Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit-4.6-snapshot-15062009 ( 65232bf00dc494ebfd978f998c88f58d18ecce1e )

2798 files changed, 236605 insertions, 92516 deletions

diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 76cfc801b9..1946d56c0d 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,303 @@
+2009-05-29  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Add a test-case for our HTTP backend, currently checking the
+        ref-counting of the SoupMessage.
+
+        * GNUmakefile.am:
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Enable the new build flag --filters for Gtk. More details in WebCore/ChangeLog.
+
+        * configure.ac:
+
+2009-05-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo and Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Add new test file for ATK.
+
+        * GNUmakefile.am:
+
+2009-05-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Fix webkitgtk_cleanfiles to clean gtk-doc-related files in the
+        correct directory, so that we pass make distcheck.
+
+        * GNUmakefile.am:
+
+2009-05-28  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version numbers in preparation for 1.1.8 release.
+
+        * configure.ac:
+
+2009-05-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Unreviewed build fix. Add gstreamer-video-0.10 libs to
+        GSTREAMER_LIBS to resolve an undefined reference to gst_video_get_size
+        - symbol used in MediaPlayerPrivateGstreamer.
+
+        * configure.ac:
+
+2009-05-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Refactor library LIBS. Move third-party libs in libwebkit instead
+        of libWebCore.
+
+        * GNUmakefile.am:
+
+2009-05-22  Antonio Gomes  <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Make Gtk build not bail out if gtk-doc-tools is not installed.
+
+        Warning message shown instead.
+
+        * autogen.sh:
+
+2009-05-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Add big warnings about the glib unicode backend being slow and
+        incomplete, since it is a work in progress.
+
+        * autotools/webkit.m4:
+        * configure.ac:
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Initial version of this patch by Jürg Billeter.
+
+        Adding options for --with-unicode-backend=icu|glib
+        and checking for pango version >= 1.21.0 if GLib backend
+        is selected. Temporarily, until remaining parts of
+        this patch are committed, introduce WTF_USE_GLIB_ICU_UNICODE_HYBRID
+        macro to allow for a mixed compilation with WTF Unicode
+        backend based on GLib while text codecs and TextBreakIterator
+        remain ICU dependent.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable YARR, and disable WREC for GTK+.
+
+        * configure.ac:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add support for running unit tests. Also run the tests whenever
+         the 'check' target runs.
+
+         * GNUmakefile.am:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Style fixes
+
+         * GNUmakefile.am:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add -no-install and -no-fast-install to programs and tests that we
+         don't install. Also remove -O2 since this is already handled at
+         configure time.
+
+         * GNUmakefile.am:
+
+2009-05-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Refactor library cflags
+
+        * GNUmakefile.am:
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Jan Alonzo.
+
+        Use AC_CANONICAL_HOST instead of AC_CANONICAL_SYSTEM, since
+        the JIT compiler is not a cross-compiler
+
+        * configure.ac:
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: bump versions in preparation for 1.1.7 release.
+
+        * configure.ac:
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Revert commit r43563, since it breaks WebKitGTK+ when compiled
+        with gcc 4.4.
+
+        * GNUmakefile.am:
+
+2009-05-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Refactor use of CFLAGS, CXXFLAGS, LIBADD and LDFLAGS.
+
+        * GNUmakefile.am:
+
+2009-05-09  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        WebKit-r43163 won't build for gtk-directfb
+        https://bugs.webkit.org/show_bug.cgi?id=25538
+
+        Move the ENCHANT check out of the with_target conditional since it
+        applies to all targets
+
+        * configure.ac:
+
+2009-05-09  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Geoffrey Garen. Landed by Jan Alonzo.
+
+        Enable JIT on x86-64 gtk+
+        https://bugs.webkit.org/show_bug.cgi?id=24724
+
+        * configure.ac:
+
+2009-05-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Ship the gtk-doc.make file, so as to not depend on gtkdoc-tools.
+
+        * GNUmakefile.am:
+        * autogen.sh:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * WebKit.pri:
+
+2009-04-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Unreviewed build GTK build fix
+
+        * configure.ac: typo fix - javascript_debugger should be enable_javascript_debugger
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * configure.ac: Add autoconfig options, missed in the first commit.
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: bump versions in preparation for 1.1.6 release.
+
+        * configure.ac:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=18344
+
+        Add webkiterror to the build.
+
+        * GNUmakefile.am:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [GTK] Error reporting
+         https://bugs.webkit.org/show_bug.cgi?id=18344
+
+         Add the default error page for installation.
+
+         * GNUmakefile.am:
+
+2009-04-24  Diego Escalante Urrelo  <diegoe@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15616
+        [GTK] Add spell checking
+
+        Add enchant support for spell-checking-languages property to work
+        properly.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
 2009-04-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Ariya Hidayat.
@@ -6,6 +306,375 @@
 
         * WebKit.pro: Include docs.pri for "make docs" target.
 
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed version bump in preparation for 1.1.5 release.
+
+        * configure.ac:
+
+2009-04-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Sam Weinig.
+
+        Added rules to maintain the localization support. We cannot simply
+        use whatever gettextize gives us because our build system is
+        non-recursive.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-04-05  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Holger Freyther.
+
+        Filter out all C++ symbols
+        https://bugs.webkit.org/show_bug.cgi?id=24960
+
+        Considering the public API is all C, we can just filter out all
+        C++ mangled symbols, which will avoid exporting symbols in some
+        corner cases such as gcc bugs on specific architectures, etc.
+
+        * autotools/symbols.filter:
+
+2009-04-03  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Require GTK+ >= 2.10; 2.8 is already very old, and some very
+        useful APIs are only available since 2.10.
+
+        * configure.ac:
+
+2009-04-01  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Holger Freyther.
+
+        Unit test WebKitDownload
+        http://bugs.webkit.org/show_bug.cgi?id=24844
+
+        * GNUmakefile.am: Add a unit test for downloading.
+
+2009-04-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Fix make distcheck, after the gtk-doc
+        integration.
+
+        * GNUmakefile.am:
+
+2009-03-30  Gustavo Noronha Silva <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Integrate gtk-doc into the Gtk+ buildsystem.
+
+        * autogen.sh:
+        * configure.ac:
+
+2009-03-30  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: bump version to 1.1.4 for release.
+
+        * configure.ac:
+
+2009-03-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        Require gnome-keyring 2.26.0, since we were depending on an
+        unreleased trunk revision between 2.25.91 and 2.26.0.
+
+        * configure.ac:
+
+2009-03-20  Jan Michael Alonzo  <jmalonzo@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Misc patches for WebKitWebHistoryItem
+        https://bugs.webkit.org/show_bug.cgi?id=24493
+
+        Added build support for build the WebKitWebHistoryItem unit test.
+
+        * GNUmakefile.am:
+
+2009-03-20  Jan Michael Alonzo  <jmalonzo@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        Separate gtk unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=24039
+
+        Build the unit tests accordingly.
+
+        * GNUmakefile.am:
+
+2009-03-17  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        Enable HTML5 media elements support by default in the GTK+ port.
+
+        * configure.ac:
+
+2009-03-17  Mike Hommey <glandium@debian.org>
+
+        Reviewed by Holger Freyther.
+
+        Do not export cti* symbols.
+        See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519924.
+
+        * autotools/symbols.filter:
+
+2009-03-15  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version to 1.1.3 for release and fix soversion
+        calculation (oops). Thanks to Frederik Himpe for pointing this
+        out.
+
+        * configure.ac:
+
+2009-03-15  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version and libtool version for release.
+
+        * configure.ac:
+
+2009-03-14  Xan Lopez  <xlopez@igalia.com>
+
+        No review, build fix.
+
+        Split clean rules to make distcheck pass.
+
+        * GNUmakefile.am:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove rarely used Makefile targets from the Makefile.
+
+        There are many situations in which the targets don't work as expected,
+        and their primary use is addressed by having the build system default
+        to building the appropriate architecture.
+
+        * Makefile.shared:
+
+2009-03-11  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Fix make clean targets
+        https://bugs.webkit.org/show_bug.cgi?id=24450
+
+        Fix 'make' clean targets. We shouldn't be removing DerivedSources
+        if it's only clean. Only remove it if it's distclean or
+        maintainer-clean. Also remove build-related auxillary files on
+        dist/maintainer clean.
+
+        * GNUmakefile.am:
+
+2009-03-11  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther
+
+        [GTK]DumpRenderTree doesn't compile for non-X11 GTK ports anymore
+        https://bugs.webkit.org/show_bug.cgi?id=2260
+
+        pangoft2 is also used in directfb builds so use it for all targets
+
+        * configure.ac:
+
+2009-03-02  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24287
+        [GTK] Move auth dialog feature to WebKit/
+
+        Add WebKitSoupAuthDialog files to build.
+
+        * GNUmakefile.am:
+
+2009-03-03  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16826
+        [Gtk] Implement WebKitDownload
+
+        Adding new files related to WebKitDownload to the GTK+ port.
+
+        * GNUmakefile.am:
+
+2009-03-02  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix; adding missing files to EXTRA_DIST, so that
+        they show up in the tarball.
+
+        * GNUmakefile.am:
+
+2009-03-01  Christian Dywan  <christian@twotoasts.de>
+
+        * configure.ac: Bump GTK port version to 1.1.1.
+
+2009-02-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix. Adding the WebKit/gtk/webkitmarshal.list
+        file to EXTRA_DIST to fix make dist.
+
+        * GNUmakefile.am:
+
+2009-02-26  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16947
+        [GTK] Missing HTTP Auth challenge
+
+        Add HTTP authentication dialog with optional GNOME Keyring
+        storage.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-02-26  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16947
+        [GTK] Missing HTTP Auth challenge
+
+        Take marshallers to be built from a manually maintained list
+        instead of grepping the sources.
+
+        It's much faster, especially so now that we want to add
+        marshallers from WebCore too. A system to only take into account
+        the modified files when generating the marshallers from sources
+        could be hacked, but I think it's overkill considering how rarely
+        a new marshaller is added.
+
+        * GNUmakefile.am:
+
+2009-02-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [Gtk] add options for 3D transforms and HTML5 channel messaging to the build
+        https://bugs.webkit.org/show_bug.cgi?id=24072
+
+        Add options for toggling 3D transforms and HTML5 channel messaging
+        support on or off.
+
+        Also fix the web-workers option. It should be web-workers and not workers.
+
+        * configure.ac:
+
+2009-02-23  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22624
+        [SOUP][GTK] Need API to get SoupSession from WebKit.
+
+        Remove CURL support, the only supported HTTP backend is SOUP now.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-02-19  Christian Dywan  <christian@twotoasts.de>
+
+        Rubber-stamped by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=22811
+        Underlinking in Programs_UnitTests (GTK+ build)
+
+        * GNUmakefile.am: Add GLIB_LIBS to unit test library flags.
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix symbols.filter location, and add other missing files to the
+        autotools build, so that make dist works.
+
+        * GNUmakefile.am:
+
+2009-02-17  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23939
+        Release build being built with debugging symbols
+
+        * configure.ac: Revert change done in revision 40790, since we
+        already have a AC_PROG_CXX macro call as part of WEBKIT_INIT
+
+2009-02-12  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Eric Seidel.
+
+        * configure.ac: Make soup the default HTTP backend for the Gtk port.
+
+2009-02-09  Calvin Walton  <calvin.walton@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23823
+
+        [Gtk] Fix build with recent autotools
+
+        Current versions of automake/libtool don't assume you want C++ enabled
+        by default any more, so explicitly check for a C++ compiler.
+
+        * configure.ac: Add AC_PROG_CXX macro
+
+2009-02-02  Christian Dywan  <christian@twotoasts.de>
+
+        Rubber-stamped by Holger Freyther.
+
+        Don't require Geolocation by default.
+
+        * configure.ac:
+
+2009-01-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [Gtk] Refactor autoconf/configure.ac in preparation for jsc and webkit build splits
+        https://bugs.webkit.org/show_bug.cgi?id=22136
+
+        * GNUmakefile.am:
+        * acinclude.m4: Removed.
+        * autogen.sh:
+        * autotools/acinclude.m4: Added.
+        * autotools/dolt.m4: Added.
+        * autotools/symbols.filter: Renamed from symbols.filter.
+        * autotools/webkit.m4: Added.
+        * configure.ac:
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [GTK] Implement GeolocationService using the Geoclue library
+
+        https://bugs.webkit.org/show_bug.cgi?id=22022
+
+        Untested implementation of the GeolocationService using the geoclue
+        library. Velocity handling is completely missing and the accuracy
+        handling might be wrong.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-01-11  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Bump version to 1.1.0 since we are breaking ABI and adding new
+        major features.
+
+        * configure.ac:
+
 2008-12-19  Marco Barisione  <marco.barisione@collabora.co.uk>
 
         Reviewed by Holger Freyther.
@@ -203,7 +872,7 @@
 2008-11-16  Geoffrey Garen  <ggaren@apple.com>
 
         Not reviewed.
-        
+
         Try to fix gtk build.
 
         * configure.ac:
@@ -801,7 +1470,7 @@
         Reviewed by Mark.
 
         Add x86_64 rule.
-        
+
         * Makefile:
 
 2008-05-09  Simon Hausmann  <hausmann@webkit.org>
@@ -809,11 +1478,11 @@
         Reviewed by Holger.
 
         Removed explicit linkage against libxml and libxslt on Qt/Mac builds.
-        
+
         This dependency is completely unnecessary here and creates only problems by
         propagating through WebCore.pro over libQtWebKit.prl right now customer
         applications.
-        
+
 
         * WebKit.pri:
 
@@ -822,7 +1491,7 @@
         Reviewed by Mark.
 
         Add an "x86_64" make rule.
-        
+
         * Makefile.shared:
 
 2008-05-02  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
@@ -973,7 +1642,7 @@
         http://bugs.webkit.org/show_bug.cgi?id=16476
 
         Add support for multiple http backends, and add soup backend (off by default).
-        
+
         * GNUmakefile.am:
         * configure.ac:
 
@@ -1060,7 +1729,7 @@
         Add separator '\' after libJavaScriptCore_la_LIBADD and cleanup
         whitespaces introduced in the previous commit.
 
-        * GNUmakefile.am: 
+        * GNUmakefile.am:
 
 2008-02-23  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
 
@@ -2452,7 +3121,7 @@
         Reviewed by Lars.
 
         Don't compile the ICO plugin when building against Qt >= 4.4
-        
+
 
         * WebKit.pro:
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index d356bca860..762a15e899 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -26,7 +26,10 @@
 #ifndef APICast_h
 #define APICast_h
 
+#include "JSNumberCell.h"
 #include "JSValue.h"
+#include <wtf/Platform.h>
+#include <wtf/UnusedParam.h>
 
 namespace JSC {
     class ExecState;
@@ -34,7 +37,6 @@ namespace JSC {
     class JSGlobalData;
     class JSObject;
     class JSValue;
-    class JSValuePtr;
 }
 
 typedef const struct OpaqueJSContextGroup* JSContextGroupRef;
@@ -56,9 +58,18 @@ inline JSC::ExecState* toJS(JSGlobalContextRef c)
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValuePtr toJS(JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
-    return JSC::JSValuePtr::decode(reinterpret_cast<JSC::JSValueEncodedAsPointer*>(const_cast<OpaqueJSValue*>(v)));
+    JSC::JSValue jsValue = JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#if USE(ALTERNATE_JSIMMEDIATE)
+    UNUSED_PARAM(exec);
+#else
+    if (jsValue && jsValue.isNumber()) {
+        ASSERT(jsValue.isAPIMangledNumber());
+        return JSC::jsNumber(exec, jsValue.uncheckedGetNumber());
+    }
+#endif
+    return jsValue;
 }
 
 inline JSC::JSObject* toJS(JSObjectRef o)
@@ -76,14 +87,17 @@ inline JSC::JSGlobalData* toJS(JSContextGroupRef g)
     return reinterpret_cast<JSC::JSGlobalData*>(const_cast<OpaqueJSContextGroup*>(g));
 }
 
-inline JSValueRef toRef(JSC::JSValuePtr v)
+inline JSValueRef toRef(JSC::ExecState* exec, JSC::JSValue v)
 {
-    return reinterpret_cast<JSValueRef>(JSC::JSValuePtr::encode(v));
-}
-
-inline JSValueRef* toRef(JSC::JSValuePtr* v)
-{
-    return reinterpret_cast<JSValueRef*>(v);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    UNUSED_PARAM(exec);
+#else
+    if (v && v.isNumber()) {
+        ASSERT(!v.isAPIMangledNumber());
+        return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(JSC::jsAPIMangledNumber(exec, v.uncheckedGetNumber())));
+    }
+#endif
+    return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(v));
 }
 
 inline JSObjectRef toRef(JSC::JSObject* o)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
index 2ffe345d44..fc3d0fe1bc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
@@ -55,15 +55,15 @@ JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef th
 
     if (completion.complType() == Throw) {
         if (exception)
-            *exception = toRef(completion.value());
+            *exception = toRef(exec, completion.value());
         return 0;
     }
-    
+
     if (completion.value())
-        return toRef(completion.value());
+        return toRef(exec, completion.value());
     
     // happens, for example, when the only statement is an empty (';') statement
-    return toRef(jsUndefined());
+    return toRef(exec, jsUndefined());
 }
 
 bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
@@ -76,7 +76,7 @@ bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourc
     Completion completion = checkSyntax(exec->dynamicGlobalObject()->globalExec(), source);
     if (completion.complType() == Throw) {
         if (exception)
-            *exception = toRef(completion.value());
+            *exception = toRef(exec, completion.value());
         return false;
     }
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
index f44d4ad883..6f012cac83 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
@@ -65,14 +65,20 @@ typedef struct OpaqueJSValue* JSObjectRef;
 /* JavaScript symbol exports */
 
 #undef JS_EXPORT
-#if defined(__GNUC__)
+#if defined(BUILDING_WX__)
+    #define JS_EXPORT
+#elif defined(__GNUC__)
     #define JS_EXPORT __attribute__((visibility("default")))
 #elif defined(WIN32) || defined(_WIN32)
     /*
      * TODO: Export symbols with JS_EXPORT when using MSVC.
      * See http://bugs.webkit.org/show_bug.cgi?id=16227
      */
-    #define JS_EXPORT
+    #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+    #define JS_EXPORT __declspec(dllexport)
+    #else
+    #define JS_EXPORT __declspec(dllimport)
+    #endif
 #else
     #define JS_EXPORT
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h
index 6beacda221..befa31643e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h
@@ -43,7 +43,7 @@ owns a large non-GC memory region. Calling this function will encourage the
 garbage collector to collect soon, hoping to reclaim that large non-GC memory
 region.
 */
-JS_EXPORT void JSReportExtraMemoryCost(JSContextRef ctx, size_t size) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT void JSReportExtraMemoryCost(JSContextRef ctx, size_t size) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 #ifdef __cplusplus
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
index e10733e821..64c83cb04d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -61,10 +61,17 @@ static JSObject* constructJSCallback(ExecState* exec, JSObject* constructor, con
         int argumentCount = static_cast<int>(args.size());
         Vector<JSValueRef, 16> arguments(argumentCount);
         for (int i = 0; i < argumentCount; i++)
-            arguments[i] = toRef(args.at(exec, i));
-            
-        JSLock::DropAllLocks dropAllLocks(exec);
-        return toJS(callback(ctx, constructorRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+            arguments[i] = toRef(exec, args.at(i));
+
+        JSValueRef exception = 0;
+        JSObjectRef result;
+        {
+            JSLock::DropAllLocks dropAllLocks(exec);
+            result = callback(ctx, constructorRef, argumentCount, arguments.data(), &exception);
+        }
+        if (exception)
+            exec->setException(toJS(exec, exception));
+        return toJS(result);
     }
     
     return toJS(JSObjectMake(ctx, static_cast<JSCallbackConstructor*>(constructor)->classRef(), 0));
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index cb8307fad9..1f0624911b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -39,7 +39,7 @@ public:
     JSObjectCallAsConstructorCallback callback() const { return m_callback; }
     static const ClassInfo info;
     
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
index b82932e69b..1b3217b404 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -46,19 +46,27 @@ JSCallbackFunction::JSCallbackFunction(ExecState* exec, JSObjectCallAsFunctionCa
 {
 }
 
-JSValuePtr JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef functionRef = toRef(functionObject);
-    JSObjectRef thisObjRef = toRef(thisValue->toThisObject(exec));
+    JSObjectRef thisObjRef = toRef(thisValue.toThisObject(exec));
 
     int argumentCount = static_cast<int>(args.size());
     Vector<JSValueRef, 16> arguments(argumentCount);
     for (int i = 0; i < argumentCount; i++)
-        arguments[i] = toRef(args.at(exec, i));
+        arguments[i] = toRef(exec, args.at(i));
 
-    JSLock::DropAllLocks dropAllLocks(exec);
-    return toJS(static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+    JSValueRef exception = 0;
+    JSValueRef result;
+    {
+        JSLock::DropAllLocks dropAllLocks(exec);
+        result = static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception);
+    }
+    if (exception)
+        exec->setException(toJS(exec, exception));
+
+    return toJS(exec, result);
 }
 
 CallType JSCallbackFunction::getCallData(CallData& callData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 46f6fccfcf..7dd87b59b5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -39,7 +39,7 @@ public:
     
     // InternalFunction mish-mashes constructor and function behavior -- we should 
     // refactor the code so this override isn't necessary
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot)); 
     }
@@ -48,7 +48,7 @@ private:
     virtual CallType getCallData(CallData&);
     virtual const ClassInfo* classInfo() const { return &info; }
 
-    static JSValuePtr call(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    static JSValue JSC_HOST_CALL call(ExecState*, JSObject*, JSValue, const ArgList&);
 
     JSObjectCallAsFunctionCallback m_callback;
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index 9001c43925..9d22ad91f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -48,7 +48,7 @@ public:
     JSClassRef classRef() const { return m_callbackObjectData->jsClass; }
     bool inherits(JSClassRef) const;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | OverridesHasInstance)); 
     }
@@ -59,12 +59,12 @@ private:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
     
-    virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
+    virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
     virtual bool deleteProperty(ExecState*, const Identifier&);
     virtual bool deleteProperty(ExecState*, unsigned);
 
-    virtual bool hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto);
+    virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
@@ -77,14 +77,14 @@ private:
 
     void init(ExecState*);
  
-    static JSCallbackObject* asCallbackObject(JSValuePtr);
+    static JSCallbackObject* asCallbackObject(JSValue);
  
-    static JSValuePtr call(ExecState*, JSObject* functionObject, JSValuePtr thisValue, const ArgList&);
+    static JSValue JSC_HOST_CALL call(ExecState*, JSObject* functionObject, JSValue thisValue, const ArgList&);
     static JSObject* construct(ExecState*, JSObject* constructor, const ArgList&);
    
-    static JSValuePtr staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     struct JSCallbackObjectData {
         JSCallbackObjectData(void* privateData, JSClassRef jsClass)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
index fdbafbc99f..987c59f529 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -40,7 +40,7 @@
 namespace JSC {
 
 template <class Base>
-inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValuePtr value)
+inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValue value)
 {
     ASSERT(asObject(value)->inherits(&info));
     return static_cast<JSCallbackObject*>(asObject(value));
@@ -99,7 +99,7 @@ template <class Base>
 UString JSCallbackObject<Base>::className() const
 {
     UString thisClassName = classRef()->className();
-    if (!thisClassName.isNull())
+    if (!thisClassName.isEmpty())
         return thisClassName;
     
     return Base::className();
@@ -125,9 +125,19 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
         } else if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (JSValueRef value = getProperty(ctx, thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot()))) {
-                slot.setValue(toJS(value));
+            JSValueRef exception = 0;
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (value) {
+                slot.setValue(toJS(exec, value));
+                return true;
+            }
+            if (exception) {
+                slot.setValue(jsUndefined());
                 return true;
             }
         }
@@ -157,19 +167,25 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, unsigned proper
 }
 
 template <class Base>
-void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSContextRef ctx = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     RefPtr<OpaqueJSString> propertyNameRef;
-    JSValueRef valueRef = toRef(value);
+    JSValueRef valueRef = toRef(exec, value);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectSetPropertyCallback setProperty = jsClass->setProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, toRef(exec->exceptionSlot())))
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (result || exception)
                 return;
         }
         
@@ -180,8 +196,14 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
                 if (JSObjectSetPropertyCallback setProperty = entry->setProperty) {
                     if (!propertyNameRef)
                         propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-                    JSLock::DropAllLocks dropAllLocks(exec);
-                    if (setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, toRef(exec->exceptionSlot())))
+                    JSValueRef exception = 0;
+                    bool result;
+                    {
+                        JSLock::DropAllLocks dropAllLocks(exec);
+                        result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+                    }
+                    exec->setException(toJS(exec, exception));
+                    if (result || exception)
                         return;
                 } else
                     throwError(exec, ReferenceError, "Attempt to set a property that is not settable.");
@@ -212,8 +234,14 @@ bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& p
         if (JSObjectDeletePropertyCallback deleteProperty = jsClass->deleteProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (deleteProperty(ctx, thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot())))
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (result || exception)
                 return true;
         }
         
@@ -266,9 +294,15 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
             int argumentCount = static_cast<int>(args.size());
             Vector<JSValueRef, 16> arguments(argumentCount);
             for (int i = 0; i < argumentCount; i++)
-                arguments[i] = toRef(args.at(exec, i));
-            JSLock::DropAllLocks dropAllLocks(exec);
-            return toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+                arguments[i] = toRef(exec, args.at(i));
+            JSValueRef exception = 0;
+            JSObject* result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
+            }
+            exec->setException(toJS(exec, exception));
+            return result;
         }
     }
     
@@ -277,15 +311,21 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
 }
 
 template <class Base>
-bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr)
+bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectHasInstanceCallback hasInstance = jsClass->hasInstance) {
-            JSLock::DropAllLocks dropAllLocks(exec);
-            return hasInstance(execRef, thisRef, toRef(value), toRef(exec->exceptionSlot()));
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = hasInstance(execRef, thisRef, toRef(exec, value), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            return result;
         }
     }
     return false;
@@ -304,25 +344,31 @@ CallType JSCallbackObject<Base>::getCallData(CallData& callData)
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef functionRef = toRef(functionObject);
-    JSObjectRef thisObjRef = toRef(thisValue->toThisObject(exec));
+    JSObjectRef thisObjRef = toRef(thisValue.toThisObject(exec));
     
     for (JSClassRef jsClass = static_cast<JSCallbackObject<Base>*>(functionObject)->classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectCallAsFunctionCallback callAsFunction = jsClass->callAsFunction) {
             int argumentCount = static_cast<int>(args.size());
             Vector<JSValueRef, 16> arguments(argumentCount);
             for (int i = 0; i < argumentCount; i++)
-                arguments[i] = toRef(args.at(exec, i));
-            JSLock::DropAllLocks dropAllLocks(exec);
-            return toJS(callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+                arguments[i] = toRef(exec, args.at(i));
+            JSValueRef exception = 0;
+            JSValue result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
+            }
+            exec->setException(toJS(exec, exception));
+            return result;
         }
     }
     
     ASSERT_NOT_REACHED(); // getCallData should prevent us from reaching here
-    return noValue();
+    return JSValue();
 }
 
 template <class Base>
@@ -376,9 +422,17 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
         if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (JSValueRef value = convertToType(ctx, thisRef, kJSTypeNumber, toRef(exec->exceptionSlot())))
-                return toJS(value)->getNumber();
+            JSValueRef exception = 0;
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (value) {
+                double dValue;
+                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
+            }
         }
             
     return Base::toNumber(exec);
@@ -392,13 +446,17 @@ UString JSCallbackObject<Base>::toString(ExecState* exec) const
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
         if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
+            JSValueRef exception = 0;
             JSValueRef value;
             {
                 JSLock::DropAllLocks dropAllLocks(exec);
-                value = convertToType(ctx, thisRef, kJSTypeString, toRef(exec->exceptionSlot()));
+                value = convertToType(ctx, thisRef, kJSTypeString, &exception);
             }
+            exec->setException(toJS(exec, exception));
             if (value)
-                return toJS(value)->getString();
+                return toJS(exec, value).getString();
+            if (exception)
+                return "";
         }
             
     return Base::toString(exec);
@@ -427,7 +485,7 @@ bool JSCallbackObject<Base>::inherits(JSClassRef c) const
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -440,16 +498,24 @@ JSValuePtr JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Iden
                 if (JSObjectGetPropertyCallback getProperty = entry->getProperty) {
                     if (!propertyNameRef)
                         propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-                    JSLock::DropAllLocks dropAllLocks(exec);
-                    if (JSValueRef value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot())))
-                        return toJS(value);
+                    JSValueRef exception = 0;
+                    JSValueRef value;
+                    {
+                        JSLock::DropAllLocks dropAllLocks(exec);
+                        value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
+                    }
+                    exec->setException(toJS(exec, exception));
+                    if (value)
+                        return toJS(exec, value);
+                    if (exception)
+                        return jsUndefined();
                 }
                     
     return throwError(exec, ReferenceError, "Static value property defined with NULL getProperty callback.");
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -474,7 +540,7 @@ JSValuePtr JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const I
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -485,9 +551,17 @@ JSValuePtr JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identif
         if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (JSValueRef value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot())))
-                return toJS(value);
+            JSValueRef exception = 0;
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (value)
+                return toJS(exec, value);
+            if (exception)
+                return jsUndefined();
         }
             
     return throwError(exec, ReferenceError, "hasProperty callback returned true for a property that doesn't exist.");
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
index 77a33f058c..afde7ce1a2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
@@ -111,7 +111,7 @@ PassRefPtr<OpaqueJSClass> OpaqueJSClass::createNoAutomaticPrototype(const JSClas
     return adoptRef(new OpaqueJSClass(definition, 0));
 }
 
-void clearReferenceToPrototype(JSObjectRef prototype)
+static void clearReferenceToPrototype(JSObjectRef prototype)
 {
     OpaqueJSClassContextData* jsClassData = static_cast<OpaqueJSClassContextData*>(JSObjectGetPrivate(prototype));
     ASSERT(jsClassData);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
index 40c45d331a..a3bdc69ab2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
@@ -44,6 +44,7 @@ using namespace JSC;
 
 JSContextGroupRef JSContextGroupCreate()
 {
+    initializeThreading();
     return toRef(JSGlobalData::create().releaseRef());
 }
 
@@ -60,6 +61,7 @@ void JSContextGroupRelease(JSContextGroupRef group)
 
 JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
 {
+    initializeThreading();
 #if PLATFORM(DARWIN)
     // When running on Tiger or Leopard, or if the application was linked before JSGlobalContextCreate was changed
     // to use a unique JSGlobalData, we use a shared one for compatibility.
@@ -95,7 +97,7 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 
     JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(globalObjectClass);
     ExecState* exec = globalObject->globalExec();
-    JSValuePtr prototype = globalObjectClass->prototype(exec);
+    JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
         prototype = jsNull();
     globalObject->resetPrototype(prototype);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h
index bc89511cb8..c5c8a71e64 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h
@@ -48,7 +48,7 @@ extern "C" {
  synchronization is required.
 @result The created JSContextGroup.
 */
-JS_EXPORT JSContextGroupRef JSContextGroupCreate() AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSContextGroupRef JSContextGroupCreate() AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
@@ -56,14 +56,14 @@ JS_EXPORT JSContextGroupRef JSContextGroupCreate() AVAILABLE_AFTER_WEBKIT_VERSIO
 @param group The JSContextGroup to retain.
 @result A JSContextGroup that is the same as group.
 */
-JS_EXPORT JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
 @abstract Releases a JavaScript context group.
 @param group The JSContextGroup to release.
 */
-JS_EXPORT void JSContextGroupRelease(JSContextGroupRef group) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT void JSContextGroupRelease(JSContextGroupRef group) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
@@ -92,7 +92,7 @@ JS_EXPORT JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
 @result A JSGlobalContext with a global object of class globalObjectClass and a context
  group equal to group.
 */
-JS_EXPORT JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClassRef globalObjectClass) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClassRef globalObjectClass) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
@@ -123,7 +123,7 @@ JS_EXPORT JSObjectRef JSContextGetGlobalObject(JSContextRef ctx);
 @param ctx The JSContext whose group you want to get.
 @result ctx's group.
 */
-JS_EXPORT JSContextGroupRef JSContextGetGroup(JSContextRef ctx) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSContextGroupRef JSContextGetGroup(JSContextRef ctx) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 #ifdef __cplusplus
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
index c08b8b0e2f..50ee6354f9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
@@ -32,6 +32,7 @@
 #include "ErrorConstructor.h"
 #include "FunctionConstructor.h"
 #include "Identifier.h"
+#include "InitializeThreading.h"
 #include "JSArray.h"
 #include "JSCallbackConstructor.h"
 #include "JSCallbackFunction.h"
@@ -52,6 +53,7 @@ using namespace JSC;
 
 JSClassRef JSClassCreate(const JSClassDefinition* definition)
 {
+    initializeThreading();
     RefPtr<OpaqueJSClass> jsClass = (definition->attributes & kJSClassAttributeNoAutomaticPrototype)
         ? OpaqueJSClass::createNoAutomaticPrototype(definition)
         : OpaqueJSClass::create(definition);
@@ -103,10 +105,10 @@ JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObje
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsPrototype = jsClass 
-        ? jsClass->prototype(exec)
-        : exec->lexicalGlobalObject()->objectPrototype();
-    
+    JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
+    if (!jsPrototype)
+        jsPrototype = exec->lexicalGlobalObject()->objectPrototype();
+
     JSCallbackConstructor* constructor = new (exec) JSCallbackConstructor(exec->lexicalGlobalObject()->callbackConstructorStructure(), jsClass, callAsConstructor);
     constructor->putDirect(exec->propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
     return toRef(constructor);
@@ -120,7 +122,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     for (unsigned i = 0; i < parameterCount; i++)
         args.append(jsString(exec, parameterNames[i]->ustring()));
     args.append(jsString(exec, body->ustring()));
@@ -128,7 +130,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
     JSObject* result = constructFunction(exec, args, nameID, sourceURL->ustring(), startingLineNumber);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -143,9 +145,9 @@ JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSVa
 
     JSObject* result;
     if (argumentCount) {
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         for (size_t i = 0; i < argumentCount; ++i)
-            argList.append(toJS(arguments[i]));
+            argList.append(toJS(exec, arguments[i]));
 
         result = constructArray(exec, argList);
     } else
@@ -153,7 +155,7 @@ JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSVa
 
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -167,14 +169,14 @@ JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSVal
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructDate(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -188,14 +190,14 @@ JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSVa
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructError(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -209,14 +211,14 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructRegExp(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -224,18 +226,26 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
     return toRef(result);
 }
 
-JSValueRef JSObjectGetPrototype(JSContextRef, JSObjectRef object)
+JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 {
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
     JSObject* jsObject = toJS(object);
-    return toRef(jsObject->prototype());
+    return toRef(exec, jsObject->prototype());
 }
 
-void JSObjectSetPrototype(JSContextRef, JSObjectRef object, JSValueRef value)
+void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
 {
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
     JSObject* jsObject = toJS(object);
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
-    jsObject->setPrototype(jsValue->isObject() ? jsValue : jsNull());
+    jsObject->setPrototype(jsValue.isObject() ? jsValue : jsNull());
 }
 
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
@@ -257,13 +267,13 @@ JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef
 
     JSObject* jsObject = toJS(object);
 
-    JSValuePtr jsValue = jsObject->get(exec, propertyName->identifier(&exec->globalData()));
+    JSValue jsValue = jsObject->get(exec, propertyName->identifier(&exec->globalData()));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
-    return toRef(jsValue);
+    return toRef(exec, jsValue);
 }
 
 void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception)
@@ -274,7 +284,7 @@ void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->globalData()));
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
     if (attributes && !jsObject->hasProperty(exec, name))
         jsObject->putWithAttributes(exec, name, jsValue, attributes);
@@ -285,7 +295,7 @@ void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
 }
@@ -298,13 +308,13 @@ JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsi
 
     JSObject* jsObject = toJS(object);
 
-    JSValuePtr jsValue = jsObject->get(exec, propertyIndex);
+    JSValue jsValue = jsObject->get(exec, propertyIndex);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
-    return toRef(jsValue);
+    return toRef(exec, jsValue);
 }
 
 
@@ -315,12 +325,12 @@ void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned p
     JSLock lock(exec);
 
     JSObject* jsObject = toJS(object);
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
     jsObject->put(exec, propertyIndex, jsValue);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
 }
@@ -336,7 +346,7 @@ bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef pr
     bool result = jsObject->deleteProperty(exec, propertyName->identifier(&exec->globalData()));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
@@ -387,19 +397,19 @@ JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObject
     if (!jsThisObject)
         jsThisObject = exec->globalThisValue();
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; i++)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     CallData callData;
     CallType callType = jsObject->getCallData(callData);
     if (callType == CallTypeNone)
         return 0;
 
-    JSValueRef result = toRef(call(exec, jsObject, callType, callData, jsThisObject, argList));
+    JSValueRef result = toRef(exec, call(exec, jsObject, callType, callData, jsThisObject, argList));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -426,13 +436,13 @@ JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size
     if (constructType == ConstructTypeNone)
         return 0;
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; i++)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
     JSObjectRef result = toRef(construct(exec, jsObject, constructType, constructData, argList));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -465,7 +475,7 @@ JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef o
     jsObject->getPropertyNames(exec, array);
 
     size_t size = array.size();
-    propertyNames->array.reserveCapacity(size);
+    propertyNames->array.reserveInitialCapacity(size);
     for (size_t i = 0; i < size; ++i)
         propertyNames->array.append(JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(array[i].ustring()).releaseRef()));
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
index 461764c4fa..3e8b0eb62e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
@@ -441,7 +441,7 @@ JS_EXPORT JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsCla
  @discussion The behavior of this function does not exactly match the behavior of the built-in Array constructor. Specifically, if one argument 
  is supplied, this function returns an array with one element.
  */
-JS_EXPORT JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
  @function
@@ -452,7 +452,7 @@ JS_EXPORT JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount,
  @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
  @result A JSObject that is a Date.
  */
-JS_EXPORT JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
  @function
@@ -463,7 +463,7 @@ JS_EXPORT JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, c
  @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
  @result A JSObject that is a Error.
  */
-JS_EXPORT JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
  @function
@@ -474,7 +474,7 @@ JS_EXPORT JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount,
  @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
  @result A JSObject that is a RegExp.
  */
-JS_EXPORT JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp
index 6452ffc215..8e236e4582 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSStringRef.h"
 
+#include "InitializeThreading.h"
 #include "OpaqueJSString.h"
 #include <wtf/unicode/UTF8.h>
 
@@ -34,11 +35,13 @@ using namespace WTF::Unicode;
 
 JSStringRef JSStringCreateWithCharacters(const JSChar* chars, size_t numChars)
 {
+    initializeThreading();
     return OpaqueJSString::create(chars, numChars).releaseRef();
 }
 
 JSStringRef JSStringCreateWithUTF8CString(const char* string)
 {
+    initializeThreading();
     if (string) {
         size_t length = strlen(string);
         Vector<UChar, 1024> buffer(length);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp
index 65edd091aa..d1f6fe3303 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp
@@ -27,6 +27,7 @@
 #include "JSStringRefCF.h"
 
 #include "APICast.h"
+#include "InitializeThreading.h"
 #include "JSStringRef.h"
 #include "OpaqueJSString.h"
 #include <runtime/UString.h>
@@ -35,7 +36,11 @@
 
 JSStringRef JSStringCreateWithCFString(CFStringRef string)
 {
-    CFIndex length = CFStringGetLength(string);
+    JSC::initializeThreading();
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());
@@ -44,7 +49,7 @@ JSStringRef JSStringCreateWithCFString(CFStringRef string)
     } else {
         return OpaqueJSString::create(0, 0).releaseRef();
     }
-    }
+}
 
 CFStringRef JSStringCopyCFString(CFAllocatorRef alloc, JSStringRef string)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
index 351a1050a9..2207181bd6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
@@ -41,66 +41,99 @@
 
 #include <algorithm> // for std::min
 
-JSType JSValueGetType(JSContextRef, JSValueRef value)
+JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
 {
-    JSC::JSValuePtr jsValue = toJS(value);
-    if (jsValue->isUndefined())
+    JSC::ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSC::JSLock lock(exec);
+
+    JSC::JSValue jsValue = toJS(exec, value);
+
+    if (jsValue.isUndefined())
         return kJSTypeUndefined;
-    if (jsValue->isNull())
+    if (jsValue.isNull())
         return kJSTypeNull;
-    if (jsValue->isBoolean())
+    if (jsValue.isBoolean())
         return kJSTypeBoolean;
-    if (jsValue->isNumber())
+    if (jsValue.isNumber())
         return kJSTypeNumber;
-    if (jsValue->isString())
+    if (jsValue.isString())
         return kJSTypeString;
-    ASSERT(jsValue->isObject());
+    ASSERT(jsValue.isObject());
     return kJSTypeObject;
 }
 
 using namespace JSC; // placed here to avoid conflict between JSC::JSType and JSType, above.
 
-bool JSValueIsUndefined(JSContextRef, JSValueRef value)
+bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isUndefined();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isUndefined();
 }
 
-bool JSValueIsNull(JSContextRef, JSValueRef value)
+bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isNull();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isNull();
 }
 
-bool JSValueIsBoolean(JSContextRef, JSValueRef value)
+bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isBoolean();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isBoolean();
 }
 
-bool JSValueIsNumber(JSContextRef, JSValueRef value)
+bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isNumber();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isNumber();
 }
 
-bool JSValueIsString(JSContextRef, JSValueRef value)
+bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isString();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isString();
 }
 
-bool JSValueIsObject(JSContextRef, JSValueRef value)
+bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isObject();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isObject();
 }
 
-bool JSValueIsObjectOfClass(JSContextRef, JSValueRef value, JSClassRef jsClass)
+bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     
-    if (JSObject* o = jsValue->getObject()) {
+    if (JSObject* o = jsValue.getObject()) {
         if (o->inherits(&JSCallbackObject<JSGlobalObject>::info))
             return static_cast<JSCallbackObject<JSGlobalObject>*>(o)->inherits(jsClass);
         else if (o->inherits(&JSCallbackObject<JSObject>::info))
@@ -115,25 +148,28 @@ bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* ex
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsA = toJS(a);
-    JSValuePtr jsB = toJS(b);
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
 
-    bool result = equal(exec, jsA, jsB); // false if an exception is thrown
+    bool result = JSValue::equal(exec, jsA, jsB); // false if an exception is thrown
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
 }
 
-bool JSValueIsStrictEqual(JSContextRef, JSValueRef a, JSValueRef b)
+bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
 {
-    JSValuePtr jsA = toJS(a);
-    JSValuePtr jsB = toJS(b);
-    
-    bool result = strictEqual(jsA, jsB);
-    return result;
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
+
+    return JSValue::strictEqual(jsA, jsB);
 }
 
 bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
@@ -142,32 +178,45 @@ bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObject
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
+
     JSObject* jsConstructor = toJS(constructor);
     if (!jsConstructor->structure()->typeInfo().implementsHasInstance())
         return false;
     bool result = jsConstructor->hasInstance(exec, jsValue, jsConstructor->get(exec, exec->propertyNames().prototype)); // false if an exception is thrown
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
 }
 
-JSValueRef JSValueMakeUndefined(JSContextRef)
+JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 {
-    return toRef(jsUndefined());
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsUndefined());
 }
 
-JSValueRef JSValueMakeNull(JSContextRef)
+JSValueRef JSValueMakeNull(JSContextRef ctx)
 {
-    return toRef(jsNull());
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsNull());
 }
 
-JSValueRef JSValueMakeBoolean(JSContextRef, bool value)
+JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 {
-    return toRef(jsBoolean(value));
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsBoolean(value));
 }
 
 JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
@@ -176,7 +225,7 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    return toRef(jsNumber(exec, value));
+    return toRef(exec, jsNumber(exec, value));
 }
 
 JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
@@ -185,14 +234,17 @@ JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    return toRef(jsString(exec, string->ustring()));
+    return toRef(exec, jsString(exec, string->ustring()));
 }
 
 bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->toBoolean(exec);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.toBoolean(exec);
 }
 
 double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
@@ -201,12 +253,12 @@ double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
-    double number = jsValue->toNumber(exec);
+    double number = jsValue.toNumber(exec);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         number = NaN;
     }
@@ -219,12 +271,12 @@ JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef*
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
-    RefPtr<OpaqueJSString> stringRef(OpaqueJSString::create(jsValue->toString(exec)));
+    RefPtr<OpaqueJSString> stringRef(OpaqueJSString::create(jsValue.toString(exec)));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         stringRef.clear();
     }
@@ -237,12 +289,12 @@ JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exce
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
-    JSObjectRef objectRef = toRef(jsValue->toObject(exec));
+    JSObjectRef objectRef = toRef(jsValue.toObject(exec));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         objectRef = 0;
     }
@@ -255,7 +307,7 @@ void JSValueProtect(JSContextRef ctx, JSValueRef value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     gcProtect(jsValue);
 }
 
@@ -265,6 +317,6 @@ void JSValueUnprotect(JSContextRef ctx, JSValueRef value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     gcUnprotect(jsValue);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
index 127336095a..8402528317 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
@@ -38,6 +38,7 @@
 #define WEBKIT_VERSION_2_0    0x0200
 #define WEBKIT_VERSION_3_0    0x0300
 #define WEBKIT_VERSION_3_1    0x0310
+#define WEBKIT_VERSION_4_0    0x0400
 #define WEBKIT_VERSION_LATEST 0x9999
 
 #ifdef __APPLE__
@@ -640,123 +641,123 @@
 
 
 /*
- * AVAILABLE_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_IN_WEBKIT_VERSION_4_0
  * 
- * Used on declarations introduced after WebKit 3.1
+ * Used on declarations introduced in WebKit 4.0
  */
 #if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1     UNAVAILABLE_ATTRIBUTE
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
 #elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1     WEAK_IMPORT_ATTRIBUTE
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
 #else
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0
 #endif
 
 /*
- * AVAILABLE_AFTER_WEBKIT_VERSION_3_1_BUT_DEPRECATED
+ * AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED
  * 
- * Used on declarations introduced after WebKit 3.1, 
- * and deprecated after WebKit 3.1
+ * Used on declarations introduced in WebKit 4.0, 
+ * and deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1_BUT_DEPRECATED    AVAILABLE_AFTER_WEBKIT_VERSION_3_1
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_IN_WEBKIT_VERSION_4_0
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.0, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.1, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.2, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.3, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 2.0, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 3.0, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 3.1, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
 #endif
 
 /*
- * DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
- * Used on types deprecated after WebKit 3.1
+ * Used on types deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+    #define DEPRECATED_IN_WEBKIT_VERSION_4_0
 #endif
 
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 3321570176..fbda5150fd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,59 +1,10236 @@
-2009-01-22  Oliver Hunt  <oliver@apple.com>
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $QMAKE_PATH_SEP instead of hardcoded / to fix Windows build
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        RS by Sam Weinig.
+
+        Remove bonus bogus \n from last commit.
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change the implementation of op_throw so the stub function always modifies its
+        return address - if it doesn't find a 'catch' it will switch to a trampoline
+        to force a return from JIT execution.  This saves memory, by avoiding the need
+        for a unique return for every op_throw.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+            JITStubs::cti_op_throw now always changes its return address,
+            remove return code generated after the stub call (this is now
+            handled by ctiOpThrowNotCaught).
+        * jit/JITStubs.cpp:
+        (JSC::):
+            Add ctiOpThrowNotCaught definitions.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            Change cti_op_throw to always change its return address.
+        * jit/JITStubs.h:
+            Add ctiOpThrowNotCaught declaration.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rudder stamped by Sam Weinig.
+
+        Add missing ASSERT.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getRelocatedAddress):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Switch storePtrWithPatch to take the initial immediate value as an argument.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jsr):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove patchLength..tByIdExternalLoadPrefix magic numbers from JIT.h.
+
+        These aren't really suitable values to be tracking within common code
+        of the JIT, since they are not (and realistically cannot) be checked
+        by ASSERTs, as the other repatch offsets are.  Move this functionality
+        (skipping the REX prefix when patching load instructions to LEAs on
+        x86-64) into the X86Assembler.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadPtrToLEA):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-06-05  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Bug 26160: Compile fails in MacOSX when GNU fileutils are installed
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26160>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use /bin/ln instead of ln for cases where this command is used with -h option.
+        As this option is not supported by GNU fileutils, this change helps users 
+        who have GNU fileutils in their PATH.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove DoubleNotEqual floating point comparison condition for now -
+        it is not used, and it is unclear the semantics are correct (I think
+        this comparison would actually give you not-equal-or-unordered, which
+        might be what is wanted... we can revisit this interface & get it
+        right when required).
+
+        Also, fix asserts in branchArith32 ops.  All adds & subs can check
+        for Signed, multiply only sets OF so can only check for overflow.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Minor tidy up in JITStubs.
+
+        * jit/JITStubs.cpp:
+        (JSC::StackHack::StackHack):
+        * jit/JITStubs.h:
+
+2009-06-05  Koen Kooi <koen@dominion.thruhere.net>
+
+        Reviewed by Xan Lopez.
+
+        Build fix for glib unicode backend.
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        3 tiny cleanups:
+
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+            store*() methods should take an ImplicitAddress, rather than an Address.
+        * assembler/X86Assembler.h:
+            Make patchPointer private.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret):
+            Remove empty line at end of function.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Encapsulate many uses of void* in the assembler & jit with types that provide
+        more semantic information.  The new types are:
+        
+            * MacroAssemblerCodePtr - this wraps a pointer into JIT generated code.
+            * FunctionPtr - this wraps a pointer to a C/C++ function in JSC.
+            * ReturnAddressPtr - this wraps a return address resulting from a 'call' instruction.
+
+        Wrapping these types allows for stronger type-checking than is possible with everything
+        represented a void*.  For example, it is now enforced by the type system that near
+        calls can only be linked to JIT code and not to C functions in JSC (this was previously
+        required, but could not be enforced on the interface).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::dataLocation):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::executableAddress):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::operator!):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::CodeLocationLabel):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::addressForLookup):
+        (JSC::AbstractMacroAssembler::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+        (JSC::FunctionPtr::value):
+        (JSC::FunctionPtr::executableAddress):
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+        (JSC::ReturnAddressPtr::value):
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::executableAddress):
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchPointerForCall):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator !):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::HostFunction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiArrayLengthTrampoline):
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallPreLink):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::operator!):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-06-05  Antti Koivisto  <antti@apple.com>
+
+        Try to unbreak Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=13128
+        Safari not obeying cache header
+        
+        Export JSC::parseDate()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug in property caching of getters and setters.
+
+        Make sure that the transition logic accounts for getters and setters.
+        If we don't we end up screwing up the transition tables so that some
+        transitions will start incorrectly believing that they need to check
+        for getters and setters. 
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        (JSC::):
+        * runtime/Structure.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Minor tweak to PatchBuffer, change it so it no longer holds a CodeRef, and instead
+        holds a separate code pointer and executable pool.  Since it now always holds its
+        own copy of the code size, and to simplify the construction sequence, it's neater
+        this way.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalizeCode):
+        (JSC::AbstractMacroAssembler::PatchBuffer::code):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove 'JIT_STUB_ARGUMENT_STACK' this is unused and untested.
+
+        This just leaves JIT_STUB_ARGUMENT_REGISTER and JIT_STUB_ARGUMENT_VA_LIST.
+        Since JIT_STUB_ARGUMENT_REGISTER is the sensible configuration on most platforms,
+        remove this define and make this the default behaviour.
+        Platforms must now define JIT_STUB_ARGUMENT_VA_LIST to get crazy va_list voodoo,
+        if they so desire.
+
+        (Refactoring of #ifdefs only, no functional change, no performance impact.)
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        * jit/JITArithmetic.cpp:
+            Remove some redundant typedefs, unused since arithmetic was added to the MacroAssembler interface.
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix due to header include problem.
+
+        * interpreter/Interpreter.h: Remove wtf from includes so that
+          compile can find the headers in expected places.
+
+2009-06-04  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        HashTable class (JavaScriptCore/wtf/HashTable.h) doesn't instantiated by 'new', so 
+        inheritance was removed. HashTable struct has been instantiated by operator new in
+        JSGlobalData.cpp:106.
+        HashTable couldn't inherited from FastAllocBase since struct with inheritance is 
+        no longer POD, so HashTable struct has been instantiated by fastNew, destroyed by
+        fastDelete.
+
+        * interpreter/Interpreter.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * wtf/HashTable.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Wrap the code that plants pushes/pops planted by JIT in explanatorily named
+        methods; move property storage reallocation into a standard stub function.
+
+        ~No performance impact (possible <1% progression on x86-64, likely just noise).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            Wrap calls to push/pop.
+        * jit/JIT.h:
+            Declare the new wrapper methods.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preverveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+            Define the new wrapper methods.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+            Wrap calls to push/pop.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+            Move property storage reallocation into a standard stub function.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+
+2009-06-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Single-threaded QtWebKit configuration
+        <https://bugs.webkit.org/show_bug.cgi?id=26015>
+
+        * JavaScriptCore.pri: Use ThreadingNone.cpp instead of
+        ThreadingQt.cpp and make sure ENABLE_JSC_MULTIPLE_THREADS is turned off
+        when ENABLE_SINGLE_THREADED is tuned on
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::wait): Fix compilation warning.
+        (WTF::ThreadCondition::timedWait): Ditto.
+
+2009-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove workaround that was added to address <rdar://problem/5488678> as it no longer affects our Tiger builds.
+
+        * Configurations/Base.xcconfig:
+
+2009-06-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Use C-style comments in Platform.h so it can be included from C
+        files.
+
+        * wtf/Platform.h:
+
+2009-06-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Use File::Spec->tmpdir instead of hardcoded paths for tempfile() dir
+        
+        This fixes the Windows-build if the user does not have a /tmp directory.
+
+        * pcre/dftables:
+
+2009-06-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver ">>" Hunt.
+
+        emitSlow_op_rshift is linking the wrong number of slow cases, if !supportsFloatingPoint().
+        Fixerate, and refactor/comment the code a little to make it clearer what is going on.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix (errm, for the other patch!).
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej Hunt.
+
+        Change JITStub functions from being static members on the JITStub class to be
+        global extern "C" functions, and switch their the function signature declaration
+        in the definition of the functions to be C-macro generated.  This makes it easier
+        to work with the stub functions from assembler code (since the names no longer
+        require mangling), and by delaring the functions with a macro we can look at
+        also auto-generating asm thunks to wrap the JITStub functions to perform the
+        work currently in 'restoreArgumentReference' (as a memory saving).
+
+        Making this change also forces us to be a bit more realistic about what is private
+        on the Register and CallFrame objects.  Presently most everything on these classes
+        is private, and the classes have plenty of friends.  We could befriend all the
+        global functions to perpetuate the delusion of encapsulation, but using friends is
+        a bit of a sledgehammer solution here - since friends can poke around with all of
+        the class's privates, and since all the major classes taht operate on Regsiters are
+        currently friends, right there is currently in practice very little protection at
+        all.  Better to start removing friend delclarations, and exposing just the parts
+        that need to be exposed.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::returnPC):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::returnValueRegister):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        (JSC::Register::i):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::classInfo):
+        * runtime/JSGlobalData.h:
+
+2009-06-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Tidy up the literal parser.
+
+        Make the number lexing in the LiteralParser exactly match the JSON spec, which
+        makes us cover more cases, but also more strict.  Also made string lexing only
+        allow double-quoted strings.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "WX" Weinig.
+
+        Allow the JIT to operate without relying on use of RWX memory, on platforms where this is supported.
+
+        This patch adds a switch to Platform.h (ENABLE_ASSEMBLER_WX_EXCLUSIVE) which enables this mode of operation.
+        When this flag is set, all executable memory will be allocated RX, and switched to RW only whilst being
+        modified.  Upon completion of code generation the protection is switched back to RX to allow execution.
+
+        Further optimization will be required before it is desirable to enable this mode of operation by default;
+        enabling this presently incurs a 5%-10% regression.
+
+        (Submitting disabled - no performance impact).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::fromFunctionPointer):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToFunction):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_U32_64):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::patchPointer):
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::repatchLoadToLEA):
+        (JSC::X86Assembler::patchInt32):
+        (JSC::X86Assembler::patchRel32):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::):
+        (JSC::ExecutableAllocator::makeWritable):
+        (JSC::ExecutableAllocator::makeExecutable):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        * wtf/Platform.h:
+
+2009-05-29 Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Inherits Interpreter class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSGlobalData.cpp. 
+
+        * interpreter/Interpreter.h:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (windows build fix).
+
+        Add exports for windows (corresponding to the JavaScriptCore.exp modification
+        in the previous change).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Alder and Maciej Stachowiak.
+
+        Bug 26057: StringImpl should share buffers with UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26057
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::create):
+        (JSC::UString::BaseString::sharedBuffer): Only do the sharing when
+        the buffer exceeds a certain size.  The size was tuned by running
+        various dom benchmarks with numbers ranging from 20 to 800 and finding
+        a place that seemed to do the best overall.
+        * runtime/UString.h:
+
+2009-05-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej "you just need to change NativeFunctionWrapper.h" Hunt.
+
+        Add ENABLE_JIT_OPTIMIZE_NATIVE_CALL switch to allow JIT to operate without native call optimizations.
+
+        * runtime/NativeFunctionWrapper.h:
+        * wtf/Platform.h:
+
+2009-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6935193> REGRESSION (r42734): Celtic Kane JavaScript benchmark does not run:
+        "Maximum call stack size exceeded"
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use the same recursion limit as the other recursion checks.
+        We need a limit of at least 100 to run the benchmark above.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added new build flag --filters for Mac. More details in WebCore/ChangeLog.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-05-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6928025> Stack overflow in JSC::stringProtoFuncReplace() running jsFunFuzz
+
+        We should always check for exceptions after creating a CachedCall, this wasn't being done in
+        the string replace logic.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed (make distcheck) build fix; adding missing headers.
+
+        * GNUmakefile.am:
+
+2009-05-27  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben
+        
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha.
+
+        When building on Windows, consider Windows specific files.
+
+        * GNUmakefile.am:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        When building with MinGW, don't use the __declspec(dl{import,export})
+        decorations and rely on the linker to use its nifty auto-import feature.
+        It is extremely hard to get the decorations right with MinGW in general
+        and impossible in WebKit, where the resulting shared library is linking
+        together some static libraries.
+
+        * config.h:
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613
+
+        Be able to use GOwnPtr for GHashTable as well. The assumption
+        is that the hash table has been created with g_hash_table_new_full
+        and has proper destruction functions.
+
+        * wtf/GOwnPtr.cpp:
+        (WTF::GHashTable):
+        * wtf/GOwnPtr.h:
+
+2009-05-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6924033> REGRESSION: Assertion failure due to forward references
+
+        Add a pattern type for forward references to ensure that we don't confuse the
+        quantifier alternatives assertion.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::ForwardReference):
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for: <rdar://problem/6918095> REGRESSION: jQuery load() issue (25981),
+        and also an ASSERT failure on http://ihasahotdog.com/.
+
+        When overwriting a property on a dictionary with a cached specific value,
+        clear the cache if new value being written is different.
+
+        * JavaScriptCore.exp:
+            Export the new symbols.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+            Close dictionary prototypes upon caching a method access, as would happen when caching
+            a regular get_by_id.
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::locationForOffset):
+            Make these methods private.
+        (JSC::JSObject::putDirectInternal):
+            When overwriting a property on a dictionary with a cached specific value,
+            clear the cache if new value being written is different.
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+            Reset the specific value field for a given property in a dictionary.
+        (JSC::Structure::despecifyFunctionTransition):
+            Rename of 'changeFunctionTransition' (this was already internally refered to as a despecification).
+        * runtime/Structure.h:
+            Declare new method.
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "pieces of eight" Hunt.
+
+        When reseting RegexPattern class, should fully reset the class, not just bits of it.
+        In particular, we delete the cached character classes (for wordchars, etc), but do
+        not reset the set of pointers to the cached classes.  In the case of a repeated parse
+        due to an illegal back-reference we will continue to use the deleted character class.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::reset):
+
+2009-05-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix to correct r44161.
+
+        * wtf/FastAllocBase.h:
+
+2009-05-26  Zoltan Horvath  <horvath.zoltan.6@stud.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inherite HashTable from FastAllocBase, because it has been instantiated by
+        'new' in JavaScriptCore/runtime/JSGlobalData.cpp.
+
+        * wtf/HashTable.h:
+        * wtf/FastAllocBase.h: Remove 'wtf' path from TypeTraits.h to allow use outside of wtf.
+
+2009-05-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25126
+        Allow the buffer underlying UString to be shared.
+
+        In order to not grow the underlying size of any structure,
+        there is a union in the Rep string which holds
+         + m_sharedBuffer -- a pointer to the shared ref counted buffer
+           if the class is BaseString and the buffer is being shared OR
+         + m_baseString -- the BaseString if the class is only UString::Rep
+           but not a UString::BaseString
+
+        Ideally, m_sharedBuffer would be a RefPtr, but it cannot be because
+        it is in a union.
+
+        No change in sunspider perf.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::share):
+        (JSC::UString::Rep::destroy):
+        (JSC::UString::BaseString::sharedBuffer):
+        (JSC::UString::BaseString::setSharedBuffer):
+        (JSC::UString::BaseString::slowIsBufferReadOnly):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::concatenate):
+        (JSC::UString::append):
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::isShared):
+        (JSC::UString::BaseString::isBufferReadOnly):
+        (JSC::UString::Rep::baseString):
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::isShared):
+        * wtf/OwnFastMallocPtr.h: Added.
+        (WTF::OwnFastMallocPtr::OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::get):
+        (WTF::OwnFastMallocPtr::release):
+
+2009-05-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Re-add interpreter logic to jit-enabled builds as GCC mysteriously regresses without it
+
+        * wtf/Platform.h:
+
+2009-05-25  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        The functions written in assembly need to have a leading
+        underscore on Windows too.
+
+        * jit/JITStubs.cpp:
+
+2009-05-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix for experimental PGO Windows target.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * GNUmakefile.am: Added OwnPtrCommon.h and PassOwnPtr.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::OwnPtr): Added constructors that take a
+        PassOwnPtr.  Also added a copy constructor declaration that's
+        required when assigning a PassOwnPtr to a stack-based OwnPtr.
+        (WTF::operator=): Added assignment operator methods that take a
+        PassOwnPtr.
+        (WTF::swap): Reformatted.
+        (WTF::operator==): Whitespace changes.
+        (WTF::operator!=): Ditto.
+
+        * wtf/OwnPtrCommon.h: Added.
+        (WTF::deleteOwnedPtr):
+
+        * wtf/PassOwnPtr.h: Added.
+        (WTF::PassOwnPtr::PassOwnPtr):
+        (WTF::PassOwnPtr::~PassOwnPtr):
+        (WTF::PassOwnPtr::get):
+        (WTF::PassOwnPtr::clear):
+        (WTF::PassOwnPtr::release):
+        (WTF::PassOwnPtr::operator*):
+        (WTF::PassOwnPtr::operator->):
+        (WTF::PassOwnPtr::operator!):
+        (WTF::PassOwnPtr::operator UnspecifiedBoolType):
+        (WTF::::operator):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+
+2009-05-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove interpreter specific logic from the JIT builds.
+
+        This saves ~100k in JSC release builds.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * wtf/Platform.h:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part two of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part one of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Geoff Garen.
 
-        <rdar://problem/6516853> (r39682-r39736) JSFunFuzz: crash on "(function(){({ x2: x }), })()"
-        <https://bugs.webkit.org/show_bug.cgi?id=23479>
+        op_method_check
+
+        Optimize method calls, by caching specific function values within the Structure.
+        The new opcode is used almost like an x86 opcode prefix byte to optimize op_get_by_id,
+        where the property access is being used to read a function to be passed to op-call (i.e.
+        'foo.bar();').  This patch modifies the Structure class such that when a property is
+        put to an object for the first time we will check if the value is a function.  If it is,
+        we will cache the function value on the Structure.  A Structure in such a state guarantees
+        that not only does a property with the given identifier exist on the object, but also that
+        its value is unchanged.  Upon any further attempt to put a property with the same identifier
+        (but a different value) to the object, it will transition back to a normal Structure (where
+        it will guarantee the presence but not the value of the property).
+
+        op_method_check makes use of the new information made available by the Structure, by
+        augmenting the functionality of op_get_by_id.  Upon generating a FunctionCallDotNode a
+        check will be emitted prior to the property access reading the function value, and the JIT
+        will generate an extra (initially unlinked but patchable) set of checks prior to the regular
+        JIT code for get_by_id.  The new code will do inline structure and prototype structure check
+        (unlike a regular get_by_id, which can only handle 'self' accesses inline), and then performs
+        an immediate load of the function value, rather than using memory accesses to load the value
+        from the obejct's property storage array.  If the method check fails it will revert, or if
+        the access is polymorphic, the op_get_by_id will continue to operate - and optimize itself -
+        just as any other regular op_get_by_id would.
+
+        ~2.5% on v8-tests, due to a ~9% progression on richards.
 
-        Automatic semicolon insertion was resulting in this being accepted in the initial
-        nodeless parsing, but subsequent reparsing for code generation would fail, leading
-        to a crash.  The solution is to ensure that reparsing a function performs parsing
-        in the same state as the initial parse.  We do this by modifying the saved source
-        ranges to include rather than exclude the opening and closing braces.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        * JavaScriptCore.exp:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::getMethodCallLinkInfoReturnLocation):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::addMethodCallLinkInfos):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitMethodCheck):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::MethodCallCompilationInfo::MethodCallCompilationInfo):
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check):
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::constructError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::methodCallDummy):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::getPropertySpecificFunction):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/JSObject.h:
+        (JSC::getJSFunction):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parseObject):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::):
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::setDespecifyFunctionProperty):
+        (JSC::PutPropertySlot::isCacheable):
+        (JSC::PutPropertySlot::cachedOffset):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changeFunctionTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::specificFunction):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        * wtf/Platform.h:
+
+2009-05-22  Brent Fulgham <bfulgham@webkit.org>
 
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25950
+        JavaScriptCore Fails to build on Windows (Cairo) due to CoreFoundation
+        link requirement.
+
+        Modify project to add new Debug_CFLite and Release_CFLite targets.  These
+        use the new JavaScriptCoreCFLite.vsprops to link against CFLite.dll.
+        Existing projects are changed to use the new JavaScriptCoreCF.vsprops
+        to link against CoreFoundation.dll.
+
+        The JavaScriptCoreCommon.vsprops is modified to remove the link
+        against CoreFoundation.dll.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Original patch by Jürg Billeter and Naiem Shaik.
+        Implementing WTF Unicode functionality based on GLib.
+
+        * GNUmakefile.am:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/glib: Added.
+        * wtf/unicode/glib/UnicodeGLib.cpp: Added.
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::umemcasecmp):
+        * wtf/unicode/glib/UnicodeGLib.h: Added.
+        (WTF::Unicode::):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isFormatChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::category):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::decompositionType):
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Added.
+
+2009-05-21  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add MacroAssemblerCodeRef.h to file list.
+
+        * GNUmakefile.am:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+        Addition of MacroAssemblerCodeRef.h rubber stamped by Geoff Garen.
+
+        Refactor JIT code-handle objects.  The representation of generated code is currently
+        a bit of a mess.  We have a class JITCode which wraps the pointer to a block of
+        generated code, but this object does not reference the executable pool meaning that
+        external events (the pool being derefed) could make the pointer become invalid.
+        To overcome this both the JIT and Yarr implement further (and similar) objects to
+        wrap the code pointer with a RefPtr to the pool.  To add to the mire, as well as the
+        CodeBlock containing a handle onto the code the FunctionBodyNode also contains a
+        copy of the code pointer which is used almost (but not entirely) uniquely to access
+        the JIT code for a function.
+
+        Rationalization of all this:
+
+            * Add a new type 'MacroAssembler::CodeRef' as a handle for a block of JIT generated code.
+            * Change the JIT & Yarr to internally handle code using CodeRefs.
+            * Move the CodeRef (formerly anow defunct JITCodeRef) from CodeBlock to its owner node.
+            * Remove the (now) redundant code pointer from FunctionBodyNode.
+
+        While tidying this up I've made the PatchBuffer return code in new allocations using a CodeRef,
+        and have enforced an interface that the PatchBuffer will always be used, and 'finalizeCode()' or
+        'finalizeCodeAddendum()' will always be called exactly once on the PatchBuffer to complete code generation.
+
+        This gives us a potentially useful hook ('PatchBuffer::performFinalization()') at the end of generation,
+        which may have a number of uses.  It may be helpful should we wish to switch our generation
+        model to allow RW/RX exclusive memory, and it may be useful on non-cache-coherent platforms to
+        give us an oportunity to cache flush as necessary.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::CodeRef::CodeRef):
+        (JSC::AbstractMacroAssembler::CodeRef::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::complete):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalize):
+        (JSC::AbstractMacroAssembler::PatchBuffer::entry):
         * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): add an assertion for successful recompile
-        * parser/Lexer.h:
-        (JSC::Lexer::sourceCode): include rather than exclude braces.
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::setJITCode):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::executablePool):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::operator bool):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::executablePool):
+        (JSC::JITCode::HostFunction):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateJITCode):
+        (JSC::EvalNode::generateJITCode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
         * parser/Nodes.h:
-        (JSC::FunctionBodyNode::toSourceString):  No need to append braces anymore.
+        (JSC::ScopeNode::generatedJITCode):
+        (JSC::ScopeNode::getExecutablePool):
+        (JSC::ScopeNode::setJITCode):
+        (JSC::ProgramNode::jitCode):
+        (JSC::EvalNode::jitCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::pcreFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::RegexCodeBlock::operator bool):
+        (JSC::Yarr::RegexCodeBlock::set):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-05-21  Oliver Hunt  <oliver@apple.com>
 
-2009-01-21  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Maciej Stachowiak.
 
-        Suggested by Oliver Hunt. Reviewed by Oliver Hunt.
+        <rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
+        <https://bugs.webkit.org/show_bug.cgi?id=25921>
 
-        https://bugs.webkit.org/show_bug.cgi?id=23456
-        Function argument names leak
+        When caching properties on the global object we need to ensure that we're
+        not attempting to cache through a shell object.
 
-        * parser/Nodes.cpp: (JSC::FunctionBodyNode::~FunctionBodyNode): Destruct parameter names.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global):
 
-2009-01-22  Beth Dakin  <bdakin@apple.com>
+2009-05-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25945: Add support for MADV_FREE to TCMalloc
+        <https://bugs.webkit.org/show_bug.cgi?id=25945>
+        <rdar://problem/6910754>
+
+        Add support for MADV_FREE to TCMalloc_SystemRelease for platforms that
+        don't also support MADV_FREE_REUSE. The code is identical to the MADV_DONTNEED
+        case except for the advice passed to madvise(), so combining the two cases
+        makes the most sense.
+
+        * wtf/Platform.h: Only define HAVE_MADV_FREE when not building on Tiger or
+        Leopard, because while it is defined on these platforms it actually does
+        nothing.
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): use MADV_FREE if it is available; otherwise use
+        MADV_DONTNEED.
+
+2009-05-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25917> / <rdar://problem/6910066>.
+        Bug 25917: REGRESSION (r43559?): Javascript debugger crashes when pausing page
+
+        The debugger currently retrieves the arguments object from an activation rather than pulling
+        it from a call frame.  This is unreliable to due to the recent optimization to lazily create
+        the arguments object.  In the long-term it should stop doing that (<rdar://problem/6911886>),
+        but for now we force eager creation of the arguments object when debugging.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25912: Harden NumberPrototype.cpp by removing use of strcpy()
+        <https://bugs.webkit.org/show_bug.cgi?id=25912>
+
+        This causes no change on SunSpider.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp): replace strcpy() with memcpy(), ASSERT that the
+        temporary buffer has sufficient space to store the result, and move the
+        explicit null-termination closer to the memcpy() for easier visual inspection
+        of the code.
+        (JSC::fractionalPartToString): replace strcpy() with memcpy(), and ASSERT
+        that the temporary buffer has sufficient space to store the result. There
+        is no explicit null-termination because this is done by the caller. The
+        same is already true for exponentialPartToString().
+        (JSC::numberProtoFuncToExponential): replace strcpy() with memcpy(), explicitly
+        null-terminate the result, and ASSERT that the temporary buffer has sufficient
+        space to store the result.
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup the JSGlobalData when exiting early with the usage statement in jsc.
+
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+
+2009-05-20  Stephanie Lewis  <slewis@apple.com>
+
+        Update the order files.  <rdar://problem/6881750> Generate new order files.
+
+        * JavaScriptCore.order:
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Replace WREC with YARR + YARR_JIT for the Qt port. This is only
+        used when compiled with JIT support for now, so it is a drop-in
+        replacement for the WREC usage. Still including the wrec headers
+        as they are being referred from RegExp.h, though the contents of
+        that header it protected by "#if ENABLE(WREC)".
+
+        * JavaScriptCore.pri:
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix GTK debug build.
+
+        The function dumpDisjunction, compiled with debug enabled, uses
+        printf, which needs stdio.h to be included.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25843: [Qt] Remove qt-port build flag
+        <https://bugs.webkit.org/show_bug.cgi?id=25843>
+
+        * JavaScriptCore.pro:
+
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Copy-paste typo.
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6885680> CrashTracer: [USER] 1 crash in Install
+        Mac OS X at <unknown binary> • 0x9274241c
+        
+        (Original patch by Joe Sokol and Ronnie Misra.)
+        
+        SunSpider says 1.004x faster.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=23461 LayoutTests/
-        fast/js/numeric-conversion.html is broken, and corresponding 
-        <rdar://problem/6514842>
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Instead of doing complicated
+        math that sometimes used to overflow, just release the full range of the
+        register file.
 
-        The basic problem here is that parseInt(Infinity) should be NaN, 
-        but we were returning 0. NaN matches Safari 3.2.1 and Firefox.
+        * interpreter/RegisterFile.h:
+        (JSC::isPageAligned):
+        (JSC::RegisterFile::RegisterFile): Added ASSERTs to verify that it's
+        safe to release the full range of the register file.
+
+        (JSC::RegisterFile::shrink): No need to releaseExcessCapacity() if the
+        new end is not smaller than the old end. (Also, doing so used to cause
+        numeric overflow, unmapping basically the whole process from memory.)
+
+2009-05-19  Oliver Hunt  <oliver@apple.com>
+
+        RS=Mark Rowe.
+
+        <rdar://problem/6888393> REGRESSION: Start Debugging JavaScript crashes browser (nightly builds only?)
+        <https://bugs.webkit.org/show_bug.cgi?id=25717>
+
+        Remove JSC_FAST_CALL as it wasn't gaining us anything, and was
+        resulting in weird bugs in the nightly builds.
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isNumber):
+        (JSC::ExpressionNode::isString):
+        (JSC::ExpressionNode::isNull):
+        (JSC::ExpressionNode::isPure):
+        (JSC::ExpressionNode::isLocation):
+        (JSC::ExpressionNode::isResolveNode):
+        (JSC::ExpressionNode::isBracketAccessorNode):
+        (JSC::ExpressionNode::isDotAccessorNode):
+        (JSC::ExpressionNode::isFuncExprNode):
+        (JSC::ExpressionNode::isSimpleArray):
+        (JSC::ExpressionNode::isAdd):
+        (JSC::ExpressionNode::resultDescriptor):
+        (JSC::StatementNode::firstLine):
+        (JSC::StatementNode::lastLine):
+        (JSC::StatementNode::isEmptyStatement):
+        (JSC::StatementNode::isReturnNode):
+        (JSC::StatementNode::isExprStatement):
+        (JSC::StatementNode::isBlock):
+        (JSC::NullNode::isNull):
+        (JSC::BooleanNode::isPure):
+        (JSC::NumberNode::value):
+        (JSC::NumberNode::setValue):
+        (JSC::NumberNode::isNumber):
+        (JSC::NumberNode::isPure):
+        (JSC::StringNode::isPure):
+        (JSC::StringNode::isString):
+        (JSC::ResolveNode::identifier):
+        (JSC::ResolveNode::isLocation):
+        (JSC::ResolveNode::isResolveNode):
+        (JSC::BracketAccessorNode::isLocation):
+        (JSC::BracketAccessorNode::isBracketAccessorNode):
+        (JSC::DotAccessorNode::base):
+        (JSC::DotAccessorNode::identifier):
+        (JSC::DotAccessorNode::isLocation):
+        (JSC::DotAccessorNode::isDotAccessorNode):
+        (JSC::TypeOfResolveNode::identifier):
+        (JSC::AddNode::isAdd):
+        (JSC::BlockNode::isBlock):
+        (JSC::EmptyStatementNode::isEmptyStatement):
+        (JSC::ExprStatementNode::isExprStatement):
+        (JSC::ReturnNode::isReturnNode):
+        (JSC::ScopeNode::sourceURL):
+        (JSC::ProgramNode::bytecode):
+        (JSC::EvalNode::bytecode):
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::toSourceString):
+        (JSC::FunctionBodyNode::bytecode):
+        (JSC::FuncExprNode::isFuncExprNode):
+
+2009-05-19  Maciej Stachowiak  <mjs@apple.com>
 
+        Reviewed by Gavin Barraclough.
+        
+        - speed up string comparison, especially for short strings
+        
+        ~1% on SunSpider
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::operator==): Inline UString's operator==, since it is called from
+        hot places in the runtime. Also, specialize 2-char strings in a similar way to
+        1-char, since we're taking the hit of a switch anyway.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        - for polymorphic prototype lookups, increase the number of slots from 4 to 8
+        
+        ~4% faster on v8 raytrace benchmark
+
+        * bytecode/Instruction.h:
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - tighten up the code for the load_varargs stub
+        
+        ~1-2% on v8-raytrace
+        
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs): Hoist some loop invariants that
+        the compiler didn't feel like hoisting for us. Remove unneeded exception check.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - Improve code generation for access to prototype properties
+        
+        ~0.4% speedup on SunSpider.
+        
+        Based on a suggestion from Geoff Garen.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable YARR, and disable WREC for GTK+.
+
+        * GNUmakefile.am:
+        * yarr/RegexParser.h:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add -no-install and -no-fast-install to programs and tests that we
+         don't install. Also remove -O2 since this is already handled at
+         configure time.
+
+         * GNUmakefile.am:
+
+2009-05-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Add JavaScriptCore/ to JSC include path only since it's not
+        required when building WebCore.
+
+        * GNUmakefile.am:
+
+2009-05-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Looking like MSVC doesn't like static variables in inline methods?
+        Make the state of the SSE2 check a static variable on the class
+        MacroAssemblerX86Common as a speculative build fix for Windows.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        (JSC::MacroAssemblerX86Common::):
+        * jit/JIT.cpp:
+
+2009-05-15  Adam Roben  <aroben@apple.com>
+
+        Add some assembler headers to JavaScriptCore.vcproj
+
+        This is just a convenience for Windows developers.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add FP support to the MacroAssembler, port JITArithmetic over to make use of this. Also add
+        API to determine whether FP support is available 'MacroAssembler::supportsFloatingPoint()',
+        FP is presently only supported on SSE2 platforms, not x87.  On platforms where a suitable
+        hardware FPU is not available 'supportsFloatingPoint()' may simply return false, and all
+        other methods ASSERT_NOT_REACHED().
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::supportsFloatingPoint):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        (JSC::MacroAssemblerX86Common::storeDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::set32):
+        (JSC::MacroAssemblerX86Common::setTest32):
+        (JSC::MacroAssemblerX86Common::x86Condition):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::movePtrToDouble):
+        (JSC::MacroAssemblerX86_64::moveDoubleToPtr):
+        (JSC::MacroAssemblerX86_64::setPtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPoint):
+        * assembler/X86Assembler.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-05-15  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 25467: JavaScript debugger should use function.displayName as the function's name in the call stack
+        <https://bugs.webkit.org/show_bug.cgi?id=25467>
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.exp: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added calculatedFunctionName
+        * debugger/DebuggerCallFrame.cpp: Added calculatedFunctionName to match existing one in ProfileNode.
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * debugger/DebuggerCallFrame.h: Added calculatedFunctionName to match existing one in ProfileNode.
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix, not reviewed.
+
+        Quick fixes for JIT builds with OPTIMIZE flags disabled.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compilePutByIdHotPath):
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Back out incorrect Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Adam Roben  <aroben@apple.com>
+
+        Windows jsc build fix
+
+        r43648 modified jsc.vcproj's post-build event not to try to copy files
+        that aren't present. Then r43661 mistakenly un-did that modification.
+        This patch restores the modification from r43648, but puts the code in
+        jscCommon.vsprops (where it should have been added in r43648).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Restored empty
+        VCPostBuildEventTool tags.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Modified the post-build
+        event command line to match the one in jsc.vcproj from r43648.
+
+2009-05-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25325
+
+        Make sure pthread_self() is declared before it gets called in Collector.cpp
+
+        * runtime/Collector.cpp: Include pthread.h in most Unix-like platforms
+        (not just for OPENBSD)
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25785>.
+        Bug 25785: Segfault in mark when using JSObjectMakeConstructor
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor): OpaqueJSClass::prototype can return 0.  We need to use the default object prototype when it does.
+        * API/tests/testapi.c:
+        (main): Add a test case.
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect): Add a clearer assertion for a null value.  The assertion on the next line does catch this,
+        but the cause of the failure is not clear from the assertion itself.
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6681868> When building with Xcode 3.1.3 should be using gcc 4.2
+
+        The meaning of XCODE_VERSION_ACTUAL is more sensible in newer versions of Xcode.
+        Update our logic to select the compiler version to use the more appropriate XCODE_VERSION_MINOR
+        if the version of Xcode supports it, and fall back to XCODE_VERSION_ACTUAL if not.
+
+        * Configurations/Base.xcconfig:
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Checking register file bounds should be a ptr comparison (m_end is a Register*).
+        Also, the compare should be unsigned, pointers don'ts go negative.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2009-05-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <rdar://problem/6882919> REGRESSION: page at Metroauto site crashes in cti_op_loop_if_less (25730)
+
+        op_loop_if_less (imm < op) was loading op into regT1, but in the slow path spills regT0.
+        This leads to bad happen.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-05-13  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25746
+        Revert http://trac.webkit.org/changeset/43507 which caused crash in PPC nightlies with Safari 4.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Revert the parser arena change. It was a slowdown, not a speedup.
+        Better luck next time (I'll break it up into pieces).
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Tiger build fix.
+
+        * parser/Grammar.y: Add back empty code blocks, needed by older
+        versions of bison on certain rules.
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-13  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43642
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Updated.
+
+        * debugger/Debugger.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringPrototype.cpp:
+        Added missing #includes.
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Step 3: Add some actual arena allocation. About 1% SunSpider speedup.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+        (JSC::BytecodeGenerator::emitPushNewScope): Updated to take a const
+        Identifier&.
+        * bytecompiler/BytecodeGenerator.h: Ditto
+
+        * bytecompiler/SegmentedVector.h: Added isEmpty.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function here from
+        WebCore so WebCore doesn't need the details of FunctionBodyNode.
+        * debugger/Debugger.h: Ditto.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute): Updated since VarStack contains const
+        Identifier* now.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_lazyLinkCall): Call isHostFunction on the body
+        rather than on the function object, since we can't easily have inlined
+        access to the FunctionBodyNode in JSFunction.h since WebCore needs
+        access to that header.
+        (JSC::JITStubs::cti_op_construct_JSConstruct): Ditto.
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Ditto.
+
+        * parser/Grammar.y: Use JSGlobalData* to pass the global data pointer
+        around whenever possible instead of using void*. Changed
+        SET_EXCEPTION_LOCATION from a macro to an inline function. Marked
+        the structure-creating functions inline. Changed the VarStack to use
+        identifier pointers instead of actual identifiers. This takes
+        advantage of the fact that all identifier pointers come from the
+        arena and avoids reference count churn. Changed Identifier* to
+        const Identifier* to make sure we don't modify any by accident.
+        Used identifiers for regular expression strings too, using the new
+        scanRegExp that has out parameters instead of the old one that relied
+        on side effects in the Lexer. Move the creation of numeric identifiers
+        out of this file and into the PropertyNode constructor.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::scanRegExp): Added out arguments that are const Identifier*
+        as well as a prefix character argument so we can handle the /= case
+        without a string append.
+        (JSC::Lexer::skipRegExp): Added. Skips a regular expression without
+        allocating Identifier objects.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers, m_pattern,
+        and m_flags, and added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::RegExpNode::RegExpNode): Changed arguments to Identifier instead
+        of UString since these come from the parser which makes identifiers.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Updated since the pattern and flags
+        are now Identifier instead of UString. Also changed the throwError code
+        to use the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::EvalNode::generateBytecode): Removed code to clear the children
+        vector. This optimization is no longer possible since everything is in
+        a single arena.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having th
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added the segmented
+        vector of identifiers that used to be in the Lexer.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Use singleStatement function rather than
+        getting at a StatementVector.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Call isHostFunction on the body
+        rather than the function object.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Moved the structure version of this in
+        here from the header. It's not hot enough that it needs to be inlined.
+        (JSC::JSFunction::isHostFunction): Moved this in here from the header.
+        It's now a helper to be used only within the class.
+        (JSC::JSFunction::setBody): Moved this in here. It's not hot enough that
+        it needs to be inlined, and we want to be able to compile the header
+        without the definition of FunctionBodyNode.
+
+        * runtime/JSFunction.h: Eliminated the include of "Nodes.h". This was
+        exposing too much JavaScriptCore dependency to WebCore. Because of this
+        change and some changes made to WebCore, we could now export a lot fewer
+        headers from JavaScriptCore, but I have not done that yet in this check-in.
+        Made a couple functions non-inline. Removes some isHostFunction() assertions.
+        
+        * wtf/FastAllocBase.h: Added the conventional using statements we use in
+        WTF so we can use identifiers from the WTF namespace without explicit
+        namespace qualification or namespace directive. This is the usual WTF style,
+        although it's unconventional in the C++ world. We use the namespace primarily
+        for link-time disambiguation, not compile-time.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix: add JITStubCall.h to files list.
+
+        * GNUmakefile.am:
+
+2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed build fix, as suggested by Yael Aharon <yael.aharon@nokia.com>.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion): renamed IsValid to isValid.
+
+2009-05-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Revert r43562 - [Gtk] WTF_USE_JSC is already defined in
+        WebCore/config.h.
+
+        * wtf/Platform.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add SamplingCounter tool to provide a simple mechanism for counting events in JSC
+        (enabled using ENABLE(SAMPLING_COUNTERS)).  To count events within a single function
+        use the class 'SamplingCounter', where the counter may be incremented from multiple
+        functions 'GlobalSamplingCounter' may be convenient; all other counters (stack or
+        heap allocated, rather than statically declared) should use the DeletableSamplingCounter.
+        Further description of these classes is provided alongside their definition in 
+        SamplingTool.h.
+
+        Counters may be incremented from c++ by calling the 'count()' method on the counter,
+        or may be incremented by JIT code by using the 'emitCount()' method within the JIT.
+
+        This patch also fixes CODEBLOCK_SAMPLING, which was missing a null pointer check.
+
+        * JavaScriptCore.exp:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::addWithCarry32):
+        (JSC::MacroAssemblerX86::and32):
+        (JSC::MacroAssemblerX86::or32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::or32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::adcl_im):
+        (JSC::X86Assembler::addq_im):
+        (JSC::X86Assembler::andl_im):
+        (JSC::X86Assembler::orl_im):
+        * bytecode/SamplingTool.cpp:
+        (JSC::AbstractSamplingCounter::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::AbstractSamplingCounter::count):
+        (JSC::GlobalSamplingCounter::name):
+        (JSC::SamplingCounter::SamplingCounter):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        (JSC::JIT::emitCount):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * wtf/Platform.h:
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6881457> Crash occurs at JSC::Interpreter::execute() when loading http://www.sears.com
+
+        We created the arguments objects before an op_push_scope but not
+        before op_push_new_scope, this meant a null arguments object could
+        be resolved inside catch blocks.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope):
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6879881> Crash occurs at JSC::JSActivation::mark() when loading http://www.monster.com; http://www.cnet.com
+        <https://bugs.webkit.org/show_bug.cgi?id=25736> Crash loading www.google.dk/ig (and other igoogle's as well)
+
+        Following on from the lazy arguments creation patch, it's now
+        possible for an activation to to have a null register in the callframe
+        so we can't just blindly mark the local registers in an activation,
+        and must null check first instead.
+
+        * API/tests/testapi.c:
+        (functionGC):
+        * API/tests/testapi.js:
+        (bludgeonArguments.return.g):
+        (bludgeonArguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        WTF_USE_CTI_REPATCH_PIC is no longer used, remove.
+
+        * jit/JIT.h:
+        * jit/JITStubCall.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        We've run into some problems where changing the size of the class JIT leads to
+        performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+
+        * jit/JIT.h:
+
+2009-05-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add ParserArena.cpp to the build.
+
+        * JavaScriptCoreSources.bkl:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Unsigned underflow on 64bit cannot be treated as a negative number
+
+        This code included some placeswhere we deliberately create negative offsets
+        from unsigned values, on 32bit this is "safe", but in 64bit builds much
+        badness occurs. Solution is to use signed types as nature intended.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+
+2009-05-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Define WTF_USE_JSC for the Gtk port.
+
+        * wtf/Platform.h:
+
+2009-05-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - allow all of strictEqual to be inlined into cti_op_stricteq once again
+        
+        We had this optimization once but accidentally lost it at some point.
+
+        * runtime/Operations.h:
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        instanceof should throw if the constructor being tested does not implement
+        'HasInstance" (i.e. is a function).  Instead we were returning false.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::isInvalidParamForIn):
+        (JSC::isInvalidParamForInstanceOf):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_instanceof):
+        * tests/mozilla/ecma_2/instanceof/instanceof-003.js:
+            Fix broken test case.
+        * tests/mozilla/ecma_2/instanceof/regress-7635.js:
+            Remove broken test case (was an exact duplicate of a test in instanceof-003.js).
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve function call forwarding performance
+
+        Make creation of the Arguments object occur lazily, so it
+        is not necessarily created for every function that references
+        it.  Then add logic to Function.apply to allow it to avoid
+        allocating the Arguments object at all.  Helps a lot with
+        the function forwarding/binding logic in jQuery, Prototype,
+        and numerous other JS libraries.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitPushScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_arguments):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_load_varargs):
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Enable use of SamplingFlags directly from JIT code.
+
+        * bytecode/SamplingTool.h:
+        * jit/JIT.h:
+        (JSC::JIT::sampleCodeBlock):
+        (JSC::JIT::sampleInstruction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Implement JIT generation for instanceof for non-objects (always returns false).
+        Also fixes the sequencing of the prototype and value isObject checks, to no match the spec.
+
+        0.5% progression on v8 tests overall, due to 3.5% on early-boyer.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more JIT refactoring.
+        
+        Rearranged code to more clearly indicate what's conditionally compiled
+        and why. Now, all shared code is at the top of our JIT files, and all
+        #if'd code is at the bottom. #if'd code is delineated by large comments.
+        
+        Moved functions that relate to the JIT but don't explicitly do codegen
+        into JIT.cpp. Refactored SSE2 check to store its result as a data member
+        in the JIT.
+
+        * jit/JIT.cpp:
+        (JSC::isSSE2Present):
+        (JSC::JIT::JIT):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        (JSC::JIT::isSSE2Present):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        * JavaScriptCore.pri: Build the new JITOpcodes.cpp
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation.  Use a macro to
+        forward the main switch-statement cases to the helper functions.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names. This patch covers the remaining
+        slow cases.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * GNUmakefile.am: Added JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Some JIT refactoring.
+        
+        Moved JITStubCall* into its own header.
+        
+        Modified JITStubCall to ASSERT that its return value is handled correctly.
+        Also, replaced function template with explicit instantiations to resolve
+        some confusion.
+        
+        Replaced all uses of emit{Get,Put}CTIArgument with explicit peeks, pokes,
+        and calls to killLastResultRegister().
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITStubCall.h: Copied from jit/JIT.h.
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Start re-factoring JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names.  This patch only covers the main
+        pass and all the arithmetic opcodes in the slow path.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITOpcodes.cpp: Copied from jit/JIT.cpp.
+        * jit/JITPropertyAccess.cpp:
+
+2009-05-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Re-add experimental PGO configs.
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "1" Garen.
+
+        Rip out the !USE(CTI_REPATCH_PIC) code.  It was untested and unused.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        GTK build fix - the deprecated waitForThreadCompletion is not needed on GTK.
+
+        * wtf/ThreadingPthreads.cpp: used #ifdef PLATFORM(DARWIN) around waitForThreadCompletion().
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Build fix for newer versions of GCC
+
+        * wtf/ThreadingPthreads.cpp: Added a declaration of
+        waitForThreadCompletion before its definition to silence a warning.
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        There are specific temporary workarounds for Safari 4 beta on OSX and Win32 since the
+        public build uses WTF threading functions with old type of ThreadingIdentifier.
+        The next time Safari 4 is rebuilt, it will 'automatically' pick up the new type and new
+        functions so the deprecated ones can be removed.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::waitForThreadCompletion): This is a workaround for Safari 4 beta on Mac.
+        Safari 4 is linked against old definition of ThreadIdentifier so it treats it as uint32_t.
+        This 'old' variant of waitForThreadCompletion takes uint32_t and has the old decorated name, so Safari can
+        load it from JavaScriptCore library. The other functions (CurrentThread() etc) happen to match their previous
+        decorated names and, while they return pthread_t now, it is a pointer which round-trips through a uint32_t.
+        This function will be removed as soon as Safari 4 will release next public build.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated decorated names of the WTF threading functions
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
+        https://bugs.webkit.org/show_bug.cgi?id=25560
+        rdar://problem/6861069
+
+        I missed this case back a year ago when I sped up handling
+        of JavaScript wrappers. Easy to fix.
+
+        * runtime/JSObject.h:
+        (JSC::JSValue::get): Return the prototype itself if the property name
+        is __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot): Ditto.
+
+2009-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename emitGetFromCallFrameHeader to emitGetFromCallFrameHeaderPtr
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix. Build ParserAreana.cpp for Qt
+
+        * JavaScriptCore.pri:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24536
+
+        Symbian compilers cannot resolve WTF::PassRefPtr<JSC::Profile>
+        unless Profile.h is included.
+
+        * profiler/ProfileGenerator.h:
+
+2009-05-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24284
+
+        * JavaScriptCore.pri: coding style modified
+        * jsc.pro: duplicated values removed from INCLUDEPATH, DEFINES
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by NOBODY (build fix).
+
+        Also add ParserArena, in addition to AllInOne, for release builds,
+        since adding it to AllInOne breaks Mac.
+
+        * GNUmakefile.am:
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Adding ParserArena to the autotools build.
+
+        * GNUmakefile.am:
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        More Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Export ParserArena::reset.
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        ParserArena to the project.
+
+        * parser/NodeConstructors.h: Added a missing include.
+        (JSC::ParserArenaDeletable::operator new): Marked these as inline.
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        - fixed REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25680
+
+        Accound for the 64-bit instruction prefix when rewriting mov to lea on 64-bit.
+        
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Part two: Remove reference counting from most nodes.
+
+        * JavaScriptCore.exp: Updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added ParserArena.h and .cpp.
+
+        * parser/Grammar.y: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData. Took out now-nonfunctional code that tries to manually
+        release declaration list. Changed the new calls that create FuncDeclNode
+        and FuncExprNode so that they use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaDeletable::operator new): Added.
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted): Added.
+        (JSC::Node::Node): Removed ParserRefCounted initializer.
+        (JSC::ElementNode::ElementNode): Ditto.
+        (JSC::PropertyNode::PropertyNode): Ditto.
+        (JSC::ArgumentsNode::ArgumentsNode): Ditto.
+        (JSC::SourceElements::SourceElements): Ditto.
+        (JSC::ParameterNode::ParameterNode): Ditto.
+        (JSC::FuncExprNode::FuncExprNode): Added ParserArenaRefCounted initializer.
+        (JSC::FuncDeclNode::FuncDeclNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Removed ParserRefCounted initializer.
+        (JSC::ClauseListNode::ClauseListNode): Ditto.
+        (JSC::CaseBlockNode::CaseBlockNode): Ditto.
+
+        * parser/NodeInfo.h: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Added ParserArenaRefCounted initializer.
+        (JSC::ProgramNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        contains function instead of the vecctor find function.
+        (JSC::EvalNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        reset function instead of the vector shrink function.
+        (JSC::FunctionBodyNode::createNativeThunk): Use the proper version
+        of operator new for the reference-counted idiom, not the deletion idiom.
+        (JSC::FunctionBodyNode::create): More of the same.
+
+        * parser/Nodes.h: Added ParserArenaDeletable and ParserArenaRefCounted
+        to replace ParserRefCounted. Fixed inheritance so only the classes that
+        need reference counting inherit from ParserArenaRefCounted.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Set m_sourceElements to 0 since it now starts
+        uninitialized. Just set it to 0 again in the failure case, since it's
+        now just a raw pointer, not an owning one.
+        (JSC::Parser::reparseInPlace): Removed now-unneeded get() function.
+        (JSC::Parser::didFinishParsing): Replaced uses of ParserRefCountedData
+        with uses of ParserArenaData.
+
+        * parser/Parser.h: Less RefPtr, more arena.
+
+        * parser/ParserArena.cpp: Added.
+        * parser/ParserArena.h: Added.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Removed arena-related code, since it's
+        now in the Parser.
+        (JSC::JSGlobalData::createLeaked): Removed unneeded #ifndef.
+        (JSC::JSGlobalData::createNativeThunk): Tweaked #if a bit.
+
+        * runtime/JSGlobalData.h: Removed parserArena, which is now in Parser.
+
+        * wtf/RefCounted.h: Added deletionHasBegun function, for use in
+        assertions to catch deletion not done by the deref function.
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2: Try to fix the Windows build by adding a symbol which is really just a re-mangling of a changed method signature
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Try to fix the Windows build by removing an unknown symbol
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Touch Nodes.cpp to try to fix Windows build
+
+        * parser/Nodes.cpp: Removed whitespace.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Quick fix for failures seen on buildbot. Maciej plans a better fix later.
+
+        * wtf/dtoa.cpp: Change the hardcoded number of 32-bit words in a BigInt
+        from 32 to 64. Parsing "1e500", for example, requires more than 32 words.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        Part one: Change lifetimes so we won't have to use reference
+        counting so much, but don't eliminate the reference counts
+        entirely yet.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Update for use of raw pointers
+        instead of RefPtr.
+        (JSC::BytecodeGenerator::emitCall): Ditto.
+        (JSC::BytecodeGenerator::emitConstruct): Ditto.
+
+        * parser/Grammar.y: Update node creating code to use new (JSGlobalData*)
+        instead of the plain new. At the moment this is just a hook for future
+        arena allocation; it's inline and JSGlobalData* is not used.
+
+        * parser/NodeConstructors.h: Updated for name change of parserObjects to
+        parserArena. Also added explicit initialization for raw pointers that used
+        to be RefPtr. Also removed some uses of get() that aren't needed now that
+        the pointers are raw pointers. Also eliminated m_parameter from FuncExprNode
+        and FuncDeclNode. Also changed node-creating code to use new (JSGlobalData*)
+        as above.
+
+        * parser/Nodes.cpp: Eliminated NodeReleaser and all use of it.
+        (JSC::ParserRefCounted::ParserRefCounted): Updated for name change of
+        parserObjects to parserArena.
+        (JSC::SourceElements::append): Use raw pointers.
+        (JSC::ArrayNode::emitBytecode): Ditto.
+        (JSC::ArrayNode::isSimpleArray): Ditto.
+        (JSC::ArrayNode::toArgumentList): Ditto.
+        (JSC::ObjectLiteralNode::emitBytecode): Ditto.
+        (JSC::PropertyListNode::emitBytecode): Ditto.
+        (JSC::BracketAccessorNode::emitBytecode): Ditto.
+        (JSC::DotAccessorNode::emitBytecode): Ditto.
+        (JSC::ArgumentListNode::emitBytecode): Ditto.
+        (JSC::NewExprNode::emitBytecode): Ditto.
+        (JSC::EvalFunctionCallNode::emitBytecode): Ditto.
+        (JSC::FunctionCallValueNode::emitBytecode): Ditto.
+        (JSC::FunctionCallResolveNode::emitBytecode): Ditto.
+        (JSC::FunctionCallBracketNode::emitBytecode): Ditto.
+        (JSC::FunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::CallFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::ApplyFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::PostfixBracketNode::emitBytecode): Ditto.
+        (JSC::PostfixDotNode::emitBytecode): Ditto.
+        (JSC::DeleteBracketNode::emitBytecode): Ditto.
+        (JSC::DeleteDotNode::emitBytecode): Ditto.
+        (JSC::DeleteValueNode::emitBytecode): Ditto.
+        (JSC::VoidNode::emitBytecode): Ditto.
+        (JSC::TypeOfValueNode::emitBytecode): Ditto.
+        (JSC::PrefixBracketNode::emitBytecode): Ditto.
+        (JSC::PrefixDotNode::emitBytecode): Ditto.
+        (JSC::UnaryOpNode::emitBytecode): Ditto.
+        (JSC::BinaryOpNode::emitStrcat): Ditto.
+        (JSC::BinaryOpNode::emitBytecode): Ditto.
+        (JSC::EqualNode::emitBytecode): Ditto.
+        (JSC::StrictEqualNode::emitBytecode): Ditto.
+        (JSC::ReverseBinaryOpNode::emitBytecode): Ditto.
+        (JSC::ThrowableBinaryOpNode::emitBytecode): Ditto.
+        (JSC::InstanceOfNode::emitBytecode): Ditto.
+        (JSC::LogicalOpNode::emitBytecode): Ditto.
+        (JSC::ConditionalNode::emitBytecode): Ditto.
+        (JSC::ReadModifyResolveNode::emitBytecode): Ditto.
+        (JSC::AssignResolveNode::emitBytecode): Ditto.
+        (JSC::AssignDotNode::emitBytecode): Ditto.
+        (JSC::ReadModifyDotNode::emitBytecode): Ditto.
+        (JSC::AssignBracketNode::emitBytecode): Ditto.
+        (JSC::ReadModifyBracketNode::emitBytecode): Ditto.
+        (JSC::CommaNode::emitBytecode): Ditto.
+        (JSC::ConstDeclNode::emitCodeSingle): Ditto.
+        (JSC::ConstDeclNode::emitBytecode): Ditto.
+        (JSC::ConstStatementNode::emitBytecode): Ditto.
+        (JSC::statementListEmitCode): Ditto.
+        (JSC::BlockNode::emitBytecode): Ditto.
+        (JSC::ExprStatementNode::emitBytecode): Ditto.
+        (JSC::VarStatementNode::emitBytecode): Ditto.
+        (JSC::IfNode::emitBytecode): Ditto.
+        (JSC::IfElseNode::emitBytecode): Ditto.
+        (JSC::DoWhileNode::emitBytecode): Ditto.
+        (JSC::WhileNode::emitBytecode): Ditto.
+        (JSC::ForNode::emitBytecode): Ditto.
+        (JSC::ForInNode::emitBytecode): Ditto.
+        (JSC::ReturnNode::emitBytecode): Ditto.
+        (JSC::WithNode::emitBytecode): Ditto.
+        (JSC::CaseBlockNode::tryOptimizedSwitch): Ditto.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Ditto.
+        (JSC::SwitchNode::emitBytecode): Ditto.
+        (JSC::LabelNode::emitBytecode): Ditto.
+        (JSC::ThrowNode::emitBytecode): Ditto.
+        (JSC::TryNode::emitBytecode): Ditto.
+        (JSC::ScopeNodeData::ScopeNodeData): Use swap to transfer ownership
+        of the arena, varStack and functionStack.
+        (JSC::ScopeNode::ScopeNode): Pass in the arena when creating the
+        ScopeNodeData.
+        (JSC::ProgramNode::ProgramNode): Made this inline since it's used
+        in only one place.
+        (JSC::ProgramNode::create): Changed this to return a PassRefPtr since
+        we plan to have the scope nodes be outside the arena, so they will need
+        some kind of ownership transfer (maybe auto_ptr instead of PassRefPtr
+        in the future, though). Remove the node from the newly-created arena to
+        avoid a circular reference. Later we'll keep the node out of the arena
+        by using a different operator new, but for now it's the ParserRefCounted
+        constructor that puts the node into the arena, and there's no way to
+        bypass that.
+        (JSC::EvalNode::EvalNode): Ditto.
+        (JSC::EvalNode::create): Ditto.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Ditto.
+        (JSC::FunctionBodyNode::createNativeThunk): Moved the code that
+        reseets the arena here instead of the caller.
+        (JSC::FunctionBodyNode::create): Same change as the other create
+        functions above.
+        (JSC::FunctionBodyNode::emitBytecode): Use raw pointers.
+
+        * parser/Nodes.h: Removed NodeReleaser. Changed FunctionStack to
+        use raw pointers. Removed the releaseNodes function. Added an override
+        of operator new that takes a JSGlobalData* to prepare for future arena use.
+        Use raw pointers instead of RefPtr everywhere possible.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Pass the arena in.
+
+        * parser/Parser.h:
+        (JSC::Parser::parse): Updated for name change of parserObjects to parserArena.
+        (JSC::Parser::reparse): Ditto.
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Ditto.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+        (JSC::JSGlobalData::createNativeThunk): Moved arena manipulation into the
+        FunctionBodyNode::createNativeThunk function.
+
+        * runtime/JSGlobalData.h: Tweaked formatting and renamed parserObjects to
+        parserArena.
+
+        * wtf/NotFound.h: Added the usual "using WTF" to this header to match the
+        rest of WTF.
+
+2009-05-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25670
+        Remove no longer valid chunk of code from dtoa.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Removed invalid code.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        "Class const *" is the same as "const Class*", use the latter syntax consistently.
+
+        See <http://www.parashift.com/c++-faq-lite/const-correctness.html#faq-18.9>.
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLength):
+        * runtime/JSObject.h:
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        - speedup dtoa/strtod
+        
+        Added a bunch of inlining, and replaced malloc with stack allocation.
+        
+        0.5% SunSpider speedup (7% on string-tagcloud).
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToExponential):
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::from):
+        * wtf/dtoa.cpp:
+        (WTF::BigInt::BigInt):
+        (WTF::BigInt::operator=):
+        (WTF::Balloc):
+        (WTF::Bfree):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::i2b):
+        (WTF::mult):
+        (WTF::pow5mult):
+        (WTF::lshift):
+        (WTF::cmp):
+        (WTF::diff):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::freedtoa):
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+
+2009-05-09  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Geoffrey Garen. Landed by Jan Alonzo.
+
+        Enable JIT on x86-64 gtk+
+        https://bugs.webkit.org/show_bug.cgi?id=24724
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Removed the last non-call-related manually managed JIT stub call.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_rshift): Fully use the JITStubCall
+        abstraction, instead of emitPutJITStubArg.
+
+2009-05-09  Sebastian Andrzej Siewior  <sebastian@breakpoint.cc>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25653
+        PLATFORM(X86_64) inherits ia64
+
+        __ia64__ is defined by gcc in an IA64 arch and has completely
+        nothing in common with X86-64 exept both are from Intel and have
+        an 64bit address space. That's it. Since code seems to expect x86
+        here, ia64 has to go.
+
+        * wtf/Platform.h:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Geoffrey Garen.
+
+        Assume SSE2 is present on X86-64 and on MAC X86-32. This fixes a
+        build breakage on non-Mac X86-64 when JIT is enabled.
+
+        * jit/JITArithmetic.cpp:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix, adding missing files to make dist.
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Original patch by John McCall. Updated by Cameron Zwarich. Further refined by me.
+        
+        - Assorted speedups to property access
+        
+        ~.3%-1% speedup on SunSpider
+        
+        1) When we know from the structure ID that an object is using inline storage, plant direct
+        loads and stores against it; no need to indirect through storage pointer.
+        
+        2) Also because of the above, union the property storage pointer with the first inline property
+        slot and add an extra inline property slot.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::patchLoadToLEA):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::store32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_EAXm):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::patchLoadToLEA):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getOffset):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/Structure.h:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all our JIT stubs so that they return a maximum of 1 JS value or
+        two non-JS pointers, and do all other value returning through out
+        parameters, in preparation for 64bit JS values on a 32bit system.
+
+        Stubs that used to return two JSValues now return one JSValue and take
+        and out parameter specifying where in the register array the second
+        value should go.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_post_dec):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6634956> CrashTracer: [REGRESSION] >400 crashes
+        in Safari at com.apple.JavaScriptCore • JSC::BytecodeGenerator::emitComplexJumpScopes + 468
+        https://bugs.webkit.org/show_bug.cgi?id=25658
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexJumpScopes): Guard the whole loop
+        with a bounds check. The old loop logic would decrement and read topScope
+        without a bounds check, which could cause crashes on page boundaries.
+
+2009-05-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by NOBODY (BuildFix).
+
+        Gtk fix: add LiteralParser to the build script per r43424.
+
+        Add LiteralParser to the Qt and Wx build scripts too.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCoreSources.bkl:
+
+2009-05-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Darin Adler.
+
+        Add a limited literal parser for eval to handle object and array literals fired at eval
+
+        This is a simplified parser and lexer that we can throw at strings passed to eval
+        in case a site is using eval to parse JSON (eg. json2.js).  The lexer is intentionally
+        limited (in effect it's whitelisting a limited "common" subset of the JSON grammar)
+        as this decreases the likelihood of us wating time attempting to parse any significant
+        amount of non-JSON content.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
         * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/LiteralParser.cpp: Added.
+        (JSC::isStringCharacter):
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parseStatement):
+        (JSC::LiteralParser::parseExpression):
+        (JSC::LiteralParser::parseArray):
+        (JSC::LiteralParser::parseObject):
+        (JSC::LiteralParser::StackGuard::StackGuard):
+        (JSC::LiteralParser::StackGuard::~StackGuard):
+        (JSC::LiteralParser::StackGuard::isSafe):
+        * runtime/LiteralParser.h: Added.
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::attemptJSONParse):
+        (JSC::LiteralParser::):
+        (JSC::LiteralParser::Lexer::Lexer):
+        (JSC::LiteralParser::Lexer::next):
+        (JSC::LiteralParser::Lexer::currentToken):
+        (JSC::LiteralParser::abortParse):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Restored a Mozilla JS test I accidentally gutted.
+
+        * tests/mozilla/ecma/Array/15.4.4.2.js:
+        (getTestCases):
+        (test):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        More abstraction for JITStub calls from JITed code.
+        
+        Added a JITStubCall class that automatically handles things like assigning
+        arguments to different stack slots and storing return values. Deployed
+        the class in about a billion places. A bunch more places remain to be
+        fixed up, but this is a good stopping point for now.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::JSRInfo::JSRInfo):
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+
+2009-05-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a new opcode jnlesseq, and optimize its compilation in the JIT using
+        techniques similar to what were used to optimize jnless in r43363.
+
+        This gives a 0.7% speedup on SunSpider, particularly on the tests 3d-cube,
+        control-flow-recursive, date-format-xparb, and string-base64.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Add support for dumping op_jnlesseq.
+        * bytecode/Opcode.h: Add op_jnlesseq to the list of opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add a peephole optimization
+        for op_jnlesseq when emitting lesseq followed by a jump.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Add case for op_jnlesseq.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Add case for op_jnlesseq.
+        (JSC::JIT::privateCompileSlowCases): Add case for op_jnlesseq.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnlesseq): Added.
+        (JSC::JIT::compileFastArithSlow_op_jnlesseq): Added.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_jlesseq): Added.
+        * jit/JITStubs.h:
+
+2009-05-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix test failures on 64-bit
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless): Avoid accidentaly treating an
+        immediate int as an immediate float in the 64-bit value representation.
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Removing an empty constructor and an uncalled, empty function seems to be a
+        pretty solid 1% regeression on my machine, so I'm going to put them back.
+        Um.  Yeah, this this pretty pointles and makes no sense at all.  I officially
+        lose the will to live in 3... 2...
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::~SamplingTool):
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "I see lots of ifdefs" Hunt.
+
+        Fix (kinda) for sampling tool breakage.  The codeblock sampling tool has become
+        b0rked due to recent changes in native function calling.  The initialization of
+        a ScopeNode appears to now occur before the sampling tool (or possibly the
+        interpreter has been brought into existence, wihich leads to crashyness).
+
+        This patch doesn't fix the problem.  The crash occurs when tracking a Scope, but
+        we shouldn't need to track scopes when we're just sampling opcodes, not
+        codeblocks.  Not retaining Scopes when just opcode sampling will reduce sampling
+        overhead reducing any instrumentation skew, which is a good thing.  As a side
+        benefit this patch also gets the opcode sampling going again, albeit in a bit of
+        a lame way.  Will come back later with a proper fix from codeblock sampling. 
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::compareLineCountInfoSampling):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+
+2009-05-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25640>.
+        Bug 25640: Crash on quit in r43384 nightly build on Leopard w/ Safari 4 beta installed
+        
+        Roll out r43366 as it removed symbols that Safari 4 Beta uses.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Oliver Hunt.
+
+        Also check for Linux for the special-cased calling convention.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * wtf/Platform.h:
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Previously, when appending to an existing string and growing the underlying buffer,
+        we would actually allocate 110% of the required size in order to give us some space
+        to expand into.  Now we treat strings differently based on their size:
+
+        Small Strings (up to 4 pages):
+        Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
+        to our previous policy, however 112.5% is cheaper to calculate.
+
+        Medium Strings (up to 128 pages):
+        For pages covering multiple pages over-allocation is less of a concern - any unused
+        space will not be paged in if it is not used, so this is purely a VM overhead.  For
+        these strings allocate 2x the requested size.
+
+        Large Strings (to infinity and beyond!):
+        Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
+        any individual string be responsible for.
+
+        Additionally, round small allocations up to a multiple of 16 bytes, and medium and
+        large allocations up to a multiple of page size.
+
+        ~1.5% progression on Sunspider, due to 5% improvement on tagcloud & 15% on validate.
+
+        * runtime/UString.cpp:
+        (JSC::expandedSize):
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNativeThunk): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        * wtf/Platform.h: Reverted an accidental (and performance-catastrophic)
+        change.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse): Shrink the parsedObjects vector after allocating
+        the root node, to avoid leaving a stray node in the vector, since that's
+        a slight memory leak, and it causes problems during JSGlobalData teardown.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): ASSERT that we're not being torn
+        down while we think we're still parsing, since that would cause lots of
+        bad memory references during our destruction.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Replaced two more macros with references to the JITStackFrame structure.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve native call performance
+
+        Fix the windows build by adding calling convention declarations everywhere,
+        chose fastcall as that seemed most sensible given we were having to declare
+        the convention explicitly.  In addition switched to fastcall on mac in the
+        deluded belief that documented fastcall behavior on windows would match 
+        actual its actual behavior.
+
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::argumentCount):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setScopeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
         (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NativeFunctionWrapper.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::callRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * wtf/Platform.h:
 
-2009-01-13  Beth Dakin  <bdakin@apple.com>
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Darin Adler and Oliver Hunt.
+        Not reviewed.
+        
+        Rolled out a portion of r43352 because it broke 64bit.
 
-        <rdar://problem/6489314> REGRESSION: Business widget's front side 
-        fails to render correctly when flipping widget
+        * jit/JITStubs.h:
 
-        The problem here is that parseInt was parsing NaN as 0. This patch 
-        corrects that by parsing NaN as NaN. This matches our old behavior 
-        and Firefox. 
+2009-05-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for functions reaturning ThreadIdentifier.
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John Honeycutt.
+        
+        - enable optimization case im the last patch that I accidentally had disabled.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Attempt to fix Win build.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated the WTF threading functions decorated names
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - optimize various cases of branch-fused less
+        
+        1% speedup on SunSpider overall
+        13% speedup on math-cordic
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        op_loop_if_less: Optimize case of constant as first operand, just as case of constant as
+        second operand.
+        op_jnless: Factored out into compileFastArith_op_jnless.
+        (JSC::JIT::privateCompileSlowCases):
+        op_jnless: Factored out into compileFastArithSlow_op_jnless.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnless): Factored out from main compile loop.
+        - Generate inline code for comparison of constant immediate int as first operand to another
+        immediate int, as for loop_if_less
+
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        - Generate inline code for comparing two floating point numbers.
+        - Generate code for both cases of comparing a floating point number to a constant immediate 
+        int.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Fix dumping of op_jnless (tangentially related bugfix).
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added the return address of a stub function to the JITStackFrame abstraction.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::StackHack::StackHack):
+        (JSC::StackHack::~StackHack):
+        (JSC::returnToThrowTrampoline):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex): Fix missing braces. This would make us always
+        take the slower case for string parsing and Visual Studio correctly
+        noticed unreachable code.
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25589: goto instead of state machine in lexer
+        https://bugs.webkit.org/show_bug.cgi?id=25589
+
+        SunSpider is 0.8% faster.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::currentCharacter): Added.
+        (JSC::Lexer::currentOffset): Changed to call currentCharacter for clarity.
+        (JSC::Lexer::setCode): Removed code to set now-obsolete m_skipLineEnd.
+        (JSC::Lexer::shiftLineTerminator): Added. Handles line numbers and the
+        two-character line terminators.
+        (JSC::Lexer::makeIdentifier): Changed to take characters and length rather
+        than a vector, since we now make these directly out of the source buffer
+        when possible.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added.
+        (JSC::isNonASCIIIdentStart): Broke out the non-inline part.
+        (JSC::isIdentStart): Moved here.
+        (JSC::isNonASCIIIdentPart): Broke out the non-inline part.
+        (JSC::isIdentPart): Moved here.
+        (JSC::singleEscape): Moved here, and removed some unneeded cases.
+        (JSC::Lexer::record8): Moved here.
+        (JSC::Lexer::record16): Moved here.
+        (JSC::Lexer::lex): Rewrote this whole function to use goto and not use
+        a state machine. Got rid of most of the local variables. Also rolled the
+        matchPunctuator function in here.
+        (JSC::Lexer::scanRegExp): Changed to use the new version of isLineTerminator.
+        Clear m_buffer16 after using it instead of before.
+
+        * parser/Lexer.h: Removed State enum, setDone function, nextLine function,
+        lookupKeywordFunction, one of the isLineTerminator functions, m_done data member,
+        m_skipLineEnd data member, and m_state data member. Added shiftLineTerminator
+        function, currentCharacter function, and changed the arguments to the makeIdentifier
+        function. Removed one branch from the isLineTerminator function.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Streamlined the case where we don't replace anything.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Removed a few more special constants, and replaced them with uses of
+        the JITStackFrame struct.
+
+        Removed one of the two possible definitions of VoidPtrPair. The Mac
+        definition was more elegant, but SunSpider doesn't think it's any
+        faster, and it's net less elegant to have two ways of doing things.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode): Tweak formatting.
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the build thread stack base determination build on Symbian,
+        by moving the code block before PLATFORM(UNIX), which is also
+        enabled on Symbian builds.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix crash due to incorrectly using an invalid scopechain 
+
+        stringProtoFuncReplace was checking for an exception on a CachedCall
+        by asking for the cached callframes exception.  Unfortunately this
+        could crash in certain circumstances as CachedCall does not guarantee
+        a valid callframe following a call.  Even more unfortunately the check
+        was entirely unnecessary as there is only a single exception slot per
+        global data, so it was already checked via the initial exec->hadException()
+        check.
+
+        To make bugs like this more obvious, i've added a debug only destructor
+        to ScopeChainNode that 0's all of its fields.  This exposed a crash in
+        the standard javascriptcore tests.
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChain::~ScopeChain):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable op_strcat across += assignments.  This patch allows the lhs of a read/modify node
+        to be included within the concatenation operation, and also modifies the implementation
+        of the concatenation to attempt to reuse and cat onto the leftmost string, rather than
+        always allocating a new empty output string to copy into (as was previously the behaviour).
+
+        ~0.5% progression, due to a 3%-3.5% progression on the string tests (particularly validate).
+
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        * parser/Nodes.h:
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+        * runtime/UString.cpp:
+        (JSC::UString::reserveCapacity):
+        * runtime/UString.h:
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix the build on Windows without JIT: interpreter/RegisterFile.h needs
+        roundUpAllocationSize, which is protected by #if ENABLED(ASSEMBLER).
+        Moved the #ifdef down and always offer the function.
+
+        * jit/ExecutableAllocator.h:
+
+2009-05-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "++" Barraclough.
+        
+        Added some abstraction around the JIT stub calling convention by creating
+        a struct to represent the persistent stack frame JIT code shares with
+        JIT stubs.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak & Darin Adler.
+
+        Improve string concatenation (as coded in JS as a sequence of adds).
+
+        Detect patterns corresponding to string concatenation, and change the bytecode
+        generation to emit a new op_strcat instruction.  By handling the full set of
+        additions within a single function we do not need allocate JSString wrappers
+        for intermediate results, and we can calculate the size of the output string
+        prior to allocating storage, in order to prevent reallocation of the buffer.
+
+        1.5%-2% progression on Sunspider, largely due to a 30% progression on date-format-xparb.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+            Add new opcodes.
+        * bytecode/Opcode.h:
+            Add new opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitStrcat):
+        (JSC::BytecodeGenerator::emitToPrimitive):
+            Add generation of new opcodes.
+        * bytecompiler/BytecodeGenerator.h:
+            Add generation of new opcodes.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            Add implmentation of new opcodes.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.h:
+            Add implmentation of new opcodes.
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+            Add generation of new opcodes.
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::AddNode::):
+            Add methods to allow identification of add nodes.
+        * parser/ResultType.h:
+        (JSC::ResultType::definitelyIsString):
+        (JSC::ResultType::forAdd):
+            Fix error in detection of adds that will produce string results.
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+            Add implmentation of new opcodes.
+        * runtime/UString.cpp:
+        (JSC::UString::appendNumeric):
+            Add methods to append numbers to an existing string.
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        (JSC::UString::BaseString::BaseString):
+            Add support for creating an empty string with a non-zero capacity available in the BaseString.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Made RefCounted::m_refCount private.
+
+        * runtime/Structure.h: Removed addressOfCount.
+        * wtf/RefCounted.h: Made m_refCount private.
+        Added addressOfCount.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Fixed assertion seen a lot!
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::~FunctionBodyNode): Removed now-bogus assertion.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Working with Sam Weinig.
+
+        Redo parse tree constructor optimization without breaking the Windows
+        build the way I did yesterday. The previous try broke the build by adding
+        an include of Lexer.h and all its dependencies that had to work outside
+        the JavaScriptCore project.
+
+        * GNUmakefile.am: Added NodeConstructors.h.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Removed byteocde directory -- we no longer are trying to include Lexer.h
+        outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Change SegmentedVector.h
+        and Lexer.h back to internal files. Added NodeConstructors.h.
+
+        * parser/Grammar.y: Added include of NodeConstructors.h.
+        Changed use of ConstDeclNode to use public functions.
+
+        * parser/NodeConstructors.h: Copied from parser/Nodes.h.
+        Just contains the inlined constructors now.
+
+        * parser/Nodes.cpp: Added include of NodeConstructors.h.
+        Moved node constructors into the header.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Removed m_refCount
+        initialization.
+
+        * parser/Nodes.h: Removed all the constructor definitions, and also
+        removed the JSC_FAST_CALL from them since these are all inlined, so the
+        calling convention is irrelevant. Made more things private. Used a data
+        member for operator opcodes instead of a virtual function. Removed the
+        special FunctionBodyNode::ref/deref functions since the default functions
+        are now just as fast.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Fixed types here so we don't typecast until
+        after we do type checking.
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the Qt build on Windows.
+
+        * JavaScriptCore.pri: Define BUILDING_JavaScriptCore/WTF to get the meaning
+        of the JS_EXPORTDATA macros correct
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Enable the JIT for the Qt build on Windows.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Tweak JavaScriptCore.pri for being able to override the generated sources dir for the
+        generated_files target.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $$GENERATED_SOURCES_DIR as output when running bison
+
+        A couple of the generators left the bison output file in the source
+        tree, and then moved it into $$GENERATED_SOURCES_DIR, which did not
+        work well when building release and debug configurations in parallel.
+
+        * JavaScriptCore.pri:
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Simplified a bit of codegen.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Moved all the JIT stub related code into one place.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-05  Sam Weinig  <sam@webkit.org>
+
+        Try to fix Windows build.
+
+        Move Node constructor to the .cpp file.
+
+        * parser/Nodes.cpp: 
+        * parser/Nodes.h:
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made SegmentedVector.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Lexer.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25569: make ParserRefCounted use conventional reference counting
+        https://bugs.webkit.org/show_bug.cgi?id=25569
+
+        SunSpider speedup of about 1.6%.
+
+        * JavaScriptCore.exp: Updated.
+
+        * parser/Nodes.cpp:
+        (JSC::NodeReleaser::releaseAllNodes): ALWAYS_INLINE.
+        (JSC::NodeReleaser::adopt): Ditto.
+        (JSC::ParserRefCounted::ParserRefCounted): Removed most of the code.
+        Add the object to a Vector<RefPtr> that gets cleared after parsing.
+        (JSC::ParserRefCounted::~ParserRefCounted): Removed most of the code.
+
+        * parser/Nodes.h: Made ParserRefCounted inherit from RefCounted and
+        made inline versions of the constructor and destructor. Made the
+        Node constructor inline.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Call globalData->parserObjects.shrink(0) after
+        parsing, where it used to call ParserRefCounted::deleteNewObjects.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Eliminated code to manage the
+        newParserObjects and parserObjectExtraRefCounts.
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+
+        * runtime/JSGlobalData.h: Replaced the HashSet and HashCountedSet
+        with a Vector.
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::~PassRefPtr): The most common thing to do with a
+        PassRefPtr in hot code is to pass it and then destroy it once it's
+        set to zero. Help the optimizer by telling it that's true.
+
+2009-05-05  Xan Lopez  <xlopez@igalia.com> and Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Disable the NativeFunctionWrapper for all non-Mac ports for now,
+        as it is also crashing on Linux/x86.
+
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose toThisObject for the DOM Window
+
+        * JavaScriptCore.exp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Make windows go again until i work out the
+        accursed calling convention).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * jit/JIT.cpp:
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix windows debug builds).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Hopefully the last fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix the build fix caused by a different build fix).
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (No idea how my changes could have broken these).
+
+        * runtime/DatePrototype.cpp:
+        * runtime/RegExpObject.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Why should i expect msvc to list all the errors in a file?).
+
+        * parser/Nodes.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix warning, and another missing include).
+
+        * jit/JIT.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * runtime/ErrorPrototype.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/StringConstructor.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Will the fixes never end?).
+
+        * runtime/FunctionPrototype.h:
+        * runtime/Lookup.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * jit/JIT.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixing).
+
+        * runtime/CallData.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/Error.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Add missing file
+
+        * runtime/NativeFunctionWrapper.h: Copied from JavaScriptCore/jit/ExecutableAllocator.cpp.
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25559: Improve native function call performance
+        <https://bugs.webkit.org/show_bug.cgi?id=25559>
+
+        In order to cache calls to native functions we now make the standard
+        prototype functions use a small assembly thunk that converts the JS
+        calling convention into the native calling convention.  As this is
+        only beneficial in the JIT we use the NativeFunctionWrapper typedef
+        to alternate between PrototypeFunction and JSFunction to keep the
+        code sane.  This change from PrototypeFunction to NativeFunctionWrapper
+        is the bulk of this patch.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::call):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::leaq_mr):
+        (JSC::X86Assembler::call_m):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator bool):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::ctiNativeCallThunk):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::):
+        (JSC::FunctionBodyNode::generatedJITCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ArgList.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncToString):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::mark):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::setScope):
+        (JSC::JSFunction::scope):
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::clearScopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setNativeFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::createNativeThunk):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::nativeFunctionThunk):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+
+2009-05-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        For convenience, let the sampling flags tool clear multiple flags at once.
+
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+
+2009-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Gavin.
+
+        - inline Vector::resize for a ~1.5% speedup on string-tagcloud
+
+        * wtf/Vector.h:
+        (WTF::Vector::resize): Inline
+
+2009-05-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2009-05-03  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+
+2009-05-02  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in one last time (I hope).
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back out. It still breaks windows.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in.
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25519: streamline lexer by handling BOMs differently
+        https://bugs.webkit.org/show_bug.cgi?id=25519
+
+        Roughly 1% faster SunSpider.
+
+        * parser/Grammar.y: Tweak formatting a bit.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Remove unnnecessary initialization of data members
+        that are set up by setCode.
+        (JSC::Lexer::currentOffset): Added. Used where the old code would look at
+        m_currentOffset.
+        (JSC::Lexer::shift1): Replaces the old shift function. No longer does anything
+        to handle BOM characters.
+        (JSC::Lexer::shift2): Ditto.
+        (JSC::Lexer::shift3): Ditto.
+        (JSC::Lexer::shift4): Ditto.
+        (JSC::Lexer::setCode): Updated for name change from yylineno to m_line.
+        Removed now-unused m_eatNextIdentifier, m_stackToken, and m_restrKeyword.
+        Replaced m_skipLF and m_skipCR with m_skipLineEnd. Replaced the old
+        m_length with m_codeEnd and m_currentOffset with m_codeStart. Added code
+        to scan for a BOM character and call copyCodeWithoutBOMs() if we find any.
+        (JSC::Lexer::copyCodeWithoutBOMs): Added.
+        (JSC::Lexer::nextLine): Updated for name change from yylineno to m_line.
+        (JSC::Lexer::makeIdentifier): Moved up higher in the file.
+        (JSC::Lexer::matchPunctuator): Moved up higher in the file and changed to
+        use a switch statement instead of just if statements.
+        (JSC::Lexer::isLineTerminator): Moved up higher in the file and changed to
+        have fewer branches.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added. This replaces the old
+        m_restrKeyword boolean.
+        (JSC::Lexer::isIdentStart): Moved up higher in the file. Changed to use
+        fewer branches in the ASCII but not identifier case.
+        (JSC::Lexer::isIdentPart): Ditto.
+        (JSC::Lexer::singleEscape): Moved up higher in the file.
+        (JSC::Lexer::convertOctal): Moved up higher in the file.
+        (JSC::Lexer::convertHex): Moved up higher in the file. Changed to use
+        toASCIIHexValue instead of rolling our own here.
+        (JSC::Lexer::convertUnicode): Ditto.
+        (JSC::Lexer::record8): Moved up higher in the file.
+        (JSC::Lexer::record16): Moved up higher in the file.
+        (JSC::Lexer::lex): Changed type of stringType to int. Replaced m_skipLF
+        and m_skipCR with m_skipLineEnd, which requires fewer branches in the
+        main lexer loop. Use currentOffset instead of m_currentOffset. Removed
+        unneeded m_stackToken. Use isASCIIDigit instead of isDecimalDigit.
+        Split out the two cases for InIdentifierOrKeyword and InIdentifier.
+        Added special case tight loops for identifiers and other simple states.
+        Removed a branch from the code that sets m_atLineStart to false using goto.
+        Streamlined the number-handling code so we don't check for the same types
+        twice for non-numeric cases and don't add a null to m_buffer8 when it's
+        not being used. Removed m_eatNextIdentifier, which wasn't working anyway,
+        and m_restrKeyword, which is redundant with m_lastToken. Set the
+        m_delimited flag without using a branch.
+        (JSC::Lexer::scanRegExp): Tweaked style a bit.
+        (JSC::Lexer::clear): Clear m_codeWithoutBOMs so we don't use memory after
+        parsing. Clear out UString objects in the more conventional way.
+        (JSC::Lexer::sourceCode): Made this no-longer inline since it has more
+        work to do in the case where we stripped BOMs.
+
+        * parser/Lexer.h: Renamed yylineno to m_lineNumber. Removed convertHex
+        function, which is the same as toASCIIHexValue. Removed isHexDigit
+        function, which is the same as isASCIIHedDigit. Replaced shift with four
+        separate shift functions. Removed isWhiteSpace function that passes
+        m_current, instead just passing m_current explicitly. Removed isOctalDigit,
+        which is the same as isASCIIOctalDigit. Eliminated unused arguments from
+        matchPunctuator. Added copyCoodeWithoutBOMs and currentOffset. Moved the
+        makeIdentifier function out of the header. Added lastTokenWasRestrKeyword
+        function. Added new constants for m_skipLineEnd. Removed unused yycolumn,
+        m_restrKeyword, m_skipLF, m_skipCR, m_eatNextIdentifier, m_stackToken,
+        m_position, m_length, m_currentOffset, m_nextOffset1, m_nextOffset2,
+        m_nextOffset3. Added m_skipLineEnd, m_codeStart, m_codeEnd, and
+        m_codeWithoutBOMs.
+
+        * parser/SourceProvider.h: Added hasBOMs function. In the future this can
+        be used to tell the lexer about strings known not to have BOMs.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Changed to use isASCIIHexDigit.
+
+        * wtf/ASCIICType.h: Added using statements to match the design of the
+        other WTF headers.
+
+2009-05-02  Ada Chan  <adachan@apple.com>
+
+        Fix windows build (when doing a clean build)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
 
+        Simplified null-ish JSValues.
+        
+        Replaced calls to noValue() with calls to JSValue() (which is what
+        noValue() returned). Removed noValue().
+        
+        Replaced almost all uses of jsImpossibleValue() with uses of JSValue().
+        Its one remaining use is for construction of hash table deleted values.
+        For that specific task, I made a new, private constructor with a special
+        tag. Removed jsImpossibleValue().
+        
+        Removed "JSValue()" initialiazers, since default construction happens...
+        by default.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearException):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_vm_throw):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsNumberCell):
+        * runtime/JSObject.cpp:
+        (JSC::callDefaultValueFunction):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValueHashTraits::constructDeletedValue):
+        (JSC::JSValueHashTraits::isDeletedValue):
+        (JSC::JSValue::JSValue):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::clearBase):
+        (JSC::PropertySlot::clearValue):
+
+2009-05-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - speed up the lexer in various ways
+
+        ~2% command-line SunSpider speedup
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Moved below shift() so it can inline.
+        (JSC::Lexer::scanRegExp):  Use resize(0) instead of clear() on Vectors, since the intent
+        here is not to free the underlying buffer.
+        (JSC::Lexer::lex): ditto; also, change the loop logic a bit for the main lexing loop
+        to avoid branching on !m_done twice per iteration. Now we only check it once.
+        (JSC::Lexer::shift): Make this ALWAYS_INLINE and tag an unusual branch as UNLIKELY
+        * parser/Lexer.h:
+        (JSC::Lexer::makeIdentifier): force to be ALWAYS_INLINE
+        * wtf/Vector.h:
+        (WTF::::append): force to be ALWAYS_INLINE (may have helped in ways other than parsing but it wasn't
+        getting inlined in a hot code path in the lexer)
+
+2009-05-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix 64bit build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Roll out JavaScriptCore API number marshaling.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSValue.h:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * JavaScriptCore.exp:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Too Far!" Garen.
+
+        Move JS number construction into JSValue.
+
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff "The Minneapolis" Garen.
+
+        Add mechanism to vend heap allocated JS numbers to JavaScriptCore API clients with a
+        representation that is independent of the number representation in the VM.
+        - Numbers leaving the interpreter are converted to a tagged JSNumberCell.
+        - The numbers coming into the interpreter (asserted to be the tagged JSNumberCell) are
+          converted back to the VM's internal number representation.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::isAPIMangledNumber):
+        (JSC::JSNumberCell::):
+        (JSC::JSNumberCell::JSNumberCell):
+        (JSC::JSValue::isAPIMangledNumber):
+        * runtime/JSValue.h:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 6.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 5.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 4.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 3.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::put):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/Debugger.h:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::lookupGetter):
+        (JSC::DebuggerActivation::lookupSetter):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::exception):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::exceptionSlot):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setArgument):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::):
+        (JSC::JITCode::execute):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (functionReadline):
+        (functionQuit):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::at):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::asArguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.h:
+        (JSC::asBooleanObject):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        * runtime/Collector.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        (JSC::Completion::value):
+        (JSC::Completion::setValue):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::asDateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createError):
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toPrimitive):
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::asInternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        (JSC::asActivation):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::mark):
+        (JSC::compareNumbersForQSort):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::createStructure):
+        (JSC::asArray):
+        (JSC::isJSArray):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        (JSC::JSByteArray::put):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        (JSC::JSByteArray::setIndex):
+        (JSC::asByteArray):
+        (JSC::isJSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::getTruncatedInt32):
+        (JSC::JSValue::getTruncatedUInt32):
+        (JSC::JSValue::mark):
+        (JSC::JSValue::marked):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toBoolean):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toString):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::toThisObject):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        (JSC::asFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (JSC::asGlobalObject):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
         * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
         (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isImmediate):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDoubleNumber):
+        (JSC::JSImmediate::isPositiveIntegerNumber):
+        (JSC::JSImmediate::isBoolean):
+        (JSC::JSImmediate::isUndefinedOrNull):
+        (JSC::JSImmediate::isEitherImmediate):
+        (JSC::JSImmediate::areBothImmediate):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::makeUndefined):
+        (JSC::JSImmediate::makeNull):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::uintValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::trueImmediate):
+        (JSC::JSImmediate::falseImmediate):
+        (JSC::JSImmediate::undefinedImmediate):
+        (JSC::JSImmediate::nullImmediate):
+        (JSC::JSImmediate::zeroImmediate):
+        (JSC::JSImmediate::oneImmediate):
+        (JSC::JSImmediate::impossibleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32Fast):
+        (JSC::JSValue::getInt32Fast):
+        (JSC::JSValue::isUInt32Fast):
+        (JSC::JSValue::getUInt32Fast):
+        (JSC::JSValue::makeInt32Fast):
+        (JSC::JSValue::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::equal):
+        (JSC::JSFastMath::notEqual):
+        (JSC::JSFastMath::andImmediateNumbers):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::orImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        (JSC::JSFastMath::incImmediateNumber):
+        (JSC::JSFastMath::decImmediateNumber):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::put):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toPrimitive):
+        (JSC::JSNumberCell::getPrimitiveNumber):
+        (JSC::JSNumberCell::getJSNumber):
+        (JSC::jsNumberCell):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::isNumberCell):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValue::isDoubleNumber):
+        (JSC::JSValue::getDoubleNumber):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::toJSNumber):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::numberToInt32):
+        (JSC::JSValue::numberToUInt32):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::createStructure):
+        (JSC::asObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSValue::isObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::toPrimitive):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        (JSC::JSPropertyNameIterator::getPrimitiveNumber):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.cpp:
+        (JSC::JSString::toPrimitive):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::asString):
+        (JSC::isJSString):
+        (JSC::JSValue::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toInteger):
+        (JSC::JSValue::toIntegerPreserveNaN):
+        * runtime/JSValue.h:
+        (JSC::JSValue::makeImmediate):
+        (JSC::JSValue::asValue):
+        (JSC::noValue):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::callNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::getJSNumber):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.cpp:
+        (JSC::JSValue::equalSlowCase):
+        (JSC::JSValue::strictEqualSlowCase):
+        (JSC::throwOutOfMemoryError):
+        (JSC::jsAddSlowCase):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/Operations.h:
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::resolveBase):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::setBase):
+        (JSC::PropertySlot::):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        (JSC::ProtectedPtr::operator JSValue):
+        (JSC::ProtectedJSValue::ProtectedJSValue):
+        (JSC::ProtectedJSValue::get):
+        (JSC::ProtectedJSValue::operator JSValue):
+        (JSC::ProtectedJSValue::operator->):
+        (JSC::ProtectedJSValue::~ProtectedJSValue):
+        (JSC::ProtectedJSValue::operator=):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::RegExpConstructor::put):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (JSC::asRegExpConstructor):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::put):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::RegExpObject::put):
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::asRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        (JSC::asStringObject):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::changePrototypeTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::storedPrototype):
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "That doesn't look like what I thought it looks like" Weinig.
+        
+        Beefed up the JSValuePtr class and removed some non-JSValuePtr dependencies
+        on JSImmediate, in prepapration for making JSImmediate an implementation
+        detail of JSValuePtr.
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt): Updated for interface changes.
+
+        * runtime/JSImmediate.h:
+        (JSC::JSValuePtr::JSValuePtr):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator bool):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::isUndefined):
+        (JSC::JSValuePtr::isNull): Changed jsImpossibleValue(), jsNull(),
+        jsUndefined(), and jsBoolean() to operate in terms of JSValuePtr instead
+        of JSImmediate.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitwise_cast): Fixed up for clarity.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug fix for rdar:/6845379.  If a case-insensitive regex contains
+        a character class containing a range with an upper bound of \uFFFF
+        the parser will infinite-loop whist adding other-case characters
+        for characters in the range that do have another case.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        OPCODE_SAMPLING without CODEBLOCK_SAMPLING is currently broken,
+        since SamplingTool::Sample::isNull() checks the m_codeBlock
+        member (which is always null without CODEBLOCK_SAMPLING).
+
+        Restructure the checks so make this work again.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::Sample::isNull):
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        - Concatenate final three strings in simple replace case at one go
+
+        ~0.2% SunSpider speedup
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Use new replaceRange helper instead of
+        taking substrings and concatenating three strings.
+        * runtime/UString.cpp:
+        (JSC::UString::replaceRange): New helper function.
+        * runtime/UString.h:
+
+2009-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Gavin Barraclough.
+        
+        Changed JSValueEncodedAsPtr* => EncodedJSValuePtr to support a non-pointer
+        encoding for JSValuePtrs.
+
+        * API/APICast.h:
+        (toJS):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        * jit/JIT.cpp:
+        (JSC::):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Abandon Ship!" Hunt.
+
+        Fix a leak in Yarr.
+
+        All Disjunctions should be recorded in RegexPattern::m_disjunctions,
+        so that they can be freed at the end of compilation - copyDisjunction
+        is failing to do so.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+
+2009-04-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add function to CallFrame for dumping the current JS caller
+
+        Added debug only method CallFrame::dumpCaller() that provide the call location
+        of the deepest currently executing JS function.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - make BaseStrings have themselves as a base, instead of nothing, to remove common branches
+
+        ~0.7% SunSpider speedup
+
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep): For the constructor without a base, set self as base instead of null.
+        (JSC::UString::Rep::baseString): Just read m_baseString - no more branching.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Two quick improvements to SamplingFlags mechanism.
+
+        SamplingFlags::ScopedFlag class to provide support for automagically
+        clearing a flag as it goes out of scope, and add a little more detail
+        to the output generated by the tool.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::ScopedFlag::ScopedFlag):
+        (JSC::SamplingFlags::ScopedFlag::~ScopedFlag):
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Restore build event steps that were truncated in r43082
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        Re-copied the command lines for the build events from the pre-r43082
+        .vcproj files.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Removed an unnecessary
+        attribute.
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Move settings from .vcproj files to .vsprops files within the
+        JavaScriptCore directory
+
+        Moving the settings to a .vsprops file means that we will only have to
+        change a single setting to affect all configurations, instead of one
+        setting per configuration.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Moved settings from these files to the new .vsprops files. Note that
+        testapi.vcproj had a lot of overrides of default settings that were
+        the same as the defaults, which I've removed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Added.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_JAVASCRIPT_DEBUGGER define.
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - speed up string concatenation by reorganizing some simple cases
+
+        0.7% SunSpider speedup
+
+        * runtime/UString.cpp:
+        (JSC::concatenate): Put fast case for appending a single character
+        before the empty string special cases; streamline code a bit to
+        delay computing values that are not needed in the fast path.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add SamplingFlags mechanism.
+
+        This mechanism allows fine-grained JSC and JavaScript program aware
+        performance measurement.  The mechanism provides a set of 32 flags,
+        numbered #1..#32.  Flag #16 is initially set, and all other flags
+        are cleared.  Flags may be set and cleared from within
+
+        Enable by setting ENABLE_SAMPLING_FLAGS to 1 in wtf/Platform.h.
+        Disabled by default, no performance impact.  Flags may be modified
+        by calling SamplingFlags::setFlag() and SamplingFlags::clearFlag()
+        from within JSC implementation, or by calling setSamplingFlag() and
+        clearSamplingFlag() from JavaScript.
+
+        The flags are sampled with a frequency of 10000Hz, and the highest
+        set flag in recorded, allowing multiple events to be measured (with
+        the highest flag number representing the highest priority).
+
+        Disabled by default; no performance impact.
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::sample):
+        (JSC::SamplingFlags::start):
+        (JSC::SamplingFlags::stop):
+        (JSC::SamplingThread::threadStartFunc):
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::sample):
+        (JSC::SamplingTool::start):
+        (JSC::SamplingTool::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::setFlag):
+        (JSC::SamplingFlags::clearFlag):
+        (JSC::SamplingTool::SamplingTool):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (runWithScripts):
+        * wtf/Platform.h:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Another attempt to fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Peg-Leg" Hunt.
+
+        Coallesce input checking and reduce futzing with the index position
+        between alternatives and iterations of the main loop of a regex,
+        when run in YARR.
+
+        Consider the following regex:  /foo|bar/
+        
+        Prior to this patch, this will be implemented something like this pseudo-code description:
+        
+        loop:
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+                if (available) { test "foo" }
+            decrement_index(3)
+            check_for_available_input(3) // this increments the index by 3, for the second alterantive.
+                if (available) { test "bar" }
+            decrement_index(3)
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+
+        With these changes it will look more like this:
+
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+            if (!available) { goto fail }
+        loop:
+            test "foo"
+            test "bar"
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+        fail:
+
+
+        This gives about a 5% gain on v8-regex, no change on Sunspider.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up ArgList to be a trivial type
+
+        Separate out old ArgList logic to handle buffering and marking arguments
+        into a distinct MarkedArgumentBuffer type.  ArgList becomes a trivial
+        struct of a pointer and length.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::emptyList):
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        (JSC::ArgList::isEmpty):
+        (JSC::ArgList::size):
+        (JSC::ArgList::begin):
+        (JSC::ArgList::end):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        (JSC::Heap::markListSet):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::fillArgList):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncMatch):
+
+2009-04-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25334
+
+        Fix Qt build when ENABLE_JIT is explicitly set to 1
+        to overrule defaults.
+
+        * JavaScriptCore.pri:
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Crash in profiler due to incorrect assuming displayName would be a string.
+
+        Fixed by adding a type guard.
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Removed scaffolding supporting dynamically converting between 32bit and
+        64bit value representations. 
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        (JSC::::call):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        (JSC::Register::marked):
+        (JSC::Register::mark):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::arguments):
+        (JSC::Register::callFrame):
+        (JSC::Register::codeBlock):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        (JSC::Register::vPC):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_call_eval):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        * runtime/ArgList.h:
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+
+2009-04-28  David Kilzer  <ddkilzer@apple.com>
+
+        A little more hardening for UString
+
+        Reviewed by Maciej Stachowiak.
+
+        Revised fix for <rdar://problem/5861045> in r42644.
+
+        * runtime/UString.cpp:
+        (JSC::newCapacityWithOverflowCheck): Added.
+        (JSC::concatenate): Used newCapacityWithOverflowCheck().
+        (JSC::UString::append): Ditto.
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bring back r42969, this time with correct codegen
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Kevin Ollivier <kevino@theolliviers.com>
+
+        wxMSW build fix. Switch JSCore build back to static. 
+
+        * API/JSBase.h:
+        * config.h:
+        * jscore.bkl:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Roll out r42969, due to hangs in build bot.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::isSSE2Present):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (even more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of string indexing
+
+        Add a cti_get_by_val_string function to specialise indexing into a string object.
+        This gives us a slight performance win on a number of string tests.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        * jit/JITStubs.h:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of right shifts of large or otherwise floating point values.
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present): Moved to the head of file.
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add missing header to file list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Maciej "Henry Morgan" Stachowiak.
+
+        Enable YARR.
+        (Again.)
+
+        * wtf/Platform.h:
+
+2009-04-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Tweak a loop condition to keep GCC happy,
+        some GCCs seem to be having issues with this. :-/
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::breakTarget):
+        * wtf/Platform.h:
+
+2009-04-27  Adam Roben  <aroben@apple.com>
+
+        Windows Debug build fix
+
+        Not sure why the buildbots weren't affected by this problem.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS
+        re-order the file list, and added JavaScriptCore[_debug].def to the
+        project. This was not necessary for the fix, but made making the fix
+        easier.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed a function that no longer exists.
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Weinig Sam.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25416
+        "Cached prototype accesses unsafely hoist property storage load above structure checks."
+        
+        Do not hoist the load of the pointer to the property storage array.
+
+        No performance impact.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey "Gaffe or energy?" Garen.
+
+        Randomize address requested by ExecutableAllocatorFixedVMPool.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove scons-based build system.
+
+        * JavaScriptCore.scons: Removed.
+
+2009-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Make HAVE_MADV_FREE darwin only for now
+
+        * wtf/Platform.h:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk build fix - check if we have MADV_FREE before using it.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * wtf/Platform.h:
+
+2009-04-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switching JSCore from a static lib to a dynamic lib
+        to match the Apple build and fix symbol exports.
+
+        * jscore.bkl:
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25337
+        Move ThreadingQt.cpp under the qt directory.
+
+        * JavaScriptCore.pri:
+        * wtf/ThreadingQt.cpp: Removed.
+        * wtf/qt/ThreadingQt.cpp: Copied from JavaScriptCore/wtf/ThreadingQt.cpp.
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25338
+        Move ThreadingGtk.cpp under the gtk directory.
+
+        * GNUmakefile.am:
+        * wtf/ThreadingGtk.cpp: Removed.
+        * wtf/gtk/ThreadingGtk.cpp: Copied from JavaScriptCore/wtf/ThreadingGtk.cpp.
+
+2009-04-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Wesley" Weinig.
+
+        Improve performance to YARR interpreter.
+        (From about 3x slower than PCRE on regex-dna to about 30% slower).
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::SubpatternBegin):
+        (JSC::Yarr::ByteTerm::SubpatternEnd):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        * yarr/RegexPattern.h:
+
+2009-04-24  Rob Raguet-Schofield  <ragfield@gmail.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        * wtf/CurrentTime.h: Fix a typo in a comment.
+
+2009-04-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add reinterpret_cast
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+
+2009-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6050421> JavaScript register file should remap to release physical pages accumulated during deep recursion
+
+        We now track the maximum extent of the RegisterFile, and when we reach the final
+        return from JS (so the stack portion of the registerfile becomes empty) we see
+        if that extent is greater than maxExcessCapacity.  If it is we use madvise or
+        VirtualFree to release the physical pages that were backing the excess.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        With great sadness and a heavy heart I switch us back from YARR to WREC in
+        order to restore greenness to the world once more.
+
+        * wtf/Platform.h:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        More Windows build fixage.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Remove a symbol that no longer exists.
+
+2009-04-23  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 24604: WebKit profiler reports incorrect total times
+        <https://bugs.webkit.org/show_bug.cgi?id=24604>
+
+        Reviewed by Timothy Hatcher and Kevin McCullough.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        (JSC::CallIdentifier::Hash::equal):
+        (JSC::CallIdentifier::hash):
+        (WTF::):
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/Profile.cpp: No more need for TreeProfile/HeavyProfile
+        (JSC::Profile::create):
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp:
+        * profiler/ProfileNode.h:
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix II.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * runtime/RegExp.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by salty sea dogs Sam & Geoff.
+
+        Enable YARR_JIT by default (where supported), replacing WREC.
+
+        * wtf/Platform.h:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff "Dread Pirate Roberts" Garen.
+
+        Various small fixes to YARR JIT, in preparation for enabling it by default.
+
+        * Correctly index into the callframe when storing restart addresses for
+          nested alternatives.
+        * Allow backtracking back into matched alternatives of parentheses.
+        * Fix callframe offset calculation for parenthetical assertions.
+        * When a set of parenthese are quantified with a fixed and variable portion,
+          and the variable portion is quantified once, this should not reset the
+          pattern match on failure to match (the last match from the firxed portion
+          should be preserved).
+        * Up the pattern size limit to match PCRE's new limit.
+        * Unlclosed parentheses should be reported with the message "missing )".
+
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add the m_ prefix on FixedVMPoolAllocator's member variables, and fix typos in a few comments.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add some assertions to FixedVMPoolAllocator to guard against cases where we
+        attempt to free memory that didn't originate from the pool, or we attempt to
+        hand out a bogus address from alloc.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam "Blackbeard" Weinig.
+
+        Although pirates do spell the word 'generate' as 'genertate',
+        webkit developers do not.  Fixertate.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Blackbeard" Weinig.
+
+        Improvements to YARR JIT.  This patch expands support in three key areas:
+            * Add (temporary) support for falling back to PCRE for expressions not supported.
+            * Add support for x86_64 and Windows.
+            * Add support for singly quantified parentheses (? and ??), alternatives within
+              parentheses, and parenthetical assertions.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::AlternativeBacktrackRecord::AlternativeBacktrackRecord):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::RegexGenerator::generationFailed):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Fix for <rdar://problem/6816957>
+        Turn off Geolocation by default
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * interpreter/CachedCall.h:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/StringPrototype.cpp:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve String.replace performance slightly
+
+        Apply our vm reentry caching logic to String.replace with global
+        regexes.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Oliver Hunt.
+        
+        Re-Fixed <rdar://problem/6406045> REGRESSION: Stack overflow on PowerPC on
+        fast/workers/use-machine-stack.html (22531)
+        
+        SunSpider reports no change.
+        
+        Use a larger recursion limit on the main thread (because we can, and
+        there's some evidence that it may improve compatibility), and a smaller
+        recursion limit on secondary threads (because they tend to have smaller
+        stacks).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC::): Ditto. I wrote the recursion test slightly funny, so that the
+        common case remains a simple compare to constant.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin): Conservatively, set the array recursion limits
+        to the lower, secondary thread limit. We can do something fancier if
+        compatibility moves us, but this seems sufficient for now.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Adam Roben.
+        
+        Disabled one more Mozilla JS test because it fails intermittently on Windows.
+        (See https://bugs.webkit.org/show_bug.cgi?id=25160.)
+
+        * tests/mozilla/expected.html:
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Rename JavaScriptCore_debug.dll to JavaScriptCore.dll in the Debug
+        configuration
+
+        This matches the naming scheme for WebKit.dll, and will be necessary
+        once Safari links against JavaScriptCore.dll. This change also causes
+        run-safari not to fail (because the launcher printed by FindSafari was
+        always looking for JavaScriptCore.dll, never
+        JavaScriptCore_debug.dll).
+
+        Part of Bug 25305: can't run safari or drt on windows
+        <https://bugs.webkit.org/show_bug.cgi?id=25305>
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Use $(WebKitDLLConfigSuffix) for naming JavaScriptCore.{dll,lib}.
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Fix JavaScriptCore build on VC++ Express
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Link
+        explicitly against gdi32.lib and oleaut32.lib.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Tiger crash fix: Put VM tags in their own header file, and fixed up the
+        #ifdefs so they're not used on Tiger.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+        * wtf/VMTags.h: Added.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        More Windows build fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy DLLs, PDBs.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add version stamping, resource copying.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate JavaScriptCore.dll from WebKit.dll.
+        Slight performance improvement or no change on benchmarks.
+        
+        Allows us to break a circular dependency between CFNetwork and WebKit on Windows,
+        and simplifies standalone JavaScriptCore builds.
+
+        Reviewed by Oliver Hunt.
+
+        * API/JSBase.h: Export symbols with JS_EXPORT when using MSVC.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Build JavaScriptCore as a DLL instead of a static library.
+        * config.h: Specify __declspec(dllexport/dllimport) appropriately when exporting data.
+        * runtime/InternalFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSArray.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/StringObject.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/UString.h: Specify JS_EXPORTDATA on exported data.
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        Always tag mmaped memory on darwin and clean up #defines
+        now that they are a little bigger.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Tim Hatcher.
+
+        Add licenses for xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2009-04-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Build fix for Qt port (after r42646). Not reviewed.
+
+        * wtf/unicode/qt4/UnicodeQt4.h: Added U16_PREV.
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Better fix for JSStringCreateWithCFString hardening.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5860954>
+        Harden JSStringCreateWithCFString against malformed CFStringRefs.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        Make FEATURE_DEFINES completely dynamic
+
+        Reviewed by Darin Adler.
+
+        Make FEATURE_DEFINES depend on individual ENABLE_FEATURE_NAME
+        variables for each feature, making it possible to remove all
+        knowledge of FEATURE_DEFINES from build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig: Extract a variable
+        from FEATURE_DEFINES for each feature setting.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix typo.  s/VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE/VM_MEMORY_JAVASCRIPT_CORE/
+
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock): Fix bozo typo.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6801555> Tag JavaScript memory on SnowLeopard
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-18  Drew Wilson  <amw@apple.com>
+
+        <rdar://problem/6781407> VisiblePosition.characterAfter should return UChar32
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic): Added.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/5861045>
+        A little bit of hardening for UString.
+
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::append):
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe and Dan Bernstein.
+
+        Fix for <rdar://problem/5861188>
+        A little bit of hardening for Vector.
+
+        * wtf/Vector.h:
+        (WTF::Vector<T, inlineCapacity>::append):
+        (WTF::Vector<T, inlineCapacity>::insert):
+
+2009-04-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        On x86_64, make all JIT-code allocations from a new heap, managed
+        by FixedVMPoolAllocator.  This class allocates a single large (2Gb)
+        pool of virtual memory from which all further allocations take place.
+        Since all JIT code is allocated from this pool, we can continue to
+        safely assume (as is already asserted) that it will always be possible
+        to link any JIT-code to JIT-code jumps and calls.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Add new file.
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Added.
+        (JSC::FreeListEntry::FreeListEntry):
+        (JSC::AVLTreeAbstractorForFreeList::get_less):
+        (JSC::AVLTreeAbstractorForFreeList::set_less):
+        (JSC::AVLTreeAbstractorForFreeList::get_greater):
+        (JSC::AVLTreeAbstractorForFreeList::set_greater):
+        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::null):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
+        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
+        (JSC::sortFreeListEntriesByPointer):
+        (JSC::sortCommonSizedAllocations):
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+            The new 2Gb heap class!
+        * jit/ExecutableAllocatorPosix.cpp:
+            Disable use of this implementation on x86_64.
+        * wtf/AVLTree.h:
+            Add missing variable initialization.
+        (WTF::::remove):
+
+2009-04-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix bug where the VM reentry cache would not correctly unroll the cached callframe
+
+        Fix a check that was intended to mark a cached call as invalid when the callframe could
+        not be constructed.  Instead it was just checking that there was a place to put the
+        exception.  This eventually results in a non-recoverable RegisterFile starvation.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call): add assertion to ensure we don't use a bad callframe
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * Configurations/FeatureDefines.xcconfig: Added.
+        * Configurations/JavaScriptCore.xcconfig: Removed definition of
+        ENABLE_SVG_DOM_OBJC_BINDINGS and FEATURE_DEFINES.  Added include
+        of FeatureDefines.xcconfig.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+
+2009-04-08  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25027: JavaScript parseInt wrong on negative numbers
+        <https://bugs.webkit.org/show_bug.cgi?id=25027>
+
+        When dealing with negative numbers, parseInt should use ceil instead of floor.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-04-16  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6744652> 32-bit to 64-bit: Javascript hash tables double in size
+
+        Remove perfect hash optimization which removes 1 MB of overhead on 32-bit and almost 2 MB on 64-bit.  Removing the optimization was not a regression on SunSpider and the acid 3 test still passes.
+
+        * create_hash_table:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::next):
+        (JSC::HashTable::entry):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerableNamesFromClassInfoTable):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix subtle error in optimised VM reentry in Array.sort
+
+        Basically to ensure we don't accidentally invalidate the cached callframe
+        we should be using the cached callframe rather than our own exec state.
+        While the old behaviour was wrong i have been unable to actually create a
+        test case where anything actually ends up going wrong.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Optimise op_resolve_base
+
+        If we can statically find a property we are trying to resolve
+        the base of, the base is guaranteed to be the global object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveBase):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of read-write-modify operators
+
+        Implement cross scope optimisation for read-write-modify
+        operators, to avoid unnecessary calls to property resolve
+        helper functions.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of remaining array enumeration functions
+
+        Make use of function entry cache for remaining Array enumeration functions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Array.sort
+
+        Cache the VM entry for Array.sort when using a JS comparison function.
+
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::sort):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25229: Need support for Array.prototype.reduceRight
+        <https://bugs.webkit.org/show_bug.cgi?id=25229>
+
+        Implement Array.reduceRight
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduceRight):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25227: Array.filter triggers an assertion when the target array shrinks while being filtered
+        <https://bugs.webkit.org/show_bug.cgi?id=25227>
+
+        We correct this simply by making the fast array path fall back on the slow path if
+        we ever discover the fast access is unsafe.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25159: Support Array.prototype.reduce
+        <https://bugs.webkit.org/show_bug.cgi?id=25159>
+
+        Implement Array.prototype.reduce
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduce):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Move CallFrameClosure from inside the Interpreter class to its own file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h:
+        * interpreter/CallFrameClosure.h: Copied from JavaScriptCore/yarr/RegexJIT.h.
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+
+2009-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25202: Improve performance of repeated callbacks into the VM
+
+        Add the concept of a CachedCall to native code for use in Array
+        prototype and similar functions where a single callback function
+        is called repeatedly with the same number of arguments.
+
+        Used Array.prototype.filter as the test function and got a 50% win
+        over a naive non-caching specialised version.  This makes the native
+        implementation of Array.prototype.filter faster than the JS one once
+        more.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h: Added.
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        (JSC::CachedCall::~CachedCall):
+           CachedCall is a wrapper that automates the calling and teardown
+           for a CallFrameClosure
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+           Create the basic entry closure for a function
+        (JSC::Interpreter::execute):
+           A new ::execute method to enter the interpreter from a closure
+        (JSC::Interpreter::endRepeatCall):
+           Clear the entry closure
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::CallFrameClosure::setArgument):
+        (JSC::Interpreter::CallFrameClosure::resetCallFrame):
+           Helper functions to simplify setting up the closure's callframe
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the build.
+
+        Add the yarr headers (and only the headers) to the build, so that
+        RegExp.cpp can compile. The headers are ifdefed out with yarr
+        disabled, so we don't need anything else for now.
+
+        * GNUmakefile.am:
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Remove support for profile-guided optimization on Windows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed
+        the Release_PGO configuration. Also let VS re-order the source files
+        list.
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        * GNUmakefile.am:
+
+2009-04-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix when building minidom. Not reviewed.
+
+        Use C-style comment instead of C++ style since autotools builds
+        minidom using gcc and not g++.
+
+        * wtf/Platform.h:
+
+2009-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative build fix.
+
+        * runtime/RegExp.h:
+
+2009-04-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cap'n Geoff Garen.
+
+        Yarr!
+        (Yet another regex runtime).
+
+        Currently disabled by default since the interpreter, whilst awesomely
+        functional, has not been optimized and is likely slower than PCRE, and
+        the JIT, whilst faster than WREC, is presently incomplete and does not
+        fallback to using an interpreter for the cases it cannot handle.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::swap):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpw_im):
+        (JSC::X86Assembler::testw_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::immediate16):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wtf/Platform.h:
+        * yarr: Added.
+        * yarr/RegexCompiler.cpp: Added.
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::CharacterClassConstructor::reset):
+        (JSC::Yarr::CharacterClassConstructor::append):
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeUpper):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeLower):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
+        (JSC::Yarr::newlineCreate):
+        (JSC::Yarr::digitsCreate):
+        (JSC::Yarr::spacesCreate):
+        (JSC::Yarr::wordcharCreate):
+        (JSC::Yarr::nondigitsCreate):
+        (JSC::Yarr::nonspacesCreate):
+        (JSC::Yarr::nonwordcharCreate):
+        (JSC::Yarr::RegexPatternConstructor::RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::~RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::reset):
+        (JSC::Yarr::RegexPatternConstructor::assertionBOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionEOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionWordBoundary):
+        (JSC::Yarr::RegexPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::RegexPatternConstructor::atomBuiltInCharacterClass):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassAtom):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassRange):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBuiltIn):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+        (JSC::Yarr::RegexPatternConstructor::copyTerm):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::disjunction):
+        (JSC::Yarr::RegexPatternConstructor::regexBegin):
+        (JSC::Yarr::RegexPatternConstructor::regexEnd):
+        (JSC::Yarr::RegexPatternConstructor::regexError):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupOffsets):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexCompiler.h: Added.
+        * yarr/RegexInterpreter.cpp: Added.
+        (JSC::Yarr::Interpreter::appendParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::restoreOutput):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::InputStream::next):
+        (JSC::Yarr::Interpreter::InputStream::rewind):
+        (JSC::Yarr::Interpreter::InputStream::read):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::prev):
+        (JSC::Yarr::Interpreter::InputStream::getPos):
+        (JSC::Yarr::Interpreter::InputStream::setPos):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeCharacterClass):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionEOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::matchPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+        (JSC::Yarr::Interpreter::recordParenthesesMatch):
+        (JSC::Yarr::Interpreter::resetMatches):
+        (JSC::Yarr::Interpreter::resetAssertionMatches):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::matchTerm):
+        (JSC::Yarr::Interpreter::backtrackTerm):
+        (JSC::Yarr::Interpreter::matchAlternative):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::ParenthesesStackEntry::ParenthesesStackEntry):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        (JSC::Yarr::byteCompileRegex):
+        (JSC::Yarr::interpretRegex):
+        * yarr/RegexInterpreter.h: Added.
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BOL):
+        (JSC::Yarr::ByteTerm::CheckInput):
+        (JSC::Yarr::ByteTerm::EOL):
+        (JSC::Yarr::ByteTerm::WordBoundary):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::PatternEnd):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        (JSC::Yarr::ByteDisjunction::ByteDisjunction):
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (JSC::Yarr::BytecodePattern::~BytecodePattern):
+        * yarr/RegexJIT.cpp: Added.
+        (JSC::Yarr::RegexGenerator::optimizeAlternative):
+        (JSC::Yarr::RegexGenerator::matchCharacterClassRange):
+        (JSC::Yarr::RegexGenerator::matchCharacterClass):
+        (JSC::Yarr::RegexGenerator::jumpIfNoAvailableInput):
+        (JSC::Yarr::RegexGenerator::jumpIfAvailableInput):
+        (JSC::Yarr::RegexGenerator::checkInput):
+        (JSC::Yarr::RegexGenerator::atEndOfInput):
+        (JSC::Yarr::RegexGenerator::notAtEndOfInput):
+        (JSC::Yarr::RegexGenerator::jumpIfCharEquals):
+        (JSC::Yarr::RegexGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::RegexGenerator::readCharacter):
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::loadFromFrame):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternativeValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::termValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::term):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::lookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isSinglePatternCharacterLookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::inputOffset):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackGenerated):
+        (JSC::Yarr::RegexGenerator::jumpToBacktrackCheckEmitPending):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingleDisjunctionOneAlternative):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h: Added.
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        * yarr/RegexParser.h: Added.
+        (JSC::Yarr::):
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::begin):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacterUnescaped):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::flush):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseAtomEscape):
+        (JSC::Yarr::Parser::parseCharacterClassEscape):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseParenthesesBegin):
+        (JSC::Yarr::Parser::parseParenthesesEnd):
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        (JSC::Yarr::Parser::saveState):
+        (JSC::Yarr::Parser::restoreState):
+        (JSC::Yarr::Parser::atEndOfPattern):
+        (JSC::Yarr::Parser::peek):
+        (JSC::Yarr::Parser::peekIsDigit):
+        (JSC::Yarr::Parser::peekDigit):
+        (JSC::Yarr::Parser::consume):
+        (JSC::Yarr::Parser::consumeDigit):
+        (JSC::Yarr::Parser::consumeNumber):
+        (JSC::Yarr::Parser::consumeOctal):
+        (JSC::Yarr::Parser::tryConsume):
+        (JSC::Yarr::Parser::tryConsumeHex):
+        (JSC::Yarr::parse):
+        * yarr/RegexPattern.h: Added.
+        (JSC::Yarr::CharacterRange::CharacterRange):
+        (JSC::Yarr::):
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::BOL):
+        (JSC::Yarr::PatternTerm::EOL):
+        (JSC::Yarr::PatternTerm::WordBoundary):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+        (JSC::Yarr::PatternTerm::quantify):
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::lastTerm):
+        (JSC::Yarr::PatternAlternative::removeLastTerm):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::~PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::~RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+        (JSC::Yarr::RegexPattern::containsIllegalBackReference):
+        (JSC::Yarr::RegexPattern::newlineCharacterClass):
+        (JSC::Yarr::RegexPattern::digitsCharacterClass):
+        (JSC::Yarr::RegexPattern::spacesCharacterClass):
+        (JSC::Yarr::RegexPattern::wordcharCharacterClass):
+        (JSC::Yarr::RegexPattern::nondigitsCharacterClass):
+        (JSC::Yarr::RegexPattern::nonspacesCharacterClass):
+        (JSC::Yarr::RegexPattern::nonwordcharCharacterClass):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Missed code from last patch).
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+
+2009-04-13  Francisco Tolmasky  <francisco@280north.com>
+
+        Reviewed by Oliver Hunt.
+        
+        BUG 25171: It should be possible to manually set the name of an anonymous function
+        <https://bugs.webkit.org/show_bug.cgi?id=25171>
+
+        This change adds the displayName property to functions, which when set overrides the 
+        normal name when appearing in the console.
+
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp): Changed call to InternalFunction::name to InternalFunction::calculatedDisplayName
+        * runtime/CommonIdentifiers.h: Added displayName common identifier.
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName): Access to user settable displayName property
+        (JSC::InternalFunction::calculatedDisplayName): Returns displayName if it exists, if not then the natural name
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disabled another JavaScriptCore test because it fails on Windows but
+        not Mac, so it makes the bots red.
+
+        * tests/mozilla/expected.html:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Disabled two JavaScriptCore tests because they fail on Window or Mac but
+        not both, so they make the bots red.
+
+        * tests/mozilla/expected.html: Updated expected results.
+
+2009-04-09  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25091
+        The Android platform requires threads to be registered with the VM.
+        This patch implements this behaviour inside ThreadingPthreads.cpp.
+
+        * wtf/ThreadingPthreads.cpp: Add a level above threadEntryPoint that takes care of (un)registering threads with the VM.
+        (WTF::runThreadWithRegistration): register the thread and run entryPoint. Unregister the thread afterwards.
+        (WTF::createThreadInternal): call runThreadWithRegistration instead of entryPoint directly.
+
+2009-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        Reinstating <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Rolled r42345 back in.  The build failure was caused by an
+        internal script which had not been updated the same way that
+        build-webkit was updated.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverting <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings.
+        It broke Mac build, and I don't know how to fix it.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Checking for __GLIBCXX__ being bigger than some date is not enough
+        to get std::tr1, C++0x has to be in use too. Add another check for
+        __GXX_EXPERIMENTAL_CXX0X__.
+
+        * wtf/TypeTraits.h:
+
+2009-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix assertion failure in function.apply
+
+        The result of excess arguments to function.apply is irrelevant
+        so we don't need to provide a result register.  We were providing
+        temporary result register but not ref'ing it resulting in an
+        assertion failure.
+
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Introduce the ENABLE_SVG_DOM_OBJC_BINDINGS feature define so
+        that SVG DOM Objective-C bindings may be optionally disabled.
+
+        * Configurations/JavaScriptCore.xcconfig: Added
+        ENABLE_SVG_DOM_OBJC_BINDINGS variable and use it in
+        FEATURE_DEFINES.
+
+2009-04-08  Paul Pedriana <ppedriana@ea.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20422
+        Allow custom memory allocation control.
+        
+        * wtf/FastAllocBase.h:
+        New added file. Implements allocation base class.
+        * wtf/TypeTraits.h:
+        Augments existing type traits support as needed by FastAllocBase.
+        * wtf/FastMalloc.h:
+        Changed to support FastMalloc match validation.
+        * wtf/FastMalloc.cpp:
+        Changed to support FastMalloc match validation.
+        * wtf/Platform.h:
+        Added ENABLE_FAST_MALLOC_MATCH_VALIDATION; defaults to 0.
+        * GNUmakefile.am:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        Updated to include added FastAllocBase.h.
+
+2009-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve function.apply performance
+
+        Jump through a few hoops to improve performance of function.apply in the general case.
+
+        In the case of zero or one arguments, or if there are only two arguments and the
+        second is an array literal we treat function.apply as function.call.
+
+        Otherwise we use the new opcodes op_load_varargs and op_call_varargs to do the .apply call
+        without re-entering the virtual machine.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitLoadVarargs):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+        * jit/JITStubs.h:
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::ArrayNode::isSimpleArray):
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::ApplyFunctionCallDotNode::):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        (JSC::Arguments::numProvidedArguments):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToRegisters):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-04-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25073
+        JavaScriptCore tests don't run if time zone is not PST
+
+        * API/tests/testapi.c:
+        (timeZoneIsPST): Added a function that checks whether the time zone is PST, using the same
+        method as functions in DateMath.cpp do for formatting the result.
+        (main): Skip date string format test if the time zone is not PST.
+
+2009-04-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Sam Weinig and Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25039
+        UString refactoring to support UChar* sharing.
+
+        No change in sunspider perf.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::BaseString::isShared):
+        Encapsulate the meaning behind the refcount == 1 checks because
+        this needs to do slightly more when sharing is added.
+        (JSC::concatenate):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        Make m_baseString part of a union to get rid of casts, but make it protected because
+        it is tricky to use it correctly since it is only valid when the Rep is not a BaseString.
+        The void* will be filled in when sharing is added.
+
+        Add constructors due to the making members protected and it make ensuring proper
+        initialization work better (like in SmallStringsStorage).
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::BaseString):
+        (JSC::UString::Rep::setBaseString):
+        (JSC::UString::Rep::baseString):
+
+2009-04-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25033
+        dtoa.cpp segfaults with g++ 4.4.0
+
+        g++ 4.4.0 seems to be more strict about aliasing rules, so it
+        produces incorrect code if dtoa.cpp is compiled with
+        -fstrict-aliasing (it also emits a ton of warnings, so fair enough
+        I guess). The problem was that we were only casting variables to
+        union types in order to do type punning, but GCC and the C
+        standard require that we actually use a union to store the value.
+
+        This patch does just that, the code is mostly copied from the dtoa
+        version in GCC:
+        http://gcc.gnu.org/viewcvs/trunk/libjava/classpath/native/fdlibm/dtoa.c?view=markup.
+
+        * wtf/dtoa.cpp:
+        (WTF::ulp):
+        (WTF::b2d):
+        (WTF::ratio):
+        (WTF::hexnan):
+        (WTF::strtod):
+        (WTF::dtoa):
+
+2009-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for Win port. Build the assembler sources to get missing functions.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+        * wtf/Platform.h:
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6744471> crash in GC due to uninitialized callFunction pointer
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Initialize
+        callFunction as we do the other data members that are used in the mark function.
+
+2009-04-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann
+
+        https://bugs.webkit.org/show_bug.cgi?id=24490
+
+        Implement WTF::ThreadSpecific in the Qt build using
+        QThreadStorage.
+
+        * wtf/ThreadSpecific.h:
+
+2009-04-01  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24990
+        Put SECTORDER_FLAGS into xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-AllInOneFile builds.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Function.prototype.call
+        <https://bugs.webkit.org/show_bug.cgi?id=24907>
+
+        Optimistically assume that expression.call(..) is going to be a call to
+        Function.prototype.call, and handle it specially to attempt to reduce the
+        degree of VM reentrancy.
+
+        When everything goes right this removes the vm reentry improving .call()
+        by around a factor of 10.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::CallFunctionCallDotNode::):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-03-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24884: Include strings.h for strcasecmp()
+        https://bugs.webkit.org/show_bug.cgi?id=24884
+
+        * runtime/DateMath.cpp: Reversed previous change including strings.h
+        * wtf/StringExtras.h: Include strings.h here is available
+
+2009-03-26  Adam Roben  <aroben@apple.com>
+
+        Copy testapi.js to $WebKitOutputDir on Windows
+
+        Part of Bug 24856: run-javascriptcore-tests should run testapi on
+        Windows
+        <https://bugs.webkit.org/show_bug.cgi?id=24856>
+
+        This matches what Mac does, which will help once we enable running
+        testapi from run-javascriptcore-tests on Windows.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Copy testapi.js next
+        to testapi.exe.
+
+2009-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix exception handling for instanceof in the interpreter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-03-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6724011> Write to freed memory in JSC::Label::deref
+        when reloading http://helpme.att.net/speedtest/
+
+        * bytecompiler/BytecodeGenerator.h: Reversed the declaration order for
+        m_labelScopes and m_labels to reverse their destruction order.
+        m_labelScopes has references to memory within m_labels, so its destructor
+        needs to run first.
+
+2009-03-24  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Correct warnings which in some environments are treated as errors.
+
+        * wtf/dtoa.cpp:
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::strtod):
+        (WTF::dtoa):
+
+2009-03-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+        
+        Explicitly define HAVE_LANGINFO_H on Darwin. Fixes the wx build bot jscore 
+        test failure. 
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24780
+
+        * wtf/Platform.h:
+
+2009-03-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix className() for API defined class
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::className):
+        * API/tests/testapi.c:
+        (EmptyObject_class):
+        (main):
+        * API/tests/testapi.js:
+
+2009-03-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make testapi assertions run in release builds, so that testapi actually
+        works in a release build.
+
+        Many of the testapi assertions have side effects that are necessary, and
+        given testapi is a testing program, perf impact of an assertion is not
+        important, so it makes sense to apply the assertions in release builds
+        anyway.
+
+        * API/tests/testapi.c:
+        (EvilExceptionObject_hasInstance):
+
+2009-03-23  David Kilzer  <ddkilzer@apple.com>
+
+        Provide JavaScript exception information after slow script timeout
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate): Set the exception object as the Completion
+        object's value for slow script timeouts.  This is used in
+        WebCore when reporting the exception.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::toString): Added.  Provides a
+        description message for the exception when it is reported.
+
+2009-03-23  Gustavo Noronha Silva  <gns@gnome.org> and Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24674
+        Crashes in !PLATFORM(MAC)'s formatLocaleDate, in very specific situations
+
+        Make sure strftime never returns 2-digits years to avoid ambiguity
+        and a crash. We wrap this new code option in HAVE_LANGINFO_H,
+        since it is apparently not available in all platforms.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * wtf/Platform.h:
+
+2009-03-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix exception handling in API
+
+        We can't just use the ExecState exception slot for returning exceptions
+        from class introspection functions provided through the API as many JSC
+        functions will explicitly clear the ExecState exception when returning.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Base>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Base>::put):
+        (JSC::JSCallbackObject<Base>::deleteProperty):
+        (JSC::JSCallbackObject<Base>::construct):
+        (JSC::JSCallbackObject<Base>::hasInstance):
+        (JSC::JSCallbackObject<Base>::call):
+        (JSC::JSCallbackObject<Base>::toNumber):
+        (JSC::JSCallbackObject<Base>::toString):
+        (JSC::JSCallbackObject<Base>::staticValueGetter):
+        (JSC::JSCallbackObject<Base>::callbackGetter):
+        * API/tests/testapi.c:
+        (MyObject_hasProperty):
+        (MyObject_getProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_callAsFunction):
+        (MyObject_callAsConstructor):
+        (MyObject_hasInstance):
+        (EvilExceptionObject_hasInstance):
+        (EvilExceptionObject_convertToType):
+        (EvilExceptionObject_class):
+        (main):
+        * API/tests/testapi.js:
+        (EvilExceptionObject.hasInstance):
+        (EvilExceptionObject.toNumber):
+        (EvilExceptionObject.toStringExplicit):
+
+2009-03-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20049: testapi failure: MyObject - 0 should be NaN but instead is 1.
+        <https://bugs.webkit.org/show_bug.cgi?id=20049>
+        <rdar://problem/6079127>
+
+        In this case, the test is wrong. According to the ECMA spec, subtraction
+        uses ToNumber, not ToPrimitive. Change the test to match the spec.
+
+        * API/tests/testapi.js:
+
+2009-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Ensure that JSObjectMakeFunction doesn't produce incorrect line numbers.
+
+        Also make test api correctly propagate failures.
+
+        * API/tests/testapi.c:
+        (main):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+
+2009-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Improve testapi by making it report failures in a way we can pick up
+        from our test scripts.
+
+        * API/tests/testapi.c:
+        (assertEqualsAsBoolean):
+        (assertEqualsAsNumber):
+        (assertEqualsAsUTF8String):
+        (assertEqualsAsCharactersPtr):
+        (main):
+        * API/tests/testapi.js:
+        (pass):
+        (fail):
+        (shouldBe):
+        (shouldThrow):
+
+2009-03-20  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24535
+
+        Fixes missing line terminator character (;) after macro call.
+        It is common practice to add the trailing ";" where macros are substituted
+        and not where they are defined with #define.
+        This change is consistent with other macro declarations across webkit,
+        and it also solves compilation failure with symbian compilers. 
+ 
+        * runtime/UString.cpp:
+        * wtf/Assertions.h:
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed a JavaScriptCore crash on the Windows buildbot.
+
+        * bytecompiler/BytecodeGenerator.h: Reduced the AST recursion limit.
+        Apparently, Windows has small stacks.
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little cleanup in the RegisterFile code.
+        
+        Moved large inline functions out of the class declaration, to make it
+        more readable.
+        
+        Switched over to using the roundUpAllocationSize function to avoid
+        duplicate code and subtle bugs.
+        
+        Renamed m_maxCommitted to m_commitEnd, to match m_end.
+        
+        Renamed allocationSize to commitSize because it's the chunk size for
+        committing memory, not allocating memory.
+        
+        SunSpider reports no change.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        (JSC::roundUpAllocationSize):
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6033712> -- a little bit of hardening in the Collector.
+        
+        SunSpider reports no change. I also verified in the disassembly that
+        we end up with a single compare to constant.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Oliver Hunt.
+
+        Fixed <rdar://problem/6406045> REGRESSION: Stack overflow on PowerPC on
+        fast/workers/use-machine-stack.html (22531)
+
+        Dialed down the re-entry allowance to 64 (from 128).
+        
+        On a 512K stack, this leaves about 64K for other code on the stack while
+        JavaScript is running. Not perfect, but it solves our crash on PPC.
+
+        Different platforms may want to dial this down even more.
+
+        Also, substantially shrunk BytecodeGenerator. Since we allocate one on
+        the stack in order to throw a stack overflow exception -- well, let's
+        just say the old code had an appreciation for irony.
+
+        SunSpider reports no change.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.h:
+        (JSC::):
+
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 24350: REGRESSION: Safari 4 breaks SPAW wysiwyg editor multiple instances
+        <https://bugs.webkit.org/show_bug.cgi?id=24350>
+        <rdar://problem/6674182>
+
+        The SPAW editor's JavaScript assumes that toString() on a function
+        constructed with the Function constructor produces a function with
+        a newline after the opening brace.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction): Add a newline after the opening brace of the
+        function's source code.
+
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23771: REGRESSION (r36016): JSObjectHasProperty freezes on global class without kJSClassAttributeNoAutomaticPrototype
+        <https://bugs.webkit.org/show_bug.cgi?id=23771>
+        <rdar://problem/6561016>
+
+        * API/tests/testapi.c:
+        (main): Add a test for this bug.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resetPrototype): Don't set the prototype of the
+        last object in the prototype chain to the object prototype when the
+        object prototype is already the last object in the prototype chain.
+
+2009-03-19  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/6687342> -[WebView scheduleInRunLoop:forMode:] has no affect on timers
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Added HAVE_RUNLOOP_TIMER for PLATFORM(MAC).
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6279213> Regular expression run-time complexity
+        limit too low for long inputs (21485)
+        
+        I raised PCRE's "matchLimit" (limit on backtracking) by an order of
+        magnitude. This fixes all the reported examples of timing out on legitimate
+        regular expression matches.
+        
+        In my testing on a Core Duo MacBook Pro, the longest you can get stuck
+        trying to match a string is still under 1s, so this seems like a safe change.
+        
+        I can think of a number of better solutions that are more complicated,
+        but this is a good improvement for now.
+
+        * pcre/pcre_exec.cpp:
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6603562> REGRESSION (Safari 4): regular expression
+        pattern size limit lower than Safari 3.2, other browsers, breaks SAP (14873)
+        
+        Bumped the pattern size limit to 1MB, and standardized it between PCRE
+        and WREC. (Empirical testing says that we can easily compile a 1MB regular
+        expression without risking a hang. Other browsers support bigger regular
+        expressions, but also hang.)
+        
+        SunSpider reports no change.
+        
+        I started with a patch posted to Bugzilla by Erik Corry (erikcorry@google.com).
+        
+        * pcre/pcre_internal.h:
+        (put3ByteValue):
+        (get3ByteValue):
+        (put3ByteValueAndAdvance):
+        (putLinkValueAllowZero):
+        (getLinkValueAllowZero): Made PCRE's "LINK_SIZE" (the number of bytes
+        used to record jumps between bytecodes) 3, to accomodate larger potential
+        jumps. Bumped PCRE's "MAX_PATTERN_SIZE" to 1MB. (Technically, at this
+        LINK_SIZE, we can support even larger patterns, but we risk a hang during
+        compilation, and it's not clear that such large patterns are important
+        on the web.)
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp): Match PCRE's maximum pattern size,
+        to avoid quirks between platforms.
+
+2009-03-18  Ada Chan  <adachan@apple.com>
+
+        Rolling out r41818 since it broke the windows build.
+        Error: ..\..\runtime\DatePrototype.cpp(30) : fatal error C1083: Cannot open include file: 'langinfo.h': No such file or directory
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        <rdar://problem/6692138> REGRESSION (Safari 4): Incorrect function return value when using IE "try ... finally" memory leak work-around (24654)
+        <https://bugs.webkit.org/show_bug.cgi?id=24654>
+
+        If the return value for a function is in a local register we need
+        to copy it before executing any finalisers, otherwise it is possible
+        for the finaliser to clobber the result.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasFinaliser):
+        * parser/Nodes.cpp:
+        (JSC::ReturnNode::emitBytecode):
+
+2009-03-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Mark Rowe.
+        
+        Move BUILDING_ON_* defines into Platform.h to make them available to other ports.
+        Also tweak the defines so that they work with the default values set by 
+        AvailabilityMacros.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24630
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert r41718 because it broke DumpRenderTree on Tiger.
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-Apple Mac ports build fix. Move defines for the BUILDING_ON_ macros into
+        Platform.h so that they're defined for all ports building on Mac, and tweak
+        the definitions of those macros based on Mark Rowe's suggestions to accomodate
+        cases where the values may not be <= to the .0 release for that version.
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Take advantage of the ability of recent versions of Xcode to easily switch the active
+        architecture.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Prevent AllInOneFile.cpp and ProfileGenerator.cpp from rebuilding unnecessarily when
+        switching between building in Xcode and via build-webkit.
+
+        build-webkit passes FEATURE_DEFINES to xcodebuild, resulting in it being present in the
+        Derived Sources build settings.  When building in Xcode, this setting isn't present so
+        Xcode reruns the script build phases.  This results in a new version of TracingDtrace.h
+        being generated, and the files that include it being rebuilt.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:  Don't regenerate TracingDtrace.h if it is
+        already newer than the input file.
+
+2009-03-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Resolved name conflict with globally defined tzname in Symbian.
+        Replaced with different name instead of using namespace qualifier
+        (appeared to be less clumsy).
+
+        * runtime/DateMath.cpp:
+
+2009-03-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6548446> TCMalloc_SystemRelease should use madvise rather than re-mmaping span of pages
+
+        * wtf/FastMalloc.cpp:
+        (WTF::mergeDecommittedStates): If either of the spans has been released to the system, release the other
+        span as well so that the flag in the merged span is accurate.
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp: Track decommitted spans when using MADV_FREE_REUSABLE / MADV_FREE_REUSE.
+        (TCMalloc_SystemRelease): Use madvise with MADV_FREE_REUSABLE when it is available.
+        (TCMalloc_SystemCommit): Use madvise with MADV_FREE_REUSE when it is available.
+        * wtf/TCSystemAlloc.h:
+
+2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Include string.h for strlen usage.
+
+        * wtf/Threading.cpp:
+
+2009-03-12  David Kilzer  <ddkilzer@apple.com>
+
+        Add NO_RETURN attribute to runInteractive() when not using readline
+
+        Reviewed by Darin Adler.
+
+        * jsc.cpp:
+        (runInteractive): If the readline library is not used, this method
+        will never return, thus the NO_RETURN attribute is needed to prevent
+        a gcc warning.
+
+2009-03-12  Adam Roben  <aroben@apple.com>
+
+        Adopt setThreadNameInternal on Windows
+
+        Also changed a Windows-only assertion about thread name length to an
+        all-platform log message.
+
+        Reviewed by Adam Treat.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread): Warn if the thread name is longer than 31
+        characters, as Visual Studio will truncate names longer than that
+        length.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadNameInternal): Renamed from setThreadName and changed
+        to always operate on the current thread.
+        (WTF::initializeThreading): Changed to use setThreadNameInternal.
+        (WTF::createThreadInternal): Removed call to setThreadName. This is
+        now handled by threadEntryPoint and setThreadNameInternal.
+
+2009-03-11  David Kilzer  <ddkilzer@apple.com>
+
+        Clarify comments regarding order of FEATURE_DEFINES
+
+        Rubber-stamped by Mark Rowe.
+
+        * Configurations/JavaScriptCore.xcconfig: Added warning about
+        the consequences when FEATURE_DEFINES are not kept in sync.
+
+2009-03-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - WTF support for fixing <rdar://problem/3919124> Thai text selection
+          in Safari is incorrect
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext): Added. Returns
+        whether the character has Unicode line breaking property value SA
+        ("Complex Context").
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext): Added an
+        implementation that always returns false.
+
+2009-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Give threads names on platforms with pthread_setname_np.
+
+        * wtf/Threading.cpp:
+        (WTF::NewThreadContext::NewThreadContext): Initialize thread name.
+        (WTF::threadEntryPoint): Call setThreadNameInternal.
+        (WTF::createThread): Pass thread name.
+
+        * wtf/Threading.h: Added new comments, setThreadNameInternal.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingNone.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Call pthread_setname_np when available.
+        * wtf/ThreadingQt.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+
+2009-03-11  Adam Roben  <aroben@apple.com>
+
+        Change the Windows implementation of ThreadSpecific to use functions
+        instead of extern globals
+
+        This will make it easier to export ThreadSpecific from WebKit.
+
+        Reviewed by John Sullivan.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): 
+        Touched this file to force ThreadSpecific.h to be copied into
+        $WebKitOutputDir.
+
+        * wtf/ThreadSpecific.h: Replaced g_tls_key_count with tlsKeyCount()
+        and g_tls_keys with tlsKeys().
+
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+        Updated to use the new functions.
+
+        * wtf/ThreadSpecificWin.cpp:
+        (WTF::tlsKeyCount):
+        (WTF::tlsKeys):
+        Added.
+
+        (WTF::ThreadSpecificThreadExit): Changed to use the new functions.
+
+2009-03-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 24291: REGRESSION (r38635): Single line JavaScript comment prevents HTML button click handler execution
+        <https://bugs.webkit.org/show_bug.cgi?id=24291>
+        <rdar://problem/6663472>
+
+        Add an extra newline to the end of the body of the program text constructed
+        by the Function constructor for parsing. This allows single line comments to
+        be handled correctly by the parser.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+
+2009-03-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 24447: REGRESSION (r41508): Google Maps does not complete initialization
+        <rdar://problem/6657774>
+
+        r41508 actually exposed a pre-existing bug where we were not invalidating the result
+        register cache at jump targets.  This causes problems when condition loads occur in an
+        expression -- namely through the ?: and || operators.  This patch corrects these issues
+        by marking the target of all forward jumps as being a jump target, and then clears the
+        result register cache when ever it starts generating code for a targeted instruction.
+
+        I do not believe it is possible to cause this class of failure outside of a single
+        expression, and expressions only provide forward branches, so this should resolve this
+        entire class of bug.  That said i've included a test case that gets as close as possible
+        to hitting this bug with a back branch, to hopefully prevent anyone from introducing the
+        problem in future.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::isUsed):
+        (JSC::AbstractMacroAssembler::Label::used):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::JmpDst):
+        (JSC::X86Assembler::JmpDst::isUsed):
+        (JSC::X86Assembler::JmpDst::used):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23175: String and UString should be able to share a UChar* buffer.
+        <https://bugs.webkit.org/show_bug.cgi?id=23175>
+
+        Add CrossThreadRefCounted.
+
+        * wtf/CrossThreadRefCounted.h: Added.
+        (WTF::CrossThreadRefCounted::create):
+        (WTF::CrossThreadRefCounted::isShared):
+        (WTF::CrossThreadRefCounted::dataAccessMustBeThreadSafe):
+        (WTF::CrossThreadRefCounted::mayBePassedToAnotherThread):
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::CrossThreadRefCounted::~CrossThreadRefCounted):
+        (WTF::CrossThreadRefCounted::ref):
+        (WTF::CrossThreadRefCounted::deref):
+        (WTF::CrossThreadRefCounted::release):
+        (WTF::CrossThreadRefCounted::copy):
+        (WTF::CrossThreadRefCounted::threadSafeDeref):
+        * wtf/RefCounted.h:
+        * wtf/Threading.h:
+        (WTF::ThreadSafeSharedBase::ThreadSafeSharedBase):
+        (WTF::ThreadSafeSharedBase::derefBase):
+        (WTF::ThreadSafeShared::ThreadSafeShared):
+        (WTF::ThreadSafeShared::deref):
+
+2009-03-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24353
+        Allow to overrule default build options for Qt build.
+
+        * JavaScriptCore.pri: Allow to overrule ENABLE_JIT
+
+2009-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+
+2009-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 24268: RuntimeArray is not a fully implemented JSArray
+        <https://bugs.webkit.org/show_bug.cgi?id=24268>
+
+        Don't cast a type to JSArray, just because it reportsArray as a supertype
+        in the JS type system.  Doesn't appear feasible to create a testcase
+        unfortunately as setting up the failure conditions requires internal access 
+        to JSC not present in DRT.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+
+2009-03-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        When preforming an op_mov, preserve any existing register mapping.
+
+        ~0.5% progression on v8 tests x86-64.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-05  Simone Fiorentino  <simone.fiorentino@consulenti.fastweb.it>
+
+        Bug 24382: request to add SH4 platform
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24382>
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h: Added support for SH4 platform.
+
+2009-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Writes of constant values to SF registers should be made with direct memory
+        writes where possible, rather than moving the value via a hardware register.
+
+        ~3% win on SunSpider tests on x86, ~1.5% win on v8 tests on x86-64.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_i32m):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-05  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        Sprinkle "static" around NumberConstructor.cpp in order to please the compiler.
+
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+
+2009-03-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6354858> FastMallocZone's enumeration code reports fragmented administration space
+
+        The handling of MALLOC_ADMIN_REGION_RANGE_TYPE in FastMalloc's zone was incorrect.  It was attempting
+        to record the memory containing and individual span as an administrative region, when all memory
+        allocated via MetaDataAlloc should in fact be recorded.  This was causing memory regions allocated
+        via MetaDataAlloc to appear as "VM_ALLOCATE ?" in vmmap output.  They are now correctly reported as
+        "MALLOC_OTHER" regions associated with the JavaScriptCore FastMalloc zone.
+
+        Memory is allocated via MetaDataAlloc from two locations: PageHeapAllocator, and TCMalloc_PageMap{2,3}.
+        These two cases are handled differently.
+
+        PageHeapAllocator is extended to keep a linked list of memory regions that it has allocated.  The
+        first object in an allocated region contains the link to the previously allocated region. To record
+        the administrative regions of a PageHeapAllocator we can simply walk the linked list and record
+        each allocated region we encounter.
+
+        TCMalloc_PageMaps allocate memory via MetaDataAlloc to store each level of the radix tree.  To record
+        the administrative regions of a TCMalloc_PageMap we walk the tree and record the storage used for nodes
+        at each position rather than the nodes themselves.
+
+        A small performance improvement is achieved by coalescing adjacent memory regions inside the PageMapMemoryUsageRecorder
+        so that fewer calls in to the range recorder are necessary.  We further reduce the number of calls to the
+        range recorder by aggregating the in-use ranges of a given memory region into a local buffer before recording
+        them with a single call.  A similar approach is also used by AdminRegionRecorder.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::Init):
+        (WTF::PageHeapAllocator::New):
+        (WTF::PageHeapAllocator::recordAdministrativeRegions):
+        (WTF::TCMallocStats::FreeObjectFinder::isFreeObject):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::~PageMapMemoryUsageRecorder):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::recordPendingRegions):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::visit):
+        (WTF::TCMallocStats::AdminRegionRecorder::AdminRegionRecorder):
+        (WTF::TCMallocStats::AdminRegionRecorder::recordRegion):
+        (WTF::TCMallocStats::AdminRegionRecorder::visit):
+        (WTF::TCMallocStats::AdminRegionRecorder::recordPendingRegions):
+        (WTF::TCMallocStats::AdminRegionRecorder::~AdminRegionRecorder):
+        (WTF::TCMallocStats::FastMallocZone::enumerate):
+        (WTF::TCMallocStats::FastMallocZone::FastMallocZone):
+        (WTF::TCMallocStats::FastMallocZone::init):
+        * wtf/TCPageMap.h:
+        (TCMalloc_PageMap2::visitValues):
+        (TCMalloc_PageMap2::visitAllocations):
+        (TCMalloc_PageMap3::visitValues):
+        (TCMalloc_PageMap3::visitAllocations):
+
+2009-03-04  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24359
+        Repaint throttling mechanism
+        
+        Set ENABLE_REPAINT_THROTTLING to 0 by default.
+
+        * wtf/Platform.h:
+
+2009-03-03  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6581203> WebCore and WebKit should install the same set of headers during installhdrs phase as build phase
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Defined REAL_PLATFORM_NAME based
+        on PLATFORM_NAME to work around the missing definition on Tiger.
+        Updated HAVE_DTRACE to use REAL_PLATFORM_NAME.
+
+2009-03-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6639110> console.profile() doesn't work without a title
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::startProfiling): assert if there is not title to ensure
+        we don't start profiling without one.
+
+2009-03-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Enable Geolocation (except on Tiger and Leopard).
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-03-01  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6635688> Move HAVE_DTRACE check to Base.xcconfig
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Set HAVE_DTRACE Xcode variable
+        based on PLATFORM_NAME and MAC_OS_X_VERSION_MAJOR.  Also define
+        it as a preprocessor macro by modifying
+        GCC_PREPROCESSOR_DEFINITIONS.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed "Generate
+        DTrace header" script phase to check for HAVE_DTRACE instead of
+        MACOSX_DEPLOYMENT_TARGET.
+        * wtf/Platform.h: Removed definition of HAVE_DTRACE macro since
+        it's defined in Base.xcconfig now.
+
+2009-03-01  Horia Olaru  <olaru@adobe.com>
+
+        By looking in grammar.y there are only a few types of statement nodes
+        on which the debugger should stop. 
+
+        Removed isBlock and isLoop virtual calls. No need to emit debug hooks in
+        the "statementListEmitCode" method as long as the necessary hooks can be
+        added in each "emitCode".
+
+        https://bugs.webkit.org/show_bug.cgi?id=21073
+
+        Reviewed by Kevin McCullough.
+
+        * parser/Nodes.cpp:
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::statementListEmitCode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * parser/Nodes.h:
+
+2009-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix bug #23614.  Switches on double precision values were incorrectly
+        truncating the scrutinee value.  E.g.:
+
+            switch (1.1) { case 1: print("FAIL"); }
+
+        Was resulting in FAIL.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_switch_imm):
+
+2009-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Integer Immediate representation need not be canonical in x86 JIT code.
+        On x86-64 we already have loosened the requirement that the int immediate
+        representation in canonical, we should bring x86 into line.
+
+        This patch is a minor (~0.5%) improvement on sunspider & v8-tests, and
+        should reduce memory footoprint (reduces JIT code size).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-26  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24099
+        ARM Compiler Warnings in pcre_exec.cpp
+
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2009-02-25  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 24086: Regression (r40993): WebKit crashes after logging in to lists.zenbe
+        <https://bugs.webkit.org/show_bug.cgi?id=24086>
+        <rdar://problem/6625111>
+
+        The numeric sort optimization in r40993 generated bytecode for a function
+        without generating JIT code. This breaks an assumption in some parts of
+        the JIT's function calling logic that the presence of a CodeBlock implies
+        the existence of JIT code.
+
+        In order to fix this, we simply generate JIT code whenever we check whether
+        a function is a numeric sort function. This only incurs an additional cost
+        in the case when the function is a numeric sort function, in which case it
+        is not expensive to generate JIT code for it.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+
+2009-02-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/6611174> REGRESSION (r36701): Unable to select
+        messages on hotmail (24052)
+        
+        The bug was that for-in enumeration used a cached prototype chain without
+        validating that it was up-to-date.
+        
+        This led me to refactor prototype chain caching so it was easier to work
+        with and harder to get wrong.
+        
+        After a bit of inlining, this patch is performance-neutral on SunSpider
+        and the v8 benchmarks.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list): Use the new refactored goodness. See
+        lines beginning with "-" and smile.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup): A shout out to const.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next): We can use a pointer comparison to
+        see if our cached structure chain is equal to the object's structure chain,
+        since in the case of a cache hit, we share references to the same structure
+        chain.
+
+        * runtime/Operations.h:
+        (JSC::countPrototypeChainEntriesAndCheckForProxies): Use the new refactored
+        goodness.
+
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::setShouldCache):
+        (JSC::PropertyNameArray::shouldCache): Renamed "cacheable" to "shouldCache"
+        to communicate that the client is specifying a recommendation, not a
+        capability.
+        
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): No need to initialize a RefPtr.
+        (JSC::Structure::getEnumerablePropertyNames): Moved some code into helper
+        functions.
+
+        (JSC::Structure::prototypeChain): New centralized accessor for a prototype
+        chain. Revalidates on every access, since the objects in the prototype
+        chain may have mutated.
+
+        (JSC::Structure::isValid): Helper function for revalidating a cached
+        prototype chain.
+
+        (JSC::Structure::getEnumerableNamesFromPropertyTable):
+        (JSC::Structure::getEnumerableNamesFromClassInfoTable): Factored out of
+        getEnumerablePropertyNames.
+
+        * runtime/Structure.h:
+
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create): No need for structureChainsAreEqual, since
+        we use pointer equality now. Refactored StructureChain to make a little
+        more sense and eliminate special cases for null prototypes.
+
+2009-02-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Use timeBeginPeriod to enable timing resolution greater than 16ms in command line jsc for Windows.
+        Allows more accurate reporting of benchmark times via command line jsc.exe. Doesn't affect WebKit's use of JavaScriptCore.
+        
+        Reviewed by Adam Roben.
+
+        * jsc.cpp:
+        (main):
+
+2009-02-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix?
+
+        * GNUmakefile.am:
+
+2009-02-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6259220> Rename AVAILABLE_AFTER_WEBKIT_VERSION_3_1 (etc.) to match the other macros
+
+        * API/JSBasePrivate.h:
+        * API/JSContextRef.h:
+        * API/JSObjectRef.h:
+        * API/WebKitAvailability.h:
+
+2009-02-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Next step in splitting JIT functionality out of the Interpreter class:
+        Moved vptr storage from Interpreter to JSGlobalData, so it could be shared
+        between Interpreter and JITStubs, and moved the *Trampoline JIT stubs
+        into the JITStubs class. Also added a VPtrSet class to encapsulate vptr
+        hacks during JSGlobalData initialization.
+        
+        SunSpider says 0.4% faster. Meh.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_is_string):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::ctiArrayLengthTrampoline):
+        (JSC::JITStubs::ctiStringLengthTrampoline):
+        (JSC::JITStubs::ctiVirtualCallPreLink):
+        (JSC::JITStubs::ctiVirtualCallLink):
+        (JSC::JITStubs::ctiVirtualCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/JSArray.h:
+        (JSC::isJSArray):
+        * runtime/JSByteArray.h:
+        (JSC::asByteArray):
+        (JSC::isJSByteArray):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        * runtime/JSString.h:
+        (JSC::isJSString):
+        * runtime/Operations.h:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+
+2009-02-23  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23787: Allow JIT to generate SSE2 code if using GCC
+        <https://bugs.webkit.org/show_bug.cgi?id=23787>
+
+        GCC version of the cpuid check.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present): previous assembly code fixed.
+
+2009-02-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24047: Need to simplify nested if's in WorkerRunLoop::runInMode
+        <https://bugs.webkit.org/show_bug.cgi?id=24047>
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::infiniteTime):
+        Allows for one to call waitForMessageFilteredWithTimeout and wait forever.
+
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::waitForMessage):
+        Made waitForMessage call waitForMessageFilteredWithTimeout, so that there is less
+        duplicate code.
+
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait):
+        Made these two implementations consistent with the pthread and gtk implementations.
+        Currently, the time calculations would overflow when passed large values.
+
+2009-02-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24096
+        PLATFORM(MAC)->PLATFORM(CF) since we want to use the CF functions in Chrome on OS X.
+
+        * wtf/CurrentTime.cpp:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix?
+
+        * GNUmakefile.am:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * GNUmakefile.am:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Next step in splitting JIT functionality out of the Interpreter class:
+        Created a JITStubs class and renamed Interpreter::cti_* to JITStubs::cti_*.
+        
+        Also, moved timeout checking into its own class, located in JSGlobalData,
+        so both the Interpreter and the JIT could have access to it.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/TimeoutChecker.cpp: Copied from interpreter/Interpreter.cpp.
+        (JSC::TimeoutChecker::TimeoutChecker):
+        (JSC::TimeoutChecker::reset):
+        (JSC::TimeoutChecker::didTimeOut):
+        * runtime/TimeoutChecker.h: Copied from interpreter/Interpreter.h.
+        (JSC::TimeoutChecker::setTimeoutInterval):
+        (JSC::TimeoutChecker::ticksUntilNextCheck):
+        (JSC::TimeoutChecker::start):
+        (JSC::TimeoutChecker::stop):
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix after r41100.
+
+        * GNUmakefile.am:
+
+2009-02-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6606660> 2==null returns true in 64bit jit
+
+        Code for op_eq_null and op_neq_null was incorrectly performing
+        a 32bit compare, which truncated the type tag from an integer
+        immediate, leading to incorrect behaviour.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::setPtr):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::setPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-02-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        First step in splitting JIT functionality out of the Interpreter class:
+        Created JITStubs.h/.cpp, and moved Interpreter::cti_* into JITStubs.cpp.
+        
+        Functions that the Interpreter and JITStubs share moved to Operations.h/.cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.cpp: Copied from interpreter/Interpreter.cpp.
+        (JSC::Interpreter::cti_op_resolve_base):
+        * jit/JITStubs.h: Copied from interpreter/Interpreter.h.
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/Operations.h:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::cachePrototypeChain):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::resolveBase):
+
+2009-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for x86-64. Where the JavaScriptCore text segment lies outside
+        a 2gb range of the heap containing JIT generated code, callbacks
+        from JIT code to the stub functions in Interpreter will be incorrectly
+        linked.
+
+        No performance impact on Sunspider, 1% regression on v8-tests,
+        due to a 3% regression on richards.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::tailRecursiveCall):
+        (JSC::MacroAssembler::makeTailRecursiveCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::call):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::patchJump):
+        (JSC::X86Assembler::patchCall):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::patchAddress):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Simplified .call and .apply in preparation for optimizing them. Also,
+        a little cleanup.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall): No need to do any specific conversion on
+        'this' -- op_convert_this will do it if necessary.
+
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject): Slightly relaxed the rules on
+        toThisObject to allow for 'undefined', which can be passed through
+        .call and .apply.
+
+2009-02-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23976: MessageQueue needs a way to wait for a message that satisfies an arbitrary criteria.
+        <https://bugs.webkit.org/show_bug.cgi?id=23976>
+
+        * wtf/Deque.h:
+        (WTF::Deque<T>::findIf):
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue<T>::waitForMessageFiltered):
+
+2009-02-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23974: Deque::Remove would be a useful method.
+        <https://bugs.webkit.org/show_bug.cgi?id=23974>
+
+        Add Deque::remove and DequeIteratorBase<T>::operator=.
+
+        Why was operator= added? Every concrete iterator (DequeIterator..DequeConstReverseIterator)
+        was calling DequeIteratorBase::assign(), which called Base::operator=(). Base::operator=()
+        was not implemented. This went unnoticed because the iterator copy code has been unused.
+
+        * wtf/Deque.h:
+        (WTF::Deque<T>::remove):
+        (WTF::DequeIteratorBase<T>::removeFromIteratorsList):
+        (WTF::DequeIteratorBase<T>::operator=):
+        (WTF::DequeIteratorBase<T>::~DequeIteratorBase):
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix symbols.filter location, and add other missing files to the
+        autotools build, so that make dist works.
+
+        * GNUmakefile.am:
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed failure in js1_5/Regress/regress-168347.js, as seen on the Oliver
+        bot.
+        
+        Technically, both behaviors are OK, but we might as well keep this test
+        passing.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded): No need to add a trailing semicolon
+        after a trailing '}', since '}' ends a block, indicating the end of a
+        statement.
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * runtime/FunctionPrototype.cpp:
+
+2009-02-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add assertion to guard against oversized pc relative calls.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::link):
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6595040> REGRESSION: http://www.amnestyusa.org/
+        fails to load.
+        
+        amnestyusa.org uses the Optimist JavaScript library, which adds event
+        listeners by concatenating string-ified functions. This is only sure to
+        be syntactically valid if the string-ified functions end in semicolons.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::isWhiteSpace):
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        (JSC::Lexer::isLineTerminator): Added some helper functions for examining
+        whitespace.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::appendSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString): When string-ifying a function, insert
+        a semicolon in the last non-whitespace position, if one doesn't already exist.
+
+2009-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Roll out r41022 as it breaks qt and gtk builds
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present):
+
+2009-02-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6468156>
+        REGRESSION (r36779): Adding link, images, flash in TinyMCE blocks entire page (21382)
+
+        No performance regression.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::fillArgList): Add codepath for when the "length" property has been
+        overridden.
+
+2009-02-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::):
+        (WTF::TCMallocStats::FastMallocZone::FastMallocZone):
+
+2009-02-16  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23787: Allow JIT to generate SSE2 code if using GCC
+        <https://bugs.webkit.org/show_bug.cgi?id=23787>
+
+        GCC version of the cpuid check.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present): GCC assembly code added.
+        6.6% progression on x86 Linux with JIT and WREC on SunSpider if using SSE2 capable machine.
 
 2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
 
@@ -72,6 +10249,294 @@
         * wtf/ThreadingQt.cpp:
         (WTF::isMainThread):
 
+2009-02-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Some data in the instruction stream is potentially uninitialized - fix this.
+
+        Change the OperandTypes constructor so that uninitialized memory in the int
+        is zeroed, and modify the Instruction constructor taking an Opcode so that
+        if !HAVE(COMPUTED_GOTO) (i.e. when Opcode is an enum, and is potentially only
+        a byte) it zeros the Instruction first before writing the opcode.
+
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * parser/ResultType.h:
+        (JSC::OperandTypes::OperandTypes):
+
+2009-02-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix for non_JIT platforms.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setIsNumericCompareFunction):
+        (JSC::CodeBlock::isNumericCompareFunction):
+
+2009-02-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/6584057> Optimize sort by JS numeric comparison
+        function not to run the comparison function
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setIsNumericCompareFunction):
+        (JSC::CodeBlock::isNumericCompareFunction): Added the ability to track
+        whether a CodeBlock performs a sort-like numeric comparison.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Set the isNumericCompareFunction bit
+        after compiling.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::emitBytecode): Fixed a bug that caused us to
+        codegen an extra return at the end of all functions (eek!), since this
+        made it harder / weirder to detect the numeric comparison pattern in
+        bytecode.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort): Use the isNumericCompareFunction bit to do
+        a faster sort if we can.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody):
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h: Renamed and exported extractFunctionBody for
+        use in initializing lazyNumericCompareFunction.
+
+        * runtime/JSArray.cpp:
+        (JSC::compareNumbersForQSort):
+        (JSC::compareByStringPairForQSort):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        * runtime/JSArray.h: Added a fast numeric sort. Renamed ArrayQSortPair
+        to be more specific since we do different kinds of qsort now.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::numericCompareFunction):
+        (JSC::JSGlobalData::ClientData::~ClientData):
+        * runtime/JSGlobalData.h: Added helper data for computing the
+        isNumericCompareFunction bit.
+
+2009-02-13  Darin Adler  <darin@apple.com>
+
+        * Configurations/JavaScriptCore.xcconfig: Undo accidental commit of this file.
+
+2009-02-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt and Alexey Proskuryakov.
+
+        Speed up a couple string functions.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIndexOf): Added a fast path for cases where the second
+        argument is either missing or an integer.
+        (JSC::stringProtoFuncBig): Use jsNontrivialString since the string is guaranteed
+        to be 2 or more characters long.
+        (JSC::stringProtoFuncSmall): Ditto.
+        (JSC::stringProtoFuncBlink): Ditto.
+        (JSC::stringProtoFuncBold): Ditto.
+        (JSC::stringProtoFuncItalics): Ditto.
+        (JSC::stringProtoFuncStrike): Ditto.
+        (JSC::stringProtoFuncSub): Ditto.
+        (JSC::stringProtoFuncSup): Ditto.
+        (JSC::stringProtoFuncFontcolor): Ditto.
+        (JSC::stringProtoFuncFontsize): Make the fast path Sam recently added even faster
+        by avoiding all but the minimum memory allocation.
+        (JSC::stringProtoFuncAnchor): Use jsNontrivialString.
+        (JSC::stringProtoFuncLink): Added a fast path.
+
+        * runtime/UString.cpp:
+        (JSC::UString::find): Added a fast path for single-character search strings.
+
+2009-02-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23926: Race condition in callOnMainThreadAndWait
+        <https://bugs.webkit.org/show_bug.cgi?id=23926>
+
+        * wtf/MainThread.cpp:
+        Removed callOnMainThreadAndWait since it isn't used.
+
+2009-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Math.random is really slow on windows.
+
+        Math.random calls WTF::randomNumber which is implemented as
+        the secure rand_s on windows.  Unfortunately rand_s is an order
+        of magnitude slower than arc4random.  For this reason I've
+        added "weakRandomNumber" for use by JavaScript's Math Object.
+        In the long term we should look at using our own secure PRNG
+        in place of the system, but this will do for now.
+
+        30% win on SunSpider on Windows, resolving most of the remaining
+        disparity vs. Mac.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom):
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
+        * wtf/RandomNumber.h:
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeWeakRandomNumberGenerator):
+
+2009-02-12  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build for other platforms.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove (/reduce) use of hard-wired register names from the JIT.
+        Currently there is no abstraction of registers used in the JIT,
+        which has a number of negative consequences.  Hard-wiring x86
+        register names makes the JIT less portable to other platforms,
+        and prevents us from performing dynamic register allocation to
+        attempt to maintain more temporary values in machine registers.
+        (The latter will be more important on x86-64, where we have more
+        registers to make use of).
+
+        Also, remove MacroAssembler::mod32.  This was not providing a
+        useful abstraction, and was not in keeping with the rest of the
+        MacroAssembler interface, in having specific register requirements.
+
+        * assembler/MacroAssemblerX86Common.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-12  Horia Olaru  <olaru@adobe.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23400
+
+        When throwing an exception within an eval argument string, the dst parameter was
+        modified in the functions below and the return value for eval was altered. Changed
+        the emitNode call in JSC::ThrowNode::emitBytecode to use a temporary register
+        to store its results instead of dst. The JSC::FunctionCallResolveNode::emitBytecode
+        would load the function within the dst registry, also altering the result returned
+        by eval. Replaced it with another temporary.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+
+2009-02-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Speed up String.prototype.fontsize.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize): Specialize for defined/commonly used values.
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Correctness fix.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Divide by the maximum representable value, which
+        is different on each platform now, to get values between 0 and 1.
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6582048>.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Make only one call to the random number generator
+        on platforms where the generator is cryptographically secure. The value
+        of randomness over and above cryptographically secure randomness is not
+        clear, and it caused some performance problems.
+
+2009-02-12  Adam Roben  <aroben@apple.com>
+
+        Fix lots of Perl warnings when building JavaScriptCoreGenerated on
+        Windows
+
+        Reviewed by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        Create the docs/ directory so that we can write bytecode.html into it.
+        This matches what JavaScriptCore.xcodeproj does.
+
 2009-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Rubber-stamped by Lars.
@@ -80,6 +10545,615 @@
 
         * JavaScriptCore.pri:
 
+2009-02-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23705
+        Fix the UI freeze caused by Worker generating a flood of messages.
+        Measure time we spend in executing posted work items. If too much time is spent
+        without returning to the run loop, exit and reschedule.
+
+        * wtf/MainThread.h:
+        Added initializeMainThreadPlatform() to initialize low-level mechanism for posting
+        work items from thread to thread. This removes #ifdefs for WIN and CHROMIUM from platform-independent code.
+
+        * wtf/MainThread.cpp:
+        (WTF::initializeMainThread):
+        (WTF::dispatchFunctionsFromMainThread):
+        Instead of dispatching all work items in the queue, dispatch them one by one
+        and measure elapsed time. After a threshold, reschedule and quit.
+
+        (WTF::callOnMainThread):
+        (WTF::callOnMainThreadAndWait):
+        Only schedule dispatch if the queue was empty - to avoid many posted messages in the run loop queue.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+        Use static instance of the mainThreadCaller instead of allocating and releasing it each time.
+        (WTF::initializeMainThreadPlatform):
+        * wtf/gtk/MainThreadChromium.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/gtk/MainThreadGtk.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/qt/MainThreadQt.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/wx/MainThreadWx.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Style cleanup.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::operator bool):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::ProcessorReturnAddress):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::operator void*):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/AbstractMacroAssembler.h: Fix comments.
+
+2009-02-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Trying to fix wx build.
+
+        * bytecode/JumpTable.h: Include "MacroAssembler.h", not <MacroAssembler.h>.
+        * jscore.bkl: Added assembler directory to search paths.
+
+2009-02-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Build
+        fix.
+        (Narrow
+        changelog
+        for
+        dhyatt).
+
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+
+2009-02-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Reduce use of void* / reinterpret_cast in JIT repatching code,
+        add strong types for Calls and for the various types of pointers
+        we retain into the JIT generated instruction stream.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::asIntptr):
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Call::link):
+        (JSC::AbstractMacroAssembler::Call::linkTo):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::operator bool):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::CodeLocationLabel):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::ProcessorReturnAddress):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::operator void*):
+        (JSC::AbstractMacroAssembler::PatchBuffer::entry):
+        (JSC::AbstractMacroAssembler::PatchBuffer::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::locationOf):
+        (JSC::AbstractMacroAssembler::PatchBuffer::returnAddressOffset):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::call):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getCallReturnOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::getCallLinkInfoReturnLocation):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::ctiForValue):
+        (JSC::SimpleJumpTable::ctiForValue):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::prepareJumpTableForStringSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_vm_throw):
+        * jit/JIT.cpp:
+        (JSC::ctiSetReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JIT::compileGetByIdSelf):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdReplace):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        (JSC::JIT::emitCTICall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitCTICall_internal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-10  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r40813
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Added profiler/ to the include
+        path so that Profiler.h can be found.
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Provide a class type for a generated block of JIT code.
+        Also changes the return address -> bytecode index map to
+        track the return addess as an unsigned offset into the code
+        instead of a ptrdiff_t in terms of void**s - the latter is
+        equal to the actual offset / sizeof(void*), making it a
+        potentially lossy representation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::returnAddressOffset):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getCallReturnOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CallReturnOffsetToBytecodeIndex::CallReturnOffsetToBytecodeIndex):
+        (JSC::getCallReturnOffset):
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::callReturnIndexVector):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::):
+        * jit/JITCall.cpp:
+        (JSC::JIT::linkCall):
+        * jit/JITCode.h: Added.
+        (JSC::):
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::operator bool):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+
+2009-02-09  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23856
+        Change the definition of "main thread" for Chromium on OSX.
+        It does not match the DARWIN definition.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Minor bugfix, incorrect check meant that subtraction causing integer overflow
+        would be missed on x86-64 JIT.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A more sensible register allocation for x86-64.
+
+        When WREC was ported to x86-64 it stuck with the same register allocation as x86.
+        This requires registers to be reordered on entry into WREC generated code, since
+        argument passing is different on x86-64 and x86 (regparm(3)).  This patch switches
+        x86-64 to use a native register allocation, that does not require argument registers
+        to be reordered.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+
+2009-02-05  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        Rubberstamped by Sam Weinig.
+
+        * wtf/TypeTraits.h: Include Platform.h, since this header uses macros
+        defined there.
+
+2009-02-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23747
+        Add Chromium threading-related files.
+
+        * wtf/MainThread.cpp: Added platform guard to initializeMainThread.
+        * wtf/chromium/ChromiumThreading.h: Added.
+        * wtf/chromium/MainThreadChromium.cpp: Added.
+        (WTF::initializeMainThread):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-02-05  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23713: COMPILE_ASSERTS should be moved out of TypeTraits.h and into .cpp file
+        <https://bugs.webkit.org/show_bug.cgi?id=23713>
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+        * wtf/HashTraits.h:
+        Remove unnecessary header file that I missed when moving out the type traits form this file.
+
+        * wtf/TypeTraits.cpp: Added.
+        (WTF::):
+        * wtf/TypeTraits.h:
+        Moved the compile asserts into TypeTraits.cpp file.
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver 'the nun' Hunt.
+
+        Add -e switch to jsc to enable evaluation of scripts passed on the command line.
+
+        * jsc.cpp:
+        (Script::Script):
+        (runWithScripts):
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam 'Big Mac' Weinig.
+
+        * assembler/AbstractMacroAssembler.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86Common.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86_64.h: Copied from assembler/MacroAssembler.h.
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        This patch tidies up the MacroAssembler, cleaning up the code and refactoring out the
+        platform-specific parts.  The MacroAssembler gets split up like a beef burger, with the
+        platform-agnostic data types being the lower bun (in the form of the class AbstractMacroAssembler),
+        the plaform-specific code generation forming a big meaty patty of methods like 'add32',
+        'branch32', etc (MacroAssemblerX86), and finally topped off with the bun-lid of the
+        MacroAssembler class itself, providing covenience methods such as the stack peek & poke,
+        and backwards branch methods, all of which can be described in a platform independent
+        way using methods from the base class.  The AbstractMacroAssembler is templated on the
+        type of the assembler class that will be used for code generation, and the three layers
+        are held together with the cocktail stick of inheritance.
+
+        The above description is a slight simplification since the MacroAssemblerX86 is actually
+        formed from two layers (in effect giving us a kind on bacon double cheeseburger) - with the
+        bulk of methods that are common between x86 & x86-64 implemented in MacroAssemblerX86Common,
+        which forms a base class for MacroAssemblerX86 and MacroAssemblerX86_64 (which add the methods
+        specific to the given platform).
+
+        I'm landing these changes first without splitting the classes across multiple files,
+        I will follow up with a second patch to split up the file MacroAssembler.h.
+
+        * assembler/MacroAssembler.h:
+        (JSC::AbstractMacroAssembler::):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::patch):
+        (JSC::AbstractMacroAssembler::DataLabel32::DataLabel32):
+        (JSC::AbstractMacroAssembler::DataLabel32::patch):
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::Jump::patch):
+        (JSC::AbstractMacroAssembler::JumpList::link):
+        (JSC::AbstractMacroAssembler::JumpList::linkTo):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::addressOf):
+        (JSC::AbstractMacroAssembler::PatchBuffer::setPtr):
+        (JSC::AbstractMacroAssembler::size):
+        (JSC::AbstractMacroAssembler::copyCode):
+        (JSC::AbstractMacroAssembler::label):
+        (JSC::AbstractMacroAssembler::align):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::swap):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::jump):
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        (JSC::MacroAssemblerX86_64::load32):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        (JSC::MacroAssemblerX86_64::andPtr):
+        (JSC::MacroAssemblerX86_64::orPtr):
+        (JSC::MacroAssemblerX86_64::rshiftPtr):
+        (JSC::MacroAssemblerX86_64::subPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        (JSC::MacroAssemblerX86_64::loadPtr):
+        (JSC::MacroAssemblerX86_64::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::sub32):
+        (JSC::MacroAssemblerX86::load32):
+        (JSC::MacroAssemblerX86::store32):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::peek):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branch16):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::rshiftPtr):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23681
+        Worker tests crash in debug builds if run --singly
+
+        The crash happened because worker threads continued running while debug-only static objects
+        were already being destroyed on main thread.
+
+        * runtime/Structure.cpp: Create static debug-only sets in heap, so that they don't get
+        destroyed.
+
+        * wtf/ThreadingPthreads.cpp: Changed assertions to conventional form.
+
+2009-02-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23715
+
+        Simplify MacroAssembler interface, by combining comparison methods.
+        Seprate operations are combined as follows:
+            jz32/jnz32/jzPtr/jnzPtr -> branchTest32/branchTestPtr,
+            j*(Add|Mul|Sub)32/j*(Add|Mul|Sub)Ptr -> branch(Add|Mul|Sub)32/branch(Add|Mul|Sub)Ptr
+            j*32/j*Ptr (all other two op combparisons) -> branch32/brnachPtr
+            set*32 -> set32
+
+        Also, represent the Scale of BaseIndex addresses as a plain enum (0,1,2,3),
+        instead of as multiplicands (1,2,4,8).
+
+        This patch singificantly reduces replication of code, and increases functionality supported
+        by the MacroAssembler.  No performance impact.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branchPtrWithPatch):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branch16):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::branchTest32):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::branchSub32):
+        (JSC::MacroAssembler::set32):
+        (JSC::MacroAssembler::setTest32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::jccRel32):
+        (JSC::X86Assembler::setccOpcode):
+        (JSC::X86Assembler::cmpq_mr):
+        (JSC::X86Assembler::setcc_r):
+        (JSC::X86Assembler::sete_r):
+        (JSC::X86Assembler::setne_r):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::jcc):
+        (JSC::X86Assembler::X86InstructionFormatter::putModRmSib):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoadCharacter):
+        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacterPair):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Fix a bug in Vector's shrinkCapacity method.  It did not properly copy elements into the inline buffer
+        when shrinking down from a size that was greater than the inline capacity.
+
+        Reviewed by Maciej
+
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::VectorBuffer):
+        (WTF::VectorBuffer::allocateBuffer):
+
 2009-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -89,6 +11163,79 @@
         * runtime/JSByteArray.h:
         (JSC::JSByteArray::storage):
 
+2009-02-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23560
+        Implement SharedTimer on WorkerRunLoop
+
+        * JavaScriptCore.exp:
+        Forgot to expose ThreadCondition::timedWait() in one of previous patches.
+
+2009-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21414> REGRESSION: Regular Expressions and character classes, shorthands and ranges
+        <rdar://problem/6543487>
+
+        In certain circumstances when WREC::Generator::generateCharacterClassInvertedRange invokes
+        itself recursively, it will incorrectly emit (and thus consume) the next single character
+        match in the current character class.  As WREC uses a binary search this out of sequence
+        codegen could result in a character match being missed and so cause the regex to produce
+        incorrect results.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23676: Speed up uses of reserveCapacity on new vectors by adding a new reserveInitialCapacity
+        https://bugs.webkit.org/show_bug.cgi?id=23676
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames): Use reserveInitialCapacity.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Ditto.
+        (JSC::Lexer::clear): Ditto.
+
+        * wtf/Vector.h: Added reserveInitialCapacity, a more efficient version of
+        reserveCapacity for use when the vector is brand new (still size 0 with no
+        capacity other than the inline capacity).
+
+2009-01-30  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        <rdar://problem/6391501> Enable the JIT on Mac OS X x86_64 as it passes all tests.
+
+        * wtf/Platform.h:
+
+2009-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe and Sam Weinig.
+
+        Finally fix load() to propagate exceptions correctly.
+
+        * jsc.cpp:
+        (functionLoad):
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23618
+        Templated worker tasks should be more error proof to use.
+        Fix Chromium build.
+
+        * wtf/TypeTraits.h:
+        (WTF::IsConvertibleToInteger::IsConvertibleToDouble):
+        Avoid "possible loss of data" warning when using Microsoft's C++ compiler
+        by avoiding an implicit conversion of int types to doubles.
+
 2009-01-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -101,24 +11248,2007 @@
         (WTF::TCMallocStats::):
         * wtf/Platform.h: Don't define COMPILER(GCC) with RVCT --gnu.
 
-2008-11-28  George Staikos  <staikos@kde.org>
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23618: Templated worker tasks should be more error proof to use
+        <https://bugs.webkit.org/show_bug.cgi?id=23618>
+
+        Add the type traits needed for the generic worker tasks
+        and compile asserts for them.
+
+        Add a summary header to the TypeTraits.h file to explain what is in there.
+
+        Add a note to explain IsPod's deficiencies.
+
+        * wtf/TypeTraits.h:
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23616: Various "template helpers" should be consolidated from isolated files in JavaScriptCore.
+        <https://bugs.webkit.org/show_bug.cgi?id=23616>
+
+        * wtf/TypeTraits.h: Moved RemovePointer, IsPod, IsInteger to this file.
+
+        * wtf/OwnPtr.h: Use RemovePointer from TypeTraits.h.
+        * wtf/RetainPtr.h:  Ditto.
+
+        * wtf/HashTraits.h: Use IsInteger from TypeTraits.h.
+
+        * wtf/VectorTraits.h: Use IsPod from TypeTraits.h.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added TypeTraits.h.
+
+2009-01-29  Stephanie Lewis <slewis@apple.com>
+
+        RS by Oliver Hunt.
+
+        Update the order files.
+
+        * JavaScriptCore.order:
+
+2009-01-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23551: Crash on page load with profiler enabled and running
+        <https://bugs.webkit.org/show_bug.cgi?id=23551>
+        <rdar://problem/6529521>
+
+        Interpreter::execute(FunctionBodyNode*, ...) calls Profiler::didExecute()
+        with a stale CallFrame. If some part of the scope chain has already been
+        freed, Profiler::didExecute() will crash when attempting to get the lexical
+        global object. The fix is to make the didExecute() call use the caller's
+        CallFrame, not the one made for the function call. In this case, the
+        willExecute() call should also be changed to match.
+
+        Since this occurs in the actual inspector JS, it is difficult to reduce.
+        I couldn't make a layout test.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for <rdar://problem/6525537>
+        Hang occurs when closing Installer window (iTunes, Aperture)
+
+        * JavaScriptCore.exp: Export JSGlobalData::sharedInstance.
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Initial patch by Mark Rowe.
+
+        <rdar://problem/6519356>
+        REGRESSION (r36006): "out of memory" alert running dromaeo on Windows
+
+        Report the cost of the ArrayStorage vector more accurately/often.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Report the extra cost even for a filled array
+        because JSString using the single character optimization and immediates
+        wont increase the cost themselves. 
+        (JSC::JSArray::putSlowCase): Update the cost when increasing the size of
+        the array.
+        (JSC::JSArray::increaseVectorLength): Ditto.
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Fix for <rdar://problem/6129678>
+        REGRESSION (Safari 3-4): Local variable not accessible from Dashcode console or variables view
+
+        Iterating the properties of activation objects accessed through the WebKit debugging
+        APIs was broken by forced conversion of JSActivation to the global object. To fix this,
+        we use a proxy activation object that acts more like a normal JSObject.
+
+        * debugger/DebuggerActivation.cpp: Added.
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::mark):
+        (JSC::DebuggerActivation::className):
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::deleteProperty):
+        (JSC::DebuggerActivation::getPropertyNames):
+        (JSC::DebuggerActivation::getPropertyAttributes):
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        (JSC::DebuggerActivation::lookupGetter):
+        (JSC::DebuggerActivation::lookupSetter):
+        * debugger/DebuggerActivation.h: Added.
+        Proxy JSActivation object for Debugging.
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::isActivationObject): Added.
+        * runtime/JSObject.h:
+        (JSC::JSObject::isActivationObject): Added.
+
+2009-01-28  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23490: Remove initialRefCount argument from RefCounted class
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23490>
+
+        Reviewed by Darin Adler.
+
+        RefCountedBase now always starts with a ref count of 1, so there
+        is no need to pass the initialRefCount into the class anymore.
+
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::ByteArray): Removed call to RefCounted(1).
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::RefCountedBase): Changed to start with a
+        ref count of 1.
+        (WTF::RefCounted::RefCounted): Removed initialRefCount argument
+        and removed call to RefCounted(1).
+
+2009-01-26  Adele Peterson  <adele@apple.com>
+
+        Build fix.  
+
+        * debugger/Debugger.cpp:
+
+2009-01-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes for eq null & neq null, on 64-bit JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=23559
+
+        This patch degrades 64-bit JIT performance on some benchmarks,
+        due to the whole not-being-incorrect thing.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-01-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 23552: Dashcode evaluator no longer works after making ExecStates actual call frames
+        <https://bugs.webkit.org/show_bug.cgi?id=23552>
+        <rdar://problem/6398839>
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame): Added so that WebScriptCallFrame can
+        evaluate JS starting from a global call frame.
+        * debugger/Debugger.h:
+
+2009-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Improve the consistency of settings in our .xcconfig files.
+
+        * Configurations/Base.xcconfig: Enable GCC_OBJC_CALL_CXX_CDTORS to match other projects.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Turn on the following warnings:
+
+            -Wcast-qual
+            -Wextra-tokens
+            -Wformat=2
+            -Winit-self
+            -Wmissing-noreturn
+            -Wpacked
+            -Wrendundant-decls
+
+        * Configurations/Base.xcconfig: Added the new warnings. Switched to -Wextra instead of
+        -W for clarity since we don't have to support the older versions of gcc that require the
+        old -W syntax. Since we now use -Wformat=2, removed -Wformat-security. Also removed
+        -Wno-format-y2k since we can have that one on now.
+
+2009-01-25  Judit Jasz  <jasy@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        Compilation problem fixing 
+        http://bugs.webkit.org/show_bug.cgi?id=23497
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall): Use JSValuePtr::encode.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Fourth patch: Deal with the last few stray warnings.
 
-        Reviewed by NOBODY (OOPS!).
+        * parser/Parser.cpp: Only declare jscyyparse if it's not already declared.
+        This makes both separate compilation and all-in-one compilation work with the
+        -Wredundant-decls warning.
 
-        Implement currentThreadStackBase() on Windows CE.
+2009-01-25  Darin Adler  <darin@apple.com>
 
-        Coding style fixes by Joerg Bornemann <joerg.bornemann@trolltech.com>.
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Third patch: Use the noreturn attribute on functions that don't
+        return to prepare for the use of the -Wmissing-noreturn warning.
+
+        * jit/JITCall.cpp:
+        (JSC::unreachable): Added NO_RETURN.
+        * jsc.cpp:
+        (functionQuit): Ditto.
+        (printUsageStatement): Ditto.
+        * wtf/AlwaysInline.h: Added definition of NO_RETURN.
 
+2009-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Force inlining of Lexer::matchPunctuator
+
+        2.2% win when parsing jQuery, Mootools, Prototype, etc
+
+        * parser/Lexer.h:
+
+2009-01-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix for <rdar://problem/6126212>
+        Ensure that callbacks out from the JSC interface are only allowed
+        to return in reverse-chronological order to that in which they were
+        made.  If we allow earlier callbacks to return first, then this may
+        result in setions of the RegisterFile in use by another thread
+        being trampled.
+
+        See uber-comment in JSLock.h for details.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Try to fix WX build.
+
+        * runtime/JSGlobalObjectFunctions.h: Include <wtf/unicode/Unicode.h>
+        for the definition of UChar.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        * Configurations/Base.xcconfig:
+        GCC 4.0 build fix.
+        
+        * runtime/JSNumberCell.h:
+        64-bit build fix.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Turn on -Wmissing-prototypes and fix the warnings.
+        
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype):
+        * Configurations/Base.xcconfig:
         * runtime/Collector.cpp:
-        (JSC::numberOfWritableBytes):
-        (JSC::systemPageSize):
-        (JSC::currentThreadStackBaseWinCE):
-        (JSC::currentThreadStackBase):
+        (JSC::getPlatformThreadRegisters):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSNumberCell.h:
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::createRep):
+        * wtf/FastMalloc.cpp:
+        * wtf/Threading.cpp:
 
-2009-01-08  Gavin Barraclough  <barraclough@apple.com>
+2009-01-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Disable GCC_WARN_ABOUT_MISSING_PROTOTYPES temporarily.
+
+        Current versions of Xcode only respect it for C and Objective-C files,
+        and our code doesn't currently compile if it is applied to C++ and
+        Objective-C++ files.
+
+        * Configurations/Base.xcconfig:
+
+2009-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23489
+        
+        Return currentTime() in correct units for the two early return cases.
+
+        Reviewed by Mark Rowe.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2009-01-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/6439247>
+        FastMalloc allocating an extra 4MB of meta-data on 64-bit
+
+        Rely on the fact that on all known x86-64 platforms only use 48 bits of
+        address space to shrink the initial size of the PageMap from ~4MB to 120K.
+        For 64-bit we still use a 3-level radix tree, but now each level is only 12
+        bits wide.
+
+        No performance change.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::MapSelector): Add specialization for 64 bit that takes into account the
+        16 bits of unused address space on x86-64.
+
+2009-01-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23461 LayoutTests/
+        fast/js/numeric-conversion.html is broken, and corresponding 
+        <rdar://problem/6514842>
+
+        The basic problem here is that parseInt(Infinity) should be NaN, 
+        but we were returning 0. NaN matches Safari 3.2.1 and Firefox.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-01-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6516853> (r39682-r39736) JSFunFuzz: crash on "(function(){({ x2: x }), })()"
+        <https://bugs.webkit.org/show_bug.cgi?id=23479>
+
+        Automatic semicolon insertion was resulting in this being accepted in the initial
+        nodeless parsing, but subsequent reparsing for code generation would fail, leading
+        to a crash.  The solution is to ensure that reparsing a function performs parsing
+        in the same state as the initial parse.  We do this by modifying the saved source
+        ranges to include rather than exclude the opening and closing braces.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): add an assertion for successful recompile
+        * parser/Lexer.h:
+        (JSC::Lexer::sourceCode): include rather than exclude braces.
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::toSourceString):  No need to append braces anymore.
+
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23373
+
+        Implement ThreadCondition::timedWait().
+        Since we borrow the code for condition variables from other sources,
+        I did the same for timedWait(). See comments in ThreadingWin.cpp for
+        rationale and more info.
+
+        * wtf/CONTRIBUTORS.pthreads-win32: 
+        Added. A list of Pthreads-win32 contributors mentioned in their license. The license itself
+        is included into wtf/ThreadingWin32.cpp.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingWin.cpp:
+        Additional info and Pthreads-win32 license at the beginning.
+        (WTF::PlatformCondition::timedWait): new method, derived from Pthreads-win32.
+        (WTF::PlatformCondition::signal): same
+        (WTF::ThreadCondition::ThreadCondition):
+        (WTF::ThreadCondition::~ThreadCondition):
+        (WTF::ThreadCondition::wait): this now calls PlatformCondition::timedWait.
+        (WTF::ThreadCondition::timedWait): same
+        (WTF::ThreadCondition::signal): this now calls PlatformCondition::signal.
+        (WTF::ThreadCondition::broadcast): same
+
+2009-01-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23469.
+
+        We need to check all numbers in integer switches, not just those
+        represented as integer JSImmediates.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_switch_imm):
+
+2009-01-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23468.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-01-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Suggested by Oliver Hunt. Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23456
+        Function argument names leak
+
+        * parser/Nodes.cpp: (JSC::FunctionBodyNode::~FunctionBodyNode): Destruct parameter names.
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2009-01-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Structure property table deleted offset maps are being leaked.
+        Probably shouldn't be doing that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23442
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Attempt to fix gtk build
+
+        * GNUmakefile.am:
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Add back the initialization to fix the build.
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        First patch: Fix some simple cases of various warnings.
+
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile): Use const_cast to change const-ness.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Remove unneeded initialization and
+        use UChar instead of unsigned short for UTF-16 values.
+
+        * wtf/dtoa.cpp:
+        (WTF::strtod): Use const_cast to change const-ness.
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Whoops, remove runtime/ByteArray references from .pri and .scons builds, update .bkl
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCoreSources.bkl:
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        RS=Dan Bernstein.
+
+        Move runtime/ByteArray to wtf/ByteArray
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * wtf/ByteArray.cpp: Renamed from JavaScriptCore/runtime/ByteArray.cpp.
+        (WTF::ByteArray::create):
+        * wtf/ByteArray.h: Renamed from JavaScriptCore/runtime/ByteArray.h.
+        (WTF::ByteArray::length):
+        (WTF::ByteArray::set):
+        (WTF::ByteArray::get):
+        (WTF::ByteArray::data):
+        (WTF::ByteArray::deref):
+        (WTF::ByteArray::ByteArray):
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Remove temporary operator-> from JSValuePtr.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrototype):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::CodeBlock::mark):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::keyForImmediateSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::throwException):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        (JSC::Interpreter::isJSByteArray):
+        * interpreter/Register.h:
+        (JSC::Register::marked):
+        (JSC::Register::mark):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        (runWithScripts):
+        (runInteractive):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        (JSC::Heap::collect):
+        (JSC::typeName):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::internalNumber):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        (JSC::createErrorMessage):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toObject):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        (JSC::JSArray::mark):
+        (JSC::JSArray::sort):
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::setIndex):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::construct):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::lastInPrototypeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSValuePtr::get):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::mark):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::createCachedPrototypeChain):
+        * runtime/Structure.h:
+        (JSC::Structure::mark):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+
+2009-01-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23409: REGRESSION: RegExp 'replace()' function improperly processes '$$'
+        <https://bugs.webkit.org/show_bug.cgi?id=23409>
+        <rdar://problem/6505723>
+
+        Test: fast/js/string-replace-3.html
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Remove code that adds an extra $ -- not sure
+        how this ever worked.
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        On x86-64 jit, cache JSImmedate::TagMask & JSImmedate::TagTypeNumber in
+        registers, save reloading them every time they're used.
+
+        Draws x86-64 jit performance close to that of i386 jit.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support to x86-64 JIT for inline double precision arithmetic ops.
+        +5/6% on x86-64, JIT enabled, sunspider.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_rr):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileFastArithSlow_op_sub):
+        * parser/ResultType.h:
+        (JSC::ResultType::isReusable):
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::definitelyIsNumber):
+        (JSC::ResultType::mightBeNumber):
+        (JSC::ResultType::isNotNumber):
+        (JSC::ResultType::unknownType):
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fixes for SamplingTool.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23390
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::encodeSample):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::samplingToolTrackCodeBlock):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitCTICall_internal):
+
+2009-01-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/6452301> REGRESSION: Latest WebKit nightlies
+        turn "c" into "" when stripping \\c_ character
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeEscape): Mimic a Firefox quirk when parsing
+        control escapes inside character classes.
+
+2009-01-16  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Removed unreachable code.
+
+2009-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6471394> REGRESSION (r39164): Discarding quantifier
+        on assertion gives incorrect result (23075)
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23075
+
+        * pcre/pcre_compile.cpp:
+        (compileBranch): Throw away an assertion if it's followed by a quantifier
+        with a 0 minimum, to match SpiderMonkey, v8, and the ECMA spec.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Fall back on PCRE for the rare
+        case of an assertion with a quantifier with a 0 minimum, since we
+        don't handle quantified subexpressions yet, and in this special case,
+        we can't just throw away the quantifier.
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support in ResultType to track that the results of bitops
+        are always of type int32_t.
+
+        * parser/Nodes.cpp:
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::BooleanNode::):
+        (JSC::NumberNode::):
+        (JSC::StringNode::):
+        (JSC::PrePostResolveNode::):
+        (JSC::TypeOfResolveNode::):
+        (JSC::TypeOfValueNode::):
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        (JSC::LogicalOpNode::):
+        * parser/ResultType.h:
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::isNotNumber):
+        (JSC::ResultType::booleanType):
+        (JSC::ResultType::numberType):
+        (JSC::ResultType::numberTypeCanReuse):
+        (JSC::ResultType::numberTypeCanReuseIsInt32):
+        (JSC::ResultType::stringOrNumberTypeCanReuse):
+        (JSC::ResultType::stringType):
+        (JSC::ResultType::unknownType):
+        (JSC::ResultType::forAdd):
+        (JSC::ResultType::forBitOp):
+        (JSC::OperandTypes::OperandTypes):
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support for integer addition, subtraction and multiplication
+        in JIT code on x86-64.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::mul32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::joMul32):
+        (JSC::MacroAssembler::joSub32):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileFastArithSlow_op_sub):
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        On x86-64 allow JSImmediate to encode 64-bit double precision values.
+        This patch only affects builds that set USE(ALTERNATE_JSIMMEDIATE).
+        Updates the implementation of JSValuePtr:: and JSImmediate:: methods
+        that operate on neumeric values to be be aware of the new representation.
+        When this representation is in use, the class JSNumberCell is redundant
+        and is compiled out.
+
+        The format of the new immediate representation is documented in JSImmediate.h.
+
+        * JavaScriptCore.exp:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::subPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::subq_rr):
+        (JSC::X86Assembler::movq_rr):
+        (JSC::X86Assembler::ucomisd_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp64):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfBothJSCells):
+        (JSC::JIT::emitJumpIfEitherNumber):
+        (JSC::JIT::emitJumpIfNotEitherNumber):
+        (JSC::JIT::emitJumpIfImmediateIntegerNumber):
+        (JSC::JIT::emitJumpIfNotImmediateIntegerNumber):
+        (JSC::JIT::emitJumpIfNotImmediateIntegerNumbers):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateIntegerNumber):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateIntegerNumbers):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::wtf_reinterpret_cast):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDoubleNumber):
+        (JSC::JSImmediate::isPositiveIntegerNumber):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::doubleToBoolean):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::makeOutOfIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::JSValuePtr::isInt32Fast):
+        (JSC::JSValuePtr::isUInt32Fast):
+        (JSC::JSValuePtr::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsNumberCell):
+        * runtime/JSNumberCell.h:
+        (JSC::createNumberStructure):
+        (JSC::isNumberCell):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValuePtr::isDoubleNumber):
+        (JSC::JSValuePtr::getDoubleNumber):
+        (JSC::JSValuePtr::isNumber):
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::jsNaN):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::numberToInt32):
+        (JSC::JSValuePtr::numberToUInt32):
+        * runtime/JSValue.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equal):
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * wtf/Platform.h:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/6045018>
+        REGRESSION (r34838): JavaScript objects appear to be leaked after loading google.com
+
+        Subtract the number of JSStrings cached in SmallStrings when calculating the
+        number of live JSObjects.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::objectCount):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::count):
+        * runtime/SmallStrings.h:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * runtime/Collector.cpp:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix crash seen running fast/canvas.
+
+        Make sure to mark the ScopeNode and CodeBlock being created
+        in the re-parse for exception information.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::mark):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2009-01-15  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23347
+        Compilation of JavaScriptCore/wtf/ThreadingPthreads.cpp fails on Linux
+
+        * wtf/ThreadingPthreads.cpp: included limits.h as INT_MAX is defined there.
+
+2009-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
+        <https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>
+
+        Character position for open and closing brace was incorrectly referencing m_position to
+        record their position in a source document, however this is unsafe as BOMs may lead to
+        m_position being an arbitrary position from the real position of the current character.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::matchPunctuator):
+
+2009-01-14  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23153: JSC build always touches JavaScriptCore/docs/bytecode.html
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23153>
+
+        Reviewed by Darin Adler.
+
+        Instead of building bytecode.html into ${SRCROOT}/docs/bytecode.html, build it
+        into ${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs/bytecode.html.
+
+        Also fixes make-bytecode-docs.pl to actually generate documentation.
+
+        * DerivedSources.make: Changed bytecode.html to be built into local docs
+        directory in ${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added "/docs" to the end of the
+        "mkdir -p" command so that the docs subdirectory is automatically created.
+        * docs/make-bytecode-docs.pl: Changed BEGIN_OPCODE to DEFINE_OPCODE so that
+        documentation is actually generated.
+
+2009-01-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for Qt from Dmitry Titov.
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+2009-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 22903: REGRESSION (r36267): visiting this site reliably crashes WebKit nightly
+
+        EvalCodeBlock's do not reference the functions that are declared inside the eval
+        code, this means that simply marking the EvalCodeBlock through the global object
+        is insufficient to mark the declared functions.  This patch corrects this by
+        explicitly marking the CodeBlocks of all the functions declared in the cached
+        EvalNode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::mark):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasFunctions):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::mark):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::mark):
+        (JSC::EvalNode::mark):
+        * parser/Nodes.h:
+
+2009-01-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23312
+        Implement MessageQueue::waitForMessageTimed()
+        Also fixed ThreadCondition::timedWait() to take absolute time, as discussed on webkit-dev.
+        Win32 version of timedWait still has to be implemented.
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueueWaitResult: new enum for the result of MessageQueue::waitForMessageTimed.
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageTimed): New method.
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::ThreadCondition::timedWait): changed to use absolute time instead of interval.
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait): ditto. The actual Win32 code is still to be implemented.
+
+2009-01-14  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Darin Adler and Oliver hunt.
+
+        Correctly match allocation functions by implementing a custom deref().
+
+        https://bugs.webkit.org/show_bug.cgi?id=23315
+
+        * runtime/ByteArray.h:
+        (JSC::ByteArray::deref):
+        (JSC::ByteArray::ByteArray):
+
+2009-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - update copyright
+
+        * Info.plist:
+
+2009-01-13  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        <rdar://problem/6489314> REGRESSION: Business widget's front side 
+        fails to render correctly when flipping widget
+
+        The problem here is that parseInt was parsing NaN as 0. This patch 
+        corrects that by parsing NaN as NaN. This matches our old behavior 
+        and Firefox. 
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for: https://bugs.webkit.org/show_bug.cgi?id=23292
+
+        Implementation of two argument canDoFastAdditiveOperations does not correlate well with reality.
+
+        * runtime/JSImmediate.h:
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+
+2009-01-13  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23290
+        Fix JSImmediate::isImmediate(src) to !src->isCell()
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-01-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23281
+        Fix the Chromium Win build.
+        Need to use PLATFORM(WIN_OS) instead of PLATFORM(WIN).
+        Moved GTK and WX up in #if sequence because they could come with WIN_OS too,
+        while they have their own implementation even on Windows.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2009-01-12  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
 
+        Make the JSImmediate interface private.
+
+        All manipulation of JS values should be through the JSValuePtr class, not by using JSImmediate
+        directly.  The key missing methods on JSValuePtr are:
+
+            * isCell() - check for values that are JSCell*s, and as such where asCell() may be used.
+            * isInt32Fast() getInt32Fast() - fast check/access for integer immediates.
+            * isUInt32Fast() getUInt32Fast() - ditto for unsigned integer immediates.
+
+        The JIT is allowed full access to JSImmediate, since it needs to be able to directly
+        manipulate JSValuePtrs.  The Interpreter is provided access to perform operations directly
+        on JSValuePtrs through the new JSFastMath interface.
+
+        No performance impact.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toNumber):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::jsIsObjectType):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_vm_throw):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        (JSC::Interpreter::isJSByteArray):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::isStrictEqCaseHandledInJITCode):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlot):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSValuePtr::isNumberCell):
+        (JSC::JSValuePtr::asCell):
+        (JSC::JSValuePtr::isNumber):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        * runtime/JSImmediate.h:
+        (JSC::js0):
+        (JSC::jsImpossibleValue):
+        (JSC::JSValuePtr::toInt32):
+        (JSC::JSValuePtr::toUInt32):
+        (JSC::JSValuePtr::isCell):
+        (JSC::JSValuePtr::isInt32Fast):
+        (JSC::JSValuePtr::getInt32Fast):
+        (JSC::JSValuePtr::isUInt32Fast):
+        (JSC::JSValuePtr::getUInt32Fast):
+        (JSC::JSValuePtr::makeInt32Fast):
+        (JSC::JSValuePtr::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::equal):
+        (JSC::JSFastMath::notEqual):
+        (JSC::JSFastMath::andImmediateNumbers):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::orImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        (JSC::JSFastMath::incImmediateNumber):
+        (JSC::JSFastMath::decImmediateNumber):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValuePtr::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::JSNumberCell::toInt32):
+        (JSC::JSNumberCell::toUInt32):
+        (JSC::JSValuePtr::toJSNumber):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::numberToInt32):
+        (JSC::JSValuePtr::numberToUInt32):
+        * runtime/JSObject.h:
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::get):
+        (JSC::JSValuePtr::put):
+        * runtime/JSValue.cpp:
+        (JSC::JSValuePtr::toInteger):
+        (JSC::JSValuePtr::toIntegerPreserveNaN):
+        * runtime/JSValue.h:
+        * runtime/Operations.cpp:
+        (JSC::JSValuePtr::equalSlowCase):
+        (JSC::JSValuePtr::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equal):
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        * runtime/Structure.cpp:
+        (JSC::Structure::createCachedPrototypeChain):
+
+2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Since date time functions have moved here, now the wx port JSC
+        needs to depend on wx.
+
+        * jscore.bkl:
+
+2009-01-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23245
+
+        Add initializeThreading to key places in JS API to ensure that
+        UString is properly initialized.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSGlobalContextCreate):
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-01-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Separate out BaseString information from UString::Rep and make all baseString access go through
+        a member function, so that it may be used for something else (in the future) in the BaseString
+        case.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::mark):
+        Adjust to account for the changes in UString and put the UString in place in
+        SmallStringsStorage to aid in locality of reference among the UChar[] and UString::Rep's.
+
+        * runtime/SmallStrings.h:
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::destroy):
+        (JSC::UString::Rep::checkConsistency):
+        (JSC::expandCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::concatenate):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::baseIsSelf):
+        (JSC::UString::Rep::setBaseString):
+        (JSC::UString::Rep::baseString):
+        (JSC::UString::Rep::):
+        (JSC::UString::Rep::null):
+        (JSC::UString::Rep::empty):
+        (JSC::UString::Rep::data):
+        (JSC::UString::cost):
+        Separate out the items out used by base strings from those used in Rep's that only
+        point to base strings.  (This potentially saves 24 bytes per Rep.)
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23239: improve handling of unused arguments in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=23239
+
+        * runtime/DatePrototype.cpp: Moved LocaleDateTimeFormat enum outside #if
+        so we can use this on all platforms. Changed valueOf to share the same
+        function with getTime, since the contents of the two are identical. Removed
+        a FIXME since the idea isn't really specific enough or helpful enough to
+        need to sit here in the source code.
+        (JSC::formatLocaleDate): Changed the Mac version of this function to take
+        the same arguments as the non-Mac version so the caller doesn't have to
+        special-case the two platforms. Also made the formatString array be const;
+        before the characters were, but the array was a modifiable global variable.
+        (JSC::dateProtoFuncToLocaleString): Changed to call the new unified
+        version of formatLocaleDate and remove the ifdef.
+        (JSC::dateProtoFuncToLocaleDateString): Ditto.
+        (JSC::dateProtoFuncToLocaleTimeString): Ditto.
+
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toObject): Use the new ASSERT_UNUSED instead of the
+        old UNUSED_PARAM.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp): Changed to only use UNUSED_PARAM when the parameter
+        is actually unused.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): Changed to only use UNUSED_PARAM when the parameter
+        is actually unused.
+        (TCMalloc_SystemCommit): Changed to omit the argument names instead of using
+        UNUSED_PARAM.
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix the build (whoops)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler and Anders Carlsson
+
+        Bug 23128: get/put_by_val need to respecialise in the face of ByteArray
+
+        Restructure the code slightly, and add comments per Darin's suggestions
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Whoops, I accidentally removed an exception check from fast the
+        fast path for string indexing when i originally landed the
+        byte array logic.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23128: get/put_by_val need to respecialise in the face of ByteArray
+        <https://bugs.webkit.org/show_bug.cgi?id=23128>
+
+        Fairly simple patch, add specialised versions of cti_op_get/put_by_val
+        that assume ByteArray, thus avoiding a few branches in the case of bytearray
+        manipulation.
+
+        No effect on SunSpider.  15% win on the original testcase.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        * interpreter/Interpreter.h:
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Try to fix Windows build.
+
+        * wtf/CurrentTime.cpp: Added a definition of msPerSecond (previously, this code was in
+        DateMath.cpp, with constant definition in DateTime.h)
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Try to fix Windows build.
+
+        * wtf/CurrentTime.cpp: Include <sys/types.h> and <sys/timeb.h>, as MSDN says to.
+
+2009-01-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23207
+        Moved currentTime() to from WebCore to WTF.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp: added export for WTF::currentTime()
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * runtime/DateMath.cpp:
+        (JSC::getCurrentUTCTimeWithMicroseconds): This function had another implementation of currentTime(), essentially. Now uses WTF version.
+        * wtf/CurrentTime.cpp: Added.
+        (WTF::currentTime):
+        (WTF::highResUpTime):
+        (WTF::lowResUTCTime):
+        (WTF::qpcAvailable):
+        * wtf/CurrentTime.h: Added.
+
+2009-01-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Stage two of converting JSValue from a pointer to a class type.
+        Remove the class JSValue.  The functionallity has been transitioned
+        into the wrapper class type JSValuePtr.
+
+        The last stage will be to rename JSValuePtr to JSValue, remove the
+        overloaded -> operator, and switch operations on JSValuePtrs from
+        using '->' to use '.' instead.
+
+        * API/APICast.h:
+        * JavaScriptCore.exp:
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValuePtr::asCell):
+        (JSC::JSValuePtr::isNumber):
+        (JSC::JSValuePtr::isString):
+        (JSC::JSValuePtr::isGetterSetter):
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::getString):
+        (JSC::JSValuePtr::getObject):
+        (JSC::JSValuePtr::getCallData):
+        (JSC::JSValuePtr::getConstructData):
+        (JSC::JSValuePtr::getUInt32):
+        (JSC::JSValuePtr::getTruncatedInt32):
+        (JSC::JSValuePtr::getTruncatedUInt32):
+        (JSC::JSValuePtr::mark):
+        (JSC::JSValuePtr::marked):
+        (JSC::JSValuePtr::toPrimitive):
+        (JSC::JSValuePtr::getPrimitiveNumber):
+        (JSC::JSValuePtr::toBoolean):
+        (JSC::JSValuePtr::toNumber):
+        (JSC::JSValuePtr::toString):
+        (JSC::JSValuePtr::toObject):
+        (JSC::JSValuePtr::toThisObject):
+        (JSC::JSValuePtr::needsThisConversion):
+        (JSC::JSValuePtr::toThisString):
+        (JSC::JSValuePtr::getJSNumber):
+        * runtime/JSImmediate.h:
+        (JSC::JSValuePtr::isUndefined):
+        (JSC::JSValuePtr::isNull):
+        (JSC::JSValuePtr::isUndefinedOrNull):
+        (JSC::JSValuePtr::isBoolean):
+        (JSC::JSValuePtr::getBoolean):
+        (JSC::JSValuePtr::toInt32):
+        (JSC::JSValuePtr::toUInt32):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::JSValuePtr::toJSNumber):
+        * runtime/JSObject.h:
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::get):
+        (JSC::JSValuePtr::put):
+        * runtime/JSString.h:
+        (JSC::JSValuePtr::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValuePtr::toInteger):
+        (JSC::JSValuePtr::toIntegerPreserveNaN):
+        (JSC::JSValuePtr::toInt32SlowCase):
+        (JSC::JSValuePtr::toUInt32SlowCase):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::makeImmediate):
+        (JSC::JSValuePtr::immediateValue):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator->):
+        (JSC::JSValuePtr::operator bool):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValuePtr::toFloat):
+        (JSC::JSValuePtr::asValue):
+        (JSC::operator==):
+        (JSC::operator!=):
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Adjustment to previous patch.  Remove call to initilizeThreading from JSGlobalCreate
+        and fix jsc.cpp instead.
+
+        * jsc.cpp:
+        (main):
+        (jscmain):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+
+2009-01-09  Sam Weinig  <sam@webkit.org>
+
+        Roll r39720 back in with a working interpreted mode.
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Added a template to make the pointer and flags combination
+        in UString more readable and less error prone.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added PtrAndFlags.h (and sorted the xcode project file).
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        Made the init threading initialize the UString globals.  Before
+        these were initilized using {} but that became harder due to the
+        addition of this tempalte class.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::createFromUTF8):
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::concatenate):
+        (JSC::UString::operator=):
+        (JSC::UString::makeNull):
+        (JSC::UString::nullRep):
+        * runtime/UString.h:
+        (JSC::UString::Rep::identifierTable):
+        (JSC::UString::Rep::setIdentifierTable):
+        (JSC::UString::Rep::isStatic):
+        (JSC::UString::Rep::setStatic):
+        (JSC::UString::Rep::):
+        (JSC::UString::Rep::null):
+        (JSC::UString::Rep::empty):
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::UString):
+
+        * wtf/PtrAndFlags.h: Added.
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::isFlagSet):
+        (WTF::PtrAndFlags::setFlag):
+        (WTF::PtrAndFlags::clearFlag):
+        (WTF::PtrAndFlags::get):
+        (WTF::PtrAndFlags::set):
+        A simple way to layer together a pointer and 2 flags.  It relies on the pointer being 4 byte aligned,
+        which should happen for all allocators (due to aligning pointers, int's, etc. on 4 byte boundaries).
+
+2009-01-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by -O-l-i-v-e-r- -H-u-n-t- Sam Weinig (sorry, Sam!).
+
         Encode immediates in the low word of JSValuePtrs, on x86-64.
 
         On 32-bit platforms a JSValuePtr may represent a 31-bit signed integer.
diff --git a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make b/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
index 865ba7c86c..4b3368293c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
+++ b/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
@@ -1,4 +1,4 @@
-# Copyright (C) 2006, 2007, 2008 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -46,7 +46,7 @@ all : \
     RegExpConstructor.lut.h \
     RegExpObject.lut.h \
     StringPrototype.lut.h \
-    $(JavaScriptCore)/docs/bytecode.html \
+    docs/bytecode.html \
 #
 
 # lookup tables for classes
@@ -71,5 +71,5 @@ Grammar.cpp: Grammar.y
 chartables.c : dftables
 	$^ $@
 
-$(JavaScriptCore)/docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
+docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
 	perl $^ $@
diff --git a/src/3rdparty/webkit/JavaScriptCore/Info.plist b/src/3rdparty/webkit/JavaScriptCore/Info.plist
index 55537af698..17949b026d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/Info.plist
+++ b/src/3rdparty/webkit/JavaScriptCore/Info.plist
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2007 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
index 9f7cb303aa..bb56e982ad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
@@ -1,1526 +1,1965 @@
 __ZN3WTF10fastMallocEm
+__ZN3WTF10fastMallocILb1EEEPvm
 __ZN3WTF20TCMalloc_ThreadCache10InitModuleEv
-__ZN3WTF15InitSizeClassesEv
+__ZN3WTFL15InitSizeClassesEv
 __Z20TCMalloc_SystemAllocmPmm
-__ZN3WTF17TCMalloc_PageHeap4initEv
+__ZN3WTFL13MetaDataAllocEm
 __ZN3WTF20TCMalloc_ThreadCache22CreateCacheIfNecessaryEv
 __ZN3WTF25TCMalloc_Central_FreeList11RemoveRangeEPPvS2_Pi
 __ZN3WTF25TCMalloc_Central_FreeList18FetchFromSpansSafeEv
 __ZN3WTF17TCMalloc_PageHeap10AllocLargeEm
 __ZN3WTF17TCMalloc_PageHeap8GrowHeapEm
-__ZN3WTF13MetaDataAllocEm
-__ZN3WTF17TCMalloc_PageHeap19IncrementalScavengeEm
+__ZN3WTF19initializeThreadingEv
+__ZN3WTF20initializeMainThreadEv
+__ZN3WTF5MutexC1Ev
+__ZN3WTF28initializeMainThreadPlatformEv
+__ZN3WTF36lockAtomicallyInitializedStaticMutexEv
 __ZN3WTF8fastFreeEPv
+__ZN3WTF38unlockAtomicallyInitializedStaticMutexEv
+__ZN3JSC19initializeThreadingEv
+__ZN3JSCL23initializeThreadingOnceEv
+__ZN3JSC17initializeUStringEv
+__ZN3JSC12initDateMathEv
+__ZN3WTF11currentTimeEv
+__ZN3WTF15ThreadConditionC1Ev
+__ZN3WTF5Mutex4lockEv
+__ZN3WTF5Mutex6unlockEv
+__ZN3WTF12createThreadEPFPvS0_ES0_PKc
+__ZN3WTF20createThreadInternalEPFPvS0_ES0_PKc
+__ZN3WTFL35establishIdentifierForPthreadHandleERP17_opaque_pthread_t
+__ZN3WTF9HashTableIjSt4pairIjP17_opaque_pthread_tENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTrai
+__ZN3WTFL16threadEntryPointEPv
 __ZN3WTF16fastZeroedMallocEm
+__ZN3WTF21setThreadNameInternalEPKc
+__ZN3WTF5MutexD1Ev
+__ZN3WTF25TCMalloc_Central_FreeList11InsertRangeEPvS1_i
+__ZN3WTF25TCMalloc_Central_FreeList18ReleaseListToSpansEPv
+__ZN3WTF12isMainThreadEv
 __ZN3WTF14FastMallocZone4sizeEP14_malloc_zone_tPKv
-__ZN3KJS8Bindings10RootObject19setCreateRootObjectEPFN3WTF10PassRefPtrIS1_EEPvE
-__ZN3KJS8Bindings8Instance21setDidExecuteFunctionEPFvPNS_9ExecStateEPNS_8JSObjectEE
-_kjs_strtod
-__Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
-__Z30calculateCompiledPatternLengthPKti24JSRegExpIgnoreCaseOptionR11CompileDataR9ErrorCode
-__Z11checkEscapePPKtS0_P9ErrorCodeib
-__Z13compileBranchiPiPPhPPKtS3_P9ErrorCodeS_S_R11CompileData
-__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
+__ZN3WTF13currentThreadEv
+__ZN3WTF16callOnMainThreadEPFvPvES0_
+__ZN3WTF5DequeINS_19FunctionWithContextEE14expandCapacityEv
+__ZN3WTF37scheduleDispatchFunctionsOnMainThreadEv
+__ZN3WTF15ThreadCondition4waitERNS_5MutexE
+__ZN3JSC8DebuggerC2Ev
+__ZN3WTF6strtodEPKcPPc
+__ZN3WTF15ThreadCondition6signalEv
+__ZN3WTF15ThreadCondition9timedWaitERNS_5MutexEd
+__ZN3WTF15ThreadCondition9broadcastEv
+-[WTFMainThreadCaller call]
+__ZN3WTF31dispatchFunctionsFromMainThreadEv
+__ZN3WTF14FastMallocZone9forceLockEP14_malloc_zone_t
 __ZN3WTF11fastReallocEPvm
-__ZN3KJS20createDidLockJSMutexEv
-__ZN3KJS9Collector14registerThreadEv
-__ZN3KJS29initializeRegisteredThreadKeyEv
-__ZN3KJS15SavedPropertiesC1Ev
-__ZN3KJS6JSCellnwEm
-__ZN3KJS9Collector12heapAllocateILNS0_8HeapTypeE0EEEPvm
-__ZN3KJS15GlobalExecStateC1EPNS_14JSGlobalObjectE
-__ZN3KJS17CommonIdentifiers6sharedEv
-__ZN3KJS17CommonIdentifiersC2Ev
-__ZN3KJS10IdentifierC1EPKc
-__ZN3KJS10Identifier3addEPKc
-__ZN3WTF7HashSetIPN3KJS7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EES6_S8_S8_EES4_EEbERKT_
-__ZN3WTF9HashTableIPN3KJS7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
-__ZN3KJS14JSGlobalObject4initEv
-__ZN3KJS14JSGlobalObject5resetEPNS_7JSValueE
-__ZN3KJS11PropertyMap5clearEv
-__ZN3KJS17FunctionPrototypeC2EPNS_9ExecStateE
-__ZN3KJS11PropertyMap3putERKNS_10IdentifierEPNS_7JSValueEjb
-__ZN3KJS17PrototypeFunctionC1EPNS_9ExecStateEPNS_17FunctionPrototypeEiRKNS_10IdentifierEPFPNS_7JSValueES2_PNS_8JSObjectERKNS_4ListEE
-__ZN3KJS19InternalFunctionImpC2EPNS_17FunctionPrototypeERKNS_10IdentifierE
-__ZN3KJS11PropertyMap11createTableEv
-__ZN3KJS15ObjectPrototypeC2EPNS_9ExecStateEPNS_17FunctionPrototypeE
-__ZN3KJS11PropertyMap6rehashEj
-__ZN3KJS14ArrayPrototypeC1EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS13ArrayInstanceC2EPNS_8JSObjectEj
-__ZN3KJS15StringPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS8jsStringEPKc
-__ZN3KJS16BooleanPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS15NumberPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS13DatePrototypeC1EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS12jsNumberCellEd
-__ZN3KJS9Collector12heapAllocateILNS0_8HeapTypeE1EEEPvm
-__ZN3KJS15RegExpPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3WTF9HashTableIPN3KJS7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZN3KJS14ErrorPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS7UStringC1EPKc
-__ZN3KJS20NativeErrorPrototypeC1EPNS_9ExecStateEPNS_14ErrorPrototypeERKNS_7UStringES7_
-__ZN3KJS8jsStringERKNS_7UStringE
-__ZN3KJS15ObjectObjectImpC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS17FunctionObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeE
-__ZNK3KJS19InternalFunctionImp9classInfoEv
-__ZN3KJS14ArrayObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_14ArrayPrototypeE
-__ZNK3KJS14ArrayPrototype9classInfoEv
-__ZN3KJS15StringObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_15StringPrototypeE
-__ZNK3KJS15StringPrototype9classInfoEv
-__ZN3KJS19StringObjectFuncImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeERKNS_10IdentifierE
-__ZN3KJS16BooleanObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_16BooleanPrototypeE
-__ZNK3KJS15BooleanInstance9classInfoEv
-__ZN3KJS15NumberObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_15NumberPrototypeE
-__ZNK3KJS14NumberInstance9classInfoEv
-__ZN3KJS13DateObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_13DatePrototypeE
-__ZNK3KJS13DatePrototype9classInfoEv
-__ZN3KJS15RegExpObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_15RegExpPrototypeE
-__ZN3KJS14ErrorObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_14ErrorPrototypeE
-__ZNK3KJS13ErrorInstance9classInfoEv
-__ZN3KJS14NativeErrorImpC1EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_20NativeErrorPrototypeE
-__ZNK3KJS11PropertyMap3getERKNS_10IdentifierE
-__ZNK3KJS9StringImp4typeEv
-__ZN3KJS10Identifier11addSlowCaseEPNS_7UString3RepE
-__ZN3WTF9HashTableIPN3KJS7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E3addIS4_S4_NS_17HashSetTranslatorILb1ES4_SA_SA_S8_EEEESt4pairINS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EEbERKT_RKT0_
-__ZN3KJS8JSObject9putDirectERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS13MathObjectImpC1EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS8JSObject17putDirectFunctionEPNS_19InternalFunctionImpEi
-__ZNK3KJS8JSObject4typeEv
-__ZN3KJS9Collector23collectOnMainThreadOnlyEPNS_7JSValueE
-__ZN3KJS9Collector7protectEPNS_7JSValueE
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E3addIPN3KJS8JSObjectEjNS_17HashMapTranslatorILb1ES1_ISF_jENS_18PairBaseHashTraitsINS8_ISF_EENS8_IjEEEESA_NS_7PtrHashISF_EEEEEES1_INS_17HashTableIteratorIiS2_S4_S6_SA_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E6rehashEi
-__ZN3KJS6JSCell9getObjectEv
-__ZN3KJS8Bindings10RootObject6createEPKvPNS_14JSGlobalObjectE
-__ZN3KJS8Bindings10RootObjectC2EPKvPNS_14JSGlobalObjectE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6rehashEi
-__ZN3KJS8Bindings10RootObject9gcProtectEPNS_8JSObjectE
-__ZNK3KJS14JSGlobalObject12saveBuiltinsERNS_13SavedBuiltinsE
-__ZN3KJS21SavedBuiltinsInternalC2Ev
-__ZNK3KJS11PropertyMap4saveERNS_15SavedPropertiesE
-__ZN3KJS30comparePropertyMapEntryIndicesEPKvS1_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E4findIiNS_22IdentityHashTranslatorIiS2_S6_EEEENS_17HashTableIteratorIiS2_S4_S6_SA_S9_EERKT_
-__ZNK3KJS16JSVariableObject16saveLocalStorageERNS_15SavedPropertiesE
-__ZN3KJS13ActivationImpD0Ev
-__ZN3KJS8JSObject12removeDirectERKNS_10IdentifierE
-__ZN3KJS11PropertyMap6removeERKNS_10IdentifierE
-__ZN3KJS7UString3Rep7destroyEv
-__ZN3KJS10Identifier6removeEPNS_7UString3RepE
-__ZN3KJS8Bindings10RootObject10invalidateEv
-__ZN3KJS9Collector9unprotectEPNS_7JSValueE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E4findIiNS_22IdentityHashTranslatorIiiS4_EEEENS_17HashTableIteratorIiiS2_S4_S6_S6_EERKT_
-__ZN3KJS8Bindings10RootObjectD1Ev
-__ZN3KJS14JSGlobalObject10globalExecEv
-__ZN3KJS14JSGlobalObject17startTimeoutCheckEv
-__ZN3KJS7UStringC1EPKNS_5UCharEi
-__ZN3KJS11Interpreter8evaluateEPNS_9ExecStateERKNS_7UStringEiPKNS_5UCharEiPNS_7JSValueE
-__ZN3KJS6ParserC2Ev
-__ZN3KJS6Parser5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EERKNS_7UStringEiPKNS_5UCharEjPiSD_PS7_
-__ZN3KJS6Parser5parseEiPKNS_5UCharEjPiS4_PNS_7UStringE
-__ZN3KJS7UStringaSEPKc
-__ZN3KJS5LexerC2Ev
-__ZN3WTF6VectorIcLm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN3KJS5UCharELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN3KJS7UStringELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN3KJS10IdentifierELm0EE15reserveCapacityEm
-__Z10kjsyyparsev
-__Z8kjsyylexv
-__ZN3KJS5Lexer3lexEv
-__ZN3KJS5Lexer14makeIdentifierERKN3WTF6VectorINS_5UCharELm0EEE
-__ZN3KJS10Identifier3addEPKNS_5UCharEi
-__ZN3KJS5Lexer15matchPunctuatorEiiii
-__ZN3KJS7UStringC2ERKN3WTF6VectorINS_5UCharELm0EEE
-__ZN3KJS14ExpressionNodeC2ENS_6JSTypeE
-__ZN3KJS16ParserRefCountedC2Ev
-__ZN3KJS7UStringC1ERKS0_
-__ZN3KJS4NodeC2Ev
-__ZN3KJS10IdentifierC1ERKS0_
-__ZN3WTF6RefPtrIN3KJS14ExpressionNodeEEC1EPS2_
-__ZN3KJS16ParserRefCounted3refEv
-__ZN3WTF6RefPtrIN3KJS12PropertyNodeEEC1EPS2_
-__ZN3WTF10ListRefPtrIN3KJS16PropertyListNodeEEC1Ev
-__ZN3KJS11ResolveNodeC1ERKNS_10IdentifierE
-__ZN3KJS14ExpressionNodeC2Ev
-__ZN3WTF10ListRefPtrIN3KJS16ArgumentListNodeEEC1Ev
-__Z20makeFunctionCallNodePN3KJS14ExpressionNodeEPNS_13ArgumentsNodeE
-__ZNK3KJS15DotAccessorNode10isLocationEv
-__ZNK3KJS14ExpressionNode13isResolveNodeEv
-__ZNK3KJS14ExpressionNode21isBracketAccessorNodeEv
-__Z14makeNumberNoded
-__Z14makeNegateNodePN3KJS14ExpressionNodeE
-__ZNK3KJS10NumberNode8isNumberEv
-__ZN3KJS19ImmediateNumberNode8setValueEd
-__ZN3KJS5lexerEv
-__ZN3KJS5Lexer10scanRegExpEv
-__ZN3KJS6RegExp6createERKNS_7UStringES3_
-__ZNK3KJS7UString4findENS_5UCharEi
-__ZN3KJS17ObjectLiteralNodeC1EPNS_16PropertyListNodeE
-__Z14compileBracketiPiPPhPPKtS3_P9ErrorCodeiS_S_R11CompileData
-__ZN3KJS16FunctionBodyNode6createEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZN3KJS16FunctionBodyNodeC2EPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZN3KJS9ScopeNodeC2EPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZN3KJS9BlockNodeC1EPNS_14SourceElementsE
-__ZN3KJS13StatementNodeC2Ev
-__ZN3WTF6RefPtrIN3KJS13ParameterNodeEEC1EPS2_
-__ZN3WTF6RefPtrIN3KJS16FunctionBodyNodeEEC1EPS2_
-__ZN3KJS12FuncExprNode9addParamsEv
-__ZN3WTF10ListRefPtrIN3KJS13ParameterNodeEEC1Ev
-__ZN3KJS10ReturnNodeC1EPNS_14ExpressionNodeE
-__Z23allowAutomaticSemicolonv
-__ZN3KJS14SourceElementsC1Ev
-__ZN3WTF10PassRefPtrIN3KJS13StatementNodeEEC1EPS2_
-__ZN3KJS14SourceElements6appendEN3WTF10PassRefPtrINS_13StatementNodeEEE
-__ZNK3KJS13StatementNode16isEmptyStatementEv
-__ZN3WTF6VectorINS_6RefPtrIN3KJS13StatementNodeEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN3KJS13StatementNodeEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN3KJS10IdentifierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN3KJS10IdentifierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN3KJS10IdentifierELm0EE15reserveCapacityEm
-__ZN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEC1Ev
-__Z26appendToVarDeclarationListRPN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEERKS4_j
-__Z20makeVarStatementNodePN3KJS14ExpressionNodeE
-__Z14makeAssignNodePN3KJS14ExpressionNodeENS_8OperatorES1_
-__ZN3KJS17ExprStatementNodeC1EPNS_14ExpressionNodeE
-__ZN3KJS6IfNodeC2EPNS_14ExpressionNodeEPNS_13StatementNodeE
-__Z21mergeDeclarationListsIPN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS0_10IdentifierEjELm16EEEEEET_SA_SA_
-__Z21mergeDeclarationListsIPN3KJS20ParserRefCountedDataIN3WTF6VectorIPNS0_12FuncDeclNodeELm16EEEEEET_S9_S9_
-__ZNK3KJS11ResolveNode10isLocationEv
-__ZNK3KJS11ResolveNode13isResolveNodeEv
-__Z22combineVarInitializersPN3KJS14ExpressionNodeEPNS_17AssignResolveNodeE
-__ZN3KJS14ExpressionNode28optimizeForUnnecessaryResultEv
-__ZN3WTF6VectorIPN3KJS10IdentifierELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS10IdentifierELm0EE14expandCapacityEm
-__ZN3KJS12FuncDeclNode9addParamsEv
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EEC1Ev
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE6appendIS4_EEvPKT_m
-__ZN3KJS16ParserRefCounted5derefEv
-__ZN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEED1Ev
-__Z12makeLessNodePN3KJS14ExpressionNodeES1_
-__Z15makePostfixNodePN3KJS14ExpressionNodeENS_8OperatorE
-__ZN3WTF6RefPtrIN3KJS13StatementNodeEEC1EPS2_
-__ZN3KJS18PostIncResolveNode28optimizeForUnnecessaryResultEv
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EEaSERKS5_
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EEaSERKS4_
-__ZNK3KJS14ExpressionNode10isLocationEv
-__ZNK3KJS19BracketAccessorNode10isLocationEv
-__ZNK3KJS19BracketAccessorNode21isBracketAccessorNodeEv
-__ZN3KJS9ForInNodeC1ERKNS_10IdentifierEPNS_14ExpressionNodeES5_PNS_13StatementNodeE
-__ZN3KJS9ThrowNodeC1EPNS_14ExpressionNodeE
-__Z14makeTypeOfNodePN3KJS14ExpressionNodeE
-__ZN3WTF6VectorINS_6RefPtrIN3KJS13StatementNodeEEELm0EEC1Ev
-__ZN3WTF6RefPtrIN3KJS14CaseClauseNodeEEC1EPS2_
-__ZN3WTF10ListRefPtrIN3KJS14ClauseListNodeEEC1Ev
-__ZN3KJS13CaseBlockNodeC2EPNS_14ClauseListNodeEPNS_14CaseClauseNodeES2_
-__Z11makeAddNodePN3KJS14ExpressionNodeES1_
-__ZN3WTF10ListRefPtrIN3KJS11ElementNodeEEC1Ev
-__ZN3WTF6RefPtrIN3KJS11ElementNodeEEC1EPS2_
-__ZNK3KJS18EmptyStatementNode16isEmptyStatementEv
-__ZN3KJS9BreakNodeC1Ev
-__Z32branchFindFirstAssertedCharacterPKhb
-__Z20branchNeedsLineStartPKhjj
-__ZN3KJS10IdentifierC1ERKNS_7UStringE
-__ZN3WTF6RefPtrIN3KJS7UString3RepEED1Ev
-__ZN3KJS9CommaNodeC2EPNS_14ExpressionNodeES2_
-__Z14makePrefixNodePN3KJS14ExpressionNodeENS_8OperatorE
-__ZN3WTF6RefPtrIN3KJS13ArgumentsNodeEEC1EPS2_
-__ZN3WTF6VectorIPN3KJS7UStringELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS7UStringELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN3KJS5UCharELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN3KJS5UCharELm0EE14expandCapacityEm
-__ZNK3KJS14ExpressionNode8isNumberEv
-__ZN3KJS19PlaceholderTrueNodeC1Ev
-__ZN3KJS18EmptyStatementNodeC1Ev
-__Z14makeDeleteNodePN3KJS14ExpressionNodeE
-__Z15isCountedRepeatPKtS0_
-__ZN3KJS12ContinueNodeC1Ev
-__ZN3KJS9ForInNodeC1EPNS_14ExpressionNodeES2_PNS_13StatementNodeE
-__ZN3KJS18PostDecResolveNode28optimizeForUnnecessaryResultEv
-__Z17bracketIsAnchoredPKh
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE15reserveCapacityEm
-__ZN3KJS7UString4fromEd
-_kjs_dtoa
-_d2b
-_Balloc
-__ZN3KJS6parserEv
-__ZN3KJS6Parser16didFinishParsingEPNS_14SourceElementsEPNS_20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEEPNS3_INS5_IPNS_12FuncDeclNodeELm16EEEEEi
-__ZN3KJS5Lexer5clearEv
-__ZN3WTF25TCMalloc_Central_FreeList11InsertRangeEPvS1_i
+__ZN3WTF11fastReallocILb1EEEPvS1_m
+__ZN3JSC7UStringC1EPKti
+__ZN3JSC7UStringC2EPKti
+__ZN3JSC12JSGlobalData12createLeakedEv
+__ZN3JSC9Structure18startIgnoringLeaksEv
+__ZN3JSC7VPtrSetC2Ev
+__ZN3JSC9StructureC1ENS_7JSValueERKNS_8TypeInfoE
+__ZN3JSC7JSArrayC1EN3WTF10PassRefPtrINS_9StructureEEE
+__ZN3JSC7JSArrayD1Ev
+__ZN3JSC7JSArrayD2Ev
+__ZN3WTF10RefCountedIN3JSC9StructureEE5derefEv
+__ZN3JSC9StructureD1Ev
+__ZN3JSC9StructureD2Ev
+__ZN3JSC11JSByteArray15createStructureENS_7JSValueE
+__ZN3JSC11JSByteArrayD1Ev
+__ZN3JSC8JSStringD1Ev
+__ZN3JSC10JSFunctionD1Ev
+__ZN3JSC10JSFunctionD2Ev
+__ZN3JSC8JSObjectD2Ev
+__ZN3JSC12JSGlobalDataC2EbRKNS_7VPtrSetE
+__ZN3JSC21createIdentifierTableEv
+__ZN3JSC17CommonIdentifiersC1EPNS_12JSGlobalDataE
+__ZN3JSC17CommonIdentifiersC2EPNS_12JSGlobalDataE
+__ZN3JSC10Identifier3addEPNS_12JSGlobalDataEPKc
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24HashT
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF9HashTableIPKcSt4pairIS2_NS_6RefPtrIN3JSC7UString3RepEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS2_EENS_14PairHashTra
+__ZN3WTF6RefPtrIN3JSC7UString3RepEED1Ev
+__ZN3JSC12SmallStringsC1Ev
+__ZN3JSC19ExecutableAllocator17intializePageSizeEv
+__ZN3JSC14ExecutablePool11systemAllocEm
+__ZN3JSC5LexerC1EPNS_12JSGlobalDataE
+__ZN3JSC5LexerC2EPNS_12JSGlobalDataE
+__ZN3JSC11InterpreterC1Ev
+__ZN3JSC11InterpreterC2Ev
+__ZN3JSC11Interpreter14privateExecuteENS0_13ExecutionFlagEPNS_12RegisterFileEPNS_9ExecStateEPNS_7JSValueE
+__ZN3WTF7HashMapIPvN3JSC8OpcodeIDENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS6_IS3_EEE3addERKS1_RKS3_
+__ZN3WTF9HashTableIPvSt4pairIS1_N3JSC8OpcodeIDEENS_18PairFirstExtractorIS5_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTrai
+__ZN3JSC8JITStubsC1EPNS_12JSGlobalDataE
+__ZN3JSC3JITC1EPNS_12JSGlobalDataEPNS_9CodeBlockE
+__ZN3JSC3JITC2EPNS_12JSGlobalDataEPNS_9CodeBlockE
+__ZN3JSC3JIT35privateCompileCTIMachineTrampolinesEPN3WTF6RefPtrINS_14ExecutablePoolEEEPNS_12JSGlobalDataEPPvS9_S9_S9_S9_S9_
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler3jCCENS0_9ConditionE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC15AssemblerBuffer11ensureSpaceEi
+__ZN3JSC20MacroAssemblerX86_6413branchTestPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAsse
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDENS_3X8610RegisterIDE
+__ZN3JSC20MacroAssemblerX86_644callEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC3JIT32compileOpCallInitializeCallFrameEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDEi
+__ZN3JSC20MacroAssemblerX86_6421makeTailRecursiveCallENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC14TimeoutCheckerC1Ev
+__ZN3JSC4HeapC1EPNS_12JSGlobalDataE
+__ZN3JSC27startProfilerServerIfNeededEv
++[ProfilerServer sharedProfileServer]
+-[ProfilerServer init]
+__ZN3JSC9Structure17stopIgnoringLeaksEv
+__ZN3JSC4Heap8allocateEm
+__ZN3JSCL13allocateBlockILNS_8HeapTypeE0EEEPNS_14CollectorBlockEv
+__ZN3JSC4Heap4heapENS_7JSValueE
+__ZN3JSC4Heap7protectENS_7JSValueE
+__ZN3WTF7HashMapIPN3JSC6JSCellEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN3JSC6JSCellESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraits
+__ZN3JSC14JSGlobalObjectnwEmPNS_12JSGlobalDataE
+__ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
+__ZN3JSC14JSGlobalObject5resetENS_7JSValueE
+__ZN3JSC4Heap12heapAllocateILNS_8HeapTypeE0EEEPvm
+__ZN3JSC8jsStringEPNS_12JSGlobalDataERKNS_7UStringE
+__ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
+__ZN3JSC7UStringC1EPKc
+__ZN3JSCL9createRepEPKc
+__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_7JSValueEjbRNS_15PutPropertySlotE
+__ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjRm
+__ZN3JSC9Structure3getERKNS_10IdentifierERj
+__ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjRm
+__ZN3JSC9Structure3putERKNS_10IdentifierEj
+__ZN3JSC8JSObject26putDirectWithoutTransitionERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEj
+__ZN3JSC17FunctionPrototype21addFunctionPropertiesEPNS_9ExecStateEPNS_9StructureEPPNS_10JSFunctionES7_
+__ZN3JSC10JSFunctionC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RK
+__ZN3JSC12JSGlobalData17createNativeThunkEv
+__ZN3JSC16FunctionBodyNode17createNativeThunkEPNS_12JSGlobalDataE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC21ParserArenaRefCountedEEELm0EE15reserveCapacityEm
+__ZN3JSC11ParserArena5resetEv
+__ZN3JSC8JSObject34putDirectFunctionWithoutTransitionEPNS_9ExecStateEPNS_16InternalFunctionEj
+__ZN3JSC15ObjectPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC9Structure26rehashPropertyMapHashTableEj
+__ZN3JSC15StringPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEE
+__ZN3JSC16BooleanPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC15NumberPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC15RegExpPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC14ErrorPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC20NativeErrorPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringES9_
+__ZN3JSC17ObjectConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_15ObjectPrototypeE
+__ZN3JSC19FunctionConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_17FunctionPrototypeE
+__ZNK3JSC16InternalFunction9classInfoEv
+__ZN3JSC16ArrayConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_14ArrayPrototypeE
+__ZNK3JSC14ArrayPrototype9classInfoEv
+__ZN3JSC17StringConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_PNS_15StringPrototypeE
+__ZNK3JSC15StringPrototype9classInfoEv
+__ZN3JSC18BooleanConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_16BooleanPrototypeE
+__ZNK3JSC13BooleanObject9classInfoEv
+__ZN3JSC17NumberConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_15NumberPrototypeE
+__ZN3JSC15DateConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_PNS_13DatePrototypeE
+__ZNK3JSC13DatePrototype9classInfoEv
+__ZN3JSC17RegExpConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_15RegExpPrototypeE
+__ZN3JSC16ErrorConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_14ErrorPrototypeE
+__ZNK3JSC13ErrorInstance9classInfoEv
+__ZN3JSC22NativeErrorConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_20NativeErrorPrototypeE
+__ZN3JSC10Identifier11addSlowCaseEPNS_12JSGlobalDataEPNS_7UString3RepE
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3JSC10MathObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEE
+__ZN3JSC12SmallStrings24singleCharacterStringRepEh
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26Symbo
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_16SymbolTableEntryEENS_18PairFirstExtractorIS8_EENS2_17Identif
+__ZN3JSC17PrototypeFunctionC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjec
+__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_7JSValueE
+__ZN3JSC9Structure17copyPropertyTableEv
+__ZN3JSC14JSGlobalObject10globalExecEv
+__ZN3JSC10Identifier3addEPNS_9ExecStateEPKc
+__ZN3JSC4Heap9unprotectENS_7JSValueE
+__ZN3JSC6JSCellnwEmPNS_9ExecStateE
+__ZN3JSC14TimeoutChecker5resetEv
+__ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_7JSValueE
+__ZN3JSC6JSLock4lockEb
+__ZN3JSC6Parser5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
+__ZN3JSC6Parser5parseEPNS_12JSGlobalDataEPiPNS_7UStringE
+__ZN3JSC7UStringaSEPKc
+__Z10jscyyparsePv
+__ZN3JSC5Lexer3lexEPvS1_
+__ZN3JSC10Identifier3addEPNS_12JSGlobalDataEPKti
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslatorEE
+__ZN3JSC15SegmentedVectorINS_10IdentifierELm64EE6appendIS1_EEvRKT_
+__ZNK3JSC9HashTable11createTableEPNS_12JSGlobalDataE
+__ZN3JSC20ParserArenaDeletablenwEmPNS_12JSGlobalDataE
+__ZN3WTF6VectorIPN3JSC20ParserArenaDeletableELm0EE15reserveCapacityEm
+__ZN3JSC5Lexer10sourceCodeEiii
+__ZN3JSC16FunctionBodyNode13finishParsingERKNS_10SourceCodeEPNS_13ParameterNodeE
+__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC12FuncDeclNodeELm0EE14expandCapacityEm
+__ZN3JSC14SourceElements6appendEPNS_13StatementNodeE
+__ZNK3JSC13StatementNode16isEmptyStatementEv
+__ZN3WTF6VectorIPN3JSC13StatementNodeELm0EE14expandCapacityEm
+__ZL20makeFunctionCallNodePvN3JSC8NodeInfoIPNS0_14ExpressionNodeEEENS1_IPNS0_13ArgumentsNodeEEEiii
+__ZNK3JSC11ResolveNode10isLocationEv
+__ZNK3JSC11ResolveNode13isResolveNodeEv
+__ZN3JSC5Lexer7record8Ei
+__ZN3JSC5Lexer10scanRegExpEv
+__ZN3JSC7UStringC2ERKN3WTF6VectorItLm0EEE
+__ZN3JSC7UString3Rep7destroyEv
+__ZN3JSC5Lexer5clearEv
+__ZN3JSC10Identifier6removeEPNS_7UString3RepE
+__ZN3WTF6VectorIN3JSC10IdentifierELm64EE14shrinkCapacityEm
+__ZN3JSC9ScopeNodeC2EPNS_12JSGlobalDataERKNS_10SourceCodeEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPN
+__ZN3WTF6VectorIPN3JSC13StatementNodeELm0EE14shrinkCapacityEm
+__ZN3JSC11ParserArena10removeLastEv
+__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
+__ZN3JSC11Interpreter7executeEPNS_11ProgramNodeEPNS_9ExecStateEPNS_14ScopeChainNodeEPNS_8JSObjectEPNS_7JSValueE
+__ZN3JSC11ProgramNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC9CodeBlockC2EPNS_9ScopeNodeENS_8CodeTypeEN3WTF10PassRefPtrINS_14SourceProviderEEEj
+__ZN3WTF7HashSetIPN3JSC16ProgramCodeBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3JSC17BytecodeGeneratorC2EPNS_11ProgramNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEEN
+__ZN3WTF6VectorIN3JSC11InstructionELm0EE14expandCapacityEm
+__ZN3JSC9Structure22toDictionaryTransitionEPS0_
+__ZN3JSC8JSObject12removeDirectERKNS_10IdentifierE
+__ZN3JSC9Structure31removePropertyWithoutTransitionERKNS_10IdentifierE
+__ZN3JSC9Structure6removeERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator12addGlobalVarERKNS_10IdentifierEbRPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitNewFunctionEPNS_10RegisterIDEPNS_12FuncDeclNodeE
+__ZN3JSC9CodeBlock25createRareDataIfNecessaryEv
+__ZN3JSC17BytecodeGenerator11newRegisterEv
+__ZN3JSC9Structure24fromDictionaryTransitionEPS0_
+__ZN3JSC17BytecodeGenerator8generateEv
+__ZN3JSC11ProgramNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitDebugHookENS_11DebugHookIDEii
+__ZN3JSC17BytecodeGenerator11addConstantENS_7JSValueE
+__ZN3WTF9HashTableIPvSt4pairIS1_jENS_18PairFirstExtractorIS3_EENS_7PtrHashIS1_EENS_14PairHashTraitsIN3JSC17JSValueHashTraitsENS
+__ZN3WTF6VectorIN3JSC8RegisterELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator8emitMoveEPNS_10RegisterIDES2_
+__ZN3JSC17BytecodeGenerator8emitNodeEPNS_10RegisterIDEPNS_4NodeE
+__ZN3WTF6VectorIN3JSC8LineInfoELm0EE14expandCapacityEm
+__ZN3JSC12FuncDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17ExprStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC23FunctionCallResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11registerForERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator8emitCallENS_8OpcodeIDEPNS_10RegisterIDES3_S3_PNS_13ArgumentsNodeEjjj
+__ZN3JSC16ArgumentListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12FuncExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitNewFunctionExpressionEPNS_10RegisterIDEPNS_12FuncExprNodeE
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC12CallLinkInfoELm0EE14expandCapacityEm
+__ZN3JSC11ResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12JSGlobalData22numericCompareFunctionEPNS_9ExecStateE
+__ZNK3JSC21UStringSourceProvider6lengthEv
+__ZNK3JSC21UStringSourceProvider4dataEv
+__ZN3JSC19extractFunctionBodyEPNS_11ProgramNodeE
+__ZNK3JSC17ExprStatementNode15isExprStatementEv
+__ZNK3JSC12FuncExprNode14isFuncExprNodeEv
+__ZN3JSC16FunctionBodyNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC6Parser14reparseInPlaceEPNS_12JSGlobalDataEPNS_16FunctionBodyNodeE
+__ZL11makeSubNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC14ExpressionNode14stripUnaryPlusEv
+__ZNK3JSC14ExpressionNode8isNumberEv
+__ZN3JSC9CodeBlockC1EPNS_9ScopeNodeENS_8CodeTypeEN3WTF10PassRefPtrINS_14SourceProviderEEEj
+__ZN3JSC17BytecodeGeneratorC2EPNS_16FunctionBodyNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3Re
+__ZN3JSC17BytecodeGenerator12addParameterERKNS_10IdentifierE
+__ZN3JSC16FunctionBodyNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9BlockNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10ReturnNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12BinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC11ResolveNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC17BytecodeGenerator12newTemporaryEv
+__ZN3JSC17BytecodeGenerator12emitBinaryOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_NS_12OperandTypesE
+__ZN3JSC17BytecodeGenerator10emitReturnEPNS_10RegisterIDE
+__ZNK3JSC9BlockNode7isBlockEv
+__ZNK3JSC10ReturnNode12isReturnNodeEv
+__ZN3JSC9CodeBlock11shrinkToFitEv
+__ZN3WTF6VectorIN3JSC11InstructionELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14shrinkCapacityEm
+__ZN3JSC11ParserArenaD1Ev
+__ZN3JSC11ResolveNodeD0Ev
+__ZN3JSC7SubNodeD0Ev
+__ZN3JSC10ReturnNodeD0Ev
+__ZN3JSC14SourceElementsD0Ev
+__ZN3JSC9BlockNodeD0Ev
+__ZN3JSC17BytecodeGeneratorD2Ev
+__ZN3WTF6VectorIN3JSC11InstructionELm0EEaSERKS3_
+__ZThn16_N3JSC11ProgramNodeD0Ev
+__ZN3JSC11ProgramNodeD0Ev
+__ZN3JSC13ParameterNodeD0Ev
+__ZN3JSC17ExprStatementNodeD0Ev
+__ZThn16_N3JSC12FuncExprNodeD0Ev
+__ZN3JSC12FuncExprNodeD0Ev
+__ZThn16_N3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC9CodeBlockD1Ev
+__ZN3JSC9CodeBlockD2Ev
+__ZN3JSC21UStringSourceProviderD0Ev
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC8LineInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncDeclNodeEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE14shrinkCapacityEm
+__ZN3JSC15ParserArenaDataIN3WTF6VectorIPNS_12FuncDeclNodeELm0EEEED0Ev
+__ZN3JSC16ArgumentListNodeD0Ev
+__ZN3JSC13ArgumentsNodeD0Ev
+__ZN3JSC23FunctionCallResolveNodeD0Ev
+__ZN3JSC14JSGlobalObject13copyGlobalsToERNS_12RegisterFileE
+__ZN3JSC3JIT14privateCompileEv
+__ZN3JSC3JIT22privateCompileMainPassEv
+__ZN3JSC3JIT13emit_op_enterEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_new_funcEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_648storePtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS3_15ImplicitAddressE
+__ZN3JSC11JITStubCall4callEj
+__ZN3WTF6VectorIN3JSC10CallRecordELm0EE14expandCapacityEm
+__ZN3JSC3JIT11emit_op_movEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_new_func_expEPNS_11InstructionE
+__ZN3JSC3JIT12emit_op_callEPNS_11InstructionE
+__ZN3JSC3JIT13compileOpCallENS_8OpcodeIDEPNS_11InstructionEj
+__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEm
+__ZN3JSC3JIT11emit_op_endEPNS_11InstructionE
+__ZN3JSC11JITStubCall4callEv
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14shrinkCapacityEm
+__ZN3JSC3JIT23privateCompileSlowCasesEv
+__ZN3JSC3JIT16emitSlow_op_callEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21compileOpCallSlowCaseEPNS_11InstructionERPNS_13SlowCaseEntryEjNS_8OpcodeIDE
+__ZN3JSC3JIT22compileOpCallSetupArgsEPNS_11InstructionE
+__ZN3JSC9CodeBlock10setJITCodeERNS_10JITCodeRefE
+__ZN3JSC17BytecodeGenerator18dumpsGeneratedCodeEv
+__ZN3WTF10RefCountedIN3JSC14ExecutablePoolEE5derefEv
+_ctiTrampoline
+__ZN3JSC8JITStubs15cti_op_new_funcEPPv
+__ZN3JSC12FuncDeclNode12makeFunctionEPNS_9ExecStateEPNS_14ScopeChainNodeE
+__ZN3JSC8JITStubs19cti_op_new_func_expEPPv
+__ZN3JSC12FuncExprNode12makeFunctionEPNS_9ExecStateEPNS_14ScopeChainNodeE
+__ZN3JSC8JITStubs22cti_op_call_JSFunctionEPPv
+__ZN3JSC16FunctionBodyNode15generateJITCodeEPNS_14ScopeChainNodeE
+__ZN3JSC10IfElseNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8newLabelEv
+__ZN3JSC15DotAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitResolveEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator18findScopedPropertyERKNS_10IdentifierERiRmbRPNS_8JSObjectE
+__ZNK3JSC16JSVariableObject16isVariableObjectEv
+__ZN3JSC17BytecodeGenerator16emitGetScopedVarEPNS_10RegisterIDEmiNS_7JSValueE
+__ZN3JSC17BytecodeGenerator11emitGetByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator11addConstantERKNS_10IdentifierE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEiNS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_17BytecodeGenerator28Identifi
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_iENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHa
+__ZN3JSC17BytecodeGenerator15emitJumpIfFalseEPNS_10RegisterIDEPNS_5LabelE
+__ZNK3JSC14JSGlobalObject14isDynamicScopeEv
+__ZN3JSC17BytecodeGenerator19emitResolveFunctionEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC10StringNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3WTF9HashTableIPN3JSC7UString3RepESt4pairIS4_PNS1_8JSStringEENS_18PairFirstExtractorIS8_EENS1_17IdentifierRepHashENS_14Pair
+__ZN3JSC11BooleanNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitJumpEPNS_5LabelE
+__ZN3JSC17BytecodeGenerator9emitLabelEPNS_5LabelE
+__ZN3WTF6VectorIjLm0EE15reserveCapacityEm
+__ZN3JSC6IfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC13StatementNode12isReturnNodeEv
+__ZN3JSC15DotAccessorNodeD0Ev
+__ZN3JSC10StringNodeD0Ev
+__ZN3JSC11BooleanNodeD0Ev
+__ZN3JSC6IfNodeD0Ev
+__ZN3JSC10IfElseNodeD0Ev
+__ZN3JSC3JIT22emit_op_get_global_varEPNS_11InstructionE
+__ZN3JSC3JIT29emitGetVariableObjectRegisterENS_3X8610RegisterIDEiS2_
+__ZN3JSC3JIT17emit_op_get_by_idEPNS_11InstructionE
+__ZN3JSC3JIT21compileGetByIdHotPathEiiPNS_10IdentifierEj
+__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEmPKS2_
+__ZN3JSC3JIT14emit_op_jfalseEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssembler
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDES4_
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14expandCapacityEm
+__ZN3JSC3JIT20emit_op_resolve_funcEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_jmpEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_retEPNS_11InstructionE
+__ZN3JSC3JIT21emitSlow_op_get_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22compileGetByIdSlowCaseEiiPNS_10IdentifierERPNS_13SlowCaseEntryEj
+__ZN3JSC3JIT18emitSlow_op_jfalseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC23MacroAssemblerX86Common12branchTest32ENS0_9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssemblerINS_12X86Assemble
+__ZN3JSC8JITStubs23cti_vm_dontLazyLinkCallEPPv
+__ZN3JSC31ctiPatchNearCallByReturnAddressENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressEPv
+__ZN3JSC8JITStubs23cti_register_file_checkEPPv
+__ZN3JSC8JITStubs16cti_op_get_by_idEPPv
+__ZNK3JSC7JSValue3getEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC27ctiPatchCallByReturnAddressENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressEPv
+__ZN3JSC8JITStubs12cti_op_jtrueEPPv
+__ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JITStubs19cti_op_resolve_funcEPPv
+__ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
+__ZNK3JSC8JSString8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs23cti_op_get_by_id_secondEPPv
+__ZN3JSC8JITStubs15tryCacheGetByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_7JSValueERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC3JIT26privateCompileGetByIdProtoEPNS_17StructureStubInfoEPNS_9StructureES4_mNS_22AbstractMacroAssemblerINS_12X86Assembl
+__ZN3JSC3JIT22compileGetDirectOffsetEPNS_8JSObjectENS_3X8610RegisterIDES4_m
+__ZN3JSC8JITStubs19cti_vm_lazyLinkCallEPPv
+__ZN3JSC3JIT8linkCallEPNS_10JSFunctionEPNS_9CodeBlockENS_7JITCodeEPNS_12CallLinkInfoEi
+__ZN3JSC8JITStubs10cti_op_endEPPv
+__ZThn16_N3JSC12FuncDeclNodeD0Ev
+__ZN3JSC12FuncDeclNodeD0Ev
 __ZN3WTF25TCMalloc_Central_FreeList11ShrinkCacheEib
-__ZN3WTF25TCMalloc_Central_FreeList18ReleaseListToSpansEPv
-__ZN3WTF15deleteAllValuesIPN3KJS16ParserRefCountedEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3KJS19BracketAccessorNodeD1Ev
-__ZN3KJS11ProgramNodeC2EPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZNK3KJS8JSObject8toObjectEPNS_9ExecStateE
-__ZN3KJS11ProgramNode7executeEPNS_9ExecStateE
-__ZN3KJS11ProgramNode21initializeSymbolTableEPNS_9ExecStateE
-__ZN3WTF6VectorImLm0EE6resizeEm
-__ZN3WTF6VectorImLm0EE14expandCapacityEm
-__ZN3WTF6VectorImLm0EE15reserveCapacityEm
-__ZN3WTF9HashTableINS_6RefPtrIN3KJS7UString3RepEEESt4pairIS5_mENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEEESC_E3addIS5_mNS_17HashMapTranslatorILb1ES7_NS_18PairBaseHashTraitsISC_SD_EESE_SA_EEEES6_INS_17HashTableIteratorIS5_S7_S9_SA_SE_SC_EEbERKT_RKT0_
-__ZN3WTF9HashTableINS_6RefPtrIN3KJS7UString3RepEEESt4pairIS5_mENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEEESC_E6rehashEi
-__ZN3KJS14JSGlobalObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZNK3WTF7HashMapINS_6RefPtrIN3KJS7UString3RepEEEmNS2_17IdentifierRepHashENS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEE3getEPS4_
-__ZN3KJS11PropertyMap11getLocationERKNS_10IdentifierE
-__ZN3KJS6Lookup9findEntryEPKNS_9HashTableERKNS_10IdentifierE
-__ZNK3KJS7UString14toStrictUInt32EPb
-__ZN3KJS8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3WTF6VectorIN3KJS17LocalStorageEntryELm32EE15reserveCapacityEm
-__ZN3KJS11FunctionImpC2EPNS_9ExecStateERKNS_10IdentifierEPNS_16FunctionBodyNodeERKNS_10ScopeChainE
-__ZN3KJS15ObjectObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9ScopeNode22optimizeVariableAccessEPNS_9ExecStateE
-__ZN3WTF6VectorIPN3KJS4NodeELm16EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS4NodeELm16EE15reserveCapacityEm
-__ZN3KJS16VarStatementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17AssignResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17ObjectLiteralNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS16PropertyListNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS12PropertyNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS4Node22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPS0_Lm16EEE
-__ZN3KJS14LogicalNotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14LogicalAndNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15DotAccessorNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11ResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11GreaterNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS19FunctionCallDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13ArgumentsNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS16ArgumentListNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9EqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18NotStrictEqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS6IfNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17ExprStatementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13AssignDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13LogicalOrNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8WithNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9BlockNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS23FunctionCallResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS21FunctionCallValueNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9ArrayNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11ElementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10IfElseNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS7AddNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS6InNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11NewExprNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS16VarStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS18AssignLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17ObjectLiteralNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PropertyListNode8evaluateEPNS_9ExecStateE
-__ZN3KJS10StringNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13jsOwnedStringERKNS_7UStringE
-__ZN3KJS8JSObject3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS14LogicalNotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14LogicalNotNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS14LogicalAndNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS11ResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11GreaterNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9ExecState19lexicalGlobalObjectEv
-__ZNK3KJS9StringImp8toObjectEPNS_9ExecStateE
-__ZN3KJS14StringInstance18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS15StringPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS20staticFunctionGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFPNS_7JSValueES2_PNS_8JSObjectERKNS_4ListEE
-__ZNK3KJS19InternalFunctionImp14implementsCallEv
-__ZN3KJS16ArgumentListNode12evaluateListEPNS_9ExecStateERNS_4ListE
-__ZN3KJS17PrototypeFunction14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22stringProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14StringInstance9classInfoEv
-__ZNK3KJS9StringImp8toStringEPNS_9ExecStateE
-__ZNK3KJS7JSValue9toIntegerEPNS_9ExecStateE
-__ZNK3KJS7UString4findERKS0_i
-__ZN3KJS19ImmediateNumberNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14LogicalAndNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9EqualNode8evaluateEPNS_9ExecStateE
-__ZN3KJS5equalEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS19FunctionCallDotNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS10RegExpNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15RegExpObjectImp15createRegExpImpEPNS_9ExecStateEN3WTF10PassRefPtrINS_6RegExpEEE
-__ZN3KJS20stringProtoFuncMatchEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS9RegExpImp9classInfoEv
-__ZN3KJS15RegExpObjectImp12performMatchEPNS_6RegExpERKNS_7UStringEiRiS6_PPi
-__ZN3KJS6RegExp5matchERKNS_7UStringEiPN3WTF11OwnArrayPtrIiEE
-__Z5matchPKtPKhiR9MatchData
-__ZNK3KJS8JSObject9toBooleanEPNS_9ExecStateE
-__ZN3KJS18NotStrictEqualNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS7UString8toUInt32EPbb
-__ZNK3KJS7UString8toDoubleEbb
-__ZN3KJS11strictEqualEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS12FuncExprNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14JSGlobalObject17tearOffActivationEPNS_9ExecStateEb
-__ZN3KJS6IfNode7executeEPNS_9ExecStateE
-__ZN3KJS18LocalVarAccessNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17ExprStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS13AssignDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11FunctionImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17FunctionExecStateC1EPNS_14JSGlobalObjectEPNS_8JSObjectEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_11FunctionImpERKNS_4ListE
-__ZN3KJS14JSGlobalObject14pushActivationEPNS_9ExecStateE
-__ZN3KJS13ActivationImp4initEPNS_9ExecStateE
-__ZN3KJS16FunctionBodyNode7executeEPNS_9ExecStateE
-__ZN3KJS16FunctionBodyNode21initializeSymbolTableEPNS_9ExecStateE
-__ZN3KJS9ForInNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17AssignBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS19BracketAccessorNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10ReturnNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9ForInNode7executeEPNS_9ExecStateE
-__ZN3KJS8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZNK3KJS11PropertyMap26getEnumerablePropertyNamesERNS_17PropertyNameArrayE
-__ZNK3KJS8JSObject9classInfoEv
-__ZN3KJS13ActivationImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS13ActivationImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS17AssignBracketNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS6JSCell9getUInt32ERj
-__ZN3KJS19BracketAccessorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS10ReturnNode7executeEPNS_9ExecStateE
-__ZN3KJS14JSGlobalObject13popActivationEv
-__ZN3KJS11FunctionImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS10NumberNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9CommaNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13ActivationImpC1ERKNS0_14ActivationDataEb
-__ZN3WTF6VectorIN3KJS17LocalStorageEntryELm32EEC2ERKS3_
-__ZN3KJS13ActivationImp15argumentsGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS13ActivationImp21createArgumentsObjectEPNS_9ExecStateE
-__ZN3KJS9ArgumentsC2EPNS_9ExecStateEPNS_11FunctionImpERKNS_4ListEPNS_13ActivationImpE
-__ZN3KJS14IndexToNameMapC2EPNS_11FunctionImpERKNS_4ListE
-__ZN3KJS11FunctionImp16getParameterNameEi
-__ZN3KJS7UString4fromEj
-__ZN3KJS9Arguments18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS9CommaNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8ThisNode8evaluateEPNS_9ExecStateE
-__ZN3KJS23FunctionCallResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9WhileNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PostDecResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18LocalVarAccessNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13LogicalOrNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11NewExprNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS14ArrayObjectImp19implementsConstructEv
-__ZN3KJS14ArrayObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9WhileNode7executeEPNS_9ExecStateE
-__ZN3KJS19PostDecLocalVarNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3KJS13ArrayInstance3putEPNS_9ExecStateEjPNS_7JSValueEi
-__ZN3KJS15RegExpObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS15RegExpObjectImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS7ForNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8LessNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17PreIncResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8NullNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13ArrayInstance18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3KJS17TypeOfResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18LocalVarTypeOfNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18typeStringForValueEPNS_7JSValueE
-__ZNK3KJS8JSObject21masqueradeAsUndefinedEv
-__ZNK3KJS8JSObject14implementsCallEv
-__ZN3KJS12FuncDeclNode7executeEPNS_9ExecStateE
-__ZN3KJS11FunctionImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS9ArrayNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13ArrayInstanceC2EPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13ArrayInstance3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS13ArrayInstance9setLengthEj
-__ZN3KJS7ForNode7executeEPNS_9ExecStateE
-__ZN3KJS8LessNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13ArrayInstance18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS13ArrayInstance12lengthGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS14ArrayPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS18arrayProtoFuncPushEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8TrueNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9BlockNode7executeEPNS_9ExecStateE
-__ZN3KJS18PreIncLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14StringInstance3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS13LogicalOrNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS8WithNode7executeEPNS_9ExecStateE
-__ZN3KJS15NumberObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS24LocalVarFunctionCallNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15ConditionalNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS22stringProtoFuncReplaceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7replaceEPNS_9ExecStateEPNS_9StringImpEPNS_7JSValueES5_
-__ZNK3KJS7UString30spliceSubstringsWithSeparatorsEPKNS0_5RangeEiPKS0_i
-__ZN3KJS15ConditionalNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9StringImp9toBooleanEPNS_9ExecStateE
-__ZN3KJS20stringProtoFuncSplitEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7UString6substrEii
-__ZN3KJS7UString3Rep6createEN3WTF10PassRefPtrIS1_EEii
-__ZN3KJS7TryNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15LessNumbersNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS10NumberNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS7TryNode7executeEPNS_9ExecStateE
-__ZN3KJS21arrayProtoFuncForEachEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18PostIncResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PostIncResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13ActivationImp18isActivationObjectEv
-__ZN3KJS13MathObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS21FunctionCallValueNode8evaluateEPNS_9ExecStateE
-__ZN3KJS12NotEqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9FalseNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19arrayProtoFuncShiftEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13ArrayInstance14deletePropertyEPNS_9ExecStateEj
-__ZNK3KJS11FunctionImp19implementsConstructEv
-__ZN3KJS11FunctionImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9EqualNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS25functionProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS11FunctionImp9classInfoEv
-__ZNK3KJS4Node8toStringEv
-__ZNK3KJS9ScopeNode8streamToERNS_12SourceStreamE
-__ZN3KJS7UString6appendEt
-__ZN3KJS7UString6appendERKS0_
-__ZN3KJS7UString6appendEPKc
-__ZN3KJS7UString14expandCapacityEi
-__ZN3KJS12SourceStreamlsEPKNS_4NodeE
-__ZNK3KJS17ExprStatementNode8streamToERNS_12SourceStreamE
-__ZNK3KJS4Node21needsParensIfLeftmostEv
-__ZNK3KJS23FunctionCallResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13ArgumentsNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16ArgumentListNode8streamToERNS_12SourceStreamE
-__ZNK3KJS11ResolveNode10precedenceEv
-__ZNK3KJS11ResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13AssignDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8ThisNode10precedenceEv
-__ZNK3KJS8ThisNode8streamToERNS_12SourceStreamE
-__ZNK3KJS19FunctionCallDotNode10precedenceEv
-__ZNK3KJS19FunctionCallDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16FunctionBodyNode11paramStringEv
-__ZNK3KJS15RegExpObjectImp14arrayOfMatchesEPNS_9ExecStateE
-__ZN3KJS9Arguments17mappedIndexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS19arrayProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22functionProtoFuncApplyEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS13ArrayInstance9classInfoEv
-__ZN3KJS24substituteBackreferencesERKNS_7UStringES2_PiPNS_6RegExpE
-__ZNK3KJS15DotAccessorNode10precedenceEv
-__ZNK3KJS15DotAccessorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16VarStatementNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS6IfNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14LogicalNotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9ArrayNode10precedenceEv
-__ZNK3KJS9ArrayNode8streamToERNS_12SourceStreamE
-__ZNK3KJS11ElementNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10StringNode10precedenceEv
-__ZNK3KJS10StringNode8streamToERNS_12SourceStreamE
-__ZN3KJS29escapeStringForPrettyPrintingERKNS_7UStringE
-__ZNK3KJS9BlockNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignBracketNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10IfElseNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9EqualNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9EqualNode10precedenceEv
-__ZN3KJS35streamLeftAssociativeBinaryOperatorERNS_12SourceStreamENS_10PrecedenceEPKcPKNS_4NodeES7_
-__ZNK3KJS17ReadModifyDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7AddNode10precedenceEv
-__ZNK3KJS7AddNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15ConditionalNode10precedenceEv
-__ZNK3KJS15ConditionalNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10RegExpNode10precedenceEv
-__ZNK3KJS10RegExpNode8streamToERNS_12SourceStreamE
-__ZNK3KJS21ReadModifyResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7TryNode8streamToERNS_12SourceStreamE
-__ZNK3KJS11NewExprNode10precedenceEv
-__ZNK3KJS11NewExprNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10NumberNode10precedenceEv
-__ZNK3KJS10NumberNode8streamToERNS_12SourceStreamE
-__ZN3KJS12SourceStreamlsEd
-__ZNK3KJS13LogicalOrNode10precedenceEv
-__ZNK3KJS13LogicalOrNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8NullNode10precedenceEv
-__ZNK3KJS8NullNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14LogicalAndNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14LogicalAndNode10precedenceEv
-__ZNK3KJS14LogicalNotNode10precedenceEv
-__ZN3KJS7UString17expandPreCapacityEi
-__ZN3KJS19BracketAccessorNode17evaluateToBooleanEPNS_9ExecStateE
-__ZNK3KJS11GreaterNode10precedenceEv
-__ZNK3KJS11GreaterNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17ObjectLiteralNode10precedenceEv
-__ZNK3KJS17ObjectLiteralNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16PropertyListNode8streamToERNS_12SourceStreamE
-__ZNK3KJS12PropertyNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8LessNode10precedenceEv
-__ZNK3KJS8LessNode8streamToERNS_12SourceStreamE
-__ZNK3KJS19BracketAccessorNode10precedenceEv
-__ZNK3KJS19BracketAccessorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15TypeOfValueNode10precedenceEv
-__ZNK3KJS15TypeOfValueNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7ForNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9CommaNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignResolveNode10precedenceEv
-__ZNK3KJS23FunctionCallResolveNode10precedenceEv
-__ZNK3KJS12FuncExprNode10precedenceEv
-__ZNK3KJS12FuncExprNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13ParameterNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9ForInNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10ReturnNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13GreaterEqNode10precedenceEv
-__ZNK3KJS13GreaterEqNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8TrueNode10precedenceEv
-__ZNK3KJS8TrueNode8streamToERNS_12SourceStreamE
-__ZNK3KJS21FunctionCallValueNode8streamToERNS_12SourceStreamE
-__ZN3KJS11ElementNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS8MultNode10precedenceEv
-__ZNK3KJS8MultNode8streamToERNS_12SourceStreamE
-__ZN3KJS21functionProtoFuncCallEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS4List8getSliceEiRS0_
-__ZN3KJS10IfElseNode7executeEPNS_9ExecStateE
-__ZN3KJS6InNode17evaluateToBooleanEPNS_9ExecStateE
-__ZNK3KJS12NotEqualNode10precedenceEv
-__ZNK3KJS12NotEqualNode8streamToERNS_12SourceStreamE
-__ZN3KJS17AssignResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13DeleteDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS12ContinueNode7executeEPNS_9ExecStateE
-__ZN3KJS13DeleteDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11FunctionImp14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3KJS11PropertyMap3getERKNS_10IdentifierERj
-__ZN3KJS11GreaterNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13PrefixDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13PreIncDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZNK3KJS8JSObject8toStringEPNS_9ExecStateE
-__ZNK3KJS8JSObject11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZNK3KJS8JSObject12defaultValueEPNS_9ExecStateENS_6JSTypeE
-__ZN3KJS22arrayProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E3addIPN3KJS16RuntimeObjectImpESB_NS_17HashSetTranslatorILb1ESB_NS5_ISB_EES6_NS_7PtrHashISB_EEEEEESt4pairINS_17HashTableIteratorIiiS2_S4_S6_S6_EEbERKT_RKT0_
-__ZN3KJS11JSImmediate8toStringEPKNS_7JSValueE
-__ZN3KJS12NotEqualNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS21arrayProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14ErrorObjectImp19implementsConstructEv
-__ZN3KJS14ErrorObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9Collector7collectEv
-__ZN3KJS9Collector31markCurrentThreadConservativelyEv
-__ZN3KJS9Collector30markStackObjectsConservativelyEPvS1_
-__ZN3KJS6JSCell4markEv
-__ZN3KJS8JSObject4markEv
-__ZNK3KJS11PropertyMap4markEv
-__ZN3KJS11FunctionImp4markEv
-__ZN3KJS14JSGlobalObject4markEv
-__ZN3KJS16JSVariableObject4markEv
-__ZN3KJS13ArrayInstance4markEv
-__ZN3KJS15JSWrapperObject4markEv
-__ZN3KJS13ActivationImp4markEv
-__ZN3KJS13ActivationImp12markChildrenEv
-__ZN3KJS14NativeErrorImp4markEv
-__ZN3KJS9Arguments4markEv
-__ZN3KJS9Collector20markProtectedObjectsEv
-__ZN3KJS9Collector5sweepILNS0_8HeapTypeE0EEEmb
-__ZN3KJS11PropertyMapD1Ev
-__ZN3KJS11FunctionImpD0Ev
-__ZN3KJS9StringImpD0Ev
-__ZN3KJS9RegExpImpD0Ev
-__ZN3KJS13ArrayInstanceD0Ev
-__ZN3KJS9ArgumentsD0Ev
-__ZN3KJS9Collector5sweepILNS0_8HeapTypeE1EEEmb
-__ZN3KJS14AddStringsNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17AddStringLeftNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9StringImp11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZN3KJS7AddNode8evaluateEPNS_9ExecStateE
-__ZN3KJS21stringProtoFuncCharAtEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26stringProtoFuncToUpperCaseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24stringProtoFuncSubstringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26stringProtoFuncToLowerCaseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7UString8toUInt32EPb
-__ZN3KJS22ReadModifyLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19PostIncLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17PreDecResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PreDecLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8MultNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS9NumberImp4typeEv
-__ZN3KJS20dateProtoFuncSetTimeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7SubNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS9StringImp8toNumberEPNS_9ExecStateE
-__ZN3KJS18globalFuncParseIntEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7JSValue15toInt32SlowCaseEPNS_9ExecStateERb
-__ZN3KJS24dateProtoFuncToGMTStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10formatTimeERKNS_17GregorianDateTimeEb
-__ZNK3KJS15RegExpObjectImp19implementsConstructEv
-__ZN3KJS15RegExpObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS19regExpProtoFuncExecEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14StringInstance18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3KJS35stringInstanceNumericPropertyGetterEPNS_9ExecStateEPNS_8JSObjectEjRKNS_12PropertySlotE
-__ZN3KJS23FunctionCallResolveNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15globalFuncIsNaNEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS20dateProtoFuncSetYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21gregorianDateTimeToMSERKNS_17GregorianDateTimeEdb
-__ZN3KJS15dateToDayInYearEiii
-__ZN3KJS21ReadModifyBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZNK3KJS15ObjectObjectImp19implementsConstructEv
-__ZN3KJS21ReadModifyBracketNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9ExecState12hadExceptionEv
-__ZNK3KJS7JSValue8toObjectEPNS_9ExecStateE
-__ZNK3KJS7JSValue8toStringEPNS_9ExecStateE
-__ZN3KJS7UStringD1Ev
-__ZN3KJS8JSObject15getPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZNK3KJS12PropertySlot8getValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierE
-__ZNK3WTF6RefPtrIN3KJS14ExpressionNodeEE3getEv
-__ZN3KJS3addEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS10IdentifierD1Ev
-__ZNK3KJS8JSObject3getEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS20arrayProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14ExpressionNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS9BreakNode7executeEPNS_9ExecStateE
-__ZN3KJS18arrayProtoFuncJoinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11JSImmediate8toObjectEPKNS_7JSValueEPNS_9ExecStateE
-__ZN3KJS10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZN3KJS5Error6createEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringEiiS6_
-__ZN3KJS14NativeErrorImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZNK3KJS6JSCell17getTruncatedInt32ERi
-__ZN3KJS15StringObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9Collector15recordExtraCostEm
-__ZN3KJS22objectProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS8JSObject9classNameEv
-__ZN3KJS14PostDecDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9CommaNodeD1Ev
-__ZN3KJS28globalFuncDecodeURIComponentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6decodeEPNS_9ExecStateERKNS_4ListEPKcb
-__ZN3KJS19BracketAccessorNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS15TypeOfValueNodeD1Ev
-__ZN3KJS17PrototypeFunctionD0Ev
-__ZN3KJS13ErrorInstanceD0Ev
-__ZN3KJS18mathProtoFuncRoundEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23FunctionCallResolveNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS13GreaterEqNodeD1Ev
-__ZN3KJS7ModNodeD1Ev
-__ZN3KJS24LocalVarFunctionCallNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS4List15expandAndAppendEPNS_7JSValueE
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE15reserveCapacityEm
-__ZN3KJS10SwitchNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13CaseBlockNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14ClauseListNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14CaseClauseNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10SwitchNode7executeEPNS_9ExecStateE
-__ZN3KJS13CaseBlockNode12executeBlockEPNS_9ExecStateEPNS_7JSValueE
-__ZN3KJS18NotStrictEqualNode17evaluateToBooleanEPNS_9ExecStateE
-__Z23_NPN_CreateScriptObjectP4_NPPPN3KJS8JSObjectEN3WTF10PassRefPtrINS1_8Bindings10RootObjectEEE
-__NPN_CreateObject
-__Z10jsAllocateP4_NPPP7NPClass
-__NPN_RetainObject
-__NPN_Evaluate
-__ZNK3KJS8Bindings10RootObject12globalObjectEv
-__ZN3KJS8Bindings22convertNPStringToUTF16EPK9_NPStringPPtPj
-__ZN3KJS8Bindings36convertUTF8ToUTF16WithLatin1FallbackEPKciPPtPj
-__ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_b
-__ZN3KJS11Interpreter8evaluateEPNS_9ExecStateERKNS_7UStringEiS5_PNS_7JSValueE
-__ZN3KJS8Bindings23convertValueToNPVariantEPNS_9ExecStateEPNS_7JSValueEP10_NPVariant
-__ZN3KJS11JSImmediate4typeEPKNS_7JSValueE
-__NPN_GetStringIdentifier
-__ZN3KJS8Bindings26identifierFromNPIdentifierEPKc
-__NPN_Invoke
-__ZN3KJS8Bindings14findRootObjectEPNS_14JSGlobalObjectE
-__NPN_ReleaseVariantValue
-__ZNK3KJS7UString10UTF8StringEb
+__ZN3JSC10JSFunction18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC10JSFunction11getCallDataERNS_8CallDataE
+__ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
+__ZN3JSC11Interpreter7executeEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_10JSFunctionEPNS_8JSObjectERKNS_7ArgListEPNS_14ScopeCha
+__ZNK3JSC15DotAccessorNode10isLocationEv
+__ZNK3JSC14ExpressionNode13isResolveNodeEv
+__ZNK3JSC14ExpressionNode21isBracketAccessorNodeEv
+__ZN3JSC19FunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC19FunctionCallDotNodeD0Ev
+__ZL26appendToVarDeclarationListPvRPN3JSC15ParserArenaDataIN3WTF6VectorISt4pairINS0_10IdentifierEjELm0EEEEERKS5_j
+__ZN3WTF6VectorISt4pairIN3JSC10IdentifierEjELm0EE14expandCapacityEm
+__ZL14makeAssignNodePvPN3JSC14ExpressionNodeENS0_8OperatorES2_bbiii
+__ZL11makeAddNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC16VarStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17AssignResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11UnaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10RegExpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringES5_
+__ZN3JSC4Yarr15jitCompileRegexEPNS_12JSGlobalDataERNS0_14RegexCodeBlockERKNS_7UStringERjRPKcbb
+__ZN3JSC4Yarr12compileRegexERKNS_7UStringERNS0_12RegexPatternE
+__ZN3JSC4Yarr18PatternDisjunction17addNewAlternativeEv
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternAlternativeELm0EE14expandCapacityEm
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseTokensEv
+__ZN3WTF6VectorIN3JSC4Yarr11PatternTermELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN3JSC4Yarr11PatternTermELm0EE14expandCapacityEm
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseEscapeILb0ES2_EEbRT0_
+__ZN3JSC4Yarr23RegexPatternConstructor25atomBuiltInCharacterClassENS0_23BuiltInCharacterClassIDEb
+__ZN3JSC4Yarr14wordcharCreateEv
+__ZN3WTF6VectorItLm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC4Yarr14CharacterClassELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN3JSC4Yarr14CharacterClassELm0EE14expandCapacityEm
+__ZN3JSC4Yarr14RegexGenerator19generateDisjunctionEPNS0_18PatternDisjunctionE
+__ZN3JSC12X86Assembler7addl_irEiNS_3X8610RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common8branch32ENS0_9ConditionENS_3X8610RegisterIDES3_
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6appendENS2_4JumpE
+__ZN3JSC4Yarr14RegexGenerator12generateTermERNS1_19TermGenerationStateE
+__ZN3JSC23MacroAssemblerX86Common8branch32ENS0_9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5I
+__ZN3JSC4Yarr14RegexGenerator19TermGenerationState15jumpToBacktrackENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPNS_14
+__ZN3JSC4Yarr14RegexGenerator13readCharacterEiNS_3X8610RegisterIDE
+__ZN3JSC4Yarr14RegexGenerator19matchCharacterClassENS_3X8610RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpLis
+__ZN3JSC4Yarr14RegexGenerator24matchCharacterClassRangeENS_3X8610RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8Ju
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList4linkEPS2_
+__ZN3JSC23MacroAssemblerX86Common4jumpEv
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm16EED1Ev
+__ZN3JSC4Yarr14RegexGenerator28generateCharacterClassGreedyERNS1_19TermGenerationStateE
+__ZN3JSC12X86Assembler7subl_irEiNS_3X8610RegisterIDE
+__ZN3JSC15AssemblerBuffer4growEv
+__ZN3WTF15deleteAllValuesIPN3JSC4Yarr14CharacterClassELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC17BytecodeGenerator13emitNewRegExpEPNS_10RegisterIDEPNS_6RegExpE
+__ZN3JSC15ConditionalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9EqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode6isNullEv
+__ZNK3JSC10StringNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC19BracketAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC10NumberNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC10NumberNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDEd
+__ZN3JSC17BytecodeGenerator12emitGetByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC17BytecodeGenerator14emitEqualityOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_
+__ZN3JSC19ReverseBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode5isAddEv
+__ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
+__ZN3JSC13AssignDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitPutByIdEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC17AssignResolveNodeD0Ev
+__ZN3JSC15ParserArenaDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEED0Ev
+__ZN3JSC16VarStatementNodeD0Ev
+__ZN3JSC14LogicalNotNodeD0Ev
+__ZN3JSC10RegExpNodeD0Ev
+__ZN3JSC10NumberNodeD0Ev
+__ZN3JSC19BracketAccessorNodeD0Ev
+__ZN3JSC9EqualNodeD0Ev
+__ZN3JSC15ConditionalNodeD0Ev
+__ZN3JSC7AddNodeD0Ev
+__ZN3JSC13GreaterEqNodeD0Ev
+__ZN3JSC13AssignDotNodeD0Ev
+__ZN3JSC3JIT13emit_op_jtrueEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_new_regexpEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_get_by_valEPNS_11InstructionE
+__ZN3JSC3JIT10emit_op_eqEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_addEPNS_11InstructionE
+__ZN3JSC11JITStubCall11addArgumentEjNS_3X8610RegisterIDE
+__ZN3JSC3JIT16emit_op_jnlesseqEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_put_by_idEPNS_11InstructionE
+__ZN3JSC3JIT21compilePutByIdHotPathEiPNS_10IdentifierEij
+__ZN3JSC3JIT17emitSlow_op_jtrueEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22emitSlow_op_get_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT14emitSlow_op_eqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT20emitSlow_op_jnlesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC20MacroAssemblerX86_6413branchTestPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDES4_
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common12branchDoubleENS0_15DoubleConditionENS_3X8613XMMRegisterIDES3_
+__ZN3JSC3JIT21emitSlow_op_put_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22compilePutByIdSlowCaseEiPNS_10IdentifierEiRPNS_13SlowCaseEntryEj
+__ZN3JSC13LogicalOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF6VectorIN3JSC17GlobalResolveInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator14emitJumpIfTrueEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC13LogicalOpNodeD0Ev
+__ZN3JSC3JIT22emit_op_resolve_globalEPNS_11InstructionE
+__ZN3JSC8JITStubs21cti_op_resolve_globalEPPv
+__ZNK3JSC8JSString9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC15StringPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20stringProtoFuncMatchEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSString12toThisStringEPNS_9ExecStateE
+__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
+__ZNK3JSC6JSCell9classInfoEv
+__ZN3JSC4Yarr23RegexPatternConstructor20atomPatternCharacterEt
+__ZN3JSC4Yarr25CharacterClassConstructor7putCharEt
+__ZN3JSC4Yarr25CharacterClassConstructor9addSortedERN3WTF6VectorItLm0EEEt
+__ZN3JSC4Yarr23RegexPatternConstructor21atomCharacterClassEndEv
+__ZN3JSC4Yarr23RegexPatternConstructor23setupDisjunctionOffsetsEPNS0_18PatternDisjunctionEjj
+__ZN3JSC4Yarr14RegexGenerator25generateParenthesesSingleERNS1_19TermGenerationStateE
+__ZN3JSC4Yarr14RegexGenerator30generateParenthesesDisjunctionERNS0_11PatternTermERNS1_19TermGenerationStateEj
+__ZN3WTF6VectorIN3JSC4Yarr14RegexGenerator26AlternativeBacktrackRecordELm0EE14expandCapacityEm
+__ZN3JSC4Yarr14RegexGenerator19jumpIfCharNotEqualsEti
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDES4_ii
+__ZN3JSC4Yarr14RegexGenerator19TermGenerationState15jumpToBacktrackERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEP
+__ZN3JSC17RegExpConstructor12performMatchEPNS_6RegExpERKNS_7UStringEiRiS6_PPi
+__ZN3JSC6RegExp5matchERKNS_7UStringEiPN3WTF11OwnArrayPtrIiEE
+__ZN3JSC4Yarr12executeRegexERNS0_14RegexCodeBlockEPKtjjPii
+__ZN3JSC8JITStubs17cti_op_new_regexpEPPv
+__ZN3JSC12RegExpObjectC1EN3WTF10PassRefPtrINS_9StructureEEENS2_INS_6RegExpEEE
+__ZNK3JSC12RegExpObject9classInfoEv
+__ZN3JSC18RegExpMatchesArrayC2EPNS_9ExecStateEPNS_24RegExpConstructorPrivateE
+__ZN3JSC8JITStubs17cti_op_get_by_valEPPv
+__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray17fillArrayInstanceEPNS_9ExecStateE
+__ZN3JSC11jsSubstringEPNS_12JSGlobalDataERKNS_7UStringEjj
+__ZN3JSC7JSArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JITStubs9cti_op_eqEPPv
+__ZN3JSCeqERKNS_7UStringES2_
+__ZN3JSC8JITStubs10cti_op_addEPPv
+__ZN3JSC11concatenateEPNS_7UString3RepES2_
+__ZN3JSCL22stringProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString4findERKS0_i
+__ZN3JSC8JITStubs16cti_op_put_by_idEPPv
+__ZNK3JSC7UString8toUInt32EPbb
+__ZNK3JSC7UString8toDoubleEbb
+__ZNK3JSC7UString10getCStringERN3WTF6VectorIcLm32EEE
+__ZN3WTF14FastMallocZone11forceUnlockEP14_malloc_zone_t
+__Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
+__ZL30calculateCompiledPatternLengthPKti24JSRegExpIgnoreCaseOptionR11CompileDataR9ErrorCode
+__ZL11checkEscapePPKtS0_P9ErrorCodeib
+__ZL13compileBranchiPiPPhPPKtS3_P9ErrorCodeS_S_R11CompileData
+__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
+__ZL5matchPKtPKhiR9MatchData
+__ZNK3JSC7UString14toStrictUInt32EPb
+__ZN3JSC17ObjectLiteralNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16PropertyListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7TryNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator9emitCatchEPNS_10RegisterIDEPNS_5LabelES4_
+__ZN3WTF6VectorIN3JSC11HandlerInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator16emitPushNewScopeEPNS_10RegisterIDERNS_10IdentifierES2_
+__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0EE14expandCapacityEm
+__ZNK3JSC14ExpressionNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC12PropertyNodeD0Ev
+__ZN3JSC16PropertyListNodeD0Ev
+__ZN3JSC17ObjectLiteralNodeD0Ev
+__ZN3JSC7TryNodeD0Ev
+__ZN3JSC3JIT18emit_op_new_objectEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_catchEPNS_11InstructionE
+__ZN3JSC3JIT22emit_op_push_new_scopeEPNS_11InstructionE
+__ZN3JSC3JIT15emit_op_resolveEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_pop_scopeEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_new_objectEPPv
+__ZN3JSC20constructEmptyObjectEPNS_9ExecStateE
+__ZN3JSC17StructureStubInfo5derefEv
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEES5_NS_17IdentityExtractorIS5_EENS2_17IdentifierRepHashENS_10HashTraitsIS5_EES
+__ZN3JSC8ThisNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ThrowableBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8ThisNodeD0Ev
+__ZN3JSC6InNodeD0Ev
+__ZN3JSC3JIT29emit_op_enter_with_activationEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_convert_thisEPNS_11InstructionE
+__ZN3JSC3JIT27emit_op_tear_off_activationEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_convert_thisEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs22cti_op_push_activationEPPv
+__ZN3JSC12JSActivationC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_16FunctionBodyNodeEEE
+__ZN3JSC12JSActivationC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_16FunctionBodyNodeEEE
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseEscapeILb1ENS3_28CharacterClassParserDelegateEEEbRT0_
+__ZN3JSC4Yarr12digitsCreateEv
+__ZN3JSC4Yarr25CharacterClassConstructor6appendEPKNS0_14CharacterClassE
+__ZN3JSC4Yarr25CharacterClassConstructor14addSortedRangeERN3WTF6VectorINS0_14CharacterRangeELm0EEEtt
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE28CharacterClassParserDelegate20atomPatternCharacterEt
+__ZN3JSC11GreaterNodeD0Ev
+__ZN3JSCL26stringProtoFuncToLowerCaseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSString14toThisJSStringEPNS_9ExecStateE
+__ZN3JSC7UStringC2EPtib
+__ZN3JSC18globalFuncParseIntEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11JSImmediate12nonInlineNaNEv
+__ZN3JSC8JITStubs11cti_op_lessEPPv
+__ZN3JSC8JITStubs9cti_op_inEPPv
+__ZNK3JSC6JSCell9getUInt32ERj
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZL14makePrefixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
+__ZN3JSC7ForNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13newLabelScopeENS_10LabelScope4TypeEPKNS_10IdentifierE
+__ZN3JSC12ContinueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14continueTargetERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator14emitJumpScopesEPNS_5LabelEi
+__ZN3JSC17PrefixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ReadModifyResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11NewExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitConstructEPNS_10RegisterIDES2_PNS_13ArgumentsNodeEjjj
+__ZN3WTF6VectorIN3JSC20GetByIdExceptionInfoELm0EE14expandCapacityEm
+__ZN3JSC8LessNodeD0Ev
+__ZN3JSC17PrefixResolveNodeD0Ev
+__ZN3JSC12ContinueNodeD0Ev
+__ZN3JSC7ForNodeD0Ev
+__ZN3JSC21ReadModifyResolveNodeD0Ev
+__ZN3JSC11NewExprNodeD0Ev
+__ZN3JSC3JIT11emit_op_notEPNS_11InstructionE
+__ZN3JSC3JIT15emit_op_pre_incEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_loop_if_lessEPNS_11InstructionE
+__ZN3JSC3JIT16emitTimeoutCheckEv
+__ZN3JSC3JIT20compileBinaryArithOpENS_8OpcodeIDEjjjNS_12OperandTypesE
+__ZN3JSC3JIT11emit_op_subEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_constructEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_construct_verifyEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_notEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT19emitSlow_op_pre_incEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT24emitSlow_op_loop_if_lessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_addEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT28compileBinaryArithOpSlowCaseENS_8OpcodeIDERPNS_13SlowCaseEntryEjjjNS_12OperandTypesE
+__ZN3JSC15AssemblerBuffer7putByteEi
+__ZN3JSC12X86Assembler23X86InstructionFormatter11twoByteOp64ENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC3JIT15emitSlow_op_subEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_constructEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT27compileOpConstructSetupArgsEPNS_11InstructionE
+__ZN3JSC3JIT28emitSlow_op_construct_verifyEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC7UString4fromEj
+__ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPNS_7UString3RepE
+__ZN3JSC8JITStubs10cti_op_notEPPv
+__ZN3JSC8JITStubs24cti_op_get_by_id_genericEPPv
+__ZN3JSC7JSArrayC2EN3WTF10PassRefPtrINS_9StructureEEERKNS_7ArgListE
+__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL24stringProtoFuncSubstringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs31cti_op_construct_NotJSConstructEPPv
+__ZN3JSC3JIT33privateCompilePatchGetArrayLengthENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_listEPPv
+__ZN3JSC3JIT30privateCompileGetByIdProtoListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureES6_mP
+__ZN3JSC3JIT16patchGetByIdSelfEPNS_17StructureStubInfoEPNS_9StructureEmNS_22AbstractMacroAssemblerINS_12X86AssemblerEE22Process
+__ZN3JSC14StructureChainC1EPNS_9StructureE
+__ZN3JSC14StructureChainC2EPNS_9StructureE
+__ZN3JSC3JIT26privateCompileGetByIdChainEPNS_17StructureStubInfoEPNS_9StructureEPNS_14StructureChainEmmNS_22AbstractMacroAssemb
+__ZN3JSC8JITStubs23cti_op_put_by_id_secondEPPv
+__ZN3JSC8JITStubs15tryCachePutByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_7JSValueERKNS_15PutPropertySlotE
+__ZN3JSC8JITStubs24cti_op_put_by_id_genericEPPv
+__ZN3JSC8JITStubs26cti_op_tear_off_activationEPPv
+__ZN3JSC8JITStubs21cti_op_ret_scopeChainEPPv
+__ZN3JSC17BytecodeGenerator16emitPutScopedVarEmiPNS_10RegisterIDENS_7JSValueE
+__ZN3JSC3JIT22emit_op_get_scoped_varEPNS_11InstructionE
+__ZN3JSC3JIT22emit_op_put_scoped_varEPNS_11InstructionE
+__ZN3JSC3JIT29emitPutVariableObjectRegisterENS_3X8610RegisterIDES2_i
+__ZN3JSC12X86Assembler7movq_rrENS_3X8610RegisterIDENS1_13XMMRegisterIDE
+__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
+__ZN3WTF20TCMalloc_ThreadCache11DeleteCacheEPS0_
+__ZN3JSC15StrictEqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15StrictEqualNodeD0Ev
+__ZN3JSC3JIT16emit_op_stricteqEPNS_11InstructionE
+__ZN3JSC3JIT17compileOpStrictEqEPNS_11InstructionENS0_21CompileOpStrictEqTypeE
+__ZN3JSC3JIT20emitSlow_op_stricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs15cti_op_stricteqEPPv
+__ZN3WTF12detachThreadEj
+__ZN3WTFL26pthreadHandleForIdentifierEj
+__ZN3WTFL31clearPthreadHandleForIdentifierEj
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE15reserveCapacityEm
+__ZN3JSC8NullNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8NullNodeD0Ev
+__ZN3WTF7HashMapISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjEPNS3_9StructureENS3_28StructureTransitionTableHashENS3_34StructureTra
+__ZN3WTF9HashTableISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjES1_IS7_PNS3_9StructureEENS_18PairFirstExtractorISA_EENS3_28Structur
+__ZN3JSC9Structure22materializePropertyMapEv
+__ZN3JSC15TypeOfValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15TypeOfValueNodeD0Ev
+__ZN3JSC12NotEqualNodeD0Ev
+__ZN3JSC3JIT11emit_op_neqEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_neqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_typeofEPPv
+__ZN3JSC20jsTypeStringForValueEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC8JITStubs10cti_op_neqEPPv
+__ZN3JSC14ExecutablePool13systemReleaseERKNS0_10AllocationE
+__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
+__ZNK3JSC10NumberNode8isNumberEv
+__ZNK3JSC14ExpressionNode10isLocationEv
+__ZN3WTF6VectorIPN3JSC10RegisterIDELm32EE14expandCapacityEm
+__ZNK3JSC11BooleanNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC4Yarr13newlineCreateEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter15emitRexIfNeededEiii
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDES3_ii
+__ZN3JSC17TypeOfResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitResolveBaseEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator20emitLoadGlobalObjectEPNS_10RegisterIDEPNS_8JSObjectE
+__ZN3WTF6VectorIN3JSC7JSValueELm0EE14expandCapacityEm
+__ZNK3JSC7AddNode5isAddEv
+__ZN3JSC12BinaryOpNode10emitStrcatERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_PNS_21ReadModifyResolveNodeE
+__ZNK3JSC10StringNode8isStringEv
+__ZNK3JSC14ExpressionNode8isStringEv
+__ZN3JSC17BytecodeGenerator10emitStrcatEPNS_10RegisterIDES2_i
+__ZN3JSC4Yarr12spacesCreateEv
+__ZN3JSC4Yarr15nonspacesCreateEv
+__ZN3JSC8WithNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitPushScopeEPNS_10RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_3X8610RegisterIDE
+__ZN3JSC14MacroAssembler4peekENS_3X8610RegisterIDEi
+__ZN3JSC4Yarr14RegexGenerator12atEndOfInputEv
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6linkToENS2_5LabelEPS2_
+__ZN3JSC14MacroAssembler4pokeENS_3X8610RegisterIDEi
+__ZN3JSC21FunctionCallValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9ArrayNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitNewArrayEPNS_10RegisterIDEPNS_11ElementNodeE
+__ZN3JSC23CallFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitJumpIfNotFunctionCallEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC4Yarr14RegexGenerator29generateAssertionWordBoundaryERNS1_19TermGenerationStateE
+__ZN3JSC4Yarr14RegexGenerator22matchAssertionWordcharERNS1_19TermGenerationStateERNS_22AbstractMacroAssemblerINS_12X86Assembler
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternDisjunctionELm4EE14expandCapacityEm
+__ZL14compileBracketiPiPPhPPKtS3_P9ErrorCodeiS_S_R11CompileData
+__ZN3JSC9ThrowNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9CommaNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF9HashTableIdSt4pairIdN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_9FloatHashIdEENS_14PairHashTraitsINS_10HashTraitsId
+__ZN3JSC17TypeOfResolveNodeD0Ev
+__ZN3JSC18NotStrictEqualNodeD0Ev
+__ZN3JSC8WithNodeD0Ev
+__ZN3JSC21FunctionCallValueNodeD0Ev
+__ZN3JSC9ArrayNodeD0Ev
+__ZN3JSC11ElementNodeD0Ev
+__ZN3JSC23CallFunctionCallDotNodeD0Ev
+__ZN3JSC9ThrowNodeD0Ev
+__ZN3JSC9CommaNodeD0Ev
+__ZN3JSC3JIT23emit_op_unexpected_loadEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_to_primitiveEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_strcatEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_nstricteqEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_push_scopeEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_new_arrayEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_jneq_ptrEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_throwEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_jnlessEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_to_primitiveEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_nstricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_jnlessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZL15makePostfixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
+__ZN3JSC18PostfixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC18PostfixResolveNodeD0Ev
+__ZN3JSC8JITStubs22cti_op_call_arityCheckEPPv
+__ZN3JSC19FunctionConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL32constructWithFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
+__ZN3JSCplERKNS_7UStringES2_
+__ZN3JSC7UString6appendERKS0_
+__ZN3JSC7UString17expandPreCapacityEi
+__ZN3WTF11fastReallocILb0EEEPvS1_m
+__ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZL11makeDivNodePvPN3JSC14ExpressionNodeES2_b
+__ZL12makeMultNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC9WhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7ModNodeD0Ev
+__ZN3JSC7DivNodeD0Ev
+__ZN3JSC8MultNodeD0Ev
+__ZN3JSC9WhileNodeD0Ev
+__ZN3JSC3JIT11emit_op_modEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_mulEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_loop_if_trueEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_modEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_mulEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT24emitSlow_op_loop_if_trueEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSCL26stringProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7JSValue20toIntegerPreserveNaNEPNS_9ExecStateE
+__ZN3JSC8JITStubs10cti_op_divEPPv
+__ZN3JSC3JIT22emit_op_loop_if_lesseqEPNS_11InstructionE
+__ZN3JSC3JIT26emitSlow_op_loop_if_lesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_lesseqEPPv
+__ZN3JSCL20stringProtoFuncSplitEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19constructEmptyArrayEPNS_9ExecStateE
+__ZN3JSC7JSArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC7JSArray11putSlowCaseEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC14ArrayPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL18arrayProtoFuncJoinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF7HashSetIPN3JSC8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC8JSObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF6VectorItLm256EE6appendItEEvPKT_m
+__ZN3WTF6VectorItLm256EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE15reserveCapacityEm
+__ZN3JSC4Heap7collectEv
+__ZN3JSC4Heap30markStackObjectsConservativelyEv
+__ZN3JSC4Heap31markCurrentThreadConservativelyEv
+__ZN3JSC4Heap39markCurrentThreadConservativelyInternalEv
+__ZN3JSC4Heap18markConservativelyEPvS1_
+__ZN3JSC7JSArray4markEv
+__ZN3JSC8JSObject4markEv
+__ZN3JSC10JSFunction4markEv
+__ZN3JSC6JSCell4markEv
+__ZN3JSC14JSGlobalObject4markEv
+__ZN3JSC15JSWrapperObject4markEv
+__ZN3JSC18GlobalEvalFunction4markEv
+__ZN3JSC16FunctionBodyNode4markEv
+__ZN3JSC9CodeBlock4markEv
+__ZN3JSC4Heap20markProtectedObjectsEv
+__ZN3JSC12SmallStrings4markEv
+__ZN3JSC4Heap5sweepILNS_8HeapTypeE0EEEmv
+__ZN3JSC14JSGlobalObjectD2Ev
+__ZN3JSC17FunctionPrototypeD1Ev
+__ZN3JSC15ObjectPrototypeD1Ev
+__ZN3JSC14ArrayPrototypeD1Ev
+__ZN3JSC15StringPrototypeD1Ev
+__ZN3JSC16BooleanPrototypeD1Ev
+__ZN3JSC15NumberPrototypeD1Ev
+__ZN3JSC13DatePrototypeD1Ev
+__ZN3JSC12DateInstanceD2Ev
+__ZN3JSC15RegExpPrototypeD1Ev
+__ZN3JSC14ErrorPrototypeD1Ev
+__ZN3JSC20NativeErrorPrototypeD1Ev
+__ZN3JSC17ObjectConstructorD1Ev
+__ZN3JSC19FunctionConstructorD1Ev
+__ZN3JSC16ArrayConstructorD1Ev
+__ZN3JSC17StringConstructorD1Ev
+__ZN3JSC18BooleanConstructorD1Ev
+__ZN3JSC17NumberConstructorD1Ev
+__ZN3JSC15DateConstructorD1Ev
+__ZN3JSC17RegExpConstructorD1Ev
+__ZN3JSC16ErrorConstructorD1Ev
+__ZN3JSC22NativeErrorConstructorD1Ev
+__ZN3JSC10MathObjectD1Ev
+__ZN3JSC18GlobalEvalFunctionD1Ev
+__ZN3JSC8JSObjectD1Ev
+__ZN3JSC9CodeBlock13unlinkCallersEv
+__ZN3WTF6VectorINS_6RefPtrIN3JSC6RegExpEEELm0EE6shrinkEm
+__ZN3JSC12JSActivationD1Ev
+__ZN3JSC12JSActivationD2Ev
+__ZN3JSC12RegExpObjectD1Ev
+__ZN3JSC18RegExpMatchesArrayD1Ev
+__ZN3JSC4Heap5sweepILNS_8HeapTypeE1EEEmv
+__ZN3JSC20globalFuncParseFloatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF17TCMalloc_PageHeap3NewEm
+__ZN3JSC8JITStubs28cti_op_construct_JSConstructEPPv
+__ZN3JSC8JSObject17createInheritorIDEv
+__ZNK3JSC19BracketAccessorNode10isLocationEv
+__ZNK3JSC19BracketAccessorNode21isBracketAccessorNodeEv
+__ZN3JSC17AssignBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitPutByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC14PostfixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17ReadModifyDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17AssignBracketNodeD0Ev
+__ZN3JSC14PostfixDotNodeD0Ev
+__ZN3JSC17ReadModifyDotNodeD0Ev
+__ZN3JSC3JIT18emit_op_put_by_valEPNS_11InstructionE
+__ZN3JSC3JIT22emitSlow_op_put_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC16ArrayConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL29constructWithArrayConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSCL27constructArrayWithSizeQuirkEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JITStubs23cti_op_put_by_val_arrayEPPv
+__ZN3JSC8JITStubs13cti_op_strcatEPPv
+__ZN3JSC7UString3Rep15reserveCapacityEi
+__ZN3JSC7UString13appendNumericEi
+__ZN3JSC11concatenateEPNS_7UString3RepEi
+__ZN3JSC12JSActivation18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL18stringFromCharCodeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC16globalFuncEscapeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26stringProtoFuncToUpperCaseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12JSActivation14isDynamicScopeEv
+__ZN3WTF6VectorINS_6RefPtrIN3JSC10RegisterIDEEELm16EE14expandCapacityEm
+__ZN3JSC17ObjectConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithObjectConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_put_by_valEPPv
+__ZN3JSC15DateConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL28constructWithDateConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC13constructDateEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JITStubs18cti_op_is_functionEPPv
+__ZN3JSC16jsIsFunctionTypeENS_7JSValueE
+__ZN3JSC10Identifier5equalEPKNS_7UString3RepEPKc
+__ZN3JSC11JSImmediate8toStringENS_7JSValueE
+__ZN3JSC7UString4fromEi
+__ZN3JSC7UString3Rep11computeHashEPKti
+__ZNK3JSC8NullNode6isNullEv
+__ZN3JSC9BreakNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11breakTargetERKNS_10IdentifierE
+__ZN3JSC9BreakNodeD0Ev
+__ZN3JSC3JIT15emit_op_eq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_is_undefinedEPPv
+__ZN3JSC12JSActivation4markEv
+__ZN3JSC12DateInstanceD1Ev
+__ZNK3JSC18EmptyStatementNode16isEmptyStatementEv
+__ZN3JSC18EmptyStatementNodeD0Ev
+__ZN3JSC3JIT15emit_op_pre_decEPNS_11InstructionE
+__ZN3JSC3JIT19emitSlow_op_pre_decEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF13tryFastMallocEm
+__ZN3JSC8JITStubs17cti_timeout_checkEPPv
+__ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
+__ZN3JSC8JITStubs14cti_op_pre_decEPPv
+__ZN3JSC13jsAddSlowCaseEPNS_9ExecStateENS_7JSValueES2_
+__ZNK3JSC8JSString11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSCL22objectProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25functionProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC10JSFunction9classInfoEv
+__ZNK3JSC21UStringSourceProvider8getRangeEii
+__ZNK3JSC7UString6substrEii
+__ZN3JSC8JITStubs26cti_op_get_by_id_self_failEPPv
+__ZN3JSC3JIT29privateCompileGetByIdSelfListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEm
+__ZN3JSC8JITStubs16cti_op_nstricteqEPPv
+__ZN3JSC9ForInNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator20emitNextPropertyNameEPNS_10RegisterIDES2_PNS_5LabelE
+__ZN3JSC9ForInNodeD0Ev
+__ZN3JSC3JIT18emit_op_next_pnameEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_get_pnamesEPPv
+__ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9Structure26getEnumerablePropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayEPNS_8JSObjectE
+__ZN3JSC9Structure35getEnumerableNamesFromPropertyTableERNS_17PropertyNameArrayE
+__ZN3JSC8JITStubs17cti_op_next_pnameEPPv
+__ZN3JSC13jsOwnedStringEPNS_12JSGlobalDataERKNS_7UStringE
+__ZN3JSC22JSPropertyNameIterator10invalidateEv
+__ZN3JSC3JIT22emit_op_init_argumentsEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_create_argumentsEPNS_11InstructionE
+__ZN3JSC8JITStubs33cti_op_create_arguments_no_paramsEPPv
+__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC3JIT16emit_op_post_decEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_post_decEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs15cti_op_post_decEPPv
+__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC17RegExpConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC17RegExpConstructor3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC6JSCell11getCallDataERNS_8CallDataE
+__ZN3JSC10JSFunction3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs16cti_op_new_arrayEPPv
+__ZN3JSC14constructArrayEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL18arrayProtoFuncPushEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL30comparePropertyMapEntryIndicesEPKvS1_
+__ZN3WTF6VectorIN3JSC10IdentifierELm20EE15reserveCapacityEm
+__ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs17cti_op_push_scopeEPPv
+__ZN3JSC8JITStubs14cti_op_resolveEPPv
+__ZN3JSC8JITStubs16cti_op_pop_scopeEPPv
+__ZN3JSC3JIT31privateCompilePutByIdTransitionEPNS_17StructureStubInfoEPNS_9StructureES4_mPNS_14StructureChainENS_22AbstractMacr
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE
+__ZN3JSC3JIT19patchPutByIdReplaceEPNS_17StructureStubInfoEPNS_9StructureEmNS_22AbstractMacroAssemblerINS_12X86AssemblerEE22Proc
+__ZN3JSC17NumberConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC8JITStubs16cti_op_is_stringEPPv
+__ZN3JSC8JITStubs19cti_op_convert_thisEPPv
+__ZNK3JSC8JSString12toThisObjectEPNS_9ExecStateE
+__ZN3JSCL22stringProtoFuncReplaceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12StringObject14toThisJSStringEPNS_9ExecStateE
+__ZN3JSCL21arrayProtoFuncForEachEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11Interpreter20prepareForRepeatCallEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_10JSFunctionEiPNS_14ScopeChainNodeEPNS_7J
+__ZN3JSC3JIT16emit_op_post_incEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_post_incEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC11Interpreter7executeERNS_16CallFrameClosureEPNS_7JSValueE
+__ZN3JSC10MathObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC11Interpreter13endRepeatCallERNS_16CallFrameClosureE
+__ZN3JSCL21resizePropertyStorageEPNS_8JSObjectEii
+__ZN3JSC8JSObject23allocatePropertyStorageEmm
+__ZN3JSC14ExecutablePool12poolAllocateEm
+__ZN3JSC9Arguments4markEv
+__ZN3JSC22JSPropertyNameIterator4markEv
+__ZN3JSC3JIT10unlinkCallEPNS_12CallLinkInfoE
+__ZN3JSC22JSPropertyNameIteratorD1Ev
+__ZN3JSC9ArgumentsD1Ev
+__ZN3JSC9ArgumentsD2Ev
+__ZN3JSC12StringObjectD1Ev
+__ZN3WTF6VectorIPN3JSC9StructureELm8EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN3JSC9StructureELm8EE15reserveCapacityEm
+__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL11getPropertyEPNS_9ExecStateEPNS_8JSObjectEj
+__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC7JSArray9setLengthEj
+__ZN3JSC7UString6appendEPKc
+__ZN3JSC8JITStubs23cti_op_create_argumentsEPPv
+__ZN3JSCL19arrayProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7JSValue9toIntegerEPNS_9ExecStateE
+__ZN3JSC24ApplyFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode13isSimpleArrayEv
+__ZN3JSC17BytecodeGenerator26emitJumpIfNotFunctionApplyEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC17BytecodeGenerator15emitCallVarargsEPNS_10RegisterIDES2_S2_S2_jjj
+__ZN3JSC24ApplyFunctionCallDotNodeD0Ev
+__ZN3JSC3JIT20emit_op_load_varargsEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_call_varargsEPNS_11InstructionE
+__ZN3JSC3JIT20compileOpCallVarargsEPNS_11InstructionE
+__ZN3JSC3JIT29compileOpCallVarargsSetupArgsEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_call_varargsEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT28compileOpCallVarargsSlowCaseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs19cti_op_load_varargsEPPv
+__ZNK3JSC7JSArray9classInfoEv
+__ZN3JSC7JSArray15copyToRegistersEPNS_9ExecStateEPNS_8RegisterEj
+__ZNK3JSC7UString30spliceSubstringsWithSeparatorsEPKNS0_5RangeEiPKS0_i
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC7UString4fromEd
+__ZN3WTF4dtoaEPcdiPiS1_PS0_
+__ZN3JSC8JITStubs21cti_op_put_by_id_failEPPv
+__ZN3JSC13DeleteDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitDeleteByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC13DeleteDotNodeD0Ev
+__ZN3JSC3JIT17emit_op_del_by_idEPNS_11InstructionE
+__ZN3JSC8JITStubs16cti_op_del_by_idEPPv
+__ZN3JSC10JSFunction14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC7ArgList8getSliceEiRS0_
+__ZN3JSC3JIT26emit_op_tear_off_argumentsEPNS_11InstructionE
+__ZN3JSC8JITStubs25cti_op_tear_off_argumentsEPPv
+__ZNK3JSC12StringObject12toThisStringEPNS_9ExecStateE
+__ZN3JSC13PrefixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13PrefixDotNodeD0Ev
+__ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
+__ZN3JSCL22arrayProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21arrayProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC16ErrorConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL29constructWithErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC14constructErrorEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL21stringProtoFuncCharAtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs32cti_op_get_by_id_proto_list_fullEPPv
+__ZN3JSC14InstanceOfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitInstanceOfEPNS_10RegisterIDES2_S2_S2_
+__ZN3JSC14InstanceOfNodeD0Ev
+__ZN3JSC3JIT18emit_op_instanceofEPNS_11InstructionE
+__ZN3JSC3JIT22emitSlow_op_instanceofEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC12X86Assembler6orl_irEiNS_3X8610RegisterIDE
+__ZN3JSC17RegExpConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithRegExpConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC15constructRegExpEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC13DatePrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20dateProtoFuncGetTimeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12DateInstance9classInfoEv
+__ZN3JSC12RegExpObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL19regExpProtoFuncTestEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12RegExpObject5matchEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC3JIT18emit_op_jmp_scopesEPNS_11InstructionE
+__ZN3JSC3JIT30privateCompileGetByIdChainListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEPNS_1
+__ZN3JSC18globalFuncUnescapeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7UString6appendEt
+__ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC17PropertyNameArray3addEPNS_7UString3RepE
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF6VectorIN3JSC10IdentifierELm20EE14expandCapacityEm
+__ZN3JSCL20arrayProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC9ArrayNode13isSimpleArrayEv
+__ZN3JSC8JITStubs10cti_op_mulEPPv
+__ZN3JSC8JITStubs16cti_op_is_objectEPPv
+__ZN3JSC14jsIsObjectTypeENS_7JSValueE
+__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE
+__ZN3JSC9CodeBlock34reparseForExceptionInfoIfNecessaryEPNS_9ExecStateE
+__ZNK3JSC10ScopeChain10localDepthEv
+__ZNK3JSC12JSActivation9classInfoEv
+__ZN3JSC6Parser7reparseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_12JSGlobalDataEPS5_
+__ZN3JSC16FunctionBodyNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IP
+__ZN3JSC13StatementNode6setLocEii
+__ZN3JSC16FunctionBodyNode14copyParametersEv
+__ZN3JSC16FunctionBodyNode13finishParsingEPNS_10IdentifierEm
+__ZN3JSC16FunctionBodyNode31bytecodeForExceptionInfoReparseEPNS_14ScopeChainNodeEPNS_9CodeBlockE
+__ZN3JSC9CodeBlock36hasGlobalResolveInfoAtBytecodeOffsetEj
+__ZN3JSC9CodeBlock27lineNumberForBytecodeOffsetEPNS_9ExecStateEj
+__ZN3WTF6VectorIPvLm0EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorIPvLm0EE15reserveCapacityEm
+__ZN3JSC3JIT16emit_op_jeq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs16cti_op_is_numberEPPv
+__ZN3JSCL23stringProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12StringObject9classInfoEv
+__ZN3JSC8JITStubs28cti_op_get_by_id_string_failEPPv
+__ZN3JSC11JSImmediate9prototypeENS_7JSValueEPNS_9ExecStateE
+__ZN3JSCL23numberProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC3JIT16emit_op_neq_nullEPNS_11InstructionE
+__ZN3JSC4Yarr23RegexPatternConstructor8copyTermERNS0_11PatternTermE
+__ZL17bracketIsAnchoredPKh
+__ZL32branchFindFirstAssertedCharacterPKhb
+__ZL20branchNeedsLineStartPKhjj
+__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20stringProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC3JIT17emit_op_jneq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs25cti_op_call_NotJSFunctionEPPv
+__ZN3JSC17StringConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callStringConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12StringObject8toStringEPNS_9ExecStateE
+__ZN3JSC23FunctionCallBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC20EvalFunctionCallNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator19emitResolveWithBaseEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC23FunctionCallBracketNodeD0Ev
+__ZN3JSC20EvalFunctionCallNodeD0Ev
+__ZN3JSC3JIT25emit_op_resolve_with_baseEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_call_evalEPNS_11InstructionE
+__ZN3JSC3JIT21emitSlow_op_call_evalEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC14MacroAssembler4jumpENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5LabelE
+__ZN3JSCL19regExpProtoFuncExecEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString12replaceRangeEiiRKS0_
+__ZN3JSC8JITStubs17cti_op_is_booleanEPPv
+__ZN3JSC3JIT22emit_op_put_global_varEPNS_11InstructionE
+__ZN3JSCL23regExpProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18regExpObjectSourceEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL18regExpObjectGlobalEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL22regExpObjectIgnoreCaseEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL21regExpObjectMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC4Yarr14RegexGenerator30generatePatternCharacterGreedyERNS1_19TermGenerationStateE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_failEPPv
+__ZN3JSC17DeleteResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17DeleteResolveNodeD0Ev
+__ZN3JSC3JIT20emit_op_resolve_baseEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_resolve_baseEPPv
+__ZN3JSC12JSActivation14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC8JSString8toNumberEPNS_9ExecStateE
+__ZN3JSC8JITStubs24cti_op_resolve_with_baseEPPv
+__ZN3JSC8JITStubs16cti_op_call_evalEPPv
+__ZN3JSC11Interpreter8callEvalEPNS_9ExecStateEPNS_12RegisterFileEPNS_8RegisterEiiRNS_7JSValueE
+__ZN3JSC13LiteralParser5Lexer3lexERNS1_18LiteralParserTokenE
+__ZN3JSC13LiteralParser14parseStatementEv
+__ZN3JSC13LiteralParser15parseExpressionEv
+__ZN3JSC13LiteralParser10parseArrayEv
+__ZN3JSC13LiteralParser11parseObjectEv
+__ZN3JSC10Identifier3addEPNS_9ExecStateEPKti
+__ZN3JSC7JSArray4pushEPNS_9ExecStateENS_7JSValueE
+__ZN3JSCL19mathProtoFuncRandomEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF16weakRandomNumberEv
+__ZN3JSCL18mathProtoFuncFloorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC4Heap15recordExtraCostEm
+__ZN3JSC6Parser5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
+__ZN3JSC9ExecState9thisValueEv
+__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEiPNS_14ScopeChainNodeEPNS_7JSValueE
+__ZN3JSC8EvalNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC17BytecodeGeneratorC2EPNS_8EvalNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEENS_16
+__ZN3JSC8EvalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZThn16_N3JSC8EvalNodeD0Ev
+__ZN3JSC8EvalNodeD0Ev
+__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject9classNameEv
+__ZN3JSC11JSImmediate12toThisObjectENS_7JSValueEPNS_9ExecStateE
+__ZNK3JSC6JSCell17getTruncatedInt32ERi
+__ZN3JSC15toInt32SlowCaseEdRb
+__ZN3JSCL20dateProtoFuncSetYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12DateInstance21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
+__ZN3JSC21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
+__ZN3JSCL12getDSTOffsetEdd
+__ZN3JSC21gregorianDateTimeToMSERKNS_17GregorianDateTimeEdb
+__ZN3JSCL15dateToDayInYearEiii
+__ZN3JSC8JITStubs19cti_op_to_primitiveEPPv
+__ZN3JSCL21dateProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC10formatTimeERKNS_17GregorianDateTimeEb
+__ZN3JSCL24dateProtoFuncToGMTStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7UString13appendNumericEd
+__ZN3JSC11concatenateEPNS_7UString3RepEd
+__ZN3JSCL20dateProtoFuncGetYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL20dateProtoFuncGetDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncGetMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncGetHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL19dateProtoFuncGetDayEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC28createUndefinedVariableErrorEPNS_9ExecStateERKNS_10IdentifierEjPNS_9CodeBlockE
+__ZN3JSC9CodeBlock32expressionRangeForBytecodeOffsetEPNS_9ExecStateEjRiS3_S3_
+__ZN3JSC5Error6createEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringEilS6_
+__ZN3JSC22NativeErrorConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL35constructWithNativeErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC22NativeErrorConstructor9constructEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSCL23returnToThrowTrampolineEPNS_12JSGlobalDataEPvRS2_
+_ctiVMThrowTrampoline
+__ZN3JSC8JITStubs12cti_vm_throwEPPv
+__ZN3JSC11Interpreter14throwExceptionERPNS_9ExecStateERNS_7JSValueEjb
+__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
+__ZNK3JSC8JSObject19isWatchdogExceptionEv
+__ZN3JSC9CodeBlock24handlerForBytecodeOffsetEj
+__ZN3JSC8JITStubs21cti_op_push_new_scopeEPPv
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm16EE14expandCapacityEm
+__ZN3JSCL20dateProtoFuncSetTimeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS1_INS2_8EvalNodeEEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3getEPS4
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS1_INS2_8EvalNodeEEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3setEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS1_INS2_8EvalNodeEEEENS_18PairFirstExtractorIS9_EENS_7StrHashIS5_
+__ZN3JSC10LessEqNodeD0Ev
+__ZN3JSC8JITStubs14cti_op_jlesseqEPPv
+__ZN3JSC8JSString18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZL18makeRightShiftNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC14RightShiftNodeD0Ev
+__ZN3JSC3JIT14emit_op_rshiftEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_rshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC18PostfixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC18PostfixBracketNodeD0Ev
+__ZN3JSC21ReadModifyBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ReadModifyBracketNodeD0Ev
+__ZN3JSC11Interpreter15unwindCallFrameERPNS_9ExecStateENS_7JSValueERjRPNS_9CodeBlockE
+__ZN3JSCL22errorProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF23waitForThreadCompletionEjPPv
+__ZN3WTF15ThreadConditionD1Ev
+__ZN3JSC9Structure24removePropertyTransitionEPS0_RKNS_10IdentifierERm
+__ZN3JSC12JSActivation3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC26createNotAnObjectErrorStubEPNS_9ExecStateEb
+__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC22JSNotAnObjectErrorStub22isNotAnObjectErrorStubEv
+__ZN3JSC22createNotAnObjectErrorEPNS_9ExecStateEPNS_22JSNotAnObjectErrorStubEjPNS_9CodeBlockE
+__ZN3JSC9CodeBlock37getByIdExceptionInfoForBytecodeOffsetEPNS_9ExecStateEjRNS_8OpcodeIDE
+__ZN3JSCL18createErrorMessageEPNS_9ExecStateEPNS_9CodeBlockEiiiNS_7JSValueENS_7UStringE
+__ZN3JSC13ErrorInstanceD1Ev
+__ZN3JSC22JSNotAnObjectErrorStubD1Ev
+__ZN3JSC13JSNotAnObjectD1Ev
+__ZN3JSC19JSStaticScopeObjectD1Ev
+__ZN3JSC19JSStaticScopeObjectD2Ev
+__ZN3JSC17DeleteBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitDeleteByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC17DeleteBracketNodeD0Ev
+__ZN3JSC8JITStubs17cti_op_del_by_valEPPv
+__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC28globalFuncEncodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL6encodeEPNS_9ExecStateERKNS_7ArgListEPKc
+__ZNK3JSC7UString10UTF8StringEb
 __ZN3WTF7Unicode18convertUTF16ToUTF8EPPKtS2_PPcS4_b
-__Z35NPN_InitializeVariantWithStringCopyP10_NPVariantPK9_NPString
-__ZN3KJS7CStringD1Ev
-__NPN_ReleaseObject
-__Z12jsDeallocateP8NPObject
-__ZN3KJS8Bindings10RootObject11gcUnprotectEPNS_8JSObjectE
-_pow5mult
-_quorem
-_diff
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EE15reserveCapacityEm
-__ZN3KJS10NumberNode8setValueEd
-__ZN3KJS11ResolveNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS21dateProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncGetFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS12NotEqualNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14InstanceOfNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS17PreIncResolveNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9NumberImp9toBooleanEPNS_9ExecStateE
-__ZN3KJS10LessEqNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS29objectProtoFuncHasOwnPropertyEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10LessEqNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13UnaryPlusNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17DeleteBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17DeleteBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS20arrayProtoFuncSpliceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17staticValueGetterINS_13MathObjectImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS13MathObjectImp16getValuePropertyEPNS_9ExecStateEi
-__NPN_DeallocateObject
-__ZN3KJS14PostIncDotNodeD1Ev
-__ZN3KJS22ReadModifyLocalVarNodeD1Ev
-__ZN3KJS10LessEqNodeD1Ev
-__ZN3KJS18PostDecResolveNodeD1Ev
-__ZN3KJS17DeleteBracketNodeD1Ev
-__ZN3KJS18PostIncResolveNodeD1Ev
-__ZN3KJS14InstanceOfNodeD1Ev
-__ZN3KJS10NegateNodeD1Ev
-__ZN3KJS17PreDecResolveNodeD1Ev
-__ZN3KJS21ReadModifyBracketNodeD1Ev
-__ZN3KJS10BitAndNodeD1Ev
-__ZN3KJS9BitOrNodeD1Ev
-__ZN3KJS14RightShiftNodeD1Ev
-__ZN3KJS13LeftShiftNodeD1Ev
-__ZN3KJS13UnaryPlusNodeD1Ev
-__ZN3KJS13MathObjectImpD0Ev
-__ZN3KJS14NativeErrorImpD0Ev
-__ZN3KJS14ErrorObjectImpD0Ev
-__ZN3KJS15RegExpObjectImpD0Ev
-__ZN3KJS17DateObjectFuncImpD0Ev
-__ZN3KJS13DateObjectImpD0Ev
-__ZN3KJS15NumberObjectImpD0Ev
-__ZN3KJS16BooleanObjectImpD0Ev
-__ZN3KJS19StringObjectFuncImpD0Ev
-__ZN3KJS15StringObjectImpD0Ev
-__ZN3KJS14ArrayObjectImpD0Ev
-__ZN3KJS17FunctionObjectImpD0Ev
-__ZN3KJS15ObjectObjectImpD0Ev
-__ZN3KJS20NativeErrorPrototypeD0Ev
-__ZN3KJS15RegExpPrototypeD0Ev
-__ZN3KJS15NumberPrototypeD0Ev
-__ZN3KJS16BooleanPrototypeD0Ev
-__ZN3KJS15StringPrototypeD0Ev
-__ZN3KJS15ObjectPrototypeD0Ev
-__ZN3KJS17FunctionPrototypeD0Ev
-__ZN3KJS13PreIncDotNodeD1Ev
-__ZN3KJS17staticValueGetterINS_15RegExpObjectImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS15RegExpObjectImp16getValuePropertyEPNS_9ExecStateEi
-__ZNK3KJS15RegExpObjectImp10getBackrefEj
-__ZN3KJS16mathProtoFuncMaxEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17staticValueGetterINS_15NumberObjectImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS15NumberObjectImp16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS10NegateNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10NegateNode8evaluateEPNS_9ExecStateE
-__ZN3KJS25stringProtoFuncCharCodeAtEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21arrayProtoFuncUnShiftEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10LessEqNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8JSObject15getPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZNK3KJS12PropertySlot8getValueEPNS_9ExecStateEPNS_8JSObjectEj
-__ZN3KJS16mathProtoFuncMinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10Identifier5equalEPKNS_7UString3RepEPKc
-__ZN3KJS11addSlowCaseEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS8LessNode8evaluateEPNS_9ExecStateE
-__ZN3KJS7DivNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS10NegateNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS7AddNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncSinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16mathProtoFuncLogEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16mathProtoFuncAbsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF6VectorIPN3KJS9ExecStateELm16EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS9ExecStateELm16EE15reserveCapacityEm
-__ZN3KJS17arrayProtoFuncPopEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21stringProtoFuncSubstrEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS28globalFuncEncodeURIComponentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6encodeEPNS_9ExecStateERKNS_4ListEPKc
-__ZN3KJS17PrefixBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17PreIncBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncExpEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncATanEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncCeilEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14AddNumbersNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18arrayProtoFuncSortEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13ArrayInstance4sortEPNS_9ExecStateEPNS_8JSObjectE
-__ZN3KJS13ArrayInstance17compactForSortingEv
-__ZN3KJS34compareWithCompareFunctionForQSortEPKvS1_
-__ZN3KJS13ArrayInstance4sortEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncPowEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15NumberObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS23numberProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS9NumberImp8toObjectEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncCosEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncSqrtEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncASinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14ExpressionNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS11DoWhileNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS21stringProtoFuncSearchEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13PreDecDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18PostfixBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PostIncBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13LeftShiftNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
+__ZN3JSC10NegateNodeD0Ev
+__ZN3JSC8JITStubs13cti_op_negateEPPv
+__ZN3JSCL17mathProtoFuncSqrtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncAbsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18mathProtoFuncRoundEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncCosEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncSinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs10cti_op_subEPPv
+__ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
+__ZN3JSC16ArrayConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL20callArrayConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs10cti_op_modEPPv
+__ZN3JSC8JITStubs12cti_op_jlessEPPv
+__ZL17makeLeftShiftNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC13LeftShiftNodeD0Ev
+__ZN3JSC3JIT14emit_op_lshiftEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_lshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC11JITStubCall11addArgumentENS_3X8610RegisterIDE
+__ZN3JSCL16mathProtoFuncMaxEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC10BitAndNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitandEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitandEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_bitandEPPv
+__ZN3JSC14BitwiseNotNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitnotEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitnotEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC22UnsignedRightShiftNodeD0Ev
+__ZN3JSC10BitXOrNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitxorEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitxorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSCL25stringProtoFuncCharCodeAtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs14cti_op_urshiftEPPv
+__ZN3JSC16toUInt32SlowCaseEdRb
+__ZN3JSCL17mathProtoFuncCeilEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC6JSCell18getTruncatedUInt32ERj
+__ZN3JSC3JIT13emit_op_bitorEPNS_11InstructionE
+__ZN3JSC3JIT17emitSlow_op_bitorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs12cti_op_bitorEPPv
+__ZN3JSC9BitOrNodeD0Ev
+__ZN3JSC8JITStubs13cti_op_rshiftEPPv
+__ZN3JSC8JITStubs13cti_op_bitxorEPPv
+__ZN3JSC9parseDateERKNS_7UStringE
+__ZN3WTF6VectorIN3JSC10CallRecordELm0EE14expandCapacityEmPKS2_
+__ZNK3JSC12JSActivation12toThisObjectEPNS_9ExecStateE
+__ZN3JSC3JIT20emit_op_resolve_skipEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_resolve_skipEPPv
+__ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17StringConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithStringConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC5equalEPKNS_7UString3RepES3_
+__ZN3JSC8EvalNode4markEv
+__ZN3JSC10SwitchNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13CaseBlockNode20emitBytecodeForBlockERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_
+__ZN3JSC13CaseBlockNode18tryOptimizedSwitchERN3WTF6VectorIPNS_14ExpressionNodeELm8EEERiS7_
+__ZN3JSCL17processClauseListEPNS_14ClauseListNodeERN3WTF6VectorIPNS_14ExpressionNodeELm8EEERNS_10SwitchKindERbRiSB_
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm8EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC5LabelEEELm8EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator11beginSwitchEPNS_10RegisterIDENS_10SwitchInfo10SwitchTypeE
+__ZN3WTF6VectorIN3JSC10SwitchInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator9endSwitchEjPN3WTF6RefPtrINS_5LabelEEEPPNS_14ExpressionNodeEPS3_ii
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0EE14expandCapacityEm
+__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
+__ZN3JSC14CaseClauseNodeD0Ev
+__ZN3JSC14ClauseListNodeD0Ev
+__ZN3JSC13CaseBlockNodeD0Ev
+__ZN3JSC10SwitchNodeD0Ev
+__ZN3JSC3JIT19emit_op_switch_charEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC12SwitchRecordELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE17CodeLocationLabelELm0EE4growEm
+__ZN3JSC8JITStubs18cti_op_switch_charEPPv
+__ZN3JSCL16mathProtoFuncPowEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIcLm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC7UString5RangeELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN3JSC7UStringELm16EE15reserveCapacityEm
+__ZN3JSC7JSArray16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9ExecState10arrayTableEPS0_
+__ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3JSC8JITStubs24cti_op_get_by_val_stringEPPv
+__ZN3JSCL16mathProtoFuncLogEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString8toDoubleEv
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22Id
+__ZN3JSCL29objectProtoFuncHasOwnPropertyEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18arrayProtoFuncSortEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray4sortEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE6insertEi
+__ZN3JSCltERKNS_7UStringES2_
+__ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE7balanceEi
+__Z12jsRegExpFreeP8JSRegExp
+__ZN3JSCL21stringProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19globalFuncEncodeURIEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19globalFuncDecodeURIEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL6decodeEPNS_9ExecStateERKNS_7ArgListEPKcb
 __ZN3WTF7Unicode18UTF8SequenceLengthEc
 __ZN3WTF7Unicode18decodeUTF8SequenceEPKc
-__ZN3KJS9StringImp18getPrimitiveNumberEPNS_9ExecStateERdRPNS_7JSValueE
-__ZN3KJSltERKNS_7UStringES2_
-__ZN3KJS15ConditionalNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS10BitAndNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10BitAndNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS19ImmediateNumberNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS13ArrayInstance16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3KJS18LocalVarAccessNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS13LeftShiftNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS19BracketAccessorNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14RightShiftNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14RightShiftNode8evaluateEPNS_9ExecStateE
-__ZN3KJS7AddNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS19ImmediateNumberNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS13LeftShiftNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18LocalVarAccessNode16evaluateToUInt32EPNS_9ExecStateE
-__ZNK3KJS9NumberImp17getTruncatedInt32ERi
-__ZN3KJS19BracketAccessorNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS16BooleanObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS24booleanProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14BitwiseNotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9BitOrNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9BitOrNode8evaluateEPNS_9ExecStateE
-__ZN3KJS10BitAndNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14BitwiseNotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15NumberObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8Bindings8Instance32createBindingForLanguageInstanceENS1_15BindingLanguageEPvN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings9CInstanceC2EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZNK3KJS8Bindings8Instance10rootObjectEv
-__ZN3KJS8Bindings8Instance19createRuntimeObjectEPS1_
-__ZN3KJS16RuntimeObjectImpC2EPNS_8Bindings8InstanceE
-__ZN3KJS8Bindings10RootObject16addRuntimeObjectEPNS_16RuntimeObjectImpE
-__ZN3KJS16RuntimeObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS8Bindings9CInstance5beginEv
-__ZNK3KJS8Bindings9CInstance8getClassEv
-__ZN3KJS8Bindings6CClass11classForIsAEP7NPClass
-__ZN3KJS8Bindings6CClassC2EP7NPClass
-__ZNK3KJS8Bindings6CClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3KJS7UString5asciiEv
-__ZNK3KJS8Bindings6CClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__NPN_UTF8FromIdentifier
-__ZN3KJS8Bindings5Class14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
-__ZN3KJS8Bindings9CInstance3endEv
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EE15reserveCapacityEm
-__ZN3KJS16RuntimeObjectImp12methodGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS13RuntimeMethodC2EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EEC2ERKS5_
-__ZN3KJS13RuntimeMethod14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS16RuntimeObjectImp9classInfoEv
-__ZN3KJS8Bindings9CInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_4ListE
-__ZNK3KJS8Bindings7CMethod4nameEv
-__ZN3KJS8Bindings23convertNPVariantToValueEPNS_9ExecStateEPK10_NPVariantPNS0_10RootObjectE
-__ZN3KJS16RuntimeObjectImpD2Ev
-__ZN3KJS8Bindings10RootObject19removeRuntimeObjectEPNS_16RuntimeObjectImpE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueEPS0_RKNS_10IdentifierE
-__ZN3KJS10substituteERNS_7UStringERKS0_
-__ZN3KJS4Node16rethrowExceptionEPNS_9ExecStateE
-__ZN3KJS4Node15handleExceptionEPNS_9ExecStateEPNS_7JSValueE
-__ZN3KJS16RuntimeObjectImp10invalidateEv
-__ZN3KJS16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS14JSGlobalObjectD2Ev
-__ZN3KJS15GlobalExecStateD1Ev
-__ZN3KJS14BitwiseNotNodeD1Ev
-__ZN3KJSplERKNS_7UStringES2_
-__ZN3KJS5Lexer14convertUnicodeEiiii
-__ZN3KJS14ArrayObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9Arguments3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E3addIjS2_NS_22IdentityHashTranslatorIjS2_S6_EEEES1_INS_17HashTableIteratorIjS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_EC2ERKSC_
-__ZN3KJS23stringProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E4findIjNS_22IdentityHashTranslatorIjS2_S6_EEEENS_17HashTableIteratorIjS2_S4_S6_SB_S9_EERKT_
-__ZN3KJS10BitXOrNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10BitXOrNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14RightShiftNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS10BitXOrNodeD1Ev
-__ZN3KJS17DateObjectFuncImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9parseDateERKNS_7UStringE
-__ZN3KJS6RegExp6createERKNS_7UStringE
-__ZN3KJS7ModNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS16RuntimeObjectImp14implementsCallEv
-__ZNK3KJS8Bindings9CInstance14implementsCallEv
-__ZN3KJS11Interpreter21shouldPrintExceptionsEv
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcRKNS_10IdentifierE
-__ZN3KJS12PropertySlot15undefinedGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKS0_
-__ZN3KJS15SavedPropertiesD1Ev
-__ZN3KJS8JSObject18isActivationObjectEv
-__ZN3KJS19globalFuncDecodeURIEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14JSGlobalObject15restoreBuiltinsERKNS_13SavedBuiltinsE
-__ZN3KJS11PropertyMap7restoreERKNS_15SavedPropertiesE
-__ZN3KJS16JSVariableObject19restoreLocalStorageERKNS_15SavedPropertiesE
-__ZN3WTF6VectorIN3KJS17LocalStorageEntryELm32EE6resizeEm
-__ZNK3KJS23FunctionCallBracketNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17TypeOfResolveNode10precedenceEv
-__ZNK3KJS17TypeOfResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13AssignDotNode10precedenceEv
-__ZNK3KJS12ContinueNode8streamToERNS_12SourceStreamE
-__ZN3KJS11FunctionImp12callerGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS9BreakNodeC1ERKNS_10IdentifierE
-__ZN3KJS13StatementNode9pushLabelERKNS_10IdentifierE
-__ZN3KJS9ThrowNode7executeEPNS_9ExecStateE
-__ZNK3KJS15NumberObjectImp19implementsConstructEv
-__ZN3KJS22numberProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8VoidNodeD1Ev
-__ZN3KJS14ErrorObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18globalFuncIsFiniteEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21ReadModifyResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15StrictEqualNode8evaluateEPNS_9ExecStateE
-__ZN3KJS27compareByStringPairForQSortEPKvS1_
-__ZN3KJS7compareERKNS_7UStringES2_
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueEPS0_S8_
-__ZN3KJS21arrayProtoFuncReverseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS20stringProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS15StringObjectImp19implementsConstructEv
-__ZN3KJS15StringObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS18PostDecResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS21dateProtoFuncSetMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23setNewValueFromDateArgsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListEib
-__ZN3KJS20dateProtoFuncSetDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21dateProtoFuncSetHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23setNewValueFromTimeArgsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListEib
-__ZN3KJS23dateProtoFuncSetMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncSetFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRPNS_7JSValueE
-__ZN3KJS20dateProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS27dateProtoFuncGetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS27dateProtoFuncSetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncGetUTCMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncSetUTCMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncGetUTCDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncSetUTCDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncGetUTCHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncSetUTCHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncGetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncSetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncGetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncSetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22numberProtoFuncToFixedEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18integer_part_noexpEd
-__ZN3KJS14AddNumbersNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS14InstanceOfNode10precedenceEv
-__ZNK3KJS14InstanceOfNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8JSObject8toNumberEPNS_9ExecStateE
-__Z15kjs_pcre_xclassiPKh
-__ZN3KJS10NumberNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS18PostDecBracketNodeD1Ev
-__ZN3KJS17PropertyNameArray3addERKNS_10IdentifierE
-__ZN3KJS22errorProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13LeftShiftNode15evaluateToInt32EPNS_9ExecStateE
-__ZNK3KJS9RegExpImp14implementsCallEv
-__ZN3KJS22stringProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15ConditionalNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3KJS11DoWhileNode7executeEPNS_9ExecStateE
-__ZN3KJS8Bindings23convertObjcValueToValueEPNS_9ExecStateEPvNS0_13ObjcValueTypeEPNS0_10RootObjectE
-__ZN3KJS8Bindings17webUndefinedClassEv
-__ZN3KJS8Bindings20webScriptObjectClassEv
-__ZN3KJS8Bindings8Instance19createRuntimeObjectENS1_15BindingLanguageEPvN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings12ObjcInstanceC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings8Instance18didExecuteFunctionEv
-__ZN3KJS8Bindings12ObjcInstance5beginEv
-__ZNK3KJS8Bindings12ObjcInstance8getClassEv
-__ZN3KJS8Bindings9ObjcClass11classForIsAEP10objc_class
-__ZN3KJS8Bindings9ObjcClassC2EP10objc_class
-__ZNK3KJS8Bindings9ObjcClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3KJS8Bindings9ObjcClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZN3KJS8Bindings25convertJSMethodNameToObjcEPKcPcm
-__ZN3KJS8Bindings10ObjcMethodC2EP10objc_classPKc
-__ZN3KJS8Bindings12ObjcInstance3endEv
-__ZN3KJS8Bindings12ObjcInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_4ListE
-__ZNK3KJS8Bindings10ObjcMethod18getMethodSignatureEv
-__ZNK3KJS8Bindings10ObjcMethod4nameEv
-__ZN3KJS8Bindings20objcValueTypeForTypeEPKc
-__ZN3KJS8Bindings23convertValueToObjcValueEPNS_9ExecStateEPNS_7JSValueENS0_13ObjcValueTypeE
-__ZNK3KJS6JSCell9getStringEv
-__ZN3KJS8Bindings23convertNSStringToStringEP8NSString
-__ZN3KJS8Bindings12ObjcInstanceD1Ev
-__ZN3KJS9LabelNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9LabelNode7executeEPNS_9ExecStateE
-__ZN3KJS12ContinueNodeC1ERKNS_10IdentifierE
-__ZN3KJS11FunctionImp12lengthGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS9BitOrNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS18EmptyStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS22UnsignedRightShiftNodeD1Ev
-__ZN3KJS7ModNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS20arrayProtoFuncFilterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6InNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17arrayProtoFuncMapEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS10LessEqNode10precedenceEv
-__ZNK3KJS10LessEqNode8streamToERNS_12SourceStreamE
-__ZNK3KJS18NotStrictEqualNode10precedenceEv
-__ZNK3KJS18NotStrictEqualNode8streamToERNS_12SourceStreamE
-__ZN3KJS14StringInstance16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3KJS7UString4fromEi
-__ZN3KJS14StringInstance11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS21stringProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22UnsignedRightShiftNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11ResolveNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS22UnsignedRightShiftNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS11ResolveNode16evaluateToUInt32EPNS_9ExecStateE
-__ZNK3KJS9NumberImp18getTruncatedUInt32ERj
-__ZN3KJS10NumberNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS7SubNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14BitwiseNotNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS10BitAndNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS7AddNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS7SubNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS8VoidNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8VoidNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17DeleteResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18LocalVarDeleteNodeD1Ev
-__ZN3KJS11FunctionImp15argumentsGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS18LocalVarDeleteNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17DeleteResolveNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS16RuntimeObjectImp6canPutEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS13UnaryPlusNode8evaluateEPNS_9ExecStateE
-__ZN3KJS24dateProtoFuncToUTCStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23booleanProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11NewExprNode16evaluateToNumberEPNS_9ExecStateE
-__Z22kjs_pcre_ucp_othercasej
-__ZN3KJS17PreDecResolveNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS7JSValue7toFloatEPNS_9ExecStateE
-__ZN3KJS14ExpressionNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS4List26markProtectedListsSlowCaseEv
-__ZNK3KJS6JSCell9getStringERNS_7UStringE
-__ZN3KJS8TrueNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS9RegExpImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZNK3KJS9NumberImp9getUInt32ERj
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueEPS0_
-__ZN3KJS23FunctionCallResolveNode15evaluateToInt32EPNS_9ExecStateE
-__ZNK3KJS6JSCell18getTruncatedUInt32ERj
-__ZNK3KJS9LabelNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17ObjectLiteralNode21needsParensIfLeftmostEv
-__ZNK3KJS11DoWhileNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17PreDecResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13PreIncDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13PreDecDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17DeleteResolveNode8streamToERNS_12SourceStreamE
-__ZN3KJS9FalseNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS23dateProtoFuncSetSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14PostIncDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8Bindings12ObjcInstance14implementsCallEv
-__ZN3KJS8Bindings9ObjcClass14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
-__ZN3KJS16BooleanObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11jsUndefinedEv
-___tcf_2
-___tcf_6
-___tcf_0
-___tcf_5
-___tcf_3
-___tcf_4
-__Z12jsRegExpFreeP8JSRegExp
-__ZN3KJS25CollectorHeapIntrospector4sizeEP14_malloc_zone_tPKv
-__ZN3WTF9HashTableINS_6RefPtrIN3KJS7UString3RepEEESt4pairIS5_mENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEEESC_E4findIS5_NS_22IdentityHashTranslatorIS5_S7_SA_EEEENS_17HashTableIteratorIS5_S7_S9_SA_SE_SC_EERKT_
-__ZN3KJS18AssignLocalVarNodeD1Ev
-__ZN3KJS8TrueNodeD1Ev
-__ZN3KJS11NewExprNodeD1Ev
-__ZN3KJS19ImmediateNumberNodeD1Ev
-__ZN3KJS17AssignBracketNodeD1Ev
-__ZN3KJS18LocalVarAccessNodeD1Ev
-__ZN3KJS16ParserRefCounted8refcountEv
-__ZN3KJS14JSGlobalObject16stopTimeoutCheckEv
-__ZN3KJS11GreaterNodeD1Ev
-__ZN3KJS16ArgumentListNodeD1Ev
-__ZN3KJS17FunctionObjectImp9constructEPNS_9ExecStateERKNS_4ListERKNS_10IdentifierERKNS_7UStringEi
-__ZN3KJS6Parser5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EERKNS_7UStringEiPKNS_5UCharEjPiSD_PS7_
-__ZN3KJS8JSObject4callEPNS_9ExecStateEPS0_RKNS_4ListE
-__ZN3KJS18AddStringRightNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16globalFuncEscapeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS13DateObjectImp19implementsConstructEv
-__ZN3KJS13DateObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS13DatePrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS20dateProtoFuncGetTimeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS12DateInstance9classInfoEv
-__ZNK3KJS9NumberImp8toNumberEPNS_9ExecStateE
-__ZNK3KJS9NumberImp8toStringEPNS_9ExecStateE
-__ZN3KJS9BlockNodeD1Ev
-__ZN3KJS21dateProtoFuncGetMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
-__ZN3KJS12getUTCOffsetEv
-__ZN3KJS12getDSTOffsetEdd
-__ZN3KJS15ConditionalNodeD1Ev
-__ZN3KJS7DivNodeD1Ev
-__ZN3KJS9EqualNodeD1Ev
-__ZN3KJS8NullNodeD1Ev
-__ZN3KJS9FalseNodeD1Ev
-__ZN3KJS12NotEqualNodeD1Ev
-__ZN3KJS7SubNodeD1Ev
-__ZN3KJS7SubNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS24LocalVarFunctionCallNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS21ReadModifyResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14StringInstance12lengthGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS18globalFuncUnescapeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7DivNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS7DivNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18LocalVarAccessNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS8MultNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8MultNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS7SubNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9NumberImp11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZN3KJS18AddStringRightNodeD1Ev
-__ZN3KJS7AddNodeD1Ev
-__ZN3KJS13LogicalOrNodeD1Ev
-__ZN3KJS17PreIncResolveNodeD1Ev
-__ZN3KJS8MultNodeD1Ev
-__ZN3KJS8LessNodeD1Ev
-__ZN3KJS14LogicalAndNodeD1Ev
-__ZN3KJS10NumberNodeD1Ev
-__ZN3KJS13GreaterEqNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14LogicalNotNodeD1Ev
-__ZN3KJS7ModNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14JSGlobalObject12checkTimeoutEv
-__ZN3KJS7ModNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15LessNumbersNode8evaluateEPNS_9ExecStateE
-__ZN3KJS20dateProtoFuncGetYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8ThisNodeD1Ev
-__ZN3KJS19mathProtoFuncRandomEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS20globalFuncParseFloatEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13GreaterEqNode8evaluateEPNS_9ExecStateE
-__ZN3KJS20dateProtoFuncGetDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18mathProtoFuncFloorEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23stringProtoFuncFontsizeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11ResolveNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13GreaterEqNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS9NumberImp18getPrimitiveNumberEPNS_9ExecStateERdRPNS_7JSValueE
-__ZN3KJS19stringProtoFuncLinkEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS19dateProtoFuncGetDayEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21dateProtoFuncGetHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncGetMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncGetSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9ArrayNodeD1Ev
-__ZN3KJS11ElementNodeD1Ev
-__ZN3KJS17ObjectLiteralNodeD1Ev
-__ZN3KJS14PostfixDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14PostIncDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19PlaceholderTrueNodeD1Ev
-__ZN3KJS19PostDecLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17ReadModifyDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17ReadModifyDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS21FunctionCallValueNodeD1Ev
-__ZN3KJS10BitAndNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14AddNumbersNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS10BitXOrNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS22UnsignedRightShiftNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8MultNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS7DivNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS19StringObjectFuncImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7ModNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS10BitAndNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS14RightShiftNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS14AddNumbersNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14globalFuncEvalEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Parser5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EERKNS_7UStringEiPKNS_5UCharEjPiSD_PS7_
-__ZN3KJS13EvalExecStateC1EPNS_14JSGlobalObjectEPNS_8EvalNodeEPNS_9ExecStateE
-__ZN3KJS8EvalNode7executeEPNS_9ExecStateE
-__ZN3KJS8EvalNodeD1Ev
-__ZN3KJS23FunctionCallBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS23FunctionCallBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PropertyListNodeD1Ev
-__ZN3KJS12PropertyNodeD1Ev
-__ZN3KJS13CaseBlockNodeD1Ev
-__ZN3KJS14CaseClauseNodeD1Ev
-__ZN3KJS14ClauseListNodeD1Ev
-__ZN3KJS9RegExpImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_9RegExpImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS9RegExpImp16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS9ThrowNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15StrictEqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS19regExpProtoFuncTestEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9RegExpImp5matchEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS15StrictEqualNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS18NotStrictEqualNodeD1Ev
-__ZN3KJS15StrictEqualNodeD1Ev
-__ZN3KJS18LocalVarTypeOfNodeD1Ev
-__ZN3KJS19globalFuncEncodeURIEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17TypeOfResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS26stringProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7JSValue20toIntegerPreserveNaNEPNS_9ExecStateE
-__ZNK3KJS7UString5rfindERKS0_i
-__ZN3KJS15TypeOfValueNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15TypeOfValueNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS17FunctionObjectImp19implementsConstructEv
-__ZN3KJS17FunctionObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZNK3KJS8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8JSObject3putEPNS_9ExecStateEjPNS_7JSValueEi
-__ZN3KJS6InNodeD1Ev
-__ZNK3KJS9Arguments9classInfoEv
-__ZN3KJS10BitXOrNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS19addSlowCaseToNumberEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS8JSObject14deletePropertyEPNS_9ExecStateEj
-__ZNK3KJS9WhileNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9FalseNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7DivNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7DivNode10precedenceEv
-__ZNK3KJS15StrictEqualNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15StrictEqualNode10precedenceEv
-__ZNK3KJS16VarDeclCommaNode10precedenceEv
-__ZNK3KJS17PreIncResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9FalseNode10precedenceEv
-__ZN3KJS14InstanceOfNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZNK3KJS19InternalFunctionImp21implementsHasInstanceEv
-__ZN3KJS8JSObject11hasInstanceEPNS_9ExecStateEPNS_7JSValueE
-__ZN3WTF14FastMallocZone9forceLockEP14_malloc_zone_t
-__ZN3KJS25CollectorHeapIntrospector9forceLockEP14_malloc_zone_t
-__ZN3WTF14FastMallocZone11forceUnlockEP14_malloc_zone_t
-__ZN3KJS25CollectorHeapIntrospector11forceUnlockEP14_malloc_zone_t
-__ZNK3KJS23FunctionCallBracketNode10precedenceEv
-__ZN3KJS14InstanceOfNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9ThrowNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7SubNode10precedenceEv
-__ZNK3KJS7SubNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10NegateNode10precedenceEv
-__ZNK3KJS10NegateNode8streamToERNS_12SourceStreamE
-__ZNK3KJS12FuncDeclNode8streamToERNS_12SourceStreamE
-__ZNK3KJS18PostDecResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9BreakNode8streamToERNS_12SourceStreamE
-__ZNK3KJS6InNode10precedenceEv
-__ZNK3KJS6InNode8streamToERNS_12SourceStreamE
-__ZN3KJS14StringInstanceC2EPNS_8JSObjectERKNS_7UStringE
-__ZN3KJS18PostDecBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS28dateProtoFuncGetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS18PostIncResolveNode8streamToERNS_12SourceStreamE
-__ZN3KJS13ArrayInstance14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS14StringInstance14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS15AssignErrorNodeD1Ev
-__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
-__ZN3WTF6VectorIcLm0EE14expandCapacityEm
+__ZN3JSCL22numberProtoFuncToFixedEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16integerPartNoExpEd
+__ZN3WTF14FastMallocZone10statisticsEP14_malloc_zone_tP19malloc_statistics_t
+__ZN3JSC4Heap26protectedGlobalObjectCountEv
+__ZN3JSC10JSFunction15argumentsGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC11Interpreter17retrieveArgumentsEPNS_9ExecStateEPNS_10JSFunctionE
+__ZN3JSCL21dateProtoFuncSetMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23setNewValueFromDateArgsEPNS_9ExecStateENS_7JSValueERKNS_7ArgListEib
+__ZN3JSCL20dateProtoFuncSetDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIPNS0_IN3JSC10RegisterIDELm32EEELm32EE14expandCapacityEm
+__ZN3JSC8JITStubs14cti_op_pre_incEPPv
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm16EE14expandCapacityEm
+__ZN3JSC13UnaryPlusNodeD0Ev
+__ZN3JSC3JIT19emit_op_to_jsnumberEPNS_11InstructionE
+__ZN3JSC3JIT23emitSlow_op_to_jsnumberEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs18cti_op_to_jsnumberEPPv
+__ZN3JSC6JSLock12DropAllLocksC1Eb
+__ZN3JSCL17createJSLockCountEv
+__ZN3JSC6JSLock12DropAllLocksD1Ev
+__ZN3JSCL24dateProtoFuncSetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_14OffsetLocationENS_7StrHashIS5_EENS_10HashTraitsIS5_EENS9_IS6_EEE3addEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_14OffsetLocationEENS_18PairFirstExtractorIS8_EENS_7StrHashIS5_
+__ZN3JSC3JIT21emit_op_switch_stringEPNS_11InstructionE
+__ZN3JSC8JITStubs20cti_op_switch_stringEPPv
+__ZN3WTF6VectorIN3JSC14ExecutablePool10AllocationELm2EE14expandCapacityEm
+__ZN3JSC12JSGlobalData6createEb
+__ZN3JSCL13allocateBlockILNS_8HeapTypeE1EEEPNS_14CollectorBlockEv
+__ZN3JSC7JSValueC1EPNS_9ExecStateEd
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RK
+__ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_16InternalFunctionEj
+__ZN3JSC7CStringD1Ev
+__ZN3WTF7HashMapIPvjNS_7PtrHashIS1_EEN3JSC17JSValueHashTraitsENS_10HashTraitsIjEEE3addERKS1_RKj
+__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncExprNodeEEELm0EE14shrinkCapacityEm
+__ZN3JSC14ExpressionNodeD2Ev
+__ZThn12_N3JSC11ProgramNodeD0Ev
+__ZThn12_N3JSC12FuncExprNodeD0Ev
+__ZThn12_N3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC8JITStubs16cti_op_new_arrayEPvz
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator10emitOpcodeENS_8OpcodeIDE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_3X8610RegisterIDES2_
+__ZN3JSC8JITStubs15cti_op_new_funcEPvz
+__ZN3JSC8JITStubs21cti_op_resolve_globalEPvz
+__ZN3JSC8JITStubs16cti_op_get_by_idEPvz
+__ZN3JSC8JITStubs31cti_op_construct_NotJSConstructEPvz
+__ZN3JSC8JITStubs16cti_op_put_by_idEPvz
+__ZN3JSC8JITStubs13cti_op_strcatEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_funcEPvz
+__ZN3JSC8JITStubs23cti_vm_dontLazyLinkCallEPvz
+__ZN3JSC8JITStubs22cti_op_call_JSFunctionEPvz
+__ZN3JSC8JITStubs23cti_register_file_checkEPvz
+__ZN3JSC8JITStubs13cti_op_negateEPvz
+__ZN3JSC8JITStubs28cti_op_construct_JSConstructEPvz
+__ZN3JSC23MacroAssemblerX86Common12branchTest32ENS0_9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressENS4_5Imm
+__ZN3JSC8JITStubs23cti_op_put_by_val_arrayEPvz
+__ZN3JSC8JITStubs23cti_op_put_by_id_secondEPvz
+__ZN3JSC15AssemblerBuffer14executableCopyEPNS_14ExecutablePoolE
+__ZN3JSC12X86Assembler8sarl_i8rEiNS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC8JITStubs10cti_op_mulEPvz
+__ZN3JSC12jsNumberCellEPNS_12JSGlobalDataEd
+__ZN3JSC8JITStubs10cti_op_subEPvz
+__ZN3JSC8JITStubs10cti_op_divEPvz
+__ZN3JSC8JITStubs23cti_op_get_by_id_secondEPvz
+__ZN3JSC8JITStubs19cti_vm_lazyLinkCallEPvz
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs19cti_op_convert_thisEPvz
+__ZN3JSC8JITStubs21cti_op_put_by_id_failEPvz
+__ZN3JSC8JITStubs10cti_op_addEPvz
+__ZN3JSC8JITStubs17cti_timeout_checkEPvz
+__ZN3JSC9jsBooleanEb
+__ZN3JSC9CodeBlock19isKnownNotImmediateEi
+__ZN3JSC12X86Assembler8movsd_mrEiNS_3X8610RegisterIDENS1_13XMMRegisterIDE
+__ZN3JSC8JITStubs25cti_op_call_NotJSFunctionEPvz
+__ZNK3JSC12JSNumberCell8toNumberEPNS_9ExecStateE
+__ZN3JSC8JITStubs26cti_op_get_by_id_self_failEPvz
+__ZN3JSC8JITStubs10cti_op_endEPvz
+__ZThn12_N3JSC12FuncDeclNodeD0Ev
+__ZN3JSC8JITStubs24cti_op_resolve_with_baseEPvz
+__ZN3JSC8JITStubs19cti_op_new_func_expEPvz
+__ZN3JSC8JITStubs22cti_op_push_activationEPvz
+__ZN3JSC8JITStubs17cti_op_get_by_valEPvz
+__ZN3JSC8JITStubs22cti_op_call_arityCheckEPvz
+__ZN3JSC8JITStubs11cti_op_lessEPvz
+__ZN3JSC12JSNumberCell18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_listEPvz
+__ZN3JSC8JITStubs12cti_op_jtrueEPvz
+__ZN3JSC8JITStubs10cti_op_modEPvz
+__ZN3JSC8JITStubs10cti_op_neqEPvz
+__ZN3JSC8JITStubs12cti_op_jlessEPvz
+__ZN3JSC8JITStubs24cti_op_get_by_id_genericEPvz
+__ZN3JSC8JITStubs14cti_op_jlesseqEPvz
+__ZN3JSC8JITStubs26cti_op_tear_off_activationEPvz
+__ZN3JSC8JITStubs21cti_op_ret_scopeChainEPvz
+__ZN3JSC8JITStubs19cti_op_to_primitiveEPvz
+__ZNK3JSC12JSNumberCell8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs13cti_op_bitandEPvz
+__ZN3JSC8JITStubs13cti_op_lshiftEPvz
+__ZN3JSC8JITStubs13cti_op_bitnotEPvz
+__ZNK3JSC12JSNumberCell9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JITStubs14cti_op_urshiftEPvz
+__ZNK3JSC12JSNumberCell18getTruncatedUInt32ERj
+__ZN3JSC4Yarr14RegexGenerator28generateCharacterClassSingleERNS1_19TermGenerationStateE
+__ZN3WTF15deleteAllValuesIPN3JSC4Yarr18PatternDisjunctionELm4EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC8JITStubs17cti_op_new_regexpEPvz
+__ZN3JSC8JITStubs12cti_op_bitorEPvz
+__ZNK3JSC12JSNumberCell17getTruncatedInt32ERi
+__ZN3JSC8JITStubs13cti_op_rshiftEPvz
+__ZN3JSC8JITStubs13cti_op_bitxorEPvz
+__ZN3WTF7HashSetINS_6RefPtrIN3JSC7UString3RepEEENS2_17IdentifierRepHashENS_10HashTraitsIS5_EEE3addERKS5_
+__ZN3JSC8JITStubs9cti_op_eqEPvz
+__ZN3JSC8JITStubs16cti_op_call_evalEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_skipEPvz
+__ZN3JSC8JITStubs17cti_op_new_objectEPvz
+__ZN3JSC8JITStubs14cti_op_resolveEPvz
+__ZN3JSC8JITStubs17cti_op_put_by_valEPvz
+__ZN3JSC8JITStubs18cti_op_switch_charEPvz
+__ZN3JSC8JITStubs28cti_op_get_by_id_string_failEPvz
+__ZThn12_N3JSC8EvalNodeD0Ev
+__ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEm
+__ZN3JSC8JITStubs17cti_op_get_pnamesEPvz
+__ZN3JSC8JITStubs17cti_op_next_pnameEPvz
+__ZN3WTF7HashSetIPN3JSC20MarkedArgumentBufferENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3JSC8JITStubs24cti_op_get_by_val_stringEPvz
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE28CharacterClassParserDelegate25atomBuiltInCharacterClassENS0_23BuiltInChar
+__ZN3JSC12jsNumberCellEPNS_9ExecStateEd
+__ZN3JSC8JITStubs18cti_op_is_functionEPvz
+__ZN3JSC8JITStubs16cti_op_is_objectEPvz
+__ZN3JSC8JITStubs16cti_op_nstricteqEPvz
+__ZN3JSC8JITStubs13cti_op_lesseqEPvz
+__ZNK3JSC12JSNumberCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSC4Yarr14RegexGenerator27generateCharacterClassFixedERNS1_19TermGenerationStateE
+__ZN3JSC4Heap7destroyEv
+__ZN3JSC12JSGlobalDataD1Ev
+__ZN3JSC12JSGlobalDataD2Ev
+__ZN3JSC12RegisterFileD1Ev
+__ZNK3JSC9HashTable11deleteTableEv
+__ZN3JSC5LexerD1Ev
+__ZN3JSC5LexerD2Ev
+__ZN3WTF20deleteAllPairSecondsIP24OpaqueJSClassContextDataKNS_7HashMapIP13OpaqueJSClassS2_NS_7PtrHashIS5_EENS_10HashTraitsIS5_E
+__ZN3JSC17CommonIdentifiersD2Ev
+__ZN3JSC21deleteIdentifierTableEPNS_15IdentifierTableE
+__ZN3JSC4HeapD1Ev
+__ZN3JSC12SmallStringsD1Ev
+__ZN3JSCL16mathProtoFuncMinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL17arrayProtoFuncPopEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray3popEv
+__ZN3JSC11DoWhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11DoWhileNodeD0Ev
+__ZN3JSC3JIT18emit_op_switch_immEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_switch_immEPPv
+__ZN3JSC13UnaryPlusNode14stripUnaryPlusEv
+__ZN3JSC15globalFuncIsNaNEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17NumberConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callNumberConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE14expandCapacityEm
+__ZN3JSC8JITStubs19cti_op_is_undefinedEPvz
+__ZN3JSC8JITStubs13cti_op_typeofEPvz
+__ZN3JSC8JITStubs33cti_op_create_arguments_no_paramsEPvz
+__ZN3JSC8JITStubs19cti_op_load_varargsEPvz
+__ZN3JSC8JITStubs10cti_op_notEPvz
+__ZN3JSC8JITStubs16cti_op_is_stringEPvz
+__ZN3JSCL24regExpConstructorDollar1EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs20cti_op_switch_stringEPvz
+__ZN3JSC9Arguments3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs18cti_op_to_jsnumberEPvz
+__ZN3JSC8JITStubs19cti_op_loop_if_lessEPvz
+__ZN3JSC9LabelNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9LabelNodeD0Ev
+__ZNK3JSC7UString5asciiEv
+__ZN3JSC8JITStubs27cti_op_get_by_id_array_failEPvz
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiPv
+__ZN3JSC8JITStubs23cti_op_create_argumentsEPvz
+__ZN3JSCL21arrayProtoFuncUnShiftEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs25cti_op_tear_off_argumentsEPvz
+__ZN3JSC7JSArray11sortNumericEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3JSC7JSArray17compactForSortingEv
+__ZN3JSCL22compareNumbersForQSortEPKvS1_
+__ZN3JSC8JITStubs15cti_op_post_incEPPv
+__ZN3JSC8JITStubs24cti_op_put_by_id_genericEPvz
+__ZN3JSCL24regExpConstructorDollar2EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar3EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar4EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar5EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar6EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL21stringProtoFuncSubstrEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23stringProtoFuncFontsizeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncToUTCStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL19stringProtoFuncLinkEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL9dateParseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs21cti_op_loop_if_lesseqEPPv
+__ZN3JSCL16mathProtoFuncExpEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC4Yarr17nonwordcharCreateEv
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternDisjunctionELm4EE14expandCapacityEmPKS4_
+__Z15jsc_pcre_xclassiPKh
+__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC28globalFuncDecodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs27cti_op_get_by_id_array_failEPPv
+__ZNK3JSC9Arguments9classInfoEv
+__ZN3JSC9Arguments15copyToRegistersEPNS_9ExecStateEPNS_8RegisterEj
+__ZN3JSC19JSStaticScopeObject4markEv
+__ZN3JSC8JITStubs19cti_op_loop_if_lessEPPv
+__ZN3JSC8JITStubs16cti_op_del_by_idEPvz
+__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC7UString6appendEPKti
+__ZN3JSC8JITStubs17cti_op_push_scopeEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_baseEPvz
+__ZN3JSC8JITStubs16cti_op_pop_scopeEPvz
+__ZN3JSC8JITStubs17cti_op_is_booleanEPvz
+__ZN3JSCL20arrayProtoFuncSpliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_jmp_scopesEPvz
+__ZN3JSC8JITStubs9cti_op_inEPvz
+__ZN3JSC8JITStubs15cti_op_stricteqEPvz
+__ZN3JSC8JITStubs32cti_op_get_by_id_proto_list_fullEPvz
+__ZN3WTF6VectorIiLm8EE14expandCapacityEm
+__ZN3JSCL21stringProtoFuncSearchEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs12cti_vm_throwEPvz
+__ZN3JSC8JITStubs21cti_op_push_new_scopeEPvz
+__ZN3JSC8JITStubs16cti_op_is_numberEPvz
+__ZN3JSC16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZNK3JSC8JSString8toObjectEPNS_9ExecStateE
+__ZN3JSC12StringObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9ExecState11stringTableEPS0_
+__ZN3JSC11JSImmediate8toObjectENS_7JSValueEPNS_9ExecStateE
+__ZN3JSC36constructBooleanFromImmediateBooleanEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC13BooleanObjectD1Ev
+__ZN3JSCL17arrayProtoFuncMapEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArrayC2EN3WTF10PassRefPtrINS_9StructureEEEj
+__ZN3JSC8JITStubs17cti_op_del_by_valEPvz
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_failEPvz
+__ZN3JSC10JSFunction12callerGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
+__ZN3JSC18globalFuncIsFiniteEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC12JSNumberCell8toObjectEPNS_9ExecStateE
+__ZN3JSC15constructNumberEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC12NumberObject11getJSNumberEv
+__ZN3JSCL7dateNowEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12NumberObjectD1Ev
+__ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSCL22numberProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC19JSStaticScopeObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
+__ZN3JSCL18arrayProtoFuncSomeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC12JSNumberCell11getJSNumberEv
+__ZN3JSC23createNotAFunctionErrorEPNS_9ExecStateENS_7JSValueEjPNS_9CodeBlockE
+__ZN3JSC17PrefixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17PrefixBracketNodeD0Ev
+__ZN3JSC17RegExpConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callRegExpConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray4sortEPNS_9ExecStateE
+__ZN3JSCL27dateProtoFuncSetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncSetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23setNewValueFromTimeArgsEPNS_9ExecStateENS_7JSValueERKNS_7ArgListEib
+__ZN3JSC8JITStubs17cti_op_switch_immEPvz
+__ZN3JSC12RegExpObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSCL24setRegExpObjectLastIndexEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSCL28regExpConstructorLeftContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC10JSFunction12lengthGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC12NumberObject9classInfoEv
+__ZN3JSC8JITStubs12cti_op_throwEPvz
+__ZN3JSCL19isNonASCIIIdentPartEi
+__ZN3JSCL27dateProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16formatLocaleDateEPNS_9ExecStateEPNS_12DateInstanceEdNS_20LocaleDateTimeFormatERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncSetHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncSetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncSetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28dateProtoFuncSetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12JSNumberCell12toThisObjectEPNS_9ExecStateE
+__ZN3JSC16ErrorConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL20callErrorConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunctionC2EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunction11getCallDataERNS_8CallDataE
+__ZN3JSC17PrototypeFunctionD1Ev
+__ZN3JSCL24booleanProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17BytecodeGenerator18emitJumpSubroutineEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC3JIT11emit_op_jsrEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC3JIT7JSRInfoELm0EE14expandCapacityEm
+__ZN3JSC3JIT12emit_op_sretEPNS_11InstructionE
+__ZN3JSC6Parser7reparseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_12JSGlobalDataEPS5_
+__ZN3JSC8EvalNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IPNS_12Func
+__ZN3JSC8EvalNode31bytecodeForExceptionInfoReparseEPNS_14ScopeChainNodeEPNS_9CodeBlockE
+__ZN3JSC20FixedVMPoolAllocator17coalesceFreeSpaceEv
+__ZN3WTF6VectorIPN3JSC13FreeListEntryELm0EE15reserveCapacityEm
+__ZN3JSCL35reverseSortFreeListEntriesByPointerEPKvS1_
+__ZN3JSC14globalFuncEvalEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21functionProtoFuncCallEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL22functionProtoFuncApplyEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC9Arguments11fillArgListEPNS_9ExecStateERNS_20MarkedArgumentBufferE
+__ZNK3JSC7JSValue12toThisObjectEPNS_9ExecStateE
+__ZN3JSC8VoidNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8VoidNodeD0Ev
+__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF10PassRefPtrINS_9StructureEEERKNS_10IdentifierE
+__ZN3JSC20MarkedArgumentBuffer9markListsERN3WTF7HashSetIPS0_NS1_7PtrHashIS3_EENS1_10HashTraitsIS3_EEEE
+__ZN3JSC7CStringaSERKS0_
+__ZNK3JSC19JSStaticScopeObject14isDynamicScopeEv
+__ZN3JSCL33reverseSortCommonSizedAllocationsEPKvS1_
+__ZN3JSCL20arrayProtoFuncFilterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17NumberConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithNumberConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEb
+__ZN3JSC8JITStubs12cti_op_throwEPPv
+__ZN3JSC6JSCell9getObjectEv
+__ZN3JSCL21arrayProtoFuncReverseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject16isVariableObjectEv
+__ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSCL27compareByStringPairForQSortEPKvS1_
+__Z22jsc_pcre_ucp_othercasej
+__ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
+__ZN3WTF7HashMapIjN3JSC7JSValueENS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3setERKjRKS2_
+__ZN3WTF9HashTableIjSt4pairIjN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEE
+__ZN3JSC12RegisterFile21releaseExcessCapacityEv
+__ZN3JSCL20isNonASCIIIdentStartEi
+__ZN3JSC17BytecodeGenerator14emitPutByIndexEPNS_10RegisterIDEjS2_
+__ZN3JSC3JIT20emit_op_put_by_indexEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_put_by_indexEPPv
+__ZN3JSCL25numberConstructorMaxValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL28numberConstructorPosInfinityEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL28numberConstructorNegInfinityEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC18BooleanConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL22callBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL17mathProtoFuncATanEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_jmp_scopesEPPv
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
+__ZN3JSCL17mathProtoFuncASinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEPNS_14ScopeChainNodeEPNS_7JSValueE
 _JSContextGetGlobalObject
+__ZN3JSC4Heap14registerThreadEv
+__ZN3JSC6JSLockC1EPNS_9ExecStateE
+_JSStringCreateWithUTF8CString
+__ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_b
 _JSClassCreate
 __ZN13OpaqueJSClass6createEPK17JSClassDefinition
 __ZN13OpaqueJSClassC2EPK17JSClassDefinitionPS_
+__ZN3JSC7UString3Rep14createFromUTF8EPKc
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEP19StaticFunctionEntryNS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3addERKS
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_P19StaticFunctionEntryENS_18PairFirstExtractorIS9_EENS_7StrHashIS5
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEP16StaticValueEntryNS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3addERKS5_R
 _JSClassRetain
 _JSObjectMake
-__ZN13OpaqueJSClass9prototypeEPK15OpaqueJSContext
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE4initEPNS_9ExecStateE
-_JSStringCreateWithUTF8CString
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE4initEPNS_9ExecStateE
+__ZN13OpaqueJSClass9prototypeEPN3JSC9ExecStateE
+__ZN13OpaqueJSClass11contextDataEPN3JSC9ExecStateE
+__ZN3WTF9HashTableIP13OpaqueJSClassSt4pairIS2_P24OpaqueJSClassContextDataENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14Pa
+__ZN24OpaqueJSClassContextDataC2EP13OpaqueJSClass
+__ZN3JSC7UString3Rep13createCopyingEPKti
 _JSObjectSetProperty
+__ZNK14OpaqueJSString10identifierEPN3JSC12JSGlobalDataE
+__ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
 _JSStringRelease
-__Z30makeGetterOrSetterPropertyNodeRKN3KJS10IdentifierES2_PNS_13ParameterNodeEPNS_16FunctionBodyNodeE
-__ZN3KJS8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
-__ZN3KJS8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
-__ZNK3KJS15GetterSetterImp4typeEv
-__ZNK3KJS8JSObject6canPutEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS13ConstDeclNodeC1ERKNS_10IdentifierEPNS_14ExpressionNodeE
-__Z26appendToVarDeclarationListRPN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEEPNS_13ConstDeclNodeE
-__ZN3KJS18ConstStatementNodeC1EPNS_13ConstDeclNodeE
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE20staticFunctionGetterEPNS_9ExecStateEPS1_RKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS18JSCallbackFunctionC1EPNS_9ExecStateEPFPK13OpaqueJSValuePK15OpaqueJSContextPS3_S9_mPKS5_PS5_ERKNS_10IdentifierE
-__ZN3KJS18JSCallbackFunction14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE20staticFunctionGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC18JSCallbackFunctionC1EPNS_9ExecStateEPFPK13OpaqueJSValuePK15OpaqueJSContextPS3_S9_mPKS5_PS5_ERKNS_10IdentifierE
+__ZN3JSC18JSCallbackFunction11getCallDataERNS_8CallDataE
+__ZN3JSC18JSCallbackFunction4callEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
 _JSObjectGetPrivate
-__ZNK3KJS16JSCallbackObjectINS_8JSObjectEE9classInfoEv
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE9classInfoEv
+_JSValueMakeUndefined
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE17staticValueGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN14OpaqueJSString6createERKN3JSC7UStringE
 _JSStringCreateWithCharacters
 _JSValueMakeString
-__ZN3KJS12PropertySlot14functionGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKS0_
-__ZN3WTF10fastCallocEmm
+__ZNK14OpaqueJSString7ustringEv
+__ZN3JSC7UStringC1EPtib
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEED1Ev
+_JSClassRelease
+__ZL25clearReferenceToPrototypeP13OpaqueJSValue
 _JSObjectGetProperty
 _JSValueToObject
-_JSValueProtect
-_JSObjectCallAsFunction
-_JSValueMakeNumber
+__ZN3JSCL22dateProtoFuncGetUTCDayEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncGetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL27dateProtoFuncGetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString8toUInt32EPb
+__ZN3JSCL24dateProtoFuncGetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncGetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncGetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL7dateUTCEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12RegExpObject11getCallDataERNS_8CallDataE
+__ZN3JSC9Arguments14deletePropertyEPNS_9ExecStateEj
 _JSValueMakeBoolean
-_JSObjectCallAsConstructor
-__ZN3KJS15GetterSetterImp4markEv
-_JSValueMakeUndefined
-_JSValueUnprotect
-_JSValueIsNumber
 _JSValueToNumber
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEED0Ev
-__Z25clearReferenceToPrototypeP13OpaqueJSValue
-_JSClassRelease
-_JSStringIsEqualToUTF8CString
-_JSStringIsEqual
-__ZN3KJSeqERKNS_7UStringES2_
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE14callbackGetterEPNS_9ExecStateEPS1_RKNS_10IdentifierERKNS_12PropertySlotE
 _JSStringCreateWithCFString
-__ZN3KJS7UStringC2EPNS_5UCharEib
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
+__ZN3WTF13tryFastCallocEmm
+_JSValueMakeNumber
+__ZN3JSC18JSCallbackFunctionD1Ev
+_JSValueToStringCopy
+_JSStringCopyCFString
+__ZN3JSC18ConstStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode14emitCodeSingleERNS_17BytecodeGeneratorE
+__ZN3JSC13ConstDeclNodeD0Ev
+__ZN3JSC18ConstStatementNodeD0Ev
+__ZN3JSC18BooleanConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL31constructWithBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC16constructBooleanEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28dateProtoFuncGetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL31dateProtoFuncToLocaleTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21regExpObjectLastIndexEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC21DebuggerStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21DebuggerStatementNodeD0Ev
+__ZN3JSC4Yarr12RegexPattern21newlineCharacterClassEv
+__ZN3JSC17ObjectConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL23dateProtoFuncSetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26stringFromCharCodeSlowCaseEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL21callObjectConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL27objectProtoFuncDefineGetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
+__ZN3JSC12GetterSetter4markEv
+__ZN3JSC12GetterSetterD1Ev
+__ZN3JSCL22regExpProtoFuncCompileEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC17NumberConstructor9classInfoEv
+__ZNK3JSC17RegExpConstructor9classInfoEv
+__ZN3JSCL31dateProtoFuncToLocaleDateStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject14isGlobalObjectEv
+_JSValueToBoolean
+__ZN3JSC8JITStubs13cti_op_lshiftEPPv
+__ZN3JSC8JITStubs13cti_op_bitnotEPPv
+__ZN3JSC6JSCell3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC19FunctionConstructor11getCallDataERNS_8CallDataE
+__ZN3WTF9ByteArray6createEm
+__ZNK3JSC6JSCell9getStringERNS_7UStringE
+__ZN3JSC3JIT12emit_op_loopEPNS_11InstructionE
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
+__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArrayC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC11JSByteArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC11JSByteArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JITStubs28cti_op_get_by_val_byte_arrayEPPv
+__ZN3JSC8JITStubs28cti_op_put_by_val_byte_arrayEPPv
+__ZL30makeGetterOrSetterPropertyNodePvRKN3JSC10IdentifierES3_PNS0_13ParameterNodeEPNS0_16FunctionBodyNodeERKNS0_10SourceCodeE
+__ZN3JSC17BytecodeGenerator13emitPutGetterEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC17BytecodeGenerator13emitPutSetterEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC3JIT18emit_op_put_getterEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_put_setterEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_put_getterEPPv
+__ZN3JSC8JITStubs17cti_op_put_setterEPPv
+__ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
+__ZNK3JSC12GetterSetter14isGetterSetterEv
+__ZNK3JSC6JSCell14isGetterSetterEv
+__ZN3JSCL29regExpConstructorRightContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC5Lexer19copyCodeWithoutBOMsEv
+__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC6JSCell16getConstructDataERNS_13ConstructDataE
+__ZN3JSC26createNotAConstructorErrorEPNS_9ExecStateENS_7JSValueEjPNS_9CodeBlockE
+__ZN3JSC15isStrWhiteSpaceEt
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
+__ZNK3JSC22NativeErrorConstructor9classInfoEv
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE9classNameEv
+__ZN3JSC4Heap11objectCountEv
+__ZNK3JSC12SmallStrings5countEv
+__ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
+__ZN3JSCL27objectProtoFuncLookupGetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12lookupGetterEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSCL27objectProtoFuncDefineSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
+__ZN3JSC9Structure22getterSetterTransitionEPS0_
+__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_7JSValueE
+__ZN3JSC12PropertySlot14functionGetterEPNS_9ExecStateERKNS_10IdentifierERKS0_
+__ZN3JSCL28objectProtoFuncIsPrototypeOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringE
+__ZNK3JSC7UString6is8BitEv
+__ZN3JSC8JSObject15unwrappedObjectEv
+__ZN3JSC22NativeErrorConstructor11getCallDataERNS_8CallDataE
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE11getCallDataERNS_8CallDataE
+__ZN3JSC17BytecodeGenerator21emitComplexJumpScopesEPNS_5LabelEPNS_18ControlFlowContextES4_
+__ZN3JSC23ThrowableExpressionData14emitThrowErrorERNS_17BytecodeGeneratorENS_9ErrorTypeEPKc
+__ZN3JSC17BytecodeGenerator12emitNewErrorEPNS_10RegisterIDENS_9ErrorTypeENS_7JSValueE
+__ZN3JSC3JIT17emit_op_new_errorEPNS_11InstructionE
+__ZN3JSC23MacroAssemblerX86Common8branch16ENS0_9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE9BaseIndexENS4_5Imm32E
+_JSStringRetain
+__ZN3JSCL19arrayProtoFuncEveryEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL20arrayProtoFuncReduceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25arrayProtoFuncReduceRightEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28arrayProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25arrayProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC15AssignErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8JITStubs16cti_op_new_errorEPPv
+__ZN3JSC15AssignErrorNodeD0Ev
+__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEd
+__ZN3JSC19JSStaticScopeObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC9ExecState9dateTableEPS0_
+__ZNK3JSC15RegExpPrototype9classInfoEv
+__ZN3JSC12StringObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSCL25dateProtoFuncToDateStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25dateProtoFuncToTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25numberConstructorNaNValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL31dateProtoFuncSetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncSetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncSetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncSetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23throwStackOverflowErrorEPNS_9ExecStateEPNS_12JSGlobalDataEPvRS4_
+__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
+__ZN3JSC15DeleteValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15DeleteValueNodeD0Ev
+__ZN3JSC16PostfixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15PrefixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16PostfixErrorNodeD0Ev
+__ZN3JSC15PrefixErrorNodeD0Ev
+__ZN3JSC23createInvalidParamErrorEPNS_9ExecStateEPKcNS_7JSValueEjPNS_9CodeBlockE
+__ZNK3JSC15DotAccessorNode17isDotAccessorNodeEv
+__ZNK3JSC14ExpressionNode17isDotAccessorNodeEv
+__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC4Heap24setGCProtectNeedsLockingEv
+__ZN3JSCL23callFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs17cti_op_instanceofEPPv
+__ZN3JSC17BytecodeGenerator35emitThrowExpressionTooDeepExceptionEv
+__ZN3JSCL25numberConstructorMinValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL17mathProtoFuncACosEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18mathProtoFuncATan2EPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncTanEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28numberProtoFuncToExponentialEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26numberProtoFuncToPrecisionEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL12charSequenceEci
+__ZN3JSCL29objectProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
+__ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
+__ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
+__ZN3JSC9ExecState22regExpConstructorTableEPS0_
+__ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar9EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL22regExpConstructorInputEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL25setRegExpConstructorInputEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSCL26regExpConstructorLastMatchEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL26regExpConstructorLastParenEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL26regExpConstructorMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL29setRegExpConstructorMultilineEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSC4Yarr15nondigitsCreateEv
+__ZNK3JSC19JSStaticScopeObject12toThisObjectEPNS_9ExecStateE
+__ZN3JSC12JSActivation18getArgumentsGetterEv
+__ZN3JSC12JSActivation15argumentsGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL23booleanProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28stringProtoFuncLocaleCompareEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF8Collator11userDefaultEv
+__ZNK3WTF8Collator7collateEPKtmS2_m
+__ZNK3WTF8Collator14createCollatorEv
+__ZN3WTF8CollatorD1Ev
+__ZN3WTF8Collator15releaseCollatorEv
+__ZNK3JSC10MathObject9classInfoEv
+__ZN3JSC9ExecState9mathTableEPS0_
+__ZN3WTF6VectorIN3JSC20FunctionRegisterInfoELm0EE14expandCapacityEm
+__ZN3JSC3JIT25emit_op_profile_will_callEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_profile_did_callEPNS_11InstructionE
+__ZN3JSC8Profiler8profilerEv
+__ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
+__ZN3JSC16ProfileGenerator6createERKNS_7UStringEPNS_9ExecStateEj
+__ZN3JSC16ProfileGeneratorC2ERKNS_7UStringEPNS_9ExecStateEj
+__ZN3JSC7Profile6createERKNS_7UStringEj
+__ZN3JSC7ProfileC2ERKNS_7UStringEj
+__ZN3JSC11ProfileNodeC1ERKNS_14CallIdentifierEPS0_S4_
+__ZN3JSC33getCurrentUTCTimeWithMicrosecondsEv
+__ZN3JSC16ProfileGenerator24addParentForConsoleStartEPNS_9ExecStateE
+__ZN3JSC8Profiler20createCallIdentifierEPNS_12JSGlobalDataENS_7JSValueERKNS_7UStringEi
+__ZN3JSC16InternalFunction21calculatedDisplayNameEPNS_12JSGlobalDataE
+__ZN3JSC11ProfileNode10insertNodeEN3WTF10PassRefPtrIS0_EE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC11ProfileNodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC16ProfileGeneratorEEELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs23cti_op_profile_did_callEPPv
+__ZN3JSC8Profiler10didExecuteEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ProfileGenerator10didExecuteERKNS_14CallIdentifierE
+__ZN3JSC11ProfileNode10didExecuteEv
+__ZN3JSC8JITStubs24cti_op_profile_will_callEPPv
+__ZN3JSC8Profiler11willExecuteEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ProfileGenerator11willExecuteERKNS_14CallIdentifierE
+__ZN3JSC11ProfileNode11willExecuteERKNS_14CallIdentifierE
+__ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
+__ZN3JSC16ProfileGenerator13stopProfilingEv
+__ZN3JSC7Profile7forEachEMNS_11ProfileNodeEFvvE
+__ZNK3JSC11ProfileNode25traverseNextNodePostOrderEv
+__ZN3JSC11ProfileNode13stopProfilingEv
+__ZN3JSCeqERKNS_7UStringEPKc
+__ZN3JSC11ProfileNode11removeChildEPS0_
+__ZN3JSC11ProfileNode8addChildEN3WTF10PassRefPtrIS0_EE
+_JSValueIsObjectOfClass
+_JSObjectCallAsConstructor
+__ZN3JSC9constructEPNS_9ExecStateENS_7JSValueENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
+_JSObjectCallAsFunction
+__ZN3JSC4Heap14primaryHeapEndEv
+__ZN3JSC4Heap16primaryHeapBeginEv
+__ZNK3JSC18JSCallbackFunction9classInfoEv
+__ZN3JSC8Profiler11willExecuteEPNS_9ExecStateERKNS_7UStringEi
+__ZN3JSC8Profiler10didExecuteEPNS_9ExecStateERKNS_7UStringEi
+__ZNK3JSC16ProfileGenerator5titleEv
+__ZN3JSC7ProfileD0Ev
+__ZN3WTF10RefCountedIN3JSC11ProfileNodeEE5derefEv
+__ZN3JSC4Yarr14RegexGenerator33generatePatternCharacterNonGreedyERNS1_19TermGenerationStateE
+__ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
+__ZNK3JSC25InterruptedExecutionError19isWatchdogExceptionEv
+__ZN3JSC25InterruptedExecutionErrorD1Ev
+__ZN3JSC12JSGlobalData10ClientDataD2Ev
+__ZN3JSC18RegExpMatchesArray16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3WTF8CollatorC1EPKc
+__ZN3WTF8Collator18setOrderLowerFirstEb
+__ZN3WTF12randomNumberEv
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZNK3JSC6JSCell9getStringEv
+__ZNK3JSC12DateInstance7getTimeERdRi
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringE
+_JSGlobalContextCreate
+_JSGlobalContextCreateInGroup
+__ZN3JSC4Heap29makeUsableFromMultipleThreadsEv
+_JSGlobalContextRetain
+__ZN3JSC6JSLock6unlockEb
+_JSEvaluateScript
+__ZNK3JSC14JSGlobalObject17supportsProfilingEv
+_JSGlobalContextRelease
+__ZN3JSC14JSGlobalObjectD1Ev
+__ZN3JSC14JSGlobalObject18JSGlobalObjectDataD0Ev
+__ZN3JSC17FunctionPrototype11getCallDataERNS_8CallDataE
+__ZN3JSC15DateConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL8callDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC13JSNotAnObject4markEv
+_JSObjectIsFunction
+__ZN3JSC4Heap17globalObjectCountEv
+__ZN3JSC4Heap20protectedObjectCountEv
+__ZN3JSC4Heap25protectedObjectTypeCountsEv
+__ZN3WTF9HashTableIPKcSt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_I
+__ZN3WTF20fastMallocStatisticsEv
+__ZNK3JSC4Heap10statisticsEv
+__ZN3WTF27releaseFastMallocFreeMemoryEv
+__ZN3JSC10JSFunction16getConstructDataERNS_13ConstructDataE
+__ZN3JSC10JSFunction9constructEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8Debugger6attachEPNS_14JSGlobalObjectE
+__ZN3WTF7HashSetIPN3JSC14JSGlobalObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3JSC3JIT13emit_op_debugEPNS_11InstructionE
+__ZN3JSC8JITStubs12cti_op_debugEPPv
+__ZN3JSC11Interpreter5debugEPNS_9ExecStateENS_11DebugHookIDEii
+__ZN3JSC8Debugger6detachEPNS_14JSGlobalObjectE
+__ZN3JSC9CodeBlock33functionRegisterForBytecodeOffsetEjRi
+_JSStringIsEqualToUTF8CString
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE14callbackGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 _JSObjectSetPrivate
-__ZN3KJS15GetterSetterImpD0Ev
-__ZN3KJS27objectProtoFuncLookupGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS17PreIncResolveNode10precedenceEv
-__ZNK3KJS10SwitchNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13CaseBlockNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14CaseClauseNode8streamToERNS_12SourceStreamE
-__ZN3KJS18ConstStatementNodeD1Ev
-__ZN3KJS17PreDecBracketNodeD1Ev
-__ZN3KJS11Interpreter24setShouldPrintExceptionsEb
-__ZN3KJS9Collector26protectedGlobalObjectCountEv
-__ZN3KJS9Collector4sizeEv
-__ZN3KJS9Collector17globalObjectCountEv
-__ZN3KJS9Collector20protectedObjectCountEv
-__ZN3KJS9Collector25protectedObjectTypeCountsEv
-__ZNK3KJS15NumberObjectImp9classInfoEv
-__ZNK3KJS15RegExpPrototype9classInfoEv
-__ZNK3KJS15RegExpObjectImp9classInfoEv
-__ZNK3KJS14NativeErrorImp9classInfoEv
-__ZNK3KJS13MathObjectImp9classInfoEv
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE14expandCapacityEm
-__ZN3KJS15ConditionalNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS9Arguments14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3KJS17DeleteBracketNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9BitOrNode10precedenceEv
-__ZNK3KJS9BitOrNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7ModNode10precedenceEv
-__ZNK3KJS7ModNode8streamToERNS_12SourceStreamE
-__ZN3KJS31dateProtoFuncToLocaleTimeStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16formatLocaleDateEPNS_9ExecStateEdbbRKNS_4ListE
-__ZN3KJS31dateProtoFuncToLocaleDateStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9BitOrNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS7DivNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS14BitwiseNotNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS13ActivationImp14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS27objectProtoFuncDefineGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17PreDecBracketNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS16BooleanObjectImp19implementsConstructEv
-__ZN3KJS27objectProtoFuncDefineSetterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPPNS_7JSValueE
-__ZN3KJS10StringNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13UnaryPlusNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17FunctionObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15DeleteValueNodeD1Ev
-__ZN3KJS15RegExpObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22dateProtoFuncGetUTCDayEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8MultNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS4Node18setErrorCompletionEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZN3KJS10StringNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS27dateProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22UnsignedRightShiftNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS18PostIncResolveNode10precedenceEv
-__ZNK3KJS21ReadModifyResolveNode10precedenceEv
-__ZNK3KJS21FunctionCallValueNode10precedenceEv
-__ZN3KJS4Node15handleExceptionEPNS_9ExecStateE
-__ZNK3KJS13UnaryPlusNode10precedenceEv
-__ZNK3KJS13UnaryPlusNode8streamToERNS_12SourceStreamE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueERKNS_10IdentifierE
-__ZNK3KJS15DotAccessorNode17isDotAccessorNodeEv
-__ZNK3KJS14PostfixDotNode10precedenceEv
-__ZN3KJS23regExpProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14PostDecDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9CommaNode10precedenceEv
-__ZNK3KJS17ReadModifyDotNode10precedenceEv
-__ZNK3KJS13DeleteDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS19PlaceholderTrueNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignBracketNode10precedenceEv
-__ZNK3KJS8WithNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17DeleteBracketNode10precedenceEv
-__ZN3KJS15ObjectObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-_KJS_JSCreateNativeJSObject
-__ZN3KJS8Bindings12JavaJSObject6invokeEPNS0_19JSObjectCallContextE
-__ZN3KJS8Bindings12JavaJSObject12createNativeEx
-__ZN3KJS8Bindings24findProtectingRootObjectEPNS_8JSObjectE
-_KJS_JSObject_JSObjectEval
-__ZN3KJS8Bindings12JavaJSObjectC1Ex
-__ZNK3KJS8Bindings12JavaJSObject4evalEP8_jstring
-__ZN3KJS8Bindings9getJNIEnvEv
-__ZN3KJS8Bindings9getJavaVMEv
-__ZN3KJS8Bindings30getUCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
-__ZN3KJS8Bindings33releaseUCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKt
-__ZNK3KJS8Bindings12JavaJSObject21convertValueToJObjectEPNS_7JSValueE
-__ZN7JNIEnv_9NewObjectEP7_jclassP10_jmethodIDz
-_KJS_JSObject_JSFinalize
-__ZN3KJS19stringProtoFuncBoldEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS15RegExpObjectImp15getRightContextEv
-__ZNK3KJS15RegExpObjectImp14getLeftContextEv
-__ZN3KJS13LeftShiftNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS7ModNode15evaluateToInt32EPNS_9ExecStateE
-__ZNK3KJS18PostDecResolveNode10precedenceEv
-__ZN3KJS28dateProtoFuncSetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS32stringProtoFuncToLocaleLowerCaseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__NPN_SetException
-__ZN3KJS18mathProtoFuncATan2EPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8Bindings12JavaInstanceC2EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings12JavaInstance5beginEv
-__ZNK3KJS8Bindings12JavaInstance8getClassEv
-__ZN3KJS8Bindings9JavaClassC2EP8_jobject
-__ZN3KJS8Bindings19callJNIObjectMethodEP8_jobjectPKcS4_z
-__ZN3KJS8Bindings13callJNIMethodE7JNITypeP8_jobjectPKcS5_Pc
-__ZN3KJS8Bindings24getCharactersFromJStringEP8_jstring
-__ZN3KJS8Bindings27releaseCharactersForJStringEP8_jstringPKc
-__ZN3KJS8Bindings9JavaFieldC2EP7JNIEnv_P8_jobject
-__ZN3KJS7CStringaSERKS0_
-__ZN3KJS8Bindings20JNITypeFromClassNameEPKc
-__ZN3KJS8Bindings14JObjectWrapperC1EP8_jobject
-__ZNK3KJS8Bindings9JavaField4nameEv
-__ZN3KJS8Bindings10JavaMethodC2EP7JNIEnv_P8_jobject
-__ZN3KJS8Bindings16callJNIIntMethodEP8_jobjectPKcS4_z
-__ZN3KJS8Bindings26callJNIStaticBooleanMethodEP7_jclassPKcS4_z
-__ZN3KJS8Bindings19callJNIStaticMethodE7JNITypeP7_jclassPKcS5_Pc
-__ZNK3KJS8Bindings10JavaMethod4nameEv
-__ZN3KJS8Bindings13JavaParameterC2EP7JNIEnv_P8_jstring
-__ZNK3KJS8Bindings9JavaClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3KJS8Bindings9JavaClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZN3KJS8Bindings12JavaInstance3endEv
-__ZN3KJS8Bindings12JavaInstanceD1Ev
-__ZN3KJS8Bindings9JavaClassD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN3KJS8Bindings5FieldEKNS_7HashMapINS_6RefPtrINS1_7UString3RepEEES4_NS_7PtrHashIS9_EENS_10HashTraitsIS9_EENSC_IS4_EEEEEEvRT0_
-__ZN3KJS8Bindings14JObjectWrapperD1Ev
-__ZN3KJS35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS31dateProtoFuncSetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS12FuncExprNode21needsParensIfLeftmostEv
-__ZN3KJS13DateObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11NewExprNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS29numberProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS25dateProtoFuncToDateStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9BitOrNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS7JSValue8toUInt32EPNS_9ExecStateE
-__ZNK3KJS8JSObject3getEPNS_9ExecStateEj
-__ZNK3KJS7JSValue16toUInt32SlowCaseEPNS_9ExecStateERb
-__ZN3KJS9Collector29markOtherThreadConservativelyEPNS0_6ThreadE
-__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
-__ZN3WTF20TCMalloc_ThreadCache11DeleteCacheEPS0_
-__ZN3KJS23destroyRegisteredThreadEPv
-__ZN3KJS28numberProtoFuncToExponentialEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26numberProtoFuncToPrecisionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15RegExpObjectImp16putValuePropertyEPNS_9ExecStateEiPNS_7JSValueEi
-__ZNK3KJS15RegExpObjectImp12getLastParenEv
-__ZN3KJS10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
-__ZN3KJS18arrayProtoFuncSomeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9LabelNode9pushLabelERKNS_10IdentifierE
-__ZN3KJS9Collector32reportOutOfMemoryToAllExecStatesEv
-__ZN3KJS5Error6createEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZNK3KJS17PreDecResolveNode10precedenceEv
-__ZN3KJS17mathProtoFuncACosEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16mathProtoFuncTanEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS16PostfixErrorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15PrefixErrorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15AssignErrorNode8streamToERNS_12SourceStreamE
-__ZN3KJS16PostfixErrorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcS5_
-__ZN3KJS16PostfixErrorNodeD1Ev
-__ZNK3KJS13LeftShiftNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13LeftShiftNode10precedenceEv
-__ZNK3KJS14RightShiftNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14RightShiftNode10precedenceEv
-__ZNK3KJS22UnsignedRightShiftNode8streamToERNS_12SourceStreamE
-__ZNK3KJS22UnsignedRightShiftNode10precedenceEv
-__ZNK3KJS10BitAndNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10BitAndNode10precedenceEv
-__ZNK3KJS10BitXOrNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10BitXOrNode10precedenceEv
-__ZN3KJS15AssignErrorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZN3KJS13char_sequenceEci
-__ZN3KJS15LessStringsNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15LessStringsNodeD1Ev
-__ZN3KJS15DeleteValueNode8evaluateEPNS_9ExecStateE
-__ZN3KJS22regExpProtoFuncCompileEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15PrefixErrorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS28objectProtoFuncIsPrototypeOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15PrefixErrorNodeD1Ev
-__ZN3KJS19arrayProtoFuncEveryEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS29objectProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS25arrayProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF6VectorItLm0EE6resizeEm
-__ZN3WTF6VectorItLm0EE14expandCapacityEm
-__ZN3WTF6VectorItLm0EE15reserveCapacityEm
-__ZN3KJS28arrayProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18ConstStatementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13ConstDeclNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18ConstStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS13ConstDeclNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15AssignConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PostIncConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PostDecConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15PreIncConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15PreDecConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19ReadModifyConstNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS13ActivationImp9classInfoEv
-__ZN3KJS16PostIncConstNodeD1Ev
-__ZN3KJS15PreIncConstNodeD1Ev
-__ZN3KJS15PreDecConstNodeD1Ev
-__ZNK3KJS13DeleteDotNode10precedenceEv
-__ZN3KJS28stringProtoFuncLocaleCompareEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10NumberNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode16evaluateToUInt32EPNS_9ExecStateE
-__ZNK3KJS21ReadModifyBracketNode8streamToERNS_12SourceStreamE
-__ZN3KJS10BitXOrNode16evaluateToNumberEPNS_9ExecStateE
-___tcf_1
-__ZNK3KJS7UString6is8BitEv
-__ZN3KJS15DotAccessorNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS24stringProtoFuncFontcolorEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14NativeErrorImp19implementsConstructEv
-__ZN3KJS19PostDecLocalVarNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS19PostDecLocalVarNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS13UnaryPlusNode17evaluateToBooleanEPNS_9ExecStateE
+__ZN3JSC7UString3Rep11computeHashEPKci
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+_JSGarbageCollect
+__ZN3JSC4Heap6isBusyEv
+__ZN3JSCL18styleFromArgStringERKNS_7UStringEl
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index dca935558b..a7da71c2b4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -1,30 +1,68 @@
 # JavaScriptCore - Qt4 build info
 VPATH += $$PWD
 
-INCLUDEPATH += tmp
-INCLUDEPATH += $$PWD $$PWD/parser $$PWD/bytecompiler $$PWD/debugger $$PWD/runtime $$PWD/wtf $$PWD/wtf/unicode $$PWD/interpreter $$PWD/jit $$PWD/profiler $$PWD/wrec $$PWD/API $$PWD/.. \
-               $$PWD/ForwardingHeaders $$PWD/bytecode $$PWD/assembler
-DEFINES += BUILDING_QT__
+CONFIG(debug, debug|release) {
+    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
+    OBJECTS_DIR = obj/release
+}
+
+INCLUDEPATH += $$GENERATED_SOURCES_DIR \
+               $$PWD \
+               $$PWD/parser \
+               $$PWD/bytecompiler \
+               $$PWD/debugger \
+               $$PWD/runtime \
+               $$PWD/wtf \
+               $$PWD/wtf/unicode \
+               $$PWD/interpreter \
+               $$PWD/jit \
+               $$PWD/profiler \
+               $$PWD/wrec \
+               $$PWD/yarr \
+               $$PWD/API \
+               $$PWD/.. \
+               $$PWD/ForwardingHeaders \
+               $$PWD/bytecode \
+               $$PWD/assembler \
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
+DEFINES += BUILDING_QT__ BUILDING_JavaScriptCore BUILDING_WTF
+
+GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
 win32-* {
-    GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
     LIBS += -lwinmm
 }
 
-# Disable the JIT due to numerous observed miscompilations :(
-CONFIG(release):isEqual(QT_ARCH,i386) {
-     JIT_DEFINES = ENABLE_JIT ENABLE_WREC ENABLE_JIT_OPTIMIZE_CALL ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS ENABLE_JIT_OPTIMIZE_ARITHMETIC
-     # Require gcc >= 4.1
-     linux-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
-         DEFINES += $$JIT_DEFINES WTF_USE_JIT_STUB_ARGUMENT_VA_LIST
-         QMAKE_CXXFLAGS += -fno-stack-protector
-         QMAKE_CFLAGS += -fno-stack-protector
-     }
-     win32-msvc* {
-         DEFINES += $$JIT_DEFINES WTF_USE_JIT_STUB_ARGUMENT_REGISTER
-     }
+# Default rules to turn JIT on/off
+!contains(DEFINES, ENABLE_JIT=.) {
+    isEqual(QT_ARCH,i386)|isEqual(QT_ARCH,windows) {
+        # Require gcc >= 4.1
+        CONFIG(release):linux-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
+            DEFINES += ENABLE_JIT=1
+        }
+        win32-msvc* {
+            DEFINES += ENABLE_JIT=1
+        }
+    }
+}
+
+# Rules when JIT enabled
+contains(DEFINES, ENABLE_JIT=1) {
+    !contains(DEFINES, ENABLE_YARR=.): DEFINES += ENABLE_YARR=1
+    !contains(DEFINES, ENABLE_YARR_JIT=.): DEFINES += ENABLE_YARR_JIT=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_CALL=.): DEFINES += ENABLE_JIT_OPTIMIZE_CALL=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS=.): DEFINES += ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_ARITHMETIC=.): DEFINES += ENABLE_JIT_OPTIMIZE_ARITHMETIC=1
+    linux-g++* {
+        !contains(DEFINES, WTF_USE_JIT_STUB_ARGUMENT_VA_LIST=.): DEFINES += WTF_USE_JIT_STUB_ARGUMENT_VA_LIST=1
+        QMAKE_CXXFLAGS += -fno-stack-protector
+        QMAKE_CFLAGS += -fno-stack-protector
+    }
+    win32-msvc* {
+        !contains(DEFINES, WTF_USE_JIT_STUB_ARGUMENT_REGISTER=.): DEFINES += WTF_USE_JIT_STUB_ARGUMENT_REGISTER=1
+    }
 }
 
 win32-msvc*: INCLUDEPATH += $$PWD/os-win32
@@ -53,10 +91,12 @@ JSCBISON += \
 
 SOURCES += \
     wtf/Assertions.cpp \
+    wtf/ByteArray.cpp \
     wtf/HashTable.cpp \
     wtf/MainThread.cpp \
     wtf/RandomNumber.cpp \
     wtf/RefCountedLeakCounter.cpp \
+    wtf/TypeTraits.cpp \
     wtf/unicode/CollatorDefault.cpp \
     wtf/unicode/icu/CollatorICU.cpp \
     wtf/unicode/UTF8.cpp \
@@ -77,26 +117,27 @@ SOURCES += \
     runtime/JSVariableObject.cpp \
     runtime/JSActivation.cpp \
     runtime/JSNotAnObject.cpp \
+    runtime/LiteralParser.cpp \
+    runtime/TimeoutChecker.cpp \
     bytecode/CodeBlock.cpp \
     bytecode/StructureStubInfo.cpp \
     bytecode/JumpTable.cpp \
     jit/JIT.cpp \
     jit/JITCall.cpp \
     jit/JITArithmetic.cpp \
+    jit/JITOpcodes.cpp \
     jit/JITPropertyAccess.cpp \
     jit/ExecutableAllocator.cpp \
+    jit/JITStubs.cpp \
     bytecompiler/BytecodeGenerator.cpp \
     runtime/ExceptionHelpers.cpp \
     runtime/JSPropertyNameIterator.cpp \
     interpreter/Interpreter.cpp \
     bytecode/Opcode.cpp \
     bytecode/SamplingTool.cpp \
-    wrec/CharacterClass.cpp \
-    wrec/CharacterClassConstructor.cpp \
-    wrec/WREC.cpp \
-    wrec/WRECFunctors.cpp \
-    wrec/WRECGenerator.cpp \
-    wrec/WRECParser.cpp \
+    yarr/RegexCompiler.cpp \
+    yarr/RegexInterpreter.cpp \
+    yarr/RegexJIT.cpp \
     interpreter/RegisterFile.cpp
 
 win32-*: SOURCES += jit/ExecutableAllocatorWin.cpp
@@ -112,17 +153,18 @@ SOURCES += \
     runtime/BooleanConstructor.cpp \
     runtime/BooleanObject.cpp \
     runtime/BooleanPrototype.cpp \
-    runtime/ByteArray.cpp \
     runtime/CallData.cpp \
     runtime/Collector.cpp \
     runtime/CommonIdentifiers.cpp \
     runtime/ConstructData.cpp \
+    wtf/CurrentTime.cpp \
     runtime/DateConstructor.cpp \
     runtime/DateInstance.cpp \
     runtime/DateMath.cpp \
     runtime/DatePrototype.cpp \
     debugger/Debugger.cpp \
     debugger/DebuggerCallFrame.cpp \
+    debugger/DebuggerActivation.cpp \
     wtf/dtoa.cpp \
     runtime/Error.cpp \
     runtime/ErrorConstructor.cpp \
@@ -161,6 +203,7 @@ SOURCES += \
     runtime/ObjectPrototype.cpp \
     runtime/Operations.cpp \
     parser/Parser.cpp \
+    parser/ParserArena.cpp \
     runtime/PropertyNameArray.cpp \
     runtime/PropertySlot.cpp \
     runtime/PrototypeFunction.cpp \
@@ -184,11 +227,17 @@ SOURCES += \
     profiler/TreeProfile.cpp \
     wtf/FastMalloc.cpp \
     wtf/Threading.cpp \
-    wtf/ThreadingQt.cpp \
     wtf/qt/MainThreadQt.cpp
 
+!contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    SOURCES += wtf/qt/ThreadingQt.cpp
+} else {
+    DEFINES += ENABLE_JSC_MULTIPLE_THREADS=0
+    SOURCES += wtf/ThreadingNone.cpp
+}
+
 # GENERATOR 1-A: LUT creator
-lut.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.lut.h
+lut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
 lut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
 lut.depend = ${QMAKE_FILE_NAME}
 lut.input = LUT_FILES
@@ -196,7 +245,7 @@ lut.CONFIG += no_link
 addExtraCompiler(lut)
 
 # GENERATOR 1-B: particular LUT creator (for 1 file only)
-keywordlut.output = $$GENERATED_SOURCES_DIR/Lexer.lut.h
+keywordlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}Lexer.lut.h
 keywordlut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
 keywordlut.depend = ${QMAKE_FILE_NAME}
 keywordlut.input = KEYWORDLUT_FILES
@@ -204,8 +253,8 @@ keywordlut.CONFIG += no_link
 addExtraCompiler(keywordlut)
 
 # GENERATOR 2: bison grammar
-jscbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o ${QMAKE_FILE_BASE}.tab.c && $(MOVE) ${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) ${QMAKE_FILE_BASE}.tab.h $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.h
+jscbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
 jscbison.depend = ${QMAKE_FILE_NAME}
 jscbison.input = JSCBISON
 jscbison.variable_out = GENERATED_SOURCES
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index 56dae058e6..28f0e6bc45 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -21,13 +21,16 @@ CONFIG(QTDIR_build) {
 }
 
 isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
-win32-*: GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
+GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
 
 INCLUDEPATH += $$GENERATED_SOURCES_DIR
 
 !CONFIG(QTDIR_build) {
-     OBJECTS_DIR = tmp
+    CONFIG(debug, debug|release) {
+        OBJECTS_DIR = obj/debug
+    } else { # Release
+        OBJECTS_DIR = obj/release
+    }
 }
 
 include($$OUTPUT_DIR/config.pri)
@@ -64,7 +67,7 @@ include(JavaScriptCore.pri)
 
 QMAKE_EXTRA_TARGETS += generated_files
 
-qt-port: lessThan(QT_MINOR_VERSION, 4) {
+lessThan(QT_MINOR_VERSION, 4) {
     DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h
index e71c8a8322..13b21bbbe6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h
@@ -25,15 +25,6 @@
 
 #endif
 
-#if defined(__APPLE__)
-#import <AvailabilityMacros.h>
-#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_4
-#define BUILDING_ON_TIGER 1
-#elif MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_5
-#define BUILDING_ON_LEOPARD 1
-#endif
-#endif
-
 #ifdef __cplusplus
 #define new ("if you use new/delete make sure to include config.h at the top of the file"()) 
 #define delete ("if you use new/delete make sure to include config.h at the top of the file"()) 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
new file mode 100644
index 0000000000..5def60fc8a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -0,0 +1,999 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AbstractMacroAssembler_h
+#define AbstractMacroAssembler_h
+
+#include <wtf/Platform.h>
+
+#include <MacroAssemblerCodeRef.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
+
+#if ENABLE(ASSEMBLER)
+
+// FIXME: keep transitioning this out into MacroAssemblerX86_64.
+#if PLATFORM(X86_64)
+#define REPTACH_OFFSET_CALL_R11 3
+#endif
+
+namespace JSC {
+
+template <class AssemblerType>
+class AbstractMacroAssembler {
+public:
+    typedef MacroAssemblerCodePtr CodePtr;
+    typedef MacroAssemblerCodeRef CodeRef;
+
+    class Jump;
+    class PatchBuffer;
+    class CodeLocationInstruction;
+    class CodeLocationLabel;
+    class CodeLocationJump;
+    class CodeLocationCall;
+    class CodeLocationNearCall;
+    class CodeLocationDataLabel32;
+    class CodeLocationDataLabelPtr;
+    class ProcessorReturnAddress;
+
+    typedef typename AssemblerType::RegisterID RegisterID;
+    typedef typename AssemblerType::FPRegisterID FPRegisterID;
+    typedef typename AssemblerType::JmpSrc JmpSrc;
+    typedef typename AssemblerType::JmpDst JmpDst;
+
+
+    // Section 1: MacroAssembler operand types
+    //
+    // The following types are used as operands to MacroAssembler operations,
+    // describing immediate  and memory operands to the instructions to be planted.
+
+
+    enum Scale {
+        TimesOne,
+        TimesTwo,
+        TimesFour,
+        TimesEight,
+    };
+
+    // Address:
+    //
+    // Describes a simple base-offset address.
+    struct Address {
+        explicit Address(RegisterID base, int32_t offset = 0)
+            : base(base)
+            , offset(offset)
+        {
+        }
+
+        RegisterID base;
+        int32_t offset;
+    };
+
+    // ImplicitAddress:
+    //
+    // This class is used for explicit 'load' and 'store' operations
+    // (as opposed to situations in which a memory operand is provided
+    // to a generic operation, such as an integer arithmetic instruction).
+    //
+    // In the case of a load (or store) operation we want to permit
+    // addresses to be implicitly constructed, e.g. the two calls:
+    //
+    //     load32(Address(addrReg), destReg);
+    //     load32(addrReg, destReg);
+    //
+    // Are equivalent, and the explicit wrapping of the Address in the former
+    // is unnecessary.
+    struct ImplicitAddress {
+        ImplicitAddress(RegisterID base)
+            : base(base)
+            , offset(0)
+        {
+        }
+
+        ImplicitAddress(Address address)
+            : base(address.base)
+            , offset(address.offset)
+        {
+        }
+
+        RegisterID base;
+        int32_t offset;
+    };
+
+    // BaseIndex:
+    //
+    // Describes a complex addressing mode.
+    struct BaseIndex {
+        BaseIndex(RegisterID base, RegisterID index, Scale scale, int32_t offset = 0)
+            : base(base)
+            , index(index)
+            , scale(scale)
+            , offset(offset)
+        {
+        }
+
+        RegisterID base;
+        RegisterID index;
+        Scale scale;
+        int32_t offset;
+    };
+
+    // AbsoluteAddress:
+    //
+    // Describes an memory operand given by a pointer.  For regular load & store
+    // operations an unwrapped void* will be used, rather than using this.
+    struct AbsoluteAddress {
+        explicit AbsoluteAddress(void* ptr)
+            : m_ptr(ptr)
+        {
+        }
+
+        void* m_ptr;
+    };
+
+    // ImmPtr:
+    //
+    // A pointer sized immediate operand to an instruction - this is wrapped
+    // in a class requiring explicit construction in order to differentiate
+    // from pointers used as absolute addresses to memory operations
+    struct ImmPtr {
+        explicit ImmPtr(void* value)
+            : m_value(value)
+        {
+        }
+
+        intptr_t asIntptr()
+        {
+            return reinterpret_cast<intptr_t>(m_value);
+        }
+
+        void* m_value;
+    };
+
+    // Imm32:
+    //
+    // A 32bit immediate operand to an instruction - this is wrapped in a
+    // class requiring explicit construction in order to prevent RegisterIDs
+    // (which are implemented as an enum) from accidentally being passed as
+    // immediate values.
+    struct Imm32 {
+        explicit Imm32(int32_t value)
+            : m_value(value)
+        {
+        }
+
+#if !PLATFORM(X86_64)
+        explicit Imm32(ImmPtr ptr)
+            : m_value(ptr.asIntptr())
+        {
+        }
+#endif
+
+        int32_t m_value;
+    };
+
+
+    // Section 2: MacroAssembler code buffer handles
+    //
+    // The following types are used to reference items in the code buffer
+    // during JIT code generation.  For example, the type Jump is used to
+    // track the location of a jump instruction so that it may later be
+    // linked to a label marking its destination.
+
+
+    // Label:
+    //
+    // A Label records a point in the generated instruction stream, typically such that
+    // it may be used as a destination for a jump.
+    class Label {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class Jump;
+        friend class MacroAssemblerCodeRef;
+        friend class PatchBuffer;
+
+    public:
+        Label()
+        {
+        }
+
+        Label(AbstractMacroAssembler<AssemblerType>* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+        
+        bool isUsed() const { return m_label.isUsed(); }
+        void used() { m_label.used(); }
+    private:
+        JmpDst m_label;
+    };
+
+    // DataLabelPtr:
+    //
+    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
+    // patched after the code has been generated.
+    class DataLabelPtr {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class PatchBuffer;
+    public:
+        DataLabelPtr()
+        {
+        }
+
+        DataLabelPtr(AbstractMacroAssembler<AssemblerType>* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+        
+    private:
+        JmpDst m_label;
+    };
+
+    // DataLabel32:
+    //
+    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
+    // patched after the code has been generated.
+    class DataLabel32 {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class PatchBuffer;
+    public:
+        DataLabel32()
+        {
+        }
+
+        DataLabel32(AbstractMacroAssembler<AssemblerType>* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+
+    private:
+        JmpDst m_label;
+    };
+
+    // Call:
+    //
+    // A Call object is a reference to a call instruction that has been planted
+    // into the code buffer - it is typically used to link the call, setting the
+    // relative offset such that when executed it will call to the desired
+    // destination.
+    class Call {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class PatchBuffer;
+    public:
+        enum Flags {
+            None = 0x0,
+            Linkable = 0x1,
+            Near = 0x2,
+            LinkableNear = 0x3,
+        };
+
+        Call()
+            : m_flags(None)
+        {
+        }
+        
+        Call(JmpSrc jmp, Flags flags)
+            : m_jmp(jmp)
+            , m_flags(flags)
+        {
+        }
+
+        bool isFlagSet(Flags flag)
+        {
+            return m_flags & flag;
+        }
+
+        static Call fromTailJump(Jump jump)
+        {
+            return Call(jump.m_jmp, Linkable);
+        }
+
+    private:
+        JmpSrc m_jmp;
+        Flags m_flags;
+    };
+
+    // Jump:
+    //
+    // A jump object is a reference to a jump instruction that has been planted
+    // into the code buffer - it is typically used to link the jump, setting the
+    // relative offset such that when executed it will jump to the desired
+    // destination.
+    class Jump {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class Call;
+        friend class PatchBuffer;
+    public:
+        Jump()
+        {
+        }
+        
+        Jump(JmpSrc jmp)    
+            : m_jmp(jmp)
+        {
+        }
+        
+        void link(AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            masm->m_assembler.linkJump(m_jmp, masm->m_assembler.label());
+        }
+        
+        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            masm->m_assembler.linkJump(m_jmp, label.m_label);
+        }
+
+    private:
+        JmpSrc m_jmp;
+    };
+
+    // JumpList:
+    //
+    // A JumpList is a set of Jump objects.
+    // All jumps in the set will be linked to the same destination.
+    class JumpList {
+        friend class PatchBuffer;
+
+    public:
+        void link(AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            size_t size = m_jumps.size();
+            for (size_t i = 0; i < size; ++i)
+                m_jumps[i].link(masm);
+            m_jumps.clear();
+        }
+        
+        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            size_t size = m_jumps.size();
+            for (size_t i = 0; i < size; ++i)
+                m_jumps[i].linkTo(label, masm);
+            m_jumps.clear();
+        }
+        
+        void append(Jump jump)
+        {
+            m_jumps.append(jump);
+        }
+        
+        void append(JumpList& other)
+        {
+            m_jumps.append(other.m_jumps.begin(), other.m_jumps.size());
+        }
+
+        bool empty()
+        {
+            return !m_jumps.size();
+        }
+
+    private:
+        Vector<Jump, 16> m_jumps;
+    };
+
+
+    // Section 3: MacroAssembler JIT instruction stream handles.
+    //
+    // The MacroAssembler supported facilities to modify a JIT generated
+    // instruction stream after it has been generated (relinking calls and
+    // jumps, and repatching data values).  The following types are used
+    // to store handles into the underlying instruction stream, the type
+    // providing semantic information as to what it is that is in the
+    // instruction stream at this point, and thus what operations may be
+    // performed on it.
+
+
+    // CodeLocationCommon:
+    //
+    // Base type for other CodeLocation* types.  A postion in the JIT genertaed
+    // instruction stream, without any semantic information.
+    class CodeLocationCommon {
+    public:
+        CodeLocationCommon()
+        {
+        }
+
+        // In order to avoid the need to store multiple handles into the
+        // instructions stream, where the code generation is deterministic
+        // and the labels will always be a fixed distance apart, these
+        // methods may be used to recover a handle that has nopw been
+        // retained, based on a known fixed relative offset from one that has.
+        CodeLocationInstruction instructionAtOffset(int offset);
+        CodeLocationLabel labelAtOffset(int offset);
+        CodeLocationJump jumpAtOffset(int offset);
+        CodeLocationCall callAtOffset(int offset);
+        CodeLocationNearCall nearCallAtOffset(int offset);
+        CodeLocationDataLabelPtr dataLabelPtrAtOffset(int offset);
+        CodeLocationDataLabel32 dataLabel32AtOffset(int offset);
+
+    protected:
+        explicit CodeLocationCommon(CodePtr location)
+            : m_location(location)
+        {
+        }
+
+        void* dataLocation() { return m_location.dataLocation(); }
+        void* executableAddress() { return m_location.executableAddress(); }
+    
+        void reset()
+        {
+            m_location = CodePtr();
+        }
+
+    private:
+        CodePtr m_location;
+    };
+
+    // CodeLocationInstruction:
+    //
+    // An arbitrary instruction in the JIT code.
+    class CodeLocationInstruction : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+    public:
+        CodeLocationInstruction()
+        {
+        }
+
+        void repatchLoadPtrToLEA()
+        {
+            AssemblerType::repatchLoadPtrToLEA(this->dataLocation());
+        }
+
+    private:
+        explicit CodeLocationInstruction(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+    };
+
+    // CodeLocationLabel:
+    //
+    // A point in the JIT code maked with a label.
+    class CodeLocationLabel : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+        friend class CodeLocationJump;
+        friend class CodeLocationCall;
+        friend class CodeLocationNearCall;
+        friend class PatchBuffer;
+        friend class ProcessorReturnAddress;
+
+    public:
+        CodeLocationLabel()
+        {
+        }
+
+        void* addressForSwitch() { return this->executableAddress(); }
+        void* addressForExceptionHandler() { return this->executableAddress(); }
+        void* addressForJSR() { return this->executableAddress(); }
+
+        bool operator!()
+        {
+            return !this->executableAddress();
+        }
+
+        void reset()
+        {
+            CodeLocationCommon::reset();
+        }
+
+    private:
+        explicit CodeLocationLabel(CodePtr location)
+            : CodeLocationCommon(location)
+        {
+        }
+
+        explicit CodeLocationLabel(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+
+        void* getJumpDestination() { return this->executableAddress(); }
+    };
+
+    // CodeLocationJump:
+    //
+    // A point in the JIT code at which there is a jump instruction.
+    class CodeLocationJump : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+        friend class PatchBuffer;
+    public:
+        CodeLocationJump()
+        {
+        }
+
+        void relink(CodeLocationLabel destination)
+        {
+            AssemblerType::relinkJump(this->dataLocation(), destination.executableAddress());
+        }
+
+    private:
+        explicit CodeLocationJump(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+    };
+
+    // CodeLocationCall:
+    //
+    // A point in the JIT code at which there is a call instruction.
+    class CodeLocationCall : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+        friend class PatchBuffer;
+        friend class ProcessorReturnAddress;
+    public:
+        CodeLocationCall()
+        {
+        }
+
+        void relink(CodeLocationLabel destination)
+        {
+#if PLATFORM(X86_64)
+            CodeLocationCommon::dataLabelPtrAtOffset(-REPTACH_OFFSET_CALL_R11).repatch(destination.executableAddress());
+#else
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+#endif
+        }
+
+        void relink(FunctionPtr destination)
+        {
+#if PLATFORM(X86_64)
+            CodeLocationCommon::dataLabelPtrAtOffset(-REPTACH_OFFSET_CALL_R11).repatch(destination.executableAddress());
+#else
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+#endif
+        }
+
+        // This methods returns the value that will be set as the return address
+        // within a function that has been called from this call instruction.
+        void* calleeReturnAddressValue()
+        {
+            return this->executableAddress();
+        }
+
+    private:
+        explicit CodeLocationCall(CodePtr location)
+            : CodeLocationCommon(location)
+        {
+        }
+
+        explicit CodeLocationCall(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+    };
+
+    // CodeLocationNearCall:
+    //
+    // A point in the JIT code at which there is a call instruction with near linkage.
+    class CodeLocationNearCall : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+        friend class PatchBuffer;
+        friend class ProcessorReturnAddress;
+    public:
+        CodeLocationNearCall()
+        {
+        }
+
+        void relink(CodePtr destination)
+        {
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+        }
+
+        void relink(CodeLocationLabel destination)
+        {
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+        }
+
+        void relink(FunctionPtr destination)
+        {
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+        }
+
+        // This methods returns the value that will be set as the return address
+        // within a function that has been called from this call instruction.
+        void* calleeReturnAddressValue()
+        {
+            return this->executableAddress();
+        }
+
+    private:
+        explicit CodeLocationNearCall(CodePtr location)
+            : CodeLocationCommon(location)
+        {
+        }
+
+        explicit CodeLocationNearCall(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+    };
+
+    // CodeLocationDataLabel32:
+    //
+    // A point in the JIT code at which there is an int32_t immediate that may be repatched.
+    class CodeLocationDataLabel32 : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+        friend class PatchBuffer;
+    public:
+        CodeLocationDataLabel32()
+        {
+        }
+
+        void repatch(int32_t value)
+        {
+            AssemblerType::repatchInt32(this->dataLocation(), value);
+        }
+
+    private:
+        explicit CodeLocationDataLabel32(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+    };
+
+    // CodeLocationDataLabelPtr:
+    //
+    // A point in the JIT code at which there is a void* immediate that may be repatched.
+    class CodeLocationDataLabelPtr : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+        friend class PatchBuffer;
+    public:
+        CodeLocationDataLabelPtr()
+        {
+        }
+
+        void repatch(void* value)
+        {
+            AssemblerType::repatchPointer(this->dataLocation(), value);
+        }
+
+    private:
+        explicit CodeLocationDataLabelPtr(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+    };
+
+    // ProcessorReturnAddress:
+    //
+    // This class can be used to relink a call identified by its return address.
+    class ProcessorReturnAddress {
+        friend class CodeLocationCall;
+        friend class CodeLocationNearCall;
+    public:
+        ProcessorReturnAddress(void* location)
+            : m_location(location)
+        {
+        }
+
+        void relinkCallerToTrampoline(CodeLocationLabel label)
+        {
+            CodeLocationCall(CodePtr(m_location)).relink(label);
+        }
+        
+        void relinkCallerToTrampoline(CodePtr newCalleeFunction)
+        {
+            relinkCallerToTrampoline(CodeLocationLabel(newCalleeFunction));
+        }
+
+        void relinkCallerToFunction(FunctionPtr function)
+        {
+            CodeLocationCall(CodePtr(m_location)).relink(function);
+        }
+        
+        void relinkNearCallerToTrampoline(CodeLocationLabel label)
+        {
+            CodeLocationNearCall(CodePtr(m_location)).relink(label);
+        }
+        
+        void relinkNearCallerToTrampoline(CodePtr newCalleeFunction)
+        {
+            relinkNearCallerToTrampoline(CodeLocationLabel(newCalleeFunction));
+        }
+
+        void* addressForLookup()
+        {
+            return m_location.value();
+        }
+
+    private:
+        ReturnAddressPtr m_location;
+    };
+
+
+    // Section 4: PatchBuffer - utility to finalize code generation.
+
+    static CodePtr trampolineAt(CodeRef ref, Label label)
+    {
+        return CodePtr(AssemblerType::getRelocatedAddress(ref.m_code.dataLocation(), label.m_label));
+    }
+
+    // PatchBuffer:
+    //
+    // This class assists in linking code generated by the macro assembler, once code generation
+    // has been completed, and the code has been copied to is final location in memory.  At this
+    // time pointers to labels within the code may be resolved, and relative offsets to external
+    // addresses may be fixed.
+    //
+    // Specifically:
+    //   * Jump objects may be linked to external targets,
+    //   * The address of Jump objects may taken, such that it can later be relinked.
+    //   * The return address of a Jump object representing a call may be acquired.
+    //   * The address of a Label pointing into the code may be resolved.
+    //   * The value referenced by a DataLabel may be fixed.
+    //
+    // FIXME: distinguish between Calls & Jumps (make a specific call to obtain the return
+    // address of calls, as opposed to a point that can be used to later relink a Jump -
+    // possibly wrap the later up in an object that can do just that).
+    class PatchBuffer : public Noncopyable {
+    public:
+        // Note: Initialization sequence is significant, since executablePool is a PassRefPtr.
+        //       First, executablePool is copied into m_executablePool, then the initialization of
+        //       m_code uses m_executablePool, *not* executablePool, since this is no longer valid.
+        PatchBuffer(AbstractMacroAssembler<AssemblerType>* masm, PassRefPtr<ExecutablePool> executablePool)
+            : m_executablePool(executablePool)
+            , m_code(masm->m_assembler.executableCopy(m_executablePool.get()))
+            , m_size(masm->m_assembler.size())
+#ifndef NDEBUG
+            , m_completed(false)
+#endif
+        {
+        }
+
+        ~PatchBuffer()
+        {
+            ASSERT(m_completed);
+        }
+
+        // These methods are used to link or set values at code generation time.
+
+        void link(Call call, FunctionPtr function)
+        {
+            ASSERT(call.isFlagSet(Call::Linkable));
+#if PLATFORM(X86_64)
+            if (!call.isFlagSet(Call::Near)) {
+                char* callLocation = reinterpret_cast<char*>(AssemblerType::getRelocatedAddress(code(), call.m_jmp)) - REPTACH_OFFSET_CALL_R11;
+                AssemblerType::patchPointerForCall(callLocation, function.value());
+            } else
+#endif
+            AssemblerType::linkCall(code(), call.m_jmp, function.value());
+        }
+        
+        void link(Jump jump, CodeLocationLabel label)
+        {
+            AssemblerType::linkJump(code(), jump.m_jmp, label.executableAddress());
+        }
+
+        void link(JumpList list, CodeLocationLabel label)
+        {
+            for (unsigned i = 0; i < list.m_jumps.size(); ++i)
+                AssemblerType::linkJump(code(), list.m_jumps[i].m_jmp, label.executableAddress());
+        }
+
+        void patch(DataLabelPtr label, void* value)
+        {
+            AssemblerType::patchPointer(code(), label.m_label, value);
+        }
+
+        void patch(DataLabelPtr label, CodeLocationLabel value)
+        {
+            AssemblerType::patchPointer(code(), label.m_label, value.getJumpDestination());
+        }
+
+        // These methods are used to obtain handles to allow the code to be relinked / repatched later.
+
+        CodeLocationCall locationOf(Call call)
+        {
+            ASSERT(call.isFlagSet(Call::Linkable));
+            ASSERT(!call.isFlagSet(Call::Near));
+            return CodeLocationCall(AssemblerType::getRelocatedAddress(code(), call.m_jmp));
+        }
+
+        CodeLocationNearCall locationOfNearCall(Call call)
+        {
+            ASSERT(call.isFlagSet(Call::Linkable));
+            ASSERT(call.isFlagSet(Call::Near));
+            return CodeLocationNearCall(AssemblerType::getRelocatedAddress(code(), call.m_jmp));
+        }
+
+        CodeLocationLabel locationOf(Label label)
+        {
+            return CodeLocationLabel(AssemblerType::getRelocatedAddress(code(), label.m_label));
+        }
+
+        CodeLocationDataLabelPtr locationOf(DataLabelPtr label)
+        {
+            return CodeLocationDataLabelPtr(AssemblerType::getRelocatedAddress(code(), label.m_label));
+        }
+
+        CodeLocationDataLabel32 locationOf(DataLabel32 label)
+        {
+            return CodeLocationDataLabel32(AssemblerType::getRelocatedAddress(code(), label.m_label));
+        }
+
+        // This method obtains the return address of the call, given as an offset from
+        // the start of the code.
+        unsigned returnAddressOffset(Call call)
+        {
+            return AssemblerType::getCallReturnOffset(call.m_jmp);
+        }
+
+        // Upon completion of all patching either 'finalizeCode()' or 'finalizeCodeAddendum()' should be called
+        // once to complete generation of the code.  'finalizeCode()' is suited to situations
+        // where the executable pool must also be retained, the lighter-weight 'finalizeCodeAddendum()' is
+        // suited to adding to an existing allocation.
+        CodeRef finalizeCode()
+        {
+            performFinalization();
+
+            return CodeRef(m_code, m_executablePool, m_size);
+        }
+        CodeLocationLabel finalizeCodeAddendum()
+        {
+            performFinalization();
+
+            return CodeLocationLabel(code());
+        }
+
+    private:
+        // Keep this private! - the underlying code should only be obtained externally via 
+        // finalizeCode() or finalizeCodeAddendum().
+        void* code()
+        {
+            return m_code;
+        }
+
+        void performFinalization()
+        {
+#ifndef NDEBUG
+            ASSERT(!m_completed);
+            m_completed = true;
+#endif
+
+            ExecutableAllocator::makeExecutable(code(), m_size);
+        }
+
+        RefPtr<ExecutablePool> m_executablePool;
+        void* m_code;
+        size_t m_size;
+#ifndef NDEBUG
+        bool m_completed;
+#endif
+    };
+
+
+    // Section 5: Misc admin methods
+
+    size_t size()
+    {
+        return m_assembler.size();
+    }
+
+    Label label()
+    {
+        return Label(this);
+    }
+    
+    Label align()
+    {
+        m_assembler.align(16);
+        return Label(this);
+    }
+
+    ptrdiff_t differenceBetween(Label from, Jump to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+    ptrdiff_t differenceBetween(Label from, Call to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+    ptrdiff_t differenceBetween(Label from, Label to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(Label from, DataLabelPtr to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(Label from, DataLabel32 to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(DataLabelPtr from, Jump to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+    ptrdiff_t differenceBetween(DataLabelPtr from, DataLabelPtr to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(DataLabelPtr from, Call to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+protected:
+    AssemblerType m_assembler;
+};
+
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationInstruction AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::instructionAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationInstruction(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationLabel AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::labelAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationLabel(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationJump AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::jumpAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationJump(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationCall AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::callAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationCall(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationNearCall AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::nearCallAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationNearCall(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationDataLabelPtr AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::dataLabelPtrAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationDataLabelPtr(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationDataLabel32 AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::dataLabel32AtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationDataLabel32(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // AbstractMacroAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
index e1f53d8247..7a5a8d322c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -132,6 +132,8 @@ namespace JSC {
             if (!result)
                 return 0;
 
+            ExecutableAllocator::makeWritable(result, m_size);
+
             return memcpy(result, m_buffer, m_size);
         }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
index 9f8d474356..f341267e75 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
@@ -30,1896 +30,306 @@
 
 #if ENABLE(ASSEMBLER)
 
-#include "X86Assembler.h"
-
-namespace JSC {
+#if PLATFORM(X86)
+#include "MacroAssemblerX86.h"
+namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 
-class MacroAssembler {
-protected:
-    X86Assembler m_assembler;
+#elif PLATFORM(X86_64)
+#include "MacroAssemblerX86_64.h"
+namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
-#if PLATFORM(X86_64)
-    static const X86::RegisterID scratchRegister = X86::r11;
+#else
+#error "The MacroAssembler is not supported on this platform."
 #endif
 
+
+namespace JSC {
+
+class MacroAssembler : public MacroAssemblerBase {
 public:
-    typedef X86::RegisterID RegisterID;
-
-    // Note: do not rely on values in this enum, these will change (to 0..3).
-    enum Scale {
-        TimesOne = 1,
-        TimesTwo = 2,
-        TimesFour = 4,
-        TimesEight = 8,
-#if PLATFORM(X86)
-        ScalePtr = TimesFour
-#endif
+
+    using MacroAssemblerBase::pop;
+    using MacroAssemblerBase::jump;
+    using MacroAssemblerBase::branch32;
+    using MacroAssemblerBase::branch16;
 #if PLATFORM(X86_64)
-        ScalePtr = TimesEight
+    using MacroAssemblerBase::branchPtr;
+    using MacroAssemblerBase::branchTestPtr;
 #endif
-    };
 
-    MacroAssembler()
+
+    // Platform agnostic onvenience functions,
+    // described in terms of other macro assembly methods.
+    void pop()
     {
+        addPtr(Imm32(sizeof(void*)), stackPointerRegister);
     }
     
-    size_t size() { return m_assembler.size(); }
-    void* copyCode(ExecutablePool* allocator)
+    void peek(RegisterID dest, int index = 0)
     {
-        return m_assembler.executableCopy(allocator);
+        loadPtr(Address(stackPointerRegister, (index * sizeof(void*))), dest);
     }
 
-
-    // Address:
-    //
-    // Describes a simple base-offset address.
-    struct Address {
-        explicit Address(RegisterID base, int32_t offset = 0)
-            : base(base)
-            , offset(offset)
-        {
-        }
-
-        RegisterID base;
-        int32_t offset;
-    };
-
-    // ImplicitAddress:
-    //
-    // This class is used for explicit 'load' and 'store' operations
-    // (as opposed to situations in which a memory operand is provided
-    // to a generic operation, such as an integer arithmetic instruction).
-    //
-    // In the case of a load (or store) operation we want to permit
-    // addresses to be implicitly constructed, e.g. the two calls:
-    //
-    //     load32(Address(addrReg), destReg);
-    //     load32(addrReg, destReg);
-    //
-    // Are equivalent, and the explicit wrapping of the Address in the former
-    // is unnecessary.
-    struct ImplicitAddress {
-        ImplicitAddress(RegisterID base)
-            : base(base)
-            , offset(0)
-        {
-        }
-
-        ImplicitAddress(Address address)
-            : base(address.base)
-            , offset(address.offset)
-        {
-        }
-
-        RegisterID base;
-        int32_t offset;
-    };
-
-    // BaseIndex:
-    //
-    // Describes a complex addressing mode.
-    struct BaseIndex {
-        BaseIndex(RegisterID base, RegisterID index, Scale scale, int32_t offset = 0)
-            : base(base)
-            , index(index)
-            , scale(scale)
-            , offset(offset)
-        {
-        }
-
-        RegisterID base;
-        RegisterID index;
-        Scale scale;
-        int32_t offset;
-    };
-
-    // AbsoluteAddress:
-    //
-    // Describes an memory operand given by a pointer.  For regular load & store
-    // operations an unwrapped void* will be used, rather than using this.
-    struct AbsoluteAddress {
-        explicit AbsoluteAddress(void* ptr)
-            : m_ptr(ptr)
-        {
-        }
-
-        void* m_ptr;
-    };
-
-
-    class Jump;
-    class PatchBuffer;
-
-    // DataLabelPtr:
-    //
-    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
-    // patched after the code has been generated.
-    class DataLabelPtr {
-        friend class MacroAssembler;
-        friend class PatchBuffer;
-
-    public:
-        DataLabelPtr()
-        {
-        }
-
-        DataLabelPtr(MacroAssembler* masm)
-            : m_label(masm->m_assembler.label())
-        {
-        }
-
-        static void patch(void* address, void* value)
-        {
-            X86Assembler::patchPointer(reinterpret_cast<intptr_t>(address), reinterpret_cast<intptr_t>(value));
-        }
-        
-    private:
-        X86Assembler::JmpDst m_label;
-    };
-
-    // DataLabel32:
-    //
-    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
-    // patched after the code has been generated.
-    class DataLabel32 {
-        friend class MacroAssembler;
-        friend class PatchBuffer;
-
-    public:
-        DataLabel32()
-        {
-        }
-
-        DataLabel32(MacroAssembler* masm)
-            : m_label(masm->m_assembler.label())
-        {
-        }
-
-        static void patch(void* address, int32_t value)
-        {
-            X86Assembler::patchImmediate(reinterpret_cast<intptr_t>(address), value);
-        }
-
-    private:
-        X86Assembler::JmpDst m_label;
-    };
-
-    // Label:
-    //
-    // A Label records a point in the generated instruction stream, typically such that
-    // it may be used as a destination for a jump.
-    class Label {
-        friend class Jump;
-        friend class MacroAssembler;
-        friend class PatchBuffer;
-
-    public:
-        Label()
-        {
-        }
-
-        Label(MacroAssembler* masm)
-            : m_label(masm->m_assembler.label())
-        {
-        }
-        
-        // FIXME: transitionary method, while we replace JmpSrces with Jumps.
-        operator X86Assembler::JmpDst()
-        {
-            return m_label;
-        }
-
-    private:
-        X86Assembler::JmpDst m_label;
-    };
-
-
-    // Jump:
-    //
-    // A jump object is a reference to a jump instruction that has been planted
-    // into the code buffer - it is typically used to link the jump, setting the
-    // relative offset such that when executed it will jump to the desired
-    // destination.
-    //
-    // Jump objects retain a pointer to the assembler for syntactic purposes -
-    // to allow the jump object to be able to link itself, e.g.:
-    //
-    //     Jump forwardsBranch = jne32(Imm32(0), reg1);
-    //     // ...
-    //     forwardsBranch.link();
-    //
-    // Jumps may also be linked to a Label.
-    class Jump {
-        friend class PatchBuffer;
-        friend class MacroAssembler;
-
-    public:
-        Jump()
-        {
-        }
-        
-        // FIXME: transitionary method, while we replace JmpSrces with Jumps.
-        Jump(X86Assembler::JmpSrc jmp)
-            : m_jmp(jmp)
-        {
-        }
-        
-        void link(MacroAssembler* masm)
-        {
-            masm->m_assembler.link(m_jmp, masm->m_assembler.label());
-        }
-        
-        void linkTo(Label label, MacroAssembler* masm)
-        {
-            masm->m_assembler.link(m_jmp, label.m_label);
-        }
-        
-        // FIXME: transitionary method, while we replace JmpSrces with Jumps.
-        operator X86Assembler::JmpSrc()
-        {
-            return m_jmp;
-        }
-
-        static void patch(void* address, void* destination)
-        {
-            X86Assembler::patchBranchOffset(reinterpret_cast<intptr_t>(address), destination);
-        }
-
-    private:
-        X86Assembler::JmpSrc m_jmp;
-    };
-
-    // JumpList:
-    //
-    // A JumpList is a set of Jump objects.
-    // All jumps in the set will be linked to the same destination.
-    class JumpList {
-        friend class PatchBuffer;
-
-    public:
-        void link(MacroAssembler* masm)
-        {
-            size_t size = m_jumps.size();
-            for (size_t i = 0; i < size; ++i)
-                m_jumps[i].link(masm);
-            m_jumps.clear();
-        }
-        
-        void linkTo(Label label, MacroAssembler* masm)
-        {
-            size_t size = m_jumps.size();
-            for (size_t i = 0; i < size; ++i)
-                m_jumps[i].linkTo(label, masm);
-            m_jumps.clear();
-        }
-        
-        void append(Jump jump)
-        {
-            m_jumps.append(jump);
-        }
-        
-        void append(JumpList& other)
-        {
-            m_jumps.append(other.m_jumps.begin(), other.m_jumps.size());
-        }
-
-        bool empty()
-        {
-            return !m_jumps.size();
-        }
-
-    private:
-        Vector<Jump, 16> m_jumps;
-    };
-
-
-    // PatchBuffer:
-    //
-    // This class assists in linking code generated by the macro assembler, once code generation
-    // has been completed, and the code has been copied to is final location in memory.  At this
-    // time pointers to labels within the code may be resolved, and relative offsets to external
-    // addresses may be fixed.
-    //
-    // Specifically:
-    //   * Jump objects may be linked to external targets,
-    //   * The address of Jump objects may taken, such that it can later be relinked.
-    //   * The return address of a Jump object representing a call may be acquired.
-    //   * The address of a Label pointing into the code may be resolved.
-    //   * The value referenced by a DataLabel may be fixed.
-    //
-    // FIXME: distinguish between Calls & Jumps (make a specific call to obtain the return
-    // address of calls, as opposed to a point that can be used to later relink a Jump -
-    // possibly wrap the later up in an object that can do just that).
-    class PatchBuffer {
-    public:
-        PatchBuffer(void* code)
-            : m_code(code)
-        {
-        }
-
-        void link(Jump jump, void* target)
-        {
-            X86Assembler::link(m_code, jump.m_jmp, target);
-        }
-
-        void link(JumpList list, void* target)
-        {
-            for (unsigned i = 0; i < list.m_jumps.size(); ++i)
-                X86Assembler::link(m_code, list.m_jumps[i], target);
-        }
-
-        void* addressOf(Jump jump)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, jump.m_jmp);
-        }
-
-        void* addressOf(Label label)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, label.m_label);
-        }
-
-        void* addressOf(DataLabelPtr label)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, label.m_label);
-        }
-
-        void* addressOf(DataLabel32 label)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, label.m_label);
-        }
-
-        void setPtr(DataLabelPtr label, void* value)
-        {
-            X86Assembler::patchAddress(m_code, label.m_label, value);
-        }
-
-    private:
-        void* m_code;
-    };
- 
-
-    // ImmPtr:
-    //
-    // A pointer sized immediate operand to an instruction - this is wrapped
-    // in a class requiring explicit construction in order to differentiate
-    // from pointers used as absolute addresses to memory operations
-    struct ImmPtr {
-        explicit ImmPtr(void* value)
-            : m_value(value)
-        {
-        }
-
-        intptr_t asIntptr()
-        {
-            return reinterpret_cast<intptr_t>(m_value);
-        }
-
-        void* m_value;
-    };
-
-
-    // Imm32:
-    //
-    // A 32bit immediate operand to an instruction - this is wrapped in a
-    // class requiring explicit construction in order to prevent RegisterIDs
-    // (which are implemented as an enum) from accidentally being passed as
-    // immediate values.
-    struct Imm32 {
-        explicit Imm32(int32_t value)
-            : m_value(value)
-        {
-        }
-
-#if PLATFORM(X86)
-        explicit Imm32(ImmPtr ptr)
-            : m_value(ptr.asIntptr())
-        {
-        }
-#endif
-
-        int32_t m_value;
-    };
-
-    // Integer arithmetic operations:
-    //
-    // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
-    // may often be a memory location (explictly described using an Address
-    // object).
-
-    void addPtr(RegisterID src, RegisterID dest)
+    void poke(RegisterID src, int index = 0)
     {
-#if PLATFORM(X86_64)
-        m_assembler.addq_rr(src, dest);
-#else
-        add32(src, dest);
-#endif
+        storePtr(src, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void addPtr(Imm32 imm, RegisterID srcDest)
+    void poke(Imm32 value, int index = 0)
     {
-#if PLATFORM(X86_64)
-        m_assembler.addq_ir(imm.m_value, srcDest);
-#else
-        add32(imm, srcDest);
-#endif
+        store32(value, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    void poke(ImmPtr imm, int index = 0)
     {
-        m_assembler.leal_mr(imm.m_value, src, dest);
+        storePtr(imm, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void add32(RegisterID src, RegisterID dest)
+
+    // Backwards banches, these are currently all implemented using existing forwards branch mechanisms.
+    void branchPtr(Condition cond, RegisterID op1, ImmPtr imm, Label target)
     {
-        m_assembler.addl_rr(src, dest);
+        branchPtr(cond, op1, imm).linkTo(target, this);
     }
 
-    void add32(Imm32 imm, Address address)
+    void branch32(Condition cond, RegisterID op1, RegisterID op2, Label target)
     {
-        m_assembler.addl_im(imm.m_value, address.offset, address.base);
+        branch32(cond, op1, op2).linkTo(target, this);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void branch32(Condition cond, RegisterID op1, Imm32 imm, Label target)
     {
-        m_assembler.addl_ir(imm.m_value, dest);
+        branch32(cond, op1, imm).linkTo(target, this);
     }
-    
-    void add32(Imm32 imm, AbsoluteAddress address)
+
+    void branch32(Condition cond, RegisterID left, Address right, Label target)
     {
-#if PLATFORM(X86_64)
-        move(ImmPtr(address.m_ptr), scratchRegister);
-        add32(imm, Address(scratchRegister));
-#else
-        m_assembler.addl_im(imm.m_value, address.m_ptr);
-#endif
+        branch32(cond, left, right).linkTo(target, this);
     }
-    
-    void add32(Address src, RegisterID dest)
+
+    void branch16(Condition cond, BaseIndex left, RegisterID right, Label target)
     {
-        m_assembler.addl_mr(src.offset, src.base, dest);
+        branch16(cond, left, right).linkTo(target, this);
     }
     
-    void andPtr(RegisterID src, RegisterID dest)
+    void branchTestPtr(Condition cond, RegisterID reg, Label target)
     {
-#if PLATFORM(X86_64)
-        m_assembler.andq_rr(src, dest);
-#else
-        and32(src, dest);
-#endif
+        branchTestPtr(cond, reg).linkTo(target, this);
     }
 
-    void andPtr(Imm32 imm, RegisterID srcDest)
+    void jump(Label target)
     {
-#if PLATFORM(X86_64)
-        m_assembler.andq_ir(imm.m_value, srcDest);
-#else
-        and32(imm, srcDest);
-#endif
+        jump().linkTo(target, this);
     }
 
-    void and32(RegisterID src, RegisterID dest)
-    {
-        m_assembler.andl_rr(src, dest);
-    }
 
-    void and32(Imm32 imm, RegisterID dest)
+    // Ptr methods
+    // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
+#if !PLATFORM(X86_64)
+    void addPtr(RegisterID src, RegisterID dest)
     {
-        m_assembler.andl_ir(imm.m_value, dest);
+        add32(src, dest);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void addPtr(Imm32 imm, RegisterID srcDest)
     {
-        m_assembler.shll_i8r(imm.m_value, dest);
+        add32(imm, srcDest);
     }
-    
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+
+    void addPtr(ImmPtr imm, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.shll_CLr(X86::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
-                m_assembler.shll_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.shll_CLr(dest);
-        
-            swap(shift_amount, X86::ecx);
-        } else
-            m_assembler.shll_CLr(dest);
+        add32(Imm32(imm), dest);
     }
-    
-    // Take the value from dividend, divide it by divisor, and put the remainder in remainder.
-    // For now, this operation has specific register requirements, and the three register must
-    // be unique.  It is unfortunate to expose this in the MacroAssembler interface, however
-    // given the complexity to fix, the fact that it is not uncommmon  for processors to have
-    // specific register requirements on this operation (e.g. Mips result in 'hi'), or to not
-    // support a hardware divide at all, it may not be 
-    void mod32(RegisterID divisor, RegisterID dividend, RegisterID remainder)
-    {
-#ifdef NDEBUG
-#pragma unused(dividend,remainder)
-#else
-        ASSERT((dividend == X86::eax) && (remainder == X86::edx));
-        ASSERT((dividend != divisor) && (remainder != divisor));
-#endif
 
-        m_assembler.cdq();
-        m_assembler.idivl_r(divisor);
+    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        add32(imm, src, dest);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void andPtr(RegisterID src, RegisterID dest)
     {
-        m_assembler.imull_i32r(src, imm.m_value, dest);
+        and32(src, dest);
     }
-    
-    void not32(RegisterID srcDest)
+
+    void andPtr(Imm32 imm, RegisterID srcDest)
     {
-        m_assembler.notl_r(srcDest);
+        and32(imm, srcDest);
     }
-    
+
     void orPtr(RegisterID src, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.orq_rr(src, dest);
-#else
         or32(src, dest);
-#endif
     }
 
     void orPtr(ImmPtr imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        m_assembler.orq_rr(scratchRegister, dest);
-#else
         or32(Imm32(imm), dest);
-#endif
     }
 
     void orPtr(Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.orq_ir(imm.m_value, dest);
-#else
         or32(imm, dest);
-#endif
-    }
-
-    void or32(RegisterID src, RegisterID dest)
-    {
-        m_assembler.orl_rr(src, dest);
-    }
-
-    void or32(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.orl_ir(imm.m_value, dest);
     }
 
     void rshiftPtr(RegisterID shift_amount, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
-                m_assembler.sarq_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarq_CLr(dest);
-        
-            swap(shift_amount, X86::ecx);
-        } else
-            m_assembler.sarq_CLr(dest);
-#else
         rshift32(shift_amount, dest);
-#endif
     }
 
     void rshiftPtr(Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.sarq_i8r(imm.m_value, dest);
-#else
         rshift32(imm, dest);
-#endif
-    }
-
-    void rshift32(RegisterID shift_amount, RegisterID dest)
-    {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarl_CLr(X86::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
-                m_assembler.sarl_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarl_CLr(dest);
-        
-            swap(shift_amount, X86::ecx);
-        } else
-            m_assembler.sarl_CLr(dest);
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void subPtr(RegisterID src, RegisterID dest)
     {
-        m_assembler.sarl_i8r(imm.m_value, dest);
+        sub32(src, dest);
     }
-
+    
     void subPtr(Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.subq_ir(imm.m_value, dest);
-#else
         sub32(imm, dest);
-#endif
     }
     
-    void sub32(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.subl_ir(imm.m_value, dest);
-    }
-    
-    void sub32(Imm32 imm, Address address)
-    {
-        m_assembler.subl_im(imm.m_value, address.offset, address.base);
-    }
-
-    void sub32(Imm32 imm, AbsoluteAddress address)
-    {
-#if PLATFORM(X86_64)
-        move(ImmPtr(address.m_ptr), scratchRegister);
-        sub32(imm, Address(scratchRegister));
-#else
-        m_assembler.subl_im(imm.m_value, address.m_ptr);
-#endif
-    }
-
-    void sub32(Address src, RegisterID dest)
+    void subPtr(ImmPtr imm, RegisterID dest)
     {
-        m_assembler.subl_mr(src.offset, src.base, dest);
+        sub32(Imm32(imm), dest);
     }
 
     void xorPtr(RegisterID src, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.xorq_rr(src, dest);
-#else
         xor32(src, dest);
-#endif
     }
 
     void xorPtr(Imm32 imm, RegisterID srcDest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.xorq_ir(imm.m_value, srcDest);
-#else
         xor32(imm, srcDest);
-#endif
-    }
-
-    void xor32(RegisterID src, RegisterID dest)
-    {
-        m_assembler.xorl_rr(src, dest);
     }
 
-    void xor32(Imm32 imm, RegisterID srcDest)
-    {
-        m_assembler.xorl_ir(imm.m_value, srcDest);
-    }
-    
-
-    // Memory access operations:
-    //
-    // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
-    // operand objects to loads and store will be implicitly constructed if a
-    // register is passed.
 
     void loadPtr(ImplicitAddress address, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_mr(address.offset, address.base, dest);
-#else
         load32(address, dest);
-#endif
-    }
-
-    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movq_mr_disp32(address.offset, address.base, dest);
-        return DataLabel32(this);
-#else
-        m_assembler.movl_mr_disp32(address.offset, address.base, dest);
-        return DataLabel32(this);
-#endif
     }
 
     void loadPtr(BaseIndex address, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
-#else
         load32(address, dest);
-#endif
     }
 
     void loadPtr(void* address, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        if (dest == X86::eax)
-            m_assembler.movq_mEAX(address);
-        else {
-            move(X86::eax, dest);
-            m_assembler.movq_mEAX(address);
-            swap(X86::eax, dest);
-        }
-#else
         load32(address, dest);
-#endif
-    }
-
-    void load32(ImplicitAddress address, RegisterID dest)
-    {
-        m_assembler.movl_mr(address.offset, address.base, dest);
-    }
-
-    void load32(BaseIndex address, RegisterID dest)
-    {
-        m_assembler.movl_mr(address.offset, address.base, address.index, address.scale, dest);
     }
 
-    void load32(void* address, RegisterID dest)
+    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        if (dest == X86::eax)
-            m_assembler.movl_mEAX(address);
-        else {
-            move(X86::eax, dest);
-            m_assembler.movl_mEAX(address);
-            swap(X86::eax, dest);
-        }
-#else
-        m_assembler.movl_mr(address, dest);
-#endif
+        return load32WithAddressOffsetPatch(address, dest);
     }
 
-    void load16(BaseIndex address, RegisterID dest)
+    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
     {
-        m_assembler.movzwl_mr(address.offset, address.base, address.index, address.scale, dest);
+        set32(cond, left, right, dest);
     }
 
     void storePtr(RegisterID src, ImplicitAddress address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_rm(src, address.offset, address.base);
-#else
         store32(src, address);
-#endif
-    }
-
-    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movq_rm_disp32(src, address.offset, address.base);
-        return DataLabel32(this);
-#else
-        m_assembler.movl_rm_disp32(src, address.offset, address.base);
-        return DataLabel32(this);
-#endif
     }
 
     void storePtr(RegisterID src, BaseIndex address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_rm(src, address.offset, address.base, address.index, address.scale);
-#else
         store32(src, address);
-#endif
-    }
-
-    void storePtr(ImmPtr imm, ImplicitAddress address)
-    {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        storePtr(scratchRegister, address);
-#else
-        m_assembler.movl_i32m(imm.asIntptr(), address.offset, address.base);
-#endif
-    }
-
-    DataLabelPtr storePtrWithPatch(Address address)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movq_i64r(0, scratchRegister);
-        DataLabelPtr label(this);
-        storePtr(scratchRegister, address);
-        return label;
-#else
-        m_assembler.movl_i32m(0, address.offset, address.base);
-        return DataLabelPtr(this);
-#endif
-    }
-
-    void store32(RegisterID src, ImplicitAddress address)
-    {
-        m_assembler.movl_rm(src, address.offset, address.base);
-    }
-
-    void store32(RegisterID src, BaseIndex address)
-    {
-        m_assembler.movl_rm(src, address.offset, address.base, address.index, address.scale);
-    }
-
-    void store32(Imm32 imm, ImplicitAddress address)
-    {
-        m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
-    }
-    
-    void store32(Imm32 imm, void* address)
-    {
-#if PLATFORM(X86_64)
-        move(X86::eax, scratchRegister);
-        move(imm, X86::eax);
-        m_assembler.movl_EAXm(address);
-        move(scratchRegister, X86::eax);
-#else
-        m_assembler.movl_i32m(imm.m_value, address);
-#endif
-    }
-
-
-    // Stack manipulation operations:
-    //
-    // The ABI is assumed to provide a stack abstraction to memory,
-    // containing machine word sized units of data.  Push and pop
-    // operations add and remove a single register sized unit of data
-    // to or from the stack.  Peek and poke operations read or write
-    // values on the stack, without moving the current stack position.
-    
-    void pop(RegisterID dest)
-    {
-        m_assembler.pop_r(dest);
-    }
-
-    void push(RegisterID src)
-    {
-        m_assembler.push_r(src);
-    }
-
-    void push(Address address)
-    {
-        m_assembler.push_m(address.offset, address.base);
-    }
-
-    void push(Imm32 imm)
-    {
-        m_assembler.push_i32(imm.m_value);
-    }
-
-    void pop()
-    {
-        addPtr(Imm32(sizeof(void*)), X86::esp);
-    }
-    
-    void peek(RegisterID dest, int index = 0)
-    {
-        loadPtr(Address(X86::esp, (index * sizeof(void *))), dest);
-    }
-
-    void poke(RegisterID src, int index = 0)
-    {
-        storePtr(src, Address(X86::esp, (index * sizeof(void *))));
-    }
-
-    void poke(Imm32 value, int index = 0)
-    {
-        store32(value, Address(X86::esp, (index * sizeof(void *))));
-    }
-
-    void poke(ImmPtr imm, int index = 0)
-    {
-        storePtr(imm, Address(X86::esp, (index * sizeof(void *))));
-    }
-
-    // Register move operations:
-    //
-    // Move values in registers.
-
-    void move(Imm32 imm, RegisterID dest)
-    {
-        // Note: on 64-bit the Imm32 value is zero extended into the register, it
-        // may be useful to have a separate version that sign extends the value?
-        if (!imm.m_value)
-            m_assembler.xorl_rr(dest, dest);
-        else
-            m_assembler.movl_i32r(imm.m_value, dest);
-    }
-
-    void move(RegisterID src, RegisterID dest)
-    {
-        // Note: on 64-bit this is is a full register move; perhaps it would be
-        // useful to have separate move32 & movePtr, with move32 zero extending?
-#if PLATFORM(X86_64)
-        m_assembler.movq_rr(src, dest);
-#else
-        m_assembler.movl_rr(src, dest);
-#endif
-    }
-
-    void move(ImmPtr imm, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        if (CAN_SIGN_EXTEND_U32_64(imm.asIntptr()))
-            m_assembler.movl_i32r(static_cast<int32_t>(imm.asIntptr()), dest);
-        else
-            m_assembler.movq_i64r(imm.asIntptr(), dest);
-#else
-        m_assembler.movl_i32r(imm.asIntptr(), dest);
-#endif
-    }
-
-    void swap(RegisterID reg1, RegisterID reg2)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.xchgq_rr(reg1, reg2);
-#else
-        m_assembler.xchgl_rr(reg1, reg2);
-#endif
-    }
-
-    void signExtend32ToPtr(RegisterID src, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movsxd_rr(src, dest);
-#else
-        if (src != dest)
-            move(src, dest);
-#endif
-    }
-
-    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movl_rr(src, dest);
-#else
-        if (src != dest)
-            move(src, dest);
-#endif
-    }
-
-
-    // Forwards / external control flow operations:
-    //
-    // This set of jump and conditional branch operations return a Jump
-    // object which may linked at a later point, allow forwards jump,
-    // or jumps that will require external linkage (after the code has been
-    // relocated).
-    //
-    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
-    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
-    // used (representing the names 'below' and 'above').
-    //
-    // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
-    // treated as a signed 32bit value, is less than or equal to 5.
-    //
-    // jz and jnz test whether the first operand is equal to zero, and take
-    // an optional second operand of a mask under which to perform the test.
-
-private:
-    void compareImm32ForBranch(RegisterID left, int32_t right)
-    {
-        m_assembler.cmpl_ir(right, left);
-    }
-
-    void compareImm32ForBranchEquality(RegisterID reg, int32_t imm)
-    {
-        if (!imm)
-            m_assembler.testl_rr(reg, reg);
-        else
-            m_assembler.cmpl_ir(imm, reg);
-    }
-
-    void compareImm32ForBranchEquality(Address address, int32_t imm)
-    {
-        m_assembler.cmpl_im(imm, address.offset, address.base);
-    }
-
-    void testImm32(RegisterID reg, Imm32 mask)
-    {
-        // if we are only interested in the low seven bits, this can be tested with a testb
-        if (mask.m_value == -1)
-            m_assembler.testl_rr(reg, reg);
-        else if ((mask.m_value & ~0x7f) == 0)
-            m_assembler.testb_i8r(mask.m_value, reg);
-        else
-            m_assembler.testl_i32r(mask.m_value, reg);
-    }
-
-    void testImm32(Address address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpl_im(0, address.offset, address.base);
-        else
-            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
-    }
-
-    void testImm32(BaseIndex address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
-        else
-            m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
-    }
-
-#if PLATFORM(X86_64)
-    void compareImm64ForBranch(RegisterID left, int32_t right)
-    {
-        m_assembler.cmpq_ir(right, left);
-    }
-
-    void compareImm64ForBranchEquality(RegisterID reg, int32_t imm)
-    {
-        if (!imm)
-            m_assembler.testq_rr(reg, reg);
-        else
-            m_assembler.cmpq_ir(imm, reg);
-    }
-
-    void testImm64(RegisterID reg, Imm32 mask)
-    {
-        // if we are only interested in the low seven bits, this can be tested with a testb
-        if (mask.m_value == -1)
-            m_assembler.testq_rr(reg, reg);
-        else if ((mask.m_value & ~0x7f) == 0)
-            m_assembler.testb_i8r(mask.m_value, reg);
-        else
-            m_assembler.testq_i32r(mask.m_value, reg);
-    }
-
-    void testImm64(Address address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpq_im(0, address.offset, address.base);
-        else
-            m_assembler.testq_i32m(mask.m_value, address.offset, address.base);
-    }
-
-    void testImm64(BaseIndex address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
-        else
-            m_assembler.testq_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
-    }
-#endif
-
-public:
-    Jump ja32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.ja());
-    }
-    
-    Jump jaePtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jae());
-#else
-        return jae32(left, right);
-#endif
-    }
-
-    Jump jaePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jae());
-        } else {
-            move(ptr, scratchRegister);
-            return jaePtr(reg, scratchRegister);
-        }
-#else
-        return jae32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jae32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jae());
     }
 
-    Jump jae32(RegisterID left, Imm32 right)
+    void storePtr(RegisterID src, void* address)
     {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jae());
-    }
-    
-    Jump jae32(RegisterID left, Address right)
-    {
-        m_assembler.cmpl_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jae());
-    }
-    
-    Jump jae32(Address left, RegisterID right)
-    {
-        m_assembler.cmpl_rm(right, left.offset, left.base);
-        return Jump(m_assembler.jae());
-    }
-    
-    Jump jbPtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jb());
-#else
-        return jb32(left, right);
-#endif
-    }
-
-    Jump jbPtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jb());
-        } else {
-            move(ptr, scratchRegister);
-            return jbPtr(reg, scratchRegister);
-        }
-#else
-        return jb32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jb32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jb());
-    }
-
-    Jump jb32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jb());
-    }
-    
-    Jump jb32(RegisterID left, Address right)
-    {
-        m_assembler.cmpl_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jb());
-    }
-    
-    Jump jePtr(RegisterID op1, RegisterID op2)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(op1, op2);
-        return Jump(m_assembler.je());
-#else
-        return je32(op1, op2);
-#endif
-    }
-
-    Jump jePtr(RegisterID reg, Address address)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rm(reg, address.offset, address.base);
-#else
-        m_assembler.cmpl_rm(reg, address.offset, address.base);
-#endif
-        return Jump(m_assembler.je());
-    }
-
-    Jump jePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranchEquality(reg, imm);
-            return Jump(m_assembler.je());
-        } else {
-            move(ptr, scratchRegister);
-            return jePtr(scratchRegister, reg);
-        }
-#else
-        return je32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jePtr(Address address, ImmPtr imm)
-    {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        return jePtr(scratchRegister, address);
-#else
-        return je32(address, Imm32(imm));
-#endif
-    }
-
-    Jump je32(RegisterID op1, RegisterID op2)
-    {
-        m_assembler.cmpl_rr(op1, op2);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump je32(Address op1, RegisterID op2)
-    {
-        m_assembler.cmpl_mr(op1.offset, op1.base, op2);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump je32(RegisterID reg, Imm32 imm)
-    {
-        compareImm32ForBranchEquality(reg, imm.m_value);
-        return Jump(m_assembler.je());
-    }
-
-    Jump je32(Address address, Imm32 imm)
-    {
-        compareImm32ForBranchEquality(address, imm.m_value);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump je16(RegisterID op1, BaseIndex op2)
-    {
-        m_assembler.cmpw_rm(op1, op2.offset, op2.base, op2.index, op2.scale);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump jg32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jg());
-    }
-
-    Jump jg32(RegisterID reg, Address address)
-    {
-        m_assembler.cmpl_mr(address.offset, address.base, reg);
-        return Jump(m_assembler.jg());
-    }
-
-    Jump jgePtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jge());
-#else
-        return jge32(left, right);
-#endif
-    }
-
-    Jump jgePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jge());
-        } else {
-            move(ptr, scratchRegister);
-            return jgePtr(reg, scratchRegister);
-        }
-#else
-        return jge32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jge32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jge());
-    }
-
-    Jump jge32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jge());
-    }
-
-    Jump jlPtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jl());
-#else
-        return jl32(left, right);
-#endif
-    }
-
-    Jump jlPtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jl());
-        } else {
-            move(ptr, scratchRegister);
-            return jlPtr(reg, scratchRegister);
-        }
-#else
-        return jl32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jl32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jl());
-    }
-    
-    Jump jl32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jl());
-    }
-
-    Jump jlePtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jle());
-#else
-        return jle32(left, right);
-#endif
-    }
-
-    Jump jlePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jle());
-        } else {
-            move(ptr, scratchRegister);
-            return jlePtr(reg, scratchRegister);
-        }
-#else
-        return jle32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jle32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jle());
-    }
-    
-    Jump jle32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jle());
+        store32(src, address);
     }
 
-    Jump jnePtr(RegisterID op1, RegisterID op2)
+    void storePtr(ImmPtr imm, ImplicitAddress address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(op1, op2);
-        return Jump(m_assembler.jne());
-#else
-        return jne32(op1, op2);
-#endif
+        store32(Imm32(imm), address);
     }
 
-    Jump jnePtr(RegisterID reg, Address address)
+    void storePtr(ImmPtr imm, void* address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rm(reg, address.offset, address.base);
-#else
-        m_assembler.cmpl_rm(reg, address.offset, address.base);
-#endif
-        return Jump(m_assembler.jne());
+        store32(Imm32(imm), address);
     }
 
-    Jump jnePtr(RegisterID reg, AbsoluteAddress address)
+    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
     {
-#if PLATFORM(X86_64)
-        move(ImmPtr(address.m_ptr), scratchRegister);
-        return jnePtr(reg, Address(scratchRegister));
-#else
-        m_assembler.cmpl_rm(reg, address.m_ptr);
-        return Jump(m_assembler.jne());
-#endif
+        return store32WithAddressOffsetPatch(src, address);
     }
 
-    Jump jnePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranchEquality(reg, imm);
-            return Jump(m_assembler.jne());
-        } else {
-            move(ptr, scratchRegister);
-            return jnePtr(scratchRegister, reg);
-        }
-#else
-        return jne32(reg, Imm32(ptr));
-#endif
-    }
 
-    Jump jnePtr(Address address, ImmPtr imm)
+    Jump branchPtr(Condition cond, RegisterID left, RegisterID right)
     {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        return jnePtr(scratchRegister, address);
-#else
-        return jne32(address, Imm32(imm));
-#endif
+        return branch32(cond, left, right);
     }
 
-#if !PLATFORM(X86_64)
-    Jump jnePtr(AbsoluteAddress address, ImmPtr imm)
+    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
     {
-        m_assembler.cmpl_im(imm.asIntptr(), address.m_ptr);
-        return Jump(m_assembler.jne());
+        return branch32(cond, left, Imm32(right));
     }
-#endif
 
-    Jump jnePtrWithPatch(RegisterID reg, DataLabelPtr& dataLabel, ImmPtr initialValue = ImmPtr(0))
+    Jump branchPtr(Condition cond, RegisterID left, Address right)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_i64r(initialValue.asIntptr(), scratchRegister);
-        dataLabel = DataLabelPtr(this);
-        return jnePtr(scratchRegister, reg);
-#else
-        m_assembler.cmpl_ir_force32(initialValue.asIntptr(), reg);
-        dataLabel = DataLabelPtr(this);
-        return Jump(m_assembler.jne());
-#endif
+        return branch32(cond, left, right);
     }
 
-    Jump jnePtrWithPatch(Address address, DataLabelPtr& dataLabel, ImmPtr initialValue = ImmPtr(0))
+    Jump branchPtr(Condition cond, Address left, RegisterID right)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_i64r(initialValue.asIntptr(), scratchRegister);
-        dataLabel = DataLabelPtr(this);
-        return jnePtr(scratchRegister, address);
-#else
-        m_assembler.cmpl_im_force32(initialValue.asIntptr(), address.offset, address.base);
-        dataLabel = DataLabelPtr(this);
-        return Jump(m_assembler.jne());
-#endif
+        return branch32(cond, left, right);
     }
 
-    Jump jne32(RegisterID op1, RegisterID op2)
+    Jump branchPtr(Condition cond, AbsoluteAddress left, RegisterID right)
     {
-        m_assembler.cmpl_rr(op1, op2);
-        return Jump(m_assembler.jne());
+        return branch32(cond, left, right);
     }
 
-    Jump jne32(RegisterID reg, Imm32 imm)
+    Jump branchPtr(Condition cond, Address left, ImmPtr right)
     {
-        compareImm32ForBranchEquality(reg, imm.m_value);
-        return Jump(m_assembler.jne());
+        return branch32(cond, left, Imm32(right));
     }
 
-    Jump jne32(Address address, Imm32 imm)
-    {
-        compareImm32ForBranchEquality(address, imm.m_value);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump jne32(Address address, RegisterID reg)
-    {
-        m_assembler.cmpl_rm(reg, address.offset, address.base);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump jnzPtr(RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchPtr(Condition cond, AbsoluteAddress left, ImmPtr right)
     {
-#if PLATFORM(X86_64)
-        testImm64(reg, mask);
-        return Jump(m_assembler.jne());
-#else
-        return jnz32(reg, mask);
-#endif
+        return branch32(cond, left, Imm32(right));
     }
 
-    Jump jnzPtr(RegisterID reg, ImmPtr mask)
+    Jump branchTestPtr(Condition cond, RegisterID reg, RegisterID mask)
     {
-#if PLATFORM(X86_64)
-        move(mask, scratchRegister);
-        m_assembler.testq_rr(scratchRegister, reg);
-        return Jump(m_assembler.jne());
-#else
-        return jnz32(reg, Imm32(mask));
-#endif
+        return branchTest32(cond, reg, mask);
     }
 
-    Jump jnzPtr(Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
     {
-#if PLATFORM(X86_64)
-        testImm64(address, mask);
-        return Jump(m_assembler.jne());
-#else
-        return jnz32(address, mask);
-#endif
+        return branchTest32(cond, reg, mask);
     }
 
-    Jump jnz32(RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
     {
-        testImm32(reg, mask);
-        return Jump(m_assembler.jne());
+        return branchTest32(cond, address, mask);
     }
 
-    Jump jnz32(Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
     {
-        testImm32(address, mask);
-        return Jump(m_assembler.jne());
+        return branchTest32(cond, address, mask);
     }
 
-    Jump jzPtr(RegisterID reg, Imm32 mask = Imm32(-1))
-    {
-#if PLATFORM(X86_64)
-        testImm64(reg, mask);
-        return Jump(m_assembler.je());
-#else
-        return jz32(reg, mask);
-#endif
-    }
 
-    Jump jzPtr(RegisterID reg, ImmPtr mask)
+    Jump branchAddPtr(Condition cond, RegisterID src, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        move(mask, scratchRegister);
-        m_assembler.testq_rr(scratchRegister, reg);
-        return Jump(m_assembler.je());
-#else
-        return jz32(reg, Imm32(mask));
-#endif
+        return branchAdd32(cond, src, dest);
     }
 
-    Jump jzPtr(Address address, Imm32 mask = Imm32(-1))
+    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        testImm64(address, mask);
-        return Jump(m_assembler.je());
-#else
-        return jz32(address, mask);
-#endif
+        return branchSub32(cond, imm, dest);
     }
-
-    Jump jzPtr(BaseIndex address, Imm32 mask = Imm32(-1))
-    {
-#if PLATFORM(X86_64)
-        testImm64(address, mask);
-        return Jump(m_assembler.je());
-#else
-        return jz32(address, mask);
 #endif
-    }
-
-    Jump jz32(RegisterID reg, Imm32 mask = Imm32(-1))
-    {
-        testImm32(reg, mask);
-        return Jump(m_assembler.je());
-    }
-
-    Jump jz32(Address address, Imm32 mask = Imm32(-1))
-    {
-        testImm32(address, mask);
-        return Jump(m_assembler.je());
-    }
-
-    Jump jz32(BaseIndex address, Imm32 mask = Imm32(-1))
-    {
-        testImm32(address, mask);
-        return Jump(m_assembler.je());
-    }
-
-    Jump jump()
-    {
-        return Jump(m_assembler.jmp());
-    }
-
-
-    // Backwards, local control flow operations:
-    //
-    // These operations provide a shorter notation for local
-    // backwards branches, which may be both more convenient
-    // for the user, and for the programmer, and for the
-    // assembler (allowing shorter values to be used in
-    // relative offsets).
-    //
-    // The code sequence:
-    //
-    //     Label topOfLoop(this);
-    //     // ...
-    //     jne32(reg1, reg2, topOfLoop);
-    //
-    // Is equivalent to the longer, potentially less efficient form:
-    //
-    //     Label topOfLoop(this);
-    //     // ...
-    //     jne32(reg1, reg2).linkTo(topOfLoop);
-
-    void jae32(RegisterID left, Address right, Label target)
-    {
-        jae32(left, right).linkTo(target, this);
-    }
-
-    void je32(RegisterID op1, Imm32 imm, Label target)
-    {
-        je32(op1, imm).linkTo(target, this);
-    }
-
-    void je16(RegisterID op1, BaseIndex op2, Label target)
-    {
-        je16(op1, op2).linkTo(target, this);
-    }
-    
-    void jl32(RegisterID left, Imm32 right, Label target)
-    {
-        jl32(left, right).linkTo(target, this);
-    }
-    
-    void jle32(RegisterID left, RegisterID right, Label target)
-    {
-        jle32(left, right).linkTo(target, this);
-    }
-    
-    void jnePtr(RegisterID op1, ImmPtr imm, Label target)
-    {
-        jnePtr(op1, imm).linkTo(target, this);
-    }
-
-    void jne32(RegisterID op1, RegisterID op2, Label target)
-    {
-        jne32(op1, op2).linkTo(target, this);
-    }
-
-    void jne32(RegisterID op1, Imm32 imm, Label target)
-    {
-        jne32(op1, imm).linkTo(target, this);
-    }
-
-    void jzPtr(RegisterID reg, Label target)
-    {
-        jzPtr(reg).linkTo(target, this);
-    }
-
-    void jump(Label target)
-    {
-        m_assembler.link(m_assembler.jmp(), target.m_label);
-    }
-
-    void jump(RegisterID target)
-    {
-        m_assembler.jmp_r(target);
-    }
-
-    // Address is a memory location containing the address to jump to
-    void jump(Address address)
-    {
-        m_assembler.jmp_m(address.offset, address.base);
-    }
-
-
-    // Arithmetic control flow operations:
-    //
-    // This set of conditional branch operations branch based
-    // on the result of an arithmetic operation.  The operation
-    // is performed as normal, storing the result.
-    //
-    // * jz operations branch if the result is zero.
-    // * jo operations branch if the (signed) arithmetic
-    //   operation caused an overflow to occur.
-
-    Jump jnzSubPtr(Imm32 imm, RegisterID dest)
-    {
-        subPtr(imm, dest);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump jnzSub32(Imm32 imm, RegisterID dest)
-    {
-        sub32(imm, dest);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump joAddPtr(RegisterID src, RegisterID dest)
-    {
-        addPtr(src, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joAdd32(RegisterID src, RegisterID dest)
-    {
-        add32(src, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joAdd32(Imm32 imm, RegisterID dest)
-    {
-        add32(imm, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joMul32(Imm32 imm, RegisterID src, RegisterID dest)
-    {
-        mul32(imm, src, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joSub32(Imm32 imm, RegisterID dest)
-    {
-        sub32(imm, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump jzSubPtr(Imm32 imm, RegisterID dest)
-    {
-        subPtr(imm, dest);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump jzSub32(Imm32 imm, RegisterID dest)
-    {
-        sub32(imm, dest);
-        return Jump(m_assembler.je());
-    }
-    
-
-    // Miscellaneous operations:
-
-    void breakpoint()
-    {
-        m_assembler.int3();
-    }
-
-    Jump call()
-    {
-        return Jump(m_assembler.call());
-    }
-
-    // FIXME: why does this return a Jump object? - it can't be linked.
-    // This may be to get a reference to the return address of the call.
-    //
-    // This should probably be handled by a separate label type to a regular
-    // jump.  Todo: add a CallLabel type, for the regular call - can be linked
-    // like a jump (possibly a subclass of jump?, or possibly casts to a Jump).
-    // Also add a CallReturnLabel type for this to return (just a more JmpDsty
-    // form of label, can get the void* after the code has been linked, but can't
-    // try to link it like a Jump object), and let the CallLabel be cast into a
-    // CallReturnLabel.
-    Jump call(RegisterID target)
-    {
-        return Jump(m_assembler.call(target));
-    }
-
-    Label label()
-    {
-        return Label(this);
-    }
-    
-    Label align()
-    {
-        m_assembler.align(16);
-        return Label(this);
-    }
-
-    ptrdiff_t differenceBetween(Label from, Jump to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
-    }
-
-    ptrdiff_t differenceBetween(Label from, Label to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_label);
-    }
-
-    ptrdiff_t differenceBetween(Label from, DataLabelPtr to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_label);
-    }
-
-    ptrdiff_t differenceBetween(Label from, DataLabel32 to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_label);
-    }
-
-    ptrdiff_t differenceBetween(DataLabelPtr from, Jump to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
-    }
 
-    void ret()
-    {
-        m_assembler.ret();
-    }
-
-    void sete32(RegisterID src, RegisterID srcDest)
-    {
-        m_assembler.cmpl_rr(srcDest, src);
-        m_assembler.sete_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    void sete32(Imm32 imm, RegisterID srcDest)
-    {
-        compareImm32ForBranchEquality(srcDest, imm.m_value);
-        m_assembler.sete_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    void setne32(RegisterID src, RegisterID srcDest)
-    {
-        m_assembler.cmpl_rr(srcDest, src);
-        m_assembler.setne_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    void setne32(Imm32 imm, RegisterID srcDest)
-    {
-        compareImm32ForBranchEquality(srcDest, imm.m_value);
-        m_assembler.setne_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    // FIXME:
-    // The mask should be optional... paerhaps the argument order should be
-    // dest-src, operations always have a dest? ... possibly not true, considering
-    // asm ops like test, or pseudo ops like pop().
-    void setnz32(Address address, Imm32 mask, RegisterID dest)
-    {
-        testImm32(address, mask);
-        m_assembler.setnz_r(dest);
-        m_assembler.movzbl_rr(dest, dest);
-    }
-
-    void setz32(Address address, Imm32 mask, RegisterID dest)
-    {
-        testImm32(address, mask);
-        m_assembler.setz_r(dest);
-        m_assembler.movzbl_rr(dest, dest);
-    }
 };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
new file mode 100644
index 0000000000..0603060476
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerCodeRef_h
+#define MacroAssemblerCodeRef_h
+
+#include <wtf/Platform.h>
+
+#include "ExecutableAllocator.h"
+#include "PassRefPtr.h"
+#include "RefPtr.h"
+#include "UnusedParam.h"
+
+#if ENABLE(ASSEMBLER)
+
+namespace JSC {
+
+// FunctionPtr:
+//
+// FunctionPtr should be used to wrap pointers to C/C++ functions in JSC
+// (particularly, the stub functions).
+class FunctionPtr {
+public:
+    FunctionPtr()
+        : m_value(0)
+    {
+    }
+
+    template<typename FunctionType>
+    explicit FunctionPtr(FunctionType* value)
+        : m_value(reinterpret_cast<void*>(value))
+    {
+        ASSERT(m_value);
+    }
+
+    void* value() const { return m_value; }
+    void* executableAddress() const { return m_value; }
+
+
+private:
+    void* m_value;
+};
+
+// ReturnAddressPtr:
+//
+// ReturnAddressPtr should be used to wrap return addresses generated by processor
+// 'call' instructions exectued in JIT code.  We use return addresses to look up
+// exception and optimization information, and to repatch the call instruction
+// that is the source of the return address.
+class ReturnAddressPtr {
+public:
+    ReturnAddressPtr()
+        : m_value(0)
+    {
+    }
+
+    explicit ReturnAddressPtr(void* value)
+        : m_value(value)
+    {
+        ASSERT(m_value);
+    }
+
+    void* value() const { return m_value; }
+
+private:
+    void* m_value;
+};
+
+// MacroAssemblerCodePtr:
+//
+// MacroAssemblerCodePtr should be used to wrap pointers to JIT generated code.
+class MacroAssemblerCodePtr {
+public:
+    MacroAssemblerCodePtr()
+        : m_value(0)
+    {
+    }
+
+    explicit MacroAssemblerCodePtr(void* value)
+        : m_value(value)
+    {
+        ASSERT(m_value);
+    }
+
+    explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
+        : m_value(ra.value())
+    {
+        ASSERT(m_value);
+    }
+
+    void* executableAddress() const { return m_value; }
+    void* dataLocation() const { ASSERT(m_value); return m_value; }
+
+private:
+    void* m_value;
+};
+
+// MacroAssemblerCodeRef:
+//
+// A reference to a section of JIT generated code.  A CodeRef consists of a
+// pointer to the code, and a ref pointer to the pool from within which it
+// was allocated.
+class MacroAssemblerCodeRef {
+public:
+    MacroAssemblerCodeRef()
+#ifndef NDEBUG
+        : m_size(0)
+#endif
+    {
+    }
+
+    MacroAssemblerCodeRef(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
+        : m_code(code)
+        , m_executablePool(executablePool)
+    {
+#ifndef NDEBUG
+        m_size = size;
+#else
+        UNUSED_PARAM(size);
+#endif
+    }
+
+    MacroAssemblerCodePtr m_code;
+    RefPtr<ExecutablePool> m_executablePool;
+#ifndef NDEBUG
+    size_t m_size;
+#endif
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerCodeRef_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
new file mode 100644
index 0000000000..801bf6186d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerX86_h
+#define MacroAssemblerX86_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(X86)
+
+#include "MacroAssemblerX86Common.h"
+
+namespace JSC {
+
+class MacroAssemblerX86 : public MacroAssemblerX86Common {
+public:
+    MacroAssemblerX86()
+        : m_isSSE2Present(isSSE2Present())
+    {
+    }
+
+    static const Scale ScalePtr = TimesFour;
+
+    using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
+    using MacroAssemblerX86Common::sub32;
+    using MacroAssemblerX86Common::or32;
+    using MacroAssemblerX86Common::load32;
+    using MacroAssemblerX86Common::store32;
+    using MacroAssemblerX86Common::branch32;
+    using MacroAssemblerX86Common::call;
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.leal_mr(imm.m_value, src, dest);
+    }
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.addl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void addWithCarry32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.adcl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void and32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.andl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void or32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.orl_im(imm.m_value, address.m_ptr);
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.subl_im(imm.m_value, address.m_ptr);
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address, dest);
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        m_assembler.movl_i32m(imm.m_value, address);
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        m_assembler.movl_rm(src, address);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        m_assembler.cmpl_rm(right, left.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Call call()
+    {
+        return Call(m_assembler.call(), Call::Linkable);
+    }
+
+    Call tailRecursiveCall()
+    {
+        return Call::fromTailJump(jump());
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        return Call::fromTailJump(oldJump);
+    }
+
+
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_assembler.movl_i32r(initialValue.asIntptr(), dest);
+        return DataLabelPtr(this);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_assembler.cmpl_ir_force32(initialRightValue.asIntptr(), left);
+        dataLabel = DataLabelPtr(this);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_assembler.cmpl_im_force32(initialRightValue.asIntptr(), left.offset, left.base);
+        dataLabel = DataLabelPtr(this);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        m_assembler.movl_i32m(initialValue.asIntptr(), address.offset, address.base);
+        return DataLabelPtr(this);
+    }
+
+    bool supportsFloatingPoint() const { return m_isSSE2Present; }
+
+private:
+    const bool m_isSSE2Present;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerX86_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
new file mode 100644
index 0000000000..cea691e0ce
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -0,0 +1,780 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerX86Common_h
+#define MacroAssemblerX86Common_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER)
+
+#include "X86Assembler.h"
+#include "AbstractMacroAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
+public:
+
+    enum Condition {
+        Equal = X86Assembler::ConditionE,
+        NotEqual = X86Assembler::ConditionNE,
+        Above = X86Assembler::ConditionA,
+        AboveOrEqual = X86Assembler::ConditionAE,
+        Below = X86Assembler::ConditionB,
+        BelowOrEqual = X86Assembler::ConditionBE,
+        GreaterThan = X86Assembler::ConditionG,
+        GreaterThanOrEqual = X86Assembler::ConditionGE,
+        LessThan = X86Assembler::ConditionL,
+        LessThanOrEqual = X86Assembler::ConditionLE,
+        Overflow = X86Assembler::ConditionO,
+        Signed = X86Assembler::ConditionS,
+        Zero = X86Assembler::ConditionE,
+        NonZero = X86Assembler::ConditionNE
+    };
+
+    enum DoubleCondition {
+        DoubleEqual = X86Assembler::ConditionE,
+        DoubleGreaterThan = X86Assembler::ConditionA,
+        DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
+        DoubleLessThan = X86Assembler::ConditionB,
+        DoubleLessThanOrEqual = X86Assembler::ConditionBE,
+    };
+
+    static const RegisterID stackPointerRegister = X86::esp;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an Imm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addl_rr(src, dest);
+    }
+
+    void add32(Imm32 imm, Address address)
+    {
+        m_assembler.addl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.addl_ir(imm.m_value, dest);
+    }
+    
+    void add32(Address src, RegisterID dest)
+    {
+        m_assembler.addl_mr(src.offset, src.base, dest);
+    }
+    
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andl_rr(src, dest);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.andl_ir(imm.m_value, dest);
+    }
+
+    void and32(Imm32 imm, Address address)
+    {
+        m_assembler.andl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.shll_i8r(imm.m_value, dest);
+    }
+    
+    void lshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        // On x86 we can only shift by ecx; if asked to shift by another register we'll
+        // need rejig the shift amount into ecx first, and restore the registers afterwards.
+        if (shift_amount != X86::ecx) {
+            swap(shift_amount, X86::ecx);
+
+            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
+            if (dest == shift_amount)
+                m_assembler.shll_CLr(X86::ecx);
+            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
+            else if (dest == X86::ecx)
+                m_assembler.shll_CLr(shift_amount);
+            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
+            else
+                m_assembler.shll_CLr(dest);
+        
+            swap(shift_amount, X86::ecx);
+        } else
+            m_assembler.shll_CLr(dest);
+    }
+    
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.imull_rr(src, dest);
+    }
+    
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.imull_i32r(src, imm.m_value, dest);
+    }
+    
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.notl_r(srcDest);
+    }
+    
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orl_rr(src, dest);
+    }
+
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.orl_ir(imm.m_value, dest);
+    }
+
+    void or32(Imm32 imm, Address address)
+    {
+        m_assembler.orl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void rshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        // On x86 we can only shift by ecx; if asked to shift by another register we'll
+        // need rejig the shift amount into ecx first, and restore the registers afterwards.
+        if (shift_amount != X86::ecx) {
+            swap(shift_amount, X86::ecx);
+
+            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
+            if (dest == shift_amount)
+                m_assembler.sarl_CLr(X86::ecx);
+            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
+            else if (dest == X86::ecx)
+                m_assembler.sarl_CLr(shift_amount);
+            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
+            else
+                m_assembler.sarl_CLr(dest);
+        
+            swap(shift_amount, X86::ecx);
+        } else
+            m_assembler.sarl_CLr(dest);
+    }
+
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sarl_i8r(imm.m_value, dest);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subl_rr(src, dest);
+    }
+    
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.subl_ir(imm.m_value, dest);
+    }
+    
+    void sub32(Imm32 imm, Address address)
+    {
+        m_assembler.subl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        m_assembler.subl_mr(src.offset, src.base, dest);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorl_rr(src, dest);
+    }
+
+    void xor32(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.xorl_ir(imm.m_value, srcDest);
+    }
+    
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an Imm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address.offset, address.base, dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_assembler.movl_mr_disp32(address.offset, address.base, dest);
+        return DataLabel32(this);
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movzwl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_assembler.movl_rm_disp32(src, address.offset, address.base);
+        return DataLabel32(this);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.movl_rm(src, address.offset, address.base);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        m_assembler.movl_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+
+    void store32(Imm32 imm, ImplicitAddress address)
+    {
+        m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
+    }
+
+
+    // Floating-point operation:
+    //
+    // Presently only supports SSE, not x87 floating point.
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address.offset, address.base, dest);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_rm(src, address.offset, address.base);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.addsd_rr(src, dest);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.addsd_mr(src.offset, src.base, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.subsd_rr(src, dest);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.subsd_mr(src.offset, src.base, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.mulsd_rr(src, dest);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.mulsd_mr(src.offset, src.base, dest);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsi2sd_rr(src, dest);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.ucomisd_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MIN).
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+        return branch32(Equal, dest, Imm32(0x80000000));
+    }
+
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+    
+    void pop(RegisterID dest)
+    {
+        m_assembler.pop_r(dest);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.push_r(src);
+    }
+
+    void push(Address address)
+    {
+        m_assembler.push_m(address.offset, address.base);
+    }
+
+    void push(Imm32 imm)
+    {
+        m_assembler.push_i32(imm.m_value);
+    }
+
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        // Note: on 64-bit the Imm32 value is zero extended into the register, it
+        // may be useful to have a separate version that sign extends the value?
+        if (!imm.m_value)
+            m_assembler.xorl_rr(dest, dest);
+        else
+            m_assembler.movl_i32r(imm.m_value, dest);
+    }
+
+#if PLATFORM(X86_64)
+    void move(RegisterID src, RegisterID dest)
+    {
+        // Note: on 64-bit this is is a full register move; perhaps it would be
+        // useful to have separate move32 & movePtr, with move32 zero extending?
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        if (CAN_SIGN_EXTEND_U32_64(imm.asIntptr()))
+            m_assembler.movl_i32r(static_cast<int32_t>(imm.asIntptr()), dest);
+        else
+            m_assembler.movq_i64r(imm.asIntptr(), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        m_assembler.xchgq_rr(reg1, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movsxd_rr(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movl_rr(src, dest);
+    }
+#else
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.movl_rr(src, dest);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        m_assembler.movl_i32r(imm.asIntptr(), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        if (reg1 != reg2)
+            m_assembler.xchgl_rr(reg1, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+#endif
+
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+public:
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmpl_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testl_rr(left, left);
+        else
+            m_assembler.cmpl_ir(right.m_value, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        m_assembler.cmpl_mr(right.offset, right.base, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        m_assembler.cmpl_rm(right, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, Address left, Imm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, RegisterID right)
+    {
+        m_assembler.cmpw_rm(right, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        ASSERT(!(right.m_value & 0xFFFF0000));
+
+        m_assembler.cmpw_im(right.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        m_assembler.testl_rr(reg, mask);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // if we are only interested in the low seven bits, this can be tested with a testb
+        if (mask.m_value == -1)
+            m_assembler.testl_rr(reg, reg);
+        else if ((mask.m_value & ~0x7f) == 0)
+            m_assembler.testb_i8r(mask.m_value, reg);
+        else
+            m_assembler.testl_i32r(mask.m_value, reg);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump jump()
+    {
+        return Jump(m_assembler.jmp());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jmp_r(target);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(Address address)
+    {
+        m_assembler.jmp_m(address.offset, address.base);
+    }
+
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+    
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        add32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        mul32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        mul32(imm, src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.int3();
+    }
+
+    Call nearCall()
+    {
+        return Call(m_assembler.call(), Call::LinkableNear);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.call(target), Call::None);
+    }
+
+    void call(Address address)
+    {
+        m_assembler.call_m(address.offset, address.base);
+    }
+
+    void ret()
+    {
+        m_assembler.ret();
+    }
+
+    void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmpl_rr(right, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+    void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testl_rr(left, left);
+        else
+            m_assembler.cmpl_ir(right.m_value, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+    // FIXME:
+    // The mask should be optional... paerhaps the argument order should be
+    // dest-src, operations always have a dest? ... possibly not true, considering
+    // asm ops like test, or pseudo ops like pop().
+    void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+protected:
+    X86Assembler::Condition x86Condition(Condition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+    X86Assembler::Condition x86Condition(DoubleCondition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+private:
+    // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
+    // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
+    friend class MacroAssemblerX86;
+
+#if PLATFORM(X86)
+#if PLATFORM(MAC)
+
+    // All X86 Macs are guaranteed to support at least SSE2,
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#else // PLATFORM(MAC)
+
+    enum SSE2CheckState {
+        NotCheckedSSE2,
+        HasSSE2,
+        NoSSE2
+    };
+
+    static bool isSSE2Present()
+    {
+        if (s_sse2CheckState == NotCheckedSSE2) {
+            // Default the flags value to zero; if the compiler is
+            // not MSVC or GCC we will read this as SSE2 not present.
+            int flags = 0;
+#if COMPILER(MSVC)
+            _asm {
+                mov eax, 1 // cpuid function 1 gives us the standard feature set
+                cpuid;
+                mov flags, edx;
+            }
+#elif COMPILER(GCC)
+            asm (
+                 "movl $0x1, %%eax;"
+                 "pushl %%ebx;"
+                 "cpuid;"
+                 "popl %%ebx;"
+                 "movl %%edx, %0;"
+                 : "=g" (flags)
+                 :
+                 : "%eax", "%ecx", "%edx"
+                 );
+#endif
+            static const int SSE2FeatureBit = 1 << 26;
+            s_sse2CheckState = (flags & SSE2FeatureBit) ? HasSSE2 : NoSSE2;
+        }
+        // Only check once.
+        ASSERT(s_sse2CheckState != NotCheckedSSE2);
+
+        return s_sse2CheckState == HasSSE2;
+    }
+    
+    static SSE2CheckState s_sse2CheckState;
+
+#endif // PLATFORM(MAC)
+#elif !defined(NDEBUG) // PLATFORM(X86)
+
+    // On x86-64 we should never be checking for SSE2 in a non-debug build,
+    // but non debug add this method to keep the asserts above happy.
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#endif
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerX86Common_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
new file mode 100644
index 0000000000..4da7fe6d57
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -0,0 +1,446 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerX86_64_h
+#define MacroAssemblerX86_64_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(X86_64)
+
+#include "MacroAssemblerX86Common.h"
+
+namespace JSC {
+
+class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
+protected:
+    static const X86::RegisterID scratchRegister = X86::r11;
+
+public:
+    static const Scale ScalePtr = TimesEight;
+
+    using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
+    using MacroAssemblerX86Common::or32;
+    using MacroAssemblerX86Common::sub32;
+    using MacroAssemblerX86Common::load32;
+    using MacroAssemblerX86Common::store32;
+    using MacroAssemblerX86Common::call;
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        add32(imm, Address(scratchRegister));
+    }
+    
+    void and32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        and32(imm, Address(scratchRegister));
+    }
+    
+    void or32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        or32(imm, Address(scratchRegister));
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        sub32(imm, Address(scratchRegister));
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        if (dest == X86::eax)
+            m_assembler.movl_mEAX(address);
+        else {
+            move(X86::eax, dest);
+            m_assembler.movl_mEAX(address);
+            swap(X86::eax, dest);
+        }
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        move(X86::eax, scratchRegister);
+        move(imm, X86::eax);
+        m_assembler.movl_EAXm(address);
+        move(scratchRegister, X86::eax);
+    }
+
+    Call call()
+    {
+        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        Call result = Call(m_assembler.call(scratchRegister), Call::Linkable);
+        ASSERT(differenceBetween(label, result) == REPTACH_OFFSET_CALL_R11);
+        return result;
+    }
+
+    Call tailRecursiveCall()
+    {
+        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
+        ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
+        return Call::fromTailJump(newJump);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
+        ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
+        return Call::fromTailJump(newJump);
+    }
+
+
+    void addPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addq_rr(src, dest);
+    }
+
+    void addPtr(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.addq_ir(imm.m_value, srcDest);
+    }
+
+    void addPtr(ImmPtr imm, RegisterID dest)
+    {
+        move(imm, scratchRegister);
+        m_assembler.addq_rr(scratchRegister, dest);
+    }
+
+    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.leaq_mr(imm.m_value, src, dest);
+    }
+
+    void addPtr(Imm32 imm, Address address)
+    {
+        m_assembler.addq_im(imm.m_value, address.offset, address.base);
+    }
+
+    void addPtr(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        addPtr(imm, Address(scratchRegister));
+    }
+    
+    void andPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andq_rr(src, dest);
+    }
+
+    void andPtr(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.andq_ir(imm.m_value, srcDest);
+    }
+
+    void orPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orq_rr(src, dest);
+    }
+
+    void orPtr(ImmPtr imm, RegisterID dest)
+    {
+        move(imm, scratchRegister);
+        m_assembler.orq_rr(scratchRegister, dest);
+    }
+
+    void orPtr(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.orq_ir(imm.m_value, dest);
+    }
+
+    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
+    {
+        // On x86 we can only shift by ecx; if asked to shift by another register we'll
+        // need rejig the shift amount into ecx first, and restore the registers afterwards.
+        if (shift_amount != X86::ecx) {
+            swap(shift_amount, X86::ecx);
+
+            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
+            if (dest == shift_amount)
+                m_assembler.sarq_CLr(X86::ecx);
+            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
+            else if (dest == X86::ecx)
+                m_assembler.sarq_CLr(shift_amount);
+            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
+            else
+                m_assembler.sarq_CLr(dest);
+        
+            swap(shift_amount, X86::ecx);
+        } else
+            m_assembler.sarq_CLr(dest);
+    }
+
+    void rshiftPtr(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sarq_i8r(imm.m_value, dest);
+    }
+
+    void subPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subq_rr(src, dest);
+    }
+    
+    void subPtr(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.subq_ir(imm.m_value, dest);
+    }
+    
+    void subPtr(ImmPtr imm, RegisterID dest)
+    {
+        move(imm, scratchRegister);
+        m_assembler.subq_rr(scratchRegister, dest);
+    }
+
+    void xorPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorq_rr(src, dest);
+    }
+
+    void xorPtr(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.xorq_ir(imm.m_value, srcDest);
+    }
+
+
+    void loadPtr(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movq_mr(address.offset, address.base, dest);
+    }
+
+    void loadPtr(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void loadPtr(void* address, RegisterID dest)
+    {
+        if (dest == X86::eax)
+            m_assembler.movq_mEAX(address);
+        else {
+            move(X86::eax, dest);
+            m_assembler.movq_mEAX(address);
+            swap(X86::eax, dest);
+        }
+    }
+
+    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_assembler.movq_mr_disp32(address.offset, address.base, dest);
+        return DataLabel32(this);
+    }
+
+    void storePtr(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.movq_rm(src, address.offset, address.base);
+    }
+
+    void storePtr(RegisterID src, BaseIndex address)
+    {
+        m_assembler.movq_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+    
+    void storePtr(RegisterID src, void* address)
+    {
+        if (src == X86::eax)
+            m_assembler.movq_EAXm(address);
+        else {
+            swap(X86::eax, src);
+            m_assembler.movq_EAXm(address);
+            swap(X86::eax, src);
+        }
+    }
+
+    void storePtr(ImmPtr imm, ImplicitAddress address)
+    {
+        intptr_t ptr = imm.asIntptr();
+        if (CAN_SIGN_EXTEND_32_64(ptr))
+            m_assembler.movq_i32m(static_cast<int>(ptr), address.offset, address.base);
+        else {
+            move(imm, scratchRegister);
+            storePtr(scratchRegister, address);
+        }
+    }
+
+    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_assembler.movq_rm_disp32(src, address.offset, address.base);
+        return DataLabel32(this);
+    }
+
+    void movePtrToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void moveDoubleToPtr(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testq_rr(left, left);
+        else
+            m_assembler.cmpq_ir(right.m_value, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+    Jump branchPtr(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmpq_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
+    {
+        intptr_t imm = right.asIntptr();
+        if (CAN_SIGN_EXTEND_32_64(imm)) {
+            if (!imm)
+                m_assembler.testq_rr(left, left);
+            else
+                m_assembler.cmpq_ir(imm, left);
+            return Jump(m_assembler.jCC(x86Condition(cond)));
+        } else {
+            move(right, scratchRegister);
+            return branchPtr(cond, left, scratchRegister);
+        }
+    }
+
+    Jump branchPtr(Condition cond, RegisterID left, Address right)
+    {
+        m_assembler.cmpq_mr(right.offset, right.base, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtr(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        move(ImmPtr(left.m_ptr), scratchRegister);
+        return branchPtr(cond, Address(scratchRegister), right);
+    }
+
+    Jump branchPtr(Condition cond, Address left, RegisterID right)
+    {
+        m_assembler.cmpq_rm(right, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtr(Condition cond, Address left, ImmPtr right)
+    {
+        move(right, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
+    }
+
+    Jump branchTestPtr(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        m_assembler.testq_rr(reg, mask);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        // if we are only interested in the low seven bits, this can be tested with a testb
+        if (mask.m_value == -1)
+            m_assembler.testq_rr(reg, reg);
+        else if ((mask.m_value & ~0x7f) == 0)
+            m_assembler.testb_i8r(mask.m_value, reg);
+        else
+            m_assembler.testq_i32r(mask.m_value, reg);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpq_im(0, address.offset, address.base);
+        else
+            m_assembler.testq_i32m(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
+        else
+            m_assembler.testq_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+
+    Jump branchAddPtr(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        addPtr(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        subPtr(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_assembler.movq_i64r(initialValue.asIntptr(), dest);
+        return DataLabelPtr(this);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr label = moveWithPatch(initialValue, scratchRegister);
+        storePtr(scratchRegister, address);
+        return label;
+    }
+
+    bool supportsFloatingPoint() const { return true; }
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerX86_64_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
index 3b0ce65883..7a8b58da98 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
@@ -82,8 +82,32 @@ class X86Assembler {
 public:
     typedef X86::RegisterID RegisterID;
     typedef X86::XMMRegisterID XMMRegisterID;
+    typedef XMMRegisterID FPRegisterID;
 
     typedef enum {
+        ConditionO,
+        ConditionNO,
+        ConditionB,
+        ConditionAE,
+        ConditionE,
+        ConditionNE,
+        ConditionBE,
+        ConditionA,
+        ConditionS,
+        ConditionNS,
+        ConditionP,
+        ConditionNP,
+        ConditionL,
+        ConditionGE,
+        ConditionLE,
+        ConditionG,
+
+        ConditionC  = ConditionB,
+        ConditionNC = ConditionAE,
+    } Condition;
+
+private:
+    typedef enum {
         OP_ADD_EvGv                     = 0x01,
         OP_ADD_GvEv                     = 0x03,
         OP_OR_EvGv                      = 0x09,
@@ -145,31 +169,30 @@ public:
         OP2_ADDSD_VsdWsd    = 0x58,
         OP2_MULSD_VsdWsd    = 0x59,
         OP2_SUBSD_VsdWsd    = 0x5C,
+        OP2_MOVD_VdEd       = 0x6E,
         OP2_MOVD_EdVd       = 0x7E,
-        OP2_JO_rel32        = 0x80,
-        OP2_JB_rel32        = 0x82,
-        OP2_JAE_rel32       = 0x83,
-        OP2_JE_rel32        = 0x84,
-        OP2_JNE_rel32       = 0x85,
-        OP2_JBE_rel32       = 0x86,
-        OP2_JA_rel32        = 0x87,
-        OP2_JS_rel32        = 0x88,
-        OP2_JP_rel32        = 0x8A,
-        OP2_JL_rel32        = 0x8C,
-        OP2_JGE_rel32       = 0x8D,
-        OP2_JLE_rel32       = 0x8E,
-        OP2_JG_rel32        = 0x8F,
-        OP_SETE             = 0x94,
-        OP_SETNE            = 0x95,
+        OP2_JCC_rel32       = 0x80,
+        OP_SETCC            = 0x90,
         OP2_IMUL_GvEv       = 0xAF,
         OP2_MOVZX_GvEb      = 0xB6,
         OP2_MOVZX_GvEw      = 0xB7,
         OP2_PEXTRW_GdUdIb   = 0xC5,
     } TwoByteOpcodeID;
 
+    TwoByteOpcodeID jccRel32(Condition cond)
+    {
+        return (TwoByteOpcodeID)(OP2_JCC_rel32 + cond);
+    }
+
+    TwoByteOpcodeID setccOpcode(Condition cond)
+    {
+        return (TwoByteOpcodeID)(OP_SETCC + cond);
+    }
+
     typedef enum {
         GROUP1_OP_ADD = 0,
         GROUP1_OP_OR  = 1,
+        GROUP1_OP_ADC = 2,
         GROUP1_OP_AND = 4,
         GROUP1_OP_SUB = 5,
         GROUP1_OP_XOR = 6,
@@ -191,9 +214,6 @@ public:
         GROUP11_MOV = 0,
     } GroupOpcodeID;
     
-    // Opaque label types
-    
-private:
     class X86InstructionFormatter;
 public:
 
@@ -221,16 +241,22 @@ public:
     public:
         JmpDst()
             : m_offset(-1)
+            , m_used(false)
         {
         }
 
+        bool isUsed() const { return m_used; }
+        void used() { m_used = true; }
     private:
         JmpDst(int offset)
             : m_offset(offset)
+            , m_used(false)
         {
+            ASSERT(m_offset == offset);
         }
 
-        int m_offset;
+        int m_offset : 31;
+        bool m_used : 1;
     };
 
     X86Assembler()
@@ -269,6 +295,19 @@ public:
 
     // Arithmetic operations:
 
+#if !PLATFORM(X86_64)
+    void adcl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADC, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADC, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
     void addl_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_ADD_EvGv, src, dst);
@@ -317,6 +356,17 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+
+    void addq_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
 #else
     void addl_im(int imm, void* addr)
     {
@@ -346,6 +396,17 @@ public:
         }
     }
 
+    void andl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
 #if PLATFORM(X86_64)
     void andq_rr(RegisterID src, RegisterID dst)
     {
@@ -362,6 +423,17 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+#else
+    void andl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
 #endif
 
     void notl_r(RegisterID dst)
@@ -390,6 +462,17 @@ public:
         }
     }
 
+    void orl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
 #if PLATFORM(X86_64)
     void orq_rr(RegisterID src, RegisterID dst)
     {
@@ -406,6 +489,17 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+#else
+    void orl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
 #endif
 
     void subl_rr(RegisterID src, RegisterID dst)
@@ -441,6 +535,11 @@ public:
     }
 
 #if PLATFORM(X86_64)
+    void subq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_SUB_EvGv, src, dst);
+    }
+
     void subq_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -634,6 +733,11 @@ public:
         m_formatter.oneByteOp64(OP_CMP_EvGv, src, base, offset);
     }
 
+    void cmpq_mr(int offset, RegisterID base, RegisterID src)
+    {
+        m_formatter.oneByteOp64(OP_CMP_GvEv, src, base, offset);
+    }
+
     void cmpq_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -690,6 +794,19 @@ public:
         m_formatter.oneByteOp(OP_CMP_EvGv, src, base, index, scale, offset);
     }
 
+    void cmpw_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate16(imm);
+        }
+    }
+
     void testl_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
@@ -738,15 +855,26 @@ public:
     }
 #endif 
 
+    void testw_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
+    }
+    
     void testb_i8r(int imm, RegisterID dst)
     {
         m_formatter.oneByteOp8(OP_GROUP3_EbIb, GROUP3_OP_TEST, dst);
         m_formatter.immediate8(imm);
     }
 
+    void setCC_r(Condition cond, RegisterID dst)
+    {
+        m_formatter.twoByteOp8(setccOpcode(cond), (GroupOpcodeID)0, dst);
+    }
+
     void sete_r(RegisterID dst)
     {
-        m_formatter.twoByteOp8(OP_SETE, (GroupOpcodeID)0, dst);
+        m_formatter.twoByteOp8(setccOpcode(ConditionE), (GroupOpcodeID)0, dst);
     }
 
     void setz_r(RegisterID dst)
@@ -756,7 +884,7 @@ public:
 
     void setne_r(RegisterID dst)
     {
-        m_formatter.twoByteOp8(OP_SETNE, (GroupOpcodeID)0, dst);
+        m_formatter.twoByteOp8(setccOpcode(ConditionNE), (GroupOpcodeID)0, dst);
     }
 
     void setnz_r(RegisterID dst)
@@ -877,6 +1005,12 @@ public:
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
     }
 
+    void movq_EAXm(void* addr)
+    {
+        m_formatter.oneByteOp64(OP_MOV_OvEAX);
+        m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
+    }
+
     void movq_mr(int offset, RegisterID base, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_GvEv, dst, base, offset);
@@ -892,6 +1026,12 @@ public:
         m_formatter.oneByteOp64(OP_MOV_GvEv, dst, base, index, scale, offset);
     }
 
+    void movq_i32m(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_GROUP11_EvIz, GROUP11_MOV, base, offset);
+        m_formatter.immediate32(imm);
+    }
+
     void movq_i64r(int64_t imm, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_EAXIv, dst);
@@ -905,6 +1045,14 @@ public:
     
     
 #else
+    void movl_rm(RegisterID src, void* addr)
+    {
+        if (src == X86::eax)
+            movl_EAXm(addr);
+        else 
+            m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
+    }
+    
     void movl_mr(void* addr, RegisterID dst)
     {
         if (dst == X86::eax)
@@ -942,6 +1090,12 @@ public:
     {
         m_formatter.oneByteOp(OP_LEA, dst, base, offset);
     }
+#if PLATFORM(X86_64)
+    void leaq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_LEA, dst, base, offset);
+    }
+#endif
 
     // Flow control:
 
@@ -956,6 +1110,11 @@ public:
         m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, dst);
         return JmpSrc(m_formatter.size());
     }
+    
+    void call_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, base, offset);
+    }
 
     JmpSrc jmp()
     {
@@ -963,9 +1122,13 @@ public:
         return m_formatter.immediateRel32();
     }
     
-    void jmp_r(RegisterID dst)
+    // Return a JmpSrc so we have a label to the jump, so we can use this
+    // To make a tail recursive call on x86-64.  The MacroAssembler
+    // really shouldn't wrap this as a Jump, since it can't be linked. :-/
+    JmpSrc jmp_r(RegisterID dst)
     {
         m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, dst);
+        return JmpSrc(m_formatter.size());
     }
     
     void jmp_m(int offset, RegisterID base)
@@ -975,7 +1138,7 @@ public:
 
     JmpSrc jne()
     {
-        m_formatter.twoByteOp(OP2_JNE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionNE));
         return m_formatter.immediateRel32();
     }
     
@@ -986,73 +1149,79 @@ public:
 
     JmpSrc je()
     {
-        m_formatter.twoByteOp(OP2_JE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jl()
     {
-        m_formatter.twoByteOp(OP2_JL_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionL));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jb()
     {
-        m_formatter.twoByteOp(OP2_JB_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionB));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jle()
     {
-        m_formatter.twoByteOp(OP2_JLE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionLE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jbe()
     {
-        m_formatter.twoByteOp(OP2_JBE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionBE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jge()
     {
-        m_formatter.twoByteOp(OP2_JGE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionGE));
         return m_formatter.immediateRel32();
     }
 
     JmpSrc jg()
     {
-        m_formatter.twoByteOp(OP2_JG_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionG));
         return m_formatter.immediateRel32();
     }
 
     JmpSrc ja()
     {
-        m_formatter.twoByteOp(OP2_JA_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionA));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jae()
     {
-        m_formatter.twoByteOp(OP2_JAE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionAE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jo()
     {
-        m_formatter.twoByteOp(OP2_JO_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionO));
         return m_formatter.immediateRel32();
     }
 
     JmpSrc jp()
     {
-        m_formatter.twoByteOp(OP2_JP_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionP));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc js()
     {
-        m_formatter.twoByteOp(OP2_JS_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionS));
+        return m_formatter.immediateRel32();
+    }
+
+    JmpSrc jCC(Condition cond)
+    {
+        m_formatter.twoByteOp(jccRel32(cond));
         return m_formatter.immediateRel32();
     }
 
@@ -1088,6 +1257,20 @@ public:
         m_formatter.twoByteOp(OP2_MOVD_EdVd, (RegisterID)src, dst);
     }
 
+#if PLATFORM(X86_64)
+    void movq_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp64(OP2_MOVD_EdVd, (RegisterID)src, dst);
+    }
+
+    void movq_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp64(OP2_MOVD_VdEd, (RegisterID)dst, src);
+    }
+#endif
+
     void movsd_rm(XMMRegisterID src, int offset, RegisterID base)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1131,7 +1314,7 @@ public:
         m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, (RegisterID)dst, base, offset);
     }
 
-    void ucomis_rr(XMMRegisterID src, XMMRegisterID dst)
+    void ucomisd_rr(XMMRegisterID src, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_66);
         m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, (RegisterID)src);
@@ -1170,31 +1353,95 @@ public:
     }
 
     // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
 
-    void link(JmpSrc from, JmpDst to)
+    void linkJump(JmpSrc from, JmpDst to)
     {
-        ASSERT(to.m_offset != -1);
         ASSERT(from.m_offset != -1);
-        
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(m_formatter.data()) + from.m_offset)[-1] = to.m_offset - from.m_offset;
+        ASSERT(to.m_offset != -1);
+
+        char* code = reinterpret_cast<char*>(m_formatter.data());
+        patchRel32(code + from.m_offset, code + to.m_offset);
     }
     
-    static void patchAddress(void* code, JmpDst position, void* value)
+    static void linkJump(void* code, JmpSrc from, void* to)
     {
-        ASSERT(position.m_offset != -1);
-        
-        reinterpret_cast<void**>(reinterpret_cast<ptrdiff_t>(code) + position.m_offset)[-1] = value;
+        ASSERT(from.m_offset != -1);
+
+        patchRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
     }
-    
-    static void link(void* code, JmpSrc from, void* to)
+
+    static void linkCall(void* code, JmpSrc from, void* to)
     {
         ASSERT(from.m_offset != -1);
-        
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(code) + from.m_offset)[-1] = reinterpret_cast<ptrdiff_t>(to) - (reinterpret_cast<ptrdiff_t>(code) + from.m_offset);
+
+        patchRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
+    }
+
+#if PLATFORM(X86_64)
+    static void patchPointerForCall(void* where, void* value)
+    {
+        reinterpret_cast<void**>(where)[-1] = value;
+    }
+#endif
+
+    static void patchPointer(void* code, JmpDst where, void* value)
+    {
+        ASSERT(where.m_offset != -1);
+
+        patchPointer(reinterpret_cast<char*>(code) + where.m_offset, value);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(from) - sizeof(int32_t), sizeof(int32_t));
+        patchRel32(from, to);
     }
     
+    static void relinkCall(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(from) - sizeof(int32_t), sizeof(int32_t));
+        patchRel32(from, to);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(where) - sizeof(int32_t), sizeof(int32_t));
+        patchInt32(where, value);
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(where) - sizeof(void*), sizeof(void*));
+        patchPointer(where, value);
+    }
+
+    static void repatchLoadPtrToLEA(void* where)
+    {
+#if PLATFORM(X86_64)
+        // On x86-64 pointer memory accesses require a 64-bit operand, and as such a REX prefix.
+        // Skip over the prefix byte.
+        where = reinterpret_cast<char*>(where) + 1;
+#endif
+        ExecutableAllocator::MakeWritable unprotect(where, 1);
+        *reinterpret_cast<unsigned char*>(where) = static_cast<unsigned char>(OP_LEA);
+    }
+    
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        ASSERT(call.m_offset >= 0);
+        return call.m_offset;
+    }
+
     static void* getRelocatedAddress(void* code, JmpSrc jump)
     {
+        ASSERT(jump.m_offset != -1);
+
         return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + jump.m_offset);
     }
     
@@ -1220,23 +1467,6 @@ public:
         return dst.m_offset - src.m_offset;
     }
     
-    static void patchImmediate(intptr_t where, int32_t value)
-    {
-        reinterpret_cast<int32_t*>(where)[-1] = value;
-    }
-    
-    static void patchPointer(intptr_t where, intptr_t value)
-    {
-        reinterpret_cast<intptr_t*>(where)[-1] = value;
-    }
-    
-    static void patchBranchOffset(intptr_t where, void* destination)
-    {
-        intptr_t offset = reinterpret_cast<intptr_t>(destination) - where;
-        ASSERT(offset == static_cast<int32_t>(offset));
-        reinterpret_cast<int32_t*>(where)[-1] = static_cast<int32_t>(offset);
-    }
-    
     void* executableCopy(ExecutablePool* allocator)
     {
         void* copy = m_formatter.executableCopy(allocator);
@@ -1246,6 +1476,24 @@ public:
 
 private:
 
+    static void patchPointer(void* where, void* value)
+    {
+        reinterpret_cast<void**>(where)[-1] = value;
+    }
+
+    static void patchInt32(void* where, int32_t value)
+    {
+        reinterpret_cast<int32_t*>(where)[-1] = value;
+    }
+
+    static void patchRel32(void* from, void* to)
+    {
+        intptr_t offset = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
+        ASSERT(offset == static_cast<int32_t>(offset));
+
+        patchInt32(from, offset);
+    }
+
     class X86InstructionFormatter {
 
         static const int maxInstructionSize = 16;
@@ -1415,6 +1663,15 @@ private:
             m_buffer.putByteUnchecked(opcode);
             memoryModRM(reg, base, index, scale, offset);
         }
+
+        void twoByteOp64(TwoByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            m_buffer.ensureSpace(maxInstructionSize);
+            emitRexW(reg, 0, rm);
+            m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            m_buffer.putByteUnchecked(opcode);
+            registerModRM(reg, rm);
+        }
 #endif
 
         // Byte-operands:
@@ -1478,6 +1735,11 @@ private:
             m_buffer.putByteUnchecked(imm);
         }
 
+        void immediate16(int imm)
+        {
+            m_buffer.putShortUnchecked(imm);
+        }
+
         void immediate32(int imm)
         {
             m_buffer.putIntUnchecked(imm);
@@ -1572,13 +1834,8 @@ private:
         {
             ASSERT(mode != ModRmRegister);
 
-            // Encode sacle of (1,2,4,8) -> (0,1,2,3)
-            int shift = 0;
-            while (scale >>= 1)
-                shift++;
-
             putModRm(mode, reg, hasSib);
-            m_buffer.putByteUnchecked((shift << 6) | ((index & 7) << 3) | (base & 7));
+            m_buffer.putByteUnchecked((scale << 6) | ((index & 7) << 3) | (base & 7));
         }
 
         void registerModRM(int reg, RegisterID rm)
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index 9207c8ac4b..d2b122a35a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -55,15 +55,15 @@ static UString escapeQuotes(const UString& str)
     return result;
 }
 
-static UString valueToSourceString(ExecState* exec, JSValuePtr val)
+static UString valueToSourceString(ExecState* exec, JSValue val)
 {
-    if (val->isString()) {
+    if (val.isString()) {
         UString result("\"");
-        result += escapeQuotes(val->toString(exec)) + "\"";
+        result += escapeQuotes(val.toString(exec)) + "\"";
         return result;
     } 
 
-    return val->toString(exec);
+    return val.toString(exec);
 }
 
 static CString registerName(int r)
@@ -74,7 +74,7 @@ static CString registerName(int r)
     return (UString("r") + UString::from(r)).UTF8String();
 }
 
-static CString constantName(ExecState* exec, int k, JSValuePtr value)
+static CString constantName(ExecState* exec, int k, JSValue value)
 {
     return (valueToSourceString(exec, value) + "(@k" + UString::from(k) + ")").UTF8String();
 }
@@ -357,7 +357,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue(exec)).ascii());
+            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -497,6 +497,10 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] create_arguments\n", location);
             break;
         }
+        case op_init_arguments: {
+            printf("[%4d] init_arguments\n", location);
+            break;
+        }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
             printf("[%4d] convert_this %s\n", location, registerName(r0).c_str());
@@ -703,7 +707,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
-            JSValuePtr scope = JSValuePtr((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell);
             int id0 = (++it)->u.operand;
             printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
             it += 2;
@@ -724,15 +728,14 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_get_global_var: {
-            int r0 = it[1].u.operand;
-            JSValuePtr scope = JSValuePtr(it[2].u.jsCell);
-            int index = it[3].u.operand;
+            int r0 = (++it)->u.operand;
+            JSValue scope = JSValue((++it)->u.jsCell);
+            int index = (++it)->u.operand;
             printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
-            it += OPCODE_LENGTH(op_get_global_var);
             break;
         }
         case op_put_global_var: {
-            JSValuePtr scope = JSValuePtr((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
             printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(r0).c_str());
@@ -824,6 +827,10 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
             break;
         }
+        case op_method_check: {
+            printf("[%4d] op_method_check\n", location);
+            break;
+        }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -889,6 +896,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printConditionalJump(begin, it, location, "jneq_null");
             break;
         }
+        case op_jneq_ptr: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            break;
+        }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -896,6 +910,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
             break;
         }
+        case op_jnlesseq: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            break;
+        }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -959,6 +980,18 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
             break;
         }
+        case op_call_varargs: {
+            int dst = (++it)->u.operand;
+            int func = (++it)->u.operand;
+            int argCount = (++it)->u.operand;
+            int registerOffset = (++it)->u.operand;
+            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), registerName(argCount).c_str(), registerOffset);
+            break;
+        }
+        case op_load_varargs: {
+            printUnaryOp(location, it, "load_varargs");
+            break;
+        }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
             printf("[%4d] tear_off_activation\t %s\n", location, registerName(r0).c_str());
@@ -989,6 +1022,19 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] construct_verify\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
             break;
         }
+        case op_strcat: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int count = (++it)->u.operand;
+            printf("[%4d] op_strcat\t %s, %s, %d\n", location, registerName(r0).c_str(), registerName(r1).c_str(), count);
+            break;
+        }
+        case op_to_primitive: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printf("[%4d] op_to_primitive\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            break;
+        }
         case op_get_pnames: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -1091,8 +1137,7 @@ static HashSet<CodeBlock*> liveCodeBlockSet;
     macro(linkedCallerList) \
     macro(identifiers) \
     macro(functionExpressions) \
-    macro(constantRegisters) \
-    macro(pcVector)
+    macro(constantRegisters)
 
 #define FOR_EACH_MEMBER_VECTOR_RARE_DATA(macro) \
     macro(regexps) \
@@ -1107,7 +1152,8 @@ static HashSet<CodeBlock*> liveCodeBlockSet;
 #define FOR_EACH_MEMBER_VECTOR_EXCEPTION_INFO(macro) \
     macro(expressionInfo) \
     macro(lineInfo) \
-    macro(getByIdExceptionInfo)
+    macro(getByIdExceptionInfo) \
+    macro(pcVector)
 
 template<typename T>
 static size_t sizeInBytes(const Vector<T>& vector)
@@ -1232,6 +1278,7 @@ CodeBlock::CodeBlock(ScopeNode* ownerNode, CodeType codeType, PassRefPtr<SourceP
 #endif
     , m_needsFullScopeChain(ownerNode->needsActivation())
     , m_usesEval(ownerNode->usesEval())
+    , m_isNumericCompareFunction(false)
     , m_codeType(codeType)
     , m_source(sourceProvider)
     , m_sourceOffset(sourceOffset)
@@ -1267,6 +1314,11 @@ CodeBlock::~CodeBlock()
             callLinkInfo->callee->removeCaller(callLinkInfo);
     }
 
+    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
+        if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure)
+            structure->deref();
+    }
+
     unlinkCallers();
 #endif
 
@@ -1380,9 +1432,10 @@ void CodeBlock::mark()
             m_rareData->m_functions[i]->body()->mark();
 
         for (size_t i = 0; i < m_rareData->m_unexpectedConstants.size(); ++i) {
-            if (!m_rareData->m_unexpectedConstants[i]->marked())
-                m_rareData->m_unexpectedConstants[i]->mark();
+            if (!m_rareData->m_unexpectedConstants[i].marked())
+                m_rareData->m_unexpectedConstants[i].mark();
         }
+        m_rareData->m_evalCodeCache.mark();
     }
 }
 
@@ -1392,6 +1445,17 @@ void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
         return;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
+    if (m_needsFullScopeChain) {
+        ScopeChain sc(scopeChain);
+        int scopeDelta = sc.localDepth();
+        if (m_codeType == EvalCode)
+            scopeDelta -= static_cast<EvalCodeBlock*>(this)->baseScopeDepth();
+        else if (m_codeType == FunctionCode)
+            scopeDelta++; // Compilation of function code assumes activation is not on the scope chain yet.
+        ASSERT(scopeDelta >= 0);
+        while (scopeDelta--)
+            scopeChain = scopeChain->next;
+    }
 
     switch (m_codeType) {
         case FunctionCode: {
@@ -1399,19 +1463,43 @@ void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
             RefPtr<FunctionBodyNode> newFunctionBody = m_globalData->parser->reparse<FunctionBodyNode>(m_globalData, ownerFunctionBodyNode);
             ASSERT(newFunctionBody);
             newFunctionBody->finishParsing(ownerFunctionBodyNode->copyParameters(), ownerFunctionBodyNode->parameterCount());
-            CodeBlock& newCodeBlock = newFunctionBody->bytecodeForExceptionInfoReparse(scopeChain);
+
+            m_globalData->scopeNodeBeingReparsed = newFunctionBody.get();
+
+            CodeBlock& newCodeBlock = newFunctionBody->bytecodeForExceptionInfoReparse(scopeChain, this);
             ASSERT(newCodeBlock.m_exceptionInfo);
             ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
+
+#if ENABLE(JIT)
+            JIT::compile(m_globalData, &newCodeBlock);
+            ASSERT(newFunctionBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
+#endif
+
             m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
+
+            m_globalData->scopeNodeBeingReparsed = 0;
+
             break;
         }
         case EvalCode: {
             EvalNode* ownerEvalNode = static_cast<EvalNode*>(m_ownerNode);
             RefPtr<EvalNode> newEvalBody = m_globalData->parser->reparse<EvalNode>(m_globalData, ownerEvalNode);
-            EvalCodeBlock& newCodeBlock = newEvalBody->bytecodeForExceptionInfoReparse(scopeChain);
+
+            m_globalData->scopeNodeBeingReparsed = newEvalBody.get();
+
+            EvalCodeBlock& newCodeBlock = newEvalBody->bytecodeForExceptionInfoReparse(scopeChain, this);
             ASSERT(newCodeBlock.m_exceptionInfo);
             ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
+
+#if ENABLE(JIT)
+            JIT::compile(m_globalData, &newCodeBlock);
+            ASSERT(newEvalBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
+#endif
+
             m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
+
+            m_globalData->scopeNodeBeingReparsed = 0;
+
             break;
         }
         default:
@@ -1554,10 +1642,54 @@ bool CodeBlock::functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int&
     functionRegisterIndex = m_rareData->m_functionRegisterInfos[low - 1].functionRegisterIndex;
     return true;
 }
+#endif
+
+#if !ENABLE(JIT)
+bool CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset)
+{
+    if (m_globalResolveInstructions.isEmpty())
+        return false;
+
+    int low = 0;
+    int high = m_globalResolveInstructions.size();
+    while (low < high) {
+        int mid = low + (high - low) / 2;
+        if (m_globalResolveInstructions[mid] <= bytecodeOffset)
+            low = mid + 1;
+        else
+            high = mid;
+    }
 
-void CodeBlock::setJITCode(JITCodeRef& jitCode)
+    if (!low || m_globalResolveInstructions[low - 1] != bytecodeOffset)
+        return false;
+    return true;
+}
+#else
+bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
+{
+    if (m_globalResolveInfos.isEmpty())
+        return false;
+
+    int low = 0;
+    int high = m_globalResolveInfos.size();
+    while (low < high) {
+        int mid = low + (high - low) / 2;
+        if (m_globalResolveInfos[mid].bytecodeOffset <= bytecodeOffset)
+            low = mid + 1;
+        else
+            high = mid;
+    }
+
+    if (!low || m_globalResolveInfos[low - 1].bytecodeOffset != bytecodeOffset)
+        return false;
+    return true;
+}
+#endif
+
+#if ENABLE(JIT)
+void CodeBlock::setJITCode(JITCode jitCode)
 {
-    m_jitCode = jitCode;
+    ownerNode()->setJITCode(jitCode);
 #if !ENABLE(OPCODE_SAMPLING)
     if (!BytecodeGenerator::dumpsGeneratedCode())
         m_instructions.clear();
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 517bd27e38..ac29c6cfaa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -32,6 +32,7 @@
 
 #include "EvalCodeCache.h"
 #include "Instruction.h"
+#include "JITCode.h"
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
 #include "Nodes.h"
@@ -58,29 +59,10 @@ namespace JSC {
         uint32_t target;
         uint32_t scopeDepth;
 #if ENABLE(JIT)
-        void* nativeCode;
+        MacroAssembler::CodeLocationLabel nativeCode;
 #endif
     };
 
-#if ENABLE(JIT)
-    // The code, and the associated pool from which it was allocated.
-    struct JITCodeRef {
-        void* code;
-        RefPtr<ExecutablePool> executablePool;
-        
-        JITCodeRef()
-            : code(0)
-        {
-        }
-        
-        JITCodeRef(void* code, PassRefPtr<ExecutablePool> executablePool)
-            : code(code)
-            , executablePool(executablePool)
-        {
-        }
-    };
-#endif
-
     struct ExpressionRangeInfo {
         enum {
             MaxOffset = (1 << 7) - 1, 
@@ -108,19 +90,15 @@ namespace JSC {
 #if ENABLE(JIT)
     struct CallLinkInfo {
         CallLinkInfo()
-            : callReturnLocation(0)
-            , hotPathBegin(0)
-            , hotPathOther(0)
-            , coldPathOther(0)
-            , callee(0)
+            : callee(0)
         {
         }
     
         unsigned bytecodeIndex;
-        void* callReturnLocation;
-        void* hotPathBegin;
-        void* hotPathOther;
-        void* coldPathOther;
+        MacroAssembler::CodeLocationNearCall callReturnLocation;
+        MacroAssembler::CodeLocationDataLabelPtr hotPathBegin;
+        MacroAssembler::CodeLocationNearCall hotPathOther;
+        MacroAssembler::CodeLocationLabel coldPathOther;
         CodeBlock* callee;
         unsigned position;
         
@@ -128,6 +106,17 @@ namespace JSC {
         bool isLinked() { return callee; }
     };
 
+    struct MethodCallLinkInfo {
+        MethodCallLinkInfo()
+            : cachedStructure(0)
+        {
+        }
+
+        MacroAssembler::CodeLocationCall callReturnLocation;
+        MacroAssembler::CodeLocationDataLabelPtr structureLabel;
+        Structure* cachedStructure;
+    };
+
     struct FunctionRegisterInfo {
         FunctionRegisterInfo(unsigned bytecodeOffset, int functionRegisterIndex)
             : bytecodeOffset(bytecodeOffset)
@@ -140,24 +129,30 @@ namespace JSC {
     };
 
     struct GlobalResolveInfo {
-        GlobalResolveInfo()
+        GlobalResolveInfo(unsigned bytecodeOffset)
             : structure(0)
             , offset(0)
+            , bytecodeOffset(bytecodeOffset)
         {
         }
 
         Structure* structure;
         unsigned offset;
+        unsigned bytecodeOffset;
     };
 
-    struct PC {
-        PC(ptrdiff_t nativePCOffset, unsigned bytecodeIndex)
-            : nativePCOffset(nativePCOffset)
+    // This structure is used to map from a call return location
+    // (given as an offset in bytes into the JIT code) back to
+    // the bytecode index of the corresponding bytecode operation.
+    // This is then used to look up the corresponding handler.
+    struct CallReturnOffsetToBytecodeIndex {
+        CallReturnOffsetToBytecodeIndex(unsigned callReturnOffset, unsigned bytecodeIndex)
+            : callReturnOffset(callReturnOffset)
             , bytecodeIndex(bytecodeIndex)
         {
         }
 
-        ptrdiff_t nativePCOffset;
+        unsigned callReturnOffset;
         unsigned bytecodeIndex;
     };
 
@@ -165,17 +160,22 @@ namespace JSC {
 
     inline void* getStructureStubInfoReturnLocation(StructureStubInfo* structureStubInfo)
     {
-        return structureStubInfo->callReturnLocation;
+        return structureStubInfo->callReturnLocation.calleeReturnAddressValue();
     }
 
     inline void* getCallLinkInfoReturnLocation(CallLinkInfo* callLinkInfo)
     {
-        return callLinkInfo->callReturnLocation;
+        return callLinkInfo->callReturnLocation.calleeReturnAddressValue();
+    }
+
+    inline void* getMethodCallLinkInfoReturnLocation(MethodCallLinkInfo* methodCallLinkInfo)
+    {
+        return methodCallLinkInfo->callReturnLocation.calleeReturnAddressValue();
     }
 
-    inline ptrdiff_t getNativePCOffset(PC* pc)
+    inline unsigned getCallReturnOffset(CallReturnOffsetToBytecodeIndex* pc)
     {
-        return pc->nativePCOffset;
+        return pc->callReturnOffset;
     }
 
     // Binary chop algorithm, calls valueAtPosition on pre-sorted elements in array,
@@ -242,7 +242,7 @@ namespace JSC {
                 return true;
 
             if (isConstantRegisterIndex(index))
-                return !JSImmediate::isImmediate(getConstant(index));
+                return getConstant(index).isCell();
 
             return false;
         }
@@ -252,9 +252,9 @@ namespace JSC {
             return index >= m_numVars && index < m_numVars + m_numConstants;
         }
 
-        ALWAYS_INLINE JSValuePtr getConstant(int index)
+        ALWAYS_INLINE JSValue getConstant(int index)
         {
-            return m_constantRegisters[index - m_numVars].getJSValue();
+            return m_constantRegisters[index - m_numVars].jsValue();
         }
 
         ALWAYS_INLINE bool isTemporaryRegisterIndex(int index)
@@ -297,24 +297,31 @@ namespace JSC {
             return *(binaryChop<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress));
         }
 
-        unsigned getBytecodeIndex(void* nativePC)
+        MethodCallLinkInfo& getMethodCallLinkInfo(void* returnAddress)
         {
-            ptrdiff_t nativePCOffset = reinterpret_cast<void**>(nativePC) - reinterpret_cast<void**>(m_jitCode.code);
-            return binaryChop<PC, ptrdiff_t, getNativePCOffset>(m_pcVector.begin(), m_pcVector.size(), nativePCOffset)->bytecodeIndex;
+            return *(binaryChop<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress));
         }
 
+        unsigned getBytecodeIndex(CallFrame* callFrame, void* nativePC)
+        {
+            reparseForExceptionInfoIfNecessary(callFrame);
+            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(m_exceptionInfo->m_callReturnIndexVector.begin(), m_exceptionInfo->m_callReturnIndexVector.size(), ownerNode()->generatedJITCode().offsetOf(nativePC))->bytecodeIndex;
+        }
+        
         bool functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex);
 #endif
 
+        void setIsNumericCompareFunction(bool isNumericCompareFunction) { m_isNumericCompareFunction = isNumericCompareFunction; }
+        bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
+
         Vector<Instruction>& instructions() { return m_instructions; }
 #ifndef NDEBUG
         void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }
 #endif
 
 #if ENABLE(JIT)
-        void setJITCode(JITCodeRef& jitCode);
-        void* jitCode() { return m_jitCode.code; }
-        ExecutablePool* executablePool() { return m_jitCode.executablePool.get(); }
+        void setJITCode(JITCode);
+        ExecutablePool* executablePool() { return ownerNode()->getExecutablePool(); }
 #endif
 
         ScopeNode* ownerNode() const { return m_ownerNode; }
@@ -343,22 +350,25 @@ namespace JSC {
 
 #if !ENABLE(JIT)
         void addPropertyAccessInstruction(unsigned propertyAccessInstruction) { m_propertyAccessInstructions.append(propertyAccessInstruction); }
-        void addGlobalResolveInstruction(unsigned globalResolveInstructions) { m_globalResolveInstructions.append(globalResolveInstructions); }
+        void addGlobalResolveInstruction(unsigned globalResolveInstruction) { m_globalResolveInstructions.append(globalResolveInstruction); }
+        bool hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset);
 #else
         size_t numberOfStructureStubInfos() const { return m_structureStubInfos.size(); }
         void addStructureStubInfo(const StructureStubInfo& stubInfo) { m_structureStubInfos.append(stubInfo); }
         StructureStubInfo& structureStubInfo(int index) { return m_structureStubInfos[index]; }
 
-        void addGlobalResolveInfo() { m_globalResolveInfos.append(GlobalResolveInfo()); }
+        void addGlobalResolveInfo(unsigned globalResolveInstruction) { m_globalResolveInfos.append(GlobalResolveInfo(globalResolveInstruction)); }
         GlobalResolveInfo& globalResolveInfo(int index) { return m_globalResolveInfos[index]; }
+        bool hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset);
 
         size_t numberOfCallLinkInfos() const { return m_callLinkInfos.size(); }
         void addCallLinkInfo() { m_callLinkInfos.append(CallLinkInfo()); }
         CallLinkInfo& callLinkInfo(int index) { return m_callLinkInfos[index]; }
 
-        void addFunctionRegisterInfo(unsigned bytecodeOffset, int functionIndex) { createRareDataIfNecessary(); m_rareData->m_functionRegisterInfos.append(FunctionRegisterInfo(bytecodeOffset, functionIndex)); }
+        void addMethodCallLinkInfos(unsigned n) { m_methodCallLinkInfos.grow(n); }
+        MethodCallLinkInfo& methodCallLinkInfo(int index) { return m_methodCallLinkInfos[index]; }
 
-        Vector<PC>& pcVector() { return m_pcVector; }
+        void addFunctionRegisterInfo(unsigned bytecodeOffset, int functionIndex) { createRareDataIfNecessary(); m_rareData->m_functionRegisterInfos.append(FunctionRegisterInfo(bytecodeOffset, functionIndex)); }
 #endif
 
         // Exception handling support
@@ -367,6 +377,7 @@ namespace JSC {
         void addExceptionHandler(const HandlerInfo& hanler) { createRareDataIfNecessary(); return m_rareData->m_exceptionHandlers.append(hanler); }
         HandlerInfo& exceptionHandler(int index) { ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
 
+        bool hasExceptionInfo() const { return m_exceptionInfo; }
         void clearExceptionInfo() { m_exceptionInfo.clear(); }
 
         void addExpressionInfo(const ExpressionRangeInfo& expressionInfo) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_expressionInfo.append(expressionInfo); }
@@ -376,6 +387,10 @@ namespace JSC {
         void addLineInfo(const LineInfo& lineInfo) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_lineInfo.append(lineInfo); }
         LineInfo& lastLineInfo() { ASSERT(m_exceptionInfo); return m_exceptionInfo->m_lineInfo.last(); }
 
+#if ENABLE(JIT)
+        Vector<CallReturnOffsetToBytecodeIndex>& callReturnIndexVector() { ASSERT(m_exceptionInfo); return m_exceptionInfo->m_callReturnIndexVector; }
+#endif
+
         // Constant Pool
 
         size_t numberOfIdentifiers() const { return m_identifiers.size(); }
@@ -392,8 +407,10 @@ namespace JSC {
         unsigned addFunction(FuncDeclNode* n) { createRareDataIfNecessary(); unsigned size = m_rareData->m_functions.size(); m_rareData->m_functions.append(n); return size; }
         FuncDeclNode* function(int index) const { ASSERT(m_rareData); return m_rareData->m_functions[index].get(); }
 
-        unsigned addUnexpectedConstant(JSValuePtr v) { createRareDataIfNecessary(); unsigned size = m_rareData->m_unexpectedConstants.size(); m_rareData->m_unexpectedConstants.append(v); return size; }
-        JSValuePtr unexpectedConstant(int index) const { ASSERT(m_rareData); return m_rareData->m_unexpectedConstants[index]; }
+        bool hasFunctions() const { return m_functionExpressions.size() || (m_rareData && m_rareData->m_functions.size()); }
+
+        unsigned addUnexpectedConstant(JSValue v) { createRareDataIfNecessary(); unsigned size = m_rareData->m_unexpectedConstants.size(); m_rareData->m_unexpectedConstants.append(v); return size; }
+        JSValue unexpectedConstant(int index) const { ASSERT(m_rareData); return m_rareData->m_unexpectedConstants[index]; }
 
         unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
@@ -451,15 +468,13 @@ namespace JSC {
 #ifndef NDEBUG
         unsigned m_instructionCount;
 #endif
-#if ENABLE(JIT)
-        JITCodeRef m_jitCode;
-#endif
 
         int m_thisRegister;
 
         bool m_needsFullScopeChain;
         bool m_usesEval;
         bool m_usesArguments;
+        bool m_isNumericCompareFunction;
 
         CodeType m_codeType;
 
@@ -473,9 +488,8 @@ namespace JSC {
         Vector<StructureStubInfo> m_structureStubInfos;
         Vector<GlobalResolveInfo> m_globalResolveInfos;
         Vector<CallLinkInfo> m_callLinkInfos;
+        Vector<MethodCallLinkInfo> m_methodCallLinkInfos;
         Vector<CallLinkInfo*> m_linkedCallerList;
-
-        Vector<PC> m_pcVector;
 #endif
 
         Vector<unsigned> m_jumpTargets;
@@ -491,6 +505,10 @@ namespace JSC {
             Vector<ExpressionRangeInfo> m_expressionInfo;
             Vector<LineInfo> m_lineInfo;
             Vector<GetByIdExceptionInfo> m_getByIdExceptionInfo;
+
+#if ENABLE(JIT)
+            Vector<CallReturnOffsetToBytecodeIndex> m_callReturnIndexVector;
+#endif
         };
         OwnPtr<ExceptionInfo> m_exceptionInfo;
 
@@ -499,7 +517,7 @@ namespace JSC {
 
             // Rare Constants
             Vector<RefPtr<FuncDeclNode> > m_functions;
-            Vector<JSValuePtr> m_unexpectedConstants;
+            Vector<JSValue> m_unexpectedConstants;
             Vector<RefPtr<RegExp> > m_regexps;
 
             // Jump Tables
@@ -542,10 +560,16 @@ namespace JSC {
 
     class EvalCodeBlock : public ProgramCodeBlock {
     public:
-        EvalCodeBlock(ScopeNode* ownerNode, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider)
+        EvalCodeBlock(ScopeNode* ownerNode, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth)
             : ProgramCodeBlock(ownerNode, EvalCode, globalObject, sourceProvider)
+            , m_baseScopeDepth(baseScopeDepth)
         {
         }
+
+        int baseScopeDepth() const { return m_baseScopeDepth; }
+
+    private:
+        int m_baseScopeDepth;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
index 29be295447..f0ce73e953 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,7 +41,7 @@ namespace JSC {
 
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValuePtr& exceptionValue)
+        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
             RefPtr<EvalNode> evalNode;
 
@@ -68,11 +68,18 @@ namespace JSC {
 
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
+        void mark()
+        {
+            EvalCacheMap::iterator end = m_cacheMap.end();
+            for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr)
+                ptr->second->mark();
+        }
     private:
         static const int maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
-        HashMap<RefPtr<UString::Rep>, RefPtr<EvalNode> > m_cacheMap;
+        typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalNode> > EvalCacheMap;
+        EvalCacheMap m_cacheMap;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
index 81a7fa0172..24ba490202 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
@@ -29,14 +29,25 @@
 #ifndef Instruction_h
 #define Instruction_h
 
+#include "MacroAssembler.h"
 #include "Opcode.h"
 #include "Structure.h"
 #include <wtf/VectorTraits.h>
 
-#define POLYMORPHIC_LIST_CACHE_SIZE 4
+#define POLYMORPHIC_LIST_CACHE_SIZE 8
 
 namespace JSC {
 
+    // *Sigh*, If the JIT is enabled we need to track the stubRountine (of type MacroAssembler::CodeLocationLabel),
+    // If the JIT is not in use we don't actually need the variable (that said, if the JIT is not in use we don't
+    // curently actually use PolymorphicAccessStructureLists, which we should).  Anyway, this seems like the best
+    // solution for now - will need to something smarter if/when we actually want mixed-mode operation.
+#if ENABLE(JIT)
+    typedef MacroAssembler::CodeLocationLabel PolymorphicAccessStructureListStubRoutineType;
+#else
+    typedef void* PolymorphicAccessStructureListStubRoutineType;
+#endif
+
     class JSCell;
     class Structure;
     class StructureChain;
@@ -45,14 +56,14 @@ namespace JSC {
     struct PolymorphicAccessStructureList {
         struct PolymorphicStubInfo {
             bool isChain;
-            void* stubRoutine;
+            PolymorphicAccessStructureListStubRoutineType stubRoutine;
             Structure* base;
             union {
                 Structure* proto;
                 StructureChain* chain;
             } u;
 
-            void set(void* _stubRoutine, Structure* _base)
+            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
             {
                 stubRoutine = _stubRoutine;
                 base = _base;
@@ -60,7 +71,7 @@ namespace JSC {
                 isChain = false;
             }
             
-            void set(void* _stubRoutine, Structure* _base, Structure* _proto)
+            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
             {
                 stubRoutine = _stubRoutine;
                 base = _base;
@@ -68,7 +79,7 @@ namespace JSC {
                 isChain = false;
             }
             
-            void set(void* _stubRoutine, Structure* _base, StructureChain* _chain)
+            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
             {
                 stubRoutine = _stubRoutine;
                 base = _base;
@@ -77,17 +88,17 @@ namespace JSC {
             }
         } list[POLYMORPHIC_LIST_CACHE_SIZE];
         
-        PolymorphicAccessStructureList(void* stubRoutine, Structure* firstBase)
+        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
         {
             list[0].set(stubRoutine, firstBase);
         }
 
-        PolymorphicAccessStructureList(void* stubRoutine, Structure* firstBase, Structure* firstProto)
+        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
         {
             list[0].set(stubRoutine, firstBase, firstProto);
         }
 
-        PolymorphicAccessStructureList(void* stubRoutine, Structure* firstBase, StructureChain* firstChain)
+        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
         {
             list[0].set(stubRoutine, firstBase, firstChain);
         }
@@ -111,11 +122,20 @@ namespace JSC {
     };
 
     struct Instruction {
-        Instruction(Opcode opcode) { u.opcode = opcode; }
+        Instruction(Opcode opcode)
+        {
+#if !HAVE(COMPUTED_GOTO)
+            // We have to initialize one of the pointer members to ensure that
+            // the entire struct is initialized, when opcode is not a pointer.
+            u.jsCell = 0;
+#endif
+            u.opcode = opcode;
+        }
+
         Instruction(int operand)
         {
             // We have to initialize one of the pointer members to ensure that
-            // the entire struct is initialised in 64-bit.
+            // the entire struct is initialized in 64-bit.
             u.jsCell = 0;
             u.operand = operand;
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h
index 44e224d566..eee773cffb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h
@@ -30,6 +30,7 @@
 #ifndef JumpTable_h
 #define JumpTable_h
 
+#include "MacroAssembler.h"
 #include "UString.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
@@ -39,7 +40,7 @@ namespace JSC {
     struct OffsetLocation {
         int32_t branchOffset;
 #if ENABLE(JIT)
-        void* ctiOffset;
+        MacroAssembler::CodeLocationLabel ctiOffset;
 #endif
     };
 
@@ -47,7 +48,7 @@ namespace JSC {
         typedef HashMap<RefPtr<UString::Rep>, OffsetLocation> StringOffsetTable;
         StringOffsetTable offsetTable;
 #if ENABLE(JIT)
-        void* ctiDefault; // FIXME: it should not be necessary to store this.
+        MacroAssembler::CodeLocationLabel ctiDefault; // FIXME: it should not be necessary to store this.
 #endif
 
         inline int32_t offsetForValue(UString::Rep* value, int32_t defaultOffset)
@@ -60,7 +61,7 @@ namespace JSC {
         }
 
 #if ENABLE(JIT)
-        inline void* ctiForValue(UString::Rep* value)
+        inline MacroAssembler::CodeLocationLabel ctiForValue(UString::Rep* value)
         {
             StringOffsetTable::const_iterator end = offsetTable.end();
             StringOffsetTable::const_iterator loc = offsetTable.find(value);
@@ -76,8 +77,8 @@ namespace JSC {
         Vector<int32_t> branchOffsets;
         int32_t min;
 #if ENABLE(JIT)
-        Vector<void*> ctiOffsets;
-        void* ctiDefault;
+        Vector<MacroAssembler::CodeLocationLabel> ctiOffsets;
+        MacroAssembler::CodeLocationLabel ctiDefault;
 #endif
 
         int32_t offsetForValue(int32_t value, int32_t defaultOffset);
@@ -88,7 +89,7 @@ namespace JSC {
         }
 
 #if ENABLE(JIT)
-        inline void* ctiForValue(int32_t value)
+        inline MacroAssembler::CodeLocationLabel ctiForValue(int32_t value)
         {
             if (value >= min && static_cast<uint32_t>(value - min) < ctiOffsets.size())
                 return ctiOffsets[value - min];
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index e9c8f78cdb..f4421dff97 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -40,6 +40,7 @@ namespace JSC {
     #define FOR_EACH_OPCODE_ID(macro) \
         macro(op_enter, 1) \
         macro(op_enter_with_activation, 2) \
+        macro(op_init_arguments, 1) \
         macro(op_create_arguments, 1) \
         macro(op_convert_this, 2) \
         \
@@ -94,7 +95,7 @@ namespace JSC {
         macro(op_resolve_global, 6) \
         macro(op_get_scoped_var, 4) \
         macro(op_put_scoped_var, 4) \
-        macro(op_get_global_var, 6) \
+        macro(op_get_global_var, 4) \
         macro(op_put_global_var, 4) \
         macro(op_resolve_base, 3) \
         macro(op_resolve_with_base, 4) \
@@ -125,7 +126,9 @@ namespace JSC {
         macro(op_jfalse, 3) \
         macro(op_jeq_null, 3) \
         macro(op_jneq_null, 3) \
+        macro(op_jneq_ptr, 4) \
         macro(op_jnless, 4) \
+        macro(op_jnlesseq, 4) \
         macro(op_jmp_scopes, 3) \
         macro(op_loop, 2) \
         macro(op_loop_if_true, 3) \
@@ -139,12 +142,17 @@ namespace JSC {
         macro(op_new_func_exp, 3) \
         macro(op_call, 5) \
         macro(op_call_eval, 5) \
+        macro(op_call_varargs, 5) \
+        macro(op_load_varargs, 3) \
         macro(op_tear_off_activation, 2) \
         macro(op_tear_off_arguments, 1) \
         macro(op_ret, 2) \
+        macro(op_method_check, 1) \
         \
         macro(op_construct, 7) \
         macro(op_construct_verify, 3) \
+        macro(op_strcat, 4) \
+        macro(op_to_primitive, 3) \
         \
         macro(op_get_pnames, 3) \
         macro(op_next_pname, 4) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
index ffb91323f2..86517233ae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -39,24 +39,57 @@
 
 namespace JSC {
 
-void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+#if ENABLE(SAMPLING_FLAGS)
+
+void SamplingFlags::sample()
 {
-    if (!m_samples) {
-        m_size = codeBlock->instructions().size();
-        m_samples = static_cast<int*>(calloc(m_size, sizeof(int)));
-        m_codeBlock = codeBlock;
+    uint32_t mask = 1 << 31;
+    unsigned index;
+
+    for (index = 0; index < 32; ++index) {
+        if (mask & s_flags)
+            break;
+        mask >>= 1;
     }
 
-    ++m_sampleCount;
+    s_flagCounts[32 - index]++;
+}
 
-    unsigned offest = vPC - codeBlock->instructions().begin();
-    // Since we don't read and write codeBlock and vPC atomically, this check
-    // can fail if we sample mid op_call / op_ret.
-    if (offest < m_size) {
-        m_samples[offest]++;
-        m_opcodeSampleCount++;
-    }
+void SamplingFlags::start()
+{
+    for (unsigned i = 0; i <= 32; ++i)
+        s_flagCounts[i] = 0;
 }
+void SamplingFlags::stop()
+{
+    uint64_t total = 0;
+    for (unsigned i = 0; i <= 32; ++i)
+        total += s_flagCounts[i];
+
+    if (total) {
+        printf("\nSamplingFlags: sample counts with flags set: (%lld total)\n", total);
+        for (unsigned i = 0; i <= 32; ++i) {
+            if (s_flagCounts[i])
+                printf("  [ %02d ] : %lld\t\t(%03.2f%%)\n", i, s_flagCounts[i], (100.0 * s_flagCounts[i]) / total);
+        }
+        printf("\n");
+    } else
+    printf("\nSamplingFlags: no samples.\n\n");
+}
+uint64_t SamplingFlags::s_flagCounts[33];
+
+#else
+void SamplingFlags::start() {}
+void SamplingFlags::stop() {}
+#endif
+
+/*
+  Start with flag 16 set.
+  By doing this the monitoring of lower valued flags will be masked out
+  until flag 16 is explictly cleared.
+*/
+uint32_t SamplingFlags::s_flags = 1 << 15;
+
 
 #if PLATFORM(WIN_OS)
 
@@ -82,62 +115,113 @@ static inline unsigned hertz2us(unsigned hertz)
     return 1000000 / hertz;
 }
 
-void SamplingTool::run()
+
+SamplingTool* SamplingTool::s_samplingTool = 0;
+
+
+bool SamplingThread::s_running = false;
+unsigned SamplingThread::s_hertz = 10000;
+ThreadIdentifier SamplingThread::s_samplingThread;
+
+void* SamplingThread::threadStartFunc(void*)
 {
-    while (m_running) {
-        sleepForMicroseconds(hertz2us(m_hertz));
+    while (s_running) {
+        sleepForMicroseconds(hertz2us(s_hertz));
 
-        Sample sample(m_sample, m_codeBlock);
-        ++m_sampleCount;
+#if ENABLE(SAMPLING_FLAGS)
+        SamplingFlags::sample();
+#endif
+#if ENABLE(OPCODE_SAMPLING)
+        SamplingTool::sample();
+#endif
+    }
 
-        if (sample.isNull())
-            continue;
+    return 0;
+}
 
-        if (!sample.inHostFunction()) {
-            unsigned opcodeID = m_interpreter->getOpcodeID(sample.vPC()[0].u.opcode);
 
-            ++m_opcodeSampleCount;
-            ++m_opcodeSamples[opcodeID];
+void SamplingThread::start(unsigned hertz)
+{
+    ASSERT(!s_running);
+    s_running = true;
+    s_hertz = hertz;
 
-            if (sample.inCTIFunction())
-                m_opcodeSamplesInCTIFunctions[opcodeID]++;
-        }
+    s_samplingThread = createThread(threadStartFunc, 0, "JavaScriptCore::Sampler");
+}
+
+void SamplingThread::stop()
+{
+    ASSERT(s_running);
+    s_running = false;
+    waitForThreadCompletion(s_samplingThread, 0);
+}
+
+
+void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+{
+    if (!m_samples) {
+        m_size = codeBlock->instructions().size();
+        m_samples = static_cast<int*>(calloc(m_size, sizeof(int)));
+        m_codeBlock = codeBlock;
+    }
+
+    ++m_sampleCount;
+
+    unsigned offest = vPC - codeBlock->instructions().begin();
+    // Since we don't read and write codeBlock and vPC atomically, this check
+    // can fail if we sample mid op_call / op_ret.
+    if (offest < m_size) {
+        m_samples[offest]++;
+        m_opcodeSampleCount++;
+    }
+}
+
+void SamplingTool::doRun()
+{
+    Sample sample(m_sample, m_codeBlock);
+    ++m_sampleCount;
+
+    if (sample.isNull())
+        return;
+
+    if (!sample.inHostFunction()) {
+        unsigned opcodeID = m_interpreter->getOpcodeID(sample.vPC()[0].u.opcode);
+
+        ++m_opcodeSampleCount;
+        ++m_opcodeSamples[opcodeID];
+
+        if (sample.inCTIFunction())
+            m_opcodeSamplesInCTIFunctions[opcodeID]++;
+    }
 
 #if ENABLE(CODEBLOCK_SAMPLING)
+    if (CodeBlock* codeBlock = sample.codeBlock()) {
         MutexLocker locker(m_scopeSampleMapMutex);
-        ScopeSampleRecord* record = m_scopeSampleMap->get(sample.codeBlock()->ownerNode);
+        ScopeSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerNode());
         ASSERT(record);
-        record->sample(sample.codeBlock(), sample.vPC());
-#endif
+        record->sample(codeBlock, sample.vPC());
     }
+#endif
 }
 
-void* SamplingTool::threadStartFunc(void* samplingTool)
+void SamplingTool::sample()
 {
-    reinterpret_cast<SamplingTool*>(samplingTool)->run();
-    return 0;
+    s_samplingTool->doRun();
 }
 
 void SamplingTool::notifyOfScope(ScopeNode* scope)
 {
+#if ENABLE(CODEBLOCK_SAMPLING)
     MutexLocker locker(m_scopeSampleMapMutex);
     m_scopeSampleMap->set(scope, new ScopeSampleRecord(scope));
+#else
+    UNUSED_PARAM(scope);
+#endif
 }
 
-void SamplingTool::start(unsigned hertz)
-{
-    ASSERT(!m_running);
-    m_running = true;
-    m_hertz = hertz;
-
-    m_samplingThread = createThread(threadStartFunc, this, "JavaScriptCore::Sampler");
-}
-
-void SamplingTool::stop()
+void SamplingTool::setup()
 {
-    ASSERT(m_running);
-    m_running = false;
-    waitForThreadCompletion(m_samplingThread, 0);
+    s_samplingTool = this;
 }
 
 #if ENABLE(OPCODE_SAMPLING)
@@ -153,14 +237,6 @@ struct LineCountInfo {
     unsigned count;
 };
 
-static int compareLineCountInfoSampling(const void* left, const void* right)
-{
-    const LineCountInfo* leftLineCount = reinterpret_cast<const LineCountInfo*>(left);
-    const LineCountInfo* rightLineCount = reinterpret_cast<const LineCountInfo*>(right);
-
-    return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
-}
-
 static int compareOpcodeIndicesSampling(const void* left, const void* right)
 {
     const OpcodeSampleInfo* leftSampleInfo = reinterpret_cast<const OpcodeSampleInfo*>(left);
@@ -169,6 +245,15 @@ static int compareOpcodeIndicesSampling(const void* left, const void* right)
     return (leftSampleInfo->count < rightSampleInfo->count) ? 1 : (leftSampleInfo->count > rightSampleInfo->count) ? -1 : 0;
 }
 
+#if ENABLE(CODEBLOCK_SAMPLING)
+static int compareLineCountInfoSampling(const void* left, const void* right)
+{
+    const LineCountInfo* leftLineCount = reinterpret_cast<const LineCountInfo*>(left);
+    const LineCountInfo* rightLineCount = reinterpret_cast<const LineCountInfo*>(right);
+
+    return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
+}
+
 static int compareScopeSampleRecords(const void* left, const void* right)
 {
     const ScopeSampleRecord* const leftValue = *static_cast<const ScopeSampleRecord* const *>(left);
@@ -176,6 +261,7 @@ static int compareScopeSampleRecords(const void* left, const void* right)
 
     return (leftValue->m_sampleCount < rightValue->m_sampleCount) ? 1 : (leftValue->m_sampleCount > rightValue->m_sampleCount) ? -1 : 0;
 }
+#endif
 
 void SamplingTool::dump(ExecState* exec)
 {
@@ -227,6 +313,8 @@ void SamplingTool::dump(ExecState* exec)
     printf("\tcti count:\tsamples inside a CTI function called by this opcode\n");
     printf("\tcti %% of self:\tcti count / sample count\n");
     
+#if ENABLE(CODEBLOCK_SAMPLING)
+
     // (3) Build and sort 'codeBlockSamples' array.
 
     int scopeCount = m_scopeSampleMap->size();
@@ -248,8 +336,8 @@ void SamplingTool::dump(ExecState* exec)
         double blockPercent = (record->m_sampleCount * 100.0) / m_sampleCount;
 
         if (blockPercent >= 1) {
-            Instruction* code = codeBlock->instructions().begin();
-            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_scope->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(0), record->m_sampleCount, m_sampleCount, blockPercent);
+            //Instruction* code = codeBlock->instructions().begin();
+            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_scope->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(exec, 0), record->m_sampleCount, m_sampleCount, blockPercent);
             if (i < 10) {
                 HashMap<unsigned,unsigned> lineCounts;
                 codeBlock->dump(exec);
@@ -259,9 +347,7 @@ void SamplingTool::dump(ExecState* exec)
                     int count = record->m_samples[op];
                     if (count) {
                         printf("    [% 4d] has sample count: % 4d\n", op, count);
-                        // It is okay to pass 0 as the CallFrame for lineNumberForBytecodeOffset since
-                        // we ensure exception information when Sampling is enabled.
-                        unsigned line = codeBlock->lineNumberForBytecodeOffset(0, op);
+                        unsigned line = codeBlock->lineNumberForBytecodeOffset(exec, op);
                         lineCounts.set(line, (lineCounts.contains(line) ? lineCounts.get(line) : 0) + count);
                     }
                 }
@@ -287,6 +373,9 @@ void SamplingTool::dump(ExecState* exec)
             }
         }
     }
+#else
+    UNUSED_PARAM(exec);
+#endif
 }
 
 #else
@@ -297,4 +386,21 @@ void SamplingTool::dump(ExecState*)
 
 #endif
 
+void AbstractSamplingCounter::dump()
+{
+#if ENABLE(SAMPLING_COUNTERS)
+    if (s_abstractSamplingCounterChain != &s_abstractSamplingCounterChainEnd) {
+        printf("\nSampling Counter Values:\n");
+        for (AbstractSamplingCounter* currCounter = s_abstractSamplingCounterChain; (currCounter != &s_abstractSamplingCounterChainEnd); currCounter = currCounter->m_next)
+            printf("\t%s\t: %lld\n", currCounter->m_name, currCounter->m_counter);
+        printf("\n\n");
+    }
+    s_completed = true;
+#endif
+}
+
+AbstractSamplingCounter AbstractSamplingCounter::s_abstractSamplingCounterChainEnd;
+AbstractSamplingCounter* AbstractSamplingCounter::s_abstractSamplingCounterChain = &s_abstractSamplingCounterChainEnd;
+bool AbstractSamplingCounter::s_completed = false;
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
index daf99d2099..7d7dc9c959 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
@@ -38,6 +38,54 @@
 
 namespace JSC {
 
+    class SamplingFlags {
+        friend class JIT;
+    public:
+        static void start();
+        static void stop();
+
+#if ENABLE(SAMPLING_FLAGS)
+        static void setFlag(unsigned flag)
+        {
+            ASSERT(flag >= 1);
+            ASSERT(flag <= 32);
+            s_flags |= 1u << (flag - 1);
+        }
+
+        static void clearFlag(unsigned flag)
+        {
+            ASSERT(flag >= 1);
+            ASSERT(flag <= 32);
+            s_flags &= ~(1u << (flag - 1));
+        }
+
+        static void sample();
+
+        class ScopedFlag {
+        public:
+            ScopedFlag(int flag)
+                : m_flag(flag)
+            {
+                setFlag(flag);
+            }
+
+            ~ScopedFlag()
+            {
+                clearFlag(m_flag);
+            }
+
+        private:
+            int m_flag;
+        };
+    
+#endif
+    private:
+        static uint32_t s_flags;
+#if ENABLE(SAMPLING_FLAGS)
+        static uint64_t s_flagCounts[33];
+#endif
+    };
+
     class CodeBlock;
     class ExecState;
     class Interpreter;
@@ -73,6 +121,19 @@ namespace JSC {
 
     typedef WTF::HashMap<ScopeNode*, ScopeSampleRecord*> ScopeSampleRecordMap;
 
+    class SamplingThread {
+    public:
+        // Sampling thread state.
+        static bool s_running;
+        static unsigned s_hertz;
+        static ThreadIdentifier s_samplingThread;
+
+        static void start(unsigned hertz=10000);
+        static void stop();
+
+        static void* threadStartFunc(void*);
+    };
+
     class SamplingTool {
     public:
         friend class CallRecord;
@@ -127,12 +188,13 @@ namespace JSC {
 
         SamplingTool(Interpreter* interpreter)
             : m_interpreter(interpreter)
-            , m_running(false)
             , m_codeBlock(0)
             , m_sample(0)
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
+#if ENABLE(CODEBLOCK_SAMPLING)
             , m_scopeSampleMap(new ScopeSampleRecordMap())
+#endif
         {
             memset(m_opcodeSamples, 0, sizeof(m_opcodeSamples));
             memset(m_opcodeSamplesInCTIFunctions, 0, sizeof(m_opcodeSamplesInCTIFunctions));
@@ -140,11 +202,12 @@ namespace JSC {
 
         ~SamplingTool()
         {
+#if ENABLE(CODEBLOCK_SAMPLING)
             deleteAllValues(*m_scopeSampleMap);
+#endif
         }
 
-        void start(unsigned hertz=10000);
-        void stop();
+        void setup();
         void dump(ExecState*);
 
         void notifyOfScope(ScopeNode* scope);
@@ -159,12 +222,14 @@ namespace JSC {
         CodeBlock** codeBlockSlot() { return &m_codeBlock; }
         intptr_t* sampleSlot() { return &m_sample; }
 
-        unsigned encodeSample(Instruction* vPC, bool inCTIFunction = false, bool inHostFunction = false)
+        void* encodeSample(Instruction* vPC, bool inCTIFunction = false, bool inHostFunction = false)
         {
             ASSERT(!(reinterpret_cast<intptr_t>(vPC) & 0x3));
-            return reinterpret_cast<intptr_t>(vPC) | (static_cast<intptr_t>(inCTIFunction) << 1) | static_cast<intptr_t>(inHostFunction);
+            return reinterpret_cast<void*>(reinterpret_cast<intptr_t>(vPC) | (static_cast<intptr_t>(inCTIFunction) << 1) | static_cast<intptr_t>(inHostFunction));
         }
 
+        static void sample();
+
     private:
         class Sample {
         public:
@@ -174,7 +239,7 @@ namespace JSC {
             {
             }
             
-            bool isNull() { return !m_sample || !m_codeBlock; }
+            bool isNull() { return !m_sample; }
             CodeBlock* codeBlock() { return m_codeBlock; }
             Instruction* vPC() { return reinterpret_cast<Instruction*>(m_sample & ~0x3); }
             bool inHostFunction() { return m_sample & 0x1; }
@@ -184,17 +249,12 @@ namespace JSC {
             intptr_t m_sample;
             CodeBlock* m_codeBlock;
         };
-        
-        static void* threadStartFunc(void*);
-        void run();
+
+        void doRun();
+        static SamplingTool* s_samplingTool;
         
         Interpreter* m_interpreter;
         
-        // Sampling thread state.
-        bool m_running;
-        unsigned m_hertz;
-        ThreadIdentifier m_samplingThread;
-
         // State tracked by the main thread, used by the sampling thread.
         CodeBlock* m_codeBlock;
         intptr_t m_sample;
@@ -205,9 +265,147 @@ namespace JSC {
         unsigned m_opcodeSamples[numOpcodeIDs];
         unsigned m_opcodeSamplesInCTIFunctions[numOpcodeIDs];
         
+#if ENABLE(CODEBLOCK_SAMPLING)
         Mutex m_scopeSampleMapMutex;
         OwnPtr<ScopeSampleRecordMap> m_scopeSampleMap;
+#endif
+    };
+
+    // AbstractSamplingCounter:
+    //
+    // Implements a named set of counters, printed on exit if ENABLE(SAMPLING_COUNTERS).
+    // See subclasses below, SamplingCounter, GlobalSamplingCounter and DeletableSamplingCounter.
+    class AbstractSamplingCounter {
+        friend class JIT;
+        friend class DeletableSamplingCounter;
+    public:
+        void count(uint32_t count = 1)
+        {
+            m_counter += count;
+        }
+
+        static void dump();
+
+    protected:
+        // Effectively the contructor, however called lazily in the case of GlobalSamplingCounter.
+        void init(const char* name)
+        {
+            m_counter = 0;
+            m_name = name;
+
+            // Set m_next to point to the head of the chain, and inform whatever is
+            // currently at the head that this node will now hold the pointer to it.
+            m_next = s_abstractSamplingCounterChain;
+            s_abstractSamplingCounterChain->m_referer = &m_next;
+            // Add this node to the head of the list.
+            s_abstractSamplingCounterChain = this;
+            m_referer = &s_abstractSamplingCounterChain;
+        }
+
+        int64_t m_counter;
+        const char* m_name;
+        AbstractSamplingCounter* m_next;
+        // This is a pointer to the pointer to this node in the chain; used to
+        // allow fast linked list deletion.
+        AbstractSamplingCounter** m_referer;
+        // Null object used to detect end of static chain.
+        static AbstractSamplingCounter s_abstractSamplingCounterChainEnd;
+        static AbstractSamplingCounter* s_abstractSamplingCounterChain;
+        static bool s_completed;
+    };
+
+#if ENABLE(SAMPLING_COUNTERS)
+    // SamplingCounter:
+    //
+    // This class is suitable and (hopefully!) convenient for cases where a counter is
+    // required within the scope of a single function.  It can be instantiated as a
+    // static variable since it contains a constructor but not a destructor (static
+    // variables in WebKit cannot have destructors).
+    //
+    // For example:
+    //
+    // void someFunction()
+    // {
+    //     static SamplingCounter countMe("This is my counter.  There are many like it, but this one is mine.");
+    //     countMe.count();
+    //     // ...
+    // }
+    //
+    class SamplingCounter : public AbstractSamplingCounter {
+    public:
+        SamplingCounter(const char* name) { init(name); }
+    };
+
+    // GlobalSamplingCounter:
+    //
+    // This class is suitable for use where a counter is to be declared globally,
+    // since it contains neither a constructor nor destructor.  Instead, ensure
+    // that 'name()' is called to provide the counter with a name (and also to
+    // allow it to be printed out on exit).
+    //
+    // GlobalSamplingCounter globalCounter;
+    //
+    // void firstFunction()
+    // {
+    //     // Put this within a function that is definitely called!
+    //     // (Or alternatively alongside all calls to 'count()').
+    //     globalCounter.name("I Name You Destroyer.");
+    //     globalCounter.count();
+    //     // ...
+    // }
+    //
+    // void secondFunction()
+    // {
+    //     globalCounter.count();
+    //     // ...
+    // }
+    //
+    class GlobalSamplingCounter : public AbstractSamplingCounter {
+    public:
+        void name(const char* name)
+        {
+            // Global objects should be mapped in zero filled memory, so this should
+            // be a safe (albeit not necessarily threadsafe) check for 'first call'.
+            if (!m_next)
+                init(name);
+        }
+    };
+
+    // DeletableSamplingCounter:
+    //
+    // The above classes (SamplingCounter, GlobalSamplingCounter), are intended for
+    // use within a global or static scope, and as such cannot have a destructor.
+    // This means there is no convenient way for them to remove themselves from the
+    // static list of counters, and should an instance of either class be freed
+    // before 'dump()' has walked over the list it will potentially walk over an
+    // invalid pointer.
+    //
+    // This class is intended for use where the counter may possibly be deleted before
+    // the program exits.  Should this occur, the counter will print it's value to
+    // stderr, and remove itself from the static list.  Example:
+    //
+    // DeletableSamplingCounter* counter = new DeletableSamplingCounter("The Counter With No Name");
+    // counter->count();
+    // delete counter;
+    //
+    class DeletableSamplingCounter : public AbstractSamplingCounter {
+    public:
+        DeletableSamplingCounter(const char* name) { init(name); }
+
+        ~DeletableSamplingCounter()
+        {
+            if (!s_completed)
+                fprintf(stderr, "DeletableSamplingCounter \"%s\" deleted early (with count %lld)\n", m_name, m_counter);
+            // Our m_referer pointer should know where the pointer to this node is,
+            // and m_next should know that this node is the previous node in the list.
+            ASSERT(*m_referer == this);
+            ASSERT(m_next->m_referer == &m_next);
+            // Remove this node from the list, and inform m_next that we have done so.
+            m_next->m_referer = m_referer;
+            *m_referer = m_next;
+        }
     };
+#endif
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
index a9e0678daa..24fcb7d4a9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -26,19 +26,18 @@
 #ifndef StructureStubInfo_h
 #define StructureStubInfo_h
 
+#if ENABLE(JIT)
+
 #include "Instruction.h"
+#include "MacroAssembler.h"
 #include "Opcode.h"
 #include "Structure.h"
 
 namespace JSC {
 
-#if ENABLE(JIT)
     struct StructureStubInfo {
         StructureStubInfo(OpcodeID opcodeID)
             : opcodeID(opcodeID)
-            , stubRoutine(0)
-            , callReturnLocation(0)
-            , hotPathBegin(0)
         {
         }
 
@@ -145,12 +144,13 @@ namespace JSC {
             } putByIdReplace;
         } u;
 
-        void* stubRoutine;
-        void* callReturnLocation;
-        void* hotPathBegin;
+        MacroAssembler::CodeLocationLabel stubRoutine;
+        MacroAssembler::CodeLocationCall callReturnLocation;
+        MacroAssembler::CodeLocationLabel hotPathBegin;
     };
-#endif
 
 } // namespace JSC
 
+#endif
+
 #endif // StructureStubInfo_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 91279b89b6..21a3016781 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -31,6 +31,7 @@
 #include "BytecodeGenerator.h"
 
 #include "BatchedTransitionOptimizer.h"
+#include "PrototypeFunction.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
 #include "UString.h"
@@ -115,7 +116,7 @@ namespace JSC {
 */
 
 #ifndef NDEBUG
-bool BytecodeGenerator::s_dumpsGeneratedCode = false;
+static bool s_dumpsGeneratedCode = false;
 #endif
 
 void BytecodeGenerator::setDumpsGeneratedCode(bool dumpsGeneratedCode)
@@ -145,14 +146,14 @@ void BytecodeGenerator::generate()
 #ifndef NDEBUG
     m_codeBlock->setInstructionCount(m_codeBlock->instructions().size());
 
-    if (s_dumpsGeneratedCode) {
-        JSGlobalObject* globalObject = m_scopeChain->globalObject();
-        m_codeBlock->dump(globalObject->globalExec());
-    }
+    if (s_dumpsGeneratedCode)
+        m_codeBlock->dump(m_scopeChain->globalObject()->globalExec());
 #endif
 
     if ((m_codeType == FunctionCode && !m_codeBlock->needsFullScopeChain() && !m_codeBlock->usesArguments()) || m_codeType == EvalCode)
         symbolTable().clear();
+        
+    m_codeBlock->setIsNumericCompareFunction(instructions() == m_globalData->numericCompareFunction(m_scopeChain->globalObject()->globalExec()));
 
 #if !ENABLE(OPCODE_SAMPLING)
     if (!m_regeneratingForExceptionInfo && (m_codeType == FunctionCode || m_codeType == EvalCode))
@@ -211,7 +212,6 @@ void BytecodeGenerator::allocateConstants(size_t count)
 BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* debugger, const ScopeChain& scopeChain, SymbolTable* symbolTable, ProgramCodeBlock* codeBlock)
     : m_shouldEmitDebugHooks(!!debugger)
     , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_regeneratingForExceptionInfo(false)
     , m_scopeChain(&scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(programNode)
@@ -222,9 +222,12 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
     , m_baseScopeDepth(0)
     , m_codeType(GlobalCode)
     , m_nextGlobalIndex(-1)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
+    , m_regeneratingForExceptionInfo(false)
+    , m_codeBlockBeingRegeneratedFrom(0)
 {
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -259,7 +262,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
         m_nextGlobalIndex -= symbolTable->size();
 
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i].get();
+            FuncDeclNode* funcDecl = functionStack[i];
             globalObject->removeDirect(funcDecl->m_ident); // Make sure our new function is not shadowed by an old property.
             emitNewFunction(addGlobalVar(funcDecl->m_ident, false), funcDecl);
         }
@@ -275,7 +278,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
             emitLoad(newVars[i], jsUndefined());
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i].get();
+            FuncDeclNode* funcDecl = functionStack[i];
             globalObject->putWithAttributes(exec, funcDecl->m_ident, funcDecl->makeFunction(exec, scopeChain.node()), DontDelete);
         }
         for (size_t i = 0; i < varStack.size(); ++i) {
@@ -294,7 +297,6 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
 BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debugger* debugger, const ScopeChain& scopeChain, SymbolTable* symbolTable, CodeBlock* codeBlock)
     : m_shouldEmitDebugHooks(!!debugger)
     , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_regeneratingForExceptionInfo(false)
     , m_scopeChain(&scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(functionBody)
@@ -303,9 +305,12 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
     , m_dynamicScopeDepth(0)
     , m_baseScopeDepth(0)
     , m_codeType(FunctionCode)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
+    , m_regeneratingForExceptionInfo(false)
+    , m_codeBlockBeingRegeneratedFrom(0)
 {
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -327,12 +332,19 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
     } else
         emitOpcode(op_enter);
 
-    if (usesArguments)
-        emitOpcode(op_create_arguments);
+     if (usesArguments) {
+        emitOpcode(op_init_arguments);
+
+        // The debugger currently retrieves the arguments object from an activation rather than pulling
+        // it from a call frame.  In the long-term it should stop doing that (<rdar://problem/6911886>),
+        // but for now we force eager creation of the arguments object when debugging.
+        if (m_shouldEmitDebugHooks)
+            emitOpcode(op_create_arguments);
+    }
 
     const DeclarationStacks::FunctionStack& functionStack = functionBody->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i) {
-        FuncDeclNode* funcDecl = functionStack[i].get();
+        FuncDeclNode* funcDecl = functionStack[i];
         const Identifier& ident = funcDecl->m_ident;
         m_functions.add(ident.ustring().rep());
         emitNewFunction(addVar(ident, false), funcDecl);
@@ -366,7 +378,6 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
 BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugger, const ScopeChain& scopeChain, SymbolTable* symbolTable, EvalCodeBlock* codeBlock)
     : m_shouldEmitDebugHooks(!!debugger)
     , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_regeneratingForExceptionInfo(false)
     , m_scopeChain(&scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(evalNode)
@@ -374,11 +385,14 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugge
     , m_thisRegister(RegisterFile::ProgramCodeThisRegister)
     , m_finallyDepth(0)
     , m_dynamicScopeDepth(0)
-    , m_baseScopeDepth(scopeChain.localDepth())
+    , m_baseScopeDepth(codeBlock->baseScopeDepth())
     , m_codeType(EvalCode)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
+    , m_regeneratingForExceptionInfo(false)
+    , m_codeBlockBeingRegeneratedFrom(0)
 {
     if (m_shouldEmitDebugHooks || m_baseScopeDepth)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -421,6 +435,36 @@ RegisterID* BytecodeGenerator::registerFor(const Identifier& ident)
     if (entry.isNull())
         return 0;
 
+    if (ident == propertyNames().arguments)
+        createArgumentsIfNecessary();
+
+    return &registerFor(entry.getIndex());
+}
+
+bool BytecodeGenerator::willResolveToArguments(const Identifier& ident)
+{
+    if (ident != propertyNames().arguments)
+        return false;
+    
+    if (!shouldOptimizeLocals())
+        return false;
+    
+    SymbolTableEntry entry = symbolTable().get(ident.ustring().rep());
+    if (entry.isNull())
+        return false;
+    
+    if (m_codeBlock->usesArguments() && m_codeType == FunctionCode)
+        return true;
+    
+    return false;
+}
+
+RegisterID* BytecodeGenerator::uncheckedRegisterForArguments()
+{
+    ASSERT(willResolveToArguments(propertyNames().arguments));
+
+    SymbolTableEntry entry = symbolTable().get(propertyNames().arguments.ustring().rep());
+    ASSERT(!entry.isNull());
     return &registerFor(entry.getIndex());
 }
 
@@ -645,6 +689,21 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->offsetFrom(instructions().size()));
             return target;
         }
+    } else if (m_lastOpcodeID == op_lesseq) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+            emitOpcode(op_jnlesseq);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->offsetFrom(instructions().size()));
+            return target;
+        }
     } else if (m_lastOpcodeID == op_not) {
         int dstIndex;
         int srcIndex;
@@ -692,6 +751,24 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
     return target;
 }
 
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond, Label* target)
+{
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(m_scopeChain->globalObject()->d()->callFunction);
+    instructions().append(target->offsetFrom(instructions().size()));
+    return target;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond, Label* target)
+{
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(m_scopeChain->globalObject()->d()->applyFunction);
+    instructions().append(target->offsetFrom(instructions().size()));
+    return target;
+}
+
 unsigned BytecodeGenerator::addConstant(FuncDeclNode* n)
 {
     // No need to explicitly unique function body nodes -- they're unique already.
@@ -714,26 +791,36 @@ unsigned BytecodeGenerator::addConstant(const Identifier& ident)
     return result.first->second;
 }
 
-RegisterID* BytecodeGenerator::addConstant(JSValuePtr v)
+RegisterID* BytecodeGenerator::addConstant(JSValue v)
 {
-    pair<JSValueMap::iterator, bool> result = m_jsValueMap.add(JSValuePtr::encode(v), m_nextConstantIndex);
+    pair<JSValueMap::iterator, bool> result = m_jsValueMap.add(JSValue::encode(v), m_nextConstantIndex);
     if (result.second) {
         RegisterID& constant = m_calleeRegisters[m_nextConstantIndex];
         
         ++m_nextConstantIndex;
 
-        m_codeBlock->addConstantRegister(JSValuePtr(v));
+        m_codeBlock->addConstantRegister(JSValue(v));
         return &constant;
     }
 
     return &registerFor(result.first->second);
 }
 
-unsigned BytecodeGenerator::addUnexpectedConstant(JSValuePtr v)
+unsigned BytecodeGenerator::addUnexpectedConstant(JSValue v)
 {
     return m_codeBlock->addUnexpectedConstant(v);
 }
 
+RegisterID* BytecodeGenerator::emitLoadGlobalObject(RegisterID* dst, JSObject* globalObject)
+{
+    if (!m_globalConstantIndex)
+        m_globalConstantIndex = m_codeBlock->addUnexpectedConstant(globalObject);
+    emitOpcode(op_unexpected_load);
+    instructions().append(dst->index());
+    instructions().append(m_globalConstantIndex);
+    return dst;
+}
+
 unsigned BytecodeGenerator::addRegExp(RegExp* r)
 {
     return m_codeBlock->addRegExp(r);
@@ -811,8 +898,8 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
         if (src1->index() == dstIndex
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
-            && m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue(m_scopeChain->globalObject()->globalExec())->isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue(m_scopeChain->globalObject()->globalExec()))->value();
+            && m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue().isString()) {
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue())->value();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -876,7 +963,7 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, double number)
     // Later we can do the extra work to handle that like the other cases.
     if (number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
         return emitLoad(dst, jsNumber(globalData(), number));
-    JSValuePtr& valueInMap = m_numberMap.add(number, noValue()).first->second;
+    JSValue& valueInMap = m_numberMap.add(number, JSValue()).first->second;
     if (!valueInMap)
         valueInMap = jsNumber(globalData(), number);
     return emitLoad(dst, valueInMap);
@@ -887,10 +974,10 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, const Identifier& ident
     JSString*& stringInMap = m_stringMap.add(identifier.ustring().rep(), 0).first->second;
     if (!stringInMap)
         stringInMap = jsOwnedString(globalData(), identifier.ustring());
-    return emitLoad(dst, JSValuePtr(stringInMap));
+    return emitLoad(dst, JSValue(stringInMap));
 }
 
-RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, JSValuePtr v)
+RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, JSValue v)
 {
     RegisterID* constantID = addConstant(v);
     if (dst)
@@ -991,14 +1078,23 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
         return dst;
     }
 
-    if (index != missingSymbolMarker()) {
-        // Directly index the property lookup across multiple scopes.  Yay!
-        return emitGetScopedVar(dst, depth, index, globalObject);
-    }
-
     if (globalObject) {
+        bool forceGlobalResolve = false;
+        if (m_regeneratingForExceptionInfo) {
 #if ENABLE(JIT)
-        m_codeBlock->addGlobalResolveInfo();
+            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
+#else
+            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
+#endif
+        }
+
+        if (index != missingSymbolMarker() && !forceGlobalResolve) {
+            // Directly index the property lookup across multiple scopes.
+            return emitGetScopedVar(dst, depth, index, globalObject);
+        }
+
+#if ENABLE(JIT)
+        m_codeBlock->addGlobalResolveInfo(instructions().size());
 #else
         m_codeBlock->addGlobalResolveInstruction(instructions().size());
 #endif
@@ -1011,6 +1107,11 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
         return dst;
     }
 
+    if (index != missingSymbolMarker()) {
+        // Directly index the property lookup across multiple scopes.
+        return emitGetScopedVar(dst, depth, index, globalObject);
+    }
+
     // In this case we are at least able to drop a few scope chains from the
     // lookup chain, although we still need to hash from then on.
     emitOpcode(op_resolve_skip);
@@ -1020,16 +1121,13 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, int index, JSValuePtr globalObject)
+RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, int index, JSValue globalObject)
 {
     if (globalObject) {
-        // op_get_global_var must be the same length as op_resolve_global.
         emitOpcode(op_get_global_var);
         instructions().append(dst->index());
         instructions().append(asCell(globalObject));
         instructions().append(index);
-        instructions().append(0);
-        instructions().append(0);
         return dst;
     }
 
@@ -1040,7 +1138,7 @@ RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, i
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, RegisterID* value, JSValuePtr globalObject)
+RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, RegisterID* value, JSValue globalObject)
 {
     if (globalObject) {
         emitOpcode(op_put_global_var);
@@ -1058,18 +1156,65 @@ RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, Registe
 
 RegisterID* BytecodeGenerator::emitResolveBase(RegisterID* dst, const Identifier& property)
 {
-    emitOpcode(op_resolve_base);
-    instructions().append(dst->index());
-    instructions().append(addConstant(property));
-    return dst;
+    size_t depth = 0;
+    int index = 0;
+    JSObject* globalObject = 0;
+    findScopedProperty(property, index, depth, false, globalObject);
+    if (!globalObject) {
+        // We can't optimise at all :-(
+        emitOpcode(op_resolve_base);
+        instructions().append(dst->index());
+        instructions().append(addConstant(property));
+        return dst;
+    }
+
+    // Global object is the base
+    return emitLoadGlobalObject(dst, globalObject);
 }
 
 RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property)
 {
-    emitOpcode(op_resolve_with_base);
-    instructions().append(baseDst->index());
+    size_t depth = 0;
+    int index = 0;
+    JSObject* globalObject = 0;
+    if (!findScopedProperty(property, index, depth, false, globalObject) || !globalObject) {
+        // We can't optimise at all :-(
+        emitOpcode(op_resolve_with_base);
+        instructions().append(baseDst->index());
+        instructions().append(propDst->index());
+        instructions().append(addConstant(property));
+        return baseDst;
+    }
+
+    bool forceGlobalResolve = false;
+    if (m_regeneratingForExceptionInfo) {
+#if ENABLE(JIT)
+        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
+#else
+        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
+#endif
+    }
+
+    // Global object is the base
+    emitLoadGlobalObject(baseDst, globalObject);
+
+    if (index != missingSymbolMarker() && !forceGlobalResolve) {
+        // Directly index the property lookup across multiple scopes.
+        emitGetScopedVar(propDst, depth, index, globalObject);
+        return baseDst;
+    }
+
+#if ENABLE(JIT)
+    m_codeBlock->addGlobalResolveInfo(instructions().size());
+#else
+    m_codeBlock->addGlobalResolveInstruction(instructions().size());
+#endif
+    emitOpcode(op_resolve_global);
     instructions().append(propDst->index());
+    instructions().append(globalObject);
     instructions().append(addConstant(property));
+    instructions().append(0);
+    instructions().append(0);
     return baseDst;
 }
 
@@ -1082,6 +1227,11 @@ RegisterID* BytecodeGenerator::emitResolveFunction(RegisterID* baseDst, Register
     return baseDst;
 }
 
+void BytecodeGenerator::emitMethodCheck()
+{
+    emitOpcode(op_method_check);
+}
+
 RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
 {
 #if ENABLE(JIT)
@@ -1238,8 +1388,15 @@ RegisterID* BytecodeGenerator::emitCall(RegisterID* dst, RegisterID* func, Regis
     return emitCall(op_call, dst, func, thisRegister, argumentsNode, divot, startOffset, endOffset);
 }
 
+void BytecodeGenerator::createArgumentsIfNecessary()
+{
+    if (m_codeBlock->usesArguments() && m_codeType == FunctionCode)
+        emitOpcode(op_create_arguments);
+}
+
 RegisterID* BytecodeGenerator::emitCallEval(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode* argumentsNode, unsigned divot, unsigned startOffset, unsigned endOffset)
 {
+    createArgumentsIfNecessary();
     return emitCall(op_call_eval, dst, func, thisRegister, argumentsNode, divot, startOffset, endOffset);
 }
 
@@ -1266,7 +1423,7 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
     // Generate code for arguments.
     Vector<RefPtr<RegisterID>, 16> argv;
     argv.append(thisRegister);
-    for (ArgumentListNode* n = argumentsNode->m_listNode.get(); n; n = n->m_next.get()) {
+    for (ArgumentListNode* n = argumentsNode->m_listNode; n; n = n->m_next) {
         argv.append(newTemporary());
         // op_call requires the arguments to be a sequential range of registers
         ASSERT(argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() + 1);
@@ -1313,6 +1470,44 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
     return dst;
 }
 
+RegisterID* BytecodeGenerator::emitLoadVarargs(RegisterID* argCountDst, RegisterID* arguments)
+{
+    ASSERT(argCountDst->index() < arguments->index());
+    emitOpcode(op_load_varargs);
+    instructions().append(argCountDst->index());
+    instructions().append(arguments->index());
+    return argCountDst;
+}
+
+RegisterID* BytecodeGenerator::emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* argCountRegister, unsigned divot, unsigned startOffset, unsigned endOffset)
+{
+    ASSERT(func->refCount());
+    ASSERT(thisRegister->refCount());
+    ASSERT(dst != func);
+    if (m_shouldEmitProfileHooks) {
+        emitOpcode(op_profile_will_call);
+        instructions().append(func->index());
+        
+#if ENABLE(JIT)
+        m_codeBlock->addFunctionRegisterInfo(instructions().size(), func->index());
+#endif
+    }
+    
+    emitExpressionInfo(divot, startOffset, endOffset);
+    
+    // Emit call.
+    emitOpcode(op_call_varargs);
+    instructions().append(dst->index()); // dst
+    instructions().append(func->index()); // func
+    instructions().append(argCountRegister->index()); // arg count
+    instructions().append(thisRegister->index() + RegisterFile::CallFrameHeaderSize); // initial registerOffset
+    if (m_shouldEmitProfileHooks) {
+        emitOpcode(op_profile_did_call);
+        instructions().append(func->index());
+    }
+    return dst;
+}
+
 RegisterID* BytecodeGenerator::emitReturn(RegisterID* src)
 {
     if (m_codeBlock->needsFullScopeChain()) {
@@ -1351,7 +1546,7 @@ RegisterID* BytecodeGenerator::emitConstruct(RegisterID* dst, RegisterID* func,
     // Generate code for arguments.
     Vector<RefPtr<RegisterID>, 16> argv;
     argv.append(newTemporary()); // reserve space for "this"
-    for (ArgumentListNode* n = argumentsNode ? argumentsNode->m_listNode.get() : 0; n; n = n->m_next.get()) {
+    for (ArgumentListNode* n = argumentsNode ? argumentsNode->m_listNode : 0; n; n = n->m_next) {
         argv.append(newTemporary());
         // op_construct requires the arguments to be a sequential range of registers
         ASSERT(argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() + 1);
@@ -1402,6 +1597,23 @@ RegisterID* BytecodeGenerator::emitConstruct(RegisterID* dst, RegisterID* func,
     return dst;
 }
 
+RegisterID* BytecodeGenerator::emitStrcat(RegisterID* dst, RegisterID* src, int count)
+{
+    emitOpcode(op_strcat);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    instructions().append(count);
+
+    return dst;
+}
+
+void BytecodeGenerator::emitToPrimitive(RegisterID* dst, RegisterID* src)
+{
+    emitOpcode(op_to_primitive);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+}
+
 RegisterID* BytecodeGenerator::emitPushScope(RegisterID* scope)
 {
     ASSERT(scope->isTemporary());
@@ -1409,6 +1621,7 @@ RegisterID* BytecodeGenerator::emitPushScope(RegisterID* scope)
     context.isFinallyBlock = false;
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
+    createArgumentsIfNecessary();
 
     return emitUnaryNoDstOp(op_push_scope, scope);
 }
@@ -1456,8 +1669,17 @@ void BytecodeGenerator::popFinallyContext()
 LabelScope* BytecodeGenerator::breakTarget(const Identifier& name)
 {
     // Reclaim free label scopes.
-    while (m_labelScopes.size() && !m_labelScopes.last().refCount())
+    //
+    // The condition was previously coded as 'm_labelScopes.size() && !m_labelScopes.last().refCount()',
+    // however sometimes this appears to lead to GCC going a little haywire and entering the loop with
+    // size 0, leading to segfaulty badness.  We are yet to identify a valid cause within our code to
+    // cause the GCC codegen to misbehave in this fashion, and as such the following refactoring of the
+    // loop condition is a workaround.
+    while (m_labelScopes.size()) {
+        if  (m_labelScopes.last().refCount())
+            break;
         m_labelScopes.removeLast();
+    }
 
     if (!m_labelScopes.size())
         return 0;
@@ -1554,14 +1776,10 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
             emitLabel(nextInsn.get());
         }
 
-        // To get here there must be at least one finally block present
-        do {
-            ASSERT(topScope->isFinallyBlock);
+        while (topScope > bottomScope && topScope->isFinallyBlock) {
             emitJumpSubroutine(topScope->finallyContext.retAddrDst, topScope->finallyContext.finallyAddr);
             --topScope;
-            if (!topScope->isFinallyBlock)
-                break;
-        } while (topScope > bottomScope);
+        }
     }
     return emitJump(target);
 }
@@ -1597,7 +1815,7 @@ RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID*
 RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* start, Label* end)
 {
 #if ENABLE(JIT)
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, 0 };
+    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, MacroAssembler::CodeLocationLabel() };
 #else
     HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
 #endif
@@ -1608,7 +1826,7 @@ RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* star
     return targetRegister;
 }
 
-RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSValuePtr message)
+RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSValue message)
 {
     emitOpcode(op_new_error);
     instructions().append(dst->index());
@@ -1638,6 +1856,8 @@ void BytecodeGenerator::emitPushNewScope(RegisterID* dst, Identifier& property,
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
     
+    createArgumentsIfNecessary();
+
     emitOpcode(op_push_new_scope);
     instructions().append(dst->index());
     instructions().append(addConstant(property));
@@ -1672,8 +1892,8 @@ static int32_t keyForImmediateSwitch(ExpressionNode* node, int32_t min, int32_t
     UNUSED_PARAM(max);
     ASSERT(node->isNumber());
     double value = static_cast<NumberNode*>(node)->value();
-    ASSERT(JSImmediate::from(value));
     int32_t key = static_cast<int32_t>(value);
+    ASSERT(JSValue::makeInt32Fast(key) && (JSValue::makeInt32Fast(key).getInt32Fast() == value));
     ASSERT(key == value);
     ASSERT(key >= min);
     ASSERT(key <= max);
@@ -1730,9 +1950,6 @@ static void prepareJumpTableForStringSwitch(StringJumpTable& jumpTable, int32_t
         UString::Rep* clause = static_cast<StringNode*>(nodes[i])->value().ustring().rep();
         OffsetLocation location;
         location.branchOffset = labels[i]->offsetFrom(switchAddress);
-#if ENABLE(JIT)
-        location.ctiOffset = 0;
-#endif
         jumpTable.offsetTable.add(clause, location);
     }
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 3156cbf827..6813d69ab9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -81,6 +81,9 @@ namespace JSC {
         // such register exists. Registers returned by registerFor do not
         // require explicit reference counting.
         RegisterID* registerFor(const Identifier&);
+        
+        bool willResolveToArguments(const Identifier&);
+        RegisterID* uncheckedRegisterForArguments();
 
         // Behaves as registerFor does, but ignores dynamic scope as
         // dynamic scope should not interfere with const initialisation
@@ -240,9 +243,10 @@ namespace JSC {
         RegisterID* emitLoad(RegisterID* dst, bool);
         RegisterID* emitLoad(RegisterID* dst, double);
         RegisterID* emitLoad(RegisterID* dst, const Identifier&);
-        RegisterID* emitLoad(RegisterID* dst, JSValuePtr);
+        RegisterID* emitLoad(RegisterID* dst, JSValue);
         RegisterID* emitUnexpectedLoad(RegisterID* dst, bool);
         RegisterID* emitUnexpectedLoad(RegisterID* dst, double);
+        RegisterID* emitLoadGlobalObject(RegisterID* dst, JSObject* globalObject);
 
         RegisterID* emitUnaryOp(OpcodeID, RegisterID* dst, RegisterID* src);
         RegisterID* emitBinaryOp(OpcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2, OperandTypes);
@@ -269,13 +273,15 @@ namespace JSC {
         RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base) { return emitBinaryOp(op_in, dst, property, base, OperandTypes()); }
 
         RegisterID* emitResolve(RegisterID* dst, const Identifier& property);
-        RegisterID* emitGetScopedVar(RegisterID* dst, size_t skip, int index, JSValuePtr globalObject);
-        RegisterID* emitPutScopedVar(size_t skip, int index, RegisterID* value, JSValuePtr globalObject);
+        RegisterID* emitGetScopedVar(RegisterID* dst, size_t skip, int index, JSValue globalObject);
+        RegisterID* emitPutScopedVar(size_t skip, int index, RegisterID* value, JSValue globalObject);
 
         RegisterID* emitResolveBase(RegisterID* dst, const Identifier& property);
         RegisterID* emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property);
         RegisterID* emitResolveFunction(RegisterID* baseDst, RegisterID* funcDst, const Identifier& property);
 
+        void emitMethodCheck();
+
         RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
         RegisterID* emitPutById(RegisterID* base, const Identifier& property, RegisterID* value);
         RegisterID* emitDeleteById(RegisterID* dst, RegisterID* base, const Identifier&);
@@ -288,16 +294,22 @@ namespace JSC {
 
         RegisterID* emitCall(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
         RegisterID* emitCallEval(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* argCount, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitLoadVarargs(RegisterID* argCountDst, RegisterID* args);
 
         RegisterID* emitReturn(RegisterID* src);
         RegisterID* emitEnd(RegisterID* src) { return emitUnaryNoDstOp(op_end, src); }
 
         RegisterID* emitConstruct(RegisterID* dst, RegisterID* func, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitStrcat(RegisterID* dst, RegisterID* src, int count);
+        void emitToPrimitive(RegisterID* dst, RegisterID* src);
 
         PassRefPtr<Label> emitLabel(Label*);
         PassRefPtr<Label> emitJump(Label* target);
         PassRefPtr<Label> emitJumpIfTrue(RegisterID* cond, Label* target);
         PassRefPtr<Label> emitJumpIfFalse(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionCall(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionApply(RegisterID* cond, Label* target);
         PassRefPtr<Label> emitJumpScopes(Label* target, int targetScopeDepth);
 
         PassRefPtr<Label> emitJumpSubroutine(RegisterID* retAddrDst, Label*);
@@ -308,7 +320,7 @@ namespace JSC {
 
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
-        RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValuePtr message);
+        RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValue message);
         void emitPushNewScope(RegisterID* dst, Identifier& property, RegisterID* value);
 
         RegisterID* emitPushScope(RegisterID* scope);
@@ -317,6 +329,7 @@ namespace JSC {
         void emitDebugHook(DebugHookID, int firstLine, int lastLine);
 
         int scopeDepth() { return m_dynamicScopeDepth + m_finallyDepth; }
+        bool hasFinaliser() { return m_finallyDepth != 0; }
 
         void pushFinallyContext(Label* target, RegisterID* returnAddrDst);
         void popFinallyContext();
@@ -329,7 +342,11 @@ namespace JSC {
 
         CodeType codeType() const { return m_codeType; }
 
-        void setRegeneratingForExceptionInfo() { m_regeneratingForExceptionInfo = true; }
+        void setRegeneratingForExceptionInfo(CodeBlock* originalCodeBlock)
+        {
+            m_regeneratingForExceptionInfo = true;
+            m_codeBlockBeingRegeneratedFrom = originalCodeBlock;
+        }
 
     private:
         void emitOpcode(OpcodeID);
@@ -340,12 +357,7 @@ namespace JSC {
 
         PassRefPtr<Label> emitComplexJumpScopes(Label* target, ControlFlowContext* topScope, ControlFlowContext* bottomScope);
 
-        struct JSValueHashTraits : HashTraits<JSValueEncodedAsPointer*> {
-            static void constructDeletedValue(JSValueEncodedAsPointer*& slot) { slot = JSValuePtr::encode(JSImmediate::impossibleValue()); }
-            static bool isDeletedValue(JSValueEncodedAsPointer* value) { return value == JSValuePtr::encode(JSImmediate::impossibleValue()); }
-        };
-
-        typedef HashMap<JSValueEncodedAsPointer*, unsigned, PtrHash<JSValueEncodedAsPointer*>, JSValueHashTraits> JSValueMap;
+        typedef HashMap<EncodedJSValue, unsigned, PtrHash<EncodedJSValue>, JSValueHashTraits> JSValueMap;
 
         struct IdentifierMapIndexHashTraits {
             typedef int TraitType;
@@ -357,9 +369,9 @@ namespace JSC {
         };
 
         typedef HashMap<RefPtr<UString::Rep>, int, IdentifierRepHash, HashTraits<RefPtr<UString::Rep> >, IdentifierMapIndexHashTraits> IdentifierMap;
-        typedef HashMap<double, JSValuePtr> NumberMap;
+        typedef HashMap<double, JSValue> NumberMap;
         typedef HashMap<UString::Rep*, JSString*, IdentifierRepHash> IdentifierStringMap;
-
+        
         RegisterID* emitCall(OpcodeID, RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
         
         RegisterID* newRegister();
@@ -407,8 +419,8 @@ namespace JSC {
         unsigned addConstant(FuncDeclNode*);
         unsigned addConstant(FuncExprNode*);
         unsigned addConstant(const Identifier&);
-        RegisterID* addConstant(JSValuePtr);
-        unsigned addUnexpectedConstant(JSValuePtr);
+        RegisterID* addConstant(JSValue);
+        unsigned addUnexpectedConstant(JSValue);
         unsigned addRegExp(RegExp*);
 
         Vector<Instruction>& instructions() { return m_codeBlock->instructions(); }
@@ -419,27 +431,29 @@ namespace JSC {
 
         RegisterID* emitThrowExpressionTooDeepException();
 
+        void createArgumentsIfNecessary();
+
         bool m_shouldEmitDebugHooks;
         bool m_shouldEmitProfileHooks;
 
-        bool m_regeneratingForExceptionInfo;
-
         const ScopeChain* m_scopeChain;
         SymbolTable* m_symbolTable;
 
         ScopeNode* m_scopeNode;
         CodeBlock* m_codeBlock;
 
+        // Some of these objects keep pointers to one another. They are arranged
+        // to ensure a sane destruction order that avoids references to freed memory.
         HashSet<RefPtr<UString::Rep>, IdentifierRepHash> m_functions;
         RegisterID m_ignoredResultRegister;
         RegisterID m_thisRegister;
         RegisterID m_argumentsRegister;
         int m_activationRegisterIndex;
-        SegmentedVector<RegisterID, 512> m_calleeRegisters;
-        SegmentedVector<RegisterID, 512> m_parameters;
-        SegmentedVector<RegisterID, 512> m_globals;
-        SegmentedVector<LabelScope, 256> m_labelScopes;
-        SegmentedVector<Label, 256> m_labels;
+        SegmentedVector<RegisterID, 32> m_calleeRegisters;
+        SegmentedVector<RegisterID, 32> m_parameters;
+        SegmentedVector<RegisterID, 32> m_globals;
+        SegmentedVector<Label, 32> m_labels;
+        SegmentedVector<LabelScope, 8> m_labelScopes;
         RefPtr<RegisterID> m_lastConstant;
         int m_finallyDepth;
         int m_dynamicScopeDepth;
@@ -452,6 +466,7 @@ namespace JSC {
         int m_nextGlobalIndex;
         int m_nextParameterIndex;
         int m_nextConstantIndex;
+        unsigned m_globalConstantIndex;
 
         int m_globalVarStorageOffset;
 
@@ -465,13 +480,12 @@ namespace JSC {
 
         OpcodeID m_lastOpcodeID;
 
-#ifndef NDEBUG
-        static bool s_dumpsGeneratedCode;
-#endif
-
         unsigned m_emitNodeDepth;
 
-        static const unsigned s_maxEmitNodeDepth = 10000;
+        bool m_regeneratingForExceptionInfo;
+        CodeBlock* m_codeBlockBeingRegeneratedFrom;
+
+        static const unsigned s_maxEmitNodeDepth = 5000;
     };
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/config.h b/src/3rdparty/webkit/JavaScriptCore/config.h
index a85178cb3b..cecae4793e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/config.h
+++ b/src/3rdparty/webkit/JavaScriptCore/config.h
@@ -25,6 +25,16 @@
 
 #include <wtf/Platform.h>
 
+#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define JS_EXPORTDATA __declspec(dllexport)
+#else
+#define JS_EXPORTDATA __declspec(dllimport)
+#endif
+#else
+#define JS_EXPORTDATA
+#endif
+
 #if PLATFORM(WIN_OS)
 
 // If we don't define these, they get defined in windef.h. 
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_hash_table b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
index 3bd9f76e86..25d0b02174 100755
--- a/src/3rdparty/webkit/JavaScriptCore/create_hash_table
+++ b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
@@ -269,10 +269,6 @@ sub output() {
     print "   { 0, 0, 0, 0 }\n";
     print "};\n\n";
     print "extern const struct HashTable $name =\n";
-    print "#if ENABLE(PERFECT_HASH_SIZE)\n";
-    print "    \{ ", $pefectHashSize - 1, ", $nameEntries, 0 \};\n";
-    print "#else\n";
     print "    \{ $compactSize, $compactHashSizeMask, $nameEntries, 0 \};\n";
-    print "#endif\n\n";
     print "} // namespace\n";
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
index a52a542c51..7d791e7c81 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
@@ -23,6 +23,8 @@
 #include "Debugger.h"
 
 #include "JSGlobalObject.h"
+#include "Interpreter.h"
+#include "Parser.h"
 
 namespace JSC {
 
@@ -51,4 +53,18 @@ void Debugger::detach(JSGlobalObject* globalObject)
     globalObject->setDebugger(0);
 }
 
+JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
+{
+    CallFrame* globalCallFrame = globalObject->globalExec();
+
+    int errLine;
+    UString errMsg;
+    SourceCode source = makeSource(script);
+    RefPtr<EvalNode> evalNode = globalObject->globalData()->parser->parse<EvalNode>(globalCallFrame, globalObject->debugger(), source, &errLine, &errMsg);
+    if (!evalNode)
+        return Error::create(globalCallFrame, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
+
+    return globalObject->globalData()->interpreter->execute(evalNode.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain(), &exception);
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
index 6af116f49f..868ea71b24 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
@@ -54,6 +54,10 @@ namespace JSC {
         HashSet<JSGlobalObject*> m_globalObjects;
     };
 
+    // This method exists only for backwards compatibility with existing
+    // WebScriptDebugger clients
+    JSValue evaluateInGlobalCallFrame(const UString&, JSValue& exception, JSGlobalObject*);
+
 } // namespace JSC
 
 #endif // Debugger_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
new file mode 100644
index 0000000000..4b2568f026
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DebuggerActivation.h"
+
+#include "JSActivation.h"
+
+namespace JSC {
+
+DebuggerActivation::DebuggerActivation(JSObject* activation)
+    : JSObject(DebuggerActivation::createStructure(jsNull()))
+{
+    ASSERT(activation);
+    ASSERT(activation->isActivationObject());
+    m_activation = static_cast<JSActivation*>(activation);
+}
+
+void DebuggerActivation::mark()
+{
+    JSObject::mark();
+    if (m_activation && !m_activation->marked())
+        m_activation->mark();
+}
+
+UString DebuggerActivation::className() const
+{
+    return m_activation->className();
+}
+
+bool DebuggerActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return m_activation->getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void DebuggerActivation::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    m_activation->put(exec, propertyName, value, slot);
+}
+
+void DebuggerActivation::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    m_activation->putWithAttributes(exec, propertyName, value, attributes);
+}
+
+bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    return m_activation->deleteProperty(exec, propertyName);
+}
+
+void DebuggerActivation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_activation->getPropertyNames(exec, propertyNames);
+}
+
+bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+{
+    return m_activation->getPropertyAttributes(exec, propertyName, attributes);
+}
+
+void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    m_activation->defineGetter(exec, propertyName, getterFunction);
+}
+
+void DebuggerActivation::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+{
+    m_activation->defineSetter(exec, propertyName, setterFunction);
+}
+
+JSValue DebuggerActivation::lookupGetter(ExecState* exec, const Identifier& propertyName)
+{
+    return m_activation->lookupGetter(exec, propertyName);
+}
+
+JSValue DebuggerActivation::lookupSetter(ExecState* exec, const Identifier& propertyName)
+{
+    return m_activation->lookupSetter(exec, propertyName);
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
new file mode 100644
index 0000000000..9e1f9f52dd
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DebuggerActivation_h
+#define DebuggerActivation_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+    class JSActivation;
+
+    class DebuggerActivation : public JSObject {
+    public:
+        DebuggerActivation(JSObject*);
+
+        virtual void mark();
+        virtual UString className() const;
+        virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
+        virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType)); 
+        }
+
+    private:
+        JSActivation* m_activation;
+    };
+
+} // namespace JSC
+
+#endif // DebuggerActivation_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index 27b824cd3f..cd8702bc44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -46,6 +46,17 @@ const UString* DebuggerCallFrame::functionName() const
         return 0;
     return &function->name(&m_callFrame->globalData());
 }
+    
+UString DebuggerCallFrame::calculatedFunctionName() const
+{
+    if (!m_callFrame->codeBlock())
+        return 0;
+    
+    JSFunction* function = static_cast<JSFunction*>(m_callFrame->callee());
+    if (!function)
+        return 0;
+    return function->calculatedDisplayName(&m_callFrame->globalData());
+}
 
 DebuggerCallFrame::Type DebuggerCallFrame::type() const
 {
@@ -63,10 +74,10 @@ JSObject* DebuggerCallFrame::thisObject() const
     return asObject(m_callFrame->thisValue());
 }
 
-JSValuePtr DebuggerCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
+JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) const
 {
     if (!m_callFrame->codeBlock())
-        return noValue();
+        return JSValue();
 
     int errLine;
     UString errMsg;
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
index cdf49651df..9d377ef97a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
@@ -39,11 +39,10 @@ namespace JSC {
 
         DebuggerCallFrame(CallFrame* callFrame)
             : m_callFrame(callFrame)
-            , m_exception(noValue())
         {
         }
 
-        DebuggerCallFrame(CallFrame* callFrame, JSValuePtr exception)
+        DebuggerCallFrame(CallFrame* callFrame, JSValue exception)
             : m_callFrame(callFrame)
             , m_exception(exception)
         {
@@ -52,14 +51,15 @@ namespace JSC {
         JSGlobalObject* dynamicGlobalObject() const { return m_callFrame->dynamicGlobalObject(); }
         const ScopeChainNode* scopeChain() const { return m_callFrame->scopeChain(); }
         const UString* functionName() const;
+        UString calculatedFunctionName() const;
         Type type() const;
         JSObject* thisObject() const;
-        JSValuePtr evaluate(const UString&, JSValuePtr& exception) const;
-        JSValuePtr exception() const { return m_exception; }
+        JSValue evaluate(const UString&, JSValue& exception) const;
+        JSValue exception() const { return m_exception; }
 
     private:
         CallFrame* m_callFrame;
-        JSValuePtr m_exception;
+        JSValue m_exception;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl b/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl
index 0be22eb716..9494d1b1e6 100755
--- a/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl
+++ b/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl
@@ -10,9 +10,9 @@ my @undocumented = ();
 print OUTPUT "<style>p code \{ font-size: 14px; \}</style>\n";
 
 while (<MACHINE>) {
-    if (/^ *BEGIN_OPCODE/) {
+    if (/^ *DEFINE_OPCODE/) {
         chomp;
-        s/^ *BEGIN_OPCODE\(op_//;
+        s/^ *DEFINE_OPCODE\(op_//;
         s/\).*$//;
         my $opcode = $_;
         $_ = <MACHINE>;
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
index 59dd35f3dd..2a7c98fbb1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue arrayTableValues[20] = {
+static const struct HashTableValue arrayTableValues[22] = {
    { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
    { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
    { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
@@ -23,15 +23,12 @@ static const struct HashTableValue arrayTableValues[20] = {
    { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
    { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
    { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
+   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
+   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
    { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
 extern const struct HashTable arrayTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 127, arrayTableValues, 0 };
-#else
     { 65, 63, arrayTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
index d70845a451..d83e680ad9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
@@ -12,7 +12,7 @@ static const struct HashTableValue dateTableValues[45] = {
    { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
    { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
    { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncValueOf, (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
    { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
@@ -53,10 +53,5 @@ static const struct HashTableValue dateTableValues[45] = {
 };
 
 extern const struct HashTable dateTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, dateTableValues, 0 };
-#else
     { 134, 127, dateTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 1652b24fd5..bc5ebe4e24 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton implementation for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton implementation for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,7 +28,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -47,7 +46,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.3"
+#define YYBISON_VERSION "2.4.1"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -55,159 +54,28 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
+/* Push parsers.  */
+#define YYPUSH 0
+
+/* Pull parsers.  */
+#define YYPULL 1
+
 /* Using locations.  */
 #define YYLSP_NEEDED 1
 
 /* Substitute the variable and function names.  */
-#define yyparse jscyyparse
-#define yylex   jscyylex
-#define yyerror jscyyerror
-#define yylval  jscyylval
-#define yychar  jscyychar
-#define yydebug jscyydebug
-#define yynerrs jscyynerrs
-#define yylloc jscyylloc
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-/* Tokens.  */
-#define NULLTOKEN 258
-#define TRUETOKEN 259
-#define FALSETOKEN 260
-#define BREAK 261
-#define CASE 262
-#define DEFAULT 263
-#define FOR 264
-#define NEW 265
-#define VAR 266
-#define CONSTTOKEN 267
-#define CONTINUE 268
-#define FUNCTION 269
-#define RETURN 270
-#define VOIDTOKEN 271
-#define DELETETOKEN 272
-#define IF 273
-#define THISTOKEN 274
-#define DO 275
-#define WHILE 276
-#define INTOKEN 277
-#define INSTANCEOF 278
-#define TYPEOF 279
-#define SWITCH 280
-#define WITH 281
-#define RESERVED 282
-#define THROW 283
-#define TRY 284
-#define CATCH 285
-#define FINALLY 286
-#define DEBUGGER 287
-#define IF_WITHOUT_ELSE 288
-#define ELSE 289
-#define EQEQ 290
-#define NE 291
-#define STREQ 292
-#define STRNEQ 293
-#define LE 294
-#define GE 295
-#define OR 296
-#define AND 297
-#define PLUSPLUS 298
-#define MINUSMINUS 299
-#define LSHIFT 300
-#define RSHIFT 301
-#define URSHIFT 302
-#define PLUSEQUAL 303
-#define MINUSEQUAL 304
-#define MULTEQUAL 305
-#define DIVEQUAL 306
-#define LSHIFTEQUAL 307
-#define RSHIFTEQUAL 308
-#define URSHIFTEQUAL 309
-#define ANDEQUAL 310
-#define MODEQUAL 311
-#define XOREQUAL 312
-#define OREQUAL 313
-#define OPENBRACE 314
-#define CLOSEBRACE 315
-#define NUMBER 316
-#define IDENT 317
-#define STRING 318
-#define AUTOPLUSPLUS 319
-#define AUTOMINUSMINUS 320
-
-
-
+#define yyparse         jscyyparse
+#define yylex           jscyylex
+#define yyerror         jscyyerror
+#define yylval          jscyylval
+#define yychar          jscyychar
+#define yydebug         jscyydebug
+#define yynerrs         jscyynerrs
+#define yylloc          jscyylloc
 
 /* Copy the first part of user declarations.  */
+
+/* Line 189 of yacc.c  */
 #line 3 "../parser/Grammar.y"
 
 
@@ -238,7 +106,7 @@
 #include <stdlib.h>
 #include "JSValue.h"
 #include "JSObject.h"
-#include "Nodes.h"
+#include "NodeConstructors.h"
 #include "Lexer.h"
 #include "JSString.h"
 #include "JSGlobalData.h"
@@ -308,24 +176,24 @@ static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, Assig
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserRefCountedData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserRefCountedData<DeclarationStacks::FunctionStack>* funcDecls,
+template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
+                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
                                                                        CodeFeatures info,
                                                                        int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = {node, varDecls, funcDecls, info, numConstants};
+    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
 template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = {node, info, numConstants};
+    NodeInfo<T> result = { node, info, numConstants };
     return result;
 }
 
-template <typename T> T mergeDeclarationLists(T decls1, T decls2) 
+template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
 {
     // decls1 or both are null
     if (!decls1)
@@ -337,32 +205,35 @@ template <typename T> T mergeDeclarationLists(T decls1, T decls2)
     // Both are non-null
     decls1->data.append(decls2->data);
     
-    // We manually release the declaration lists to avoid accumulating many many
-    // unused heap allocated vectors
-    decls2->ref();
-    decls2->deref();
+    // Manually release as much as possible from the now-defunct declaration lists
+    // to avoid accumulating so many unused heap allocated vectors.
+    decls2->data.clear();
+
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
 
     varDecls->data.append(make_pair(ident, attrs));
 
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->m_init)
+    if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->m_ident, attrs);
+    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
 }
 
 
 
+/* Line 189 of yacc.c  */
+#line 236 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -381,10 +252,88 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 # define YYTOKEN_TABLE 0
 #endif
 
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     NULLTOKEN = 258,
+     TRUETOKEN = 259,
+     FALSETOKEN = 260,
+     BREAK = 261,
+     CASE = 262,
+     DEFAULT = 263,
+     FOR = 264,
+     NEW = 265,
+     VAR = 266,
+     CONSTTOKEN = 267,
+     CONTINUE = 268,
+     FUNCTION = 269,
+     RETURN = 270,
+     VOIDTOKEN = 271,
+     DELETETOKEN = 272,
+     IF = 273,
+     THISTOKEN = 274,
+     DO = 275,
+     WHILE = 276,
+     INTOKEN = 277,
+     INSTANCEOF = 278,
+     TYPEOF = 279,
+     SWITCH = 280,
+     WITH = 281,
+     RESERVED = 282,
+     THROW = 283,
+     TRY = 284,
+     CATCH = 285,
+     FINALLY = 286,
+     DEBUGGER = 287,
+     IF_WITHOUT_ELSE = 288,
+     ELSE = 289,
+     EQEQ = 290,
+     NE = 291,
+     STREQ = 292,
+     STRNEQ = 293,
+     LE = 294,
+     GE = 295,
+     OR = 296,
+     AND = 297,
+     PLUSPLUS = 298,
+     MINUSMINUS = 299,
+     LSHIFT = 300,
+     RSHIFT = 301,
+     URSHIFT = 302,
+     PLUSEQUAL = 303,
+     MINUSEQUAL = 304,
+     MULTEQUAL = 305,
+     DIVEQUAL = 306,
+     LSHIFTEQUAL = 307,
+     RSHIFTEQUAL = 308,
+     URSHIFTEQUAL = 309,
+     ANDEQUAL = 310,
+     MODEQUAL = 311,
+     XOREQUAL = 312,
+     OREQUAL = 313,
+     OPENBRACE = 314,
+     CLOSEBRACE = 315,
+     NUMBER = 316,
+     IDENT = 317,
+     STRING = 318,
+     AUTOPLUSPLUS = 319,
+     AUTOMINUSMINUS = 320
+   };
+#endif
+
+
+
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 157 "../parser/Grammar.y"
 {
+
+/* Line 214 of yacc.c  */
+#line 157 "../parser/Grammar.y"
+
     int                 intValue;
     double              doubleValue;
     Identifier*         ident;
@@ -414,13 +363,15 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-}
-/* Line 187 of yacc.c.  */
-#line 420 "Grammar.tab.c"
-	YYSTYPE;
+
+
+
+/* Line 214 of yacc.c  */
+#line 371 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 #if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
@@ -440,8 +391,8 @@ typedef struct YYLTYPE
 /* Copy the second part of user declarations.  */
 
 
-/* Line 216 of yacc.c.  */
-#line 445 "Grammar.tab.c"
+/* Line 264 of yacc.c  */
+#line 396 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -516,14 +467,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int i)
+YYID (int yyi)
 #else
 static int
-YYID (i)
-    int i;
+YYID (yyi)
+    int yyi;
 #endif
 {
-  return i;
+  return yyi;
 }
 #endif
 
@@ -605,9 +556,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss;
-  YYSTYPE yyvs;
-    YYLTYPE yyls;
+  yytype_int16 yyss_alloc;
+  YYSTYPE yyvs_alloc;
+  YYLTYPE yyls_alloc;
 };
 
 /* The size of the maximum gap between one aligned stack and the next.  */
@@ -642,12 +593,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack)					\
+# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack, Stack, yysize);				\
-	Stack = &yyptr->Stack;						\
+	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
+	Stack = &yyptr->Stack_alloc;					\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -1019,42 +970,42 @@ static const yytype_uint16 yyrline[] =
      804,   805,   806,   807,   808,   809,   810,   811,   815,   817,
      822,   824,   830,   837,   846,   854,   867,   874,   883,   891,
      904,   906,   912,   920,   932,   933,   937,   941,   945,   949,
-     951,   956,   959,   968,   970,   972,   974,   980,   987,   996,
-    1002,  1013,  1014,  1018,  1019,  1023,  1027,  1031,  1035,  1042,
-    1045,  1048,  1051,  1057,  1060,  1063,  1066,  1072,  1078,  1084,
-    1085,  1094,  1095,  1099,  1105,  1115,  1116,  1120,  1121,  1125,
-    1131,  1135,  1142,  1148,  1154,  1164,  1166,  1171,  1172,  1183,
-    1184,  1191,  1192,  1202,  1205,  1211,  1212,  1216,  1217,  1222,
-    1229,  1240,  1241,  1242,  1243,  1244,  1245,  1246,  1250,  1251,
-    1252,  1253,  1254,  1258,  1259,  1263,  1264,  1265,  1267,  1271,
-    1272,  1273,  1274,  1275,  1279,  1280,  1281,  1285,  1286,  1289,
-    1291,  1295,  1296,  1300,  1301,  1302,  1303,  1304,  1308,  1309,
-    1310,  1311,  1315,  1316,  1320,  1321,  1325,  1326,  1327,  1328,
-    1332,  1333,  1334,  1335,  1339,  1340,  1344,  1345,  1349,  1350,
-    1354,  1355,  1359,  1360,  1361,  1365,  1366,  1367,  1371,  1372,
-    1373,  1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1384,
-    1385,  1389,  1390,  1394,  1395,  1396,  1397,  1401,  1402,  1403,
-    1404,  1408,  1409,  1410,  1414,  1415,  1416,  1420,  1421,  1422,
-    1423,  1427,  1428,  1429,  1430,  1434,  1435,  1436,  1437,  1438,
-    1439,  1440,  1444,  1445,  1446,  1447,  1448,  1449,  1453,  1454,
-    1455,  1456,  1457,  1458,  1459,  1463,  1464,  1465,  1466,  1467,
-    1471,  1472,  1473,  1474,  1475,  1479,  1480,  1481,  1482,  1483,
-    1487,  1488,  1492,  1493,  1497,  1498,  1502,  1503,  1507,  1508,
-    1512,  1513,  1517,  1518,  1522,  1523,  1527,  1528,  1532,  1533,
-    1537,  1538,  1542,  1543,  1547,  1548,  1552,  1553,  1557,  1558,
-    1562,  1563,  1567,  1568,  1572,  1573,  1577,  1578,  1582,  1583,
-    1587,  1588,  1592,  1593,  1594,  1595,  1596,  1597,  1598,  1599,
-    1600,  1601,  1602,  1603,  1607,  1608,  1612,  1613,  1617,  1618,
-    1622,  1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,
-    1632,  1633,  1634,  1635,  1636,  1637,  1638,  1642,  1643,  1647,
-    1648,  1652,  1653,  1654,  1655,  1659,  1660,  1661,  1662,  1666,
-    1667,  1671,  1672,  1676,  1677,  1681,  1685,  1689,  1693,  1694,
-    1698,  1699,  1703,  1704,  1705,  1706,  1707,  1708,  1709,  1710,
-    1713,  1715,  1718,  1720,  1724,  1725,  1726,  1727,  1731,  1732,
-    1733,  1734,  1738,  1739,  1740,  1741,  1745,  1749,  1753,  1754,
-    1757,  1759,  1763,  1764,  1768,  1769,  1773,  1774,  1778,  1782,
-    1783,  1787,  1788,  1789,  1793,  1794,  1798,  1799,  1803,  1804,
-    1805,  1806,  1810,  1811,  1814,  1816,  1820,  1821
+     951,   956,   959,   969,   971,   973,   975,   981,   988,   997,
+    1003,  1014,  1015,  1019,  1020,  1024,  1028,  1032,  1036,  1043,
+    1046,  1049,  1052,  1058,  1061,  1064,  1067,  1073,  1079,  1085,
+    1086,  1095,  1096,  1100,  1106,  1116,  1117,  1121,  1122,  1126,
+    1132,  1136,  1143,  1149,  1155,  1165,  1167,  1172,  1173,  1184,
+    1185,  1192,  1193,  1203,  1206,  1212,  1213,  1217,  1218,  1223,
+    1230,  1241,  1242,  1243,  1244,  1245,  1246,  1247,  1251,  1252,
+    1253,  1254,  1255,  1259,  1260,  1264,  1265,  1266,  1268,  1272,
+    1273,  1274,  1275,  1276,  1280,  1281,  1282,  1286,  1287,  1290,
+    1292,  1296,  1297,  1301,  1302,  1303,  1304,  1305,  1309,  1310,
+    1311,  1312,  1316,  1317,  1321,  1322,  1326,  1327,  1328,  1329,
+    1333,  1334,  1335,  1336,  1340,  1341,  1345,  1346,  1350,  1351,
+    1355,  1356,  1360,  1361,  1362,  1366,  1367,  1368,  1372,  1373,
+    1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1382,  1385,
+    1386,  1390,  1391,  1395,  1396,  1397,  1398,  1402,  1403,  1404,
+    1405,  1409,  1410,  1411,  1415,  1416,  1417,  1421,  1422,  1423,
+    1424,  1428,  1429,  1430,  1431,  1435,  1436,  1437,  1438,  1439,
+    1440,  1441,  1445,  1446,  1447,  1448,  1449,  1450,  1454,  1455,
+    1456,  1457,  1458,  1459,  1460,  1464,  1465,  1466,  1467,  1468,
+    1472,  1473,  1474,  1475,  1476,  1480,  1481,  1482,  1483,  1484,
+    1488,  1489,  1493,  1494,  1498,  1499,  1503,  1504,  1508,  1509,
+    1513,  1514,  1518,  1519,  1523,  1524,  1528,  1529,  1533,  1534,
+    1538,  1539,  1543,  1544,  1548,  1549,  1553,  1554,  1558,  1559,
+    1563,  1564,  1568,  1569,  1573,  1574,  1578,  1579,  1583,  1584,
+    1588,  1589,  1593,  1594,  1595,  1596,  1597,  1598,  1599,  1600,
+    1601,  1602,  1603,  1604,  1608,  1609,  1613,  1614,  1618,  1619,
+    1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,  1632,
+    1633,  1634,  1635,  1636,  1637,  1638,  1639,  1643,  1644,  1648,
+    1649,  1653,  1654,  1655,  1656,  1660,  1661,  1662,  1663,  1667,
+    1668,  1672,  1673,  1677,  1678,  1682,  1686,  1690,  1694,  1695,
+    1699,  1700,  1704,  1705,  1706,  1707,  1708,  1709,  1710,  1711,
+    1714,  1716,  1719,  1721,  1725,  1726,  1727,  1728,  1732,  1733,
+    1734,  1735,  1739,  1740,  1741,  1742,  1746,  1750,  1754,  1755,
+    1758,  1760,  1764,  1765,  1769,  1770,  1774,  1775,  1779,  1783,
+    1784,  1788,  1789,  1790,  1794,  1795,  1799,  1800,  1804,  1805,
+    1806,  1807,  1811,  1812,  1815,  1817,  1821,  1822
 };
 #endif
 
@@ -2361,17 +2312,20 @@ yy_symbol_print (yyoutput, yytype, yyvaluep, yylocationp)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
+yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
 #else
 static void
-yy_stack_print (bottom, top)
-    yytype_int16 *bottom;
-    yytype_int16 *top;
+yy_stack_print (yybottom, yytop)
+    yytype_int16 *yybottom;
+    yytype_int16 *yytop;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; bottom <= top; ++bottom)
-    YYFPRINTF (stderr, " %d", *bottom);
+  for (; yybottom <= yytop; yybottom++)
+    {
+      int yybot = *yybottom;
+      YYFPRINTF (stderr, " %d", yybot);
+    }
   YYFPRINTF (stderr, "\n");
 }
 
@@ -2406,11 +2360,11 @@ yy_reduce_print (yyvsp, yylsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      fprintf (stderr, "   $%d = ", yyi + 1);
+      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       , &(yylsp[(yyi + 1) - (yynrhs)])		       );
-      fprintf (stderr, "\n");
+      YYFPRINTF (stderr, "\n");
     }
 }
 
@@ -2692,10 +2646,8 @@ yydestruct (yymsg, yytype, yyvaluep, yylocationp)
 	break;
     }
 }
-
 
 /* Prevent warnings from -Wmissing-prototypes.  */
-
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -2714,10 +2666,9 @@ int yyparse ();
 
 
 
-
-/*----------.
-| yyparse.  |
-`----------*/
+/*-------------------------.
+| yyparse or yypush_parse.  |
+`-------------------------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -2741,88 +2692,97 @@ yyparse ()
 #endif
 #endif
 {
-  /* The look-ahead symbol.  */
+/* The lookahead symbol.  */
 int yychar;
 
-/* The semantic value of the look-ahead symbol.  */
+/* The semantic value of the lookahead symbol.  */
 YYSTYPE yylval;
 
-/* Number of syntax errors so far.  */
-int yynerrs;
-/* Location data for the look-ahead symbol.  */
+/* Location data for the lookahead symbol.  */
 YYLTYPE yylloc;
 
-  int yystate;
-  int yyn;
-  int yyresult;
-  /* Number of tokens to shift before error messages enabled.  */
-  int yyerrstatus;
-  /* Look-ahead token as an internal (translated) token number.  */
-  int yytoken = 0;
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
+    /* Number of syntax errors so far.  */
+    int yynerrs;
 
-  /* Three stacks and their tools:
-     `yyss': related to states,
-     `yyvs': related to semantic values,
-     `yyls': related to locations.
+    int yystate;
+    /* Number of tokens to shift before error messages enabled.  */
+    int yyerrstatus;
 
-     Refer to the stacks thru separate pointers, to allow yyoverflow
-     to reallocate them elsewhere.  */
+    /* The stacks and their tools:
+       `yyss': related to states.
+       `yyvs': related to semantic values.
+       `yyls': related to locations.
 
-  /* The state stack.  */
-  yytype_int16 yyssa[YYINITDEPTH];
-  yytype_int16 *yyss = yyssa;
-  yytype_int16 *yyssp;
+       Refer to the stacks thru separate pointers, to allow yyoverflow
+       to reallocate them elsewhere.  */
 
-  /* The semantic value stack.  */
-  YYSTYPE yyvsa[YYINITDEPTH];
-  YYSTYPE *yyvs = yyvsa;
-  YYSTYPE *yyvsp;
+    /* The state stack.  */
+    yytype_int16 yyssa[YYINITDEPTH];
+    yytype_int16 *yyss;
+    yytype_int16 *yyssp;
 
-  /* The location stack.  */
-  YYLTYPE yylsa[YYINITDEPTH];
-  YYLTYPE *yyls = yylsa;
-  YYLTYPE *yylsp;
-  /* The locations where the error started and ended.  */
-  YYLTYPE yyerror_range[2];
+    /* The semantic value stack.  */
+    YYSTYPE yyvsa[YYINITDEPTH];
+    YYSTYPE *yyvs;
+    YYSTYPE *yyvsp;
 
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
+    /* The location stack.  */
+    YYLTYPE yylsa[YYINITDEPTH];
+    YYLTYPE *yyls;
+    YYLTYPE *yylsp;
 
-  YYSIZE_T yystacksize = YYINITDEPTH;
+    /* The locations where the error started and ended.  */
+    YYLTYPE yyerror_range[2];
 
+    YYSIZE_T yystacksize;
+
+  int yyn;
+  int yyresult;
+  /* Lookahead token as an internal (translated) token number.  */
+  int yytoken;
   /* The variables used to return semantic value and location from the
      action routines.  */
   YYSTYPE yyval;
   YYLTYPE yyloc;
 
+#if YYERROR_VERBOSE
+  /* Buffer for error messages, and its allocated size.  */
+  char yymsgbuf[128];
+  char *yymsg = yymsgbuf;
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
+#endif
+
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
+
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
+  yytoken = 0;
+  yyss = yyssa;
+  yyvs = yyvsa;
+  yyls = yylsa;
+  yystacksize = YYINITDEPTH;
+
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY;		/* Cause a token to be read.  */
+  yychar = YYEMPTY; /* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
-
   yyssp = yyss;
   yyvsp = yyvs;
   yylsp = yyls;
+
 #if YYLTYPE_IS_TRIVIAL
   /* Initialize the default location before parsing starts.  */
   yylloc.first_line   = yylloc.last_line   = 1;
-  yylloc.first_column = yylloc.last_column = 0;
+  yylloc.first_column = yylloc.last_column = 1;
 #endif
 
   goto yysetstate;
@@ -2861,6 +2821,7 @@ YYLTYPE yylloc;
 		    &yyvs1, yysize * sizeof (*yyvsp),
 		    &yyls1, yysize * sizeof (*yylsp),
 		    &yystacksize);
+
 	yyls = yyls1;
 	yyss = yyss1;
 	yyvs = yyvs1;
@@ -2882,9 +2843,9 @@ YYLTYPE yylloc;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss);
-	YYSTACK_RELOCATE (yyvs);
-	YYSTACK_RELOCATE (yyls);
+	YYSTACK_RELOCATE (yyss_alloc, yyss);
+	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
+	YYSTACK_RELOCATE (yyls_alloc, yyls);
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -2905,6 +2866,9 @@ YYLTYPE yylloc;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
+  if (yystate == YYFINAL)
+    YYACCEPT;
+
   goto yybackup;
 
 /*-----------.
@@ -2913,16 +2877,16 @@ YYLTYPE yylloc;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     look-ahead token if we need one and don't already have one.  */
+     lookahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to look-ahead token.  */
+  /* First try to decide what to do without reference to lookahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a look-ahead token if don't already have one.  */
+  /* Not known => get a lookahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -2954,20 +2918,16 @@ yybackup:
       goto yyreduce;
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the look-ahead token.  */
+  /* Shift the lookahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token unless it is eof.  */
-  if (yychar != YYEOF)
-    yychar = YYEMPTY;
+  /* Discard the shifted token.  */
+  yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -3008,37 +2968,49 @@ yyreduce:
   switch (yyn)
     {
         case 2:
+
+/* Line 1455 of yacc.c  */
 #line 290 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NullNode(GLOBAL_DATA), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
+
+/* Line 1455 of yacc.c  */
 #line 291 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
+
+/* Line 1455 of yacc.c  */
 #line 292 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
+
+/* Line 1455 of yacc.c  */
 #line 293 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
+
+/* Line 1455 of yacc.c  */
 #line 294 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
+
+/* Line 1455 of yacc.c  */
 #line 295 "../parser/Grammar.y"
     {
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3046,12 +3018,14 @@ yyreduce:
     break;
 
   case 8:
+
+/* Line 1455 of yacc.c  */
 #line 304 "../parser/Grammar.y"
     {
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3059,26 +3033,36 @@ yyreduce:
     break;
 
   case 9:
+
+/* Line 1455 of yacc.c  */
 #line 316 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
+
+/* Line 1455 of yacc.c  */
 #line 317 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
+
+/* Line 1455 of yacc.c  */
 #line 318 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
+
+/* Line 1455 of yacc.c  */
 #line 319 "../parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
+
+/* Line 1455 of yacc.c  */
 #line 321 "../parser/Grammar.y"
     {
                                                                  (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
@@ -3091,644 +3075,876 @@ yyreduce:
     break;
 
   case 14:
+
+/* Line 1455 of yacc.c  */
 #line 332 "../parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = new PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
+    { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (1)].propertyNode).m_numConstants; ;}
     break;
 
   case 15:
+
+/* Line 1455 of yacc.c  */
 #line 336 "../parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
-                                          (yyval.propertyList).m_node.tail = new PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
+                                          (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (3)].propertyList).m_numConstants + (yyvsp[(3) - (3)].propertyNode).m_numConstants; ;}
     break;
 
   case 17:
+
+/* Line 1455 of yacc.c  */
 #line 344 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
+
+/* Line 1455 of yacc.c  */
 #line 345 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
+
+/* Line 1455 of yacc.c  */
 #line 347 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
+
+/* Line 1455 of yacc.c  */
 #line 351 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
+
+/* Line 1455 of yacc.c  */
 #line 354 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
+
+/* Line 1455 of yacc.c  */
 #line 355 "../parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
+
+/* Line 1455 of yacc.c  */
 #line 359 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
+
+/* Line 1455 of yacc.c  */
 #line 360 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
+
+/* Line 1455 of yacc.c  */
 #line 361 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
+
+/* Line 1455 of yacc.c  */
 #line 365 "../parser/Grammar.y"
-    { (yyval.elementList).m_node.head = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
+    { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants; ;}
     break;
 
   case 29:
+
+/* Line 1455 of yacc.c  */
 #line 370 "../parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
-                                          (yyval.elementList).m_node.tail = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
+                                          (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(1) - (4)].elementList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants; ;}
     break;
 
   case 30:
+
+/* Line 1455 of yacc.c  */
 #line 377 "../parser/Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
+
+/* Line 1455 of yacc.c  */
 #line 382 "../parser/Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
+
+/* Line 1455 of yacc.c  */
 #line 383 "../parser/Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
+
+/* Line 1455 of yacc.c  */
 #line 388 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
+
+/* Line 1455 of yacc.c  */
 #line 389 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 37:
+
+/* Line 1455 of yacc.c  */
 #line 393 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 38:
+
+/* Line 1455 of yacc.c  */
 #line 397 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 40:
+
+/* Line 1455 of yacc.c  */
 #line 405 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 41:
+
+/* Line 1455 of yacc.c  */
 #line 409 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 42:
+
+/* Line 1455 of yacc.c  */
 #line 413 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 44:
+
+/* Line 1455 of yacc.c  */
 #line 421 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 46:
+
+/* Line 1455 of yacc.c  */
 #line 429 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 47:
+
+/* Line 1455 of yacc.c  */
 #line 436 "../parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
+
+/* Line 1455 of yacc.c  */
 #line 437 "../parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
+
+/* Line 1455 of yacc.c  */
 #line 438 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 50:
+
+/* Line 1455 of yacc.c  */
 #line 442 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 51:
+
+/* Line 1455 of yacc.c  */
 #line 448 "../parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
+
+/* Line 1455 of yacc.c  */
 #line 449 "../parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
+
+/* Line 1455 of yacc.c  */
 #line 450 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 54:
+
+/* Line 1455 of yacc.c  */
 #line 454 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 55:
+
+/* Line 1455 of yacc.c  */
 #line 461 "../parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
+
+/* Line 1455 of yacc.c  */
 #line 462 "../parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
+
+/* Line 1455 of yacc.c  */
 #line 466 "../parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
+    { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (1)].expressionNode).m_numConstants; ;}
     break;
 
   case 58:
+
+/* Line 1455 of yacc.c  */
 #line 470 "../parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
-                                          (yyval.argumentList).m_node.tail = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
+                                          (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (3)].argumentList).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants; ;}
     break;
 
   case 64:
+
+/* Line 1455 of yacc.c  */
 #line 488 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
+
+/* Line 1455 of yacc.c  */
 #line 489 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
+
+/* Line 1455 of yacc.c  */
 #line 494 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
+
+/* Line 1455 of yacc.c  */
 #line 495 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
+
+/* Line 1455 of yacc.c  */
 #line 499 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
+
+/* Line 1455 of yacc.c  */
 #line 500 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
+
+/* Line 1455 of yacc.c  */
 #line 501 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
+
+/* Line 1455 of yacc.c  */
 #line 502 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
+
+/* Line 1455 of yacc.c  */
 #line 503 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
+
+/* Line 1455 of yacc.c  */
 #line 504 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
+
+/* Line 1455 of yacc.c  */
 #line 505 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
+
+/* Line 1455 of yacc.c  */
 #line 506 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
+
+/* Line 1455 of yacc.c  */
 #line 507 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
+
+/* Line 1455 of yacc.c  */
 #line 508 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
+
+/* Line 1455 of yacc.c  */
 #line 509 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
+
+/* Line 1455 of yacc.c  */
 #line 523 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
+
+/* Line 1455 of yacc.c  */
 #line 524 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
+
+/* Line 1455 of yacc.c  */
 #line 525 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
+
+/* Line 1455 of yacc.c  */
 #line 531 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
+
+/* Line 1455 of yacc.c  */
 #line 533 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
+
+/* Line 1455 of yacc.c  */
 #line 535 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
+
+/* Line 1455 of yacc.c  */
 #line 540 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
+
+/* Line 1455 of yacc.c  */
 #line 541 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
+
+/* Line 1455 of yacc.c  */
 #line 547 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
+
+/* Line 1455 of yacc.c  */
 #line 549 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
+
+/* Line 1455 of yacc.c  */
 #line 554 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
+
+/* Line 1455 of yacc.c  */
 #line 555 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
+
+/* Line 1455 of yacc.c  */
 #line 556 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
+
+/* Line 1455 of yacc.c  */
 #line 561 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
+
+/* Line 1455 of yacc.c  */
 #line 562 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
+
+/* Line 1455 of yacc.c  */
 #line 563 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
+
+/* Line 1455 of yacc.c  */
 #line 568 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
+
+/* Line 1455 of yacc.c  */
 #line 569 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
+
+/* Line 1455 of yacc.c  */
 #line 570 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
+
+/* Line 1455 of yacc.c  */
 #line 571 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
+
+/* Line 1455 of yacc.c  */
 #line 572 "../parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 112:
+
+/* Line 1455 of yacc.c  */
 #line 575 "../parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 114:
+
+/* Line 1455 of yacc.c  */
 #line 582 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
+
+/* Line 1455 of yacc.c  */
 #line 583 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
+
+/* Line 1455 of yacc.c  */
 #line 584 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
+
+/* Line 1455 of yacc.c  */
 #line 585 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
+
+/* Line 1455 of yacc.c  */
 #line 587 "../parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 120:
+
+/* Line 1455 of yacc.c  */
 #line 594 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
+
+/* Line 1455 of yacc.c  */
 #line 595 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
+
+/* Line 1455 of yacc.c  */
 #line 596 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
+
+/* Line 1455 of yacc.c  */
 #line 597 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
+
+/* Line 1455 of yacc.c  */
 #line 599 "../parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 125:
+
+/* Line 1455 of yacc.c  */
 #line 603 "../parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 127:
+
+/* Line 1455 of yacc.c  */
 #line 610 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
+
+/* Line 1455 of yacc.c  */
 #line 611 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
+
+/* Line 1455 of yacc.c  */
 #line 612 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
+
+/* Line 1455 of yacc.c  */
 #line 613 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
+
+/* Line 1455 of yacc.c  */
 #line 619 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
+
+/* Line 1455 of yacc.c  */
 #line 621 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
+
+/* Line 1455 of yacc.c  */
 #line 623 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
+
+/* Line 1455 of yacc.c  */
 #line 625 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
+
+/* Line 1455 of yacc.c  */
 #line 631 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
+
+/* Line 1455 of yacc.c  */
 #line 632 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
+
+/* Line 1455 of yacc.c  */
 #line 634 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
+
+/* Line 1455 of yacc.c  */
 #line 636 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
+
+/* Line 1455 of yacc.c  */
 #line 641 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
+
+/* Line 1455 of yacc.c  */
 #line 647 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
+
+/* Line 1455 of yacc.c  */
 #line 652 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
+
+/* Line 1455 of yacc.c  */
 #line 657 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
+
+/* Line 1455 of yacc.c  */
 #line 663 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
+
+/* Line 1455 of yacc.c  */
 #line 669 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
+
+/* Line 1455 of yacc.c  */
 #line 674 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
+
+/* Line 1455 of yacc.c  */
 #line 680 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
+
+/* Line 1455 of yacc.c  */
 #line 686 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
+
+/* Line 1455 of yacc.c  */
 #line 691 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
+
+/* Line 1455 of yacc.c  */
 #line 697 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
+
+/* Line 1455 of yacc.c  */
 #line 703 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
+
+/* Line 1455 of yacc.c  */
 #line 708 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
+
+/* Line 1455 of yacc.c  */
 #line 714 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
+
+/* Line 1455 of yacc.c  */
 #line 719 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
+
+/* Line 1455 of yacc.c  */
 #line 725 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
+
+/* Line 1455 of yacc.c  */
 #line 731 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
+
+/* Line 1455 of yacc.c  */
 #line 737 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
+
+/* Line 1455 of yacc.c  */
 #line 743 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
@@ -3736,6 +3952,8 @@ yyreduce:
     break;
 
   case 180:
+
+/* Line 1455 of yacc.c  */
 #line 751 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
@@ -3743,6 +3961,8 @@ yyreduce:
     break;
 
   case 182:
+
+/* Line 1455 of yacc.c  */
 #line 759 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
@@ -3750,99 +3970,137 @@ yyreduce:
     break;
 
   case 183:
+
+/* Line 1455 of yacc.c  */
 #line 765 "../parser/Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
+
+/* Line 1455 of yacc.c  */
 #line 766 "../parser/Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
+
+/* Line 1455 of yacc.c  */
 #line 767 "../parser/Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
+
+/* Line 1455 of yacc.c  */
 #line 768 "../parser/Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
+
+/* Line 1455 of yacc.c  */
 #line 769 "../parser/Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
+
+/* Line 1455 of yacc.c  */
 #line 770 "../parser/Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
+
+/* Line 1455 of yacc.c  */
 #line 771 "../parser/Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
+
+/* Line 1455 of yacc.c  */
 #line 772 "../parser/Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
+
+/* Line 1455 of yacc.c  */
 #line 773 "../parser/Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
+
+/* Line 1455 of yacc.c  */
 #line 774 "../parser/Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
+
+/* Line 1455 of yacc.c  */
 #line 775 "../parser/Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
+
+/* Line 1455 of yacc.c  */
 #line 776 "../parser/Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
+
+/* Line 1455 of yacc.c  */
 #line 781 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
+
+/* Line 1455 of yacc.c  */
 #line 786 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
+
+/* Line 1455 of yacc.c  */
 #line 791 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
+
+/* Line 1455 of yacc.c  */
 #line 815 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 219:
+
+/* Line 1455 of yacc.c  */
 #line 817 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 220:
+
+/* Line 1455 of yacc.c  */
 #line 822 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 221:
+
+/* Line 1455 of yacc.c  */
 #line 824 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
@@ -3850,9 +4108,11 @@ yyreduce:
     break;
 
   case 222:
+
+/* Line 1455 of yacc.c  */
 #line 830 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3861,11 +4121,13 @@ yyreduce:
     break;
 
   case 223:
+
+/* Line 1455 of yacc.c  */
 #line 837 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3874,6 +4136,8 @@ yyreduce:
     break;
 
   case 224:
+
+/* Line 1455 of yacc.c  */
 #line 847 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
@@ -3885,8 +4149,10 @@ yyreduce:
     break;
 
   case 225:
+
+/* Line 1455 of yacc.c  */
 #line 855 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
@@ -3898,9 +4164,11 @@ yyreduce:
     break;
 
   case 226:
+
+/* Line 1455 of yacc.c  */
 #line 867 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3909,11 +4177,13 @@ yyreduce:
     break;
 
   case 227:
+
+/* Line 1455 of yacc.c  */
 #line 874 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3922,6 +4192,8 @@ yyreduce:
     break;
 
   case 228:
+
+/* Line 1455 of yacc.c  */
 #line 884 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
@@ -3933,8 +4205,10 @@ yyreduce:
     break;
 
   case 229:
+
+/* Line 1455 of yacc.c  */
 #line 892 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
@@ -3946,22 +4220,28 @@ yyreduce:
     break;
 
   case 230:
+
+/* Line 1455 of yacc.c  */
 #line 904 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 231:
+
+/* Line 1455 of yacc.c  */
 #line 907 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 232:
+
+/* Line 1455 of yacc.c  */
 #line 912 "../parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
-                                          (yyval.constDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(1) - (1)].constDeclNode).m_node);
                                           (yyval.constDeclList).m_funcDeclarations = 0; 
                                           (yyval.constDeclList).m_features = (yyvsp[(1) - (1)].constDeclNode).m_features;
@@ -3970,8 +4250,10 @@ yyreduce:
     break;
 
   case 233:
+
+/* Line 1455 of yacc.c  */
 #line 921 "../parser/Grammar.y"
-    {  (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
+    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_varDeclarations = (yyvsp[(1) - (3)].constDeclList).m_varDeclarations;
@@ -3982,78 +4264,105 @@ yyreduce:
     break;
 
   case 234:
+
+/* Line 1455 of yacc.c  */
 #line 932 "../parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
+
+/* Line 1455 of yacc.c  */
 #line 933 "../parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
+
+/* Line 1455 of yacc.c  */
 #line 937 "../parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
+
+/* Line 1455 of yacc.c  */
 #line 941 "../parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
+
+/* Line 1455 of yacc.c  */
 #line 945 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
+
+/* Line 1455 of yacc.c  */
 #line 949 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 240:
+
+/* Line 1455 of yacc.c  */
 #line 951 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 241:
+
+/* Line 1455 of yacc.c  */
 #line 957 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 242:
+
+/* Line 1455 of yacc.c  */
 #line 960 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations), mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
     break;
 
   case 243:
-#line 968 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+
+/* Line 1455 of yacc.c  */
+#line 969 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 244:
-#line 970 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+
+/* Line 1455 of yacc.c  */
+#line 971 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 245:
-#line 972 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+
+/* Line 1455 of yacc.c  */
+#line 973 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 246:
-#line 975 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
+
+/* Line 1455 of yacc.c  */
+#line 976 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
@@ -4061,8 +4370,10 @@ yyreduce:
     break;
 
   case 247:
-#line 981 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
+
+/* Line 1455 of yacc.c  */
+#line 982 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
@@ -4071,9 +4382,11 @@ yyreduce:
     break;
 
   case 248:
-#line 988 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 989 "../parser/Grammar.y"
     {
-                                            ForInNode* node = new ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
+                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
                                             (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
@@ -4083,8 +4396,10 @@ yyreduce:
     break;
 
   case 249:
-#line 997 "../parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
+
+/* Line 1455 of yacc.c  */
+#line 998 "../parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
@@ -4092,8 +4407,10 @@ yyreduce:
     break;
 
   case 250:
-#line 1003 "../parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
+
+/* Line 1455 of yacc.c  */
+#line 1004 "../parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
@@ -4103,125 +4420,161 @@ yyreduce:
     break;
 
   case 251:
-#line 1013 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1014 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
-#line 1018 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1019 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
-#line 1023 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1024 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 256:
-#line 1027 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1028 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 257:
-#line 1031 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1032 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 258:
-#line 1035 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1036 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 259:
-#line 1042 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1043 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 260:
-#line 1045 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1046 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 261:
-#line 1048 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1049 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 262:
-#line 1051 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1052 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 263:
-#line 1057 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+
+/* Line 1455 of yacc.c  */
+#line 1058 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 264:
-#line 1060 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+
+/* Line 1455 of yacc.c  */
+#line 1061 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 265:
-#line 1063 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+
+/* Line 1455 of yacc.c  */
+#line 1064 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 266:
-#line 1066 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+
+/* Line 1455 of yacc.c  */
+#line 1067 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 267:
-#line 1072 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
+
+/* Line 1455 of yacc.c  */
+#line 1073 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 268:
-#line 1078 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
+
+/* Line 1455 of yacc.c  */
+#line 1079 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 269:
-#line 1084 "../parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1085 "../parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
-#line 1086 "../parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
+
+/* Line 1455 of yacc.c  */
+#line 1087 "../parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (5)].clauseList).m_features | (yyvsp[(3) - (5)].caseClauseNode).m_features | (yyvsp[(4) - (5)].clauseList).m_features,
@@ -4229,13 +4582,17 @@ yyreduce:
     break;
 
   case 271:
-#line 1094 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1095 "../parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
-#line 1099 "../parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1100 "../parser/Grammar.y"
+    { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
                                           (yyval.clauseList).m_funcDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_funcDeclarations; 
@@ -4244,9 +4601,11 @@ yyreduce:
     break;
 
   case 274:
-#line 1105 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1106 "../parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
-                                          (yyval.clauseList).m_node.tail = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
+                                          (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
                                           (yyval.clauseList).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_funcDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_funcDeclarations);
                                           (yyval.clauseList).m_features = (yyvsp[(1) - (2)].clauseList).m_features | (yyvsp[(2) - (2)].caseClauseNode).m_features;
@@ -4255,51 +4614,67 @@ yyreduce:
     break;
 
   case 275:
-#line 1115 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1116 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
-#line 1116 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1117 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
-#line 1120 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1121 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
-#line 1121 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1122 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
-#line 1125 "../parser/Grammar.y"
-    { LabelNode* node = new LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1126 "../parser/Grammar.y"
+    { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
     break;
 
   case 280:
-#line 1131 "../parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1132 "../parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                         ;}
     break;
 
   case 281:
-#line 1135 "../parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1136 "../parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
                                         ;}
     break;
 
   case 282:
-#line 1142 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
+
+/* Line 1455 of yacc.c  */
+#line 1143 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
@@ -4308,8 +4683,10 @@ yyreduce:
     break;
 
   case 283:
-#line 1148 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
+
+/* Line 1455 of yacc.c  */
+#line 1149 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
@@ -4318,8 +4695,10 @@ yyreduce:
     break;
 
   case 284:
-#line 1155 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
+
+/* Line 1455 of yacc.c  */
+#line 1156 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
@@ -4328,26 +4707,34 @@ yyreduce:
     break;
 
   case 285:
-#line 1164 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+
+/* Line 1455 of yacc.c  */
+#line 1165 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 286:
-#line 1166 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+
+/* Line 1455 of yacc.c  */
+#line 1167 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 287:
-#line 1171 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1172 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
     break;
 
   case 288:
-#line 1173 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1174 "../parser/Grammar.y"
     { 
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
           DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
@@ -4356,12 +4743,16 @@ yyreduce:
     break;
 
   case 289:
-#line 1183 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1184 "../parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), LEXER->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
-#line 1185 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1186 "../parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature) 
@@ -4371,12 +4762,16 @@ yyreduce:
     break;
 
   case 291:
-#line 1191 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1192 "../parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
-#line 1193 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1194 "../parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4386,43 +4781,57 @@ yyreduce:
     break;
 
   case 293:
-#line 1202 "../parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = new ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1203 "../parser/Grammar.y"
+    { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
     break;
 
   case 294:
-#line 1205 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1206 "../parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.parameterList).m_node.tail = new ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
+                                          (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
     break;
 
   case 295:
-#line 1211 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1212 "../parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
-#line 1212 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1213 "../parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
-#line 1216 "../parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing(new SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1217 "../parser/Grammar.y"
+    { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
-#line 1217 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1218 "../parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
 
   case 299:
-#line 1222 "../parser/Grammar.y"
-    { (yyval.sourceElements).m_node = new SourceElements(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1223 "../parser/Grammar.y"
+    { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
                                           (yyval.sourceElements).m_funcDeclarations = (yyvsp[(1) - (1)].statementNode).m_funcDeclarations;
@@ -4432,7 +4841,9 @@ yyreduce:
     break;
 
   case 300:
-#line 1229 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1230 "../parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4442,188 +4853,261 @@ yyreduce:
     break;
 
   case 304:
-#line 1243 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1244 "../parser/Grammar.y"
     { ;}
     break;
 
   case 305:
-#line 1244 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1245 "../parser/Grammar.y"
     { ;}
     break;
 
   case 306:
-#line 1245 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1246 "../parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 307:
-#line 1246 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1247 "../parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 308:
-#line 1250 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1251 "../parser/Grammar.y"
     { ;}
     break;
 
   case 309:
-#line 1251 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1252 "../parser/Grammar.y"
     { ;}
     break;
 
   case 310:
-#line 1252 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1253 "../parser/Grammar.y"
     { ;}
     break;
 
   case 311:
-#line 1253 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1254 "../parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
-#line 1254 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1255 "../parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
-#line 1264 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1265 "../parser/Grammar.y"
     { ;}
     break;
 
   case 317:
-#line 1265 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1266 "../parser/Grammar.y"
     { ;}
     break;
 
   case 318:
-#line 1267 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1268 "../parser/Grammar.y"
     { ;}
     break;
 
   case 322:
-#line 1274 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1275 "../parser/Grammar.y"
     { ;}
     break;
 
   case 517:
-#line 1642 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1643 "../parser/Grammar.y"
     { ;}
     break;
 
   case 518:
-#line 1643 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1644 "../parser/Grammar.y"
     { ;}
     break;
 
   case 520:
-#line 1648 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1649 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
-#line 1652 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1653 "../parser/Grammar.y"
     { ;}
     break;
 
   case 522:
-#line 1653 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1654 "../parser/Grammar.y"
     { ;}
     break;
 
   case 525:
-#line 1659 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1660 "../parser/Grammar.y"
     { ;}
     break;
 
   case 526:
-#line 1660 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1661 "../parser/Grammar.y"
     { ;}
     break;
 
   case 530:
-#line 1667 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1668 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
-#line 1676 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1677 "../parser/Grammar.y"
     { ;}
     break;
 
   case 534:
-#line 1677 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1678 "../parser/Grammar.y"
     { ;}
     break;
 
   case 539:
-#line 1694 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1695 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
-#line 1725 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1726 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
-#line 1727 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1728 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
-#line 1732 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1733 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
-#line 1734 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1735 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
-#line 1739 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1740 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
-#line 1741 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1742 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
-#line 1753 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1754 "../parser/Grammar.y"
     { ;}
     break;
 
   case 569:
-#line 1754 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1755 "../parser/Grammar.y"
     { ;}
     break;
 
   case 578:
-#line 1778 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1779 "../parser/Grammar.y"
     { ;}
     break;
 
   case 580:
-#line 1783 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1784 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
-#line 1794 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1795 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
-#line 1810 "../parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1811 "../parser/Grammar.y"
     { ;}
     break;
 
 
-/* Line 1267 of yacc.c.  */
-#line 4627 "Grammar.tab.c"
+
+/* Line 1455 of yacc.c  */
+#line 5111 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4699,7 +5183,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse look-ahead token after an
+      /* If just tried and failed to reuse lookahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -4716,7 +5200,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse look-ahead token after shifting the error
+  /* Else will try to reuse lookahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -4774,14 +5258,11 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   *++yyvsp = yylval;
 
   yyerror_range[1] = yylloc;
   /* Using YYLLOC is tempting, but would change the location of
-     the look-ahead.  YYLOC is available though.  */
+     the lookahead.  YYLOC is available though.  */
   YYLLOC_DEFAULT (yyloc, (yyerror_range - 1), 2);
   *++yylsp = yyloc;
 
@@ -4806,7 +5287,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#ifndef yyoverflow
+#if !defined(yyoverflow) || YYERROR_VERBOSE
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -4817,7 +5298,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEOF && yychar != YYEMPTY)
+  if (yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval, &yylloc);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -4843,29 +5324,31 @@ yyreturn:
 }
 
 
-#line 1826 "../parser/Grammar.y"
+
+/* Line 1675 of yacc.c  */
+#line 1827 "../parser/Grammar.y"
 
 
 static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
             SET_EXCEPTION_LOCATION(node, start, divot, end);
             return node;
         } else
-            return new ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -4873,9 +5356,9 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4883,21 +5366,21 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
 static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
@@ -4905,22 +5388,22 @@ static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Ope
 static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4930,23 +5413,29 @@ static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeIn
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
         if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node = new FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
+        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
+        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else
+        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
@@ -4955,26 +5444,26 @@ static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
     }
-    return new TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new DeleteValueNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
 static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
@@ -4986,7 +5475,7 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
 }
 
 static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
@@ -5000,19 +5489,19 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new NegateNode(GLOBAL_DATA, n);
+    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
 }
 
 static NumberNode* makeNumberNode(void* globalPtr, double d)
 {
-    return new NumberNode(GLOBAL_DATA, d);
+    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
 }
 
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
         return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new BitwiseNotNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5024,12 +5513,12 @@ static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, Expr
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
 
-    return new MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5039,14 +5528,14 @@ static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5056,21 +5545,21 @@ static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 /* called by yyparse on error */
@@ -5089,7 +5578,7 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 {
     if (!list)
         return init;
-    return new VarDeclCommaNode(GLOBAL_DATA, list, init);
+    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
@@ -5098,8 +5587,8 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
 {
     if (!expr)
-        return new EmptyStatementNode(GLOBAL_DATA);
-    return new VarStatementNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
+    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
 }
 
 #undef GLOBAL_DATA
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
index 99dbd4cbe5..c7d3837827 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton interface for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton interface for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -104,78 +104,16 @@
      AUTOMINUSMINUS = 320
    };
 #endif
-/* Tokens.  */
-#define NULLTOKEN 258
-#define TRUETOKEN 259
-#define FALSETOKEN 260
-#define BREAK 261
-#define CASE 262
-#define DEFAULT 263
-#define FOR 264
-#define NEW 265
-#define VAR 266
-#define CONSTTOKEN 267
-#define CONTINUE 268
-#define FUNCTION 269
-#define RETURN 270
-#define VOIDTOKEN 271
-#define DELETETOKEN 272
-#define IF 273
-#define THISTOKEN 274
-#define DO 275
-#define WHILE 276
-#define INTOKEN 277
-#define INSTANCEOF 278
-#define TYPEOF 279
-#define SWITCH 280
-#define WITH 281
-#define RESERVED 282
-#define THROW 283
-#define TRY 284
-#define CATCH 285
-#define FINALLY 286
-#define DEBUGGER 287
-#define IF_WITHOUT_ELSE 288
-#define ELSE 289
-#define EQEQ 290
-#define NE 291
-#define STREQ 292
-#define STRNEQ 293
-#define LE 294
-#define GE 295
-#define OR 296
-#define AND 297
-#define PLUSPLUS 298
-#define MINUSMINUS 299
-#define LSHIFT 300
-#define RSHIFT 301
-#define URSHIFT 302
-#define PLUSEQUAL 303
-#define MINUSEQUAL 304
-#define MULTEQUAL 305
-#define DIVEQUAL 306
-#define LSHIFTEQUAL 307
-#define RSHIFTEQUAL 308
-#define URSHIFTEQUAL 309
-#define ANDEQUAL 310
-#define MODEQUAL 311
-#define XOREQUAL 312
-#define OREQUAL 313
-#define OPENBRACE 314
-#define CLOSEBRACE 315
-#define NUMBER 316
-#define IDENT 317
-#define STRING 318
-#define AUTOPLUSPLUS 319
-#define AUTOMINUSMINUS 320
-
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 157 "../parser/Grammar.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 157 "../parser/Grammar.y"
+
     int                 intValue;
     double              doubleValue;
     Identifier*         ident;
@@ -205,13 +143,15 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-}
-/* Line 1489 of yacc.c.  */
-#line 211 "Grammar.tab.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 151 "JavaScriptCore/tmp/../generated/Grammar.tab.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
@@ -230,3 +170,4 @@ typedef struct YYLTYPE
 #endif
 
 
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
index 07cf12202f..fb1ae29b37 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
@@ -45,10 +45,5 @@ static const struct HashTableValue mainTableValues[37] = {
 };
 
 extern const struct HashTable mainTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 1023, mainTableValues, 0 };
-#else
     { 133, 127, mainTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
index 8fb01f2781..7d9b43e21d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
@@ -27,10 +27,5 @@ static const struct HashTableValue mathTableValues[19] = {
 };
 
 extern const struct HashTable mathTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, mathTableValues, 0 };
-#else
     { 67, 63, mathTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
index de3d5a9132..e963e1ae92 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue numberTableValues[6] = {
 };
 
 extern const struct HashTable numberTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 15, numberTableValues, 0 };
-#else
     { 16, 15, numberTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
index 705efbb4af..fd822c67a1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
@@ -30,10 +30,5 @@ static const struct HashTableValue regExpConstructorTableValues[22] = {
 };
 
 extern const struct HashTable regExpConstructorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, regExpConstructorTableValues, 0 };
-#else
     { 65, 63, regExpConstructorTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
index 3612f62f9d..81d5b60604 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue regExpTableValues[6] = {
 };
 
 extern const struct HashTable regExpTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 31, regExpTableValues, 0 };
-#else
     { 17, 15, regExpTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
index 0cf08151f9..dfb9c200de 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
@@ -41,10 +41,5 @@ static const struct HashTableValue stringTableValues[33] = {
 };
 
 extern const struct HashTable stringTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, stringTableValues, 0 };
-#else
     { 71, 63, stringTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
new file mode 100644
index 0000000000..f48f4f4cab
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CachedCall_h
+#define CachedCall_h
+
+#include "CallFrameClosure.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "Interpreter.h"
+
+namespace JSC {
+    class CachedCall : Noncopyable {
+    public:
+        CachedCall(CallFrame* callFrame, JSFunction* function, int argCount, JSValue* exception)
+            : m_valid(false)
+            , m_interpreter(callFrame->interpreter())
+            , m_exception(exception)
+            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().node()->globalObject())
+        {
+            m_closure = m_interpreter->prepareForRepeatCall(function->body(), callFrame, function, argCount, function->scope().node(), exception);
+            m_valid = !*exception;
+        }
+        
+        JSValue call()
+        { 
+            ASSERT(m_valid);
+            return m_interpreter->execute(m_closure, m_exception);
+        }
+        void setThis(JSValue v) { m_closure.setArgument(0, v); }
+        void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
+        CallFrame* newCallFrame() { return m_closure.newCallFrame; }
+        ~CachedCall()
+        {
+            if (m_valid)
+                m_interpreter->endRepeatCall(m_closure);
+        }
+        
+    private:
+        bool m_valid;
+        Interpreter* m_interpreter;
+        JSValue* m_exception;
+        DynamicGlobalObjectScope m_globalObjectScope;
+        CallFrameClosure m_closure;
+    };
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp
index 1c74280f82..972487565f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp
@@ -27,12 +27,26 @@
 #include "CallFrame.h"
 
 #include "CodeBlock.h"
+#include "Interpreter.h"
 
 namespace JSC {
 
-JSValuePtr CallFrame::thisValue()
+JSValue CallFrame::thisValue()
 {
-    return this[codeBlock()->thisRegister()].jsValue(this);
+    return this[codeBlock()->thisRegister()].jsValue();
 }
 
+#ifndef NDEBUG
+void CallFrame::dumpCaller()
+{
+    int signedLineNumber;
+    intptr_t sourceID;
+    UString urlString;
+    JSValue function;
+    
+    interpreter()->retrieveLastCaller(this, signedLineNumber, sourceID, urlString, function);
+    printf("Callpoint => %s:%d\n", urlString.ascii(), signedLineNumber);
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
index d6b9b7967b..a61e143ad3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
@@ -40,8 +40,9 @@ namespace JSC  {
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
         ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
-        JSValuePtr thisValue();
+        JSValue thisValue();
 
         // Global object in which execution began.
         JSGlobalObject* dynamicGlobalObject();
@@ -73,17 +74,19 @@ namespace JSC  {
         // pointer, so these are inefficient, and should be used sparingly in new code.
         // But they're used in many places in legacy code, so they're not going away any time soon.
 
-        void setException(JSValuePtr exception) { globalData().exception = exception; }
-        void clearException() { globalData().exception = noValue(); }
-        JSValuePtr exception() const { return globalData().exception; }
-        JSValuePtr* exceptionSlot() { return &globalData().exception; }
+        void setException(JSValue exception) { globalData().exception = exception; }
+        void clearException() { globalData().exception = JSValue(); }
+        JSValue exception() const { return globalData().exception; }
+        JSValue* exceptionSlot() { return &globalData().exception; }
         bool hadException() const { return globalData().exception; }
 
         const CommonIdentifiers& propertyNames() const { return *globalData().propertyNames; }
-        const ArgList& emptyList() const { return *globalData().emptyList; }
+        const MarkedArgumentBuffer& emptyList() const { return *globalData().emptyList; }
         Interpreter* interpreter() { return globalData().interpreter; }
         Heap* heap() { return &globalData().heap; }
-
+#ifndef NDEBUG
+        void dumpCaller();
+#endif
         static const HashTable* arrayTable(CallFrame* callFrame) { return callFrame->globalData().arrayTable; }
         static const HashTable* dateTable(CallFrame* callFrame) { return callFrame->globalData().dateTable; }
         static const HashTable* mathTable(CallFrame* callFrame) { return callFrame->globalData().mathTable; }
@@ -92,28 +95,17 @@ namespace JSC  {
         static const HashTable* regExpConstructorTable(CallFrame* callFrame) { return callFrame->globalData().regExpConstructorTable; }
         static const HashTable* stringTable(CallFrame* callFrame) { return callFrame->globalData().stringTable; }
 
-    private:
-        friend class Arguments;
-        friend class JSActivation;
-        friend class JSGlobalObject;
-        friend class Interpreter;
-
         static CallFrame* create(Register* callFrameBase) { return static_cast<CallFrame*>(callFrameBase); }
         Register* registers() { return this; }
 
         CallFrame& operator=(const Register& r) { *static_cast<Register*>(this) = r; return *this; }
 
-        int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
         CallFrame* callerFrame() const { return this[RegisterFile::CallerFrame].callFrame(); }
         Arguments* optionalCalleeArguments() const { return this[RegisterFile::OptionalCalleeArguments].arguments(); }
         Instruction* returnPC() const { return this[RegisterFile::ReturnPC].vPC(); }
-        int returnValueRegister() const { return this[RegisterFile::ReturnValueRegister].i(); }
 
-        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = count; }
-        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
         void setCalleeArguments(Arguments* arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
         void setCallerFrame(CallFrame* callerFrame) { this[RegisterFile::CallerFrame] = callerFrame; }
-        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
         void setScopeChain(ScopeChainNode* scopeChain) { this[RegisterFile::ScopeChain] = scopeChain; }
 
         ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
@@ -131,6 +123,19 @@ namespace JSC  {
             setCalleeArguments(0);
         }
 
+    private:
+        friend class Arguments;
+        friend class JSActivation;
+        friend class JSGlobalObject;
+        friend class Interpreter;
+        friend struct CallFrameClosure;
+
+        int returnValueRegister() const { return this[RegisterFile::ReturnValueRegister].i(); }
+
+        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = count; }
+        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
+        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
+
         static const intptr_t HostCallFrameFlag = 1;
 
         static CallFrame* noCaller() { return reinterpret_cast<CallFrame*>(HostCallFrameFlag); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h
new file mode 100644
index 0000000000..0e14cedca6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CallFrameClosure_h
+#define CallFrameClosure_h
+
+namespace JSC {
+
+struct CallFrameClosure {
+    CallFrame* oldCallFrame;
+    CallFrame* newCallFrame;
+    JSFunction* function;
+    FunctionBodyNode* functionBody;
+    JSGlobalData* globalData;
+    Register* oldEnd;
+    ScopeChainNode* scopeChain;
+    int expectedParams;
+    int providedParams;
+    
+    void setArgument(int arg, JSValue value)
+    {
+        if (arg < expectedParams)
+            newCallFrame[arg - RegisterFile::CallFrameHeaderSize - expectedParams] = value;
+        else
+            newCallFrame[arg - RegisterFile::CallFrameHeaderSize - expectedParams - providedParams] = value;
+    }
+    void resetCallFrame()
+    {
+        newCallFrame->setScopeChain(scopeChain);
+        newCallFrame->setCalleeArguments(0);
+        for (int i = providedParams; i < expectedParams; ++i)
+            newCallFrame[i - RegisterFile::CallFrameHeaderSize - expectedParams] = jsUndefined();
+    }
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index 0f9ea01090..d980962be6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -32,11 +32,14 @@
 
 #include "Arguments.h"
 #include "BatchedTransitionOptimizer.h"
+#include "CallFrame.h"
+#include "CallFrameClosure.h"
 #include "CodeBlock.h"
+#include "Collector.h"
+#include "Debugger.h"
 #include "DebuggerCallFrame.h"
 #include "EvalCodeCache.h"
 #include "ExceptionHelpers.h"
-#include "CallFrame.h"
 #include "GlobalEvalFunction.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -44,19 +47,19 @@
 #include "JSFunction.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
+#include "LiteralParser.h"
 #include "JSStaticScopeObject.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
+#include "Operations.h"
 #include "Parser.h"
 #include "Profiler.h"
 #include "RegExpObject.h"
 #include "RegExpPrototype.h"
 #include "Register.h"
-#include "Collector.h"
-#include "Debugger.h"
-#include "Operations.h"
 #include "SamplingTool.h"
 #include <stdio.h>
+#include <wtf/Threading.h>
 
 #if ENABLE(JIT)
 #include "JIT.h"
@@ -66,34 +69,16 @@
 #include "AssemblerBuffer.h"
 #endif
 
-#if PLATFORM(DARWIN)
-#include <mach/mach.h>
-#endif
-
-#if HAVE(SYS_TIME_H)
-#include <sys/time.h>
-#endif
-
-#if PLATFORM(WIN_OS)
-#include <windows.h>
-#endif
-
-#if PLATFORM(QT)
-#include <QDateTime>
-#endif
-
 using namespace std;
 
 namespace JSC {
 
-// Preferred number of milliseconds between each timeout check
-static const int preferredScriptCheckTimeInterval = 1000;
-
-static ALWAYS_INLINE unsigned bytecodeOffsetForPC(CodeBlock* codeBlock, void* pc)
+static ALWAYS_INLINE unsigned bytecodeOffsetForPC(CallFrame* callFrame, CodeBlock* codeBlock, void* pc)
 {
 #if ENABLE(JIT)
-    return codeBlock->getBytecodeIndex(pc);
+    return codeBlock->getBytecodeIndex(callFrame, pc);
 #else
+    UNUSED_PARAM(callFrame);
     return static_cast<Instruction*>(pc) - codeBlock->instructions().begin();
 #endif
 }
@@ -106,203 +91,8 @@ static int depth(CodeBlock* codeBlock, ScopeChain& sc)
     return sc.localDepth();
 }
 
-// FIXME: This operation should be called "getNumber", not "isNumber" (as it is in JSValue.h).
-// FIXME: There's no need to have a "slow" version of this. All versions should be fast.
-static ALWAYS_INLINE bool fastIsNumber(JSValuePtr value, double& arg)
-{
-    if (JSImmediate::isNumber(value))
-        arg = JSImmediate::getTruncatedInt32(value);
-    else if (LIKELY(!JSImmediate::isImmediate(value)) && LIKELY(Heap::isNumber(asCell(value))))
-        arg = asNumberCell(value)->value();
-    else
-        return false;
-    return true;
-}
-
-// FIXME: Why doesn't JSValuePtr::toInt32 have the Heap::isNumber optimization?
-static bool fastToInt32(JSValuePtr value, int32_t& arg)
-{
-    if (JSImmediate::isNumber(value))
-        arg = JSImmediate::getTruncatedInt32(value);
-    else if (LIKELY(!JSImmediate::isImmediate(value)) && LIKELY(Heap::isNumber(asCell(value))))
-        arg = asNumberCell(value)->toInt32();
-    else
-        return false;
-    return true;
-}
-
-static ALWAYS_INLINE bool fastToUInt32(JSValuePtr value, uint32_t& arg)
-{
-    if (JSImmediate::isNumber(value)) {
-        if (JSImmediate::getTruncatedUInt32(value, arg))
-            return true;
-        bool scratch;
-        arg = toUInt32SlowCase(JSImmediate::getTruncatedInt32(value), scratch);
-        return true;
-    } else if (!JSImmediate::isImmediate(value) && Heap::isNumber(asCell(value)))
-        arg = asNumberCell(value)->toUInt32();
-    else
-        return false;
-    return true;
-}
-
-static inline bool jsLess(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    if (JSImmediate::areBothImmediateNumbers(v1, v2))
-        return JSImmediate::getTruncatedInt32(v1) < JSImmediate::getTruncatedInt32(v2);
-
-    double n1;
-    double n2;
-    if (fastIsNumber(v1, n1) && fastIsNumber(v2, n2))
-        return n1 < n2;
-
-    Interpreter* interpreter = callFrame->interpreter();
-    if (interpreter->isJSString(v1) && interpreter->isJSString(v2))
-        return asString(v1)->value() < asString(v2)->value();
-
-    JSValuePtr p1;
-    JSValuePtr p2;
-    bool wasNotString1 = v1->getPrimitiveNumber(callFrame, n1, p1);
-    bool wasNotString2 = v2->getPrimitiveNumber(callFrame, n2, p2);
-
-    if (wasNotString1 | wasNotString2)
-        return n1 < n2;
-
-    return asString(p1)->value() < asString(p2)->value();
-}
-
-static inline bool jsLessEq(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    if (JSImmediate::areBothImmediateNumbers(v1, v2))
-        return JSImmediate::getTruncatedInt32(v1) <= JSImmediate::getTruncatedInt32(v2);
-
-    double n1;
-    double n2;
-    if (fastIsNumber(v1, n1) && fastIsNumber(v2, n2))
-        return n1 <= n2;
-
-    Interpreter* interpreter = callFrame->interpreter();
-    if (interpreter->isJSString(v1) && interpreter->isJSString(v2))
-        return !(asString(v2)->value() < asString(v1)->value());
-
-    JSValuePtr p1;
-    JSValuePtr p2;
-    bool wasNotString1 = v1->getPrimitiveNumber(callFrame, n1, p1);
-    bool wasNotString2 = v2->getPrimitiveNumber(callFrame, n2, p2);
-
-    if (wasNotString1 | wasNotString2)
-        return n1 <= n2;
-
-    return !(asString(p2)->value() < asString(p1)->value());
-}
-
-static NEVER_INLINE JSValuePtr jsAddSlowCase(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    // exception for the Date exception in defaultValue()
-    JSValuePtr p1 = v1->toPrimitive(callFrame);
-    JSValuePtr p2 = v2->toPrimitive(callFrame);
-
-    if (p1->isString() || p2->isString()) {
-        RefPtr<UString::Rep> value = concatenate(p1->toString(callFrame).rep(), p2->toString(callFrame).rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
-    }
-
-    return jsNumber(callFrame, p1->toNumber(callFrame) + p2->toNumber(callFrame));
-}
-
-// Fast-path choices here are based on frequency data from SunSpider:
-//    <times> Add case: <t1> <t2>
-//    ---------------------------
-//    5626160 Add case: 3 3 (of these, 3637690 are for immediate values)
-//    247412  Add case: 5 5
-//    20900   Add case: 5 6
-//    13962   Add case: 5 3
-//    4000    Add case: 3 5
-
-static ALWAYS_INLINE JSValuePtr jsAdd(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = fastIsNumber(v2, right);
-    if (rightIsNumber && fastIsNumber(v1, left))
-        return jsNumber(callFrame, left + right);
-    
-    bool leftIsString = v1->isString();
-    if (leftIsString && v2->isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
-    }
-
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = JSImmediate::isImmediate(v2) ?
-            concatenate(asString(v1)->value().rep(), JSImmediate::getTruncatedInt32(v2)) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
-    }
-
-    // All other cases are pretty uncommon
-    return jsAddSlowCase(callFrame, v1, v2);
-}
-
-static JSValuePtr jsTypeStringForValue(CallFrame* callFrame, JSValuePtr v)
-{
-    if (v->isUndefined())
-        return jsNontrivialString(callFrame, "undefined");
-    if (v->isBoolean())
-        return jsNontrivialString(callFrame, "boolean");
-    if (v->isNumber())
-        return jsNontrivialString(callFrame, "number");
-    if (v->isString())
-        return jsNontrivialString(callFrame, "string");
-    if (v->isObject()) {
-        // Return "undefined" for objects that should be treated
-        // as null when doing comparisons.
-        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
-            return jsNontrivialString(callFrame, "undefined");
-        CallData callData;
-        if (asObject(v)->getCallData(callData) != CallTypeNone)
-            return jsNontrivialString(callFrame, "function");
-    }
-    return jsNontrivialString(callFrame, "object");
-}
-
-static bool jsIsObjectType(JSValuePtr v)
-{
-    if (JSImmediate::isImmediate(v))
-        return v->isNull();
-
-    JSType type = asCell(v)->structure()->typeInfo().type();
-    if (type == NumberType || type == StringType)
-        return false;
-    if (type == ObjectType) {
-        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
-            return false;
-        CallData callData;
-        if (asObject(v)->getCallData(callData) != CallTypeNone)
-            return false;
-    }
-    return true;
-}
-
-static bool jsIsFunctionType(JSValuePtr v)
-{
-    if (v->isObject()) {
-        CallData callData;
-        if (asObject(v)->getCallData(callData) != CallTypeNone)
-            return true;
-    }
-    return false;
-}
-
-NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+#if USE(INTERPRETER)
+NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int dst = (vPC + 1)->u.operand;
     int property = (vPC + 2)->u.operand;
@@ -318,11 +108,11 @@ NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, J
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
     } while (++iter != end);
@@ -330,7 +120,7 @@ NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, J
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     CodeBlock* codeBlock = callFrame->codeBlock();
 
@@ -351,11 +141,11 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
     } while (++iter != end);
@@ -363,7 +153,7 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int dst = (vPC + 1)->u.operand;
     JSGlobalObject* globalObject = static_cast<JSGlobalObject*>((vPC + 2)->u.jsCell);
@@ -373,7 +163,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     int offset = (vPC + 5)->u.operand;
 
     if (structure == globalObject->structure()) {
-        callFrame[dst] = JSValuePtr(globalObject->getDirectOffset(offset));
+        callFrame[dst] = JSValue(globalObject->getDirectOffset(offset));
         return true;
     }
 
@@ -381,21 +171,21 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     Identifier& ident = codeBlock->identifier(property);
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValuePtr result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
+        JSValue result = slot.getValue(callFrame, ident);
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
             vPC[4] = globalObject->structure();
             vPC[5] = slot.cachedOffset();
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
 
         exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
-        callFrame[dst] = JSValuePtr(result);
+        callFrame[dst] = JSValue(result);
         return true;
     }
 
@@ -403,37 +193,14 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     return false;
 }
 
-static ALWAYS_INLINE JSValuePtr inlineResolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
-{
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator next = iter;
-    ++next;
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-
-    PropertySlot slot;
-    JSObject* base;
-    while (true) {
-        base = *iter;
-        if (next == end || base->getPropertySlot(callFrame, property, slot))
-            return base;
-
-        iter = next;
-        ++next;
-    }
-
-    ASSERT_NOT_REACHED();
-    return noValue();
-}
-
 NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vPC)
 {
     int dst = (vPC + 1)->u.operand;
     int property = (vPC + 2)->u.operand;
-    callFrame[dst] = JSValuePtr(inlineResolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
+    callFrame[dst] = JSValue(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int baseDst = (vPC + 1)->u.operand;
     int propDst = (vPC + 2)->u.operand;
@@ -454,12 +221,12 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
         base = *iter;
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[propDst] = JSValuePtr(result);
-            callFrame[baseDst] = JSValuePtr(base);
+            callFrame[propDst] = JSValue(result);
+            callFrame[baseDst] = JSValue(base);
             return true;
         }
         ++iter;
@@ -469,7 +236,7 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int baseDst = (vPC + 1)->u.operand;
     int funcDst = (vPC + 2)->u.operand;
@@ -498,13 +265,13 @@ NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruct
             // that in host objects you always get a valid object for this.
             // We also handle wrapper substitution for the global object at the same time.
             JSObject* thisObj = base->toThisObject(callFrame);
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
 
-            callFrame[baseDst] = JSValuePtr(thisObj);
-            callFrame[funcDst] = JSValuePtr(result);
+            callFrame[baseDst] = JSValue(thisObj);
+            callFrame[funcDst] = JSValue(result);
             return true;
         }
         ++iter;
@@ -514,6 +281,8 @@ NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruct
     return false;
 }
 
+#endif // USE(INTERPRETER)
+
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argc)
 {
     Register* r = callFrame->registers();
@@ -551,89 +320,57 @@ ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newC
     return CallFrame::create(r);
 }
 
-static NEVER_INLINE bool isNotObject(CallFrame* callFrame, bool forInstanceOf, CodeBlock* codeBlock, const Instruction* vPC, JSValuePtr value, JSValuePtr& exceptionData)
+#if USE(INTERPRETER)
+static NEVER_INLINE bool isInvalidParamForIn(CallFrame* callFrame, CodeBlock* codeBlock, const Instruction* vPC, JSValue value, JSValue& exceptionData)
 {
-    if (value->isObject())
+    if (value.isObject())
         return false;
-    exceptionData = createInvalidParamError(callFrame, forInstanceOf ? "instanceof" : "in" , value, vPC - codeBlock->instructions().begin(), codeBlock);
+    exceptionData = createInvalidParamError(callFrame, "in" , value, vPC - codeBlock->instructions().begin(), codeBlock);
     return true;
 }
 
-NEVER_INLINE JSValuePtr Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset, JSValuePtr& exceptionValue)
+static NEVER_INLINE bool isInvalidParamForInstanceOf(CallFrame* callFrame, CodeBlock* codeBlock, const Instruction* vPC, JSValue value, JSValue& exceptionData)
+{
+    if (value.isObject() && asObject(value)->structure()->typeInfo().implementsHasInstance())
+        return false;
+    exceptionData = createInvalidParamError(callFrame, "instanceof" , value, vPC - codeBlock->instructions().begin(), codeBlock);
+    return true;
+}
+#endif
+
+NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset, JSValue& exceptionValue)
 {
     if (argc < 2)
         return jsUndefined();
 
-    JSValuePtr program = argv[1].jsValue(callFrame);
+    JSValue program = argv[1].jsValue();
 
-    if (!program->isString())
+    if (!program.isString())
         return program;
 
     UString programSource = asString(program)->value();
 
+    LiteralParser preparser(callFrame, programSource);
+    if (JSValue parsedObject = preparser.tryLiteralParse())
+        return parsedObject;
+    
+    
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     CodeBlock* codeBlock = callFrame->codeBlock();
     RefPtr<EvalNode> evalNode = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
 
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
     if (evalNode)
-        result = callFrame->globalData().interpreter->execute(evalNode.get(), callFrame, callFrame->thisValue()->toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
+        result = callFrame->globalData().interpreter->execute(evalNode.get(), callFrame, callFrame->thisValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
 
     return result;
 }
 
 Interpreter::Interpreter()
     : m_sampler(0)
-#if ENABLE(JIT)
-    , m_ctiArrayLengthTrampoline(0)
-    , m_ctiStringLengthTrampoline(0)
-    , m_ctiVirtualCallPreLink(0)
-    , m_ctiVirtualCallLink(0)
-    , m_ctiVirtualCall(0)
-#endif
     , m_reentryDepth(0)
-    , m_timeoutTime(0)
-    , m_timeAtLastCheckTimeout(0)
-    , m_timeExecuting(0)
-    , m_timeoutCheckCount(0)
-    , m_ticksUntilNextTimeoutCheck(initialTickCountThreshold)
 {
-    initTimeout();
     privateExecute(InitializeAndReturn, 0, 0, 0);
-    
-    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
-    void* storage = fastMalloc(sizeof(CollectorBlock));
-
-    JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
-    m_jsArrayVptr = jsArray->vptr();
-    jsArray->~JSCell();
-
-    JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
-    m_jsByteArrayVptr = jsByteArray->vptr();
-    jsByteArray->~JSCell();
-
-    JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
-    m_jsStringVptr = jsString->vptr();
-    jsString->~JSCell();
-
-    JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
-    m_jsFunctionVptr = jsFunction->vptr();
-    jsFunction->~JSCell();
-    
-    fastFree(storage);
-}
-
-void Interpreter::initialize(JSGlobalData* globalData)
-{
-#if ENABLE(JIT)
-    JIT::compileCTIMachineTrampolines(globalData);
-#else
-    UNUSED_PARAM(globalData);
-#endif
-}
-
-Interpreter::~Interpreter()
-{
 }
 
 #ifndef NDEBUG
@@ -733,7 +470,7 @@ bool Interpreter::isOpcode(Opcode opcode)
 #endif
 }
 
-NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValuePtr exceptionValue, unsigned& bytecodeOffset, CodeBlock*& codeBlock)
+NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue exceptionValue, unsigned& bytecodeOffset, CodeBlock*& codeBlock)
 {
     CodeBlock* oldCodeBlock = codeBlock;
     ScopeChainNode* scopeChain = callFrame->scopeChain();
@@ -772,16 +509,16 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValuePtr
         return false;
 
     codeBlock = callFrame->codeBlock();
-    bytecodeOffset = bytecodeOffsetForPC(codeBlock, returnPC);
+    bytecodeOffset = bytecodeOffsetForPC(callFrame, codeBlock, returnPC);
     return true;
 }
 
-NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValuePtr& exceptionValue, unsigned bytecodeOffset, bool explicitThrow)
+NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValue& exceptionValue, unsigned bytecodeOffset, bool explicitThrow)
 {
     // Set up the exception object
 
     CodeBlock* codeBlock = callFrame->codeBlock();
-    if (exceptionValue->isObject()) {
+    if (exceptionValue.isObject()) {
         JSObject* exception = asObject(exceptionValue);
         if (exception->isNotAnObjectErrorStub()) {
             exception = createNotAnObjectError(callFrame, static_cast<JSNotAnObjectErrorStub*>(exception), bytecodeOffset, codeBlock);
@@ -830,13 +567,13 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     if (Profiler* profiler = *Profiler::enabledProfilerReference()) {
 #if !ENABLE(JIT)
         if (isCallBytecode(codeBlock->instructions()[bytecodeOffset].u.opcode))
-            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 2].u.operand].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 2].u.operand].jsValue());
         else if (codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
-            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 10].u.operand].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 10].u.operand].jsValue());
 #else
         int functionRegisterIndex;
         if (codeBlock->functionRegisterForBytecodeOffset(bytecodeOffset, functionRegisterIndex))
-            profiler->didExecute(callFrame, callFrame[functionRegisterIndex].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[functionRegisterIndex].jsValue());
 #endif
     }
 
@@ -861,13 +598,15 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     return handler;
 }
 
-JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValuePtr* exception)
+JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     CodeBlock* codeBlock = &programNode->bytecode(scopeChain);
@@ -886,7 +625,7 @@ JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame,
     globalObject->copyGlobalsTo(m_registerFile);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd + codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize);
-    newCallFrame[codeBlock->thisRegister()] = JSValuePtr(thisObj);
+    newCallFrame[codeBlock->thisRegister()] = JSValue(thisObj);
     newCallFrame->init(codeBlock, 0, scopeChain, CallFrame::noCaller(), 0, 0, 0);
 
     if (codeBlock->needsFullScopeChain())
@@ -896,15 +635,13 @@ JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame,
     if (*profiler)
         (*profiler)->willExecute(newCallFrame, programNode->sourceURL(), programNode->lineNo());
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = JIT::execute(codeBlock->jitCode(), &m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = programNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -922,13 +659,15 @@ JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame,
     return result;
 }
 
-JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValuePtr* exception)
+JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     Register* oldEnd = m_registerFile.end();
@@ -943,7 +682,7 @@ JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* c
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
-    newCallFrame[0] = JSValuePtr(thisObj);
+    newCallFrame[0] = JSValue(thisObj);
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
         newCallFrame[++dst] = *it;
@@ -960,17 +699,15 @@ JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* c
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
-        (*profiler)->willExecute(newCallFrame, function);
+        (*profiler)->willExecute(callFrame, function);
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = JIT::execute(codeBlock->jitCode(), &m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = functionBodyNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -978,24 +715,97 @@ JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* c
     }
 
     if (*profiler)
-        (*profiler)->didExecute(newCallFrame, function);
+        (*profiler)->didExecute(callFrame, function);
 
     m_registerFile.shrink(oldEnd);
     return result;
 }
 
-JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValuePtr* exception)
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
+{
+    ASSERT(!scopeChain->globalData->exception);
+    
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return CallFrameClosure();
+        }
+    }
+    
+    Register* oldEnd = m_registerFile.end();
+    int argc = 1 + argCount; // implicit "this" parameter
+    
+    if (!m_registerFile.grow(oldEnd + argc)) {
+        *exception = createStackOverflowError(callFrame);
+        return CallFrameClosure();
+    }
+
+    CallFrame* newCallFrame = CallFrame::create(oldEnd);
+    size_t dst = 0;
+    for (int i = 0; i < argc; ++i)
+        newCallFrame[++dst] = jsUndefined();
+    
+    CodeBlock* codeBlock = &functionBodyNode->bytecode(scopeChain);
+    newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
+    if (UNLIKELY(!newCallFrame)) {
+        *exception = createStackOverflowError(callFrame);
+        m_registerFile.shrink(oldEnd);
+        return CallFrameClosure();
+    }
+    // a 0 codeBlock indicates a built-in caller
+    newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, argc, function);
+#if ENABLE(JIT)
+    functionBodyNode->jitCode(scopeChain);
+#endif
+
+    CallFrameClosure result = { callFrame, newCallFrame, function, functionBodyNode, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
+    return result;
+}
+
+JSValue Interpreter::execute(CallFrameClosure& closure, JSValue* exception) 
+{
+    closure.resetCallFrame();
+    Profiler** profiler = Profiler::enabledProfilerReference();
+    if (*profiler)
+        (*profiler)->willExecute(closure.oldCallFrame, closure.function);
+    
+    JSValue result;
+    {
+        SamplingTool::CallRecord callRecord(m_sampler);
+        
+        m_reentryDepth++;
+#if ENABLE(JIT)
+        result = closure.functionBody->generatedJITCode().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
+#else
+        result = privateExecute(Normal, &m_registerFile, closure.newCallFrame, exception);
+#endif
+        m_reentryDepth--;
+    }
+    
+    if (*profiler)
+        (*profiler)->didExecute(closure.oldCallFrame, closure.function);
+    return result;
+}
+
+void Interpreter::endRepeatCall(CallFrameClosure& closure)
+{
+    m_registerFile.shrink(closure.oldEnd);
+}
+
+JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
 {
     return execute(evalNode, callFrame, thisObj, m_registerFile.size() + evalNode->bytecode(scopeChain).m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
 }
 
-JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValuePtr* exception)
+JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
@@ -1044,7 +854,7 @@ JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObje
     CallFrame* newCallFrame = CallFrame::create(m_registerFile.start() + globalRegisterOffset);
 
     // a 0 codeBlock indicates a built-in caller
-    newCallFrame[codeBlock->thisRegister()] = JSValuePtr(thisObj);
+    newCallFrame[codeBlock->thisRegister()] = JSValue(thisObj);
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, 0, 0);
 
     if (codeBlock->needsFullScopeChain())
@@ -1054,15 +864,13 @@ JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObje
     if (*profiler)
         (*profiler)->willExecute(newCallFrame, evalNode->sourceURL(), evalNode->lineNo());
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = JIT::execute(codeBlock->jitCode(), &m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = evalNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -1103,123 +911,27 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
             return;
     }
 }
-
-void Interpreter::resetTimeoutCheck()
-{
-    m_ticksUntilNextTimeoutCheck = initialTickCountThreshold;
-    m_timeAtLastCheckTimeout = 0;
-    m_timeExecuting = 0;
-}
-
-// Returns the time the current thread has spent executing, in milliseconds.
-static inline unsigned getCPUTime()
-{
-#if PLATFORM(DARWIN)
-    mach_msg_type_number_t infoCount = THREAD_BASIC_INFO_COUNT;
-    thread_basic_info_data_t info;
-
-    // Get thread information
-    mach_port_t threadPort = mach_thread_self();
-    thread_info(threadPort, THREAD_BASIC_INFO, reinterpret_cast<thread_info_t>(&info), &infoCount);
-    mach_port_deallocate(mach_task_self(), threadPort);
-    
-    unsigned time = info.user_time.seconds * 1000 + info.user_time.microseconds / 1000;
-    time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
-    
-    return time;
-#elif HAVE(SYS_TIME_H)
-    // FIXME: This should probably use getrusage with the RUSAGE_THREAD flag.
-    struct timeval tv;
-    gettimeofday(&tv, 0);
-    return tv.tv_sec * 1000 + tv.tv_usec / 1000;
-#elif PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    return t.toTime_t() * 1000 + t.time().msec();
-#elif PLATFORM(WIN_OS)
-    union {
-        FILETIME fileTime;
-        unsigned long long fileTimeAsLong;
-    } userTime, kernelTime;
     
-    // GetThreadTimes won't accept NULL arguments so we pass these even though
-    // they're not used.
-    FILETIME creationTime, exitTime;
-    
-    GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
-    
-    return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
-#else
-#error Platform does not have getCurrentTime function
-#endif
-}
-
-// We have to return a JSValue here, gcc seems to produce worse code if 
-// we attempt to return a bool
-ALWAYS_INLINE bool Interpreter::checkTimeout(JSGlobalObject* globalObject)
-{
-    unsigned currentTime = getCPUTime();
-    
-    if (!m_timeAtLastCheckTimeout) {
-        // Suspicious amount of looping in a script -- start timing it
-        m_timeAtLastCheckTimeout = currentTime;
-        return false;
-    }
-    
-    unsigned timeDiff = currentTime - m_timeAtLastCheckTimeout;
-    
-    if (timeDiff == 0)
-        timeDiff = 1;
-    
-    m_timeExecuting += timeDiff;
-    m_timeAtLastCheckTimeout = currentTime;
-    
-    // Adjust the tick threshold so we get the next checkTimeout call in the interval specified in 
-    // preferredScriptCheckTimeInterval
-    m_ticksUntilNextTimeoutCheck = static_cast<unsigned>((static_cast<float>(preferredScriptCheckTimeInterval) / timeDiff) * m_ticksUntilNextTimeoutCheck);
-    // If the new threshold is 0 reset it to the default threshold. This can happen if the timeDiff is higher than the
-    // preferred script check time interval.
-    if (m_ticksUntilNextTimeoutCheck == 0)
-        m_ticksUntilNextTimeoutCheck = initialTickCountThreshold;
-    
-    if (m_timeoutTime && m_timeExecuting > m_timeoutTime) {
-        if (globalObject->shouldInterruptScript())
-            return true;
-        
-        resetTimeoutCheck();
-    }
-    
-    return false;
-}
-
+#if USE(INTERPRETER)
 NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
 {
     int dst = (++vPC)->u.operand;
     CodeBlock* codeBlock = callFrame->codeBlock();
     Identifier& property = codeBlock->identifier((++vPC)->u.operand);
-    JSValuePtr value = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+    JSValue value = callFrame[(++vPC)->u.operand].jsValue();
     JSObject* scope = new (callFrame) JSStaticScopeObject(callFrame, property, value, DontDelete);
-    callFrame[dst] = JSValuePtr(scope);
+    callFrame[dst] = JSValue(scope);
 
     return callFrame->scopeChain()->push(scope);
 }
 
-static StructureChain* cachePrototypeChain(CallFrame* callFrame, Structure* structure)
-{
-    JSValuePtr prototype = structure->prototypeForLookup(callFrame);
-    if (JSImmediate::isImmediate(prototype))
-        return 0;
-    RefPtr<StructureChain> chain = StructureChain::create(asObject(prototype)->structure());
-    structure->setCachedPrototypeChain(chain.release());
-    return structure->cachedPrototypeChain();
-}
-
-NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValuePtr baseValue, const PutPropertySlot& slot)
+NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValue baseValue, const PutPropertySlot& slot)
 {
     // Recursive invocation may already have specialized this instruction.
     if (vPC[0].u.opcode != getOpcode(op_put_by_id))
         return;
 
-    if (JSImmediate::isImmediate(baseValue))
+    if (!baseValue.isCell())
         return;
 
     // Uncacheable: give up.
@@ -1263,16 +975,7 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain) {
-            chain = cachePrototypeChain(callFrame, structure);
-            if (!chain) {
-                // This happens if someone has manually inserted null into the prototype chain
-                vPC[0] = getOpcode(op_put_by_id_generic);
-                return;
-            }
-        }
-        vPC[6] = chain;
+        vPC[6] = structure->prototypeChain(callFrame);
         vPC[7] = slot.cachedOffset();
         codeBlock->refStructures(vPC);
         return;
@@ -1290,55 +993,25 @@ NEVER_INLINE void Interpreter::uncachePutByID(CodeBlock* codeBlock, Instruction*
     vPC[4] = 0;
 }
 
-static size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValuePtr baseValue, const PropertySlot& slot)
-{
-    JSCell* cell = asCell(baseValue);
-    size_t count = 0;
-
-    while (slot.slotBase() != cell) {
-        JSValuePtr v = cell->structure()->prototypeForLookup(callFrame);
-
-        // If we didn't find slotBase in baseValue's prototype chain, then baseValue
-        // must be a proxy for another object.
-
-        if (v->isNull())
-            return 0;
-
-        cell = asCell(v);
-
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (cell->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(cell->structure());
-            asObject(cell)->setStructure(transition.release());
-            cell->structure()->setCachedPrototypeChain(0);
-        }
-
-        ++count;
-    }
-    
-    ASSERT(count);
-    return count;
-}
-
-NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot& slot)
+NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot)
 {
     // Recursive invocation may already have specialized this instruction.
     if (vPC[0].u.opcode != getOpcode(op_get_by_id))
         return;
 
     // FIXME: Cache property access for immediates.
-    if (JSImmediate::isImmediate(baseValue)) {
+    if (!baseValue.isCell()) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    if (isJSArray(baseValue) && propertyName == callFrame->propertyNames().length) {
+    JSGlobalData* globalData = &callFrame->globalData();
+    if (isJSArray(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
         vPC[0] = getOpcode(op_get_array_length);
         return;
     }
 
-    if (isJSString(baseValue) && propertyName == callFrame->propertyNames().length) {
+    if (isJSString(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
         vPC[0] = getOpcode(op_get_string_length);
         return;
     }
@@ -1381,17 +1054,14 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
     }
 
     if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-        ASSERT(slot.slotBase()->isObject());
+        ASSERT(slot.slotBase().isObject());
 
         JSObject* baseObject = asObject(slot.slotBase());
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (baseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(baseObject->structure());
-            baseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
+        if (baseObject->structure()->isDictionary())
+            baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
 
         vPC[0] = getOpcode(op_get_by_id_proto);
         vPC[5] = baseObject->structure();
@@ -1407,14 +1077,9 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    StructureChain* chain = structure->cachedPrototypeChain();
-    if (!chain)
-        chain = cachePrototypeChain(callFrame, structure);
-    ASSERT(chain);
-
     vPC[0] = getOpcode(op_get_by_id_chain);
     vPC[4] = structure;
-    vPC[5] = chain;
+    vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
     vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
@@ -1427,7 +1092,9 @@ NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock* codeBlock, Instruction*
     vPC[4] = 0;
 }
 
-JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame, JSValuePtr* exception)
+#endif // USE(INTERPRETER)
+
+JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame, JSValue* exception)
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
@@ -1442,25 +1109,31 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             #undef ADD_OPCODE_ID
             ASSERT(m_opcodeIDTable.size() == numOpcodeIDs);
         #endif // HAVE(COMPUTED_GOTO)
-        return noValue();
+        return JSValue();
     }
 
 #if ENABLE(JIT)
     // Currently with CTI enabled we never interpret functions
     ASSERT_NOT_REACHED();
 #endif
+#if !USE(INTERPRETER)
+    UNUSED_PARAM(registerFile);
+    UNUSED_PARAM(callFrame);
+    UNUSED_PARAM(exception);
+    return JSValue();
+#else
 
     JSGlobalData* globalData = &callFrame->globalData();
-    JSValuePtr exceptionValue = noValue();
+    JSValue exceptionValue;
     HandlerInfo* handler = 0;
 
     Instruction* vPC = callFrame->codeBlock()->instructions().begin();
     Profiler** enabledProfilerReference = Profiler::enabledProfilerReference();
-    unsigned tickCount = m_ticksUntilNextTimeoutCheck + 1;
+    unsigned tickCount = globalData->timeoutChecker.ticksUntilNextCheck();
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(globalData->exception != noValue())) { \
+        if (UNLIKELY(globalData->exception != JSValue())) { \
             exceptionValue = globalData->exception; \
             goto vm_throw; \
         } \
@@ -1472,19 +1145,17 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
 #define CHECK_FOR_TIMEOUT() \
     if (!--tickCount) { \
-        if (checkTimeout(callFrame->dynamicGlobalObject())) { \
+        if (globalData->timeoutChecker.didTimeOut(callFrame)) { \
             exceptionValue = jsNull(); \
             goto vm_throw; \
         } \
-        tickCount = m_ticksUntilNextTimeoutCheck; \
+        tickCount = globalData->timeoutChecker.ticksUntilNextCheck(); \
     }
     
 #if ENABLE(OPCODE_SAMPLING)
     #define SAMPLE(codeBlock, vPC) m_sampler->sample(codeBlock, vPC)
-    #define CTI_SAMPLER ARG_globalData->interpreter->sampler()
 #else
     #define SAMPLE(codeBlock, vPC)
-    #define CTI_SAMPLER 0
 #endif
 
 #if HAVE(COMPUTED_GOTO)
@@ -1514,7 +1185,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            constructor, and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(constructEmptyObject(callFrame));
+        callFrame[dst] = JSValue(constructEmptyObject(callFrame));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1531,7 +1202,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int firstArg = (++vPC)->u.operand;
         int argCount = (++vPC)->u.operand;
         ArgList args(callFrame->registers() + firstArg, argCount);
-        callFrame[dst] = JSValuePtr(constructArray(callFrame, args));
+        callFrame[dst] = JSValue(constructArray(callFrame, args));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1545,7 +1216,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int regExp = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
+        callFrame[dst] = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1570,12 +1241,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = jsBoolean(src1 == src2);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSFastMath::equal(src1, src2);
         else {
-            JSValuePtr result = jsBoolean(equalSlowCase(callFrame, src1, src2));
+            JSValue result = jsBoolean(JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1590,15 +1261,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            operator, and puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
 
-        if (src->isUndefinedOrNull()) {
+        if (src.isUndefinedOrNull()) {
             callFrame[dst] = jsBoolean(true);
             ++vPC;
             NEXT_INSTRUCTION();
         }
         
-        callFrame[dst] = jsBoolean(!JSImmediate::isImmediate(src) && src->asCell()->structure()->typeInfo().masqueradesAsUndefined());
+        callFrame[dst] = jsBoolean(src.isCell() && src.asCell()->structure()->typeInfo().masqueradesAsUndefined());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -1610,12 +1281,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = jsBoolean(src1 != src2);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSFastMath::notEqual(src1, src2);
         else {
-            JSValuePtr result = jsBoolean(!equalSlowCase(callFrame, src1, src2));
+            JSValue result = jsBoolean(!JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1630,15 +1301,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            operator, and puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
 
-        if (src->isUndefinedOrNull()) {
+        if (src.isUndefinedOrNull()) {
             callFrame[dst] = jsBoolean(false);
             ++vPC;
             NEXT_INSTRUCTION();
         }
         
-        callFrame[dst] = jsBoolean(JSImmediate::isImmediate(src) || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
+        callFrame[dst] = jsBoolean(!src.isCell() || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -1650,14 +1321,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediate(src1, src2))
-            callFrame[dst] = jsBoolean(src1 == src2);
-        else if (JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate()))
-            callFrame[dst] = jsBoolean(false);
-        else
-            callFrame[dst] = jsBoolean(strictEqualSlowCase(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        callFrame[dst] = jsBoolean(JSValue::strictEqual(src1, src2));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1670,15 +1336,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-
-        if (JSImmediate::areBothImmediate(src1, src2))
-            callFrame[dst] = jsBoolean(src1 != src2);
-        else if (JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate()))
-            callFrame[dst] = jsBoolean(true);
-        else
-            callFrame[dst] = jsBoolean(!strictEqualSlowCase(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        callFrame[dst] = jsBoolean(!JSValue::strictEqual(src1, src2));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1691,9 +1351,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr result = jsBoolean(jsLess(callFrame, src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue result = jsBoolean(jsLess(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -1708,9 +1368,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr result = jsBoolean(jsLessEq(callFrame, src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue result = jsBoolean(jsLessEq(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -1724,11 +1384,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            back in register srcDst.
         */
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v))
-            callFrame[srcDst] = JSValuePtr(JSImmediate::incImmediateNumber(v));
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v))
+            callFrame[srcDst] = JSValue(JSFastMath::incImmediateNumber(v));
         else {
-            JSValuePtr result = jsNumber(callFrame, v->toNumber(callFrame) + 1);
+            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) + 1);
             CHECK_FOR_EXCEPTION();
             callFrame[srcDst] = result;
         }
@@ -1743,11 +1403,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            back in register srcDst.
         */
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v))
-            callFrame[srcDst] = JSValuePtr(JSImmediate::decImmediateNumber(v));
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v))
+            callFrame[srcDst] = JSValue(JSFastMath::decImmediateNumber(v));
         else {
-            JSValuePtr result = jsNumber(callFrame, v->toNumber(callFrame) - 1);
+            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) - 1);
             CHECK_FOR_EXCEPTION();
             callFrame[srcDst] = result;
         }
@@ -1764,15 +1424,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v)) {
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v)) {
             callFrame[dst] = v;
-            callFrame[srcDst] = JSValuePtr(JSImmediate::incImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::incImmediateNumber(v));
         } else {
-            JSValuePtr number = callFrame[srcDst].jsValue(callFrame)->toJSNumber(callFrame);
+            JSValue number = callFrame[srcDst].jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = number;
-            callFrame[srcDst] = JSValuePtr(jsNumber(callFrame, number->uncheckedGetNumber() + 1));
+            callFrame[srcDst] = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() + 1));
         }
 
         ++vPC;
@@ -1787,15 +1447,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v)) {
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v)) {
             callFrame[dst] = v;
-            callFrame[srcDst] = JSValuePtr(JSImmediate::decImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::decImmediateNumber(v));
         } else {
-            JSValuePtr number = callFrame[srcDst].jsValue(callFrame)->toJSNumber(callFrame);
+            JSValue number = callFrame[srcDst].jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = number;
-            callFrame[srcDst] = JSValuePtr(jsNumber(callFrame, number->uncheckedGetNumber() - 1));
+            callFrame[srcDst] = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() - 1));
         }
 
         ++vPC;
@@ -1810,12 +1470,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
 
-        JSValuePtr srcVal = callFrame[src].jsValue(callFrame);
+        JSValue srcVal = callFrame[src].jsValue();
 
-        if (LIKELY(srcVal->isNumber()))
+        if (LIKELY(srcVal.isNumber()))
             callFrame[dst] = callFrame[src];
         else {
-            JSValuePtr result = srcVal->toJSNumber(callFrame);
+            JSValue result = srcVal.toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1830,13 +1490,13 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
         ++vPC;
         double v;
-        if (fastIsNumber(src, v))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, -v));
+        if (src.getNumber(v))
+            callFrame[dst] = JSValue(jsNumber(callFrame, -v));
         else {
-            JSValuePtr result = jsNumber(callFrame, -src->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1851,12 +1511,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            numeric add, depending on the types of the operands.)
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(src1) && JSImmediate::canDoFastAdditiveOperations(src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::addImmediateNumbers(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::addImmediateNumbers(src1, src2));
         else {
-            JSValuePtr result = jsAdd(callFrame, src1, src2);
+            JSValue result = jsAdd(callFrame, src1, src2);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1870,21 +1530,21 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            numbers), and puts the product in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2)) {
-            int32_t left = JSImmediate::getTruncatedInt32(src1);
-            int32_t right = JSImmediate::getTruncatedInt32(src2);
+        if (JSValue::areBothInt32Fast(src1, src2)) {
+            int32_t left = src1.getInt32Fast();
+            int32_t right = src2.getInt32Fast();
             if ((left | right) >> 15 == 0)
-                callFrame[dst] = JSValuePtr(jsNumber(callFrame, left * right));
+                callFrame[dst] = JSValue(jsNumber(callFrame, left * right));
             else
-                callFrame[dst] = JSValuePtr(jsNumber(callFrame, static_cast<double>(left) * static_cast<double>(right)));
-        } else if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left * right));
+                callFrame[dst] = JSValue(jsNumber(callFrame, static_cast<double>(left) * static_cast<double>(right)));
+        } else if (src1.getNumber(left) && src2.getNumber(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left * right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toNumber(callFrame) * src2->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) * src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1900,14 +1560,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            quotient in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr dividend = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr divisor = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue dividend = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue divisor = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
-        if (fastIsNumber(dividend, left) && fastIsNumber(divisor, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left / right));
+        if (dividend.getNumber(left) && divisor.getNumber(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left / right));
         else {
-            JSValuePtr result = jsNumber(callFrame, dividend->toNumber(callFrame) / divisor->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1925,17 +1585,21 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int dividend = (++vPC)->u.operand;
         int divisor = (++vPC)->u.operand;
 
-        JSValuePtr dividendValue = callFrame[dividend].jsValue(callFrame);
-        JSValuePtr divisorValue = callFrame[divisor].jsValue(callFrame);
+        JSValue dividendValue = callFrame[dividend].jsValue();
+        JSValue divisorValue = callFrame[divisor].jsValue();
 
-        if (JSImmediate::areBothImmediateNumbers(dividendValue, divisorValue) && divisorValue != JSImmediate::from(0)) {
-            callFrame[dst] = JSValuePtr(JSImmediate::from(JSImmediate::getTruncatedInt32(dividendValue) % JSImmediate::getTruncatedInt32(divisorValue)));
+        if (JSValue::areBothInt32Fast(dividendValue, divisorValue) && divisorValue != jsNumber(callFrame, 0)) {
+            // We expect the result of the modulus of a number that was representable as an int32 to also be representable
+            // as an int32.
+            JSValue result = JSValue::makeInt32Fast(dividendValue.getInt32Fast() % divisorValue.getInt32Fast());
+            ASSERT(result);
+            callFrame[dst] = result;
             ++vPC;
             NEXT_INSTRUCTION();
         }
 
-        double d = dividendValue->toNumber(callFrame);
-        JSValuePtr result = jsNumber(callFrame, fmod(d, divisorValue->toNumber(callFrame)));
+        double d = dividendValue.toNumber(callFrame);
+        JSValue result = jsNumber(callFrame, fmod(d, divisorValue.toNumber(callFrame)));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
         ++vPC;
@@ -1949,16 +1613,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
-        if (JSImmediate::canDoFastAdditiveOperations(src1) && JSImmediate::canDoFastAdditiveOperations(src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::subImmediateNumbers(src1, src2));
-        else if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left - right));
+        if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::subImmediateNumbers(src1, src2));
+        else if (src1.getNumber(left) && src2.getNumber(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left - right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toNumber(callFrame) - src2->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1973,16 +1637,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         uint32_t right;
-        if (JSImmediate::areBothImmediateNumbers(val, shift))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, JSImmediate::getTruncatedInt32(val) << (JSImmediate::getTruncatedUInt32(shift) & 0x1f)));
-        else if (fastToInt32(val, left) && fastToUInt32(shift, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left << (right & 0x1f)));
+        if (JSValue::areBothInt32Fast(val, shift))
+            callFrame[dst] = JSValue(jsNumber(callFrame, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
+        else if (val.numberToInt32(left) && shift.numberToUInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left << (right & 0x1f)));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val->toInt32(callFrame)) << (shift->toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1998,16 +1662,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            uint32), and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         uint32_t right;
-        if (JSImmediate::areBothImmediateNumbers(val, shift))
-            callFrame[dst] = JSValuePtr(JSImmediate::rightShiftImmediateNumbers(val, shift));
-        else if (fastToInt32(val, left) && fastToUInt32(shift, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left >> (right & 0x1f)));
+        if (JSFastMath::canDoFastRshift(val, shift))
+            callFrame[dst] = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
+        else if (val.numberToInt32(left) && shift.numberToUInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left >> (right & 0x1f)));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val->toInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2023,12 +1687,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            uint32), and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediateNumbers(val, shift) && !JSImmediate::isNegative(val))
-            callFrame[dst] = JSValuePtr(JSImmediate::rightShiftImmediateNumbers(val, shift));
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastUrshift(val, shift))
+            callFrame[dst] = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val->toUInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2044,16 +1708,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::andImmediateNumbers(src1, src2));
-        else if (fastToInt32(src1, left) && fastToInt32(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left & right));
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::andImmediateNumbers(src1, src2));
+        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left & right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toInt32(callFrame) & src2->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) & src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2069,16 +1733,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::xorImmediateNumbers(src1, src2));
-        else if (fastToInt32(src1, left) && fastToInt32(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left ^ right));
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::xorImmediateNumbers(src1, src2));
+        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left ^ right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toInt32(callFrame) ^ src2->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2094,16 +1758,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::orImmediateNumbers(src1, src2));
-        else if (fastToInt32(src1, left) && fastToInt32(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left | right));
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::orImmediateNumbers(src1, src2));
+        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left | right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toInt32(callFrame) | src2->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) | src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2118,12 +1782,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
         int32_t value;
-        if (fastToInt32(src, value))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, ~value));
+        if (src.numberToInt32(value))
+            callFrame[dst] = JSValue(jsNumber(callFrame, ~value));
         else {
-            JSValuePtr result = jsNumber(callFrame, ~src->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, ~src.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2138,7 +1802,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        JSValuePtr result = jsBoolean(!callFrame[src].jsValue(callFrame)->toBoolean(callFrame));
+        JSValue result = jsBoolean(!callFrame[src].jsValue().toBoolean(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -2163,13 +1827,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = vPC[3].u.operand;
         int baseProto = vPC[4].u.operand;
 
-        JSValuePtr baseVal = callFrame[base].jsValue(callFrame);
+        JSValue baseVal = callFrame[base].jsValue();
 
-        if (isNotObject(callFrame, true, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
+        if (isInvalidParamForInstanceOf(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
             goto vm_throw;
 
-        JSObject* baseObj = asObject(baseVal);
-        callFrame[dst] = jsBoolean(baseObj->structure()->typeInfo().implementsHasInstance() ? baseObj->hasInstance(callFrame, callFrame[value].jsValue(callFrame), callFrame[baseProto].jsValue(callFrame)) : false);
+        bool result = asObject(baseVal)->hasInstance(callFrame, callFrame[value].jsValue(), callFrame[baseProto].jsValue());
+        CHECK_FOR_EXCEPTION();
+        callFrame[dst] = jsBoolean(result);
 
         vPC += 5;
         NEXT_INSTRUCTION();
@@ -2182,7 +1847,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(jsTypeStringForValue(callFrame, callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = JSValue(jsTypeStringForValue(callFrame, callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2196,8 +1861,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[src].jsValue(callFrame);
-        callFrame[dst] = jsBoolean(JSImmediate::isImmediate(v) ? v->isUndefined() : v->asCell()->structure()->typeInfo().masqueradesAsUndefined());
+        JSValue v = callFrame[src].jsValue();
+        callFrame[dst] = jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2211,7 +1876,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame)->isBoolean());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isBoolean());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2225,7 +1890,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame)->isNumber());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isNumber());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2239,7 +1904,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame)->isString());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isString());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2253,7 +1918,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(jsIsObjectType(callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = jsBoolean(jsIsObjectType(callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2267,7 +1932,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(jsIsFunctionType(callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = jsBoolean(jsIsFunctionType(callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2285,19 +1950,19 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int base = (++vPC)->u.operand;
 
-        JSValuePtr baseVal = callFrame[base].jsValue(callFrame);
-        if (isNotObject(callFrame, false, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
+        JSValue baseVal = callFrame[base].jsValue();
+        if (isInvalidParamForIn(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
             goto vm_throw;
 
         JSObject* baseObj = asObject(baseVal);
 
-        JSValuePtr propName = callFrame[property].jsValue(callFrame);
+        JSValue propName = callFrame[property].jsValue();
 
         uint32_t i;
-        if (propName->getUInt32(i))
+        if (propName.getUInt32(i))
             callFrame[dst] = jsBoolean(baseObj->hasProperty(callFrame, i));
         else {
-            Identifier property(callFrame, propName->toString(callFrame));
+            Identifier property(callFrame, propName.toString(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = jsBoolean(baseObj->hasProperty(callFrame, property));
         }
@@ -2348,18 +2013,17 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_global_var) {
-        /* get_global_var dst(r) globalObject(c) index(n) nop(n) nop(n)
+        /* get_global_var dst(r) globalObject(c) index(n)
 
            Gets the global var at global slot index and places it in register dst.
          */
-        int dst = vPC[1].u.operand;
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
+        int dst = (++vPC)->u.operand;
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = vPC[3].u.operand;
+        int index = (++vPC)->u.operand;
 
         callFrame[dst] = scope->registerAt(index);
-
-        vPC += OPCODE_LENGTH(op_resolve_global);
+        ++vPC;
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_global_var) {
@@ -2372,7 +2036,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int index = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
         
-        scope->registerAt(index) = JSValuePtr(callFrame[value].jsValue(callFrame));
+        scope->registerAt(index) = JSValue(callFrame[value].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }            
@@ -2420,7 +2084,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
-        scope->registerAt(index) = JSValuePtr(callFrame[value].jsValue(callFrame));
+        scope->registerAt(index) = JSValue(callFrame[value].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -2488,9 +2152,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
         CodeBlock* codeBlock = callFrame->codeBlock();
         Identifier& ident = codeBlock->identifier(property);
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         PropertySlot slot(baseValue);
-        JSValuePtr result = baseValue->get(callFrame, ident, slot);
+        JSValue result = baseValue.get(callFrame, ident, slot);
         CHECK_FOR_EXCEPTION();
 
         tryCacheGetByID(callFrame, codeBlock, vPC, baseValue, ident, slot);
@@ -2507,9 +2171,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
@@ -2520,7 +2184,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 int offset = vPC[5].u.operand;
 
                 ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
-                callFrame[dst] = JSValuePtr(baseObject->getDirectOffset(offset));
+                callFrame[dst] = JSValue(baseObject->getDirectOffset(offset));
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2538,14 +2202,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            reverts to op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
             if (LIKELY(baseCell->structure() == structure)) {
-                ASSERT(structure->prototypeForLookup(callFrame)->isObject());
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
                 Structure* prototypeStructure = vPC[5].u.structure;
 
@@ -2554,7 +2218,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                     int offset = vPC[6].u.operand;
 
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
-                    callFrame[dst] = JSValuePtr(protoObject->getDirectOffset(offset));
+                    callFrame[dst] = JSValue(protoObject->getDirectOffset(offset));
 
                     vPC += 8;
                     NEXT_INSTRUCTION();
@@ -2587,9 +2251,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            reverts to op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
@@ -2598,9 +2262,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 size_t count = vPC[6].u.operand;
                 RefPtr<Structure>* end = it + count;
 
-                JSObject* baseObject = asObject(baseCell);
-                while (1) {
-                    baseObject = asObject(baseObject->structure()->prototypeForLookup(callFrame));
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+
                     if (UNLIKELY(baseObject->structure() != (*it).get()))
                         break;
 
@@ -2609,11 +2273,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                         int offset = vPC[7].u.operand;
 
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
-                        callFrame[dst] = JSValuePtr(baseObject->getDirectOffset(offset));
+                        callFrame[dst] = JSValue(baseObject->getDirectOffset(offset));
 
                         vPC += 8;
                         NEXT_INSTRUCTION();
                     }
+
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
                 }
             }
         }
@@ -2632,9 +2299,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = vPC[3].u.operand;
 
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         PropertySlot slot(baseValue);
-        JSValuePtr result = baseValue->get(callFrame, ident, slot);
+        JSValue result = baseValue.get(callFrame, ident, slot);
         CHECK_FOR_EXCEPTION();
 
         callFrame[dst] = result;
@@ -2650,10 +2317,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        if (LIKELY(isJSArray(baseValue))) {
+        JSValue baseValue = callFrame[base].jsValue();
+        if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, asArray(baseValue)->length()));
+            callFrame[dst] = JSValue(jsNumber(callFrame, asArray(baseValue)->length()));
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2670,10 +2337,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        if (LIKELY(isJSString(baseValue))) {
+        JSValue baseValue = callFrame[base].jsValue();
+        if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, asString(baseValue)->value().size()));
+            callFrame[dst] = JSValue(jsNumber(callFrame, asString(baseValue)->value().size()));
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2696,10 +2363,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int value = vPC[3].u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         Identifier& ident = codeBlock->identifier(property);
         PutPropertySlot slot;
-        baseValue->put(callFrame, ident, callFrame[value].jsValue(callFrame), slot);
+        baseValue.put(callFrame, ident, callFrame[value].jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
         tryCachePutByID(callFrame, codeBlock, vPC, baseValue, slot);
@@ -2719,9 +2386,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            the register file.
          */
         int base = vPC[1].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* oldStructure = vPC[4].u.structure;
             Structure* newStructure = vPC[5].u.structure;
@@ -2732,8 +2399,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
                 RefPtr<Structure>* it = vPC[6].u.structureChain->head();
 
-                JSValuePtr proto = baseObject->structure()->prototypeForLookup(callFrame);
-                while (!proto->isNull()) {
+                JSValue proto = baseObject->structure()->prototypeForLookup(callFrame);
+                while (!proto.isNull()) {
                     if (UNLIKELY(asObject(proto)->structure() != (*it).get())) {
                         uncachePutByID(callFrame->codeBlock(), vPC);
                         NEXT_INSTRUCTION();
@@ -2747,7 +2414,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[7].u.operand;
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame[value].jsValue(callFrame));
+                baseObject->putDirectOffset(offset, callFrame[value].jsValue());
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2769,9 +2436,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            the register file.
         */
         int base = vPC[1].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
@@ -2782,7 +2449,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 unsigned offset = vPC[5].u.operand;
                 
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame[value].jsValue(callFrame));
+                baseObject->putDirectOffset(offset, callFrame[value].jsValue());
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2805,10 +2472,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = vPC[2].u.operand;
         int value = vPC[3].u.operand;
 
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         PutPropertySlot slot;
-        baseValue->put(callFrame, ident, callFrame[value].jsValue(callFrame), slot);
+        baseValue.put(callFrame, ident, callFrame[value].jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
         vPC += 8;
@@ -2826,9 +2493,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
 
-        JSObject* baseObj = callFrame[base].jsValue(callFrame)->toObject(callFrame);
+        JSObject* baseObj = callFrame[base].jsValue().toObject(callFrame);
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        JSValuePtr result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
+        JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
         ++vPC;
@@ -2846,29 +2513,28 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
         
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
+        JSValue subscript = callFrame[property].jsValue();
 
-        JSValuePtr result;
-        unsigned i;
+        JSValue result;
 
-        bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-        if (LIKELY(isUInt32)) {
-            if (isJSArray(baseValue)) {
+        if (LIKELY(subscript.isUInt32Fast())) {
+            uint32_t i = subscript.getUInt32Fast();
+            if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canGetIndex(i))
                     result = jsArray->getIndex(i);
                 else
                     result = jsArray->JSArray::get(callFrame, i);
-            } else if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
+            } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
                 result = asString(baseValue)->getIndex(&callFrame->globalData(), i);
-            else if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i))
-                result = asByteArray(baseValue)->getIndex(i);
+            else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i))
+                result = asByteArray(baseValue)->getIndex(callFrame, i);
             else
-                result = baseValue->get(callFrame, i);
+                result = baseValue.get(callFrame, i);
         } else {
-            Identifier property(callFrame, subscript->toString(callFrame));
-            result = baseValue->get(callFrame, property);
+            Identifier property(callFrame, subscript.toString(callFrame));
+            result = baseValue.get(callFrame, property);
         }
 
         CHECK_FOR_EXCEPTION();
@@ -2891,36 +2557,34 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
 
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
-
-        unsigned i;
+        JSValue baseValue = callFrame[base].jsValue();
+        JSValue subscript = callFrame[property].jsValue();
 
-        bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-        if (LIKELY(isUInt32)) {
-            if (isJSArray(baseValue)) {
+        if (LIKELY(subscript.isUInt32Fast())) {
+            uint32_t i = subscript.getUInt32Fast();
+            if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canSetIndex(i))
-                    jsArray->setIndex(i, callFrame[value].jsValue(callFrame));
+                    jsArray->setIndex(i, callFrame[value].jsValue());
                 else
-                    jsArray->JSArray::put(callFrame, i, callFrame[value].jsValue(callFrame));
-            } else if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+                    jsArray->JSArray::put(callFrame, i, callFrame[value].jsValue());
+            } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
                 JSByteArray* jsByteArray = asByteArray(baseValue);
                 double dValue = 0;
-                JSValuePtr jsValue = callFrame[value].jsValue(callFrame);
-                if (JSImmediate::isNumber(jsValue))
-                    jsByteArray->setIndex(i, JSImmediate::getTruncatedInt32(jsValue));
-                else if (fastIsNumber(jsValue, dValue))
+                JSValue jsValue = callFrame[value].jsValue();
+                if (jsValue.isInt32Fast())
+                    jsByteArray->setIndex(i, jsValue.getInt32Fast());
+                else if (jsValue.getNumber(dValue))
                     jsByteArray->setIndex(i, dValue);
                 else
-                    baseValue->put(callFrame, i, jsValue);
+                    baseValue.put(callFrame, i, jsValue);
             } else
-                baseValue->put(callFrame, i, callFrame[value].jsValue(callFrame));
+                baseValue.put(callFrame, i, callFrame[value].jsValue());
         } else {
-            Identifier property(callFrame, subscript->toString(callFrame));
+            Identifier property(callFrame, subscript.toString(callFrame));
             if (!globalData->exception) { // Don't put to an object if toString threw an exception.
                 PutPropertySlot slot;
-                baseValue->put(callFrame, property, callFrame[value].jsValue(callFrame), slot);
+                baseValue.put(callFrame, property, callFrame[value].jsValue(), slot);
             }
         }
 
@@ -2940,16 +2604,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
 
-        JSObject* baseObj = callFrame[base].jsValue(callFrame)->toObject(callFrame); // may throw
+        JSObject* baseObj = callFrame[base].jsValue().toObject(callFrame); // may throw
 
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
-        JSValuePtr result;
+        JSValue subscript = callFrame[property].jsValue();
+        JSValue result;
         uint32_t i;
-        if (subscript->getUInt32(i))
+        if (subscript.getUInt32(i))
             result = jsBoolean(baseObj->deleteProperty(callFrame, i));
         else {
             CHECK_FOR_EXCEPTION();
-            Identifier property(callFrame, subscript->toString(callFrame));
+            Identifier property(callFrame, subscript.toString(callFrame));
             CHECK_FOR_EXCEPTION();
             result = jsBoolean(baseObj->deleteProperty(callFrame, property));
         }
@@ -2975,7 +2639,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         unsigned property = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
 
-        callFrame[base].jsValue(callFrame)->put(callFrame, property, callFrame[value].jsValue(callFrame));
+        callFrame[base].jsValue().put(callFrame, property, callFrame[value].jsValue());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3022,7 +2686,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (callFrame[cond].jsValue(callFrame)->toBoolean(callFrame)) {
+        if (callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             CHECK_FOR_TIMEOUT();
             NEXT_INSTRUCTION();
@@ -3039,7 +2703,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (callFrame[cond].jsValue(callFrame)->toBoolean(callFrame)) {
+        if (callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3055,7 +2719,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (!callFrame[cond].jsValue(callFrame)->toBoolean(callFrame)) {
+        if (!callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3071,9 +2735,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int src = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        JSValuePtr srcValue = callFrame[src].jsValue(callFrame);
+        JSValue srcValue = callFrame[src].jsValue();
 
-        if (srcValue->isUndefinedOrNull() || (!JSImmediate::isImmediate(srcValue) && srcValue->asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (srcValue.isUndefinedOrNull() || (srcValue.isCell() && srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3089,9 +2753,27 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int src = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        JSValuePtr srcValue = callFrame[src].jsValue(callFrame);
+        JSValue srcValue = callFrame[src].jsValue();
 
-        if (!srcValue->isUndefinedOrNull() || (!JSImmediate::isImmediate(srcValue) && !srcValue->asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_jneq_ptr) {
+        /* jneq_ptr src(r) ptr(jsCell) target(offset)
+         
+           Jumps to offset target from the current instruction, if the value r is equal
+           to ptr, using pointer equality.
+         */
+        int src = (++vPC)->u.operand;
+        JSValue ptr = JSValue((++vPC)->u.jsCell);
+        int target = (++vPC)->u.operand;
+        JSValue srcValue = callFrame[src].jsValue();
+        if (srcValue != ptr) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3110,8 +2792,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
         
         bool result = jsLess(callFrame, src1, src2);
@@ -3137,8 +2819,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
         */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
         
         bool result = jsLessEq(callFrame, src1, src2);
@@ -3161,8 +2843,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            target from the current instruction, if and only if the 
            result of the comparison is false.
         */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
 
         bool result = jsLess(callFrame, src1, src2);
@@ -3176,6 +2858,29 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jnlesseq) {
+        /* jnlesseq src1(r) src2(r) target(offset)
+
+           Checks whether register src1 is less than or equal to
+           register src2, as with the ECMAScript '<=' operator,
+           and then jumps to offset target from the current instruction,
+           if and only if theresult of the comparison is false.
+        */
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        int target = (++vPC)->u.operand;
+
+        bool result = jsLessEq(callFrame, src1, src2);
+        CHECK_FOR_EXCEPTION();
+        
+        if (!result) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_switch_imm) {
         /* switch_imm tableIndex(n) defaultOffset(offset) scrutinee(r)
 
@@ -3187,12 +2892,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (!JSImmediate::isNumber(scrutinee))
-            vPC += defaultOffset;
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
+        if (scrutinee.isInt32Fast())
+            vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.getInt32Fast(), defaultOffset);
         else {
-            int32_t value = JSImmediate::getTruncatedInt32(scrutinee);
-            vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(value, defaultOffset);
+            double value;
+            int32_t intValue;
+            if (scrutinee.getNumber(value) && ((intValue = static_cast<int32_t>(value)) == value))
+                vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(intValue, defaultOffset);
+            else
+                vPC += defaultOffset;
         }
         NEXT_INSTRUCTION();
     }
@@ -3207,8 +2916,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (!scrutinee->isString())
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
+        if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
             UString::Rep* value = asString(scrutinee)->value().rep();
@@ -3230,8 +2939,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (!scrutinee->isString())
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
+        if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
             vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value().rep(), defaultOffset);
@@ -3286,15 +2995,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int argCount = vPC[3].u.operand;
         int registerOffset = vPC[4].u.operand;
 
-        JSValuePtr funcVal = callFrame[func].jsValue(callFrame);
+        JSValue funcVal = callFrame[func].jsValue();
 
         Register* newCallFrame = callFrame->registers() + registerOffset;
         Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
-        JSValuePtr thisValue = argv[0].jsValue(callFrame);
+        JSValue thisValue = argv[0].jsValue();
         JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-            JSValuePtr result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
+            JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
             if (exceptionValue)
                 goto vm_throw;
             callFrame[dst] = result;
@@ -3323,10 +3032,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int argCount = vPC[3].u.operand;
         int registerOffset = vPC[4].u.operand;
 
-        JSValuePtr v = callFrame[func].jsValue(callFrame);
+        JSValue v = callFrame[func].jsValue();
 
         CallData callData;
-        CallType callType = v->getCallData(callData);
+        CallType callType = v.getCallData(callData);
 
         if (callType == CallTypeJS) {
             ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
@@ -3361,18 +3070,18 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             ArgList args(thisRegister + 1, argCount - 1);
 
             // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
-            JSValuePtr thisValue = thisRegister->jsValue(callFrame);
+            JSValue thisValue = thisRegister->jsValue();
             if (thisValue == jsNull())
                 thisValue = callFrame->globalThisValue();
 
-            JSValuePtr returnValue;
+            JSValue returnValue;
             {
                 SamplingTool::HostCallRecord callRecord(m_sampler);
                 returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
             }
             CHECK_FOR_EXCEPTION();
 
-            callFrame[dst] = JSValuePtr(returnValue);
+            callFrame[dst] = JSValue(returnValue);
 
             vPC += 5;
             NEXT_INSTRUCTION();
@@ -3383,6 +3092,160 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         exceptionValue = createNotAFunctionError(callFrame, v, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
         goto vm_throw;
     }
+    DEFINE_OPCODE(op_load_varargs) {
+        int argCountDst = (++vPC)->u.operand;
+        int argsOffset = (++vPC)->u.operand;
+        
+        JSValue arguments = callFrame[argsOffset].jsValue();
+        uint32_t argCount = 0;
+        if (!arguments) {
+            argCount = (uint32_t)(callFrame[RegisterFile::ArgumentCount].u.i) - 1;
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                exceptionValue = createStackOverflowError(callFrame);
+                goto vm_throw;
+            }
+            uint32_t expectedParams = asFunction(callFrame[RegisterFile::Callee].jsValue())->body()->parameterCount();
+            uint32_t inplaceArgs = min(argCount, expectedParams);
+            uint32_t i = 0;
+            Register* argStore = callFrame->registers() + argsOffset;
+
+            // First step is to copy the "expected" parameters from their normal location relative to the callframe
+            for (; i < inplaceArgs; i++)
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams];
+            // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
+            for (; i < argCount; i++)
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1];
+        } else if (!arguments.isUndefinedOrNull()) {
+            if (!arguments.isObject()) {
+                exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+                goto vm_throw;
+            }
+            if (asObject(arguments)->classInfo() == &Arguments::info) {
+                Arguments* args = asArguments(arguments);
+                argCount = args->numProvidedArguments(callFrame);
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                args->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+            } else if (isJSArray(&callFrame->globalData(), arguments)) {
+                JSArray* array = asArray(arguments);
+                argCount = array->length();
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+            } else if (asObject(arguments)->inherits(&JSArray::info)) {
+                JSObject* argObject = asObject(arguments);
+                argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                Register* argsBuffer = callFrame->registers() + argsOffset;
+                for (unsigned i = 0; i < argCount; ++i) {
+                    argsBuffer[i] = asObject(arguments)->get(callFrame, i);
+                    CHECK_FOR_EXCEPTION();
+                }
+            } else {
+                if (!arguments.isObject()) {
+                    exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+                    goto vm_throw;
+                }
+            }
+        }
+        CHECK_FOR_EXCEPTION();
+        callFrame[argCountDst] = argCount + 1;
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_call_varargs) {
+        /* call_varargs dst(r) func(r) argCountReg(r) baseRegisterOffset(n)
+         
+         Perform a function call with a dynamic set of arguments.
+         
+         registerOffset is the distance the callFrame pointer should move
+         before the VM initializes the new call frame's header, excluding
+         space for arguments.
+         
+         dst is where op_ret should store its result.
+         */
+        
+        int dst = vPC[1].u.operand;
+        int func = vPC[2].u.operand;
+        int argCountReg = vPC[3].u.operand;
+        int registerOffset = vPC[4].u.operand;
+        
+        JSValue v = callFrame[func].jsValue();
+        int argCount = callFrame[argCountReg].i();
+        registerOffset += argCount;
+        CallData callData;
+        CallType callType = v.getCallData(callData);
+        
+        if (callType == CallTypeJS) {
+            ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
+            FunctionBodyNode* functionBodyNode = callData.js.functionBody;
+            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            
+            CallFrame* previousCallFrame = callFrame;
+            
+            callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
+            if (UNLIKELY(!callFrame)) {
+                callFrame = previousCallFrame;
+                exceptionValue = createStackOverflowError(callFrame);
+                goto vm_throw;
+            }
+            
+            callFrame->init(newCodeBlock, vPC + 5, callDataScopeChain, previousCallFrame, dst, argCount, asFunction(v));
+            vPC = newCodeBlock->instructions().begin();
+            
+#if ENABLE(OPCODE_STATS)
+            OpcodeStats::resetLastInstruction();
+#endif
+            
+            NEXT_INSTRUCTION();
+        }
+        
+        if (callType == CallTypeHost) {
+            ScopeChainNode* scopeChain = callFrame->scopeChain();
+            CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
+            newCallFrame->init(0, vPC + 5, scopeChain, callFrame, dst, argCount, 0);
+            
+            Register* thisRegister = newCallFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
+            ArgList args(thisRegister + 1, argCount - 1);
+            
+            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
+            JSValue thisValue = thisRegister->jsValue();
+            if (thisValue == jsNull())
+                thisValue = callFrame->globalThisValue();
+            
+            JSValue returnValue;
+            {
+                SamplingTool::HostCallRecord callRecord(m_sampler);
+                returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
+            }
+            CHECK_FOR_EXCEPTION();
+            
+            callFrame[dst] = JSValue(returnValue);
+            
+            vPC += 5;
+            NEXT_INSTRUCTION();
+        }
+        
+        ASSERT(callType == CallTypeNone);
+        
+        exceptionValue = createNotAFunctionError(callFrame, v, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+        goto vm_throw;
+    }
     DEFINE_OPCODE(op_tear_off_activation) {
         /* tear_off_activation activation(r)
 
@@ -3399,7 +3262,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int src = (++vPC)->u.operand;
         ASSERT(callFrame->codeBlock()->needsFullScopeChain());
 
-        asActivation(callFrame[src].getJSValue())->copyRegisters(callFrame->optionalCalleeArguments());
+        asActivation(callFrame[src].jsValue())->copyRegisters(callFrame->optionalCalleeArguments());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3418,8 +3281,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         ASSERT(callFrame->codeBlock()->usesArguments() && !callFrame->codeBlock()->needsFullScopeChain());
-
-        callFrame->optionalCalleeArguments()->copyRegisters();
+        if (callFrame->optionalCalleeArguments())
+            callFrame->optionalCalleeArguments()->copyRegisters();
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3439,7 +3302,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         if (callFrame->codeBlock()->needsFullScopeChain())
             callFrame->scopeChain()->deref();
 
-        JSValuePtr returnValue = callFrame[result].jsValue(callFrame);
+        JSValue returnValue = callFrame[result].jsValue();
 
         vPC = callFrame->returnPC();
         int dst = callFrame->returnValueRegister();
@@ -3448,7 +3311,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         if (callFrame->hasHostCallFrameFlag())
             return returnValue;
 
-        callFrame[dst] = JSValuePtr(returnValue);
+        callFrame[dst] = JSValue(returnValue);
 
         NEXT_INSTRUCTION();
     }
@@ -3518,28 +3381,40 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int thisRegister = (++vPC)->u.operand;
-        JSValuePtr thisVal = callFrame[thisRegister].getJSValue();
-        if (thisVal->needsThisConversion())
-            callFrame[thisRegister] = JSValuePtr(thisVal->toThisObject(callFrame));
+        JSValue thisVal = callFrame[thisRegister].jsValue();
+        if (thisVal.needsThisConversion())
+            callFrame[thisRegister] = JSValue(thisVal.toThisObject(callFrame));
 
         ++vPC;
         NEXT_INSTRUCTION();
     }
-    DEFINE_OPCODE(op_create_arguments) {
+    DEFINE_OPCODE(op_init_arguments) {
         /* create_arguments
 
-           Creates the 'arguments' object and places it in both the
-           'arguments' call frame slot and the local 'arguments'
-           register.
+           Initialises the arguments object reference to null to ensure
+           we can correctly detect that we need to create it later (or
+           avoid creating it altogether).
 
            This opcode should only be used at the beginning of a code
            block.
-        */
+         */
+        callFrame[RegisterFile::ArgumentsRegister] = JSValue();
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_create_arguments) {
+        /* create_arguments
 
-        Arguments* arguments = new (globalData) Arguments(callFrame);
-        callFrame->setCalleeArguments(arguments);
-        callFrame[RegisterFile::ArgumentsRegister] = arguments;
+           Creates the 'arguments' object and places it in both the
+           'arguments' call frame slot and the local 'arguments'
+           register, if it has not already been initialised.
+         */
         
+         if (!callFrame->optionalCalleeArguments()) {
+             Arguments* arguments = new (globalData) Arguments(callFrame);
+             callFrame->setCalleeArguments(arguments);
+             callFrame[RegisterFile::ArgumentsRegister] = arguments;
+         }
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -3565,10 +3440,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int proto = vPC[5].u.operand;
         int thisRegister = vPC[6].u.operand;
 
-        JSValuePtr v = callFrame[func].jsValue(callFrame);
+        JSValue v = callFrame[func].jsValue();
 
         ConstructData constructData;
-        ConstructType constructType = v->getConstructData(constructData);
+        ConstructType constructType = v.getConstructData(constructData);
 
         if (constructType == ConstructTypeJS) {
             ScopeChainNode* callDataScopeChain = constructData.js.scopeChain;
@@ -3576,14 +3451,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
 
             Structure* structure;
-            JSValuePtr prototype = callFrame[proto].jsValue(callFrame);
-            if (prototype->isObject())
+            JSValue prototype = callFrame[proto].jsValue();
+            if (prototype.isObject())
                 structure = asObject(prototype)->inheritorID();
             else
                 structure = callDataScopeChain->globalObject()->emptyObjectStructure();
             JSObject* newObject = new (globalData) JSObject(structure);
 
-            callFrame[thisRegister] = JSValuePtr(newObject); // "this" value
+            callFrame[thisRegister] = JSValue(newObject); // "this" value
 
             CallFrame* previousCallFrame = callFrame;
 
@@ -3611,13 +3486,13 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
             newCallFrame->init(0, vPC + 7, scopeChain, callFrame, dst, argCount, 0);
 
-            JSValuePtr returnValue;
+            JSValue returnValue;
             {
                 SamplingTool::HostCallRecord callRecord(m_sampler);
                 returnValue = constructData.native.function(newCallFrame, asObject(v), args);
             }
             CHECK_FOR_EXCEPTION();
-            callFrame[dst] = JSValuePtr(returnValue);
+            callFrame[dst] = JSValue(returnValue);
 
             vPC += 7;
             NEXT_INSTRUCTION();
@@ -3635,8 +3510,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            the object in register override to register dst.
         */
 
-        int dst = vPC[1].u.operand;;
-        if (LIKELY(callFrame[dst].jsValue(callFrame)->isObject())) {
+        int dst = vPC[1].u.operand;
+        if (LIKELY(callFrame[dst].jsValue().isObject())) {
             vPC += 3;
             NEXT_INSTRUCTION();
         }
@@ -3647,6 +3522,25 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         vPC += 3;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_strcat) {
+        int dst = (++vPC)->u.operand;
+        int src = (++vPC)->u.operand;
+        int count = (++vPC)->u.operand;
+
+        callFrame[dst] = concatenateStrings(callFrame, &callFrame->registers()[src], count);
+        ++vPC;
+
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_to_primitive) {
+        int dst = (++vPC)->u.operand;
+        int src = (++vPC)->u.operand;
+
+        callFrame[dst] = callFrame[src].jsValue().toPrimitive(callFrame);
+        ++vPC;
+
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_push_scope) {
         /* push_scope scope(r)
 
@@ -3655,11 +3549,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            are replaced by the result of toObject conversion of the scope.
         */
         int scope = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[scope].jsValue(callFrame);
-        JSObject* o = v->toObject(callFrame);
+        JSValue v = callFrame[scope].jsValue();
+        JSObject* o = v.toObject(callFrame);
         CHECK_FOR_EXCEPTION();
 
-        callFrame[scope] = JSValuePtr(o);
+        callFrame[scope] = JSValue(o);
         callFrame->setScopeChain(callFrame->scopeChain()->push(o));
 
         ++vPC;
@@ -3686,7 +3580,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int dst = (++vPC)->u.operand;
         int base = (++vPC)->u.operand;
 
-        callFrame[dst] = JSPropertyNameIterator::create(callFrame, callFrame[base].jsValue(callFrame));
+        callFrame[dst] = JSPropertyNameIterator::create(callFrame, callFrame[base].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -3704,9 +3598,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int target = (++vPC)->u.operand;
 
         JSPropertyNameIterator* it = callFrame[iter].propertyNameIterator();
-        if (JSValuePtr temp = it->next(callFrame)) {
+        if (JSValue temp = it->next(callFrame)) {
             CHECK_FOR_TIMEOUT();
-            callFrame[dst] = JSValuePtr(temp);
+            callFrame[dst] = JSValue(temp);
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3755,7 +3649,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
     DEFINE_OPCODE(op_catch) {
         /* catch ex(r)
 
-           Retrieves the VMs current exception and puts it in register
+           Retrieves the VM's current exception and puts it in register
            ex. This is only valid after an exception has been raised,
            and usually forms the beginning of an exception handler.
         */
@@ -3763,7 +3657,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         ASSERT(!globalData->exception);
         int ex = (++vPC)->u.operand;
         callFrame[ex] = exceptionValue;
-        exceptionValue = noValue();
+        exceptionValue = JSValue();
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3780,7 +3674,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int ex = (++vPC)->u.operand;
-        exceptionValue = callFrame[ex].jsValue(callFrame);
+        exceptionValue = callFrame[ex].jsValue();
 
         handler = throwException(callFrame, exceptionValue, vPC - callFrame->codeBlock()->instructions().begin(), true);
         if (!handler) {
@@ -3798,7 +3692,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(callFrame->codeBlock()->unexpectedConstant(src));
+        callFrame[dst] = JSValue(callFrame->codeBlock()->unexpectedConstant(src));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3816,7 +3710,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int message = (++vPC)->u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        callFrame[dst] = JSValuePtr(Error::create(callFrame, (ErrorType)type, codeBlock->unexpectedConstant(message)->toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
+        callFrame[dst] = JSValue(Error::create(callFrame, (ErrorType)type, codeBlock->unexpectedConstant(message).toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3834,7 +3728,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             scopeChain->deref();
         }
         int result = (++vPC)->u.operand;
-        return callFrame[result].jsValue(callFrame);
+        return callFrame[result].jsValue();
     }
     DEFINE_OPCODE(op_put_getter) {
         /* put_getter base(r) property(id) function(r)
@@ -3851,11 +3745,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int function = (++vPC)->u.operand;
 
-        ASSERT(callFrame[base].jsValue(callFrame)->isObject());
-        JSObject* baseObj = asObject(callFrame[base].jsValue(callFrame));
+        ASSERT(callFrame[base].jsValue().isObject());
+        JSObject* baseObj = asObject(callFrame[base].jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        ASSERT(callFrame[function].jsValue(callFrame)->isObject());
-        baseObj->defineGetter(callFrame, ident, asObject(callFrame[function].jsValue(callFrame)));
+        ASSERT(callFrame[function].jsValue().isObject());
+        baseObj->defineGetter(callFrame, ident, asObject(callFrame[function].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3875,15 +3769,19 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int function = (++vPC)->u.operand;
 
-        ASSERT(callFrame[base].jsValue(callFrame)->isObject());
-        JSObject* baseObj = asObject(callFrame[base].jsValue(callFrame));
+        ASSERT(callFrame[base].jsValue().isObject());
+        JSObject* baseObj = asObject(callFrame[base].jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        ASSERT(callFrame[function].jsValue(callFrame)->isObject());
-        baseObj->defineSetter(callFrame, ident, asObject(callFrame[function].jsValue(callFrame)));
+        ASSERT(callFrame[function].jsValue().isObject());
+        baseObj->defineSetter(callFrame, ident, asObject(callFrame[function].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_method_check) {
+        vPC++;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jsr) {
         /* jsr retAddrDst(r) target(offset)
 
@@ -3932,7 +3830,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int function = vPC[1].u.operand;
 
         if (*enabledProfilerReference)
-            (*enabledProfilerReference)->willExecute(callFrame, callFrame[function].jsValue(callFrame));
+            (*enabledProfilerReference)->willExecute(callFrame, callFrame[function].jsValue());
 
         vPC += 2;
         NEXT_INSTRUCTION();
@@ -3946,13 +3844,13 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int function = vPC[1].u.operand;
 
         if (*enabledProfilerReference)
-            (*enabledProfilerReference)->didExecute(callFrame, callFrame[function].jsValue(callFrame));
+            (*enabledProfilerReference)->didExecute(callFrame, callFrame[function].jsValue());
 
         vPC += 2;
         NEXT_INSTRUCTION();
     }
     vm_throw: {
-        globalData->exception = noValue();
+        globalData->exception = JSValue();
         if (!tickCount) {
             // The exceptionValue is a lie! (GCC produces bad code for reasons I 
             // cannot fathom if we don't assign to the exceptionValue before branching)
@@ -3971,13 +3869,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 #if !HAVE(COMPUTED_GOTO)
     } // iterator loop ends
 #endif
+#endif // USE(INTERPRETER)
     #undef NEXT_INSTRUCTION
     #undef DEFINE_OPCODE
     #undef CHECK_FOR_EXCEPTION
     #undef CHECK_FOR_TIMEOUT
 }
 
-JSValuePtr Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* function) const
+JSValue Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrame(callFrame, function);
     if (!functionCallFrame)
@@ -3988,7 +3887,12 @@ JSValuePtr Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* func
         ASSERT(codeBlock->codeType() == FunctionCode);
         SymbolTable& symbolTable = codeBlock->symbolTable();
         int argumentsIndex = symbolTable.get(functionCallFrame->propertyNames().arguments.ustring().rep()).getIndex();
-        return functionCallFrame[argumentsIndex].jsValue(callFrame);
+        if (!functionCallFrame[argumentsIndex].arguments()) {
+            Arguments* arguments = new (callFrame) Arguments(functionCallFrame);
+            functionCallFrame->setCalleeArguments(arguments);
+            functionCallFrame[RegisterFile::ArgumentsRegister] = arguments;
+        }
+        return functionCallFrame[argumentsIndex].jsValue();
     }
 
     Arguments* arguments = functionCallFrame->optionalCalleeArguments();
@@ -4001,7 +3905,7 @@ JSValuePtr Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* func
     return arguments;
 }
 
-JSValuePtr Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* function) const
+JSValue Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrame(callFrame, function);
     if (!functionCallFrame)
@@ -4011,16 +3915,16 @@ JSValuePtr Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* f
     if (callerFrame->hasHostCallFrameFlag())
         return jsNull();
 
-    JSValuePtr caller = callerFrame->callee();
+    JSValue caller = callerFrame->callee();
     if (!caller)
         return jsNull();
 
     return caller;
 }
 
-void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValuePtr& function) const
+void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const
 {
-    function = noValue();
+    function = JSValue();
     lineNumber = -1;
     sourceURL = UString();
 
@@ -4032,7 +3936,7 @@ void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intp
     if (!callerCodeBlock)
         return;
 
-    unsigned bytecodeOffset = bytecodeOffsetForPC(callerCodeBlock, callFrame->returnPC());
+    unsigned bytecodeOffset = bytecodeOffsetForPC(callerFrame, callerCodeBlock, callFrame->returnPC());
     lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(callerFrame, bytecodeOffset - 1);
     sourceID = callerCodeBlock->ownerNode()->sourceID();
     sourceURL = callerCodeBlock->ownerNode()->sourceURL();
@@ -4048,2061 +3952,4 @@ CallFrame* Interpreter::findFunctionCallFrame(CallFrame* callFrame, InternalFunc
     return 0;
 }
 
-#if ENABLE(JIT)
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-NEVER_INLINE void Interpreter::tryCTICachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const PutPropertySlot& slot)
-{
-    // The interpreter checks for recursion here; I do not believe this can occur in CTI.
-
-    if (JSImmediate::isImmediate(baseValue))
-        return;
-
-    // Uncacheable: give up.
-    if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-    
-    JSCell* baseCell = asCell(baseValue);
-    Structure* structure = baseCell->structure();
-
-    if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-
-    // If baseCell != base, then baseCell must be a proxy for another object.
-    if (baseCell != slot.base()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
-    // Cache hit: Specialize instruction and ref Structures.
-
-    // Structure transition, cache transition info
-    if (slot.type() == PutPropertySlot::NewProperty) {
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain) {
-            chain = cachePrototypeChain(callFrame, structure);
-            if (!chain) {
-                // This happens if someone has manually inserted null into the prototype chain 
-                stubInfo->opcodeID = op_put_by_id_generic;
-                return;
-            }
-        }
-        stubInfo->initPutByIdTransition(structure->previousID(), structure, chain);
-        JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), chain, returnAddress);
-        return;
-    }
-    
-    stubInfo->initPutByIdReplace(structure);
-
-#if USE(CTI_REPATCH_PIC)
-    UNUSED_PARAM(callFrame);
-    JIT::patchPutByIdReplace(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-    JIT::compilePutByIdReplace(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
-}
-
-NEVER_INLINE void Interpreter::tryCTICacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot& slot)
-{
-    // FIXME: Write a test that proves we need to check for recursion here just
-    // like the interpreter does, then add a check for recursion.
-
-    // FIXME: Cache property access for immediates.
-    if (JSImmediate::isImmediate(baseValue)) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    if (isJSArray(baseValue) && propertyName == callFrame->propertyNames().length) {
-#if USE(CTI_REPATCH_PIC)
-        JIT::compilePatchGetArrayLength(callFrame->scopeChain()->globalData, codeBlock, returnAddress);
-#else
-        ctiPatchCallByReturnAddress(returnAddress, m_ctiArrayLengthTrampoline);
-#endif
-        return;
-    }
-    if (isJSString(baseValue) && propertyName == callFrame->propertyNames().length) {
-        // The tradeoff of compiling an patched inline string length access routine does not seem
-        // to pay off, so we currently only do this for arrays.
-        ctiPatchCallByReturnAddress(returnAddress, m_ctiStringLengthTrampoline);
-        return;
-    }
-
-    // Uncacheable: give up.
-    if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    JSCell* baseCell = asCell(baseValue);
-    Structure* structure = baseCell->structure();
-
-    if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    // In the interpreter the last structure is trapped here; in CTI we use the
-    // *_second method to achieve a similar (but not quite the same) effect.
-
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
-    // Cache hit: Specialize instruction and ref Structures.
-
-    if (slot.slotBase() == baseValue) {
-        // set this up, so derefStructures can do it's job.
-        stubInfo->initGetByIdSelf(structure);
-        
-#if USE(CTI_REPATCH_PIC)
-        JIT::patchGetByIdSelf(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-        JIT::compileGetByIdSelf(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
-        return;
-    }
-
-    if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-        ASSERT(slot.slotBase()->isObject());
-
-        JSObject* slotBaseObject = asObject(slot.slotBase());
-
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(slotBaseObject->structure());
-            slotBaseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
-        
-        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
-
-        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
-        return;
-    }
-
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
-    if (!count) {
-        stubInfo->opcodeID = op_get_by_id_generic;
-        return;
-    }
-
-    StructureChain* chain = structure->cachedPrototypeChain();
-    if (!chain)
-        chain = cachePrototypeChain(callFrame, structure);
-    ASSERT(chain);
-
-    stubInfo->initGetByIdChain(structure, chain);
-
-    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, chain, count, slot.cachedOffset(), returnAddress);
-}
-
-#endif
-
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-#define SETUP_VA_LISTL_ARGS va_list vl_args; va_start(vl_args, args)
-#else // JIT_STUB_ARGUMENT_REGISTER or JIT_STUB_ARGUMENT_STACK
-#define SETUP_VA_LISTL_ARGS
-#endif
-
-#ifndef NDEBUG
-
-extern "C" {
-
-static void jscGeneratedNativeCode() 
-{
-    // When executing a CTI function (which might do an allocation), we hack the return address
-    // to pretend to be executing this function, to keep stack logging tools from blowing out
-    // memory.
-}
-
-}
-
-struct StackHack {
-    ALWAYS_INLINE StackHack(void** location) 
-    { 
-        returnAddressLocation = location;
-        savedReturnAddress = *returnAddressLocation;
-        ctiSetReturnAddress(returnAddressLocation, reinterpret_cast<void*>(jscGeneratedNativeCode));
-    }
-    ALWAYS_INLINE ~StackHack() 
-    { 
-        ctiSetReturnAddress(returnAddressLocation, savedReturnAddress);
-    }
-
-    void** returnAddressLocation;
-    void* savedReturnAddress;
-};
-
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS; StackHack stackHack(&STUB_RETURN_ADDRESS_SLOT)
-#define STUB_SET_RETURN_ADDRESS(address) stackHack.savedReturnAddress = address
-#define STUB_RETURN_ADDRESS stackHack.savedReturnAddress
-
-#else
-
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS
-#define STUB_SET_RETURN_ADDRESS(address) ctiSetReturnAddress(&STUB_RETURN_ADDRESS_SLOT, address);
-#define STUB_RETURN_ADDRESS STUB_RETURN_ADDRESS_SLOT
-
-#endif
-
-// The reason this is not inlined is to avoid having to do a PIC branch
-// to get the address of the ctiVMThrowTrampoline function. It's also
-// good to keep the code size down by leaving as much of the exception
-// handling code out of line as possible.
-static NEVER_INLINE void returnToThrowTrampoline(JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
-{
-    ASSERT(globalData->exception);
-    globalData->exceptionLocation = exceptionLocation;
-    ctiSetReturnAddress(&returnAddressSlot, reinterpret_cast<void*>(ctiVMThrowTrampoline));
-}
-
-static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
-{
-    globalData->exception = createStackOverflowError(callFrame);
-    returnToThrowTrampoline(globalData, exceptionLocation, returnAddressSlot);
-}
-
-#define VM_THROW_EXCEPTION() \
-    do { \
-        VM_THROW_EXCEPTION_AT_END(); \
-        return 0; \
-    } while (0)
-#define VM_THROW_EXCEPTION_2() \
-    do { \
-        VM_THROW_EXCEPTION_AT_END(); \
-        RETURN_PAIR(0, 0); \
-    } while (0)
-#define VM_THROW_EXCEPTION_AT_END() \
-    returnToThrowTrampoline(ARG_globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
-
-#define CHECK_FOR_EXCEPTION() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
-            VM_THROW_EXCEPTION(); \
-    } while (0)
-#define CHECK_FOR_EXCEPTION_AT_END() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
-            VM_THROW_EXCEPTION_AT_END(); \
-    } while (0)
-#define CHECK_FOR_EXCEPTION_VOID() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) { \
-            VM_THROW_EXCEPTION_AT_END(); \
-            return; \
-        } \
-    } while (0)
-
-JSObject* Interpreter::cti_op_convert_this(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v1 = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSObject* result = v1->toThisObject(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-void Interpreter::cti_op_end(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ScopeChainNode* scopeChain = ARG_callFrame->scopeChain();
-    ASSERT(scopeChain->refCount > 1);
-    scopeChain->deref();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_add(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v1 = ARG_src1;
-    JSValuePtr v2 = ARG_src2;
-
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = fastIsNumber(v2, right);
-    if (rightIsNumber && fastIsNumber(v1, left))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left + right));
-    
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool leftIsString = v1->isString();
-    if (leftIsString && v2->isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
-    }
-
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = JSImmediate::isImmediate(v2) ?
-            concatenate(asString(v1)->value().rep(), JSImmediate::getTruncatedInt32(v2)) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
-    }
-
-    // All other cases are pretty uncommon
-    JSValuePtr result = jsAddSlowCase(callFrame, v1, v2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_pre_inc(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v->toNumber(callFrame) + 1);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_timeout_check(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    if (interpreter->checkTimeout(ARG_callFrame->dynamicGlobalObject())) {
-        ARG_globalData->exception = createInterruptedExecutionException(ARG_globalData);
-        VM_THROW_EXCEPTION_AT_END();
-    }
-    
-    return interpreter->m_ticksUntilNextTimeoutCheck;
-}
-
-void Interpreter::cti_register_file_check(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    if (LIKELY(ARG_registerFile->grow(ARG_callFrame + ARG_callFrame->codeBlock()->m_numCalleeRegisters)))
-        return;
-
-    // Rewind to the previous call frame because op_call already optimistically
-    // moved the call frame forward.
-    CallFrame* oldCallFrame = ARG_callFrame->callerFrame();
-    ARG_setCallFrame(oldCallFrame);
-    throwStackOverflowError(oldCallFrame, ARG_globalData, oldCallFrame->returnPC(), STUB_RETURN_ADDRESS);
-}
-
-int Interpreter::cti_op_loop_if_less(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-int Interpreter::cti_op_loop_if_lesseq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLessEq(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSObject* Interpreter::cti_op_new_object(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return constructEmptyObject(ARG_callFrame);
-}
-
-void Interpreter::cti_op_put_by_id_generic(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    PutPropertySlot slot;
-    ARG_src1->put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_generic(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-void Interpreter::cti_op_put_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    PutPropertySlot slot;
-    ARG_src1->put(callFrame, ident, ARG_src3, slot);
-
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_id_second(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    PutPropertySlot slot;
-    ARG_src1->put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
-    ARG_globalData->interpreter->tryCTICachePutByID(ARG_callFrame, ARG_callFrame->codeBlock(), STUB_RETURN_ADDRESS, ARG_src1, slot);
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_id_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    PutPropertySlot slot;
-    ARG_src1->put(callFrame, ident, ARG_src3, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_second(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    ARG_globalData->interpreter->tryCTICacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_self_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    CHECK_FOR_EXCEPTION();
-
-    if (!JSImmediate::isImmediate(baseValue)
-        && slot.isCacheable()
-        && !asCell(baseValue)->structure()->isDictionary()
-        && slot.slotBase() == baseValue) {
-
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-
-        ASSERT(slot.slotBase()->isObject());
-
-        PolymorphicAccessStructureList* polymorphicStructureList;
-        int listIndex = 1;
-
-        if (stubInfo->opcodeID == op_get_by_id_self) {
-            ASSERT(!stubInfo->stubRoutine);
-            polymorphicStructureList = new PolymorphicAccessStructureList(0, stubInfo->u.getByIdSelf.baseObjectStructure);
-            stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
-        } else {
-            polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
-            listIndex = stubInfo->u.getByIdSelfList.listSize;
-            stubInfo->u.getByIdSelfList.listSize++;
-        }
-
-        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-    } else {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-    }
-    return JSValuePtr::encode(result);
-}
-
-static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
-{
-    PolymorphicAccessStructureList* prototypeStructureList = 0;
-    listIndex = 1;
-
-    switch (stubInfo->opcodeID) {
-    case op_get_by_id_proto:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
-        stubInfo->stubRoutine = 0;
-        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
-        break;
-    case op_get_by_id_chain:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
-        stubInfo->stubRoutine = 0;
-        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
-        break;
-    case op_get_by_id_proto_list:
-        prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
-        listIndex = stubInfo->u.getByIdProtoList.listSize;
-        stubInfo->u.getByIdProtoList.listSize++;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-    
-    ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE);
-    return prototypeStructureList;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_list(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION();
-
-    if (JSImmediate::isImmediate(baseValue) || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-        return JSValuePtr::encode(result);
-    }
-
-    Structure* structure = asCell(baseValue)->structure();
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-
-    ASSERT(slot.slotBase()->isObject());
-    JSObject* slotBaseObject = asObject(slot.slotBase());
-
-    if (slot.slotBase() == baseValue)
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-    else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(slotBaseObject->structure());
-            slotBaseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
-
-        int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
-
-        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain)
-            chain = cachePrototypeChain(callFrame, structure);
-        ASSERT(chain);
-
-        int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
-
-        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, chain, count, slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
-    } else
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_list_full(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_array_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_string_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-#endif
-
-JSValueEncodedAsPointer* Interpreter::cti_op_instanceof(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr value = ARG_src1;
-    JSValuePtr baseVal = ARG_src2;
-    JSValuePtr proto = ARG_src3;
-
-    // at least one of these checks must have failed to get to the slow case
-    ASSERT(JSImmediate::isAnyImmediate(value, baseVal, proto) 
-           || !value->isObject() || !baseVal->isObject() || !proto->isObject() 
-           || (asObject(baseVal)->structure()->typeInfo().flags() & (ImplementsHasInstance | OverridesHasInstance)) != ImplementsHasInstance);
-
-    if (!baseVal->isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "instanceof", baseVal, vPCIndex, codeBlock);
-        VM_THROW_EXCEPTION();
-    }
-
-    if (!asObject(baseVal)->structure()->typeInfo().implementsHasInstance())
-        return JSValuePtr::encode(jsBoolean(false));
-
-    if (!proto->isObject()) {
-        throwError(callFrame, TypeError, "instanceof called on an object with an invalid prototype property.");
-        VM_THROW_EXCEPTION();
-    }
-        
-    if (!value->isObject())
-        return JSValuePtr::encode(jsBoolean(false));
-
-    JSValuePtr result = jsBoolean(asObject(baseVal)->hasInstance(callFrame, value, proto));
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_del_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    
-    JSObject* baseObj = ARG_src1->toObject(callFrame);
-
-    JSValuePtr result = jsBoolean(baseObj->deleteProperty(callFrame, *ARG_id2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_mul(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left * right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toNumber(callFrame) * src2->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSObject* Interpreter::cti_op_new_func(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return ARG_func1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
-}
-
-void* Interpreter::cti_op_call_JSFunction(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-#ifndef NDEBUG
-    CallData callData;
-    ASSERT(ARG_src1->getCallData(callData) == CallTypeJS);
-#endif
-
-    ScopeChainNode* callDataScopeChain = asFunction(ARG_src1)->m_scopeChain.node();
-    CodeBlock* newCodeBlock = &asFunction(ARG_src1)->body()->bytecode(callDataScopeChain);
-
-    if (!newCodeBlock->jitCode())
-        JIT::compile(ARG_globalData, newCodeBlock);
-
-    return newCodeBlock;
-}
-
-VoidPtrPair Interpreter::cti_op_call_arityCheck(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* newCodeBlock = ARG_codeBlock4;
-    int argCount = ARG_int3;
-
-    ASSERT(argCount != newCodeBlock->m_numParameters);
-
-    CallFrame* oldCallFrame = callFrame->callerFrame();
-
-    if (argCount > newCodeBlock->m_numParameters) {
-        size_t numParameters = newCodeBlock->m_numParameters;
-        Register* r = callFrame->registers() + numParameters;
-
-        Register* argv = r - RegisterFile::CallFrameHeaderSize - numParameters - argCount;
-        for (size_t i = 0; i < numParameters; ++i)
-            argv[i + argCount] = argv[i];
-
-        callFrame = CallFrame::create(r);
-        callFrame->setCallerFrame(oldCallFrame);
-    } else {
-        size_t omittedArgCount = newCodeBlock->m_numParameters - argCount;
-        Register* r = callFrame->registers() + omittedArgCount;
-        Register* newEnd = r + newCodeBlock->m_numCalleeRegisters;
-        if (!ARG_registerFile->grow(newEnd)) {
-            // Rewind to the previous call frame because op_call already optimistically
-            // moved the call frame forward.
-            ARG_setCallFrame(oldCallFrame);
-            throwStackOverflowError(oldCallFrame, ARG_globalData, ARG_returnAddress2, STUB_RETURN_ADDRESS);
-            RETURN_PAIR(0, 0);
-        }
-
-        Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
-        for (size_t i = 0; i < omittedArgCount; ++i)
-            argv[i] = jsUndefined();
-
-        callFrame = CallFrame::create(r);
-        callFrame->setCallerFrame(oldCallFrame);
-    }
-
-    RETURN_PAIR(newCodeBlock, callFrame);
-}
-
-void* Interpreter::cti_vm_dontLazyLinkCall(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->m_scopeChain.node());
-    if (!codeBlock->jitCode())
-        JIT::compile(ARG_globalData, codeBlock);
-
-    ctiPatchCallByReturnAddress(ARG_returnAddress2, ARG_globalData->interpreter->m_ctiVirtualCallLink);
-
-    return codeBlock->jitCode();
-}
-
-void* Interpreter::cti_vm_lazyLinkCall(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->m_scopeChain.node());
-    if (!codeBlock->jitCode())
-        JIT::compile(ARG_globalData, codeBlock);
-
-    CallLinkInfo* callLinkInfo = &ARG_callFrame->callerFrame()->codeBlock()->getCallLinkInfo(ARG_returnAddress2);
-    JIT::linkCall(callee, codeBlock, codeBlock->jitCode(), callLinkInfo, ARG_int3);
-
-    return codeBlock->jitCode();
-}
-
-JSObject* Interpreter::cti_op_push_activation(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSActivation* activation = new (ARG_globalData) JSActivation(ARG_callFrame, static_cast<FunctionBodyNode*>(ARG_callFrame->codeBlock()->ownerNode()));
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->copy()->push(activation));
-    return activation;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_call_NotJSFunction(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr funcVal = ARG_src1;
-
-    CallData callData;
-    CallType callType = funcVal->getCallData(callData);
-
-    ASSERT(callType != CallTypeJS);
-
-    if (callType == CallTypeHost) {
-        int registerOffset = ARG_int2;
-        int argCount = ARG_int3;
-        CallFrame* previousCallFrame = ARG_callFrame;
-        CallFrame* callFrame = CallFrame::create(previousCallFrame->registers() + registerOffset);
-
-        callFrame->init(0, static_cast<Instruction*>(STUB_RETURN_ADDRESS), previousCallFrame->scopeChain(), previousCallFrame, 0, argCount, 0);
-        ARG_setCallFrame(callFrame);
-
-        Register* argv = ARG_callFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
-        ArgList argList(argv + 1, argCount - 1);
-
-        JSValuePtr returnValue;
-        {
-            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
-
-            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
-            JSValuePtr thisValue = argv[0].jsValue(callFrame);
-            if (thisValue == jsNull())
-                thisValue = callFrame->globalThisValue();
-
-            returnValue = callData.native.function(callFrame, asObject(funcVal), thisValue, argList);
-        }
-        ARG_setCallFrame(previousCallFrame);
-        CHECK_FOR_EXCEPTION();
-
-        return JSValuePtr::encode(returnValue);
-    }
-
-    ASSERT(callType == CallTypeNone);
-
-    CodeBlock* codeBlock = ARG_callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAFunctionError(ARG_callFrame, funcVal, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-void Interpreter::cti_op_create_arguments(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
-}
-
-void Interpreter::cti_op_create_arguments_no_params(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame, Arguments::NoParameters);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
-}
-
-void Interpreter::cti_op_tear_off_activation(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    asActivation(ARG_src1)->copyRegisters(ARG_callFrame->optionalCalleeArguments());
-}
-
-void Interpreter::cti_op_tear_off_arguments(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->usesArguments() && !ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->optionalCalleeArguments()->copyRegisters();
-}
-
-void Interpreter::cti_op_profile_will_call(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->willExecute(ARG_callFrame, ARG_src1);
-}
-
-void Interpreter::cti_op_profile_did_call(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->didExecute(ARG_callFrame, ARG_src1);
-}
-
-void Interpreter::cti_op_ret_scopeChain(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->scopeChain()->deref();
-}
-
-JSObject* Interpreter::cti_op_new_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ArgList argList(&ARG_callFrame->registers()[ARG_int1], ARG_int2);
-    return constructArray(ARG_callFrame, argList);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    do {
-        JSObject* o = *iter;
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
-        }
-    } while (++iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSObject* Interpreter::cti_op_construct_JSConstruct(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-#ifndef NDEBUG
-    ConstructData constructData;
-    ASSERT(asFunction(ARG_src1)->getConstructData(constructData) == ConstructTypeJS);
-#endif
-
-    Structure* structure;
-    if (ARG_src4->isObject())
-        structure = asObject(ARG_src4)->inheritorID();
-    else
-        structure = asFunction(ARG_src1)->m_scopeChain.node()->globalObject()->emptyObjectStructure();
-    return new (ARG_globalData) JSObject(structure);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_construct_NotJSConstruct(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr constrVal = ARG_src1;
-    int argCount = ARG_int3;
-    int thisRegister = ARG_int5;
-
-    ConstructData constructData;
-    ConstructType constructType = constrVal->getConstructData(constructData);
-
-    if (constructType == ConstructTypeHost) {
-        ArgList argList(callFrame->registers() + thisRegister + 1, argCount - 1);
-
-        JSValuePtr returnValue;
-        {
-            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
-            returnValue = constructData.native.function(callFrame, asObject(constrVal), argList);
-        }
-        CHECK_FOR_EXCEPTION();
-
-        return JSValuePtr::encode(returnValue);
-    }
-
-    ASSERT(constructType == ConstructTypeNone);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAConstructorError(callFrame, constrVal, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-
-    JSValuePtr result;
-    unsigned i;
-
-    bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-    if (LIKELY(isUInt32)) {
-        if (interpreter->isJSArray(baseValue)) {
-            JSArray* jsArray = asArray(baseValue);
-            if (jsArray->canGetIndex(i))
-                result = jsArray->getIndex(i);
-            else
-                result = jsArray->JSArray::get(callFrame, i);
-        } else if (interpreter->isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
-            return JSValuePtr::encode(asString(baseValue)->getIndex(ARG_globalData, i));
-        else if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i))
-            return JSValuePtr::encode(asByteArray(baseValue)->getIndex(i));
-        else
-            result = baseValue->get(callFrame, i);
-    } else {
-        Identifier property(callFrame, subscript->toString(callFrame));
-        result = baseValue->get(callFrame, property);
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_resolve_func(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {            
-            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
-            // However, section 10.2.3 says that in the case where the value provided
-            // by the caller is null, the global object should be used. It also says
-            // that the section does not apply to internal functions, but for simplicity
-            // of implementation we use the global object anyway here. This guarantees
-            // that in host objects you always get a valid object for this.
-            // We also handle wrapper substitution for the global object at the same time.
-            JSObject* thisObj = base->toThisObject(callFrame);
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-
-            RETURN_PAIR(thisObj, JSValuePtr::encode(result));
-        }
-        ++iter;
-    } while (iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_sub(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left - right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toNumber(callFrame) - src2->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-void Interpreter::cti_op_put_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr value = ARG_src3;
-
-    unsigned i;
-
-    bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-    if (LIKELY(isUInt32)) {
-        if (interpreter->isJSArray(baseValue)) {
-            JSArray* jsArray = asArray(baseValue);
-            if (jsArray->canSetIndex(i))
-                jsArray->setIndex(i, value);
-            else
-                jsArray->JSArray::put(callFrame, i, value);
-        } else if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
-            JSByteArray* jsByteArray = asByteArray(baseValue);
-            double dValue = 0;
-            if (JSImmediate::isNumber(value)) {
-                jsByteArray->setIndex(i, JSImmediate::getTruncatedInt32(value));
-                return;
-            } else if (fastIsNumber(value, dValue)) {
-                jsByteArray->setIndex(i, dValue);
-                return;
-            } else
-                baseValue->put(callFrame, i, value);
-        } else
-            baseValue->put(callFrame, i, value);
-    } else {
-        Identifier property(callFrame, subscript->toString(callFrame));
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue->put(callFrame, property, value, slot);
-        }
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_val_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    int i = ARG_int2;
-    JSValuePtr value = ARG_src3;
-
-    ASSERT(ARG_globalData->interpreter->isJSArray(baseValue));
-
-    if (LIKELY(i >= 0))
-        asArray(baseValue)->JSArray::put(callFrame, i, value);
-    else {
-        Identifier property(callFrame, JSImmediate::from(i)->toString(callFrame));
-        // FIXME: can toString throw an exception here?
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue->put(callFrame, property, value, slot);
-        }
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_lesseq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLessEq(callFrame, ARG_src1, ARG_src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_loop_if_true(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = src1->toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_negate(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    double v;
-    if (fastIsNumber(src, v))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, -v));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, -src->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_base(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(inlineResolveBase(ARG_callFrame, *ARG_id1, ARG_callFrame->scopeChain()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_skip(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    int skip = ARG_int2;
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-    while (skip--) {
-        ++iter;
-        ASSERT(iter != end);
-    }
-    Identifier& ident = *ARG_id1;
-    do {
-        JSObject* o = *iter;
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
-        }
-    } while (++iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_global(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalObject* globalObject = asGlobalObject(ARG_src1);
-    Identifier& ident = *ARG_id2;
-    unsigned globalResolveInfoIndex = ARG_int3;
-    ASSERT(globalObject->isGlobalObject());
-
-    PropertySlot slot(globalObject);
-    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValuePtr result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
-            GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
-            if (globalResolveInfo.structure)
-                globalResolveInfo.structure->deref();
-            globalObject->structure()->ref();
-            globalResolveInfo.structure = globalObject->structure();
-            globalResolveInfo.offset = slot.cachedOffset();
-            return JSValuePtr::encode(result);
-        }
-
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
-    }
-
-    unsigned vPCIndex = ARG_callFrame->codeBlock()->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, callFrame->codeBlock());
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_div(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left / right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toNumber(callFrame) / src2->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_pre_dec(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v->toNumber(callFrame) - 1);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_jless(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_not(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsBoolean(!src->toBoolean(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_jtrue(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = src1->toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-VoidPtrPair Interpreter::cti_op_post_inc(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr number = v->toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number->uncheckedGetNumber() + 1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_eq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(!JSImmediate::areBothImmediateNumbers(src1, src2));
-    JSValuePtr result = jsBoolean(equalSlowCaseInline(callFrame, src1, src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_lshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    int32_t left;
-    uint32_t right;
-    if (JSImmediate::areBothImmediateNumbers(val, shift))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, JSImmediate::getTruncatedInt32(val) << (JSImmediate::getTruncatedUInt32(shift) & 0x1f)));
-    if (fastToInt32(val, left) && fastToUInt32(shift, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left << (right & 0x1f)));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val->toInt32(callFrame)) << (shift->toUInt32(callFrame) & 0x1f));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitand(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    int32_t left;
-    int32_t right;
-    if (fastToInt32(src1, left) && fastToInt32(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left & right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toInt32(callFrame) & src2->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_rshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    int32_t left;
-    uint32_t right;
-    if (JSImmediate::areBothImmediateNumbers(val, shift))
-        return JSValuePtr::encode(JSImmediate::rightShiftImmediateNumbers(val, shift));
-    if (fastToInt32(val, left) && fastToUInt32(shift, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left >> (right & 0x1f)));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val->toInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitnot(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    int value;
-    if (fastToInt32(src, value))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, ~value));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, ~src->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_resolve_with_base(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-
-            RETURN_PAIR(base, JSValuePtr::encode(result));
-        }
-        ++iter;
-    } while (iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
-}
-
-JSObject* Interpreter::cti_op_new_func_exp(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return ARG_funcexp1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_mod(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr dividendValue = ARG_src1;
-    JSValuePtr divisorValue = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-    double d = dividendValue->toNumber(callFrame);
-    JSValuePtr result = jsNumber(ARG_globalData, fmod(d, divisorValue->toNumber(callFrame)));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_less(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLess(callFrame, ARG_src1, ARG_src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_neq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    ASSERT(!JSImmediate::areBothImmediateNumbers(src1, src2));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(!equalSlowCaseInline(callFrame, src1, src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_post_dec(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr number = v->toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number->uncheckedGetNumber() - 1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_urshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    if (JSImmediate::areBothImmediateNumbers(val, shift) && !JSImmediate::isNegative(val))
-        return JSValuePtr::encode(JSImmediate::rightShiftImmediateNumbers(val, shift));
-    else {
-        JSValuePtr result = jsNumber(ARG_globalData, (val->toUInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
-    }
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitxor(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toInt32(callFrame) ^ src2->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSObject* Interpreter::cti_op_new_regexp(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return new (ARG_globalData) RegExpObject(ARG_callFrame->lexicalGlobalObject()->regExpStructure(), ARG_regexp1);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitor(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toInt32(callFrame) | src2->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_call_eval(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    RegisterFile* registerFile = ARG_registerFile;
-
-    Interpreter* interpreter = ARG_globalData->interpreter;
-    
-    JSValuePtr funcVal = ARG_src1;
-    int registerOffset = ARG_int2;
-    int argCount = ARG_int3;
-
-    Register* newCallFrame = callFrame->registers() + registerOffset;
-    Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
-    JSValuePtr thisValue = argv[0].jsValue(callFrame);
-    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
-
-    if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-        JSValuePtr exceptionValue = noValue();
-        JSValuePtr result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
-        if (UNLIKELY(exceptionValue != noValue())) {
-            ARG_globalData->exception = exceptionValue;
-            VM_THROW_EXCEPTION_AT_END();
-        }
-        return JSValuePtr::encode(result);
-    }
-
-    return JSValuePtr::encode(JSImmediate::impossibleValue());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_throw(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-
-    JSValuePtr exceptionValue = ARG_src1;
-    ASSERT(exceptionValue);
-
-    HandlerInfo* handler = ARG_globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
-
-    if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(JSImmediate::nullImmediate());
-    }
-
-    ARG_setCallFrame(callFrame);
-    void* catchRoutine = handler->nativeCode;
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
-}
-
-JSPropertyNameIterator* Interpreter::cti_op_get_pnames(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSPropertyNameIterator::create(ARG_callFrame, ARG_src1);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_next_pname(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSPropertyNameIterator* it = ARG_pni1;
-    JSValuePtr temp = it->next(ARG_callFrame);
-    if (!temp)
-        it->invalidate();
-    return JSValuePtr::encode(temp);
-}
-
-JSObject* Interpreter::cti_op_push_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSObject* o = ARG_src1->toObject(ARG_callFrame);
-    CHECK_FOR_EXCEPTION();
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->push(o));
-    return o;
-}
-
-void Interpreter::cti_op_pop_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->pop());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_typeof(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsTypeStringForValue(ARG_callFrame, ARG_src1));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_undefined(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-    return JSValuePtr::encode(jsBoolean(JSImmediate::isImmediate(v) ? v->isUndefined() : v->asCell()->structure()->typeInfo().masqueradesAsUndefined()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_boolean(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_src1->isBoolean()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_number(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_src1->isNumber()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_string(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_globalData->interpreter->isJSString(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_object(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(jsIsObjectType(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_function(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(jsIsFunctionType(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_stricteq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    // handled inline as fast cases
-    ASSERT(!JSImmediate::areBothImmediate(src1, src2));
-    ASSERT(!(JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate())));
-
-    return JSValuePtr::encode(jsBoolean(strictEqualSlowCaseInline(src1, src2)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_nstricteq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    // handled inline as fast cases
-    ASSERT(!JSImmediate::areBothImmediate(src1, src2));
-    ASSERT(!(JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate())));
-    
-    return JSValuePtr::encode(jsBoolean(!strictEqualSlowCaseInline(src1, src2)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_to_jsnumber(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = src->toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_in(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr baseVal = ARG_src2;
-
-    if (!baseVal->isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "in", baseVal, vPCIndex, codeBlock);
-        VM_THROW_EXCEPTION();
-    }
-
-    JSValuePtr propName = ARG_src1;
-    JSObject* baseObj = asObject(baseVal);
-
-    uint32_t i;
-    if (propName->getUInt32(i))
-        return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, i)));
-
-    Identifier property(callFrame, propName->toString(callFrame));
-    CHECK_FOR_EXCEPTION();
-    return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
-}
-
-JSObject* Interpreter::cti_op_push_new_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSObject* scope = new (ARG_globalData) JSStaticScopeObject(ARG_callFrame, *ARG_id1, ARG_src2, DontDelete);
-
-    CallFrame* callFrame = ARG_callFrame;
-    callFrame->setScopeChain(callFrame->scopeChain()->push(scope));
-    return scope;
-}
-
-void Interpreter::cti_op_jmp_scopes(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    unsigned count = ARG_int1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    ScopeChainNode* tmp = callFrame->scopeChain();
-    while (count--)
-        tmp = tmp->pop();
-    callFrame->setScopeChain(tmp);
-}
-
-void Interpreter::cti_op_put_by_index(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    unsigned property = ARG_int2;
-
-    ARG_src1->put(callFrame, property, ARG_src3);
-}
-
-void* Interpreter::cti_op_switch_imm(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    if (JSImmediate::isNumber(scrutinee)) {
-        int32_t value = JSImmediate::getTruncatedInt32(scrutinee);
-        return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(value);
-    }
-
-    return codeBlock->immediateSwitchJumpTable(tableIndex).ctiDefault;
-}
-
-void* Interpreter::cti_op_switch_char(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault;
-
-    if (scrutinee->isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        if (value->size() == 1)
-            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]);
-    }
-
-    return result;
-}
-
-void* Interpreter::cti_op_switch_string(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault;
-
-    if (scrutinee->isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value);
-    }
-
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_del_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSObject* baseObj = baseValue->toObject(callFrame); // may throw
-
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr result;
-    uint32_t i;
-    if (subscript->getUInt32(i))
-        result = jsBoolean(baseObj->deleteProperty(callFrame, i));
-    else {
-        CHECK_FOR_EXCEPTION();
-        Identifier property(callFrame, subscript->toString(callFrame));
-        CHECK_FOR_EXCEPTION();
-        result = jsBoolean(baseObj->deleteProperty(callFrame, property));
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-void Interpreter::cti_op_put_getter(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(ARG_src1->isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3->isObject());
-    baseObj->defineGetter(callFrame, *ARG_id2, asObject(ARG_src3));
-}
-
-void Interpreter::cti_op_put_setter(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(ARG_src1->isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3->isObject());
-    baseObj->defineSetter(callFrame, *ARG_id2, asObject(ARG_src3));
-}
-
-JSObject* Interpreter::cti_op_new_error(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned type = ARG_int1;
-    JSValuePtr message = ARG_src2;
-    unsigned bytecodeOffset = ARG_int3;
-
-    unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
-    return Error::create(callFrame, static_cast<ErrorType>(type), message->toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
-}
-
-void Interpreter::cti_op_debug(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    int debugHookID = ARG_int1;
-    int firstLine = ARG_int2;
-    int lastLine = ARG_int3;
-
-    ARG_globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_vm_throw(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    JSGlobalData* globalData = ARG_globalData;
-
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(globalData->exceptionLocation);
-
-    JSValuePtr exceptionValue = globalData->exception;
-    ASSERT(exceptionValue);
-    globalData->exception = noValue();
-
-    HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, false);
-
-    if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(JSImmediate::nullImmediate());
-    }
-
-    ARG_setCallFrame(callFrame);
-    void* catchRoutine = handler->nativeCode;
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
-}
-
-#undef STUB_RETURN_ADDRESS
-#undef STUB_SET_RETURN_ADDRESS
-#undef BEGIN_STUB_FUNCTION
-#undef CHECK_FOR_EXCEPTION
-#undef CHECK_FOR_EXCEPTION_AT_END
-#undef CHECK_FOR_EXCEPTION_VOID
-#undef VM_THROW_EXCEPTION
-#undef VM_THROW_EXCEPTION_2
-#undef VM_THROW_EXCEPTION_AT_END
-
-#endif // ENABLE(JIT)
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 26d6732f82..7cab2547f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -30,11 +30,13 @@
 #define Interpreter_h
 
 #include "ArgList.h"
+#include "FastAllocBase.h"
+#include "HashMap.h"
 #include "JSCell.h"
 #include "JSValue.h"
+#include "JSObject.h"
 #include "Opcode.h"
 #include "RegisterFile.h"
-#include <wtf/HashMap.h>
 
 namespace JSC {
 
@@ -50,54 +52,9 @@ namespace JSC {
     class Register;
     class ScopeChainNode;
     class SamplingTool;
+    struct CallFrameClosure;
     struct HandlerInfo;
 
-#if ENABLE(JIT)
-
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-    #define STUB_ARGS void* args, ...
-    #define ARGS (reinterpret_cast<void**>(vl_args) - 1)
-#else // JIT_STUB_ARGUMENT_REGISTER or JIT_STUB_ARGUMENT_STACK
-    #define STUB_ARGS void** args
-    #define ARGS (args)
-#endif
-
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    #if PLATFORM(X86_64)
-    #define JIT_STUB
-    #elif COMPILER(MSVC)
-    #define JIT_STUB __fastcall
-    #elif COMPILER(GCC)
-    #define JIT_STUB  __attribute__ ((fastcall))
-    #else
-    #error Need to support register calling convention in this compiler
-    #endif
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-    #if COMPILER(MSVC)
-    #define JIT_STUB __cdecl
-    #else
-    #define JIT_STUB
-    #endif
-#endif
-
-// The Mac compilers are fine with this, 
-#if PLATFORM(MAC)
-    struct VoidPtrPair {
-        void* first;
-        void* second;
-    };
-#define RETURN_PAIR(a,b) VoidPtrPair pair = { a, b }; return pair
-#else
-    typedef uint64_t VoidPtrPair;
-    union VoidPtrPairValue {
-        struct { void* first; void* second; } s;
-        VoidPtrPair i;
-    };
-#define RETURN_PAIR(a,b) VoidPtrPairValue pair = {{ a, b }}; return pair.i
-#endif
-
-#endif // ENABLE(JIT)
-
     enum DebugHookID {
         WillExecuteProgram,
         DidExecuteProgram,
@@ -107,16 +64,14 @@ namespace JSC {
         WillExecuteStatement
     };
 
-    enum { MaxReentryDepth = 128 };
+    enum { MaxMainThreadReentryDepth = 256, MaxSecondaryThreadReentryDepth = 32 };
 
-    class Interpreter {
+    class Interpreter : public WTF::FastAllocBase {
         friend class JIT;
+        friend class CachedCall;
     public:
         Interpreter();
-        ~Interpreter();
 
-        void initialize(JSGlobalData*);
-        
         RegisterFile& registerFile() { return m_registerFile; }
         
         Opcode getOpcode(OpcodeID id)
@@ -140,236 +95,72 @@ namespace JSC {
 
         bool isOpcode(Opcode);
         
-        JSValuePtr execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValuePtr* exception);
-        JSValuePtr execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValuePtr* exception);
-        JSValuePtr execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValuePtr* exception);
+        JSValue execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
+        JSValue execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
 
-        JSValuePtr retrieveArguments(CallFrame*, JSFunction*) const;
-        JSValuePtr retrieveCaller(CallFrame*, InternalFunction*) const;
-        void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValuePtr& function) const;
+        JSValue retrieveArguments(CallFrame*, JSFunction*) const;
+        JSValue retrieveCaller(CallFrame*, InternalFunction*) const;
+        void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const;
         
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
-        void setTimeoutTime(unsigned timeoutTime) { m_timeoutTime = timeoutTime; }
         
-        void startTimeoutCheck()
-        {
-            if (!m_timeoutCheckCount)
-                resetTimeoutCheck();
-            
-            ++m_timeoutCheckCount;
-        }
-        
-        void stopTimeoutCheck()
-        {
-            ASSERT(m_timeoutCheckCount);
-            --m_timeoutCheckCount;
-        }
-
-        inline void initTimeout()
-        {
-            ASSERT(!m_timeoutCheckCount);
-            resetTimeoutCheck();
-            m_timeoutTime = 0;
-            m_timeoutCheckCount = 0;
-        }
-
         void setSampler(SamplingTool* sampler) { m_sampler = sampler; }
         SamplingTool* sampler() { return m_sampler; }
 
-#if ENABLE(JIT)
-
-        static int JIT_STUB cti_timeout_check(STUB_ARGS);
-        static void JIT_STUB cti_register_file_check(STUB_ARGS);
-
-        static JSObject* JIT_STUB cti_op_convert_this(STUB_ARGS);
-        static void JIT_STUB cti_op_end(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_add(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_pre_inc(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_less(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_object(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_second(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_second(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_generic(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_self_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_string_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_del_by_id(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_instanceof(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_mul(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_func(STUB_ARGS);
-        static void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS);
-        static void JIT_STUB cti_op_create_arguments(STUB_ARGS);
-        static void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS);
-        static void JIT_STUB cti_op_tear_off_activation(STUB_ARGS);
-        static void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS);
-        static void JIT_STUB cti_op_profile_will_call(STUB_ARGS);
-        static void JIT_STUB cti_op_profile_did_call(STUB_ARGS);
-        static void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_array(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_global(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_val(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_resolve_func(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_sub(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_val(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_val_array(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_lesseq(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_true(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_base(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_negate(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_skip(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_div(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_pre_dec(STUB_ARGS);
-        static int JIT_STUB cti_op_jless(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_not(STUB_ARGS);
-        static int JIT_STUB cti_op_jtrue(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_post_inc(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_eq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_lshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitand(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_rshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitnot(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_resolve_with_base(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_mod(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_less(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_neq(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_post_dec(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_urshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitxor(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitor(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_call_eval(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_throw(STUB_ARGS);
-        static JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_next_pname(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS);
-        static void JIT_STUB cti_op_pop_scope(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_typeof(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_undefined(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_boolean(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_number(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_string(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_object(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_function(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_stricteq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_nstricteq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_to_jsnumber(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_in(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS);
-        static void JIT_STUB cti_op_jmp_scopes(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_index(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_imm(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_char(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_string(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_del_by_val(STUB_ARGS);
-        static void JIT_STUB cti_op_put_getter(STUB_ARGS);
-        static void JIT_STUB cti_op_put_setter(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_error(STUB_ARGS);
-        static void JIT_STUB cti_op_debug(STUB_ARGS);
-
-        static JSValueEncodedAsPointer* JIT_STUB cti_vm_throw(STUB_ARGS);
-        static void* JIT_STUB cti_vm_dontLazyLinkCall(STUB_ARGS);
-        static void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS);
-        
-#endif // ENABLE(JIT)
-
-        // Default number of ticks before a timeout check should be done.
-        static const int initialTickCountThreshold = 1024;
-
-        bool isJSArray(JSValuePtr v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsArrayVptr; }
-        bool isJSString(JSValuePtr v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsStringVptr; }
-        bool isJSByteArray(JSValuePtr v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsByteArrayVptr; }
+        NEVER_INLINE JSValue callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValue& exceptionValue);
+        NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset, bool);
+        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
 
     private:
         enum ExecutionFlag { Normal, InitializeAndReturn };
 
-        NEVER_INLINE JSValuePtr callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValuePtr& exceptionValue);
-        JSValuePtr execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValuePtr* exception);
+        CallFrameClosure prepareForRepeatCall(FunctionBodyNode*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
+        void endRepeatCall(CallFrameClosure&);
+        JSValue execute(CallFrameClosure&, JSValue* exception);
 
-        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
+        JSValue execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
 
-        NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
-        NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
-        NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+#if USE(INTERPRETER)
+        NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE void resolveBase(CallFrame*, Instruction* vPC);
-        NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+        NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE ScopeChainNode* createExceptionScope(CallFrame*, const Instruction* vPC);
 
-        NEVER_INLINE bool unwindCallFrame(CallFrame*&, JSValuePtr, unsigned& bytecodeOffset, CodeBlock*&);
-        NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValuePtr&, unsigned bytecodeOffset, bool);
-        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+        void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
+        void uncacheGetByID(CodeBlock*, Instruction* vPC);
+        void tryCachePutByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const PutPropertySlot&);
+        void uncachePutByID(CodeBlock*, Instruction* vPC);        
+#endif
+
+        NEVER_INLINE bool unwindCallFrame(CallFrame*&, JSValue, unsigned& bytecodeOffset, CodeBlock*&);
 
         static ALWAYS_INLINE CallFrame* slideRegisterWindowForCall(CodeBlock*, RegisterFile*, CallFrame*, size_t registerOffset, int argc);
 
         static CallFrame* findFunctionCallFrame(CallFrame*, InternalFunction*);
 
-        JSValuePtr privateExecute(ExecutionFlag, RegisterFile*, CallFrame*, JSValuePtr* exception);
+        JSValue privateExecute(ExecutionFlag, RegisterFile*, CallFrame*, JSValue* exception);
 
         void dumpCallFrame(CallFrame*);
         void dumpRegisters(CallFrame*);
-
-        bool checkTimeout(JSGlobalObject*);
-        void resetTimeoutCheck();
-
-        void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot&);
-        void uncacheGetByID(CodeBlock*, Instruction* vPC);
-        void tryCachePutByID(CallFrame*, CodeBlock*, Instruction*, JSValuePtr baseValue, const PutPropertySlot&);
-        void uncachePutByID(CodeBlock*, Instruction* vPC);
         
         bool isCallBytecode(Opcode opcode) { return opcode == getOpcode(op_call) || opcode == getOpcode(op_construct) || opcode == getOpcode(op_call_eval); }
 
-#if ENABLE(JIT)
-        static void throwStackOverflowPreviousFrame(CallFrame**, JSGlobalData*, void*& returnAddress);
-
-        void tryCTICacheGetByID(CallFrame*, CodeBlock*, void* returnAddress, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot&);
-        void tryCTICachePutByID(CallFrame*, CodeBlock*, void* returnAddress, JSValuePtr baseValue, const PutPropertySlot&);
-#endif
-
         SamplingTool* m_sampler;
 
-#if ENABLE(JIT)
-        RefPtr<ExecutablePool> m_executablePool;
-        void* m_ctiArrayLengthTrampoline;
-        void* m_ctiStringLengthTrampoline;
-        void* m_ctiVirtualCallPreLink;
-        void* m_ctiVirtualCallLink;
-        void* m_ctiVirtualCall;
-#endif
-
         int m_reentryDepth;
-        unsigned m_timeoutTime;
-        unsigned m_timeAtLastCheckTimeout;
-        unsigned m_timeExecuting;
-        unsigned m_timeoutCheckCount;
-        unsigned m_ticksUntilNextTimeoutCheck;
 
         RegisterFile m_registerFile;
         
-        void* m_jsArrayVptr;
-        void* m_jsByteArrayVptr;
-        void* m_jsStringVptr;
-        void* m_jsFunctionVptr;
-
 #if HAVE(COMPUTED_GOTO)
         Opcode m_opcodeTable[numOpcodeIDs]; // Maps OpcodeID => Opcode for compiling
         HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
 #endif
     };
-
+    
 } // namespace JSC
 
 #endif // Interpreter_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index 9ad1815a2e..cceac74842 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -30,6 +30,7 @@
 #define Register_h
 
 #include "JSValue.h"
+#include <wtf/Assertions.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
@@ -49,24 +50,26 @@ namespace JSC {
     class Register {
     public:
         Register();
-        Register(JSValuePtr);
+        Register(JSValue);
+        Register(Arguments*);
 
-        JSValuePtr jsValue(CallFrame*) const;
-        JSValuePtr getJSValue() const;
+        JSValue jsValue() const;
 
         bool marked() const;
         void mark();
         
+        int32_t i() const;
+        void* v() const;
+
     private:
         friend class ExecState;
         friend class Interpreter;
 
-        // Only CallFrame and Interpreter should use these functions.
+        // Only CallFrame, Interpreter, and JITStubs should use these functions.
 
         Register(intptr_t);
 
         Register(JSActivation*);
-        Register(Arguments*);
         Register(CallFrame*);
         Register(CodeBlock*);
         Register(JSFunction*);
@@ -74,9 +77,6 @@ namespace JSC {
         Register(ScopeChainNode*);
         Register(Instruction*);
 
-        intptr_t i() const;
-        void* v() const;
-
         JSActivation* activation() const;
         Arguments* arguments() const;
         CallFrame* callFrame() const;
@@ -89,7 +89,7 @@ namespace JSC {
         union {
             intptr_t i;
             void* v;
-            JSValueEncodedAsPointer* value;
+            EncodedJSValue value;
 
             JSActivation* activation;
             Arguments* arguments;
@@ -100,136 +100,89 @@ namespace JSC {
             ScopeChainNode* scopeChain;
             Instruction* vPC;
         } u;
-
-#ifndef NDEBUG
-        enum {
-            EmptyType,
-
-            IntType,
-            ValueType,
-
-            ActivationType,
-            ArgumentsType,
-            CallFrameType,
-            CodeBlockType,
-            FunctionType,
-            InstructionType,
-            PropertyNameIteratorType,
-            RegisterType,
-            ScopeChainNodeType
-        } m_type;
-#endif
     };
 
-#ifndef NDEBUG
-    #define SET_TYPE(type) m_type = (type)
-    // FIXME: The CTI code to put value into registers doesn't set m_type.
-    // Once it does, we can turn this assertion back on.
-    #define ASSERT_TYPE(type)
-#else
-    #define SET_TYPE(type)
-    #define ASSERT_TYPE(type)
-#endif
-
     ALWAYS_INLINE Register::Register()
     {
 #ifndef NDEBUG
-        SET_TYPE(EmptyType);
-        u.value = JSValuePtr::encode(noValue());
+        u.value = JSValue::encode(JSValue());
 #endif
     }
 
-    ALWAYS_INLINE Register::Register(JSValuePtr v)
+    ALWAYS_INLINE Register::Register(JSValue v)
     {
-        SET_TYPE(ValueType);
-        u.value = JSValuePtr::encode(v);
+        u.value = JSValue::encode(v);
     }
 
-    // This function is scaffolding for legacy clients. It will eventually go away.
-    ALWAYS_INLINE JSValuePtr Register::jsValue(CallFrame*) const
+    ALWAYS_INLINE JSValue Register::jsValue() const
     {
-        // Once registers hold doubles, this function will allocate a JSValue*
-        // if the register doesn't hold one already. 
-        ASSERT_TYPE(ValueType);
-        return JSValuePtr::decode(u.value);
-    }
-    
-    ALWAYS_INLINE JSValuePtr Register::getJSValue() const
-    {
-        ASSERT_TYPE(JSValueType);
-        return JSValuePtr::decode(u.value);
+        return JSValue::decode(u.value);
     }
     
     ALWAYS_INLINE bool Register::marked() const
     {
-        return getJSValue()->marked();
+        return jsValue().marked();
     }
 
     ALWAYS_INLINE void Register::mark()
     {
-        getJSValue()->mark();
+        jsValue().mark();
     }
     
     // Interpreter functions
 
     ALWAYS_INLINE Register::Register(Arguments* arguments)
     {
-        SET_TYPE(ArgumentsType);
         u.arguments = arguments;
     }
 
     ALWAYS_INLINE Register::Register(JSActivation* activation)
     {
-        SET_TYPE(ActivationType);
         u.activation = activation;
     }
 
     ALWAYS_INLINE Register::Register(CallFrame* callFrame)
     {
-        SET_TYPE(CallFrameType);
         u.callFrame = callFrame;
     }
 
     ALWAYS_INLINE Register::Register(CodeBlock* codeBlock)
     {
-        SET_TYPE(CodeBlockType);
         u.codeBlock = codeBlock;
     }
 
     ALWAYS_INLINE Register::Register(JSFunction* function)
     {
-        SET_TYPE(FunctionType);
         u.function = function;
     }
 
     ALWAYS_INLINE Register::Register(Instruction* vPC)
     {
-        SET_TYPE(InstructionType);
         u.vPC = vPC;
     }
 
     ALWAYS_INLINE Register::Register(ScopeChainNode* scopeChain)
     {
-        SET_TYPE(ScopeChainNodeType);
         u.scopeChain = scopeChain;
     }
 
     ALWAYS_INLINE Register::Register(JSPropertyNameIterator* propertyNameIterator)
     {
-        SET_TYPE(PropertyNameIteratorType);
         u.propertyNameIterator = propertyNameIterator;
     }
 
     ALWAYS_INLINE Register::Register(intptr_t i)
     {
-        SET_TYPE(IntType);
+        // See comment on 'i()' below.
+        ASSERT(i == static_cast<int32_t>(i));
         u.i = i;
     }
 
-    ALWAYS_INLINE intptr_t Register::i() const
+    // Read 'i' as a 32-bit integer; we only use it to hold 32-bit values,
+    // and we only write 32-bits when writing the arg count from JIT code.
+    ALWAYS_INLINE int32_t Register::i() const
     {
-        ASSERT_TYPE(IntType);
-        return u.i;
+        return static_cast<int32_t>(u.i);
     }
     
     ALWAYS_INLINE void* Register::v() const
@@ -239,55 +192,44 @@ namespace JSC {
 
     ALWAYS_INLINE JSActivation* Register::activation() const
     {
-        ASSERT_TYPE(ActivationType);
         return u.activation;
     }
     
     ALWAYS_INLINE Arguments* Register::arguments() const
     {
-        ASSERT_TYPE(ArgumentsType);
         return u.arguments;
     }
     
     ALWAYS_INLINE CallFrame* Register::callFrame() const
     {
-        ASSERT_TYPE(CallFrameType);
         return u.callFrame;
     }
     
     ALWAYS_INLINE CodeBlock* Register::codeBlock() const
     {
-        ASSERT_TYPE(CodeBlockType);
         return u.codeBlock;
     }
     
     ALWAYS_INLINE JSFunction* Register::function() const
     {
-        ASSERT_TYPE(FunctionType);
         return u.function;
     }
     
     ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
     {
-        ASSERT_TYPE(PropertyNameIteratorType);
         return u.propertyNameIterator;
     }
     
     ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
     {
-        ASSERT_TYPE(ScopeChainNodeType);
         return u.scopeChain;
     }
     
     ALWAYS_INLINE Instruction* Register::vPC() const
     {
-        ASSERT_TYPE(InstructionType);
         return u.vPC;
     }
 
-    #undef SET_TYPE
-    #undef ASSERT_TYPE
-
 } // namespace JSC
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
index 50698f5f01..cfcf1d3627 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -42,4 +42,15 @@ RegisterFile::~RegisterFile()
 #endif
 }
 
+void RegisterFile::releaseExcessCapacity()
+{
+#if HAVE(MMAP) && HAVE(MADV_FREE) && !HAVE(VIRTUALALLOC)
+    while (madvise(m_start, (m_max - m_start) * sizeof(Register), MADV_FREE) == -1 && errno == EAGAIN) { }
+#elif HAVE(VIRTUALALLOC)
+    VirtualFree(m_start, (m_max - m_start) * sizeof(Register), MEM_DECOMMIT);
+    m_commitEnd = m_start;
+#endif
+    m_maxUsed = m_start;
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
index 9a792ee56e..933efb9f07 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
@@ -29,9 +29,11 @@
 #ifndef RegisterFile_h
 #define RegisterFile_h
 
-#include "Register.h"
 #include "Collector.h"
+#include "ExecutableAllocator.h"
+#include "Register.h"
 #include <wtf/Noncopyable.h>
+#include <wtf/VMTags.h>
 
 #if HAVE(MMAP)
 #include <errno.h>
@@ -111,52 +113,11 @@ namespace JSC {
 
         static const size_t defaultCapacity = 524288;
         static const size_t defaultMaxGlobals = 8192;
-        static const size_t allocationSize = 1 << 14;
-        static const size_t allocationSizeMask = allocationSize - 1;
-
-        RegisterFile(size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals)
-            : m_numGlobals(0)
-            , m_maxGlobals(maxGlobals)
-            , m_start(0)
-            , m_end(0)
-            , m_max(0)
-            , m_buffer(0)
-            , m_globalObject(0)
-        {
-            size_t bufferLength = (capacity + maxGlobals) * sizeof(Register);
-#if HAVE(MMAP)
-            m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0));
-            if (m_buffer == MAP_FAILED) {
-                fprintf(stderr, "Could not allocate register file: %d\n", errno);
-                CRASH();
-            }
-#elif HAVE(VIRTUALALLOC)
-            // Ensure bufferLength is a multiple of allocation size
-            bufferLength = (bufferLength + allocationSizeMask) & ~allocationSizeMask;
-            m_buffer = static_cast<Register*>(VirtualAlloc(0, bufferLength, MEM_RESERVE, PAGE_READWRITE));
-            if (!m_buffer) {
-#if !PLATFORM(WIN_CE)
-                fprintf(stderr, "Could not allocate register file: %d\n", errno);
-#endif
-                CRASH();
-            }
-            int initialAllocation = (maxGlobals * sizeof(Register) + allocationSizeMask) & ~allocationSizeMask;
-            void* commitCheck = VirtualAlloc(m_buffer, initialAllocation, MEM_COMMIT, PAGE_READWRITE);
-            if (commitCheck != m_buffer) {
-#if !PLATFORM(WIN_CE)
-                fprintf(stderr, "Could not allocate register file: %d\n", errno);
-#endif
-                CRASH();
-            }
-            m_maxCommitted = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_buffer) + initialAllocation);
-#else
-            #error "Don't know how to reserve virtual memory on this platform."
-#endif
-            m_start = m_buffer + maxGlobals;
-            m_end = m_start;
-            m_max = m_start + capacity;
-        }
+        static const size_t commitSize = 1 << 14;
+        // Allow 8k of excess registers before we start trying to reap the registerfile
+        static const ptrdiff_t maxExcessCapacity = 8 * 1024;
 
+        RegisterFile(size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals);
         ~RegisterFile();
 
         Register* start() const { return m_start; }
@@ -166,33 +127,8 @@ namespace JSC {
         void setGlobalObject(JSGlobalObject* globalObject) { m_globalObject = globalObject; }
         JSGlobalObject* globalObject() { return m_globalObject; }
 
-        void shrink(Register* newEnd)
-        {
-            if (newEnd < m_end)
-                m_end = newEnd;
-        }
-
-        bool grow(Register* newEnd)
-        {
-            if (newEnd > m_end) {
-                if (newEnd > m_max)
-                    return false;
-#if !HAVE(MMAP) && HAVE(VIRTUALALLOC)
-                if (newEnd > m_maxCommitted) {
-                    ptrdiff_t additionalAllocation = ((reinterpret_cast<char*>(newEnd)  - reinterpret_cast<char*>(m_maxCommitted)) + allocationSizeMask) & ~allocationSizeMask;
-                    if (!VirtualAlloc(m_maxCommitted, additionalAllocation, MEM_COMMIT, PAGE_READWRITE)) {
-#if !PLATFORM(WIN_CE)
-                        fprintf(stderr, "Could not allocate register file: %d\n", errno);
-#endif
-                        CRASH();
-                    }
-                    m_maxCommitted = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_maxCommitted) + additionalAllocation);
-                }
-#endif
-                m_end = newEnd;
-            }
-            return true;
-        }
+        bool grow(Register* newEnd);
+        void shrink(Register* newEnd);
         
         void setNumGlobals(size_t numGlobals) { m_numGlobals = numGlobals; }
         int numGlobals() const { return m_numGlobals; }
@@ -204,19 +140,108 @@ namespace JSC {
         void markCallFrames(Heap* heap) { heap->markConservatively(m_start, m_end); }
 
     private:
+        void releaseExcessCapacity();
         size_t m_numGlobals;
         const size_t m_maxGlobals;
         Register* m_start;
         Register* m_end;
         Register* m_max;
         Register* m_buffer;
+        Register* m_maxUsed;
+
 #if HAVE(VIRTUALALLOC)
-        Register* m_maxCommitted;
+        Register* m_commitEnd;
 #endif
 
         JSGlobalObject* m_globalObject; // The global object whose vars are currently stored in the register file.
     };
 
+    // FIXME: Add a generic getpagesize() to WTF, then move this function to WTF as well.
+    inline bool isPageAligned(size_t size) { return size != 0 && size % (8 * 1024) == 0; }
+
+    inline RegisterFile::RegisterFile(size_t capacity, size_t maxGlobals)
+        : m_numGlobals(0)
+        , m_maxGlobals(maxGlobals)
+        , m_start(0)
+        , m_end(0)
+        , m_max(0)
+        , m_buffer(0)
+        , m_globalObject(0)
+    {
+        // Verify that our values will play nice with mmap and VirtualAlloc.
+        ASSERT(isPageAligned(maxGlobals));
+        ASSERT(isPageAligned(capacity));
+
+        size_t bufferLength = (capacity + maxGlobals) * sizeof(Register);
+    #if HAVE(MMAP)
+        m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
+        if (m_buffer == MAP_FAILED) {
+            fprintf(stderr, "Could not allocate register file: %d\n", errno);
+            CRASH();
+        }
+    #elif HAVE(VIRTUALALLOC)
+        m_buffer = static_cast<Register*>(VirtualAlloc(0, roundUpAllocationSize(bufferLength, commitSize), MEM_RESERVE, PAGE_READWRITE));
+        if (!m_buffer) {
+    #if !PLATFORM(WIN_CE)
+            fprintf(stderr, "Could not allocate register file: %d\n", errno);
+    #endif
+            CRASH();
+        }
+        size_t committedSize = roundUpAllocationSize(maxGlobals * sizeof(Register), commitSize);
+        void* commitCheck = VirtualAlloc(m_buffer, committedSize, MEM_COMMIT, PAGE_READWRITE);
+        if (commitCheck != m_buffer) {
+    #if !PLATFORM(WIN_CE)
+            fprintf(stderr, "Could not allocate register file: %d\n", errno);
+    #endif
+            CRASH();
+        }
+        m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_buffer) + committedSize);
+    #else
+        #error "Don't know how to reserve virtual memory on this platform."
+    #endif
+        m_start = m_buffer + maxGlobals;
+        m_end = m_start;
+        m_maxUsed = m_end;
+        m_max = m_start + capacity;
+    }
+
+    inline void RegisterFile::shrink(Register* newEnd)
+    {
+        if (newEnd >= m_end)
+            return;
+        m_end = newEnd;
+        if (m_end == m_start && (m_maxUsed - m_start) > maxExcessCapacity)
+            releaseExcessCapacity();
+    }
+
+    inline bool RegisterFile::grow(Register* newEnd)
+    {
+        if (newEnd < m_end)
+            return true;
+
+        if (newEnd > m_max)
+            return false;
+
+#if !HAVE(MMAP) && HAVE(VIRTUALALLOC)
+        if (newEnd > m_commitEnd) {
+            size_t size = roundUpAllocationSize(reinterpret_cast<char*>(newEnd) - reinterpret_cast<char*>(m_commitEnd), commitSize);
+            if (!VirtualAlloc(m_commitEnd, size, MEM_COMMIT, PAGE_READWRITE)) {
+#if !PLATFORM(WIN_CE)
+                fprintf(stderr, "Could not allocate register file: %d\n", errno);
+#endif
+                CRASH();
+            }
+            m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_commitEnd) + size);
+        }
+#endif
+
+        if (newEnd > m_maxUsed)
+            m_maxUsed = newEnd;
+
+        m_end = newEnd;
+        return true;
+    }
+
 } // namespace JSC
 
 #endif // RegisterFile_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 154125642e..18261f8f39 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -26,8 +26,6 @@
 #ifndef ExecutableAllocator_h
 #define ExecutableAllocator_h
 
-#if ENABLE(ASSEMBLER)
-
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -38,6 +36,32 @@
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#define PROTECTION_FLAGS_RW (PROT_READ | PROT_WRITE)
+#define PROTECTION_FLAGS_RX (PROT_READ | PROT_EXEC)
+#define INITIAL_PROTECTION_FLAGS PROTECTION_FLAGS_RX
+#else
+#define INITIAL_PROTECTION_FLAGS (PROT_READ | PROT_WRITE | PROT_EXEC)
+#endif
+
+namespace JSC {
+
+inline size_t roundUpAllocationSize(size_t request, size_t granularity)
+{
+    if ((std::numeric_limits<size_t>::max() - granularity) <= request)
+        CRASH(); // Allocation is too large
+    
+    // Round up to next page boundary
+    size_t size = request + (granularity - 1);
+    size = size & ~(granularity - 1);
+    ASSERT(size >= request);
+    return size;
+}
+
+}
+
+#if ENABLE(ASSEMBLER)
+
 namespace JSC {
 
 class ExecutablePool : public RefCounted<ExecutablePool> {
@@ -86,18 +110,6 @@ private:
     static Allocation systemAlloc(size_t n);
     static void systemRelease(const Allocation& alloc);
 
-    inline size_t roundUpAllocationSize(size_t request, size_t granularity)
-    {
-        if ((std::numeric_limits<size_t>::max() - granularity) <= request)
-            CRASH(); // Allocation is too large
-        
-        // Round up to next page boundary
-        size_t size = request + (granularity - 1);
-        size = size & ~(granularity - 1);
-        ASSERT(size >= request);
-        return size;
-    }
-
     ExecutablePool(size_t n);
 
     void* poolAllocate(size_t n);
@@ -108,6 +120,8 @@ private:
 };
 
 class ExecutableAllocator {
+    enum ProtectionSeting { Writable, Executable };
+
 public:
     static size_t pageSize;
     ExecutableAllocator()
@@ -137,7 +151,40 @@ public:
         return pool.release();
     }
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+    static void makeWritable(void* start, size_t size) { reprotectRegion(start, size, Writable); }
+    static void makeExecutable(void* start, size_t size) { reprotectRegion(start, size, Executable); }
+
+    class MakeWritable {
+    public:
+        MakeWritable(void* start, size_t size)
+            : m_start(start)
+            , m_size(size)
+        {
+            makeWritable(start, size);
+        }
+
+        ~MakeWritable()
+        {
+            makeExecutable(m_start, m_size);
+        }
+
+    private:
+        void* m_start;
+        size_t m_size;
+    };
+#else
+    static void makeWritable(void*, size_t) {}
+    static void makeExecutable(void*, size_t) {}
+    class MakeWritable { public: MakeWritable(void*, size_t) {} };
+#endif
+
 private:
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+    static void reprotectRegion(void*, size_t, ProtectionSeting);
+#endif
+
     RefPtr<ExecutablePool> m_smallAllocationPool;
     static void intializePageSize();
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
new file mode 100644
index 0000000000..7682b9c642
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -0,0 +1,447 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "ExecutableAllocator.h"
+
+#include <errno.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(MAC) && PLATFORM(X86_64)
+
+#include "TCSpinLock.h"
+#include <mach/mach_init.h>
+#include <mach/vm_map.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#include <wtf/AVLTree.h>
+#include <wtf/VMTags.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+#define TWO_GB (2u * 1024u * 1024u * 1024u)
+#define SIXTEEN_MB (16u * 1024u * 1024u)
+
+// FreeListEntry describes a free chunk of memory, stored in the freeList.
+struct FreeListEntry {
+    FreeListEntry(void* pointer, size_t size)
+        : pointer(pointer)
+        , size(size)
+        , nextEntry(0)
+        , less(0)
+        , greater(0)
+        , balanceFactor(0)
+    {
+    }
+
+    // All entries of the same size share a single entry
+    // in the AVLTree, and are linked together in a linked
+    // list, using nextEntry.
+    void* pointer;
+    size_t size;
+    FreeListEntry* nextEntry;
+
+    // These fields are used by AVLTree.
+    FreeListEntry* less;
+    FreeListEntry* greater;
+    int balanceFactor;
+};
+
+// Abstractor class for use in AVLTree.
+// Nodes in the AVLTree are of type FreeListEntry, keyed on
+// (and thus sorted by) their size.
+struct AVLTreeAbstractorForFreeList {
+    typedef FreeListEntry* handle;
+    typedef int32_t size;
+    typedef size_t key;
+
+    handle get_less(handle h) { return h->less; }
+    void set_less(handle h, handle lh) { h->less = lh; }
+    handle get_greater(handle h) { return h->greater; }
+    void set_greater(handle h, handle gh) { h->greater = gh; }
+    int get_balance_factor(handle h) { return h->balanceFactor; }
+    void set_balance_factor(handle h, int bf) { h->balanceFactor = bf; }
+
+    static handle null() { return 0; }
+
+    int compare_key_key(key va, key vb) { return va - vb; }
+    int compare_key_node(key k, handle h) { return compare_key_key(k, h->size); }
+    int compare_node_node(handle h1, handle h2) { return compare_key_key(h1->size, h2->size); }
+};
+
+// Used to reverse sort an array of FreeListEntry pointers.
+static int reverseSortFreeListEntriesByPointer(const void* leftPtr, const void* rightPtr)
+{
+    FreeListEntry* left = *(FreeListEntry**)leftPtr;
+    FreeListEntry* right = *(FreeListEntry**)rightPtr;
+
+    return (intptr_t)(right->pointer) - (intptr_t)(left->pointer);
+}
+
+// Used to reverse sort an array of pointers.
+static int reverseSortCommonSizedAllocations(const void* leftPtr, const void* rightPtr)
+{
+    void* left = *(void**)leftPtr;
+    void* right = *(void**)rightPtr;
+
+    return (intptr_t)right - (intptr_t)left;
+}
+
+class FixedVMPoolAllocator
+{
+    // The free list is stored in a sorted tree.
+    typedef AVLTree<AVLTreeAbstractorForFreeList, 40> SizeSortedFreeTree;
+
+    // Use madvise as apropriate to prevent freed pages from being spilled,
+    // and to attempt to ensure that used memory is reported correctly.
+#if HAVE(MADV_FREE_REUSE)
+    void release(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
+    }
+
+    void reuse(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_FREE_REUSE) == -1 && errno == EAGAIN) { }
+    }
+#elif HAVE(MADV_DONTNEED)
+    void release(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_DONTNEED) == -1 && errno == EAGAIN) { }
+    }
+
+    void reuse(void*, size_t) {}
+#else
+    void release(void*, size_t) {}
+    void reuse(void*, size_t) {}
+#endif
+
+    // All addition to the free list should go through this method, rather than
+    // calling insert directly, to avoid multiple entries beging added with the
+    // same key.  All nodes being added should be singletons, they should not
+    // already be a part of a chain.
+    void addToFreeList(FreeListEntry* entry)
+    {
+        ASSERT(!entry->nextEntry);
+
+        if (entry->size == m_commonSize) {
+            m_commonSizedAllocations.append(entry->pointer);
+            delete entry;
+        } else if (FreeListEntry* entryInFreeList = m_freeList.search(entry->size, m_freeList.EQUAL)) {
+            // m_freeList already contain an entry for this size - insert this node into the chain.
+            entry->nextEntry = entryInFreeList->nextEntry;
+            entryInFreeList->nextEntry = entry;
+        } else
+            m_freeList.insert(entry);
+    }
+
+    // We do not attempt to coalesce addition, which may lead to fragmentation;
+    // instead we periodically perform a sweep to try to coalesce neigboring
+    // entries in m_freeList.  Presently this is triggered at the point 16MB
+    // of memory has been released.
+    void coalesceFreeSpace()
+    {
+        Vector<FreeListEntry*> freeListEntries;
+        SizeSortedFreeTree::Iterator iter;
+        iter.start_iter_least(m_freeList);
+
+        // Empty m_freeList into a Vector.
+        for (FreeListEntry* entry; (entry = *iter); ++iter) {
+            // Each entry in m_freeList might correspond to multiple
+            // free chunks of memory (of the same size).  Walk the chain
+            // (this is likely of couse only be one entry long!) adding
+            // each entry to the Vector (at reseting the next in chain
+            // pointer to separate each node out).
+            FreeListEntry* next;
+            do {
+                next = entry->nextEntry;
+                entry->nextEntry = 0;
+                freeListEntries.append(entry);
+            } while ((entry = next));
+        }
+        // All entries are now in the Vector; purge the tree.
+        m_freeList.purge();
+
+        // Reverse-sort the freeListEntries and m_commonSizedAllocations Vectors.
+        // We reverse-sort so that we can logically work forwards through memory,
+        // whilst popping items off the end of the Vectors using last() and removeLast().
+        qsort(freeListEntries.begin(), freeListEntries.size(), sizeof(FreeListEntry*), reverseSortFreeListEntriesByPointer);
+        qsort(m_commonSizedAllocations.begin(), m_commonSizedAllocations.size(), sizeof(void*), reverseSortCommonSizedAllocations);
+
+        // The entries from m_commonSizedAllocations that cannot be
+        // coalesced into larger chunks will be temporarily stored here.
+        Vector<void*> newCommonSizedAllocations;
+
+        // Keep processing so long as entries remain in either of the vectors.
+        while (freeListEntries.size() || m_commonSizedAllocations.size()) {
+            // We're going to try to find a FreeListEntry node that we can coalesce onto.
+            FreeListEntry* coalescionEntry = 0;
+
+            // Is the lowest addressed chunk of free memory of common-size, or is it in the free list?
+            if (m_commonSizedAllocations.size() && (!freeListEntries.size() || (m_commonSizedAllocations.last() < freeListEntries.last()->pointer))) {
+                // Pop an item from the m_commonSizedAllocations vector - this is the lowest
+                // addressed free chunk.  Find out the begin and end addresses of the memory chunk.
+                void* begin = m_commonSizedAllocations.last();
+                void* end = (void*)((intptr_t)begin + m_commonSize);
+                m_commonSizedAllocations.removeLast();
+
+                // Try to find another free chunk abutting onto the end of the one we have already found.
+                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
+                    // There is an existing FreeListEntry for the next chunk of memory!
+                    // we can reuse this.  Pop it off the end of m_freeList.
+                    coalescionEntry = freeListEntries.last();
+                    freeListEntries.removeLast();
+                    // Update the existing node to include the common-sized chunk that we also found. 
+                    coalescionEntry->pointer = (void*)((intptr_t)coalescionEntry->pointer - m_commonSize);
+                    coalescionEntry->size += m_commonSize;
+                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
+                    // There is a second common-sized chunk that can be coalesced.
+                    // Allocate a new node.
+                    m_commonSizedAllocations.removeLast();
+                    coalescionEntry = new FreeListEntry(begin, 2 * m_commonSize);
+                } else {
+                    // Nope - this poor little guy is all on his own. :-(
+                    // Add him into the newCommonSizedAllocations vector for now, we're
+                    // going to end up adding him back into the m_commonSizedAllocations
+                    // list when we're done.
+                    newCommonSizedAllocations.append(begin);
+                    continue;
+                }
+            } else {
+                ASSERT(freeListEntries.size());
+                ASSERT(!m_commonSizedAllocations.size() || (freeListEntries.last()->pointer < m_commonSizedAllocations.last()));
+                // The lowest addressed item is from m_freeList; pop it from the Vector.
+                coalescionEntry = freeListEntries.last();
+                freeListEntries.removeLast();
+            }
+            
+            // Right, we have a FreeListEntry, we just need check if there is anything else
+            // to coalesce onto the end.
+            ASSERT(coalescionEntry);
+            while (true) {
+                // Calculate the end address of the chunk we have found so far.
+                void* end = (void*)((intptr_t)coalescionEntry->pointer - coalescionEntry->size);
+
+                // Is there another chunk adjacent to the one we already have?
+                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
+                    // Yes - another FreeListEntry -pop it from the list.
+                    FreeListEntry* coalescee = freeListEntries.last();
+                    freeListEntries.removeLast();
+                    // Add it's size onto our existing node.
+                    coalescionEntry->size += coalescee->size;
+                    delete coalescee;
+                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
+                    // We can coalesce the next common-sized chunk.
+                    m_commonSizedAllocations.removeLast();
+                    coalescionEntry->size += m_commonSize;
+                } else
+                    break; // Nope, nothing to be added - stop here.
+            }
+
+            // We've coalesced everything we can onto the current chunk.
+            // Add it back into m_freeList.
+            addToFreeList(coalescionEntry);
+        }
+
+        // All chunks of free memory larger than m_commonSize should be
+        // back in m_freeList by now.  All that remains to be done is to
+        // copy the contents on the newCommonSizedAllocations back into
+        // the m_commonSizedAllocations Vector.
+        ASSERT(m_commonSizedAllocations.size() == 0);
+        m_commonSizedAllocations.append(newCommonSizedAllocations);
+    }
+
+public:
+
+    FixedVMPoolAllocator(size_t commonSize, size_t totalHeapSize)
+        : m_commonSize(commonSize)
+        , m_countFreedSinceLastCoalesce(0)
+        , m_totalHeapSize(totalHeapSize)
+    {
+        // Cook up an address to allocate at, using the following recipe:
+        //   17 bits of zero, stay in userspace kids.
+        //   26 bits of randomness for ASLR.
+        //   21 bits of zero, at least stay aligned within one level of the pagetables.
+        //
+        // But! - as a temporary workaround for some plugin problems (rdar://problem/6812854),
+        // for now instead of 2^26 bits of ASLR lets stick with 25 bits of randomization plus
+        // 2^24, which should put up somewhere in the middle of usespace (in the address range
+        // 0x200000000000 .. 0x5fffffffffff).
+        intptr_t randomLocation = arc4random() & ((1 << 25) - 1);
+        randomLocation += (1 << 24);
+        randomLocation <<= 21;
+        m_base = mmap(reinterpret_cast<void*>(randomLocation), m_totalHeapSize, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0);
+        if (!m_base)
+            CRASH();
+
+        // For simplicity, we keep all memory in m_freeList in a 'released' state.
+        // This means that we can simply reuse all memory when allocating, without
+        // worrying about it's previous state, and also makes coalescing m_freeList
+        // simpler since we need not worry about the possibility of coalescing released
+        // chunks with non-released ones.
+        release(m_base, m_totalHeapSize);
+        m_freeList.insert(new FreeListEntry(m_base, m_totalHeapSize));
+    }
+
+    void* alloc(size_t size)
+    {
+        void* result;
+
+        // Freed allocations of the common size are not stored back into the main
+        // m_freeList, but are instead stored in a separate vector.  If the request
+        // is for a common sized allocation, check this list.
+        if ((size == m_commonSize) && m_commonSizedAllocations.size()) {
+            result = m_commonSizedAllocations.last();
+            m_commonSizedAllocations.removeLast();
+        } else {
+            // Serach m_freeList for a suitable sized chunk to allocate memory from.
+            FreeListEntry* entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
+
+            // This would be bad news.
+            if (!entry) {
+                // Errk!  Lets take a last-ditch desparation attempt at defragmentation...
+                coalesceFreeSpace();
+                // Did that free up a large enough chunk?
+                entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
+                // No?...  *BOOM!*
+                if (!entry)
+                    CRASH();
+            }
+            ASSERT(entry->size != m_commonSize);
+
+            // Remove the entry from m_freeList.  But! -
+            // Each entry in the tree may represent a chain of multiple chunks of the
+            // same size, and we only want to remove one on them.  So, if this entry
+            // does have a chain, just remove the first-but-one item from the chain.
+            if (FreeListEntry* next = entry->nextEntry) {
+                // We're going to leave 'entry' in the tree; remove 'next' from its chain.
+                entry->nextEntry = next->nextEntry;
+                next->nextEntry = 0;
+                entry = next;
+            } else
+                m_freeList.remove(entry->size);
+
+            // Whoo!, we have a result!
+            ASSERT(entry->size >= size);
+            result = entry->pointer;
+
+            // If the allocation exactly fits the chunk we found in the,
+            // m_freeList then the FreeListEntry node is no longer needed.
+            if (entry->size == size)
+                delete entry;
+            else {
+                // There is memory left over, and it is not of the common size.
+                // We can reuse the existing FreeListEntry node to add this back
+                // into m_freeList.
+                entry->pointer = (void*)((intptr_t)entry->pointer + size);
+                entry->size -= size;
+                addToFreeList(entry);
+            }
+        }
+
+        // Call reuse to report to the operating system that this memory is in use.
+        ASSERT(isWithinVMPool(result, size));
+        reuse(result, size);
+        return result;
+    }
+
+    void free(void* pointer, size_t size)
+    {
+        // Call release to report to the operating system that this
+        // memory is no longer in use, and need not be paged out.
+        ASSERT(isWithinVMPool(pointer, size));
+        release(pointer, size);
+
+        // Common-sized allocations are stored in the m_commonSizedAllocations
+        // vector; all other freed chunks are added to m_freeList.
+        if (size == m_commonSize)
+            m_commonSizedAllocations.append(pointer);
+        else
+            addToFreeList(new FreeListEntry(pointer, size));
+
+        // Do some housekeeping.  Every time we reach a point that
+        // 16MB of allocations have been freed, sweep m_freeList
+        // coalescing any neighboring fragments.
+        m_countFreedSinceLastCoalesce += size;
+        if (m_countFreedSinceLastCoalesce >= SIXTEEN_MB) {
+            m_countFreedSinceLastCoalesce = 0;
+            coalesceFreeSpace();
+        }
+    }
+
+private:
+
+#ifndef NDEBUG
+    bool isWithinVMPool(void* pointer, size_t size)
+    {
+        return pointer >= m_base && (reinterpret_cast<char*>(pointer) + size <= reinterpret_cast<char*>(m_base) + m_totalHeapSize);
+    }
+#endif
+
+    // Freed space from the most common sized allocations will be held in this list, ...
+    const size_t m_commonSize;
+    Vector<void*> m_commonSizedAllocations;
+
+    // ... and all other freed allocations are held in m_freeList.
+    SizeSortedFreeTree m_freeList;
+
+    // This is used for housekeeping, to trigger defragmentation of the freed lists.
+    size_t m_countFreedSinceLastCoalesce;
+
+    void* m_base;
+    size_t m_totalHeapSize;
+};
+
+void ExecutableAllocator::intializePageSize()
+{
+    ExecutableAllocator::pageSize = getpagesize();
+}
+
+static FixedVMPoolAllocator* allocator = 0;
+static SpinLock spinlock = SPINLOCK_INITIALIZER;
+
+ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t size)
+{
+  SpinLockHolder lock_holder(&spinlock);
+
+    if (!allocator)
+        allocator = new FixedVMPoolAllocator(JIT_ALLOCATOR_LARGE_ALLOC_SIZE, TWO_GB);
+    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(allocator->alloc(size)), size};
+    return alloc;
+}
+
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& allocation) 
+{
+  SpinLockHolder lock_holder(&spinlock);
+
+    ASSERT(allocator);
+    allocator->free(allocation.pages, allocation.size);
+}
+
+}
+
+#endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 21955d7829..4bd5a2c6e9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -31,9 +31,12 @@
 
 #include <sys/mman.h>
 #include <unistd.h>
+#include <wtf/VMTags.h>
 
 namespace JSC {
 
+#if !(PLATFORM(MAC) && PLATFORM(X86_64))
+
 void ExecutableAllocator::intializePageSize()
 {
     ExecutableAllocator::pageSize = getpagesize();
@@ -41,16 +44,39 @@ void ExecutableAllocator::intializePageSize()
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
 {
-    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(mmap(NULL, n, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0)), n};
+    ExecutablePool::Allocation alloc = { reinterpret_cast<char*>(mmap(NULL, n, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0)), n };
     return alloc;
 }
 
-void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc) 
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
 { 
     int result = munmap(alloc.pages, alloc.size);
     ASSERT_UNUSED(result, !result);
 }
 
+#endif // !(PLATFORM(MAC) && PLATFORM(X86_64))
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
+{
+    if (!pageSize)
+        intializePageSize();
+
+    // Calculate the start of the page containing this region,
+    // and account for this extra memory within size.
+    intptr_t startPtr = reinterpret_cast<intptr_t>(start);
+    intptr_t pageStartPtr = startPtr & ~(pageSize - 1);
+    void* pageStart = reinterpret_cast<void*>(pageStartPtr);
+    size += (startPtr - pageStartPtr);
+
+    // Round size up
+    size += (pageSize - 1);
+    size &= ~(pageSize - 1);
+
+    mprotect(pageStart, size, (setting == Writable) ? PROTECTION_FLAGS_RW : PROTECTION_FLAGS_RX);
+}
+#endif
+
 }
 
 #endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index 7467f81a65..a9ba7d0ea1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -51,6 +51,10 @@ void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
     VirtualFree(alloc.pages, 0, MEM_RELEASE); 
 }
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
+#endif
+
 }
 
 #endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index 0ce9bc15d5..7f2656c821 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -1,3 +1,4 @@
+
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
@@ -29,10 +30,11 @@
 #if ENABLE(JIT)
 
 #include "CodeBlock.h"
+#include "Interpreter.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
-#include "Interpreter.h"
 #include "ResultType.h"
 #include "SamplingTool.h"
 
@@ -44,159 +46,19 @@ using namespace std;
 
 namespace JSC {
 
-COMPILE_ASSERT(STUB_ARGS_code == 0xC, STUB_ARGS_code_is_C);
-COMPILE_ASSERT(STUB_ARGS_callFrame == 0xE, STUB_ARGS_callFrame_is_E);
-
-#if COMPILER(GCC) && PLATFORM(X86)
-
-#if PLATFORM(DARWIN)
-#define SYMBOL_STRING(name) "_" #name
-#else
-#define SYMBOL_STRING(name) #name
-#endif
-
-asm(
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushl %ebp" "\n"
-    "movl %esp, %ebp" "\n"
-    "pushl %esi" "\n"
-    "pushl %edi" "\n"
-    "pushl %ebx" "\n"
-    "subl $0x1c, %esp" "\n"
-    "movl $512, %esi" "\n"
-    "movl 0x38(%esp), %edi" "\n" // Ox38 = 0x0E * 4, 0x0E = STUB_ARGS_callFrame (see assertion above)
-    "call *0x30(%esp)" "\n" // Ox30 = 0x0C * 4, 0x0C = STUB_ARGS_code (see assertion above)
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-
-asm(
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-    "call " SYMBOL_STRING(_ZN3JSC11Interpreter12cti_vm_throwEPvz) "\n"
-#else
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    "movl %esp, %ecx" "\n"
-#else // JIT_STUB_ARGUMENT_STACK
-    "movl %esp, 0(%esp)" "\n"
-#endif
-    "call " SYMBOL_STRING(_ZN3JSC11Interpreter12cti_vm_throwEPPv) "\n"
-#endif
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(GCC) && PLATFORM(X86_64)
-
-#if PLATFORM(DARWIN)
-#define SYMBOL_STRING(name) "_" #name
-#else
-#define SYMBOL_STRING(name) #name
-#endif
-
-asm(
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushq %rbp" "\n"
-    "movq %rsp, %rbp" "\n"
-    "pushq %r12" "\n"
-    "pushq %r13" "\n"
-    "pushq %rbx" "\n"
-    "subq $0x38, %rsp" "\n"
-    "movq $512, %r12" "\n"
-    "movq 0x70(%rsp), %r13" "\n" // Ox70 = 0x0E * 8, 0x0E = STUB_ARGS_callFrame (see assertion above)
-    "call *0x60(%rsp)" "\n" // Ox60 = 0x0C * 8, 0x0C = STUB_ARGS_code (see assertion above)
-    "addq $0x38, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
-);
-
-asm(
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(_ZN3JSC11Interpreter12cti_vm_throwEPPv) "\n"
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-#error "JIT_STUB_ARGUMENT configuration not supported."
-#endif
-    "addq $0x38, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(MSVC)
-
-extern "C" {
-    
-    __declspec(naked) JSValueEncodedAsPointer* ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValuePtr* exception, Profiler**, JSGlobalData*)
-    {
-        __asm {
-            push ebp;
-            mov ebp, esp;
-            push esi;
-            push edi;
-            push ebx;
-            sub esp, 0x1c;
-            mov esi, 512;
-            mov ecx, esp;
-            mov edi, [esp + 0x38];
-            call [esp + 0x30]; // Ox30 = 0x0C * 4, 0x0C = STUB_ARGS_code (see assertion above)
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-    
-    __declspec(naked) void ctiVMThrowTrampoline()
-    {
-        __asm {
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-            mov ecx, esp;
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-#error "JIT_STUB_ARGUMENT configuration not supported."
-#endif
-            call JSC::Interpreter::cti_vm_throw;
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-    
+void ctiPatchNearCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction)
+{
+    returnAddress.relinkNearCallerToTrampoline(newCalleeFunction);
 }
 
-#endif
-
-void ctiSetReturnAddress(void** where, void* what)
+void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction)
 {
-    *where = what;
+    returnAddress.relinkCallerToTrampoline(newCalleeFunction);
 }
 
-void ctiPatchCallByReturnAddress(void* where, void* what)
+void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, FunctionPtr newCalleeFunction)
 {
-    MacroAssembler::Jump::patch(where, what);
+    returnAddress.relinkCallerToFunction(newCalleeFunction);
 }
 
 JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock)
@@ -213,51 +75,31 @@ JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock)
 
 void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
 {
-    bool negated = (type == OpNStrictEq);
-
     unsigned dst = currentInstruction[1].u.operand;
     unsigned src1 = currentInstruction[2].u.operand;
     unsigned src2 = currentInstruction[3].u.operand;
 
-    emitGetVirtualRegisters(src1, X86::eax, src2, X86::edx);
-
-    // Check that bot are immediates, if so check if they're equal
-    Jump firstNotImmediate = emitJumpIfJSCell(X86::eax);
-    Jump secondNotImmediate = emitJumpIfJSCell(X86::edx);
-    Jump bothWereImmediatesButNotEqual = jne32(X86::edx, X86::eax);
-
-    // They are equal - set the result to true. (Or false, if negated).
-    move(ImmPtr(JSValuePtr::encode(jsBoolean(!negated))), X86::eax);
-    Jump bothWereImmediatesAndEqual = jump();
-
-    // eax was not an immediate, we haven't yet checked edx.
-    // If edx is also a JSCell, or is 0, then jump to a slow case,
-    // otherwise these values are not equal.
-    firstNotImmediate.link(this);
-    emitJumpSlowCaseIfJSCell(X86::edx);
-    addSlowCase(jePtr(X86::edx, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))));
-    Jump firstWasNotImmediate = jump();
-
-    // eax was an immediate, but edx wasn't.
-    // If eax is 0 jump to a slow case, otherwise these values are not equal.
-    secondNotImmediate.link(this);
-    addSlowCase(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))));
-
-    // We get here if the two values are different immediates, or one is 0 and the other is a JSCell.
-    // Vaelues are not equal, set the result to false.
-    bothWereImmediatesButNotEqual.link(this);
-    firstWasNotImmediate.link(this);
-    move(ImmPtr(JSValuePtr::encode(jsBoolean(negated))), X86::eax);
-    
-    bothWereImmediatesAndEqual.link(this);
+    emitGetVirtualRegisters(src1, regT0, src2, regT1);
+
+    // Jump to a slow case if either operand is a number, or if both are JSCell*s.
+    move(regT0, regT2);
+    orPtr(regT1, regT2);
+    addSlowCase(emitJumpIfJSCell(regT2));
+    addSlowCase(emitJumpIfImmediateNumber(regT2));
+
+    if (type == OpStrictEq)
+        set32(Equal, regT1, regT0, regT0);
+    else
+        set32(NotEqual, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+
     emitPutVirtualRegister(dst);
 }
 
-void JIT::emitSlowScriptCheck()
+void JIT::emitTimeoutCheck()
 {
-    Jump skipTimeout = jnzSub32(Imm32(1), timeoutCheckRegister);
-    emitCTICall(Interpreter::cti_timeout_check);
-    move(X86::eax, timeoutCheckRegister);
+    Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
+    JITStubCall(this, JITStubs::cti_timeout_check).call(timeoutCheckRegister);
     skipTimeout.link(this);
 
     killLastResultRegister();
@@ -268,20 +110,32 @@ void JIT::emitSlowScriptCheck()
     m_bytecodeIndex += OPCODE_LENGTH(name); \
     break;
 
-#define CTI_COMPILE_BINARY_OP(name) \
+#define DEFINE_BINARY_OP(name) \
+    case name: { \
+        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2); \
+        stubCall.call(currentInstruction[1].u.operand); \
+        NEXT_OPCODE(name); \
+    }
+
+#define DEFINE_UNARY_OP(name) \
     case name: { \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx); \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx); \
-        emitCTICall(Interpreter::cti_##name); \
-        emitPutVirtualRegister(currentInstruction[1].u.operand); \
+        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
+        stubCall.call(currentInstruction[1].u.operand); \
         NEXT_OPCODE(name); \
     }
 
-#define CTI_COMPILE_UNARY_OP(name) \
+#define DEFINE_OP(name) \
     case name: { \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx); \
-        emitCTICall(Interpreter::cti_##name); \
-        emitPutVirtualRegister(currentInstruction[1].u.operand); \
+        emit_##name(currentInstruction); \
+        NEXT_OPCODE(name); \
+    }
+
+#define DEFINE_SLOWCASE_OP(name) \
+    case name: { \
+        emitSlow_##name(currentInstruction, iter); \
         NEXT_OPCODE(name); \
     }
 
@@ -289,9 +143,10 @@ void JIT::privateCompileMainPass()
 {
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
     unsigned instructionCount = m_codeBlock->instructions().size();
-    unsigned propertyAccessInstructionIndex = 0;
-    unsigned globalResolveInfoIndex = 0;
-    unsigned callLinkInfoIndex = 0;
+
+    m_propertyAccessInstructionIndex = 0;
+    m_globalResolveInfoIndex = 0;
+    m_callLinkInfoIndex = 0;
 
     for (m_bytecodeIndex = 0; m_bytecodeIndex < instructionCount; ) {
         Instruction* currentInstruction = instructionsBegin + m_bytecodeIndex;
@@ -299,918 +154,126 @@ void JIT::privateCompileMainPass()
 
 #if ENABLE(OPCODE_SAMPLING)
         if (m_bytecodeIndex > 0) // Avoid the overhead of sampling op_enter twice.
-            store32(m_interpreter->sampler()->encodeSample(currentInstruction), m_interpreter->sampler()->sampleSlot());
+            sampleInstruction(currentInstruction);
 #endif
 
+        if (m_labels[m_bytecodeIndex].isUsed())
+            killLastResultRegister();
+        
         m_labels[m_bytecodeIndex] = label();
-        OpcodeID opcodeID = m_interpreter->getOpcodeID(currentInstruction->u.opcode);
-
-        switch (opcodeID) {
-        case op_mov: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_mov);
-        }
-        case op_add: {
-            compileFastArith_op_add(currentInstruction);
-            NEXT_OPCODE(op_add);
-        }
-        case op_end: {
-            if (m_codeBlock->needsFullScopeChain())
-                emitCTICall(Interpreter::cti_op_end);
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-            push(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
-            ret();
-            NEXT_OPCODE(op_end);
-        }
-        case op_jmp: {
-            unsigned target = currentInstruction[1].u.operand;
-            addJump(jump(), target + 1);
-            NEXT_OPCODE(op_jmp);
-        }
-        case op_pre_inc: {
-            compileFastArith_op_pre_inc(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_pre_inc);
-        }
-        case op_loop: {
-            emitSlowScriptCheck();
-
-            unsigned target = currentInstruction[1].u.operand;
-            addJump(jump(), target + 1);
-            NEXT_OPCODE(op_end);
-        }
-        case op_loop_if_less: {
-            emitSlowScriptCheck();
-
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = JSImmediate::intValue(getConstantOperand(op2));
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(jl32(X86::eax, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::edx);
-                addJump(jl32(X86::eax, X86::edx), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_loop_if_lesseq: {
-            emitSlowScriptCheck();
-
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = JSImmediate::intValue(getConstantOperand(op2));
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(jle32(X86::eax, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::edx);
-                addJump(jle32(X86::eax, X86::edx), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_new_object: {
-            emitCTICall(Interpreter::cti_op_new_object);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_object);
-        }
-        case op_put_by_id: {
-            compilePutByIdHotPath(currentInstruction[1].u.operand, &(m_codeBlock->identifier(currentInstruction[2].u.operand)), currentInstruction[3].u.operand, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_put_by_id);
-        }
-        case op_get_by_id: {
-            compileGetByIdHotPath(currentInstruction[1].u.operand, currentInstruction[2].u.operand, &(m_codeBlock->identifier(currentInstruction[3].u.operand)), propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_get_by_id);
-        }
-        case op_instanceof: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax); // value
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::ecx); // baseVal
-            emitGetVirtualRegister(currentInstruction[4].u.operand, X86::edx); // proto
-
-            // check if any are immediates
-            move(X86::eax, X86::ebx);
-            orPtr(X86::ecx, X86::ebx);
-            orPtr(X86::edx, X86::ebx);
-            emitJumpSlowCaseIfNotJSCell(X86::ebx);
-
-            // check that all are object type - this is a bit of a bithack to avoid excess branching;
-            // we check that the sum of the three type codes from Structures is exactly 3 * ObjectType,
-            // this works because NumberType and StringType are smaller
-            move(Imm32(3 * ObjectType), X86::ebx);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::eax);
-            loadPtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            loadPtr(Address(X86::edx, FIELD_OFFSET(JSCell, m_structure)), X86::edx);
-            sub32(Address(X86::eax, FIELD_OFFSET(Structure, m_typeInfo.m_type)), X86::ebx);
-            sub32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_type)), X86::ebx);
-            addSlowCase(jne32(Address(X86::edx, FIELD_OFFSET(Structure, m_typeInfo.m_type)), X86::ebx));
-
-            // check that baseVal's flags include ImplementsHasInstance but not OverridesHasInstance
-            load32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), X86::ecx);
-            and32(Imm32(ImplementsHasInstance | OverridesHasInstance), X86::ecx);
-            addSlowCase(jne32(X86::ecx, Imm32(ImplementsHasInstance)));
-
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::ecx); // reload value
-            emitGetVirtualRegister(currentInstruction[4].u.operand, X86::edx); // reload proto
-
-            // optimistically load true result
-            move(ImmPtr(JSValuePtr::encode(jsBoolean(true))), X86::eax);
-
-            Label loop(this);
-
-            // load value's prototype
-            loadPtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            loadPtr(Address(X86::ecx, FIELD_OFFSET(Structure, m_prototype)), X86::ecx);
-
-            Jump exit = jePtr(X86::ecx, X86::edx);
-
-            jnePtr(X86::ecx, ImmPtr(JSValuePtr::encode(jsNull())), loop);
-
-            move(ImmPtr(JSValuePtr::encode(jsBoolean(false))), X86::eax);
-
-            exit.link(this);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_instanceof);
-        }
-        case op_del_by_id: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitCTICall(Interpreter::cti_op_del_by_id);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_del_by_id);
-        }
-        case op_mul: {
-            compileFastArith_op_mul(currentInstruction);
-            NEXT_OPCODE(op_mul);
-        }
-        case op_new_func: {
-            FuncDeclNode* func = m_codeBlock->function(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(func, 1);
-            emitCTICall(Interpreter::cti_op_new_func);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_func);
-        }
-        case op_call: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_call);
-        }
-        case op_call_eval: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_call_eval);
-        }
-        case op_construct: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_construct);
-        }
-        case op_get_global_var: {
-            JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[2].u.jsCell);
-            move(ImmPtr(globalObject), X86::eax);
-            emitGetVariableObjectRegister(X86::eax, currentInstruction[3].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_global_var);
-        }
-        case op_put_global_var: {
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::edx);
-            JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[1].u.jsCell);
-            move(ImmPtr(globalObject), X86::eax);
-            emitPutVariableObjectRegister(X86::edx, X86::eax, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_put_global_var);
-        }
-        case op_get_scoped_var: {
-            int skip = currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain();
-
-            emitGetFromCallFrameHeader(RegisterFile::ScopeChain, X86::eax);
-            while (skip--)
-                loadPtr(Address(X86::eax, FIELD_OFFSET(ScopeChainNode, next)), X86::eax);
-
-            loadPtr(Address(X86::eax, FIELD_OFFSET(ScopeChainNode, object)), X86::eax);
-            emitGetVariableObjectRegister(X86::eax, currentInstruction[2].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_scoped_var);
-        }
-        case op_put_scoped_var: {
-            int skip = currentInstruction[2].u.operand + m_codeBlock->needsFullScopeChain();
-
-            emitGetFromCallFrameHeader(RegisterFile::ScopeChain, X86::edx);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::eax);
-            while (skip--)
-                loadPtr(Address(X86::edx, FIELD_OFFSET(ScopeChainNode, next)), X86::edx);
-
-            loadPtr(Address(X86::edx, FIELD_OFFSET(ScopeChainNode, object)), X86::edx);
-            emitPutVariableObjectRegister(X86::eax, X86::edx, currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_put_scoped_var);
-        }
-        case op_tear_off_activation: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_tear_off_activation);
-            NEXT_OPCODE(op_tear_off_activation);
-        }
-        case op_tear_off_arguments: {
-            emitCTICall(Interpreter::cti_op_tear_off_arguments);
-            NEXT_OPCODE(op_tear_off_arguments);
-        }
-        case op_ret: {
-            // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-            if (m_codeBlock->needsFullScopeChain())
-                emitCTICall(Interpreter::cti_op_ret_scopeChain);
-
-            // Return the result in %eax.
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            // Grab the return address.
-            emitGetFromCallFrameHeader(RegisterFile::ReturnPC, X86::edx);
-
-            // Restore our caller's "r".
-            emitGetFromCallFrameHeader(RegisterFile::CallerFrame, callFrameRegister);
-
-            // Return.
-            push(X86::edx);
-            ret();
-
-            NEXT_OPCODE(op_ret);
-        }
-        case op_new_array: {
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 1);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand, 2);
-            emitCTICall(Interpreter::cti_op_new_array);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_array);
-        }
-        case op_resolve: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve);
-        }
-        case op_construct_verify: {
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
 
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addSlowCase(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
+        switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+        DEFINE_BINARY_OP(op_del_by_val)
+        DEFINE_BINARY_OP(op_div)
+        DEFINE_BINARY_OP(op_in)
+        DEFINE_BINARY_OP(op_less)
+        DEFINE_BINARY_OP(op_lesseq)
+        DEFINE_BINARY_OP(op_urshift)
+        DEFINE_UNARY_OP(op_get_pnames)
+        DEFINE_UNARY_OP(op_is_boolean)
+        DEFINE_UNARY_OP(op_is_function)
+        DEFINE_UNARY_OP(op_is_number)
+        DEFINE_UNARY_OP(op_is_object)
+        DEFINE_UNARY_OP(op_is_string)
+        DEFINE_UNARY_OP(op_is_undefined)
+        DEFINE_UNARY_OP(op_negate)
+        DEFINE_UNARY_OP(op_typeof)
+
+        DEFINE_OP(op_add)
+        DEFINE_OP(op_bitand)
+        DEFINE_OP(op_bitnot)
+        DEFINE_OP(op_bitor)
+        DEFINE_OP(op_bitxor)
+        DEFINE_OP(op_call)
+        DEFINE_OP(op_call_eval)
+        DEFINE_OP(op_call_varargs)
+        DEFINE_OP(op_catch)
+        DEFINE_OP(op_construct)
+        DEFINE_OP(op_construct_verify)
+        DEFINE_OP(op_convert_this)
+        DEFINE_OP(op_init_arguments)
+        DEFINE_OP(op_create_arguments)
+        DEFINE_OP(op_debug)
+        DEFINE_OP(op_del_by_id)
+        DEFINE_OP(op_end)
+        DEFINE_OP(op_enter)
+        DEFINE_OP(op_enter_with_activation)
+        DEFINE_OP(op_eq)
+        DEFINE_OP(op_eq_null)
+        DEFINE_OP(op_get_by_id)
+        DEFINE_OP(op_get_by_val)
+        DEFINE_OP(op_get_global_var)
+        DEFINE_OP(op_get_scoped_var)
+        DEFINE_OP(op_instanceof)
+        DEFINE_OP(op_jeq_null)
+        DEFINE_OP(op_jfalse)
+        DEFINE_OP(op_jmp)
+        DEFINE_OP(op_jmp_scopes)
+        DEFINE_OP(op_jneq_null)
+        DEFINE_OP(op_jneq_ptr)
+        DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jnlesseq)
+        DEFINE_OP(op_jsr)
+        DEFINE_OP(op_jtrue)
+        DEFINE_OP(op_load_varargs)
+        DEFINE_OP(op_loop)
+        DEFINE_OP(op_loop_if_less)
+        DEFINE_OP(op_loop_if_lesseq)
+        DEFINE_OP(op_loop_if_true)
+        DEFINE_OP(op_lshift)
+        DEFINE_OP(op_method_check)
+        DEFINE_OP(op_mod)
+        DEFINE_OP(op_mov)
+        DEFINE_OP(op_mul)
+        DEFINE_OP(op_neq)
+        DEFINE_OP(op_neq_null)
+        DEFINE_OP(op_new_array)
+        DEFINE_OP(op_new_error)
+        DEFINE_OP(op_new_func)
+        DEFINE_OP(op_new_func_exp)
+        DEFINE_OP(op_new_object)
+        DEFINE_OP(op_new_regexp)
+        DEFINE_OP(op_next_pname)
+        DEFINE_OP(op_not)
+        DEFINE_OP(op_nstricteq)
+        DEFINE_OP(op_pop_scope)
+        DEFINE_OP(op_post_dec)
+        DEFINE_OP(op_post_inc)
+        DEFINE_OP(op_pre_dec)
+        DEFINE_OP(op_pre_inc)
+        DEFINE_OP(op_profile_did_call)
+        DEFINE_OP(op_profile_will_call)
+        DEFINE_OP(op_push_new_scope)
+        DEFINE_OP(op_push_scope)
+        DEFINE_OP(op_put_by_id)
+        DEFINE_OP(op_put_by_index)
+        DEFINE_OP(op_put_by_val)
+        DEFINE_OP(op_put_getter)
+        DEFINE_OP(op_put_global_var)
+        DEFINE_OP(op_put_scoped_var)
+        DEFINE_OP(op_put_setter)
+        DEFINE_OP(op_resolve)
+        DEFINE_OP(op_resolve_base)
+        DEFINE_OP(op_resolve_func)
+        DEFINE_OP(op_resolve_global)
+        DEFINE_OP(op_resolve_skip)
+        DEFINE_OP(op_resolve_with_base)
+        DEFINE_OP(op_ret)
+        DEFINE_OP(op_rshift)
+        DEFINE_OP(op_sret)
+        DEFINE_OP(op_strcat)
+        DEFINE_OP(op_stricteq)
+        DEFINE_OP(op_sub)
+        DEFINE_OP(op_switch_char)
+        DEFINE_OP(op_switch_imm)
+        DEFINE_OP(op_switch_string)
+        DEFINE_OP(op_tear_off_activation)
+        DEFINE_OP(op_tear_off_arguments)
+        DEFINE_OP(op_throw)
+        DEFINE_OP(op_to_jsnumber)
+        DEFINE_OP(op_to_primitive)
+        DEFINE_OP(op_unexpected_load)
 
-            NEXT_OPCODE(op_construct_verify);
-        }
-        case op_get_by_val: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNum(X86::edx);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
-            // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
-            // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
-            // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
-            // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
-            // extending since it makes it easier to re-tag the value in the slow case.
-            zeroExtend32ToPtr(X86::edx, X86::edx);
-#else
-            emitFastArithImmToInt(X86::edx);
-#endif
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            addSlowCase(jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr)));
-
-            // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::ecx);
-            addSlowCase(jae32(X86::edx, Address(X86::eax, FIELD_OFFSET(JSArray, m_fastAccessCutoff))));
-
-            // Get the value from the vector
-            loadPtr(BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_by_val);
-        }
-        case op_resolve_func: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve_func);
-            emitPutVirtualRegister(currentInstruction[2].u.operand, X86::edx);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_func);
-        }
-        case op_sub: {
-            compileBinaryArithOp(op_sub, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
-            NEXT_OPCODE(op_sub);
-        }
-        case op_put_by_val: {
-            emitGetVirtualRegisters(currentInstruction[1].u.operand, X86::eax, currentInstruction[2].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNum(X86::edx);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            // See comment in op_get_by_val.
-            zeroExtend32ToPtr(X86::edx, X86::edx);
-#else
-            emitFastArithImmToInt(X86::edx);
-#endif
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            addSlowCase(jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr)));
-
-            // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::ecx);
-            Jump inFastVector = jb32(X86::edx, Address(X86::eax, FIELD_OFFSET(JSArray, m_fastAccessCutoff)));
-            // No; oh well, check if the access if within the vector - if so, we may still be okay.
-            addSlowCase(jae32(X86::edx, Address(X86::ecx, FIELD_OFFSET(ArrayStorage, m_vectorLength))));
-
-            // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-            // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-            addSlowCase(jzPtr(BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0]))));
-
-            // All good - put the value into the array.
-            inFastVector.link(this);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::eax);
-            storePtr(X86::eax, BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])));
-            NEXT_OPCODE(op_put_by_val);
-        }
-        CTI_COMPILE_BINARY_OP(op_lesseq)
-        case op_loop_if_true: {
-            emitSlowScriptCheck();
-
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            Jump isZero = jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate())));
-            addJump(emitJumpIfImmNum(X86::eax), target + 2);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(true)))), target + 2);
-            addSlowCase(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(false)))));
-
-            isZero.link(this);
-            NEXT_OPCODE(op_loop_if_true);
-        };
-        case op_resolve_base: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve_base);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_base);
-        }
-        case op_negate: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_negate);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_negate);
-        }
-        case op_resolve_skip: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain(), 2);
-            emitCTICall(Interpreter::cti_op_resolve_skip);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_skip);
-        }
-        case op_resolve_global: {
-            // Fast case
-            void* globalObject = currentInstruction[2].u.jsCell;
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            
-            unsigned currentIndex = globalResolveInfoIndex++;
-            void* structureAddress = &(m_codeBlock->globalResolveInfo(currentIndex).structure);
-            void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
-
-            // Check Structure of global object
-            move(ImmPtr(globalObject), X86::eax);
-            loadPtr(structureAddress, X86::edx);
-            Jump noMatch = jnePtr(X86::edx, Address(X86::eax, FIELD_OFFSET(JSCell, m_structure))); // Structures don't match
-
-            // Load cached property
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSGlobalObject, m_propertyStorage)), X86::eax);
-            load32(offsetAddr, X86::edx);
-            loadPtr(BaseIndex(X86::eax, X86::edx, ScalePtr), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            Jump end = jump();
-
-            // Slow case
-            noMatch.link(this);
-            emitPutJITStubArgConstant(globalObject, 1);
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgConstant(currentIndex, 3);
-            emitCTICall(Interpreter::cti_op_resolve_global);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            end.link(this);
-            NEXT_OPCODE(op_resolve_global);
-        }
-        CTI_COMPILE_BINARY_OP(op_div)
-        case op_pre_dec: {
-            compileFastArith_op_pre_dec(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_pre_dec);
-        }
-        case op_jnless: {
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = JSImmediate::intValue(getConstantOperand(op2));
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(jge32(X86::eax, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::edx);
-                addJump(jge32(X86::eax, X86::edx), target + 3);
-            }
-            NEXT_OPCODE(op_jnless);
-        }
-        case op_not: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), X86::eax);
-            addSlowCase(jnzPtr(X86::eax, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_not);
-        }
-        case op_jfalse: {
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))), target + 2);
-            Jump isNonZero = emitJumpIfImmNum(X86::eax);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(false)))), target + 2);
-            addSlowCase(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(true)))));
-
-            isNonZero.link(this);
-            NEXT_OPCODE(op_jfalse);
-        };
-        case op_jeq_null: {
-            unsigned src = currentInstruction[1].u.operand;
-            unsigned target = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addJump(jnz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
-            Jump wasNotImmediate = jump();
-
-            // Now handle the immediate cases - undefined & null
-            isImmediate.link(this);
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsNull()))), target + 2);            
-
-            wasNotImmediate.link(this);
-            NEXT_OPCODE(op_jeq_null);
-        };
-        case op_jneq_null: {
-            unsigned src = currentInstruction[1].u.operand;
-            unsigned target = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addJump(jz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
-            Jump wasNotImmediate = jump();
-
-            // Now handle the immediate cases - undefined & null
-            isImmediate.link(this);
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            addJump(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsNull()))), target + 2);            
-
-            wasNotImmediate.link(this);
-            NEXT_OPCODE(op_jneq_null);
-        }
-        case op_post_inc: {
-            compileFastArith_op_post_inc(currentInstruction[1].u.operand, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_post_inc);
-        }
-        case op_unexpected_load: {
-            JSValuePtr v = m_codeBlock->unexpectedConstant(currentInstruction[2].u.operand);
-            move(ImmPtr(JSValuePtr::encode(v)), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_unexpected_load);
-        }
-        case op_jsr: {
-            int retAddrDst = currentInstruction[1].u.operand;
-            int target = currentInstruction[2].u.operand;
-            DataLabelPtr storeLocation = storePtrWithPatch(Address(callFrameRegister, sizeof(Register) * retAddrDst));
-            addJump(jump(), target + 2);
-            m_jsrSites.append(JSRInfo(storeLocation, label()));
-            NEXT_OPCODE(op_jsr);
-        }
-        case op_sret: {
-            jump(Address(callFrameRegister, sizeof(Register) * currentInstruction[1].u.operand));
-            NEXT_OPCODE(op_sret);
-        }
-        case op_eq: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            sete32(X86::edx, X86::eax);
-            emitTagAsBoolImmediate(X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_eq);
-        }
-        case op_lshift: {
-            compileFastArith_op_lshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_lshift);
-        }
-        case op_bitand: {
-            compileFastArith_op_bitand(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_bitand);
-        }
-        case op_rshift: {
-            compileFastArith_op_rshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_rshift);
-        }
-        case op_bitnot: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            not32(X86::eax);
-            emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
-#else
-            xorPtr(Imm32(~JSImmediate::TagTypeInteger), X86::eax);
-#endif
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitnot);
-        }
-        case op_resolve_with_base: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve_with_base);
-            emitPutVirtualRegister(currentInstruction[2].u.operand, X86::edx);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_with_base);
-        }
-        case op_new_func_exp: {
-            FuncExprNode* func = m_codeBlock->functionExpression(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(func, 1);
-            emitCTICall(Interpreter::cti_op_new_func_exp);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_func_exp);
-        }
-        case op_mod: {
-            compileFastArith_op_mod(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_mod);
-        }
-        case op_jtrue: {
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            Jump isZero = jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate())));
-            addJump(emitJumpIfImmNum(X86::eax), target + 2);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(true)))), target + 2);
-            addSlowCase(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(false)))));
-
-            isZero.link(this);
-            NEXT_OPCODE(op_jtrue);
-        }
-        CTI_COMPILE_BINARY_OP(op_less)
-        case op_neq: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            setne32(X86::edx, X86::eax);
-            emitTagAsBoolImmediate(X86::eax);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_neq);
-        }
-        case op_post_dec: {
-            compileFastArith_op_post_dec(currentInstruction[1].u.operand, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_post_dec);
-        }
-        CTI_COMPILE_BINARY_OP(op_urshift)
-        case op_bitxor: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            xorPtr(X86::edx, X86::eax);
-            emitFastArithReTagImmediate(X86::eax, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitxor);
-        }
-        case op_new_regexp: {
-            RegExp* regExp = m_codeBlock->regexp(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(regExp, 1);
-            emitCTICall(Interpreter::cti_op_new_regexp);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_regexp);
-        }
-        case op_bitor: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            orPtr(X86::edx, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitor);
-        }
-        case op_throw: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_throw);
-#if PLATFORM(X86_64)
-            addPtr(Imm32(0x38), X86::esp);
-            pop(X86::ebx);
-            pop(X86::r13);
-            pop(X86::r12);
-            pop(X86::ebp);
-            ret();
-#else
-            addPtr(Imm32(0x1c), X86::esp);
-            pop(X86::ebx);
-            pop(X86::edi);
-            pop(X86::esi);
-            pop(X86::ebp);
-            ret();
-#endif
-            NEXT_OPCODE(op_throw);
-        }
-        case op_get_pnames: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_get_pnames);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_pnames);
-        }
-        case op_next_pname: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            unsigned target = currentInstruction[3].u.operand;
-            emitCTICall(Interpreter::cti_op_next_pname);
-            Jump endOfIter = jzPtr(X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            addJump(jump(), target + 3);
-            endOfIter.link(this);
-            NEXT_OPCODE(op_next_pname);
-        }
-        case op_push_scope: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_push_scope);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_push_scope);
-        }
-        case op_pop_scope: {
-            emitCTICall(Interpreter::cti_op_pop_scope);
-            NEXT_OPCODE(op_pop_scope);
-        }
-        CTI_COMPILE_UNARY_OP(op_typeof)
-        CTI_COMPILE_UNARY_OP(op_is_undefined)
-        CTI_COMPILE_UNARY_OP(op_is_boolean)
-        CTI_COMPILE_UNARY_OP(op_is_number)
-        CTI_COMPILE_UNARY_OP(op_is_string)
-        CTI_COMPILE_UNARY_OP(op_is_object)
-        CTI_COMPILE_UNARY_OP(op_is_function)
-        case op_stricteq: {
-            compileOpStrictEq(currentInstruction, OpStrictEq);
-            NEXT_OPCODE(op_stricteq);
-        }
-        case op_nstricteq: {
-            compileOpStrictEq(currentInstruction, OpNStrictEq);
-            NEXT_OPCODE(op_nstricteq);
-        }
-        case op_to_jsnumber: {
-            int srcVReg = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(srcVReg, X86::eax);
-            
-            Jump wasImmediate = emitJumpIfImmNum(X86::eax);
-
-            emitJumpSlowCaseIfNotJSCell(X86::eax, srcVReg);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addSlowCase(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
-            
-            wasImmediate.link(this);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_to_jsnumber);
-        }
-        CTI_COMPILE_BINARY_OP(op_in)
-        case op_push_new_scope: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx);
-            emitCTICall(Interpreter::cti_op_push_new_scope);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_push_new_scope);
-        }
-        case op_catch: {
-            emitGetCTIParam(STUB_ARGS_callFrame, callFrameRegister);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_catch);
-        }
-        case op_jmp_scopes: {
-            unsigned count = currentInstruction[1].u.operand;
-            emitPutJITStubArgConstant(count, 1);
-            emitCTICall(Interpreter::cti_op_jmp_scopes);
-            unsigned target = currentInstruction[2].u.operand;
-            addJump(jump(), target + 2);
-            NEXT_OPCODE(op_jmp_scopes);
-        }
-        case op_put_by_index: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_put_by_index);
-            NEXT_OPCODE(op_put_by_index);
-        }
-        case op_switch_imm: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            SimpleJumpTable* jumpTable = &m_codeBlock->immediateSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
-            jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, X86::ecx);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(Interpreter::cti_op_switch_imm);
-            jump(X86::eax);
-            NEXT_OPCODE(op_switch_imm);
-        }
-        case op_switch_char: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            SimpleJumpTable* jumpTable = &m_codeBlock->characterSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
-            jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, X86::ecx);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(Interpreter::cti_op_switch_char);
-            jump(X86::eax);
-            NEXT_OPCODE(op_switch_char);
-        }
-        case op_switch_string: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, X86::ecx);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(Interpreter::cti_op_switch_string);
-            jump(X86::eax);
-            NEXT_OPCODE(op_switch_string);
-        }
-        case op_del_by_val: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx);
-            emitCTICall(Interpreter::cti_op_del_by_val);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_del_by_val);
-        }
-        case op_put_getter: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_put_getter);
-            NEXT_OPCODE(op_put_getter);
-        }
-        case op_put_setter: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_put_setter);
-            NEXT_OPCODE(op_put_setter);
-        }
-        case op_new_error: {
-            JSValuePtr message = m_codeBlock->unexpectedConstant(currentInstruction[3].u.operand);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 1);
-            emitPutJITStubArgConstant(JSValuePtr::encode(message), 2);
-            emitPutJITStubArgConstant(m_bytecodeIndex, 3);
-            emitCTICall(Interpreter::cti_op_new_error);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_error);
-        }
-        case op_debug: {
-            emitPutJITStubArgConstant(currentInstruction[1].u.operand, 1);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 2);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand, 3);
-            emitCTICall(Interpreter::cti_op_debug);
-            NEXT_OPCODE(op_debug);
-        }
-        case op_eq_null: {
-            unsigned dst = currentInstruction[1].u.operand;
-            unsigned src1 = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src1, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            setnz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), X86::eax);
-
-            Jump wasNotImmediate = jump();
-
-            isImmediate.link(this);
-
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            sete32(Imm32(JSImmediate::FullTagTypeNull), X86::eax);
-
-            wasNotImmediate.link(this);
-
-            emitTagAsBoolImmediate(X86::eax);
-            emitPutVirtualRegister(dst);
-
-            NEXT_OPCODE(op_eq_null);
-        }
-        case op_neq_null: {
-            unsigned dst = currentInstruction[1].u.operand;
-            unsigned src1 = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src1, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            setz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), X86::eax);
-
-            Jump wasNotImmediate = jump();
-
-            isImmediate.link(this);
-
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            setne32(Imm32(JSImmediate::FullTagTypeNull), X86::eax);
-
-            wasNotImmediate.link(this);
-
-            emitTagAsBoolImmediate(X86::eax);
-            emitPutVirtualRegister(dst);
-
-            NEXT_OPCODE(op_neq_null);
-        }
-        case op_enter: {
-            // Even though CTI doesn't use them, we initialize our constant
-            // registers to zap stale pointers, to avoid unnecessarily prolonging
-            // object lifetime and increasing GC pressure.
-            size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
-            for (size_t j = 0; j < count; ++j)
-                emitInitRegister(j);
-
-            NEXT_OPCODE(op_enter);
-        }
-        case op_enter_with_activation: {
-            // Even though CTI doesn't use them, we initialize our constant
-            // registers to zap stale pointers, to avoid unnecessarily prolonging
-            // object lifetime and increasing GC pressure.
-            size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
-            for (size_t j = 0; j < count; ++j)
-                emitInitRegister(j);
-
-            emitCTICall(Interpreter::cti_op_push_activation);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_enter_with_activation);
-        }
-        case op_create_arguments: {
-            if (m_codeBlock->m_numParameters == 1)
-                emitCTICall(Interpreter::cti_op_create_arguments_no_params);
-            else
-                emitCTICall(Interpreter::cti_op_create_arguments);
-            NEXT_OPCODE(op_create_arguments);
-        }
-        case op_convert_this: {
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::edx);
-            addSlowCase(jnz32(Address(X86::edx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
-
-            NEXT_OPCODE(op_convert_this);
-        }
-        case op_profile_will_call: {
-            emitGetCTIParam(STUB_ARGS_profilerReference, X86::eax);
-            Jump noProfiler = jzPtr(Address(X86::eax));
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::eax);
-            emitCTICall(Interpreter::cti_op_profile_will_call);
-            noProfiler.link(this);
-
-            NEXT_OPCODE(op_profile_will_call);
-        }
-        case op_profile_did_call: {
-            emitGetCTIParam(STUB_ARGS_profilerReference, X86::eax);
-            Jump noProfiler = jzPtr(Address(X86::eax));
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::eax);
-            emitCTICall(Interpreter::cti_op_profile_did_call);
-            noProfiler.link(this);
-
-            NEXT_OPCODE(op_profile_did_call);
-        }
         case op_get_array_length:
         case op_get_by_id_chain:
         case op_get_by_id_generic:
@@ -1226,11 +289,11 @@ void JIT::privateCompileMainPass()
         }
     }
 
-    ASSERT(propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
-    ASSERT(callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
+    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
 
 #ifndef NDEBUG
-    // reset this, in order to guard it's use with asserts
+    // Reset this, in order to guard its use with ASSERTs.
     m_bytecodeIndex = (unsigned)-1;
 #endif
 }
@@ -1247,8 +310,9 @@ void JIT::privateCompileLinkPass()
 void JIT::privateCompileSlowCases()
 {
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
-    unsigned propertyAccessInstructionIndex = 0;
-    unsigned callLinkInfoIndex = 0;
+
+    m_propertyAccessInstructionIndex = 0;
+    m_callLinkInfoIndex = 0;
 
     for (Vector<SlowCaseEntry>::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
         // FIXME: enable peephole optimizations for slow cases when applicable
@@ -1260,312 +324,47 @@ void JIT::privateCompileSlowCases()
 #endif
         Instruction* currentInstruction = instructionsBegin + m_bytecodeIndex;
 
-        switch (OpcodeID opcodeID = m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
-        case op_convert_this: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_convert_this);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_convert_this);
-        }
-        case op_add: {
-            compileFastArithSlow_op_add(currentInstruction, iter);
-            NEXT_OPCODE(op_add);
-        }
-        case op_construct_verify: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_construct_verify);
-        }
-        case op_get_by_val: {
-            // The slow case that handles accesses to arrays (below) may jump back up to here. 
-            Label beginGetByValSlow(this);
-
-            Jump notImm = getSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
-            notImm.link(this);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_get_by_val);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-            // This is slow case that handles accesses to arrays above the fast cut-off.
-            // First, check if this is an access to the vector
-            linkSlowCase(iter);
-            jae32(X86::edx, Address(X86::ecx, FIELD_OFFSET(ArrayStorage, m_vectorLength)), beginGetByValSlow);
-
-            // okay, missed the fast region, but it is still in the vector.  Get the value.
-            loadPtr(BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), X86::ecx);
-            // Check whether the value loaded is zero; if so we need to return undefined.
-            jzPtr(X86::ecx, beginGetByValSlow);
-            move(X86::ecx, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            NEXT_OPCODE(op_get_by_val);
-        }
-        case op_sub: {
-            compileBinaryArithOpSlowCase(op_sub, iter, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
-            NEXT_OPCODE(op_sub);
-        }
-        case op_rshift: {
-            compileFastArithSlow_op_rshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_rshift);
-        }
-        case op_lshift: {
-            compileFastArithSlow_op_lshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_lshift);
-        }
-        case op_loop_if_less: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-                emitCTICall(Interpreter::cti_op_loop_if_less);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArg(X86::edx, 2);
-                emitCTICall(Interpreter::cti_op_loop_if_less);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_put_by_id: {
-            compilePutByIdSlowCase(currentInstruction[1].u.operand, &(m_codeBlock->identifier(currentInstruction[2].u.operand)), currentInstruction[3].u.operand, iter, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_put_by_id);
-        }
-        case op_get_by_id: {
-            compileGetByIdSlowCase(currentInstruction[1].u.operand, currentInstruction[2].u.operand, &(m_codeBlock->identifier(currentInstruction[3].u.operand)), iter, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_get_by_id);
-        }
-        case op_loop_if_lesseq: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 2, X86::ecx);
-                emitCTICall(Interpreter::cti_op_loop_if_lesseq);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArg(X86::edx, 2);
-                emitCTICall(Interpreter::cti_op_loop_if_lesseq);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_lesseq);
-        }
-        case op_pre_inc: {
-            compileFastArithSlow_op_pre_inc(currentInstruction[1].u.operand, iter);
-            NEXT_OPCODE(op_pre_inc);
-        }
-        case op_put_by_val: {
-            // Normal slow cases - either is not an immediate imm, or is an array.
-            Jump notImm = getSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
-            notImm.link(this);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::ecx);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitPutJITStubArg(X86::ecx, 3);
-            emitCTICall(Interpreter::cti_op_put_by_val);
-            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
-
-            // slow cases for immediate int accesses to arrays
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::ecx);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitPutJITStubArg(X86::ecx, 3);
-            emitCTICall(Interpreter::cti_op_put_by_val_array);
-
-            NEXT_OPCODE(op_put_by_val);
-        }
-        case op_loop_if_true: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(jnz32(X86::eax), target + 2);
-            NEXT_OPCODE(op_loop_if_true);
-        }
-        case op_pre_dec: {
-            compileFastArithSlow_op_pre_dec(currentInstruction[1].u.operand, iter);
-            NEXT_OPCODE(op_pre_dec);
-        }
-        case op_jnless: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 2, X86::ecx);
-                emitCTICall(Interpreter::cti_op_jless);
-                emitJumpSlowToHot(jz32(X86::eax), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArg(X86::edx, 2);
-                emitCTICall(Interpreter::cti_op_jless);
-                emitJumpSlowToHot(jz32(X86::eax), target + 3);
-            }
-            NEXT_OPCODE(op_jnless);
-        }
-        case op_not: {
-            linkSlowCase(iter);
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), X86::eax);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_not);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_not);
-        }
-        case op_jfalse: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(jz32(X86::eax), target + 2); // inverted!
-            NEXT_OPCODE(op_jfalse);
-        }
-        case op_post_inc: {
-            compileFastArithSlow_op_post_inc(currentInstruction[1].u.operand, currentInstruction[2].u.operand, iter);
-            NEXT_OPCODE(op_post_inc);
-        }
-        case op_bitnot: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_bitnot);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitnot);
-        }
-        case op_bitand: {
-            compileFastArithSlow_op_bitand(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_bitand);
-        }
-        case op_jtrue: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(jnz32(X86::eax), target + 2);
-            NEXT_OPCODE(op_jtrue);
-        }
-        case op_post_dec: {
-            compileFastArithSlow_op_post_dec(currentInstruction[1].u.operand, currentInstruction[2].u.operand, iter);
-            NEXT_OPCODE(op_post_dec);
-        }
-        case op_bitxor: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_bitxor);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitxor);
-        }
-        case op_bitor: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_bitor);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitor);
-        }
-        case op_eq: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_eq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_eq);
-        }
-        case op_neq: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_neq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_neq);
-        }
-        case op_stricteq: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_stricteq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_stricteq);
-        }
-        case op_nstricteq: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_nstricteq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_nstricteq);
-        }
-        case op_instanceof: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[4].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_instanceof);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_instanceof);
-        }
-        case op_mod: {
-            compileFastArithSlow_op_mod(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_mod);
-        }
-        case op_mul: {
-            compileFastArithSlow_op_mul(currentInstruction, iter);
-            NEXT_OPCODE(op_mul);
-        }
-
-        case op_call: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_call);
-        }
-        case op_call_eval: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_call_eval);
-        }
-        case op_construct: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_construct);
-        }
-        case op_to_jsnumber: {
-            linkSlowCaseIfNotJSCell(iter, currentInstruction[2].u.operand);
-            linkSlowCase(iter);
-
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_to_jsnumber);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_to_jsnumber);
-        }
-
+        switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+        DEFINE_SLOWCASE_OP(op_add)
+        DEFINE_SLOWCASE_OP(op_bitand)
+        DEFINE_SLOWCASE_OP(op_bitnot)
+        DEFINE_SLOWCASE_OP(op_bitor)
+        DEFINE_SLOWCASE_OP(op_bitxor)
+        DEFINE_SLOWCASE_OP(op_call)
+        DEFINE_SLOWCASE_OP(op_call_eval)
+        DEFINE_SLOWCASE_OP(op_call_varargs)
+        DEFINE_SLOWCASE_OP(op_construct)
+        DEFINE_SLOWCASE_OP(op_construct_verify)
+        DEFINE_SLOWCASE_OP(op_convert_this)
+        DEFINE_SLOWCASE_OP(op_eq)
+        DEFINE_SLOWCASE_OP(op_get_by_id)
+        DEFINE_SLOWCASE_OP(op_get_by_val)
+        DEFINE_SLOWCASE_OP(op_instanceof)
+        DEFINE_SLOWCASE_OP(op_jfalse)
+        DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jnlesseq)
+        DEFINE_SLOWCASE_OP(op_jtrue)
+        DEFINE_SLOWCASE_OP(op_loop_if_less)
+        DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
+        DEFINE_SLOWCASE_OP(op_loop_if_true)
+        DEFINE_SLOWCASE_OP(op_lshift)
+        DEFINE_SLOWCASE_OP(op_mod)
+        DEFINE_SLOWCASE_OP(op_mul)
+        DEFINE_SLOWCASE_OP(op_method_check)
+        DEFINE_SLOWCASE_OP(op_neq)
+        DEFINE_SLOWCASE_OP(op_not)
+        DEFINE_SLOWCASE_OP(op_nstricteq)
+        DEFINE_SLOWCASE_OP(op_post_dec)
+        DEFINE_SLOWCASE_OP(op_post_inc)
+        DEFINE_SLOWCASE_OP(op_pre_dec)
+        DEFINE_SLOWCASE_OP(op_pre_inc)
+        DEFINE_SLOWCASE_OP(op_put_by_id)
+        DEFINE_SLOWCASE_OP(op_put_by_val)
+        DEFINE_SLOWCASE_OP(op_rshift)
+        DEFINE_SLOWCASE_OP(op_stricteq)
+        DEFINE_SLOWCASE_OP(op_sub)
+        DEFINE_SLOWCASE_OP(op_to_jsnumber)
+        DEFINE_SLOWCASE_OP(op_to_primitive)
         default:
             ASSERT_NOT_REACHED();
         }
@@ -1577,28 +376,26 @@ void JIT::privateCompileSlowCases()
     }
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    ASSERT(propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
+    ASSERT(m_propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
 #endif
-    ASSERT(callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
 
 #ifndef NDEBUG
-    // reset this, in order to guard it's use with asserts
+    // Reset this, in order to guard its use with ASSERTs.
     m_bytecodeIndex = (unsigned)-1;
 #endif
 }
 
 void JIT::privateCompile()
 {
-#if ENABLE(CODEBLOCK_SAMPLING)
-        storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 #if ENABLE(OPCODE_SAMPLING)
-        store32(Imm32(m_interpreter->sampler()->encodeSample(m_codeBlock->instructions().begin())), m_interpreter->sampler()->sampleSlot());
+    sampleInstruction(m_codeBlock->instructions().begin());
 #endif
 
     // Could use a pop_m, but would need to offset the following instruction if so.
-    pop(X86::ecx);
-    emitPutToCallFrameHeader(X86::ecx, RegisterFile::ReturnPC);
+    preverveReturnAddressAfterCall(regT2);
+    emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
 
     Jump slowRegisterFileCheck;
     Label afterRegisterFileCheck;
@@ -1606,10 +403,10 @@ void JIT::privateCompile()
         // In the case of a fast linked call, we do not set this up in the caller.
         emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
 
-        emitGetCTIParam(STUB_ARGS_registerFile, X86::eax);
-        addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, X86::edx);
-        
-        slowRegisterFileCheck = jg32(X86::edx, Address(X86::eax, FIELD_OFFSET(RegisterFile, m_end)));
+        peek(regT0, FIELD_OFFSET(JITStackFrame, registerFile) / sizeof (void*));
+        addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
+
+        slowRegisterFileCheck = branchPtr(Above, regT1, Address(regT0, FIELD_OFFSET(RegisterFile, m_end)));
         afterRegisterFileCheck = label();
     }
 
@@ -1619,22 +416,17 @@ void JIT::privateCompile()
 
     if (m_codeBlock->codeType() == FunctionCode) {
         slowRegisterFileCheck.link(this);
-        m_bytecodeIndex = 0; // emitCTICall will add to the map, but doesn't actually need this...
-        emitCTICall(Interpreter::cti_register_file_check);
+        m_bytecodeIndex = 0;
+        JITStubCall(this, JITStubs::cti_register_file_check).call();
 #ifndef NDEBUG
-        // reset this, in order to guard it's use with asserts
-        m_bytecodeIndex = (unsigned)-1;
+        m_bytecodeIndex = (unsigned)-1; // Reset this, in order to guard its use with ASSERTs.
 #endif
         jump(afterRegisterFileCheck);
     }
 
     ASSERT(m_jmpTable.isEmpty());
 
-    RefPtr<ExecutablePool> allocator = m_globalData->poolForSize(m_assembler.size());
-    void* code = m_assembler.executableCopy(allocator.get());
-    JITCodeRef codeRef(code, allocator);
- 
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
 
     // Translate vPC offsets into addresses in JIT generated code, for switch tables.
     for (unsigned i = 0; i < m_switches.size(); ++i) {
@@ -1645,87 +437,90 @@ void JIT::privateCompile()
             ASSERT(record.type == SwitchRecord::Immediate || record.type == SwitchRecord::Character); 
             ASSERT(record.jumpTable.simpleJumpTable->branchOffsets.size() == record.jumpTable.simpleJumpTable->ctiOffsets.size());
 
-            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
 
             for (unsigned j = 0; j < record.jumpTable.simpleJumpTable->branchOffsets.size(); ++j) {
                 unsigned offset = record.jumpTable.simpleJumpTable->branchOffsets[j];
-                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
+                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
             }
         } else {
             ASSERT(record.type == SwitchRecord::String);
 
-            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
 
             StringJumpTable::StringOffsetTable::iterator end = record.jumpTable.stringJumpTable->offsetTable.end();            
             for (StringJumpTable::StringOffsetTable::iterator it = record.jumpTable.stringJumpTable->offsetTable.begin(); it != end; ++it) {
                 unsigned offset = it->second.branchOffset;
-                it->second.ctiOffset = offset ? patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
+                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
             }
         }
     }
 
     for (size_t i = 0; i < m_codeBlock->numberOfExceptionHandlers(); ++i) {
         HandlerInfo& handler = m_codeBlock->exceptionHandler(i);
-        handler.nativeCode = patchBuffer.addressOf(m_labels[handler.target]);
+        handler.nativeCode = patchBuffer.locationOf(m_labels[handler.target]);
     }
 
-    m_codeBlock->pcVector().reserveCapacity(m_calls.size());
     for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
         if (iter->to)
-            patchBuffer.link(iter->from, iter->to);
-        m_codeBlock->pcVector().append(PC(reinterpret_cast<void**>(patchBuffer.addressOf(iter->from)) - reinterpret_cast<void**>(code), iter->bytecodeIndex));
+            patchBuffer.link(iter->from, FunctionPtr(iter->to));
+    }
+
+    if (m_codeBlock->hasExceptionInfo()) {
+        m_codeBlock->callReturnIndexVector().reserveCapacity(m_calls.size());
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter)
+            m_codeBlock->callReturnIndexVector().append(CallReturnOffsetToBytecodeIndex(patchBuffer.returnAddressOffset(iter->from), iter->bytecodeIndex));
     }
 
     // Link absolute addresses for jsr
     for (Vector<JSRInfo>::iterator iter = m_jsrSites.begin(); iter != m_jsrSites.end(); ++iter)
-        patchBuffer.setPtr(iter->storeLocation, patchBuffer.addressOf(iter->target));
+        patchBuffer.patch(iter->storeLocation, patchBuffer.locationOf(iter->target).addressForJSR());
 
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     for (unsigned i = 0; i < m_codeBlock->numberOfStructureStubInfos(); ++i) {
         StructureStubInfo& info = m_codeBlock->structureStubInfo(i);
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-        info.callReturnLocation = patchBuffer.addressOf(m_propertyAccessCompilationInfo[i].callReturnLocation);
-        info.hotPathBegin = patchBuffer.addressOf(m_propertyAccessCompilationInfo[i].hotPathBegin);
-#else
-        info.callReturnLocation = 0;
-        info.hotPathBegin = 0;
-#endif
+        info.callReturnLocation = patchBuffer.locationOf(m_propertyAccessCompilationInfo[i].callReturnLocation);
+        info.hotPathBegin = patchBuffer.locationOf(m_propertyAccessCompilationInfo[i].hotPathBegin);
     }
+#endif
+#if ENABLE(JIT_OPTIMIZE_CALL)
     for (unsigned i = 0; i < m_codeBlock->numberOfCallLinkInfos(); ++i) {
         CallLinkInfo& info = m_codeBlock->callLinkInfo(i);
-#if ENABLE(JIT_OPTIMIZE_CALL)
-        info.callReturnLocation = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].callReturnLocation);
-        info.hotPathBegin = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
-        info.hotPathOther = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].hotPathOther);
-        info.coldPathOther = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].coldPathOther);
-#else
-        info.callReturnLocation = 0;
-        info.hotPathBegin = 0;
-        info.hotPathOther = 0;
-        info.coldPathOther = 0;
+        info.callReturnLocation = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].callReturnLocation);
+        info.hotPathBegin = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
+        info.hotPathOther = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].hotPathOther);
+        info.coldPathOther = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].coldPathOther);
+    }
 #endif
+    unsigned methodCallCount = m_methodCallCompilationInfo.size();
+    m_codeBlock->addMethodCallLinkInfos(methodCallCount);
+    for (unsigned i = 0; i < methodCallCount; ++i) {
+        MethodCallLinkInfo& info = m_codeBlock->methodCallLinkInfo(i);
+        info.structureLabel = patchBuffer.locationOf(m_methodCallCompilationInfo[i].structureToCompare);
+        info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
     }
 
-    m_codeBlock->setJITCode(codeRef);
+    m_codeBlock->setJITCode(patchBuffer.finalizeCode());
 }
 
-void JIT::privateCompileCTIMachineTrampolines()
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
 {
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (1) The first function provides fast property access for array length
     Label arrayLengthBegin = align();
 
     // Check eax is an array
-    Jump array_failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump array_failureCases2 = jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr));
+    Jump array_failureCases1 = emitJumpIfNotJSCell(regT0);
+    Jump array_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
 
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::eax);
-    load32(Address(X86::eax, FIELD_OFFSET(ArrayStorage, m_length)), X86::eax);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT0);
+    load32(Address(regT0, FIELD_OFFSET(ArrayStorage, m_length)), regT0);
 
-    Jump array_failureCases3 = ja32(X86::eax, Imm32(JSImmediate::maxImmediateInt));
+    Jump array_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
-    // X86::eax contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 
     ret();
 
@@ -1733,17 +528,17 @@ void JIT::privateCompileCTIMachineTrampolines()
     Label stringLengthBegin = align();
 
     // Check eax is a string
-    Jump string_failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump string_failureCases2 = jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsStringVptr));
+    Jump string_failureCases1 = emitJumpIfNotJSCell(regT0);
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSString, m_value) + FIELD_OFFSET(UString, m_rep)), X86::eax);
-    load32(Address(X86::eax, FIELD_OFFSET(UString::Rep, len)), X86::eax);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSString, m_value) + FIELD_OFFSET(UString, m_rep)), regT0);
+    load32(Address(regT0, FIELD_OFFSET(UString::Rep, len)), regT0);
 
-    Jump string_failureCases3 = ja32(X86::eax, Imm32(JSImmediate::maxImmediateInt));
+    Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
-    // X86::eax contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
+    emitFastArithIntToImmNoCheck(regT0, regT0);
     
     ret();
 #endif
@@ -1753,139 +548,336 @@ void JIT::privateCompileCTIMachineTrampolines()
     Label virtualCallPreLinkBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_body)), X86::eax);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(FunctionBodyNode, m_code)), X86::eax);
-    Jump hasCodeBlock1 = jnzPtr(X86::eax);
-    pop(X86::ebx);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
+    Jump hasCodeBlock1 = branchTestPtr(NonZero, regT0);
+    // If m_code is null and m_jitCode is not, then we have a native function, so arity is irrelevant
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    Jump isNativeFunc1 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
-    Jump callJSFunction1 = call();
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callJSFunction1 = call();
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock1.link(this);
 
     // Check argCount matches callee arity.
-    Jump arityCheckOkay1 = je32(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_numParameters)), X86::edx);
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
-    emitPutJITStubArg(X86::eax, 4);
+    Jump arityCheckOkay1 = branch32(Equal, Address(regT0, FIELD_OFFSET(CodeBlock, m_numParameters)), regT1);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
+    emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
-    Jump callArityCheck1 = call();
-    move(X86::edx, callFrameRegister);
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callArityCheck1 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay1.link(this);
+    isNativeFunc1.link(this);
     
     compileOpCallInitializeCallFrame();
 
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
     restoreArgumentReference();
-    Jump callDontLazyLinkCall = call();
-    push(X86::ebx);
+    Call callDontLazyLinkCall = call();
+    emitGetJITStubArg(1, regT2);
+    restoreReturnAddressBeforeReturn(regT3);
 
-    jump(X86::eax);
+    jump(regT0);
 
     Label virtualCallLinkBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_body)), X86::eax);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(FunctionBodyNode, m_code)), X86::eax);
-    Jump hasCodeBlock2 = jnzPtr(X86::eax);
-    pop(X86::ebx);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
+    Jump hasCodeBlock2 = branchTestPtr(NonZero, regT0);
+    // If m_code is null and m_jitCode is not, then we have a native function, so arity is irrelevant
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    Jump isNativeFunc2 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
-    Jump callJSFunction2 = call();
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callJSFunction2 = call();
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock2.link(this);
 
     // Check argCount matches callee arity.
-    Jump arityCheckOkay2 = je32(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_numParameters)), X86::edx);
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
-    emitPutJITStubArg(X86::eax, 4);
+    Jump arityCheckOkay2 = branch32(Equal, Address(regT0, FIELD_OFFSET(CodeBlock, m_numParameters)), regT1);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
+    emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
-    Jump callArityCheck2 = call();
-    move(X86::edx, callFrameRegister);
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callArityCheck2 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay2.link(this);
+    isNativeFunc2.link(this);
 
     compileOpCallInitializeCallFrame();
 
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
     restoreArgumentReference();
-    Jump callLazyLinkCall = call();
-    push(X86::ebx);
+    Call callLazyLinkCall = call();
+    restoreReturnAddressBeforeReturn(regT3);
 
-    jump(X86::eax);
+    jump(regT0);
 
     Label virtualCallBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_body)), X86::eax);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(FunctionBodyNode, m_code)), X86::eax);
-    Jump hasCodeBlock3 = jnzPtr(X86::eax);
-    pop(X86::ebx);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
+    Jump hasCodeBlock3 = branchTestPtr(NonZero, regT0);
+    // If m_code is null and m_jitCode is not, then we have a native function, so arity is irrelevant
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    Jump isNativeFunc3 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
-    Jump callJSFunction3 = call();
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callJSFunction3 = call();
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
     hasCodeBlock3.link(this);
 
     // Check argCount matches callee arity.
-    Jump arityCheckOkay3 = je32(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_numParameters)), X86::edx);
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
-    emitPutJITStubArg(X86::eax, 4);
+    Jump arityCheckOkay3 = branch32(Equal, Address(regT0, FIELD_OFFSET(CodeBlock, m_numParameters)), regT1);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
+    emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
-    Jump callArityCheck3 = call();
-    move(X86::edx, callFrameRegister);
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callArityCheck3 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
     arityCheckOkay3.link(this);
+    // load ctiCode from the new codeBlock.
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    isNativeFunc3.link(this);
 
     compileOpCallInitializeCallFrame();
+    jump(regT0);
 
-    // load ctiCode from the new codeBlock.
-    loadPtr(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_jitCode)), X86::eax);
+    
+    Label nativeCallThunk = align();
+    preverveReturnAddressAfterCall(regT0);
+    emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
+
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT1);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    
+
+#if PLATFORM(X86_64)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86::ecx);
+
+    // Allocate stack space for our arglist
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+    COMPILE_ASSERT((sizeof(ArgList) & 0xf) == 0, ArgList_should_by_16byte_aligned);
+    
+    // Set up arguments
+    subPtr(Imm32(1), X86::ecx); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(X86::ecx, Address(stackPointerRegister, FIELD_OFFSET(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in edx
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), callFrameRegister, X86::edx);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (ecx)
+    mul32(Imm32(sizeof(Register)), X86::ecx, X86::ecx);
+    subPtr(X86::ecx, X86::edx);
+
+    // push pointer to arguments
+    storePtr(X86::edx, Address(stackPointerRegister, FIELD_OFFSET(ArgList, m_args)));
+    
+    // ArgList is passed by reference so is stackPointerRegister
+    move(stackPointerRegister, X86::ecx);
+    
+    // edx currently points to the first argument, edx-sizeof(Register) points to 'this'
+    loadPtr(Address(X86::edx, -(int32_t)sizeof(Register)), X86::edx);
+    
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::esi);
+
+    move(callFrameRegister, X86::edi); 
+
+    call(Address(X86::esi, FIELD_OFFSET(JSFunction, m_data)));
+    
+    addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+#else
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    /* We have two structs that we use to describe the stackframe we set up for our
+     * call to native code.  NativeCallFrameStructure describes the how we set up the stack
+     * in advance of the call.  NativeFunctionCalleeSignature describes the callframe
+     * as the native code expects it.  We do this as we are using the fastcall calling
+     * convention which results in the callee popping its arguments off the stack, but
+     * not the rest of the callframe so we need a nice way to ensure we increment the
+     * stack pointer by the right amount after the call.
+     */
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in EDX
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+        JSValue result;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#else
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in ECX
+      //  JSObject* callee; // passed in EDX
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#endif
+    const int NativeCallFrameSize = (sizeof(NativeCallFrameStructure) + 15) & ~15;
+    // Allocate system stack frame
+    subPtr(Imm32(NativeCallFrameSize), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // push argcount
+    storePtr(regT0, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, args) + FIELD_OFFSET(ArgList, m_argCount)));
+    
+    // Calculate the start of the callframe header, and store in regT1
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int)sizeof(Register)), callFrameRegister, regT1);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT0)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+    storePtr(regT1, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, args) + FIELD_OFFSET(ArgList, m_args)));
+
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(FIELD_OFFSET(NativeCallFrameStructure, args)), stackPointerRegister, regT0);
+    storePtr(regT0, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, argPointer)));
 
-    jump(X86::eax);
+    // regT1 currently points to the first argument, regT1 - sizeof(Register) points to 'this'
+    loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
+    storePtr(regT1, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, thisValue)));
+
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(FIELD_OFFSET(NativeCallFrameStructure, result)), stackPointerRegister, X86::ecx);
+
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::eax);
+    storePtr(X86::eax, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, callee)));
+
+    // Plant callframe
+    move(callFrameRegister, X86::edx);
+
+    call(Address(X86::eax, FIELD_OFFSET(JSFunction, m_data)));
+
+    // JSValue is a non-POD type
+    loadPtr(Address(X86::eax), X86::eax);
+#else
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::edx);
+
+    // Plant callframe
+    move(callFrameRegister, X86::ecx);
+    call(Address(X86::edx, FIELD_OFFSET(JSFunction, m_data)));
+#endif
+
+    // We've put a few temporaries on the stack in addition to the actual arguments
+    // so pull them off now
+    addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
+
+#endif
+
+    // Check for an exception
+    loadPtr(&(globalData->exception), regT2);
+    Jump exceptionHandler = branchTestPtr(NonZero, regT2);
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    
+    // Return.
+    restoreReturnAddressBeforeReturn(regT1);
+    ret();
+
+    // Handle an exception
+    exceptionHandler.link(this);
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    storePtr(regT1, regT2);
+    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    poke(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
+    restoreReturnAddressBeforeReturn(regT2);
+    ret();
+    
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    Call array_failureCases1Call = makeTailRecursiveCall(array_failureCases1);
+    Call array_failureCases2Call = makeTailRecursiveCall(array_failureCases2);
+    Call array_failureCases3Call = makeTailRecursiveCall(array_failureCases3);
+    Call string_failureCases1Call = makeTailRecursiveCall(string_failureCases1);
+    Call string_failureCases2Call = makeTailRecursiveCall(string_failureCases2);
+    Call string_failureCases3Call = makeTailRecursiveCall(string_failureCases3);
+#endif
 
     // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
-    m_interpreter->m_executablePool = m_globalData->poolForSize(m_assembler.size());
-    void* code = m_assembler.executableCopy(m_interpreter->m_executablePool.get());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    patchBuffer.link(array_failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
-    patchBuffer.link(array_failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
-    patchBuffer.link(array_failureCases3, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
-    patchBuffer.link(string_failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_string_fail));
-    patchBuffer.link(string_failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_string_fail));
-    patchBuffer.link(string_failureCases3, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_string_fail));
-
-    m_interpreter->m_ctiArrayLengthTrampoline = patchBuffer.addressOf(arrayLengthBegin);
-    m_interpreter->m_ctiStringLengthTrampoline = patchBuffer.addressOf(stringLengthBegin);
+    patchBuffer.link(array_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(array_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(array_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(string_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+#endif
+    patchBuffer.link(callArityCheck1, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callArityCheck2, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callArityCheck3, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callJSFunction1, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callJSFunction2, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callJSFunction3, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callDontLazyLinkCall, FunctionPtr(JITStubs::cti_vm_dontLazyLinkCall));
+    patchBuffer.link(callLazyLinkCall, FunctionPtr(JITStubs::cti_vm_lazyLinkCall));
+
+    CodeRef finalCode = patchBuffer.finalizeCode();
+    *executablePool = finalCode.m_executablePool;
+
+    *ctiVirtualCallPreLink = trampolineAt(finalCode, virtualCallPreLinkBegin);
+    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    *ctiArrayLengthTrampoline = trampolineAt(finalCode, arrayLengthBegin);
+    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+#else
+    UNUSED_PARAM(ctiArrayLengthTrampoline);
+    UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
-    patchBuffer.link(callArityCheck1, reinterpret_cast<void*>(Interpreter::cti_op_call_arityCheck));
-    patchBuffer.link(callArityCheck2, reinterpret_cast<void*>(Interpreter::cti_op_call_arityCheck));
-    patchBuffer.link(callArityCheck3, reinterpret_cast<void*>(Interpreter::cti_op_call_arityCheck));
-    patchBuffer.link(callJSFunction1, reinterpret_cast<void*>(Interpreter::cti_op_call_JSFunction));
-    patchBuffer.link(callJSFunction2, reinterpret_cast<void*>(Interpreter::cti_op_call_JSFunction));
-    patchBuffer.link(callJSFunction3, reinterpret_cast<void*>(Interpreter::cti_op_call_JSFunction));
-    patchBuffer.link(callDontLazyLinkCall, reinterpret_cast<void*>(Interpreter::cti_vm_dontLazyLinkCall));
-    patchBuffer.link(callLazyLinkCall, reinterpret_cast<void*>(Interpreter::cti_vm_lazyLinkCall));
-
-    m_interpreter->m_ctiVirtualCallPreLink = patchBuffer.addressOf(virtualCallPreLinkBegin);
-    m_interpreter->m_ctiVirtualCallLink = patchBuffer.addressOf(virtualCallLinkBegin);
-    m_interpreter->m_ctiVirtualCall = patchBuffer.addressOf(virtualCallBegin);
 }
 
 void JIT::emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst)
@@ -1902,6 +894,41 @@ void JIT::emitPutVariableObjectRegister(RegisterID src, RegisterID variableObjec
     storePtr(src, Address(variableObject, index * sizeof(Register)));
 }
 
+void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
+{
+    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
+    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
+    // match).  Reset the check so it no longer matches.
+    callLinkInfo->hotPathBegin.repatch(JSValue::encode(JSValue()));
+}
+
+void JIT::linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode& code, CallLinkInfo* callLinkInfo, int callerArgCount)
+{
+    // Currently we only link calls with the exact number of arguments.
+    // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
+    if (!calleeCodeBlock || callerArgCount == calleeCodeBlock->m_numParameters) {
+        ASSERT(!callLinkInfo->isLinked());
+    
+        if (calleeCodeBlock)
+            calleeCodeBlock->addCaller(callLinkInfo);
+    
+        callLinkInfo->hotPathBegin.repatch(callee);
+        callLinkInfo->hotPathOther.relink(code.addressForCall());
+    }
+
+    // patch the instruction that jumps out to the cold path, so that we only try to link once.
+    callLinkInfo->hotPathBegin.jumpAtOffset(patchOffsetOpCallCompareToJump).relink(callLinkInfo->coldPathOther);
+}
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
+
+// This probably does not belong here; adding here for now as a quick Windows build fix.
+#if ENABLE(ASSEMBLER)
+
+#if PLATFORM(X86) && !PLATFORM(MAC)
+JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index 931eb3b6d7..c9e5355273 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -30,59 +30,30 @@
 
 #if ENABLE(JIT)
 
-#define WTF_USE_CTI_REPATCH_PIC 1
+// We've run into some problems where changing the size of the class JIT leads to
+// performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+#if COMPILER(GCC)
+#define JIT_CLASS_ALIGNMENT __attribute__ ((aligned (32)))
+#else
+#define JIT_CLASS_ALIGNMENT
+#endif
 
+#include "CodeBlock.h"
 #include "Interpreter.h"
+#include "JITCode.h"
+#include "JITStubs.h"
 #include "Opcode.h"
 #include "RegisterFile.h"
 #include "MacroAssembler.h"
 #include "Profiler.h"
+#include <bytecode/SamplingTool.h>
 #include <wtf/AlwaysInline.h>
 #include <wtf/Vector.h>
 
-#define STUB_ARGS_offset 0x0C
-#define STUB_ARGS_code (STUB_ARGS_offset)
-#define STUB_ARGS_registerFile (STUB_ARGS_offset + 1)
-#define STUB_ARGS_callFrame (STUB_ARGS_offset + 2)
-#define STUB_ARGS_exception (STUB_ARGS_offset + 3)
-#define STUB_ARGS_profilerReference (STUB_ARGS_offset + 4)
-#define STUB_ARGS_globalData (STUB_ARGS_offset + 5)
-
-#define ARG_callFrame static_cast<CallFrame*>(ARGS[STUB_ARGS_callFrame])
-#define ARG_registerFile static_cast<RegisterFile*>(ARGS[STUB_ARGS_registerFile])
-#define ARG_exception static_cast<JSValuePtr*>(ARGS[STUB_ARGS_exception])
-#define ARG_profilerReference static_cast<Profiler**>(ARGS[STUB_ARGS_profilerReference])
-#define ARG_globalData static_cast<JSGlobalData*>(ARGS[STUB_ARGS_globalData])
-
-#define ARG_setCallFrame(newCallFrame) (ARGS[STUB_ARGS_callFrame] = (newCallFrame))
-
-#define ARG_src1 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[1]))
-#define ARG_src2 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[2]))
-#define ARG_src3 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[3]))
-#define ARG_src4 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[4]))
-#define ARG_src5 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[5]))
-#define ARG_id1 static_cast<Identifier*>(ARGS[1])
-#define ARG_id2 static_cast<Identifier*>(ARGS[2])
-#define ARG_id3 static_cast<Identifier*>(ARGS[3])
-#define ARG_id4 static_cast<Identifier*>(ARGS[4])
-#define ARG_int1 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[1]))
-#define ARG_int2 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[2]))
-#define ARG_int3 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[3]))
-#define ARG_int4 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[4]))
-#define ARG_int5 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[5]))
-#define ARG_int6 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[6]))
-#define ARG_func1 static_cast<FuncDeclNode*>(ARGS[1])
-#define ARG_funcexp1 static_cast<FuncExprNode*>(ARGS[1])
-#define ARG_regexp1 static_cast<RegExp*>(ARGS[1])
-#define ARG_pni1 static_cast<JSPropertyNameIterator*>(ARGS[1])
-#define ARG_returnAddress2 static_cast<void*>(ARGS[2])
-#define ARG_codeBlock4 static_cast<CodeBlock*>(ARGS[4])
-
-#define STUB_RETURN_ADDRESS_SLOT (ARGS[-1])
-
 namespace JSC {
 
     class CodeBlock;
+    class JIT;
     class JSPropertyNameIterator;
     class Interpreter;
     class Register;
@@ -98,16 +69,8 @@ namespace JSC {
     struct PolymorphicAccessStructureList;
     struct StructureStubInfo;
 
-    typedef JSValueEncodedAsPointer* (JIT_STUB *CTIHelper_j)(STUB_ARGS);
-    typedef JSObject* (JIT_STUB *CTIHelper_o)(STUB_ARGS);
-    typedef JSPropertyNameIterator* (JIT_STUB *CTIHelper_p)(STUB_ARGS);
-    typedef void (JIT_STUB *CTIHelper_v)(STUB_ARGS);
-    typedef void* (JIT_STUB *CTIHelper_s)(STUB_ARGS);
-    typedef int (JIT_STUB *CTIHelper_b)(STUB_ARGS);
-    typedef VoidPtrPair (JIT_STUB *CTIHelper_2)(STUB_ARGS);
-
     struct CallRecord {
-        MacroAssembler::Jump from;
+        MacroAssembler::Call from;
         unsigned bytecodeIndex;
         void* to;
 
@@ -115,7 +78,7 @@ namespace JSC {
         {
         }
 
-        CallRecord(MacroAssembler::Jump from, unsigned bytecodeIndex, void* to = 0)
+        CallRecord(MacroAssembler::Call from, unsigned bytecodeIndex, void* to = 0)
             : from(from)
             , bytecodeIndex(bytecodeIndex)
             , to(to)
@@ -182,42 +145,91 @@ namespace JSC {
     };
 
     struct PropertyStubCompilationInfo {
-        MacroAssembler::Jump callReturnLocation;
+        MacroAssembler::Call callReturnLocation;
         MacroAssembler::Label hotPathBegin;
     };
 
     struct StructureStubCompilationInfo {
         MacroAssembler::DataLabelPtr hotPathBegin;
-        MacroAssembler::Jump hotPathOther;
-        MacroAssembler::Jump callReturnLocation;
+        MacroAssembler::Call hotPathOther;
+        MacroAssembler::Call callReturnLocation;
         MacroAssembler::Label coldPathOther;
     };
 
-    extern "C" {
-        JSValueEncodedAsPointer* ctiTrampoline(
-#if PLATFORM(X86_64)
-            // FIXME: (bug #22910) this will force all arguments onto the stack (regparm(0) does not appear to have any effect).
-            // We can allow register passing here, and move the writes of these values into the trampoline.
-            void*, void*, void*, void*, void*, void*,
-#endif
-            void* code, RegisterFile*, CallFrame*, JSValuePtr* exception, Profiler**, JSGlobalData*);
-        void ctiVMThrowTrampoline();
+    struct MethodCallCompilationInfo {
+        MethodCallCompilationInfo(unsigned propertyAccessIndex)
+            : propertyAccessIndex(propertyAccessIndex)
+        {
+        }
+
+        MacroAssembler::DataLabelPtr structureToCompare;
+        unsigned propertyAccessIndex;
     };
 
-    void ctiSetReturnAddress(void** where, void* what);
-    void ctiPatchCallByReturnAddress(void* where, void* what);
+    // Near calls can only be patched to other JIT code, regular calls can be patched to JIT code or relinked to stub functions.
+    void ctiPatchNearCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction);
+    void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction);
+    void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, FunctionPtr newCalleeFunction);
 
     class JIT : private MacroAssembler {
+        friend class JITStubCall;
+        friend class CallEvalJITStub;
+
         using MacroAssembler::Jump;
         using MacroAssembler::JumpList;
         using MacroAssembler::Label;
 
+        // NOTES:
+        //
+        // regT0 has two special meanings.  The return value from a stub
+        // call will always be in regT0, and by default (unless
+        // a register is specified) emitPutVirtualRegister() will store
+        // the value from regT0.
+        //
+        // regT3 is required to be callee-preserved.
+        //
+        // tempRegister2 is has no such dependencies.  It is important that
+        // on x86/x86-64 it is ecx for performance reasons, since the
+        // MacroAssembler will need to plant register swaps if it is not -
+        // however the code will still function correctly.
 #if PLATFORM(X86_64)
+        static const RegisterID returnValueRegister = X86::eax;
+        static const RegisterID cachedResultRegister = X86::eax;
+        static const RegisterID firstArgumentRegister = X86::edi;
+
         static const RegisterID timeoutCheckRegister = X86::r12;
         static const RegisterID callFrameRegister = X86::r13;
-#else
+        static const RegisterID tagTypeNumberRegister = X86::r14;
+        static const RegisterID tagMaskRegister = X86::r15;
+
+        static const RegisterID regT0 = X86::eax;
+        static const RegisterID regT1 = X86::edx;
+        static const RegisterID regT2 = X86::ecx;
+        static const RegisterID regT3 = X86::ebx;
+
+        static const FPRegisterID fpRegT0 = X86::xmm0;
+        static const FPRegisterID fpRegT1 = X86::xmm1;
+        static const FPRegisterID fpRegT2 = X86::xmm2;
+#elif PLATFORM(X86)
+        static const RegisterID returnValueRegister = X86::eax;
+        static const RegisterID cachedResultRegister = X86::eax;
+        // On x86 we always use fastcall conventions = but on
+        // OS X if might make more sense to just use regparm.
+        static const RegisterID firstArgumentRegister = X86::ecx;
+
         static const RegisterID timeoutCheckRegister = X86::esi;
         static const RegisterID callFrameRegister = X86::edi;
+
+        static const RegisterID regT0 = X86::eax;
+        static const RegisterID regT1 = X86::edx;
+        static const RegisterID regT2 = X86::ecx;
+        static const RegisterID regT3 = X86::ebx;
+
+        static const FPRegisterID fpRegT0 = X86::xmm0;
+        static const FPRegisterID fpRegT1 = X86::xmm1;
+        static const FPRegisterID fpRegT2 = X86::xmm2;
+#else
+    #error "JIT not supported on this platform."
 #endif
 
         static const int patchGetByIdDefaultStructure = -1;
@@ -225,48 +237,56 @@ namespace JSC {
         // will compress the displacement, and we may not be able to fit a patched offset.
         static const int patchGetByIdDefaultOffset = 256;
 
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-#if PLATFORM(X86_64)
-        static const int ctiArgumentInitSize = 3;
-#else
-        static const int ctiArgumentInitSize = 2;
-#endif
-#elif USE(JIT_STUB_ARGUMENT_STACK)
-        static const int ctiArgumentInitSize = 4;
-#else // JIT_STUB_ARGUMENT_VA_LIST
-        static const int ctiArgumentInitSize = 0;
-#endif
-
 #if PLATFORM(X86_64)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
+        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchLengthPutByIdExternalLoad = 4;
         static const int patchOffsetPutByIdPropertyMapOffset = 31;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
         static const int patchOffsetGetByIdBranchToSlowCase = 20;
+        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchLengthGetByIdExternalLoad = 4;
         static const int patchOffsetGetByIdPropertyMapOffset = 31;
         static const int patchOffsetGetByIdPutResult = 31;
 #if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 40 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 66;
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 30 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 44;
 #endif
         static const int patchOffsetOpCallCompareToJump = 9;
+
+        static const int patchOffsetMethodCheckProtoObj = 20;
+        static const int patchOffsetMethodCheckProtoStruct = 30;
+        static const int patchOffsetMethodCheckPutFunction = 50;
 #else
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
+        static const int patchOffsetPutByIdExternalLoad = 13;
+        static const int patchLengthPutByIdExternalLoad = 3;
         static const int patchOffsetPutByIdPropertyMapOffset = 22;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 7;
         static const int patchOffsetGetByIdBranchToSlowCase = 13;
+        static const int patchOffsetGetByIdExternalLoad = 13;
+        static const int patchLengthGetByIdExternalLoad = 3;
         static const int patchOffsetGetByIdPropertyMapOffset = 22;
         static const int patchOffsetGetByIdPutResult = 22;
-#if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 31 + ctiArgumentInitSize;
+#if ENABLE(OPCODE_SAMPLING) && USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 31;
+#elif ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 33;
+#elif USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 21;
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 21 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 23;
 #endif
         static const int patchOffsetOpCallCompareToJump = 6;
+
+        static const int patchOffsetMethodCheckProtoObj = 11;
+        static const int patchOffsetMethodCheckProtoStruct = 18;
+        static const int patchOffsetMethodCheckPutFunction = 29;
 #endif
 
     public:
@@ -276,19 +296,12 @@ namespace JSC {
             jit.privateCompile();
         }
 
-        static void compileGetByIdSelf(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-        {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdSelf(stubInfo, structure, cachedOffset, returnAddress);
-        }
-
-        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, void* returnAddress)
+        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
         }
 
-#if USE(CTI_REPATCH_PIC)
         static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
@@ -304,118 +317,237 @@ namespace JSC {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
         }
-#endif
 
-        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, void* returnAddress)
+        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ProcessorReturnAddress returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
         }
-
-        static void compilePutByIdReplace(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-        {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompilePutByIdReplace(stubInfo, structure, cachedOffset, returnAddress);
-        }
         
-        static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, void* returnAddress)
+        static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ProcessorReturnAddress returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData)
+        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
         {
             JIT jit(globalData);
-            jit.privateCompileCTIMachineTrampolines();
+            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
         }
 
-        static void patchGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
-        static void patchPutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
+        static void patchGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, ProcessorReturnAddress returnAddress);
+        static void patchPutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, ProcessorReturnAddress returnAddress);
+        static void patchMethodCallProto(MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*);
 
-        static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, void* returnAddress)
+        static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ProcessorReturnAddress returnAddress)
         {
             JIT jit(globalData, codeBlock);
             return jit.privateCompilePatchGetArrayLength(returnAddress);
         }
 
-        static void linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, void* ctiCode, CallLinkInfo* callLinkInfo, int callerArgCount);
+        static void linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode&, CallLinkInfo*, int callerArgCount);
         static void unlinkCall(CallLinkInfo*);
 
-        inline static JSValuePtr execute(void* code, RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValuePtr* exception)
-        {
-            return JSValuePtr::decode(ctiTrampoline(
-#if PLATFORM(X86_64)
-                0, 0, 0, 0, 0, 0,
-#endif
-                code, registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
-        }
-
     private:
+        struct JSRInfo {
+            DataLabelPtr storeLocation;
+            Label target;
+
+            JSRInfo(DataLabelPtr storeLocation, Label targetLocation)
+                : storeLocation(storeLocation)
+                , target(targetLocation)
+            {
+            }
+        };
+
         JIT(JSGlobalData*, CodeBlock* = 0);
 
         void privateCompileMainPass();
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         void privateCompile();
-        void privateCompileGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
-        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, void* returnAddress, CallFrame* callFrame);
-#if USE(CTI_REPATCH_PIC)
+        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame);
         void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
         void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
         void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame);
-#endif
-        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, void* returnAddress, CallFrame* callFrame);
-        void privateCompilePutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
-        void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, void* returnAddress);
+        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame);
+        void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ProcessorReturnAddress returnAddress);
 
-        void privateCompileCTIMachineTrampolines();
-        void privateCompilePatchGetArrayLength(void* returnAddress);
+        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
+        void privateCompilePatchGetArrayLength(ProcessorReturnAddress returnAddress);
 
         void addSlowCase(Jump);
         void addJump(Jump, int);
         void emitJumpSlowToHot(Jump, int);
 
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
         void compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned propertyAccessInstructionIndex);
-        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex);
-        void compilePutByIdHotPath(int baseVReg, Identifier* ident, int valueVReg, unsigned propertyAccessInstructionIndex);
-        void compilePutByIdSlowCase(int baseVReg, Identifier* ident, int valueVReg, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex);
+        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck = false);
+#endif
         void compileOpCall(OpcodeID, Instruction* instruction, unsigned callLinkInfoIndex);
+        void compileOpCallVarargs(Instruction* instruction);
         void compileOpCallInitializeCallFrame();
         void compileOpCallSetupArgs(Instruction*);
-        void compileOpCallEvalSetupArgs(Instruction*);
+        void compileOpCallVarargsSetupArgs(Instruction*);
         void compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex, OpcodeID opcodeID);
+        void compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter);
         void compileOpConstructSetupArgs(Instruction*);
         enum CompileOpStrictEqType { OpStrictEq, OpNStrictEq };
         void compileOpStrictEq(Instruction* instruction, CompileOpStrictEqType type);
-        void putDoubleResultToJSNumberCellOrJSImmediate(X86Assembler::XMMRegisterID xmmSource, RegisterID jsNumberCell, unsigned dst, X86Assembler::JmpSrc* wroteJSNumberCell, X86Assembler::XMMRegisterID tempXmm, RegisterID tempReg1, RegisterID tempReg2);
-
-        void compileFastArith_op_add(Instruction*);
-        void compileFastArith_op_mul(Instruction*);
-        void compileFastArith_op_mod(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_bitand(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_lshift(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_rshift(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_pre_inc(unsigned srcDst);
-        void compileFastArith_op_pre_dec(unsigned srcDst);
-        void compileFastArith_op_post_inc(unsigned result, unsigned srcDst);
-        void compileFastArith_op_post_dec(unsigned result, unsigned srcDst);
-        void compileFastArithSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_mod(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_bitand(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_rshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_pre_inc(unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_pre_dec(unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_post_inc(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_post_dec(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
+
+        void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset);
+        void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
+
+        // Arithmetic Ops
+
+        void emit_op_add(Instruction*);
+        void emit_op_sub(Instruction*);
+        void emit_op_mul(Instruction*);
+        void emit_op_mod(Instruction*);
+        void emit_op_bitand(Instruction*);
+        void emit_op_lshift(Instruction*);
+        void emit_op_rshift(Instruction*);
+        void emit_op_jnless(Instruction*);
+        void emit_op_jnlesseq(Instruction*);
+        void emit_op_pre_inc(Instruction*);
+        void emit_op_pre_dec(Instruction*);
+        void emit_op_post_inc(Instruction*);
+        void emit_op_post_dec(Instruction*);
+        void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_rshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
+        void emit_op_get_by_val(Instruction*);
+        void emit_op_put_by_val(Instruction*);
+        void emit_op_put_by_index(Instruction*);
+        void emit_op_put_getter(Instruction*);
+        void emit_op_put_setter(Instruction*);
+        void emit_op_del_by_id(Instruction*);
+
+        void emit_op_mov(Instruction*);
+        void emit_op_end(Instruction*);
+        void emit_op_jmp(Instruction*);
+        void emit_op_loop(Instruction*);
+        void emit_op_loop_if_less(Instruction*);
+        void emit_op_loop_if_lesseq(Instruction*);
+        void emit_op_new_object(Instruction*);
+        void emit_op_put_by_id(Instruction*);
+        void emit_op_get_by_id(Instruction*);
+        void emit_op_instanceof(Instruction*);
+        void emit_op_new_func(Instruction*);
+        void emit_op_call(Instruction*);
+        void emit_op_call_eval(Instruction*);
+        void emit_op_method_check(Instruction*);
+        void emit_op_load_varargs(Instruction*);
+        void emit_op_call_varargs(Instruction*);
+        void emit_op_construct(Instruction*);
+        void emit_op_get_global_var(Instruction*);
+        void emit_op_put_global_var(Instruction*);
+        void emit_op_get_scoped_var(Instruction*);
+        void emit_op_put_scoped_var(Instruction*);
+        void emit_op_tear_off_activation(Instruction*);
+        void emit_op_tear_off_arguments(Instruction*);
+        void emit_op_ret(Instruction*);
+        void emit_op_new_array(Instruction*);
+        void emit_op_resolve(Instruction*);
+        void emit_op_construct_verify(Instruction*);
+        void emit_op_to_primitive(Instruction*);
+        void emit_op_strcat(Instruction*);
+        void emit_op_resolve_func(Instruction*);
+        void emit_op_loop_if_true(Instruction*);
+        void emit_op_resolve_base(Instruction*);
+        void emit_op_resolve_skip(Instruction*);
+        void emit_op_resolve_global(Instruction*);
+        void emit_op_not(Instruction*);
+        void emit_op_jfalse(Instruction*);
+        void emit_op_jeq_null(Instruction*);
+        void emit_op_jneq_null(Instruction*);
+        void emit_op_jneq_ptr(Instruction*);
+        void emit_op_unexpected_load(Instruction*);
+        void emit_op_jsr(Instruction*);
+        void emit_op_sret(Instruction*);
+        void emit_op_eq(Instruction*);
+        void emit_op_bitnot(Instruction*);
+        void emit_op_resolve_with_base(Instruction*);
+        void emit_op_new_func_exp(Instruction*);
+        void emit_op_jtrue(Instruction*);
+        void emit_op_neq(Instruction*);
+        void emit_op_bitxor(Instruction*);
+        void emit_op_new_regexp(Instruction*);
+        void emit_op_bitor(Instruction*);
+        void emit_op_throw(Instruction*);
+        void emit_op_next_pname(Instruction*);
+        void emit_op_push_scope(Instruction*);
+        void emit_op_pop_scope(Instruction*);
+        void emit_op_stricteq(Instruction*);
+        void emit_op_nstricteq(Instruction*);
+        void emit_op_to_jsnumber(Instruction*);
+        void emit_op_push_new_scope(Instruction*);
+        void emit_op_catch(Instruction*);
+        void emit_op_jmp_scopes(Instruction*);
+        void emit_op_switch_imm(Instruction*);
+        void emit_op_switch_char(Instruction*);
+        void emit_op_switch_string(Instruction*);
+        void emit_op_new_error(Instruction*);
+        void emit_op_debug(Instruction*);
+        void emit_op_eq_null(Instruction*);
+        void emit_op_neq_null(Instruction*);
+        void emit_op_enter(Instruction*);
+        void emit_op_enter_with_activation(Instruction*);
+        void emit_op_init_arguments(Instruction*);
+        void emit_op_create_arguments(Instruction*);
+        void emit_op_convert_this(Instruction*);
+        void emit_op_profile_will_call(Instruction*);
+        void emit_op_profile_did_call(Instruction*);
+
+        void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct_verify(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_primitive(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_not(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitnot(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitxor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_neq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_stricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_nstricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_eval(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_jsnumber(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
+#if ENABLE(JIT_OPTIMIZE_ARITHMETIC)
         void compileBinaryArithOp(OpcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
         void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
+#endif
 
         void emitGetVirtualRegister(int src, RegisterID dst);
         void emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2);
-        void emitPutVirtualRegister(unsigned dst, RegisterID from = X86::eax);
+        void emitPutVirtualRegister(unsigned dst, RegisterID from = regT0);
 
         void emitPutJITStubArg(RegisterID src, unsigned argumentNumber);
         void emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch);
@@ -425,23 +557,35 @@ namespace JSC {
 
         void emitInitRegister(unsigned dst);
 
-        void emitPutCTIParam(void* value, unsigned name);
-        void emitPutCTIParam(RegisterID from, unsigned name);
-        void emitGetCTIParam(unsigned name, RegisterID to);
-
         void emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry);
         void emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry);
-        void emitGetFromCallFrameHeader(RegisterFile::CallFrameHeaderEntry entry, RegisterID to);
+        void emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
+        void emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
 
-        JSValuePtr getConstantOperand(unsigned src);
+        JSValue getConstantOperand(unsigned src);
         int32_t getConstantOperandImmediateInt(unsigned src);
         bool isOperandConstantImmediateInt(unsigned src);
 
         Jump emitJumpIfJSCell(RegisterID);
+        Jump emitJumpIfBothJSCells(RegisterID, RegisterID, RegisterID);
         void emitJumpSlowCaseIfJSCell(RegisterID);
         Jump emitJumpIfNotJSCell(RegisterID);
         void emitJumpSlowCaseIfNotJSCell(RegisterID);
         void emitJumpSlowCaseIfNotJSCell(RegisterID, int VReg);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        JIT::Jump emitJumpIfImmediateNumber(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID);
+#else
+        JIT::Jump emitJumpIfImmediateNumber(RegisterID reg)
+        {
+            return emitJumpIfImmediateInteger(reg);
+        }
+        
+        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID reg)
+        {
+            return emitJumpIfNotImmediateInteger(reg);
+        }
+#endif
 
         Jump getSlowCase(Vector<SlowCaseEntry>::iterator& iter)
         {
@@ -454,9 +598,11 @@ namespace JSC {
         }
         void linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator&, int vReg);
 
-        JIT::Jump emitJumpIfImmNum(RegisterID);
-        void emitJumpSlowCaseIfNotImmNum(RegisterID);
-        void emitJumpSlowCaseIfNotImmNums(RegisterID, RegisterID, RegisterID);
+        JIT::Jump emitJumpIfImmediateInteger(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateInteger(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
+        void emitJumpSlowCaseIfNotImmediateInteger(RegisterID);
+        void emitJumpSlowCaseIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
 
         Jump checkStructure(RegisterID reg, Structure* structure);
 
@@ -473,27 +619,41 @@ namespace JSC {
         void restoreArgumentReference();
         void restoreArgumentReferenceForTrampoline();
 
-        Jump emitNakedCall(RegisterID);
-        Jump emitNakedCall(void* function);
-        Jump emitCTICall_internal(void*);
-        Jump emitCTICall(CTIHelper_j helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_o helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_p helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_v helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_s helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_b helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_2 helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
+        Call emitNakedCall(CodePtr function = CodePtr());
+        void preverveReturnAddressAfterCall(RegisterID);
+        void restoreReturnAddressBeforeReturn(RegisterID);
+        void restoreReturnAddressBeforeReturn(Address);
 
         void emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst);
         void emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index);
         
-        void emitSlowScriptCheck();
+        void emitTimeoutCheck();
 #ifndef NDEBUG
         void printBytecodeOperandTypes(unsigned src1, unsigned src2);
 #endif
 
         void killLastResultRegister();
 
+
+#if ENABLE(SAMPLING_FLAGS)
+        void setSamplingFlag(int32_t);
+        void clearSamplingFlag(int32_t);
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+        void emitCount(AbstractSamplingCounter&, uint32_t = 1);
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+        void sampleInstruction(Instruction*, bool = false);
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+        void sampleCodeBlock(CodeBlock*);
+#else
+        void sampleCodeBlock(CodeBlock*) {}
+#endif
+
         Interpreter* m_interpreter;
         JSGlobalData* m_globalData;
         CodeBlock* m_codeBlock;
@@ -502,19 +662,9 @@ namespace JSC {
         Vector<Label> m_labels;
         Vector<PropertyStubCompilationInfo> m_propertyAccessCompilationInfo;
         Vector<StructureStubCompilationInfo> m_callStructureStubCompilationInfo;
+        Vector<MethodCallCompilationInfo> m_methodCallCompilationInfo;
         Vector<JumpTable> m_jmpTable;
 
-        struct JSRInfo {
-            DataLabelPtr storeLocation;
-            Label target;
-
-            JSRInfo(DataLabelPtr storeLocation, Label targetLocation)
-                : storeLocation(storeLocation)
-                , target(targetLocation)
-            {
-            }
-        };
-
         unsigned m_bytecodeIndex;
         Vector<JSRInfo> m_jsrSites;
         Vector<SlowCaseEntry> m_slowCases;
@@ -522,7 +672,12 @@ namespace JSC {
 
         int m_lastResultBytecodeRegister;
         unsigned m_jumpTargetsPosition;
-    };
+
+        unsigned m_propertyAccessInstructionIndex;
+        unsigned m_globalResolveInfoIndex;
+        unsigned m_callLinkInfoIndex;
+    } JIT_CLASS_ALIGNMENT;
+
 }
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index f95bab8ee3..2ceb935019 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -40,35 +41,43 @@
 #include <stdio.h>
 #endif
 
-#define __ m_assembler.
 
 using namespace std;
 
 namespace JSC {
 
-void JIT::compileFastArith_op_lshift(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_lshift(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-    // FIXME: would we be better using 'emitJumpSlowCaseIfNotImmNums'? - we *probably* ought to be consistent.
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::ecx);
-    emitFastArithImmToInt(X86::eax);
-    emitFastArithImmToInt(X86::ecx);
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(op1, regT0, op2, regT2);
+    // FIXME: would we be better using 'emitJumpSlowCaseIfNotImmediateIntegers'? - we *probably* ought to be consistent.
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT2);
+    emitFastArithImmToInt(regT0);
+    emitFastArithImmToInt(regT2);
 #if !PLATFORM(X86)
     // Mask with 0x1f as per ecma-262 11.7.2 step 7.
     // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-    and32(Imm32(0x1f), X86::ecx);
+    and32(Imm32(0x1f), regT2);
 #endif
-    lshift32(X86::ecx, X86::eax);
+    lshift32(regT2, regT0);
 #if !USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joAdd32(X86::eax, X86::eax));
-    signExtend32ToPtr(X86::eax, X86::eax);
+    addSlowCase(branchAdd32(Overflow, regT0, regT0));
+    signExtend32ToPtr(regT0, regT0);
 #endif
-    emitFastArithReTagImmediate(X86::eax, X86::eax);
+    emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
 #if USE(ALTERNATE_JSIMMEDIATE)
     UNUSED_PARAM(op1);
     UNUSED_PARAM(op2);
@@ -79,652 +88,1137 @@ void JIT::compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned
     Jump notImm1 = getSlowCase(iter);
     Jump notImm2 = getSlowCase(iter);
     linkSlowCase(iter);
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
+    emitGetVirtualRegisters(op1, regT0, op2, regT2);
     notImm1.link(this);
     notImm2.link(this);
 #endif
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::ecx, 2);
-    emitCTICall(Interpreter::cti_op_lshift);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_lshift);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT2);
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_rshift(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_rshift(Instruction* currentInstruction)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
     if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        // isOperandConstantImmediateInt(op2) => 1 SlowCase
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
 #if USE(ALTERNATE_JSIMMEDIATE)
-        rshift32(Imm32(JSImmediate::getTruncatedUInt32(getConstantOperand(op2)) & 0x1f), X86::eax);
+        rshift32(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
 #else
-        rshiftPtr(Imm32(JSImmediate::getTruncatedUInt32(getConstantOperand(op2)) & 0x1f), X86::eax);
+        rshiftPtr(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
 #endif
     } else {
-        emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::ecx);
-        emitFastArithImmToInt(X86::ecx);
+        emitGetVirtualRegisters(op1, regT0, op2, regT2);
+        if (supportsFloatingPoint()) {
+            Jump lhsIsInt = emitJumpIfImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+            // supportsFloatingPoint() && USE(ALTERNATE_JSIMMEDIATE) => 3 SlowCases
+            addSlowCase(emitJumpIfNotImmediateNumber(regT0));
+            movePtrToDouble(regT0, fpRegT0);
+            addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
+#else
+            // supportsFloatingPoint() && !USE(ALTERNATE_JSIMMEDIATE) => 5 SlowCases (of which 1 IfNotJSCell)
+            emitJumpSlowCaseIfNotJSCell(regT0, op1);
+            addSlowCase(checkStructure(regT0, m_globalData->numberStructure.get()));
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+            addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
+            addSlowCase(branchAdd32(Overflow, regT0, regT0));
+#endif
+            lhsIsInt.link(this);
+            emitJumpSlowCaseIfNotImmediateInteger(regT2);
+        } else {
+            // !supportsFloatingPoint() => 2 SlowCases
+            emitJumpSlowCaseIfNotImmediateInteger(regT0);
+            emitJumpSlowCaseIfNotImmediateInteger(regT2);
+        }
+        emitFastArithImmToInt(regT2);
 #if !PLATFORM(X86)
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
         // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-        and32(Imm32(0x1f), X86::ecx);
+        and32(Imm32(0x1f), regT2);
 #endif
 #if USE(ALTERNATE_JSIMMEDIATE)
-        rshift32(X86::ecx, X86::eax);
+        rshift32(regT2, regT0);
 #else
-        rshiftPtr(X86::ecx, X86::eax);
+        rshiftPtr(regT2, regT0);
 #endif
     }
 #if USE(ALTERNATE_JSIMMEDIATE)
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-    orPtr(Imm32(JSImmediate::TagTypeInteger), X86::eax);
+    orPtr(Imm32(JSImmediate::TagTypeNumber), regT0);
 #endif
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_rshift(unsigned result, unsigned, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    if (isOperandConstantImmediateInt(op2))
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-    else {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_rshift);
+
+    if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        emitPutJITStubArg(X86::ecx, 2);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+    } else {
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+#else
+            linkSlowCaseIfNotJSCell(iter, op1);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+#endif
+            // We're reloading op1 to regT0 as we can no longer guarantee that
+            // we have not munged the operand.  It may have already been shifted
+            // correctly, but it still will not have been tagged.
+            stubCall.addArgument(op1, regT0);
+            stubCall.addArgument(regT2);
+        } else {
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            stubCall.addArgument(regT0);
+            stubCall.addArgument(regT2);
+        }
     }
 
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_rshift);
-    emitPutVirtualRegister(result);
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_bitand(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_jnless(Instruction* currentInstruction)
 {
-    if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        int32_t imm = JSImmediate::intValue(getConstantOperand(op1));
-        andPtr(Imm32(imm), X86::eax);
-        if (imm >= 0)
-            emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
-        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)))), X86::eax);
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-    } else if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        int32_t imm = JSImmediate::intValue(getConstantOperand(op2));
-        andPtr(Imm32(imm), X86::eax);
-        if (imm >= 0)
-            emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
 #else
-        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)))), X86::eax);
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
+        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target + 3);
     } else {
-        emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-        andPtr(X86::edx, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target + 3);
     }
-    emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_bitand(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    if (isOperandConstantImmediateInt(op1)) {
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArg(X86::eax, 2);
-    } else if (isOperandConstantImmediateInt(op2)) {
-        emitPutJITStubArg(X86::eax, 1);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
     } else {
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArg(X86::edx, 2);
-    }
-    emitCTICall(Interpreter::cti_op_bitand);
-    emitPutVirtualRegister(result);
-}
+        linkSlowCase(iter);
 
-void JIT::compileFastArith_op_mod(unsigned result, unsigned op1, unsigned op2)
-{
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::ecx);
+        if (supportsFloatingPoint()) {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(jePtr(X86::ecx, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))));
-    mod32(X86::ecx, X86::eax, X86::edx);
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
 #else
-    emitFastArithDeTagImmediate(X86::eax);
-    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
-    mod32(X86::ecx, X86::eax, X86::edx);
-    signExtend32ToPtr(X86::edx, X86::edx);
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
 #endif
-    emitFastArithReTagImmediate(X86::edx, X86::eax);
-    emitPutVirtualRegister(result);
-}
-void JIT::compileFastArithSlow_op_mod(unsigned result, unsigned, unsigned, Vector<SlowCaseEntry>::iterator& iter)
-{
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
 #if USE(ALTERNATE_JSIMMEDIATE)
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
 #else
-    Jump notImm1 = getSlowCase(iter);
-    Jump notImm2 = getSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithReTagImmediate(X86::eax, X86::eax);
-    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
-    notImm1.link(this);
-    notImm2.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
 #endif
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::ecx, 2);
-    emitCTICall(Interpreter::cti_op_mod);
-    emitPutVirtualRegister(result);
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    }
 }
 
-void JIT::compileFastArith_op_add(Instruction* currentInstruction)
+void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
 
-    if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        // FIXME: investigate performing a 31-bit add here (can we preserve upper bit & detect overflow from low word to high?)
-        //        (or, detect carry? - if const is positive, will only carry when overflowing from negative to positive?)
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op1)), X86::eax));
-        emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        emitFastArithImmToInt(X86::eax);
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op2)), X86::eax));
-        emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
 #else
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        emitPutVirtualRegister(result);
+        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target + 3);
     } else {
-        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-        if (types.first().mightBeNumber() && types.second().mightBeNumber())
-            compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
-        else {
-            emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-            emitCTICall(Interpreter::cti_op_add);
-            emitPutVirtualRegister(result);
-        }
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(GreaterThan, regT0, regT1), target + 3);
     }
 }
-void JIT::compileFastArithSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
 
-    if (isOperandConstantImmediateInt(op1)) {
-#if USE(ALTERNATE_JSIMMEDIATE)
-        linkSlowCase(iter);
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
 #else
-        Jump notImm = getSlowCase(iter);
-        linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), X86::eax);
-        notImm.link(this);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArg(X86::eax, 2);
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
 #endif
-        emitCTICall(Interpreter::cti_op_add);
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2)) {
+            
+            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
 #if USE(ALTERNATE_JSIMMEDIATE)
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+            fail1.link(this);
 #else
-        Jump notImm = getSlowCase(iter);
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), X86::eax);
-        notImm.link(this);
-        emitPutJITStubArg(X86::eax, 1);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
 #endif
-        emitCTICall(Interpreter::cti_op_add);
-        emitPutVirtualRegister(result);
+            
+            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
     } else {
-        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-        ASSERT(types.first().mightBeNumber() && types.second().mightBeNumber());
-        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, types);
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
     }
 }
 
-void JIT::compileFastArith_op_mul(Instruction* currentInstruction)
+void JIT::emit_op_bitand(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    // For now, only plant a fast int case if the constant operand is greater than zero.
-    int32_t value;
-    if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
+        int32_t imm = getConstantOperandImmediateInt(op1);
+        andPtr(Imm32(imm), regT0);
+        if (imm >= 0)
+            emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-        emitFastArithDeTagImmediate(X86::eax);
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)))), regT0);
 #endif
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
+        int32_t imm = getConstantOperandImmediateInt(op2);
+        andPtr(Imm32(imm), regT0);
+        if (imm >= 0)
+            emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-        emitFastArithDeTagImmediate(X86::eax);
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)))), regT0);
 #endif
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
-        emitPutVirtualRegister(result);
-    } else
-        compileBinaryArithOp(op_mul, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        andPtr(regT1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    }
+    emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_bitand(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    int result = currentInstruction[1].u.operand;
-    int op1 = currentInstruction[2].u.operand;
-    int op2 = currentInstruction[3].u.operand;
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
 
-    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
-        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(Interpreter::cti_op_mul);
-        emitPutVirtualRegister(result);
-    } else
-        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+    linkSlowCase(iter);
+    if (isOperandConstantImmediateInt(op1)) {
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call(result);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else {
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call(result);
+    }
 }
 
-void JIT::compileFastArith_op_post_inc(unsigned result, unsigned srcDst)
+void JIT::emit_op_post_inc(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    move(X86::eax, X86::edx);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    move(regT0, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joAdd32(Imm32(1), X86::edx));
-    emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
+    addSlowCase(branchAdd32(Overflow, Imm32(1), regT1));
+    emitFastArithIntToImmNoCheck(regT1, regT1);
 #else
-    addSlowCase(joAdd32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::edx));
-    signExtend32ToPtr(X86::edx, X86::edx);
+    addSlowCase(branchAdd32(Overflow, Imm32(1 << JSImmediate::IntegerPayloadShift), regT1));
+    signExtend32ToPtr(regT1, regT1);
 #endif
-    emitPutVirtualRegister(srcDst, X86::edx);
+    emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_post_inc(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_post_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
     linkSlowCase(iter);
     linkSlowCase(iter);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_post_inc);
-    emitPutVirtualRegister(srcDst, X86::edx);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_post_inc);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_post_dec(unsigned result, unsigned srcDst)
+void JIT::emit_op_post_dec(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    move(X86::eax, X86::edx);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    move(regT0, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joSub32(Imm32(1), X86::edx));
-    emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
+    addSlowCase(branchSub32(Zero, Imm32(1), regT1));
+    emitFastArithIntToImmNoCheck(regT1, regT1);
 #else
-    addSlowCase(joSub32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::edx));
-    signExtend32ToPtr(X86::edx, X86::edx);
+    addSlowCase(branchSub32(Zero, Imm32(1 << JSImmediate::IntegerPayloadShift), regT1));
+    signExtend32ToPtr(regT1, regT1);
 #endif
-    emitPutVirtualRegister(srcDst, X86::edx);
+    emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_post_dec(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_post_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
     linkSlowCase(iter);
     linkSlowCase(iter);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_post_dec);
-    emitPutVirtualRegister(srcDst, X86::edx);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_post_dec);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_pre_inc(unsigned srcDst)
+void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    // FIXME: Could add ptr & specify int64; no need to re-sign-extend?
-    addSlowCase(joAdd32(Imm32(1), X86::eax));
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-    addSlowCase(joAdd32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::eax));
-    signExtend32ToPtr(X86::eax, X86::eax);
+    addSlowCase(branchAdd32(Overflow, Imm32(1 << JSImmediate::IntegerPayloadShift), regT0));
+    signExtend32ToPtr(regT0, regT0);
 #endif
     emitPutVirtualRegister(srcDst);
 }
-void JIT::compileFastArithSlow_op_pre_inc(unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_pre_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     Jump notImm = getSlowCase(iter);
     linkSlowCase(iter);
-    emitGetVirtualRegister(srcDst, X86::eax);
+    emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_pre_inc);
-    emitPutVirtualRegister(srcDst);
+    JITStubCall stubCall(this, JITStubs::cti_op_pre_inc);
+    stubCall.addArgument(regT0);
+    stubCall.call(srcDst);
 }
 
-void JIT::compileFastArith_op_pre_dec(unsigned srcDst)
+void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joSub32(Imm32(1), X86::eax));
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    addSlowCase(branchSub32(Zero, Imm32(1), regT0));
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-    addSlowCase(joSub32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::eax));
-    signExtend32ToPtr(X86::eax, X86::eax);
+    addSlowCase(branchSub32(Zero, Imm32(1 << JSImmediate::IntegerPayloadShift), regT0));
+    signExtend32ToPtr(regT0, regT0);
 #endif
     emitPutVirtualRegister(srcDst);
 }
-void JIT::compileFastArithSlow_op_pre_dec(unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     Jump notImm = getSlowCase(iter);
     linkSlowCase(iter);
-    emitGetVirtualRegister(srcDst, X86::eax);
+    emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_pre_dec);
-    emitPutVirtualRegister(srcDst);
+    JITStubCall stubCall(this, JITStubs::cti_op_pre_dec);
+    stubCall.addArgument(regT0);
+    stubCall.call(srcDst);
 }
 
+/* ------------------------------ BEGIN: OP_MOD ------------------------------ */
+
+#if PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
+    emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
+    emitJumpSlowCaseIfNotImmediateInteger(X86::ecx);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    addSlowCase(branchPtr(Equal, X86::ecx, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
+    m_assembler.cdq();
+    m_assembler.idivl_r(X86::ecx);
+#else
+    emitFastArithDeTagImmediate(X86::eax);
+    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
+    m_assembler.cdq();
+    m_assembler.idivl_r(X86::ecx);
+    signExtend32ToPtr(X86::edx, X86::edx);
+#endif
+    emitFastArithReTagImmediate(X86::edx, X86::eax);
+    emitPutVirtualRegister(result);
+}
+
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+#else
+    Jump notImm1 = getSlowCase(iter);
+    Jump notImm2 = getSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithReTagImmediate(X86::eax, X86::eax);
+    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
+    notImm1.link(this);
+    notImm2.link(this);
+#endif
+    JITStubCall stubCall(this, JITStubs::cti_op_mod);
+    stubCall.addArgument(X86::eax);
+    stubCall.addArgument(X86::ecx);
+    stubCall.call(result);
+}
+
+#else // PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_mod);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+#endif // PLATFORM(X86) || PLATFORM(X86_64)
+
+/* ------------------------------ END: OP_MOD ------------------------------ */
 
 #if !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
 
-void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes)
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_add);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_mul);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_sub);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+#elif USE(ALTERNATE_JSIMMEDIATE) // *AND* ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+
+/* ------------------------------ BEGIN: USE(ALTERNATE_JSIMMEDIATE) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
+void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsigned op2, OperandTypes)
 {
-    emitPutJITStubArgFromVirtualRegister(src1, 1, X86::ecx);
-    emitPutJITStubArgFromVirtualRegister(src2, 2, X86::ecx);
+    emitGetVirtualRegisters(op1, regT0, op2, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
     if (opcodeID == op_add)
-        emitCTICall(Interpreter::cti_op_add);
+        addSlowCase(branchAdd32(Overflow, regT1, regT0));
     else if (opcodeID == op_sub)
-        emitCTICall(Interpreter::cti_op_sub);
+        addSlowCase(branchSub32(Overflow, regT1, regT0));
     else {
         ASSERT(opcodeID == op_mul);
-        emitCTICall(Interpreter::cti_op_mul);
+        addSlowCase(branchMul32(Overflow, regT1, regT0));
+        addSlowCase(branchTest32(Zero, regT0));
     }
-    emitPutVirtualRegister(dst);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 }
 
-void JIT::compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned, unsigned, unsigned, OperandTypes)
+void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned result, unsigned op1, unsigned, OperandTypes types)
 {
-    ASSERT_NOT_REACHED();
+    // We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
+    COMPILE_ASSERT(((JSImmediate::TagTypeNumber + JSImmediate::DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
+
+    Jump notImm1 = getSlowCase(iter);
+    Jump notImm2 = getSlowCase(iter);
+
+    linkSlowCase(iter); // Integer overflow case - we could handle this in JIT code, but this is likely rare.
+    if (opcodeID == op_mul) // op_mul has an extra slow case to handle 0 * negative number.
+        linkSlowCase(iter);
+    emitGetVirtualRegister(op1, regT0);
+
+    Label stubFunctionCall(this);
+    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(result);
+    Jump end = jump();
+
+    // if we get here, eax is not an int32, edx not yet checked.
+    notImm1.link(this);
+    if (!types.first().definitelyIsNumber())
+        emitJumpIfNotImmediateNumber(regT0).linkTo(stubFunctionCall, this);
+    if (!types.second().definitelyIsNumber())
+        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+    addPtr(tagTypeNumberRegister, regT0);
+    movePtrToDouble(regT0, fpRegT1);
+    Jump op2isDouble = emitJumpIfNotImmediateInteger(regT1);
+    convertInt32ToDouble(regT1, fpRegT2);
+    Jump op2wasInteger = jump();
+
+    // if we get here, eax IS an int32, edx is not.
+    notImm2.link(this);
+    if (!types.second().definitelyIsNumber())
+        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+    convertInt32ToDouble(regT0, fpRegT1);
+    op2isDouble.link(this);
+    addPtr(tagTypeNumberRegister, regT1);
+    movePtrToDouble(regT1, fpRegT2);
+    op2wasInteger.link(this);
+
+    if (opcodeID == op_add)
+        addDouble(fpRegT2, fpRegT1);
+    else if (opcodeID == op_sub)
+        subDouble(fpRegT2, fpRegT1);
+    else {
+        ASSERT(opcodeID == op_mul);
+        mulDouble(fpRegT2, fpRegT1);
+    }
+    moveDoubleToPtr(fpRegT1, regT0);
+    subPtr(tagTypeNumberRegister, regT0);
+    emitPutVirtualRegister(result, regT0);
+
+    end.link(this);
 }
 
-#else
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-typedef X86Assembler::JmpSrc JmpSrc;
-typedef X86Assembler::JmpDst JmpDst;
-typedef X86Assembler::XMMRegisterID XMMRegisterID;
+    if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+        return;
+    }
 
-#if PLATFORM(MAC)
+    if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1)), regT0));
+        emitFastArithIntToImmNoCheck(regT0, regT0);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2)), regT0));
+        emitFastArithIntToImmNoCheck(regT0, regT0);
+    } else
+        compileBinaryArithOp(op_add, result, op1, op2, types);
+
+    emitPutVirtualRegister(result);
+}
 
-static inline bool isSSE2Present()
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    return true; // All X86 Macs are guaranteed to support at least SSE2
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op1) || isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else
+        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
 
-#else
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-static bool isSSE2Present()
-{
-    static const int SSE2FeatureBit = 1 << 26;
-    struct SSE2Check {
-        SSE2Check()
-        {
-            int flags;
-#if COMPILER(MSVC)
-            _asm {
-                mov eax, 1 // cpuid function 1 gives us the standard feature set
-                cpuid;
-                mov flags, edx;
-            }
-#else
-            flags = 0;
-            // FIXME: Add GCC code to do above asm
-#endif
-            present = (flags & SSE2FeatureBit) != 0;
-        }
-        bool present;
-    };
-    static SSE2Check check;
-    return check.present;
+    // For now, only plant a fast int case if the constant operand is greater than zero.
+    int32_t value;
+    if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        emitFastArithReTagImmediate(regT0, regT0);
+    } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        emitFastArithReTagImmediate(regT0, regT0);
+    } else
+        compileBinaryArithOp(op_mul, result, op1, op2, types);
+
+    emitPutVirtualRegister(result);
 }
 
-#endif
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-/*
-  This is required since number representation is canonical - values representable as a JSImmediate should not be stored in a JSNumberCell.
-  
-  In the common case, the double value from 'xmmSource' is written to the reusable JSNumberCell pointed to by 'jsNumberCell', then 'jsNumberCell'
-  is written to the output SF Register 'dst', and then a jump is planted (stored into *wroteJSNumberCell).
-  
-  However if the value from xmmSource is representable as a JSImmediate, then the JSImmediate value will be written to the output, and flow
-  control will fall through from the code planted.
-*/
-void JIT::putDoubleResultToJSNumberCellOrJSImmediate(X86::XMMRegisterID xmmSource, X86::RegisterID jsNumberCell, unsigned dst, JmpSrc* wroteJSNumberCell,  X86::XMMRegisterID tempXmm, X86::RegisterID tempReg1, X86::RegisterID tempReg2)
-{
-    // convert (double -> JSImmediate -> double), and check if the value is unchanged - in which case the value is representable as a JSImmediate.
-    __ cvttsd2si_rr(xmmSource, tempReg1);
-    __ addl_rr(tempReg1, tempReg1);
-    __ sarl_i8r(1, tempReg1);
-    __ cvtsi2sd_rr(tempReg1, tempXmm);
-    // Compare & branch if immediate. 
-    __ ucomis_rr(tempXmm, xmmSource);
-    JmpSrc resultIsImm = __ je();
-    JmpDst resultLookedLikeImmButActuallyIsnt = __ label();
-    
-    // Store the result to the JSNumberCell and jump.
-    __ movsd_rm(xmmSource, FIELD_OFFSET(JSNumberCell, m_value), jsNumberCell);
-    if (jsNumberCell != X86::eax)
-        __ movl_rr(jsNumberCell, X86::eax);
-    emitPutVirtualRegister(dst);
-    *wroteJSNumberCell = __ jmp();
-
-    __ link(resultIsImm, __ label());
-    // value == (double)(JSImmediate)value... or at least, it looks that way...
-    // ucomi will report that (0 == -0), and will report true if either input in NaN (result is unordered).
-    __ link(__ jp(), resultLookedLikeImmButActuallyIsnt); // Actually was a NaN
-    __ pextrw_irr(3, xmmSource, tempReg2);
-    __ cmpl_ir(0x8000, tempReg2);
-    __ link(__ je(), resultLookedLikeImmButActuallyIsnt); // Actually was -0
-    // Yes it really really really is representable as a JSImmediate.
-    emitFastArithIntToImmNoCheck(tempReg1, X86::eax);
-    emitPutVirtualRegister(dst);
+    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
+        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
+        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else
+        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, types);
 }
 
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    compileBinaryArithOp(op_sub, result, op1, op2, types);
+
+    emitPutVirtualRegister(result);
+}
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    compileBinaryArithOpSlowCase(op_sub, iter, result, op1, op2, types);
+}
+
+#else // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
 void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
 {
     Structure* numberStructure = m_globalData->numberStructure.get();
-    JmpSrc wasJSNumberCell1;
-    JmpSrc wasJSNumberCell1b;
-    JmpSrc wasJSNumberCell2;
-    JmpSrc wasJSNumberCell2b;
+    Jump wasJSNumberCell1;
+    Jump wasJSNumberCell2;
 
-    emitGetVirtualRegisters(src1, X86::eax, src2, X86::edx);
+    emitGetVirtualRegisters(src1, regT0, src2, regT1);
 
-    if (types.second().isReusable() && isSSE2Present()) {
+    if (types.second().isReusable() && supportsFloatingPoint()) {
         ASSERT(types.second().mightBeNumber());
 
         // Check op2 is a number
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::edx);
-        JmpSrc op2imm = __ jne();
+        Jump op2imm = emitJumpIfImmediateInteger(regT1);
         if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::edx, src2);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::edx);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT1, src2);
+            addSlowCase(checkStructure(regT1, numberStructure));
         }
 
         // (1) In this case src2 is a reusable number cell.
         //     Slow case if src1 is not a number type.
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::eax);
-        JmpSrc op1imm = __ jne();
+        Jump op1imm = emitJumpIfImmediateInteger(regT0);
         if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::eax, src1);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::eax);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT0, src1);
+            addSlowCase(checkStructure(regT0, numberStructure));
         }
 
         // (1a) if we get here, src1 is also a number cell
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::eax, X86::xmm0);
-        JmpSrc loadedDouble = __ jmp();
+        loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+        Jump loadedDouble = jump();
         // (1b) if we get here, src1 is an immediate
-        __ link(op1imm, __ label());
-        emitFastArithImmToInt(X86::eax);
-        __ cvtsi2sd_rr(X86::eax, X86::xmm0);
+        op1imm.link(this);
+        emitFastArithImmToInt(regT0);
+        convertInt32ToDouble(regT0, fpRegT0);
         // (1c) 
-        __ link(loadedDouble, __ label());
+        loadedDouble.link(this);
         if (opcodeID == op_add)
-            __ addsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            addDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         else if (opcodeID == op_sub)
-            __ subsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            subDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         else {
             ASSERT(opcodeID == op_mul);
-            __ mulsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            mulDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         }
 
-        putDoubleResultToJSNumberCellOrJSImmediate(X86::xmm0, X86::edx, dst, &wasJSNumberCell2, X86::xmm1, X86::ecx, X86::eax);
-        wasJSNumberCell2b = __ jmp();
+        // Store the result to the JSNumberCell and jump.
+        storeDouble(fpRegT0, Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)));
+        move(regT1, regT0);
+        emitPutVirtualRegister(dst);
+        wasJSNumberCell2 = jump();
 
         // (2) This handles cases where src2 is an immediate number.
         //     Two slow cases - either src1 isn't an immediate, or the subtract overflows.
-        __ link(op2imm, __ label());
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
-    } else if (types.first().isReusable() && isSSE2Present()) {
+        op2imm.link(this);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    } else if (types.first().isReusable() && supportsFloatingPoint()) {
         ASSERT(types.first().mightBeNumber());
 
         // Check op1 is a number
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::eax);
-        JmpSrc op1imm = __ jne();
+        Jump op1imm = emitJumpIfImmediateInteger(regT0);
         if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::eax, src1);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::eax);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT0, src1);
+            addSlowCase(checkStructure(regT0, numberStructure));
         }
 
         // (1) In this case src1 is a reusable number cell.
         //     Slow case if src2 is not a number type.
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::edx);
-        JmpSrc op2imm = __ jne();
+        Jump op2imm = emitJumpIfImmediateInteger(regT1);
         if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::edx, src2);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::edx);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT1, src2);
+            addSlowCase(checkStructure(regT1, numberStructure));
         }
 
         // (1a) if we get here, src2 is also a number cell
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm1);
-        JmpSrc loadedDouble = __ jmp();
+        loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+        Jump loadedDouble = jump();
         // (1b) if we get here, src2 is an immediate
-        __ link(op2imm, __ label());
-        emitFastArithImmToInt(X86::edx);
-        __ cvtsi2sd_rr(X86::edx, X86::xmm1);
+        op2imm.link(this);
+        emitFastArithImmToInt(regT1);
+        convertInt32ToDouble(regT1, fpRegT1);
         // (1c) 
-        __ link(loadedDouble, __ label());
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::eax, X86::xmm0);
+        loadedDouble.link(this);
+        loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         if (opcodeID == op_add)
-            __ addsd_rr(X86::xmm1, X86::xmm0);
+            addDouble(fpRegT1, fpRegT0);
         else if (opcodeID == op_sub)
-            __ subsd_rr(X86::xmm1, X86::xmm0);
+            subDouble(fpRegT1, fpRegT0);
         else {
             ASSERT(opcodeID == op_mul);
-            __ mulsd_rr(X86::xmm1, X86::xmm0);
+            mulDouble(fpRegT1, fpRegT0);
         }
-        __ movsd_rm(X86::xmm0, FIELD_OFFSET(JSNumberCell, m_value), X86::eax);
+        storeDouble(fpRegT0, Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)));
         emitPutVirtualRegister(dst);
 
-        putDoubleResultToJSNumberCellOrJSImmediate(X86::xmm0, X86::eax, dst, &wasJSNumberCell1, X86::xmm1, X86::ecx, X86::edx);
-        wasJSNumberCell1b = __ jmp();
+        // Store the result to the JSNumberCell and jump.
+        storeDouble(fpRegT0, Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)));
+        emitPutVirtualRegister(dst);
+        wasJSNumberCell1 = jump();
 
         // (2) This handles cases where src1 is an immediate number.
         //     Two slow cases - either src2 isn't an immediate, or the subtract overflows.
-        __ link(op1imm, __ label());
-        emitJumpSlowCaseIfNotImmNum(X86::edx);
+        op1imm.link(this);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
     } else
-        emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
+        emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
 
     if (opcodeID == op_add) {
-        emitFastArithDeTagImmediate(X86::eax);
-        __ addl_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchAdd32(Overflow, regT1, regT0));
     } else  if (opcodeID == op_sub) {
-        __ subl_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        addSlowCase(branchSub32(Overflow, regT1, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
     } else {
         ASSERT(opcodeID == op_mul);
         // convert eax & edx from JSImmediates to ints, and check if either are zero
-        emitFastArithImmToInt(X86::edx);
-        JmpSrc op1Zero = emitFastArithDeTagImmediateJumpIfZero(X86::eax);
-        __ testl_rr(X86::edx, X86::edx);
-        JmpSrc op2NonZero = __ jne();
-        __ link(op1Zero, __ label());
+        emitFastArithImmToInt(regT1);
+        Jump op1Zero = emitFastArithDeTagImmediateJumpIfZero(regT0);
+        Jump op2NonZero = branchTest32(NonZero, regT1);
+        op1Zero.link(this);
         // if either input is zero, add the two together, and check if the result is < 0.
         // If it is, we have a problem (N < 0), (N * 0) == -0, not representatble as a JSImmediate. 
-        __ movl_rr(X86::eax, X86::ecx);
-        __ addl_rr(X86::edx, X86::ecx);
-        addSlowCase(__ js());
+        move(regT0, regT2);
+        addSlowCase(branchAdd32(Signed, regT1, regT2));
         // Skip the above check if neither input is zero
-        __ link(op2NonZero, __ label());
-        __ imull_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        op2NonZero.link(this);
+        addSlowCase(branchMul32(Overflow, regT1, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
     }
     emitPutVirtualRegister(dst);
 
-    if (types.second().isReusable() && isSSE2Present()) {
-        __ link(wasJSNumberCell2, __ label());
-        __ link(wasJSNumberCell2b, __ label());
-    }
-    else if (types.first().isReusable() && isSSE2Present()) {
-        __ link(wasJSNumberCell1, __ label());
-        __ link(wasJSNumberCell1b, __ label());
-    }
+    if (types.second().isReusable() && supportsFloatingPoint())
+        wasJSNumberCell2.link(this);
+    else if (types.first().isReusable() && supportsFloatingPoint())
+        wasJSNumberCell1.link(this);
 }
 
 void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
 {
     linkSlowCase(iter);
-    if (types.second().isReusable() && isSSE2Present()) {
+    if (types.second().isReusable() && supportsFloatingPoint()) {
         if (!types.first().definitelyIsNumber()) {
             linkSlowCaseIfNotJSCell(iter, src1);
             linkSlowCase(iter);
@@ -733,7 +1227,7 @@ void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>:
             linkSlowCaseIfNotJSCell(iter, src2);
             linkSlowCase(iter);
         }
-    } else if (types.first().isReusable() && isSSE2Present()) {
+    } else if (types.first().isReusable() && supportsFloatingPoint()) {
         if (!types.first().definitelyIsNumber()) {
             linkSlowCaseIfNotJSCell(iter, src1);
             linkSlowCase(iter);
@@ -749,20 +1243,134 @@ void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>:
     if (opcodeID == op_mul)
         linkSlowCase(iter);
 
-    emitPutJITStubArgFromVirtualRegister(src1, 1, X86::ecx);
-    emitPutJITStubArgFromVirtualRegister(src2, 2, X86::ecx);
-    if (opcodeID == op_add)
-        emitCTICall(Interpreter::cti_op_add);
-    else if (opcodeID == op_sub)
-        emitCTICall(Interpreter::cti_op_sub);
-    else {
-        ASSERT(opcodeID == op_mul);
-        emitCTICall(Interpreter::cti_op_mul);
+    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    stubCall.addArgument(src1, regT2);
+    stubCall.addArgument(src2, regT2);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else {
+        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+        if (types.first().mightBeNumber() && types.second().mightBeNumber())
+            compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+        else {
+            JITStubCall stubCall(this, JITStubs::cti_op_add);
+            stubCall.addArgument(op1, regT2);
+            stubCall.addArgument(op2, regT2);
+            stubCall.call(result);
+        }
     }
-    emitPutVirtualRegister(dst);
 }
 
-#endif
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op1)) {
+        Jump notImm = getSlowCase(iter);
+        linkSlowCase(iter);
+        sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0);
+        notImm.link(this);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call(result);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        Jump notImm = getSlowCase(iter);
+        linkSlowCase(iter);
+        sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0);
+        notImm.link(this);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else {
+        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+        ASSERT(types.first().mightBeNumber() && types.second().mightBeNumber());
+        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, types);
+    }
+}
+
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    // For now, only plant a fast int case if the constant operand is greater than zero.
+    int32_t value;
+    if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else
+        compileBinaryArithOp(op_mul, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
+        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
+        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else
+        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    compileBinaryArithOp(op_sub, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileBinaryArithOpSlowCase(op_sub, iter, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+#endif // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+
+/* ------------------------------ END: OP_ADD, OP_SUB, OP_MUL ------------------------------ */
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index 0e85d7544d..cf852be9f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -44,40 +45,15 @@ using namespace std;
 
 namespace JSC {
 
-void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
-{
-    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
-    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
-    // match).  Reset the check so it no longer matches.
-    DataLabelPtr::patch(callLinkInfo->hotPathBegin, JSValuePtr::encode(JSImmediate::impossibleValue()));
-}
-
-void JIT::linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, void* ctiCode, CallLinkInfo* callLinkInfo, int callerArgCount)
-{
-    // Currently we only link calls with the exact number of arguments.
-    if (callerArgCount == calleeCodeBlock->m_numParameters) {
-        ASSERT(!callLinkInfo->isLinked());
-    
-        calleeCodeBlock->addCaller(callLinkInfo);
-    
-        DataLabelPtr::patch(callLinkInfo->hotPathBegin, callee);
-        Jump::patch(callLinkInfo->hotPathOther, ctiCode);
-    }
-
-    // patch the instruction that jumps out to the cold path, so that we only try to link once.
-    void* patchCheck = reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(callLinkInfo->hotPathBegin) + patchOffsetOpCallCompareToJump);
-    Jump::patch(patchCheck, callLinkInfo->coldPathOther);
-}
-
 void JIT::compileOpCallInitializeCallFrame()
 {
-    store32(X86::edx, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
+    store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
 
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_scopeChain) + FIELD_OFFSET(ScopeChain, m_node)), X86::edx); // newScopeChain
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_data) + FIELD_OFFSET(ScopeChain, m_node)), regT1); // newScopeChain
 
-    storePtr(ImmPtr(JSValuePtr::encode(noValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
-    storePtr(X86::ecx, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
-    storePtr(X86::edx, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
+    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
+    storePtr(regT2, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
+    storePtr(regT1, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
 }
 
 void JIT::compileOpCallSetupArgs(Instruction* instruction)
@@ -86,20 +62,20 @@ void JIT::compileOpCallSetupArgs(Instruction* instruction)
     int registerOffset = instruction[4].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(X86::ecx, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
+    emitPutJITStubArg(regT2, 1);
     emitPutJITStubArgConstant(argCount, 3);
+    emitPutJITStubArgConstant(registerOffset, 2);
 }
-
-void JIT::compileOpCallEvalSetupArgs(Instruction* instruction)
+          
+void JIT::compileOpCallVarargsSetupArgs(Instruction* instruction)
 {
-    int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
-
+    
     // ecx holds func
-    emitPutJITStubArg(X86::ecx, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
-    emitPutJITStubArgConstant(argCount, 3);
+    emitPutJITStubArg(regT2, 1);
+    emitPutJITStubArg(regT1, 3);
+    addPtr(Imm32(registerOffset), regT1, regT0);
+    emitPutJITStubArg(regT0, 2);
 }
 
 void JIT::compileOpConstructSetupArgs(Instruction* instruction)
@@ -110,15 +86,58 @@ void JIT::compileOpConstructSetupArgs(Instruction* instruction)
     int thisRegister = instruction[6].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(X86::ecx, 1);
+    emitPutJITStubArg(regT2, 1);
     emitPutJITStubArgConstant(registerOffset, 2);
     emitPutJITStubArgConstant(argCount, 3);
-    emitPutJITStubArgFromVirtualRegister(proto, 4, X86::eax);
+    emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
     emitPutJITStubArgConstant(thisRegister, 5);
 }
 
+void JIT::compileOpCallVarargs(Instruction* instruction)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+    int argCountRegister = instruction[3].u.operand;
+
+    emitGetVirtualRegister(argCountRegister, regT1);
+    emitGetVirtualRegister(callee, regT2);
+    compileOpCallVarargsSetupArgs(instruction);
+
+    // Check for JSFunctions.
+    emitJumpSlowCaseIfNotJSCell(regT2);
+    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    
+    // Speculatively roll the callframe, assuming argCount will match the arity.
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    intptr_t offset = (intptr_t)sizeof(Register) * (intptr_t)RegisterFile::CallerFrame;
+    addPtr(Imm32((int32_t)offset), regT0, regT3);
+    addPtr(callFrameRegister, regT3);
+    storePtr(callFrameRegister, regT3);
+    addPtr(regT0, callFrameRegister);
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
+
+    // Put the return value in dst. In the interpreter, op_ret does this.
+    emitPutVirtualRegister(dst);
+    
+    sampleCodeBlock(m_codeBlock);
+}
+
+void JIT::compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = instruction[1].u.operand;
+    
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
+    
+    sampleCodeBlock(m_codeBlock);
+}
+    
 #if !ENABLE(JIT_OPTIMIZE_CALL)
 
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
 void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
 {
     int dst = instruction[1].u.operand;
@@ -129,14 +148,11 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        emitGetVirtualRegister(callee, X86::ecx);
-        compileOpCallEvalSetupArgs(instruction);
-
-        emitCTICall(Interpreter::cti_op_call_eval);
-        wasEval = jnePtr(X86::eax, ImmPtr(JSImmediate::impossibleValue()));
+        CallEvalJITStub(this, instruction).call();
+        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
-    emitGetVirtualRegister(callee, X86::ecx);
+    emitGetVirtualRegister(callee, regT2);
     // The arguments have been set up on the hot path for op_call_eval
     if (opcodeID == op_call)
         compileOpCallSetupArgs(instruction);
@@ -144,22 +160,21 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         compileOpConstructSetupArgs(instruction);
 
     // Check for JSFunctions.
-    emitJumpSlowCaseIfNotJSCell(X86::ecx);
-    addSlowCase(jnePtr(Address(X86::ecx), ImmPtr(m_interpreter->m_jsFunctionVptr)));
+    emitJumpSlowCaseIfNotJSCell(regT2);
+    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, X86::ecx);
+        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitGetVirtualRegister(callee, regT2);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
-    move(Imm32(argCount), X86::edx);
+    move(Imm32(argCount), regT1);
 
-    emitNakedCall(m_interpreter->m_ctiVirtualCall);
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
     if (opcodeID == op_call_eval)
         wasEval.link(this);
@@ -167,9 +182,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     // Put the return value in dst. In the interpreter, op_ret does this.
     emitPutVirtualRegister(dst);
 
-#if ENABLE(CODEBLOCK_SAMPLING)
-    storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
 void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned, OpcodeID opcodeID)
@@ -178,24 +191,15 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
     linkSlowCase(iter);
     linkSlowCase(iter);
+    JITStubCall stubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
 
-    // This handles host functions
-    emitCTICall(((opcodeID == op_construct) ? Interpreter::cti_op_construct_NotJSConstruct : Interpreter::cti_op_call_NotJSFunction));
-    // Put the return value in dst. In the interpreter, op_ret does this.
-    emitPutVirtualRegister(dst);
-
-#if ENABLE(CODEBLOCK_SAMPLING)
-    storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
-#else
+#else // !ENABLE(JIT_OPTIMIZE_CALL)
 
-static void unreachable()
-{
-    ASSERT_NOT_REACHED();
-    exit(1);
-}
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
 
 void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned callLinkInfoIndex)
 {
@@ -207,18 +211,15 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        emitGetVirtualRegister(callee, X86::ecx);
-        compileOpCallEvalSetupArgs(instruction);
-
-        emitCTICall(Interpreter::cti_op_call_eval);
-        wasEval = jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::impossibleValue())));
+        CallEvalJITStub(this, instruction).call();
+        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
     // This plants a check for a cached JSFunction value, so we can plant a fast link to the callee.
     // This deliberately leaves the callee in ecx, used when setting up the stack frame below
-    emitGetVirtualRegister(callee, X86::ecx);
+    emitGetVirtualRegister(callee, regT2);
     DataLabelPtr addressOfLinkedFunctionCheck;
-    Jump jumpToSlow = jnePtrWithPatch(X86::ecx, addressOfLinkedFunctionCheck, ImmPtr(JSValuePtr::encode(JSImmediate::impossibleValue())));
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT2, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
@@ -230,25 +231,25 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         int proto = instruction[5].u.operand;
         int thisRegister = instruction[6].u.operand;
 
-        emitPutJITStubArg(X86::ecx, 1);
-        emitPutJITStubArgFromVirtualRegister(proto, 4, X86::eax);
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(thisRegister);
-        emitGetVirtualRegister(callee, X86::ecx);
+        emitPutJITStubArg(regT2, 1);
+        emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
+        JITStubCall stubCall(this, JITStubs::cti_op_construct_JSConstruct);
+        stubCall.call(thisRegister);
+        emitGetVirtualRegister(callee, regT2);
     }
 
     // Fast version of stack frame initialization, directly relative to edi.
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
-    storePtr(ImmPtr(JSValuePtr::encode(noValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
-    storePtr(X86::ecx, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_scopeChain) + FIELD_OFFSET(ScopeChain, m_node)), X86::edx); // newScopeChain
+    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
+    storePtr(regT2, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_data) + FIELD_OFFSET(ScopeChain, m_node)), regT1); // newScopeChain
     store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
     storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
-    storePtr(X86::edx, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
+    storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * sizeof(Register)), callFrameRegister);
 
     // Call to the callee
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall(reinterpret_cast<void*>(unreachable));
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
     
     if (opcodeID == op_call_eval)
         wasEval.link(this);
@@ -256,9 +257,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Put the return value in dst. In the interpreter, op_ret does this.
     emitPutVirtualRegister(dst);
 
-#if ENABLE(CODEBLOCK_SAMPLING)
-        storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
 void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex, OpcodeID opcodeID)
@@ -277,28 +276,26 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
         compileOpConstructSetupArgs(instruction);
 
     // Fast check for JS function.
-    Jump callLinkFailNotObject = emitJumpIfNotJSCell(X86::ecx);
-    Jump callLinkFailNotJSFunction = jnePtr(Address(X86::ecx), ImmPtr(m_interpreter->m_jsFunctionVptr));
+    Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT2);
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, X86::ecx);
+        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitGetVirtualRegister(callee, regT2);
     }
 
-    move(Imm32(argCount), X86::edx);
+    move(Imm32(argCount), regT1);
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
 
     m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation =
-        emitNakedCall(m_interpreter->m_ctiVirtualCallPreLink);
+        emitNakedCall(m_globalData->jitStubs.ctiVirtualCallPreLink());
 
     Jump storeResultForFirstRun = jump();
 
-// FIXME: this label can be removed, since it is a fixed offset from 'callReturnLocation'.
     // This is the address for the cold path *after* the first run (which tries to link the call).
     m_callStructureStubCompilationInfo[callLinkInfoIndex].coldPathOther = MacroAssembler::Label(this);
 
@@ -309,14 +306,15 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
         compileOpConstructSetupArgs(instruction);
 
     // Check for JSFunctions.
-    Jump isNotObject = emitJumpIfNotJSCell(X86::ecx);
-    Jump isJSFunction = jePtr(Address(X86::ecx), ImmPtr(m_interpreter->m_jsFunctionVptr));
+    Jump isNotObject = emitJumpIfNotJSCell(regT2);
+    Jump isJSFunction = branchPtr(Equal, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr));
 
     // This handles host functions
     isNotObject.link(this);
     callLinkFailNotObject.link(this);
     callLinkFailNotJSFunction.link(this);
-    emitCTICall(((opcodeID == op_construct) ? Interpreter::cti_op_construct_NotJSConstruct : Interpreter::cti_op_call_NotJSFunction));
+    JITStubCall stubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call();
     Jump wasNotJSFunction = jump();
 
     // Next, handle JSFunctions...
@@ -324,29 +322,29 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, X86::ecx);
+        JITStubCall stubCall(this, JITStubs::cti_op_construct_JSConstruct);
+        stubCall.call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitGetVirtualRegister(callee, regT2);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
-    move(Imm32(argCount), X86::edx);
+    move(Imm32(argCount), regT1);
 
-    emitNakedCall(m_interpreter->m_ctiVirtualCall);
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
     // Put the return value in dst. In the interpreter, op_ret does this.
     wasNotJSFunction.link(this);
     storeResultForFirstRun.link(this);
     emitPutVirtualRegister(dst);
 
-#if ENABLE(CODEBLOCK_SAMPLING)
-    storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
-#endif
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_CALL)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
new file mode 100644
index 0000000000..7ee644bee7
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITCode_h
+#define JITCode_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+#include "CallFrame.h"
+#include "JSValue.h"
+#include "MacroAssemblerCodeRef.h"
+#include "Profiler.h"
+
+namespace JSC {
+
+    class JSGlobalData;
+    class RegisterFile;
+
+    class JITCode {
+        typedef MacroAssemblerCodeRef CodeRef;
+        typedef MacroAssemblerCodePtr CodePtr;
+    public:
+        JITCode()
+        {
+        }
+
+        JITCode(const CodeRef ref)
+            : m_ref(ref)
+        {
+        }
+
+        bool operator !() const
+        {
+            return !m_ref.m_code.executableAddress();
+        }
+
+        CodePtr addressForCall()
+        {
+            return m_ref.m_code;
+        }
+
+        // This function returns the offset in bytes of 'pointerIntoCode' into
+        // this block of code.  The pointer provided must be a pointer into this
+        // block of code.  It is ASSERTed that no codeblock >4gb in size.
+        unsigned offsetOf(void* pointerIntoCode)
+        {
+            intptr_t result = reinterpret_cast<intptr_t>(pointerIntoCode) - reinterpret_cast<intptr_t>(m_ref.m_code.executableAddress());
+            ASSERT(static_cast<intptr_t>(static_cast<unsigned>(result)) == result);
+            return static_cast<unsigned>(result);
+        }
+
+        // Execute the code!
+        inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValue* exception)
+        {
+            return JSValue::decode(ctiTrampoline(
+#if PLATFORM(X86_64)
+                0, 0, 0, 0, 0, 0,
+#endif
+                m_ref.m_code.executableAddress(), registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
+        }
+
+#ifndef NDEBUG
+        size_t size()
+        {
+            ASSERT(m_ref.m_code.executableAddress());
+            return m_ref.m_size;
+        }
+#endif
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_ref.m_executablePool.get();
+        }
+
+        // Host functions are a bit special; they have a m_code pointer but they
+        // do not individully ref the executable pool containing the trampoline.
+        static JITCode HostFunction(CodePtr code)
+        {
+            return JITCode(code.dataLocation(), 0, 0);
+        }
+
+    private:
+        JITCode(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
+            : m_ref(code, executablePool, size)
+        {
+        }
+
+        CodeRef m_ref;
+    };
+
+};
+
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index 3804ba9c15..d5de291594 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -53,8 +53,8 @@ ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
 
     // TODO: we want to reuse values that are already in registers if we can - add a register allocator!
     if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValuePtr value = m_codeBlock->getConstant(src);
-        move(ImmPtr(JSValuePtr::encode(value)), dst);
+        JSValue value = m_codeBlock->getConstant(src);
+        move(ImmPtr(JSValue::encode(value)), dst);
         killLastResultRegister();
         return;
     }
@@ -69,8 +69,8 @@ ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
 
         if (!atJumpTarget) {
             // The argument we want is already stored in eax
-            if (dst != X86::eax)
-                move(X86::eax, dst);
+            if (dst != cachedResultRegister)
+                move(cachedResultRegister, dst);
             killLastResultRegister();
             return;
         }
@@ -112,7 +112,7 @@ ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID ds
     peek(dst, argumentNumber);
 }
 
-ALWAYS_INLINE JSValuePtr JIT::getConstantOperand(unsigned src)
+ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
 {
     ASSERT(m_codeBlock->isConstantRegisterIndex(src));
     return m_codeBlock->getConstant(src);
@@ -120,20 +120,20 @@ ALWAYS_INLINE JSValuePtr JIT::getConstantOperand(unsigned src)
 
 ALWAYS_INLINE int32_t JIT::getConstantOperandImmediateInt(unsigned src)
 {
-    return static_cast<int32_t>(JSImmediate::intValue(getConstantOperand(src)));
+    return getConstantOperand(src).getInt32Fast();
 }
 
 ALWAYS_INLINE bool JIT::isOperandConstantImmediateInt(unsigned src)
 {
-    return m_codeBlock->isConstantRegisterIndex(src) && JSImmediate::isNumber(getConstantOperand(src));
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isInt32Fast();
 }
 
 // get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
     if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValuePtr value = m_codeBlock->getConstant(src);
-        emitPutJITStubArgConstant(JSValuePtr::encode(value), argumentNumber);
+        JSValue value = m_codeBlock->getConstant(src);
+        emitPutJITStubArgConstant(JSValue::encode(value), argumentNumber);
     } else {
         loadPtr(Address(callFrameRegister, src * sizeof(Register)), scratch);
         emitPutJITStubArg(scratch, argumentNumber);
@@ -142,22 +142,6 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsig
     killLastResultRegister();
 }
 
-ALWAYS_INLINE void JIT::emitPutCTIParam(void* value, unsigned name)
-{
-    poke(ImmPtr(value), name);
-}
-
-ALWAYS_INLINE void JIT::emitPutCTIParam(RegisterID from, unsigned name)
-{
-    poke(from, name);
-}
-
-ALWAYS_INLINE void JIT::emitGetCTIParam(unsigned name, RegisterID to)
-{
-    peek(to, name);
-    killLastResultRegister();
-}
-
 ALWAYS_INLINE void JIT::emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
 {
     storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
@@ -168,108 +152,98 @@ ALWAYS_INLINE void JIT::emitPutImmediateToCallFrameHeader(void* value, RegisterF
     storePtr(ImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
 }
 
-ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader(RegisterFile::CallFrameHeaderEntry entry, RegisterID to)
+ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
 {
-    loadPtr(Address(callFrameRegister, entry * sizeof(Register)), to);
+    loadPtr(Address(from, entry * sizeof(Register)), to);
+    killLastResultRegister();
+}
+
+ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
+{
+    load32(Address(from, entry * sizeof(Register)), to);
     killLastResultRegister();
 }
 
 ALWAYS_INLINE void JIT::emitPutVirtualRegister(unsigned dst, RegisterID from)
 {
     storePtr(from, Address(callFrameRegister, dst * sizeof(Register)));
-    m_lastResultBytecodeRegister = (from == X86::eax) ? dst : std::numeric_limits<int>::max();
+    m_lastResultBytecodeRegister = (from == cachedResultRegister) ? dst : std::numeric_limits<int>::max();
     // FIXME: #ifndef NDEBUG, Write the correct m_type to the register.
 }
 
 ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
 {
-    storePtr(ImmPtr(JSValuePtr::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
+    storePtr(ImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
     // FIXME: #ifndef NDEBUG, Write the correct m_type to the register.
 }
 
-ALWAYS_INLINE JIT::Jump JIT::emitNakedCall(X86::RegisterID r)
+ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
 {
     ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
 
-    Jump nakedCall = call(r);
-    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex));
+    Call nakedCall = nearCall();
+    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex, function.executableAddress()));
     return nakedCall;
 }
 
-ALWAYS_INLINE JIT::Jump JIT::emitNakedCall(void* function)
+ALWAYS_INLINE void JIT::preverveReturnAddressAfterCall(RegisterID reg)
 {
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-    Jump nakedCall = call();
-    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex, function));
-    return nakedCall;
+    pop(reg);
 }
 
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-ALWAYS_INLINE void JIT::restoreArgumentReference()
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
 {
-#if PLATFORM(X86_64)
-    move(X86::esp, X86::edi);
-#else
-    move(X86::esp, X86::ecx);
-#endif
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
+    push(reg);
 }
-ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
-    // In the trampoline on x86-64, the first argument register is not overwritten.
-#if !PLATFORM(X86_64)
-    move(X86::esp, X86::ecx);
-    addPtr(Imm32(sizeof(void*)), X86::ecx);
-#endif
+    push(address);
 }
-#elif USE(JIT_STUB_ARGUMENT_STACK)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
 ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
-    storePtr(X86::esp, X86::esp);
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
+    poke(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline() {}
-#else // JIT_STUB_ARGUMENT_VA_LIST
+#else
 ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
+    move(stackPointerRegister, firstArgumentRegister);
+    poke(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
 }
-ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline() {}
-#endif
-
-ALWAYS_INLINE JIT::Jump JIT::emitCTICall_internal(void* helper)
+ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-#if ENABLE(OPCODE_SAMPLING)
-    store32(Imm32(m_interpreter->sampler()->encodeSample(m_codeBlock->instructions().begin() + m_bytecodeIndex, true)), m_interpreter->sampler()->sampleSlot());
-#endif
-    restoreArgumentReference();
-    Jump ctiCall = call();
-    m_calls.append(CallRecord(ctiCall, m_bytecodeIndex, helper));
-#if ENABLE(OPCODE_SAMPLING)
-    store32(Imm32(m_interpreter->sampler()->encodeSample(m_codeBlock->instructions().begin() + m_bytecodeIndex, false)), m_interpreter->sampler()->sampleSlot());
+    // In the trampoline on x86-64, the first argument register is not overwritten.
+#if !PLATFORM(X86_64)
+    move(stackPointerRegister, firstArgumentRegister);
+    addPtr(Imm32(sizeof(void*)), firstArgumentRegister);
 #endif
-    killLastResultRegister();
-
-    return ctiCall;
 }
+#endif
 
 ALWAYS_INLINE JIT::Jump JIT::checkStructure(RegisterID reg, Structure* structure)
 {
-    return jnePtr(Address(reg, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(structure));
+    return branchPtr(NotEqual, Address(reg, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(structure));
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    return jzPtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagMask)));
+    return branchTestPtr(Zero, reg, tagMaskRegister);
 #else
-    return jz32(reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(Zero, reg, Imm32(JSImmediate::TagMask));
 #endif
 }
 
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfBothJSCells(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+{
+    move(reg1, scratch);
+    orPtr(reg2, scratch);
+    return emitJumpIfJSCell(scratch);
+}
+
 ALWAYS_INLINE void JIT::emitJumpSlowCaseIfJSCell(RegisterID reg)
 {
     addSlowCase(emitJumpIfJSCell(reg));
@@ -278,9 +252,9 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfJSCell(RegisterID reg)
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotJSCell(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    return jnzPtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagMask)));
+    return branchTestPtr(NonZero, reg, tagMaskRegister);
 #else
-    return jnz32(reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagMask));
 #endif
 }
 
@@ -301,40 +275,61 @@ ALWAYS_INLINE void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator&
         linkSlowCase(iter);
 }
 
-ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmNum(RegisterID reg)
+#if USE(ALTERNATE_JSIMMEDIATE)
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateNumber(RegisterID reg)
+{
+    return branchTestPtr(NonZero, reg, tagTypeNumberRegister);
+}
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateNumber(RegisterID reg)
+{
+    return branchTestPtr(Zero, reg, tagTypeNumberRegister);
+}
+#endif
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    return jaePtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagTypeInteger)));
+    return branchPtr(AboveOrEqual, reg, tagTypeNumberRegister);
 #else
-    return jnz32(reg, Imm32(JSImmediate::TagTypeInteger));
+    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagTypeNumber));
 #endif
 }
 
-ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmNum(RegisterID reg)
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateInteger(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(jbPtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagTypeInteger))));
+    return branchPtr(Below, reg, tagTypeNumberRegister);
 #else
-    addSlowCase(jz32(reg, Imm32(JSImmediate::TagTypeInteger)));
+    return branchTest32(Zero, reg, Imm32(JSImmediate::TagTypeNumber));
 #endif
 }
 
-ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmNums(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateIntegers(RegisterID reg1, RegisterID reg2, RegisterID scratch)
 {
     move(reg1, scratch);
     andPtr(reg2, scratch);
-    emitJumpSlowCaseIfNotImmNum(scratch);
+    return emitJumpIfNotImmediateInteger(scratch);
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateInteger(RegisterID reg)
+{
+    addSlowCase(emitJumpIfNotImmediateInteger(reg));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateIntegers(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+{
+    addSlowCase(emitJumpIfNotImmediateIntegers(reg1, reg2, scratch));
 }
 
 #if !USE(ALTERNATE_JSIMMEDIATE)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
-    subPtr(Imm32(JSImmediate::TagTypeInteger), reg);
+    subPtr(Imm32(JSImmediate::TagTypeNumber), reg);
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitFastArithDeTagImmediateJumpIfZero(RegisterID reg)
 {
-    return jzSubPtr(Imm32(JSImmediate::TagTypeInteger), reg);
+    return branchSubPtr(Zero, Imm32(JSImmediate::TagTypeNumber), reg);
 }
 #endif
 
@@ -345,7 +340,7 @@ ALWAYS_INLINE void JIT::emitFastArithReTagImmediate(RegisterID src, RegisterID d
 #else
     if (src != dest)
         move(src, dest);
-    addPtr(Imm32(JSImmediate::TagTypeInteger), dest);
+    addPtr(Imm32(JSImmediate::TagTypeNumber), dest);
 #endif
 }
 
@@ -364,7 +359,7 @@ ALWAYS_INLINE void JIT::emitFastArithIntToImmNoCheck(RegisterID src, RegisterID
 #if USE(ALTERNATE_JSIMMEDIATE)
     if (src != dest)
         move(src, dest);
-    orPtr(ImmPtr(reinterpret_cast<void*>(JSImmediate::TagTypeInteger)), dest);
+    orPtr(tagTypeNumberRegister, dest);
 #else
     signExtend32ToPtr(src, dest);
     addPtr(dest, dest);
@@ -399,6 +394,66 @@ ALWAYS_INLINE void JIT::emitJumpSlowToHot(Jump jump, int relativeOffset)
     jump.linkTo(m_labels[m_bytecodeIndex + relativeOffset], this);
 }
 
+#if ENABLE(SAMPLING_FLAGS)
+ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    or32(Imm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+
+ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    and32(Imm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
+{
+#if PLATFORM(X86_64) // Or any other 64-bit plattform.
+    addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
+#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
+    intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
+    add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
+    addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+#else
+#error "SAMPLING_FLAGS not implemented on this platform."
+#endif
+}
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86::ecx);
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+}
+#endif
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86::ecx);
+    storePtr(ImmPtr(codeBlock), X86::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+}
+#endif
+#endif
 }
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
new file mode 100644
index 0000000000..1737551939
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -0,0 +1,1183 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JIT.h"
+
+#if ENABLE(JIT)
+
+#include "JITInlineMethods.h"
+#include "JITStubCall.h"
+#include "JSArray.h"
+#include "JSCell.h"
+
+namespace JSC {
+
+#define RECORD_JUMP_TARGET(targetOffset) \
+   do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
+
+void JIT::emit_op_mov(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    if (m_codeBlock->isConstantRegisterIndex(src)) {
+        storePtr(ImmPtr(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
+        if (dst == m_lastResultBytecodeRegister)
+            killLastResultRegister();
+    } else if ((src == m_lastResultBytecodeRegister) || (dst == m_lastResultBytecodeRegister)) {
+        // If either the src or dst is the cached register go though
+        // get/put registers to make sure we track this correctly.
+        emitGetVirtualRegister(src, regT0);
+        emitPutVirtualRegister(dst);
+    } else {
+        // Perform the copy via regT1; do not disturb any mapping in regT0.
+        loadPtr(Address(callFrameRegister, src * sizeof(Register)), regT1);
+        storePtr(regT1, Address(callFrameRegister, dst * sizeof(Register)));
+    }
+}
+
+void JIT::emit_op_end(Instruction* currentInstruction)
+{
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, JITStubs::cti_op_end).call();
+    ASSERT(returnValueRegister != callFrameRegister);
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
+    restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
+    ret();
+}
+
+void JIT::emit_op_jmp(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target + 1);
+    RECORD_JUMP_TARGET(target + 1);
+}
+
+void JIT::emit_op_loop(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target + 1);
+}
+
+void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+        addJump(branch32(LessThan, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+        addJump(branch32(LessThanOrEqual, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emit_op_new_object(Instruction* currentInstruction)
+{
+    JITStubCall(this, JITStubs::cti_op_new_object).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_instanceof(Instruction* currentInstruction)
+{
+    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT2);
+
+    // Check that baseVal & proto are cells.
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT1);
+
+    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    addSlowCase(branchTest32(Zero, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+
+    // If value is not an Object, return false.
+    Jump valueIsImmediate = emitJumpIfNotJSCell(regT2);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSCell, m_structure)), regT0);
+    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
+
+    // Check proto is object.
+    loadPtr(Address(regT1, FIELD_OFFSET(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+
+    // Optimistically load the result true, and start looping.
+    // Initially, regT1 still contains proto and regT2 still contains value.
+    // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
+    move(ImmPtr(JSValue::encode(jsBoolean(true))), regT0);
+    Label loop(this);
+
+    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
+    loadPtr(Address(regT2, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT2, FIELD_OFFSET(Structure, m_prototype)), regT2);
+    Jump isInstance = branchPtr(Equal, regT2, regT1);
+    branchPtr(NotEqual, regT2, ImmPtr(JSValue::encode(jsNull())), loop);
+
+    // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
+    valueIsImmediate.link(this);
+    valueIsNotObject.link(this);
+    move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
+
+    // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
+    isInstance.link(this);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_new_func(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_func);
+    stubCall.addArgument(ImmPtr(m_codeBlock->function(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_call_eval(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_eval, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_load_varargs(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_load_varargs);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCallVarargs(currentInstruction);
+}
+
+void JIT::emit_op_construct(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_get_global_var(Instruction* currentInstruction)
+{
+    JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[2].u.jsCell);
+    move(ImmPtr(globalObject), regT0);
+    emitGetVariableObjectRegister(regT0, currentInstruction[3].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_global_var(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT1);
+    JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[1].u.jsCell);
+    move(ImmPtr(globalObject), regT0);
+    emitPutVariableObjectRegister(regT1, regT0, currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
+{
+    int skip = currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain();
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT0);
+    while (skip--)
+        loadPtr(Address(regT0, FIELD_OFFSET(ScopeChainNode, next)), regT0);
+
+    loadPtr(Address(regT0, FIELD_OFFSET(ScopeChainNode, object)), regT0);
+    emitGetVariableObjectRegister(regT0, currentInstruction[2].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
+{
+    int skip = currentInstruction[2].u.operand + m_codeBlock->needsFullScopeChain();
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1);
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    while (skip--)
+        loadPtr(Address(regT1, FIELD_OFFSET(ScopeChainNode, next)), regT1);
+
+    loadPtr(Address(regT1, FIELD_OFFSET(ScopeChainNode, object)), regT1);
+    emitPutVariableObjectRegister(regT0, regT1, currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_tear_off_activation);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call();
+}
+
+void JIT::emit_op_tear_off_arguments(Instruction*)
+{
+    JITStubCall(this, JITStubs::cti_op_tear_off_arguments).call();
+}
+
+void JIT::emit_op_ret(Instruction* currentInstruction)
+{
+    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, JITStubs::cti_op_ret_scopeChain).call();
+
+    ASSERT(callFrameRegister != regT1);
+    ASSERT(regT1 != returnValueRegister);
+    ASSERT(returnValueRegister != callFrameRegister);
+
+    // Return the result in %eax.
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+
+    // Return.
+    restoreReturnAddressBeforeReturn(regT1);
+    ret();
+}
+
+void JIT::emit_op_new_array(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_array);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_construct_verify(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
+
+}
+
+void JIT::emit_op_to_primitive(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    
+    Jump isImm = emitJumpIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    isImm.link(this);
+
+    if (dst != src)
+        emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_strcat(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_strcat);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_func(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_func);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
+    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+
+    isZero.link(this);
+};
+void JIT::emit_op_resolve_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_skip);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain()));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_global(Instruction* currentInstruction)
+{
+    // Fast case
+    void* globalObject = currentInstruction[2].u.jsCell;
+    Identifier* ident = &m_codeBlock->identifier(currentInstruction[3].u.operand);
+    
+    unsigned currentIndex = m_globalResolveInfoIndex++;
+    void* structureAddress = &(m_codeBlock->globalResolveInfo(currentIndex).structure);
+    void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
+
+    // Check Structure of global object
+    move(ImmPtr(globalObject), regT0);
+    loadPtr(structureAddress, regT1);
+    Jump noMatch = branchPtr(NotEqual, regT1, Address(regT0, FIELD_OFFSET(JSCell, m_structure))); // Structures don't match
+
+    // Load cached property
+    // Assume that the global object always uses external storage.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSGlobalObject, m_externalStorage)), regT0);
+    load32(offsetAddr, regT1);
+    loadPtr(BaseIndex(regT0, regT1, ScalePtr), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    Jump end = jump();
+
+    // Slow case
+    noMatch.link(this);
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_global);
+    stubCall.addArgument(ImmPtr(globalObject));
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(Imm32(currentIndex));
+    stubCall.call(currentInstruction[1].u.operand);
+    end.link(this);
+}
+
+void JIT::emit_op_not(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    addSlowCase(branchTestPtr(NonZero, regT0, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jfalse(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target + 2);
+    Jump isNonZero = emitJumpIfImmediateInteger(regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
+
+    isNonZero.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+};
+void JIT::emit_op_jeq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addJump(branchTest32(NonZero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+
+    wasNotImmediate.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+};
+void JIT::emit_op_jneq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addJump(branchTest32(Zero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+
+    wasNotImmediate.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    JSCell* ptr = currentInstruction[2].u.jsCell;
+    unsigned target = currentInstruction[3].u.operand;
+    
+    emitGetVirtualRegister(src, regT0);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target + 3);            
+
+    RECORD_JUMP_TARGET(target + 3);
+}
+
+void JIT::emit_op_unexpected_load(Instruction* currentInstruction)
+{
+    JSValue v = m_codeBlock->unexpectedConstant(currentInstruction[2].u.operand);
+    move(ImmPtr(JSValue::encode(v)), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jsr(Instruction* currentInstruction)
+{
+    int retAddrDst = currentInstruction[1].u.operand;
+    int target = currentInstruction[2].u.operand;
+    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    addJump(jump(), target + 2);
+    m_jsrSites.append(JSRInfo(storeLocation, label()));
+    killLastResultRegister();
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_sret(Instruction* currentInstruction)
+{
+    jump(Address(callFrameRegister, sizeof(Register) * currentInstruction[1].u.operand));
+    killLastResultRegister();
+}
+
+void JIT::emit_op_eq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    set32(Equal, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_bitnot(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    not32(regT0);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
+#else
+    xorPtr(Imm32(~JSImmediate::TagTypeNumber), regT0);
+#endif
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_with_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_func_exp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpression(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jtrue(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
+    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+
+    isZero.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_neq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    set32(NotEqual, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+
+}
+
+void JIT::emit_op_bitxor(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    xorPtr(regT1, regT0);
+    emitFastArithReTagImmediate(regT0, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_new_regexp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_regexp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_bitor(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    orPtr(regT1, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_throw(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_throw);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call();
+    ASSERT(regT0 == returnValueRegister);
+#ifndef NDEBUG
+    // cti_op_throw always changes it's return address,
+    // this point in the code should never be reached.
+    breakpoint();
+#endif
+}
+
+void JIT::emit_op_next_pname(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_next_pname);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.call();
+    Jump endOfIter = branchTestPtr(Zero, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    addJump(jump(), currentInstruction[3].u.operand + 3);
+    endOfIter.link(this);
+}
+
+void JIT::emit_op_push_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_push_scope);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_pop_scope(Instruction*)
+{
+    JITStubCall(this, JITStubs::cti_op_pop_scope).call();
+}
+
+void JIT::emit_op_stricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpStrictEq);
+}
+
+void JIT::emit_op_nstricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpNStrictEq);
+}
+
+void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
+{
+    int srcVReg = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(srcVReg, regT0);
+    
+    Jump wasImmediate = emitJumpIfImmediateInteger(regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    
+    wasImmediate.link(this);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_push_new_scope);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_catch(Instruction* currentInstruction)
+{
+    killLastResultRegister(); // FIXME: Implicitly treat op_catch as a labeled statement, and remove this line of code.
+    peek(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_jmp_scopes);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call();
+    addJump(jump(), currentInstruction[2].u.operand + 2);
+    RECORD_JUMP_TARGET(currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emit_op_switch_imm(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->immediateSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_imm);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_char(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->characterSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_char);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_string(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_string);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_new_error(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_error);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(ImmPtr(JSValue::encode(m_codeBlock->unexpectedConstant(currentInstruction[3].u.operand))));
+    stubCall.addArgument(Imm32(m_bytecodeIndex));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_debug(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_debug);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call();
+}
+
+void JIT::emit_op_eq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    setTest32(NonZero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(Equal, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+
+    wasNotImmediate.link(this);
+
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_neq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    setTest32(Zero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(NotEqual, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+
+    wasNotImmediate.link(this);
+
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_enter(Instruction*)
+{
+    // Even though CTI doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
+    for (size_t j = 0; j < count; ++j)
+        emitInitRegister(j);
+
+}
+
+void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
+{
+    // Even though CTI doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
+    for (size_t j = 0; j < count; ++j)
+        emitInitRegister(j);
+
+    JITStubCall(this, JITStubs::cti_op_push_activation).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_create_arguments(Instruction*)
+{
+    Jump argsCreated = branchTestPtr(NonZero, Address(callFrameRegister, sizeof(Register) * RegisterFile::ArgumentsRegister));
+    if (m_codeBlock->m_numParameters == 1)
+        JITStubCall(this, JITStubs::cti_op_create_arguments_no_params).call();
+    else
+        JITStubCall(this, JITStubs::cti_op_create_arguments).call();
+    argsCreated.link(this);
+}
+    
+void JIT::emit_op_init_arguments(Instruction*)
+{
+    storePtr(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * RegisterFile::ArgumentsRegister));
+}
+
+void JIT::emit_op_convert_this(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT1);
+    addSlowCase(branchTest32(NonZero, Address(regT1, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+
+}
+
+void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
+{
+    peek(regT1, FIELD_OFFSET(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT1));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_profile_will_call);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT1);
+    stubCall.call();
+    noProfiler.link(this);
+
+}
+
+void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
+{
+    peek(regT1, FIELD_OFFSET(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT1));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_profile_did_call);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT1);
+    stubCall.call();
+    noProfiler.link(this);
+}
+
+
+// Slow cases
+
+void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_convert_this);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_construct_verify(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, JITStubs::cti_op_to_primitive);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
+    Label beginGetByValSlow(this);
+
+    Jump notImm = getSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithIntToImmNoCheck(regT1, regT1);
+
+    notImm.link(this);
+    JITStubCall stubCall(this, JITStubs::cti_op_get_by_val);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
+
+    // This is slow void JIT::emitSlow_that handles accesses to arrays above the fast cut-off.
+    // First, check if this is an access to the vector
+    linkSlowCase(iter);
+    branch32(AboveOrEqual, regT1, Address(regT2, FIELD_OFFSET(ArrayStorage, m_vectorLength)), beginGetByValSlow);
+
+    // okay, missed the fast region, but it is still in the vector.  Get the value.
+    loadPtr(BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), regT2);
+    // Check whether the value loaded is zero; if so we need to return undefined.
+    branchTestPtr(Zero, regT2, beginGetByValSlow);
+    move(regT2, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
+}
+
+void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    // Normal slow cases - either is not an immediate imm, or is an array.
+    Jump notImm = getSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithIntToImmNoCheck(regT1, regT1);
+
+    notImm.link(this); {
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
+    }
+
+    // slow cases for immediate int accesses to arrays
+    linkSlowCase(iter);
+    linkSlowCase(iter); {
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val_array);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+        stubCall.call();
+    }
+}
+
+void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    JITStubCall stubCall(this, JITStubs::cti_op_not);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand + 2); // inverted!
+}
+
+void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitnot);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitxor);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitor);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_eq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_neq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_stricteq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_nstricteq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_instanceof);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.addArgument(currentInstruction[4].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call);
+}
+
+void JIT::emitSlow_op_call_eval(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call_eval);
+}
+
+void JIT::emitSlow_op_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallVarargsSlowCase(currentInstruction, iter);
+}
+
+void JIT::emitSlow_op_construct(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_construct);
+}
+
+void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCaseIfNotJSCell(iter, currentInstruction[2].u.operand);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, JITStubs::cti_op_to_jsnumber);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index 6740becbea..29b9cab9cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -44,81 +45,274 @@ using namespace std;
 
 namespace JSC {
 
-#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
+    // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
+    // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
+    // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
+    // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
+    // extending since it makes it easier to re-tag the value in the slow case.
+    zeroExtend32ToPtr(regT1, regT1);
+#else
+    emitFastArithImmToInt(regT1);
+#endif
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+
+    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
+    loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, FIELD_OFFSET(JSArray, m_fastAccessCutoff))));
 
-void JIT::compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned)
+    // Get the value from the vector
+    loadPtr(BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
-    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
-    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
-    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
-    // to jump back to if one of these trampolies finds a match.
+    emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    // See comment in op_get_by_val.
+    zeroExtend32ToPtr(regT1, regT1);
+#else
+    emitFastArithImmToInt(regT1);
+#endif
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+
+    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
+    loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
+    Jump inFastVector = branch32(Below, regT1, Address(regT0, FIELD_OFFSET(JSArray, m_fastAccessCutoff)));
+    // No; oh well, check if the access if within the vector - if so, we may still be okay.
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT2, FIELD_OFFSET(ArrayStorage, m_vectorLength))));
+
+    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
+    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
+    addSlowCase(branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0]))));
+
+    // All good - put the value into the array.
+    inFastVector.link(this);
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    storePtr(regT0, BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])));
+}
 
-    emitGetVirtualRegister(baseVReg, X86::eax);
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_index);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
+}
 
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArgConstant(ident, 2);
-    emitCTICall(Interpreter::cti_op_get_by_id_generic);
-    emitPutVirtualRegister(resultVReg);
+void JIT::emit_op_put_getter(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_getter);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
 }
 
+void JIT::emit_op_put_setter(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_setter);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
+}
 
-void JIT::compileGetByIdSlowCase(int, int, Identifier*, Vector<SlowCaseEntry>::iterator&, unsigned)
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_del_by_id);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+
+#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
+#endif
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+    JITStubCall stubCall(this, JITStubs::cti_op_get_by_id_generic);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.call(resultVReg);
+
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-void JIT::compilePutByIdHotPath(int baseVReg, Identifier* ident, int valueVReg, unsigned)
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 {
-    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
-    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
-    // such that the Structure & offset are always at the same distance from this.
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+    unsigned valueVReg = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(baseVReg, regT0, valueVReg, regT1);
 
-    emitGetVirtualRegisters(baseVReg, X86::eax, valueVReg, X86::edx);
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_generic);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(regT1);
+    stubCall.call();
 
-    emitPutJITStubArgConstant(ident, 2);
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::edx, 3);
-    emitCTICall(Interpreter::cti_op_put_by_id_generic);
+    m_propertyAccessInstructionIndex++;
 }
 
-void JIT::compilePutByIdSlowCase(int, Identifier*, int, Vector<SlowCaseEntry>::iterator&, unsigned)
+void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-#else
+#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
 
-void JIT::compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier*, unsigned propertyAccessInstructionIndex)
+void JIT::emit_op_method_check(Instruction* currentInstruction)
+{
+    // Assert that the following instruction is a get_by_id.
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+
+    // Do the method check - check the object & its prototype's structure inline (this is the common case).
+    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
+    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+    Jump notCell = emitJumpIfNotJSCell(regT0);
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, FIELD_OFFSET(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT1);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, FIELD_OFFSET(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+
+    // This will be relinked to load the function without doing a load.
+    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    Jump match = jump();
+
+    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
+    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
+    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+
+    // Link the failure cases here.
+    notCell.link(this);
+    structureCheck.link(this);
+    protoStructureCheck.link(this);
+
+    // Do a regular(ish) get_by_id (the slow case will be link to
+    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
+    compileGetByIdHotPath(resultVReg, baseVReg, ident, m_propertyAccessInstructionIndex++);
+
+    match.link(this);
+    emitPutVirtualRegister(resultVReg);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, true);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+
+#endif
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+    compileGetByIdHotPath(resultVReg, baseVReg, ident, m_propertyAccessInstructionIndex++);
+    emitPutVirtualRegister(resultVReg);
+}
+
+void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propertyAccessInstructionIndex)
 {
     // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
     // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
     // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
     // to jump back to if one of these trampolies finds a match.
 
-    emitGetVirtualRegister(baseVReg, X86::eax);
-
-    emitJumpSlowCaseIfNotJSCell(X86::eax, baseVReg);
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
     DataLabelPtr structureToCompare;
-    Jump structureCheck = jnePtrWithPatch(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, FIELD_OFFSET(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
     ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
 
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(X86::eax, patchGetByIdDefaultOffset), X86::eax);
+    Label externalLoad(this);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+
+    DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(regT0, patchGetByIdDefaultOffset), regT0);
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetGetByIdPropertyMapOffset);
 
     Label putResult(this);
     ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
-    emitPutVirtualRegister(resultVReg);
 }
 
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
 
-void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex)
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, false);
+}
+
+void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck)
 {
     // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
     // so that we only need track one pointer into the slow case code - we track a pointer to the location
@@ -132,10 +326,10 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
 #ifndef NDEBUG
     Label coldPathBegin(this);
 #endif
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArgConstant(ident, 2);
-    Jump call = emitCTICall(Interpreter::cti_op_get_by_id);
-    emitPutVirtualRegister(resultVReg);
+    JITStubCall stubCall(this, isMethodCheck ? JITStubs::cti_op_get_by_id_method_check : JITStubs::cti_op_get_by_id);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    Call call = stubCall.call(resultVReg);
 
     ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
 
@@ -143,338 +337,329 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].callReturnLocation = call;
 }
 
-void JIT::compilePutByIdHotPath(int baseVReg, Identifier*, int valueVReg, unsigned propertyAccessInstructionIndex)
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 {
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    unsigned valueVReg = currentInstruction[3].u.operand;
+
+    unsigned propertyAccessInstructionIndex = m_propertyAccessInstructionIndex++;
+
     // In order to be able to patch both the Structure, and the object offset, we store one pointer,
     // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
     // such that the Structure & offset are always at the same distance from this.
 
-    emitGetVirtualRegisters(baseVReg, X86::eax, valueVReg, X86::edx);
+    emitGetVirtualRegisters(baseVReg, regT0, valueVReg, regT1);
 
     // Jump to a slow case if either the base object is an immediate, or if the Structure does not match.
-    emitJumpSlowCaseIfNotJSCell(X86::eax, baseVReg);
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
-    addSlowCase(jnePtrWithPatch(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, FIELD_OFFSET(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
 
     // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(X86::edx, Address(X86::eax, patchGetByIdDefaultOffset));
+    Label externalLoad(this);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+
+    DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetPutByIdPropertyMapOffset);
 }
 
-void JIT::compilePutByIdSlowCase(int baseVReg, Identifier* ident, int, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex)
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+
+    unsigned propertyAccessInstructionIndex = m_propertyAccessInstructionIndex++;
+
     linkSlowCaseIfNotJSCell(iter, baseVReg);
     linkSlowCase(iter);
 
-    emitPutJITStubArgConstant(ident, 2);
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::edx, 3);
-    Jump call = emitCTICall(Interpreter::cti_op_put_by_id);
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(regT1);
+    Call call = stubCall.call();
 
     // Track the location of the call; this will be used to recover patch information.
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].callReturnLocation = call;
 }
 
-static JSObject* resizePropertyStorage(JSObject* baseObject, int32_t oldSize, int32_t newSize)
+// Compile a store into an object's property storage.  May overwrite the
+// value in objectReg.
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset)
 {
-    baseObject->allocatePropertyStorage(oldSize, newSize);
-    return baseObject;
+    int offset = cachedOffset * sizeof(JSValue);
+    if (structure->isUsingInlineStorage())
+        offset += FIELD_OFFSET(JSObject, m_inlineStorage);
+    else
+        loadPtr(Address(base, FIELD_OFFSET(JSObject, m_externalStorage)), base);
+    storePtr(value, Address(base, offset));
 }
 
-static inline bool transitionWillNeedStorageRealloc(Structure* oldStructure, Structure* newStructure)
+// Compile a load from an object's property storage.  May overwrite base.
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset)
 {
-    return oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    int offset = cachedOffset * sizeof(JSValue);
+    if (structure->isUsingInlineStorage())
+        offset += FIELD_OFFSET(JSObject, m_inlineStorage);
+    else
+        loadPtr(Address(base, FIELD_OFFSET(JSObject, m_externalStorage)), base);
+    loadPtr(Address(base, offset), result);
 }
 
-void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, void* returnAddress)
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset)
+{
+    if (base->isUsingInlineStorage())
+        loadPtr(static_cast<void*>(&base->m_inlineStorage[cachedOffset]), result);
+    else
+        loadPtr(static_cast<void*>(&base->m_externalStorage[cachedOffset]), result);
+}
+
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ProcessorReturnAddress returnAddress)
 {
     JumpList failureCases;
     // Check eax is an object of the right Structure.
-    failureCases.append(emitJumpIfNotJSCell(X86::eax));
-    failureCases.append(jnePtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(oldStructure)));
+    failureCases.append(emitJumpIfNotJSCell(regT0));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(oldStructure)));
     JumpList successCases;
 
-    //  ecx = baseObject
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
+    // ecx = baseObject
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
     // proto(ecx) = baseObject->structure()->prototype()
-    failureCases.append(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
+    failureCases.append(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
 
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(Structure, m_prototype)), X86::ecx);
+    loadPtr(Address(regT2, FIELD_OFFSET(Structure, m_prototype)), regT2);
     
     // ecx = baseObject->m_structure
     for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
         // null check the prototype
-        successCases.append(jePtr(X86::ecx, ImmPtr(JSValuePtr::encode(jsNull()))));
+        successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNull()))));
 
         // Check the structure id
-        failureCases.append(jnePtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(it->get())));
+        failureCases.append(branchPtr(NotEqual, Address(regT2, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(it->get())));
         
-        loadPtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-        failureCases.append(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
-        loadPtr(Address(X86::ecx, FIELD_OFFSET(Structure, m_prototype)), X86::ecx);
+        loadPtr(Address(regT2, FIELD_OFFSET(JSCell, m_structure)), regT2);
+        failureCases.append(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
+        loadPtr(Address(regT2, FIELD_OFFSET(Structure, m_prototype)), regT2);
     }
 
     successCases.link(this);
 
-    Jump callTarget;
+    Call callTarget;
 
     // emit a call only if storage realloc is needed
-    if (transitionWillNeedStorageRealloc(oldStructure, newStructure)) {
-        pop(X86::ebx);
-#if PLATFORM(X86_64)
-        move(Imm32(newStructure->propertyStorageCapacity()), X86::edx);
-        move(Imm32(oldStructure->propertyStorageCapacity()), X86::esi);
-        move(X86::eax, X86::edi);
-        callTarget = call();
-#else
-        push(Imm32(newStructure->propertyStorageCapacity()));
-        push(Imm32(oldStructure->propertyStorageCapacity()));
-        push(X86::eax);
-        callTarget = call();
-        addPtr(Imm32(3 * sizeof(void*)), X86::esp);
-#endif
-        emitGetJITStubArg(3, X86::edx);
-        push(X86::ebx);
+    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    if (willNeedStorageRealloc) {
+        // This trampoline was called to like a JIT stub; before we can can call again we need to
+        // remove the return address from the stack, to prevent the stack from becoming misaligned.
+        preverveReturnAddressAfterCall(regT3);
+ 
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_transition_realloc);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.addArgument(regT1); // This argument is not used in the stub; we set it up on the stack so that it can be restored, below.
+        stubCall.call(regT0);
+        emitGetJITStubArg(4, regT1);
+
+        restoreReturnAddressBeforeReturn(regT3);
     }
 
     // Assumes m_refCount can be decremented easily, refcount decrement is safe as 
     // codeblock should ensure oldStructure->m_refCount > 0
     sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
     add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)));
+    storePtr(ImmPtr(newStructure), Address(regT0, FIELD_OFFSET(JSCell, m_structure)));
 
     // write the value
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    storePtr(X86::edx, Address(X86::eax, cachedOffset * sizeof(JSValuePtr)));
+    compilePutDirectOffset(regT0, regT1, newStructure, cachedOffset);
 
     ret();
     
-    Jump failureJump;
-    bool plantedFailureJump = false;
-    if (!failureCases.empty()) {
-        failureCases.link(this);
-        restoreArgumentReferenceForTrampoline();
-        failureJump = jump();
-        plantedFailureJump = true;
-    }
+    ASSERT(!failureCases.empty());
+    failureCases.link(this);
+    restoreArgumentReferenceForTrampoline();
+    Call failureCall = tailRecursiveCall();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
-    if (plantedFailureJump)
-        patchBuffer.link(failureJump, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_fail));
+    patchBuffer.link(failureCall, FunctionPtr(JITStubs::cti_op_put_by_id_fail));
 
-    if (transitionWillNeedStorageRealloc(oldStructure, newStructure))
-        patchBuffer.link(callTarget, reinterpret_cast<void*>(resizePropertyStorage));
-    
-    stubInfo->stubRoutine = code;
+    if (willNeedStorageRealloc) {
+        ASSERT(m_calls.size() == 1);
+        patchBuffer.link(m_calls[0].from, FunctionPtr(JITStubs::cti_op_put_by_id_transition_realloc));
+    }
     
-    Jump::patch(returnAddress, code);
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    returnAddress.relinkCallerToTrampoline(entryLabel);
 }
 
-void JIT::patchGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
+void JIT::patchGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
 {
     // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
-    // Should probably go to Interpreter::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_self_fail));
+    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_self_fail));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad).repatchLoadPtrToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    void* structureAddress = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdStructure);
-    void* displacementAddress = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPropertyMapOffset);
-    DataLabelPtr::patch(structureAddress, structure);
-    DataLabel32::patch(displacementAddress, cachedOffset * sizeof(JSValuePtr));
+    stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure).repatch(structure);
+    stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset).repatch(offset);
+}
+
+void JIT::patchMethodCallProto(MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto)
+{
+    ASSERT(!methodCallLinkInfo.cachedStructure);
+    methodCallLinkInfo.cachedStructure = structure;
+    structure->ref();
+
+    methodCallLinkInfo.structureLabel.repatch(structure);
+    methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj).repatch(proto);
+    methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct).repatch(proto->structure());
+    methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction).repatch(callee);
 }
 
-void JIT::patchPutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
+void JIT::patchPutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
 {
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    // Should probably go to Interpreter::cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_generic));
+    // Should probably go to JITStubs::cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad).repatchLoadPtrToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    void* structureAddress = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetPutByIdStructure;
-    void* displacementAddress = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetPutByIdPropertyMapOffset;
-    DataLabelPtr::patch(structureAddress, structure);
-    DataLabel32::patch(displacementAddress, cachedOffset * sizeof(JSValuePtr));
+    stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure).repatch(structure);
+    stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset).repatch(offset);
 }
 
-void JIT::privateCompilePatchGetArrayLength(void* returnAddress)
+void JIT::privateCompilePatchGetArrayLength(ProcessorReturnAddress returnAddress)
 {
-    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
+    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress.addressForLookup());
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
 
     // Check eax is an array
-    Jump failureCases1 = jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr));
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
 
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::ecx);
-    load32(Address(X86::ecx, FIELD_OFFSET(ArrayStorage, m_length)), X86::ecx);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
+    load32(Address(regT2, FIELD_OFFSET(ArrayStorage, m_length)), regT2);
 
-    Jump failureCases2 = ja32(X86::ecx, Imm32(JSImmediate::maxImmediateInt));
+    Jump failureCases2 = branch32(Above, regT2, Imm32(JSImmediate::maxImmediateInt));
 
-    emitFastArithIntToImmNoCheck(X86::ecx, X86::eax);
+    emitFastArithIntToImmNoCheck(regT2, regT0);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* slowCaseBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
     patchBuffer.link(failureCases1, slowCaseBegin);
     patchBuffer.link(failureCases2, slowCaseBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    void* hotPathPutResult = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, hotPathPutResult);
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = code;
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
 
-    // Finally patch the jump to sow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
-}
-
-void JIT::privateCompileGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-{
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump failureCases2 = checkStructure(X86::eax, structure);
-
-    // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    loadPtr(Address(X86::eax, cachedOffset * sizeof(JSValuePtr)), X86::eax);
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-
-    patchBuffer.link(failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_self_fail));
-    patchBuffer.link(failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_self_fail));
-
-    stubInfo->stubRoutine = code;
-
-    Jump::patch(returnAddress, code);
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    jumpLocation.relink(entryLabel);
 }
 
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, void* returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame)
 {
-#if USE(CTI_REPATCH_PIC)
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_list));
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
 
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(static_cast<void*>(protoPropertyStorage), X86::edx);
 
     // Check eax is an object of the right Structure.
-    Jump failureCases1 = checkStructure(X86::eax, structure);
+    Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), X86::ebx);
-    Jump failureCases2 = jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress));
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
     // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
 
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* slowCaseBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
     patchBuffer.link(failureCases1, slowCaseBegin);
     patchBuffer.link(failureCases2, slowCaseBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = code;
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
-#else
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
-
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump failureCases2 = checkStructure(X86::eax, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-    Jump failureCases3 = jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-
-    // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
-
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-
-    patchBuffer.link(failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-    patchBuffer.link(failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-    patchBuffer.link(failureCases3, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-
-    stubInfo->stubRoutine = code;
-
-    Jump::patch(returnAddress, code);
-#endif
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    jumpLocation.relink(entryLabel);
 }
 
-#if USE(CTI_REPATCH_PIC)
 void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
 {
-    Jump failureCase = checkStructure(X86::eax, structure);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    loadPtr(Address(X86::eax, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    Jump failureCase = checkStructure(regT0, structure);
+    compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    ASSERT(code);
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
     if (!lastProtoBegin)
-        lastProtoBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
+        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
 
     patchBuffer.link(failureCase, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     structure->ref();
-    polymorphicStructures->list[currentIndex].set(code, structure);
+    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    jumpLocation.relink(entryLabel);
 }
 
 void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
@@ -482,45 +667,43 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
 
     // Check eax is an object of the right Structure.
-    Jump failureCases1 = checkStructure(X86::eax, structure);
+    Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), X86::ebx);
-    Jump failureCases2 = jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress));
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
     // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
 
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
     patchBuffer.link(failureCases1, lastProtoBegin);
     patchBuffer.link(failureCases2, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     structure->ref();
     prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(code, structure, prototypeStructure);
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    jumpLocation.relink(entryLabel);
 }
 
 void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
@@ -530,7 +713,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
-    Jump baseObjectCheck = checkStructure(X86::eax, structure);
+    Jump baseObjectCheck = checkStructure(regT0, structure);
     bucketsOfFail.append(baseObjectCheck);
 
     Structure* currStructure = structure;
@@ -543,54 +726,50 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), X86::ebx);
-        bucketsOfFail.append(jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress)));
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
-        bucketsOfFail.append(jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
 #endif
     }
     ASSERT(protoObject);
 
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
 
     patchBuffer.link(bucketsOfFail, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     // Track the stub we have created so that it will be deleted later.
     structure->ref();
     chain->ref();
-    prototypeStructures->list[currentIndex].set(code, structure, chain);
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    jumpLocation.relink(entryLabel);
 }
-#endif
 
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, void* returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame)
 {
-#if USE(CTI_REPATCH_PIC)
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_list));
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
 
     ASSERT(count);
     
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(X86::eax, structure));
+    bucketsOfFail.append(checkStructure(regT0, structure));
 
     Structure* currStructure = structure;
     RefPtr<Structure>* chainEntries = chain->head();
@@ -602,102 +781,37 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), X86::ebx);
-        bucketsOfFail.append(jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress)));
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
-        bucketsOfFail.append(jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
 #endif
     }
     ASSERT(protoObject);
 
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* slowCaseBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
-
-    patchBuffer.link(bucketsOfFail, slowCaseBegin);
+    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = code;
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
-#else
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(emitJumpIfNotJSCell(X86::eax));
-    bucketsOfFail.append(checkStructure(X86::eax, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), X86::ebx);
-        bucketsOfFail.append(jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress)));
-#else
-        bucketsOfFail.append(jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-
-    patchBuffer.link(bucketsOfFail, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-
-    stubInfo->stubRoutine = code;
-
-    Jump::patch(returnAddress, code);
-#endif
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    jumpLocation.relink(entryLabel);
 }
 
-void JIT::privateCompilePutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-{
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump failureCases2 = checkStructure(X86::eax, structure);
-
-    // checks out okay! - putDirectOffset
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    storePtr(X86::edx, Address(X86::eax, cachedOffset * sizeof(JSValuePtr)));
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-    
-    patchBuffer.link(failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_fail));
-    patchBuffer.link(failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_fail));
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
 
-    stubInfo->stubRoutine = code;
-    
-    Jump::patch(returnAddress, code);
-}
-
-#endif
+#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
new file mode 100644
index 0000000000..6c9ccc19ef
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITStubCall_h
+#define JITStubCall_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+    class JITStubCall {
+    public:
+        JITStubCall(JIT* jit, JSObject* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, JSPropertyNameIterator* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, void* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, int (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, void (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Void)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        // Arguments are added first to last.
+
+        void addArgument(JIT::Imm32 argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(JIT::ImmPtr argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(JIT::RegisterID argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(unsigned src, JIT::RegisterID scratchRegister) // src is a virtual register.
+        {
+            if (m_jit->m_codeBlock->isConstantRegisterIndex(src))
+                addArgument(JIT::ImmPtr(JSValue::encode(m_jit->m_codeBlock->getConstant(src))));
+            else {
+                m_jit->loadPtr(JIT::Address(JIT::callFrameRegister, src * sizeof(Register)), scratchRegister);
+                addArgument(scratchRegister);
+            }
+            m_jit->killLastResultRegister();
+        }
+
+        JIT::Call call()
+        {
+            ASSERT(m_jit->m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+
+#if ENABLE(OPCODE_SAMPLING)
+            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
+#endif
+
+            m_jit->restoreArgumentReference();
+            JIT::Call call = m_jit->call();
+            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
+
+#if ENABLE(OPCODE_SAMPLING)
+            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
+#endif
+
+            m_jit->killLastResultRegister();
+            return call;
+        }
+
+        JIT::Call call(unsigned dst) // dst is a virtual register.
+        {
+            ASSERT(m_returnType == Value);
+            JIT::Call call = this->call();
+            m_jit->emitPutVirtualRegister(dst);
+            return call;
+        }
+
+        JIT::Call call(JIT::RegisterID dst)
+        {
+            ASSERT(m_returnType == Value);
+            JIT::Call call = this->call();
+            if (dst != JIT::returnValueRegister)
+                m_jit->move(JIT::returnValueRegister, dst);
+            return call;
+        }
+
+    private:
+        JIT* m_jit;
+        void* m_stub;
+        enum { Value, Void } m_returnType;
+        size_t m_argumentIndex;
+    };
+
+    class CallEvalJITStub : public JITStubCall {
+    public:
+        CallEvalJITStub(JIT* jit, Instruction* instruction)
+            : JITStubCall(jit, JITStubs::cti_op_call_eval)
+        {
+            int callee = instruction[2].u.operand;
+            int argCount = instruction[3].u.operand;
+            int registerOffset = instruction[4].u.operand;
+
+            addArgument(callee, JIT::regT2);
+            addArgument(JIT::Imm32(registerOffset));
+            addArgument(JIT::Imm32(argCount));
+        }
+    };
+}
+
+#endif // ENABLE(JIT)
+
+#endif // JITStubCall_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
new file mode 100644
index 0000000000..41ebd202d7
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -0,0 +1,2603 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITStubs.h"
+
+#if ENABLE(JIT)
+
+#include "Arguments.h"
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "Collector.h"
+#include "Debugger.h"
+#include "ExceptionHelpers.h"
+#include "GlobalEvalFunction.h"
+#include "JIT.h"
+#include "JSActivation.h"
+#include "JSArray.h"
+#include "JSByteArray.h"
+#include "JSFunction.h"
+#include "JSNotAnObject.h"
+#include "JSPropertyNameIterator.h"
+#include "JSStaticScopeObject.h"
+#include "JSString.h"
+#include "ObjectPrototype.h"
+#include "Operations.h"
+#include "Parser.h"
+#include "Profiler.h"
+#include "RegExpObject.h"
+#include "RegExpPrototype.h"
+#include "Register.h"
+#include "SamplingTool.h"
+#include <stdio.h>
+
+using namespace std;
+
+namespace JSC {
+
+
+#if PLATFORM(DARWIN) || PLATFORM(WIN_OS)
+#define SYMBOL_STRING(name) "_" #name
+#else
+#define SYMBOL_STRING(name) #name
+#endif
+
+#if COMPILER(GCC) && PLATFORM(X86)
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+asm(
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushl %ebp" "\n"
+    "movl %esp, %ebp" "\n"
+    "pushl %esi" "\n"
+    "pushl %edi" "\n"
+    "pushl %ebx" "\n"
+    "subl $0x1c, %esp" "\n"
+    "movl $512, %esi" "\n"
+    "movl 0x38(%esp), %edi" "\n"
+    "call *0x30(%esp)" "\n"
+    "addl $0x1c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+
+asm(
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+#if !USE(JIT_STUB_ARGUMENT_VA_LIST)
+    "movl %esp, %ecx" "\n"
+#endif
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addl $0x1c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+    
+#elif COMPILER(GCC) && PLATFORM(X86_64)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x90, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x48, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+asm(
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushq %rbp" "\n"
+    "movq %rsp, %rbp" "\n"
+    "pushq %r12" "\n"
+    "pushq %r13" "\n"
+    "pushq %r14" "\n"
+    "pushq %r15" "\n"
+    "pushq %rbx" "\n"
+    "subq $0x48, %rsp" "\n"
+    "movq $512, %r12" "\n"
+    "movq $0xFFFF000000000000, %r14" "\n"
+    "movq $0xFFFF000000000002, %r15" "\n"
+    "movq 0x90(%rsp), %r13" "\n"
+    "call *0x80(%rsp)" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+asm(
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "movq %rsp, %rdi" "\n"
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+#elif COMPILER(MSVC)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+extern "C" {
+
+    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*)
+    {
+        __asm {
+            push ebp;
+            mov ebp, esp;
+            push esi;
+            push edi;
+            push ebx;
+            sub esp, 0x1c;
+            mov esi, 512;
+            mov ecx, esp;
+            mov edi, [esp + 0x38];
+            call [esp + 0x30];
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+
+    __declspec(naked) void ctiVMThrowTrampoline()
+    {
+        __asm {
+            mov ecx, esp;
+            call JITStubs::cti_vm_throw;
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+
+    __declspec(naked) void ctiOpThrowNotCaught()
+    {
+        __asm {
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+}
+
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+    #define CTI_SAMPLER stackFrame.globalData->interpreter->sampler()
+#else
+    #define CTI_SAMPLER 0
+#endif
+
+JITThunks::JITThunks(JSGlobalData* globalData)
+{
+    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiArrayLengthTrampoline, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallPreLink, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
+}
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValue baseValue, const PutPropertySlot& slot)
+{
+    // The interpreter checks for recursion here; I do not believe this can occur in CTI.
+
+    if (!baseValue.isCell())
+        return;
+
+    // Uncacheable: give up.
+    if (!slot.isCacheable()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        return;
+    }
+    
+    JSCell* baseCell = asCell(baseValue);
+    Structure* structure = baseCell->structure();
+
+    if (structure->isDictionary()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        return;
+    }
+
+    // If baseCell != base, then baseCell must be a proxy for another object.
+    if (baseCell != slot.base()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        return;
+    }
+
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
+
+    // Cache hit: Specialize instruction and ref Structures.
+
+    // Structure transition, cache transition info
+    if (slot.type() == PutPropertySlot::NewProperty) {
+        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
+        stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
+        JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress);
+        return;
+    }
+    
+    stubInfo->initPutByIdReplace(structure);
+
+    JIT::patchPutByIdReplace(stubInfo, structure, slot.cachedOffset(), returnAddress);
+}
+
+NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot)
+{
+    // FIXME: Write a test that proves we need to check for recursion here just
+    // like the interpreter does, then add a check for recursion.
+
+    // FIXME: Cache property access for immediates.
+    if (!baseValue.isCell()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        return;
+    }
+    
+    JSGlobalData* globalData = &callFrame->globalData();
+
+    if (isJSArray(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
+        JIT::compilePatchGetArrayLength(callFrame->scopeChain()->globalData, codeBlock, returnAddress);
+        return;
+    }
+    
+    if (isJSString(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
+        // The tradeoff of compiling an patched inline string length access routine does not seem
+        // to pay off, so we currently only do this for arrays.
+        ctiPatchCallByReturnAddress(returnAddress, globalData->jitStubs.ctiStringLengthTrampoline());
+        return;
+    }
+
+    // Uncacheable: give up.
+    if (!slot.isCacheable()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        return;
+    }
+
+    JSCell* baseCell = asCell(baseValue);
+    Structure* structure = baseCell->structure();
+
+    if (structure->isDictionary()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        return;
+    }
+
+    // In the interpreter the last structure is trapped here; in CTI we use the
+    // *_second method to achieve a similar (but not quite the same) effect.
+
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
+
+    // Cache hit: Specialize instruction and ref Structures.
+
+    if (slot.slotBase() == baseValue) {
+        // set this up, so derefStructures can do it's job.
+        stubInfo->initGetByIdSelf(structure);
+
+        JIT::patchGetByIdSelf(stubInfo, structure, slot.cachedOffset(), returnAddress);
+        return;
+    }
+
+    if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
+        ASSERT(slot.slotBase().isObject());
+
+        JSObject* slotBaseObject = asObject(slot.slotBase());
+
+        // Since we're accessing a prototype in a loop, it's a good bet that it
+        // should not be treated as a dictionary.
+        if (slotBaseObject->structure()->isDictionary())
+            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        
+        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
+
+        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
+        return;
+    }
+
+    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    if (!count) {
+        stubInfo->opcodeID = op_get_by_id_generic;
+        return;
+    }
+
+    StructureChain* prototypeChain = structure->prototypeChain(callFrame);
+    stubInfo->initGetByIdChain(structure, prototypeChain);
+    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
+}
+
+#endif
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#define SETUP_VA_LISTL_ARGS va_list vl_args; va_start(vl_args, args)
+#else
+#define SETUP_VA_LISTL_ARGS
+#endif
+
+#ifndef NDEBUG
+
+extern "C" {
+
+static void jscGeneratedNativeCode() 
+{
+    // When executing a JIT stub function (which might do an allocation), we hack the return address
+    // to pretend to be executing this function, to keep stack logging tools from blowing out
+    // memory.
+}
+
+}
+
+struct StackHack {
+    ALWAYS_INLINE StackHack(JITStackFrame& stackFrame) 
+        : stackFrame(stackFrame)
+        , savedReturnAddress(*stackFrame.returnAddressSlot())
+    {
+        *stackFrame.returnAddressSlot() = reinterpret_cast<void*>(jscGeneratedNativeCode);
+    }
+
+    ALWAYS_INLINE ~StackHack() 
+    { 
+        *stackFrame.returnAddressSlot() = savedReturnAddress;
+    }
+
+    JITStackFrame& stackFrame;
+    void* savedReturnAddress;
+};
+
+#define STUB_INIT_STACK_FRAME(stackFrame) SETUP_VA_LISTL_ARGS; JITStackFrame& stackFrame = *reinterpret_cast<JITStackFrame*>(STUB_ARGS); StackHack stackHack(stackFrame)
+#define STUB_SET_RETURN_ADDRESS(returnAddress) stackHack.savedReturnAddress = returnAddress
+#define STUB_RETURN_ADDRESS stackHack.savedReturnAddress
+
+#else
+
+#define STUB_INIT_STACK_FRAME(stackFrame) SETUP_VA_LISTL_ARGS; JITStackFrame& stackFrame = *reinterpret_cast<JITStackFrame*>(STUB_ARGS)
+#define STUB_SET_RETURN_ADDRESS(returnAddress) *stackFrame.returnAddressSlot() = returnAddress
+#define STUB_RETURN_ADDRESS *stackFrame.returnAddressSlot()
+
+#endif
+
+// The reason this is not inlined is to avoid having to do a PIC branch
+// to get the address of the ctiVMThrowTrampoline function. It's also
+// good to keep the code size down by leaving as much of the exception
+// handling code out of line as possible.
+static NEVER_INLINE void returnToThrowTrampoline(JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
+{
+    ASSERT(globalData->exception);
+    globalData->exceptionLocation = exceptionLocation;
+    returnAddressSlot = reinterpret_cast<void*>(ctiVMThrowTrampoline);
+}
+
+static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
+{
+    globalData->exception = createStackOverflowError(callFrame);
+    returnToThrowTrampoline(globalData, exceptionLocation, returnAddressSlot);
+}
+
+#define VM_THROW_EXCEPTION() \
+    do { \
+        VM_THROW_EXCEPTION_AT_END(); \
+        return 0; \
+    } while (0)
+#define VM_THROW_EXCEPTION_AT_END() \
+    returnToThrowTrampoline(stackFrame.globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
+
+#define CHECK_FOR_EXCEPTION() \
+    do { \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
+            VM_THROW_EXCEPTION(); \
+    } while (0)
+#define CHECK_FOR_EXCEPTION_AT_END() \
+    do { \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
+            VM_THROW_EXCEPTION_AT_END(); \
+    } while (0)
+#define CHECK_FOR_EXCEPTION_VOID() \
+    do { \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) { \
+            VM_THROW_EXCEPTION_AT_END(); \
+            return; \
+        } \
+    } while (0)
+
+namespace JITStubs {
+
+#define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
+
+DEFINE_STUB_FUNCTION(JSObject*, op_convert_this)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v1 = stackFrame.args[0].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSObject* result = v1.toThisObject(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(void, op_end)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ScopeChainNode* scopeChain = stackFrame.callFrame->scopeChain();
+    ASSERT(scopeChain->refCount > 1);
+    scopeChain->deref();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v1 = stackFrame.args[0].jsValue();
+    JSValue v2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right = 0.0;
+
+    bool rightIsNumber = v2.getNumber(right);
+    if (rightIsNumber && v1.getNumber(left))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool leftIsString = v1.isString();
+    if (leftIsString && v2.isString()) {
+        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
+        if (UNLIKELY(!value)) {
+            throwOutOfMemoryError(callFrame);
+            VM_THROW_EXCEPTION();
+        }
+
+        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    }
+
+    if (rightIsNumber & leftIsString) {
+        RefPtr<UString::Rep> value = v2.isInt32Fast() ?
+            concatenate(asString(v1)->value().rep(), v2.getInt32Fast()) :
+            concatenate(asString(v1)->value().rep(), right);
+
+        if (UNLIKELY(!value)) {
+            throwOutOfMemoryError(callFrame);
+            VM_THROW_EXCEPTION();
+        }
+        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    }
+
+    // All other cases are pretty uncommon
+    JSValue result = jsAddSlowCase(callFrame, v1, v2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_inc)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) + 1);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, timeout_check)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    JSGlobalData* globalData = stackFrame.globalData;
+    TimeoutChecker& timeoutChecker = globalData->timeoutChecker;
+
+    if (timeoutChecker.didTimeOut(stackFrame.callFrame)) {
+        globalData->exception = createInterruptedExecutionException(globalData);
+        VM_THROW_EXCEPTION_AT_END();
+    }
+    
+    return timeoutChecker.ticksUntilNextCheck();
+}
+
+DEFINE_STUB_FUNCTION(void, register_file_check)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    if (LIKELY(stackFrame.registerFile->grow(&stackFrame.callFrame->registers()[stackFrame.callFrame->codeBlock()->m_numCalleeRegisters])))
+        return;
+
+    // Rewind to the previous call frame because op_call already optimistically
+    // moved the call frame forward.
+    CallFrame* oldCallFrame = stackFrame.callFrame->callerFrame();
+    stackFrame.callFrame = oldCallFrame;
+    throwStackOverflowError(oldCallFrame, stackFrame.globalData, oldCallFrame->returnPC(), STUB_RETURN_ADDRESS);
+}
+
+DEFINE_STUB_FUNCTION(int, op_loop_if_less)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLess(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLessEq(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_object)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return constructEmptyObject(stackFrame.callFrame);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id_generic)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_generic)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
+
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_id_second));
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
+    JITThunks::tryCachePutByID(stackFrame.callFrame, stackFrame.callFrame->codeBlock(), STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot);
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_put_by_id_transition_realloc)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    int32_t oldSize = stackFrame.args[1].int32();
+    int32_t newSize = stackFrame.args[2].int32();
+
+    ASSERT(baseValue.isObject());
+    asObject(baseValue)->allocatePropertyStorage(oldSize, newSize);
+
+    return JSValue::encode(baseValue);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_second));
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_method_check_second));
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    CHECK_FOR_EXCEPTION();
+
+    // If we successfully got something, then the base from which it is being accessed must
+    // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
+    // an isCacheable() chceck.
+    ASSERT(!slot.isCacheable() || slot.slotBase().isObject());
+
+    // Check that:
+    //   * We're dealing with a JSCell,
+    //   * the property is cachable,
+    //   * it's not a dictionary
+    //   * there is a function cached.
+    Structure* structure;
+    JSCell* specific;
+    JSObject* slotBaseObject;
+    if (baseValue.isCell()
+        && slot.isCacheable()
+        && !(structure = asCell(baseValue)->structure())->isDictionary()
+        && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
+        && specific
+        ) {
+
+        JSFunction* callee = (JSFunction*)specific;
+
+        // Since we're accessing a prototype in a loop, it's a good bet that it
+        // should not be treated as a dictionary.
+        if (slotBaseObject->structure()->isDictionary())
+            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+
+        // The result fetched should always be the callee!
+        ASSERT(result == JSValue(callee));
+        MethodCallLinkInfo& methodCallLinkInfo = callFrame->codeBlock()->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
+
+        // Check to see if the function is on the object's prototype.  Patch up the code to optimize.
+        if (slot.slotBase() == structure->prototypeForLookup(callFrame))
+            JIT::patchMethodCallProto(methodCallLinkInfo, callee, structure, slotBaseObject);
+        // Check to see if the function is on the object itself.
+        // Since we generate the method-check to check both the structure and a prototype-structure (since this
+        // is the common case) we have a problem - we need to patch the prototype structure check to do something
+        // useful.  We could try to nop it out altogether, but that's a little messy, so lets do something simpler
+        // for now.  For now it performs a check on a special object on the global object only used for this
+        // purpose.  The object is in no way exposed, and as such the check will always pass.
+        else if (slot.slotBase() == baseValue)
+            JIT::patchMethodCallProto(methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject()->methodCallDummy());
+
+        // For now let any other case be cached as a normal get_by_id.
+    }
+
+    // Revert the get_by_id op back to being a regular get_by_id - allow it to cache like normal, if it needs to.
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    JITThunks::tryCacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    CHECK_FOR_EXCEPTION();
+
+    if (baseValue.isCell()
+        && slot.isCacheable()
+        && !asCell(baseValue)->structure()->isDictionary()
+        && slot.slotBase() == baseValue) {
+
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+
+        ASSERT(slot.slotBase().isObject());
+
+        PolymorphicAccessStructureList* polymorphicStructureList;
+        int listIndex = 1;
+
+        if (stubInfo->opcodeID == op_get_by_id_self) {
+            ASSERT(!stubInfo->stubRoutine);
+            polymorphicStructureList = new PolymorphicAccessStructureList(MacroAssembler::CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure);
+            stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
+        } else {
+            polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
+            listIndex = stubInfo->u.getByIdSelfList.listSize;
+            stubInfo->u.getByIdSelfList.listSize++;
+        }
+
+        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
+
+        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+    } else {
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+    }
+    return JSValue::encode(result);
+}
+
+static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
+{
+    PolymorphicAccessStructureList* prototypeStructureList = 0;
+    listIndex = 1;
+
+    switch (stubInfo->opcodeID) {
+    case op_get_by_id_proto:
+        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
+        stubInfo->stubRoutine.reset();
+        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
+        break;
+    case op_get_by_id_chain:
+        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
+        stubInfo->stubRoutine.reset();
+        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
+        break;
+    case op_get_by_id_proto_list:
+        prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
+        listIndex = stubInfo->u.getByIdProtoList.listSize;
+        stubInfo->u.getByIdProtoList.listSize++;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    
+    ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE);
+    return prototypeStructureList;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION();
+
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+        return JSValue::encode(result);
+    }
+
+    Structure* structure = asCell(baseValue)->structure();
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+
+    ASSERT(slot.slotBase().isObject());
+    JSObject* slotBaseObject = asObject(slot.slotBase());
+
+    if (slot.slotBase() == baseValue)
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+    else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
+        // Since we're accessing a prototype in a loop, it's a good bet that it
+        // should not be treated as a dictionary.
+        if (slotBaseObject->structure()->isDictionary())
+            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+
+        int listIndex;
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+
+        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
+
+        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
+        int listIndex;
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, structure->prototypeChain(callFrame), count, slot.cachedOffset());
+
+        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+    } else
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list_full)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_array_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_string_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+#endif
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue value = stackFrame.args[0].jsValue();
+    JSValue baseVal = stackFrame.args[1].jsValue();
+    JSValue proto = stackFrame.args[2].jsValue();
+
+    // At least one of these checks must have failed to get to the slow case.
+    ASSERT(!value.isCell() || !baseVal.isCell() || !proto.isCell()
+           || !value.isObject() || !baseVal.isObject() || !proto.isObject() 
+           || (asObject(baseVal)->structure()->typeInfo().flags() & (ImplementsHasInstance | OverridesHasInstance)) != ImplementsHasInstance);
+
+
+    // ECMA-262 15.3.5.3:
+    // Throw an exception either if baseVal is not an object, or if it does not implement 'HasInstance' (i.e. is a function).
+    TypeInfo typeInfo(UnspecifiedType, 0);
+    if (!baseVal.isObject() || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance()) {
+        CallFrame* callFrame = stackFrame.callFrame;
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+        stackFrame.globalData->exception = createInvalidParamError(callFrame, "instanceof", baseVal, vPCIndex, codeBlock);
+        VM_THROW_EXCEPTION();
+    }
+    ASSERT(typeInfo.type() != UnspecifiedType);
+
+    if (!typeInfo.overridesHasInstance()) {
+        if (!value.isObject())
+            return JSValue::encode(jsBoolean(false));
+
+        if (!proto.isObject()) {
+            throwError(callFrame, TypeError, "instanceof called on an object with an invalid prototype property.");
+            VM_THROW_EXCEPTION();
+        }
+    }
+
+    JSValue result = jsBoolean(asObject(baseVal)->hasInstance(callFrame, value, proto));
+    CHECK_FOR_EXCEPTION_AT_END();
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_id)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    
+    JSObject* baseObj = stackFrame.args[0].jsValue().toObject(callFrame);
+
+    JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, stackFrame.args[1].identifier()));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_mul)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right;
+    if (src1.getNumber(left) && src2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left * right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) * src2.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_func)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return stackFrame.args[0].funcDeclNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+}
+
+DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+#ifndef NDEBUG
+    CallData callData;
+    ASSERT(stackFrame.args[0].jsValue().getCallData(callData) == CallTypeJS);
+#endif
+
+    JSFunction* function = asFunction(stackFrame.args[0].jsValue());
+    FunctionBodyNode* body = function->body();
+    ScopeChainNode* callDataScopeChain = function->scope().node();
+    body->jitCode(callDataScopeChain);
+
+    return &(body->generatedBytecode());
+}
+
+DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* newCodeBlock = stackFrame.args[3].codeBlock();
+    int argCount = stackFrame.args[2].int32();
+
+    ASSERT(argCount != newCodeBlock->m_numParameters);
+
+    CallFrame* oldCallFrame = callFrame->callerFrame();
+
+    if (argCount > newCodeBlock->m_numParameters) {
+        size_t numParameters = newCodeBlock->m_numParameters;
+        Register* r = callFrame->registers() + numParameters;
+
+        Register* argv = r - RegisterFile::CallFrameHeaderSize - numParameters - argCount;
+        for (size_t i = 0; i < numParameters; ++i)
+            argv[i + argCount] = argv[i];
+
+        callFrame = CallFrame::create(r);
+        callFrame->setCallerFrame(oldCallFrame);
+    } else {
+        size_t omittedArgCount = newCodeBlock->m_numParameters - argCount;
+        Register* r = callFrame->registers() + omittedArgCount;
+        Register* newEnd = r + newCodeBlock->m_numCalleeRegisters;
+        if (!stackFrame.registerFile->grow(newEnd)) {
+            // Rewind to the previous call frame because op_call already optimistically
+            // moved the call frame forward.
+            stackFrame.callFrame = oldCallFrame;
+            throwStackOverflowError(oldCallFrame, stackFrame.globalData, stackFrame.args[1].returnAddress(), STUB_RETURN_ADDRESS);
+            RETURN_POINTER_PAIR(0, 0);
+        }
+
+        Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
+        for (size_t i = 0; i < omittedArgCount; ++i)
+            argv[i] = jsUndefined();
+
+        callFrame = CallFrame::create(r);
+        callFrame->setCallerFrame(oldCallFrame);
+    }
+
+    RETURN_POINTER_PAIR(newCodeBlock, callFrame);
+}
+
+DEFINE_STUB_FUNCTION(void*, vm_dontLazyLinkCall)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSGlobalData* globalData = stackFrame.globalData;
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
+
+    ctiPatchNearCallByReturnAddress(stackFrame.args[1].returnAddress(), globalData->jitStubs.ctiVirtualCallLink());
+
+    return callee->body()->generatedJITCode().addressForCall().executableAddress();
+}
+
+DEFINE_STUB_FUNCTION(void*, vm_lazyLinkCall)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
+    JITCode& jitCode = callee->body()->generatedJITCode();
+    
+    CodeBlock* codeBlock = 0;
+    if (!callee->isHostFunction())
+        codeBlock = &callee->body()->bytecode(callee->scope().node());
+
+    CallLinkInfo* callLinkInfo = &stackFrame.callFrame->callerFrame()->codeBlock()->getCallLinkInfo(stackFrame.args[1].returnAddress());
+    JIT::linkCall(callee, codeBlock, jitCode, callLinkInfo, stackFrame.args[2].int32());
+
+    return jitCode.addressForCall().executableAddress();
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionBodyNode*>(stackFrame.callFrame->codeBlock()->ownerNode()));
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->copy()->push(activation));
+    return activation;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_NotJSFunction)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue funcVal = stackFrame.args[0].jsValue();
+
+    CallData callData;
+    CallType callType = funcVal.getCallData(callData);
+
+    ASSERT(callType != CallTypeJS);
+
+    if (callType == CallTypeHost) {
+        int registerOffset = stackFrame.args[1].int32();
+        int argCount = stackFrame.args[2].int32();
+        CallFrame* previousCallFrame = stackFrame.callFrame;
+        CallFrame* callFrame = CallFrame::create(previousCallFrame->registers() + registerOffset);
+
+        callFrame->init(0, static_cast<Instruction*>(STUB_RETURN_ADDRESS), previousCallFrame->scopeChain(), previousCallFrame, 0, argCount, 0);
+        stackFrame.callFrame = callFrame;
+
+        Register* argv = stackFrame.callFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
+        ArgList argList(argv + 1, argCount - 1);
+
+        JSValue returnValue;
+        {
+            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
+
+            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
+            JSValue thisValue = argv[0].jsValue();
+            if (thisValue == jsNull())
+                thisValue = callFrame->globalThisValue();
+
+            returnValue = callData.native.function(callFrame, asObject(funcVal), thisValue, argList);
+        }
+        stackFrame.callFrame = previousCallFrame;
+        CHECK_FOR_EXCEPTION();
+
+        return JSValue::encode(returnValue);
+    }
+
+    ASSERT(callType == CallTypeNone);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createNotAFunctionError(stackFrame.callFrame, funcVal, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(void, op_create_arguments)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame);
+    stackFrame.callFrame->setCalleeArguments(arguments);
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
+}
+
+DEFINE_STUB_FUNCTION(void, op_create_arguments_no_params)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame, Arguments::NoParameters);
+    stackFrame.callFrame->setCalleeArguments(arguments);
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
+}
+
+DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    asActivation(stackFrame.args[0].jsValue())->copyRegisters(stackFrame.callFrame->optionalCalleeArguments());
+}
+
+DEFINE_STUB_FUNCTION(void, op_tear_off_arguments)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(stackFrame.callFrame->codeBlock()->usesArguments() && !stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    if (stackFrame.callFrame->optionalCalleeArguments())
+        stackFrame.callFrame->optionalCalleeArguments()->copyRegisters();
+}
+
+DEFINE_STUB_FUNCTION(void, op_profile_will_call)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(*stackFrame.enabledProfilerReference);
+    (*stackFrame.enabledProfilerReference)->willExecute(stackFrame.callFrame, stackFrame.args[0].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(void, op_profile_did_call)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(*stackFrame.enabledProfilerReference);
+    (*stackFrame.enabledProfilerReference)->didExecute(stackFrame.callFrame, stackFrame.args[0].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(void, op_ret_scopeChain)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    stackFrame.callFrame->scopeChain()->deref();
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ArgList argList(&stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
+    return constructArray(stackFrame.callFrame, argList);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+    ASSERT(iter != end);
+
+    Identifier& ident = stackFrame.args[0].identifier();
+    do {
+        JSObject* o = *iter;
+        PropertySlot slot(o);
+        if (o->getPropertySlot(callFrame, ident, slot)) {
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+            return JSValue::encode(result);
+        }
+    } while (++iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSFunction* constructor = asFunction(stackFrame.args[0].jsValue());
+    if (constructor->isHostFunction()) {
+        CallFrame* callFrame = stackFrame.callFrame;
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+        stackFrame.globalData->exception = createNotAConstructorError(callFrame, constructor, vPCIndex, codeBlock);
+        VM_THROW_EXCEPTION();
+    }
+
+#ifndef NDEBUG
+    ConstructData constructData;
+    ASSERT(constructor->getConstructData(constructData) == ConstructTypeJS);
+#endif
+
+    Structure* structure;
+    if (stackFrame.args[3].jsValue().isObject())
+        structure = asObject(stackFrame.args[3].jsValue())->inheritorID();
+    else
+        structure = constructor->scope().node()->globalObject()->emptyObjectStructure();
+    return new (stackFrame.globalData) JSObject(structure);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_construct_NotJSConstruct)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue constrVal = stackFrame.args[0].jsValue();
+    int argCount = stackFrame.args[2].int32();
+    int thisRegister = stackFrame.args[4].int32();
+
+    ConstructData constructData;
+    ConstructType constructType = constrVal.getConstructData(constructData);
+
+    if (constructType == ConstructTypeHost) {
+        ArgList argList(callFrame->registers() + thisRegister + 1, argCount - 1);
+
+        JSValue returnValue;
+        {
+            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
+            returnValue = constructData.native.function(callFrame, asObject(constrVal), argList);
+        }
+        CHECK_FOR_EXCEPTION();
+
+        return JSValue::encode(returnValue);
+    }
+
+    ASSERT(constructType == ConstructTypeNone);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createNotAConstructorError(callFrame, constrVal, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+
+    JSValue result;
+
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSArray(globalData, baseValue)) {
+            JSArray* jsArray = asArray(baseValue);
+            if (jsArray->canGetIndex(i))
+                result = jsArray->getIndex(i);
+            else
+                result = jsArray->JSArray::get(callFrame, i);
+        } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
+            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+        } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_byte_array));
+            return JSValue::encode(asByteArray(baseValue)->getIndex(callFrame, i));
+        } else
+            result = baseValue.get(callFrame, i);
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, property);
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+    
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+    
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    
+    JSValue result;
+    
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
+            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+        else {
+            result = baseValue.get(callFrame, i);
+            if (!isJSString(globalData, baseValue))
+                ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val));
+        }
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, property);
+    }
+    
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+    
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_byte_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+    
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    
+    JSValue result;
+
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            return JSValue::encode(asByteArray(baseValue)->getIndex(callFrame, i));
+        }
+
+        result = baseValue.get(callFrame, i);
+        if (!isJSByteArray(globalData, baseValue))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val));
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, property);
+    }
+    
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_func)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+
+    // FIXME: add scopeDepthIsZero optimization
+
+    ASSERT(iter != end);
+
+    Identifier& ident = stackFrame.args[0].identifier();
+    JSObject* base;
+    do {
+        base = *iter;
+        PropertySlot slot(base);
+        if (base->getPropertySlot(callFrame, ident, slot)) {            
+            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
+            // However, section 10.2.3 says that in the case where the value provided
+            // by the caller is null, the global object should be used. It also says
+            // that the section does not apply to internal functions, but for simplicity
+            // of implementation we use the global object anyway here. This guarantees
+            // that in host objects you always get a valid object for this.
+            // We also handle wrapper substitution for the global object at the same time.
+            JSObject* thisObj = base->toThisObject(callFrame);
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+
+            callFrame->registers()[stackFrame.args[1].int32()] = JSValue(thisObj);
+            return JSValue::encode(result);
+        }
+        ++iter;
+    } while (iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION_AT_END();
+    return JSValue::encode(JSValue());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_sub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right;
+    if (src1.getNumber(left) && src2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left - right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) - src2.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_val)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue value = stackFrame.args[2].jsValue();
+
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSArray(globalData, baseValue)) {
+            JSArray* jsArray = asArray(baseValue);
+            if (jsArray->canSetIndex(i))
+                jsArray->setIndex(i, value);
+            else
+                jsArray->JSArray::put(callFrame, i, value);
+        } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            JSByteArray* jsByteArray = asByteArray(baseValue);
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val_byte_array));
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            if (value.isInt32Fast()) {
+                jsByteArray->setIndex(i, value.getInt32Fast());
+                return;
+            } else {
+                double dValue = 0;
+                if (value.getNumber(dValue)) {
+                    jsByteArray->setIndex(i, dValue);
+                    return;
+                }
+            }
+
+            baseValue.put(callFrame, i, value);
+        } else
+            baseValue.put(callFrame, i, value);
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
+            PutPropertySlot slot;
+            baseValue.put(callFrame, property, value, slot);
+        }
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_val_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    int i = stackFrame.args[1].int32();
+    JSValue value = stackFrame.args[2].jsValue();
+
+    ASSERT(isJSArray(stackFrame.globalData, baseValue));
+
+    if (LIKELY(i >= 0))
+        asArray(baseValue)->JSArray::put(callFrame, i, value);
+    else {
+        // This should work since we're re-boxing an immediate unboxed in JIT code.
+        ASSERT(JSValue::makeInt32Fast(i));
+        Identifier property(callFrame, JSValue::makeInt32Fast(i).toString(callFrame));
+        // FIXME: can toString throw an exception here?
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
+            PutPropertySlot slot;
+            baseValue.put(callFrame, property, value, slot);
+        }
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+    
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue value = stackFrame.args[2].jsValue();
+    
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            JSByteArray* jsByteArray = asByteArray(baseValue);
+            
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            if (value.isInt32Fast()) {
+                jsByteArray->setIndex(i, value.getInt32Fast());
+                return;
+            } else {
+                double dValue = 0;                
+                if (value.getNumber(dValue)) {
+                    jsByteArray->setIndex(i, dValue);
+                    return;
+                }
+            }
+        }
+
+        if (!isJSByteArray(globalData, baseValue))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val));
+        baseValue.put(callFrame, i, value);
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
+            PutPropertySlot slot;
+            baseValue.put(callFrame, property, value, slot);
+        }
+    }
+    
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_lesseq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(jsLessEq(callFrame, stackFrame.args[0].jsValue(), stackFrame.args[1].jsValue()));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, op_loop_if_true)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = src1.toBoolean(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+    
+DEFINE_STUB_FUNCTION(int, op_load_varargs)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    RegisterFile* registerFile = stackFrame.registerFile;
+    int argsOffset = stackFrame.args[0].int32();
+    JSValue arguments = callFrame->registers()[argsOffset].jsValue();
+    uint32_t argCount = 0;
+    if (!arguments) {
+        int providedParams = callFrame->registers()[RegisterFile::ArgumentCount].i() - 1;
+        argCount = providedParams;
+        int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+        Register* newEnd = callFrame->registers() + sizeDelta;
+        if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+            stackFrame.globalData->exception = createStackOverflowError(callFrame);
+            VM_THROW_EXCEPTION();
+        }
+        int32_t expectedParams = asFunction(callFrame->registers()[RegisterFile::Callee].jsValue())->body()->parameterCount();
+        int32_t inplaceArgs = min(providedParams, expectedParams);
+        
+        Register* inplaceArgsDst = callFrame->registers() + argsOffset;
+
+        Register* inplaceArgsEnd = inplaceArgsDst + inplaceArgs;
+        Register* inplaceArgsEnd2 = inplaceArgsDst + providedParams;
+
+        Register* inplaceArgsSrc = callFrame->registers() - RegisterFile::CallFrameHeaderSize - expectedParams;
+        Register* inplaceArgsSrc2 = inplaceArgsSrc - providedParams - 1 + inplaceArgs;
+ 
+        // First step is to copy the "expected" parameters from their normal location relative to the callframe
+        while (inplaceArgsDst < inplaceArgsEnd)
+            *inplaceArgsDst++ = *inplaceArgsSrc++;
+
+        // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
+        while (inplaceArgsDst < inplaceArgsEnd2)
+            *inplaceArgsDst++ = *inplaceArgsSrc2++;
+
+    } else if (!arguments.isUndefinedOrNull()) {
+        if (!arguments.isObject()) {
+            CodeBlock* codeBlock = callFrame->codeBlock();
+            unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+            stackFrame.globalData->exception = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPCIndex, codeBlock);
+            VM_THROW_EXCEPTION();
+        }
+        if (asObject(arguments)->classInfo() == &Arguments::info) {
+            Arguments* argsObject = asArguments(arguments);
+            argCount = argsObject->numProvidedArguments(callFrame);
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            argsObject->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+        } else if (isJSArray(&callFrame->globalData(), arguments)) {
+            JSArray* array = asArray(arguments);
+            argCount = array->length();
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+        } else if (asObject(arguments)->inherits(&JSArray::info)) {
+            JSObject* argObject = asObject(arguments);
+            argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            Register* argsBuffer = callFrame->registers() + argsOffset;
+            for (unsigned i = 0; i < argCount; ++i) {
+                argsBuffer[i] = asObject(arguments)->get(callFrame, i);
+                CHECK_FOR_EXCEPTION();
+            }
+        } else {
+            CodeBlock* codeBlock = callFrame->codeBlock();
+            unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+            stackFrame.globalData->exception = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPCIndex, codeBlock);
+            VM_THROW_EXCEPTION();
+        }
+    }
+
+    return argCount + 1;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_negate)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+
+    double v;
+    if (src.getNumber(v))
+        return JSValue::encode(jsNumber(stackFrame.globalData, -v));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, -src.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    int skip = stackFrame.args[1].int32();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+    ASSERT(iter != end);
+    while (skip--) {
+        ++iter;
+        ASSERT(iter != end);
+    }
+    Identifier& ident = stackFrame.args[0].identifier();
+    do {
+        JSObject* o = *iter;
+        PropertySlot slot(o);
+        if (o->getPropertySlot(callFrame, ident, slot)) {
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+            return JSValue::encode(result);
+        }
+    } while (++iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalObject* globalObject = asGlobalObject(stackFrame.args[0].jsValue());
+    Identifier& ident = stackFrame.args[1].identifier();
+    unsigned globalResolveInfoIndex = stackFrame.args[2].int32();
+    ASSERT(globalObject->isGlobalObject());
+
+    PropertySlot slot(globalObject);
+    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
+        JSValue result = slot.getValue(callFrame, ident);
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
+            GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
+            if (globalResolveInfo.structure)
+                globalResolveInfo.structure->deref();
+            globalObject->structure()->ref();
+            globalResolveInfo.structure = globalObject->structure();
+            globalResolveInfo.offset = slot.cachedOffset();
+            return JSValue::encode(result);
+        }
+
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
+    }
+
+    unsigned vPCIndex = callFrame->codeBlock()->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, callFrame->codeBlock());
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_div)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right;
+    if (src1.getNumber(left) && src2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left / right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) / src2.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_dec)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) - 1);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, op_jless)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLess(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(int, op_jlesseq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLessEq(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_not)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = jsBoolean(!src.toBoolean(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, op_jtrue)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = src1.toBoolean(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue number = v.toJSNumber(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() + 1);
+    return JSValue::encode(number);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_eq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
+    JSValue result = jsBoolean(JSValue::equalSlowCaseInline(callFrame, src1, src2));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
+
+    int32_t left;
+    uint32_t right;
+    if (JSValue::areBothInt32Fast(val, shift))
+        return JSValue::encode(jsNumber(stackFrame.globalData, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
+    if (val.numberToInt32(left) && shift.numberToUInt32(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left << (right & 0x1f)));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitand)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    int32_t left;
+    int32_t right;
+    if (src1.numberToInt32(left) && src2.numberToInt32(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left & right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) & src2.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_rshift)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
+
+    int32_t left;
+    uint32_t right;
+    if (JSFastMath::canDoFastRshift(val, shift))
+        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
+    if (val.numberToInt32(left) && shift.numberToUInt32(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left >> (right & 0x1f)));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitnot)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+
+    int value;
+    if (src.numberToInt32(value))
+        return JSValue::encode(jsNumber(stackFrame.globalData, ~value));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, ~src.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+
+    // FIXME: add scopeDepthIsZero optimization
+
+    ASSERT(iter != end);
+
+    Identifier& ident = stackFrame.args[0].identifier();
+    JSObject* base;
+    do {
+        base = *iter;
+        PropertySlot slot(base);
+        if (base->getPropertySlot(callFrame, ident, slot)) {
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+
+            callFrame->registers()[stackFrame.args[1].int32()] = JSValue(base);
+            return JSValue::encode(result);
+        }
+        ++iter;
+    } while (iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION_AT_END();
+    return JSValue::encode(JSValue());
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return stackFrame.args[0].funcExprNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_mod)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue dividendValue = stackFrame.args[0].jsValue();
+    JSValue divisorValue = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    double d = dividendValue.toNumber(callFrame);
+    JSValue result = jsNumber(stackFrame.globalData, fmod(d, divisorValue.toNumber(callFrame)));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_less)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(jsLess(callFrame, stackFrame.args[0].jsValue(), stackFrame.args[1].jsValue()));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_neq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(!JSValue::equalSlowCaseInline(callFrame, src1, src2));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_dec)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue number = v.toJSNumber(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() - 1);
+    return JSValue::encode(number);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_urshift)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    if (JSFastMath::canDoFastUrshift(val, shift))
+        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
+    else {
+        JSValue result = jsNumber(stackFrame.globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
+    }
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitxor)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_regexp)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return new (stackFrame.globalData) RegExpObject(stackFrame.callFrame->lexicalGlobalObject()->regExpStructure(), stackFrame.args[0].regExp());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitor)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) | src2.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    RegisterFile* registerFile = stackFrame.registerFile;
+
+    Interpreter* interpreter = stackFrame.globalData->interpreter;
+    
+    JSValue funcVal = stackFrame.args[0].jsValue();
+    int registerOffset = stackFrame.args[1].int32();
+    int argCount = stackFrame.args[2].int32();
+
+    Register* newCallFrame = callFrame->registers() + registerOffset;
+    Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
+    JSValue thisValue = argv[0].jsValue();
+    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
+
+    if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
+        JSValue exceptionValue;
+        JSValue result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
+        if (UNLIKELY(exceptionValue != JSValue())) {
+            stackFrame.globalData->exception = exceptionValue;
+            VM_THROW_EXCEPTION_AT_END();
+        }
+        return JSValue::encode(result);
+    }
+
+    return JSValue::encode(JSValue());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+
+    JSValue exceptionValue = stackFrame.args[0].jsValue();
+    ASSERT(exceptionValue);
+
+    HandlerInfo* handler = stackFrame.globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
+
+    if (!handler) {
+        *stackFrame.exception = exceptionValue;
+        STUB_SET_RETURN_ADDRESS(reinterpret_cast<void*>(ctiOpThrowNotCaught));
+        return JSValue::encode(jsNull());
+    }
+
+    stackFrame.callFrame = callFrame;
+    void* catchRoutine = handler->nativeCode.addressForExceptionHandler();
+    ASSERT(catchRoutine);
+    STUB_SET_RETURN_ADDRESS(catchRoutine);
+    return JSValue::encode(exceptionValue);
+}
+
+DEFINE_STUB_FUNCTION(JSPropertyNameIterator*, op_get_pnames)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSPropertyNameIterator::create(stackFrame.callFrame, stackFrame.args[0].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_next_pname)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSPropertyNameIterator* it = stackFrame.args[0].propertyNameIterator();
+    JSValue temp = it->next(stackFrame.callFrame);
+    if (!temp)
+        it->invalidate();
+    return JSValue::encode(temp);
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSObject* o = stackFrame.args[0].jsValue().toObject(stackFrame.callFrame);
+    CHECK_FOR_EXCEPTION();
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->push(o));
+    return o;
+}
+
+DEFINE_STUB_FUNCTION(void, op_pop_scope)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->pop());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_typeof)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsTypeStringForValue(stackFrame.callFrame, stackFrame.args[0].jsValue()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_undefined)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+    return JSValue::encode(jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_boolean)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(stackFrame.args[0].jsValue().isBoolean()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_number)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(stackFrame.args[0].jsValue().isNumber()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_string)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(isJSString(stackFrame.globalData, stackFrame.args[0].jsValue())));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_object)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(jsIsObjectType(stackFrame.args[0].jsValue())));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_function)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(jsIsFunctionType(stackFrame.args[0].jsValue())));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_primitive)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(stackFrame.args[0].jsValue().toPrimitive(stackFrame.callFrame));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_strcat)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_jsnumber)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = src.toJSNumber(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_in)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue baseVal = stackFrame.args[1].jsValue();
+
+    if (!baseVal.isObject()) {
+        CallFrame* callFrame = stackFrame.callFrame;
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+        stackFrame.globalData->exception = createInvalidParamError(callFrame, "in", baseVal, vPCIndex, codeBlock);
+        VM_THROW_EXCEPTION();
+    }
+
+    JSValue propName = stackFrame.args[0].jsValue();
+    JSObject* baseObj = asObject(baseVal);
+
+    uint32_t i;
+    if (propName.getUInt32(i))
+        return JSValue::encode(jsBoolean(baseObj->hasProperty(callFrame, i)));
+
+    Identifier property(callFrame, propName.toString(callFrame));
+    CHECK_FOR_EXCEPTION();
+    return JSValue::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_push_new_scope)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSObject* scope = new (stackFrame.globalData) JSStaticScopeObject(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.args[1].jsValue(), DontDelete);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    callFrame->setScopeChain(callFrame->scopeChain()->push(scope));
+    return scope;
+}
+
+DEFINE_STUB_FUNCTION(void, op_jmp_scopes)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    unsigned count = stackFrame.args[0].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ScopeChainNode* tmp = callFrame->scopeChain();
+    while (count--)
+        tmp = tmp->pop();
+    callFrame->setScopeChain(tmp);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_index)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    unsigned property = stackFrame.args[1].int32();
+
+    stackFrame.args[0].jsValue().put(callFrame, property, stackFrame.args[2].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(void*, op_switch_imm)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    if (scrutinee.isInt32Fast())
+        return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(scrutinee.getInt32Fast()).addressForSwitch();
+    else {
+        double value;
+        int32_t intValue;
+        if (scrutinee.getNumber(value) && ((intValue = static_cast<int32_t>(value)) == value))
+            return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(intValue).addressForSwitch();
+        else
+            return codeBlock->immediateSwitchJumpTable(tableIndex).ctiDefault.addressForSwitch();
+    }
+}
+
+DEFINE_STUB_FUNCTION(void*, op_switch_char)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault.addressForSwitch();
+
+    if (scrutinee.isString()) {
+        UString::Rep* value = asString(scrutinee)->value().rep();
+        if (value->size() == 1)
+            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]).addressForSwitch();
+    }
+
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(void*, op_switch_string)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault.addressForSwitch();
+
+    if (scrutinee.isString()) {
+        UString::Rep* value = asString(scrutinee)->value().rep();
+        result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value).addressForSwitch();
+    }
+
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_val)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSObject* baseObj = baseValue.toObject(callFrame); // may throw
+
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue result;
+    uint32_t i;
+    if (subscript.getUInt32(i))
+        result = jsBoolean(baseObj->deleteProperty(callFrame, i));
+    else {
+        CHECK_FOR_EXCEPTION();
+        Identifier property(callFrame, subscript.toString(callFrame));
+        CHECK_FOR_EXCEPTION();
+        result = jsBoolean(baseObj->deleteProperty(callFrame, property));
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_getter)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ASSERT(stackFrame.args[0].jsValue().isObject());
+    JSObject* baseObj = asObject(stackFrame.args[0].jsValue());
+    ASSERT(stackFrame.args[2].jsValue().isObject());
+    baseObj->defineGetter(callFrame, stackFrame.args[1].identifier(), asObject(stackFrame.args[2].jsValue()));
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_setter)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ASSERT(stackFrame.args[0].jsValue().isObject());
+    JSObject* baseObj = asObject(stackFrame.args[0].jsValue());
+    ASSERT(stackFrame.args[2].jsValue().isObject());
+    baseObj->defineSetter(callFrame, stackFrame.args[1].identifier(), asObject(stackFrame.args[2].jsValue()));
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_error)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned type = stackFrame.args[0].int32();
+    JSValue message = stackFrame.args[1].jsValue();
+    unsigned bytecodeOffset = stackFrame.args[2].int32();
+
+    unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
+    return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+}
+
+DEFINE_STUB_FUNCTION(void, op_debug)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    int debugHookID = stackFrame.args[0].int32();
+    int firstLine = stackFrame.args[1].int32();
+    int lastLine = stackFrame.args[2].int32();
+
+    stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    JSGlobalData* globalData = stackFrame.globalData;
+
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, globalData->exceptionLocation);
+
+    JSValue exceptionValue = globalData->exception;
+    ASSERT(exceptionValue);
+    globalData->exception = JSValue();
+
+    HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, false);
+
+    if (!handler) {
+        *stackFrame.exception = exceptionValue;
+        return JSValue::encode(jsNull());
+    }
+
+    stackFrame.callFrame = callFrame;
+    void* catchRoutine = handler->nativeCode.addressForExceptionHandler();
+    ASSERT(catchRoutine);
+    STUB_SET_RETURN_ADDRESS(catchRoutine);
+    return JSValue::encode(exceptionValue);
+}
+
+} // namespace JITStubs
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
new file mode 100644
index 0000000000..48e536937c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -0,0 +1,319 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JITStubs_h
+#define JITStubs_h
+
+#include <wtf/Platform.h>
+
+#include "MacroAssemblerCodeRef.h"
+#include "Register.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+    class CodeBlock;
+    class ExecutablePool;
+    class Identifier;
+    class JSGlobalData;
+    class JSGlobalData;
+    class JSObject;
+    class JSPropertyNameIterator;
+    class JSValue;
+    class JSValueEncodedAsPointer;
+    class Profiler;
+    class PropertySlot;
+    class PutPropertySlot;
+    class RegisterFile;
+    class FuncDeclNode;
+    class FuncExprNode;
+    class RegExp;
+
+    union JITStubArg {
+        void* asPointer;
+        EncodedJSValue asEncodedJSValue;
+        int32_t asInt32;
+
+        JSValue jsValue() { return JSValue::decode(asEncodedJSValue); }
+        Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
+        int32_t int32() { return asInt32; }
+        CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
+        FuncDeclNode* funcDeclNode() { return static_cast<FuncDeclNode*>(asPointer); }
+        FuncExprNode* funcExprNode() { return static_cast<FuncExprNode*>(asPointer); }
+        RegExp* regExp() { return static_cast<RegExp*>(asPointer); }
+        JSPropertyNameIterator* propertyNameIterator() { return static_cast<JSPropertyNameIterator*>(asPointer); }
+        void* returnAddress() { return asPointer; }
+    };
+
+#if PLATFORM(X86_64)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[8];
+
+        void* savedRBX;
+        void* savedR15;
+        void* savedR14;
+        void* savedR13;
+        void* savedR12;
+        void* savedRBP;
+        void* savedRIP;
+
+        void* code;
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+
+        // When JIT code makes a call, it pushes its return address just below the rest of the stack.
+        void** returnAddressSlot() { return reinterpret_cast<void**>(this) - 1; }
+    };
+#elif PLATFORM(X86)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[6];
+
+        void* savedEBX;
+        void* savedEDI;
+        void* savedESI;
+        void* savedEBP;
+        void* savedEIP;
+
+        void* code;
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+        
+        // When JIT code makes a call, it pushes its return address just below the rest of the stack.
+        void** returnAddressSlot() { return reinterpret_cast<void**>(this) - 1; }
+    };
+#else
+#error "JITStackFrame not defined for this platform."
+#endif
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+    #define STUB_ARGS_DECLARATION void* args, ...
+    #define STUB_ARGS (reinterpret_cast<void**>(vl_args) - 1)
+
+    #if COMPILER(MSVC)
+    #define JIT_STUB __cdecl
+    #else
+    #define JIT_STUB
+    #endif
+#else
+    #define STUB_ARGS_DECLARATION void** args
+    #define STUB_ARGS (args)
+
+    #if PLATFORM(X86) && COMPILER(MSVC)
+    #define JIT_STUB __fastcall
+    #elif PLATFORM(X86) && COMPILER(GCC)
+    #define JIT_STUB  __attribute__ ((fastcall))
+    #else
+    #define JIT_STUB
+    #endif
+#endif
+
+#if PLATFORM(X86_64)
+    struct VoidPtrPair {
+        void* first;
+        void* second;
+    };
+    #define RETURN_POINTER_PAIR(a,b) VoidPtrPair pair = { a, b }; return pair
+#else
+    // MSVC doesn't support returning a two-value struct in two registers, so
+    // we cast the struct to int64_t instead.
+    typedef uint64_t VoidPtrPair;
+    union VoidPtrPairUnion {
+        struct { void* first; void* second; } s;
+        VoidPtrPair i;
+    };
+    #define RETURN_POINTER_PAIR(a,b) VoidPtrPairUnion pair = {{ a, b }}; return pair.i
+#endif
+
+    extern "C" void ctiVMThrowTrampoline();
+    extern "C" void ctiOpThrowNotCaught();
+    extern "C" EncodedJSValue ctiTrampoline(
+#if PLATFORM(X86_64)
+            // FIXME: (bug #22910) this will force all arguments onto the stack (regparm(0) does not appear to have any effect).
+            // We can allow register passing here, and move the writes of these values into the trampoline.
+            void*, void*, void*, void*, void*, void*,
+#endif
+            void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*);
+
+    class JITThunks {
+    public:
+        JITThunks(JSGlobalData*);
+
+        static void tryCacheGetByID(CallFrame*, CodeBlock*, void* returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
+        static void tryCachePutByID(CallFrame*, CodeBlock*, void* returnAddress, JSValue baseValue, const PutPropertySlot&);
+        
+        MacroAssemblerCodePtr ctiArrayLengthTrampoline() { return m_ctiArrayLengthTrampoline; }
+        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
+        MacroAssemblerCodePtr ctiVirtualCallPreLink() { return m_ctiVirtualCallPreLink; }
+        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
+        MacroAssemblerCodePtr ctiVirtualCall() { return m_ctiVirtualCall; }
+        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_ctiNativeCallThunk; }
+
+    private:
+        RefPtr<ExecutablePool> m_executablePool;
+
+        MacroAssemblerCodePtr m_ctiArrayLengthTrampoline;
+        MacroAssemblerCodePtr m_ctiStringLengthTrampoline;
+        MacroAssemblerCodePtr m_ctiVirtualCallPreLink;
+        MacroAssemblerCodePtr m_ctiVirtualCallLink;
+        MacroAssemblerCodePtr m_ctiVirtualCall;
+        MacroAssemblerCodePtr m_ctiNativeCallThunk;
+    };
+
+namespace JITStubs { extern "C" {
+
+    void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_end(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_jmp_scopes(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_pop_scope(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_did_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_will_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_second(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_register_file_check(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jless(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_char(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_imm(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_string(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_dontLazyLinkCall(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_object(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS_DECLARATION);
+    JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_add(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitand(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitnot(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitor(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitxor(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_call_eval(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_del_by_id(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_del_by_val(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_div(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check_second(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_second(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_self_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_string_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val_byte_array(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val_string(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_in(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_instanceof(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_boolean(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_function(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_number(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_object(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_string(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_undefined(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_less(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_lesseq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_lshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_mod(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_mul(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_negate(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_neq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_next_pname(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_not(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_nstricteq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_pre_dec(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_pre_inc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_base(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_global(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_skip(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_rshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_strcat(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_stricteq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_sub(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_to_jsnumber(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_to_primitive(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_inc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_func(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_with_base(STUB_ARGS_DECLARATION);
+    VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION);
+
+}; } // extern "C" namespace JITStubs
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // JITStubs_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index c8b796dcab..21a8c18a97 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -26,6 +26,7 @@
 #include "Completion.h"
 #include "InitializeThreading.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "JSLock.h"
 #include "PrototypeFunction.h"
 #include "SamplingTool.h"
@@ -54,6 +55,7 @@
 #if COMPILER(MSVC) && !PLATFORM(WIN_CE)
 #include <crtdbg.h>
 #include <windows.h>
+#include <mmsystem.h>
 #endif
 
 #if PLATFORM(QT)
@@ -67,14 +69,30 @@ using namespace WTF;
 static void cleanupGlobalData(JSGlobalData*);
 static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>& buffer);
 
-static JSValuePtr functionPrint(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionDebug(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionGC(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionVersion(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionRun(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionLoad(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionReadline(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionQuit(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL functionPrint(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionDebug(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionGC(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionVersion(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionRun(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionLoad(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionReadline(ExecState*, JSObject*, JSValue, const ArgList&);
+static NO_RETURN JSValue JSC_HOST_CALL functionQuit(ExecState*, JSObject*, JSValue, const ArgList&);
+
+#if ENABLE(SAMPLING_FLAGS)
+static JSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState*, JSObject*, JSValue, const ArgList&);
+#endif
+
+struct Script {
+    bool isFile;
+    char *argument;
+    
+    Script(bool isFile, char *argument)
+        : isFile(isFile)
+        , argument(argument)
+    {
+    }
+};
 
 struct Options {
     Options()
@@ -85,7 +103,7 @@ struct Options {
 
     bool interactive;
     bool dump;
-    Vector<UString> fileNames;
+    Vector<Script> scripts;
     Vector<UString> arguments;
 };
 
@@ -159,14 +177,19 @@ ASSERT_CLASS_FITS_IN_CELL(GlobalObject);
 GlobalObject::GlobalObject(const Vector<UString>& arguments)
     : JSGlobalObject()
 {
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
+
+#if ENABLE(SAMPLING_FLAGS)
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "setSamplingFlags"), functionSetSamplingFlags));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "clearSamplingFlags"), functionClearSamplingFlags));
+#endif
 
     JSObject* array = constructEmptyArray(globalExec());
     for (size_t i = 0; i < arguments.size(); ++i)
@@ -174,13 +197,13 @@ GlobalObject::GlobalObject(const Vector<UString>& arguments)
     putDirect(Identifier(globalExec(), "arguments"), array);
 }
 
-JSValuePtr functionPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     for (unsigned i = 0; i < args.size(); ++i) {
         if (i != 0)
             putchar(' ');
         
-        printf("%s", args.at(exec, i)->toString(exec).UTF8String().c_str());
+        printf("%s", args.at(i).toString(exec).UTF8String().c_str());
     }
     
     putchar('\n');
@@ -188,30 +211,30 @@ JSValuePtr functionPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr functionDebug(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionDebug(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    fprintf(stderr, "--> %s\n", args.at(exec, 0)->toString(exec).UTF8String().c_str());
+    fprintf(stderr, "--> %s\n", args.at(0).toString(exec).UTF8String().c_str());
     return jsUndefined();
 }
 
-JSValuePtr functionGC(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionGC(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     JSLock lock(false);
     exec->heap()->collect();
     return jsUndefined();
 }
 
-JSValuePtr functionVersion(ExecState*, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionVersion(ExecState*, JSObject*, JSValue, const ArgList&)
 {
     // We need this function for compatibility with the Mozilla JS tests but for now
     // we don't actually do any version-specific handling
     return jsUndefined();
 }
 
-JSValuePtr functionRun(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionRun(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     StopWatch stopWatch;
-    UString fileName = args.at(exec, 0)->toString(exec);
+    UString fileName = args.at(0).toString(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return throwError(exec, GeneralError, "Could not open file.");
@@ -225,20 +248,45 @@ JSValuePtr functionRun(ExecState* exec, JSObject*, JSValuePtr, const ArgList& ar
     return jsNumber(globalObject->globalExec(), stopWatch.getElapsedMS());
 }
 
-JSValuePtr functionLoad(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionLoad(ExecState* exec, JSObject* o, JSValue v, const ArgList& args)
 {
-    UString fileName = args.at(exec, 0)->toString(exec);
+    UNUSED_PARAM(o);
+    UNUSED_PARAM(v);
+    UString fileName = args.at(0).toString(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return throwError(exec, GeneralError, "Could not open file.");
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-    evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script.data(), fileName));
+    Completion result = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script.data(), fileName));
+    if (result.complType() == Throw)
+        exec->setException(result.value());
+    return result.value();
+}
 
-    return jsUndefined();
+#if ENABLE(SAMPLING_FLAGS)
+JSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    for (unsigned i = 0; i < args.size(); ++i) {
+        unsigned flag = static_cast<unsigned>(args.at(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::setFlag(flag);
+    }
+    return jsNull();
+}
+
+JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    for (unsigned i = 0; i < args.size(); ++i) {
+        unsigned flag = static_cast<unsigned>(args.at(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::clearFlag(flag);
+    }
+    return jsNull();
 }
+#endif
 
-JSValuePtr functionReadline(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionReadline(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     Vector<char, 256> line;
     int c;
@@ -252,14 +300,10 @@ JSValuePtr functionReadline(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsString(exec, line.data());
 }
 
-JSValuePtr functionQuit(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionQuit(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     cleanupGlobalData(&exec->globalData());
     exit(EXIT_SUCCESS);
-#if !COMPILER(MSVC) && !PLATFORM(WIN_CE)
-    // MSVC knows that exit(0) never returns, so it flags this return statement as unreachable.
-    return jsUndefined();
-#endif
 }
 
 // Use SEH for Release builds only to get rid of the crash report dialog
@@ -288,10 +332,17 @@ int main(int argc, char** argv)
     _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
 #endif
 
+#if COMPILER(MSVC) && !PLATFORM(WIN_CE)
+    timeBeginPeriod(1);
+#endif
+
 #if PLATFORM(QT)
     QCoreApplication app(argc, argv);
 #endif
 
+    // Initialize JSC before getting JSGlobalData.
+    JSC::initializeThreading();
+
     // We can't use destructors in the following code because it uses Windows
     // Structured Exception Handling
     int res = 0;
@@ -311,9 +362,11 @@ static void cleanupGlobalData(JSGlobalData* globalData)
     globalData->deref();
 }
 
-static bool runWithScripts(GlobalObject* globalObject, const Vector<UString>& fileNames, bool dump)
+static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scripts, bool dump)
 {
-    Vector<char> script;
+    UString script;
+    UString fileName;
+    Vector<char> scriptBuffer;
 
     if (dump)
         BytecodeGenerator::setDumpsGeneratedCode(true);
@@ -321,42 +374,62 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<UString>& fi
 #if ENABLE(OPCODE_SAMPLING)
     Interpreter* interpreter = globalObject->globalData()->interpreter;
     interpreter->setSampler(new SamplingTool(interpreter));
+    interpreter->sampler()->setup();
+#endif
+#if ENABLE(SAMPLING_FLAGS)
+    SamplingFlags::start();
 #endif
 
     bool success = true;
-    for (size_t i = 0; i < fileNames.size(); i++) {
-        UString fileName = fileNames[i];
-
-        if (!fillBufferWithContentsOfFile(fileName, script))
-            return false; // fail early so we can catch missing files
+    for (size_t i = 0; i < scripts.size(); i++) {
+        if (scripts[i].isFile) {
+            fileName = scripts[i].argument;
+            if (!fillBufferWithContentsOfFile(fileName, scriptBuffer))
+                return false; // fail early so we can catch missing files
+            script = scriptBuffer.data();
+        } else {
+            script = scripts[i].argument;
+            fileName = "[Command Line]";
+        }
 
-#if ENABLE(OPCODE_SAMPLING)
-        interpreter->sampler()->start();
+#if ENABLE(SAMPLING_THREAD)
+        SamplingThread::start();
 #endif
-        Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script.data(), fileName));
+
+        Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script, fileName));
         success = success && completion.complType() != Throw;
         if (dump) {
             if (completion.complType() == Throw)
-                printf("Exception: %s\n", completion.value()->toString(globalObject->globalExec()).ascii());
+                printf("Exception: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
             else
-                printf("End: %s\n", completion.value()->toString(globalObject->globalExec()).ascii());
+                printf("End: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
         }
 
-        globalObject->globalExec()->clearException();
-
-#if ENABLE(OPCODE_SAMPLING)
-        interpreter->sampler()->stop();
+#if ENABLE(SAMPLING_THREAD)
+        SamplingThread::stop();
 #endif
+
+        globalObject->globalExec()->clearException();
     }
 
+#if ENABLE(SAMPLING_FLAGS)
+    SamplingFlags::stop();
+#endif
 #if ENABLE(OPCODE_SAMPLING)
     interpreter->sampler()->dump(globalObject->globalExec());
     delete interpreter->sampler();
 #endif
+#if ENABLE(SAMPLING_COUNTERS)
+    AbstractSamplingCounter::dump();
+#endif
     return success;
 }
 
-static void runInteractive(GlobalObject* globalObject)
+static
+#if !HAVE(READLINE)
+NO_RETURN
+#endif
+void runInteractive(GlobalObject* globalObject)
 {
     while (true) {
 #if HAVE(READLINE)
@@ -381,39 +454,48 @@ static void runInteractive(GlobalObject* globalObject)
         Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(line.data(), interpreterName));
 #endif
         if (completion.complType() == Throw)
-            printf("Exception: %s\n", completion.value()->toString(globalObject->globalExec()).ascii());
+            printf("Exception: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
         else
-            printf("%s\n", completion.value()->toString(globalObject->globalExec()).UTF8String().c_str());
+            printf("%s\n", completion.value().toString(globalObject->globalExec()).UTF8String().c_str());
 
         globalObject->globalExec()->clearException();
     }
     printf("\n");
 }
 
-static void printUsageStatement()
+static NO_RETURN void printUsageStatement(JSGlobalData* globalData, bool help = false)
 {
     fprintf(stderr, "Usage: jsc [options] [files] [-- arguments]\n");
     fprintf(stderr, "  -d         Dumps bytecode (debug builds only)\n");
+    fprintf(stderr, "  -e         Evaluate argument as script code\n");
     fprintf(stderr, "  -f         Specifies a source file (deprecated)\n");
     fprintf(stderr, "  -h|--help  Prints this help message\n");
     fprintf(stderr, "  -i         Enables interactive mode (default if no files are specified)\n");
     fprintf(stderr, "  -s         Installs signal handlers that exit on a crash (Unix platforms only)\n");
-    exit(EXIT_FAILURE);
+
+    cleanupGlobalData(globalData);
+    exit(help ? EXIT_SUCCESS : EXIT_FAILURE);
 }
 
-static void parseArguments(int argc, char** argv, Options& options)
+static void parseArguments(int argc, char** argv, Options& options, JSGlobalData* globalData)
 {
     int i = 1;
     for (; i < argc; ++i) {
         const char* arg = argv[i];
         if (strcmp(arg, "-f") == 0) {
             if (++i == argc)
-                printUsageStatement();
-            options.fileNames.append(argv[i]);
+                printUsageStatement(globalData);
+            options.scripts.append(Script(true, argv[i]));
+            continue;
+        }
+        if (strcmp(arg, "-e") == 0) {
+            if (++i == argc)
+                printUsageStatement(globalData);
+            options.scripts.append(Script(false, argv[i]));
             continue;
         }
         if (strcmp(arg, "-h") == 0 || strcmp(arg, "--help") == 0) {
-            printUsageStatement();
+            printUsageStatement(globalData, true);
         }
         if (strcmp(arg, "-i") == 0) {
             options.interactive = true;
@@ -436,10 +518,10 @@ static void parseArguments(int argc, char** argv, Options& options)
             ++i;
             break;
         }
-        options.fileNames.append(argv[i]);
+        options.scripts.append(Script(true, argv[i]));
     }
     
-    if (options.fileNames.isEmpty())
+    if (options.scripts.isEmpty())
         options.interactive = true;
     
     for (; i < argc; ++i)
@@ -448,15 +530,13 @@ static void parseArguments(int argc, char** argv, Options& options)
 
 int jscmain(int argc, char** argv, JSGlobalData* globalData)
 {
-    JSC::initializeThreading();
-
     JSLock lock(false);
 
     Options options;
-    parseArguments(argc, argv, options);
+    parseArguments(argc, argv, options, globalData);
 
     GlobalObject* globalObject = new (globalData) GlobalObject(options.arguments);
-    bool success = runWithScripts(globalObject, options.fileNames, options.dump);
+    bool success = runWithScripts(globalObject, options.scripts, options.dump);
     if (options.interactive && success)
         runInteractive(globalObject);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index ae787f68e8..52dddde0e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -29,7 +29,7 @@
 #include <stdlib.h>
 #include "JSValue.h"
 #include "JSObject.h"
-#include "Nodes.h"
+#include "NodeConstructors.h"
 #include "Lexer.h"
 #include "JSString.h"
 #include "JSGlobalData.h"
@@ -99,24 +99,24 @@ static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, Assig
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserRefCountedData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserRefCountedData<DeclarationStacks::FunctionStack>* funcDecls,
+template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
+                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
                                                                        CodeFeatures info,
                                                                        int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = {node, varDecls, funcDecls, info, numConstants};
+    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
 template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = {node, info, numConstants};
+    NodeInfo<T> result = { node, info, numConstants };
     return result;
 }
 
-template <typename T> T mergeDeclarationLists(T decls1, T decls2) 
+template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
 {
     // decls1 or both are null
     if (!decls1)
@@ -128,28 +128,28 @@ template <typename T> T mergeDeclarationLists(T decls1, T decls2)
     // Both are non-null
     decls1->data.append(decls2->data);
     
-    // We manually release the declaration lists to avoid accumulating many many
-    // unused heap allocated vectors
-    decls2->ref();
-    decls2->deref();
+    // Manually release as much as possible from the now-defunct declaration lists
+    // to avoid accumulating so many unused heap allocated vectors.
+    decls2->data.clear();
+
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
 
     varDecls->data.append(make_pair(ident, attrs));
 
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->m_init)
+    if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->m_ident, attrs);
+    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
 }
 
 %}
@@ -218,7 +218,7 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 %token ANDEQUAL MODEQUAL           /* &= and %= */
 %token XOREQUAL OREQUAL            /* ^= and |= */
 %token <intValue> OPENBRACE        /* { (with char offset) */
-%token <intValue> CLOSEBRACE        /* { (with char offset) */
+%token <intValue> CLOSEBRACE       /* } (with char offset) */
 
 /* terminal types */
 %token <doubleValue> NUMBER
@@ -264,7 +264,7 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 %type <expressionNode>  Initializer InitializerNoIn
 %type <statementNode>   FunctionDeclaration
 %type <funcExprNode>    FunctionExpr
-%type <functionBodyNode>  FunctionBody
+%type <functionBodyNode> FunctionBody
 %type <sourceElements>  SourceElements
 %type <parameterList>   FormalParameterList
 %type <op>              AssignmentOperator
@@ -287,16 +287,16 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 // In the mean time, make sure to make any changes to the grammar in both versions.
 
 Literal:
-    NULLTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new NullNode(GLOBAL_DATA), 0, 1); }
-  | TRUETOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, true), 0, 1); }
-  | FALSETOKEN                          { $$ = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, false), 0, 1); }
+    NULLTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); }
+  | TRUETOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); }
+  | FALSETOKEN                          { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); }
   | NUMBER                              { $$ = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, $1), 0, 1); }
-  | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new StringNode(GLOBAL_DATA, *$1), 0, 1); }
+  | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *$1), 0, 1); }
   | '/' /* regexp */                    {
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -305,7 +305,7 @@ Literal:
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -313,9 +313,9 @@ Literal:
 ;
 
 Property:
-    IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+    IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
   | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *$1, *$2, 0, $6, LEXER->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); DBG($6, @5, @7); if (!$$.m_node) YYABORT; }
   | IDENT IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
                                                              {
@@ -329,46 +329,46 @@ Property:
 ;
 
 PropertyList:
-    Property                            { $$.m_node.head = new PropertyListNode(GLOBAL_DATA, $1.m_node); 
+    Property                            { $$.m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $1.m_node); 
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | PropertyList ',' Property           { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new PropertyListNode(GLOBAL_DATA, $3.m_node, $1.m_node.tail);
+                                          $$.m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $3.m_node, $1.m_node.tail);
                                           $$.m_features = $1.m_features | $3.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
 ;
 
 PrimaryExpr:
     PrimaryExprNoBrace
-  | OPENBRACE CLOSEBRACE                             { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA), 0, 0); }
-  | OPENBRACE PropertyList CLOSEBRACE                { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | OPENBRACE CLOSEBRACE                             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); }
+  | OPENBRACE PropertyList CLOSEBRACE                { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
   /* allow extra comma, see http://bugs.webkit.org/show_bug.cgi?id=5939 */
-  | OPENBRACE PropertyList ',' CLOSEBRACE            { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | OPENBRACE PropertyList ',' CLOSEBRACE            { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
 ;
 
 PrimaryExprNoBrace:
-    THISTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new ThisNode(GLOBAL_DATA), ThisFeature, 0); }
+    THISTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); }
   | Literal
   | ArrayLiteral
-  | IDENT                               { $$ = createNodeInfo<ExpressionNode*>(new ResolveNode(GLOBAL_DATA, *$1, @1.first_column), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
+  | IDENT                               { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *$1, @1.first_column), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
   | '(' Expr ')'                        { $$ = $2; }
 ;
 
 ArrayLiteral:
-    '[' ElisionOpt ']'                  { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $2), 0, $2 ? 1 : 0); }
-  | '[' ElementList ']'                 { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
-  | '[' ElementList ',' ElisionOpt ']'  { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $4, $2.m_node.head), $2.m_features, $4 ? $2.m_numConstants + 1 : $2.m_numConstants); }
+    '[' ElisionOpt ']'                  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2), 0, $2 ? 1 : 0); }
+  | '[' ElementList ']'                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | '[' ElementList ',' ElisionOpt ']'  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $4, $2.m_node.head), $2.m_features, $4 ? $2.m_numConstants + 1 : $2.m_numConstants); }
 ;
 
 ElementList:
-    ElisionOpt AssignmentExpr           { $$.m_node.head = new ElementNode(GLOBAL_DATA, $1, $2.m_node);
+    ElisionOpt AssignmentExpr           { $$.m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1, $2.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $2.m_features;
                                           $$.m_numConstants = $2.m_numConstants; }
   | ElementList ',' ElisionOpt AssignmentExpr
                                         { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ElementNode(GLOBAL_DATA, $1.m_node.tail, $3, $4.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1.m_node.tail, $3, $4.m_node);
                                           $$.m_features = $1.m_features | $4.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $4.m_numConstants; }
 ;
@@ -386,15 +386,15 @@ Elision:
 MemberExpr:
     PrimaryExpr
   | FunctionExpr                        { $$ = createNodeInfo<ExpressionNode*>($1.m_node, $1.m_features, $1.m_numConstants); }
-  | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | MemberExpr '.' IDENT                { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | MemberExpr '.' IDENT                { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
+  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
@@ -402,15 +402,15 @@ MemberExpr:
 
 MemberExprNoBF:
     PrimaryExprNoBrace
-  | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
+  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
@@ -418,7 +418,7 @@ MemberExprNoBF:
 
 NewExpr:
     MemberExpr
-  | NEW NewExpr                         { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node);
+  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants); 
                                         }
@@ -426,7 +426,7 @@ NewExpr:
 
 NewExprNoBF:
     MemberExprNoBF
-  | NEW NewExpr                         { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node);
+  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants);
                                         }
@@ -435,11 +435,11 @@ NewExprNoBF:
 CallExpr:
     MemberExpr Arguments                { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExpr Arguments                  { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | CallExpr '.' IDENT                  { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | CallExpr '.' IDENT                  { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); }
 ;
@@ -447,28 +447,28 @@ CallExpr:
 CallExprNoBF:
     MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); 
                                         }
 ;
 
 Arguments:
-    '(' ')'                             { $$ = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA), 0, 0); }
-  | '(' ArgumentList ')'                { $$ = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+    '(' ')'                             { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); }
+  | '(' ArgumentList ')'                { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
 ;
 
 ArgumentList:
-    AssignmentExpr                      { $$.m_node.head = new ArgumentListNode(GLOBAL_DATA, $1.m_node);
+    AssignmentExpr                      { $$.m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | ArgumentList ',' AssignmentExpr     { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ArgumentListNode(GLOBAL_DATA, $1.m_node.tail, $3.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node.tail, $3.m_node);
                                           $$.m_features = $1.m_features | $3.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
 ;
@@ -497,16 +497,16 @@ PostfixExprNoBF:
 
 UnaryExprCommon:
     DELETETOKEN UnaryExpr               { $$ = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, $2.m_node, @1.first_column, @2.last_column, @2.last_column), $2.m_features, $2.m_numConstants); }
-  | VOIDTOKEN UnaryExpr                 { $$ = createNodeInfo<ExpressionNode*>(new VoidNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants + 1); }
+  | VOIDTOKEN UnaryExpr                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants + 1); }
   | TYPEOF UnaryExpr                    { $$ = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | PLUSPLUS UnaryExpr                  { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | AUTOPLUSPLUS UnaryExpr              { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | MINUSMINUS UnaryExpr                { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | AUTOMINUSMINUS UnaryExpr            { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
-  | '+' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new UnaryPlusNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
+  | '+' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | '-' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | '~' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-  | '!' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new LogicalNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
+  | '!' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
 
 UnaryExpr:
     PostfixExpr
@@ -522,7 +522,7 @@ MultiplicativeExpr:
     UnaryExpr
   | MultiplicativeExpr '*' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | MultiplicativeExpr '/' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | MultiplicativeExpr '%' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | MultiplicativeExpr '%' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 MultiplicativeExprNoBF:
@@ -532,7 +532,7 @@ MultiplicativeExprNoBF:
   | MultiplicativeExprNoBF '/' UnaryExpr
                                         { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | MultiplicativeExprNoBF '%' UnaryExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 AdditiveExpr:
@@ -553,188 +553,188 @@ ShiftExpr:
     AdditiveExpr
   | ShiftExpr LSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | ShiftExpr RSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExpr URSHIFT AdditiveExpr      { $$ = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ShiftExpr URSHIFT AdditiveExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ShiftExprNoBF:
     AdditiveExprNoBF
   | ShiftExprNoBF LSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | ShiftExprNoBF RSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExprNoBF URSHIFT AdditiveExpr  { $$ = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ShiftExprNoBF URSHIFT AdditiveExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExpr:
     ShiftExpr
-  | RelationalExpr '<' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr '>' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | RelationalExpr '<' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr '>' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExprNoIn:
     ShiftExpr
-  | RelationalExprNoIn '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoIn INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExprNoBF:
     ShiftExprNoBF
-  | RelationalExprNoBF '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INTOKEN ShiftExpr 
-                                        { InNode* node = new InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExpr:
     RelationalExpr
-  | EqualityExpr EQEQ RelationalExpr    { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr NE RelationalExpr      { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STREQ RelationalExpr   { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STRNEQ RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr EQEQ RelationalExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr NE RelationalExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr STREQ RelationalExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr STRNEQ RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExprNoIn:
     RelationalExprNoIn
   | EqualityExprNoIn EQEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn NE RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn STREQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn STRNEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExprNoBF:
     RelationalExprNoBF
   | EqualityExprNoBF EQEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoBF NE RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExprNoBF NE RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoBF STREQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoBF STRNEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExpr:
     EqualityExpr
-  | BitwiseANDExpr '&' EqualityExpr     { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseANDExpr '&' EqualityExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExprNoIn:
     EqualityExprNoIn
   | BitwiseANDExprNoIn '&' EqualityExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExprNoBF:
     EqualityExprNoBF
-  | BitwiseANDExprNoBF '&' EqualityExpr { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseANDExprNoBF '&' EqualityExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExpr:
     BitwiseANDExpr
-  | BitwiseXORExpr '^' BitwiseANDExpr   { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseXORExpr '^' BitwiseANDExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExprNoIn:
     BitwiseANDExprNoIn
   | BitwiseXORExprNoIn '^' BitwiseANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExprNoBF:
     BitwiseANDExprNoBF
   | BitwiseXORExprNoBF '^' BitwiseANDExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExpr:
     BitwiseXORExpr
-  | BitwiseORExpr '|' BitwiseXORExpr    { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseORExpr '|' BitwiseXORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExprNoIn:
     BitwiseXORExprNoIn
   | BitwiseORExprNoIn '|' BitwiseXORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExprNoBF:
     BitwiseXORExprNoBF
   | BitwiseORExprNoBF '|' BitwiseXORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExpr:
     BitwiseORExpr
-  | LogicalANDExpr AND BitwiseORExpr    { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalANDExpr AND BitwiseORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExprNoIn:
     BitwiseORExprNoIn
   | LogicalANDExprNoIn AND BitwiseORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExprNoBF:
     BitwiseORExprNoBF
   | LogicalANDExprNoBF AND BitwiseORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExpr:
     LogicalANDExpr
-  | LogicalORExpr OR LogicalANDExpr     { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalORExpr OR LogicalANDExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExprNoIn:
     LogicalANDExprNoIn
   | LogicalORExprNoIn OR LogicalANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExprNoBF:
     LogicalANDExprNoBF
-  | LogicalORExprNoBF OR LogicalANDExpr { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalORExprNoBF OR LogicalANDExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ConditionalExpr:
     LogicalORExpr
   | LogicalORExpr '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 ConditionalExprNoIn:
     LogicalORExprNoIn
   | LogicalORExprNoIn '?' AssignmentExprNoIn ':' AssignmentExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 ConditionalExprNoBF:
     LogicalORExprNoBF
   | LogicalORExprNoBF '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 AssignmentExpr:
@@ -778,17 +778,17 @@ AssignmentOperator:
 
 Expr:
     AssignmentExpr
-  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoIn:
     AssignmentExprNoIn
-  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoBF:
     AssignmentExprNoBF
-  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 Statement:
@@ -812,9 +812,9 @@ Statement:
 ;
 
 Block:
-    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @3); }
 ;
 
@@ -828,16 +828,16 @@ VariableStatement:
 
 VariableDeclarationList:
     IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_numConstants = 0;
                                         }
-  | IDENT Initializer                   { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
+  | IDENT Initializer                   { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
@@ -852,7 +852,7 @@ VariableDeclarationList:
                                           $$.m_numConstants = $1.m_numConstants;
                                         }
   | VariableDeclarationList ',' IDENT Initializer
-                                        { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
+                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
@@ -865,16 +865,16 @@ VariableDeclarationList:
 
 VariableDeclarationListNoIn:
     IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_numConstants = 0;
                                         }
-  | IDENT InitializerNoIn               { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
+  | IDENT InitializerNoIn               { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
@@ -889,7 +889,7 @@ VariableDeclarationListNoIn:
                                           $$.m_numConstants = $1.m_numConstants;
                                         }
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
-                                        { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
+                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
@@ -901,24 +901,24 @@ VariableDeclarationListNoIn:
 ;
 
 ConstStatement:
-    CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+    CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @3); }
   | CONSTTOKEN ConstDeclarationList error
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ConstDeclarationList:
     ConstDeclaration                    { $$.m_node.head = $1.m_node;
                                           $$.m_node.tail = $$.m_node.head;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, $1.m_node);
                                           $$.m_funcDeclarations = 0; 
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants;
     }
   | ConstDeclarationList ',' ConstDeclaration
-                                        {  $$.m_node.head = $1.m_node.head;
+                                        { $$.m_node.head = $1.m_node.head;
                                           $1.m_node.tail->m_next = $3.m_node;
                                           $$.m_node.tail = $3.m_node;
                                           $$.m_varDeclarations = $1.m_varDeclarations;
@@ -929,8 +929,8 @@ ConstDeclarationList:
 ;
 
 ConstDeclaration:
-    IDENT                               { $$ = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *$1, 0), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
-  | IDENT Initializer                   { $$ = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *$1, $2.m_node), ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features, $2.m_numConstants); }
+    IDENT                               { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, 0), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
+  | IDENT Initializer                   { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, $2.m_node), ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features, $2.m_numConstants); }
 ;
 
 Initializer:
@@ -942,43 +942,44 @@ InitializerNoIn:
 ;
 
 EmptyStatement:
-    ';'                                 { $$ = createNodeDeclarationInfo<StatementNode*>(new EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); }
+    ';'                                 { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); }
 ;
 
 ExprStatement:
-    ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
+    ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
-  | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
+  | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 IfStatement:
     IF '(' Expr ')' Statement %prec IF_WITHOUT_ELSE
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
   | IF '(' Expr ')' Statement ELSE Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
-                                                                                         mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations), mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
+                                                                                         mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations),
+                                                                                         mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $3.m_features | $5.m_features | $7.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants); 
                                           DBG($$.m_node, @1, @4); }
 ;
 
 IterationStatement:
-    DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
+    DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
                                              DBG($$.m_node, @1, @3); }
-  | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
+  | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
                                              DBG($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
-  | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
+  | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
   | FOR '(' ExprNoInOpt ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
                                                                                          $3.m_features | $5.m_features | $7.m_features | $9.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
                                           DBG($$.m_node, @1, @8); 
                                         }
   | FOR '(' VAR VariableDeclarationListNoIn ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
                                                                                          mergeDeclarationLists($4.m_varDeclarations, $10.m_varDeclarations),
                                                                                          mergeDeclarationLists($4.m_funcDeclarations, $10.m_funcDeclarations),
                                                                                          $4.m_features | $6.m_features | $8.m_features | $10.m_features,
@@ -986,7 +987,7 @@ IterationStatement:
                                           DBG($$.m_node, @1, @9); }
   | FOR '(' LeftHandSideExpr INTOKEN Expr ')' Statement
                                         {
-                                            ForInNode* node = new ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
+                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
                                             SET_EXCEPTION_LOCATION(node, @3.first_column, @3.last_column, @5.last_column);
                                             $$ = createNodeDeclarationInfo<StatementNode*>(node, $7.m_varDeclarations, $7.m_funcDeclarations,
                                                                                            $3.m_features | $5.m_features | $7.m_features,
@@ -994,13 +995,13 @@ IterationStatement:
                                             DBG($$.m_node, @1, @6);
                                         }
   | FOR '(' VAR IDENT INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
+                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
                                           SET_EXCEPTION_LOCATION(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $8.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $8.m_varDeclarations, $8.m_funcDeclarations, ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $6.m_features | $8.m_features, $6.m_numConstants + $8.m_numConstants);
                                           DBG($$.m_node, @1, @7); }
   | FOR '(' VAR IDENT InitializerNoIn INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
+                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
                                           SET_EXCEPTION_LOCATION(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $9.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $9.m_varDeclarations, $9.m_funcDeclarations,
@@ -1020,70 +1021,70 @@ ExprNoInOpt:
 ;
 
 ContinueStatement:
-    CONTINUE ';'                        { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+    CONTINUE ';'                        { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | CONTINUE error                      { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+  | CONTINUE error                      { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | CONTINUE IDENT ';'                  { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *$2);
+  | CONTINUE IDENT ';'                  { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @3); }
-  | CONTINUE IDENT error                { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *$2);
+  | CONTINUE IDENT error                { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 BreakStatement:
-    BREAK ';'                           { BreakNode* node = new BreakNode(GLOBAL_DATA);
+    BREAK ';'                           { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
-  | BREAK error                         { BreakNode* node = new BreakNode(GLOBAL_DATA);
+  | BREAK error                         { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | BREAK IDENT ';'                     { BreakNode* node = new BreakNode(GLOBAL_DATA, *$2);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+  | BREAK IDENT ';'                     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @3); }
-  | BREAK IDENT error                   { BreakNode* node = new BreakNode(GLOBAL_DATA, *$2);
+  | BREAK IDENT error                   { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ReturnStatement:
-    RETURN ';'                          { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+    RETURN ';'                          { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
-  | RETURN error                        { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+  | RETURN error                        { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | RETURN Expr ';'                     { ReturnNode* node = new ReturnNode(GLOBAL_DATA, $2.m_node); 
+  | RETURN Expr ';'                     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @3); }
-  | RETURN Expr error                   { ReturnNode* node = new ReturnNode(GLOBAL_DATA, $2.m_node); 
+  | RETURN Expr error                   { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 WithStatement:
-    WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
+    WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
                                                                                          $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features | WithFeature, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
 ;
 
 SwitchStatement:
-    SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
+    SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
                                                                                          $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
 ;
 
 CaseBlock:
-    OPENBRACE CaseClausesOpt CLOSEBRACE              { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, $2.m_node.head, 0, 0), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants); }
+    OPENBRACE CaseClausesOpt CLOSEBRACE              { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, 0, 0), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants); }
   | OPENBRACE CaseClausesOpt DefaultClause CaseClausesOpt CLOSEBRACE
-                                        { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, $2.m_node.head, $3.m_node, $4.m_node.head),
+                                        { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, $3.m_node, $4.m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $3.m_varDeclarations), $4.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $3.m_funcDeclarations), $4.m_funcDeclarations),
                                                                                          $2.m_features | $3.m_features | $4.m_features,
@@ -1096,14 +1097,14 @@ CaseClausesOpt:
 ;
 
 CaseClauses:
-    CaseClause                          { $$.m_node.head = new ClauseListNode(GLOBAL_DATA, $1.m_node);
+    CaseClause                          { $$.m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           $$.m_funcDeclarations = $1.m_funcDeclarations; 
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | CaseClauses CaseClause              { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ClauseListNode(GLOBAL_DATA, $1.m_node.tail, $2.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node.tail, $2.m_node);
                                           $$.m_varDeclarations = mergeDeclarationLists($1.m_varDeclarations, $2.m_varDeclarations);
                                           $$.m_funcDeclarations = mergeDeclarationLists($1.m_funcDeclarations, $2.m_funcDeclarations);
                                           $$.m_features = $1.m_features | $2.m_features;
@@ -1112,47 +1113,47 @@ CaseClauses:
 ;
 
 CaseClause:
-    CASE Expr ':'                       { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, $2.m_node), 0, 0, $2.m_features, $2.m_numConstants); }
-  | CASE Expr ':' SourceElements        { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, $2.m_node, $4.m_node), $4.m_varDeclarations, $4.m_funcDeclarations, $2.m_features | $4.m_features, $2.m_numConstants + $4.m_numConstants); }
+    CASE Expr ':'                       { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node), 0, 0, $2.m_features, $2.m_numConstants); }
+  | CASE Expr ':' SourceElements        { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node, $4.m_node), $4.m_varDeclarations, $4.m_funcDeclarations, $2.m_features | $4.m_features, $2.m_numConstants + $4.m_numConstants); }
 ;
 
 DefaultClause:
-    DEFAULT ':'                         { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); }
-  | DEFAULT ':' SourceElements          { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0, $3.m_node), $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
+    DEFAULT ':'                         { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); }
+  | DEFAULT ':' SourceElements          { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, $3.m_node), $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 LabelledStatement:
-    IDENT ':' Statement                 { LabelNode* node = new LabelNode(GLOBAL_DATA, *$1, $3.m_node);
+    IDENT ':' Statement                 { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *$1, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 ThrowStatement:
-    THROW Expr ';'                      { ThrowNode* node = new ThrowNode(GLOBAL_DATA, $2.m_node);
+    THROW Expr ';'                      { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2);
                                         }
-  | THROW Expr error                    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, $2.m_node);
+  | THROW Expr error                    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; 
                                         }
 ;
 
 TryStatement:
-    TRY Block FINALLY Block             { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, $4.m_node),
+    TRY Block FINALLY Block             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, $4.m_node),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $4.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $4.m_funcDeclarations),
                                                                                          $2.m_features | $4.m_features,
                                                                                          $2.m_numConstants + $4.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
-  | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
+  | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | CatchFeature,
                                                                                          $2.m_numConstants + $7.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
   | TRY Block CATCH '(' IDENT ')' Block FINALLY Block
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations), $9.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations), $9.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | $9.m_features | CatchFeature,
@@ -1161,17 +1162,17 @@ TryStatement:
 ;
 
 DebuggerStatement:
-    DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+    DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+  | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 FunctionDeclaration:
-    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
+    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
   | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
       { 
-          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
+          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
           if ($4.m_features & ArgumentsFeature)
               $7->setUsesArguments(); 
           DBG($7, @6, @8);
@@ -1199,12 +1200,12 @@ FunctionExpr:
 ;
 
 FormalParameterList:
-    IDENT                               { $$.m_node.head = new ParameterNode(GLOBAL_DATA, *$1);
+    IDENT                               { $$.m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *$1);
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_node.tail = $$.m_node.head; }
   | FormalParameterList ',' IDENT       { $$.m_node.head = $1.m_node.head;
                                           $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          $$.m_node.tail = new ParameterNode(GLOBAL_DATA, $1.m_node.tail, *$3);  }
+                                          $$.m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, $1.m_node.tail, *$3);  }
 ;
 
 FunctionBody:
@@ -1213,13 +1214,13 @@ FunctionBody:
 ;
 
 Program:
-    /* not in spec */                   { GLOBAL_DATA->parser->didFinishParsing(new SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, @0.last_line, 0); }
+    /* not in spec */                   { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, @0.last_line, 0); }
     | SourceElements                    { GLOBAL_DATA->parser->didFinishParsing($1.m_node, $1.m_varDeclarations, $1.m_funcDeclarations, $1.m_features, 
                                                                                 @1.last_line, $1.m_numConstants); }
 ;
 
 SourceElements:
-    Statement                           { $$.m_node = new SourceElements(GLOBAL_DATA);
+    Statement                           { $$.m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           $$.m_node->append($1.m_node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           $$.m_funcDeclarations = $1.m_funcDeclarations;
@@ -1828,23 +1829,23 @@ SourceElements_NoNode:
 static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
             SET_EXCEPTION_LOCATION(node, start, divot, end);
             return node;
         } else
-            return new ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -1852,9 +1853,9 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -1862,21 +1863,21 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
 static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
@@ -1884,22 +1885,22 @@ static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Ope
 static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -1909,23 +1910,29 @@ static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeIn
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
         if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node = new FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
+        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
+        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else
+        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
@@ -1934,26 +1941,26 @@ static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
     }
-    return new TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new DeleteValueNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
 static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
@@ -1965,7 +1972,7 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
 }
 
 static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
@@ -1979,19 +1986,19 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new NegateNode(GLOBAL_DATA, n);
+    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
 }
 
 static NumberNode* makeNumberNode(void* globalPtr, double d)
 {
-    return new NumberNode(GLOBAL_DATA, d);
+    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
 }
 
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
         return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new BitwiseNotNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2003,12 +2010,12 @@ static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, Expr
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
 
-    return new MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2018,14 +2025,14 @@ static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2035,21 +2042,21 @@ static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 /* called by yyparse on error */
@@ -2068,7 +2075,7 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 {
     if (!list)
         return init;
-    return new VarDeclCommaNode(GLOBAL_DATA, list, init);
+    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
@@ -2077,8 +2084,8 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
 {
     if (!expr)
-        return new EmptyStatementNode(GLOBAL_DATA);
-    return new VarStatementNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
+    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
 }
 
 #undef GLOBAL_DATA
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index 0bacb22021..8e89c18a9e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -31,14 +31,12 @@
 #include <ctype.h>
 #include <limits.h>
 #include <string.h>
-#include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
-#include <wtf/unicode/Unicode.h>
 
 using namespace WTF;
 using namespace Unicode;
 
-// we can't specify the namespace in yacc's C output, so do it here
+// We can't specify the namespace in yacc's C output, so do it here instead.
 using namespace JSC;
 
 #ifndef KDE_USE_FINAL
@@ -48,7 +46,7 @@ using namespace JSC;
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
-// a bridge for yacc from the C world to C++
+// A bridge for yacc from the C world to the C++ world.
 int jscyylex(void* lvalp, void* llocp, void* globalData)
 {
     return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
@@ -56,825 +54,895 @@ int jscyylex(void* lvalp, void* llocp, void* globalData)
 
 namespace JSC {
 
-static bool isDecimalDigit(int);
+static const UChar byteOrderMark = 0xFEFF;
 
 Lexer::Lexer(JSGlobalData* globalData)
-    : yylineno(1)
-    , m_restrKeyword(false)
-    , m_eatNextIdentifier(false)
-    , m_stackToken(-1)
-    , m_lastToken(-1)
-    , m_position(0)
-    , m_code(0)
-    , m_length(0)
-    , m_isReparsing(false)
-    , m_atLineStart(true)
-    , m_current(0)
-    , m_next1(0)
-    , m_next2(0)
-    , m_next3(0)
-    , m_currentOffset(0)
-    , m_nextOffset1(0)
-    , m_nextOffset2(0)
-    , m_nextOffset3(0)
+    : m_isReparsing(false)
     , m_globalData(globalData)
-    , m_mainTable(JSC::mainTable)
+    , m_keywordTable(JSC::mainTable)
 {
-    m_buffer8.reserveCapacity(initialReadBufferCapacity);
-    m_buffer16.reserveCapacity(initialReadBufferCapacity);
+    m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
+    m_buffer16.reserveInitialCapacity(initialReadBufferCapacity);
 }
 
 Lexer::~Lexer()
 {
-    m_mainTable.deleteTable();
+    m_keywordTable.deleteTable();
+}
+
+inline const UChar* Lexer::currentCharacter() const
+{
+    return m_code - 4;
+}
+
+inline int Lexer::currentOffset() const
+{
+    return currentCharacter() - m_codeStart;
+}
+
+ALWAYS_INLINE void Lexer::shift1()
+{
+    m_current = m_next1;
+    m_next1 = m_next2;
+    m_next2 = m_next3;
+    if (LIKELY(m_code < m_codeEnd))
+        m_next3 = m_code[0];
+    else
+        m_next3 = -1;
+
+    ++m_code;
+}
+
+ALWAYS_INLINE void Lexer::shift2()
+{
+    m_current = m_next2;
+    m_next1 = m_next3;
+    if (LIKELY(m_code + 1 < m_codeEnd)) {
+        m_next2 = m_code[0];
+        m_next3 = m_code[1];
+    } else {
+        m_next2 = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 2;
+}
+
+ALWAYS_INLINE void Lexer::shift3()
+{
+    m_current = m_next3;
+    if (LIKELY(m_code + 2 < m_codeEnd)) {
+        m_next1 = m_code[0];
+        m_next2 = m_code[1];
+        m_next3 = m_code[2];
+    } else {
+        m_next1 = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next2 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 3;
+}
+
+ALWAYS_INLINE void Lexer::shift4()
+{
+    if (LIKELY(m_code + 3 < m_codeEnd)) {
+        m_current = m_code[0];
+        m_next1 = m_code[1];
+        m_next2 = m_code[2];
+        m_next3 = m_code[3];
+    } else {
+        m_current = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next1 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
+        m_next2 = m_code + 2 < m_codeEnd ? m_code[2] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 4;
 }
 
 void Lexer::setCode(const SourceCode& source)
 {
-    yylineno = source.firstLine();
-    m_restrKeyword = false;
+    m_lineNumber = source.firstLine();
     m_delimited = false;
-    m_eatNextIdentifier = false;
-    m_stackToken = -1;
     m_lastToken = -1;
 
-    m_position = source.startOffset();
+    const UChar* data = source.provider()->data();
+
     m_source = &source;
-    m_code = source.provider()->data();
-    m_length = source.endOffset();
-    m_skipLF = false;
-    m_skipCR = false;
+    m_codeStart = data;
+    m_code = data + source.startOffset();
+    m_codeEnd = data + source.endOffset();
     m_error = false;
     m_atLineStart = true;
 
-    // read first characters
-    shift(4);
+    // ECMA-262 calls for stripping all Cf characters, but we only strip BOM characters.
+    // See <https://bugs.webkit.org/show_bug.cgi?id=4931> for details.
+    if (source.provider()->hasBOMs()) {
+        for (const UChar* p = m_codeStart; p < m_codeEnd; ++p) {
+            if (UNLIKELY(*p == byteOrderMark)) {
+                copyCodeWithoutBOMs();
+                break;
+            }
+        }
+    }
+
+    // Read the first characters into the 4-character buffer.
+    shift4();
+    ASSERT(currentOffset() == source.startOffset());
 }
 
-void Lexer::shift(unsigned p)
+void Lexer::copyCodeWithoutBOMs()
 {
-    // ECMA-262 calls for stripping Cf characters here, but we only do this for BOM,
-    // see <https://bugs.webkit.org/show_bug.cgi?id=4931>.
-
-    while (p--) {
-        m_current = m_next1;
-        m_next1 = m_next2;
-        m_next2 = m_next3;
-        m_currentOffset = m_nextOffset1;
-        m_nextOffset1 = m_nextOffset2;
-        m_nextOffset2 = m_nextOffset3;
-        do {
-            if (m_position >= m_length) {
-                m_nextOffset3 = m_position;
-                m_position++;
-                m_next3 = -1;
-                break;
-            }
-            m_nextOffset3 = m_position;
-            m_next3 = m_code[m_position++];
-        } while (m_next3 == 0xFEFF);
+    // Note: In this case, the character offset data for debugging will be incorrect.
+    // If it's important to correctly debug code with extraneous BOMs, then the caller
+    // should strip the BOMs when creating the SourceProvider object and do its own
+    // mapping of offsets within the stripped text to original text offset.
+
+    m_codeWithoutBOMs.reserveCapacity(m_codeEnd - m_code);
+    for (const UChar* p = m_code; p < m_codeEnd; ++p) {
+        UChar c = *p;
+        if (c != byteOrderMark)
+            m_codeWithoutBOMs.append(c);
+    }
+    ptrdiff_t startDelta = m_codeStart - m_code;
+    m_code = m_codeWithoutBOMs.data();
+    m_codeStart = m_code + startDelta;
+    m_codeEnd = m_codeWithoutBOMs.data() + m_codeWithoutBOMs.size();
+}
+
+void Lexer::shiftLineTerminator()
+{
+    ASSERT(isLineTerminator(m_current));
+
+    // Allow both CRLF and LFCR.
+    if (m_current + m_next1 == '\n' + '\r')
+        shift2();
+    else
+        shift1();
+
+    ++m_lineNumber;
+}
+
+ALWAYS_INLINE Identifier* Lexer::makeIdentifier(const UChar* characters, size_t length)
+{
+    m_identifiers.append(Identifier(m_globalData, characters, length));
+    return &m_identifiers.last();
+}
+
+inline bool Lexer::lastTokenWasRestrKeyword() const
+{
+    return m_lastToken == CONTINUE || m_lastToken == BREAK || m_lastToken == RETURN || m_lastToken == THROW;
+}
+
+static NEVER_INLINE bool isNonASCIIIdentStart(int c)
+{
+    return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other);
+}
+
+static inline bool isIdentStart(int c)
+{
+    return isASCII(c) ? isASCIIAlpha(c) || c == '$' || c == '_' : isNonASCIIIdentStart(c);
+}
+
+static NEVER_INLINE bool isNonASCIIIdentPart(int c)
+{
+    return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
+        | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector);
+}
+
+static inline bool isIdentPart(int c)
+{
+    return isASCII(c) ? isASCIIAlphanumeric(c) || c == '$' || c == '_' : isNonASCIIIdentPart(c);
+}
+
+static inline int singleEscape(int c)
+{
+    switch (c) {
+        case 'b':
+            return 0x08;
+        case 't':
+            return 0x09;
+        case 'n':
+            return 0x0A;
+        case 'v':
+            return 0x0B;
+        case 'f':
+            return 0x0C;
+        case 'r':
+            return 0x0D;
+        default:
+            return c;
     }
 }
 
-// called on each new line
-void Lexer::nextLine()
+inline void Lexer::record8(int c)
 {
-    yylineno++;
-    m_atLineStart = true;
+    ASSERT(c >= 0);
+    ASSERT(c <= 0xFF);
+    m_buffer8.append(static_cast<char>(c));
 }
 
-void Lexer::setDone(State s)
+inline void Lexer::record16(UChar c)
 {
-    m_state = s;
-    m_done = true;
+    m_buffer16.append(c);
+}
+
+inline void Lexer::record16(int c)
+{
+    ASSERT(c >= 0);
+    ASSERT(c <= USHRT_MAX);
+    record16(UChar(static_cast<unsigned short>(c)));
 }
 
 int Lexer::lex(void* p1, void* p2)
 {
+    ASSERT(!m_error);
+    ASSERT(m_buffer8.isEmpty());
+    ASSERT(m_buffer16.isEmpty());
+
     YYSTYPE* lvalp = static_cast<YYSTYPE*>(p1);
     YYLTYPE* llocp = static_cast<YYLTYPE*>(p2);
     int token = 0;
-    m_state = Start;
-    unsigned short stringType = 0; // either single or double quotes
-    m_buffer8.clear();
-    m_buffer16.clear();
-    m_done = false;
     m_terminator = false;
-    m_skipLF = false;
-    m_skipCR = false;
-
-    // did we push a token on the stack previously ?
-    // (after an automatic semicolon insertion)
-    if (m_stackToken >= 0) {
-        setDone(Other);
-        token = m_stackToken;
-        m_stackToken = 0;
-    }
-    int startOffset = m_currentOffset;
-    while (!m_done) {
-        if (m_skipLF && m_current != '\n') // found \r but not \n afterwards
-            m_skipLF = false;
-        if (m_skipCR && m_current != '\r') // found \n but not \r afterwards
-            m_skipCR = false;
-        if (m_skipLF || m_skipCR) { // found \r\n or \n\r -> eat the second one
-            m_skipLF = false;
-            m_skipCR = false;
-            shift(1);
+
+start:
+    while (isWhiteSpace(m_current))
+        shift1();
+
+    int startOffset = currentOffset();
+
+    if (m_current == -1) {
+        if (!m_terminator && !m_delimited && !m_isReparsing) {
+            // automatic semicolon insertion if program incomplete
+            token = ';';
+            goto doneSemicolon;
         }
-        switch (m_state) {
-            case Start:
-                startOffset = m_currentOffset;
-                if (isWhiteSpace()) {
-                    // do nothing
-                } else if (m_current == '/' && m_next1 == '/') {
-                    shift(1);
-                    m_state = InSingleLineComment;
-                } else if (m_current == '/' && m_next1 == '*') {
-                    shift(1);
-                    m_state = InMultiLineComment;
-                } else if (m_current == -1) {
-                    if (!m_terminator && !m_delimited && !m_isReparsing) {
-                        // automatic semicolon insertion if program incomplete
-                        token = ';';
-                        m_stackToken = 0;
-                        setDone(Other);
-                    } else
-                        setDone(Eof);
-                } else if (isLineTerminator()) {
-                    nextLine();
-                    m_terminator = true;
-                    if (m_restrKeyword) {
-                        token = ';';
-                        setDone(Other);
-                    }
-                } else if (m_current == '"' || m_current == '\'') {
-                    m_state = InString;
-                    stringType = static_cast<unsigned short>(m_current);
-                } else if (isIdentStart(m_current)) {
-                    record16(m_current);
-                    m_state = InIdentifierOrKeyword;
-                } else if (m_current == '\\')
-                    m_state = InIdentifierStartUnicodeEscapeStart;
-                else if (m_current == '0') {
-                    record8(m_current);
-                    m_state = InNum0;
-                } else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InNum;
-                } else if (m_current == '.' && isDecimalDigit(m_next1)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                    // <!-- marks the beginning of a line comment (for www usage)
-                } else if (m_current == '<' && m_next1 == '!' && m_next2 == '-' && m_next3 == '-') {
-                    shift(3);
-                    m_state = InSingleLineComment;
-                    // same for -->
-                } else if (m_atLineStart && m_current == '-' && m_next1 == '-' &&  m_next2 == '>') {
-                    shift(2);
-                    m_state = InSingleLineComment;
-                } else {
-                    token = matchPunctuator(lvalp->intValue, m_current, m_next1, m_next2, m_next3);
-                    if (token != -1)
-                        setDone(Other);
-                    else
-                        setDone(Bad);
+        return 0;
+    }
+
+    m_delimited = false;
+    switch (m_current) {
+        case '>':
+            if (m_next1 == '>' && m_next2 == '>') {
+                if (m_next3 == '=') {
+                    shift4();
+                    token = URSHIFTEQUAL;
+                    break;
                 }
+                shift3();
+                token = URSHIFT;
                 break;
-            case InString:
-                if (m_current == stringType) {
-                    shift(1);
-                    setDone(String);
-                } else if (isLineTerminator() || m_current == -1)
-                    setDone(Bad);
-                else if (m_current == '\\')
-                    m_state = InEscapeSequence;
-                else
-                    record16(m_current);
+            }
+            if (m_next1 == '>') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = RSHIFTEQUAL;
+                    break;
+                }
+                shift2();
+                token = RSHIFT;
                 break;
-            // Escape Sequences inside of strings
-            case InEscapeSequence:
-                if (isOctalDigit(m_current)) {
-                    if (m_current >= '0' && m_current <= '3' &&
-                        isOctalDigit(m_next1) && isOctalDigit(m_next2)) {
-                        record16(convertOctal(m_current, m_next1, m_next2));
-                        shift(2);
-                        m_state = InString;
-                    } else if (isOctalDigit(m_current) && isOctalDigit(m_next1)) {
-                        record16(convertOctal('0', m_current, m_next1));
-                        shift(1);
-                        m_state = InString;
-                    } else if (isOctalDigit(m_current)) {
-                        record16(convertOctal('0', '0', m_current));
-                        m_state = InString;
-                    } else
-                        setDone(Bad);
-                } else if (m_current == 'x')
-                    m_state = InHexEscape;
-                else if (m_current == 'u')
-                    m_state = InUnicodeEscape;
-                else if (isLineTerminator()) {
-                    nextLine();
-                    m_state = InString;
-                } else {
-                    record16(singleEscape(static_cast<unsigned short>(m_current)));
-                    m_state = InString;
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = GE;
+                break;
+            }
+            shift1();
+            token = '>';
+            break;
+        case '=':
+            if (m_next1 == '=') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = STREQ;
+                    break;
                 }
+                shift2();
+                token = EQEQ;
                 break;
-            case InHexEscape:
-                if (isHexDigit(m_current) && isHexDigit(m_next1)) {
-                    m_state = InString;
-                    record16(convertHex(m_current, m_next1));
-                    shift(1);
-                } else if (m_current == stringType) {
-                    record16('x');
-                    shift(1);
-                    setDone(String);
-                } else {
-                    record16('x');
-                    record16(m_current);
-                    m_state = InString;
+            }
+            shift1();
+            token = '=';
+            break;
+        case '!':
+            if (m_next1 == '=') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = STRNEQ;
+                    break;
                 }
+                shift2();
+                token = NE;
                 break;
-            case InUnicodeEscape:
-                if (isHexDigit(m_current) && isHexDigit(m_next1) && isHexDigit(m_next2) && isHexDigit(m_next3)) {
-                    record16(convertUnicode(m_current, m_next1, m_next2, m_next3));
-                    shift(3);
-                    m_state = InString;
-                } else if (m_current == stringType) {
-                    record16('u');
-                    shift(1);
-                    setDone(String);
-                } else
-                    setDone(Bad);
+            }
+            shift1();
+            token = '!';
+            break;
+        case '<':
+            if (m_next1 == '!' && m_next2 == '-' && m_next3 == '-') {
+                // <!-- marks the beginning of a line comment (for www usage)
+                shift4();
+                goto inSingleLineComment;
+            }
+            if (m_next1 == '<') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = LSHIFTEQUAL;
+                    break;
+                }
+                shift2();
+                token = LSHIFT;
                 break;
-            case InSingleLineComment:
-                if (isLineTerminator()) {
-                    nextLine();
-                    m_terminator = true;
-                    if (m_restrKeyword) {
-                        token = ';';
-                        setDone(Other);
-                    } else
-                        m_state = Start;
-                } else if (m_current == -1)
-                    setDone(Eof);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = LE;
                 break;
-            case InMultiLineComment:
-                if (m_current == -1)
-                    setDone(Bad);
-                else if (isLineTerminator())
-                    nextLine();
-                else if (m_current == '*' && m_next1 == '/') {
-                    m_state = Start;
-                    shift(1);
+            }
+            shift1();
+            token = '<';
+            break;
+        case '+':
+            if (m_next1 == '+') {
+                shift2();
+                if (m_terminator) {
+                    token = AUTOPLUSPLUS;
+                    break;
                 }
+                token = PLUSPLUS;
                 break;
-            case InIdentifierOrKeyword:
-            case InIdentifier:
-                if (isIdentPart(m_current))
-                    record16(m_current);
-                else if (m_current == '\\')
-                    m_state = InIdentifierPartUnicodeEscapeStart;
-                else
-                    setDone(m_state == InIdentifierOrKeyword ? IdentifierOrKeyword : Identifier);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = PLUSEQUAL;
                 break;
-            case InNum0:
-                if (m_current == 'x' || m_current == 'X') {
-                    record8(m_current);
-                    m_state = InHex;
-                } else if (m_current == '.') {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else if (isOctalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InOctal;
-                } else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else
-                    setDone(Number);
+            }
+            shift1();
+            token = '+';
+            break;
+        case '-':
+            if (m_next1 == '-') {
+                if (m_atLineStart && m_next2 == '>') {
+                    shift3();
+                    goto inSingleLineComment;
+                }
+                shift2();
+                if (m_terminator) {
+                    token = AUTOMINUSMINUS;
+                    break;
+                }
+                token = MINUSMINUS;
                 break;
-            case InHex:
-                if (isHexDigit(m_current))
-                    record8(m_current);
-                else
-                    setDone(Hex);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = MINUSEQUAL;
                 break;
-            case InOctal:
-                if (isOctalDigit(m_current))
-                    record8(m_current);
-                else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else
-                    setDone(Octal);
+            }
+            shift1();
+            token = '-';
+            break;
+        case '*':
+            if (m_next1 == '=') {
+                shift2();
+                token = MULTEQUAL;
                 break;
-            case InNum:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else if (m_current == '.') {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else
-                    setDone(Number);
+            }
+            shift1();
+            token = '*';
+            break;
+        case '/':
+            if (m_next1 == '/') {
+                shift2();
+                goto inSingleLineComment;
+            }
+            if (m_next1 == '*')
+                goto inMultiLineComment;
+            if (m_next1 == '=') {
+                shift2();
+                token = DIVEQUAL;
                 break;
-            case InDecimal:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else
-                    setDone(Number);
+            }
+            shift1();
+            token = '/';
+            break;
+        case '&':
+            if (m_next1 == '&') {
+                shift2();
+                token = AND;
                 break;
-            case InExponentIndicator:
-                if (m_current == '+' || m_current == '-')
-                    record8(m_current);
-                else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InExponent;
-                } else
-                    setDone(Bad);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = ANDEQUAL;
                 break;
-            case InExponent:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else
-                    setDone(Number);
+            }
+            shift1();
+            token = '&';
+            break;
+        case '^':
+            if (m_next1 == '=') {
+                shift2();
+                token = XOREQUAL;
                 break;
-            case InIdentifierStartUnicodeEscapeStart:
-                if (m_current == 'u')
-                    m_state = InIdentifierStartUnicodeEscape;
-                else
-                    setDone(Bad);
+            }
+            shift1();
+            token = '^';
+            break;
+        case '%':
+            if (m_next1 == '=') {
+                shift2();
+                token = MODEQUAL;
                 break;
-            case InIdentifierPartUnicodeEscapeStart:
-                if (m_current == 'u')
-                    m_state = InIdentifierPartUnicodeEscape;
-                else
-                    setDone(Bad);
+            }
+            shift1();
+            token = '%';
+            break;
+        case '|':
+            if (m_next1 == '=') {
+                shift2();
+                token = OREQUAL;
                 break;
-            case InIdentifierStartUnicodeEscape:
-                if (!isHexDigit(m_current) || !isHexDigit(m_next1) || !isHexDigit(m_next2) || !isHexDigit(m_next3)) {
-                    setDone(Bad);
-                    break;
-                }
-                token = convertUnicode(m_current, m_next1, m_next2, m_next3);
-                shift(3);
-                if (!isIdentStart(token)) {
-                    setDone(Bad);
-                    break;
-                }
-                record16(token);
-                m_state = InIdentifier;
+            }
+            if (m_next1 == '|') {
+                shift2();
+                token = OR;
                 break;
-            case InIdentifierPartUnicodeEscape:
-                if (!isHexDigit(m_current) || !isHexDigit(m_next1) || !isHexDigit(m_next2) || !isHexDigit(m_next3)) {
-                    setDone(Bad);
-                    break;
-                }
-                token = convertUnicode(m_current, m_next1, m_next2, m_next3);
-                shift(3);
-                if (!isIdentPart(token)) {
-                    setDone(Bad);
-                    break;
+            }
+            shift1();
+            token = '|';
+            break;
+        case '.':
+            if (isASCIIDigit(m_next1)) {
+                record8('.');
+                shift1();
+                goto inNumberAfterDecimalPoint;
+            }
+            token = '.';
+            shift1();
+            break;
+        case ',':
+        case '~':
+        case '?':
+        case ':':
+        case '(':
+        case ')':
+        case '[':
+        case ']':
+            token = m_current;
+            shift1();
+            break;
+        case ';':
+            shift1();
+            m_delimited = true;
+            token = ';';
+            break;
+        case '{':
+            lvalp->intValue = currentOffset();
+            shift1();
+            token = OPENBRACE;
+            break;
+        case '}':
+            lvalp->intValue = currentOffset();
+            shift1();
+            m_delimited = true;
+            token = CLOSEBRACE;
+            break;
+        case '\\':
+            goto startIdentifierWithBackslash;
+        case '0':
+            goto startNumberWithZeroDigit;
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            goto startNumber;
+        case '"':
+        case '\'':
+            goto startString;
+        default:
+            if (isIdentStart(m_current))
+                goto startIdentifierOrKeyword;
+            if (isLineTerminator(m_current)) {
+                shiftLineTerminator();
+                m_atLineStart = true;
+                m_terminator = true;
+                if (lastTokenWasRestrKeyword()) {
+                    token = ';';
+                    goto doneSemicolon;
                 }
-                record16(token);
-                m_state = InIdentifier;
-                break;
-            default:
-                ASSERT(!"Unhandled state in switch statement");
-        }
-
-        // move on to the next character
-        if (!m_done)
-            shift(1);
-        if (m_state != Start && m_state != InSingleLineComment)
-            m_atLineStart = false;
+                goto start;
+            }
+            goto returnError;
     }
 
-    // no identifiers allowed directly after numeric literal, e.g. "3in" is bad
-    if ((m_state == Number || m_state == Octal || m_state == Hex) && isIdentStart(m_current))
-        m_state = Bad;
+    m_atLineStart = false;
+    goto returnToken;
 
-    // terminate string
-    m_buffer8.append('\0');
-
-#ifdef JSC_DEBUG_LEX
-    fprintf(stderr, "line: %d ", lineNo());
-    fprintf(stderr, "yytext (%x): ", m_buffer8[0]);
-    fprintf(stderr, "%s ", m_buffer8.data());
-#endif
+startString: {
+    int stringQuoteCharacter = m_current;
+    shift1();
 
-    double dval = 0;
-    if (m_state == Number)
-        dval = WTF::strtod(m_buffer8.data(), 0L);
-    else if (m_state == Hex) { // scan hex numbers
-        const char* p = m_buffer8.data() + 2;
-        while (char c = *p++) {
-            dval *= 16;
-            dval += convertHex(c);
+    const UChar* stringStart = currentCharacter();
+    while (m_current != stringQuoteCharacter) {
+        // Fast check for characters that require special handling.
+        // Catches -1, \n, \r, \, 0x2028, and 0x2029 as efficiently
+        // as possible, and lets through all common ASCII characters.
+        if (UNLIKELY(m_current == '\\') || UNLIKELY(((static_cast<unsigned>(m_current) - 0xE) & 0x2000))) {
+            m_buffer16.append(stringStart, currentCharacter() - stringStart);
+            goto inString;
+        }
+        shift1();
+    }
+    lvalp->ident = makeIdentifier(stringStart, currentCharacter() - stringStart);
+    shift1();
+    m_atLineStart = false;
+    m_delimited = false;
+    token = STRING;
+    goto returnToken;
+
+inString:
+    while (m_current != stringQuoteCharacter) {
+        if (m_current == '\\')
+            goto inStringEscapeSequence;
+        if (UNLIKELY(isLineTerminator(m_current)))
+            goto returnError;
+        if (UNLIKELY(m_current == -1))
+            goto returnError;
+        record16(m_current);
+        shift1();
+    }
+    goto doneString;
+
+inStringEscapeSequence:
+    shift1();
+    if (m_current == 'x') {
+        shift1();
+        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1)) {
+            record16(convertHex(m_current, m_next1));
+            shift2();
+            goto inString;
         }
+        record16('x');
+        if (m_current == stringQuoteCharacter)
+            goto doneString;
+        goto inString;
+    }
+    if (m_current == 'u') {
+        shift1();
+        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1) && isASCIIHexDigit(m_next2) && isASCIIHexDigit(m_next3)) {
+            record16(convertUnicode(m_current, m_next1, m_next2, m_next3));
+            shift4();
+            goto inString;
+        }
+        if (m_current == stringQuoteCharacter) {
+            record16('u');
+            goto doneString;
+        }
+        goto returnError;
+    }
+    if (isASCIIOctalDigit(m_current)) {
+        if (m_current >= '0' && m_current <= '3' && isASCIIOctalDigit(m_next1) && isASCIIOctalDigit(m_next2)) {
+            record16((m_current - '0') * 64 + (m_next1 - '0') * 8 + m_next2 - '0');
+            shift3();
+            goto inString;
+        }
+        if (isASCIIOctalDigit(m_next1)) {
+            record16((m_current - '0') * 8 + m_next1 - '0');
+            shift2();
+            goto inString;
+        }
+        record16(m_current - '0');
+        shift1();
+        goto inString;
+    }
+    if (isLineTerminator(m_current)) {
+        shiftLineTerminator();
+        goto inString;
+    }
+    record16(singleEscape(m_current));
+    shift1();
+    goto inString;
+}
 
-        if (dval >= mantissaOverflowLowerBound)
-            dval = parseIntOverflow(m_buffer8.data() + 2, p - (m_buffer8.data() + 3), 16);
+startIdentifierWithBackslash:
+    shift1();
+    if (UNLIKELY(m_current != 'u'))
+        goto returnError;
+    shift1();
+    if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+        goto returnError;
+    token = convertUnicode(m_current, m_next1, m_next2, m_next3);
+    if (UNLIKELY(!isIdentStart(token)))
+        goto returnError;
+    goto inIdentifierAfterCharacterCheck;
+
+startIdentifierOrKeyword: {
+    const UChar* identifierStart = currentCharacter();
+    shift1();
+    while (isIdentPart(m_current))
+        shift1();
+    if (LIKELY(m_current != '\\')) {
+        lvalp->ident = makeIdentifier(identifierStart, currentCharacter() - identifierStart);
+        goto doneIdentifierOrKeyword;
+    }
+    m_buffer16.append(identifierStart, currentCharacter() - identifierStart);
+}
 
-        m_state = Number;
-    } else if (m_state == Octal) {   // scan octal number
-        const char* p = m_buffer8.data() + 1;
-        while (char c = *p++) {
-            dval *= 8;
-            dval += c - '0';
+    do {
+        shift1();
+        if (UNLIKELY(m_current != 'u'))
+            goto returnError;
+        shift1();
+        if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+            goto returnError;
+        token = convertUnicode(m_current, m_next1, m_next2, m_next3);
+        if (UNLIKELY(!isIdentPart(token)))
+            goto returnError;
+inIdentifierAfterCharacterCheck:
+        record16(token);
+        shift4();
+
+        while (isIdentPart(m_current)) {
+            record16(m_current);
+            shift1();
         }
+    } while (UNLIKELY(m_current == '\\'));
+    goto doneIdentifier;
 
-        if (dval >= mantissaOverflowLowerBound)
-            dval = parseIntOverflow(m_buffer8.data() + 1, p - (m_buffer8.data() + 2), 8);
-
-        m_state = Number;
+inSingleLineComment:
+    while (!isLineTerminator(m_current)) {
+        if (UNLIKELY(m_current == -1))
+            return 0;
+        shift1();
     }
-
-#ifdef JSC_DEBUG_LEX
-    switch (m_state) {
-        case Eof:
-            printf("(EOF)\n");
-            break;
-        case Other:
-            printf("(Other)\n");
-            break;
-        case Identifier:
-            printf("(Identifier)/(Keyword)\n");
-            break;
-        case String:
-            printf("(String)\n");
-            break;
-        case Number:
-            printf("(Number)\n");
-            break;
-        default:
-            printf("(unknown)");
+    shiftLineTerminator();
+    m_atLineStart = true;
+    m_terminator = true;
+    if (lastTokenWasRestrKeyword())
+        goto doneSemicolon;
+    goto start;
+
+inMultiLineComment:
+    shift2();
+    while (m_current != '*' || m_next1 != '/') {
+        if (isLineTerminator(m_current))
+            shiftLineTerminator();
+        else {
+            shift1();
+            if (UNLIKELY(m_current == -1))
+                goto returnError;
+        }
     }
-#endif
+    shift2();
+    m_atLineStart = false;
+    goto start;
+
+startNumberWithZeroDigit:
+    shift1();
+    if ((m_current | 0x20) == 'x' && isASCIIHexDigit(m_next1)) {
+        shift1();
+        goto inHex;
+    }
+    if (m_current == '.') {
+        record8('0');
+        record8('.');
+        shift1();
+        goto inNumberAfterDecimalPoint;
+    }
+    if ((m_current | 0x20) == 'e') {
+        record8('0');
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
+    }
+    if (isASCIIOctalDigit(m_current))
+        goto inOctal;
+    if (isASCIIDigit(m_current))
+        goto startNumber;
+    lvalp->doubleValue = 0;
+    goto doneNumeric;
+
+inNumberAfterDecimalPoint:
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift1();
+    }
+    if ((m_current | 0x20) == 'e') {
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
+    }
+    goto doneNumber;
+
+inExponentIndicator:
+    if (m_current == '+' || m_current == '-') {
+        record8(m_current);
+        shift1();
+    }
+    if (!isASCIIDigit(m_current))
+        goto returnError;
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIDigit(m_current));
+    goto doneNumber;
+
+inOctal: {
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIOctalDigit(m_current));
+    if (isASCIIDigit(m_current))
+        goto startNumber;
 
-    if (m_state != Identifier)
-        m_eatNextIdentifier = false;
+    double dval = 0;
 
-    m_restrKeyword = false;
-    m_delimited = false;
-    llocp->first_line = yylineno;
-    llocp->last_line = yylineno;
-    llocp->first_column = startOffset;
-    llocp->last_column = m_currentOffset;
-    switch (m_state) {
-        case Eof:
-            token = 0;
-            break;
-        case Other:
-            if (token == '}' || token == ';')
-                m_delimited = true;
-            break;
-        case Identifier:
-            // Apply anonymous-function hack below (eat the identifier).
-            if (m_eatNextIdentifier) {
-                m_eatNextIdentifier = false;
-                token = lex(lvalp, llocp);
-                break;
-            }
-            lvalp->ident = makeIdentifier(m_buffer16);
-            token = IDENT;
-            break;
-        case IdentifierOrKeyword: {
-            lvalp->ident = makeIdentifier(m_buffer16);
-            const HashEntry* entry = m_mainTable.entry(m_globalData, *lvalp->ident);
-            if (!entry) {
-                // Lookup for keyword failed, means this is an identifier.
-                token = IDENT;
-                break;
-            }
-            token = entry->lexerValue();
-            // Hack for "f = function somename() { ... }"; too hard to get into the grammar.
-            m_eatNextIdentifier = token == FUNCTION && m_lastToken == '=';
-            if (token == CONTINUE || token == BREAK || token == RETURN || token == THROW)
-                m_restrKeyword = true;
-            break;
-        }
-        case String:
-            // Atomize constant strings in case they're later used in property lookup.
-            lvalp->ident = makeIdentifier(m_buffer16);
-            token = STRING;
-            break;
-        case Number:
-            lvalp->doubleValue = dval;
-            token = NUMBER;
-            break;
-        case Bad:
-#ifdef JSC_DEBUG_LEX
-            fprintf(stderr, "yylex: ERROR.\n");
-#endif
-            m_error = true;
-            return -1;
-        default:
-            ASSERT(!"unhandled numeration value in switch");
-            m_error = true;
-            return -1;
+    const char* end = m_buffer8.end();
+    for (const char* p = m_buffer8.data(); p < end; ++p) {
+        dval *= 8;
+        dval += *p - '0';
     }
-    m_lastToken = token;
-    return token;
-}
+    if (dval >= mantissaOverflowLowerBound)
+        dval = parseIntOverflow(m_buffer8.data(), end - m_buffer8.data(), 8);
 
-bool Lexer::isWhiteSpace() const
-{
-    return m_current == '\t' || m_current == 0x0b || m_current == 0x0c || isSeparatorSpace(m_current);
-}
+    m_buffer8.resize(0);
 
-bool Lexer::isLineTerminator()
-{
-    bool cr = (m_current == '\r');
-    bool lf = (m_current == '\n');
-    if (cr)
-        m_skipLF = true;
-    else if (lf)
-        m_skipCR = true;
-    return cr || lf || m_current == 0x2028 || m_current == 0x2029;
+    lvalp->doubleValue = dval;
+    goto doneNumeric;
 }
 
-bool Lexer::isIdentStart(int c)
-{
-    return isASCIIAlpha(c) || c == '$' || c == '_' || (!isASCII(c) && (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other)));
-}
+inHex: {
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIHexDigit(m_current));
 
-bool Lexer::isIdentPart(int c)
-{
-    return isASCIIAlphanumeric(c) || c == '$' || c == '_' || (!isASCII(c) && (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
-                            | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector)));
-}
+    double dval = 0;
 
-static bool isDecimalDigit(int c)
-{
-    return isASCIIDigit(c);
-}
+    const char* end = m_buffer8.end();
+    for (const char* p = m_buffer8.data(); p < end; ++p) {
+        dval *= 16;
+        dval += toASCIIHexValue(*p);
+    }
+    if (dval >= mantissaOverflowLowerBound)
+        dval = parseIntOverflow(m_buffer8.data(), end - m_buffer8.data(), 16);
 
-bool Lexer::isHexDigit(int c)
-{
-    return isASCIIHexDigit(c); 
-}
+    m_buffer8.resize(0);
 
-bool Lexer::isOctalDigit(int c)
-{
-    return isASCIIOctalDigit(c);
+    lvalp->doubleValue = dval;
+    goto doneNumeric;
 }
 
-int Lexer::matchPunctuator(int& charPos, int c1, int c2, int c3, int c4)
-{
-    if (c1 == '>' && c2 == '>' && c3 == '>' && c4 == '=') {
-        shift(4);
-        return URSHIFTEQUAL;
-    }
-    if (c1 == '=' && c2 == '=' && c3 == '=') {
-        shift(3);
-        return STREQ;
-    }
-    if (c1 == '!' && c2 == '=' && c3 == '=') {
-        shift(3);
-        return STRNEQ;
-    }
-    if (c1 == '>' && c2 == '>' && c3 == '>') {
-        shift(3);
-        return URSHIFT;
-    }
-    if (c1 == '<' && c2 == '<' && c3 == '=') {
-        shift(3);
-        return LSHIFTEQUAL;
-    }
-    if (c1 == '>' && c2 == '>' && c3 == '=') {
-        shift(3);
-        return RSHIFTEQUAL;
-    }
-    if (c1 == '<' && c2 == '=') {
-        shift(2);
-        return LE;
-    }
-    if (c1 == '>' && c2 == '=') {
-        shift(2);
-        return GE;
-    }
-    if (c1 == '!' && c2 == '=') {
-        shift(2);
-        return NE;
-    }
-    if (c1 == '+' && c2 == '+') {
-        shift(2);
-        if (m_terminator)
-            return AUTOPLUSPLUS;
-        return PLUSPLUS;
-    }
-    if (c1 == '-' && c2 == '-') {
-        shift(2);
-        if (m_terminator)
-            return AUTOMINUSMINUS;
-        return MINUSMINUS;
-    }
-    if (c1 == '=' && c2 == '=') {
-        shift(2);
-        return EQEQ;
-    }
-    if (c1 == '+' && c2 == '=') {
-        shift(2);
-        return PLUSEQUAL;
-    }
-    if (c1 == '-' && c2 == '=') {
-        shift(2);
-        return MINUSEQUAL;
-    }
-    if (c1 == '*' && c2 == '=') {
-        shift(2);
-        return MULTEQUAL;
-    }
-    if (c1 == '/' && c2 == '=') {
-        shift(2);
-        return DIVEQUAL;
-    }
-    if (c1 == '&' && c2 == '=') {
-        shift(2);
-        return ANDEQUAL;
-    }
-    if (c1 == '^' && c2 == '=') {
-        shift(2);
-        return XOREQUAL;
-    }
-    if (c1 == '%' && c2 == '=') {
-        shift(2);
-        return MODEQUAL;
-    }
-    if (c1 == '|' && c2 == '=') {
-        shift(2);
-        return OREQUAL;
-    }
-    if (c1 == '<' && c2 == '<') {
-        shift(2);
-        return LSHIFT;
-    }
-    if (c1 == '>' && c2 == '>') {
-        shift(2);
-        return RSHIFT;
+startNumber:
+    record8(m_current);
+    shift1();
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift1();
     }
-    if (c1 == '&' && c2 == '&') {
-        shift(2);
-        return AND;
+    if (m_current == '.') {
+        record8('.');
+        shift1();
+        goto inNumberAfterDecimalPoint;
     }
-    if (c1 == '|' && c2 == '|') {
-        shift(2);
-        return OR;
+    if ((m_current | 0x20) == 'e') {
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
     }
 
-    switch (c1) {
-        case '=':
-        case '>':
-        case '<':
-        case ',':
-        case '!':
-        case '~':
-        case '?':
-        case ':':
-        case '.':
-        case '+':
-        case '-':
-        case '*':
-        case '/':
-        case '&':
-        case '|':
-        case '^':
-        case '%':
-        case '(':
-        case ')':
-        case '[':
-        case ']':
-        case ';':
-            shift(1);
-            return static_cast<int>(c1);
-        case '{':
-            charPos = m_position - 4;
-            shift(1);
-            return OPENBRACE;
-        case '}':
-            charPos = m_position - 4;
-            shift(1);
-            return CLOSEBRACE;
-        default:
-            return -1;
-    }
-}
+    // Fall through into doneNumber.
 
-unsigned short Lexer::singleEscape(unsigned short c)
-{
-    switch (c) {
-        case 'b':
-            return 0x08;
-        case 't':
-            return 0x09;
-        case 'n':
-            return 0x0A;
-        case 'v':
-            return 0x0B;
-        case 'f':
-            return 0x0C;
-        case 'r':
-            return 0x0D;
-        case '"':
-            return 0x22;
-        case '\'':
-            return 0x27;
-        case '\\':
-            return 0x5C;
-        default:
-            return c;
-    }
-}
+doneNumber:
+    // Null-terminate string for strtod.
+    m_buffer8.append('\0');
+    lvalp->doubleValue = WTF::strtod(m_buffer8.data(), 0);
+    m_buffer8.resize(0);
 
-unsigned short Lexer::convertOctal(int c1, int c2, int c3)
-{
-    return static_cast<unsigned short>((c1 - '0') * 64 + (c2 - '0') * 8 + c3 - '0');
-}
+    // Fall through into doneNumeric.
 
-unsigned char Lexer::convertHex(int c)
-{
-    if (c >= '0' && c <= '9')
-        return static_cast<unsigned char>(c - '0');
-    if (c >= 'a' && c <= 'f')
-        return static_cast<unsigned char>(c - 'a' + 10);
-    return static_cast<unsigned char>(c - 'A' + 10);
-}
+doneNumeric:
+    // No identifiers allowed directly after numeric literal, e.g. "3in" is bad.
+    if (UNLIKELY(isIdentStart(m_current)))
+        goto returnError;
 
-unsigned char Lexer::convertHex(int c1, int c2)
-{
-    return ((convertHex(c1) << 4) + convertHex(c2));
-}
+    m_atLineStart = false;
+    m_delimited = false;
+    token = NUMBER;
+    goto returnToken;
 
-UChar Lexer::convertUnicode(int c1, int c2, int c3, int c4)
-{
-    unsigned char highByte = (convertHex(c1) << 4) + convertHex(c2);
-    unsigned char lowByte = (convertHex(c3) << 4) + convertHex(c4);
-    return (highByte << 8 | lowByte);
-}
+doneSemicolon:
+    token = ';';
+    m_delimited = true;
+    goto returnToken;
 
-void Lexer::record8(int c)
-{
-    ASSERT(c >= 0);
-    ASSERT(c <= 0xff);
-    m_buffer8.append(static_cast<char>(c));
+doneIdentifier:
+    m_atLineStart = false;
+    m_delimited = false;
+    lvalp->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+    token = IDENT;
+    goto returnToken;
+
+doneIdentifierOrKeyword: {
+    m_atLineStart = false;
+    m_delimited = false;
+    m_buffer16.resize(0);
+    const HashEntry* entry = m_keywordTable.entry(m_globalData, *lvalp->ident);
+    token = entry ? entry->lexerValue() : IDENT;
+    goto returnToken;
 }
 
-void Lexer::record16(int c)
-{
-    ASSERT(c >= 0);
-    ASSERT(c <= USHRT_MAX);
-    record16(UChar(static_cast<unsigned short>(c)));
+doneString:
+    // Atomize constant strings in case they're later used in property lookup.
+    shift1();
+    m_atLineStart = false;
+    m_delimited = false;
+    lvalp->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+    token = STRING;
+
+    // Fall through into returnToken.
+
+returnToken: {
+    int lineNumber = m_lineNumber;
+    llocp->first_line = lineNumber;
+    llocp->last_line = lineNumber;
+    llocp->first_column = startOffset;
+    llocp->last_column = currentOffset();
+
+    m_lastToken = token;
+    return token;
 }
 
-void Lexer::record16(UChar c)
-{
-    m_buffer16.append(c);
+returnError:
+    m_error = true;
+    return -1;
 }
 
 bool Lexer::scanRegExp()
 {
-    m_buffer16.clear();
+    ASSERT(m_buffer16.isEmpty());
+
     bool lastWasEscape = false;
     bool inBrackets = false;
 
-    while (1) {
-        if (isLineTerminator() || m_current == -1)
+    while (true) {
+        if (isLineTerminator(m_current) || m_current == -1)
             return false;
-        else if (m_current != '/' || lastWasEscape == true || inBrackets == true) {
+        if (m_current != '/' || lastWasEscape || inBrackets) {
             // keep track of '[' and ']'
             if (!lastWasEscape) {
-                if ( m_current == '[' && !inBrackets )
+                if (m_current == '[' && !inBrackets)
                     inBrackets = true;
-                if ( m_current == ']' && inBrackets )
+                if (m_current == ']' && inBrackets)
                     inBrackets = false;
             }
             record16(m_current);
-            lastWasEscape =
-            !lastWasEscape && (m_current == '\\');
+            lastWasEscape = !lastWasEscape && m_current == '\\';
         } else { // end of regexp
             m_pattern = UString(m_buffer16);
-            m_buffer16.clear();
-            shift(1);
+            m_buffer16.resize(0);
+            shift1();
             break;
         }
-        shift(1);
+        shift1();
     }
 
     while (isIdentPart(m_current)) {
         record16(m_current);
-        shift(1);
+        shift1();
     }
     m_flags = UString(m_buffer16);
+    m_buffer16.resize(0);
 
     return true;
 }
@@ -882,19 +950,42 @@ bool Lexer::scanRegExp()
 void Lexer::clear()
 {
     m_identifiers.clear();
+    m_codeWithoutBOMs.clear();
 
     Vector<char> newBuffer8;
-    newBuffer8.reserveCapacity(initialReadBufferCapacity);
+    newBuffer8.reserveInitialCapacity(initialReadBufferCapacity);
     m_buffer8.swap(newBuffer8);
 
     Vector<UChar> newBuffer16;
-    newBuffer16.reserveCapacity(initialReadBufferCapacity);
+    newBuffer16.reserveInitialCapacity(initialReadBufferCapacity);
     m_buffer16.swap(newBuffer16);
 
     m_isReparsing = false;
 
-    m_pattern = 0;
-    m_flags = 0;
+    m_pattern = UString();
+    m_flags = UString();
+}
+
+SourceCode Lexer::sourceCode(int openBrace, int closeBrace, int firstLine)
+{
+    if (m_codeWithoutBOMs.isEmpty())
+        return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine);
+
+    const UChar* data = m_source->provider()->data();
+
+    ASSERT(openBrace < closeBrace);
+
+    int numBOMsBeforeOpenBrace = 0;
+    int numBOMsBetweenBraces = 0;
+
+    int i;
+    for (i = m_source->startOffset(); i < openBrace; ++i)
+        numBOMsBeforeOpenBrace += data[i] == byteOrderMark;
+    for (; i < closeBrace; ++i)
+        numBOMsBetweenBraces += data[i] == byteOrderMark;
+
+    return SourceCode(m_source->provider(), openBrace + numBOMsBeforeOpenBrace,
+        closeBrace + numBOMsBeforeOpenBrace + numBOMsBetweenBraces + 1, firstLine);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
index afcf09fead..9c22a9c591 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -22,11 +22,12 @@
 #ifndef Lexer_h
 #define Lexer_h
 
-#include "Identifier.h"
 #include "Lookup.h"
 #include "SegmentedVector.h"
 #include "SourceCode.h"
+#include <wtf/ASCIICType.h>
 #include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC {
 
@@ -34,115 +35,71 @@ namespace JSC {
 
     class Lexer : Noncopyable {
     public:
+        // Character manipulation functions.
+        static bool isWhiteSpace(int character);
+        static bool isLineTerminator(int character);
+        static unsigned char convertHex(int c1, int c2);
+        static UChar convertUnicode(int c1, int c2, int c3, int c4);
+
+        // Functions to set up parsing.
         void setCode(const SourceCode&);
         void setIsReparsing() { m_isReparsing = true; }
-        int lex(void* lvalp, void* llocp);
-
-        int lineNo() const { return yylineno; }
 
+        // Functions for the parser itself.
+        int lex(void* lvalp, void* llocp);
+        int lineNumber() const { return m_lineNumber; }
         bool prevTerminator() const { return m_terminator; }
-
-        enum State {
-            Start,
-            IdentifierOrKeyword,
-            Identifier,
-            InIdentifierOrKeyword,
-            InIdentifier,
-            InIdentifierStartUnicodeEscapeStart,
-            InIdentifierStartUnicodeEscape,
-            InIdentifierPartUnicodeEscapeStart,
-            InIdentifierPartUnicodeEscape,
-            InSingleLineComment,
-            InMultiLineComment,
-            InNum,
-            InNum0,
-            InHex,
-            InOctal,
-            InDecimal,
-            InExponentIndicator,
-            InExponent,
-            Hex,
-            Octal,
-            Number,
-            String,
-            Eof,
-            InString,
-            InEscapeSequence,
-            InHexEscape,
-            InUnicodeEscape,
-            Other,
-            Bad
-        };
-
+        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine);
         bool scanRegExp();
         const UString& pattern() const { return m_pattern; }
         const UString& flags() const { return m_flags; }
 
-        static unsigned char convertHex(int);
-        static unsigned char convertHex(int c1, int c2);
-        static UChar convertUnicode(int c1, int c2, int c3, int c4);
-        static bool isIdentStart(int);
-        static bool isIdentPart(int);
-        static bool isHexDigit(int);
-
+        // Functions for use after parsing.
         bool sawError() const { return m_error; }
-
         void clear();
-        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine) { return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine); }
 
     private:
         friend class JSGlobalData;
+
         Lexer(JSGlobalData*);
         ~Lexer();
 
-        void setDone(State);
-        void shift(unsigned int p);
-        void nextLine();
-        int lookupKeyword(const char *);
-
-        bool isWhiteSpace() const;
-        bool isLineTerminator();
-        static bool isOctalDigit(int);
-
-        int matchPunctuator(int& charPos, int c1, int c2, int c3, int c4);
-        static unsigned short singleEscape(unsigned short);
-        static unsigned short convertOctal(int c1, int c2, int c3);
+        void shift1();
+        void shift2();
+        void shift3();
+        void shift4();
+        void shiftLineTerminator();
 
         void record8(int);
         void record16(int);
         void record16(UChar);
 
-        JSC::Identifier* makeIdentifier(const Vector<UChar>& buffer)
-        {
-            m_identifiers.append(JSC::Identifier(m_globalData, buffer.data(), buffer.size()));
-            return &m_identifiers.last();
-        }
+        void copyCodeWithoutBOMs();
+
+        int currentOffset() const;
+        const UChar* currentCharacter() const;
+
+        JSC::Identifier* makeIdentifier(const UChar* buffer, size_t length);
+
+        bool lastTokenWasRestrKeyword() const;
 
         static const size_t initialReadBufferCapacity = 32;
         static const size_t initialIdentifierTableCapacity = 64;
 
-        int yylineno;
-        int yycolumn;
+        int m_lineNumber;
 
-        bool m_done;
         Vector<char> m_buffer8;
         Vector<UChar> m_buffer16;
         bool m_terminator;
-        bool m_restrKeyword;
         bool m_delimited; // encountered delimiter like "'" and "}" on last run
-        bool m_skipLF;
-        bool m_skipCR;
-        bool m_eatNextIdentifier;
-        int m_stackToken;
         int m_lastToken;
 
-        State m_state;
-        unsigned int m_position;
         const SourceCode* m_source;
         const UChar* m_code;
-        unsigned int m_length;
+        const UChar* m_codeStart;
+        const UChar* m_codeEnd;
         bool m_isReparsing;
-        int m_atLineStart;
+        bool m_atLineStart;
         bool m_error;
 
         // current and following unicode characters (int to allow for -1 for end-of-file marker)
@@ -151,11 +108,6 @@ namespace JSC {
         int m_next2;
         int m_next3;
         
-        int m_currentOffset;
-        int m_nextOffset1;
-        int m_nextOffset2;
-        int m_nextOffset3;
-        
         SegmentedVector<JSC::Identifier, initialIdentifierTableCapacity> m_identifiers;
 
         JSGlobalData* m_globalData;
@@ -163,9 +115,31 @@ namespace JSC {
         UString m_pattern;
         UString m_flags;
 
-        const HashTable m_mainTable;
+        const HashTable m_keywordTable;
+
+        Vector<UChar> m_codeWithoutBOMs;
     };
 
+    inline bool Lexer::isWhiteSpace(int ch)
+    {
+        return isASCII(ch) ? (ch == ' ' || ch == '\t' || ch == 0xB || ch == 0xC) : WTF::Unicode::isSeparatorSpace(ch);
+    }
+
+    inline bool Lexer::isLineTerminator(int ch)
+    {
+        return ch == '\r' || ch == '\n' || (ch & ~1) == 0x2028;
+    }
+
+    inline unsigned char Lexer::convertHex(int c1, int c2)
+    {
+        return (toASCIIHexValue(c1) << 4) | toASCIIHexValue(c2);
+    }
+
+    inline UChar Lexer::convertUnicode(int c1, int c2, int c3, int c4)
+    {
+        return (convertHex(c1, c2) << 8) | convertHex(c3, c4);
+    }
+
 } // namespace JSC
 
 #endif // Lexer_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
new file mode 100644
index 0000000000..ea1579b3e9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
@@ -0,0 +1,911 @@
+/*
+ *  Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef NodeConstructors_h
+#define NodeConstructors_h
+
+#include "Nodes.h"
+#include "Lexer.h"
+#include "Parser.h"
+
+namespace JSC {
+
+    inline void* ParserArenaDeletable::operator new(size_t size, JSGlobalData* globalData)
+    {
+        ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(fastMalloc(size));
+        globalData->parser->arena().deleteWithArena(deletable);
+        return deletable;
+    }
+
+    inline void* ParserArenaDeletable::operator new(size_t size)
+    {
+        return fastMalloc(size);
+    }
+
+    inline ParserArenaRefCounted::ParserArenaRefCounted(JSGlobalData* globalData)
+    {
+        globalData->parser->arena().derefWithArena(adoptRef(this));
+    }
+
+    inline Node::Node(JSGlobalData* globalData)
+        : m_line(globalData->lexer->lineNumber())
+    {
+    }
+
+    inline ExpressionNode::ExpressionNode(JSGlobalData* globalData, ResultType resultType)
+        : Node(globalData)
+        , m_resultType(resultType)
+    {
+    }
+
+    inline StatementNode::StatementNode(JSGlobalData* globalData)
+        : Node(globalData)
+        , m_lastLine(-1)
+    {
+    }
+
+    inline NullNode::NullNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData, ResultType::nullType())
+    {
+    }
+
+    inline BooleanNode::BooleanNode(JSGlobalData* globalData, bool value)
+        : ExpressionNode(globalData, ResultType::booleanType())
+        , m_value(value)
+    {
+    }
+
+    inline NumberNode::NumberNode(JSGlobalData* globalData, double v)
+        : ExpressionNode(globalData, ResultType::numberType())
+        , m_double(v)
+    {
+    }
+
+    inline StringNode::StringNode(JSGlobalData* globalData, const Identifier& v)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_value(v)
+    {
+    }
+
+    inline RegExpNode::RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags)
+        : ExpressionNode(globalData)
+        , m_pattern(pattern)
+        , m_flags(flags)
+    {
+    }
+
+    inline ThisNode::ThisNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData)
+    {
+    }
+
+    inline ResolveNode::ResolveNode(JSGlobalData* globalData, const Identifier& ident, int startOffset)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_startOffset(startOffset)
+    {
+    }
+
+    inline ElementNode::ElementNode(JSGlobalData*, int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+    }
+
+    inline ElementNode::ElementNode(JSGlobalData*, ElementNode* l, int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+        l->m_next = this;
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, int elision)
+        : ExpressionNode(globalData)
+        , m_element(0)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, ElementNode* element)
+        : ExpressionNode(globalData)
+        , m_element(element)
+        , m_elision(0)
+        , m_optional(false)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, int elision, ElementNode* element)
+        : ExpressionNode(globalData)
+        , m_element(element)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline PropertyNode::PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* assign, Type type)
+        : m_name(name)
+        , m_assign(assign)
+        , m_type(type)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node)
+        : Node(globalData)
+        , m_node(node)
+        , m_next(0)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node, PropertyListNode* list)
+        : Node(globalData)
+        , m_node(node)
+        , m_next(0)
+    {
+        list->m_next = this;
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData)
+        , m_list(0)
+    {
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(JSGlobalData* globalData, PropertyListNode* list)
+        : ExpressionNode(globalData)
+        , m_list(list)
+    {
+    }
+
+    inline BracketAccessorNode::BracketAccessorNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments)
+        : ExpressionNode(globalData)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+    {
+    }
+
+    inline DotAccessorNode::DotAccessorNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident)
+        : ExpressionNode(globalData)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : Node(globalData)
+        , m_next(0)
+        , m_expr(expr)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(JSGlobalData* globalData, ArgumentListNode* listNode, ExpressionNode* expr)
+        : Node(globalData)
+        , m_next(0)
+        , m_expr(expr)
+    {
+        listNode->m_next = this;
+    }
+
+    inline ArgumentsNode::ArgumentsNode(JSGlobalData*)
+        : m_listNode(0)
+    {
+    }
+
+    inline ArgumentsNode::ArgumentsNode(JSGlobalData*, ArgumentListNode* listNode)
+        : m_listNode(listNode)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+        , m_args(0)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+        , m_args(args)
+    {
+    }
+
+    inline EvalFunctionCallNode::EvalFunctionCallNode(JSGlobalData* globalData, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallValueNode::FunctionCallValueNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallResolveNode::FunctionCallResolveNode(JSGlobalData* globalData, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallBracketNode::FunctionCallBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallDotNode::FunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline CallFunctionCallDotNode::CallFunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(globalData, base, ident, args, divot, startOffset, endOffset)
+    {
+    }
+
+    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(globalData, base, ident, args, divot, startOffset, endOffset)
+    {
+    }
+
+    inline PrePostResolveNode::PrePostResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData, ResultType::numberType()) // could be reusable for pre?
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+    {
+    }
+
+    inline PostfixResolveNode::PostfixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixBracketNode::PostfixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixDotNode::PostfixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixErrorNode::PostfixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_operator(oper)
+    {
+    }
+
+    inline DeleteResolveNode::DeleteResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteBracketNode::DeleteBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+    {
+    }
+
+    inline DeleteDotNode::DeleteDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteValueNode::DeleteValueNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline VoidNode::VoidNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline TypeOfResolveNode::TypeOfResolveNode(JSGlobalData* globalData, const Identifier& ident)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_ident(ident)
+    {
+    }
+
+    inline TypeOfValueNode::TypeOfValueNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_expr(expr)
+    {
+    }
+
+    inline PrefixResolveNode::PrefixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixBracketNode::PrefixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixDotNode::PrefixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixErrorNode::PrefixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_operator(oper)
+    {
+    }
+
+    inline UnaryOpNode::UnaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr, OpcodeID opcodeID)
+        : ExpressionNode(globalData, type)
+        , m_expr(expr)
+        , m_opcodeID(opcodeID)
+    {
+    }
+
+    inline UnaryPlusNode::UnaryPlusNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::numberType(), expr, op_to_jsnumber)
+    {
+    }
+
+    inline NegateNode::NegateNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr, op_negate)
+    {
+    }
+
+    inline BitwiseNotNode::BitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::forBitOp(), expr, op_bitnot)
+    {
+    }
+
+    inline LogicalNotNode::LogicalNotNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::booleanType(), expr, op_not)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(globalData, type)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReverseBinaryOpNode::ReverseBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline ReverseBinaryOpNode::ReverseBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, type, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline MultNode::MultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_mul, rightHasAssignments)
+    {
+    }
+
+    inline DivNode::DivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_div, rightHasAssignments)
+    {
+    }
+
+
+    inline ModNode::ModNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_mod, rightHasAssignments)
+    {
+    }
+
+    inline AddNode::AddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, op_add, rightHasAssignments)
+    {
+    }
+
+    inline SubNode::SubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_sub, rightHasAssignments)
+    {
+    }
+
+    inline LeftShiftNode::LeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_lshift, rightHasAssignments)
+    {
+    }
+
+    inline RightShiftNode::RightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_rshift, rightHasAssignments)
+    {
+    }
+
+    inline UnsignedRightShiftNode::UnsignedRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_urshift, rightHasAssignments)
+    {
+    }
+
+    inline LessNode::LessNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    {
+    }
+
+    inline GreaterNode::GreaterNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    {
+    }
+
+    inline LessEqNode::LessEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    {
+    }
+
+    inline GreaterEqNode::GreaterEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, type, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline InstanceOfNode::InstanceOfNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_instanceof, rightHasAssignments)
+    {
+    }
+
+    inline InNode::InNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(globalData, expr1, expr2, op_in, rightHasAssignments)
+    {
+    }
+
+    inline EqualNode::EqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_eq, rightHasAssignments)
+    {
+    }
+
+    inline NotEqualNode::NotEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_neq, rightHasAssignments)
+    {
+    }
+
+    inline StrictEqualNode::StrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_stricteq, rightHasAssignments)
+    {
+    }
+
+    inline NotStrictEqualNode::NotStrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_nstricteq, rightHasAssignments)
+    {
+    }
+
+    inline BitAndNode::BitAndNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitand, rightHasAssignments)
+    {
+    }
+
+    inline BitOrNode::BitOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitor, rightHasAssignments)
+    {
+    }
+
+    inline BitXOrNode::BitXOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitxor, rightHasAssignments)
+    {
+    }
+
+    inline LogicalOpNode::LogicalOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
+        : ExpressionNode(globalData, ResultType::booleanType())
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_operator(oper)
+    {
+    }
+
+    inline ConditionalNode::ConditionalNode(JSGlobalData* globalData, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(globalData)
+        , m_logical(logical)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+    {
+    }
+
+    inline ReadModifyResolveNode::ReadModifyResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignResolveNode::AssignResolveNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_right(right)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReadModifyBracketNode::ReadModifyBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_operator(oper)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignBracketNode::AssignBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignDotNode::AssignDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReadModifyDotNode::ReadModifyDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignErrorNode::AssignErrorNode(JSGlobalData* globalData, ExpressionNode* left, Operator oper, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_left(left)
+        , m_operator(oper)
+        , m_right(right)
+    {
+    }
+
+    inline CommaNode::CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+    {
+    }
+
+    inline ConstStatementNode::ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next)
+        : StatementNode(globalData)
+        , m_next(next)
+    {
+    }
+
+    inline SourceElements::SourceElements(JSGlobalData*)
+    {
+    }
+
+    inline EmptyStatementNode::EmptyStatementNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline DebuggerStatementNode::DebuggerStatementNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+    
+    inline ExprStatementNode::ExprStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline VarStatementNode::VarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+    
+    inline IfNode::IfNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock)
+        : StatementNode(globalData)
+        , m_condition(condition)
+        , m_ifBlock(ifBlock)
+    {
+    }
+
+    inline IfElseNode::IfElseNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock)
+        : IfNode(globalData, condition, ifBlock)
+        , m_elseBlock(elseBlock)
+    {
+    }
+
+    inline DoWhileNode::DoWhileNode(JSGlobalData* globalData, StatementNode* statement, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_statement(statement)
+        , m_expr(expr)
+    {
+    }
+
+    inline WhileNode::WhileNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_statement(statement)
+    {
+    }
+
+    inline ForNode::ForNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl)
+        : StatementNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_expr3(expr3)
+        , m_statement(statement)
+        , m_expr1WasVarDecl(expr1 && expr1WasVarDecl)
+    {
+        ASSERT(statement);
+    }
+
+    inline ContinueNode::ContinueNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline ContinueNode::ContinueNode(JSGlobalData* globalData, const Identifier& ident)
+        : StatementNode(globalData)
+        , m_ident(ident)
+    {
+    }
+    
+    inline BreakNode::BreakNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline BreakNode::BreakNode(JSGlobalData* globalData, const Identifier& ident)
+        : StatementNode(globalData)
+        , m_ident(ident)
+    {
+    }
+    
+    inline ReturnNode::ReturnNode(JSGlobalData* globalData, ExpressionNode* value)
+        : StatementNode(globalData)
+        , m_value(value)
+    {
+    }
+
+    inline WithNode::WithNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_divot(divot)
+        , m_expressionLength(expressionLength)
+    {
+    }
+
+    inline LabelNode::LabelNode(JSGlobalData* globalData, const Identifier& name, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_name(name)
+        , m_statement(statement)
+    {
+    }
+
+    inline ThrowNode::ThrowNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline TryNode::TryNode(JSGlobalData* globalData, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock)
+        : StatementNode(globalData)
+        , m_tryBlock(tryBlock)
+        , m_exceptionIdent(exceptionIdent)
+        , m_catchBlock(catchBlock)
+        , m_finallyBlock(finallyBlock)
+        , m_catchHasEval(catchHasEval)
+    {
+    }
+
+    inline ParameterNode::ParameterNode(JSGlobalData*, const Identifier& ident)
+        : m_ident(ident)
+        , m_next(0)
+    {
+    }
+
+    inline ParameterNode::ParameterNode(JSGlobalData*, ParameterNode* l, const Identifier& ident)
+        : m_ident(ident)
+        , m_next(0)
+    {
+        l->m_next = this;
+    }
+
+    inline FuncExprNode::FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : ExpressionNode(globalData)
+        , ParserArenaRefCounted(globalData)
+        , m_ident(ident)
+        , m_body(body)
+    {
+        m_body->finishParsing(source, parameter);
+    }
+
+    inline FuncDeclNode::FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : StatementNode(globalData)
+        , ParserArenaRefCounted(globalData)
+        , m_ident(ident)
+        , m_body(body)
+    {
+        m_body->finishParsing(source, parameter);
+    }
+
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr)
+        : m_expr(expr)
+    {
+    }
+
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr, SourceElements* children)
+        : m_expr(expr)
+    {
+        if (children)
+            children->releaseContentsIntoVector(m_children);
+    }
+
+    inline ClauseListNode::ClauseListNode(JSGlobalData*, CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+    }
+
+    inline ClauseListNode::ClauseListNode(JSGlobalData*, ClauseListNode* clauseList, CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+        clauseList->m_next = this;
+    }
+
+    inline CaseBlockNode::CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2)
+        : m_list1(list1)
+        , m_defaultClause(defaultClause)
+        , m_list2(list2)
+    {
+    }
+
+    inline SwitchNode::SwitchNode(JSGlobalData* globalData, ExpressionNode* expr, CaseBlockNode* block)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_block(block)
+    {
+    }
+
+    inline ConstDeclNode::ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* init)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_next(0)
+        , m_init(init)
+    {
+    }
+
+    inline BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
+        : StatementNode(globalData)
+    {
+        if (children)
+            children->releaseContentsIntoVector(m_children);
+    }
+
+    inline ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_init(0)
+        , m_lexpr(l)
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_identIsVarDecl(false)
+    {
+    }
+
+    inline ForInNode::ForInNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
+        : StatementNode(globalData)
+        , m_ident(ident)
+        , m_init(0)
+        , m_lexpr(new (globalData) ResolveNode(globalData, ident, divot - startOffset))
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_identIsVarDecl(true)
+    {
+        if (in) {
+            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, ident, in, true);
+            node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
+            m_init = node;
+        }
+        // for( var foo = bar in baz )
+    }
+
+} // namespace JSC
+
+#endif // NodeConstructors_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h
index a518b23f4e..7f4deffac9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h
@@ -43,8 +43,8 @@ namespace JSC {
     
     template <typename T> struct NodeDeclarationInfo {
         T m_node;
-        ParserRefCountedData<DeclarationStacks::VarStack>* m_varDeclarations;
-        ParserRefCountedData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
+        ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
+        ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
         CodeFeatures m_features;
         int m_numConstants;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 201af28745..4ddf13ad68 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -25,24 +25,23 @@
 
 #include "config.h"
 #include "Nodes.h"
+#include "NodeConstructors.h"
 
 #include "BytecodeGenerator.h"
 #include "CallFrame.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSStaticScopeObject.h"
 #include "LabelScope.h"
+#include "Lexer.h"
+#include "Operations.h"
 #include "Parser.h"
 #include "PropertyNameArray.h"
 #include "RegExpObject.h"
 #include "SamplingTool.h"
-#include "Debugger.h"
-#include "Lexer.h"
-#include "Operations.h"
-#include <math.h>
 #include <wtf/Assertions.h>
-#include <wtf/HashCountedSet.h>
-#include <wtf/HashSet.h>
-#include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/Threading.h>
 
@@ -50,173 +49,7 @@ using namespace WTF;
 
 namespace JSC {
 
-static void substitute(UString& string, const UString& substring) JSC_FAST_CALL;
-
-// ------------------------------ NodeReleaser --------------------------------
-
-class NodeReleaser : Noncopyable {
-public:
-    // Call this function inside the destructor of a class derived from Node.
-    // This will traverse the tree below this node, destroying all of those nodes,
-    // but without relying on recursion.
-    static void releaseAllNodes(ParserRefCounted* root);
-
-    // Call this on each node in a the releaseNodes virtual function.
-    // It gives the node to the NodeReleaser, which will then release the
-    // node later at the end of the releaseAllNodes process.
-    template <typename T> void release(RefPtr<T>& node) { if (node) adopt(node.release()); }
-    void release(RefPtr<FunctionBodyNode>& node) { if (node) adoptFunctionBodyNode(node); }
-
-private:
-    NodeReleaser() { }
-    ~NodeReleaser() { }
-
-    void adopt(PassRefPtr<ParserRefCounted>);
-    void adoptFunctionBodyNode(RefPtr<FunctionBodyNode>&);
-
-    typedef Vector<RefPtr<ParserRefCounted> > NodeReleaseVector;
-    OwnPtr<NodeReleaseVector> m_vector;
-};
-
-void NodeReleaser::releaseAllNodes(ParserRefCounted* root)
-{
-    ASSERT(root);
-    NodeReleaser releaser;
-    root->releaseNodes(releaser);
-    if (!releaser.m_vector)
-        return;
-    // Note: The call to release.m_vector->size() is intentionally inside
-    // the loop, since calls to releaseNodes are expected to increase the size.
-    for (size_t i = 0; i < releaser.m_vector->size(); ++i) {
-        ParserRefCounted* node = (*releaser.m_vector)[i].get();
-        if (node->hasOneRef())
-            node->releaseNodes(releaser);
-    }
-}
-
-void NodeReleaser::adopt(PassRefPtr<ParserRefCounted> node)
-{
-    ASSERT(node);
-    if (!node->hasOneRef())
-        return;
-    if (!m_vector)
-        m_vector.set(new NodeReleaseVector);
-    m_vector->append(node);
-}
-
-void NodeReleaser::adoptFunctionBodyNode(RefPtr<FunctionBodyNode>& functionBodyNode)
-{
-    // This sidesteps a problem where if you assign a PassRefPtr<FunctionBodyNode>
-    // to a PassRefPtr<Node> we leave the two reference counts (FunctionBodyNode
-    // and ParserRefCounted) unbalanced. It would be nice to fix this problem in
-    // a cleaner way -- perhaps we could remove the FunctionBodyNode reference
-    // count at some point.
-    RefPtr<Node> node = functionBodyNode;
-    functionBodyNode = 0;
-    adopt(node.release());
-}
-
-// ------------------------------ ParserRefCounted -----------------------------------------
-
-#ifndef NDEBUG
-static RefCountedLeakCounter parserRefCountedCounter("JSC::Node");
-#endif
-
-ParserRefCounted::ParserRefCounted(JSGlobalData* globalData)
-    : m_globalData(globalData)
-{
-#ifndef NDEBUG
-    parserRefCountedCounter.increment();
-#endif
-    if (!m_globalData->newParserObjects)
-        m_globalData->newParserObjects = new HashSet<ParserRefCounted*>;
-    m_globalData->newParserObjects->add(this);
-    ASSERT(m_globalData->newParserObjects->contains(this));
-}
-
-ParserRefCounted::~ParserRefCounted()
-{
-#ifndef NDEBUG
-    parserRefCountedCounter.decrement();
-#endif
-}
-
-void ParserRefCounted::releaseNodes(NodeReleaser&)
-{
-}
-
-void ParserRefCounted::ref()
-{
-    // bumping from 0 to 1 is just removing from the new nodes set
-    if (m_globalData->newParserObjects) {
-        HashSet<ParserRefCounted*>::iterator it = m_globalData->newParserObjects->find(this);
-        if (it != m_globalData->newParserObjects->end()) {
-            m_globalData->newParserObjects->remove(it);
-            ASSERT(!m_globalData->parserObjectExtraRefCounts || !m_globalData->parserObjectExtraRefCounts->contains(this));
-            return;
-        }
-    }
-
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts)
-        m_globalData->parserObjectExtraRefCounts = new HashCountedSet<ParserRefCounted*>;
-    m_globalData->parserObjectExtraRefCounts->add(this);
-}
-
-void ParserRefCounted::deref()
-{
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts) {
-        delete this;
-        return;
-    }
-
-    HashCountedSet<ParserRefCounted*>::iterator it = m_globalData->parserObjectExtraRefCounts->find(this);
-    if (it == m_globalData->parserObjectExtraRefCounts->end())
-        delete this;
-    else
-        m_globalData->parserObjectExtraRefCounts->remove(it);
-}
-
-bool ParserRefCounted::hasOneRef()
-{
-    if (m_globalData->newParserObjects && m_globalData->newParserObjects->contains(this)) {
-        ASSERT(!m_globalData->parserObjectExtraRefCounts || !m_globalData->parserObjectExtraRefCounts->contains(this));
-        return false;
-    }
-
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts)
-        return true;
-
-    return !m_globalData->parserObjectExtraRefCounts->contains(this);
-}
-
-void ParserRefCounted::deleteNewObjects(JSGlobalData* globalData)
-{
-    if (!globalData->newParserObjects)
-        return;
-
-#ifndef NDEBUG
-    HashSet<ParserRefCounted*>::iterator end = globalData->newParserObjects->end();
-    for (HashSet<ParserRefCounted*>::iterator it = globalData->newParserObjects->begin(); it != end; ++it)
-        ASSERT(!globalData->parserObjectExtraRefCounts || !globalData->parserObjectExtraRefCounts->contains(*it));
-#endif
-    deleteAllValues(*globalData->newParserObjects);
-    delete globalData->newParserObjects;
-    globalData->newParserObjects = 0;
-}
-
-// ------------------------------ Node --------------------------------
-
-Node::Node(JSGlobalData* globalData)
-    : ParserRefCounted(globalData)
-{
-    m_line = globalData->lexer->lineNo();
-}
+static void substitute(UString& string, const UString& substring);
 
 // ------------------------------ ThrowableExpressionData --------------------------------
 
@@ -247,14 +80,8 @@ RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator
     generator.emitThrow(exception);
     return exception;
 }
-    
-// ------------------------------ StatementNode --------------------------------
 
-StatementNode::StatementNode(JSGlobalData* globalData)
-    : Node(globalData)
-    , m_lastLine(-1)
-{
-}
+// ------------------------------ StatementNode --------------------------------
 
 void StatementNode::setLoc(int firstLine, int lastLine)
 {
@@ -264,11 +91,10 @@ void StatementNode::setLoc(int firstLine, int lastLine)
 
 // ------------------------------ SourceElements --------------------------------
 
-void SourceElements::append(PassRefPtr<StatementNode> statement)
+void SourceElements::append(StatementNode* statement)
 {
     if (statement->isEmptyStatement())
         return;
-
     m_statements.append(statement);
 }
 
@@ -348,47 +174,24 @@ RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     return generator.emitResolve(generator.finalDestination(dst), m_ident);
 }
 
-// ------------------------------ ElementNode ------------------------------------
-
-ElementNode::~ElementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ElementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_node);
-}
-
 // ------------------------------ ArrayNode ------------------------------------
 
-ArrayNode::~ArrayNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArrayNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_element);
-}
-
 RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     // FIXME: Should we put all of this code into emitNewArray?
 
     unsigned length = 0;
     ElementNode* firstPutElement;
-    for (firstPutElement = m_element.get(); firstPutElement; firstPutElement = firstPutElement->next()) {
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
         if (firstPutElement->elision())
             break;
         ++length;
     }
 
     if (!firstPutElement && !m_elision)
-        return generator.emitNewArray(generator.finalDestination(dst), m_element.get());
+        return generator.emitNewArray(generator.finalDestination(dst), m_element);
 
-    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element.get());
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
 
     for (ElementNode* n = firstPutElement; n; n = n->next()) {
         RegisterID* value = generator.emitNode(n->value());
@@ -404,30 +207,35 @@ RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     return generator.moveToDestinationIfNeeded(dst, array.get());
 }
 
-// ------------------------------ PropertyNode ----------------------------
-
-PropertyNode::~PropertyNode()
+bool ArrayNode::isSimpleArray() const
 {
-    NodeReleaser::releaseAllNodes(this);
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+    }
+    return true;
 }
 
-void PropertyNode::releaseNodes(NodeReleaser& releaser)
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
 {
-    releaser.release(m_assign);
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
+    }
+    return head;
 }
 
 // ------------------------------ ObjectLiteralNode ----------------------------
 
-ObjectLiteralNode::~ObjectLiteralNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ObjectLiteralNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_list);
-}
-
 RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
      if (!m_list) {
@@ -435,30 +243,19 @@ RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, Regist
              return 0;
          return generator.emitNewObject(generator.finalDestination(dst));
      }
-     return generator.emitNode(dst, m_list.get());
+     return generator.emitNode(dst, m_list);
 }
 
 // ------------------------------ PropertyListNode -----------------------------
 
-PropertyListNode::~PropertyListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PropertyListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_node);
-    releaser.release(m_next);
-}
-
 RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> newObj = generator.tempDestination(dst);
     
     generator.emitNewObject(newObj.get());
     
-    for (PropertyListNode* p = this; p; p = p->m_next.get()) {
-        RegisterID* value = generator.emitNode(p->m_node->m_assign.get());
+    for (PropertyListNode* p = this; p; p = p->m_next) {
+        RegisterID* value = generator.emitNode(p->m_node->m_assign);
         
         switch (p->m_node->m_type) {
             case PropertyNode::Constant: {
@@ -483,152 +280,66 @@ RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, Registe
 
 // ------------------------------ BracketAccessorNode --------------------------------
 
-BracketAccessorNode::~BracketAccessorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void BracketAccessorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments, m_subscript->isPure(generator));
-    RegisterID* property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    RegisterID* property = generator.emitNode(m_subscript);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
 }
 
 // ------------------------------ DotAccessorNode --------------------------------
 
-DotAccessorNode::~DotAccessorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DotAccessorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* base = generator.emitNode(m_base.get());
+    RegisterID* base = generator.emitNode(m_base);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
 }
 
 // ------------------------------ ArgumentListNode -----------------------------
 
-ArgumentListNode::~ArgumentListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArgumentListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_expr);
-}
-
 RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr.get());
-}
-
-// ------------------------------ ArgumentsNode -----------------------------
-
-ArgumentsNode::~ArgumentsNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArgumentsNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_listNode);
+    return generator.emitNode(dst, m_expr);
 }
 
 // ------------------------------ NewExprNode ----------------------------------
 
-NewExprNode::~NewExprNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void NewExprNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_args);
-}
-
 RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> func = generator.emitNode(m_expr.get());
-    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args.get(), divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ EvalFunctionCallNode ----------------------------------
 
-EvalFunctionCallNode::~EvalFunctionCallNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void EvalFunctionCallNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_args);
-}
-
 RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> func = generator.tempDestination(dst);
     RefPtr<RegisterID> thisRegister = generator.newTemporary();
     generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
     generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
-    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallValueNode ----------------------------------
 
-FunctionCallValueNode::~FunctionCallValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> func = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
     RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallResolveNode ----------------------------------
 
-FunctionCallResolveNode::~FunctionCallResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
     }
 
     int index = 0;
@@ -637,61 +348,142 @@ RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator,
     if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
         RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
     }
 
-    RefPtr<RegisterID> func = generator.tempDestination(dst);
+    RefPtr<RegisterID> func = generator.newTemporary();
     RefPtr<RegisterID> thisRegister = generator.newTemporary();
     int identifierStart = divot() - startOffset();
     generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
     generator.emitResolveFunction(thisRegister.get(), func.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallBracketNode ----------------------------------
 
-FunctionCallBracketNode::~FunctionCallBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RegisterID* property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RegisterID* property = generator.emitNode(m_subscript);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
     RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallDotNode ----------------------------------
 
-FunctionCallDotNode::~FunctionCallDotNode()
+RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    NodeReleaser::releaseAllNodes(this);
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    generator.emitMethodCheck();
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
-void FunctionCallDotNode::releaseNodes(NodeReleaser& releaser)
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    {
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.newTemporary();
+        ArgumentListNode* oldList = m_args->m_listNode;
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            m_args->m_listNode = m_args->m_listNode->m_next;
+        } else
+            generator.emitLoad(thisRegister.get(), jsNull());
+
+        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+        generator.emitJump(end.get());
+        m_args->m_listNode = oldList;
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+    
+static bool areTrivialApplyArguments(ArgumentsNode* args)
 {
-    releaser.release(m_base);
-    releaser.release(m_args);
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
 }
 
-RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    {
+        if (mayBeCall) {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                if (m_args->m_listNode) {
+                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
+                    ASSERT(!m_args->m_listNode->m_next);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
+                }
+            } else
+                generator.emitLoad(thisRegister.get(), jsNull());
+            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+            m_args->m_listNode = oldList;
+        } else {
+            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            RefPtr<RegisterID> argsRegister = generator.newTemporary();
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            ArgumentListNode* args = m_args->m_listNode->m_next;
+            bool isArgumentsApply = false;
+            if (args->m_expr->isResolveNode()) {
+                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
+                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
+                if (isArgumentsApply)
+                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
+            }
+            if (!isArgumentsApply)
+                generator.emitNode(argsRegister.get(), args->m_expr);
+            while ((args = args->m_next))
+                generator.emitNode(args->m_expr);
+
+            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
+            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
+        }
+        generator.emitJump(end.get());
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
 }
 
 // ------------------------------ PostfixResolveNode ----------------------------------
@@ -752,21 +544,10 @@ RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, Regis
 
 // ------------------------------ PostfixBracketNode ----------------------------------
 
-PostfixBracketNode::~PostfixBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
@@ -787,19 +568,9 @@ RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, Regis
 
 // ------------------------------ PostfixDotNode ----------------------------------
 
-PostfixDotNode::~PostfixDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
@@ -820,16 +591,6 @@ RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterI
 
 // ------------------------------ PostfixErrorNode -----------------------------------
 
-PostfixErrorNode::~PostfixErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Postfix ++ operator applied to value that is not a reference." : "Postfix -- operator applied to value that is not a reference.");
@@ -849,21 +610,10 @@ RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ DeleteBracketNode -----------------------------------
 
-DeleteBracketNode::~DeleteBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> r0 = generator.emitNode(m_base.get());
-    RegisterID* r1 = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RegisterID* r1 = generator.emitNode(m_subscript);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
@@ -871,19 +621,9 @@ RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ DeleteDotNode -----------------------------------
 
-DeleteDotNode::~DeleteDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* r0 = generator.emitNode(m_base.get());
+    RegisterID* r0 = generator.emitNode(m_base);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
@@ -891,19 +631,9 @@ RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ DeleteValueNode -----------------------------------
 
-DeleteValueNode::~DeleteValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr.get());
+    generator.emitNode(generator.ignoredResult(), m_expr);
 
     // delete on a non-location expression ignores the value and returns true
     return generator.emitUnexpectedLoad(generator.finalDestination(dst), true);
@@ -911,23 +641,13 @@ RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ VoidNode -------------------------------------
 
-VoidNode::~VoidNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void VoidNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_expr);
         return 0;
     }
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
     return generator.emitLoad(dst, jsUndefined());
 }
 
@@ -950,23 +670,13 @@ RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ TypeOfValueNode -----------------------------------
 
-TypeOfValueNode::~TypeOfValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void TypeOfValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_expr);
         return 0;
     }
-    RefPtr<RegisterID> src = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
     return generator.emitTypeOf(generator.finalDestination(dst), src.get());
 }
 
@@ -1006,21 +716,10 @@ RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ PrefixBracketNode ----------------------------------
 
-PrefixBracketNode::~PrefixBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
@@ -1036,19 +735,9 @@ RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ PrefixDotNode ----------------------------------
 
-PrefixDotNode::~PrefixDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
@@ -1064,16 +753,6 @@ RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ PrefixErrorNode -----------------------------------
 
-PrefixErrorNode::~PrefixErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Prefix ++ operator applied to value that is not a reference." : "Prefix -- operator applied to value that is not a reference.");
@@ -1081,48 +760,149 @@ RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ Unary Operation Nodes -----------------------------------
 
-UnaryOpNode::~UnaryOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void UnaryOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* src = generator.emitNode(m_expr.get());
+    RegisterID* src = generator.emitNode(m_expr);
     return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
 }
 
 // ------------------------------ Binary Operation Nodes -----------------------------------
 
-BinaryOpNode::~BinaryOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
+{
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
+
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
 
-void BinaryOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
 }
 
 RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
+        return emitStrcat(generator, dst);
+
     if (opcodeID == op_neq) {
         if (m_expr1->isNull() || m_expr2->isNull()) {
             RefPtr<RegisterID> src = generator.tempDestination(dst);
-            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2.get() : m_expr1.get());
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
             return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
         }
     }
 
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 }
 
@@ -1130,41 +910,41 @@ RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 {
     if (m_expr1->isNull() || m_expr2->isNull()) {
         RefPtr<RegisterID> src = generator.tempDestination(dst);
-        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2.get() : m_expr1.get());
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
         return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
     }
 
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 }
 
 RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 }
 
 RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
 }
 
 RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 }
 
 RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitGetByIdExceptionInfo(op_instanceof);
@@ -1176,28 +956,17 @@ RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterI
 
 // ------------------------------ LogicalOpNode ----------------------------
 
-LogicalOpNode::~LogicalOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void LogicalOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> temp = generator.tempDestination(dst);
     RefPtr<Label> target = generator.newLabel();
     
-    generator.emitNode(temp.get(), m_expr1.get());
+    generator.emitNode(temp.get(), m_expr1);
     if (m_operator == OpLogicalAnd)
         generator.emitJumpIfFalse(temp.get(), target.get());
     else
         generator.emitJumpIfTrue(temp.get(), target.get());
-    generator.emitNode(temp.get(), m_expr2.get());
+    generator.emitNode(temp.get(), m_expr2);
     generator.emitLabel(target.get());
 
     return generator.moveToDestinationIfNeeded(dst, temp.get());
@@ -1205,32 +974,20 @@ RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ ConditionalNode ------------------------------
 
-ConditionalNode::~ConditionalNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConditionalNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_logical);
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> newDst = generator.finalDestination(dst);
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_logical.get());
+    RegisterID* cond = generator.emitNode(m_logical);
     generator.emitJumpIfFalse(cond, beforeElse.get());
 
-    generator.emitNode(newDst.get(), m_expr1.get());
+    generator.emitNode(newDst.get(), m_expr1);
     generator.emitJump(afterElse.get());
 
     generator.emitLabel(beforeElse.get());
-    generator.emitNode(newDst.get(), m_expr2.get());
+    generator.emitNode(newDst.get(), m_expr2);
 
     generator.emitLabel(afterElse.get());
 
@@ -1239,18 +996,8 @@ RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ ReadModifyResolveNode -----------------------------------
 
-ReadModifyResolveNode::~ReadModifyResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_right);
-}
-
 // FIXME: should this be moved to be a method on BytecodeGenerator?
-static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, RegisterID* src2, Operator oper, OperandTypes types)
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
 {
     OpcodeID opcodeID;
     switch (oper) {
@@ -1261,6 +1008,8 @@ static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& gen
             opcodeID = op_div;
             break;
         case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
             opcodeID = op_add;
             break;
         case OpMinusEq:
@@ -1291,7 +1040,14 @@ static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& gen
             ASSERT_NOT_REACHED();
             return dst;
     }
-    
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
     return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
 }
 
@@ -1299,21 +1055,18 @@ RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, Re
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident)) {
-            RegisterID* src2 = generator.emitNode(m_right.get());
-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         }
         
         if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
             RefPtr<RegisterID> result = generator.newTemporary();
             generator.emitMove(result.get(), local);
-            RegisterID* src2 = generator.emitNode(m_right.get());
-            emitReadModifyAssignment(generator, result.get(), result.get(), src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
             generator.emitMove(local, result.get());
             return generator.moveToDestinationIfNeeded(dst, result.get());
         }
         
-        RegisterID* src2 = generator.emitNode(m_right.get());
-        RegisterID* result = emitReadModifyAssignment(generator, local, local, src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         return generator.moveToDestinationIfNeeded(dst, result);
     }
 
@@ -1322,8 +1075,7 @@ RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, Re
     JSObject* globalObject = 0;
     if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
         RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        RegisterID* src2 = generator.emitNode(m_right.get());
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         generator.emitPutScopedVar(depth, index, result, globalObject);
         return result;
     }
@@ -1331,31 +1083,19 @@ RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, Re
     RefPtr<RegisterID> src1 = generator.tempDestination(dst);
     generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
-    RegisterID* src2 = generator.emitNode(m_right.get());
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
     return generator.emitPutById(base.get(), m_ident, result);
 }
 
 // ------------------------------ AssignResolveNode -----------------------------------
 
-AssignResolveNode::~AssignResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_right);
-}
-
 RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident))
-            return generator.emitNode(dst, m_right.get());
+            return generator.emitNode(dst, m_right);
         
-        RegisterID* result = generator.emitNode(local, m_right.get());
+        RegisterID* result = generator.emitNode(local, m_right);
         return generator.moveToDestinationIfNeeded(dst, result);
     }
 
@@ -1365,7 +1105,7 @@ RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
     if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
         if (dst == generator.ignoredResult())
             dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right.get());
+        RegisterID* value = generator.emitNode(dst, m_right);
         generator.emitPutScopedVar(depth, index, value, globalObject);
         return value;
     }
@@ -1373,29 +1113,18 @@ RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
     if (dst == generator.ignoredResult())
         dst = 0;
-    RegisterID* value = generator.emitNode(dst, m_right.get());
+    RegisterID* value = generator.emitNode(dst, m_right);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitPutById(base.get(), m_ident, value);
 }
 
 // ------------------------------ AssignDotNode -----------------------------------
 
-AssignDotNode::~AssignDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right.get());
+    RegisterID* result = generator.emitNode(value.get(), m_right);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutById(base.get(), m_ident, result);
     return generator.moveToDestinationIfNeeded(dst, result);
@@ -1403,25 +1132,13 @@ RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ ReadModifyDotNode -----------------------------------
 
-ReadModifyDotNode::~ReadModifyDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_right);
-}
-
 RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RegisterID* change = generator.emitNode(m_right.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), change, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitPutById(base.get(), m_ident, updatedValue);
@@ -1429,17 +1146,6 @@ RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ AssignErrorNode -----------------------------------
 
-AssignErrorNode::~AssignErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_left);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
@@ -1447,24 +1153,12 @@ RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ AssignBracketNode -----------------------------------
 
-AssignBracketNode::~AssignBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right.get());
+    RegisterID* result = generator.emitNode(value.get(), m_right);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), result);
@@ -1473,27 +1167,14 @@ RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ ReadModifyBracketNode -----------------------------------
 
-ReadModifyBracketNode::~ReadModifyBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_right);
-}
-
 RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
-    RegisterID* change = generator.emitNode(m_right.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), change, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), updatedValue);
@@ -1503,63 +1184,34 @@ RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, Re
 
 // ------------------------------ CommaNode ------------------------------------
 
-CommaNode::~CommaNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CommaNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr1.get());
-    return generator.emitNode(dst, m_expr2.get());
+    generator.emitNode(generator.ignoredResult(), m_expr1);
+    return generator.emitNode(dst, m_expr2);
 }
 
 // ------------------------------ ConstDeclNode ------------------------------------
 
-ConstDeclNode::~ConstDeclNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConstDeclNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_init);
-}
-
-ConstDeclNode::ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* init)
-    : ExpressionNode(globalData)
-    , m_ident(ident)
-    , m_init(init)
-{
-}
-
 RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
 {
     if (RegisterID* local = generator.constRegisterFor(m_ident)) {
         if (!m_init)
             return local;
 
-        return generator.emitNode(local, m_init.get());
+        return generator.emitNode(local, m_init);
     }
     
     // FIXME: While this code should only be hit in eval code, it will potentially
     // assign to the wrong base if m_ident exists in an intervening dynamic scope.
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    RegisterID* value = m_init ? generator.emitNode(m_init.get()) : generator.emitLoad(0, jsUndefined());
+    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
     return generator.emitPutById(base.get(), m_ident, value);
 }
 
 RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     RegisterID* result = 0;
-    for (ConstDeclNode* n = this; n; n = n->m_next.get())
+    for (ConstDeclNode* n = this; n; n = n->m_next)
         result = n->emitCodeSingle(generator);
 
     return result;
@@ -1567,65 +1219,34 @@ RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ ConstStatementNode -----------------------------
 
-ConstStatementNode::~ConstStatementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConstStatementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-}
-
 RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    return generator.emitNode(m_next.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_next);
 }
 
 // ------------------------------ Helper functions for handling Vectors of StatementNode -------------------------------
 
-static inline RegisterID* statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
-{
-    StatementVector::const_iterator end = statements.end();
-    for (StatementVector::const_iterator it = statements.begin(); it != end; ++it) {
-        StatementNode* n = it->get();
-        if (!n->isLoop())
-            generator.emitDebugHook(WillExecuteStatement, n->firstLine(), n->lastLine());
-        generator.emitNode(dst, n);
-    }
-    return 0;
-}
-
-// ------------------------------ BlockNode ------------------------------------
-
-BlockNode::~BlockNode()
+static inline void statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
 {
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void BlockNode::releaseNodes(NodeReleaser& releaser)
-{
-    size_t size = m_children.size();
+    size_t size = statements.size();
     for (size_t i = 0; i < size; ++i)
-        releaser.release(m_children[i]);
+        generator.emitNode(dst, statements[i]);
 }
 
-BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
-    : StatementNode(globalData)
-{
-    if (children)
-        children->releaseContentsIntoVector(m_children);
-}
+// ------------------------------ BlockNode ------------------------------------
 
 RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    return statementListEmitCode(m_children, generator, dst);
+    statementListEmitCode(m_children, generator, dst);
+    return 0;
 }
 
 // ------------------------------ EmptyStatementNode ---------------------------
 
-RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator&, RegisterID* dst)
+RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     return dst;
 }
 
@@ -1642,51 +1263,31 @@ RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, Re
 RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
+    return generator.emitNode(dst, m_expr);
 }
 
 // ------------------------------ VarStatementNode ----------------------------
 
-VarStatementNode::~VarStatementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void VarStatementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     ASSERT(m_expr);
-    return generator.emitNode(m_expr.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_expr);
 }
 
 // ------------------------------ IfNode ---------------------------------------
 
-IfNode::~IfNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void IfNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_condition);
-    releaser.release(m_ifBlock);
-}
-
 RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<Label> afterThen = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_condition.get());
+    RegisterID* cond = generator.emitNode(m_condition);
     generator.emitJumpIfFalse(cond, afterThen.get());
 
-    if (!m_ifBlock->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_ifBlock->firstLine(), m_ifBlock->lastLine());
-
-    generator.emitNode(dst, m_ifBlock.get());
+    generator.emitNode(dst, m_ifBlock);
     generator.emitLabel(afterThen.get());
 
     // FIXME: This should return the last statement executed so that it can be returned as a Completion.
@@ -1695,37 +1296,22 @@ RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 // ------------------------------ IfElseNode ---------------------------------------
 
-IfElseNode::~IfElseNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void IfElseNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_elseBlock);
-    IfNode::releaseNodes(releaser);
-}
-
 RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_condition.get());
+    RegisterID* cond = generator.emitNode(m_condition);
     generator.emitJumpIfFalse(cond, beforeElse.get());
 
-    if (!m_ifBlock->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_ifBlock->firstLine(), m_ifBlock->lastLine());
-
-    generator.emitNode(dst, m_ifBlock.get());
+    generator.emitNode(dst, m_ifBlock);
     generator.emitJump(afterElse.get());
 
     generator.emitLabel(beforeElse.get());
 
-    if (!m_elseBlock->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_elseBlock->firstLine(), m_elseBlock->lastLine());
-
-    generator.emitNode(dst, m_elseBlock.get());
+    generator.emitNode(dst, m_elseBlock);
 
     generator.emitLabel(afterElse.get());
 
@@ -1735,17 +1321,6 @@ RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 // ------------------------------ DoWhileNode ----------------------------------
 
-DoWhileNode::~DoWhileNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DoWhileNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_statement);
-    releaser.release(m_expr);
-}
-
 RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1754,15 +1329,12 @@ RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     generator.emitLabel(topOfLoop.get());
 
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
-        
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement.get());
+   
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr.get());
+    RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
     generator.emitLabel(scope->breakTarget());
@@ -1771,17 +1343,6 @@ RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 
 // ------------------------------ WhileNode ------------------------------------
 
-WhileNode::~WhileNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void WhileNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
 RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1790,15 +1351,12 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
-
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
- 
-    generator.emitNode(dst, m_statement.get());
+    
+    generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr.get());
+    RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
     generator.emitLabel(scope->breakTarget());
@@ -1809,19 +1367,6 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 // ------------------------------ ForNode --------------------------------------
 
-ForNode::~ForNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ForNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-    releaser.release(m_expr3);
-    releaser.release(m_statement);
-}
-
 RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult())
@@ -1832,7 +1377,7 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_expr1)
-        generator.emitNode(generator.ignoredResult(), m_expr1.get());
+        generator.emitNode(generator.ignoredResult(), m_expr1);
 
     RefPtr<Label> condition = generator.newLabel();
     generator.emitJump(condition.get());
@@ -1840,17 +1385,16 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
 
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement.get());
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     if (m_expr3)
-        generator.emitNode(generator.ignoredResult(), m_expr3.get());
+        generator.emitNode(generator.ignoredResult(), m_expr3);
 
     generator.emitLabel(condition.get());
     if (m_expr2) {
-        RegisterID* cond = generator.emitNode(m_expr2.get());
+        RegisterID* cond = generator.emitNode(m_expr2);
         generator.emitJumpIfTrue(cond, topOfLoop.get());
     } else
         generator.emitJump(topOfLoop.get());
@@ -1861,45 +1405,6 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 // ------------------------------ ForInNode ------------------------------------
 
-ForInNode::~ForInNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ForInNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_init);
-    releaser.release(m_lexpr);
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
-ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
-    : StatementNode(globalData)
-    , m_init(0L)
-    , m_lexpr(l)
-    , m_expr(expr)
-    , m_statement(statement)
-    , m_identIsVarDecl(false)
-{
-}
-
-ForInNode::ForInNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
-    : StatementNode(globalData)
-    , m_ident(ident)
-    , m_lexpr(new ResolveNode(globalData, ident, divot - startOffset))
-    , m_expr(expr)
-    , m_statement(statement)
-    , m_identIsVarDecl(true)
-{
-    if (in) {
-        AssignResolveNode* node = new AssignResolveNode(globalData, ident, in, true);
-        node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
-        m_init = node;
-    }
-    // for( var foo = bar in baz )
-}
-
 RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1912,8 +1417,8 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_init)
-        generator.emitNode(generator.ignoredResult(), m_init.get());
-    RegisterID* forInBase = generator.emitNode(m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_init);
+    RegisterID* forInBase = generator.emitNode(m_expr);
     RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
     generator.emitJump(scope->continueTarget());
 
@@ -1922,7 +1427,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     RegisterID* propertyName;
     if (m_lexpr->isResolveNode()) {
-        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr.get())->identifier();
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
         propertyName = generator.registerFor(ident);
         if (!propertyName) {
             propertyName = generator.newTemporary();
@@ -1933,7 +1438,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
             generator.emitPutById(base, ident, propertyName);
         }
     } else if (m_lexpr->isDotAccessorNode()) {
-        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr.get());
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
         const Identifier& ident = assignNode->identifier();
         propertyName = generator.newTemporary();
         RefPtr<RegisterID> protect = propertyName;
@@ -1943,7 +1448,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
         generator.emitPutById(base, ident, propertyName);
     } else {
         ASSERT(m_lexpr->isBracketAccessorNode());
-        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr.get());
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
         propertyName = generator.newTemporary();
         RefPtr<RegisterID> protect = propertyName;
         RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
@@ -1953,12 +1458,11 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
         generator.emitPutByVal(base.get(), subscript, propertyName);
     }   
 
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
-    generator.emitNode(dst, m_statement.get());
+    generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitNextPropertyName(propertyName, iter.get(), loopStart.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     generator.emitLabel(scope->breakTarget());
     return dst;
 }
@@ -1968,6 +1472,8 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 // ECMA 12.7
 RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     LabelScope* scope = generator.continueTarget(m_ident);
 
     if (!scope)
@@ -1984,6 +1490,8 @@ RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 // ECMA 12.8
 RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     LabelScope* scope = generator.breakTarget(m_ident);
     
     if (!scope)
@@ -1997,26 +1505,22 @@ RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 // ------------------------------ ReturnNode -----------------------------------
 
-ReturnNode::~ReturnNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReturnNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_value);
-}
-
 RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     if (generator.codeType() != FunctionCode)
         return emitThrowError(generator, SyntaxError, "Invalid return statement.");
 
     if (dst == generator.ignoredResult())
         dst = 0;
-    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value.get()) : generator.emitLoad(dst, jsUndefined());
+    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
+    RefPtr<RegisterID> returnRegister;
     if (generator.scopeDepth()) {
         RefPtr<Label> l0 = generator.newLabel();
+        if (generator.hasFinaliser() && !r0->isTemporary()) {
+            returnRegister = generator.emitMove(generator.newTemporary(), r0);
+            r0 = returnRegister.get();
+        }
         generator.emitJumpScopes(l0.get(), 0);
         generator.emitLabel(l0.get());
     }
@@ -2026,67 +1530,21 @@ RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 // ------------------------------ WithNode -------------------------------------
 
-WithNode::~WithNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void WithNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
 RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr.get()); // scope must be protected until popped
+    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
     generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
     generator.emitPushScope(scope.get());
-    RegisterID* result = generator.emitNode(dst, m_statement.get());
+    RegisterID* result = generator.emitNode(dst, m_statement);
     generator.emitPopScope();
     return result;
 }
 
-// ------------------------------ CaseClauseNode --------------------------------
-
-CaseClauseNode::~CaseClauseNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CaseClauseNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
-// ------------------------------ ClauseListNode --------------------------------
-
-ClauseListNode::~ClauseListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ClauseListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_clause);
-    releaser.release(m_next);
-}
-
 // ------------------------------ CaseBlockNode --------------------------------
 
-CaseBlockNode::~CaseBlockNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CaseBlockNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_list1);
-    releaser.release(m_defaultClause);
-    releaser.release(m_list2);
-}
-
 enum SwitchKind { 
     SwitchUnset = 0,
     SwitchNumber = 1, 
@@ -2101,7 +1559,8 @@ static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>&
         literalVector.append(clauseExpression);
         if (clauseExpression->isNumber()) {
             double value = static_cast<NumberNode*>(clauseExpression)->value();
-            if ((typeForTable & ~SwitchNumber) || !JSImmediate::from(value)) {
+            JSValue jsValue = JSValue::makeInt32Fast(static_cast<int32_t>(value));
+            if ((typeForTable & ~SwitchNumber) || !jsValue || (jsValue.getInt32Fast() != value)) {
                 typeForTable = SwitchNeither;
                 break;
             }
@@ -2140,8 +1599,8 @@ SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*,
     SwitchKind typeForTable = SwitchUnset;
     bool singleCharacterSwitch = true;
     
-    processClauseList(m_list1.get(), literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    processClauseList(m_list2.get(), literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
     
     if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
         return SwitchInfo::SwitchNone;
@@ -2181,7 +1640,7 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
         generator.beginSwitch(switchExpression, switchType);
     } else {
         // Setup jumps
-        for (ClauseListNode* list = m_list1.get(); list; list = list->getNext()) {
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
             RefPtr<RegisterID> clauseVal = generator.newTemporary();
             generator.emitNode(clauseVal.get(), list->getClause()->expr());
             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
@@ -2189,7 +1648,7 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
             generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
         }
         
-        for (ClauseListNode* list = m_list2.get(); list; list = list->getNext()) {
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
             RefPtr<RegisterID> clauseVal = generator.newTemporary();
             generator.emitNode(clauseVal.get(), list->getClause()->expr());
             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
@@ -2203,19 +1662,19 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
     RegisterID* result = 0;
 
     size_t i = 0;
-    for (ClauseListNode* list = m_list1.get(); list; list = list->getNext()) {
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        result = statementListEmitCode(list->getClause()->children(), generator, dst);
+        statementListEmitCode(list->getClause()->children(), generator, dst);
     }
 
     if (m_defaultClause) {
         generator.emitLabel(defaultLabel.get());
-        result = statementListEmitCode(m_defaultClause->children(), generator, dst);
+        statementListEmitCode(m_defaultClause->children(), generator, dst);
     }
 
-    for (ClauseListNode* list = m_list2.get(); list; list = list->getNext()) {
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        result = statementListEmitCode(list->getClause()->children(), generator, dst);
+        statementListEmitCode(list->getClause()->children(), generator, dst);
     }
     if (!m_defaultClause)
         generator.emitLabel(defaultLabel.get());
@@ -2230,22 +1689,13 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
 
 // ------------------------------ SwitchNode -----------------------------------
 
-SwitchNode::~SwitchNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void SwitchNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_block);
-}
-
 RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
 
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
     RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
 
     generator.emitLabel(scope->breakTarget());
@@ -2254,23 +1704,15 @@ RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 // ------------------------------ LabelNode ------------------------------------
 
-LabelNode::~LabelNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void LabelNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_statement);
-}
-
 RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
     if (generator.breakTarget(m_name))
         return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
 
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
-    RegisterID* r0 = generator.emitNode(dst, m_statement.get());
+    RegisterID* r0 = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->breakTarget());
     return r0;
@@ -2278,42 +1720,24 @@ RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 // ------------------------------ ThrowNode ------------------------------------
 
-ThrowNode::~ThrowNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ThrowNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
     if (dst == generator.ignoredResult())
         dst = 0;
-    RefPtr<RegisterID> expr = generator.emitNode(dst, m_expr.get());
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitThrow(expr.get());
-    return dst;
+    return 0;
 }
 
 // ------------------------------ TryNode --------------------------------------
 
-TryNode::~TryNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void TryNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_tryBlock);
-    releaser.release(m_catchBlock);
-    releaser.release(m_finallyBlock);
-}
-
 RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
     RefPtr<Label> tryStartLabel = generator.newLabel();
     RefPtr<Label> tryEndLabel = generator.newLabel();
     RefPtr<Label> finallyStart;
@@ -2324,7 +1748,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
         generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
     }
     generator.emitLabel(tryStartLabel.get());
-    generator.emitNode(dst, m_tryBlock.get());
+    generator.emitNode(dst, m_tryBlock);
     generator.emitLabel(tryEndLabel.get());
 
     if (m_catchBlock) {
@@ -2338,7 +1762,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
             generator.emitPushScope(exceptionRegister.get());
         } else
             generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
-        generator.emitNode(dst, m_catchBlock.get());
+        generator.emitNode(dst, m_catchBlock);
         generator.emitPopScope();
         generator.emitLabel(handlerEndLabel.get());
     }
@@ -2367,7 +1791,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
         // emit the finally block itself
         generator.emitLabel(finallyStart.get());
-        generator.emitNode(dst, m_finallyBlock.get());
+        generator.emitNode(dst, m_finallyBlock);
         generator.emitSubroutineReturn(finallyReturnAddr.get());
 
         generator.emitLabel(finallyEndLabel.get());
@@ -2376,77 +1800,73 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     return dst;
 }
 
-// ------------------------------ ParameterNode -----------------------------
-
-ParameterNode::~ParameterNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ParameterNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-}
-
 // -----------------------------ScopeNodeData ---------------------------
 
-ScopeNodeData::ScopeNodeData(SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
+ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
     : m_numConstants(numConstants)
 {
+    m_arena.swap(arena);
     if (varStack)
-        m_varStack = *varStack;
+        m_varStack.swap(*varStack);
     if (funcStack)
-        m_functionStack = *funcStack;
+        m_functionStack.swap(*funcStack);
     if (children)
         children->releaseContentsIntoVector(m_children);
 }
 
+void ScopeNodeData::mark()
+{
+    FunctionStack::iterator end = m_functionStack.end();
+    for (FunctionStack::iterator ptr = m_functionStack.begin(); ptr != end; ++ptr) {
+        FunctionBodyNode* body = (*ptr)->body();
+        if (!body->isGenerated())
+            continue;
+        body->generatedBytecode().mark();
+    }
+}
+
 // ------------------------------ ScopeNode -----------------------------
 
 ScopeNode::ScopeNode(JSGlobalData* globalData)
     : StatementNode(globalData)
+    , ParserArenaRefCounted(globalData)
     , m_features(NoFeatures)
 {
-#if ENABLE(OPCODE_SAMPLING)
-    globalData->interpreter->sampler()->notifyOfScope(this);
+#if ENABLE(CODEBLOCK_SAMPLING)
+    if (SamplingTool* sampler = globalData->interpreter->sampler())
+        sampler->notifyOfScope(this);
 #endif
 }
 
 ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, CodeFeatures features, int numConstants)
     : StatementNode(globalData)
-    , m_data(new ScopeNodeData(children, varStack, funcStack, numConstants))
+    , ParserArenaRefCounted(globalData)
+    , m_data(new ScopeNodeData(globalData->parser->arena(), children, varStack, funcStack, numConstants))
     , m_features(features)
     , m_source(source)
 {
-#if ENABLE(OPCODE_SAMPLING)
-    globalData->interpreter->sampler()->notifyOfScope(this);
+#if ENABLE(CODEBLOCK_SAMPLING)
+    if (SamplingTool* sampler = globalData->interpreter->sampler())
+        sampler->notifyOfScope(this);
 #endif
 }
 
-ScopeNode::~ScopeNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ScopeNode::releaseNodes(NodeReleaser& releaser)
-{
-    if (!m_data)
-        return;
-    size_t size = m_data->m_children.size();
-    for (size_t i = 0; i < size; ++i)
-        releaser.release(m_data->m_children[i]);
-}
-
 // ------------------------------ ProgramNode -----------------------------
 
-ProgramNode::ProgramNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+inline ProgramNode::ProgramNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, source, children, varStack, funcStack, features, numConstants)
 {
 }
 
-ProgramNode* ProgramNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    return new ProgramNode(globalData, children, varStack, funcStack, source, features, numConstants);
+    RefPtr<ProgramNode> node = new ProgramNode(globalData, children, varStack, funcStack, source, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
@@ -2475,16 +1895,33 @@ void ProgramNode::generateBytecode(ScopeChainNode* scopeChainNode)
     destroyData();
 }
 
+#if ENABLE(JIT)
+void ProgramNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
 // ------------------------------ EvalNode -----------------------------
 
-EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, source, children, varStack, funcStack, features, numConstants)
 {
 }
 
-EvalNode* EvalNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    return new EvalNode(globalData, children, varStack, funcStack, source, features, numConstants);
+    RefPtr<EvalNode> node = new EvalNode(globalData, children, varStack, funcStack, source, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
@@ -2505,7 +1942,7 @@ void EvalNode::generateBytecode(ScopeChainNode* scopeChainNode)
     ScopeChain scopeChain(scopeChainNode);
     JSGlobalObject* globalObject = scopeChain.globalObject();
 
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider()));
+    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
 
     BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get());
     generator.generate();
@@ -2515,43 +1952,57 @@ void EvalNode::generateBytecode(ScopeChainNode* scopeChainNode)
     children().clear();
 }
 
-EvalCodeBlock& EvalNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode)
+EvalCodeBlock& EvalNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
 {
     ASSERT(!m_code);
 
     ScopeChain scopeChain(scopeChainNode);
     JSGlobalObject* globalObject = scopeChain.globalObject();
 
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider()));
+    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
 
     BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get());
-    generator.setRegeneratingForExceptionInfo();
+    generator.setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
     generator.generate();
 
     return *m_code;
 }
 
+void EvalNode::mark()
+{
+    // We don't need to mark our own CodeBlock as the JSGlobalObject takes care of that
+    data()->mark();
+}
+
+#if ENABLE(JIT)
+void EvalNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
 // ------------------------------ FunctionBodyNode -----------------------------
 
-FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
     : ScopeNode(globalData)
     , m_parameters(0)
     , m_parameterCount(0)
-    , m_refCount(0)
 {
 }
 
-FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, sourceCode, children, varStack, funcStack, features, numConstants)
     , m_parameters(0)
     , m_parameterCount(0)
-    , m_refCount(0)
 {
 }
 
 FunctionBodyNode::~FunctionBodyNode()
 {
-    ASSERT(!m_refCount);
     for (size_t i = 0; i < m_parameterCount; ++i)
         m_parameters[i].~Identifier();
     fastFree(m_parameters);
@@ -2581,14 +2032,30 @@ void FunctionBodyNode::mark()
         m_code->mark();
 }
 
+#if ENABLE(JIT)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::createNativeThunk(JSGlobalData* globalData)
+{
+    RefPtr<FunctionBodyNode> body = new FunctionBodyNode(globalData);
+    globalData->parser->arena().reset();
+    body->m_jitCode = JITCode(JITCode::HostFunction(globalData->jitStubs.ctiNativeCallThunk()));
+    return body.release();
+}
+#endif
+
 FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData)
 {
     return new FunctionBodyNode(globalData);
 }
 
-FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
 {
-    return new FunctionBodyNode(globalData, children, varStack, funcStack, sourceCode, features, numConstants);
+    RefPtr<FunctionBodyNode> node = new FunctionBodyNode(globalData, children, varStack, funcStack, sourceCode, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 void FunctionBodyNode::generateBytecode(ScopeChainNode* scopeChainNode)
@@ -2610,7 +2077,18 @@ void FunctionBodyNode::generateBytecode(ScopeChainNode* scopeChainNode)
     destroyData();
 }
 
-CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode)
+#if ENABLE(JIT)
+void FunctionBodyNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
+CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
 {
     ASSERT(!m_code);
 
@@ -2620,7 +2098,7 @@ CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* sco
     m_code.set(new CodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
 
     BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get());
-    generator.setRegeneratingForExceptionInfo();
+    generator.setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
     generator.generate();
 
     return *m_code;
@@ -2630,11 +2108,15 @@ RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, Registe
 {
     generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
     statementListEmitCode(children(), generator, generator.ignoredResult());
-    if (!children().size() || !children().last()->isReturnNode()) {
-        RegisterID* r0 = generator.emitLoad(0, jsUndefined());
-        generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-        generator.emitReturn(r0);
+    if (children().size() && children().last()->isBlock()) {
+        BlockNode* blockNode = static_cast<BlockNode*>(children().last());
+        if (blockNode->children().size() && blockNode->children().last()->isReturnNode())
+            return 0;
     }
+
+    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    generator.emitReturn(r0);
     return 0;
 }
 
@@ -2659,17 +2141,6 @@ Identifier* FunctionBodyNode::copyParameters()
 
 // ------------------------------ FuncDeclNode ---------------------------------
 
-FuncDeclNode::~FuncDeclNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FuncDeclNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_parameter);
-    releaser.release(m_body);
-}
-
 JSFunction* FuncDeclNode::makeFunction(ExecState* exec, ScopeChainNode* scopeChain)
 {
     return new (exec) JSFunction(exec, m_ident, m_body.get(), scopeChain);
@@ -2684,17 +2155,6 @@ RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 
 // ------------------------------ FuncExprNode ---------------------------------
 
-FuncExprNode::~FuncExprNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FuncExprNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_parameter);
-    releaser.release(m_body);
-}
-
 RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index 20885c37e8..cda1ee41c7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -23,34 +23,30 @@
  *
  */
 
-#ifndef NODES_H_
-#define NODES_H_
+#ifndef Nodes_h
+#define Nodes_h
 
 #include "Error.h"
+#include "JITCode.h"
 #include "Opcode.h"
+#include "ParserArena.h"
 #include "ResultType.h"
 #include "SourceCode.h"
 #include "SymbolTable.h"
 #include <wtf/MathExtras.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/Vector.h>
-
-#if PLATFORM(X86) && COMPILER(GCC)
-#define JSC_FAST_CALL __attribute__((regparm(3)))
-#else
-#define JSC_FAST_CALL
-#endif
 
 namespace JSC {
 
+    class ArgumentListNode;
     class CodeBlock;
     class BytecodeGenerator;
     class FuncDeclNode;
     class EvalCodeBlock;
     class JSFunction;
-    class NodeReleaser;
     class ProgramCodeBlock;
     class PropertyListNode;
+    class ReadModifyResolveNode;
     class RegisterID;
     class ScopeChainNode;
 
@@ -91,7 +87,7 @@ namespace JSC {
     namespace DeclarationStacks {
         enum VarAttrs { IsConstant = 1, HasInitializer = 2 };
         typedef Vector<std::pair<Identifier, unsigned> > VarStack;
-        typedef Vector<RefPtr<FuncDeclNode> > FunctionStack;
+        typedef Vector<FuncDeclNode*> FunctionStack;
     }
 
     struct SwitchInfo {
@@ -100,30 +96,37 @@ namespace JSC {
         SwitchType switchType;
     };
 
-    class ParserRefCounted : Noncopyable {
+    class ParserArenaDeletable {
     protected:
-        ParserRefCounted(JSGlobalData*) JSC_FAST_CALL;
+        ParserArenaDeletable() { }
 
     public:
-        virtual ~ParserRefCounted();
+        virtual ~ParserArenaDeletable() { }
 
-        // Nonrecursive destruction.
-        virtual void releaseNodes(NodeReleaser&);
+        // Objects created with this version of new are deleted when the arena is deleted.
+        void* operator new(size_t, JSGlobalData*);
 
-        void ref() JSC_FAST_CALL;
-        void deref() JSC_FAST_CALL;
-        bool hasOneRef() JSC_FAST_CALL;
+        // Objects created with this version of new are not deleted when the arena is deleted.
+        // Other arrangements must be made.
+        void* operator new(size_t);
+    };
 
-        static void deleteNewObjects(JSGlobalData*) JSC_FAST_CALL;
+    class ParserArenaRefCounted : public RefCounted<ParserArenaRefCounted> {
+    protected:
+        ParserArenaRefCounted(JSGlobalData*);
 
-    private:
-        JSGlobalData* m_globalData;
+    public:
+        virtual ~ParserArenaRefCounted()
+        {
+            ASSERT(deletionHasBegun());
+        }
     };
 
-    class Node : public ParserRefCounted {
-    public:
-        Node(JSGlobalData*) JSC_FAST_CALL;
+    class Node : public ParserArenaDeletable {
+    protected:
+        Node(JSGlobalData*);
 
+    public:
         /*
             Return value: The register holding the production's value.
                      dst: An optional parameter specifying the most efficient
@@ -146,7 +149,7 @@ namespace JSC {
             because the assignment node, "x =", passes r[x] as dst to the number
             node, "1".
         */
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) JSC_FAST_CALL = 0;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) = 0;
 
         int lineNo() const { return m_line; }
 
@@ -156,46 +159,44 @@ namespace JSC {
 
     class ExpressionNode : public Node {
     public:
-        ExpressionNode(JSGlobalData* globalData, ResultType resultDesc = ResultType::unknown()) JSC_FAST_CALL
-            : Node(globalData)
-            , m_resultDesc(resultDesc)
-        {
-        }
+        ExpressionNode(JSGlobalData*, ResultType = ResultType::unknownType());
 
-        virtual bool isNumber() const JSC_FAST_CALL { return false; }
-        virtual bool isString() const JSC_FAST_CALL { return false; }
-        virtual bool isNull() const JSC_FAST_CALL { return false; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return false; }        
-        virtual bool isLocation() const JSC_FAST_CALL { return false; }
-        virtual bool isResolveNode() const JSC_FAST_CALL { return false; }
-        virtual bool isBracketAccessorNode() const JSC_FAST_CALL { return false; }
-        virtual bool isDotAccessorNode() const JSC_FAST_CALL { return false; }
-        virtual bool isFuncExprNode() const JSC_FAST_CALL { return false; } 
+        virtual bool isNumber() const { return false; }
+        virtual bool isString() const { return false; }
+        virtual bool isNull() const { return false; }
+        virtual bool isPure(BytecodeGenerator&) const { return false; }        
+        virtual bool isLocation() const { return false; }
+        virtual bool isResolveNode() const { return false; }
+        virtual bool isBracketAccessorNode() const { return false; }
+        virtual bool isDotAccessorNode() const { return false; }
+        virtual bool isFuncExprNode() const { return false; } 
+        virtual bool isSimpleArray() const { return false; }
+        virtual bool isAdd() const { return false; }
 
         virtual ExpressionNode* stripUnaryPlus() { return this; }
 
-        ResultType resultDescriptor() const JSC_FAST_CALL { return m_resultDesc; }
+        ResultType resultDescriptor() const { return m_resultType; }
 
         // This needs to be in public in order to compile using GCC 3.x 
         typedef enum { EvalOperator, FunctionCall } CallerType;
 
     private:
-        ResultType m_resultDesc;
+        ResultType m_resultType;
     };
 
     class StatementNode : public Node {
     public:
-        StatementNode(JSGlobalData*) JSC_FAST_CALL;
-        void setLoc(int line0, int line1) JSC_FAST_CALL;
-        int firstLine() const JSC_FAST_CALL { return lineNo(); }
-        int lastLine() const JSC_FAST_CALL { return m_lastLine; }
+        StatementNode(JSGlobalData*);
 
-        virtual bool isEmptyStatement() const JSC_FAST_CALL { return false; }
-        virtual bool isReturnNode() const JSC_FAST_CALL { return false; }
-        virtual bool isExprStatement() const JSC_FAST_CALL { return false; }
+        void setLoc(int line0, int line1);
+        int firstLine() const { return lineNo(); }
+        int lastLine() const { return m_lastLine; }
 
-        virtual bool isBlock() const JSC_FAST_CALL { return false; }
-        virtual bool isLoop() const JSC_FAST_CALL { return false; }
+        virtual bool isEmptyStatement() const { return false; }
+        virtual bool isReturnNode() const { return false; }
+        virtual bool isExprStatement() const { return false; }
+
+        virtual bool isBlock() const { return false; }
 
     private:
         int m_lastLine;
@@ -203,66 +204,54 @@ namespace JSC {
 
     class NullNode : public ExpressionNode {
     public:
-        NullNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::nullType())
-        {
-        }
+        NullNode(JSGlobalData*);
 
-        virtual bool isNull() const JSC_FAST_CALL { return true; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual bool isNull() const { return true; }
     };
 
     class BooleanNode : public ExpressionNode {
     public:
-        BooleanNode(JSGlobalData* globalData, bool value) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::boolean())
-            , m_value(value)
-        {
-        }
+        BooleanNode(JSGlobalData*, bool value);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
 
-    private:
         bool m_value;
     };
 
     class NumberNode : public ExpressionNode {
     public:
-        NumberNode(JSGlobalData* globalData, double v) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::constNumber())
-            , m_double(v)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        NumberNode(JSGlobalData*, double v);
 
-        virtual bool isNumber() const JSC_FAST_CALL { return true; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
-        double value() const JSC_FAST_CALL { return m_double; }
-        void setValue(double d) JSC_FAST_CALL { m_double = d; }
+        double value() const { return m_double; }
+        void setValue(double d) { m_double = d; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isNumber() const { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
+
         double m_double;
     };
 
     class StringNode : public ExpressionNode {
     public:
-        StringNode(JSGlobalData* globalData, const Identifier& v) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::string())
-            , m_value(v)
-        {
-        }
+        StringNode(JSGlobalData*, const Identifier& v);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        
-        virtual bool isString() const JSC_FAST_CALL { return true; }
         const Identifier& value() { return m_value; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        
+        virtual bool isString() const { return true; }
+
         Identifier m_value;
     };
     
@@ -365,1158 +354,682 @@ namespace JSC {
 
     class RegExpNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_pattern(pattern)
-            , m_flags(flags)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        RegExpNode(JSGlobalData*, const UString& pattern, const UString& flags);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         UString m_pattern;
         UString m_flags;
     };
 
     class ThisNode : public ExpressionNode {
     public:
-        ThisNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-        {
-        }
+        ThisNode(JSGlobalData*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class ResolveNode : public ExpressionNode {
     public:
-        ResolveNode(JSGlobalData* globalData, const Identifier& ident, int startOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_startOffset(startOffset)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ResolveNode(JSGlobalData*, const Identifier&, int startOffset);
 
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL;
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isResolveNode() const JSC_FAST_CALL { return true; }
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        const Identifier& identifier() const { return m_ident; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isPure(BytecodeGenerator&) const ;
+        virtual bool isLocation() const { return true; }
+        virtual bool isResolveNode() const { return true; }
+
         Identifier m_ident;
         int32_t m_startOffset;
     };
 
-    class ElementNode : public ParserRefCounted {
+    class ElementNode : public ParserArenaDeletable {
     public:
-        ElementNode(JSGlobalData* globalData, int elision, ExpressionNode* node) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_elision(elision)
-            , m_node(node)
-        {
-        }
-
-        ElementNode(JSGlobalData* globalData, ElementNode* l, int elision, ExpressionNode* node) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_elision(elision)
-            , m_node(node)
-        {
-            l->m_next = this;
-        }
-
-        virtual ~ElementNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ElementNode(JSGlobalData*, int elision, ExpressionNode*);
+        ElementNode(JSGlobalData*, ElementNode*, int elision, ExpressionNode*);
 
         int elision() const { return m_elision; }
-        ExpressionNode* value() { return m_node.get(); }
-
-        ElementNode* next() { return m_next.get(); }
+        ExpressionNode* value() { return m_node; }
+        ElementNode* next() { return m_next; }
 
     private:
-        RefPtr<ElementNode> m_next;
+        ElementNode* m_next;
         int m_elision;
-        RefPtr<ExpressionNode> m_node;
+        ExpressionNode* m_node;
     };
 
     class ArrayNode : public ExpressionNode {
     public:
-        ArrayNode(JSGlobalData* globalData, int elision) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_elision(elision)
-            , m_optional(true)
-        {
-        }
+        ArrayNode(JSGlobalData*, int elision);
+        ArrayNode(JSGlobalData*, ElementNode*);
+        ArrayNode(JSGlobalData*, int elision, ElementNode*);
 
-        ArrayNode(JSGlobalData* globalData, ElementNode* element) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_element(element)
-            , m_elision(0)
-            , m_optional(false)
-        {
-        }
-
-        ArrayNode(JSGlobalData* globalData, int elision, ElementNode* element) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_element(element)
-            , m_elision(elision)
-            , m_optional(true)
-        {
-        }
+        ArgumentListNode* toArgumentList(JSGlobalData*) const;
 
-        virtual ~ArrayNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual bool isSimpleArray() const ;
 
-    private:
-        RefPtr<ElementNode> m_element;
+        ElementNode* m_element;
         int m_elision;
         bool m_optional;
     };
 
-    class PropertyNode : public ParserRefCounted {
+    class PropertyNode : public ParserArenaDeletable {
     public:
         enum Type { Constant, Getter, Setter };
 
-        PropertyNode(JSGlobalData* globalData, const Identifier& name, ExpressionNode* assign, Type type) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_name(name)
-            , m_assign(assign)
-            , m_type(type)
-        {
-        }
-
-        virtual ~PropertyNode();
-        virtual void releaseNodes(NodeReleaser&);
+        PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* value, Type);
 
         const Identifier& name() const { return m_name; }
 
     private:
         friend class PropertyListNode;
         Identifier m_name;
-        RefPtr<ExpressionNode> m_assign;
+        ExpressionNode* m_assign;
         Type m_type;
     };
 
     class PropertyListNode : public Node {
     public:
-        PropertyListNode(JSGlobalData* globalData, PropertyNode* node) JSC_FAST_CALL
-            : Node(globalData)
-            , m_node(node)
-        {
-        }
+        PropertyListNode(JSGlobalData*, PropertyNode*);
+        PropertyListNode(JSGlobalData*, PropertyNode*, PropertyListNode*);
 
-        PropertyListNode(JSGlobalData* globalData, PropertyNode* node, PropertyListNode* list) JSC_FAST_CALL
-            : Node(globalData)
-            , m_node(node)
-        {
-            list->m_next = this;
-        }
-
-        virtual ~PropertyListNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
     private:
-        RefPtr<PropertyNode> m_node;
-        RefPtr<PropertyListNode> m_next;
+        PropertyNode* m_node;
+        PropertyListNode* m_next;
     };
 
     class ObjectLiteralNode : public ExpressionNode {
     public:
-        ObjectLiteralNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-        {
-        }
-
-        ObjectLiteralNode(JSGlobalData* globalData, PropertyListNode* list) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_list(list)
-        {
-        }
-
-        virtual ~ObjectLiteralNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ObjectLiteralNode(JSGlobalData*);
+        ObjectLiteralNode(JSGlobalData*, PropertyListNode*);
 
     private:
-        RefPtr<PropertyListNode> m_list;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        PropertyListNode* m_list;
     };
     
     class BracketAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        BracketAccessorNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-        {
-        }
+        BracketAccessorNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments);
 
-        virtual ~BracketAccessorNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ExpressionNode* base() const { return m_base; }
+        ExpressionNode* subscript() const { return m_subscript; }
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isBracketAccessorNode() const JSC_FAST_CALL { return true; }
-        ExpressionNode* base() JSC_FAST_CALL { return m_base.get(); }
-        ExpressionNode* subscript() JSC_FAST_CALL { return m_subscript.get(); }
+        virtual bool isLocation() const { return true; }
+        virtual bool isBracketAccessorNode() const { return true; }
 
-    private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         bool m_subscriptHasAssignments;
     };
 
     class DotAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DotAccessorNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_base(base)
-            , m_ident(ident)
-        {
-        }
+        DotAccessorNode(JSGlobalData*, ExpressionNode* base, const Identifier&);
 
-        virtual ~DotAccessorNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ExpressionNode* base() const { return m_base; }
+        const Identifier& identifier() const { return m_ident; }
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isDotAccessorNode() const JSC_FAST_CALL { return true; }
-        ExpressionNode* base() const JSC_FAST_CALL { return m_base.get(); }
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        virtual bool isLocation() const { return true; }
+        virtual bool isDotAccessorNode() const { return true; }
 
-    private:
-        RefPtr<ExpressionNode> m_base;
+        ExpressionNode* m_base;
         Identifier m_ident;
     };
 
     class ArgumentListNode : public Node {
     public:
-        ArgumentListNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : Node(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        ArgumentListNode(JSGlobalData* globalData, ArgumentListNode* listNode, ExpressionNode* expr) JSC_FAST_CALL
-            : Node(globalData)
-            , m_expr(expr)
-        {
-            listNode->m_next = this;
-        }
-
-        virtual ~ArgumentListNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ArgumentListNode(JSGlobalData*, ExpressionNode*);
+        ArgumentListNode(JSGlobalData*, ArgumentListNode*, ExpressionNode*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ArgumentListNode* m_next;
+        ExpressionNode* m_expr;
 
-        RefPtr<ArgumentListNode> m_next;
-        RefPtr<ExpressionNode> m_expr;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
-    class ArgumentsNode : public ParserRefCounted {
+    class ArgumentsNode : public ParserArenaDeletable {
     public:
-        ArgumentsNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-        {
-        }
-
-        ArgumentsNode(JSGlobalData* globalData, ArgumentListNode* listNode) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_listNode(listNode)
-        {
-        }
-
-        virtual ~ArgumentsNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ArgumentsNode(JSGlobalData*);
+        ArgumentsNode(JSGlobalData*, ArgumentListNode*);
 
-        RefPtr<ArgumentListNode> m_listNode;
+        ArgumentListNode* m_listNode;
     };
 
     class NewExprNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        NewExprNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        NewExprNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-            , m_args(args)
-        {
-        }
-
-        virtual ~NewExprNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        NewExprNode(JSGlobalData*, ExpressionNode*);
+        NewExprNode(JSGlobalData*, ExpressionNode*, ArgumentsNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
     };
 
     class EvalFunctionCallNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        EvalFunctionCallNode(JSGlobalData* globalData, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_args(args)
-        {
-        }
-
-        virtual ~EvalFunctionCallNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        EvalFunctionCallNode(JSGlobalData*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallValueNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallValueNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallValueNode(JSGlobalData*, ExpressionNode*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallResolveNode(JSGlobalData* globalData, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallResolveNode(JSGlobalData*, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ArgumentsNode> m_args;
+        ArgumentsNode* m_args;
         size_t m_index; // Used by LocalVarFunctionCallNode.
         size_t m_scopeDepth; // Used by ScopedVarFunctionCallNode and NonLocalVarFunctionCallNode
     };
     
     class FunctionCallBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_args(args)
-        {
-        }
+        FunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
-        virtual ~FunctionCallDotNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    protected:
+        ExpressionNode* m_base;
+        const Identifier m_ident;
+        ArgumentsNode* m_args;
+    };
+
+    class CallFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        CallFunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        Identifier m_ident;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+    };
+    
+    class ApplyFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        ApplyFunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class PrePostResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrePostResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::constNumber()) // could be reusable for pre?
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-        {
-        }
+        PrePostResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     protected:
-        Identifier m_ident;
+        const Identifier m_ident;
     };
 
     class PostfixResolveNode : public PrePostResolveNode {
     public:
-        PostfixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
-            , m_operator(oper)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixResolveNode(JSGlobalData*, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Operator m_operator;
     };
 
     class PostfixBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         Operator m_operator;
     };
 
     class PostfixDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
         Operator m_operator;
     };
 
     class PostfixErrorNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixErrorNode(JSGlobalData*, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
     class DeleteResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class DeleteBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-        {
-        }
-
-        virtual ~DeleteBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
     };
 
     class DeleteDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-        {
-        }
-
-        virtual ~DeleteDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
     };
 
     class DeleteValueNode : public ExpressionNode {
     public:
-        DeleteValueNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~DeleteValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteValueNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class VoidNode : public ExpressionNode {
     public:
-        VoidNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~VoidNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        VoidNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class TypeOfResolveNode : public ExpressionNode {
     public:
-        TypeOfResolveNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::string())
-            , m_ident(ident)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        TypeOfResolveNode(JSGlobalData*, const Identifier&);
 
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        const Identifier& identifier() const { return m_ident; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class TypeOfValueNode : public ExpressionNode {
     public:
-        TypeOfValueNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::string())
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~TypeOfValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        TypeOfValueNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class PrefixResolveNode : public PrePostResolveNode {
     public:
-        PrefixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
-            , m_operator(oper)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixResolveNode(JSGlobalData*, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Operator m_operator;
     };
 
     class PrefixBracketNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         Operator m_operator;
     };
 
     class PrefixDotNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
         Operator m_operator;
     };
 
     class PrefixErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrefixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixErrorNode(JSGlobalData*, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
     class UnaryOpNode : public ExpressionNode {
     public:
-        UnaryOpNode(JSGlobalData* globalData, ExpressionNode* expr)
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
+        UnaryOpNode(JSGlobalData*, ResultType, ExpressionNode*, OpcodeID);
 
-        UnaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr)
-            : ExpressionNode(globalData, type)
-            , m_expr(expr)
-        {
-        }
+    protected:
+        ExpressionNode* expr() { return m_expr; }
 
-        virtual ~UnaryOpNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL = 0;
+        OpcodeID opcodeID() const { return m_opcodeID; }
 
-    protected:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* m_expr;
+        OpcodeID m_opcodeID;
     };
 
     class UnaryPlusNode : public UnaryOpNode {
     public:
-        UnaryPlusNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::constNumber(), expr)
-        {
-        }
+        UnaryPlusNode(JSGlobalData*, ExpressionNode*);
 
-        virtual ExpressionNode* stripUnaryPlus() { return m_expr.get(); }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_to_jsnumber; }
+    private:
+        virtual ExpressionNode* stripUnaryPlus() { return expr(); }
     };
 
     class NegateNode : public UnaryOpNode {
     public:
-        NegateNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::reusableNumber(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_negate; }
+        NegateNode(JSGlobalData*, ExpressionNode*);
     };
 
     class BitwiseNotNode : public UnaryOpNode {
     public:
-        BitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::reusableNumber(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitnot; }
+        BitwiseNotNode(JSGlobalData*, ExpressionNode*);
     };
 
     class LogicalNotNode : public UnaryOpNode {
     public:
-        LogicalNotNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::boolean(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_not; }
+        LogicalNotNode(JSGlobalData*, ExpressionNode*);
     };
 
     class BinaryOpNode : public ExpressionNode {
     public:
-        BinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : ExpressionNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
+        BinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        BinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        BinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : ExpressionNode(globalData, type)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
+        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
 
-        virtual ~BinaryOpNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL = 0;
+    protected:
+        OpcodeID opcodeID() const { return m_opcodeID; }
 
     protected:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+    private:
+        OpcodeID m_opcodeID;
+    protected:
         bool m_rightHasAssignments;
     };
 
     class ReverseBinaryOpNode : public BinaryOpNode {
     public:
-        ReverseBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : BinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
+        ReverseBinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ReverseBinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        ReverseBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : BinaryOpNode(globalData, type, expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class MultNode : public BinaryOpNode {
     public:
-        MultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_mul; }
+        MultNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class DivNode : public BinaryOpNode {
     public:
-        DivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_div; }
+        DivNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ModNode : public BinaryOpNode {
     public:
-        ModNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_mod; }
+        ModNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class AddNode : public BinaryOpNode {
     public:
-        AddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, rightHasAssignments)
-        {
-        }
+        AddNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_add; }
+        virtual bool isAdd() const { return true; }
     };
 
     class SubNode : public BinaryOpNode {
     public:
-        SubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_sub; }
+        SubNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LeftShiftNode : public BinaryOpNode {
     public:
-        LeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lshift; }
+        LeftShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class RightShiftNode : public BinaryOpNode {
     public:
-        RightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_rshift; }
+        RightShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class UnsignedRightShiftNode : public BinaryOpNode {
     public:
-        UnsignedRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_urshift; }
+        UnsignedRightShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessNode : public BinaryOpNode {
     public:
-        LessNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_less; }
+        LessNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterNode : public ReverseBinaryOpNode {
     public:
-        GreaterNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ReverseBinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_less; }
+        GreaterNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessEqNode : public BinaryOpNode {
     public:
-        LessEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lesseq; }
+        LessEqNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterEqNode : public ReverseBinaryOpNode {
     public:
-        GreaterEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ReverseBinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lesseq; }
+        GreaterEqNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ThrowableBinaryOpNode : public BinaryOpNode, public ThrowableExpressionData {
     public:
-        ThrowableBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, type, expr1, expr2, rightHasAssignments)
-        {
-        }
-        ThrowableBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ThrowableBinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ThrowableBinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
     
     class InstanceOfNode : public ThrowableBinaryOpNode {
     public:
-        InstanceOfNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ThrowableBinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_instanceof; }
+        InstanceOfNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class InNode : public ThrowableBinaryOpNode {
     public:
-        InNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ThrowableBinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_in; }
+        InNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class EqualNode : public BinaryOpNode {
     public:
-        EqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
+        EqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_eq; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class NotEqualNode : public BinaryOpNode {
     public:
-        NotEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_neq; }
+        NotEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class StrictEqualNode : public BinaryOpNode {
     public:
-        StrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
+        StrictEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_stricteq; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class NotStrictEqualNode : public BinaryOpNode {
     public:
-        NotStrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_nstricteq; }
+        NotStrictEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitAndNode : public BinaryOpNode {
     public:
-        BitAndNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitand; }
+        BitAndNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitOrNode : public BinaryOpNode {
     public:
-        BitOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitor; }
+        BitOrNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitXOrNode : public BinaryOpNode {
     public:
-        BitXOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitxor; }
+        BitXOrNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
-    /**
-     * m_expr1 && m_expr2, m_expr1 || m_expr2
-     */
+    // m_expr1 && m_expr2, m_expr1 || m_expr2
     class LogicalOpNode : public ExpressionNode {
     public:
-        LogicalOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::boolean())
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~LogicalOpNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        LogicalOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
         LogicalOperator m_operator;
     };
 
-    /**
-     * The ternary operator, "m_logical ? m_expr1 : m_expr2"
-     */
+    // The ternary operator, "m_logical ? m_expr1 : m_expr2"
     class ConditionalNode : public ExpressionNode {
     public:
-        ConditionalNode(JSGlobalData* globalData, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_logical(logical)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-        {
-        }
-
-        virtual ~ConditionalNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ConditionalNode(JSGlobalData*, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2);
 
     private:
-        RefPtr<ExpressionNode> m_logical;
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_logical;
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
     };
 
     class ReadModifyResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        ReadModifyResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-            , m_right(right)
-            , m_operator(oper)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyResolveNode(JSGlobalData*, const Identifier&, Operator, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
-        Operator m_operator : 31;
-        bool m_rightHasAssignments : 1;
+        Operator m_operator;
+        bool m_rightHasAssignments;
     };
 
     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignResolveNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_right(right)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignResolveNode(JSGlobalData*, const Identifier&, ExpressionNode* right, bool rightHasAssignments);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
         bool m_rightHasAssignments;
     };
 
     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_right(right)
-            , m_operator(oper)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ExpressionNode> m_right;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
         Operator m_operator : 30;
         bool m_subscriptHasAssignments : 1;
         bool m_rightHasAssignments : 1;
@@ -1524,168 +1037,105 @@ namespace JSC {
 
     class AssignBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_right(right)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ExpressionNode> m_right;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
         bool m_subscriptHasAssignments : 1;
         bool m_rightHasAssignments : 1;
     };
 
     class AssignDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_right(right)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         bool m_rightHasAssignments;
     };
 
     class ReadModifyDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_right(right)
-            , m_operator(oper)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         Operator m_operator : 31;
         bool m_rightHasAssignments : 1;
     };
 
     class AssignErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignErrorNode(JSGlobalData* globalData, ExpressionNode* left, Operator oper, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_left(left)
-            , m_operator(oper)
-            , m_right(right)
-        {
-        }
-
-        virtual ~AssignErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignErrorNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_left;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_left;
         Operator m_operator;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
     };
 
     class CommaNode : public ExpressionNode {
     public:
-        CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-        {
-        }
-
-        virtual ~CommaNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
     };
     
-    class VarDeclCommaNode : public CommaNode {
-    public:
-        VarDeclCommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : CommaNode(globalData, expr1, expr2)
-        {
-        }
-    };
-
     class ConstDeclNode : public ExpressionNode {
     public:
-        ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in) JSC_FAST_CALL;
+        ConstDeclNode(JSGlobalData*, const Identifier&, ExpressionNode*);
+
+        bool hasInitializer() const { return m_init; }
+        const Identifier& ident() { return m_ident; }
 
-        virtual ~ConstDeclNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitCodeSingle(BytecodeGenerator&);
 
         Identifier m_ident;
-        RefPtr<ConstDeclNode> m_next;
-        RefPtr<ExpressionNode> m_init;
-        
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual RegisterID* emitCodeSingle(BytecodeGenerator&) JSC_FAST_CALL;
-    };
 
-    class ConstStatementNode : public StatementNode {
     public:
-        ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_next(next)
-        {
-        }
+        ConstDeclNode* m_next;
 
-        virtual ~ConstStatementNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        ExpressionNode* m_init;
+    };
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    class ConstStatementNode : public StatementNode {
+    public:
+        ConstStatementNode(JSGlobalData*, ConstDeclNode* next);
 
     private:
-        RefPtr<ConstDeclNode> m_next;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ConstDeclNode* m_next;
     };
 
-    typedef Vector<RefPtr<StatementNode> > StatementVector;
+    typedef Vector<StatementNode*> StatementVector;
 
-    class SourceElements : public ParserRefCounted {
+    class SourceElements : public ParserArenaDeletable {
     public:
-        SourceElements(JSGlobalData* globalData) : ParserRefCounted(globalData) {}
+        SourceElements(JSGlobalData*);
 
-        void append(PassRefPtr<StatementNode>);
+        void append(StatementNode*);
         void releaseContentsIntoVector(StatementVector& destination)
         {
             ASSERT(destination.isEmpty());
@@ -1699,399 +1149,262 @@ namespace JSC {
 
     class BlockNode : public StatementNode {
     public:
-        BlockNode(JSGlobalData*, SourceElements* children) JSC_FAST_CALL;
-
-        virtual ~BlockNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        BlockNode(JSGlobalData*, SourceElements* children);
 
         StatementVector& children() { return m_children; }
 
-        virtual bool isBlock() const JSC_FAST_CALL { return true; }
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isBlock() const { return true; }
+
         StatementVector m_children;
     };
 
     class EmptyStatementNode : public StatementNode {
     public:
-        EmptyStatementNode(JSGlobalData* globalData) JSC_FAST_CALL // debug
-            : StatementNode(globalData)
-        {
-        }
+        EmptyStatementNode(JSGlobalData*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isEmptyStatement() const JSC_FAST_CALL { return true; }
+        virtual bool isEmptyStatement() const { return true; }
     };
     
     class DebuggerStatementNode : public StatementNode {
     public:
-        DebuggerStatementNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
+        DebuggerStatementNode(JSGlobalData*);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class ExprStatementNode : public StatementNode {
     public:
-        ExprStatementNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
+        ExprStatementNode(JSGlobalData*, ExpressionNode*);
 
-        virtual bool isExprStatement() const JSC_FAST_CALL { return true; }
+        ExpressionNode* expr() const { return m_expr; }
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual bool isExprStatement() const { return true; }
 
-        ExpressionNode* expr() const { return m_expr.get(); }
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-    private:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* m_expr;
     };
 
     class VarStatementNode : public StatementNode {
     public:
-        VarStatementNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
-        
-        virtual ~VarStatementNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        VarStatementNode(JSGlobalData*, ExpressionNode*);        
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class IfNode : public StatementNode {
     public:
-        IfNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_condition(condition)
-            , m_ifBlock(ifBlock)
-        {
-        }
-
-        virtual ~IfNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        IfNode(JSGlobalData*, ExpressionNode* condition, StatementNode* ifBlock);
 
     protected:
-        RefPtr<ExpressionNode> m_condition;
-        RefPtr<StatementNode> m_ifBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_condition;
+        StatementNode* m_ifBlock;
     };
 
     class IfElseNode : public IfNode {
     public:
-        IfElseNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock) JSC_FAST_CALL
-            : IfNode(globalData, condition, ifBlock)
-            , m_elseBlock(elseBlock)
-        {
-        }
-
-        virtual ~IfElseNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        IfElseNode(JSGlobalData*, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock);
 
     private:
-        RefPtr<StatementNode> m_elseBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        StatementNode* m_elseBlock;
     };
 
     class DoWhileNode : public StatementNode {
     public:
-        DoWhileNode(JSGlobalData* globalData, StatementNode* statement, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_statement(statement)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~DoWhileNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        DoWhileNode(JSGlobalData*, StatementNode* statement, ExpressionNode*);
 
     private:
-        RefPtr<StatementNode> m_statement;
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        StatementNode* m_statement;
+        ExpressionNode* m_expr;
     };
 
     class WhileNode : public StatementNode {
     public:
-        WhileNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_statement(statement)
-        {
-        }
-
-        virtual ~WhileNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        WhileNode(JSGlobalData*, ExpressionNode*, StatementNode* statement);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
     };
 
     class ForNode : public StatementNode {
     public:
-        ForNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_expr3(expr3)
-            , m_statement(statement)
-            , m_expr1WasVarDecl(expr1 && expr1WasVarDecl)
-        {
-            ASSERT(statement);
-        }
-
-        virtual ~ForNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        ForNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
-        RefPtr<ExpressionNode> m_expr3;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+        ExpressionNode* m_expr3;
+        StatementNode* m_statement;
         bool m_expr1WasVarDecl;
     };
 
     class ForInNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ForInNode(JSGlobalData*, ExpressionNode*, ExpressionNode*, StatementNode*) JSC_FAST_CALL;
-        ForInNode(JSGlobalData*, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset) JSC_FAST_CALL;
-        
-        virtual ~ForInNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        ForInNode(JSGlobalData*, ExpressionNode*, ExpressionNode*, StatementNode*);
+        ForInNode(JSGlobalData*, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_init;
-        RefPtr<ExpressionNode> m_lexpr;
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        ExpressionNode* m_init;
+        ExpressionNode* m_lexpr;
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
         bool m_identIsVarDecl;
     };
 
     class ContinueNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ContinueNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
-
-        ContinueNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-        {
-        }
+        ContinueNode(JSGlobalData*);
+        ContinueNode(JSGlobalData*, const Identifier&);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class BreakNode : public StatementNode, public ThrowableExpressionData {
     public:
-        BreakNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
-
-        BreakNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-        {
-        }
+        BreakNode(JSGlobalData*);
+        BreakNode(JSGlobalData*, const Identifier&);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class ReturnNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ReturnNode(JSGlobalData* globalData, ExpressionNode* value) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_value(value)
-        {
-        }
+        ReturnNode(JSGlobalData*, ExpressionNode* value);
 
-        virtual ~ReturnNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual bool isReturnNode() const JSC_FAST_CALL { return true; }
+        virtual bool isReturnNode() const { return true; }
 
-    private:
-        RefPtr<ExpressionNode> m_value;
+        ExpressionNode* m_value;
     };
 
     class WithNode : public StatementNode {
     public:
-        WithNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_statement(statement)
-            , m_divot(divot)
-            , m_expressionLength(expressionLength)
-        {
-        }
-
-        virtual ~WithNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        WithNode(JSGlobalData*, ExpressionNode*, StatementNode*, uint32_t divot, uint32_t expressionLength);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
         uint32_t m_divot;
         uint32_t m_expressionLength;
     };
 
     class LabelNode : public StatementNode, public ThrowableExpressionData {
     public:
-        LabelNode(JSGlobalData* globalData, const Identifier& name, StatementNode* statement) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_name(name)
-            , m_statement(statement)
-        {
-        }
-
-        virtual ~LabelNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        LabelNode(JSGlobalData*, const Identifier& name, StatementNode*);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_name;
-        RefPtr<StatementNode> m_statement;
+        StatementNode* m_statement;
     };
 
     class ThrowNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ThrowNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~ThrowNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ThrowNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class TryNode : public StatementNode {
     public:
-        TryNode(JSGlobalData* globalData, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_tryBlock(tryBlock)
-            , m_exceptionIdent(exceptionIdent)
-            , m_catchBlock(catchBlock)
-            , m_finallyBlock(finallyBlock)
-            , m_catchHasEval(catchHasEval)
-        {
-        }
-
-        virtual ~TryNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) JSC_FAST_CALL;
+        TryNode(JSGlobalData*, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock);
 
     private:
-        RefPtr<StatementNode> m_tryBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0);
+
+        StatementNode* m_tryBlock;
         Identifier m_exceptionIdent;
-        RefPtr<StatementNode> m_catchBlock;
-        RefPtr<StatementNode> m_finallyBlock;
+        StatementNode* m_catchBlock;
+        StatementNode* m_finallyBlock;
         bool m_catchHasEval;
     };
 
-    class ParameterNode : public ParserRefCounted {
+    class ParameterNode : public ParserArenaDeletable {
     public:
-        ParameterNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_ident(ident)
-        {
-        }
-
-        ParameterNode(JSGlobalData* globalData, ParameterNode* l, const Identifier& ident) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_ident(ident)
-        {
-            l->m_next = this;
-        }
+        ParameterNode(JSGlobalData*, const Identifier&);
+        ParameterNode(JSGlobalData*, ParameterNode*, const Identifier&);
 
-        virtual ~ParameterNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        const Identifier& ident() const JSC_FAST_CALL { return m_ident; }
-        ParameterNode* nextParam() const JSC_FAST_CALL { return m_next.get(); }
+        const Identifier& ident() const { return m_ident; }
+        ParameterNode* nextParam() const { return m_next; }
 
     private:
         Identifier m_ident;
-        RefPtr<ParameterNode> m_next;
+        ParameterNode* m_next;
     };
 
     struct ScopeNodeData {
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNodeData(SourceElements*, VarStack*, FunctionStack*, int numConstants);
+        ScopeNodeData(ParserArena&, SourceElements*, VarStack*, FunctionStack*, int numConstants);
 
+        ParserArena m_arena;
         VarStack m_varStack;
         FunctionStack m_functionStack;
         int m_numConstants;
         StatementVector m_children;
+
+        void mark();
     };
 
-    class ScopeNode : public StatementNode {
+    class ScopeNode : public StatementNode, public ParserArenaRefCounted {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNode(JSGlobalData*) JSC_FAST_CALL;
-        ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants) JSC_FAST_CALL;
-        virtual ~ScopeNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ScopeNode(JSGlobalData*);
+        ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants);
 
-        void adoptData(std::auto_ptr<ScopeNodeData> data) { m_data.adopt(data); }
+        void adoptData(std::auto_ptr<ScopeNodeData> data)
+        {
+            ASSERT(!data->m_arena.contains(this));
+            ASSERT(!m_data);
+            m_data.adopt(data);
+        }
         ScopeNodeData* data() const { return m_data.get(); }
         void destroyData() { m_data.clear(); }
 
         const SourceCode& source() const { return m_source; }
-        const UString& sourceURL() const JSC_FAST_CALL { return m_source.provider()->url(); }
+        const UString& sourceURL() const { return m_source.provider()->url(); }
         intptr_t sourceID() const { return m_source.provider()->asID(); }
 
         void setFeatures(CodeFeatures features) { m_features = features; }
@@ -2116,9 +1429,33 @@ namespace JSC {
             return m_data->m_numConstants + 2;
         }
 
+        virtual void mark() { }
+
+#if ENABLE(JIT)
+        JITCode& generatedJITCode()
+        {
+            ASSERT(m_jitCode);
+            return m_jitCode;
+        }
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_jitCode.getExecutablePool();
+        }
+
+        void setJITCode(const JITCode jitCode)
+        {
+            m_jitCode = jitCode;
+        }
+#endif
+
     protected:
         void setSource(const SourceCode& source) { m_source = source; }
 
+#if ENABLE(JIT)
+        JITCode m_jitCode;
+#endif
+
     private:
         OwnPtr<ScopeNodeData> m_data;
         CodeFeatures m_features;
@@ -2127,42 +1464,70 @@ namespace JSC {
 
     class ProgramNode : public ScopeNode {
     public:
-        static ProgramNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        static PassRefPtr<ProgramNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
+        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
             if (!m_code)
                 generateBytecode(scopeChain);
             return *m_code;
         }
 
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
+        {
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
+        }
+#endif
+
     private:
-        ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        void generateBytecode(ScopeChainNode*);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
 
         OwnPtr<ProgramCodeBlock> m_code;
     };
 
     class EvalNode : public ScopeNode {
     public:
-        static EvalNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        static PassRefPtr<EvalNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
+        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
             if (!m_code)
                 generateBytecode(scopeChain);
             return *m_code;
         }
 
-        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*) JSC_FAST_CALL;
+        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
+
+        virtual void mark();
+
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
+        {
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
+        }
+#endif
 
     private:
-        EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        void generateBytecode(ScopeChainNode*);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
         
         OwnPtr<EvalCodeBlock> m_code;
     };
@@ -2170,217 +1535,159 @@ namespace JSC {
     class FunctionBodyNode : public ScopeNode {
         friend class JIT;
     public:
-        static FunctionBodyNode* create(JSGlobalData*) JSC_FAST_CALL;
-        static FunctionBodyNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+#if ENABLE(JIT)
+        static PassRefPtr<FunctionBodyNode> createNativeThunk(JSGlobalData*);
+#endif
+        static FunctionBodyNode* create(JSGlobalData*);
+        static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
         virtual ~FunctionBodyNode();
 
-        const Identifier* parameters() const JSC_FAST_CALL { return m_parameters; }
+        const Identifier* parameters() const { return m_parameters; }
         size_t parameterCount() const { return m_parameterCount; }
-        UString paramString() const JSC_FAST_CALL;
+        UString paramString() const ;
         Identifier* copyParameters();
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        
-        CodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
-        {
-            ASSERT(scopeChain);
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        CodeBlock& generatedBytecode() JSC_FAST_CALL
+        bool isGenerated() const
         {
-            ASSERT(m_code);
-            return *m_code;
+            return m_code;
         }
 
-        bool isGenerated() JSC_FAST_CALL
+        bool isHostFunction() const
         {
-            return m_code;
+#if ENABLE(JIT)
+            return !!m_jitCode && !m_code;
+#else
+            return true;
+#endif
         }
 
-        void mark();
+        virtual void mark();
 
         void finishParsing(const SourceCode&, ParameterNode*);
         void finishParsing(Identifier* parameters, size_t parameterCount);
         
-        UString toSourceString() const JSC_FAST_CALL { return source().toString(); }
+        UString toSourceString() const { return source().toString(); }
 
-        // These objects are ref/deref'd a lot in the scope chain, so this is a faster ref/deref.
-        // If the virtual machine changes so this doesn't happen as much we can change back.
-        void ref()
+        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
         {
-            if (++m_refCount == 1)
-                ScopeNode::ref();
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
         }
-        void deref()
+#endif
+
+        CodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
-            ASSERT(m_refCount);
-            if (!--m_refCount)
-                ScopeNode::deref();
+            ASSERT(scopeChain);
+            if (!m_code)
+                generateBytecode(scopeChain);
+            return *m_code;
         }
-
-        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChain) JSC_FAST_CALL;
-
+        
+        CodeBlock& generatedBytecode()
+        {
+            ASSERT(m_code);
+            return *m_code;
+        }
+        
     private:
-        FunctionBodyNode(JSGlobalData*) JSC_FAST_CALL;
-        FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
-
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
+        FunctionBodyNode(JSGlobalData*);
+        FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
+        void generateBytecode(ScopeChainNode*);
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
         Identifier* m_parameters;
         size_t m_parameterCount;
         OwnPtr<CodeBlock> m_code;
-        unsigned m_refCount;
     };
 
-    class FuncExprNode : public ExpressionNode {
+    class FuncExprNode : public ExpressionNode, public ParserArenaRefCounted {
     public:
-        FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_parameter(parameter)
-            , m_body(body)
-        {
-            m_body->finishParsing(source, m_parameter.get());
-        }
-
-        virtual ~FuncExprNode();
-        virtual void releaseNodes(NodeReleaser&);
+        FuncExprNode(JSGlobalData*, const Identifier&, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0);
 
-        virtual bool isFuncExprNode() const JSC_FAST_CALL { return true; } 
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*) JSC_FAST_CALL;
+        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
 
         FunctionBodyNode* body() { return m_body.get(); }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isFuncExprNode() const { return true; } 
+
         Identifier m_ident;
-        RefPtr<ParameterNode> m_parameter;
         RefPtr<FunctionBodyNode> m_body;
     };
 
-    class FuncDeclNode : public StatementNode {
+    class FuncDeclNode : public StatementNode, public ParserArenaRefCounted {
     public:
-        FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-            , m_parameter(parameter)
-            , m_body(body)
-        {
-            m_body->finishParsing(source, m_parameter.get());
-        }
-
-        virtual ~FuncDeclNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FuncDeclNode(JSGlobalData*, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
 
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*) JSC_FAST_CALL;
+        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
 
         Identifier m_ident;
 
         FunctionBodyNode* body() { return m_body.get(); }
 
     private:
-        RefPtr<ParameterNode> m_parameter;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         RefPtr<FunctionBodyNode> m_body;
     };
 
-    class CaseClauseNode : public ParserRefCounted {
+    class CaseClauseNode : public ParserArenaDeletable {
     public:
-        CaseClauseNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_expr(expr)
-        {
-        }
+        CaseClauseNode(JSGlobalData*, ExpressionNode*);
+        CaseClauseNode(JSGlobalData*, ExpressionNode*, SourceElements*);
 
-        CaseClauseNode(JSGlobalData* globalData, ExpressionNode* expr, SourceElements* children) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_expr(expr)
-        {
-            if (children)
-                children->releaseContentsIntoVector(m_children);
-        }
-
-        virtual ~CaseClauseNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        ExpressionNode* expr() const { return m_expr.get(); }
+        ExpressionNode* expr() const { return m_expr; }
         StatementVector& children() { return m_children; }
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* m_expr;
         StatementVector m_children;
     };
 
-    class ClauseListNode : public ParserRefCounted {
+    class ClauseListNode : public ParserArenaDeletable {
     public:
-        ClauseListNode(JSGlobalData* globalData, CaseClauseNode* clause) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_clause(clause)
-        {
-        }
-
-        ClauseListNode(JSGlobalData* globalData, ClauseListNode* clauseList, CaseClauseNode* clause) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_clause(clause)
-        {
-            clauseList->m_next = this;
-        }
-
-        virtual ~ClauseListNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ClauseListNode(JSGlobalData*, CaseClauseNode*);
+        ClauseListNode(JSGlobalData*, ClauseListNode*, CaseClauseNode*);
 
-        CaseClauseNode* getClause() const JSC_FAST_CALL { return m_clause.get(); }
-        ClauseListNode* getNext() const JSC_FAST_CALL { return m_next.get(); }
+        CaseClauseNode* getClause() const { return m_clause; }
+        ClauseListNode* getNext() const { return m_next; }
 
     private:
-        RefPtr<CaseClauseNode> m_clause;
-        RefPtr<ClauseListNode> m_next;
+        CaseClauseNode* m_clause;
+        ClauseListNode* m_next;
     };
 
-    class CaseBlockNode : public ParserRefCounted {
+    class CaseBlockNode : public ParserArenaDeletable {
     public:
-        CaseBlockNode(JSGlobalData* globalData, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_list1(list1)
-            , m_defaultClause(defaultClause)
-            , m_list2(list2)
-        {
-        }
+        CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2);
 
-        virtual ~CaseBlockNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0) JSC_FAST_CALL;
+        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0);
 
     private:
         SwitchInfo::SwitchType tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num);
-        RefPtr<ClauseListNode> m_list1;
-        RefPtr<CaseClauseNode> m_defaultClause;
-        RefPtr<ClauseListNode> m_list2;
+        ClauseListNode* m_list1;
+        CaseClauseNode* m_defaultClause;
+        ClauseListNode* m_list2;
     };
 
     class SwitchNode : public StatementNode {
     public:
-        SwitchNode(JSGlobalData* globalData, ExpressionNode* expr, CaseBlockNode* block) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_block(block)
-        {
-        }
-
-        virtual ~SwitchNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        SwitchNode(JSGlobalData*, ExpressionNode*, CaseBlockNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<CaseBlockNode> m_block;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        CaseBlockNode* m_block;
     };
 
     struct ElementList {
@@ -2415,4 +1722,4 @@ namespace JSC {
 
 } // namespace JSC
 
-#endif // NODES_H_
+#endif // Nodes_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
index 1b1e4d7b48..96f4ae6ae2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
@@ -31,13 +31,15 @@
 
 using std::auto_ptr;
 
+#ifndef yyparse
 extern int jscyyparse(void*);
+#endif
 
 namespace JSC {
 
 void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
 {
-    ASSERT(!m_sourceElements);
+    m_sourceElements = 0;
 
     int defaultErrLine;
     UString defaultErrMsg;
@@ -55,14 +57,13 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
 
     int parseError = jscyyparse(globalData);
     bool lexError = lexer.sawError();
+    int lineNumber = lexer.lineNumber();
     lexer.clear();
 
-    ParserRefCounted::deleteNewObjects(globalData);
-
     if (parseError || lexError) {
-        *errLine = lexer.lineNo();
+        *errLine = lineNumber;
         *errMsg = "Parse error";
-        m_sourceElements.clear();
+        m_sourceElements = 0;
     }
 }
 
@@ -75,23 +76,26 @@ void Parser::reparseInPlace(JSGlobalData* globalData, FunctionBodyNode* function
     parse(globalData, 0, 0);
     ASSERT(m_sourceElements);
 
-    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(m_sourceElements.get(),
-                                                                               m_varDeclarations ? &m_varDeclarations->data : 0, 
-                                                                               m_funcDeclarations ? &m_funcDeclarations->data : 0,
-                                                                               m_numConstants)));
+    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(globalData->parser->arena(),
+        m_sourceElements,
+        m_varDeclarations ? &m_varDeclarations->data : 0, 
+        m_funcDeclarations ? &m_funcDeclarations->data : 0,
+        m_numConstants)));
     bool usesArguments = functionBodyNode->usesArguments();
     functionBodyNode->setFeatures(m_features);
     if (usesArguments && !functionBodyNode->usesArguments())
         functionBodyNode->setUsesArguments();
 
+    ASSERT(globalData->parser->arena().isEmpty());
+
     m_source = 0;
     m_sourceElements = 0;
     m_varDeclarations = 0;
     m_funcDeclarations = 0;
 }
 
-void Parser::didFinishParsing(SourceElements* sourceElements, ParserRefCountedData<DeclarationStacks::VarStack>* varStack, 
-                              ParserRefCountedData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
+void Parser::didFinishParsing(SourceElements* sourceElements, ParserArenaData<DeclarationStacks::VarStack>* varStack, 
+                              ParserArenaData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
 {
     m_sourceElements = sourceElements;
     m_varDeclarations = varStack;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
index 6191ccb8b4..6f4c2b7d4e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
@@ -23,9 +23,9 @@
 #ifndef Parser_h
 #define Parser_h
 
-#include "SourceProvider.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include "SourceProvider.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -37,15 +37,7 @@ namespace JSC {
     class ProgramNode;
     class UString;
 
-    template <typename T>
-    struct ParserRefCountedData : ParserRefCounted {
-        ParserRefCountedData(JSGlobalData* globalData)
-            : ParserRefCounted(globalData)
-        {
-        }
-
-        T data;
-    };
+    template <typename T> struct ParserArenaData : ParserArenaDeletable { T data; };
 
     class Parser : Noncopyable {
     public:
@@ -53,16 +45,19 @@ namespace JSC {
         template <class ParsedNode> PassRefPtr<ParsedNode> reparse(JSGlobalData*, ParsedNode*);
         void reparseInPlace(JSGlobalData*, FunctionBodyNode*);
 
-        void didFinishParsing(SourceElements*, ParserRefCountedData<DeclarationStacks::VarStack>*, 
-                              ParserRefCountedData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
+        void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
+                              ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
+
+        ParserArena& arena() { return m_arena; }
 
     private:
         void parse(JSGlobalData*, int* errLine, UString* errMsg);
 
+        ParserArena m_arena;
         const SourceCode* m_source;
-        RefPtr<SourceElements> m_sourceElements;
-        RefPtr<ParserRefCountedData<DeclarationStacks::VarStack> > m_varDeclarations;
-        RefPtr<ParserRefCountedData<DeclarationStacks::FunctionStack> > m_funcDeclarations;
+        SourceElements* m_sourceElements;
+        ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
+        ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
         CodeFeatures m_features;
         int m_lastLine;
         int m_numConstants;
@@ -75,7 +70,7 @@ namespace JSC {
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(&exec->globalData(),
-                                         m_sourceElements.get(),
+                                         m_sourceElements,
                                          m_varDeclarations ? &m_varDeclarations->data : 0, 
                                          m_funcDeclarations ? &m_funcDeclarations->data : 0,
                                          *m_source,
@@ -84,8 +79,9 @@ namespace JSC {
             result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
+        m_arena.reset();
+
         m_source = 0;
-        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
@@ -101,7 +97,7 @@ namespace JSC {
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(globalData,
-                                        m_sourceElements.get(),
+                                        m_sourceElements,
                                         m_varDeclarations ? &m_varDeclarations->data : 0, 
                                         m_funcDeclarations ? &m_funcDeclarations->data : 0,
                                         *m_source,
@@ -110,8 +106,9 @@ namespace JSC {
             result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
+        m_arena.reset();
+
         m_source = 0;
-        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp
new file mode 100644
index 0000000000..261750668e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ParserArena.h"
+
+#include "Nodes.h"
+
+namespace JSC {
+
+ParserArena::~ParserArena()
+{
+    deleteAllValues(m_deletableObjects);
+}
+
+bool ParserArena::contains(ParserArenaRefCounted* object) const
+{
+    return m_refCountedObjects.find(object) != notFound;
+}
+
+ParserArenaRefCounted* ParserArena::last() const
+{
+    return m_refCountedObjects.last().get();
+}
+
+void ParserArena::removeLast()
+{
+    m_refCountedObjects.removeLast();
+}
+
+void ParserArena::reset()
+{
+    deleteAllValues(m_deletableObjects);
+    m_deletableObjects.shrink(0);
+    m_refCountedObjects.shrink(0);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
new file mode 100644
index 0000000000..66c8529abe
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ParserArena_h
+#define ParserArena_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+    class ParserArenaDeletable;
+    class ParserArenaRefCounted;
+
+    class ParserArena {
+    public:
+        void swap(ParserArena& otherArena)
+        {
+            m_deletableObjects.swap(otherArena.m_deletableObjects);
+            m_refCountedObjects.swap(otherArena.m_refCountedObjects);
+        }
+        ~ParserArena();
+
+        void deleteWithArena(ParserArenaDeletable* object) { m_deletableObjects.append(object); }
+        void derefWithArena(PassRefPtr<ParserArenaRefCounted> object) { m_refCountedObjects.append(object); }
+
+        bool contains(ParserArenaRefCounted*) const;
+        ParserArenaRefCounted* last() const;
+        void removeLast();
+
+        bool isEmpty() const { return m_deletableObjects.isEmpty() && m_refCountedObjects.isEmpty(); }
+        void reset();
+
+    private:
+        Vector<ParserArenaDeletable*> m_deletableObjects;
+        Vector<RefPtr<ParserArenaRefCounted> > m_refCountedObjects;
+    };
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h b/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h
index 4913887420..27b8112a0e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h
@@ -33,16 +33,16 @@ namespace JSC {
 
         typedef char Type;
         static const Type TypeReusable = 1;
+        static const Type TypeInt32    = 2;
         
-        static const Type TypeMaybeNumber = 2;
-        static const Type TypeMaybeString = 4;
-        static const Type TypeMaybeNull = 8;
-        static const Type TypeMaybeBool = 16;
-        static const Type TypeMaybeOther = 32;
-
-        static const Type TypeReusableNumber = 3;
-        static const Type TypeStringOrReusableNumber = 4;
-    
+        static const Type TypeMaybeNumber = 0x04;
+        static const Type TypeMaybeString = 0x08;
+        static const Type TypeMaybeNull   = 0x10;
+        static const Type TypeMaybeBool   = 0x20;
+        static const Type TypeMaybeOther  = 0x40;
+
+        static const Type TypeBits = TypeMaybeNumber | TypeMaybeString | TypeMaybeNull | TypeMaybeBool | TypeMaybeOther;
+
         explicit ResultType(Type type)
             : m_type(type)
         {
@@ -50,66 +50,86 @@ namespace JSC {
         
         bool isReusable()
         {
-            return (m_type & TypeReusable);
+            return m_type & TypeReusable;
+        }
+
+        bool isInt32()
+        {
+            return m_type & TypeInt32;
         }
 
         bool definitelyIsNumber()
         {
-            return ((m_type & ~TypeReusable) == TypeMaybeNumber);
+            return (m_type & TypeBits) == TypeMaybeNumber;
         }
         
-        bool isNotNumber()
+        bool definitelyIsString()
         {
-            return ((m_type & TypeMaybeNumber) == 0);
+            return (m_type & TypeBits) == TypeMaybeString;
         }
-        
+
         bool mightBeNumber()
         {
-            return !isNotNumber();
+            return m_type & TypeMaybeNumber;
         }
 
+        bool isNotNumber()
+        {
+            return !mightBeNumber();
+        }
+        
         static ResultType nullType()
         {
             return ResultType(TypeMaybeNull);
         }
         
-        static ResultType boolean()
+        static ResultType booleanType()
         {
             return ResultType(TypeMaybeBool);
         }
         
-        static ResultType constNumber()
+        static ResultType numberType()
         {
             return ResultType(TypeMaybeNumber);
         }
         
-        static ResultType reusableNumber()
+        static ResultType numberTypeCanReuse()
         {
             return ResultType(TypeReusable | TypeMaybeNumber);
         }
         
-        static ResultType reusableNumberOrString()
+        static ResultType numberTypeCanReuseIsInt32()
+        {
+            return ResultType(TypeReusable | TypeInt32 | TypeMaybeNumber);
+        }
+        
+        static ResultType stringOrNumberTypeCanReuse()
         {
             return ResultType(TypeReusable | TypeMaybeNumber | TypeMaybeString);
         }
         
-        static ResultType string()
+        static ResultType stringType()
         {
             return ResultType(TypeMaybeString);
         }
         
-        static ResultType unknown()
+        static ResultType unknownType()
         {
-            return ResultType(TypeMaybeNumber | TypeMaybeString | TypeMaybeNull | TypeMaybeBool | TypeMaybeOther);
+            return ResultType(TypeBits);
         }
         
         static ResultType forAdd(ResultType op1, ResultType op2)
         {
             if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
-                return reusableNumber();
-            if (op1.isNotNumber() || op2.isNotNumber())
-                return string();
-            return reusableNumberOrString();
+                return numberTypeCanReuse();
+            if (op1.definitelyIsString() || op2.definitelyIsString())
+                return stringType();
+            return stringOrNumberTypeCanReuse();
+        }
+        
+        static ResultType forBitOp()
+        {
+            return numberTypeCanReuseIsInt32();
         }
 
     private:
@@ -118,8 +138,11 @@ namespace JSC {
     
     struct OperandTypes
     {
-        OperandTypes(ResultType first = ResultType::unknown(), ResultType second = ResultType::unknown())
+        OperandTypes(ResultType first = ResultType::unknownType(), ResultType second = ResultType::unknownType())
         {
+            // We have to initialize one of the int to ensure that
+            // the entire struct is initialized.
+            m_u.i = 0;
             m_u.rds.first = first.m_type;
             m_u.rds.second = second.m_type;
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h b/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h
index 07da9e043f..1c59eeda40 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,10 +34,13 @@
 
 namespace JSC {
 
+    enum SourceBOMPresence { SourceHasNoBOMs, SourceCouldHaveBOMs };
+
     class SourceProvider : public RefCounted<SourceProvider> {
     public:
-        SourceProvider(const UString& url)
+        SourceProvider(const UString& url, SourceBOMPresence hasBOMs = SourceCouldHaveBOMs)
             : m_url(url)
+            , m_hasBOMs(hasBOMs)
         {
         }
         virtual ~SourceProvider() { }
@@ -49,8 +52,11 @@ namespace JSC {
         const UString& url() { return m_url; }
         intptr_t asID() { return reinterpret_cast<intptr_t>(this); }
 
+        SourceBOMPresence hasBOMs() const { return m_hasBOMs; }
+
     private:
         UString m_url;
+        SourceBOMPresence m_hasBOMs;
     };
 
     class UStringSourceProvider : public SourceProvider {
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
index de2f5bbaf2..8a2d1401b4 100755
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
@@ -244,7 +244,7 @@ sub readHeaderValues()
  
     my ($fh, $tempFile) = tempfile(
         basename($0) . "-XXXXXXXX",
-        DIR => ($ENV{'TMPDIR'} || "/tmp"),
+        DIR => File::Spec->tmpdir,
         SUFFIX => ".in",
         UNLINK => 0,
     );
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp
index 7ad5676424..2bedca669c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp
@@ -303,7 +303,10 @@ static int checkEscape(const UChar** ptrPtr, const UChar* patternEnd, ErrorCode*
                 }
                 
                 c = *ptr;
-                if (!isASCIIAlpha(c)) {
+
+                /* To match Firefox, inside a character class, we also accept
+                   numbers and '_' as control characters */
+                if ((!isClass && !isASCIIAlpha(c)) || (!isASCIIAlphanumeric(c) && c != '_')) {
                     c = '\\';
                     ptr -= 2;
                     break;
@@ -1058,11 +1061,6 @@ compileBranch(int options, int* brackets, unsigned char** codePtr,
                 
                 reqvary = (repeatMin == repeat_max) ? 0 : REQ_VARY;
                 
-                // A quantifier after an assertion is meaningless, since assertions
-                // don't move index forward. So, we discard it.
-                if (*previous == OP_ASSERT || *previous == OP_ASSERT_NOT)
-                    goto END_REPEAT;
-                
                 opType = 0;                    /* Default single-char op codes */
                 
                 /* Save start of previous item, in case we have to move it up to make space
@@ -1416,6 +1414,15 @@ compileBranch(int options, int* brackets, unsigned char** codePtr,
                         code[-ketoffset] = OP_KETRMAX + repeatType;
                 }
                 
+                // A quantifier after an assertion is mostly meaningless, but it
+                // can nullify the assertion if it has a 0 minimum.
+                else if (*previous == OP_ASSERT || *previous == OP_ASSERT_NOT) {
+                    if (repeatMin == 0) {
+                        code = previous;
+                        goto END_REPEAT;
+                    }
+                }
+                
                 /* Else there's some kind of shambles */
                 
                 else {
@@ -2209,7 +2216,7 @@ static int calculateCompiledPatternLength(const UChar* pattern, int patternLengt
                         
                         int d = -1;
                         if (safelyCheckNextChar(ptr, patternEnd, '-')) {
-                            UChar const *hyptr = ptr++;
+                            const UChar* hyptr = ptr++;
                             if (safelyCheckNextChar(ptr, patternEnd, '\\')) {
                                 ptr++;
                                 d = checkEscape(&ptr, patternEnd, &errorcode, cd.numCapturingBrackets, true);
@@ -2600,7 +2607,7 @@ JSRegExp* jsRegExpCompile(const UChar* pattern, int patternLength,
     
     const UChar* ptr = (const UChar*)pattern;
     const UChar* patternEnd = pattern + patternLength;
-    unsigned char* code = (unsigned char*)codeStart;
+    unsigned char* code = const_cast<unsigned char*>(codeStart);
     int firstByte, reqByte;
     int bracketCount = 0;
     if (!cd.needOuterBracket)
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
index cec34178a0..80a092ad2c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
@@ -175,7 +175,7 @@ reqByte match. */
 /* The below limit restricts the number of "recursive" match calls in order to
 avoid spending exponential time on complex regular expressions. */
 
-static const unsigned matchLimit = 100000;
+static const unsigned matchLimit = 1000000;
 
 #ifdef DEBUG
 /*************************************************
@@ -447,6 +447,7 @@ static int match(const UChar* subjectPtr, const unsigned char* instructionPtr, i
     int min;
     bool minimize = false; /* Initialization not really needed, but some compilers think so. */
     unsigned remainingMatchCount = matchLimit;
+    int othercase; /* Declare here to avoid errors during jumps */
     
     MatchStack stack;
 
@@ -1186,7 +1187,7 @@ RECURSE:
                 stack.currentFrame->args.instructionPtr += stack.currentFrame->locals.length;
                 
                 if (stack.currentFrame->locals.fc <= 0xFFFF) {
-                    int othercase = md.ignoreCase ? jsc_pcre_ucp_othercase(stack.currentFrame->locals.fc) : -1;
+                    othercase = md.ignoreCase ? jsc_pcre_ucp_othercase(stack.currentFrame->locals.fc) : -1;
                     
                     for (int i = 1; i <= min; i++) {
                         if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc && *stack.currentFrame->args.subjectPtr != othercase)
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h
index 29167655af..0016bb56d5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h
@@ -85,7 +85,7 @@ total length. */
 offsets within the compiled regex. The default is 2, which allows for compiled
 patterns up to 64K long. */
 
-#define LINK_SIZE   2
+#define LINK_SIZE   3
 
 /* Define DEBUG to get debugging output on stdout. */
 
@@ -124,28 +124,60 @@ static inline void put2ByteValue(unsigned char* opcodePtr, int value)
     opcodePtr[1] = value;
 }
 
+static inline void put3ByteValue(unsigned char* opcodePtr, int value)
+{
+    ASSERT(value >= 0 && value <= 0xFFFFFF);
+    opcodePtr[0] = value >> 16;
+    opcodePtr[1] = value >> 8;
+    opcodePtr[2] = value;
+}
+
 static inline int get2ByteValue(const unsigned char* opcodePtr)
 {
     return (opcodePtr[0] << 8) | opcodePtr[1];
 }
 
+static inline int get3ByteValue(const unsigned char* opcodePtr)
+{
+    return (opcodePtr[0] << 16) | (opcodePtr[1] << 8) | opcodePtr[2];
+}
+
 static inline void put2ByteValueAndAdvance(unsigned char*& opcodePtr, int value)
 {
     put2ByteValue(opcodePtr, value);
     opcodePtr += 2;
 }
 
+static inline void put3ByteValueAndAdvance(unsigned char*& opcodePtr, int value)
+{
+    put3ByteValue(opcodePtr, value);
+    opcodePtr += 3;
+}
+
 static inline void putLinkValueAllowZero(unsigned char* opcodePtr, int value)
 {
+#if LINK_SIZE == 3
+    put3ByteValue(opcodePtr, value);
+#elif LINK_SIZE == 2
     put2ByteValue(opcodePtr, value);
+#else
+#   error LINK_SIZE not supported.
+#endif
 }
 
 static inline int getLinkValueAllowZero(const unsigned char* opcodePtr)
 {
+#if LINK_SIZE == 3
+    return get3ByteValue(opcodePtr);
+#elif LINK_SIZE == 2
     return get2ByteValue(opcodePtr);
+#else
+#   error LINK_SIZE not supported.
+#endif
 }
 
-#define MAX_PATTERN_SIZE (1 << 16)
+#define MAX_PATTERN_SIZE 1024 * 1024 // Derived by empirical testing of compile time in PCRE and WREC.
+COMPILE_ASSERT(MAX_PATTERN_SIZE < (1 << (8 * LINK_SIZE)), pcre_max_pattern_fits_in_bytecode);
 
 static inline void putLinkValue(unsigned char* opcodePtr, int value)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
index 6ceef13641..c2c25d5fed 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
@@ -51,32 +51,34 @@ namespace JSC {
         inline bool operator==(const CallIdentifier& ci) const { return ci.m_lineNumber == m_lineNumber && ci.m_name == m_name && ci.m_url == m_url; }
         inline bool operator!=(const CallIdentifier& ci) const { return !(*this == ci); }
 
+        struct Hash {
+            static unsigned hash(const CallIdentifier& key)
+            {
+                unsigned hashCodes[3] = {
+                    key.m_name.rep()->hash(),
+                    key.m_url.rep()->hash(),
+                    key.m_lineNumber
+                };
+                return UString::Rep::computeHash(reinterpret_cast<char*>(hashCodes), sizeof(hashCodes));
+            }
+
+            static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
+            static const bool safeToCompareToEmptyOrDeleted = true;
+        };
+
+        unsigned hash() const { return Hash::hash(*this); }
+
 #ifndef NDEBUG
         operator const char*() const { return c_str(); }
         const char* c_str() const { return m_name.UTF8String().c_str(); }
 #endif
     };
 
-    struct CallIdentifierHash {
-        static unsigned hash(const CallIdentifier& key)
-        {
-            unsigned hashCodes[3] = {
-                key.m_name.rep()->hash(),
-                key.m_url.rep()->hash(),
-                key.m_lineNumber
-            };
-            return UString::Rep::computeHash(reinterpret_cast<char*>(hashCodes), sizeof(hashCodes));
-        }
-
-        static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
-        static const bool safeToCompareToEmptyOrDeleted = true;
-    };
-
 } // namespace JSC
 
 namespace WTF {
 
-    template<> struct DefaultHash<JSC::CallIdentifier> { typedef JSC::CallIdentifierHash Hash; };
+    template<> struct DefaultHash<JSC::CallIdentifier> { typedef JSC::CallIdentifier::Hash Hash; };
 
     template<> struct HashTraits<JSC::CallIdentifier> : GenericHashTraits<JSC::CallIdentifier> {
         static void constructDeletedValue(JSC::CallIdentifier& slot)
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
index 5ea9d3b9ed..e69de29bb2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
@@ -1,115 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "HeavyProfile.h"
-
-#include "TreeProfile.h"
-
-namespace JSC {
-
-HeavyProfile::HeavyProfile(TreeProfile* treeProfile)
-    : Profile(treeProfile->title(), treeProfile->uid())
-{
-    m_treeProfile = treeProfile;
-    head()->setTotalTime(m_treeProfile->head()->actualTotalTime());
-    head()->setSelfTime(m_treeProfile->head()->actualSelfTime());
-    generateHeavyStructure();
-}
-
-void HeavyProfile::generateHeavyStructure()
-{
-    ProfileNode* treeHead = m_treeProfile->head();
-    ProfileNode* currentNode = treeHead->firstChild();
-    for (ProfileNode* nextNode = currentNode; nextNode; nextNode = nextNode->firstChild())
-        currentNode = nextNode;
-
-    // For each node
-    HashMap<CallIdentifier, ProfileNode*> foundChildren;
-    while (currentNode && currentNode != treeHead) {
-        ProfileNode* child = foundChildren.get(currentNode->callIdentifier());
-        if (child) // currentNode is in the set already
-            mergeProfiles(child, currentNode);
-        else { // currentNode is not in the set
-            child = addNode(currentNode);
-            foundChildren.set(currentNode->callIdentifier(), child);
-        }
-
-        currentNode = currentNode->traverseNextNodePostOrder();
-    }
-}
-
-ProfileNode* HeavyProfile::addNode(ProfileNode* currentNode)
-{
-    RefPtr<ProfileNode> node = ProfileNode::create(head(), currentNode);
-    head()->addChild(node);
-
-    addAncestorsAsChildren(currentNode->parent(), node.get());
-    return node.get();
-}
-
-void HeavyProfile::mergeProfiles(ProfileNode* heavyProfileHead, ProfileNode* treeProfileHead)
-{
-    ASSERT_ARG(heavyProfileHead, heavyProfileHead);
-    ASSERT_ARG(treeProfileHead, treeProfileHead);
-
-    ProfileNode* currentTreeNode = treeProfileHead;
-    ProfileNode* currentHeavyNode = heavyProfileHead;
-    ProfileNode* previousHeavyNode = 0;
-    
-    while (currentHeavyNode) {
-        previousHeavyNode = currentHeavyNode;
-
-        currentHeavyNode->setTotalTime(currentHeavyNode->actualTotalTime() + currentTreeNode->actualTotalTime());
-        currentHeavyNode->setSelfTime(currentHeavyNode->actualSelfTime() + currentTreeNode->actualSelfTime());
-        currentHeavyNode->setNumberOfCalls(currentHeavyNode->numberOfCalls() + currentTreeNode->numberOfCalls());
-
-        currentTreeNode = currentTreeNode->parent();
-        currentHeavyNode = currentHeavyNode->findChild(currentTreeNode);
-    }
-
-    // If currentTreeNode is null then we already have the whole tree we wanted to copy.
-    // If not we need to copy the subset of the tree that remains different between the two.
-    if (currentTreeNode)
-        addAncestorsAsChildren(currentTreeNode, previousHeavyNode);
-}
-
-void HeavyProfile::addAncestorsAsChildren(ProfileNode* getFrom, ProfileNode* addTo)
-{
-    ASSERT_ARG(getFrom, getFrom);
-    ASSERT_ARG(addTo, addTo);
-
-    if (!getFrom->head())
-        return;
-
-    RefPtr<ProfileNode> currentNode = addTo;
-    for (ProfileNode* treeAncestor = getFrom; treeAncestor && treeAncestor != getFrom->head(); treeAncestor = treeAncestor->parent()) {
-        RefPtr<ProfileNode> newChild = ProfileNode::create(currentNode->head(), treeAncestor);
-        currentNode->addChild(newChild);
-        currentNode = newChild.release();
-    }
-}
-
-}   // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
index 903d091cc2..e69de29bb2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- 
-#ifndef HeavyProfile_h
-#define HeavyProfile_h
-
-#include "Profile.h"
-#include "ProfileNode.h"
-#include "TreeProfile.h"
-
-namespace JSC {
-
-    class UString;
-
-    class HeavyProfile : public Profile {
-    public:
-        static PassRefPtr<HeavyProfile> create(TreeProfile* treeProfile)
-        {
-            return adoptRef(new HeavyProfile(treeProfile));
-        }
-
-        virtual Profile* heavyProfile() { return this; }
-        virtual Profile* treeProfile()
-        {
-            return m_treeProfile;
-        }
-
-
-    private:
-        HeavyProfile(TreeProfile*);
-        void generateHeavyStructure();
-        ProfileNode* addNode(ProfileNode*);
-        void mergeProfiles(ProfileNode* heavyProfileHead, ProfileNode* treeProfileHead);
-        void addAncestorsAsChildren(ProfileNode* getFrom, ProfileNode* addTo);
-
-        TreeProfile* m_treeProfile;
-    };
-
-} // namespace JSC
-
-#endif // HeavyProfile_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
index 72e6d21a0b..de75e71c61 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
@@ -27,14 +27,13 @@
 #include "Profile.h"
 
 #include "ProfileNode.h"
-#include "TreeProfile.h"
 #include <stdio.h>
 
 namespace JSC {
 
 PassRefPtr<Profile> Profile::create(const UString& title, unsigned uid)
 {
-    return TreeProfile::create(title, uid);
+    return adoptRef(new Profile(title, uid));
 }
 
 Profile::Profile(const UString& title, unsigned uid)
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h
index dd96f77fc5..6bf29f7a6f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h
@@ -45,22 +45,11 @@ namespace JSC {
         unsigned int uid() const { return m_uid; }
 
         void forEach(void (ProfileNode::*)());
-        void sortTotalTimeDescending() { forEach(&ProfileNode::sortTotalTimeDescending); }
-        void sortTotalTimeAscending() { forEach(&ProfileNode::sortTotalTimeAscending); }
-        void sortSelfTimeDescending() { forEach(&ProfileNode::sortSelfTimeDescending); }
-        void sortSelfTimeAscending() { forEach(&ProfileNode::sortSelfTimeAscending); }
-        void sortCallsDescending() { forEach(&ProfileNode::sortCallsDescending); }
-        void sortCallsAscending() { forEach(&ProfileNode::sortCallsAscending); }
-        void sortFunctionNameDescending() { forEach(&ProfileNode::sortFunctionNameDescending); }
-        void sortFunctionNameAscending() { forEach(&ProfileNode::sortFunctionNameAscending); }
 
         void focus(const ProfileNode*);
         void exclude(const ProfileNode*);
         void restoreAll();
 
-        virtual Profile* heavyProfile() = 0;
-        virtual Profile* treeProfile() = 0; 
-
 #ifndef NDEBUG
         void debugPrintData() const;
         void debugPrintDataSampleStyle() const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
index 62e9fe3230..1a061cb9cb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -59,10 +59,10 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
     int lineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
-    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function->toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
+    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     m_head->insertNode(m_currentNode.get());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
index 54d45658ef..cccb502d43 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
@@ -26,6 +26,7 @@
 #ifndef ProfileGenerator_h
 #define ProfileGenerator_h
 
+#include "Profile.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
index 3458902d17..bf0bbcb14b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
@@ -204,12 +204,6 @@ ProfileNode* ProfileNode::traverseNextNodePreOrder(bool processChildren) const
     return next;
 }
 
-void ProfileNode::sort(bool comparator(const RefPtr<ProfileNode>& , const RefPtr<ProfileNode>& ))
-{
-    std::sort(childrenBegin(), childrenEnd(), comparator);    
-    resetChildrensSiblings();
-}
-
 void ProfileNode::setTreeVisible(ProfileNode* node, bool visible)
 {
     ProfileNode* nodeParent = node->parent();
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h
index b41601128e..2b5a93602f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h
@@ -112,16 +112,6 @@ namespace JSC {
         ProfileNode* traverseNextNodePostOrder() const;
         ProfileNode* traverseNextNodePreOrder(bool processChildren = true) const;
 
-        void sort(bool (*)(const RefPtr<ProfileNode>&, const RefPtr<ProfileNode>&));
-        void sortTotalTimeDescending() { sort(totalTimeDescendingComparator); }
-        void sortTotalTimeAscending() { sort(totalTimeAscendingComparator); }
-        void sortSelfTimeDescending() { sort(selfTimeDescendingComparator); }
-        void sortSelfTimeAscending() { sort(selfTimeAscendingComparator); }
-        void sortCallsDescending() { sort(callsDescendingComparator); }
-        void sortCallsAscending() { sort(callsAscendingComparator); }
-        void sortFunctionNameDescending() { sort(functionNameDescendingComparator); }
-        void sortFunctionNameAscending() { sort(functionNameAscendingComparator); }
-
         // Views
         void calculateVisibleTotalTime();
         bool focus(const CallIdentifier&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
index 3df3b3f27c..e103fd19fb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
@@ -33,6 +33,7 @@
 #include "CallFrame.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
+#include "Nodes.h"
 #include "Profile.h"
 #include "ProfileGenerator.h"
 #include "ProfileNode.h"
@@ -58,6 +59,8 @@ Profiler* Profiler::profiler()
 
 void Profiler::startProfiling(ExecState* exec, const UString& title)
 {
+    ASSERT_ARG(title, !title.isNull());
+
     // Check if we currently have a Profile for this global ExecState and title.
     // If so return early and don't create a new Profile.
     ExecState* globalExec = exec ? exec->lexicalGlobalObject()->globalExec() : 0;
@@ -101,7 +104,7 @@ static inline void dispatchFunctionToProfiles(const Vector<RefPtr<ProfileGenerat
     }
 }
 
-void Profiler::willExecute(ExecState* exec, JSValuePtr function)
+void Profiler::willExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -112,12 +115,12 @@ void Profiler::willExecute(ExecState* exec, const UString& sourceURL, int starti
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), noValue(), sourceURL, startingLineNumber);
+    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber);
 
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, callIdentifier, exec->lexicalGlobalObject()->profileGroup());
 }
 
-void Profiler::didExecute(ExecState* exec, JSValuePtr function)
+void Profiler::didExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -128,17 +131,20 @@ void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startin
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), noValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValuePtr function, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue function, const UString& defaultSourceURL, int defaultLineNumber)
 {
     if (!function)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
-    if (!function->isObject())
+    if (!function.isObject())
         return CallIdentifier("(unknown)", defaultSourceURL, defaultLineNumber);
-    if (asObject(function)->inherits(&JSFunction::info))
-        return createCallIdentifierFromFunctionImp(globalData, asFunction(function));
+    if (asObject(function)->inherits(&JSFunction::info)) {
+        JSFunction* func = asFunction(function);
+        if (!func->isHostFunction())
+            return createCallIdentifierFromFunctionImp(globalData, func);
+    }
     if (asObject(function)->inherits(&InternalFunction::info))
         return CallIdentifier(static_cast<InternalFunction*>(asObject(function))->name(globalData), defaultSourceURL, defaultLineNumber);
     return CallIdentifier("(" + asObject(function)->className() + " object)", defaultSourceURL, defaultLineNumber);
@@ -146,7 +152,7 @@ CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValueP
 
 CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
 {
-    const UString& name = function->name(globalData);
+    const UString& name = function->calculatedDisplayName(globalData);
     return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->body()->sourceURL(), function->body()->lineNo());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
index d00bccf881..b37f613561 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
@@ -40,7 +40,7 @@ namespace JSC {
     class ExecState;
     class JSGlobalData;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ProfileGenerator;
     class UString;
 
@@ -52,14 +52,14 @@ namespace JSC {
         }
 
         static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValuePtr, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValue, const UString& sourceURL, int lineNumber);
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
 
-        void willExecute(ExecState*, JSValuePtr function);
+        void willExecute(ExecState*, JSValue function);
         void willExecute(ExecState*, const UString& sourceURL, int startingLineNumber);
-        void didExecute(ExecState*, JSValuePtr function);
+        void didExecute(ExecState*, JSValue function);
         void didExecute(ExecState*, const UString& sourceURL, int startingLineNumber);
 
         const Vector<RefPtr<ProfileGenerator> >& currentProfiles() { return m_currentProfiles; };
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
index 0c7fedb7d9..e69de29bb2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "TreeProfile.h"
-
-#include "HeavyProfile.h"
-
-namespace JSC {
-
-PassRefPtr<TreeProfile> TreeProfile::create(const UString& title, unsigned uid)
-{
-    return adoptRef(new TreeProfile(title, uid));
-}
-
-TreeProfile::TreeProfile(const UString& title, unsigned uid)
-    : Profile(title, uid)
-{
-}
-
-Profile* TreeProfile::heavyProfile()
-{
-    if (!m_heavyProfile)
-        m_heavyProfile = HeavyProfile::create(this);
-
-    return m_heavyProfile.get();
-}
-
-} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
index ebef4d8b2a..e69de29bb2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- 
-#ifndef TreeProfile_h
-#define TreeProfile_h
-
-#include "Profile.h"
-
-namespace JSC {
-
-    class ExecState;
-    class HeavyProfile;
-    class UString;
-
-    class TreeProfile : public Profile {
-    public:
-        static PassRefPtr<TreeProfile> create(const UString& title, unsigned uid);
-
-        virtual Profile* heavyProfile();
-        virtual Profile* treeProfile() { return this; }
-
-    private:
-        TreeProfile(const UString& title, unsigned uid);
-        RefPtr<HeavyProfile> m_heavyProfile;
-    };
-
-} // namespace JSC
-
-#endif // TreeProfiler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
index 5ead73360f..0b5d958b6a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
@@ -30,19 +30,18 @@ namespace JSC {
 
 void ArgList::getSlice(int startIndex, ArgList& result) const
 {
-    ASSERT(!result.m_isReadOnly);
-
-    const_iterator start = min(begin() + startIndex, end());
-    result.m_vector.appendRange(start, end());
-    result.m_size = result.m_vector.size();
-    result.m_buffer = result.m_vector.data();
+    if (startIndex <= 0 || static_cast<unsigned>(startIndex) >= m_argCount) {
+        result = ArgList(m_args, 0);
+        return;
+    }
+    result = ArgList(m_args + startIndex, m_argCount - startIndex);
 }
 
-void ArgList::markLists(ListSet& markSet)
+void MarkedArgumentBuffer::markLists(ListSet& markSet)
 {
     ListSet::iterator end = markSet.end();
     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
-        ArgList* list = *it;
+        MarkedArgumentBuffer* list = *it;
 
         iterator end2 = list->end();
         for (iterator it2 = list->begin(); it2 != end2; ++it2)
@@ -51,7 +50,7 @@ void ArgList::markLists(ListSet& markSet)
     }
 }
 
-void ArgList::slowAppend(JSValuePtr v)
+void MarkedArgumentBuffer::slowAppend(JSValue v)
 {
     // As long as our size stays within our Vector's inline 
     // capacity, all our values are allocated on the stack, and 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
index a1763e0a6e..8e85d7f3ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Computer, Inc.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Computer, Inc.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -31,11 +31,11 @@
 
 namespace JSC {
     
-    class ArgList : Noncopyable {
+    class MarkedArgumentBuffer : Noncopyable {
     private:
         static const unsigned inlineCapacity = 8;
         typedef Vector<Register, inlineCapacity> VectorType;
-        typedef HashSet<ArgList*> ListSet;
+        typedef HashSet<MarkedArgumentBuffer*> ListSet;
 
     public:
         typedef VectorType::iterator iterator;
@@ -43,7 +43,7 @@ namespace JSC {
 
         // Constructor for a read-write list, to which you may append values.
         // FIXME: Remove all clients of this API, then remove this API.
-        ArgList()
+        MarkedArgumentBuffer()
             : m_markSet(0)
 #ifndef NDEBUG
             , m_isReadOnly(false)
@@ -54,7 +54,7 @@ namespace JSC {
         }
 
         // Constructor for a read-only list whose data has already been allocated elsewhere.
-        ArgList(Register* buffer, size_t size)
+        MarkedArgumentBuffer(Register* buffer, size_t size)
             : m_buffer(buffer)
             , m_size(size)
             , m_markSet(0)
@@ -76,7 +76,7 @@ namespace JSC {
 #endif
         }
 
-        ~ArgList()
+        ~MarkedArgumentBuffer()
         {
             if (m_markSet)
                 m_markSet->remove(this);
@@ -85,10 +85,10 @@ namespace JSC {
         size_t size() const { return m_size; }
         bool isEmpty() const { return !m_size; }
 
-        JSValuePtr at(ExecState* exec, size_t i) const
+        JSValue at(size_t i) const
         {
             if (i < m_size)
-                return m_buffer[i].jsValue(exec);
+                return m_buffer[i].jsValue();
             return jsUndefined();
         }
 
@@ -99,7 +99,7 @@ namespace JSC {
             m_size = 0;
         }
 
-        void append(JSValuePtr v)
+        void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
             
@@ -114,8 +114,6 @@ namespace JSC {
             }
         }
 
-        void getSlice(int startIndex, ArgList& result) const;
-
         iterator begin() { return m_buffer; }
         iterator end() { return m_buffer + m_size; }
 
@@ -125,7 +123,7 @@ namespace JSC {
         static void markLists(ListSet&);
 
     private:
-        void slowAppend(JSValuePtr);
+        void slowAppend(JSValue);
         
         Register* m_buffer;
         size_t m_size;
@@ -156,6 +154,60 @@ namespace JSC {
         void operator delete(void*, size_t);
     };
 
+    class ArgList {
+        friend class JIT;
+    public:
+        typedef JSValue* iterator;
+        typedef const JSValue* const_iterator;
+
+        ArgList()
+            : m_args(0)
+            , m_argCount(0)
+        {
+        }
+        
+        ArgList(JSValue* args, unsigned argCount)
+            : m_args(args)
+            , m_argCount(argCount)
+        {
+        }
+        
+        ArgList(Register* args, int argCount)
+            : m_args(reinterpret_cast<JSValue*>(args))
+            , m_argCount(argCount)
+        {
+            ASSERT(argCount >= 0);
+        }
+
+        ArgList(const MarkedArgumentBuffer& args)
+            : m_args(reinterpret_cast<JSValue*>(const_cast<Register*>(args.begin())))
+            , m_argCount(args.size())
+        {
+        }
+
+        JSValue at(size_t idx) const
+        {
+            if (idx < m_argCount)
+                return m_args[idx];
+            return jsUndefined();
+        }
+
+        bool isEmpty() const { return !m_argCount; }
+
+        size_t size() const { return m_argCount; }
+        
+        iterator begin() { return m_args; }
+        iterator end() { return m_args + m_argCount; }
+        
+        const_iterator begin() const { return m_args; }
+        const_iterator end() const { return m_args + m_argCount; }
+
+        void getSlice(int startIndex, ArgList& result) const;
+    private:
+        JSValue* m_args;
+        size_t m_argCount;
+    };
+
 } // namespace JSC
 
 #endif // ArgList_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
index b0429a9f79..f867fe81f1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
@@ -69,8 +69,50 @@ void Arguments::mark()
         d->activation->mark();
 }
 
-void Arguments::fillArgList(ExecState* exec, ArgList& args)
+void Arguments::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
 {
+    if (UNLIKELY(d->overrodeLength)) {
+        unsigned length = min(get(exec, exec->propertyNames().length).toUInt32(exec), maxSize);
+        for (unsigned i = 0; i < length; i++)
+            buffer[i] = get(exec, i);
+        return;
+    }
+
+    if (LIKELY(!d->deletedArguments)) {
+        unsigned parametersLength = min(min(d->numParameters, d->numArguments), maxSize);
+        unsigned i = 0;
+        for (; i < parametersLength; ++i)
+            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+        for (; i < d->numArguments; ++i)
+            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+        return;
+    }
+    
+    unsigned parametersLength = min(min(d->numParameters, d->numArguments), maxSize);
+    unsigned i = 0;
+    for (; i < parametersLength; ++i) {
+        if (!d->deletedArguments[i])
+            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+        else
+            buffer[i] = get(exec, i);
+    }
+    for (; i < d->numArguments; ++i) {
+        if (!d->deletedArguments[i])
+            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+        else
+            buffer[i] = get(exec, i);
+    }
+}
+
+void Arguments::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
+{
+    if (UNLIKELY(d->overrodeLength)) {
+        unsigned length = get(exec, exec->propertyNames().length).toUInt32(exec); 
+        for (unsigned i = 0; i < length; i++) 
+            args.append(get(exec, i)); 
+        return;
+    }
+
     if (LIKELY(!d->deletedArguments)) {
         if (LIKELY(!d->numParameters)) {
             args.initialize(d->extraArguments, d->numArguments);
@@ -85,9 +127,9 @@ void Arguments::fillArgList(ExecState* exec, ArgList& args)
         unsigned parametersLength = min(d->numParameters, d->numArguments);
         unsigned i = 0;
         for (; i < parametersLength; ++i)
-            args.append(d->registers[d->firstParameterIndex + i].jsValue(exec));
+            args.append(d->registers[d->firstParameterIndex + i].jsValue());
         for (; i < d->numArguments; ++i)
-            args.append(d->extraArguments[i - d->numParameters].jsValue(exec));
+            args.append(d->extraArguments[i - d->numParameters].jsValue());
         return;
     }
 
@@ -95,13 +137,13 @@ void Arguments::fillArgList(ExecState* exec, ArgList& args)
     unsigned i = 0;
     for (; i < parametersLength; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->registers[d->firstParameterIndex + i].jsValue(exec));
+            args.append(d->registers[d->firstParameterIndex + i].jsValue());
         else
             args.append(get(exec, i));
     }
     for (; i < d->numArguments; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->extraArguments[i - d->numParameters].jsValue(exec));
+            args.append(d->extraArguments[i - d->numParameters].jsValue());
         else
             args.append(get(exec, i));
     }
@@ -113,7 +155,7 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& sl
         if (i < d->numParameters) {
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
+            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
         return true;
     }
 
@@ -128,7 +170,7 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
         if (i < d->numParameters) {
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
+            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
         return true;
     }
 
@@ -145,28 +187,28 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void Arguments::put(ExecState* exec, unsigned i, JSValuePtr value, PutPropertySlot& slot)
+void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValuePtr(value);
+            d->registers[d->firstParameterIndex + i] = JSValue(value);
         else
-            d->extraArguments[i - d->numParameters] = JSValuePtr(value);
+            d->extraArguments[i - d->numParameters] = JSValue(value);
         return;
     }
 
     JSObject::put(exec, Identifier(exec, UString::from(i)), value, slot);
 }
 
-void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValuePtr(value);
+            d->registers[d->firstParameterIndex + i] = JSValue(value);
         else
-            d->extraArguments[i - d->numParameters] = JSValuePtr(value);
+            d->extraArguments[i - d->numParameters] = JSValue(value);
         return;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index ebea6ad155..72697eb33a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -63,8 +63,16 @@ namespace JSC {
 
         virtual void mark();
 
-        void fillArgList(ExecState*, ArgList&);
+        void fillArgList(ExecState*, MarkedArgumentBuffer&);
 
+        uint32_t numProvidedArguments(ExecState* exec) const 
+        {
+            if (UNLIKELY(d->overrodeLength))
+                return get(exec, exec->propertyNames().length).toUInt32(exec);
+            return d->numArguments; 
+        }
+        
+        void copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize);
         void copyRegisters();
         bool isTornOff() const { return d->registerArray; }
         void setActivation(JSActivation* activation)
@@ -73,7 +81,7 @@ namespace JSC {
             d->registers = &activation->registerAt(0);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype) 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
             return Structure::create(prototype, TypeInfo(ObjectType)); 
         }
@@ -82,8 +90,8 @@ namespace JSC {
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
@@ -94,9 +102,9 @@ namespace JSC {
         OwnPtr<ArgumentsData> d;
     };
 
-    Arguments* asArguments(JSValuePtr);
+    Arguments* asArguments(JSValue);
 
-    inline Arguments* asArguments(JSValuePtr value)
+    inline Arguments* asArguments(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&Arguments::info));
         return static_cast<Arguments*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
index e63abbc213..e96bdfc7bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -26,6 +26,7 @@
 
 #include "ArrayPrototype.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "Lookup.h"
 
 namespace JSC {
@@ -45,15 +46,15 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, PassRefPtr<Structure> struct
 static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
     // a single numeric argument denotes the array size (!)
-    if (args.size() == 1 && args.at(exec, 0)->isNumber()) {
-        uint32_t n = args.at(exec, 0)->toUInt32(exec);
-        if (n != args.at(exec, 0)->toNumber(exec))
+    if (args.size() == 1 && args.at(0).isNumber()) {
+        uint32_t n = args.at(0).toUInt32(exec);
+        if (n != args.at(0).toNumber(exec))
             return throwError(exec, RangeError, "Array size is not a small enough positive integer.");
         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), n);
     }
 
     // otherwise the array is constructed with the arguments in it
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), args);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), args);
 }
 
 static JSObject* constructWithArrayConstructor(ExecState* exec, JSObject*, const ArgList& args)
@@ -68,7 +69,7 @@ ConstructType ArrayConstructor::getConstructData(ConstructData& constructData)
     return ConstructTypeHost;
 }
 
-static JSValuePtr callArrayConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callArrayConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructArrayWithSizeQuirk(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 0d6ebddee0..807e59a671 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
@@ -24,7 +24,10 @@
 #include "config.h"
 #include "ArrayPrototype.h"
 
+#include "CodeBlock.h"
+#include "CachedCall.h"
 #include "Interpreter.h"
+#include "JIT.h"
 #include "ObjectPrototype.h"
 #include "Lookup.h"
 #include "Operations.h"
@@ -36,25 +39,27 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ArrayPrototype);
 
-static JSValuePtr arrayProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncConcat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncJoin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncPop(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncPush(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncReverse(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncShift(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSlice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSort(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSplice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncUnShift(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncEvery(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncForEach(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSome(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncFilter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncMap(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -62,6 +67,23 @@ static JSValuePtr arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, c
 
 namespace JSC {
 
+static inline bool isNumericCompareFunction(CallType callType, const CallData& callData)
+{
+    if (callType != CallTypeJS)
+        return false;
+
+#if ENABLE(JIT)
+    // If the JIT is enabled then we need to preserve the invariant that every
+    // function with a CodeBlock also has JIT code.
+    callData.js.functionBody->jitCode(callData.js.scopeChain);
+    CodeBlock& codeBlock = callData.js.functionBody->generatedBytecode();
+#else
+    CodeBlock& codeBlock = callData.js.functionBody->bytecode(callData.js.scopeChain);
+#endif
+
+    return codeBlock.isNumericCompareFunction();
+}
+
 // ------------------------------ ArrayPrototype ----------------------------
 
 const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::arrayTable};
@@ -86,6 +108,8 @@ const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::a
   indexOf        arrayProtoFuncIndexOf        DontEnum|Function 1
   lastIndexOf    arrayProtoFuncLastIndexOf    DontEnum|Function 1
   filter         arrayProtoFuncFilter         DontEnum|Function 1
+  reduce         arrayProtoFuncReduce         DontEnum|Function 1
+  reduceRight    arrayProtoFuncReduceRight    DontEnum|Function 1
   map            arrayProtoFuncMap            DontEnum|Function 1
 @end
 */
@@ -104,36 +128,38 @@ bool ArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prope
 // ------------------------------ Array Functions ----------------------------
 
 // Helper function
-static JSValuePtr getProperty(ExecState* exec, JSObject* obj, unsigned index)
+static JSValue getProperty(ExecState* exec, JSObject* obj, unsigned index)
 {
     PropertySlot slot(obj);
     if (!obj->getPropertySlot(exec, index, slot))
-        return noValue();
+        return JSValue();
     return slot.getValue(exec, index);
 }
 
-static void putProperty(ExecState* exec, JSObject* obj, const Identifier& propertyName, JSValuePtr value)
+static void putProperty(ExecState* exec, JSObject* obj, const Identifier& propertyName, JSValue value)
 {
     PutPropertySlot slot;
     obj->put(exec, propertyName, value, slot);
 }
 
-JSValuePtr arrayProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&JSArray::info))
+    if (!thisValue.isObject(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoiding infinite recursion.
 
     Vector<UChar, 256> strBuffer;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
@@ -143,11 +169,11 @@ JSValuePtr arrayProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVal
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
-        if (element->isUndefinedOrNull())
+        JSValue element = thisObj->get(exec, k);
+        if (element.isUndefinedOrNull())
             continue;
 
-        UString str = element->toString(exec);
+        UString str = element.toString(exec);
         strBuffer.append(str.data(), str.size());
 
         if (!strBuffer.data()) {
@@ -162,22 +188,24 @@ JSValuePtr arrayProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVal
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&JSArray::info))
+    if (!thisValue.isObject(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
     Vector<UChar, 256> strBuffer;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
@@ -187,19 +215,19 @@ JSValuePtr arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr t
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
-        if (element->isUndefinedOrNull())
+        JSValue element = thisObj->get(exec, k);
+        if (element.isUndefinedOrNull())
             continue;
 
-        JSObject* o = element->toObject(exec);
-        JSValuePtr conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
+        JSObject* o = element.toObject(exec);
+        JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
         UString str;
         CallData callData;
-        CallType callType = conversionFunction->getCallData(callData);
+        CallType callType = conversionFunction.getCallData(callData);
         if (callType != CallTypeNone)
-            str = call(exec, conversionFunction, callType, callData, element, exec->emptyList())->toString(exec);
+            str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
         else
-            str = element->toString(exec);
+            str = element.toString(exec);
         strBuffer.append(str.data(), str.size());
 
         if (!strBuffer.data()) {
@@ -214,13 +242,15 @@ JSValuePtr arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr t
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
@@ -229,9 +259,9 @@ JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue,
     Vector<UChar, 256> strBuffer;
 
     UChar comma = ',';
-    UString separator = args.at(exec, 0)->isUndefined() ? UString(&comma, 1) : args.at(exec, 0)->toString(exec);
+    UString separator = args.at(0).isUndefined() ? UString(&comma, 1) : args.at(0).toString(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(separator.data(), separator.size());
@@ -241,11 +271,11 @@ JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue,
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
-        if (element->isUndefinedOrNull())
+        JSValue element = thisObj->get(exec, k);
+        if (element.isUndefinedOrNull())
             continue;
 
-        UString str = element->toString(exec);
+        UString str = element.toString(exec);
         strBuffer.append(str.data(), str.size());
 
         if (!strBuffer.data()) {
@@ -260,19 +290,19 @@ JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSArray* arr = constructEmptyArray(exec);
     int n = 0;
-    JSValuePtr curArg = thisValue->toThisObject(exec);
+    JSValue curArg = thisValue.toThisObject(exec);
     ArgList::const_iterator it = args.begin();
     ArgList::const_iterator end = args.end();
     while (1) {
-        if (curArg->isObject(&JSArray::info)) {
-            JSArray* curArray = asArray(curArg);
-            unsigned length = curArray->length();
+        if (curArg.isObject(&JSArray::info)) {
+            unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);
+            JSObject* curObject = curArg.toObject(exec);
             for (unsigned k = 0; k < length; ++k) {
-                if (JSValuePtr v = getProperty(exec, curArray, k))
+                if (JSValue v = getProperty(exec, curObject, k))
                     arr->put(exec, n, v);
                 n++;
             }
@@ -282,21 +312,21 @@ JSValuePtr arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue
         }
         if (it == end)
             break;
-        curArg = (*it).jsValue(exec);
+        curArg = (*it);
         ++it;
     }
     arr->setLength(n);
     return arr;
 }
 
-JSValuePtr arrayProtoFuncPop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (exec->interpreter()->isJSArray(thisValue))
+    if (isJSArray(&exec->globalData(), thisValue))
         return asArray(thisValue)->pop();
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    JSValuePtr result;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSValue result;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
         result = jsUndefined();
@@ -308,33 +338,33 @@ JSValuePtr arrayProtoFuncPop(ExecState* exec, JSObject*, JSValuePtr thisValue, c
     return result;
 }
 
-JSValuePtr arrayProtoFuncPush(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (exec->interpreter()->isJSArray(thisValue) && args.size() == 1) {
+    if (isJSArray(&exec->globalData(), thisValue) && args.size() == 1) {
         JSArray* array = asArray(thisValue);
-        array->push(exec, args.begin()->jsValue(exec));
+        array->push(exec, *args.begin());
         return jsNumber(exec, array->length());
     }
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned n = 0; n < args.size(); n++)
-        thisObj->put(exec, length + n, args.at(exec, n));
+        thisObj->put(exec, length + n, args.at(n));
     length += args.size();
     putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
     return jsNumber(exec, length);
 }
 
-JSValuePtr arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned middle = length / 2;
 
     for (unsigned k = 0; k < middle; k++) {
         unsigned lk1 = length - k - 1;
-        JSValuePtr obj2 = getProperty(exec, thisObj, lk1);
-        JSValuePtr obj = getProperty(exec, thisObj, k);
+        JSValue obj2 = getProperty(exec, thisObj, lk1);
+        JSValue obj = getProperty(exec, thisObj, k);
 
         if (obj2)
             thisObj->put(exec, k, obj2);
@@ -349,19 +379,19 @@ JSValuePtr arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValuePtr thisValu
     return thisObj;
 }
 
-JSValuePtr arrayProtoFuncShift(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    JSValuePtr result;
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSValue result;
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
         result = jsUndefined();
     } else {
         result = thisObj->get(exec, 0);
         for (unsigned k = 1; k < length; k++) {
-            if (JSValuePtr obj = getProperty(exec, thisObj, k))
+            if (JSValue obj = getProperty(exec, thisObj, k))
                 thisObj->put(exec, k - 1, obj);
             else
                 thisObj->deleteProperty(exec, k - 1);
@@ -372,17 +402,17 @@ JSValuePtr arrayProtoFuncShift(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return result;
 }
 
-JSValuePtr arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // http://developer.netscape.com/docs/manuals/js/client/jsref/array.htm#1193713 or 15.4.4.10
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     // We return a new array
     JSArray* resObj = constructEmptyArray(exec);
-    JSValuePtr result = resObj;
-    double begin = args.at(exec, 0)->toInteger(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSValue result = resObj;
+    double begin = args.at(0).toInteger(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (begin >= 0) {
         if (begin > length)
             begin = length;
@@ -392,10 +422,10 @@ JSValuePtr arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue,
             begin = 0;
     }
     double end;
-    if (args.at(exec, 1)->isUndefined())
+    if (args.at(1).isUndefined())
         end = length;
     else {
-        end = args.at(exec, 1)->toInteger(exec);
+        end = args.at(1).toInteger(exec);
         if (end < 0) {
             end += length;
             if (end < 0)
@@ -410,30 +440,32 @@ JSValuePtr arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue,
     int b = static_cast<int>(begin);
     int e = static_cast<int>(end);
     for (int k = b; k < e; k++, n++) {
-        if (JSValuePtr v = getProperty(exec, thisObj, k))
+        if (JSValue v = getProperty(exec, thisObj, k))
             resObj->put(exec, n, v);
     }
     resObj->setLength(n);
     return result;
 }
 
-JSValuePtr arrayProtoFuncSort(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
 
     if (thisObj->classInfo() == &JSArray::info) {
-        if (callType != CallTypeNone)
+        if (isNumericCompareFunction(callType, callData))
+            asArray(thisObj)->sortNumeric(exec, function, callType, callData);
+        else if (callType != CallTypeNone)
             asArray(thisObj)->sort(exec, function, callType, callData);
         else
             asArray(thisObj)->sort(exec);
         return thisObj;
     }
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
 
     if (!length)
         return thisObj;
@@ -441,23 +473,23 @@ JSValuePtr arrayProtoFuncSort(ExecState* exec, JSObject*, JSValuePtr thisValue,
     // "Min" sort. Not the fastest, but definitely less code than heapsort
     // or quicksort, and much less swapping than bubblesort/insertionsort.
     for (unsigned i = 0; i < length - 1; ++i) {
-        JSValuePtr iObj = thisObj->get(exec, i);
+        JSValue iObj = thisObj->get(exec, i);
         unsigned themin = i;
-        JSValuePtr minObj = iObj;
+        JSValue minObj = iObj;
         for (unsigned j = i + 1; j < length; ++j) {
-            JSValuePtr jObj = thisObj->get(exec, j);
+            JSValue jObj = thisObj->get(exec, j);
             double compareResult;
-            if (jObj->isUndefined())
+            if (jObj.isUndefined())
                 compareResult = 1; // don't check minObj because there's no need to differentiate == (0) from > (1)
-            else if (minObj->isUndefined())
+            else if (minObj.isUndefined())
                 compareResult = -1;
             else if (callType != CallTypeNone) {
-                ArgList l;
+                MarkedArgumentBuffer l;
                 l.append(jObj);
                 l.append(minObj);
-                compareResult = call(exec, function, callType, callData, exec->globalThisValue(), l)->toNumber(exec);
+                compareResult = call(exec, function, callType, callData, exec->globalThisValue(), l).toNumber(exec);
             } else
-                compareResult = (jObj->toString(exec) < minObj->toString(exec)) ? -1 : 1;
+                compareResult = (jObj.toString(exec) < minObj.toString(exec)) ? -1 : 1;
 
             if (compareResult < 0) {
                 themin = j;
@@ -473,17 +505,17 @@ JSValuePtr arrayProtoFuncSort(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return thisObj;
 }
 
-JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     // 15.4.4.12
     JSArray* resObj = constructEmptyArray(exec);
-    JSValuePtr result = resObj;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSValue result = resObj;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(exec, 0)->toUInt32(exec);
+    int begin = args.at(0).toUInt32(exec);
     if (begin < 0)
         begin = std::max<int>(begin + length, 0);
     else
@@ -491,12 +523,12 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
 
     unsigned deleteCount;
     if (args.size() > 1)
-        deleteCount = std::min<int>(std::max<int>(args.at(exec, 1)->toUInt32(exec), 0), length - begin);
+        deleteCount = std::min<int>(std::max<int>(args.at(1).toUInt32(exec), 0), length - begin);
     else
         deleteCount = length - begin;
 
     for (unsigned k = 0; k < deleteCount; k++) {
-        if (JSValuePtr v = getProperty(exec, thisObj, k + begin))
+        if (JSValue v = getProperty(exec, thisObj, k + begin))
             resObj->put(exec, k, v);
     }
     resObj->setLength(deleteCount);
@@ -505,7 +537,7 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
     if (additionalArgs != deleteCount) {
         if (additionalArgs < deleteCount) {
             for (unsigned k = begin; k < length - deleteCount; ++k) {
-                if (JSValuePtr v = getProperty(exec, thisObj, k + deleteCount))
+                if (JSValue v = getProperty(exec, thisObj, k + deleteCount))
                     thisObj->put(exec, k + additionalArgs, v);
                 else
                     thisObj->deleteProperty(exec, k + additionalArgs);
@@ -514,7 +546,7 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
                 thisObj->deleteProperty(exec, k - 1);
         } else {
             for (unsigned k = length - deleteCount; (int)k > begin; --k) {
-                if (JSValuePtr obj = getProperty(exec, thisObj, k + deleteCount - 1))
+                if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);
                 else
                     thisObj->deleteProperty(exec, k + additionalArgs - 1);
@@ -522,101 +554,138 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
         }
     }
     for (unsigned k = 0; k < additionalArgs; ++k)
-        thisObj->put(exec, k + begin, args.at(exec, k + 2));
+        thisObj->put(exec, k + begin, args.at(k + 2));
 
     putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length - deleteCount + additionalArgs));
     return result;
 }
 
-JSValuePtr arrayProtoFuncUnShift(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     // 15.4.4.13
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned nrArgs = args.size();
     if (nrArgs) {
         for (unsigned k = length; k > 0; --k) {
-            if (JSValuePtr v = getProperty(exec, thisObj, k - 1))
+            if (JSValue v = getProperty(exec, thisObj, k - 1))
                 thisObj->put(exec, k + nrArgs - 1, v);
             else
                 thisObj->deleteProperty(exec, k + nrArgs - 1);
         }
     }
     for (unsigned k = 0; k < nrArgs; ++k)
-        thisObj->put(exec, k, args.at(exec, k));
-    JSValuePtr result = jsNumber(exec, length + nrArgs);
+        thisObj->put(exec, k, args.at(k));
+    JSValue result = jsNumber(exec, length + nrArgs);
     putProperty(exec, thisObj, exec->propertyNames().length, result);
     return result;
 }
 
-JSValuePtr arrayProtoFuncFilter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
     JSArray* resultArray = constructEmptyArray(exec);
 
     unsigned filterIndex = 0;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (!array->canGetIndex(k))
+                break;
+            JSValue v = array->getIndex(k);
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, v);
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(exec))
+                resultArray->put(exec, filterIndex++, v);
+        }
+        if (k == length)
+            return resultArray;
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
 
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        JSValuePtr v = slot.getValue(exec, k);
+        JSValue v = slot.getValue(exec, k);
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        JSValuePtr result = call(exec, function, callType, callData, applyThis, eachArguments);
+        JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
 
-        if (result->toBoolean(exec))
+        if (result.toBoolean(exec))
             resultArray->put(exec, filterIndex++, v);
     }
     return resultArray;
 }
 
-JSValuePtr arrayProtoFuncMap(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
 
     JSArray* resultArray = constructEmptyArray(exec, length);
-
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+
+            resultArray->JSArray::put(exec, k, cachedCall.call());
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        JSValuePtr v = slot.getValue(exec, k);
+        JSValue v = slot.getValue(exec, k);
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        JSValuePtr result = call(exec, function, callType, callData, applyThis, eachArguments);
+        JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
         resultArray->put(exec, k, result);
     }
 
@@ -628,34 +697,52 @@ JSValuePtr arrayProtoFuncMap(ExecState* exec, JSObject*, JSValuePtr thisValue, c
 // http://developer-test.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Objects:Array:forEach
 // http://developer-test.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Objects:Array:some
 
-JSValuePtr arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
-
-    JSValuePtr result = jsBoolean(true);
-
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
+
+    JSValue result = jsBoolean(true);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+            
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            if (!cachedCall.call().toBoolean(exec))
+                return jsBoolean(false);
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
 
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments)->toBoolean(exec);
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
 
         if (!predicateResult) {
             result = jsBoolean(false);
@@ -666,25 +753,42 @@ JSValuePtr arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return result;
 }
 
-JSValuePtr arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+
+            cachedCall.call();
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
@@ -694,32 +798,50 @@ JSValuePtr arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsUndefined();
 }
 
-JSValuePtr arrayProtoFuncSome(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
-
-    JSValuePtr result = jsBoolean(false);
-
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
+
+    JSValue result = jsBoolean(false);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+            
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            if (cachedCall.call().toBoolean(exec))
+                return jsBoolean(true);
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments)->toBoolean(exec);
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
 
         if (predicateResult) {
             result = jsBoolean(true);
@@ -729,16 +851,155 @@ JSValuePtr arrayProtoFuncSome(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return result;
 }
 
-JSValuePtr arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    
+    JSValue function = args.at(0);
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return throwError(exec, TypeError);
+
+    unsigned i = 0;
+    JSValue rv;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length && args.size() == 1)
+        return throwError(exec, TypeError);
+    JSArray* array = 0;
+    if (isJSArray(&exec->globalData(), thisObj))
+        array = asArray(thisObj);
+
+    if (args.size() >= 2)
+        rv = args.at(1);
+    else if (array && array->canGetIndex(0)){
+        rv = array->getIndex(0);
+        i = 1;
+    } else {
+        for (i = 0; i < length; i++) {
+            rv = getProperty(exec, thisObj, i);
+            if (rv)
+                break;
+        }
+        if (!rv)
+            return throwError(exec, TypeError);
+        i++;
+    }
+
+    if (callType == CallTypeJS && array) {
+        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        for (; i < length && !exec->hadException(); ++i) {
+            cachedCall.setThis(jsNull());
+            cachedCall.setArgument(0, rv);
+            JSValue v;
+            if (LIKELY(array->canGetIndex(i)))
+                v = array->getIndex(i);
+            else
+                break; // length has been made unsafe while we enumerate fallback to slow path
+            cachedCall.setArgument(1, v);
+            cachedCall.setArgument(2, jsNumber(exec, i));
+            cachedCall.setArgument(3, array);
+            rv = cachedCall.call();
+        }
+        if (i == length) // only return if we reached the end of the array
+            return rv;
+    }
+
+    for (; i < length && !exec->hadException(); ++i) {
+        JSValue prop = getProperty(exec, thisObj, i);
+        if (!prop)
+            continue;
+        
+        MarkedArgumentBuffer eachArguments;
+        eachArguments.append(rv);
+        eachArguments.append(prop);
+        eachArguments.append(jsNumber(exec, i));
+        eachArguments.append(thisObj);
+        
+        rv = call(exec, function, callType, callData, jsNull(), eachArguments);
+    }
+    return rv;
+}
+
+JSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    
+    JSValue function = args.at(0);
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return throwError(exec, TypeError);
+    
+    unsigned i = 0;
+    JSValue rv;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length && args.size() == 1)
+        return throwError(exec, TypeError);
+    JSArray* array = 0;
+    if (isJSArray(&exec->globalData(), thisObj))
+        array = asArray(thisObj);
+    
+    if (args.size() >= 2)
+        rv = args.at(1);
+    else if (array && array->canGetIndex(length - 1)){
+        rv = array->getIndex(length - 1);
+        i = 1;
+    } else {
+        for (i = 0; i < length; i++) {
+            rv = getProperty(exec, thisObj, length - i - 1);
+            if (rv)
+                break;
+        }
+        if (!rv)
+            return throwError(exec, TypeError);
+        i++;
+    }
+    
+    if (callType == CallTypeJS && array) {
+        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        for (; i < length && !exec->hadException(); ++i) {
+            unsigned idx = length - i - 1;
+            cachedCall.setThis(jsNull());
+            cachedCall.setArgument(0, rv);
+            if (UNLIKELY(!array->canGetIndex(idx)))
+                break; // length has been made unsafe while we enumerate fallback to slow path
+            cachedCall.setArgument(1, array->getIndex(idx));
+            cachedCall.setArgument(2, jsNumber(exec, idx));
+            cachedCall.setArgument(3, array);
+            rv = cachedCall.call();
+        }
+        if (i == length) // only return if we reached the end of the array
+            return rv;
+    }
+    
+    for (; i < length && !exec->hadException(); ++i) {
+        unsigned idx = length - i - 1;
+        JSValue prop = getProperty(exec, thisObj, idx);
+        if (!prop)
+            continue;
+        
+        MarkedArgumentBuffer eachArguments;
+        eachArguments.append(rv);
+        eachArguments.append(prop);
+        eachArguments.append(jsNumber(exec, idx));
+        eachArguments.append(thisObj);
+        
+        rv = call(exec, function, callType, callData, jsNull(), eachArguments);
+    }
+    return rv;        
+}
+
+JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // JavaScript 1.5 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:indexOf
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     unsigned index = 0;
-    double d = args.at(exec, 1)->toInteger(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    double d = args.at(1).toInteger(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (d < 0)
         d += length;
     if (d > 0) {
@@ -748,28 +1009,28 @@ JSValuePtr arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValu
             index = static_cast<unsigned>(d);
     }
 
-    JSValuePtr searchElement = args.at(exec, 0);
+    JSValue searchElement = args.at(0);
     for (; index < length; ++index) {
-        JSValuePtr e = getProperty(exec, thisObj, index);
+        JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (strictEqual(searchElement, e))
+        if (JSValue::strictEqual(searchElement, e))
             return jsNumber(exec, index);
     }
 
     return jsNumber(exec, -1);
 }
 
-JSValuePtr arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // JavaScript 1.6 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:lastIndexOf
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     int index = length - 1;
-    double d = args.at(exec, 1)->toIntegerPreserveNaN(exec);
+    double d = args.at(1).toIntegerPreserveNaN(exec);
 
     if (d < 0) {
         d += length;
@@ -779,12 +1040,12 @@ JSValuePtr arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr this
     if (d < length)
         index = static_cast<int>(d);
 
-    JSValuePtr searchElement = args.at(exec, 0);
+    JSValue searchElement = args.at(0);
     for (; index >= 0; --index) {
-        JSValuePtr e = getProperty(exec, thisObj, index);
+        JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (strictEqual(searchElement, e))
+        if (JSValue::strictEqual(searchElement, e))
             return jsNumber(exec, index);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp
index aa245bbe08..9fcba374c0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -41,7 +41,7 @@ BooleanConstructor::BooleanConstructor(ExecState* exec, PassRefPtr<Structure> st
 JSObject* constructBoolean(ExecState* exec, const ArgList& args)
 {
     BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
-    obj->setInternalValue(jsBoolean(args.at(exec, 0)->toBoolean(exec)));
+    obj->setInternalValue(jsBoolean(args.at(0).toBoolean(exec)));
     return obj;
 }
 
@@ -57,9 +57,9 @@ ConstructType BooleanConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.6.1
-static JSValuePtr callBooleanConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callBooleanConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsBoolean(args.at(exec, 0)->toBoolean(exec));
+    return jsBoolean(args.at(0).toBoolean(exec));
 }
 
 CallType BooleanConstructor::getCallData(CallData& callData)
@@ -68,7 +68,7 @@ CallType BooleanConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValuePtr immediateBooleanValue)
+JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValue immediateBooleanValue)
 {
     BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
     obj->setInternalValue(immediateBooleanValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h
index db4e8e2a41..d9f51ab528 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h
@@ -36,7 +36,7 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValuePtr);
+    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValue);
     JSObject* constructBoolean(ExecState*, const ArgList&);
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index 68941e30cf..cfd55fe4da 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -33,9 +33,9 @@ namespace JSC {
         static const ClassInfo info;
     };
 
-    BooleanObject* asBooleanObject(JSValuePtr);
+    BooleanObject* asBooleanObject(JSValue);
 
-    inline BooleanObject* asBooleanObject(JSValuePtr value)
+    inline BooleanObject* asBooleanObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&BooleanObject::info));
         return static_cast<BooleanObject*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
index 77a7a1e8b5..703a56851d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -22,6 +22,7 @@
 #include "BooleanPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -31,8 +32,8 @@ namespace JSC {
 ASSERT_CLASS_FITS_IN_CELL(BooleanPrototype);
 
 // Functions
-static JSValuePtr booleanProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr booleanProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.6.4
 
@@ -41,8 +42,8 @@ BooleanPrototype::BooleanPrototype(ExecState* exec, PassRefPtr<Structure> struct
 {
     setInternalValue(jsBoolean(false));
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
 }
 
 
@@ -50,7 +51,7 @@ BooleanPrototype::BooleanPrototype(ExecState* exec, PassRefPtr<Structure> struct
 
 // ECMA 15.6.4.2 + 15.6.4.3
 
-JSValuePtr booleanProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (thisValue == jsBoolean(false))
         return jsNontrivialString(exec, "false");
@@ -58,7 +59,7 @@ JSValuePtr booleanProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisV
     if (thisValue == jsBoolean(true))
         return jsNontrivialString(exec, "true");
 
-    if (!thisValue->isObject(&BooleanObject::info))
+    if (!thisValue.isObject(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
@@ -68,12 +69,12 @@ JSValuePtr booleanProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNontrivialString(exec, "true");
 }
 
-JSValuePtr booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (JSImmediate::isBoolean(thisValue))
+    if (thisValue.isBoolean())
         return thisValue;
 
-    if (!thisValue->isObject(&BooleanObject::info))
+    if (!thisValue.isObject(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     return asBooleanObject(thisValue)->internalValue();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
index fbb6392cc2..62e42fef5c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
@@ -30,7 +30,7 @@
 
 namespace JSC {
 
-JSValuePtr call(ExecState* exec, JSValuePtr functionObject, CallType callType, const CallData& callData, JSValuePtr thisValue, const ArgList& args)
+JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
 {
     if (callType == CallTypeHost)
         return callData.native.function(exec, asObject(functionObject), thisValue, args);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
index b8d84cd5f6..d5b0172d8f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
@@ -29,13 +29,15 @@
 #ifndef CallData_h
 #define CallData_h
 
+#include "NativeFunctionWrapper.h"
+
 namespace JSC {
 
     class ArgList;
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ScopeChainNode;
 
     enum CallType {
@@ -44,7 +46,7 @@ namespace JSC {
         CallTypeJS
     };
 
-    typedef JSValuePtr (*NativeFunction)(ExecState*, JSObject*, JSValuePtr thisValue, const ArgList&);
+    typedef JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*, JSObject*, JSValue thisValue, const ArgList&);
 
     union CallData {
         struct {
@@ -56,7 +58,7 @@ namespace JSC {
         } js;
     };
 
-    JSValuePtr call(ExecState*, JSValuePtr functionObject, CallType, const CallData&, JSValuePtr thisValue, const ArgList&);
+    JSValue call(ExecState*, JSValue functionObject, CallType, const CallData&, JSValue thisValue, const ArgList&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 69cb05e17a..1e5eab354a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -23,13 +23,14 @@
 #include "Collector.h"
 
 #include "ArgList.h"
-#include "CollectorHeapIterator.h"
 #include "CallFrame.h"
+#include "CollectorHeapIterator.h"
+#include "Interpreter.h"
 #include "JSGlobalObject.h"
 #include "JSLock.h"
 #include "JSString.h"
 #include "JSValue.h"
-#include "Interpreter.h"
+#include "Nodes.h"
 #include "Tracing.h"
 #include <algorithm>
 #include <setjmp.h>
@@ -37,11 +38,12 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/HashCountedSet.h>
 #include <wtf/UnusedParam.h>
+#include <wtf/VMTags.h>
 
 #if PLATFORM(DARWIN)
 
-#include <mach/mach_port.h>
 #include <mach/mach_init.h>
+#include <mach/mach_port.h>
 #include <mach/task.h>
 #include <mach/thread_act.h>
 #include <mach/vm_map.h>
@@ -74,9 +76,7 @@ extern int *__libc_stack_end;
 
 #if PLATFORM(SOLARIS)
 #include <thread.h>
-#endif
-
-#if PLATFORM(OPENBSD)
+#else
 #include <pthread.h>
 #endif
 
@@ -199,7 +199,7 @@ static NEVER_INLINE CollectorBlock* allocateBlock()
 #if PLATFORM(DARWIN)
     vm_address_t address = 0;
     // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
-    vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
+    vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
 #elif PLATFORM(SYMBIAN)
     // no memory map in symbian, need to hack with fastMalloc
     void* address = fastMalloc(BLOCK_SIZE);
@@ -365,6 +365,9 @@ collect:
         // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
         size_t numBlocks = heap.numBlocks;
         if (usedBlocks == numBlocks) {
+            static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
+            if (numBlocks > maxNumBlocks)
+                CRASH();
             numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
             heap.numBlocks = numBlocks;
             heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
@@ -483,6 +486,15 @@ static inline void* currentThreadStackBase()
     stack_t stack;
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
+#elif PLATFORM(SYMBIAN)
+    static void* stackBase = 0;
+    if (stackBase == 0) {
+        TThreadStackInfo info;
+        RThread thread;
+        thread.StackInfo(info);
+        stackBase = (void*)info.iBase;
+    }
+    return (void*)stackBase;
 #elif PLATFORM(UNIX)
 #ifdef UCLIBC_USE_PROC_SELF_MAPS
     // Read /proc/self/maps and locate the line whose address
@@ -548,15 +560,6 @@ static inline void* currentThreadStackBase()
     }
     return static_cast<char*>(stackBase) + stackSize;
 #endif
-#elif PLATFORM(SYMBIAN)
-    static void* stackBase = 0;
-    if (stackBase == 0) {
-        TThreadStackInfo info;
-        RThread thread;
-        thread.StackInfo(info);
-        stackBase = (void*)info.iBase;
-    }
-    return (void*)stackBase;
 #else
 #error Need a way to get the stack base on this platform
 #endif
@@ -768,7 +771,7 @@ typedef CONTEXT PlatformThreadRegisters;
 #error Need a thread register struct for this platform
 #endif
 
-size_t getPlatformThreadRegisters(const PlatformThread& platformThread, PlatformThreadRegisters& regs)
+static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, PlatformThreadRegisters& regs)
 {
 #if PLATFORM(DARWIN)
 
@@ -906,45 +909,45 @@ void Heap::setGCProtectNeedsLocking()
         m_protectedValuesMutex.set(new Mutex);
 }
 
-void Heap::protect(JSValuePtr k)
+void Heap::protect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
 
-    if (JSImmediate::isImmediate(k))
+    if (!k.isCell())
         return;
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->lock();
 
-    m_protectedValues.add(k->asCell());
+    m_protectedValues.add(k.asCell());
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->unlock();
 }
 
-void Heap::unprotect(JSValuePtr k)
+void Heap::unprotect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
 
-    if (JSImmediate::isImmediate(k))
+    if (!k.isCell())
         return;
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->lock();
 
-    m_protectedValues.remove(k->asCell());
+    m_protectedValues.remove(k.asCell());
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->unlock();
 }
 
-Heap* Heap::heap(JSValuePtr v)
+Heap* Heap::heap(JSValue v)
 {
-    if (JSImmediate::isImmediate(v))
+    if (!v.isCell())
         return 0;
-    return Heap::cellBlock(v->asCell())->heap;
+    return Heap::cellBlock(v.asCell())->heap;
 }
 
 void Heap::markProtectedObjects()
@@ -1084,11 +1087,13 @@ bool Heap::collect()
     markStackObjectsConservatively();
     markProtectedObjects();
     if (m_markListSet && m_markListSet->size())
-        ArgList::markLists(*m_markListSet);
-    if (m_globalData->exception && !m_globalData->exception->marked())
-        m_globalData->exception->mark();
+        MarkedArgumentBuffer::markLists(*m_markListSet);
+    if (m_globalData->exception && !m_globalData->exception.marked())
+        m_globalData->exception.mark();
     m_globalData->interpreter->registerFile().markCallFrames(this);
     m_globalData->smallStrings.mark();
+    if (m_globalData->scopeNodeBeingReparsed)
+        m_globalData->scopeNodeBeingReparsed->mark();
 
     JAVASCRIPTCORE_GC_MARKED();
 
@@ -1105,7 +1110,7 @@ bool Heap::collect()
 
 size_t Heap::objectCount() 
 {
-    return primaryHeap.numLiveObjects + numberHeap.numLiveObjects; 
+    return primaryHeap.numLiveObjects + numberHeap.numLiveObjects - m_globalData->smallStrings.count(); 
 }
 
 template <HeapType heapType> 
@@ -1175,16 +1180,16 @@ size_t Heap::protectedObjectCount()
     return result;
 }
 
-static const char* typeName(JSCell* val)
+static const char* typeName(JSCell* cell)
 {
-    if (val->isString())
+    if (cell->isString())
         return "string";
-    if (val->isNumber())
+    if (cell->isNumber())
         return "number";
-    if (val->isGetterSetter())
+    if (cell->isGetterSetter())
         return "gettersetter";
-    ASSERT(val->isObject());
-    const ClassInfo* info = static_cast<JSObject*>(val)->classInfo();
+    ASSERT(cell->isObject());
+    const ClassInfo* info = static_cast<JSObject*>(cell)->classInfo();
     return info ? info->className : "Object";
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index ba41d607f2..23f9f158ef 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -39,11 +39,11 @@
 
 namespace JSC {
 
-    class ArgList;
+    class MarkedArgumentBuffer;
     class CollectorBlock;
     class JSCell;
     class JSGlobalData;
-    class JSValuePtr;
+    class JSValue;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
     enum HeapType { PrimaryHeap, NumberHeap };
@@ -96,10 +96,10 @@ namespace JSC {
         Statistics statistics() const;
 
         void setGCProtectNeedsLocking();
-        void protect(JSValuePtr);
-        void unprotect(JSValuePtr);
+        void protect(JSValue);
+        void unprotect(JSValue);
 
-        static Heap* heap(JSValuePtr); // 0 for immediate values
+        static Heap* heap(JSValue); // 0 for immediate values
 
         size_t globalObjectCount();
         size_t protectedObjectCount();
@@ -113,7 +113,7 @@ namespace JSC {
 
         void markConservatively(void* start, void* end);
 
-        HashSet<ArgList*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<ArgList*>; return *m_markListSet; }
+        HashSet<MarkedArgumentBuffer*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<MarkedArgumentBuffer*>; return *m_markListSet; }
 
         JSGlobalData* globalData() const { return m_globalData; }
         static bool isNumber(JSCell*);
@@ -147,7 +147,7 @@ namespace JSC {
         OwnPtr<Mutex> m_protectedValuesMutex; // Only non-null if the client explicitly requested it via setGCPrtotectNeedsLocking().
         ProtectCountSet m_protectedValues;
 
-        HashSet<ArgList*>* m_markListSet;
+        HashSet<MarkedArgumentBuffer*>* m_markListSet;
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         void makeUsableFromMultipleThreads();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
index 45b99a8f72..d4c5d528e1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -24,7 +24,7 @@
 #include "Identifier.h"
 #include <wtf/Noncopyable.h>
 
-// ArgList of property names, passed to a macro so we can do set them up various
+// MarkedArgumentBuffer of property names, passed to a macro so we can do set them up various
 // ways without repeating the list.
 #define JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(macro) \
     macro(__defineGetter__) \
@@ -63,7 +63,8 @@
     macro(toPrecision) \
     macro(toString) \
     macro(UTC) \
-    macro(valueOf)
+    macro(valueOf) \
+    macro(displayName)
 
 namespace JSC {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
index b4923f7851..b8b15819d5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
@@ -50,7 +50,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
     return Completion(Normal);
 }
 
-Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValuePtr thisValue)
+Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
     
@@ -61,14 +61,14 @@ Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& s
     if (!programNode)
         return Completion(Throw, Error::create(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url()));
 
-    JSObject* thisObj = (!thisValue || thisValue->isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue->toObject(exec);
+    JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
-    JSValuePtr exception = noValue();
-    JSValuePtr result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
+    JSValue exception;
+    JSValue result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
 
     if (exception) {
-        if (exception->isObject() && asObject(exception)->isWatchdogException())
-            return Completion(Interrupted, result);
+        if (exception.isObject() && asObject(exception)->isWatchdogException())
+            return Completion(Interrupted, exception);
         return Completion(Throw, exception);
     }
     return Completion(Normal, result);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h
index 9631b50a18..41c9a642f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h
@@ -39,24 +39,24 @@ namespace JSC {
      */
     class Completion {
     public:
-        Completion(ComplType type = Normal, JSValuePtr value = noValue())
+        Completion(ComplType type = Normal, JSValue value = JSValue())
             : m_type(type)
             , m_value(value)
         {
         }
 
         ComplType complType() const { return m_type; }
-        JSValuePtr value() const { return m_value; }
-        void setValue(JSValuePtr v) { m_value = v; }
+        JSValue value() const { return m_value; }
+        void setValue(JSValue v) { m_value = v; }
         bool isValueCompletion() const { return m_value; }
 
     private:
         ComplType m_type;
-        JSValuePtr m_value;
+        JSValue m_value;
     };
 
     Completion checkSyntax(ExecState*, const SourceCode&);
-    Completion evaluate(ExecState*, ScopeChain&, const SourceCode&, JSValuePtr thisValue = noValue());
+    Completion evaluate(ExecState*, ScopeChain&, const SourceCode&, JSValue thisValue = JSValue());
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
index 7a729ae337..7ee59d7ef7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
@@ -30,7 +30,7 @@
 
 namespace JSC {
 
-JSObject* construct(ExecState* exec, JSValuePtr object, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
+JSObject* construct(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
 {
     if (constructType == ConstructTypeHost)
         return constructData.native.function(exec, asObject(object), args);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
index 559c1bd5eb..9d580d5799 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
@@ -35,7 +35,7 @@ namespace JSC {
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ScopeChainNode;
 
     enum ConstructType {
@@ -56,7 +56,7 @@ namespace JSC {
         } js;
     };
 
-    JSObject* construct(ExecState*, JSValuePtr constructor, ConstructType, const ConstructData&, const ArgList&);
+    JSObject* construct(ExecState*, JSValue constructor, ConstructType, const ConstructData&, const ArgList&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
index 6510f4b13f..54362d0027 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
@@ -25,6 +25,7 @@
 #include "DateInstance.h"
 #include "DateMath.h"
 #include "DatePrototype.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
@@ -47,18 +48,18 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(DateConstructor);
 
-static JSValuePtr dateParse(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateNow(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateUTC(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL dateParse(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateNow(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateUTC(ExecState*, JSObject*, JSValue, const ArgList&);
 
 DateConstructor::DateConstructor(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, DatePrototype* datePrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, datePrototype->classInfo()->className))
 {
       putDirectWithoutTransition(exec->propertyNames().prototype, datePrototype, DontEnum|DontDelete|ReadOnly);
 
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
 
       putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 7), ReadOnly | DontEnum | DontDelete);
 }
@@ -73,35 +74,35 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
         value = getCurrentUTCTime();
     else if (numArgs == 1) {
-        if (args.at(exec, 0)->isObject(&DateInstance::info))
-            value = asDateInstance(args.at(exec, 0))->internalNumber();
+        if (args.at(0).isObject(&DateInstance::info))
+            value = asDateInstance(args.at(0))->internalNumber();
         else {
-            JSValuePtr primitive = args.at(exec, 0)->toPrimitive(exec);
-            if (primitive->isString())
-                value = parseDate(primitive->getString());
+            JSValue primitive = args.at(0).toPrimitive(exec);
+            if (primitive.isString())
+                value = parseDate(primitive.getString());
             else
-                value = primitive->toNumber(exec);
+                value = primitive.toNumber(exec);
         }
     } else {
-        if (isnan(args.at(exec, 0)->toNumber(exec))
-                || isnan(args.at(exec, 1)->toNumber(exec))
-                || (numArgs >= 3 && isnan(args.at(exec, 2)->toNumber(exec)))
-                || (numArgs >= 4 && isnan(args.at(exec, 3)->toNumber(exec)))
-                || (numArgs >= 5 && isnan(args.at(exec, 4)->toNumber(exec)))
-                || (numArgs >= 6 && isnan(args.at(exec, 5)->toNumber(exec)))
-                || (numArgs >= 7 && isnan(args.at(exec, 6)->toNumber(exec))))
+        if (isnan(args.at(0).toNumber(exec))
+                || isnan(args.at(1).toNumber(exec))
+                || (numArgs >= 3 && isnan(args.at(2).toNumber(exec)))
+                || (numArgs >= 4 && isnan(args.at(3).toNumber(exec)))
+                || (numArgs >= 5 && isnan(args.at(4).toNumber(exec)))
+                || (numArgs >= 6 && isnan(args.at(5).toNumber(exec)))
+                || (numArgs >= 7 && isnan(args.at(6).toNumber(exec))))
             value = NaN;
         else {
           GregorianDateTime t;
-          int year = args.at(exec, 0)->toInt32(exec);
+          int year = args.at(0).toInt32(exec);
           t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-          t.month = args.at(exec, 1)->toInt32(exec);
-          t.monthDay = (numArgs >= 3) ? args.at(exec, 2)->toInt32(exec) : 1;
-          t.hour = args.at(exec, 3)->toInt32(exec);
-          t.minute = args.at(exec, 4)->toInt32(exec);
-          t.second = args.at(exec, 5)->toInt32(exec);
+          t.month = args.at(1).toInt32(exec);
+          t.monthDay = (numArgs >= 3) ? args.at(2).toInt32(exec) : 1;
+          t.hour = args.at(3).toInt32(exec);
+          t.minute = args.at(4).toInt32(exec);
+          t.second = args.at(5).toInt32(exec);
           t.isDST = -1;
-          double ms = (numArgs >= 7) ? args.at(exec, 6)->toNumber(exec) : 0;
+          double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
           value = gregorianDateTimeToMS(t, ms, false);
         }
     }
@@ -123,7 +124,7 @@ ConstructType DateConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.9.2
-static JSValuePtr callDate(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL callDate(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     time_t localTime = time(0);
     tm localTM;
@@ -138,37 +139,37 @@ CallType DateConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-static JSValuePtr dateParse(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL dateParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseDate(args.at(exec, 0)->toString(exec)));
+    return jsNumber(exec, parseDate(args.at(0).toString(exec)));
 }
 
-static JSValuePtr dateNow(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL dateNow(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     return jsNumber(exec, getCurrentUTCTime());
 }
 
-static JSValuePtr dateUTC(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const ArgList& args) 
 {
     int n = args.size();
-    if (isnan(args.at(exec, 0)->toNumber(exec))
-            || isnan(args.at(exec, 1)->toNumber(exec))
-            || (n >= 3 && isnan(args.at(exec, 2)->toNumber(exec)))
-            || (n >= 4 && isnan(args.at(exec, 3)->toNumber(exec)))
-            || (n >= 5 && isnan(args.at(exec, 4)->toNumber(exec)))
-            || (n >= 6 && isnan(args.at(exec, 5)->toNumber(exec)))
-            || (n >= 7 && isnan(args.at(exec, 6)->toNumber(exec))))
+    if (isnan(args.at(0).toNumber(exec))
+            || isnan(args.at(1).toNumber(exec))
+            || (n >= 3 && isnan(args.at(2).toNumber(exec)))
+            || (n >= 4 && isnan(args.at(3).toNumber(exec)))
+            || (n >= 5 && isnan(args.at(4).toNumber(exec)))
+            || (n >= 6 && isnan(args.at(5).toNumber(exec)))
+            || (n >= 7 && isnan(args.at(6).toNumber(exec))))
         return jsNaN(exec);
 
     GregorianDateTime t;
-    int year = args.at(exec, 0)->toInt32(exec);
+    int year = args.at(0).toInt32(exec);
     t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-    t.month = args.at(exec, 1)->toInt32(exec);
-    t.monthDay = (n >= 3) ? args.at(exec, 2)->toInt32(exec) : 1;
-    t.hour = args.at(exec, 3)->toInt32(exec);
-    t.minute = args.at(exec, 4)->toInt32(exec);
-    t.second = args.at(exec, 5)->toInt32(exec);
-    double ms = (n >= 7) ? args.at(exec, 6)->toNumber(exec) : 0;
+    t.month = args.at(1).toInt32(exec);
+    t.monthDay = (n >= 3) ? args.at(2).toInt32(exec) : 1;
+    t.hour = args.at(3).toInt32(exec);
+    t.minute = args.at(4).toInt32(exec);
+    t.second = args.at(5).toInt32(exec);
+    double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
     return jsNumber(exec, gregorianDateTimeToMS(t, ms, true));
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index 8dbca81a4a..0ecd1dbdc0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -32,7 +32,7 @@ namespace JSC {
         explicit DateInstance(PassRefPtr<Structure>);
         virtual ~DateInstance();
 
-        double internalNumber() const { return internalValue()->uncheckedGetNumber(); }
+        double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
         bool getTime(GregorianDateTime&, int& offset) const;
         bool getUTCTime(GregorianDateTime&) const;
@@ -52,9 +52,9 @@ namespace JSC {
         mutable Cache* m_cache;
     };
 
-    DateInstance* asDateInstance(JSValuePtr);
+    DateInstance* asDateInstance(JSValue);
 
-    inline DateInstance* asDateInstance(JSValuePtr value)
+    inline DateInstance* asDateInstance(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&DateInstance::info));
         return static_cast<DateInstance*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.cpp
index 9cfe2567d3..2f8c88cc18 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.cpp
@@ -48,6 +48,7 @@
 #include <time.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StringExtras.h>
 
@@ -67,10 +68,6 @@
 #include <sys/timeb.h>
 #endif
 
-#if HAVE(STRINGS_H)
-#include <strings.h>
-#endif
-
 using namespace WTF;
 
 namespace JSC {
@@ -291,139 +288,10 @@ double getCurrentUTCTime()
     return floor(getCurrentUTCTimeWithMicroseconds());
 }
 
-#if PLATFORM(WIN_OS)
-
-static LARGE_INTEGER qpcFrequency;
-static bool syncedTime;
-
-static double highResUpTime()
-{
-    // We use QPC, but only after sanity checking its result, due to bugs:
-    // http://support.microsoft.com/kb/274323
-    // http://support.microsoft.com/kb/895980
-    // http://msdn.microsoft.com/en-us/library/ms644904.aspx ("...you can get different results on different processors due to bugs in the basic input/output system (BIOS) or the hardware abstraction layer (HAL)."
-
-    static LARGE_INTEGER qpcLast;
-    static DWORD tickCountLast;
-    static bool inited;
-
-    LARGE_INTEGER qpc;
-    QueryPerformanceCounter(&qpc);
-    DWORD tickCount = GetTickCount();
-
-    if (inited) {
-        __int64 qpcElapsed = ((qpc.QuadPart - qpcLast.QuadPart) * 1000) / qpcFrequency.QuadPart;
-        __int64 tickCountElapsed;
-        if (tickCount >= tickCountLast)
-            tickCountElapsed = (tickCount - tickCountLast);
-        else {
-#if COMPILER(MINGW)
-            __int64 tickCountLarge = tickCount + 0x100000000ULL;
-#else
-            __int64 tickCountLarge = tickCount + 0x100000000I64;
-#endif
-            tickCountElapsed = tickCountLarge - tickCountLast;
-        }
-
-        // force a re-sync if QueryPerformanceCounter differs from GetTickCount by more than 500ms.
-        // (500ms value is from http://support.microsoft.com/kb/274323)
-        __int64 diff = tickCountElapsed - qpcElapsed;
-        if (diff > 500 || diff < -500)
-            syncedTime = false;
-    } else
-        inited = true;
-
-    qpcLast = qpc;
-    tickCountLast = tickCount;
-
-    return (1000.0 * qpc.QuadPart) / static_cast<double>(qpcFrequency.QuadPart);;
-}
-
-static double lowResUTCTime()
-{
-#if PLATFORM(WIN_CE)
-    SYSTEMTIME systemTime;
-    GetSystemTime(&systemTime);
-    struct tm tmtime;
-    tmtime.tm_year = systemTime.wYear - 1900;
-    tmtime.tm_mon = systemTime.wMonth - 1;
-    tmtime.tm_mday = systemTime.wDay;
-    tmtime.tm_wday = systemTime.wDayOfWeek;
-    tmtime.tm_hour = systemTime.wHour;
-    tmtime.tm_min = systemTime.wMinute;
-    tmtime.tm_sec = systemTime.wSecond;
-    time_t timet = mktime(&tmtime);
-    return timet * msPerSecond + systemTime.wMilliseconds;
-#else
-    struct _timeb timebuffer;
-    _ftime(&timebuffer);
-    return timebuffer.time * msPerSecond + timebuffer.millitm;
-#endif
-}
-
-static bool qpcAvailable()
-{
-    static bool available;
-    static bool checked;
-
-    if (checked)
-        return available;
-
-    available = QueryPerformanceFrequency(&qpcFrequency);
-    checked = true;
-    return available;
-}
-
-#endif
-
+// Returns current time in milliseconds since 1 Jan 1970.
 double getCurrentUTCTimeWithMicroseconds()
 {
-#if PLATFORM(WIN_OS)
-    // Use a combination of ftime and QueryPerformanceCounter.
-    // ftime returns the information we want, but doesn't have sufficient resolution.
-    // QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
-    // To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use QueryPerformanceCounter
-    // by itself, adding the delta to the saved ftime.  We periodically re-sync to correct for drift.
-    static bool started;
-    static double syncLowResUTCTime;
-    static double syncHighResUpTime;
-    static double lastUTCTime;
-
-    double lowResTime = lowResUTCTime();
-
-    if (!qpcAvailable())
-        return lowResTime;
-
-    double highResTime = highResUpTime();
-
-    if (!syncedTime) {
-        timeBeginPeriod(1); // increase time resolution around low-res time getter
-        syncLowResUTCTime = lowResTime = lowResUTCTime();
-        timeEndPeriod(1); // restore time resolution
-        syncHighResUpTime = highResTime;
-        syncedTime = true;
-    }
-
-    double highResElapsed = highResTime - syncHighResUpTime;
-    double utc = syncLowResUTCTime + highResElapsed;
-
-    // force a clock re-sync if we've drifted
-    double lowResElapsed = lowResTime - syncLowResUTCTime;
-    const double maximumAllowedDriftMsec = 15.625 * 2.0; // 2x the typical low-res accuracy
-    if (fabs(highResElapsed - lowResElapsed) > maximumAllowedDriftMsec)
-        syncedTime = false;
-
-    // make sure time doesn't run backwards (only correct if difference is < 2 seconds, since DST or clock changes could occur)
-    const double backwardTimeLimit = 2000.0;
-    if (utc < lastUTCTime && (lastUTCTime - utc) < backwardTimeLimit)
-        return lastUTCTime;
-    lastUTCTime = utc;
-#else
-    struct timeval tv;
-    gettimeofday(&tv, 0);
-    double utc = tv.tv_sec * msPerSecond + tv.tv_usec / 1000.0;
-#endif
-    return utc;
+    return currentTime() * 1000.0; 
 }
 
 void getLocalTime(const time_t* localTime, struct tm* localTM)
@@ -1047,14 +915,14 @@ UString formatTime(const GregorianDateTime &t, bool utc)
         snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
     } else {
         int offset = abs(gmtoffset(t));
-        char tzname[70];
+        char timeZoneName[70];
         struct tm gtm = t;
-        strftime(tzname, sizeof(tzname), "%Z", &gtm);
+        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
 
-        if (tzname[0]) {
+        if (timeZoneName[0]) {
             snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
                 t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, tzname);
+                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
         } else {
             snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
                 t.hour, t.minute, t.second,
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
index 79ab2a204a..ff3fb19793 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
@@ -23,10 +23,16 @@
 #include "DatePrototype.h"
 
 #include "DateMath.h"
+#include "Error.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "DateInstance.h"
 #include <float.h>
+
+#if !PLATFORM(MAC) && HAVE(LANGINFO_H)
+#include <langinfo.h>
+#endif
+
 #include <limits.h>
 #include <locale.h>
 #include <math.h>
@@ -58,50 +64,49 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(DatePrototype);
 
-static JSValuePtr dateProtoFuncGetDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetDay(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMilliSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetTime(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCDay(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMilliSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetTime(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMilliseconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToDateString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToGMTString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleDateString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleTimeString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToTimeString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToUTCString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -109,8 +114,13 @@ static JSValuePtr dateProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const
 
 namespace JSC {
 
+enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
+ 
 #if PLATFORM(MAC)
 
+// FIXME: Since this is superior to the strftime-based version, why limit this to PLATFORM(MAC)?
+// Instead we should consider using this whenever PLATFORM(CF) is true.
+
 static CFDateFormatterStyle styleFromArgString(const UString& string, CFDateFormatterStyle defaultStyle)
 {
     if (string == "short")
@@ -124,24 +134,24 @@ static CFDateFormatterStyle styleFromArgString(const UString& string, CFDateForm
     return defaultStyle;
 }
 
-static UString formatLocaleDate(ExecState* exec, double time, bool includeDate, bool includeTime, const ArgList& args)
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance*, double timeInMilliseconds, LocaleDateTimeFormat format, const ArgList& args)
 {
-    CFDateFormatterStyle dateStyle = (includeDate ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
-    CFDateFormatterStyle timeStyle = (includeTime ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
+    CFDateFormatterStyle dateStyle = (format != LocaleTime ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
+    CFDateFormatterStyle timeStyle = (format != LocaleDate ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
 
     bool useCustomFormat = false;
     UString customFormatString;
 
-    UString arg0String = args.at(exec, 0)->toString(exec);
-    if (arg0String == "custom" && !args.at(exec, 1)->isUndefined()) {
+    UString arg0String = args.at(0).toString(exec);
+    if (arg0String == "custom" && !args.at(1).isUndefined()) {
         useCustomFormat = true;
-        customFormatString = args.at(exec, 1)->toString(exec);
-    } else if (includeDate && includeTime && !args.at(exec, 1)->isUndefined()) {
+        customFormatString = args.at(1).toString(exec);
+    } else if (format == LocaleDateAndTime && !args.at(1).isUndefined()) {
         dateStyle = styleFromArgString(arg0String, dateStyle);
-        timeStyle = styleFromArgString(args.at(exec, 1)->toString(exec), timeStyle);
-    } else if (includeDate && !args.at(exec, 0)->isUndefined())
+        timeStyle = styleFromArgString(args.at(1).toString(exec), timeStyle);
+    } else if (format != LocaleTime && !args.at(0).isUndefined())
         dateStyle = styleFromArgString(arg0String, dateStyle);
-    else if (includeTime && !args.at(exec, 0)->isUndefined())
+    else if (format != LocaleDate && !args.at(0).isUndefined())
         timeStyle = styleFromArgString(arg0String, timeStyle);
 
     CFLocaleRef locale = CFLocaleCopyCurrent();
@@ -149,12 +159,12 @@ static UString formatLocaleDate(ExecState* exec, double time, bool includeDate,
     CFRelease(locale);
 
     if (useCustomFormat) {
-        CFStringRef customFormatCFString = CFStringCreateWithCharacters(0, (UniChar *)customFormatString.data(), customFormatString.size());
+        CFStringRef customFormatCFString = CFStringCreateWithCharacters(0, customFormatString.data(), customFormatString.size());
         CFDateFormatterSetFormat(formatter, customFormatCFString);
         CFRelease(customFormatCFString);
     }
 
-    CFStringRef string = CFDateFormatterCreateStringWithAbsoluteTime(0, formatter, time - kCFAbsoluteTimeIntervalSince1970);
+    CFStringRef string = CFDateFormatterCreateStringWithAbsoluteTime(0, formatter, floor(timeInMilliseconds / msPerSecond) - kCFAbsoluteTimeIntervalSince1970);
 
     CFRelease(formatter);
 
@@ -166,20 +176,22 @@ static UString formatLocaleDate(ExecState* exec, double time, bool includeDate,
     ASSERT(length <= bufferLength);
     if (length > bufferLength)
         length = bufferLength;
-    CFStringGetCharacters(string, CFRangeMake(0, length), reinterpret_cast<UniChar *>(buffer));
+    CFStringGetCharacters(string, CFRangeMake(0, length), buffer);
 
     CFRelease(string);
 
-    return UString(buffer, length);
+    return jsNontrivialString(exec, UString(buffer, length));
 }
 
-#else
+#else // !PLATFORM(MAC)
 
-enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
- 
-static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, const LocaleDateTimeFormat format)
+static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, LocaleDateTimeFormat format)
 {
-    static const char* formatStrings[] = {"%#c", "%#x", "%X"};
+#if HAVE(LANGINFO_H)
+    static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
+#else
+    static const char* const formatStrings[] = { "%#c", "%#x", "%X" };
+#endif
  
     // Offset year if needed
     struct tm localTM = gdt;
@@ -188,10 +200,26 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, c
     if (yearNeedsOffset)
         localTM.tm_year = equivalentYearForDST(year) - 1900;
  
+#if HAVE(LANGINFO_H)
+    // We do not allow strftime to generate dates with 2-digits years,
+    // both to avoid ambiguity, and a crash in strncpy, for years that
+    // need offset.
+    char* formatString = strdup(nl_langinfo(formats[format]));
+    char* yPos = strchr(formatString, 'y');
+    if (yPos)
+        *yPos = 'Y';
+#endif
+
     // Do the formatting
     const int bufsize = 128;
     char timebuffer[bufsize];
+
+#if HAVE(LANGINFO_H)
+    size_t ret = strftime(timebuffer, bufsize, formatString, &localTM);
+    free(formatString);
+#else
     size_t ret = strftime(timebuffer, bufsize, formatStrings[format], &localTM);
+#endif
  
     if (ret == 0)
         return jsEmptyString(exec);
@@ -211,7 +239,15 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, c
     return jsNontrivialString(exec, timebuffer);
 }
 
-#endif // PLATFORM(WIN_OS)
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double timeInMilliseconds, LocaleDateTimeFormat format, const ArgList&)
+{
+    GregorianDateTime gregorianDateTime;
+    const bool notUTC = false;
+    dateObject->msToGregorianDateTime(timeInMilliseconds, notUTC, gregorianDateTime);
+    return formatLocaleDate(exec, gregorianDateTime, format);
+}
+
+#endif // !PLATFORM(MAC)
 
 // Converts a list of arguments sent to a Date member function into milliseconds, updating
 // ms (representing milliseconds) and t (representing the rest of the date structure) appropriately.
@@ -231,19 +267,19 @@ static bool fillStructuresUsingTimeArgs(ExecState* exec, const ArgList& args, in
     // hours
     if (maxArgs >= 4 && idx < numArgs) {
         t->hour = 0;
-        milliseconds += args.at(exec, idx++)->toInt32(exec, ok) * msPerHour;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerHour;
     }
 
     // minutes
     if (maxArgs >= 3 && idx < numArgs && ok) {
         t->minute = 0;
-        milliseconds += args.at(exec, idx++)->toInt32(exec, ok) * msPerMinute;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerMinute;
     }
     
     // seconds
     if (maxArgs >= 2 && idx < numArgs && ok) {
         t->second = 0;
-        milliseconds += args.at(exec, idx++)->toInt32(exec, ok) * msPerSecond;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerSecond;
     }
     
     if (!ok)
@@ -251,7 +287,7 @@ static bool fillStructuresUsingTimeArgs(ExecState* exec, const ArgList& args, in
         
     // milliseconds
     if (idx < numArgs) {
-        double millis = args.at(exec, idx)->toNumber(exec);
+        double millis = args.at(idx).toNumber(exec);
         ok = isfinite(millis);
         milliseconds += millis;
     } else
@@ -277,16 +313,16 @@ static bool fillStructuresUsingDateArgs(ExecState *exec, const ArgList& args, in
   
     // years
     if (maxArgs >= 3 && idx < numArgs)
-        t->year = args.at(exec, idx++)->toInt32(exec, ok) - 1900;
+        t->year = args.at(idx++).toInt32(exec, ok) - 1900;
     
     // months
     if (maxArgs >= 2 && idx < numArgs && ok)   
-        t->month = args.at(exec, idx++)->toInt32(exec, ok);
+        t->month = args.at(idx++).toInt32(exec, ok);
     
     // days
     if (idx < numArgs && ok) {   
         t->monthDay = 0;
-        *ms += args.at(exec, idx)->toInt32(exec, ok) * msPerDay;
+        *ms += args.at(idx).toInt32(exec, ok) * msPerDay;
     }
     
     return ok;
@@ -295,7 +331,6 @@ static bool fillStructuresUsingDateArgs(ExecState *exec, const ArgList& args, in
 const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState::dateTable};
 
 /* Source for DatePrototype.lut.h
-   FIXME: We could use templates to simplify the UTC variants.
 @begin dateTable
   toString              dateProtoFuncToString                DontEnum|Function       0
   toUTCString           dateProtoFuncToUTCString             DontEnum|Function       0
@@ -304,7 +339,7 @@ const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState
   toLocaleString        dateProtoFuncToLocaleString          DontEnum|Function       0
   toLocaleDateString    dateProtoFuncToLocaleDateString      DontEnum|Function       0
   toLocaleTimeString    dateProtoFuncToLocaleTimeString      DontEnum|Function       0
-  valueOf               dateProtoFuncValueOf                 DontEnum|Function       0
+  valueOf               dateProtoFuncGetTime                 DontEnum|Function       0
   getTime               dateProtoFuncGetTime                 DontEnum|Function       0
   getFullYear           dateProtoFuncGetFullYear             DontEnum|Function       0
   getUTCFullYear        dateProtoFuncGetUTCFullYear          DontEnum|Function       0
@@ -343,6 +378,7 @@ const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState
   getYear               dateProtoFuncGetYear                 DontEnum|Function       0
 @end
 */
+
 // ECMA 15.9.4
 
 DatePrototype::DatePrototype(ExecState* exec, PassRefPtr<Structure> structure)
@@ -359,9 +395,9 @@ bool DatePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& proper
 
 // Functions
 
-JSValuePtr dateProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -376,9 +412,9 @@ JSValuePtr dateProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -393,9 +429,9 @@ JSValuePtr dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -410,9 +446,9 @@ JSValuePtr dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValuePtr this
     return jsNontrivialString(exec, formatDate(t));
 }
 
-JSValuePtr dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -427,9 +463,9 @@ JSValuePtr dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValuePtr this
     return jsNontrivialString(exec, formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -437,23 +473,12 @@ JSValuePtr dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr th
     if (isnan(milli))
         return jsNontrivialString(exec, "Invalid Date");
 
-#if PLATFORM(MAC)
-    double secs = floor(milli / msPerSecond);
-    return jsNontrivialString(exec, formatLocaleDate(exec, secs, true, true, args));
-#else
-    UNUSED_PARAM(args);
-
-    const bool utc = false;
-
-    GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return formatLocaleDate(exec, t, LocaleDateAndTime);
-#endif
+    return formatLocaleDate(exec, thisDateObj, milli, LocaleDateAndTime, args);
 }
 
-JSValuePtr dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -461,23 +486,12 @@ JSValuePtr dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValuePt
     if (isnan(milli))
         return jsNontrivialString(exec, "Invalid Date");
 
-#if PLATFORM(MAC)
-    double secs = floor(milli / msPerSecond);
-    return jsNontrivialString(exec, formatLocaleDate(exec, secs, true, false, args));
-#else
-    UNUSED_PARAM(args);
-
-    const bool utc = false;
-
-    GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return formatLocaleDate(exec, t, LocaleDate);
-#endif
+    return formatLocaleDate(exec, thisDateObj, milli, LocaleDate, args);
 }
 
-JSValuePtr dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -485,36 +499,12 @@ JSValuePtr dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValuePt
     if (isnan(milli))
         return jsNontrivialString(exec, "Invalid Date");
 
-#if PLATFORM(MAC)
-    double secs = floor(milli / msPerSecond);
-    return jsNontrivialString(exec, formatLocaleDate(exec, secs, false, true, args));
-#else
-    UNUSED_PARAM(args);
-
-    const bool utc = false;
-
-    GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return formatLocaleDate(exec, t, LocaleTime);
-#endif
-}
-
-JSValuePtr dateProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
-{
-    if (!thisValue->isObject(&DateInstance::info))
-        return throwError(exec, TypeError);
-
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
-
-    return jsNumber(exec, milli);
+    return formatLocaleDate(exec, thisDateObj, milli, LocaleTime, args);
 }
 
-JSValuePtr dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -525,9 +515,9 @@ JSValuePtr dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValuePtr thisValue
     return jsNumber(exec, milli);
 }
 
-JSValuePtr dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -542,9 +532,9 @@ JSValuePtr dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNumber(exec, 1900 + t.year);
 }
 
-JSValuePtr dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -559,9 +549,9 @@ JSValuePtr dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr th
     return jsNumber(exec, 1900 + t.year);
 }
 
-JSValuePtr dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -576,9 +566,9 @@ JSValuePtr dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -593,9 +583,9 @@ JSValuePtr dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNumber(exec, t.month);
 }
 
-JSValuePtr dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -610,9 +600,9 @@ JSValuePtr dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNumber(exec, t.month);
 }
 
-JSValuePtr dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -627,9 +617,9 @@ JSValuePtr dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValuePtr thisValue
     return jsNumber(exec, t.monthDay);
 }
 
-JSValuePtr dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -644,9 +634,9 @@ JSValuePtr dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsNumber(exec, t.monthDay);
 }
 
-JSValuePtr dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -661,9 +651,9 @@ JSValuePtr dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return jsNumber(exec, t.weekDay);
 }
 
-JSValuePtr dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -678,9 +668,9 @@ JSValuePtr dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValuePtr thisVal
     return jsNumber(exec, t.weekDay);
 }
 
-JSValuePtr dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -695,9 +685,9 @@ JSValuePtr dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNumber(exec, t.hour);
 }
 
-JSValuePtr dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -712,9 +702,9 @@ JSValuePtr dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNumber(exec, t.hour);
 }
 
-JSValuePtr dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -729,9 +719,9 @@ JSValuePtr dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsNumber(exec, t.minute);
 }
 
-JSValuePtr dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -746,9 +736,9 @@ JSValuePtr dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thi
     return jsNumber(exec, t.minute);
 }
 
-JSValuePtr dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -763,9 +753,9 @@ JSValuePtr dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsNumber(exec, t.second);
 }
 
-JSValuePtr dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -780,9 +770,9 @@ JSValuePtr dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thi
     return jsNumber(exec, t.second);
 }
 
-JSValuePtr dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -795,9 +785,9 @@ JSValuePtr dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr t
     return jsNumber(exec, ms);
 }
 
-JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -810,9 +800,9 @@ JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePt
     return jsNumber(exec, ms);
 }
 
-JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -827,29 +817,29 @@ JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValuePtr
     return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
 }
 
-JSValuePtr dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    double milli = timeClip(args.at(exec, 0)->toNumber(exec));
-    JSValuePtr result = jsNumber(exec, milli);
+    double milli = timeClip(args.at(0).toNumber(exec));
+    JSValue result = jsNumber(exec, milli);
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-static JSValuePtr setNewValueFromTimeArgs(ExecState* exec, JSValuePtr thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
+static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     double milli = thisDateObj->internalNumber();
     
     if (args.isEmpty() || isnan(milli)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
@@ -861,24 +851,24 @@ static JSValuePtr setNewValueFromTimeArgs(ExecState* exec, JSValuePtr thisValue,
     thisDateObj->msToGregorianDateTime(milli, inputIsUTC, t);
 
     if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
     
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-static JSValuePtr setNewValueFromDateArgs(ExecState* exec, JSValuePtr thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
+static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     if (args.isEmpty()) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }      
@@ -898,110 +888,110 @@ static JSValuePtr setNewValueFromDateArgs(ExecState* exec, JSValuePtr thisValue,
     }
     
     if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
            
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-JSValuePtr dateProtoFuncSetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 4, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 4, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
@@ -1021,22 +1011,22 @@ JSValuePtr dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValuePtr thisValue
     }
     
     bool ok = true;
-    int32_t year = args.at(exec, 0)->toInt32(exec, ok);
+    int32_t year = args.at(0).toInt32(exec, ok);
     if (!ok) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
             
     t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-JSValuePtr dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index a6bbdf2881..5f4d0ec43d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -36,7 +36,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
index 5e21c8e56e..db1d8ccb0b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
@@ -26,6 +26,7 @@
 
 #include "ConstructData.h"
 #include "ErrorConstructor.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
 #include "JSString.h"
@@ -72,7 +73,7 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const UString& message,
             break;
     }
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     if (message.isEmpty())
         args.append(jsString(exec, name));
     else
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp
index 2e8a52389a..07b7e23381 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -41,8 +41,8 @@ ErrorConstructor::ErrorConstructor(ExecState* exec, PassRefPtr<Structure> struct
 ErrorInstance* constructError(ExecState* exec, const ArgList& args)
 {
     ErrorInstance* obj = new (exec) ErrorInstance(exec->lexicalGlobalObject()->errorStructure());
-    if (!args.at(exec, 0)->isUndefined())
-        obj->putDirect(exec->propertyNames().message, jsString(exec, args.at(exec, 0)->toString(exec)));
+    if (!args.at(0).isUndefined())
+        obj->putDirect(exec->propertyNames().message, jsString(exec, args.at(0).toString(exec)));
     return obj;
 }
 
@@ -58,7 +58,7 @@ ConstructType ErrorConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.9.2
-static JSValuePtr callErrorConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callErrorConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     // "Error()" gives the sames result as "new Error()"
     return constructError(exec, args);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
index 35358f7f76..599390ee92 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ErrorPrototype.h"
 
+#include "JSFunction.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -30,7 +31,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ErrorPrototype);
 
-static JSValuePtr errorProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.9.4
 ErrorPrototype::ErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
@@ -41,24 +42,24 @@ ErrorPrototype::ErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure,
     putDirectWithoutTransition(exec->propertyNames().name, jsNontrivialString(exec, "Error"), DontEnum);
     putDirectWithoutTransition(exec->propertyNames().message, jsNontrivialString(exec, "Unknown error"), DontEnum);
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
 }
 
-JSValuePtr errorProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     UString s = "Error";
 
-    JSValuePtr v = thisObj->get(exec, exec->propertyNames().name);
-    if (!v->isUndefined())
-        s = v->toString(exec);
+    JSValue v = thisObj->get(exec, exec->propertyNames().name);
+    if (!v.isUndefined())
+        s = v.toString(exec);
 
     v = thisObj->get(exec, exec->propertyNames().message);
-    if (!v->isUndefined()) {
+    if (!v.isUndefined()) {
         // Mozilla-compatible format.
         s += ": ";
-        s += v->toString(exec);
+        s += v.toString(exec);
     }
 
     return jsNontrivialString(exec, s);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 42ddf04125..e63594c032 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -31,6 +31,7 @@
 
 #include "CodeBlock.h"
 #include "CallFrame.h"
+#include "JSGlobalObjectFunctions.h"
 #include "JSObject.h"
 #include "JSNotAnObject.h"
 #include "Interpreter.h"
@@ -38,16 +39,6 @@
 
 namespace JSC {
 
-static void substitute(UString& string, const UString& substring)
-{
-    int position = string.find("%s");
-    ASSERT(position != -1);
-    UString newString = string.substr(0, position);
-    newString.append(substring);
-    newString.append(string.substr(position + 2));
-    string = newString;
-}
-
 class InterruptedExecutionError : public JSObject {
 public:
     InterruptedExecutionError(JSGlobalData* globalData)
@@ -56,38 +47,26 @@ public:
     }
 
     virtual bool isWatchdogException() const { return true; }
+
+    virtual UString toString(ExecState*) const { return "JavaScript execution exceeded timeout."; }
 };
 
-JSValuePtr createInterruptedExecutionException(JSGlobalData* globalData)
+JSValue createInterruptedExecutionException(JSGlobalData* globalData)
 {
     return new (globalData) InterruptedExecutionError(globalData);
 }
 
-JSValuePtr createError(ExecState* exec, ErrorType e, const char* msg)
+static JSValue createError(ExecState* exec, ErrorType e, const char* msg)
 {
     return Error::create(exec, e, msg, -1, -1, 0);
 }
 
-JSValuePtr createError(ExecState* exec, ErrorType e, const char* msg, const Identifier& label)
-{
-    UString message = msg;
-    substitute(message, label.ustring());
-    return Error::create(exec, e, message, -1, -1, 0);
-}
-
-JSValuePtr createError(ExecState* exec, ErrorType e, const char* msg, JSValuePtr v)
-{
-    UString message = msg;
-    substitute(message, v->toString(exec));
-    return Error::create(exec, e, message, -1, -1, 0);
-}
-
-JSValuePtr createStackOverflowError(ExecState* exec)
+JSValue createStackOverflowError(ExecState* exec)
 {
     return createError(exec, RangeError, "Maximum call stack size exceeded.");
 }
 
-JSValuePtr createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
@@ -102,12 +81,10 @@ JSValuePtr createUndefinedVariableError(ExecState* exec, const Identifier& ident
     return exception;
 }
     
-bool isStrWhiteSpace(UChar c);
-
-static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValuePtr value, UString error)
+static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValue value, UString error)
 {
     if (!expressionStop || expressionStart > codeBlock->source()->length()) {
-        UString errorText = value->toString(exec);
+        UString errorText = value.toString(exec);
         errorText.append(" is ");
         errorText.append(error);
         return errorText;
@@ -119,7 +96,7 @@ static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, in
         errorText.append('\'');
         errorText.append(codeBlock->source()->getRange(expressionStart, expressionStop));
         errorText.append("' [");
-        errorText.append(value->toString(exec));
+        errorText.append(value.toString(exec));
         errorText.append("] is ");
     } else {
         // No range information, so give a few characters of context
@@ -140,7 +117,7 @@ static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, in
         errorText.append("near '...");
         errorText.append(codeBlock->source()->getRange(start, stop));
         errorText.append("...' [");
-        errorText.append(value->toString(exec));
+        errorText.append(value.toString(exec));
         errorText.append("] is ");
     }
     errorText.append(error);
@@ -148,7 +125,7 @@ static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, in
     return errorText;
 }
 
-JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     UString message = "not a valid argument for '";
     message.append(op);
@@ -166,7 +143,7 @@ JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValuePtr va
     return exception;
 }
 
-JSObject* createNotAConstructorError(ExecState* exec, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSObject* createNotAConstructorError(ExecState* exec, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
@@ -187,7 +164,7 @@ JSObject* createNotAConstructorError(ExecState* exec, JSValuePtr value, unsigned
     return exception;
 }
 
-JSValuePtr createNotAFunctionError(ExecState* exec, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSValue createNotAFunctionError(ExecState* exec, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index d4dfdd865f..09d99dc1e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -40,16 +40,16 @@ namespace JSC {
     class JSGlobalData;
     class JSNotAnObjectErrorStub;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class Node;
 
-    JSValuePtr createInterruptedExecutionException(JSGlobalData*);
-    JSValuePtr createStackOverflowError(ExecState*);
-    JSValuePtr createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
+    JSValue createInterruptedExecutionException(JSGlobalData*);
+    JSValue createStackOverflowError(ExecState*);
+    JSValue createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
     JSNotAnObjectErrorStub* createNotAnObjectErrorStub(ExecState*, bool isNull);
-    JSObject* createInvalidParamError(ExecState*, const char* op, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
-    JSObject* createNotAConstructorError(ExecState*, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
-    JSValuePtr createNotAFunctionError(ExecState*, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
+    JSObject* createInvalidParamError(ExecState*, const char* op, JSValue, unsigned bytecodeOffset, CodeBlock*);
+    JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
+    JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
index e8cfe65a01..f4f5cc8e61 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -54,7 +54,7 @@ ConstructType FunctionConstructor::getConstructData(ConstructData& constructData
     return ConstructTypeHost;
 }
 
-static JSValuePtr callFunctionConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callFunctionConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructFunction(exec, args);
 }
@@ -66,7 +66,7 @@ CallType FunctionConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-static FunctionBodyNode* functionBody(ProgramNode* program)
+FunctionBodyNode* extractFunctionBody(ProgramNode* program)
 {
     if (!program)
         return 0;
@@ -75,17 +75,19 @@ static FunctionBodyNode* functionBody(ProgramNode* program)
     if (children.size() != 1)
         return 0;
 
-    ExprStatementNode* exprStatement = static_cast<ExprStatementNode*>(children[0].get()); 
+    StatementNode* exprStatement = children[0];
+    ASSERT(exprStatement);
     ASSERT(exprStatement->isExprStatement());
     if (!exprStatement || !exprStatement->isExprStatement())
         return 0;
 
-    FuncExprNode* funcExpr = static_cast<FuncExprNode*>(exprStatement->expr());
+    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
+    ASSERT(funcExpr);
     ASSERT(funcExpr->isFuncExprNode());
     if (!funcExpr || !funcExpr->isFuncExprNode())
         return 0;
 
-    FunctionBodyNode* body = funcExpr->body();
+    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
     ASSERT(body);
     return body;
 }
@@ -93,16 +95,19 @@ static FunctionBodyNode* functionBody(ProgramNode* program)
 // ECMA 15.3.2 The Function Constructor
 JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
 {
+    // Functions need to have a space following the opening { due to for web compatibility
+    // see https://bugs.webkit.org/show_bug.cgi?id=24350
+    // We also need \n before the closing } to handle // comments at the end of the last line
     UString program;
     if (args.isEmpty())
-        program = "(function(){})";
+        program = "(function() { \n})";
     else if (args.size() == 1)
-        program = "(function(){" + args.at(exec, 0)->toString(exec) + "})";
+        program = "(function() { " + args.at(0).toString(exec) + "\n})";
     else {
-        program = "(function(" + args.at(exec, 0)->toString(exec);
+        program = "(function(" + args.at(0).toString(exec);
         for (size_t i = 1; i < args.size() - 1; i++)
-            program += "," + args.at(exec, i)->toString(exec);
-        program += "){" + args.at(exec, args.size() - 1)->toString(exec) + "})";
+            program += "," + args.at(i).toString(exec);
+        program += ") { " + args.at(args.size() - 1).toString(exec) + "\n})";
     }
 
     int errLine;
@@ -110,7 +115,7 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     SourceCode source = makeSource(program, sourceURL, lineNumber);
     RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
 
-    FunctionBodyNode* body = functionBody(programNode.get());
+    FunctionBodyNode* body = extractFunctionBody(programNode.get());
     if (!body)
         return throwError(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
index e8486dc223..124b35484a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
@@ -26,6 +26,8 @@
 namespace JSC {
 
     class FunctionPrototype;
+    class ProgramNode;
+    class FunctionBodyNode;
 
     class FunctionConstructor : public InternalFunction {
     public:
@@ -39,6 +41,8 @@ namespace JSC {
     JSObject* constructFunction(ExecState*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
     JSObject* constructFunction(ExecState*, const ArgList&);
 
+    FunctionBodyNode* extractFunctionBody(ProgramNode*);
+
 } // namespace JSC
 
 #endif // FunctionConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
index 4d9d682d26..9ba2144190 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -26,15 +26,16 @@
 #include "JSFunction.h"
 #include "JSString.h"
 #include "Interpreter.h"
+#include "Lexer.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(FunctionPrototype);
 
-static JSValuePtr functionProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionProtoFuncApply(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionProtoFuncCall(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*, JSObject*, JSValue, const ArgList&);
 
 FunctionPrototype::FunctionPrototype(ExecState* exec, PassRefPtr<Structure> structure)
     : InternalFunction(&exec->globalData(), structure, exec->propertyNames().nullIdentifier)
@@ -42,14 +43,16 @@ FunctionPrototype::FunctionPrototype(ExecState* exec, PassRefPtr<Structure> stru
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 0), DontDelete | ReadOnly | DontEnum);
 }
 
-void FunctionPrototype::addFunctionProperties(ExecState* exec, Structure* prototypeFunctionStructure)
+void FunctionPrototype::addFunctionProperties(ExecState* exec, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().call, functionProtoFuncCall), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
+    *applyFunction = new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply);
+    putDirectFunctionWithoutTransition(exec, *applyFunction, DontEnum);
+    *callFunction = new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().call, functionProtoFuncCall);
+    putDirectFunctionWithoutTransition(exec, *callFunction, DontEnum);
 }
 
-static JSValuePtr callFunctionPrototype(ExecState*, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL callFunctionPrototype(ExecState*, JSObject*, JSValue, const ArgList&)
 {
     return jsUndefined();
 }
@@ -63,14 +66,34 @@ CallType FunctionPrototype::getCallData(CallData& callData)
 
 // Functions
 
-JSValuePtr functionProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+// Compatibility hack for the Optimost JavaScript library. (See <rdar://problem/6595040>.)
+static inline void insertSemicolonIfNeeded(UString& functionBody)
 {
-    if (thisValue->isObject(&JSFunction::info)) {
+    ASSERT(functionBody[0] == '{');
+    ASSERT(functionBody[functionBody.size() - 1] == '}');
+
+    for (size_t i = functionBody.size() - 2; i > 0; --i) {
+        UChar ch = functionBody[i];
+        if (!Lexer::isWhiteSpace(ch) && !Lexer::isLineTerminator(ch)) {
+            if (ch != ';' && ch != '}')
+                functionBody = functionBody.substr(0, i + 1) + ";" + functionBody.substr(i + 1, functionBody.size() - (i + 1));
+            return;
+        }
+    }
+}
+
+JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    if (thisValue.isObject(&JSFunction::info)) {
         JSFunction* function = asFunction(thisValue);
-        return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + function->body()->toSourceString());
+        if (!function->isHostFunction()) {
+            UString functionBody = function->body()->toSourceString();
+            insertSemicolonIfNeeded(functionBody);
+            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + functionBody);
+        }
     }
 
-    if (thisValue->isObject(&InternalFunction::info)) {
+    if (thisValue.isObject(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
         return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
     }
@@ -78,59 +101,44 @@ JSValuePtr functionProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr this
     return throwError(exec, TypeError);
 }
 
-JSValuePtr functionProtoFuncApply(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    CallType callType = thisValue->getCallData(callData);
+    CallType callType = thisValue.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSValuePtr thisArg = args.at(exec, 0);
-    JSValuePtr argArray = args.at(exec, 1);
+    JSValue array = args.at(1);
 
-    JSValuePtr applyThis;
-    if (thisArg->isUndefinedOrNull())
-        applyThis = exec->globalThisValue();
-    else
-        applyThis = thisArg->toObject(exec);
-
-    ArgList applyArgs;
-    if (!argArray->isUndefinedOrNull()) {
-        if (!argArray->isObject())
+    MarkedArgumentBuffer applyArgs;
+    if (!array.isUndefinedOrNull()) {
+        if (!array.isObject())
             return throwError(exec, TypeError);
-        if (asObject(argArray)->classInfo() == &Arguments::info)
-            asArguments(argArray)->fillArgList(exec, applyArgs);
-        else if (exec->interpreter()->isJSArray(argArray))
-            asArray(argArray)->fillArgList(exec, applyArgs);
-        else if (asObject(argArray)->inherits(&JSArray::info)) {
-            unsigned length = asArray(argArray)->get(exec, exec->propertyNames().length)->toUInt32(exec);
+        if (asObject(array)->classInfo() == &Arguments::info)
+            asArguments(array)->fillArgList(exec, applyArgs);
+        else if (isJSArray(&exec->globalData(), array))
+            asArray(array)->fillArgList(exec, applyArgs);
+        else if (asObject(array)->inherits(&JSArray::info)) {
+            unsigned length = asArray(array)->get(exec, exec->propertyNames().length).toUInt32(exec);
             for (unsigned i = 0; i < length; ++i)
-                applyArgs.append(asArray(argArray)->get(exec, i));
+                applyArgs.append(asArray(array)->get(exec, i));
         } else
             return throwError(exec, TypeError);
     }
 
-    return call(exec, thisValue, callType, callData, applyThis, applyArgs);
+    return call(exec, thisValue, callType, callData, args.at(0), applyArgs);
 }
 
-JSValuePtr functionProtoFuncCall(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL functionProtoFuncCall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    CallType callType = thisValue->getCallData(callData);
+    CallType callType = thisValue.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSValuePtr thisArg = args.at(exec, 0);
-
-    JSObject* callThis;
-    if (thisArg->isUndefinedOrNull())
-        callThis = exec->globalThisValue();
-    else
-        callThis = thisArg->toObject(exec);
-
-    ArgList argsTail;
-    args.getSlice(1, argsTail);
-    return call(exec, thisValue, callType, callData, callThis, argsTail);
+    ArgList callArgs;
+    args.getSlice(1, callArgs);
+    return call(exec, thisValue, callType, callData, args.at(0), callArgs);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index 33d68b7295..607ddab15a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -25,12 +25,14 @@
 
 namespace JSC {
 
+    class PrototypeFunction;
+
     class FunctionPrototype : public InternalFunction {
     public:
         FunctionPrototype(ExecState*, PassRefPtr<Structure>);
-        void addFunctionProperties(ExecState*, Structure* prototypeFunctionStructure);
+        void addFunctionProperties(ExecState*, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto)
+        static PassRefPtr<Structure> createStructure(JSValue proto)
         {
             return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
index d24a024113..cd1b40a15f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
@@ -38,17 +38,17 @@ void GetterSetter::mark()
         m_setter->mark();
 }
 
-JSValuePtr GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     ASSERT_NOT_REACHED();
     return jsNull();
 }
 
-bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     ASSERT_NOT_REACHED();
     number = 0;
-    value = noValue();
+    value = JSValue();
     return true;
 }
 
@@ -73,7 +73,7 @@ UString GetterSetter::toString(ExecState*) const
 JSObject* GetterSetter::toObject(ExecState* exec) const
 {
     ASSERT_NOT_REACHED();
-    return jsNull()->toObject(exec);
+    return jsNull().toObject(exec);
 }
 
 bool GetterSetter::isGetterSetter() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index 48e1baf3f7..e6b74a1ed0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -50,8 +50,8 @@ namespace JSC {
     private:
         virtual bool isGetterSetter() const;
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -61,9 +61,9 @@ namespace JSC {
         JSObject* m_setter;  
     };
 
-    GetterSetter* asGetterSetter(JSValuePtr);
+    GetterSetter* asGetterSetter(JSValue);
 
-    inline GetterSetter* asGetterSetter(JSValuePtr value)
+    inline GetterSetter* asGetterSetter(JSValue value)
     {
         ASSERT(asCell(value)->isGetterSetter());
         return static_cast<GetterSetter*>(asCell(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
index 837201016c..040c123e55 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
@@ -124,12 +124,12 @@ struct CStringTranslator {
 PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const char* c)
 {
     if (!c) {
-        UString::Rep::null.hash();
-        return &UString::Rep::null;
+        UString::Rep::null().hash();
+        return &UString::Rep::null();
     }
     if (!c[0]) {
-        UString::Rep::empty.hash();
-        return &UString::Rep::empty;
+        UString::Rep::empty().hash();
+        return &UString::Rep::empty();
     }
     if (!c[1])
         return add(globalData, globalData->smallStrings.singleCharacterStringRep(static_cast<unsigned char>(c[0])));
@@ -194,8 +194,8 @@ PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const UChar*
             return add(globalData, globalData->smallStrings.singleCharacterStringRep(c));
     }
     if (!length) {
-        UString::Rep::empty.hash();
-        return &UString::Rep::empty;
+        UString::Rep::empty().hash();
+        return &UString::Rep::empty();
     }
     UCharBuffer buf = {s, length}; 
     pair<HashSet<UString::Rep*>::iterator, bool> addResult = globalData->identifierTable->add<UCharBuffer, UCharBufferTranslator>(buf);
@@ -225,8 +225,8 @@ PassRefPtr<UString::Rep> Identifier::addSlowCase(JSGlobalData* globalData, UStri
             }
     }
     if (!r->len) {
-        UString::Rep::empty.hash();
-        return &UString::Rep::empty;
+        UString::Rep::empty().hash();
+        return &UString::Rep::empty();
     }
     return *globalData->identifierTable->add(r).first;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
index a17c386b81..cda9fb11ea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -49,9 +49,9 @@ static pthread_once_t initializeThreadingKeyOnce = PTHREAD_ONCE_INIT;
 static void initializeThreadingOnce()
 {
     WTF::initializeThreading();
+    initializeUString();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex = new Mutex;
-    UString::null();
     initDateMath();
 #endif
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
index 6714cf5426..b5c9571559 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
@@ -48,4 +48,24 @@ const UString& InternalFunction::name(JSGlobalData* globalData)
     return asString(getDirect(globalData->propertyNames->name))->value();
 }
 
+const UString InternalFunction::displayName(JSGlobalData* globalData)
+{
+    JSValue displayName = getDirect(globalData->propertyNames->displayName);
+    
+    if (displayName && isJSString(globalData, displayName))
+        return asString(displayName)->value();
+    
+    return UString::null();
+}
+
+const UString InternalFunction::calculatedDisplayName(JSGlobalData* globalData)
+{
+    const UString explicitName = displayName(globalData);
+    
+    if (!explicitName.isEmpty())
+        return explicitName;
+    
+    return name(globalData);
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index cc4b917e44..310644cedc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -34,11 +34,13 @@ namespace JSC {
     class InternalFunction : public JSObject {
     public:
         virtual const ClassInfo* classInfo() const; 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         const UString& name(JSGlobalData*);
+        const UString displayName(JSGlobalData*);
+        const UString calculatedDisplayName(JSGlobalData*);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
         }
@@ -51,9 +53,9 @@ namespace JSC {
         virtual CallType getCallData(CallData&) = 0;
     };
 
-    InternalFunction* asInternalFunction(JSValuePtr);
+    InternalFunction* asInternalFunction(JSValue);
 
-    inline InternalFunction* asInternalFunction(JSValuePtr value)
+    inline InternalFunction* asInternalFunction(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&InternalFunction::info));
         return static_cast<InternalFunction*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
index d03b3f08cf..89966292f5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
@@ -75,7 +75,7 @@ void JSActivation::mark()
 
     for ( ; i < count; ++i) {
         Register& r = registerArray[i];
-        if (!r.marked())
+        if (r.jsValue() && !r.marked())
             r.mark();
     }
 }
@@ -85,7 +85,7 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     if (symbolTableGet(propertyName, slot))
         return true;
 
-    if (JSValuePtr* location = getDirectLocation(propertyName)) {
+    if (JSValue* location = getDirectLocation(propertyName)) {
         slot.setValueSlot(location);
         return true;
     }
@@ -99,11 +99,11 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     // We don't call through to JSObject because there's no way to give an 
     // activation object getter properties or a prototype.
     ASSERT(!hasGetterSetterProperties());
-    ASSERT(prototype()->isNull());
+    ASSERT(prototype().isNull());
     return false;
 }
 
-void JSActivation::put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSActivation::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -118,7 +118,7 @@ void JSActivation::put(ExecState*, const Identifier& propertyName, JSValuePtr va
 }
 
 // FIXME: Make this function honor ReadOnly (const) and DontEnum
-void JSActivation::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSActivation::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -130,7 +130,7 @@ void JSActivation::putWithAttributes(ExecState*, const Identifier& propertyName,
     // expose in the activation object.
     ASSERT(!hasGetterSetterProperties());
     PutPropertySlot slot;
-    putDirect(propertyName, value, attributes, true, slot);
+    JSObject::putWithAttributes(exec, propertyName, value, attributes, true, slot);
 }
 
 bool JSActivation::deleteProperty(ExecState* exec, const Identifier& propertyName)
@@ -151,7 +151,7 @@ bool JSActivation::isDynamicScope() const
     return d()->functionBody->usesEval();
 }
 
-JSValuePtr JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSActivation* activation = asActivation(slot.slotBase());
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index 222f423a00..c183dac77c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -50,11 +50,13 @@ namespace JSC {
 
         virtual bool isDynamicScope() const;
 
+        virtual bool isActivationObject() const { return true; }
+
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
-        virtual void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
@@ -64,7 +66,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
 
     private:
         struct JSActivationData : public JSVariableObjectData {
@@ -77,15 +79,15 @@ namespace JSC {
             RefPtr<FunctionBodyNode> functionBody;
         };
         
-        static JSValuePtr argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
         JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
     };
 
-    JSActivation* asActivation(JSValuePtr);
+    JSActivation* asActivation(JSValue);
 
-    inline JSActivation* asActivation(JSValuePtr value)
+    inline JSActivation* asActivation(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSActivation::info));
         return static_cast<JSActivation*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index 35d0dec250..296ac9d5a7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -24,9 +24,11 @@
 #include "JSArray.h"
 
 #include "ArrayPrototype.h"
+#include "CachedCall.h"
 #include "PropertyNameArray.h"
 #include <wtf/AVLTree.h>
 #include <wtf/Assertions.h>
+#include <wtf/OwnPtr.h>
 #include <Operations.h>
 
 #define CHECK_ARRAY_CONSISTENCY 0
@@ -65,9 +67,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSArray);
 
 // The definition of MAX_STORAGE_VECTOR_LENGTH is dependant on the definition storageSize
 // function below - the MAX_STORAGE_VECTOR_LENGTH limit is defined such that the storage
-// size calculation cannot overflow.  (sizeof(ArrayStorage) - sizeof(JSValuePtr)) +
-// (vectorLength * sizeof(JSValuePtr)) must be <= 0xFFFFFFFFU (which is maximum value of size_t).
-#define MAX_STORAGE_VECTOR_LENGTH static_cast<unsigned>((0xFFFFFFFFU - (sizeof(ArrayStorage) - sizeof(JSValuePtr))) / sizeof(JSValuePtr))
+// size calculation cannot overflow.  (sizeof(ArrayStorage) - sizeof(JSValue)) +
+// (vectorLength * sizeof(JSValue)) must be <= 0xFFFFFFFFU (which is maximum value of size_t).
+#define MAX_STORAGE_VECTOR_LENGTH static_cast<unsigned>((0xFFFFFFFFU - (sizeof(ArrayStorage) - sizeof(JSValue))) / sizeof(JSValue))
 
 // These values have to be macros to be used in max() and min() without introducing
 // a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
@@ -90,10 +92,10 @@ static inline size_t storageSize(unsigned vectorLength)
 
     // MAX_STORAGE_VECTOR_LENGTH is defined such that provided (vectorLength <= MAX_STORAGE_VECTOR_LENGTH)
     // - as asserted above - the following calculation cannot overflow.
-    size_t size = (sizeof(ArrayStorage) - sizeof(JSValuePtr)) + (vectorLength * sizeof(JSValuePtr));
+    size_t size = (sizeof(ArrayStorage) - sizeof(JSValue)) + (vectorLength * sizeof(JSValue));
     // Assertion to detect integer overflow in previous calculation (should not be possible, provided that
     // MAX_STORAGE_VECTOR_LENGTH is correctly defined).
-    ASSERT(((size - (sizeof(ArrayStorage) - sizeof(JSValuePtr))) / sizeof(JSValuePtr) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(JSValuePtr))));
+    ASSERT(((size - (sizeof(ArrayStorage) - sizeof(JSValue))) / sizeof(JSValue) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(JSValue))));
 
     return size;
 }
@@ -149,12 +151,12 @@ JSArray::JSArray(PassRefPtr<Structure> structure, unsigned initialLength)
     m_storage->m_vectorLength = initialCapacity;
     m_storage->m_length = initialLength;
 
-    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValuePtr));
+    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
 
     checkConsistency();
 }
 
-JSArray::JSArray(ExecState* exec, PassRefPtr<Structure> structure, const ArgList& list)
+JSArray::JSArray(PassRefPtr<Structure> structure, const ArgList& list)
     : JSObject(structure)
 {
     unsigned length = list.size();
@@ -171,12 +173,11 @@ JSArray::JSArray(ExecState* exec, PassRefPtr<Structure> structure, const ArgList
     size_t i = 0;
     ArgList::const_iterator end = list.end();
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
-        storage->m_vector[i] = (*it).jsValue(exec);
+        storage->m_vector[i] = *it;
 
     m_storage = storage;
 
-    // When the array is created non-empty, its cells are filled, so it's really no worse than
-    // a property map. Therefore don't report extra memory cost.
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(length));
 
     checkConsistency();
 }
@@ -200,7 +201,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
     }
 
     if (i < storage->m_vectorLength) {
-        JSValuePtr& valueSlot = storage->m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             slot.setValueSlot(&valueSlot);
             return true;
@@ -234,7 +235,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
 }
 
 // ECMA 15.4.5.1
-void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
@@ -244,8 +245,8 @@ void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr va
     }
 
     if (propertyName == exec->propertyNames().length) {
-        unsigned newLength = value->toUInt32(exec);
-        if (value->toNumber(exec) != static_cast<double>(newLength)) {
+        unsigned newLength = value.toUInt32(exec);
+        if (value.toNumber(exec) != static_cast<double>(newLength)) {
             throwError(exec, RangeError, "Invalid array length.");
             return;
         }
@@ -256,7 +257,7 @@ void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr va
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void JSArray::put(ExecState* exec, unsigned i, JSValuePtr value)
+void JSArray::put(ExecState* exec, unsigned i, JSValue value)
 {
     checkConsistency();
 
@@ -267,7 +268,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValuePtr value)
     }
 
     if (i < m_storage->m_vectorLength) {
-        JSValuePtr& valueSlot = m_storage->m_vector[i];
+        JSValue& valueSlot = m_storage->m_vector[i];
         if (valueSlot) {
             valueSlot = value;
             checkConsistency();
@@ -283,7 +284,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValuePtr value)
     putSlowCase(exec, i, value);
 }
 
-NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValuePtr value)
+NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue value)
 {
     ArrayStorage* storage = m_storage;
     SparseArrayValueMap* map = storage->m_sparseValueMap;
@@ -349,14 +350,17 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValuePtr v
     }
 
     unsigned vectorLength = storage->m_vectorLength;
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
+
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
-            storage->m_vector[j] = noValue();
+            storage->m_vector[j] = JSValue();
         if (i > MIN_SPARSE_ARRAY_INDEX)
             map->remove(i);
     } else {
         for (unsigned j = vectorLength; j < max(vectorLength, MIN_SPARSE_ARRAY_INDEX); ++j)
-            storage->m_vector[j] = noValue();
+            storage->m_vector[j] = JSValue();
         for (unsigned j = max(vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
             storage->m_vector[j] = map->take(j);
     }
@@ -391,12 +395,12 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
     ArrayStorage* storage = m_storage;
 
     if (i < storage->m_vectorLength) {
-        JSValuePtr& valueSlot = storage->m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
             return false;
         }
-        valueSlot = noValue();
+        valueSlot = JSValue();
         --storage->m_numValuesInVector;
         if (m_fastAccessCutoff > i)
             m_fastAccessCutoff = i;
@@ -462,10 +466,11 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     if (!storage)
         return false;
 
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
     storage->m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
-        storage->m_vector[i] = noValue();
+        storage->m_vector[i] = JSValue();
 
     m_storage = storage;
     return true;
@@ -485,9 +490,9 @@ void JSArray::setLength(unsigned newLength)
 
         unsigned usedVectorLength = min(length, storage->m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
-            JSValuePtr& valueSlot = storage->m_vector[i];
+            JSValue& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
-            valueSlot = noValue();
+            valueSlot = JSValue();
             storage->m_numValuesInVector -= hadValue;
         }
 
@@ -510,7 +515,7 @@ void JSArray::setLength(unsigned newLength)
     checkConsistency();
 }
 
-JSValuePtr JSArray::pop()
+JSValue JSArray::pop()
 {
     checkConsistency();
 
@@ -520,19 +525,19 @@ JSValuePtr JSArray::pop()
 
     --length;
 
-    JSValuePtr result;
+    JSValue result;
 
     if (m_fastAccessCutoff > length) {
-        JSValuePtr& valueSlot = m_storage->m_vector[length];
+        JSValue& valueSlot = m_storage->m_vector[length];
         result = valueSlot;
         ASSERT(result);
-        valueSlot = noValue();
+        valueSlot = JSValue();
         --m_storage->m_numValuesInVector;
         m_fastAccessCutoff = length;
     } else if (length < m_storage->m_vectorLength) {
-        JSValuePtr& valueSlot = m_storage->m_vector[length];
+        JSValue& valueSlot = m_storage->m_vector[length];
         result = valueSlot;
-        valueSlot = noValue();
+        valueSlot = JSValue();
         if (result)
             --m_storage->m_numValuesInVector;
         else
@@ -559,7 +564,7 @@ JSValuePtr JSArray::pop()
     return result;
 }
 
-void JSArray::push(ExecState* exec, JSValuePtr value)
+void JSArray::push(ExecState* exec, JSValue value)
 {
     checkConsistency();
 
@@ -599,30 +604,68 @@ void JSArray::mark()
 
     unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
     for (unsigned i = 0; i < usedVectorLength; ++i) {
-        JSValuePtr value = storage->m_vector[i];
-        if (value && !value->marked())
-            value->mark();
+        JSValue value = storage->m_vector[i];
+        if (value && !value.marked())
+            value.mark();
     }
 
     if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
         SparseArrayValueMap::iterator end = map->end();
         for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it) {
-            JSValuePtr value = it->second;
-            if (!value->marked())
-                value->mark();
+            JSValue value = it->second;
+            if (!value.marked())
+                value.mark();
         }
     }
 }
 
-typedef std::pair<JSValuePtr, UString> ArrayQSortPair;
+static int compareNumbersForQSort(const void* a, const void* b)
+{
+    double da = static_cast<const JSValue*>(a)->uncheckedGetNumber();
+    double db = static_cast<const JSValue*>(b)->uncheckedGetNumber();
+    return (da > db) - (da < db);
+}
+
+typedef std::pair<JSValue, UString> ValueStringPair;
 
 static int compareByStringPairForQSort(const void* a, const void* b)
 {
-    const ArrayQSortPair* va = static_cast<const ArrayQSortPair*>(a);
-    const ArrayQSortPair* vb = static_cast<const ArrayQSortPair*>(b);
+    const ValueStringPair* va = static_cast<const ValueStringPair*>(a);
+    const ValueStringPair* vb = static_cast<const ValueStringPair*>(b);
     return compare(va->second, vb->second);
 }
 
+void JSArray::sortNumeric(ExecState* exec, JSValue compareFunction, CallType callType, const CallData& callData)
+{
+    unsigned lengthNotIncludingUndefined = compactForSorting();
+    if (m_storage->m_sparseValueMap) {
+        throwOutOfMemoryError(exec);
+        return;
+    }
+
+    if (!lengthNotIncludingUndefined)
+        return;
+        
+    bool allValuesAreNumbers = true;
+    size_t size = m_storage->m_numValuesInVector;
+    for (size_t i = 0; i < size; ++i) {
+        if (!m_storage->m_vector[i].isNumber()) {
+            allValuesAreNumbers = false;
+            break;
+        }
+    }
+
+    if (!allValuesAreNumbers)
+        return sort(exec, compareFunction, callType, callData);
+
+    // For numeric comparison, which is fast, qsort is faster than mergesort. We
+    // also don't require mergesort's stability, since there's no user visible
+    // side-effect from swapping the order of equal primitive values.
+    qsort(m_storage->m_vector, size, sizeof(JSValue), compareNumbersForQSort);
+
+    checkConsistency(SortConsistencyCheck);
+}
+
 void JSArray::sort(ExecState* exec)
 {
     unsigned lengthNotIncludingUndefined = compactForSorting();
@@ -639,15 +682,15 @@ void JSArray::sort(ExecState* exec)
     // buffer. Besides, this protects us from crashing if some objects have custom toString methods that return
     // random or otherwise changing results, effectively making compare function inconsistent.
 
-    Vector<ArrayQSortPair> values(lengthNotIncludingUndefined);
+    Vector<ValueStringPair> values(lengthNotIncludingUndefined);
     if (!values.begin()) {
         throwOutOfMemoryError(exec);
         return;
     }
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++) {
-        JSValuePtr value = m_storage->m_vector[i];
-        ASSERT(!value->isUndefined());
+        JSValue value = m_storage->m_vector[i];
+        ASSERT(!value.isUndefined());
         values[i].first = value;
     }
 
@@ -658,7 +701,7 @@ void JSArray::sort(ExecState* exec)
     // a toString call raises an exception.
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++)
-        values[i].second = values[i].first->toString(exec);
+        values[i].second = values[i].first.toString(exec);
 
     if (exec->hadException())
         return;
@@ -667,11 +710,11 @@ void JSArray::sort(ExecState* exec)
     // than O(N log N).
 
 #if HAVE(MERGESORT)
-    mergesort(values.begin(), values.size(), sizeof(ArrayQSortPair), compareByStringPairForQSort);
+    mergesort(values.begin(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
 #else
     // FIXME: The qsort library function is likely to not be a stable sort.
     // ECMAScript-262 does not specify a stable sort, but in practice, browsers perform a stable sort.
-    qsort(values.begin(), values.size(), sizeof(ArrayQSortPair), compareByStringPairForQSort);
+    qsort(values.begin(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
 #endif
 
     // FIXME: If the toString function changed the length of the array, this might be
@@ -684,7 +727,7 @@ void JSArray::sort(ExecState* exec)
 }
 
 struct AVLTreeNodeForArrayCompare {
-    JSValuePtr value;
+    JSValue value;
 
     // Child pointers.  The high bit of gt is robbed and used as the
     // balance factor sign.  The high bit of lt is robbed and used as
@@ -695,15 +738,16 @@ struct AVLTreeNodeForArrayCompare {
 
 struct AVLTreeAbstractorForArrayCompare {
     typedef int32_t handle; // Handle is an index into m_nodes vector.
-    typedef JSValuePtr key;
+    typedef JSValue key;
     typedef int32_t size;
 
     Vector<AVLTreeNodeForArrayCompare> m_nodes;
     ExecState* m_exec;
-    JSValuePtr m_compareFunction;
+    JSValue m_compareFunction;
     CallType m_compareCallType;
     const CallData* m_compareCallData;
-    JSValuePtr m_globalThisValue;
+    JSValue m_globalThisValue;
+    OwnPtr<CachedCall> m_cachedCall;
 
     handle get_less(handle h) { return m_nodes[h].lt & 0x7FFFFFFF; }
     void set_less(handle h, handle lh) { m_nodes[h].lt &= 0x80000000; m_nodes[h].lt |= lh; }
@@ -733,16 +777,24 @@ struct AVLTreeAbstractorForArrayCompare {
 
     int compare_key_key(key va, key vb)
     {
-        ASSERT(!va->isUndefined());
-        ASSERT(!vb->isUndefined());
+        ASSERT(!va.isUndefined());
+        ASSERT(!vb.isUndefined());
 
         if (m_exec->hadException())
             return 1;
 
-        ArgList arguments;
-        arguments.append(va);
-        arguments.append(vb);
-        double compareResult = call(m_exec, m_compareFunction, m_compareCallType, *m_compareCallData, m_globalThisValue, arguments)->toNumber(m_exec);
+        double compareResult;
+        if (m_cachedCall) {
+            m_cachedCall->setThis(m_globalThisValue);
+            m_cachedCall->setArgument(0, va);
+            m_cachedCall->setArgument(1, vb);
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+        } else {
+            MarkedArgumentBuffer arguments;
+            arguments.append(va);
+            arguments.append(vb);
+            compareResult = call(m_exec, m_compareFunction, m_compareCallType, *m_compareCallData, m_globalThisValue, arguments).toNumber(m_exec);
+        }
         return (compareResult < 0) ? -1 : 1; // Not passing equality through, because we need to store all values, even if equivalent.
     }
 
@@ -752,7 +804,7 @@ struct AVLTreeAbstractorForArrayCompare {
     static handle null() { return 0x7FFFFFFF; }
 };
 
-void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callType, const CallData& callData)
+void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType, const CallData& callData)
 {
     checkConsistency();
 
@@ -777,6 +829,9 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
     tree.abstractor().m_globalThisValue = exec->globalThisValue();
     tree.abstractor().m_nodes.resize(usedVectorLength + (m_storage->m_sparseValueMap ? m_storage->m_sparseValueMap->size() : 0));
 
+    if (callType == CallTypeJS)
+        tree.abstractor().m_cachedCall.set(new CachedCall(exec, asFunction(compareFunction), 2, exec->exceptionSlot()));
+
     if (!tree.abstractor().m_nodes.begin()) {
         throwOutOfMemoryError(exec);
         return;
@@ -790,16 +845,16 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
 
     // Iterate over the array, ignoring missing values, counting undefined ones, and inserting all other ones into the tree.
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValuePtr v = m_storage->m_vector[numDefined];
-        if (!v || v->isUndefined())
+        JSValue v = m_storage->m_vector[numDefined];
+        if (!v || v.isUndefined())
             break;
         tree.abstractor().m_nodes[numDefined].value = v;
         tree.insert(numDefined);
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValuePtr v = m_storage->m_vector[i];
+        JSValue v = m_storage->m_vector[i];
         if (v) {
-            if (v->isUndefined())
+            if (v.isUndefined())
                 ++numUndefined;
             else {
                 tree.abstractor().m_nodes[numDefined].value = v;
@@ -851,7 +906,7 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
 
     // Ensure that unused values in the vector are zeroed out.
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        m_storage->m_vector[i] = noValue();
+        m_storage->m_vector[i] = JSValue();
 
     m_fastAccessCutoff = newUsedVectorLength;
     m_storage->m_numValuesInVector = newUsedVectorLength;
@@ -859,7 +914,7 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
     checkConsistency(SortConsistencyCheck);
 }
 
-void JSArray::fillArgList(ExecState* exec, ArgList& args)
+void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
     unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
     unsigned i = 0;
@@ -869,6 +924,19 @@ void JSArray::fillArgList(ExecState* exec, ArgList& args)
         args.append(get(exec, i));
 }
 
+void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
+{
+    ASSERT(m_storage->m_length == maxSize);
+    UNUSED_PARAM(maxSize);
+    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    unsigned i = 0;
+    for (; i < fastAccessLength; ++i)
+        buffer[i] = getIndex(i);
+    uint32_t size = m_storage->m_length;
+    for (; i < size; ++i)
+        buffer[i] = get(exec, i);
+}
+
 unsigned JSArray::compactForSorting()
 {
     checkConsistency();
@@ -881,14 +949,14 @@ unsigned JSArray::compactForSorting()
     unsigned numUndefined = 0;
 
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValuePtr v = storage->m_vector[numDefined];
-        if (!v || v->isUndefined())
+        JSValue v = storage->m_vector[numDefined];
+        if (!v || v.isUndefined())
             break;
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValuePtr v = storage->m_vector[i];
+        JSValue v = storage->m_vector[i];
         if (v) {
-            if (v->isUndefined())
+            if (v.isUndefined())
                 ++numUndefined;
             else
                 storage->m_vector[numDefined++] = v;
@@ -918,7 +986,7 @@ unsigned JSArray::compactForSorting()
     for (unsigned i = numDefined; i < newUsedVectorLength; ++i)
         storage->m_vector[i] = jsUndefined();
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        storage->m_vector[i] = noValue();
+        storage->m_vector[i] = JSValue();
 
     m_fastAccessCutoff = newUsedVectorLength;
     storage->m_numValuesInVector = newUsedVectorLength;
@@ -951,7 +1019,7 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
 
     unsigned numValuesInVector = 0;
     for (unsigned i = 0; i < m_storage->m_vectorLength; ++i) {
-        if (JSValuePtr value = m_storage->m_vector[i]) {
+        if (JSValue value = m_storage->m_vector[i]) {
             ASSERT(i < m_storage->m_length);
             if (type != DestructorConsistencyCheck)
                 value->type(); // Likely to crash if the object was deallocated.
@@ -990,16 +1058,16 @@ JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
     return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength);
 }
 
-JSArray* constructArray(ExecState* exec, JSValuePtr singleItemValue)
+JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
 {
-    ArgList values;
+    MarkedArgumentBuffer values;
     values.append(singleItemValue);
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), values);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
 }
 
 JSArray* constructArray(ExecState* exec, const ArgList& values)
 {
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), values);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index e280022a14..ea490d86aa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -25,7 +25,7 @@
 
 namespace JSC {
 
-    typedef HashMap<unsigned, JSValuePtr> SparseArrayValueMap;
+    typedef HashMap<unsigned, JSValue> SparseArrayValueMap;
 
     struct ArrayStorage {
         unsigned m_length;
@@ -33,7 +33,7 @@ namespace JSC {
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
         void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
-        JSValuePtr m_vector[1];
+        JSValue m_vector[1];
     };
 
     class JSArray : public JSObject {
@@ -42,47 +42,49 @@ namespace JSC {
     public:
         explicit JSArray(PassRefPtr<Structure>);
         JSArray(PassRefPtr<Structure>, unsigned initialLength);
-        JSArray(ExecState*, PassRefPtr<Structure>, const ArgList& initialValues);
+        JSArray(PassRefPtr<Structure>, const ArgList& initialValues);
         virtual ~JSArray();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr); // FIXME: Make protected and add setItem.
+        virtual void put(ExecState*, unsigned propertyName, JSValue); // FIXME: Make protected and add setItem.
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         unsigned length() const { return m_storage->m_length; }
         void setLength(unsigned); // OK to use on new arrays, but not if it might be a RegExpMatchArray.
 
         void sort(ExecState*);
-        void sort(ExecState*, JSValuePtr compareFunction, CallType, const CallData&);
+        void sort(ExecState*, JSValue compareFunction, CallType, const CallData&);
+        void sortNumeric(ExecState*, JSValue compareFunction, CallType, const CallData&);
 
-        void push(ExecState*, JSValuePtr);
-        JSValuePtr pop();
+        void push(ExecState*, JSValue);
+        JSValue pop();
 
         bool canGetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValuePtr getIndex(unsigned i)
+        JSValue getIndex(unsigned i)
         {
             ASSERT(canGetIndex(i));
             return m_storage->m_vector[i];
         }
 
         bool canSetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValuePtr setIndex(unsigned i, JSValuePtr v)
+        JSValue setIndex(unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
             return m_storage->m_vector[i] = v;
         }
 
-        void fillArgList(ExecState*, ArgList&);
+        void fillArgList(ExecState*, MarkedArgumentBuffer&);
+        void copyToRegisters(ExecState*, Register*, uint32_t);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
     protected:
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
@@ -95,7 +97,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
 
         bool getOwnPropertySlotSlowCase(ExecState*, unsigned propertyName, PropertySlot&);
-        void putSlowCase(ExecState*, unsigned propertyName, JSValuePtr);
+        void putSlowCase(ExecState*, unsigned propertyName, JSValue);
 
         bool increaseVectorLength(unsigned newLength);
         
@@ -108,19 +110,21 @@ namespace JSC {
         ArrayStorage* m_storage;
     };
 
-    JSArray* asArray(JSValuePtr);
+    JSArray* asArray(JSValue);
 
     JSArray* constructEmptyArray(ExecState*);
     JSArray* constructEmptyArray(ExecState*, unsigned initialLength);
-    JSArray* constructArray(ExecState*, JSValuePtr singleItemValue);
+    JSArray* constructArray(ExecState*, JSValue singleItemValue);
     JSArray* constructArray(ExecState*, const ArgList& values);
 
-    inline JSArray* asArray(JSValuePtr value)
+    inline JSArray* asArray(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSArray::info));
         return static_cast<JSArray*>(asObject(value));
     }
 
+    inline bool isJSArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr; }
+
 } // namespace JSC
 
 #endif // JSArray_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index 4a190380d6..2a5e72f74c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -29,6 +29,8 @@
 #include "JSGlobalObject.h"
 #include "PropertyNameArray.h"
 
+using namespace WTF;
+
 namespace JSC {
 
 const ClassInfo JSByteArray::s_defaultInfo = { "ByteArray", 0, 0, 0 };
@@ -41,7 +43,7 @@ JSByteArray::JSByteArray(ExecState* exec, PassRefPtr<Structure> structure, ByteA
     putDirect(exec->globalData().propertyNames->length, jsNumber(exec, m_storage->length()), ReadOnly | DontDelete);
 }
     
-PassRefPtr<Structure> JSByteArray::createStructure(JSValuePtr prototype)
+PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
     PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType));
     return result;
@@ -52,7 +54,7 @@ bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& property
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
     if (ok && canAccessIndex(index)) {
-        slot.setValue(getIndex(index));
+        slot.setValue(getIndex(exec, index));
         return true;
     }
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
@@ -61,13 +63,13 @@ bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& property
 bool JSByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (canAccessIndex(propertyName)) {
-        slot.setValue(getIndex(propertyName));
+        slot.setValue(getIndex(exec, propertyName));
         return true;
     }
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
@@ -78,7 +80,7 @@ void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValuePt
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     setIndex(exec, propertyName, value);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index 895200b06b..57374e0ace 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -26,19 +26,20 @@
 #ifndef JSByteArray_h
 #define JSByteArray_h
 
-#include "ByteArray.h"
 #include "JSObject.h"
 
+#include <wtf/ByteArray.h>
+
 namespace JSC {
 
     class JSByteArray : public JSObject {
-        friend class Interpreter;
+        friend class VPtrSet;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
-        JSValuePtr getIndex(unsigned i)
+        JSValue getIndex(ExecState* exec, unsigned i)
         {
             ASSERT(canAccessIndex(i));
-            return JSImmediate::from(m_storage->data()[i]);
+            return jsNumber(exec, m_storage->data()[i]);
         }
 
         void setIndex(unsigned i, int value)
@@ -63,22 +64,22 @@ namespace JSC {
             m_storage->data()[i] = static_cast<unsigned char>(value + 0.5);
         }
         
-        void setIndex(ExecState* exec, unsigned i, JSValuePtr value)
+        void setIndex(ExecState* exec, unsigned i, JSValue value)
         {
-            double byteValue = value->toNumber(exec);
+            double byteValue = value.toNumber(exec);
             if (exec->hadException())
                 return;
             if (canAccessIndex(i))
                 setIndex(i, byteValue);
         }
 
-        JSByteArray(ExecState* exec, PassRefPtr<Structure>, ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype);
+        JSByteArray(ExecState* exec, PassRefPtr<Structure>, WTF::ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
+        static PassRefPtr<Structure> createStructure(JSValue prototype);
         
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
@@ -87,7 +88,7 @@ namespace JSC {
         
         size_t length() const { return m_storage->length(); }
 
-        ByteArray* storage() const { return m_storage.get(); }
+        WTF::ByteArray* storage() const { return m_storage.get(); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -97,15 +98,18 @@ namespace JSC {
         {
         }
 
-        RefPtr<ByteArray> m_storage;
+        RefPtr<WTF::ByteArray> m_storage;
         const ClassInfo* m_classInfo;
     };
     
-    JSByteArray* asByteArray(JSValuePtr value);
-    inline JSByteArray* asByteArray(JSValuePtr value)
+    JSByteArray* asByteArray(JSValue value);
+    inline JSByteArray* asByteArray(JSValue value)
     {
         return static_cast<JSByteArray*>(asCell(value));
     }
-}
 
-#endif
+    inline bool isJSByteArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsByteArrayVPtr; }
+
+} // namespace JSC
+
+#endif // JSByteArray_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index c1c1ce4217..8cf794387b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -100,19 +100,6 @@ bool JSCell::getTruncatedUInt32(uint32_t&) const
     return false;
 }
 
-bool JSCell::getNumber(double& numericValue) const
-{
-    if (!isNumber())
-        return false;
-    numericValue = static_cast<const JSNumberCell*>(this)->value();
-    return true;
-}
-
-double JSCell::getNumber() const
-{
-    return isNumber() ? static_cast<const JSNumberCell*>(this)->value() : NaN;
-}
-
 bool JSCell::getString(UString&stringValue) const
 {
     if (!isString())
@@ -170,12 +157,12 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySl
     return true;
 }
 
-void JSCell::put(ExecState* exec, const Identifier& identifier, JSValuePtr value, PutPropertySlot& slot)
+void JSCell::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     toObject(exec)->put(exec, identifier, value, slot);
 }
 
-void JSCell::put(ExecState* exec, unsigned identifier, JSValuePtr value)
+void JSCell::put(ExecState* exec, unsigned identifier, JSValue value)
 {
     toObject(exec)->put(exec, identifier, value);
 }
@@ -210,9 +197,9 @@ const ClassInfo* JSCell::classInfo() const
     return 0;
 }
 
-JSValuePtr JSCell::getJSNumber()
+JSValue JSCell::getJSNumber()
 {
-    return noValue();
+    return JSValue();
 }
 
 bool JSCell::isGetterSetter() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 6d963b3fed..e0a9b4d5f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -23,6 +23,7 @@
 #ifndef JSCell_h
 #define JSCell_h
 
+#include <wtf/Noncopyable.h>
 #include "Structure.h"
 #include "JSValue.h"
 #include "JSImmediate.h"
@@ -30,16 +31,16 @@
 
 namespace JSC {
 
-    class JSCell : public JSValue {
-        friend class JIT;
+    class JSCell : Noncopyable {
         friend class GetterSetter;
         friend class Heap;
+        friend class JIT;
         friend class JSNumberCell;
         friend class JSObject;
         friend class JSPropertyNameIterator;
         friend class JSString;
         friend class JSValue;
-        friend class Interpreter;
+        friend class VPtrSet;
 
     private:
         explicit JSCell(Structure*);
@@ -56,8 +57,6 @@ namespace JSC {
         Structure* structure() const;
 
         // Extracting the value.
-        bool getNumber(double&) const;
-        double getNumber() const; // NaN if not a number
         bool getString(UString&) const;
         UString getString() const; // null string if not a string
         JSObject* getObject(); // NULL if not an object
@@ -67,13 +66,14 @@ namespace JSC {
         virtual ConstructType getConstructData(ConstructData&);
 
         // Extracting integer values.
+        // FIXME: remove these methods, can check isNumberCell in JSValue && then call asNumberCell::*.
         virtual bool getUInt32(uint32_t&) const;
         virtual bool getTruncatedInt32(int32_t&) const;
         virtual bool getTruncatedUInt32(uint32_t&) const;
 
         // Basic conversions.
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&) = 0;
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&) = 0;
         virtual bool toBoolean(ExecState*) const = 0;
         virtual double toNumber(ExecState*) const = 0;
         virtual UString toString(ExecState*) const = 0;
@@ -88,15 +88,15 @@ namespace JSC {
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
         virtual UString toThisString(ExecState*) const;
         virtual JSString* toThisJSString(ExecState*);
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
         void* vptr() { return *reinterpret_cast<void**>(this); }
 
     private:
@@ -108,12 +108,11 @@ namespace JSC {
         Structure* m_structure;
     };
 
-    JSCell* asCell(JSValuePtr);
+    JSCell* asCell(JSValue);
 
-    inline JSCell* asCell(JSValuePtr value)
+    inline JSCell* asCell(JSValue value)
     {
-        ASSERT(!JSImmediate::isImmediate(value));
-        return value->asCell();
+        return value.asCell();
     }
 
     inline JSCell::JSCell(Structure* structure)
@@ -157,8 +156,8 @@ namespace JSC {
 
     ALWAYS_INLINE JSCell* JSValue::asCell() const
     {
-        ASSERT(!JSImmediate::isImmediate(asValue()));
-        return const_cast<JSCell*>(reinterpret_cast<const JSCell*>(this));
+        ASSERT(isCell());
+        return m_ptr;
     }
 
     inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
@@ -172,11 +171,6 @@ namespace JSC {
 
     // --- JSValue inlines ----------------------------
 
-    inline bool JSValue::isNumber() const
-    {
-        return JSImmediate::isNumber(asValue()) || (!JSImmediate::isImmediate(asValue()) && asCell()->isNumber());
-    }
-
     inline bool JSValue::isString() const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->isString();
@@ -192,11 +186,6 @@ namespace JSC {
         return !JSImmediate::isImmediate(asValue()) && asCell()->isObject();
     }
 
-    inline double JSValue::getNumber() const
-    {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asCell()->getNumber();
-    }
-
     inline bool JSValue::getString(UString& s) const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->getString(s);
@@ -247,12 +236,12 @@ namespace JSC {
         return JSImmediate::isImmediate(asValue()) || asCell()->marked();
     }
 
-    inline JSValuePtr JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+    inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
     {
         return JSImmediate::isImmediate(asValue()) ? asValue() : asCell()->toPrimitive(exec, preferredType);
     }
 
-    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValuePtr& value)
+    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
     {
         if (JSImmediate::isImmediate(asValue())) {
             number = JSImmediate::toDouble(asValue());
@@ -301,9 +290,9 @@ namespace JSC {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toString(asValue()) : asCell()->toThisString(exec);
     }
 
-    inline JSValuePtr JSValue::getJSNumber()
+    inline JSValue JSValue::getJSNumber()
     {
-        return JSImmediate::isNumber(asValue()) ? asValue() : JSImmediate::isImmediate(asValue()) ? noValue() : asCell()->getJSNumber();
+        return JSImmediate::isNumber(asValue()) ? asValue() : JSImmediate::isImmediate(asValue()) ? JSValue() : asCell()->getJSNumber();
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
index a22cb34e96..f4564514f6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
@@ -45,11 +45,29 @@ ASSERT_CLASS_FITS_IN_CELL(JSFunction);
 
 const ClassInfo JSFunction::info = { "Function", &InternalFunction::info, 0, 0 };
 
+JSFunction::JSFunction(ExecState* exec, PassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
+    : Base(&exec->globalData(), structure, name)
+#if ENABLE(JIT)
+    , m_body(exec->globalData().nativeFunctionThunk())
+#else
+    , m_body(0)
+#endif
+{
+#if ENABLE(JIT)
+    setNativeFunction(func);
+    putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
+#else
+    UNUSED_PARAM(length);
+    UNUSED_PARAM(func);
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 JSFunction::JSFunction(ExecState* exec, const Identifier& name, FunctionBodyNode* body, ScopeChainNode* scopeChainNode)
     : Base(&exec->globalData(), exec->lexicalGlobalObject()->functionStructure(), name)
     , m_body(body)
-    , m_scopeChain(scopeChainNode)
 {
+    setScopeChain(scopeChainNode);
 }
 
 JSFunction::~JSFunction()
@@ -58,55 +76,72 @@ JSFunction::~JSFunction()
     // JIT code for other functions may have had calls linked directly to the code for this function; these links
     // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
     // this memory is freed and may be reused (potentially for another, different JSFunction).
-    if (m_body && m_body->isGenerated())
-        m_body->generatedBytecode().unlinkCallers();
+    if (!isHostFunction()) {
+        if (m_body && m_body->isGenerated())
+            m_body->generatedBytecode().unlinkCallers();
+        scopeChain().~ScopeChain();
+    }
+    
 #endif
 }
 
 void JSFunction::mark()
 {
     Base::mark();
-    m_body->mark();
-    m_scopeChain.mark();
+    if (!isHostFunction()) {
+        m_body->mark();
+        scopeChain().mark();
+    }
 }
 
 CallType JSFunction::getCallData(CallData& callData)
 {
+    if (isHostFunction()) {
+        callData.native.function = nativeFunction();
+        return CallTypeHost;
+    }
     callData.js.functionBody = m_body.get();
-    callData.js.scopeChain = m_scopeChain.node();
+    callData.js.scopeChain = scopeChain().node();
     return CallTypeJS;
 }
 
-JSValuePtr JSFunction::call(ExecState* exec, JSValuePtr thisValue, const ArgList& args)
+JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args)
 {
-    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue->toThisObject(exec), args, m_scopeChain.node(), exec->exceptionSlot());
+    ASSERT(!isHostFunction());
+    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
-JSValuePtr JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveArguments(exec, thisObj);
 }
 
-JSValuePtr JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveCaller(exec, thisObj);
 }
 
-JSValuePtr JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return jsNumber(exec, thisObj->m_body->parameterCount());
 }
 
 bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
+    if (isHostFunction())
+        return Base::getOwnPropertySlot(exec, propertyName, slot);
+
     if (propertyName == exec->propertyNames().prototype) {
-        JSValuePtr* location = getDirectLocation(propertyName);
+        JSValue* location = getDirectLocation(propertyName);
 
         if (!location) {
-            JSObject* prototype = new (exec) JSObject(m_scopeChain.globalObject()->emptyObjectStructure());
+            JSObject* prototype = new (exec) JSObject(scopeChain().globalObject()->emptyObjectStructure());
             prototype->putDirect(exec->propertyNames().constructor, this, DontEnum);
             putDirect(exec->propertyNames().prototype, prototype, DontDelete);
             location = getDirectLocation(propertyName);
@@ -133,8 +168,12 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
+    if (isHostFunction()) {
+        Base::put(exec, propertyName, value, slot);
+        return;
+    }
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return;
     Base::put(exec, propertyName, value, slot);
@@ -142,6 +181,8 @@ void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValuePtr
 
 bool JSFunction::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
+    if (isHostFunction())
+        return Base::deleteProperty(exec, propertyName);
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return false;
     return Base::deleteProperty(exec, propertyName);
@@ -150,23 +191,26 @@ bool JSFunction::deleteProperty(ExecState* exec, const Identifier& propertyName)
 // ECMA 13.2.2 [[Construct]]
 ConstructType JSFunction::getConstructData(ConstructData& constructData)
 {
+    if (isHostFunction())
+        return ConstructTypeNone;
     constructData.js.functionBody = m_body.get();
-    constructData.js.scopeChain = m_scopeChain.node();
+    constructData.js.scopeChain = scopeChain().node();
     return ConstructTypeJS;
 }
 
 JSObject* JSFunction::construct(ExecState* exec, const ArgList& args)
 {
+    ASSERT(!isHostFunction());
     Structure* structure;
-    JSValuePtr prototype = get(exec, exec->propertyNames().prototype);
-    if (prototype->isObject())
+    JSValue prototype = get(exec, exec->propertyNames().prototype);
+    if (prototype.isObject())
         structure = asObject(prototype)->inheritorID();
     else
         structure = exec->lexicalGlobalObject()->emptyObjectStructure();
     JSObject* thisObj = new (exec) JSObject(structure);
 
-    JSValuePtr result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, m_scopeChain.node(), exec->exceptionSlot());
-    if (exec->hadException() || !result->isObject())
+    JSValue result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, scopeChain().node(), exec->exceptionSlot());
+    if (exec->hadException() || !result.isObject())
         return thisObj;
     return asObject(result);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index 6a43737ad7..b27e5157f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -39,29 +39,30 @@ namespace JSC {
 
     class JSFunction : public InternalFunction {
         friend class JIT;
-        friend class Interpreter;
+        friend class VPtrSet;
 
         typedef InternalFunction Base;
 
         JSFunction(PassRefPtr<Structure> structure)
             : InternalFunction(structure)
-            , m_scopeChain(NoScopeChain())
         {
+            clearScopeChain();
         }
 
     public:
+        JSFunction(ExecState*, PassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
         JSFunction(ExecState*, const Identifier&, FunctionBodyNode*, ScopeChainNode*);
         ~JSFunction();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         JSObject* construct(ExecState*, const ArgList&);
-        JSValuePtr call(ExecState*, JSValuePtr thisValue, const ArgList&);
+        JSValue call(ExecState*, JSValue thisValue, const ArgList&);
 
-        void setScope(const ScopeChain& scopeChain) { m_scopeChain = scopeChain; }
-        ScopeChain& scope() { return m_scopeChain; }
+        void setScope(const ScopeChain& scopeChain) { setScopeChain(scopeChain); }
+        ScopeChain& scope() { return scopeChain(); }
 
         void setBody(FunctionBodyNode* body) { m_body = body; }
         void setBody(PassRefPtr<FunctionBodyNode> body) { m_body = body; }
@@ -69,30 +70,64 @@ namespace JSC {
 
         virtual void mark();
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype) 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
 
-    private:
-        virtual const ClassInfo* classInfo() const { return &info; }
+#if ENABLE(JIT)
+        bool isHostFunction() const { return m_body && m_body->isHostFunction(); }
+#else
+        bool isHostFunction() const { return false; }
+#endif
+        NativeFunction nativeFunction()
+        {
+            return *reinterpret_cast<NativeFunction*>(m_data);
+        }
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
 
-        static JSValuePtr argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValuePtr callerGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    private:
+        virtual const ClassInfo* classInfo() const { return &info; }
+
+        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
 
         RefPtr<FunctionBodyNode> m_body;
-        ScopeChain m_scopeChain;
+        ScopeChain& scopeChain()
+        {
+            ASSERT(!isHostFunction());
+            return *reinterpret_cast<ScopeChain*>(m_data);
+        }
+        void clearScopeChain()
+        {
+            ASSERT(!isHostFunction());
+            new (m_data) ScopeChain(NoScopeChain());
+        }
+        void setScopeChain(ScopeChainNode* sc)
+        {
+            ASSERT(!isHostFunction());
+            new (m_data) ScopeChain(sc);
+        }
+        void setScopeChain(const ScopeChain& sc)
+        {
+            ASSERT(!isHostFunction());
+            *reinterpret_cast<ScopeChain*>(m_data) = sc;
+        }
+        void setNativeFunction(NativeFunction func)
+        {
+            *reinterpret_cast<NativeFunction*>(m_data) = func;
+        }
+        unsigned char m_data[sizeof(void*)];
     };
 
-    JSFunction* asFunction(JSValuePtr);
+    JSFunction* asFunction(JSValue);
 
-    inline JSFunction* asFunction(JSValuePtr value)
+    inline JSFunction* asFunction(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSFunction::info));
         return static_cast<JSFunction*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
index 62df65eb79..15948485c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -30,15 +30,19 @@
 #include "JSGlobalData.h"
 
 #include "ArgList.h"
+#include "Collector.h"
 #include "CommonIdentifiers.h"
+#include "FunctionConstructor.h"
+#include "Interpreter.h"
 #include "JSActivation.h"
+#include "JSArray.h"
+#include "JSByteArray.h"
 #include "JSClassRef.h"
+#include "JSFunction.h"
 #include "JSLock.h"
 #include "JSNotAnObject.h"
 #include "JSStaticScopeObject.h"
-#include "Interpreter.h"
 #include "Parser.h"
-#include "Collector.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
@@ -63,40 +67,80 @@ extern const HashTable regExpTable;
 extern const HashTable regExpConstructorTable;
 extern const HashTable stringTable;
 
-JSGlobalData::JSGlobalData(bool isShared)
-    : interpreter(new Interpreter)
-    , exception(noValue())
-    , arrayTable(new HashTable(JSC::arrayTable))
-    , dateTable(new HashTable(JSC::dateTable))
-    , mathTable(new HashTable(JSC::mathTable))
-    , numberTable(new HashTable(JSC::numberTable))
-    , regExpTable(new HashTable(JSC::regExpTable))
-    , regExpConstructorTable(new HashTable(JSC::regExpConstructorTable))
-    , stringTable(new HashTable(JSC::stringTable))
+struct VPtrSet {
+    VPtrSet();
+
+    void* jsArrayVPtr;
+    void* jsByteArrayVPtr;
+    void* jsStringVPtr;
+    void* jsFunctionVPtr;
+};
+
+VPtrSet::VPtrSet()
+{
+    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
+    void* storage = fastMalloc(sizeof(CollectorBlock));
+
+    JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
+    jsArrayVPtr = jsArray->vptr();
+    jsArray->~JSCell();
+
+    JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
+    jsByteArrayVPtr = jsByteArray->vptr();
+    jsByteArray->~JSCell();
+
+    JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
+    jsStringVPtr = jsString->vptr();
+    jsString->~JSCell();
+
+    JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
+    jsFunctionVPtr = jsFunction->vptr();
+    jsFunction->~JSCell();
+
+    fastFree(storage);
+}
+
+JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
+    : isSharedInstance(isShared)
+    , clientData(0)
+    , arrayTable(fastNew<HashTable>(JSC::arrayTable))
+    , dateTable(fastNew<HashTable>(JSC::dateTable))
+    , mathTable(fastNew<HashTable>(JSC::mathTable))
+    , numberTable(fastNew<HashTable>(JSC::numberTable))
+    , regExpTable(fastNew<HashTable>(JSC::regExpTable))
+    , regExpConstructorTable(fastNew<HashTable>(JSC::regExpConstructorTable))
+    , stringTable(fastNew<HashTable>(JSC::stringTable))
     , activationStructure(JSActivation::createStructure(jsNull()))
     , interruptedExecutionErrorStructure(JSObject::createStructure(jsNull()))
     , staticScopeStructure(JSStaticScopeObject::createStructure(jsNull()))
     , stringStructure(JSString::createStructure(jsNull()))
     , notAnObjectErrorStubStructure(JSNotAnObjectErrorStub::createStructure(jsNull()))
     , notAnObjectStructure(JSNotAnObject::createStructure(jsNull()))
+#if !USE(ALTERNATE_JSIMMEDIATE)
     , numberStructure(JSNumberCell::createStructure(jsNull()))
+#endif
+    , jsArrayVPtr(vptrSet.jsArrayVPtr)
+    , jsByteArrayVPtr(vptrSet.jsByteArrayVPtr)
+    , jsStringVPtr(vptrSet.jsStringVPtr)
+    , jsFunctionVPtr(vptrSet.jsFunctionVPtr)
     , identifierTable(createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
-    , emptyList(new ArgList)
-    , newParserObjects(0)
-    , parserObjectExtraRefCounts(0)
+    , emptyList(new MarkedArgumentBuffer)
     , lexer(new Lexer(this))
     , parser(new Parser)
+    , interpreter(new Interpreter)
+#if ENABLE(JIT)
+    , jitStubs(this)
+#endif
+    , heap(this)
+    , initializingLazyNumericCompareFunction(false)
     , head(0)
     , dynamicGlobalObject(0)
-    , isSharedInstance(isShared)
-    , clientData(0)
-    , heap(this)
+    , scopeNodeBeingReparsed(0)
 {
 #if PLATFORM(MAC)
     startProfilerServerIfNeeded();
 #endif
-    interpreter->initialize(this);
 }
 
 JSGlobalData::~JSGlobalData()
@@ -116,13 +160,17 @@ JSGlobalData::~JSGlobalData()
     regExpTable->deleteTable();
     regExpConstructorTable->deleteTable();
     stringTable->deleteTable();
-    delete arrayTable;
-    delete dateTable;
-    delete mathTable;
-    delete numberTable;
-    delete regExpTable;
-    delete regExpConstructorTable;
-    delete stringTable;
+#if ENABLE(JIT)
+    lazyNativeFunctionThunk.clear();
+#endif
+
+    fastDelete(const_cast<HashTable*>(arrayTable));
+    fastDelete(const_cast<HashTable*>(dateTable));
+    fastDelete(const_cast<HashTable*>(mathTable));
+    fastDelete(const_cast<HashTable*>(numberTable));
+    fastDelete(const_cast<HashTable*>(regExpTable));
+    fastDelete(const_cast<HashTable*>(regExpConstructorTable));
+    fastDelete(const_cast<HashTable*>(stringTable));
 
     delete parser;
     delete lexer;
@@ -134,27 +182,20 @@ JSGlobalData::~JSGlobalData()
     delete propertyNames;
     deleteIdentifierTable(identifierTable);
 
-    delete newParserObjects;
-    delete parserObjectExtraRefCounts;
-    
     delete clientData;
 }
 
-PassRefPtr<JSGlobalData> JSGlobalData::create()
+PassRefPtr<JSGlobalData> JSGlobalData::create(bool isShared)
 {
-    return adoptRef(new JSGlobalData);
+    return adoptRef(new JSGlobalData(isShared, VPtrSet()));
 }
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked()
 {
-#ifndef NDEBUG
     Structure::startIgnoringLeaks();
     RefPtr<JSGlobalData> data = create();
     Structure::stopIgnoringLeaks();
     return data.release();
-#else
-    return create();
-#endif
 }
 
 bool JSGlobalData::sharedInstanceExists()
@@ -166,7 +207,7 @@ JSGlobalData& JSGlobalData::sharedInstance()
 {
     JSGlobalData*& instance = sharedInstanceInternal();
     if (!instance) {
-        instance = new JSGlobalData(true);
+        instance = create(true).releaseRef();
 #if ENABLE(JSC_MULTIPLE_THREADS)
         instance->makeUsableFromMultipleThreads();
 #endif
@@ -181,8 +222,31 @@ JSGlobalData*& JSGlobalData::sharedInstanceInternal()
     return sharedInstance;
 }
 
-JSGlobalData::ClientData::~ClientData()
+#if ENABLE(JIT)
+
+void JSGlobalData::createNativeThunk()
+{
+    lazyNativeFunctionThunk = FunctionBodyNode::createNativeThunk(this);
+}
+
+#endif
+
+// FIXME: We can also detect forms like v1 < v2 ? -1 : 0, reverse comparison, etc.
+const Vector<Instruction>& JSGlobalData::numericCompareFunction(ExecState* exec)
 {
+    if (!lazyNumericCompareFunction.size() && !initializingLazyNumericCompareFunction) {
+        initializingLazyNumericCompareFunction = true;
+        RefPtr<ProgramNode> programNode = parser->parse<ProgramNode>(exec, 0, makeSource(UString("(function (v1, v2) { return v1 - v2; })")), 0, 0);
+        RefPtr<FunctionBodyNode> functionBody = extractFunctionBody(programNode.get());
+        lazyNumericCompareFunction = functionBody->bytecode(exec->scopeChain()).instructions();
+        initializingLazyNumericCompareFunction = false;
+    }
+
+    return lazyNumericCompareFunction;
 }
 
+JSGlobalData::ClientData::~ClientData()
+{
 }
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
index 67f4178c30..e53746bb44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,39 +29,46 @@
 #ifndef JSGlobalData_h
 #define JSGlobalData_h
 
-#include <wtf/Forward.h>
-#include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
 #include "Collector.h"
 #include "ExecutableAllocator.h"
-#include "SmallStrings.h"
+#include "JITStubs.h"
 #include "JSValue.h"
+#include "SmallStrings.h"
+#include "TimeoutChecker.h"
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
 
 struct OpaqueJSClass;
 struct OpaqueJSClassContextData;
 
 namespace JSC {
 
-    class ArgList;
     class CommonIdentifiers;
-    class Heap;
+    class FunctionBodyNode;
     class IdentifierTable;
+    class Instruction;
+    class Interpreter;
     class JSGlobalObject;
     class JSObject;
     class Lexer;
-    class Interpreter;
     class Parser;
-    class ParserRefCounted;
+    class ScopeNode;
     class Structure;
     class UString;
     struct HashTable;
+    struct VPtrSet;
 
     class JSGlobalData : public RefCounted<JSGlobalData> {
     public:
+        struct ClientData {
+            virtual ~ClientData() = 0;
+        };
+
         static bool sharedInstanceExists();
         static JSGlobalData& sharedInstance();
 
-        static PassRefPtr<JSGlobalData> create();
+        static PassRefPtr<JSGlobalData> create(bool isShared = false);
         static PassRefPtr<JSGlobalData> createLeaked();
         ~JSGlobalData();
 
@@ -70,12 +77,8 @@ namespace JSC {
         void makeUsableFromMultipleThreads() { heap.makeUsableFromMultipleThreads(); }
 #endif
 
-        Interpreter* interpreter;
-
-        JSValuePtr exception;
-#if ENABLE(JIT)
-        void* exceptionLocation;
-#endif
+        bool isSharedInstance;
+        ClientData* clientData;
 
         const HashTable* arrayTable;
         const HashTable* dateTable;
@@ -91,48 +94,64 @@ namespace JSC {
         RefPtr<Structure> stringStructure;
         RefPtr<Structure> notAnObjectErrorStubStructure;
         RefPtr<Structure> notAnObjectStructure;
+#if !USE(ALTERNATE_JSIMMEDIATE)
         RefPtr<Structure> numberStructure;
+#endif
+
+        void* jsArrayVPtr;
+        void* jsByteArrayVPtr;
+        void* jsStringVPtr;
+        void* jsFunctionVPtr;
 
         IdentifierTable* identifierTable;
         CommonIdentifiers* propertyNames;
-        const ArgList* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
-
+        const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
         SmallStrings smallStrings;
-        
-        HashMap<OpaqueJSClass*, OpaqueJSClassContextData*> opaqueJSClassData;
 
-        HashSet<ParserRefCounted*>* newParserObjects;
-        HashCountedSet<ParserRefCounted*>* parserObjectExtraRefCounts;
+#if ENABLE(ASSEMBLER)
+        ExecutableAllocator executableAllocator;
+#endif
 
         Lexer* lexer;
         Parser* parser;
+        Interpreter* interpreter;
+#if ENABLE(JIT)
+        JITThunks jitStubs;
+        FunctionBodyNode* nativeFunctionThunk()
+        {
+            if (!lazyNativeFunctionThunk)
+                createNativeThunk();
+            return lazyNativeFunctionThunk.get();
+        }
+        RefPtr<FunctionBodyNode> lazyNativeFunctionThunk;
+#endif
+        TimeoutChecker timeoutChecker;
+        Heap heap;
 
-        JSGlobalObject* head;
-        JSGlobalObject* dynamicGlobalObject;
+        JSValue exception;
+#if ENABLE(JIT)
+        void* exceptionLocation;
+#endif
 
-        bool isSharedInstance;
+        const Vector<Instruction>& numericCompareFunction(ExecState*);
+        Vector<Instruction> lazyNumericCompareFunction;
+        bool initializingLazyNumericCompareFunction;
 
-        struct ClientData {
-            virtual ~ClientData() = 0;
-        };
+        HashMap<OpaqueJSClass*, OpaqueJSClassContextData*> opaqueJSClassData;
 
-        ClientData* clientData;
+        JSGlobalObject* head;
+        JSGlobalObject* dynamicGlobalObject;
 
         HashSet<JSObject*> arrayVisitedElements;
 
-        Heap heap;
-#if ENABLE(ASSEMBLER)
-        PassRefPtr<ExecutablePool> poolForSize(size_t n) { return m_executableAllocator.poolForSize(n); }
-#endif
-    private:
-        JSGlobalData(bool isShared = false);
-#if ENABLE(ASSEMBLER)
-        ExecutableAllocator m_executableAllocator;
-#endif
+        ScopeNode* scopeNodeBeingReparsed;
 
+    private:
+        JSGlobalData(bool isShared, const VPtrSet&);
         static JSGlobalData*& sharedInstanceInternal();
+        void createNativeThunk();
     };
 
-}
+} // namespace JSC
 
-#endif
+#endif // JSGlobalData_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index dfe291c549..1e9f6705a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -47,6 +47,7 @@
 #include "FunctionConstructor.h"
 #include "FunctionPrototype.h"
 #include "GlobalEvalFunction.h"
+#include "JSFunction.h"
 #include "JSGlobalObjectFunctions.h"
 #include "JSLock.h"
 #include "Interpreter.h"
@@ -78,10 +79,10 @@ static const int initialTickCountThreshold = 255;
 // Preferred number of milliseconds between each timeout check
 static const int preferredScriptCheckTimeInterval = 1000;
 
-static inline void markIfNeeded(JSValuePtr v)
+static inline void markIfNeeded(JSValue v)
 {
-    if (v && !v->marked())
-        v->mark();
+    if (v && !v.marked())
+        v.mark();
 }
 
 static inline void markIfNeeded(const RefPtr<Structure>& s)
@@ -147,7 +148,7 @@ void JSGlobalObject::init(JSObject* thisValue)
     reset(prototype());
 }
 
-void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -156,20 +157,20 @@ void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValu
     JSVariableObject::put(exec, propertyName, value, slot);
 }
 
-void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (symbolTablePutWithAttributes(propertyName, value, attributes))
         return;
 
-    JSValuePtr valueBefore = getDirect(propertyName);
+    JSValue valueBefore = getDirect(propertyName);
     PutPropertySlot slot;
     JSVariableObject::put(exec, propertyName, value, slot);
     if (!valueBefore) {
-        JSValuePtr valueAfter = getDirect(propertyName);
+        JSValue valueAfter = getDirect(propertyName);
         if (valueAfter)
-            putDirect(propertyName, valueAfter, attributes);
+            JSObject::putWithAttributes(exec, propertyName, valueAfter, attributes);
     }
 }
 
@@ -190,12 +191,12 @@ void JSGlobalObject::defineSetter(ExecState* exec, const Identifier& propertyNam
 static inline JSObject* lastInPrototypeChain(JSObject* object)
 {
     JSObject* o = object;
-    while (o->prototype()->isObject())
+    while (o->prototype().isObject())
         o = asObject(o->prototype());
     return o;
 }
 
-void JSGlobalObject::reset(JSValuePtr prototype)
+void JSGlobalObject::reset(JSValue prototype)
 {
     ExecState* exec = JSGlobalObject::globalExec();
 
@@ -203,7 +204,11 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     d()->functionPrototype = new (exec) FunctionPrototype(exec, FunctionPrototype::createStructure(jsNull())); // The real prototype will be set once ObjectPrototype is created.
     d()->prototypeFunctionStructure = PrototypeFunction::createStructure(d()->functionPrototype);
-    d()->functionPrototype->addFunctionProperties(exec, d()->prototypeFunctionStructure.get());
+    NativeFunctionWrapper* callFunction = 0;
+    NativeFunctionWrapper* applyFunction = 0;
+    d()->functionPrototype->addFunctionProperties(exec, d()->prototypeFunctionStructure.get(), &callFunction, &applyFunction);
+    d()->callFunction = callFunction;
+    d()->applyFunction = applyFunction;
     d()->objectPrototype = new (exec) ObjectPrototype(exec, ObjectPrototype::createStructure(jsNull()), d()->prototypeFunctionStructure.get());
     d()->functionPrototype->structure()->setPrototypeWithoutTransition(d()->objectPrototype);
 
@@ -234,6 +239,8 @@ void JSGlobalObject::reset(JSValuePtr prototype)
     d()->regExpPrototype = new (exec) RegExpPrototype(exec, RegExpPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
     d()->regExpStructure = RegExpObject::createStructure(d()->regExpPrototype);
 
+    d()->methodCallDummy = constructEmptyObject(exec);
+
     ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, ErrorPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
     d()->errorStructure = ErrorInstance::createStructure(errorPrototype);
 
@@ -248,13 +255,13 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     // Constructors
 
-    JSValuePtr objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype);
-    JSValuePtr functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
-    JSValuePtr arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
-    JSValuePtr stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
-    JSValuePtr booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
-    JSValuePtr numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
-    JSValuePtr dateConstructor = new (exec) DateConstructor(exec, DateConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->datePrototype);
+    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype);
+    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
+    JSCell* stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
+    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
+    JSCell* numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
+    JSCell* dateConstructor = new (exec) DateConstructor(exec, DateConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->datePrototype);
 
     d()->regExpConstructor = new (exec) RegExpConstructor(exec, RegExpConstructor::createStructure(d()->functionPrototype), d()->regExpPrototype);
 
@@ -269,15 +276,15 @@ void JSGlobalObject::reset(JSValuePtr prototype)
     d()->typeErrorConstructor = new (exec) NativeErrorConstructor(exec, nativeErrorStructure, typeErrorPrototype);
     d()->URIErrorConstructor = new (exec) NativeErrorConstructor(exec, nativeErrorStructure, URIErrorPrototype);
 
-    d()->objectPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, objectConstructor, DontEnum);
-    d()->functionPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, functionConstructor, DontEnum);
-    d()->arrayPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, arrayConstructor, DontEnum);
-    d()->booleanPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, booleanConstructor, DontEnum);
-    d()->stringPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, stringConstructor, DontEnum);
-    d()->numberPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, numberConstructor, DontEnum);
-    d()->datePrototype->putDirectWithoutTransition(exec->propertyNames().constructor, dateConstructor, DontEnum);
-    d()->regExpPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, d()->regExpConstructor, DontEnum);
-    errorPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, d()->errorConstructor, DontEnum);
+    d()->objectPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, objectConstructor, DontEnum);
+    d()->functionPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, functionConstructor, DontEnum);
+    d()->arrayPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, arrayConstructor, DontEnum);
+    d()->booleanPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, booleanConstructor, DontEnum);
+    d()->stringPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, stringConstructor, DontEnum);
+    d()->numberPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, numberConstructor, DontEnum);
+    d()->datePrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, dateConstructor, DontEnum);
+    d()->regExpPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->regExpConstructor, DontEnum);
+    errorPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->errorConstructor, DontEnum);
 
     evalErrorPrototype->putDirect(exec->propertyNames().constructor, d()->evalErrorConstructor, DontEnum);
     rangeErrorPrototype->putDirect(exec->propertyNames().constructor, d()->rangeErrorConstructor, DontEnum);
@@ -290,21 +297,21 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     // FIXME: These properties could be handled by a static hash table.
 
-    putDirectWithoutTransition(Identifier(exec, "Object"), objectConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Function"), functionConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Array"), arrayConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "String"), stringConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Number"), numberConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Object"), objectConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Function"), functionConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Array"), arrayConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "String"), stringConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Number"), numberConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor);
 
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
@@ -320,43 +327,32 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     d()->evalFunction = new (exec) GlobalEvalFunction(exec, GlobalEvalFunction::createStructure(d()->functionPrototype), 1, exec->propertyNames().eval, globalFuncEval, this);
     putDirectFunctionWithoutTransition(exec, d()->evalFunction, DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
 #ifndef NDEBUG
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
 #endif
 
     resetPrototype(prototype);
 }
 
 // Set prototype, and also insert the object prototype at the end of the chain.
-void JSGlobalObject::resetPrototype(JSValuePtr prototype)
+void JSGlobalObject::resetPrototype(JSValue prototype)
 {
     setPrototype(prototype);
-    lastInPrototypeChain(this)->setPrototype(d()->objectPrototype);
-}
-
-void JSGlobalObject::setTimeoutTime(unsigned timeoutTime)
-{
-    globalData()->interpreter->setTimeoutTime(timeoutTime);
-}
 
-void JSGlobalObject::startTimeoutCheck()
-{
-    globalData()->interpreter->startTimeoutCheck();
-}
-
-void JSGlobalObject::stopTimeoutCheck()
-{
-    globalData()->interpreter->stopTimeoutCheck();
+    JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
+    JSObject* objectPrototype = d()->objectPrototype;
+    if (oldLastInPrototypeChain != objectPrototype)
+        oldLastInPrototypeChain->setPrototype(objectPrototype);
 }
 
 void JSGlobalObject::mark()
@@ -381,6 +377,8 @@ void JSGlobalObject::mark()
     markIfNeeded(d()->URIErrorConstructor);
 
     markIfNeeded(d()->evalFunction);
+    markIfNeeded(d()->callFunction);
+    markIfNeeded(d()->applyFunction);
 
     markIfNeeded(d()->objectPrototype);
     markIfNeeded(d()->functionPrototype);
@@ -391,6 +389,8 @@ void JSGlobalObject::mark()
     markIfNeeded(d()->datePrototype);
     markIfNeeded(d()->regExpPrototype);
 
+    markIfNeeded(d()->methodCallDummy);
+
     markIfNeeded(d()->errorStructure);
 
     // No need to mark the other structures, because their prototypes are all
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 4a10f6467f..da9a819433 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -24,6 +24,7 @@
 
 #include "JSGlobalData.h"
 #include "JSVariableObject.h"
+#include "NativeFunctionWrapper.h"
 #include "NumberPrototype.h"
 #include "StringPrototype.h"
 #include <wtf/HashSet.h>
@@ -40,6 +41,7 @@ namespace JSC {
     class GlobalEvalFunction;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
+    class PrototypeFunction;
     class RegExpConstructor;
     class RegExpPrototype;
     class RegisterFile;
@@ -67,6 +69,8 @@ namespace JSC {
                 , typeErrorConstructor(0)
                 , URIErrorConstructor(0)
                 , evalFunction(0)
+                , callFunction(0)
+                , applyFunction(0)
                 , objectPrototype(0)
                 , functionPrototype(0)
                 , arrayPrototype(0)
@@ -75,6 +79,7 @@ namespace JSC {
                 , numberPrototype(0)
                 , datePrototype(0)
                 , regExpPrototype(0)
+                , methodCallDummy(0)
             {
             }
             
@@ -104,6 +109,8 @@ namespace JSC {
             NativeErrorConstructor* URIErrorConstructor;
 
             GlobalEvalFunction* evalFunction;
+            NativeFunctionWrapper* callFunction;
+            NativeFunctionWrapper* applyFunction;
 
             ObjectPrototype* objectPrototype;
             FunctionPrototype* functionPrototype;
@@ -114,6 +121,8 @@ namespace JSC {
             DatePrototype* datePrototype;
             RegExpPrototype* regExpPrototype;
 
+            JSObject* methodCallDummy;
+
             RefPtr<Structure> argumentsStructure;
             RefPtr<Structure> arrayStructure;
             RefPtr<Structure> booleanObjectStructure;
@@ -161,8 +170,8 @@ namespace JSC {
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
-        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
 
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc);
@@ -195,6 +204,8 @@ namespace JSC {
         DatePrototype* datePrototype() const { return d()->datePrototype; }
         RegExpPrototype* regExpPrototype() const { return d()->regExpPrototype; }
 
+        JSObject* methodCallDummy() const { return d()->methodCallDummy; }
+
         Structure* argumentsStructure() const { return d()->argumentsStructure.get(); }
         Structure* arrayStructure() const { return d()->arrayStructure.get(); }
         Structure* booleanObjectStructure() const { return d()->booleanObjectStructure.get(); }
@@ -214,10 +225,6 @@ namespace JSC {
         void setProfileGroup(unsigned value) { d()->profileGroup = value; }
         unsigned profileGroup() const { return d()->profileGroup; }
 
-        void setTimeoutTime(unsigned timeoutTime);
-        void startTimeoutCheck();
-        void stopTimeoutCheck();
-
         Debugger* debugger() const { return d()->debugger; }
         void setDebugger(Debugger* debugger) { d()->debugger = debugger; }
         
@@ -244,19 +251,19 @@ namespace JSC {
         void copyGlobalsFrom(RegisterFile&);
         void copyGlobalsTo(RegisterFile&);
         
-        void resetPrototype(JSValuePtr prototype);
+        void resetPrototype(JSValue prototype);
 
         JSGlobalData* globalData() { return d()->globalData.get(); }
         JSGlobalObjectData* d() const { return static_cast<JSGlobalObjectData*>(JSVariableObject::d); }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
     protected:
         struct GlobalPropertyInfo {
-            GlobalPropertyInfo(const Identifier& i, JSValuePtr v, unsigned a)
+            GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
                 : identifier(i)
                 , value(v)
                 , attributes(a)
@@ -264,7 +271,7 @@ namespace JSC {
             }
 
             const Identifier identifier;
-            JSValuePtr value;
+            JSValue value;
             unsigned attributes;
         };
         void addStaticGlobals(GlobalPropertyInfo*, int count);
@@ -272,16 +279,16 @@ namespace JSC {
     private:
         // FIXME: Fold reset into init.
         void init(JSObject* thisValue);
-        void reset(JSValuePtr prototype);
+        void reset(JSValue prototype);
 
         void setRegisters(Register* registers, Register* registerArray, size_t count);
 
         void* operator new(size_t); // can only be allocated with JSGlobalData
     };
 
-    JSGlobalObject* asGlobalObject(JSValuePtr);
+    JSGlobalObject* asGlobalObject(JSValue);
 
-    inline JSGlobalObject* asGlobalObject(JSValuePtr value)
+    inline JSGlobalObject* asGlobalObject(JSValue value)
     {
         ASSERT(asObject(value)->isGlobalObject());
         return static_cast<JSGlobalObject*>(asObject(value));
@@ -333,7 +340,7 @@ namespace JSC {
         return asGlobalObject(n->object);
     }
 
-    inline JSValuePtr Structure::prototypeForLookup(ExecState* exec)
+    inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
         if (typeInfo().type() == ObjectType)
             return m_prototype;
@@ -345,6 +352,32 @@ namespace JSC {
         return exec->lexicalGlobalObject()->numberPrototype();
     }
 
+    inline StructureChain* Structure::prototypeChain(ExecState* exec) const
+    {
+        // We cache our prototype chain so our clients can share it.
+        if (!isValid(exec, m_cachedPrototypeChain.get())) {
+            JSValue prototype = prototypeForLookup(exec);
+            m_cachedPrototypeChain = StructureChain::create(prototype.isNull() ? 0 : asObject(prototype)->structure());
+        }
+        return m_cachedPrototypeChain.get();
+    }
+
+    inline bool Structure::isValid(ExecState* exec, StructureChain* cachedPrototypeChain) const
+    {
+        if (!cachedPrototypeChain)
+            return false;
+
+        JSValue prototype = prototypeForLookup(exec);
+        RefPtr<Structure>* cachedStructure = cachedPrototypeChain->head();
+        while(*cachedStructure && !prototype.isNull()) {
+            if (asObject(prototype)->structure() != *cachedStructure)
+                return false;
+            ++cachedStructure;
+            prototype = asObject(prototype)->prototype();
+        }
+        return prototype.isNull() && !*cachedStructure;
+    }
+
     inline JSGlobalObject* ExecState::dynamicGlobalObject()
     {
         if (this == lexicalGlobalObject()->globalExec())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index ecdddcf339..b013957eae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -28,6 +28,7 @@
 #include "CallFrame.h"
 #include "GlobalEvalFunction.h"
 #include "JSGlobalObject.h"
+#include "LiteralParser.h"
 #include "JSString.h"
 #include "Interpreter.h"
 #include "Parser.h"
@@ -47,9 +48,9 @@ using namespace Unicode;
 
 namespace JSC {
 
-static JSValuePtr encode(ExecState* exec, const ArgList& args, const char* doNotEscape)
+static JSValue encode(ExecState* exec, const ArgList& args, const char* doNotEscape)
 {
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     CString cstr = str.UTF8String(true);
     if (!cstr.c_str())
         return throwError(exec, URIError, "String contained an illegal UTF-16 sequence.");
@@ -69,10 +70,10 @@ static JSValuePtr encode(ExecState* exec, const ArgList& args, const char* doNot
     return jsString(exec, result);
 }
 
-static JSValuePtr decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
+static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
 {
     UString result = "";
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
     const UChar* d = str.data();
@@ -268,18 +269,22 @@ static double parseFloat(const UString& s)
     return s.toDouble(true /*tolerant*/, false /* NaN for empty string */);
 }
 
-JSValuePtr globalFuncEval(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEval(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObject = thisValue->toThisObject(exec);
+    JSObject* thisObject = thisValue.toThisObject(exec);
     JSObject* unwrappedObject = thisObject->unwrappedObject();
     if (!unwrappedObject->isGlobalObject() || static_cast<JSGlobalObject*>(unwrappedObject)->evalFunction() != function)
         return throwError(exec, EvalError, "The \"this\" value passed to eval must be the global object from which eval originated");
 
-    JSValuePtr x = args.at(exec, 0);
-    if (!x->isString())
+    JSValue x = args.at(0);
+    if (!x.isString())
         return x;
 
-    UString s = x->toString(exec);
+    UString s = x.toString(exec);
+
+    LiteralParser preparser(exec, s);
+    if (JSValue parsedObject = preparser.tryLiteralParse())
+        return parsedObject;
 
     int errLine;
     UString errMsg;
@@ -293,42 +298,42 @@ JSValuePtr globalFuncEval(ExecState* exec, JSObject* function, JSValuePtr thisVa
     return exec->interpreter()->execute(evalNode.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot());
 }
 
-JSValuePtr globalFuncParseInt(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    JSValuePtr value = args.at(exec, 0);
-    int32_t radix = args.at(exec, 1)->toInt32(exec);
+    JSValue value = args.at(0);
+    int32_t radix = args.at(1).toInt32(exec);
 
-    if (value->isNumber() && (radix == 0 || radix == 10)) {
-        if (JSImmediate::isImmediate(value))
+    if (value.isNumber() && (radix == 0 || radix == 10)) {
+        if (value.isInt32Fast())
             return value;
-        double d = value->uncheckedGetNumber();
+        double d = value.uncheckedGetNumber();
         if (isfinite(d))
-            return jsNumber(exec, floor(d));
+            return jsNumber(exec, (d > 0) ? floor(d) : ceil(d));
         if (isnan(d) || isinf(d))
             return jsNaN(&exec->globalData());
-        return JSImmediate::zeroImmediate();
+        return jsNumber(exec, 0);
     }
 
-    return jsNumber(exec, parseInt(value->toString(exec), radix));
+    return jsNumber(exec, parseInt(value.toString(exec), radix));
 }
 
-JSValuePtr globalFuncParseFloat(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncParseFloat(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseFloat(args.at(exec, 0)->toString(exec)));
+    return jsNumber(exec, parseFloat(args.at(0).toString(exec)));
 }
 
-JSValuePtr globalFuncIsNaN(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncIsNaN(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsBoolean(isnan(args.at(exec, 0)->toNumber(exec)));
+    return jsBoolean(isnan(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr globalFuncIsFinite(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncIsFinite(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    double n = args.at(exec, 0)->toNumber(exec);
+    double n = args.at(0).toNumber(exec);
     return jsBoolean(!isnan(n) && !isinf(n));
 }
 
-JSValuePtr globalFuncDecodeURI(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_unescape_when_decoding_URI[] =
         "#$&+,/:;=?@";
@@ -336,12 +341,12 @@ JSValuePtr globalFuncDecodeURI(ExecState* exec, JSObject*, JSValuePtr, const Arg
     return decode(exec, args, do_not_unescape_when_decoding_URI, true);
 }
 
-JSValuePtr globalFuncDecodeURIComponent(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return decode(exec, args, "", true);
 }
 
-JSValuePtr globalFuncEncodeURI(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape_when_encoding_URI[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -352,7 +357,7 @@ JSValuePtr globalFuncEncodeURI(ExecState* exec, JSObject*, JSValuePtr, const Arg
     return encode(exec, args, do_not_escape_when_encoding_URI);
 }
 
-JSValuePtr globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape_when_encoding_URI_component[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -363,7 +368,7 @@ JSValuePtr globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValuePtr,
     return encode(exec, args, do_not_escape_when_encoding_URI_component);
 }
 
-JSValuePtr globalFuncEscape(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -373,7 +378,7 @@ JSValuePtr globalFuncEscape(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
 
     UString result = "";
     UString s;
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     const UChar* c = str.data();
     for (int k = 0; k < str.size(); k++, c++) {
         int u = c[0];
@@ -394,22 +399,22 @@ JSValuePtr globalFuncEscape(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsString(exec, result);
 }
 
-JSValuePtr globalFuncUnescape(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     UString result = "";
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
     while (k < len) {
         const UChar* c = str.data() + k;
         UChar u;
         if (c[0] == '%' && k <= len - 6 && c[1] == 'u') {
-            if (Lexer::isHexDigit(c[2]) && Lexer::isHexDigit(c[3]) && Lexer::isHexDigit(c[4]) && Lexer::isHexDigit(c[5])) {
+            if (isASCIIHexDigit(c[2]) && isASCIIHexDigit(c[3]) && isASCIIHexDigit(c[4]) && isASCIIHexDigit(c[5])) {
                 u = Lexer::convertUnicode(c[2], c[3], c[4], c[5]);
                 c = &u;
                 k += 5;
             }
-        } else if (c[0] == '%' && k <= len - 3 && Lexer::isHexDigit(c[1]) && Lexer::isHexDigit(c[2])) {
+        } else if (c[0] == '%' && k <= len - 3 && isASCIIHexDigit(c[1]) && isASCIIHexDigit(c[2])) {
             u = UChar(Lexer::convertHex(c[1], c[2]));
             c = &u;
             k += 2;
@@ -422,10 +427,10 @@ JSValuePtr globalFuncUnescape(ExecState* exec, JSObject*, JSValuePtr, const ArgL
 }
 
 #ifndef NDEBUG
-JSValuePtr globalFuncJSCPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncJSCPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     CStringBuffer string;
-    args.at(exec, 0)->toString(exec).getCString(string);
+    args.at(0).toString(exec).getCString(string);
     puts(string.data());
     return jsUndefined();
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
index ea1f106070..b1046f2dd4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
@@ -24,34 +24,36 @@
 #ifndef JSGlobalObjectFunctions_h
 #define JSGlobalObjectFunctions_h
 
-#include "JSImmediate.h" // temporary until JSValue* becomes a class we can forward-declare
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC {
 
     class ArgList;
     class ExecState;
     class JSObject;
+    class JSValue;
 
     // FIXME: These functions should really be in JSGlobalObject.cpp, but putting them there
     // is a 0.5% reduction.
 
-    JSValuePtr globalFuncEval(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncParseInt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncParseFloat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncIsNaN(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncIsFinite(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncDecodeURI(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncDecodeURIComponent(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEncodeURI(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEncodeURIComponent(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEscape(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncUnescape(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEval(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncParseInt(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncParseFloat(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncIsNaN(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncIsFinite(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEscape(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncUnescape(ExecState*, JSObject*, JSValue, const ArgList&);
 #ifndef NDEBUG
-    JSValuePtr globalFuncJSCPrint(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncJSCPrint(ExecState*, JSObject*, JSValue, const ArgList&);
 #endif
 
     static const double mantissaOverflowLowerBound = 9007199254740992.0;
     double parseIntOverflow(const char*, int length, int radix);
+    bool isStrWhiteSpace(UChar);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
index 09b37508c3..201e56c604 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
@@ -32,35 +32,31 @@
 
 namespace JSC {
 
-JSObject* JSImmediate::toThisObject(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::toThisObject(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
-        return constructNumberFromImmediateNumber(exec, v);
+        return constructNumber(exec, v);
     if (isBoolean(v))
         return constructBooleanFromImmediateBoolean(exec, v);
-    if (v->isNull())
-        return exec->globalThisValue();
-    
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v->isNull());
-    exec->setException(exception);
-    return new (exec) JSNotAnObject(exec, exception);
+    ASSERT(v.isUndefinedOrNull());
+    return exec->globalThisValue();
 }
 
-JSObject* JSImmediate::toObject(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::toObject(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
-        return constructNumberFromImmediateNumber(exec, v);
+        return constructNumber(exec, v);
     if (isBoolean(v))
         return constructBooleanFromImmediateBoolean(exec, v);
     
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v->isNull());
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v.isNull());
     exec->setException(exception);
     return new (exec) JSNotAnObject(exec, exception);
 }
 
-JSObject* JSImmediate::prototype(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::prototype(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
@@ -68,23 +64,34 @@ JSObject* JSImmediate::prototype(JSValuePtr v, ExecState* exec)
     if (isBoolean(v))
         return exec->lexicalGlobalObject()->booleanPrototype();
 
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v->isNull());
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v.isNull());
     exec->setException(exception);
     return new (exec) JSNotAnObject(exec, exception);
 }
 
-UString JSImmediate::toString(JSValuePtr v)
+UString JSImmediate::toString(JSValue v)
 {
     ASSERT(isImmediate(v));
-    if (isNumber(v))
+    if (isIntegerNumber(v))
         return UString::from(getTruncatedInt32(v));
+#if USE(ALTERNATE_JSIMMEDIATE)
+    if (isNumber(v)) {
+        ASSERT(isDoubleNumber(v));
+        double value = doubleValue(v);
+        if (value == 0.0) // +0.0 or -0.0
+            return "0";
+        return UString::from(value);
+    }
+#else
+        ASSERT(!isNumber(v));
+#endif
     if (jsBoolean(false) == v)
         return "false";
     if (jsBoolean(true) == v)
         return "true";
-    if (v->isNull())
+    if (v.isNull())
         return "null";
-    ASSERT(v->isUndefined());
+    ASSERT(v.isUndefined());
     return "undefined";
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
index 37bca2a867..706396ecfe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
@@ -25,6 +25,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/AlwaysInline.h>
 #include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
 #include "JSValue.h"
 #include <limits>
 #include <limits.h>
@@ -36,10 +37,23 @@ namespace JSC {
 
     class ExecState;
     class JSCell;
+    class JSFastMath;
+    class JSGlobalData;
     class JSObject;
-    class JSValue;
     class UString;
 
+#if USE(ALTERNATE_JSIMMEDIATE)
+    inline intptr_t reinterpretDoubleToIntptr(double value)
+    {
+        return WTF::bitwise_cast<intptr_t>(value);
+    }
+
+    inline double reinterpretIntptrToDouble(intptr_t value)
+    {
+        return WTF::bitwise_cast<double>(value);
+    }
+#endif
+
     /*
      * A JSValue* is either a pointer to a cell (a heap-allocated object) or an immediate (a type-tagged 
      * value masquerading as a pointer). The low two bits in a JSValue* are available for type tagging
@@ -84,14 +98,33 @@ namespace JSC {
 
     /*
      * On 64-bit platforms, we support an alternative encoding form for immediates, if
-     * USE(ALTERNATE_JSIMMEDIATE) is defined.
+     * USE(ALTERNATE_JSIMMEDIATE) is defined.  When this format is used, double precision
+     * floating point values may also be encoded as JSImmediates.
+     *
+     * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+     * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+     * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+     * have a payload of zero.  We assume that non-zero payloads are available to encode
+     * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+     * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+     * ranges to encode other values (however there are also other ranges of NaN space that
+     * could have been selected).  This range of NaN space is represented by 64-bit numbers
+     * begining with the 16-bit hex patterns 0xFFFE and 0xFFFF - we rely on the fact that no
+     * valid double-precision numbers will begin fall in these ranges.
      *
-     * The top 16-bits denote the type:
+     * The scheme we have implemented encodes double precision values by adding 2^48 to the
+     * 64-bit integer representation of the number.  After this manipulation, no encoded
+     * double-precision value will begin with the pattern 0x0000 or 0xFFFF.
+     *
+     * The top 16-bits denote the type of the encoded JSImmediate:
      *
      * Pointer: 0000:PPPP:PPPP:PPPP
+     *          0001:****:****:****
+     * Double:{         ...
+     *          FFFE:****:****:****
      * Integer: FFFF:0000:IIII:IIII
      *
-     * 32-bit signed integers are marked with the 16-bit tag '0xFFFF'.  The tag '0x0000'
+     * 32-bit signed integers are marked with the 16-bit tag 0xFFFF.  The tag 0x0000
      * denotes a pointer, or another form of tagged immediate.  Boolean, null and undefined
      * values are encoded in the same manner as the default format.
      */
@@ -99,14 +132,41 @@ namespace JSC {
     class JSImmediate {
     private:
         friend class JIT;
-    
+        friend class JSValue;
+        friend class JSFastMath;
+        friend JSValue jsNumber(ExecState* exec, double d);
+        friend JSValue jsNumber(ExecState*, char i);
+        friend JSValue jsNumber(ExecState*, unsigned char i);
+        friend JSValue jsNumber(ExecState*, short i);
+        friend JSValue jsNumber(ExecState*, unsigned short i);
+        friend JSValue jsNumber(ExecState* exec, int i);
+        friend JSValue jsNumber(ExecState* exec, unsigned i);
+        friend JSValue jsNumber(ExecState* exec, long i);
+        friend JSValue jsNumber(ExecState* exec, unsigned long i);
+        friend JSValue jsNumber(ExecState* exec, long long i);
+        friend JSValue jsNumber(ExecState* exec, unsigned long long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, double d);
+        friend JSValue jsNumber(JSGlobalData* globalData, short i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned short i);
+        friend JSValue jsNumber(JSGlobalData* globalData, int i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned i);
+        friend JSValue jsNumber(JSGlobalData* globalData, long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, long long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long long i);
+
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static const intptr_t TagTypeInteger = 0xffff000000000000ll; // bottom bit set indicates integer, this dominates the following bit
+        // If all bits in the mask are set, this indicates an integer number,
+        // if any but not all are set this value is a double precision number.
+        static const intptr_t TagTypeNumber = 0xffff000000000000ll;
+        // This value is 2^48, used to encode doubles such that the encoded value will begin
+        // with a 16-bit pattern within the range 0x0001..0xFFFE.
+        static const intptr_t DoubleEncodeOffset = 0x1000000000000ll;
 #else
-        static const intptr_t TagTypeInteger = 0x1; // bottom bit set indicates integer, this dominates the following bit
+        static const intptr_t TagTypeNumber = 0x1; // bottom bit set indicates integer, this dominates the following bit
 #endif
         static const intptr_t TagBitTypeOther   = 0x2; // second bit set indicates immediate other than an integer
-        static const intptr_t TagMask           = TagTypeInteger | TagBitTypeOther;
+        static const intptr_t TagMask           = TagTypeNumber | TagBitTypeOther;
 
         static const intptr_t ExtendedTagMask         = 0xC; // extended tag holds a further two bits
         static const intptr_t ExtendedTagBitBool      = 0x4;
@@ -128,157 +188,102 @@ namespace JSC {
 
         static const int32_t signBit = 0x80000000;
  
-    public:
-        static ALWAYS_INLINE bool isImmediate(JSValuePtr v)
+        static ALWAYS_INLINE bool isImmediate(JSValue v)
         {
             return rawValue(v) & TagMask;
         }
         
-        static ALWAYS_INLINE bool isNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isNumber(JSValue v)
+        {
+            return rawValue(v) & TagTypeNumber;
+        }
+
+        static ALWAYS_INLINE bool isIntegerNumber(JSValue v)
+        {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            return (rawValue(v) & TagTypeNumber) == TagTypeNumber;
+#else
+            return isNumber(v);
+#endif
+        }
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+        static ALWAYS_INLINE bool isDoubleNumber(JSValue v)
         {
-            return rawValue(v) & TagTypeInteger;
+            return isNumber(v) && !isIntegerNumber(v);
         }
+#endif
 
-        static ALWAYS_INLINE bool isPositiveNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isPositiveIntegerNumber(JSValue v)
         {
             // A single mask to check for the sign bit and the number tag all at once.
-            return (rawValue(v) & (signBit | TagTypeInteger)) == TagTypeInteger;
+            return (rawValue(v) & (signBit | TagTypeNumber)) == TagTypeNumber;
         }
         
-        static ALWAYS_INLINE bool isBoolean(JSValuePtr v)
+        static ALWAYS_INLINE bool isBoolean(JSValue v)
         {
             return (rawValue(v) & FullTagTypeMask) == FullTagTypeBool;
         }
         
-        static ALWAYS_INLINE bool isUndefinedOrNull(JSValuePtr v)
+        static ALWAYS_INLINE bool isUndefinedOrNull(JSValue v)
         {
             // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
             return (rawValue(v) & ~ExtendedTagBitUndefined) == FullTagTypeNull;
         }
 
-        static bool isNegative(JSValuePtr v)
-        {
-            ASSERT(isNumber(v));
-            return rawValue(v) & signBit;
-        }
-
-        static JSValuePtr from(char);
-        static JSValuePtr from(signed char);
-        static JSValuePtr from(unsigned char);
-        static JSValuePtr from(short);
-        static JSValuePtr from(unsigned short);
-        static JSValuePtr from(int);
-        static JSValuePtr from(unsigned);
-        static JSValuePtr from(long);
-        static JSValuePtr from(unsigned long);
-        static JSValuePtr from(long long);
-        static JSValuePtr from(unsigned long long);
-        static JSValuePtr from(double);
-
-        static ALWAYS_INLINE bool isEitherImmediate(JSValuePtr v1, JSValuePtr v2)
+        static JSValue from(char);
+        static JSValue from(signed char);
+        static JSValue from(unsigned char);
+        static JSValue from(short);
+        static JSValue from(unsigned short);
+        static JSValue from(int);
+        static JSValue from(unsigned);
+        static JSValue from(long);
+        static JSValue from(unsigned long);
+        static JSValue from(long long);
+        static JSValue from(unsigned long long);
+        static JSValue from(double);
+
+        static ALWAYS_INLINE bool isEitherImmediate(JSValue v1, JSValue v2)
         {
             return (rawValue(v1) | rawValue(v2)) & TagMask;
         }
 
-        static ALWAYS_INLINE bool isAnyImmediate(JSValuePtr v1, JSValuePtr v2, JSValuePtr v3)
-        {
-            return (rawValue(v1) | rawValue(v2) | rawValue(v3)) & TagMask;
-        }
-
-        static ALWAYS_INLINE bool areBothImmediate(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool areBothImmediate(JSValue v1, JSValue v2)
         {
             return isImmediate(v1) & isImmediate(v2);
         }
 
-        static ALWAYS_INLINE bool areBothImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            return rawValue(v1) & rawValue(v2) & TagTypeInteger;
-        }
-
-        static ALWAYS_INLINE JSValuePtr andImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(areBothImmediateNumbers(v1, v2));
-            return makeValue(rawValue(v1) & rawValue(v2));
-        }
-
-        static ALWAYS_INLINE JSValuePtr xorImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(areBothImmediateNumbers(v1, v2));
-            return makeValue((rawValue(v1) ^ rawValue(v2)) | TagTypeInteger);
-        }
-
-        static ALWAYS_INLINE JSValuePtr orImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(areBothImmediateNumbers(v1, v2));
-            return makeValue(rawValue(v1) | rawValue(v2));
-        }
-
-        static ALWAYS_INLINE JSValuePtr rightShiftImmediateNumbers(JSValuePtr val, JSValuePtr shift)
+        static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValue v1, JSValue v2)
         {
-            ASSERT(areBothImmediateNumbers(val, shift));
 #if USE(ALTERNATE_JSIMMEDIATE)
-            return makeValue(static_cast<intptr_t>(static_cast<uint32_t>(static_cast<int32_t>(rawValue(val)) >> ((rawValue(shift) >> IntegerPayloadShift) & 0x1f))) | TagTypeInteger);
+            return (rawValue(v1) & rawValue(v2) & TagTypeNumber) == TagTypeNumber;
 #else
-            return makeValue((rawValue(val) >> ((rawValue(shift) >> IntegerPayloadShift) & 0x1f)) | TagTypeInteger);
+            return rawValue(v1) & rawValue(v2) & TagTypeNumber;
 #endif
         }
 
-        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValuePtr v)
-        {
-            // Number is non-negative and an operation involving two of these can't overflow.
-            // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
-            return (rawValue(v) & (TagTypeInteger + (signBit | (signBit >> 1)))) == TagTypeInteger;
-        }
-
-        static ALWAYS_INLINE JSValuePtr addImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(canDoFastAdditiveOperations(v1));
-            ASSERT(canDoFastAdditiveOperations(v2));
-            return makeValue(rawValue(v1) + rawValue(v2) - TagTypeInteger);
-        }
-
-        static ALWAYS_INLINE JSValuePtr subImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(canDoFastAdditiveOperations(v1));
-            ASSERT(canDoFastAdditiveOperations(v2));
-            return makeValue(rawValue(v1) - rawValue(v2) + TagTypeInteger);
-        }
-
-        static ALWAYS_INLINE JSValuePtr incImmediateNumber(JSValuePtr v)
-        {
-            ASSERT(canDoFastAdditiveOperations(v));
-            return makeValue(rawValue(v) + (1 << IntegerPayloadShift));
-        }
-
-        static ALWAYS_INLINE JSValuePtr decImmediateNumber(JSValuePtr v)
-        {
-            ASSERT(canDoFastAdditiveOperations(v));
-            return makeValue(rawValue(v) - (1 << IntegerPayloadShift));
-        }
-
-        static double toDouble(JSValuePtr);
-        static bool toBoolean(JSValuePtr);
-        static JSObject* toObject(JSValuePtr, ExecState*);
-        static JSObject* toThisObject(JSValuePtr, ExecState*);
-        static UString toString(JSValuePtr);
+        static double toDouble(JSValue);
+        static bool toBoolean(JSValue);
+        static JSObject* toObject(JSValue, ExecState*);
+        static JSObject* toThisObject(JSValue, ExecState*);
+        static UString toString(JSValue);
 
-        static bool getUInt32(JSValuePtr, uint32_t&);
-        static bool getTruncatedInt32(JSValuePtr, int32_t&);
-        static bool getTruncatedUInt32(JSValuePtr, uint32_t&);
+        static bool getUInt32(JSValue, uint32_t&);
+        static bool getTruncatedInt32(JSValue, int32_t&);
+        static bool getTruncatedUInt32(JSValue, uint32_t&);
 
-        static int32_t getTruncatedInt32(JSValuePtr);
-        static uint32_t getTruncatedUInt32(JSValuePtr);
+        static int32_t getTruncatedInt32(JSValue);
+        static uint32_t getTruncatedUInt32(JSValue);
 
-        static JSValuePtr trueImmediate();
-        static JSValuePtr falseImmediate();
-        static JSValuePtr undefinedImmediate();
-        static JSValuePtr nullImmediate();
-        static JSValuePtr zeroImmediate();
-        static JSValuePtr oneImmediate();
+        static JSValue trueImmediate();
+        static JSValue falseImmediate();
+        static JSValue undefinedImmediate();
+        static JSValue nullImmediate();
+        static JSValue zeroImmediate();
+        static JSValue oneImmediate();
 
-        static JSValuePtr impossibleValue();
-        
-        static JSObject* prototype(JSValuePtr, ExecState*);
+        static JSObject* prototype(JSValue, ExecState*);
 
     private:
 #if USE(ALTERNATE_JSIMMEDIATE)
@@ -290,51 +295,71 @@ namespace JSC {
 #endif
         static const unsigned maxImmediateUInt = maxImmediateInt;
 
-        static ALWAYS_INLINE JSValuePtr makeValue(intptr_t integer)
+        static ALWAYS_INLINE JSValue makeValue(intptr_t integer)
         {
-            return JSValuePtr::makeImmediate(integer);
+            return JSValue::makeImmediate(integer);
         }
 
+        // With USE(ALTERNATE_JSIMMEDIATE) we want the argument to be zero extended, so the
+        // integer doesn't interfere with the tag bits in the upper word.  In the default encoding,
+        // if intptr_t id larger then int32_t we sign extend the value through the upper word.
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static ALWAYS_INLINE JSValuePtr makeInt(uint32_t value)
+        static ALWAYS_INLINE JSValue makeInt(uint32_t value)
 #else
-        static ALWAYS_INLINE JSValuePtr makeInt(int32_t value)
+        static ALWAYS_INLINE JSValue makeInt(int32_t value)
 #endif
         {
-            return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeInteger);
+            return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeNumber);
+        }
+        
+#if USE(ALTERNATE_JSIMMEDIATE)
+        static ALWAYS_INLINE JSValue makeDouble(double value)
+        {
+            return makeValue(reinterpretDoubleToIntptr(value) + DoubleEncodeOffset);
         }
+#endif
         
-        static ALWAYS_INLINE JSValuePtr makeBool(bool b)
+        static ALWAYS_INLINE JSValue makeBool(bool b)
         {
             return makeValue((static_cast<intptr_t>(b) << ExtendedPayloadShift) | FullTagTypeBool);
         }
         
-        static ALWAYS_INLINE JSValuePtr makeUndefined()
+        static ALWAYS_INLINE JSValue makeUndefined()
         {
             return makeValue(FullTagTypeUndefined);
         }
         
-        static ALWAYS_INLINE JSValuePtr makeNull()
+        static ALWAYS_INLINE JSValue makeNull()
         {
             return makeValue(FullTagTypeNull);
         }
-        
-        static ALWAYS_INLINE int32_t intValue(JSValuePtr v)
+
+        template<typename T>
+        static JSValue fromNumberOutsideIntegerRange(T);
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+        static ALWAYS_INLINE double doubleValue(JSValue v)
+        {
+            return reinterpretIntptrToDouble(rawValue(v) - DoubleEncodeOffset);
+        }
+#endif
+
+        static ALWAYS_INLINE int32_t intValue(JSValue v)
         {
             return static_cast<int32_t>(rawValue(v) >> IntegerPayloadShift);
         }
         
-        static ALWAYS_INLINE uint32_t uintValue(JSValuePtr v)
+        static ALWAYS_INLINE uint32_t uintValue(JSValue v)
         {
             return static_cast<uint32_t>(rawValue(v) >> IntegerPayloadShift);
         }
         
-        static ALWAYS_INLINE bool boolValue(JSValuePtr v)
+        static ALWAYS_INLINE bool boolValue(JSValue v)
         {
             return rawValue(v) & ExtendedPayloadBitBoolValue;
         }
         
-        static ALWAYS_INLINE intptr_t rawValue(JSValuePtr v)
+        static ALWAYS_INLINE intptr_t rawValue(JSValue v)
         {
             return v.immediateValue();
         }
@@ -342,177 +367,204 @@ namespace JSC {
         static double nonInlineNaN();
     };
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::trueImmediate() { return makeBool(true); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::falseImmediate() { return makeBool(false); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::undefinedImmediate() { return makeUndefined(); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::nullImmediate() { return makeNull(); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::zeroImmediate() { return makeInt(0); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::oneImmediate() { return makeInt(1); }
+    ALWAYS_INLINE JSValue JSImmediate::trueImmediate() { return makeBool(true); }
+    ALWAYS_INLINE JSValue JSImmediate::falseImmediate() { return makeBool(false); }
+    ALWAYS_INLINE JSValue JSImmediate::undefinedImmediate() { return makeUndefined(); }
+    ALWAYS_INLINE JSValue JSImmediate::nullImmediate() { return makeNull(); }
+    ALWAYS_INLINE JSValue JSImmediate::zeroImmediate() { return makeInt(0); }
+    ALWAYS_INLINE JSValue JSImmediate::oneImmediate() { return makeInt(1); }
 
-    // This value is impossible because 0x4 is not a valid pointer but a tag of 0 would indicate non-immediate
-    ALWAYS_INLINE JSValuePtr JSImmediate::impossibleValue() { return makeValue(0x4); }
+#if USE(ALTERNATE_JSIMMEDIATE)
+    inline bool doubleToBoolean(double value)
+    {
+        return value < 0.0 || value > 0.0;
+    }
 
-    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValuePtr v)
+    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
+    {
+        ASSERT(isImmediate(v));
+        return isNumber(v) ? isIntegerNumber(v) ? v != zeroImmediate()
+            : doubleToBoolean(doubleValue(v)) : v == trueImmediate();
+    }
+#else
+    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
     {
         ASSERT(isImmediate(v));
-        intptr_t bits = rawValue(v);
-        return (bits & TagTypeInteger)
-            ? bits != TagTypeInteger // !0 ints
-            : bits == (FullTagTypeBool | ExtendedPayloadBitBoolValue); // bool true
+        return isIntegerNumber(v) ? v != zeroImmediate() : v == trueImmediate();
     }
+#endif
 
-    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValuePtr v)
+    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValue v)
     {
-        ASSERT(isNumber(v));
+        // FIXME: should probably be asserting isPositiveIntegerNumber here.
+        ASSERT(isIntegerNumber(v));
         return intValue(v);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(char i)
+#if USE(ALTERNATE_JSIMMEDIATE)
+    template<typename T>
+    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T value)
+    {
+        return makeDouble(static_cast<double>(value));
+    }
+#else
+    template<typename T>
+    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T)
+    {
+        return JSValue();
+    }
+#endif
+
+    ALWAYS_INLINE JSValue JSImmediate::from(char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(signed char i)
+    ALWAYS_INLINE JSValue JSImmediate::from(signed char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned char i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(short i)
+    ALWAYS_INLINE JSValue JSImmediate::from(short i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned short i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned short i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(int i)
+    ALWAYS_INLINE JSValue JSImmediate::from(int i)
     {
+#if !USE(ALTERNATE_JSIMMEDIATE)
         if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
+#endif
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned i)
     {
         if (i > maxImmediateUInt)
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(long i)
     {
         if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long i)
     {
         if (i > maxImmediateUInt)
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(long long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(long long i)
     {
         if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return noValue();
+            return JSValue();
         return makeInt(static_cast<intptr_t>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned long long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long long i)
     {
         if (i > maxImmediateUInt)
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(static_cast<intptr_t>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(double d)
+    ALWAYS_INLINE JSValue JSImmediate::from(double d)
     {
         const int intVal = static_cast<int>(d);
 
-        if ((intVal < minImmediateInt) | (intVal > maxImmediateInt))
-            return noValue();
-
         // Check for data loss from conversion to int.
         if (intVal != d || (!intVal && signbit(d)))
-            return noValue();
+            return fromNumberOutsideIntegerRange(d);
 
-        return makeInt(intVal);
+        return from(intVal);
     }
 
-    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValuePtr v)
+    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValue v)
     {
-        ASSERT(isNumber(v));
+        ASSERT(isIntegerNumber(v));
         return intValue(v);
     }
 
-    ALWAYS_INLINE double JSImmediate::toDouble(JSValuePtr v)
+    ALWAYS_INLINE double JSImmediate::toDouble(JSValue v)
     {
         ASSERT(isImmediate(v));
-        int i;
-        if (isNumber(v))
-            i = intValue(v);
-        else if (rawValue(v) == FullTagTypeUndefined)
+
+        if (isIntegerNumber(v))
+            return intValue(v);
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+        if (isNumber(v)) {
+            ASSERT(isDoubleNumber(v));
+            return doubleValue(v);
+        }
+#else
+        ASSERT(!isNumber(v));
+#endif
+
+        if (rawValue(v) == FullTagTypeUndefined)
             return nonInlineNaN();
-        else
-            i = rawValue(v) >> ExtendedPayloadShift;
-        return i;
+
+        ASSERT(JSImmediate::isBoolean(v) || (v == JSImmediate::nullImmediate()));
+        return rawValue(v) >> ExtendedPayloadShift;
     }
 
-    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValuePtr v, uint32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValue v, uint32_t& i)
     {
         i = uintValue(v);
-        return isPositiveNumber(v);
+        return isPositiveIntegerNumber(v);
     }
 
-    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValuePtr v, int32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValue v, int32_t& i)
     {
         i = intValue(v);
-        return isNumber(v);
+        return isIntegerNumber(v);
     }
 
-    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValuePtr v, uint32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValue v, uint32_t& i)
     {
         return getUInt32(v, i);
     }
 
-    inline JSValuePtr jsNull()
-    {
-        return JSImmediate::nullImmediate();
-    }
+    // These are identical logic to the JSValue functions above, and faster than jsNumber(number).toInt32().
+    int32_t toInt32(double);
+    uint32_t toUInt32(double);
+    int32_t toInt32SlowCase(double, bool& ok);
+    uint32_t toUInt32SlowCase(double, bool& ok);
 
-    inline JSValuePtr jsBoolean(bool b)
+    inline JSValue::JSValue(JSNullTag)
     {
-        return b ? JSImmediate::trueImmediate() : JSImmediate::falseImmediate();
+        *this = JSImmediate::nullImmediate();
     }
-
-    inline JSValuePtr jsUndefined()
+    
+    inline JSValue::JSValue(JSUndefinedTag)
     {
-        return JSImmediate::undefinedImmediate();
+        *this = JSImmediate::undefinedImmediate();
     }
 
-    // These are identical logic to the JSValue functions above, and faster than jsNumber(number)->toInt32().
-    int32_t toInt32(double);
-    uint32_t toUInt32(double);
-    int32_t toInt32SlowCase(double, bool& ok);
-    uint32_t toUInt32SlowCase(double, bool& ok);
-
-    inline bool JSValue::isUndefined() const
+    inline JSValue::JSValue(JSTrueTag)
     {
-        return asValue() == jsUndefined();
+        *this = JSImmediate::trueImmediate();
     }
 
-    inline bool JSValue::isNull() const
+    inline JSValue::JSValue(JSFalseTag)
     {
-        return asValue() == jsNull();
+        *this = JSImmediate::falseImmediate();
     }
 
     inline bool JSValue::isUndefinedOrNull() const
@@ -545,8 +597,8 @@ namespace JSC {
         int32_t i;
         if (getTruncatedInt32(i))
             return i;
-        bool ok;
-        return toInt32SlowCase(exec, ok);
+        bool ignored;
+        return toInt32SlowCase(toNumber(exec), ignored);
     }
 
     inline uint32_t JSValue::toUInt32(ExecState* exec) const
@@ -554,8 +606,8 @@ namespace JSC {
         uint32_t i;
         if (getTruncatedUInt32(i))
             return i;
-        bool ok;
-        return toUInt32SlowCase(exec, ok);
+        bool ignored;
+        return toUInt32SlowCase(toNumber(exec), ignored);
     }
 
     inline int32_t toInt32(double val)
@@ -583,7 +635,7 @@ namespace JSC {
             ok = true;
             return i;
         }
-        return toInt32SlowCase(exec, ok);
+        return toInt32SlowCase(toNumber(exec), ok);
     }
 
     inline uint32_t JSValue::toUInt32(ExecState* exec, bool& ok) const
@@ -593,9 +645,142 @@ namespace JSC {
             ok = true;
             return i;
         }
-        return toUInt32SlowCase(exec, ok);
+        return toUInt32SlowCase(toNumber(exec), ok);
+    }
+
+    inline bool JSValue::isCell() const
+    {
+        return !JSImmediate::isImmediate(asValue());
+    }
+
+    inline bool JSValue::isInt32Fast() const
+    {
+        return JSImmediate::isIntegerNumber(asValue());
+    }
+
+    inline int32_t JSValue::getInt32Fast() const
+    {
+        ASSERT(isInt32Fast());
+        return JSImmediate::getTruncatedInt32(asValue());
+    }
+
+    inline bool JSValue::isUInt32Fast() const
+    {
+        return JSImmediate::isPositiveIntegerNumber(asValue());
+    }
+
+    inline uint32_t JSValue::getUInt32Fast() const
+    {
+        ASSERT(isUInt32Fast());
+        return JSImmediate::getTruncatedUInt32(asValue());
+    }
+
+    inline JSValue JSValue::makeInt32Fast(int32_t i)
+    {
+        return JSImmediate::from(i);
+    }
+
+    inline bool JSValue::areBothInt32Fast(JSValue v1, JSValue v2)
+    {
+        return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
     }
 
+    class JSFastMath {
+    public:
+        static ALWAYS_INLINE bool canDoFastBitwiseOperations(JSValue v1, JSValue v2)
+        {
+            return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
+        }
+
+        static ALWAYS_INLINE JSValue equal(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return jsBoolean(v1 == v2);
+        }
+
+        static ALWAYS_INLINE JSValue notEqual(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return jsBoolean(v1 != v2);
+        }
+
+        static ALWAYS_INLINE JSValue andImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) & JSImmediate::rawValue(v2));
+        }
+
+        static ALWAYS_INLINE JSValue xorImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return JSImmediate::makeValue((JSImmediate::rawValue(v1) ^ JSImmediate::rawValue(v2)) | JSImmediate::TagTypeNumber);
+        }
+
+        static ALWAYS_INLINE JSValue orImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) | JSImmediate::rawValue(v2));
+        }
+
+        static ALWAYS_INLINE bool canDoFastRshift(JSValue v1, JSValue v2)
+        {
+            return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
+        }
+
+        static ALWAYS_INLINE bool canDoFastUrshift(JSValue v1, JSValue v2)
+        {
+            return JSImmediate::areBothImmediateIntegerNumbers(v1, v2) && !(JSImmediate::rawValue(v1) & JSImmediate::signBit);
+        }
+
+        static ALWAYS_INLINE JSValue rightShiftImmediateNumbers(JSValue val, JSValue shift)
+        {
+            ASSERT(canDoFastRshift(val, shift) || canDoFastUrshift(val, shift));
+#if USE(ALTERNATE_JSIMMEDIATE)
+            return JSImmediate::makeValue(static_cast<intptr_t>(static_cast<uint32_t>(static_cast<int32_t>(JSImmediate::rawValue(val)) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f))) | JSImmediate::TagTypeNumber);
+#else
+            return JSImmediate::makeValue((JSImmediate::rawValue(val) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f)) | JSImmediate::TagTypeNumber);
+#endif
+        }
+
+        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValue v)
+        {
+            // Number is non-negative and an operation involving two of these can't overflow.
+            // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
+            return (JSImmediate::rawValue(v) & (JSImmediate::TagTypeNumber + (JSImmediate::signBit | (JSImmediate::signBit >> 1)))) == JSImmediate::TagTypeNumber;
+        }
+
+        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValue v1, JSValue v2)
+        {
+            // Number is non-negative and an operation involving two of these can't overflow.
+            // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
+            return canDoFastAdditiveOperations(v1) && canDoFastAdditiveOperations(v2);
+        }
+
+        static ALWAYS_INLINE JSValue addImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastAdditiveOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) + JSImmediate::rawValue(v2) - JSImmediate::TagTypeNumber);
+        }
+
+        static ALWAYS_INLINE JSValue subImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastAdditiveOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) - JSImmediate::rawValue(v2) + JSImmediate::TagTypeNumber);
+        }
+
+        static ALWAYS_INLINE JSValue incImmediateNumber(JSValue v)
+        {
+            ASSERT(canDoFastAdditiveOperations(v));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v) + (1 << JSImmediate::IntegerPayloadShift));
+        }
+
+        static ALWAYS_INLINE JSValue decImmediateNumber(JSValue v)
+        {
+            ASSERT(canDoFastAdditiveOperations(v));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v) - (1 << JSImmediate::IntegerPayloadShift));
+        }
+    };
+
 } // namespace JSC
 
 #endif // JSImmediate_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp
index 5662a41946..7ece5da3d6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp
@@ -119,11 +119,58 @@ bool JSLock::currentThreadIsHoldingLock()
     return !!pthread_getspecific(JSLockCount);
 }
 
+// This is fairly nasty.  We allow multiple threads to run on the same
+// context, and we do not require any locking semantics in doing so -
+// clients of the API may simply use the context from multiple threads
+// concurently, and assume this will work.  In order to make this work,
+// We lock the context when a thread enters, and unlock it when it leaves.
+// However we do not only unlock when the thread returns from its
+// entry point (evaluate script or call function), we also unlock the
+// context if the thread leaves JSC by making a call out to an external
+// function through a callback.
+//
+// All threads using the context share the same JS stack (the RegisterFile).
+// Whenever a thread calls into JSC it starts using the RegisterFile from the
+// previous 'high water mark' - the maximum point the stack has ever grown to
+// (returned by RegisterFile::end()).  So if a first thread calls out to a
+// callback, and a second thread enters JSC, then also exits by calling out
+// to a callback, we can be left with stackframes from both threads in the
+// RegisterFile.  As such, a problem may occur should the first thread's
+// callback complete first, and attempt to return to JSC.  Were we to allow
+// this to happen, and were its stack to grow further, then it may potentially
+// write over the second thread's call frames.
+//
+// In avoid JS stack corruption we enforce a policy of only ever allowing two
+// threads to use a JS context concurrently, and only allowing the second of
+// these threads to execute until it has completed and fully returned from its
+// outermost call into JSC.  We enforce this policy using 'lockDropDepth'.  The
+// first time a thread exits it will call DropAllLocks - which will do as expected
+// and drop locks allowing another thread to enter.  Should another thread, or the
+// same thread again, enter JSC (through evaluate script or call function), and exit
+// again through a callback, then the locks will not be dropped when DropAllLocks
+// is called (since lockDropDepth is non-zero).  Since this thread is still holding
+// the locks, only it will re able to re-enter JSC (either be returning from the
+// callback, or by re-entering through another call to evaulate script or call
+// function).
+//
+// This policy is slightly more restricive than it needs to be for correctness -
+// we could validly allow futher entries into JSC from other threads, we only
+// need ensure that callbacks return in the reverse chronological order of the
+// order in which they were made - though implementing the less restrictive policy
+// would likely increase complexity and overhead.
+//
+static unsigned lockDropDepth = 0;
+
 JSLock::DropAllLocks::DropAllLocks(ExecState* exec)
     : m_lockingForReal(exec->globalData().isSharedInstance)
 {
     pthread_once(&createJSLockCountOnce, createJSLockCount);
 
+    if (lockDropDepth++) {
+        m_lockCount = 0;
+        return;
+    }
+
     m_lockCount = JSLock::lockCount();
     for (intptr_t i = 0; i < m_lockCount; i++)
         JSLock::unlock(m_lockingForReal);
@@ -134,6 +181,11 @@ JSLock::DropAllLocks::DropAllLocks(bool lockingForReal)
 {
     pthread_once(&createJSLockCountOnce, createJSLockCount);
 
+    if (lockDropDepth++) {
+        m_lockCount = 0;
+        return;
+    }
+
     // It is necessary to drop even "unreal" locks, because having a non-zero lock count
     // will prevent a real lock from being taken.
 
@@ -146,6 +198,8 @@ JSLock::DropAllLocks::~DropAllLocks()
 {
     for (intptr_t i = 0; i < m_lockCount; i++)
         JSLock::lock(m_lockingForReal);
+
+    --lockDropDepth;
 }
 
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
index d4310fc577..937dc2b9f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -37,13 +37,13 @@ namespace JSC {
 ASSERT_CLASS_FITS_IN_CELL(JSNotAnObject);
 
 // JSValue methods
-JSValuePtr JSNotAnObject::toPrimitive(ExecState* exec, PreferredPrimitiveType) const
+JSValue JSNotAnObject::toPrimitive(ExecState* exec, PreferredPrimitiveType) const
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return m_exception;
 }
 
-bool JSNotAnObject::getPrimitiveNumber(ExecState* exec, double&, JSValuePtr&)
+bool JSNotAnObject::getPrimitiveNumber(ExecState* exec, double&, JSValue&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return false;
@@ -69,8 +69,7 @@ UString JSNotAnObject::toString(ExecState* exec) const
 
 JSObject* JSNotAnObject::toObject(ExecState* exec) const
 {
-    UNUSED_PARAM(exec);
-    ASSERT(exec->hadException() && exec->exception() == m_exception);
+    ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return m_exception;
 }
 
@@ -95,12 +94,12 @@ bool JSNotAnObject::getOwnPropertySlot(ExecState* exec, unsigned, PropertySlot&)
     return false;
 }
 
-void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValuePtr, PutPropertySlot&)
+void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValue, PutPropertySlot&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
 
-void JSNotAnObject::put(ExecState* exec, unsigned, JSValuePtr)
+void JSNotAnObject::put(ExecState* exec, unsigned, JSValue)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index c69593f476..a8e36bd21d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -60,15 +60,15 @@ namespace JSC {
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
      private:
         // JSValue methods
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -81,8 +81,8 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue);
 
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
index efda0c6ce3..669440bc62 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
@@ -28,12 +28,14 @@
 
 namespace JSC {
 
-JSValuePtr JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
+#if !USE(ALTERNATE_JSIMMEDIATE)
+
+JSValue JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSNumberCell*>(this);
 }
 
-bool JSNumberCell::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool JSNumberCell::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     number = m_value;
     value = this;
@@ -96,29 +98,40 @@ bool JSNumberCell::getTruncatedUInt32(uint32_t& uint32) const
     return true;
 }
 
-JSValuePtr JSNumberCell::getJSNumber()
+JSValue JSNumberCell::getJSNumber()
 {
     return this;
 }
 
-NEVER_INLINE JSValuePtr jsNumberCell(ExecState* exec, double d)
+JSValue jsNumberCell(ExecState* exec, double d)
 {
     return new (exec) JSNumberCell(exec, d);
 }
 
-NEVER_INLINE JSValuePtr jsNaN(ExecState* exec)
+JSValue jsNumberCell(JSGlobalData* globalData, double d)
 {
-    return new (exec) JSNumberCell(exec, NaN);
+    return new (globalData) JSNumberCell(globalData, d);
 }
 
-NEVER_INLINE JSValuePtr jsNumberCell(JSGlobalData* globalData, double d)
+JSValue jsAPIMangledNumber(ExecState* exec, double d)
 {
-    return new (globalData) JSNumberCell(globalData, d);
+    return new (exec) JSNumberCell(JSNumberCell::APIMangled, d);
+}
+
+#else
+
+JSValue jsNumberCell(ExecState*, double)
+{
+    ASSERT_NOT_REACHED();
+    return JSValue();
 }
 
-NEVER_INLINE JSValuePtr jsNaN(JSGlobalData* globalData)
+JSValue jsAPIMangledNumber(ExecState*, double)
 {
-    return new (globalData) JSNumberCell(globalData, NaN);
+    ASSERT_NOT_REACHED();
+    return JSValue();
 }
 
+#endif
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index 00d190df88..a35e2106d0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -32,6 +32,14 @@
 
 namespace JSC {
 
+    extern const double NaN;
+    extern const double Inf;
+
+    JSValue jsNumberCell(ExecState*, double);
+    JSValue jsAPIMangledNumber(ExecState*, double);
+
+#if !USE(ALTERNATE_JSIMMEDIATE)
+
     class Identifier;
     class JSCell;
     class JSObject;
@@ -43,15 +51,14 @@ namespace JSC {
 
     class JSNumberCell : public JSCell {
         friend class JIT;
-        friend JSValuePtr jsNumberCell(JSGlobalData*, double);
-        friend JSValuePtr jsNaN(JSGlobalData*);
-        friend JSValuePtr jsNumberCell(ExecState*, double);
-        friend JSValuePtr jsNaN(ExecState*);
+        friend JSValue jsNumberCell(JSGlobalData*, double);
+        friend JSValue jsNumberCell(ExecState*, double);
+        friend JSValue jsAPIMangledNumber(ExecState*, double);
     public:
         double value() const { return m_value; }
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -59,10 +66,10 @@ namespace JSC {
 
         virtual UString toThisString(ExecState*) const;
         virtual JSObject* toThisObject(ExecState*) const;
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
 
-        int32_t toInt32() const;
-        uint32_t toUInt32() const;
+        static const uintptr_t JSAPIMangledMagicNumber = 0xbbadbeef;
+        bool isAPIMangledNumber() const { return m_structure == reinterpret_cast<Structure*>(JSAPIMangledMagicNumber); }
 
         void* operator new(size_t size, ExecState* exec)
         {
@@ -82,7 +89,7 @@ namespace JSC {
     #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
@@ -97,6 +104,13 @@ namespace JSC {
         {
         }
 
+        enum APIMangledTag { APIMangled };
+        JSNumberCell(APIMangledTag, double value)
+            : JSCell(reinterpret_cast<Structure*>(JSAPIMangledMagicNumber))
+            , m_value(value)
+        {
+        }
+
         virtual bool getUInt32(uint32_t&) const;
         virtual bool getTruncatedInt32(int32_t&) const;
         virtual bool getTruncatedUInt32(uint32_t&) const;
@@ -104,157 +118,361 @@ namespace JSC {
         double m_value;
     };
 
-    extern const double NaN;
-    extern const double Inf;
+    JSValue jsNumberCell(JSGlobalData*, double);
 
-    JSNumberCell* asNumberCell(JSValuePtr);
+    inline bool isNumberCell(JSValue v)
+    {
+        return v.isCell() && v.asCell()->isNumber();
+    }
+
+    inline JSNumberCell* asNumberCell(JSValue v)
+    {
+        ASSERT(isNumberCell(v));
+        return static_cast<JSNumberCell*>(v.asCell());
+    }
 
-    JSValuePtr jsNumberCell(JSGlobalData*, double);
-    JSValuePtr jsNaN(JSGlobalData*);
-    JSValuePtr jsNumberCell(ExecState*, double);
-    JSValuePtr jsNaN(ExecState*);
 
-    inline JSNumberCell* asNumberCell(JSValuePtr value)
+    inline JSValue::JSValue(ExecState* exec, double d)
     {
-        ASSERT(asCell(value)->isNumber());
-        return static_cast<JSNumberCell*>(asCell(value));
+        JSValue v = JSImmediate::from(d);
+        *this = v ? v : jsNumberCell(exec, d);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, double d)
+    inline JSValue::JSValue(ExecState* exec, int i)
     {
-        JSValuePtr v = JSImmediate::from(d);
-        return v ? v : jsNumberCell(exec, d);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, short i)
+    inline JSValue::JSValue(ExecState* exec, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned short i)
+    inline JSValue::JSValue(ExecState* exec, long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, int i)
+    inline JSValue::JSValue(ExecState* exec, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned i)
+    inline JSValue::JSValue(ExecState* exec, long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, long i)
+    inline JSValue::JSValue(ExecState* exec, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, double d)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(d);
+        *this = v ? v : jsNumberCell(globalData, d);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, long long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, int i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned long long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, double d)
+    inline JSValue::JSValue(JSGlobalData* globalData, long i)
     {
-        JSValuePtr v = JSImmediate::from(d);
-        return v ? v : jsNumberCell(globalData, d);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, short i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned short i)
+    inline JSValue::JSValue(JSGlobalData* globalData, long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, int i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned i)
+    inline bool JSValue::isDoubleNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        return isNumberCell(asValue());
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, long i)
+    inline double JSValue::getDoubleNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        return asNumberCell(asValue())->value();
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long i)
+    inline bool JSValue::isNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        return JSImmediate::isNumber(asValue()) || isDoubleNumber();
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, long long i)
+    inline double JSValue::uncheckedGetNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, static_cast<double>(i));
+        ASSERT(isNumber());
+        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : getDoubleNumber();
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long long i)
+    inline bool JSValue::isAPIMangledNumber()
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, static_cast<double>(i));
+        ASSERT(isNumber());
+        return JSImmediate::isImmediate(asValue()) ? false : asNumberCell(asValue())->isAPIMangledNumber();
     }
 
-    // --- JSValue inlines ----------------------------
+#else
+
+    inline JSValue::JSValue(ExecState*, double d)
+    {
+        JSValue v = JSImmediate::from(d);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, int i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, double d)
+    {
+        JSValue v = JSImmediate::from(d);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, int i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline bool JSValue::isDoubleNumber() const
+    {
+        return JSImmediate::isDoubleNumber(asValue());
+    }
+
+    inline double JSValue::getDoubleNumber() const
+    {
+        return JSImmediate::doubleValue(asValue());
+    }
+
+    inline bool JSValue::isNumber() const
+    {
+        return JSImmediate::isNumber(asValue());
+    }
 
     inline double JSValue::uncheckedGetNumber() const
     {
-        ASSERT(JSImmediate::isImmediate(asValue()) || asCell()->isNumber());
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asNumberCell(asValue())->value();
+        ASSERT(isNumber());
+        return JSImmediate::toDouble(asValue());
+    }
+
+#endif
+
+    inline JSValue::JSValue(ExecState*, char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(ExecState*, short i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned short i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
     }
 
-    inline int32_t JSNumberCell::toInt32() const
+    inline JSValue::JSValue(JSGlobalData*, short i)
     {
-        if (m_value >= -2147483648.0 && m_value < 2147483648.0)
-            return static_cast<int32_t>(m_value);
-        bool scratch;
-        return JSC::toInt32SlowCase(m_value, scratch);
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
     }
 
-    inline uint32_t JSNumberCell::toUInt32() const
+    inline JSValue::JSValue(JSGlobalData*, unsigned short i)
     {
-        if (m_value >= 0.0 && m_value < 4294967296.0)
-            return static_cast<uint32_t>(m_value);
-        bool scratch;
-        return JSC::toUInt32SlowCase(m_value, scratch);
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSValue::toJSNumber(ExecState* exec) const
+    inline JSValue jsNaN(ExecState* exec)
     {
-        return JSImmediate::isNumber(asValue()) ? asValue() : jsNumber(exec, this->toNumber(exec));
+        return jsNumber(exec, NaN);
+    }
+
+    inline JSValue jsNaN(JSGlobalData* globalData)
+    {
+        return jsNumber(globalData, NaN);
+    }
+
+    // --- JSValue inlines ----------------------------
+
+    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
+    {
+        return isNumber() ? asValue() : jsNumber(exec, this->toNumber(exec));
+    }
+
+    inline bool JSValue::getNumber(double &result) const
+    {
+        if (isInt32Fast())
+            result = getInt32Fast();
+        else if (LIKELY(isDoubleNumber()))
+            result = getDoubleNumber();
+        else {
+            ASSERT(!isNumber());
+            return false;
+        }
+        return true;
+    }
+
+    inline bool JSValue::numberToInt32(int32_t& arg)
+    {
+        if (isInt32Fast())
+            arg = getInt32Fast();
+        else if (LIKELY(isDoubleNumber()))
+            arg = JSC::toInt32(getDoubleNumber());
+        else {
+            ASSERT(!isNumber());
+            return false;
+        }
+        return true;
+    }
+
+    inline bool JSValue::numberToUInt32(uint32_t& arg)
+    {
+        if (isUInt32Fast())
+            arg = getUInt32Fast();
+        else if (LIKELY(isDoubleNumber()))
+            arg = JSC::toUInt32(getDoubleNumber());
+        else if (isInt32Fast()) {
+            // FIXME: I think this case can be merged with the uint case; toUInt32SlowCase
+            // on a negative value is equivalent to simple static_casting.
+            bool ignored;
+            arg = toUInt32SlowCase(getInt32Fast(), ignored);
+        } else {
+            ASSERT(!isNumber());
+            return false;
+        }
+        return true;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index d38c325c87..415c25d33b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -69,11 +69,13 @@ void JSObject::mark()
     JSCell::mark();
     m_structure->mark();
 
+    PropertyStorage storage = propertyStorage();
+
     size_t storageSize = m_structure->propertyStorageSize();
     for (size_t i = 0; i < storageSize; ++i) {
-        JSValuePtr v = m_propertyStorage[i];
-        if (!v->marked())
-            v->mark();
+        JSValue v = JSValue::decode(storage[i]);
+        if (!v.marked())
+            v.mark();
     }
 
     JSOBJECT_MARK_END();
@@ -98,18 +100,18 @@ static void throwSetterError(ExecState* exec)
 }
 
 // ECMA 8.6.2.2
-void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (propertyName == exec->propertyNames().underscoreProto) {
         // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
-        if (!value->isObject() && !value->isNull())
+        if (!value.isObject() && !value.isNull())
             return;
 
-        JSValuePtr nextPrototypeValue = value;
-        while (nextPrototypeValue && nextPrototypeValue->isObject()) {
+        JSValue nextPrototypeValue = value;
+        while (nextPrototypeValue && nextPrototypeValue.isObject()) {
             JSObject* nextPrototype = asObject(nextPrototypeValue)->unwrappedObject();
             if (nextPrototype == this) {
                 throwError(exec, GeneralError, "cyclic __proto__ value");
@@ -123,22 +125,23 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr v
     }
 
     // Check if there are any setters or getters in the prototype chain
-    JSValuePtr prototype;
+    JSValue prototype;
     for (JSObject* obj = this; !obj->structure()->hasGetterSetterProperties(); obj = asObject(prototype)) {
         prototype = obj->prototype();
-        if (prototype->isNull()) {
-            putDirect(propertyName, value, 0, true, slot);
+        if (prototype.isNull()) {
+            putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
             return;
         }
     }
     
     unsigned attributes;
-    if ((m_structure->get(propertyName, attributes) != WTF::notFound) && attributes & ReadOnly)
+    JSCell* specificValue;
+    if ((m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly)
         return;
 
     for (JSObject* obj = this; ; obj = asObject(prototype)) {
-        if (JSValuePtr gs = obj->getDirect(propertyName)) {
-            if (gs->isGetterSetter()) {
+        if (JSValue gs = obj->getDirect(propertyName)) {
+            if (gs.isGetterSetter()) {
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
                     throwSetterError(exec);
@@ -147,7 +150,7 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr v
                 
                 CallData callData;
                 CallType callType = setterFunc->getCallData(callData);
-                ArgList args;
+                MarkedArgumentBuffer args;
                 args.append(value);
                 call(exec, setterFunc, callType, callData, this, args);
                 return;
@@ -159,26 +162,31 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr v
         }
 
         prototype = obj->prototype();
-        if (prototype->isNull())
+        if (prototype.isNull())
             break;
     }
 
-    putDirect(propertyName, value, 0, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
     return;
 }
 
-void JSObject::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSObject::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     PutPropertySlot slot;
     put(exec, Identifier::from(exec, propertyName), value, slot);
 }
 
-void JSObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
-    putDirect(propertyName, value, attributes);
+    putDirectInternal(exec->globalData(), propertyName, value, attributes, checkReadOnly, slot);
 }
 
-void JSObject::putWithAttributes(ExecState* exec, unsigned propertyName, JSValuePtr value, unsigned attributes)
+void JSObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    putDirectInternal(exec->globalData(), propertyName, value, attributes);
+}
+
+void JSObject::putWithAttributes(ExecState* exec, unsigned propertyName, JSValue value, unsigned attributes)
 {
     putWithAttributes(exec, Identifier::from(exec, propertyName), value, attributes);
 }
@@ -199,7 +207,8 @@ bool JSObject::hasProperty(ExecState* exec, unsigned propertyName) const
 bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     unsigned attributes;
-    if (m_structure->get(propertyName, attributes) != WTF::notFound) {
+    JSCell* specificValue;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) {
         if ((attributes & DontDelete))
             return false;
         removeDirect(propertyName);
@@ -226,11 +235,11 @@ bool JSObject::deleteProperty(ExecState* exec, unsigned propertyName)
     return deleteProperty(exec, Identifier::from(exec, propertyName));
 }
 
-static ALWAYS_INLINE JSValuePtr callDefaultValueFunction(ExecState* exec, const JSObject* object, const Identifier& propertyName)
+static ALWAYS_INLINE JSValue callDefaultValueFunction(ExecState* exec, const JSObject* object, const Identifier& propertyName)
 {
-    JSValuePtr function = object->get(exec, propertyName);
+    JSValue function = object->get(exec, propertyName);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return exec->exception();
 
@@ -239,35 +248,35 @@ static ALWAYS_INLINE JSValuePtr callDefaultValueFunction(ExecState* exec, const
     if (exec->hadException())
         return exec->exception();
 
-    JSValuePtr result = call(exec, function, callType, callData, const_cast<JSObject*>(object), exec->emptyList());
-    ASSERT(!result->isGetterSetter());
+    JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), exec->emptyList());
+    ASSERT(!result.isGetterSetter());
     if (exec->hadException())
         return exec->exception();
-    if (result->isObject())
-        return noValue();
+    if (result.isObject())
+        return JSValue();
     return result;
 }
 
-bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValuePtr& result)
+bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result)
 {
     result = defaultValue(exec, PreferNumber);
-    number = result->toNumber(exec);
-    return !result->isString();
+    number = result.toNumber(exec);
+    return !result.isString();
 }
 
 // ECMA 8.6.2.6
-JSValuePtr JSObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue JSObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     // Must call toString first for Date objects.
     if ((hint == PreferString) || (hint != PreferNumber && prototype() == exec->lexicalGlobalObject()->datePrototype())) {
-        JSValuePtr value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
+        JSValue value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
         if (value)
             return value;
         value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
         if (value)
             return value;
     } else {
-        JSValuePtr value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
+        JSValue value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
         if (value)
             return value;
         value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
@@ -293,8 +302,8 @@ const HashEntry* JSObject::findPropertyHashEntry(ExecState* exec, const Identifi
 
 void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
 {
-    JSValuePtr object = getDirect(propertyName);
-    if (object && object->isGetterSetter()) {
+    JSValue object = getDirect(propertyName);
+    if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setGetter(getterFunction);
         return;
@@ -302,7 +311,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter;
-    putDirect(propertyName, getterSetter, None, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -320,8 +329,8 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
 
 void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
 {
-    JSValuePtr object = getDirect(propertyName);
-    if (object && object->isGetterSetter()) {
+    JSValue object = getDirect(propertyName);
+    if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setSetter(setterFunction);
         return;
@@ -329,7 +338,7 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter;
-    putDirect(propertyName, getterSetter, None, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, Setter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -345,12 +354,12 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
     getterSetter->setSetter(setterFunction);
 }
 
-JSValuePtr JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValuePtr value = object->getDirect(propertyName)) {
-            if (!value->isGetterSetter())
+        if (JSValue value = object->getDirect(propertyName)) {
+            if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->getter();
             if (!functionObject)
@@ -358,18 +367,18 @@ JSValuePtr JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
             return functionObject;
         }
 
-        if (!object->prototype() || !object->prototype()->isObject())
+        if (!object->prototype() || !object->prototype().isObject())
             return jsUndefined();
         object = asObject(object->prototype());
     }
 }
 
-JSValuePtr JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValuePtr value = object->getDirect(propertyName)) {
-            if (!value->isGetterSetter())
+        if (JSValue value = object->getDirect(propertyName)) {
+            if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->setter();
             if (!functionObject)
@@ -377,24 +386,24 @@ JSValuePtr JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
             return functionObject;
         }
 
-        if (!object->prototype() || !object->prototype()->isObject())
+        if (!object->prototype() || !object->prototype().isObject())
             return jsUndefined();
         object = asObject(object->prototype());
     }
 }
 
-bool JSObject::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto)
+bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
-    if (!proto->isObject()) {
-        throwError(exec, TypeError, "instanceof called on an object with an invalid prototype property.");
+    if (!value.isObject())
         return false;
-    }
 
-    if (!value->isObject())
+    if (!proto.isObject()) {
+        throwError(exec, TypeError, "instanceof called on an object with an invalid prototype property.");
         return false;
+    }
 
     JSObject* object = asObject(value);
-    while ((object = object->prototype()->getObject())) {
+    while ((object = object->prototype().getObject())) {
         if (proto == object)
             return true;
     }
@@ -411,7 +420,8 @@ bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyN
 
 bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
-    if (m_structure->get(propertyName, attributes) != WTF::notFound)
+    JSCell* specificValue;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
         return true;
     
     // Look in the static hashtable of properties
@@ -424,6 +434,19 @@ bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& property
     return false;
 }
 
+bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
+{
+    unsigned attributes;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
+        return true;
+
+    // This could be a function within the static table? - should probably
+    // also look in the hash?  This currently should not be a problem, since
+    // we've currently always call 'get' first, which should have populated
+    // the normal storage.
+    return false;
+}
+
 void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
@@ -436,18 +459,18 @@ bool JSObject::toBoolean(ExecState*) const
 
 double JSObject::toNumber(ExecState* exec) const
 {
-    JSValuePtr primitive = toPrimitive(exec, PreferNumber);
+    JSValue primitive = toPrimitive(exec, PreferNumber);
     if (exec->hadException()) // should be picked up soon in Nodes.cpp
         return 0.0;
-    return primitive->toNumber(exec);
+    return primitive.toNumber(exec);
 }
 
 UString JSObject::toString(ExecState* exec) const
 {
-    JSValuePtr primitive = toPrimitive(exec, PreferString);
+    JSValue primitive = toPrimitive(exec, PreferString);
     if (exec->hadException())
         return "";
-    return primitive->toString(exec);
+    return primitive.toString(exec);
 }
 
 JSObject* JSObject::toObject(ExecState*) const
@@ -471,27 +494,27 @@ void JSObject::removeDirect(const Identifier& propertyName)
     if (m_structure->isDictionary()) {
         offset = m_structure->removePropertyWithoutTransition(propertyName);
         if (offset != WTF::notFound)
-            m_propertyStorage[offset] = jsUndefined();
+            putDirectOffset(offset, jsUndefined());
         return;
     }
 
     RefPtr<Structure> structure = Structure::removePropertyTransition(m_structure, propertyName, offset);
-    if (offset != WTF::notFound)
-        m_propertyStorage[offset] = jsUndefined();
     setStructure(structure.release());
+    if (offset != WTF::notFound)
+        putDirectOffset(offset, jsUndefined());
 }
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirect(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunction(Identifier(exec, function->name(&exec->globalData())), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunctionWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
 }
 
-NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValuePtr* location)
+NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
 {
     if (JSObject* getterFunction = asGetterSetter(*location)->getter())
         slot.setGetterSlot(getterFunction);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 5918b9da79..54805f26d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -32,9 +32,17 @@
 #include "PutPropertySlot.h"
 #include "ScopeChain.h"
 #include "Structure.h"
+#include "JSGlobalData.h"
 
 namespace JSC {
 
+    inline JSCell* getJSFunction(JSGlobalData& globalData, JSValue value)
+    {
+        if (value.isCell() && (value.asCell()->vptr() == globalData.jsFunctionVPtr))
+            return value.asCell();
+        return 0;
+    }
+
     class InternalFunction;
     class PropertyNameArray;
     class Structure;
@@ -49,9 +57,12 @@ namespace JSC {
         DontEnum     = 1 << 2,  // property doesn't appear in (for .. in ..)
         DontDelete   = 1 << 3,  // property can't be deleted
         Function     = 1 << 4,  // property is a function - only used by static hashtables
+        Getter       = 1 << 5,  // property is a getter
+        Setter       = 1 << 6   // property is a setter
     };
 
-    typedef JSValuePtr* PropertyStorage;
+    typedef EncodedJSValue* PropertyStorage;
+    typedef const EncodedJSValue* ConstPropertyStorage;
 
     class JSObject : public JSCell {
         friend class BatchedTransitionOptimizer;
@@ -69,18 +80,16 @@ namespace JSC {
 
         bool inherits(const ClassInfo* classInfo) const { return JSCell::isObject(classInfo); }
 
-        JSValuePtr prototype() const;
-        void setPrototype(JSValuePtr prototype);
+        JSValue prototype() const;
+        void setPrototype(JSValue prototype);
         
         void setStructure(PassRefPtr<Structure>);
         Structure* inheritorID();
 
-        PropertyStorage& propertyStorage() { return m_propertyStorage; }
-
         virtual UString className() const;
 
-        JSValuePtr get(ExecState*, const Identifier& propertyName) const;
-        JSValuePtr get(ExecState*, unsigned propertyName) const;
+        JSValue get(ExecState*, const Identifier& propertyName) const;
+        JSValue get(ExecState*, unsigned propertyName) const;
 
         bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
@@ -88,11 +97,12 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr value);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue value);
 
-        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes);
-        virtual void putWithAttributes(ExecState*, unsigned propertyName, JSValuePtr value, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, unsigned propertyName, JSValue value, unsigned attributes);
 
         bool propertyIsEnumerable(ExecState*, const Identifier& propertyName) const;
 
@@ -103,14 +113,14 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+        virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-        virtual bool hasInstance(ExecState*, JSValuePtr, JSValuePtr prototypeProperty);
+        virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
 
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -120,34 +130,31 @@ namespace JSC {
         virtual JSObject* unwrappedObject();
 
         virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
-        JSValuePtr getDirect(const Identifier& propertyName) const
+        JSValue getDirect(const Identifier& propertyName) const
         {
             size_t offset = m_structure->get(propertyName);
-            return offset != WTF::notFound ? m_propertyStorage[offset] : noValue();
+            return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
         }
 
-        JSValuePtr* getDirectLocation(const Identifier& propertyName)
+        JSValue* getDirectLocation(const Identifier& propertyName)
         {
             size_t offset = m_structure->get(propertyName);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        JSValuePtr* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
+        JSValue* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
         {
-            size_t offset = m_structure->get(propertyName, attributes);
+            JSCell* specificFunction;
+            size_t offset = m_structure->get(propertyName, attributes, specificFunction);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        size_t offsetForLocation(JSValuePtr* location)
-        {
-            return location - m_propertyStorage;
-        }
-
-        JSValuePtr* locationForOffset(size_t offset)
+        size_t offsetForLocation(JSValue* location) const
         {
-            return &m_propertyStorage[offset];
+            return location - reinterpret_cast<const JSValue*>(propertyStorage());
         }
 
         void transitionTo(Structure*);
@@ -156,36 +163,42 @@ namespace JSC {
         bool hasCustomProperties() { return !m_structure->isEmpty(); }
         bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
 
-        void putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr = 0);
-        void putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr = 0);
+
+        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
+        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
         void putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr = 0);
-        void putDirectWithoutTransition(const Identifier& propertyName, JSValuePtr value, unsigned attr = 0);
+
+        void putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attr = 0);
+        void putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
         void putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr = 0);
 
         // Fast access to known property offsets.
-        JSValuePtr getDirectOffset(size_t offset) { return m_propertyStorage[offset]; }
-        void putDirectOffset(size_t offset, JSValuePtr value) { m_propertyStorage[offset] = value; }
+        JSValue getDirectOffset(size_t offset) const { return JSValue::decode(propertyStorage()[offset]); }
+        void putDirectOffset(size_t offset, JSValue value) { propertyStorage()[offset] = JSValue::encode(value); }
 
-        void fillGetterPropertySlot(PropertySlot&, JSValuePtr* location);
+        void fillGetterPropertySlot(PropertySlot&, JSValue* location);
 
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
-        virtual JSValuePtr lookupGetter(ExecState*, const Identifier& propertyName);
-        virtual JSValuePtr lookupSetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
         virtual bool isGlobalObject() const { return false; }
         virtual bool isVariableObject() const { return false; }
+        virtual bool isActivationObject() const { return false; }
         virtual bool isWatchdogException() const { return false; }
         virtual bool isNotAnObjectErrorStub() const { return false; }
 
         void allocatePropertyStorage(size_t oldSize, size_t newSize);
         void allocatePropertyStorageInline(size_t oldSize, size_t newSize);
-        bool usingInlineStorage() const { return m_propertyStorage == m_inlineStorage; }
+        bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
 
-        static const size_t inlineStorageCapacity = 2;
+        static const size_t inlineStorageCapacity = 3;
         static const size_t nonInlineBaseStorageCapacity = 16;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
         }
@@ -194,6 +207,23 @@ namespace JSC {
         bool getOwnPropertySlotForWrite(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
 
     private:
+        ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
+        PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
+
+        const JSValue* locationForOffset(size_t offset) const
+        {
+            return reinterpret_cast<const JSValue*>(&propertyStorage()[offset]);
+        }
+
+        JSValue* locationForOffset(size_t offset)
+        {
+            return reinterpret_cast<JSValue*>(&propertyStorage()[offset]);
+        }
+
+        void putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot, JSCell*);
+        void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr = 0);
+
         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         const HashEntry* findPropertyHashEntry(ExecState*, const Identifier& propertyName) const;
@@ -201,15 +231,17 @@ namespace JSC {
 
         RefPtr<Structure> m_inheritorID;
 
-        PropertyStorage m_propertyStorage;        
-        JSValuePtr m_inlineStorage[inlineStorageCapacity];
+        union {
+            PropertyStorage m_externalStorage;
+            EncodedJSValue m_inlineStorage[inlineStorageCapacity];
+        };
     };
 
-    JSObject* asObject(JSValuePtr);
+    JSObject* asObject(JSValue);
 
     JSObject* constructEmptyObject(ExecState*);
 
-inline JSObject* asObject(JSValuePtr value)
+inline JSObject* asObject(JSValue value)
 {
     ASSERT(asCell(value)->isObject());
     return static_cast<JSObject*>(asCell(value));
@@ -217,28 +249,27 @@ inline JSObject* asObject(JSValuePtr value)
 
 inline JSObject::JSObject(PassRefPtr<Structure> structure)
     : JSCell(structure.releaseRef()) // ~JSObject balances this ref()
-    , m_propertyStorage(m_inlineStorage)
 {
     ASSERT(m_structure);
     ASSERT(m_structure->propertyStorageCapacity() == inlineStorageCapacity);
     ASSERT(m_structure->isEmpty());
-    ASSERT(prototype()->isNull() || Heap::heap(this) == Heap::heap(prototype()));
+    ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
 }
 
 inline JSObject::~JSObject()
 {
     ASSERT(m_structure);
-    if (m_propertyStorage != m_inlineStorage)
-        delete [] m_propertyStorage;
+    if (!isUsingInlineStorage())
+        delete [] m_externalStorage;
     m_structure->deref();
 }
 
-inline JSValuePtr JSObject::prototype() const
+inline JSValue JSObject::prototype() const
 {
     return m_structure->storedPrototype();
 }
 
-inline void JSObject::setPrototype(JSValuePtr prototype)
+inline void JSObject::setPrototype(JSValue prototype)
 {
     ASSERT(prototype);
     RefPtr<Structure> newStructure = Structure::changePrototypeTransition(m_structure, prototype);
@@ -258,6 +289,11 @@ inline Structure* JSObject::inheritorID()
     return createInheritorID();
 }
 
+inline bool Structure::isUsingInlineStorage() const
+{
+    return (propertyStorageCapacity() == JSObject::inlineStorageCapacity);
+}
+
 inline bool JSCell::isObject(const ClassInfo* info) const
 {
     for (const ClassInfo* ci = classInfo(); ci; ci = ci->parentClass) {
@@ -270,13 +306,13 @@ inline bool JSCell::isObject(const ClassInfo* info) const
 // this method is here to be after the inline declaration of JSCell::isObject
 inline bool JSValue::isObject(const ClassInfo* classInfo) const
 {
-    return !JSImmediate::isImmediate(asValue()) && asCell()->isObject(classInfo);
+    return isCell() && asCell()->isObject(classInfo);
 }
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (JSValuePtr* location = getDirectLocation(propertyName)) {
-        if (m_structure->hasGetterSetterProperties() && location[0]->isGetterSetter())
+    if (JSValue* location = getDirectLocation(propertyName)) {
+        if (m_structure->hasGetterSetterProperties() && location[0].isGetterSetter())
             fillGetterPropertySlot(slot, location);
         else
             slot.setValueSlot(this, location, offsetForLocation(location));
@@ -295,8 +331,8 @@ ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Ide
 ALWAYS_INLINE bool JSObject::getOwnPropertySlotForWrite(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, bool& slotIsWriteable)
 {
     unsigned attributes;
-    if (JSValuePtr* location = getDirectLocation(propertyName, attributes)) {
-        if (m_structure->hasGetterSetterProperties() && location[0]->isGetterSetter()) {
+    if (JSValue* location = getDirectLocation(propertyName, attributes)) {
+        if (m_structure->hasGetterSetterProperties() && location[0].isGetterSetter()) {
             slotIsWriteable = false;
             fillGetterPropertySlot(slot, location);
         } else {
@@ -339,8 +375,8 @@ inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propert
     while (true) {
         if (object->fastGetOwnPropertySlot(exec, propertyName, slot))
             return true;
-        JSValuePtr prototype = object->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = object->prototype();
+        if (!prototype.isObject())
             return false;
         object = asObject(prototype);
     }
@@ -352,14 +388,14 @@ inline bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, Pr
     while (true) {
         if (object->getOwnPropertySlot(exec, propertyName, slot))
             return true;
-        JSValuePtr prototype = object->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = object->prototype();
+        if (!prototype.isObject())
             return false;
         object = asObject(prototype);
     }
 }
 
-inline JSValuePtr JSObject::get(ExecState* exec, const Identifier& propertyName) const
+inline JSValue JSObject::get(ExecState* exec, const Identifier& propertyName) const
 {
     PropertySlot slot(this);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
@@ -368,7 +404,7 @@ inline JSValuePtr JSObject::get(ExecState* exec, const Identifier& propertyName)
     return jsUndefined();
 }
 
-inline JSValuePtr JSObject::get(ExecState* exec, unsigned propertyName) const
+inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
 {
     PropertySlot slot(this);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
@@ -377,80 +413,139 @@ inline JSValuePtr JSObject::get(ExecState* exec, unsigned propertyName) const
     return jsUndefined();
 }
 
-inline void JSObject::putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr)
-{
-    PutPropertySlot slot;
-    putDirect(propertyName, value, attr, false, slot);
-}
-
-inline void JSObject::putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot, JSCell* specificFunction)
 {
+    ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (m_structure->isDictionary()) {
         unsigned currentAttributes;
-        size_t offset = m_structure->get(propertyName, currentAttributes);
+        JSCell* currentSpecificFunction;
+        size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
+            if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
+                m_structure->despecifyDictionaryFunction(propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return;
-            m_propertyStorage[offset] = value;
-            slot.setExistingProperty(this, offset);
+            putDirectOffset(offset, value);
+            if (!specificFunction && !currentSpecificFunction)
+                slot.setExistingProperty(this, offset);
             return;
         }
 
         size_t currentCapacity = m_structure->propertyStorageCapacity();
-        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes);
+        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, specificFunction);
         if (currentCapacity != m_structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
 
         ASSERT(offset < m_structure->propertyStorageCapacity());
-        m_propertyStorage[offset] = value;
-        slot.setNewProperty(this, offset);
+        putDirectOffset(offset, value);
+        // See comment on setNewProperty call below.
+        if (!specificFunction)
+            slot.setNewProperty(this, offset);
         return;
     }
 
     size_t offset;
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, offset)) {
+    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, specificFunction, offset)) {    
         if (currentCapacity != structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
         ASSERT(offset < structure->propertyStorageCapacity());
-        m_propertyStorage[offset] = value;
-        slot.setNewProperty(this, offset);
-        slot.setWasTransition(true);
         setStructure(structure.release());
+        putDirectOffset(offset, value);
+        // See comment on setNewProperty call below.
+        if (!specificFunction)
+            slot.setNewProperty(this, offset);
         return;
     }
 
     unsigned currentAttributes;
-    offset = m_structure->get(propertyName, currentAttributes);
+    JSCell* currentSpecificFunction;
+    offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
     if (offset != WTF::notFound) {
         if (checkReadOnly && currentAttributes & ReadOnly)
             return;
-        m_propertyStorage[offset] = value;
+
+        if (currentSpecificFunction && (specificFunction != currentSpecificFunction)) {
+            setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
+            putDirectOffset(offset, value);
+            // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+            return;
+        }
+        putDirectOffset(offset, value);
         slot.setExistingProperty(this, offset);
         return;
     }
 
-    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, offset);
+    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
     ASSERT(offset < structure->propertyStorageCapacity());
-    m_propertyStorage[offset] = value;
-    slot.setNewProperty(this, offset);
-    slot.setWasTransition(true);
     setStructure(structure.release());
+    putDirectOffset(offset, value);
+    // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+    if (!specificFunction)
+        slot.setNewProperty(this, offset);
+}
+
+inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, getJSFunction(globalData, value));
+}
+
+inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
+}
+
+inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, 0);
+}
+
+inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attributes, false, slot, 0);
+}
+
+inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, value);
+}
+
+inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attr, false, slot, value);
+}
+
+inline void JSObject::putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    size_t currentCapacity = m_structure->propertyStorageCapacity();
+    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, 0);
+    if (currentCapacity != m_structure->propertyStorageCapacity())
+        allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
+    putDirectOffset(offset, value);
 }
 
-inline void JSObject::putDirectWithoutTransition(const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+inline void JSObject::putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes);
+    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, value);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
-    m_propertyStorage[offset] = value;
+    putDirectOffset(offset, value);
 }
 
 inline void JSObject::transitionTo(Structure* newStructure)
@@ -460,21 +555,23 @@ inline void JSObject::transitionTo(Structure* newStructure)
     setStructure(newStructure);
 }
 
-inline JSValuePtr JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
 {
     return defaultValue(exec, preferredType);
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, const Identifier& propertyName) const
+inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(asValue());
     return get(exec, propertyName, slot);
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
+inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSObject* prototype = JSImmediate::prototype(asValue(), exec);
+        if (propertyName == exec->propertyNames().underscoreProto)
+            return prototype;
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
         return slot.getValue(exec, propertyName);
@@ -484,22 +581,22 @@ inline JSValuePtr JSValue::get(ExecState* exec, const Identifier& propertyName,
         if (cell->fastGetOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
         ASSERT(cell->isObject());
-        JSValuePtr prototype = static_cast<JSObject*>(cell)->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        if (!prototype.isObject())
             return jsUndefined();
         cell = asObject(prototype);
     }
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, unsigned propertyName) const
+inline JSValue JSValue::get(ExecState* exec, unsigned propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(asValue());
     return get(exec, propertyName, slot);
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
+inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSObject* prototype = JSImmediate::prototype(asValue(), exec);
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
@@ -510,25 +607,25 @@ inline JSValuePtr JSValue::get(ExecState* exec, unsigned propertyName, PropertyS
         if (cell->getOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
         ASSERT(cell->isObject());
-        JSValuePtr prototype = static_cast<JSObject*>(cell)->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        if (!prototype.isObject())
             return jsUndefined();
-        cell = prototype->asCell();
+        cell = prototype.asCell();
     }
 }
 
-inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value, slot);
         return;
     }
     asCell()->put(exec, propertyName, value, slot);
 }
 
-inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value);
         return;
     }
@@ -539,14 +636,20 @@ ALWAYS_INLINE void JSObject::allocatePropertyStorageInline(size_t oldSize, size_
 {
     ASSERT(newSize > oldSize);
 
-    JSValuePtr* oldPropertyStorage = m_propertyStorage;
-    m_propertyStorage = new JSValuePtr[newSize];
+    // It's important that this function not rely on m_structure, since
+    // we might be in the middle of a transition.
+    bool wasInline = (oldSize == JSObject::inlineStorageCapacity);
+
+    PropertyStorage oldPropertyStorage = (wasInline ? m_inlineStorage : m_externalStorage);
+    PropertyStorage newPropertyStorage = new EncodedJSValue[newSize];
 
     for (unsigned i = 0; i < oldSize; ++i)
-        m_propertyStorage[i] = oldPropertyStorage[i];
+       newPropertyStorage[i] = oldPropertyStorage[i];
 
-    if (oldPropertyStorage != m_inlineStorage)
+    if (!wasInline)
         delete [] oldPropertyStorage;
+
+    m_externalStorage = newPropertyStorage;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index ec8efea6c6..8c7b53d531 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -37,13 +37,13 @@ JSPropertyNameIterator::~JSPropertyNameIterator()
 {
 }
 
-JSValuePtr JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     ASSERT_NOT_REACHED();
-    return noValue();
+    return JSValue();
 }
 
-bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValuePtr&)
+bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValue&)
 {
     ASSERT_NOT_REACHED();
     return false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index fddb4f64db..9817c07579 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -40,12 +40,12 @@ namespace JSC {
 
     class JSPropertyNameIterator : public JSCell {
     public:
-        static JSPropertyNameIterator* create(ExecState*, JSValuePtr);
+        static JSPropertyNameIterator* create(ExecState*, JSValue);
 
         virtual ~JSPropertyNameIterator();
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double&, JSValuePtr&);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -53,7 +53,7 @@ namespace JSC {
 
         virtual void mark();
 
-        JSValuePtr next(ExecState*);
+        JSValue next(ExecState*);
         void invalidate();
 
     private:
@@ -83,23 +83,23 @@ inline JSPropertyNameIterator::JSPropertyNameIterator(JSObject* object, PassRefP
 {
 }
 
-inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValuePtr v)
+inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValue v)
 {
-    if (v->isUndefinedOrNull())
+    if (v.isUndefinedOrNull())
         return new (exec) JSPropertyNameIterator;
 
-    JSObject* o = v->toObject(exec);
+    JSObject* o = v.toObject(exec);
     PropertyNameArray propertyNames(exec);
     o->getPropertyNames(exec, propertyNames);
     return new (exec) JSPropertyNameIterator(o, propertyNames.releaseData());
 }
 
-inline JSValuePtr JSPropertyNameIterator::next(ExecState* exec)
+inline JSValue JSPropertyNameIterator::next(ExecState* exec)
 {
     if (m_position == m_end)
-        return noValue();
+        return JSValue();
 
-    if (m_data->cachedStructure() == m_object->structure() && structureChainsAreEqual(m_data->cachedPrototypeChain(), m_object->structure()->cachedPrototypeChain()))
+    if (m_data->cachedStructure() == m_object->structure() && m_data->cachedPrototypeChain() == m_object->structure()->prototypeChain(exec))
         return jsOwnedString(exec, (*m_position++).ustring());
 
     do {
@@ -108,7 +108,7 @@ inline JSValuePtr JSPropertyNameIterator::next(ExecState* exec)
         m_position++;
     } while (m_position != m_end);
 
-    return noValue();
+    return JSValue();
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 4196822b72..0253fdd2e3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -44,7 +44,7 @@ JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
     return exec->globalThisValue();
 }
 
-void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (symbolTablePut(propertyName, value))
         return;
@@ -52,7 +52,7 @@ void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValu
     ASSERT_NOT_REACHED();
 }
 
-void JSStaticScopeObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSStaticScopeObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     if (symbolTablePutWithAttributes(propertyName, value, attributes))
         return;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index e1400b770d..7e7ce655dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -43,7 +43,7 @@ namespace JSC{
         };
         
     public:
-        JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValuePtr value, unsigned attributes)
+        JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValue value, unsigned attributes)
             : JSVariableObject(exec->globalData().staticScopeStructure, new JSStaticScopeObjectData())
         {
             d()->registerStore = value;
@@ -55,10 +55,10 @@ namespace JSC{
         virtual JSObject* toThisObject(ExecState*) const;
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
-        void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
 
     private:
         JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index e644bf6aed..86f95e0dbd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -30,12 +30,12 @@
 
 namespace JSC {
 
-JSValuePtr JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSString*>(this);
 }
 
-bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     value = this;
     number = m_value.toDouble();
@@ -88,9 +88,13 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     // This function should only be called by JSValue::get.
     if (getStringPropertySlot(exec, propertyName, slot))
         return true;
+    if (propertyName == exec->propertyNames().underscoreProto) {
+        slot.setValue(exec->lexicalGlobalObject()->stringPrototype());
+        return true;
+    }
     slot.setBase(this);
     JSObject* object;
-    for (JSValuePtr prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype->isNull(); prototype = object->prototype()) {
+    for (JSValue prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype.isNull(); prototype = object->prototype()) {
         object = asObject(prototype);
         if (object->getOwnPropertySlot(exec, propertyName, slot))
             return true;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index a584a3c370..900c565768 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -60,7 +60,7 @@ namespace JSC {
 
     class JSString : public JSCell {
         friend class JIT;
-        friend class Interpreter;
+        friend class VPtrSet;
 
     public:
         JSString(JSGlobalData* globalData, const UString& value)
@@ -90,7 +90,7 @@ namespace JSC {
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -99,8 +99,8 @@ namespace JSC {
         {
         }
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual JSObject* toObject(ExecState*) const;
@@ -117,9 +117,9 @@ namespace JSC {
         UString m_value;
     };
 
-    JSString* asString(JSValuePtr);
+    JSString* asString(JSValue);
 
-    inline JSString* asString(JSValuePtr value)
+    inline JSString* asString(JSValue value)
     {
         ASSERT(asCell(value)->isString());
         return static_cast<JSString*>(asCell(value));
@@ -202,6 +202,8 @@ namespace JSC {
         return false;
     }
 
+    inline bool isJSString(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsStringVPtr; }
+
     // --- JSValue inlines ----------------------------
 
     inline JSString* JSValue::toThisJSString(ExecState* exec)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index 73580b0b4b..885914dd82 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -33,18 +33,16 @@ static const double D32 = 4294967296.0;
 // ECMA 9.4
 double JSValue::toInteger(ExecState* exec) const
 {
-    int32_t i;
-    if (getTruncatedInt32(i))
-        return i;
+    if (isInt32Fast())
+        return getInt32Fast();
     double d = toNumber(exec);
     return isnan(d) ? 0.0 : trunc(d);
 }
 
 double JSValue::toIntegerPreserveNaN(ExecState* exec) const
 {
-    int32_t i;
-    if (getTruncatedInt32(i))
-        return i;
+    if (isInt32Fast())
+        return getInt32Fast();
     return trunc(toNumber(exec));
 }
 
@@ -68,11 +66,6 @@ int32_t toInt32SlowCase(double d, bool& ok)
     return static_cast<int32_t>(d32);
 }
 
-int32_t JSValue::toInt32SlowCase(ExecState* exec, bool& ok) const
-{
-    return JSC::toInt32SlowCase(toNumber(exec), ok);
-}
-
 uint32_t toUInt32SlowCase(double d, bool& ok)
 {
     ok = true;
@@ -91,14 +84,4 @@ uint32_t toUInt32SlowCase(double d, bool& ok)
     return static_cast<uint32_t>(d32);
 }
 
-uint32_t JSValue::toUInt32SlowCase(ExecState* exec, bool& ok) const
-{
-    return JSC::toUInt32SlowCase(toNumber(exec), ok);
-}
-
-float JSValue::toFloat(ExecState* exec) const
-{
-    return static_cast<float>(toNumber(exec));
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index f04b67f7ae..391425c752 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -28,12 +28,15 @@
 
 #include "CallData.h"
 #include "ConstructData.h"
-#include <wtf/Noncopyable.h>
+#include <wtf/HashTraits.h>
+#include <wtf/AlwaysInline.h>
 
 namespace JSC {
 
     class Identifier;
     class JSCell;
+    class JSGlobalData;
+    class JSImmediate;
     class JSObject;
     class JSString;
     class PropertySlot;
@@ -45,12 +48,67 @@ namespace JSC {
 
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
 
-    class JSValue : Noncopyable {
-    protected:
-        JSValue() { }
-        virtual ~JSValue() { }
+    typedef void* EncodedJSValue;
+
+    class JSValue {
+        friend class JSImmediate;
+        friend struct JSValueHashTraits;
 
+        static JSValue makeImmediate(intptr_t value)
+        {
+            return JSValue(reinterpret_cast<JSCell*>(value));
+        }
+
+        intptr_t immediateValue()
+        {
+            return reinterpret_cast<intptr_t>(m_ptr);
+        }
+        
     public:
+        enum JSNullTag { JSNull };
+        enum JSUndefinedTag { JSUndefined };
+        enum JSTrueTag { JSTrue };
+        enum JSFalseTag { JSFalse };
+
+        static EncodedJSValue encode(JSValue value);
+        static JSValue decode(EncodedJSValue ptr);
+
+        JSValue();
+        JSValue(JSNullTag);
+        JSValue(JSUndefinedTag);
+        JSValue(JSTrueTag);
+        JSValue(JSFalseTag);
+        JSValue(JSCell* ptr);
+        JSValue(const JSCell* ptr);
+
+        // Numbers
+        JSValue(ExecState*, double);
+        JSValue(ExecState*, char);
+        JSValue(ExecState*, unsigned char);
+        JSValue(ExecState*, short);
+        JSValue(ExecState*, unsigned short);
+        JSValue(ExecState*, int);
+        JSValue(ExecState*, unsigned);
+        JSValue(ExecState*, long);
+        JSValue(ExecState*, unsigned long);
+        JSValue(ExecState*, long long);
+        JSValue(ExecState*, unsigned long long);
+        JSValue(JSGlobalData*, double);
+        JSValue(JSGlobalData*, char);
+        JSValue(JSGlobalData*, unsigned char);
+        JSValue(JSGlobalData*, short);
+        JSValue(JSGlobalData*, unsigned short);
+        JSValue(JSGlobalData*, int);
+        JSValue(JSGlobalData*, unsigned);
+        JSValue(JSGlobalData*, long);
+        JSValue(JSGlobalData*, unsigned long);
+        JSValue(JSGlobalData*, long long);
+        JSValue(JSGlobalData*, unsigned long long);
+
+        operator bool() const;
+        bool operator==(const JSValue other) const;
+        bool operator!=(const JSValue other) const;
+
         // Querying the type.
         bool isUndefined() const;
         bool isNull() const;
@@ -65,7 +123,7 @@ namespace JSC {
         // Extracting the value.
         bool getBoolean(bool&) const;
         bool getBoolean() const; // false if not a boolean
-        double getNumber() const; // NaN if not a number
+        bool getNumber(double&) const;
         double uncheckedGetNumber() const;
         bool getString(UString&) const;
         UString getString() const; // null string if not a string
@@ -80,143 +138,282 @@ namespace JSC {
         bool getTruncatedUInt32(uint32_t&) const;
         
         // Basic conversions.
-        JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
-        bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&);
+        JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+        bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
 
         bool toBoolean(ExecState*) const;
 
         // toNumber conversion is expected to be side effect free if an exception has
         // been set in the ExecState already.
         double toNumber(ExecState*) const;
-        JSValuePtr toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
-
+        JSValue toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
         UString toString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
 
         // Integer conversions.
+        // 'x.numberToInt32(output)' is equivalent to 'x.isNumber() && x.toInt32(output)'
         double toInteger(ExecState*) const;
         double toIntegerPreserveNaN(ExecState*) const;
         int32_t toInt32(ExecState*) const;
         int32_t toInt32(ExecState*, bool& ok) const;
+        bool numberToInt32(int32_t& arg);
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
-
-        // Floating point conversions.
-        float toFloat(ExecState*) const;
+        bool numberToUInt32(uint32_t& arg);
+
+        // Fast integer operations; these values return results where the value is trivially available
+        // in a convenient form, for use in optimizations.  No assumptions should be made based on the
+        // results of these operations, for example !isInt32Fast() does not necessarily indicate the
+        // result of getNumber will not be 0.
+        bool isInt32Fast() const;
+        int32_t getInt32Fast() const;
+        bool isUInt32Fast() const;
+        uint32_t getUInt32Fast() const;
+        static JSValue makeInt32Fast(int32_t);
+        static bool areBothInt32Fast(JSValue, JSValue);
+
+        // Floating point conversions (this is a convenience method for webcore;
+        // signle precision float is not a representation used in JS or JSC).
+        float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
+
+        // API Mangled Numbers
+        bool isAPIMangledNumber();
 
         // Garbage collection.
         void mark();
         bool marked() const;
 
         // Object operations, with the toObject operation included.
-        JSValuePtr get(ExecState*, const Identifier& propertyName) const;
-        JSValuePtr get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
-        JSValuePtr get(ExecState*, unsigned propertyName) const;
-        JSValuePtr get(ExecState*, unsigned propertyName, PropertySlot&) const;
-        void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        void put(ExecState*, unsigned propertyName, JSValuePtr);
-        bool deleteProperty(ExecState*, const Identifier& propertyName);
-        bool deleteProperty(ExecState*, unsigned propertyName);
+        JSValue get(ExecState*, const Identifier& propertyName) const;
+        JSValue get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
+        JSValue get(ExecState*, unsigned propertyName) const;
+        JSValue get(ExecState*, unsigned propertyName, PropertySlot&) const;
+        void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        void put(ExecState*, unsigned propertyName, JSValue);
 
         bool needsThisConversion() const;
         JSObject* toThisObject(ExecState*) const;
         UString toThisString(ExecState*) const;
         JSString* toThisJSString(ExecState*);
 
-        JSValuePtr getJSNumber(); // 0 if this is not a JSNumber or number object
+        static bool equal(ExecState* exec, JSValue v1, JSValue v2);
+        static bool equalSlowCase(ExecState* exec, JSValue v1, JSValue v2);
+        static bool equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqual(JSValue v1, JSValue v2);
+        static bool strictEqualSlowCase(JSValue v1, JSValue v2);
+        static bool strictEqualSlowCaseInline(JSValue v1, JSValue v2);
 
-        JSValuePtr asValue() const;
+        JSValue getJSNumber(); // JSValue() if this is not a JSNumber or number object
 
+        bool isCell() const;
         JSCell* asCell() const;
 
     private:
-        bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-        bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        int32_t toInt32SlowCase(ExecState*, bool& ok) const;
-        uint32_t toUInt32SlowCase(ExecState*, bool& ok) const;
+        enum HashTableDeletedValueTag { HashTableDeletedValue };
+        JSValue(HashTableDeletedValueTag);
+
+        inline const JSValue asValue() const { return *this; }
+
+        bool isDoubleNumber() const;
+        double getDoubleNumber() const;
+
+        JSCell* m_ptr;
     };
 
-    class JSImmediate;
-    class JSValueEncodedAsPointer;
+    struct JSValueHashTraits : HashTraits<EncodedJSValue> {
+        static void constructDeletedValue(EncodedJSValue& slot) { slot = JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+        static bool isDeletedValue(EncodedJSValue value) { return value == JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+    };
 
-    class JSValuePtr {
-        friend class JSImmediate;
+    // Stand-alone helper functions.
+    inline JSValue jsNull()
+    {
+        return JSValue(JSValue::JSNull);
+    }
 
-        static JSValuePtr makeImmediate(intptr_t value)
-        {
-            return JSValuePtr(reinterpret_cast<JSValue*>(value));
-        }
+    inline JSValue jsUndefined()
+    {
+        return JSValue(JSValue::JSUndefined);
+    }
 
-        intptr_t immediateValue()
-        {
-            return reinterpret_cast<intptr_t>(m_ptr);
-        }
-        
-    public:
-        JSValuePtr()
-            : m_ptr(0)
-        {
-        }
+    inline JSValue jsBoolean(bool b)
+    {
+        return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
+    }
 
-        JSValuePtr(JSValue* ptr)
-            : m_ptr(ptr)
-        {
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
+    {
+        return JSValue(exec, d);
+    }
 
-        JSValuePtr(const JSValue* ptr)
-            : m_ptr(const_cast<JSValue*>(ptr))
-        {
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, char i)
+    {
+        return JSValue(exec, i);
+    }
 
-        JSValue* operator->() const
-        {
-            return m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned char i)
+    {
+        return JSValue(exec, i);
+    }
 
-        operator bool() const
-        {
-            return m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, short i)
+    {
+        return JSValue(exec, i);
+    }
 
-        bool operator==(const JSValuePtr other) const
-        {
-            return m_ptr == other.m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned short i)
+    {
+        return JSValue(exec, i);
+    }
 
-        bool operator!=(const JSValuePtr other) const
-        {
-            return m_ptr != other.m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, int i)
+    {
+        return JSValue(exec, i);
+    }
 
-        static JSValueEncodedAsPointer* encode(JSValuePtr value)
-        {
-            return reinterpret_cast<JSValueEncodedAsPointer*>(value.m_ptr);
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned i)
+    {
+        return JSValue(exec, i);
+    }
 
-        static JSValuePtr decode(JSValueEncodedAsPointer* ptr)
-        {
-            return JSValuePtr(reinterpret_cast<JSValue*>(ptr));
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long i)
+    {
+        return JSValue(exec, i);
+    }
 
-    private:
-        JSValue* m_ptr;
-    };
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, double d)
+    {
+        return JSValue(globalData, d);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, char i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned char i)
+    {
+        return JSValue(globalData, i);
+    }
 
-    inline JSValuePtr JSValue::asValue() const
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, short i)
     {
-        return JSValuePtr(this);
+        return JSValue(globalData, i);
     }
 
-    inline JSValuePtr noValue()
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned short i)
     {
-        return JSValuePtr();
+        return JSValue(globalData, i);
     }
 
-    inline bool operator==(const JSValuePtr a, const JSValue* b) { return a == JSValuePtr(b); }
-    inline bool operator==(const JSValue* a, const JSValuePtr b) { return JSValuePtr(a) == b; }
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, int i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long long i)
+    {
+        return JSValue(globalData, i);
+    }
 
-    inline bool operator!=(const JSValuePtr a, const JSValue* b) { return a != JSValuePtr(b); }
-    inline bool operator!=(const JSValue* a, const JSValuePtr b) { return JSValuePtr(a) != b; }
+    inline bool operator==(const JSValue a, const JSCell* b) { return a == JSValue(b); }
+    inline bool operator==(const JSCell* a, const JSValue b) { return JSValue(a) == b; }
+
+    inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
+    inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
+
+    // JSValue member functions.
+    inline EncodedJSValue JSValue::encode(JSValue value)
+    {
+        return reinterpret_cast<EncodedJSValue>(value.m_ptr);
+    }
+
+    inline JSValue JSValue::decode(EncodedJSValue ptr)
+    {
+        return JSValue(reinterpret_cast<JSCell*>(ptr));
+    }
+
+    // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
+    inline JSValue::JSValue()
+        : m_ptr(0)
+    {
+    }
+
+    // 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+        : m_ptr(reinterpret_cast<JSCell*>(0x4))
+    {
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+        : m_ptr(ptr)
+    {
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+        : m_ptr(const_cast<JSCell*>(ptr))
+    {
+    }
+
+    inline JSValue::operator bool() const
+    {
+        return m_ptr;
+    }
+
+    inline bool JSValue::operator==(const JSValue other) const
+    {
+        return m_ptr == other.m_ptr;
+    }
+
+    inline bool JSValue::operator!=(const JSValue other) const
+    {
+        return m_ptr != other.m_ptr;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return asValue() == jsUndefined();
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return asValue() == jsNull();
+    }
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index 9bf5c4f601..b969da5e48 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -46,7 +46,7 @@ namespace JSC {
     public:
         SymbolTable& symbolTable() const { return *d->symbolTable; }
 
-        virtual void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes) = 0;
+        virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
         virtual bool deleteProperty(ExecState*, const Identifier&);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
@@ -90,8 +90,8 @@ namespace JSC {
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        bool symbolTablePut(const Identifier&, JSValuePtr);
-        bool symbolTablePutWithAttributes(const Identifier&, JSValuePtr, unsigned attributes);
+        bool symbolTablePut(const Identifier&, JSValue);
+        bool symbolTablePutWithAttributes(const Identifier&, JSValue, unsigned attributes);
 
         JSVariableObjectData* d;
     };
@@ -117,7 +117,7 @@ namespace JSC {
         return false;
     }
 
-    inline bool JSVariableObject::symbolTablePut(const Identifier& propertyName, JSValuePtr value)
+    inline bool JSVariableObject::symbolTablePut(const Identifier& propertyName, JSValue value)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -130,7 +130,7 @@ namespace JSC {
         return true;
     }
 
-    inline bool JSVariableObject::symbolTablePutWithAttributes(const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+    inline bool JSVariableObject::symbolTablePutWithAttributes(const Identifier& propertyName, JSValue value, unsigned attributes)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
index c791d938f3..fb5701872d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
@@ -29,8 +29,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSWrapperObject);
 void JSWrapperObject::mark() 
 {
     JSObject::mark();
-    if (m_internalValue && !m_internalValue->marked())
-        m_internalValue->mark();
+    if (m_internalValue && !m_internalValue.marked())
+        m_internalValue.mark();
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 4ca96f421c..2a2e3c6ffd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -33,25 +33,24 @@ namespace JSC {
         explicit JSWrapperObject(PassRefPtr<Structure>);
 
     public:
-        JSValuePtr internalValue() const { return m_internalValue; }
-        void setInternalValue(JSValuePtr);
+        JSValue internalValue() const { return m_internalValue; }
+        void setInternalValue(JSValue);
         
         virtual void mark();
         
     private:
-        JSValuePtr m_internalValue;
+        JSValue m_internalValue;
     };
     
     inline JSWrapperObject::JSWrapperObject(PassRefPtr<Structure> structure)
         : JSObject(structure)
-        , m_internalValue(noValue())
     {
     }
     
-    inline void JSWrapperObject::setInternalValue(JSValuePtr value)
+    inline void JSWrapperObject::setInternalValue(JSValue value)
     {
         ASSERT(value);
-        ASSERT(!value->isObject());
+        ASSERT(!value.isObject());
         m_internalValue = value;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
new file mode 100644
index 0000000000..10f9a139ac
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
@@ -0,0 +1,306 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LiteralParser.h"
+
+#include "JSArray.h"
+#include "JSString.h"
+#include <wtf/ASCIICType.h>
+
+namespace JSC {
+
+class LiteralParser::StackGuard {
+public:
+    StackGuard(LiteralParser* parser) 
+        : m_parser(parser)
+    {
+        m_parser->m_depth++;
+    }
+    ~StackGuard()
+    {
+        m_parser->m_depth--;
+    }
+    bool isSafe() { return m_parser->m_depth < 10; }
+private:
+    LiteralParser* m_parser;
+};
+
+static bool isSafeStringCharacter(UChar c)
+{
+    return (c >= ' ' && c <= 0xff && c != '\\') || c == '\t';
+}
+
+LiteralParser::TokenType LiteralParser::Lexer::lex(LiteralParserToken& token)
+{
+    while (m_ptr < m_end && isASCIISpace(*m_ptr))
+        ++m_ptr;
+
+    ASSERT(m_ptr <= m_end);
+    if (m_ptr >= m_end) {
+        token.type = TokEnd;
+        token.start = token.end = m_ptr;
+        return TokEnd;
+    }
+    token.type = TokError;
+    token.start = m_ptr;
+    switch (*m_ptr) {
+        case '[':
+            token.type = TokLBracket;
+            token.end = ++m_ptr;
+            return TokLBracket;
+        case ']':
+            token.type = TokRBracket;
+            token.end = ++m_ptr;
+            return TokRBracket;
+        case '(':
+            token.type = TokLParen;
+            token.end = ++m_ptr;
+            return TokLBracket;
+        case ')':
+            token.type = TokRParen;
+            token.end = ++m_ptr;
+            return TokRBracket;
+        case '{':
+            token.type = TokLBrace;
+            token.end = ++m_ptr;
+            return TokLBrace;
+        case '}':
+            token.type = TokRBrace;
+            token.end = ++m_ptr;
+            return TokRBrace;
+        case ',':
+            token.type = TokComma;
+            token.end = ++m_ptr;
+            return TokComma;
+        case ':':
+            token.type = TokColon;
+            token.end = ++m_ptr;
+            return TokColon;
+        case '"':
+            return lexString(token);
+
+        case '-':
+        case '0':
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            return lexNumber(token);
+    }
+    return TokError;
+}
+
+LiteralParser::TokenType LiteralParser::Lexer::lexString(LiteralParserToken& token)
+{
+    ++m_ptr;
+    while (m_ptr < m_end && isSafeStringCharacter(*m_ptr) && *m_ptr != '"')
+        ++m_ptr;
+    if (m_ptr >= m_end || *m_ptr != '"') {
+        token.type = TokError;
+        token.end = ++m_ptr;
+        return TokError;
+    }
+    token.type = TokString;
+    token.end = ++m_ptr;
+    return TokString;
+}
+
+LiteralParser::TokenType LiteralParser::Lexer::lexNumber(LiteralParserToken& token)
+{
+    // ES5 and json.org define numbers as
+    // number
+    //     int
+    //     int frac? exp?
+    //
+    // int
+    //     -? 0
+    //     -? digit1-9 digits?
+    //
+    // digits
+    //     digit digits?
+    //
+    // -?(0 | [1-9][0-9]*) ('.' [0-9]+)? ([eE][+-]? [0-9]+)?
+
+    if (m_ptr < m_end && *m_ptr == '-') // -?
+        ++m_ptr;
+    
+    // (0 | [1-9][0-9]*)
+    if (m_ptr < m_end && *m_ptr == '0') // 0
+        ++m_ptr;
+    else if (m_ptr < m_end && *m_ptr >= '1' && *m_ptr <= '9') { // [1-9]
+        ++m_ptr;
+        // [0-9]*
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    } else
+        return TokError;
+
+    // ('.' [0-9]+)?
+    if (m_ptr < m_end && *m_ptr == '.') {
+        ++m_ptr;
+        // [0-9]+
+        if (m_ptr >= m_end && !isASCIIDigit(*m_ptr))
+            return TokError;
+
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    }
+
+    //  ([eE][+-]? [0-9]+)?
+    if (m_ptr < m_end && (*m_ptr == 'e' || *m_ptr == 'E')) { // [eE]
+        ++m_ptr;
+
+        // [-+]?
+        if (m_ptr < m_end && (*m_ptr == '-' || *m_ptr == '+'))
+            ++m_ptr;
+
+        // [0-9]+
+        if (m_ptr >= m_end && !isASCIIDigit(*m_ptr))
+            return TokError;
+        
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    }
+    
+    token.type = TokNumber;
+    token.end = m_ptr;
+    return TokNumber;
+}
+
+JSValue LiteralParser::parseStatement()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+
+    switch (m_lexer.currentToken().type) {
+        case TokLBracket:
+        case TokNumber:
+        case TokString:
+            return parseExpression();
+        case TokLParen: {
+            m_lexer.next();
+            JSValue result = parseExpression();
+            if (m_aborted || m_lexer.currentToken().type != TokRParen)
+                return abortParse();
+            m_lexer.next();
+            return result;
+        }
+        default:
+            return abortParse();
+    }
+}
+
+JSValue LiteralParser::parseExpression()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+    switch (m_lexer.currentToken().type) {
+        case TokLBracket:
+            return parseArray();
+        case TokLBrace:
+            return parseObject();
+        case TokString: {
+            Lexer::LiteralParserToken stringToken = m_lexer.currentToken();
+            m_lexer.next();
+            return jsString(m_exec, UString(stringToken.start + 1, stringToken.end - stringToken.start - 2));
+        }
+        case TokNumber: {
+            Lexer::LiteralParserToken numberToken = m_lexer.currentToken();
+            m_lexer.next();
+            return jsNumber(m_exec, UString(numberToken.start, numberToken.end - numberToken.start).toDouble());
+        }
+        default:
+            return JSValue();
+    }
+}
+
+JSValue LiteralParser::parseArray()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+    JSArray* array = constructEmptyArray(m_exec);
+    while (true) {
+        m_lexer.next();
+        JSValue value = parseExpression();
+        if (m_aborted)
+            return JSValue();
+        if (!value)
+            break;
+        array->push(m_exec, value);
+
+        if (m_lexer.currentToken().type != TokComma)
+            break;
+    }
+    if (m_lexer.currentToken().type != TokRBracket)
+        return abortParse();
+
+    m_lexer.next();
+    return array;
+}
+
+JSValue LiteralParser::parseObject()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+    JSObject* object = constructEmptyObject(m_exec);
+    
+    while (m_lexer.next() == TokString) {
+        Lexer::LiteralParserToken identifierToken = m_lexer.currentToken();
+        
+        // Check for colon
+        if (m_lexer.next() != TokColon)
+            return abortParse();
+        m_lexer.next();
+        
+        JSValue value = parseExpression();
+        if (!value || m_aborted)
+            return abortParse();
+        
+        Identifier ident(m_exec, identifierToken.start + 1, identifierToken.end - identifierToken.start - 2);
+        object->putDirect(ident, value);
+        
+        if (m_lexer.currentToken().type != TokComma)
+            break;
+    }
+    
+    if (m_lexer.currentToken().type != TokRBrace)
+        return abortParse();
+    m_lexer.next();
+    return object;
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h
new file mode 100644
index 0000000000..a72e3d08c4
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LiteralParser_h
+#define LiteralParser_h
+
+#include "JSGlobalObjectFunctions.h"
+#include "JSValue.h"
+#include "UString.h"
+
+namespace JSC {
+
+    class LiteralParser {
+    public:
+        LiteralParser(ExecState* exec, const UString& s)
+            : m_exec(exec)
+            , m_lexer(s)
+            , m_depth(0)
+            , m_aborted(false)
+        {
+        }
+        
+        JSValue tryLiteralParse()
+        {
+            m_lexer.next();
+            JSValue result = parseStatement();
+            if (m_aborted || m_lexer.currentToken().type != TokEnd)
+                return JSValue();
+            return result;
+        }
+    private:
+        
+        enum TokenType { TokLBracket, TokRBracket, TokLBrace, TokRBrace, 
+                         TokString, TokIdentifier, TokNumber, TokColon, 
+                         TokLParen, TokRParen, TokComma, TokEnd, TokError };
+
+        class Lexer {
+        public:
+            struct LiteralParserToken {
+                TokenType type;
+                const UChar* start;
+                const UChar* end;
+            };
+            Lexer(const UString& s)
+                : m_string(s)
+                , m_ptr(s.data())
+                , m_end(s.data() + s.size())
+            {
+            }
+            
+            TokenType next()
+            {
+                return lex(m_currentToken);
+            }
+            
+            const LiteralParserToken& currentToken()
+            {
+                return m_currentToken;
+            }
+            
+        private:
+            TokenType lex(LiteralParserToken&);
+            TokenType lexString(LiteralParserToken&);
+            TokenType lexNumber(LiteralParserToken&);
+            LiteralParserToken m_currentToken;
+            UString m_string;
+            const UChar* m_ptr;
+            const UChar* m_end;
+        };
+        
+        class StackGuard;
+        JSValue parseStatement();
+        JSValue parseExpression();
+        JSValue parseArray();
+        JSValue parseObject();
+
+        JSValue abortParse()
+        {
+            m_aborted = true;
+            return JSValue();
+        }
+
+        ExecState* m_exec;
+        LiteralParser::Lexer m_lexer;
+        int m_depth;
+        bool m_aborted;
+    };
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
index 98133a8a04..8359ff7f66 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
@@ -20,25 +20,13 @@
 #include "config.h"
 #include "Lookup.h"
 
+#include "JSFunction.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
 
 void HashTable::createTable(JSGlobalData* globalData) const
 {
-#if ENABLE(PERFECT_HASH_SIZE)
-    ASSERT(!table);
-    HashEntry* entries = new HashEntry[hashSizeMask + 1];
-    for (int i = 0; i <= hashSizeMask; ++i)
-        entries[i].setKey(0);
-    for (int i = 0; values[i].key; ++i) {
-        UString::Rep* identifier = Identifier::add(globalData, values[i].key).releaseRef();
-        int hashIndex = identifier->computedHash() & hashSizeMask;
-        ASSERT(!entries[hashIndex].key());
-        entries[hashIndex].initialize(identifier, values[i].attributes, values[i].value1, values[i].value2);
-    }
-    table = entries;
-#else
     ASSERT(!table);
     int linkIndex = compactHashSizeMask + 1;
     HashEntry* entries = new HashEntry[compactSize];
@@ -61,17 +49,12 @@ void HashTable::createTable(JSGlobalData* globalData) const
         entry->initialize(identifier, values[i].attributes, values[i].value1, values[i].value2);
     }
     table = entries;
-#endif
 }
 
 void HashTable::deleteTable() const
 {
     if (table) {
-#if ENABLE(PERFECT_HASH_SIZE)
-        int max = hashSizeMask + 1;
-#else
         int max = compactSize;
-#endif
         for (int i = 0; i != max; ++i) {
             if (UString::Rep* key = table[i].key())
                 key->deref();
@@ -84,11 +67,12 @@ void HashTable::deleteTable() const
 void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject* thisObj, const Identifier& propertyName, PropertySlot& slot)
 {
     ASSERT(entry->attributes() & Function);
-    JSValuePtr* location = thisObj->getDirectLocation(propertyName);
+    JSValue* location = thisObj->getDirectLocation(propertyName);
 
     if (!location) {
-        PrototypeFunction* function = new (exec) PrototypeFunction(exec, entry->functionLength(), propertyName, entry->function());
-        thisObj->putDirect(propertyName, function, entry->attributes());
+        InternalFunction* function = new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), entry->functionLength(), propertyName, entry->function());
+
+        thisObj->putDirectFunction(propertyName, function, entry->attributes());
         location = thisObj->getDirectLocation(propertyName);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index 55c3221b0f..3b7353d1bb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -23,17 +23,12 @@
 
 #include "CallFrame.h"
 #include "Identifier.h"
-#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
 #include "PropertySlot.h"
 #include <stdio.h>
 #include <wtf/Assertions.h>
 
-// Set ENABLE_PERFECT_HASH_SIZE to 0 to save memory at the
-// cost of speed.  Test your platform as results may vary.
-#define ENABLE_PERFECT_HASH_SIZE 1
-
 namespace JSC {
 
     // Hash table generated by the create_hash_table script.
@@ -45,9 +40,9 @@ namespace JSC {
     };
 
     // FIXME: There is no reason this get function can't be simpler.
-    // ie. typedef JSValuePtr (*GetFunction)(ExecState*, JSObject* baseObject)
+    // ie. typedef JSValue (*GetFunction)(ExecState*, JSObject* baseObject)
     typedef PropertySlot::GetValueFunc GetFunction;
-    typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValuePtr value);
+    typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
     class HashEntry {
     public:
@@ -57,9 +52,7 @@ namespace JSC {
             m_attributes = attributes;
             m_u.store.value1 = v1;
             m_u.store.value2 = v2;
-#if !ENABLE(PERFECT_HASH_SIZE)
             m_next = 0;
-#endif
         }
 
         void setKey(UString::Rep* key) { m_key = key; }
@@ -75,10 +68,8 @@ namespace JSC {
 
         intptr_t lexerValue() const { ASSERT(!m_attributes); return m_u.lexer.value; }
 
-#if !ENABLE(PERFECT_HASH_SIZE)
         void setNext(HashEntry *next) { m_next = next; }
         HashEntry* next() const { return m_next; }
-#endif
 
     private:
         UString::Rep* m_key;
@@ -103,18 +94,14 @@ namespace JSC {
             } lexer;
         } m_u;
 
-#if !ENABLE(PERFECT_HASH_SIZE)
         HashEntry* m_next;
-#endif
     };
 
     struct HashTable {
-#if ENABLE(PERFECT_HASH_SIZE)
-        int hashSizeMask; // Precomputed size for the hash table (minus 1).
-#else
+
         int compactSize;
         int compactHashSizeMask;
-#endif
+
         const HashTableValue* values; // Fixed values generated by script.
         mutable const HashEntry* table; // Table allocated at runtime.
 
@@ -148,13 +135,6 @@ namespace JSC {
     private:
         ALWAYS_INLINE const HashEntry* entry(const Identifier& identifier) const
         {
-#if ENABLE(PERFECT_HASH_SIZE)
-            ASSERT(table);
-            const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & hashSizeMask];
-            if (entry->key() != identifier.ustring().rep())
-                return 0;
-            return entry;
-#else
             ASSERT(table);
 
             const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & compactHashSizeMask];
@@ -169,7 +149,6 @@ namespace JSC {
             } while (entry);
 
             return 0;
-#endif
         }
 
         // Convert the hash table keys to identifiers.
@@ -243,16 +222,19 @@ namespace JSC {
      * is found it sets the value and returns true, else it returns false.
      */
     template <class ThisImp>
-    inline bool lookupPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, const HashTable* table, ThisImp* thisObj)
+    inline bool lookupPut(ExecState* exec, const Identifier& propertyName, JSValue value, const HashTable* table, ThisImp* thisObj)
     {
         const HashEntry* entry = table->entry(exec, propertyName);
 
         if (!entry)
             return false;
 
-        if (entry->attributes() & Function) // function: put as override property
-            thisObj->putDirect(propertyName, value);
-        else if (!(entry->attributes() & ReadOnly))
+        if (entry->attributes() & Function) { // function: put as override property
+            if (LIKELY(value.isCell()))
+                thisObj->putDirectFunction(propertyName, value.asCell());
+            else
+                thisObj->putDirect(propertyName, value);
+        } else if (!(entry->attributes() & ReadOnly))
             entry->propertyPutter()(exec, thisObj, value);
 
         return true;
@@ -265,7 +247,7 @@ namespace JSC {
      * then it calls put() on the ParentImp class.
      */
     template <class ThisImp, class ParentImp>
-    inline void lookupPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, const HashTable* table, ThisImp* thisObj, PutPropertySlot& slot)
+    inline void lookupPut(ExecState* exec, const Identifier& propertyName, JSValue value, const HashTable* table, ThisImp* thisObj, PutPropertySlot& slot)
     {
         if (!lookupPut<ThisImp>(exec, propertyName, value, table, thisObj))
             thisObj->ParentImp::put(exec, propertyName, value, slot); // not found: forward to parent
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
index 5bec2e659f..2572bc9ac0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
@@ -27,29 +27,30 @@
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/RandomNumber.h>
+#include <wtf/RandomNumberSeed.h>
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(MathObject);
 
-static JSValuePtr mathProtoFuncAbs(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncACos(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncASin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncATan(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncATan2(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncCeil(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncCos(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncExp(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncFloor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncLog(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncMax(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncMin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncPow(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncRandom(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncRound(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncSin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncSqrt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncTan(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncMin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -95,6 +96,7 @@ MathObject::MathObject(ExecState* exec, PassRefPtr<Structure> structure)
     putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(exec, piDouble), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(exec, sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(exec, sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
+    WTF::initializeWeakRandomNumberGenerator();
 }
 
 // ECMA 15.8
@@ -113,62 +115,62 @@ bool MathObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
 
 // ------------------------------ Functions --------------------------------
 
-JSValuePtr mathProtoFuncAbs(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, fabs(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, fabs(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncACos(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, acos(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, acos(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncASin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, asin(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, asin(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncATan(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, atan(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncATan2(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan2(args.at(exec, 0)->toNumber(exec), args.at(exec, 1)->toNumber(exec)));
+    return jsNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncCeil(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, ceil(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, ceil(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncCos(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, cos(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, cos(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncExp(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, exp(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, exp(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncFloor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, floor(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, floor(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncLog(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, log(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, log(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncMax(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     unsigned argsCount = args.size();
     double result = -Inf;
     for (unsigned k = 0; k < argsCount; ++k) {
-        double val = args.at(exec, k)->toNumber(exec);
+        double val = args.at(k).toNumber(exec);
         if (isnan(val)) {
             result = NaN;
             break;
@@ -179,12 +181,12 @@ JSValuePtr mathProtoFuncMax(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsNumber(exec, result);
 }
 
-JSValuePtr mathProtoFuncMin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncMin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     unsigned argsCount = args.size();
     double result = +Inf;
     for (unsigned k = 0; k < argsCount; ++k) {
-        double val = args.at(exec, k)->toNumber(exec);
+        double val = args.at(k).toNumber(exec);
         if (isnan(val)) {
             result = NaN;
             break;
@@ -195,12 +197,12 @@ JSValuePtr mathProtoFuncMin(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsNumber(exec, result);
 }
 
-JSValuePtr mathProtoFuncPow(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     // ECMA 15.8.2.1.13
 
-    double arg = args.at(exec, 0)->toNumber(exec);
-    double arg2 = args.at(exec, 1)->toNumber(exec);
+    double arg = args.at(0).toNumber(exec);
+    double arg2 = args.at(1).toNumber(exec);
 
     if (isnan(arg2))
         return jsNaN(exec);
@@ -209,32 +211,32 @@ JSValuePtr mathProtoFuncPow(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsNumber(exec, pow(arg, arg2));
 }
 
-JSValuePtr mathProtoFuncRandom(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, WTF::randomNumber());
+    return jsNumber(exec, WTF::weakRandomNumber());
 }
 
-JSValuePtr mathProtoFuncRound(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    double arg = args.at(exec, 0)->toNumber(exec);
+    double arg = args.at(0).toNumber(exec);
     if (signbit(arg) && arg >= -0.5)
          return jsNumber(exec, -0.0);
     return jsNumber(exec, floor(arg + 0.5));
 }
 
-JSValuePtr mathProtoFuncSin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sin(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, sin(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sqrt(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, sqrt(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncTan(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, tan(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, tan(args.at(0).toNumber(exec)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index d6163fdb3a..3557d1ecaa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index 3d043e9964..0205fc55d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -33,7 +33,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
 
 NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, PassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name)->getString()))
+    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString()))
     , m_errorStructure(ErrorInstance::createStructure(nativeErrorPrototype))
 {
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
@@ -43,8 +43,8 @@ NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, PassRefPtr<Struc
 ErrorInstance* NativeErrorConstructor::construct(ExecState* exec, const ArgList& args)
 {
     ErrorInstance* object = new (exec) ErrorInstance(m_errorStructure);
-    if (!args.at(exec, 0)->isUndefined())
-        object->putDirect(exec->propertyNames().message, jsString(exec, args.at(exec, 0)->toString(exec)));
+    if (!args.at(0).isUndefined())
+        object->putDirect(exec->propertyNames().message, jsString(exec, args.at(0).toString(exec)));
     return object;
 }
 
@@ -58,8 +58,8 @@ ConstructType NativeErrorConstructor::getConstructData(ConstructData& constructD
     constructData.native.function = constructWithNativeErrorConstructor;
     return ConstructTypeHost;
 }
-
-static JSValuePtr callNativeErrorConstructor(ExecState* exec, JSObject* constructor, JSValuePtr, const ArgList& args)
+    
+static JSValue JSC_HOST_CALL callNativeErrorConstructor(ExecState* exec, JSObject* constructor, JSValue, const ArgList& args)
 {
     return static_cast<NativeErrorConstructor*>(constructor)->construct(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeFunctionWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeFunctionWrapper.h
new file mode 100644
index 0000000000..d4eeb3bd06
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeFunctionWrapper.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef NativeFunctionWrapper_h
+#define NativeFunctionWrapper_h
+
+namespace JSC {
+#if ENABLE(JIT) && ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
+    class JSFunction;
+    typedef JSFunction NativeFunctionWrapper;
+#else
+    class PrototypeFunction;
+    typedef PrototypeFunction NativeFunctionWrapper;
+#endif
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
index 0da4d69f2f..2840bf0b2c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -29,11 +29,11 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberConstructor);
 
-static JSValuePtr numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
 
 } // namespace JSC
 
@@ -68,36 +68,36 @@ bool NumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNaN(exec);
 }
 
-JSValuePtr numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, -Inf);
+    return jsNumber(exec, -Inf);
 }
 
-JSValuePtr numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, Inf);
+    return jsNumber(exec, Inf);
 }
 
-JSValuePtr numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, 1.7976931348623157E+308);
+    return jsNumber(exec, 1.7976931348623157E+308);
 }
 
-JSValuePtr numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, 5E-324);
+    return jsNumber(exec, 5E-324);
 }
 
 // ECMA 15.7.1
 static JSObject* constructWithNumberConstructor(ExecState* exec, JSObject*, const ArgList& args)
 {
     NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
-    double n = args.isEmpty() ? 0 : args.at(exec, 0)->toNumber(exec);
+    double n = args.isEmpty() ? 0 : args.at(0).toNumber(exec);
     object->setInternalValue(jsNumber(exec, n));
     return object;
 }
@@ -109,9 +109,9 @@ ConstructType NumberConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.7.2
-static JSValuePtr callNumberConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callNumberConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, args.isEmpty() ? 0 : args.at(exec, 0)->toNumber(exec));
+    return jsNumber(exec, args.isEmpty() ? 0 : args.at(0).toNumber(exec));
 }
 
 CallType NumberConstructor::getCallData(CallData& callData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index 070be5f25e..b1224ec552 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -32,11 +32,11 @@ namespace JSC {
         NumberConstructor(ExecState*, PassRefPtr<Structure>, NumberPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        JSValuePtr getValueProperty(ExecState*, int token) const;
+        JSValue getValueProperty(ExecState*, int token) const;
 
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp
index 6613390c4b..0e8df1730f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp
@@ -36,23 +36,16 @@ NumberObject::NumberObject(PassRefPtr<Structure> structure)
 {
 }
 
-JSValuePtr NumberObject::getJSNumber()
+JSValue NumberObject::getJSNumber()
 {
     return internalValue();
 }
 
-NumberObject* constructNumber(ExecState* exec, JSNumberCell* number)
+NumberObject* constructNumber(ExecState* exec, JSValue number)
 {
     NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
     object->setInternalValue(number);
     return object;
 }
 
-NumberObject* constructNumberFromImmediateNumber(ExecState* exec, JSValuePtr value)
-{
-    NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
-    object->setInternalValue(value);
-    return object;
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index 8cc27158fb..d354b9b8a2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -25,8 +25,6 @@
 
 namespace JSC {
 
-    class JSNumberCell;
-
     class NumberObject : public JSWrapperObject {
     public:
         explicit NumberObject(PassRefPtr<Structure>);
@@ -36,11 +34,10 @@ namespace JSC {
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
     };
 
-    NumberObject* constructNumber(ExecState*, JSNumberCell*);
-    NumberObject* constructNumberFromImmediateNumber(ExecState*, JSValuePtr);
+    NumberObject* constructNumber(ExecState*, JSValue);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
index 8b45f5401c..947324c6ac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -23,6 +23,7 @@
 #include "NumberPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "PrototypeFunction.h"
 #include "dtoa.h"
@@ -35,12 +36,12 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberPrototype);
 
-static JSValuePtr numberProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToFixed(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToExponential(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToPrecision(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.7.4
 
@@ -51,12 +52,12 @@ NumberPrototype::NumberPrototype(ExecState* exec, PassRefPtr<Structure> structur
 
     // The constructor will be added later, after NumberConstructor has been constructed
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
@@ -67,7 +68,8 @@ static UString integerPartNoExp(double d)
 {
     int decimalPoint;
     int sign;
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     bool resultIsInfOrNan = (decimalPoint == 9999);
     size_t length = strlen(result);
 
@@ -80,17 +82,16 @@ static UString integerPartNoExp(double d)
         Vector<char, 1024> buf(decimalPoint + 1);
 
         if (static_cast<int>(length) <= decimalPoint) {
-            strcpy(buf.data(), result);
+            ASSERT(decimalPoint < 1024);
+            memcpy(buf.data(), result, length);
             memset(buf.data() + length, '0', decimalPoint - length);
         } else
             strncpy(buf.data(), result, decimalPoint);
-
         buf[decimalPoint] = '\0';
+
         str.append(buf.data());
     }
 
-    WTF::freedtoa(result);
-
     return str;
 }
 
@@ -133,15 +134,15 @@ static double intPow10(int e)
     return static_cast<double>(result);
 }
 
-JSValuePtr numberProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double radixAsDouble = args.at(exec, 0)->toInteger(exec); // nan -> 0
-    if (radixAsDouble == 10 || args.at(exec, 0)->isUndefined())
-        return jsString(exec, v->toString(exec));
+    double radixAsDouble = args.at(0).toInteger(exec); // nan -> 0
+    if (radixAsDouble == 10 || args.at(0).isUndefined())
+        return jsString(exec, v.toString(exec));
 
     if (radixAsDouble < 2 || radixAsDouble > 36)
         return throwError(exec, RangeError, "toString() radix argument must be between 2 and 36");
@@ -153,7 +154,7 @@ JSValuePtr numberProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVa
     // unless someone finds a precise rule.
     char s[2048 + 3];
     const char* lastCharInString = s + sizeof(s) - 1;
-    double x = v->uncheckedGetNumber();
+    double x = v.uncheckedGetNumber();
     if (isnan(x) || isinf(x))
         return jsString(exec, UString::from(x));
 
@@ -197,39 +198,39 @@ JSValuePtr numberProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsString(exec, startOfResultString);
 }
 
-JSValuePtr numberProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     // FIXME: Not implemented yet.
 
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    return jsString(exec, v->toString(exec));
+    return jsString(exec, v.toString(exec));
 }
 
-JSValuePtr numberProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
     return v;
 }
 
-JSValuePtr numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    JSValuePtr fractionDigits = args.at(exec, 0);
-    double df = fractionDigits->toInteger(exec);
+    JSValue fractionDigits = args.at(0);
+    double df = fractionDigits.toInteger(exec);
     if (!(df >= 0 && df <= 20))
         return throwError(exec, RangeError, "toFixed() digits argument must be between 0 and 20");
     int f = static_cast<int>(df);
 
-    double x = v->uncheckedGetNumber();
+    double x = v.uncheckedGetNumber();
     if (isnan(x))
         return jsNontrivialString(exec, "NaN");
 
@@ -277,7 +278,8 @@ static void fractionalPartToString(char* buf, int& i, const char* result, int re
             strncpy(buf + i, result + 1, fractionalDigits);
             i += fractionalDigits;
         } else {
-            strcpy(buf + i, result + 1);
+            ASSERT(i + resultLength - 1 < 80);
+            memcpy(buf + i, result + 1, resultLength - 1);
             i += static_cast<int>(resultLength) - 1;
         }
     }
@@ -302,23 +304,23 @@ static void exponentialPartToString(char* buf, int& i, int decimalPoint)
     buf[i++] = static_cast<char>('0' + exponential % 10);
 }
 
-JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double x = v->uncheckedGetNumber();
+    double x = v.uncheckedGetNumber();
 
     if (isnan(x) || isinf(x))
         return jsString(exec, UString::from(x));
 
-    JSValuePtr fractionalDigitsValue = args.at(exec, 0);
-    double df = fractionalDigitsValue->toInteger(exec);
+    JSValue fractionalDigitsValue = args.at(0);
+    double df = fractionalDigitsValue.toInteger(exec);
     if (!(df >= 0 && df <= 20))
         return throwError(exec, RangeError, "toExponential() argument must between 0 and 20");
     int fractionalDigits = static_cast<int>(df);
-    bool includeAllDigits = fractionalDigitsValue->isUndefined();
+    bool includeAllDigits = fractionalDigitsValue.isUndefined();
 
     int decimalAdjust = 0;
     if (x && !includeAllDigits) {
@@ -344,7 +346,8 @@ JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr t
 
     int decimalPoint;
     int sign;
-    char* result = WTF::dtoa(x, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, x, 0, &decimalPoint, &sign, NULL);
     size_t resultLength = strlen(result);
     decimalPoint += decimalAdjust;
 
@@ -353,9 +356,12 @@ JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr t
     if (sign)
         buf[i++] = '-';
 
-    if (decimalPoint == 999) // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
-        strcpy(buf + i, result);
-    else {
+    // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
+    if (decimalPoint == 999) {
+        ASSERT(i + resultLength < 80);
+        memcpy(buf + i, result, resultLength);
+        buf[i + resultLength] = '\0';
+    } else {
         buf[i++] = result[0];
 
         if (includeAllDigits)
@@ -367,21 +373,19 @@ JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr t
     }
     ASSERT(i <= 80);
 
-    WTF::freedtoa(result);
-
     return jsString(exec, buf);
 }
 
-JSValuePtr numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double doublePrecision = args.at(exec, 0)->toIntegerPreserveNaN(exec);
-    double x = v->uncheckedGetNumber();
-    if (args.at(exec, 0)->isUndefined() || isnan(x) || isinf(x))
-        return jsString(exec, v->toString(exec));
+    double doublePrecision = args.at(0).toIntegerPreserveNaN(exec);
+    double x = v.uncheckedGetNumber();
+    if (args.at(0).isUndefined() || isnan(x) || isinf(x))
+        return jsString(exec, v.toString(exec));
 
     UString s;
     if (x < 0) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index ff97ca4b1b..cf1790f061 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ObjectConstructor.h"
 
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "ObjectPrototype.h"
 
@@ -41,10 +42,10 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, PassRefPtr<Structure> stru
 // ECMA 15.2.2
 static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr arg = args.at(exec, 0);
-    if (arg->isUndefinedOrNull())
+    JSValue arg = args.at(0);
+    if (arg.isUndefinedOrNull())
         return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
-    return arg->toObject(exec);
+    return arg.toObject(exec);
 }
 
 static JSObject* constructWithObjectConstructor(ExecState* exec, JSObject*, const ArgList& args)
@@ -58,7 +59,7 @@ ConstructType ObjectConstructor::getConstructData(ConstructData& constructData)
     return ConstructTypeHost;
 }
 
-static JSValuePtr callObjectConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callObjectConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructObject(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
index 696570b458..98e4713188 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -22,6 +22,7 @@
 #include "ObjectPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "PrototypeFunction.h"
 
@@ -29,58 +30,58 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ObjectPrototype);
 
-static JSValuePtr objectProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncHasOwnProperty(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncIsPrototypeOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncDefineGetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncDefineSetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncLookupGetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncLookupSetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncPropertyIsEnumerable(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 ObjectPrototype::ObjectPrototype(ExecState* exec, PassRefPtr<Structure> stucture, Structure* prototypeFunctionStructure)
     : JSObject(stucture)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
 
     // Mozilla extensions
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
 }
 
 // ------------------------------ Functions --------------------------------
 
 // ECMA 15.2.4.2, 15.2.4.4, 15.2.4.5, 15.2.4.7
 
-JSValuePtr objectProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return thisValue->toThisObject(exec);
+    return thisValue.toThisObject(exec);
 }
 
-JSValuePtr objectProtoFuncHasOwnProperty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return jsBoolean(thisValue->toThisObject(exec)->hasOwnProperty(exec, Identifier(exec, args.at(exec, 0)->toString(exec))));
+    return jsBoolean(thisValue.toThisObject(exec)->hasOwnProperty(exec, Identifier(exec, args.at(0).toString(exec))));
 }
 
-JSValuePtr objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    if (!args.at(exec, 0)->isObject())
+    if (!args.at(0).isObject())
         return jsBoolean(false);
 
-    JSValuePtr v = asObject(args.at(exec, 0))->prototype();
+    JSValue v = asObject(args.at(0))->prototype();
 
     while (true) {
-        if (!v->isObject())
+        if (!v.isObject())
             return jsBoolean(false);
         if (v == thisObj)
             return jsBoolean(true);
@@ -88,47 +89,47 @@ JSValuePtr objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValuePtr t
     }
 }
 
-JSValuePtr objectProtoFuncDefineGetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    if (args.at(exec, 1)->getCallData(callData) == CallTypeNone)
+    if (args.at(1).getCallData(callData) == CallTypeNone)
         return throwError(exec, SyntaxError, "invalid getter usage");
-    thisValue->toThisObject(exec)->defineGetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)), asObject(args.at(exec, 1)));
+    thisValue.toThisObject(exec)->defineGetter(exec, Identifier(exec, args.at(0).toString(exec)), asObject(args.at(1)));
     return jsUndefined();
 }
 
-JSValuePtr objectProtoFuncDefineSetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    if (args.at(exec, 1)->getCallData(callData) == CallTypeNone)
+    if (args.at(1).getCallData(callData) == CallTypeNone)
         return throwError(exec, SyntaxError, "invalid setter usage");
-    thisValue->toThisObject(exec)->defineSetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)), asObject(args.at(exec, 1)));
+    thisValue.toThisObject(exec)->defineSetter(exec, Identifier(exec, args.at(0).toString(exec)), asObject(args.at(1)));
     return jsUndefined();
 }
 
-JSValuePtr objectProtoFuncLookupGetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return thisValue->toThisObject(exec)->lookupGetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return thisValue.toThisObject(exec)->lookupGetter(exec, Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr objectProtoFuncLookupSetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return thisValue->toThisObject(exec)->lookupSetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return thisValue.toThisObject(exec)->lookupSetter(exec, Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr objectProtoFuncPropertyIsEnumerable(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return jsBoolean(thisValue->toThisObject(exec)->propertyIsEnumerable(exec, Identifier(exec, args.at(exec, 0)->toString(exec))));
+    return jsBoolean(thisValue.toThisObject(exec)->propertyIsEnumerable(exec, Identifier(exec, args.at(0).toString(exec))));
 }
 
-JSValuePtr objectProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return thisValue->toThisJSString(exec);
+    return thisValue.toThisJSString(exec);
 }
 
-JSValuePtr objectProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return jsNontrivialString(exec, "[object " + thisValue->toThisObject(exec)->className() + "]");
+    return jsNontrivialString(exec, "[object " + thisValue.toThisObject(exec)->className() + "]");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
index 1c432fe27b..7790ae0909 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
@@ -30,7 +30,7 @@ namespace JSC {
         ObjectPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
     };
 
-    JSValuePtr objectProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
index 6f843030fb..093bbecf38 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
@@ -35,41 +35,87 @@
 
 namespace JSC {
 
-// ECMA 11.9.3
-bool equal(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
+bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
 {
-    if (JSImmediate::areBothImmediateNumbers(v1, v2))
-        return v1 == v2;
-
     return equalSlowCaseInline(exec, v1, v2);
 }
 
-bool equalSlowCase(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
+bool JSValue::strictEqualSlowCase(JSValue v1, JSValue v2)
 {
-    return equalSlowCaseInline(exec, v1, v2);
+    return strictEqualSlowCaseInline(v1, v2);
 }
 
-bool strictEqual(JSValuePtr v1, JSValuePtr v2)
+NEVER_INLINE JSValue throwOutOfMemoryError(ExecState* exec)
 {
-    if (JSImmediate::areBothImmediate(v1, v2))
-        return v1 == v2;
+    JSObject* error = Error::create(exec, GeneralError, "Out of memory");
+    exec->setException(error);
+    return error;
+}
 
-    if (JSImmediate::isEitherImmediate(v1, v2) & (v1 != JSImmediate::from(0)) & (v2 != JSImmediate::from(0)))
-        return false;
+NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
+{
+    // exception for the Date exception in defaultValue()
+    JSValue p1 = v1.toPrimitive(callFrame);
+    JSValue p2 = v2.toPrimitive(callFrame);
 
-    return strictEqualSlowCaseInline(v1, v2);
+    if (p1.isString() || p2.isString()) {
+        RefPtr<UString::Rep> value = concatenate(p1.toString(callFrame).rep(), p2.toString(callFrame).rep());
+        if (!value)
+            return throwOutOfMemoryError(callFrame);
+        return jsString(callFrame, value.release());
+    }
+
+    return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
 
-bool strictEqualSlowCase(JSValuePtr v1, JSValuePtr v2)
+JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v)
 {
-    return strictEqualSlowCaseInline(v1, v2);
+    if (v.isUndefined())
+        return jsNontrivialString(callFrame, "undefined");
+    if (v.isBoolean())
+        return jsNontrivialString(callFrame, "boolean");
+    if (v.isNumber())
+        return jsNontrivialString(callFrame, "number");
+    if (v.isString())
+        return jsNontrivialString(callFrame, "string");
+    if (v.isObject()) {
+        // Return "undefined" for objects that should be treated
+        // as null when doing comparisons.
+        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
+            return jsNontrivialString(callFrame, "undefined");
+        CallData callData;
+        if (asObject(v)->getCallData(callData) != CallTypeNone)
+            return jsNontrivialString(callFrame, "function");
+    }
+    return jsNontrivialString(callFrame, "object");
 }
 
-NEVER_INLINE JSValuePtr throwOutOfMemoryError(ExecState* exec)
+bool jsIsObjectType(JSValue v)
 {
-    JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-    exec->setException(error);
-    return error;
+    if (!v.isCell())
+        return v.isNull();
+
+    JSType type = asCell(v)->structure()->typeInfo().type();
+    if (type == NumberType || type == StringType)
+        return false;
+    if (type == ObjectType) {
+        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
+            return false;
+        CallData callData;
+        if (asObject(v)->getCallData(callData) != CallTypeNone)
+            return false;
+    }
+    return true;
+}
+
+bool jsIsFunctionType(JSValue v)
+{
+    if (v.isObject()) {
+        CallData callData;
+        if (asObject(v)->getCallData(callData) != CallTypeNone)
+            return true;
+    }
+    return false;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index f627c52102..acfc6c23e6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -22,116 +22,313 @@
 #ifndef Operations_h
 #define Operations_h
 
+#include "Interpreter.h"
 #include "JSImmediate.h"
 #include "JSNumberCell.h"
 #include "JSString.h"
 
 namespace JSC {
 
-  // ECMA 11.9.3
-  bool equal(ExecState*, JSValuePtr, JSValuePtr);
-  bool equalSlowCase(ExecState*, JSValuePtr, JSValuePtr);
-
-  ALWAYS_INLINE bool equalSlowCaseInline(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
-  {
-      ASSERT(!JSImmediate::areBothImmediateNumbers(v1, v2));
-
-      do {
-          if (v1->isNumber() && v2->isNumber())
-              return v1->uncheckedGetNumber() == v2->uncheckedGetNumber();
-
-          bool s1 = v1->isString();
-          bool s2 = v2->isString();
-          if (s1 && s2)
-              return asString(v1)->value() == asString(v2)->value();
-
-          if (v1->isUndefinedOrNull()) {
-              if (v2->isUndefinedOrNull())
-                  return true;
-              if (JSImmediate::isImmediate(v2))
-                  return false;
-              return v2->asCell()->structure()->typeInfo().masqueradesAsUndefined();
-          }
-
-          if (v2->isUndefinedOrNull()) {
-              if (JSImmediate::isImmediate(v1))
-                  return false;
-              return v1->asCell()->structure()->typeInfo().masqueradesAsUndefined();
-          }
-
-          if (v1->isObject()) {
-              if (v2->isObject())
-                  return v1 == v2;
-              JSValuePtr p1 = v1->toPrimitive(exec);
-              if (exec->hadException())
-                  return false;
-              v1 = p1;
-              if (JSImmediate::areBothImmediateNumbers(v1, v2))
-                  return v1 == v2;
-              continue;
-          }
-
-          if (v2->isObject()) {
-              JSValuePtr p2 = v2->toPrimitive(exec);
-              if (exec->hadException())
-                  return false;
-              v2 = p2;
-              if (JSImmediate::areBothImmediateNumbers(v1, v2))
-                  return v1 == v2;
-              continue;
-          }
-
-          if (s1 || s2) {
-              double d1 = v1->toNumber(exec);
-              double d2 = v2->toNumber(exec);
-              return d1 == d2;
-          }
-
-          if (v1->isBoolean()) {
-              if (v2->isNumber())
-                  return static_cast<double>(v1->getBoolean()) == v2->uncheckedGetNumber();
-          } else if (v2->isBoolean()) {
-              if (v1->isNumber())
-                  return v1->uncheckedGetNumber() == static_cast<double>(v2->getBoolean());
-          }
-
-          return v1 == v2;
-      } while (true);
-  }
-
-
-  bool strictEqual(JSValuePtr, JSValuePtr);
-  bool strictEqualSlowCase(JSValuePtr, JSValuePtr);
-
-  inline bool strictEqualSlowCaseInline(JSValuePtr v1, JSValuePtr v2)
-  {
-      ASSERT(!JSImmediate::areBothImmediate(v1, v2));
-      
-      if (JSImmediate::isEitherImmediate(v1, v2)) {
-          ASSERT(v1 == JSImmediate::zeroImmediate() || v2 == JSImmediate::zeroImmediate());
-          ASSERT(v1 != v2);
-
-          // The reason we can't just return false here is that 0 === -0,
-          // and while the former is an immediate number, the latter is not.
-          if (v1 == JSImmediate::zeroImmediate())
-              return asCell(v2)->isNumber() && asNumberCell(v2)->value() == 0;
-          return asCell(v1)->isNumber() && asNumberCell(v1)->value() == 0;
-      }
-      
-      if (asCell(v1)->isNumber()) {
-          return asCell(v2)->isNumber()
-              && asNumberCell(v1)->value() == asNumberCell(v2)->value();
-      }
-
-      if (asCell(v1)->isString()) {
-          return asCell(v2)->isString()
-              && asString(v1)->value() == asString(v2)->value();
-      }
-
-      return v1 == v2;
-  }
-
-  JSValuePtr throwOutOfMemoryError(ExecState*);
-}
-
-#endif
+    NEVER_INLINE JSValue throwOutOfMemoryError(ExecState*);
+    NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
+    JSValue jsTypeStringForValue(CallFrame*, JSValue);
+    bool jsIsObjectType(JSValue);
+    bool jsIsFunctionType(JSValue);
+
+    // ECMA 11.9.3
+    inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
+    {
+        if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+            return v1 == v2;
+
+        return equalSlowCase(exec, v1, v2);
+    }
+
+    ALWAYS_INLINE bool JSValue::equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
+    {
+        ASSERT(!JSImmediate::areBothImmediateIntegerNumbers(v1, v2));
+
+        do {
+            if (v1.isNumber() && v2.isNumber())
+                return v1.uncheckedGetNumber() == v2.uncheckedGetNumber();
+
+            bool s1 = v1.isString();
+            bool s2 = v2.isString();
+            if (s1 && s2)
+                return asString(v1)->value() == asString(v2)->value();
+
+            if (v1.isUndefinedOrNull()) {
+                if (v2.isUndefinedOrNull())
+                    return true;
+                if (JSImmediate::isImmediate(v2))
+                    return false;
+                return v2.asCell()->structure()->typeInfo().masqueradesAsUndefined();
+            }
+
+            if (v2.isUndefinedOrNull()) {
+                if (JSImmediate::isImmediate(v1))
+                    return false;
+                return v1.asCell()->structure()->typeInfo().masqueradesAsUndefined();
+            }
+
+            if (v1.isObject()) {
+                if (v2.isObject())
+                    return v1 == v2;
+                JSValue p1 = v1.toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                v1 = p1;
+                if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+                    return v1 == v2;
+                continue;
+            }
+
+            if (v2.isObject()) {
+                JSValue p2 = v2.toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                v2 = p2;
+                if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+                    return v1 == v2;
+                continue;
+            }
+
+            if (s1 || s2) {
+                double d1 = v1.toNumber(exec);
+                double d2 = v2.toNumber(exec);
+                return d1 == d2;
+            }
+
+            if (v1.isBoolean()) {
+                if (v2.isNumber())
+                    return static_cast<double>(v1.getBoolean()) == v2.uncheckedGetNumber();
+            } else if (v2.isBoolean()) {
+                if (v1.isNumber())
+                    return v1.uncheckedGetNumber() == static_cast<double>(v2.getBoolean());
+            }
+
+            return v1 == v2;
+        } while (true);
+    }
+
+    // ECMA 11.9.3
+    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
+    {
+        ASSERT(!JSImmediate::isEitherImmediate(v1, v2));
+
+        if (v1.asCell()->isString() && v2.asCell()->isString())
+            return asString(v1)->value() == asString(v2)->value();
+
+        return v1 == v2;
+    }
+
+    inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
+    {
+        if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+            return v1 == v2;
+
+        if (v1.isNumber() && v2.isNumber())
+            return v1.uncheckedGetNumber() == v2.uncheckedGetNumber();
+
+        if (JSImmediate::isEitherImmediate(v1, v2))
+            return v1 == v2;
+
+        return strictEqualSlowCaseInline(v1, v2);
+    }
+
+    inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
+    {
+        if (JSValue::areBothInt32Fast(v1, v2))
+            return v1.getInt32Fast() < v2.getInt32Fast();
+
+        double n1;
+        double n2;
+        if (v1.getNumber(n1) && v2.getNumber(n2))
+            return n1 < n2;
+
+        JSGlobalData* globalData = &callFrame->globalData();
+        if (isJSString(globalData, v1) && isJSString(globalData, v2))
+            return asString(v1)->value() < asString(v2)->value();
+
+        JSValue p1;
+        JSValue p2;
+        bool wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+        bool wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+
+        if (wasNotString1 | wasNotString2)
+            return n1 < n2;
+
+        return asString(p1)->value() < asString(p2)->value();
+    }
+
+    inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
+    {
+        if (JSValue::areBothInt32Fast(v1, v2))
+            return v1.getInt32Fast() <= v2.getInt32Fast();
+
+        double n1;
+        double n2;
+        if (v1.getNumber(n1) && v2.getNumber(n2))
+            return n1 <= n2;
+
+        JSGlobalData* globalData = &callFrame->globalData();
+        if (isJSString(globalData, v1) && isJSString(globalData, v2))
+            return !(asString(v2)->value() < asString(v1)->value());
+
+        JSValue p1;
+        JSValue p2;
+        bool wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+        bool wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+
+        if (wasNotString1 | wasNotString2)
+            return n1 <= n2;
+
+        return !(asString(p2)->value() < asString(p1)->value());
+    }
+
+    // Fast-path choices here are based on frequency data from SunSpider:
+    //    <times> Add case: <t1> <t2>
+    //    ---------------------------
+    //    5626160 Add case: 3 3 (of these, 3637690 are for immediate values)
+    //    247412  Add case: 5 5
+    //    20900   Add case: 5 6
+    //    13962   Add case: 5 3
+    //    4000    Add case: 3 5
+
+    ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
+    {
+        double left;
+        double right = 0.0;
+
+        bool rightIsNumber = v2.getNumber(right);
+        if (rightIsNumber && v1.getNumber(left))
+            return jsNumber(callFrame, left + right);
+        
+        bool leftIsString = v1.isString();
+        if (leftIsString && v2.isString()) {
+            RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
+            if (!value)
+                return throwOutOfMemoryError(callFrame);
+            return jsString(callFrame, value.release());
+        }
+
+        if (rightIsNumber & leftIsString) {
+            RefPtr<UString::Rep> value = v2.isInt32Fast() ?
+                concatenate(asString(v1)->value().rep(), v2.getInt32Fast()) :
+                concatenate(asString(v1)->value().rep(), right);
+
+            if (!value)
+                return throwOutOfMemoryError(callFrame);
+            return jsString(callFrame, value.release());
+        }
+
+        // All other cases are pretty uncommon
+        return jsAddSlowCase(callFrame, v1, v2);
+    }
+
+    inline size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValue baseValue, const PropertySlot& slot)
+    {
+        JSCell* cell = asCell(baseValue);
+        size_t count = 0;
+
+        while (slot.slotBase() != cell) {
+            JSValue v = cell->structure()->prototypeForLookup(callFrame);
+
+            // If we didn't find slotBase in baseValue's prototype chain, then baseValue
+            // must be a proxy for another object.
+
+            if (v.isNull())
+                return 0;
+
+            cell = asCell(v);
+
+            // Since we're accessing a prototype in a loop, it's a good bet that it
+            // should not be treated as a dictionary.
+            if (cell->structure()->isDictionary())
+                asObject(cell)->setStructure(Structure::fromDictionaryTransition(cell->structure()));
+
+            ++count;
+        }
+        
+        ASSERT(count);
+        return count;
+    }
+
+    ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
+    {
+        ScopeChainIterator iter = scopeChain->begin();
+        ScopeChainIterator next = iter;
+        ++next;
+        ScopeChainIterator end = scopeChain->end();
+        ASSERT(iter != end);
+
+        PropertySlot slot;
+        JSObject* base;
+        while (true) {
+            base = *iter;
+            if (next == end || base->getPropertySlot(callFrame, property, slot))
+                return base;
+
+            iter = next;
+            ++next;
+        }
+
+        ASSERT_NOT_REACHED();
+        return JSValue();
+    }
+
+    ALWAYS_INLINE JSValue concatenateStrings(CallFrame* callFrame, Register* strings, unsigned count)
+    {
+        ASSERT(count >= 3);
+
+        // Estimate the amount of space required to hold the entire string.  If all
+        // arguments are strings, we can easily calculate the exact amount of space
+        // required.  For any other arguments, for now let's assume they may require
+        // 11 UChars of storage.  This is enouch to hold any int, and likely is also
+        // reasonable for the other immediates.  We may want to come back and tune
+        // this value at some point.
+        unsigned bufferSize = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                bufferSize += asString(v)->value().size();
+            else
+                bufferSize += 11;
+        }
+
+        // Allocate an output string to store the result.
+        // If the first argument is a String, and if it has the capacity (or can grow
+        // its capacity) to hold the entire result then use this as a base to concatenate
+        // onto.  Otherwise, allocate a new empty output buffer.
+        JSValue firstValue = strings[0].jsValue();
+        RefPtr<UString::Rep> resultRep;
+        if (firstValue.isString() && (resultRep = asString(firstValue)->value().rep())->reserveCapacity(bufferSize)) {
+            // We're going to concatenate onto the first string - remove it from the list of items to be appended.
+            ++strings;
+            --count;
+        } else
+            resultRep = UString::Rep::createEmptyBuffer(bufferSize);
+        UString result(resultRep);
+
+        // Loop over the openards, writing them into the output buffer.
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                result.append(asString(v)->value());
+            else if (v.isInt32Fast())
+                result.appendNumeric(v.getInt32Fast());
+            else {
+                double d;
+                if (v.getNumber(d))
+                    result.appendNumeric(d);
+                else
+                    result.append(v.toString(callFrame));
+            }
+        }
+
+        return jsString(callFrame, result);
+    }
+
+} // namespace JSC
+
+#endif // Operations_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
index 935df68031..44dc2b84ff 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -30,20 +30,23 @@ namespace JSC {
         UString::Rep* key;
         unsigned offset;
         unsigned attributes;
+        JSCell* specificValue;
         unsigned index;
 
-        PropertyMapEntry(UString::Rep* key, unsigned attributes)
+        PropertyMapEntry(UString::Rep* key, unsigned attributes, JSCell* specificValue)
             : key(key)
             , offset(0)
             , attributes(attributes)
+            , specificValue(specificValue)
             , index(0)
         {
         }
 
-        PropertyMapEntry(UString::Rep* key, unsigned offset, unsigned attributes, unsigned index)
+        PropertyMapEntry(UString::Rep* key, unsigned offset, unsigned attributes, JSCell* specificValue, unsigned index)
             : key(key)
             , offset(offset)
             , attributes(attributes)
+            , specificValue(specificValue)
             , index(index)
         {
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
index 47e9d84a98..0878e73f87 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -27,7 +27,7 @@ static const size_t setThreshold = 20;
 
 void PropertyNameArray::add(UString::Rep* identifier)
 {
-    ASSERT(identifier == &UString::Rep::null || identifier == &UString::Rep::empty || identifier->identifierTable());
+    ASSERT(identifier == &UString::Rep::null() || identifier == &UString::Rep::empty() || identifier->identifierTable());
 
     size_t size = m_data->propertyNameVector().size();
     if (size < setThreshold) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
index 7dc14fe213..b4382f4228 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
@@ -65,14 +65,14 @@ namespace JSC {
         PropertyNameArray(JSGlobalData* globalData)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(globalData)
-            , m_cacheable(true)
+            , m_shouldCache(true)
         {
         }
 
         PropertyNameArray(ExecState* exec)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(&exec->globalData())
-            , m_cacheable(true)
+            , m_shouldCache(true)
         {
         }
 
@@ -95,8 +95,8 @@ namespace JSC {
 
         PassRefPtr<PropertyNameArrayData> releaseData() { return m_data.release(); }
 
-        void setCacheable(bool cacheable) { m_cacheable = cacheable; }
-        bool cacheable() const { return m_cacheable; }
+        void setShouldCache(bool shouldCache) { m_shouldCache = shouldCache; }
+        bool shouldCache() const { return m_shouldCache; }
 
     private:
         typedef HashSet<UString::Rep*, PtrHash<UString::Rep*> > IdentifierSet;
@@ -104,7 +104,7 @@ namespace JSC {
         RefPtr<PropertyNameArrayData> m_data;
         IdentifierSet m_set;
         JSGlobalData* m_globalData;
-        bool m_cacheable;
+        bool m_shouldCache;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
index 175f2711e3..36fa5d83d6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
@@ -27,7 +27,7 @@
 
 namespace JSC {
 
-JSValuePtr PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     // Prevent getter functions from observing execution if an exception is pending.
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
index 1dd1afafea..7af60ce98f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
@@ -45,30 +45,30 @@ namespace JSC {
             clearValue();
         }
 
-        explicit PropertySlot(const JSValuePtr base)
+        explicit PropertySlot(const JSValue base)
             : m_slotBase(base)
             , m_offset(WTF::notFound)
         {
             clearValue();
         }
 
-        typedef JSValuePtr (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
+        typedef JSValue (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
 
-        JSValuePtr getValue(ExecState* exec, const Identifier& propertyName) const
+        JSValue getValue(ExecState* exec, const Identifier& propertyName) const
         {
             if (m_getValue == JSC_VALUE_SLOT_MARKER)
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue(exec);
+                return (*m_data.registerSlot).jsValue();
             return m_getValue(exec, propertyName, *this);
         }
 
-        JSValuePtr getValue(ExecState* exec, unsigned propertyName) const
+        JSValue getValue(ExecState* exec, unsigned propertyName) const
         {
             if (m_getValue == JSC_VALUE_SLOT_MARKER)
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue(exec);
+                return (*m_data.registerSlot).jsValue();
             return m_getValue(exec, Identifier::from(exec, propertyName), *this);
         }
 
@@ -79,17 +79,17 @@ namespace JSC {
             return m_offset;
         }
 
-        void putValue(JSValuePtr value)
+        void putValue(JSValue value)
         { 
             if (m_getValue == JSC_VALUE_SLOT_MARKER) {
                 *m_data.valueSlot = value;
                 return;
             }
             ASSERT(m_getValue == JSC_REGISTER_SLOT_MARKER);
-            *m_data.registerSlot = JSValuePtr(value);
+            *m_data.registerSlot = JSValue(value);
         }
 
-        void setValueSlot(JSValuePtr* valueSlot) 
+        void setValueSlot(JSValue* valueSlot) 
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -97,7 +97,7 @@ namespace JSC {
             m_data.valueSlot = valueSlot;
         }
         
-        void setValueSlot(JSValuePtr slotBase, JSValuePtr* valueSlot)
+        void setValueSlot(JSValue slotBase, JSValue* valueSlot)
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -105,7 +105,7 @@ namespace JSC {
             m_data.valueSlot = valueSlot;
         }
         
-        void setValueSlot(JSValuePtr slotBase, JSValuePtr* valueSlot, size_t offset)
+        void setValueSlot(JSValue slotBase, JSValue* valueSlot, size_t offset)
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -114,7 +114,7 @@ namespace JSC {
             m_offset = offset;
         }
         
-        void setValue(JSValuePtr value)
+        void setValue(JSValue value)
         {
             ASSERT(value);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -131,7 +131,7 @@ namespace JSC {
             m_data.registerSlot = registerSlot;
         }
 
-        void setCustom(JSValuePtr slotBase, GetValueFunc getValue)
+        void setCustom(JSValue slotBase, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
@@ -139,7 +139,7 @@ namespace JSC {
             m_slotBase = slotBase;
         }
 
-        void setCustomIndex(JSValuePtr slotBase, unsigned index, GetValueFunc getValue)
+        void setCustomIndex(JSValue slotBase, unsigned index, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
@@ -161,13 +161,13 @@ namespace JSC {
             setValue(jsUndefined());
         }
 
-        JSValuePtr slotBase() const
+        JSValue slotBase() const
         {
             ASSERT(m_slotBase);
             return m_slotBase;
         }
 
-        void setBase(JSValuePtr base)
+        void setBase(JSValue base)
         {
             ASSERT(m_slotBase);
             ASSERT(base);
@@ -177,33 +177,33 @@ namespace JSC {
         void clearBase()
         {
 #ifndef NDEBUG
-            m_slotBase = noValue();
+            m_slotBase = JSValue();
 #endif
         }
 
         void clearValue()
         {
 #ifndef NDEBUG
-            m_value = noValue();
+            m_value = JSValue();
 #endif
         }
 
         unsigned index() const { return m_data.index; }
 
     private:
-        static JSValuePtr functionGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue functionGetter(ExecState*, const Identifier&, const PropertySlot&);
 
         GetValueFunc m_getValue;
         
-        JSValuePtr m_slotBase;
+        JSValue m_slotBase;
         union {
             JSObject* getterFunc;
-            JSValuePtr* valueSlot;
+            JSValue* valueSlot;
             Register* registerSlot;
             unsigned index;
         } m_data;
 
-        JSValuePtr m_value;
+        JSValue m_value;
 
         size_t m_offset;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
index efbc4bb6e9..224164d2f9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
@@ -49,18 +49,16 @@ namespace JSC {
             gcUnprotect(val);
     }
     
-    inline void gcProtect(JSValuePtr value)
+    inline void gcProtect(JSValue value)
     {
-        if (!value || JSImmediate::isImmediate(value))
-            return;
-        gcProtect(asCell(value));
+        if (value && value.isCell())
+            gcProtect(asCell(value));
     }
 
-    inline void gcUnprotect(JSValuePtr value)
+    inline void gcUnprotect(JSValue value)
     {
-        if (!value || JSImmediate::isImmediate(value))
-            return;
-        gcUnprotect(asCell(value));
+        if (value && value.isCell())
+            gcUnprotect(asCell(value));
     }
 
     // FIXME: Share more code with RefPtr template? The only differences are the ref/deref operation
@@ -76,7 +74,7 @@ namespace JSC {
         
         T* get() const { return m_ptr; }
         operator T*() const { return m_ptr; }
-        operator JSValuePtr() const { return JSValuePtr(m_ptr); }
+        operator JSValue() const { return JSValue(m_ptr); }
         T* operator->() const { return m_ptr; }
         
         operator bool() const { return m_ptr; }
@@ -89,27 +87,27 @@ namespace JSC {
         T* m_ptr;
     };
 
-    class ProtectedJSValuePtr {
+    class ProtectedJSValue {
     public:
-        ProtectedJSValuePtr() {}
-        ProtectedJSValuePtr(JSValuePtr value);
-        ProtectedJSValuePtr(const ProtectedJSValuePtr&);
-        ~ProtectedJSValuePtr();
+        ProtectedJSValue() {}
+        ProtectedJSValue(JSValue value);
+        ProtectedJSValue(const ProtectedJSValue&);
+        ~ProtectedJSValue();
 
-        template <class U> ProtectedJSValuePtr(const ProtectedPtr<U>&);
+        template <class U> ProtectedJSValue(const ProtectedPtr<U>&);
         
-        JSValuePtr get() const { return m_value; }
-        operator JSValuePtr() const { return m_value; }
-        JSValuePtr operator->() const { return m_value; }
+        JSValue get() const { return m_value; }
+        operator JSValue() const { return m_value; }
+        JSValue operator->() const { return m_value; }
         
         operator bool() const { return m_value; }
         bool operator!() const { return !m_value; }
 
-        ProtectedJSValuePtr& operator=(const ProtectedJSValuePtr&);
-        ProtectedJSValuePtr& operator=(JSValuePtr);
+        ProtectedJSValue& operator=(const ProtectedJSValue&);
+        ProtectedJSValue& operator=(JSValue);
         
     private:
-        JSValuePtr m_value;
+        JSValue m_value;
     };
 
     template <class T> inline ProtectedPtr<T>::ProtectedPtr(T* ptr)
@@ -152,39 +150,39 @@ namespace JSC {
         return *this;
     }
 
-    inline ProtectedJSValuePtr::ProtectedJSValuePtr(JSValuePtr value)
+    inline ProtectedJSValue::ProtectedJSValue(JSValue value)
         : m_value(value)
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr::ProtectedJSValuePtr(const ProtectedJSValuePtr& o)
+    inline ProtectedJSValue::ProtectedJSValue(const ProtectedJSValue& o)
         : m_value(o.get())
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr::~ProtectedJSValuePtr()
+    inline ProtectedJSValue::~ProtectedJSValue()
     {
         gcUnprotect(m_value);
     }
 
-    template <class U> ProtectedJSValuePtr::ProtectedJSValuePtr(const ProtectedPtr<U>& o)
+    template <class U> ProtectedJSValue::ProtectedJSValue(const ProtectedPtr<U>& o)
         : m_value(o.get())
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr& ProtectedJSValuePtr::operator=(const ProtectedJSValuePtr& o) 
+    inline ProtectedJSValue& ProtectedJSValue::operator=(const ProtectedJSValue& o) 
     {
-        JSValuePtr ovalue = o.m_value;
+        JSValue ovalue = o.m_value;
         gcProtect(ovalue);
         gcUnprotect(m_value);
         m_value = ovalue;
         return *this;
     }
 
-    inline ProtectedJSValuePtr& ProtectedJSValuePtr::operator=(JSValuePtr ovalue)
+    inline ProtectedJSValue& ProtectedJSValue::operator=(JSValue ovalue)
     {
         gcProtect(ovalue);
         gcUnprotect(m_value);
@@ -200,17 +198,17 @@ namespace JSC {
     template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const T* b) { return a.get() != b; }
     template <class T> inline bool operator!=(const T* a, const ProtectedPtr<T>& b) { return a != b.get(); }
 
-    inline bool operator==(const ProtectedJSValuePtr& a, const ProtectedJSValuePtr& b) { return a.get() == b.get(); }
-    inline bool operator==(const ProtectedJSValuePtr& a, const JSValuePtr b) { return a.get() == b; }
-    template <class T> inline bool operator==(const ProtectedJSValuePtr& a, const ProtectedPtr<T>& b) { return a.get() == JSValuePtr(b.get()); }
-    inline bool operator==(const JSValuePtr a, const ProtectedJSValuePtr& b) { return a == b.get(); }
-    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedJSValuePtr& b) { return JSValuePtr(a.get()) == b.get(); }
-
-    inline bool operator!=(const ProtectedJSValuePtr& a, const ProtectedJSValuePtr& b) { return a.get() != b.get(); }
-    inline bool operator!=(const ProtectedJSValuePtr& a, const JSValuePtr b) { return a.get() != b; }
-    template <class T> inline bool operator!=(const ProtectedJSValuePtr& a, const ProtectedPtr<T>& b) { return a.get() != JSValuePtr(b.get()); }
-    inline bool operator!=(const JSValuePtr a, const ProtectedJSValuePtr& b) { return a != b.get(); }
-    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedJSValuePtr& b) { return JSValuePtr(a.get()) != b.get(); }
+    inline bool operator==(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() == b.get(); }
+    inline bool operator==(const ProtectedJSValue& a, const JSValue b) { return a.get() == b; }
+    template <class T> inline bool operator==(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() == JSValue(b.get()); }
+    inline bool operator==(const JSValue a, const ProtectedJSValue& b) { return a == b.get(); }
+    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) == b.get(); }
+
+    inline bool operator!=(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() != b.get(); }
+    inline bool operator!=(const ProtectedJSValue& a, const JSValue b) { return a.get() != b; }
+    template <class T> inline bool operator!=(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() != JSValue(b.get()); }
+    inline bool operator!=(const JSValue a, const ProtectedJSValue& b) { return a != b.get(); }
+    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) != b.get(); }
  
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h
index 1e2dfe920e..eb8ea8a994 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h
@@ -32,15 +32,15 @@
 namespace JSC {
     
     class JSObject;
+    class JSFunction;
     
     class PutPropertySlot {
     public:
-        enum Type { Invalid, ExistingProperty, NewProperty };
+        enum Type { Uncachable, ExistingProperty, NewProperty };
 
         PutPropertySlot()
-            : m_type(Invalid)
+            : m_type(Uncachable)
             , m_base(0)
-            , m_wasTransition(false)
         {
         }
 
@@ -61,18 +61,14 @@ namespace JSC {
         Type type() const { return m_type; }
         JSObject* base() const { return m_base; }
 
-        bool isCacheable() const { return m_type != Invalid; }
+        bool isCacheable() const { return m_type != Uncachable; }
         size_t cachedOffset() const {
             ASSERT(isCacheable());
             return m_offset;
         }
-        
-        bool wasTransition() const { return m_wasTransition; }
-        void setWasTransition(bool wasTransition) { m_wasTransition = wasTransition; }
     private:
         Type m_type;
         JSObject* m_base;
-        bool m_wasTransition;
         size_t m_offset;
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
index 722914d879..857a316906 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
@@ -20,17 +20,33 @@
 
 #include "config.h"
 #include "RegExp.h"
-
-#include "JIT.h"
 #include "Lexer.h"
-#include "WRECGenerator.h"
-#include <pcre/pcre.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 
+
+#if ENABLE(YARR)
+
+#include "yarr/RegexCompiler.h"
+#if ENABLE(YARR_JIT)
+#include "yarr/RegexJIT.h"
+#else
+#include "yarr/RegexInterpreter.h"
+#endif
+
+#else
+
+#if ENABLE(WREC)
+#include "JIT.h"
+#include "WRECGenerator.h"
+#endif
+#include <pcre/pcre.h>
+
+#endif
+
 namespace JSC {
 
 #if ENABLE(WREC)
@@ -40,62 +56,41 @@ using namespace WREC;
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
     : m_pattern(pattern)
     , m_flagBits(0)
-    , m_regExp(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
-    UNUSED_PARAM(globalData);
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, pattern, &m_numSubpatterns, &m_constructionError, m_executablePool);
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
-#endif
-    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(pattern.data()), pattern.size(),
-        JSRegExpDoNotIgnoreCase, JSRegExpSingleLine, &m_numSubpatterns, &m_constructionError);
-}
-
-PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern)
-{
-    return adoptRef(new RegExp(globalData, pattern));
+    compile(globalData);
 }
 
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags)
     : m_pattern(pattern)
     , m_flags(flags)
     , m_flagBits(0)
-    , m_regExp(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
-    UNUSED_PARAM(globalData);
-
     // NOTE: The global flag is handled on a case-by-case basis by functions like
     // String::match and RegExpObject::match.
     if (flags.find('g') != -1)
         m_flagBits |= Global;
-
-    // FIXME: Eliminate duplication by adding a way ask a JSRegExp what its flags are?
-    JSRegExpIgnoreCaseOption ignoreCaseOption = JSRegExpDoNotIgnoreCase;
-    if (flags.find('i') != -1) {
+    if (flags.find('i') != -1)
         m_flagBits |= IgnoreCase;
-        ignoreCaseOption = JSRegExpIgnoreCase;
-    }
-
-    JSRegExpMultilineOption multilineOption = JSRegExpSingleLine;
-    if (flags.find('m') != -1) {
+    if (flags.find('m') != -1)
         m_flagBits |= Multiline;
-        multilineOption = JSRegExpMultiline;
-    }
 
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, (m_flagBits & IgnoreCase), (m_flagBits & Multiline));
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
+    compile(globalData);
+}
+
+#if !ENABLE(YARR)
+RegExp::~RegExp()
+{
+    jsRegExpFree(m_regExp);
+}
 #endif
-    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(pattern.data()), pattern.size(),
-        ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
+
+PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern)
+{
+    return adoptRef(new RegExp(globalData, pattern));
 }
 
 PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern, const UString& flags)
@@ -103,9 +98,83 @@ PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& patte
     return adoptRef(new RegExp(globalData, pattern, flags));
 }
 
-RegExp::~RegExp()
+#if ENABLE(YARR)
+
+void RegExp::compile(JSGlobalData* globalData)
 {
-    jsRegExpFree(m_regExp);
+#if ENABLE(YARR_JIT)
+    Yarr::jitCompileRegex(globalData, m_regExpJITCode, m_pattern, m_numSubpatterns, m_constructionError, ignoreCase(), multiline());
+#else
+    UNUSED_PARAM(globalData);
+    m_regExpBytecode.set(Yarr::byteCompileRegex(m_pattern, m_numSubpatterns, m_constructionError, ignoreCase(), multiline()));
+#endif
+}
+
+int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
+{
+    if (startOffset < 0)
+        startOffset = 0;
+    if (ovector)
+        ovector->clear();
+
+    if (startOffset > s.size() || s.isNull())
+        return -1;
+
+#if ENABLE(YARR_JIT)
+    if (!!m_regExpJITCode) {
+#else
+    if (m_regExpBytecode) {
+#endif
+        int offsetVectorSize = (m_numSubpatterns + 1) * 3; // FIXME: should be 2 - but adding temporary fallback to pcre.
+        int* offsetVector = new int [offsetVectorSize];
+        ASSERT(offsetVector);
+        for (int j = 0; j < offsetVectorSize; ++j)
+            offsetVector[j] = -1;
+
+        OwnArrayPtr<int> nonReturnedOvector;
+        if (!ovector)
+            nonReturnedOvector.set(offsetVector);
+        else
+            ovector->set(offsetVector);
+
+#if ENABLE(YARR_JIT)
+        int result = Yarr::executeRegex(m_regExpJITCode, s.data(), startOffset, s.size(), offsetVector, offsetVectorSize);
+#else
+        int result = Yarr::interpretRegex(m_regExpBytecode.get(), s.data(), startOffset, s.size(), offsetVector);
+#endif
+
+        if (result < 0) {
+#ifndef NDEBUG
+            // TODO: define up a symbol, rather than magic -1
+            if (result != -1)
+                fprintf(stderr, "jsRegExpExecute failed with result %d\n", result);
+#endif
+            if (ovector)
+                ovector->clear();
+        }
+        return result;
+    }
+
+    return -1;
+}
+
+#else
+
+void RegExp::compile(JSGlobalData* globalData)
+{
+    m_regExp = 0;
+#if ENABLE(WREC)
+    m_wrecFunction = Generator::compileRegExp(globalData, m_pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, ignoreCase(), multiline());
+    if (m_wrecFunction || m_constructionError)
+        return;
+    // Fall through to non-WREC case.
+#else
+    UNUSED_PARAM(globalData);
+#endif
+
+    JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase() ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
+    JSRegExpMultilineOption multilineOption = multiline() ? JSRegExpMultiline : JSRegExpSingleLine;
+    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(m_pattern.data()), m_pattern.size(), ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
 }
 
 int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
@@ -122,6 +191,7 @@ int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
     if (m_wrecFunction) {
         int offsetVectorSize = (m_numSubpatterns + 1) * 2;
         int* offsetVector = new int [offsetVectorSize];
+        ASSERT(offsetVector);
         for (int j = 0; j < offsetVectorSize; ++j)
             offsetVector[j] = -1;
 
@@ -178,4 +248,6 @@ int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
     return -1;
 }
 
+#endif
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
index 139c754f2b..f3be656d76 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
@@ -26,6 +26,8 @@
 #include "ExecutableAllocator.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
+#include "yarr/RegexJIT.h"
+#include "yarr/RegexInterpreter.h"
 
 struct JSRegExp;
 
@@ -37,7 +39,9 @@ namespace JSC {
     public:
         static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern);
         static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, const UString& flags);
+#if !ENABLE(YARR)
         ~RegExp();
+#endif
 
         bool global() const { return m_flagBits & Global; }
         bool ignoreCase() const { return m_flagBits & IgnoreCase; }
@@ -56,21 +60,27 @@ namespace JSC {
         RegExp(JSGlobalData* globalData, const UString& pattern);
         RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags);
 
-        void compile();
+        void compile(JSGlobalData*);
 
         enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
 
         UString m_pattern; // FIXME: Just decompile m_regExp instead of storing this.
         UString m_flags; // FIXME: Just decompile m_regExp instead of storing this.
         int m_flagBits;
-        JSRegExp* m_regExp;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
 
+#if ENABLE(YARR_JIT)
+        Yarr::RegexCodeBlock m_regExpJITCode;
+#elif ENABLE(YARR)
+        OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
+#else
 #if ENABLE(WREC)
         WREC::CompiledRegExp m_wrecFunction;
         RefPtr<ExecutablePool> m_executablePool;
 #endif
+        JSRegExp* m_regExp;
+#endif
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index 84a297c5e9..bcd0d07906 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -33,24 +33,24 @@
 
 namespace JSC {
 
-static JSValuePtr regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
-
-static void setRegExpConstructorInput(ExecState*, JSObject*, JSValuePtr);
-static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValuePtr);
+static JSValue regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
+
+static void setRegExpConstructorInput(ExecState*, JSObject*, JSValue);
+static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
 
@@ -185,7 +185,7 @@ JSObject* RegExpConstructor::arrayOfMatches(ExecState* exec) const
     return new (exec) RegExpMatchesArray(exec, d.get());
 }
 
-JSValuePtr RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
+JSValue RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
 {
     if (d->lastOvector && i <= d->lastNumSubPatterns) {
         int start = d->lastOvector[2 * i];
@@ -195,7 +195,7 @@ JSValuePtr RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getLastParen(ExecState* exec) const
+JSValue RegExpConstructor::getLastParen(ExecState* exec) const
 {
     unsigned i = d->lastNumSubPatterns;
     if (i > 0) {
@@ -207,14 +207,14 @@ JSValuePtr RegExpConstructor::getLastParen(ExecState* exec) const
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getLeftContext(ExecState* exec) const
+JSValue RegExpConstructor::getLeftContext(ExecState* exec) const
 {
     if (d->lastOvector)
         return jsSubstring(exec, d->lastInput, 0, d->lastOvector[0]);
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getRightContext(ExecState* exec) const
+JSValue RegExpConstructor::getRightContext(ExecState* exec) const
 {
     if (d->lastOvector)
         return jsSubstring(exec, d->lastInput, d->lastOvector[1], d->lastInput.size() - d->lastOvector[1]);
@@ -226,110 +226,110 @@ bool RegExpConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
 }
 
-JSValuePtr regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 2);
 }
 
-JSValuePtr regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 3);
 }
 
-JSValuePtr regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 4);
 }
 
-JSValuePtr regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 5);
 }
 
-JSValuePtr regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 6);
 }
 
-JSValuePtr regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 7);
 }
 
-JSValuePtr regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 8);
 }
 
-JSValuePtr regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 9);
 }
 
-JSValuePtr regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsString(exec, asRegExpConstructor(slot.slotBase())->input());
 }
 
-JSValuePtr regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpConstructor(slot.slotBase())->multiline());
 }
 
-JSValuePtr regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 0);
 }
 
-JSValuePtr regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getLastParen(exec);
 }
 
-JSValuePtr regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getLeftContext(exec);
 }
 
-JSValuePtr regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getRightContext(exec);
 }
 
-void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<RegExpConstructor, InternalFunction>(exec, propertyName, value, ExecState::regExpConstructorTable(exec), this, slot);
 }
 
-void setRegExpConstructorInput(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpConstructorInput(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpConstructor(baseObject)->setInput(value->toString(exec));
+    asRegExpConstructor(baseObject)->setInput(value.toString(exec));
 }
 
-void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpConstructor(baseObject)->setMultiline(value->toBoolean(exec));
+    asRegExpConstructor(baseObject)->setMultiline(value.toBoolean(exec));
 }
   
 // ECMA 15.10.4
 JSObject* constructRegExp(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr arg0 = args.at(exec, 0);
-    JSValuePtr arg1 = args.at(exec, 1);
+    JSValue arg0 = args.at(0);
+    JSValue arg1 = args.at(1);
 
-    if (arg0->isObject(&RegExpObject::info)) {
-        if (!arg1->isUndefined())
+    if (arg0.isObject(&RegExpObject::info)) {
+        if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         return asObject(arg0);
     }
 
-    UString pattern = arg0->isUndefined() ? UString("") : arg0->toString(exec);
-    UString flags = arg1->isUndefined() ? UString("") : arg1->toString(exec);
+    UString pattern = arg0.isUndefined() ? UString("") : arg0.toString(exec);
+    UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
 
     RefPtr<RegExp> regExp = RegExp::create(&exec->globalData(), pattern, flags);
     if (!regExp->isValid())
@@ -349,7 +349,7 @@ ConstructType RegExpConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.10.3
-static JSValuePtr callRegExpConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRegExpConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructRegExp(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index f8c43663c9..6823f3fb70 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -34,12 +34,12 @@ namespace JSC {
     public:
         RegExpConstructor(ExecState*, PassRefPtr<Structure>, RegExpPrototype*);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
         }
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         static const ClassInfo info;
@@ -53,10 +53,10 @@ namespace JSC {
         void setMultiline(bool);
         bool multiline() const;
 
-        JSValuePtr getBackref(ExecState*, unsigned) const;
-        JSValuePtr getLastParen(ExecState*) const;
-        JSValuePtr getLeftContext(ExecState*) const;
-        JSValuePtr getRightContext(ExecState*) const;
+        JSValue getBackref(ExecState*, unsigned) const;
+        JSValue getLastParen(ExecState*) const;
+        JSValue getLeftContext(ExecState*) const;
+        JSValue getRightContext(ExecState*) const;
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
@@ -67,11 +67,11 @@ namespace JSC {
         OwnPtr<RegExpConstructorPrivate> d;
     };
 
-    RegExpConstructor* asRegExpConstructor(JSValuePtr);
+    RegExpConstructor* asRegExpConstructor(JSValue);
 
     JSObject* constructRegExp(ExecState*, const ArgList&);
 
-    inline RegExpConstructor* asRegExpConstructor(JSValuePtr value)
+    inline RegExpConstructor* asRegExpConstructor(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&RegExpConstructor::info));
         return static_cast<RegExpConstructor*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
index 358394117f..9ae18b9e89 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -44,14 +44,14 @@ namespace JSC {
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
-        virtual void put(ExecState* exec, const Identifier& propertyName, JSValuePtr v, PutPropertySlot& slot)
+        virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v, slot);
         }
 
-        virtual void put(ExecState* exec, unsigned propertyName, JSValuePtr v)
+        virtual void put(ExecState* exec, unsigned propertyName, JSValue v)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 5a54ad0e77..687844ed52 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "RegExpObject.h"
 
+#include "Error.h"
 #include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
@@ -29,12 +30,12 @@
 
 namespace JSC {
 
-static JSValuePtr regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
-static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValuePtr);
+static JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
+static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
 
@@ -71,54 +72,54 @@ bool RegExpObject::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
 }
 
-JSValuePtr regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->ignoreCase());
 }
  
-JSValuePtr regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
 {            
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->multiline());
 }
 
-JSValuePtr regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsString(exec, asRegExpObject(slot.slotBase())->regExp()->pattern());
 }
 
-JSValuePtr regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsNumber(exec, asRegExpObject(slot.slotBase())->lastIndex());
 }
 
-void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<RegExpObject, JSObject>(exec, propertyName, value, ExecState::regExpTable(exec), this, slot);
 }
 
-void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpObject(baseObject)->setLastIndex(value->toInteger(exec));
+    asRegExpObject(baseObject)->setLastIndex(value.toInteger(exec));
 }
 
-JSValuePtr RegExpObject::test(ExecState* exec, const ArgList& args)
+JSValue RegExpObject::test(ExecState* exec, const ArgList& args)
 {
     return jsBoolean(match(exec, args));
 }
 
-JSValuePtr RegExpObject::exec(ExecState* exec, const ArgList& args)
+JSValue RegExpObject::exec(ExecState* exec, const ArgList& args)
 {
     if (match(exec, args))
         return exec->lexicalGlobalObject()->regExpConstructor()->arrayOfMatches(exec);
     return jsNull();
 }
 
-static JSValuePtr callRegExpObject(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRegExpObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     return asRegExpObject(function)->exec(exec, args);
 }
@@ -134,7 +135,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
 {
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
 
-    UString input = args.isEmpty() ? regExpConstructor->input() : args.at(exec, 0)->toString(exec);
+    UString input = args.isEmpty() ? regExpConstructor->input() : args.at(0).toString(exec);
     if (input.isNull()) {
         throwError(exec, GeneralError, "No input to " + toString(exec) + ".");
         return false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index 4c99c30133..fac9978f10 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -37,16 +37,16 @@ namespace JSC {
         void setLastIndex(double lastIndex) { d->lastIndex = lastIndex; }
         double lastIndex() const { return d->lastIndex; }
 
-        JSValuePtr test(ExecState*, const ArgList&);
-        JSValuePtr exec(ExecState*, const ArgList&);
+        JSValue test(ExecState*, const ArgList&);
+        JSValue exec(ExecState*, const ArgList&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
@@ -70,9 +70,9 @@ namespace JSC {
         OwnPtr<RegExpObjectData> d;
     };
 
-    RegExpObject* asRegExpObject(JSValuePtr);
+    RegExpObject* asRegExpObject(JSValue);
 
-    inline RegExpObject* asRegExpObject(JSValuePtr value)
+    inline RegExpObject* asRegExpObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&RegExpObject::info));
         return static_cast<RegExpObject*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
index b47d4894f0..b1ab889e04 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -23,6 +23,7 @@
 
 #include "ArrayPrototype.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "JSObject.h"
 #include "JSString.h"
 #include "JSValue.h"
@@ -35,10 +36,10 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(RegExpPrototype);
 
-static JSValuePtr regExpProtoFuncTest(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncExec(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncCompile(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.10.5
 
@@ -47,44 +48,44 @@ const ClassInfo RegExpPrototype::info = { "RegExpPrototype", 0, 0, 0 };
 RegExpPrototype::RegExpPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : JSObject(structure)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
     
-JSValuePtr regExpProtoFuncTest(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&RegExpObject::info))
+    if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->test(exec, args);
 }
 
-JSValuePtr regExpProtoFuncExec(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&RegExpObject::info))
+    if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->exec(exec, args);
 }
 
-JSValuePtr regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&RegExpObject::info))
+    if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
 
     RefPtr<RegExp> regExp;
-    JSValuePtr arg0 = args.at(exec, 0);
-    JSValuePtr arg1 = args.at(exec, 1);
+    JSValue arg0 = args.at(0);
+    JSValue arg1 = args.at(1);
     
-    if (arg0->isObject(&RegExpObject::info)) {
-        if (!arg1->isUndefined())
+    if (arg0.isObject(&RegExpObject::info)) {
+        if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         regExp = asRegExpObject(arg0)->regExp();
     } else {
-        UString pattern = args.isEmpty() ? UString("") : arg0->toString(exec);
-        UString flags = arg1->isUndefined() ? UString("") : arg1->toString(exec);
+        UString pattern = args.isEmpty() ? UString("") : arg0.toString(exec);
+        UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
         regExp = RegExp::create(&exec->globalData(), pattern, flags);
     }
 
@@ -96,21 +97,21 @@ JSValuePtr regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValuePtr thisVal
     return jsUndefined();
 }
 
-JSValuePtr regExpProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&RegExpObject::info)) {
-        if (thisValue->isObject(&RegExpPrototype::info))
+    if (!thisValue.isObject(&RegExpObject::info)) {
+        if (thisValue.isObject(&RegExpPrototype::info))
             return jsNontrivialString(exec, "//");
         return throwError(exec, TypeError);
     }
 
-    UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source)->toString(exec);
+    UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
     result.append('/');
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global)->toBoolean(exec))
+    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global).toBoolean(exec))
         result.append('g');
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase)->toBoolean(exec))
+    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase).toBoolean(exec))
         result.append('i');
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline)->toBoolean(exec))
+    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline).toBoolean(exec))
         result.append('m');
     return jsNontrivialString(exec, result);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index 32b5e9235c..6f1560a20e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -41,6 +41,18 @@ namespace JSC {
         {
             ASSERT(globalData);
         }
+#ifndef NDEBUG
+        // Due to the number of subtle and timing dependent bugs that have occurred due
+        // to deleted but still "valid" ScopeChainNodes we now deliberately clobber the
+        // contents in debug builds.
+        ~ScopeChainNode()
+        {
+            next = 0;
+            object = 0;
+            globalData = 0;
+            globalThis = 0;
+        }
+#endif
 
         ScopeChainNode* next;
         JSObject* object;
@@ -171,6 +183,9 @@ namespace JSC {
         {
             if (m_node)
                 m_node->deref();
+#ifndef NDEBUG
+            m_node = 0;
+#endif
         }
 
         void swap(ScopeChain&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
index 06811b9929..87b49f05a5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
@@ -29,48 +29,52 @@
 #include "JSGlobalObject.h"
 #include "JSString.h"
 
+#include <wtf/Noncopyable.h>
+
 namespace JSC {
+static const unsigned numCharactersToStore = 0x100;
 
-class SmallStringsStorage {
+class SmallStringsStorage : Noncopyable {
 public:
     SmallStringsStorage();
-    ~SmallStringsStorage();
 
-    UString::Rep* rep(unsigned char character) { return &reps[character]; }
+    UString::Rep* rep(unsigned char character) { return &m_reps[character]; }
 
 private:
-    UChar characters[0x100];
-    UString::Rep* reps;
+    UChar m_characters[numCharactersToStore];
+    UString::BaseString m_base;
+    UString::Rep m_reps[numCharactersToStore];
 };
 
 SmallStringsStorage::SmallStringsStorage()
-    : reps(static_cast<UString::Rep*>(fastZeroedMalloc(sizeof(UString::Rep) * 0x100)))
+    : m_base(m_characters, numCharactersToStore)
 {
-    for (unsigned i = 0; i < 0x100; ++i) {
-        characters[i] = i;
-        reps[i].offset = i;
-        reps[i].len = 1;
-        reps[i].rc = 1;
-        reps[i].baseString = &reps[0];
-    }
-    reps[0].rc = 0x101;
-    reps[0].buf = characters;
-
+    m_base.rc = numCharactersToStore + 1;
     // make sure UString doesn't try to reuse the buffer by pretending we have one more character in it
-    reps[0].usedCapacity = 0x101;
-    reps[0].capacity = 0x101;
-}
+    m_base.usedCapacity = numCharactersToStore + 1;
+    m_base.capacity = numCharactersToStore + 1;
+    m_base.checkConsistency();
 
-SmallStringsStorage::~SmallStringsStorage()
-{
-    fastFree(reps);
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
+        m_characters[i] = i;
+
+    memset(&m_reps, 0, sizeof(m_reps));
+    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+        m_reps[i].offset = i;
+        m_reps[i].len = 1;
+        m_reps[i].rc = 1;
+        m_reps[i].setBaseString(&m_base);
+        m_reps[i].checkConsistency();
+    }
 }
 
 SmallStrings::SmallStrings()
     : m_emptyString(0)
     , m_storage(0)
 {
-    for (unsigned i = 0; i < 0x100; ++i)
+    COMPILE_ASSERT(numCharactersToStore == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
+
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
         m_singleCharacterStrings[i] = 0;
 }
 
@@ -82,12 +86,24 @@ void SmallStrings::mark()
 {
     if (m_emptyString && !m_emptyString->marked())
         m_emptyString->mark();
-    for (unsigned i = 0; i < 0x100; ++i) {
+    for (unsigned i = 0; i < numCharactersToStore; ++i) {
         if (m_singleCharacterStrings[i] && !m_singleCharacterStrings[i]->marked())
             m_singleCharacterStrings[i]->mark();
     }
 }
-    
+
+unsigned SmallStrings::count() const
+{
+    unsigned count = 0;
+    if (m_emptyString)
+        ++count;
+    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+        if (m_singleCharacterStrings[i])
+            ++count;
+    }
+    return count;
+}
+
 void SmallStrings::createEmptyString(JSGlobalData* globalData)
 {
     ASSERT(!m_emptyString);
@@ -109,4 +125,4 @@ UString::Rep* SmallStrings::singleCharacterStringRep(unsigned char character)
     return m_storage->rep(character);
 }
 
-}
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
index 7e5f5c893c..e7f11704ba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
@@ -55,9 +55,11 @@ namespace JSC {
         }
 
         UString::Rep* singleCharacterStringRep(unsigned char character);
-        
+
         void mark();
-        
+
+        unsigned count() const;
+
     private:
         void createEmptyString(JSGlobalData*);
         void createSingleCharacterString(JSGlobalData*, unsigned char);
@@ -66,7 +68,7 @@ namespace JSC {
         JSString* m_singleCharacterStrings[0x100];
         OwnPtr<SmallStringsStorage> m_storage;
     };
-    
-}
 
-#endif
+} // namespace JSC
+
+#endif // SmallStrings_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
index bac819ff5e..6380445874 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
@@ -21,26 +21,27 @@
 #include "config.h"
 #include "StringConstructor.h"
 
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "PrototypeFunction.h"
 #include "StringPrototype.h"
 
 namespace JSC {
 
-static NEVER_INLINE JSValuePtr stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
+static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
 {
     UChar* buf = static_cast<UChar*>(fastMalloc(args.size() * sizeof(UChar)));
     UChar* p = buf;
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        *p++ = static_cast<UChar>((*it).jsValue(exec)->toUInt32(exec));
+        *p++ = static_cast<UChar>((*it).toUInt32(exec));
     return jsString(exec, UString(buf, p - buf, false));
 }
 
-static JSValuePtr stringFromCharCode(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (LIKELY(args.size() == 1))
-        return jsSingleCharacterString(exec, args.at(exec, 0)->toUInt32(exec));
+        return jsSingleCharacterString(exec, args.at(0).toUInt32(exec));
     return stringFromCharCodeSlowCase(exec, args);
 }
 
@@ -53,7 +54,7 @@ StringConstructor::StringConstructor(ExecState* exec, PassRefPtr<Structure> stru
     putDirectWithoutTransition(exec->propertyNames().prototype, stringPrototype, ReadOnly | DontEnum | DontDelete);
 
     // ECMA 15.5.3.2 fromCharCode()
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
 
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
@@ -64,7 +65,7 @@ static JSObject* constructWithStringConstructor(ExecState* exec, JSObject*, cons
 {
     if (args.isEmpty())
         return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure());
-    return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), args.at(exec, 0)->toString(exec));
+    return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), args.at(0).toString(exec));
 }
 
 ConstructType StringConstructor::getConstructData(ConstructData& constructData)
@@ -74,11 +75,11 @@ ConstructType StringConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.5.1
-static JSValuePtr callStringConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callStringConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (args.isEmpty())
         return jsEmptyString(exec);
-    return jsString(exec, args.at(exec, 0)->toString(exec));
+    return jsString(exec, args.at(0).toString(exec));
 }
 
 CallType StringConstructor::getCallData(CallData& callData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
index 093f5de92f..fb44498a57 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
@@ -61,7 +61,7 @@ bool StringObject::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Pr
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length)
         return;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index 540c5761e1..ea3a045466 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -36,16 +36,16 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState* exec, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const JS_EXPORTDATA ClassInfo info;
 
         JSString* internalValue() const { return asString(JSWrapperObject::internalValue());}
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
@@ -59,9 +59,9 @@ namespace JSC {
         virtual JSString* toThisJSString(ExecState*);
   };
 
-    StringObject* asStringObject(JSValuePtr);
+    StringObject* asStringObject(JSValue);
 
-    inline StringObject* asStringObject(JSValuePtr value)
+    inline StringObject* asStringObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&StringObject::info));
         return static_cast<StringObject*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 72c0f47f98..bc5c0a5b22 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -42,7 +42,7 @@ namespace JSC {
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined)); 
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index 1f43cd6228..d6939cb5b4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "StringPrototype.h"
 
+#include "CachedCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -37,36 +38,36 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(StringPrototype);
 
-static JSValuePtr stringProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncCharAt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncCharCodeAt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncConcat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncMatch(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncReplace(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSearch(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSlice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSplit(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSubstr(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSubstring(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncToLowerCase(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncToUpperCase(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLocaleCompare(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-
-static JSValuePtr stringProtoFuncBig(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSmall(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncBlink(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncBold(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFixed(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncItalics(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncStrike(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSub(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSup(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFontcolor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFontsize(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncAnchor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLink(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState*, JSObject*, JSValue, const ArgList&);
+
+static JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -140,13 +141,12 @@ static inline UString substituteBackreferences(const UString& replacement, const
         if (i + 1 == replacement.size())
             break;
 
-        unsigned short ref = replacement[i + 1];
+        UChar ref = replacement[i + 1];
         if (ref == '$') {
             // "$$" -> "$"
             ++i;
             substitutedReplacement.append(replacement.data() + offset, i - offset);
             offset = i + 1;
-            substitutedReplacement.append('$');
             continue;
         }
 
@@ -205,21 +205,21 @@ static inline int localeCompare(const UString& a, const UString& b)
     return Collator::userDefault()->collate(reinterpret_cast<const ::UChar*>(a.data()), a.size(), reinterpret_cast<const ::UChar*>(b.data()), b.size());
 }
 
-JSValuePtr stringProtoFuncReplace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSString* sourceVal = thisValue->toThisJSString(exec);
+    JSString* sourceVal = thisValue.toThisJSString(exec);
     const UString& source = sourceVal->value();
 
-    JSValuePtr pattern = args.at(exec, 0);
+    JSValue pattern = args.at(0);
 
-    JSValuePtr replacement = args.at(exec, 1);
+    JSValue replacement = args.at(1);
     UString replacementString;
     CallData callData;
-    CallType callType = replacement->getCallData(callData);
+    CallType callType = replacement.getCallData(callData);
     if (callType == CallTypeNone)
-        replacementString = replacement->toString(exec);
+        replacementString = replacement.toString(exec);
 
-    if (pattern->isObject(&RegExpObject::info)) {
+    if (pattern.isObject(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(pattern)->regExp();
         bool global = reg->global();
 
@@ -232,167 +232,223 @@ JSValuePtr stringProtoFuncReplace(ExecState* exec, JSObject*, JSValuePtr thisVal
         Vector<UString, 16> replacements;
 
         // This is either a loop (if global is set) or a one-way (if not).
-        do {
-            int matchIndex;
-            int matchLen;
-            int* ovector;
-            regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
-            if (matchIndex < 0)
-                break;
-
-            sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+        if (global && callType == CallTypeJS) {
+            // reg->numSubpatterns() + 1 for pattern args, + 2 for match start and sourceValue
+            int argCount = reg->numSubpatterns() + 1 + 2;
+            JSFunction* func = asFunction(replacement);
+            CachedCall cachedCall(exec, func, argCount, exec->exceptionSlot());
+            if (exec->hadException())
+                return jsNull();
+            while (true) {
+                int matchIndex;
+                int matchLen;
+                int* ovector;
+                regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
+                if (matchIndex < 0)
+                    break;
+                
+                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
 
-            if (callType != CallTypeNone) {
                 int completeMatchStart = ovector[0];
-                ArgList args;
-
-                for (unsigned i = 0; i < reg->numSubpatterns() + 1; ++i) {
+                unsigned i = 0;
+                for (; i < reg->numSubpatterns() + 1; ++i) {
                     int matchStart = ovector[i * 2];
                     int matchLen = ovector[i * 2 + 1] - matchStart;
 
                     if (matchStart < 0)
-                        args.append(jsUndefined());
+                        cachedCall.setArgument(i, jsUndefined());
                     else
-                        args.append(jsSubstring(exec, source, matchStart, matchLen));
+                        cachedCall.setArgument(i, jsSubstring(exec, source, matchStart, matchLen));
                 }
 
-                args.append(jsNumber(exec, completeMatchStart));
-                args.append(sourceVal);
-
-                replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args)->toString(exec));
+                cachedCall.setArgument(i++, jsNumber(exec, completeMatchStart));
+                cachedCall.setArgument(i++, sourceVal);
+                
+                cachedCall.setThis(exec->globalThisValue());
+                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
                 if (exec->hadException())
                     break;
-            } else
-                replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
 
-            lastIndex = matchIndex + matchLen;
-            startPosition = lastIndex;
+                lastIndex = matchIndex + matchLen;
+                startPosition = lastIndex;
 
-            // special case of empty match
-            if (matchLen == 0) {
-                startPosition++;
-                if (startPosition > source.size())
+                // special case of empty match
+                if (matchLen == 0) {
+                    startPosition++;
+                    if (startPosition > source.size())
+                        break;
+                }
+            }            
+        } else {
+            do {
+                int matchIndex;
+                int matchLen;
+                int* ovector;
+                regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
+                if (matchIndex < 0)
                     break;
-            }
-        } while (global);
 
-        if (lastIndex < source.size())
-            sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
+                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
 
-        UString result = source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size());
+                if (callType != CallTypeNone) {
+                    int completeMatchStart = ovector[0];
+                    MarkedArgumentBuffer args;
 
-        if (result == source)
+                    for (unsigned i = 0; i < reg->numSubpatterns() + 1; ++i) {
+                        int matchStart = ovector[i * 2];
+                        int matchLen = ovector[i * 2 + 1] - matchStart;
+
+                        if (matchStart < 0)
+                            args.append(jsUndefined());
+                        else
+                            args.append(jsSubstring(exec, source, matchStart, matchLen));
+                    }
+
+                    args.append(jsNumber(exec, completeMatchStart));
+                    args.append(sourceVal);
+
+                    replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec));
+                    if (exec->hadException())
+                        break;
+                } else
+                    replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
+
+                lastIndex = matchIndex + matchLen;
+                startPosition = lastIndex;
+
+                // special case of empty match
+                if (matchLen == 0) {
+                    startPosition++;
+                    if (startPosition > source.size())
+                        break;
+                }
+            } while (global);
+        }
+
+        if (!lastIndex && replacements.isEmpty())
             return sourceVal;
 
-        return jsString(exec, result);
+        if (lastIndex < source.size())
+            sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
+
+        return jsString(exec, source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(),
+            replacements.data(), replacements.size()));
     }
 
-    // First arg is a string
-    UString patternString = pattern->toString(exec);
+    // Not a regular expression, so treat the pattern as a string.
+
+    UString patternString = pattern.toString(exec);
     int matchPos = source.find(patternString);
-    int matchLen = patternString.size();
-    // Do the replacement
+
     if (matchPos == -1)
         return sourceVal;
 
+    int matchLen = patternString.size();
     if (callType != CallTypeNone) {
-        ArgList args;
+        MarkedArgumentBuffer args;
         args.append(jsSubstring(exec, source, matchPos, matchLen));
         args.append(jsNumber(exec, matchPos));
         args.append(sourceVal);
 
-        replacementString = call(exec, replacement, callType, callData, exec->globalThisValue(), args)->toString(exec);
+        replacementString = call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec);
     }
 
     int ovector[2] = { matchPos, matchPos + matchLen };
-    return jsString(exec, source.substr(0, matchPos)
-        + substituteBackreferences(replacementString, source, ovector, 0)
-        + source.substr(matchPos + matchLen));
+    return jsString(exec, source.replaceRange(matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0)));
 }
 
-JSValuePtr stringProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     // Also used for valueOf.
 
-    if (thisValue->isString())
+    if (thisValue.isString())
         return thisValue;
 
-    if (thisValue->isObject(&StringObject::info))
+    if (thisValue.isObject(&StringObject::info))
         return asStringObject(thisValue)->internalValue();
 
     return throwError(exec, TypeError);
 }
 
-JSValuePtr stringProtoFuncCharAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
-    JSValuePtr a0 = args.at(exec, 0);
-    if (JSImmediate::isNumber(a0)) {
-        uint32_t i;
-        if (JSImmediate::getUInt32(a0, i) && i < len)
+    JSValue a0 = args.at(0);
+    if (a0.isUInt32Fast()) {
+        uint32_t i = a0.getUInt32Fast();
+        if (i < len)
             return jsSingleCharacterSubstring(exec, s, i);
         return jsEmptyString(exec);
     }
-    double dpos = a0->toInteger(exec);
+    double dpos = a0.toInteger(exec);
     if (dpos >= 0 && dpos < len)
         return jsSingleCharacterSubstring(exec, s, static_cast<unsigned>(dpos));
     return jsEmptyString(exec);
 }
 
-JSValuePtr stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
-    JSValuePtr a0 = args.at(exec, 0);
-    if (JSImmediate::isNumber(a0)) {
-        uint32_t i;
-        if (JSImmediate::getUInt32(a0, i) && i < len)
+    JSValue a0 = args.at(0);
+    if (a0.isUInt32Fast()) {
+        uint32_t i = a0.getUInt32Fast();
+        if (i < len)
             return jsNumber(exec, s.data()[i]);
         return jsNaN(exec);
     }
-    double dpos = a0->toInteger(exec);
+    double dpos = a0.toInteger(exec);
     if (dpos >= 0 && dpos < len)
         return jsNumber(exec, s[static_cast<int>(dpos)]);
     return jsNaN(exec);
 }
 
-JSValuePtr stringProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        s += (*it).jsValue(exec)->toString(exec);
+        s += (*it).toString(exec);
     return jsString(exec, s);
 }
 
-JSValuePtr stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
-    UString u2 = a0->toString(exec);
-    double dpos = a1->toInteger(exec);
-    if (dpos < 0)
-        dpos = 0;
-    else if (dpos > len)
-        dpos = len;
-    return jsNumber(exec, s.find(u2, static_cast<int>(dpos)));
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
+    UString u2 = a0.toString(exec);
+    int pos;
+    if (a1.isUndefined())
+        pos = 0;
+    else if (a1.isUInt32Fast())
+        pos = min<uint32_t>(a1.getUInt32Fast(), len);
+    else {
+        double dpos = a1.toInteger(exec);
+        if (dpos < 0)
+            dpos = 0;
+        else if (dpos > len)
+            dpos = len;
+        pos = static_cast<int>(dpos);
+    }
+
+    return jsNumber(exec, s.find(u2, pos));
 }
 
-JSValuePtr stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
-    UString u2 = a0->toString(exec);
-    double dpos = a1->toIntegerPreserveNaN(exec);
+    UString u2 = a0.toString(exec);
+    double dpos = a1.toIntegerPreserveNaN(exec);
     if (dpos < 0)
         dpos = 0;
     else if (!(dpos <= len)) // true for NaN
@@ -400,16 +456,16 @@ JSValuePtr stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thi
     return jsNumber(exec, s.rfind(u2, static_cast<int>(dpos)));
 }
 
-JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
 
     UString u = s;
     RefPtr<RegExp> reg;
     RegExpObject* imp = 0;
-    if (a0->isObject(&RegExpObject::info))
+    if (a0.isObject(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else {
         /*
@@ -417,7 +473,7 @@ JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = RegExp::create(&exec->globalData(), a0->toString(exec));
+        reg = RegExp::create(&exec->globalData(), a0.toString(exec));
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
@@ -431,7 +487,7 @@ JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue
     }
 
     // return array of matches
-    ArgList list;
+    MarkedArgumentBuffer list;
     int lastIndex = 0;
     while (pos >= 0) {
         list.append(jsSubstring(exec, u, pos, matchLength));
@@ -451,15 +507,15 @@ JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue
     return constructArray(exec, list);
 }
 
-JSValuePtr stringProtoFuncSearch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
 
     UString u = s;
     RefPtr<RegExp> reg;
-    if (a0->isObject(&RegExpObject::info))
+    if (a0.isObject(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else { 
         /*
@@ -467,7 +523,7 @@ JSValuePtr stringProtoFuncSearch(ExecState* exec, JSObject*, JSValuePtr thisValu
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = RegExp::create(&exec->globalData(), a0->toString(exec));
+        reg = RegExp::create(&exec->globalData(), a0.toString(exec));
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
@@ -476,17 +532,17 @@ JSValuePtr stringProtoFuncSearch(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNumber(exec, pos);
 }
 
-JSValuePtr stringProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     // The arg processing is very much like ArrayProtoFunc::Slice
-    double start = a0->toInteger(exec);
-    double end = a1->isUndefined() ? len : a1->toInteger(exec);
+    double start = a0.toInteger(exec);
+    double end = a1.isUndefined() ? len : a1.toInteger(exec);
     double from = start < 0 ? len + start : start;
     double to = end < 0 ? len + end : end;
     if (to > from && to > 0 && from < len) {
@@ -500,18 +556,18 @@ JSValuePtr stringProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue
     return jsEmptyString(exec);
 }
 
-JSValuePtr stringProtoFuncSplit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     JSArray* result = constructEmptyArray(exec);
     unsigned i = 0;
     int p0 = 0;
-    unsigned limit = a1->isUndefined() ? 0xFFFFFFFFU : a1->toUInt32(exec);
-    if (a0->isObject(&RegExpObject::info)) {
+    unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
+    if (a0.isObject(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
         if (s.isEmpty() && reg->match(s, 0) >= 0) {
             // empty string matched by regexp -> empty array
@@ -538,7 +594,7 @@ JSValuePtr stringProtoFuncSplit(ExecState* exec, JSObject*, JSValuePtr thisValue
             }
         }
     } else {
-        UString u2 = a0->toString(exec);
+        UString u2 = a0.toString(exec);
         if (u2.isEmpty()) {
             if (s.isEmpty()) {
                 // empty separator matches empty string -> empty array
@@ -562,16 +618,16 @@ JSValuePtr stringProtoFuncSplit(ExecState* exec, JSObject*, JSValuePtr thisValue
     return result;
 }
 
-JSValuePtr stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
-    double start = a0->toInteger(exec);
-    double length = a1->isUndefined() ? len : a1->toInteger(exec);
+    double start = a0.toInteger(exec);
+    double length = a1.isUndefined() ? len : a1.toInteger(exec);
     if (start >= len || length <= 0)
         return jsEmptyString(exec);
     if (start < 0) {
@@ -584,16 +640,16 @@ JSValuePtr stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsSubstring(exec, s, static_cast<unsigned>(start), static_cast<unsigned>(length));
 }
 
-JSValuePtr stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
-    double start = a0->toNumber(exec);
-    double end = a1->toNumber(exec);
+    double start = a0.toNumber(exec);
+    double end = a1.toNumber(exec);
     if (isnan(start))
         start = 0;
     if (isnan(end))
@@ -606,7 +662,7 @@ JSValuePtr stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValuePtr thisV
         start = len;
     if (end > len)
         end = len;
-    if (a1->isUndefined())
+    if (a1.isUndefined())
         end = len;
     if (start > end) {
         double temp = end;
@@ -616,9 +672,9 @@ JSValuePtr stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsSubstring(exec, s, static_cast<unsigned>(start), static_cast<unsigned>(end) - static_cast<unsigned>(start));
 }
 
-JSValuePtr stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSString* sVal = thisValue->toThisJSString(exec);
+    JSString* sVal = thisValue.toThisJSString(exec);
     const UString& s = sVal->value();
 
     int sSize = s.size();
@@ -650,9 +706,9 @@ JSValuePtr stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValuePtr thi
     return jsString(exec, UString(buffer.releaseBuffer(), length, false));
 }
 
-JSValuePtr stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSString* sVal = thisValue->toThisJSString(exec);
+    JSString* sVal = thisValue.toThisJSString(exec);
     const UString& s = sVal->value();
 
     int sSize = s.size();
@@ -684,96 +740,155 @@ JSValuePtr stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValuePtr thi
     return jsString(exec, UString(buffer.releaseBuffer(), length, false));
 }
 
-JSValuePtr stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (args.size() < 1)
       return jsNumber(exec, 0);
 
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsNumber(exec, localeCompare(s, a0->toString(exec)));
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    return jsNumber(exec, localeCompare(s, a0.toString(exec)));
 }
 
-JSValuePtr stringProtoFuncBig(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<big>" + s + "</big>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<big>" + s + "</big>");
 }
 
-JSValuePtr stringProtoFuncSmall(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<small>" + s + "</small>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<small>" + s + "</small>");
 }
 
-JSValuePtr stringProtoFuncBlink(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<blink>" + s + "</blink>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<blink>" + s + "</blink>");
 }
 
-JSValuePtr stringProtoFuncBold(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<b>" + s + "</b>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<b>" + s + "</b>");
 }
 
-JSValuePtr stringProtoFuncFixed(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     return jsString(exec, "<tt>" + s + "</tt>");
 }
 
-JSValuePtr stringProtoFuncItalics(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<i>" + s + "</i>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<i>" + s + "</i>");
 }
 
-JSValuePtr stringProtoFuncStrike(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<strike>" + s + "</strike>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<strike>" + s + "</strike>");
 }
 
-JSValuePtr stringProtoFuncSub(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<sub>" + s + "</sub>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<sub>" + s + "</sub>");
 }
 
-JSValuePtr stringProtoFuncSup(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<sup>" + s + "</sup>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<sup>" + s + "</sup>");
 }
 
-JSValuePtr stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<font color=\"" + a0->toString(exec) + "\">" + s + "</font>");
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    return jsNontrivialString(exec, "<font color=\"" + a0.toString(exec) + "\">" + s + "</font>");
 }
 
-JSValuePtr stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<font size=\"" + a0->toString(exec) + "\">" + s + "</font>");
-}
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
 
-JSValuePtr stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<a name=\"" + a0->toString(exec) + "\">" + s + "</a>");
-}
+    uint32_t smallInteger;
+    if (a0.getUInt32(smallInteger) && smallInteger <= 9) {
+        unsigned stringSize = s.size();
+        unsigned bufferSize = 22 + stringSize;
+        UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
+        if (!buffer)
+            return jsUndefined();
+        buffer[0] = '<';
+        buffer[1] = 'f';
+        buffer[2] = 'o';
+        buffer[3] = 'n';
+        buffer[4] = 't';
+        buffer[5] = ' ';
+        buffer[6] = 's';
+        buffer[7] = 'i';
+        buffer[8] = 'z';
+        buffer[9] = 'e';
+        buffer[10] = '=';
+        buffer[11] = '"';
+        buffer[12] = '0' + smallInteger;
+        buffer[13] = '"';
+        buffer[14] = '>';
+        memcpy(&buffer[15], s.data(), stringSize * sizeof(UChar));
+        buffer[15 + stringSize] = '<';
+        buffer[16 + stringSize] = '/';
+        buffer[17 + stringSize] = 'f';
+        buffer[18 + stringSize] = 'o';
+        buffer[19 + stringSize] = 'n';
+        buffer[20 + stringSize] = 't';
+        buffer[21 + stringSize] = '>';
+        return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+    }
 
-JSValuePtr stringProtoFuncLink(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<a href=\"" + a0->toString(exec) + "\">" + s + "</a>");
+    return jsNontrivialString(exec, "<font size=\"" + a0.toString(exec) + "\">" + s + "</font>");
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    return jsNontrivialString(exec, "<a name=\"" + a0.toString(exec) + "\">" + s + "</a>");
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    UString linkText = a0.toString(exec);
+
+    unsigned linkTextSize = linkText.size();
+    unsigned stringSize = s.size();
+    unsigned bufferSize = 15 + linkTextSize + stringSize;
+    UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
+    if (!buffer)
+        return jsUndefined();
+    buffer[0] = '<';
+    buffer[1] = 'a';
+    buffer[2] = ' ';
+    buffer[3] = 'h';
+    buffer[4] = 'r';
+    buffer[5] = 'e';
+    buffer[6] = 'f';
+    buffer[7] = '=';
+    buffer[8] = '"';
+    memcpy(&buffer[9], linkText.data(), linkTextSize * sizeof(UChar));
+    buffer[9 + linkTextSize] = '"';
+    buffer[10 + linkTextSize] = '>';
+    memcpy(&buffer[11 + linkTextSize], s.data(), stringSize * sizeof(UChar));
+    buffer[11 + linkTextSize + stringSize] = '<';
+    buffer[12 + linkTextSize + stringSize] = '/';
+    buffer[13 + linkTextSize + stringSize] = 'a';
+    buffer[14 + linkTextSize + stringSize] = '>';
+    return jsNontrivialString(exec, UString(buffer, bufferSize, false));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 5fcde7be38..3597a5cd7f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -65,15 +65,15 @@ static const unsigned newTableSize = 16;
 static WTF::RefCountedLeakCounter structureCounter("Structure");
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
-static Mutex ignoreSetMutex;
+static Mutex& ignoreSetMutex = *(new Mutex);
 #endif
 
 static bool shouldIgnoreLeaks;
-static HashSet<Structure*> ignoreSet;
+static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
 #endif
 
 #if DUMP_STRUCTURE_ID_STATISTICS
-static HashSet<Structure*> liveStructureSet;
+static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
 
 void Structure::dumpStatistics()
@@ -120,12 +120,10 @@ void Structure::dumpStatistics()
 #endif
 }
 
-Structure::Structure(JSValuePtr prototype, const TypeInfo& typeInfo)
+Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     : m_typeInfo(typeInfo)
     , m_prototype(prototype)
-    , m_cachedPrototypeChain(0)
-    , m_previous(0)
-    , m_nameInPrevious(0)
+    , m_specificValueInPrevious(0)
     , m_propertyTable(0)
     , m_propertyStorageCapacity(JSObject::inlineStorageCapacity)
     , m_offset(noOffset)
@@ -136,7 +134,7 @@ Structure::Structure(JSValuePtr prototype, const TypeInfo& typeInfo)
     , m_attributesInPrevious(0)
 {
     ASSERT(m_prototype);
-    ASSERT(m_prototype->isObject() || m_prototype->isNull());
+    ASSERT(m_prototype.isObject() || m_prototype.isNull());
 
     m_transitions.singleTransition = 0;
 
@@ -161,8 +159,8 @@ Structure::~Structure()
         if (m_previous->m_usingSingleTransitionSlot) {
             m_previous->m_transitions.singleTransition = 0;
         } else {
-            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), m_attributesInPrevious)));
-            m_previous->m_transitions.table->remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious));
+            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious))));
+            m_previous->m_transitions.table->remove(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious)));
         }
     }
 
@@ -178,6 +176,8 @@ Structure::~Structure()
             if (UString::Rep* key = m_propertyTable->entries()[i].key)
                 key->deref();
         }
+
+        delete m_propertyTable->deletedOffsets;
         fastFree(m_propertyTable);
     }
 
@@ -280,59 +280,34 @@ void Structure::materializePropertyMap()
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
         structure->m_nameInPrevious->ref();
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, ++m_propertyTable->lastIndexUsed); 
+        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
 
 void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
 {
-    bool shouldCache = propertyNames.cacheable() && !(propertyNames.size() || m_isDictionary);
+    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || m_isDictionary);
 
-    if (shouldCache) {
-        if (m_cachedPropertyNameArrayData) {
-            if (structureChainsAreEqual(m_cachedPropertyNameArrayData->cachedPrototypeChain(), cachedPrototypeChain())) {
-                propertyNames.setData(m_cachedPropertyNameArrayData);
-                return;
-            }
+    if (shouldCache && m_cachedPropertyNameArrayData) {
+        if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
+            propertyNames.setData(m_cachedPropertyNameArrayData);
+            return;
         }
-        propertyNames.setCacheable(false);
+        clearEnumerationCache();
     }
 
-    getEnumerablePropertyNamesInternal(propertyNames);
+    getEnumerableNamesFromPropertyTable(propertyNames);
+    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
 
-    // Add properties from the static hashtables of properties
-    for (const ClassInfo* info = baseObject->classInfo(); info; info = info->parentClass) {
-        const HashTable* table = info->propHashTable(exec);
-        if (!table)
-            continue;
-        table->initializeIfNeeded(exec);
-        ASSERT(table->table);
-#if ENABLE(PERFECT_HASH_SIZE)
-        int hashSizeMask = table->hashSizeMask;
-#else
-        int hashSizeMask = table->compactSize - 1;
-#endif
-        const HashEntry* entry = table->table;
-        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
-                propertyNames.add(entry->key());
-        }
-    }
-
-    if (m_prototype->isObject())
+    if (m_prototype.isObject()) {
+        propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
         asObject(m_prototype)->getPropertyNames(exec, propertyNames);
+    }
 
     if (shouldCache) {
-        if (m_cachedPropertyNameArrayData)
-            m_cachedPropertyNameArrayData->setCachedStructure(0);
-
         m_cachedPropertyNameArrayData = propertyNames.data();
-
-        StructureChain* chain = cachedPrototypeChain();
-        if (!chain)
-            chain = createCachedPrototypeChain();
-        m_cachedPropertyNameArrayData->setCachedPrototypeChain(chain);
+        m_cachedPropertyNameArrayData->setCachedPrototypeChain(prototypeChain(exec));
         m_cachedPropertyNameArrayData->setCachedStructure(this);
     }
 }
@@ -352,20 +327,69 @@ void Structure::growPropertyStorageCapacity()
         m_propertyStorageCapacity *= 2;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, size_t& offset)
+void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
+{
+    const UString::Rep* rep = propertyName._ustring.rep();
+
+    materializePropertyMapIfNecessary();
+
+    ASSERT(m_isDictionary);
+    ASSERT(m_propertyTable);
+
+    unsigned i = rep->computedHash();
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numProbes;
+#endif
+
+    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+    ASSERT(entryIndex != emptyEntryIndex);
+
+    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+        return;
+    }
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numCollisions;
+#endif
+
+    unsigned k = 1 | doubleHash(rep->computedHash());
+
+    while (1) {
+        i += k;
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numRehashes;
+#endif
+
+        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+        ASSERT(entryIndex != emptyEntryIndex);
+
+        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+            return;
+        }
+    }
+}
+
+PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->m_isDictionary);
     ASSERT(structure->typeInfo().type() == ObjectType);
 
     if (structure->m_usingSingleTransitionSlot) {
         Structure* existingTransition = structure->m_transitions.singleTransition;
-        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep() && existingTransition->m_attributesInPrevious == attributes) {
+        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep()
+            && existingTransition->m_attributesInPrevious == attributes
+            && existingTransition->m_specificValueInPrevious == specificValue) {
+
             ASSERT(structure->m_transitions.singleTransition->m_offset != noOffset);
             offset = structure->m_transitions.singleTransition->m_offset;
             return existingTransition;
         }
     } else {
-        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair(propertyName.ustring().rep(), attributes))) {
+        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)))) {
             ASSERT(existingTransition->m_offset != noOffset);
             offset = existingTransition->m_offset;
             return existingTransition;
@@ -375,25 +399,27 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     return 0;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, size_t& offset)
+PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->m_isDictionary);
     ASSERT(structure->typeInfo().type() == ObjectType);
-    ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, offset));
+    ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
 
     if (structure->transitionCount() > s_maxTransitionLength) {
         RefPtr<Structure> transition = toDictionaryTransition(structure);
-        offset = transition->put(propertyName, attributes);
+        offset = transition->put(propertyName, attributes, specificValue);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
         return transition.release();
     }
 
     RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
     transition->m_previous = structure;
     transition->m_nameInPrevious = propertyName.ustring().rep();
     transition->m_attributesInPrevious = attributes;
+    transition->m_specificValueInPrevious = specificValue;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
 
@@ -411,7 +437,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
             transition->createPropertyMapHashTable();
     }
 
-    offset = transition->put(propertyName, attributes);
+    offset = transition->put(propertyName, attributes, specificValue);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
         transition->growPropertyStorageCapacity();
 
@@ -427,9 +453,9 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
         structure->m_usingSingleTransitionSlot = false;
         StructureTransitionTable* transitionTable = new StructureTransitionTable;
         structure->m_transitions.table = transitionTable;
-        transitionTable->add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition);
+        transitionTable->add(make_pair(existingTransition->m_nameInPrevious.get(), make_pair(existingTransition->m_attributesInPrevious, existingTransition->m_specificValueInPrevious)), existingTransition);
     }
-    structure->m_transitions.table->add(make_pair(propertyName.ustring().rep(), attributes), transition.get());
+    structure->m_transitions.table->add(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)), transition.get());
     return transition.release();
 }
 
@@ -444,7 +470,7 @@ PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure,
     return transition.release();
 }
 
-PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValuePtr prototype)
+PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
 {
     RefPtr<Structure> transition = create(prototype, structure->typeInfo());
 
@@ -460,6 +486,25 @@ PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure,
     return transition.release();
 }
 
+PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
+{
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+
+    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
+    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+
+    // Don't set m_offset, as one can not transition to this.
+
+    structure->materializePropertyMapIfNecessary();
+    transition->m_propertyTable = structure->copyPropertyTable();
+    transition->m_isPinnedPropertyTable = true;
+
+    bool removed = transition->despecifyFunction(replaceFunction);
+    ASSERT_UNUSED(removed, removed);
+
+    return transition.release();
+}
+
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
     RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
@@ -507,14 +552,14 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
     return structure;
 }
 
-size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes)
+size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_transitions.singleTransition);
 
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
-    size_t offset = put(propertyName, attributes);
+    size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     clearEnumerationCache();
@@ -534,20 +579,6 @@ size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName
     return offset;
 }
 
-StructureChain* Structure::createCachedPrototypeChain()
-{
-    ASSERT(typeInfo().type() == ObjectType);
-    ASSERT(!m_cachedPrototypeChain);
-
-    JSValuePtr prototype = storedPrototype();
-    if (JSImmediate::isImmediate(prototype))
-        return 0;
-
-    RefPtr<StructureChain> chain = StructureChain::create(asObject(prototype)->structure());
-    setCachedPrototypeChain(chain.release());
-    return cachedPrototypeChain();
-}
-
 #if DUMP_PROPERTYMAP_STATS
 
 static int numProbes;
@@ -604,16 +635,12 @@ PropertyMapHashTable* Structure::copyPropertyTable()
     return newTable;
 }
 
-size_t Structure::get(const Identifier& propertyName, unsigned& attributes)
+size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& specificValue)
 {
-    ASSERT(!propertyName.isNull());
-
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
         return notFound;
 
-    UString::Rep* rep = propertyName._ustring.rep();
-
     unsigned i = rep->computedHash();
 
 #if DUMP_PROPERTYMAP_STATS
@@ -626,6 +653,7 @@ size_t Structure::get(const Identifier& propertyName, unsigned& attributes)
 
     if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
         attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
+        specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
         return m_propertyTable->entries()[entryIndex - 1].offset;
     }
 
@@ -648,12 +676,64 @@ size_t Structure::get(const Identifier& propertyName, unsigned& attributes)
 
         if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
             attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
+            specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
             return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
 }
 
-size_t Structure::put(const Identifier& propertyName, unsigned attributes)
+bool Structure::despecifyFunction(const Identifier& propertyName)
+{
+    ASSERT(!propertyName.isNull());
+
+    materializePropertyMapIfNecessary();
+    if (!m_propertyTable)
+        return false;
+
+    UString::Rep* rep = propertyName._ustring.rep();
+
+    unsigned i = rep->computedHash();
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numProbes;
+#endif
+
+    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+    if (entryIndex == emptyEntryIndex)
+        return false;
+
+    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+        ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
+        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+        return true;
+    }
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numCollisions;
+#endif
+
+    unsigned k = 1 | doubleHash(rep->computedHash());
+
+    while (1) {
+        i += k;
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numRehashes;
+#endif
+
+        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+        if (entryIndex == emptyEntryIndex)
+            return false;
+
+        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+            ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
+            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+            return true;
+        }
+    }
+}
+
+size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
     ASSERT(get(propertyName) == notFound);
@@ -723,6 +803,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes)
     rep->ref();
     m_propertyTable->entries()[entryIndex - 1].key = rep;
     m_propertyTable->entries()[entryIndex - 1].attributes = attributes;
+    m_propertyTable->entries()[entryIndex - 1].specificValue = specificValue;
     m_propertyTable->entries()[entryIndex - 1].index = ++m_propertyTable->lastIndexUsed;
 
     unsigned newOffset;
@@ -795,6 +876,7 @@ size_t Structure::remove(const Identifier& propertyName)
     key->deref();
     m_propertyTable->entries()[entryIndex - 1].key = 0;
     m_propertyTable->entries()[entryIndex - 1].attributes = 0;
+    m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
     m_propertyTable->entries()[entryIndex - 1].offset = 0;
 
     if (!m_propertyTable->deletedOffsets)
@@ -922,7 +1004,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerablePropertyNamesInternal(PropertyNameArray& propertyNames)
+void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyNames)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -979,6 +1061,25 @@ void Structure::getEnumerablePropertyNamesInternal(PropertyNameArray& propertyNa
     }
 }
 
+void Structure::getEnumerableNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+{
+    // Add properties from the static hashtables of properties
+    for (; classInfo; classInfo = classInfo->parentClass) {
+        const HashTable* table = classInfo->propHashTable(exec);
+        if (!table)
+            continue;
+        table->initializeIfNeeded(exec);
+        ASSERT(table->table);
+
+        int hashSizeMask = table->compactSize - 1;
+        const HashEntry* entry = table->table;
+        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
+            if (entry->key() && !(entry->attributes() & DontEnum))
+                propertyNames.add(entry->key());
+        }
+    }
+}
+
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
 
 void Structure::checkConsistency()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index c326b3f8d8..866999d319 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -51,7 +51,7 @@ namespace JSC {
     class Structure : public RefCounted<Structure> {
     public:
         friend class JIT;
-        static PassRefPtr<Structure> create(JSValuePtr prototype, const TypeInfo& typeInfo)
+        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
         {
             return adoptRef(new Structure(prototype, typeInfo));
         }
@@ -61,10 +61,11 @@ namespace JSC {
 
         static void dumpStatistics();
 
-        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, size_t& offset);
-        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, size_t& offset);
+        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
+        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
-        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValuePtr prototype);
+        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
+        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);        
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toDictionaryTransition(Structure*);
         static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
@@ -73,34 +74,38 @@ namespace JSC {
 
         void mark()
         {
-            if (!m_prototype->marked())
-                m_prototype->mark();
+            if (!m_prototype.marked())
+                m_prototype.mark();
         }
 
         // These should be used with caution.  
-        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes);
+        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
-        void setPrototypeWithoutTransition(JSValuePtr prototype) { m_prototype = prototype; }
+        void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
 
         bool isDictionary() const { return m_isDictionary; }
 
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
-        JSValuePtr storedPrototype() const { return m_prototype; }
-        JSValuePtr prototypeForLookup(ExecState*); 
+        JSValue storedPrototype() const { return m_prototype; }
+        JSValue prototypeForLookup(ExecState*) const;
+        StructureChain* prototypeChain(ExecState*) const;
 
         Structure* previousID() const { return m_previous.get(); }
 
-        StructureChain* createCachedPrototypeChain();
-        void setCachedPrototypeChain(PassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
-        StructureChain* cachedPrototypeChain() const { return m_cachedPrototypeChain.get(); }
-
         void growPropertyStorageCapacity();
         size_t propertyStorageCapacity() const { return m_propertyStorageCapacity; }
         size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
-        size_t get(const Identifier& propertyName, unsigned& attributes);
+        size_t get(const UString::Rep* rep, unsigned& attributes, JSCell*& specificValue);
+        size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
+        {
+            ASSERT(!propertyName.isNull());
+            return get(propertyName._ustring.rep(), attributes, specificValue);
+        }
+
         void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
@@ -108,12 +113,16 @@ namespace JSC {
 
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
+        JSCell* specificValue() { return m_specificValueInPrevious; }
+        void despecifyDictionaryFunction(const Identifier& propertyName);
+
     private:
-        Structure(JSValuePtr prototype, const TypeInfo&);
+        Structure(JSValue prototype, const TypeInfo&);
 
-        size_t put(const Identifier& propertyName, unsigned attributes);
+        size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
-        void getEnumerablePropertyNamesInternal(PropertyNameArray&);
+        void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
+        void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -123,6 +132,8 @@ namespace JSC {
         void insertIntoPropertyMapHashTable(const PropertyMapEntry&);
         void checkConsistency();
 
+        bool despecifyFunction(const Identifier&);
+
         PropertyMapHashTable* copyPropertyTable();
         void materializePropertyMap();
         void materializePropertyMapIfNecessary()
@@ -134,16 +145,13 @@ namespace JSC {
 
         void clearEnumerationCache();
 
-        void* addressOfCount()
-        {
-            return &m_refCount;
-        }
-
         signed char transitionCount() const
         {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
             return m_offset == noOffset ? 0 : m_offset + 1;
         }
+        
+        bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
         static const unsigned emptyEntryIndex = 0;
     
@@ -153,8 +161,8 @@ namespace JSC {
 
         TypeInfo m_typeInfo;
 
-        JSValuePtr m_prototype;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
+        JSValue m_prototype;
+        mutable RefPtr<StructureChain> m_cachedPrototypeChain;
 
         RefPtr<Structure> m_previous;
         RefPtr<UString::Rep> m_nameInPrevious;
@@ -163,6 +171,7 @@ namespace JSC {
             Structure* singleTransition;
             StructureTransitionTable* table;
         } m_transitions;
+        JSCell* m_specificValueInPrevious;
 
         RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
 
@@ -175,7 +184,7 @@ namespace JSC {
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
         bool m_usingSingleTransitionSlot : 1;
-        unsigned m_attributesInPrevious : 5;
+        unsigned m_attributesInPrevious : 7;
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
index 84c67c3dec..085876c496 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
@@ -32,42 +32,18 @@
 
 namespace JSC {
 
-StructureChain::StructureChain(Structure* structure)
+StructureChain::StructureChain(Structure* head)
 {
-    size_t size = 1;
-
-    Structure* tmp = structure;
-    while (!tmp->storedPrototype()->isNull()) {
+    size_t size = 0;
+    for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
         ++size;
-        tmp = asCell(tmp->storedPrototype())->structure();
-    }
     
     m_vector.set(new RefPtr<Structure>[size + 1]);
 
-    size_t i;
-    for (i = 0; i < size - 1; ++i) {
-        m_vector[i] = structure;
-        structure = asObject(structure->storedPrototype())->structure();
-    }
-    m_vector[i] = structure;
-    m_vector[i + 1] = 0;
-}
-
-bool structureChainsAreEqual(StructureChain* chainA, StructureChain* chainB)
-{
-    if (!chainA || !chainB)
-        return false;
-
-    RefPtr<Structure>* a = chainA->head();
-    RefPtr<Structure>* b = chainB->head();
-    while (1) {
-        if (*a != *b)
-            return false;
-        if (!*a)
-            return true;
-        a++;
-        b++;
-    }
+    size_t i = 0;
+    for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
+        m_vector[i++] = current;
+    m_vector[i] = 0;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
index a3a1be2802..795e6494a7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
@@ -37,18 +37,15 @@ namespace JSC {
 
     class StructureChain : public RefCounted<StructureChain> {
     public:
-        static PassRefPtr<StructureChain> create(Structure* structure) { return adoptRef(new StructureChain(structure)); }
-
+        static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
         RefPtr<Structure>* head() { return m_vector.get(); }
 
     private:
-        StructureChain(Structure* structure);
+        StructureChain(Structure* head);
 
         OwnArrayPtr<RefPtr<Structure> > m_vector;
     };
 
-    bool structureChainsAreEqual(StructureChain*, StructureChain*);
-
 } // namespace JSC
 
 #endif // StructureChain_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
index 154304963a..804cbeb1de 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -37,7 +37,7 @@ namespace JSC {
     class Structure;
 
     struct StructureTransitionTableHash {
-        typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
+        typedef std::pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> > Key;
         static unsigned hash(const Key& p)
         {
             return p.first->computedHash();
@@ -53,13 +53,14 @@ namespace JSC {
 
     struct StructureTransitionTableHashTraits {
         typedef WTF::HashTraits<RefPtr<UString::Rep> > FirstTraits;
-        typedef WTF::GenericHashTraits<unsigned> SecondTraits;
-        typedef std::pair<FirstTraits::TraitType, SecondTraits::TraitType> TraitType;
+        typedef WTF::GenericHashTraits<unsigned> SecondFirstTraits;
+        typedef WTF::GenericHashTraits<JSCell*> SecondSecondTraits;
+        typedef std::pair<FirstTraits::TraitType, std::pair<SecondFirstTraits::TraitType, SecondSecondTraits::TraitType> > TraitType;
 
-        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondTraits::emptyValueIsZero;
-        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
+        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondFirstTraits::emptyValueIsZero && SecondSecondTraits::emptyValueIsZero;
+        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), std::make_pair(SecondFirstTraits::emptyValue(), SecondSecondTraits::emptyValue())); }
 
-        static const bool needsDestruction = FirstTraits::needsDestruction || SecondTraits::needsDestruction;
+        static const bool needsDestruction = FirstTraits::needsDestruction || SecondFirstTraits::needsDestruction || SecondSecondTraits::needsDestruction;
 
         static void constructDeletedValue(TraitType& slot) { FirstTraits::constructDeletedValue(slot.first); }
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
new file mode 100644
index 0000000000..30ba6e9bb4
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TimeoutChecker.h"
+
+#include "CallFrame.h"
+#include "JSGlobalObject.h"
+
+#if PLATFORM(DARWIN)
+#include <mach/mach.h>
+#endif
+
+#if HAVE(SYS_TIME_H)
+#include <sys/time.h>
+#endif
+
+#if PLATFORM(WIN_OS)
+#include <windows.h>
+#endif
+
+#if PLATFORM(QT)
+#include <QDateTime>
+#endif
+
+using namespace std;
+
+namespace JSC {
+
+// Number of ticks before the first timeout check is done.
+static const int ticksUntilFirstCheck = 1024;
+
+// Number of milliseconds between each timeout check.
+static const int intervalBetweenChecks = 1000;
+
+// Returns the time the current thread has spent executing, in milliseconds.
+static inline unsigned getCPUTime()
+{
+#if PLATFORM(DARWIN)
+    mach_msg_type_number_t infoCount = THREAD_BASIC_INFO_COUNT;
+    thread_basic_info_data_t info;
+
+    // Get thread information
+    mach_port_t threadPort = mach_thread_self();
+    thread_info(threadPort, THREAD_BASIC_INFO, reinterpret_cast<thread_info_t>(&info), &infoCount);
+    mach_port_deallocate(mach_task_self(), threadPort);
+    
+    unsigned time = info.user_time.seconds * 1000 + info.user_time.microseconds / 1000;
+    time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
+    
+    return time;
+#elif HAVE(SYS_TIME_H)
+    // FIXME: This should probably use getrusage with the RUSAGE_THREAD flag.
+    struct timeval tv;
+    gettimeofday(&tv, 0);
+    return tv.tv_sec * 1000 + tv.tv_usec / 1000;
+#elif PLATFORM(QT)
+    QDateTime t = QDateTime::currentDateTime();
+    return t.toTime_t() * 1000 + t.time().msec();
+#elif PLATFORM(WIN_OS)
+    union {
+        FILETIME fileTime;
+        unsigned long long fileTimeAsLong;
+    } userTime, kernelTime;
+    
+    // GetThreadTimes won't accept NULL arguments so we pass these even though
+    // they're not used.
+    FILETIME creationTime, exitTime;
+    
+    GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
+    
+    return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
+#else
+#error Platform does not have getCurrentTime function
+#endif
+}
+
+TimeoutChecker::TimeoutChecker()
+    : m_timeoutInterval(0)
+    , m_startCount(0)
+{
+    reset();
+}
+
+void TimeoutChecker::reset()
+{
+    m_ticksUntilNextCheck = ticksUntilFirstCheck;
+    m_timeAtLastCheck = 0;
+    m_timeExecuting = 0;
+}
+
+bool TimeoutChecker::didTimeOut(ExecState* exec)
+{
+    unsigned currentTime = getCPUTime();
+    
+    if (!m_timeAtLastCheck) {
+        // Suspicious amount of looping in a script -- start timing it
+        m_timeAtLastCheck = currentTime;
+        return false;
+    }
+    
+    unsigned timeDiff = currentTime - m_timeAtLastCheck;
+    
+    if (timeDiff == 0)
+        timeDiff = 1;
+    
+    m_timeExecuting += timeDiff;
+    m_timeAtLastCheck = currentTime;
+    
+    // Adjust the tick threshold so we get the next checkTimeout call in the
+    // interval specified in intervalBetweenChecks.
+    m_ticksUntilNextCheck = static_cast<unsigned>((static_cast<float>(intervalBetweenChecks) / timeDiff) * m_ticksUntilNextCheck);
+    // If the new threshold is 0 reset it to the default threshold. This can happen if the timeDiff is higher than the
+    // preferred script check time interval.
+    if (m_ticksUntilNextCheck == 0)
+        m_ticksUntilNextCheck = ticksUntilFirstCheck;
+    
+    if (m_timeoutInterval && m_timeExecuting > m_timeoutInterval) {
+        if (exec->dynamicGlobalObject()->shouldInterruptScript())
+            return true;
+        
+        reset();
+    }
+    
+    return false;
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
new file mode 100644
index 0000000000..7bfa6d0830
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TimeoutChecker_h
+#define TimeoutChecker_h
+
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+    class ExecState;
+
+    class TimeoutChecker {
+    public:
+        TimeoutChecker();
+
+        void setTimeoutInterval(unsigned timeoutInterval) { m_timeoutInterval = timeoutInterval; }
+        
+        unsigned ticksUntilNextCheck() { return m_ticksUntilNextCheck; }
+        
+        void start()
+        {
+            if (!m_startCount)
+                reset();
+            ++m_startCount;
+        }
+
+        void stop()
+        {
+            ASSERT(m_startCount);
+            --m_startCount;
+        }
+
+        void reset();
+
+        bool didTimeOut(ExecState*);
+
+    private:
+        unsigned m_timeoutInterval;
+        unsigned m_timeAtLastCheck;
+        unsigned m_timeExecuting;
+        unsigned m_startCount;
+        unsigned m_ticksUntilNextCheck;
+    };
+
+} // namespace JSC
+
+#endif // TimeoutChecker_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h
index 52da34786e..70aeed33e9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h
@@ -35,13 +35,22 @@ namespace JSC {
     static const unsigned MasqueradesAsUndefined = 1;
     static const unsigned ImplementsHasInstance = 1 << 1;
     static const unsigned OverridesHasInstance = 1 << 2;
-    static const unsigned NeedsThisConversion = 1 << 3;
-    static const unsigned HasStandardGetOwnPropertySlot = 1 << 4;
+    static const unsigned ImplementsDefaultHasInstance = 1 << 3;
+    static const unsigned NeedsThisConversion = 1 << 4;
+    static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
 
     class TypeInfo {
         friend class JIT;
     public:
-        TypeInfo(JSType type, unsigned flags = 0) : m_type(type), m_flags(flags) { }
+        TypeInfo(JSType type, unsigned flags = 0)
+            : m_type(type)
+        {
+            // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
+            if ((flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
+                m_flags = flags | ImplementsDefaultHasInstance;
+            else
+                m_flags = flags;
+        }
 
         JSType type() const { return m_type; }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
index 45df248448..0eb46da5a9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
@@ -1,7 +1,8 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -61,6 +62,9 @@ namespace JSC {
 extern const double NaN;
 extern const double Inf;
 
+// This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
+static const int minLengthToShare = 30;
+
 static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
 static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
 
@@ -92,7 +96,7 @@ static inline void copyChars(UChar* destination, const UChar* source, unsigned n
     memcpy(destination, source, numCharacters * sizeof(UChar));
 }
 
-COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes)
+COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes);
 
 CString::CString(const char* c)
     : m_length(strlen(c))
@@ -186,86 +190,59 @@ bool operator==(const CString& c1, const CString& c2)
 // These static strings are immutable, except for rc, whose initial value is chosen to 
 // reduce the possibility of it becoming zero due to ref/deref not being thread-safe.
 static UChar sharedEmptyChar;
-UString::Rep UString::Rep::null = { 0, 0, INT_MAX / 2, 0, 1, &UString::Rep::null, 0, 0, 0, 0, 0, 0 };
-UString::Rep UString::Rep::empty = { 0, 0, INT_MAX / 2, 0, 1, &UString::Rep::empty, 0, &sharedEmptyChar, 0, 0, 0, 0 };
-
-static char* statBuffer = 0; // Only used for debugging via UString::ascii().
+UString::BaseString* UString::Rep::nullBaseString;
+UString::BaseString* UString::Rep::emptyBaseString;
+UString* UString::nullUString;
 
-PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
+static void initializeStaticBaseString(UString::BaseString& base)
 {
-    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
-    copyChars(copyD, d, l);
-    return create(copyD, l);
+    base.rc = INT_MAX / 2;
+    base.m_identifierTableAndFlags.setFlag(UString::Rep::StaticFlag);
+    base.checkConsistency();
 }
 
-PassRefPtr<UString::Rep> UString::Rep::create(UChar* d, int l)
+void initializeUString()
 {
-    Rep* r = new Rep;
-    r->offset = 0;
-    r->len = l;
-    r->rc = 1;
-    r->_hash = 0;
-    r->m_identifierTable = 0;
-    r->baseString = r;
-    r->reportedCost = 0;
-    r->buf = d;
-    r->usedCapacity = l;
-    r->capacity = l;
-    r->usedPreCapacity = 0;
-    r->preCapacity = 0;
+    UString::Rep::nullBaseString = new UString::BaseString(0, 0);
+    initializeStaticBaseString(*UString::Rep::nullBaseString);
 
-    r->checkConsistency();
+    UString::Rep::emptyBaseString = new UString::BaseString(&sharedEmptyChar, 0);
+    initializeStaticBaseString(*UString::Rep::emptyBaseString);
 
-    // steal the single reference this Rep was created with
-    return adoptRef(r);
+    UString::nullUString = new UString;
 }
 
-PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<Rep> base, int offset, int length)
-{
-    ASSERT(base);
-    base->checkConsistency();
-
-    int baseOffset = base->offset;
-
-    base = base->baseString;
-
-    ASSERT(-(offset + baseOffset) <= base->usedPreCapacity);
-    ASSERT(offset + baseOffset + length <= base->usedCapacity);
-
-    Rep* r = new Rep;
-    r->offset = baseOffset + offset;
-    r->len = length;
-    r->rc = 1;
-    r->_hash = 0;
-    r->m_identifierTable = 0;
-    r->baseString = base.releaseRef();
-    r->reportedCost = 0;
-    r->buf = 0;
-    r->usedCapacity = 0;
-    r->capacity = 0;
-    r->usedPreCapacity = 0;
-    r->preCapacity = 0;
-
-    r->checkConsistency();
+static char* statBuffer = 0; // Only used for debugging via UString::ascii().
 
-    // steal the single reference this Rep was created with
-    return adoptRef(r);
+PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
+{
+    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
+    copyChars(copyD, d, l);
+    return create(copyD, l);
 }
 
 PassRefPtr<UString::Rep> UString::Rep::createFromUTF8(const char* string)
 {
     if (!string)
-        return &UString::Rep::null;
+        return &UString::Rep::null();
 
     size_t length = strlen(string);
     Vector<UChar, 1024> buffer(length);
     UChar* p = buffer.data();
     if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
-        return &UString::Rep::null;
+        return &UString::Rep::null();
 
     return UString::Rep::createCopying(buffer.data(), p - buffer.data());
 }
 
+PassRefPtr<UString::Rep> UString::Rep::create(UChar* string, int length, PassRefPtr<UString::SharedUChar> sharedBuffer)
+{
+    PassRefPtr<UString::Rep> rep = create(string, length);
+    rep->baseString()->setSharedBuffer(sharedBuffer);
+    rep->checkConsistency();
+    return rep;
+}
+
 void UString::Rep::destroy()
 {
     checkConsistency();
@@ -275,10 +252,15 @@ void UString::Rep::destroy()
     if (!isStatic()) {
         if (identifierTable())
             Identifier::remove(this);
-        if (baseString == this)
-            fastFree(buf);
-        else
-            baseString->deref();
+
+        UString::BaseString* base = baseString();
+        if (base == this) {
+            if (m_sharedBuffer)
+                m_sharedBuffer->deref();
+            else
+                fastFree(base->buf);
+        } else
+            base->deref();
 
         delete this;
     }
@@ -380,17 +362,10 @@ unsigned UString::Rep::computeHash(const char* s, int l)
 #ifndef NDEBUG
 void UString::Rep::checkConsistency() const
 {
-    // Only base strings have non-zero shared data.
-    if (this != baseString) {
-        ASSERT(!buf);
-        ASSERT(!usedCapacity);
-        ASSERT(!capacity);
-        ASSERT(!usedPreCapacity);
-        ASSERT(!preCapacity);
-    }
+    const UString::BaseString* base = baseString();
 
     // There is no recursion for base strings.
-    ASSERT(baseString == baseString->baseString);
+    ASSERT(base == base->baseString());
 
     if (isStatic()) {
         // There are only two static strings: null and empty.
@@ -401,63 +376,148 @@ void UString::Rep::checkConsistency() const
     }
 
     // The string fits in buffer.
-    ASSERT(baseString->usedPreCapacity <= baseString->preCapacity);
-    ASSERT(baseString->usedCapacity <= baseString->capacity);
-    ASSERT(-offset <= baseString->usedPreCapacity);
-    ASSERT(offset + len <= baseString->usedCapacity);
+    ASSERT(base->usedPreCapacity <= base->preCapacity);
+    ASSERT(base->usedCapacity <= base->capacity);
+    ASSERT(-offset <= base->usedPreCapacity);
+    ASSERT(offset + len <= base->usedCapacity);
 }
 #endif
 
-// put these early so they can be inlined
-static inline size_t expandedSize(size_t size, size_t otherSize)
+UString::SharedUChar* UString::BaseString::sharedBuffer()
 {
-    // Do the size calculation in two parts, returning overflowIndicator if
-    // we overflow the maximum value that we can handle.
 
-    if (size > maxUChars())
-        return overflowIndicator();
-
-    size_t expandedSize = ((size + 10) / 10 * 11) + 1;
-    if (maxUChars() - expandedSize < otherSize)
-        return overflowIndicator();
+    if (len < minLengthToShare)
+        return 0;
 
-    return expandedSize + otherSize;
+    if (!m_sharedBuffer)
+        setSharedBuffer(SharedUChar::create(new OwnFastMallocPtr<UChar>(buf)));
+    return m_sharedBuffer;
 }
 
-inline int UString::usedCapacity() const
+void UString::BaseString::setSharedBuffer(PassRefPtr<UString::SharedUChar> sharedBuffer)
 {
-    return m_rep->baseString->usedCapacity;
+    // The manual steps below are because m_sharedBuffer can't be a RefPtr. m_sharedBuffer
+    // is in a union with another variable to avoid making BaseString any larger.
+    if (m_sharedBuffer)
+        m_sharedBuffer->deref();
+    m_sharedBuffer = sharedBuffer.releaseRef();
 }
 
-inline int UString::usedPreCapacity() const
+bool UString::BaseString::slowIsBufferReadOnly()
 {
-    return m_rep->baseString->usedPreCapacity;
+    // The buffer may not be modified as soon as the underlying data has been shared with another class.
+    if (m_sharedBuffer->isShared())
+        return true;
+
+    // At this point, we know it that the underlying buffer isn't shared outside of this base class,
+    // so get rid of m_sharedBuffer.
+    OwnPtr<OwnFastMallocPtr<UChar> > mallocPtr(m_sharedBuffer->release());
+    UChar* unsharedBuf = const_cast<UChar*>(mallocPtr->release());
+    setSharedBuffer(0);
+    preCapacity += (buf - unsharedBuf);
+    buf = unsharedBuf;
+    return false;
 }
 
+// Put these early so they can be inlined.
+static inline size_t expandedSize(size_t capacitySize, size_t precapacitySize)
+{
+    // Combine capacitySize & precapacitySize to produce a single size to allocate,
+    // check that doing so does not result in overflow.
+    size_t size = capacitySize + precapacitySize;
+    if (size < capacitySize)
+        return overflowIndicator();
+
+    // Small Strings (up to 4 pages):
+    // Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
+    // to our previous policy, however 112.5% is cheaper to calculate.
+    if (size < 0x4000) {
+        size_t expandedSize = ((size + (size >> 3)) | 15) + 1;
+        // Given the limited range within which we calculate the expansion in this
+        // fashion the above calculation should never overflow.
+        ASSERT(expandedSize >= size);
+        ASSERT(expandedSize < maxUChars());
+        return expandedSize;
+    }
+
+    // Medium Strings (up to 128 pages):
+    // For pages covering multiple pages over-allocation is less of a concern - any unused
+    // space will not be paged in if it is not used, so this is purely a VM overhead.  For
+    // these strings allocate 2x the requested size.
+    if (size < 0x80000) {
+        size_t expandedSize = ((size + size) | 0xfff) + 1;
+        // Given the limited range within which we calculate the expansion in this
+        // fashion the above calculation should never overflow.
+        ASSERT(expandedSize >= size);
+        ASSERT(expandedSize < maxUChars());
+        return expandedSize;
+    }
+
+    // Large Strings (to infinity and beyond!):
+    // Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
+    // any individual string be responsible for.
+    size_t expandedSize = ((size + (size >> 3)) | 0xfff) + 1;
+
+    // Check for overflow - any result that is at least as large as requested (but
+    // still below the limit) is okay.
+    if ((expandedSize >= size) && (expandedSize < maxUChars()))
+        return expandedSize;
+    return overflowIndicator();
+}
 
 static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
 {
     rep->checkConsistency();
+    ASSERT(!rep->baseString()->isBufferReadOnly());
 
-    UString::Rep* r = rep->baseString;
+    UString::BaseString* base = rep->baseString();
 
-    if (requiredLength > r->capacity) {
-        size_t newCapacity = expandedSize(requiredLength, r->preCapacity);
-        UChar* oldBuf = r->buf;
-        r->buf = reallocChars(r->buf, newCapacity);
-        if (!r->buf) {
-            r->buf = oldBuf;
+    if (requiredLength > base->capacity) {
+        size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
+        UChar* oldBuf = base->buf;
+        base->buf = reallocChars(base->buf, newCapacity);
+        if (!base->buf) {
+            base->buf = oldBuf;
             return false;
         }
-        r->capacity = newCapacity - r->preCapacity;
+        base->capacity = newCapacity - base->preCapacity;
     }
-    if (requiredLength > r->usedCapacity)
-        r->usedCapacity = requiredLength;
+    if (requiredLength > base->usedCapacity)
+        base->usedCapacity = requiredLength;
 
     rep->checkConsistency();
     return true;
 }
 
+bool UString::Rep::reserveCapacity(int capacity)
+{
+    // If this is an empty string there is no point 'growing' it - just allocate a new one.
+    // If the BaseString is shared with another string that is using more capacity than this
+    // string is, then growing the buffer won't help.
+    // If the BaseString's buffer is readonly, then it isn't allowed to grow.
+    UString::BaseString* base = baseString();
+    if (!base->buf || !base->capacity || (offset + len) != base->usedCapacity || base->isBufferReadOnly())
+        return false;
+    
+    // If there is already sufficient capacity, no need to grow!
+    if (capacity <= base->capacity)
+        return true;
+
+    checkConsistency();
+
+    size_t newCapacity = expandedSize(capacity, base->preCapacity);
+    UChar* oldBuf = base->buf;
+    base->buf = reallocChars(base->buf, newCapacity);
+    if (!base->buf) {
+        base->buf = oldBuf;
+        return false;
+    }
+    base->capacity = newCapacity - base->preCapacity;
+
+    checkConsistency();
+    return true;
+}
+
 void UString::expandCapacity(int requiredLength)
 {
     if (!JSC::expandCapacity(m_rep.get(), requiredLength))
@@ -467,42 +527,43 @@ void UString::expandCapacity(int requiredLength)
 void UString::expandPreCapacity(int requiredPreCap)
 {
     m_rep->checkConsistency();
+    ASSERT(!m_rep->baseString()->isBufferReadOnly());
 
-    Rep* r = m_rep->baseString;
+    BaseString* base = m_rep->baseString();
 
-    if (requiredPreCap > r->preCapacity) {
-        size_t newCapacity = expandedSize(requiredPreCap, r->capacity);
-        int delta = newCapacity - r->capacity - r->preCapacity;
+    if (requiredPreCap > base->preCapacity) {
+        size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
+        int delta = newCapacity - base->capacity - base->preCapacity;
 
         UChar* newBuf = allocChars(newCapacity);
         if (!newBuf) {
             makeNull();
             return;
         }
-        copyChars(newBuf + delta, r->buf, r->capacity + r->preCapacity);
-        fastFree(r->buf);
-        r->buf = newBuf;
+        copyChars(newBuf + delta, base->buf, base->capacity + base->preCapacity);
+        fastFree(base->buf);
+        base->buf = newBuf;
 
-        r->preCapacity = newCapacity - r->capacity;
+        base->preCapacity = newCapacity - base->capacity;
     }
-    if (requiredPreCap > r->usedPreCapacity)
-        r->usedPreCapacity = requiredPreCap;
+    if (requiredPreCap > base->usedPreCapacity)
+        base->usedPreCapacity = requiredPreCap;
 
     m_rep->checkConsistency();
 }
 
-PassRefPtr<UString::Rep> createRep(const char* c)
+static PassRefPtr<UString::Rep> createRep(const char* c)
 {
     if (!c)
-        return &UString::Rep::null;
+        return &UString::Rep::null();
 
     if (!c[0])
-        return &UString::Rep::empty;
+        return &UString::Rep::empty();
 
     size_t length = strlen(c);
     UChar* d = allocChars(length);
     if (!d)
-        return &UString::Rep::null;
+        return &UString::Rep::null();
     else {
         for (size_t i = 0; i < length; i++)
             d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
@@ -519,7 +580,7 @@ UString::UString(const char* c)
 UString::UString(const UChar* c, int length)
 {
     if (length == 0) 
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
     else
         m_rep = Rep::createCopying(c, length);
 }
@@ -527,7 +588,7 @@ UString::UString(const UChar* c, int length)
 UString::UString(UChar* c, int length, bool copy)
 {
     if (length == 0)
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
     else if (copy)
         m_rep = Rep::createCopying(c, length);
     else
@@ -537,11 +598,22 @@ UString::UString(UChar* c, int length, bool copy)
 UString::UString(const Vector<UChar>& buffer)
 {
     if (!buffer.size())
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
     else
         m_rep = Rep::createCopying(buffer.data(), buffer.size());
 }
 
+static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
+{
+    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
+
+    const int plusLength = plusOne ? 1 : 0;
+    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
+        CRASH();
+
+    return currentCapacity + extendLength + plusLength;
+}
+
 static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
 {
     RefPtr<UString::Rep> rep = r;
@@ -551,6 +623,7 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     int thisSize = rep->size();
     int thisOffset = rep->offset;
     int length = thisSize + tSize;
+    UString::BaseString* base = rep->baseString();
 
     // possible cases:
     if (tSize == 0) {
@@ -558,34 +631,34 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     } else if (thisSize == 0) {
         // this is empty
         rep = UString::Rep::createCopying(tData, tSize);
-    } else if (rep->baseIsSelf() && rep->rc == 1) {
+    } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), thisOffset + length))
-            rep = &UString::Rep::null;
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
+            rep = &UString::Rep::null();
         if (rep->data()) {
             copyChars(rep->data() + thisSize, tData, tSize);
             rep->len = length;
             rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == rep->baseString->usedCapacity && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), thisOffset + length))
-            rep = &UString::Rep::null;
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
+            rep = &UString::Rep::null();
         if (rep->data()) {
             copyChars(rep->data() + thisSize, tData, tSize);
             rep = UString::Rep::create(rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
-            rep = &UString::Rep::null;
+            rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
             copyChars(d + thisSize, tData, tSize);
             rep = UString::Rep::create(d, length);
-            rep->capacity = newCapacity;
+            rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -604,6 +677,7 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     int thisOffset = rep->offset;
     int tSize = static_cast<int>(strlen(t));
     int length = thisSize + tSize;
+    UString::BaseString* base = rep->baseString();
 
     // possible cases:
     if (thisSize == 0) {
@@ -611,9 +685,9 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
         rep = createRep(t);
     } else if (tSize == 0) {
         // t is empty, we'll just return *this below.
-    } else if (rep->baseIsSelf() && rep->rc == 1) {
+    } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), thisOffset + length);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
             for (int i = 0; i < tSize; ++i)
@@ -621,9 +695,9 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
             rep->len = length;
             rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == rep->baseString->usedCapacity && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), thisOffset + length);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
             for (int i = 0; i < tSize; ++i)
@@ -631,17 +705,17 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
             rep = UString::Rep::create(rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
-            rep = &UString::Rep::null;
+            rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
             for (int i = 0; i < tSize; ++i)
                 d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
             rep = UString::Rep::create(d, length);
-            rep->capacity = newCapacity;
+            rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -656,13 +730,19 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
     b->checkConsistency();
 
     int aSize = a->size();
-    int aOffset = a->offset;
     int bSize = b->size();
-    int bOffset = b->offset;
-    int length = aSize + bSize;
+    int aOffset = a->offset;
 
     // possible cases:
 
+    UString::BaseString* aBase = a->baseString();
+    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + aSize < aBase->capacity && !aBase->isBufferReadOnly()) {
+        // b is a single character (common fast case)
+        ++aBase->usedCapacity;
+        a->data()[aSize] = b->data()[0];
+        return UString::Rep::create(a, 0, aSize + 1);
+    }
+
     // a is empty
     if (aSize == 0)
         return b;
@@ -670,21 +750,19 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
     if (bSize == 0)
         return a;
 
-    if (bSize == 1 && aOffset + aSize == a->baseString->usedCapacity && aOffset + length <= a->baseString->capacity) {
-        // b is a single character (common fast case)
-        a->baseString->usedCapacity = aOffset + length;
-        a->data()[aSize] = b->data()[0];
-        return UString::Rep::create(a, 0, length);
-    }
+    int bOffset = b->offset;
+    int length = aSize + bSize;
 
-    if (aOffset + aSize == a->baseString->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize &&
-               (-bOffset != b->baseString->usedPreCapacity || aSize >= bSize)) {
+    UString::BaseString* bBase = b->baseString();
+    if (aOffset + aSize == aBase->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize
+        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize) && !aBase->isBufferReadOnly()) {
         // - a reaches the end of its buffer so it qualifies for shared append
         // - also, it's at least a quarter the length of b - appending to a much shorter
         //   string does more harm than good
         // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
+        
         UString x(a);
-        x.expandCapacity(aOffset + length);
+        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
         if (!a->data() || !x.data())
             return 0;
         copyChars(a->data() + aSize, b->data(), bSize);
@@ -697,7 +775,7 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
         return result;
     }
 
-    if (-bOffset == b->baseString->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize) {
+    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize && !bBase->isBufferReadOnly()) {
         // - b reaches the beginning of its buffer so it qualifies for shared prepend
         // - also, it's at least a quarter the length of a - prepending to a much shorter
         //   string does more harm than good
@@ -723,7 +801,7 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
     copyChars(d, a->data(), aSize);
     copyChars(d + aSize, b->data(), bSize);
     PassRefPtr<UString::Rep> result = UString::Rep::create(d, length);
-    result->capacity = newCapacity;
+    result->baseString()->capacity = newCapacity;
 
     a->checkConsistency();
     b->checkConsistency();
@@ -775,7 +853,8 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
     int decimalPoint;
     int sign;
 
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     int length = static_cast<int>(strlen(result));
   
     int i = 0;
@@ -826,15 +905,7 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
         buf[i++] = '\0';
     }
     
-  WTF::freedtoa(result);
-
-  return concatenate(rep, buf);
-}
-
-const UString& UString::null()
-{
-    static UString* n = new UString; // Should be called from main thread at least once to be safely initialized.
-    return *n;
+    return concatenate(rep, buf);
 }
 
 UString UString::from(int i)
@@ -922,8 +993,9 @@ UString UString::from(double d)
     char buf[80];
     int decimalPoint;
     int sign;
-
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     int length = static_cast<int>(strlen(result));
   
     int i = 0;
@@ -974,9 +1046,7 @@ UString UString::from(double d)
         buf[i++] = '\0';
     }
     
-  WTF::freedtoa(result);
-
-  return UString(buf);
+    return UString(buf);
 }
 
 UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const
@@ -1021,6 +1091,28 @@ UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, in
     return UString::Rep::create(buffer, totalLength);
 }
 
+UString UString::replaceRange(int rangeStart, int rangeLength, const UString& replacement) const
+{
+    m_rep->checkConsistency();
+
+    int replacementLength = replacement.size();
+    int totalLength = size() - rangeLength + replacementLength;
+    if (totalLength == 0)
+        return "";
+
+    UChar* buffer = allocChars(totalLength);
+    if (!buffer)
+        return null();
+
+    copyChars(buffer, data(), rangeStart);
+    copyChars(buffer + rangeStart, replacement.data(), replacementLength);
+    int rangeEnd = rangeStart + rangeLength;
+    copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
+
+    return UString::Rep::create(buffer, totalLength);
+}
+
+
 UString& UString::append(const UString &t)
 {
     m_rep->checkConsistency();
@@ -1030,6 +1122,7 @@ UString& UString::append(const UString &t)
     int thisOffset = m_rep->offset;
     int tSize = t.size();
     int length = thisSize + tSize;
+    BaseString* base = m_rep->baseString();
 
     // possible cases:
     if (thisSize == 0) {
@@ -1037,23 +1130,23 @@ UString& UString::append(const UString &t)
         *this = t;
     } else if (tSize == 0) {
         // t is empty
-    } else if (m_rep->baseIsSelf() && m_rep->rc == 1) {
+    } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
             m_rep->len = length;
             m_rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == usedCapacity() && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(thisOffset + length);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
             m_rep = Rep::create(m_rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -1062,7 +1155,7 @@ UString& UString::append(const UString &t)
             copyChars(d, data(), thisSize);
             copyChars(d + thisSize, t.data(), tSize);
             m_rep = Rep::create(d, length);
-            m_rep->capacity = newCapacity;
+            m_rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -1078,6 +1171,18 @@ UString& UString::append(const UChar* tData, int tSize)
     return *this;
 }
 
+UString& UString::appendNumeric(int i)
+{
+    m_rep = concatenate(rep(), i);
+    return *this;
+}
+
+UString& UString::appendNumeric(double d)
+{
+    m_rep = concatenate(rep(), d);
+    return *this;
+}
+
 UString& UString::append(const char* t)
 {
     m_rep = concatenate(m_rep.release(), t);
@@ -1090,6 +1195,7 @@ UString& UString::append(UChar c)
 
     int thisOffset = m_rep->offset;
     int length = size();
+    BaseString* base = m_rep->baseString();
 
     // possible cases:
     if (length == 0) {
@@ -1101,27 +1207,27 @@ UString& UString::append(UChar c)
         else {
             d[0] = c;
             m_rep = Rep::create(d, 1);
-            m_rep->capacity = newCapacity;
+            m_rep->baseString()->capacity = newCapacity;
         }
-    } else if (m_rep->baseIsSelf() && m_rep->rc == 1) {
+    } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length + 1);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {
             d[length] = c;
             m_rep->len = length + 1;
             m_rep->_hash = 0;
         }
-    } else if (thisOffset + length == usedCapacity() && length >= minShareSize) {
+    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the string - extend it and share
-        expandCapacity(thisOffset + length + 1);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {
             d[length] = c;
             m_rep = Rep::create(m_rep, 0, length + 1);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length + 1, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -1130,7 +1236,7 @@ UString& UString::append(UChar c)
             copyChars(d, data(), length);
             d[length] = c;
             m_rep = Rep::create(d, length + 1);
-            m_rep->capacity = newCapacity;
+            m_rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -1185,19 +1291,20 @@ char* UString::ascii() const
 UString& UString::operator=(const char* c)
 {
     if (!c) {
-        m_rep = &Rep::null;
+        m_rep = &Rep::null();
         return *this;
     }
 
     if (!c[0]) {
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
         return *this;
     }
 
     int l = static_cast<int>(strlen(c));
     UChar* d;
-    if (m_rep->rc == 1 && l <= m_rep->capacity && m_rep->baseIsSelf() && m_rep->offset == 0 && m_rep->preCapacity == 0) {
-        d = m_rep->buf;
+    BaseString* base = m_rep->baseString();
+    if (!base->isShared() && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
+        d = base->buf;
         m_rep->_hash = 0;
         m_rep->len = l;
     } else {
@@ -1413,12 +1520,24 @@ uint32_t UString::toStrictUInt32(bool* ok) const
 
 int UString::find(const UString& f, int pos) const
 {
-    int sz = size();
     int fsz = f.size();
-    if (sz < fsz)
-        return -1;
+
     if (pos < 0)
         pos = 0;
+
+    if (fsz == 1) {
+        UChar ch = f[0];
+        const UChar* end = data() + size();
+        for (const UChar* c = data() + pos; c < end; c++) {
+            if (*c == ch)
+                return static_cast<int>(c - data());
+        }
+        return -1;
+    }
+
+    int sz = size();
+    if (sz < fsz)
+        return -1;
     if (fsz == 0)
         return pos;
     const UChar* end = data() + sz - fsz;
@@ -1502,19 +1621,6 @@ UString UString::substr(int pos, int len) const
     return UString(Rep::create(m_rep, pos, len));
 }
 
-bool operator==(const UString& s1, const UString& s2)
-{
-    int size = s1.size();
-    switch (size) {
-        case 0:
-            return !s2.size();
-        case 1:
-            return s2.size() == 1 && s1.data()[0] == s2.data()[0];
-        default:
-            return s2.size() == size && memcmp(s1.data(), s2.data(), size * sizeof(UChar)) == 0;
-    }
-}
-
 bool operator==(const UString& s1, const char *s2)
 {
     if (s2 == 0)
@@ -1626,13 +1732,13 @@ CString UString::UTF8String(bool strict) const
 // For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
 NEVER_INLINE void UString::makeNull()
 {
-    m_rep = &Rep::null;
+    m_rep = &Rep::null();
 }
 
 // For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
 NEVER_INLINE UString::Rep* UString::nullRep()
 {
-    return &Rep::null;
+    return &Rep::null();
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index 75403c0fc0..6852d9132b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -1,6 +1,7 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -26,8 +27,10 @@
 #include <stdint.h>
 #include <string.h>
 #include <wtf/Assertions.h>
-#include <wtf/FastMalloc.h>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/PtrAndFlags.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
@@ -74,10 +77,26 @@ namespace JSC {
         friend class JIT;
 
     public:
-        struct Rep {
+        typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
+        struct BaseString;
+        struct Rep : Noncopyable {
             friend class JIT;
 
-            static PassRefPtr<Rep> create(UChar*, int);
+            static PassRefPtr<Rep> create(UChar* buffer, int length)
+            {
+                return adoptRef(new BaseString(buffer, length));
+            }
+
+            static PassRefPtr<Rep> createEmptyBuffer(size_t size)
+            {
+                // Guard against integer overflow
+                if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
+                    if (void * buf = tryFastMalloc(size * sizeof(UChar)))
+                        return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
+                }
+                return adoptRef(new BaseString(0, 0, 0));
+            }
+
             static PassRefPtr<Rep> createCopying(const UChar*, int);
             static PassRefPtr<Rep> create(PassRefPtr<Rep> base, int offset, int length);
 
@@ -85,10 +104,13 @@ namespace JSC {
             // Returns UString::Rep::null for null input or conversion failure.
             static PassRefPtr<Rep> createFromUTF8(const char*);
 
+            // Uses SharedUChar to have joint ownership over the UChar*.
+            static PassRefPtr<Rep> create(UChar*, int, PassRefPtr<SharedUChar>);
+
             void destroy();
 
-            bool baseIsSelf() const { return baseString == this; }
-            UChar* data() const { return baseString->buf + baseString->preCapacity + offset; }
+            bool baseIsSelf() const { return m_identifierTableAndFlags.isFlagSet(BaseStringFlag); }
+            UChar* data() const;
             int size() const { return len; }
 
             unsigned hash() const { if (_hash == 0) _hash = computeHash(data(), len); return _hash; }
@@ -98,35 +120,115 @@ namespace JSC {
             static unsigned computeHash(const char*, int length);
             static unsigned computeHash(const char* s) { return computeHash(s, strlen(s)); }
 
-            IdentifierTable* identifierTable() const { return reinterpret_cast<IdentifierTable*>(m_identifierTable & ~static_cast<uintptr_t>(1)); }
-            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTable = reinterpret_cast<intptr_t>(table); }
+            IdentifierTable* identifierTable() const { return m_identifierTableAndFlags.get(); }
+            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTableAndFlags.set(table); }
 
-            bool isStatic() const { return m_identifierTable & 1; }
-            void setStatic(bool v) { ASSERT(!identifierTable()); m_identifierTable = v; }
+            bool isStatic() const { return m_identifierTableAndFlags.isFlagSet(StaticFlag); }
+            void setStatic(bool);
+            void setBaseString(PassRefPtr<BaseString>);
+            BaseString* baseString();
+            const BaseString* baseString() const;
 
             Rep* ref() { ++rc; return this; }
             ALWAYS_INLINE void deref() { if (--rc == 0) destroy(); }
 
             void checkConsistency() const;
+            enum UStringFlags {
+                StaticFlag,
+                BaseStringFlag
+            };
 
             // unshared data
             int offset;
             int len;
             int rc; // For null and empty static strings, this field does not reflect a correct count, because ref/deref are not thread-safe. A special case in destroy() guarantees that these do not get deleted.
             mutable unsigned _hash;
-            intptr_t m_identifierTable; // A pointer to identifier table. The lowest bit is used to indicate whether the string is static (null or empty).
-            UString::Rep* baseString;
-            size_t reportedCost;
+            PtrAndFlags<IdentifierTable, UStringFlags> m_identifierTableAndFlags;
+
+            static BaseString& null() { return *nullBaseString; }
+            static BaseString& empty() { return *emptyBaseString; }
 
-            // potentially shared data. 0 if backed up by a base string.
+            bool reserveCapacity(int capacity);
+
+        protected:
+            // Constructor for use by BaseString subclass; they use the union with m_baseString for another purpose.
+            Rep(int length)
+                : offset(0)
+                , len(length)
+                , rc(1)
+                , _hash(0)
+                , m_baseString(0)
+            {
+            }
+
+            Rep(PassRefPtr<BaseString> base, int offsetInBase, int length)
+                : offset(offsetInBase)
+                , len(length)
+                , rc(1)
+                , _hash(0)
+                , m_baseString(base.releaseRef())
+            {
+                checkConsistency();
+            }
+
+            union {
+                // If !baseIsSelf()
+                BaseString* m_baseString;
+                // If baseIsSelf()
+                SharedUChar* m_sharedBuffer;
+            };
+
+        private:
+            // For SmallStringStorage which allocates an array and does initialization manually.
+            Rep() { }
+
+            friend class SmallStringsStorage;
+            friend void initializeUString();
+            JS_EXPORTDATA static BaseString* nullBaseString;
+            JS_EXPORTDATA static BaseString* emptyBaseString;
+        };
+
+
+        struct BaseString : public Rep {
+            bool isShared() { return rc != 1 || isBufferReadOnly(); }
+            void setSharedBuffer(PassRefPtr<SharedUChar>);
+            SharedUChar* sharedBuffer();
+
+            bool isBufferReadOnly()
+            {
+                if (!m_sharedBuffer)
+                    return false;
+                return slowIsBufferReadOnly();
+            }
+
+            // potentially shared data.
             UChar* buf;
-            int usedCapacity;
-            int capacity;
-            int usedPreCapacity;
             int preCapacity;
+            int usedPreCapacity;
+            int capacity;
+            int usedCapacity;
+
+            size_t reportedCost;
+
+        private:
+            BaseString(UChar* buffer, int length, int additionalCapacity = 0)
+                : Rep(length)
+                , buf(buffer)
+                , preCapacity(0)
+                , usedPreCapacity(0)
+                , capacity(length + additionalCapacity)
+                , usedCapacity(length)
+                , reportedCost(0)
+            {
+                m_identifierTableAndFlags.setFlag(BaseStringFlag);
+                checkConsistency();
+            }
+
+            bool slowIsBufferReadOnly();
 
-            static Rep null;
-            static Rep empty;
+            friend struct Rep;
+            friend class SmallStringsStorage;
+            friend void initializeUString();
         };
 
     public:
@@ -175,11 +277,15 @@ namespace JSC {
 
         UString spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const;
 
+        UString replaceRange(int rangeStart, int RangeEnd, const UString& replacement) const;
+
         UString& append(const UString&);
         UString& append(const char*);
         UString& append(UChar);
         UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
         UString& append(const UChar*, int size);
+        UString& appendNumeric(int);
+        UString& appendNumeric(double);
 
         bool getCString(CStringBuffer&) const;
 
@@ -204,7 +310,7 @@ namespace JSC {
 
         const UChar* data() const { return m_rep->data(); }
 
-        bool isNull() const { return (m_rep == &Rep::null); }
+        bool isNull() const { return (m_rep == &Rep::null()); }
         bool isEmpty() const { return (!m_rep->len); }
 
         bool is8Bit() const;
@@ -230,7 +336,7 @@ namespace JSC {
 
         UString substr(int pos = 0, int len = -1) const;
 
-        static const UString& null();
+        static const UString& null() { return *nullUString; }
 
         Rep* rep() const { return m_rep.get(); }
         static Rep* nullRep();
@@ -243,15 +349,26 @@ namespace JSC {
 
         size_t cost() const;
 
+        // Attempt to grow this string such that it can grow to a total length of 'capacity'
+        // without reallocation.  This may fail a number of reasons - if the BasicString is
+        // shared and another string is using part of the capacity beyond our end point, if
+        // the realloc fails, or if this string is empty and has no storage.
+        //
+        // This method returns a boolean indicating success.
+        bool reserveCapacity(int capacity)
+        {
+            return m_rep->reserveCapacity(capacity);
+        }
+
     private:
-        int usedCapacity() const;
-        int usedPreCapacity() const;
         void expandCapacity(int requiredLength);
         void expandPreCapacity(int requiredPreCap);
         void makeNull();
 
         RefPtr<Rep> m_rep;
+        static UString* nullUString;
 
+        friend void initializeUString();
         friend bool operator==(const UString&, const UString&);
         friend PassRefPtr<Rep> concatenate(Rep*, Rep*); // returns 0 if out of memory
     };
@@ -259,7 +376,26 @@ namespace JSC {
     PassRefPtr<UString::Rep> concatenate(UString::Rep*, int);
     PassRefPtr<UString::Rep> concatenate(UString::Rep*, double);
 
-    bool operator==(const UString&, const UString&);
+    inline bool operator==(const UString& s1, const UString& s2)
+    {
+        int size = s1.size();
+        switch (size) {
+        case 0:
+            return !s2.size();
+        case 1:
+            return s2.size() == 1 && s1.data()[0] == s2.data()[0];
+        case 2: {
+            if (s2.size() != 2)
+                return false;
+            const UChar* d1 = s1.data();
+            const UChar* d2 = s2.data();
+            return (d1[0] == d2[0]) & (d1[1] == d2[1]);
+        }
+        default:
+            return s2.size() == size && memcmp(s1.data(), s2.data(), size * sizeof(UChar)) == 0;
+        }
+    }
+
 
     inline bool operator!=(const UString& s1, const UString& s2)
     {
@@ -298,6 +434,54 @@ namespace JSC {
 
     bool equal(const UString::Rep*, const UString::Rep*);
 
+    inline PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<UString::Rep> rep, int offset, int length)
+    {
+        ASSERT(rep);
+        rep->checkConsistency();
+
+        int repOffset = rep->offset;
+
+        PassRefPtr<BaseString> base = rep->baseString();
+
+        ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
+        ASSERT(offset + repOffset + length <= base->usedCapacity);
+
+        // Steal the single reference this Rep was created with.
+        return adoptRef(new Rep(base, repOffset + offset, length));
+    }
+
+    inline UChar* UString::Rep::data() const
+    {
+        const BaseString* base = baseString();
+        return base->buf + base->preCapacity + offset;
+    }
+
+    inline void UString::Rep::setStatic(bool v)
+    {
+        ASSERT(!identifierTable());
+        if (v)
+            m_identifierTableAndFlags.setFlag(StaticFlag);
+        else
+            m_identifierTableAndFlags.clearFlag(StaticFlag);
+    }
+
+    inline void UString::Rep::setBaseString(PassRefPtr<BaseString> base)
+    {
+        ASSERT(base != this);
+        ASSERT(!baseIsSelf());
+        m_baseString = base.releaseRef();
+    }
+
+    inline UString::BaseString* UString::Rep::baseString()
+    {
+        return !baseIsSelf() ? m_baseString : reinterpret_cast<BaseString*>(this) ;
+    }
+
+    inline const UString::BaseString* UString::Rep::baseString() const
+    {
+        return const_cast<Rep*>(this)->baseString();
+    }
+
 #ifdef NDEBUG
     inline void UString::Rep::checkConsistency() const
     {
@@ -305,7 +489,7 @@ namespace JSC {
 #endif
 
     inline UString::UString()
-        : m_rep(&Rep::null)
+        : m_rep(&Rep::null())
     {
     }
 
@@ -328,8 +512,9 @@ namespace JSC {
 
     inline size_t UString::cost() const
     {
-        size_t capacity = (m_rep->baseString->capacity + m_rep->baseString->preCapacity) * sizeof(UChar);
-        size_t reportedCost = m_rep->baseString->reportedCost;
+        BaseString* base = m_rep->baseString();
+        size_t capacity = (base->capacity + base->preCapacity) * sizeof(UChar);
+        size_t reportedCost = base->reportedCost;
         ASSERT(capacity >= reportedCost);
 
         size_t capacityDelta = capacity - reportedCost;
@@ -337,7 +522,7 @@ namespace JSC {
         if (capacityDelta < static_cast<size_t>(minShareSize))
             return 0;
 
-        m_rep->baseString->reportedCost = capacity;
+        base->reportedCost = capacity;
 
         return capacityDelta;
     }
@@ -347,6 +532,7 @@ namespace JSC {
         static unsigned hash(JSC::UString::Rep* key) { return key->computedHash(); }
     };
 
+    void initializeUString();
 } // namespace JSC
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
index 099931b786..145a1cee8f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
@@ -40,12 +40,9 @@ using namespace WTF;
 
 namespace JSC { namespace WREC {
 
-// Patterns longer than this can hang the compiler.
-static const int MaxPatternSize = (1 << 13);
-
 CompiledRegExp Generator::compileRegExp(JSGlobalData* globalData, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase, bool multiline)
 {
-    if (pattern.size() > MaxPatternSize) {
+    if (pattern.size() > MAX_PATTERN_SIZE) {
         *error_ptr = "regular expression too large";
         return 0;
     }
@@ -80,7 +77,7 @@ CompiledRegExp Generator::compileRegExp(JSGlobalData* globalData, const UString&
     }
 
     *numSubpatterns_ptr = parser.numSubpatterns();
-    pool = globalData->poolForSize(generator.size());
+    pool = globalData->executableAllocator.poolForSize(generator.size());
     return reinterpret_cast<CompiledRegExp>(generator.copyCode(pool.get()));
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
index dd48484600..e2e8abaf05 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
@@ -40,16 +40,7 @@ namespace JSC { namespace WREC {
 
 void Generator::generateEnter()
 {
-#if PLATFORM(X86_64)
-    // On x86-64 edi and esi are caller preserved, so nothing to do here.
-    // The four arguments have been passed in the registers %rdi, %rsi,
-    // %rdx, %rcx - shuffle these into the expected locations.
-    move(X86::edi, input); // (arg 1) edi -> eax
-    move(X86::ecx, output); // (arg 4) ecx -> edi
-    move(X86::edx, length); // (arg 3) edx -> ecx
-    move(X86::esi, index); // (arg 2) esi -> edx
-
-#else
+#if PLATFORM(X86)
     // On x86 edi & esi are callee preserved registers.
     push(X86::edi);
     push(X86::esi);
@@ -67,24 +58,20 @@ void Generator::generateEnter()
     peek(output, 3);
 #endif
 #endif
-
-#ifndef NDEBUG
-    // ASSERT that the output register is not null.
-    Jump outputNotNull = jnzPtr(output);
-    breakpoint();
-    outputNotNull.link(this);
-#endif
 }
 
 void Generator::generateReturnSuccess()
 {
+    ASSERT(returnRegister != index);
+    ASSERT(returnRegister != output);
+
     // Set return value.
-    pop(X86::eax); // match begin
-    store32(X86::eax, output);
+    pop(returnRegister); // match begin
+    store32(returnRegister, output);
     store32(index, Address(output, 4)); // match end
     
     // Restore callee save registers.
-#if !PLATFORM(X86_64)
+#if PLATFORM(X86)
     pop(X86::esi);
     pop(X86::edi);
 #endif
@@ -100,14 +87,14 @@ void Generator::generateIncrementIndex(Jump* failure)
 {
     peek(index);
     if (failure)
-        *failure = je32(length, index);
+        *failure = branch32(Equal, length, index);
     add32(Imm32(1), index);
     poke(index);
 }
 
 void Generator::generateLoadCharacter(JumpList& failures)
 {
-    failures.append(je32(length, index));
+    failures.append(branch32(Equal, length, index));
     load16(BaseIndex(input, index, TimesTwo), character);
 }
 
@@ -115,14 +102,15 @@ void Generator::generateLoadCharacter(JumpList& failures)
 // were part of the input string.
 void Generator::generateJumpIfNotEndOfInput(Label target)
 {
-    jle32(index, length, target);
+    branch32(LessThanOrEqual, index, length, target);
 }
 
 void Generator::generateReturnFailure()
 {
     pop();
-    move(Imm32(-1), X86::eax);
-#if !PLATFORM(X86_64)
+    move(Imm32(-1), returnRegister);
+
+#if PLATFORM(X86)
     pop(X86::esi);
     pop(X86::edi);
 #endif
@@ -145,7 +133,7 @@ void Generator::generateBackreferenceQuantifier(JumpList& failures, Quantifier::
     GenerateBackreferenceFunctor functor(subpatternId);
 
     load32(Address(output, (2 * subpatternId) * sizeof(int)), character);
-    Jump skipIfEmpty = je32(Address(output, ((2 * subpatternId) + 1) * sizeof(int)), character);
+    Jump skipIfEmpty = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), character);
 
     ASSERT(quantifierType == Quantifier::Greedy || quantifierType == Quantifier::NonGreedy);
     if (quantifierType == Quantifier::Greedy)
@@ -175,7 +163,7 @@ void Generator::generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunc
     Label alternativeFailed(this);
     pop(index);
     if (max != Quantifier::Infinity)
-        je32(repeatCount, Imm32(max), quantifierFailed);
+        branch32(Equal, repeatCount, Imm32(max), quantifierFailed);
 
     // (1) Read an atom.
     if (min)
@@ -187,7 +175,7 @@ void Generator::generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunc
     
     // (2) Keep reading if we're under the minimum.
     if (min > 1)
-        jl32(repeatCount, Imm32(min), readAtom);
+        branch32(LessThan, repeatCount, Imm32(min), readAtom);
 
     // (3) Test the rest of the alternative.
     if (!min)
@@ -221,7 +209,7 @@ void Generator::generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor
     else if (max == 1)
         doneReadingAtomsList.append(jump());
     else {
-        jne32(repeatCount, Imm32(max), readAtom);
+        branch32(NotEqual, repeatCount, Imm32(max), readAtom);
         doneReadingAtomsList.append(jump());
     }
 
@@ -238,7 +226,7 @@ void Generator::generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor
 
     // (2) Verify that we have enough atoms.
     doneReadingAtomsList.link(this);
-    jl32(repeatCount, Imm32(min), quantifierFailed);
+    branch32(LessThan, repeatCount, Imm32(min), quantifierFailed);
 
     // (3) Test the rest of the alternative.
     push(index);
@@ -277,7 +265,7 @@ bool Generator::generatePatternCharacterPair(JumpList& failures, int ch1, int ch
 
     // Optimistically consume 2 characters.
     add32(Imm32(2), index);
-    failures.append(jg32(index, length));
+    failures.append(branch32(GreaterThan, index, length));
 
     // Load the characters we just consumed, offset -2 characters from index.
     load32(BaseIndex(input, index, TimesTwo, -2 * 2), character);
@@ -306,7 +294,7 @@ bool Generator::generatePatternCharacterPair(JumpList& failures, int ch1, int ch
     }
     int pair = ch1 | (ch2 << 16);
 
-    failures.append(jne32(character, Imm32(pair)));
+    failures.append(branch32(NotEqual, character, Imm32(pair)));
     return true;
 }
 
@@ -328,14 +316,14 @@ void Generator::generatePatternCharacter(JumpList& failures, int ch)
             ch |= 32;
         } else if (!isASCII(ch) && ((lower = Unicode::toLower(ch)) != (upper = Unicode::toUpper(ch)))) {
             // handle unicode case sentitive characters - branch to success on upper
-            isUpper = je32(character, Imm32(upper));
+            isUpper = branch32(Equal, character, Imm32(upper));
             hasUpper = true;
             ch = lower;
         }
     }
     
     // checks for ch, or lower case version of ch, if insensitive
-    failures.append(jne32(character, Imm32((unsigned short)ch)));
+    failures.append(branch32(NotEqual, character, Imm32((unsigned short)ch)));
 
     if (m_parser.ignoreCase() && hasUpper) {
         // for unicode case insensitive matches, branch here if upper matches.
@@ -357,33 +345,33 @@ void Generator::generateCharacterClassInvertedRange(JumpList& failures, JumpList
         // check if there are any ranges or matches below lo.  If not, just jl to failure -
         // if there is anything else to check, check that first, if it falls through jmp to failure.
         if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-            Jump loOrAbove = jge32(character, Imm32((unsigned short)lo));
+            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
             
             // generate code for all ranges before this one
             if (which)
                 generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
             
-            do {
-                matchDest.append(je32(character, Imm32((unsigned short)matches[*matchIndex])));
+            while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
                 ++*matchIndex;
-            } while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo));
+            }
             failures.append(jump());
 
             loOrAbove.link(this);
         } else if (which) {
-            Jump loOrAbove = jge32(character, Imm32((unsigned short)lo));
+            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
 
             generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
             failures.append(jump());
 
             loOrAbove.link(this);
         } else
-            failures.append(jl32(character, Imm32((unsigned short)lo)));
+            failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
 
         while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
             ++*matchIndex;
 
-        matchDest.append(jle32(character, Imm32((unsigned short)hi)));
+        matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
         // fall through to here, the value is above hi.
 
         // shuffle along & loop around if there are any more matches to handle.
@@ -397,12 +385,12 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
 {
     Jump unicodeFail;
     if (charClass.numMatchesUnicode || charClass.numRangesUnicode) {
-        Jump isAscii = jle32(character, Imm32(0x7f));
+        Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
     
         if (charClass.numMatchesUnicode) {
             for (unsigned i = 0; i < charClass.numMatchesUnicode; ++i) {
                 UChar ch = charClass.matchesUnicode[i];
-                matchDest.append(je32(character, Imm32(ch)));
+                matchDest.append(branch32(Equal, character, Imm32(ch)));
             }
         }
         
@@ -411,8 +399,8 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
                 UChar lo = charClass.rangesUnicode[i].begin;
                 UChar hi = charClass.rangesUnicode[i].end;
                 
-                Jump below = jl32(character, Imm32(lo));
-                matchDest.append(jle32(character, Imm32(hi)));
+                Jump below = branch32(LessThan, character, Imm32(lo));
+                matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
                 below.link(this);
             }
         }
@@ -426,7 +414,7 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
         JumpList failures; 
         generateCharacterClassInvertedRange(failures, matchDest, charClass.ranges, charClass.numRanges, &matchIndex, charClass.matches, charClass.numMatches);
         while (matchIndex < charClass.numMatches)
-            matchDest.append(je32(character, Imm32((unsigned short)charClass.matches[matchIndex++])));
+            matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass.matches[matchIndex++])));
 
         failures.link(this);
     } else if (charClass.numMatches) {
@@ -443,13 +431,13 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
                 if (isASCIIUpper(ch))
                     continue;
             }
-            matchDest.append(je32(character, Imm32((unsigned short)ch)));
+            matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
         }
 
         if (unsigned countAZaz = matchesAZaz.size()) {
             or32(Imm32(32), character);
             for (unsigned i = 0; i < countAZaz; ++i)
-                matchDest.append(je32(character, Imm32(matchesAZaz[i])));
+                matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
         }
     }
 
@@ -533,7 +521,7 @@ void Generator::generateAssertionBOL(JumpList& failures)
         JumpList previousIsNewline;
 
         // begin of input == success
-        previousIsNewline.append(je32(index, Imm32(0)));
+        previousIsNewline.append(branch32(Equal, index, Imm32(0)));
 
         // now check prev char against newline characters.
         load16(BaseIndex(input, index, TimesTwo, -2), character);
@@ -543,7 +531,7 @@ void Generator::generateAssertionBOL(JumpList& failures)
 
         previousIsNewline.link(this);
     } else
-        failures.append(jne32(index, Imm32(0)));
+        failures.append(branch32(NotEqual, index, Imm32(0)));
 }
 
 void Generator::generateAssertionEOL(JumpList& failures)
@@ -556,7 +544,7 @@ void Generator::generateAssertionEOL(JumpList& failures)
         failures.append(jump());
         nextIsNewline.link(this);
     } else {
-        failures.append(jne32(length, index));
+        failures.append(branch32(NotEqual, length, index));
     }
 }
 
@@ -568,7 +556,7 @@ void Generator::generateAssertionWordBoundary(JumpList& failures, bool invert)
     // (1) Check if the previous value was a word char
 
     // (1.1) check for begin of input
-    Jump atBegin = je32(index, Imm32(0));
+    Jump atBegin = branch32(Equal, index, Imm32(0));
     // (1.2) load the last char, and chck if is word character
     load16(BaseIndex(input, index, TimesTwo, -2), character);
     JumpList previousIsWord;
@@ -625,14 +613,14 @@ void Generator::generateBackreference(JumpList& failures, unsigned subpatternId)
     skipIncrement.link(this);
 
     // check if we're at the end of backref (if we are, success!)
-    Jump endOfBackRef = je32(Address(output, ((2 * subpatternId) + 1) * sizeof(int)), repeatCount);
+    Jump endOfBackRef = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), repeatCount);
 
     load16(BaseIndex(input, repeatCount, MacroAssembler::TimesTwo), character);
 
     // check if we've run out of input (this would be a can o'fail)
-    Jump endOfInput = je32(length, index);
+    Jump endOfInput = branch32(Equal, length, index);
 
-    je16(character, BaseIndex(input, index, TimesTwo), topOfLoop);
+    branch16(Equal, BaseIndex(input, index, TimesTwo), character, topOfLoop);
 
     endOfInput.link(this);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
index af4101a934..8562cac9b3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
@@ -62,13 +62,29 @@ namespace JSC {
         {
         }
 
+#if PLATFORM(X86)
         static const RegisterID input = X86::eax;
-        static const RegisterID length = X86::ecx;
         static const RegisterID index = X86::edx;
-        static const RegisterID character = X86::esi;
+        static const RegisterID length = X86::ecx;
         static const RegisterID output = X86::edi;
+
+        static const RegisterID character = X86::esi;
         static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
-        
+
+        static const RegisterID returnRegister = X86::eax;
+#endif
+#if PLATFORM(X86_64)
+        static const RegisterID input = X86::edi;
+        static const RegisterID index = X86::esi;
+        static const RegisterID length = X86::edx;
+        static const RegisterID output = X86::ecx;
+
+        static const RegisterID character = X86::eax;
+        static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
+
+        static const RegisterID returnRegister = X86::eax;
+#endif
+
         void generateEnter();
         void generateSaveIndex();
         void generateIncrementIndex(Jump* failure = 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
index be42a3447b..1709bf9290 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
@@ -233,38 +233,42 @@ bool Parser::parseParentheses(JumpList& failures)
     // unsupported parentheses, we fall back on PCRE.
 
     switch (type) {
-        case Generator::Assertion:
+        case Generator::Assertion: {
             m_generator.generateParenthesesAssertion(failures);
 
             if (consume() != ')') {
                 setError(ParenthesesUnmatched);
                 return false;
             }
-            
-            // A quantifier after an assertion is meaningless, since assertions
-            // don't move index forward. So, we discard it.
-            consumeQuantifier();
-            break;
 
-        case Generator::InvertedAssertion:
+            Quantifier quantifier = consumeQuantifier();
+            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
+                setError(ParenthesesNotSupported);
+                return false;
+            }
+
+            return true;
+        }
+        case Generator::InvertedAssertion: {
             m_generator.generateParenthesesInvertedAssertion(failures);
 
             if (consume() != ')') {
                 setError(ParenthesesUnmatched);
                 return false;
             }
-            
-            // A quantifier after an assertion is meaningless, since assertions
-            // don't move index forward. So, we discard it.
-            consumeQuantifier();
-            break;
 
+            Quantifier quantifier = consumeQuantifier();
+            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
+                setError(ParenthesesNotSupported);
+                return false;
+            }
+
+            return true;
+        }
         default:
             setError(ParenthesesNotSupported);
             return false;
     }
-
-    return true;
 }
 
 bool Parser::parseCharacterClass(JumpList& failures)
@@ -457,7 +461,9 @@ Escape Parser::consumeEscape(bool inCharacterClass)
         consume();
         
         int control = consume();
-        if (!isASCIIAlpha(control)) {
+        // To match Firefox, inside a character class, we also accept numbers
+        // and '_' as control characters.
+        if ((!inCharacterClass && !isASCIIAlpha(control)) || (!isASCIIAlphanumeric(control) && control != '_')) {
             state.restore();
             return PatternCharacterEscape('\\');
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
index 0c2ca70d5d..0c3c29fb3a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -149,4 +149,18 @@ namespace WTF {
     inline bool isASCIIPrintable(int c) { return c >= ' ' && c <= '~'; }
 }
 
+using WTF::isASCII;
+using WTF::isASCIIAlpha;
+using WTF::isASCIIAlphanumeric;
+using WTF::isASCIIDigit;
+using WTF::isASCIIHexDigit;
+using WTF::isASCIILower;
+using WTF::isASCIIOctalDigit;
+using WTF::isASCIIPrintable;
+using WTF::isASCIISpace;
+using WTF::isASCIIUpper;
+using WTF::toASCIIHexValue;
+using WTF::toASCIILower;
+using WTF::toASCIIUpper;
+
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h b/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h
index 18db8ff459..d7470e7f95 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h
@@ -764,7 +764,7 @@ AVLTree<Abstractor, maxDepth, BSet>::remove(key k)
 
     handle h = abs.root;
     handle parent = null(), child;
-    int cmp, cmp_shortened_sub_with_path;
+    int cmp, cmp_shortened_sub_with_path = 0;
 
     for (;;) {
         if (h == null())
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
index d39b2b962a..64fdd99577 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
@@ -22,7 +22,7 @@
 
 #ifndef ALWAYS_INLINE
 #if COMPILER(GCC) && defined(NDEBUG) && !COMPILER(MINGW)
-#define ALWAYS_INLINE inline __attribute__ ((__always_inline__))
+#define ALWAYS_INLINE inline __attribute__((__always_inline__))
 #elif COMPILER(MSVC) && defined(NDEBUG)
 #define ALWAYS_INLINE __forceinline
 #else
@@ -32,7 +32,7 @@
 
 #ifndef NEVER_INLINE
 #if COMPILER(GCC)
-#define NEVER_INLINE __attribute__ ((__noinline__))
+#define NEVER_INLINE __attribute__((__noinline__))
 #else
 #define NEVER_INLINE
 #endif
@@ -53,3 +53,11 @@
 #define LIKELY(x) (x)
 #endif
 #endif
+
+#ifndef NO_RETURN
+#if COMPILER(GCC)
+#define NO_RETURN __attribute((__noreturn__))
+#else
+#define NO_RETURN
+#endif
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
index c17e501fa2..9643517a9d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
@@ -194,7 +194,7 @@ while (0)
 
 /* COMPILE_ASSERT */
 #ifndef COMPILE_ASSERT
-#define COMPILE_ASSERT(exp, name) typedef int dummy##name [(exp) ? 1 : -1];
+#define COMPILE_ASSERT(exp, name) typedef int dummy##name [(exp) ? 1 : -1]
 #endif
 
 /* FATAL */
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.cpp
index 4b88fd6587..526f147825 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "ByteArray.h"
 
-namespace JSC {
+namespace WTF {
 
 PassRefPtr<ByteArray> ByteArray::create(size_t size)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h
index 744894271f..33f0877f06 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h
@@ -29,8 +29,8 @@
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 
-namespace JSC {
-    class ByteArray : public RefCounted<ByteArray> {
+namespace WTF {
+    class ByteArray : public RefCountedBase {
     public:
         unsigned length() const { return m_size; }
 
@@ -55,6 +55,16 @@ namespace JSC {
 
         unsigned char* data() { return m_data; }
 
+        void deref()
+        {
+            if (derefBase()) {
+                // We allocated with new unsigned char[] in create(),
+                // and then used placement new to construct the object.
+                this->~ByteArray();
+                delete[] reinterpret_cast<unsigned char*>(this);
+            }
+        }
+
         static PassRefPtr<ByteArray> create(size_t size);
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CONTRIBUTORS.pthreads-win32 b/src/3rdparty/webkit/JavaScriptCore/wtf/CONTRIBUTORS.pthreads-win32
new file mode 100644
index 0000000000..7de0f26065
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CONTRIBUTORS.pthreads-win32
@@ -0,0 +1,137 @@
+This is a copy of CONTRIBUTORS file for the Pthreads-win32 library, downloaded
+from http://sourceware.org/cgi-bin/cvsweb.cgi/~checkout~/pthreads/CONTRIBUTORS?rev=1.32&cvsroot=pthreads-win32
+
+Included here to compliment the Pthreads-win32 license header in wtf/ThreadingWin.cpp file.
+WebKit is using derived sources of ThreadCondition code from Pthreads-win32.
+
+-------------------------------------------------------------------------------
+
+Contributors (in approximate order of appearance)
+
+[See also the ChangeLog file where individuals are
+attributed in log entries. Likewise in the FAQ file.]
+
+Ben Elliston		bje at cygnus dot com
+					Initiated the project;
+					setup the project infrastructure (CVS, web page, etc.);
+					early prototype routines.
+Ross Johnson		rpj at callisto dot canberra dot edu dot au
+					early prototype routines;
+					ongoing project coordination/maintenance;
+					implementation of spin locks and barriers;
+					various enhancements;
+					bug fixes;
+					documentation;
+					testsuite.
+Robert Colquhoun	rjc at trump dot net dot au
+					Early bug fixes.
+John E. Bossom		John dot Bossom at cognos dot com
+					Contributed substantial original working implementation;
+					bug fixes;
+					ongoing guidance and standards interpretation.
+Anders Norlander	anorland at hem2 dot passagen dot se
+					Early enhancements and runtime checking for supported
+					Win32 routines.
+Tor Lillqvist		tml at iki dot fi
+					General enhancements;
+					early bug fixes to condition variables.
+Scott Lightner		scott at curriculum dot com
+					Bug fix.
+Kevin Ruland		Kevin dot Ruland at anheuser-busch dot com
+					Various bug fixes.
+Mike Russo		miker at eai dot com
+					Bug fix.
+Mark E. Armstrong	avail at pacbell dot net
+					Bug fixes.
+Lorin Hochstein 	lmh at xiphos dot ca
+					general bug fixes; bug fixes to condition variables.
+Peter Slacik		Peter dot Slacik at tatramed dot sk
+					Bug fixes.
+Mumit Khan		khan at xraylith dot wisc dot edu
+					Fixes to work with Mingw32.
+Milan Gardian		mg at tatramed dot sk
+					Bug fixes and reports/analyses of obscure problems.
+Aurelio Medina		aureliom at crt dot com
+					First implementation of read-write locks.
+Graham Dumpleton	Graham dot Dumpleton at ra dot pad dot otc dot telstra dot com dot au
+					Bug fix in condition variables.
+Tristan Savatier	tristan at mpegtv dot com
+					WinCE port.
+Erik Hensema		erik at hensema dot xs4all dot nl
+					Bug fixes.
+Rich Peters		rpeters at micro-magic dot com
+Todd Owen		towen at lucidcalm dot dropbear dot id dot au
+					Bug fixes to dll loading.
+Jason Nye		jnye at nbnet dot nb dot ca
+					Implementation of async cancelation.
+Fred Forester		fforest at eticomm dot net
+Kevin D. Clark		kclark at cabletron dot com
+David Baggett		dmb at itasoftware dot com
+					Bug fixes.
+Paul Redondo		paul at matchvision dot com
+Scott McCaskill 	scott at 3dfx dot com
+					Bug fixes.
+Jef Gearhart		jgearhart at tpssys dot com
+					Bug fix.
+Arthur Kantor		akantor at bexusa dot com
+					Mutex enhancements.
+Steven Reddie		smr at essemer dot com dot au
+					Bug fix.
+Alexander Terekhov	TEREKHOV at de dot ibm dot com
+					Re-implemented and improved read-write locks;
+					(with Louis Thomas) re-implemented and improved
+					condition variables;
+					enhancements to semaphores;
+					enhancements to mutexes;
+					new mutex implementation in 'futex' style;
+					suggested a robust implementation of pthread_once
+					similar to that implemented by V.Kliathcko;
+					system clock change handling re CV timeouts;
+					bug fixes.
+Thomas Pfaff		tpfaff at gmx dot net
+					Changes to make C version usable with C++ applications;
+					re-implemented mutex routines to avoid Win32 mutexes
+					and TryEnterCriticalSection;
+					procedure to fix Mingw32 thread-safety issues.
+Franco Bez		franco dot bez at gmx dot de
+					procedure to fix Mingw32 thread-safety issues.
+Louis Thomas		lthomas at arbitrade dot com
+					(with Alexander Terekhov) re-implemented and improved
+					condition variables.
+David Korn		dgk at research dot att dot com
+					Ported to UWIN.
+Phil Frisbie, Jr.	phil at hawksoft dot com
+					Bug fix.
+Ralf Brese		Ralf dot Brese at pdb4 dot siemens dot de
+					Bug fix.
+prionx at juno dot com 	prionx at juno dot com
+					Bug fixes.
+Max Woodbury		mtew at cds dot duke dot edu
+					POSIX versioning conditionals;
+					reduced namespace pollution;
+					idea to separate routines to reduce statically
+					linked image sizes.
+Rob Fanner		rfanner at stonethree dot com
+					Bug fix.
+Michael Johnson 	michaelj at maine dot rr dot com
+					Bug fix.
+Nicolas Barry		boozai at yahoo dot com
+					Bug fixes.
+Piet van Bruggen	pietvb at newbridges dot nl
+					Bug fix.
+Makoto Kato		raven at oldskool dot jp
+					AMD64 port.
+Panagiotis E. Hadjidoukas	peh at hpclab dot ceid dot upatras dot gr
+					Contributed the QueueUserAPCEx package which
+					makes preemptive async cancelation possible.
+Will Bryant		will dot bryant at ecosm dot com
+					Borland compiler patch and makefile.
+Anuj Goyal		anuj dot goyal at gmail dot com
+					Port to Digital Mars compiler.
+Gottlob Frege		gottlobfrege at  gmail dot com
+					re-implemented pthread_once (version 2)
+					(pthread_once cancellation added by rpj).
+Vladimir Kliatchko	vladimir at kliatchko dot com
+					reimplemented pthread_once with the same form
+					as described by A.Terekhov (later version 2);
+					implementation of MCS (Mellor-Crummey/Scott) locks.
\ No newline at end of file
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
new file mode 100644
index 0000000000..281dfa606c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CrossThreadRefCounted_h
+#define CrossThreadRefCounted_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Threading.h>
+
+namespace WTF {
+
+    // Used to allowing sharing data across classes and threads (like ThreadedSafeShared).
+    //
+    // Why not just use ThreadSafeShared?
+    // ThreadSafeShared can have a significant perf impact when used in low level classes
+    // (like UString) that get ref/deref'ed a lot. This class has the benefit of doing fast ref
+    // counts like RefPtr whenever possible, but it has the downside that you need to copy it
+    // to use it on another thread.
+    //
+    // Is this class threadsafe?
+    // While each instance of the class is not threadsafe, the copied instance is threadsafe
+    // with respect to the original and any other copies.  The underlying m_data is jointly
+    // owned by the original instance and all copies.
+    template<class T>
+    class CrossThreadRefCounted : Noncopyable {
+    public:
+        static PassRefPtr<CrossThreadRefCounted<T> > create(T* data)
+        {
+            return adoptRef(new CrossThreadRefCounted<T>(data, 0));
+        }
+
+        // Used to make an instance that can be used on another thread.
+        PassRefPtr<CrossThreadRefCounted<T> > crossThreadCopy();
+
+        void ref();
+        void deref();
+        T* release();
+
+        bool isShared() const
+        {
+            return !m_refCounter.hasOneRef() || (m_threadSafeRefCounter && !m_threadSafeRefCounter->hasOneRef());
+        }
+
+#ifndef NDEBUG
+        bool mayBePassedToAnotherThread() const { ASSERT(!m_threadId); return m_refCounter.hasOneRef(); }
+#endif
+
+    private:
+        CrossThreadRefCounted(T* data, ThreadSafeSharedBase* threadedCounter)
+            : m_threadSafeRefCounter(threadedCounter)
+            , m_data(data)
+#ifndef NDEBUG
+            , m_threadId(0)
+#endif
+        {
+        }
+
+        ~CrossThreadRefCounted()
+        {
+            if (!m_threadSafeRefCounter)
+                delete m_data;
+        }
+
+        void threadSafeDeref();
+
+        RefCountedBase m_refCounter;
+        ThreadSafeSharedBase* m_threadSafeRefCounter;
+        T* m_data;
+#ifndef NDEBUG
+        ThreadIdentifier m_threadId;
+#endif
+    };
+
+    template<class T>
+    void CrossThreadRefCounted<T>::ref()
+    {
+        ASSERT(!m_threadId || m_threadId == currentThread());
+        m_refCounter.ref();
+#ifndef NDEBUG
+        // Store the threadId as soon as the ref count gets to 2.
+        // The class gets created with a ref count of 1 and then passed
+        // to another thread where to ref count get increased.  This
+        // is a heuristic but it seems to always work and has helped
+        // find some bugs.
+        if (!m_threadId && m_refCounter.refCount() == 2)
+            m_threadId = currentThread();
+#endif
+    }
+
+    template<class T>
+    void CrossThreadRefCounted<T>::deref()
+    {
+        ASSERT(!m_threadId || m_threadId == currentThread());
+        if (m_refCounter.derefBase()) {
+            threadSafeDeref();
+            delete this;
+        } else {
+#ifndef NDEBUG
+            // Clear the threadId when the ref goes to 1 because it
+            // is safe to be passed to another thread at this point.
+            if (m_threadId && m_refCounter.refCount() == 1)
+                m_threadId = 0;
+#endif
+        }
+    }
+
+    template<class T>
+    T* CrossThreadRefCounted<T>::release()
+    {
+        ASSERT(!isShared());
+
+        T* data = m_data;
+        m_data = 0;
+        return data;
+    }
+
+    template<class T>
+    PassRefPtr<CrossThreadRefCounted<T> > CrossThreadRefCounted<T>::crossThreadCopy()
+    {
+        if (m_threadSafeRefCounter)
+            m_threadSafeRefCounter->ref();
+        else
+            m_threadSafeRefCounter = new ThreadSafeSharedBase(2);
+        return adoptRef(new CrossThreadRefCounted<T>(m_data, m_threadSafeRefCounter));
+    }
+
+
+    template<class T>
+    void CrossThreadRefCounted<T>::threadSafeDeref()
+    {
+        if (m_threadSafeRefCounter && m_threadSafeRefCounter->derefBase()) {
+            delete m_threadSafeRefCounter;
+            m_threadSafeRefCounter = 0;
+        }
+    }
+} // namespace WTF
+
+using WTF::CrossThreadRefCounted;
+
+#endif // CrossThreadRefCounted_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
new file mode 100644
index 0000000000..7ce9d654a4
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CurrentTime.h"
+
+#if PLATFORM(WIN_OS)
+// Windows is first since we want to use hires timers, despite PLATFORM(CF)
+// being defined.
+// If defined, WIN32_LEAN_AND_MEAN disables timeBeginPeriod/timeEndPeriod.
+#undef WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <math.h>
+#include <stdint.h>
+#if HAVE(SYS_TIMEB_H)
+#include <sys/timeb.h>
+#endif
+#if !PLATFORM(WIN_CE)
+#include <sys/types.h>
+#endif
+#include <time.h>
+#elif PLATFORM(CF)
+#include <CoreFoundation/CFDate.h>
+#elif PLATFORM(GTK)
+#include <glib.h>
+#elif PLATFORM(WX)
+#include <wx/datetime.h>
+#else // Posix systems relying on the gettimeofday()
+#include <sys/time.h>
+#endif
+
+namespace WTF {
+
+const double msPerSecond = 1000.0;
+
+#if PLATFORM(WIN_OS)
+
+static LARGE_INTEGER qpcFrequency;
+static bool syncedTime;
+
+static double highResUpTime()
+{
+    // We use QPC, but only after sanity checking its result, due to bugs:
+    // http://support.microsoft.com/kb/274323
+    // http://support.microsoft.com/kb/895980
+    // http://msdn.microsoft.com/en-us/library/ms644904.aspx ("...you can get different results on different processors due to bugs in the basic input/output system (BIOS) or the hardware abstraction layer (HAL)."
+
+    static LARGE_INTEGER qpcLast;
+    static DWORD tickCountLast;
+    static bool inited;
+
+    LARGE_INTEGER qpc;
+    QueryPerformanceCounter(&qpc);
+    DWORD tickCount = GetTickCount();
+
+    if (inited) {
+        __int64 qpcElapsed = ((qpc.QuadPart - qpcLast.QuadPart) * 1000) / qpcFrequency.QuadPart;
+        __int64 tickCountElapsed;
+        if (tickCount >= tickCountLast)
+            tickCountElapsed = (tickCount - tickCountLast);
+        else {
+#if COMPILER(MINGW)
+            __int64 tickCountLarge = tickCount + 0x100000000ULL;
+#else
+            __int64 tickCountLarge = tickCount + 0x100000000I64;
+#endif
+            tickCountElapsed = tickCountLarge - tickCountLast;
+        }
+
+        // force a re-sync if QueryPerformanceCounter differs from GetTickCount by more than 500ms.
+        // (500ms value is from http://support.microsoft.com/kb/274323)
+        __int64 diff = tickCountElapsed - qpcElapsed;
+        if (diff > 500 || diff < -500)
+            syncedTime = false;
+    } else
+        inited = true;
+
+    qpcLast = qpc;
+    tickCountLast = tickCount;
+
+    return (1000.0 * qpc.QuadPart) / static_cast<double>(qpcFrequency.QuadPart);
+}
+
+static double lowResUTCTime()
+{
+#if PLATFORM(WIN_CE)
+    SYSTEMTIME systemTime;
+    GetSystemTime(&systemTime);
+    struct tm tmtime;
+    tmtime.tm_year = systemTime.wYear - 1900;
+    tmtime.tm_mon = systemTime.wMonth - 1;
+    tmtime.tm_mday = systemTime.wDay;
+    tmtime.tm_wday = systemTime.wDayOfWeek;
+    tmtime.tm_hour = systemTime.wHour;
+    tmtime.tm_min = systemTime.wMinute;
+    tmtime.tm_sec = systemTime.wSecond;
+    time_t timet = mktime(&tmtime);
+    return timet * msPerSecond + systemTime.wMilliseconds;
+#else // PLATFORM(WIN_CE)
+    struct _timeb timebuffer;
+    _ftime(&timebuffer);
+    return timebuffer.time * msPerSecond + timebuffer.millitm;
+#endif // PLATFORM(WIN_CE)
+}
+
+static bool qpcAvailable()
+{
+    static bool available;
+    static bool checked;
+
+    if (checked)
+        return available;
+
+    available = QueryPerformanceFrequency(&qpcFrequency);
+    checked = true;
+    return available;
+}
+
+double currentTime()
+{
+    // Use a combination of ftime and QueryPerformanceCounter.
+    // ftime returns the information we want, but doesn't have sufficient resolution.
+    // QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
+    // To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use QueryPerformanceCounter
+    // by itself, adding the delta to the saved ftime.  We periodically re-sync to correct for drift.
+    static bool started;
+    static double syncLowResUTCTime;
+    static double syncHighResUpTime;
+    static double lastUTCTime;
+
+    double lowResTime = lowResUTCTime();
+
+    if (!qpcAvailable())
+        return lowResTime / 1000.0;
+
+    double highResTime = highResUpTime();
+
+    if (!syncedTime) {
+        timeBeginPeriod(1); // increase time resolution around low-res time getter
+        syncLowResUTCTime = lowResTime = lowResUTCTime();
+        timeEndPeriod(1); // restore time resolution
+        syncHighResUpTime = highResTime;
+        syncedTime = true;
+    }
+
+    double highResElapsed = highResTime - syncHighResUpTime;
+    double utc = syncLowResUTCTime + highResElapsed;
+
+    // force a clock re-sync if we've drifted
+    double lowResElapsed = lowResTime - syncLowResUTCTime;
+    const double maximumAllowedDriftMsec = 15.625 * 2.0; // 2x the typical low-res accuracy
+    if (fabs(highResElapsed - lowResElapsed) > maximumAllowedDriftMsec)
+        syncedTime = false;
+
+    // make sure time doesn't run backwards (only correct if difference is < 2 seconds, since DST or clock changes could occur)
+    const double backwardTimeLimit = 2000.0;
+    if (utc < lastUTCTime && (lastUTCTime - utc) < backwardTimeLimit)
+        return lastUTCTime / 1000.0;
+    lastUTCTime = utc;
+    return utc / 1000.0;
+}
+
+#elif PLATFORM(CF)
+
+double currentTime()
+{
+    return CFAbsoluteTimeGetCurrent() + kCFAbsoluteTimeIntervalSince1970;
+}
+
+#elif PLATFORM(GTK)
+
+// Note: GTK on Windows will pick up the PLATFORM(WIN) implementation above which provides
+// better accuracy compared with Windows implementation of g_get_current_time:
+// (http://www.google.com/codesearch/p?hl=en#HHnNRjks1t0/glib-2.5.2/glib/gmain.c&q=g_get_current_time).
+// Non-Windows GTK builds could use gettimeofday() directly but for the sake of consistency lets use GTK function.
+double currentTime()
+{
+    GTimeVal now;
+    g_get_current_time(&now);
+    return static_cast<double>(now.tv_sec) + static_cast<double>(now.tv_usec / 1000000.0);
+}
+
+#elif PLATFORM(WX)
+
+double currentTime()
+{
+    wxDateTime now = wxDateTime::UNow();
+    return (double)now.GetTicks() + (double)(now.GetMillisecond() / 1000.0);
+}
+
+#else // Other Posix systems rely on the gettimeofday().
+
+double currentTime()
+{
+    struct timeval now;
+    struct timezone zone;
+
+    gettimeofday(&now, &zone);
+    return static_cast<double>(now.tv_sec) + (double)(now.tv_usec / 1000000.0);
+}
+
+#endif
+
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
new file mode 100644
index 0000000000..31f1ec8753
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CurrentTime_h
+#define CurrentTime_h
+
+namespace WTF {
+
+    // Returns the current system (UTC) time in seconds, starting January 1, 1970.
+    // Precision varies depending on a platform but usually is as good or better 
+    // than a millisecond.
+    double currentTime();
+
+} // namespace WTF
+
+using WTF::currentTime;
+
+#endif // CurrentTime_h
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h
index 70c546b816..c371d383f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,9 +76,14 @@ namespace WTF {
         template<typename U> void append(const U&);
         template<typename U> void prepend(const U&);
         void removeFirst();
+        void remove(iterator&);
+        void remove(const_iterator&);
 
         void clear();
 
+        template<typename Predicate>
+        iterator findIf(Predicate&);
+
     private:
         friend class DequeIteratorBase<T>;
 
@@ -85,6 +91,7 @@ namespace WTF {
         typedef VectorTypeOperations<T> TypeOperations;
         typedef DequeIteratorBase<T> IteratorBase;
 
+        void remove(size_t position);
         void invalidateIterators();
         void destroyAll();
         void checkValidity() const;
@@ -124,6 +131,7 @@ namespace WTF {
 
     private:
         void addToIteratorsList();
+        void removeFromIteratorsList();
         void checkValidity() const;
         void checkValidity(const Base&) const;
 
@@ -348,7 +356,7 @@ namespace WTF {
         destroyAll();
     }
 
-    template <typename T>
+    template<typename T>
     inline void Deque<T>::swap(Deque<T>& other)
     {
         checkValidity();
@@ -361,7 +369,7 @@ namespace WTF {
         other.checkValidity();
     }
 
-    template <typename T>
+    template<typename T>
     inline void Deque<T>::clear()
     {
         checkValidity();
@@ -373,6 +381,18 @@ namespace WTF {
     }
 
     template<typename T>
+    template<typename Predicate>
+    inline DequeIterator<T> Deque<T>::findIf(Predicate& predicate)
+    {
+        iterator end_iterator = end();
+        for (iterator it = begin(); it != end_iterator; ++it) {
+            if (predicate(*it))
+                return it;
+        }
+        return end_iterator;
+    }
+
+    template<typename T>
     inline void Deque<T>::expandCapacityIfNeeded()
     {
         if (m_start) {
@@ -447,10 +467,48 @@ namespace WTF {
         checkValidity();
     }
 
+    template<typename T>
+    inline void Deque<T>::remove(iterator& it)
+    {
+        it.checkValidity();
+        remove(it.m_index);
+    }
+
+    template<typename T>
+    inline void Deque<T>::remove(const_iterator& it)
+    {
+        it.checkValidity();
+        remove(it.m_index);
+    }
+
+    template<typename T>
+    inline void Deque<T>::remove(size_t position)
+    {
+        if (position == m_end)
+            return;
+
+        checkValidity();
+        invalidateIterators();
+
+        T* buffer = m_buffer.buffer();
+        TypeOperations::destruct(&buffer[position], &buffer[position + 1]);
+
+        // Find which segment of the circular buffer contained the remove element, and only move elements in that part.
+        if (position >= m_start) {
+            TypeOperations::moveOverlapping(buffer + m_start, buffer + position, buffer + m_start + 1);
+            m_start = (m_start + 1) % m_buffer.capacity();
+        } else {
+            TypeOperations::moveOverlapping(buffer + position + 1, buffer + m_end, buffer + position);
+            m_end = (m_end - 1 + m_buffer.capacity()) % m_buffer.capacity();
+        }
+        checkValidity();
+    }
+
 #ifdef NDEBUG
     template<typename T> inline void DequeIteratorBase<T>::checkValidity() const { }
     template<typename T> inline void DequeIteratorBase<T>::checkValidity(const DequeIteratorBase<T>&) const { }
     template<typename T> inline void DequeIteratorBase<T>::addToIteratorsList() { }
+    template<typename T> inline void DequeIteratorBase<T>::removeFromIteratorsList() { }
 #else
     template<typename T>
     void DequeIteratorBase<T>::checkValidity() const
@@ -480,6 +538,30 @@ namespace WTF {
         }
         m_previous = 0;
     }
+
+    template<typename T>
+    void DequeIteratorBase<T>::removeFromIteratorsList()
+    {
+        if (!m_deque) {
+            ASSERT(!m_next);
+            ASSERT(!m_previous);
+        } else {
+            if (m_next) {
+                ASSERT(m_next->m_previous == this);
+                m_next->m_previous = m_previous;
+            }
+            if (m_previous) {
+                ASSERT(m_deque->m_iterators != this);
+                ASSERT(m_previous->m_next == this);
+                m_previous->m_next = m_next;
+            } else {
+                ASSERT(m_deque->m_iterators == this);
+                m_deque->m_iterators = m_next;
+            }
+        }
+        m_next = 0;
+        m_previous = 0;
+    }
 #endif
 
     template<typename T>
@@ -507,30 +589,25 @@ namespace WTF {
     }
 
     template<typename T>
+    inline DequeIteratorBase<T>& DequeIteratorBase<T>::operator=(const Base& other)
+    {
+        checkValidity();
+        other.checkValidity();
+        removeFromIteratorsList();
+
+        m_deque = other.m_deque;
+        m_index = other.m_index;
+        addToIteratorsList();
+        checkValidity();
+        return *this;
+    }
+
+    template<typename T>
     inline DequeIteratorBase<T>::~DequeIteratorBase()
     {
 #ifndef NDEBUG
-        // Delete iterator from doubly-linked list of iterators.
-        if (!m_deque) {
-            ASSERT(!m_next);
-            ASSERT(!m_previous);
-        } else {
-            if (m_next) {
-                ASSERT(m_next->m_previous == this);
-                m_next->m_previous = m_previous;
-            }
-            if (m_previous) {
-                ASSERT(m_deque->m_iterators != this);
-                ASSERT(m_previous->m_next == this);
-                m_previous->m_next = m_next;
-            } else {
-                ASSERT(m_deque->m_iterators == this);
-                m_deque->m_iterators = m_next;
-            }
-        }
+        removeFromIteratorsList();
         m_deque = 0;
-        m_next = 0;
-        m_previous = 0;
 #endif
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
new file mode 100644
index 0000000000..71e6bfa71d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
@@ -0,0 +1,400 @@
+/*
+ * Copyright (C) 2008, 2009 Paul Pedriana <ppedriana@ea.com>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FastAllocBase_h
+#define FastAllocBase_h
+
+// Provides customizable overrides of fastMalloc/fastFree and operator new/delete
+//
+// Provided functionality:
+//    namespace WTF {
+//        class FastAllocBase;
+//
+//        T*    fastNew<T>();
+//        T*    fastNew<T>(arg);
+//        T*    fastNew<T>(arg, arg);
+//        T*    fastNewArray<T>(count);
+//        void  fastDelete(T* p);
+//        void  fastDeleteArray(T* p);
+//        void  fastNonNullDelete(T* p);
+//        void  fastNonNullDeleteArray(T* p);
+//    }
+//
+// FastDelete assumes that the underlying
+//
+// Example usage:
+//    class Widget : public FastAllocBase { ... };
+//
+//    char* charPtr = fastNew<char>();
+//    fastDelete(charPtr);
+//
+//    char* charArrayPtr = fastNewArray<char>(37);
+//    fastDeleteArray(charArrayPtr);
+//
+//    void** voidPtrPtr = fastNew<void*>();
+//    fastDelete(voidPtrPtr);
+//
+//    void** voidPtrArrayPtr = fastNewArray<void*>(37);
+//    fastDeleteArray(voidPtrArrayPtr);
+//
+//    POD* podPtr = fastNew<POD>();
+//    fastDelete(podPtr);
+//
+//    POD* podArrayPtr = fastNewArray<POD>(37);
+//    fastDeleteArray(podArrayPtr);
+//
+//    Object* objectPtr = fastNew<Object>();
+//    fastDelete(objectPtr);
+//
+//    Object* objectArrayPtr = fastNewArray<Object>(37);
+//    fastDeleteArray(objectArrayPtr);
+//
+
+#include <new>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include "FastMalloc.h"
+#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+
+namespace WTF {
+
+    class FastAllocBase {
+    public:
+        // Placement operator new.
+        void* operator new(size_t, void* p) { return p; }
+        void* operator new[](size_t, void* p) { return p; }
+
+        void* operator new(size_t size)
+        {
+            void* p = fastMalloc(size);
+            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNew);
+            return p;
+        }
+
+        void operator delete(void* p)
+        {
+            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNew);
+            fastFree(p);
+        }
+
+        void* operator new[](size_t size)
+        {
+            void* p = fastMalloc(size);
+            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNewArray);
+            return p;
+        }
+
+        void operator delete[](void* p)
+        {
+            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNewArray);
+            fastFree(p);
+        }
+    };
+
+    // fastNew / fastDelete
+
+    template <typename T>
+    inline T* fastNew()
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T;
+    }
+
+    template <typename T, typename Arg1>
+    inline T* fastNew(Arg1 arg1)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1);
+    }
+
+    template <typename T, typename Arg1, typename Arg2>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3, typename Arg4>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3, Arg4 arg4)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3, arg4);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3, typename Arg4, typename Arg5>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3, Arg4 arg4, Arg5 arg5)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3, arg4, arg5);
+    }
+
+    namespace Internal {
+
+        // We define a union of pointer to an integer and pointer to T.
+        // When non-POD arrays are allocated we add a few leading bytes to tell what
+        // the size of the array is. We return to the user the pointer to T.
+        // The way to think of it is as if we allocate a struct like so:
+        //    struct Array {
+        //        AllocAlignmentInteger m_size;
+        //        T m_T[array count];
+        //    };
+
+        template <typename T>
+        union ArraySize {
+            AllocAlignmentInteger* size;
+            T* t;
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a trivial ctor and a trivial dtor.
+        template <typename T, bool trivialCtor, bool trivialDtor>
+        struct NewArrayImpl {
+            static T* fastNewArray(size_t count)
+            {
+                T* p = static_cast<T*>(fastMalloc(sizeof(T) * count));
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                return p;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a non-trivial ctor and a trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, false, true> {
+            static T* fastNewArray(size_t count)
+            {
+                T* p = static_cast<T*>(fastMalloc(sizeof(T) * count));
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+
+                for (T* pObject = p, *pObjectEnd = pObject + count; pObject != pObjectEnd; ++pObject)
+                    ::new(pObject) T;
+
+                return p;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a trivial ctor and a non-trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, true, false> {
+            static T* fastNewArray(size_t count)
+            {
+                void* p = fastMalloc(sizeof(AllocAlignmentInteger) + (sizeof(T) * count));
+                ArraySize<T> a = { static_cast<AllocAlignmentInteger*>(p) };
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                *a.size++ = count;
+                // No need to construct the objects in this case.
+
+                return a.t;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a non-trivial ctor and a non-trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, false, false> {
+            static T* fastNewArray(size_t count)
+            {
+                void* p = fastMalloc(sizeof(AllocAlignmentInteger) + (sizeof(T) * count));
+                ArraySize<T> a = { static_cast<AllocAlignmentInteger*>(p) };
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                *a.size++ = count;
+
+                for (T* pT = a.t, *pTEnd = pT + count; pT != pTEnd; ++pT)
+                    ::new(pT) T;
+
+                return a.t;
+            }
+        };
+    } // namespace Internal
+
+    template <typename T>
+    inline T* fastNewArray(size_t count)
+    {
+        return Internal::NewArrayImpl<T, WTF::HasTrivialConstructor<T>::value, WTF::HasTrivialDestructor<T>::value>::fastNewArray(count);
+    }
+
+    template <typename T>
+    inline void fastDelete(T* p)
+    {
+        if (!p)
+            return;
+
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        p->~T();
+        fastFree(p);
+    }
+
+    namespace Internal {
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a trivial dtor.
+        template <typename T, bool trivialDtor>
+        struct DeleteArrayImpl {
+            static void fastDeleteArray(void* p)
+            {
+                // No need to destruct the objects in this case.
+                // We expect that fastFree checks for null.
+                fastMallocMatchValidateFree(p, Internal::AllocTypeFastNewArray);
+                fastFree(p);
+            }
+        };
+
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a non-trivial dtor.
+        template <typename T>
+        struct DeleteArrayImpl<T, false> {
+            static void fastDeleteArray(T* p)
+            {
+                if (!p)
+                    return;
+
+                ArraySize<T> a;
+                a.t = p;
+                a.size--; // Decrement size pointer
+
+                T* pEnd = p + *a.size;
+                while (pEnd-- != p)
+                    pEnd->~T();
+
+                fastMallocMatchValidateFree(a.size, Internal::AllocTypeFastNewArray);
+                fastFree(a.size);
+            }
+        };
+
+    } // namespace Internal
+
+    template <typename T>
+    void fastDeleteArray(T* p)
+    {
+        Internal::DeleteArrayImpl<T, WTF::HasTrivialDestructor<T>::value>::fastDeleteArray(p);
+    }
+
+
+    template <typename T>
+    inline void fastNonNullDelete(T* p)
+    {
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        p->~T();
+        fastFree(p);
+    }
+
+    namespace Internal {
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a trivial dtor.
+        template <typename T, bool trivialDtor>
+        struct NonNullDeleteArrayImpl {
+            static void fastNonNullDeleteArray(void* p)
+            {
+                fastMallocMatchValidateFree(p, Internal::AllocTypeFastNewArray);
+                // No need to destruct the objects in this case.
+                fastFree(p);
+            }
+        };
+
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a non-trivial dtor.
+        template <typename T>
+        struct NonNullDeleteArrayImpl<T, false> {
+            static void fastNonNullDeleteArray(T* p)
+            {
+                ArraySize<T> a;
+                a.t = p;
+                a.size--;
+
+                T* pEnd = p + *a.size;
+                while (pEnd-- != p)
+                    pEnd->~T();
+
+                fastMallocMatchValidateFree(a.size, Internal::AllocTypeFastNewArray);
+                fastFree(a.size);
+            }
+        };
+
+    } // namespace Internal
+
+    template <typename T>
+    void fastNonNullDeleteArray(T* p)
+    {
+        Internal::NonNullDeleteArrayImpl<T, WTF::HasTrivialDestructor<T>::value>::fastNonNullDeleteArray(p);
+    }
+
+
+} // namespace WTF
+
+#endif // FastAllocBase_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index 4387d61e6a..f1141604c5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -78,6 +78,7 @@
 #include "FastMalloc.h"
 
 #include "Assertions.h"
+#include <limits>
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <pthread.h>
 #endif
@@ -94,7 +95,7 @@
 #define FORCE_SYSTEM_MALLOC 1
 #endif
 
-#define TCMALLOC_TRACK_DECOMMITED_SPANS (HAVE(VIRTUALALLOC))
+#define TCMALLOC_TRACK_DECOMMITED_SPANS (HAVE(VIRTUALALLOC) || HAVE(MADV_FREE_REUSE))
 
 #ifndef NDEBUG
 namespace WTF {
@@ -151,6 +152,19 @@ void fastMallocAllow()
 
 namespace WTF {
 
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+
+namespace Internal {
+
+void fastMallocMatchFailed(void*)
+{
+    CRASH();
+}
+
+} // namespace Internal
+
+#endif
+
 void* fastZeroedMalloc(size_t n) 
 {
     void* result = fastMalloc(n);
@@ -183,13 +197,34 @@ namespace WTF {
 void* tryFastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= n)  // If overflow would occur...
+        return 0;
+
+    void* result = malloc(n + sizeof(AllocAlignmentInteger));
+    if (!result)
+        return 0;
+
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+
+    return result;
+#else
     return malloc(n);
+#endif
 }
 
 void* fastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastMalloc(n);
+#else
     void* result = malloc(n);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -198,13 +233,36 @@ void* fastMalloc(size_t n)
 void* tryFastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    size_t totalBytes = n_elements * element_size;
+    if (n_elements > 1 && element_size && (totalBytes / element_size) != n_elements || (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= totalBytes))
+        return 0;
+
+    totalBytes += sizeof(AllocAlignmentInteger);
+    void* result = malloc(totalBytes);
+    if (!result)
+        return 0;
+
+    memset(result, 0, totalBytes);
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+    return result;
+#else
     return calloc(n_elements, element_size);
+#endif
 }
 
 void* fastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastCalloc(n_elements, element_size);
+#else
     void* result = calloc(n_elements, element_size);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -213,19 +271,57 @@ void* fastCalloc(size_t n_elements, size_t element_size)
 void fastFree(void* p)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (!p)
+        return;
+
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(p);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(p);
+    free(header);
+#else
     free(p);
+#endif
 }
 
 void* tryFastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (p) {
+        if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= n)  // If overflow would occur...
+            return 0;
+        AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(p);
+        if (*header != Internal::AllocTypeMalloc)
+            Internal::fastMallocMatchFailed(p);
+        void* result = realloc(header, n + sizeof(AllocAlignmentInteger));
+        if (!result)
+            return 0;
+
+        // This should not be needed because the value is already there:
+        // *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+        result = static_cast<AllocAlignmentInteger*>(result) + 1;
+        return result;
+    } else {
+        return fastMalloc(n);
+    }
+#else
     return realloc(p, n);
+#endif
 }
 
 void* fastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastRealloc(p, n);
+#else
     void* result = realloc(p, n);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -265,6 +361,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include "TCSystemAlloc.h"
 #include <algorithm>
 #include <errno.h>
+#include <limits>
 #include <new>
 #include <pthread.h>
 #include <stdarg.h>
@@ -321,9 +418,11 @@ namespace WTF {
 #define CHECK_CONDITION ASSERT
 
 #if PLATFORM(DARWIN)
+class Span;
+class TCMalloc_Central_FreeListPadded;
 class TCMalloc_PageHeap;
 class TCMalloc_ThreadCache;
-class TCMalloc_Central_FreeListPadded;
+template <typename T> class PageHeapAllocator;
 
 class FastMallocZone {
 public:
@@ -339,7 +438,7 @@ public:
     static void statistics(malloc_zone_t*, malloc_statistics_t* stats) { memset(stats, 0, sizeof(malloc_statistics_t)); }
 
 private:
-    FastMallocZone(TCMalloc_PageHeap*, TCMalloc_ThreadCache**, TCMalloc_Central_FreeListPadded*);
+    FastMallocZone(TCMalloc_PageHeap*, TCMalloc_ThreadCache**, TCMalloc_Central_FreeListPadded*, PageHeapAllocator<Span>*, PageHeapAllocator<TCMalloc_ThreadCache>*);
     static size_t size(malloc_zone_t*, const void*);
     static void* zoneMalloc(malloc_zone_t*, size_t);
     static void* zoneCalloc(malloc_zone_t*, size_t numItems, size_t size);
@@ -352,6 +451,8 @@ private:
     TCMalloc_PageHeap* m_pageHeap;
     TCMalloc_ThreadCache** m_threadHeaps;
     TCMalloc_Central_FreeListPadded* m_centralCaches;
+    PageHeapAllocator<Span>* m_spanAllocator;
+    PageHeapAllocator<TCMalloc_ThreadCache>* m_pageHeapAllocator;
 };
 
 #endif
@@ -820,6 +921,9 @@ class PageHeapAllocator {
   char* free_area_;
   size_t free_avail_;
 
+  // Linked list of all regions allocated by this allocator
+  void* allocated_regions_;
+
   // Free list of already carved objects
   void* free_list_;
 
@@ -830,6 +934,7 @@ class PageHeapAllocator {
   void Init() {
     ASSERT(kAlignedSize <= kAllocIncrement);
     inuse_ = 0;
+    allocated_regions_ = 0;
     free_area_ = NULL;
     free_avail_ = 0;
     free_list_ = NULL;
@@ -844,9 +949,14 @@ class PageHeapAllocator {
     } else {
       if (free_avail_ < kAlignedSize) {
         // Need more room
-        free_area_ = reinterpret_cast<char*>(MetaDataAlloc(kAllocIncrement));
-        if (free_area_ == NULL) CRASH();
-        free_avail_ = kAllocIncrement;
+        char* new_allocation = reinterpret_cast<char*>(MetaDataAlloc(kAllocIncrement));
+        if (!new_allocation)
+          CRASH();
+
+        *(void**)new_allocation = allocated_regions_;
+        allocated_regions_ = new_allocation;
+        free_area_ = new_allocation + kAlignedSize;
+        free_avail_ = kAllocIncrement - kAlignedSize;
       }
       result = free_area_;
       free_area_ += kAlignedSize;
@@ -863,6 +973,18 @@ class PageHeapAllocator {
   }
 
   int inuse() const { return inuse_; }
+
+#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+  template <class Recorder>
+  void recordAdministrativeRegions(Recorder& recorder, const RemoteMemoryReader& reader)
+  {
+      vm_address_t adminAllocation = reinterpret_cast<vm_address_t>(allocated_regions_);
+      while (adminAllocation) {
+          recorder.recordRegion(adminAllocation, kAllocIncrement);
+          adminAllocation = *reader(reinterpret_cast<vm_address_t*>(adminAllocation));
+      }
+  }
+#endif
 };
 
 // -------------------------------------------------------------------------
@@ -1037,11 +1159,30 @@ template <int BITS> class MapSelector {
   typedef PackedCache<BITS, uint64_t> CacheType;
 };
 
+#if defined(WTF_CHANGES)
+#if PLATFORM(X86_64)
+// On all known X86-64 platforms, the upper 16 bits are always unused and therefore 
+// can be excluded from the PageMap key.
+// See http://en.wikipedia.org/wiki/X86-64#Virtual_address_space_details
+
+static const size_t kBitsUnusedOn64Bit = 16;
+#else
+static const size_t kBitsUnusedOn64Bit = 0;
+#endif
+
+// A three-level map for 64-bit machines
+template <> class MapSelector<64> {
+ public:
+  typedef TCMalloc_PageMap3<64 - kPageShift - kBitsUnusedOn64Bit> Type;
+  typedef PackedCache<64, uint64_t> CacheType;
+};
+#endif
+
 // A two-level map for 32-bit machines
 template <> class MapSelector<32> {
  public:
-  typedef TCMalloc_PageMap2<32-kPageShift> Type;
-  typedef PackedCache<32-kPageShift, uint16_t> CacheType;
+  typedef TCMalloc_PageMap2<32 - kPageShift> Type;
+  typedef PackedCache<32 - kPageShift, uint16_t> CacheType;
 };
 
 // -------------------------------------------------------------------------
@@ -1359,8 +1500,14 @@ static ALWAYS_INLINE void mergeDecommittedStates(Span*, Span*) { }
 #else
 static ALWAYS_INLINE void mergeDecommittedStates(Span* destination, Span* other)
 {
-    if (other->decommitted)
+    if (destination->decommitted && !other->decommitted) {
+        TCMalloc_SystemRelease(reinterpret_cast<void*>(other->start << kPageShift),
+                               static_cast<size_t>(other->length << kPageShift));
+    } else if (other->decommitted && !destination->decommitted) {
+        TCMalloc_SystemRelease(reinterpret_cast<void*>(destination->start << kPageShift),
+                               static_cast<size_t>(destination->length << kPageShift));
         destination->decommitted = true;
+    }
 }
 #endif
 
@@ -3244,7 +3391,20 @@ template <bool crashOnFailure>
 ALWAYS_INLINE
 #endif
 void* malloc(size_t size) {
-  void* result = do_malloc(size);
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= size)  // If overflow would occur...
+        return 0;
+    size += sizeof(AllocAlignmentInteger);
+    void* result = do_malloc(size);
+    if (!result)
+        return 0;
+
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+#else
+    void* result = do_malloc(size);
+#endif
+
 #ifndef WTF_CHANGES
   MallocHook::InvokeNewHook(result, size);
 #endif
@@ -3258,7 +3418,18 @@ void free(void* ptr) {
 #ifndef WTF_CHANGES
   MallocHook::InvokeDeleteHook(ptr);
 #endif
-  do_free(ptr);
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (!ptr)
+        return;
+
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(ptr);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(ptr);
+    do_free(header);
+#else
+    do_free(ptr);
+#endif
 }
 
 #ifndef WTF_CHANGES
@@ -3281,22 +3452,39 @@ template <bool crashOnFailure>
 ALWAYS_INLINE
 #endif
 void* calloc(size_t n, size_t elem_size) {
-  const size_t totalBytes = n * elem_size;
+  size_t totalBytes = n * elem_size;
     
   // Protect against overflow
   if (n > 1 && elem_size && (totalBytes / elem_size) != n)
     return 0;
-    
-  void* result = do_malloc(totalBytes);
-  if (result != NULL) {
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= totalBytes)  // If overflow would occur...
+        return 0;
+
+    totalBytes += sizeof(AllocAlignmentInteger);
+    void* result = do_malloc(totalBytes);
+    if (!result)
+        return 0;
+
     memset(result, 0, totalBytes);
-  }
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+#else
+    void* result = do_malloc(totalBytes);
+    if (result != NULL) {
+        memset(result, 0, totalBytes);
+    }
+#endif
+
 #ifndef WTF_CHANGES
   MallocHook::InvokeNewHook(result, totalBytes);
 #endif
   return result;
 }
 
+// Since cfree isn't used anywhere, we don't compile it in.
+#ifndef WTF_CHANGES
 #ifndef WTF_CHANGES
 extern "C" 
 #endif
@@ -3306,6 +3494,7 @@ void cfree(void* ptr) {
 #endif
   do_free(ptr);
 }
+#endif
 
 #ifndef WTF_CHANGES
 extern "C" 
@@ -3328,10 +3517,14 @@ ALWAYS_INLINE
 #endif
 void* realloc(void* old_ptr, size_t new_size) {
   if (old_ptr == NULL) {
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = malloc(new_size);
+#else
     void* result = do_malloc(new_size);
 #ifndef WTF_CHANGES
     MallocHook::InvokeNewHook(result, new_size);
 #endif
+#endif
     return result;
   }
   if (new_size == 0) {
@@ -3342,6 +3535,16 @@ void* realloc(void* old_ptr, size_t new_size) {
     return NULL;
   }
 
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= new_size)  // If overflow would occur...
+        return 0;
+    new_size += sizeof(AllocAlignmentInteger);
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(old_ptr);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(old_ptr);
+    old_ptr = header;
+#endif
+
   // Get the size of the old entry
   const PageID p = reinterpret_cast<uintptr_t>(old_ptr) >> kPageShift;
   size_t cl = pageheap->GetSizeClassIfCached(p);
@@ -3378,8 +3581,14 @@ void* realloc(void* old_ptr, size_t new_size) {
     // that we already know the sizeclass of old_ptr.  The benefit
     // would be small, so don't bother.
     do_free(old_ptr);
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    new_ptr = static_cast<AllocAlignmentInteger*>(new_ptr) + 1;
+#endif
     return new_ptr;
   } else {
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    old_ptr = pByte + sizeof(AllocAlignmentInteger);  // Set old_ptr back to the user pointer.
+#endif
     return old_ptr;
   }
 }
@@ -3608,6 +3817,7 @@ public:
 
     void visit(void* ptr) { m_freeObjects.add(ptr); }
     bool isFreeObject(void* ptr) const { return m_freeObjects.contains(ptr); }
+    bool isFreeObject(vm_address_t ptr) const { return isFreeObject(reinterpret_cast<void*>(ptr)); }
     size_t freeObjectCount() const { return m_freeObjects.size(); }
 
     void findFreeObjects(TCMalloc_ThreadCache* threadCache)
@@ -3658,7 +3868,9 @@ class PageMapMemoryUsageRecorder {
     vm_range_recorder_t* m_recorder;
     const RemoteMemoryReader& m_reader;
     const FreeObjectFinder& m_freeObjectFinder;
-    mutable HashSet<void*> m_seenPointers;
+
+    HashSet<void*> m_seenPointers;
+    Vector<Span*> m_coalescedSpans;
 
 public:
     PageMapMemoryUsageRecorder(task_t task, void* context, unsigned typeMask, vm_range_recorder_t* recorder, const RemoteMemoryReader& reader, const FreeObjectFinder& freeObjectFinder)
@@ -3670,51 +3882,133 @@ public:
         , m_freeObjectFinder(freeObjectFinder)
     { }
 
-    int visit(void* ptr) const
+    ~PageMapMemoryUsageRecorder()
+    {
+        ASSERT(!m_coalescedSpans.size());
+    }
+
+    void recordPendingRegions()
+    {
+        Span* lastSpan = m_coalescedSpans[m_coalescedSpans.size() - 1];
+        vm_range_t ptrRange = { m_coalescedSpans[0]->start << kPageShift, 0 };
+        ptrRange.size = (lastSpan->start << kPageShift) - ptrRange.address + (lastSpan->length * kPageSize);
+
+        // Mark the memory region the spans represent as a candidate for containing pointers
+        if (m_typeMask & MALLOC_PTR_REGION_RANGE_TYPE)
+            (*m_recorder)(m_task, m_context, MALLOC_PTR_REGION_RANGE_TYPE, &ptrRange, 1);
+
+        if (!(m_typeMask & MALLOC_PTR_IN_USE_RANGE_TYPE)) {
+            m_coalescedSpans.clear();
+            return;
+        }
+
+        Vector<vm_range_t, 1024> allocatedPointers;
+        for (size_t i = 0; i < m_coalescedSpans.size(); ++i) {
+            Span *theSpan = m_coalescedSpans[i];
+            if (theSpan->free)
+                continue;
+
+            vm_address_t spanStartAddress = theSpan->start << kPageShift;
+            vm_size_t spanSizeInBytes = theSpan->length * kPageSize;
+
+            if (!theSpan->sizeclass) {
+                // If it's an allocated large object span, mark it as in use
+                if (!m_freeObjectFinder.isFreeObject(spanStartAddress))
+                    allocatedPointers.append((vm_range_t){spanStartAddress, spanSizeInBytes});
+            } else {
+                const size_t objectSize = ByteSizeForClass(theSpan->sizeclass);
+
+                // Mark each allocated small object within the span as in use
+                const vm_address_t endOfSpan = spanStartAddress + spanSizeInBytes;
+                for (vm_address_t object = spanStartAddress; object + objectSize <= endOfSpan; object += objectSize) {
+                    if (!m_freeObjectFinder.isFreeObject(object))
+                        allocatedPointers.append((vm_range_t){object, objectSize});
+                }
+            }
+        }
+
+        (*m_recorder)(m_task, m_context, MALLOC_PTR_IN_USE_RANGE_TYPE, allocatedPointers.data(), allocatedPointers.size());
+
+        m_coalescedSpans.clear();
+    }
+
+    int visit(void* ptr)
     {
         if (!ptr)
             return 1;
 
         Span* span = m_reader(reinterpret_cast<Span*>(ptr));
+        if (!span->start)
+            return 1;
+
         if (m_seenPointers.contains(ptr))
             return span->length;
         m_seenPointers.add(ptr);
 
-        // Mark the memory used for the Span itself as an administrative region
-        vm_range_t ptrRange = { reinterpret_cast<vm_address_t>(ptr), sizeof(Span) };
-        if (m_typeMask & (MALLOC_PTR_REGION_RANGE_TYPE | MALLOC_ADMIN_REGION_RANGE_TYPE))
-            (*m_recorder)(m_task, m_context, MALLOC_ADMIN_REGION_RANGE_TYPE, &ptrRange, 1);
+        if (!m_coalescedSpans.size()) {
+            m_coalescedSpans.append(span);
+            return span->length;
+        }
 
-        ptrRange.address = span->start << kPageShift;
-        ptrRange.size = span->length * kPageSize;
+        Span* previousSpan = m_coalescedSpans[m_coalescedSpans.size() - 1];
+        vm_address_t previousSpanStartAddress = previousSpan->start << kPageShift;
+        vm_size_t previousSpanSizeInBytes = previousSpan->length * kPageSize;
 
-        // Mark the memory region the span represents as candidates for containing pointers
-        if (m_typeMask & (MALLOC_PTR_REGION_RANGE_TYPE | MALLOC_ADMIN_REGION_RANGE_TYPE))
-            (*m_recorder)(m_task, m_context, MALLOC_PTR_REGION_RANGE_TYPE, &ptrRange, 1);
+        // If the new span is adjacent to the previous span, do nothing for now.
+        vm_address_t spanStartAddress = span->start << kPageShift;
+        if (spanStartAddress == previousSpanStartAddress + previousSpanSizeInBytes) {
+            m_coalescedSpans.append(span);
+            return span->length;
+        }
 
-        if (!span->free && (m_typeMask & MALLOC_PTR_IN_USE_RANGE_TYPE)) {
-            // If it's an allocated large object span, mark it as in use
-            if (span->sizeclass == 0 && !m_freeObjectFinder.isFreeObject(reinterpret_cast<void*>(ptrRange.address)))
-                (*m_recorder)(m_task, m_context, MALLOC_PTR_IN_USE_RANGE_TYPE, &ptrRange, 1);
-            else if (span->sizeclass) {
-                const size_t byteSize = ByteSizeForClass(span->sizeclass);
-                unsigned totalObjects = (span->length << kPageShift) / byteSize;
-                ASSERT(span->refcount <= totalObjects);
-                char* ptr = reinterpret_cast<char*>(span->start << kPageShift);
+        // New span is not adjacent to previous span, so record the spans coalesced so far.
+        recordPendingRegions();
+        m_coalescedSpans.append(span);
 
-                // Mark each allocated small object within the span as in use
-                for (unsigned i = 0; i < totalObjects; i++) {
-                    char* thisObject = ptr + (i * byteSize);
-                    if (m_freeObjectFinder.isFreeObject(thisObject))
-                        continue;
+        return span->length;
+    }
+};
 
-                    vm_range_t objectRange = { reinterpret_cast<vm_address_t>(thisObject), byteSize };
-                    (*m_recorder)(m_task, m_context, MALLOC_PTR_IN_USE_RANGE_TYPE, &objectRange, 1);
-                }
-            }
+class AdminRegionRecorder {
+    task_t m_task;
+    void* m_context;
+    unsigned m_typeMask;
+    vm_range_recorder_t* m_recorder;
+    const RemoteMemoryReader& m_reader;
+
+    Vector<vm_range_t, 1024> m_pendingRegions;
+
+public:
+    AdminRegionRecorder(task_t task, void* context, unsigned typeMask, vm_range_recorder_t* recorder, const RemoteMemoryReader& reader)
+        : m_task(task)
+        , m_context(context)
+        , m_typeMask(typeMask)
+        , m_recorder(recorder)
+        , m_reader(reader)
+    { }
+
+    void recordRegion(vm_address_t ptr, size_t size)
+    {
+        if (m_typeMask & MALLOC_ADMIN_REGION_RANGE_TYPE)
+            m_pendingRegions.append((vm_range_t){ ptr, size });
+    }
+
+    void visit(void *ptr, size_t size)
+    {
+        recordRegion(reinterpret_cast<vm_address_t>(ptr), size);
+    }
+
+    void recordPendingRegions()
+    {
+        if (m_pendingRegions.size()) {
+            (*m_recorder)(m_task, m_context, MALLOC_ADMIN_REGION_RANGE_TYPE, m_pendingRegions.data(), m_pendingRegions.size());
+            m_pendingRegions.clear();
         }
+    }
 
-        return span->length;
+    ~AdminRegionRecorder()
+    {
+        ASSERT(!m_pendingRegions.size());
     }
 };
 
@@ -3737,10 +4031,22 @@ kern_return_t FastMallocZone::enumerate(task_t task, void* context, unsigned typ
 
     TCMalloc_PageHeap::PageMap* pageMap = &pageHeap->pagemap_;
     PageMapFreeObjectFinder pageMapFinder(memoryReader, finder);
-    pageMap->visit(pageMapFinder, memoryReader);
+    pageMap->visitValues(pageMapFinder, memoryReader);
 
     PageMapMemoryUsageRecorder usageRecorder(task, context, typeMask, recorder, memoryReader, finder);
-    pageMap->visit(usageRecorder, memoryReader);
+    pageMap->visitValues(usageRecorder, memoryReader);
+    usageRecorder.recordPendingRegions();
+
+    AdminRegionRecorder adminRegionRecorder(task, context, typeMask, recorder, memoryReader);
+    pageMap->visitAllocations(adminRegionRecorder, memoryReader);
+
+    PageHeapAllocator<Span>* spanAllocator = memoryReader(mzone->m_spanAllocator);
+    PageHeapAllocator<TCMalloc_ThreadCache>* pageHeapAllocator = memoryReader(mzone->m_pageHeapAllocator);
+
+    spanAllocator->recordAdministrativeRegions(adminRegionRecorder, memoryReader);
+    pageHeapAllocator->recordAdministrativeRegions(adminRegionRecorder, memoryReader);
+
+    adminRegionRecorder.recordPendingRegions();
 
     return 0;
 }
@@ -3781,15 +4087,24 @@ void* FastMallocZone::zoneRealloc(malloc_zone_t*, void*, size_t)
 
 extern "C" {
 malloc_introspection_t jscore_fastmalloc_introspection = { &FastMallocZone::enumerate, &FastMallocZone::goodSize, &FastMallocZone::check, &FastMallocZone::print,
-    &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics };
+    &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    , 0 // zone_locked will not be called on the zone unless it advertises itself as version five or higher.
+#endif
+
+    };
 }
 
-FastMallocZone::FastMallocZone(TCMalloc_PageHeap* pageHeap, TCMalloc_ThreadCache** threadHeaps, TCMalloc_Central_FreeListPadded* centralCaches)
+FastMallocZone::FastMallocZone(TCMalloc_PageHeap* pageHeap, TCMalloc_ThreadCache** threadHeaps, TCMalloc_Central_FreeListPadded* centralCaches, PageHeapAllocator<Span>* spanAllocator, PageHeapAllocator<TCMalloc_ThreadCache>* pageHeapAllocator)
     : m_pageHeap(pageHeap)
     , m_threadHeaps(threadHeaps)
     , m_centralCaches(centralCaches)
+    , m_spanAllocator(spanAllocator)
+    , m_pageHeapAllocator(pageHeapAllocator)
 {
     memset(&m_zone, 0, sizeof(m_zone));
+    m_zone.version = 4;
     m_zone.zone_name = "JavaScriptCore FastMalloc";
     m_zone.size = &FastMallocZone::size;
     m_zone.malloc = &FastMallocZone::zoneMalloc;
@@ -3805,7 +4120,7 @@ FastMallocZone::FastMallocZone(TCMalloc_PageHeap* pageHeap, TCMalloc_ThreadCache
 
 void FastMallocZone::init()
 {
-    static FastMallocZone zone(pageheap, &thread_heaps, static_cast<TCMalloc_Central_FreeListPadded*>(central_cache));
+    static FastMallocZone zone(pageheap, &thread_heaps, static_cast<TCMalloc_Central_FreeListPadded*>(central_cache), &span_allocator, &threadheap_allocator);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index f1264ac92f..9e13cf98af 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -56,6 +56,95 @@ namespace WTF {
     };
     FastMallocStatistics fastMallocStatistics();
 
+    // This defines a type which holds an unsigned integer and is the same
+    // size as the minimally aligned memory allocation.
+    typedef unsigned long long AllocAlignmentInteger;
+
+    namespace Internal {
+        enum AllocType {                    // Start with an unusual number instead of zero, because zero is common.
+            AllocTypeMalloc = 0x375d6750,   // Encompasses fastMalloc, fastZeroedMalloc, fastCalloc, fastRealloc.
+            AllocTypeClassNew,              // Encompasses class operator new from FastAllocBase.
+            AllocTypeClassNewArray,         // Encompasses class operator new[] from FastAllocBase.
+            AllocTypeFastNew,               // Encompasses fastNew.
+            AllocTypeFastNewArray,          // Encompasses fastNewArray.
+            AllocTypeNew,                   // Encompasses global operator new.
+            AllocTypeNewArray               // Encompasses global operator new[].
+        };
+    }
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+
+    // Malloc validation is a scheme whereby a tag is attached to an
+    // allocation which identifies how it was originally allocated.
+    // This allows us to verify that the freeing operation matches the
+    // allocation operation. If memory is allocated with operator new[]
+    // but freed with free or delete, this system would detect that.
+    // In the implementation here, the tag is an integer prepended to
+    // the allocation memory which is assigned one of the AllocType
+    // enumeration values. An alternative implementation of this
+    // scheme could store the tag somewhere else or ignore it.
+    // Users of FastMalloc don't need to know or care how this tagging
+    // is implemented.
+
+    namespace Internal {
+
+        // Return the AllocType tag associated with the allocated block p.
+        inline AllocType fastMallocMatchValidationType(const void* p)
+        {
+            const AllocAlignmentInteger* type = static_cast<const AllocAlignmentInteger*>(p) - 1;
+            return static_cast<AllocType>(*type);
+        }
+
+        // Return the address of the AllocType tag associated with the allocated block p.
+        inline AllocAlignmentInteger* fastMallocMatchValidationValue(void* p)
+        {
+            return reinterpret_cast<AllocAlignmentInteger*>(static_cast<char*>(p) - sizeof(AllocAlignmentInteger));
+        }
+
+        // Set the AllocType tag to be associaged with the allocated block p.
+        inline void setFastMallocMatchValidationType(void* p, AllocType allocType)
+        {
+            AllocAlignmentInteger* type = static_cast<AllocAlignmentInteger*>(p) - 1;
+            *type = static_cast<AllocAlignmentInteger>(allocType);
+        }
+
+        // Handle a detected alloc/free mismatch. By default this calls CRASH().
+        void fastMallocMatchFailed(void* p);
+
+    } // namespace Internal
+
+    // This is a higher level function which is used by FastMalloc-using code.
+    inline void fastMallocMatchValidateMalloc(void* p, Internal::AllocType allocType)
+    {
+        if (!p)
+            return;
+
+        Internal::setFastMallocMatchValidationType(p, allocType);
+    }
+
+    // This is a higher level function which is used by FastMalloc-using code.
+    inline void fastMallocMatchValidateFree(void* p, Internal::AllocType allocType)
+    {
+        if (!p)
+            return;
+
+        if (Internal::fastMallocMatchValidationType(p) != allocType)
+            Internal::fastMallocMatchFailed(p);
+        Internal::setFastMallocMatchValidationType(p, Internal::AllocTypeMalloc);  // Set it to this so that fastFree thinks it's OK.
+    }
+
+#else
+
+    inline void fastMallocMatchValidateMalloc(void*, Internal::AllocType)
+    {
+    }
+
+    inline void fastMallocMatchValidateFree(void*, Internal::AllocType)
+    {
+    }
+
+#endif
+
 } // namespace WTF
 
 using WTF::fastMalloc;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
index 58869f4b67..432885f1c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
@@ -56,4 +56,10 @@ template <> void freeOwnedGPtr<GDir>(GDir* ptr)
         g_dir_close(ptr);
 }
 
+template <> void freeOwnedGPtr<GHashTable>(GHashTable* ptr)
+{
+    if (ptr)
+        g_hash_table_unref(ptr);
+}
+
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
index bbb793abc7..8d03ff2246 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
@@ -35,6 +35,7 @@ namespace WTF {
     template<> void freeOwnedGPtr<GMutex>(GMutex*);
     template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
     template<> void freeOwnedGPtr<GDir>(GDir*);
+    template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
 
     template <typename T> class GOwnPtr : Noncopyable {
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h
index b3c0b7a7dc..c8d40f7d54 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h
@@ -21,8 +21,8 @@
 #ifndef WTF_HashTraits_h
 #define WTF_HashTraits_h
 
-#include "Assertions.h"
 #include "HashFunctions.h"
+#include "TypeTraits.h"
 #include <utility>
 #include <limits>
 
@@ -31,47 +31,6 @@ namespace WTF {
     using std::pair;
     using std::make_pair;
 
-    template<typename T> struct IsInteger           { static const bool value = false; };
-    template<> struct IsInteger<bool>               { static const bool value = true; };
-    template<> struct IsInteger<char>               { static const bool value = true; };
-    template<> struct IsInteger<signed char>        { static const bool value = true; };
-    template<> struct IsInteger<unsigned char>      { static const bool value = true; };
-    template<> struct IsInteger<short>              { static const bool value = true; };
-    template<> struct IsInteger<unsigned short>     { static const bool value = true; };
-    template<> struct IsInteger<int>                { static const bool value = true; };
-    template<> struct IsInteger<unsigned int>       { static const bool value = true; };
-    template<> struct IsInteger<long>               { static const bool value = true; };
-    template<> struct IsInteger<unsigned long>      { static const bool value = true; };
-    template<> struct IsInteger<long long>          { static const bool value = true; };
-    template<> struct IsInteger<unsigned long long> { static const bool value = true; };
-
-#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
-    template<> struct IsInteger<wchar_t>            { static const bool value = true; };
-#endif
-
-    COMPILE_ASSERT(IsInteger<bool>::value, WTF_IsInteger_bool_true);
-    COMPILE_ASSERT(IsInteger<char>::value, WTF_IsInteger_char_true);
-    COMPILE_ASSERT(IsInteger<signed char>::value, WTF_IsInteger_signed_char_true);
-    COMPILE_ASSERT(IsInteger<unsigned char>::value, WTF_IsInteger_unsigned_char_true);
-    COMPILE_ASSERT(IsInteger<short>::value, WTF_IsInteger_short_true);
-    COMPILE_ASSERT(IsInteger<unsigned short>::value, WTF_IsInteger_unsigned_short_true);
-    COMPILE_ASSERT(IsInteger<int>::value, WTF_IsInteger_int_true);
-    COMPILE_ASSERT(IsInteger<unsigned int>::value, WTF_IsInteger_unsigned_int_true);
-    COMPILE_ASSERT(IsInteger<long>::value, WTF_IsInteger_long_true);
-    COMPILE_ASSERT(IsInteger<unsigned long>::value, WTF_IsInteger_unsigned_long_true);
-    COMPILE_ASSERT(IsInteger<long long>::value, WTF_IsInteger_long_long_true);
-    COMPILE_ASSERT(IsInteger<unsigned long long>::value, WTF_IsInteger_unsigned_long_long_true);
-
-#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
-    COMPILE_ASSERT(IsInteger<wchar_t>::value, WTF_IsInteger_wchar_t_true);
-#endif
-
-    COMPILE_ASSERT(!IsInteger<char*>::value, WTF_IsInteger_char_pointer_false);
-    COMPILE_ASSERT(!IsInteger<const char* >::value, WTF_IsInteger_const_char_pointer_false);
-    COMPILE_ASSERT(!IsInteger<volatile char* >::value, WTF_IsInteger_volatile_char_pointer__false);
-    COMPILE_ASSERT(!IsInteger<double>::value, WTF_IsInteger_double_false);
-    COMPILE_ASSERT(!IsInteger<float>::value, WTF_IsInteger_float_false);
-
     template<typename T> struct HashTraits;
 
     template<bool isInteger, typename T> struct GenericHashTraitsBase;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
index c7a6caa344..3c19b7a5ee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
@@ -29,26 +29,25 @@
 #include "config.h"
 #include "MainThread.h"
 
+#include "CurrentTime.h"
+#include "Deque.h"
 #include "StdLibExtras.h"
 #include "Threading.h"
-#include "Vector.h"
 
 namespace WTF {
 
 struct FunctionWithContext {
     MainThreadFunction* function;
     void* context;
-    ThreadCondition* syncFlag;
 
-    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0, ThreadCondition* syncFlag = 0)
+    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0)
         : function(function)
         , context(context)
-        , syncFlag(syncFlag)
     { 
     }
 };
 
-typedef Vector<FunctionWithContext> FunctionQueue;
+typedef Deque<FunctionWithContext> FunctionQueue;
 
 static bool callbacksPaused; // This global variable is only accessed from main thread.
 
@@ -64,12 +63,14 @@ static FunctionQueue& functionQueue()
     return staticFunctionQueue;
 }
 
-#if !PLATFORM(WIN)
 void initializeMainThread()
 {
     mainThreadFunctionQueueMutex();
+    initializeMainThreadPlatform();
 }
-#endif
+
+// 0.1 sec delays in UI is approximate threshold when they become noticeable. Have a limit that's half of that.
+static const double maxRunLoopSuspensionTime = 0.05;
 
 void dispatchFunctionsFromMainThread()
 {
@@ -78,52 +79,42 @@ void dispatchFunctionsFromMainThread()
     if (callbacksPaused)
         return;
 
-    FunctionQueue queueCopy;
-    {
-        MutexLocker locker(mainThreadFunctionQueueMutex());
-        queueCopy.swap(functionQueue());
-    }
+    double startTime = currentTime();
+
+    FunctionWithContext invocation;
+    while (true) {
+        {
+            MutexLocker locker(mainThreadFunctionQueueMutex());
+            if (!functionQueue().size())
+                break;
+            invocation = functionQueue().first();
+            functionQueue().removeFirst();
+        }
 
-    for (unsigned i = 0; i < queueCopy.size(); ++i) {
-        FunctionWithContext& invocation = queueCopy[i];
         invocation.function(invocation.context);
-        if (invocation.syncFlag)
-            invocation.syncFlag->signal();
+
+        // If we are running accumulated functions for too long so UI may become unresponsive, we need to
+        // yield so the user input can be processed. Otherwise user may not be able to even close the window.
+        // This code has effect only in case the scheduleDispatchFunctionsOnMainThread() is implemented in a way that
+        // allows input events to be processed before we are back here.
+        if (currentTime() - startTime > maxRunLoopSuspensionTime) {
+            scheduleDispatchFunctionsOnMainThread();
+            break;
+        }
     }
 }
 
 void callOnMainThread(MainThreadFunction* function, void* context)
 {
     ASSERT(function);
-
+    bool needToSchedule = false;
     {
         MutexLocker locker(mainThreadFunctionQueueMutex());
+        needToSchedule = functionQueue().size() == 0;
         functionQueue().append(FunctionWithContext(function, context));
     }
-
-    scheduleDispatchFunctionsOnMainThread();
-}
-
-void callOnMainThreadAndWait(MainThreadFunction* function, void* context)
-{
-    ASSERT(function);
-
-    if (isMainThread()) {
-        function(context);
-        return;
-    }
-
-    ThreadCondition syncFlag;
-    Mutex conditionMutex;
-
-    {
-        MutexLocker locker(mainThreadFunctionQueueMutex());
-        functionQueue().append(FunctionWithContext(function, context, &syncFlag));
-        conditionMutex.lock();
-    }
-
-    scheduleDispatchFunctionsOnMainThread();
-    syncFlag.wait(conditionMutex);
+    if (needToSchedule)
+        scheduleDispatchFunctionsOnMainThread();
 }
 
 void setMainThreadCallbacksPaused(bool paused)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
index 953b9867c7..01ce80476f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
@@ -37,7 +37,6 @@ class Mutex;
 typedef void MainThreadFunction(void*);
 
 void callOnMainThread(MainThreadFunction*, void* context);
-void callOnMainThreadAndWait(MainThreadFunction*, void* context);
 
 void setMainThreadCallbacksPaused(bool paused);
 
@@ -45,9 +44,10 @@ void setMainThreadCallbacksPaused(bool paused);
 void initializeMainThread();
 
 // These functions are internal to the callOnMainThread implementation.
-void dispatchFunctionsFromMainThread();
+void initializeMainThreadPlatform();
 void scheduleDispatchFunctionsOnMainThread();
 Mutex& mainThreadFunctionQueueMutex();
+void dispatchFunctionsFromMainThread();
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
index 481211d0e0..9549f37a35 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,6 +30,7 @@
 #ifndef MessageQueue_h
 #define MessageQueue_h
 
+#include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/Deque.h>
 #include <wtf/Noncopyable.h>
@@ -36,6 +38,12 @@
 
 namespace WTF {
 
+    enum MessageQueueWaitResult {
+        MessageQueueTerminated,       // Queue was destroyed while waiting for message.
+        MessageQueueTimeout,          // Timeout was specified and it expired.
+        MessageQueueMessageReceived,  // A message was successfully received and returned.
+    };
+
     template<typename DataType>
     class MessageQueue : Noncopyable {
     public:
@@ -44,6 +52,8 @@ namespace WTF {
         void append(const DataType&);
         void prepend(const DataType&);
         bool waitForMessage(DataType&);
+        template<typename Predicate>
+        MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
         void kill();
 
         bool tryGetMessage(DataType&);
@@ -52,7 +62,11 @@ namespace WTF {
         // The result of isEmpty() is only valid if no other thread is manipulating the queue at the same time.
         bool isEmpty();
 
+        static double infiniteTime() { return std::numeric_limits<double>::max(); }
+
     private:
+        static bool alwaysTruePredicate(DataType&) { return true; }
+
         mutable Mutex m_mutex;
         ThreadCondition m_condition;
         Deque<DataType> m_queue;
@@ -78,18 +92,34 @@ namespace WTF {
     template<typename DataType>
     inline bool MessageQueue<DataType>::waitForMessage(DataType& result)
     {
+        MessageQueueWaitResult exitReason = waitForMessageFilteredWithTimeout(result, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
+        ASSERT(exitReason == MessageQueueTerminated || exitReason == MessageQueueMessageReceived);
+        return exitReason == MessageQueueMessageReceived;
+    }
+
+    template<typename DataType>
+    template<typename Predicate>
+    inline MessageQueueWaitResult MessageQueue<DataType>::waitForMessageFilteredWithTimeout(DataType& result, Predicate& predicate, double absoluteTime)
+    {
         MutexLocker lock(m_mutex);
-        
-        while (!m_killed && m_queue.isEmpty())
-            m_condition.wait(m_mutex);
+        bool timedOut = false;
+
+        DequeConstIterator<DataType> found = m_queue.end();
+        while (!m_killed && !timedOut && (found = m_queue.findIf(predicate)) == m_queue.end())
+            timedOut = !m_condition.timedWait(m_mutex, absoluteTime);
+
+        ASSERT(!timedOut || absoluteTime != infiniteTime());
 
         if (m_killed)
-            return false;
+            return MessageQueueTerminated;
 
-        ASSERT(!m_queue.isEmpty());
-        result = m_queue.first();
-        m_queue.removeFirst();
-        return true;
+        if (timedOut)
+            return MessageQueueTimeout;
+
+        ASSERT(found != m_queue.end());
+        result = *found;
+        m_queue.remove(found);
+        return MessageQueueMessageReceived;
     }
 
     template<typename DataType>
@@ -129,8 +159,13 @@ namespace WTF {
         MutexLocker lock(m_mutex);
         return m_killed;
     }
-}
+} // namespace WTF
 
 using WTF::MessageQueue;
+// MessageQueueWaitResult enum and all its values.
+using WTF::MessageQueueWaitResult;
+using WTF::MessageQueueTerminated;
+using WTF::MessageQueueTimeout;
+using WTF::MessageQueueMessageReceived;
 
 #endif // MessageQueue_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h b/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h
index f0bb866545..4263bcecab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h
@@ -32,4 +32,6 @@ namespace WTF {
 
 } // namespace WTF
 
+using WTF::notFound;
+
 #endif // NotFound_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
new file mode 100644
index 0000000000..5c0d0647bf
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef OwnFastMallocPtr_h
+#define OwnFastMallocPtr_h
+
+#include "FastMalloc.h"
+#include "Noncopyable.h"
+
+namespace WTF {
+
+    template<class T> class OwnFastMallocPtr : Noncopyable {
+    public:
+        explicit OwnFastMallocPtr(T* ptr) : m_ptr(ptr)
+        {
+        }
+
+        ~OwnFastMallocPtr()
+        {
+            fastFree(m_ptr);
+        }
+
+        T* get() const { return m_ptr; }
+        T* release() { T* ptr = m_ptr; m_ptr = 0; return ptr; }
+
+    private:
+        T* m_ptr;
+    };
+
+} // namespace WTF
+
+using WTF::OwnFastMallocPtr;
+
+#endif // OwnFastMallocPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
index 256b55c5a6..9e4bd32ae8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -21,53 +21,35 @@
 #ifndef WTF_OwnPtr_h
 #define WTF_OwnPtr_h
 
+#include "Assertions.h"
+#include "Noncopyable.h"
+#include "OwnPtrCommon.h"
+#include "TypeTraits.h"
 #include <algorithm>
 #include <memory>
-#include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
-
-#if PLATFORM(WIN)
-
-typedef struct HBITMAP__* HBITMAP;
-typedef struct HBRUSH__* HBRUSH;
-typedef struct HFONT__* HFONT;
-typedef struct HPALETTE__* HPALETTE;
-typedef struct HPEN__* HPEN;
-typedef struct HRGN__* HRGN;
-
-#endif
 
 namespace WTF {
 
     // Unlike most of our smart pointers, OwnPtr can take either the pointer type or the pointed-to type.
 
-    // FIXME: Share a single RemovePointer class template with RetainPtr.
-    template <typename T> struct OwnPtrRemovePointer { typedef T type; };
-    template <typename T> struct OwnPtrRemovePointer<T*> { typedef T type; };
-
-    template <typename T> inline void deleteOwnedPtr(T* ptr)
-    {
-        typedef char known[sizeof(T) ? 1 : -1];
-        if (sizeof(known))
-            delete ptr;
-    }
-
-#if PLATFORM(WIN)
-    void deleteOwnedPtr(HBITMAP);
-    void deleteOwnedPtr(HBRUSH);
-    void deleteOwnedPtr(HFONT);
-    void deleteOwnedPtr(HPALETTE);
-    void deleteOwnedPtr(HPEN);
-    void deleteOwnedPtr(HRGN);
-#endif
+    template <typename T> class PassOwnPtr;
 
     template <typename T> class OwnPtr : Noncopyable {
     public:
-        typedef typename OwnPtrRemovePointer<T>::type ValueType;
+        typedef typename RemovePointer<T>::Type ValueType;
         typedef ValueType* PtrType;
 
         explicit OwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
         OwnPtr(std::auto_ptr<ValueType> autoPtr) : m_ptr(autoPtr.release()) { }
+        // See comment in PassOwnPtr.h for why this takes a const reference.
+        template <typename U> OwnPtr(const PassOwnPtr<U>& o);
+
+        // This copy constructor is used implicitly by gcc when it generates
+        // transients for assigning a PassOwnPtr<T> object to a stack-allocated
+        // OwnPtr<T> object.  It should never be called explicitly and gcc
+        // should optimize away the constructor when generating code.
+        OwnPtr(const OwnPtr<ValueType>& o);
+
         ~OwnPtr() { deleteOwnedPtr(m_ptr); }
 
         PtrType get() const { return m_ptr; }
@@ -89,19 +71,50 @@ namespace WTF {
         typedef PtrType OwnPtr::*UnspecifiedBoolType;
         operator UnspecifiedBoolType() const { return m_ptr ? &OwnPtr::m_ptr : 0; }
 
+        OwnPtr& operator=(const PassOwnPtr<T>&);
+        template <typename U> OwnPtr& operator=(const PassOwnPtr<U>&);
+
         void swap(OwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
 
     private:
         PtrType m_ptr;
     };
-    
-    template <typename T> inline void swap(OwnPtr<T>& a, OwnPtr<T>& b) { a.swap(b); }
+
+    template <typename T> template <typename U> inline OwnPtr<T>::OwnPtr(const PassOwnPtr<U>& o)
+        : m_ptr(o.release())
+    {
+    }
+
+    template <typename T> inline OwnPtr<T>& OwnPtr<T>::operator=(const PassOwnPtr<T>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> template <typename U> inline OwnPtr<T>& OwnPtr<T>::operator=(const PassOwnPtr<U>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> inline void swap(OwnPtr<T>& a, OwnPtr<T>& b)
+    {
+        a.swap(b);
+    }
 
     template <typename T, typename U> inline bool operator==(const OwnPtr<T>& a, U* b)
-    { 
+    {
         return a.get() == b; 
     }
-    
+
     template <typename T, typename U> inline bool operator==(T* a, const OwnPtr<U>& b) 
     {
         return a == b.get(); 
@@ -113,10 +126,10 @@ namespace WTF {
     }
 
     template <typename T, typename U> inline bool operator!=(T* a, const OwnPtr<U>& b)
-    { 
+    {
         return a != b.get(); 
     }
-    
+
     template <typename T> inline typename OwnPtr<T>::PtrType getPtr(const OwnPtr<T>& p)
     {
         return p.get();
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
new file mode 100644
index 0000000000..6cd8bdd565
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_OwnPtrCommon_h
+#define WTF_OwnPtrCommon_h
+
+#if PLATFORM(WIN)
+typedef struct HBITMAP__* HBITMAP;
+typedef struct HBRUSH__* HBRUSH;
+typedef struct HFONT__* HFONT;
+typedef struct HPALETTE__* HPALETTE;
+typedef struct HPEN__* HPEN;
+typedef struct HRGN__* HRGN;
+#endif
+
+namespace WTF {
+
+    template <typename T> inline void deleteOwnedPtr(T* ptr)
+    {
+        typedef char known[sizeof(T) ? 1 : -1];
+        if (sizeof(known))
+            delete ptr;
+    }
+
+#if PLATFORM(WIN)
+    void deleteOwnedPtr(HBITMAP);
+    void deleteOwnedPtr(HBRUSH);
+    void deleteOwnedPtr(HFONT);
+    void deleteOwnedPtr(HPALETTE);
+    void deleteOwnedPtr(HPEN);
+    void deleteOwnedPtr(HRGN);
+#endif
+
+} // namespace WTF
+
+#endif // WTF_OwnPtrCommon_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassOwnPtr.h
new file mode 100644
index 0000000000..ae70457863
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassOwnPtr.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_PassOwnPtr_h
+#define WTF_PassOwnPtr_h
+
+#include "Assertions.h"
+#include "OwnPtrCommon.h"
+#include "TypeTraits.h"
+
+namespace WTF {
+
+    // Unlike most of our smart pointers, PassOwnPtr can take either the pointer type or the pointed-to type.
+
+    template <typename T> class OwnPtr;
+
+    template <typename T> class PassOwnPtr {
+    public:
+        typedef typename RemovePointer<T>::Type ValueType;
+        typedef ValueType* PtrType;
+
+        PassOwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
+        // It somewhat breaks the type system to allow transfer of ownership out of
+        // a const PassOwnPtr. However, it makes it much easier to work with PassOwnPtr
+        // temporaries, and we don't really have a need to use real const PassOwnPtrs 
+        // anyway.
+        PassOwnPtr(const PassOwnPtr& o) : m_ptr(o.release()) { }
+        template <typename U> PassOwnPtr(const PassOwnPtr<U>& o) : m_ptr(o.release()) { }
+
+        ~PassOwnPtr() { deleteOwnedPtr(m_ptr); }
+
+        PtrType get() const { return m_ptr; }
+
+        void clear() { m_ptr = 0; }
+        PtrType release() const { PtrType ptr = m_ptr; m_ptr = 0; return ptr; }
+
+        ValueType& operator*() const { ASSERT(m_ptr); return *m_ptr; }
+        PtrType operator->() const { ASSERT(m_ptr); return m_ptr; }
+
+        bool operator!() const { return !m_ptr; }
+
+        // This conversion operator allows implicit conversion to bool but not to other integer types.
+        typedef PtrType PassOwnPtr::*UnspecifiedBoolType;
+        operator UnspecifiedBoolType() const { return m_ptr ? &PassOwnPtr::m_ptr : 0; }
+
+        PassOwnPtr& operator=(T*);
+        PassOwnPtr& operator=(const PassOwnPtr<T>&);
+        template <typename U> PassOwnPtr& operator=(const PassOwnPtr<U>&);
+
+    private:
+        mutable PtrType m_ptr;
+    };
+
+    template <typename T> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(T* optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr;
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(const PassOwnPtr<T>& optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> template <typename U> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(const PassOwnPtr<U>& optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, const OwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator==(const OwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, U* b) 
+    {
+        return a.get() == b; 
+    }
+    
+    template <typename T, typename U> inline bool operator==(T* a, const PassOwnPtr<U>& b) 
+    {
+        return a == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, const OwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const OwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, U* b)
+    {
+        return a.get() != b; 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(T* a, const PassOwnPtr<U>& b) 
+    {
+        return a != b.get(); 
+    }
+
+    template <typename T, typename U> inline PassOwnPtr<T> static_pointer_cast(const PassOwnPtr<U>& p) 
+    {
+        return PassOwnPtr<T>(static_cast<T*>(p.release())); 
+    }
+
+    template <typename T, typename U> inline PassOwnPtr<T> const_pointer_cast(const PassOwnPtr<U>& p) 
+    {
+        return PassOwnPtr<T>(const_cast<T*>(p.release())); 
+    }
+
+    template <typename T> inline T* getPtr(const PassOwnPtr<T>& p)
+    {
+        return p.get();
+    }
+
+} // namespace WTF
+
+using WTF::PassOwnPtr;
+using WTF::const_pointer_cast;
+using WTF::static_pointer_cast;
+
+#endif // WTF_PassOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
index c1dc309f4d..d80ed62913 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
@@ -40,7 +40,7 @@ namespace WTF {
         PassRefPtr(const PassRefPtr& o) : m_ptr(o.releaseRef()) {}
         template <typename U> PassRefPtr(const PassRefPtr<U>& o) : m_ptr(o.releaseRef()) { }
 
-        ALWAYS_INLINE ~PassRefPtr() { if (T* ptr = m_ptr) ptr->deref(); }
+        ALWAYS_INLINE ~PassRefPtr() { if (UNLIKELY(m_ptr != 0)) m_ptr->deref(); }
         
         template <class U> 
         PassRefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) ptr->ref(); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 6c27123174..b08e08c162 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -40,6 +40,12 @@
 /* be used regardless of operating environment */
 #ifdef __APPLE__
 #define WTF_PLATFORM_DARWIN 1
+#include <AvailabilityMacros.h>
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
+#define BUILDING_ON_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
+#define BUILDING_ON_LEOPARD 1
+#endif
 #endif
 
 /* PLATFORM(WIN_OS) */
@@ -58,6 +64,13 @@
 #include <ce_time.h>
 #endif
 
+/* PLATFORM(LINUX) */
+/* Operating system level dependencies for Linux-like systems that */
+/* should be used regardless of operating environment */
+#ifdef __linux__
+#define WTF_PLATFORM_LINUX 1
+#endif
+
 /* PLATFORM(FREEBSD) */
 /* Operating system level dependencies for FreeBSD-like systems that */
 /* should be used regardless of operating environment */
@@ -208,11 +221,15 @@
 
 /* PLATFORM(X86_64) */
 #if   defined(__x86_64__) \
-   || defined(__ia64__) \
    || defined(_M_X64)
 #define WTF_PLATFORM_X86_64 1
 #endif
 
+/* PLATFORM(SH4) */
+#if defined(__SH4__)
+#define WTF_PLATFORM_SH4 1
+#endif
+
 /* PLATFORM(SPARC64) */
 #if defined(__sparc64__)
 #define WTF_PLATFORM_SPARC64 1
@@ -301,9 +318,7 @@
 #define ENABLE_DASHBOARD_SUPPORT 1
 #endif
 #define HAVE_READLINE 1
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-#define HAVE_DTRACE 1
-#endif
+#define HAVE_RUNLOOP_TIMER 1
 #endif
 
 #if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
@@ -316,6 +331,7 @@
 #endif
 
 #if PLATFORM(WX)
+#define ENABLE_ASSEMBLER 1
 #define WTF_USE_CURL 1
 #define WTF_USE_PTHREADS 1
 #endif
@@ -332,13 +348,10 @@
 #endif
 #endif /* !defined(HAVE_ACCESSIBILITY) */
 
-#if COMPILER(GCC)
-#define HAVE_COMPUTED_GOTO 1
-#endif
-
 #if PLATFORM(DARWIN)
 
 #define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 1
 #define HAVE_MMAP 1
 #define HAVE_MERGESORT 1
 #define HAVE_SBRK 1
@@ -347,6 +360,11 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#define HAVE_MADV_FREE_REUSE 1
+#define HAVE_MADV_FREE 1
+#endif
+
 #elif PLATFORM(WIN_OS)
 
 #define HAVE_FLOAT_H 1
@@ -375,6 +393,7 @@
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
 
 #define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 1
 #define HAVE_MMAP 1
 #define HAVE_SBRK 1
 #define HAVE_STRINGS_H 1
@@ -385,6 +404,12 @@
 
 /* ENABLE macro defaults */
 
+/* fastMalloc match validation allows for runtime verification that
+   new is matched by delete, fastMalloc is matched by fastFree, etc. */
+#if !defined(ENABLE_FAST_MALLOC_MATCH_VALIDATION)
+#define ENABLE_FAST_MALLOC_MATCH_VALIDATION 0
+#endif
+
 #if !defined(ENABLE_ICONDATABASE)
 #define ENABLE_ICONDATABASE 1
 #endif
@@ -417,16 +442,15 @@
 #define ENABLE_OPCODE_STATS 0
 #endif
 
-#if !defined(ENABLE_CODEBLOCK_SAMPLING)
+#define ENABLE_SAMPLING_COUNTERS 0
+#define ENABLE_SAMPLING_FLAGS 0
+#define ENABLE_OPCODE_SAMPLING 0
 #define ENABLE_CODEBLOCK_SAMPLING 0
+#if ENABLE(CODEBLOCK_SAMPLING) && !ENABLE(OPCODE_SAMPLING)
+#error "CODEBLOCK_SAMPLING requires OPCODE_SAMPLING"
 #endif
-
-#if ENABLE(CODEBLOCK_SAMPLING) && !defined(ENABLE_OPCODE_SAMPLING)
-#define ENABLE_OPCODE_SAMPLING 1
-#endif
-
-#if !defined(ENABLE_OPCODE_SAMPLING)
-#define ENABLE_OPCODE_SAMPLING 0
+#if ENABLE(OPCODE_SAMPLING) || ENABLE(SAMPLING_FLAGS)
+#define ENABLE_SAMPLING_THREAD 1
 #endif
 
 #if !defined(ENABLE_GEOLOCATION)
@@ -437,51 +461,80 @@
 #define ENABLE_TEXT_CARET 1
 #endif
 
+#if !defined(ENABLE_ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL)
+#define ENABLE_ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL 0
+#endif
+
+#if !defined(WTF_USE_ALTERNATE_JSIMMEDIATE) && PLATFORM(X86_64) && PLATFORM(MAC)
+#define WTF_USE_ALTERNATE_JSIMMEDIATE 1
+#endif
+
+#if !defined(ENABLE_REPAINT_THROTTLING)
+#define ENABLE_REPAINT_THROTTLING 0
+#endif
+
 #if !defined(ENABLE_JIT)
-/* x86-64 support is under development. */
+/* The JIT is tested & working on x86_64 Mac */
 #if PLATFORM(X86_64) && PLATFORM(MAC)
-    #define ENABLE_JIT 0
-    #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-    #define ENABLE_JIT_OPTIMIZE_CALL 1
-    #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
-    #define WTF_USE_ALTERNATE_JSIMMEDIATE 1
+    #define ENABLE_JIT 1
 /* The JIT is tested & working on x86 Mac */
 #elif PLATFORM(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-    #define ENABLE_JIT_OPTIMIZE_CALL 1
-    #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
-    #define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
 /* The JIT is tested & working on x86 Windows */
 #elif PLATFORM(X86) && PLATFORM(WIN)
     #define ENABLE_JIT 1
-    #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
+#endif
     #define ENABLE_JIT_OPTIMIZE_CALL 1
+    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 1
     #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
     #define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
+    #define ENABLE_JIT_OPTIMIZE_METHOD_CALLS 1
 #endif
+
+#if PLATFORM(X86_64)
+    #define JSC_HOST_CALL
+#elif COMPILER(MSVC)
+    #define JSC_HOST_CALL __fastcall
+#elif COMPILER(GCC) && PLATFORM(X86)
+    #define JSC_HOST_CALL __attribute__ ((fastcall))
+#else
+    #if ENABLE(JIT)
+    #error Need to support register calling convention in this compiler
+    #else
+    #define JSC_HOST_CALL
+    #endif
 #endif
 
-#if ENABLE(JIT)
-#if !(USE(JIT_STUB_ARGUMENT_VA_LIST) || USE(JIT_STUB_ARGUMENT_REGISTER) || USE(JIT_STUB_ARGUMENT_STACK))
-#error Please define one of the JIT_STUB_ARGUMENT settings.
-#elif (USE(JIT_STUB_ARGUMENT_VA_LIST) && USE(JIT_STUB_ARGUMENT_REGISTER)) \
-   || (USE(JIT_STUB_ARGUMENT_VA_LIST) && USE(JIT_STUB_ARGUMENT_STACK)) \
-   || (USE(JIT_STUB_ARGUMENT_REGISTER) && USE(JIT_STUB_ARGUMENT_STACK))
-#error Please do not define more than one of the JIT_STUB_ARGUMENT settings.
+#if COMPILER(GCC) && !ENABLE(JIT)
+#define HAVE_COMPUTED_GOTO 1
 #endif
+
+#if ENABLE(JIT) && defined(COVERAGE)
+    #define WTF_USE_INTERPRETER 0
+#else
+    #define WTF_USE_INTERPRETER 1
 #endif
 
-/* WREC supports x86 & x86-64, and has been tested on Mac and Windows ('cept on 64-bit on Mac). */
-#if (!defined(ENABLE_WREC) && PLATFORM(X86) && PLATFORM(MAC)) \
- || (!defined(ENABLE_WREC) && PLATFORM(X86_64) && PLATFORM(MAC)) \
- || (!defined(ENABLE_WREC) && PLATFORM(X86) && PLATFORM(WIN))
-#define ENABLE_WREC 1
+/* Yet Another Regex Runtime. */
+/* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
+#if (!defined(ENABLE_YARR_JIT) && PLATFORM(X86) && PLATFORM(MAC)) \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM(X86_64) && PLATFORM(MAC)) \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM(X86) && PLATFORM(WIN))
+#define ENABLE_YARR 1
+#define ENABLE_YARR_JIT 1
+#endif
+/* Sanity Check */
+#if ENABLE(YARR_JIT) && !ENABLE(YARR)
+#error "YARR_JIT requires YARR"
 #endif
 
-#if ENABLE(JIT) || ENABLE(WREC)
+#if ENABLE(JIT) || ENABLE(YARR_JIT)
 #define ENABLE_ASSEMBLER 1
 #endif
+/* Setting this flag prevents the assembler from using RWX memory; this may improve
+   security but currectly comes at a significant performance cost. */
+#define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
 
 #if !defined(ENABLE_PAN_SCROLLING) && PLATFORM(WIN_OS)
 #define ENABLE_PAN_SCROLLING 1
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
new file mode 100644
index 0000000000..477e893d60
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PtrAndFlags_h
+#define PtrAndFlags_h
+
+#include <wtf/Assertions.h>
+
+namespace WTF {
+    template<class T, typename FlagEnum> class PtrAndFlags {
+    public:
+        PtrAndFlags() : m_ptrAndFlags(0) {}
+
+        bool isFlagSet(FlagEnum flagNumber) const { ASSERT(flagNumber < 2); return m_ptrAndFlags & (1 << flagNumber); }
+        void setFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags |= (1 << flagNumber);}
+        void clearFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags &= ~(1 << flagNumber);}
+        T* get() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
+        void set(T* ptr) { ASSERT(!(reinterpret_cast<intptr_t>(ptr) & 3)); m_ptrAndFlags = reinterpret_cast<intptr_t>(ptr) | (m_ptrAndFlags & 3);}
+    private:
+        intptr_t m_ptrAndFlags;
+    };
+} // namespace WTF
+
+using WTF::PtrAndFlags;
+
+#endif // PtrAndFlags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
index e5692271ec..c94d5a4b90 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
@@ -36,6 +36,16 @@
 
 namespace WTF {
 
+double weakRandomNumber()
+{
+#if COMPILER(MSVC) && defined(_CRT_RAND_S)
+    // rand_s is incredibly slow on windows so we fall back on rand for Math.random
+    return (rand() + (rand() / (RAND_MAX + 1.0))) / (RAND_MAX + 1.0);
+#else
+    return randomNumber();
+#endif
+}
+
 double randomNumber()
 {
 #if !ENABLE(JSC_MULTIPLE_THREADS)
@@ -46,42 +56,39 @@ double randomNumber()
     }
 #endif
     
-    uint32_t part1;
-    uint32_t part2;
-    uint64_t fullRandom;
 #if COMPILER(MSVC) && defined(_CRT_RAND_S)
-    rand_s(&part1);
-    rand_s(&part2);
-    fullRandom = part1;
-    fullRandom <<= 32;
-    fullRandom |= part2;
+    uint32_t bits;
+    rand_s(&bits);
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #elif PLATFORM(DARWIN)
-    part1 = arc4random();
-    part2 = arc4random();
-    fullRandom = part1;
-    fullRandom <<= 32;
-    fullRandom |= part2;
+    uint32_t bits = arc4random();
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #elif PLATFORM(UNIX)
-    part1 = random() & (RAND_MAX - 1);
-    part2 = random() & (RAND_MAX - 1);
+    uint32_t part1 = random() & (RAND_MAX - 1);
+    uint32_t part2 = random() & (RAND_MAX - 1);
     // random only provides 31 bits
-    fullRandom = part1;
+    uint64_t fullRandom = part1;
     fullRandom <<= 31;
     fullRandom |= part2;
+
+    // Mask off the low 53bits
+    fullRandom &= (1LL << 53) - 1;
+    return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #else
-    part1 = rand() & (RAND_MAX - 1);
-    part2 = rand() & (RAND_MAX - 1);
+    uint32_t part1 = rand() & (RAND_MAX - 1);
+    uint32_t part2 = rand() & (RAND_MAX - 1);
     // rand only provides 31 bits, and the low order bits of that aren't very random
     // so we take the high 26 bits of part 1, and the high 27 bits of part2.
     part1 >>= 5; // drop the low 5 bits
     part2 >>= 4; // drop the low 4 bits
-    fullRandom = part1;
+    uint64_t fullRandom = part1;
     fullRandom <<= 27;
     fullRandom |= part2;
-#endif
+
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
+#endif
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h
index 3540344a94..fe1687c6bb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h
@@ -28,9 +28,15 @@
 
 namespace WTF {
 
-    // Returns a pseudo-random number in the range [0, 1)
+    // Returns a pseudo-random number in the range [0, 1), attempts to be
+    // cryptographically secure if possible on the target platform
     double randomNumber();
 
+    // Returns a pseudo-random number in the range [0, 1), attempts to
+    // produce a reasonable "random" number fast.
+    // We only need this because rand_s is so slow on windows.
+    double weakRandomNumber();
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
index c7af3d66fd..161377f183 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -61,6 +61,15 @@ inline void initializeRandomNumberGenerator()
 #endif
 }
 
+inline void initializeWeakRandomNumberGenerator()
+{
+#if COMPILER(MSVC) && defined(_CRT_RAND_S)
+    // We need to initialise windows rand() explicitly for Math.random
+    unsigned seed = 0;
+    rand_s(&seed);
+    srand(seed);
+#endif
+}
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h
index ac8e167bf7..c174145dce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h
@@ -49,15 +49,17 @@ public:
     }
 
 protected:
-    RefCountedBase(int initialRefCount)
-        : m_refCount(initialRefCount)
+    RefCountedBase()
+        : m_refCount(1)
 #ifndef NDEBUG
         , m_deletionHasBegun(false)
 #endif
     {
     }
 
-    ~RefCountedBase() {}
+    ~RefCountedBase()
+    {
+    }
 
     // Returns whether the pointer should be freed or not.
     bool derefBase()
@@ -75,7 +77,23 @@ protected:
         return false;
     }
 
-protected:
+    // Helper for generating JIT code. Please do not use for non-JIT purposes.
+    int* addressOfCount()
+    {
+        return &m_refCount;
+    }
+
+#ifndef NDEBUG
+    bool deletionHasBegun() const
+    {
+        return m_deletionHasBegun;
+    }
+#endif
+
+private:
+    template<class T>
+    friend class CrossThreadRefCounted;
+
     int m_refCount;
 #ifndef NDEBUG
     bool m_deletionHasBegun;
@@ -85,11 +103,6 @@ protected:
 
 template<class T> class RefCounted : public RefCountedBase {
 public:
-    RefCounted(int initialRefCount = 1)
-        : RefCountedBase(initialRefCount)
-    {
-    }
-
     void deref()
     {
         if (derefBase())
@@ -97,7 +110,9 @@ public:
     }
 
 protected:
-    ~RefCounted() {}
+    ~RefCounted()
+    {
+    }
 };
 
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h
index a66a12748a..77f25e05f9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h
@@ -21,6 +21,7 @@
 #ifndef RetainPtr_h
 #define RetainPtr_h
 
+#include "TypeTraits.h"
 #include <algorithm>
 #include <CoreFoundation/CoreFoundation.h>
 
@@ -30,14 +31,6 @@
 
 namespace WTF {
 
-    template <typename T> struct RemovePointer {
-        typedef T type;
-    };
-
-    template <typename T> struct RemovePointer<T*> {
-        typedef T type;
-    };
-
     // Unlike most most of our smart pointers, RetainPtr can take either the pointer type or the pointed-to type,
     // so both RetainPtr<NSDictionary> and RetainPtr<CFDictionaryRef> will work.
 
@@ -56,7 +49,7 @@ namespace WTF {
 
     template <typename T> class RetainPtr {
     public:
-        typedef typename RemovePointer<T>::type ValueType;
+        typedef typename RemovePointer<T>::Type ValueType;
         typedef ValueType* PtrType;
 
         RetainPtr() : m_ptr(0) {}
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
index ddc5a58df1..afc5e8a9e3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
@@ -23,7 +23,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#ifndef WTF_StdLibExtras_h
+#define WTF_StdLibExtras_h
+
 #include <wtf/Platform.h>
+#include <wtf/Assertions.h>
 
 // Use these to declare and define a static local variable (static T;) so that
 //  it is leaked so that its destructors are not called at exit. Using this
@@ -36,3 +40,24 @@
 #define DEFINE_STATIC_LOCAL(type, name, arguments) \
     static type& name = *new type arguments
 #endif
+
+namespace WTF {
+
+    /*
+     * C++'s idea of a reinterpret_cast lacks sufficient cojones.
+     */
+    template<typename TO, typename FROM>
+    TO bitwise_cast(FROM from)
+    {
+        COMPILE_ASSERT(sizeof(TO) == sizeof(FROM), WTF_bitwise_cast_sizeof_casted_types_is_equal);
+        union {
+            FROM from;
+            TO to;
+        } u;
+        u.from = from;
+        return u.to;
+    }
+
+} // namespace WTF
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 881b0667bc..926fd61254 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -29,6 +29,10 @@
 #include <stdarg.h>
 #include <stdio.h>
 
+#if HAVE(STRINGS_H) 
+#include <strings.h> 
+#endif 
+
 #if COMPILER(MSVC)
 
 inline int snprintf(char* buffer, size_t count, const char* format, ...) 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h
index 21a87e4195..3f56c24bbe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h
@@ -54,7 +54,6 @@
 #endif
 
 #include <string.h>
-
 #include "Assertions.h"
 
 // Single-level array
@@ -164,7 +163,7 @@ class TCMalloc_PageMap2 {
 
 #ifdef WTF_CHANGES
   template<class Visitor, class MemoryReader>
-  void visit(const Visitor& visitor, const MemoryReader& reader)
+  void visitValues(Visitor& visitor, const MemoryReader& reader)
   {
     for (int i = 0; i < ROOT_LENGTH; i++) {
       if (!root_[i])
@@ -175,6 +174,14 @@ class TCMalloc_PageMap2 {
         ;
     }
   }
+
+  template<class Visitor, class MemoryReader>
+  void visitAllocations(Visitor& visitor, const MemoryReader&) {
+    for (int i = 0; i < ROOT_LENGTH; i++) {
+      if (root_[i])
+        visitor.visit(root_[i], sizeof(Leaf));
+    }
+  }
 #endif
 };
 
@@ -266,7 +273,7 @@ class TCMalloc_PageMap3 {
 
 #ifdef WTF_CHANGES
   template<class Visitor, class MemoryReader>
-  void visit(const Visitor& visitor, const MemoryReader& reader) {
+  void visitValues(Visitor& visitor, const MemoryReader& reader) {
     Node* root = reader(root_);
     for (int i = 0; i < INTERIOR_LENGTH; i++) {
       if (!root->ptrs[i])
@@ -283,6 +290,26 @@ class TCMalloc_PageMap3 {
       }
     }
   }
+
+  template<class Visitor, class MemoryReader>
+  void visitAllocations(Visitor& visitor, const MemoryReader& reader) {
+    visitor.visit(root_, sizeof(Node));
+
+    Node* root = reader(root_);
+    for (int i = 0; i < INTERIOR_LENGTH; i++) {
+      if (!root->ptrs[i])
+        continue;
+
+      visitor.visit(root->ptrs[i], sizeof(Node));
+      Node* n = reader(root->ptrs[i]);
+      for (int j = 0; j < INTERIOR_LENGTH; j++) {
+        if (!n->ptrs[j])
+          continue;
+
+        visitor.visit(n->ptrs[j], sizeof(Leaf));
+      }
+    }
+  }
 #endif
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 9c147b2791..478ce63a82 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -381,11 +381,24 @@ void* TCMalloc_SystemAlloc(size_t size, size_t *actual_size, size_t alignment) {
   return NULL;
 }
 
+#if HAVE(MADV_FREE_REUSE)
+
+void TCMalloc_SystemRelease(void* start, size_t length)
+{
+    while (madvise(start, length, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
+}
+
+#elif HAVE(MADV_FREE) || HAVE(MADV_DONTNEED)
+
 void TCMalloc_SystemRelease(void* start, size_t length)
 {
-  UNUSED_PARAM(start);
-  UNUSED_PARAM(length);
-#if HAVE(MADV_DONTNEED)
+    // MADV_FREE clears the modified bit on pages, which allows
+    // them to be discarded immediately.
+#if HAVE(MADV_FREE)
+    const int advice = MADV_FREE;
+#else
+    const int advice = MADV_DONTNEED;
+#endif
   if (FLAGS_malloc_devmem_start) {
     // It's not safe to use MADV_DONTNEED if we've been mapping
     // /dev/mem for heap memory
@@ -412,26 +425,45 @@ void TCMalloc_SystemRelease(void* start, size_t length)
     // Note -- ignoring most return codes, because if this fails it
     // doesn't matter...
     while (madvise(reinterpret_cast<char*>(new_start), new_end - new_start,
-                   MADV_DONTNEED) == -1 &&
+                   advice) == -1 &&
            errno == EAGAIN) {
       // NOP
     }
-    return;
   }
-#endif
+}
 
-#if HAVE(MMAP)
+#elif HAVE(MMAP)
+
+void TCMalloc_SystemRelease(void* start, size_t length)
+{
   void* newAddress = mmap(start, length, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
   // If the mmap failed then that's ok, we just won't return the memory to the system.
   ASSERT_UNUSED(newAddress, newAddress == start || newAddress == reinterpret_cast<void*>(MAP_FAILED));
-  return;
-#endif
 }
 
-#if HAVE(VIRTUALALLOC)
+#else
+
+// Platforms that don't support returning memory use an empty inline version of TCMalloc_SystemRelease
+// declared in TCSystemAlloc.h
+
+#endif
+
+#if HAVE(MADV_FREE_REUSE)
+
 void TCMalloc_SystemCommit(void* start, size_t length)
 {
-    UNUSED_PARAM(start);
-    UNUSED_PARAM(length);
+    while (madvise(start, length, MADV_FREE_REUSE) == -1 && errno == EAGAIN) { }
 }
+
+#elif HAVE(VIRTUALALLOC)
+
+void TCMalloc_SystemCommit(void*, size_t)
+{
+}
+
+#else
+
+// Platforms that don't need to explicitly commit memory use an empty inline version of TCMalloc_SystemCommit
+// declared in TCSystemAlloc.h
+
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
index 0caf718b5e..8e3a01ae7d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
@@ -62,9 +62,13 @@ extern void* TCMalloc_SystemAlloc(size_t bytes, size_t *actual_bytes,
 // be released, partial pages will not.)
 extern void TCMalloc_SystemRelease(void* start, size_t length);
 
-#if HAVE(VIRTUALALLOC)
 extern void TCMalloc_SystemCommit(void* start, size_t length);
-#else
+
+#if !HAVE(MADV_FREE_REUSE) && !HAVE(MADV_DONTNEED) && !HAVE(MMAP)
+inline void TCMalloc_SystemRelease(void*, size_t) { }
+#endif
+
+#if !HAVE(VIRTUALALLOC) && !HAVE(MADV_FREE_REUSE)
 inline void TCMalloc_SystemCommit(void*, size_t) { }
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
index 76038025d9..b07a9a21e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
@@ -45,13 +45,15 @@
 
 #if USE(PTHREADS)
 #include <pthread.h>
+#elif PLATFORM(QT)
+#include <QThreadStorage>
 #elif PLATFORM(WIN_OS)
 #include <windows.h>
 #endif
 
 namespace WTF {
 
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
 // ThreadSpecificThreadExit should be called each time when a thread is detached.
 // This is done automatically for threads created with WTF::createThread.
 void ThreadSpecificThreadExit();
@@ -66,7 +68,7 @@ public:
     ~ThreadSpecific();
 
 private:
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
     friend void ThreadSpecificThreadExit();
 #endif
     
@@ -74,7 +76,7 @@ private:
     void set(T*);
     void static destroy(void* ptr);
 
-#if USE(PTHREADS) || PLATFORM(WIN_OS)
+#if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
 
@@ -88,6 +90,8 @@ private:
 
 #if USE(PTHREADS)
     pthread_key_t m_key;
+#elif PLATFORM(QT)
+    QThreadStorage<Data*> m_key;
 #elif PLATFORM(WIN_OS)
     int m_index;
 #endif
@@ -122,6 +126,37 @@ inline void ThreadSpecific<T>::set(T* ptr)
     pthread_setspecific(m_key, new Data(ptr, this));
 }
 
+#elif PLATFORM(QT)
+
+template<typename T>
+inline ThreadSpecific<T>::ThreadSpecific()
+{
+}
+
+template<typename T>
+inline ThreadSpecific<T>::~ThreadSpecific()
+{
+    Data* data = static_cast<Data*>(m_key.localData());
+    if (data)
+        data->destructor(data);
+}
+
+template<typename T>
+inline T* ThreadSpecific<T>::get()
+{
+    Data* data = static_cast<Data*>(m_key.localData());
+    return data ? data->value : 0;
+}
+
+template<typename T>
+inline void ThreadSpecific<T>::set(T* ptr)
+{
+    ASSERT(!get());
+    Data* data = new Data(ptr, this);
+    data->destructor = &ThreadSpecific<T>::destroy;
+    m_key.setLocalData(data);
+}
+
 #elif PLATFORM(WIN_OS)
 
 // The maximum number of TLS keys that can be created. For simplification, we assume that:
@@ -129,8 +164,8 @@ inline void ThreadSpecific<T>::set(T* ptr)
 // 2) We do not need to hold many instances of ThreadSpecific<> data. This fixed number should be far enough.
 const int kMaxTlsKeySize = 256;
 
-extern long g_tls_key_count;
-extern DWORD g_tls_keys[kMaxTlsKeySize];
+long& tlsKeyCount();
+DWORD* tlsKeys();
 
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
@@ -140,23 +175,23 @@ inline ThreadSpecific<T>::ThreadSpecific()
     if (tls_key == TLS_OUT_OF_INDEXES)
         CRASH();
 
-    m_index = InterlockedIncrement(&g_tls_key_count) - 1;
+    m_index = InterlockedIncrement(&tlsKeyCount()) - 1;
     if (m_index >= kMaxTlsKeySize)
         CRASH();
-    g_tls_keys[m_index] = tls_key;
+    tlsKeys()[m_index] = tls_key;
 }
 
 template<typename T>
 inline ThreadSpecific<T>::~ThreadSpecific()
 {
     // Does not invoke destructor functions. They will be called from ThreadSpecificThreadExit when the thread is detached.
-    TlsFree(g_tls_keys[m_index]);
+    TlsFree(tlsKeys()[m_index]);
 }
 
 template<typename T>
 inline T* ThreadSpecific<T>::get()
 {
-    Data* data = static_cast<Data*>(TlsGetValue(g_tls_keys[m_index]));
+    Data* data = static_cast<Data*>(TlsGetValue(tlsKeys()[m_index]));
     return data ? data->value : 0;
 }
 
@@ -166,7 +201,7 @@ inline void ThreadSpecific<T>::set(T* ptr)
     ASSERT(!get());
     Data* data = new Data(ptr, this);
     data->destructor = &ThreadSpecific<T>::destroy;
-    TlsSetValue(g_tls_keys[m_index], data);
+    TlsSetValue(tlsKeys()[m_index], data);
 }
 
 #else
@@ -189,8 +224,10 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
 
 #if USE(PTHREADS)
     pthread_setspecific(data->owner->m_key, 0);
+#elif PLATFORM(QT)
+    data->owner->m_key.setLocalData(0);
 #elif PLATFORM(WIN_OS)
-    TlsSetValue(g_tls_keys[data->owner->m_index], 0);
+    TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
 #error ThreadSpecific is not implemented for this platform.
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp
index 1a3febbf62..f2c0cad957 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp
@@ -29,14 +29,23 @@
 
 namespace WTF {
 
-long g_tls_key_count = 0;
-DWORD g_tls_keys[kMaxTlsKeySize];
+long& tlsKeyCount()
+{
+    static long count;
+    return count;
+}
+
+DWORD* tlsKeys()
+{
+    static DWORD keys[kMaxTlsKeySize];
+    return keys;
+}
 
 void ThreadSpecificThreadExit()
 {
-    for (long i = 0; i < g_tls_key_count; i++) {
+    for (long i = 0; i < tlsKeyCount(); i++) {
         // The layout of ThreadSpecific<T>::Data does not depend on T. So we are safe to do the static cast to ThreadSpecific<int> in order to access its data member.
-        ThreadSpecific<int>::Data* data = static_cast<ThreadSpecific<int>::Data*>(TlsGetValue(g_tls_keys[i]));
+        ThreadSpecific<int>::Data* data = static_cast<ThreadSpecific<int>::Data*>(TlsGetValue(tlsKeys()[i]));
         if (data)
             data->destructor(data);
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
index 0179dccab4..bd25ee7498 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,16 +26,21 @@
 #include "config.h"
 #include "Threading.h"
 
+#include <string.h>
+
 namespace WTF {
 
 struct NewThreadContext {
-    NewThreadContext(ThreadFunction entryPoint, void* data)
+    NewThreadContext(ThreadFunction entryPoint, void* data, const char* name)
         : entryPoint(entryPoint)
         , data(data)
-    { }
+        , name(name)
+    {
+    }
 
     ThreadFunction entryPoint;
     void* data;
+    const char* name;
 
     Mutex creationMutex;
 };
@@ -44,6 +49,8 @@ static void* threadEntryPoint(void* contextData)
 {
     NewThreadContext* context = reinterpret_cast<NewThreadContext*>(contextData);
 
+    setThreadNameInternal(context->name);
+
     // Block until our creating thread has completed any extra setup work
     {
         MutexLocker locker(context->creationMutex);
@@ -59,7 +66,14 @@ static void* threadEntryPoint(void* contextData)
 
 ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char* name)
 {
-    NewThreadContext* context = new NewThreadContext(entryPoint, data);
+    // Visual Studio has a 31-character limit on thread names. Longer names will
+    // be truncated silently, but we'd like callers to know about the limit.
+#if !LOG_DISABLED
+    if (strlen(name) > 31)
+        LOG_ERROR("Thread name \"%s\" is longer than 31 characters and will be truncated by Visual Studio", name);
+#endif
+
+    NewThreadContext* context = new NewThreadContext(entryPoint, data, name);
 
     // Prevent the thread body from executing until we've established the thread identifier
     MutexLocker locker(context->creationMutex);
@@ -72,6 +86,8 @@ ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char*
 // This function is deprecated but needs to be kept around for backward
 // compatibility. Use the 3-argument version of createThread above.
 
+ThreadIdentifier createThread(ThreadFunction entryPoint, void* data);
+
 ThreadIdentifier createThread(ThreadFunction entryPoint, void* data)
 {
     return createThread(entryPoint, data, 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
index 156013de64..02fa3a4cd7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
@@ -108,10 +108,17 @@ namespace WTF {
 typedef uint32_t ThreadIdentifier;
 typedef void* (*ThreadFunction)(void* argument);
 
-// Returns 0 if thread creation failed
+// Returns 0 if thread creation failed.
+// The thread name must be a literal since on some platforms it's passed in to the thread.
 ThreadIdentifier createThread(ThreadFunction, void*, const char* threadName);
+
+// Internal platform-specific createThread implementation.
 ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char* threadName);
 
+// Called in the thread during initialization.
+// Helpful for platforms where the thread name must be set from within the thread.
+void setThreadNameInternal(const char* threadName);
+
 ThreadIdentifier currentThread();
 bool isMainThread();
 int waitForThreadCompletion(ThreadIdentifier, void**);
@@ -132,12 +139,15 @@ struct PlatformMutex {
     size_t m_recursionCount;
 };
 struct PlatformCondition {
-    size_t m_timedOut;
-    size_t m_blocked;
-    size_t m_waitingForRemoval;
-    HANDLE m_gate;
-    HANDLE m_queue;
-    HANDLE m_mutex;
+    size_t m_waitersGone;
+    size_t m_waitersBlocked;
+    size_t m_waitersToUnblock; 
+    HANDLE m_blockLock;
+    HANDLE m_blockQueue;
+    HANDLE m_unblockLock;
+
+    bool timedWait(PlatformMutex&, DWORD durationMilliseconds);
+    void signal(bool unblockAll);
 };
 #else
 typedef void* PlatformMutex;
@@ -167,8 +177,9 @@ public:
     ~ThreadCondition();
     
     void wait(Mutex& mutex);
-    // Returns true if the condition was signaled before the timeout, false if the timeout was reached
-    bool timedWait(Mutex&, double interval);
+    // Returns true if the condition was signaled before absoluteTime, false if the absoluteTime was reached or is in the past.
+    // The absoluteTime is in seconds, starting on January 1, 1970. The time is assumed to use the same time zone as WTF::currentTime().
+    bool timedWait(Mutex&, double absoluteTime);
     void signal();
     void broadcast();
     
@@ -201,9 +212,9 @@ inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_
 
 #endif
 
-template<class T> class ThreadSafeShared : Noncopyable {
+class ThreadSafeSharedBase : Noncopyable {
 public:
-    ThreadSafeShared(int initialRefCount = 1)
+    ThreadSafeSharedBase(int initialRefCount = 1)
         : m_refCount(initialRefCount)
     {
     }
@@ -218,20 +229,6 @@ public:
 #endif
     }
 
-    void deref()
-    {
-#if USE(LOCKFREE_THREADSAFESHARED)
-        if (atomicDecrement(&m_refCount) <= 0)
-#else
-        {
-            MutexLocker locker(m_mutex);
-            --m_refCount;
-        }
-        if (m_refCount <= 0)
-#endif
-            delete static_cast<T*>(this);
-    }
-
     bool hasOneRef()
     {
         return refCount() == 1;
@@ -245,13 +242,50 @@ public:
         return static_cast<int const volatile &>(m_refCount);
     }
 
+protected:
+    // Returns whether the pointer should be freed or not.
+    bool derefBase()
+    {
+#if USE(LOCKFREE_THREADSAFESHARED)
+        if (atomicDecrement(&m_refCount) <= 0)
+            return true;
+#else
+        int refCount;
+        {
+            MutexLocker locker(m_mutex);
+            --m_refCount;
+            refCount = m_refCount;
+        }
+        if (refCount <= 0)
+            return true;
+#endif
+        return false;
+    }
+
 private:
+    template<class T>
+    friend class CrossThreadRefCounted;
+
     int m_refCount;
 #if !USE(LOCKFREE_THREADSAFESHARED)
     mutable Mutex m_mutex;
 #endif
 };
 
+template<class T> class ThreadSafeShared : public ThreadSafeSharedBase {
+public:
+    ThreadSafeShared(int initialRefCount = 1)
+        : ThreadSafeSharedBase(initialRefCount)
+    {
+    }
+
+    void deref()
+    {
+        if (derefBase())
+            delete static_cast<T*>(this);
+    }
+};
+
 // This function must be called from the main thread. It is safe to call it repeatedly.
 // Darwin is an exception to this rule: it is OK to call it from any thread, the only requirement is that the calls are not reentrant.
 void initializeThreading();
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingGtk.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingGtk.cpp
deleted file mode 100644
index 777d55bc32..0000000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingGtk.cpp
+++ /dev/null
@@ -1,244 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "Threading.h"
-
-#if !USE(PTHREADS)
-
-#include "HashMap.h"
-#include "MainThread.h"
-#include "RandomNumberSeed.h"
-
-#include <glib.h>
-
-namespace WTF {
-
-static Mutex* atomicallyInitializedStaticMutex;
-
-static ThreadIdentifier mainThreadIdentifier;
-
-static Mutex& threadMapMutex()
-{
-    static Mutex mutex;
-    return mutex;
-}
-
-void initializeThreading()
-{
-    if (!g_thread_supported())
-        g_thread_init(NULL);
-    ASSERT(g_thread_supported());
-
-    if (!atomicallyInitializedStaticMutex) {
-        atomicallyInitializedStaticMutex = new Mutex;
-        threadMapMutex();
-        initializeRandomNumberGenerator();
-        mainThreadIdentifier = currentThread();
-        initializeMainThread();
-    }
-}
-
-void lockAtomicallyInitializedStaticMutex()
-{
-    ASSERT(atomicallyInitializedStaticMutex);
-    atomicallyInitializedStaticMutex->lock();
-}
-
-void unlockAtomicallyInitializedStaticMutex()
-{
-    atomicallyInitializedStaticMutex->unlock();
-}
-
-static HashMap<ThreadIdentifier, GThread*>& threadMap()
-{
-    static HashMap<ThreadIdentifier, GThread*> map;
-    return map;
-}
-
-static ThreadIdentifier identifierByGthreadHandle(GThread*& thread)
-{
-    MutexLocker locker(threadMapMutex());
-
-    HashMap<ThreadIdentifier, GThread*>::iterator i = threadMap().begin();
-    for (; i != threadMap().end(); ++i) {
-        if (i->second == thread)
-            return i->first;
-    }
-
-    return 0;
-}
-
-static ThreadIdentifier establishIdentifierForThread(GThread*& thread)
-{
-    ASSERT(!identifierByGthreadHandle(thread));
-
-    MutexLocker locker(threadMapMutex());
-
-    static ThreadIdentifier identifierCount = 1;
-
-    threadMap().add(identifierCount, thread);
-
-    return identifierCount++;
-}
-
-static GThread* threadForIdentifier(ThreadIdentifier id)
-{
-    MutexLocker locker(threadMapMutex());
-
-    return threadMap().get(id);
-}
-
-static void clearThreadForIdentifier(ThreadIdentifier id)
-{
-    MutexLocker locker(threadMapMutex());
-
-    ASSERT(threadMap().contains(id));
-
-    threadMap().remove(id);
-}
-
-ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
-{
-    GThread* thread;
-    if (!(thread = g_thread_create(entryPoint, data, TRUE, 0))) {
-        LOG_ERROR("Failed to create thread at entry point %p with data %p", entryPoint, data);
-        return 0;
-    }
-
-    ThreadIdentifier threadID = establishIdentifierForThread(thread);
-    return threadID;
-}
-
-int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
-{
-    ASSERT(threadID);
-
-    GThread* thread = threadForIdentifier(threadID);
-
-    void* joinResult = g_thread_join(thread);
-    if (result)
-        *result = joinResult;
-
-    clearThreadForIdentifier(threadID);
-    return 0;
-}
-
-void detachThread(ThreadIdentifier)
-{
-}
-
-ThreadIdentifier currentThread()
-{
-    GThread* currentThread = g_thread_self();
-    if (ThreadIdentifier id = identifierByGthreadHandle(currentThread))
-        return id;
-    return establishIdentifierForThread(currentThread);
-}
-
-bool isMainThread()
-{
-    return currentThread() == mainThreadIdentifier;
-}
-
-Mutex::Mutex()
-    : m_mutex(g_mutex_new())
-{
-}
-
-Mutex::~Mutex()
-{
-}
-
-void Mutex::lock()
-{
-    g_mutex_lock(m_mutex.get());
-}
-
-bool Mutex::tryLock()
-{
-    return g_mutex_trylock(m_mutex.get());
-}
-
-void Mutex::unlock()
-{
-    g_mutex_unlock(m_mutex.get());
-}
-
-ThreadCondition::ThreadCondition()
-    : m_condition(g_cond_new())
-{
-}
-
-ThreadCondition::~ThreadCondition()
-{
-}
-
-void ThreadCondition::wait(Mutex& mutex)
-{
-    g_cond_wait(m_condition.get(), mutex.impl().get());
-}
-
-bool ThreadCondition::timedWait(Mutex& mutex, double interval)
-{
-    if (interval < 0.0) {
-        wait(mutex);
-        return true;
-    }
-    
-    int intervalSeconds = static_cast<int>(interval);
-    int intervalMicroseconds = static_cast<int>((interval - intervalSeconds) * 1000000.0);
-    
-    GTimeVal targetTime;
-    g_get_current_time(&targetTime);
-        
-    targetTime.tv_sec += intervalSeconds;
-    targetTime.tv_usec += intervalMicroseconds;
-    if (targetTime.tv_usec > 1000000) {
-        targetTime.tv_usec -= 1000000;
-        targetTime.tv_sec++;
-    }
-
-    return g_cond_timed_wait(m_condition.get(), mutex.impl().get(), &targetTime);
-}
-
-void ThreadCondition::signal()
-{
-    g_cond_signal(m_condition.get());
-}
-
-void ThreadCondition::broadcast()
-{
-    g_cond_broadcast(m_condition.get());
-}
-
-
-}
-
-#endif // !USE(PTHREADS)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
index 832cd0c412..e713102369 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
@@ -33,10 +33,11 @@
 namespace WTF {
 
 void initializeThreading() { }
-ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return 0; }
+ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return ThreadIdentifier(); }
+void setThreadNameInternal(const char*) { }
 int waitForThreadCompletion(ThreadIdentifier, void**) { return 0; }
 void detachThread(ThreadIdentifier) { }
-ThreadIdentifier currentThread() { return 0; }
+ThreadIdentifier currentThread() { return ThreadIdentifier(); }
 bool isMainThread() { return true; }
 
 Mutex::Mutex() { }
@@ -48,7 +49,7 @@ void Mutex::unlock() { }
 ThreadCondition::ThreadCondition() { }
 ThreadCondition::~ThreadCondition() { }
 void ThreadCondition::wait(Mutex& mutex) { }
-bool ThreadCondition::timedWait(Mutex& mutex, double interval) { return false; }
+bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime) { return false; }
 void ThreadCondition::signal() { }
 void ThreadCondition::broadcast() { }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index f111fcf17e..3f5cbf56de 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,27 +26,33 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #include "config.h"
 #include "Threading.h"
 
-#include "StdLibExtras.h"
-
 #if USE(PTHREADS)
 
+#include "CurrentTime.h"
 #include "HashMap.h"
 #include "MainThread.h"
 #include "RandomNumberSeed.h"
-
+#include "StdLibExtras.h"
+#include "UnusedParam.h"
 #include <errno.h>
+#include <limits.h>
 #include <sys/time.h>
 
+#if PLATFORM(ANDROID)
+#include "jni_utility.h"
+#endif
+
 namespace WTF {
 
 typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
 
 static Mutex* atomicallyInitializedStaticMutex;
 
-#if !PLATFORM(DARWIN)
+#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
 static ThreadIdentifier mainThreadIdentifier; // The thread that was the first to call initializeThreading(), which must be the main thread.
 #endif
 
@@ -62,7 +68,7 @@ void initializeThreading()
         atomicallyInitializedStaticMutex = new Mutex;
         threadMapMutex();
         initializeRandomNumberGenerator();
-#if !PLATFORM(DARWIN)
+#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
         mainThreadIdentifier = currentThread();
 #endif
         initializeMainThread();
@@ -108,14 +114,14 @@ static ThreadIdentifier establishIdentifierForPthreadHandle(pthread_t& pthreadHa
     static ThreadIdentifier identifierCount = 1;
 
     threadMap().add(identifierCount, pthreadHandle);
-    
+
     return identifierCount++;
 }
 
 static pthread_t pthreadHandleForIdentifier(ThreadIdentifier id)
 {
     MutexLocker locker(threadMapMutex());
-    
+
     return threadMap().get(id);
 }
 
@@ -124,31 +130,76 @@ static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
     MutexLocker locker(threadMapMutex());
 
     ASSERT(threadMap().contains(id));
-    
+
     threadMap().remove(id);
 }
 
+#if PLATFORM(ANDROID)
+// On the Android platform, threads must be registered with the VM before they run.
+struct ThreadData {
+    ThreadFunction entryPoint;
+    void* arg;
+};
+
+static void* runThreadWithRegistration(void* arg)
+{
+    ThreadData* data = static_cast<ThreadData*>(arg);
+    JavaVM* vm = JSC::Bindings::getJavaVM();
+    JNIEnv* env;
+    void* ret = 0;
+    if (vm->AttachCurrentThread(&env, 0) == JNI_OK) {
+        ret = data->entryPoint(data->arg);
+        vm->DetachCurrentThread();
+    }
+    delete data;
+    return ret;
+}
+
+ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
+{
+    pthread_t threadHandle;
+    ThreadData* threadData = new ThreadData();
+    threadData->entryPoint = entryPoint;
+    threadData->arg = data;
+
+    if (pthread_create(&threadHandle, 0, runThreadWithRegistration, static_cast<void*>(threadData))) {
+        LOG_ERROR("Failed to create pthread at entry point %p with data %p", entryPoint, data);
+        return 0;
+    }
+    return establishIdentifierForPthreadHandle(threadHandle);
+}
+#else
 ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
 {
     pthread_t threadHandle;
-    if (pthread_create(&threadHandle, NULL, entryPoint, data)) {
+    if (pthread_create(&threadHandle, 0, entryPoint, data)) {
         LOG_ERROR("Failed to create pthread at entry point %p with data %p", entryPoint, data);
         return 0;
     }
 
     return establishIdentifierForPthreadHandle(threadHandle);
 }
+#endif
+
+void setThreadNameInternal(const char* threadName)
+{
+#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    pthread_setname_np(threadName);
+#else
+    UNUSED_PARAM(threadName);
+#endif
+}
 
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 {
     ASSERT(threadID);
-    
+
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
- 
+
     int joinResult = pthread_join(pthreadHandle, result);
     if (joinResult == EDEADLK)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
-        
+
     clearPthreadHandleForIdentifier(threadID);
     return joinResult;
 }
@@ -156,11 +207,11 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 void detachThread(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
-    
+
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
-    
+
     pthread_detach(pthreadHandle);
-    
+
     clearPthreadHandleForIdentifier(threadID);
 }
 
@@ -174,7 +225,7 @@ ThreadIdentifier currentThread()
 
 bool isMainThread()
 {
-#if PLATFORM(DARWIN)
+#if PLATFORM(DARWIN) && !PLATFORM(CHROMIUM)
     return pthread_main_np();
 #else
     return currentThread() == mainThreadIdentifier;
@@ -193,27 +244,27 @@ Mutex::~Mutex()
 
 void Mutex::lock()
 {
-    if (pthread_mutex_lock(&m_mutex) != 0)
-        ASSERT(false);
+    int result = pthread_mutex_lock(&m_mutex);
+    ASSERT_UNUSED(result, !result);
 }
-    
+
 bool Mutex::tryLock()
 {
     int result = pthread_mutex_trylock(&m_mutex);
-    
+
     if (result == 0)
         return true;
-    else if (result == EBUSY)
+    if (result == EBUSY)
         return false;
 
-    ASSERT(false);
+    ASSERT_NOT_REACHED();
     return false;
 }
 
 void Mutex::unlock()
 {
-    if (pthread_mutex_unlock(&m_mutex) != 0)
-        ASSERT(false);
+    int result = pthread_mutex_unlock(&m_mutex);
+    ASSERT_UNUSED(result, !result);
 }
 
 ThreadCondition::ThreadCondition()
@@ -228,48 +279,42 @@ ThreadCondition::~ThreadCondition()
     
 void ThreadCondition::wait(Mutex& mutex)
 {
-    if (pthread_cond_wait(&m_condition, &mutex.impl()) != 0)
-        ASSERT(false);
+    int result = pthread_cond_wait(&m_condition, &mutex.impl());
+    ASSERT_UNUSED(result, !result);
 }
 
-bool ThreadCondition::timedWait(Mutex& mutex, double secondsToWait)
+bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
 {
-    if (secondsToWait < 0.0) {
+    if (absoluteTime < currentTime())
+        return false;
+
+    if (absoluteTime > INT_MAX) {
         wait(mutex);
         return true;
     }
 
-    int intervalSeconds = static_cast<int>(secondsToWait);
-    int intervalMicroseconds = static_cast<int>((secondsToWait - intervalSeconds) * 1000000.0);
-
-    // Current time comes in sec/microsec
-    timeval currentTime;
-    gettimeofday(&currentTime, NULL);
+    int timeSeconds = static_cast<int>(absoluteTime);
+    int timeNanoseconds = static_cast<int>((absoluteTime - timeSeconds) * 1E9);
 
-    // Target time comes in sec/nanosec
     timespec targetTime;
-    targetTime.tv_sec = currentTime.tv_sec + intervalSeconds;
-    targetTime.tv_nsec = (currentTime.tv_usec + intervalMicroseconds) * 1000;
-    if (targetTime.tv_nsec > 1000000000) {
-        targetTime.tv_nsec -= 1000000000;
-        targetTime.tv_sec++;
-    }
+    targetTime.tv_sec = timeSeconds;
+    targetTime.tv_nsec = timeNanoseconds;
 
     return pthread_cond_timedwait(&m_condition, &mutex.impl(), &targetTime) == 0;
 }
 
 void ThreadCondition::signal()
 {
-    if (pthread_cond_signal(&m_condition) != 0)
-        ASSERT(false);
+    int result = pthread_cond_signal(&m_condition);
+    ASSERT_UNUSED(result, !result);
 }
 
 void ThreadCondition::broadcast()
 {
-    if (pthread_cond_broadcast(&m_condition) != 0)
-        ASSERT(false);
+    int result = pthread_cond_broadcast(&m_condition);
+    ASSERT_UNUSED(result, !result);
 }
-    
+
 } // namespace WTF
 
 #endif // USE(PTHREADS)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
index 3626a379bd..ea186564b0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,40 +25,61 @@
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * There are numerous academic and practical works on how to implement pthread_cond_wait/pthread_cond_signal/pthread_cond_broadcast
+ * functions on Win32. Here is one example: http://www.cs.wustl.edu/~schmidt/win32-cv-1.html which is widely credited as a 'starting point'
+ * of modern attempts. There are several more or less proven implementations, one in Boost C++ library (http://www.boost.org) and another
+ * in pthreads-win32 (http://sourceware.org/pthreads-win32/).
+ *
+ * The number of articles and discussions is the evidence of significant difficulties in implementing these primitives correctly.
+ * The brief search of revisions, ChangeLog entries, discussions in comp.programming.threads and other places clearly documents
+ * numerous pitfalls and performance problems the authors had to overcome to arrive to the suitable implementations.
+ * Optimally, WebKit would use one of those supported/tested libraries directly. To roll out our own implementation is impractical,
+ * if even for the lack of sufficient testing. However, a faithful reproduction of the code from one of the popular supported
+ * libraries seems to be a good compromise.
+ *
+ * The early Boost implementation (http://www.boxbackup.org/trac/browser/box/nick/win/lib/win32/boost_1_32_0/libs/thread/src/condition.cpp?rev=30)
+ * is identical to pthreads-win32 (http://sourceware.org/cgi-bin/cvsweb.cgi/pthreads/pthread_cond_wait.c?rev=1.10&content-type=text/x-cvsweb-markup&cvsroot=pthreads-win32).
+ * Current Boost uses yet another (although seemingly equivalent) algorithm which came from their 'thread rewrite' effort.
  *
- * =============================================================================
- * Note:  The implementation of condition variables under the Windows
- * plaform was based on that of the excellent BOOST C++ library.  It
- * has been rewritten to fit in with the WebKit architecture and to
- * use its coding conventions.
- * =============================================================================
+ * This file includes timedWait/signal/broadcast implementations translated to WebKit coding style from the latest algorithm by
+ * Alexander Terekhov and Louis Thomas, as captured here: http://sourceware.org/cgi-bin/cvsweb.cgi/pthreads/pthread_cond_wait.c?rev=1.10&content-type=text/x-cvsweb-markup&cvsroot=pthreads-win32
+ * It replaces the implementation of their previous algorithm, also documented in the same source above.
+ * The naming and comments are left very close to original to enable easy cross-check.
  *
- * The Boost license is virtually identical to the Apple variation at the
- * top of this file, but is included here for completeness:
+ * The corresponding Pthreads-win32 License is included below, and CONTRIBUTORS file which it refers to is added to
+ * source directory (as CONTRIBUTORS.pthreads-win32).
+ */
+
+/*
+ *      Pthreads-win32 - POSIX Threads Library for Win32
+ *      Copyright(C) 1998 John E. Bossom
+ *      Copyright(C) 1999,2005 Pthreads-win32 contributors
  *
- * Boost Software License - Version 1.0 - August 17th, 2003
+ *      Contact Email: rpj@callisto.canberra.edu.au
  *
- * Permission is hereby granted, free of charge, to any person or organization
- * obtaining a copy of the software and accompanying documentation covered by
- * this license (the "Software") to use, reproduce, display, distribute,
- * execute, and transmit the Software, and to prepare derivative works of the
- * Software, and to permit third-parties to whom the Software is furnished to
- * do so, all subject to the following:
+ *      The current list of contributors is contained
+ *      in the file CONTRIBUTORS included with the source
+ *      code distribution. The list can also be seen at the
+ *      following World Wide Web location:
+ *      http://sources.redhat.com/pthreads-win32/contributors.html
  *
- * The copyright notices in the Software and this entire statement, including
- * the above license grant, this restriction and the following disclaimer,
- * must be included in all copies of the Software, in whole or in part, and
- * all derivative works of the Software, unless such copies or derivative
- * works are solely in the form of machine-executable object code generated by
- * a source language processor.
+ *      This library is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU Lesser General Public
+ *      License as published by the Free Software Foundation; either
+ *      version 2 of the License, or (at your option) any later version.
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
- * SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
- * FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
+ *      This library is distributed in the hope that it will be useful,
+ *      but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *      Lesser General Public License for more details.
+ *
+ *      You should have received a copy of the GNU Lesser General Public
+ *      License along with this library in the file COPYING.LIB;
+ *      if not, write to the Free Software Foundation, Inc.,
+ *      59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
  */
 
 #include "config.h"
@@ -69,13 +91,14 @@
 #endif
 #include <process.h>
 #include <windows.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
 #include <wtf/RandomNumberSeed.h>
 
 namespace WTF {
 
-// MS_VC_EXCEPTION, THREADNAME_INFO, and setThreadName all come from <http://msdn.microsoft.com/en-us/library/xcb2z8hs.aspx>.
+// MS_VC_EXCEPTION, THREADNAME_INFO, and setThreadNameInternal all come from <http://msdn.microsoft.com/en-us/library/xcb2z8hs.aspx>.
 static const DWORD MS_VC_EXCEPTION = 0x406D1388;
 
 #pragma pack(push, 8)
@@ -87,16 +110,12 @@ typedef struct tagTHREADNAME_INFO {
 } THREADNAME_INFO;
 #pragma pack(pop)
 
-static void setThreadName(DWORD dwThreadID, LPCSTR szThreadName)
+void setThreadNameInternal(const char* szThreadName)
 {
-    // Visual Studio has a 31-character limit on thread names. Longer names will
-    // be truncated silently, but we'd like callers to know about the limit.
-    ASSERT_ARG(szThreadName, strlen(szThreadName) <= 31);
-
     THREADNAME_INFO info;
     info.dwType = 0x1000;
     info.szName = szThreadName;
-    info.dwThreadID = dwThreadID;
+    info.dwThreadID = GetCurrentThreadId();
     info.dwFlags = 0;
 
     __try {
@@ -134,7 +153,7 @@ void initializeThreading()
         initializeRandomNumberGenerator();
         initializeMainThread();
         mainThreadIdentifier = currentThread();
-        setThreadName(mainThreadIdentifier, "Main Thread");
+        setThreadNameInternal("Main Thread");
     }
 }
 
@@ -197,9 +216,6 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
         return 0;
     }
 
-    if (threadName)
-        setThreadName(threadIdentifier, threadName);
-
     threadID = static_cast<ThreadIdentifier>(threadIdentifier);
     storeThreadHandleByIdentifier(threadIdentifier, threadHandle);
 
@@ -214,11 +230,11 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     if (!threadHandle)
         LOG_ERROR("ThreadIdentifier %u did not correspond to an active thread when trying to quit", threadID);
  
-    DWORD joinResult = ::WaitForSingleObject(threadHandle, INFINITE);
+    DWORD joinResult = WaitForSingleObject(threadHandle, INFINITE);
     if (joinResult == WAIT_FAILED)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
 
-    ::CloseHandle(threadHandle);
+    CloseHandle(threadHandle);
     clearThreadHandleForIdentifier(threadID);
 
     return joinResult;
@@ -227,16 +243,16 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 void detachThread(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
-    
+
     HANDLE threadHandle = threadHandleForIdentifier(threadID);
     if (threadHandle)
-        ::CloseHandle(threadHandle);
+        CloseHandle(threadHandle);
     clearThreadHandleForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
 {
-    return static_cast<ThreadIdentifier>(::GetCurrentThreadId());
+    return static_cast<ThreadIdentifier>(GetCurrentThreadId());
 }
 
 bool isMainThread()
@@ -247,17 +263,17 @@ bool isMainThread()
 Mutex::Mutex()
 {
     m_mutex.m_recursionCount = 0;
-    ::InitializeCriticalSection(&m_mutex.m_internalMutex);
+    InitializeCriticalSection(&m_mutex.m_internalMutex);
 }
 
 Mutex::~Mutex()
 {
-    ::DeleteCriticalSection(&m_mutex.m_internalMutex);
+    DeleteCriticalSection(&m_mutex.m_internalMutex);
 }
 
 void Mutex::lock()
 {
-    ::EnterCriticalSection(&m_mutex.m_internalMutex);
+    EnterCriticalSection(&m_mutex.m_internalMutex);
     ++m_mutex.m_recursionCount;
 }
     
@@ -269,14 +285,14 @@ bool Mutex::tryLock()
     // treats this as a successful case, it changes the behavior of several
     // tests in WebKit that check to see if the current thread already
     // owned this mutex (see e.g., IconDatabase::getOrCreateIconRecord)
-    DWORD result = ::TryEnterCriticalSection(&m_mutex.m_internalMutex);
+    DWORD result = TryEnterCriticalSection(&m_mutex.m_internalMutex);
     
     if (result != 0) {       // We got the lock
         // If this thread already had the lock, we must unlock and
         // return false so that we mimic the behavior of POSIX's
         // pthread_mutex_trylock:
         if (m_mutex.m_recursionCount > 0) {
-            ::LeaveCriticalSection(&m_mutex.m_internalMutex);
+            LeaveCriticalSection(&m_mutex.m_internalMutex);
             return false;
         }
 
@@ -290,183 +306,168 @@ bool Mutex::tryLock()
 void Mutex::unlock()
 {
     --m_mutex.m_recursionCount;
-    ::LeaveCriticalSection(&m_mutex.m_internalMutex);
-}
-
-static const long MaxSemaphoreCount = static_cast<long>(~0UL >> 1);
-
-ThreadCondition::ThreadCondition()
-{
-    m_condition.m_timedOut = 0;
-    m_condition.m_blocked = 0;
-    m_condition.m_waitingForRemoval = 0;
-    m_condition.m_gate = ::CreateSemaphore(0, 1, 1, 0);
-    m_condition.m_queue = ::CreateSemaphore(0, 0, MaxSemaphoreCount, 0);
-    m_condition.m_mutex = ::CreateMutex(0, 0, 0);
-
-    if (!m_condition.m_gate || !m_condition.m_queue || !m_condition.m_mutex) {
-        if (m_condition.m_gate)
-            ::CloseHandle(m_condition.m_gate);
-        if (m_condition.m_queue)
-            ::CloseHandle(m_condition.m_queue);
-        if (m_condition.m_mutex)
-            ::CloseHandle(m_condition.m_mutex);
-    }
+    LeaveCriticalSection(&m_mutex.m_internalMutex);
 }
 
-ThreadCondition::~ThreadCondition()
-{
-    ::CloseHandle(m_condition.m_gate);
-    ::CloseHandle(m_condition.m_queue);
-    ::CloseHandle(m_condition.m_mutex);
-}
-    
-void ThreadCondition::wait(Mutex& mutex)
+bool PlatformCondition::timedWait(PlatformMutex& mutex, DWORD durationMilliseconds)
 {
-    PlatformMutex& cs = mutex.impl();
-
     // Enter the wait state.
-    DWORD res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
+    DWORD res = WaitForSingleObject(m_blockLock, INFINITE);
     ASSERT(res == WAIT_OBJECT_0);
-    ++m_condition.m_blocked;
-    res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
+    ++m_waitersBlocked;
+    res = ReleaseSemaphore(m_blockLock, 1, 0);
     ASSERT(res);
 
-    ::LeaveCriticalSection(&cs.m_internalMutex);
+    LeaveCriticalSection(&mutex.m_internalMutex);
 
-    res = ::WaitForSingleObject(m_condition.m_queue, INFINITE);
-    ASSERT(res == WAIT_OBJECT_0);
+    // Main wait - use timeout.
+    bool timedOut = (WaitForSingleObject(m_blockQueue, durationMilliseconds) == WAIT_TIMEOUT);
 
-    res = ::WaitForSingleObject(m_condition.m_mutex, INFINITE);
+    res = WaitForSingleObject(m_unblockLock, INFINITE);
     ASSERT(res == WAIT_OBJECT_0);
-    size_t wasWaiting = m_condition.m_waitingForRemoval;
-    size_t wasTimedOut = m_condition.m_timedOut;
-    if (wasWaiting != 0) {
-        if (--m_condition.m_waitingForRemoval == 0) {
-            if (m_condition.m_blocked != 0) {
-                res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);  // open m_gate
-                ASSERT(res);
-                wasWaiting = 0;
-            }
-            else if (m_condition.m_timedOut != 0)
-                m_condition.m_timedOut = 0;
-        }
-    } else if (++m_condition.m_timedOut == ((std::numeric_limits<unsigned>::max)() / 2)) {
-        // timeout occured, normalize the m_condition.m_timedOut count
+
+    int signalsLeft = m_waitersToUnblock;
+
+    if (m_waitersToUnblock)
+        --m_waitersToUnblock;
+    else if (++m_waitersGone == (INT_MAX / 2)) { // timeout/canceled or spurious semaphore
+        // timeout or spurious wakeup occured, normalize the m_waitersGone count
         // this may occur if many calls to wait with a timeout are made and
         // no call to notify_* is made
-        res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
+        res = WaitForSingleObject(m_blockLock, INFINITE);
         ASSERT(res == WAIT_OBJECT_0);
-        m_condition.m_blocked -= m_condition.m_timedOut;
-        res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
+        m_waitersBlocked -= m_waitersGone;
+        res = ReleaseSemaphore(m_blockLock, 1, 0);
         ASSERT(res);
-        m_condition.m_timedOut = 0;
+        m_waitersGone = 0;
     }
-    res = ::ReleaseMutex(m_condition.m_mutex);
+
+    res = ReleaseMutex(m_unblockLock);
     ASSERT(res);
 
-    if (wasWaiting == 1) {
-        for (/**/ ; wasTimedOut; --wasTimedOut) {
-            // better now than spurious later
-            res = ::WaitForSingleObject(m_condition.m_queue, INFINITE);
-            ASSERT(res == WAIT_OBJECT_0);
-        }
-        res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
+    if (signalsLeft == 1) {
+        res = ReleaseSemaphore(m_blockLock, 1, 0); // Open the gate.
         ASSERT(res);
     }
 
-    ::EnterCriticalSection (&cs.m_internalMutex);
-}
+    EnterCriticalSection (&mutex.m_internalMutex);
 
-bool ThreadCondition::timedWait(Mutex& mutex, double interval)
-{
-    // Empty for now
-    ASSERT(false);
-    return false;
+    return !timedOut;
 }
 
-void ThreadCondition::signal()
+void PlatformCondition::signal(bool unblockAll)
 {
-    unsigned signals = 0;
+    unsigned signalsToIssue = 0;
 
-    DWORD res = ::WaitForSingleObject(m_condition.m_mutex, INFINITE);
+    DWORD res = WaitForSingleObject(m_unblockLock, INFINITE);
     ASSERT(res == WAIT_OBJECT_0);
 
-    if (m_condition.m_waitingForRemoval != 0) { // the m_gate is already closed
-        if (m_condition.m_blocked == 0) {
-            res = ::ReleaseMutex(m_condition.m_mutex);
+    if (m_waitersToUnblock) { // the gate is already closed
+        if (!m_waitersBlocked) { // no-op
+            res = ReleaseMutex(m_unblockLock);
             ASSERT(res);
             return;
         }
 
-        ++m_condition.m_waitingForRemoval;
-        --m_condition.m_blocked;
-
-        signals = 1;
-    } else {
-        res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
+        if (unblockAll) {
+            signalsToIssue = m_waitersBlocked;
+            m_waitersToUnblock += m_waitersBlocked;
+            m_waitersBlocked = 0;
+        } else {
+            signalsToIssue = 1;
+            ++m_waitersToUnblock;
+            --m_waitersBlocked;
+        }
+    } else if (m_waitersBlocked > m_waitersGone) {
+        res = WaitForSingleObject(m_blockLock, INFINITE); // Close the gate.
         ASSERT(res == WAIT_OBJECT_0);
-        if (m_condition.m_blocked > m_condition.m_timedOut) {
-            if (m_condition.m_timedOut != 0) {
-                m_condition.m_blocked -= m_condition.m_timedOut;
-                m_condition.m_timedOut = 0;
-            }
-            signals = m_condition.m_waitingForRemoval = 1;
-            --m_condition.m_blocked;
+        if (m_waitersGone != 0) {
+            m_waitersBlocked -= m_waitersGone;
+            m_waitersGone = 0;
+        }
+        if (unblockAll) {
+            signalsToIssue = m_waitersBlocked;
+            m_waitersToUnblock = m_waitersBlocked;
+            m_waitersBlocked = 0;
         } else {
-            res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
-            ASSERT(res);
+            signalsToIssue = 1;
+            m_waitersToUnblock = 1;
+            --m_waitersBlocked;
         }
+    } else { // No-op.
+        res = ReleaseMutex(m_unblockLock);
+        ASSERT(res);
+        return;
     }
 
-    res =::ReleaseMutex(m_condition.m_mutex);
+    res = ReleaseMutex(m_unblockLock);
     ASSERT(res);
 
-    if (signals) {
-        res = ::ReleaseSemaphore(m_condition.m_queue, signals, 0);
+    if (signalsToIssue) {
+        res = ReleaseSemaphore(m_blockQueue, signalsToIssue, 0);
         ASSERT(res);
     }
 }
 
-void ThreadCondition::broadcast()
+static const long MaxSemaphoreCount = static_cast<long>(~0UL >> 1);
+
+ThreadCondition::ThreadCondition()
 {
-    unsigned signals = 0;
+    m_condition.m_waitersGone = 0;
+    m_condition.m_waitersBlocked = 0;
+    m_condition.m_waitersToUnblock = 0;
+    m_condition.m_blockLock = CreateSemaphore(0, 1, 1, 0);
+    m_condition.m_blockQueue = CreateSemaphore(0, 0, MaxSemaphoreCount, 0);
+    m_condition.m_unblockLock = CreateMutex(0, 0, 0);
+
+    if (!m_condition.m_blockLock || !m_condition.m_blockQueue || !m_condition.m_unblockLock) {
+        if (m_condition.m_blockLock)
+            CloseHandle(m_condition.m_blockLock);
+        if (m_condition.m_blockQueue)
+            CloseHandle(m_condition.m_blockQueue);
+        if (m_condition.m_unblockLock)
+            CloseHandle(m_condition.m_unblockLock);
+    }
+}
 
-    DWORD res = ::WaitForSingleObject(m_condition.m_mutex, INFINITE);
-    ASSERT(res == WAIT_OBJECT_0);
+ThreadCondition::~ThreadCondition()
+{
+    CloseHandle(m_condition.m_blockLock);
+    CloseHandle(m_condition.m_blockQueue);
+    CloseHandle(m_condition.m_unblockLock);
+}
 
-    if (m_condition.m_waitingForRemoval != 0) { // the m_gate is already closed
-        if (m_condition.m_blocked == 0) {
-            res = ::ReleaseMutex(m_condition.m_mutex);
-            ASSERT(res);
-            return;
-        }
+void ThreadCondition::wait(Mutex& mutex)
+{
+    m_condition.timedWait(mutex.impl(), INFINITE);
+}
 
-        m_condition.m_waitingForRemoval += (signals = m_condition.m_blocked);
-        m_condition.m_blocked = 0;
-    } else {
-        res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
-        ASSERT(res == WAIT_OBJECT_0);
-        if (m_condition.m_blocked > m_condition.m_timedOut) {
-            if (m_condition.m_timedOut != 0) {
-                m_condition.m_blocked -= m_condition.m_timedOut;
-                m_condition.m_timedOut = 0;
-            }
-            signals = m_condition.m_waitingForRemoval = m_condition.m_blocked;
-            m_condition.m_blocked = 0;
-        } else {
-            res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
-            ASSERT(res);
-        }
-    }
+bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
+{
+    double currentTime = WTF::currentTime();
 
-    res = ::ReleaseMutex(m_condition.m_mutex);
-    ASSERT(res);
+    // Time is in the past - return immediately.
+    if (absoluteTime < currentTime)
+        return false;
 
-    if (signals) {
-        res = ::ReleaseSemaphore(m_condition.m_queue, signals, 0);
-        ASSERT(res);
+    // Time is too far in the future (and would overflow unsigned long) - wait forever.
+    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0) {
+        wait(mutex);
+        return true;
     }
+
+    double intervalMilliseconds = (absoluteTime - currentTime) * 1000.0;
+    return m_condition.timedWait(mutex.impl(), static_cast<unsigned long>(intervalMilliseconds));
+}
+
+void ThreadCondition::signal()
+{
+    m_condition.signal(false); // Unblock only 1 thread.
+}
+
+void ThreadCondition::broadcast()
+{
+    m_condition.signal(true); // Unblock all threads.
 }
 
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
new file mode 100644
index 0000000000..36fc6c68f9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
@@ -0,0 +1,120 @@
+ /*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "TypeTraits.h"
+
+#include "Assertions.h"
+
+namespace WTF {
+
+COMPILE_ASSERT(IsInteger<bool>::value, WTF_IsInteger_bool_true);
+COMPILE_ASSERT(IsInteger<char>::value, WTF_IsInteger_char_true);
+COMPILE_ASSERT(IsInteger<signed char>::value, WTF_IsInteger_signed_char_true);
+COMPILE_ASSERT(IsInteger<unsigned char>::value, WTF_IsInteger_unsigned_char_true);
+COMPILE_ASSERT(IsInteger<short>::value, WTF_IsInteger_short_true);
+COMPILE_ASSERT(IsInteger<unsigned short>::value, WTF_IsInteger_unsigned_short_true);
+COMPILE_ASSERT(IsInteger<int>::value, WTF_IsInteger_int_true);
+COMPILE_ASSERT(IsInteger<unsigned int>::value, WTF_IsInteger_unsigned_int_true);
+COMPILE_ASSERT(IsInteger<long>::value, WTF_IsInteger_long_true);
+COMPILE_ASSERT(IsInteger<unsigned long>::value, WTF_IsInteger_unsigned_long_true);
+COMPILE_ASSERT(IsInteger<long long>::value, WTF_IsInteger_long_long_true);
+COMPILE_ASSERT(IsInteger<unsigned long long>::value, WTF_IsInteger_unsigned_long_long_true);
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+COMPILE_ASSERT(IsInteger<wchar_t>::value, WTF_IsInteger_wchar_t_true);
+#endif
+COMPILE_ASSERT(!IsInteger<char*>::value, WTF_IsInteger_char_pointer_false);
+COMPILE_ASSERT(!IsInteger<const char*>::value, WTF_IsInteger_const_char_pointer_false);
+COMPILE_ASSERT(!IsInteger<volatile char*>::value, WTF_IsInteger_volatile_char_pointer_false);
+COMPILE_ASSERT(!IsInteger<double>::value, WTF_IsInteger_double_false);
+COMPILE_ASSERT(!IsInteger<float>::value, WTF_IsInteger_float_false);
+
+COMPILE_ASSERT(IsPod<bool>::value, WTF_IsPod_bool_true);
+COMPILE_ASSERT(IsPod<char>::value, WTF_IsPod_char_true);
+COMPILE_ASSERT(IsPod<signed char>::value, WTF_IsPod_signed_char_true);
+COMPILE_ASSERT(IsPod<unsigned char>::value, WTF_IsPod_unsigned_char_true);
+COMPILE_ASSERT(IsPod<short>::value, WTF_IsPod_short_true);
+COMPILE_ASSERT(IsPod<unsigned short>::value, WTF_IsPod_unsigned_short_true);
+COMPILE_ASSERT(IsPod<int>::value, WTF_IsPod_int_true);
+COMPILE_ASSERT(IsPod<unsigned int>::value, WTF_IsPod_unsigned_int_true);
+COMPILE_ASSERT(IsPod<long>::value, WTF_IsPod_long_true);
+COMPILE_ASSERT(IsPod<unsigned long>::value, WTF_IsPod_unsigned_long_true);
+COMPILE_ASSERT(IsPod<long long>::value, WTF_IsPod_long_long_true);
+COMPILE_ASSERT(IsPod<unsigned long long>::value, WTF_IsPod_unsigned_long_long_true);
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+COMPILE_ASSERT(IsPod<wchar_t>::value, WTF_IsPod_wchar_t_true);
+#endif
+COMPILE_ASSERT(IsPod<char*>::value, WTF_IsPod_char_pointer_true);
+COMPILE_ASSERT(IsPod<const char*>::value, WTF_IsPod_const_char_pointer_true);
+COMPILE_ASSERT(IsPod<volatile char*>::value, WTF_IsPod_volatile_char_pointer_true);
+COMPILE_ASSERT(IsPod<double>::value, WTF_IsPod_double_true);
+COMPILE_ASSERT(IsPod<long double>::value, WTF_IsPod_long_double_true);
+COMPILE_ASSERT(IsPod<float>::value, WTF_IsPod_float_true);
+COMPILE_ASSERT(!IsPod<IsPod<bool> >::value, WTF_IsPod_struct_false);
+
+enum IsConvertibleToIntegerCheck { };
+COMPILE_ASSERT(IsConvertibleToInteger<IsConvertibleToIntegerCheck>::value, WTF_IsConvertibleToInteger_enum_true);
+COMPILE_ASSERT(IsConvertibleToInteger<bool>::value, WTF_IsConvertibleToInteger_bool_true);
+COMPILE_ASSERT(IsConvertibleToInteger<char>::value, WTF_IsConvertibleToInteger_char_true);
+COMPILE_ASSERT(IsConvertibleToInteger<signed char>::value, WTF_IsConvertibleToInteger_signed_char_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned char>::value, WTF_IsConvertibleToInteger_unsigned_char_true);
+COMPILE_ASSERT(IsConvertibleToInteger<short>::value, WTF_IsConvertibleToInteger_short_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned short>::value, WTF_IsConvertibleToInteger_unsigned_short_true);
+COMPILE_ASSERT(IsConvertibleToInteger<int>::value, WTF_IsConvertibleToInteger_int_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned int>::value, WTF_IsConvertibleToInteger_unsigned_int_true);
+COMPILE_ASSERT(IsConvertibleToInteger<long>::value, WTF_IsConvertibleToInteger_long_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned long>::value, WTF_IsConvertibleToInteger_unsigned_long_true);
+COMPILE_ASSERT(IsConvertibleToInteger<long long>::value, WTF_IsConvertibleToInteger_long_long_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned long long>::value, WTF_IsConvertibleToInteger_unsigned_long_long_true);
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+COMPILE_ASSERT(IsConvertibleToInteger<wchar_t>::value, WTF_IsConvertibleToInteger_wchar_t_true);
+#endif
+COMPILE_ASSERT(IsConvertibleToInteger<double>::value, WTF_IsConvertibleToInteger_double_true);
+COMPILE_ASSERT(IsConvertibleToInteger<long double>::value, WTF_IsConvertibleToInteger_long_double_true);
+COMPILE_ASSERT(IsConvertibleToInteger<float>::value, WTF_IsConvertibleToInteger_float_true);
+COMPILE_ASSERT(!IsConvertibleToInteger<char*>::value, WTF_IsConvertibleToInteger_char_pointer_false);
+COMPILE_ASSERT(!IsConvertibleToInteger<const char*>::value, WTF_IsConvertibleToInteger_const_char_pointer_false);
+COMPILE_ASSERT(!IsConvertibleToInteger<volatile char*>::value, WTF_IsConvertibleToInteger_volatile_char_pointer_false);
+COMPILE_ASSERT(!IsConvertibleToInteger<IsConvertibleToInteger<bool> >::value, WTF_IsConvertibleToInteger_struct_false);
+
+COMPILE_ASSERT((IsSameType<bool, bool>::value), WTF_IsSameType_bool_true);
+COMPILE_ASSERT((IsSameType<int*, int*>::value), WTF_IsSameType_int_pointer_true);
+COMPILE_ASSERT((!IsSameType<int, int*>::value), WTF_IsSameType_int_int_pointer_false);
+COMPILE_ASSERT((!IsSameType<bool, const bool>::value), WTF_IsSameType_const_change_false);
+COMPILE_ASSERT((!IsSameType<bool, volatile bool>::value), WTF_IsSameType_volatile_change_false);
+
+COMPILE_ASSERT((IsSameType<bool, RemoveConst<const bool>::Type>::value), WTF_test_RemoveConst_const_bool);
+COMPILE_ASSERT((!IsSameType<bool, RemoveConst<volatile bool>::Type>::value), WTF_test_RemoveConst_volatile_bool);
+
+COMPILE_ASSERT((IsSameType<bool, RemoveVolatile<bool>::Type>::value), WTF_test_RemoveVolatile_bool);
+COMPILE_ASSERT((!IsSameType<bool, RemoveVolatile<const bool>::Type>::value), WTF_test_RemoveVolatile_const_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveVolatile<volatile bool>::Type>::value), WTF_test_RemoveVolatile_volatile_bool);
+
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<bool>::Type>::value), WTF_test_RemoveConstVolatile_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<const bool>::Type>::value), WTF_test_RemoveConstVolatile_const_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<volatile bool>::Type>::value), WTF_test_RemoveConstVolatile_volatile_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<const volatile bool>::Type>::value), WTF_test_RemoveConstVolatile_const_volatile_bool);
+
+COMPILE_ASSERT((IsSameType<int, RemovePointer<int>::Type>::value), WTF_Test_RemovePointer_int);
+COMPILE_ASSERT((IsSameType<int, RemovePointer<int*>::Type>::value), WTF_Test_RemovePointer_int_pointer);
+COMPILE_ASSERT((!IsSameType<int, RemovePointer<int**>::Type>::value), WTF_Test_RemovePointer_int_pointer_pointer);
+
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
new file mode 100644
index 0000000000..6ce6a3e5cc
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
@@ -0,0 +1,339 @@
+ /*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef TypeTraits_h
+#define TypeTraits_h
+
+#include "Platform.h"
+
+#if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
+#include <type_traits>
+#endif
+
+namespace WTF {
+
+    // The following are provided in this file:
+    //
+    //   IsInteger<T>::value
+    //   IsPod<T>::value, see the definition for a note about its limitations
+    //   IsConvertibleToInteger<T>::value
+    //
+    //   IsSameType<T, U>::value
+    //
+    //   RemovePointer<T>::Type
+    //   RemoveConst<T>::Type
+    //   RemoveVolatile<T>::Type
+    //   RemoveConstVolatile<T>::Type
+    //
+    //   COMPILE_ASSERT's in TypeTraits.cpp illustrate their usage and what they do.
+
+    template<typename T> struct IsInteger           { static const bool value = false; };
+    template<> struct IsInteger<bool>               { static const bool value = true; };
+    template<> struct IsInteger<char>               { static const bool value = true; };
+    template<> struct IsInteger<signed char>        { static const bool value = true; };
+    template<> struct IsInteger<unsigned char>      { static const bool value = true; };
+    template<> struct IsInteger<short>              { static const bool value = true; };
+    template<> struct IsInteger<unsigned short>     { static const bool value = true; };
+    template<> struct IsInteger<int>                { static const bool value = true; };
+    template<> struct IsInteger<unsigned int>       { static const bool value = true; };
+    template<> struct IsInteger<long>               { static const bool value = true; };
+    template<> struct IsInteger<unsigned long>      { static const bool value = true; };
+    template<> struct IsInteger<long long>          { static const bool value = true; };
+    template<> struct IsInteger<unsigned long long> { static const bool value = true; };
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+    template<> struct IsInteger<wchar_t>            { static const bool value = true; };
+#endif
+
+    // IsPod is misnamed as it doesn't cover all plain old data (pod) types.
+    // Specifically, it doesn't allow for enums or for structs.
+    template <typename T> struct IsPod           { static const bool value = IsInteger<T>::value; };
+    template <> struct IsPod<float>              { static const bool value = true; };
+    template <> struct IsPod<double>             { static const bool value = true; };
+    template <> struct IsPod<long double>        { static const bool value = true; };
+    template <typename P> struct IsPod<P*>       { static const bool value = true; };
+
+    template<typename T> class IsConvertibleToInteger {
+        // Avoid "possible loss of data" warning when using Microsoft's C++ compiler
+        // by not converting int's to doubles.
+        template<bool performCheck, typename U> class IsConvertibleToDouble;
+        template<typename U> class IsConvertibleToDouble<false, U> {
+        public:
+            static const bool value = false;
+        };
+
+        template<typename U> class IsConvertibleToDouble<true, U> {
+            typedef char YesType;
+            struct NoType {
+                char padding[8];
+            };
+
+            static YesType floatCheck(long double);
+            static NoType floatCheck(...);
+            static T& t;
+        public:
+            static const bool value = sizeof(floatCheck(t)) == sizeof(YesType);
+        };
+
+    public:
+        static const bool value = IsInteger<T>::value || IsConvertibleToDouble<!IsInteger<T>::value, T>::value;
+    };
+
+    template <typename T, typename U> struct IsSameType {
+        static const bool value = false;
+    };
+
+    template <typename T> struct IsSameType<T, T> {
+        static const bool value = true;
+    };
+
+    template <typename T> struct RemoveConst {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveConst<const T> {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveVolatile {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveVolatile<volatile T> {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveConstVolatile {
+        typedef typename RemoveVolatile<typename RemoveConst<T>::Type>::Type Type;
+    };
+
+    template <typename T> struct RemovePointer {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemovePointer<T*> {
+        typedef T Type;
+    };
+
+#if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
+
+    // GCC's libstdc++ 20070724 and later supports C++ TR1 type_traits in the std namespace.
+    // VC10 (VS2010) and later support C++ TR1 type_traits in the std::tr1 namespace.
+    template<typename T> struct HasTrivialConstructor : public std::tr1::has_trivial_constructor<T> { };
+    template<typename T> struct HasTrivialDestructor : public std::tr1::has_trivial_destructor<T> { };
+
+#else
+
+    // This compiler doesn't provide type traits, so we provide basic HasTrivialConstructor
+    // and HasTrivialDestructor definitions. The definitions here include most built-in
+    // scalar types but do not include POD structs and classes. For the intended purposes of
+    // type_traits this results correct but potentially less efficient code.
+    template <typename T, T v>
+    struct IntegralConstant {
+        static const T value = v;
+        typedef T value_type;
+        typedef IntegralConstant<T, v> type;
+    };
+
+    typedef IntegralConstant<bool, true>  true_type;
+    typedef IntegralConstant<bool, false> false_type;
+
+#if defined(_MSC_VER) && (_MSC_VER >= 1400)
+    // VC8 (VS2005) and later have built-in compiler support for HasTrivialConstructor / HasTrivialDestructor,
+    // but for some unexplained reason it doesn't work on built-in types.
+    template <typename T> struct HasTrivialConstructor : public IntegralConstant<bool, __has_trivial_constructor(T)>{ };
+    template <typename T> struct HasTrivialDestructor : public IntegralConstant<bool, __has_trivial_destructor(T)>{ };
+#else
+    template <typename T> struct HasTrivialConstructor : public false_type{ };
+    template <typename T> struct HasTrivialDestructor : public false_type{ };
+#endif
+
+    template <typename T> struct HasTrivialConstructor<T*> : public true_type{ };
+    template <typename T> struct HasTrivialDestructor<T*> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<float> : public true_type{ };
+    template <> struct HasTrivialConstructor<const float> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile float> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile float> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const double> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile double> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile long double> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned char> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned short> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned int> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned long long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed char> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed short> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed int> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed long long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<const bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile bool> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile char> : public true_type{ };
+
+    #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+        template <> struct HasTrivialConstructor<wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<const wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<volatile wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<const volatile wchar_t> : public true_type{ };
+    #endif
+
+    template <> struct HasTrivialDestructor<float> : public true_type{ };
+    template <> struct HasTrivialDestructor<const float> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile float> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile float> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const double> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile double> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile long double> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned char> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned short> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned int> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned long long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed char> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed short> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed int> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed long long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<const bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile bool> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile char> : public true_type{ };
+
+    #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+        template <> struct HasTrivialDestructor<wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<const wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<volatile wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<const volatile wchar_t> : public true_type{ };
+    #endif
+
+#endif  // __GLIBCXX__, etc.
+
+} // namespace WTF
+
+#endif // TypeTraits_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
new file mode 100644
index 0000000000..519f518949
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef VMTags_h
+#define VMTags_h
+
+#include <wtf/Platform.h>
+
+// On Mac OS X, the VM subsystem allows tagging memory requested from mmap and vm_map
+// in order to aid tools that inspect system memory use. 
+#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#include <mach/vm_statistics.h>
+
+#if defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
+#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+#else
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(63)
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(64)
+#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(65)
+#endif // defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+
+#else // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#define VM_TAG_FOR_COLLECTOR_MEMORY -1
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
+#define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+
+#endif // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#endif // VMTags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 880b45de87..dcfeb29db4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -377,7 +377,8 @@ namespace WTF {
         VectorBuffer(size_t capacity)
             : Base(inlineBuffer(), inlineCapacity)
         {
-            allocateBuffer(capacity);
+            if (capacity > inlineCapacity)
+                Base::allocateBuffer(capacity);
         }
 
         ~VectorBuffer()
@@ -389,6 +390,10 @@ namespace WTF {
         {
             if (newCapacity > inlineCapacity)
                 Base::allocateBuffer(newCapacity);
+            else {
+                m_buffer = inlineBuffer();
+                m_capacity = inlineCapacity;
+            }
         }
 
         void deallocateBuffer(T* bufferToDeallocate)
@@ -503,6 +508,7 @@ namespace WTF {
         void grow(size_t size);
         void resize(size_t size);
         void reserveCapacity(size_t newCapacity);
+        void reserveInitialCapacity(size_t initialCapacity);
         void shrinkCapacity(size_t newCapacity);
         void shrinkToFit() { shrinkCapacity(size()); }
 
@@ -686,7 +692,7 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity>
-    void Vector<T, inlineCapacity>::resize(size_t size)
+    inline void Vector<T, inlineCapacity>::resize(size_t size)
     {
         if (size <= m_size)
             TypeOperations::destruct(begin() + size, end());
@@ -733,6 +739,15 @@ namespace WTF {
     }
     
     template<typename T, size_t inlineCapacity>
+    inline void Vector<T, inlineCapacity>::reserveInitialCapacity(size_t initialCapacity)
+    {
+        ASSERT(!m_size);
+        ASSERT(capacity() == inlineCapacity);
+        if (initialCapacity > inlineCapacity)
+            m_buffer.allocateBuffer(initialCapacity);
+    }
+    
+    template<typename T, size_t inlineCapacity>
     void Vector<T, inlineCapacity>::shrinkCapacity(size_t newCapacity)
     {
         if (newCapacity >= capacity())
@@ -766,6 +781,8 @@ namespace WTF {
             if (!begin())
                 return;
         }
+        if (newSize < m_size)
+            CRASH();
         T* dest = end();
         for (size_t i = 0; i < dataSize; ++i)
             new (&dest[i]) T(data[i]);
@@ -773,7 +790,7 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity> template<typename U>
-    inline void Vector<T, inlineCapacity>::append(const U& val)
+    ALWAYS_INLINE void Vector<T, inlineCapacity>::append(const U& val)
     {
         const U* ptr = &val;
         if (size() == capacity()) {
@@ -827,6 +844,8 @@ namespace WTF {
             if (!begin())
                 return;
         }
+        if (newSize < m_size)
+            CRASH();
         T* spot = begin() + position;
         TypeOperations::moveOverlapping(spot, end(), spot + dataSize);
         for (size_t i = 0; i < dataSize; ++i)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
index 6efe36c58e..7974b9a77e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
@@ -22,6 +22,7 @@
 #define WTF_VectorTraits_h
 
 #include "RefPtr.h"
+#include "TypeTraits.h"
 #include <utility>
 #include <memory>
 
@@ -29,24 +30,6 @@ using std::pair;
 
 namespace WTF {
 
-    template <typename T> struct IsPod           { static const bool value = false; };
-    template <> struct IsPod<bool>               { static const bool value = true; };
-    template <> struct IsPod<char>               { static const bool value = true; };
-    template <> struct IsPod<signed char>        { static const bool value = true; };
-    template <> struct IsPod<unsigned char>      { static const bool value = true; };
-    template <> struct IsPod<short>              { static const bool value = true; };
-    template <> struct IsPod<unsigned short>     { static const bool value = true; };
-    template <> struct IsPod<int>                { static const bool value = true; };
-    template <> struct IsPod<unsigned int>       { static const bool value = true; };
-    template <> struct IsPod<long>               { static const bool value = true; };
-    template <> struct IsPod<unsigned long>      { static const bool value = true; };
-    template <> struct IsPod<long long>          { static const bool value = true; };
-    template <> struct IsPod<unsigned long long> { static const bool value = true; };
-    template <> struct IsPod<float>              { static const bool value = true; };
-    template <> struct IsPod<double>             { static const bool value = true; };
-    template <> struct IsPod<long double>        { static const bool value = true; };
-    template <typename P> struct IsPod<P *>      { static const bool value = true; };
-
     template<bool isPod, typename T>
     class VectorTraitsBase;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
index adbb115f05..9509388f09 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
@@ -150,6 +150,8 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/Threading.h>
 
+#include <stdio.h>
+
 #if COMPILER(MSVC)
 #pragma warning(disable: 4244)
 #pragma warning(disable: 4245)
@@ -189,13 +191,13 @@ typedef union { double d; uint32_t L[2]; } U;
 #endif
 #else
 #ifdef IEEE_8087
-#define word0(x) ((U*)&x)->L[1]
-#define word1(x) ((U*)&x)->L[0]
+#define word0(x) (x)->L[1]
+#define word1(x) (x)->L[0]
 #else
-#define word0(x) ((U*)&x)->L[0]
-#define word1(x) ((U*)&x)->L[1]
+#define word0(x) (x)->L[0]
+#define word1(x) (x)->L[1]
 #endif
-#define dval(x) ((U*)&x)->d
+#define dval(x) (x)->d
 #endif
 
 /* The following definition of Storeinc is appropriate for MIPS processors.
@@ -275,32 +277,29 @@ typedef union { double d; uint32_t L[2]; } U;
 
 #define Kmax 15
 
-struct Bigint {
-    struct Bigint* next;
-    int k, maxwds, sign, wds;
-    uint32_t x[1];
-};
-
-static Bigint* Balloc(int k)
-{
-    int x = 1 << k;
-    Bigint* rv = (Bigint*)fastMalloc(sizeof(Bigint) + (x - 1)*sizeof(uint32_t));
-    rv->k = k;
-    rv->maxwds = x;
-    rv->next = 0;
-    rv->sign = rv->wds = 0;
-
-    return rv;
-}
-
-static void Bfree(Bigint* v)
-{
-    fastFree(v);
-}
+struct BigInt {
+    BigInt() : sign(0), wds(0) { }
+    BigInt(const BigInt& other) : sign(other.sign), wds(other.wds) 
+    {
+        for (int i = 0; i < 64; ++i)
+            x[i] = other.x[i];
+    }
 
-#define Bcopy(x, y) memcpy((char*)&x->sign, (char*)&y->sign, y->wds * sizeof(int32_t) + 2 * sizeof(int))
+    BigInt& operator=(const BigInt& other) 
+    {
+        sign = other.sign;
+        wds = other.wds;
+        for (int i = 0; i < 64; ++i)
+            x[i] = other.x[i];        
+        return *this;
+    }
+    
+    int sign;
+    int wds;
+    uint32_t x[64];
+};
 
-static Bigint* multadd(Bigint* b, int m, int a)    /* multiply by m and add a */
+static void multadd(BigInt& b, int m, int a)    /* multiply by m and add a */
 {
 #ifdef USE_LONG_LONG
     unsigned long long carry;
@@ -308,8 +307,8 @@ static Bigint* multadd(Bigint* b, int m, int a)    /* multiply by m and add a */
     uint32_t carry;
 #endif
 
-    int wds = b->wds;
-    uint32_t* x = b->x;
+    int wds = b.wds;
+    uint32_t* x = b.x;
     int i = 0;
     carry = a;
     do {
@@ -333,19 +332,12 @@ static Bigint* multadd(Bigint* b, int m, int a)    /* multiply by m and add a */
     } while (++i < wds);
 
     if (carry) {
-        if (wds >= b->maxwds) {
-            Bigint* b1 = Balloc(b->k + 1);
-            Bcopy(b1, b);
-            Bfree(b);
-            b = b1;
-        }
-        b->x[wds++] = (uint32_t)carry;
-        b->wds = wds;
+        b.x[wds++] = (uint32_t)carry;
+        b.wds = wds;
     }
-    return b;
 }
 
-static Bigint* s2b(const char* s, int nd0, int nd, uint32_t y9)
+static void s2b(BigInt& b, const char* s, int nd0, int nd, uint32_t y9)
 {
     int k;
     int32_t y;
@@ -353,27 +345,26 @@ static Bigint* s2b(const char* s, int nd0, int nd, uint32_t y9)
 
     for (k = 0, y = 1; x > y; y <<= 1, k++) { }
 #ifdef Pack_32
-    Bigint* b = Balloc(k);
-    b->x[0] = y9;
-    b->wds = 1;
+    b.sign = 0;
+    b.x[0] = y9;
+    b.wds = 1;
 #else
-    Bigint* b = Balloc(k + 1);
-    b->x[0] = y9 & 0xffff;
-    b->wds = (b->x[1] = y9 >> 16) ? 2 : 1;
+    b.sign = 0;
+    b.x[0] = y9 & 0xffff;
+    b.wds = (b->x[1] = y9 >> 16) ? 2 : 1;
 #endif
 
     int i = 9;
     if (9 < nd0) {
         s += 9;
         do {
-            b = multadd(b, 10, *s++ - '0');
+            multadd(b, 10, *s++ - '0');
         } while (++i < nd0);
         s++;
     } else
         s += 10;
     for (; i < nd; i++)
-        b = multadd(b, 10, *s++ - '0');
-    return b;
+        multadd(b, 10, *s++ - '0');
 }
 
 static int hi0bits(uint32_t x)
@@ -446,21 +437,21 @@ static int lo0bits (uint32_t* y)
     return k;
 }
 
-static Bigint* i2b(int i)
+static void i2b(BigInt& b, int i)
 {
-    Bigint* b;
-
-    b = Balloc(1);
-    b->x[0] = i;
-    b->wds = 1;
-    return b;
+    b.sign = 0;
+    b.x[0] = i;
+    b.wds = 1;
 }
 
-static Bigint* mult(Bigint* a, Bigint* b)
+static void mult(BigInt& aRef, const BigInt& bRef)
 {
-    Bigint* c;
-    int k, wa, wb, wc;
-    uint32_t *x, *xa, *xae, *xb, *xbe, *xc, *xc0;
+    const BigInt* a = &aRef;
+    const BigInt* b = &bRef;
+    BigInt c;
+    int wa, wb, wc;
+    const uint32_t *x = 0, *xa, *xb, *xae, *xbe;
+    uint32_t *xc, *xc0;
     uint32_t y;
 #ifdef USE_LONG_LONG
     unsigned long long carry, z;
@@ -469,24 +460,22 @@ static Bigint* mult(Bigint* a, Bigint* b)
 #endif
 
     if (a->wds < b->wds) {
-        c = a;
+        const BigInt* tmp = a;
         a = b;
-        b = c;
+        b = tmp;
     }
-    k = a->k;
+    
     wa = a->wds;
     wb = b->wds;
     wc = wa + wb;
-    if (wc > a->maxwds)
-        k++;
-    c = Balloc(k);
-    for (x = c->x, xa = x + wc; x < xa; x++)
-        *x = 0;
+
+    for (xc = c.x, xa = xc + wc; xc < xa; xc++)
+        *xc = 0;
     xa = a->x;
     xae = xa + wa;
     xb = b->x;
     xbe = xb + wb;
-    xc0 = c->x;
+    xc0 = c.x;
 #ifdef USE_LONG_LONG
     for (; xb < xbe; xc0++) {
         if ((y = *xb++)) {
@@ -548,33 +537,43 @@ static Bigint* mult(Bigint* a, Bigint* b)
     }
 #endif
 #endif
-    for (xc0 = c->x, xc = xc0 + wc; wc > 0 && !*--xc; --wc) { }
-    c->wds = wc;
-    return c;
+    for (xc0 = c.x, xc = xc0 + wc; wc > 0 && !*--xc; --wc) { }
+    c.wds = wc;
+    aRef = c;
 }
 
-static Bigint* p5s;
+struct P5Node {
+    BigInt val;
+    P5Node* next;
+};
+    
+static P5Node* p5s;
 static int p5s_count;
 
-static Bigint* pow5mult(Bigint* b, int k)
+static ALWAYS_INLINE void pow5mult(BigInt& b, int k)
 {
     static int p05[3] = { 5, 25, 125 };
 
     if (int i = k & 3)
-        b = multadd(b, p05[i - 1], 0);
+        multadd(b, p05[i - 1], 0);
 
     if (!(k >>= 2))
-        return b;
+        return;
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex->lock();
 #endif
-    Bigint* p5 = p5s;
+    P5Node* p5 = p5s;
+
     if (!p5) {
         /* first time */
-        p5 = p5s = i2b(625);
+        p5 = new P5Node;
+        i2b(p5->val, 625);
+        p5->next = 0;
+        p5s = p5;
         p5s_count = 1;
     }
+
     int p5s_count_local = p5s_count;
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex->unlock();
@@ -582,11 +581,9 @@ static Bigint* pow5mult(Bigint* b, int k)
     int p5s_used = 0;
 
     for (;;) {
-        if (k & 1) {
-            Bigint* b1 = mult(b, p5);
-            Bfree(b);
-            b = b1;
-        }
+        if (k & 1)
+            mult(b, p5->val);
+
         if (!(k >>= 1))
             break;
 
@@ -596,7 +593,10 @@ static Bigint* pow5mult(Bigint* b, int k)
 #endif
             if (p5s_used == p5s_count) {
                 ASSERT(!p5->next);
-                p5->next = mult(p5, p5);
+                p5->next = new P5Node;
+                p5->next->next = 0;
+                p5->next->val = p5->val;
+                mult(p5->next->val, p5->next->val);
                 ++p5s_count;
             }
             
@@ -607,30 +607,21 @@ static Bigint* pow5mult(Bigint* b, int k)
         }
         p5 = p5->next;
     }
-
-    return b;
 }
 
-static Bigint* lshift(Bigint* b, int k)
+static ALWAYS_INLINE void lshift(BigInt& b, int k)
 {
-    Bigint* result = b;
-
 #ifdef Pack_32
     int n = k >> 5;
 #else
     int n = k >> 4;
 #endif
 
-    int k1 = b->k;
-    int n1 = n + b->wds + 1;
-    for (int i = b->maxwds; n1 > i; i <<= 1)
-        k1++;
-    if (b->k < k1)
-        result = Balloc(k1);
+    int n1 = n + b.wds + 1;
 
-    const uint32_t* srcStart = b->x;
-    uint32_t* dstStart = result->x;
-    const uint32_t* src = srcStart + b->wds - 1;
+    const uint32_t* srcStart = b.x;
+    uint32_t* dstStart = b.x;
+    const uint32_t* src = srcStart + b.wds - 1;
     uint32_t* dst = dstStart + n1 - 1;
 #ifdef Pack_32
     if (k &= 0x1f) {
@@ -642,7 +633,7 @@ static Bigint* lshift(Bigint* b, int k)
         }
         *dst = hiSubword;
         ASSERT(dst == dstStart + n);
-        result->wds = b->wds + n + (result->x[n1 - 1] != 0);
+        b.wds = b.wds + n + (b.x[n1 - 1] != 0);
     }
 #else
     if (k &= 0xf) {
@@ -661,30 +652,26 @@ static Bigint* lshift(Bigint* b, int k)
         do {
             *--dst = *src--;
         } while (src >= srcStart);
-        result->wds = b->wds + n;
+        b.wds = b.wds + n;
     }
     for (dst = dstStart + n; dst != dstStart; )
         *--dst = 0;
-
-    if (result != b)
-        Bfree(b);
-    return result;
 }
 
-static int cmp(Bigint* a, Bigint* b)
+static int cmp(const BigInt& a, const BigInt& b)
 {
-    uint32_t *xa, *xa0, *xb, *xb0;
+    const uint32_t *xa, *xa0, *xb, *xb0;
     int i, j;
 
-    i = a->wds;
-    j = b->wds;
-    ASSERT(i <= 1 || a->x[i - 1]);
-    ASSERT(j <= 1 || b->x[j - 1]);
+    i = a.wds;
+    j = b.wds;
+    ASSERT(i <= 1 || a.x[i - 1]);
+    ASSERT(j <= 1 || b.x[j - 1]);
     if (i -= j)
         return i;
-    xa0 = a->x;
+    xa0 = a.x;
     xa = xa0 + j;
-    xb0 = b->x;
+    xb0 = b.x;
     xb = xb0 + j;
     for (;;) {
         if (*--xa != *--xb)
@@ -695,35 +682,37 @@ static int cmp(Bigint* a, Bigint* b)
     return 0;
 }
 
-static Bigint* diff(Bigint* a, Bigint* b)
+static ALWAYS_INLINE void diff(BigInt& c, const BigInt& aRef, const BigInt& bRef)
 {
-    Bigint* c;
+    const BigInt* a = &aRef;
+    const BigInt* b = &bRef;
     int i, wa, wb;
-    uint32_t *xa, *xae, *xb, *xbe, *xc;
+    uint32_t *xc;
 
-    i = cmp(a,b);
+    i = cmp(*a, *b);
     if (!i) {
-        c = Balloc(0);
-        c->wds = 1;
-        c->x[0] = 0;
-        return c;
+        c.sign = 0;
+        c.wds = 1;
+        c.x[0] = 0;
+        return;
     }
     if (i < 0) {
-        c = a;
+        const BigInt* tmp = a;
         a = b;
-        b = c;
+        b = tmp;
         i = 1;
     } else
         i = 0;
-    c = Balloc(a->k);
-    c->sign = i;
+
+    c.wds = 0;
+    c.sign = i;
     wa = a->wds;
-    xa = a->x;
-    xae = xa + wa;
+    const uint32_t* xa = a->x;
+    const uint32_t* xae = xa + wa;
     wb = b->wds;
-    xb = b->x;
-    xbe = xb + wb;
-    xc = c->x;
+    const uint32_t* xb = b->x;
+    const uint32_t* xbe = xb + wb;
+    xc = c.x;
 #ifdef USE_LONG_LONG
     unsigned long long borrow = 0;
     do {
@@ -768,14 +757,13 @@ static Bigint* diff(Bigint* a, Bigint* b)
 #endif
     while (!*--xc)
         wa--;
-    c->wds = wa;
-    return c;
+    c.wds = wa;
 }
 
-static double ulp(double x)
+static double ulp(U *x)
 {
     register int32_t L;
-    double a;
+    U u;
 
     L = (word0(x) & Exp_mask) - (P - 1) * Exp_msk1;
 #ifndef Avoid_Underflow
@@ -783,57 +771,57 @@ static double ulp(double x)
     if (L > 0) {
 #endif
 #endif
-        word0(a) = L;
-        word1(a) = 0;
+        word0(&u) = L;
+        word1(&u) = 0;
 #ifndef Avoid_Underflow
 #ifndef Sudden_Underflow
     } else {
         L = -L >> Exp_shift;
         if (L < Exp_shift) {
-            word0(a) = 0x80000 >> L;
-            word1(a) = 0;
+            word0(&u) = 0x80000 >> L;
+            word1(&u) = 0;
         } else {
-            word0(a) = 0;
+            word0(&u) = 0;
             L -= Exp_shift;
-            word1(a) = L >= 31 ? 1 : 1 << 31 - L;
+            word1(&u) = L >= 31 ? 1 : 1 << 31 - L;
         }
     }
 #endif
 #endif
-    return dval(a);
+    return dval(&u);
 }
 
-static double b2d(Bigint* a, int* e)
+static double b2d(const BigInt& a, int* e)
 {
-    uint32_t* xa;
-    uint32_t* xa0;
+    const uint32_t* xa;
+    const uint32_t* xa0;
     uint32_t w;
     uint32_t y;
     uint32_t z;
     int k;
-    double d;
+    U d;
 
-#define d0 word0(d)
-#define d1 word1(d)
+#define d0 word0(&d)
+#define d1 word1(&d)
 
-    xa0 = a->x;
-    xa = xa0 + a->wds;
+    xa0 = a.x;
+    xa = xa0 + a.wds;
     y = *--xa;
     ASSERT(y);
     k = hi0bits(y);
     *e = 32 - k;
 #ifdef Pack_32
     if (k < Ebits) {
-        d0 = Exp_1 | y >> Ebits - k;
+        d0 = Exp_1 | (y >> (Ebits - k));
         w = xa > xa0 ? *--xa : 0;
-        d1 = y << (32 - Ebits) + k | w >> Ebits - k;
+        d1 = (y << (32 - Ebits + k)) | (w >> (Ebits - k));
         goto ret_d;
     }
     z = xa > xa0 ? *--xa : 0;
     if (k -= Ebits) {
-        d0 = Exp_1 | y << k | z >> 32 - k;
+        d0 = Exp_1 | (y << k) | (z >> (32 - k));
         y = xa > xa0 ? *--xa : 0;
-        d1 = z << k | y >> 32 - k;
+        d1 = (z << k) | (y >> (32 - k));
     } else {
         d0 = Exp_1 | y;
         d1 = z;
@@ -857,12 +845,11 @@ static double b2d(Bigint* a, int* e)
 ret_d:
 #undef d0
 #undef d1
-    return dval(d);
+    return dval(&d);
 }
 
-static Bigint* d2b(double d, int* e, int* bits)
+static ALWAYS_INLINE void d2b(BigInt& b, U* d, int* e, int* bits)
 {
-    Bigint* b;
     int de, k;
     uint32_t *x, y, z;
 #ifndef Sudden_Underflow
@@ -871,12 +858,13 @@ static Bigint* d2b(double d, int* e, int* bits)
 #define d0 word0(d)
 #define d1 word1(d)
 
+    b.sign = 0;
 #ifdef Pack_32
-    b = Balloc(1);
+    b.wds = 1;
 #else
-    b = Balloc(2);
+    b.wds = 2;
 #endif
-    x = b->x;
+    x = b.x;
 
     z = d0 & Frac_mask;
     d0 &= 0x7fffffff;    /* clear sign bit, which we ignore */
@@ -889,21 +877,21 @@ static Bigint* d2b(double d, int* e, int* bits)
 #ifdef Pack_32
     if ((y = d1)) {
         if ((k = lo0bits(&y))) {
-            x[0] = y | z << 32 - k;
+            x[0] = y | (z << (32 - k));
             z >>= k;
         } else
             x[0] = y;
 #ifndef Sudden_Underflow
         i =
 #endif
-            b->wds = (x[1] = z) ? 2 : 1;
+            b.wds = (x[1] = z) ? 2 : 1;
     } else {
         k = lo0bits(&z);
         x[0] = z;
 #ifndef Sudden_Underflow
         i =
 #endif
-            b->wds = 1;
+            b.wds = 1;
         k += 32;
     }
 #else
@@ -958,30 +946,29 @@ static Bigint* d2b(double d, int* e, int* bits)
 #endif
     }
 #endif
-    return b;
 }
 #undef d0
 #undef d1
 
-static double ratio(Bigint* a, Bigint* b)
+static double ratio(const BigInt& a, const BigInt& b)
 {
-    double da, db;
+    U da, db;
     int k, ka, kb;
 
-    dval(da) = b2d(a, &ka);
-    dval(db) = b2d(b, &kb);
+    dval(&da) = b2d(a, &ka);
+    dval(&db) = b2d(b, &kb);
 #ifdef Pack_32
-    k = ka - kb + 32 * (a->wds - b->wds);
+    k = ka - kb + 32 * (a.wds - b.wds);
 #else
-    k = ka - kb + 16 * (a->wds - b->wds);
+    k = ka - kb + 16 * (a.wds - b.wds);
 #endif
     if (k > 0)
-        word0(da) += k * Exp_msk1;
+        word0(&da) += k * Exp_msk1;
     else {
         k = -k;
-        word0(db) += k * Exp_msk1;
+        word0(&db) += k * Exp_msk1;
     }
-    return dval(da) / dval(db);
+    return dval(&da) / dval(&db);
 }
 
 static const double tens[] = {
@@ -1031,7 +1018,7 @@ static int match(const char** sp, const char* t)
 }
 
 #ifndef No_Hex_NaN
-static void hexnan(double* rvp, const char** sp)
+static void hexnan(U* rvp, const char** sp)
 {
     uint32_t c, x[2];
     const char* s;
@@ -1070,8 +1057,8 @@ static void hexnan(double* rvp, const char** sp)
         x[1] = (x[1] << 4) | c;
     }
     if ((x[0] &= 0xfffff) || x[1]) {
-        word0(*rvp) = Exp_mask | x[0];
-        word1(*rvp) = x[1];
+        word0(rvp) = Exp_mask | x[0];
+        word1(rvp) = x[1];
     }
 }
 #endif /*No_Hex_NaN*/
@@ -1085,16 +1072,17 @@ double strtod(const char* s00, char** se)
     int bb2, bb5, bbe, bd2, bd5, bbbits, bs2, c, dsign,
          e, e1, esign, i, j, k, nd, nd0, nf, nz, nz0, sign;
     const char *s, *s0, *s1;
-    double aadj, aadj1, adj, rv, rv0;
+    double aadj, aadj1;
+    U aadj2, adj, rv, rv0;
     int32_t L;
     uint32_t y, z;
-    Bigint *bb = NULL, *bb1 = NULL, *bd = NULL, *bd0 = NULL, *bs = NULL, *delta = NULL;
+    BigInt bb, bb1, bd, bd0, bs, delta;
 #ifdef SET_INEXACT
     int inexact, oldinexact;
 #endif
 
     sign = nz0 = nz = 0;
-    dval(rv) = 0.;
+    dval(&rv) = 0;
     for (s = s00; ; s++)
         switch (*s) {
             case '-':
@@ -1209,16 +1197,16 @@ dig_done:
                         --s;
                         if (!match(&s,"inity"))
                             ++s;
-                        word0(rv) = 0x7ff00000;
-                        word1(rv) = 0;
+                        word0(&rv) = 0x7ff00000;
+                        word1(&rv) = 0;
                         goto ret;
                     }
                     break;
                 case 'n':
                 case 'N':
                     if (match(&s, "an")) {
-                        word0(rv) = NAN_WORD0;
-                        word1(rv) = NAN_WORD1;
+                        word0(&rv) = NAN_WORD0;
+                        word1(&rv) = NAN_WORD1;
 #ifndef No_Hex_NaN
                         if (*s == '(') /*)*/
                             hexnan(&rv, &s);
@@ -1243,21 +1231,20 @@ ret0:
     if (!nd0)
         nd0 = nd;
     k = nd < DBL_DIG + 1 ? nd : DBL_DIG + 1;
-    dval(rv) = y;
+    dval(&rv) = y;
     if (k > 9) {
 #ifdef SET_INEXACT
         if (k > DBL_DIG)
             oldinexact = get_inexact();
 #endif
-        dval(rv) = tens[k - 9] * dval(rv) + z;
+        dval(&rv) = tens[k - 9] * dval(&rv) + z;
     }
-    bd0 = 0;
     if (nd <= DBL_DIG && Flt_Rounds == 1) {
         if (!e)
             goto ret;
         if (e > 0) {
             if (e <= Ten_pmax) {
-                /* rv = */ rounded_product(dval(rv), tens[e]);
+                /* rv = */ rounded_product(dval(&rv), tens[e]);
                 goto ret;
             }
             i = DBL_DIG - nd;
@@ -1266,14 +1253,14 @@ ret0:
                  * this for larger i values.
                  */
                 e -= i;
-                dval(rv) *= tens[i];
-                /* rv = */ rounded_product(dval(rv), tens[e]);
+                dval(&rv) *= tens[i];
+                /* rv = */ rounded_product(dval(&rv), tens[e]);
                 goto ret;
             }
         }
 #ifndef Inaccurate_Divide
         else if (e >= -Ten_pmax) {
-            /* rv = */ rounded_quotient(dval(rv), tens[-e]);
+            /* rv = */ rounded_quotient(dval(&rv), tens[-e]);
             goto ret;
         }
 #endif
@@ -1293,7 +1280,7 @@ ret0:
 
     if (e1 > 0) {
         if ((i = e1 & 15))
-            dval(rv) *= tens[i];
+            dval(&rv) *= tens[i];
         if (e1 &= ~15) {
             if (e1 > DBL_MAX_10_EXP) {
 ovfl:
@@ -1301,38 +1288,36 @@ ovfl:
                 errno = ERANGE;
 #endif
                 /* Can't trust HUGE_VAL */
-                word0(rv) = Exp_mask;
-                word1(rv) = 0;
+                word0(&rv) = Exp_mask;
+                word1(&rv) = 0;
 #ifdef SET_INEXACT
                 /* set overflow bit */
-                dval(rv0) = 1e300;
-                dval(rv0) *= dval(rv0);
+                dval(&rv0) = 1e300;
+                dval(&rv0) *= dval(&rv0);
 #endif
-                if (bd0)
-                    goto retfree;
                 goto ret;
             }
             e1 >>= 4;
             for (j = 0; e1 > 1; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= bigtens[j];
+                    dval(&rv) *= bigtens[j];
         /* The last multiplication could overflow. */
-            word0(rv) -= P * Exp_msk1;
-            dval(rv) *= bigtens[j];
-            if ((z = word0(rv) & Exp_mask) > Exp_msk1 * (DBL_MAX_EXP + Bias - P))
+            word0(&rv) -= P * Exp_msk1;
+            dval(&rv) *= bigtens[j];
+            if ((z = word0(&rv) & Exp_mask) > Exp_msk1 * (DBL_MAX_EXP + Bias - P))
                 goto ovfl;
             if (z > Exp_msk1 * (DBL_MAX_EXP + Bias - 1 - P)) {
                 /* set to largest number */
                 /* (Can't trust DBL_MAX) */
-                word0(rv) = Big0;
-                word1(rv) = Big1;
+                word0(&rv) = Big0;
+                word1(&rv) = Big1;
             } else
-                word0(rv) += P * Exp_msk1;
+                word0(&rv) += P * Exp_msk1;
         }
     } else if (e1 < 0) {
         e1 = -e1;
         if ((i = e1 & 15))
-            dval(rv) /= tens[i];
+            dval(&rv) /= tens[i];
         if (e1 >>= 4) {
             if (e1 >= 1 << n_bigtens)
                 goto undfl;
@@ -1341,42 +1326,40 @@ ovfl:
                 scale = 2 * P;
             for (j = 0; e1 > 0; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= tinytens[j];
-            if (scale && (j = (2 * P) + 1 - ((word0(rv) & Exp_mask) >> Exp_shift)) > 0) {
+                    dval(&rv) *= tinytens[j];
+            if (scale && (j = (2 * P) + 1 - ((word0(&rv) & Exp_mask) >> Exp_shift)) > 0) {
                 /* scaled rv is denormal; zap j low bits */
                 if (j >= 32) {
-                    word1(rv) = 0;
+                    word1(&rv) = 0;
                     if (j >= 53)
-                       word0(rv) = (P + 2) * Exp_msk1;
+                       word0(&rv) = (P + 2) * Exp_msk1;
                     else
-                       word0(rv) &= 0xffffffff << j - 32;
+                       word0(&rv) &= 0xffffffff << (j - 32);
                 } else
-                    word1(rv) &= 0xffffffff << j;
+                    word1(&rv) &= 0xffffffff << j;
             }
 #else
             for (j = 0; e1 > 1; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= tinytens[j];
+                    dval(&rv) *= tinytens[j];
             /* The last multiplication could underflow. */
-            dval(rv0) = dval(rv);
-            dval(rv) *= tinytens[j];
-            if (!dval(rv)) {
-                dval(rv) = 2. * dval(rv0);
-                dval(rv) *= tinytens[j];
+            dval(&rv0) = dval(&rv);
+            dval(&rv) *= tinytens[j];
+            if (!dval(&rv)) {
+                dval(&rv) = 2. * dval(&rv0);
+                dval(&rv) *= tinytens[j];
 #endif
-                if (!dval(rv)) {
+                if (!dval(&rv)) {
 undfl:
-                    dval(rv) = 0.;
+                    dval(&rv) = 0.;
 #ifndef NO_ERRNO
                     errno = ERANGE;
 #endif
-                    if (bd0)
-                        goto retfree;
                     goto ret;
                 }
 #ifndef Avoid_Underflow
-                word0(rv) = Tiny0;
-                word1(rv) = Tiny1;
+                word0(&rv) = Tiny0;
+                word1(&rv) = Tiny1;
                 /* The refinement below will clean
                  * this approximation up.
                  */
@@ -1389,13 +1372,12 @@ undfl:
 
     /* Put digits into bd: true value = bd * 10^e */
 
-    bd0 = s2b(s0, nd0, nd, y);
+    s2b(bd0, s0, nd0, nd, y);
 
     for (;;) {
-        bd = Balloc(bd0->k);
-        Bcopy(bd, bd0);
-        bb = d2b(dval(rv), &bbe, &bbbits);    /* rv = bb * 2^bbe */
-        bs = i2b(1);
+        bd = bd0;
+        d2b(bb, &rv, &bbe, &bbbits);    /* rv = bb * 2^bbe */
+        i2b(bs, 1);
 
         if (e >= 0) {
             bb2 = bb5 = 0;
@@ -1442,33 +1424,31 @@ undfl:
             bs2 -= i;
         }
         if (bb5 > 0) {
-            bs = pow5mult(bs, bb5);
-            bb1 = mult(bs, bb);
-            Bfree(bb);
-            bb = bb1;
+            pow5mult(bs, bb5);
+            mult(bb, bs);
         }
         if (bb2 > 0)
-            bb = lshift(bb, bb2);
+            lshift(bb, bb2);
         if (bd5 > 0)
-            bd = pow5mult(bd, bd5);
+            pow5mult(bd, bd5);
         if (bd2 > 0)
-            bd = lshift(bd, bd2);
+            lshift(bd, bd2);
         if (bs2 > 0)
-            bs = lshift(bs, bs2);
-        delta = diff(bb, bd);
-        dsign = delta->sign;
-        delta->sign = 0;
+            lshift(bs, bs2);
+        diff(delta, bb, bd);
+        dsign = delta.sign;
+        delta.sign = 0;
         i = cmp(delta, bs);
 
         if (i < 0) {
             /* Error is less than half an ulp -- check for
              * special case of mantissa a power of two.
              */
-            if (dsign || word1(rv) || word0(rv) & Bndry_mask
+            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask
 #ifdef Avoid_Underflow
-             || (word0(rv) & Exp_mask) <= (2 * P + 1) * Exp_msk1
+             || (word0(&rv) & Exp_mask) <= (2 * P + 1) * Exp_msk1
 #else
-             || (word0(rv) & Exp_mask) <= Exp_msk1
+             || (word0(&rv) & Exp_mask) <= Exp_msk1
 #endif
                 ) {
 #ifdef SET_INEXACT
@@ -1477,14 +1457,14 @@ undfl:
 #endif
                 break;
             }
-            if (!delta->x[0] && delta->wds <= 1) {
+            if (!delta.x[0] && delta.wds <= 1) {
                 /* exact result */
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
                 break;
             }
-            delta = lshift(delta,Log2P);
+            lshift(delta, Log2P);
             if (cmp(delta, bs) > 0)
                 goto drop_down;
             break;
@@ -1492,26 +1472,26 @@ undfl:
         if (i == 0) {
             /* exactly half-way between */
             if (dsign) {
-                if ((word0(rv) & Bndry_mask1) == Bndry_mask1
-                 &&  word1(rv) == (
+                if ((word0(&rv) & Bndry_mask1) == Bndry_mask1
+                 &&  word1(&rv) == (
 #ifdef Avoid_Underflow
-            (scale && (y = word0(rv) & Exp_mask) <= 2 * P * Exp_msk1)
+            (scale && (y = word0(&rv) & Exp_mask) <= 2 * P * Exp_msk1)
         ? (0xffffffff & (0xffffffff << (2 * P + 1 - (y >> Exp_shift)))) :
 #endif
                            0xffffffff)) {
                     /*boundary case -- increment exponent*/
-                    word0(rv) = (word0(rv) & Exp_mask) + Exp_msk1;
-                    word1(rv) = 0;
+                    word0(&rv) = (word0(&rv) & Exp_mask) + Exp_msk1;
+                    word1(&rv) = 0;
 #ifdef Avoid_Underflow
                     dsign = 0;
 #endif
                     break;
                 }
-            } else if (!(word0(rv) & Bndry_mask) && !word1(rv)) {
+            } else if (!(word0(&rv) & Bndry_mask) && !word1(&rv)) {
 drop_down:
                 /* boundary case -- decrement exponent */
 #ifdef Sudden_Underflow /*{{*/
-                L = word0(rv) & Exp_mask;
+                L = word0(&rv) & Exp_mask;
 #ifdef Avoid_Underflow
                 if (L <= (scale ? (2 * P + 1) * Exp_msk1 : Exp_msk1))
 #else
@@ -1522,7 +1502,7 @@ drop_down:
 #else /*Sudden_Underflow}{*/
 #ifdef Avoid_Underflow
                 if (scale) {
-                    L = word0(rv) & Exp_mask;
+                    L = word0(&rv) & Exp_mask;
                     if (L <= (2 * P + 1) * Exp_msk1) {
                         if (L > (P + 2) * Exp_msk1)
                             /* round even ==> */
@@ -1533,20 +1513,20 @@ drop_down:
                     }
                 }
 #endif /*Avoid_Underflow*/
-                L = (word0(rv) & Exp_mask) - Exp_msk1;
+                L = (word0(&rv) & Exp_mask) - Exp_msk1;
 #endif /*Sudden_Underflow}}*/
-                word0(rv) = L | Bndry_mask1;
-                word1(rv) = 0xffffffff;
+                word0(&rv) = L | Bndry_mask1;
+                word1(&rv) = 0xffffffff;
                 break;
             }
-            if (!(word1(rv) & LSB))
+            if (!(word1(&rv) & LSB))
                 break;
             if (dsign)
-                dval(rv) += ulp(dval(rv));
+                dval(&rv) += ulp(&rv);
             else {
-                dval(rv) -= ulp(dval(rv));
+                dval(&rv) -= ulp(&rv);
 #ifndef Sudden_Underflow
-                if (!dval(rv))
+                if (!dval(&rv))
                     goto undfl;
 #endif
             }
@@ -1558,9 +1538,9 @@ drop_down:
         if ((aadj = ratio(delta, bs)) <= 2.) {
             if (dsign)
                 aadj = aadj1 = 1.;
-            else if (word1(rv) || word0(rv) & Bndry_mask) {
+            else if (word1(&rv) || word0(&rv) & Bndry_mask) {
 #ifndef Sudden_Underflow
-                if (word1(rv) == Tiny1 && !word0(rv))
+                if (word1(&rv) == Tiny1 && !word0(&rv))
                     goto undfl;
 #endif
                 aadj = 1.;
@@ -1592,23 +1572,23 @@ drop_down:
                 aadj1 += 0.5;
 #endif /*Check_FLT_ROUNDS*/
         }
-        y = word0(rv) & Exp_mask;
+        y = word0(&rv) & Exp_mask;
 
         /* Check for overflow */
 
         if (y == Exp_msk1 * (DBL_MAX_EXP + Bias - 1)) {
-            dval(rv0) = dval(rv);
-            word0(rv) -= P * Exp_msk1;
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
-            if ((word0(rv) & Exp_mask) >= Exp_msk1 * (DBL_MAX_EXP + Bias - P)) {
-                if (word0(rv0) == Big0 && word1(rv0) == Big1)
+            dval(&rv0) = dval(&rv);
+            word0(&rv) -= P * Exp_msk1;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
+            if ((word0(&rv) & Exp_mask) >= Exp_msk1 * (DBL_MAX_EXP + Bias - P)) {
+                if (word0(&rv0) == Big0 && word1(&rv0) == Big1)
                     goto ovfl;
-                word0(rv) = Big0;
-                word1(rv) = Big1;
+                word0(&rv) = Big0;
+                word1(&rv) = Big1;
                 goto cont;
             } else
-                word0(rv) += P * Exp_msk1;
+                word0(&rv) += P * Exp_msk1;
         } else {
 #ifdef Avoid_Underflow
             if (scale && y <= 2 * P * Exp_msk1) {
@@ -1618,30 +1598,32 @@ drop_down:
                     aadj = z;
                     aadj1 = dsign ? aadj : -aadj;
                 }
-                word0(aadj1) += (2 * P + 1) * Exp_msk1 - y;
+                dval(&aadj2) = aadj1;
+                word0(&aadj2) += (2 * P + 1) * Exp_msk1 - y;
+                aadj1 = dval(&aadj2);
             }
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
 #else
 #ifdef Sudden_Underflow
-            if ((word0(rv) & Exp_mask) <= P * Exp_msk1) {
-                dval(rv0) = dval(rv);
-                word0(rv) += P * Exp_msk1;
-                adj = aadj1 * ulp(dval(rv));
-                dval(rv) += adj;
-                if ((word0(rv) & Exp_mask) <= P * Exp_msk1)
+            if ((word0(&rv) & Exp_mask) <= P * Exp_msk1) {
+                dval(&rv0) = dval(&rv);
+                word0(&rv) += P * Exp_msk1;
+                adj.d = aadj1 * ulp(&rv);
+                dval(&rv) += adj.d;
+                if ((word0(&rv) & Exp_mask) <= P * Exp_msk1)
                 {
-                    if (word0(rv0) == Tiny0 && word1(rv0) == Tiny1)
+                    if (word0(&rv0) == Tiny0 && word1(&rv0) == Tiny1)
                         goto undfl;
-                    word0(rv) = Tiny0;
-                    word1(rv) = Tiny1;
+                    word0(&rv) = Tiny0;
+                    word1(&rv) = Tiny1;
                     goto cont;
                 }
                 else
-                    word0(rv) -= P * Exp_msk1;
+                    word0(&rv) -= P * Exp_msk1;
             } else {
-                adj = aadj1 * ulp(dval(rv));
-                dval(rv) += adj;
+                adj.d = aadj1 * ulp(&rv);
+                dval(&rv) += adj.d;
             }
 #else /*Sudden_Underflow*/
             /* Compute adj so that the IEEE rounding rules will
@@ -1656,12 +1638,12 @@ drop_down:
                 if (!dsign)
                     aadj1 = -aadj1;
             }
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
 #endif /*Sudden_Underflow*/
 #endif /*Avoid_Underflow*/
         }
-        z = word0(rv) & Exp_mask;
+        z = word0(&rv) & Exp_mask;
 #ifndef SET_INEXACT
 #ifdef Avoid_Underflow
         if (!scale)
@@ -1671,7 +1653,7 @@ drop_down:
             L = (int32_t)aadj;
             aadj -= L;
             /* The tolerances below are conservative. */
-            if (dsign || word1(rv) || word0(rv) & Bndry_mask) {
+            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask) {
                 if (aadj < .4999999 || aadj > .5000001)
                     break;
             } else if (aadj < .4999999 / FLT_RADIX)
@@ -1679,53 +1661,44 @@ drop_down:
         }
 #endif
 cont:
-        Bfree(bb);
-        Bfree(bd);
-        Bfree(bs);
-        Bfree(delta);
+        ;
     }
 #ifdef SET_INEXACT
     if (inexact) {
         if (!oldinexact) {
-            word0(rv0) = Exp_1 + (70 << Exp_shift);
-            word1(rv0) = 0;
-            dval(rv0) += 1.;
+            word0(&rv0) = Exp_1 + (70 << Exp_shift);
+            word1(&rv0) = 0;
+            dval(&rv0) += 1.;
         }
     } else if (!oldinexact)
         clear_inexact();
 #endif
 #ifdef Avoid_Underflow
     if (scale) {
-        word0(rv0) = Exp_1 - 2 * P * Exp_msk1;
-        word1(rv0) = 0;
-        dval(rv) *= dval(rv0);
+        word0(&rv0) = Exp_1 - 2 * P * Exp_msk1;
+        word1(&rv0) = 0;
+        dval(&rv) *= dval(&rv0);
 #ifndef NO_ERRNO
         /* try to avoid the bug of testing an 8087 register value */
-        if (word0(rv) == 0 && word1(rv) == 0)
+        if (word0(&rv) == 0 && word1(&rv) == 0)
             errno = ERANGE;
 #endif
     }
 #endif /* Avoid_Underflow */
 #ifdef SET_INEXACT
-    if (inexact && !(word0(rv) & Exp_mask)) {
+    if (inexact && !(word0(&rv) & Exp_mask)) {
         /* set underflow bit */
-        dval(rv0) = 1e-300;
-        dval(rv0) *= dval(rv0);
+        dval(&rv0) = 1e-300;
+        dval(&rv0) *= dval(&rv0);
     }
 #endif
-retfree:
-    Bfree(bb);
-    Bfree(bd);
-    Bfree(bs);
-    Bfree(bd0);
-    Bfree(delta);
 ret:
     if (se)
-        *se = (char*)s;
-    return sign ? -dval(rv) : dval(rv);
+        *se = const_cast<char*>(s);
+    return sign ? -dval(&rv) : dval(&rv);
 }
 
-static int quorem(Bigint* b, Bigint* S)
+static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
 {
     int n;
     uint32_t *bx, *bxe, q, *sx, *sxe;
@@ -1738,13 +1711,13 @@ static int quorem(Bigint* b, Bigint* S)
 #endif
 #endif
 
-    n = S->wds;
-    ASSERT_WITH_MESSAGE(b->wds <= n, "oversize b in quorem");
-    if (b->wds < n)
+    n = S.wds;
+    ASSERT_WITH_MESSAGE(b.wds <= n, "oversize b in quorem");
+    if (b.wds < n)
         return 0;
-    sx = S->x;
+    sx = S.x;
     sxe = sx + --n;
-    bx = b->x;
+    bx = b.x;
     bxe = bx + n;
     q = *bxe / (*sxe + 1);    /* ensure q <= true quotient */
     ASSERT_WITH_MESSAGE(q <= 9, "oversized quotient in quorem");
@@ -1779,18 +1752,18 @@ static int quorem(Bigint* b, Bigint* S)
 #endif
         } while (sx <= sxe);
         if (!*bxe) {
-            bx = b->x;
+            bx = b.x;
             while (--bxe > bx && !*bxe)
                 --n;
-            b->wds = n;
+            b.wds = n;
         }
     }
     if (cmp(b, S) >= 0) {
         q++;
         borrow = 0;
         carry = 0;
-        bx = b->x;
-        sx = S->x;
+        bx = b.x;
+        sx = S.x;
         do {
 #ifdef USE_LONG_LONG
             ys = *sx++ + carry;
@@ -1818,68 +1791,17 @@ static int quorem(Bigint* b, Bigint* S)
 #endif
 #endif
         } while (sx <= sxe);
-        bx = b->x;
+        bx = b.x;
         bxe = bx + n;
         if (!*bxe) {
             while (--bxe > bx && !*bxe)
                 --n;
-            b->wds = n;
+            b.wds = n;
         }
     }
     return q;
 }
 
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-static char* dtoa_result;
-#endif
-
-static char* rv_alloc(int i)
-{
-    int k;
-
-    int j = sizeof(uint32_t);
-    for (k = 0;
-        sizeof(Bigint) - sizeof(uint32_t) - sizeof(int) + j <= (unsigned)i;
-        j <<= 1)
-            k++;
-    int* r = (int*)Balloc(k);
-    *r = k;
-    return
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    dtoa_result =
-#endif
-        (char*)(r + 1);
-}
-
-static char* nrv_alloc(const char* s, char** rve, int n)
-{
-    char* rv = rv_alloc(n);
-    char* t = rv;
-
-    while ((*t = *s++))
-        t++;
-    if (rve)
-        *rve = t;
-    return rv;
-}
-
-/* freedtoa(s) must be used to free values s returned by dtoa
- * when MULTIPLE_THREADS is #defined.  It should be used in all cases,
- * but for consistency with earlier versions of dtoa, it is optional
- * when MULTIPLE_THREADS is not defined.
- */
-
-void freedtoa(char* s)
-{
-    Bigint* b = (Bigint*)((int*)s - 1);
-    b->maxwds = 1 << (b->k = *(int*)b);
-    Bfree(b);
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    if (s == dtoa_result)
-        dtoa_result = 0;
-#endif
-}
-
 /* dtoa for IEEE arithmetic (dmg): convert double to ASCII string.
  *
  * Inspired by "How to Print Floating-Point Numbers Accurately" by
@@ -1914,7 +1836,7 @@ void freedtoa(char* s)
  *       calculation.
  */
 
-char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
+void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rve)
 {
     /*
         Arguments ndigits, decpt, sign are similar to those
@@ -1933,38 +1855,37 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
     int denorm;
     uint32_t x;
 #endif
-    Bigint *b, *b1, *delta, *mlo = NULL, *mhi, *S;
-    double d2, ds, eps;
+    BigInt b, b1, delta, mlo, mhi, S;
+    U d2, eps, u;
+    double ds;
     char *s, *s0;
 #ifdef SET_INEXACT
     int inexact, oldinexact;
 #endif
 
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    if (dtoa_result) {
-        freedtoa(dtoa_result);
-        dtoa_result = 0;
-    }
-#endif
-
-    if (word0(d) & Sign_bit) {
+    u.d = dd;
+    if (word0(&u) & Sign_bit) {
         /* set sign for everything, including 0's and NaNs */
         *sign = 1;
-        word0(d) &= ~Sign_bit;    /* clear sign bit */
+        word0(&u) &= ~Sign_bit;    /* clear sign bit */
     } else
         *sign = 0;
 
-    if ((word0(d) & Exp_mask) == Exp_mask)
+    if ((word0(&u) & Exp_mask) == Exp_mask)
     {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(d) && !(word0(d) & 0xfffff))
-            return nrv_alloc("Infinity", rve, 8);
-        return nrv_alloc("NaN", rve, 3);
+        if (!word1(&u) && !(word0(&u) & 0xfffff))
+            strcpy(result, "Infinity");
+        else 
+            strcpy(result, "NaN");
+        return;
     }
-    if (!dval(d)) {
+    if (!dval(&u)) {
         *decpt = 1;
-        return nrv_alloc("0", rve, 1);
+        result[0] = '0';
+        result[1] = '\0';
+        return;
     }
 
 #ifdef SET_INEXACT
@@ -1972,15 +1893,15 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
     inexact = 1;
 #endif
 
-    b = d2b(dval(d), &be, &bbits);
+    d2b(b, &u, &be, &bbits);
 #ifdef Sudden_Underflow
-    i = (int)(word0(d) >> Exp_shift1 & (Exp_mask >> Exp_shift1));
+    i = (int)(word0(&u) >> Exp_shift1 & (Exp_mask >> Exp_shift1));
 #else
-    if ((i = (int)(word0(d) >> Exp_shift1 & (Exp_mask >> Exp_shift1)))) {
+    if ((i = (int)(word0(&u) >> Exp_shift1 & (Exp_mask >> Exp_shift1)))) {
 #endif
-        dval(d2) = dval(d);
-        word0(d2) &= Frac_mask1;
-        word0(d2) |= Exp_11;
+        dval(&d2) = dval(&u);
+        word0(&d2) &= Frac_mask1;
+        word0(&d2) |= Exp_11;
 
         /* log(x)    ~=~ log(1.5) + (x-1.5)/1.5
          * log10(x)     =  log(x) / log(10)
@@ -2011,21 +1932,21 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
         /* d is denormalized */
 
         i = bbits + be + (Bias + (P - 1) - 1);
-        x = i > 32  ? word0(d) << 64 - i | word1(d) >> i - 32
-                : word1(d) << 32 - i;
-        dval(d2) = x;
-        word0(d2) -= 31 * Exp_msk1; /* adjust exponent */
+        x = (i > 32) ? (word0(&u) << (64 - i)) | (word1(&u) >> (i - 32))
+                : word1(&u) << (32 - i);
+        dval(&d2) = x;
+        word0(&d2) -= 31 * Exp_msk1; /* adjust exponent */
         i -= (Bias + (P - 1) - 1) + 1;
         denorm = 1;
     }
 #endif
-    ds = (dval(d2) - 1.5) * 0.289529654602168 + 0.1760912590558 + (i * 0.301029995663981);
+    ds = (dval(&d2) - 1.5) * 0.289529654602168 + 0.1760912590558 + (i * 0.301029995663981);
     k = (int)ds;
     if (ds < 0. && ds != k)
         k--;    /* want k = floor(ds) */
     k_check = 1;
     if (k >= 0 && k <= Ten_pmax) {
-        if (dval(d) < tens[k])
+        if (dval(&u) < tens[k])
             k--;
         k_check = 0;
     }
@@ -2059,14 +1980,14 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
     ilim = ilim1 = -1;
     i = 18;
     ndigits = 0;
-    s = s0 = rv_alloc(i);
+    s = s0 = result;
 
     if (ilim >= 0 && ilim <= Quick_max && try_quick) {
 
         /* Try to get by with floating-point arithmetic. */
 
         i = 0;
-        dval(d2) = dval(d);
+        dval(&d2) = dval(&u);
         k0 = k;
         ilim0 = ilim;
         ieps = 2; /* conservative */
@@ -2076,7 +1997,7 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
             if (j & Bletch) {
                 /* prevent overflows */
                 j &= Bletch - 1;
-                dval(d) /= bigtens[n_bigtens - 1];
+                dval(&u) /= bigtens[n_bigtens - 1];
                 ieps++;
             }
             for (; j; j >>= 1, i++) {
@@ -2085,32 +2006,32 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
                     ds *= bigtens[i];
                 }
             }
-            dval(d) /= ds;
+            dval(&u) /= ds;
         } else if ((j1 = -k)) {
-            dval(d) *= tens[j1 & 0xf];
+            dval(&u) *= tens[j1 & 0xf];
             for (j = j1 >> 4; j; j >>= 1, i++) {
                 if (j & 1) {
                     ieps++;
-                    dval(d) *= bigtens[i];
+                    dval(&u) *= bigtens[i];
                 }
             }
         }
-        if (k_check && dval(d) < 1. && ilim > 0) {
+        if (k_check && dval(&u) < 1. && ilim > 0) {
             if (ilim1 <= 0)
                 goto fast_failed;
             ilim = ilim1;
             k--;
-            dval(d) *= 10.;
+            dval(&u) *= 10.;
             ieps++;
         }
-        dval(eps) = (ieps * dval(d)) + 7.;
-        word0(eps) -= (P - 1) * Exp_msk1;
+        dval(&eps) = (ieps * dval(&u)) + 7.;
+        word0(&eps) -= (P - 1) * Exp_msk1;
         if (ilim == 0) {
-            S = mhi = 0;
-            dval(d) -= 5.;
-            if (dval(d) > dval(eps))
+            S = mhi = BigInt();
+            dval(&u) -= 5.;
+            if (dval(&u) > dval(&eps))
                 goto one_digit;
-            if (dval(d) < -dval(eps))
+            if (dval(&u) < -dval(&eps))
                 goto no_digits;
             goto fast_failed;
         }
@@ -2119,36 +2040,36 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
             /* Use Steele & White method of only
              * generating digits needed.
              */
-            dval(eps) = (0.5 / tens[ilim - 1]) - dval(eps);
+            dval(&eps) = (0.5 / tens[ilim - 1]) - dval(&eps);
             for (i = 0;;) {
-                L = (long int)dval(d);
-                dval(d) -= L;
+                L = (long int)dval(&u);
+                dval(&u) -= L;
                 *s++ = '0' + (int)L;
-                if (dval(d) < dval(eps))
-                    goto ret1;
-                if (1. - dval(d) < dval(eps))
+                if (dval(&u) < dval(&eps))
+                    goto ret;
+                if (1. - dval(&u) < dval(&eps))
                     goto bump_up;
                 if (++i >= ilim)
                     break;
-                dval(eps) *= 10.;
-                dval(d) *= 10.;
+                dval(&eps) *= 10.;
+                dval(&u) *= 10.;
             }
         } else {
 #endif
             /* Generate ilim digits, then fix them up. */
-            dval(eps) *= tens[ilim - 1];
-            for (i = 1;; i++, dval(d) *= 10.) {
-                L = (int32_t)(dval(d));
-                if (!(dval(d) -= L))
+            dval(&eps) *= tens[ilim - 1];
+            for (i = 1;; i++, dval(&u) *= 10.) {
+                L = (int32_t)(dval(&u));
+                if (!(dval(&u) -= L))
                     ilim = i;
                 *s++ = '0' + (int)L;
                 if (i == ilim) {
-                    if (dval(d) > 0.5 + dval(eps))
+                    if (dval(&u) > 0.5 + dval(&eps))
                         goto bump_up;
-                    else if (dval(d) < 0.5 - dval(eps)) {
+                    else if (dval(&u) < 0.5 - dval(&eps)) {
                         while (*--s == '0') { }
                         s++;
-                        goto ret1;
+                        goto ret;
                     }
                     break;
                 }
@@ -2158,7 +2079,7 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
 #endif
 fast_failed:
         s = s0;
-        dval(d) = dval(d2);
+        dval(&u) = dval(&d2);
         k = k0;
         ilim = ilim0;
     }
@@ -2169,31 +2090,31 @@ fast_failed:
         /* Yes. */
         ds = tens[k];
         if (ndigits < 0 && ilim <= 0) {
-            S = mhi = 0;
-            if (ilim < 0 || dval(d) <= 5 * ds)
+            S = mhi = BigInt();
+            if (ilim < 0 || dval(&u) <= 5 * ds)
                 goto no_digits;
             goto one_digit;
         }
-        for (i = 1;; i++, dval(d) *= 10.) {
-            L = (int32_t)(dval(d) / ds);
-            dval(d) -= L * ds;
+        for (i = 1;; i++, dval(&u) *= 10.) {
+            L = (int32_t)(dval(&u) / ds);
+            dval(&u) -= L * ds;
 #ifdef Check_FLT_ROUNDS
             /* If FLT_ROUNDS == 2, L will usually be high by 1 */
-            if (dval(d) < 0) {
+            if (dval(&u) < 0) {
                 L--;
-                dval(d) += ds;
+                dval(&u) += ds;
             }
 #endif
             *s++ = '0' + (int)L;
-            if (!dval(d)) {
+            if (!dval(&u)) {
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
                 break;
             }
             if (i == ilim) {
-                dval(d) += dval(d);
-                if (dval(d) > ds || dval(d) == ds && L & 1) {
+                dval(&u) += dval(&u);
+                if (dval(&u) > ds || (dval(&u) == ds && (L & 1))) {
 bump_up:
                     while (*--s == '9')
                         if (s == s0) {
@@ -2206,12 +2127,12 @@ bump_up:
                 break;
             }
         }
-        goto ret1;
+        goto ret;
     }
 
     m2 = b2;
     m5 = b5;
-    mhi = mlo = 0;
+    mhi = mlo = BigInt();
     if (leftright) {
         i =
 #ifndef Sudden_Underflow
@@ -2220,7 +2141,7 @@ bump_up:
             1 + P - bbits;
         b2 += i;
         s2 += i;
-        mhi = i2b(1);
+        i2b(mhi, 1);
     }
     if (m2 > 0 && s2 > 0) {
         i = m2 < s2 ? m2 : s2;
@@ -2231,26 +2152,24 @@ bump_up:
     if (b5 > 0) {
         if (leftright) {
             if (m5 > 0) {
-                mhi = pow5mult(mhi, m5);
-                b1 = mult(mhi, b);
-                Bfree(b);
-                b = b1;
+                pow5mult(mhi, m5);
+                mult(b, mhi);
             }
             if ((j = b5 - m5))
-                b = pow5mult(b, j);
+                pow5mult(b, j);
         } else
-            b = pow5mult(b, b5);
+            pow5mult(b, b5);
         }
-    S = i2b(1);
+    i2b(S, 1);
     if (s5 > 0)
-        S = pow5mult(S, s5);
+        pow5mult(S, s5);
 
     /* Check for special case that d is a normalized power of 2. */
 
     spec_case = 0;
-    if (!word1(d) && !(word0(d) & Bndry_mask)
+    if (!word1(&u) && !(word0(&u) & Bndry_mask)
 #ifndef Sudden_Underflow
-     && word0(d) & (Exp_mask & ~Exp_msk1)
+     && word0(&u) & (Exp_mask & ~Exp_msk1)
 #endif
             ) {
         /* The special case */
@@ -2267,10 +2186,10 @@ bump_up:
      * can do shifts and ors to compute the numerator for q.
      */
 #ifdef Pack_32
-    if ((i = ((s5 ? 32 - hi0bits(S->x[S->wds - 1]) : 1) + s2) & 0x1f))
+    if ((i = ((s5 ? 32 - hi0bits(S.x[S.wds - 1]) : 1) + s2) & 0x1f))
         i = 32 - i;
 #else
-    if ((i = ((s5 ? 32 - hi0bits(S->x[S->wds - 1]) : 1) + s2) & 0xf))
+    if ((i = ((s5 ? 32 - hi0bits(S.x[S.wds - 1]) : 1) + s2) & 0xf))
         i = 16 - i;
 #endif
     if (i > 4) {
@@ -2285,22 +2204,22 @@ bump_up:
         s2 += i;
     }
     if (b2 > 0)
-        b = lshift(b, b2);
+        lshift(b, b2);
     if (s2 > 0)
-        S = lshift(S, s2);
+        lshift(S, s2);
     if (k_check) {
         if (cmp(b,S) < 0) {
             k--;
-            b = multadd(b, 10, 0);    /* we botched the k estimate */
+            multadd(b, 10, 0);    /* we botched the k estimate */
             if (leftright)
-                mhi = multadd(mhi, 10, 0);
+                multadd(mhi, 10, 0);
             ilim = ilim1;
         }
     }
 
     if (leftright) {
         if (m2 > 0)
-            mhi = lshift(mhi, m2);
+            lshift(mhi, m2);
 
         /* Compute mlo -- check for special case
          * that d is a normalized power of 2.
@@ -2308,9 +2227,8 @@ bump_up:
 
         mlo = mhi;
         if (spec_case) {
-            mhi = Balloc(mhi->k);
-            Bcopy(mhi, mlo);
-            mhi = lshift(mhi, Log2P);
+            mhi = mlo;
+            lshift(mhi, Log2P);
         }
 
         for (i = 1;;i++) {
@@ -2319,10 +2237,9 @@ bump_up:
              * that will round to d?
              */
             j = cmp(b, mlo);
-            delta = diff(S, mhi);
-            j1 = delta->sign ? 1 : cmp(b, delta);
-            Bfree(delta);
-            if (j1 == 0 && !(word1(d) & 1)) {
+            diff(delta, S, mhi);
+            j1 = delta.sign ? 1 : cmp(b, delta);
+            if (j1 == 0 && !(word1(&u) & 1)) {
                 if (dig == '9')
                     goto round_9_up;
                 if (j > 0)
@@ -2334,17 +2251,17 @@ bump_up:
                 *s++ = dig;
                 goto ret;
             }
-            if (j < 0 || j == 0 && !(word1(d) & 1)) {
-                if (!b->x[0] && b->wds <= 1) {
+            if (j < 0 || (j == 0 && !(word1(&u) & 1))) {
+                if (!b.x[0] && b.wds <= 1) {
 #ifdef SET_INEXACT
                     inexact = 0;
 #endif
                     goto accept_dig;
                 }
                 if (j1 > 0) {
-                    b = lshift(b, 1);
+                    lshift(b, 1);
                     j1 = cmp(b, S);
-                    if ((j1 > 0 || j1 == 0 && dig & 1) && dig++ == '9')
+                    if ((j1 > 0 || (j1 == 0 && (dig & 1))) && dig++ == '9')
                         goto round_9_up;
                 }
 accept_dig:
@@ -2363,18 +2280,14 @@ round_9_up:
             *s++ = dig;
             if (i == ilim)
                 break;
-            b = multadd(b, 10, 0);
-            if (mlo == mhi)
-                mlo = mhi = multadd(mhi, 10, 0);
-            else {
-                mlo = multadd(mlo, 10, 0);
-                mhi = multadd(mhi, 10, 0);
-            }
+            multadd(b, 10, 0);
+            multadd(mlo, 10, 0);
+            multadd(mhi, 10, 0);
         }
     } else
         for (i = 1;; i++) {
             *s++ = dig = quorem(b,S) + '0';
-            if (!b->x[0] && b->wds <= 1) {
+            if (!b.x[0] && b.wds <= 1) {
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
@@ -2382,14 +2295,14 @@ round_9_up:
             }
             if (i >= ilim)
                 break;
-            b = multadd(b, 10, 0);
+            multadd(b, 10, 0);
         }
 
     /* Round off last digit */
 
-    b = lshift(b, 1);
+    lshift(b, 1);
     j = cmp(b, S);
-    if (j > 0 || j == 0 && dig & 1) {
+    if (j > 0 || (j == 0 && (dig & 1))) {
 roundoff:
         while (*--s == '9')
             if (s == s0) {
@@ -2411,29 +2324,20 @@ one_digit:
     k++;
     goto ret;
 ret:
-    Bfree(S);
-    if (mhi) {
-        if (mlo && mlo != mhi)
-            Bfree(mlo);
-        Bfree(mhi);
-    }
-ret1:
 #ifdef SET_INEXACT
     if (inexact) {
         if (!oldinexact) {
-            word0(d) = Exp_1 + (70 << Exp_shift);
-            word1(d) = 0;
-            dval(d) += 1.;
+            word0(&u) = Exp_1 + (70 << Exp_shift);
+            word1(&u) = 0;
+            dval(&u) += 1.;
         }
     } else if (!oldinexact)
         clear_inexact();
 #endif
-    Bfree(b);
     *s = 0;
     *decpt = k + 1;
     if (rve)
         *rve = s;
-    return s0;
 }
 
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
index ed858c0680..cbec7c7182 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
@@ -30,8 +30,7 @@ namespace WTF {
     extern WTF::Mutex* s_dtoaP5Mutex;
 
     double strtod(const char* s00, char** se);
-    char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve);
-    void freedtoa(char* s);
+    void dtoa(char* result, double d, int ndigits, int* decpt, int* sign, char** rve);
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
index 1914600a81..7b2d0f25a8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
@@ -58,12 +58,15 @@ void MainThreadInvoker::dispatch()
 
 Q_GLOBAL_STATIC(MainThreadInvoker, webkit_main_thread_invoker)
 
+void initializeMainThreadPlatform()
+{
+}
 
 void scheduleDispatchFunctionsOnMainThread()
 {
     QMetaObject::invokeMethod(webkit_main_thread_invoker(), "dispatch", Qt::QueuedConnection);
 }
 
-}
+} // namespace WTF
 
 #include "MainThreadQt.moc"
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
index 1a40d5287a..1fdd2bbb9c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "Threading.h"
 
+#include "CurrentTime.h"
 #include "HashMap.h"
 #include "MainThread.h"
 #include "RandomNumberSeed.h"
@@ -161,6 +162,10 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     return establishIdentifierForThread(threadRef);
 }
 
+void setThreadNameInternal(const char*)
+{
+}
+
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 {
     ASSERT(threadID);
@@ -233,15 +238,22 @@ void ThreadCondition::wait(Mutex& mutex)
     m_condition->wait(mutex.impl());
 }
 
-bool ThreadCondition::timedWait(Mutex& mutex, double secondsToWait)
+bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
 {
-    if (secondsToWait < 0.0) {
+    double currentTime = WTF::currentTime();
+
+    // Time is in the past - return immediately.
+    if (absoluteTime < currentTime)
+        return false;
+
+    // Time is too far in the future (and would overflow unsigned long) - wait forever.
+    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0) {
         wait(mutex);
         return true;
     }
 
-    unsigned long millisecondsToWait = static_cast<unsigned long>(secondsToWait * 1000.0);
-    return m_condition->wait(mutex.impl(), millisecondsToWait);
+    double intervalMilliseconds = (absoluteTime - currentTime) * 1000.0;
+    return m_condition->wait(mutex.impl(), static_cast<unsigned long>(intervalMilliseconds));
 }
 
 void ThreadCondition::signal()
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
index 5b849e4d50..f86a9b7c39 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
@@ -28,10 +28,12 @@
 #include "qt4/UnicodeQt4.h"
 #elif USE(ICU_UNICODE)
 #include <wtf/unicode/icu/UnicodeIcu.h>
+#elif USE(GLIB_UNICODE)
+#include <wtf/unicode/glib/UnicodeGLib.h>
 #else
 #error "Unknown Unicode implementation"
 #endif
 
-COMPILE_ASSERT(sizeof(UChar) == 2, UCharIsTwoBytes)
+COMPILE_ASSERT(sizeof(UChar) == 2, UCharIsTwoBytes);
 
 #endif // WTF_UNICODE_H
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
new file mode 100644
index 0000000000..a779b36809
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
@@ -0,0 +1,214 @@
+/*
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "UnicodeGLib.h"
+
+namespace WTF {
+namespace Unicode {
+
+UChar32 foldCase(UChar32 ch)
+{
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8char;
+    utf8char.set(g_ucs4_to_utf8(reinterpret_cast<gunichar*>(&ch), 1, 0, 0, &gerror.outPtr()));
+    if (gerror)
+        return ch;
+
+    GOwnPtr<char> utf8caseFolded;
+    utf8caseFolded.set(g_utf8_casefold(utf8char.get(), -1));
+
+    GOwnPtr<gunichar> ucs4Result;
+    ucs4Result.set(g_utf8_to_ucs4_fast(utf8caseFolded.get(), -1, 0));
+
+    return *ucs4Result;
+}
+
+int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_casefold(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+int toLower(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_strdown(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_strup(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+Direction direction(UChar32 c)
+{
+    PangoBidiType type = pango_bidi_type_for_unichar(c);
+    switch (type) {
+    case PANGO_BIDI_TYPE_L:
+        return LeftToRight;
+    case PANGO_BIDI_TYPE_R:
+        return RightToLeft;
+    case PANGO_BIDI_TYPE_AL:
+        return RightToLeftArabic;
+    case PANGO_BIDI_TYPE_LRE:
+        return LeftToRightEmbedding;
+    case PANGO_BIDI_TYPE_RLE:
+        return RightToLeftEmbedding;
+    case PANGO_BIDI_TYPE_LRO:
+        return LeftToRightOverride;
+    case PANGO_BIDI_TYPE_RLO:
+        return RightToLeftOverride;
+    case PANGO_BIDI_TYPE_PDF:
+        return PopDirectionalFormat;
+    case PANGO_BIDI_TYPE_EN:
+        return EuropeanNumber;
+    case PANGO_BIDI_TYPE_AN:
+        return ArabicNumber;
+    case PANGO_BIDI_TYPE_ES:
+        return EuropeanNumberSeparator;
+    case PANGO_BIDI_TYPE_ET:
+        return EuropeanNumberTerminator;
+    case PANGO_BIDI_TYPE_CS:
+        return CommonNumberSeparator;
+    case PANGO_BIDI_TYPE_NSM:
+        return NonSpacingMark;
+    case PANGO_BIDI_TYPE_BN:
+        return BoundaryNeutral;
+    case PANGO_BIDI_TYPE_B:
+        return BlockSeparator;
+    case PANGO_BIDI_TYPE_S:
+        return SegmentSeparator;
+    case PANGO_BIDI_TYPE_WS:
+        return WhiteSpaceNeutral;
+    default:
+        return OtherNeutral;
+    }
+}
+
+int umemcasecmp(const UChar* a, const UChar* b, int len)
+{
+    GOwnPtr<char> utf8a;
+    GOwnPtr<char> utf8b;
+
+    utf8a.set(g_utf16_to_utf8(a, len, 0, 0, 0));
+    utf8b.set(g_utf16_to_utf8(b, len, 0, 0, 0));
+
+    GOwnPtr<char> foldedA;
+    GOwnPtr<char> foldedB;
+
+    foldedA.set(g_utf8_casefold(utf8a.get(), -1));
+    foldedB.set(g_utf8_casefold(utf8b.get(), -1));
+
+    // FIXME: umemcasecmp needs to mimic u_memcasecmp of icu
+    // from the ICU docs:
+    // "Compare two strings case-insensitively using full case folding.
+    // his is equivalent to u_strcmp(u_strFoldCase(s1, n, options), u_strFoldCase(s2, n, options))."
+    //
+    // So it looks like we don't need the full g_utf8_collate here,
+    // but really a bitwise comparison of casefolded unicode chars (not utf-8 bytes).
+    // As there is no direct equivalent to this icu function in GLib, for now
+    // we'll use g_utf8_collate():
+
+    return g_utf8_collate(foldedA.get(), foldedB.get());
+}
+
+}
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
new file mode 100644
index 0000000000..c03d3ec3b1
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -0,0 +1,238 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UnicodeGLib_h
+#define UnicodeGLib_h
+
+#include "UnicodeMacrosFromICU.h"
+#include <wtf/GOwnPtr.h>
+
+#include <glib.h>
+#include <pango/pango.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef uint16_t UChar;
+typedef int32_t UChar32;
+
+namespace WTF {
+namespace Unicode {
+
+enum Direction {
+    LeftToRight,
+    RightToLeft,
+    EuropeanNumber,
+    EuropeanNumberSeparator,
+    EuropeanNumberTerminator,
+    ArabicNumber,
+    CommonNumberSeparator,
+    BlockSeparator,
+    SegmentSeparator,
+    WhiteSpaceNeutral,
+    OtherNeutral,
+    LeftToRightEmbedding,
+    LeftToRightOverride,
+    RightToLeftArabic,
+    RightToLeftEmbedding,
+    RightToLeftOverride,
+    PopDirectionalFormat,
+    NonSpacingMark,
+    BoundaryNeutral
+};
+
+enum DecompositionType {
+    DecompositionNone,
+    DecompositionCanonical,
+    DecompositionCompat,
+    DecompositionCircle,
+    DecompositionFinal,
+    DecompositionFont,
+    DecompositionFraction,
+    DecompositionInitial,
+    DecompositionIsolated,
+    DecompositionMedial,
+    DecompositionNarrow,
+    DecompositionNoBreak,
+    DecompositionSmall,
+    DecompositionSquare,
+    DecompositionSub,
+    DecompositionSuper,
+    DecompositionVertical,
+    DecompositionWide,
+};
+
+enum CharCategory {
+    NoCategory =  0,
+    Other_NotAssigned = U_MASK(G_UNICODE_UNASSIGNED),
+    Letter_Uppercase = U_MASK(G_UNICODE_UPPERCASE_LETTER),
+    Letter_Lowercase = U_MASK(G_UNICODE_LOWERCASE_LETTER),
+    Letter_Titlecase = U_MASK(G_UNICODE_TITLECASE_LETTER),
+    Letter_Modifier = U_MASK(G_UNICODE_MODIFIER_LETTER),
+    Letter_Other = U_MASK(G_UNICODE_OTHER_LETTER),
+
+    Mark_NonSpacing = U_MASK(G_UNICODE_NON_SPACING_MARK),
+    Mark_Enclosing = U_MASK(G_UNICODE_ENCLOSING_MARK),
+    Mark_SpacingCombining = U_MASK(G_UNICODE_COMBINING_MARK),
+
+    Number_DecimalDigit = U_MASK(G_UNICODE_DECIMAL_NUMBER),
+    Number_Letter = U_MASK(G_UNICODE_LETTER_NUMBER),
+    Number_Other = U_MASK(G_UNICODE_OTHER_NUMBER),
+
+    Separator_Space = U_MASK(G_UNICODE_SPACE_SEPARATOR),
+    Separator_Line = U_MASK(G_UNICODE_LINE_SEPARATOR),
+    Separator_Paragraph = U_MASK(G_UNICODE_PARAGRAPH_SEPARATOR),
+
+    Other_Control = U_MASK(G_UNICODE_CONTROL),
+    Other_Format = U_MASK(G_UNICODE_FORMAT),
+    Other_PrivateUse = U_MASK(G_UNICODE_PRIVATE_USE),
+    Other_Surrogate = U_MASK(G_UNICODE_SURROGATE),
+
+    Punctuation_Dash = U_MASK(G_UNICODE_DASH_PUNCTUATION),
+    Punctuation_Open = U_MASK(G_UNICODE_OPEN_PUNCTUATION),
+    Punctuation_Close = U_MASK(G_UNICODE_CLOSE_PUNCTUATION),
+    Punctuation_Connector = U_MASK(G_UNICODE_CONNECT_PUNCTUATION),
+    Punctuation_Other = U_MASK(G_UNICODE_OTHER_PUNCTUATION),
+
+    Symbol_Math = U_MASK(G_UNICODE_MATH_SYMBOL),
+    Symbol_Currency = U_MASK(G_UNICODE_CURRENCY_SYMBOL),
+    Symbol_Modifier = U_MASK(G_UNICODE_MODIFIER_SYMBOL),
+    Symbol_Other = U_MASK(G_UNICODE_OTHER_SYMBOL),
+
+    Punctuation_InitialQuote = U_MASK(G_UNICODE_INITIAL_PUNCTUATION),
+    Punctuation_FinalQuote = U_MASK(G_UNICODE_FINAL_PUNCTUATION)
+};
+
+UChar32 foldCase(UChar32);
+
+int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+int toLower(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+inline UChar32 toLower(UChar32 c)
+{
+    return g_unichar_tolower(c);
+}
+
+inline UChar32 toUpper(UChar32 c)
+{
+    return g_unichar_toupper(c);
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+inline UChar32 toTitleCase(UChar32 c)
+{
+    return g_unichar_totitle(c);
+}
+
+inline bool isArabicChar(UChar32 c)
+{
+    return c >= 0x0600 && c <= 0x06FF;
+}
+
+inline bool isFormatChar(UChar32 c)
+{
+    return g_unichar_type(c) == G_UNICODE_FORMAT;
+}
+
+inline bool isSeparatorSpace(UChar32 c)
+{
+    return g_unichar_type(c) == G_UNICODE_SPACE_SEPARATOR;
+}
+
+inline bool isPrintableChar(UChar32 c)
+{
+    return g_unichar_isprint(c);
+}
+
+inline bool isDigit(UChar32 c)
+{
+    return g_unichar_isdigit(c);
+}
+
+inline bool isPunct(UChar32 c)
+{
+    return g_unichar_ispunct(c);
+}
+
+inline bool hasLineBreakingPropertyComplexContext(UChar32 c)
+{
+    // FIXME
+    return false;
+}
+
+inline bool hasLineBreakingPropertyComplexContextOrIdeographic(UChar32 c)
+{
+    // FIXME
+    return false;
+}
+
+inline UChar32 mirroredChar(UChar32 c)
+{
+    gunichar mirror = 0;
+    g_unichar_get_mirror_char(c, &mirror);
+    return mirror;
+}
+
+inline CharCategory category(UChar32 c)
+{
+    if (c > 0xffff)
+        return NoCategory;
+
+    return (CharCategory) U_MASK(g_unichar_type(c));
+}
+
+Direction direction(UChar32);
+
+inline bool isLower(UChar32 c)
+{
+    return g_unichar_islower(c);
+}
+
+inline int digitValue(UChar32 c)
+{
+    return g_unichar_digit_value(c);
+}
+
+inline uint8_t combiningClass(UChar32 c)
+{
+    // FIXME
+    // return g_unichar_combining_class(c);
+    return 0;
+}
+
+inline DecompositionType decompositionType(UChar32 c)
+{
+    // FIXME
+    return DecompositionNone;
+}
+
+int umemcasecmp(const UChar*, const UChar*, int len);
+
+}
+}
+
+#endif
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
new file mode 100644
index 0000000000..5d3eca6873
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
@@ -0,0 +1,69 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UnicodeMacrosFromICU_h
+#define UnicodeMacrosFromICU_h
+
+// some defines from ICU
+
+#define U16_IS_LEAD(c) (((c)&0xfffffc00)==0xd800)
+#define U16_IS_TRAIL(c) (((c)&0xfffffc00)==0xdc00)
+#define U16_SURROGATE_OFFSET ((0xd800<<10UL)+0xdc00-0x10000)
+#define U16_GET_SUPPLEMENTARY(lead, trail) \
+    (((UChar32)(lead)<<10UL)+(UChar32)(trail)-U16_SURROGATE_OFFSET)
+
+#define U16_LEAD(supplementary) (UChar)(((supplementary)>>10)+0xd7c0)
+#define U16_TRAIL(supplementary) (UChar)(((supplementary)&0x3ff)|0xdc00)
+
+#define U_IS_SURROGATE(c) (((c)&0xfffff800)==0xd800)
+#define U16_IS_SINGLE(c) !U_IS_SURROGATE(c)
+#define U16_IS_SURROGATE(c) U_IS_SURROGATE(c)
+#define U16_IS_SURROGATE_LEAD(c) (((c)&0x400)==0)
+
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
+#define U16_NEXT(s, i, length, c) { \
+    (c)=(s)[(i)++]; \
+    if(U16_IS_LEAD(c)) { \
+        uint16_t __c2; \
+        if((i)<(length) && U16_IS_TRAIL(__c2=(s)[(i)])) { \
+            ++(i); \
+            (c)=U16_GET_SUPPLEMENTARY((c), __c2); \
+        } \
+    } \
+}
+
+#define U_MASK(x) ((uint32_t)1<<(x))
+
+#endif
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
index 608aea69d7..35c6fbfd7b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
@@ -179,6 +179,17 @@ inline bool isPunct(UChar32 c)
     return !!u_ispunct(c);
 }
 
+inline bool hasLineBreakingPropertyComplexContext(UChar32 c)
+{
+    return u_getIntPropertyValue(c, UCHAR_LINE_BREAK) == U_LB_COMPLEX_CONTEXT;
+}
+
+inline bool hasLineBreakingPropertyComplexContextOrIdeographic(UChar32 c)
+{
+    int32_t prop = u_getIntPropertyValue(c, UCHAR_LINE_BREAK);
+    return prop == U_LB_COMPLEX_CONTEXT || prop == U_LB_IDEOGRAPHIC;
+}
+
 inline UChar32 mirroredChar(UChar32 c)
 {
     return u_charMirror(c);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index d7d78ce330..1531694432 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -92,6 +92,17 @@ typedef uint32_t UChar32;
     } \
 }
 
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
 #define U_MASK(x) ((uint32_t)1<<(x))
 
 namespace WTF {
@@ -352,6 +363,12 @@ inline bool isLower(UChar32 c)
     return QChar::category(c) == QChar::Letter_Lowercase;
 }
 
+inline bool hasLineBreakingPropertyComplexContext(UChar32)
+{
+    // FIXME: Implement this to return whether the character has line breaking property SA (Complex Context).
+    return false;
+}
+
 inline UChar32 mirroredChar(UChar32 c)
 {
     return QChar::mirroredChar(c);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
new file mode 100644
index 0000000000..c7b3c8119f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
@@ -0,0 +1,728 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexCompiler.h"
+
+#include "RegexInterpreter.h"
+#include "RegexPattern.h"
+#include <wtf/Vector.h>
+
+#if ENABLE(YARR)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+class CharacterClassConstructor {
+public:
+    CharacterClassConstructor(bool isCaseInsensitive = false)
+        : m_isCaseInsensitive(isCaseInsensitive)
+    {
+    }
+    
+    void reset()
+    {
+        m_matches.clear();
+        m_ranges.clear();
+        m_matchesUnicode.clear();
+        m_rangesUnicode.clear();
+    }
+
+    void append(const CharacterClass* other)
+    {
+        for (size_t i = 0; i < other->m_matches.size(); ++i)
+            addSorted(m_matches, other->m_matches[i]);
+        for (size_t i = 0; i < other->m_ranges.size(); ++i)
+            addSortedRange(m_ranges, other->m_ranges[i].begin, other->m_ranges[i].end);
+        for (size_t i = 0; i < other->m_matchesUnicode.size(); ++i)
+            addSorted(m_matchesUnicode, other->m_matchesUnicode[i]);
+        for (size_t i = 0; i < other->m_rangesUnicode.size(); ++i)
+            addSortedRange(m_rangesUnicode, other->m_rangesUnicode[i].begin, other->m_rangesUnicode[i].end);
+    }
+
+    void putChar(UChar ch)
+    {
+        if (ch <= 0x7f) {
+            if (m_isCaseInsensitive && isASCIIAlpha(ch)) {
+                addSorted(m_matches, toASCIIUpper(ch));
+                addSorted(m_matches, toASCIILower(ch));
+            } else
+                addSorted(m_matches, ch);
+        } else {
+            UChar upper, lower;
+            if (m_isCaseInsensitive && ((upper = Unicode::toUpper(ch)) != (lower = Unicode::toLower(ch)))) {
+                addSorted(m_matchesUnicode, upper);
+                addSorted(m_matchesUnicode, lower);
+            } else
+                addSorted(m_matchesUnicode, ch);
+        }
+    }
+
+    // returns true if this character has another case, and 'ch' is the upper case form.
+    static inline bool isUnicodeUpper(UChar ch)
+    {
+        return ch != Unicode::toLower(ch);
+    }
+
+    // returns true if this character has another case, and 'ch' is the lower case form.
+    static inline bool isUnicodeLower(UChar ch)
+    {
+        return ch != Unicode::toUpper(ch);
+    }
+
+    void putRange(UChar lo, UChar hi)
+    {
+        if (lo <= 0x7f) {
+            char asciiLo = lo;
+            char asciiHi = std::min(hi, (UChar)0x7f);
+            addSortedRange(m_ranges, lo, asciiHi);
+            
+            if (m_isCaseInsensitive) {
+                if ((asciiLo <= 'Z') && (asciiHi >= 'A'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'A')+('a'-'A'), std::min(asciiHi, 'Z')+('a'-'A'));
+                if ((asciiLo <= 'z') && (asciiHi >= 'a'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'a')+('A'-'a'), std::min(asciiHi, 'z')+('A'-'a'));
+            }
+        }
+        if (hi >= 0x80) {
+            uint32_t unicodeCurr = std::max(lo, (UChar)0x80);
+            addSortedRange(m_rangesUnicode, unicodeCurr, hi);
+            
+            if (m_isCaseInsensitive) {
+                while (unicodeCurr <= hi) {
+                    // If the upper bound of the range (hi) is 0xffff, the increments to
+                    // unicodeCurr in this loop may take it to 0x10000.  This is fine
+                    // (if so we won't re-enter the loop, since the loop condition above
+                    // will definitely fail) - but this does mean we cannot use a UChar
+                    // to represent unicodeCurr, we must use a 32-bit value instead.
+                    ASSERT(unicodeCurr <= 0xffff);
+
+                    if (isUnicodeUpper(unicodeCurr)) {
+                        UChar lowerCaseRangeBegin = Unicode::toLower(unicodeCurr);
+                        UChar lowerCaseRangeEnd = lowerCaseRangeBegin;
+                        while ((++unicodeCurr <= hi) && isUnicodeUpper(unicodeCurr) && (Unicode::toLower(unicodeCurr) == (lowerCaseRangeEnd + 1)))
+                            lowerCaseRangeEnd++;
+                        addSortedRange(m_rangesUnicode, lowerCaseRangeBegin, lowerCaseRangeEnd);
+                    } else if (isUnicodeLower(unicodeCurr)) {
+                        UChar upperCaseRangeBegin = Unicode::toUpper(unicodeCurr);
+                        UChar upperCaseRangeEnd = upperCaseRangeBegin;
+                        while ((++unicodeCurr <= hi) && isUnicodeLower(unicodeCurr) && (Unicode::toUpper(unicodeCurr) == (upperCaseRangeEnd + 1)))
+                            upperCaseRangeEnd++;
+                        addSortedRange(m_rangesUnicode, upperCaseRangeBegin, upperCaseRangeEnd);
+                    } else
+                        ++unicodeCurr;
+                }
+            }
+        }
+    }
+
+    CharacterClass* charClass()
+    {
+        CharacterClass* characterClass = new CharacterClass();
+
+        characterClass->m_matches.append(m_matches);
+        characterClass->m_ranges.append(m_ranges);
+        characterClass->m_matchesUnicode.append(m_matchesUnicode);
+        characterClass->m_rangesUnicode.append(m_rangesUnicode);
+
+        reset();
+
+        return characterClass;
+    }
+
+private:
+    void addSorted(Vector<UChar>& matches, UChar ch)
+    {
+        unsigned pos = 0;
+        unsigned range = matches.size();
+
+        // binary chop, find position to insert char.
+        while (range) {
+            unsigned index = range >> 1;
+
+            int val = matches[pos+index] - ch;
+            if (!val)
+                return;
+            else if (val > 0)
+                range = index;
+            else {
+                pos += (index+1);
+                range -= (index+1);
+            }
+        }
+        
+        if (pos == matches.size())
+            matches.append(ch);
+        else
+            matches.insert(pos, ch);
+    }
+
+    void addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi)
+    {
+        unsigned end = ranges.size();
+        
+        // Simple linear scan - I doubt there are that many ranges anyway...
+        // feel free to fix this with something faster (eg binary chop).
+        for (unsigned i = 0; i < end; ++i) {
+            // does the new range fall before the current position in the array
+            if (hi < ranges[i].begin) {
+                // optional optimization: concatenate appending ranges? - may not be worthwhile.
+                if (hi == (ranges[i].begin - 1)) {
+                    ranges[i].begin = lo;
+                    return;
+                }
+                ranges.insert(i, CharacterRange(lo, hi));
+                return;
+            }
+            // Okay, since we didn't hit the last case, the end of the new range is definitely at or after the begining
+            // If the new range start at or before the end of the last range, then the overlap (if it starts one after the
+            // end of the last range they concatenate, which is just as good.
+            if (lo <= (ranges[i].end + 1)) {
+                // found an intersect! we'll replace this entry in the array.
+                ranges[i].begin = std::min(ranges[i].begin, lo);
+                ranges[i].end = std::max(ranges[i].end, hi);
+
+                // now check if the new range can subsume any subsequent ranges.
+                unsigned next = i+1;
+                // each iteration of the loop we will either remove something from the list, or break the loop.
+                while (next < ranges.size()) {
+                    if (ranges[next].begin <= (ranges[i].end + 1)) {
+                        // the next entry now overlaps / concatenates this one.
+                        ranges[i].end = std::max(ranges[i].end, ranges[next].end);
+                        ranges.remove(next);
+                    } else
+                        break;
+                }
+                
+                return;
+            }
+        }
+
+        // CharacterRange comes after all existing ranges.
+        ranges.append(CharacterRange(lo, hi));
+    }
+
+    bool m_isCaseInsensitive;
+
+    Vector<UChar> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+};
+
+
+CharacterClass* newlineCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('\n');
+    characterClass->m_matches.append('\r');
+    characterClass->m_matchesUnicode.append(0x2028);
+    characterClass->m_matchesUnicode.append(0x2029);
+    
+    return characterClass;
+}
+
+CharacterClass* digitsCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange('0', '9'));
+    
+    return characterClass;
+}
+
+CharacterClass* spacesCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append(' ');
+    characterClass->m_ranges.append(CharacterRange('\t', '\r'));
+    characterClass->m_matchesUnicode.append(0x00a0);
+    characterClass->m_matchesUnicode.append(0x1680);
+    characterClass->m_matchesUnicode.append(0x180e);
+    characterClass->m_matchesUnicode.append(0x2028);
+    characterClass->m_matchesUnicode.append(0x2029);
+    characterClass->m_matchesUnicode.append(0x202f);
+    characterClass->m_matchesUnicode.append(0x205f);
+    characterClass->m_matchesUnicode.append(0x3000);
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2000, 0x200a));
+    
+    return characterClass;
+}
+
+CharacterClass* wordcharCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('_');
+    characterClass->m_ranges.append(CharacterRange('0', '9'));
+    characterClass->m_ranges.append(CharacterRange('A', 'Z'));
+    characterClass->m_ranges.append(CharacterRange('a', 'z'));
+    
+    return characterClass;
+}
+
+CharacterClass* nondigitsCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange(0, '0' - 1));
+    characterClass->m_ranges.append(CharacterRange('9' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x80, 0xffff));
+    
+    return characterClass;
+}
+
+CharacterClass* nonspacesCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange(0, '\t' - 1));
+    characterClass->m_ranges.append(CharacterRange('\r' + 1, ' ' - 1));
+    characterClass->m_ranges.append(CharacterRange(' ' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x0080, 0x009f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x00a1, 0x167f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x1681, 0x180d));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x180f, 0x1fff));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x200b, 0x2027));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x202a, 0x202e));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2030, 0x205e));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2060, 0x2fff));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x3001, 0xffff));
+    
+    return characterClass;
+}
+
+CharacterClass* nonwordcharCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('`');
+    characterClass->m_ranges.append(CharacterRange(0, '0' - 1));
+    characterClass->m_ranges.append(CharacterRange('9' + 1, 'A' - 1));
+    characterClass->m_ranges.append(CharacterRange('Z' + 1, '_' - 1));
+    characterClass->m_ranges.append(CharacterRange('z' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x80, 0xffff));
+
+    return characterClass;
+}
+
+
+class RegexPatternConstructor {
+public:
+    RegexPatternConstructor(RegexPattern& pattern)
+        : m_pattern(pattern)
+        , m_characterClassConstructor(pattern.m_ignoreCase)
+    {
+    }
+
+    ~RegexPatternConstructor()
+    {
+    }
+
+    void reset()
+    {
+        m_pattern.reset();
+        m_characterClassConstructor.reset();
+    }
+    
+    void assertionBOL()
+    {
+        m_alternative->m_terms.append(PatternTerm::BOL());
+    }
+    void assertionEOL()
+    {
+        m_alternative->m_terms.append(PatternTerm::EOL());
+    }
+    void assertionWordBoundary(bool invert)
+    {
+        m_alternative->m_terms.append(PatternTerm::WordBoundary(invert));
+    }
+
+    void atomPatternCharacter(UChar ch)
+    {
+        // We handle case-insensitive checking of unicode characters which do have both
+        // cases by handling them as if they were defined using a CharacterClass.
+        if (m_pattern.m_ignoreCase && !isASCII(ch) && (Unicode::toUpper(ch) != Unicode::toLower(ch))) {
+            atomCharacterClassBegin();
+            atomCharacterClassAtom(ch);
+            atomCharacterClassEnd();
+        } else
+            m_alternative->m_terms.append(PatternTerm(ch));
+    }
+
+    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+    {
+        switch (classID) {
+        case DigitClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.digitsCharacterClass(), invert));
+            break;
+        case SpaceClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.spacesCharacterClass(), invert));
+            break;
+        case WordClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.wordcharCharacterClass(), invert));
+            break;
+        case NewlineClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.newlineCharacterClass(), invert));
+            break;
+        }
+    }
+
+    void atomCharacterClassBegin(bool invert = false)
+    {
+        m_invertCharacterClass = invert;
+    }
+
+    void atomCharacterClassAtom(UChar ch)
+    {
+        m_characterClassConstructor.putChar(ch);
+    }
+
+    void atomCharacterClassRange(UChar begin, UChar end)
+    {
+        m_characterClassConstructor.putRange(begin, end);
+    }
+
+    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+    {
+        ASSERT(classID != NewlineClassID);
+
+        switch (classID) {
+        case DigitClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nondigitsCharacterClass() : m_pattern.digitsCharacterClass());
+            break;
+        
+        case SpaceClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nonspacesCharacterClass() : m_pattern.spacesCharacterClass());
+            break;
+        
+        case WordClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nonwordcharCharacterClass() : m_pattern.wordcharCharacterClass());
+            break;
+        
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void atomCharacterClassEnd()
+    {
+        CharacterClass* newCharacterClass = m_characterClassConstructor.charClass();
+        m_pattern.m_userCharacterClasses.append(newCharacterClass);
+        m_alternative->m_terms.append(PatternTerm(newCharacterClass, m_invertCharacterClass));
+    }
+
+    void atomParenthesesSubpatternBegin(bool capture = true)
+    {
+        unsigned subpatternId = m_pattern.m_numSubpatterns + 1;
+        if (capture)
+            m_pattern.m_numSubpatterns++;
+
+        PatternDisjunction* parenthesesDisjunction = new PatternDisjunction(m_alternative);
+        m_pattern.m_disjunctions.append(parenthesesDisjunction);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, capture));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+    }
+
+    void atomParentheticalAssertionBegin(bool invert = false)
+    {
+        PatternDisjunction* parenthesesDisjunction = new PatternDisjunction(m_alternative);
+        m_pattern.m_disjunctions.append(parenthesesDisjunction);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParentheticalAssertion, m_pattern.m_numSubpatterns + 1, parenthesesDisjunction, invert));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+    }
+
+    void atomParenthesesEnd()
+    {
+        ASSERT(m_alternative->m_parent);
+        ASSERT(m_alternative->m_parent->m_parent);
+        m_alternative = m_alternative->m_parent->m_parent;
+        
+        m_alternative->lastTerm().parentheses.lastSubpatternId = m_pattern.m_numSubpatterns;
+    }
+
+    void atomBackReference(unsigned subpatternId)
+    {
+        ASSERT(subpatternId);
+        m_pattern.m_maxBackReference = std::max(m_pattern.m_maxBackReference, subpatternId);
+
+        if (subpatternId > m_pattern.m_numSubpatterns) {
+            m_alternative->m_terms.append(PatternTerm::ForwardReference());
+            return;
+        }
+
+        PatternAlternative* currentAlternative = m_alternative;
+        ASSERT(currentAlternative);
+
+        // Note to self: if we waited until the AST was baked, we could also remove forwards refs 
+        while ((currentAlternative = currentAlternative->m_parent->m_parent)) {
+            PatternTerm& term = currentAlternative->lastTerm();
+            ASSERT((term.type == PatternTerm::TypeParenthesesSubpattern) || (term.type == PatternTerm::TypeParentheticalAssertion));
+
+            if ((term.type == PatternTerm::TypeParenthesesSubpattern) && term.invertOrCapture && (subpatternId == term.subpatternId)) {
+                m_alternative->m_terms.append(PatternTerm::ForwardReference());
+                return;
+            }
+        }
+
+        m_alternative->m_terms.append(PatternTerm(subpatternId));
+    }
+
+    PatternDisjunction* copyDisjunction(PatternDisjunction* disjunction)
+    {
+        PatternDisjunction* newDisjunction = new PatternDisjunction();
+
+        newDisjunction->m_parent = disjunction->m_parent;
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            PatternAlternative* newAlternative = newDisjunction->addNewAlternative();
+            for (unsigned i = 0; i < alternative->m_terms.size(); ++i)
+                newAlternative->m_terms.append(copyTerm(alternative->m_terms[i]));
+        }
+
+        m_pattern.m_disjunctions.append(newDisjunction);
+        return newDisjunction;
+    }
+
+    PatternTerm copyTerm(PatternTerm& term)
+    {
+        if ((term.type != PatternTerm::TypeParenthesesSubpattern) && (term.type != PatternTerm::TypeParentheticalAssertion))
+            return PatternTerm(term);
+
+        PatternTerm termCopy = term;
+        termCopy.parentheses.disjunction = copyDisjunction(termCopy.parentheses.disjunction);
+        return termCopy;
+    }
+
+    void quantifyAtom(unsigned min, unsigned max, bool greedy)
+    {
+        ASSERT(min <= max);
+        ASSERT(m_alternative->m_terms.size());
+
+        if (!max) {
+            m_alternative->removeLastTerm();
+            return;
+        }
+
+        PatternTerm& term = m_alternative->lastTerm();
+        ASSERT(term.type > PatternTerm::TypeAssertionWordBoundary);
+        ASSERT((term.quantityCount == 1) && (term.quantityType == QuantifierFixedCount));
+
+        // For any assertion with a zero minimum, not matching is valid and has no effect,
+        // remove it.  Otherwise, we need to match as least once, but there is no point
+        // matching more than once, so remove the quantifier.  It is not entirely clear
+        // from the spec whether or not this behavior is correct, but I believe this
+        // matches Firefox. :-/
+        if (term.type == PatternTerm::TypeParentheticalAssertion) {
+            if (!min)
+                m_alternative->removeLastTerm();
+            return;
+        }
+
+        if (min == 0)
+            term.quantify(max, greedy   ? QuantifierGreedy : QuantifierNonGreedy);
+        else if (min == max)
+            term.quantify(min, QuantifierFixedCount);
+        else {
+            term.quantify(min, QuantifierFixedCount);
+            m_alternative->m_terms.append(copyTerm(term));
+            // NOTE: this term is interesting from an analysis perspective, in that it can be ignored.....
+            m_alternative->lastTerm().quantify((max == UINT_MAX) ? max : max - min, greedy ? QuantifierGreedy : QuantifierNonGreedy);
+            if (m_alternative->lastTerm().type == PatternTerm::TypeParenthesesSubpattern)
+                m_alternative->lastTerm().parentheses.isCopy = true;
+        }
+    }
+
+    void disjunction()
+    {
+        m_alternative = m_alternative->m_parent->addNewAlternative();
+    }
+
+    void regexBegin()
+    {
+        m_pattern.m_body = new PatternDisjunction();
+        m_alternative = m_pattern.m_body->addNewAlternative();
+        m_pattern.m_disjunctions.append(m_pattern.m_body);
+    }
+    void regexEnd()
+    {
+    }
+    void regexError()
+    {
+    }
+
+    unsigned setupAlternativeOffsets(PatternAlternative* alternative, unsigned currentCallFrameSize, unsigned initialInputPosition)
+    {
+        alternative->m_hasFixedSize = true;
+        unsigned currentInputPosition = initialInputPosition;
+
+        for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+
+            switch (term.type) {
+            case PatternTerm::TypeAssertionBOL:
+            case PatternTerm::TypeAssertionEOL:
+            case PatternTerm::TypeAssertionWordBoundary:
+                term.inputPosition = currentInputPosition;
+                break;
+
+            case PatternTerm::TypeBackReference:
+                term.inputPosition = currentInputPosition;
+                term.frameLocation = currentCallFrameSize;
+                currentCallFrameSize += RegexStackSpaceForBackTrackInfoBackReference;
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeForwardReference:
+                break;
+
+            case PatternTerm::TypePatternCharacter:
+                term.inputPosition = currentInputPosition;
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoPatternCharacter;
+                    alternative->m_hasFixedSize = false;
+                } else
+                    currentInputPosition += term.quantityCount;
+                break;
+
+            case PatternTerm::TypeCharacterClass:
+                term.inputPosition = currentInputPosition;
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoCharacterClass;
+                    alternative->m_hasFixedSize = false;
+                } else
+                    currentInputPosition += term.quantityCount;
+                break;
+
+            case PatternTerm::TypeParenthesesSubpattern:
+                // Note: for fixed once parentheses we will ensure at least the minimum is available; others are on their own.
+                term.frameLocation = currentCallFrameSize;
+                if ((term.quantityCount == 1) && !term.parentheses.isCopy) {
+                    if (term.quantityType == QuantifierFixedCount) {
+                        currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition);
+                        currentInputPosition += term.parentheses.disjunction->m_minimumSize;
+                    } else {
+                        currentCallFrameSize += RegexStackSpaceForBackTrackInfoParenthesesOnce;
+                        currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition);
+                    }
+                    term.inputPosition = currentInputPosition;
+                } else {
+                    term.inputPosition = currentInputPosition;
+                    setupDisjunctionOffsets(term.parentheses.disjunction, 0, currentInputPosition);
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoParentheses;
+                }
+                // Fixed count of 1 could be accepted, if they have a fixed size *AND* if all alternatives are of the same length.
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeParentheticalAssertion:
+                term.inputPosition = currentInputPosition;
+                term.frameLocation = currentCallFrameSize;
+                currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize + RegexStackSpaceForBackTrackInfoParentheticalAssertion, currentInputPosition);
+                break;
+            }
+        }
+
+        alternative->m_minimumSize = currentInputPosition - initialInputPosition;
+        return currentCallFrameSize;
+    }
+
+    unsigned setupDisjunctionOffsets(PatternDisjunction* disjunction, unsigned initialCallFrameSize, unsigned initialInputPosition)
+    {
+        if ((disjunction != m_pattern.m_body) && (disjunction->m_alternatives.size() > 1))
+            initialCallFrameSize += RegexStackSpaceForBackTrackInfoAlternative;
+
+        unsigned minimumInputSize = UINT_MAX;
+        unsigned maximumCallFrameSize = 0;
+        bool hasFixedSize = true;
+
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            unsigned currentAlternativeCallFrameSize = setupAlternativeOffsets(alternative, initialCallFrameSize, initialInputPosition);
+            minimumInputSize = min(minimumInputSize, alternative->m_minimumSize);
+            maximumCallFrameSize = max(maximumCallFrameSize, currentAlternativeCallFrameSize);
+            hasFixedSize &= alternative->m_hasFixedSize;
+        }
+        
+        ASSERT(minimumInputSize != UINT_MAX);
+        ASSERT(maximumCallFrameSize >= initialCallFrameSize);
+
+        disjunction->m_hasFixedSize = hasFixedSize;
+        disjunction->m_minimumSize = minimumInputSize;
+        disjunction->m_callFrameSize = maximumCallFrameSize;
+        return maximumCallFrameSize;
+    }
+
+    void setupOffsets()
+    {
+        setupDisjunctionOffsets(m_pattern.m_body, 0, 0);
+    }
+
+private:
+    RegexPattern& m_pattern;
+    PatternAlternative* m_alternative;
+    CharacterClassConstructor m_characterClassConstructor;
+    bool m_invertCharacterClass;
+};
+
+
+const char* compileRegex(const UString& patternString, RegexPattern& pattern)
+{
+    RegexPatternConstructor constructor(pattern);
+
+    if (const char* error = parse(constructor, patternString))
+        return error;
+    
+    // If the pattern contains illegal backreferences reset & reparse.
+    // Quoting Netscape's "What's new in JavaScript 1.2",
+    //      "Note: if the number of left parentheses is less than the number specified
+    //       in \#, the \# is taken as an octal escape as described in the next row."
+    if (pattern.containsIllegalBackReference()) {
+        unsigned numSubpatterns = pattern.m_numSubpatterns;
+
+        constructor.reset();
+#ifndef NDEBUG
+        const char* error =
+#endif
+            parse(constructor, patternString, numSubpatterns);
+
+        ASSERT(!error);
+        ASSERT(numSubpatterns == pattern.m_numSubpatterns);
+    }
+
+    constructor.setupOffsets();
+
+    return false;
+};
+
+
+} }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
new file mode 100644
index 0000000000..3ed2be9e4a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexCompiler_h
+#define RegexCompiler_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/unicode/Unicode.h>
+#include "RegexParser.h"
+#include "RegexPattern.h"
+
+namespace JSC { namespace Yarr {
+
+const char* compileRegex(const UString& patternString, RegexPattern& pattern);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexCompiler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
new file mode 100644
index 0000000000..b0aae65028
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -0,0 +1,1638 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexInterpreter.h"
+
+#include "RegexCompiler.h"
+#include "RegexPattern.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+#if ENABLE(YARR)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+class Interpreter {
+public:
+    struct ParenthesesDisjunctionContext;
+
+    struct BackTrackInfoPatternCharacter {
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoCharacterClass {
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoBackReference {
+        uintptr_t begin; // Not really needed for greedy quantifiers.
+        uintptr_t matchAmount; // Not really needed for fixed quantifiers.
+    };
+    struct BackTrackInfoAlternative {
+        uintptr_t offset;
+    };
+    struct BackTrackInfoParentheticalAssertion {
+        uintptr_t begin;
+    };
+    struct BackTrackInfoParenthesesOnce {
+        uintptr_t inParentheses;
+    };
+    struct BackTrackInfoParentheses {
+        uintptr_t matchAmount;
+        ParenthesesDisjunctionContext* lastContext;
+        uintptr_t prevBegin;
+        uintptr_t prevEnd;
+    };
+
+    static inline void appendParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack, ParenthesesDisjunctionContext* context)
+    {
+        context->next = backTrack->lastContext;
+        backTrack->lastContext = context;
+        ++backTrack->matchAmount;
+    }
+
+    static inline void popParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack)
+    {
+        ASSERT(backTrack->matchAmount);
+        ASSERT(backTrack->lastContext);
+        backTrack->lastContext = backTrack->lastContext->next;
+        --backTrack->matchAmount;
+    }
+
+    struct DisjunctionContext
+    {
+        DisjunctionContext()
+            : term(0)
+        {
+        }
+        
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        int term;
+        unsigned matchBegin;
+        unsigned matchEnd;
+        uintptr_t frame[1];
+    };
+
+    DisjunctionContext* allocDisjunctionContext(ByteDisjunction* disjunction)
+    {
+        return new(malloc(sizeof(DisjunctionContext) + (disjunction->m_frameSize - 1) * sizeof(uintptr_t))) DisjunctionContext();
+    }
+
+    void freeDisjunctionContext(DisjunctionContext* context)
+    {
+        free(context);
+    }
+
+    struct ParenthesesDisjunctionContext
+    {
+        ParenthesesDisjunctionContext(int* output, ByteTerm& term)
+            : next(0)
+        {
+            unsigned firstSubpatternId = term.atom.subpatternId;
+            unsigned numNestedSubpatterns = term.atom.parenthesesDisjunction->m_numSubpatterns;
+
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i) {
+                subpatternBackup[i] = output[(firstSubpatternId << 1) + i];
+                output[(firstSubpatternId << 1) + i] = -1;
+            }
+            
+            new(getDisjunctionContext(term)) DisjunctionContext();
+        }
+
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        void restoreOutput(int* output, unsigned firstSubpatternId, unsigned numNestedSubpatterns)
+        {
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i)
+                output[(firstSubpatternId << 1) + i] = subpatternBackup[i];
+        }
+        
+        DisjunctionContext* getDisjunctionContext(ByteTerm& term)
+        {
+            return reinterpret_cast<DisjunctionContext*>(&(subpatternBackup[term.atom.parenthesesDisjunction->m_numSubpatterns << 1]));
+        }
+
+        ParenthesesDisjunctionContext* next;
+        int subpatternBackup[1];
+    };
+
+    ParenthesesDisjunctionContext* allocParenthesesDisjunctionContext(ByteDisjunction* disjunction, int* output, ByteTerm& term)
+    {
+        return new(malloc(sizeof(ParenthesesDisjunctionContext) + (((term.atom.parenthesesDisjunction->m_numSubpatterns << 1) - 1) * sizeof(int)) + sizeof(DisjunctionContext) + (disjunction->m_frameSize - 1) * sizeof(uintptr_t))) ParenthesesDisjunctionContext(output, term);
+    }
+
+    void freeParenthesesDisjunctionContext(ParenthesesDisjunctionContext* context)
+    {
+        free(context);
+    }
+
+    class InputStream {
+    public:
+        InputStream(const UChar* input, unsigned start, unsigned length)
+            : input(input)
+            , pos(start)
+            , length(length)
+        {
+        }
+
+        void next()
+        {
+            ++pos;
+        }
+
+        void rewind(unsigned amount)
+        {
+            ASSERT(pos >= amount);
+            pos -= amount;
+        }
+
+        int read()
+        {
+            ASSERT(pos < length);
+            if (pos < length)
+                return input[pos];
+            return -1;
+        }
+
+        int readChecked(int position)
+        {
+            ASSERT(position < 0);
+            ASSERT((unsigned)-position <= pos);
+            unsigned p = pos + position;
+            ASSERT(p < length);
+            return input[p];
+        }
+
+        int reread(unsigned from)
+        {
+            ASSERT(from < length);
+            return input[from];
+        }
+
+        int prev()
+        {
+            ASSERT(!(pos > length));
+            if (pos && length)
+                return input[pos - 1];
+            return -1;
+        }
+        
+        unsigned getPos()
+        {
+            return pos;
+        }
+
+        void setPos(unsigned p)
+        {
+            pos = p;
+        }
+        
+        bool atStart()
+        {
+            return pos == 0;
+        }
+
+        bool atEnd()
+        {
+            return pos == length;
+        }
+
+        bool checkInput(int count)
+        {
+            if ((pos + count) <= length) {
+                pos += count;
+                return true;
+            } else
+                return false;
+        }
+
+        void uncheckInput(int count)
+        {
+            pos -= count;
+        }
+
+        bool atStart(int position)
+        {
+            return (pos + position) == 0;
+        }
+
+        bool atEnd(int position)
+        {
+            return (pos + position) == length;
+        }
+
+    private:
+        const UChar* input;
+        unsigned pos;
+        unsigned length;
+    };
+
+    bool testCharacterClass(CharacterClass* characterClass, int ch)
+    {
+        if (ch & 0xFF80) {
+            for (unsigned i = 0; i < characterClass->m_matchesUnicode.size(); ++i)
+                if (ch == characterClass->m_matchesUnicode[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_rangesUnicode.size(); ++i)
+                if ((ch >= characterClass->m_rangesUnicode[i].begin) && (ch <= characterClass->m_rangesUnicode[i].end))
+                    return true;
+        } else {
+            for (unsigned i = 0; i < characterClass->m_matches.size(); ++i)
+                if (ch == characterClass->m_matches[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_ranges.size(); ++i)
+                if ((ch >= characterClass->m_ranges[i].begin) && (ch <= characterClass->m_ranges[i].end))
+                    return true;
+        }
+
+        return false;
+    }
+
+    bool tryConsumeCharacter(int testChar)
+    {
+        if (input.atEnd())
+            return false;
+        
+        int ch = input.read();
+
+        if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
+            input.next();
+            return true;
+        }
+        return false;
+    }
+
+    bool checkCharacter(int testChar, int inputPosition)
+    {
+        return testChar == input.readChecked(inputPosition);
+    }
+
+    bool checkCasedCharacter(int loChar, int hiChar, int inputPosition)
+    {
+        int ch = input.readChecked(inputPosition);
+        return (loChar == ch) || (hiChar == ch);
+    }
+
+    bool tryConsumeCharacterClass(CharacterClass* characterClass, bool invert)
+    {
+        if (input.atEnd())
+            return false;
+
+        bool match = testCharacterClass(characterClass, input.read());
+
+        if (invert)
+            match = !match;
+
+        if (match) {
+            input.next();
+            return true;
+        }
+        return false;
+    }
+
+    bool checkCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition)
+    {
+        bool match = testCharacterClass(characterClass, input.readChecked(inputPosition));
+        return invert ? !match : match;
+    }
+
+    bool tryConsumeBackReference(int matchBegin, int matchEnd, int inputOffset)
+    {
+        int matchSize = matchEnd - matchBegin;
+
+        if (!input.checkInput(matchSize))
+            return false;
+
+        for (int i = 0; i < matchSize; ++i) {
+            if (!checkCharacter(input.reread(matchBegin + i), inputOffset - matchSize + i)) {
+                input.uncheckInput(matchSize);
+                return false;
+            }
+        }
+        
+        return true;
+    }
+
+    bool matchAssertionBOL(ByteTerm& term)
+    {
+        return (input.atStart(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition - 1)));
+    }
+
+    bool matchAssertionEOL(ByteTerm& term)
+    {
+        if (term.inputPosition)
+            return (input.atEnd(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition)));
+        else
+            return (input.atEnd()) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.read()));
+    }
+
+    bool matchAssertionWordBoundary(ByteTerm& term)
+    {
+        bool prevIsWordchar = !input.atStart(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition - 1));
+        bool readIsWordchar;
+        if (term.inputPosition)
+            readIsWordchar = !input.atEnd(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition));
+        else
+            readIsWordchar = !input.atEnd() && testCharacterClass(pattern->wordcharCharacterClass, input.read());
+
+        bool wordBoundary = prevIsWordchar != readIsWordchar;
+        return term.invert() ? !wordBoundary : wordBoundary;
+    }
+
+    bool backtrackPatternCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacter(term.atom.patternCharacter, term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackPatternCasedCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCasedCharacter(term.atom.casedCharacter.lo, term.atom.casedCharacter.hi, term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityCount; ++matchAmount) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + matchAmount))
+                    return false;
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        int matchBegin = output[(term.atom.subpatternId << 1)];
+        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        ASSERT((matchBegin == -1) == (matchEnd == -1));
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return true;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            backTrack->begin = input.getPos();
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityCount; ++matchAmount) {
+                if (!tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                    input.setPos(backTrack->begin);
+                    return false;
+                }
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition))
+                ++matchAmount;
+            backTrack->matchAmount = matchAmount;
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->begin = input.getPos();
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        int matchBegin = output[(term.atom.subpatternId << 1)];
+        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        ASSERT((matchBegin == -1) == (matchEnd == -1));
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return false;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            // for quantityCount == 1, could rewind.
+            input.setPos(backTrack->begin);
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.rewind(matchEnd - matchBegin);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                ++backTrack->matchAmount;
+                return true;
+            } else
+                input.setPos(backTrack->begin);
+            break;
+        }
+
+        return false;
+    }
+
+    void recordParenthesesMatch(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = context->getDisjunctionContext(term)->matchBegin + term.inputPosition;
+            output[(subpatternId << 1) + 1] = context->getDisjunctionContext(term)->matchEnd + term.inputPosition;
+        }
+    }
+    void resetMatches(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        unsigned firstSubpatternId = term.atom.subpatternId;
+        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
+        context->restoreOutput(output, firstSubpatternId, count);
+    }
+    void resetAssertionMatches(ByteTerm& term)
+    {
+        unsigned firstSubpatternId = term.atom.subpatternId;
+        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
+        for (unsigned i = 0; i < (count << 1); ++i)
+            output[(firstSubpatternId << 1) + i] = -1;
+    }
+    bool parenthesesDoBacktrack(ByteTerm& term, BackTrackInfoParentheses* backTrack)
+    {
+        while (backTrack->matchAmount) {
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+
+            if (matchDisjunction(term.atom.parenthesesDisjunction, context->getDisjunctionContext(term), true))
+                return true;
+            
+            resetMatches(term, context);
+            freeParenthesesDisjunctionContext(context);
+            popParenthesesDisjunctionContext(backTrack);
+        }
+
+        return false;
+    }
+
+    bool matchParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy: {
+            // set this speculatively; if we get to the parens end this will be true.
+            backTrack->inParentheses = 1;
+            break;
+        }
+        case QuantifierNonGreedy: {
+            backTrack->inParentheses = 0;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+        case QuantifierFixedCount:
+            break;
+        }
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = input.getPos() + term.inputPosition;
+        }
+
+        return true;
+    }
+
+    bool matchParenthesesOnceEnd(ByteTerm& term, DisjunctionContext*)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1) + 1] = input.getPos() + term.inputPosition;
+        }
+        return true;
+    }
+
+    bool backtrackParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = -1;
+            output[(subpatternId << 1) + 1] = -1;
+        }
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            // if we backtrack to this point, there is another chance - try matching nothing.
+            ASSERT(backTrack->inParentheses);
+            backTrack->inParentheses = 0;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        case QuantifierNonGreedy:
+            ASSERT(backTrack->inParentheses);
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackParenthesesOnceEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            if (!backTrack->inParentheses) {
+                context->term -= term.atom.parenthesesWidth;
+                return false;
+            }
+        case QuantifierNonGreedy:
+            if (!backTrack->inParentheses) {
+                // now try to match the parens; set this speculatively.
+                backTrack->inParentheses = 1;
+                if (term.capture()) {
+                    unsigned subpatternId = term.atom.subpatternId;
+                    output[(subpatternId << 1) + 1] = input.getPos() + term.inputPosition;
+                }
+                context->term -= term.atom.parenthesesWidth;
+                return true;
+            }
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        backTrack->begin = input.getPos();
+        return true;
+    }
+
+    bool matchParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        // We've reached the end of the parens; if they are inverted, this is failure.
+        if (term.invert()) {
+            context->term -= term.atom.parenthesesWidth;
+            return false;
+        }
+
+        return true;
+    }
+
+    bool backtrackParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        // We've failed to match parens; if they are inverted, this is win!
+        if (term.invert()) {
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+
+        return false;
+    }
+
+    bool backtrackParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        context->term -= term.atom.parenthesesWidth;
+        return false;
+    }
+
+    bool matchParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+
+        unsigned subpatternId = term.atom.subpatternId;
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        backTrack->prevBegin = output[(subpatternId << 1)];
+        backTrack->prevEnd = output[(subpatternId << 1) + 1];
+
+        backTrack->matchAmount = 0;
+        backTrack->lastContext = 0;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    if (!parenthesesDoBacktrack(term, backTrack))
+                        return false;
+                }
+            }
+
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    break;
+                }
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    // Rules for backtracking differ depending on whether this is greedy or non-greedy.
+    //
+    // Greedy matches never should try just adding more - you should already have done
+    // the 'more' cases.  Always backtrack, at least a leetle bit.  However cases where
+    // you backtrack an item off the list needs checking, since we'll never have matched
+    // the one less case.  Tracking forwards, still add as much as possible.
+    //
+    // Non-greedy, we've already done the one less case, so don't match on popping.
+    // We haven't done the one more case, so always try to add that.
+    //
+    bool backtrackParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = backTrack->prevBegin;
+            output[(subpatternId << 1) + 1] = backTrack->prevEnd;
+        }
+
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+
+            ParenthesesDisjunctionContext* context = 0;
+
+            if (!parenthesesDoBacktrack(term, backTrack))
+                return false;
+
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    if (!parenthesesDoBacktrack(term, backTrack))
+                        return false;
+                }
+            }
+
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+            context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            if (!backTrack->matchAmount)
+                return false;
+
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true)) {
+                while (backTrack->matchAmount < term.atom.quantityCount) {
+                    ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                    if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                        appendParenthesesDisjunctionContext(backTrack, context);
+                    else {
+                        resetMatches(term, context);
+                        freeParenthesesDisjunctionContext(context);
+                        break;
+                    }
+                }
+            } else {
+                resetMatches(term, context);
+                freeParenthesesDisjunctionContext(context);
+                popParenthesesDisjunctionContext(backTrack);
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return true;
+        }
+
+        case QuantifierNonGreedy: {
+            // If we've not reached the limit, try to add one more match.
+            if (backTrack->matchAmount < term.atom.quantityCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term))) {
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                    recordParenthesesMatch(term, context);
+                    return true;
+                } else {
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                }
+            }
+
+            // Nope - okay backtrack looking for an alternative.
+            while (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true)) {
+                    // successful backtrack! we're back in the game!
+                    if (backTrack->matchAmount) {
+                        context = backTrack->lastContext;
+                        recordParenthesesMatch(term, context);
+                    }
+                    return true;
+                }
+                
+                // pop a match off the stack
+                resetMatches(term, context);
+                freeParenthesesDisjunctionContext(context);
+                popParenthesesDisjunctionContext(backTrack);
+            }
+
+            return false;
+        }
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+#define MATCH_NEXT() { ++context->term; goto matchAgain; }
+#define BACKTRACK() { --context->term; goto backtrack; }
+#define currentTerm() (disjunction->terms[context->term])
+    bool matchDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        if (btrack)
+            BACKTRACK();
+
+        context->matchBegin = input.getPos();
+        context->term = 0;
+
+    matchAgain:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeSubpatternEnd:
+            context->matchEnd = input.getPos();
+            return true;
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeBodyAlternativeDisjunction:
+        case ByteTerm::TypeBodyAlternativeEnd:
+            context->matchEnd = input.getPos();
+            return true;
+
+        case ByteTerm::TypeAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeAlternativeDisjunction:
+        case ByteTerm::TypeAlternativeEnd: {
+            int offset = currentTerm().alternative.end;
+            BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+            backTrack->offset = offset;
+            context->term += offset;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeAssertionBOL:
+            if (matchAssertionBOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionEOL:
+            if (matchAssertionEOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionWordBoundary:
+            if (matchAssertionWordBoundary(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypePatternCharacterOnce:
+        case ByteTerm::TypePatternCharacterFixed: {
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition + matchAmount))
+                    BACKTRACK();
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            unsigned matchAmount = 0;
+            while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypePatternCasedCharacterOnce:
+        case ByteTerm::TypePatternCasedCharacterFixed: {
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition + matchAmount))
+                    BACKTRACK();
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            unsigned matchAmount = 0;
+            while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeCharacterClass:
+            if (matchCharacterClass(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeBackReference:
+            if (matchBackReference(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpattern:
+            if (matchParentheses(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+            if (matchParenthesesOnceBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+            if (matchParenthesesOnceEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionBegin:
+            if (matchParentheticalAssertionBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionEnd:
+            if (matchParentheticalAssertionEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypeCheckInput:
+            if (input.checkInput(currentTerm().checkInputCount))
+                MATCH_NEXT();
+            BACKTRACK();
+        }
+
+        // We should never fall-through to here.
+        ASSERT_NOT_REACHED();
+
+    backtrack:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            return false;
+        case ByteTerm::TypeSubpatternEnd:
+            ASSERT_NOT_REACHED();
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+        case ByteTerm::TypeBodyAlternativeDisjunction: {
+            int offset = currentTerm().alternative.next;
+            context->term += offset;
+            if (offset > 0)
+                MATCH_NEXT();
+
+            if (input.atEnd())
+                return false;
+
+            input.next();
+            context->matchBegin = input.getPos();
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypeBodyAlternativeEnd:
+            ASSERT_NOT_REACHED();
+
+            case ByteTerm::TypeAlternativeBegin:
+            case ByteTerm::TypeAlternativeDisjunction: {
+                int offset = currentTerm().alternative.next;
+                context->term += offset;
+                if (offset > 0)
+                    MATCH_NEXT();
+                BACKTRACK();
+            }
+            case ByteTerm::TypeAlternativeEnd: {
+                // We should never backtrack back into an alternative of the main body of the regex.
+                BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+                unsigned offset = backTrack->offset;
+                context->term -= offset;
+                BACKTRACK();
+            }
+
+            case ByteTerm::TypeAssertionBOL:
+            case ByteTerm::TypeAssertionEOL:
+            case ByteTerm::TypeAssertionWordBoundary:
+                BACKTRACK();
+
+            case ByteTerm::TypePatternCharacterOnce:
+            case ByteTerm::TypePatternCharacterFixed:
+            case ByteTerm::TypePatternCharacterGreedy:
+            case ByteTerm::TypePatternCharacterNonGreedy:
+                if (backtrackPatternCharacter(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypePatternCasedCharacterOnce:
+            case ByteTerm::TypePatternCasedCharacterFixed:
+            case ByteTerm::TypePatternCasedCharacterGreedy:
+            case ByteTerm::TypePatternCasedCharacterNonGreedy:
+                if (backtrackPatternCasedCharacter(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeCharacterClass:
+                if (backtrackCharacterClass(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeBackReference:
+                if (backtrackBackReference(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpattern:
+                if (backtrackParentheses(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+                if (backtrackParenthesesOnceBegin(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+                if (backtrackParenthesesOnceEnd(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParentheticalAssertionBegin:
+                if (backtrackParentheticalAssertionBegin(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParentheticalAssertionEnd:
+                if (backtrackParentheticalAssertionEnd(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+
+            case ByteTerm::TypeCheckInput:
+                input.uncheckInput(currentTerm().checkInputCount);
+                BACKTRACK();
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool matchNonZeroDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        if (matchDisjunction(disjunction, context, btrack)) {
+            while (context->matchBegin == context->matchEnd) {
+                if (!matchDisjunction(disjunction, context, true))
+                    return false;
+            }
+            return true;
+        }
+
+        return false;
+    }
+
+    int interpret()
+    {
+        for (unsigned i = 0; i < ((pattern->m_body->m_numSubpatterns + 1) << 1); ++i)
+            output[i] = -1;
+
+        DisjunctionContext* context = allocDisjunctionContext(pattern->m_body.get());
+
+        if (matchDisjunction(pattern->m_body.get(), context)) {
+            output[0] = context->matchBegin;
+            output[1] = context->matchEnd;
+        }
+
+        freeDisjunctionContext(context);
+
+        return output[0];
+    }
+
+    Interpreter(BytecodePattern* pattern, int* output, const UChar* inputChar, unsigned start, unsigned length)
+        : pattern(pattern)
+        , output(output)
+        , input(inputChar, start, length)
+    {
+    }
+
+private:
+    BytecodePattern *pattern;
+    int* output;
+    InputStream input;
+};
+
+
+
+class ByteCompiler {
+    struct ParenthesesStackEntry {
+        unsigned beginTerm;
+        unsigned savedAlternativeIndex;
+        ParenthesesStackEntry(unsigned beginTerm, unsigned savedAlternativeIndex/*, unsigned subpatternId, bool capture = false*/)
+            : beginTerm(beginTerm)
+            , savedAlternativeIndex(savedAlternativeIndex)
+        {
+        }
+    };
+
+public:
+    ByteCompiler(RegexPattern& pattern)
+        : m_pattern(pattern)
+    {
+        bodyDisjunction = 0;
+        currentAlternativeIndex = 0;
+    }
+    
+    BytecodePattern* compile()
+    {
+        regexBegin(m_pattern.m_numSubpatterns, m_pattern.m_body->m_callFrameSize);
+        emitDisjunction(m_pattern.m_body);
+        regexEnd();
+
+        return new BytecodePattern(bodyDisjunction, m_allParenthesesInfo, m_pattern);
+    }
+    
+    void checkInput(unsigned count)
+    {
+        bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
+    }
+
+    void assertionBOL(int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
+    }
+
+    void assertionEOL(int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
+    }
+
+    void assertionWordBoundary(bool invert, int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
+    }
+
+    void atomPatternCharacter(UChar ch, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        if (m_pattern.m_ignoreCase) {
+            UChar lo = Unicode::toLower(ch);
+            UChar hi = Unicode::toUpper(ch);
+            
+            if (lo != hi) {
+                bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityCount, quantityType));
+                return;
+            }
+        }
+
+        bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
+    }
+    
+    void atomCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
+
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomBackReference(unsigned subpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        ASSERT(subpatternId);
+
+        bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
+
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = bodyDisjunction->terms.size();
+
+        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, inputPosition));
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
+        currentAlternativeIndex = beginTerm + 1;
+    }
+
+    void atomParentheticalAssertionBegin(unsigned subpatternId, bool invert, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = bodyDisjunction->terms.size();
+
+        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, invert, 0));
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
+        currentAlternativeIndex = beginTerm + 1;
+    }
+
+    unsigned popParenthesesStack()
+    {
+        ASSERT(m_parenthesesStack.size());
+        int stackEnd = m_parenthesesStack.size() - 1;
+        unsigned beginTerm = m_parenthesesStack[stackEnd].beginTerm;
+        currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
+        m_parenthesesStack.shrink(stackEnd);
+
+        ASSERT(beginTerm < bodyDisjunction->terms.size());
+        ASSERT(currentAlternativeIndex < bodyDisjunction->terms.size());
+        
+        return beginTerm;
+    }
+
+#ifndef NDEBUG
+    void dumpDisjunction(ByteDisjunction* disjunction)
+    {
+        printf("ByteDisjunction(%p):\n\t", disjunction);
+        for (unsigned i = 0; i < disjunction->terms.size(); ++i)
+            printf("{ %d } ", disjunction->terms[i].type);
+        printf("\n");
+    }
+#endif
+
+    void closeAlternative(int beginTerm)
+    {
+        int origBeginTerm = beginTerm;
+        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
+        int endIndex = bodyDisjunction->terms.size();
+
+        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+
+        if (!bodyDisjunction->terms[beginTerm].alternative.next)
+            bodyDisjunction->terms.remove(beginTerm);
+        else {
+            while (bodyDisjunction->terms[beginTerm].alternative.next) {
+                beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
+                ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
+                bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+                bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            }
+            
+            bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+            bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
+            bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+        }
+    }
+
+    void closeBodyAlternative()
+    {
+        int beginTerm = 0;
+        int origBeginTerm = 0;
+        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
+        int endIndex = bodyDisjunction->terms.size();
+
+        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+
+        while (bodyDisjunction->terms[beginTerm].alternative.next) {
+            beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
+            ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
+            bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        }
+        
+        bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
+        bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesEnd(bool doInline, unsigned lastSubpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType, unsigned callFrameSize = 0)
+    {
+        unsigned beginTerm = popParenthesesStack();
+        closeAlternative(beginTerm + 1);
+        unsigned endTerm = bodyDisjunction->terms.size();
+
+        bool isAssertion = bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin;
+        bool invertOrCapture = bodyDisjunction->terms[beginTerm].invertOrCapture;
+        unsigned subpatternId = bodyDisjunction->terms[beginTerm].atom.subpatternId;
+
+        bodyDisjunction->terms.append(ByteTerm(isAssertion ? ByteTerm::TypeParentheticalAssertionEnd : ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, invertOrCapture, inputPosition));
+        bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+
+        if (doInline) {
+            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            bodyDisjunction->terms[endTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+        } else {
+            ByteTerm& parenthesesBegin = bodyDisjunction->terms[beginTerm];
+            ASSERT(parenthesesBegin.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+
+            bool invertOrCapture = parenthesesBegin.invertOrCapture;
+            unsigned subpatternId = parenthesesBegin.atom.subpatternId;
+
+            unsigned numSubpatterns = lastSubpatternId - subpatternId + 1;
+            ByteDisjunction* parenthesesDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+
+            parenthesesDisjunction->terms.append(ByteTerm::SubpatternBegin());
+            for (unsigned termInParentheses = beginTerm + 1; termInParentheses < endTerm; ++termInParentheses)
+                parenthesesDisjunction->terms.append(bodyDisjunction->terms[termInParentheses]);
+            parenthesesDisjunction->terms.append(ByteTerm::SubpatternEnd());
+
+            bodyDisjunction->terms.shrink(beginTerm);
+
+            m_allParenthesesInfo.append(parenthesesDisjunction);
+            bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, invertOrCapture, inputPosition));
+
+            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        }
+    }
+
+    void regexBegin(unsigned numSubpatterns, unsigned callFrameSize)
+    {
+        bodyDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin());
+        bodyDisjunction->terms[0].frameLocation = 0;
+        currentAlternativeIndex = 0;
+    }
+
+    void regexEnd()
+    {
+        closeBodyAlternative();
+    }
+
+    void alterantiveBodyDisjunction()
+    {
+        int newAlternativeIndex = bodyDisjunction->terms.size();
+        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction());
+
+        currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void alterantiveDisjunction()
+    {
+        int newAlternativeIndex = bodyDisjunction->terms.size();
+        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
+
+        currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0)
+    {
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            unsigned currentCountAlreadyChecked = inputCountAlreadyChecked;
+        
+            if (alt) {
+                if (disjunction == m_pattern.m_body)
+                    alterantiveBodyDisjunction();
+                else
+                    alterantiveDisjunction();
+            }
+
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            unsigned minimumSize = alternative->m_minimumSize;
+
+            ASSERT(minimumSize >= parenthesesInputCountAlreadyChecked);
+            unsigned countToCheck = minimumSize - parenthesesInputCountAlreadyChecked;
+            if (countToCheck)
+                checkInput(countToCheck);
+            currentCountAlreadyChecked += countToCheck;
+
+            for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+                PatternTerm& term = alternative->m_terms[i];
+
+                switch (term.type) {
+                case PatternTerm::TypeAssertionBOL:
+                    assertionBOL(term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypeAssertionEOL:
+                    assertionEOL(term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypeAssertionWordBoundary:
+                    assertionWordBoundary(term.invertOrCapture, term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypePatternCharacter:
+                    atomPatternCharacter(term.patternCharacter, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeCharacterClass:
+                    atomCharacterClass(term.characterClass, term.invertOrCapture, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeBackReference:
+                    atomBackReference(term.subpatternId, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                        break;
+
+                case PatternTerm::TypeForwardReference:
+                    break;
+
+                case PatternTerm::TypeParenthesesSubpattern: {
+                    unsigned disjunctionAlreadyCheckedCount = 0;
+                    if ((term.quantityCount == 1) && !term.parentheses.isCopy) {
+                        if (term.quantityType == QuantifierFixedCount) {
+                            disjunctionAlreadyCheckedCount = term.parentheses.disjunction->m_minimumSize;
+                            unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                            atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, term.frameLocation);
+                            emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, term.parentheses.disjunction->m_minimumSize);
+                            atomParenthesesEnd(true, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                        } else {
+                            unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                            atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, term.frameLocation + RegexStackSpaceForBackTrackInfoParenthesesOnce);
+                            emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                            atomParenthesesEnd(true, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                        }
+                    } else {
+                        unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                        atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, 0);
+                        emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                        atomParenthesesEnd(false, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                    }
+                    break;
+                }
+
+                case PatternTerm::TypeParentheticalAssertion: {
+                    unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+                    
+                    atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
+                    emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                    atomParenthesesEnd(true, term.parentheses.lastSubpatternId, 0, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+                }
+                }
+            }
+        }
+    }
+
+private:
+    RegexPattern& m_pattern;
+    ByteDisjunction* bodyDisjunction;
+    unsigned currentAlternativeIndex;
+    Vector<ParenthesesStackEntry> m_parenthesesStack;
+    Vector<ByteDisjunction*> m_allParenthesesInfo;
+};
+
+
+BytecodePattern* byteCompileRegex(const UString& patternString, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline)
+{
+    RegexPattern pattern(ignoreCase, multiline);
+
+    if ((error = compileRegex(patternString, pattern)))
+        return 0;
+
+    numSubpatterns = pattern.m_numSubpatterns;
+
+    return ByteCompiler(pattern).compile();
+}
+
+int interpretRegex(BytecodePattern* regex, const UChar* input, unsigned start, unsigned length, int* output)
+{
+    return Interpreter(regex, output, input, start, length).interpret();
+}
+
+
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoPatternCharacter) == (RegexStackSpaceForBackTrackInfoPatternCharacter * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoPatternCharacter);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoCharacterClass) == (RegexStackSpaceForBackTrackInfoCharacterClass * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoCharacterClass);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoBackReference) == (RegexStackSpaceForBackTrackInfoBackReference * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoBackReference);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoAlternative) == (RegexStackSpaceForBackTrackInfoAlternative * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoAlternative);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParentheticalAssertion) == (RegexStackSpaceForBackTrackInfoParentheticalAssertion * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParentheticalAssertion);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParenthesesOnce) == (RegexStackSpaceForBackTrackInfoParenthesesOnce * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParenthesesOnce);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParentheses) == (RegexStackSpaceForBackTrackInfoParentheses * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParentheses);
+
+
+} }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
new file mode 100644
index 0000000000..a8c122ac71
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexInterpreter_h
+#define RegexInterpreter_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/unicode/Unicode.h>
+#include "RegexParser.h"
+#include "RegexPattern.h"
+
+namespace JSC { namespace Yarr {
+
+class ByteDisjunction;
+
+struct ByteTerm {
+    enum Type {
+        TypeBodyAlternativeBegin,
+        TypeBodyAlternativeDisjunction,
+        TypeBodyAlternativeEnd,
+        TypeAlternativeBegin,
+        TypeAlternativeDisjunction,
+        TypeAlternativeEnd,
+        TypeSubpatternBegin,
+        TypeSubpatternEnd,
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacterOnce,
+        TypePatternCharacterFixed,
+        TypePatternCharacterGreedy,
+        TypePatternCharacterNonGreedy,
+        TypePatternCasedCharacterOnce,
+        TypePatternCasedCharacterFixed,
+        TypePatternCasedCharacterGreedy,
+        TypePatternCasedCharacterNonGreedy,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeParenthesesSubpattern,
+        TypeParenthesesSubpatternOnceBegin,
+        TypeParenthesesSubpatternOnceEnd,
+        TypeParentheticalAssertionBegin,
+        TypeParentheticalAssertionEnd,
+        TypeCheckInput,
+    } type;
+    bool invertOrCapture;
+    union {
+        struct {
+            union {
+                UChar patternCharacter;
+                struct {
+                    UChar lo;
+                    UChar hi;
+                } casedCharacter;
+                CharacterClass* characterClass;
+                unsigned subpatternId;
+            };
+            union {
+                ByteDisjunction* parenthesesDisjunction;
+                unsigned parenthesesWidth;
+            };
+            QuantifierType quantityType;
+            unsigned quantityCount;
+        } atom;
+        struct {
+            int next;
+            int end;
+        } alternative;
+        unsigned checkInputCount;
+    };
+    unsigned frameLocation;
+    int inputPosition;
+
+    ByteTerm(UChar ch, int inputPos, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+    {
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCharacterOnce : ByteTerm::TypePatternCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCharacterNonGreedy;
+            break;
+        }
+
+        atom.patternCharacter = ch;
+        atom.quantityType = quantityType;
+        atom.quantityCount = quantityCount;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(UChar lo, UChar hi, int inputPos, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+    {
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCasedCharacterOnce : ByteTerm::TypePatternCasedCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCasedCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCasedCharacterNonGreedy;
+            break;
+        }
+
+        atom.casedCharacter.lo = lo;
+        atom.casedCharacter.hi = hi;
+        atom.quantityType = quantityType;
+        atom.quantityCount = quantityCount;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(CharacterClass* characterClass, bool invert, int inputPos)
+        : type(ByteTerm::TypeCharacterClass)
+        , invertOrCapture(invert)
+    {
+        atom.characterClass = characterClass;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, ByteDisjunction* parenthesesInfo, bool invertOrCapture, int inputPos)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        atom.subpatternId = subpatternId;
+        atom.parenthesesDisjunction = parenthesesInfo;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+    
+    ByteTerm(Type type, bool invert = false)
+        : type(type)
+        , invertOrCapture(invert)
+    {
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, bool invertOrCapture, int inputPos)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        atom.subpatternId = subpatternId;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+
+    static ByteTerm BOL(int inputPos)
+    {
+        ByteTerm term(TypeAssertionBOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm CheckInput(unsigned count)
+    {
+        ByteTerm term(TypeCheckInput);
+        term.checkInputCount = count;
+        return term;
+    }
+
+    static ByteTerm EOL(int inputPos)
+    {
+        ByteTerm term(TypeAssertionEOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm WordBoundary(bool invert, int inputPos)
+    {
+        ByteTerm term(TypeAssertionWordBoundary, invert);
+        term.inputPosition = inputPos;
+        return term;
+    }
+    
+    static ByteTerm BackReference(unsigned subpatternId, int inputPos)
+    {
+        return ByteTerm(TypeBackReference, subpatternId, false, inputPos);
+    }
+
+    static ByteTerm BodyAlternativeBegin()
+    {
+        ByteTerm term(TypeBodyAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeDisjunction()
+    {
+        ByteTerm term(TypeBodyAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeEnd()
+    {
+        ByteTerm term(TypeBodyAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeBegin()
+    {
+        ByteTerm term(TypeAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeDisjunction()
+    {
+        ByteTerm term(TypeAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeEnd()
+    {
+        ByteTerm term(TypeAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm SubpatternBegin()
+    {
+        return ByteTerm(TypeSubpatternBegin);
+    }
+
+    static ByteTerm SubpatternEnd()
+    {
+        return ByteTerm(TypeSubpatternEnd);
+    }
+
+    bool invert()
+    {
+        return invertOrCapture;
+    }
+
+    bool capture()
+    {
+        return invertOrCapture;
+    }
+};
+
+class ByteDisjunction {
+public:
+    ByteDisjunction(unsigned numSubpatterns, unsigned frameSize)
+        : m_numSubpatterns(numSubpatterns)
+        , m_frameSize(frameSize)
+    {
+    }
+
+    Vector<ByteTerm> terms;
+    unsigned m_numSubpatterns;
+    unsigned m_frameSize;
+};
+
+struct BytecodePattern {
+    BytecodePattern(ByteDisjunction* body, Vector<ByteDisjunction*> allParenthesesInfo, RegexPattern& pattern)
+        : m_body(body)
+        , m_ignoreCase(pattern.m_ignoreCase)
+        , m_multiline(pattern.m_multiline)
+    {
+        newlineCharacterClass = pattern.newlineCharacterClass();
+        wordcharCharacterClass = pattern.wordcharCharacterClass();
+
+        m_allParenthesesInfo.append(allParenthesesInfo);
+        m_userCharacterClasses.append(pattern.m_userCharacterClasses);
+        // 'Steal' the RegexPattern's CharacterClasses!  We clear its
+        // array, so that it won't delete them on destruction.  We'll
+        // take responsibility for that.
+        pattern.m_userCharacterClasses.clear();
+    }
+
+    ~BytecodePattern()
+    {
+        deleteAllValues(m_allParenthesesInfo);
+        deleteAllValues(m_userCharacterClasses);
+    }
+
+    OwnPtr<ByteDisjunction> m_body;
+    bool m_ignoreCase;
+    bool m_multiline;
+    
+    CharacterClass* newlineCharacterClass;
+    CharacterClass* wordcharCharacterClass;
+private:
+    Vector<ByteDisjunction*> m_allParenthesesInfo;
+    Vector<CharacterClass*> m_userCharacterClasses;
+};
+
+BytecodePattern* byteCompileRegex(const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
+int interpretRegex(BytecodePattern* v_regex, const UChar* input, unsigned start, unsigned length, int* output);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexInterpreter_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
new file mode 100644
index 0000000000..a64dd8ddfa
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -0,0 +1,1390 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexJIT.h"
+
+#include "ASCIICType.h"
+#include "JSGlobalData.h"
+#include "MacroAssembler.h"
+#include "RegexCompiler.h"
+
+#include "pcre.h" // temporary, remove when fallback is removed.
+
+#if ENABLE(YARR_JIT)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+
+class RegexGenerator : private MacroAssembler {
+    friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
+
+#if PLATFORM(X86)
+    static const RegisterID input = X86::eax;
+    static const RegisterID index = X86::edx;
+    static const RegisterID length = X86::ecx;
+    static const RegisterID output = X86::edi;
+
+    static const RegisterID regT0 = X86::ebx;
+    static const RegisterID regT1 = X86::esi;
+
+    static const RegisterID returnRegister = X86::eax;
+#endif
+#if PLATFORM(X86_64)
+    static const RegisterID input = X86::edi;
+    static const RegisterID index = X86::esi;
+    static const RegisterID length = X86::edx;
+    static const RegisterID output = X86::ecx;
+
+    static const RegisterID regT0 = X86::eax;
+    static const RegisterID regT1 = X86::ebx;
+
+    static const RegisterID returnRegister = X86::eax;
+#endif
+
+    void optimizeAlternative(PatternAlternative* alternative)
+    {
+        if (!alternative->m_terms.size())
+            return;
+
+        for (unsigned i = 0; i < alternative->m_terms.size() - 1; ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+            PatternTerm& nextTerm = alternative->m_terms[i + 1];
+
+            if ((term.type == PatternTerm::TypeCharacterClass)
+                && (term.quantityType == QuantifierFixedCount)
+                && (nextTerm.type == PatternTerm::TypePatternCharacter)
+                && (nextTerm.quantityType == QuantifierFixedCount)) {
+                PatternTerm termCopy = term;
+                alternative->m_terms[i] = nextTerm;
+                alternative->m_terms[i + 1] = termCopy;
+            }
+        }
+    }
+
+    void matchCharacterClassRange(RegisterID character, JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount)
+    {
+        do {
+            // pick which range we're going to generate
+            int which = count >> 1;
+            char lo = ranges[which].begin;
+            char hi = ranges[which].end;
+            
+            // check if there are any ranges or matches below lo.  If not, just jl to failure -
+            // if there is anything else to check, check that first, if it falls through jmp to failure.
+            if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+                
+                // generate code for all ranges before this one
+                if (which)
+                    matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+                
+                while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                    matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
+                    ++*matchIndex;
+                }
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else if (which) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+
+                matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else
+                failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
+
+            while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
+                ++*matchIndex;
+
+            matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
+            // fall through to here, the value is above hi.
+
+            // shuffle along & loop around if there are any more matches to handle.
+            unsigned next = which + 1;
+            ranges += next;
+            count -= next;
+        } while (count);
+    }
+
+    void matchCharacterClass(RegisterID character, JumpList& matchDest, const CharacterClass* charClass)
+    {
+        Jump unicodeFail;
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size()) {
+            Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
+        
+            if (charClass->m_matchesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_matchesUnicode.size(); ++i) {
+                    UChar ch = charClass->m_matchesUnicode[i];
+                    matchDest.append(branch32(Equal, character, Imm32(ch)));
+                }
+            }
+            
+            if (charClass->m_rangesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_rangesUnicode.size(); ++i) {
+                    UChar lo = charClass->m_rangesUnicode[i].begin;
+                    UChar hi = charClass->m_rangesUnicode[i].end;
+                    
+                    Jump below = branch32(LessThan, character, Imm32(lo));
+                    matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
+                    below.link(this);
+                }
+            }
+
+            unicodeFail = jump();
+            isAscii.link(this);
+        }
+
+        if (charClass->m_ranges.size()) {
+            unsigned matchIndex = 0;
+            JumpList failures; 
+            matchCharacterClassRange(character, failures, matchDest, charClass->m_ranges.begin(), charClass->m_ranges.size(), &matchIndex, charClass->m_matches.begin(), charClass->m_matches.size());
+            while (matchIndex < charClass->m_matches.size())
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass->m_matches[matchIndex++])));
+
+            failures.link(this);
+        } else if (charClass->m_matches.size()) {
+            // optimization: gather 'a','A' etc back together, can mask & test once.
+            Vector<char> matchesAZaz;
+
+            for (unsigned i = 0; i < charClass->m_matches.size(); ++i) {
+                char ch = charClass->m_matches[i];
+                if (m_pattern.m_ignoreCase) {
+                    if (isASCIILower(ch)) {
+                        matchesAZaz.append(ch);
+                        continue;
+                    }
+                    if (isASCIIUpper(ch))
+                        continue;
+                }
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
+            }
+
+            if (unsigned countAZaz = matchesAZaz.size()) {
+                or32(Imm32(32), character);
+                for (unsigned i = 0; i < countAZaz; ++i)
+                    matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
+            }
+        }
+
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size())
+            unicodeFail.link(this);
+    }
+
+    // Jumps if input not available; will have (incorrectly) incremented already!
+    Jump jumpIfNoAvailableInput(unsigned countToCheck)
+    {
+        add32(Imm32(countToCheck), index);
+        return branch32(Above, index, length);
+    }
+
+    Jump jumpIfAvailableInput(unsigned countToCheck)
+    {
+        add32(Imm32(countToCheck), index);
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump checkInput()
+    {
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump atEndOfInput()
+    {
+        return branch32(Equal, index, length);
+    }
+
+    Jump notAtEndOfInput()
+    {
+        return branch32(NotEqual, index, length);
+    }
+
+    Jump jumpIfCharEquals(UChar ch, int inputPosition)
+    {
+        return branch16(Equal, BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), Imm32(ch));
+    }
+
+    Jump jumpIfCharNotEquals(UChar ch, int inputPosition)
+    {
+        return branch16(NotEqual, BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), Imm32(ch));
+    }
+
+    void readCharacter(int inputPosition, RegisterID reg)
+    {
+        load16(BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), reg);
+    }
+
+    void storeToFrame(RegisterID reg, unsigned frameLocation)
+    {
+        poke(reg, frameLocation);
+    }
+
+    void storeToFrame(Imm32 imm, unsigned frameLocation)
+    {
+        poke(imm, frameLocation);
+    }
+
+    DataLabelPtr storeToFrameWithPatch(unsigned frameLocation)
+    {
+        return storePtrWithPatch(ImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    void loadFromFrame(unsigned frameLocation, RegisterID reg)
+    {
+        peek(reg, frameLocation);
+    }
+
+    void loadFromFrameAndJump(unsigned frameLocation)
+    {
+        jump(Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    struct AlternativeBacktrackRecord {
+        DataLabelPtr dataLabel;
+        Label backtrackLocation;
+
+        AlternativeBacktrackRecord(DataLabelPtr dataLabel, Label backtrackLocation)
+            : dataLabel(dataLabel)
+            , backtrackLocation(backtrackLocation)
+        {
+        }
+    };
+
+    struct TermGenerationState {
+        TermGenerationState(PatternDisjunction* disjunction, unsigned checkedTotal)
+            : disjunction(disjunction)
+            , checkedTotal(checkedTotal)
+        {
+        }
+
+        void resetAlternative()
+        {
+            isBackTrackGenerated = false;
+            alt = 0;
+        }
+        bool alternativeValid()
+        {
+            return alt < disjunction->m_alternatives.size();
+        }
+        void nextAlternative()
+        {
+            ++alt;
+        }
+        PatternAlternative* alternative()
+        {
+            return disjunction->m_alternatives[alt];
+        }
+
+        void resetTerm()
+        {
+            ASSERT(alternativeValid());
+            t = 0;
+        }
+        bool termValid()
+        {
+            ASSERT(alternativeValid());
+            return t < alternative()->m_terms.size();
+        }
+        void nextTerm()
+        {
+            ASSERT(alternativeValid());
+            ++t;
+        }
+        PatternTerm& term()
+        {
+            ASSERT(alternativeValid());
+            return alternative()->m_terms[t];
+        }
+
+        PatternTerm& lookaheadTerm()
+        {
+            ASSERT(alternativeValid());
+            ASSERT((t + 1) < alternative()->m_terms.size());
+            return alternative()->m_terms[t + 1];
+        }
+        bool isSinglePatternCharacterLookaheadTerm()
+        {
+            ASSERT(alternativeValid());
+            return ((t + 1) < alternative()->m_terms.size())
+                && (lookaheadTerm().type == PatternTerm::TypePatternCharacter)
+                && (lookaheadTerm().quantityType == QuantifierFixedCount)
+                && (lookaheadTerm().quantityCount == 1);
+        }
+
+        int inputOffset()
+        {
+            return term().inputPosition - checkedTotal;
+        }
+
+        void jumpToBacktrack(Jump jump, MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated)
+                jump.linkTo(backtrackLabel, masm);
+            else
+                backTrackJumps.append(jump);
+        }
+        void jumpToBacktrack(JumpList& jumps, MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated)
+                jumps.linkTo(backtrackLabel, masm);
+            else
+                backTrackJumps.append(jumps);
+        }
+        bool plantJumpToBacktrackIfExists(MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated) {
+                masm->jump(backtrackLabel);
+                return true;
+            }
+            return false;
+        }
+        void addBacktrackJump(Jump jump)
+        {
+            backTrackJumps.append(jump);
+        }
+        void setBacktrackGenerated(Label label)
+        {
+            isBackTrackGenerated = true;
+            backtrackLabel = label;
+        }
+        void linkAlternativeBacktracks(MacroAssembler* masm)
+        {
+            isBackTrackGenerated = false;
+            backTrackJumps.link(masm);
+        }
+        void linkAlternativeBacktracksTo(Label label, MacroAssembler* masm)
+        {
+            isBackTrackGenerated = false;
+            backTrackJumps.linkTo(label, masm);
+        }
+        void propagateBacktrackingFrom(TermGenerationState& nestedParenthesesState, MacroAssembler* masm)
+        {
+            jumpToBacktrack(nestedParenthesesState.backTrackJumps, masm);
+            if (nestedParenthesesState.isBackTrackGenerated)
+                setBacktrackGenerated(nestedParenthesesState.backtrackLabel);
+        }
+
+        PatternDisjunction* disjunction;
+        int checkedTotal;
+    private:
+        unsigned alt;
+        unsigned t;
+        JumpList backTrackJumps;
+        Label backtrackLabel;
+        bool isBackTrackGenerated;
+    };
+
+    void generateAssertionBOL(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        if (m_pattern.m_multiline) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (!term.inputPosition)
+                matchDest.append(branch32(Equal, index, Imm32(state.checkedTotal)));
+
+            readCharacter(state.inputOffset() - 1, character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            state.jumpToBacktrack(jump(), this);
+
+            matchDest.link(this);
+        } else {
+            // Erk, really should poison out these alternatives early. :-/
+            if (term.inputPosition)
+                state.jumpToBacktrack(jump(), this);
+            else
+                state.jumpToBacktrack(branch32(NotEqual, index, Imm32(state.checkedTotal)), this);
+        }
+    }
+
+    void generateAssertionEOL(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        if (m_pattern.m_multiline) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (term.inputPosition == state.checkedTotal)
+                matchDest.append(atEndOfInput());
+
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            state.jumpToBacktrack(jump(), this);
+
+            matchDest.link(this);
+        } else {
+            if (term.inputPosition == state.checkedTotal)
+                state.jumpToBacktrack(notAtEndOfInput(), this);
+            // Erk, really should poison out these alternatives early. :-/
+            else
+                state.jumpToBacktrack(jump(), this);
+        }
+    }
+
+    // Also falls though on nextIsNotWordChar.
+    void matchAssertionWordchar(TermGenerationState& state, JumpList& nextIsWordChar, JumpList& nextIsNotWordChar)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        if (term.inputPosition == state.checkedTotal)
+            nextIsNotWordChar.append(atEndOfInput());
+
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, nextIsWordChar, m_pattern.wordcharCharacterClass());
+    }
+
+    void generateAssertionWordBoundary(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        Jump atBegin;
+        JumpList matchDest;
+        if (!term.inputPosition)
+            atBegin = branch32(Equal, index, Imm32(state.checkedTotal));
+        readCharacter(state.inputOffset() - 1, character);
+        matchCharacterClass(character, matchDest, m_pattern.wordcharCharacterClass());
+        if (!term.inputPosition)
+            atBegin.link(this);
+
+        // We fall through to here if the last character was not a wordchar.
+        JumpList nonWordCharThenWordChar;
+        JumpList nonWordCharThenNonWordChar;
+        if (term.invertOrCapture) {
+            matchAssertionWordchar(state, nonWordCharThenNonWordChar, nonWordCharThenWordChar);
+            nonWordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(state, nonWordCharThenWordChar, nonWordCharThenNonWordChar);
+            nonWordCharThenNonWordChar.append(jump());
+        }
+        state.jumpToBacktrack(nonWordCharThenNonWordChar, this);
+
+        // We jump here if the last character was a wordchar.
+        matchDest.link(this);
+        JumpList wordCharThenWordChar;
+        JumpList wordCharThenNonWordChar;
+        if (term.invertOrCapture) {
+            matchAssertionWordchar(state, wordCharThenNonWordChar, wordCharThenWordChar);
+            wordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(state, wordCharThenWordChar, wordCharThenNonWordChar);
+            // This can fall-though!
+        }
+
+        state.jumpToBacktrack(wordCharThenWordChar, this);
+        
+        nonWordCharThenWordChar.link(this);
+        wordCharThenNonWordChar.link(this);
+    }
+
+    void generatePatternCharacterSingle(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        UChar ch = state.term().patternCharacter;
+
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))), this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            state.jumpToBacktrack(jumpIfCharNotEquals(ch, state.inputOffset()), this);
+        }
+    }
+
+    void generatePatternCharacterPair(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        UChar ch1 = state.term().patternCharacter;
+        UChar ch2 = state.lookaheadTerm().patternCharacter;
+
+        int mask = 0;
+        int chPair = ch1 | (ch2 << 16);
+        
+        if (m_pattern.m_ignoreCase) {
+            if (isASCIIAlpha(ch1))
+                mask |= 32;
+            if (isASCIIAlpha(ch2))
+                mask |= 32 << 16;
+        }
+
+        if (mask) {
+            load32(BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), character);
+            or32(Imm32(mask), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(chPair | mask)), this);
+        } else
+            state.jumpToBacktrack(branch32(NotEqual, BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), Imm32(chPair)), this);
+    }
+
+    void generatePatternCharacterFixed(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+
+        move(index, countRegister);
+        sub32(Imm32(term.quantityCount), countRegister);
+
+        Label loop(this);
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
+            or32(Imm32(32), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))), this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            state.jumpToBacktrack(branch16(NotEqual, BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), Imm32(ch)), this);
+        }
+        add32(Imm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+
+    void generatePatternCharacterGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+    
+        move(Imm32(0), countRegister);
+
+        JumpList failures;
+        Label loop(this);
+        failures.append(atEndOfInput());
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            failures.append(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            failures.append(jumpIfCharNotEquals(ch, state.inputOffset()));
+        }
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+        branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
+        failures.append(jump());
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+        state.jumpToBacktrack(branchTest32(Zero, countRegister), this);
+        sub32(Imm32(1), countRegister);
+        sub32(Imm32(1), index);
+
+        failures.link(this);
+
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generatePatternCharacterNonGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+    
+        move(Imm32(0), countRegister);
+
+        Jump firstTimeDoNothing = jump();
+
+        Label hardFail(this);
+        sub32(countRegister, index);
+        state.jumpToBacktrack(jump(), this);
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+
+        atEndOfInput().linkTo(hardFail, this);
+        branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            branch32(NotEqual, character, Imm32(Unicode::toLower(ch))).linkTo(hardFail, this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            jumpIfCharNotEquals(ch, state.inputOffset()).linkTo(hardFail, this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+
+        firstTimeDoNothing.link(this);
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateCharacterClassSingle(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        JumpList matchDest;
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            state.jumpToBacktrack(matchDest, this);
+        else {
+            state.jumpToBacktrack(jump(), this);
+            matchDest.link(this);
+        }
+    }
+
+    void generateCharacterClassFixed(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+
+        move(index, countRegister);
+        sub32(Imm32(term.quantityCount), countRegister);
+
+        Label loop(this);
+        JumpList matchDest;
+        load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            state.jumpToBacktrack(matchDest, this);
+        else {
+            state.jumpToBacktrack(jump(), this);
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+
+    void generateCharacterClassGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+    
+        move(Imm32(0), countRegister);
+
+        JumpList failures;
+        Label loop(this);
+        failures.append(atEndOfInput());
+
+        if (term.invertOrCapture) {
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, failures, term.characterClass);
+        } else {
+            JumpList matchDest;
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, matchDest, term.characterClass);
+            failures.append(jump());
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+        branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
+        failures.append(jump());
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+        state.jumpToBacktrack(branchTest32(Zero, countRegister), this);
+        sub32(Imm32(1), countRegister);
+        sub32(Imm32(1), index);
+
+        failures.link(this);
+
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateCharacterClassNonGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+    
+        move(Imm32(0), countRegister);
+
+        Jump firstTimeDoNothing = jump();
+
+        Label hardFail(this);
+        sub32(countRegister, index);
+        state.jumpToBacktrack(jump(), this);
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+
+        atEndOfInput().linkTo(hardFail, this);
+        branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
+
+        JumpList matchDest;
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            matchDest.linkTo(hardFail, this);
+        else {
+            jump(hardFail);
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+
+        firstTimeDoNothing.link(this);
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateParenthesesDisjunction(PatternTerm& parenthesesTerm, TermGenerationState& state, unsigned alternativeFrameLocation)
+    {
+        ASSERT((parenthesesTerm.type == PatternTerm::TypeParenthesesSubpattern) || (parenthesesTerm.type == PatternTerm::TypeParentheticalAssertion));
+        ASSERT(parenthesesTerm.quantityCount == 1);
+    
+        PatternDisjunction* disjunction = parenthesesTerm.parentheses.disjunction;
+        unsigned preCheckedCount = ((parenthesesTerm.quantityType == QuantifierFixedCount) && (parenthesesTerm.type != PatternTerm::TypeParentheticalAssertion)) ? disjunction->m_minimumSize : 0;
+
+        if (disjunction->m_alternatives.size() == 1) {
+            state.resetAlternative();
+            ASSERT(state.alternativeValid());
+            PatternAlternative* alternative = state.alternative();
+            optimizeAlternative(alternative);
+
+            int countToCheck = alternative->m_minimumSize - preCheckedCount;
+            if (countToCheck) {
+                ASSERT((parenthesesTerm.type == PatternTerm::TypeParentheticalAssertion) || (parenthesesTerm.quantityType != QuantifierFixedCount));
+
+                // FIXME: This is quite horrible.  The call to 'plantJumpToBacktrackIfExists'
+                // will be forced to always trampoline into here, just to decrement the index.
+                // Ick. 
+                Jump skip = jump();
+
+                Label backtrackBegin(this);
+                sub32(Imm32(countToCheck), index);
+                state.addBacktrackJump(jump());
+                
+                skip.link(this);
+
+                state.setBacktrackGenerated(backtrackBegin);
+
+                state.jumpToBacktrack(jumpIfNoAvailableInput(countToCheck), this);
+                state.checkedTotal += countToCheck;
+            }
+
+            for (state.resetTerm(); state.termValid(); state.nextTerm())
+                generateTerm(state);
+
+            state.checkedTotal -= countToCheck;
+        } else {
+            JumpList successes;
+
+            for (state.resetAlternative(); state.alternativeValid(); state.nextAlternative()) {
+
+                PatternAlternative* alternative = state.alternative();
+                optimizeAlternative(alternative);
+
+                ASSERT(alternative->m_minimumSize >= preCheckedCount);
+                int countToCheck = alternative->m_minimumSize - preCheckedCount;
+                if (countToCheck) {
+                    state.addBacktrackJump(jumpIfNoAvailableInput(countToCheck));
+                    state.checkedTotal += countToCheck;
+                }
+
+                for (state.resetTerm(); state.termValid(); state.nextTerm())
+                    generateTerm(state);
+
+                // Matched an alternative.
+                DataLabelPtr dataLabel = storeToFrameWithPatch(alternativeFrameLocation);
+                successes.append(jump());
+
+                // Alternative did not match.
+                Label backtrackLocation(this);
+                
+                // Can we backtrack the alternative? - if so, do so.  If not, just fall through to the next one.
+                state.plantJumpToBacktrackIfExists(this);
+                
+                state.linkAlternativeBacktracks(this);
+
+                if (countToCheck) {
+                    sub32(Imm32(countToCheck), index);
+                    state.checkedTotal -= countToCheck;
+                }
+
+                m_backtrackRecords.append(AlternativeBacktrackRecord(dataLabel, backtrackLocation));
+            }
+            // We fall through to here when the last alternative fails.
+            // Add a backtrack out of here for the parenthese handling code to link up.
+            state.addBacktrackJump(jump());
+
+            // Generate a trampoline for the parens code to backtrack to, to retry the
+            // next alternative.
+            state.setBacktrackGenerated(label());
+            loadFromFrameAndJump(alternativeFrameLocation);
+
+            // FIXME: both of the above hooks are a little inefficient, in that you
+            // may end up trampolining here, just to trampoline back out to the
+            // parentheses code, or vice versa.  We can probably eliminate a jump
+            // by restructuring, but coding this way for now for simplicity during
+            // development.
+
+            successes.link(this);
+        }
+    }
+
+    void generateParenthesesSingle(TermGenerationState& state)
+    {
+        const RegisterID indexTemporary = regT0;
+        PatternTerm& term = state.term();
+        PatternDisjunction* disjunction = term.parentheses.disjunction;
+        ASSERT(term.quantityCount == 1);
+
+        unsigned preCheckedCount = ((term.quantityCount == 1) && (term.quantityType == QuantifierFixedCount)) ? disjunction->m_minimumSize : 0;
+
+        unsigned parenthesesFrameLocation = term.frameLocation;
+        unsigned alternativeFrameLocation = parenthesesFrameLocation;
+        if (term.quantityType != QuantifierFixedCount)
+            alternativeFrameLocation += RegexStackSpaceForBackTrackInfoParenthesesOnce;
+
+        // optimized case - no capture & no quantifier can be handled in a light-weight manner.
+        if (!term.invertOrCapture && (term.quantityType == QuantifierFixedCount)) {
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // this expects that any backtracks back out of the parentheses will be in the
+            // parenthesesState's backTrackJumps vector, and that if they need backtracking
+            // they will have set an entry point on the parenthesesState's backtrackLabel.
+            state.propagateBacktrackingFrom(parenthesesState, this);
+        } else {
+            Jump nonGreedySkipParentheses;
+            Label nonGreedyTryParentheses;
+            if (term.quantityType == QuantifierGreedy)
+                storeToFrame(Imm32(1), parenthesesFrameLocation);
+            else if (term.quantityType == QuantifierNonGreedy) {
+                storeToFrame(Imm32(0), parenthesesFrameLocation);
+                nonGreedySkipParentheses = jump();
+                nonGreedyTryParentheses = label();
+                storeToFrame(Imm32(1), parenthesesFrameLocation);
+            }
+
+            // store the match start index
+            if (term.invertOrCapture) {
+                int inputOffset = state.inputOffset() - preCheckedCount;
+                if (inputOffset) {
+                    move(index, indexTemporary);
+                    add32(Imm32(inputOffset), indexTemporary);
+                    store32(indexTemporary, Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+                } else
+                    store32(index, Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+            }
+
+            // generate the body of the parentheses
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+
+            // store the match end index
+            if (term.invertOrCapture) {
+                int inputOffset = state.inputOffset();
+                if (inputOffset) {
+                    move(index, indexTemporary);
+                    add32(Imm32(state.inputOffset()), indexTemporary);
+                    store32(indexTemporary, Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+                } else
+                    store32(index, Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+            }
+            Jump success = jump();
+
+            // A failure AFTER the parens jumps here
+            Label backtrackFromAfterParens(this);
+
+            if (term.quantityType == QuantifierGreedy) {
+                // If this is zero we have now tested with both with and without the parens.
+                loadFromFrame(parenthesesFrameLocation, indexTemporary);
+                state.jumpToBacktrack(branchTest32(Zero, indexTemporary), this);
+            } else if (term.quantityType == QuantifierNonGreedy) {
+                // If this is zero we have now tested with both with and without the parens.
+                loadFromFrame(parenthesesFrameLocation, indexTemporary);
+                branchTest32(Zero, indexTemporary).linkTo(nonGreedyTryParentheses, this);
+            }
+
+            parenthesesState.plantJumpToBacktrackIfExists(this);
+            // A failure WITHIN the parens jumps here
+            parenthesesState.linkAlternativeBacktracks(this);
+            if (term.invertOrCapture) {
+                store32(Imm32(-1), Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+                store32(Imm32(-1), Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+            }
+
+            if (term.quantityType == QuantifierGreedy)
+                storeToFrame(Imm32(0), parenthesesFrameLocation);
+            else
+                state.jumpToBacktrack(jump(), this);
+
+            state.setBacktrackGenerated(backtrackFromAfterParens);
+            if (term.quantityType == QuantifierNonGreedy)
+                nonGreedySkipParentheses.link(this);
+            success.link(this);
+        }
+    }
+
+    void generateParentheticalAssertion(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+        PatternDisjunction* disjunction = term.parentheses.disjunction;
+        ASSERT(term.quantityCount == 1);
+        ASSERT(term.quantityType == QuantifierFixedCount);
+
+        unsigned parenthesesFrameLocation = term.frameLocation;
+        unsigned alternativeFrameLocation = parenthesesFrameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+
+        int countCheckedAfterAssertion = state.checkedTotal - term.inputPosition;
+
+        if (term.invertOrCapture) {
+            // Inverted case
+            storeToFrame(index, parenthesesFrameLocation);
+
+            state.checkedTotal -= countCheckedAfterAssertion;
+            if (countCheckedAfterAssertion)
+                sub32(Imm32(countCheckedAfterAssertion), index);
+
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // Success! - which means - Fail!
+            loadFromFrame(parenthesesFrameLocation, index);
+            state.jumpToBacktrack(jump(), this);
+
+            // And fail means success.
+            parenthesesState.linkAlternativeBacktracks(this);
+            loadFromFrame(parenthesesFrameLocation, index);
+
+            state.checkedTotal += countCheckedAfterAssertion;
+        } else {
+            // Normal case
+            storeToFrame(index, parenthesesFrameLocation);
+
+            state.checkedTotal -= countCheckedAfterAssertion;
+            if (countCheckedAfterAssertion)
+                sub32(Imm32(countCheckedAfterAssertion), index);
+
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // Success! - which means - Success!
+            loadFromFrame(parenthesesFrameLocation, index);
+            Jump success = jump();
+
+            parenthesesState.linkAlternativeBacktracks(this);
+            loadFromFrame(parenthesesFrameLocation, index);
+            state.jumpToBacktrack(jump(), this);
+
+            success.link(this);
+
+            state.checkedTotal += countCheckedAfterAssertion;
+        }
+    }
+
+    void generateTerm(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        switch (term.type) {
+        case PatternTerm::TypeAssertionBOL:
+            generateAssertionBOL(state);
+            break;
+        
+        case PatternTerm::TypeAssertionEOL:
+            generateAssertionEOL(state);
+            break;
+        
+        case PatternTerm::TypeAssertionWordBoundary:
+            generateAssertionWordBoundary(state);
+            break;
+        
+        case PatternTerm::TypePatternCharacter:
+            switch (term.quantityType) {
+            case QuantifierFixedCount:
+                if (term.quantityCount == 1) {
+                    if (state.isSinglePatternCharacterLookaheadTerm() && (state.lookaheadTerm().inputPosition == (term.inputPosition + 1))) {
+                        generatePatternCharacterPair(state);
+                        state.nextTerm();
+                    } else
+                        generatePatternCharacterSingle(state);
+                } else
+                    generatePatternCharacterFixed(state);
+                break;
+            case QuantifierGreedy:
+                generatePatternCharacterGreedy(state);
+                break;
+            case QuantifierNonGreedy:
+                generatePatternCharacterNonGreedy(state);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeCharacterClass:
+            switch (term.quantityType) {
+            case QuantifierFixedCount:
+                if (term.quantityCount == 1)
+                    generateCharacterClassSingle(state);
+                else
+                    generateCharacterClassFixed(state);
+                break;
+            case QuantifierGreedy:
+                generateCharacterClassGreedy(state);
+                break;
+            case QuantifierNonGreedy:
+                generateCharacterClassNonGreedy(state);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeBackReference:
+            m_generationFailed = true;
+            break;
+
+        case PatternTerm::TypeForwardReference:
+            break;
+
+        case PatternTerm::TypeParenthesesSubpattern:
+            if ((term.quantityCount == 1) && !term.parentheses.isCopy)
+                generateParenthesesSingle(state);
+            else
+                m_generationFailed = true;
+            break;
+
+        case PatternTerm::TypeParentheticalAssertion:
+            generateParentheticalAssertion(state);
+            break;
+        }
+    }
+
+    void generateDisjunction(PatternDisjunction* disjunction)
+    {
+        TermGenerationState state(disjunction, 0);
+        state.resetAlternative();
+
+        // Plant a check to see if there is sufficient input available to run the first alternative.
+        // Jumping back to the label 'firstAlternative' will get to this check, jumping to
+        // 'firstAlternativeInputChecked' will jump directly to matching the alternative having
+        // skipped this check.
+
+        Label firstAlternative(this);
+
+        // check availability for the next alternative
+        int countCheckedForCurrentAlternative = 0;
+        int countToCheckForFirstAlternative = 0;
+        bool hasShorterAlternatives = false;
+        JumpList notEnoughInputForPreviousAlternative;
+
+        if (state.alternativeValid()) {
+            PatternAlternative* alternative = state.alternative();
+            countToCheckForFirstAlternative = alternative->m_minimumSize;
+            state.checkedTotal += countToCheckForFirstAlternative;
+            if (countToCheckForFirstAlternative)
+                notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForFirstAlternative));
+            countCheckedForCurrentAlternative = countToCheckForFirstAlternative;
+        }
+
+        Label firstAlternativeInputChecked(this);
+
+        while (state.alternativeValid()) {
+            // Track whether any alternatives are shorter than the first one.
+            hasShorterAlternatives = hasShorterAlternatives || (countCheckedForCurrentAlternative < countToCheckForFirstAlternative);
+
+            PatternAlternative* alternative = state.alternative();
+            optimizeAlternative(alternative);
+
+            for (state.resetTerm(); state.termValid(); state.nextTerm())
+                generateTerm(state);
+
+            // If we get here, the alternative matched.
+            if (m_pattern.m_body->m_callFrameSize)
+                addPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
+            
+            ASSERT(index != returnRegister);
+            if (m_pattern.m_body->m_hasFixedSize) {
+                move(index, returnRegister);
+                if (alternative->m_minimumSize)
+                    sub32(Imm32(alternative->m_minimumSize), returnRegister);
+            } else
+                pop(returnRegister);
+            store32(index, Address(output, 4));
+            store32(returnRegister, output);
+
+            generateReturn();
+
+            state.nextAlternative();
+
+            // if there are any more alternatives, plant the check for input before looping.
+            if (state.alternativeValid()) {
+                PatternAlternative* nextAlternative = state.alternative();
+                int countToCheckForNextAlternative = nextAlternative->m_minimumSize;
+
+                if (countCheckedForCurrentAlternative > countToCheckForNextAlternative) { // CASE 1: current alternative was longer than the next one.
+                    // If we get here, there the last input checked failed.
+                    notEnoughInputForPreviousAlternative.link(this);
+
+                    // Check if sufficent input available to run the next alternative 
+                    notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForNextAlternative - countCheckedForCurrentAlternative));
+                    // We are now in the correct state to enter the next alternative; this add is only required
+                    // to mirror and revert operation of the sub32, just below.
+                    add32(Imm32(countCheckedForCurrentAlternative - countToCheckForNextAlternative), index);
+
+                    // If we get here, there the last input checked passed.
+                    state.linkAlternativeBacktracks(this);
+                    // No need to check if we can run the next alternative, since it is shorter -
+                    // just update index.
+                    sub32(Imm32(countCheckedForCurrentAlternative - countToCheckForNextAlternative), index);
+                } else if (countCheckedForCurrentAlternative < countToCheckForNextAlternative) { // CASE 2: next alternative is longer than the current one.
+                    // If we get here, there the last input checked failed.
+                    // If there is insufficient input to run the current alternative, and the next alternative is longer,
+                    // then there is definitely not enough input to run it - don't even check. Just adjust index, as if
+                    // we had checked.
+                    notEnoughInputForPreviousAlternative.link(this);
+                    add32(Imm32(countToCheckForNextAlternative - countCheckedForCurrentAlternative), index);
+                    notEnoughInputForPreviousAlternative.append(jump());
+
+                    // The next alternative is longer than the current one; check the difference.
+                    state.linkAlternativeBacktracks(this);
+                    notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForNextAlternative - countCheckedForCurrentAlternative));
+                } else { // CASE 3: Both alternatives are the same length.
+                    ASSERT(countCheckedForCurrentAlternative == countToCheckForNextAlternative);
+
+                    // If the next alterative is the same length as this one, then no need to check the input -
+                    // if there was sufficent input to run the current alternative then there is sufficient
+                    // input to run the next one; if not, there isn't.
+                    state.linkAlternativeBacktracks(this);
+                }
+
+                state.checkedTotal -= countCheckedForCurrentAlternative;
+                countCheckedForCurrentAlternative = countToCheckForNextAlternative;
+                state.checkedTotal += countCheckedForCurrentAlternative;
+            }
+        }
+        
+        // If we get here, all Alternatives failed...
+
+        state.checkedTotal -= countCheckedForCurrentAlternative;
+
+        // How much more input need there be to be able to retry from the first alternative?
+        // examples:
+        //   /yarr_jit/ or /wrec|pcre/
+        //     In these examples we need check for one more input before looping.
+        //   /yarr_jit|pcre/
+        //     In this case we need check for 5 more input to loop (+4 to allow for the first alterative
+        //     being four longer than the last alternative checked, and another +1 to effectively move
+        //     the start position along by one).
+        //   /yarr|rules/ or /wrec|notsomuch/
+        //     In these examples, provided that there was sufficient input to have just been matching for
+        //     the second alternative we can loop without checking for available input (since the second
+        //     alternative is longer than the first).  In the latter example we need to decrement index
+        //     (by 4) so the start position is only progressed by 1 from the last iteration.
+        int incrementForNextIter = (countToCheckForFirstAlternative - countCheckedForCurrentAlternative) + 1;
+
+        // First, deal with the cases where there was sufficient input to try the last alternative.
+        if (incrementForNextIter > 0) // We need to check for more input anyway, fall through to the checking below.
+            state.linkAlternativeBacktracks(this);
+        else if (m_pattern.m_body->m_hasFixedSize && !incrementForNextIter) // No need to update anything, link these backtracks straight to the to pof the loop!
+            state.linkAlternativeBacktracksTo(firstAlternativeInputChecked, this);
+        else { // no need to check the input, but we do have some bookkeeping to do first.
+            state.linkAlternativeBacktracks(this);
+
+            // Where necessary update our preserved start position.
+            if (!m_pattern.m_body->m_hasFixedSize) {
+                move(index, regT0);
+                sub32(Imm32(countCheckedForCurrentAlternative - 1), regT0);
+                poke(regT0, m_pattern.m_body->m_callFrameSize);
+            }
+
+            // Update index if necessary, and loop (without checking).
+            if (incrementForNextIter)
+                add32(Imm32(incrementForNextIter), index);
+            jump().linkTo(firstAlternativeInputChecked, this);
+        }
+
+        notEnoughInputForPreviousAlternative.link(this);
+        // Update our idea of the start position, if we're tracking this.
+        if (!m_pattern.m_body->m_hasFixedSize) {
+            if (countCheckedForCurrentAlternative - 1) {
+                move(index, regT0);
+                sub32(Imm32(countCheckedForCurrentAlternative - 1), regT0);
+                poke(regT0, m_pattern.m_body->m_callFrameSize);
+            } else
+                poke(index, m_pattern.m_body->m_callFrameSize);
+        }
+        // Check if there is sufficent input to run the first alternative again.
+        jumpIfAvailableInput(incrementForNextIter).linkTo(firstAlternativeInputChecked, this);
+        // No - insufficent input to run the first alteranative, are there any other alternatives we
+        // might need to check?  If so, the last check will have left the index incremented by
+        // (countToCheckForFirstAlternative + 1), so we need test whether countToCheckForFirstAlternative
+        // LESS input is available, to have the effect of just progressing the start position by 1
+        // from the last iteration.  If this check passes we can just jump up to the check associated
+        // with the first alternative in the loop.  This is a bit sad, since we'll end up trying the
+        // first alternative again, and this check will fail (otherwise the check planted just above
+        // here would have passed).  This is a bit sad, however it saves trying to do something more
+        // complex here in compilation, and in the common case we should end up coallescing the checks.
+        //
+        // FIXME: a nice improvement here may be to stop trying to match sooner, based on the least
+        // of the minimum-alterantive-lengths.  E.g. if I have two alternatives of length 200 and 150,
+        // and a string of length 100, we'll end up looping index from 0 to 100, checking whether there
+        // is sufficient input to run either alternative (constantly failing).  If there had been only
+        // one alternative, or if the shorter alternative had come first, we would have terminated
+        // immediately. :-/
+        if (hasShorterAlternatives)
+            jumpIfAvailableInput(-countToCheckForFirstAlternative).linkTo(firstAlternative, this);
+        // index will now be a bit garbled (depending on whether 'hasShorterAlternatives' is true,
+        // it has either been incremented by 1 or by (countToCheckForFirstAlternative + 1) ... 
+        // but since we're about to return a failure this doesn't really matter!)
+
+        unsigned frameSize = m_pattern.m_body->m_callFrameSize;
+        if (!m_pattern.m_body->m_hasFixedSize)
+            ++frameSize;
+        if (frameSize)
+            addPtr(Imm32(frameSize * sizeof(void*)), stackPointerRegister);
+
+        move(Imm32(-1), returnRegister);
+
+        generateReturn();
+    }
+
+    void generateEnter()
+    {
+        // On x86 edi & esi are callee preserved registers.
+        push(X86::ebp);
+        move(stackPointerRegister, X86::ebp);
+#if PLATFORM(X86)
+        // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
+        push(X86::ebx);
+        push(X86::edi);
+        push(X86::esi);
+        // load output into edi (2 = saved ebp + return address).
+#if COMPILER(MSVC)
+        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), input);
+        loadPtr(Address(X86::ebp, 3 * sizeof(void*)), index);
+        loadPtr(Address(X86::ebp, 4 * sizeof(void*)), length);
+        loadPtr(Address(X86::ebp, 5 * sizeof(void*)), output);
+#else
+        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), output);
+#endif
+#endif
+    }
+
+    void generateReturn()
+    {
+#if PLATFORM(X86)
+        pop(X86::esi);
+        pop(X86::edi);
+        pop(X86::ebx);
+#endif
+        pop(X86::ebp);
+        ret();
+    }
+
+public:
+    RegexGenerator(RegexPattern& pattern)
+        : m_pattern(pattern)
+        , m_generationFailed(false)
+    {
+    }
+
+    void generate()
+    {
+        generateEnter();
+
+        // TODO: do I really want this on the stack?
+        if (!m_pattern.m_body->m_hasFixedSize)
+            push(index);
+
+        if (m_pattern.m_body->m_callFrameSize)
+            subPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
+
+        generateDisjunction(m_pattern.m_body);
+    }
+
+    void compile(JSGlobalData* globalData, RegexCodeBlock& jitObject)
+    {
+        generate();
+
+        PatchBuffer patchBuffer(this, globalData->executableAllocator.poolForSize(size()));
+
+        for (unsigned i = 0; i < m_backtrackRecords.size(); ++i)
+            patchBuffer.patch(m_backtrackRecords[i].dataLabel, patchBuffer.locationOf(m_backtrackRecords[i].backtrackLocation));
+
+        jitObject.set(patchBuffer.finalizeCode());
+    }
+
+    bool generationFailed()
+    {
+        return m_generationFailed;
+    }
+
+private:
+    RegexPattern& m_pattern;
+    Vector<AlternativeBacktrackRecord> m_backtrackRecords;
+    bool m_generationFailed;
+};
+
+void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& patternString, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline)
+{
+    RegexPattern pattern(ignoreCase, multiline);
+
+    if ((error = compileRegex(patternString, pattern)))
+        return;
+
+    numSubpatterns = pattern.m_numSubpatterns;
+
+    RegexGenerator generator(pattern);
+    generator.compile(globalData, jitObject);
+
+    if (generator.generationFailed()) {
+        JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
+        JSRegExpMultilineOption multilineOption = multiline ? JSRegExpMultiline : JSRegExpSingleLine;
+        jitObject.setFallback(jsRegExpCompile(reinterpret_cast<const UChar*>(patternString.data()), patternString.size(), ignoreCaseOption, multilineOption, &numSubpatterns, &error));
+    }
+}
+
+int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
+{
+    if (JSRegExp* fallback = jitObject.getFallback())
+        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
+
+    return jitObject.execute(input, start, length, output);
+}
+
+}}
+
+#endif
+
+
+
+
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
new file mode 100644
index 0000000000..5b0df9dde0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexJIT_h
+#define RegexJIT_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR_JIT)
+
+#include "MacroAssembler.h"
+#include "RegexPattern.h"
+#include <UString.h>
+
+#include <pcre.h>
+struct JSRegExp; // temporary, remove when fallback is removed.
+
+#if PLATFORM(X86) && !COMPILER(MSVC)
+#define YARR_CALL __attribute__ ((regparm (3)))
+#else
+#define YARR_CALL
+#endif
+
+namespace JSC {
+
+class JSGlobalData;
+class ExecutablePool;
+
+namespace Yarr {
+
+class RegexCodeBlock {
+    typedef int (*RegexJITCode)(const UChar* input, unsigned start, unsigned length, int* output) YARR_CALL;
+
+public:
+    RegexCodeBlock()
+        : m_fallback(0)
+    {
+    }
+
+    ~RegexCodeBlock()
+    {
+        if (m_fallback)
+            jsRegExpFree(m_fallback);
+    }
+
+    JSRegExp* getFallback() { return m_fallback; }
+    void setFallback(JSRegExp* fallback) { m_fallback = fallback; }
+
+    bool operator!() { return !m_ref.m_code.executableAddress(); }
+    void set(MacroAssembler::CodeRef ref) { m_ref = ref; }
+
+    int execute(const UChar* input, unsigned start, unsigned length, int* output)
+    {
+        return reinterpret_cast<RegexJITCode>(m_ref.m_code.executableAddress())(input, start, length, output);
+    }
+
+private:
+    MacroAssembler::CodeRef m_ref;
+    JSRegExp* m_fallback;
+};
+
+void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
+int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexJIT_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
new file mode 100644
index 0000000000..64e8463054
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
@@ -0,0 +1,854 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexParser_h
+#define RegexParser_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <UString.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/unicode/Unicode.h>
+#include <limits.h>
+
+namespace JSC { namespace Yarr {
+
+enum BuiltInCharacterClassID {
+    DigitClassID,
+    SpaceClassID,
+    WordClassID,
+    NewlineClassID,
+};
+
+// The Parser class should not be used directly - only via the Yarr::parse() method.
+template<class Delegate>
+class Parser {
+private:
+    template<class FriendDelegate>
+    friend const char* parse(FriendDelegate& delegate, const UString& pattern, unsigned backReferenceLimit);
+
+    enum ErrorCode {
+        NoError,
+        PatternTooLarge,
+        QuantifierOutOfOrder,
+        QuantifierWithoutAtom,
+        MissingParentheses,
+        ParenthesesUnmatched,
+        ParenthesesTypeInvalid,
+        CharacterClassUnmatched,
+        CharacterClassOutOfOrder,
+        EscapeUnterminated,
+        NumberOfErrorCodes
+    };
+
+    /*
+     * CharacterClassParserDelegate:
+     *
+     * The class CharacterClassParserDelegate is used in the parsing of character
+     * classes.  This class handles detection of character ranges.  This class
+     * implements enough of the delegate interface such that it can be passed to
+     * parseEscape() as an EscapeDelegate.  This allows parseEscape() to be reused
+     * to perform the parsing of escape characters in character sets.
+     */
+    class CharacterClassParserDelegate {
+    public:
+        CharacterClassParserDelegate(Delegate& delegate, ErrorCode& err)
+            : m_delegate(delegate)
+            , m_err(err)
+            , m_state(empty)
+        {
+        }
+
+        /*
+         * begin():
+         *
+         * Called at beginning of construction.
+         */
+        void begin(bool invert)
+        {
+            m_delegate.atomCharacterClassBegin(invert);
+        }
+
+        /*
+         * atomPatternCharacterUnescaped():
+         *
+         * This method is called directly from parseCharacterClass(), to report a new
+         * pattern character token.  This method differs from atomPatternCharacter(),
+         * which will be called from parseEscape(), since a hypen provided via this
+         * method may be indicating a character range, but a hyphen parsed by
+         * parseEscape() cannot be interpreted as doing so.
+         */
+        void atomPatternCharacterUnescaped(UChar ch)
+        {
+            switch (m_state) {
+            case empty:
+                m_character = ch;
+                m_state = cachedCharacter;
+                break;
+
+            case cachedCharacter:
+                if (ch == '-')
+                    m_state = cachedCharacterHyphen;
+                else {
+                    m_delegate.atomCharacterClassAtom(m_character);
+                    m_character = ch;
+                }
+                break;
+
+            case cachedCharacterHyphen:
+                if (ch >= m_character)
+                    m_delegate.atomCharacterClassRange(m_character, ch);
+                else
+                    m_err = CharacterClassOutOfOrder;
+                m_state = empty;
+            }
+        }
+
+        /*
+         * atomPatternCharacter():
+         *
+         * Adds a pattern character, called by parseEscape(), as such will not
+         * interpret a hyphen as indicating a character range.
+         */
+        void atomPatternCharacter(UChar ch)
+        {
+            // Flush if a character is already pending to prevent the
+            // hyphen from begin interpreted as indicating a range.
+            if((ch == '-') && (m_state == cachedCharacter))
+                flush();
+
+            atomPatternCharacterUnescaped(ch);
+        }
+
+        /*
+         * atomBuiltInCharacterClass():
+         *
+         * Adds a built-in character class, called by parseEscape().
+         */
+        void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+        {
+            flush();
+            m_delegate.atomCharacterClassBuiltIn(classID, invert);
+        }
+
+        /*
+         * end():
+         *
+         * Called at end of construction.
+         */
+        void end()
+        {
+            flush();
+            m_delegate.atomCharacterClassEnd();
+        }
+
+        // parseEscape() should never call these delegate methods when
+        // invoked with inCharacterClass set.
+        void assertionWordBoundary(bool) { ASSERT_NOT_REACHED(); }
+        void atomBackReference(unsigned) { ASSERT_NOT_REACHED(); }
+
+    private:
+        void flush()
+        {
+            if (m_state != empty) // either cachedCharacter or cachedCharacterHyphen
+                m_delegate.atomCharacterClassAtom(m_character);
+            if (m_state == cachedCharacterHyphen)
+                m_delegate.atomCharacterClassAtom('-');
+            m_state = empty;
+        }
+    
+        Delegate& m_delegate;
+        ErrorCode& m_err;
+        enum CharacterClassConstructionState {
+            empty,
+            cachedCharacter,
+            cachedCharacterHyphen,
+        } m_state;
+        UChar m_character;
+    };
+
+    Parser(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit)
+        : m_delegate(delegate)
+        , m_backReferenceLimit(backReferenceLimit)
+        , m_err(NoError)
+        , m_data(pattern.data())
+        , m_size(pattern.size())
+        , m_index(0)
+        , m_parenthesesNestingDepth(0)
+    {
+    }
+    
+    /*
+     * parseEscape():
+     *
+     * Helper for parseTokens() AND parseCharacterClass().
+     * Unlike the other parser methods, this function does not report tokens
+     * directly to the member delegate (m_delegate), instead tokens are
+     * emitted to the delegate provided as an argument.  In the case of atom
+     * escapes, parseTokens() will call parseEscape() passing m_delegate as
+     * an argument, and as such the escape will be reported to the delegate.
+     *
+     * However this method may also be used by parseCharacterClass(), in which
+     * case a CharacterClassParserDelegate will be passed as the delegate that
+     * tokens should be added to.  A boolean flag is also provided to indicate
+     * whether that an escape in a CharacterClass is being parsed (some parsing
+     * rules change in this context).
+     *
+     * The boolean value returned by this method indicates whether the token
+     * parsed was an atom (outside of a characted class \b and \B will be
+     * interpreted as assertions).
+     */
+    template<bool inCharacterClass, class EscapeDelegate>
+    bool parseEscape(EscapeDelegate& delegate)
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '\\');
+        consume();
+
+        if (atEndOfPattern()) {
+            m_err = EscapeUnterminated;
+            return false;
+        }
+
+        switch (peek()) {
+        // Assertions
+        case 'b':
+            consume();
+            if (inCharacterClass)
+                delegate.atomPatternCharacter('\b');
+            else {
+                delegate.assertionWordBoundary(false);
+                return false;
+            }
+            break;
+        case 'B':
+            consume();
+            if (inCharacterClass)
+                delegate.atomPatternCharacter('B');
+            else {
+                delegate.assertionWordBoundary(true);
+                return false;
+            }
+            break;
+
+        // CharacterClassEscape
+        case 'd':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, false);
+            break;
+        case 's':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, false);
+            break;
+        case 'w':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, false);
+            break;
+        case 'D':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, true);
+            break;
+        case 'S':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, true);
+            break;
+        case 'W':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, true);
+            break;
+
+        // DecimalEscape
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9': {
+            // To match Firefox, we parse an invalid backreference in the range [1-7] as an octal escape.
+            // First, try to parse this as backreference.
+            if (!inCharacterClass) {
+                ParseState state = saveState();
+
+                unsigned backReference = consumeNumber();
+                if (backReference <= m_backReferenceLimit) {
+                    delegate.atomBackReference(backReference);
+                    break;
+                }
+
+                restoreState(state);
+            }
+            
+            // Not a backreference, and not octal.
+            if (peek() >= '8') {
+                delegate.atomPatternCharacter('\\');
+                break;
+            }
+
+            // Fall-through to handle this as an octal escape.
+        }
+
+        // Octal escape
+        case '0':
+            delegate.atomPatternCharacter(consumeOctal());
+            break;
+
+        // ControlEscape
+        case 'f':
+            consume();
+            delegate.atomPatternCharacter('\f');
+            break;
+        case 'n':
+            consume();
+            delegate.atomPatternCharacter('\n');
+            break;
+        case 'r':
+            consume();
+            delegate.atomPatternCharacter('\r');
+            break;
+        case 't':
+            consume();
+            delegate.atomPatternCharacter('\t');
+            break;
+        case 'v':
+            consume();
+            delegate.atomPatternCharacter('\v');
+            break;
+
+        // ControlLetter
+        case 'c': {
+            ParseState state = saveState();
+            consume();
+            if (!atEndOfPattern()) {
+                int control = consume();
+
+                // To match Firefox, inside a character class, we also accept numbers and '_' as control characters.
+                if (inCharacterClass ? WTF::isASCIIAlphanumeric(control) || (control == '_') : WTF::isASCIIAlpha(control)) {
+                    delegate.atomPatternCharacter(control & 0x1f);
+                    break;
+                }
+            }
+            restoreState(state);
+            delegate.atomPatternCharacter('\\');
+            break;
+        }
+
+        // HexEscape
+        case 'x': {
+            consume();
+            int x = tryConsumeHex(2);
+            if (x == -1)
+                delegate.atomPatternCharacter('x');
+            else
+                delegate.atomPatternCharacter(x);
+            break;
+        }
+
+        // UnicodeEscape
+        case 'u': {
+            consume();
+            int u = tryConsumeHex(4);
+            if (u == -1)
+                delegate.atomPatternCharacter('u');
+            else
+                delegate.atomPatternCharacter(u);
+            break;
+        }
+
+        // IdentityEscape
+        default:
+            delegate.atomPatternCharacter(consume());
+        }
+        
+        return true;
+    }
+
+    /*
+     * parseAtomEscape(), parseCharacterClassEscape():
+     *
+     * These methods alias to parseEscape().
+     */
+    bool parseAtomEscape()
+    {
+        return parseEscape<false>(m_delegate);
+    }
+    void parseCharacterClassEscape(CharacterClassParserDelegate& delegate)
+    {
+        parseEscape<true>(delegate);
+    }
+
+    /*
+     * parseCharacterClass():
+     *
+     * Helper for parseTokens(); calls dirctly and indirectly (via parseCharacterClassEscape)
+     * to an instance of CharacterClassParserDelegate, to describe the character class to the
+     * delegate.
+     */
+    void parseCharacterClass()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '[');
+        consume();
+
+        CharacterClassParserDelegate characterClassConstructor(m_delegate, m_err);
+
+        characterClassConstructor.begin(tryConsume('^'));
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case ']':
+                consume();
+                characterClassConstructor.end();
+                return;
+
+            case '\\':
+                parseCharacterClassEscape(characterClassConstructor);
+                break;
+
+            default:
+                characterClassConstructor.atomPatternCharacterUnescaped(consume());
+            }
+
+            if (m_err)
+                return;
+        }
+
+        m_err = CharacterClassUnmatched;
+    }
+
+    /*
+     * parseParenthesesBegin():
+     *
+     * Helper for parseTokens(); checks for parentheses types other than regular capturing subpatterns.
+     */
+    void parseParenthesesBegin()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '(');
+        consume();
+
+        if (tryConsume('?')) {
+            if (atEndOfPattern()) {
+                m_err = ParenthesesTypeInvalid;
+                return;
+            }
+
+            switch (consume()) {
+            case ':':
+                m_delegate.atomParenthesesSubpatternBegin(false);
+                break;
+            
+            case '=':
+                m_delegate.atomParentheticalAssertionBegin();
+                break;
+
+            case '!':
+                m_delegate.atomParentheticalAssertionBegin(true);
+                break;
+            
+            default:
+                m_err = ParenthesesTypeInvalid;
+            }
+        } else
+            m_delegate.atomParenthesesSubpatternBegin();
+
+        ++m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseParenthesesEnd():
+     *
+     * Helper for parseTokens(); checks for parse errors (due to unmatched parentheses).
+     */
+    void parseParenthesesEnd()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == ')');
+        consume();
+
+        if (m_parenthesesNestingDepth > 0)
+            m_delegate.atomParenthesesEnd();
+        else
+            m_err = ParenthesesUnmatched;
+
+        --m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseQuantifier():
+     *
+     * Helper for parseTokens(); checks for parse errors and non-greedy quantifiers.
+     */
+    void parseQuantifier(bool lastTokenWasAnAtom, unsigned min, unsigned max)
+    {
+        ASSERT(!m_err);
+        ASSERT(min <= max);
+
+        if (lastTokenWasAnAtom)
+            m_delegate.quantifyAtom(min, max, !tryConsume('?'));
+        else
+            m_err = QuantifierWithoutAtom;
+    }
+
+    /*
+     * parseTokens():
+     *
+     * This method loops over the input pattern reporting tokens to the delegate.
+     * The method returns when a parse error is detected, or the end of the pattern
+     * is reached.  One piece of state is tracked around the loop, which is whether
+     * the last token passed to the delegate was an atom (this is necessary to detect
+     * a parse error when a quantifier provided without an atom to quantify).
+     */
+    void parseTokens()
+    {
+        bool lastTokenWasAnAtom = false;
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case '|':
+                consume();
+                m_delegate.disjunction();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '(':
+                parseParenthesesBegin();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case ')':
+                parseParenthesesEnd();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '^':
+                consume();
+                m_delegate.assertionBOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '$':
+                consume();
+                m_delegate.assertionEOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '.':
+                consume();
+                m_delegate.atomBuiltInCharacterClass(NewlineClassID, true);
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '[':
+                parseCharacterClass();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '\\':
+                lastTokenWasAnAtom = parseAtomEscape();
+                break;
+
+            case '*':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, UINT_MAX);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '+':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 1, UINT_MAX);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '?':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, 1);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '{': {
+                ParseState state = saveState();
+
+                consume();
+                if (peekIsDigit()) {
+                    unsigned min = consumeNumber();
+                    unsigned max = min;
+                    
+                    if (tryConsume(','))
+                        max = peekIsDigit() ? consumeNumber() : UINT_MAX;
+
+                    if (tryConsume('}')) {
+                        if (min <= max)
+                            parseQuantifier(lastTokenWasAnAtom, min, max);
+                        else
+                            m_err = QuantifierOutOfOrder;
+                        lastTokenWasAnAtom = false;
+                        break;
+                    }
+                }
+
+                restoreState(state);
+            } // if we did not find a complete quantifer, fall through to the default case.
+
+            default:
+                m_delegate.atomPatternCharacter(consume());
+                lastTokenWasAnAtom = true;
+            }
+
+            if (m_err)
+                return;
+        }
+
+        if (m_parenthesesNestingDepth > 0)
+            m_err = MissingParentheses;
+    }
+
+    /*
+     * parse():
+     *
+     * This method calls regexBegin(), calls parseTokens() to parse over the input
+     * patterns, calls regexEnd() or regexError() as appropriate, and converts any
+     * error code to a const char* for a result.
+     */
+    const char* parse()
+    {
+        m_delegate.regexBegin();
+
+        if (m_size > MAX_PATTERN_SIZE)
+            m_err = PatternTooLarge;
+        else
+            parseTokens();
+        ASSERT(atEndOfPattern() || m_err);
+
+        if (m_err)
+            m_delegate.regexError();
+        else
+            m_delegate.regexEnd();
+
+        // The order of this array must match the ErrorCode enum.
+        static const char* errorMessages[NumberOfErrorCodes] = {
+            0, // NoError
+            "regular expression too large",
+            "numbers out of order in {} quantifier",
+            "nothing to repeat",
+            "missing )",
+            "unmatched parentheses",
+            "unrecognized character after (?",
+            "missing terminating ] for character class",
+            "range out of order in character class",
+            "\\ at end of pattern"
+        };
+
+        return errorMessages[m_err];
+    }
+
+
+    // Misc helper functions:
+
+    typedef unsigned ParseState;
+    
+    ParseState saveState()
+    {
+        return m_index;
+    }
+
+    void restoreState(ParseState state)
+    {
+        m_index = state;
+    }
+
+    bool atEndOfPattern()
+    {
+        ASSERT(m_index <= m_size);
+        return m_index == m_size;
+    }
+
+    int peek()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index];
+    }
+
+    bool peekIsDigit()
+    {
+        return !atEndOfPattern() && WTF::isASCIIDigit(peek());
+    }
+
+    unsigned peekDigit()
+    {
+        ASSERT(peekIsDigit());
+        return peek() - '0';
+    }
+
+    int consume()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index++];
+    }
+
+    unsigned consumeDigit()
+    {
+        ASSERT(peekIsDigit());
+        return consume() - '0';
+    }
+
+    unsigned consumeNumber()
+    {
+        unsigned n = consumeDigit();
+        // check for overflow.
+        for (unsigned newValue; peekIsDigit() && ((newValue = n * 10 + peekDigit()) >= n); ) {
+            n = newValue;
+            consume();
+        }
+        return n;
+    }
+
+    unsigned consumeOctal()
+    {
+        ASSERT(WTF::isASCIIOctalDigit(peek()));
+
+        unsigned n = consumeDigit();
+        while (n < 32 && !atEndOfPattern() && WTF::isASCIIOctalDigit(peek()))
+            n = n * 8 + consumeDigit();
+        return n;
+    }
+
+    bool tryConsume(UChar ch)
+    {
+        if (atEndOfPattern() || (m_data[m_index] != ch))
+            return false;
+        ++m_index;
+        return true;
+    }
+
+    int tryConsumeHex(int count)
+    {
+        ParseState state = saveState();
+
+        int n = 0;
+        while (count--) {
+            if (atEndOfPattern() || !WTF::isASCIIHexDigit(peek())) {
+                restoreState(state);
+                return -1;
+            }
+            n = (n << 4) | WTF::toASCIIHexValue(consume());
+        }
+        return n;
+    }
+
+    Delegate& m_delegate;
+    unsigned m_backReferenceLimit;
+    ErrorCode m_err;
+    const UChar* m_data;
+    unsigned m_size;
+    unsigned m_index;
+    unsigned m_parenthesesNestingDepth;
+
+    // Derived by empirical testing of compile time in PCRE and WREC.
+    static const unsigned MAX_PATTERN_SIZE = 1024 * 1024;
+};
+
+/*
+ * Yarr::parse():
+ *
+ * The parse method is passed a pattern to be parsed and a delegate upon which
+ * callbacks will be made to record the parsed tokens forming the regex.
+ * Yarr::parse() returns null on success, or a const C string providing an error
+ * message where a parse error occurs.
+ *
+ * The Delegate must implement the following interface:
+ *
+ *    void assertionBOL();
+ *    void assertionEOL();
+ *    void assertionWordBoundary(bool invert);
+ *
+ *    void atomPatternCharacter(UChar ch);
+ *    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert);
+ *    void atomCharacterClassBegin(bool invert)
+ *    void atomCharacterClassAtom(UChar ch)
+ *    void atomCharacterClassRange(UChar begin, UChar end)
+ *    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+ *    void atomCharacterClassEnd()
+ *    void atomParenthesesSubpatternBegin(bool capture = true);
+ *    void atomParentheticalAssertionBegin(bool invert = false);
+ *    void atomParenthesesEnd();
+ *    void atomBackReference(unsigned subpatternId);
+ *
+ *    void quantifyAtom(unsigned min, unsigned max, bool greedy);
+ *
+ *    void disjunction();
+ *
+ *    void regexBegin();
+ *    void regexEnd();
+ *    void regexError();
+ *
+ * Before any call recording tokens are made, regexBegin() will be called on the
+ * delegate once.  Once parsing is complete either regexEnd() or regexError() will
+ * be called, as appropriate.
+ *
+ * The regular expression is described by a sequence of assertion*() and atom*()
+ * callbacks to the delegate, describing the terms in the regular expression.
+ * Following an atom a quantifyAtom() call may occur to indicate that the previous
+ * atom should be quantified.  In the case of atoms described across multiple
+ * calls (parentheses and character classes) the call to quantifyAtom() will come
+ * after the call to the atom*End() method, never after atom*Begin().
+ *
+ * Character classes may either be described by a single call to
+ * atomBuiltInCharacterClass(), or by a sequence of atomCharacterClass*() calls.
+ * In the latter case, ...Begin() will be called, followed by a sequence of
+ * calls to ...Atom(), ...Range(), and ...BuiltIn(), followed by a call to ...End().
+ *
+ * Sequences of atoms and assertions are broken into alternatives via calls to
+ * disjunction().  Assertions, atoms, and disjunctions emitted between calls to
+ * atomParenthesesBegin() and atomParenthesesEnd() form the body of a subpattern.
+ * atomParenthesesBegin() is passed a subpatternId.  In the case of a regular
+ * capturing subpattern, this will be the subpatternId associated with these
+ * parentheses, and will also by definition be the lowest subpatternId of these
+ * parentheses and of any nested paretheses.  The atomParenthesesEnd() method
+ * is passed the subpatternId of the last capturing subexpression nested within
+ * these paretheses.  In the case of a capturing subpattern with no nested
+ * capturing subpatterns, the same subpatternId will be passed to the begin and
+ * end functions.  In the case of non-capturing subpatterns the subpatternId
+ * passed to the begin method is also the first possible subpatternId that might
+ * be nested within these paretheses.  If a set of non-capturing parentheses does
+ * not contain any capturing subpatterns, then the subpatternId passed to begin
+ * will be greater than the subpatternId passed to end.
+ */
+
+template<class Delegate>
+const char* parse(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit = UINT_MAX)
+{
+    return Parser<Delegate>(delegate, pattern, backReferenceLimit).parse();
+}
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexParser_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
new file mode 100644
index 0000000000..fb1b0ab815
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
@@ -0,0 +1,356 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexPattern_h
+#define RegexPattern_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+
+namespace JSC { namespace Yarr {
+
+#define RegexStackSpaceForBackTrackInfoPatternCharacter 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoCharacterClass 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoBackReference 2
+#define RegexStackSpaceForBackTrackInfoAlternative 1 // One per alternative.
+#define RegexStackSpaceForBackTrackInfoParentheticalAssertion 1
+#define RegexStackSpaceForBackTrackInfoParenthesesOnce 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoParentheses 4
+
+struct PatternDisjunction;
+
+struct CharacterRange {
+    UChar begin;
+    UChar end;
+
+    CharacterRange(UChar begin, UChar end)
+        : begin(begin)
+        , end(end)
+    {
+    }
+};
+
+struct CharacterClass {
+    Vector<UChar> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+};
+
+enum QuantifierType {
+    QuantifierFixedCount,
+    QuantifierGreedy,
+    QuantifierNonGreedy,
+};
+
+struct PatternTerm {
+    enum Type {
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacter,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeForwardReference,
+        TypeParenthesesSubpattern,
+        TypeParentheticalAssertion,
+    } type;
+    bool invertOrCapture;
+    union {
+        UChar patternCharacter;
+        CharacterClass* characterClass;
+        unsigned subpatternId;
+        struct {
+            PatternDisjunction* disjunction;
+            unsigned subpatternId;
+            unsigned lastSubpatternId;
+            bool isCopy;
+        } parentheses;
+    };
+    QuantifierType quantityType;
+    unsigned quantityCount;
+    int inputPosition;
+    unsigned frameLocation;
+
+    PatternTerm(UChar ch)
+        : type(PatternTerm::TypePatternCharacter)
+    {
+        patternCharacter = ch;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(CharacterClass* charClass, bool invert)
+        : type(PatternTerm::TypeCharacterClass)
+        , invertOrCapture(invert)
+    {
+        characterClass = charClass;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(Type type, unsigned subpatternId, PatternDisjunction* disjunction, bool invertOrCapture)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        parentheses.disjunction = disjunction;
+        parentheses.subpatternId = subpatternId;
+        parentheses.isCopy = false;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+    
+    PatternTerm(Type type, bool invert = false)
+        : type(type)
+        , invertOrCapture(invert)
+    {
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(unsigned spatternId)
+        : type(TypeBackReference)
+        , invertOrCapture(invertOrCapture)
+    {
+        subpatternId = spatternId;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    static PatternTerm ForwardReference()
+    {
+        return PatternTerm(TypeForwardReference);
+    }
+
+    static PatternTerm BOL()
+    {
+        return PatternTerm(TypeAssertionBOL);
+    }
+
+    static PatternTerm EOL()
+    {
+        return PatternTerm(TypeAssertionEOL);
+    }
+
+    static PatternTerm WordBoundary(bool invert)
+    {
+        return PatternTerm(TypeAssertionWordBoundary, invert);
+    }
+    
+    bool invert()
+    {
+        return invertOrCapture;
+    }
+
+    bool capture()
+    {
+        return invertOrCapture;
+    }
+    
+    void quantify(unsigned count, QuantifierType type)
+    {
+        quantityCount = count;
+        quantityType = type;
+    }
+};
+
+struct PatternAlternative {
+    PatternAlternative(PatternDisjunction* disjunction)
+        : m_parent(disjunction)
+    {
+    }
+
+    PatternTerm& lastTerm()
+    {
+        ASSERT(m_terms.size());
+        return m_terms[m_terms.size() - 1];
+    }
+    
+    void removeLastTerm()
+    {
+        ASSERT(m_terms.size());
+        m_terms.shrink(m_terms.size() - 1);
+    }
+
+    Vector<PatternTerm> m_terms;
+    PatternDisjunction* m_parent;
+    unsigned m_minimumSize;
+    bool m_hasFixedSize;
+};
+
+struct PatternDisjunction {
+    PatternDisjunction(PatternAlternative* parent = 0)
+        : m_parent(parent)
+    {
+    }
+    
+    ~PatternDisjunction()
+    {
+        deleteAllValues(m_alternatives);
+    }
+
+    PatternAlternative* addNewAlternative()
+    {
+        PatternAlternative* alternative = new PatternAlternative(this);
+        m_alternatives.append(alternative);
+        return alternative;
+    }
+
+    Vector<PatternAlternative*> m_alternatives;
+    PatternAlternative* m_parent;
+    unsigned m_minimumSize;
+    unsigned m_callFrameSize;
+    bool m_hasFixedSize;
+};
+
+// You probably don't want to be calling these functions directly
+// (please to be calling newlineCharacterClass() et al on your
+// friendly neighborhood RegexPattern instance to get nicely
+// cached copies).
+CharacterClass* newlineCreate();
+CharacterClass* digitsCreate();
+CharacterClass* spacesCreate();
+CharacterClass* wordcharCreate();
+CharacterClass* nondigitsCreate();
+CharacterClass* nonspacesCreate();
+CharacterClass* nonwordcharCreate();
+
+struct RegexPattern {
+    RegexPattern(bool ignoreCase, bool multiline)
+        : m_ignoreCase(ignoreCase)
+        , m_multiline(multiline)
+        , m_numSubpatterns(0)
+        , m_maxBackReference(0)
+        , newlineCached(0)
+        , digitsCached(0)
+        , spacesCached(0)
+        , wordcharCached(0)
+        , nondigitsCached(0)
+        , nonspacesCached(0)
+        , nonwordcharCached(0)
+    {
+    }
+
+    ~RegexPattern()
+    {
+        deleteAllValues(m_disjunctions);
+        deleteAllValues(m_userCharacterClasses);
+    }
+
+    void reset()
+    {
+        m_numSubpatterns = 0;
+        m_maxBackReference = 0;
+
+        newlineCached = 0;
+        digitsCached = 0;
+        spacesCached = 0;
+        wordcharCached = 0;
+        nondigitsCached = 0;
+        nonspacesCached = 0;
+        nonwordcharCached = 0;
+
+        deleteAllValues(m_disjunctions);
+        m_disjunctions.clear();
+        deleteAllValues(m_userCharacterClasses);
+        m_userCharacterClasses.clear();
+    }
+
+    bool containsIllegalBackReference()
+    {
+        return m_maxBackReference > m_numSubpatterns;
+    }
+
+    CharacterClass* newlineCharacterClass()
+    {
+        if (!newlineCached)
+            m_userCharacterClasses.append(newlineCached = newlineCreate());
+        return newlineCached;
+    }
+    CharacterClass* digitsCharacterClass()
+    {
+        if (!digitsCached)
+            m_userCharacterClasses.append(digitsCached = digitsCreate());
+        return digitsCached;
+    }
+    CharacterClass* spacesCharacterClass()
+    {
+        if (!spacesCached)
+            m_userCharacterClasses.append(spacesCached = spacesCreate());
+        return spacesCached;
+    }
+    CharacterClass* wordcharCharacterClass()
+    {
+        if (!wordcharCached)
+            m_userCharacterClasses.append(wordcharCached = wordcharCreate());
+        return wordcharCached;
+    }
+    CharacterClass* nondigitsCharacterClass()
+    {
+        if (!nondigitsCached)
+            m_userCharacterClasses.append(nondigitsCached = nondigitsCreate());
+        return nondigitsCached;
+    }
+    CharacterClass* nonspacesCharacterClass()
+    {
+        if (!nonspacesCached)
+            m_userCharacterClasses.append(nonspacesCached = nonspacesCreate());
+        return nonspacesCached;
+    }
+    CharacterClass* nonwordcharCharacterClass()
+    {
+        if (!nonwordcharCached)
+            m_userCharacterClasses.append(nonwordcharCached = nonwordcharCreate());
+        return nonwordcharCached;
+    }
+
+    bool m_ignoreCase;
+    bool m_multiline;
+    unsigned m_numSubpatterns;
+    unsigned m_maxBackReference;
+    PatternDisjunction* m_body;
+    Vector<PatternDisjunction*, 4> m_disjunctions;
+    Vector<CharacterClass*> m_userCharacterClasses;
+
+private:
+    CharacterClass* newlineCached;
+    CharacterClass* digitsCached;
+    CharacterClass* spacesCached;
+    CharacterClass* wordcharCached;
+    CharacterClass* nondigitsCached;
+    CharacterClass* nonspacesCached;
+    CharacterClass* nonwordcharCached;
+};
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexPattern_h
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 7d5d1c5a8b..a0f039badd 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        origin/qtwebkit-4.5 branch/tag
+        qtwebkit-4.6-snapshot-15062009 branch/tag
 
 and has the sha1 checksum
 
-        4ee8af9348b3f57d3c0f3575ae0a58336cf07a92
+        65232bf00dc494ebfd978f998c88f58d18ecce1e
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 072beeeb9d..14190f6ef3 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,25 +1,5978 @@
-2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+2009-06-10  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Do not call the parent implementation (Widget::) in show() and hide()
-        of the PluginViewQt, as it always changes the visible state of the
-        platformWidget (equal to the platformPluginWidget in the Qt port),
-        thus ignoring the isParentVisible() test.
+        Fix the build of PluginView on Qt with 64-bit where we disable plugins
+        at compile time.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
+        Use the FooNone.cpp files at compile-time.
 
-2009-04-22  Tamas Szirbucz  <szirbucz.tamas@stud.u-szeged.hu>
+        * plugins/PluginPackageNone.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH on Windows
+        
+        This define was brought in after refactoring some code from
+        PluginPackage(Qt|Gtk).cpp into the shared PluginPackage.cpp.
+
+        * WebCore.pro:
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $QMAKE_PATH_SEP instead of hardcoded / to fix Windows build
+
+        * WebCore.pro:
+
+2009-06-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Ariya Hidayat.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25023
-        Delete reply in QNetworkReplyHandler::abort() to avoid leak.
+        [Qt] Build fix when NETSCAPE_PLUGIN_API support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=26244
+
+        * WebCore.pro: Define PLUGIN_PACKAGE_SIMPLE_HASH only if
+        NETSCAPE_PLUGIN_API is turned on
+        * plugins/PluginPackage.cpp: Guard initializeBrowserFuncs()
+        * plugins/PluginViewNone.cpp: Match guards with PluginView.h
+
+2009-06-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6931661> -[WebView _selectionIsAll] returns YES
+          when the selection is inside a text field.
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll): Return false if the selection is in
+        a shadow tree.
+
+2009-06-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26106
+        [GTK] Crashes when you keep a combo open during a page transition, then close it
+
+        Hide the combo popup and disconnect from its signals during
+        PopupMenu destruction to handle this exceptional case with no
+        crash.
+
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::menuUnmapped):
+
+2009-06-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6930540>
+        REGRESSION (r43797): Serif and fantasy font-family names are wrong in result of getComputedStyle
+
+        Test: fast/css/font-family-builtins.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::identifierForFamily): Fix typo. Fantasy family should be
+        -webkit-fantasy not, -webkit-serif.
+
+2009-06-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/6936235>
+        Need to support StorageEvent.storageArea to meet the Web Storage spec
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent): Pass the localStorage for
+        the frame being dispatched to.
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent): Ditto, only for sessionStorage.
+
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::storageArea):
+        * storage/StorageEvent.idl:
+        Add storageArea member.
+
+2009-06-05  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix WMLInputElement initialization code. Don't call initialize() on attach(), let
+        WMLCardElement handle initialization once, after the document has been parsed.
+
+        To keep layout tests working introduce a new function in Document.idl: initializeWMLPageState().
+        WMLTestCase.js (the wml/ layout test framework) will use it to simulate a regular WML document,
+        whose variable state gets initialized on WMLDocument::finishedParsing(). Force initialization
+        of the WML variable state, right after the dynamically created elements have been inserted into the tree.
+
+        * dom/Document.cpp:
+        (WebCore::Document::initializeWMLPageState):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLDocument.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::initialize):
+        * wml/WMLInputElement.h:
+
+2009-06-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ononline and onoffline attributes for the <body> element. 
+
+        * html/HTMLAttributeNames.in: Added ononlineAttr and onofflineAttr.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): Map ononlineAttr
+        and onofflineAttr to window event listeners.
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add missing includes of config.h
+
+        * platform/qt/QWebPopup.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+
+2009-06-05  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26215
+        Try to fix the Chromium build.
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
+        (WebCore::fillNonBMPGlyphs):
+
+2009-06-05  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Bug 26160: Compile fails in MacOSX when GNU fileutils are installed
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26160>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use /bin/ln instead of ln for cases where this command is used with -h option.
+        As this option is not supported by GNU fileutils, this change helps users 
+        who have GNU fileutils in their PATH.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-03  Ben Murdoch  <benm@google.com>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25710> HTML5 Database stops executing transactions if the URL hash changes while a transaction is open and an XHR is in progress.
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix a bug that causes database transactions to fail if a history navigation to a hash fragment of the same document is made while resources (e.g. an XHR) are loading
+
+        Test: storage/hash-change-with-xhr.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::stopAllLoaders):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+        * WebCore.base.exp:
+
+2009-06-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make sure the correct config.h is included when shadowbuilding
+
+        * WebCore.pro:
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build after r44452
 
         * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove some dead code (MenuEventProxy)
+
+        * WebCore.pro:
+        * platform/ContextMenu.h:
+        * platform/qt/ContextMenuQt.cpp:
+        * platform/qt/MenuEventProxy.h: Removed.
+
+2009-06-05  Xan Lopez  <xlopez@igalia.com>
+
+        More build fixes.
+
+        * platform/graphics/gtk/GlyphPageTreeNodePango.cpp:
+        (WebCore::GlyphPage::fill):
+
+2009-06-05  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the GTK+ build.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/FontCacheGtk.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp:
+        (WebCore::GlyphPage::fill):
+
+2009-06-05  Antti Koivisto  <antti@apple.com>
+
+        Try to fix Windows (and possibly other platforms) build.
+
+        Restore ResourceResponseBase::lastModifiedDate() and setLastModifiedDate() removed in previous commit.
+        for now since PluginStream used on some platforms expects them and calculations differ from plain 
+        Last-modified header value.
+        
+        Also include <wtf/MathExtras.h> to get isfinite().
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::setLastModifiedDate):
+        (WebCore::ResourceResponseBase::lastModifiedDate):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-06-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13128
+        Safari not obeying cache header
+        
+        Implement RFC 2616 cache expiration calculations in WebKit instead of
+        relying on the networking layer.
+
+        * ForwardingHeaders/runtime/DateMath.h: Added.
+        * WebCore.base.exp:
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidationSucceeded):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isExpired):
+        (WebCore::CachedResource::currentAge):
+        (WebCore::CachedResource::freshnessLifetime):
+        (WebCore::CachedResource::setResponse):
+        (WebCore::CachedResource::updateResponseAfterRevalidation):
+        (WebCore::CachedResource::mustRevalidate):
+        * loader/CachedResource.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::setHTTPHeaderField):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::cacheControlContainsNoCache):
+        (WebCore::ResourceResponseBase::cacheControlContainsMustRevalidate):
+        (WebCore::ResourceResponseBase::cacheControlMaxAge):
+        (WebCore::parseDateValueInHeader):
+        (WebCore::ResourceResponseBase::date):
+        (WebCore::ResourceResponseBase::age):
+        (WebCore::ResourceResponseBase::expires):
+        (WebCore::ResourceResponseBase::lastModified):
+        (WebCore::ResourceResponseBase::isAttachment):
+        (WebCore::ResourceResponseBase::compare):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26201: Remove superfluous 'if' statements in RenderTable::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=26201
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild): remove superfluous 'if' statements
+       
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26202: add macros for primitive values to simplify CSSStyleSelector::applyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=26202
+
+        * css/CSSStyleSelector.cpp: add HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE[_WITH_VALUE] macros
+        (WebCore::CSSStyleSelector::applyProperty): use new macros
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel
+
+        Bug 26203: Move parsing of 'attr(X)' values to own method
+        https://bugs.webkit.org/show_bug.cgi?id=26203
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr): new method
+        (WebCore::CSSParser::parseContent): use new parseAttr method
+        * css/CSSParser.h:
+        (WebCore::CSSParser::parseAttr): new method
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26205: RenderTableSection::addChild : correct comment
+        https://bugs.webkit.org/show_bug.cgi?id=26205
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild): correct comment
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26204: RenderBlock : simplify handleSpecialChild, comment correction
+        https://bugs.webkit.org/show_bug.cgi?id=26204
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleSpecialChild): simplify usage
+        (WebCore::RenderBlock::handlePositionedChild): simplify usage
+        (WebCore::RenderBlock::handleFloatingChild): simplify usage
+        (WebCore::RenderBlock::handleRunInChild): simplify usage
+        (WebCore::RenderBlock::layoutBlock): correct comment
+        (WebCore::RenderBlock::layoutBlockChildren): simplify loop, change call to handleSpecialChild
+        * rendering/RenderBlock.h: 
+        (WebCore::RenderBlock::handleSpecialChild): change signature
+        (WebCore::RenderBlock::handlePositionedChild): change signature
+        (WebCore::RenderBlock::handleFloatingChild): change signature
+        (WebCore::RenderBlock::handleRunInChild): change signature
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - retry to fix the Tiger build
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Tiger build
+
+        * platform/graphics/SimpleFontData.h:
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Leopard and Tiger builds
+
+        * platform/graphics/SimpleFontData.h:
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::shapeAndPlaceItem):
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - make SimpleFontData's data members private
+        - rename SimpleFontData's m_font member to m_platformData
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::spaceWidth):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::platformData):
+        (WebCore::SimpleFontData::spaceWidth):
+        (WebCore::SimpleFontData::adjustedSpaceWidth):
+        (WebCore::SimpleFontData::syntheticBoldOffset):
+        (WebCore::SimpleFontData::spaceGlyph):
+        (WebCore::SimpleFontData::getNSFont):
+        (WebCore::SimpleFontData::getQtFont):
+        (WebCore::SimpleFontData::getWxFont):
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::advance):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::setPangoAttributes):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::adjustGlyphsAndAdvances):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::initializeATSUStyle):
+        (WebCore::overrideLayoutOperation):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::checkShapesArabic):
+        (WebCore::SimpleFontData::getCTFont):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::widthForGDIGlyph):
+        (WebCore::SimpleFontData::scriptFontProperties):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-06-04  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize the width of PopupMenuListBox properly for Mac Chromium.
+
+        Added a test that works only with this patch applied. The test is
+        a manual one, since the hit testing infrastructure in the layout
+        tests sends keyboard and mouse events to the main window and not
+        the cocoa control that implements the popup up, which means we can't
+        select items from the popup up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25904
+
+
+        * manual-tests/select-narrow-width.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupContainer::showExternal):
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed Windows build correction.
+
+        * WebCore.vcproj/WebCore.vcproj: Add missing 'ReplaceNodeWithSpanCommand.cpp'
+          and 'ReplaceNodeWithSpanCommand.h'
+
+2009-02-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Make sure execCommand("bold") on <b style="text-decoration: underline">test</b>
+        only removes the bold and not the underline.
+        https://bugs.webkit.org/show_bug.cgi?id=23496
+
+        Test: editing/execCommand/convert-style-elements-to-spans.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleDeclaration.h:
+        (WebCore::CSSStyleDeclaration::isEmpty):
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedAttrMap::isEmpty):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isUnstyledStyleSpan):
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle):
+        (WebCore::ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::replaceNodeWithSpanPreservingChildrenAndAttributes):
+        * editing/CompositeEditCommand.h:
+        * editing/RemoveNodePreservingChildrenCommand.cpp:
+        (WebCore::RemoveNodePreservingChildrenCommand::RemoveNodePreservingChildrenCommand):
+        * editing/ReplaceNodeWithSpanCommand.cpp: Added.
+        (WebCore::ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand):
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+        (WebCore::ReplaceNodeWithSpanCommand::doApply):
+        (WebCore::ReplaceNodeWithSpanCommand::doUnapply):
+        * editing/ReplaceNodeWithSpanCommand.h: Added.
+        (WebCore::ReplaceNodeWithSpanCommand::create):
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows Cairo target.
+
+        Add missing post-build command to copy history/cf contents
+        to output directory.
+
+        * WebCore.vcproj/WebCore.vcproj: Update Debug_Cairo and Release_Cairo
+          target post-build steps with copy commands.
+
+2009-06-04  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6854695> Movie controller thumb fails to scale with full page zoom
+        
+        Account for zoom level when drawing media controller thumb on Windows.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize):
+
+2009-06-04  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move DOM window focus/blur out of SelectionController and into FocusController.  Make sure it
+        fires on the focused frame when the page activation state changes also.  This is covered by an existing
+        layout test (albeit badly).  I have modified the test to be correct.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setFocused):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedFrame):
+        (WebCore::FocusController::setActive):
+
+2009-06-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Adding in empty files to stage the extract of RenderThemeChromiumSkia
+        from RenderThemeChromiumLinux and RenderThemeChromiumWindows.
+
+        * rendering/RenderThemeChromiumSkia.cpp: Added.
+        * rendering/RenderThemeChromiumSkia.h: Added.
+
+2009-06-04  Andrei Popescu <andreip@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25562
+        Potential crash after ApplicationCacheStorage::storeNewestCache() fails
+
+              Fix the crash by checking the return value of cacheStorage().storeNewestCache(this)
+              in WebCore::ApplicationCacheGroup::checkIfLoadIsComplete. If storeNewestCache failed,
+              we run the cache failure steps:
+
+        1. Fire the error events to all pending master entries, as well any other cache hosts
+           currently associated with a cache in this group.
+        2. Disassociate the pending master entries from the failed new cache.
+        3. Reinstate the old "newest cache", if there was one.
+
+        We also introduce two other changes:
+
+        1. a mechanism to rollback storageID changes to the in-memory resource
+           objects when the storing of an ApplicationCache object fails.
+
+        2. defer removing the pending master entries from the list of pending master entries
+           until the entire load is complete. This matches the HTML 5 spec better. To track
+           if the load is complete we now introduce a counter for those pending master entries
+           that haven't yet finshed downloading.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup): initializes the new counter to 0
+        (WebCore::ApplicationCacheGroup::selectCache): increments the counter when a new pending
+        master entry is added.
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource): decrements the counter
+        instead of removing the pending master entry.
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource): decrements the counter
+        instead of removing the pending master entry.
+        (WebCore::ApplicationCacheGroup::setNewestCache): removes an assertion that no longer
+        holds true. In particular, the newest cache is not necessarily new anymore. We can
+        set an old cache as the new cache. This can happen if we failed to store a newly
+        downloaded cache to the database and we are now reinstating the former newest cache.
+        (WebCore::ApplicationCacheGroup::manifestNotFound): resets the counter to 0.
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): check if the loading is complete
+        based on the counter instead of the list of pending master entries. Empty the list of
+        master entries if the load is complete.
+        * loader/appcache/ApplicationCacheGroup.h: add the new counter.
+        * loader/appcache/ApplicationCacheStorage.cpp: introduce the journaling mechanism for
+        in-memory resource objects.
+        (WebCore::ResourceStorageIDJournal::~ResourceStorageIDJournal):
+        (WebCore::ResourceStorageIDJournal::add):
+        (WebCore::ResourceStorageIDJournal::commit):
+        (WebCore::ResourceStorageIDJournal::Record::Record):
+        (WebCore::ResourceStorageIDJournal::Record::restore):
+        (WebCore::ApplicationCacheStorage::store): log the changes to the in-memory resource
+        objects.
+        (WebCore::ApplicationCacheStorage::storeNewestCache): create the journal object.
+        * loader/appcache/ApplicationCacheStorage.h:  modify the signature of
+        bool store(ApplicationCache*) to add a pointer to the logger object used to
+        trace the changes to the storageID of the resource objects.
+
+2009-06-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26154
+        Allow underscores in the hostnames we parse out of databaseIdentifiers.
+        This code is used for HTML 5 database support.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-06-04  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26084: Multiple missing images in webkit-mask-image prevent rendering
+        https://bugs.webkit.org/show_bug.cgi?id=26084
+
+        When painting multiple images, make sure that at least one image is valid before pushing a transparency layer.
+
+        Added a manual test.
+
+        * manual-tests/mask-composite-missing-images.html: Added.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+
+2009-06-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26180
+        Add a fast path for SecurityOrigin::equal. If "other == this" (where
+        other is the other security origin), then we really don't need to do
+        all the other (expensive) comparisons. We know it's equal.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::equal):
+
+2009-06-03  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Improvements in how selection behaves with focus/activation and a reversion back to using isActive
+        in the scrollbar theme code to remove a Chromium ifdef.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Make the controller set its focused state correctly upon initial creation.
+
+        (WebCore::SelectionController::setSelection):
+        Make selection willing to shift the focus node if the selection is focused even if the
+        selection is not active.  Whether or not the Page is active is irrelevant to focus changes.
+
+        (WebCore::SelectionController::setFocused):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isFocused):
+        Add a new isFocused() method so that code can check if the Selection is focused without caring
+        about the active state.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        Allow focus shifts even when the selection is not active.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        Revert Dan's change to directly talk to AppKit for checking active state.  Now that the WebCore isActive
+        method works, ditch the Chromium-specific #ifdef and go back to the original code.
+
+2009-06-04  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Test: media/before-load-member-access.html
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26081
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::played): Ensure that if m_playedTimeRanges,
+        is not initialized we return a valid range, and don't attempt to use it.
+
+2009-06-03  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement a way to invalidate the FontCache used by the Qt port.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::invalidate):
+
+2009-06-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26015
+
+        [Qt] Single-threaded QtWebKit configuration
+
+        Turn off Database, DOM storage, icon database and Web Workers support
+        when ENABLE_SINGLE_THREADED is turned on.
+
+        Set SQLITE_THREADSAFE to false to turn off SQLite mutexes
+        when ENABLE_SINGLE_THREADED is turned on.
+
+        * WebCore.pro:
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - add some assertions that Font methods are used on the main thread
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setShouldUseSmoothing):
+        * platform/graphics/Font.h:
+        (WebCore::Font::primaryFont):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        Rolled out apparently-accidental changes to config.h from r44398. These
+        were not part of the patch as reviewed.
+
+        * config.h:
+
+2009-06-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26177
+        Reverting 'private' to 'protected' on 2 classes.
+        Chromium glue layer (not yet in Webkit tree) relies on ability to derive
+        Chromium-specific platform classes and access the data members.
+        See bug for more details.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+
+2009-06-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser <simonfr@apple.com>.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=26162
+
+        This corrects an error when destroying an animation
+        or transition where endAnimation was never getting
+        called and therefore the hardware animation was never
+        getting removed.
+
+        This includes a manual-test since it's really impossible
+        to make a meaningful automatic test for an animation
+        bug like this.
+
+        This has no effect unless accelerated compositing is 
+        enabled.
+
+        * manual-tests/interrupted-compound-transform.html: Added.
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+
+2009-06-03  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Make the scrollbar thumb size twice the width for Chromium Linux. This
+        matches Firefox on Linux.
+
+        This will need layout test pixel results to be rebaselined in the
+        Chromium tree.
+
+        http://code.google.com/p/chromium/issues/detail?id=12602
+        https://bugs.webkit.org/show_bug.cgi?id=26176
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::minimumThumbLength):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+
+2009-06-03  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Change Chromium scrollbar theme code to use different classes on
+        Windows and Linux rather than suppling symbols. The ScrollbarTheme
+        class is already using virtual dispatch, so there's no reason not to.
+
+        This should not affect any layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26174
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromiumLinux::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintButton):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        (WebCore::ScrollbarThemeChromiumLinux::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromiumWin::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarThemeChromiumWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumWin::paintButton):
+        (WebCore::ScrollbarThemeChromiumWin::paintThumb):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        (WebCore::ScrollbarThemeChromiumWin::getClassicThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumWin.h: Added.
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enabling debugger requires that Scripts panel is already attached to the
+        render tree. The reason is that recompile events result in script sources
+        being added into the source frames. Prior to the global options introduced,
+        debugger was enabled from the Scripts panel, so that it was guaranteed to
+        exist. The InspectorController::enableDebugger API calls with no inspector
+        frontend showing were failing though.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26145
+
+        * WebCore.base.exp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::enableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::attachDebuggerWhenShown):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.attachDebuggerWhenShown):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix a regression from the previous patch
+
+        * platform/graphics/Font.cpp: Initialize shouldUseFontSmoothing to true.
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - eliminate WebCoreTextRenderer
+
+        * WebCore.base.exp: Updated.
+        * WebCore.xcodeproj/project.pbxproj: Removed WebCoreTextRenderer.{h,mm}
+            and promoted WebFontCache.h to private.
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setShouldUseSmoothing): Added this static setter for
+            a new file-static boolean.
+        (WebCore::Font::shouldUseSmoothing): Added this static getter.
+        * platform/graphics/Font.h: Decleared setShouldUseSmoothing() and
+            shouldUseSmoothing().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs): Use Font::shouldUseSmoothing() instead of
+        WebCoreShouldUseFontSmoothing().
+        * platform/graphics/mac/WebLayer.mm: Removed unneeded #import.
+        * platform/mac/WebCoreTextRenderer.h: Removed.
+        * platform/mac/WebCoreTextRenderer.mm: Removed.
+
+2009-06-03  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        v8's ScriptController::evaluate should protect the Frame like the jsc version.
+        https://bugs.webkit.org/show_bug.cgi?id=26172
+
+        This change is simply copying protections done for Frame in the method
+        WebCore::ScriptController::evaluate in the file js/ScriptController.cpp.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6841120> Use CTFontManager notifications instead
+          of ATS notifications
+
+        * platform/graphics/FontCache.h: Made it an error to destroy a
+        FontCache instance.
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::fontCacheRegisteredFontsChangedNotificationCallback): Added
+        this notification callback for the
+        kCTFontManagerRegisteredFontsChangedNotification, which calls
+        invalidate().
+        (WebCore::FontCache::platformInit): Register for
+        kCTFontManagerRegisteredFontsChangedNotification.
+
+2009-06-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use CGContextShowGlyphsWithAdvances to get more accurate text rendering on Mac.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26161
+
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Reorder ResourcesPanel components initialization to unfreeze resource list scroller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26159
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - Fix for crash (preceded by assertion) in InspectorController::didCommitLoad
+          when reloading or navigating with the Inspector open.
+        - Fix for Inspector's Elements panel being empty when Inspector first appears.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26134
+        https://bugs.webkit.org/show_bug.cgi?id=26135
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        * inspector/InspectorController.h:
+
+2009-06-03  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r44379
+
+        * svg/graphics/SVGImage.cpp: Move EmptyClients.h back down below the
+        other #includes to fix a compiler warning on Windows.
+
+2009-06-02  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add workaround for crash in Linux Flash Player when hosted by
+        another toolkit than GTK+. Bug fixed at the Flash Player bugzilla,
+        issue (FP-2140).
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-06-01  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor the Qt plugin code to use NPP_SetWindow correctly,
+        to make resizing of plugins work.
+
+        Attention was paid to make sure that the windowed plugins scroll
+        synchronized with the page view. A manual test has been added.
+
+        * manual-tests/qt/plugin-iframe.html: Added.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::frameRectsChanged):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::PluginContainerQt):
+        * plugins/qt/PluginContainerQt.h:
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::init):
+
+2009-06-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Bug 26112: viewless WebKit -- make events work
+        https://bugs.webkit.org/show_bug.cgi?id=26112
+
+        The main fix here is to make mouse and wheel event coordinates in the coordinate
+        system of the top level NSView rather than the NSWindow when in the viewless mode.
+        This is the design Hyatt chose, but the event part of it wasn't done yet.
+
+        Also fix FrameView to do normal reference counting instead of a strange model with
+        an explicit deref near creation time.
+
+        * WebCore.base.exp: Updated.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventLoopHandleMouseUp): Moved this function into the file
+        to reduce conditionals in the header.
+        (WebCore::EventHandler::eventLoopHandleMouseDragged): Ditto.
+
+        * page/EventHandler.h: Reduced includes. Fixed formatting of Objective-C types.
+        Made currentNSEvent a static member function. Added sendContextMenuEvent and
+        eventMayStartDrag functions that takes NSEvent * so the conversion to PlatformMouseEvent
+        can be done here rather than in WebKit. Reduced #if by making eventLoopHandleMouseUp and
+        eventLoopHandleMouseDragged unconditional.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setView): Made this take a PassRefPtr since it takes ownership.
+        (WebCore::Frame::createView): Changed to use RefPtr and FrameView::create and remove
+        the explicit deref.
+
+        * page/Frame.h: Changed setView to take a PassRefPtr.
+
+        * page/FrameTree.cpp: Added newly-needed include.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Got rid of one of the two constructors, and removed
+        the initialization of m_refCount and call to show from the reamining one.
+        (WebCore::FrameView::create): Added two create functions that do what the two
+        constructors did before, except that they return a PassRefPtr to make sure the
+        reference counting is handled correctly.
+        (WebCore::FrameView::~FrameView): Removed assertion from when FrameView implemented
+        its own reference counting.
+
+        * page/FrameView.h: Inherit from RefCounted for reference counting. Made the
+        constructor private and added create functions. Got rid of the hand-implemented
+        reference counting in this class.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::currentNSEventSlot): Renamed currentEvent to currentNSEventSlot to
+        make it more clear how it relates to currentNSEvent.
+        (WebCore::EventHandler::currentNSEvent): Updated.
+        (WebCore::CurrentEventScope::CurrentEventScope): Added. Use to set/reset the
+        current event in a foolproof way.
+        (WebCore::CurrentEventScope::~CurrentEventScope): Ditto.
+        (WebCore::EventHandler::wheelEvent): Use CurrentEventScope. Pass the platform
+        window in when constructing the PlatformWheelEvent.
+        (WebCore::EventHandler::keyEvent): Use CurrentEventScope.
+        (WebCore::lastEventIsMouseUp): Use currentNSEvent.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Ditto.
+        (WebCore::EventHandler::eventLoopHandleMouseDragged): Ditto.
+        (WebCore::EventHandler::eventLoopHandleMouseUp): Ditto.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Use
+        currentPlatformMouseEvent to get a mouse event that has the appropriate
+        platform window passed to create it.
+        (WebCore::EventHandler::passWheelEventToWidget): Ditto.
+        (WebCore::EventHandler::mouseDown): Ditto.
+        (WebCore::EventHandler::mouseDragged): Ditto.
+        (WebCore::EventHandler::mouseUp): Ditto.
+        (WebCore::EventHandler::mouseMoved): Ditto.
+        (WebCore::EventHandler::currentPlatformMouseEvent): Added. Passes the
+        platform window that's now needed to create a PlatformMouseEvent.
+        (WebCore::EventHandler::sendContextMenuEvent): Added.
+        (WebCore::EventHandler::eventMayStartDrag): Added.
+
+        * platform/HostWindow.h: Removed unneeded includes and constructor definition.
+
+        * platform/PlatformMouseEvent.h: Sorted things in alphabetical order.
+        Changed Mac constructor to take a windowView as well as the event. This is
+        needed in viewless mode, since the "window" is actually an NSView, so the
+        event has to know which view to compute the coordinates with. Made the
+        same change to pointForEvent.
+        * platform/PlatformWheelEvent.h: Ditto.
+
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::pointForEvent): Convert point from window coordinates to view
+        coordinates if a windowView is passed in. This is used in viewless mode.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent): Ditto.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Ditto.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromContainingWindow): Fixed case where there
+        is no platform widget and no parent. Before it would yield unpredictable
+        results because of dispatching to a nil object and returning a structure.
+        Now it returns the point without changing coordinates at all, which is what
+        we need for this case in viewless mode.
+
+        * rendering/RenderApplet.cpp: Removed unneeded includes.
+        (WebCore::RenderApplet::intrinsicSize): Use widget function.
+        (WebCore::RenderApplet::createWidgetIfNecessary): Ditto.
+
+        * rendering/RenderApplet.h: Make more things private. Get rid of unneeded
+        explicit destructor.
+
+        * rendering/RenderFrame.cpp: Removed unneeded includes.
+        (WebCore::RenderFrame::edgeInfo): Updated to use node function so header
+        doesn't have to define element function.
+        (WebCore::RenderFrame::viewCleared): Ditto. Also changed to use widget
+        function.
+
+        * rendering/RenderFrame.h: Removed unneeded includes. Made some things
+        private. Got rid of element function.
+
+        * rendering/RenderPart.cpp: Removed unneeded includes.
+        (WebCore::RenderPart::~RenderPart): Changed to use clearWidget function.
+        (WebCore::RenderPart::setWidget): Changed to use widget function.
+        (WebCore::RenderPart::deleteWidget): Changed to use passed-in widget.
+        This is now only called by the clearWidget function.
+
+        * rendering/RenderPart.h: Removed unneeded forward declarations.
+        Made more functions private. Updated deleteWidget to take widget argument.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::~RenderPartObject): use frameView function
+        instead of getting at m_view directly.
+        (WebCore::RenderPartObject::updateWidget): Ditto.
+        (WebCore::RenderPartObject::layout): Ditto. Same for widget and m_widget.
+        (WebCore::RenderPartObject::viewCleared): Ditto.
+
+        * rendering/RenderPartObject.h: Made some functions private.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_frameView with
+        construction syntax instead of assignment.
+        (WebCore::RenderWidget::destroy): Updated for name change of m_view
+        to m_frameView.
+        (WebCore::RenderWidget::~RenderWidget): Use clearWidget to delete
+        the widget.
+        (WebCore::RenderWidget::setWidget): Use clearWidget.
+        (WebCore::RenderWidget::paint): Updated for name change of m_view
+        to m_frameView.
+        (WebCore::RenderWidget::deleteWidget): Changed to use passed-in widget.
+
+        * rendering/RenderWidget.h: Made many functions protected, others
+        private and made all data members private.
+
+        * svg/animation/SMILTime.h: Removed unhelpful max and min functions. These
+        just do what std::max and std::min will already do automatically for this
+        type, so they are not helpful.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::SVGImage): Removed unneeded initial values for types
+        that initialize to zero without anything explicit.
+        (WebCore::SVGImage::~SVGImage): Update since m_frame and m_frameView are
+        no longer stored.
+        (WebCore::SVGImage::setContainerSize): Ditto.
+        (WebCore::SVGImage::usesContainerSize): Ditto.
+        (WebCore::SVGImage::size): Ditto.
+        (WebCore::SVGImage::hasRelativeWidth): Ditto.
+        (WebCore::SVGImage::hasRelativeHeight): Ditto.
+        (WebCore::SVGImage::draw): Ditto.
+        (WebCore::SVGImage::nativeImageForCurrentFrame): Ditto.
+        (WebCore::SVGImage::dataChanged): Ditto.
+
+        * svg/graphics/SVGImage.h: Removed unneeded includes and unneeded data
+        members m_document, m_frame, m_frameView, and m_minSize.
+
+2009-06-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        The previous code was assuming that we'll be painting buttons on the scrollbar
+        which isn't true on Linux. To reproduce, resize a page with scrollbars until
+        they are less than two widths high.
+
+        This will need pixel test baselines to be updated in the Chromium tree.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp: move this function...
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect): ... to here
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect): add an alternative which
+        doesn't remove the track when the scrollbar is less than two widths
+        high.
+
+2009-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove workaround that was added to address <rdar://problem/5488678> as it no longer affects our Tiger builds.
+
+        * Configurations/Base.xcconfig:
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Insert*List on an stand-alone image in a content editable region ASSERTS
+        ASSERTION FAILED: isStartOfParagraph(startOfParagraphToMove)
+        https://bugs.webkit.org/show_bug.cgi?id=19066
+
+        Attempt to fix this by noticing that we inserted the list inside
+        the selection which includes the image, and re-adjust the selection
+        to not include the list before trying to move the image into
+        the list item.
+        
+        Test: editing/execCommand/list-wrapping-image-crash.html
+
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename PositionIterator members in hope of further clarity
+        https://bugs.webkit.org/show_bug.cgi?id=24854
+
+        Rename m_parent to m_anchorNode (since although it's always the parent
+        of the previous m_child member, it is not always the parent of the effective position)
+        Rename m_child to m_nodeAfterPositionInAnchor to make clear that it's the node
+        directly following the position.  This member is often NULL, but is always
+        a child of m_parent, now m_anchorNode if set.
+        Rename m_offset to m_offsetInAnchor (since it's interpreted relative to m_anchorNode)
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        (WebCore::PositionIterator::increment):
+        (WebCore::PositionIterator::decrement):
+        (WebCore::PositionIterator::atStart):
+        (WebCore::PositionIterator::atEnd):
+        (WebCore::PositionIterator::atStartOfNode):
+        (WebCore::PositionIterator::atEndOfNode):
+        (WebCore::PositionIterator::isCandidate):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        (WebCore::PositionIterator::node):
+        (WebCore::PositionIterator::offsetInLeafNode):
+
+2009-06-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 17167: Failures in fast/dom/Node/initial-values.html
+
+        This partly solve a compatibility issue with other browsers. It will also
+        make us more consistent while handling XHTML element.
+
+        The issue is that when we create an XHTML element inside an HTML document
+        (as it is the case when calling createElementNS), we default to the HTML
+        behaviour in nodeName. As we cannot test if an HTMLElement is an XHTML
+        element, our fix is to check whether it has a prefix and then default
+        to XML behaviour for nodeName.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::nodeName): Add a prefix check before
+        returning the uppercase tagName (HTML behaviour).
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a compareBoundaryPoints which takes RangeBoundaryPoints
+        https://bugs.webkit.org/show_bug.cgi?id=25500
+
+        I noticed the need for this function when removing compareBoundaryPoints(Position, Position)
+        This patch is almost entirely minus lines.
+
+        No functional changes, thus no tests.
+
+        * dom/Range.cpp:
+        (WebCore::Range::setStart):
+        (WebCore::Range::setEnd):
+        (WebCore::Range::compareBoundaryPoints):
+        (WebCore::Range::boundaryPointsValid):
+        * dom/Range.h:
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove Range::compareBoundaryPoints(Position, Position) per Darin's suggestion in bug 25056
+        https://bugs.webkit.org/show_bug.cgi?id=25500
+
+        Darin indicated the Range should deal only with primitive DOM node/offset
+        pairs, and that Position (which is a more robust editing construct) should have
+        its own comparison functions and that Range.h should not mention Position at all.
+
+        Turns out that Position already has a comparePositions() function (which knows
+        how to additionally handled positions in shadow trees).  So I've just changed
+        all callers of compareBoundaryPoints(Position, Position) to use the existing
+        comparePositions() function.  I've also added a comparePositions which takes
+        VisiblePositions for convenience.
+
+        * dom/Range.cpp:
+        * dom/Range.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::updateStartEnd):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        * editing/htmlediting.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+
+2009-06-02  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26122
+        Upstream v8_utility.h functions into V8Utilities.h.  This patch has
+        some transitional code to make upstreaming easier.  This code will
+        be deleted in a few days.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct): NewInstance -> newInstance.
+        * bindings/v8/V8Utilities.h:
+        (WebCore::AllowAllocation::AllowAllocation): Function added.
+        (WebCore::AllowAllocation::~AllowAllocation): Function added.
+        (WebCore::SafeAllocation::NewInstance): Function added.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        NewInstance -> newInstance.
+        (WebCore::WorkerContextExecutionProxy::toV8): NewInstance ->
+        newInstance.
+
+2009-06-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6940747> Search field’s focus ring is outset
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSearchFieldStyle): Set the focused
+        search field outline offset to -2.
+
+2009-06-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add list of unimplemented event handlers to DOMWindow.
+
+        * page/DOMWindow.idl:
+
+2009-06-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26133
+        Adapt and import py-dom-xpath tests
+
+        Tests: fast/xpath/py-dom-xpath/abbreviations.html
+               fast/xpath/py-dom-xpath/axes.html
+               fast/xpath/py-dom-xpath/data.html
+               fast/xpath/py-dom-xpath/expressions.html
+               fast/xpath/py-dom-xpath/functions.html
+               fast/xpath/py-dom-xpath/nodetests.html
+               fast/xpath/py-dom-xpath/paths.html
+               fast/xpath/py-dom-xpath/predicates.html
+
+        Fix bugs found with this test suite:
+        - name and local-name were incorrect for processing instructions (XPath expanded-name
+        doesn't match DOM exactly);
+        - name, local-name and namespace functions should crash on attribute nodes;
+        - attemps to make node sets from other types were not detected as errors.
+
+        No performance impact.
+
+        * xml/XPathExpressionNode.h: Track type conversion errors that happen during evaluation.
+        An error won't stop evaluation, but an exception will be raised afterwards. We could also
+        detect conversion errors at compile time, but not if we're going to support XPath variables
+        (which is unnecessary for XPathEvaluator, but will be necessary if we decide to make our own
+        XSLT one day).
+
+        * xml/XPathExpression.cpp: (WebCore::XPathExpression::evaluate): Check whether a type
+        conversion exception occurred during evaluation, and raise an excpetion if it did.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::expandedNameLocalPart):
+        (WebCore::XPath::expandedName):
+        XPath name(), local-name() and namespace-uri() functions are defined in terms of expanded-name,
+        which doesn't match anything available via DOM exactly. Calculate the expanded name properly.
+        (WebCore::XPath::FunNamespaceURI::evaluate): This function could crash if used with an
+        attribute node, because it released what was possibly the only reference to attribute node
+        before using it. Changed the function to avoid such situation.
+        (WebCore::XPath::FunLocalName::evaluate): Ditto. Also, used the new expandedNameLocalPart()
+        to work properly with processing instruction nodes.
+        (WebCore::XPath::FunName::evaluate): Ditto (using expandedName()).
+        (WebCore::XPath::FunCount::evaluate): Signal an error if the argument is not a node-set
+        (by using toNodeSet unconditionally, which will raise an error, and return an empty set).
+
+        * xml/XPathPath.cpp: (WebCore::XPath::Filter::evaluate): Signal an error if the expression
+        evaluation result is not a node-set.
+
+        * xml/XPathPath.h: (WebCore::XPath::Filter::resultType): A Filter's result is actually
+        always a node-set (this is not so for FilterExpr production in the spec, but is for us,
+        because we don't naively map BNF productions to classes).
+
+        * xml/XPathPredicate.cpp: (WebCore::XPath::Union::evaluate): Signal an error if either side
+        is not a node-set.
+
+        * xml/XPathStep.cpp: Removed an unnecesary include.
+
+        * xml/XPathValue.cpp:
+        (WebCore::XPath::Value::toNodeSet): Signal an error if conversion fails.
+        (WebCore::XPath::Value::modifiableNodeSet): Ditto.
+        (WebCore::XPath::Value::toNumber): Don't allow inputs that don't match XPath Number production
+        (in particular, those using exponential notation).
+
+2009-06-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Added oncontextmenu, oninput, and onmessage event handlers to
+        the DOMWindow. Aditionally, the onloadstart, onprogress, onstalled,
+        and onsuspend event handlers were implemented but not added to
+        DOMWindow.idl.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninput):
+        (WebCore::DOMWindow::setOninput):
+        (WebCore::DOMWindow::onmessage):
+        (WebCore::DOMWindow::setOnmessage):
+        (WebCore::DOMWindow::oncontextmenu):
+        (WebCore::DOMWindow::setOncontextmenu):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-06-01  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26123
+
+        Remove a redundant checkEncodedString call when constructing a
+        KURL object from a string.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Reposition platform guard, improperly placed by http://trac.webkit.org/changeset/44340
+        Bad Dimitri.
+
+        * platform/KeyboardCodes.h: Repositioned the guard to avoid nested
+            WebCore namespace declarations.
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        * platform/KeyboardCodes.h: Integrated contents of platform/chromium/KeyboardCodes.h
+            with a stern FIXME.
+        * platform/chromium/KeyboardCodes.h: Removed.
+
+2009-06-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix assertion error in --filters enabled debug builds.
+        Instead of using RefPtr<AtomicStringImpl> as keys for the hash maps in SVGFilterBuilder, just use AtomicString objects.
+
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        (WebCore::SVGFilterBuilder::add):
+        (WebCore::SVGFilterBuilder::getEffectById):
+        * svg/graphics/filters/SVGFilterBuilder.h:
+
+2009-06-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix --filters enabled build on Mac.
+        Remove unnecessary 'boundingBox' parameter from finishRenderSVGContent() method.
+        Kill several warnings, to make build pass.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::setStdDeviation):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix Chromium build by adding an #ifdef, restoring the code path to that
+        before http://trac.webkit.org/changeset/44287.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Added an #ifdef.
+
+2009-06-01  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Remove last pieces of the old SVG filter system. They are not
+        usable with our current filter system. The new filter effects
+        will replace the functionality step by step.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/cairo: Removed.
+        * svg/graphics/cairo/SVGResourceFilterCairo.cpp: Removed.
+        * svg/graphics/cg: Removed.
+        * svg/graphics/cg/SVGResourceFilterCg.cpp: Removed.
+        * svg/graphics/cg/SVGResourceFilterCg.mm: Removed.
+        * svg/graphics/filters/SVGFilterEffect.cpp: Removed.
+        * svg/graphics/filters/SVGFilterEffect.h: Removed.
+        * svg/graphics/filters/cg: Removed.
+        * svg/graphics/filters/cg/SVGFEHelpersCg.h: Removed.
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm: Removed.
+        * svg/graphics/filters/cg/SVGFilterEffectCg.mm: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.h: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.m: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.h: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.h: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.m: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.m: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.m: Removed.
+        * svg/graphics/mac: Removed.
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h: Removed.
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm: Removed.
+        * svg/graphics/qt: Removed.
+        * svg/graphics/qt/SVGResourceFilterQt.cpp: Removed.
+        * svg/graphics/skia: Removed.
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp: Removed.
+
+2009-06-01  Dmitry Titov  <dimich@chromium.org>
+
+        Fix the previous checkin (ttp://trac.webkit.org/changeset/44327).
+        This adds a comment suggested during review.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::~ThreadGlobalData): Add comment clarifying the change.
+
+2009-06-01  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25973
+        Avoid calling CurrentThread() in thread-specific destructors in OSX Chromium.
+        Pthreads invoke thread-specific destructors after WTF::detachThread() is called and ThreadIdentifier
+        for the thread removed from the WTF thread map. Calling CurrentThread() in such destructor causes
+        the ThreadIdentifier to be re-created and inserted into the map again. Since Pthreads on OSX reuse
+        the pthread_t between threads, the next created thread will have the same pthread_t and cause an assert
+        in establishIdentifierForPthreadHandle() since the id is already in the map.
+
+        The behavior is covered by existing test LayoutTests/fast/workers/worker-terminate.html, which currently fails
+        on OSX Chromium and will stop failing after this change.
+
+        * platform/ThreadGlobalData.h:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        Store the result of "isMainThread()" in a member variable during construction of thread-specific data
+        to avoid calling IsMainThread() in destructor, since the latter calls CurrentThread() in OSX Chromium.
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Alder and Maciej Stachowiak.
+
+        Bug 26057: StringImpl should share buffers with UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26057
+
+        This change results in the following performance improvements:
+        On http://www.hixie.ch/tests/adhoc/perf/dom/artificial/core/001.html
+        the time went from 78ms to 40ms for append (other times remained constant).
+
+        On http://www.hixie.ch/tests/adhoc/perf/dom/artificial/core/002.html,
+        the time went from 3900ms to 2600ms.
+
+        For http://dromaeo.com/?dom, the time for DomModification improved by ~6%.
+        Other tests in dom seemed to be faster across several runs but within the
+        margin of error (except DOM Attributes which was slightly ~1.5% worse).
+
+        Existing tests cover this code and there is no new functionality
+        that is exposed to test.
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        * platform/text/String.cpp:
+        (WebCore::String::String):
+        (WebCore::String::operator UString):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create): Consumes a shared buffer.
+        (WebCore::StringImpl::ustring): Shares the StringImpl's buffer with the UString.
+        (WebCore::StringImpl::sharedBuffer): Exposes the buffer that may be shared.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable): Converted the bools to be inside of PtrAndFlags
+        to avoid growing StringImpl in size.
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        V8 bindings follow-up to to DOMWindow-related cleanup:
+        http://trac.webkit.org/changeset/44215
+
+        * bindings/v8/ScriptController.cpp: Removed disconnectFrame(), relocated
+            its body to destructor.
+        * bindings/v8/ScriptController.h: Removed disconnectFrame() decl.
+
+2009-05-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - Add panel enabler to the resources panel.
+        - Add session / always options into the panel enabler.
+        - Make enabled status for three panels sticky (globally).
+        - Persist enabled status using InspectorController::Settings
+        - Make InspectorController produce no network-related overhead when
+          resources panel is not enabled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26046
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::Setting::Setting):
+        (WebCore::InspectorController::resourceTrackingEnabled):
+        * inspector/InspectorController.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::resourceTrackingWasEnabled):
+        (WebCore::InspectorFrontend::resourceTrackingWasDisabled):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/PanelEnablerView.js:
+        (WebInspector.PanelEnablerView.enableOption):
+        (WebInspector.PanelEnablerView):
+        (WebInspector.PanelEnablerView.prototype._windowResized):
+        (WebInspector.PanelEnablerView.prototype.alwaysWasChosen):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasEnabled):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasDisabled):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSidebarWidth):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.resourceTrackingWasEnabled):
+        (WebInspector.resourceTrackingWasDisabled):
+
+2009-06-01  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.  Landed (and tweaked) by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25902
+
+        Added WorkerContext.close()
+
+        Test: fast/workers/worker-close.html
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal):
+
+2009-06-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=12471
+        XPathResult not invalidated for documents retrieved via XMLHttpRequest
+
+        Test: fast/xpath/detached-subtree-invalidate-iterator.html and existing tests in dom/svg/level3/xpath.
+
+        Use DOM tree version instead of DOMSubtreeModified events to invalidate, which is more
+        reliable and much faster.
+
+        * xml/XPathExpression.cpp:
+        (WebCore::XPathExpression::evaluate):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+        (WebCore::XPathResult::~XPathResult):
+        (WebCore::XPathResult::invalidIteratorState):
+        (WebCore::XPathResult::iterateNext):
+        * xml/XPathResult.h:
+        (WebCore::XPathResult::create):
+
+2009-06-01  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Adler.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25750
+
+        Test: fast/transforms/bounding-rect-zoom.html
+
+        Make getClientRects and getBoundingClientRect account for ther zoom
+        factor.
+
+        * dom/Element.cpp:
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+
+2009-06-01  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26026
+
+        Fix an infinite loop when using the keyboard in Chromium select
+        popups.
+
+        Not testable since it involves sending a keyboard event to
+        the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * platform/chromium/PopupMenuChromium.cpp:
+
+2009-06-01  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        If a url with an anchor is being loaded, ensure that the anchor remains locked in view until the page
+        has finished loading compeltely or the user has manually scrolled.  Refreshing an anchor url after
+        scrolling to a new location on the page will still result in jumping to the new location.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26034
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Set anchor lock after navigating to anchor.
+        (WebCore::FrameLoader::completed): Release anchor lock.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Ensure anchor lock starts unset.
+        (WebCore::FrameView::reset): Ensure anchor lock starts unset.
+        (WebCore::FrameView::layout): If anchor lock is set, force a gotoAnchor() after layout.
+        (WebCore::FrameView::scrollRectIntoViewRecursively): Release anchor lock if a programmatic scroll begins.
+        (WebCore::FrameView::setWasScrolledByUser): Release anchor lock if user manually scrolls.
+        (WebCore::FrameView::setScrollPosition): Release anchor lock if a programmatic scroll begins.
+        * page/FrameView.h:
+        (WebCore::FrameView::lockedToAnchor): Added.
+        (WebCore::FrameView::setLockedToAnchor): Added.
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        A short clean-up. FilterBuilder is SVG specific. Move it
+        to svg/graphics/filters and rename it to SVGFilterBuilder. 
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/FilterBuilder.cpp: Removed.
+        * svg/FilterBuilder.h: Removed.
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::builder):
+        * svg/graphics/filters/SVGFilterBuilder.cpp: Added.
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        (WebCore::SVGFilterBuilder::add):
+        (WebCore::SVGFilterBuilder::getEffectById):
+        (WebCore::SVGFilterBuilder::clearEffects):
+        * svg/graphics/filters/SVGFilterBuilder.h: Added.
+        (WebCore::SVGFilterBuilder::lastEffect):
+
+2009-05-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13233
+        Need to implement an optimizing XPath evaluator
+
+        Avoid sorting results of hierarchical paths that are naturally sorted. On a flat data structure
+        with 128K nodes and a simple XPath expression, this changes evaluation time from 1.5 minutes
+        to 33 ms.
+
+        * xml/XPathNodeSet.h: Keep track of whether subtrees rooted at nodes in set are disjoint,
+        which is useful for optimization.
+        (WebCore::XPath::NodeSet::NodeSet): Removed, it was identical to compiler generated one.
+        (WebCore::XPath::NodeSet::operator=): Ditto.
+        (WebCore::XPath::NodeSet::swap): Ditto.
+        (WebCore::XPath::NodeSet::isSorted): Single element sets are always sorted, even if sort()
+        was never called.
+        (WebCore::XPath::NodeSet::markSubtreesDisjoint): Just like being sorted, the new flag is
+        maintained by callers.
+        (WebCore::XPath::NodeSet::subtreesAreDisjoint): A single element set only has one subtree.
+        Currently, the only way for a set to gain this flag is to be produced from a single element
+        set with a hierarchical location path.
+
+        * xml/XPathPath.cpp: (WebCore::XPath::LocationPath::evaluate): Use the new flag to avoid
+        maintaining a set of unique nodes, and to avoid sorting the result.
+
+2009-05-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13233
+        Need to implement an optimizing XPath evaluator
+
+        This patch adds some infrastructure and simple optimizations. Namely,
+        - we now avoid building a full NodeSet just to evaluate a predicate in some cases;
+        - "/descendant-or-self::node()/child::" is optimized to iterate the tree once when possible;
+
+        * xml/XPathExpressionNode.cpp:
+        (WebCore::XPath::Expression::Expression):
+        * xml/XPathExpressionNode.h:
+        (WebCore::XPath::Expression::addSubExpression):
+        (WebCore::XPath::Expression::isContextNodeSensitive):
+        (WebCore::XPath::Expression::isContextPositionSensitive):
+        (WebCore::XPath::Expression::isContextSizeSensitive):
+        (WebCore::XPath::Expression::setIsContextNodeSensitive):
+        (WebCore::XPath::Expression::setIsContextPositionSensitive):
+        (WebCore::XPath::Expression::setIsContextSizeSensitive):
+        XPath expression now knows its result type, and whether evaluation depends on context.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLast::resultType):
+        (WebCore::XPath::FunLast::FunLast):
+        (WebCore::XPath::FunPosition::resultType):
+        (WebCore::XPath::FunPosition::FunPosition):
+        (WebCore::XPath::FunCount::resultType):
+        (WebCore::XPath::FunId::resultType):
+        (WebCore::XPath::FunLocalName::resultType):
+        (WebCore::XPath::FunLocalName::FunLocalName):
+        (WebCore::XPath::FunNamespaceURI::resultType):
+        (WebCore::XPath::FunNamespaceURI::FunNamespaceURI):
+        (WebCore::XPath::FunName::resultType):
+        (WebCore::XPath::FunName::FunName):
+        (WebCore::XPath::FunString::resultType):
+        (WebCore::XPath::FunString::FunString):
+        (WebCore::XPath::FunConcat::resultType):
+        (WebCore::XPath::FunStartsWith::resultType):
+        (WebCore::XPath::FunContains::resultType):
+        (WebCore::XPath::FunSubstringBefore::resultType):
+        (WebCore::XPath::FunSubstringAfter::resultType):
+        (WebCore::XPath::FunSubstring::resultType):
+        (WebCore::XPath::FunStringLength::resultType):
+        (WebCore::XPath::FunStringLength::FunStringLength):
+        (WebCore::XPath::FunNormalizeSpace::resultType):
+        (WebCore::XPath::FunNormalizeSpace::FunNormalizeSpace):
+        (WebCore::XPath::FunTranslate::resultType):
+        (WebCore::XPath::FunBoolean::resultType):
+        (WebCore::XPath::FunNot::resultType):
+        (WebCore::XPath::FunTrue::resultType):
+        (WebCore::XPath::FunFalse::resultType):
+        (WebCore::XPath::FunLang::resultType):
+        (WebCore::XPath::FunLang::FunLang):
+        (WebCore::XPath::FunNumber::resultType):
+        (WebCore::XPath::FunNumber::FunNumber):
+        (WebCore::XPath::FunSum::resultType):
+        (WebCore::XPath::FunFloor::resultType):
+        (WebCore::XPath::FunCeiling::resultType):
+        (WebCore::XPath::FunRound::resultType):
+        (WebCore::XPath::Function::setArguments):
+        Set optimization details for the expression. Normally, a function does not introduce context
+        node set dependency, but some use context node as default argument, or otherwise use the context.
+
+        * xml/XPathFunctions.h: Tweaked style.
+
+        * xml/XPathPath.cpp:
+        (WebCore::XPath::Filter::Filter): A filter is as context node set sensitive as its expression is.
+        (WebCore::XPath::LocationPath::LocationPath): A location path can only be context node sensitive,
+        and only if the path relative.
+        (WebCore::XPath::LocationPath::appendStep): Invoke compile-time Step optimizations.
+        (WebCore::XPath::LocationPath::insertFirstStep): Ditto.
+        (WebCore::XPath::Path::Path): A path is as context node set sensitive as its filter is.
+
+        * xml/XPathPath.h:
+        (WebCore::XPath::Filter::resultType): Result type of a filter is the same as of its expression
+        (useful filters return NodeSets, of course).
+        (WebCore::XPath::LocationPath::setAbsolute): An absolute location path if context node set
+        insensitive.
+        (WebCore::XPath::LocationPath::resultType): A path's result is always a node set.
+        (WebCore::XPath::Path::resultType): Ditto.
+
+        * xml/XPathPredicate.h:
+        (WebCore::XPath::Number::resultType): Return a proper result type.
+        (WebCore::XPath::StringExpression::resultType): Ditto.
+        (WebCore::XPath::Negative::resultType): Ditto.
+        (WebCore::XPath::NumericOp::resultType): Ditto.
+        (WebCore::XPath::EqTestOp::resultType): Ditto.
+        (WebCore::XPath::LogicalOp::resultType): Ditto.
+        (WebCore::XPath::Union::resultType): Ditto.
+        (WebCore::XPath::Predicate::isContextPositionSensitive): A predicate can be context position
+        sensitive even if its expression is not, because e.g. [5] is a shortcut for [position()=5].
+        (WebCore::XPath::Predicate::isContextSizeSensitive): This matches expression result.
+
+        * xml/XPathStep.h:
+        (WebCore::XPath::Step::NodeTest::Kind): Removed unused ElementNodeTest, which was previously
+        borrowed from XPath 2.0 to express some optimizations.
+        (WebCore::XPath::Step::NodeTest::mergedPredicates): To avoid building a huge node set and
+        filtering it with predicates, we now try to apply predicates while enumerating an axis.
+        (WebCore::XPath::Step::nodeTest): Expose m_nodeTest.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::~Step): The step owns NodeTest merged predicates, so it is still
+        possible to copy NodeTests.
+        (WebCore::XPath::Step::optimize): Merge predicates into NodeTest if possible.
+        (WebCore::XPath::optimizeStepPair): Optimize some expressions containing "//".
+        (WebCore::XPath::Step::predicatesAreContextListInsensitive): The above optimization is only
+        possible if there are no context sensitive predicates for "//".
+        (WebCore::XPath::Step::evaluate): Track context position for the first merged predicate.
+        (WebCore::XPath::nodeMatchesBasicTest): Check whether the node matches node test, ignoring
+        merged predicates.
+        (WebCore::XPath::nodeMatches): Additionally check merged predicates, and update position.
+        (WebCore::XPath::Step::nodesInAxis): Check merged predicates in optimized attribute code
+        path.
+
+        * xml/XPathVariableReference.h: (WebCore::XPath::VariableReference::resultType): Variable
+        references are not used with XPathEvaluator, so we'll only need them if we decide to
+        reimplement XSLT. The type of variable reference is not known at compile time.
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove unused JSEventTargetBase.h
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventTargetBase.h: Removed.
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Add missing oncanplay, oncanplaythrough, ondurationchange, onemptied,
+        onended, onloadeddata, onloadedmetadata, onpause, onplay, onplaying,
+        onratechange, onseeked, onseeking, ontimeupdate, onvolumechange,
+        onwaiting, onloadstart, onprogress, onstalled, onsuspend, ondrag,
+        ondragend, ondragenter, ondragleave, ondragover, ondragstart and 
+        ondrop event handlers to the DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::ondrag):
+        (WebCore::DOMWindow::setOndrag):
+        (WebCore::DOMWindow::ondragend):
+        (WebCore::DOMWindow::setOndragend):
+        (WebCore::DOMWindow::ondragenter):
+        (WebCore::DOMWindow::setOndragenter):
+        (WebCore::DOMWindow::ondragleave):
+        (WebCore::DOMWindow::setOndragleave):
+        (WebCore::DOMWindow::ondragover):
+        (WebCore::DOMWindow::setOndragover):
+        (WebCore::DOMWindow::ondragstart):
+        (WebCore::DOMWindow::setOndragstart):
+        (WebCore::DOMWindow::ondrop):
+        (WebCore::DOMWindow::setOndrop):
+        (WebCore::DOMWindow::oncanplay):
+        (WebCore::DOMWindow::setOncanplay):
+        (WebCore::DOMWindow::oncanplaythrough):
+        (WebCore::DOMWindow::setOncanplaythrough):
+        (WebCore::DOMWindow::ondurationchange):
+        (WebCore::DOMWindow::setOndurationchange):
+        (WebCore::DOMWindow::onemptied):
+        (WebCore::DOMWindow::setOnemptied):
+        (WebCore::DOMWindow::onended):
+        (WebCore::DOMWindow::setOnended):
+        (WebCore::DOMWindow::onloadeddata):
+        (WebCore::DOMWindow::setOnloadeddata):
+        (WebCore::DOMWindow::onloadedmetadata):
+        (WebCore::DOMWindow::setOnloadedmetadata):
+        (WebCore::DOMWindow::onpause):
+        (WebCore::DOMWindow::setOnpause):
+        (WebCore::DOMWindow::onplay):
+        (WebCore::DOMWindow::setOnplay):
+        (WebCore::DOMWindow::onplaying):
+        (WebCore::DOMWindow::setOnplaying):
+        (WebCore::DOMWindow::onratechange):
+        (WebCore::DOMWindow::setOnratechange):
+        (WebCore::DOMWindow::onseeked):
+        (WebCore::DOMWindow::setOnseeked):
+        (WebCore::DOMWindow::onseeking):
+        (WebCore::DOMWindow::setOnseeking):
+        (WebCore::DOMWindow::ontimeupdate):
+        (WebCore::DOMWindow::setOntimeupdate):
+        (WebCore::DOMWindow::onvolumechange):
+        (WebCore::DOMWindow::setOnvolumechange):
+        (WebCore::DOMWindow::onwaiting):
+        (WebCore::DOMWindow::setOnwaiting):
+        (WebCore::DOMWindow::onloadstart):
+        (WebCore::DOMWindow::setOnloadstart):
+        (WebCore::DOMWindow::onprogress):
+        (WebCore::DOMWindow::setOnprogress):
+        (WebCore::DOMWindow::onstalled):
+        (WebCore::DOMWindow::setOnstalled):
+        (WebCore::DOMWindow::onsuspend):
+        (WebCore::DOMWindow::setOnsuspend):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Add missing onstorage event handler to the DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onstorage):
+        (WebCore::DOMWindow::setOnstorage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-05-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26110
+        Update online/offline events to match the current spec.
+        - Also adds window.ononline and window.onoffline event handler
+          properties.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onoffline):
+        (WebCore::DOMWindow::setOnoffline):
+        (WebCore::DOMWindow::ononline):
+        (WebCore::DOMWindow::setOnonline):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Make use of the new filter system in WebCore for SVG. Deleted Mac bindings
+        and replace it by a platform independent code. Calculation of subRegions
+        is missing but needed for a first filter effect.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/Filter.h:
+        (WebCore::Filter::~Filter):
+        (WebCore::Filter::setSourceImage):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        * svg/FilterBuilder.h:
+        (WebCore::FilterBuilder::lastEffect):
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::SVGFEBlendElement):
+        (WebCore::SVGFEBlendElement::build):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+        (WebCore::SVGFEColorMatrixElement::build):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::SVGFEComponentTransferElement):
+        (WebCore::SVGFEComponentTransferElement::build):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::SVGFECompositeElement):
+        (WebCore::SVGFECompositeElement::build):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement):
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::SVGFEDisplacementMapElement):
+        (WebCore::SVGFEDisplacementMapElement::build):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::SVGFEGaussianBlurElement):
+        (WebCore::SVGFEGaussianBlurElement::build):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::notifyFinished):
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::SVGFEMergeElement):
+        (WebCore::SVGFEMergeElement::build):
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::SVGFEOffsetElement):
+        (WebCore::SVGFEOffsetElement::build):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::SVGFESpecularLightingElement):
+        (WebCore::SVGFESpecularLightingElement::build):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::SVGFETileElement):
+        (WebCore::SVGFETileElement::build):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::SVGFETurbulenceElement):
+        (WebCore::SVGFETurbulenceElement::build):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::contextElement):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::filterBBoxForItemBBox):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        (WebCore::SVGResourceFilter::externalRepresentation):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::filterBoundingBox):
+        (WebCore::SVGResourceFilter::setFilterBoundingBox):
+        (WebCore::SVGResourceFilter::itemBoundingBox):
+        (WebCore::SVGResourceFilter::setItemBoundingBox):
+        (WebCore::SVGResourceFilter::builder):
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Adding 'in1' attribute support for <feFlood>, as specified in SVG 1.1.
+        This change helps creating test cases, once filters are activated.
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::parseMappedAttribute):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Replace all occurrences of SVGResourceFilter by Filter. This is the last 
+        step for a SVG independent filter system. Every other part of WebCore can
+        use the filter system by creating a new Filter object.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply):
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/Filter.h: Added.
+        (WebCore::Filter::setSourceImage):
+        (WebCore::Filter::sourceImage):
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/graphics/filters/SourceGraphic.h:
+        * svg/Filter.cpp: Removed.
+        * svg/Filter.h: Removed.
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::apply):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::apply):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::apply):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        (WebCore::FETurbulence::apply):
+        * svg/graphics/filters/SVGFETurbulence.h:
+        * svg/graphics/filters/SVGFilter.cpp: Added.
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h: Added.
+
+2009-05-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for platforms without plugins support.
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::userAgentStatic):
+        (WebCore::PluginView::getValueStatic):
+
+2009-05-30  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=25979
+
+        Fix regression, local WML files won't load anymore, as the mimetype isn't correctly detected.    
+        Bug filed at <rdar://problem/6917571> to cover this CFNetwork limitation.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-05-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26091
+        Make storage events match the current spec.
+        - Storage event listeners are added to the window.
+        - Storage events are dispatched to the window.
+
+        Updated existing tests.
+
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchWindowEvent):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+
+2009-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 26097: REGRESSION (r44283): Tab key doesn't work when focus is on a <select> element
+
+        Test: fast/forms/focus-control-to-page.html
+
+        * dom/SelectElement.h: Made destructor protected. Tweaked a bit.
+
+        * html/HTMLSelectElement.cpp: Removed unneeded includes.
+        (WebCore::HTMLSelectElement::remove): Removed unneeded range check of the
+        result of optionToListIndex.
+        (WebCore::HTMLSelectElement::parseMappedAttribute): Removed code to set the
+        unused attribute, m_minwidth.
+        (WebCore::HTMLSelectElement::defaultEventHandler): The actual bug fix.
+        Call through to the base class defaultEventHandler if the event hasn't
+        been handled yet.
+
+        * html/HTMLSelectElement.h: Removed unneeded includes. Made a lot more functions
+        private. Removed unused minWidth function and m_minwidth data member.
+
+2009-05-30  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Holger Freyther.
+
+        The two KeyboardCodes.h files are basically identical and the
+        qt one is properly #ifdef-ed for different win32 systems. Share
+        them between Qt and Gtk implementations.
+
+        * GNUmakefile.am:
+        * platform/KeyboardCodes.h: Copied from WebCore/platform/qt/KeyboardCodes.h.
+        * platform/gtk/KeyboardCodes.h: Removed.
+        * platform/qt/KeyboardCodes.h: Removed.
+
+2009-05-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        LocalStorage and SessionStorage's implicit setters do not correctly 
+        handle null.  The custom JS bindings should convert to strings
+        unconditionally and not try to handle null specially.
+        https://bugs.webkit.org/show_bug.cgi?id=25970
+
+        Tests: storage/domstorage/localstorage/string-conversion.html
+               storage/domstorage/sessionstorage/string-conversion.html
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::customPut):
+
+2009-05-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6935192> REGRESSION (Safari 3-TOT): Scroll
+          bars in key window draw as inactive if the WebView is not active
+
+        Test: platform/mac/scrollbars/key-window-not-first-responder.html
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Use the window's key state instead
+        of the WebView's first responder state to switch between active and
+        inactive state.
+
+2009-05-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=18445
+          <rdar://problem/5931174> Assertion failure in CSSGradientValue::image
+          with -webkit-gradient as body's background
+
+        Test: fast/backgrounds/body-generated-image-propagated-to-root.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Check if this
+        is the root element painting a background layer propagated from the
+        body, and if it is, use the body's renderer as the client to
+        StyleImage::image().
+
+2009-05-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for AXObjectCache.
+
+        For !HAVE(ACCESSIBILITY) postNotification was defined twice. Move
+        that into the #ifdef.
+
+        * accessibility/AXObjectCache.cpp:
+
+2009-05-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26072
+
+        Add support for the last missing WML element: <select>. This patch adds WMLSelectElement, providing
+        the same functionality HTMLSelectElement has. The WML specific features will follow soon.
+    
+        Add simple testcase covering <select> element rendering: fast/wml/select.wml
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::optionIndex):
+        (WebCore::isOptionElement):
+        * dom/OptionElement.h:
+        * dom/OptionGroupElement.cpp:
+        (WebCore::isOptionGroupElement):
+        * dom/OptionGroupElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::accessKeySetSelectedIndex):
+        (WebCore::toSelectElement):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::index):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::accessKeySetSelectedIndex):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        (WebCore::RenderMenuList::itemIsLabel):
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::attach):
+        (WebCore::WMLFormControlElement::recalcStyle):
+        * wml/WMLFormControlElement.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::attach):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::insertBefore):
+        (WebCore::WMLOptGroupElement::replaceChild):
+        (WebCore::WMLOptGroupElement::removeChild):
+        (WebCore::WMLOptGroupElement::appendChild):
+        (WebCore::WMLOptGroupElement::removeChildren):
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptGroupElement::accessKeyAction):
+        (WebCore::WMLOptGroupElement::childrenChanged):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::attach):
+        (WebCore::WMLOptGroupElement::detach):
+        (WebCore::WMLOptGroupElement::recalcSelectOptions):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptionElement::accessKeyAction):
+        (WebCore::WMLOptionElement::childrenChanged):
+        (WebCore::WMLOptionElement::parseMappedAttribute):
+        (WebCore::WMLOptionElement::attach):
+        (WebCore::WMLOptionElement::detach):
+        (WebCore::WMLOptionElement::insertedIntoDocument):
+        * wml/WMLSelectElement.cpp: Added.
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::~WMLSelectElement):
+        (WebCore::WMLSelectElement::formControlType):
+        (WebCore::WMLSelectElement::isKeyboardFocusable):
+        (WebCore::WMLSelectElement::isMouseFocusable):
+        (WebCore::WMLSelectElement::selectAll):
+        (WebCore::WMLSelectElement::recalcStyle):
+        (WebCore::WMLSelectElement::dispatchFocusEvent):
+        (WebCore::WMLSelectElement::dispatchBlurEvent):
+        (WebCore::WMLSelectElement::selectedIndex):
+        (WebCore::WMLSelectElement::setSelectedIndex):
+        (WebCore::WMLSelectElement::saveFormControlState):
+        (WebCore::WMLSelectElement::restoreFormControlState):
+        (WebCore::WMLSelectElement::childrenChanged):
+        (WebCore::WMLSelectElement::parseMappedAttribute):
+        (WebCore::WMLSelectElement::createRenderer):
+        (WebCore::WMLSelectElement::appendFormData):
+        (WebCore::WMLSelectElement::optionToListIndex):
+        (WebCore::WMLSelectElement::listToOptionIndex):
+        (WebCore::WMLSelectElement::reset):
+        (WebCore::WMLSelectElement::defaultEventHandler):
+        (WebCore::WMLSelectElement::accessKeyAction):
+        (WebCore::WMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::WMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::WMLSelectElement::updateListBoxSelection):
+        (WebCore::WMLSelectElement::listBoxOnChange):
+        (WebCore::WMLSelectElement::menuListOnChange):
+        (WebCore::WMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::WMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::WMLSelectElement::accessKeySetSelectedIndex):
+        (WebCore::WMLSelectElement::setRecalcListItems):
+        (WebCore::WMLSelectElement::scrollToSelection):
+        (WebCore::WMLSelectElement::insertedIntoTree):
+        * wml/WMLSelectElement.h: Added.
+        (WebCore::WMLSelectElement::canSelectAll):
+        (WebCore::WMLSelectElement::canStartSelection):
+        (WebCore::WMLSelectElement::size):
+        (WebCore::WMLSelectElement::multiple):
+        (WebCore::WMLSelectElement::listItems):
+        * wml/WMLTagNames.in:
+
+2009-05-29  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix for windows).
+
+        http://trac.webkit.org/changeset/44279 left in a "Vector<WCHAR> localeNameBuf"
+        that it was trying to replace.  Resulting in this variable being defined twice (and
+        the second time incorrectly).
+
+        * platform/win/Language.cpp:
+        (WebCore::localeInfo):
+
+2009-05-29  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26018
+
+        Fix behavior of the Element View of the Web Inspector for double
+        clicking the element outline tree.
+
+        Double clicking the element outline tree should
+        1) on attribute: enter attribute editing mode
+        2) on text: enter text editing mode
+        3) otherwise: change root node to the parent element of double clicked
+           element.
+
+        Now, 3) is broken. For example, clicking <html> clears the element
+        outline view.
+
+        rootDOMNode should be updated to this.representedObject.parentNode, not
+        this.parent.representedObject which is parent inside the element
+        outline tree itself.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-05-29  David Moore  <davemoore@google.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26001
+        Change many of the uses of String::adopt() to String::createUninitialized().
+        This allows those strings to use an inlined buffer for their characters.
+
+        * dom/StyleElement.cpp:
+        Loop over nodes to precompute length of string and then
+        write the characters into the allocated inline buffer
+        (WebCore::StyleElement::process):
+        * dom/Text.cpp:
+        Loop over nodes to precompute length of string and then
+        write the characters into the allocated inline buffer
+        (WebCore::Text::wholeText):
+        (WebCore::Text::rendererIsNeeded):
+        (WebCore::Text::createRenderer):
+        (WebCore::Text::createWithLengthLimit):
+        (WebCore::Text::formatForDebugger):
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+        (WebCore::String::insert):
+        (WebCore::String::truncate):
+        (WebCore::String::remove):
+        * platform/text/StringBuilder.cpp:
+        (WebCore::StringBuilder::toString):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper):
+        (WebCore::StringImpl::secure):
+        (WebCore::StringImpl::foldCase):
+        (WebCore::StringImpl::replace):
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::TextCodecLatin1::decode):
+        * platform/text/TextCodecUserDefined.cpp:
+        (WebCore::TextCodecUserDefined::decode):
+        * platform/win/Language.cpp:
+        (WebCore::localeInfo):
+
+2009-05-29  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Darin Alder.
+
+        Bug 25911: Apply href in base elements to anchors shown on the source viewer
+        https://bugs.webkit.org/show_bug.cgi?id=25911
+
+        In rendering HTML sources, parse base elements to apply the base URI to
+        anchors shown on the source viewer.
+
+        This issue was originally reported to the Chromium issue tracker.
+        http://code.google.com/p/chromium/issues/detail?id=2418
+
+        Test: fast/frames/viewsource-link-on-href-value.html
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addViewSourceToken):
+
+2009-05-29  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22429
+        document.styleSheets collection ignores media=presentation
+
+        Ensure that stylesheets though <link> show up in document.styleSheets regardless of media attribute.
+
+        Test: fast/css/sheet-collection-link.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+
+2009-05-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26069
+        Fix a crash in custom V8 bindings code for XMLHttpRequest.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-29  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 26074: SQLTransaction::executeSQL does an unnecessary call to String::copy.
+        https://bugs.webkit.org/show_bug.cgi?id=26074
+
+        The constructor for SQLStatement already does a copy for this string.
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+
+2009-05-29  Darin Adler  <darin@apple.com>
+
+        Fix build; the new Cairo code compiled on Windows only.
+
+        * platform/graphics/gtk/FontPlatformData.h: Added syntheticBold
+        and syntheticOblique functions as in the Windows version to make it
+        easier to use this cross-platform. Later we can make data members
+        private as in the Windows version.
+        * platform/graphics/mac/FontPlatformData.h: Ditto.
+
+2009-05-29  Alexander Macdonald  <alexmac@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        Added support for synthetic bold/oblique font rendering
+        on platforms that use cairo.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-05-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 26024: AX: possible to fail assertion because AXPostNotification calls accessibilityIsIgnored
+        https://bugs.webkit.org/show_bug.cgi?id=26024
+
+        AX notifications are posted after a one shot timer so that notifications are not performed mid-layout.
+        Consolidated postNotification and postNotificationToElement into one method.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-05-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for Windows Cairo target.
+        https://bugs.webkit.org/show_bug.cgi?id=25972
+
+        Compiler mistakenly selects SMILTime min/max instead of STL version,
+        resulting in a build error.  This change makes the meaning of the
+        min/max explicit and avoids the problem.
+
+        * html/TimeRanges.h:
+        (WebCore::TimeRanges::Range::unionWithOverlappingOrContiguousRange):
+
+2009-05-29  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Make SoupMessage a member of ResourceRequest, instead of creating
+        it in startHttp. Implement updating of ResourceRequest from
+        SoupMessage, and vice versa.
+
+        * GNUmakefile.am:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::gotHeadersCallback):
+        (WebCore::ResourceHandle::startHttp):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::~ResourceRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp: Added.
+        (WTF::SoupURI):
+        (WebCore::ResourceRequest::soupMessage):
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+
+2009-05-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26068
+        V8: Remove the remaining b8::Locker usage in worker code.
+        This completes the fix for https://bugs.webkit.org/show_bug.cgi?id=25944,
+        since the patches for enabling timers and that bug have "crossed in the queue".
+        Existing LayoutTests/fast/workers/worker-timeout.html covers this fix (will start work in Chromium).
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-05-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Simplify the Accept-Encoding header we are sending out, for it
+        seems some servers do not enjoy parsing the full, explicit
+        version.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added a new build flag --filters. This replaces the old --svg-filters and enables
+        other parts of WebKit to use some basic filters of platform/graphics/filters if needed.
+        This patch also fixes a bug in dom/DOMImplementation.cpp where we used SVG_FILTER. This flag
+        doesn't exist and was replaced by FILTERS as well as all SVG_FILTERS occurrences.
+        Filters are not working yet. This patch is just a preperation. Filters are deactivated by
+        default. 
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * dom/DOMImplementation.cpp:
+        (WebCore::isSVG10Feature):
+        (WebCore::isSVG11Feature):
+        * page/DOMWindow.idl:
+        * platform/graphics/filters/FEBlend.cpp:
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceAlpha.cpp:
+        * platform/graphics/filters/SourceAlpha.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        * platform/graphics/filters/SourceGraphic.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::selfWillPaint):
+        * rendering/RenderSVGModelObject.cpp:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/Filter.cpp:
+        * svg/Filter.h:
+        * svg/FilterBuilder.cpp:
+        * svg/FilterBuilder.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGComponentTransferFunctionElement.idl:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEBlendElement.idl:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEColorMatrixElement.idl:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFEComponentTransferElement.idl:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDiffuseLightingElement.idl:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEDisplacementMapElement.idl:
+        * svg/SVGFEDistantLightElement.cpp:
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFEDistantLightElement.idl:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncAElement.idl:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncBElement.idl:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncGElement.idl:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEFuncRElement.idl:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEGaussianBlurElement.idl:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEImageElement.idl:
+        * svg/SVGFELightElement.cpp:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeElement.idl:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMergeNodeElement.idl:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFEOffsetElement.idl:
+        * svg/SVGFEPointLightElement.cpp:
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFEPointLightElement.idl:
+        * svg/SVGFESpecularLightingElement.cpp:
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpecularLightingElement.idl:
+        * svg/SVGFESpotLightElement.cpp:
+        * svg/SVGFESpotLightElement.h:
+        * svg/SVGFESpotLightElement.idl:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETileElement.idl:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFETurbulenceElement.idl:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterElement.idl:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/cairo/SVGResourceFilterCairo.cpp:
+        * svg/graphics/cg/SVGResourceFilterCg.cpp:
+        * svg/graphics/cg/SVGResourceFilterCg.mm:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        * svg/graphics/filters/SVGFETurbulence.h:
+        * svg/graphics/filters/SVGFilterEffect.cpp:
+        * svg/graphics/filters/SVGFilterEffect.h:
+        * svg/graphics/filters/SVGLightSource.cpp:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        * svg/graphics/filters/cg/SVGFEHelpersCg.h:
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm:
+        * svg/graphics/filters/cg/SVGFilterEffectCg.mm:
+        * svg/graphics/filters/cg/WKArithmeticFilter.h:
+        * svg/graphics/filters/cg/WKArithmeticFilter.m:
+        * svg/graphics/filters/cg/WKComponentMergeFilter.h:
+        * svg/graphics/filters/cg/WKComponentMergeFilter.m:
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.h:
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.m:
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.h:
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.m:
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.h:
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.m:
+        * svg/graphics/filters/cg/WKDistantLightFilter.h:
+        * svg/graphics/filters/cg/WKDistantLightFilter.m:
+        * svg/graphics/filters/cg/WKGammaTransferFilter.h:
+        * svg/graphics/filters/cg/WKGammaTransferFilter.m:
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.h:
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.m:
+        * svg/graphics/filters/cg/WKLinearTransferFilter.h:
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m:
+        * svg/graphics/filters/cg/WKNormalMapFilter.h:
+        * svg/graphics/filters/cg/WKNormalMapFilter.m:
+        * svg/graphics/filters/cg/WKPointLightFilter.h:
+        * svg/graphics/filters/cg/WKPointLightFilter.m:
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h:
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.m:
+        * svg/graphics/filters/cg/WKSpotLightFilter.h:
+        * svg/graphics/filters/cg/WKSpotLightFilter.m:
+        * svg/graphics/filters/cg/WKTableTransferFilter.h:
+        * svg/graphics/filters/cg/WKTableTransferFilter.m:
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h:
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm:
+        * svg/graphics/qt/SVGResourceFilterQt.cpp:
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp:
+        * svg/svgtags.in:
+
+2009-05-28  Brett Wilson  <brettw@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26067
+
+        Add casts for scale function to make more explicit what is happening
+        and fix a compiler warning.
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::scale):
+
+2009-05-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove the returnValueSlot concept from JSDOMWindowBase. Now that windows
+        are not cleared on navigation it is no longer necessary.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        (WebCore::JSDOMWindowBase::willRemoveFromWindowShell):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+
+2009-05-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo and Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Implement atk_text_get_text_{at,after,before}_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove unnecessary destructor from InputElementData/OptionElementData.
+
+        * dom/InputElement.cpp:
+        * dom/InputElement.h:
+        * dom/OptionElement.cpp:
+        * dom/OptionElement.h:
+
+2009-05-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26062
+
+        Refactor code from all virtual methods in HTMLSelectElement (that are also needed for WMLSelectElement)
+        in the recently introduced SelectElement abstract base class. Follow the same design sheme that InputElement uses.
+
+        A follow-up patch can now easily add WMLSelectElement.
+
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::selectAll):
+        (WebCore::SelectElement::saveLastSelection):
+        (WebCore::isOptionElement):
+        (WebCore::isOptionGroupElement):
+        (WebCore::SelectElement::nextSelectableListIndex):
+        (WebCore::SelectElement::previousSelectableListIndex):
+        (WebCore::SelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElement::setActiveSelectionEndIndex):
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::selectedIndex):
+        (WebCore::SelectElement::setSelectedIndex):
+        (WebCore::SelectElement::optionToListIndex):
+        (WebCore::SelectElement::listToOptionIndex):
+        (WebCore::SelectElement::dispatchFocusEvent):
+        (WebCore::SelectElement::dispatchBlurEvent):
+        (WebCore::SelectElement::deselectItems):
+        (WebCore::SelectElement::saveFormControlState):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::parseMultipleAttribute):
+        (WebCore::SelectElement::appendFormData):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        (WebCore::SelectElement::defaultEventHandler):
+        (WebCore::SelectElement::lastSelectedListIndex):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::SelectElement::typeAheadFind):
+        (WebCore::SelectElement::insertedIntoTree):
+        (WebCore::SelectElementData::SelectElementData):
+        (WebCore::SelectElementData::checkListItems):
+        (WebCore::SelectElementData::listItems):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::multiple):
+        (WebCore::SelectElementData::setMultiple):
+        (WebCore::SelectElementData::size):
+        (WebCore::SelectElementData::setSize):
+        (WebCore::SelectElementData::usesMenuList):
+        (WebCore::SelectElementData::lastOnChangeIndex):
+        (WebCore::SelectElementData::setLastOnChangeIndex):
+        (WebCore::SelectElementData::lastOnChangeSelection):
+        (WebCore::SelectElementData::activeSelectionState):
+        (WebCore::SelectElementData::setActiveSelectionState):
+        (WebCore::SelectElementData::activeSelectionAnchorIndex):
+        (WebCore::SelectElementData::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElementData::activeSelectionEndIndex):
+        (WebCore::SelectElementData::setActiveSelectionEndIndex):
+        (WebCore::SelectElementData::cachedStateForActiveSelection):
+        (WebCore::SelectElementData::shouldRecalcListItems):
+        (WebCore::SelectElementData::setShouldRecalcListItems):
+        (WebCore::SelectElementData::rawListItems):
+        (WebCore::SelectElementData::repeatingChar):
+        (WebCore::SelectElementData::setRepeatingChar):
+        (WebCore::SelectElementData::lastCharTime):
+        (WebCore::SelectElementData::setLastCharTime):
+        (WebCore::SelectElementData::typedString):
+        (WebCore::SelectElementData::setTypedString):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement):
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::HTMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        (WebCore::HTMLSelectElement::canSelectAll):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::createRenderer):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::defaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::scrollToSelection):
+        (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+        * wml/WMLOptionElement.h:
+
+
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::selectAll):
+        (WebCore::SelectElement::saveLastSelection):
+        (WebCore::isOptionElement):
+        (WebCore::isOptionGroupElement):
+        (WebCore::SelectElement::nextSelectableListIndex):
+        (WebCore::SelectElement::previousSelectableListIndex):
+        (WebCore::SelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElement::setActiveSelectionEndIndex):
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::selectedIndex):
+        (WebCore::SelectElement::setSelectedIndex):
+        (WebCore::SelectElement::optionToListIndex):
+        (WebCore::SelectElement::listToOptionIndex):
+        (WebCore::SelectElement::dispatchFocusEvent):
+        (WebCore::SelectElement::dispatchBlurEvent):
+        (WebCore::SelectElement::deselectItems):
+        (WebCore::SelectElement::saveFormControlState):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::parseMultipleAttribute):
+        (WebCore::SelectElement::appendFormData):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        (WebCore::SelectElement::defaultEventHandler):
+        (WebCore::SelectElement::lastSelectedListIndex):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::SelectElement::typeAheadFind):
+        (WebCore::SelectElement::insertedIntoTree):
+        (WebCore::SelectElementData::SelectElementData):
+        (WebCore::SelectElementData::~SelectElementData):
+        (WebCore::SelectElementData::checkListItems):
+        (WebCore::SelectElementData::listItems):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::multiple):
+        (WebCore::SelectElementData::setMultiple):
+        (WebCore::SelectElementData::size):
+        (WebCore::SelectElementData::setSize):
+        (WebCore::SelectElementData::usesMenuList):
+        (WebCore::SelectElementData::lastOnChangeIndex):
+        (WebCore::SelectElementData::setLastOnChangeIndex):
+        (WebCore::SelectElementData::lastOnChangeSelection):
+        (WebCore::SelectElementData::activeSelectionState):
+        (WebCore::SelectElementData::setActiveSelectionState):
+        (WebCore::SelectElementData::activeSelectionAnchorIndex):
+        (WebCore::SelectElementData::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElementData::activeSelectionEndIndex):
+        (WebCore::SelectElementData::setActiveSelectionEndIndex):
+        (WebCore::SelectElementData::cachedStateForActiveSelection):
+        (WebCore::SelectElementData::shouldRecalcListItems):
+        (WebCore::SelectElementData::setShouldRecalcListItems):
+        (WebCore::SelectElementData::rawListItems):
+        (WebCore::SelectElementData::repeatingChar):
+        (WebCore::SelectElementData::setRepeatingChar):
+        (WebCore::SelectElementData::lastCharTime):
+        (WebCore::SelectElementData::setLastCharTime):
+        (WebCore::SelectElementData::typedString):
+        (WebCore::SelectElementData::setTypedString):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement):
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::HTMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        (WebCore::HTMLSelectElement::canSelectAll):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::createRenderer):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::defaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::scrollToSelection):
+        (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+        * wml/WMLOptionElement.h:
+
+2009-05-28  Adam Roben  <aroben@apple.com>
+
+        Don't try to use the new combobox parts on Vista in Classic mode
+
+        Fixes:
+        <rdar://problem/6929277> REGRESSION (r42289+r42350): Windows Classic
+        theme: drop down lists in Preferences get a line/square
+        <rdar://problem/6929298> REGRESSION (r42289): Windows Classic: drop
+        down lists are black with a circle on many sites
+
+        Reviewed by Steve Falkenburg.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMenuList): Only use the new combobox
+        parts when we have a theme (i.e., when we're not in Classic mode).
+        When we don't have a theme, fall back to the pre-r42289 code.
+
+2009-05-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25659
+        Avoid calling frameCount() unnecessarily (which could lead to extra
+        GIF decoding).
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedDataIfNecessary):
+
+2009-05-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=8736
+
+        Tests: fast/borders/border-radius-constraints.html
+               fast/borders/border-radius-split-inline.html
+               
+        When the sum of the corner radii on a side exceed the length of the side,
+        reduce the radii according to CSS 3 rules.
+        
+        Add RenderStyle::getBorderRadiiForRect() to fetch corner radii, applying
+        the constraints. Use that for painting borders, box-shadow, clipping replaced
+        elements
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::scale):
+        Add a scale method that scales by a float (using C rounding rules, like IntRect::scale()).
+
+        * platform/graphics/Path.cpp:
+        Make the QUARTER const static.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        (WebCore::RenderBoxModelObject::paintBorder):
+        Use getBorderRadiiForRect to fetch border radii, and fix a bug when drawing
+        borders for split inlines, which used to apply the radii for each segment,
+        and no longer does.
+
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        Use getBorderRadiiForRect to fetch border radii for clipping.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        Use getBorderRadiiForRect to fetch border radii for clipping.
+
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getBorderRadiiForRect):
+        New bottleneck method to fetch corner radiil given a rect, applying the constraint
+        rules.
+
+2009-05-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26005
+        Optimization for XPath //* does not preserve context size
+
+        Test: fast/xpath/position.html
+
+        Fixed the bug by removing the incorrect optimization, and made enough micro-optimizations to
+        get a performance progression on my tests.
+
+        * xml/XPathPath.h: Removed broken optimizeStepPair().
+
+        * xml/XPathPath.cpp:
+        (WebCore::XPath::LocationPath::evaluate): Style fix.
+        (WebCore::XPath::LocationPath::appendStep): Don't call optimizeStepPair().
+        (WebCore::XPath::LocationPath::insertFirstStep): Ditto.
+        (WebCore::XPath::Path::Path): Style fix.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::primaryNodeType): Turned this member function into a static inline helper.
+        (WebCore::XPath::nodeMatches): Ditto. Don't check for namespace axis, which is unsupported
+        (and might never be).
+        (WebCore::XPath::Step::nodesInAxis): Updated for the new nodeMatches() signature.
+
+        * xml/XPathStep.h:
+        (WebCore::XPath::Step::NodeTest::data):
+        (WebCore::XPath::Step::NodeTest::namespaceURI):
+        Made these data members AtomicString to avoid repeated conversions. This is the biggest
+        performance win here.
+
+        * xml/XPathUtil.cpp: (WebCore::XPath::stringValue): Reserve some capacity upfront.
+
+2009-05-28  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        When creating a linear or radial gradient with a single stop
+        at offset 1.0, the Skia layer was allocating 3 stops, but only
+        filling 2, leaving one uninitialized.  Only 2 stops are necessary
+        in this case, at offsets (0.0, 1.0).
+
+        http://bugs.webkit.org/show_bug.cgi?id=26063
+
+        Covered by: LayoutTests/svg/W3C-SVG-1.1/pservers-grad-16-b.svg
+                    LayoutTests/svg/custom/gradient-stop-corner-cases.svg
+                    LayoutTests/svg/custom/js-late-gradient-and-object-creation.svg
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::totalStopsNeeded):
+
+2009-05-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26041
+        Allow adding resource source to WebInspector.SourceFrame asynchronously.
+
+        Provide common implementation for InspectorController::addResourceSourceToFrame and
+        InspectorController::addSourceToFrame methods.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addResourceSourceToFrame):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._isContentLoaded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+2009-05-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        After r44177 we had a problem when increasing the size
+        of the window the scrollbars stayed and were not hidden.
+        This was due WebCore giving up on the Scrollbar as it became
+        unnecessary but the GtkAdjustment remained unchanged.
+        So from the point of view of the GtkScrolledWindow scrolling
+        was still necessary and the GtkScrollbar kept being displayed.
+
+        Solve the issue by resetting the GtkAdjustment in the
+        destructor of ScrollbarGtk.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::~ScrollbarGtk):
+
+2009-05-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up window.open()'s use of lexical and dynamic scope.
+
+        (Added one unreviewed tweak: use dynamicFrame instead of lexicalFrame
+        for DOMWindow::allowPopUp.)
+
+        Test: http/tests/security/frameNavigation/context-for-window-open.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toDynamicFrame):
+        (WebCore::processingUserGesture):
+        (WebCore::completeURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::createWindow):
+
+2009-05-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26056
+        XPath string() function can be very slow
+
+        * xml/XPathUtil.cpp: (WebCore::XPath::stringValue): Use an intermediate Vector when appending.
+
+2009-05-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6927761> <isindex> placeholder text is unstylable
+          and initially not visible
+
+        Test: fast/forms/isindex-placeholder.html
+
+        * css/html4.css: Added a default style for <isindex> placeholder text.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Changed to call
+        the new protected function updatePlaceholderVisibility().
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Added this
+        protected function to allow HTMLIsIndexElement::parseMappedAttribute()
+        to invoke InputElement::updatePlaceholderVisibility().
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute): Call
+        updatePlaceholderVisibility() when parsing the placeholder attribute.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle): If there
+        is no placeholder pseudo-element style, use the normal style.
+
+2009-05-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        More cleanup of DOMWindow related functions.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::willRemoveFromWindowShell): Renamed from JSDOMWindowBase::clear()
+        * bindings/js/JSDOMWindowBase.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog): Update Comment.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        Remove JSDOMWindowShell::clear().  It was unused.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+
+2009-05-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Miscellaneous cleanup of DOMWindow related functions.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject): Fix poorly named variables.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::supportsProfiling): Don't jump through hoops
+        checking for null frames if the build does not support profiling.
+        (WebCore::JSDOMWindowBase::clear): Use setCurrentEvent(0) instead of calling
+        clearHelperObjectProperties().  It is clearer.
+        * bindings/js/JSDOMWindowBase.h:
+        Removed now unused clearHelperObjectProperties() function, empty disconnectFrame()
+        function, and the empty destructor.
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        Remove disconnectFrame() which only called JSDOMWindowBase::disconnectFrame(), which
+        is a no-op.
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::pageDestroyed):
+        Remove calls to JSDOMWindowShell::disconnectFrame() which only called
+        JSDOMWindowBase::disconnectFrame(), which is a no-op.
+
+2009-05-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25974
+        Remove extra qualifiers from the ScheduledAction decl.
+
+        * bindings/v8/ScheduledAction.h: Removed extraneous class qualifiers.
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make distcheck fix. One more missing file.
+
+        * GNUmakefile.am:
+
+2009-05-27  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fixed trunk build on Linux after r44126.
+
+        * WebCore.pro:
+
+2009-05-27  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6926046> REGRESSION (r43972): http://www.youtube.com/html5 crashes on open
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Don't look for a media engine based on an empty MIME type.
+
+2009-05-27  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26029: FrameLoader::canLoad should allow calls with just a security origin
+        https://bugs.webkit.org/show_bug.cgi?id=26029
+
+        No functional changes, so no tests.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canLoad):
+        * loader/FrameLoader.h:
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix.
+
+        Remove file that does not exist from the build.
+
+        * GNUmakefile.am:
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Remove two unneeded protected constructors, these classes have pure-virtual functions, and can't be constructed anyway.
+
+        * dom/InputElement.h:
+        * dom/OptionGroupElement.h:
+
+2009-05-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17725
+        XPath should be case insensitive for HTML
+
+        Test: fast/xpath/node-name-case-sensitivity.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::Step::nodeMatches): Made node name check case insensitive
+        for HTML elements in HTML documents.
+
+2009-05-27  John Sullivan  <sullivan@apple.com>
+
+        fixed <rdar://problem/6925482> repro crash in WebCore::DragController::dragExited dropping 
+        bookmarks (at least) over Top Sites (at least)
+
+        Reviewed by Kevin Decker
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragExited):
+        nil check m_documentUnderMouse and take the "local file" case if it's nil
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha.
+
+        When building on window, consider Windows specific files.
+
+        * GNUmakefile.am:
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26031
+
+        InputElementData is too heavy, save storing two pointers by passing them
+        directly to the static helper functions (the only place which needs them). 
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::updateFocusAppearance):
+        (WebCore::InputElement::updateSelectionRange):
+        (WebCore::InputElement::aboutToUnload):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::constrainValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::parseSizeAttribute):
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        (WebCore::InputElement::updateValueIfNeeded):
+        (WebCore::InputElement::notifyFormStateChanged):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::updateFocusAppearance):
+        (WebCore::HTMLInputElement::aboutToUnload):
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::setSelectionRange):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::constrainValue):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::updateFocusAppearance):
+        (WebCore::WMLInputElement::aboutToUnload):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueFromRenderer):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::constrainValue):
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26033
+
+        OptionElementData saves an Element pointer, which is unnessary.
+        Just pass it to the static function calls directly.
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        (WebCore::OptionElement::collectOptionText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        (WebCore::OptionElementData::OptionElementData):
+        * dom/OptionElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::text):
+        (WebCore::HTMLOptionElement::value):
+        (WebCore::HTMLOptionElement::setSelected):
+        (WebCore::HTMLOptionElement::setSelectedState):
+        (WebCore::HTMLOptionElement::textIndentedToRespectGroupLabel):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::WMLOptionElement):
+        (WebCore::WMLOptionElement::setSelectedState):
+        (WebCore::WMLOptionElement::value):
+        (WebCore::WMLOptionElement::textIndentedToRespectGroupLabel):
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        When building with MinGW, don't use the __declspec(dl{import,export})
+        decorations and rely on the linker to use its nifty auto-import feature.
+        It is extremely hard to get the decorations right with MinGW in general
+        and impossible in WebKit, where the resulting shared library is linking 
+        together some static libraries.
+
+        * config.h:
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613
+
+        Add a WebCore::Widget that can embed GtkWidget with and
+        without a GdkWindow. This can be used to embed any GtkWidget.
+
+        Some bits are directly copied from the Scrollbar implementation
+        but can not be easily shared here.
+
+        * GNUmakefile.am:
+        * platform/gtk/GtkPluginWidget.cpp: Added.
+        (WebCore::GtkPluginWidget::GtkPluginWidget):
+        (WebCore::GtkPluginWidget::invalidateRect):
+        (WebCore::GtkPluginWidget::frameRectsChanged):
+        (WebCore::GtkPluginWidget::paint):
+        * platform/gtk/GtkPluginWidget.h: Added.
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613.
+
+        Implement Widget::setIsSelected for Gtk+ by searching
+        for a property of the name "webkit-widget-is-selected" and if
+        such property exists we are going to set it. We expect
+        the property to take a boolean.
+
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-05-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/6916371>
+        iWeb 'Announce' button does nothing after publishing to MobileMe
+
+        Add ability to force content sniffing for all urls (including file: urls)
+
+        * WebCore.base.exp:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+        (WebCore::ResourceHandle::forceContentSniffing):
+        * platform/network/ResourceHandle.h:
+
+2009-05-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25996
+
+        [Qt] Dead-code stripping for unix
+
+        * WebCore.pro: Turn on GCC dead-code stripping flags for Unix
+
+2009-05-10  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25646
+
+        [GTK] Send onscroll events for the main FrameView
+
+        WebKit/GTK+ is currently not sending any onscroll
+        events for a frame with external adjustments. This is
+        due the fact that the value-changed signal of the GtkAdjustment
+        is handled by WebCore::ScrollView directly and is not going through
+        the WebCore::Scrollbar -> WebCore::ScrollbarClient ->
+        WebCore::FrameView::valueChanged -> WebCore::ScrollView::valueChanged
+        path.
+
+        Fix the above problem by wrapping the GtkAdjustment we get
+        assigned from GTK+ in a ScrollbarGtk that will not have any
+        visual appearance. Remove code from ScrollView that knows
+        about adjustments and create a special case for
+        WebCore::ScrollView::createScrollbar that will create such
+        a special WebCore::ScrollbarGtk.
+
+        * platform/ScrollView.cpp: Remove adjustment code
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h: Remove adjustment code
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformDestroy):
+        (WebCore::ScrollView::createScrollbar):
+        (WebCore::ScrollView::setGtkAdjustments):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::createScrollbar): Special case.
+        (ScrollbarGtk::ScrollbarGtk):  New ctor and work on the adjustment
+        (ScrollbarGtk::~ScrollbarGtk): Disconnect signal
+        (ScrollbarGtk::frameRectsChanged): Do nothing when we lack a platformWidget
+        * platform/gtk/ScrollbarGtk.h:
+
+2009-05-26  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26035: Make ImageSource::frameHasAlphaAtIndex() return false for JPEGs with CG
+        <https://bugs.webkit.org/show_bug.cgi?id=26035>
+        <rdar://problem/6924087>
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex): return false if the image
+        is JPEG, there is no image type, or m_decoder is null.
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for the JPEGImageDecoder.
+
+        Revision 44167 removed stdio.h from the included headers and
+        this will lead to an error that FILE is not known inside the
+        jpeglib.h Put back the stdio.h include.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-05-26  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the crash issue while running layout tests after enalbed XHTMLMP
+        https://bugs.webkit.org/show_bug.cgi?id=26017
+
+        * dom/Document.cpp:
+        (WebCore::Document::isXHTMLMPDocument):
+
+2009-05-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6901751> 
+        REGRESSION (r35515): Tiger crash painting the selection on registration page of car2go.com
+        
+        Don't use the WKCGContextIsSafeToClip function; it wasn't working correctly. Instead, just disable
+        the improved selection drawing on Tiger.
+        
+        * WebCore.Tiger.exp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillSelectionGaps):
+
+2009-05-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part two
+        Mostly cosmetic changes, mainly to get image decoders for Cairo build to
+        comply with WebKit style guidelines:
+        * Fix header guard names
+        * Fix initializer list wrapping
+        * Fix class/function "{" wrapping
+        * Fix wrapping of long boolean expressions
+        * Fix whitespace around operators
+        * Eliminate whitespace on otherwise-blank lines
+        * No {} on single-line conditional arms
+        * Use 0 instead of NULL
+        * Don't #include "config.h" in headers
+
+        Also a few non-cosmetic changes:
+        * Remove unneeded #ifdef protecting the contents of these files.  The
+          platforms listed don't match who uses these files anymore (even
+          without considering Skia), and platforms which don't use them at all
+          (like CG) aren't harmed by the files, since they don't have
+          equivalently-named classes.  It's simpler to just ditch these.
+        * Convert a use of Vector<>& into SharedBuffer*, since that's how the
+          data is really stored anyway.
+        * Use size() instead of m_size, for consistency with Skia code, and
+          future-proofing (if a particular decoder wants to specialize this).
+        * Move an ASSERT that was slightly more aggressive than necessary.
+        * Change variable names/types for clarity/accuracy and to match Skia.
+        * Remove unnecessary macro magic to work around a problem which no
+          longer exists in the third-party JPEG headers.
+        * Stop silencing a portability warning about setjmp (the vcproj/vsprops
+          are the right place for this)
+        * In Skia code, don't explicitly check |m_failed| before calling
+          isSizeAvailable(), which itself checks |m_failed|.
+
+        * platform/image-decoders/ImageDecoder.h: Fix header guards, "{" wrapping.
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Fix initializer list wrapping.
+        (WebCore::ImageDecoder::ImageDecoder): Fix initializer list wrapping.
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/bmp/BMPImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Remove unneeded #ifdef, fix "{" wrapping.
+        (WebCore::GIFImageDecoderPrivate::GIFImageDecoderPrivate): Use an initializer instead of a block-level statement.
+        (WebCore::GIFImageDecoderPrivate::decode): Expect a SharedBuffer.
+        (WebCore::GIFImageDecoderPrivate::getColorMap):
+        (WebCore::GIFImageDecoder::GIFImageDecoder): Fix initializer list wrapping.
+        (WebCore::GIFImageDecoder::frameCount): Add comment.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): Explicitly cast, fix whitespace around operators.
+        (WebCore::GIFImageDecoder::decode): Pass a SharedBuffer.
+        (WebCore::GIFImageDecoder::initFrameBuffer): Use size() instead of m_size, move ASSERT, fix boolean wrapping, fix indenting.
+        (WebCore::GIFImageDecoder::prepEmptyFrameBuffer): Use size() instead of m_size.
+        (WebCore::GIFImageDecoder::haveDecodedRow): Use size() instead of m_size, eliminate unneeded whitespace, change variable name.
+        (WebCore::GIFImageDecoder::frameComplete): Use size() instead of m_size, no {} on single-line conditional arms, fix boolean wrapping.
+        * platform/image-decoders/gif/GIFImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/gif/GIFImageReader.cpp: Remove unneeded #ifdef.
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h: Fix header guards, change variable type.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/ico/ICOImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Remove unneeded #ifdef, macro magic, silencing of warning.
+        (WebCore::JPEGImageDecoder::outputScanlines): Use size() instead of m_size, change variable name.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Remove unneeded #ifdef, silencing of warning, change variable type.
+        (WebCore::PNGImageReader::PNGImageReader): Fix initializer list wrapping.
+        (WebCore::PNGImageReader::close): Add comment, zero another member for consistency.
+        (WebCore::PNGImageDecoder::PNGImageDecoder): Fix indenting.
+        (WebCore::PNGImageDecoder::decodingFailed): Define in .cpp, not .h.
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/png/PNGImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): Fix whitespace around operators.
+        * platform/image-decoders/skia/GIFImageReader.h: "unsigned" is sufficient to convey "unsigned int".
+        * platform/image-decoders/skia/ImageDecoder.h: Remove unnecessary #includes.
+        (WebCore::ImageDecoder::ImageDecoder): Fix initializer list wrapping.
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::JPEGImageReader): Use 0 instead of NULL.
+        (WebCore::JPEGImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        * platform/image-decoders/skia/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::PNGImageReader): Fix initializer list wrapping.
+        (WebCore::PNGImageDecoder::PNGImageDecoder): Fix indenting.
+        (WebCore::PNGImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        (WebCore::rowAvailable):
+        * platform/image-decoders/skia/XBMImageDecoder.h: Don't #include config.h.
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Fix header guards, "{" wrapping.
+
+2009-05-26  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25944
+        Remove the uses of V8 Locker in worker execution code. No additional test is needed.
+        The normal WebKit layout tests should cover it. However, layout tests that start
+        multiple workers will fail to pass due to test shell limitation in Chromium. To cover
+        this, UI tests will be added (http://code.google.com/p/chromium/issues/detail?id=12554).
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListenerHelper):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+
+2009-05-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25974
+        Enable timers in Chromuim workers.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Added function which can execute a callback using WorkerContext.
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction): added url parameter to capture the worker's location.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval): replaced NotImplemented with code to create ScheduledAction and DOMTimer.
+        Also, removed declarations for clearTimeout/clearInterval callbacks since they are now directly generated from IDL.
+
+2009-05-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23649
+        Update V8 bindings to match SQLTransactionErrorCallback change.
+
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent): Changed to return void.
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h: Ditto.
+
+2009-05-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Move FilterEffect to platform/graphics/filters. First step to get an
+        SVG independent filter system.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FilterEffect.cpp: Added.
+        (WebCore::FilterEffect::FilterEffect):
+        (WebCore::FilterEffect::~FilterEffect):
+        (WebCore::FilterEffect::externalRepresentation):
+        * platform/graphics/filters/FilterEffect.h: Added.
+        (WebCore::FilterEffect::xBoundingBoxMode):
+        (WebCore::FilterEffect::setXBoundingBoxMode):
+        (WebCore::FilterEffect::yBoundingBoxMode):
+        (WebCore::FilterEffect::setYBoundingBoxMode):
+        (WebCore::FilterEffect::widthBoundingBoxMode):
+        (WebCore::FilterEffect::setWidthBoundingBoxMode):
+        (WebCore::FilterEffect::heightBoundingBoxMode):
+        (WebCore::FilterEffect::setHeightBoundingBoxMode):
+        (WebCore::FilterEffect::subRegion):
+        (WebCore::FilterEffect::setSubRegion):
+        (WebCore::FilterEffect::resultImage):
+        (WebCore::FilterEffect::setEffectBuffer):
+        * svg/FilterEffect.cpp: Removed.
+        * svg/FilterEffect.h: Removed.
+
+2009-05-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23649
+        Update SQLTransactionErrorCallback to not return a value per changes in
+        HTML5 spec.
+
+        Test: storage/transaction-error-callback.html
+
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        (WebCore::SQLTransaction::handleTransactionError):
+        (WebCore::SQLTransaction::deliverTransactionErrorCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionErrorCallback.h:
+
+2009-05-26  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25969
+
+        Detect the case where we can fit without scrollbars when the view shrinks, so that we don't mistakenly
+        continue to show scrollbars.
+
+        Added two tests in fast/dynamic.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-05-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25801: change AccessibilityAria -> AccessibilityARIA
+        https://bugs.webkit.org/show_bug.cgi?id=25801
+
+        * GNUmakefile.am:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.cpp: Copied from WebCore/accessibility/AccessibilityAriaGrid.cpp.
+        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::create):
+        (WebCore::AccessibilityARIAGrid::addChild):
+        (WebCore::AccessibilityARIAGrid::addChildren):
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityARIAGrid.h: Copied from WebCore/accessibility/AccessibilityAriaGrid.h.
+        * accessibility/AccessibilityARIAGridCell.cpp: Copied from WebCore/accessibility/AccessibilityAriaGridCell.cpp.
+        (WebCore::AccessibilityARIAGridCell::AccessibilityARIAGridCell):
+        (WebCore::AccessibilityARIAGridCell::~AccessibilityARIAGridCell):
+        (WebCore::AccessibilityARIAGridCell::create):
+        (WebCore::AccessibilityARIAGridCell::parentTable):
+        (WebCore::AccessibilityARIAGridCell::rowIndexRange):
+        (WebCore::AccessibilityARIAGridCell::columnIndexRange):
+        * accessibility/AccessibilityARIAGridCell.h: Copied from WebCore/accessibility/AccessibilityAriaGridCell.h.
+        * accessibility/AccessibilityARIAGridRow.cpp: Copied from WebCore/accessibility/AccessibilityAriaGridRow.cpp.
+        (WebCore::AccessibilityARIAGridRow::AccessibilityARIAGridRow):
+        (WebCore::AccessibilityARIAGridRow::~AccessibilityARIAGridRow):
+        (WebCore::AccessibilityARIAGridRow::create):
+        (WebCore::AccessibilityARIAGridRow::parentTable):
+        (WebCore::AccessibilityARIAGridRow::headerObject):
+        * accessibility/AccessibilityARIAGridRow.h: Copied from WebCore/accessibility/AccessibilityAriaGridRow.h.
+        * accessibility/AccessibilityAriaGrid.cpp: Removed.
+        * accessibility/AccessibilityAriaGrid.h: Removed.
+        * accessibility/AccessibilityAriaGridCell.cpp: Removed.
+        * accessibility/AccessibilityAriaGridCell.h: Removed.
+        * accessibility/AccessibilityAriaGridRow.cpp: Removed.
+        * accessibility/AccessibilityAriaGridRow.h: Removed.
+
+2009-05-26  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26012
+
+        Fix the Skia path to normalize the given source rect when
+        drawing patterns, so it accepts negative width/height (as CG does).
+        Fixes Chromium bug http://www.crbug.com/6167.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Serialize calls to WebInspector. This is the first step where method 
+        calls are being serialized to arrays (not yet JSON stringified ones) and 
+        are being dispatched on the client. This change also allows client to override 
+        InspectorFrontend, so that the serialized calls can be made on a given object
+        instead of in-process WebInspector global. This will be the main control flow
+        when InspectorController is decoupled from the in-process frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26010
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::overrideFrontendObject):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorFrontend::showPanel):
+        (WebCore::InspectorFrontend::populateInterface):
+        (WebCore::InspectorFrontend::reset):
+        (WebCore::InspectorFrontend::debuggerWasEnabled):
+        (WebCore::InspectorFrontend::debuggerWasDisabled):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfile):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::newFunctionCall):
+        (WebCore::InspectorFrontend::callSimpleFunction):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch):
+
+2009-05-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6918671> REGRESSION (r41700): Crashes in debug DumpRenderTree at RefCountedBase::ref().
+
+        * dom/QualifiedName.cpp: (WebCore::QualifiedName::QualifiedName):
+        * dom/QualifiedName.h: (WebCore::QualifiedName::QualifiedNameImpl::QualifiedNameImpl):
+        Adjust empty namespace before QNameComponentsTranslator black magic, not after.
+
+2009-05-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        Added forwarding headers.
+
+        * ForwardingHeaders/wtf/CrossThreadRefCounted.h: Added.
+        * ForwardingHeaders/wtf/OwnFastMallocPtr.h: Added.
+
+2009-05-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - WebCore side of <rdar://problem/6914001>.
+
+        Add a new m_allowPopupsFromPlugin flag.
+        
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::setAllowPopupsFromPlugin):
+        (WebCore::ScriptController::allowPopupsFromPlugin):
+
+2009-05-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26006
+
+        Sort out our use of dynamicGlobalObject and lexicalGlobalObject for
+        window.location.  The correct use appears to be as follows:
+
+        1) Use dynamicGlobalObject to find the user gesture.
+        2) Use dynamicGlobalObject to complete URLs.
+        3) Use lexicalGlobalObject to find the referrer.
+        4) Use lexicalGlobalObject for the frame navigation checks.
+        5) Use lexicalGlobalObject for the XSS checks.
+
+        Tests: http/tests/security/frameNavigation/context-for-location-assign.html
+               http/tests/security/frameNavigation/context-for-location-href.html
+               http/tests/security/frameNavigation/context-for-location.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::shouldAllowNavigation):
+        (WebCore::toLexicalFrame):
+        (WebCore::processingUserGesture):
+        (WebCore::completeURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::reload):
+        (WebCore::JSLocation::assign):
+        (WebCore::JSLocation::toString):
+        (WebCore::JSLocationPrototype::customPut):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::processingUserGesture):
+        (WebCore::shouldAllowNavigation):
+        (WebCore::completeURL):
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetLocation):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-25  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        With Windows compilers older then MSVC 2005, the functions
+        gmtime_s and localtime_s don't exist. The gmtime and localtime are
+        on Windows always thread safe. So use them in the cases where
+        gmtime_s and localtime_s are not present.
+
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+
+2009-05-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Follow up on r44120. PluginPackageMac.cpp is used
+        by Qt on Mac and contained a copy of the m_browserFunc
+        assignments and ::equal, ::hash and ::compareFileVersion.
+        Change it to use the ones from PluginPackage.cpp as well.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25612
+
+        Support conditionals in the tag factories, by placing
+        feature #ifdefs around the individual factory functions
+        and the registration.
+
+        Made the Audio and Video elements conditional in the tag factories
+
+        * html/HTMLTagNames.in:
+        * dom/make_names.pl:
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Gtk build when video is disabled.
+
+        * GNUmakefile.am: Always generate and compile the IDL files for the media
+        elements. They contain proper feature #ifdefs.
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build when video is disabled.
+
+        * WebCore.pro: Always generate the IDL files for the media elements. They
+        contain proper ENABLE(VIDEO) #ifdefs.
+
+2009-05-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26004
+
+        The origin for postMessage should follow lexical scope, not dynamic
+        scope.  Yes, this is a super-obscure corner case.
+
+        Test: http/tests/security/postMessage/origin-follows-lexical-scope.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix build bustage related to PassOwnPtr changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25999
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        Minor cleanup in PluginPackage::hash. Let the compiler
+        figure out the size of the array. Do not have it in the
+        definition and specially not the in the call to
+        StringImpl::hash.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        Move ::hash, ::equal and ::compareFileVersion from
+        the duplicated copies in PluginPackageQt.cpp and
+        PluginPackageGtk to PluginPackage.cpp. We need to #ifdef
+        this for the PluginPackageWin version. Use the new style
+        ENABLE() for this feature/policy and enable it in the Gtk+
+        and Qt buildsystem.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+        (WebCore::PluginPackage::equal):
+        (WebCore::PluginPackage::compareFileVersion):
+        * plugins/gtk/PluginPackageGtk.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        So far the initialization of the browserfuncs struct
+        is done in PluginPackageQt, PluginPackageGtk and
+        PluginPackageWin there is no need for this duplication.
+
+        The PluginPackageWin version got copied to PluginPackage
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-05-24  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Added standard input for filter system.
+
+        No testcases were added. Filter system is still off.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/SourceAlpha.cpp: Added.
+        (WebCore::SourceAlpha::create):
+        (WebCore::SourceAlpha::effectName):
+        (WebCore::SourceAlpha::apply):
+        (WebCore::SourceAlpha::dump):
+        * platform/graphics/filters/SourceAlpha.h: Added.
+        (WebCore::SourceAlpha::SourceAlpha):
+        * platform/graphics/filters/SourceGraphic.cpp: Added.
+        (WebCore::SourceGraphic::create):
+        (WebCore::SourceGraphic::effectName):
+        (WebCore::SourceGraphic::apply):
+        (WebCore::SourceGraphic::dump):
+        * platform/graphics/filters/SourceGraphic.h: Added.
+        (WebCore::SourceGraphic::SourceGraphic):
+        * svg/FilterBuilder.cpp: Added.
+        (WebCore::FilterBuilder::FilterBuilder):
+        (WebCore::FilterBuilder::add):
+        (WebCore::FilterBuilder::getEffectById):
+        (WebCore::FilterBuilder::clearEffects):
+        * svg/FilterBuilder.h:
+
+2009-05-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25612
+
+        Add support conditionals in the JSC bindings generator code for attributes,
+        by placing feature #ifdefs around the setters/getters.
+
+        Made the audio and video element specific DOM attributes conditional
+        in the generated code, by moving the #ifdefs from the IDL files into
+        the generated code. This allows for re-using the same generated code
+        with or without ENABLE(VIDEO).
+
+        * page/DOMWindow.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-05-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for Qt. Change signature to have PassOwnPtr.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::newTextCodecQt):
+
+2009-05-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - clean up ColorMac a little
+
+        * platform/graphics/mac/ColorMac.h: Whitespace change.
+        * platform/graphics/mac/ColorMac.mm: Removed redundant #import
+        statements and sorted the remaining ones.
+        (WebCore::makeRGBAFromNSColor): Replaced four Objective-C method calls
+        with a single call and removed redundant casts to int.
+        (WebCore::nsColor): Removed ".0f" from number literals used as CGFloats.
+        In one case, this avoids an intermediate conversion to float before
+        conversion to double on 64-bit.
+        (WebCore::CGColorFromNSColor): Replaced four Objective-C method calls
+        with a single call.
+        (WebCore::focusRingColor):
+        (+[WebCoreControlTintObserver controlTintDidChange]): Whitespace change.
+
+2009-05-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] ROLE_ROW_HEADER should not be used for list item bullets/numbers
+        https://bugs.webkit.org/show_bug.cgi?id=25900
+
+        Use ATK_ROLE_TEXT for ListMarkerRole.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole):
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Reformat WebCore::requiresContextForWordBoundary()
+
+        * platform/text/TextBoundaries.h:
+        (WebCore::requiresContextForWordBoundary):
+
+2009-05-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Roll out ResourceHandle patch, that I accidently included in my last commit.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+
+2009-05-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23808
+
+        After a long journey, add the last missing ABC to share form control element support with HTMLSelectElement.
+        RenderListBox/RenderMenuList operates on SelectElement instead of HTMLSelectElement now, querying selected index etc.
+        This makes it possible to use these render objects for ie. WML, as it's done before for input & option elements.
+
+        WMLSelectElement will be created soon, in a follow-up patch, adding more methods to SelectElement, sharing code between
+        HTMLSelectElement/WMLSelectElement.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::listBoxOptionIndex):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::dispatchFormControlChangeEvent):
+        * dom/SelectElement.cpp: Added.
+        (WebCore::toSelectElement):
+        * dom/SelectElement.h: Added.
+        (WebCore::SelectElement::~SelectElement):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::index):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::lastSelectedListIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::length):
+        (WebCore::HTMLSelectElement::remove):
+        (WebCore::HTMLSelectElement::value):
+        (WebCore::HTMLSelectElement::setValue):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        (WebCore::HTMLSelectElement::nextSelectableListIndex):
+        (WebCore::HTMLSelectElement::previousSelectableListIndex):
+        (WebCore::HTMLSelectElement::setLength):
+        (WebCore::HTMLSelectElement::checkListItems):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::valueChanged):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::scrollToRevealSelection):
+        (WebCore::RenderListBox::size):
+        (WebCore::RenderListBox::numItems):
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        (WebCore::RenderListBox::panScroll):
+        (WebCore::RenderListBox::autoscroll):
+        (WebCore::RenderListBox::stopAutoscroll):
+        (WebCore::RenderListBox::valueChanged):
+        (WebCore::RenderListBox::nodeAtPoint):
+        * rendering/RenderListBox.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::RenderMenuList):
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::updateFromElement):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::showPopup):
+        (WebCore::RenderMenuList::valueChanged):
+        (WebCore::RenderMenuList::itemText):
+        (WebCore::RenderMenuList::itemIsEnabled):
+        (WebCore::RenderMenuList::itemStyle):
+        (WebCore::RenderMenuList::itemBackgroundColor):
+        (WebCore::RenderMenuList::listSize):
+        (WebCore::RenderMenuList::selectedIndex):
+        (WebCore::RenderMenuList::itemIsSeparator):
+        (WebCore::RenderMenuList::itemIsLabel):
+        (WebCore::RenderMenuList::itemIsSelected):
+        (WebCore::RenderMenuList::setTextFromItem):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::setValueForPosition):
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Fix Gtk/Qt builds for PassOwnPtr
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern): Use an OwnPtr<ImageBuffer>
+        instead of an std::auto_ptr<ImageBuffer> to store the result of
+        ImageBuffer::create() now that it returns a
+        PassOwnPtr<ImageBuffer>.
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains): Ditto.
+        (WebCore::Path::strokeBoundingRect): Ditto.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        No test cases added since there is no change in behavior.
+
+        * WebCore.base.exp: Updated export for
+        HistoryItem::setRedirectURLs() which now takes a PassOwnPtr.
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Use NodeListsNodeData::create()
+        instead of new NodeListsNodeData.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::getElementsByTagNameNS): Ditto.
+        (WebCore::Node::getElementsByName): Ditto.
+        (WebCore::Node::getElementsByClassName): Ditto.
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::create): Added.  Implements
+        create() pattern popularized by RefCounted classes.
+        (WebCore::NodeListsNodeData::NodeListsNodeData): Declared
+        private constructor.
+        (WebCore::NodeRareData::setNodeLists): Now takes a PassOwnPtr<>
+        instead of an auto_ptr<>.
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::setRedirectURLs): Ditto.
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setRedirectURLs): Ditto.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal): Use
+        OwnPtr<> instead of auto_ptr<> for stack variable.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer): Updated to use
+        assignment operator now that ImageBuffer::create() returns a
+        PassOwnPtr<>.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::createHTMLParserQuirks): Return a
+        PassOwnPtr<> instead of a raw HTMLParserQuirks pointer.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::createHTMLParserQuirks): Ditto.
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create): Return PassOwnPtr<> instead of
+        auto_ptr<>.  Use OwnPtr<> instead of auto_ptr<> for stack
+        variable.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * platform/text/TextCodec.h:
+        (WebCore::NewTextCodecFunction): Return PassOwnPtr<> instead of
+        auto_ptr<>.
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::newTextCodecICU): Ditto.
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::newStreamingTextDecoderWindowsLatin1): Ditto.
+        * platform/text/TextCodecUTF16.cpp:
+        (WebCore::newStreamingTextDecoderUTF16LE): Ditto.
+        (WebCore::newStreamingTextDecoderUTF16BE): Ditto.
+        * platform/text/TextCodecUserDefined.cpp:
+        (WebCore::newStreamingTextDecoderUserDefined): Ditto.
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::newTextCodec): Ditto.
+        * platform/text/TextEncodingRegistry.h:
+        (WebCore::newTextCodec): Ditto.
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::newTextCodecMac): Ditto.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Use
+        OwnPtr<> instead of auto_ptr<> for stack variable.
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent): Ditto.  Return
+        OwnPtr<> instead of auto_ptr<>.
+        * svg/SVGMaskElement.h:
+        (WebCore::SVGMaskElement::drawMaskerContent): Return OwnPtr<>
+        instead of auto_ptr<>.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern): Use OwnPtr<> instead
+        of auto_ptr<> for stack variable.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame): Updated to use
+        assignment operator now that ImageBuffer::create() returns a
+        PassOwnPtr<>.
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient): Use OwnPtr<>
+        instead of auto_ptr<> for stack variable.
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setTile): Updated to take a
+        PassOwnPtr<> instead of an auto_ptr<>.
+        (WebCore::SVGPaintServerPattern::setup): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * svg/graphics/SVGPaintServerPattern.h:
+        (WebCore::SVGPaintServerPattern::setTile): Updated to take a
+        PassOwnPtr<> instead of an auto_ptr<>.
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask): Updated to use
+        assignment operator now that SVGMaskElement::drawMaskerContent()
+        returns a PassOwnPtr<>.  Use OwnPtr<> instead of auto_ptr<> for
+        stack variable.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * ForwardingHeaders/wtf/OwnPtrCommon.h: Added.
+        * ForwardingHeaders/wtf/PassOwnPtr.h: Added.
+        * WebCore.vcproj/WebCore.vcproj: Added OwnPtrCommon.h and
+        PassOwnPtr.h.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Fix Mac builds by backing out r44093
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        * page/Geolocation.idl:
+        * page/Geoposition.cpp:
+        * page/Geoposition.h:
+        * page/Geoposition.idl:
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame):
+        (WebCore::Navigator::geolocation):
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+        (WebCore::GeolocationService::create):
+
+2009-05-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Add GEOLOCATION guards around Geolocation API code
+        https://bugs.webkit.org/show_bug.cgi?id=25756
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        * page/Geolocation.idl:
+        * page/Geoposition.cpp:
+        * page/Geoposition.h:
+        * page/Geoposition.idl:
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame):
+        (WebCore::Navigator::geolocation):
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Rename startupdateStyleIfNeededDispatcher to startUpdateStyleIfNeededDispatcher
+
+        In r42377, startUpdateRenderingDispatcher() was renamed to
+        startupdateStyleIfNeededDispatcher(), but the camelCase "U" was
+        dropped.  This change restores it.
+
+        * WebCore.order:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::startUpdateStyleIfNeededDispatcher):
+        (WebCore::AnimationControllerPrivate::addEventToDispatch):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        * page/animation/AnimationControllerPrivate.h:
+
+2009-05-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build-fix for Qt. Disable SVG Filters.
+
+        SVG Filters can not be built right now and Qt should not have
+        them enabled anyway as they do not carry out any filtering.
+
+        * WebCore.pro:
+
+2009-05-23  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build-fix for gtk. Remove source input files
+        for SVG filter system from the build for the moment and
+        add them later again.
+
+        * GNUmakefile.am:
+
+2009-05-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Preparing Filter primitves for the new filter system.
+
+        No testcases were added. SVG filters are off by default.
+
+        * GNUmakefile.am:
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply):
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEComposite.h:
+        * svg/Filter.h:
+        * svg/FilterBuilder.h:
+        (WebCore::FilterBuilder::lastFilter):
+        * svg/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * svg/FilterEffect.h:
+        (WebCore::FilterEffect::xBoundingBoxMode):
+        (WebCore::FilterEffect::setXBoundingBoxMode):
+        (WebCore::FilterEffect::yBoundingBoxMode):
+        (WebCore::FilterEffect::setYBoundingBoxMode):
+        (WebCore::FilterEffect::widthBoundingBoxMode):
+        (WebCore::FilterEffect::setWidthBoundingBoxMode):
+        (WebCore::FilterEffect::heightBoundingBoxMode):
+        (WebCore::FilterEffect::setHeightBoundingBoxMode):
+        (WebCore::FilterEffect::subRegion):
+        (WebCore::FilterEffect::setSubRegion):
+        (WebCore::FilterEffect::resultImage):
+        (WebCore::FilterEffect::setEffectBuffer):
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::apply):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::apply):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::apply):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        (WebCore::FETurbulence::apply):
+        * svg/graphics/filters/SVGFETurbulence.h:
+
+2009-05-22  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build-fix for gtk. Breakage caused by a wrong call of ImageBuffer.
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-22  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Added the use of tileRect() for a correct drawing of
+        border-images.
+
+        Testcases for border-image are in fast/borders like
+        border-image-01.html and will be activated for cairo, once
+        gtk supports pixel tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19652
+        [CAIRO] wrong drawing of border-image
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-22  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25684
+
+        Ask the Scrollbar for the orientation.
+
+        Use Scrollbar::orientation to figure out the
+        direction of scrolling.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::valueChanged):
+
+2009-05-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6916082> Incorrect handling of % as CSS value.
+
+        Test: fast/css/percent-character-as-value.html
+
+        * css/CSSGrammar.y: Make a stray % character reliably cause
+        CSS parsing to succeed, but the CSS value to be ignored because
+        of incorrect type. A type of 0 has this effect.
+
+2009-05-22  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25971
+        Correct a handful of build errors in the Windows Cairo variant
+        due to missing VIDEO support.
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude RenderMediaControls for
+          the Cairo-based Windows target.
+        * rendering/RenderThemeWin.cpp: Avoid #include of RenderMediaControls
+          for non-VIDEO builds.
+
+2009-05-22  David Kilzer  <ddkilzer@apple.com>
+
+        One <limits> is enough
+
+        * html/HTMLMediaElement.cpp: Removed duplicate #include <limits>.
+
+2009-05-22  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/6915957> REGRESSION: Hang when leaving page with VLC
+        plug-in
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        Look for the VLC plug-in's new name.
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25966
+
+        Remove redudant member from Chromium's ResourceRequest.  We already
+        have this data in the cross-platform ResourceRequestBase.  Also, rename
+        ChromiumBridge parameter to be consistant with the new name for this
+        piece of data.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-05-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Only account for overhang for multi-character strings.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25961
+
+        * platform/wx/wxcode/win/fontprops.cpp:
+        (GetTextExtent):
+
+2009-05-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch to CURL cookies so we can benefit from API updates.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * webcore-wx.bkl:
+
+2009-05-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part one
+        Indent contents of namespaces in header files, to comply with the
+        style guide.  No functional change.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::bytes):
+        (WebCore::RGBA32Buffer::rect):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::status):
+        (WebCore::RGBA32Buffer::duration):
+        (WebCore::RGBA32Buffer::disposalMethod):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setRect):
+        (WebCore::RGBA32Buffer::ensureHeight):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setDuration):
+        (WebCore::RGBA32Buffer::setDisposalMethod):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+        (WebCore::ImageDecoder::m_failed):
+        (WebCore::ImageDecoder::~ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::size):
+        (WebCore::ImageDecoder::frameCount):
+        (WebCore::ImageDecoder::repetitionCount):
+        (WebCore::ImageDecoder::supportsAlpha):
+        (WebCore::ImageDecoder::failed):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::clearFrameBufferCache):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::filenameExtension):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::filenameExtension):
+        (WebCore::GIFImageDecoder::frameDurationAtIndex):
+        (WebCore::GIFImageDecoder::):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::filenameExtension):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        (WebCore::JPEGImageDecoder::supportsAlpha):
+        (WebCore::JPEGImageDecoder::reader):
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::reader):
+        (WebCore::PNGImageDecoder::decodingFailed):
+        * platform/image-decoders/xbm/XBMImageDecoder.h:
+        (WebCore::XBMImageDecoder::filenameExtension):
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Minor changes that allow building a hybrid version of WebKit
+        that has WTF Unicode backend based on GLib functions while
+        text codecs and TextBreakIterator remain based on ICU.
+
+        Fixed some includes that were assuming a WTF ICU backend and
+        introduced temporary usage of WTF_USE_GLIB_ICU_UNICODE_HYBRID
+        macro.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        * platform/text/TextBoundariesICU.cpp:
+        * platform/text/TextCodecICU.h:
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25955
+
+        Remove the policyBaseURL parameter from setCookie.  This parameter is
+        redundant with the document parameter.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * dom/Document.cpp:
+        (WebCore::Document::setCookie):
+        * platform/CookieJar.h:
+        * platform/mac/CookieJar.mm:
+        (WebCore::setCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::setCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25955
+
+        Rename policyBaseURL and mainDocumentURL to firstPartyForCookies.  The
+        previous names were confusing and inaccurate.
+
+        * WebCore.order:
+        * dom/Document.cpp:
+        (WebCore::Document::setCookie):
+        * dom/Document.h:
+        (WebCore::Document::firstPartyForCookies):
+        (WebCore::Document::setFirstPartyForCookies):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::updateFirstPartyForCookies):
+        (WebCore::FrameLoader::setFirstPartyForCookies):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::firstPartyForCookies):
+        (WebCore::ResourceRequestBase::setFirstPartyForCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::firstPartyForCookies):
+        (WebCore::ResourceRequestBase::setFirstPartyForCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::setCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+
+2009-05-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Fix the call to editingCancelled to be this._editingCancelled, since
+        editingCancelled doesn't exist and throws an exception.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24881>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+
+2009-05-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25928
+        Several errors detected by cppcheck
+
+        Fix all (the only one) problem in cross-platform code found by the tool. Port maintainers
+        should take a look at other reports.
+
+        * css/CSSParser.cpp: (WebCore::CSSParser::addProperty): Don't leak the property even if there
+        are billions of those.
+
+2009-05-22  Shinichiro Hamaji  <hamaji@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove optimization path alpha=0 case from GraphicContext(CG|Skia).
+        This optimization doesn't make sense for some composite mode (e.g., 'copy' operation).
+
+        https://bugs.webkit.org/show_bug.cgi?id=25956
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Revert the whole thing, since we can't figure out a way to make it
+        work in all platforms.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Windows build.
+
+        Apparently it can't tell if '1.0f' is float or double, so cast to
+        float.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix breakage from the previous patch.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25805
+        In debug build, mingw win32 build has problems with powf
+
+        Change C-style calls to powf and sqrtf to C++-style calls to
+        overloaded pow and sqrt. This solves also a problem with mingw
+        compiler during the debug build.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-21  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6913680> Update image caching options.
+        Disable extra ImageIO cache because we already handle caching decoded image data.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-05-21  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25903: Create a default UI theme for media controls in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=25903
+
+        Implement a default UI for chromium.  Add a style sheet for Chromium
+        media controls with good defaults and implemented basic draw functions
+        for play/pause & mute buttons.
+
+        * css/mediaControlsChromium.css: Added.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet): Export
+        our custom media controls style sheet.
+        (WebCore::RenderThemeChromiumLinux::paintMediaButtonInternal): Paint
+        buttons respecting chromium media controls color scheme.
+        (WebCore::RenderThemeChromiumLinux::paintMediaPlayButton): Paint logic
+        specific to play/pause button.
+        (WebCore::RenderThemeChromiumLinux::paintMediaMuteButton): Paint
+        specific to mute button.
+        * rendering/RenderThemeChromiumLinux.h: Appropriate header changes.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet): Export
+        our custom media controls style sheet.
+        (WebCore::RenderThemeChromiumWin::paintMediaButtonInternal): Paint
+        buttons respecting chromium media controls color scheme.
+        (WebCore::RenderThemeChromiumWin::paintMediaPlayButton): Paint logic
+        specific to play/pause button.
+        (WebCore::RenderThemeChromiumWin::paintMediaMuteButton): Paint specific
+        to mute button.
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize): Appropriate
+        header changes.
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        When stripping the query from a file:// URL, do not leave a trailing question mark.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25940
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Notify ImageObserver::didDraw to help the cache purge alive resources.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25942
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+2009-05-21  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Flesh out font fallback for Chromium's Skia port.
+        getLastResortFallbackFont should fall back on well-known fonts.
+        https://bugs.webkit.org/show_bug.cgi?id=25860
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): try known font names.
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - speculative fix for <rdar://problem/6890716> crash at
+          FontCache::purgeInactiveFontData + 199
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::purgeInactiveFontData): Deleting a SimpleFontData
+        can cause releaseFontData() to be called, which modifies
+        gInactiveFontData. Therefore, avoid deleting SimpleFontData instances
+        while iterating over gInactiveFontData and delete them afterwards.
+
+2009-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Test for <rdar://problem/6910832> | https://bugs.webkit.org/show_bug.cgi?id=25907
+        Incorrect URL returned to the DOM while the user drags a file
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::tryDHTMLDrag): Don't base our decision on KURL,
+        since that only looks at the text of the document's URL. Do base our
+        decision on the securityOrigin(), which knows more about the document's
+        actual origin.
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25947
+          Assertion failure in FrameLoader::transitionToCommitted on launch in
+          Safari with r43985
+
+        Rolled out r43979.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+
+2009-05-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson and Mark Rowe.
+
+        Fix for <rdar://problem/6901522>
+        REGRESSION: Office 2008: Preview with browser is not shown, and Finder window is in the front of Safari
+
+        If the NSURLRequest is annotated with a "ForceHTMLMIMEType" property, force
+        the MIME type to be text/html.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-05-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Blind windows fix after last commit.
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use an environment variable to control which logs are on and off.
+        Also, make a generic function for translating channel name to its log.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25936
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        * platform/wx/LoggingWx.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-05-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 25946: Chromium needs MIMETypeRegistry::getMediaMIMETypeForExtension implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=25946
+
+        A very simple implementation to keep it working.  A bug has been filed in the chromium db
+        (http://code.google.com/p/chromium/issues/detail?id=12441) to investigate doing something more
+        complete.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+
+2009-05-20  Siddhartha Chattopadhyaya  <sidchat@google.com>
+
+        Reviewed by Justin Garcia.
+        
+        Add automatic spell correction support in WebKit
+
+        https://bugs.webkit.org/show_bug.cgi?id=24953
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingInRange):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::markAllMisspellingsInRange):
+        (WebCore::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markMisspellings):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::getAutoCorrectSuggestionForMisspelledWord):
+        * page/EditorClient.h:
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Darin Adler.
+
+        Text files which have sub MIME types are treated as not displayable
+        http://bugs.webkit.org/show_bug.cgi?id=24903
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType): Regard any
+        MIME type beginning with "text/" as supported and remove all "text/"
+        types from the list.
+
+2009-05-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25890
+        Implement Network logging channel on Mac
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::setDefersLoading):
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didCancelAuthenticationChallenge:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]):
+        (-[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]):
+        (-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]):
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]):
+        Added logging for async requests (as these are most interesting).
+
+2009-05-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/6902197> WebCore doesn't know about all of the MIME types supported by QTKit
+        
+        Add a static table to map from some common file extensions to their MIME types so it
+        is possible to detect support even when the platform mapping is incomplete. Use the
+        table to lookup types not found by UTI on the OSX, and when looking for a media engine
+        with a generic or missing type.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeMediaTypeMaps): New, initialize the mediaMIMETypeForExtensionMap.
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension): New. Look for the specified
+        MIME type in the static mapping table if the platform specific getMIMETypeForExtension
+        doesn't find a match.
+        * platform/MIMETypeRegistry.h: Declare getMediaMIMETypeForExtension.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): When the type passed is empty, "application/octet-stream", or
+        "text/plain", try to look it up based on the file extension with getMediaMIMETypeForExtension.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::addFileTypesToCache): See if getMediaMIMETypeForExtension can map from file extension
+        to MIME type if UTI fails.
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Clean up DragController
+        https://bugs.webkit.org/show_bug.cgi?id=25926
+
+        I renamed m_document to m_documentUnderMouse to better document what it does
+        I could call it m_lastDocumentUnderMouse to be most-accurate, but this seemed
+        long enough.
+
+        I also saw copy/paste code involving clearing the selection when moving out of
+        one document and into another.  I moved that code into a function called
+        mouseMovedIntoDocument.
+
+        I also got rid of a couple needless null-checks after confirming via source
+        inspection they were not ever possible.
+        In Mac WebKit it's not possible to have a Page that doesn't have a mainFrame()
+        I left an ASSERT(m_page->mainFrame()) in case some other port ever violates this.
+        It's also not possible to return a document from documentAtPoint that is not
+        in a frame (as such a document would not be rendered).
+
+        No functional changes, thus no tests.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragIsMove):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::mouseMovedIntoDocument):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::operationForLoad):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::canProcessDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::placeDragCaret):
+        * page/DragController.h:
+        (WebCore::DragController::documentUnderMouse):
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Rename DragController::dragOperation() to sourceDragOperation() for clarity
+        Remove unused setDragOperation()
+
+        There are two times DragOperation is used.  The source specifies
+        what drag operations it supports (in a mask) and the destination
+        picks a subset of those as DragOperations it supports if a drop were
+        to occur.  I was confused when I first saw this accessor as to which
+        it meant.  It turns out that this is only used when WebKit starts a
+        drag, and we keep it around so that we can provide this information
+        to other Mac OS X applications when they ask.  I've renamed the method
+        for clarity so the next person in this code will be less confused.
+
+        No functional changes, thus no tests.
+
+        * page/DragController.h:
+        (WebCore::DragController::sourceDragOperation):
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - WebCore part of <rdar://problem/6901751> REGRESSION (r35515): Tiger
+          crash painting the selection on registration page of car2go.com
+
+        A bug in old versions of Core Graphics causes memory corruption to occur
+        when clipping under certain conditions. Make the clipping functions
+        fail silently under those conditions.
+
+        Test: fast/block/float/selection-gap-clip-out-tiger-crash.html
+
+        * WebCore.Tiger.exp: Added wkCGContextIsSafeToClip
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::safeCGContextClip): Added a wrapper around CGContextClip that,
+        on Tiger, bails out if wkCGContextIsSafeToClip() returns false.
+        (WebCore::safeCGContextEOClip): Ditto for CGContextEOClip.
+        (WebCore::safeCGContextClipToRect): Ditto for CGContextClipToRect.
+        (WebCore::GraphicsContext::fillPath): Changed to call the safe variants
+        of CGContextClip, CGContextEOClip and CGContextClipToRect.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::clip): Ditto.
+        (WebCore::GraphicsContext::clipOut): Ditto.
+        (WebCore::GraphicsContext::clipOutEllipseInRect): Ditto.
+        (WebCore::GraphicsContext::clipPath): Ditto.
+        (WebCore::GraphicsContext::addInnerRoundedRectClip): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+        * platform/mac/WebCoreSystemInterface.h: Added wkCGContextIsSafeToClip.
+        * platform/mac/WebCoreSystemInterface.mm: Added wkCGContextIsSafeToClip.
+
+2009-05-21  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25910
+        WebkitGTK r43960 cannot compile
+
+        Do not include local copy of guriescape header, which was
+        removed. We now use the copy in glib.
+
+        * platform/gtk/FileSystemGtk.cpp:
+
+2009-05-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25706
+
+        It turns out the CurrentContext wasn't currect either because it gave
+        us the frame for the write() function itself.  We actually want the
+        *calling* context.
+
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Implement Image::loadPlatformResource.
+
+        Install the four resources we are using. For the icons
+        where an icon name is specified by freedeskop.org try to
+        map the WebCore name to that name and fallback to the
+        internal icon. For everything else use the internal icon
+        name. Remove the temporary link stub as this is not
+        required any more.
+
+        * GNUmakefile.am: Install the png files, set DATA_DIR again
+        * Resources/panIcon.png: Copied from WebKit/win/WebKit.vcproj/panIcon.png.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WTF::GtkIconInfo): Add template specialization for GtkIconInfo
+        (WebCore::getIconFileNameOrFallback): Use GtkIconTheme to get the icon
+        (WebCore::loadResourceIntoSharedBuffer):
+        (WebCore::Image::loadPlatformResource): Implement
+        * platform/gtk/TemporaryLinkStubs.cpp: Remove link stub
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19357
+
+        [GTK] The Gtk+ port wants to have a themable
+        urlIcon too.
+
+        * loader/icon/IconDatabase.cpp:
+
+2009-05-20  Stephanie Lewis  <slewis@apple.com>
+
+        Update the order files.  <rdar://problem/6881750> Generate new order files.
+
+        * WebCore.order:
+
+2009-05-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix some assertion failures in plug-in tests on the Windows debug build bot.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream): Switch to using protocolIsJavaScript.
+        * plugins/PluginView.cpp:
+        (WebCore::scriptStringIfJavaScriptURL): Ditto.
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More protocolInHTTPFamily() cleanup.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6905475>
+        Office 2008: Entourage: Crash when you switch to "My Day" view
+
+        The host function callback callObjCFallbackObject was not annotated
+        with JSC_HOST_CALL which meant that when it was called by the JIT, which
+        expects the JSC_HOST_CALL calling convention, the arguments are not in the
+        expected places.
+
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject): Added missing JSC_HOST_CALL
+        annotation on callObjCFallbackObject.
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Need to disable this assert while the chormium code is fixed for it.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::protocolIs):
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Change KURLGoogle.cpp to mirror the KURL.cpp changes done in
+        http://trac.webkit.org/changeset/43929.  Fix assert placement.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::protocolIs):
+        (WebCore::protocolIs):
+
+2009-05-20  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 bindings for V8DomWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=25869
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl): Moved from v8_custom.cpp.
+        (WebCore::isAscii): Moved from v8_custom.cpp.
+        (WebCore::convertBase64): Moved from v8_custom.cpp.
+        (WebCore::CALLBACK_FUNC_DECL): Moved from v8_custom.cpp.
+        (WebCore::eventNameFromAttributeName): Moved from v8_custom.cpp.
+        (WebCore::ACCESSOR_SETTER): Moved from v8_custom.cpp.
+        (WebCore::ACCESSOR_GETTER): Moved from v8_custom.cpp.
+        (WebCore::NAMED_ACCESS_CHECK): Moved from v8_custom.cpp.
+        (WebCore::INDEXED_ACCESS_CHECK): Moved from v8_custom.cpp.
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Jan Alonzo.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl): Always use Glib Base64 decoding.
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Rubberstamped by Gustavo Noronha.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::parseDataUrl): Remove Gtk/ Glib Base64 decoding.
+
+2009-05-20  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha.
+
+        * GNUmakefile.am:
+        * platform/gtk/guriescape.c:
+        * platform/gtk/guriescape.h: Remove copies of g_uri_escape_string and
+        g_uri_unescape_string now that we require Glib 2.16.
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Change KURLGoogle.cpp to mirror the KURL.cpp changes done in
+        http://trac.webkit.org/changeset/43929.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::protocolIsJavaScript):
+        (WebCore::protocolIs):
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        At all call sites that check if a KURL has either the http or https protocol,
+        use the KURL::protocolInHTTPFamily() accessor, instead.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::open):
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::requestIsHTTPOrHTTPSGet):
+
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/6904941> and https://bugs.webkit.org/show_bug.cgi?id=25300
+
+        KURL parsing changes back in r30243 and r30815 made javascript urls that use the form
+        "javascript://" be detected as invalid hierarchical URLs.  When a KURL is marked as
+        invalid, you can no longer ask it a question such as "is your protocol javascript?"
+        Therefore FrameLoader wouldn't recognize them as javascript URLs and instead try to
+        navigate to them.
+
+        URL parsing rules aside, such URLs are in use in the wild (Microsoft's Virtual Earth 
+        being a high profile example) and actually represent valid javascript.
+
+        Whenever checking for javascript urls, the new protocolIsJavaScript() should be used
+        as it functions on a String which doesn't have to pass KURLs parsing rules. 
+
+        Test: fast/loader/javascript-url-hierarchical-execution.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue): Use protocolIsJavaScript().
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation): Ditto.
+        (WebCore::createWindow): Ditto.
+        (WebCore::JSDOMWindow::open): Ditto.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL): Ditto.
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::allowSettingJavascriptURL): Ditto.
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc): Ditto.
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed): Ditto.
+        (WebCore::JSLocation::reload): Ditto.
+        * editing/markup.cpp:
+        (WebCore::appendQuotedURLAttributeValue): Ditto.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame): Ditto.
+        (WebCore::FrameLoader::submitForm): Ditto.
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Ditto.
+        
+        * platform/KURL.cpp:
+        (WebCore::KURL::init): Use protocolIsJavaScript().
+        (WebCore::KURL::protocolIs): ASSERT that the protocol being asked about is not javascript.
+           Such checks should go through protocolIsJavaScript() instead.
+        (WebCore::encodeRelativeString): Use protocolIsJavaScript().
+        (WebCore::protocolIsJavaScript):
+        * platform/KURL.h:
 
 2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
 
@@ -37,16 +5990,947 @@
         * plugins/qt/PluginPackageQt.cpp:
         (WebCore::PluginPackage::load): Fix assignment
 
-2009-05-11  Yael Aharon  <yael.aharon@nokia.com>
+2009-05-20  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Timothy Hatcher.
 
-        Change Qt port to match the mac and windows ports, and unregister plugins when plugins are stopped.
-        Not doing that can cause assersion failure.
-        https://bugs.webkit.org/show_bug.cgi?id=25702
+        Make absoluteRectsForRange and absoluteQuadsForRange non-virtual
+        and only exist on RenderText.
+
+        * dom/Range.cpp:
+        (WebCore::Range::textRects):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight): Use absoluteQuads instead
+        of absoluteQuadsForRange since no range is being specifiec.
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderText.h:
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Implement AtkObject::focus-event and
+        AtkObject::state-changed:focused signal emission.
+
+        Adds a new handleFocusedUIElementChangedWithRenderers, only in the
+        GTK port, called at the same point than
+        handleFocusedUIElementChanged but with two parameters, the old and
+        the newly focused RenderObjects. We need this, since the ATK
+        signals require us to pass the objects involved in the focus
+        change as arguments.
+
+        * accessibility/AXObjectCache.h:
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChangedWithRenderers):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25834
+
+        Make ChromeClient a interface again
+
+        With recent additions to ChromeClient.h empty defaults were
+        added. This is bad for porters as these changes go unnoticed
+        and at runtime no notImplemented warning is logged and grepping
+        for notImplemented will not show anything. Change this Client
+        to be like the other Clients again and always have pure virtuals
+        (but for stuff inside #ifdef PLATFORM(MAC)).
+
+        Update the various WebKit/* implementations to compile again.
+
+        * loader/EmptyClients.h: Add empty defaults
+        (WebCore::EmptyChromeClient::setCursor):
+        (WebCore::EmptyChromeClient::scrollRectIntoView):
+        (WebCore::EmptyChromeClient::requestGeolocationPermissionForFrame):
+        * page/ChromeClient.h: Make methods pure virtual
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a bug where a non visible plugin would show it self in a
+        sibling frame. The problem was due to our clipping. In Qt,
+        if setMask is set with an empty QRegion, no clipping will
+        be performed, so in that case we hide the PluginContainer
+
+        Added manual test.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::adjustGeometry):
+        * manual-tests/qt/plugin-sibling-frame-include.html
+        * manual-tests/qt/plugin-sibling-frame.html
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not call the parent implementation (Widget::) in show() and hide()
+        of the PluginViewQt, as it always changes the visible state of the
+        platformWidget (equal to the platformPluginWidget in the Qt port),
+        thus ignoring the isParentVisible() test.
 
         * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::stop):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-05-20  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+        Change the implementation of HTMLNoScriptElement to avoid the pain of 
+        adding virtual function for XHTMLMP support
+
+        Includes changes suggested by Simon Fraser.
+
+        * dom/Node.cpp:
+        (WebCore::Node::styleForRenderer):
+        * dom/Node.h:
+        * html/HTMLNoScriptElement.cpp:
+        * html/HTMLNoScriptElement.h:
+
+2009-05-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL backend build fix. Make sure URL is always set.
+        
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+
+2009-05-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by George Staikos.
+
+        Fix Qt WebKit build break in Mac OS.
+
+        * platform/FileSystem.h:
+
+2009-05-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Eric Seidel.
+
+        Enable code that was commented out waiting for a way to get a
+        GdkPixbuf from an image, effectively enabling copying images to
+        the clipboard.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25414
+        [GTK] ROLE_PANEL should not be used for paragraphs and list items.
+
+        Implement Atk list item role for list items.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25414
+        [GTK] ROLE_PANEL should not be used for paragraphs and list items.
+
+        Implement Atk paragraph role for paragraph elements.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-05-20  Eric Seidel  <eric@webkit.org>
+
+        Fix bug URL in ChangeLogs in r43903.
+        https://bugs.webkit.org/show_bug.cgi?id=25742
+
+2009-05-20  Takeshi Yoshino <tyoshino@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24539: Fix RenderThemeChromiumWin::paintTextFieldInternal() not to hide background image.
+        https://bugs.webkit.org/show_bug.cgi?id=25742
+
+        Fix RenderThemeChromiumWin::paintTextFieldInternal().
+
+        We shouldn't paint the content area of text fields when o->style() has
+        background image or transparent background color. paintTextFieldInternal() is
+        used for painting inner area of HTML option elements by Chromium.
+
+        When we pass fillContentArea = true to ChromiumBridge::paintTextField, it hides
+        the background image rendered by RenderBoxModelObject. So, we should set
+        fillContentArea = false in such case.
+
+        Besides, when background-color:transparent is specified for CSS property,
+        o->style().backgroundColor returns black color with alpha channel == 0. But
+        since ThemeEngine for Windows behind ChromiumBridge::paintTextField cannot
+        recognize alpha channel, it fills the rect with black. I made workaround to set
+        fillContentArea = false when alpha channel == 0 to avoid this.
+
+        And more, I'd like to fallback the color passed to ChromiumBridge to white when
+        o->style()->backgroundColor() is invalid.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+
+2009-05-20  Shinichiro Hamaji  <hamaji@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25417
+        Map CompositeCopy to Skia's kSrc_Mode composite operation.
+
+        Test: fast/canvas/canvas-composite-alpha.html
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+
+2009-05-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Xan Lopez.
+
+        Remove misplaced extern "C"
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Expose password field with role of PASSWORD_TEXT
+        https://bugs.webkit.org/show_bug.cgi?id=25682
+
+        Check if input type is a password field and return
+        ATK_ROLE_PASSWORD_TEXT if it is.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25845: [Qt] Fix QtWebKit pkgconfig dependencies
+        <https://bugs.webkit.org/show_bug.cgi?id=25845>
+
+        * WebCore.pro: Remove QtDBus; remove QtXml if Qt >= 4.4
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25843: [Qt] Remove qt-port build flag
+        <https://bugs.webkit.org/show_bug.cgi?id=25843>
+
+        * bridge/testbindings.pro:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25824
+
+        [Qt] Cleanup - move files exclusive to JAVASCRIPT_DEBUGGER
+        and WORKERS under the appropriate build section
+
+        * WebCore.pro:
+
+2009-05-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed Qt build fix, after r43892.
+
+        * platform/graphics/qt/ImageQt.cpp: included ImageObservser.h
+
+2009-05-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25856
+        [Qt] notify an image has been drawn, to help Cache purge alive decoded data.
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY, layout tests fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+        This reverts commit r43888.
+
+        Once that change was checked in many of the fast/flexbox0*.html        
+        tests (and others) started failing.
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::updateMarqueePosition):
+        (WebCore::RenderMarquee::timerFired):
+
+2009-05-19  Yichao Yin <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Add XHTMLMP support to Webkit
+        Update the configure files for building XHTMLMP-enabled WebKit on different platform
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2009-05-19  Antti Koivisto  <antti@apple.com>
+
+        I can't figure out how to make this not timing dependent, making it manual test instead.
+
+        * manual-tests/preload-scanner-entities.html: Added.
+
+2009-05-19  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto. 
+
+        <rdar://problem/6886382> REGRESSION (Safari 4PB -> ToT): HTTP cache revalidation broken.
+
+        This was caused in http://trac.webkit.org/changeset/41425, which fixed an image caching bug
+        in QuickLooks (rdar://problem/6619630).
+
+        We need to respect the DocumentLoader's request cache policy when deciding the cache policy
+        for subresources, but the check (originally removed in r39304 and added back in in the same
+        place in r41424) needs to be tweaked and relocated a bit.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy): Renamed from cachePolicy().  Move checking
+          the DocumentLoader's request to a more appropriate place. Add code to handle the recently 
+          added FIXME regarding POSTs. Add a new FIXME describing a great way to make this code 
+          cleaner in the future.
+        * loader/FrameLoader.h:
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::cachePolicy): Calls the newly renamed subresourceCachePolicy().
+
+2009-05-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25872: aria-labeledby appends all siblings instead of all children to aria name
+        https://bugs.webkit.org/show_bug.cgi?id=25872
+
+        When setting the aria-labeledby text it should stay within the element identified by the id
+        when searching through the sibling list.
+  
+        This also removes an outdated assert in getDocumentLinks. Its possible for the document to
+        think an element is a link, but accessibility can treat it differently (eg. its ARIA role is different).
+
+        Test: accessibility/aria-labelledby-stay-within.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaAccessiblityName):
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+
+2009-05-19  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler).
+        
+        <rdar://problem/6902674> REGRESSION: Query parameters are sometimes incorrect in URL (23135)
+        
+        Push characters back in correct order when entity parsing fails after 3 characters.
+
+        Test: fast/tokenizer/preload-scanner-entities.html
+
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::consumeEntity):
+
+2009-05-19  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a crash in Mac Chromium when displaying an HTML select element
+        with no items.
+        https://bugs.webkit.org/show_bug.cgi?id=25874
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal):
+
+2009-05-19  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8 bindings for CanvasRenderingContext2D.
+        https://bugs.webkit.org/show_bug.cgi?id=25858
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp: Moved bindings from v8_custom.cpp.
+
+2009-05-19  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Windows Build Fix.
+
+        * WebCore.vcproj/WebCore.vcproj: Copy accessibility headers from WebCore.
+
+2009-05-19  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/6889218> REGRESSION: Some iChat transcript resources are not
+        loaded because willSendRequest doesn't happen immediately
+
+        Reviewed by Antti Koivisto.
+
+        * WebCore.base.exp: Export Loader::servePendingRequests().
+
+2009-05-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25859: Need to upstream ScriptController.* for v8.
+        https://bugs.webkit.org/show_bug.cgi?id=25859
+
+        Fixing the header file (which I accidentally made identical to the cpp file).
+
+        * bindings/v8/ScriptController.h:
+
+2009-05-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler and Brady Eidson.
+
+        <rdar://problem/6900582> REGRESSION (r42446?): UA Profiler in http://stevesouders.com/ua/ stalls
+
+        The problem was that Document::removeAllEventListeners() was called for a wrong document
+        when a CachedFrame was destroyed.
+
+        Cannot be tested automatically, because DRT doesn't have a b/f cache.
+
+        * dom/Document.cpp: (WebCore::Document::domWindow): Make sure that this doesn't return an
+        unrelated window even if document's m_frame pointer is stale.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::clear): Added a FIXME about strange behavior.
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Split InspectorController into InspectorController and InspectorFrontend. Latter encapsulates all frontend interaction and is the only entity allowed to make ScriptFunctionCalls. The further plan is to serialize these script function calls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::setAttachedWindow):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showPanel):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addScriptProfile):
+        (WebCore::InspectorController::toggleRecordButton):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::didContinue):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDOMStorageResource.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        * inspector/InspectorFrontend.cpp: Added.
+        (WebCore::callSimpleFunction):
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::~InspectorFrontend):
+        (WebCore::InspectorFrontend::newJSONObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorFrontend::showPanel):
+        (WebCore::InspectorFrontend::populateInterface):
+        (WebCore::InspectorFrontend::reset):
+        (WebCore::InspectorFrontend::debuggerWasEnabled):
+        (WebCore::InspectorFrontend::debuggerWasDisabled):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfile):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h: Added.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        * inspector/InspectorResource.h:
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduce JSONObject that wraps ScriptObject and ScriptState* for further serialization
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/JSONObject.cpp: Added.
+        (WebCore::JSONObject::JSONObject):
+        (WebCore::JSONObject::set):
+        (WebCore::JSONObject::scriptObject):
+        (WebCore::JSONObject::createNew):
+        * inspector/JSONObject.h: Added.
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Refactor InpectorController so that it does not instantiate resource/console/database/domresource javascript objects. Move instantiation into the javascript.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        * inspector/InspectorDOMStorageResource.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        (WebCore::InspectorDatabaseResource::unbind):
+        * inspector/InspectorDatabaseResource.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Console.js:
+        (WebInspector.ConsoleMessage):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        (WebInspector.removeResource):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+        (WebInspector.reset):
+        (WebInspector.addMessageToConsole):
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        The Qt port has code that disables scrolling optimizations
+        when the root contains native windows, such as windowed plugins.
+
+        This code broke when detaching iframes containing windowed
+        plugins.
+
+        Each ScrollView now knows how many native windows it and its
+        children contain, and when it is detached, that number is
+        substracted from its old parents.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::setParent):
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::adjustWidgetsPreventingBlittingCount):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+
+2009-05-18  David Kilzer  <ddkilzer@apple.com>
+
+        Tiger build fix for r43850
+
+        * platform/mac/ClipboardMac.mm: Added typedef for NSUinteger
+        when building on Tiger.
+
+2009-05-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        ClipboardMac cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=25847
+
+        I'm mostly just moving code, however there are 3 changes I made while moving, detailed below.
+
+        No functional changes, so no tests.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::clearData):
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+          Broke out logic for filenames into its own function to make the caller more readable.
+        (WebCore::absoluteURLsFromPasteboard):
+          Broke out logic from getData into absoluteURLsFromPasteboard. This returns an NSArray
+          so that we can use -[NSArray componentsJoinedByString] in the caller (which is
+          cleaner than the manual "\n" addition before).
+          This also access to the full list of file urls for future callers.
+        (WebCore::ClipboardMac::getData):
+          unsigned count = (type == "URL") ? 1 : [fileList count]; is now an
+          explicit check for "URL", before it was a check for != "text/uri-list" which
+          was much more confusing in my opinion.  text/uri-list and URL are the only
+          two types which map to NSURLPboardType in cocoaTypeFromMIMEType().
+        (WebCore::ClipboardMac::types):
+          I removed an extra if (!types) check, right before [types count].  In Obj-C
+          messaging nil will return 0 (size of a pointer), so it's safe to message nil
+          here and expect it to return 0.
+
+2009-05-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 25859: Need to upstream ScriptController.* for v8.
+        https://bugs.webkit.org/show_bug.cgi?id=25859
+
+        * bindings/v8/ScriptController.cpp: Added.
+        * bindings/v8/ScriptController.h: Added.
+
+2009-05-18  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Change ScriptElement to support XHTMLMP in a better way
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+
+        * dom/ScriptElement.h:
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.h:
+        (WebCore::SVGScriptElement::shouldExecuteAsJavaScript):
+
+2009-05-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, finish up changes after the accessibility dir split.
+
+        * webcore-base.bkl:
+
+2009-05-18  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos (and others).
+
+        Add XHTMLMP support to Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+        XHTMLMP is a strict subset of XHTML 1.1. It extends XHTML Basic and add enhanced
+        functionality. Most of the functionalities have already been implemented by Webkit.
+        
+        The changes include:
+        1) Adding <noscript> support
+        2) Document conformance validation
+        3) User Agent conformance validation
+ 
+        refer to the specification: OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf
+
+        Tests: fast/xhtmlmp/check-doctype-declaration.xhtml
+               fast/xhtmlmp/check-rootelement.xhtml
+               fast/xhtmlmp/noscript-in-multiscripts.xhtml
+               fast/xhtmlmp/noscript-nested.xhtml
+               fast/xhtmlmp/noscript.xhtml
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::isXHTMLMPDocument):
+        * dom/Document.h:
+        (WebCore::Document::shouldProcessNoscriptElement):
+        (WebCore::Document::setShouldProcessNoscriptElement):
+        * dom/Node.cpp:
+        (WebCore::Node::createRendererIfNeeded):
+        * dom/Node.h:
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLTokenizer::setIsXHTMLMPDocument):
+        (WebCore::XMLTokenizer::isXHTMLMPDocument):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        (WebCore::XMLTokenizer::endDocument):
+        (WebCore::XMLTokenizer::internalSubset):
+        (WebCore::getEntityHandler):
+        (WebCore::externalSubsetHandler):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::parse):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        (WebCore::):
+        * dom/make_names.pl:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLNoScriptElement.cpp: Added.
+        (WebCore::HTMLNoScriptElement::HTMLNoScriptElement):
+        (WebCore::HTMLNoScriptElement::~HTMLNoScriptElement):
+        (WebCore::HTMLNoScriptElement::checkDTD):
+        (WebCore::HTMLNoScriptElement::attach):
+        (WebCore::HTMLNoScriptElement::recalcStyle):
+        (WebCore::HTMLNoScriptElement::childShouldCreateRenderer):
+        (WebCore::HTMLNoScriptElement::styleForRenderer):
+        * html/HTMLNoScriptElement.h: Added.
+        (WebCore::HTMLNoScriptElement::rendererIsNeeded):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        (WebCore::HTMLParser::isInline):
+        * html/HTMLTagNames.in:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+
+2009-05-18  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-05-18  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Fixed build for the Qt port by adding the WebCore/accessibility
+        directory to the includepath.
+
+        * WebCore.pro:
+
+2009-05-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 25776: accessibility should have its own folder in WebCore project
+        https://bugs.webkit.org/show_bug.cgi?id=25776
+   
+        Speculative fix for windows build failure.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-05-18  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 20652: WebKit doesn't display favicons with MIME type image/vnd.microsoft.icon
+
+        <https://bugs.webkit.org/show_bug.cgi?id=20652>
+
+        Reviewed by Darin Adler.
+
+        Test: http/tests/misc/favicon-as-image.html
+
+        * inspector/front-end/inspector.js: Added
+        image/vnd.microsoft.icon to WebInspector.MIMETypes.
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes): Added
+        image/vnd.microsoft.icon to list of supported image and image
+        resource MIME types.
+
+2009-05-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25776: accessibility should have its own folder in WebCore project
+        https://bugs.webkit.org/show_bug.cgi?id=25776
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility: Added.
+        * accessibility/AXObjectCache.cpp: Copied from WebCore/page/AXObjectCache.cpp.
+        * accessibility/AXObjectCache.h: Copied from WebCore/page/AXObjectCache.h.
+        * accessibility/AccessibilityAriaGrid.cpp: Copied from WebCore/page/AccessibilityAriaGrid.cpp.
+        * accessibility/AccessibilityAriaGrid.h: Copied from WebCore/page/AccessibilityAriaGrid.h.
+        * accessibility/AccessibilityAriaGridCell.cpp: Copied from WebCore/page/AccessibilityAriaGridCell.cpp.
+        * accessibility/AccessibilityAriaGridCell.h: Copied from WebCore/page/AccessibilityAriaGridCell.h.
+        * accessibility/AccessibilityAriaGridRow.cpp: Copied from WebCore/page/AccessibilityAriaGridRow.cpp.
+        * accessibility/AccessibilityAriaGridRow.h: Copied from WebCore/page/AccessibilityAriaGridRow.h.
+        * accessibility/AccessibilityImageMapLink.cpp: Copied from WebCore/page/AccessibilityImageMapLink.cpp.
+        * accessibility/AccessibilityImageMapLink.h: Copied from WebCore/page/AccessibilityImageMapLink.h.
+        * accessibility/AccessibilityList.cpp: Copied from WebCore/page/AccessibilityList.cpp.
+        * accessibility/AccessibilityList.h: Copied from WebCore/page/AccessibilityList.h.
+        * accessibility/AccessibilityListBox.cpp: Copied from WebCore/page/AccessibilityListBox.cpp.
+        * accessibility/AccessibilityListBox.h: Copied from WebCore/page/AccessibilityListBox.h.
+        * accessibility/AccessibilityListBoxOption.cpp: Copied from WebCore/page/AccessibilityListBoxOption.cpp.
+        * accessibility/AccessibilityListBoxOption.h: Copied from WebCore/page/AccessibilityListBoxOption.h.
+        * accessibility/AccessibilityObject.cpp: Copied from WebCore/page/AccessibilityObject.cpp.
+        * accessibility/AccessibilityObject.h: Copied from WebCore/page/AccessibilityObject.h.
+        * accessibility/AccessibilityRenderObject.cpp: Copied from WebCore/page/AccessibilityRenderObject.cpp.
+        * accessibility/AccessibilityRenderObject.h: Copied from WebCore/page/AccessibilityRenderObject.h.
+        * accessibility/AccessibilityTable.cpp: Copied from WebCore/page/AccessibilityTable.cpp.
+        * accessibility/AccessibilityTable.h: Copied from WebCore/page/AccessibilityTable.h.
+        * accessibility/AccessibilityTableCell.cpp: Copied from WebCore/page/AccessibilityTableCell.cpp.
+        * accessibility/AccessibilityTableCell.h: Copied from WebCore/page/AccessibilityTableCell.h.
+        * accessibility/AccessibilityTableColumn.cpp: Copied from WebCore/page/AccessibilityTableColumn.cpp.
+        * accessibility/AccessibilityTableColumn.h: Copied from WebCore/page/AccessibilityTableColumn.h.
+        * accessibility/AccessibilityTableHeaderContainer.cpp: Copied from WebCore/page/AccessibilityTableHeaderContainer.cpp.
+        * accessibility/AccessibilityTableHeaderContainer.h: Copied from WebCore/page/AccessibilityTableHeaderContainer.h.
+        * accessibility/AccessibilityTableRow.cpp: Copied from WebCore/page/AccessibilityTableRow.cpp.
+        * accessibility/AccessibilityTableRow.h: Copied from WebCore/page/AccessibilityTableRow.h.
+        * accessibility/chromium: Added.
+        * accessibility/chromium/AXObjectCacheChromium.cpp: Copied from WebCore/page/chromium/AXObjectCacheChromium.cpp.
+        * accessibility/chromium/AccessibilityObjectChromium.cpp: Copied from WebCore/page/chromium/AccessibilityObjectChromium.cpp.
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Copied from WebCore/page/chromium/AccessibilityObjectWrapper.h.
+        * accessibility/gtk: Added.
+        * accessibility/gtk/AXObjectCacheAtk.cpp: Copied from WebCore/page/gtk/AXObjectCacheAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp: Copied from WebCore/page/gtk/AccessibilityObjectAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp: Copied from WebCore/page/gtk/AccessibilityObjectWrapperAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h: Copied from WebCore/page/gtk/AccessibilityObjectWrapperAtk.h.
+        * accessibility/mac: Added.
+        * accessibility/mac/AXObjectCacheMac.mm: Copied from WebCore/page/mac/AXObjectCacheMac.mm.
+        * accessibility/mac/AccessibilityObjectMac.mm: Copied from WebCore/page/mac/AccessibilityObjectMac.mm.
+        * accessibility/mac/AccessibilityObjectWrapper.h: Copied from WebCore/page/mac/AccessibilityObjectWrapper.h.
+        * accessibility/mac/AccessibilityObjectWrapper.mm: Copied from WebCore/page/mac/AccessibilityObjectWrapper.mm.
+        * accessibility/qt: Added.
+        * accessibility/qt/AccessibilityObjectQt.cpp: Copied from WebCore/page/qt/AccessibilityObjectQt.cpp.
+        * accessibility/win: Added.
+        * accessibility/win/AXObjectCacheWin.cpp: Copied from WebCore/page/win/AXObjectCacheWin.cpp.
+        * accessibility/win/AccessibilityObjectWin.cpp: Copied from WebCore/page/win/AccessibilityObjectWin.cpp.
+        * accessibility/win/AccessibilityObjectWrapperWin.h: Copied from WebCore/page/win/AccessibilityObjectWrapperWin.h.
+        * accessibility/wx: Added.
+        * accessibility/wx/AccessibilityObjectWx.cpp: Copied from WebCore/page/wx/AccessibilityObjectWx.cpp.
+        * page/AXObjectCache.cpp: Removed.
+        * page/AXObjectCache.h: Removed.
+        * page/AccessibilityAriaGrid.cpp: Removed.
+        * page/AccessibilityAriaGrid.h: Removed.
+        * page/AccessibilityAriaGridCell.cpp: Removed.
+        * page/AccessibilityAriaGridCell.h: Removed.
+        * page/AccessibilityAriaGridRow.cpp: Removed.
+        * page/AccessibilityAriaGridRow.h: Removed.
+        * page/AccessibilityImageMapLink.cpp: Removed.
+        * page/AccessibilityImageMapLink.h: Removed.
+        * page/AccessibilityList.cpp: Removed.
+        * page/AccessibilityList.h: Removed.
+        * page/AccessibilityListBox.cpp: Removed.
+        * page/AccessibilityListBox.h: Removed.
+        * page/AccessibilityListBoxOption.cpp: Removed.
+        * page/AccessibilityListBoxOption.h: Removed.
+        * page/AccessibilityObject.cpp: Removed.
+        * page/AccessibilityObject.h: Removed.
+        * page/AccessibilityRenderObject.cpp: Removed.
+        * page/AccessibilityRenderObject.h: Removed.
+        * page/AccessibilityTable.cpp: Removed.
+        * page/AccessibilityTable.h: Removed.
+        * page/AccessibilityTableCell.cpp: Removed.
+        * page/AccessibilityTableCell.h: Removed.
+        * page/AccessibilityTableColumn.cpp: Removed.
+        * page/AccessibilityTableColumn.h: Removed.
+        * page/AccessibilityTableHeaderContainer.cpp: Removed.
+        * page/AccessibilityTableHeaderContainer.h: Removed.
+        * page/AccessibilityTableRow.cpp: Removed.
+        * page/AccessibilityTableRow.h: Removed.
+        * page/chromium/AXObjectCacheChromium.cpp: Removed.
+        * page/chromium/AccessibilityObjectChromium.cpp: Removed.
+        * page/chromium/AccessibilityObjectWrapper.h: Removed.
+        * page/gtk/AXObjectCacheAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectWrapperAtk.h: Removed.
+        * page/mac/AXObjectCacheMac.mm: Removed.
+        * page/mac/AccessibilityObjectMac.mm: Removed.
+        * page/mac/AccessibilityObjectWrapper.h: Removed.
+        * page/mac/AccessibilityObjectWrapper.mm: Removed.
+        * page/qt/AccessibilityObjectQt.cpp: Removed.
+        * page/win/AXObjectCacheWin.cpp: Removed.
+        * page/win/AccessibilityObjectWin.cpp: Removed.
+        * page/win/AccessibilityObjectWrapperWin.h: Removed.
+        * page/wx/AccessibilityObjectWx.cpp: Removed.
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25854
+        [GTK] Should tell servers we only support identity as content encoding
+
+        Let servers know we only support identity as content
+        encoding. We will implement this in libsoup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-05-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6881160> REGRESSION (r41425): Unable to create battle.net account due to
+        CAPTCHA failure.
+
+        The problem was that after loading and displaying a CAPTCHA image, it was loaded from
+        the server again due to preloading. So, the server expected the last loaded (invisible)
+        CAPTCHA text to be typed and posted back.
+
+        I don't know how to make tests for preloading.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::checkForPendingPreloads): There is never a reason
+        to preload after loading for real - and if cache policy is CachePolicyReload, that actually
+        results in another load from network layer.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::cachePolicy): It's not good for cachePolicy()
+        to lie, but I don't know how to re-do r41425 properly. Added a FIXME.
 
 2009-05-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
 
@@ -79,6 +6963,414 @@
         (WebCore::FontFallbackList::releaseFontData):
         (WebCore::FontFallbackList::fontDataAt):
 
+2009-05-15  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Style fixes
+
+         * GNUmakefile.am:
+
+2009-05-17  George Staikos  <george.staikos@torchmobile.com>
+
+        Not reviewed - build fix.
+
+        Fix typo: constr -> const.
+
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::setPlaceholder):
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Fix done by Simon Fraser (reviewed by me).
+
+        <rdar://problem/6893775> Page with screen-only stylesheet with overflow and height
+        transitions has bad layout and overlapping garbled text when printing
+
+        * manual-tests/print-with-height-transition-in-screen-stylesheet.html: Added.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations): Don't run transitions when printing.
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6870241> REGRESSION: Programmatically selected popup menu item not shown
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setSelectedIndex): Added a call to updateFromElement and
+        also a type check on the selected index to avoid a bad cast to HTMLOptionElement.
+
+        * manual-tests/select-option-in-onload.html: Added.
+
+2009-05-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Rename local variables for readability.
+        
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBorder):
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25840: fix some warnings seen on the GTK bot
+        https://bugs.webkit.org/show_bug.cgi?id=25840
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::platformScrollbarModes): Initialize results here.
+        This is really just to quiet warnings. I think this code is unreachable.
+        Someone could put ASSERT_NOT_REACHED() in here too at some point.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream): Use proper printf format for int
+        here, %d, not %lu. This could cause a real problem when compiled 64-bit,
+        so it's good to fix.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::getNextSoftBreak): Initialize breakOffset to 0 here. This is
+        really just to quiet the warning, but still seems like a good idea.
+
+2009-05-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25769: Fix accessibility warnings on GTK
+        https://bugs.webkit.org/show_bug.cgi?id=25769
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::columnCount): Get rid of excess const.
+        (WebCore::AccessibilityTable::rowCount): Ditto.
+        * page/AccessibilityTable.h: Ditto.
+
+2009-05-17  Kai Brüning  <kai@granus.net>
+
+        Reviewed by Darin Adler.
+
+        bug 25822: DOM normalize does not remove empty text node between element nodes
+        https://bugs.webkit.org/show_bug.cgi?id=25822
+
+        Test: fast/dom/Node/normalize.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::normalize): Changed to remove any empty text nodes.
+
+2009-05-16  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Darin Adler.
+
+        Allow Strings to be created with one malloc node with no copying
+        https://bugs.webkit.org/show_bug.cgi?id=25779
+
+        Add new methods to String and StringImpl, refactoring existing
+        methods in StringImpl to use new createUninitialized() method.
+
+        * platform/text/PlatformString.h:
+        (WebCore::String::createUninitialized):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::createUninitialized):
+        (WebCore::StringImpl::create):
+        * platform/text/StringImpl.h:
+
+2009-05-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6827041> WebCore should stop throwing away the CGImageSourceRef to
+        dramatically improve animated GIF decoding performance
+
+        Recent versions of ImageIO discard previously decoded image frames if the client
+        application no longer holds references to them, so there's no need to throw away
+        the decoder unless we're explicitly asked to destroy all of the frames.
+
+        This drops peak CPU usage when displaying <http://www.aintitcool.com/files/HoD2.gif>
+        from over 90% to below 3%.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-05-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - fix <rdar://problem/6873305> Two distinct characters are not displayed
+          correctly with 2 of the font selections from the stickies widget
+
+        Test: platform/mac/editing/pasteboard/text-precomposed.html
+
+        Ensure that "text/plain" data retrieved from the clipboard is always
+        precomposed. This makes Clipboard::getData() and
+        Pasteboard::documentFragment() consistent with Pasteboard::plainText()
+        and -[WebHTMLView _documentFragmentFromPasteboard:forType:inContext:subresources:].
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::getData):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-05-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForFamily): Declare valueForFamily as static.
+
+2009-05-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6883872> REGRESSION (r43243): computed style for font-family is returning
+        only the generic font, if any generic font is in the family list
+
+        Test: fast/css/getComputedStyle/computed-style-font-family.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        Sorted computedProperties alphabetically. Added CSSPropertyClip and CSSPropertyWordBreak.
+        (WebCore::identifierForFamily): Added. Maps internal font family names to identifiers.
+        (WebCore::valueForFamily): Added. Creates either an identifier or a string as appropriate.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Implemented the font-family
+        property as specified in the CSS standard. Fixed clip to return "auto" when there is no
+        clip set instead of nothing at all. Gave inheritableProperties and numInheritableProperties
+        internal linkage since there was no reason for them to have external linkage.
+
+2009-05-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25741
+
+        Append instead of throwing when insertItemBefore gets an out-of-bound
+        index.
+
+        Test: svg/dom/svglist-insertItemBefore-appends.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
+2009-05-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25829
+        
+        Fix -webkit-background-clip:text when the renderer had a non (0,0) x, y offset.
+
+        Test: fast/backgrounds/background-clip-text.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2009-05-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6888244> REGRESSION: Using the Up or Down keyboard
+          arrows, I can't navigate caret between To Do items in a Note message
+
+        Test: editing/selection/move-by-line-004.html
+
+        * editing/visible_units.cpp:
+        (WebCore::enclosingNodeWithNonInlineRenderer): Added this helper
+        function.
+        (WebCore::previousLinePosition): When advancing to the next candidate
+        node, stop when leaving the closest ancestor of the original node that
+        is not an inline. The code, incorrectly, was trying to exit the closest
+        ancestor of that type which was editable, and therefore missing other
+        blocks in the same editable root.
+        (WebCore::nextLinePosition): Ditto.
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Jan Alonzo.
+
+        Converting filename to uri by concatenating strings is broken
+        on Windows. So, don't do it for that platform.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-05-15  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 bindings for HTMLOptionsCollection and HTMLSelectElementCollection.
+        https://bugs.webkit.org/show_bug.cgi?id=25739
+
+        * bindings/v8/V8Collection.cpp: Added.
+        (WebCore::toOptionsCollectionSetter): Moved from v8_custom.cpp.
+        * bindings/v8/V8Collection.h: Added prototype for toOptionsCollectionSetter().
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_SETTER): Moved from v8_custom.cpp.
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):  Moved from v8_custom.cpp.
+        (WebCore::INDEXED_PROPERTY_SETTER):  Moved from v8_custom.cpp.
+
+2009-05-15  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6649936> Add *.exp export files to WebCore Xcode project
+
+        Reviewed by Darin Adler and Timothy Hatcher.
+
+        * WebCore.xcodeproj/project.pbxproj: Added Exports group, moved
+        WebCore.base.exp into the group, and added 10 other *.exp files
+        in WebCore.
+
+2009-05-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25826
+        Change type to only have custom getter in JCS.
+
+        * html/HTMLInputElement.idl: Changed CustomGetter attribute to JSCCustomGetter.
+
+2009-05-15  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Add a settings entry to en/disable web font support
+        https://bugs.webkit.org/show_bug.cgi?id=25239
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Remove dead youtube site specific hack that was commented out.
+
+        * bindings/js/JSNavigatorCustom.cpp:
+        * page/Navigator.idl:
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25826
+        <rdar://problem/6884742> 
+        REGRESSION: In Gmail's Edit Link dialog, I can't type in the Link To: field (due to <input type=url> support)
+
+        Added a site specific quirk for mail.google.com which returns "text" when getting the type of an <input type=url>
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::needsGmailQuirk):
+        (WebCore::JSHTMLInputElement::type):
+        * html/HTMLInputElement.idl:
+
+2009-05-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25810
+        Upstream V8 DOM Wrapper map declarations.
+
+        No behavior change, so no tests.
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::WeakReferenceMap): Added.
+        (WebCore::WeakReferenceMap::~WeakReferenceMap): Added.
+        (WebCore::WeakReferenceMap::get): Added.
+        (WebCore::WeakReferenceMap::set): Added.
+        (WebCore::WeakReferenceMap::forget): Added.
+        (WebCore::WeakReferenceMap::contains): Added.
+        (WebCore::WeakReferenceMap::impl): Added.
+        (WebCore::DOMWrapperMap::DOMWrapperMap): Added.
+
+2009-05-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25773
+        
+        Rename GraphicsLayer::graphicsContextsFlipped() to 
+        GraphicsLayer::compositingCoordinatesOrientation() in order to clarify the usage.
+
+        Clean up code around the GraphicsLayer "contents" layer that makes use of this
+        flag, by removing the setHasContentsLayer() method, and just using setContentsLayer(),
+        which can then always do the flipping if necessary.
+
+        Only affects ACCELERATED_COMPOSITING builds.
+        
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::contentsLayer):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::compositingCoordinatesOrientation):
+        (WebCore::GraphicsLayerCA::setBackgroundColor):
+        (WebCore::GraphicsLayerCA::clearBackgroundColor):
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+        (WebCore::GraphicsLayerCA::clearContents):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+
+2009-05-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25765
+
+        Avoid calling setNeedsStyleRecalc() when we are
+        putting an animated page in the cache. This avoids
+        the assert and subsequent problems with a dirty 
+        page going into the cache.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+
+2009-05-15  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 25467: JavaScript debugger should use function.displayName as the function's name in the call stack
+        <https://bugs.webkit.org/show_bug.cgi?id=25467>
+        
+        Reviewed by Adam Roben.
+
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::functionName): Use calculatedFunctionName which takes into account displayName
+        * inspector/front-end/CallStackSidebarPane.js: Remove "|| anonymous function" since it is handled internally just like in profiles
+        (WebInspector.CallStackSidebarPane.prototype.update):
+
+2009-05-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix (and a matching Mac change, to avoid unnecessarily diverging the implementations).
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        Check strings with isEmpty(), not relying on any implicit conversions.
+
+2009-05-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler, Brady Eidson and Eric Carlson.
+
+        <rdar://problem/6875643> REGRESSION: Unable to download file with FTP URL that includes
+        username and password (Lightwave 9.6 for Mac from Newtek site)
+
+        CFNetwork only invokes didReceiveAuthenticationChallenge for HTTP requests. Credentials
+        for other protocols (including FTP) should be included as part of the URL.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Put credentials in URL for non-HTTP requests.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::makeSimpleCrossOriginAccessRequest):
+        Bail out quickly if the URL is non-HTTP. Cross-origin requests require specific HTTP
+        headers to be received, so they cannot work with other protocols.
+
 2009-05-15  Ariya Hidayat  <ariya.hidayat@nokia.com>
 
         Reviewed by Holger Freyther.
@@ -106,6 +7398,788 @@
         (WebCore::ImageDecoderQt::reset): Resetted the flag.
         * platform/graphics/qt/ImageDecoderQt.h: Added m_hasAlphaChannel.
 
+2009-05-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Finish support for disabling the JavaScript Debugger and Profiler 
+        at compile time in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=24917
+
+        * bindings/js/JSInspectorControllerCustom.cpp: ENABLE_JAVASCRIPT_DEBUGGER guard
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp: Ditto.
+        * inspector/JavaScriptCallFrame.cpp: Ditto.
+        * inspector/JavaScriptCallFrame.h: Ditto.
+        * inspector/JavaScriptCallFrame.idl: Ditto.
+        * inspector/JavaScriptDebugListener.h: Ditto.
+        * inspector/JavaScriptDebugServer.cpp: Ditto.
+        * inspector/JavaScriptDebugServer.h: Ditto.
+        * inspector/JavaScriptProfile.cpp: Ditto.
+        * inspector/JavaScriptProfile.h: Ditto.
+        * inspector/JavaScriptProfileNode.cpp: Ditto.
+        * inspector/JavaScriptProfileNode.h: Ditto.
+        * page/Console.cpp: Use guard ENABLE(JAVASCRIPT_DEBUGGER) instead of USE(JSC)
+        * page/Console.h: Ditto.
+        * page/Console.idl: Use guard ENABLE(JAVASCRIPT_DEBUGGER) instead of !defined(V8_BINDING)
+
+2009-05-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        http://bugs.webkit.org/show_bug.cgi?id=25464
+
+        Improve the font fallback for characters belonging to 'common' scripts
+        in ChromiumWin port. Make characters like Danda, Double Danda (punctuation
+        marks in North Indian scripts) and currency signs (e.g. Thai Baht)
+        rendered correctly in Chromium on Win. 
+
+        Tests: fast/text/international/danda-space.html
+               fast/text/international/thai-baht-space.html
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::FontMap::getScriptBasedOnUnicodeBlock):
+        (WebCore::FontMap::getScript):
+        (WebCore::getFallbackFamily):
+
+2009-05-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25731
+        [Qt] Cleanup - move files exclusive to XPATH and XSLT under the
+        appropriate build section
+
+        * WebCore.pro:
+
+2009-05-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel and Darin Fisher.
+
+        Fix a font-related leak in Chromium's Skia backend found by Valgrind.
+        https://bugs.webkit.org/show_bug.cgi?id=25760
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        Use caches instead of "new" on every call.
+
+2009-05-14  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize m_spreadMethod in the second constructor too. Not sure if
+        a test case can be written, so no test case.
+        https://bugs.webkit.org/show_bug.cgi?id=25814
+
+        No test possible: spreadMethod() is only used by SVG, doesn't seem possible to hit
+        this case, since several other SVG tests already should be calling
+        spreadMethod().
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::Gradient):
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Fix Windows build after renaming MediaControlElements to MediaControlElementType.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderMediaControls.h:
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        <rdar://problem/6739671> Movie controller’s play button does not change into a pause
+        button
+
+        Fix a controls repaint issue when the playing state of a video changes by
+        educating the MediaControlInputElements about the state they are currently
+        displaying, and making them repaint when that state changes. This applies
+        to the play/pause and mute/unmute buttons, which both have two states.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        Pass in and initialize the MediaControlElementType.
+        
+        (WebCore::MediaControlInputElement::update):
+        Update the display type too
+        
+        (WebCore::MediaControlInputElement::setDisplayType):
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlMuteButtonElement::updateDisplayType):
+        Choose muted vs. unmuted display.
+        
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlPlayButtonElement::updateDisplayType):
+        Choose play vs. paused display.
+
+        * rendering/MediaControlElements.h:
+        Renamed the MediaControlElements enum to MediaControlElementType.
+        (WebCore::MediaControlInputElement::updateDisplayType):
+        Add a MediaControlElementType member variable with a setter to allow
+        the element to know what type it is displaying.
+
+2009-05-14  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25197
+
+        Add support for aspect-ratio and orientation
+        media queries.
+
+        Tests: fast/media/mq-aspect-ratio.html
+               fast/media/mq-orientation.html
+
+        * css/MediaFeatureNames.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::orientationMediaFeatureEval):
+        (WebCore::aspect_ratioMediaFeatureEval):
+        (WebCore::min_aspect_ratioMediaFeatureEval):
+        (WebCore::max_aspect_ratioMediaFeatureEval):
+        * css/MediaQueryExp.h:
+        (WebCore::MediaQueryExp::isViewportDependent):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        - Resubmitting previous patch, correctly this time.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        - Rolling out to fix a bug and the build
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6510362> In some situations message content is messed up
+        when indentation is decreased
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode): Calling recursively
+        here served to do nothing because this function will return if the
+        second argument is the parent of the first.  Not only does this now work
+        as intended, but is necessary for the rest of this fix.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph): To determine if we 
+        are the last node in a <blockquote>, and can therefore remove the
+        <blockquote> we need the endOfEnclosingBlock to extend to the end of
+        the <blockquote> not just the next block, which could be a <div>, for
+        example. 
+        - Also If a <blockquote> is removed, but it's the child of another
+        <blockquote> then its children are now children of the top <blockquote>.
+        In this case we want to split the parent <blockquote> because the next
+        paragraph assumes that it is the first node in its <blockquote> and if
+        that is not true, various bugs arise.
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType):
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix http/tests/xmlhttprequest/cache-override.html on Windows
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType): Modify the previous response so it maintains all of its data.
+        (WebCore::didReceiveResponse): Call setDefaultMIMEType() when needed.
+        (WebCore::WebCoreSynchronousLoader::load): Ditto.
+
+2009-05-14  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug: Mac Chromium popup menus are not positioned correctly
+        on scrolled pages:
+        https://bugs.webkit.org/show_bug.cgi?id=25772
+
+        Fix Mac Chromium popup menu placement by taking into
+        account any scrolling in the current window. This mirrors
+        the positioning done in PopupContainer::show(), which is
+        used on Chromium Windows and linux.
+
+        Also fixed indenting for this method.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal):
+
+2009-05-14  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25774
+        Upstream V8MessagePortCustom.cpp from the chromium repository.
+
+        * bindings/v8/custom/V8MessagePortCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25777
+        
+        StyleGeneratedImage::imageSize() needs to take zooming into account for
+        fixed-size images (i.e. canvas) so that canvas-as-image-background
+        renders correctly with zooming.
+
+        Test: fast/canvas/canvas-bg-zoom.html
+
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::imageSize):
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch originally by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25796
+        <rdar://problem/6886654> Shouldn't set referer and origin in Loader::Host::servePendingRequests().
+
+        Test: http/tests/security/credentials-in-referer.html
+
+        * loader/loader.cpp: (WebCore::Loader::Host::servePendingRequests): This will be done in
+        SubresourceLoader::create() anyway.
+
+2009-05-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25797: Pages with image maps are not properly read with Voiceover
+        https://bugs.webkit.org/show_bug.cgi?id=25797
+
+        * page/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isEnabled):
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6887762> and https://bugs.webkit.org/show_bug.cgi?id=25790 
+
+        Nuke the bogus ASSERT and add a legitimate ASSERT with a little help from a new accessor.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniff):
+        * platform/network/ResourceHandle.h:
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+        (WebCore::didReceiveResponse):
+
+2009-05-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25791
+        Bug 25791: HTMLMediaElement: implement 'startTime' attribute
+        
+        Support the recently added HTMLMediaElement 'startTime' attribute. This is a read-only 
+        value that only the media engine can know, so we just need to add the attribute 
+        to HTMLMediaElement and add methods to MediaPlayer and MediaPlayerPrivateInterface so 
+        the engine can make it available.
+
+        Test: media/media-startTime.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::startTime): New.
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::startTime): New.
+        * platform/graphics/MediaPlayer.h:
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::startTime): New.
+
+2009-05-14  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Only create a QWidget wrapper for the plugin in the case it is not
+        in the Qt window mapper, and thus receiving events from the Qt
+        event system. Native Qt based plugins running in process, will
+        already be in the window mapper, and thus creating a wrapper,
+        stops them from getting events from Qt, as they are redirected
+        to the wrapper.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::on_clientIsEmbedded):
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25784
+        Leaks seen on HTTP tests
+
+        We should change ResourceHandleMac.mm to use smart pointers some day, but this is a minimal fix.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Release mutable request copy made for
+        disabling content sniffing, matching the normal code path.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Release m_user
+        and m_pass before overwriting.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+
+2009-05-14  Yury Semikhatsky <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25418
+        Remove new lines from event handler wrapper to make line numbers
+        in the wrapped script conside with the lines in the original script.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+
+2009-05-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove a JSC-specific include that is already added by including
+        ScriptController.
+
+        No change in behavior, so no tests.
+
+        * dom/Document.cpp: Removed JSDOMBinding include.
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/4072827> Downloaded non-ASCII file name becomes garbled
+
+        Hopefully, a final stroke. When updating ResourceRequest from a platform request, a wrong
+        CFString function was used, so a user-friendly name was stored in encoding fallback array.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm: (WebCore::ResourceRequest::doUpdateResourceRequest):
+
+2009-05-14  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add more ENABLE_DATABASE guards.
+        https://bugs.webkit.org/show_bug.cgi?id=25616
+
+        See also https://bugs.webkit.org/show_bug.cgi?id=24776 (original set of guards)
+
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.h:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.h:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.h:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * storage/Database.cpp:
+        * storage/DatabaseDetails.h:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLError.idl:
+        * storage/SQLResultSet.cpp:
+        * storage/SQLResultSet.h:
+        * storage/SQLResultSet.idl:
+        * storage/SQLResultSetRowList.cpp:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLResultSetRowList.idl:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25787
+
+        Gtk was the last platform to not unregister plugins when
+        the plugin is stopped. Catch up with r43550.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::stop):
+
+2009-05-14  Adam Roben  <aroben@apple.com>
+
+        Make WebCore.vcproj's pre-build event work again
+
+        * WebCore.vcproj/WebCore.vcproj: Removed empty override of the
+        pre-build event that was accidentally left in when the pre-build event
+        was moved to WebCoreCommon.vsprops.
+
+2009-05-14  Darin Adler  <darin@apple.com>
+
+        * manual-tests/right-click-crash.html: Added.
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6681868> When building with Xcode 3.1.3 should be using gcc 4.2
+
+        The meaning of XCODE_VERSION_ACTUAL is more sensible in newer versions of Xcode.
+        Update our logic to select the compiler version to use the more appropriate XCODE_VERSION_MINOR
+        if the version of Xcode supports it, and fall back to XCODE_VERSION_ACTUAL if not.
+
+        * Configurations/Base.xcconfig:
+
+2009-05-13  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * WebCore.NPAPI.exp:
+
+2009-05-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix invalid memory write seen in HTMLCanvasElement by Valgrind
+        https://bugs.webkit.org/show_bug.cgi?id=25759
+
+        I can't think of any way to catch this with a layout test, so no test.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasDestroyed):
+        * css/CSSCanvasValue.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::~HTMLCanvasElement):
+        * html/HTMLCanvasElement.h:
+
+2009-05-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix <rdar://problem/5483015> Replies in Mail are drawn first without
+          the user style sheet and then redrawn with the style sheet
+
+        Test: platform/mac/fast/loader/user-stylesheet-fast-path.html
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation): For data URLs with
+        base64-encoded UTF-8 data, just decode the style sheet here an apply
+        it synchronously instead of invoking an asynchronous loader.
+
+2009-05-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 25755: Implement ARIA grid role
+        https://bugs.webkit.org/show_bug.cgi?id=25755
+
+        Fix build bustage from last checkin.
+
+        * page/AccessibilityAriaGrid.cpp:
+        (WebCore::AccessibilityAriaGrid::addChild):
+
+2009-05-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25755: Implement ARIA grid role
+        https://bugs.webkit.org/show_bug.cgi?id=25755
+
+        Test: accessibility/aria-tables.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::nodeIsAriaType):
+        (WebCore::AXObjectCache::getOrCreate):
+        * page/AXObjectCache.h:
+        * page/AccessibilityAriaGrid.cpp: Added.
+        (WebCore::AccessibilityAriaGrid::AccessibilityAriaGrid):
+        (WebCore::AccessibilityAriaGrid::~AccessibilityAriaGrid):
+        (WebCore::AccessibilityAriaGrid::create):
+        (WebCore::AccessibilityAriaGrid::addChild):
+        (WebCore::AccessibilityAriaGrid::addChildren):
+        (WebCore::AccessibilityAriaGrid::cellForColumnAndRow):
+        * page/AccessibilityAriaGrid.h: Added.
+        (WebCore::AccessibilityAriaGrid::isAriaTable):
+        * page/AccessibilityAriaGridCell.cpp: Added.
+        (WebCore::AccessibilityAriaGridCell::AccessibilityAriaGridCell):
+        (WebCore::AccessibilityAriaGridCell::~AccessibilityAriaGridCell):
+        (WebCore::AccessibilityAriaGridCell::create):
+        (WebCore::AccessibilityAriaGridCell::parentTable):
+        (WebCore::AccessibilityAriaGridCell::rowIndexRange):
+        (WebCore::AccessibilityAriaGridCell::columnIndexRange):
+        * page/AccessibilityAriaGridCell.h: Added.
+        * page/AccessibilityAriaGridRow.cpp: Added.
+        (WebCore::AccessibilityAriaGridRow::AccessibilityAriaGridRow):
+        (WebCore::AccessibilityAriaGridRow::~AccessibilityAriaGridRow):
+        (WebCore::AccessibilityAriaGridRow::create):
+        (WebCore::AccessibilityAriaGridRow::parentTable):
+        (WebCore::AccessibilityAriaGridRow::headerObject):
+        * page/AccessibilityAriaGridRow.h: Added.
+        * page/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * page/AccessibilityList.h:
+        * page/AccessibilityObject.h:
+        (WebCore::):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * page/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::isAriaTable):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableCell.h:
+        * page/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::setParentTable):
+        (WebCore::AccessibilityTableColumn::headerObject):
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::isTableRow):
+        (WebCore::AccessibilityTableRow::parentTable):
+        * page/AccessibilityTableRow.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+
+2009-05-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25763: Need to move v8 custom binding to the custom directory.
+        https://bugs.webkit.org/show_bug.cgi?id=25763
+
+        No test due to no change in behavior.
+
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Renamed from WebCore/bindings/v8/V8CanvasPixelArrayCustom.cpp.
+
+2009-05-13  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix LayoutTests/fast/dom/Element/attr-param-typechecking.html crashing with V8.
+        https://bugs.webkit.org/show_bug.cgi?id=25758
+
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): return the result of throwError() if it is called.
+
+2009-05-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix a number of bugs relating to RTL and text-overflow:ellipsis.
+        Also refactor the relevant code to make it a little clearer.
+
+        This CL fixes 3 fundamental issues:
+        - Corrects behavior if the truncated InlineTextBox's directionality is
+          different from the overall flow direction - bug 25135.
+        - Make decoration drawing in InlineFlowbox RTL-aware - bug 24206.
+        - Full truncation on InlineBoxes in RTL flow - bug 24186
+        - Add tests for the above + reorder/cleanup tests for easier
+          interpretation of outcome.
+
+        The code for placing ellipsis has been refactored to use
+        left/right notation rather than a single variable whose meaning
+        could differ based on flow directionality.
+
+        To support differing inline directionality vs flow directionality,
+        different variables are now used in InlineTextBox::placeEllipsisBox to
+        track the two.
+
+        The drawing mode for underlines in standards mode now correctly handles
+        RTL truncation and relevant test where added.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24186
+        https://bugs.webkit.org/show_bug.cgi?id=25135
+        https://bugs.webkit.org/show_bug.cgi?id=24206
+
+        Tests: fast/css/text-overflow-ellipsis-bidi.html
+               fast/css/text-overflow-ellipsis-strict.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::placeEllipsisBox):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        (WebCore::InlineTextBox::paint):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::placeEllipsis):
+        (WebCore::RootInlineBox::placeEllipsisBox):
+        * rendering/RootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+
+2009-05-13  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25746
+        Revert http://trac.webkit.org/changeset/43507 which caused crash in PPC nightlies with Safari 4.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::openFunc):
+        (WebCore::createStringParser):
+        (WebCore::createMemoryParser):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix for <rdar://problem/6872894> REGRESSION (r41896-42143): First letter cut off in styled select menus
+        
+        Make sure to do rounded clipping for overflow and controls relative to the border box and not to the overflow/control clip rect
+        (which is typically clipped to the padding or content box).  Doing so was causing rounded clips to be incorrectly applied to padding and
+        content.
+    
+        Added fast/overflow/border-radius-clipping.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Revert the parser arena change. It was a slowdown, not a speedup.
+        Better luck next time (I'll break it up into pieces).
+
+2009-05-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin and Darin Adler.
+
+        Fix for <rdar://problem/6869687> REGRESSION (r41203): Facebook friend suggestions disappear on update.
+        
+        Make sure that renderers are marked for layout if a style change causes them to switch from having a self-painting layer
+        to a non-self-painting layer (and vice versa).
+        
+        Move misplaced layer repainting code that was in RenderBox up into RenderBoxModelObject so that inlines with layers
+        repaint properly on opacity changes, etc.
+
+        Added fast/repaint/opacity-change-on-overflow-float.html.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+
+2009-05-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, build fix.
+
+        Move an include, needed by Debugger under the corresponding guard.
+
+        * inspector/InspectorController.cpp: Moved parser/SourceCode under JAVASCRIPT_DEBUGGER
+            guard.
+
+2009-05-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 25394: REGRESSION: crash in DocumentLoader::addResponse due to bad |this| pointer
+        https://bugs.webkit.org/show_bug.cgi?id=25394
+
+        Test: http/tests/xmlhttprequest/frame-unload-abort-crash.html
+
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        Add another check to subresource loader to avoid doing any loads in frames
+        when the loaders are being stopped.
+
+2009-05-13  Stephan Haller  <nomad@froevel.de>
+
+        Reviewed by Gustavo Noronha.
+
+        Wrong handling of file upload if no file selected
+        https://bugs.webkit.org/show_bug.cgi?id=25649
+
+        Fixed returned path if path is empty
+
+        * WebCore/platform/gtk/FileSystemGtk.cpp:
+
+2009-05-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6805567> REGRESSION (r42348): Notes flicker white
+          when loading
+
+        Tests: fast/frames/content-opacity-1.html
+               fast/frames/content-opacity-2.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset): Reset m_contentIsOpaque to false.
+        (WebCore::FrameView::useSlowRepaints): Use slow repaints if the content
+        is not known to be opaque.
+        (WebCore::FrameView::setContentIsOpaque): Added. Sets m_contentIsOpaque
+        and enables or disables fast repaints accordingly.
+        * page/FrameView.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Removed the
+        document()->haveStylesheetsLoaded() condition in determining whether the
+        root is opaque. This is what was causing the bug, as iframes were
+        considered to be opaque, and thus painted an opaque white background,
+        whenever they were pending a style sheet load.
+        Changed to call FrameView::setContentIsOpaqe() instead of
+        setUseSlowRepaints(), which allows the frame to go back to fast repaints
+        if the content becomes opaque.
+        Corrected the check for background color opacity: any alpha value other
+        than 255--not just zero--is not opaque.
+
 2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
 
         Reviewed by Sam Weinig.
@@ -116,6 +8190,5018 @@
         * platform/graphics/qt/GraphicsContextQt.cpp:
         (WebCore::toQtCompositionMode):
 
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        * bindings/js/JSDOMBinding.h: Removed include of JSFunction.h.
+        We don't want the entire DOM binding to depend on that file.
+
+        * bindings/js/JSAudioConstructor.cpp: Added include of Error.h.
+        Before we inherited this automatically because JDDOMBinding.h
+        included JSFunction.h, but that was excessive.
+        * bindings/js/JSDOMWindowCustom.cpp: Ditto.
+        * bindings/js/JSHTMLInputElementCustom.cpp: Ditto.
+        * bindings/js/JSImageConstructor.cpp: Ditto.
+        * bindings/js/JSLazyEventListener.cpp: Ditto, but for JSFunction.h.
+        * bindings/js/JSMessageChannelConstructor.cpp: Ditto.
+        * bindings/js/JSOptionConstructor.cpp: Ditto.
+        * bindings/js/JSWorkerConstructor.cpp: Ditto.
+        * bindings/js/JSXMLHttpRequestConstructor.cpp: Ditto.
+        * bridge/jni/jni_jsobject.mm: Ditto, but for SourceCode.h.
+        * inspector/InspectorController.cpp: Ditto.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Moved mose of this function into the base class in JavaScriptCore,
+        so the details of compilation don't have to be exposed.
+
+2009-05-13  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6879145>
+        Generate a contextual menu item allowing autocorrections to
+        easily be changed back.  Refrain from re-correcting items
+        that have already been autocorrected once.
+
+        * dom/DocumentMarker.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::changeBackToReplacedString):
+        * editing/Editor.h:
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/mac/WebCoreViewFactory.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::contextMenuItemTagChangeBack):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::replacedString):
+        * rendering/HitTestResult.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        * rendering/InlineTextBox.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber Stamped by Oliver Hunt.
+
+        [GTK] Fix Gtk+/X11 build on OSX
+
+        Including the CoreFoundation header here and X11 headers
+        later will result in different definitions of Boolean. The
+        CoreFoundation include does not seem to be necessary here
+        and my mac build was successfull without it. I will remove
+        it for now. If the build bots disagree this will be replaced
+        by a #if PLATFORM(CF).
+
+        * platform/FileSystem.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber Stamped by Gustavo Noronha.
+
+        [GTK] Move the #ifdef around for a buildfix for Gtk+ on OSX
+
+        When building Gtk+ on OSX we ended up declaring
+        setNPWindowIfNeeded twice. Fix that by moving
+        the #if PLATFORM(GTK) up and using elif instead of
+        else.
+
+        * plugins/PluginView.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25685
+        [GTK] Middle click paste form the pasteboard
+
+        The kit wants to paste from at least two different
+        clipboards. By introducing getCurrentTarget to the
+        PasteboardHelper interface we can make this decision
+        in the kit.
+        Use the new method in PasteboardGtk to get the right
+        GdkClipboard for the paste operation.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::plainText):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-05-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6438177> QTMoviePreferredTransformAttribute only supported on SnowLeopard
+        <rdar://problem/6872468> QTMovieOpenForPlaybackAttribute only supported on SnowLeopard
+
+        QTMoviePreferredTransformAttribute and QTMovieOpenForPlaybackAttribute are not supported
+        on Tiger or Leopard.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Remove invalid ASSERT.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): Only request QTMoviePreferredTransformAttribute
+        when !BUILDING_ON_TIGER and !BUILDING_ON_LEOPARD.
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): Only ask for QTMovieOpenForPlaybackAttribute 
+        when !BUILDING_ON_TIGER and !BUILDING_ON_LEOPARD,
+
+2009-05-12  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25738: Skia: CSS border style not cleared for SVG object
+        https://bugs.webkit.org/show_bug.cgi?id=25738
+
+        If no dashing is set, this change reverts to solid stroke
+        (previously the code bailed and left the old setting, whatever it was)
+
+        Test case listed in above bug entry.
+        (Additional complications due to each platform rendering dotted lines differently -
+        c.f. https://bugs.webkit.org/show_bug.cgi?id=25737)
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setLineDash):
+
+2009-05-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 21903: Adds DOM bindings for the placeholder property of the
+        HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=21903
+
+        Test: fast/forms/placeholder-dom-property.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::placeholder):
+        (WebCore::HTMLInputElement::setPlaceholder):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::placeholder):
+        (WebCore::WMLInputElement::setPlaceholder):
+
+2009-05-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25706
+
+        Change V8 bindings to match JSC bindings with respect to using
+        the lexical or dynamic global object.
+
+        Tests: http/tests/security/aboutBlank/security-context-grandchildren-lexical.html
+               http/tests/security/aboutBlank/security-context-grandchildren-write-lexical.html
+               http/tests/security/aboutBlank/security-context-grandchildren-writeln-lexical.html
+
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-03-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6702386> Incorrect bound check in SVGList::insertItemBefore
+
+        SVGList::insertItemBefore would not perform a bounds check on the
+        index it was provided, potentially leading to a buffer overflow. 
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
+2009-05-12  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25708: Cannot choose menu items in popups with many entries in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=25708
+
+        This change sets the window size for popups on Mac to include all items
+        in the menu. This is required for hit testing on Mac, where we use native
+        controls to manage the popups and don't want to artificially limit the
+        valid hit testing region to a limited scroll window.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+
+2009-05-12  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixes to build with latest skia:  SkTypeface::Create() is now
+        SkTypeface::CreateFromName(); computeBounds() has been reworked
+        as getBounds().  The changes are placed behind an #ifdef for now,
+        so that we can roll back the skia version in Chromium if necessary
+        without having to roll back this change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25705
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::boundingRect):
+        (WebCore::boundingBoxForCurrentStroke):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-05-12  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25732
+        Update V8ElementCustom.cpp to match the current API of V8Proxy.
+
+        (WebCore::ACCESSOR_SETTER): Change retrieveActiveFrame() to retrieveFrameForEnteredContext().
+
+2009-05-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25694
+        HTMLParser::createHead() ASSERT: Creating an element, calling  document.open() and writing
+        to the document NULL ptr
+
+        Test: fast/parser/implicit-head-in-fragment-crash.html
+
+        * html/HTMLParser.cpp: (WebCore::HTMLParser::bodyCreateErrorCheck): Do not try to implicitly
+        create <head> when parsing a fragment.
+
+2009-05-12  Soren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25687
+        Missing check for valid function in V8 bindings for toString function for event listeners.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction): Added empty handle checks.
+
+2009-05-11  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Change Qt port to match the mac and windows ports, and unregister plugins when plugins are stopped.
+        Not doing that can cause assersion failure.
+        https://bugs.webkit.org/show_bug.cgi?id=25702
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::stop):
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Bug 25714: [Qt] Decouple HTML5 Database support from the
+        SQLite/generic database support in the Qt port
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25714>
+
+        * WebCore.pro:
+
+2009-05-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25713: AX: Control Elements not identified in HTML content
+        https://bugs.webkit.org/show_bug.cgi?id=25713
+
+        Test: accessibility/onclick-handlers.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6276843> REGRESSION: TextIterator generates
+        an extra newline for ranges that start outside of body
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
+        Check startPos for null, not just currPos.
+
+2009-05-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25700: Regression:WebKit:cmd-left and cmd-right use to go to the beginning and end of a line in Mail
+        https://bugs.webkit.org/show_bug.cgi?id=25700
+
+        Keyboard selection movement handlers need to also watch for the Cmd key when Accessibility is enabled.
+        Note: This code is only used when accessibility is enabled.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleKeyboardSelectionMovement):
+
+2009-05-11  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 25087: Test for ENABLE_FOO macros consistently in IDL files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25087>
+
+        Reviewed by Timothy Hatcher.
+
+        Change tests for ENABLE macros to check for both existence and
+        value:
+
+        - Negative:  #if !defined(ENABLE_FOO) || !ENABLE_FOO
+        - Positive:  #if defined(ENABLE_FOO) && ENABLE_FOO
+
+        * css/CSSCharsetRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/RGBColor.idl:
+        * dom/Attr.idl:
+        * dom/DOMCoreException.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Event.idl:
+        * dom/EventException.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/Node.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/Range.idl:
+        * dom/RangeException.idl:
+        * dom/WheelEvent.idl:
+        * html/CanvasPixelArray.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/ImageData.idl:
+        * inspector/InspectorController.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/Console.idl:
+        * page/Coordinates.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/Geoposition.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Navigator.idl:
+        * svg/SVGElementInstance.idl:
+        * svg/SVGException.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24538: class/struct mixup in forward declarations
+        https://bugs.webkit.org/show_bug.cgi?id=24538
+
+        * inspector/InspectorResource.h:
+        * loader/CachedFont.h:
+        * loader/appcache/ApplicationCache.h:
+        * rendering/RenderBlock.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.h:
+        * svg/SVGGlyphElement.h:
+        * svg/SVGHKernElement.h:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24539: Unresolved CSSMutableStyleDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=24539
+
+        The Symbian tools can't compile and link this without this include.
+        It's not clear why this is different from other toolsets or why it affects
+        only this header file, but adding the include for now.
+
+        * editing/RemoveCSSPropertyCommand.h: Added include of CSSMutableStyleDeclaration.h.
+
+2009-05-11  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25701
+        REGRESSION(r38788 & r42020): styled searchfields look wrong on Windows, affects Facebook
+
+        Test: fast/forms/search-styled.html
+
+        * css/themeWin.css:
+        Remove the overriding of -webkit-appearance for searchfields. This will cause background
+        images to not be honored when styling searchfields
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSearchFieldStyle):
+        * rendering/RenderThemeWin.h:
+        Re-instate final adjustments to searchfield styling that were removed in r42020
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+
+2009-05-11  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25626
+        Update V8ElementCustom.cpp to match the current API of Node.
+
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Changed a couple of method names to match current names.
+        (WebCore::ACCESSOR_GETTER): Changed a method name to match current name.
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+
+2009-05-11  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8CustomBinding.cpp is missing a header file
+
+        https://bugs.webkit.org/show_bug.cgi?id=25644
+
+        * bindings/v8/custom/V8CustomBinding.cpp: Added #include "V8Proxy.h".
+
+2009-05-11  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25634
+        Change V8Proxy::retrieveActiveFrame() call sites to V8Proxy::retrieveFrameForEnteredContext().
+
+        Also, change instances of ScriptController::retrieveActiveFrame() to
+        V8::retrieveFrameForEnteredContext() for consistency.
+
+
+        See http://codereview.chromium.org/113085 for the corresponding Chromium change.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetLocation):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5972751> Local image files (BMP, ico) can be misidentified as HTML.
+
+        First part of the fix - Disable content sniffing for file resources which never should've been happening anyways.
+        Second part of the fix - If the networking layer doesn't give us back a MIME type default to "application/octet-stream".
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::defaultMIMEType): "application/octet-stream"
+        * platform/MIMETypeRegistry.h:
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::create): If content sniffing is true, double check with "shouldContentSniffRequest()" which
+          might override it to false.
+        (WebCore::ResourceHandle::shouldContentSniffURL): Return false for file:// urls, true for everything else.
+        * platform/network/ResourceHandle.h:
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType): Create a copy of the CFURLRequest with the default MIME type instead
+          of null.
+        (WebCore::didReceiveResponse): If the MIME type for the response is null, create a copy with the default MIME type.
+        (WebCore::WebCoreSynchronousLoader::load): Use shouldContentSniffRequest() to make synchronous loads have the same 
+          sniffing policy as asynchronous loads.  Also, correct a null MIME type by creating a copy with the default type.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Use shouldContentSniffRequest() to make synchronous loads have the
+          same sniffing policy as asynchronous loads.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Set up the [NSURLResponse MIMEType] swizzling if
+          it hasn't been set up yet.
+        (_web_NSURLResponse_MIMEType): Either return the actual MIME type of the response, or the default MIME type if it's nil.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Remove the workaround added in r29370 as it will now be covered by
+          the new mechanism.
+
+2009-05-11  David Kilzer  <ddkilzer@apple.com>
+
+        Fix typo "APPLICATION_CAHE_DYNAMIC_ENTRIES" to "APPLICATION_CACHE_DYNAMIC_ENTRIES"
+
+        This was added in r39816 to disable dynamic entries.  They are
+        still disabled after fixing the typo since this feature define
+        is never set anywhere.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * loader/appcache/DOMApplicationCache.idl:
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        Most of the change is in WTF.
+        Unless noted, all the following files changed to use the new ThreadIdentifier::isValid()
+        method instead of just doing 'if(m_threadID)' kind of checks, since ThreadIdentifier
+        is now a class rather then an integer.
+        Also, there is no need to initialize threadID in constructors to 0 now.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::libxmlLoaderThread): use DEFINE_STATIC_LOCAL and accessor function for static thread id,
+        since now ThreadIdentifier needs construction and we avoid having global initializers.
+        (WebCore::matchFunc): use the new accessor function.
+        (WebCore::openFunc): ditto.
+        (WebCore::createStringParser): ditto.
+        (WebCore::createMemoryParser): ditto.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread): remove m_threadID from debug output.
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unused header that declared one function which was never defined anywhere.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/cf/ResourceResponseCFNet.cpp: Change to include ResourceResponse.h (which really means
+          platform/network/cf/ResourceResponse.h)
+        * platform/network/cf/ResourceResponseCFNet.h: Removed.
+
+2009-05-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25213
+        Fix assert during Inspector destruction.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed): Moved closing
+            inspector above removing InspectorController object to fix JS errors,
+            added clearing inspector page ptr.
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Make sure that public APIs are properly exported on all Qt platforms
+        https://bugs.webkit.org/show_bug.cgi?id=25601
+
+        * WebCore.pro: Define QT_MAKEDLL for all non-static builds, not just for win
+
+2009-05-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24284
+
+        * WebCore.pro: duplicated values removed from INCLUDEPATH
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix Symbian; clean Up WebKit/Qt if ENABLE_NETSCAPE_PLUGIN_API=0
+        https://bugs.webkit.org/show_bug.cgi?id=24688
+
+        * WebCore.pro: Use platform independent plugin stubs if ENABLE_NETSCAPE_PLUGIN_API=0
+        * platform/qt/TemporaryLinkStubs.cpp: Remove stub functions for plugins
+
+2009-05-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix a crash when deactivating a document that had adopted a <form>
+          element
+
+        Test: fast/dom/HTMLFormElement/document-deactivation-callback-crash.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument): Corrected the
+        logic here: <form> elements should be registered for document activation
+        callbacks if and only if autocomplete is off.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6867598> REGRESSION (r42483): Have to enter credentials twice when trying
+        to view protected MobileMe video
+
+        Add a temporary workaround.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Added an m_useSiteSpecificQuirks boolean (Mac-only). A Frame pointer is only available when
+        starting a request, so we need to store this data for later use.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Initialize m_useSiteSpecificQuirks.
+        (WebCore::ResourceHandle::receivedCredential): Use per-session credentials with gallery.me.com.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6870383> Have to enter credentials twice when downloading from a protected page
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        Move WebCore credential storage to AuthenticationCF, so that WebKit could use it (macthing
+        an earlier Mac change).
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Match newer XMLHttpRequest draft and make withCredential setter raise an exception when
+        called at a wrong time.
+
+        No test, because we are waiting for a newer version of system frameworks to test the attribute.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::setWithCredentials):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        Raise INVALID_STATE_ERR if the state is not OPENED, or if the send() flag is true.
+
+2009-05-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25602
+          REGRESSION: fast/overflow/overflow-focus-ring.html seems double-drawn
+          on ToT
+
+        Test: fast/layers/self-painting-outline.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer): Paint the layer's own outline only
+        if it is a self-painting layer.
+
+2009-05-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen and Mark Rowe.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25666
+          Assertion failure in Node::setDocument()
+          (willMoveToNewOwnerDocumentWasCalled) when adopting a <form> element
+
+        Test: fast/dom/HTMLFormElement/adopt-assertion.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::willMoveToNewOwnerDocument): Overrides of
+        this method are required to call the base class implementation. Do it.
+        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument): Ditto.
+
+2009-03-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebCore::DocumentLoader::mainReceivedError now asserts if error.isNull(), so
+        make sure CURL does not create empty ResourceError() objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24927
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix, adding missing files to make dist.
+
+        * GNUmakefile.am:
+
+2009-05-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25656
+        
+        Reduce the inline capacity of CSSParserValueList's m_values
+        vector to reduce the size of CSSParserValueList from 544 to 160 bytes in 64-bit.
+
+        * css/CSSParserValues.h:
+
+2009-05-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Used sort-Xcode-project-file to sort the XCode project file - it hasn't been done for a while.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-05-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6864786> REGRESSION: Crash below
+          ApplyStyleCommand::applyInlineStyleToRange when reviewing a patch in
+          Bugzilla
+
+        Test: editing/style/apply-through-end-of-document.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange): Added a null
+        check for the case of a range extending through the end of the document,
+        in which pastEndNode is 0.
+
+2009-05-08  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/6857446> REGRESSION (Safari 3-4): Contraction base 
+        marked as misspelled even though contraction is a word
+        Make sure spelling underline does not persist on words like 
+        <doesn't>.  
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+
+2009-05-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure the path's refdata isn't deleted before we're done with the object.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25652
+
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::~Path):
+        (WebCore::Path::Path):
+        (WebCore::Path::translate):
+
+2009-05-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for memory leak on Mac.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25650
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+
+2009-05-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6857446> REGRESSION (r37591): Cannot print or 
+        preview from maps.yandex.ru
+
+        We need to fall into the stretchesToViewHeight() quirk when we are 
+        printing and we are the root and the root has percentage height OR 
+        when we are the body and the root has percentage height. Otherwise 
+        we have a height of 0 and can run into painting troubles.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+
+2009-05-08  Douglas Davidson  <ddavidso@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes for <rdar://problem/6852771>.
+        Prevent text checking replacement immediately after an apostrophe
+        and automatic link addition except immediately after typing.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+
+2009-05-08  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25627
+        Bug 25627: HTMLMediaElement: some errors should fire on <source> elements
+
+        Update for HTML5 spec change to fire 'error' events on <source> element
+        when there is a failure while processing/loading a <source>.
+
+        Test: media/video-source-error.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::enqueueEvent): Remove white-space.
+        (WebCore::HTMLMediaElement::loadInternal): Call cancelPendingEventsAndCallbacks instead
+        of just calling m_pendingEvents.clear() as we now also need to cancel pending errors on
+        all <source> element. 
+        (WebCore::HTMLMediaElement::selectMediaResource): Call isSafeToLoadURL() here instead of in
+        loadResource() as we need to report errors differently depending on the type of failure. Use
+        KURL instead of String.
+        (WebCore::HTMLMediaElement::loadNextSourceChild): nextSourceChild -> selectNextSourceChild.
+        Fail silently when there are no more <source> canditates because that is what spec mandates.
+        Keep url as KURL instead of converting to String.
+        (WebCore::HTMLMediaElement::loadResource): ASSERT that the URL is safe to load as we now 
+        assume the safety check now done before this function. Takes KURL instead of String.
+        (WebCore::HTMLMediaElement::isSafeToLoadURL): New, checks to see if a url is safe to load, logs
+        failure if not.
+        (WebCore::HTMLMediaElement::noneSupported): MEDIA_ERR_NONE_SUPPORTED -> MEDIA_ERR_SRC_NOT_SUPPORTED
+        (WebCore::HTMLMediaElement::cancelPendingEventsAndCallbacks): New, clear all events pending on
+        the media and all source elements.
+        (WebCore::HTMLMediaElement::setNetworkState): Fire an error on the source element when the 
+        the failure happened while processing one. Only call nonSupported() when the failure happened
+        while processing media element 'src' attribute.
+        (WebCore::HTMLMediaElement::havePotentialSourceChild): nextSourceChild -> selectNextSourceChild.
+        Deal with selectNextSourceChild returning a KURL instead of a String.
+        (WebCore::HTMLMediaElement::selectNextSourceChild): Renamed from nextSourceChild, add optional
+        param to control whether or not errors are fired on a source element when it will not be used.
+        Check safety of url here instead of waiting until loadResource(). Return a KURL instead of a
+        String.
+        (WebCore::HTMLMediaElement::initialURL): nextSourceChild -> selectNextSourceChild. Keep url as
+        a KURL instead of a String.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::):
+
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::HTMLSourceElement): Initialize timer related variables.
+        (WebCore::HTMLSourceElement::scheduleErrorEvent): New, start one-shot timer to fire an error
+        event ASAP.
+        (WebCore::HTMLSourceElement::cancelPendingErrorEvent): New, cancel pending error event.
+        (WebCore::HTMLSourceElement::errorEventTimerFired): New, fire error event if it has not been
+        cancelled.
+        * html/HTMLSourceElement.h:
+
+        * html/MediaError.h: 
+        (WebCore::MediaError::): MEDIA_ERR_NONE_SUPPORTED -> MEDIA_ERR_SRC_NOT_SUPPORTED
+        * html/MediaError.idl: Ditto
+
+2009-05-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - fix <rdar://problem/6859955> Undoing typed text after selecting all
+          leaves non-text areas highlighted
+
+        Test: fast/repaint/selection-clear.html
+
+        When RenderView::clearSelection() is called from
+        SelectionController::nodeWillBeRemoved(), selected renderers may already
+        be marked for layout, which means that they can no longer compute
+        their selection repaint info. Instead, an empty IntRect (or GapRects) is
+        returned, leading to incomplete repaint.
+
+        The fix is not to rely on individual renderers when clearing the
+        selection, but instead, cache the bounding rectangle of the selected
+        blocks' GapRects when setting the selection, and invalidate that
+        entire rectangle when clearing it.
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added a parameter saying whether
+        the repainting of selected blocks should include both
+        previously-selected areas and newly-selected areas or only
+        newly-selected areas. The default is both. Also compute
+        m_cachedSelectionBounds to be the bounding rectangle of the
+        new selection's BlockSelectionInfos' GapRects.
+        (WebCore::RenderView::clearSelection): Repaint m_cachedSelectionBounds,
+        and tell setSelection() that it should not paint areas that were in
+        the old selection's BlockSelectionInfos' GapRects.
+        * rendering/RenderView.h:
+        (WebCore::RenderView::):
+
+2009-05-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6868773> NPN_GetAuthenticationInfo does not work with non-permanent credentials
+
+        * WebCore.base.exp:
+        * platform/network/mac/AuthenticationMac.h:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        * platform/network/mac/AuthenticationMac.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        Moved WebCoreCredentialStorage to AuthenticationMac, so that it could be used from WebKit.
+
+2009-05-08  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build, add missing JSC_HOST_CALL macros to the runtime
+        call methods.
+
+        * bridge/qt/qt_runtime.h:
+
+2009-05-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add missing strings to localizedStrings.js
+        https://bugs.webkit.org/show_bug.cgi?id=25635
+
+        Add the strings "Delete", "Key", "Refresh" and "Value".
+
+        * English.lproj/localizedStrings.js:
+
+2009-05-08  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed, tweaked and landed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24992
+        [Qt] crash at http://browserspy.dk/browser.php
+
+        This cannot be easily tested in DRT, because it relies on interaction with QApplication,
+        but the added assertions guard against re-introducing this issue.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::didOpenURL): Don't make client calls
+        while the frame is being constructed, because the intermediate state without a document
+        is something we don't want to expose.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setJSStatusBarText): Assert that the frame has a document, which is an
+        approximation of it being in a consistent state for client calls.
+        (WebCore::Frame::setJSDefaultStatusBarText): Ditto.
+
+2009-05-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25640>.
+        Bug 25640: Crash on quit in r43384 nightly build on Leopard w/ Safari 4 beta installed
+        
+        Roll out r43366 as it removed symbols that Safari 4 Beta uses.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::openFunc):
+        (WebCore::createStringParser):
+        (WebCore::createMemoryParser):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Unify scrolling code via adjustments and keys. Use the WebCore
+        defined constants, since that's what people are most used to at
+        this point.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+
+2009-05-07  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+        Suggested by Oliver Hunt.
+
+        Rolling back http://trac.webkit.org/changeset/43385
+        because we have to use mac artwork for the underline on OSX.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::createPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::setCGStrokeColor):
+        (WebCore::spellingPatternColor):
+        (WebCore::grammarPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+
+2009-05-07  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Simon Fraser.
+  
+        https://bugs.webkit.org/show_bug.cgi?id=25573
+        Unify use of CG-common routine for drawLineForMisspellingOrBadGrammar.
+        Cleanup for WebKit, but required for Chromium happiness.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::spellingPatternColor):
+        (WebCore::grammarPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 25575: Registered mutation event listener crashes HTMLMediaElement
+        https://bugs.webkit.org/show_bug.cgi?id=25575
+
+        Test: fast/media/video-controls-with-mutation-event-handler.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Don't call setAttribute.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createTimeline): Call setAttribute here.
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to minimize padding.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        * rendering/RenderTableSection.h:
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to make Events 8 bytes smaller in 64-bit.
+
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+
+2009-05-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Fix regression caused by r41469, add test case to prevent it from 
+        happening again.
+        https://bugs.webkit.org/show_bug.cgi?id=25252
+  
+        hasLayer() was true during removeOnlyThisLayer()/
+        updateLayerPositions()
+        which caused updateLayerPosition()'s walk up the render tree to 
+        include offsets from the layer we were about to remove.
+  
+        I'm not 100% convinced that this wasn't a bug in 
+        updateLayerPosition() or in RenderBoxModelObject::styleDidChange, 
+        because the layer in question is not the containing block for the 
+        block which gets laid out wrong. But this restores the previous 
+        behavior and adds a test.  So the next time someone is in here re-
+        factoring, they will at least know if they break something.
+  
+        Test: fast/layers/remove-only-this-layer-update.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::destroyLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Attempt to fix GTK build.
+
+        * platform/graphics/GlyphPageTreeNode.h: add #include <string.h> to ensure memcpy and memset are defined.
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve native call performance
+
+        Add calling convention declarations where necessary, and update bindings
+        script to generate them as well.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::callPlugin):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::callRuntimeObject):
+
+2009-05-07  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=25617
+
+        Fix memory/performance regression because of too much form control related abstraction just for WMLs sake.
+
+        Remove FormControlElement and FormControlElementWithState base classes, as the overhead is too high for the
+        gain. HTML has no benefit of that kind of abstraction, so we're going to move the functionality to Element directly.
+
+        The functions now living in FormControlElement(WithState) lived in Node/Element/HTMLFormControlElement before.
+        This patches moves all of them in a central place in Element.h, as virtual functions with an inline default implementation.
+        To avoid confusion like isEnabled() living on Node, before the creation of the FormControlElement abstraction layer, all
+        methods are renamed to clarify where they belong to. All renames are listed here:
+
+        From FormControlElement:
+        - isEnabled() -> isEnabledFormControl()
+        - isReadOnly() -> isReadOnlyFormControl()
+        - isTextControl() -> isTextFormControl()
+        - valueMatchesRenderer() -> formControlValueMatchesRenderer()
+        - setValueMatchesRenderer() -> setFormControlValueMatchesRenderer()
+        - name() -> formControlName()
+        - type() -> formControlType()
+
+        From FormControlElementWithState:
+        - saveState() -> saveFormControlState()
+        - restoreState() -> restoreFormControlState()
+
+        A lot of Element -> FormControlElement(WithState) casting is gone again, so it's not only a memory, but also a performance progression.
+
+        No testcases affected, no new tests needed.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/Document.cpp:
+        (WebCore::Document::formElementsState):
+        * dom/Document.h:
+        (WebCore::Document::registerFormElementWithState):
+        (WebCore::Document::unregisterFormElementWithState):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::isEnabledFormControl):
+        (WebCore::Element::isReadOnlyFormControl):
+        (WebCore::Element::isTextFormControl):
+        (WebCore::Element::formControlValueMatchesRenderer):
+        (WebCore::Element::setFormControlValueMatchesRenderer):
+        (WebCore::Element::formControlName):
+        (WebCore::Element::formControlType):
+        (WebCore::Element::saveFormControlState):
+        (WebCore::Element::restoreFormControlState):
+        * dom/FormControlElement.cpp: Removed.
+        * dom/FormControlElement.h: Removed.
+        * dom/FormControlElementWithState.cpp: Removed.
+        * dom/FormControlElementWithState.h: Removed.
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::formControlType):
+        * html/HTMLButtonElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::formControlType):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        (WebCore::HTMLFormControlElement::formControlName):
+        (WebCore::HTMLFormControlElement::willValidate):
+        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::willMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::didMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isTextFormControl):
+        (WebCore::HTMLFormControlElement::isEnabledFormControl):
+        (WebCore::HTMLFormControlElement::formControlValueMatchesRenderer):
+        (WebCore::HTMLFormControlElement::setFormControlValueMatchesRenderer):
+        (WebCore::HTMLFormControlElement::isReadOnlyFormControl):
+        (WebCore::HTMLFormControlElement::type):
+        (WebCore::HTMLFormControlElement::name):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formControlName):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::detach):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::readOnly):
+        (WebCore::HTMLInputElement::isTextFormControl):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::formControlType):
+        * html/HTMLKeygenElement.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::formControlType):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::formControlType):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::formControlType):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::formControlType):
+        (WebCore::HTMLTextAreaElement::saveFormControlState):
+        (WebCore::HTMLTextAreaElement::restoreFormControlState):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setValue):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::readOnly):
+        (WebCore::HTMLTextAreaElement::isTextFormControl):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::updateUserModifyProperty):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isEnabled):
+        (WebCore::RenderTheme::isReadOnlyControl):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustMenuListStyle):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::adjustMenuListStyle):
+        * wml/WMLFormControlElement.cpp:
+        * wml/WMLFormControlElement.h:
+        (WebCore::WMLFormControlElement::isReadOnlyFormControl):
+        (WebCore::WMLFormControlElement::isTextFormControl):
+        (WebCore::WMLFormControlElement::formControlValueMatchesRenderer):
+        (WebCore::WMLFormControlElement::setFormControlValueMatchesRenderer):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::isKeyboardFocusable):
+        (WebCore::WMLInputElement::isMouseFocusable):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::formControlType):
+        (WebCore::WMLInputElement::formControlName):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::saveFormControlState):
+        (WebCore::WMLInputElement::restoreFormControlState):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::detach):
+        (WebCore::WMLInputElement::appendFormData):
+        (WebCore::WMLInputElement::init):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::isTextFormControl):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::formControlType):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::formControlType):
+        * wml/WMLOptionElement.h:
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        Most of the change is in WTF.
+        Unless noted, all the following files changed to use the new ThreadIdentifier::isValid()
+        method instead of just doing 'if(m_threadID)' kind of checks, since ThreadIdentifier
+        is now a class rather then an integer.
+        Also, there is no need to initialize threadID in constructors to 0 now.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::libxmlLoaderThread): use DEFINE_STATIC_LOCAL and accessor function for static thread id,
+        since now ThreadIdentifier needs construction and we avoid having global initializers.
+        (WebCore::matchFunc): use the new accessor function.
+        (WebCore::openFunc): ditto.
+        (WebCore::createStringParser): ditto.
+        (WebCore::createMemoryParser): ditto.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread): remove m_threadID from debug output.
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to minimize padding.
+
+        * dom/ClassNames.h:
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6864062> Shrink GlyphPage from 4112 to 2576 bytes in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25605
+
+        Shrink GlyphPage by splitting the array of GlyphData, which has lots
+        of padding, into separate Glyph and SimpleFontData* arrays.
+
+        * platform/graphics/Font.h:
+        glyphDataForCharacter has to return a GlyphData by value now.
+        
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        Return GlyphData by value.
+        
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+        Better encapsulation of GlyphPage, using the new methods.
+
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+        * platform/graphics/GlyphPageTreeNode.h:
+        (WebCore::GlyphData::GlyphData):
+        (WebCore::GlyphPage::indexForCharacter):
+        (WebCore::GlyphPage::glyphDataForCharacter):
+        (WebCore::GlyphPage::glyphDataForIndex):
+        (WebCore::GlyphPage::glyphAt):
+        (WebCore::GlyphPage::fontDataForCharacter):
+        (WebCore::GlyphPage::setGlyphDataForCharacter):
+        (WebCore::GlyphPage::setGlyphDataForIndex):
+        (WebCore::GlyphPage::copyFrom):
+        (WebCore::GlyphPage::clear):
+
+2009-05-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25625
+        Implement Image/Option constructors in V8 bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Removed old JS-based code.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp: Added.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp: Added.
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        I hate myself for doing this, but need to fix that ChangeLog entry.
+
+        * ChangeLog:
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Darin Adler
+
+        * html/HTMLParser.cpp: Use the correct style of BUILDING_ON_* for WebCore.
+        * html/HTMLParser.h: Ditto
+
+2009-05-07  David Hyatt  <hyatt@apple.com>
+
+        Restore intrinsic margins to all form controls on Mac and Windows.  Some of this regressed in 43007
+        when textareas were given explicit margins.  Some of it had already regressed earlier whenever intrinsic
+        margins were turned off in themeWin.css.
+
+        Reviewed by Beth Dakin.
+
+        * css/html4.css:
+        * css/themeWin.css:
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler and Alexey Proskuryakov.
+
+        <rdar://problem/6863795> Exception occurs in Mail when attempting to create signatures due to <head> element creation
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Check shouldCreateImplicitHead() before creating it.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Check shouldCreateImplicitHead() before creating it.
+        (WebCore::HTMLParser::bodyCreateErrorCheck): Ditto.
+        (WebCore::shouldCreateImplicitHead): For Tiger/Leopard when running under Mail, the implicit <head> shouldn't be created.
+        * html/HTMLParser.h:
+        (WebCore::shouldCreateImplicitHead): Inline implementation for non-Tiger/Leopard platforms
+
+2009-05-07  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a memory leak in V8EventListenerList::remove.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25618
+
+        No new functionality so no new tests. 
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::remove):
+
+2009-05-07  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp: Add missing
+        HTMLCollection.h include.
+
+2009-05-07  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25598: AX: if a radio button has a label and a title, the label is not exposed
+        https://bugs.webkit.org/show_bug.cgi?id=25598
+
+        Test: accessibility/radio-button-title-label.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::exposesTitleUIElement):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * page/AccessibilityRenderObject.h:
+
+2009-05-07  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER): ":" should be "::"
+
+2009-05-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25610
+        [GTK] text.caretOffset is reportedly always 0
+
+        Use the right function to get the caret offset in an
+        element. selectionStart() would only work for text
+        controls (there's even an ASSERT when calculating the selected
+        text range). Instead just get the selection and get the offset of
+        the start position.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for antialiased CSS border-radius
+        
+        WebKit implements border-radius by drawing a double-size border,
+        and then letting the clip constrain the border to the right width
+        and position. This requires support for antialiased clipping, as
+        well as painting, to get a nice smooth border.
+        
+        Qt only does antialiased clipping if the anti-alias flag is set
+        at the time of clipping, so we have to enable this in the method
+        addInnerRoundedRectClip(), as well as when we draw the border.
+        
+        Currently the raster-engine is the only Qt paint engine to support
+        anti-aliased clipping, but the OpenGL and Mac paint engines could
+        potentially support this in the future.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-05-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Render empty optgroup elements.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24900
+
+        Currently, optgroup elements which are empty are not rendered. The
+        HTML specification gives no guidance on this situation.
+
+        However, the test for being empty is that they have no children, thus
+        this will not render:
+          <optgroup label="test"></optgroup>
+        while this /will/ render (because of the text node child):
+          <optgroup label="test"> </optgroup>
+
+        This patch will cause both cases to render which matches IE's and
+        Firefox's behaviour.
+
+        The difference only appears when opening the select element and does
+        not appear in the render tree. Thus, a manual layout-test is required.
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcListItems):
+        * manual-tests/optgroup-empty-and-nested.html: Added.
+
+2009-05-06  Julie Parent  <jparent@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25608: Unused m_frame in ChromiumClipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=25608
+
+        * platform/chromium/ClipboardChromium.h:
+        
+        No tests added as this is only removing dead code, no functional changes.
+
+2009-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Justin Garcia.
+
+        - fix another part of <rdar://problem/6703873> Triple-click quoted line
+          and type Return creates an extra quoted blank line
+
+        Test: editing/inserting/6703873-2.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Corrected the logic for
+        determining the first node that should go into the new blockquote
+        given the split position: if it is at the end of a container, use the
+        next node after the container. Otherwise, use the child at the
+        position's offset.
+
+2009-05-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, fixes for wx trunk builds.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/wx/RenderThemeWx.cpp:
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+
+2009-05-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25597
+        Fix API drift compile errors that occurred while this was ifdef-ed out.
+        The two big issues were that RenderObject::element() became
+        RenderObject::node() and some of the wk* drawing functions had
+        an extra theme parameter added to the argument list.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+
+2009-05-06  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25385
+        Upstream changes to V8 bindings for supporting nested workers.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER WorkerOnmessage):
+        (WebCore::CALLBACK_FUNC_DECL WorkerAddEventListener):
+
+2009-05-06  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25513
+        The V8 bindings convert every javascript property to its associated css style
+        name. It then calls functions that convert that name to an id. This makes
+        getting or setting css styles on elements slow.
+        
+        The patch fixes this by caching the results of the transformation, mapping a
+        javascript property name to its css property id. It then calls the already
+        public webkit methods that take the id in place of the string property names.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+
+2009-05-06  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25591
+        Upstream V8HTMLFormElement from the Chromium repository.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER HTMLFormElement): Upstreamed from Chromium repository
+        (WebCore::NAMED_PROPERTY_GETTER HTMLFormElement): Changed empty element return case to return notHandledByInterceptor();
+        (WebCore::CALLBACK_FUNC_DECL HTMLFormElementSubmit): Upstreamed from Chromium repository
+
+2009-05-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25595
+        Upstream V8CanvasPixelArrayCustom from chromium port tree.
+
+        * bindings/v8/V8CanvasPixelArrayCustom.cpp: Added.
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stampted by Eric Seidel
+
+        Add braces to clarify logic flow in RenderObject::adjustStyleDifference.
+        Only affects ACCELERATED_COMPOSITING builds.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::adjustStyleDifference):
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6862550> Reduce size of RenderText in 64-bit
+        
+        Rearrange data members of RenderText so that an int comes
+        first, to minimize padding.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        * rendering/RenderText.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6862823> Reduce size of RenderStyle in 64-bit
+        
+        Rearrange data members of RenderStyle to minimize padding
+        when building for 64-bit.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+
+2009-05-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25596
+
+        Fixes Chromium build bustage caused by r43317 (making
+        RefCountedBase::m_refCount private)
+
+        * page/chromium/AccessibilityObjectWrapper.h:
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):
+
+2009-05-06  Hin-Chung Lam  <hclam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25593
+
+        Refactor for MediaPlayerPrivate for Chromium port. Remove
+        the implementation of MediaPlayerPrivateInferface from it.
+
+        * platform\graphics\chromium\MediaPlayerPrivateChromium.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt, Dan Bernstein
+        
+        <rdar://problem/6860197> Reduce the size of FontFallbackList in 64-bit
+
+        Re-order the data members of FontFallbackList to save 8 bytes when building 64-bit.
+
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        * platform/graphics/FontFallbackList.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein
+
+        <rdar://problem/6860068> Reduce size of InlineBox in 64-bit
+
+        Re-order the data members of InlineBox to save 8 bytes when building 64-bit.
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+
+2009-05-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25588
+        Adding the custom v8 bindings Document.location.
+
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp: Added.
+
+2009-05-06  Kevin McCullough  <kmccullough@apple.com>
+
+        -Clarified a comment
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-05-06  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds by including "MappedAttribute.h" in several places.
+
+        * wml/WMLAElement.cpp:
+        * wml/WMLAccessElement.cpp:
+        * wml/WMLBRElement.cpp:
+        * wml/WMLCardElement.cpp:
+        * wml/WMLDoElement.cpp:
+        * wml/WMLElement.cpp:
+        * wml/WMLFieldSetElement.cpp:
+        * wml/WMLGoElement.cpp:
+        * wml/WMLImageElement.cpp:
+        * wml/WMLInputElement.cpp:
+        * wml/WMLMetaElement.cpp:
+        * wml/WMLOnEventElement.cpp:
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptionElement.cpp:
+        * wml/WMLPElement.cpp:
+        * wml/WMLPostfieldElement.cpp:
+        * wml/WMLSetvarElement.cpp:
+        * wml/WMLTableElement.cpp:
+        * wml/WMLTemplateElement.cpp:
+        * wml/WMLTimerElement.cpp:
+
+2009-05-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Emit AtkText::text-selection-changed when the selection changes
+        and the current selection is of Range (ie, the start and end
+        positions are different) type. This seems to match what Gecko
+        does.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-05-05  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Emit AtkText::text-caret-moved when selection changes.
+
+        * GNUmakefile.am:
+        * editing/SelectionController.h:
+        * editing/gtk/SelectionController.cpp: Added.
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Use mozilla cursors for the previously not implemented
+        cursors. The manual-tests/cursor.html is looking complete
+        now.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::cellCursor):
+        (WebCore::noDropCursor):
+        (WebCore::progressCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        Properly indent the header file.
+
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Use the mozilla copyright header. Use MPL1.1/GPL2.0
+        and LGPL2.1 as the license compared to LGPL2.0.
+
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Move PluginView::invalidateRegion from the
+        TemporaryLinkStubs to PluginViewGtk.cpp and implement
+        it with a call to Widget::invalidate() just like
+        mac is doing. Optimisations would have to be window
+        system specific.
+
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::invalidateRegion):
+
+2009-05-06  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Misc fixes to InspectorClientGtk.
+
+        * GNUmakefile.am: Add localizedStrings.js to webinspector_DATA.
+        This prevents copious amounts "Localized string not found" errors
+        in the console
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the Qt build on Windows.
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::shouldIncludeChildWindows): Implemented dummy accessor.
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Tweak WebCore.pro for being able to override the generated sources dir for the
+        generated_files target.
+
+        * WebCore.pro:
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the Qt/Windows build, use iface instead of interface to avoid conflict
+        with VS2005 headers.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
+
+2009-05-06  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        We need to include StringExtras.h on Windows CE to access the strdup function.
+
+        * plugins/PluginStream.cpp:
+
+2009-05-06  Soren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Changed the toString behaviour for non document dom node event handlers in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25544
+
+        In the V8 bindings non document dom node event handlers are wrapped in a number of with blocks and uses an inner
+        function. This causes the default toString on such a handler to return all this wrapper code. As some web sites
+        use the source of an event handler to create new functions this wrapper code causes compatibility problems.
+
+        Create a specific toString function for these handlers which will return a function source compatible with the
+        source returned by the JSC bindings and other browsers.
+
+        Test: fast/events/event-function-toString.html
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create):
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * WebCore.pro:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $$GENERATED_SOURCES_DIR as output when running bison
+
+        A couple of the generators left the bison output file in the source
+        tree, and then moved it into $$GENERATED_SOURCES_DIR, which did not
+        work well when building release and debug configurations in parallel.
+
+        * WebCore.pro:
+
+2009-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        - fix an assertion failure in RemoveNodeCommand() when deleting a <br>
+          between a block and a mail blockquote
+
+        Test: editing/deleting/removeNodeCommand-assert.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Pass the start block
+        to prune() instead of passing m_upstreamStart.node(), because the latter
+        may have been removed already.
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        No review, roll out only.
+
+        Roll out r23072 since it broke layout tests
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-05-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+        
+        Add #if ENABLE(DATABASE) guards around database code so toggling ENABLE_DATABASE off does not break builds.
+        https://bugs.webkit.org/show_bug.cgi?id=24776
+
+        No functional changes, thus no tests.
+
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSDatabaseCustom.cpp:
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        * loader/EmptyClients.h:
+        * page/ChromeClient.h:
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/ChangeVersionWrapper.h:
+        * storage/Database.cpp:
+        (WebCore::Database::databaseInfoTableName):
+        * storage/Database.h:
+        * storage/Database.idl:
+        * storage/DatabaseTask.cpp:
+        * storage/DatabaseTask.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseThread.h:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/DatabaseTrackerClient.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginQuotaManager.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransaction.idl:
+
+2009-05-05  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add some documentation to InlineBox::x(),y().
+        https://bugs.webkit.org/show_bug.cgi?id=25378
+
+        * rendering/InlineBox.h:
+
+2009-05-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Disable all the SVG features for WebKit/Qt if ENABLE_SVG=0 
+        https://bugs.webkit.org/show_bug.cgi?id=24693
+
+        * WebCore.pro:
+
+2009-05-05  Sankar Aditya Tanguturi  <sankaraditya@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Anonymous blocks should not be exposed in accessibility tree.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=23072
+
+        Tests: accessibility/ignore-anonymous-block.html
+               platform/win/accessibility/document-role.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):Return
+        true for Anonymous blocks. Matching Firefox 2.0.0.14
+
+2009-05-05  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=25487
+
+        For euc-kr and other 8bit Korean encodings
+        (similar to euc-kr/windows-949), make document.charset return
+        EUC-KR instead of windows-949. The latter is not recognized by
+        Korean web servers.
+
+        Add domName method to TextEncoding to deal with cases where
+        our internal encoding name does not match what's widely recognized
+        by web servers. Currently, the only case is 'windows-949' (internal
+        name) vs 'EUC-KR'.
+
+        Test: fast/encoding/euckr-name.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::encoding): Call TextEncoding.domName() instead
+        of TextEncoding.name().
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::domName): For the canonical name 'windows-949',
+        return 'EUC-KR'. Otherwise, just return the canonical name.
+        * platform/text/TextEncoding.h:
+
+2009-05-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Rendering fix for <select> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=25558
+
+        When switching a <select> element from display:none to default
+        display, we would fail to invalidate the parent's pref widths in some
+        situations:
+
+        When attaching the element, RenderMenuList::updateOptionsWidth would
+        call setNeedsLayoutAndPrefWidthsRecalc before the parent pointer was
+        set. This would mark the pref widths as dirty, but not for any parent
+        objects.
+
+        When RenderObjectChildList::appendChildNode later calls
+        setNeedsLayoutAndPrefWidthsRecalc again, with a valid parent pointer,
+        nothing would be done because the pref widths were already dirty for.
+        the RenderMenuList.
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+
+2009-05-05  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Switch V8EventListenerList to use HashTable<T>.
+        https://bugs.webkit.org/show_bug.cgi?id=25496
+        
+        This avoids some tricky issues with event listener removal in the 
+        current implementation and has slightly better performance.
+
+        No new functionality so no new tests.
+
+        * bindings/v8/V8EventListenerList.cpp: Added V8EventListenerListIterator.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::size):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+
+2009-05-05  Darin Fisher  <darin@chromium.org>
+
+        Fixing build bustage.
+
+        Add some missing includes to fix the Chromium build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-05-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25570
+
+        history.{back,forward,go} should always be dispatched asynchronously,
+        even when the history navigation would just result in scrolling the
+        page.  This matches the behavior of other browsers like IE and FF.
+
+        Test: fast/history/back-forward-is-asynchronous.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add an ASSERT(useTransforms) to mapLocalToContainer implementations in SVG.
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+        https://bugs.webkit.org/show_bug.cgi?id=25568
+
+        Adding this ASSERT exposed a bug in SVGPaintServerPattern::setup
+        which was causing transformed SVG text when filled/stroked with a
+        pattern using patternUnits=objectBoundingBox to draw incorrectly.
+
+        I fixed the incorrect drawing (by removing the broken code) and added
+        two test cases to test the fix:
+        * svg/transforms/text-with-pattern-inside-transformed-html.xhtml
+        * svg/transforms/text-with-pattern-with-svg-transform.svg
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-05-05  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25554
+        
+        Support HTML5 text control input types: email, number, tel, url
+
+        Test: fast/html/text-field-input-types.html
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isTextField]): Call HTMLInputElement::isTextField directly.
+        * html/HTMLInputElement.cpp: Use the new types where appropriate.
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::type):
+        (WebCore::HTMLInputElement::saveState):
+        (WebCore::HTMLInputElement::restoreState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLInputElement.h: Ditto.
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+
+2009-04-01  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Mouse wheel scrolling and keyboard shortcut support for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24797
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/wx/KeyboardEventWx.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollPosition):
+
+2009-05-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for Windows, add missing include.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24798
+
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+
+2009-05-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25574: AXImageMap children links don't respond properly to accessibilityHitTest:
+        https://bugs.webkit.org/show_bug.cgi?id=25574
+
+        Enable accessibility hit-testing for image map links. 
+        Allow image map links to return AXURLs and AXAccessKey information.
+
+        Test: platform/mac/accessibility/imagemap-hittest.html
+
+        * page/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::url):
+        * page/AccessibilityImageMapLink.h:
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::minValueForRange):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/AccessibilityRenderObject.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-05-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6552129> Select a quote line and paste elsewhere, you
+        get that line and an extra quoted blank line
+        <rdar://problem/6609308> Triple-click a quoted header line, copy, paste
+        onto an empty line makes an extra quoted line
+
+        - When pasting a blockquote with a newline, make sure we put the newline
+        outside of the blockquote so that it is not quoted.
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-05-05  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Call moz_gtk_shutdown on RenderThemeGtk destruction.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        <rdar://problem/6858340> REGRESSION: can't drag local HTML files into Safari because CFURLCreateWithFileSystemPath inserts "localhost"
+
+        * platform/win/ClipboardUtilitiesWin.cpp: (WebCore::urlFromPath): Remove localhost.
+
+2009-05-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Brady Eidson.
+
+        Safety-check m_documentLoader before dereferencing.  While it seems
+        unlikely this could fail (as Safari 3 shipped without this),
+        technically almost any call can change or reset m_documentLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+
+2009-05-05  Dan Bernstein  <mitz@apple.com>
+
+        - Tiger build fix
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::toCSSIdentifier):
+
+2009-05-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25303
+        No need to ref the internal buffer inside the Skia ImageDecoder.
+
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::bitmap):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+
+2009-05-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=24192
+          <rdar://problem/5760774> Replying to a Mail message that contains
+          fixed width text can change the size of the text
+
+        Covered by existing tests: editing/pasteboard/5027857.html
+                                   editing/pasteboard/paste-pre-002.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringKeyword):
+        Added. If the font-size is keyword-based, returns the keyword value
+        instead of the pixel size.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): If
+        font-family is a generic family, return the generic family instead of
+        the the internal string -webkit-[serif|sans-serif|cursive|fantasy
+        |monospace].
+        (WebCore::CSSComputedStyleDeclaration::copyInheritableProperties):
+        For the font-size property, prefer a keyword value over a pixel size.
+        * css/CSSComputedStyleDeclaration.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::currentlyHasStyle): For the font-size property,
+        call getFontSizeCSSValuePreferringKeyword().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::keywordSize): Changed the return type to
+        unsigned.
+        (WebCore::FontDescription::setKeywordSize): Changed the parameter type
+        to unsigned.
+        (WebCore::FontDescription::m_keywordSize): Changed the type of this
+        4-bit field to unsigned, because it takes values as high as 8.
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix http/tests/misc/DOMContentLoaded-event.html
+
+        The native call performance improvement removed a few places where we
+        unintentionally performed a toThisObject conversion.  This patch updates
+        the bindings codegen to not rely on this bug.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-05-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        Implement WebCore::directoryName for Gtk+.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::directoryName):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Fix mappedAttributes() access without NULL check
+        https://bugs.webkit.org/show_bug.cgi?id=25553
+
+        SVGStyledElement::getPresentationAttribute was using mappedAttributes()
+        without checking for NULL.
+
+        HTMLInputElement::setInputType also doesn't NULL check, but I was not
+        able to get it to crash with a test case so I just added an ASSERT.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-05-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        Implement WebCore::imageTitle for Gtk+.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::imageTitle):
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25559: Improve native function call performance
+        <https://bugs.webkit.org/show_bug.cgi?id=25559>
+
+        Add forwarding header necessary for compilation, and fix debugger
+        to correctly account for change in JSFunction behaviour.
+
+        * ForwardingHeaders/jit/JITCode.h: Added.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Make convertValueToQVariant more robust against null JSValues.
+
+        Don't require the caller to do the null check.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        No review, just a revert.
+
+        Roll out http://trac.webkit.org/changeset/43213 as it caused 4 tests to crash.
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+
+2009-05-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/6576889> REGRESSION (r35185): Cannot watch Flash movies on omg.yahoo.com
+
+        The problem was caused by missing <head> element - we used to create it when moving a
+        misplaced <style> element, but we now handle those in place. Other browsers always create
+        a <head> element.
+
+        There is no guarantee that a <head> element always exists - first, it can be removed with
+        removeChild or innerHTML, and also, we don't currently create it for frameset documents, or
+        for manually created ones (e.g. ImageDocument).
+
+        Test: fast/parser/head-element-for-yahoo-player.html
+
+        * dom/Document.cpp: (WebCore::Document::implicitClose): Create a <head> element for about:blank.
+        A removed comment talked about rdar://3758785, but that problem doesn't re-occur even if this
+        code is removed completely.
+
+        * html/HTMLHtmlElement.cpp: (WebCore::HTMLHtmlElement::checkDTD): No longer allow <script>
+        elements as children of <html>. This isn't directly related to this bug, but it was easier
+        to fix both at once (IE and Firefox both don't allow such mispositioned <script> elements).
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Move <script> to <head> if <body> hasn't been created yet.
+        Create a <head> it a <body> is created implicitly to contain some other element.
+        (WebCore::HTMLParser::bodyCreateErrorCheck): Ensure that a <head> exists when <body> is
+        explicitly present in source.
+        (WebCore::HTMLParser::createHead): Do the work even if <html> element hasn't been created yet.
+
+2009-05-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        As Qtish implementation of MIMETypeRegistry::getMIMETypeForExtension()
+        returns the application/octet-stream mimetype when it can't associate
+        extension with any mimetype, it can happen that the application/octet-stream
+        mimetype will hit the list of supported image formats. For instance,
+        it is possible when QImageReader or QImageWriter support an extension
+        that is not in the extensions map.
+
+        Make sure that this mimetype is not treated as displayable image type.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        ASSERT(useTransforms) in SVG mapLocalToContainer implementations
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove m_absoluteBounds hack from RenderSVGText
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        No functional changes (SVGs inside CSS transformed HTML should theoretically repaint better)
+
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGText.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove the vestigial calculateLocalTransform()
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        RenderSVGContainer is now the only render which needs this
+        function, but it no longer returns the unused bool.
+
+        calculateLocalTransform() previously was called by the DOM before
+        transform updates were part of layout().
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::localTransform):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::calculateLocalTransform):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Move more code into SVGRenderBase
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        clippedOverflowRectForRepaint, computeRectForRepaint and mapLocalToContainer
+        are now all shared via SVGRenderBase.
+
+        RenderForeignObject should also be sharing this code, but I've left it
+        alone for now, as changing that would likely cause test changes.
+
+        No test changes.  It's possible that transformed <svg:image> elements will
+        now show up with better metrics in the inspector.
+
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        (WebCore::RenderSVGImage::mapLocalToContainer):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        (WebCore::RenderSVGModelObject::mapLocalToContainer):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::clippedOverflowRectForRepaint):
+        (WebCore::SVGRenderBase::computeRectForRepaint):
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * rendering/SVGRenderSupport.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add SVGRenderBase to share logic between SVG renderers
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        I've added an SVGRenderBase base class which is shared by
+        all of the SVG renders now.  This patch is just moving code
+        there are no functional changes in this patch.
+
+        Currently I've left these functions in SVGRenderSupport.h
+        In a later patch I will rename SVGRenderSupport.* to SVGRenderBase.*
+
+        clampImageBufferSizeToViewport now takes a FrameView* which makes some code easier to read.
+
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        (WebCore::clampImageBufferSizeToViewport):
+        (WebCore::SVGRenderBase::computeContainerBoundingBox):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed SVG build fix.
+
+        Include MappedAttribute.h after r43187.
+
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFELightElement.cpp:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFESpecularLightingElement.cpp:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+
+2009-05-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam 'The Belly' Weinig
+
+        <rdar://problem/6828894> - Facebook photo uploader applet broken on Leopard only
+
+        In r41568 we started adding a default codebase attribute to <applet> tags if they didn't specify one
+        themselves.  Leopard's Java plug-in mishandles this case and fails to load code for the applet.
+
+        The spirit of r41568 can be maintained by removing the "default codebase" piece and only performing
+        the canLoad() check if a codebase was actually set on the applet tag.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer): Don't create a default codebase attribute.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget): Only perform the canLoad() check if the codebase was set.
+
+2009-05-04  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * html/HTMLCollection.h:
+        * html/HTMLFormElement.h:
+        Declare CollectionCache as a struct, not a class, to match its
+        definition.
+
+2009-05-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin, Oliver Hunt.
+
+        Bug 25557: REGRESSION: Canvas elements are ignored instead of being exposed as AXImage
+        https://bugs.webkit.org/show_bug.cgi?id=25557
+
+        Test: accessibility/canvas.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::roleValue):
+
+2009-05-04  Brady Eidson  <beidson@apple.com>
+
+        Fix an ancient Changelog entry where Sam Weinig flat out lied and confused my exploration of a bug.
+
+        * ChangeLog
+
+2009-05-04  Kai Brüning  <kai@granus.net>
+
+        Reviewed by Eric Seidel.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24883
+        24883: Bad success test in parseXMLDocumentFragment in XMLTokenizerLibxml2.cpp
+        
+        Fixed test whether all the chunk has been processed to correctly count utf8 bytes.
+
+        Test: fast/innerHTML/innerHTML-nbsp.xhtml
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::parseXMLDocumentFragment):
+
+2009-05-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24924: remove Document.h include of Attr.h and HTMLCollection.h,
+        and NamedMappedAttrMap.h include of MappedAttribute.h
+        https://bugs.webkit.org/show_bug.cgi?id=24924
+
+        Make compiles faster, and debugging info smaller.
+
+        * GNUmakefile.am: Added new source files.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS): Updated for new collection type names.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createAttribute): Added. No longer inline.
+        (WebCore::Document::images): Updated for new collection type names.
+        (WebCore::Document::applets): Ditto.
+        (WebCore::Document::embeds): Ditto.
+        (WebCore::Document::plugins): Ditto.
+        (WebCore::Document::objects): Ditto.
+        (WebCore::Document::scripts): Ditto.
+        (WebCore::Document::links): Ditto.
+        (WebCore::Document::forms): Ditto.
+        (WebCore::Document::anchors): Ditto.
+        (WebCore::Document::all): Ditto.
+        (WebCore::Document::windowNamedItems): Ditto.
+        (WebCore::Document::documentNamedItems): Ditto.
+        (WebCore::Document::nameCollectionInfo): Ditto.
+
+        * dom/Document.h: Changed around includes and forward declarations.
+        Updated for changes to collection types.
+
+        * dom/NamedMappedAttrMap.h: Removed include of MappedAttribute.h.
+
+        * html/CollectionCache.cpp: Copied from WebCore/html/HTMLCollection.cpp.
+        Contains the class that used to be HTMLCollection::CollectionInfo.
+        * html/CollectionCache.h: Copied from WebCore/html/HTMLCollection.h.
+        Ditto.
+
+        * html/CollectionType.h: Copied from WebCore/html/HTMLCollection.h.
+        Has the enum that used to be HTMLCollection::Type.
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::HTMLCollection): Update for collection type change.
+        (WebCore::HTMLCollection::create): Ditto.
+        (WebCore::HTMLCollection::resetCollectionInfo): Ditto.
+        (WebCore::HTMLCollection::itemAfter): Ditto.
+        * html/HTMLCollection.h: Ditto.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::children): Updated for new collection type names.
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo): Ditto.
+        (WebCore::HTMLFormCollection::HTMLFormCollection): Ditto.
+        * html/HTMLFormCollection.h: Ditto.
+        * html/HTMLFormElement.h: Ditto.
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::areas): Ditto.
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::HTMLNameCollection): Ditto.
+        * html/HTMLNameCollection.h:
+        (WebCore::HTMLNameCollection::create): Ditto.
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo): Ditto.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::tBodies):Ditto.
+        * html/HTMLTableRowElement.cpp:
+        (WebCore::HTMLTableRowElement::cells):Ditto.
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection): Ditto.
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::rows): Ditto.
+
+        * bindings/js/JSDOMWindowBase.cpp: Added newly-needed includes.
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp: Ditto.
+        * css/CSSStyleSelector.cpp: Ditto.
+        * dom/Element.cpp: Ditto.
+        * dom/InputElement.cpp: Ditto.
+        * dom/NamedAttrMap.cpp: Ditto.
+        * dom/NamedMappedAttrMap.cpp: Ditto.
+        * dom/Node.cpp: Ditto.
+        * dom/StyledElement.cpp: Ditto.
+        * dom/StyledElement.h: Ditto.
+        * editing/ApplyStyleCommand.cpp: Ditto.
+        * editing/DeleteSelectionCommand.cpp: Ditto.
+        * editing/Editor.cpp: Ditto.
+        * editing/EditorCommand.cpp: Ditto.
+        * editing/InsertParagraphSeparatorCommand.cpp: Ditto.
+        * editing/ReplaceSelectionCommand.cpp: Ditto.
+        * editing/markup.cpp: Ditto.
+        * html/CanvasRenderingContext2D.cpp: Ditto.
+        * html/HTMLAnchorElement.cpp: Ditto.
+        * html/HTMLAppletElement.cpp: Ditto.
+        * html/HTMLAreaElement.cpp: Ditto.
+        * html/HTMLBRElement.cpp: Ditto.
+        * html/HTMLBaseElement.cpp: Ditto.
+        * html/HTMLBodyElement.cpp: Ditto.
+        * html/HTMLButtonElement.cpp: Ditto.
+        * html/HTMLCanvasElement.cpp: Ditto.
+        * html/HTMLDivElement.cpp: Ditto.
+        * html/HTMLEmbedElement.cpp: Ditto.
+        * html/HTMLFontElement.cpp: Ditto.
+        * html/HTMLFormControlElement.cpp: Ditto.
+        * html/HTMLFormElement.cpp: Ditto.
+        * html/HTMLFrameElement.cpp: Ditto.
+        * html/HTMLFrameElementBase.cpp: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        * html/HTMLHRElement.cpp: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLImageElement.cpp: Ditto.
+        * html/HTMLInputElement.cpp: Ditto.
+        * html/HTMLIsIndexElement.cpp: Ditto.
+        * html/HTMLKeygenElement.cpp: Ditto.
+        * html/HTMLLIElement.cpp: Ditto.
+        * html/HTMLLinkElement.cpp: Ditto.
+        * html/HTMLMarqueeElement.cpp: Ditto.
+        * html/HTMLMetaElement.cpp: Ditto.
+        * html/HTMLOListElement.cpp: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLOptionElement.cpp: Ditto.
+        * html/HTMLParagraphElement.cpp: Ditto.
+        * html/HTMLParamElement.cpp: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPreElement.cpp: Ditto.
+        * html/HTMLScriptElement.cpp: Ditto.
+        * html/HTMLSelectElement.cpp: Ditto.
+        * html/HTMLStyleElement.cpp: Ditto.
+        * html/HTMLTableCaptionElement.cpp: Ditto.
+        * html/HTMLTableCellElement.cpp: Ditto.
+        * html/HTMLTableColElement.cpp: Ditto.
+        * html/HTMLTablePartElement.cpp: Ditto.
+        * html/HTMLTextAreaElement.cpp: Ditto.
+        * html/HTMLTokenizer.cpp: Ditto.
+        * html/HTMLUListElement.cpp: Ditto.
+        * html/HTMLVideoElement.cpp: Ditto.
+        * html/HTMLViewSourceDocument.cpp: Ditto.
+        * loader/ImageDocument.cpp: Ditto.
+        * page/Frame.cpp: Ditto.
+        * rendering/RenderTreeAsText.cpp: Ditto.
+        * svg/SVGAElement.cpp: Ditto.
+        * svg/SVGAnimateMotionElement.cpp: Ditto.
+        * svg/SVGAnimateTransformElement.cpp: Ditto.
+        * svg/SVGAnimationElement.cpp: Ditto.
+        * svg/SVGCircleElement.cpp: Ditto.
+        * svg/SVGClipPathElement.cpp: Ditto.
+        * svg/SVGCursorElement.cpp: Ditto.
+        * svg/SVGElement.cpp: Ditto.
+        * svg/SVGEllipseElement.cpp: Ditto.
+        * svg/SVGExternalResourcesRequired.cpp: Ditto.
+        * svg/SVGFitToViewBox.cpp: Ditto.
+        * svg/SVGFontFaceElement.cpp: Ditto.
+        * svg/SVGFontFaceUriElement.cpp: Ditto.
+        * svg/SVGForeignObjectElement.cpp: Ditto.
+        * svg/SVGGlyphElement.cpp: Ditto.
+        * svg/SVGGradientElement.cpp: Ditto.
+        * svg/SVGImageElement.cpp: Ditto.
+        * svg/SVGLangSpace.cpp: Ditto.
+        * svg/SVGLineElement.cpp: Ditto.
+        * svg/SVGLinearGradientElement.cpp: Ditto.
+        * svg/SVGMarkerElement.cpp: Ditto.
+        * svg/SVGMaskElement.cpp: Ditto.
+        * svg/SVGPathElement.cpp: Ditto.
+        * svg/SVGPatternElement.cpp: Ditto.
+        * svg/SVGPolyElement.cpp: Ditto.
+        * svg/SVGRadialGradientElement.cpp: Ditto.
+        * svg/SVGRectElement.cpp: Ditto.
+        * svg/SVGSVGElement.cpp: Ditto.
+        * svg/SVGScriptElement.cpp: Ditto.
+        * svg/SVGStopElement.cpp: Ditto.
+        * svg/SVGStyleElement.cpp: Ditto.
+        * svg/SVGStyledElement.cpp: Ditto.
+        * svg/SVGStyledTransformableElement.cpp: Ditto.
+        * svg/SVGTests.cpp: Ditto.
+        * svg/SVGTextContentElement.cpp: Ditto.
+        * svg/SVGTextElement.cpp: Ditto.
+        * svg/SVGTextPathElement.cpp: Ditto.
+        * svg/SVGTextPositioningElement.cpp: Ditto.
+        * svg/SVGURIReference.cpp: Ditto.
+        * svg/SVGUseElement.cpp: Ditto.
+        * svg/SVGViewElement.cpp: Ditto.
+        * svg/animation/SVGSMILElement.cpp: Ditto.
+        * xml/XPathStep.cpp: Ditto.
+
+2009-05-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Do not instantiate hidden WebInspector panels. Otherwise they are hitting unimplemented InspectorController methods.
+        https://bugs.webkit.org/show_bug.cgi?id=25520
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-05-04  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6839881> With "Mail Contents of This Page" in Safari images don't appear in the Tiger Mail compose window
+
+        DocumentLoader::subresource() is the implementation for the WebKit API [WebDataSource subresourceForURL:] and has 
+        particularly sticky behavior.  
+
+        If the DocumentLoader represents a WebArchive, this method should return ArchiveResources from that archive.  However, we 
+        prefer CachedResources over ArchiveResources because they might represent fresher data than what was originally loaded 
+        from the WebArchive.
+
+        In some instances, CachedResources are created and associated with the DocumentLoader but not immediately run through the 
+        loading delegate machinery.  This was always a possibility, but the Preload Scanner made this significantly more likely.
+
+        When this happens and someone asks the WebDataSource for a subresource, it would prefer the CachedResource over an 
+        ArchiveResource it has even if the CachedResource hasn't been loaded yet.  The CachedResource has nil data, so no
+        WebResource is returned, and the client thinks the subresource doesn't exist even though it does.
+
+        This broke Tiger Mail and probably various other WebKit applications but has a fairly straightforward fix.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): If there is a CachedResource but it hasn't been loaded yet, fallback to the
+          ArchiveResource.
+
+2009-05-04  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25545
+        Bug 25545: HTMLMediaElement: display anamorphic video correctly
+        
+        Tell QuickTime to use clean aperture mode so movies with non-square pixels are sized
+        and displayed correctly.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): Ask QuickTime to use clean aperture mode.
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::load): Ditto. Add ASSERT to ensure that static movie property array isn't 
+        filled beyond capacity.
+
+2009-05-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25332>.
+        Bug 25332: Plug-in inserted in to DOM of PluginDocument fails to load
+
+        Only the first plug-in in a PluginDocument can use the main resource data.  For all
+        subsequent plug-ins, such as the plug-in that ClickToFlash inserts when swapping itself
+        out for the real Flash plug-in, we need to load the resource data in the same manner
+        as for other embedded plug-ins.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-05-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Update the qrc file for the Web Inspector in the Qt build
+        with missing files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Move absoluteRects and absoluteQuads into RenderSVGInline and remove absoluteTransform() usage
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::absoluteRects):
+        (WebCore::RenderSVGInline::absoluteQuads):
+        * rendering/RenderSVGInline.h:
+        * rendering/RenderSVGTSpan.cpp:
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGTextPath.cpp:
+        * rendering/RenderSVGTextPath.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Move RenderSVGText off of localToAbsolute()
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove broken absoluteTransform() code from RenderSVGInlineText
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        This improved SVG text focus rings.
+        This also improved SVG.getScreenCTM() results.
+
+        SVGSVGElement::getScreenCTM was passing "true" for the second argument in
+        localToAbsolute, which is "fixed" it meant to pass "true" for the
+        third argument (useTransforms).  That change alone caused no layout test changes, however
+        before I fixed this, it was hitting ASSERT(!fixed) in RenderSVGRoot::mapLocalToContainer
+
+        mapLocalToContainer implementations really should be shared,
+        but I'll do that in a later patch.
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        (WebCore::RenderSVGInlineText::computeRepaintQuadForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::mapLocalToContainer):
+        * rendering/RenderSVGText.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getScreenCTM):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove dead code from RenderPath
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Share layout code between RenderSVGViewportContainer and RenderSVGContainer
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::calcViewport):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove redundant disableLayoutState() calls
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Simplify RenderForeignObject::paint and fix a repaint bug.
+        Paint now calls applyTransformToPaintInfo which correctly transforms the damage rect.
+        https://bugs.webkit.org/show_bug.cgi?id=16939
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint):
+
+2009-05-03  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Test: editing/spelling/spellcheck-attribute.html
+
+        Bug 14552: Add a way to disable spell checking for specific element
+        https://bugs.webkit.org/show_bug.cgi?id=14552
+
+        For compatibility with Firefox, this code ascends the DOM tree when an element does
+        not have its "spellcheck" attribute.
+
+        * editing/Editor.cpp:
+        (WebCore::markMisspellingsOrBadGrammar): Retrieve the value of the "spellcheck"
+        attribute of an element before calling a spell checker or a grammar checker.
+        * html/HTMLAttributeNames.in: Add a "spellcheck" attribute.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in one last time (I hope).
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back out. It still breaks windows.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in.
+
+2009-05-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - another fix for <rdar://problem/6617298> Typing delete on an unquoted
+          blank line unquotes the preceding, quoted blank line
+
+        Test: editing/deleting/type-delete-after-quote-2.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand): Initialize
+        m_startsAtEmptyLine.
+        (WebCore::DeleteSelectionCommand::handleSpecialCaseBRDelete): When the
+        selection starts at an empty line, do not prevent the merging of blocks.
+        This is what allows the text after the line break to be merged into the
+        block containing the line break. Also set m_startsAtEmptyLine to true.
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): If
+        m_startsAtEmptyLine is true, create a placeholder BR to serve as the
+        merge destination.
+        * editing/DeleteSelectionCommand.h:
+
+2009-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Simplified null-ish JSValues.
+        
+        Replaced calls to noValue() with calls to JSValue() (which is what
+        noValue() returned). Removed noValue().
+        
+        Removed "JSValue()" initialiazers, since default construction happens...
+        by default.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::hasNoValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::invokeConstruct):
+
+2009-05-02  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6631735> Crash in WebCore::CSSStyleSelector::applyProperty(int, WebCore::CSSValue*) (RenderStyle.h:454)
+        
+        Avoid re-entering style selector from load delegates by not issuing resource loads synchronously during attach().
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks):
+        (WebCore::ContainerNode::resumePostAttachCallbacks):
+        (WebCore::ContainerNode::attach):
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::suspendPendingRequests):
+        (WebCore::Loader::resumePendingRequests):
+        (WebCore::Loader::Host::servePendingRequests):
+        * loader/loader.h:
+        (WebCore::Loader::isSuspendingPendingRequests):
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25352: REGRESSION(r42322): style isn't applied at bmwusa.com
+        https://bugs.webkit.org/show_bug.cgi?id=25352
+        rdar://problem/6823239
+
+        Test: http/tests/mime/standard-mode-loads-stylesheet-with-text-css-and-invalid-type.html
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::extractMIMETypeFromMediaType): Allow comma as a separator.
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Bug 25491: WebFrame leak when a subframe removes itself
+        https://bugs.webkit.org/show_bug.cgi?id=25491
+        rdar://problem/6833859
+
+        Test: fast/loading/subframe-removes-itself.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): When isStopping is true,
+        treat load as complete, even if isLoadingInAPISense is still returning true.
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Roll out JavaScriptCore API number marshaling.
+
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual):
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::getHeadCallback):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * workers/WorkerContext.idl:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Cleanup workers code a bit.
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::customGetOwnPropertySlot):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::toWorkerContext):
+        (WebCore::WorkerContext::self):
+        (WebCore::WorkerContext::setOnmessage):
+        (WebCore::WorkerContext::onmessage):
+        * workers/WorkerContext.idl:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        A little clean up.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual):
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::getHeadCallback):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+
+2009-05-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Oliver Hunt and Sam "Jon 'The Belly' Honeycutt" Weinig
+
+        Fix <rdar://problem/6848867> Addition of DOCTYPE node breaks Tiger Mail
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument firstChild]): Add a Tiger Mail version of this method that skips DOCTYPE nodes.
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue):
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::customPut):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profiles):
+        * bindings/js/JSCoordinatesCustom.cpp:
+        (WebCore::JSCoordinates::altitude):
+        (WebCore::JSCoordinates::altitudeAccuracy):
+        (WebCore::JSCoordinates::heading):
+        (WebCore::JSCoordinates::speed):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        (WebCore::toVoidCallback):
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringOrNull):
+        (WebCore::jsOwnedStringOrNull):
+        (WebCore::jsStringOrUndefined):
+        (WebCore::jsStringOrFalse):
+        (WebCore::valueToStringWithNullCheck):
+        (WebCore::valueToStringWithUndefinedOrNullCheck):
+        (WebCore::reportException):
+        (WebCore::reportCurrentException):
+        (WebCore::setDOMException):
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::getDOMNodeWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::getByIndex):
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::childFrameGetter):
+        (WebCore::JSDOMWindowBase::indexGetter):
+        (WebCore::JSDOMWindowBase::namedItemGetter):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        (WebCore::JSDOMWindowBase::put):
+        (WebCore::JSDOMWindowBase::setReturnValueSlot):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::lookupGetter):
+        (WebCore::JSDOMWindow::lookupSetter):
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::crypto):
+        (WebCore::JSDOMWindow::event):
+        (WebCore::JSDOMWindow::image):
+        (WebCore::JSDOMWindow::option):
+        (WebCore::JSDOMWindow::audio):
+        (WebCore::JSDOMWindow::webKitPoint):
+        (WebCore::JSDOMWindow::webKitCSSMatrix):
+        (WebCore::JSDOMWindow::xmlHttpRequest):
+        (WebCore::JSDOMWindow::xsltProcessor):
+        (WebCore::JSDOMWindow::messageChannel):
+        (WebCore::JSDOMWindow::worker):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        (WebCore::toDOMWindow):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::JSDOMWindow::customPut):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::put):
+        (WebCore::JSDOMWindowShell::putWithAttributes):
+        (WebCore::JSDOMWindowShell::lookupGetter):
+        (WebCore::JSDOMWindowShell::lookupSetter):
+        (WebCore::toJS):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::JSDocument::setLocation):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNode):
+        (WebCore::JSElement::setAttributeNS):
+        (WebCore::JSElement::setAttributeNodeNS):
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData):
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::customPut):
+        (WebCore::JSHTMLAppletElement::nameGetter):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        (WebCore::JSHTMLDocument::all):
+        (WebCore::JSHTMLDocument::setAll):
+        (WebCore::JSHTMLDocument::open):
+        (WebCore::JSHTMLDocument::write):
+        (WebCore::JSHTMLDocument::writeln):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::customPut):
+        (WebCore::JSHTMLEmbedElement::nameGetter):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        (WebCore::JSHTMLFormElement::submit):
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        (WebCore::JSHTMLFrameElement::setLocation):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::setSelectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::customPut):
+        (WebCore::JSHTMLObjectElement::nameGetter):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::setLength):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::add):
+        (WebCore::JSHTMLOptionsCollection::remove):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        (WebCore::selectIndexSetter):
+        (WebCore::JSHTMLSelectElement::indexSetter):
+        * bindings/js/JSHTMLSelectElementCustom.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        (WebCore::JSHistory::customPut):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        (WebCore::JSInspectedObjectWrapper::wrapOutgoingValue):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        (WebCore::JSInspectorCallbackWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        (WebCore::JSInspectorCallbackWrapper::wrapOutgoingValue):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::highlightDOMNode):
+        (WebCore::JSInspectorController::addResourceSourceToFrame):
+        (WebCore::JSInspectorController::addSourceToFrame):
+        (WebCore::JSInspectorController::getResourceDocumentNode):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::inspectedWindow):
+        (WebCore::JSInspectorController::setting):
+        (WebCore::JSInspectorController::setSetting):
+        (WebCore::JSInspectorController::wrapCallback):
+        (WebCore::JSInspectorController::currentCallFrame):
+        (WebCore::JSInspectorController::profiles):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        (WebCore::JSJavaScriptCallFrame::thisObject):
+        (WebCore::JSJavaScriptCallFrame::type):
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::customPut):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::reload):
+        (WebCore::JSLocation::assign):
+        (WebCore::JSLocation::toString):
+        (WebCore::JSLocationPrototype::customPut):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::lengthGetter):
+        (WebCore::JSNamedNodesCollection::indexGetter):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createStructure):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::needsYouTubeQuirk):
+        (WebCore::JSNavigator::appVersion):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::createWrapper):
+        (WebCore::toJSNewlyCreated):
+        (WebCore::toJS):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::JSNodeFilterCondition):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        (WebCore::JSNodeFilterCondition::create):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        (WebCore::toNodeFilter):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::nextNode):
+        (WebCore::JSNodeIterator::previousNode):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectGetter):
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomPut):
+        (WebCore::callPlugin):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::asWrapper):
+        (WebCore::JSQuarantinedObjectWrapper::cachedValueGetter):
+        (WebCore::JSQuarantinedObjectWrapper::transferExceptionToExecState):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot):
+        (WebCore::JSQuarantinedObjectWrapper::put):
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::getJSRGBColor):
+        (jsRGBColorRed):
+        (jsRGBColorGreen):
+        (jsRGBColorBlue):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createStructure):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        (WebCore::toJS):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::clear):
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPointList::clear):
+        (WebCore::JSSVGPointList::initialize):
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        (WebCore::JSSVGPointList::appendItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGTransformList::clear):
+        (WebCore::JSSVGTransformList::initialize):
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        (WebCore::JSSVGTransformList::appendItem):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter):
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::customPut):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::parentNode):
+        (WebCore::JSTreeWalker::firstChild):
+        (WebCore::JSTreeWalker::lastChild):
+        (WebCore::JSTreeWalker::nextSibling):
+        (WebCore::JSTreeWalker::previousSibling):
+        (WebCore::JSTreeWalker::previousNode):
+        (WebCore::JSTreeWalker::nextNode):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::self):
+        (WebCore::JSWorkerContext::setSelf):
+        (WebCore::JSWorkerContext::xmlHttpRequest):
+        (WebCore::JSWorkerContext::importScripts):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        (WebCore::JSXMLHttpRequest::responseText):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptCallStack.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::jsValue):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_HasMethod):
+        (_NPN_Construct):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::defaultValue):
+        (JSC::Bindings::CInstance::stringValue):
+        (JSC::Bindings::CInstance::numberValue):
+        (JSC::Bindings::CInstance::booleanValue):
+        (JSC::Bindings::CInstance::valueOf):
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_runtime.h:
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/c/c_utility.h:
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        (JavaInstance::numberValue):
+        (JavaInstance::booleanValue):
+        (JavaInstance::invokeMethod):
+        (JavaInstance::defaultValue):
+        (JavaInstance::valueOf):
+        * bridge/jni/jni_instance.h:
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jni_utility.h:
+        * bridge/objc/WebScriptObject.h:
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::fallbackObject):
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        (ObjcInstance::defaultValue):
+        (ObjcInstance::stringValue):
+        (ObjcInstance::numberValue):
+        (ObjcInstance::booleanValue):
+        (ObjcInstance::valueOf):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::convertValueToObjcObject):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        (JSC::Bindings::ObjcArray::setValueAt):
+        (JSC::Bindings::ObjcArray::valueAt):
+        (JSC::Bindings::ObjcFallbackObjectImp::put):
+        (JSC::Bindings::callObjCFallbackObject):
+        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/runtime.h:
+        (JSC::Bindings::Class::fallbackObject):
+        (JSC::Bindings::Instance::setValueOfUndefinedField):
+        (JSC::Bindings::Instance::invokeDefaultMethod):
+        (JSC::Bindings::Instance::invokeConstruct):
+        (JSC::Bindings::Instance::put):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        (JSC::RuntimeArray::indexGetter):
+        (JSC::RuntimeArray::put):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::callRuntimeObject):
+        (JSC::callRuntimeConstructor):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfileNode.h:
+
+2009-05-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25485
+        Only use visitedURL in Qt. This is a follow-up change to http://trac.webkit.org/changeset/43052,
+        which broke Chromium build.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState): Moved guards around to
+            provide separate code paths for Qt and non-Qt ports. Also restored original
+            order of execution.
+
+2009-05-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6839222>
+        CrashTracer: Lots of crashes in Safari in hash table remove function inside DocumentLoader::removeSubresourceLoader
+        
+        After calling m_client->didFail(), check if the subresource loader has reached its terminal state. If that's the case,
+        return early to avoid calling removeSubresourceLoader on a null document loader. I don't think this is allowed to happen
+        which is why I've added the ASSERT.
+        
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didCancel):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Disallow the deletion UI for elements that have any overflow clipping.
+        Also disallow the UI for the body element it isn't practical to delete,
+        and the deletion UI would be clipped.
+
+        <rdar://problem/6840161> Deletion UI can be clipped by some
+        elements (with overflow: hidden)
+
+        Reviewed by Darin Adler.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Decrease the minimum height for deleteable elements to 16px, and increase the
+        minimum width to 48px. This allows deleting shorter items like navigation bars.
+
+        <rdar://problem/6840735> Deletion UI does not show up for short
+        elements (22px or less)
+
+        Reviewed by Adele Peterson.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Clean up the comments and logic in the code for picking a
+        deleteable element for the deletion UI.
+
+        Reviewed by Adele Peterson.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adele Peterson and Darin Adler.
+
+        <rdar://problem/4815598> Stuck in double spacing mode after pasting a
+        paragraph with padding/margin (or table mode !)
+
+        A lot of the issues in this bug were resolved on Mail's side by using
+        WebKit to convert to plain text.  This is the final issue, that floating
+        style stays on copied nodes causing them to float when they are pasted
+        which is not what the user intended.
+
+        * editing/markup.cpp:
+        (WebCore::removeExteriorStyles):
+        (WebCore::):
+        (WebCore::appendStartMarkup):
+        (WebCore::getStartMarkup):
+        (WebCore::createMarkup):
+
+2009-05-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a FrameLoaderClient callback for the ResourceRetrievedByXMLHttpRequest.
+        This is the only resource-related information that is available in InspectorController
+        and is missing in the FrameLoaderClient.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25347
+
+        * WebCore.xcodeproj/project.pbxproj: Made ScriptSource private.
+        * dom/Document.cpp: Made a call to a client along with the call to the InspectorController.
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/EmptyClients.h: Added stub implementation.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidLoadResourceByXMLHttpRequest):
+        * loader/FrameLoader.cpp: Call initiating dispatches.
+        (WebCore::FrameLoader::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+
+2009-04-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6841106> REGRESSION: Crash drag selecting 
+        To Do's in a Mail note (excessive recursion in mouse drag tracking)
+
+        Oliver's recent change to dragging seems to have revealed a long-
+        time bug in passSubframeEventToSubframe where we did not set 
+        m_sendingEventToSubview to true before calling 
+        handleMouseMoveEvent() in the NSMouseMoved case. This patch fixes 
+        that and adds ASSERTions around all of the places where 
+        m_sendingEventToSubview is set to true and then false to make sure 
+        we are not trampling its state.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventLoopHandleMouseUp):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+
+2009-04-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        MediaDocument falls back to plug-in unnecessarily
+        https://bugs.webkit.org/show_bug.cgi?id=25504
+        <rdar://problem/6844702>
+        
+        Don't allow harmless media types to cause a MediaDocument to fall
+        back to PluginDocument.
+
+        Test: media/video-document-types.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks): add timecode, timecode 64,
+        odsm, and sdsm to allowed track types.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks): Ditto.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add CHROMIUM guard to unfork Document.cpp
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Added guard.
+
+2009-04-30  David Kilzer  <ddkilzer@apple.com>
+
+        Use OwnPtr<HTMLParserQuirks> for m_parserQuirks
+
+        Reviewed by Geoff Garen.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::~HTMLParser): Removed unneeded code.
+        * html/HTMLParser.h: Made m_parserQuirks an OwnPtr.
+
+2009-04-30  David Kilzer  <ddkilzer@apple.com>
+
+        Provide a mechanism to create a quirks delegate for HTMLParser
+
+        Reviewed by David Hyatt.
+
+        No tests since there is no change in behavior.
+
+        HTMLParserQuirks.h defines an abstract base class that may be
+        extended as needed.  The ChromeClient::createHTMLParserQuirks()
+        factory method should be used to return an HTMLParserQuirks
+        subclassed object when needed.
+
+        * WebCore.xcodeproj/project.pbxproj: Added HTMLParserQuirks.h.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser): Initialize m_parserQuirks
+        using ChromeClient::createHTMLParserQuirks().
+        (WebCore::HTMLParser::~HTMLParser): Delete m_parserQuirks if
+        set.
+        (WebCore::HTMLParser::reset): Call HTMLParserQuirks::reset() if
+        m_parserQuirks is set.
+        (WebCore::HTMLParser::insertNode): Call
+        HTMLParserQuirks::shouldInsertNode() if m_parserQuirks is set,
+        and return early if it returns false.
+        (WebCore::HTMLParser::popBlock): Call
+        HTMLParserQuirks::shouldPopBlock() if m_parserQuirks is set, and
+        return early if it returns false.
+        * html/HTMLParser.h: Added m_parserQuirks.
+        * html/HTMLParserQuirks.h: Added.
+        (WebCore::HTMLParserQuirks::HTMLParserQuirks):
+        (WebCore::HTMLParserQuirks::~HTMLParserQuirks):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::createHTMLParserQuirks): Added.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::createHTMLParserQuirks): Added.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25492
+        Add JSC guards around node wrapper cache calls. These are not used by V8.
+
+        Also, remove JSDOMBinding include, which is brought in by ScriptController.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document): Added JSC guard.
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): Ditto and removed JSDOMBinding include.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25493
+        Remove debugger/profiler custom method stubs, catching V8 bindings up to
+        http://trac.webkit.org/changeset/43072.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed method stubs.
+
+2009-04-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6839338> VoiceOver does not take into account transforms when drawing outlines
+        
+        Use transform-aware quad methods when computing the boundingBoxRect for
+        an AccessibilityRenderObject. The code follows RenderObject::absoluteBoundingBoxRect().
+
+        Test: accessibility/transformed-element.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, Chromium build fix.
+
+        Catch up to ScriptObject changes from http://trac.webkit.org/changeset/42512.
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get): Renamed from getObject.
+        (WebCore::ScriptGlobalObject::remove): Added.
+        * bindings/v8/ScriptObject.h: Ditto.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * WebCore.pro: Fix copy-paste error.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * GNUmakefile.am: Add ENABLE_JAVASCRIPT_DEBUGGER definitions.
+        * WebCore.pro: Ditto.
+
+2009-04-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change Position to pre-compute the AnchorType and store it.
+        Also store a "legacy editing mode" bit on the Position.
+        https://bugs.webkit.org/show_bug.cgi?id=24763
+
+        The old Postion(node, offset) constructor creates legacy positions
+        but there are new constructors to create explicitly anchored positions
+        which the next patch will use.
+
+        Once we fix all the "position-fixup" functions (like rangeCompliantEquivalent) to
+        only affect legacy positions, we will be able to distinguish
+        between [table, 1] and [table, after] in the code correctly!
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Position.cpp:
+        (WebCore::Position::Position):
+        (WebCore::Position::moveToPosition):
+        (WebCore::Position::moveToOffset):
+        (WebCore::Position::anchorTypeForLegacyEditingPosition):
+        (WebCore::Position::element):
+        * dom/Position.h:
+        (WebCore::Position::):
+        (WebCore::Position::Position):
+        (WebCore::Position::anchorType):
+        (WebCore::Position::deprecatedEditingOffset):
+
+2009-04-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix bug where the WorkerLocation and WorkerNavigator wrappers would be
+        collected even if the WorkerContext is still alive.
+
+        Test: fast/workers/worker-context-gc.html
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::completeURL):
+        (WebCore::WorkerContext::location):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::optionalNavigator):
+        (WebCore::WorkerContext::optionalLocation):
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_JAVASCRIPT_DEBUGGER.
+        * WebCore.vcproj/build-generated-files.sh: Ditto.
+        * bindings/js/JSConsoleCustom.cpp: Added ENABLE(JAVASCRIPT_DEBUGGER) guard.
+        * bindings/js/JSDOMWindowBase.cpp: Ditto.
+        * bindings/js/JSInspectorControllerCustom.cpp: Ditto.
+        * inspector/InspectorController.cpp: Moved profiler/debugger methods under
+            ENABLE(JAVASCRIPT_DEBUGGER) flag.
+        * inspector/InspectorController.h: Ditto.
+        * inspector/InspectorController.idl: Added ENABLE(JAVASCRIPT_DEBUGGER) guard.
+        * page/Console.cpp: Replaced USE(JSC) with ENABLE(JAVASCRIPT_DEBUGGER) guard.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25275
+        This patch snuck in a re-definition of a local.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Removed re-definition.
+
+2009-04-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix a leak introduced yesterday.  Don't allocate a ScheduledAction
+        if the toString()ing throws an exception.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+
+2009-04-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25379
+        <rdar://problem/6809460> REGRESSION (r41772): Selecting a bank in American Express Pay Bill fails
+
+        Test: fast/forms/multiple-selected-options-innerHTML.html
+
+        This problem was caused by an inconsistency at when Node::instertedIntoTree() is called.
+        For normal HTML parsing, it is called immediately after an element is inserted, but for
+        innerHTML, it is only called after the whole subtree is inserted into a document.
+
+        It may make sense to harmonize these cases one day, but for now, I only made the minimal
+        changes necessary to fix the bug.
+
+        * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        Recalculate list items when a SELECT element is inserted. OPTION elements cannot decide
+        which one to keep selected themselves, because their logic assumes normal parsing, with
+        insertedIntoTree() called after each element is inserted.
+
+2009-04-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25342
+        Add MessageSource and MessageLevel parameters to the ChromeClient::addMessageToConsole.
+
+        Chromium async/out-of-process version of WebInspector is currently not based on
+        InspectorController. The reason was that we did not want to interfere with
+        the unforking effort, yet wanted to experiment. So we came up with these
+        agents concept that basically mimic InspectorController, but separating 'agent'
+        nature from the 'transport'. Now that InspectorController is unforked, I am
+        planning to bring these concepts into the WebKit land and use what we have in
+        Chromium as a proof of concept / experimental playground.
+
+        * loader/EmptyClients.h: added MessageSource and MessageLevel parameters.
+        (WebCore::EmptyChromeClient::addMessageToConsole): ditto
+        * page/ChromeClient.h: ditto
+        * page/Console.cpp: Used new method signature.
+        (WebCore::Console::addMessage): ditto
+
+2009-04-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25476
+          <rdar://problem/6841919> REGRESSION (r42987): Welcome to Safari 4
+          animation is jittery
+
+        Reverted r42987.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/3785248> http://www.greekembassy.org/ gets in an infinite reload loop
+        https://bugs.webkit.org/show_bug.cgi?id=21193
+
+        Some websites use for attributes in script elements to specify events that the script 
+        should be run for.  One example is greekembassy.org which has the following in their <head>:
+
+        <script for=window event=onresize>
+            location.reload(false);
+        </script>
+
+        Since we don't support the full for attribute syntax, we would just blissfully ignore the
+        condition and execute the code unconditionally.  This caused breakage on multiple real-world 
+        sites besides greekembassy.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16915 and <rdar://problem/4471751> track adding full 
+        support for the for attribute in scripts.  In the meantime it's best to not execute them
+        unconditionally.
+
+        Test: fast/dom/HTMLScriptElement/script-for-attribute-unexpected-execution.html
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript): After all other checks have
+          passed, only return true if there is no for attribute in the script element.
+        * dom/ScriptElement.h:
+
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue): Return the attribute value, if any.
+        * html/HTMLScriptElement.h:
+
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::forAttributeValue): Return an empty string (like the other
+          attribute getters do for SVGScriptElement)
+        * svg/SVGScriptElement.h:
+
+2009-04-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        The Qt API exposes a global history patch CSSStyleSelector to make API consumers work again
+
+        https://bugs.webkit.org/show_bug.cgi?id=20952
+
+        The QtWebKit port made the mistake of exposing a global history. This broke
+        with the addition of PageGroup and LinkHash. This needs to be repaired
+        for Qt4.5.
+
+        Add a function to LinkHash.cpp that is resolving a URL. Use this
+        function from within CSSStyleSelector to forward the url to the
+        QWebHistoryInterface API.
+
+        It is sad that there is a path within visitedLinkHash which is now
+        doing a memcpy, it is sad to add a PLATFORM(QT) define to CSSStyleSelector
+        and using QtWebKit types within WebCore is a layering violation as well.
+
+        PageGroup::setShouldTrackVisitedLinks is currently not enabled. For
+        Qt4.6 a second version of the QWebHistoryInterface is going to be
+        added which will fix things up.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
+        * platform/LinkHash.cpp:
+        (WebCore::visitedURL):
+        (WebCore::visitedLinkHash):
+        * platform/LinkHash.h:
+
+2009-04-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * platform/graphics/SimpleFontData.cpp: Don't use initCharWidths() for the Qt build.
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit): Instead initialize the average and
+        max char widths from QFontMetrics.
+
+2009-04-30  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreview build fix after r43037.
+
+        Use MarkedArgumentBuffer instead of ArgList.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtConnectionObject::execute):
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25440
+        setTimeout should stringify non-string/non-function first arguments
+
+        Test: fast/dom/Window/setTimeout-string-argument.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        * bindings/js/ScheduledAction.h:
+
+2009-04-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - WebCore part of <rdar://problem/6609509> Select All and then Delete
+          should put Mail editing back into the same state as a new message
+
+        Test: editing/deleting/in-visibly-empty-root.html
+
+        * WebCore.base.exp: Exported VisibleSelection::isAll(bool).
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isAll): Added. Calls through to
+        VisibleSelection.
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::makeEditableRootEmpty): Added. Removes all children
+        of the root editable element the selection is in, other than a
+        placeholder. Returns true iff it did anything.
+        (WebCore::TypingCommand::deleteKeyPressed): When there is only a single
+        visible position in the root editable element, but it has children other
+        than a placeholder, remove those children.
+        * editing/TypingCommand.h:
+        * editing/VisiblePosition.h:
+        Added a StayInEditableContent enum and a FIXME.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll): Added. Returns whether the
+        selection encompasses all visible positions, either in the document or
+        in the editable root.
+        * editing/VisibleSelection.h:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Fix style nit.
+
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder):
+
+2009-04-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        For now just drop the deferred layout on the floor, since it causes an infinite hang in mail.  Even
+        trying to schedule a relayout for later leaves you in a state where you hit the needsLayout painting
+        assertions.
+
+        Basically what Mail is doing is crazy, and we can't support it other than to just drop the last layout
+        and not do it (which is basically what was happening before).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::needsLayout):
+
+2009-04-29  Douglas Davidson  <ddavidso@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        <rdar://problem/6836921> Mail exhibits issues with text checking, e.g. menu items not always validated correctly
+        
+        Updates to the text checking code to enable text checking even if spellchecking is turned off 
+        and fix an off-by-one error in selection handling.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up ArgList to be a trivial type
+
+        Start using MarkedArgumentBuffer to create argument lists for function calls
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profiles):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::profiles):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::setting):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/objc/WebScriptObject.mm:
+        (getListFromNSArray):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        * bridge/NP_jsobject.cpp:
+        (getListFromVariantArgs):
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::getListFromJArray):
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix m_offset uses added while I wasn't looking.
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+
+2009-04-29  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24168
+        RTL: Home/End key does not behave correctly in mixed bidi text in RTL document
+
+        Test: editing/selection/home-end.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary
+        (WebCore::SelectionController::modifyExtendingBackward): Change calling 
+        startOfLine() to logicalStartOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingBackward): Change calling startOfLine() 
+        to logicalStartOfLine() when granularity is LineBoundary.
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder): Added. Reconstruct leaf boxes in logical order.
+        (WebCore::getLogicalStartBoxAndNode): Added.
+        (WebCore::getLogicalEndBoxAndNode): Added.
+        (WebCore::logicalStartPositionForLine): Added. Similar to startPositionForLine.
+        (WebCore::logicalStartOfLine): Added. Similar to startOfLine.
+        (WebCore::logicalEndPositionForLine): Added. Similar to endPositionForLine.
+        (WebCore::inSameLogicalLine): Added.
+        (WebCore::logicalEndOfLine): Added. Similar to endOfLine.
+        * editing/visible_units.h:
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Make m_offset private and change all callers to use deprecatedEditingOffset().
+        https://bugs.webkit.org/show_bug.cgi?id=25472
+
+        Per Darin's suggestion, this was just a simple search replace
+        of .m_offset with .deprecatedEditingOffset().
+
+        There was one change in InsertParagraphSeparatorCommand::doApply to use
+        Position::moveToOffset(0) instead of .m_offset = 0;
+
+        * dom/Position.cpp:
+        (WebCore::Position::rendersInDifferentPosition):
+        (WebCore::Position::leadingWhitespacePosition):
+        * dom/Position.h:
+        (WebCore::Position::deprecatedEditingOffset):
+        (WebCore::Position::moveToOffset):
+        (WebCore::operator==):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::compareBoundaryPoints):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        (WebCore::ApplyStyleCommand::splitTextAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::mergeStartWithPreviousIfIdentical):
+        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
+        (WebCore::ApplyStyleCommand::joinChildTextNodes):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit):
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::updatePositionForNodeRemoval):
+        (WebCore::updatePositionForTextRemoval):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::fixupWhitespace):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setComposition):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::getCompositionSelection):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::debugRenderer):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+        (WebCore::VisiblePosition::debugPosition):
+        (WebCore::makeRange):
+        (WebCore::setStart):
+        (WebCore::setEnd):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        (WebCore::makeSearchRange):
+        (WebCore::VisibleSelection::debugPosition):
+        (WebCore::VisibleSelection::showTreeForThis):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        (WebCore::rangeCompliantEquivalent):
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::nextBoundary):
+        (WebCore::startPositionForLine):
+        (WebCore::startOfLine):
+        (WebCore::endPositionForLine):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+        * page/AccessibilityObject.cpp:
+        (WebCore::updateAXLineStartForVisiblePosition):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentOffset):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::indexForVisiblePosition):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeSelection):
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out a patch.
+
+        Revert http://trac.webkit.org/changeset/43019
+
+        New tests failed because I removed the tabs from them
+        when landing (since we avoid tabs in WebKit files).
+        I couldn't tell if the new results were correct with
+        spaces or not.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/visible_units.cpp:
+        * editing/visible_units.h:
+
+2009-04-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6828164>, Mail hits the !root->needsLayout() assert because it re-marks the FrameView for layout
+        when the FrameView is resized.  This bug was exposed by the elimination of the separate WebKit layout
+        flag on Mac.  
+        
+        FrameView now defers setNeedsLayouts during size changes.  Once all of the size changes are finished (including re-entrant ones
+        from WebDynamicScrollbarsView and ScrollView::updateScrollbars) we then do a layout if necessary.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::setNeedsLayout):
+        * page/FrameView.h:
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out a patch.
+
+        Revert 43020 as it caused accessibility/lists.html to fail
+        and no one is around to tell me if it's a progression or not.
+
+        * page/AccessibilityObject.h:
+        (WebCore::):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+
+2009-04-29  Sankar Aditya Tanguturi  <sankaraditya@gmail.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Add a new accessibility role for list items. Part of
+        http://bugs.webkit.org/show_id.cgi?id=20013
+
+        Tests: platform/win/accessibility/listitem-role.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::):  Add ListItemRole to accessibilityRole enum.
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):Return
+        listItemRole when rendered object is a list item.
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute): Return
+        true for ListItemRole, matching firefox.
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::): Map ListItemRole with NSAccessibilityGroupRole in
+        MAC.
+
+2009-04-29  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24168
+        RTL: Home/End key does not behave correctly in mixed bidi text in RTL document
+
+        Test: editing/selection/home-end.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary
+        (WebCore::SelectionController::modifyExtendingBackward): Change calling 
+        startOfLine() to logicalStartOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingBackward): Change calling startOfLine() 
+        to logicalStartOfLine() when granularity is LineBoundary.
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder): Added. Reconstruct leaf boxes in logical order.
+        (WebCore::getLogicalStartBoxAndNode): Added.
+        (WebCore::getLogicalEndBoxAndNode): Added.
+        (WebCore::logicalStartPositionForLine): Added. Similar to startPositionForLine.
+        (WebCore::logicalStartOfLine): Added. Similar to startOfLine.
+        (WebCore::logicalEndPositionForLine): Added. Similar to endPositionForLine.
+        (WebCore::inSameLogicalLine): Added.
+        (WebCore::logicalEndOfLine): Added. Similar to endOfLine.
+        * editing/visible_units.h:
+
+2009-04-29  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Update location while page is loading.
+        https://bugs.webkit.org/show_bug.cgi?id=21597
+
+        Tested by:
+        - fast/dom/location-new-window-no-crash
+        - fast/dom/Window/window-open-pending-url
+
+        * page/Location.cpp:
+
+2009-04-29  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android port files to WebCore/platform.
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android: Added.
+        * platform/android/ClipboardAndroid.cpp: Added.
+        * platform/android/ClipboardAndroid.h: Added.
+
+2009-04-29  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android-specific files to the WebCore/page directory.
+        https://bugs.webkit.org/show_bug.cgi?id=23295
+
+        * page/android: Added.
+        * page/android/DragControllerAndroid.cpp: Added.
+        * page/android/EventHandlerAndroid.cpp: Added.
+        * page/android/InspectorControllerAndroid.cpp: Added.
+
+2009-04-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Extract PageGroupLoadDeferrer from Chrome.cpp
+
+        * GNUmakefile.am: added PageGroupLoadDeferrer
+        * WebCore.pro: ditto
+        * WebCore.scons: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * page/Chrome.cpp: PageGroupLoadDeferrer impl moved to a separate class.
+        * page/PageGroupLoadDeferrer.cpp: Added.
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        * page/PageGroupLoadDeferrer.h: Added.
+
+2009-04-24  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make textarea and text input metrics more closely match IEs.
+
+        This involves:
+        -set text input width to size*avgCharWidth + maxCharWidth - avgCharWidth
+        -set textarea width to cols*avgCharWidth
+        -Make default CSS match IEs
+        -Correctly initializing m_avgCharWidth and m_maxCharWidth for each platform and SVG.
+
+        Those values for textarea and inputs were derived by doing a ton of manual
+        testing of IE's width values for various textareas and fonts. On Windows we match
+        IE exactly except for a couple fonts of the ~12 tested.
+
+        To get the average and max character width of a font, we do the following
+        for each platform:
+        -Win: TextMetrics expose avgCharWidth and maxCharWidth
+        -SVG: avgCharWidth = width of an '0', fallback on width of a space glyph, then m_xHeight
+            maxCharWidth = width of a 'W' for roman fonts, fallback on m_ascent
+        -Linux: avgCharWidth = width of an '0', fallback on m_xHeight
+            maxCharWidth = max of avgCharWidth and m_ascent
+        -Mac: Calculate the avgCharWidth and grab the maxCharWidth off the font.
+            If either one is non-positive, then calculate the value using the Linux approach.
+
+        Tests: fast/forms/text-control-intrinsic-widths.html
+               fast/forms/textarea-metrics.html
+               svg/custom/svg-fonts-in-text-controls.html
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::maxCharWidth):
+        (WebCore::SimpleFontData::avgCharWidth):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+
+2009-04-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):  Added CSS_INITIAL to the switch statement, and changed to use the WebCore
+          type and not the binding type.
+
+2009-04-29  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Reverted my previous change to add resetChromiumPluginCache().
+        https://bugs.webkit.org/show_bug.cgi?id=25318
+
+        * plugins/chromium/PluginDataChromium.cpp:
+
+2009-04-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6573742> - Problem dragging standalone images from Safari to Mail
+
+        Roll out trac.webkit.org/changeset/35867 which fixed <rdar://problem/6153432>
+
+        Cloned <rdar://problem/6153432> to <rdar://problem/6839881> to find a better fix for that Tiger Mail bug.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Remove the preload referenced check.
+
+2009-04-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25430
+
+        Provide style sheet for UI controls of media elements for Chromium port.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet):
+
+2009-04-29  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Expose sudden termination to Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=25457
+
+        * platform/SuddenTermination.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SuddenTerminationChromium.cpp: Added.
+        (WebCore::disableSuddenTermination):
+        (WebCore::enableSuddenTermination):
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unused EventListeners.
+
+        * page/DOMWindow.idl:
+
+2009-04-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reveal current execution line once SourceFrame content is loaded. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=25448
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
 2009-04-29  Ariya Hidayat  <ariya.hidayat@nokia.com>
 
         Reviewed by Simon Fraser.
@@ -126,6 +13212,1297 @@
         * platform/graphics/qt/ImageBufferQt.cpp:
         (WebCore::ImageBufferData::ImageBufferData):
 
+2009-04-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex): Removed exec param from at() call.
+        (JSC::Bindings::QtRuntimeConnectionMethod::call): Ditto.
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Missed one.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Removed scaffolding supporting dynamically converting between 32bit and
+        64bit value representations. 
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNode):
+        (WebCore::JSElement::setAttributeNS):
+        (WebCore::JSElement::setAttributeNodeNS):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::add):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::highlightDOMNode):
+        (WebCore::JSInspectorController::addResourceSourceToFrame):
+        (WebCore::JSInspectorController::addSourceToFrame):
+        (WebCore::JSInspectorController::getResourceDocumentNode):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::setting):
+        (WebCore::JSInspectorController::setSetting):
+        (WebCore::JSInspectorController::wrapCallback):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::JSSVGPointList::initialize):
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        (WebCore::JSSVGPointList::appendItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::JSSVGTransformList::initialize):
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        (WebCore::JSSVGTransformList::appendItem):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::constructWebKitPoint):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::importScripts):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/js/ScriptCallFrame.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+
+2009-04-28  David Carson  <dacarson@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Restore alignment to device pixel boundaries.
+        https://bugs.webkit.org/show_bug.cgi?id=25458
+
+        Adjust the adjusted destination rect to be device pixel aligned.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move unimplemented captureEvents and releaseEvents from JSDOMWindow
+        to DOMWindow.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25420
+        <rdar://problem/6829570> REGRESSION: XMLHttpRequest allows loading from another origin
+
+        Test: http/tests/xmlhttprequest/detaching-frame-2.html
+
+        This was caused by faulty DOMWindow::document(), which could return a new document from
+        the window's frame after navigation.
+
+        * bindings/js/JSDOMWindowCustom.h: (WebCore::JSDOMWindowBase::allowsAccessFromPrivate):
+        Removed an obsolete check that allowed access when document was null. Contrary to what a
+        comment said, that can happen for a window that is no longer in frame, not to one whose
+        document is not constructed yet.
+
+        * bindings/js/JSXMLHttpRequestConstructor.cpp: (WebCore::constructXMLHttpRequest): Bail
+        out if context was not found. This currently happens due to a shortcoming in
+        DOMWindow::document() - when it is fixed, the XMLHttpRequest object in included regression
+        test will be constructed successfully, but won't be sent, because its context will be
+        frameless.
+
+        * page/DOMWindow.cpp: (WebCore::DOMWindow::document): Check that the window in frame hasn't
+        been replaced yet. Added FIXME comments about how this may be better fixed in the future.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::document):
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::document):
+        (WebCore::constructImage):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::document):
+        (WebCore::constructHTMLOptionElement):
+        Make matching changes to other constructors that hold a reference to global object.
+
+2009-04-28  Kevin Ollivier <kevino@theolliviers.com>
+
+        wxMSW build fix. Switch JSCore build back to static.
+
+        * config.h:
+
+2009-04-28  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6834830>
+
+        Make sure we cover the two possible values reported by event.total that are playback engine
+        specific.
+
+        * media/progress-event-total-expected.txt: Match the new test.
+        * media/progress-event-total.html: Test the two values.
+
+2009-04-28  Timothy Hatcher  <timothy@apple.com>
+
+        Rename -[DOMRange lineBoxRects] to -[DOMRange textRects] and change how it
+        collects the individual rects, making sure to only include RenderText.
+
+        <rdar://problem/6810061>
+
+        Reviewed by Sam Weinig.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]): Added. Make a Range and call textRects.
+        (-[DOMNode lineBoxRects]): Call textRects method.
+        (-[DOMRange textRects]): Call Range::textRects.
+        (-[DOMRange lineBoxRects]): Call textRects method.
+        * bindings/objc/DOMPrivate.h: Add the new methods and a comment
+        about lineBoxRects being deprecated.
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox): Call textRects (renamed from addLineBoxRects).
+        (WebCore::Range::textRects): Renamed from addLineBoxRects. Iterate over the
+        nodes instead of the RenderObjects to correctly account for offsets. Also
+        only call absoluteRectsForRange on RenderText.
+        * dom/Range.h: Renamed addLineBoxRects to textRects.
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects): Call textRects (renamed from addLineBoxRects).
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRectsForRange): Remove if conditions that made this
+        function very specific for the lineBoxRects API. These functions are still used
+        by the InspectorController, and this change improves what the Inspector shows.
+        (WebCore::RenderObject::absoluteQuadsForRange): Ditto.
+
+2009-04-28  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the topLevel boolean argument from absolute{Rects,Quads}.
+        This argument was default to true and no one ever passed false.
+
+        Reviewed by Sam Weinig.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::absoluteRects):
+        (WebCore::RenderBlock::absoluteQuads):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::absoluteQuads):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::absoluteRects):
+        (WebCore::RenderSVGHiddenContainer::absoluteQuads):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::absoluteRects):
+        (WebCore::RenderSVGImage::absoluteQuads):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::absoluteRects):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        (WebCore::RenderSVGModelObject::absoluteQuads):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRects):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::absoluteRects):
+        (WebCore::RenderView::absoluteQuads):
+        * rendering/RenderView.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6794691> Media documents and <video controls> never show controls on Windows
+
+        RenderThemeWin doesn't implement the media element controller rendering methods, so media
+        controls stopped rendering when we switched from RenderThemeSafari. Rather than having copies
+        of the code in both places, the logic is in a new class that is called from both.
+
+        * WebCore.vcproj/WebCore.vcproj: Add RenderMediaControls.cpp.
+
+        * rendering/RenderMediaControls.cpp: Added.
+        (WebCore::determineState): Translate renderer state to ThemeControlState.
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize): Adjust slider thumb.
+        (WebCore::parentMediaElement): Return the HTMLMediaElement parent of a controller element.
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Paint a media controller part.
+        * rendering/RenderMediaControls.h: Added.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSliderTrack): Remove the MediaSliderPart case, it is never
+        called for the media slider.
+        (WebCore::RenderThemeSafari::adjustSliderThumbSize): Call RenderMediaControls function.
+        (WebCore::RenderThemeSafari::paintMediaFullscreenButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSeekBackButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSeekForwardButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSliderThumb): Ditto.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeWin::paintMediaFullscreenButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSeekBackButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSeekForwardButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSliderThumb): Ditto.
+        * rendering/RenderThemeWin.h:
+
+2009-04-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/6419515> REGRESSION (r31037): Positioned 
+        images with % height are collapsed when printing
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight): Make sure we don't ignore 
+        printing here!
+
+2009-04-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6617298> Typing delete on an unquoted blank line unquotes the preceding, quoted blank line
+
+        Test: editing/deleting/type-delete-after-quote.html
+
+        When a selection is deleted that contains a whole number paragraphs plus a line break, we refrain from merging paragraphs after the delete,
+        since it is unclear to most users that such a selection actually ends at the start of the next paragraph.  However, when a user hits delete 
+        with a caret selection, they actually do expect the start of that paragraph to be merged into the paragraph before it.  We can tell that 
+        we're in this state because the TypingCommand creates the selection to delete but it doesn't change the endingSelection.  So we can tell
+        that if we started with a caret selection, then we're not in this special case where we have to protect the user from unexpected behavior 
+        from deleting a range they selected.
+
+        * editing/DeleteSelectionCommand.cpp: (WebCore::DeleteSelectionCommand::initializePositionData):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add missing header to file list.
+
+        * GNUmakefile.am:
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix foreignObject transform order
+        https://bugs.webkit.org/show_bug.cgi?id=25433
+
+        Transforms were being applied in the wrong order.
+        When mapping from local to parent, first apply the viewport transform
+        then map from the viewport box to the parent box.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::localToParentTransform):
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Simplify nodeAtPoint for SVG
+        https://bugs.webkit.org/show_bug.cgi?id=25432
+
+        Added a new nodeAtFloatPoint method which takes a FloatPoint
+        instead of the *super confusing* x/y tx/ty pairs that HTML uses.
+        Mostly this is just lots of minus-lines as the new code is *much* simpler.
+
+        I made all the SVG renderers use the new nodeAtFloatPoint and ASSERT_NOT_REACHED
+        for the nodeAtPoint HTML/CSS int x/y version.
+
+        Eventually the rest of CSS/HTML render objects will follow suit
+        and move to nodeAtFloatPoint (possibly renamed back to nodeAtPoint), but changing them
+        over was well outside the scope of this change.
+
+        SVG hit testing is not actually floating point precise yet, since its still
+        passed in an integer x/y.  Certain transform hit-test edge cases are likely fixed
+        by moving to FloatPoint here, but I didn't try to find one.
+
+        This should not cause functional changes for common-case hit testing, thus
+        no tests changed, nor should new tests be needed.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::paint):
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        (WebCore::RenderForeignObject::layout):
+        (WebCore::RenderForeignObject::nodeAtFloatPoint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::nodeAtFloatPoint):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::nodeAtFloatPoint):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::nodeAtFloatPoint):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::pointIsInsideViewportClip):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::nodeAtFloatPoint):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        (WebCore::RenderSVGImage::nodeAtFloatPoint):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::nodeAtFloatPoint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtFloatPoint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtFloatPoint):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        - fix the Tiger build
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::cacheMovieScale):
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Consolidate ScheduleAction creation into ScheduledAction::create.
+        Autogenerate JSWorkerContext.clearTimeout and clearInterval.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::DOMWindow::setTimeout):
+        (WebCore::DOMWindow::clearTimeout):
+        (WebCore::DOMWindow::setInterval):
+        (WebCore::DOMWindow::clearInterval):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2009-04-28  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6643219> Crashes after moving nodes between documents with Safari 4 Beta installed
+
+        When moving Nodes between documents we weren't properly updating style declarations.  Certain operations, such
+        as creating webarchives, would tickle this bug.
+
+        Tests: webarchive/adopt-attribute-styled-body-webarchive.html
+               webarchive/adopt-attribute-styled-node-webarchive.html
+               webarchive/adopt-inline-styled-node-webarchive.html
+
+        * dom/Node.cpp:  Add a debug-only mechanism to insure that anyone who overrides (did/will)MoveToNewOwnerDocument
+          calls their parent-class implementation after they've done their own work.
+        (WebCore::setWillMoveToNewOwnerDocumentWasCalled): 
+        (WebCore::setDidMoveToNewOwnerDocumentWasCalled):
+        (WebCore::Node::setDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged): Add a comment explaining why we don't need to walk the nameAttrMap
+          to update style declarations.
+        (WebCore::StyledElement::didMoveToNewOwnerDocument): Update the parent pointer for the inline style declaration.
+        * dom/StyledElement.h:
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::didMoveToNewOwnerDocument): Update the parent pointer for the link declaration.
+        * html/HTMLBodyElement.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+         Reviewed by Darin Adler.
+        
+        <rdar://problem/6834876> Don't use BlockExceptions macros until QTKit supports 
+        QTMoviePreferredTransformAttribute
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): use @try and @catch instead of 
+        BEGIN_BLOCK_OBJC_EXCEPTIONS and END_BLOCK_OBJC_EXCEPTIONS for builds of QTKit 
+        that throw an exception on QTMovieCurrentSizeAttribute but don't support 
+        QTMoviePreferredTransformAttribute
+
+2009-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText): Streamline code path to avoid a bit of reference count
+        churn and remove a strange unneeeded PassRefPtr typecast. Also added a comment.
+        (WebCore::RenderText::setTextInternal): Ditto.
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Simplify how SVG containers paint
+        https://bugs.webkit.org/show_bug.cgi?id=25431
+
+        Moved filterBoundingBox() from RenderSVGModelObject to SVGRenderSupport to share with other classes.
+        Gave RenderSVGText a modern clippedOverflowRectForRepaint and computeRectForRepaint.
+        RenderSVGText now applies transforms at paint() time instead of during chunk draw time
+        this should be much more efficient.
+
+        Fixed the order in which RenderSVGViewportContainer applied
+        transforms and clips.  We now clip to the viewport first and apply
+        all transforms at once.  Also since the viewport logic is now only
+        inside RenderSVGViewportContainer (instead of inside RenderSVGContainer)
+        we always know we have a viewport.  We now use only viewportSize instead of
+        viewport() since RenderSVGViewportContainers can't have x/y offsets.
+
+        We now correctly transform the PaintInfo::rect (damage rect) when applying transforms.
+        This allowed us to apply the transform during text paint() instead of at chunk paint
+        time. Previously we had to apply the transform during chunk paint time because
+        RenderBlock (superclass of RenderSVGBlock) would check intersection with the damageRect
+        before telling any of the inlines to draw.  Now that we adjust the damage rect correctly
+        we pass the intersection check correctly!  (This probably fixed some <text> redraw bugs
+        but since I still have a bunch of those to fix, I've not tried to write additional tests
+        to cover these potential fixes yet.)
+
+        SVGRootInlineBox no longer needs to deal with transforms at chunk paint time, yay!
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::applyViewportClip):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::viewportSize):
+        (WebCore::RenderSVGRoot::calcViewport):
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::parentOriginToBorderBox):
+        (WebCore::RenderSVGRoot::borderOriginToContentBox):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::paint):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        (WebCore::RenderSVGText::localTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::filterBoundingBoxForRenderer):
+        (WebCore::applyTransformToPaintInfo):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBox::paint):
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25453: AX: fall back to PLACEHOLDER attr if form element is not labeled
+        https://bugs.webkit.org/show_bug.cgi?id=25453
+
+        Test: accessibility/placeholder.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25452: AX: Don't create addition space AXStaticText element for every bold or link tag
+        https://bugs.webkit.org/show_bug.cgi?id=25452
+
+        Test: accessibility/ignore-spacer-elements.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-04-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Work around <rdar://problem/6833240> by relying on static initialization to zero the entire struct.
+        This removes the need for us to explicitly initialize all of the members, which have a tendency
+        to change in meaning and number between versions of libxml2.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::):
+        (WebCore::sharedXHTMLEntity):
+        (WebCore::getXHTMLEntity):
+
+2009-04-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix linker warning by specifying /NODEFAULTLIB:LIBCMT for QTMovieWin.
+        
+        Reviewed by Mark Rowe.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25449: AX: Respect the alt tag of ARIA button as AXDescription
+        https://bugs.webkit.org/show_bug.cgi?id=25449
+
+        Test: accessibility/img-aria-button-alt-tag.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2009-04-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - formatting cleanup
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight): Corrected indentation and added braces
+        around a multi-line "else" clause.
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben
+        
+        <rdar://problem/6769968> media/video-size-intrinsic-scale.html fails on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=25094
+        
+        Display movies saved with a non-identity matrix at the correct size.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate): Initialize m_widthScaleFactor and m_heightScaleFactor.
+        (QTMovieWinPrivate::cacheMovieScale): New, calculate difference between initial
+        size and natural size so naturalSize() accounts for non-identity movie matrix.
+        (QTMovieWinPrivate::task):Call cacheMovieScale when load state reaches
+        kMovieLoadStateLoaded for the first time. kMovieLoadState -> QTMovieLoadState.
+        (QTMovieWinPrivate::drawingComplete): kMovieLoadState -> QTMovieLoadState.
+        (QTMovieWinPrivate::createGWorld): Don't bother creating gworld until load state reaches
+        kMovieLoadStateLoaded because we do not try to draw it before that point.
+        (QTMovieWinPrivate::setSize): Do not change movie box before reaching kMovieLoadStateLoaded
+        because we need to get the movie's initial size in cacheMovieScale.
+        (QTMovieWin::getNaturalSize): Multiply width and height by initial scale.
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Move timer code from JSDOMWindow to DOMWindow. clearTimeout and
+        clearInterval can now be autogenerated.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createScheduledAction):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout):
+        (WebCore::DOMWindow::clearTimeout):
+        (WebCore::DOMWindow::setInterval):
+        (WebCore::DOMWindow::clearInterval):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-28  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Small optimization, don't get the widget's handle twice in one method.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25446
+
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::invalidateRect):
+        (WebCore::Widget::paint):
+
+2009-04-28  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        ScrollView copy and paste typo fix.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25445
+
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollbarModes):
+
+2009-04-28  John Sullivan  <sullivan@apple.com>
+
+        <rdar://problem/6820221> REGRESSION: 2-byte character names of images are displayed as %-encoded ASCII
+
+        Reviewed by Adam Roben
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::finish):
+        decode the filename before processing it as part of the image name that's passed to the client
+
+2009-04-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        - fix initialization order to match declaration order to fix release build
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Justin Garcia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16135
+        [GTK] Support caret browsing
+
+        Based on a patch by Alp Toker.
+
+        Implement basic support for caret browsing, active only when the
+        corresponding setting is enabled.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        (WebCore::clearSelectionIfNeeded):
+        (WebCore::FocusController::setFocusedNode):
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::respondToChangedSelection):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret):
+
+2009-04-27  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a compile breakage.
+        <https://bugs.webkit.org/show_bug.cgi?id=25384>
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-27  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6822344> Use of QTMovieCurrentSizeAttribute generates exception and will crash
+
+        QTMovieCurrentSizeAttribute generates an exception with some versions of QTKit, so calculate a 
+        multiplier to scale from natural size to current size when a movie is opened and use that to 
+        return the correct value from the naturalSize() method.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_scaleFactor.
+        (WebCore::MediaPlayerPrivate::naturalSize): Return naturalSize transformed by initial scale.
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): New, calculate difference between initial
+        size and natural size so naturalSize() accounts for non-identity movie matrix.
+        (WebCore::MediaPlayerPrivate::updateStates): Call cacheMovieScale when load state reaches
+        QTMovieLoadStateLoaded for the first time.
+
+2009-04-27  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6709057> REGRESSION (4PB-TOT): http://www.winway.com/main3/support/faq.aspx selector doesn't look right or work
+
+        The problem here is that we had a self-painting layer nested inside 
+        a non-self-painting layer. We ended up ignoring the self-painting 
+        layer both during painting and hit-testing. This patch corrects 
+        that. 
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-04-27  Ada Chan  <adachan@apple.com>
+
+        If it has been set to allow any HTTPS certificates for this host, set 
+        kCFStreamSSLAllowsExpiredCertificates to true to allow expired 
+        certificate, and set kCFStreamSSLValidatesCertificateChain false to skip
+        certificate chain validation. (<rdar://problem/6382059>)
+
+        Reviewed by John Sullivan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::makeFinalRequest):
+
+2009-04-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+        
+        <rdar://problem/6822225> Full page zooming of <video> element in the browser window doesn't work well
+        
+        Fix a 'size changed' notification thrash that caused standalone video elements
+        to continually resize after full page zooming, by using the movie's natual size (which is independent
+        of zooming), rather than its current size (which is not).
+        
+        Note that this regresses <https://bugs.webkit.org/show_bug.cgi?id=25029>, so we have to
+        disable the media/video-size-intrinsic-scale.html test. However, we have to stop using
+        QTMovieCurrentSizeAttribute anyway; this will be addressed, and the test re-enabled via
+        <rdar://problem/6822344>.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+
+2009-04-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6642221> REGRESSION: With the Movie widget, movie trailer fails to
+        load if movie had been previously viewed
+        
+        Fix the Dashboard quirk for display:none plug-ins by moving the code from HTMLObjectElement
+        to HTMLEmebedElement. It has to be in HTMLEmbedElement because the content we care about uses <embed>.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::rendererIsNeeded):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Move more window event related code into DOMWindow.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setWindowAttributeEventListener):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchLoadEvent):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        * dom/Element.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::dispatchEventWithDocumentAsTarget):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchUnloadEvent):
+        (WebCore::DOMWindow::dispatchBeforeUnloadEvent):
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+
+2009-04-27  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Implement the editing mechanisms and add context menu items for
+        <rdar://problem/6724106> WebViews need to implement text checking
+
+        Reviewed by Justin Garcia.
+
+        * editing/Editor.cpp:
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        * loader/EmptyClients.h:
+        * page/ContextMenuController.cpp:
+        * page/EditorClient.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/ContextMenu.cpp:
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6772944> REGRESSION (r42223): PLT 2% slower, i-Bench 3% slower
+
+        Be slightly less eager in collecting after page close/navigation by increasing
+        the time before collection from 0 seconds to .5 seconds.
+
+        3% speedup on the PLT.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::garbageCollectSoon):
+
+2009-04-27  David Kilzer  <ddkilzer@apple.com>
+
+        Consolidate runtime application checks for Apple Mail and Safari
+
+        Reviewed by Mark Rowe and Darin Adler.
+
+        * WebCore.base.exp: Added exports.
+        * WebCore.xcodeproj/project.pbxproj: Added
+        RuntimeApplicationChecks.{h|mm} source files to the project.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        Removed local checkedSafari and isSafari variables and switched
+        to use applicationIsSafari().
+        * platform/mac/RuntimeApplicationChecks.h: Added.
+        * platform/mac/RuntimeApplicationChecks.mm: Added.
+        (WebCore::applicationIsAppleMail): Runtime application check for
+        Apple Mail.
+        (WebCore::applicationIsSafari): Runtime application check for
+        Safari.
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25374: AX: No AXValue change sent when text is auto-inserted
+        https://bugs.webkit.org/show_bug.cgi?id=25374
+
+        First patch caused some regression tests to fail. 
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Cover more WebCore role -> ATK role conversions.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Do not call ATK setters in the getters, just return the
+        value. Among other things calling the setter will emit the notify
+        signal, which is wrong.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkImage interface.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed debug build fix.
+
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_toggle_paint):
+
+2009-04-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25382
+        Remove direct reference to CallFrame.h include to pacify Win build.
+
+        * bindings/js/JSDOMBinding.h: Removed ScriptState.h include.
+        * bindings/js/ScriptState.h: Replaced CallFrame.h with JSDOMBinding.h
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25374: AX: No AXValue change sent when text is auto-inserted
+        https://bugs.webkit.org/show_bug.cgi?id=25374
+
+        When an input's text value is changed through the DOM, no AXValueChange notification is being sent.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-04-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25382
+        Move scriptStateFromNode to ScriptState.
+
+        * bindings/js/JSDOMBinding.cpp: Moved scriptStateFromNode to ScriptState.
+        * bindings/js/JSDOMBinding.h: Ditto.
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode): Added.
+        * bindings/js/ScriptState.h: Ditto.
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode): Added.
+        * bindings/v8/ScriptState.h: Ditto.
+        * dom/NodeFilter.h: Removed JSDOMBinding header include.
+        * dom/NodeIterator.h: Ditto.
+        * dom/TreeWalker.h: Ditto.
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25428: 5 crashes in DumpRenderTree at com.apple.WebCore • -[AccessibilityObjectWrapper accessibilityAttributeValue:] + 830
+        https://bugs.webkit.org/show_bug.cgi?id=25428
+
+        When marking children as changed in accessibility, we cannot rely on the accessibility parent chain existing.
+        Instead, the render chain needs to be consulted.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+
+2009-04-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25399
+        <rdar://problem/6633943> REGRESSION: Many crashes reported accessing Lexis/Nexis database,
+        beneath WebCore::Cache::evict
+
+        The crash happened because a cached resource handle was removed from a document's cached
+        resources map twice recursively, so a destructor was called for a value in a deleted bucket.
+        The first call was from Cache::evict, and when destroying CachedResourceHandle destroyed
+        CachedResource, DocLoader::removeCachedResource() was called again, with HashMap being in
+        an inconsistent state.
+
+        I couldn't fully reconstruct the loading sequence to make a test.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Assert that the resource being revalidated is in cache
+        (it makes no sense to revalidate one that isn't).
+        (WebCore::Cache::evict): Don't remove the resource from document's map. Removing a resource
+        from the cache in no way implies that documents no longer use the old version. This fixes the
+        crash, and also fixes many cases of resource content being unavailable in Web Inspector.
+
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): When bringing a revalidated resource back to cache,
+        reset m_isBeingRevalidated to maintain the invariant of resources being revalidated never
+        being in cache. This fixes another assertion I saw on LexisNexis search: in rare cases,
+        switchClientsToRevalidatedResource() results in the same resource being requested again,
+        but we were only enforcing CachedResource invariants after calling this function.
+        (WebCore::CachedResource::unregisterHandle): Assert that the counter doesn't underflow.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::removeCachedResource): Assert that the passed
+        resource is removed, not some other resource that happens to have the same URL (this used to
+        fail on LexisNexis search before this patch).
+
+        * loader/ImageDocument.cpp: (WebCore::ImageTokenizer::write): Replaced ASSERT_NOT_REACHED
+        with notImplemented(). This method can be legally called via document.write(), and should
+        work. LexisNexis takes this code path, but apparently has a fallback for Safari, so it
+        doesn't affect site functionality.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::clearResourceToRevalidate): Don't assert that m_resourceToRevalidate
+        is being revalidated - this may no longer be true, because we now reset this member in
+        CachedResource::setInCache().
+
+2009-04-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - make BidiContext a RefCounted class, starting with a refcount of 1,
+          and share the root BidiContexts.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawBidiText): Use BidiContext::create().
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create): Added. For the four "root" contexts,
+        returns a reference to a shared static BidiContext.
+        * platform/text/BidiContext.h:
+        (WebCore::BidiContext::BidiContext):
+        * platform/text/BidiResolver.h:
+        (WebCore::::commitExplicitEmbedding): Use BidiContext::create().
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::determineStartPosition): Ditto.
+
+2009-04-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Build fix for r42893: change GDK_exclaim to GDK_exclam
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-04-27  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Xan Lopez.
+
+        Fix wrong key code conversion.
+
+        Missing conversion for GDK_exlaim ('!').
+        Parens are opposite: GDK_parenleft is open paren '('
+        and GDK_parenright is close paren ')'.
+        https://bugs.webkit.org/show_bug.cgi?id=25367
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-04-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] gtkdrawing update
+        https://bugs.webkit.org/show_bug.cgi?id=25408
+
+        Update to the 25 Apr 2009 version of gtk2drawing.c and
+        gtkdrawing.h from Mozilla (http://hg.mozilla.org/mozilla-central)
+
+        * platform/gtk/gtk2drawing.c:
+        (setup_widget_prototype):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_toolbar_widget):
+        (ensure_tree_header_cell_widget):
+        (moz_gtk_init):
+        (moz_gtk_button_get_inner_border):
+        (moz_gtk_toggle_paint):
+        (moz_gtk_caret_paint):
+        (moz_gtk_entry_paint):
+        (moz_gtk_tree_header_cell_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_toolbar_separator_width):
+        (moz_gtk_get_menu_separator_height):
+        (moz_gtk_widget_paint):
+        (moz_gtk_shutdown):
+        * platform/gtk/gtkdrawing.h:
+
 2009-04-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -138,143 +14515,4010 @@
         * platform/qt/RenderThemeQt.cpp:
         (WebCore::RenderThemeQt::applyTheme):
 
-2009-03-13  Adam Bergkvist <adam.bergkvist@ericsson.com>
+2009-04-26  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24349
-        [QT] HTTP status text is never set
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25412
+        The Window object should be an EventTarget
 
-        Set HTTP status text to the reason phrase attribute of QNetworkReply.
+        Test: fast/dom/Window/dispatchEvent.html
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): Add DOMWindow case.
+        (WebCore::toEventTarget): Ditto.
 
-2009-03-02  Dirk Schulze  <krit@webkit.org>
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toDOMWindow): Added.
+        * dom/EventTarget.h:
 
-        Reviewed by Holger Freyther.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::scriptExecutionContext): Added. Returns the document.
+        (WebCore::DOMWindow::dispatchEvent): Added.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::toDOMWindow):
+        (WebCore::DOMWindow::refEventTarget):
+        (WebCore::DOMWindow::derefEventTarget):
+        * page/DOMWindow.idl:
 
-        Added putImageData to Qt. Discussed with Ariya Hidayat.
+2009-04-26  Sam Weinig  <sam@webkit.org>
 
-        [Qt] lacks putImageData support in Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=22186
+        Reviewed by Eric Seidel.
 
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::putImageData):
+        Remove scons-based build system.
 
-2009-03-01  Larry Ewing  <lewing@novell.com>
+        * WebCore.scons: Removed.
 
-        Reviewed by Alexey Proskuryakov.
+2009-04-26  Darin Adler  <darin@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=24080
-        NPN_GetValue casting to the wrong type and writing outside bounds
+        Suggested by Darin Fisher.
 
-        Make sure to cast the value to the correct type so that only
-        memory owned by the value is written to.
+        Improve the fix for bug 25355: Crash when Creating New Tab or New Window when set to open Same Page
+        https://bugs.webkit.org/show_bug.cgi?id=25355
+        rdar://problem/6823543
 
-        * plugins/gtk/PluginViewGtk.cpp (PluginView::getValueStatic): 
-        * plugins/qt/PluginViewQt.cpp (PluginView::getValueStatic):
-        * plugins/mac/PluginViewMac.cpp (PluginView::getValueStatic): 
-        (PluginView::getValue):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Allow shouldScroll to be true even if m_currentHistoryItem is 0.
+        Not sure if when this case can really arise in practice, but it's good to match the original
+        logic more closely.
 
-2009-02-27  Adam Treat  <adam.treat@torchmobile.com>
+2009-04-25  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Oliver Hunt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24229
-        If an image has no alpha channel there is no reason to use SourceOver.
+        A width or height of zero for the destination or source rect of an
+        image causes a not invertible pattern matrix.
+        This crahes newer versions of Cairo and give some graphic gliches in
+        Canvas.
+        With this patch we check if there is something to draw and return if not.
 
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::Image::drawPattern):
+        * platform/graphics/cairo/ImageCairo.cpp:
         (WebCore::BitmapImage::draw):
 
-2009-02-27  Zack Rusin  <zack@kde.org>
+2009-04-25  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Nikolas Zimmermann.
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25390
+        
+        Fix point mapping and hit testing through transforms and perspective
+        with ENABLE_3D_RENDERING. Previously the code did the more efficient
+        move(), rather than getTransformFromContainer(), when the object had
+        no transform. However, this skipped the application of perspective
+        when the immediate child of the perspective element had no transform
+        itself.
 
-        Qt: be more reasonable about scrolled lines
+        Test: transforms/3d/point-mapping/3d-point-mapping-3.html
 
-        cMouseWheelPixelsPerLineStep is currently a constant set to 13.3. it doesn't
-        match our metrics meaning that Qt scrolls by ~2 lines by default which is quite
-        irritating. so lets scroll vertically by the Qt set number of lines * Qt default
-        single step scroll
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createLocalTransformState):
+        Call shouldUseTransformFromContainer() to determine if we need to
+        go through the more expensive getTransformFromContainer() code
+        path.
 
-        * platform/qt/WheelEventQt.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::shouldUseTransformFromContainer):
+        New method that indicates whether we need use getTransformFromContainer()
+        when mapping points through renderers, and hit testing.
 
-2009-02-25  Dirk Schulze  <krit@webkit.org>
+2009-04-25  Adele Peterson  <adele@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Ported arcTo to Qt. Qt has no native support for arcTo. This changes
-        calculate the behavior of arcTo and draws it with lineTo and arc.
+        Fix for <rdar://problem/6712771> REGRESSION(34681): Text is no longer underlined after delete
+        https://bugs.webkit.org/show_bug.cgi?id=25396
 
-        [QT] implement Canvas arcTo
-        https://bugs.webkit.org/show_bug.cgi?id=23873
+        Test: editing/deleting/delete-br-013.html
 
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::addArcTo):
+        * editing/CompositeEditCommand.cpp: (WebCore::CompositeEditCommand::moveParagraphs):
+         Only preserve an empty paragraph's style when moving paragraphs around if the selection is still 
+         in an empty paragraph after the move occurs.  This was causing the empty paragraph's style to overwrite
+         the previous paragraph's style during a delete of an empty paragraph.
 
-2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+2009-04-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6808171> REGRESSION (3-4): Standalone media documents don't 
+        properly display non-linear media
+
+        If a media engine claims it can support the MIME type, WebCore now creates a <video>
+        element for document mode media files instead of an <embed> element. Because WebCore's 
+        QuickTime backed media players do not support every kind of media the QuickTime plug-in
+        supports, and because it is not always possible to tell what type of media is in a file 
+        without opening and parsing it, some types of media that used to be displayed properly
+        by a plug-in are no longer supported properly. To fix this, if the media engine
+        sees that it can not completely support a media file it now informs the media 
+        document, which replaces the <video> element with an <embed>.
+        
+        r42301 landed support for OSX. This patch modifies those changes slighly and adds support
+        for Windows.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::MediaDocument): Initialize m_replaceMediaElementTimer.
+        (WebCore::MediaDocument::mediaElementSawUnsupportedTracks): Don't replace the <video> 
+        element immediately.
+        (WebCore::MediaDocument::replaceMediaElementTimerFired): Renamed from replaceVideoWithEmbed.
+        Set body margin-width and margin-height to 0 as that is what a PluginDocument uses.
+        * loader/MediaDocument.h:
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::loadStateChanged): Don't do anything if m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::rateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::timeChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::didEnd): Ditto.
+        (WebCore::MediaPlayerPrivate::repaint): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks): Set m_hasUnsupportedTracks before callback.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_totalTrackCount and m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::updateStates): Call sawUnsupportedTracks if the movie has unsupported
+        media type(s) or if it fails completely.
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks): New, disable the movie object and tell the
+        media player client we won't play this movie correctly.
+        (WebCore::MediaPlayerPrivate::didEnd): Don't do anything if m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::setSize): Ditto.
+        (WebCore::MediaPlayerPrivate::setVisible): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::MediaPlayerPrivate::movieEnded): Ditto.
+        (WebCore::MediaPlayerPrivate::movieLoadStateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::movieTimeChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::movieNewImageAvailable): Ditto.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::task): Stop the task timer if we were disabled during the load state
+        change callback.
+        (QTMovieWinPrivate::drawingComplete): Don't do anything if disabled.
+        (QTMovieWin::QTMovieWin): Initialize m_disabled.
+        (QTMovieWin::disableUnsupportedTracks): Return total number of tracks.
+        (QTMovieWin::setDisabled): New, set m_disabled flag.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=18344
+
+        Fix the SOUP resource handle to report SOUP_HTTP_ERROR for Soup
+        errors and G_IO_ERROR for gio errors.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::ResourceHandle::start):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+        (WebCore::ResourceHandle::startGio):
+
+2009-04-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Mark Rowe.
+
+        Only set the new URL once for the request. Doing it a second time
+        after the call to willSendRequest was causing crashes when
+        redirected requests got cancelled.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-04-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding ScriptEventListener.cpp.
+
+        * WebCoreSources.bkl:
+
+2009-04-24  Sergio García-Cuevas  <sergio_gcg@telefonica.net>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17267
+        [GTK] Primary selection/clipboard support
+
+        Copy the link location to the primary selection as well as the
+        clipboard selection when using the "copy link selection" context
+        menu entry.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeURL):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-04-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25383
+        Changing SVG size via JS does not update CSS width/height
+
+        Add an ugly hack to fix CSS width/height updates from JS.
+
+        We can't easily call setAttribute when width/height changes
+        as that would cause infinite recursion (as we'd try to set
+        the animation storage from the attributes)
+
+        For now, when we get notification that JS changed width/height
+        we copy what parseMappedAttribute does and update the CSS values as well.
+
+        A better fix for this would be:
+        https://bugs.webkit.org/show_bug.cgi?id=25383
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::updateCSSForAttribute):
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2009-04-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        We should not show the deletion UI for blockquotes in mail but they do 
+        show now that we only check for one visible border.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-04-24  Dan Bernstein  <mitz@apple.com>
+
+        - address Hyatt's review comments on the last patch
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::performOverlapTests):
+        (WebCore::RenderLayer::paintLayer):
+
+2009-04-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=5909
+          <rdar://problem/5863349> overlapping element leaves trail when
+          scrolling iframe
+
+        * WebCore.xcodeproj/project.pbxproj: Added OverlapTestRequestClient.h.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset): Initialize m_isOverlapped.
+        (WebCore::FrameView::useSlowRepaints): Also check m_isOverlapped.
+        (WebCore::FrameView::removeSlowRepaintObject): Use useSlowRepaints()
+        so overlapping is taken into account.
+        (WebCore::FrameView::setIsOverlapped): Added. Sets m_isOverlapped and
+        enables or disables copy-on-scroll accordingly.
+
+        * page/FrameView.h:
+        Added setIsOverlapped() and m_isOverlapped.
+
+        * rendering/OverlapTestRequestClient.h: Added. During foreground painting,
+        an OverlapTestRequestClient can make a request to test if any subsequently-
+        painted layers overlap a rect. The test result is delivered to the
+        requestClient via setOverlapTestResult().
+        (WebCore::OverlapTestRequestClient::~OverlapTestRequestClient):
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint): Pass an OverlapTestRequestMap to
+        paintLayer(). When done painting, inform any remaining requestClients that
+        they are not overlapped.
+
+        (WebCore::RenderLayer::paintLayer): Take an OverlapTestRequestMap and
+        pass it down to child and reflection layers. Inform requestClients if this
+        layer overlaps their requested rects.
+
+        * rendering/RenderLayer.h:
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::PaintInfo::PaintInfo): Added an
+        OverlapTestRequestMap member.
+
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint): For now, pass a 0 OverlapTestRequestMap
+        to paintLayer().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): For FrameViews, request an overlap test
+        with the frame.
+        (WebCore::RenderWidget::setOverlapTestResult): Call
+        FrameView::setIsOverlapped() with the result of the overlap test.
+
+        * rendering/RenderWidget.h: Made RenderWidget an OverlapTestRequestClient.
+
+2009-04-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser, Dan Bernstein.
+
+        Speed up the PLT by devirtualizing the height() function on InlineBox.  virtualizing it in order to make the height() computation dynamic caused
+        a ~0.5% slowdown.  This patch does the following to get the speed back:
+        
+        (a) Devirtualizes isText and forces inline box creators to set the bit as needed.  This actually resulted in simplified code, since ListMarkerBox could
+        then be removed.
+        (b) Reduces the height() call count.  In some cases the code was repeatedly calling height(), which used to be fine when the function was just an inline
+        member variable access.  The call sites have been patched to cut down on extra height() calls now that it is more expensive.
+        (c) Devirtualize height() except on SVG boxes.  For all non-SVG, the height() function on InlineBox handles the computation.  For SVG boxes, a new bit has
+        been set on InlineBoxes (isSVG()) that indicates that the virtual svgBoxHeight() function should be called to retrieve the height instead.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isSVG):
+        (WebCore::InlineBox::setIsSVG):
+        (WebCore::InlineBox::isText):
+        (WebCore::InlineBox::setIsText):
+        (WebCore::InlineBox::svgBoxHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        * rendering/InlineTextBox.h:
+        * rendering/ListMarkerBox.cpp: Removed.
+        * rendering/ListMarkerBox.h: Removed.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::createInlineBox):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createFlowBox):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootBox):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::createInlineTextBox):
+        * rendering/RootInlineBox.cpp:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::svgBoxHeight):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::svgBoxHeight):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::svgBoxHeight):
+
+2009-04-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25370
+        Introduce ScriptEventListener to refactor away direct references to
+        JSLazyEventListener in WebCore code.
+
+        * GNUmakefile.am: Added ScriptEventListener to project.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSDOMGlobalObject.cpp: Removed unused JSLazyEventListener include.
+        * bindings/js/JSLazyEventListener.cpp: Moved createAttributeEventListener helpers
+            to ScriptEventListener.
+        * bindings/js/JSLazyEventListener.h: Ditto.
+        * bindings/js/ScriptController.cpp: Removed unused JSLazyEventListener include.
+        * bindings/js/ScriptEventListener.cpp: Added.
+        * bindings/js/ScriptEventListener.h: Added.
+        * bindings/v8/ScriptEventListener.cpp: Added.
+        * bindings/v8/ScriptEventListener.h: Added.
+        * dom/Document.cpp: Renamed JSLazyEventListener include to ScriptEventListener.
+        * html/HTMLBodyElement.cpp: Ditto.
+        * html/HTMLButtonElement.cpp: Ditto.
+        * html/HTMLElement.cpp: Ditto.
+        * html/HTMLFormElement.cpp: Ditto.
+        * html/HTMLFrameElementBase.cpp: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        * html/HTMLImageElement.cpp: Ditto.
+        * html/HTMLInputElement.cpp: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLScriptElement.cpp: Ditto.
+        * html/HTMLSelectElement.cpp: Ditto.
+        * html/HTMLTextAreaElement.cpp: Ditto.
+        * svg/SVGElement.cpp: Ditto.
+        * svg/SVGSVGElement.cpp: Ditto.
+
+2009-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25355: Crash when Creating New Tab or New Window when set to open Same Page
+        https://bugs.webkit.org/show_bug.cgi?id=25355
+        rdar://problem/6823543
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Added a null check.
+
+2009-04-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix RenderSVGImage to dump with full bounds and style information.
+        https://bugs.webkit.org/show_bug.cgi?id=25377
+        
+        No functional changes, we're just now including more info in render tree dumps.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGImage):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::isSVGImage):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::write):
+        * rendering/SVGRenderTreeAsText.h:
+
+2009-04-24  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        Rename "isInline" => "isAttribute" in v8 bindings (jsc was done in r42699).
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::add):
+        (WebCore::V8EventListenerList::remove):
+        (WebCore::V8EventListenerList::clear):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::virtualisAttribute):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+        (WebCore::V8EventListener::virtualisAttribute):
+
+2009-04-24  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25343
+        Fix Chromium/Skia bug where -webkit-box-shadow with 0,0 offset 
+        ignores blur.
+
+        * WebCore\platform\graphics\skia\GraphicsContextSkia.cpp
+         (WebCore::GraphicsContext::setPlatformShadow): Add check against
+         blur before clearing looper.
+
+2009-04-24  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Initialize TextIterator::m_textLength to 0.
+
+        This assures that TextIterator::length() will return 0 for cases when TextIterator's constructor returns early (because there is nothing to iterate over in the range).
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25335>
+
+        Test: editing/selection/doubleclick-whitespace-img-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::TextIterator):
+
+2009-04-24  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25329
+        Add indexed access method in v8 binding of ClientRectList.
+
+        * bindings/v8/custom/V8ClientRectListCustom.cpp: Added.
+
+2009-04-24  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25257
+        Use null for unspecified event listener attributes of XMLHttpRequest
+        and XMLHttpRequestUpload in v8 binding.
+
+        cf. http://www.whatwg.org/specs/web-apps/current-work/#event-handler-attributes
+        An event handler attribute, unless otherwise specified, can either
+        have the value null or be set to a Function object.
+        Initially, an event handler attribute must be set to null.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-default-attributes.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Changed to use v8::Null().
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Ditto.
+
+2009-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6663836> CrashTracer: crashes in Safari at com.apple.WebCore • WebCore::reportException + 1513
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException): Added a null check.
+
+2009-04-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23219
+
+        Add support for transtions and animations of background-position, -webkit-background-size,
+        -webkit-mask-position and -webkit-mask-size.
+
+        Tests: transitions/background-transitions.html
+               transitions/mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        Add a blend func for LengthSize.
+        
+        (WebCore::ensurePropertyMap):
+        Add wrappers for the new properties.
+        
+        (WebCore::addShorthandProperties):
+        Add a shorthand property for CSSPropertyBackgroundPosition to map to
+        CSSPropertyBackgroundPositionX and CSSPropertyBackgroundPositionY, 
+        add CSSPropertyWebkitMask for CSSPropertyWebkitMaskPosition, and add
+        CSSPropertyWebkitMaskPosition for CSSPropertyWebkitMaskPositionX and
+        CSSPropertyWebkitMaskPositionY.
+        
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setBackgroundXPosition):
+        (WebCore::InheritedFlags::setBackgroundYPosition):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setMaskXPosition):
+        (WebCore::InheritedFlags::setMaskYPosition):
+        (WebCore::InheritedFlags::setMaskSize):
+        Add setters for the properties that can be animated now.
+
+2009-04-24  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/5089327> Newline gets stripped when pasting whole lines in certain markup
+
+        Test: editing/pasteboard/paste-blockquote-after-blockquote.html
+
+        When we have matching quote levels, its ok to merge the starts of the inserted and existing blocks more frequently.
+        But we should only merge here if the selection start was inside a mail blockquote.  This prevents against removing a 
+        blockquote from newly pasted quoted content that was pasted into an unquoted position.  If that unquoted position happens 
+        to be right after another blockquote, we don't want to merge and risk stripping a valid block (and newline) from the pasted content.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::shouldMergeStart): Also added an early return to always return false when we're already moving paragraphs.
+        (WebCore::ReplaceSelectionCommand::doApply): Removed redundant check for when we're moving paragraphs.
+        * editing/ReplaceSelectionCommand.h:
+
+2009-04-23  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 24604: WebKit profiler reports incorrect total times
+        <https://bugs.webkit.org/show_bug.cgi?id=24604>
+
+        Reviewed by Timothy Hatcher and Kevin McCullough.
+
+        Made it so that most of the profiler functions now match the behavior of Shark. Most notably, in the
+        heavy view, child nodes now represent the statistics of the root node. Each root node of heavy view
+        displays flattened statistics for a particular function that ran during the profile, and each child
+        of these root nodes represents a callpath that lead to it. Thus, the statistics for each of these child
+        nodes should show how much of the root nodes values came from it. For example, if you had the following to
+        stacks take place during the profile:
+
+        A ->calls 1 times-> B ->calls 2 times-> C
+        D ->calls 4 times-> C
+
+        The tree for the C root node would look like this:
+
+        C -> B -> A
+          -> D
+
+        The number of calls values would look like this:
+
+        C (6) -> B (2) -> A(2)
+              -> D (4)
+
+        What this means is that "2 of the total 6 C calls came from B", "2 of the total C calls came from A", and
+        "4 of the total C calls came from D".  Notice that the "A ->calls 2 time->" is completely ignored. This becomes
+        particularly tricky during recursive calls, because each child note can represent multiple possible paths. This
+        is the reason that we would get things like 40000% previously with recursion.
+
+        This is also the way gprof works, and as close as we can get to Shark's behavior (Shark is not instrumented so it
+        can't know exactly how many calls came from where, etc).
+
+        * English.lproj/localizedStrings.js: Added "Average" for average times in the profile.
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::ProfileClass):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getParent):
+        (WebCore::getHead):
+        (WebCore::getCallUID):
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/BottomUpProfileDataGridTree.js: Added.
+        (WebInspector.BottomUpProfileDataGridTree):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.focus):
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._populate):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGrid.prototype.removeChild):
+        (WebInspector.DataGrid.prototype.removeChildren):
+        (WebInspector.DataGridNode.prototype.set hasChildren):
+        (WebInspector.DataGridNode.prototype.get hasChildren):
+        * inspector/front-end/ProfileDataGridTree.js: Added.
+        (WebInspector.ProfileDataGridNode):
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        (WebInspector.ProfileDataGridNode.prototype.select):
+        (WebInspector.ProfileDataGridNode.prototype.deselect):
+        (WebInspector.ProfileDataGridNode.prototype.expand):
+        (WebInspector.ProfileDataGridNode.prototype.insertChild):
+        (WebInspector.ProfileDataGridNode.prototype.removeChild):
+        (WebInspector.ProfileDataGridNode.prototype.removeChildren):
+        (WebInspector.ProfileDataGridNode.prototype.findChild):
+        (WebInspector.ProfileDataGridNode.prototype.get averageTime):
+        (WebInspector.ProfileDataGridNode.prototype.get averagePercent):
+        (WebInspector.ProfileDataGridNode.prototype.get selfPercent):
+        (WebInspector.ProfileDataGridNode.prototype.get totalPercent):
+        (WebInspector.ProfileDataGridNode.prototype._save):
+        (WebInspector.ProfileDataGridNode.prototype._restore):
+        (WebInspector.ProfileDataGridNode.prototype._merge):
+        (WebInspector.ProfileDataGridTree):
+        (WebInspector.ProfileDataGridTree.prototype.get expanded):
+        (WebInspector.ProfileDataGridTree.prototype.appendChild):
+        (WebInspector.ProfileDataGridTree.prototype.insertChild):
+        (WebInspector.ProfileDataGridTree.prototype.removeChildren):
+        (WebInspector.ProfileDataGridTree.prototype.findChild.WebInspector.ProfileDataGridNode.prototype.findChild.sort.WebInspector.ProfileDataGridNode.prototype.sort._save):
+        (WebInspector.ProfileDataGridTree.propertyComparator.comparator):
+        (WebInspector.ProfileDataGridTree.propertyComparator.else.comparator):
+        (WebInspector.ProfileDataGridTree.propertyComparator):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.set profile):
+        (WebInspector.ProfileView.prototype.get bottomUpProfileDataGridTree):
+        (WebInspector.ProfileView.prototype.get topDownProfileDataGridTree):
+        (WebInspector.ProfileView.prototype.get currentTree):
+        (WebInspector.ProfileView.prototype.set currentTree):
+        (WebInspector.ProfileView.prototype.get topDownTree):
+        (WebInspector.ProfileView.prototype.get bottomUpTree):
+        (WebInspector.ProfileView.prototype.refresh):
+        (WebInspector.ProfileView.prototype.refreshVisibleData):
+        (WebInspector.ProfileView.prototype.refreshShowAsPercents):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        (WebInspector.ProfileView.prototype.performSearch):
+        (WebInspector.ProfileView.prototype._changeView):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        (WebInspector.ProfileView.prototype._sortProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype.searchMatchFound):
+        * inspector/front-end/TopDownProfileDataGridTree.js: Added.
+        (WebInspector.TopDownProfileDataGridNode):
+        (WebInspector.TopDownProfileDataGridNode.prototype._populate):
+        (WebInspector.TopDownProfileDataGridNode.prototype._exclude):
+        (WebInspector.TopDownProfileDataGridTree):
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-04-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Use static functions (and a couple templates)
+        to further reduce the amount of copy/paste code in SVGRenderTreeAsText
+
+        No test changes, only code cleanup.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeNameValuePair):
+        (WebCore::writeNameAndQuotedValue):
+        (WebCore::writeIfNotEmpty):
+        (WebCore::writeIfNotDefault):
+        (WebCore::writeStyle):
+        (WebCore::writePositionAndStyle):
+        (WebCore::operator<<):
+
+2009-04-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        SVGRenderTreeAsText cleanup/code sharing.
+
+        No test changes, only code cleanup.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::firstRunOrigin):
+        * rendering/RenderText.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStandardPrefix):
+        (WebCore::writeChildren):
+        (WebCore::write):
+        (WebCore::writeRenderResources):
+
+2009-04-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore part of fix for <rdar://problem/6333461> REGRESSION 
+        (r36864-r36869): Dragging stocks widget scrollbar drags the whole 
+        widget
+
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isScrollbar):
+        * platform/Widget.h:
+        (WebCore::Widget::isScrollbar):
+
+2009-04-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6808109> "Deletion UI" is not available for many
+        portions of HTML content
+
+        This patch makes the deletion UI show up in some new situations:
+        1) If a block's background color is different from its parent's
+        2) If a block has a background image.
+        3) If a block has a single visible border.
+        However the block must now not only be at least a minimum width and
+        height, but also exceed a minimum area.  In practice this has led to
+        much better element selection. 
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-04-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding XMLTokenizerScope.cpp to the build.
+
+        * WebCoreSources.bkl:
+
+2009-04-23  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6788905> REGRESSION (41928?): hang in Position::upstream
+        https://bugs.webkit.org/show_bug.cgi?id=25312
+
+        I was unable to reproduce the problem, but I'm pretty sure this will fix it.
+
+        * rendering/RenderObject.cpp: (WebCore::RenderObject::createVisiblePosition):
+        Since VisiblePosition doesn't ensure the offset is good, we shouldn't pass max int as an offset.
+
+2009-04-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25313
+        Missing scroll bars in GMail.
+
+        Test: fast/overflow/overflow-y-scroll.html
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars): Added check for the ScrollbarAlwaysOn
+        scroll mode.
+
+2009-04-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        - fix <rdar://problem/6081309> Mail crash when pressing down arrow in
+          some messages in WebCore::canHaveChildrenForEditing
+
+        Test: editing/selection/extend-by-line-anonymous-content-crash.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition): Null-check node. If p is not an
+        editable position, then closestLeafChildForXPos() may have returned a
+        non-editable box, and in particular one belonging to anonymous content.
+        If node is 0, fall back on RenderObject::positionForPoint, which
+        finds the closest position in non-anonymous content.
+        (WebCore::nextLinePosition): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Fixed a typo.
+
+2009-04-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6791439> REGRESSION: Get an error page instead of login page navigating back in gmail
+
+        Test: http/tests/history/back-to-post.php
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        Apply a new cache policy if it changed after the platform request was first created.
+        While at it, also made sure to update timeout.
+
+2009-04-23  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        When creating a new drawable object, collect system's
+        information about the best depth it can provide and use it
+        in a new colormap that the new drawable requires.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-04-23  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15654
+        GdkPixbuf support for ImageCairo
+
+        Add support for converting a Cairo surface to a GdkPixbuf.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        (WebCore::Image::getGdkPixbuf):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-04-23  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make windowed plugins (on X11, Qt) behave nicer with wheel scrolling.
+
+        Basically, what we want is to send wheel events to the plugin *only*
+        when it has focus, or else send it to the parent frame.
+
+        This is a work around, and basically what we do, is to steal the
+        wheel events from the plugin, modify the window ID, and put the
+        event back into the Qt event loop.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginClientWrapper::PluginClientWrapper):
+        (PluginClientWrapper::~PluginClientWrapper):
+        (PluginClientWrapper::x11Event):
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::~PluginContainerQt):
+        (PluginContainerQt::on_clientClosed):
+        (PluginContainerQt::on_clientIsEmbedded):
+        (PluginContainerQt::redirectWheelEventsToParent):
+        (PluginContainerQt::x11Event):
+        (PluginContainerQt::focusInEvent):
+        * plugins/qt/PluginContainerQt.h:
+
+2009-04-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/6786961> - "Are you sure you want to resubmit this form?" nag displays twice.
+
+        For most loads, we were consulting the navigation policy delegate twice.  Once from FrameLoader before
+        the load started and once from MainResourceLoader in its willSendRequest callback.
+
+        In the past we tried removing MainResourceLoader's call altogether.  This caused a regression where urls 
+        that redirect to a url handled by an external application would no longer work in Safari.  It probably 
+        also broke other WebKit apps in subtle ways.
+
+        Changing MainResourceLoader to make the check only on redirects fixes both bugs.  We now only call the 
+        policy delegate once for most standard loads, but we do correctly call it a second time for redirects.
+
+        Tests: http/tests/misc/policy-delegate-called-twice.html
+               http/tests/misc/redirect-to-external-url.html
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest): Call the navigation policy delegate only for redirects.
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/6800695>
+
+        Add a hack to only allow navigating (via a link from a http page)
+        to feed: urls (same for feeds: and feedsearch:) that map to http:
+        or https: via their nested protocol. This includes both feed://example.com
+        and feed:http://example.com.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isFeedWithNestedProtocolInHTTPFamily):
+        (WebCore::FrameLoader::loadFrameRequest):
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Autogenerate the XMLHttpRequest constructor getter/setter for the
+        WorkerContext and remove the now no longer needed JSWorkerContextBase.lut.h
+        file.
+
+        * DerivedSources.make: Remove JSWorkerContextBase.lut.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/JSWorkerContextBase.h: Remove code to support hand written
+        code for XMLHttpRequest constructor lookup and shadowing.
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::customGetOwnPropertySlot): Remove JSC prefixes.
+        (WebCore::JSWorkerContext::xmlHttpRequest): Added. Custom implementation of
+        cached constructor lookup.
+        * workers/WorkerContext.idl: Make the XMLHttpRequestConstructor accessor not
+        V8 specific.
+
+2009-04-22  Darin Adler  <darin@apple.com>
+
+        * page/Navigator.idl: Touch this file to fix build since Geolocation
+        configuration was recently turned off.
+
+2009-04-22  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25322
+        Can't delete empty paragraph after a block image
+        
+        Empty paragraph removal would have been handled by mergeParagraphs, but we stopped short
+        because of some code that avoided problems that would arise from Positions that would go
+        bad during deletion.  
+        
+        We have several checks that prevent us from using bad Positions, this one in particular
+        was added to avoid bad Positions that result from text removal.  So, I removed the check
+        and started correctly updating m_downstreamEnd during text removal so that it doesn't go
+        bad.  m_upstreamStart doesn't need to be updated during text removal, since only text
+        after it will ever be removed.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::deleteTextFromNode):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6757346> SAP: Prevent default on mouseDown does not stop iframe from capturing subsequent mouse moves
+
+        Make mouseUp target the correct frame when the original
+        mousedown made the drag non-capturing.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6757346> SAP: Prevent default on mouseDown does not stop iframe from capturing subsequent mouse moves
+
+        This is the first step of allowing drag events to match the behaviour
+        of mouse move events when the default action of the initial mouse down
+        is prevented.  Remaining issue is that the final mouse up event still
+        targets the original root frame.
+
+        Test: fast/events/mouse-drag-from-frame-to-other-frame.html
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+
+2009-04-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+        
+        <rdar://problem/6702882> QT movie's video fails to be displayed after switching between tabs
+        <rdar://problem/6754957> Resizing Web browser window and hitting play will cause video blocks and artifacting
+
+        When in a media document, MediaPlayerPrivateQTKit uses a QTMovieView which may get
+        layer backing under some circumstances. However, drawing the view via
+        displayRectIgnoringOpacity:inContext: bypasses any layer setup that AppKit normally performs.
+        So when in the media document, we draw via displayRectIgnoringOpacity:.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-04-22  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash in Mail when forwarding a specific HTML email.
+        Caused by the fix for <rdar://problem/6512520> (r42096).
+        Unable to create a test case that works outside of Mail.
+
+        <rdar://problem/6796069>
+
+        Reviewed by Ada Chan.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Null check pastEnd before trying to
+        call Range::compareBoundaryPoints.
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Fix for <rdar://problem/6816957>
+        Turn off Geolocation by default
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-04-22  Eric Seidel  <eric@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Change RenderSVGImage to dump as RenderSVGImage instead of RenderImage
+
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::renderName):
+
+2009-04-21  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash on Gmail when they remove a "before unload" event listener when
+        it was never added to the pending map in the first place.
+
+        <rdar://problem/6814144>
+
+        Reviewed by Darin Adler.
+
+        * page/DOMWindow.cpp:
+        (WebCore::allowsPendingBeforeUnloadListeners): Renamed from shouldAddPendingBeforeUnloadListener.
+        (WebCore::DOMWindow::addEventListener): Call allowsPendingBeforeUnloadListeners now.
+        (WebCore::DOMWindow::removeEventListener): Call allowsPendingBeforeUnloadListeners before
+        removing the before unload listener.
+        (WebCore::DOMWindow::clearAttributeEventListener): Ditto.
+
+2009-04-22  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Made windowed plugins move/resize synchronized with the painting, so
+        that windowed plugins are not moved before the rest of the parent
+        frame during scrolling.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::requestGeometry):
+        (PluginContainerQt::adjustGeometry):
+        * plugins/qt/PluginContainerQt.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-04-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix various bugs in the X11 Qt plugin focus handling.
+
+        Notify the focus controller on activation/deactivation of the plugin and
+        set focus on the plugin's element when it receives the window system
+        focus.
+
+        * WebCore.pro: Added PluginContainerQt to the Qt build.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::focusPluginElement): New helper function, moved from PluginViewWin.
+        * plugins/PluginView.h:
+        (WebCore::PluginView::parentFrame): Added parent frame accessor.
+        * plugins/qt/PluginContainerQt.cpp: Added.
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::focusInEvent): Set the focus controller active on focus in events.
+        (PluginContainerQt::focusOutEvent): Deactivate the focus controller when loosing the focus.
+        * plugins/qt/PluginContainerQt.h: Added.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::init): Allocate a PluginContainerQt instead of QX11EmbedContainer.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::handleMouseEvent): Moved the code to set focus on the plugin element
+        to PluginView::focusPluginElement.
+
+2009-04-22  Tamas Szirbucz  <szirbucz.tamas@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25023
+        Delete reply in QNetworkReplyHandler::abort() to avoid leak.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+
+2009-04-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Allow the UI delegate to control cursor-setting.
+
+        Reviewed by Ada Chan.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::setCursor):
+        Pass the call to the client.
+
+        * page/Chrome.h:
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::setCursor):
+        Stubbed; returns false.
+
+        * platform/Cursor.h:
+        Define PlatformCursorHandle for each platform.
+
+        * platform/win/WidgetWin.cpp:
+        Reordered some includes. Added an include of Page.h.
+        (WebCore::Widget::setCursor):
+        Fixed a typo in the comment about ignoreNextSetCursor. Get the Page, and
+        call its Chrome's setCursor() method with the passed cursor. Fall back
+        to SetCursor() if the Page is not available.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+        Remove an unused variable. Cleaned up some whitespace.
+
+2009-04-21  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a method to purge the Chromium plugin list cache.
+        https://bugs.webkit.org/show_bug.cgi?id=25318
+
+        * plugins/chromium/PluginDataChromium.cpp:
+        (WebCore::resetChromiumPluginCache):
+
+2009-04-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25164> / <rdar://problem/6786319>.
+
+        We need to ensure that XMLTokenizer sets the current DocLoader before calling in to
+        any libxml2 methods that may trigger a load.  The presence of a DocLoader indicates
+        that the load was originated by WebCore's use of libxml2 and that we should enforce
+        the same-origin policy on it.  XMLTokenizer::initializeParserContext,
+        XMLTokenizer::doWrite and XMLTokenizer::doEnd were three methods that were not setting
+        the current DocLoader when they should have.
+
+        The XMLTokenizerScope class is introduced to simplify the pattern of saving, setting and
+        restoring the current DocLoader and libxml2 error handlers.  The DocLoader and error handlers
+        are saved and set when the scope is allocated, and restored to their previous values when
+        the scope is exited.
+
+        Test: http/tests/security/xss-DENIED-xml-external-entity.xhtml
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::shouldAllowExternalLoad):
+        (WebCore::openFunc):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::xmlDocPtrForString):
+        * dom/XMLTokenizerScope.cpp:
+        (WebCore::XMLTokenizerScope::XMLTokenizerScope):
+        (WebCore::XMLTokenizerScope::~XMLTokenizerScope):
+        * dom/XMLTokenizerScope.h:
+        * xml/XSLStyleSheet.cpp:
+        (WebCore::XSLStyleSheet::parseString):
+        * xml/XSLTProcessor.cpp:
+
+2009-04-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5874009>
+        Add port 3659 (apple-sasl / PasswordServer) to the list of blocked ports.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::portAllowed):
+
+2009-04-21  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25320
+        Crash when changing block styles in a root that contains no visible content (but contains nodes with renderers)
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): If the enclosing block is the 
+        root editable element and it contains no visible content, create a new block but don't try and move 
+        content into it, since there's nothing for moveParagraphs to move.
+        
+
+2009-04-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25162: REGRESSION (r41176-r41242): Drag-selection above/below the line does not select to beginning/end
+        https://bugs.webkit.org/show_bug.cgi?id=25162
+        rdar://problem/6764354
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize editing behavior to Mac-style for PLATFORM(MAC).
+        Later we may want to change this default to encompass other versions running on Mac.
+
+        * page/Settings.h: Added EditingBehavior, setEditingBehavior, editingBehavior, and
+        m_editingBehavior. Also moved m_maximumDecodedImageSize out of the middle of all
+        the bit fields.
+
+        * platform/graphics/IntPoint.h: Added a constructor to turn an IntSize into an IntPoint.
+        I'm not sure the distinction here is serving us well at the moment. When converting from
+        global to local coordinates you want to do IntPoint - IntPoint and have the result be
+        another IntPoint, not an IntSize. And so on.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries): Changed to use pointers more and
+        separate coordinates less.
+        (WebCore::RenderBlock::positionForPointWithInlineChildren): Turned into a member function.
+        Added separate cases to support the Mac and Windows behavior.
+        (WebCore::RenderBlock::positionForPoint): Updated for the change above. Also moved the
+        computation of pointInContents closer to the place it's used.
+
+        * rendering/RenderBlock.h: Updated for the new private member function.
+
+2009-04-17  Timothy Hatcher  <timothy@apple.com>
+
+        Change pending unload and beforeunload counts to store the listeners
+        in a single data structure that can be quickly iterated for dispatch.
+
+        <rdar://problem/6383352&6383379&6383940>
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp: Change what symbols are exported.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Remove count updating code
+        and move an if inside a block already checking m_frame->document().
+        * page/Chrome.cpp: Remove disableSuddenTermination/enableSuddenTermination.
+        * page/Chrome.h: Ditto.
+        * page/ChromeClient.h: Ditto.
+        * page/DOMWindow.cpp:
+        (WebCore::pendingUnloadEventListenerMap): Create a static map.
+        (WebCore::pendingBeforeUnloadEventListenerMap): Ditto.
+        (WebCore::addPendingEventListener): Add the event listener to the map.
+        (WebCore::removePendingEventListener): Remove the event listener from the map.
+        (WebCore::removePendingEventListeners): Remove all listeners for the window.
+        (WebCore::dispatchWindowEventToListeners): Dispatch the event to the given listeners.
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents): Send the beforeunload event.
+        (WebCore::DOMWindow::pendingUnloadEventListeners): Return a count of pending listeners.
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Send the unload event.
+        (WebCore::DOMWindow::~DOMWindow): Remove the window from both event listener maps.
+        (WebCore::DOMWindow::addEventListener): Call addPendingEventListener when needed.
+        (WebCore::DOMWindow::removeEventListener): Call removePendingEventListener when needed.
+        (WebCore::DOMWindow::removeAllEventListeners): Call removePendingEventListeners.
+        (WebCore::DOMWindow::removeInlineEventListenerForType): Call removePendingEventListener when needed.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::frame): Changed to be const.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Remove count tracking code.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Ditto.
+        * page/Page.h: Ditto.
+
+2009-04-21  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19644
+        Text copied with Select All pastes with a indent but shouldn't
+        <rdar://problem/6102483> 
+        Pasting the content of an HTML message in Mail causes addition nested <div> elements to be added
+        
+        To improve selectall/copy/paste fidelity of certain pages, we began wrapping copied content with
+        a div that held properties and attributes from the fully selected body.  To fix the above issues, 
+        only do this if if the body has certain properties or attributes.  We'll begin adding to this list as 
+        necessary.  For now it's just background colors and images.  Tested copy/paste of nytimes, wired,
+        arstechnica, and several others.
+        
+        Massive nesting can still happen, it will just be much less common.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): 
+
+2009-04-21  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25250
+        Allow platforms to snap the scroll thumb back to the drag origin
+        during a drag.  Implement functions for Safari/Win and Chromium/Win
+        to do this snapping at distances approximating the native ones.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::setValue):
+        (WebCore::Scrollbar::scroll):
+        (WebCore::Scrollbar::moveThumb):
+        (WebCore::Scrollbar::setCurrentPos):
+        (WebCore::Scrollbar::mouseMoved):
+        (WebCore::Scrollbar::mouseDown):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::shouldSnapBackToDragOrigin):
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::shouldSnapBackToDragOrigin):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromium::shouldSnapBackToDragOrigin):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeWin::shouldSnapBackToDragOrigin):
+        * platform/win/ScrollbarThemeWin.h:
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName): Remove unreachable code when SVG is
+        enabled.
+
+2009-04-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        !ENABLE(SVG) build fix.
+        
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName):
+
+2009-04-21  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25309
+        Better use AtomicStrings when calling from the V8
+        bindings into WebCore code.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+
+2009-04-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+ 
+        Bug 25304: AX: Safari not identifying a secure text field
+        https://bugs.webkit.org/show_bug.cgi?id=25304
+
+        Secure text fields need to be able to return AXTitleUIElements.
+
+        Test: accessibility/secure-textfield-title-ui.html
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-04-21  Dan Bernstein  <mitz@apple.com>
+
+        - fix the Tiger build
+
+        * page/mac/EventHandlerMac.mm:
+        (method_setImplementation):
+
+2009-04-21   Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25271
+
+        Fix the build with disabled DOM storage or disabled database support.
+
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        * bindings/js/ScriptObjectQuarantine.h:
+
+2009-04-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Compile fix for r42633. const qualifier does not work
+        on a static method.
+
+        * dom/Document.h:
+        (WebCore::Document::isSVGDocument):
+
+2009-04-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler and John Sullivan.
+
+        - fix <rdar://problem/5914146> Crash at -[NSScrollView scrollWheel:]
+
+        -[NSScrollView scrollWheel:] runs a nested event-tracking run loop
+        in a mode that allows WebCore timers to fire and NSURLConnection
+        callbacks to be dispatched, which can release the NSScrollView and
+        cause it to be deallocated (one example is a DOM timer callback that
+        removes a subframe from the document). This leads to a crash in
+        -scrollView:.
+
+        The fix is to replace the implementation of -[NSScrollView scrollWheel:]
+        with one that optionally retains the receiver for the duration of the
+        call.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::nsScrollViewScrollWheelShouldRetainSelf): Added.
+        (WebCore::setNSScrollViewScrollWheelShouldRetainSelf): Added. Replaces
+        the implementation of -[NSScrollView scrollWheel:] with the
+        self-retaining one, and sets a static boolean that tells it whether to
+        retain the receiver around the call to the original implementation.
+        (WebCore::selfRetainingNSScrollViewScrollWheel): Added. If
+        setNSScrollViewScrollWheelShouldRetainSelf(true) was called and this
+        function is executing on the main thread, it retains the NSScrollView,
+        invokes the original -[NSScrollView scrollWheel:], then releases the
+        view. Otherwise it just calls through to the original implementation.
+        (WebCore::EventHandler::passWheelEventToWidget): Added calls to
+        setNSScrollViewScrollWheelShouldRetainSelf() around the call to
+        -scrollWheel:.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Tiger crash fix: Put VM tags in their own header file, and fixed up the
+        #ifdefs so they're not used on Tiger.
+
+        * ForwardingHeaders/wtf/VMTags.h: Copied from WebCore/ForwardingHeaders/wtf/HashTraits.h.
+
+2009-04-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkComponent interface.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (core):
+
+2009-04-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Only implement AtkAction interface if we actually have an action.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25290
+        REGRESSION(r41732): Crash when constructing XMLHttpRequest in a detached document
+
+        Test: fast/dom/xmlhttprequest-constructor-in-detached-document.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        Avoid accessing JSDOMGlobalObject via ScriptExecutionContext, since it may not
+        work during frame teardown.
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Darin Adler and Sam Weinig.
+
+        Renamed "*InlineEventListener*" => "*AttributeEventListener*", and
+        "isInline" => "isAttribute".
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::virtualisAttribute):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        (WebCore::JSEventListener::isAttribute):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/JSLazyEventListener.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Element.cpp:
+        (WebCore::Element::setWindowAttributeEventListener):
+        * dom/Element.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::isAttribute):
+        (WebCore::EventListener::virtualisAttribute):
+        * dom/Node.cpp:
+        (WebCore::Node::clearAttributeEventListener):
+        (WebCore::Node::setAttributeEventListener):
+        (WebCore::Node::getAttributeEventListener):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::onblur):
+        (WebCore::Node::setOnblur):
+        (WebCore::Node::onchange):
+        (WebCore::Node::setOnchange):
+        (WebCore::Node::onclick):
+        (WebCore::Node::setOnclick):
+        (WebCore::Node::oncontextmenu):
+        (WebCore::Node::setOncontextmenu):
+        (WebCore::Node::ondblclick):
+        (WebCore::Node::setOndblclick):
+        (WebCore::Node::onerror):
+        (WebCore::Node::setOnerror):
+        (WebCore::Node::onfocus):
+        (WebCore::Node::setOnfocus):
+        (WebCore::Node::oninput):
+        (WebCore::Node::setOninput):
+        (WebCore::Node::onkeydown):
+        (WebCore::Node::setOnkeydown):
+        (WebCore::Node::onkeypress):
+        (WebCore::Node::setOnkeypress):
+        (WebCore::Node::onkeyup):
+        (WebCore::Node::setOnkeyup):
+        (WebCore::Node::onload):
+        (WebCore::Node::setOnload):
+        (WebCore::Node::onmousedown):
+        (WebCore::Node::setOnmousedown):
+        (WebCore::Node::onmousemove):
+        (WebCore::Node::setOnmousemove):
+        (WebCore::Node::onmouseout):
+        (WebCore::Node::setOnmouseout):
+        (WebCore::Node::onmouseover):
+        (WebCore::Node::setOnmouseover):
+        (WebCore::Node::onmouseup):
+        (WebCore::Node::setOnmouseup):
+        (WebCore::Node::onmousewheel):
+        (WebCore::Node::setOnmousewheel):
+        (WebCore::Node::onbeforecut):
+        (WebCore::Node::setOnbeforecut):
+        (WebCore::Node::oncut):
+        (WebCore::Node::setOncut):
+        (WebCore::Node::onbeforecopy):
+        (WebCore::Node::setOnbeforecopy):
+        (WebCore::Node::oncopy):
+        (WebCore::Node::setOncopy):
+        (WebCore::Node::onbeforepaste):
+        (WebCore::Node::setOnbeforepaste):
+        (WebCore::Node::onpaste):
+        (WebCore::Node::setOnpaste):
+        (WebCore::Node::ondragenter):
+        (WebCore::Node::setOndragenter):
+        (WebCore::Node::ondragover):
+        (WebCore::Node::setOndragover):
+        (WebCore::Node::ondragleave):
+        (WebCore::Node::setOndragleave):
+        (WebCore::Node::ondrop):
+        (WebCore::Node::setOndrop):
+        (WebCore::Node::ondragstart):
+        (WebCore::Node::setOndragstart):
+        (WebCore::Node::ondrag):
+        (WebCore::Node::setOndrag):
+        (WebCore::Node::ondragend):
+        (WebCore::Node::setOndragend):
+        (WebCore::Node::onreset):
+        (WebCore::Node::setOnreset):
+        (WebCore::Node::onresize):
+        (WebCore::Node::setOnresize):
+        (WebCore::Node::onscroll):
+        (WebCore::Node::setOnscroll):
+        (WebCore::Node::onsearch):
+        (WebCore::Node::setOnsearch):
+        (WebCore::Node::onselect):
+        (WebCore::Node::setOnselect):
+        (WebCore::Node::onselectstart):
+        (WebCore::Node::setOnselectstart):
+        (WebCore::Node::onsubmit):
+        (WebCore::Node::setOnsubmit):
+        (WebCore::Node::onunload):
+        (WebCore::Node::setOnunload):
+        * dom/Node.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setAttributeEventListener):
+        (WebCore::DOMWindow::clearAttributeEventListener):
+        (WebCore::DOMWindow::getAttributeEventListener):
+        (WebCore::DOMWindow::onabort):
+        (WebCore::DOMWindow::setOnabort):
+        (WebCore::DOMWindow::onblur):
+        (WebCore::DOMWindow::setOnblur):
+        (WebCore::DOMWindow::onchange):
+        (WebCore::DOMWindow::setOnchange):
+        (WebCore::DOMWindow::onclick):
+        (WebCore::DOMWindow::setOnclick):
+        (WebCore::DOMWindow::ondblclick):
+        (WebCore::DOMWindow::setOndblclick):
+        (WebCore::DOMWindow::onerror):
+        (WebCore::DOMWindow::setOnerror):
+        (WebCore::DOMWindow::onfocus):
+        (WebCore::DOMWindow::setOnfocus):
+        (WebCore::DOMWindow::onkeydown):
+        (WebCore::DOMWindow::setOnkeydown):
+        (WebCore::DOMWindow::onkeypress):
+        (WebCore::DOMWindow::setOnkeypress):
+        (WebCore::DOMWindow::onkeyup):
+        (WebCore::DOMWindow::setOnkeyup):
+        (WebCore::DOMWindow::onload):
+        (WebCore::DOMWindow::setOnload):
+        (WebCore::DOMWindow::onmousedown):
+        (WebCore::DOMWindow::setOnmousedown):
+        (WebCore::DOMWindow::onmousemove):
+        (WebCore::DOMWindow::setOnmousemove):
+        (WebCore::DOMWindow::onmouseout):
+        (WebCore::DOMWindow::setOnmouseout):
+        (WebCore::DOMWindow::onmouseover):
+        (WebCore::DOMWindow::setOnmouseover):
+        (WebCore::DOMWindow::onmouseup):
+        (WebCore::DOMWindow::setOnmouseup):
+        (WebCore::DOMWindow::onmousewheel):
+        (WebCore::DOMWindow::setOnmousewheel):
+        (WebCore::DOMWindow::onreset):
+        (WebCore::DOMWindow::setOnreset):
+        (WebCore::DOMWindow::onresize):
+        (WebCore::DOMWindow::setOnresize):
+        (WebCore::DOMWindow::onscroll):
+        (WebCore::DOMWindow::setOnscroll):
+        (WebCore::DOMWindow::onsearch):
+        (WebCore::DOMWindow::setOnsearch):
+        (WebCore::DOMWindow::onselect):
+        (WebCore::DOMWindow::setOnselect):
+        (WebCore::DOMWindow::onsubmit):
+        (WebCore::DOMWindow::setOnsubmit):
+        (WebCore::DOMWindow::onunload):
+        (WebCore::DOMWindow::setOnunload):
+        (WebCore::DOMWindow::onbeforeunload):
+        (WebCore::DOMWindow::setOnbeforeunload):
+        (WebCore::DOMWindow::onwebkitanimationstart):
+        (WebCore::DOMWindow::setOnwebkitanimationstart):
+        (WebCore::DOMWindow::onwebkitanimationiteration):
+        (WebCore::DOMWindow::setOnwebkitanimationiteration):
+        (WebCore::DOMWindow::onwebkitanimationend):
+        (WebCore::DOMWindow::setOnwebkitanimationend):
+        (WebCore::DOMWindow::onwebkittransitionend):
+        (WebCore::DOMWindow::setOnwebkittransitionend):
+        * page/DOMWindow.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::onabort):
+        (WebCore::SVGElementInstance::setOnabort):
+        (WebCore::SVGElementInstance::onblur):
+        (WebCore::SVGElementInstance::setOnblur):
+        (WebCore::SVGElementInstance::onchange):
+        (WebCore::SVGElementInstance::setOnchange):
+        (WebCore::SVGElementInstance::onclick):
+        (WebCore::SVGElementInstance::setOnclick):
+        (WebCore::SVGElementInstance::oncontextmenu):
+        (WebCore::SVGElementInstance::setOncontextmenu):
+        (WebCore::SVGElementInstance::ondblclick):
+        (WebCore::SVGElementInstance::setOndblclick):
+        (WebCore::SVGElementInstance::onerror):
+        (WebCore::SVGElementInstance::setOnerror):
+        (WebCore::SVGElementInstance::onfocus):
+        (WebCore::SVGElementInstance::setOnfocus):
+        (WebCore::SVGElementInstance::oninput):
+        (WebCore::SVGElementInstance::setOninput):
+        (WebCore::SVGElementInstance::onkeydown):
+        (WebCore::SVGElementInstance::setOnkeydown):
+        (WebCore::SVGElementInstance::onkeypress):
+        (WebCore::SVGElementInstance::setOnkeypress):
+        (WebCore::SVGElementInstance::onkeyup):
+        (WebCore::SVGElementInstance::setOnkeyup):
+        (WebCore::SVGElementInstance::onload):
+        (WebCore::SVGElementInstance::setOnload):
+        (WebCore::SVGElementInstance::onmousedown):
+        (WebCore::SVGElementInstance::setOnmousedown):
+        (WebCore::SVGElementInstance::onmousemove):
+        (WebCore::SVGElementInstance::setOnmousemove):
+        (WebCore::SVGElementInstance::onmouseout):
+        (WebCore::SVGElementInstance::setOnmouseout):
+        (WebCore::SVGElementInstance::onmouseover):
+        (WebCore::SVGElementInstance::setOnmouseover):
+        (WebCore::SVGElementInstance::onmouseup):
+        (WebCore::SVGElementInstance::setOnmouseup):
+        (WebCore::SVGElementInstance::onmousewheel):
+        (WebCore::SVGElementInstance::setOnmousewheel):
+        (WebCore::SVGElementInstance::onbeforecut):
+        (WebCore::SVGElementInstance::setOnbeforecut):
+        (WebCore::SVGElementInstance::oncut):
+        (WebCore::SVGElementInstance::setOncut):
+        (WebCore::SVGElementInstance::onbeforecopy):
+        (WebCore::SVGElementInstance::setOnbeforecopy):
+        (WebCore::SVGElementInstance::oncopy):
+        (WebCore::SVGElementInstance::setOncopy):
+        (WebCore::SVGElementInstance::onbeforepaste):
+        (WebCore::SVGElementInstance::setOnbeforepaste):
+        (WebCore::SVGElementInstance::onpaste):
+        (WebCore::SVGElementInstance::setOnpaste):
+        (WebCore::SVGElementInstance::ondragenter):
+        (WebCore::SVGElementInstance::setOndragenter):
+        (WebCore::SVGElementInstance::ondragover):
+        (WebCore::SVGElementInstance::setOndragover):
+        (WebCore::SVGElementInstance::ondragleave):
+        (WebCore::SVGElementInstance::setOndragleave):
+        (WebCore::SVGElementInstance::ondrop):
+        (WebCore::SVGElementInstance::setOndrop):
+        (WebCore::SVGElementInstance::ondragstart):
+        (WebCore::SVGElementInstance::setOndragstart):
+        (WebCore::SVGElementInstance::ondrag):
+        (WebCore::SVGElementInstance::setOndrag):
+        (WebCore::SVGElementInstance::ondragend):
+        (WebCore::SVGElementInstance::setOndragend):
+        (WebCore::SVGElementInstance::onreset):
+        (WebCore::SVGElementInstance::setOnreset):
+        (WebCore::SVGElementInstance::onresize):
+        (WebCore::SVGElementInstance::setOnresize):
+        (WebCore::SVGElementInstance::onscroll):
+        (WebCore::SVGElementInstance::setOnscroll):
+        (WebCore::SVGElementInstance::onsearch):
+        (WebCore::SVGElementInstance::setOnsearch):
+        (WebCore::SVGElementInstance::onselect):
+        (WebCore::SVGElementInstance::setOnselect):
+        (WebCore::SVGElementInstance::onselectstart):
+        (WebCore::SVGElementInstance::setOnselectstart):
+        (WebCore::SVGElementInstance::onsubmit):
+        (WebCore::SVGElementInstance::setOnsubmit):
+        (WebCore::SVGElementInstance::onunload):
+        (WebCore::SVGElementInstance::setOnunload):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Approved by Mark Rowe, Cameron Zwarich, Oliver Hunt, and Ojan Vafai.
+        
+        Used svn merge to roll out revisions 42678, 42690, 42694, 42697 because
+        they broke the Tiger and Windows buildbots.
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        * rendering/RenderTextControl.cpp:
+        * rendering/RenderTextControlMultiLine.cpp:
+        * rendering/RenderTextControlSingleLine.cpp:
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        One last loose end, discovered using COLLECT_ON_EVERY_ALLOCATION, for
+        https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark): Don't ASSERT that an ElementInstance's
+        correspondingElement has a JS wrapper. If a GC falls exactly between the
+        allocation of the ElementInstance wrapper and the correspondingElement
+        wrapper, the correspondingElement won't have a wrapper at the time we
+        mark the ElementInstance's wrapper.
+
+2009-04-20  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe
+
+        Clean builds are broken on case-sensitive filesystems.  Let's fix, shall we?
+
+        * platform/graphics/SimpleFontData.cpp: Remove "String.h" include.  Ojan probably intended to include
+          "PlatformString.h" which was unnecessary because it is pulled in through other headers.  This wasn't a 
+          build failure on case-insensitive file systems because those systems would find the system <string.h>, averting
+          the warning.
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Last patch for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Converted "lazy" event listeners to be unprotected, just like all the others.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::virtualIsInline):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::isInline): Merged JSAbstractEventListener
+        into JSEventListener. Now that the only difference between JSEventListener
+        and JSLazyEventListener is that JSLazyEventListener compiles lazily,
+        there's no need for an abstract base class.
+
+        * bindings/js/JSLazyEventListener.cpp: Converted JSLazyEventListener to
+        inherit from JSEventListener and match its un-GC-protected behavior.
+        (WebCore::JSLazyEventListener::JSLazyEventListener): ditto
+        (WebCore::JSLazyEventListener::parseCode): ditto
+        (WebCore::createInlineEventListener): When creating a lazy event listener,
+        ensure that the related node has a JS wrapper to mark the listener. Since
+        the parser makes these listeners, it's possible that no JS reference has
+        been made to the node yet.
+        * bindings/js/JSLazyEventListener.h: ditto
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::clearJSFunction): Removed an usused function.
+
+2009-04-20  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25299
+        Don't bound caret to root line box if it is still inside its containing block
+        
+        Can't yet write tests for behavior of non-standard caret widths.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate JavaScriptCore.dll from WebKit.dll.
+        Slight performance improvement or no change on benchmarks.
+        
+        Allows us to break a circular dependency between CFNetwork and WebKit on Windows,
+        and simplifies standalone JavaScriptCore builds.
 
         Reviewed by Oliver Hunt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24498
-        Fix the Qt port to use the same algorithm for drawing dashed and dotted
-        borders as the other ports.  This makes the Qt port pixel-for-pixel perfect
-        compared to border drawing with Apple's canonical mac port and much closer
-        to konqueror and firefox behavior.
+        * config.h: Specify __declspec(dllexport/dllimport) appropriately when exporting data.
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawLine):
+2009-04-20  Anders Carlsson  <andersca@apple.com>
 
-2009-03-09  Adam Treat  <adam.treat@torchmobile.com>
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6722845> In the Cocoa event model, NPWindow's window field should be null
+
+        * bridge/npapi.h:
+        (_NPCocoaEvent::):
+        Add a CGContextRef member to the draw struct. Add an NPCoordinateSpace enum.
+        
+        * plugins/npfunctions.h:
+        Add a prototype for NPN_ConvertPoint.
+
+2009-04-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make textarea and text input metrics more closely match IEs.
+        https://bugs.webkit.org/show_bug.cgi?id=15312
+
+        This involves:
+        -set text input width to size*avgCharWidth + maxCharWidth - avgCharWidth
+        -set textarea width to cols*avgCharWidth
+        -Make default CSS match IEs
+        -Correctly initializing m_avgCharWidth and m_maxCharWidth for each platform and SVG.
+
+        Those values for textarea and inputs were derived by doing a ton of manual
+        testing of IE's width values for various textareas and fonts.
+
+        To get the average and max character width of a font, we do the following
+        for each platform:
+        -Win: TextMetrics expose avgCharWidth and maxCharWidth
+        -SVG: avgCharWidth = width of an '0', fallback on width of a space glyph, then m_xHeight
+            maxCharWidth = width of a 'W' for roman fonts, fallback on m_ascent
+        -Linux: avgCharWidth = width of an '0', fallback on m_xHeight
+            maxCharWidth = max of avgCharWidth and m_ascent
+        -Mac: look in the OS/2 table for avgCharWidth and grab the maxCharWidth off the font.
+            If either one is not there, then calculate the value using the Linux approach.
+
+        Linux ports could probably dig into the OS/2 table as well, but I'll leave
+        that up to them to implement.
+
+        Tests: fast/forms/text-control-intrinsic-widths.html
+               fast/forms/textarea-metrics.html
+               svg/custom/svg-fonts-in-text-controls.html
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::maxCharWidth):
+        (WebCore::SimpleFontData::avgCharWidth):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove m_absoluteBounds hack from SVG renderers and move outlineBoundsForRepaint into RenderSVGModelObject
+        https://bugs.webkit.org/show_bug.cgi?id=25276
+
+        This also exposed a buggy paint check in RenderSVGContainer::layout()
+        we should repaint if we are self painting OR if our kids changed, not AND.
+
+        Writing real outlineBoundsForRepaint required writing a mapLocalToContainer() function
+
+        No functional changes, thus no tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::layout):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::mapLocalToContainer):
+        (WebCore::RenderSVGModelObject::outlineBoundsForRepaint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::localToParentTransformWithoutCSSParentOffset):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+
+2009-04-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=25282
+        
+        outlineBoundsForRepaint() should compute a quad relative to the
+        repaintContainer. This fixes the repaint issues originally fixed in
+        https://bugs.webkit.org/show_bug.cgi?id=12885 for elements in compositing layers.
+        Failure was only apparent when building with ACCELERATED_COMPOSITING enabled.
+
+        Tests: compositing/repaint/content-into-overflow.html
+               compositing/repaint/overflow-into-content.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::outlineBoundsForRepaint):
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Tim Hatcher.
+
+        Add licenses for xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
+
+2009-04-20  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25261
+        Implement the V8 binding for DOMWindow.event similarly to JSC, by using
+        the custom getter boilerplate from the IDL file. 
+        Also, stub out DOMWindow.crypto which is defined by the idl.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-04-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25243
+        Crash when data:// loads are cancelled
+
+        Properly handle cancellation of the load for data:// loads. This
+        fixes crashing in the followin test:
+
+        plugins/return-error-from-new-stream-callback-in-full-frame-plugin.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        - maybe fix release builds
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::notifyFinished):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        - not fix release builds
+
+        * dom/Document.cpp:
+        (WebCore::Document::executeScriptSoonTimerFired):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6734365> REGRESSION eBay "Save this search" link
+          does nothing the second time search results are opened
+
+        Test: fast/dom/HTMLScriptElement/nested-execution.html
+
+        Instead of executing scripts as soon as they finish loading, which may
+        happen synchronously during execution of another script, defer their
+        execution until the next run loop iteration, using a queue that is
+        similar to the HTML5 notion of the "list of scripts that will execute as
+        soon as possible", and in my testing was consistent with how Firefox
+        behaved.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Initialize m_executeScriptSoonTimer.
+        (WebCore::Document::~Document): deref() script elements in
+        m_scriptsToExecuteSoon.
+        (WebCore::Document::executeScriptSoonTimerFired): Added. Executes the
+        scripts in m_scriptsToExecuteSoon and deref()s them.
+        (WebCore::Document::executeScriptSoon): Added. Appends to
+        m_scriptsToExecuteSoon and ref()s the script element, which keeps the
+        ScriptElementData alive as well.
+        * dom/Document.h:
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::ScriptElementData): Initialize m_requested.
+        (WebCore::ScriptElementData::requestScript): Set m_requested to true, to
+        prevent further load requests.
+        (WebCore::ScriptElementData::execute): Added. Moved the code from
+        notifyFinished() which should not execute synchronously here, to be
+        called by the Document on a 0-interval timer.
+        (WebCore::ScriptElementData::notifyFinished): Moved the code to
+        dispatch events and evaluate the script, which should not execute
+        synchronously, out of here.
+        (WebCore::ScriptElementData::ignoresLoadRequest): Changed to test for
+        m_requested instead of m_cachedScript, because the latter is cleared
+        before the script is evaluated.
+        * dom/ScriptElement.h:
+
+2009-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto and Darin Adler.
+
+        <rdar://problem/6127705> Excessive memory consumption on image load failure
+
+        When we fail to decode an image we clear most of the image data, but not the
+        input data itself, which can be backed by a CFData object that itself holds onto
+        a few hundred Kbs of memory.  This patch merely ensures that this buffer gets
+        cleared.
+
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::error):
+
+2009-04-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add hooks so sudden termination will not cause loss of icons or local storage.
+        rdar://problem/5951701
+
+        * loader/icon/IconDatabase.cpp: Marked various constants static to give them
+        internal linkage.
+        (WebCore::IconDatabase::IconDatabase): Added initial value for m_syncTimer.
+        Removed unneeded initial value for m_defaultIconRecord. Changed assertion to
+        work cross-platform.
+        (WebCore::IconDatabase::wakeSyncThread): Added disableSuddenTermination, so
+        we won't terminate until the sync thread has done its thing.
+        (WebCore::IconDatabase::scheduleOrDeferSyncTimer): Added disableSuddenTermination,
+        so we won't terminate if we have an outstanding sync timer.
+        (WebCore::IconDatabase::syncTimerFired): Added enableSuddenTermination, to
+        balance the one in scheduleOrDeferSyncTimer.
+        (WebCore::IconDatabase::syncThreadMainLoop): Added enableSuddenTermination, to
+        balance the one in wakeSyncThread.
+        (WebCore::IconDatabase::deleteAllPreparedStatements): Use clear() instead of set(0).
+
+        * loader/icon/IconDatabase.h: Use a Timer instead of an OwnPtr<Timer>.
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::scheduleFinalSync): Added disableSuddenTermination.
+        (WebCore::LocalStorageArea::scheduleItemForSync): Ditto.
+        (WebCore::LocalStorageArea::scheduleClear): Ditto.
+        (WebCore::LocalStorageArea::syncTimerFired): Added a disableSuddenTermination if
+        we schedule a performSync callback for later and an unconditional
+        enableSuddenTermination to balance the ones in the schedule calls above.
+        (WebCore::LocalStorageArea::sync): Factored out the work of the sync function so it
+        can continue to use early return idiom.
+        (WebCore::LocalStorageArea::performSync): Added a call to enableSuddenTermination.
+
+        * storage/LocalStorageArea.h: Added declaration of the sync function.
+
+2009-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        Make FEATURE_DEFINES completely dynamic
+
+        Reviewed by Darin Adler.
+
+        Make FEATURE_DEFINES depend on individual ENABLE_FEATURE_NAME
+        variables for each feature, making it possible to remove all
+        knowledge of FEATURE_DEFINES from build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig: Extract a variable
+        from FEATURE_DEFINES for each feature setting.
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Removed a little more complexity from event handler creation and destruction.
+        
+        Removed the jsProtectedEventListeners, jsProtectedInlineEventListeners,
+        and jsInlineEventListeners maps, and all the code for managing them.
+        
+        ProtectedEventListeners don't exist anymore, so they're easy to nix.
+        
+        Inline EventListeners do still exist, but there's no reason to track
+        them in a map. The map exists to enable 'removeEventListener' to associate
+        a unique JSEventListener with a given JavaScript function. But the
+        'removeEventListener' API only works with non-inline event listeners!
+        
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::createJSInlineEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::clearJSFunctionInline):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::~JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        - revert the previous change, which was to a file that the Windows
+          port does not even use
+
+        * icu/unicode/utf16.h:
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - try to fix the Windows build
+
+        * icu/unicode/utf16.h:
+
+2009-04-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25066
+        
+        When a <video> element gained a RenderLayer via opacity, reflection etc., the
+        layer hierarchy was not correctly updated because RenderMedia skipped a level
+        when asked for its children; it skipped m_controlsShadowRoot's renderer, which
+        actually has a layer.
+
+        Test: fast/layers/video-layer.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::MediaControlShadowRootElement):
+        Don't manually call setParent() on the renderer. It will happen later
+        as a result of addChild().
+        
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createControlsShadowRoot):
+        Add m_controlsShadowRoot's renderer as a child. 
+
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::children):
+        Now maintain a RenderObjectChildList, m_children, and remove the unneeded
+        removeChild() method. Make the two children() methods inline.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::moveLayers):
+        Assert if moveLayers() is called with an oldParent that is not the
+        layer's actual parent (which would have revealed this bug).
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed a layout test failure, caused by my last check-in
+        (fast/dom/script-element-gc.html).
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * html/HTMLScriptElement.h:
+        (WebCore::HTMLScriptElement::haveFiredLoadEvent): Treat script elements
+        just like image elements: if a script element is loading, mark its JS
+        wrapper, even if the element is not in the document.
+
+2009-04-18  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25170
+        Upstream V8WorkerCustom.cpp and V8WorkerContextCustom.cpp for V8 bindings.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp: Added.
+        * bindings/v8/custom/V8WorkerCustom.cpp: Added.
+
+2009-04-18  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/post_bug.cg://bugs.webkit.org/show_bug.cgi?id=25167 
+        Change createHiddenXHRDependency and removeHiddenXHRDependency so that they can be used by other custom code in V8 bindings.
+
+        * bindings/v8/V8Utilities.cpp: Renamed from WebCore/bindings/v8/V8XMLHttpRequestUtilities.cpp.
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/V8Utilities.h: Renamed from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-18  Drew Wilson  <amw@apple.com>
+
+        <rdar://problem/6781407> VisiblePosition.characterAfter should return UChar32
+
+        Reviewed by Dan Bernstein.
+
+        No test case since there is no change in behavior.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter): Now handles surrogate
+        pairs correctly and returns a UChar32.
+        * editing/VisiblePosition.h:
+        (WebCore::VisiblePosition::characterBefore): Now returns a UChar32.
+        * editing/visible_units.cpp:
+        (WebCore::endOfFirstWordBoundaryContext): Renamed
+        firstNonComplexContextLineBreak() to this. Changed it to use the
+        generic requiresContextForWordBoundary() instead of
+        hasLineBreakingPropertyComplexContext().
+        (WebCore::startOfLastWordBoundaryContext): Replaces
+        lastNonComplexContextLineBreak(), but returns the offset of
+        the character after the last character that does not require
+        context for word breaking. Also changed to use
+        requiresContextForWordBoundary().
+        (WebCore::previousBoundary): Updated for the above changes in
+        names and semantics, and changed to use
+        requiresContextForWordBoundary().
+        (WebCore::nextBoundary): Ditto.
+        (WebCore::startWordBoundary): Ditto.
+        (WebCore::endWordBoundary): Ditto.
+        (WebCore::previousWordPositionBoundary): Ditto.
+        (WebCore::nextWordPositionBoundary): Ditto.
+        * platform/text/TextBoundaries.h:
+        (WebCore::requiresContextForWordBoundary): Added.
+        * platform/text/mac/TextBoundaries.mm:
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed <rdar://problem/6797442> | https://bugs.webkit.org/show_bug.cgi?id=25285
+        REGRESSION (r42569): Profiles cannot be selected in inspector profiler
+        
+        EventListeners are shared; RegisteredEventListeners are not. Therefore,
+        when a node wrapper needs to invalidate the node's JS event listeners,
+        it should invalidate its RegisteredEventListeners, not its EventListeners.
+        Otherwise, it might invalidate an EventListener shared by another node.
+
+        * dom/RegisteredEventListener.h:
+        (WebCore::invalidateEventListeners): ditto
+
+2009-04-18  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6781295> video.buffered and video.seekable are not
+        the same. video.buffered should return only what is buffered and
+        not what is seekable
+
+        * WebCore.base.exp: Added wkQTMovieMaxTimeSeekable.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Return wkQTMovieMaxTimeSeekable.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTMovieMaxTimeSeekable.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-18  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6747241> work around QTKit no longer reaching
+        QTMovieLoadStateComplete
+
+        * WebCore.base.exp: Export wkQTMovieMaxTimeLoadedChangeNotification.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): observe QTMovieMaxTimeLoadedChangeNotification.
+        (WebCore::MediaPlayerPrivate::updateStates): compare duuration() with maxTimeLoaded() instead of
+        using QTMovieLoadStateComplete to determine if a movie are fully loaded.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTMovieMaxTimeLoadedChangeNotification.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-18  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
 
         Reviewed by George Staikos.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24463
-        WebCore::qstring is detaching and copying twice for every single
-        WebCore::TextRun that is processed and drawn.  This elevates this method
-        to one of the top-ten most expensive methods in all of QtWebKit according
-        to profiling.  This changes the method so that QString only detaches
-        when absolutely necessary.
+        Make WML work again, most regressions test were failing.
 
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::qstring):
-        (WebCore::fixSpacing):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
+        * dom/Document.cpp: Be sure to create WML elements in WML namespace. Otherwhise hasTagName() comparisions fail.
+        (WebCore::Document::createElement):
+        * wml/WMLCardElement.cpp: Add ASSERT(hasTagName(cardTag)) to catch errors like this in future.
+        (WebCore::WMLCardElement::WMLCardElement):
+        * wml/WMLTagNames.in: Wrap comment in #if 0/#endif blocks, to silence the generation script.
 
-2009-02-04  Simon Hausmann  <simon.hausmann@nokia.com>
+2009-04-17  Justin Garcia  <justin.garcia@apple.com>
 
-        Unreviewed Qt build fix.
+        Reviewed by Dan Bernstein.
 
-        Changed ASSERT(image) to ASSERT(!image.isNull()).
+        https://bugs.webkit.org/show_bug.cgi?id=25277
+        If there is no line wrapping, a caret can leave its containing block but it shouldn't leave its root line box
+        
+        Also added code to handle a caret wider than one pixel.
+        
+        Added fast/inline/25277.html and fast/inline/25277-2.html
 
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::getImageData):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect): Distribute a caret's width to either side of the offset,
+        so that a caret between two characters doesn't hang over one character more than the other.
+        If there is no wrapping, the caret can leave its containing block, but not its root line box.
 
-2009-02-03  Dirk Schulze  <krit@webkit.org>
+2009-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Some refactoring of "inline" event listeners.
+        
+        Renames:
+            dispatchEventForType => dispatchEvent
+            setWindowInlineEventListenerForTypeAndAttribute => setWindowInlineEventListener
+            removeInlineEventListenerForType => clearInlineEventListener
+            setInlineEventListenerForType => setInlineEventListener
+            inlineEventListenerForType => getInlineEventListener
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::createInlineEventListener):
+        * bindings/js/JSLazyEventListener.h: Added two helper functions for
+        creating "inline" event listeners. These replace Document::createEventListener,
+        and abstract the creation of JS event listeners for DOM attributes out
+        of the DOM. Removed legacy JSProtectedEventListener constructor code for
+        adding the event listener's function to a map, since lazy event listeners
+        don't have functions at construction time.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Document.h:
+        (WebCore::Document::isSVGDocument):
+        * dom/Element.cpp:
+        (WebCore::Element::setWindowInlineEventListener):
+        * dom/Element.h: Updated for renames. Nixed Document::createEventListener,
+        mentioned above. Moved setWindowInlineEventListenerForTypeAndAttribute
+        to Element, for simplicity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::clearInlineEventListener):
+        (WebCore::Node::setInlineEventListener):
+        (WebCore::Node::getInlineEventListener):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::etc.):
+        * dom/Node.h: Updated for renames.
+        
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment): Updated for renames.
+        
+        Updated these files for renames, and to use the new createInlineEventListener
+        helper function:
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::onChange):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/DOMWindow.cpp:
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::eventListeners):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendScrollEvent):
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        * svg/SVGElementInstance.cpp:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * Configurations/FeatureDefines.xcconfig: Added.
+        * Configurations/WebCore.xcconfig: Removed definition of
+        ENABLE_SVG_DOM_OBJC_BINDINGS and FEATURE_DEFINES.  Added include
+        of FeatureDefines.xcconfig.
+        * WebCore.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+        * bindings/scripts/CodeGeneratorObjC.pm: When creating a list of
+        command-line macro definitions, split on one-or-more spaces
+        instead of a single space since the FEATURE_DEFINES macro may
+        now contain more than one space between macros if some macros
+        aren't defined.
+
+2009-04-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe
+
+        <rdar://problem/6786999> Tiger WebKit shouldn't try to POST on back/forward without nagging.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willLoadFromCache):
+
+2009-04-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Added sudden termination functions that can be called without involving
+        the page or client.
+
+        * GNUmakefile.am: Added SuddenTermination.h.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto. Also added SuddenTermination.mm.
+
+        * platform/SuddenTermination.h: Added.
+        * platform/mac/SuddenTermination.mm: Added.
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Move more code into RenderSVGModelObject
+
+        needsLayer() already returns false from RenderSVGModelObject
+        lineHeight and baselinePosition are from days of RenderPath having RenderBox parents.
+
+        I also added comments to explain how focus rings work (now that I understand)
+        I got rid of two more uses of m_absoluteBounds (nearly dead!)
+
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::addFocusRingRects):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        (WebCore::RenderSVGModelObject::absoluteQuads):
+        * rendering/RenderSVGModelObject.h:
+
+2009-04-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25238
+        Invalidate the hovered scrollbar part when resetting the pressed part,
+        since once there is no pressed part we can draw a hovered state.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setHoveredPart):
+        (WebCore::Scrollbar::setPressedPart):
+
+2009-04-16  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25223
+        REGRESSION: Back button after form submission to the same URL fails to navigate.
+
+        Test: http/tests/navigation/post-goback-same-url.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Check if the page we are leaving has
+        FormData.
+
+2009-04-17  Nikolas Zimmermann  <nikolas.zimmerman@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds.
+
+        * rendering/RenderTableRow.cpp: Remove dead code, which is no longer necessary.
+        (WebCore::RenderTableRow::addChild):
+        * wml/WMLInputElement.cpp: Apply same fix HTMLInputElement received. Covert RenderObject's to RenderTextControl where needed.
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-04-17  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24849
+
+        Add support for the media element 'played' attribute.
+        This involves support of "normalized TimeRanges" as described by
+        the spec.
+
+        Test: media/video-played.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Renamed 
+        m_currentTimeDuringSeek->m_lastSeekTime. Added m_playing and m_playedTimeRanges.
+        (WebCore::HTMLMediaElement::loadInternal): Reset m_playing, m_lastSeekTime, and
+        m_playedTimeRanges
+        (WebCore::HTMLMediaElement::seek): Set current time to m_playedTimeRanges
+        (WebCore::HTMLMediaElement::currentTime): m_currentTimeDuringSeek -> m_lastSeekTime
+        (WebCore::HTMLMediaElement::played): Returns m_playedTimeRanges.
+        (WebCore::HTMLMediaElement::updatePlayState): Add the new played time ranges when pausing. 
+        Set the m_playing flag.
+        * html/HTMLMediaElement.h:
+
+        * html/TimeRanges.cpp:
+        (TimeRanges::add): Merge range(s) if overlap.
+        * html/TimeRanges.h: Add various helpers (below).
+        (WebCore::TimeRanges::Range::isPointInRange): Added.
+        (WebCore::TimeRanges::Range::isOverlappingRange): Ditto.
+        (WebCore::TimeRanges::Range::unionWithOverlappingRange): Ditto.
+        (WebCore::TimeRanges::Range::isBeforeRange): Ditto.
+
+2009-04-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Bug 25210: don't use ObjC methods to wrap/unwrap DOM objects with ObjC
+        https://bugs.webkit.org/show_bug.cgi?id=25210
+
+        * WebCore.base.exp: Export the core and kit function overloads that are used
+        in WebKit. Also resorted this file.
+
+        * WebCore.xcodeproj/project.pbxproj: Re-added DOMHTMLCanvasElement.h to fix
+        a strange problem with the file type.
+
+        * bindings/objc/DOM.mm: Removed the many extraneous includes. Added new includes
+        so we can use and implement the new core and kit functions. Import DOMInternal.h
+        first so it can do its public/private magic.
+        (-[DOMNode _rootObject]): Changed to use early-return style.
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap DOM nodes. This has the code that used to be in the _wrapNode method.
+        (kit): Added. Takes an EventTarget and makes the appropriate type of wrapper,
+        dpending on whether it's a Node or an SVGElementInstance. This replace methods
+        that used to be on both of those classes.
+        (-[DOMNode boundingBox]): Changed to use early return, and the core function.
+        (-[DOMNode lineBoxRects]): Ditto.
+        (-[DOMNode renderedImage]): Ditto.
+        (-[DOMRange boundingBox]): Ditto.
+        (-[DOMRange lineBoxRects]): Ditto.
+        (-[DOMElement image]): Ditto.
+        (-[DOMElement _font]): Ditto.
+        (-[DOMElement _imageTIFFRepresentation]): Ditto.
+        (-[DOMElement _getURLAttribute:]): Ditto.
+        (-[DOMElement isFocused]): Ditto.
+        (kit): Hand-wrote the version of this for NodeFilter, since it's a protocol,
+        not a class in the binding.
+        (core): Ditto.
+        (-[DOMNodeFilter acceptNode:]): Use core.
+
+        * bindings/objc/DOMAbstractView.mm:
+        (-[DOMAbstractView document]): Use kit.
+        (-[DOMAbstractView _disconnectFrame]): Call removeDOMWrapper, which is no longer
+        in the WebCore namespace, since it's headed for WebKit in the future.
+        (core): Hand-wrote the version of this for DOMAbstractView.mm, since we store
+        a pointer to the Frame, not the DMWindow.
+        (kit): Ditto.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap CSS objects. This has the code that used to be in the _wrapStyleSheet,
+        _wrapCSSRule, and _wrapCSSValue methods.
+
+        * bindings/objc/DOMEvents.mm:
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap event objects. This has the code that used to be in the _wrapEvent methods.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument createDocumentFragmentWithMarkupString:baseURL:]): Use kit and core.
+        (-[DOMHTMLDocument createDocumentFragmentWithText:]): Ditto.
+        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Ditto.
+        (-[DOMHTMLInputElement _rectOnScreen]): Ditto.
+        (-[DOMHTMLInputElement _replaceCharactersInRange:withString:selectingFromIndex:]): Ditto.
+        (-[DOMHTMLInputElement _selectedRange]): Ditto.
+        (-[DOMHTMLInputElement _setAutofilled:]): Ditto.
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Ditto.
+        (-[DOMHTMLInputElement _isEdited]): Ditto.
+        (-[DOMHTMLTextAreaElement _isEdited]): Ditto.
+        (kitClass): Added. Gives HTMLOptionCollection objects an appropriate wrapper.
+
+        * bindings/objc/DOMInternal.h: Removed most of the imports. There's no reason
+        to have this header include all the other internal DOM headers. Removed unneeded
+        interfaces, including the redeclaration of _init in DOMObject, since it's already
+        inherited from WebScriptObject. Moved all the functions out of the WebCore
+        namespace since this code is destined for WebKit, which doesn't use a namespace.
+        Added kit and core functions for the two classes that live in this header.
+
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]): Use core.
+
+        * bindings/objc/DOMObject.h: Made the _internal field be private instead of
+        protected. This also allows the "#define private public" trick to be used to
+        make the field accessible inside the bindings code.
+
+        * bindings/objc/DOMObject.mm:
+        (-[DOMObject dealloc]): Updated for namespace change.
+        (-[DOMObject sheet]): Use core and kit functions.
+
+        * bindings/objc/DOMRGBColor.mm:
+        (-[DOMRGBColor dealloc]): Updated for namespace change.
+        (-[DOMRGBColor red]): Use kit function.
+        (-[DOMRGBColor green]): Ditto.
+        (-[DOMRGBColor blue]): Ditto.
+        (-[DOMRGBColor alpha]): Ditto.
+        (core): Added. Replaces the _RGBColor method.
+        (kit): Added. Replaces the _wrapRGBColor method.
+
+        * bindings/objc/DOMSVGPathSegInternal.mm:
+        (kitClass): Added. Replaces the _wrapSVGPathSeg method.
+
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper): Use kit function.
+        (createDOMWrapper): Ditto.
+
+        * bindings/objc/DOMXPath.mm:
+        (core): Added. Replaces the _xpathNSResolver method.
+        (kit): Added. Replaces the _wrapXPathNSResolver method.
+
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::find): Changed to use early return.
+        (WebCore::ObjCEventListener::handleEvent): Use kit function.
+
+        * bindings/objc/ObjCNodeFilterCondition.mm:
+        (WebCore::ObjCNodeFilterCondition::acceptNode): Use kit function.
+
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]):
+        Updated for namespace change.
+
+        * bindings/scripts/CodeGeneratorObjC.pm: Changed spelling of "license"
+        to U.S. spelling. Removed GetObjCTypeMaker, GetObjCTypeGetterName,
+        GetInternalTypeGetterSignature, and GetInternalTypeMakerSignature.
+        Changed includes to conform to new scheme. Generate core and kit
+        functions instead of methods and calls to those functions. Added a new
+        attribute, Polymorphic, to indicate classes that have derived subclasses.
+        Removed the old ObjCCustomInternalImpl attribute.
+
+        * css/CSSRule.idl: Use Polymorphic attribute, so core and kit functions
+        will be generated, with kit calling kitClass. This requires less hand-
+        written code than the old ObjCCustomInternalImpl.
+        * css/CSSValue.idl: Ditto.
+        * css/StyleSheet.idl: Ditto.
+        * dom/Event.idl: Ditto.
+        * dom/Node.idl: Ditto.
+        * html/HTMLCollection.idl: Ditto.
+        * svg/SVGPathSeg.idl: Ditto.
+
+        * editing/TextAffinity.h: Moved kit and core functions out of the
+        WebCore namespace since this code is destined for WebKit, which
+        doesn't use a namespace
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::declareAndWriteDragImage): Use kit function.
+
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::asFragment): Use core function.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection): Use kit function.
+
+        * svg/SVGElementInstance.idl: Removed now-unneeded ObjCCustomInternalImpl
+        function. This can be generated in a standard way now.
+        * svg/SVGViewSpec.idl: Ditto.
+
+2009-04-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/5753299> "Private Browsing" doesn't affect HTML 5 Database storage
+
+        If the Page is in private browsing mode when a statement is queued up, flag that 
+        statement as read-only.
+
+        It would be better to set the read-only flag on the database thread when it actually
+        executes, but that would either require making Settings access a lock-protected operation
+        or involve a synchronous callback to the WebCore thread, neither of which seem worth it.
+        If it becomes an issue in practice, we can revisit this later.
+
+        Test: storage/private-browsing-readonly.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::setAuthorizerReadOnly):
+        * storage/Database.h:
+
+        * storage/DatabaseAuthorizer.cpp:  For all action types that would alter the database,
+          deny when in read-only mode.
+        (WebCore::DatabaseAuthorizer::reset):
+        (WebCore::DatabaseAuthorizer::createTable):
+        (WebCore::DatabaseAuthorizer::dropTable):
+        (WebCore::DatabaseAuthorizer::allowAlterTable):
+        (WebCore::DatabaseAuthorizer::createIndex):
+        (WebCore::DatabaseAuthorizer::dropIndex):
+        (WebCore::DatabaseAuthorizer::createTrigger):
+        (WebCore::DatabaseAuthorizer::dropTrigger):
+        (WebCore::DatabaseAuthorizer::createVTable):
+        (WebCore::DatabaseAuthorizer::dropVTable):
+        (WebCore::DatabaseAuthorizer::allowDelete):
+        (WebCore::DatabaseAuthorizer::allowInsert):
+        (WebCore::DatabaseAuthorizer::allowUpdate):
+        (WebCore::DatabaseAuthorizer::setReadOnly):
+        * storage/DatabaseAuthorizer.h:
+
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::create): Add a m_readOnly flag.
+        (WebCore::SQLStatement::SQLStatement): Ditto.
+        (WebCore::SQLStatement::execute): If m_readOnly is set, tell the authorizer to change
+          to read-only mode.
+        * storage/SQLStatement.h:
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL): Flag the statement as read-only if the Page is
+          currently in private browsing mode.
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Move RenderPath and RenderSVGContainer onto a unified clippedOverflowRectForRepaint
+        https://bugs.webkit.org/show_bug.cgi?id=25268
+
+        Lots of minus lines.  Now we're sharing more sane code
+        (which will respect -webkit-transforms! and scroll offsets correctly)
+
+        Which means this fixes:
+        https://bugs.webkit.org/show_bug.cgi?id=20769 and
+        https://bugs.webkit.org/show_bug.cgi?id=21968 too!
+
+        We're no longer expanding the paint rect "for anti-aliasing", since
+        I can't find a case where that's required.  If it is, repaintRectInLocalCoordinates()
+        should be fixed to handle those cases instead of here.
+
+        This fixes svg/custom/scroll-hit-test (now that we respect scroll offsets when repainting)
+        as well as improves our focus ring drawing seen in svg/custom/focus-ring
+        focus rings are now closer to transformed content by a couple pixels (they were needlessly outset by the antialiasing hack)
+        Also, it fixes the dumped rects for markers, causing a progression in svg/custom/marker-overflow-clip
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+
+2009-04-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25259: AX: VoiceOver cmd-cntl-space does not follow the google.com->more link
+        https://bugs.webkit.org/show_bug.cgi?id=25259
+  
+        When a node becomes visible or hidden, accessibility needs to be told to update.
+
+        Test: accessibility/visible-elements.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2009-04-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, added missing header.
+
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+
+2009-04-17  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix.
+
+        Fix the build with enabled SVG filters
+
+        * rendering/RenderSVGModelObject.cpp: Include SVGResourceFilter.h.
+
+2009-04-16  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25196
+        Add a missing V8DOMMap include.
+
+        * bindings/v8/WorkerScriptController.cpp: Included V8DOMMap.h.
+
+2009-04-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25260
+        Finish V8 custom bindings for InspectorController.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added.
+
+2009-04-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Switch to wxGraphicsBitmap when using wxGraphicsContext so that we're not doing
+        unnecessary conversions internally when drawing bitmaps.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25248
+
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+2009-04-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Performing a block style change in an editable root that contains only a br adds a newline
+        https://bugs.webkit.org/show_bug.cgi?id=25256
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Fix a bad check for an root
+        block that didn't handle a root that contained a placeholder.
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix computeContainerBoundingBox to respect viewport translations
+        https://bugs.webkit.org/show_bug.cgi?id=25254
+
+        Previously computeContainerBoundingBox was just adding the viewportTranslation.
+        Which, although it has a confusing name, only contains the scale and translation
+        for the viewBox/preserveAspectRatio adjustment.  It does not contain the
+        translation for the x/y offset of the viewport.
+        localToParentTransform() does contain this offset, so we use that instead
+        of the previous hacky code.
+
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add a localToParentTransform() method which includes the
+        full transform between local and parent local coordinates.
+        https://bugs.webkit.org/show_bug.cgi?id=25226
+
+        Moved m_localTransform up into RenderSVGTransformableContainer
+        and added a comment to RenderSVGViewportContainer to make it more
+        clear that it does not have a localTransform().
+
+        This patch reveals two more failed design decisions:
+        1.  Use of RenderBox::absoluteTransform() to mean "absoluteTransform()
+            including only my localTransform()" callers are probably using it
+            incorrectly anyway and are just masking bugs in the confused code.
+        2.  computeContainerBoundingBox does not include viewport translations in
+            its computed bounding box, so bounding boxes will be off for parents of
+            inner <svg> elements.  I'll fix this an updated the results in a separate change.
+
+        No functional changes, thus no tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToParentTransform):
+        (WebCore::RenderObject::absoluteTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::viewportTransform):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::absoluteTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        (WebCore::RenderSVGTransformableContainer::localTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        (WebCore::RenderSVGViewportContainer::absoluteTransform):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+
+2009-04-16  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Fix Chromium's rendering of <option> elements inside of <optgroups>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25244
+
+        Test (will included as a manual test by https://bugs.webkit.org/show_bug.cgi?id=24900):
+
+        <select>
+          <optgroup label="Should be bold">
+            <option>Should not be bold</option>
+          </optgroup>
+        </select>
+
+        * css/themeWin.css: adding comments
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::getRowFont): use menuStyle() rather than the item's style
+
+2009-04-16  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25218
+
+        Make DOMWindow::inlineEventListenerForType not have the "inline"
+        keyword. As this method gets used outside of DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inlineEventListenerForType):
+
+2009-04-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix <rdar://problem/6766969>
+        
+        When deferred repaints are enabled and being reset and there is a active
+        timer, stop the timer and do the deferred repaints immediately.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::resetDeferredRepaintDelay):
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Sam Weinig.
 
-        This is a follow up of r40546. Call toImage() once speeds up ImageBuffer::getImageData()
+        https://bugs.webkit.org/show_bug.cgi?id=25241
+        Remove superfluous NotImplemented.h includes.
 
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::getImageData):
+        * html/CanvasRenderingContext2D.cpp:
+        * html/CanvasStyle.cpp:
+        * page/AccessibilityRenderObject.cpp:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        * platform/graphics/gtk/FontGtk.cpp:
+        * platform/graphics/gtk/IconGtk.cpp:
+        * platform/graphics/qt/IconQt.cpp:
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        * platform/graphics/skia/ImageSkia.cpp:
+        * platform/graphics/win/ColorSafari.cpp:
+        * platform/graphics/win/FontWin.cpp:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        * platform/graphics/wx/ImageWx.cpp:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        * platform/gtk/PopupMenuGtk.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/gtk/ScrollbarGtk.cpp:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        * platform/posix/FileSystemPOSIX.cpp:
+        * platform/qt/DragDataQt.cpp:
+        * platform/qt/FileSystemQt.cpp:
+        * platform/qt/Localizations.cpp:
+        * platform/qt/PopupMenuQt.cpp:
+        * platform/win/EditorWin.cpp:
+        * platform/win/PasteboardWin.cpp:
+        * platform/wx/KeyboardEventWx.cpp:
+        * platform/wx/PopupMenuWx.cpp:
+        * platform/wx/SharedTimerWx.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * svg/graphics/SVGImage.cpp:
 
-2009-02-03  Dirk Schulze  <krit@webkit.org>
+2009-04-16  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Sam Weinig and Oliver Hunt.
+        Reviewed by Sam Weinig.
 
-        Added getImageData() support for QtWebKit.
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Some cleanup in event handling code.
 
-        [QT] lacks getImageData / putImageData support in Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=22186
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h: Removed findJSProtectedEventListener
+        and findJSProtectedEventListener because they are now unused.
 
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::getImageData):
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::clearGlobalObject):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::~JSLazyEventListener):
+        (WebCore::JSLazyEventListener::globalObject):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::clearGlobalObject): Nixed JSProtectedEventListener,
+        and merged it with JSLazyEventListener, the only remaining event listener
+        that still GC-protects its function and global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::eventHandlerLineNumber): Renamed handlerLineno =>
+        handlerLineNumber, because anything less would be uncivilized. Removed
+        createInlineEventListener because it mostly did irrelevent work, so it
+        just got in the way of understanding how event handler creation works.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEventListener):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::processToken): Ditto.
+
+2009-04-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20765 Website 
+        crashes on load due to messy HTML in search form
+        -and corresponding-
+        <rdar://problem/6210633>
+
+        Before this patch, <form>s were allowed to sit inside tables 
+        without being wrapped by anonymous table parts. There was also a 
+        concept that such a form could be "demoted" and would not be 
+        allowed to have any children. This patch has the HTML parser mark 
+        form elements that have been demoted as such, and then the demoted 
+        forms are not given renderers. I also removed the code that allowed 
+        forms to sit in tables without anonymous table sections. So now any 
+        forms that do manage to get a renderer inside a table will also be 
+        wrapped with appropriate table parts.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::HTMLFormElement):
+        (WebCore::HTMLFormElement::rendererIsNeeded):
+        * html/HTMLFormElement.h:
+        (WebCore::HTMLFormElement::setDemoted):
+        (WebCore::HTMLFormElement::isDemoted):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+
+2009-04-16  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24527
+        caret does not paint the first time you focus on a 0px right padding RTL div
+
+        Test: fast/forms/caret-rtl.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect): When calculating x-axis if 
+        alignment is alignRight, we need to subtract the caretWidth so that the
+        caret at IntRect(x, y, caretWidth, height) is inside the block.
+
+2009-04-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25228
+        SelectionController::absoluteCaretBounds returns an inflated caret (the caret repaint rect)
+        
+        Return the bounds of the transformed caret, not the transformed repaint rect for the caret (which is inflated).
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::localCaretRect):
+        (WebCore::SelectionController::absoluteBoundsForLocalRect):
+        (WebCore::SelectionController::caretRepaintRect):
+        (WebCore::SelectionController::recomputeCaretRect):
+        * editing/SelectionController.h:
+
+2009-04-16  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25187
+        Bug 25187: <video> may not be rendered upon certain racy conditions
+
+        Always create the video renderer when the load state reaches QTMovieLoadStateLoaded and
+        the element is visible, not just when the movie has just been opened.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Make sure we do not make false
+        assumption on the state changes order. Create the renderer if none is present,
+        when movie is loaded instead.
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add filterBoundingBox() to RenderSVGModelObject to share a tiny bit of code
+
+        RenderSVGModelObject has much more interesting code it can share,
+        but I'm just trying to get the commits out of my local branch and into
+        the repository in any order I can. :)  This one was small.
+
+        This will be used by the unified RenderSVGModelObject
+        clippedOverflowRectForRepaint patch coming soon.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::filterBoundingBox):
+        * rendering/RenderSVGModelObject.h:
+
+2009-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel and Adam Roben.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Simplified some EventHandler creation code.
+        
+        Removed a pile of code whose sole purpose was to allow SVG event handlers
+        to supply a parameter named "evt" instead of the normal "event", and
+        replaced it with a single parameter to JSLazyEventListener's constructor
+        specifying the parameter name to use.
+
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createInlineEventListener):
+        * bindings/js/ScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::createEventListener):
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Split out objectBoundingBox and repaintRectInLocalCoordinates from relativeBBox
+        in preparation for simplifying (and fixing) repaint logic in the SVG rendering tree.
+        https://bugs.webkit.org/show_bug.cgi?id=25224
+
+        objectBoundingBox() matches the SVG 1.1 concept of a "bounding box"
+
+        repaintRectInLocalCoordinates() should return the a rect covering all painted content.
+        However, repaintRectInLocalCoordinates() still only returns the "stroke bounding box"
+        in this patch.  In a future patch, repaintRectInLocalCoordinates will be fixed to return
+        a rect covering all painted content.  In order to avoid changing several hundred layout test results, I've left
+        the behavior as-is for now.  The returned rect is used by various repaintRectInLocalCoordinates
+        implementations and sometimes adjusted to include all painted content, but not always, and
+        the places where the adjustments are made are sometimes wrong.  Again, will be fixed in
+        an upcoming patch.
+
+        This patch discovered a bug in Font::drawTextUsingSVGFont, which is probably causing
+        bounding-box relative gradients on SVGFont glyphs to not paint correctly.
+        I chose not to try and fix the bug in this patch and instead left a FIXME.
+
+        This patch also discovered that at least tspan.getBBox() is broken.  This
+        along with the foreignObject.getBBox() change will be tested (and fixed) in a
+        later patch.  https://bugs.webkit.org/show_bug.cgi?id=25225
+
+        No change in behavior (besides the above mentioned foreignObject.getBBox()), thus no tests.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::objectBoundingBox): this is a behavior improvement for getBBox() test case coming in a later patch
+        (WebCore::RenderForeignObject::repaintRectInLocalCoordinates): only really used for layout test results, might some day be used for repaint.
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::objectBoundingBox): new methods, ASSERT if used but not implemented.
+        (WebCore::RenderObject::repaintRectInLocalCoordinates):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::objectBoundingBox):
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        (WebCore::RenderPath::lineHeight):
+        (WebCore::RenderPath::baselinePosition):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::addFocusRingRects):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::objectBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::objectBoundingBox):
+        (WebCore::RenderSVGGradientStop::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::objectBoundingBox):
+        (WebCore::RenderSVGHiddenContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::objectBoundingBox):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGImage::calculateAbsoluteBounds):
+        (WebCore::RenderSVGImage::addFocusRingRects):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::objectBoundingBox):
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTSpan.h:
+        (WebCore::RenderSVGTSpan::objectBoundingBox):
+        (WebCore::RenderSVGTSpan::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::objectBoundingBox):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::getBBox):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-04-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6032139> Table cell widths calculated
+          incorrectly on table that uses table-layout:fixed, colspans, and a mix
+          of percentage and pixel widths
+
+        Test: fast/table/fixed-granular-cols.html
+
+        The incorrect widths resulted from incorrect handling of the case where
+        the <col> elements are more granular than the table cells.
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray): When processing <col>
+        elements, append effective columns or split existing effective columns
+        as needed.
+
+2009-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        <rdar://problem/6795285> Infinite recursion in ResourceHandle::receivedRequestToContinueWithoutCredential
+
+        Rolled out <http://trac.webkit.org/projects/webkit/changeset/42536> - the two instances of
+        authentication challenge are different, after all. Added a FIXME comment about a possible
+        future improvement.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+
+2009-04-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Also fixed <rdar://problem/6792909> WebInspector crashes when reloading
+        a page with breakpoints set
+        
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::clearJSFunctionInline):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h: Actually clear our function and global
+        object pointers when our client instructs us to. (Oops!) Also, mark
+        our global object while we still intend to use it.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark):
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * svg/SVGElementInstance.idl: For every SVGElementInstance wrapper, ensure
+        that the corresponding element also has a wrapper, to keep its event
+        listeners alive.
+
+2009-04-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25201
+        Add ScriptFunctionCall/ScriptObject for V8.
+
+        * bindings/v8/ScriptFunctionCall.cpp: Added.
+        * bindings/v8/ScriptFunctionCall.h: Added.
+        * bindings/v8/ScriptObject.cpp: Added.
+        * bindings/v8/ScriptObject.h: Added.
+        * bindings/v8/ScriptObjectQuarantine.cpp: Added.
+        * bindings/v8/ScriptObjectQuarantine.h: Added.
+        * bindings/v8/ScriptScope.cpp: Added.
+        * bindings/v8/ScriptScope.h: Added.
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState): Added new constructors.
+        (WebCore::ScriptState::frame): Added Frame ptr accessor.
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString): Added default constructor.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isEqual): Added.
+
+2009-04-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Add RenderSVGModelObject.* to GTK+'s build.
+
+        * GNUmakefile.am:
+
+2009-04-15  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6785760> WebCore should use a maximum of 6 connections per host, not 4
+
+        Reviewed by Adam Roben.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add special casing to bindings generator so that custom functions
+        starting with xml or xslt conform to WebKit style guidelines.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::xmlHttpRequest):
+        (WebCore::JSDOMWindow::xsltProcessor):
+        * bindings/scripts/CodeGenerator.pm:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add minimal RenderSVGModelObject and make RenderPath and RenderSVGContainer use it.
+        https://bugs.webkit.org/show_bug.cgi?id=25221
+        
+        RenderSVGModelObject is the base rendering class for things which live
+        in the SVG rendering tree.  Not all SVG renders are RenderSVGModelObjects yet.
+        
+        More patches coming.  This is just adding the class, future patches
+        will pull more logic out of RenderPath and RenderSVGContainer into RenderSVGModelObject.
+
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::RenderPath):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp: Added.
+        (WebCore::RenderSVGModelObject::RenderSVGModelObject):
+        * rendering/RenderSVGModelObject.h: Added.
+        (WebCore::RenderSVGModelObject::requiresLayer):
+        * rendering/RenderTreeAsText.cpp:
+        * rendering/SVGRenderTreeAsText.cpp:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove more dead code from RenderSVGHiddenContainer.
+
+        lineHeight and baselinePosition used to be on RenderSVGContainer
+        (of which this is a subclass) because RenderSVGContainer used
+        to be a RenderBox and always the renderer for <svg>
+        Now <svg> uses RenderSVGRoot when needing a RenderBox (inside HTML)
+        and RenderSVGViewportContainer (when inside SVG content)
+        so there is no need for RenderSVGHiddenContainer to have these HTML-specific methods.
+
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove unneeded (broken) code from SVG renderers
+        https://bugs.webkit.org/show_bug.cgi?id=25214
+
+        Mostly due to my historical confusions about the render tree
+        and some methods not being removed after classes were split.
+
+        RenderSVGRoot is an RenderBox and should just use all the
+        standard RenderBox methods for inspector and repaint rects.
+
+        RenderSVGContainer is *not* a RenderBox (any more) and thus
+        doesn't need lineHeight or width/height or calcBounds.
+
+        RenderSVGViewportContainer had some broken code which tried
+        to see if the click was inside the container at all, but it
+        was using width/height metrics based off of the containing
+        block (from calcWidth) which is wrong (since its real
+        width/height are from its containing viewport not containing block).
+
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGRoot.cpp:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25217
+        Simplify nearestViewportElement and farthestViewportElement using isViewportElement and a for loop
+        Add ASSERT(element) to all these functions since they should never be passed a null element.
+
+        * svg/SVGLocatable.cpp:
+        (WebCore::isViewportElement):
+        (WebCore::SVGLocatable::nearestViewportElement):
+        (WebCore::SVGLocatable::farthestViewportElement):
+        (WebCore::SVGLocatable::getBBox):
+        (WebCore::SVGLocatable::getCTM):
+        (WebCore::SVGLocatable::getScreenCTM):
+
+2009-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove support for the ObjCIvar extended attribute from the Objective-C
+        bindings generator.  It is not used anymore.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+
+2009-04-15  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25204
+        Create a fast path for ReplaceSelectionCommand that merges text nodes
+        
+        During simple pastes, where we're just pasting a text node into a run of text, we would split the current
+        text and insert the new node in between.  This is slow and we hit this bug:
+
+        https://bugs.webkit.org/show_bug.cgi?id=6148
+
+        in the layout and rendering code where adjacent text nodes don't shape correctly in Arabic.
+        
+        This change creates a fast path for ReplaceSelectionCommand that inserts text directly into the
+        text node that holds the selection (very similar to the fast path we wrote for InsertTextCommand).
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::performTrivialReplace):
+        * editing/ReplaceSelectionCommand.h:
+        * editing/TextIterator.cpp:
+
+2009-04-15  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Move VDMX parsing into the Chromium Linux port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25116
+
+        VDMX tables are optional tables in TrueType fonts which contain the
+        exact pixel height of a given font at a given pel size. In order to
+        match Windows font metrics we have to use these numbers.
+
+        Previously, the parsing was performed in Skia. As part of the merge
+        with upstream Skia, an interface for getting table data from a font
+        has been added to Skia and we're moving the parsing into WebKit.
+
+        This does not change any layout tests.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::uniqueID):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        * platform/graphics/chromium/FontTrueTypeLinux.cpp: Added.
+        * platform/graphics/chromium/FontTrueTypeLinux.h: Added.
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-04-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25180
+
+        Restore stroked outlines to PlatformContextSkia::drawRect().
+        These were removed inadvertently in r41805, aka
+        https://bugs.webkit.org/show_bug.cgi?id=24662.
+        SkRect is { left, top, right, bottom }, not { left, top, width, height }.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+
+2009-04-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6777374> Generated content with display: run-in
+          causes a crash
+
+        Test: fast/runin/generated.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild): Check if the run-in block is
+        generated, and if so, make the RenderInline anonymous instead of passing
+        a 0 node to the RenderInline constructor. If the run-in itself is
+        generated, do move :before and :after children from the block into the
+        inline, as they will not be regenerated. Changed nested ifs into early
+        returns.
+
+2009-04-15  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25192
+
+        Expose DOMWindow::removeInlineEventListenerForType and
+        DOMWindow::inlineEventListenerForType as public.
+
+        * page/DOMWindow.h:
+
+2009-04-14  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25198
+
+        Wrap RegisteredEventListener's markEventListeners and invalidateEventListeners
+        in a USE(JSC), since it doesn't compile with V8 bindings.
+
+        * dom/RegisteredEventListener.h:
+
+2009-04-15  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25194
+
+        Fix a caller of Settings::javaScriptCanOpenWindowsAutomatically() to
+        use the new name.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Don't keep platform objects for authentication challenge in ResourceHandleInternal.
+        We already have a copy in AuthenticationChallenge object.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed some now-defunct autogeneration code.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Fix <rdar://problem/6755724> <audio> and <video> elements can reference local 
+        file:/// URLs from remote in Safari
+
+        Tests: http/tests/security/local-video-poster-from-remote.html
+               http/tests/security/local-video-source-from-remote.html
+               http/tests/security/local-video-src-from-remote.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Don't pass url to media engine unless loader->canLoad()
+        says it is OK.
+
+2009-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Part of <rdar://problem/6150868>
+        Fix incorrect handling of content that needs to go into the head element
+        once the head element has been removed.
+
+        Test: fast/parser/head-content-after-head-removal.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser): Remove unneeded initializer of m_head.
+        (WebCore::HTMLParser::handleError): Update since m_head is now a RefPtr.
+        (WebCore::HTMLParser::createHead): Ditto.
+        * html/HTMLParser.h: Make m_head a RefPtr.
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Used svn merge -r42529:42528 to roll out my last patch because it broke
+        the build.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::jsProtectedEventListeners):
+        (WebCore::JSDOMGlobalObject::jsProtectedInlineEventListeners):
+        * bindings/js/JSDOMGlobalObject.h:
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed some now-dead code related to protected event listeners.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Stop using protected event listeners on SVGElementInstance.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark): Mark our event listeners, since
+        they're not protected anymore.
+
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener): Make unprotected
+        event listeners, since we mark them now.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogenerate event listener
+        invalidation for SVGElementInstance.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::eventListeners): Added an accessor, for
+        the sake of autogenerated code.
+
+        * svg/SVGElementInstance.idl: Removed the ProtectedEventListener attribute
+        from event listener properties. Added a CustomMarkFunction attribute,
+        since we need to mark our event listeners.
+
+2009-04-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-04-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Add header guards to WebCore forwarding headers.
+        
+        Speeds up WebCore debug build on Windows by 12% on my system,
+        since Visual Studio appears to not optimize for standard header
+        guards in included files.
+        
+        Rubber stamped by Ada Chan.
+
+        * ForwardingHeaders/debugger/Debugger.h:
+        * ForwardingHeaders/debugger/DebuggerActivation.h:
+        * ForwardingHeaders/debugger/DebuggerCallFrame.h:
+        * ForwardingHeaders/interpreter/CallFrame.h:
+        * ForwardingHeaders/interpreter/Interpreter.h:
+        * ForwardingHeaders/masm/X86Assembler.h:
+        * ForwardingHeaders/parser/Parser.h:
+        * ForwardingHeaders/parser/SourceCode.h:
+        * ForwardingHeaders/parser/SourceProvider.h:
+        * ForwardingHeaders/pcre/pcre.h:
+        * ForwardingHeaders/profiler/Profile.h:
+        * ForwardingHeaders/profiler/ProfileNode.h:
+        * ForwardingHeaders/profiler/Profiler.h:
+        * ForwardingHeaders/runtime/ArgList.h:
+        * ForwardingHeaders/runtime/ArrayPrototype.h:
+        * ForwardingHeaders/runtime/BooleanObject.h:
+        * ForwardingHeaders/runtime/CallData.h:
+        * ForwardingHeaders/runtime/Collector.h:
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h:
+        * ForwardingHeaders/runtime/Completion.h:
+        * ForwardingHeaders/runtime/ConstructData.h:
+        * ForwardingHeaders/runtime/DateInstance.h:
+        * ForwardingHeaders/runtime/Error.h:
+        * ForwardingHeaders/runtime/FunctionConstructor.h:
+        * ForwardingHeaders/runtime/FunctionPrototype.h:
+        * ForwardingHeaders/runtime/Identifier.h:
+        * ForwardingHeaders/runtime/InitializeThreading.h:
+        * ForwardingHeaders/runtime/InternalFunction.h:
+        * ForwardingHeaders/runtime/JSArray.h:
+        * ForwardingHeaders/runtime/JSByteArray.h:
+        * ForwardingHeaders/runtime/JSFunction.h:
+        * ForwardingHeaders/runtime/JSGlobalData.h:
+        * ForwardingHeaders/runtime/JSGlobalObject.h:
+        * ForwardingHeaders/runtime/JSLock.h:
+        * ForwardingHeaders/runtime/JSNumberCell.h:
+        * ForwardingHeaders/runtime/JSObject.h:
+        * ForwardingHeaders/runtime/JSString.h:
+        * ForwardingHeaders/runtime/JSValue.h:
+        * ForwardingHeaders/runtime/Lookup.h:
+        * ForwardingHeaders/runtime/ObjectPrototype.h:
+        * ForwardingHeaders/runtime/Operations.h:
+        * ForwardingHeaders/runtime/PropertyMap.h:
+        * ForwardingHeaders/runtime/PropertyNameArray.h:
+        * ForwardingHeaders/runtime/Protect.h:
+        * ForwardingHeaders/runtime/PrototypeFunction.h:
+        * ForwardingHeaders/runtime/StringObject.h:
+        * ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h:
+        * ForwardingHeaders/runtime/StringPrototype.h:
+        * ForwardingHeaders/runtime/Structure.h:
+        * ForwardingHeaders/runtime/SymbolTable.h:
+        * ForwardingHeaders/runtime/UString.h:
+        * ForwardingHeaders/wrec/WREC.h:
+        * ForwardingHeaders/wtf/ASCIICType.h:
+        * ForwardingHeaders/wtf/AlwaysInline.h:
+        * ForwardingHeaders/wtf/Assertions.h:
+        * ForwardingHeaders/wtf/ByteArray.h:
+        * ForwardingHeaders/wtf/CurrentTime.h:
+        * ForwardingHeaders/wtf/Deque.h:
+        * ForwardingHeaders/wtf/DisallowCType.h:
+        * ForwardingHeaders/wtf/FastMalloc.h:
+        * ForwardingHeaders/wtf/Forward.h:
+        * ForwardingHeaders/wtf/GetPtr.h:
+        * ForwardingHeaders/wtf/HashCountedSet.h:
+        * ForwardingHeaders/wtf/HashFunctions.h:
+        * ForwardingHeaders/wtf/HashMap.h:
+        * ForwardingHeaders/wtf/HashSet.h:
+        * ForwardingHeaders/wtf/HashTable.h:
+        * ForwardingHeaders/wtf/HashTraits.h:
+        * ForwardingHeaders/wtf/ListHashSet.h:
+        * ForwardingHeaders/wtf/ListRefPtr.h:
+        * ForwardingHeaders/wtf/Locker.h:
+        * ForwardingHeaders/wtf/MainThread.h:
+        * ForwardingHeaders/wtf/MathExtras.h:
+        * ForwardingHeaders/wtf/MessageQueue.h:
+        * ForwardingHeaders/wtf/Noncopyable.h:
+        * ForwardingHeaders/wtf/NotFound.h:
+        * ForwardingHeaders/wtf/OwnArrayPtr.h:
+        * ForwardingHeaders/wtf/OwnPtr.h:
+        * ForwardingHeaders/wtf/PassRefPtr.h:
+        * ForwardingHeaders/wtf/Platform.h:
+        * ForwardingHeaders/wtf/PtrAndFlags.h:
+        * ForwardingHeaders/wtf/RandomNumber.h:
+        * ForwardingHeaders/wtf/RefCounted.h:
+        * ForwardingHeaders/wtf/RefCountedLeakCounter.h:
+        * ForwardingHeaders/wtf/RefPtr.h:
+        * ForwardingHeaders/wtf/RetainPtr.h:
+        * ForwardingHeaders/wtf/StdLibExtras.h:
+        * ForwardingHeaders/wtf/StringExtras.h:
+        * ForwardingHeaders/wtf/ThreadSpecific.h:
+        * ForwardingHeaders/wtf/Threading.h:
+        * ForwardingHeaders/wtf/TypeTraits.h:
+        * ForwardingHeaders/wtf/UnusedParam.h:
+        * ForwardingHeaders/wtf/Vector.h:
+        * ForwardingHeaders/wtf/VectorTraits.h:
+        * ForwardingHeaders/wtf/dtoa.h:
+        * ForwardingHeaders/wtf/unicode/Collator.h:
+        * ForwardingHeaders/wtf/unicode/UTF8.h:
+        * ForwardingHeaders/wtf/unicode/Unicode.h:
+        * ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h:
+
+2009-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Use a template function to generalize the way we create non-caching
+        JS function getters.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
 
 2009-04-14  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
 
@@ -291,6 +18535,2782 @@
         * platform/network/qt/ResourceRequestQt.cpp:
         (WebCore::ResourceRequest::toNetworkRequest):
 
+2009-04-14  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a world leak caused by opening the Web Inspector. This was
+        a regression caused by the InspectorController becoming refcounted.
+
+        <rdar://problem/6782944>
+
+        Reviewed by Darin Adler.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get): Renamed to better match the
+        other functions.
+        (WebCore::ScriptGlobalObject::remove): Added. Deletes the property.
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController): Do less work
+        at destruction time since the object lifetime is tied to JS GC.
+        Assert that inspectedPageDestroyed cleared everything needed.
+        (WebCore::InspectorController::inspectedPageDestroyed): Do most
+        of the work that ~InspectorController was doing.
+        (WebCore::InspectorController::scriptObjectReady): Renamed getObject.
+
+2009-04-14  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        This is some cleanup motivated by the crash in http://crbug.com/9775 , which 
+        happens because of calling window.open inside a window.onload handler. 
+
+        These changes are just part of the fix, along with some asserts to help prevent
+        breakage on future changes. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=25132
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::add):
+        (WebCore::V8EventListenerList::remove):
+        (WebCore::V8EventListenerList::clear):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::size):
+
+2009-04-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25142
+        Fix a race that can occur between flex and the perl script that parses
+        its output.
+
+        * css/maketokenizer: Consume all input.
+
+2009-04-14  Rohit Rao  <rohitrao@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25184
+        Do not change the text color for selected text in Mac Chromium.
+
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        Now returns false, matching the behavior of Safari on Mac.
+
+2009-04-14  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25172
+        Extra partial layout during the first keypress in an empty block
+        
+        Determining if a placeholder needs to be removed requires the creation of a VisiblePosition 
+        which was triggering layout before we were finished modifying the DOM for the insert operation.
+        
+        Find out if we need to remove a placeholder near the start of the operation, and if we do remember 
+        where it's located.  Then, later, remove it along with all of the other DOM operations we perform.
+        
+        Renamed lineBreakExistsAtPosition to lineBreakExistsAtVisiblePosition and added a lineBreakExistsAtPosition
+        that takes in a Position.  In InsertTextCommand, we can use the latter, since we normalize manually.
+        
+        removePlaceholderAt now takes in a Position that it assumes has already been checked for a placeholder.
+        
+        No test added as this only effects performance.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::removePlaceholderAt):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CompositeEditCommand.h:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete):
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::doApply):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/htmlediting.cpp:
+        (WebCore::lineBreakExistsAtVisiblePosition):
+        (WebCore::lineBreakExistsAtPosition):
+        * editing/htmlediting.h:
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Remove support for profile-guided optimization on Windows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * WebCore.vcproj/WebCore.vcproj: Removed the Release_PGO
+        configuration.
+
+2009-04-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25163
+        Upstream fix for releasing v8 objects on worker thread termination in Chromium.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::domDataList): Now uses Vector instead of HashMap.
+        (WebCore::domDataListMutex):
+        (WebCore::ThreadSpecificDOMData::ThreadSpecificDOMData):  remove usage of currentThread();
+        (WebCore::ThreadSpecificDOMData::~ThreadSpecificDOMData): ditto.
+        (WebCore::NonMainThreadSpecificDOMData::~NonMainThreadSpecificDOMData): moved call to removeAllDOMObjectsInCurrentThread() to ~WorkerScriptController.
+        (WebCore::handleWeakObjectInOwningThread):
+        (WebCore::derefDelayedObjects):
+        (WebCore::removeAllDOMObjectsInCurrentThread): not static anymore.
+        * bindings/v8/V8DOMMap.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose): removed code that avoided dual-dereference of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): this ref() is countered in removeAllDOMObjectsInCurrentThread(), when the WorkerContext is removed from the v8 map.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 25183: Split up WebCore.vcproj's settings into vsprops files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25183>
+
+        WebCore.vcproj now uses a set of .vsprops files to store most of its
+        settings.
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/WebCore.vcproj: Moved settings from here into the new
+        .vsprops files.
+
+        * WebCore.vcproj/WebCoreCFNetwork.vsprops: Added. Contains settings
+        for ports that build against CFNetwork.
+        * WebCore.vcproj/WebCoreCG.vsprops: Added. Contains settings for ports
+        that build against CoreGraphics.
+        * WebCore.vcproj/WebCoreCURL.vsprops: Added. Contains settings for
+        ports that build against libcurl.
+        * WebCore.vcproj/WebCoreCairo.vsprops: Added. Contains settings for
+        ports that build against Cairo.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Added. Contains settings
+        shared by all ports.
+        * WebCore.vcproj/WebCoreMediaQT.vsprops: Added. Contains settings for
+        ports that use QTMovieWin to implement the MediaPlayerPrivate
+        interface.
+        * WebCore.vcproj/WebCorePthreads.vsprops: Added. Contains settings for
+        ports that build against pthreads.
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        http/tests/xmlhttprequest/basic-auth.html fails on Tiger.
+
+        Turns out that NSURLCredentialPersistenceNone doesn't work on Tiger, so we have to use
+        session persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Route the credential through
+        receivedCredential(), ensuring that the Tiger-specific need to use session credentials
+        is honored.
+        (WebCore::ResourceHandle::receivedCredential): On Tiger, change PersistenceNone to
+        PersistenceForSession, because the former doesn't work.
+
+2009-04-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6703873> Triple-click quoted line and type Return creates an extra quoted blank line
+
+        Test: editing/inserting/6703873.html
+
+        * editing/BreakBlockquoteCommand.cpp: (WebCore::BreakBlockquoteCommand::doApply):
+        If the startNode's original parent is now empty, we can remove it.  Its already been cloned and copied with the startNode,
+        so we only need to keep it around if it actually holds some original content, otherwise it will look like an extra empty 
+        container in the document.
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Add a proper implementation of AtkText::get_text and
+        AtkText::get_character_count, which takes into account non
+        TextControl text. With this the 'Text' field in Accerciser's
+        Interface Viewer is filled correctly.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Remove some dead code and g_return_if_fail from static functions.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Also implement text interface for StaticTextRole, which covers
+        most of the text in web pages.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Another Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+
+2009-04-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6698851> Implement XMLHttpRequest withCredentials attribute
+
+        * WebCore.xcodeproj/project.pbxproj: Made ThreadableLoader.h private, as enum definitions
+        from it are now used in otehr private headers.
+
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        Added withCredentials attribute. When it is false (default), neither credentials nor cookies
+        are sent with cross origin requests, When it is true, those are sent, but the server needs
+        to allow handling results via Access-Control-Allow-Credentials header. It was always possible
+        to send a cross-site request with credentials via IFRAME or IMG, so this just adds a way to
+        read results, as long as the server reports that it's allowed.
+        Having the default set to false ensures that requests won't fail unexpectedly because of
+        stored credentials and cookies for other resources in the target protection space.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestSynchronously): Allow stored credentials for same origin
+        requests, and for cross origin ones that have withCredentials attribute set. Such code already
+        existed for cookies (but it's simpler, because we could just set a ResourceRequest flag).
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Ditto.
+
+        * platform/network/ResourceHandle.h: Added willSendRequest() - just like for other callbacks,
+        is is easier to have code in the class. Also, loadResourceSynchronously() now takes a
+        StoredCredentials option, matching async case.
+
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::receivedCredential): Removed. This method could never be
+        called, and no client used it.
+        (WebCore::ResourceHandleClient::receivedRequestToContinueWithoutCredential): Ditto.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal): Split username and password out
+        of request URL. We want to always get a callback for credentials to manage them in WebCore,
+        so network back-end shouldn't see them too early.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::removeCredentials):
+        * platform/network/ResourceRequestBase.h:
+        Added a removeCredentials() method that removes login and password parts from request URL.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreCredentialStorage): Added a simple storage class for per-session credentials.
+        (WebCore::ResourceHandle::loadResourceSynchronously): Pass allowStoredCredentials through.
+        (WebCore::ResourceHandle::willSendRequest): On a redirect, credentials should be replaced.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Try credentials from the URL
+        and per-session credentials. Code was partially moved from Obj-C callback.
+        (WebCore::ResourceHandle::receivedCredential): Intercept per-session credentials and store
+        them in WebCore storage.
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Don't
+        store the redirected URL - we only needed credentials, which are now stored separately.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]): Removed
+        code that was setting credentials from URL. First, the code is now in ResourceHandle, and
+        also, it wasn't actually needed in Leopard release before this patch, see <rdar://problem/5298142>.
+        (-[WebCoreSynchronousLoader dealloc]): Release credentials. Note that unlike ResourceHandle,
+        this class still needs to track URL for checking whether a redirect is allowed. This is
+        not a great solution, and we should unify client code to use the same checks in sync and
+        async cases.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Just like in
+        async case, put credentials aside to ensure that network back-end asks for them.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Use credentials
+        from URL, or from WebCore storage.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Don't use stored
+        credentials when not allowed to.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Put credentials aside to ensure that network back-end asks for them.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::willSendRequest):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::shouldUseCredentialStorage):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac case.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        Trying not to break the build.
+
+        * dom/XMLTokenizerLibxml2.cpp: (WebCore::openFunc):
+        * xml/XSLTProcessor.cpp: (WebCore::docLoaderFunc):
+        Unconditionally allow stored credentials for these, as they only support same origin loads.
+
+        * workers/WorkerContext.cpp: (WebCore::WorkerContext::importScripts):
+        WorkerContext.importScripts() can be cross-origin, but sending credentials with it is no worse
+        than sending them with <script src=...>, so this is also unconditionally allowed.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Pass through storedCredentials.
+        (WebCore::DocumentThreadableLoader::create): Ditto.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Save storedCredentials and
+        sameOrigin flags foruse in callbacks.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Assert that loaders aren't all confused.
+        (WebCore::DocumentThreadableLoader::didSendData): Ditto.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didReceiveData): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::didFail): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Don't use credential
+        storage if that's not allowed by the code that invoked DocumentThreadableLoader.
+        (WebCore::DocumentThreadableLoader::didReceiveAuthenticationChallenge): Simulate a failure
+        and cancel the request if we are about to ask the user for credentials for a cross-origin
+        request, which is forbidden by CORS (and would have been very confusing if allowed).
+        (WebCore::DocumentThreadableLoader::receivedCancellation): Assert that loaders aren't all confused.
+
+        * loader/DocumentThreadableLoader.h: Updated for the new flags (storedCredentials and
+        sameOrigin) that affect the loader. Eventually, we need to move all CORS logic from XHR here.
+
+        * loader/ThreadableLoader.h: (StoredCredentials): Added another flag that affects loader
+        behavior. We should combine all of these into a structure, and use it for sync requests, too.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        Pass through storedCredentials.
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove an outdated comment in ScrollView.h
+
+        * platform/ScrollView.h:
+
+2009-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25177
+
+        QTTrack's -media method always return NULL in 64-bit QTKit, so
+        MediaPlayerPrivate::disableUnsupportedTracks should use 
+        QTTrackMediaTypeAttribute to get a track's type.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Stop using protected event listeners on the window object.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::mark): Mark our event listeners, since they're
+        no longer protected.
+
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Create unprotected event
+        listeners, since we mark them now.
+
+        * bindings/js/JSEventListener.h: Made some functions public so
+        DOMWindow could call them.
+
+        * bindings/js/JSNodeCustom.cpp: Moved markEventListeners to a header,
+        so it could be shared.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Generate event listener marking
+        and invalidating code for the DOMWindow.
+
+        * dom/RegisteredEventListener.h:
+        (WebCore::markEventListeners):
+        (WebCore::invalidateEventListeners): Added helper functions.
+
+        * page/DOMWindow.idl: Make the window's event listener attributes not
+        protected.
+
+2009-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25155
+
+        OS X standalone media documents should not switch from <video> to <embed> when 
+        QTKit load state is QTMovieLoadStateLoading as that happens frequently when a loading
+        with a slow network connection or when a movie is not saved fast-start.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Don't open movie with plug-in when QTKit's
+        loadstate is QTMovieLoadStateLoading, wait until it drops below QTMovieLoadStateError.
+
+2009-04-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24453
+        REGRESSION: If setTimeout is called on a iframe's window, the DOM changes to
+        the main document that timer callback makes are not flushed.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        Use Document::updateStyleForAllDocuments() instead of document->updateStyleIfNeeded()
+        since timers may affect documents other then their own.
+
+2009-04-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by David Hyatt.
+
+        Check document for nullity to avoid crashing on GTK+, when
+        creating the WebView.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2009-04-13  Ada Chan  <adachan@apple.com>
+
+        Forgot to capitalize the "US".
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentTextBreakLocaleID):
+
+2009-04-13  Ada Chan  <adachan@apple.com>
+
+        <rdar://problem/6564956> URL field double-click selects entire domain, rather than single word or entire URL
+        Revert back to the old word breaking behavior by using en_US_POSIX locale.        
+
+        Reviewed by Steve Falkenburg.
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentTextBreakLocaleID):
+
+2009-04-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * platform/cf/BinaryPropertyList.cpp: Added comment.
+        * platform/cf/BinaryPropertyList.h: Fixed mistakes in comments.
+
+2009-04-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25158: hit testing doesn't work right in some cases involving anonymous blocks
+        https://bugs.webkit.org/show_bug.cgi?id=25158
+        rdar://problem/6769693
+
+        Test: editing/selection/click-after-nested-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::isChildHitTestCandidate): Added. Helper so the two loops in positionForPoint
+        can share code.
+        (WebCore::RenderBlock::positionForPoint): Removed unneeded special case for first
+        child box. Changed special case for last child box to propertly handle the various
+        types of child box that are not hit test candidates (the same ones already handled
+        by the hit test loop below), adding in a loop so we find the last candidate.
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25125.  Rework scrolling so that a layout happens first when
+        it's already needed so that the code doesn't end up making bad decisions based off invalid document sizes.
+
+        * WebCore.base.exp:
+        * page/FrameView.h:
+        (WebCore::FrameView::visibleContentsResized):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+
+2009-04-13  Adam Roben  <aroben@apple.com>
+
+        Add SharedBuffer::wrapCFData
+
+        This is the CF-equivalent of wrapNSData.
+
+        Reviewed by Brady Eidson.
+
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::wrapCFData):
+
+2009-04-13  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * page/EventHandler.cpp:
+        (WebCore::documentPointForWindowPoint):
+
+2009-04-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6740294> Increase the connection count per host
+        
+        Try to use six connections per host if possible.
+
+        * WebCore.base.exp:
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::initMaximumHTTPConnectionCountPerHost):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::initMaximumHTTPConnectionCountPerHost):
+
+2009-04-13  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25153
+        Can't place the caret into text field that scrolls the window on focus
+        
+        We refetch the target node in the shadow node case, and when we do so the window coordinate for the mouse event may
+        be invalid because of scrolling that the focus handler did.  Cache the document point (that we derived from the window
+        coordinate) and use that any time we refetch.
+
+        * page/EventHandler.cpp:
+        (WebCore::documentPointForWindowPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::prepareMouseEvent):
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Rename JavaScriptCanOpenWindowsAutomatically to javaScriptCanOpenWindowsAutomatically
+        to conform to our style guidelines.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::allowPopUp):
+        * page/Settings.h:
+        (WebCore::Settings::javaScriptCanOpenWindowsAutomatically):
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: Made another header private.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-04-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25121
+        Upstream changes to handle error messages from V8 when running worker script.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::reportFatalErrorInV8):
+        (WebCore::handleConsoleMessage):
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Made setInlineEventListenerForType not inline, since Document
+        calls it now. Made RegisteredEventListener.h a private header on Mac,
+        so WebKit can use it.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setInlineEventListenerForType):
+
+2009-04-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6404439> REGRESSION: Overlapping text and other
+          layout issues in View Sample feature of MYOB FIrstEdge v3
+
+        * page/Navigator.cpp:
+        (WebCore::shouldHideFourDot): Added "tdqm_loader.js" to the list of
+        JavaScript files this quirk applies to.
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move open and showModalDialog functions out of JSDOMWindowBase
+        and into JSDOMWindow by partially generating them.
+
+        This slightly changes the behavior of getting window.showModalDialog
+        when the embedding app does not support it to return undefined regardless
+        of shadowing.  This should not be an issue in a practice, but will be addressed
+        when we add a generic way to handle runtime specialization of property
+        access.
+
+        * DerivedSources.make: Remove JSDOMWindowBase.lut.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot): Move canShowModalDialog check from
+        here to JSDOMWindow::customGetOwnPropertySlot.
+        (WebCore::JSDOMWindowBase::put): Remove dead code.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::parseModalDialogFeatures): Move from JSDOMWindowBase.
+        (WebCore::DOMWindow::allowPopUp): Ditto.
+        (WebCore::DOMWindow::canShowModalDialog): Ditto.
+        (WebCore::DOMWindow::canShowModalDialogNow): Ditto.
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Moved storage for window event listeners into the window object.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Add / remove window event
+        listeners to / from the window object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::clear):
+        (WebCore::Document::setWindowInlineEventListenerForTypeAndAttribute): Moved
+        a bunch of code to the DOMWindow class, and left behind a few calls through
+        to DOMWindow, to support legacy clients. (Eventually, these will go away, too.)
+
+        * dom/Document.h: ditto.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchWindowEvent): Dipatch window events on the window
+        object, not the document.
+
+        * dom/Node.h:
+        * dom/RegisteredEventListener.h: Moved RegisteredEventListenerVector
+        declaration, since it's required in more places now.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::clear): Updated for rename. Also, remove event
+        listeners before detaching and clearing the document's window pointer,
+        since the the document needs its window pointer in order to tell the window
+        to clear its event listeners.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Updated for rename, and
+        movement of window event listeners into the window.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocument::createDocumentStructure): Updated for movement
+        of window event listeners into the window.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::handleEvent):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::hasEventListener):
+        (WebCore::DOMWindow::setInlineEventListenerForType):
+        (WebCore::DOMWindow::removeInlineEventListenerForType):
+        (WebCore::DOMWindow::inlineEventListenerForType):
+        (WebCore::DOMWindow::addPendingFrameUnloadEventCount):
+        (WebCore::DOMWindow::removePendingFrameUnloadEventCount):
+        (WebCore::DOMWindow::addPendingFrameBeforeUnloadEventCount):
+        (WebCore::DOMWindow::removePendingFrameBeforeUnloadEventCount):
+        * page/DOMWindow.h: Moved a bunch of code to the DOMWindow class, from the Document.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose): Updated for movement of window event listeners into the window.
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25149
+
+        The Geolocation timer needs to start after the UA has granted permission.
+
+        * bindings/js/JSGeolocationCustom.cpp: Use PassRefPtr<PositionOptions>
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * page/Geolocation.cpp: Add a RefPtr<PositionOptions> so it can be used
+        later when the timer is started. Change PositionOptions* to PassRefPtr<PositionOptions>
+        where needed.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier):
+        (WebCore::Geolocation::GeoNotifier::startTimer):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::setIsAllowed): Start the timer is the UA allows
+        (WebCore::Geolocation::startTimer):
+        (WebCore::Geolocation::startTimersForOneShots):
+        (WebCore::Geolocation::startTimersForWatchers):
+        (WebCore::Geolocation::startTimers):
+        * page/Geolocation.h:
+        (WebCore::Geolocation::GeoNotifier::create):
+
+2009-04-13  Pamela Greene  <pam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix Chromium (V8) build by renaming methods to match changes
+        in http://trac.webkit.org/changeset/42377.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25141
+
+        * bindings/v8/ScheduledAction.cpp:
+     (WebCore::ScheduledAction::execute): updateRendering() -> updateStyleIfNeeded()
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent): updateDocumentsRendering() -> updateStyleForAllDocuments()
+
+2009-04-13  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25136
+        CRASH in DocumentLoader::removeSubresourceLoader due to null m_frame
+
+        Test: fast/frames/frame-unload-crash.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::updateLoading): Added null check of m_frame.
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Tim Hatcher.
+
+        Put the MessagePort constructor back in ENABLE_CHANNEL_MESSAGING.
+
+        * page/DOMWindow.idl:
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix GTK build break.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::updatePosition):
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        Assertion in updateStyleForAllDocuments.  Make sure to unscheduleStyleRecalc when an object goes into
+        the page cache.  Disallow scheduling of style recalcs on a document that is already in the page cache.
+        Schedule a style recalc if needed when an object comes out of the page cache.
+
+        * dom/Document.cpp:
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::setInPageCache):
+
+2009-04-13  Timothy Hatcher  <timothy@apple.com>
+
+        Correctly sort (program) scripts in the Scripts panel popup menu.
+
+        Reviewed by Ada Chan.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu): Refactor the code
+        and sort "(program)" options by the sourceID to maintain some order.
+        * inspector/front-end/utilities.js:
+        (indexOfObjectInListSortedByFunction): Fix a bug where identical objects would cause
+        an incorrect return value that confuses insertionIndexForObjectInListSortedByFunction.
+        Just set 'first' and break so the correct result will be returned.
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24770
+        
+        Add custom code for Coordinates that returns null when required by the
+        Geolocation spec.
+        
+        http://dev.w3.org/geo/api/spec-source.html#coordinates
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCoordinatesCustom.cpp: Added.
+        (WebCore::JSCoordinates::altitude): returns null if the value cannot be provided.
+        (WebCore::JSCoordinates::altitudeAccuracy): Ditto
+        (WebCore::JSCoordinates::heading): Ditto
+        (WebCore::JSCoordinates::speed): Ditto
+        * page/Coordinates.h:
+        (WebCore::Coordinates::create): Add 'canProvide' parameters and values
+        (WebCore::Coordinates::canProvideAltitude):
+        (WebCore::Coordinates::canProvideAltitudeAccuracy):
+        (WebCore::Coordinates::canProvideHeading):
+        (WebCore::Coordinates::canProvideSpeed):
+        (WebCore::Coordinates::Coordinates):
+        * page/Coordinates.idl: specify custom getters
+        * platform/mac/GeolocationServiceMac.mm: Set the values correctly if they cannot be provided.
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-04-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/5510537> Typing return at start of block quote yields empty quoted line
+
+        Test: editing/inserting/5510537.html
+
+        * editing/BreakBlockquoteCommand.cpp: (WebCore::BreakBlockquoteCommand::doApply): If the break insertion position
+        is at the beginning of the topmost quote, then just insert the <br> before the blockquote.  Otherwise, if the break
+        insertion position is at the beginning of any quote, adjust the position so the break comes before the current quote level
+        so we don't end up with an empty line in that quote in addition to the new line we're adding with the <br>.
+
+2009-04-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix problem when encoding history files with duplicate integer arrays near the end of the file.
+        This results in an assertion failure, and if assertions are turned off, corrupted output.
+
+        When writing an integer array it's important not to add an object reference to the
+        aggregate buffer. The writing of the array does not depend on the aggregate buffer. But,
+        more importantly, it's possible this instance integer array is a duplicate and won't be
+        written out. If so, there's no guarantee there's enough space in the aggregate buffer to
+        store the object references (the references will be ignored). In some cases the aggregate
+        buffer can then overrun the data being written; normally this is prevented by the fact that
+        the data being written will include a copy of the aggregate buffer.
+
+        Also removed a bit of unneeded dead code to handle the integer -1.
+
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::BinaryPropertyListPlan::BinaryPropertyListPlan): Removed unneeded
+        m_integerNegativeOneObjectReference, since property lists support only non-negative integers.
+        (WebCore::BinaryPropertyListPlan::writeInteger): Removed support for
+        m_integerNegativeOneObjectReference.
+        (WebCore::BinaryPropertyListPlan::integerObjectReference): Ditto.
+        (WebCore::BinaryPropertyListSerializer::writeIntegerWithoutAddingAggregateObjectReference):
+        Added. Factored out most of writeInteger, for use in writeIntegerArray, without calling
+        addAggregateObjectReference.
+        (WebCore::BinaryPropertyListSerializer::writeInteger): Changed to call the new
+        writeIntegerWithoutAddingAggregateObjectReference function.
+        (WebCore::BinaryPropertyListSerializer::writeIntegerArray): Call the new
+        writeIntegerWithoutAddingAggregateObjectReference function and therefore remove the
+        code to save and restore m_currentAggregateBufferByte, which is no longer needed.
+
+2009-04-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed Qt build fix.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+
+2009-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move the event and crypto attributes and the captureEvents and releaseEvents
+        functions out of JSDOMWindowBase by partially generating them.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::currentEvent): Make const.
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::crypto): Not implemented.
+        (WebCore::JSDOMWindow::event):
+        (WebCore::JSDOMWindow::captureEvents): Not implemented.
+        (WebCore::JSDOMWindow::releaseEvents): Ditto.
+        * page/DOMWindow.idl:
+
+2009-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move more attributes out of JSDOMWindowBase by
+        partially generating them.
+
+        - Expose the MessagePort constructor.
+
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (setJSDOMWindowBaseEvent):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::image):
+        (WebCore::JSDOMWindow::option):
+        (WebCore::JSDOMWindow::audio):
+        (WebCore::JSDOMWindow::webKitPoint):
+        (WebCore::JSDOMWindow::webKitCSSMatrix):
+        (WebCore::JSDOMWindow::xMLHttpRequest):
+        (WebCore::JSDOMWindow::xSLTProcessor):
+        (WebCore::JSDOMWindow::messageChannel):
+        (WebCore::JSDOMWindow::worker):
+        * page/DOMWindow.idl:
+
+2009-04-12  Timothy Hatcher  <timothy@apple.com>
+
+        A resource's filename is not correct after a redirect in the Inspector.
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject): Fix a typo in the
+        lastPathComponent property name.
+
+2009-04-12  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Test: editing/inserting/6609479-1.html
+
+        Follow-up to <rdar://problem/6609479>.
+
+        Before my last change, a Mail blockquote would've been broken up earlier, and you would've been guaranteed that the inserted content
+        was at the start of a paragraph.  Now we need to check for that explicitly, and only merge the start of the inserted content if it is 
+        at the start of a paragraph.
+
+        * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplaceSelectionCommand::shouldMergeStart):
+
+2009-04-11  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6609479> Pressing return inside a table cell that's inside quoted content will split the table
+
+        Test: editing/inserting/6609479.html
+
+        Don't break a blockquote if pasting or inserting into a table.
+
+        * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/TypingCommand.cpp: (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+
+2009-04-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6643103> Unscaled values from body.scrollHeight
+
+        Test: fast/css/zoom-body-scroll.html
+
+        Adjust scroll{Left,Top,Width,Height} values for zoom in getters and
+        setters.
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::adjustForZoom):
+        (WebCore::HTMLBodyElement::scrollLeft):
+        (WebCore::HTMLBodyElement::setScrollLeft):
+        (WebCore::HTMLBodyElement::scrollTop):
+        (WebCore::HTMLBodyElement::setScrollTop):
+        (WebCore::HTMLBodyElement::scrollHeight):
+        (WebCore::HTMLBodyElement::scrollWidth):
+
+2009-04-10  Timothy Hatcher  <timothy@apple.com>
+
+        Allow page navigation and reload while stopped at a breakpoint.
+
+        <rdar://problem/6781108> Having a breakpoint active prevents page reload
+
+        Reviewed by Darin Adler.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didContinue): Call the resumedScript function.
+        * inspector/InspectorController.h: Added didContinue.
+        * inspector/JavaScriptDebugListener.h: Ditto.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::pauseIfNeeded): Call didContinue on the listeners.
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerResumed): Update the interface and state.
+        * inspector/front-end/inspector.js:
+        (WebInspector.resumedScript): Call ScriptsPanel.debuggerResumed.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Call resumeDebugger.
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Remove unused include for JSLock.
+
+        * page/mac/FrameMac.mm:
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add back the keepAlive timer for after the script execution to
+        protect the callers of evaluate, as was part of the original intent
+        of timer.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * page/mac/FrameMac.mm:
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=25137
+
+        If we reload, the animation controller sticks around and has
+        a stale animation time. So the needed delay is computed wrong.
+        I added a reset of the animation timer on load.
+
+        I did not do a test case because this only happens on reload so I
+        couldn't make an automated test. I tried using an iframe and using
+        reload() but that doesn't tickle the bug.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitOpen):
+
+2009-04-10  Grace Kloba  <klobag@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Move WORKERS header files inside ENABLE(WORKERS).
+        So if WORKERS is not enabled and the generated files are not generated, the build is still working.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/ScheduledAction.cpp:
+
+2009-04-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6773515> crash in push_heap inside WebCore when printing
+
+        The crash was due to manipulating a timer on a different thread than the one it was created on.
+        This adds some diagnostics so we'll catch that kind of mistake immediately.
+
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::TimerBase): Store the thread identifier in debug versions.
+        (WebCore::TimerBase::start): Assert it's the same thread the timer was created on.
+        (WebCore::TimerBase::stop): Ditto.
+        (WebCore::TimerBase::isActive): Ditto.
+        (WebCore::TimerBase::setNextFireTime): Ditto.
+
+        * platform/Timer.h: Added the thread identifier data member.
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25108
+
+        If you remove a class with a transition while that transition is running
+        the animation timer will continue to fire after the transition is finished.
+        This has no visual indication, but it does drain the processor. And in some
+        cases it might even cause a glitch in future animations. Unfortunately there
+        is no way to test this without putting in printfs.
+
+        This happens because the animation logic is never traversed after a transition
+        is removed, so we never get a chance to cleanup. So I added cleanup in the logic
+        that fires the dispatch of the last style change when the animation finishes.
+
+        Test: transitions/remove-transition-style.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6648858>
+        CrashTracer: [REGRESSION(Safari 4)] 60 crashes in Safari at com.apple.WebCore • WebCore::ScriptController::evaluate + 241
+
+        The Frame (and therefore ScriptController) were being destroyed
+        during JavaScript execution causing the JSDOMWindowShell to become
+        null.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Use a RefPtr to protect the Frame
+        instead of the keep-alive timer, since a nested event loop used from with-in 
+        JavaScript execution could cause the timer to fire before returning.
+
+2009-04-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25133
+        Fix an error in InspectorController's bindings, clean up a few header
+        includes, make empty object construction in ScriptObject less ambiguous.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::setSetting): Send correct argument from
+            the bindings.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::createNew): Added.
+        * bindings/js/ScriptObject.h: Removed constructor, added decl for createNew.
+        * inspector/ConsoleMessage.cpp: Remove unused header.
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/InspectorResource.cpp:
+        (WebCore::createHeadersObject): Changed to use ScriptObject::createNew.
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=25134
+
+        This both fixes a bug where I was not sending in the right time
+        to continue the animation and was not recomputing current time
+        when coming out of suspend.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::suspendAnimations):
+        (WebCore::AnimationControllerPrivate::resumeAnimations):
+
+2009-04-10  Adam Roben  <aroben@apple.com>
+
+        Give Windows's <select> popup menus drop shadows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        No test possible.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::registerPopup): Use the CS_DROPSHADOW window class style.
+
+2009-04-10  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a bug in the Web Inspector where it would show scripts
+        from previous pages when toggling the debugger off and back on.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25095
+        rdar://problem/6769970
+
+        Reviewed by John Sullivan.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData): Null out the
+        debugger for the scriptController. This balances the attachDebugger
+        that was already in ScriptCachedFrameData::restore.
+        (WebCore::ScriptCachedFrameData::restore): Clean up an if statement.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell): Clear the debugger from
+        the current window before setting the new window.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions): Only accumulate
+        source providers for code associated this as the debugger.
+
+2009-04-10  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6646998> Avoid starting QTKitServer if possible
+        When possible avoid asking QTKit for the MIME types that require QTKitServer
+        when running 64-bit.
+
+        * WebCore.base.exp: Added new entry point.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::addFileTypesToCache): Add an NSArray of types to the cache.
+        (WebCore::mimeCommonTypesCache): Add all "common" QTKit types to the cache.
+        (WebCore::mimeModernTypesCache): Add only "modern" QTKit types to the cache (this list does 
+        not start QTKitServer if it is not already running).
+        (WebCore::MediaPlayerPrivate::getSupportedTypes): Refactored.
+        (WebCore::MediaPlayerPrivate::supportsType): Look in list of "modern" types first to avoid
+        starting QTKitServer if possible.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTIncludeOnlyModernMediaFileTypes.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-10  Adam Roben  <aroben@apple.com>
+
+        Turn on window animations for <select> popup menus
+
+        We turned these off back when <select> popup menus were partially
+        transparent. Now that they're opaque, there's no reason not to
+        animate them.
+
+        Reviewed by Steve Falkenburg.
+
+        No test possible.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show): Remove the #ifdef that was disabling the
+        window animation.
+
+2009-04-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix a regression from r42379 which made zero-width characters affect
+          line height
+
+        Test: fixes fast/text/wide-zero-width-space.html
+
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::overrideLayoutOperation): Add to the fallback font list set
+        here, and only if the glyph is not zero-width...
+        (WebCore::ATSULayoutParameters::initialize): ...instead of doing it
+        here. This matches WidthIterator's behavior.
+
+2009-04-10  Darin Fisher  <darin@chromium.org>
+
+        Fixing build bustage caused by warnings being treated as errors.
+        1- A local variable was only be used inside a debug assertion, which
+           caused grief for the release build.
+        2- Missing initializer for member 'DocumentMarker::activeMatch'
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMarker):
+        (WebCore::Document::setMarkersActive):
+
+2009-04-10  Finnur Thorarinsson  <finnur.webkit@gmail.com>
+
+        Reviewed by John Sullivan.
+
+        Fixing: https://bugs.webkit.org/show_bug.cgi?id=25117
+        (TextMatches don't have a concept of active match)
+
+        For the ports that use the DocumentMarker as highlighting for FindInPage it is
+        useful to have a flag that specifies which marker is active, so it can be drawn
+        in a different color.
+
+        This allows me to remove the hack to use the SelectionController to highlight
+        the active match (in the ChromiumWin port).
+
+        * dom/Document.cpp:
+        (WebCore::Document::setMarkersActive):
+        * dom/Document.h:
+        * dom/DocumentMarker.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderTheme::platformInactiveTextSearchHighlightColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveTextSearchHighlightColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-04-10  Pamela Greene  <pam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Build fix for Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=12440
+
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame): change docWidth() to overflowWidth()
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        Add a timer for style recalc (similar to the one used for scheduling layouts).  For now in order
+        to reduce the risk of regressions, I have left in all the synchronous machinery for updating style
+        following DOM events and JavaScript timeouts.  Eventually these calls will be removed.
+
+        Where the timer will really kick in and be useful is for clients that do style changes from
+        Objective-C DOM bindings or that execute JavaScript to manipulate style from the JavaScriptCore C API.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::appendChild):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::unscheduleStyleRecalc):
+        (WebCore::Document::styleRecalcTimerFired):
+        (WebCore::Document::updateStyleForAllDocuments):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        (WebCore::Node::lazyAttach):
+
+2009-04-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6586787> JS debugger does not work in 64-bit
+
+        Don't truncate the source id in JSCallFrame
+
+        * inspector/JavaScriptCallFrame.h:
+
+2009-04-09  Adam Roben  <aroben@apple.com>
+
+        Start compiling HistoryPropertyList on Windows
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/WebCore.vcproj: Added HistoryPropertyList and its
+        dependencies to the project. Copy headers from history/cf to
+        $WebKitOutputDir.
+        * history/cf/HistoryPropertyList.cpp: Added StringExtras.h so that
+        this file will compile on Windows.
+
+2009-04-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6166612> Text boxes' metrics should be based on
+          the actual fonts used in them, not just the primary font
+
+        Covered by many existing layout tests
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Added a fallbackFonts parameter. If the
+        platform supports collecting fallback fonts in its complex font path
+        and fallbackFonts is not null, all fallback fonts used for the text run
+        will be added to it.
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::width): Ditto.
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): Removed an unnecessary namespace
+        qualifier.
+        (WebCore::Font::floatWidthForSimpleText): Added a fallbackFonts
+        parameter, which is passed down to WidthIterator.
+
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Added a fallbackFonts parameter
+        and used it to initialize the m_fallbackFonts member.
+        (WebCore::WidthIterator::advance): Track the fonts being used and add
+        any fallback fonts to the m_fallbackFonts set. Make sure to only add
+        non-small-caps fonts.
+
+        * platform/graphics/WidthIterator.h:
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns false, meaning this platform's
+        implementation of floatWidthForComplexText() does not populate the
+        fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Updated for the new
+        prototype.
+
+        * platform/graphics/chromium/FontLinux.cpp: Ditto.
+
+        * platform/graphics/gtk/FontGtk.cpp: Ditto.
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::CoreTextController): Added a fallbackFonts
+        parameter and used it to initialize the m_fallbackFonts member.
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Add
+        fallback fonts to m_fallbackFonts.
+
+        * platform/graphics/mac/CoreTextController.h:
+
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns true, indicating that the Mac
+        implementations of floatWidthForComplexText() populate the fallbackFonts
+        set.
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::ATSULayoutParameters::ATSULayoutParameters): Added a
+        fallbackFonts parameter and used it to initialize the m_fallbackFonts
+        member.
+        (WebCore::ATSULayoutParameters::initialize): Add fallback fonts to
+        m_fallbackFonts.
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to ATSULayoutParameters.
+
+        * platform/graphics/mac/FontMacCoreText.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to CoreTextController.
+
+        * platform/graphics/win/FontWin.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns true, indicating that the
+        UniscribeController-based implementations of floatWidthForComplexText()
+        populate the fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to UniscribeController.
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::UniscribeController): Added a
+        fallbackfonts parameter and used it to initialize m_fallbackFonts.
+        (WebCore::UniscribeController::advance): Add fallback fonts to
+        m_fallbackFonts.
+
+        * platform/graphics/win/UniscribeController.h:
+        
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns false, meaning this platform's
+        implementation of floatWidthForComplexText() does not populate the
+        fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Updated for the new
+        prototype.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights): For an InlineTextBox
+        with multiple fonts, compute a common baseline and line height by
+        considering all fonts' ascents and descents (and line spacing, if
+        applicable).
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::setFallbackFonts): Added. Temporarily stores
+        the set of fallback fonts in a vector.
+        (WebCore::InlineTextBox::takeFallbackFonts): Added. Returns the fallback
+        fonts previously stored and removes them from storage.
+
+        * rendering/InlineTextBox.h:
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText): Initialized the
+        m_knownNotToUseFallbackFonts to false.
+        (WebCore::RenderText::styleDidChange): Reset
+        m_knownNotToUseFallbackFonts to false if the style difference is such that
+        affects layout.
+        (WebCore::RenderText::widthFromCache): Added a fallbackFonts parameter,
+        which is passed down to Font::width().
+        (WebCore::RenderText::trimmedPrefWidths): Updated for the change to
+        widthFromCache().
+        (WebCore::RenderText::calcPrefWidths): Made this call a private version
+        of calcPrefWidths() that takes a fallbackFonts parameter and set the
+        m_knownNotToUseFallbackFonts to true if the set comes back empty.
+        The private version passes the fallbackFonts set to widthFromCache().
+        (WebCore::RenderText::setText): Reset m_knownNotToUseFallbackFonts to
+        false.
+        (WebCore::RenderText::createFallbackFontMetricsBox): Added.
+        (WebCore::RenderText::width): Added a fallbackFonts parameter, which is
+        passed down to calcPrefWidths(), widthFromCache() and Font::width().
+        Set m_knownNotToUseFallbackFonts to true when appropriate.
+
+        * rendering/RenderText.h:
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::constructLine): Added an assertion and a continue
+        statement to remove one level of indentation.
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine): Temporarily
+        store the set of fallback fonts in the InlineTextBox.
+        (WebCore::RenderBlock::computeVerticalPositionsForLine): Added an
+        assertion.
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Rename all of the changed()/setChanged()/setDocumentChanged() methods to mention style recalc
+        explicitly instead.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::updateStyleIfNeededForBindings):
+        (WebCore::ScriptController::initJavaJSBindings):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removeProperty):
+        (WebCore::CSSMutableStyleDeclaration::setNeedsStyleRecalc):
+        (WebCore::CSSMutableStyleDeclaration::setProperty):
+        (WebCore::CSSMutableStyleDeclaration::setStringProperty):
+        (WebCore::CSSMutableStyleDeclaration::setImageProperty):
+        (WebCore::CSSMutableStyleDeclaration::parseDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::addParsedProperties):
+        (WebCore::CSSMutableStyleDeclaration::setCssText):
+        (WebCore::CSSMutableStyleDeclaration::merge):
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::allVisitedStateChanged):
+        (WebCore::CSSStyleSelector::SelectorChecker::visitedStateChanged):
+        * css/CSSVariablesDeclaration.cpp:
+        (WebCore::CSSVariablesDeclaration::removeVariable):
+        (WebCore::CSSVariablesDeclaration::setVariable):
+        (WebCore::CSSVariablesDeclaration::setNeedsStyleRecalc):
+        * css/CSSVariablesDeclaration.h:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::ContainerNode::detach):
+        (WebCore::ContainerNode::setFocus):
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::unscheduleStyleRecalc):
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::updateStyleIfNeeded):
+        (WebCore::Document::updateStyleForAllDocuments):
+        (WebCore::Document::updateLayout):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::prepareMouseEvent):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::setCSSTarget):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        (WebCore::checkForSiblingStyleChanges):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        (WebCore::Node::setNeedsStyleRecalc):
+        (WebCore::Node::lazyAttach):
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/Node.h:
+        (WebCore::Node::needsStyleRecalc):
+        (WebCore::Node::childNeedsStyleRecalc):
+        (WebCore::Node::setChildNeedsStyleRecalc):
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        (WebCore::StyledElement::classAttributeChanged):
+        (WebCore::StyledElement::parseMappedAttribute):
+        * dom/Text.cpp:
+        (WebCore::Text::recalcStyle):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::enable):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setBaseWritingDirection):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::setInnerText):
+        (WebCore::HTMLElement::isContentEditable):
+        (WebCore::HTMLElement::isContentRichlyEditable):
+        (WebCore::HTMLElement::contentEditable):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::recalcStyle):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setIndeterminate):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setAutofilled):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::finishParsingChildren):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        (WebCore::HTMLObjectElement::finishParsingChildren):
+        (WebCore::HTMLObjectElement::childrenChanged):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::restoreState):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        * html/HTMLTableElement.cpp:
+        (WebCore::setTableCellsChanged):
+        (WebCore::HTMLTableElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::executeScript):
+        (WebCore::FrameLoader::gotoAnchor):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::alert):
+        (WebCore::DOMWindow::confirm):
+        (WebCore::DOMWindow::prompt):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hoverTimerFired):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::needsLayout):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::clear):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::startupdateStyleIfNeededDispatcher):
+        (WebCore::AnimationControllerPrivate::addEventToDispatch):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationController::cancelAnimations):
+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateDragState):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::svgAttributeChanged):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::svgAttributeChanged):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::setNeedsUpdate):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::addCSSPropertyAndNotifyAttributeMap):
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::parseMappedAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::parseMappedAttribute):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::SVGUseElement::childrenChanged):
+        (WebCore::SVGUseElement::recalcStyle):
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::parseMappedAttribute):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+
+2009-04-09  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        When there is a shadow set but it specifies "no shadow", clear the
+        shadow shader. This will prevent Chromium from thinking there's a
+        shadow and using the Skia codepath rather than Windows.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Crash when accessing svg.viewport on a detached SVGSVGElement
+        https://bugs.webkit.org/show_bug.cgi?id=25105
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::isOutermostSVG): return "true" that we are the "outermost" SVG element if we have no parent.  (The spec is unclear as to what behavior we should have in this case, and I doubt anyone cares for now).
+
+2009-04-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25084
+        Upstream changes to V8 bindings for XHR so that it can work under either DOMWindow or WorkerContext.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListenerHelper):
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateObjectEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson and Sam Weinig.
+
+        Part of <rdar://problem/5438063> Saving history containing 100,000 entries causes pauses of 2s while browsing
+
+        Longer term solution is to change the design so Safari doesn't read and write all of history.
+        This patch is step one: Do the serializing, which is done on the main thread, much faster.
+
+        * WebCore.base.exp: Added new entry points.
+        * WebCore.xcodeproj/project.pbxproj: Added new source files.
+
+        * history/cf: Added.
+
+        * history/cf/HistoryPropertyList.cpp: Added.
+        * history/cf/HistoryPropertyList.h: Added. Code to write history files. In the future we'll also
+        have code for reading here too.
+
+        * platform/cf/BinaryPropertyList.cpp: Added.
+        * platform/cf/BinaryPropertyList.h: Added. Code to write binary property list files.
+
+2009-04-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=25122
+
+        If deferred repainting is active, we need to ensure that there are no repaints
+        pending at the end of layoutIfNeededRecursive, which is called just before
+        painting via -viewWillDraw.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+
+2009-04-09  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25117
+        Fix Mac Chromium form controls.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        When rendering native controls in Mac Chromium, use a clean NSGraphicsContext.
+        Properly save and restore native graphics context.
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-04-09  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25030
+        Refactor MessagePort code to enable Chrome to use a MessagePortProxy object
+        instead of a real MessagePort for the entangledPort, since it could
+        theoretically live in a separate process.
+
+        The goal of this refactoring is to remove all assumptions that the object
+        representing the entangled port is actually of type MessagePort. All
+        operations that were previously directly modifying private MessagePort member
+        variables in the entangled port (i.e. entangle(), postMessage()) have been changed
+        to invoke functions in the  MessagePortProxy interface instead which will allow
+        the Chrome bindings to proxy these calls to another process.
+
+        No new layout tests, as this is just a refactoring with no bug fixes
+        or new functionality.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::clone):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::deliverMessage):
+        (WebCore::MessagePort::startConversation):
+        (WebCore::MessagePort::close):
+        (WebCore::MessagePort::entangle):
+        (WebCore::MessagePort::unentangle):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::entangledPort):
+        * dom/MessagePortProxy.h: Added.
+        (WebCore::MessagePortProxy::~MessagePortProxy):
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Big Boy" Garen.
+
+        Fix for <rdar://problem/5745677> Possible to stop load during an unload event
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=20605
+
+        Tests: fast/events/stop-load-in-unload-handler-using-document-write.html
+               fast/events/stop-load-in-unload-handler-using-window-stop.html
+
+        Don't allow calling methods that would stop the new load inside the unload
+        event.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::stopAllLoaders):
+        * loader/FrameLoader.h:
+
+2009-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        Reinstating <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Rolled r42345 back in.  The build failure was caused by an
+        internal script which had not been updated the same way that
+        build-webkit was updated.
+
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm:
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm:
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h:
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+
+2009-04-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25109
+
+        Eliminate CompositeAnimationPrivate, which was a needless level
+        of abstraction. Remove the methods like addToStyleAvailableWaitList()
+        that simply turn around and call the animation controller.
+        
+        Rename animationControllerPriv() to animationController().
+        Rename willNeedService() to timeToNextService().
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::~AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::timeToNextService):
+        (WebCore::AnimationBase::beginAnimationUpdateTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::~CompositeAnimation):
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::overrideImplicitAnimations):
+        (WebCore::CompositeAnimation::resumeOverriddenImplicitAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::animationController):
+        (WebCore::CompositeAnimation::isSuspended):
+        (WebCore::CompositeAnimation::hasAnimations):
+        (WebCore::CompositeAnimation::CompositeAnimation):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        (WebCore::ImplicitAnimation::timeToNextService):
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        (WebCore::KeyframeAnimation::timeToNextService):
+        * page/animation/KeyframeAnimation.h:
+
+2009-04-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverting <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings.
+        It broke Mac build, and I don't know how to fix it.
+
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm:
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm:
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h:
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        RenderView::docWidth() was made private by r42334. That commit
+        changes its usage for overflowWidth(), so do that here too.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkObject::ref_state_set. Still quite a few states not
+        implemented.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Move fallback object creation to its own function, as it will be
+        used in several places.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Move AccessibilityObject methods to their file.
+
+        * page/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::wrapper):
+        (WebCore::AccessibilityObject::setWrapper):
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Rework accessibility type generation code, based on Mozilla a11y
+        implementation.
+
+        Have one base a11y type, and generate derived types that implement
+        only the necessary interfaces at runtime, based on the specific
+        object we are wrapping. This allows to save a lot of code while
+        covering all possible cases.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix document.implementation.createDocument(null, "a:b") not to crash!
+        https://bugs.webkit.org/show_bug.cgi?id=25096
+
+        Test: fast/dom/DOMImplementation/createDocument-namespace-err.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::addChild): add ASSERT() to give a better crash next time
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument): check the exception code before using the result
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Make <select>s in application chrome documents match the Vista system
+        dialog look
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::documentIsInApplicationChromeMode): Added this simple helper
+        function.
+        (WebCore::RenderThemeWin::getThemeData): In application chrome mode,
+        the drop down button never uses any look but the "normal" look.
+        (WebCore::RenderThemeWin::paintMenuList): In application chrome mode,
+        use the "readonly" style to match system dialogs.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://6592515> Crash closing tab with Top Sites or Cover Flow
+        showing after clicking "Go Back" in phishing alert
+
+        RenderButton's m_timer is not stopped when its Document enters the
+        page cache. When the WebView was torn down, the timer would fire after
+        the Frame's Page had been destroyed, leading to a crash. This patch
+        just makes the timer do nothing when it fires. Making the timer not
+        fire when in the page cache is covered by bug 25110.
+
+        Reviewed by Dave Hyatt.
+
+        No test possible.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::timerFired): Do nothing when we're in the page
+        cache.
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Fix bugs where we would mistakenly turn off blitting for iframes if an external paint
+        caused the checks to be triggered too early in the loading process of the frame.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2009-04-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Cameron Zwarich
+
+        https://bugs.webkit.org/show_bug.cgi?id=25106
+        
+        Fix signature of virtual function on AnimationBase so that it matches
+        those in the derived classes, by removing unused parameter.
+        
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::endAnimation):
+
+2009-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Introduce the ENABLE_SVG_DOM_OBJC_BINDINGS feature define so
+        that SVG DOM Objective-C bindings may be optionally disabled.
+
+        * Configurations/WebCore.xcconfig: Added
+        ENABLE_SVG_DOM_OBJC_BINDINGS variable and use it in
+        FEATURE_DEFINES and EXCLUDED_SOURCE_FILE_NAMES.  When SVG DOM
+        Objective-C bindings are disabled, two generated header files no
+        longer exist and none of the generated DOMSVG*.mm files should
+        be compiled.
+        * DerivedSources.make: All of the WebCore.SVG*.exp files contain
+        SVG DOM Objective-C bindings classes, so exclude them unless
+        ENABLE_SVG_DOM_OBJC_BINDINGS is set.
+        * bindings/objc/DOM.mm: Switched from using ENABLE(SVG) to using
+        ENABLE(SVG_DOM_OBJC_BINDINGS).
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm: Ditto.
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm: Ditto.
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h: Ditto.
+        * bindings/objc/ExceptionHandlers.mm: Added use of
+        ENABLE(SVG_DOM_OBJC_BINDINGS).
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl: Excluded -getSVGDocument method
+        in generated Objective-C DOM classes if SVG DOM Objective-C
+        bindings are disabled.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-04-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - limit the workaround for <rdar://problem/5781372> to Mac OS X versions
+          that need it
+
+        * platform/mac/WebFontCache.mm:
+        (fixUpWeight): Changed this function to be a no-op post-Leopard.
+
+2009-04-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6771547> Appending to a RenderText causes all its
+          lines to be dirtied
+
+        Test: fast/repaint/text-append-dirty-lines.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setTextWithOffset): If no text boxes intersected
+        with or came after the new text, dirty the last root box, since the new
+        text may begin there. Having at least one dirty line prevents the
+        incorrect dirtying of all lines later during layoutInlineChildren().
+
+2009-04-08  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25100
+
+        Fixes a Chromium-specific crash in WebCore::ImageBuffer::context that
+        occurs when rendering semi-transparent RTL text.
+
+        Test: fast/text/complex-text-opacity.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp: Handle RTL when computing text bounds.
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::estimateTextBounds):
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin
+
+        Fix a porting error in my previous patch.  A != was supposed to be an ==.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben and Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=12440, repaints inconsistent for
+        fixed positioned elements.
+
+        Rewrite the updateScrollers method to be more correct in its results.
+
+        Test: fast/block/positioning/fixed-positioning-scrollbar-bug.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::implicitClose):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::adjustPageHeight):
+        * page/FrameView.h:
+        * page/win/FrameWin.cpp:
+        (WebCore::computePageRectsForFrame):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::docHeight):
+        (WebCore::RenderView::docWidth):
+        * rendering/RenderView.h:
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6226200> Implement Microsoft's X-FRAME-OPTIONS anti-framing defense
+
+        Tests: http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html
+               http/tests/security/XFrameOptions/x-frame-options-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Stop the current load and redirect to about:blank
+        if an X-FRAME-OPTIONS <meta> tag http-equiq dictates we should.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions): Add logic to parse
+        the X-FRAME-OPTIONS parameter.
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse): Stop the current load if framed and
+        a X-FRAME-OPTIONS header and its parameter dictate that we should.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Fix http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect.html on Windows
+
+        Reviewed by Sam Weinig.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Mimic the
+        ResourceHandleMac code by propagating the CFError's error code for
+        kCFErrorDomainCFNetwork errors to the ResourceResponse.
+
+2009-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the PPC build.
+        
+        * plugins/npfunctions.h:
+
+2009-04-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/5908616> tokenizer resizer should handle edge cases consistently
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeBuffer): Handle edge cases the same way as a failed fastMalloc.
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Ditto.
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler
+
+        Make sure that cloneNode works with SVG attributes that require synchronization.  This fixes
+        issues with <use> element shadow tree cloning where the clones can end up not obtaining the
+        correct attribute values.
+
+        A subsequent patch of mine will expose this problem and cause it to be covered by existing
+        layout tests, so no test is required at this time for this problem.
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneElementWithoutChildren):
+
+2009-04-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25093
+        REGRESSION: some scripts are showing in the Inspector with only "true"
+        as the source.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didParseSource): Fixed conversion issue.
+        (WebCore::InspectorController::failedToParseSource): Ditto.
+
+2009-04-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24904
+
+        Verify the MIME type of stylesheets (in standards mode) by looking
+        at the Content-Type header directly.  This bypasses any content
+        sniffing that might be confusing the issue.
+
+        Test: http/tests/mime/standard-mode-loads-stylesheet-without-content-type-header.html
+
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::canUseSheet):
+
+2009-04-08  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25041
+        <rdar://problem/6697754>
+        Bug 25041: HTMLMediaElement: OSX autoplay broken by r41907
+        
+        OSX media player should set readyState to HAVE_ENOUGH_DATA when the movie's load state
+        reaches QTMovieLoadStatePlaythroughOK, not when the entire file has been downloaded,
+        so autoplay can begin when it should.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Set readState to 
+        HAVE_ENOUGH_DATA when QTMovie load state reaches QTMovieLoadStatePlaythroughOK.
+        (WebCore::MediaPlayerPrivate::paint): Add braces missed in r42203.
+
+2009-04-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Kilzer. Based on a patch by Grace Kloba.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24656
+        cacheControlContainsNoCache() in ResourceResponseBase.h is wrong
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Removed misused code for
+        parsing directive values, fixing parsing of directives that we care about.
+
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::cacheControlContainsNoCache): Fixed a copy/paste mistake,
+        m_cacheControlContainsMustRevalidate was returned instead of m_cacheControlContainsNoCache.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Make text fields match the system look on Vista
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::getThemeData): Use the new-to-Vista
+        EP_EDITBORDER_NOSCROLL part for text fields.
+
+2009-04-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24957
+        REGRESSION: Google calendar widget no longer shows upcoming events
+
+        Test: http/tests/xmlhttprequest/authorization-header.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData): Removed Authorization from
+        the list of forbidden headers.
+
+2009-04-07  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Remove no longer needed debug warning and Windows-specific codepaths
+        (as we now use the Safari/Win port's timer there)
+
+        https://bugs.webkit.org/show_bug.cgi?id=25070
+
+        * platform/wx/SharedTimerWx.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Fix many <video> regression tests on Windows
+
+        Reviewed by Dave Hyatt.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getNaturalSize): Call GetMovieNaturalBoundsRect, which
+        returns the movie's natural bounds (duh), rather than GetMovieBox,
+        which returns the movie's current displayed size/position.
+
+2009-04-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig
+
+        <rdar://problem/5968249> "Private Browsing" doesn't affect HTML 5 LocalStorage
+
+        The expected behavior for persistent storage when private browsing mode is undefined by the spec.
+        For now we're going with a "read-only when in private browsing" policy until we can get feedback
+        and/or get the behavior specified in the spec.
+
+        Note that I purposefully made the change to restrict SessionStorage to read-only, also, with the
+        understanding that the spec allows for SessionStorage to persist across relaunches, even though
+        our implementation currently doesn't do this.
+
+        * dom/DOMCoreException.idl: Add some new ExceptionCodes defined in HTML5, one of which is needed
+          for LocalStorage changes (QUOTA_EXCEEDED_ERR)
+        * dom/ExceptionCode.cpp: 
+        * dom/ExceptionCode.h:
+
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::internalSetItem): If private browsing is enabled, throw the QUOTA_EXCEEDED_ERR
+          exception as the spec allows.
+        (WebCore::StorageArea::internalRemoveItem): If private browsing is enabled, silently fail to remove
+          the item.
+        (WebCore::StorageArea::internalClear): If private browsing is enabled, silently fail to clear the area.
+
+2009-04-07  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6148255>
+
+        Standalone media documents can not always handle everything
+        using a <video> element. In these cases switch to an <embed>
+        element that uses the QuickTime plugin, in the hope that it
+        will have more luck. Typical media types that trigger this
+        are streamed media and QTVR.
+
+        Equivalent Windows fix to come once reviewed. Note also that
+        this area of code needs a cleanup:
+        https://bugs.webkit.org/show_bug.cgi?id=25085
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
+        * html/HTMLMediaElement.h:
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::mediaElementSawUnsupportedTracks):
+        (WebCore::MediaDocument::replaceVideoWithEmbed):
+        * loader/MediaDocument.h:
+            - removes the <video> element and puts in an <embed>
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerSawUnsupportedTracks):
+            - new internal method for flagging a problem
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+            - looks for the types of content we don't handle
+        (WebCore::MediaPlayerPrivate::rateChanged):
+        (WebCore::MediaPlayerPrivate::sizeChanged):
+        (WebCore::MediaPlayerPrivate::timeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks):
+            - inform the MediaClient that we have a potential problem
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6767428> Resurrect
+          +[WebFontCache fontWithFamily:traits:size:] for clients that call it
+          directly
+
+        WebFontCache is a class in the WebCore framework and is not WebKit API,
+        but apparently (perhaps mistakenly) some clients call this private
+        interface.
+
+        This change resurrects the interface and gives it reasonable behavior
+        (however, note that WebCore will not call the old interface, so hacks that
+        override it will have no effect on WebKit clients).
+
+        * platform/mac/WebFontCache.h:
+        * platform/mac/WebFontCache.mm:
+        (+[WebFontCache fontWithFamily:traits:size:]): Added. Call through to
+        +fontWithFamily:traits:weight:size:.
+
+2009-04-07  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Fix ScrollView's algorithm that determines whether or not to show scrollbars.  There was a bug
+        with the method mainly because RenderView will size itself to the viewport's size, making it
+        impossible to really know the document's "true" size.
+
+        In order to solve this problem ScrollView now has a minimumContentsSize method.  This method
+        returns the document size excluding the RenderView from the calculation.  This width/height
+        is now cached on RenderView in m_docWidth/m_docHeight member variables.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustPageHeight):
+        (WebCore::FrameView::minimumContentsSize):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::minimumContentsSize):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::calcDocHeight):
+        (WebCore::RenderView::calcDocWidth):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::docWidth):
+        (WebCore::RenderView::docHeight):
+
+2009-04-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Build fix, not reviewed.
+
+        * WebCore.xcodeproj/project.pbxproj: Made ScriptObject.h private.
+
+2009-04-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25063
+        Refactor InspectorController to use ScriptObject/State.
+
+        * GNUmakefile.am: Added ScriptState.cpp.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::addSourceToFrame): Fixed argument index typo.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call): Added reportExceptions parameter.
+        (WebCore::ScriptFunctionCall::construct): Ditto.
+        * bindings/js/ScriptFunctionCall.h: Ditto.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::handleException): Added exception-reporting heloper.
+        (WebCore::ScriptObject::set): Changed to use handleException.
+        (WebCore::ScriptGlobalObject::set): Ditto,
+        * bindings/js/ScriptObject.cpp: Added ScriptGlobalObject.
+        (WebCore::ScriptGlobalObject::set): Added.
+        (WebCore::ScriptGlobalObject::getObject): Added.
+        * bindings/js/ScriptObject.h: Added ScriptGlobalObject decls.
+        (WebCore::ScriptGlobalObject::ScriptGlobalObject): Added.
+        * bindings/js/ScriptState.cpp: Added.
+        * bindings/js/ScriptState.h: Added scriptStateFromPage decl.
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole): Changed to not report exceptions
+            to avoid re-entrancy.
+        * inspector/InspectorController.cpp: Refactored to use ScriptState/Object.
+        * inspector/InspectorController.h: Ditto.
+
+2009-04-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25083
+
+        Skia was previously calculating the leading value incorrectly, leading
+        us to add fHeight to get the height of a line of text. Now that Skia
+        is calculating fLeading correctly, we can remove fHeight.
+
+        This doesn't affect any layout tests.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-04-07  Brian Weinstein  <bweinstein@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24851
+
+        This fix removes the status code from the status message in a ResourceResponse, which allows a few more tests in http to pass.
+
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-04-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25081
+
+        Skia is changing from reporting the XRange to reporting the XMin and
+        XMax.  Obviously these are equivalent, but other users of the metrics
+        need the two numbers to be separate.
+
+        This doesn't affect any layout tests.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Make the look of <select>s match the system look on Vista
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp: Added new constants.
+        (WebCore::RenderThemeWin::getThemeData): On Vista, use the
+        CP_DROPDOWNBUTTONRIGHT part for drop down buttons.
+        (WebCore::RenderThemeWin::paintMenuList): On Vista, use the CP_BORDER
+        part to draw the border of <select>s.
+        (WebCore::RenderThemeWin::paintMenuListButton): On Vista, outset the
+        drop down button to make its border coincide with the <select>'s
+        border.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Move isRunningOnVistaOrLater to a shared location
+
+        Rubber-stamped in advance by Dave Hyatt.
+
+        * WebCore.vcproj/WebCore.vcproj: Added SystemInfo.{cpp,h}, and let VS
+        have its way with the rest of the file.
+        * platform/win/ScrollbarThemeWin.cpp: Moved isRunningOnVistaOrLater
+        from here...
+        * platform/win/SystemInfo.cpp: Added.
+        (WebCore::isRunningOnVistaOrLater): ...to here.
+        * platform/win/SystemInfo.h: Added.
+
+2009-04-07  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24692
+        Enable PopupMenuChromium to handle HTML select popups using native
+        cocoa controls on the Mac, all other platforms are unchanged.
+
+        We also split out the storage container for the popup menu items
+        so that ChromeClientChromium can access them for forwarding to
+        the embedding host (Chromium.app or test_shell).
+
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::items):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::menuItemHeight):
+        (WebCore::popupData):
+        (WebCore::PopupListBox::pointToRowIndex):
+        (WebCore::PopupListBox::getRowBounds):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::updateFromElement):
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupListBox::clear):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupItem::):
+        (WebCore::PopupItem::PopupItem):
+
+2009-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Added some double-checking to event handler marking. Now, when the
+        wrapper that's responsible for marking an event handler's JavaScript
+        function gets collected, it clears the event handler's JavaScript function
+        so we won't dereference it after it's collected.
+        
+        In theory, we would never dereference a JavaScript event handler after
+        its node's wrapper was collected anyway, but it's nice to be safe.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::invalidateJSFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::markEventListeners):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::mark):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::invalidateJSFunction):
+        (WebCore::EventListener::markJSFunction):
+        (WebCore::markIfNotNull):
+
+2009-04-07  David Levin  <levin@chromium.org>
+
+        Build fix.
+
+        r44280 undid the change in r42268 that made CookieJar.h private.
+        This redoes the change.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-04-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream changes to WorkerContextExecutionProxy for enabling V8 preemption.
+        https://bugs.webkit.org/show_bug.cgi?id=25034
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6764359> Thai word selection misbehaves for the
+          last sentence in the document
+
+        Test: editing/selection/thai-word-at-document-end.html
+
+        * editing/visible_units.cpp:
+            - Added a BoundarySearchContextAvailability enum used to indicate
+            whether the caller to a boundary search function may be able to provide
+            additional text in the search direction and call again.
+            - Added a named type for the boundary search function signature. Changed
+            the signature to take a context availability parameter and a boolean
+            out parameter indicating whether more context is needed to perform
+            the search.
+        (WebCore::previousBoundary): If the beginning of the range was reached
+            but the last search wanted more context, perform the search again, this
+            time indicating that there is no earlier text.
+        (WebCore::nextBoundary): Similarly, in the other direction.
+        (WebCore::startWordBoundary): Check whether more context may be available
+            and ask for more context if needed.
+        (WebCore::endWordBoundary): Ditto.
+        (WebCore::previousWordPositionBoundary): Ditto.
+        (WebCore::nextWordPositionBoundary): Ditto.
+        (WebCore::startSentenceBoundary):  Updated signature.
+        (WebCore::endSentenceBoundary): Ditto.
+        (WebCore::previousSentencePositionBoundary): Ditto.
+        (WebCore::nextSentencePositionBoundary): Ditto.
+
+2009-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        
+        A little renaming:
+        
+        function => jsFunction
+        listener => jsFunction
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::mark):
+        (WebCore::JSProtectedEventListener::JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::~JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::jsFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSProtectedEventListener::create):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * dom/EventListener.h:
+        (WebCore::EventListener::jsFunction):
+
 2009-04-07  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler
@@ -303,6 +21323,436 @@
         * page/DOMWindow.h:
         (WebCore::DOMWindow::optionalLocalStorage): Return m_localStorage, not m_sessionStorage.
 
+2009-04-07  Darin Adler  <darin@apple.com>
+
+        Roll out incorrect build fix.
+
+        * WebCore.NPAPI.exp: Reverted.
+
+2009-04-07  Darin Adler  <darin@apple.com>
+
+        Another build fix.
+
+        * WebCore.NPAPI.exp: Added new functions.
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Another build fix.
+        
+        * plugins/npfunctions.h:
+
+2009-04-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Fix non-Mac builds.
+
+        * bridge/npapi.h:
+
+2009-04-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25082
+        
+        Clean up repaint logic when RenderLayers become and stop being composited.
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        (WebCore::RenderLayer::repaintIncludingNonCompositingDescendants):
+        New compositing-only method that repaints a layer and all its non-composited descendants.
+        Takes a repaintContainer for performance; all the repaints necessarily share the same
+        repaintContainer.
+
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        Rather than use calculateCompositedBounds() to compute the repaint rect (which gave
+        the wrong answer when the composited layer tree was in flux), use the new
+        repaintOnCompositingChange() method.
+        
+        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
+        Call repaintIncludingNonCompositingDescendants(), and if necessary make sure
+        that the view/layer drawing synchronization happens.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do a repaintOnCompositingChange() when a layer is going to be composited. This is
+        a good place because we haven't started to change the compositing tree.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        After we've finished updating all the descendant layers, we can do a repaint for
+        layers that ceased compositing.
+
+2009-04-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25069
+        
+        Clean up the accelerated compositing code that determines the format of
+        the GraphicsLayer hierarchy, being more explicit about which parts have
+        to happen before and after descendant layers have been updated. Also remove
+        some unhelpful caching of state.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        Only call updateCompositingLayers() if we know we're not going to be
+        doing a layout soon.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setDrawsContent):
+        Toggling drawsContent from false to true should do a setNeedsDisplay().
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        updateLayerCompositingState() no longer updates the layer geometry, so
+        do that here if we're not going to rebuild layers anyway.
+        Also, updateLayerCompositingState() no longer does a setContentsNeedDisplay,
+        so do that if the style change indicates that a repaint is required.
+        
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        The 'drawing optimizations' logic has been rolled into updateGraphicsLayerConfiguration()
+        and updateGraphicsLayerGeometry().
+        
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        Group that code that decides what GraphicsLayers are needed into this method,
+        which deals with clipping layers and 'direct compositing': images that can be
+        rendered via the compositor.
+        
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        Call setDrawsContent() if updateGraphicsLayerConfiguration() didn't already
+        figure it out for image layers.
+        
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+        Remove the m_simpleCompositingLayerStatusDirty cache indicator, since we just
+        computed it every time anyway.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        updateGraphicsLayers() was renamed to updateGraphicsLayerConfiguration(),
+        which calls clippedByAncestor() etc. itself rather than having everything passed in.
+        Repaints are taken care of by styleChanged() and setDrawsContent().
+        
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        !layer->isComposited() && layer->transform() is a synonym for paintsWithTransform().
+        
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+        No need to call updateGraphicsLayerGeometry() here, because we're going to
+        rebuild layers anyway.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        Add comments, and test layerBacking instead of layer->isComposited().
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+        
+        * WebCore.base.exp:
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6667001> NPAPI: need NPN_Get/SetValueForURL() and NPN_GetAuthenticationInfo()
+        
+        * WebCore.base.exp:
+        Add symbols needed by WebKit.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+        Make CookieJar a private header.
+        
+        * bridge/npapi.h:
+        Add function definitions.
+        
+        * plugins/npfunctions.h:
+        Fix the NPN_SetValueForURLProcPtr signature.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://6520933> REGRESSION (3.2.1-ToT): Scroll bar disappears in
+        WebView and Bookmarks view after switching theme or turning on High
+        Contrast mode
+
+        Reviewed by Dave Hyatt.
+
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::themeChanged): Null out scrollbarTheme
+        after closing it so that we'll re-open the theme next time we paint.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Small cleanup/correctness fix in ScrollbarThemeWin
+
+        Reviewed by Dave Hyatt.
+
+        * platform/win/ScrollbarThemeWin.cpp: Removed the now-unused
+        haveTheme boolean.
+        (WebCore::checkAndInitScrollbarTheme): Check IsThemeActive() before
+        calling OpenThemeData. This seems to be what MSDN recommends.
+        (WebCore::ScrollbarThemeWin::themeChanged): Null-check scrollbarTheme
+        before closing it, rather than indirectly null-checking it via
+        checking haveTheme.
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - when -webkit-line-break: after-white-space is specified but the text
+          does not auto-wrap, do not shrink the trailing space to fit in the
+          available width
+
+        Test: fast/text/whitespace/nowrap-line-break-after-white-space.html
+
+        - when shrinking such trailing space, do not shrink below zero
+
+        Covered by existing tests
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RangeBoundaryPoint off of Position, per Darin's suggestion
+        https://bugs.webkit.org/show_bug.cgi?id=24966
+
+        Rename setToChild to setToBeforeChild (since that's what the method does)
+
+        * dom/Position.h:
+        (WebCore::Position::offsetInContainerNode):
+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::boundaryNodeWillBeRemoved):
+        * dom/Range.h:
+        (WebCore::Range::startPosition):
+        (WebCore::Range::endPosition):
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):
+        (WebCore::RangeBoundaryPoint::container):
+        (WebCore::RangeBoundaryPoint::childBefore):
+        (WebCore::RangeBoundaryPoint::position):
+        (WebCore::RangeBoundaryPoint::offset):
+        (WebCore::RangeBoundaryPoint::clear):
+        (WebCore::RangeBoundaryPoint::set):
+        (WebCore::RangeBoundaryPoint::setOffset):
+        (WebCore::RangeBoundaryPoint::setToBeforeChild):
+        (WebCore::RangeBoundaryPoint::setToStartOfNode):
+        (WebCore::RangeBoundaryPoint::setToEndOfNode):
+        (WebCore::RangeBoundaryPoint::childBeforeWillBeRemoved):
+        (WebCore::RangeBoundaryPoint::invalidateOffset):
+
+2009-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add containerNode(), computeOffsetInContainerNode(),
+        computeNodeBeforePosition() and computeNodeAfterPosition().
+        https://bugs.webkit.org/show_bug.cgi?id=24763
+
+        These functions will replace uses of rangeCompliantPosition()
+        in future patches.
+
+        No changes in behavior, thus no tests.
+
+        * dom/Position.cpp:
+        (WebCore::Position::containerNode):
+        (WebCore::Position::computeOffsetInContainerNode):
+        (WebCore::Position::computeNodeBeforePosition):
+        (WebCore::Position::computeNodeAfterPosition):
+        (WebCore::Position::anchorType):
+        * dom/Position.h:
+        (WebCore::Position::):
+
+2009-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Bottleneck dispatching mutation events in a new dispatchMutationEvent
+        function.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchMutationEvent):
+        * dom/Node.h:
+
+2009-04-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25059
+        Remove references to dominantScript, getGenericFontForScript.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp: Removed references
+            to getGenericFontForScript.
+        (WebCore::FontCache::getLastResortFallbackFont): Removed calls to dominantScript.
+        * platform/graphics/chromium/FontCacheLinux.cpp: Ditto.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::defaultGUIFont): Removed Document* arg.
+        (WebCore::RenderThemeChromiumLinux::systemFont): Ditto.
+        * rendering/RenderThemeChromiumLinux.h: Ditto.
+        * rendering/RenderThemeChromiumMac.h: Ditto.
+        * rendering/RenderThemeChromiumMac.mm: Ditto.
+        (WebCore::RenderThemeChromiumMac::systemFont): Ditto.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::defaultGUIFont): Ditto.
+        (WebCore::RenderThemeChromiumWin::systemFont): Ditto.
+        * rendering/RenderThemeChromiumWin.h: Ditto.
+
+2009-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        The problem was that a protected event listener's scope chain would end
+        up with a reference to the Node protecting it, causing a cycle. The
+        solution is to stop protecting event listeners and rely on marking instead.
+
+        This patch converts most Node event listeners to use marking instead of
+        GC protection.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument): Refactored the test for whether a Node
+        needs marking, and added a case for marking the node in order to mark its
+        event listeners.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::markEventListeners):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::mark): Added code to mark a Node's event listeners when
+        marking the Node. Changed code using protected event listeners to use event
+        listeners.
+
+        * dom/Node.idl: Changed code using protected event listeners to use event
+        listeners.
+
+2009-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unchecked bool return values for some dispatch event functions.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchWebKitAnimationEvent):
+        (WebCore::Node::dispatchWebKitTransitionEvent):
+        (WebCore::Node::dispatchProgressEvent):
+        * dom/Node.h:
+
+2009-04-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25058
+        Fix chromium build bustage caused by r42216
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-04-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20575
+        No localization in WebKitGtk
+
+        * platform/gtk/FileChooserGtk.cpp: Remove usage of glib/gi18n.h,
+        since there are not translatable strings.
+        * platform/gtk/LocalizedStringsGtk.cpp: Use the glib i18n header
+        that is specific for libraries.
+
+2009-04-06  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24978
+        Use custom implementations of a few Node methods so that
+        we don't over-aggressively create JS wrappers here.
+
+        * bindings/v8/custom/V8NodeCustom.cpp: Added custom implementations.
+        * dom/Node.idl: Removed JSC-specifier, making impl custom for V8 as well.
+
+2009-04-06  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25031
+        Make the V8 element collections check for named properties *before*
+        checking if there are any elements with the same name. Otherwise
+        it is both incorrect and slow.
+
+        Test: fast/dom/HTMLSelectElement/length-not-overridden.html
+
+        Both of these interceptors were attempting to find an element in the
+        collection that had a name or id of the property name before checking
+        for a JS property with that name.
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionNamedPropertyGetter):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+
+2009-04-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25052
+        
+        Pull the call to updateGraphicsLayerGeometry() out of updateGraphicsLayers(),
+        because we need to call it at the end of rebuildCompositingLayerTree() once
+        we've determined which descendant layers are composited, otherwise
+        calculateCompositedBounds() can give the wrong answer.
+        
+        Now that updateLayerCompositingState() doesn't end up calling updateGraphicsLayerGeometry(),
+        call that explicitly from styleChanged(), if we know a layer update is not pending,
+        and similarly from updateAfterLayout().
+
+        Test: compositing/overflow/overflow-positioning.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateGraphicsLayers):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-04-06  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add accessors to AtomicString which take String/const char* arguments
+        so that we don't accidentally thrash the AtomicString table.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24979
+
+        * platform/text/AtomicString.h:
+
+2009-04-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make col and row work in WebCore/manual-tests/cursor.html. The issue
+        was spotted in the WebKit inspector.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+
 2009-04-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -314,6 +21764,29 @@
         (WebCore::PluginView::hide):
         (WebCore::PluginView::setParentVisible):
 
+2009-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add new files to the Qt build.
+        Export helper function from the Qt JSC binding, needed in WebKit/qt.
+
+        * WebCore.pro: Add new files.
+        * bridge/qt/qt_runtime.h: Declare convertQVariantToValue.
+
+2009-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Changed ScriptFunctionCall's last argument from a const char* as the function name to a String.
+
+        Internally the function name is stored as a WebCore::String and the Qt port wants to use this
+        constructor programmatically where the function name is also a WebCore::String.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        * bindings/js/ScriptFunctionCall.h:
+
 2009-04-06  Mike Belshe <mike@belshe.com>
 
         Reviewed by Eric Seidel.
@@ -330,6 +21803,47 @@
         * html/HTMLCanvasElement.cpp:
         (WebCore::HTMLCanvasElement::createImageBuffer):
 
+2009-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        [Originally] Reviewed by Sam Weinig.
+
+        Rolled back in r42214 with crashes fixed.
+
+        [Removed irrelevant ExecState* parameter from event handler registration code.]
+        
+        [No change in behavior.]
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
 2009-04-05  Erik L. Bunce  <elbunce@xendom.com>
 
         Reviewed by Simon Hausmann.
@@ -341,6 +21855,2206 @@
         * platform/qt/DragDataQt.cpp:
         (WebCore::DragData::asURL):
 
+2009-04-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createPrototype): Take the JSGlobalObject
+        as second argument.
+
+2009-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for wxMac/Tiger.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        * rendering/break_lines.cpp:
+        (WebCore::nextBreakablePosition):
+        * webcore-wx.bkl:
+
+2009-04-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Cameron Zwarich
+
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+        
+        Ensure that mapPoint(const IntPoint&) calls the FloatPoint
+        version to avoid infinite recursion.
+        
+        No test because mapPoint(const IntPoint&) isn't ever called
+        on Mac, so I can't reproduce.
+        
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::mapPoint):
+
+2009-04-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6757862> REGRESSION: Cannot use the mouse to place
+          the insertion point inside a Thai character
+
+        Test: fast/text/international/thai-offsetForPosition-inside-character.html
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::offsetForPosition): Changed to use
+        cursorMovementIterator instead of characterBreakIterator, allowing this
+        function to return a valid cursor position even if it is not at
+        a character boundary.
+
+2009-04-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix an assertion failure when clicking at the beginning of a
+          glyph cluster at the beginning of a text run
+
+        Test: fast/text/offsetForPosition-cluster-at-zero.html
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::offsetForPosition): Corrected the bound
+        check on firstGlyphBeforeCluster, letting it be 0 or -1, but not less
+        than -1.
+
+2009-04-03  Brian Weinstein  <bweinstein@gmail.com>
+
+        Allows 16 HTML/CSS standard colors to be shown as swatch backgrounds
+        when the names are given.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25044
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6330929>
+        https://bugs.webkit.org/show_bug.cgi?id=21456
+
+        Don't update the document pointer for all inactive windows on navigations.
+        This change causes us to differ slightly from Firefox when accessing the
+        document from within a closure tied to a navigated context, but as all
+        browsers differ on this edge case, I don't foresee compatibility issues.
+
+        Test: http/tests/security/cross-frame-access-document-direct.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-04-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Test: transitions/bad-transition-shorthand-crash.html
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=24787.
+
+        We were starting transitions with 0 duration and delay, which is 
+        useless. With accelerated compositing on, this went through a code
+        path that tried to use m_toStyle, which never got set because the 
+        transitions was short circuited before it had a chance to. So I
+        both protect against using that null pointer and avoid starting
+        the transition in the first place.
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::blendPropertyValueInStyle):
+
+2009-04-03  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where you could not type any more in the Web Inspector's
+        search field after the first match is selected in the Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23982
+        rdar://problem/6592367
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._jumpToSearchResult): Use the
+        window object of the frame to set the selection, not the main window.
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22081
+        <rdar://problem/6346030>
+        Don't allow overriding the return value of window.location.
+
+        Tests: fast/dom/Window/Location/location-override-toString-on-proto-using-defineGetter.html
+               fast/dom/Window/Location/location-override-toString-on-proto-using-with.html
+               fast/dom/Window/Location/location-override-toString-on-proto.html
+               fast/dom/Window/Location/location-override-toString-using-defineGetter.html
+               fast/dom/Window/Location/location-override-toString-using-with.html
+               fast/dom/Window/Location/location-override-toString.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto-using-defineGetter.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto-using-with.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto.html
+               fast/dom/Window/Location/location-override-valueOf-using-defineGetter.html
+               fast/dom/Window/Location/location-override-valueOf-using-with.html
+               fast/dom/Window/Location/location-override-valueOf.html
+               fast/dom/Window/Location/window-override-location-using-defineGetter.html
+               fast/dom/Window/Location/window-override-window-using-defineGetter.html
+               fast/dom/Window/Location/window-shadow-location-using-js-object-with-toString.html
+               fast/dom/Window/Location/window-shadow-location-using-string.html
+               fast/dom/Window/Location/window-shadow-window-using-js-object-with-location-field.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::customPut):
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::customPut):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/Location.idl:
+
+2009-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out r42214 since it seems to have caused crashes on the buildbot.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6476356>
+        https://bugs.webkit.org/show_bug.cgi?id=23148
+
+        - Use the window object the Location and History objects are directly associated with
+          instead of the lexical global object to pick the object prototype to serve as the
+          base of the their respective prototype chains.
+        - Re-factor as necessary to allow passing the correct global object to the createPrototype
+          functions.
+
+        Tests: http/tests/security/cross-frame-access-history-prototype.html
+               http/tests/security/cross-frame-access-location-prototype.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMStructure):
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMStructure):
+        (WebCore::getDOMPrototype):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createPrototype):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createPrototype):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createPrototype):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createPrototype):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createPrototype):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createPrototype):
+        * page/DOMWindow.idl:
+
+2009-04-03  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25009
+        Upstream changes to WorkerContextExecutionProxy for V8 bindings in order to use V8EventListenerList as container.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed irrelevant ExecState* parameter from event handler registration code.
+        
+        No change in behavior.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/6634771> Under full-page zoom, cannot scroll
+          MobileMe contact list
+
+        Test: fast/css/zoom-in-length-round-trip.html
+
+        * dom/Element.cpp:
+        (WebCore::adjustForLocalZoom): For zoom factors greater than 1, ensure
+        that the returned value is equal to the original unscaled value.
+        (WebCore::adjustForAbsoluteZoom): Ditto.
+
+2009-04-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=24941
+
+        This fix essentially does a -viewWillDraw call for layout. It adds 
+        a CFRunLoopObserver which performs layout just before drawing on the 
+        Mac platform. This makes sure layout is complete before rendering and 
+        avoids a flash.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scheduleViewUpdate):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedUpdate):
+        (WebCore::RenderLayerCompositor::scheduleViewUpdate):
+        * rendering/RenderLayerCompositor.h:
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+
+        Optimize mapPoint(), mapRect() and mapQuad() for identity matrix and translations.
+        
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::mapPoint):
+        (WebCore::TransformationMatrix::mapRect):
+        (WebCore::TransformationMatrix::mapQuad):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::mapPoint):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25018
+        
+        Add containsPoint() and containsQuad() methods to FloatQuad.
+
+        * platform/graphics/FloatQuad.cpp:
+        (WebCore::dot):
+        (WebCore::isPointInTriangle):
+        (WebCore::FloatQuad::containsPoint):
+        (WebCore::FloatQuad::containsQuad):
+        * platform/graphics/FloatQuad.h:
+
+2009-04-03  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Darin.
+
+        *  loader/ProgressTracker.cpp: Included DocumentLoader.h
+        (WebCore::ProgressTracker::incrementProgress): Limit the 50%-clamp rule to 
+        documents that use WebCore's layout system.
+
+2009-04-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25029
+        <rdar://problem/6336092> REGRESSION: movie does not resize correctly
+
+        Test: media/video-size-intrinsic-scale.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::naturalSize): Use QTMovieCurrentSizeAttribute instead 
+        of QTMovieNaturalSizeAttribute so we return the correct size for movies saved
+        with a non-default matrix.
+        (WebCore::MediaPlayerPrivate::setSize): Don't resize the QTMovieView
+        because [QTMovieView setFrame] also resizes the movie itself, and as
+        the renderer calls setSize immediately when a movie reports a size change
+        (QTMovieSizeDidChangeNotification) we can get into a feedback loop
+        observing the size change and resetting the size, and this can cause
+        QuickTime to miss correctly setting a movie's size when the media size
+        changes after opening (as happens with an rtsp movie once the server sends
+        the track sizes). Instead, remember the size passed to paint() and 
+        resize the view when it changes.
+        (WebCore::MediaPlayerPrivate::paint): Resize the view when passed a new size.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getNaturalSize): Use GetMovieBox instead of GetMovieNaturalBoundsRect
+        so we return the correct size for movies saved with non-default matrix.
+
+2009-04-03  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Restore FrameLoader::policyDocumentLoader to fix the Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=25028
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::policyDocumentLoader):
+
+2009-04-02  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use long long, not int64, when working in webcore (sorry).
+        https://bugs.webkit.org/show_bug.cgi?id=25011
+
+        No change in functionality, so no tests.
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::getAppCacheID):
+        (WebCore::ResourceResponse::setAppCacheID):
+
+2009-04-03  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Remove pre-processor checks for GTK+ >= 2.10, since we now require
+        at least that version.
+
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::gtkStockIDFromContextMenuAction):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::contextMenuItemTagSelectAll):
+        * platform/gtk/MouseEventGtk.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25021
+        
+        Fix repainting an element with a reflection and transform after layout.
+        Telling the reflection to repaint directly is wrong, because, with
+        LayoutState enabled, it only takes the reflection's transform into account,
+        not that of the element. We can fix this, and keep the benefits of LayoutState,
+        by computing the reflected repaint rect, and repainting that using the original
+        renderer.
+
+        Test: fast/repaint/reflection-repaint-test.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23307
+        
+        When repainting during layout (when LayoutState is enabled), we need
+        to apply the transform to the dirty rect, before applying x(), y() and
+        the offset storted in the LayoutState.
+        
+        Also bypass LayoutState in mapLocalToContainer() if we have a repaintContainer,
+        since LayoutState is always root-relative.
+
+        Test: fast/repaint/transform-layout-repaint.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+
+2009-04-02  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build after r42191.
+
+        * WebCore.base.exp:
+
+2009-04-02  Mark Rowe  <mrowe@apple.com>
+
+        Fix Windows build after r42190.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):  Update to use the new name of the constant.
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6625840> Previous Page isn't loaded after hitting back button at http://www.breakingnews.ie/
+
+        Test: http/tests/navigation/onload-navigation-iframe-2.html
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Removed unneeded createdByParser flag.
+        * html/HTMLFrameElement.h: Ditto.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Ditto.
+        * html/HTMLFrameElementBase.h: Ditto.
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Ditto.
+        * html/HTMLFrameOwnerElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::HTMLIFrameElement): Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement): Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Removed unneeded check of the createdByParser flag.
+        The original change that introduced this, http://trac.webkit.org/changeset/25410, does
+        not make it clear why this check was needed. And it seems it is not needed.
+
+2009-04-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add a way to get a list of focusable nodes.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::getFocusableNodes):
+        * dom/Document.h:
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6654255> crash due to null FrameView in EventHandler
+
+        Lots of code was added to EventHandler that used view() and page() without
+        null checking, but both of those can become null due to the frame lifetime.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::handleAutoscroll):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::setPanScrollCursor):
+        (WebCore::EventHandler::allowDHTMLDrag):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::prepareMouseEvent):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::hoverTimerFired):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::dragHysteresisExceeded):
+        (WebCore::EventHandler::shouldDragAutoNode):
+        (WebCore::EventHandler::handleDrag):
+        (WebCore::EventHandler::handleTextInputEvent):
+        (WebCore::EventHandler::addPendingFrameUnloadEventCount):
+        (WebCore::EventHandler::removePendingFrameUnloadEventCount):
+        (WebCore::EventHandler::clearPendingFrameUnloadEventCount):
+        (WebCore::EventHandler::addPendingFrameBeforeUnloadEventCount):
+        (WebCore::EventHandler::removePendingFrameBeforeUnloadEventCount):
+        (WebCore::EventHandler::clearPendingFrameBeforeUnloadEventCount):
+        Added null checks for view() and page(). Made minor code cleanups.
+
+2009-04-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix regression in <object> layout test.  Make sure that even though a 404 image loads, that <object>
+        still considers it an error for the purposes of firing onerror.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+
+2009-04-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25010
+        Refactor InspectorController to replace all JS function invocations with
+        ScriptFunctionCall.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added int, UString,
+            and JSValuePtr methods.
+        (WebCore::ScriptFunctionCall::call): Added simplified, exception-eating
+            method.
+        * bindings/js/ScriptFunctionCall.h: Decls for above.
+        * bindings/js/ScriptObjectQuarantine.cpp: Added helper for Node and DOMWindow.
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h: Decls for above.
+        * inspector/InspectorController.cpp:
+        (WebCore::callSimpleFunction): Made into a static.
+        (WebCore::InspectorController::focusNode): Refactored to use ScriptFunctionCall.
+        (WebCore::InspectorController::toggleRecordButton): Ditto.
+        (WebCore::InspectorController::startGroup): Ditto.
+        (WebCore::InspectorController::setAttachedWindow): Ditto.
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared): Ditto.
+        (WebCore::InspectorController::addScriptProfile): Ditto.
+        (WebCore::InspectorController::didParseSource): Ditto.
+        (WebCore::InspectorController::failedToParseSource): Ditto.
+        (WebCore::InspectorController::didPause): Ditto.
+        * inspector/InspectorController.h: Removed callFunction and callSimpleFunction
+            decls.
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream changes to V8WorkerContextEventListener for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25007
+
+        * bindings/v8/V8ObjectEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8WorkerContextObjectEventListener for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25005
+
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Added.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Added.
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8EventListenerList for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25004
+
+        * bindings/v8/V8EventListenerList.cpp: Added.
+        * bindings/v8/V8EventListenerList.h: Added.
+
+2009-04-02  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium's ResourceRequest and ResourceResponse structs need some new data members.
+        https://bugs.webkit.org/show_bug.cgi?id=24897
+
+        These fields are needed to facilitate Chromium's implementation of the HTML5
+        ApplicationCache feature. We need to know what frame (or context) is doing the
+        requesting, and from what cache the resulting resource was retrieved.
+
+        No change in functionality, so no tests.
+
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::getAppCacheID):
+        (WebCore::ResourceResponse::setAppCacheID):
+
+2009-04-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24643.
+        
+        Make sure images just ignore HTTP error codes and keep loading anyway.  Only <object> checks http error codes and falls back.  Everyone
+        else just ignores it and displays the image anyway.
+
+        Added http/tests/misc/image-error.html
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::CachedImage):
+        * loader/CachedImage.h:
+        (WebCore::CachedImage::httpStatusCodeError):
+        (WebCore::CachedImage::httpStatusCodeErrorOccurred):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::httpStatusCodeError):
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didReceiveData):
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add XHR constructor in WorkerContext.idl for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=24962
+
+        * workers/WorkerContext.idl:
+
+2009-04-02  Ben Murdoch  <benm@google.com>
+
+        Fix Bug 19743: Release build fails on 32-bit Windows
+
+        <https://bugs.webkit.org/show_bug.cgi?id=19743>
+
+        Combines all the HTML element cpp files into one to help reduce the
+        size of WebCore.lib so we can build in release mode on 32bit Windows.
+
+        Reviewed by Adam Roben.
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded all the separate
+        HTML*Element.cpp files from the build. Added HTMLElementsAllInOne.cpp
+        to the build.
+        * html/HTMLElementsAllInOne.cpp: Added.
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24999
+        
+        Optimize hit testing with transforms.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        getTransformFromContainer() change to return the matrix by reference.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::update3DTransformedDescendantStatus):
+        The method failed to set m_3DTransformedDescendantStatusDirty to false,
+        so did the work every time.
+
+        (WebCore::RenderLayer::createLocalTransformState):
+        Only call the expensive getTransformFromContainer() if there is a transform,
+        otherwise we just have a translation.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+        * rendering/RenderObject.h:
+        Change transformFromContainer() to getTransformFromContainer(), and return
+        the matrix by reference to reduce copying.
+        New enum values for arguments for readability.
+
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::applyTransform):
+        (WebCore::HitTestingTransformState::translate):
+        New method that adds a translation to the accumulated matrix, optionally
+        without flattening. Cheaper than applyTransform().
+
+        (WebCore::HitTestingTransformState::applyTransform):
+        (WebCore::HitTestingTransformState::flatten):
+        (WebCore::HitTestingTransformState::flattenWithTransform):
+        Add flattenWithTransform(), which is a helper that allows us to
+        avoid doing the inverse() twice.
+
+        * rendering/TransformState.h:
+        (WebCore::TransformState::):
+        (WebCore::TransformState::move):
+        (WebCore::HitTestingTransformState::):
+        New method on HitTestingTransformState that adds a translation to the
+        accumulated matrix, optionally without flattening. Cheaper than applyTransform().
+        New enum values for arguments for readability.
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+        
+        Optimize common code paths in TransformationMatrix.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::translate3d):
+        Optimize to avoid matrix copy.
+        
+        (WebCore::TransformationMatrix::isInvertible):
+        Test for identity and translation matrices before computing
+        the determinant.
+        
+        (WebCore::TransformationMatrix::inverse):
+        Optimize for identity matrix and translations.
+        
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        Utility method.
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24930
+        [Gtk] ISO files content is displayed inside the webview instead of being downloaded
+
+        Also sniff content of types declared as text/plain. This is
+        justified by the fact that it is common to have Apache HTTP
+        servers configured to send text/plain as Content-Type by default.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Protect the handle when notifying the client that the response was
+        received also in gotChunkCallback, or we crash in didReceiveData
+        when the load is cancelled in didReceiveResponse.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotChunkCallback):
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25001
+        Crash when content type parameters have no value
+
+        Handle the case where a Content-Type header parameter has no
+        value (i.e. no = character), to work-around a bug in libsoup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-04-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24490
+
+        Enable web workers in Qt.
+
+        * WebCore.pro:
+
+2009-04-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler. Based on work of Julien Chaffraix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22475
+        REGRESSION: Async XMLHttpRequest never finishes on nonexistent files anymore
+
+        https://bugs.webkit.org/show_bug.cgi?id=24886
+        XHR requests opened when offline never return
+
+        Tests: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+               http/tests/xmlhttprequest/state-after-network-error.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener): Only dispatch load event if this
+        wasn't an error.
+        (WebCore::XMLHttpRequest::abort): Fixed formatting.
+        (WebCore::XMLHttpRequest::genericError): Change state to DONE and dispatch readystatechange.
+        The comment saying that this doesn't match Firefox was added in r33559 without explanation
+        or tests, and I don't think that it's accurate. Also, Firefox and Safari 3 both change state
+        to HEADERS_RECEIVED before DONE on error - this doesn't match the spec, and I doubt
+        that any code depends on this, so I went with the spec here.
+
+2009-04-01  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24997
+        Race conditions in icon database threading code
+        
+        m_syncThreadRunning set was mistakenly eliminated in r27717.
+        This reintroduces it.
+
+        Reviewed by Oliver Hunt.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open): Set m_syncThreadRunning.
+
+2009-04-01  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6748609> Use ActiveDOMObject to suspend marquees
+        
+        Make marquees ActiveDOMObjects, get rid of the special suspension code.
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::HTMLMarqueeElement):
+        (WebCore::HTMLMarqueeElement::canSuspend):
+        (WebCore::HTMLMarqueeElement::suspend):
+        (WebCore::HTMLMarqueeElement::resume):
+        * html/HTMLMarqueeElement.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::clearTimers):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::marquee):
+
+2009-04-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler
+
+        Make constant values static in previous commit, as suggested
+        by Darin.
+
+        * rendering/RenderVideo.cpp:
+
+2009-04-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=24993
+
+        Standalone media should have a smaller instrinsic
+        height.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::RenderVideo):
+
+2009-04-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22378: Crash submitting a form when parsing an XHTML document
+        https://bugs.webkit.org/show_bug.cgi?id=22378
+        rdar://problem/6388377
+
+        Tests: fast/loader/submit-form-while-parsing-1.xhtml
+               fast/loader/submit-form-while-parsing-2.html
+
+        * WebCore.base.exp: Updated.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem): Renamed m_subItems to m_children.
+        Used uncheckedAppend because we reserveInitialCapacity.
+        (WebCore::HistoryItem::addChildItem): Renamed m_subItems to m_children.
+        Added an assertion that this is only used to add items that don't have
+        duplicate frame names.
+        (WebCore::HistoryItem::setChildItem): Added. Replaces an existing item
+        if any, preserving the isTargetItem flag.
+        (WebCore::HistoryItem::childItemWithTarget): Renamed from childItemWithName
+        for consistency with the other functions here that all call the frame name the
+        "target". Also updated for rename of m_subItems to m_children.
+        (WebCore::HistoryItem::findTargetItem): Renamed from recurseToFindTargetItem.
+        Removed unneeded size check.
+        (WebCore::HistoryItem::targetItem): Changed to always return the top item
+        if no item has the isTargetItem flag set. The old version would instead return
+        0 in some cases, but return the top item if it had no children.
+        (WebCore::HistoryItem::children): Renamed m_subItems to m_children.
+        (WebCore::HistoryItem::hasChildren): Ditto.
+        (WebCore::HistoryItem::showTreeWithIndent): Ditto.
+
+        * history/HistoryItem.h: Name changes.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit): Create and pass a FormState instead of
+        attaching "recorded form values" and "form about to be submitted" to the frame
+        loader. Parameter work fine for this; there's no need to store state on the
+        FrameLoader.
+
+        * loader/FormState.cpp:
+        (WebCore::FormState::FormState): Adopt a vector instead of copying a hash map.
+        (WebCore::FormState::create): Ditto.
+        * loader/FormState.h: Update to use a vector that we adopt instead of hash map
+        that we copy for auto-fill text field values.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a new case for
+        form submissions and turned the "wasDuringLoad" state into a separate boolean
+        instead of using a special redirection type to track it.
+        (WebCore::FrameLoader::createWindow): Updated for name and argument change of
+        loadFrameRequest.
+        (WebCore::FrameLoader::urlSelected): Ditto.
+        (WebCore::FrameLoader::submitForm): Removed the "deferred form submission"
+        machinery, replacing it with the "scheduled redirection" mechanism, shared
+        with other kinds of redirection and navigation. Moved frame targeting here
+        so we can schedule the redirection on the right frame. Moved the multiple
+        form submission protection here. Moved the code to implement the rule that
+        m_navigationDuringLoad was used for here too.
+        (WebCore::FrameLoader::didOpenURL): Use the new wasDuringLoad flag instead
+        of the locationChangeDuringLoad type to detect location change during a load.
+        (WebCore::FrameLoader::executeScript): Removed call to now-obsolete function,
+        submitFormAgain.
+        (WebCore::FrameLoader::scheduleLocationChange): Moved the code to stop loading
+        out of this function into scheduleRedirection, so it can be shared with the
+        new scheduleFormSubmission function.
+        (WebCore::FrameLoader::scheduleFormSubmission): Added. Almost the same as
+        scheduleLocationChange, but with the arguments for a form submission.
+        (WebCore::FrameLoader::scheduleRefresh): Updated for the change to the
+        duringLoad flag.
+        (WebCore::FrameLoader::isLocationChange): Added case for formSubmission
+        and removed case for locationChangeDuringLoad.
+        (WebCore::FrameLoader::redirectionTimerFired): Ditto. Also removed unneeded
+        completeURL call and just use KURL constructor to match the other cases.
+        (WebCore::FrameLoader::provisionalLoadStarted): Removed the code to set up
+        the m_navigationDuringLoad, which is no longer needed. The new version of
+        this is in the submitForm function and sets the lockHistory boolean.
+        (WebCore::FrameLoader::scheduleRedirection): Moved the code to stop a load
+        in here that used to be in scheduleLocationChange.
+        (WebCore::FrameLoader::startRedirectionTimer): Added case for formSubmission
+        and removed case for locationChangeDuringLoad.
+        (WebCore::FrameLoader::stopRedirectionTimer): Ditto.
+        (WebCore::FrameLoader::completed): Removed call to now-obsolete function,
+        submitFormAgain.
+        (WebCore::FrameLoader::loadFrameRequest): Renamed from
+        loadFrameRequestWithFormAndValues. Replaced form element and form values
+        argument with a single FormState argument. Changed frame targeting code
+        to use the source frame in the case of a form submission to better match
+        the actual target frame.
+        (WebCore::FrameLoader::loadURL): Don't search for existing frames in the
+        form submission case since we already did that in the submitForm function.
+        (WebCore::FrameLoader::clientRedirected): Changed to work with the
+        m_isExecutingJavaScriptFormAction data member directly instead of taking
+        it as a function parameter.
+        (WebCore::FrameLoader::loadPostRequest): Don't search for existing frames
+        in the form submission case since we already did that in the submitForm
+        function.
+        (WebCore::FrameLoader::addBackForwardItemClippedAtTarget): Moved comment
+        in here that was misplaced elsewhere in the file.
+        (WebCore::FrameLoader::findFrameForNavigation): Changed to use the early
+        return idiom.
+        (WebCore::FrameLoader::recursiveGoToItem): Updated for HistoryItem changes.
+        (WebCore::FrameLoader::childFramesMatchItem): Ditto.
+        (WebCore::FrameLoader::updateHistoryForStandardLoad): Removed the
+        m_navigationDuringLoad logic; that's now handled by setting lockHistory
+        to true in the submitForm function.
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedBackForwardList):
+        Use the new setChildItem function so we don't get multiple items for the
+        same frame name in the history item tree in the back/forward list.
+
+        * loader/FrameLoader.h: Renamed loadFrameRequestWithFormAndValues to
+        loadFrameRequest and made it take a form state object instead of the
+        form element and form values. Removed the unused functions
+        loadEmptyDocumentSynchronously, provisionalDocumentLoader,
+        notifyIconChnaged, and updateBaseURLForEmptyDocument. Changed the
+        submitForm function to take a form state argument. Eliminated the
+        clearRecordedFormValues, setFormAboutToBeSubmitted, and recordFormValue
+        functions, which are replaced by the form state arguments to submitForm
+        and loadFrameRequest. Removed the isJavaScriptFormAction argument from
+        the clientRedirected function; instead it looks at a data member directly.
+        Eliminated the submitFormAgain and overload of the submitForm function;
+        these are now subsumed into the remaining submitForm function and the
+        scheduleFormSubmission function. Removed unused and obsolete data
+        members m_navigationDuringLoad, m_deferredFormSubmission,
+        m_formAboutToBeSubmitted and m_formValuesAboutToBeSubmitted.
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        Updated for name and argument change of loadFrameRequest.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Removed call to the now-unneeded
+        clearRecordedFormValues function.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, fixing previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24994
+        Revert V8DOMMap.cpp change which accidentally snuck into the previous
+        commit.
+
+        * bindings/v8/V8DOMMap.cpp: Revert change in previous commit.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24994
+        Fix miscellaneous merge/upstreaming divergencies in Chromium port.
+
+        * bindings/v8/V8Collection.h: Added an include.
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::baseAsString): Added to match KURL.cpp.
+        * platform/chromium/ClipboardChromium.cpp: Added an include.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24989
+        Refactor InspectorResource to use ScriptObject/FunctionCall.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::addResourceSourceToFrame): Tweaked to use
+            a more appropriate type conversion.
+        (WebCore::JSInspectorController::getResourceDocumentNode): Tweaked to
+            accommodate for InspectorResource refactoring.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added long long type to match
+            existing jsNumber call signature.
+        * bindings/js/ScriptFunctionCall.h: Declaration for above.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::createEmptyObject): Added.
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set): Added a bunch of property setters.
+        * bindings/js/ScriptObject.h: Declarations for above.
+        * inspector/InspectorController.cpp: Moved all InspectorResource-managing code
+            to InspectorResource.cpp
+        (WebCore::InspectorController::populateScriptObjects): Changed to use
+            refactored InspectorResource.
+        (WebCore::InspectorController::resetScriptObjects): Ditto.
+        (WebCore::InspectorController::pruneResources): Ditto.
+        (WebCore::InspectorController::didCommitLoad): Ditto.
+        (WebCore::InspectorController::addResource): Ditto.
+        (WebCore::InspectorController::removeResource): Ditto.
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Ditto.
+        (WebCore::InspectorController::identifierForInitialRequest): Ditto.
+        (WebCore::InspectorController::willSendRequest): Ditto.
+        (WebCore::InspectorController::didReceiveResponse): Ditto.
+        (WebCore::InspectorController::didReceiveContentLength): Ditto.
+        (WebCore::InspectorController::didFinishLoading): Ditto.
+        (WebCore::InspectorController::didFailLoading): Ditto,
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest): Ditto.
+        (WebCore::InspectorController::scriptImported): Ditto.
+        * inspector/InspectorController.h: Removed InspectorResource-managing code decls
+            and tweaked some signatures to use ScriptString and long long for identifier.
+        * inspector/InspectorController.idl: Changed to use long long for identifier.
+        * inspector/InspectorResource.cpp: Refactored to use ScriptObject/FunctionCall.
+        (WebCore::InspectorResource::InspectorResource): Ditto.
+        (WebCore::InspectorResource::~InspectorResource): Ditto.
+        (WebCore::InspectorResource::createCached): Added.
+        (WebCore::InspectorResource::updateRequest): Added.
+        (WebCore::InspectorResource::updateResponse): Added.
+        (WebCore::createHeadersObject): Added.
+        (WebCore::InspectorResource::createScriptObject): Added.
+        (WebCore::InspectorResource::updateScriptObject): Added.
+        (WebCore::InspectorResource::releaseScriptObject): Added.
+        (WebCore::InspectorResource::type): Tweaked to use ScriptString.
+        (WebCore::InspectorResource::setXMLHttpResponseText): Added.
+        (WebCore::InspectorResource::sourceString): Tweaked to use ScriptString.
+        (WebCore::InspectorResource::startTiming): Added.
+        (WebCore::InspectorResource::markResponseReceivedTime): Added.
+        (WebCore::InspectorResource::endTiming): Added.
+        (WebCore::InspectorResource::markFailed): Added.
+        (WebCore::InspectorResource::addLength): Added.
+        * inspector/InspectorResource.h: Added decls for newly refactored-in methods.
+        (WebCore::InspectorResource::create): Added.
+        (WebCore::InspectorResource::isSameLoader): Added.
+        (WebCore::InspectorResource::markMainResource): Added.
+        (WebCore::InspectorResource::identifier): Added.
+        (WebCore::InspectorResource::requestURL): Added.
+        (WebCore::InspectorResource::frame): Added.
+        (WebCore::InspectorResource::mimeType): Added.
+        (WebCore::InspectorResource::Changes::Changes): Added new class to track
+            resource changes.
+        (WebCore::InspectorResource::Changes::hasChange): Added.
+        (WebCore::InspectorResource::Changes::set): Added.
+        (WebCore::InspectorResource::Changes::clear): Added.
+        (WebCore::InspectorResource::Changes::setAll): Added.
+        (WebCore::InspectorResource::Changes::clearAll): Added.
+
+2009-04-01  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Ensure the right click doesn't deselect text under it.  This was
+        happening in the Chromium and GTK+ ports because they don't select
+        the text under the cursor on right click.
+        
+        This was regressed in r41715, https://bugs.webkit.org/show_bug.cgi?id=19737
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24946
+
+        Test: fast/events/context-no-deselect.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+
+2009-04-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24991
+        
+        Need to use toRenderBoxModelObject(), not toRenderBox(), to test for layer()
+        when getting the transform.
+        
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+
+2009-03-31  Darin Adler  <darin@apple.com>
+
+        Rolled out that last change until I can investigate the regression test failures it seems
+        to have caused.
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::decrement):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+
+2009-03-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24621: PositionIterator doesn't iterate "after last child" positions when going backwards
+        https://bugs.webkit.org/show_bug.cgi?id=24621
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::decrement): Make sure that when the parent has no children, we
+        don't ever use Position::uncheckedPreviousOffset. This is consistent with the forward
+        iterator, but also should never arise because of the fix below.
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator): Fixed so m_offset will always be 0 when
+        the passed-in node has no children. Like the change above, this is consistent with the rest
+        of the class, although in the long run I think it's a bit strange to treat a <p> element
+        with no children differently than a <p> element with children.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24965
+        Bug 24965: HTMLMediaElement: network state changes can be missed
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Always update m_networkState when the
+        state changes, even when no event needs to be fired.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24964
+        Bug 24964: HTMLMediaElement: 'waiting' event may fire twice
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Only fire 'waiting' event once when ready state
+        drops below HAVE_FUTURE_DATA.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24846
+        Bug 24846: HTMLMediaElement should implement 'autobuffer' attribute
+
+        Add 'autobuffer' attrubute to media element. 'autobuffer' is a hint that
+        the author recommends downloading the entire resource optimistically, so the
+        attribute is made available to the media engine to use if it is able.
+
+        Test: media/video-dom-autobuffer.html
+
+        * html/HTMLAttributeNames.in: Add autobuffer.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): New.
+        (WebCore::HTMLMediaElement::autobuffer): Ditto.
+        (WebCore::HTMLMediaElement::setAutobuffer): Ditto.
+
+        * html/HTMLMediaElement.h: Declare autobuffer and setAutobuffer.
+
+        * html/HTMLMediaElement.idl: Add autobuffer.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_autobuffer.
+        (WebCore::MediaPlayer::autobuffer): New.
+        (WebCore::MediaPlayer::setAutobuffer): Ditto.
+        * platform/graphics/MediaPlayer.h: Declare m_autobuffer, autobuffer and setAutobuffer
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setAutobuffer): Declare setAutobuffer.
+
+2009-03-31  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24550
+        Check return value of vasprintf. This should keep gcc 4.3.3
+        happy rather than have it complain about attribute warn_unused_result.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Style guide violation!
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Fix Tiger build.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8DOMMap for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=24951
+
+        * bindings/v8/V8DOMMap.cpp: Added.
+        * bindings/v8/V8DOMMap.h: Added.
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24955
+
+        Spacebar didn't play/pause in standalone MediaDocument
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24901
+        Added the following methods to MediaPlayerPrivate for Chromium port.
+        void sizeChanged();
+        void rateChanged();
+        void durationChanged();
+
+        The above changes are to reflect changes in MediaPlayer.cpp.
+        More details can be found in the original changeset.
+        http://trac.webkit.org/changeset/41907
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h:
+
+2009-03-31  Rafael Weinstein  <rafaelw@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24947
+
+        Special-case drawing text-shadow on win32, to let GDI draw in cases
+        when both fill & shadow color are opaque and the shadow has no blur.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleDrawTextShadow):
+        (WebCore::windowsCanHandleTextDrawing):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2009-03-31  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        r42055 removed some functions in FrameLoader used by Chrome,
+        this CL backs out some of those changes to unbreak the Chrome build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24949
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+
+2009-03-31  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Build fixes for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24945
+
+        * dom/Document.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::imageToMarkup):
+
+2009-03-31  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer): Use NamedNodeMap instead of NamedAttrMap.
+
+2009-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Don't create CFDataRef with a fixed size.
+        Fixes synchronous XMLHTTPRequests on Windows.
+        
+        Reviewed by Ada Chan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 24594: PolicyDelegate NavigationAction is WebNavigationTypeOther instead of WebNavigationTypeReload
+        https://bugs.webkit.org/show_bug.cgi?id=24594
+        rdar://problem/6682110
+
+        Test: fast/loader/reload-policy-delegate.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader): Set the triggering action here where we know it's
+        the policy loader and can use m_policyLoadType rather than letting it get set inside
+        checkNavigationPolicy.
+
+2009-03-30  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/5838871> CrashTracer: 1483 crashes Quicklooking
+        in Finder (painting without up to date layout)
+
+        Reviewed by Dan Bernstein.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents): Add an early return when
+        painting is attempted when layout is needed.
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+        
+        Sort alphabetically.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+        
+        Build fixes for building --3d-rendering and --no-svg
+
+        * rendering/RenderLayerBacking.cpp:
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+
+        Build fixes when building --no-svg
+        
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add missing CSS properties
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::updateIfSVGCursorIsUsed): Handle unused param
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Add missing CSS properties
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Add missing CSS properties
+        * dom/Node.cpp:
+        (WebCore::updateSVGElementInstancesAfterEventListenerChange): Handle unused param
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Handle unused param
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Handle unused param
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Bug 24916: REGRESSION: NavigationAction policy dispatch broken
+        https://bugs.webkit.org/show_bug.cgi?id=24916
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Rearrange the code so that the "event" PassRefPtr
+        is not used twice. This also optimizes the case where a frame name is specified,
+        but it's the name of the frame being loaded. Also called release in all the final
+        uses of FormState.
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Bug 24937: NamedNodeMap and NamedAttrMap should not be separate classes
+        https://bugs.webkit.org/show_bug.cgi?id=24937
+
+        Also should fix the Windows COM bindings build.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Removed special case for NamedNodeMap.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * dom/NamedAttrMap.h: Renamed class from NamedAttrMap to
+        NamedNodeMap and removed NamedNodeMap base class. Made the NamedNodeMap
+        functions all public and non-virtual. Removed virtualLength.
+
+        * dom/NamedNodeMap.h: Replaced file with just an include
+        of NamedAttrMap.h. As a follow up we will rename the NamedAttrMap
+        files and remove this file.
+
+        * bindings/js/JSNamedNodesCollection.cpp: Renamed from NamedAttrMap to NamedNodeMap.
+        * dom/Attr.h: Ditto.
+        * dom/Attribute.h: Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::importNode): Ditto.
+        * dom/Element.cpp:
+        (WebCore::Element::attributes): Ditto.
+        (WebCore::Element::setAttributeMap): Ditto.
+        (WebCore::Element::createAttributeMap): Ditto.
+        (WebCore::Element::insertedIntoDocument): Ditto.
+        (WebCore::Element::removedFromDocument): Ditto.
+        (WebCore::Element::openTagStartToString): Ditto.
+        (WebCore::Element::removeAttributeNode): Ditto.
+        (WebCore::Element::getAttributeNode): Ditto.
+        (WebCore::Element::getAttributeNodeNS): Ditto.
+        (WebCore::Element::hasAttribute): Ditto.
+        (WebCore::Element::hasAttributeNS): Ditto.
+        (WebCore::Element::normalizeAttributes): Ditto.
+        * dom/Element.h: Ditto.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::detachAttributesFromElement): Ditto.
+        (WebCore::NamedNodeMap::~NamedNodeMap): Ditto.
+        (WebCore::NamedNodeMap::isMappedAttributeMap): Ditto.
+        (WebCore::NamedNodeMap::getNamedItem): Ditto.
+        (WebCore::NamedNodeMap::getNamedItemNS): Ditto.
+        (WebCore::NamedNodeMap::removeNamedItem): Ditto.
+        (WebCore::NamedNodeMap::removeNamedItemNS): Ditto.
+        (WebCore::NamedNodeMap::setNamedItem): Ditto.
+        (WebCore::NamedNodeMap::item): Ditto.
+        (WebCore::NamedNodeMap::getAttributeItem): Ditto.
+        (WebCore::NamedNodeMap::clearAttributes): Ditto.
+        (WebCore::NamedNodeMap::detachFromElement): Ditto.
+        (WebCore::NamedNodeMap::setAttributes): Ditto.
+        (WebCore::NamedNodeMap::addAttribute): Ditto.
+        (WebCore::NamedNodeMap::removeAttribute): Ditto.
+        (WebCore::NamedNodeMap::mapsEquivalent): Ditto.
+        * dom/NamedMappedAttrMap.cpp:
+        (WebCore::NamedMappedAttrMap::clearAttributes): Ditto.
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::NamedMappedAttrMap): Ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics): Ditto.
+        (WebCore::Node::isEqualNode): Ditto.
+        (WebCore::Node::isDefaultNamespace): Ditto.
+        (WebCore::Node::lookupNamespaceURI): Ditto.
+        (WebCore::Node::lookupNamespacePrefix): Ditto.
+        (WebCore::Node::compareDocumentPosition): Ditto.
+        * dom/Node.h: Ditto.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer): Ditto.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan): Ditto.
+        (WebCore::isEmptyFontTag): Ditto.
+        (WebCore::areIdenticalElements): Ditto.
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Ditto.
+        (WebCore::completeURLs): Ditto.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Ditto.
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ditto.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty): Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Ditto.
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis): Ditto.
+
+2009-03-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24750
+        [GTK] requests download instead of displaying page
+
+        Use soup facilities to append parameters to the content type, to
+        make that more robust;
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-03-30  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6735683> Move SECTORDER_FLAGS from Xcode project to WebCore.xcconfig
+
+        Reviewed by Timothy Hatcher, Mark Rowe and Darin Adler.
+
+        * Configurations/Base.xcconfig: Moved Production definition of
+        SECTORDER_FLAGS to here from Xcode project file.
+        * Configurations/DebugRelease.xcconfig: Override SECTORDER_FLAGS
+        in Base.xcconfig to the empty string since it is not used for
+        Debug and Release configurations.
+        * WebCore.xcodeproj/project.pbxproj: Removed SECTORDER_FLAGS.
+
+2009-03-30  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after recent Node.idl changes
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Touched this to force sources
+        of classes that derive from Node to rebuild.
+
+2009-03-30  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * svg/graphics/SVGImage.cpp: Added a missing #include.
+
+2009-03-30  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24879
+        Add frame accessor to Screen, Console, and BarInfo objects. Add type 
+        accessor to BarInfo objects.
+
+        In the V8 JavaScript bindings, we need access to the frame and
+        type for already created Screen, Console, and BarInfo objects in
+        order to keep their wrappers alive across GCs.
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::frame): Added.
+        (WebCore::BarInfo::type): Added.
+        * page/BarInfo.h:
+        * page/Console.cpp:
+        (WebCore::Console::frame): Added.
+        * page/Console.h:
+        * page/Screen.cpp:
+        (WebCore::Screen::frame): Added.
+        * page/Screen.h:
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Requested by Antti Koivisto.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Tweaked code to be a little clearer and added
+        a better comment.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23445: Copying certain hidden text causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=23445
+        rdar://problem/6512520
+
+        Test: editing/pasteboard/copy-display-none.html
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Added a check for the case where adjusting the start node moves
+        the start of the selection past the end of the range entirely. If we try to iterate we'll
+        never hit the end of the range and will probably crash iterating the rest of the document.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 24672: ASSERTION FAILURE: !m_purgeableData in WebCore::CachedResource::data() saving a WebArchive
+        https://bugs.webkit.org/show_bug.cgi?id=24672
+        rdar://problem/6574263
+
+        I couldn't create a test case for this. In fact, the case in the bug doesn't exist any more,
+        but there is an Apple-internal website I was able to use to reproduce and fix.
+
+        * loader/CachedResource.h: Made makePurgeable public.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Call makePurgeable to make the resource non-purgeable
+        so we can get its data if it hasn't yet been purged.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Fix build again.
+
+        * loader/EmptyClients.h: Fix typo in name of FormState.h.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Try to fix the release build.
+
+        * history/CachedPage.cpp: Make include unconditional, not debug-only.
+
+2009-03-29  Greg Bolsinga  <bolsinga@apple.com>
+
+        Undo that last build fix, since it turned out the file wasn't deleted.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-03-29  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix build break by removing references to deleted header files.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Try to fix the Windows build.
+
+        * loader/EmptyClients.h: Added include of FormState.h.
+        * loader/MainResourceLoader.cpp: Ditto.
+
+2009-03-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24926
+        Fix Chromium build break.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)): renamed 'features' into 'windowFeatures'.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Another attempt to fix the Qt build.
+
+        * WebCore.pro: Added CheckedRadioButtons.cpp.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 24921: remove include of HTMLFormElement.h from Document.h
+        https://bugs.webkit.org/show_bug.cgi?id=24921
+
+        * GNUmakefile.am: Added CheckedRadioButtons source files.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/objc/PublicDOMInterfaces.h: Changed type of parentElement to Element.
+
+        * dom/CheckedRadioButtons.cpp: Copied from WebCore/html/HTMLFormElement.cpp.
+        Removed all the code except for CheckedRadioButtons, and moved that out to be
+        a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/CheckedRadioButtons.h: Copied from WebCore/html/HTMLFormElement.h.
+        Removed all the code except for CheckedRadioButtons, and moved that out to be
+        a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/Document.h: Removed unneeded includes, including HTMLFormElement.h.
+        Added include of CheckedRadioButtons.h. Changed uses of CheckedRadioButtons
+        class to use a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/Node.idl: Changed the type of parentElement from Node to Element for
+        two reasons. 1) Node was incorrect, since parentElement returns an Element.
+        2) The bindings won't compile any more unless they know parentElement's
+        return value is an Element due to include changes.
+
+        * html/HTMLFormElement.cpp: Moved definitions of the functions in the
+        CheckedRadioButtons class to the new CheckedRadioButtons.cpp.
+
+        * html/HTMLFormElement.h: Moved definition of the CheckedRadioButtons
+        class to the new CheckedRadioButtons.h.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::checkedRadioButtons): Changed use of CheckedRadioButtons
+        class to use a namespace-level class instead of a member of HTMLFormElement.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow): Tweaked formatting.
+
+        * css/CSSGrammar.y: Added newly-needed include.
+        * dom/Range.cpp: Ditto.
+        * editing/BreakBlockquoteCommand.cpp: Ditto.
+        * editing/CompositeEditCommand.cpp: Ditto.
+        * editing/InsertLineBreakCommand.cpp: Ditto.
+        * editing/ModifySelectionListLevel.cpp: Ditto.
+        * editing/RemoveFormatCommand.cpp: Ditto.
+        * editing/TextIterator.cpp: Ditto.
+        * editing/VisiblePosition.cpp: Ditto.
+        * loader/DocLoader.cpp: Ditto.
+        * page/AccessibilityRenderObject.cpp: Ditto.
+        * page/Page.cpp: Ditto.
+        * rendering/RenderBlock.cpp: Ditto.
+        * rendering/RenderLayer.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * storage/LocalStorageArea.cpp: Ditto.
+        * storage/SessionStorageArea.cpp: Ditto.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6015407> attr parsing should allow only identifiers
+
+        Test: fast/css/attr-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseContent): Allow only CSS_IDENT, and filter out
+        identifiers that start with "-".
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText): Added a case for CSS_ATTR so the test
+        case works. This has the pleasant side effect of fixing a bug too.
+
+2009-03-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        <rdar://problem/6492712> Cross-origin redirects are not handled correctly.
+
+        Forgot to save the file after applying changes for review comments.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::didReceiveResponse):
+        (WebCore::didReceiveData):
+        (WebCore::didSendBodyData):
+        (WebCore::didFinishLoading):
+        (WebCore::didFail):
+        (WebCore::willCacheResponse):
+        (WebCore::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+
+2009-03-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6492712> Cross-origin redirects are not handled correctly.
+
+        Test: http/tests/xmlhttprequest/redirect-cross-origin-tripmine.html
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Match Mac behavior more closely - we shouldn't rely on underlying library handling of
+        synchronous requests.
+
+        * loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::willSendRequest):
+        -[NSURLConnection cancel] doesn't fully cancel the connection if called from willSendRequest
+        delegate method for a redirect.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]):
+        Match async behavior more closely.
+
+2009-03-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 24914: empty-string assertion crash when running storage tests
+        https://bugs.webkit.org/show_bug.cgi?id=24914
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Don't store empty version strings
+        in the map, since empty strings are per-thread.
+
+2009-03-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24910
+        Fixes for Chromium build.
+
+        * bindings/v8/V8LazyEventListener.h: renamed IsInline() into virtualIsInline()
+        * bindings/v8/custom/V8CustomEventListener.h: ditto.
+        * dom/EventListener.h: used #if USE(JSC) to fix the build on non-JSC platform.
+
+2009-03-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, correcting landing error.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24812
+        Custom bindings should be in v8/custom, not v8.
+
+        * bindings/v8/V8HTMLDocumentCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp: Moved from parent dir.
+
+2009-03-28  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24616
+        Add V8 custom bindings for DOMWindow.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Added.
+
+2009-03-28  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24812
+        Add V8 custom bindings for HTMLDocument.
+
+        * bindings/v8/V8HTMLDocumentCustom.cpp: Added.
+
+2009-03-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix two SVG test failures in 64-bit.
+
+        getSubStringLength's arguments were declared as unsigned in the IDL and as signed long in the implementation.
+        This led to a value of -1 in JavaScript being converted to MAX_UINT in the bindings.  In 32-bit this was
+        identical to -1 when interpeted as signed long, but in 64-bit it was still equal to MAX_UINT.
+
+        The solution for this is to use the IsIndex attribute on arguments that the SVG spec declares as "unsigned long"
+        but requires an exception be thrown when a negative value is passed.  This results in the JS bindings handling the
+        check for a negative value and lets the implementation treat the arguments purely as unsigned values.
+
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::getNumberOfChars):
+        (WebCore::SVGTextContentElement::getSubStringLength):
+        (WebCore::SVGTextContentElement::getStartPositionOfChar):
+        (WebCore::SVGTextContentElement::getEndPositionOfChar):
+        (WebCore::SVGTextContentElement::getExtentOfChar):
+        (WebCore::SVGTextContentElement::getRotationOfChar):
+        (WebCore::SVGTextContentElement::getCharNumAtPosition):
+        (WebCore::SVGTextContentElement::selectSubString):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextContentElement.idl:
+
+2009-03-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get mailto code out of FrameLoader.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::transferMailtoPostFormDataToURL): Added. Factored out the mailto
+        logic so HTMLFormElement::submit isn't full of ugly bits. This includes the
+        part of the logic that involves transformeing the URL that was previously
+        inside FrameLoader.
+        (WebCore::HTMLFormElement::submit): Call transferMailtoPostFormDataToURL and
+        also release the data for slightly less refcount churn.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Removed all the special casing for mailto,
+        since HTMLFormElement now properly prepares both the URL and the form data.
+
+2009-03-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6724514> A bit of OpenTypeUtilities cleanup
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream): Changed to use EOTHeader.
+        (WebCore::createFontCustomPlatformData): Ditto.
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::EOTHeader::EOTHeader): Added. Initializes the buffer size to
+        the size of an EOTPrefix.
+        (WebCore::EOTHeader::updateEOTSize): Added. Updates the size field in
+        the prefix.
+        (WebCore::EOTHeader::appendBigEndianString): Changed the static
+        appendBigEndianStringToEOTHeader() into this member function.
+        (WebCore::EOTHeader::appendPaddingShort): Added.
+        (WebCore::getEOTHeader): Changed to use EOTHeader.
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        (WebCore::EOTHeader::size):
+        (WebCore::EOTHeader::data):
+        (WebCore::EOTHeader::prefix):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream): Changed to use EOTHeader.
+        (WebCore::createFontCustomPlatformData): Ditto.
+
+2009-03-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        To prepare for work on a form loading fix, remove some unused functions,
+        consolidate some functions, and make many more functions private in
+        FrameLoader.
+
+        * WebCore.base.exp: Remove some unused entry points, update another.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Clear m_frame directly instead of using
+        clearFramePointer.
+        * dom/Document.h: Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Consolidate the two functions
+        of this name into a single function. Also changed the event argument
+        to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::submitForm): Changed the event argument to
+        be PassRefPtr<Event>.
+        (WebCore::FrameLoader::scheduleLocationChange): Call completeURL
+        explicitly so we can remove the version of changeLocation that does
+        completeURL for us.
+        (WebCore::FrameLoader::redirectionTimerFired): Ditto.
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Set m_provisionalHistoryItem
+        directly so we don't need a setProvisionalHistoryItem function.
+        (WebCore::FrameLoader::canCachePageContainingThisFrame): Get at
+        m_quickRedirectComing directly so we don't need a isQuickRedirectComing
+        function.
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Ditto.
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues): Changed the
+        event argument to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::loadURL): Move the logic of the continueLoadWithData
+        function here because this is the only caller. If we want to make the
+        resulting function smaller we should refactor some other way. Also
+        streamlined the user-chosen encoding logic, but did not change what it does.
+        (WebCore::FrameLoader::finishedLoadingDocument): Changed the event argument
+        to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::loadPostRequest): Ditto.
+        (WebCore::FrameLoader::receivedMainResourceError): Moved the logic from
+        the didNotOpenURL function here, since this was the only caller.
+
+        * loader/FrameLoader.h: Removed include of FormState.h and used a forward
+        declaration instead. Removed unneeded forward declation of Element.
+        Moved many functions into the private section, and removed some other
+        unused or uneeded functions.
+
+2009-03-27  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24303
+        Using keyboard select RTL text, Highlights goes to opposite direction from Firefox and IE.
+
+        Test: editing/selection/extend-selection.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock): Added
+        (WebCore::SelectionController::modifyExtendingRight): Added. Currenctly 
+        implemented for character and word granularity, all other granularities
+        are treated as "forward".
+        (WebCore::SelectionController::modifyExtendingForward): Renamed 
+        modifyExtendingRightForward() to this.
+        (WebCore::SelectionController::modifyExtendingLeft): Added. Currenctly
+        implemented for character and word granularity, all other granularities
+        are treated as "backward".
+        (WebCore::SelectionController::modifyExtendingBackward): Renamed
+        modifyExtendingLeftBackward() to this.
+        (WebCore::SelectionController::modify): Change to call either the 
+        left/right or backward/forward methods depending on the 'dir' argument
+        for extends.
+        * editing/SelectionController.h:
+
+2009-03-27  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24836
+        Fix navigator.plugins.refresh(false) in Chromium.
+
+        * plugins/chromium/PluginDataChromium.cpp:
+        (WebCore::PluginData::refresh):
+
+2009-03-27  Timothy Hatcher  <timothy@apple.com>
+
+        Make scrollLeft, scrollTop, scrollWidth, and scrollHeight
+        virtual to fix the broken layout tests from my last commit.
+
+        Reviewed by Mark Rowe.
+
+        * dom/Element.cpp:
+        (WebCore::Element::scrollLeft):
+        (WebCore::Element::scrollTop):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Element.h:
+        * html/HTMLBodyElement.h:
+
+2009-03-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=24876>.
+        Bug 24876: fast/forms/select-max-length.html times out in debug builds due to HTMLSelectElement::setLength being O(N^2)
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength): Repeatedly calling remove to remove elements causes us to recalculate the list
+        items after each node is removed, leading to O(N^2) behaviour.  By inlining the batch removal in to setLength we can avoid
+        this gratuitous recalcuation.
+
+2009-03-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        We don't support images for GtkCursors yet. We need a  placeholder to avoid crashes.
+        I took crosshair to have a common behavior with firefox.
+
+        [GTK] SVG - Crash on setting the cursor icon
+        https://bugs.webkit.org/show_bug.cgi?id=24565
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-03-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove redundant attributes and functions from IDL files that have the
+        same attributes and functions defined in the super class.
+
+        Reviewed by Simon Fraser.
+
+        * WebCore.xcodeproj/project.pbxproj: Remove DOMHTMLBodyElementPrivate.h.
+        * bindings/objc/PublicDOMInterfaces.h: Remove focus and blur from DOMHTMLElement.
+        * html/HTMLBodyElement.idl: Remove scrollLeft, scrollTop, scrollWidth
+        and scrollHeight.
+        * html/HTMLElement.idl: Remove blur and focus.
+
+2009-03-27  Adam Roben  <aroben@apple.com>
+
+        Don't include substitute data URLs in global history redirect chains
+
+        <rdar://6690169>
+
+        Reviewed by Darin Adler.
+
+        This might be testable if:
+          - support were added to DRT for providing substitute data on failed
+            loads
+          - support were added to DRT for dumping redirect chains
+
+        I tried doing the above and was still unable to make a test.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::updateHistoryForStandardLoad):
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedBackForwardList):
+        Call updateGlobalHistoryRedirectLinks only if the load succeeded
+        (i.e., there is no unreachableURL). Previous the FrameLoaderClient
+        implementations were unconditionally calling
+        updateGlobalHistoryRedirectLinks from within updateGlobalHistory.
+
+2009-03-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24861
+        Chromium port did not render decorations for <input type="search">.
+        This copies RenderThemeWin.*.
+
+        * css/themeChromiumWin.css: Removed.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldResultsButton):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::paintSearchField):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumWin::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldResultsButton):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::paintSearchField):
+
+2009-03-27  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        If an object has a self-painting layer, don't count it as part of a block's visual overflow.
+        This fix has only been made for block-level children.   The inline-level case is still broken
+        (and covered by an existing bug).
+
+        Added fast/block/positioning/negative-rel-position.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+
+2009-03-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6642221>
+        REGRESSION: With the Movie widget, movie trailer fails to load if movie had been previously viewed
+        
+        Add a dashboard specific workaround so that we always create renderers for object elements, even if display:none is set.
+        
+        I've filed <rdar://problem/6731022> against the Movies widget.
+        
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-03-25  Timothy Hatcher  <timothy@apple.com>
+
+        Expose new DOM methods as public Objective-C API.
+
+        <rdar://problem/5837350> Expose new DOM classes and methods
+        as public API (match the additions to the JavaScript DOM)
+
+        Reviewed by Mark Rowe and Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOMHTML.h:
+        * bindings/objc/DOMPrivate.h:
+        * bindings/objc/PublicDOMInterfaces.h:
+
 2009-03-27  Zack Rusin <zack@kde.org>
 
         Reviewed by Simon Hausmann.
@@ -371,18 +24085,2571 @@
         (WebCore::RenderThemeQt::paintTextField):
         * platform/qt/RenderThemeQt.h:
 
-2009-02-06  Dirk Schulze  <krit@webkit.org>
+2009-03-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix bug in clearRect(). Use fillRect() instead of eraseRect() to get
-        the context transparent.
+        https://bugs.webkit.org/show_bug.cgi?id=24852
+        Build fix for GNU mode RVCT compilation
 
-        [QT] clearRect fill's a given rect with white
-        https://bugs.webkit.org/show_bug.cgi?id=23728
+        * html/PreloadScanner.cpp:
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::clearRect):
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24868
+
+        Make text of the writing direction items more user friendly.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24274
+
+        Fixed the Qt 4.4 Mac build with netscape plugins enabled.
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-03-26  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * platform/text/TextEncodingDetectorNone.cpp:
+        (WebCore::detectTextEncoding):
+
+2009-03-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24874
+        24874: HTMLMediaElement: 'duration' defaults to NaN, deal with it
+        
+        The 'duration' attribute is NaN when no media is available, so the
+        media element should take care when comparing with duration().
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Don't compare with duration when
+        it is NaN.
+        (WebCore::HTMLMediaElement::endedPlayback): Ditto.
+
+2009-03-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * platform/text/TextEncodingDetectorICU.cpp:
+        * platform/text/TextEncodingDetectorNone.cpp:
+
+2009-03-26  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Cameron Zwarich.
+
+        1. Fix the crash in setHintEncoding
+        2. Fix build failures on Tiger and Qt.
+        UnusedParam.h was not included by TextEncodingDetector{None,ICU}.cpp
+        in the patch landed in r42023
+        for http://bugs.webkit.org/show_bug.cgi?id=16482
+
+        * loader/TextResourceDecoder.h:
+        (WebCore::TextResourceDecoder::setHintEncoding):
+        * platform/text/TextEncodingDetectorICU.cpp:
+        * platform/text/TextEncodingDetectorNone.cpp:
+
+2009-03-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix when ACCELERATED_COMPOSITING is turned on.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+
+2009-03-26  Eric Seidel  <eric@webkit.org>
+
+        No additional review, committing previously reviewed files for build fix only.
+
+        Add files I missed when commiting Jungshik's patch in r42022.
+        https://bugs.webkit.org/show_bug.cgi?id=16482
+
+        * icu/unicode/ucsdet.h: Added.
+        * platform/text/TextEncodingDetector.h: Added.
+        * platform/text/TextEncodingDetectorICU.cpp: Added.
+        (WebCore::detectTextEncoding):
+        * platform/text/TextEncodingDetectorNone.cpp: Added.
+        (WebCore::detectTextEncoding):
+
+2009-03-26  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add an encoding detector 'hook' to TextResourceDecoder.
+         - add |usesEncodingDetector| to Settings. It's off by default.
+         - add a new encoding source type |EncodingFromParent| 
+           to distinguish cases when the encoding is inherited from
+           the parent frame from cases when it's actually auto-detected.
+         - add TextEncodingDetector* to platform/text. Currently,
+           the only implementation uses ICU. Stub is added for 
+           ports that do not use ICU and a build on Tiger. Mac OS 
+           Tiger comes with ICU 3.2 that does not support encoding detector.
+         - add ucsdet.h to icu/unicode for ports using ICU.
+
+        Layout tests will be added once bug 20534 is fixed and a WebPreference
+        can be controlled in test_shell. With UsesEncodingDetector off, there
+        is no change to test. 
+
+        http://bugs.webkit.org/show_bug.cgi?id=16482
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore/GNUmakefile.am
+        * WebCore/WebCore.pro
+        * WebCore/WebCore.scons
+        * WebCore/WebCoreSources.bkl
+        * WebCore.base.exp
+        * icu/unicode/ucsdet.h
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::write): turn on/off encoding detector depending on Settings and set hintEncoding of TextResourceDecoder to the parent frame encoding if necessary and the security policy allows refering to the parent frame encoding.
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::TextResourceDecoder):
+        (WebCore::TextResourceDecoder::checkForCSSCharset): add check for EncodingFromParentFrame
+        (WebCore::TextResourceDecoder::checkForHeadCharset): ditto
+        (WebCore::TextResourceDecoder::shouldAutoDetect):
+        (WebCore::TextResourceDecoder::decode): call encoding detector if shouldAutoDetect returns true.
+        (WebCore::TextResourceDecoder::flush): if encoding is not determined by now, call encoding detector if shouldAutoDetect returns true.
+        * loader/TextResourceDecoder.h:
+        (WebCore::TextResourceDecoder::):
+        (WebCore::TextResourceDecoder::create):
+        (WebCore::TextResourceDecoder::setHintEncoding):
+        (WebCore::TextResourceDecoder::source):
+        * page/Settings.cpp: add m_usesEncodingDetector
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setUsesEncodingDetector):
+        * page/Settings.h:
+        (WebCore::Settings::usesEncodingDetector):
+        * platform/text/TextEncodingDetector.h: Added.
+        * platform/text/TextEncodingDetectorICU.cpp: Added.
+        (WebCore::detectTextEncoding):
+        * platform/text/TextEncodingDetectorNone.cpp: Added.
+        (WebCore::detectTextEncoding):
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Removed code that casts EventListener down to derived classes
+        without type checking. A crash could happen if you added event
+        listeners with Objective-C and then manipulated the class with
+        JavaScript.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark): Removed all the casts
+        and used the markIfNotNull function and mark functions on
+        EventListener instead.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark): Ditto.
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark): Ditto.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::mark): Ditto.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark): Ditto.
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark): Ditto.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent): Used function,
+        the new name for what used to be called listenerObj.
+        (WebCore::JSAbstractEventListener::virtualIsInline): Renamed since
+        this doesn't need to be virtual for callers who have a pointer to
+        this class, not the base class.
+        (WebCore::JSEventListener::function): Renamed from listenerObj.
+        (WebCore::JSProtectedEventListener::function): Ditto.
+
+        * bindings/js/JSEventListener.h: Removed unneeded forward class
+        declarations. Made all virtual functions private since there's no
+        need to call any of them on a particular derived class, only on
+        EventListener. Explicitly declare JSEventListener::mark as virtual
+        since it's now overriding a function in the EventListener base class.
+        Made JSProtectedEventListener::m_globalObject protected so the
+        JSLazyEventListener derived class can use it directly instead of using
+        a virtual function to get the pointer.
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode): Use m_globalObject instead
+        of globalObject since the latter is a virtual function and there's no
+        need to pay virtual function overhead.
+        (WebCore::JSLazyEventListener::function): Renamed from listenerObj.
+
+        * bindings/js/JSLazyEventListener.h: Moved forward declaration of the
+        Node class here from JSEventListener.h.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Removed now-unneeded cast to
+        JSEventListener when getting the script object from a listener.
+
+        * dom/EventListener.h: Added virtual function and mark functions
+        so we can extract the JavaScript function object or mark a JavaScript
+        event listener in a type safe manner.
+
+2009-03-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24859
+        Use CSS file instead of code to adjust search field styling.
+
+        * css/themeWin.css:
+        * rendering/RenderThemeWin.cpp:
+        * rendering/RenderThemeWin.h:
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Split JSLazyEventListener out into its own separate source file.
+        We'll be removing JSAbstractEventListener and JSProtectedEventListener soon,
+        so leave those in the same file with JSEventListener.
+
+        * GNUmakefile.am: Added JSLazyEventListener.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSEventListener.cpp: Removed the JSLazyEventListener part.
+        Removed unneeded includes. Removed incorrect ASSERT_CLASS_FITS_IN_CELL, since
+        JSAbstractEventListener is not derived from JSCell.
+
+        * bindings/js/JSEventListener.h: Removed the JSLazyEventListener part
+        and the now-unneeded include of PlatformString.h.
+
+        * bindings/js/JSLazyEventListener.cpp: Copied from bindings/js/JSEventListener.cpp.
+        Kept only the JSLazyEventListener part.
+        (WebCore::eventParameterName): Made this have internal linkage by adding "static".
+        Also moved the default case out of the switch statement so we will get a warning
+        if we omit any cases in the future.
+
+        * bindings/js/JSLazyEventListener.h: Copied from bindings/js/JSEventListener.h.
+        Kept only the JSLazyEventListener part.
+
+        * bindings/js/ScriptController.cpp: Removed unneeded includes and sorted the
+        remanining ones. Include JSLazyEventListener.h instead of JSEventListener.h.
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Renamed JSUnprotectedEventListener to JSEventListener.
+        And related renames.
+
+        Soon Geoff will make all JavaScript event listeners use mark instead
+        of protect, so there's no need to emphasize "unprotected".
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::jsEventListeners):
+        (WebCore::JSDOMGlobalObject::jsInlineEventListeners):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::listenerObj):
+        (WebCore::JSEventListener::globalObject):
+        (WebCore::JSEventListener::clearGlobalObject):
+        (WebCore::JSEventListener::mark):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::mark):
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        All just renaming.
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Renamed JSEventListener to JSProtectedEventListener.
+        And related renames.
+
+        Soon Geoff will make all JavaScript event listeners use mark instead
+        of protect, and so this class will be be obsolete. We will rename
+        JSUnrpotectedEventListener to JSEventListener in the next check-in,
+        since that one will remain.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::jsProtectedEventListeners):
+        (WebCore::JSDOMGlobalObject::jsProtectedInlineEventListeners):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSProtectedEventListener::JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::~JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::listenerObj):
+        (WebCore::JSProtectedEventListener::globalObject):
+        (WebCore::JSProtectedEventListener::clearGlobalObject):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSProtectedEventListener::create):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        All just renaming.
+
+2009-03-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix <rdar://problem/6725042> BidiResolver::createBidiRunsForLine can
+          create runs extending beyond the end
+
+        No test because Safari does not use this version of
+        createBidiRunsForLine() with the end iterator not pointing to the end
+        of the text run.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiResolver::appendRun): Cap the end of the run at the end
+        of the line and set the reachedEndOfLine flag. This mirrors the logic
+        in the specialized version of appendRun() in bidi.cpp, which is why the
+        problem did not show up in HTML. Also avoid creating empty runs.
+
+2009-03-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24864
+
+        Change the terminology from "inner content layer" to "direct compositing"
+        for cases where we can push an image directly over to the compositing system,
+        without having to draw it.
+        
+        Clean up much of the code which looks at style to determine if this is possible,
+        and fix some bugs when backgrounds change dynamically.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasBorderOutlineOrShadow):
+        (WebCore::hasBoxDecorations):
+        (WebCore::hasBoxDecorationsWithBackgroundImage):
+        (WebCore::RenderLayerBacking::canBeSimpleContainerCompositingLayer):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::detectDrawingOptimizations):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        (WebCore::RenderLayerBacking::updateImageContents):
+        * rendering/RenderLayerBacking.h:
+
+2009-03-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23914
+
+        Tests: compositing/overflow/ancestor-overflow.html
+               compositing/overflow/parent-overflow.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLayer.h:
+        (WebCore::ClipRects::infiniteRect):
+        New static method that returns a large rect that is used by the clipping
+        logic.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        Use parentClipRects(), rather than calculateRects(), to compute the overflow
+        rect that we'll use to create a masking layer for composited clipping.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        Use parentClipRects() to see whether there's a layer between us and our
+        compositing ancestor which applies clipping.
+        
+        (WebCore::RenderLayerCompositor::clipsCompositingDescendants):
+        A layer which imposes clipping to its children doesn't have to be a stacking
+        context; it might be a normal flow layer; in either case, we can rely on the
+        hasCompositingDescendant() bit.
+
+2009-03-26  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24837
+        Escape key should dismiss select menu
+
+        Reviewed by Adam Roben.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupWndProc):
+
+2009-03-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make sure the script uses LF line endings even on Windows.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24805
+
+        * WebCore/make-generated-sources.sh: Change svn:eol-style to LF
+
+2009-03-26  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Remove warnings all over the place by making operator precedence
+        explicit in cases like x && y || z.  No functional change.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseShadow):
+        * dom/Document.cpp:
+        (WebCore::Document::shouldScheduleLayout):
+        * dom/Node.cpp:
+        (WebCore::Node::isBlockFlowOrBlockTable):
+        * dom/Node.h:
+        (WebCore::Node::document):
+        * dom/Position.cpp:
+        (WebCore::Position::next):
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        (WebCore::Position::getInlineBoxAndOffset):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::atStart):
+        * dom/Range.cpp:
+        (WebCore::Range::intersectsNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setBaseWritingDirection):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance):
+        (WebCore::SimplifiedBackwardsTextIterator::advance):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::canonicalPosition):
+        * editing/htmlediting.cpp:
+        (WebCore::isMailBlockquote):
+        (WebCore::lineBreakExistsAtPosition):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateFromElement):
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::checkForHeadCharset):
+        * page/AccessibilityObject.cpp:
+        (WebCore::updateAXLineStartForVisiblePosition):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendContextMenuEvent):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperGetter::equals):
+        (WebCore::PropertyWrapperShadow::equals):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::adjustScrollbarsAvoidingResizerCount):
+        * platform/text/Base64.cpp:
+        (WebCore::base64Encode):
+        * platform/text/BidiResolver.h:
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChild):
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::positionForPoint):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        (WebCore::RenderBlock::hasLineIfEmpty):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::imageChanged):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::positionForPoint):
+        (WebCore::RenderBox::shrinkToAvoidFloats):
+        * rendering/RenderObject.h:
+        (WebCore::objectIsRelayoutBoundary):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::calcPrefWidths):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::textWidth):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/StyleInheritedData.cpp:
+        (WebCore::cursorDataEquivalent):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::shadowDataEquivalent):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::shadowDataEquivalent):
+        (WebCore::StyleRareNonInheritedData::animationDataEquivalent):
+        (WebCore::StyleRareNonInheritedData::transitionDataEquivalent):
+
+2009-03-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24804
+        [GTK] 401 responses cause rogue content to be loaded
+
+        Our soup code handles 401 responses itself, so we should not feed
+        the headers and data of those responses to the loader.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::gotChunkCallback):
+
+2009-03-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Darin Adler.
+        
+        Fixed <rdar://problem/6603167> Crash in WebKit!JSC::JSGlobalObject::resetPrototype
+        during Stress test (#3 & #7 WER crashes for Safari 4 Beta)
+        
+        The problem was that allocation of the global object would, for just a
+        moment, leave the global object's prototype unprotected from GC. This
+        bug doesn't apply to non-global DOM objects because their prototypes are
+        cached and marked by the global object.
+
+        No test case because the crashing condition is hard to deterministically
+        produce in a normal build, and in a Windows Release build with
+        COLLECT_ON_EVERY_ALLOCATION set to 1, existing tests crash/hang.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript): Protect the global object's
+        prototype from GC during construction, since the global object does not
+        yet point to it, and therefore won't mark it.
+
+2009-03-25  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23361
+
+        When using hardware compositing, some images can be directly
+        rendered by the hardware - no need to draw them into a separate
+        context, therefore saving memory.
+        Only images with certain style properties can be directly
+        composited - basically anything that is not a simple image requires
+        the usual rendering path (eg. if the image has borders).
+
+        Test: compositing/direct-image-compositing.html
+
+        * manual-tests/resources/simple_image.png: Added.
+        * manual-tests/simple-image-compositing.html: Added.
+        * platform/graphics/Image.h:
+        (WebCore::Image::startAnimation):
+            - move this to public
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged):
+            - poke compositing layer if image has changed
+        (WebCore::RenderImage::notifyFinished):
+            - let the compositing layer know that it can render the image
+        * rendering/RenderImage.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseInnerContentLayer):
+        (WebCore::RenderLayerBacking::detectDrawingOptimizations):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerBacking.h:
+            - code to hook up direct compositing of images where
+              possible
+
+2009-03-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium build fix. Fix #include in V8NodeFilterCondition.cpp due to the
+        rename of V8NodeFilter to V8NodeFilterCondition.
+
+        * bindings/v8/V8NodeFilterCondition.cpp:
+
+2009-03-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24817
+        
+        When the slider range is zero, avoid a divide by zero, which caused the
+        thumb to be positioned off in the weeds, which broke painting.
+
+        Test: media/video-empty-source.html
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::proportionFromValue):
+        (WebCore::SliderRange::valueFromProportion):
+        (WebCore::sliderPosition):
+        (WebCore::RenderSlider::setValueForPosition):
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove dead code and style cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::CanvasStyle):
+          Coverty was annoyed that we didn't initialize all of our members.  I agree, but I didn't
+          want to paste all 8 members each time, so I just cleaned up the existing constructors and left them.
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedNode):
+          "node" was checked just above and is already known to be non-null
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::insertOnlyThisLayer):
+          We were already using parentLayer w/o a NULL check above, so just add an explicit ASSERT and use it w/o NULL check
+        (WebCore::RenderLayer::resize):
+          element is already ASSERTed above, no need to null check it here
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addCell):
+          currentCell.cell was just assigned to the value "cell" which is known to be non-null, no need to null check again.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move ASSERT(foo) to before where foo-> is used
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+          Move ASSERTs to the top of the function, code was using "node" before ASSERT(node), once I moved
+          ASSERT(node) to the top of the function it made sense to move the rest of them there too.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::prepareToRenderSVGContent):
+          move ASSERT(object) to *before* we use "object" :)
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Make TextTokenizer ASSERT that the buffer was freed
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * loader/TextDocument.cpp:
+        (WebCore::TextTokenizer::TextTokenizer):
+        (WebCore::TextTokenizer::~TextTokenizer):
+        (WebCore::TextTokenizer::finish):
+          Make it clear by adding a ~TextTokenizer that finish() will always be called and the memory never leaked.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix case where lBreak.obj->isBR() when lBreak.obj was NULL
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        I don't have a test case where we were taking the wrong path here
+        However, adding an ASSERT(lBreak.obj) before this usage caused
+        multiple bidi tests to fail, so lBreak.obj can be null here.
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+          lBreak.obj can be null, so we can't call ->isBR() on it unconditionally.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Style cleanup and dead code removal in dom, editing
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        (WebCore::ContainerNode::getRect):
+          Coverty was (rightly) confused as to what the hell "o" was being used for
+          and whether or not it would ever be NULL.  I added some ASSERTS so that people (and machines)
+          would be less confused about the logic in getUpperLeftCorner/getLowerRightCorner
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+          Remove dead code, this block already checked that change == Force
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+          Coverty correctly identified that traversePreviousNodePostOrder can return NULL, thus
+          prev will be null, and we don't really explicitly handle it (like we probably should)
+          It's OK though, because we end up creating a null position object, which may not have
+          been what we intended, but we certainly don't crash.
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+          Remove dead code, insertionPosition.node() is already checked to be non-null above.
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup):
+          removed dead code, annotate is already known to be true at this point in the file
+          !annotate was checked above, and break; was called.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        CSS dead code removal and cleanup from Coverty errors
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+          Every other place in the code we check settings() for NULL, so I made these places
+          check too, even though we should never be resolving style against a document which has
+          no frame (which I believe is the only time settings() can be null)
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::styleSheetChanged):
+          Removing dead code, "root" can never be null here.
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::colorFromSVGColorCSSValue):
+        (WebCore::CSSStyleSelector::applySVGProperty):
+          Extra returns in the old macros caused dead code.  Removing the old macros and use modern
+          ones instead. :)
+          Extra null checks to value were not needed.  Added an ASSERT at the top of the function
+          to make it clear that value will never be NULL.
+          Added colorFromSVGColorCSSValue to clean up the code a little.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Font fallback cleanup and added ASSERT for GlyphPageTreeNode
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::compareFontFaces):
+          Coverty was concerned that it was possible to index off the end of weightFallbackRuleSets
+          I can't read the code well enough to tell, so I tried to make the code clearer
+          and added an ASSERT.        
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+          Coverty believes we can crash here due to j being larger than GlyphPage::size.  I think to is already
+          known to be < GlyphPage::size due to the min() statement above, but not being sure I added an ASSERT.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Coverty inspired fixes in Animations/Transforms
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * page/animation/AnimationBase.h:
+          Fix animate() signatures to match so that the virtual methods actually override one another. :)
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::removeFromStartTimeResponseWaitList):
+          Attempt to fix this method, prevAnimation was never set to anything but NULL,
+          as far as I can tell the author originally intended to update it at the end
+          of the loop, which is what I changed this code to do.
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+          Make method signature match AnimationBase::animate
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+          Make method signature match AnimationBase::animate
+        * page/animation/KeyframeAnimation.h:
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
+        (WebCore::PerspectiveTransformOperation::blend):
+          if (blendToIdentity) already returned above.
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+          if (blendToIdentity) already returned above.
+
+2009-03-25  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fix compiler warnings regarding assignments in if statements.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::createFormData):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compare):
+
+2009-03-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6472150> repro crash in
+          RenderBlock::rightmostPosition(bool, bool) const at mercotte.fr using
+          menus
+
+        Test: fast/inline/continuation-positioned-reparenting.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitFlow): When repurposing the existing
+        container as the "pre" block, clear its positioned objects list, because
+        positioned descendants may end up in a different block after the split.
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24784
+        
+        Length values in transform operations need to take zoom into account.
+
+        Test: fast/transforms/transforms-with-zoom.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::createTransformOperations):
+
+2009-03-25  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24809, background-clip/origin don't use the correct
+        values.  Add support for the new values (while preserving the old values for backwards
+        compatibility).
+
+        Changed some existing test cases to use the new values.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillBox):
+        * css/CSSValueKeywords.in:
+
+2009-03-25  Brett Wilson  <brettw@dhcp-172-22-71-191.mtv.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix complex text opacity on the Chromium Windows port.
+        https://bugs.webkit.org/show_bug.cgi?id=24757
+
+        Test: fast/text/complex-text-opacity.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::init):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::estimateTextBounds):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::hdc):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::TransparencyAwareUniscribePainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::~TransparencyAwareUniscribePainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::estimateTextBounds):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2009-03-25  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Fix for bug 23198, border images should not clip to border radii.  The border-image should just ignore
+        the border-radius, since the assumption is that any desired rounding will be built into the border-image
+        itself.
+
+        Note that I do not agree with this change, but I am matching the spec.
+
+        Added fast/borders/border-image-border-radius.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+
+2009-03-25  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24750
+        [GTK] requests download instead of displaying page
+
+        Fix the Content-Type headers we get from soup, so that we set a
+        proper media type on the ResourceResponse.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-03-25  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24600
+        [GTK] responses with status code >= 400 should not be given special treatment
+
+        Do not special case requests that have HTTP responses >=
+        400. Redirects are handled automatically by libsoup, but the rest
+        of the responses should be treated like any other.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+        (WebCore::gotHeadersCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::finishedCallback):
+
+2009-03-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Tidy up LegacyWebArchive a bit. And don't include favicons in web archives when
+        they are being used only for selections, not an entire document.
+
+        * WebCore.base.exp: Remove exported function that's not used in WebKit.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation): Made a static member
+        function so it can share private things with other member functions. Added some FIXME
+        comments to a branch of code I think is dead. Changed boolean argument into a named
+        one. Renamed to match other similar functions.
+        (WebCore::LegacyWebArchive::createResourceResponseFromPropertyListData): Ditto.
+        (WebCore::LegacyWebArchive::createResource): Ditto.
+        (WebCore::LegacyWebArchive::create): Merged the create and init functions.
+        (WebCore::LegacyWebArchive::rawDataRepresentation): Added some assertions because
+        we should never fail to write (we can fail to read).
+        (WebCore::LegacyWebArchive::createResourceResponseFromMacArchivedData): Made a static
+        member function as above.
+        (WebCore::LegacyWebArchive::createFromSelection): Ditto.
+        (WebCore::LegacyWebArchive::create): Iterate the vector with indices rather than
+        iterators. Only include the favicon if the first node is the document since we don't
+        want to include the favicon when copying and pasting.
+
+        * loader/archive/cf/LegacyWebArchive.h: Made one of the create functions private.
+        Made the Mac-specific functions be static member functions. Made other helpers be
+        static member functions. Removed the nit function.
+
+        * loader/archive/cf/LegacyWebArchiveMac.mm:
+        (WebCore::LegacyWebArchive::createResourceResponseFromMacArchivedData): Updated
+        comment and made this a static member function.
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation): Ditto. Also made
+        it so we only type cast in one place.
+
+2009-03-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Bug 24740: crash in RenderSlider::setPositionFromValue when calling pause() after setting <video> to display: none
+        https://bugs.webkit.org/show_bug.cgi?id=24740
+        rdar://problem/6679873
+
+        Bug 12104: Native Slider: When the thumb's height is specified as a percentage, it is not centered properly
+        https://bugs.webkit.org/show_bug.cgi?id=12104
+
+        Test: media/video-display-none-crash.html
+
+        The problem here was that RenderSlider was trying to position its thumb in a way that
+        requires it to call updateLayout inside rendering code. The right way to position a
+        child renderer is to do layout, so I had to write a layout function. And then fix a few
+        other small problems shown by the same test case.
+
+        * rendering/RenderSlider.cpp: Made defaultTrackLength have internal linkage.
+        Renamed HTMLSliderThumbElement to SliderThumbElement because we only use the HTML
+        prefix for public DOM classes, not elements used as implementation details.
+        Made SliderThumbElement function members private and got rid of unneeded default
+        argument value for shadowParent.
+        (WebCore::SliderRange::SliderRange): Added. Parses precision, max, and min attributes.
+        (WebCore::SliderRange::clampValue): Added. Does standard clamping based on the above.
+        (WebCore::SliderRange::valueFromElement): Added. Reads the value from the element in
+        a way that clamps to the range.
+        (WebCore::sliderPosition): Added. Computes the slider position: a double.
+        (WebCore::SliderThumbElement::SliderThumbElement): Removed unneeded explicit
+        initialization of m_initialClickPoint.
+        (WebCore::SliderThumbElement::defaultEventHandler): Call setValueForPosition instead
+        of calling setCurrentPosition and valueChanged.
+        (WebCore::RenderSlider::RenderSlider): Remove unneeded explicit initialization of m_thumb.
+        (WebCore::RenderSlider::styleDidChange): Remove unneeded second argument to createThumbStyle.
+        (WebCore::RenderSlider::createThumbStyle): Remove unneeded second argument. Get rid of code
+        setting the position to relative and setting the left and top. We now handle positioning
+        in a custom layout function.
+        (WebCore::RenderSlider::layout): Rewrote to handle positioning of the thumb as layout.
+        (WebCore::RenderSlider::updateFromElement): Added code to immediately update the value
+        in the element if it's out of range. This clamping used to be done as a side effect of
+        setPositionFromValue. Also, this has nothing to do with the renderer, so at some point
+        it could be moved into HTMLInputElement. Removed call to setPositionFromValue
+        and instead just rely on the call to setNeedsLayout. Fix the setNeedsLayout call to be
+        a normal setNeedsLayout(true), not a setNeedsLayout(true, false), because we do want
+        this to be propagated to the parent -- it's not called during layout.
+        (WebCore::RenderSlider::setValueForPosition): Refactor to use the new SliderRange
+        class. Also don't call setCurrentPosition; instead just call setNeedsLayout.
+        (WebCore::RenderSlider::currentPosition): Use the actual position of the renderer rather
+        than the style to find the position; that means this needs to be done after layout is done.
+        Also removed unneeded runtime checks and replaced them with assertions, after checking
+        all callers to see they already guarantee this.
+        (WebCore::RenderSlider::trackSize): Removed unneeded runtime checks and replaced them
+        with assertions, after checking all callers to see they already guarantee this.
+        (WebCore::RenderSlider::inDragMode): Added a null check for m_thumb so this won't
+        crash if called early on a brand new RenderSlider.
+
+        * rendering/RenderSlider.h: Made all functions private except for forwardEvent and inDragMode.
+        Renamed HTMLSliderThumbElement to SliderThumbElement because we only use the HTML
+        prefix for public DOM classes, not elements used as implementation details. Made the
+        mouseEventIsInThumb function non-virtual. Removed the return value and argument from
+        setPositionFromValue. Removed valueChanged and setCurrentPosition. Removed the oldStyle
+        argument to createThumbStyle (see above). Made SliderThumbElement a friend so it can use some
+        private member functions.
+
+2009-03-25  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fix ambiguous else cases by adding braces to nested if()s with elses.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toArmenianUnder10000):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+
+2009-03-24  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Move variable into proper platform block to quiet warning.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+
+2009-03-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix for <rdar://problem/6719375> Deal with QTKit loadstate changes when playing streaming movies
+
+        *  WebCore/html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Deal with media engine reviving after having
+        network state of NETWORK_NO_SOURCE.
+
+        *  WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Reset m_readyState at each state change since
+        some types of movies currently cause QTKit's load state to bounce around. QTMovieLoadStatePlaythroughOK
+        corresponds to HaveFutureData, not HaveEnoughData.
+
+2009-03-24  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24707
+        <rdar://problem/6593021> Deleting with a caret in a blank, quoted line decreases the quoting, but does not delete the line
+
+        * editing/TypingCommand.cpp: (WebCore::TypingCommand::deleteKeyPressed):
+        After breaking out of an empty mail blockquote, we still want continue with the deletion
+        so actual content will get deleted, and not just the quote style.
+
+2009-03-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6624662> REGRESSION (r39904): can't save certain web pages as web archive (ones without favicons!)
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Added a null check.
+
+2009-03-24  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24685
+
+        The Skia drawLine function takes subpixel values and attempts to draw
+        a line with subpixel precision. This is complex and slow for drawing
+        scrollbars which use only vertical and horizontal lines.
+
+        This changes the Chromium Linux scrollbar code to use drawIRect.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::invalidateOnMouseEnterExit):
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+
+2009-03-24  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23310: Setting an absolute path (/abs) on an <iframe> with no src doesn't resolve the URL properly
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23310>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/frames/iframe-no-src-set-location.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::completeURL): If m_baseURL is empty or is
+        about:blank and we have a parent document, use the parent
+        document's URL for the base when completing a new URL.
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24659
+        
+        When hit-testing 3d-transformed layers, it doesn't make sense to project the hitTestRect
+        into the coordinate space of the layer, and doing so can result in pathalogical quads
+        that break hit testing. In that case, simply use the same bounds as used for painting,
+        which are the composited bounds for this layer.
+
+        Test: transforms/3d/hit-testing/rotated-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24436
+        
+        When compositing is enabled, painting and hit testing end up using different
+        clipping roots, because, for painting, every composited layer is a clipping root,
+        but for hit testing only layers with transforms are. To fix this, we use
+        temporary clip rects for hit testing, if the page is in compositing mode.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::parentClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayer.h:
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24782
+
+        Fix regression with CSS clip rects with non-length values, by reverting to
+        the original code, but passing the zoom multiplier through convertToLength().
+        
+        Also make stylistic change in createTransformOperations(), renaming 'inStyle'
+        to 'style.
+        
+        Tested by existing tests.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+
+2009-03-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=21789, overflow:hidden elements should clip their foreground contents
+        to a border-radius.
+
+        This patch makes non-self-painting overflow layers and control clips work with border-radius.  RenderLayers
+        that should be clipped by overflow ancestors with border-radius are still broken.
+
+        Added fast/clip/overflow-border-radius-clip.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+
+2009-03-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=21789, overflow:hidden elements should clip their foreground contents.
+        
+        This first patch makes overflow:hidden properly clip the foreground contents of overflow:hidden replaced elements.  Common
+        replaced elements now default to overflow:hidden in the UA stylesheet (this is what the spec specifically recommends be
+        done).
+    
+        Added fast/replaced/border-radius-clip.html
+
+        * css/html4.css:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-03-24  Adele Peterson  <adele@apple.com>
+
+        RS by Mark Rowe.
+
+        Only build these Mail quirks checks in on the Mac.
+
+        * dom/Document.cpp: (WebCore::disableRangeMutation):
+        * html/HTMLElement.cpp: (WebCore::HTMLElement::inEitherTagList):
+
+2009-03-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        Remove ResourceLoaderCFNet.cpp from build list for Cairo Releas
+        and Debug targets.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-03-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Fix layout tests broken by r41907.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Don't set "was playing" based on the new ready state
+
+2009-03-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24689
+        Fix Chromium compilation errors.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+
+2009-03-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24759
+        Add missing methods Element.prototype.removeMatchingStyleClasses and
+        Node.prototype.enclosingNodeOrSelfWithNodeNameInArray to SourceFrame content
+        iframe. These methods are called by Element.prototype.removeStyleClass and
+        Node.prototype.enclosingNodeOrSelfWithNodeName.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
+2009-03-24  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24653
+        WebKit should be buildable without prefix header injection.
+        Adds missing #includes and forward declarations as needed.
+
+        * editing/SmartReplaceCF.cpp:
+        * platform/graphics/mac/ColorMac.mm:
+        * platform/graphics/mac/FontCacheMac.mm:
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        * platform/graphics/mac/FontMac.mm:
+        * platform/graphics/mac/FontMacATSUI.mm:
+        * platform/graphics/mac/FontPlatformData.h:
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        * platform/mac/FoundationExtras.h:
+        * platform/mac/LocalCurrentGraphicsContext.h:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/mac/WebCoreTextRenderer.h:
+        * platform/mac/WebCoreTextRenderer.mm:
+        * platform/mac/WebFontCache.h:
+        * platform/mac/WebFontCache.mm:
+        * platform/text/PlatformString.h:
+        * platform/text/mac/ShapeArabic.c:
+        * platform/text/mac/StringMac.mm:
+        * rendering/RenderThemeChromiumMac.h:
+
+2009-03-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6107874> by capping the nesting depth of
+          "block-level" elements generated by the parser
+
+        Test: fast/parser/block-nesting-cap.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser):
+        (WebCore::HTMLParser::insertNode):
+        (WebCore::HTMLParser::pushBlock):
+        (WebCore::HTMLParser::popOneBlockCommon):
+        (WebCore::HTMLParser::freeBlock):
+        * html/HTMLParser.h:
+
+2009-03-23  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24771
+        
+        DOMTimeStamps are based upon 1970.
+
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-03-23  Eric Seidel  <eric@webkit.org>
+
+        Build fix, no review.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): change .container to .isNotNull()
+
+2009-03-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename Position::container to m_anchorNode and make it private
+        https://bugs.webkit.org/show_bug.cgi?id=24760
+
+        More code cleanup for Position.
+
+        Change all uses of m_container to node()
+        Eventually most uses of node() should change to anchorNode() to designate
+        that it's the node the Position is anchored to, but not necessarily the
+        container of the position (it could be the before/after neighbor).
+
+        Remove any code which sets m_container, and change it to use a new
+        Position::moveToPosition function which takes a node and offset.
+        It never makes sense to change the node and leave the offset.
+
+        * dom/Position.h:
+        (WebCore::Position::Position):
+        (WebCore::Position::clear):
+        (WebCore::Position::anchorNode):
+        (WebCore::Position::node):
+        (WebCore::Position::moveToPosition):
+        (WebCore::Position::moveToOffset):
+        (WebCore::Position::isNull):
+        (WebCore::Position::isNotNull):
+        (WebCore::operator==):
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::compareBoundaryPoints):
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::container):
+        (WebCore::RangeBoundaryPoint::set):
+        (WebCore::RangeBoundaryPoint::setOffset):
+        (WebCore::RangeBoundaryPoint::setToChild):
+        (WebCore::RangeBoundaryPoint::setToStart):
+        (WebCore::RangeBoundaryPoint::setToEnd):
+
+2009-03-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        document.write() should be able to make a document strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=24336
+
+        Remove an implicit write of "<html>" on the first document.write call
+        this was added as part of a KDE import http://trac.webkit.org/changeset/798
+        with no layout test or explanation.  I can't think of any reason why
+        an implicit <html> write is necessary (or correct), so I'm removing it and
+        adding a test for the correct behavior.  The parser will add any necessary
+        HTMLHTMLElements during the write() anyway.
+
+        Our behavior is now tested by fast/dom/Document/document-write-doctype
+        and matches IE, FF fails this new test.  Mozilla bug filed:
+        https://bugzilla.mozilla.org/show_bug.cgi?id=483908
+
+        * dom/Document.cpp:
+        (WebCore::Document::write):
+
+2009-03-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6140966>
+        Empty Caches does not clear the Cross-site XMLHttpRequest preflight cache
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24726: hit testing doesn't work right when the click is on anonymous content
+        https://bugs.webkit.org/show_bug.cgi?id=24726
+        rdar://problem/6696992
+
+        Test: editing/selection/hit-test-anonymous.html
+
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::positionForPoint): Call createVisiblePosition instead of
+        creating a VisiblePosition directly. It will handle finding non-anonymous
+        content nearby if node() is 0.
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries): Ditto.
+        (WebCore::positionForPointWithInlineChildren): Ditto.
+        (WebCore::RenderBlock::positionForPoint): Ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::positionForPoint): Ditto.
+        (WebCore::RenderObject::createVisiblePosition): Added.
+        * rendering/RenderObject.h: Added createVisiblePosition.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::positionForPoint): Call createVisiblePosition.
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForPoint): Ditto.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint): Ditto.
+
+2009-03-23  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler & Dave Hyatt.
+
+        Fix for <rdar://problem/6621310> REGRESSION(35185): Apple Travel HTML emails missing some style after Safari 4 upgrade
+
+        Leopard Mail doesn't expect <style> to be in the body.  This change reverts back to the old behavior of
+        moving <style> to <head> for that version of Mail.
+
+        * html/HTMLElement.cpp: (WebCore::HTMLElement::inEitherTagList):
+
+2009-03-23  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe & Dave Hyatt.
+
+        Merge some of the individual Mail quirks into two settings that we can check for future quirks.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::disableRangeMutation):
+        (WebCore::Document::nodeChildrenChanged):
+        (WebCore::Document::nodeWillBeRemoved):
+        (WebCore::Document::textInserted):
+        (WebCore::Document::textRemoved):
+        (WebCore::Document::textNodesMerged):
+        (WebCore::Document::textNodeSplit):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setNeedsLeopardMailQuirks):
+        (WebCore::Settings::setNeedsTigerMailQuirks):
+        * page/Settings.h:
+        (WebCore::Settings::needsLeopardMailQuirks):
+        (WebCore::Settings::needsTigerMailQuirks):
+
+2009-03-23  Ada Chan  <adachan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24762
+        Support text-indent in <option> elements on windows platform.
+
+        Reviewed by Adele Peterson.
+
+        * css/themeWin.css:
+        * platform/PopupMenuStyle.h: We don't honor font specified on <option> elements right now.  Make this
+        explicit via windows themed default stylesheet.
+        (WebCore::PopupMenuStyle::PopupMenuStyle): Also store text-indent and text-direction.
+        (WebCore::PopupMenuStyle::textIndent):
+        (WebCore::PopupMenuStyle::textDirection):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint): Adjust the text's x-coordinate if text-indent is supported for options and 
+        text-indent is specified with LTR direction.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth): Take text-indent into account if theme supports text-indent for options.
+        (WebCore::RenderMenuList::itemStyle): Use new PopupMenuStyle constructor on windows.
+        (WebCore::RenderMenuList::menuStyle): Ditto.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::menuStyle): Ditto.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::popupOptionSupportsTextIndent): Added.  Default is false since we are only supporting it in windows for now.
+        * rendering/RenderThemeWin.h:
+        (WebCore::RenderThemeWin::popupOptionSupportsTextIndent): Returns true for windows.
+
+2009-03-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24699
+        REGRESSION: Java Applets broken
+        <rdar://problem/6707494>
+
+        Fix loading Java applets without a codeBase. Only pass the base (up to the
+        the last path component) of the baseURL to the plug-in.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer):
+        * platform/KURL.cpp:
+        (WebCore::KURL::baseAsString):
+        * platform/KURL.h:
+
+2009-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * platform/KURL.h: Removed now-incorrect comments.
+        None of the parts include the separator characters any more, now that
+        query doesn't include the "?", so the comments explaining which do and do
+        not are no-longer helpful.
+
+2009-03-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24764
+
+        Renamed files V8NodeFilter -> V8NodeFilterCondition to reflect
+        class names.  Also fixed some headers that got mangled in search/replace
+        operations.
+
+        No change in behavior, so no test.
+
+        * bindings/v8/V8NodeFilter.h: Removed.
+        * bindings/v8/V8NodeFilterCondition.cpp: Renamed from WebCore/bindings/v8/V8NodeFilter.cpp.
+        * bindings/v8/V8NodeFilterCondition.h: Added.
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+
+2009-03-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24741
+
+        Adds a unique across-browser-sessions identifier to FormData, which may
+        be used by ResourceHandle as a secondary cache key to enable cached
+        form submissions.
+
+        At issue: two otherwise identical form submissions may result in
+        completely independent responses, which may each be appropriate to
+        store and reuse from cache.
+
+        * html/HTMLFormElement.cpp: Added call to FormData::setIdentifier so that
+        we only enable cached form submissions for those generated by HTML.  This
+        way we do not bother with POSTs generated by XMLHttpRequest.
+        (WebCore::generateFormDataIdentifier):
+        (WebCore::HTMLFormElement::createFormData):
+        * platform/network/FormData.cpp: Initialize m_identifier to 0, which means
+        the unspecified identifier.  So by default there is no identifier and
+        nothing changes.
+        (WebCore::FormData::FormData):
+        * platform/network/FormData.h: Added m_identifier with setter and getter.
+        (WebCore::FormData::setIdentifier):
+        (WebCore::FormData::identifier):
+
+2009-03-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24733
+        
+        Fix media controller with full-page zoom. Previously, the media controller
+        shadow nodes never saw style changes on the RenderMedia, so did not respond
+        to zooming at all. Now, we update the style on the shadow renderers
+        whenever RenderMedia gets a style change. Also fix the video thumb in
+        the theme to be scaled properly.
+
+        Test: media/video-controls-zoomed.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::updateStyle):
+        (WebCore::MediaTextDisplayElement::MediaTextDisplayElement):
+        (WebCore::MediaTextDisplayElement::updateStyle):
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::updateStyle):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+        * rendering/RenderMedia.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+
+2009-03-23  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24739
+
+        Rework StringImpl::create methods to try to allocate a single buffer
+        rather than allocating both the StringImpl class and a separate data
+        buffer.
+
+        * platform/text/StringImpl.cpp:
+        * platform/text/StringImpl.h:
+
+2009-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Based on a patch by Nico Weber <nicolasweber@gmx.de>
+
+        Bug 24755: LayoutTests/http/tests/misc/url-in-utf16le.html regression
+        https://bugs.webkit.org/show_bug.cgi?id=24755
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::isUTF7Encoding): Added. Checks if the current encoding
+        is UTF7 without loading extended codecs.
+        (WebCore::TextEncoding::encodingForFormSubmission): Use isUTF7Encoding() instead
+        of comparing with UTF7Encoding(). Eliminate the explicit check of
+        noExtendedTextEncodingNameUsed() because that's now handled by the functions
+        that this function calls instead.
+
+        * platform/text/TextEncoding.h: Added isUTF7Encoding function.
+        Also tweaked formatting a bit.
+
+2009-03-20  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24720
+        RenderThemeChromium should draw something for Slider parts instead of
+        dropping them on the floor.
+
+        * platform/chromium/ChromiumBridge.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumWin::paintSliderTrack):
+        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
+
+2009-03-23  Glen Murphy  <glen@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24657
+
+        Fix Skia drawing of highly scaled bitmaps; the conversion to
+        IntRect produced visible layout test failures in highly scaled 
+        coordinate systems.
+
+        Test: svg/custom/image-small-width-height.svg
+
+        * WebCore\platform\graphics\skia\ImageSkia.cpp:
+
+2009-03-23  David Kilzer  <ddkilzer@apple.com>
+
+        Provide JavaScript exception information after slow script timeout
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Changed to report
+        exceptions for the Interrupted completion type as well.
+
+2009-03-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24736
+        
+        Fix three mostly-unrelated problems with full-page zoom:
+        
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        Document::elementFromPoint() needs to take full-page zoom into account.
+        
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        Take full-page zoom into account when computing offsetX/offsetY.
+        
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        Don't use offsetX/offsetY when hit testing list boxes; offsets were broken
+        with full-page zoom, and using pageX/pageY is easier because we don't
+        have to worry about the event target, and we already have a point in
+        absolute coordinates.
+
+        Tests: fast/forms/listbox-hit-test-zoomed.html
+               fast/forms/search-zoomed.html
+               fast/forms/slider-zoomed.html
+
+2009-03-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=24753
+        
+        The rect for CSS 'clip' needs to have zooming applied to it.
+
+        Test: fast/css/clip-zooming.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-03-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6704282>
+        https://bugs.webkit.org/show_bug.cgi?id=24719
+        QTMovieWinTimer logic inversion
+
+        Fix logic inversion in the Win32 timer used by QTMovieWin that caused it to always
+        use SetTimer, even when the intervals was below USER_TIMER_MINIMUM. A side effect of
+        this was that a movie timer would sometimes be blocked for significant amounts of time 
+        because WM_TIMER messages are not processed when the thread's message queue has any
+        higher priority messages, and WebCore/Win's timer uses PostMessage for low interval
+        timers. Also change SetTimer call to use HWND and custom message instead of 
+        timer function since the timer already has an HWND for processing PostMessage.
+
+        Not possible to make a test for this because it is so timing dependant.
+
+        * platform/graphics/win/QTMovieWinTimer.cpp:
+        (TimerWindowWndProc):
+        (setSharedTimerFireDelay):
+
+2009-03-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24588
+        
+        Update media element implementation to current HTML5 spec
+
+        New tests: 
+               media/media-constants.html
+               media/video-seek-no-src-exception.html
+               media/video-source-add-src.html
+               media/video-src-invalid-remove.html
+               media/video-src-plus-source.html
+               media/video-timeupdate-during-playback.html
+
+        * dom/EventNames.h: Remove obsolute events, add new ones.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize new member vars.
+        (WebCore::HTMLMediaElement::attributeChanged): Trigger load() only when we don't
+        have a source.
+        (WebCore::HTMLMediaElement::removedFromDocument): Deal with state name changes.
+        (WebCore::HTMLMediaElement::scheduleProgressEvent): New, create a progress event and 
+        add it to the event queue to be dispatch when the timer fires.
+        (WebCore::HTMLMediaElement::scheduleEvent): New, create a generic event and add
+        it to the event queue to be dispatch when the timer fires.
+        (WebCore::HTMLMediaElement::enqueueEvent): Add an event to the queue and ticke the 
+        asynch event timer.
+        (WebCore::HTMLMediaElement::asyncEventTimerFired): Dispatch all pending events.
+        (WebCore::HTMLMediaElement::loadTimerFired): Either trigger the initial load or
+        try to load the next <source> url.
+        (WebCore::HTMLMediaElement::load): Minor style change.
+        (WebCore::HTMLMediaElement::loadInternal): The first part of the spec load algorithm, cleanup
+        the current load (if any) and set up state for a new load.
+        (WebCore::HTMLMediaElement::selectMediaResource): Deal with no 'src' or <source>, post 'loadstart'
+        event, and initiate load from 'src' if present.
+        (WebCore::HTMLMediaElement::loadNextSourceChild): Initiate load from next <source> url, or trigger
+        noneSupported() if no more to consider.
+        (WebCore::HTMLMediaElement::loadResource): Instantiate a new MediaPlayer and ask it to load a url.
+        (WebCore::HTMLMediaElement::startProgressEventTimer): Start the repeating progress event timer.
+        (WebCore::HTMLMediaElement::noneSupported): Post error event and set up state when no valid 
+        media url was found.
+        (WebCore::HTMLMediaElement::mediaEngineError): Post error event and set up state when no valid 
+        media engine failed with a decode error or a network error.
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged):
+        (WebCore::HTMLMediaElement::setNetworkState): Updated for new spec network states.
+        (WebCore::HTMLMediaElement::mediaPlayerReadyStateChanged):
+        (WebCore::HTMLMediaElement::setReadyState): Updated for new spec ready state.
+        (WebCore::HTMLMediaElement::progressEventTimerFired): Bail if the network is not active.
+        (WebCore::HTMLMediaElement::seek): Return INVALID_STATE_ERR exception if state is too low or
+        if player hasn't been set up yet. This is necessary becase load() is async. Clear the flag
+        we use to guard against sending 'ended' more than once.
+        (WebCore::HTMLMediaElement::duration): Don't bother calling media engine before it has metadata.
+        (WebCore::HTMLMediaElement::setDefaultPlaybackRate): Remove exception param, 0 is no longer an
+        invalid rate. 
+        (WebCore::HTMLMediaElement::setPlaybackRate): Remove exception param, 0 is no longer an
+        invalid rate. Cache rate being set so we can use it later if media engine isn't ready now.
+        (WebCore::HTMLMediaElement::play): Remove exception param, play() before load() now just
+        starts loading asynchronously.
+        (WebCore::HTMLMediaElement::playInternal): Remove exception param. Fire 'waiting' or 'playing'
+        event depending on current state.
+        (WebCore::HTMLMediaElement::pause): Remove exception param, pause() before load() now just
+        starts loading asynchronously.
+        (WebCore::HTMLMediaElement::pauseInternal): Remove exception param.
+        (WebCore::HTMLMediaElement::setVolume): dispatchEventAsync -> scheduleEvent
+        (WebCore::HTMLMediaElement::setMuted): dispatchEventAsync -> scheduleEvent
+        (WebCore::HTMLMediaElement::togglePlayState): Remove exception param.
+        (WebCore::HTMLMediaElement::beginScrubbing): pause() doesn't take an exception param.
+        (WebCore::HTMLMediaElement::startPlaybackProgressTimer): New, starts timer that fires 4 times per
+        second when the movie is playing to timeupdate so we can post 'timeupdate' events.
+        (WebCore::HTMLMediaElement::playbackProgressTimerFired): Timer proc.
+        (WebCore::HTMLMediaElement::scheduleTimeupdateEvent): Bottleneck around scheduling a 'timeupdate'
+        event because we both fire them them when the spec says we should and when the media engine
+        says that time has jumped, but we don't want to fire more than one at a given movie time. We also
+        use this bottleneck to keep track of the last time one was posted so we won't fire too often
+        during playback.
+        (WebCore::HTMLMediaElement::canPlay): readyState now tracks whether or not we have metadata.
+        (WebCore::HTMLMediaElement::havePotentialSourceChild): New, checks to see if there are a <source>
+        element with a 'src' attribute that we have not tried to load yet.
+        (WebCore::HTMLMediaElement::nextSourceChild): New, returns the url and content type of the next
+        <source> element that we haven't tried to load.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Schedule 'seeked' event when seeking completes.
+        Set a flag when we post the 'ended' event, clear it when time changed and we aren't at the end since
+        some media engines call this proc more than once when playback reaches the end and stops, but we
+        don't want to post 'ended' more than once.
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged): New, added so media engine can inform
+        when the movie duration changes and we can post 'durationchanged' event.
+        (WebCore::HTMLMediaElement::mediaPlayerRateChanged): New, added so media engine can inform when
+        the rate changed and we can updated our cached rate. This is useful because we only want to know
+        post periodic 'timeupdate' events when the movie is actually playing, and because we want to know
+        the actual playback rate when it differs from what we tried to set.
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged): New, added so media engine can inform when
+        a movie's intrinsic size changes and we can inform the renderer.
+        (WebCore::HTMLMediaElement::potentiallyPlaying): Renamed from activelyPlaying since the spec now
+        uses "actively playing" for this concept. Update logic for new state names and un-comment calls
+        to stoppedDueToErrors() and pausedForUserInteraction() since the spec says those condiditons
+        are part of the answer.
+        (WebCore::HTMLMediaElement::endedPlayback): Update logic for new state names. 
+        (WebCore::HTMLMediaElement::stoppedDueToErrors): New, spec says this logic should be part of
+        the determination of "potentially playing".
+        (WebCore::HTMLMediaElement::pausedForUserInteraction): New, placeholder for when (if) user
+        agent supports this spec concept.
+        (WebCore::HTMLMediaElement::updatePlayState): Stop timer used to fire periodic 'timeupdate' 
+        events when we pauses the movie. Set the media engine rate before calling play() in case it
+        wasn't set up when the rate was changed.
+        (WebCore::HTMLMediaElement::stopPeriodicTimers): New, stop the progress event and 'timeupate'
+        event timers.
+        (WebCore::HTMLMediaElement::userCancelledLoad): New, logic pulled out of documentWillBecomeInactive
+        and updated for the current spec.
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Moved some logic to userCancelledLoad.
+        (WebCore::HTMLMediaElement::documentDidBecomeActive): Update comments.
+        (WebCore::HTMLMediaElement::initialURL): Update for refactoring of code that determines the 
+        initial url.
+        * html/HTMLMediaElement.h: Change ReadyState and NetworkState enums to match names in the spec,
+        update for changes in .cpp.
+        (WebCore::HTMLMediaElement::):
+
+        * html/HTMLMediaElement.idl: Update ready state and network state constants for spec changes.
+        defaultPlaybackRate, playbackRate, play(), and pause() no longer raise exceptions.
+
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::insertedIntoDocument): Update for network state name changes.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::updatePosterImage): Update for ready state name changes.
+
+        * html/MediaError.h:
+        (WebCore::MediaError::): add MEDIA_ERR_NONE_SUPPORTED.
+
+        * html/MediaError.idl: add MEDIA_ERR_NONE_SUPPORTED.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler): play() and pause() don't take an exception.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::readyState): Update for newtork state name changes.
+        (WebCore::MediaPlayer::sizeChanged): New, so engine can report intrinsic size changes.
+        (WebCore::MediaPlayer::rateChanged): New, so engine can report rate changes.
+        (WebCore::MediaPlayer::durationChanged): New, so engine can report duration changes.
+        * platform/graphics/MediaPlayer.h: Update NetworkState and ReadyState enum names to match spec
+        states.
+        (WebCore::MediaPlayerClient::mediaPlayerDurationChanged): New.
+        (WebCore::MediaPlayerClient::mediaPlayerRateChanged): New.
+        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged): New.
+        (WebCore::MediaPlayer::):
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Ditto.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Update for network/ready state name changes.
+        Remove endPointTimer, it is no longer necessary. Add m_enabledTrackCount and m_duration.
+        (WebCore::MediaPlayerPrivate::metaDataAvailable):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): No more m_endPointTimer or m_endTime. Initialize
+        m_enabledTrackCount and m_duration. Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::play): No more m_endPointTimer.
+        (WebCore::MediaPlayerPrivate::pause): Ditto.
+        (WebCore::MediaPlayerPrivate::currentTime): No more m_endTime.
+        (WebCore::MediaPlayerPrivate::seek): Ditto.
+        (WebCore::MediaPlayerPrivate::doSeek): Ditto, plus don't call setRate(0) when the rate is
+        already zero.
+        (WebCore::MediaPlayerPrivate::setEndTime): No more m_endTime.
+        (WebCore::MediaPlayerPrivate::updateStates): Update for network/ready state name changes. Return
+        different errors depending on what causes a failure. Watch for and report duration changes.
+        (WebCore::MediaPlayerPrivate::rateChanged): Report rate changes.
+        (WebCore::MediaPlayerPrivate::sizeChanged): Report size changes.
+        (WebCore::MediaPlayerPrivate::didEnd): No more endpoint timer.
+        (WebCore::MediaPlayerPrivate::setVisible): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks): Don't return number of unsupported
+        tracks, store in m_enabledTrackCount so we can use it to help determine causes of failure.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Ditto.
+        (WebCore::MediaPlayerPrivate::duration): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Ditto.
+        (WebCore::MediaPlayerPrivate::naturalSize): Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): No more m_endPointTimer. Update for 
+        network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Update for network/ready state name changes. No more
+        m_endPointTimer.
+        (WebCore::MediaPlayerPrivate::play): No more m_endPointTimer.
+        (WebCore::MediaPlayerPrivate::pause): Ditto. 
+        (WebCore::MediaPlayerPrivate::setEndTime): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::didEnd): No more m_endPointTimer.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlPlayButtonElement::defaultEventHandler): Update for network/ready state 
+        name changes.
+        (WebCore::MediaControlSeekButtonElement::defaultEventHandler): Ditto.
+
+2009-03-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxGTK build fix. Add missing header.
+
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+
+2009-03-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24665
+        
+        Image-map code in RenderImage could result in RenderImage::nodeAtPoint()
+        setting HitTestResult::innerNode(), but returning false, which violates
+        hit testing rules. Use a temporary HitTestResult so that we only fill in
+        result when we know we've hit.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint):
+
+2009-03-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24743
+        
+        Fix hit testing regression from r41840. We need to pass the temporary
+        HitTestResult when testing sublayers, then only copy to 'result' when
+        the layer is known to have been hit.
+
+        Test: fast/layers/zindex-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24733
+        
+        Fix hit testing on video controls after full page zoom by fixing wider issue
+        with event->pageX(), pageY() with zooming. pageX and pageY are "fixed" to be
+        invariant under zooming (for JavaScript), so we keep an actual page point around
+        in MouseEvent::absoluteLocation() to avoid the need to factor in zooming everywhere.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::initCoordinates):
+        (WebCore::MouseRelatedEvent::computePageLocation):
+        * dom/MouseRelatedEvent.h:
+        (WebCore::MouseRelatedEvent::absoluteLocation):
+        (WebCore::MouseRelatedEvent::setAbsoluteLocation):
+        Member var, and getter and setter for absoluteLocation.
+        New method, computePageLocation(), to compute the actual page point,
+        and call it when creating and initting mouse-related events.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        Keep non-adjusted pageX and pageY around, and call setAbsoluteLocation()
+        on the event to replace a potentially rounded point.
+        
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        Clean up slider handling code.
+        
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        Add FIXME comment for use of offsetX/offsetY.
+        
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        Use absoluteLocation() when hit testing for context menus.
+        
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::userResize):
+        Use absoluteLocation() when resizing frames.
+        
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::forwardEvent):
+        Use absoluteLocation() when hit testing media controls.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
+        (WebCore::RenderSlider::mouseEventIsInThumb):
+        Use absoluteLocation() when handling slider events.
+
+        (WebCore::RenderSlider::forwardEvent):
+        Factor some code out of HTMLInputElement::defaultEventHandler().
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        Use absoluteLocation() when hit testing search field buttons, which fixees
+        bugs in the search field with zooming.
+
+2009-03-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24727
+        Add V8XMLHttpRequest*.
+
+        * bindings/v8/V8XMLHttpRequestUtilities.cpp: Added.
+        * bindings/v8/V8XMLHttpRequestUtilities.h: Added.
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp: Added.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp: Added.
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Added.
+
+2009-03-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24725
+        Add V8NodeFilter.
+
+        * bindings/v8/V8NodeFilter.cpp: Added.
+        * bindings/v8/V8NodeFilter.h: Added.
+
+2009-03-21  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Kevin Decker
+
+        - remove some redundant #include statements
+
+        * bindings/js/JSDOMWindowBase.cpp:
+
+2009-03-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6574185> REGRESSION (3.2.2-TOT): hang in text drawing code
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs): Changed glyph stroking to fill and stroke each
+        glyph as a separate path, instead of all glyphs as a single path. This
+        matches what CGContextShowGlyphsWithAdvances() does, and has comparable
+        performance.
+
+2009-03-20  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Build fix for ENABLE(3D_RENDERING)
+
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+
+2009-03-20  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24705
+
+        A bug in the V8 bindings is preventing chromium from setting the href on the
+        location object...any attempt throws a security error, not just for javascript
+        protocol
+
+        * page/Location.idl:
+
+2009-03-20  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24608
+
+        Include stdio.h needed for printf on gcc 4.4.0
+
+        * platform/KURLGoogle.cpp:
+
+2009-03-20  Mike Belshe <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24577
+
+        Don't let comments at the end of an event handler
+        break the event handler.
+
+        No change in behavior, so no test.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+
+2009-03-20  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24535
+
+        Fixes missing line terminator character (;) after macro call.
+        It is common practice to add the trailing ";" where macros are substituted
+        and not where they are defined with #define.
+        This change is consistent with other macro declarations across webkit,
+        and it also solves compilation failure with symbian compilers. 
+ 
+        No change in behavior, so no test.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        * bindings/js/JSNamedNodesCollection.cpp:
+        * bindings/js/JSNodeFilterCondition.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        * bindings/js/JSRGBColor.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-03-20  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov and Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24324
+
+        Make the minimum timer configurable for different platforms.
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::fired):
+        * page/DOMTimer.h:
+        (WebCore::DOMTimer::minTimerInterval):
+        (WebCore::DOMTimer::setMinTimerInterval):
+
+2009-03-20  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22834
+
+        Make sure to consistently match new/delete and fastMalloc/fastFree.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+        (WebCore::CSSSelectorList::deleteSelectors):
+
+2009-03-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23739
+          <rdar://problem/6556371> REGRESSION (r36513): iframe isn't sized properly upon load
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::percentHeightDescendants): Added this accessor.
+        * rendering/RenderBlock.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows): Extended the check for
+        children that flex to include other descendants with percent height
+        which is relative to the cell.
+
+2009-03-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24706
+        Remove ScriptExecutionContext::encoding() since Workers do not need it.
+        WorkerContext::encoding() is simply removed, while Document::encoding()
+        made non-virtual and private. Workers use UTF-8 now except when instructed
+        otherwise by http header. Also updated test.
+
+        * dom/Document.h: Made encoding() non-virtual and private.
+        * dom/ScriptExecutionContext.h: removed encoding().
+
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/WorkerContext.cpp: removed encoding() implementation.
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::completeURL):
+        * workers/WorkerContext.h: removed encoding()
+        (WebCore::WorkerContext::create):
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerImportScriptsClient.cpp:
+        (WebCore::WorkerImportScriptsClient::didReceiveData):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        In all these, removed storing encoding and 'inheriting' it from the parent.
+        Instead, they are all using UTF-8 now.
+
+2009-03-20  Timothy Hatcher  <timothy@apple.com>
+
+        Change how threading exceptions are checked so they are reported
+        by what round they were added. That way WebKit can decided the
+        behavior per-round based on linked-on-or-after checks.
+
+        <rdar://problem/6626741&6648478&6635474&6674079>
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp: Export the new symbols.
+        * bindings/objc/DOMAbstractView.mm: Use the new WebCoreThreadViolationCheckRoundOne macro.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * platform/ThreadCheck.h:
+        * platform/mac/ThreadCheck.mm:
+        (WebCore::readThreadViolationBehaviorFromUserDefaults): Refactor how the default is read.
+        (WebCore::setDefaultThreadViolationBehavior): Take a round argument.
+        (WebCore::reportThreadViolation): Ditto.
+        (WebCoreReportThreadViolation): Ditto.
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed up an out-of-date comment.
+
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customPut):
+
+2009-03-20  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20909 REGRESSION 
+        (r35318): A press release at pfizer.com does not display correctly
+        - and corresponding -
+        <rdar://problem/6680073>
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::invalidateContainerPrefWidths):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+
+2009-03-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        maxDeepOffset is confusing and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=24586
+
+        Abstract some hard-to-read (but shared) logic into a new renderedAsNonInlineTableOrHR function.
+        Add first/lastDeepEditingPositionForNode Position creation functions
+        and deploy them to places we used to call maxDeepOffset.
+
+        Rename Position::atStart and atEnd to atStartOfTree atEndOfTree
+        Add a new Position::atFirst/atLastEditingPositionForNode() and use these
+        to replace a few more callers for maxDeepOffset()
+        
+        Rename maxDeepOffset to lastEditingOffsetForNode (so that we mere mortals have some clue what it does)
+
+        "Editing positions" are confusing because they have one
+        of two behaviors, depending on if the container node is ignored
+        by editing (if editingIgnoresContent(node) returns true) or not.
+        Positions referring to nodes ignored by editing are
+        neighbor-relative (they are before or after the node) where as
+        positions reffering to other nodes are container-relative
+        (they are between two child nodes of the container, identified
+        by the offset() member).  I will be fixing this confusion in
+        future patches.  These renames hopefully make the current behavior clearer.
+
+        * dom/Position.cpp:
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::atFirstEditingPositionForNode):
+        (WebCore::Position::atLastEditingPositionForNode):
+        (WebCore::Position::atStartOfTree):
+        (WebCore::Position::atEndOfTree):
+        (WebCore::Position::previousCharacterPosition):
+        (WebCore::Position::nextCharacterPosition):
+        (WebCore::Position::upstream):
+        (WebCore::Position::isCandidate):
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * dom/Position.h:
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        (WebCore::PositionIterator::increment):
+        (WebCore::PositionIterator::decrement):
+        (WebCore::PositionIterator::atEnd):
+        (WebCore::PositionIterator::atEndOfNode):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::isTableCellEmpty):
+        (WebCore::DeleteSelectionCommand::removeNode):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::previous):
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::left):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::right):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::selectionFromContentsOfNode):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::nextVisuallyDistinctCandidate):
+        (WebCore::previousVisuallyDistinctCandidate):
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::lastOffsetForEditing):
+        (WebCore::isFirstPositionAfterTable):
+        (WebCore::isLastPositionBeforeTable):
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::enclosingEmptyListItem):
+        (WebCore::caretMaxOffset):
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::renderedAsNonInlineTableOrHR):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::startOfEditableContent):
+        (WebCore::endOfEditableContent):
+        * page/AccessibilityObject.cpp:
+        (WebCore::endOfStyleRange):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionRange):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2009-03-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24689
+        Add (upstream) V8 bindings for Workers. Mostly style cleaning.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp: Added.
+        * bindings/v8/WorkerContextExecutionProxy.h: Added.
+        * bindings/v8/WorkerScriptController.cpp: Added.
+        * bindings/v8/WorkerScriptController.h: Added.
+        * bindings/v8/V8Index.h: Added. This is just a wrapper for v8_index.h, like V8Proxy.h
+        * bindings/v8/V8Proxy.h: Added domObjectMap() function that wraps GetDOMObjectMap().
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::callListenerFunction): TrackEvent() renamed trackEvent()
+
+2009-03-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for LayoutTests/fast/canvas/canvas-text-alignment.html
+        on chromium/skia.  The problem was that the gradient matrix
+        for text was being applied twice.  Fixed by reverting some of
+        https://bugs.webkit.org/show_bug.cgi?id=23957, so that skiaDrawText
+        is no longer responsible for measuring the text and scaling up
+        the gradient matrix.  Instead, the text bounding box is passed
+        in from SVGPaintServerGradient.  I didn't make this change for CG,
+        since it uses a different method (the gradient is drawn using the
+        text as a pre-rendered mask).
+        https://bugs.webkit.org/show_bug.cgi?id=24687
+
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::skiaDrawText):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+
+2009-03-20  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        There seems to be some rounding error in cairo (or in how we use
+        cairo) with some fonts, like DejaVu Sans Mono, which makes cairo
+        report a height smaller than ascent + descent, which is wrong and
+        confuses WebCore's layout system. Workaround this while we figure
+        out what's going on.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-03-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24122
+        <rdar://problem/6674179>
+        REGRESSION: DOM Range extractContents/deleteContents failures seen on Moxiecode tests
+
+        Test: fast/dom/Range/deleted-range-endpoints.html
+
+        * dom/Range.cpp: (WebCore::Range::processContents): Set the final range in accordance
+        to the specification.
+
+2009-03-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6682554> Flash content not being rendered (Shockwave Flash 10.0 r22)
+        
+        If calling updateWidget for some reason resulted in another widget being added to m_widgetUpdateSet, then
+        that object would never be updated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateWidgets):
+        Factor the widget updating code out into this method. Return true if the update set is empty.
+        
+        (WebCore::FrameView::performPostLayoutTasks):
+        Loop over the update set multiple times until all widgets have been updated or until we reach the cap.
+        
+        * page/FrameView.h:
+
+2009-03-18  Timothy Hatcher  <timothy@apple.com>
+
+        Make the defered data loading timer honor the Page's scheduled runloop pairs.
+        Introduces a new RunLoopTimer class that has an API mimicking Timer but
+        allows it to be scheduled with one or more SchedulePairs.
+
+        <rdar://problem/6687342> -[WebView scheduleInRunLoop:forMode:] has no affect on timers
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Adds the new RunLoopTimer.{cpp,h} files.
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::handleDataLoadNow): Use the MainResourceLoaderTimer typedef.
+        (WebCore::MainResourceLoader::startDataLoadTimer): Added. Start the timer and on
+        Mac platforms also schedule with the Page's SchedulePairs.
+        (WebCore::MainResourceLoader::handleDataLoadSoon): Call startDataLoadTimer().
+        (WebCore::MainResourceLoader::setDefersLoading): Ditto.
+        * loader/MainResourceLoader.h:
+        * platform/cf/RunLoopTimerCF.cpp: Added.
+        (WebCore::RunLoopTimerBase::~RunLoopTimerBase):
+        (WebCore::timerFired):
+        (WebCore::RunLoopTimerBase::start):
+        (WebCore::RunLoopTimerBase::schedule):
+        (WebCore::RunLoopTimerBase::stop):
+        (WebCore::RunLoopTimerBase::isActive):
+        * platform/RunLoopTimer.h: Added.
+        (WebCore::RunLoopTimerBase::RunLoopTimerBase):
+        (WebCore::RunLoopTimerBase::startRepeating):
+        (WebCore::RunLoopTimerBase::startOneShot):
+        (WebCore::RunLoopTimer::RunLoopTimer):
+        (WebCore::RunLoopTimer::fired):
+
+2009-03-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24702
+        Upstream miscellaneous bindings changes.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Changed to call lower-case evaluate.
+        * bindings/v8/ScriptCallStack.h: Added an extra include.
+
+2009-03-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24686
+        
+        When hit testing a RenderLayer whose parent lives in a preserves-3D hierarchy,
+        we need to compare the computed z-offset with the depth-test z-offset before
+        deciding that such a RenderLayer was hit. This fixes an issue, tested by the
+        3d-point-mapping-overlapping.html test, where the child of a transformed element
+        is found by hit testing, even when some other element with greater Z overlaps
+        them both.
+        
+        Improved the code by adding a utility method, isHitCandidate(), which computes and tests
+        z-depth when necessary.
+
+        Tests: transforms/3d/point-mapping/3d-point-mapping-coplanar.html
+               transforms/3d/point-mapping/3d-point-mapping-overlapping.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isHitCandidate):
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-19  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24456
+        Split ColorChromium.cpp into Mac & Windows variants.
+        Remove Chromium Dependency on platform/graphics/mac/ColorMac.mm since we
+        ultimately need to take a different approach.  For now, createCGColor()
+        is copied from ColorMac.mm.
+
+        No observable change in behavior, so no test.
+
+        * platform/graphics/chromium/ColorChromium.cpp:
+        (WebCore::focusRingColor):
+        * platform/graphics/chromium/ColorChromiumMac.mm: Added.
+
+2009-03-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24675
+        Unforking frontend: add custom InspectorController methods
+        implementation.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Added.
+
+2009-03-19  Jay Campan  <jcampan@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24625
+        Adding an accessor to the currently selected index in the PopupMenuChromium.
+        This is required for implementing the deletion of an autocomplete entry in Chromium.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::selectedIndex):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-03-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24526
+        Improve windows skia text stroking.
+
+        Test: LayoutTests/svg/custom/struct-use-09-b.svg
+
+        * platform/graphics/skia/SkiaFontWin.cpp: Close the path representing
+        each font glyph polygon, rather than only closing the path once per
+        letter. This fixes stroking for letters with multiple polygons, such
+        as 'A' or 'D'.
+        (WebCore::getPathForGlyph):
+        (WebCore::skiaDrawText):
 
 2009-03-19  Simon Hausmann  <simon.hausmann@nokia.com>
 
@@ -402,6 +26669,5954 @@
         * plugins/qt/PluginViewQt.cpp:
         (WebCore::PluginView::init): Ditto.
 
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 24596: ASSERT in JSC::PropertySlot::slotBase @ iGoogle homepage
+        <https://bugs.webkit.org/show_bug.cgi?id=24596>
+        <rdar://problem/6686493>
+
+        JSDOMWindow::customGetOwnPropertySlot() does an access check after calling
+        JSGlobalObject::getOwnPropertySlot(). This causes the PropertySlot to be
+        set twice, once to the value that is illegal to access, and then to undefined
+        This causes an assertion failure in property access caching code.
+
+        The fix is to do the access check before calling JSGlobalObject::getOwnPropertySlot().
+
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+
+2009-03-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24676
+        Simple cross-origin requests shouldn't dispatch upload progress events
+
+        Test: http/tests/xmlhttprequest/simple-cross-origin-progress-events.html
+
+        * loader/CrossOriginAccessControl.cpp: (WebCore::passesAccessControlCheck): Added a comment
+        explaining the somewhat unexpected behavior of this function.
+
+        * xml/XMLHttpRequestUpload.cpp: (WebCore::XMLHttpRequestUpload::hasListeners):
+        * xml/XMLHttpRequestUpload.h:
+        Report whether there are any event listeners registered.
+
+        * xml/XMLHttpRequest.h: Added m_uploadEventsAllowed.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Set m_uploadEventsAllowed flag.
+        (WebCore::XMLHttpRequest::makeSameOriginRequest): Ditto.
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequest): Ditto.
+        (WebCore::XMLHttpRequest::makeSimpleCrossOriginAccessRequest): Set request body - it can be
+        non-empty for POST requests.
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight): Set m_uploadEventsAllowed flag.
+        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult): Ditto.
+        (WebCore::XMLHttpRequest::abort): Only dispatch upload progress events if allowed.
+        (WebCore::XMLHttpRequest::networkError): Ditto.
+        (WebCore::XMLHttpRequest::abortError): Ditto.
+        (WebCore::XMLHttpRequest::didSendData): Ditto.
+
+2009-03-18  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24398
+        Fix a crash when loading a svg file in Chromium's test_shell and
+        then reloading the page.
+
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::BackForwardList):
+        (WebCore::BackForwardList::close):
+
+2009-03-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/6685235>
+        <video> element poster cannot be set dynamically if not originally set up in HTML
+        
+        Allocate the media engine immediately so the plug-in proxy is available for
+        scripting right away.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer):
+
+2009-03-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6636747> REGRESSION (Safari 4 PB-r41326): 
+        Popup menu appears at the wrong location on page at http://
+        www.signonsandiego.com/
+
+        This was a regression from http://trac.webkit.org/changeset/40769, 
+        which changed the base class of RenderInline to 
+        RenderBoxModelObject rather than RenderBox.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetParent): offsetParent should return a 
+        RenderBoxModelObject rather than just a RenderBox, which is more 
+        restrictive. 
+
+2009-03-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6504776> 
+        CrashTracer: [USER] 188 crashes in Safari at com.apple.WebCore • WTF::HashTableIterator<WTF::RefPtr<WebCore::ResourceLoader>, ...
+
+        Return early in case calling the client ends up spinning the run loop and completing/cancelling the load.
+        
+        * loader/NetscapePlugInStreamLoader.cpp:
+        (WebCore::NetscapePlugInStreamLoader::didCancel):
+
+2009-03-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24664
+        Upstreaming v8 collection.h
+
+        No change in behavior, so no test.
+
+        * bindings/v8/V8Collection.h: Added.
+
+2009-03-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23966
+        REGRESSION: Custom arrow navigation functionality doesn't work at dropular.net
+        <rdar://problem/6589657>
+
+        Match the CSSOM spec for getClientRects and getBoundingClientRect by
+        returning a 0x0 rect at the correct top/left position for empty inline
+        boxes.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+
+2009-03-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Match the changes done for windows in the bug
+        https://bugs.webkit.org/show_bug.cgi?id=24530.
+
+        No change in behavior, so no test.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+
+2009-03-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Added support for SVG's stroked texts to Qt.
+
+        [Qt] SVGs stroked text support missing
+        https://bugs.webkit.org/show_bug.cgi?id=24262
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-03-18  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix fast/encoding/char-decoding.html with recent ICU.
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::decode): Look for gb18030 case-insensitively,
+        as newer versions of ICU use GB18030 as the canonical name.
+
+2009-03-17  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24662
+        Chromium build fixes.
+
+        Bug https://bugs.webkit.org/show_bug.cgi?id=24663 tracks
+        the invalid implementation of ScriptCallStack.
+
+        No change in behavior, so no test.
+
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+
+2009-03-17  David Carson  <dacarson@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Add anchor elements to the simple style sheet so that applications that 
+        are using WebKit just for simple text and links will also take advantage
+        of the fast path.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::elementCanUseSimpleDefaultStyle):
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6687005> Need support for new move-left/right selectors.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeMoveToLeftEndOfLine): Added.
+        (WebCore::executeMoveToLeftEndOfLineAndModifySelection): Added.
+        (WebCore::executeMoveToRightEndOfLine): Added.
+        (WebCore::executeMoveToRightEndOfLineAndModifySelection): Added.
+        Added command entries for the functions above.
+
+2009-03-17  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Put the padding inside scrollbars on textareas.
+        https://bugs.webkit.org/show_bug.cgi?id=24370
+        
+        Put the padding inside the scrollbars on textareas. This is done by moving the
+        overflow from the shadowNode to the RenderTextControlMultiline. As a result,
+        all of the scroll handing methods that RenderTextControl overrides can be moved
+        down into RenderTextControlSingleLine since RenderTextControlMultiline can now
+        just use RenderBlock's versions. This also allows RenderTextControlMultiLine to
+        no longer need a custom layout method since the shadowNode can now just size
+        like a regular DIV.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::selection):
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::hitInnerTextElement):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
+        (WebCore::RenderTextControlSingleLine::autoscroll):
+        (WebCore::RenderTextControlSingleLine::scrollWidth):
+        (WebCore::RenderTextControlSingleLine::scrollHeight):
+        (WebCore::RenderTextControlSingleLine::scrollLeft):
+        (WebCore::RenderTextControlSingleLine::scrollTop):
+        (WebCore::RenderTextControlSingleLine::setScrollLeft):
+        (WebCore::RenderTextControlSingleLine::setScrollTop):
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock):
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        (WebCore::TextControlInnerTextElement::createRenderer):
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Bug 24517: REGRESSION (r41552): innerHTML does an updateLayout -- unneeded and can be slow
+        https://bugs.webkit.org/show_bug.cgi?id=24517
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::enable): Added a call to updateRendering, since
+        determining whether to display the delete button involves style and updateRendering
+        also updates style (should probably be named updateStyle, in fact). Not needed to fix
+        this bug, but would have prevented the crash that led to this bug in the first place.
+
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::EditCommand): Get rid of unneeded null check. All frames have
+        delete button controllers.
+        * editing/Editor.cpp:
+        (WebCore::Editor::rangeForPoint): Ditto.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Changed a "&" to a "&&" so that generating markup
+        doesn't depend on renderers at all when the convertBlocksToInlines boolean is false.
+        This allows us to omit the call to updateLayoutIgnorePendingStylesheets in the
+        createMarkup function that's called by innerHTML.
+        (WebCore::MarkupAccumulator::appendMarkup): Turned this into a class with a member
+        function. Added a feature where the accumulator will skip a node. Moved arguments
+        that don't change during recursion into an object. This function still is a bit
+        inefficient, since it creates a new HashMap at every level as it recurses, but for now
+        I did not tackle that. Also replaced the onlyIncludeChildren boolean with EChildrenOnly
+        for consistency and clarity.
+        (WebCore::createMarkup): Removed the call to updateLayoutIgnorePendingStylesheets.
+        Instead of calling disable/enable on the delete button controller's container element,
+        pass it in to the markup accumulator as a node to skip.
+
+2009-03-17  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24651
+        Skia does not always render text fill/stroke pattern/gradient/color correctly
+
+        Changes Skia's font rendering to only render gradient/pattern if current
+        color space indicates the gradient/pattern should be used.
+        This is covered by LayoutTests/fast/canvas/canvas-text-alignment.html .
+    
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::strokeColorSpace):
+        (WebCore::GraphicsContext::fillColorSpace):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2009-03-17  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24655
+        <rdar://problem/6633727> Hitting return at the end of a line with an anchor jumps me to the bottom of the message
+
+        Test: editing/inserting/6633727.html
+
+        This changes does a few things:
+        1) Renames pos to insertionPosition.
+        2) Eliminates "startNode".  It doesn't work well to consider the node separately from the insertionPosition.  
+           The insertionPosition gets updated at various times, and it seems likely that startNode can get out of sync.
+        3) Before building up a list of ancestors to move around when we insert the new block, make sure to use the deepest
+           representation of the insertionPosition, so all ancestor nodes are correctly included.
+
+        * editing/InsertParagraphSeparatorCommand.cpp: (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-03-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kevin Ollivier.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24115
+        Introduce platform independent stubs for plugins.
+
+        * plugins/PluginDataNone.cpp: Copied from WebCore/plugins/wx/PluginDataWx.cpp.
+        * plugins/PluginPackageNone.cpp: Copied from WebCore/plugins/wx/PluginPackageWx.cpp.
+        * plugins/PluginViewNone.cpp: Copied from WebCore/plugins/wx/PluginViewWx.cpp.
+        * plugins/wx/PluginDataWx.cpp: Removed.
+        * plugins/wx/PluginPackageWx.cpp: Removed.
+        * plugins/wx/PluginViewWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Earlier version reviewed by Adele Peterson.
+
+        Bug 24304: REGRESSION (r39864): Hitting the space bar to select an <input type=radio>
+        or push an <input type=button> or <button> causes the page to scroll down.
+
+        Would be best to add a regression test for Windows eventually; tested that this has
+        no effect on the Mac OS X platform.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler): Added FIXMEs and tweaked formatting.
+        Use the code that calls the base class's defaultEventHandler early only in the cases
+        where it's needed: keydown and keypress events in text fields. In other cases, do the
+        more typical thing and call the default handler only at the end of the function.
+        This function already had code to make sure the keypress event for space never gets
+        through, but it was running too late since the scrolling code was moved into the
+        base class default event handler.
+
+2009-03-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24632
+
+        Fix repaint issues when composited layers come and go (only applies
+        when ACCELERATED_COMPOSITING is turned on).
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::mustOverlayCompositedLayers):
+        (WebCore::RenderLayer::setMustOverlayCompositedLayers):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        * rendering/RenderLayerBacking.h:
+
+        Move what used to be the 'forceCompositingLayer' flag from RenderLayerBacking
+        to RenderLayer, because we don't want the side-effects of creating RenderLayerBacking
+        when setting this flag.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        When a RenderLayer flips into or out of compositing mode, compute a repaint
+        rect relative to the containerForRepaint, and repaint it.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Call layer->setMustOverlayCompositedLayers() rather than setForcedCompositingLayer().
+        
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
+        
+        Rename requiresCompositingLayerForTransform() to requiresCompositingForTransform()
+        and make it a class static method to match requiresCompositingForAnimation(). Both
+        now take RenderObjects, rathern than RenderLayers.
+        
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasTransformRelatedProperty):
+        Minor tidyup using convenience methods added in an earlier commit.
+
+2009-03-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24396
+
+        * config.h:
+        Add WTF_USE_ACCELERATED_COMPOSITING, defined to 0 for now, and add some
+        comments to make the #ifdefs more readable.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::computedTransform):
+        Add a comment to mention that we don't flatten the matrix.
+        
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+        Have the 'transform-3d' media query evaluate to 'true' if 3d-rendering
+        is supported.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+        No need for the #ifdef here. If we don't support 3d, we will have already flattened
+        the matrix.
+        
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::makeAffine):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        New method to convert the matrix to an affine matrix by throwing a way the non-affine
+        parts.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        If 3d rendering is not supported, convert the matrix to an affine matrix
+        which can be rendered, and used for hit testing.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        Change the name of the exported symbol that webkitdirs.pm uses to know if
+        3d rendering is supported. There is no other 3d-rendering-specific symbol we can sniff.
+        
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+        Only take perspective into account if 3d rendering is supported.
+
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+        Utility method that flattens a matrix if 3d rendering is not supported.
+
+2009-03-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Fix typo after mouse wheel changes.
+
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::isEqual): Fix build, remove stray parenthesis.
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Fix crash seen right away when running run-webkit-tests.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::isEqual): Restore assertion to its behavior pre-refactoring.
+        Also tweaked formatting a bit.
+
+2009-03-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLSelectElement::add() doesn't look at exception code returned from insertBefore(), so 
+        it doesn't need to zero it out before calling.
+
+        * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::add): Removed "ec = 0" line.
+
+2009-03-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - WebCore part of adding a mechanism for controlling the caching of
+          responses through WebFrameLoaderClient
+
+        Mac already has such a mechanism, and this adds one for CFNetwork ports.
+
+        * WebCore.vcproj/WebCore.vcproj: Added EmptyClients.h
+        and ResourceLoaderCFNet.cpp.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::shouldCacheResponse): Added an
+        implementation that always returns true.
+
+        * loader/FrameLoaderClient.h: Declared shouldCacheResponse().
+
+        * loader/ResourceLoader.h: Ditto.
+
+        * loader/cf/ResourceLoaderCFNet.cpp: Added.
+        (WebCore::ResourceLoader::shouldCacheResponse): Added. Calls through to
+        FrameLoaderClient::shouldCacheResponse().
+
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::shouldCacheResponse): Added an
+        implementation that always returns true.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willCacheResponse): Added a call to
+        ResourceHandleClient::shouldCacheResponse(). If the client returns
+        false, return 0, which will prevent CFNetwork from caching the response.
+
+2009-03-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13287
+        Cannot change SELECT to a dynamically created option
+
+        Tests: fast/forms/add-and-remove-option.html
+               fast/forms/add-remove-option-modification-event.html
+               fast/forms/add-selected-option.html
+               fast/forms/select-cache-desynchronization.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Increment DOM tree version. This will happen when
+        dispatching DOMSubtreeModified again, but the version should be incremented for event
+        listeners to have an up to date view of the DOM.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * html/HTMLOptionElement.cpp: (WebCore::HTMLOptionElement::insertedIntoTree):
+        Make sure that the select element knows about its new selected option.
+
+        * html/HTMLOptionElement.h: Use insertedIntoTree() instead of insertedIntoDocument(),
+        because DOM also needs to be updated for forms that are not in document yet. Similar
+        problems exist for node removing, but removedFromTree() is called at a wrong time, so
+        those problems cannot be fixed without deeper refactoring.
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setRecalcListItems): Reset m_activeSelectionAnchorIndex - it
+        doesn't make sense to keep the anchor after programmatically changing the selection, and
+        keeping it was causing a failure in fast/forms/listbox-selection.html.
+
+        * html/HTMLSelectElement.h: Removed overrides for ContainerNode methods that only called
+        base class versions.
+
+2009-03-17  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6690324> Accessing FTP sites reads unallocated memory, can result in garbled entries or crashes
+        
+        Reviewed by Darin Adler.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::parseAndAppendOneLine): Assign CString to a local while we hold pointers into it.
+
+2009-03-16  David Hyatt  <hyatt@apple.com>
+
+        <rdar://problem/6648411> REGRESSION: Layout of page is wrong at http://www.popcap.com/
+
+        Make sure that the initial shouldPaint check that looks at enclosingLayers properly skips over
+        layers that don't paint themselves.  This is done by adding a new enclosingSelfPaintingLayer method
+        so that RenderObjects can walk up the enclosing layer chain and skip any layers that don't paint
+        themselves.
+
+        Reviewed by Darin Adler.
+
+        Added fast/block/float/overlapping-floats-with-overflow-hidden.html
+
+        * WebCore.base.exp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverhangingFloats):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::enclosingSelfPaintingLayer):
+        * rendering/RenderObject.h:
+
+2009-03-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24592
+        [GTK] Crash in FcPatternHash
+
+        Style fixes.
+
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::operator=):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+
+2009-03-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24592
+        [GTK] Crash in FcPatternHash
+
+        Sanitize memory management in pango fonts.
+
+        Release memory allocated by FontPlatformDataPango in its own
+        destructor instead of doing it from other classes, and add copy
+        constructor and '=' operator to be able to track referenced
+        objects properly.
+
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24624: Crash in imageLoadEventTimerFired after adoptNode used on <img>,
+        seen with inspector, which uses adoptNode
+        https://bugs.webkit.org/show_bug.cgi?id=24624
+        rdar://problem/6422850
+
+        Test: fast/dom/HTMLImageElement/image-load-cross-document.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Removed m_imageLoadEventTimer.
+        (WebCore::Document::detach): Removed m_imageLoadEventDispatchSoonList and
+        m_imageLoadEventDispatchingList.
+        (WebCore::Document::implicitClose): Called ImageLoader::dispatchPendingLoadEvents
+        instead of dispatchImageLoadEventsNow.
+
+        * dom/Document.h: Removed ImageLoader, dispatchImageLoadEventSoon,
+        dispatchImageLoadEventsNow, removeImage, m_imageLoadEventDispatchSoonList,
+        m_imageLoadEventDispatchingList, m_imageLoadEventTimer, and imageLoadEventTimerFired.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::loadEventSender): Added. Returns the single global ImageLoadEventSender
+        object used privately as the target of the load event timer.
+        (WebCore::ImageLoader::~ImageLoader): Call ImageLoadEventSender::cancelLoadEvent
+        rather than Document::removeImage.
+        (WebCore::ImageLoader::setImage): Use m_element directly, not element().
+        (WebCore::ImageLoader::updateFromElement): Ditto. Also name the local variable
+        document instead of doc.
+        (WebCore::ImageLoader::notifyFinished): Call ImageLoadEventSender::dispatchLoadEventSoon
+        rather than Document::dispatchImageLoadEventSoon.
+        (WebCore::ImageLoader::dispatchPendingLoadEvent): Added. Handles the common logic
+        about when load events can be dispatched so that dispatchLoadEvent only has to
+        have the specific part for each derived class. This includes a check that the
+        document is attached, which used to be handled by having documents empty out the
+        image load event vectors in the detach function.
+        (WebCore::ImageLoader::dispatchPendingLoadEvents): Added. Calls the appropriate
+        function on the ImageLoadEventSender, which avoids the need to have that class be
+        public in the ImageLoader header.
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender): Added. Has the code that
+        was previously in the Document constructor.
+        (WebCore::ImageLoadEventSender::dispatchLoadEventSoon): Added. Has the code that
+        was previously in Document::dispatchImageLoadEventSoon.
+        (WebCore::ImageLoadEventSender::cancelLoadEvent): Added. Has the code that was
+        previously in Document::removeImage.
+        (WebCore::ImageLoadEventSender::dispatchPendingLoadEvents): Added. Has the code
+        that was previously in Document::dispatchImageLoadEventsNow.
+        (WebCore::ImageLoadEventSender::timerFired): Added. Calls dispatchPendingLoadEvents.
+
+        * loader/ImageLoader.h: Improved comments. Made the virtual functions private
+        or protected rather than public. Added static dispatchPendingLoadEvents function
+        for use by Document and private dispatchPendingLoadEvent function for use by
+        ImageLoadEventSender. Made setLoadingImage private and eliminated
+        setHaveFiredLoadEvent since that can all be done inside the class without any
+        member functions.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent): Removed logic to check whether a
+        load event already fired and whether image() is 0. These are now both base class
+        responsibilities.
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent): Ditto.
+        * wml/WMLImageLoader.cpp:
+        (WebCore::WMLImageLoader::dispatchLoadEvent): Ditto.
+
+2009-03-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24623
+        Refactor ConsoleMessage to use ScriptFuncitonCall and eliminate JSC
+        dependencies.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added uint and ScriptString-taking methods.
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::quarantineValue): Added generic ScriptValue quarantine helper.
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual): Added.
+        * bindings/js/ScriptValue.h:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole): Added.
+        (WebCore::ConsoleMessage::isEqual): Changed to use ScriptValue::isEqual.
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::incrementCount): Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Changed to use ConsoleMessage::addToConsole.
+        (WebCore::InspectorController::populateScriptObjects): Ditto.
+        * inspector/InspectorController.h:
+
+2009-03-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Mark Rowe.
+
+        Get BUILDING_ON_* defines from Platform.h.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24630
+
+        * WebCorePrefix.h:
+
+2009-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24592
+        [GTK] Crash in FcPatternHash
+
+        Sanitize memory management in gtk fonts.
+
+        Release memory allocated by FontPlatformDataGtk in its own
+        destructor instead of doing it from other classes, and add copy
+        constructor and '=' operator to be able to track referenced
+        objects properly.
+
+        * platform/graphics/gtk/FontPlatformData.h:
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformDestroy):
+
+2009-03-17  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Build fix for Qt < 4.5.
+
+        As reported by Yael Aharon  <yael.aharon@nokia.com>
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-03-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24614
+        Access control checks are different in cached and uncached cases
+
+        Test: http/tests/xmlhttprequest/access-control-basic-non-simple-deny-cached.html
+
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::isOnAccessControlSimpleRequestMethodWhitelist): Factored out simple method
+        check for use in both cached and uncached cases. In cached case, an old definition that
+        omitted HEAD was still used.
+        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist): Check that content type has an
+        allowed value. This is needed in all call sites. Also changed to compare MIME type, not
+        content type.
+        (WebCore::isSimpleCrossOriginAccessRequest): Use the above methods.
+
+        * loader/CrossOriginAccessControl.h: Expose isOnAccessControlSimpleRequestMethodWhitelist.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders):
+        Use the new checks for simple method and header.
+
+2009-03-16  Gustavo Noronha Silva  <gns@gnome.org> and Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24638
+        [GTK] HTML5 media tags do not work
+
+        Add a repaint-requested signal to the video sink, and use it to
+        call MediaPlayerPrivate::repaint, so that the video actually
+        plays.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_class_init):
+
+2009-03-16  Gustavo Noronha Silva  <gns@gnome.org> and Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24638
+        [GTK] HTML5 media tags do not work
+
+        Work-around the fact that gst_element_query_duration returns true even
+        though it is unable to figure out the duration when in stream (push)
+        mode.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6642742> Top Sites malfunction when switching text zoom mode
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setNeedsReapplyStyles): Don’t do anything if the frame is
+        currently showing a non-HTML view.
+
+2009-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24629: moving forward or backward a paragraph fails at edge of document
+        https://bugs.webkit.org/show_bug.cgi?id=24629
+        rdar://problem/6544413
+
+        Test: editing/selection/move-paragraph-document-edges.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousParagraphPosition): Use the last result from
+        previousLinePosition rather than going all the way back to what was originally
+        passed in when we hit exception cases like null or not moving. This correctly
+        inherits the behavior of previousLinePosition when we are in a paragraph at the
+        edge of a document.
+        (WebCore::nextParagraphPosition): Ditto.
+
+2009-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24619: RenderObject::selectionStartEnd does not need to be a virtual function
+        https://bugs.webkit.org/show_bug.cgi?id=24619
+
+        * rendering/RenderObject.h: Remove virtual keyword from selectionStartEnd declaration.
+        * rendering/RenderView.h: Ditto.
+
+2009-03-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24368
+        DOM scroll events should be based off the actual number of wheel
+        ticks, not off the number of lines scrolled.  This matches IE.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchWheelEvent):
+        * dom/WheelEvent.cpp:
+        (WebCore::WheelEvent::WheelEvent):
+        * dom/WheelEvent.h:
+        (WebCore::WheelEvent::create):
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::wheelTicksX):
+        (WebCore::PlatformWheelEvent::wheelTicksY):
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/qt/WheelEventQt.cpp:
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+        
+        Clean up a few issues in the Animation code:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        Whitespace
+        
+        (WebCore::AnimationBase::willNeedService):
+        Don't round to float, use std::max
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        Fix erroneously copied line to null out m_lastResponseWaiter.
+
+2009-03-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=13632
+
+        Overflow scrolling needs to account for the bottom/right padding on the object itself as well
+        as for bottom/right margins on children.
+
+        Existing tests cover this.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+
+2009-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6320555>
+        Add an upper limit for setting HTMLSelectElement.length.
+
+        Test: fast/forms/select-max-length.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::setLength):
+
+2009-03-16  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6686721> Media document crash in 64-bit WebKit
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieView): QTMovieContentViewClass is only used when
+        rendering inline with old versions of QuickTime, so don't look for it when we are in a 
+        media document.
+
+2009-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24590
+        Refactor InspectorDOMStorageResource to use ScriptFunctionCall.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added method for bool argument.
+        * bindings/js/ScriptFunctionCall.h: Ditto, also cleaned up.
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject): Added Storage helper.
+        * bindings/js/ScriptObjectQuarantine.h: Ditto.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects): Changed to use bind method.
+        (WebCore::InspectorController::resetScriptObjects): Changed to use unbind method.
+        (WebCore::InspectorController::didUseDOMStorage): Changed to use isSameHostAndType and bind methods.
+        * inspector/InspectorController.h: Removed add/remove methods for DOM storage.
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::isSameHostAndType): Added.
+        (WebCore::InspectorDOMStorageResource::bind): Added.
+        (WebCore::InspectorDOMStorageResource::unbind): Added.
+        * inspector/InspectorDOMStorageResource.h:
+
+2009-03-16   Mike Belshe  <mike@belse.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24580
+        Fix query() to match KURL behavior, this time with the code that
+        compiles.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): Fix copy/paste mistake.
+
+2009-03-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21752
+        REGRESSION: referencing XHR constructor for a not yet loaded frame permanently breaks it
+
+        Test: fast/dom/Window/window-early-properties-xhr.html
+
+        For some transitions, the Window object is not replaced, but Document is. When this happened,
+        window.document property was updated, but references to Document kept in cached constructors
+        were not.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        (WebCore::JSAudioConstructor::document):
+        (WebCore::JSAudioConstructor::mark):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        (WebCore::JSImageConstructor::document):
+        (WebCore::JSImageConstructor::mark):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        (WebCore::JSMessageChannelConstructor::scriptExecutionContext):
+        (WebCore::JSMessageChannelConstructor::mark):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        (WebCore::JSOptionConstructor::document):
+        (WebCore::JSOptionConstructor::mark):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        (WebCore::JSXMLHttpRequestConstructor::scriptExecutionContext):
+        (WebCore::JSXMLHttpRequestConstructor::mark):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        Changed cached constructors to keep a reference to Window, not Document.
+
+2009-03-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24549
+        Impose a limit on Access-Control-Max-Age value
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::CrossOriginPreflightResultCacheItem::parse):
+
+2009-03-15  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/6668875> Normalize Geolocation results
+
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-03-15  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Update ::toString format as suggested by Darin Adler.
+
+        * page/Geoposition.cpp:
+        (WebCore::Geoposition::toString):
+
+2009-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6668238> WebCore is registering text encodings needlessly from KURL constructor.
+
+        Reviewed by Darin Adler.
+
+        Yet another case where we would trigger extended encoding loading needlessly.
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encodingForFormSubmission):
+
+2009-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: no review.
+
+        * rendering/style/ContentData.h:
+
+2009-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 24542: Improve ContentData encapsulation
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24542>
+
+        Reviewed by Simon Fraser.
+
+        No tests since there is no change in behavior.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): Used getter methods
+        instead of data members on ContentData class.  Used isImage()
+        convenience method.
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent): Ditto.
+
+        * rendering/style/ContentData.cpp:
+        (WebCore::ContentData::clear): Extracted code into
+        deleteContent() method.
+        (WebCore::ContentData::dataEquivalent): Added.  Extracted code
+        from StyleRareNonInheritedData::contentDataEquivalent().
+        (WebCore::ContentData::deleteContent): Added.  Used by setter
+        methods.
+        * rendering/style/ContentData.h: Made m_type, m_content and
+        m_next private.
+        (WebCore::ContentData::isCounter): Added.
+        (WebCore::ContentData::isImage): Added.
+        (WebCore::ContentData::isNone): Added.
+        (WebCore::ContentData::isText): Added.
+        (WebCore::ContentData::type): Added.
+        (WebCore::ContentData::dataEquivalent): Added.
+        (WebCore::ContentData::image): Added.
+        (WebCore::ContentData::setImage): Added.
+        (WebCore::ContentData::text): Added.
+        (WebCore::ContentData::setText): Added.
+        (WebCore::ContentData::counter): Added.
+        (WebCore::ContentData::setCounter): Added.
+        (WebCore::ContentData::next): Added.
+        (WebCore::ContentData::setNext): Added.
+
+        * rendering/style/CounterContent.h:
+        (WebCore::operator!=): Removed.
+        (WebCore::operator==): Renamed operator!=() and reversed its
+        logic after extracting code from
+        StyleRareNonInheritedData::contentDataEquivalent() to create
+        ContentData::dataEquivalent().
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setContent): Used new getters and setters
+        on ContentData class.  Changed first argument from a StringImpl*
+        to a PassRefPtr<StrimgImpl>.  Used isText() convenience method.
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::setContent): Updated declaration.
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::contentDataEquivalent):
+        Extracted most logic in while() loop into
+        ContentData::dataEquivalent().
+
+2009-03-15  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24602
+        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
+
+        Reintroduce the URI into the soup message after having set it in
+        the KURL, on redirects, to make sure it is properly encoded. This
+        fixes bad request problems when servers give bad URIs on their
+        response's Location header.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-03-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19737
+        No cursor and paste not enabled right clicking text field/area
+
+        Test: fast/events/right-click-focus.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::handleMousePressEvent):
+        Take normal code path for right clicks (we were taking it for Ctrl-clicks anyway).
+
+2009-03-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23949
+        HTMLSelectElement is in inconsistent state when handling mutation events
+
+        Test: fast/forms/mutation-event-recalc.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::appendChild):
+        Call childrenChanged() before dispatching modification events, not after.
+
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::insertBefore):
+        (WebCore::HTMLOptGroupElement::replaceChild):
+        (WebCore::HTMLOptGroupElement::removeChild):
+        (WebCore::HTMLOptGroupElement::appendChild):
+        (WebCore::HTMLOptGroupElement::removeChildren):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::add):
+        (WebCore::HTMLSelectElement::remove):
+        (WebCore::HTMLSelectElement::insertBefore):
+        (WebCore::HTMLSelectElement::replaceChild):
+        (WebCore::HTMLSelectElement::removeChild):
+        (WebCore::HTMLSelectElement::appendChild):
+        (WebCore::HTMLSelectElement::removeChildren):
+        Remove calls to recalcSelectOptions(). It is too late to recalc now, after mutation events
+        were already dispatched.
+
+2009-03-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        <rdar://problem/6683465>
+
+        Geolocation has to be able to handle NULL Frames.
+
+        Reviewed by Mark Rowe
+    
+2009-03-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Geoposition::toString was missing the Coordinates after the update.
+
+        * page/Geoposition.cpp:
+        (WebCore::Geoposition::toString):
+
+2009-03-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Build fix - pass a Coordinate to Geoposition::create
+        https://bugs.webkit.org/show_bug.cgi?id=24603
+
+        Gtk build fix per r41650
+        https://bugs.webkit.org/show_bug.cgi?id=24506
+        Geolocation in Safari differs from the spec, no Coordinates attribute on Position
+
+        Pass a Coordinate to Geoposition::create.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::updatePosition):
+
+2009-03-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24545
+        Make cross-site XHR simple request definition match current spec draft
+
+        Tests: http/tests/xmlhttprequest/access-control-basic-post-fail-non-simple-content-type.html
+               http/tests/xmlhttprequest/access-control-basic-whitelist-request-headers.html
+
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist): Added Content-Language.
+        (WebCore::isSimpleCrossOriginAccessRequest): Added HEAD. Restricted content types to those
+        that could be sent via form submission.
+
+2009-03-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15172
+        object fallback - empty string for first argument of setAttributeNS does not work like null
+
+        https://bugs.webkit.org/show_bug.cgi?id=24548
+        createElementNS("", name) should create an element in null namespace
+
+        Tests: fast/dom/createElementNS-empty-namespace.html
+               fast/dom/setAttributeNS-empty-namespace.html
+
+        * dom/QualifiedName.h: (WebCore::QualifiedName::QualifiedNameImpl::QualifiedNameImpl):
+        Convert empty namespaces to null.
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Take advantage of the ability of recent versions of Xcode to easily switch the active
+        architecture.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2009-03-13  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24593
+        Added requestorID so we can track the request to its WebView without using frame (which was removed).
+
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::requestorID):
+        (WebCore::ResourceRequest::setRequestorID):
+        (WebCore::ResourceRequest::setTargetType):
+        (WebCore::ResourceRequest::policyURL):
+        (WebCore::ResourceRequest::setPolicyURL):
+        (WebCore::ResourceRequest::requestorPid):
+        (WebCore::ResourceRequest::setRequestorPid):
+
+2009-03-13  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24561
+        Add custom V8 bindings for HTMLElementCanvas, Location.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp: Added.
+        * bindings/v8/custom/V8LocationCustom.cpp: Added.
+
+2009-03-13  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24584
+
+        Fix transparent text rendering on Chromium.  FontChromiumWin
+        was calling beginTransparencyLayer()/endTransparencyLayer(), with
+        a TransparencyWin inside to do GDI ClearType rendering over an
+        opaque background.  TransparencyWin does its special sauce
+        in the destructor, but it was being called too late to be used
+        correctly in the layer.  Put the special sauce into a new function,
+        composite(), and call that explicitly instead.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::~TransparencyWin):
+        (WebCore::TransparencyWin::composite):
+        (WebCore::TransparencyWin::init):
+        * platform/graphics/chromium/TransparencyWin.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+
+2009-03-13  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24562
+        Add custom implementation for getCSSCanvasContext to V8 bindings.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp: Added new method.
+
+2009-03-13  Mike Belshe  <mike@belse.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24580
+        Fix query() to match KURL behavior.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): remove extra logic around question mark.
+
+2009-03-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 24474: AX: in multi-body tables, asking for a cell at a specific coordinate can return nil
+        https://bugs.webkit.org/show_bug.cgi?id=24474
+
+        Test: platform/mac-snowleopard/accessibility/table-multi-bodies.html
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24589
+        Upstream changes to V8 event listeners (Chromium r11133) in order to
+        fix worker functionality break in Chromium.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+
+2009-03-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24524
+        Introduce ScriptObject and ScriptFunctionCall abstractions.
+
+        * GNUmakefile.am: Added ScriptObject and ScriptFunctionCall to project.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * bindings/js/ScriptFunctionCall.cpp: Added.
+        * bindings/js/ScriptFunctionCall.h: Added.
+        * bindings/js/ScriptObject.cpp: Added.
+        * bindings/js/ScriptObject.h: Added.
+        * bindings/js/ScriptObjectQuarantine.cpp: Added.
+        * bindings/js/ScriptObjectQuarantine.h: Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects): Changed to use InspectorDatabaseResource::bind.
+        (WebCore::InspectorController::resetScriptObjects): Changed to use InspectorDatabaseResource::unbind.
+        (WebCore::InspectorController::didOpenDatabase): Changed to use InspectorDatabaseResource::unbind.
+        * inspector/InspectorController.h: Removed addScriptDatabaseResource and
+        removeScriptDatabaseResource declarations.
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind): Added.
+        (WebCore::InspectorDatabaseResource::unbind): Added.
+        * inspector/InspectorDatabaseResource.h: Added bind and unbind declarations.
+
+2009-03-13  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24467
+        Make Skia drawRect() and stroke behavior match CG.
+
+        This makes drawRect() ignore the stroke width (like CG does), and
+        adds a warning comment about that to the appropriate header.
+
+        It also eliminates some hacky code in Skia's stroke preparation,
+        which tried to adjust odd-width strokes to fall on pixel boundaries.
+        Not only did this not match CG, it wouldn't necessarily work right,
+        because there could be other transforms (e.g. full-page zoom) that
+        would affect the stroke before it reached the device pixel level.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24583
+        Need to change scope of constructor and destructor of V8ObjectEventListener from private
+        to protected so that they could be used in its derived class V8WorkerContextEventListener.
+
+        * bindings/v8/V8ObjectEventListener.h:
+
+2009-03-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24579
+        Many V8*Event* files are misplaced.
+
+        This code is infrastructure for supporting the bindings and thus should
+        be in the bindings/v8 directory.
+
+        * bindings/v8/V8AbstractEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8AbstractEventListener.cpp.
+        * bindings/v8/V8AbstractEventListener.h: Renamed from WebCore/bindings/v8/custom/V8AbstractEventListener.h.
+        * bindings/v8/V8LazyEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8LazyEventListener.cpp.
+        * bindings/v8/V8LazyEventListener.h: Renamed from WebCore/bindings/v8/custom/V8LazyEventListener.h.
+        * bindings/v8/V8ObjectEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8ObjectEventListener.cpp.
+        * bindings/v8/V8ObjectEventListener.h: Renamed from WebCore/bindings/v8/custom/V8ObjectEventListener.h.
+        * bindings/v8/V8WorkerContextEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8WorkerContextEventListener.cpp.
+        * bindings/v8/V8WorkerContextEventListener.h: Renamed from WebCore/bindings/v8/custom/V8WorkerContextEventListener.h.
+
+2009-03-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Fix for <rdar://problem/5089327> Color of quoted content is wrong when pasted inside other quoted content
+
+        Test: editing/pasteboard/5089327.html
+
+        Handle spans being pasted within a quoted region in the same way we handle "paste as quotation" content.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::handleStyleSpansBeforeInsertion):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+
+2009-03-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Update Geolocation perimission dialogs to be asynchronous.
+        https://bugs.webkit.org/show_bug.cgi?id=24505
+
+        Geolocation now requests permission from the Chrome asynchronously.
+        The Chrome is passed the Geolocation object, and the Chrome sets the permission
+        on the Geolocation. Geolocation also tracks if the Chrome should clear its cache
+        of SecurityOrigins with geolocation permission. This is so that the GeolocationService
+        can inform the Chrome of its request, and the Chrome is also free to implement its
+        own policy.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::requestGeolocationPermissionForFrame):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::requestGeolocationPermissionForFrame):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::setIsAllowed):
+        (WebCore::Geolocation::displayChallengeIfNecessary):
+        (WebCore::Geolocation::geolocationServicePositionChanged):
+        * page/Geolocation.h:
+        (WebCore::Geolocation::isAllowed):
+        (WebCore::Geolocation::setShouldClearCache):
+        (WebCore::Geolocation::shouldClearCache):
+        (WebCore::Geolocation::):
+
+2009-03-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6610666> Revise the Cocoa event model text API
+        
+        Add a NPCocoaEventTextInput event type. Remove the text input variables.
+        
+        * bridge/npapi.h:
+        (_NPCocoaEvent::):
+
+2009-03-13  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders.
+
+        <rdar://problem/6630340> REGRESSION (39114-39115): Unity Web Player no longer works if Flip4Mac is also installed
+        
+        The code assumed if we have a plug-in that supports "application/x-oleobject" we should always prefer the object tag
+        over of an embed tag. That assumption can cause the Mac platform to load the wrong plug-in, as Flip4Mac claims supports
+        for x-oleobject.
+        
+        * rendering/RenderPartObject.cpp:
+        (WebCore::shouldUseEmbedDescendant): Made the Mac platform always return true here. 
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24559
+        Need to port JSC fix (r41565) to V8 in order to fix layout test onload-single-line-comment.html.
+
+        * bindings/v8/custom/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24557
+        This is to support running multiple workers in a single worker process in chromium.
+
+        * bindings/v8/custom/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        Add locker to v8 event listener of worker context.
+
+2009-03-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24575
+        XHR response is incorrect after a network error.
+
+        Tests: http/tests/xmlhttprequest/cross-site-denied-response-sync-2.html
+               http/tests/xmlhttprequest/cross-site-denied-response-sync.html
+               http/tests/xmlhttprequest/cross-site-denied-response.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::networkError): Call internalAbort() to fully reset the request.
+        (WebCore::XMLHttpRequest::didFailRedirectCheck): No need to call internalAbort() here. Note
+        that since internalAbort() can drop GC protection, it is not safe to use the object after
+        this call.
+        (WebCore::XMLHttpRequest::didReceiveData): Check that the request wasn't aborted, and
+        return early if it was. This can happen during sync requests, as the loader does not know
+        that it was aborted, and just synthesizes all callbacks.
+
+2009-03-13  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=3547
+        XMLHttpRequest.statusText returns always "OK"
+
+        Covered by existing tests (which now pass on all platforms but Mac).
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::statusText): Return ResourceResponse status text. It is now up
+        to each platform to correctly set the status text or set it to "OK" to retain current
+        behavior.
+
+2009-03-13  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24349
+        [QT] HTTP status text is never set
+
+        Set HTTP status text to the reason phrase attribute of QNetworkReply.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-03-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        <rdar://problem/6622300>: Reproducible crash on
+        <http://www.editgrid.com/explore/tnc/dave/FusionChart%3A_Candlestick>
+        
+        Prevent CSSStyleSheet::checkLoaded() writing to freed memory when it gets
+        deleted from under itself. The sheetLoaded() notification can allow scripts
+        to run via HTMLTokenizer::executeScriptsWaitingForStylesheets(),
+        which can cause the last ref to the CSSStyleSheet to be released.
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::checkLoaded):
+
+2009-03-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Allow make-generated-sources.sh to pass args down to DerivedSources.make
+
+        * make-generated-sources.sh:
+
+2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24498
+        Fix the Qt port to use the same algorithm for drawing dashed and dotted
+        borders as the other ports.  This makes the Qt port pixel-for-pixel perfect
+        compared to border drawing with Apple's canonical mac port and much closer
+        to konqueror and firefox behavior.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-02-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Clean up DOMSelection to use some helper functions
+        making the code smaller, and less error-prone.
+        https://bugs.webkit.org/show_bug.cgi?id=19221
+
+        I tried moving DOMSelection off of rangeCompliantEquivalent
+        but failed.  VisibleSelection holds positions like (table, 1) to mean
+        "after the table".
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::visibleSelection):
+        (WebCore::anchorPosition):
+        (WebCore::focusPosition):
+        (WebCore::basePosition):
+        (WebCore::extentPosition):
+        (WebCore::DOMSelection::anchorNode):
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusNode):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseNode):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentNode):
+        (WebCore::DOMSelection::extentOffset):
+        * page/DOMSelection.h:
+
+2009-03-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24563
+        Change ResourceRequest to be a struct rather then a class to match other declarations.
+
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-03-12  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 24530: width100percent-searchfield.html should be fixed for chromium.
+        <https://bugs.webkit.org/show_bug.cgi?id=24530>
+
+        Compensate for r39924 in chromium, which broke LayoutTests/fast/replaced/width100percent-searchfield.html
+
+        * css/themeChromiumWin.css: Added.
+        Overrides the changes to start supporting input[type="search"] on Windows (since
+        Chromium doesn't do anything special for this).
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeChromiumWin::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumWin::determineState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-03-12  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24506
+        Geolocation in Safari differs from the spec, no Coordinates attribute on Position
+        
+        Get up to date.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        * page/Coordinates.cpp: Added.
+        (WebCore::Coordinates::toString):
+        * page/Coordinates.h: Added.
+        (WebCore::Coordinates::create):
+        (WebCore::Coordinates::latitude):
+        (WebCore::Coordinates::longitude):
+        (WebCore::Coordinates::altitude):
+        (WebCore::Coordinates::accuracy):
+        (WebCore::Coordinates::altitudeAccuracy):
+        (WebCore::Coordinates::heading):
+        (WebCore::Coordinates::speed):
+        (WebCore::Coordinates::Coordinates):
+        * page/Coordinates.idl: Added.
+        * page/Geoposition.cpp:
+        (WebCore::Geoposition::toString):
+        * page/Geoposition.h:
+        (WebCore::Geoposition::create):
+        (WebCore::Geoposition::coords):
+        (WebCore::Geoposition::Geoposition):
+        * page/Geoposition.idl:
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create):
+        (WebCore::PositionOptions::maximumAge):
+        (WebCore::PositionOptions::setMaximumAge):
+        (WebCore::PositionOptions::PositionOptions):
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24496
+        Fix console logging of non-string values by coercing the argument to
+        a string, for V8 bindings.
+
+        Test: fast/js/console-non-string-values.html
+
+        * bindings/v8/ScriptValue.cpp: Added toString method.
+        (WebCore::ScriptValue::toString):
+        * bindings/v8/ScriptValue.h: Added PlatformString, ScriptState includes
+            and toString declaration.
+
+2009-03-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Eliminate ChromiumBridge::uiResourceProtocol
+        https://bugs.webkit.org/show_bug.cgi?id=24558
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-03-12  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missing breaks in switch statement
+        https://bugs.webkit.org/show_bug.cgi?id=24556
+
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didFailWithError:]):
+
+2009-03-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24554
+        Remove some unused functions from ChromiumBridge.
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-03-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Fisher and Justin Garcia.
+
+        Safari crashes during drag and drop in Google presentations
+        due to mutation event handlers removing DOM content during insertNode
+        https://bugs.webkit.org/show_bug.cgi?id=22634
+
+        Added a bunch of "null" checks to make sure nodes are still
+        in the document before we operate on them.  This is an
+        inelegant solution, but it's the best we have for now.
+        
+        Test: editing/selection/crash-on-drag-with-mutation-events.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24525
+        REGRESSION: Inspector window doesn't close when inspected page is
+        destroyed. This is a revert of r41158, which became unnecessary when
+        InspectorController became ref-counted in r41462.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed): Reset m_inspectedPage
+            after calling close().
+        (WebCore::InspectorController::stopUserInitiatedProfiling): Remove
+            m_inspectedPage check guard around profile logic.
+
+2009-03-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24502
+        Make horizontal scrolling on Windows always go the correct direction.
+
+        * platform/PlatformWheelEvent.h:
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24496
+        Fix console logging of non-string values by coercing the argument to
+        a string.
+
+        Test: fast/js/console-non-string-values.html
+
+        * bindings/js/ScriptValue.cpp: Removed PlatformString include.
+        * bindings/js/ScriptValue.h: Added toString method.
+        (WebCore::ScriptValue::toString):
+        * page/Console.cpp:
+        (WebCore::getFirstArgumentAsString): Changed firstArgumentAsString method to use
+            ScriptValue::toString.
+        (WebCore::Console::addMessage): added extra ScriptState argument to callsite.
+        (WebCore::Console::count): Ditto.
+
+2009-03-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24508
+        
+        Fix updating of text field with placeholder text when value is set
+        by ensuring that updatePlaceholderVisibility() is called after
+        the value has been updated, not before.
+
+        Test: fast/forms/placeholder-set-value.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue):
+
+2009-03-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24552
+        
+        Hit testing involving normal flow, self-painting layers (e.g. reflections)
+        was broken because it was not null-testing the result of hitTestLayer(),
+        so bailing early with a nil hit layer.
+
+        Test: fast/layers/normal-flow-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Removed zero-sized files, left over from improperly applied patch.
+
+        * platform/graphics/chromium/ThemeHelperChromiumWin.cpp: Removed.
+        * platform/graphics/chromium/ThemeHelperChromiumWin.h: Removed.
+
+2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Do not ignore alpha color in optimization.  Hard to believe, but there
+        are websites that fill the entire page with a tiled image consisting of
+        nothing but a 100% transparent 1x1 image. <cough>orbitz.com</cough>
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 24110: cloneNode should call cloneElement and not the reverse
+
+        - Splitted the code from cloneNode into cloneElementWithChildren and cloneElementWithChildren.
+          Now cloneNode calls one of the 2 previous methods.
+
+        - Renamed cloneElement to cloneElementWithoutChildren as it was the previous behaviour.
+
+        - Moved cloneNode to the Element private section so that WebCore callers cannot use it.
+
+        - Removed Element::cloneNode usage through WebCore.
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneNode): Moved to Element's private section and it
+        now calls the two next methods.
+        (WebCore::Element::cloneElementWithChildren): Added.
+        (WebCore::Element::cloneElementWithoutChildren): Renamed from cloneElement
+        to avoid ambiguity.
+        * dom/Element.h:
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Changed call to cloneElement
+        to call to cloneElementWithoutChildren.
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Ditto.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Ditto.
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply): Ditto.
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::IncreaseSelectionListLevelCommand::doApply): Ditto.
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::doApply): Ditto.
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromText): Ditto.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree): Ditto.
+
+2009-03-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a crash on the 1x1 pixel check for background image in gtk.
+        We need to load the image first and need to be sure that the image
+        is not null before checking the type. 
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24544
+        Rename setUrl to setURL
+
+        Use proper case for setUrl method, rename it to setURL.
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback):
+        (WebCore::headerCallback):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        (WebCore::queryInfoCallback):
+
+2009-03-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24519
+        [GTK] Use two argument KURL ctor in ResourceHandleSoup
+
+        Use two argument KURL ctor, the single argument ctor expects its
+        input to be the output of a previous KURL::parse call, which is
+        not the case here.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        (WebCore::queryInfoCallback):
+
+2009-03-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix for <rdar://6418681>
+        https://bugs.webkit.org/show_bug.cgi?id=22644
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted): Add the Citrix ICA
+        Client plug-in to the blacklist; it requires a Mozilla-based browser.
+
+2009-03-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        build fix.
+
+        * html/CanvasRenderingContext2D.h:
+
+2009-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6673852> Widget "Simple World Clock" does not display with Safari 4
+
+        A number of dashboard widgets rely on canvas failing silently when given invalid
+        colors for gradient stops, but both the spec and firefox throw exceptions here.
+        So we work around this by creating a dashboard quirk that will only suppress the
+        exception in dashboard compatibility mode.
+
+        Test: fast/canvas/canvas-gradient-addStop-error.html
+
+        * html/CanvasGradient.cpp:
+        (WebCore::CanvasGradient::CanvasGradient):
+        (WebCore::CanvasGradient::addColorStop):
+        * html/CanvasGradient.h:
+        (WebCore::CanvasGradient::setDashboardCompatibilityMode):
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
+        (WebCore::CanvasRenderingContext2D::createLinearGradient):
+        (WebCore::CanvasRenderingContext2D::createRadialGradient):
+        * html/CanvasRenderingContext2D.h:
+
+2009-03-11  David Kilzer  <ddkilzer@apple.com>
+
+        Clarify comments regarding order of FEATURE_DEFINES
+
+        Rubber-stamped by Mark Rowe.
+
+        * Configurations/WebCore.xcconfig: Added warning about the
+        consequences when FEATURE_DEFINES are not kept in sync.
+
+2009-03-11  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24515
+        [GTK] soup backend should use GMappedFile instead of mmap directly
+
+        Rewrite mmap code used to upload files to use GMappedFile, so that
+        it is platform-independent.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-03-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - WebCore part of fixing <rdar://problem/3919124> Thai text selection
+          in Safari is incorrect
+
+        Test: platform/mac/editing/selection/word-thai.html
+
+        Tested on Mac, but should work on all ICU platforms (or more precisely
+        on all platforms that implement
+        WTF::Unicode::hasLineBreakingPropertyComplexContext() correctly).
+
+        * editing/TextIterator.cpp:
+        (WebCore::BackwardsCharacterIterator::BackwardsCharacterIterator):
+        Added.
+        (WebCore::BackwardsCharacterIterator::range): Added.
+        (WebCore::BackwardsCharacterIterator::advance): Added.
+
+        * editing/TextIterator.h: Added BackwardsCharacterIterator with the
+        minimal functionality required for this patch.
+        (WebCore::BackwardsCharacterIterator::atEnd): Added.
+
+        * editing/visible_units.cpp:
+        (WebCore::firstNonComplexContextLineBreak): Added this helper function
+        that returns the index of the first character in the string whose
+        Unicode line breaking property value is not SA ("Complex Context"), or
+        the length of the string if there is no such character.
+        (WebCore::lastNonComplexContextLineBreak): Added this helper function
+        that returns the index of the last character in the string whose
+        Unicode line breaking property value is not SA ("Complex Context"), or
+        -1 if there is no such character.
+        (WebCore::previousBoundary): Changed the signature of the search
+        function to include an offset parameter. Renamed the 'exception' local
+        variable to 'ec' and changed its type to ExceptionCode. Extend the
+        string forwards until the first character with Unicode line breaking
+        property value other than SA. This gives the boundary search function
+        enough context in the forward direction. Changed to use a
+        BackwardsCharacterIterator for translating the backwards offset into
+        a position.
+        (WebCore::nextBoundary): Changed the signature of the search
+        function to include an offset parameter. Extend the string backwards
+        until the first character with Unicode line breaking property value
+        other than SA. This gives the boundary search function enough context in
+        the backwards direction. Restricted the workaround for <rdar://5192593>
+        only to the line break case, because it was causing an extra character
+        to be selected following a word that ended with a combining mark.
+        (WebCore::startWordBoundary): Added an offset parameter. Check that
+        going backwards from the given offset, there is a character with Unicode
+        line breaking property value other than SA, and otherwise return 0 to
+        request more context.
+        (WebCore::endWordBoundary): Similar, but in reverse.
+        (WebCore::previousWordPositionBoundary): Similar.
+        (WebCore::nextWordPositionBoundary): Similar.
+        (WebCore::startSentenceBoundary): Updated for the new search function
+        signature.
+        (WebCore::endSentenceBoundary): Ditto.
+        (WebCore::previousSentencePositionBoundary): Ditto.
+        (WebCore::nextSentencePositionBoundary): Ditto.
+
+2009-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Don't use "::" in thread names because it is ugly!
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open): Use "WebCore: " instead of "WebCore::".
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::loaderRunLoop): Call this "WebCore: CFNetwork Loader" to make
+        it clear this is a WebCore-created thread.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start): Use "WebCore: " instead of "WebCore::".
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start): Use "WebCore: " instead of "WebCore::".
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start): Use "WebCore: " instead of "WebCore::".
+
+2009-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6653286> WebCore's implementation of screenIsMonochrome is needlessly complex
+
+        * platform/mac/PlatformScreenMac.mm:
+        (WebCore::screenIsMonochrome): Return false.
+
+2009-03-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=14749 percentage 
+        top value on position:relative child not calculated correctly if 
+        parent has percentage height
+        - and corresponding -
+        <rdar://problem/6172925>
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+
+2009-03-11  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement ScriptValue::hasNoValue for V8.
+        https://bugs.webkit.org/show_bug.cgi?id=24507
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::hasNoValue):
+
+2009-03-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 24459: Add v8 bindings for event.
+        <https://bugs.webkit.org/show_bug.cgi?id=24459>
+
+        Adding custom event bindings.
+
+        * bindings/v8/custom/V8AbstractEventListener.cpp: Added.
+        * bindings/v8/custom/V8AbstractEventListener.h: Added.
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        Fixed messed up copyright header.
+        * bindings/v8/custom/V8CustomEventListener.cpp: Added.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        Replaced forwarding header with the real implementation.
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8LazyEventListener.cpp: Added.
+        * bindings/v8/custom/V8LazyEventListener.h: Added.
+        * bindings/v8/custom/V8ObjectEventListener.cpp: Added.
+        * bindings/v8/custom/V8ObjectEventListener.h: Added.
+        * bindings/v8/custom/V8WorkerContextEventListener.cpp: Added.
+        * bindings/v8/custom/V8WorkerContextEventListener.h: Added.
+
+2009-03-11  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24521
+        Add some missing includes for the non-JSC build.
+
+        * platform/text/PlatformString.h: added OwnPtr.h
+        * xml/XMLHttpRequest.cpp: added SecurityOrigin.h
+
+2009-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24531
+        
+        Make sure that AnimationControllerPrivate::getAnimatedStyleForRenderer() never
+        returns a null style if it has a valid renderer, which could happen if a
+        CompositeAnimation existed, but wasn't running any animations or transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
+
+2009-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Scons build. Patch from Alexander Guy.
+
+        * WebCore.scons:
+
+2009-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+       
+        https://bugs.webkit.org/show_bug.cgi?id=23093
+        
+        When the cancel button in the search field is shown or hidden,
+        we need to explicitly setStyle() on the cancel button's renderer,
+        to ensure that repaint happens. Changing the style without telling
+        the renderer won't work.
+
+        Test: fast/repaint/search-field-cancel.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
+        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
+        (WebCore::RenderTextControlSingleLine::visibilityForCancelButton):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-03-11  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15790
+        Ligatures aren't accounted for when manipulating VisiblePositions
+
+        Changed cursorMovementIterator rules to prevent a cursor from moving in the middle of an
+        Indic ligature which uses a virama sign.
+        
+        Test: editing/deleting/skip-virama-001.html
+
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::cursorMovementIterator):
+
+2009-03-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24513
+        REGRESSION: Cursor movement doesn't work on Tiger (ICU 3.2)
+
+        Fixes existing tests on Tiger.
+
+        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator):
+        Use characterBreakIterator on Tiger (like we used to do).
+
+2009-03-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/4072827> Downloaded non-ASCII file name becomes garbled
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Correct selector name
+        in instancesRespondToSelector.
+
+2009-03-11  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK]DumpRenderTree doesn't compile for non-X11 GTK ports anymore
+        https://bugs.webkit.org/show_bug.cgi?id=2260
+
+        Add missing stdio.h include to get the build going
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+
+2009-03-10  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Ken Kocienda.
+
+        * dom/Range.cpp:
+        (WebCore::Range::addLineBoxRects): If the range ended at [div, 0], addLineBoxRects
+        would include rects for the divs contents.  Set the correct RenderObject to stop at.
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6123770> Restrict access to document.cookie when making a cross-site XHR
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::responseXML): Removed an incorrect
+        comment about cookie support. Firefox doesn't expose cookies on responseXML at all, and
+        there are security concerns with exposing them for cross-origin requests, so it's not clear
+        if we want to change anything here.
+
+2009-03-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24503
+        
+        Fix hit testing of absolutely positioned single line text controls by
+        ensuring that we set result.innerNode() correctly. If the hit node is
+        a descendant of the inner text element or if it is the <input> itself,
+        then we say we hit the innerTextElement.
+        
+        Rename hitInnerTextBlock() to hitInnerTextElement() to match the
+        'innerTextElement' terminology used elsewhere.
+        
+        Assert that if renderer()->hitTest() returns false, no-one set
+        result.innerNode().
+
+        Test: fast/forms/search-abs-pos-cancel-button.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestContents):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::hitInnerTextElement):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+
+2009-03-10  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6668238> WebCore is registering text encodings needlessly from KURL constructor.
+        
+        Another case where we would trigger extended encoding loading needlessly.
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::isNonByteBasedEncoding):
+
+2009-03-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6624769> REGRESSION (Safari 4 PB): No 
+        scroll bar appears for long line of text with NOWRAP set
+
+        This is a regression from http://trac.webkit.org/changeset/32226
+        I talked with Dan about the original change, and we decided that 
+        the best fix was to remove his small potential-optimization that 
+        only created a separate line box for whitespace under certain 
+        circumstances. This new code will always create a separate line 
+        box.
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-03-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6166844>
+        https://bugs.webkit.org/show_bug.cgi?id=24495
+
+        Use same rule for loading java applets as we do for images.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget):
+
+2009-03-10  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Get rid of revealCaret and use revealSelection instead.
+
+        * WebCore.base.exp:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+        * page/Frame.h:
+
+2009-03-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23736: WebKit Crashes on http://g-conquest.fr/~server2
+        <https://bugs.webkit.org/show_bug.cgi?id=23736>
+        <rdar://problem/6560278>
+
+        Before replacing the document, FrameLoader::executeIfJavaScriptURL()
+        should call stopAllLoaders(), just like continueLoadAfterNavigationPolicy().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+
+2009-03-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24494: crash when deleting at end of document and merging paragraphs
+        https://bugs.webkit.org/show_bug.cgi?id=24494
+        rdar://problem/6571537
+
+        Test: editing/deleting/merge-at-end-of-document.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::compareBoundaryPoints): Split out assertion. It's better not to
+        use && in assertions since we'd like to know which condition is failing.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange): Added a null check before
+        calling compareBoundaryPoints, since a 0 for the node is ambiguous and so the
+        function doesn't know which value to return.
+
+2009-03-10  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel. Math checked by Oliver Hunt.
+
+        Implement the Cairo version of the checkForSolidColor() method. This halfes the
+        time to draw on 1x1 px background images.
+        I added two new calls to Color for the pixel manipulation on cairo_surface's.
+        They are neede to premultiply/unpremultiply the colors of the surface.
+
+        [CAIRO] Introduce single-pixel image optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=17284
+
+        * platform/graphics/Color.cpp:
+        (WebCore::colorFromPremultipliedARGB):
+        (WebCore::premultipliedARGBFromColor):
+        * platform/graphics/Color.h:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24437
+
+        Add support for registering noAccess URL schemes:
+        1-  Add FrameLoader::registerURLSchemeAsNoAccess, and have SecurityOrigin check
+        that list upon construction (similar to how isLocal is implemented).
+        2-  Make InspectorController call grantUniversalAccess on its Document's
+        SecurityOrigin at the time when windowScriptObjectAvailable is called.
+
+        This enables content such as the inspector to be loaded from a custom (non-file)
+        URL, which is how Chromium loads the inspector.  It also allows other URL schemes
+        to be treated like data: URLs, which Chromium utilizes for its various HTML-based
+        UI panels.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * loader/FrameLoader.cpp:
+        (WebCore::localSchemes):
+        (WebCore::noAccessSchemes):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::isLocal):
+
+2009-03-10  Xan Lopez  <xlopez@igalia.com>
+
+        Build fix, no review
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+
+2009-03-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24491
+        Rename posOffset to m_offset, get rid of accessor
+
+        As suggested in dom/Position.h, this patch gets rid of the
+        'offset()' accessor and renames posOffset to m_offset. I've used
+        m_offset instead of offset to follow the style guide lines, since
+        Position is still a class and not a structure. If the long term
+        plan is still to make it a structure it would be pretty easy to
+        just s/m_offset/offset/ globally when that is achieved.
+
+        * dom/Position.cpp:
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::atStart):
+        (WebCore::Position::atEnd):
+        (WebCore::Position::renderedOffset):
+        (WebCore::Position::isCandidate):
+        (WebCore::Position::inRenderedText):
+        (WebCore::Position::isRenderedCharacter):
+        (WebCore::Position::rendersInDifferentPosition):
+        (WebCore::Position::leadingWhitespacePosition):
+        (WebCore::Position::debugPosition):
+        (WebCore::Position::formatForDebugger):
+        * dom/Position.h:
+        (WebCore::Position::Position):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        * dom/Range.cpp:
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::position):
+        (WebCore::RangeBoundaryPoint::set):
+        (WebCore::RangeBoundaryPoint::setOffset):
+        (WebCore::RangeBoundaryPoint::setToChild):
+        (WebCore::RangeBoundaryPoint::setToStart):
+        (WebCore::RangeBoundaryPoint::setToEnd):
+        (WebCore::RangeBoundaryPoint::childBeforeWillBeRemoved):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        (WebCore::ApplyStyleCommand::splitTextAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::mergeStartWithPreviousIfIdentical):
+        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
+        (WebCore::ApplyStyleCommand::joinChildTextNodes):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit):
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::removePlaceholderAt):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::updatePositionForNodeRemoval):
+        (WebCore::updatePositionForTextRemoval):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::fixupWhitespace):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setComposition):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::getCompositionSelection):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::debugRenderer):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+        (WebCore::VisiblePosition::debugPosition):
+        (WebCore::makeRange):
+        (WebCore::setStart):
+        (WebCore::setEnd):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        (WebCore::makeSearchRange):
+        (WebCore::VisibleSelection::debugPosition):
+        (WebCore::VisibleSelection::showTreeForThis):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::isFirstPositionAfterTable):
+        (WebCore::isLastPositionBeforeTable):
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::nextBoundary):
+        (WebCore::startPositionForLine):
+        (WebCore::startOfLine):
+        (WebCore::endPositionForLine):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        * page/AccessibilityObject.cpp:
+        (WebCore::updateAXLineStartForVisiblePosition):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::extentOffset):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::indexForVisiblePosition):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeSelection):
+
+2009-03-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23564: REGRESSION (r39230-39286): crash loading page that changes <input> display type and then calls innerHTML
+        https://bugs.webkit.org/show_bug.cgi?id=23564
+        rdar://problem/6537238
+
+        Test: fast/dom/HTMLElement/innerHTML-selection-crash.html
+
+        * editing/markup.cpp: (WebCore::createMarkup): Added updateLayoutIgnorePendingStylesheets
+        call to the one of the two overloads of this function that wasn't calling it. This fixes
+        this crash and other possible crashes inside innerHTML.
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24285
+        Text resource loading checks for BOM twice
+
+        This removes TextDecoder class, since its only purpose was to check for BOM, which is
+        already done in TextResourceDecoder. Callers that use TextEncoding::decode() won't get
+        BOM checked, but I didn't find any cases where it would significantly change behavior.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Remove TextDecoder.{h,cpp}.
+
+        * platform/text/TextDecoder.cpp: Removed.
+        * platform/text/TextDecoder.h: Removed.
+
+        * loader/TextResourceDecoder.h: Instead of a TextDecoder object, keep TextEncoding and
+        TextCodec separately.
+
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::TextResourceDecoder): Updated for m_encoding being a member.
+        (WebCore::TextResourceDecoder::setEncoding): Ditto.
+        (WebCore::TextResourceDecoder::checkForBOM): Removed a FIXME saying that a BOM could override
+        even a user-chosen encoding - this is how it already worked due to TextDecoder checking for
+        BOM again. Made this function return the detected BOM length.
+        (WebCore::TextResourceDecoder::decode): Skip the BOM if it was found at the beginning of
+        a text resource.
+        (WebCore::TextResourceDecoder::flush): Reset m_checkedForBOM, so that re-decoding the same
+        resource again (as frequently done by CachedResource subclasses) will skip the BOM correctly.
+
+        * platform/text/TextEncoding.cpp: (WebCore::TextEncoding::decode):
+        Use TextCodec directly without a TextDecoder wrapper. This means that this method no longer
+        checks for BOM, which was a counter-intuitive feature.
+
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::CachedScript):
+        (WebCore::CachedScript::setEncoding):
+        (WebCore::CachedScript::encoding):
+        (WebCore::CachedScript::script):
+        * loader/CachedScript.h:
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        Use TextResourceDecoder, as TextEncoding::decode() no longer checks for BOM.
+        A side effect of this is that these resources will now be subject to encoding auto-detection.
+
+        * loader/CachedFont.cpp: (WebCore::CachedFont::ensureSVGFontData):
+        * page/Page.cpp: (WebCore::Page::userStyleSheet):
+        Be sure to flush TextResourceDecoder, pushing any remaining bytes out, and making the decoder
+        re-usable (for repeated decoding of the same resource).
+
+        * platform/text/TextEncodingRegistry.h: Updated comments for newTextCodec().
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24488
+        An assertion failure when updating an offline application cache after emptying caches
+
+        Emptying appcache cannot be performed automatically, so no test.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Ensure that the cache is in disk
+        storage, even if the application wasn't updated server side.
+
+2009-03-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/6425807> Implement WorkerUtils.importScripts()
+        <https://bugs.webkit.org/show_bug.cgi?id=22721>
+
+        Implement importScripts, currently uses a series of synchronous loads
+        to fetch the scripts, but this is simpler than a synchronous load of
+        multiple loads in parallel.  In future we'll want to switch to parallel
+        loading, but this will do for now.
+        
+        Test: http/tests/workers/worker-importScripts.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::importScripts):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::hasNoValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::setException):
+        * bindings/js/WorkerScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::scriptImported):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptImported):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::setScriptProperties):
+        * inspector/InspectorResource.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::scriptImported):
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerImportScriptsClient.cpp: Added.
+        (WebCore::WorkerImportScriptsClient::didReceiveResponse):
+        (WebCore::WorkerImportScriptsClient::didReceiveData):
+        (WebCore::WorkerImportScriptsClient::didFinishLoading):
+        (WebCore::WorkerImportScriptsClient::didFail):
+        (WebCore::WorkerImportScriptsClient::didFailRedirectCheck):
+        (WebCore::WorkerImportScriptsClient::didReceiveAuthenticationCancellation):
+        * workers/WorkerImportScriptsClient.h: Added.
+        (WebCore::WorkerImportScriptsClient::WorkerImportScriptsClient):
+        (WebCore::WorkerImportScriptsClient::script):
+        (WebCore::WorkerImportScriptsClient::failed):
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24462
+        Move cross-origin access control code out of XMLHttpRequest
+
+        Step 1: move preflight result cache and access control helper functions.
+
+        No change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/CrossOriginAccessControl.cpp: Added.
+        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist):
+        (WebCore::isSimpleCrossOriginAccessRequest):
+        (WebCore::createAllowedCrossOriginResponseHeadersSet):
+        (WebCore::isOnAccessControlResponseHeaderWhitelist):
+        (WebCore::passesAccessControlCheck):
+        * loader/CrossOriginAccessControl.h: Added.
+        * loader/CrossOriginPreflightResultCache.cpp: Added.
+        (WebCore::parseAccessControlMaxAge):
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::parseAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCacheItem::parse):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsRequest):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        * loader/CrossOriginPreflightResultCache.h: Added.
+        (WebCore::CrossOriginPreflightResultCacheItem::CrossOriginPreflightResultCacheItem):
+        (WebCore::CrossOriginPreflightResultCache::CrossOriginPreflightResultCache):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequest):
+        (WebCore::XMLHttpRequest::makeSimpleCrossOriginAccessRequest):
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight):
+        (WebCore::XMLHttpRequest::didReceiveResponse):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        * xml/XMLHttpRequest.h:
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19797
+        Bring the list of forbidden headers in sync with XMLHttpRequest spec draft
+
+        Added new checks to http/tests/xmlhttprequest/set-dangerous-headers.html.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData): Added all headers from
+        XMLHttpRequest 2 draft.
+
+2009-03-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23975
+          <rdar://problem/6593610> REGRESSION: Scrollbar arrow not repainted
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::invalidateScrollbarRect): Corrected the vertical
+        scrollbar rect calculation.
+
+2009-03-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein, Oliver Hunt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24475
+        
+        When repainting replaced elements, need to union the selection
+        and overflow rects because either may extend outside the other.
+        
+        Test: fast/repaint/transform-replaced-shadows.html
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+
+2009-03-09  Stephanie Lewis  <slewis@apple.com>
+
+        Fix build.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::markAllMisspellingsAndBadGrammarInRanges):
+
+2009-03-09  Kim Christensen  <kimworking@gmail.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24276
+        Dropdown / select boxes do not consider the windows task bar in Chromium.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showPopup):
+
+2009-03-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson and Dave Hyatt.
+
+        - fix <rdar://problem/6654344> REGRESSION (r41041): Zillow.com has
+          misaligned edit fields
+
+        Test: fast/forms/legend-display-none.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Change the display
+        property of legend elements to 'block' unless it is 'none'.
+        * css/html4.css: Do not force the display property of legend elements to
+        'block' using CSS, because that prevents style rules from setting it to
+        'none'.
+
+2009-03-09  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23024
+
+        Fix an incorrect criteria in the if statement that leaves references to
+        deleted floating objects in RenderBlock.
+
+        Test: fast/block/float/crash-on-absolute-positioning.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+
+2009-03-09  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify JSC/V8 idl file.
+        https://bugs.webkit.org/show_bug.cgi?id=24424
+
+        * page/Location.idl:
+
+2009-03-09  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify JSC/V8 for History.idl.
+
+        * page/History.idl:
+
+2009-03-09  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify JSC/V8 implementations of DOMWindow.idl.
+
+        * page/DOMWindow.idl:
+
+2009-03-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24163
+        
+        Implement mapping of FloatQuads through 3D transforms.
+        
+        Removed the redundant localToContainerQuad() methods, which can now 
+        shared code with the old mapLocalToAbsolutePoint(), which was
+        renamed to mapLocalToContainer(). This can now convert a point,
+        and optionally a FloatQuad, which are carried along in the TransformState.
+        
+        Optimized TransformState to reduce to simple FloatPoint.move()
+        if there are no transforms, and to heap-allocate a transform only if
+        necessary to accumulate transforms (when using preserve-3d).
+        
+        Tested by 3d point mapping tests, and the inspector highlight (which now shows
+        the correct quads for 3d-transformed elements).
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::projectQuad):
+        (WebCore::TransformationMatrix::translateRight):
+        (WebCore::TransformationMatrix::translateRight3d):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::mapLocalToContainer):
+        (WebCore::RenderObject::localToContainerQuad):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::mapLocalToContainer):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::mapLocalToContainer):
+        * rendering/RenderView.h:
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::applyTransform):
+        (WebCore::TransformState::flatten):
+        (WebCore::TransformState::mappedPoint):
+        (WebCore::TransformState::mappedQuad):
+        (WebCore::TransformState::flattenWithTransform):
+        (WebCore::HitTestingTransformState::mappedQuad):
+        * rendering/TransformState.h:
+        (WebCore::TransformState::TransformState):
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::lastPlanarPoint):
+        (WebCore::TransformState::lastPlanarQuad):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::preserves3D):
+
+2009-03-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24433
+        
+        During hit testing with transforms, if a layer has backface-visibility: hidden,
+        we need to check for it whether or not the layer has a transform, because it
+        might be an ancestor that is transformed.
+
+        Test: transforms/3d/hit-testing/backface-no-transform-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24353
+        Allow to overrule default build options for Qt build.
+
+        * WebCore.pro: Allow to overrule ENABLE_VIDEO and ENABLE_NETSCAPE_PLUGIN_API
+
+2009-03-09  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24463
+        WebCore::qstring is detaching and copying twice for every single
+        WebCore::TextRun that is processed and drawn.  This elevates this method
+        to one of the top-ten most expensive methods in all of QtWebKit according
+        to profiling.  This changes the method so that QString only detaches
+        when absolutely necessary.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::qstring):
+        (WebCore::fixSpacing):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+
+2009-03-08  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Split ScrollAlignment and ScrollBehavior out of RenderLayer.h so that
+        Frame.h no longer needs to include it.  This cuts the size of the symbols
+        for a debug build by around 3%.
+
+        * dom/Element.cpp:
+        (WebCore::Element::scrollIntoView):
+        (WebCore::Element::scrollIntoViewIfNeeded):
+        * editing/Editor.cpp:
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::revealSelectionAfterEditingOperation):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::revealCaret):
+        * page/Frame.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::getRectToExpose):
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderLayer.h:
+        * rendering/ScrollBehavior.cpp: Added.
+        (WebCore::):
+        * rendering/ScrollBehavior.h: Added.
+        (WebCore::):
+        (WebCore::ScrollAlignment::getVisibleBehavior):
+        (WebCore::ScrollAlignment::getPartialBehavior):
+        (WebCore::ScrollAlignment::getHiddenBehavior):
+
+        Add the new files to the build systems:
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        Add includes that were previously pulled in by way of RenderLayer.h from Frame.h:
+        * dom/Clipboard.cpp:
+        * editing/EditorCommand.cpp:
+        * editing/InsertLineBreakCommand.cpp:
+        * editing/TypingCommand.cpp:
+        * html/HTMLFormControlElement.cpp:
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        * loader/icon/IconLoader.cpp:
+        * page/animation/AnimationController.cpp:
+        * rendering/RenderSlider.cpp:
+        * rendering/RenderTextControl.cpp:
+
+
+2009-03-08  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed Dan Bernstein.
+
+        Push the include of Frame.h out of RenderView.h and down to those files
+        that need it.  This cuts the size of symbols for RenderFoo object files
+        by around 15% in a debug build.
+
+        * bindings/objc/DOM.mm:
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.cpp:
+        * rendering/RenderReplaced.cpp:
+        * rendering/RenderText.cpp:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::zoomFactor):
+        * rendering/RenderView.h:
+
+2009-03-08  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove some unnecessary or redundant includes from files related to the JS bindings.
+        This cuts the size of the symbols for a debug build by around 3%.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        * bindings/js/JSSVGPODTypeWrapper.h:
+
+2009-03-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Remove the unused methods previousHistoryItem(), setPreviousHistoryItem()
+        and provisionalHistoryItem() from FrameLoader.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+
+2009-03-08  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Implement proper logging for the GTK+ port, inspired by the one in
+        Qt. We use the WEBKIT_DEBUG environment variable which was already
+        being used to decide whether to setup a logger for soup or not.
+
+        * platform/gtk/LoggingGtk.cpp:
+        (WebCore::getChannelFromName):
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-03-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - WebCore part of removing build-time and run-time support for legacy
+          versions of CFNetwork and Core Graphics
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit):
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::setHTTPBody):
+        (WebCore::httpBodyFromRequest):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::didSendBodyData):
+        (WebCore::shouldUseCredentialStorageCallback):
+        (WebCore::ResourceHandle::start):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::filterCookies):
+
+2009-03-07  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24444
+        No multiple JS property for <input type="file" multiple />
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::multiple):
+        (WebCore::HTMLInputElement::setMultiple):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-03-07  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        ScrollView scrollbars in subframes are *not* native, so take that
+        into account again.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::getLocationInParentWindow):
+        (ScrollbarGtk::frameRectsChanged):
+        (ScrollbarGtk::paint):
+        * platform/gtk/ScrollbarGtk.h:
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24405
+        Horizontal scrolling on Windows was reversed from Mac (and intuition).
+
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Convert some C-style casts to static_cast<>()s.
+
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-06  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6607524> REGRESSION (Safari 3-4): I can't tab back to the URL field in an empty window (key loop is broken)
+
+        I haven't been able to make a test for this since the problem is not reproducible within an empty iframe.
+
+        * page/EventHandler.cpp: (WebCore::eventTargetNodeForDocument): We used to ensure that every html document had a body element.
+          That is no longer true, so we should return the document element for a truly empty document.
+
+2009-03-06  Jay Campan  <jcampan@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24306
+
+        Adding a flag to ResourceRequestBase to indicate whether or not upload
+        progress notifications are needed for a resource. This is useful to
+        avoid sending these notifications when there are no consumers
+        (especially in the Chromium case where IPC is involved). 
+
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::reportUploadProgress):
+        (WebCore::ResourceRequestBase::setReportUploadProgress):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+
+2009-03-06  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24150
+        Add virtual ScriptExecutionContext::encoding()
+
+        Test: http/tests/workers/text-encoding.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::encoding):
+        * dom/Document.h:
+        (WebCore::Document::inputEncoding):
+        (WebCore::Document::charset):
+        (WebCore::Document::characterSet):
+        Add new virtual method and route DOM synonym functions on Document through it.
+
+        * dom/ScriptExecutionContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::encoding):
+        (WebCore::WorkerContext::completeURL): Added comment on why this is different from Document::completeURL
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::create):
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        All of the above route the 'encoding' parameter of parent context to the new
+        instance of WorkerContext - from Worker::notifyFinished() via WorkerMessagingProxy
+        through WorkerThread through WorkerThreadStartupData and into constructor of WorkerContext.
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Build bustage fix.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchWheelEvent):
+
+2009-03-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieView):  Delay callback while setting up movieview.
+
+2009-03-06  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Justin Garcia.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24108
+
+        Update spelling and grammar checking to use the new combined text 
+        checking (with automatic language identification) on Snow Leopard. 
+        Tested manually in Mail and Safari; automated tests to come later. 
+        
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingOrBadGrammarInRange):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::guessesForMisspelledOrUngrammaticalRange):
+        (WebCore::Editor::guessesForMisspelledOrUngrammaticalSelection):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::checkSpellingAndGrammarOfParagraph):
+        * page/EditorClient.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::respondToChangedSelection):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24407
+        Windows scroll amount was too small, and wheel scroll distance
+        conversion code was overly complex.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        * platform/PlatformWheelEvent.h:
+        (WebCore::):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Scrollbar.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/qt/WheelEventQt.cpp:
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::horizontalScrollChars):
+        (WebCore::verticalScrollLines):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Generate valid bindings with HTML5 database support disabled. 
+
+        * inspector/InspectorController.idl: Added feature guard around 
+        databaseTableNames definition.
+
+2009-03-04  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        Do not take into account the case of being a ScrollView scrollbar,
+        since those are native in our case.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::frameRectsChanged):
+
+2009-03-04  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        Move Widget::paint to ScrollbarGtk::paint, since it's scrollbar
+        specific and it's our only Widget anyway.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::paint):
+        * platform/gtk/ScrollbarGtk.h:
+        * platform/gtk/WidgetGtk.cpp:
+
+2009-03-04  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        Use correct clip rectangle and apply coordinate translation needed
+        for non-ScrollView scrollbars.
+
+        We were ignoring the clip rectangle passed as parameter, which is
+        wrong in the case of non coalesced expose events. This, in turn,
+        uncovers the fact that we were not applying coordinate translation
+        to our position.
+
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::paint):
+
+2009-03-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix, no review
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: fix setSize declaration
+
+2009-03-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22790
+        Bug 22790: [Transforms] MediaPlayer::setRect() makes no sense with transforms
+        Replace media engine setRect with setSize since they don't use about the 
+        position anyway.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setSize): Changed from setRect.
+        (WebCore::MediaPlayer::setSize): Ditto.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::size): Changed from rect().
+
+        * platform/graphics/MediaPlayerPrivate.h: Changed setRect to setSize.
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: Ditto.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp: 
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_size instead of m_rect
+        (WebCore::MediaPlayerPrivate::setSize): Changed from setRect
+        (WebCore::MediaPlayerPrivate::paint): update comment
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h: m_rect -> m_size.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:  m_rect
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_rect.
+        (WebCore::MediaPlayerPrivate::createQTMovieView): setRect-> setSize.
+        (WebCore::MediaPlayerPrivate::setSize): Changed from setRect
+        (WebCore::MediaPlayerPrivate::paint): Call view:setFrame: when in a media document so 
+        the movie is drawn in the correct location.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::setSize):  Changed from setRect
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setSize):  Changed from setRect
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer): Call setSize instead of setRect.
+
+2009-03-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 24422: REGRESSION: null-URL crash in FrameLoader setting location.hash on new window
+        https://bugs.webkit.org/show_bug.cgi?id=24422
+        rdar://problem/6402208
+
+        Test: fast/dom/location-new-window-no-crash.html
+
+        The issue here is empty (or null) URLs. I picked the "schedule navigation" bottleneck
+        to add some checks for empty URLs. We could also put the empty URL checks at some
+        other bottleneck level and add more assertions over time. I tried adding a few more
+        assertions to functions like loadURL and hit them while running the regression tests,
+        so it's probably going to be a bit tricky to clean this up throughout the loader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Explicitly marked this struct
+        immutable by making all its members const. Added assertions about the arguments,
+        including that the URL is not empty. Initialized one uninitialized member in one of
+        the constructors.
+        (WebCore::FrameLoader::scheduleHTTPRedirection): Added an early exit to make this
+        a no-op if passed an empty URL.
+        (WebCore::FrameLoader::scheduleLocationChange): Ditto.
+        (WebCore::FrameLoader::scheduleRefresh): Ditto.
+
+2009-03-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24423
+        Use new soup_message_body_set_accumulate API in soup backend
+
+        Disable accumulating chunks for request_body on file uploads,
+        using the new soup API.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-03-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Replace use of deprecated SOUP_MESSAGE_OVERWRITE_CHUNKS flag with
+        the new soup_message_body_set_accumulate API in soup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::ResourceHandle::startHttp):
+
+2009-03-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24051
+        Soup backend needs content sniffing capabilities
+
+        Perform content sniffing when using soup, so that we have a chance
+        of figuring out the Content-Type of the file if it's not sent by
+        the server.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::gotChunkCallback):
+
+2009-03-06  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24342
+        Cannot insert a Thai character after a Thai prepend character when using ICU 4.0
+
+        This change creates a new break iterator "cursorMovementIterator" for
+        moving cursors and use it when moving an input cursor.
+        In "TextBreakIteratorICU.cpp", this break iterator uses custom ruleset
+        based on the one of ICU 3.8.
+        On the other hand, in "TextBreakIteratorQt.cpp", this break iterator
+        just calls the characterBreakIterator() function.
+
+        Test: editing/inserting/insert-thai-characters-001.html
+
+        * platform/text/TextBreakIterator.h: Added a new function cursorMovementIterator().
+        * platform/text/TextBreakIteratorICU.cpp: Implemented the cursorMovementIterator() function for ICU.
+        (WebCore::setUpIteratorWithRules): Ditto.
+        (WebCore::cursorMovementIterator): Ditto.
+        * platform/text/qt/TextBreakIteratorQt.cpp: Implemented the cursorMovementIterator() function for Qt.
+        (WebCore::cursorMovementIterator): Ditto.
+        * rendering/RenderText.cpp: Call the cursorMovementIterator() function when moving an input cursor.
+        (WebCore::RenderText::previousOffset): Ditto.
+        (WebCore::RenderText::nextOffset): Ditto.
+
+2009-03-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6621701> Safari 4 Beta Breaks XMLHttpRequest Response Text With Special
+        Characters (a compatibility issue with widgets).
+
+        Test: http/tests/xmlhttprequest/broken-xml-encoding.html
+
+        Revert part of an Acid 3 fix - now we are no longer strict when decoding XMLHttpRequest XML
+        responses.
+
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::TextResourceDecoder):
+        (WebCore::TextResourceDecoder::decode):
+        (WebCore::TextResourceDecoder::flush):
+        * loader/TextResourceDecoder.h:
+        (WebCore::TextResourceDecoder::useLenientXMLDecoding):
+        Don't stop on XML decoding errors if useLenientXMLDecoding() was called.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::didReceiveData): Don't stop on XML
+        decoding errors. This behavior is now limited to other kinds of XML content.
+
+2009-03-05  Simone Fiorentino  <simone.fiorentino@consulenti.fastweb.it>
+
+        Bug 24382: request to add SH4 platform
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24382>
+
+        Reviewed by David Kilzer.
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::equal): Aligned memory access on SH4 platform.
+
+2009-03-05  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24215
+
+        Gears expects an object tag with display:none to instantiate the plugin,
+        so we add a workaround to make this work and fix Gears on WebKit trunk.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-03-05  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Need to have Chromium Mac match Safari Mac's accesskey handling
+        https://bugs.webkit.org/show_bug.cgi?id=24404
+
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::accessKeyModifiers): Share access key modifiers with Mac Safari when building for the Mac.
+
+2009-03-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24412
+        
+        Fix crash when hit-testing elements with -webkit-transform-style: preserve-3d
+        but no transform. We need to make localTransformState if we see preserve-3d.
+        Also need to call update3DTransformedDescendantStatus() before we test
+        m_has3DTransformedDescendant.
+
+        Test: transforms/3d/hit-testing/hit-preserves-3d.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Changes to RenderLayer destruction to hopefully help catch an elusive crasher
+        https://bugs.webkit.org/show_bug.cgi?id=24409
+        
+        Added a new RenderBoxModelObject::destroyLayer() call which is
+        now the only way which RenderLayers should ever be destroyed.
+        This ensures that the pointer to the layer is cleared in the
+        RenderObject after destruction, allowing us to ASSERT in the
+        RenderBoxModelObject destructor.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::destroyLayer):
+        (WebCore::RenderBoxModelObject::destroy):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::stackingContext):
+        (WebCore::RenderLayer::destroy):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2009-03-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Remove old, unused IE 5.5 scrollbar-* CSS properties.
+        Sort the unimplemented getComputedStyle properties so it's
+        easier to see which ones actually need implementation.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-03-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        WebViewDidChangeSelectionNotifications weren't being sent for commands that change the selection's position
+        within the document without changing its position in the DOM.  For example, pressing return in (caret marked by ^):
+        <div contentEditable="true"><div>^Hello</div></div>
+        Undo was being enabled, shouldDeleteDOMRange called, etc. when doing no-op deletes (a delete in an empty document 
+        for example). 
+
+        Changes to layout tests demonstrate fix.
+        
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::apply): Don't call applyEditing for a TypingCommand.  The TypingCommand knows whether or
+        not it did work that needs to be applied.
+        * editing/Editor.cpp:
+        (WebCore::Editor::appliedEditing): Moved code (but did not alter) to changeSelectionAfterCommand.
+        (WebCore::Editor::unappliedEditing): Ditto.
+        (WebCore::Editor::reappliedEditing): Ditto.
+        (WebCore::Editor::changeSelectionAfterCommand): Moved code from *appliedEditing into here.  Also call out to
+        EditorClient::respondToChangedSelection() for commands that changed the selection's position in the document
+        even if they did not change it's position in the DOM.  Any TypingCommand that gets this far changed it's position
+        in the document.
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand): Removed unused m_appliedEditing.
+        (WebCore::TypingCommand::typingAddedToOpenCommand): Always apply editing.  We won't get this far if we don't need to.
+        (WebCore::TypingCommand::deleteKeyPressed): Don't do any of the things that only make sense for Range selections, like
+        adding to the killring and responding to a change in selections if the delete was a no-op.
+        (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.
+        * editing/TypingCommand.h:
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Eliminate a ref-counting leak in InspectorController.
+
+        * inspector/InspectorController.h: Made constructor private, added static create method.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Change initializer to use static create method.
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24355
+        Add InspectorController.idl and convert InspectorController.cpp to use
+        JSC bindings.
+
+        * DerivedSources.make: Added InspectorController.idl
+        * WebCore.xcodeproj/project.pbxproj: Added idl, bindings files.
+        * bindings/js/JSInspectorControllerCustom.cpp: Added.
+        * bindings/scripts/CodeGeneratorJS.pm: Added Array to no-header types.
+        * inspector/InspectorController.cpp: Removed hand-rolled bindings.
+        * inspector/InspectorController.h: Added platform and addSourceToFrame methods.
+        * inspector/InspectorController.idl: Added.
+        * page/Page.h: Changed member to RefPtr since InspectorController is now ref-counted.
+
+2009-03-05  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24400
+        Bug 24400: Remove "start", "end", "loopStart", "loopEnd", "currentLoop", and "playCount" 
+        media element attributes
+
+        Test: media/video-loop.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::loadInternal):
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::seek):
+        (WebCore::HTMLMediaElement::playInternal):
+        (WebCore::HTMLMediaElement::loop):
+        (WebCore::HTMLMediaElement::setLoop):
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
+        (WebCore::HTMLMediaElement::endedPlayback):
+        (WebCore::HTMLMediaElement::updatePlayState):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+2009-03-05  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6651112> Safari asks about re-posting a form even when page is cached
+        
+        Reviewed by Ada Chan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache): Ported from Mac version.
+
+2009-03-05  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=24248
+
+        Make sure painting of overflow controls checks that visibility:visible is set on the block before
+        painting.  Pixel tests caught this regression.
+
+        Make sure resizer painting pushes a clip of the corner rect.  It was relying on the clip layers happened
+        to do to their bounds (which had nothing to do with overflow).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+
+2009-03-05  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24386
+        A faster implementation of extractMIMETypeFromMediaType.
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::extractMIMETypeFromMediaType):
+
+2009-03-05  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24392
+        Do not get the current time for unless we're doing PRELOAD_DEBUG as this
+        can be unnecessarily expensive.
+
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::write):
+
+2009-03-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24327
+        
+        When mapping points and hit testing through transforms, work
+        correctly when acclerated animations of transforms are running.
+        
+        Tested by LayoutTests/animations/animation-hit-test-transform.html,
+        which only failed when ACCELERATED_COMPOSITING was turned on.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+
+2009-03-05  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24391
+        Frame.cpp uses JSC specific includes
+
+        * page/Frame.cpp:
+
+2009-03-05  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24389
+        WebKitGTK+ crashes when cancelling plugin loads
+
+        Remove bogus calls to the client's didFinishLoading method from
+        our ResourceHandle::cancel implementation. Calling
+        didFinishLoading here is mostly inoffensive for most loads, but
+        causes crashes when plugin loads are cancelled.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::cancel):
+
+2009-03-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        
+        * WebCore.vcproj/QTMovieWin.vcproj:
+
+2009-03-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for when ENABLE_NETSCAPE_PLUGIN_API = 0.  The method
+        ScriptController::jsObjectForPluginElement(HTMLPlugInElement*); is not
+        protected by an #if and uses HTMLPlugInElement so it must be included.
+
+        * bindings/js/ScriptController.cpp:
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        GTK Build fix.
+
+        * inspector/ConsoleMessage.h: Use proper header.
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24376
+        Split InspectorController.cpp file into separate classes.
+
+        * GNUmakefile.am: Modified to include new files.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * inspector/ConsoleMessage.cpp: Added.
+        * inspector/ConsoleMessage.h: Added.
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDOMStorageResource.cpp: Added.
+        * inspector/InspectorDOMStorageResource.h: Added.
+        * inspector/InspectorDatabaseResource.cpp: Added.
+        * inspector/InspectorDatabaseResource.h: Added.
+        * inspector/InspectorResource.cpp: Added.
+        * inspector/InspectorResource.h: Added.
+
+2009-03-05  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24387
+        Remove media element bufferingRate attribute. No test necessary as there
+        were none for this attribute.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Don't initialize m_bufferingRate.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::progressEventTimerFired): Don't calculate m_bufferingRate.
+        * html/HTMLMediaElement.h: Remove m_bufferingRate.
+        * html/HTMLMediaElement.idl: Ditto.
+
+2009-03-05  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24377
+        [GTK] Comply better with coding style guidelines in ResourceHandleSoup
+
+        Use C++ booleans, 0 instead of NULL, prefix boolean variables with
+        'is', do not use 'else if' if the previous if had a return, delete
+        trailing whitespace, etc.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::fillResponseFromMessage):
+        (WebCore::restartedCallback):
+        (WebCore::finishedCallback):
+        (WebCore::parseDataUrl):
+        (WebCore::ensureSessionIsInitialized):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::reportUnknownProtocolError):
+        (WebCore::ResourceHandle::start):
+        (WebCore::cleanupGioOperation):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+        (WebCore::ResourceHandle::startGio):
+
+2009-03-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=24328
+        
+        If an element has backface-visibility: hidden, hit testing should not
+        hit the back sides of elements. Test for that by inverting the accumulated
+        transform and looking at the z vector.
+
+        Tested by transforms/3d/hit-testing/backface-hit-test.html
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        r41362 mistakenly added functions "RenderThemeWin::" into
+        RenderThemeChromiumGtk.cpp. When correcting this, I somehow changed
+        them to void return types. This patch switches them back to ints.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24360
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingBottom):
+
+2009-03-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: change some metrics to better match Windows after
+        r41416. Aesthetically this may be worse, but web-compat is king.
+
+        Also, the previous code had an off by one error when drawing
+        scrollbars which caused the scrollbar to overflow it's bounds by 1px
+        at the right and bottom edges.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24369
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumLinux::systemFont):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+
+2009-03-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add an ASSERT to better demonstrate the cause of the crash in
+        https://bugs.webkit.org/show_bug.cgi?id=23736
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::~DocLoader):
+
+2009-03-04  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24337: Assert when doing sync XHR in a worker for a cacheable response.
+        <https://bugs.webkit.org/show_bug.cgi?id=24337>
+
+        Tests: http/tests/xmlhttprequest/access-control-basic-denied-preflight-cache.html
+               http/tests/xmlhttprequest/workers/xmlhttprequest-file-not-found.html
+
+        * loader/mac/ResourceLoaderMac.mm:
+        (WebCore::ResourceLoader::willCacheResponse):
+        An identifier is only asssigned if resource load callbacks are done.  So don't send
+        willCacheResponse which uses identifier if resource load callbacks aren't being sent.
+
+2009-03-04  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24330: Sync xhr in workers should send an abort exception when the worker is terminated.
+        <https://bugs.webkit.org/show_bug.cgi?id=24330>
+
+        Test: http/tests/xmlhttprequest/workers/abort-exception-assert.html
+
+        * dom/ExceptionCode.cpp:
+        (WebCore::xmlHttpRequestExceptionNames):
+        Added missing ABORT_ERR whose absence caused an assert.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
+        Add more logic to handle the termination case for sync xhr.
+
+2009-03-04  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24364
+        Add support for HTMLMediaElement canPlayType method. Make
+        MediaPlayer::supportsType take a ContentType instead of a
+        separate mime type and codecs parameter.
+
+        Test: media/video-can-play-type.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType): Add canPlayType method.
+        (WebCore::HTMLMediaElement::loadInternal): selectMediaURL returns a ContentType.
+        (WebCore::HTMLMediaElement::selectMediaURL): Return a ContentType instead of raw MIME type.
+        (WebCore::HTMLMediaElement::initialURL): selectMediaURL returns a ContentType.
+        * html/HTMLMediaElement.h: Add prototype.
+        * html/HTMLMediaElement.idl: Ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Take a ContentType instead of raw MIME type.
+        (WebCore::MediaPlayer::supportsType): Ditto.
+        * platform/graphics/MediaPlayer.h:
+
+2009-03-04  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24359
+        Repaint throttling mechanism
+        
+        Excessive repainting can slow down page loadind. This implements a timer
+        based throttling mechanism. It is behind ENABLE(REPAINT_THROTTLING) and not 
+        enabled by default.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkCompleted):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::handleTextInputEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::beginDeferredRepaints):
+        (WebCore::FrameView::endDeferredRepaints):
+        (WebCore::FrameView::checkStopDelayingDeferredRepaints):
+        (WebCore::FrameView::doDeferredRepaints):
+        (WebCore::FrameView::updateDeferredRepaintDelay):
+        (WebCore::FrameView::resetDeferredRepaintDelay):
+        (WebCore::FrameView::adjustedDeferredRepaintDelay):
+        (WebCore::FrameView::deferredRepaintTimerFired):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+
+2009-03-04  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Antti Koivisto.
+
+        Remove LOW_BANDWIDTH_DISPLAY as it is not being used by any platforms.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::haveStylesheetsLoaded):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::checkNotify):
+        * loader/DocLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::write):
+        (WebCore::FrameLoader::endIfNotLoadingMainResource):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+
+2009-03-02  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24287
+        [GTK] Move auth dialog feature to WebKit/
+
+        Remove WebKitSoupAuthDialog files from build and stop using it.
+
+        * GNUmakefile.am:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+        * platform/network/soup/webkit-soup-auth-dialog.c: Removed.
+        * platform/network/soup/webkit-soup-auth-dialog.h: Removed.
+
+2009-03-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24361
+        
+        Reinstate code that sets result.innerNode when hitTest() returns true,
+        but never filled in the innerNode. Fixes hit testing of generated content.
+
+        Test: fast/css-generated-content/hit-test-generated-content.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestContents):
+
+2009-03-04  Adam Barth  <abath@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24356
+
+        Fix WebKit style for allowUniversalAccessFromFileURLs.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAllowUniversalAccessFromFileURLs):
+        * page/Settings.h:
+        (WebCore::Settings::allowUniversalAccessFromFileURLs):
+
+2009-03-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6619630> Quick Look of vCards stuck on image of first card opened.
+
+        I narrowed this down to http://trac.webkit.org/changeset/39304 which, among other things,
+        consolidated some of the various decision making pieces of the Cache into the new method
+        FrameLoader::cachePolicy().
+
+        Before 39304, when deciding whether to use an existing CachedResource, we checked if the FrameLoader 
+        is reloading.  If it is, we'd evict any existing resource then recreate it.  Quick looks uses the
+        same URL for this image every time and expects it to be reloaded with each new card.
+
+        The FrameLoader::isReloading() check did one thing - Ask the DocumentLoader if it's cache policy
+        is "ReloadIgnoringCacheData".  This check was lost in the consolidation to the new method.  
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePolicy): Restore the DocumentLoader's cachePolicy check as a possible
+          condition for returning CachePolicyReload.
+
+2009-03-04  Timothy Hatcher  <timothy@apple.com>
+
+        * English.lproj/localizedStrings.js: Update strings to include "DATABASES",
+        "LOCAL STORAGE" and "SESSION STORAGE".
+
+2009-03-04  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a regression where the Web Inspector console would not animate
+        in or out correctly.
+
+        Reviewed by Anders Carlsson.
+
+        * inspector/front-end/inspector.css: Move a z-index to a child element
+        to get the correct stacking order during the animation.
+
+2009-03-03  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24201, pathologically bad block layout.
+
+        Make sure to factor clear deltas into y position estimates.  Also avoid doing the comparison of
+        the final position against the y position estimate until after the clear has happened.  This gets rid
+        of some duplicated cut/pasted code and also ensures a layout delta only has to be put in once.
+
+        Reviewed by Dan Bernstein
+
+        Added fast/block/float/nested-clearance.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::estimateVerticalPosition):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::getClearDelta):
+        * rendering/RenderBlock.h:
+
+2009-03-02  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Simon Hausmann.
+
+        Improvement to 3d transformations rendering in QtWebKit. QTransform is used
+        instead of QMatrix. This allows perspective transformations since QTransform is
+        a true 3x3 matrix.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp: Use QTransform instead of QMatrix everywhere.
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::translate):
+        (WebCore::Path::transform):
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QTransform): Replace the conversion operator
+        to QMatrix with one to QTransform.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/qt/FontQt.cpp:
+
+2009-02-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24151
+        Fix Qt/S60 build break
+
+        * platform/FileSystem.h: Create a default case for non-win and non-mac Qt builds
+        * platform/qt/FileSystemQt.cpp: Ditto
+        (WebCore::unloadModule):
+
+2009-03-03  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21939
+        Uninitialized ExceptionCode in DOMWindow::postMessage
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+
+2009-03-03  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6581203> WebCore and WebKit should install the same set of headers during installhdrs phase as build phase
+
+        Reviewed by Mark Rowe.
+
+        The fix is to add INSTALLHDRS_COPY_PHASE = YES and
+        INSTALLHDRS_SCRIPT_PHASE = YES to WebCore.xcconfig, then to make
+        sure various build phase scripts work with the installhdrs build
+        phase.
+
+        * Configurations/Base.xcconfig: Defined REAL_PLATFORM_NAME
+        based on PLATFORM_NAME to work around the missing definition on
+        Tiger.
+        * Configurations/WebCore.xcconfig: Added
+        JAVASCRIPTCORE_PRIVATE_HEADERS_DIR variable to simplify logic in
+        the "Generate Derived Sources" script.  Added
+        INSTALLHDRS_COPY_PHASE = YES and INSTALLHDRS_SCRIPT_PHASE = YES.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        - Added shell code to prevent running "Check For Global
+          Initializers", "Check For Exit Time Destructors" and "Check
+          For Weak VTables" scripts during the installhdrs build phase.
+        - Made "Generate Derived Sources" work for the installhdrs build
+          phase.  Also simplified setting of CREATE_HASH_TABLE by using
+          JAVASCRIPTCORE_PRIVATE_HEADERS_DIR.
+
+2009-03-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: Switch to using Skia to render widgets.
+
+        In order to sandbox the Chromium renderer on Linux we need to remove
+        the X connection. GTK cannot render without an X connection so, for
+        now, we render widgets ourselves.
+
+        Previously didn't use anti-alias fonts in order to match Windows font
+        rendering exactly. This was helpful when bootstrapping our layout
+        tests. Now, however, we are ready to enable it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24244
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintButton):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setupPaint):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::~PlatformContextSkia):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * rendering/RenderThemeChromiumGtk.cpp: Removed.
+        * rendering/RenderThemeChromiumGtk.h: Removed.
+        * rendering/RenderThemeChromiumLinux.cpp: Added.
+        * rendering/RenderThemeChromiumLinux.h: Added.
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24261
+        Fix return types.
+
+        Test: LayoutTests/dom/svg/level3/xpath/XPathEvaluator_evaluate_TYPE_ERR.svg
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt32): change return type to int
+        (WebCore::toFloat): change return type to float.
+
+2009-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22884
+        <rdar://problem/6449783>
+        modified layout test crashes Safari
+
+        Null check NPStream before dereferencing it.
+        
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::destroyStream):
+
+2009-03-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/6641045>
+        Don't call QTKit to get movie properties until movie metadata has been loaded.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        (WebCore::MediaPlayerPrivate::metaDataAvailable): defined
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTTime): return default if !metaDataAvailable.
+        (WebCore::MediaPlayerPrivate::play): Ditto.
+        (WebCore::MediaPlayerPrivate::pause): Ditto.
+        (WebCore::MediaPlayerPrivate::duration): Ditto.
+        (WebCore::MediaPlayerPrivate::currentTime): Ditto.
+        (WebCore::MediaPlayerPrivate::seek): Ditto.
+        (WebCore::MediaPlayerPrivate::seekTimerFired): Ditto.
+        (WebCore::MediaPlayerPrivate::paused): Ditto.
+        (WebCore::MediaPlayerPrivate::seeking): Ditto.
+        (WebCore::MediaPlayerPrivate::naturalSize): Ditto.
+        (WebCore::MediaPlayerPrivate::hasVideo): Ditto.
+        (WebCore::MediaPlayerPrivate::setVolume): Ditto.
+        (WebCore::MediaPlayerPrivate::setRate): Ditto.
+        (WebCore::MediaPlayerPrivate::dataRate): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+
+2009-03-03  Kevin McCullough  <kmccullough@apple.com>
+
+        - Spelling fix.
+
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23657
+        Remove Database API callback IDLs from the project. 
+        They were removed in r40633.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed IDL files from the project.
+
+2009-03-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6639110> console.profile() doesn't work without a title
+
+        * page/Console.cpp:
+        (WebCore::Console::profile): If there is no title assume this is a user
+        initiated profile and give it the next incremented title name.
+
+2009-03-03  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a regression that broke dirxml and caused an ASSERT in debug builds. Also simplified
+        the console code and refactored things to have fewer code paths and duplication.
+
+        rdar://problem/6367127
+        https://bugs.webkit.org/show_bug.cgi?id=24329
+
+        Reviewed by Kevin McCullough.
+
+        Test: manual-tests/inspector/console-dir.html
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap): Use the lexicalGlobalObject instead of dynamicGlobalObject
+        to fix an ASSERT about using a wrapper from the wrong ExecState.
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper): Ditto.
+        (WebCore::JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom): Ditto.
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._format): Remove the inline argument and add forceObjectFormat.
+        When forceObjectFormat is true, the only formatter used is _formatobject.
+        (WebInspector.Console.prototype._formatvalue): Remove the inline argument.
+        (WebInspector.Console.prototype._formatstring): Ditto.
+        (WebInspector.Console.prototype._formatregexp): Ditto.
+        (WebInspector.Console.prototype._formatarray): Ditto.
+        (WebInspector.Console.prototype._formatnode): Remove the inline argument and make a DOM tree instead of an anchor.
+        (WebInspector.Console.prototype._formatobject): Remove the inline argument and always make a property graph.
+        (WebInspector.Console.prototype._formaterror): Remove the inline argument.
+        (WebInspector.ConsoleMessage): Remove the case for MessageLevel.Node and
+        simplify the case for MessageLevel.Object to use the normal _format code path with the %O formatter.
+        (WebInspector.ConsoleMessage.prototype._format.formatForConsole): Don't pass an additional true argument for inline.
+        (WebInspector.ConsoleMessage.prototype._format.formatAsObjectForConsole): Added. Pass a true argument for forceObjectFormat.
+        (WebInspector.ConsoleMessage.prototype._format): Added support for the %O formatter. Use formatForConsole for all arguments.
+        (WebInspector.ConsoleMessage.prototype.toString): Add the other message levels.
+        * inspector/front-end/inspector.css: Tweak styles to look and work correctly.
+        * inspector/front-end/utilities.js:
+        (Object.type): Return "node" for Node objects.
+        (Object.describe): Handle the "node" type.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix): Fix an assert by adding the other message level types.
+        (WebCore::Console::dirxml): Use the standard log fuction since it prints a DOM tree for nodes by default.
+        * page/Console.h:
+        (WebCore::enum MessageLevel): Removed NodeMessageLevel. Added a FIXME.
+
+2009-03-03  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24325
+        Crash on replacing document contents during drop.
+
+        Makes sure a node is in the document during a move before using it.
+
+        Test: fast/events/crash-on-mutate-during-drop.html
+
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+
+2009-03-03  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23028
+        Enable dynamic web font support to Chromium on Windows.
+        Files that were omitted by mistake in the latest patch
+        that was landed.
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream):
+        (WebCore::createFontCustomPlatformData):
+
+2009-03-03  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16826
+        [Gtk] Implement WebKitDownload
+
+        Make the Soup backend able to handle requests without a frame,
+        since we may have such things now that we support downloads.
+
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24331
+        Add custom V8 bindings for Element, Attr, HTMLFrame, and HTMLIFrame.
+
+        * bindings/v8/custom/V8AttrCustom.cpp: Added.
+        * bindings/v8/custom/V8CustomBinding.cpp: Added.
+        * bindings/v8/custom/V8CustomBinding.h: Added attribute-checking helpers.
+        * bindings/v8/custom/V8ElementCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp: Added.
+
+2009-03-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6616664> - Quick looks of various file types is broken
+
+        In http://trac.webkit.org/changeset/40553 there was an attempt to prevent NSURLRequest churn
+        for non-HTTP loads when the underlying ResourceRequest changed.  Unfortunately it was a little
+        overzealous as the mainDocumentURL is relevant for all loads, not only HTTP/HTTPS loads.
+
+        Partially reverted behavior to always set the mainDocumentURL in situations when we would've
+        before that patch.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::setMainDocumentURL):
+
+2009-03-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24256
+
+        Added a WebCoreForceSoftwareAnimation flag.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::forceSoftwareAnimation):
+        (WebCore::GraphicsLayerCA::setOpacity):
+        (WebCore::GraphicsLayerCA::animateTransform):
+        (WebCore::GraphicsLayerCA::animateFloat):
+
+2009-03-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24257
+
+        Added prototype properties for several classes with constructors that
+        were missing them, including the one mentioned in the bug.
+
+        Test: fast/dom/Window/custom-constructors.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseWebKitCSSMatrix):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24321
+        Add V8 bindings headers.
+
+        * bindings/v8/V8Binding.h: Added.
+        * bindings/v8/V8Proxy.h: Added.
+        * bindings/v8/custom/V8CustomBinding.h: Added.
+        * bindings/v8/custom/V8CustomEventListener.h: Added.
+
+2009-03-03  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23803
+        Fix an 'off-by-1' error in ChromiumWin's font fallback.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+
+2009-03-03  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        http://bugs.webkit.org/show_bug.cgi?id=23028
+        Enable dynamic web font support to Chromium on Windows: Part 1
+        - Move OpenTypeUtilities.{cpp,h} to platform/graphics/opentype
+          from platform/graphics/win because both Windows port and Chromium Windows
+          port will use them.
+        - Adjust WebCore.vcproj accordingly.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/opentype: Added.
+        * platform/graphics/opentype/OpenTypeUtilities.cpp: Copied from WebCore/platform/graphics/win/OpenTypeUtilities.cpp.
+        * platform/graphics/opentype/OpenTypeUtilities.h: Copied from WebCore/platform/graphics/win/OpenTypeUtilities.h.
+        * platform/graphics/win/OpenTypeUtilities.cpp: Removed.
+        * platform/graphics/win/OpenTypeUtilities.h: Removed.
+
+2009-03-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24312
+        
+        Take 3D transforms into account when hit testing:
+        
+        1. Maintain a bit on each RenderLayer that is set when the layer
+           has 3d descendants, so that we know when to fall into the slow
+           hit testing path.
+           
+        2. Make a ref-counted HitTestingTransformState, which is used to store
+           an accumulated transform, and the hit test point, and hitTestRect
+           in the plane of the ancestor non-3d ('flattening') layer.
+           
+           It's ref-counted so we can heap allocate it (to avoid stack bloat),
+           and avoid copying when hitTestLayer calls itself after applying the transform.
+           
+        3. Add logic to hitTestLayer to depth-test just direct descendants, if any have
+           3D transforms, or to do deep depth-testing when traversing a preserves-3d
+           hierarchy. When hit, layers compute a z-offset from the ancestor flattening
+           layer, which allows for correct depth testing.
+           
+           The existing early-return codepath is unaffected when there are no 3d transforms
+           and no preserve-3d.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::dirty3DTransformedDescendantStatus):
+        (WebCore::RenderLayer::update3DTransformedDescendantStatus):
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::computeZOffset):
+        (WebCore::RenderLayer::createLocalTransformState):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestContents):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::preserves3D):
+        (WebCore::RenderLayer::has3DTransform):
+        (WebCore::RenderLayer::setHas3DTransformedDescendant):
+        (WebCore::RenderLayer::has3DTransformedDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::flatten):
+        (WebCore::TransformState::mappedPoint):
+        (WebCore::HitTestingTransformState::move):
+        (WebCore::HitTestingTransformState::applyTransform):
+        (WebCore::HitTestingTransformState::flatten):
+        (WebCore::HitTestingTransformState::mappedPoint):
+        (WebCore::HitTestingTransformState::mappedQuad):
+        * rendering/TransformState.h:
+        (WebCore::TransformState::TransformState):
+        (WebCore::HitTestingTransformState::create):
+        (WebCore::HitTestingTransformState::move):
+        (WebCore::HitTestingTransformState::HitTestingTransformState):
+
+2009-03-03  Brett Wilson  <brettw@chromium.org>
+
+        Fix uninitialized memory reads in the Chromium Windows transparency
+        code that were identified by Purify,
+
+        Reviewed by Darin Fisher.
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        (WebCore::TransparencyWin::initializeNewContext):
+
+2009-03-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24312
+        
+        Factor the code that compute a transform relative to the container
+        into RenderObject::transformFromContainer().
+        
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToAbsolutePoint):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+        * rendering/RenderObject.h:
+
+2009-03-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24317
+        
+        Always return |true| from RenderTextControlMultiLine::nodeAtPoint() if
+        the superclass found a node, otherwise we set the innerNode of the
+        HitTestResult, but don't actually report that we found a hit.
+
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+
+2009-03-03  Onne Gorter  <onne.gorter@avinity.net>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23707
+        resizing plugins does not work, because the plugin never gets informed
+
+        Make gtk plugins resize correctly, by sending them the setwindow event
+        correctly. Also ensure that all plugin eventing is done with correct
+        locking/calling. Mostly copied from mac implementation.
+
+        manual test: manual-tests/gtk/plugin-resize-scroll.html
+
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        ensure locking/calling for NPEvents
+        (WebCore::PluginView::updatePluginWidget):
+        if something changed, let setNPWindowIfNeeded handle it
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        ensure calling conventions
+        (WebCore::PluginView::setNPWindowRect):
+        just pass control to setNPWindowIfNeeded
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        event the plugin correctly of new window
+        (WebCore::PluginView::init):
+        init through the new setup
+
+2009-03-03  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24311
+        Make IDL returning DOMObject use [V8Custom]
+
+        * dom/Document.idl:
+        * html/HTMLCanvasElement.idl:
+
+2009-03-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+
+        https://bugs.webkit.org/show_bug.cgi?id=24313
+        
+        If RenderTextControlSingleLine::nodeAtPoint() pokes a node into the
+        HitTestResult, then it had better well return |true|. And m_innerBlock
+        could never have been set as the hit node by the superclass, because
+        the superclass knows nothing about m_innerBlock.
+        
+        Test: fast/forms/input-hit-test-border.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+
+2009-03-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Enable Geolocation (except on Tiger and Leopard).
+
+        * Configurations/WebCore.xcconfig:
+
+2009-03-02  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24307
+        Null out m_highlightedNode on hideHighlight().
+        Ran WebCore/manual-tests/inspector/highlight-nodes.html.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::hideHighlight):
+
+2009-03-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6507404> Add Geolocation support.
+
+        This is not yet turned on for any Mac platform.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::shouldAllowGeolocationForFrame):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::shouldAllowGeolocationForFrame):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::disconnectFrame): Remove call to setUsingGeolocation as the document
+        will not be alive at this point.
+        (WebCore::Geolocation::getCurrentPosition): Check if the embedding app allows geolocation and
+        return a PERMISSION_DENIED if not.
+        (WebCore::Geolocation::watchPosition): Ditto.
+        (WebCore::Geolocation::shouldAllowGeolocation): Perform request to embedding layer of whether
+        to allow geolocation and cache the result. 
+        * page/Geolocation.h:
+        (WebCore::Geolocation::):
+        * platform/GeolocationService.cpp:
+        * platform/GeolocationService.h:
+        (WebCore::GeolocationService::~GeolocationService):
+        (WebCore::GeolocationService::stopUpdating):
+        * platform/mac/GeolocationServiceMac.h: Added.
+        (WebCore::GeolocationServiceMac::lastPosition):
+        (WebCore::GeolocationServiceMac::lastError):
+        * platform/mac/GeolocationServiceMac.mm: Added.
+        (WebCore::GeolocationService::create):
+        (WebCore::GeolocationServiceMac::GeolocationServiceMac):
+        (WebCore::GeolocationServiceMac::~GeolocationServiceMac):
+        (WebCore::GeolocationServiceMac::startUpdating):
+        (WebCore::GeolocationServiceMac::stopUpdating):
+        (WebCore::GeolocationServiceMac::suspend):
+        (WebCore::GeolocationServiceMac::resume):
+        (WebCore::GeolocationServiceMac::positionChanged):
+        (WebCore::GeolocationServiceMac::errorOccurred):
+        (-[WebCoreCoreLocationObserver initWithCallback:]):
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+        (-[WebCoreCoreLocationObserver locationManager:didFailWithError:]):
+
+2009-03-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for wxWidgets Mac trunk build.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        (GetTextExtent):
+        * webcore-wx.bkl:
+
+2009-03-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxGTK missing header build fix.
+
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+
+2009-03-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21811
+          REGRESSION: Windows Build Not Selecting Proper Font
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont): Added back code to verify that the created
+        HFONT has the requested face name.
+
+2009-03-02  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a regression caused by splitting the input and output of console commands.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24293
+
+        Reviewed by Kevin McCullough.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addMessage): Don't treat ConsoleCommandResult as a
+        normal ConsoleMessage when appending. This prevents resetting repeatCounts incorrectly.
+
+2009-03-02  Timothy Hatcher  <timothy@apple.com>
+
+        Make exception messages and logged Error objects display consistently.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18983
+
+        Reviewed by Adam Roben.
+
+        * English.lproj/localizedStrings.js: Remove a string for line numbers.
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._enterKeyPressed): Pass the exception
+        boolean to the ConsoleCommandResult constructor and don't pass level.
+        (WebInspector.Console.prototype._formatnode): Fix a className typo.
+        (WebInspector.Console.prototype._formaterror): Add an error-message
+        classed span around the message to show in red and remove the
+        console-message-url class from the link so it doesn't float right.
+        Instead enclose the link in parentheses and use displayNameForURL
+        to shorten the URL in the link.
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Simplify
+        how line numbers are shown since link underlining a string with
+        parentheses looks bad.
+        (WebInspector.ConsoleCommandResult): Take an exception boolean flag
+        instead of a level and get line and URL based on that flag.
+        * inspector/front-end/inspector.css: Tweaks to the styles.
+
+2009-03-02  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24048: extra windows button padding doesn't apply when there's no appearance
+        <https://bugs.webkit.org/show_bug.cgi?id=24048>
+
+        Replace adjustButtonInnerStyle with buttonInternalPaddingLeft/Right/Top/Bottom.
+
+        No tests added as existing tests already cover this behavior.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderTheme.cpp:
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::buttonInternalPaddingLeft):
+        (WebCore::RenderTheme::buttonInternalPaddingRight):
+        (WebCore::RenderTheme::buttonInternalPaddingTop):
+        * rendering/RenderThemeChromiumGtk.cpp:
+        (WebCore::RenderThemeWin::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeWin::buttonInternalPaddingRight):
+        (WebCore::RenderThemeWin::buttonInternalPaddingTop):
+        (WebCore::RenderThemeWin::buttonInternalPaddingBottom):
+        * rendering/RenderThemeChromiumGtk.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingBottom):
+        * rendering/RenderThemeChromiumWin.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeWin::buttonInternalPaddingRight):
+        (WebCore::RenderThemeWin::buttonInternalPaddingTop):
+        (WebCore::RenderThemeWin::buttonInternalPaddingBottom):
+        * rendering/RenderThemeWin.h:
+
+2009-03-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for Qt port.  Remove unnecessary assert.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::putImageData):
+
+2009-03-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Adam Roben and previously by Eric Seidel and Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24227
+        Ensure that the checkForSolidColor() optimization is correctly triggered
+        for all cases of drawPattern.  Currently, the optimization was not triggered
+        when the check had not been previously performed via a request for the
+        image's NativeImagePtr.
+
+        Implement the Qt version of the checkForSolidColor() method.  Combined with
+        the bug fix this reduces the time it takes to draw a repeating background
+        of a 1x1 image from ~50msecs to ~0msecs on my machine.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Image.h:
+        (WebCore::Image::mayFillWithSolidColor):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-02  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix; adding missing files to EXTRA_DIST, so that
+        they show up in the tarball.
+
+        * GNUmakefile.am:
+
+2009-03-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Added putImageData to Qt. Discussed with Ariya Hidayat.
+
+        [Qt] lacks putImageData support in Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=22186
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::putImageData):
+
+2009-03-02  Timothy Hatcher  <timothy@apple.com>
+
+        Show exception messages again when evaluating bad expressions in the
+        Web Inspector's console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19890
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::transferExceptionToExecState):
+        Fix the order in which the exception is set and cleared now that the
+        exception is stored in the shared GlobalData, not per ExecState.
+
+2009-02-28  Timothy Hatcher  <timothy@apple.com>
+
+        Make input in the Web Inspector console print before any output
+        that might be added by the called function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19931
+
+        Reviewed by Oliver Hunt.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._enterKeyPressed): Add the command
+        message before evaluating the result. Associate the originating
+        command to the result, so if they are adjacent there is no divider.
+        (WebInspector.ConsoleCommand): No longer take a result.
+        (WebInspector.ConsoleCommand.prototype.toMessageElement): Result
+        code removed since it isn't used now.
+        (WebInspector.ConsoleCommandResult): Subclass ConsoleMessage.
+        (WebInspector.ConsoleCommandResult.prototype.toMessageElement):
+        Call the ConsoleMessage toMessageElement and add a style class.
+        * inspector/front-end/inspector.css: Add a new style class for
+        adjacent results to hide the divider. Also tweak the position of
+        the disclosure triangle for objects to not use the left margin.
+
+2009-03-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 24282: AX Palindrome error when asking for a specific index of the AXChildren array
+        <https://bugs.webkit.org/show_bug.cgi?id=24282>
+
+        When fetching an array of elements with a range, attachment views need to be returned
+        instead of the actual attachment.
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+
+2009-03-01  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24251: Cleanup: replace positionForCoordinates with positionForPoint
+        <https://bugs.webkit.org/show_bug.cgi?id=24251>
+        
+        Make RenderObject::positionForCoordinate non-virtual and
+        RenderObject::positionForPoint virtual in preparation for
+        removing positionFor* from RenderObject/RenderText.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::visiblePositionForPoint):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::positionForPoint):
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::positionForPoint):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::positionForCoordinates):
+        (WebCore::RenderObject::positionForPoint):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::positionForPoint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForPoint):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        * rendering/RenderText.h:
+
+2009-03-01  Larry Ewing  <lewing@novell.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24080
+        NPN_GetValue casting to the wrong type and writing outside bounds
+
+        Make sure to cast the value to the correct type so that only
+        memory owned by the value is written to.
+
+        * plugins/gtk/PluginViewGtk.cpp (PluginView::getValueStatic): 
+        * plugins/qt/PluginViewQt.cpp (PluginView::getValueStatic):
+        * plugins/mac/PluginViewMac.cpp (PluginView::getValueStatic): 
+        (PluginView::getValue):
+
+2009-03-01  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24197 and
+        https://bugs.webkit.org/show_bug.cgi?id=23512
+
+        The Windows version of cgColor() is conditionally compiled using
+        !PLATFORM(MAC) change this to PLATFORM(WIN_OS) so that Chrome
+        can use the OS X version instead of the Windows version.
+
+        Also rename cgColor() -> createCGColor()
+
+        No observable change in behavior, so no test.
+
+        * platform/graphics/Color.h:
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::createCGColor):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::setLayerBorderColor):
+        (WebCore::setLayerBackgroundColor):
+        (WebCore::GraphicsLayerCA::setBackgroundColor):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm:
+        (WebCore::ciColor):
+
+2009-03-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24271: XMLHttpRequest needs js bindings for Workers.
+        <https://bugs.webkit.org/show_bug.cgi?id=24271>
+
+        Tests: http/tests/xmlhttprequest/workers/methods-async.html
+               http/tests/xmlhttprequest/workers/methods.html
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::getOwnPropertySlot):
+        (jsWorkerContextBaseXMLHttpRequest):
+        (setJSWorkerContextBaseXMLHttpRequest):
+        Expose XMLHttpRequest to Workers.
+
+        * bindings/js/JSWorkerContextBase.h:
+
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        (WebCore::constructXMLHttpRequest):
+        (WebCore::JSXMLHttpRequestConstructor::mark):
+        Removed the dependencies on Document.
+
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        (WebCore::JSXMLHttpRequestConstructor::scriptExecutionContext):
+        * dom/EventException.idl:
+        * dom/EventListener.idl:
+        Change to have the NoStaticTables attribute since they are used from XHR.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::workerContextDidFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        Fixed identifier to be unsigned long.
+
+        * loader/WorkerThreadableLoader.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        Stop active objects when the thread is getting shutdown so that xhr gets properly shutdown.
+
+        * xml/XMLHttpRequestUpload.cpp:
+
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XMLHttpRequestProgressEvent.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        Change to have the NoStaticTables attribute since they are used from XHR.
+
+2009-03-01  Horia Olaru  <olaru@adobe.com>
+
+        Adding manual debugger test cases for bug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21073
+
+        Reviewed by Kevin McCullough.
+
+        * manual-tests/inspector/debugger-step-on-do-while-statements.html: Added.
+        * manual-tests/inspector/debugger-step-on-for-in-statements.html: Added.
+        * manual-tests/inspector/debugger-step-on-for-statements.html: Added.
+        * manual-tests/inspector/debugger-step-on-while-statements.html: Added.
+        * manual-tests/inspector/resources/loop-statements.js: Added.
+
+2009-03-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6634768> Reproducible crash in RenderLayer::updateScrollCornerStyle() using full-page zoom at MobileMe Contacts
+
+        Test: fast/events/scroll-during-zoom-change.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Pause scheduled events during style
+        reclaculation. Changes to the zoom property result in scroll events
+        being generated during style recalc, and those events need to be
+        deferred until the render tree is consistent.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Changed to account for a case in which the
+        post-layout tasks trigger a nested layout, which reactivates the
+        post-layout task timer.
+
+2009-03-01  Ross Boucher  <rboucher@gmail.com>
+
+        Alphabetically sort scripts in the Script's panel file popup menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23395
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/utilities.js:
+        (insertionIndexForObjectInListSortedByFunction):
+        (indexOfObjectInListSortedByFunction):
+
+2009-03-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Pass securityOrigin->host() instead of securityOrigin->domain() to WebInspector
+        when creating databases, localStorage or sessionStorage. Changing document.domain
+        should have no affect on databases, localStorage and sessionStorage in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23844
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addDOMStorageScriptResource):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+
+2009-03-01  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Avoid leaking errors when reporting GIO errors.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+
+2009-03-01  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fixes crash when the GIO backend is given the URI for a directory.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::networkErrorForFile):
+
+2009-02-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24261
+        Fix V8 custom binding scrubbing error.
+
+        Test: fast/dom/TreeWalker/TreeWalker-currentNode.html
+        Test: traversal/exception-forwarding.html
+        TesT: traversal/stay-within-root.html
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8): Replace v8::Undefined() return value with v8::Null().
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8): Ditto.
+
+2009-02-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24261
+        Fix V8 custom binding scrubbing error.
+
+        Test: fast/dom/CSSStyleDeclaration/css-properties-case-sensitive.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyName):  Remove dubious checks, left over from
+            incomplete conversion of parameter from pointer to pass-by-ref.
+        (WebCore::NAMED_PROPERTY_GETTER): Initialize parameter.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+
+2009-02-28  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24263
+        [GTK] ref ResourceHandle until we are finished with it
+
+        Add a ref to the ResourceHandle in startHttp so we can keep it
+        alive untill all callbacks have been executed, and unref it when
+        soup tells us it's done with the SoupMessage (in
+        finishedCallback). Fixes a number of crashes when calling
+        didReceiveData whould crash because of the handle dying.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::ResourceHandle::startHttp):
+
+2009-02-28  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24226
+        [SOUP] HTTP status text is never set
+
+        Set HTTP status text to SoupMessage reason_phrase.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-02-28  Dan Bernstein  <mitz@apple.com>
+
+        - fix malformed project file
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-02-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23848
+          <rdar://problem/6573250> REGRESSION: Crash when mouse cursor moves over a link on www.opportuno.de
+
+        Test: fast/layers/inline-dirty-z-order-lists.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): Moved the code that dirties a
+        layer's and its stacking context's z-order lists when the layer's
+        z-index or visibility change from here...
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange): ...to here, so that
+        it will apply to RenderInline too.
+
+2009-02-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Don't include TextResourceDecoder.h in Document.h
+
+        This undoes inlining of Document::displayStringModifiedByEncoding() to avoid world rebuilds
+        when TextResourceDecoder.h is modified. Performance impact is expected to be negligible.
+
+        * dom/Document.cpp:
+        (WebCore::Document::displayStringModifiedByEncoding):
+        (WebCore::Document::displayBufferModifiedByEncoding):
+        * dom/Document.h:
+        * WebCore.base.exp:
+
+2009-02-27  Matt Pennig  <pennig@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Resolves: https://bugs.webkit.org/show_bug.cgi?id=24107
+        "Fixed elements have 0 as an offsetLeft property"
+        
+        Code also brings offsetLeft/Top in full conformance with the spec.
+        Added two tests, one for fixed-position elements, and one for <html>.
+        
+        Tests: fast/dom/Element/fixed-position-offset-parent.html
+               fast/dom/Element/offsetLeft-offsetTop-html.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::offsetLeft):
+        (WebCore::RenderBoxModelObject::offsetTop):
+
+2009-02-27  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        renderer()->hasTransform() returns true for elements
+        with perspective, but no transform, so test for transform
+        when hit testing. This fixes ASSERT from
+        https://bugs.webkit.org/show_bug.cgi?id=24252
+
+        Test: transforms/no_transform_hit_testing.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-02-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix scrubbing error -- a reversed condition.
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::clear): Change early exit for empty value, not the opposite.
+
+2009-02-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add confirmMessageFromWorkerObject to WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=24152
+
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::WorkerMessagingProxy::confirmMessageFromWorkerObject):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-02-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Revert r41295, the fix for https://bugs.webkit.org/show_bug.cgi?id=24227 
+        because it leads to assertion failures in the Mac port.
+        
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Image.h:
+        (WebCore::Image::mayFillWithSolidColor):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-02-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20249
+
+        Add a preference to allow universal access from local URLs to mitigate
+        some attacks.  Some clients still want to allow this access, so we
+        expose this as a preference.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAllowUniversalAccessFromFileUrls):
+        * page/Settings.h:
+        (WebCore::Settings::allowUniversalAccessFromFileUrls):
+
+2009-02-27  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24229
+        If an image has no alpha channel there is no reason to use SourceOver.
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+
+2009-02-27  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Eric Seidel and Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24227
+        Ensure that the checkForSolidColor() optimization is correctly triggered
+        for all cases of drawPattern.  Currently, the optimization was not triggered
+        when the check had not been previously performed via a request for the
+        image's NativeImagePtr.
+
+        Implement the Qt version of the checkForSolidColor() method.  Combined with
+        the bug fix this reduces the time it takes to draw a repeating background
+        of a 1x1 image from ~50msecs to ~0msecs on my machine.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Image.h:
+        (WebCore::Image::mayFillWithSolidColor):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-02-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Zack Rusin.
+
+        Added support for gradients and pattern on Fonts for Qt.
+
+        [Qt] gradients and patterns for FontQt
+        https://bugs.webkit.org/show_bug.cgi?id=24243
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-02-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WorkerContextProxy::create in WorkerMessagingProxy.cpp should only be provided for non-Chromium platform.
+        https://bugs.webkit.org/show_bug.cgi?id=24113
+
+        * workers/WorkerMessagingProxy.cpp:
+
+2009-02-27  Yael Aharon  <yael.aharon@nokia.com>
+
+        Added a refresh button to storage views.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24040
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._refreshButtonClicked):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        (WebInspector.DatabaseTableView.prototype.get statusBarItems):
+        (WebInspector.DatabaseTableView.prototype._refreshButtonClicked):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.get statusBarItems):
+        (WebInspector.DatabasesPanel.prototype.reset):
+        (WebInspector.DatabasesPanel.prototype.showDatabase):
+        (WebInspector.DatabasesPanel.prototype.showDOMStorage):
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        * inspector/front-end/inspector.css:
+
+2009-02-27  Yael Aharon  <yael.aharon@nokia.com>
+
+        Added support for editing/deleting localStorage and sessionStorage items
+        directly from Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23866.
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/DOMStorageDataGrid.js: Added.
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._ondblclick):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.get statusBarItems):
+        (WebInspector.DatabasesPanel.prototype.reset):
+        (WebInspector.DatabasesPanel.prototype.showDOMStorage):
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-02-26  Brett Wilson  <brettw@chromium.org>
+
+        Fix Windows transparency for the Chromium port. Implement a helper
+        class for handling transparency on Windows. It allows semitransparent
+        ClearType and semitransparent form controls by making new layers in the
+        background.
+
+        It also replaces the "ThemeHelper" which allows better
+        scaling and transforms on Windows form controls. In addition to the
+        functionality that the ThemeHelper did, but additionally handles the
+        antialiasing properly so that the form controls aren't composited on a
+        white square.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24101
+
+        Reviewed by Eric Seidel.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::drawGlyphs):
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/ThemeHelperChromiumWin.cpp:
+        * platform/graphics/chromium/ThemeHelperChromiumWin.h:
+        * platform/graphics/chromium/TransparencyWin.cpp: Added.
+        (WebCore::):
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        (WebCore::TransparencyWin::OwnedBuffers::destBitmap):
+        (WebCore::TransparencyWin::OwnedBuffers::referenceBitmap):
+        (WebCore::TransparencyWin::OwnedBuffers::canHandleSize):
+        (WebCore::TransparencyWin::TransparencyWin):
+        (WebCore::TransparencyWin::~TransparencyWin):
+        (WebCore::TransparencyWin::init):
+        (WebCore::TransparencyWin::computeLayerSize):
+        (WebCore::TransparencyWin::setupLayer):
+        (WebCore::TransparencyWin::setupLayerForNoLayer):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupLayerForTextComposite):
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        (WebCore::TransparencyWin::setupTransform):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        (WebCore::TransparencyWin::setupTransformForUntransform):
+        (WebCore::TransparencyWin::setupTransformForScaleTransform):
+        (WebCore::TransparencyWin::setTextCompositeColor):
+        (WebCore::TransparencyWin::initializeNewContext):
+        (WebCore::TransparencyWin::compositeOpaqueComposite):
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/chromium/TransparencyWin.h: Added.
+        (WebCore::TransparencyWin::):
+        (WebCore::TransparencyWin::context):
+        (WebCore::TransparencyWin::platformContext):
+        (WebCore::TransparencyWin::drawRect):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumWin::paintButton):
+        (WebCore::RenderThemeChromiumWin::paintMenuList):
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+
+2009-02-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24211
+        Add ScheduledAction for V8.
+
+        * bindings/v8/ScheduledAction.cpp: Added.
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h: Added.
+        (WebCore::ScheduledAction::ScheduledAction):
+
+2009-02-27  Zack Rusin  <zack@kde.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Qt: be more reasonable about scrolled lines
+
+        cMouseWheelPixelsPerLineStep is currently a constant set to 13.3. it doesn't
+        match our metrics meaning that Qt scrolls by ~2 lines by default which is quite
+        irritating. so lets scroll vertically by the Qt set number of lines * Qt default
+        single step scroll
+
+        * platform/qt/WheelEventQt.cpp:
+
+2009-02-27  Xan Lopez  <xan@gnome.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24222
+        [GTK] Remove checks for old glib versions
+
+        libsoup, which is a hard dependency, needs at least glib 2.15.3,
+        so remove all glib checks for versions older than that.
+
+        * platform/gtk/ContextMenuGtk.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::ContextMenuItem::setSubMenu):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::retainPlatformWidget):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+
+2009-02-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for Gradients and Patterns on filled or stroked Fonts
+        in Cairo. I also added support for globalAlpha on FontCairo.
+
+        [CAIRO] SVG/Canvas fonts miss gradients/pattern support
+        https://bugs.webkit.org/show_bug.cgi?id=18617
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-02-26  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23957
+
+        Fix for SVG gradient and pattern text for Chromium/skia. 
+        Added accessors for the fill and stroke gradients to
+        GraphicsContext.  Changed the paintSkiaText function to take a
+        GraphicsContext, so we can check for gradients/patterns. 
+        Changed the skiaDrawText function to set the SkPaint shader
+        correctly, and to scale up the gradient shader matrix to
+        encompass the entire text string.  Also offset each glyph
+        separately, rather than transforming the canvas, so that the
+        gradient/pattern stays fixed relative to the text origin.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::getFillGradient):
+        (WebCore::GraphicsContext::getStrokeGradient):
+        (WebCore::GraphicsContext::getFillPattern):
+        (WebCore::GraphicsContext::getStrokePattern):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::skiaDrawText):
+        (WebCore::paintSkiaText):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2009-02-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24208
+        Add custom V8 bindings for Navigator, Clipboard, Document, and Node.
+
+        * bindings/v8/custom/V8ClipboardCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-26  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix for building with GNOME Keyring enabled.
+
+        * platform/network/soup/webkit-soup-auth-dialog.c:
+        (show_auth_dialog):
+
+2009-02-26  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16947
+        [GTK] Missing HTTP Auth challenge
+
+        Add HTTP authentication dialog with optional GNOME Keyring
+        storage.
+
+        * GNUmakefile.am:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::currentToplevelCallback):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::ResourceHandle::start):
+        * platform/network/soup/webkit-soup-auth-dialog.c: Added.
+        (webkit_soup_auth_dialog_class_init):
+        (webkit_soup_auth_dialog_init):
+        (webkit_soup_auth_dialog_session_feature_init):
+        (free_authData):
+        (set_password_callback):
+        (response_callback):
+        (show_auth_dialog):
+        (find_password_callback):
+        (session_authenticate):
+        (attach):
+        * platform/network/soup/webkit-soup-auth-dialog.h: Added.
+
+2009-02-25  Ojan Vafai  <ojan@chromium.org> and Eric Seidel <eric@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        After Ojan's positionForCoordinates fix http://trac.webkit.org/changeset/41191
+        svg/custom/pointer-events-image.svg and svg/custom/pointer-events-text.svg
+        started failing because Ojan's new code was now *correctly* calling through to
+        SVG asking for the closest text offset in the last line box, instead of
+        just returning the offset at the end of the last line box when clicking below a box.
+
+        But!  The SVG code was wrong, in that it returned the character offset of the last
+        character when you asked for a character offset after the end of the box, instead
+        it should return the offset *after* the last character.  This patch fixes
+        that behavior by reordering the last two clauses in svgCharacterHitsPosition.
+
+        The SVG positionForCoordinates function is still wrong, and I've added some FIXMEs
+        to document what's wrong.  I've also cleaned up the code a bit so it's clearer
+        what it is doing (which also makes more obvious what's wrong with it).
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForCoordinates):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::SVGInlineTextBoxClosestCharacterToPositionWalker):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::offsetOfHitCharacter):
+        (WebCore::SVGInlineTextBox::closestCharacterToPosition):
+        (WebCore::SVGInlineTextBox::svgCharacterHitsPosition):
+
+2009-02-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Minor cleanup of ChromiumBridge:
+        Removing unused matchesMIMEType method and s/Javascript/JavaScript/
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+
+2009-02-26  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Fix text-bottom vertical alignment.  It was incorrectly aligning the bottom of the descent instead of including
+        the line-height below the descent.
+
+        Added fast/inline/vertical-align-text-bottom.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition):
+
+2009-02-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make SVG Masking platform independet with the use of ImageBuffer::getImageData(),
+        ImageBuffer::putImageData() and GraphicsContext::clipToImageBuffer(). Every platform has
+        just to implement this three methods to support SVG Masking now.
+ 
+        Make SVG Masking platform aware
+        https://bugs.webkit.org/show_bug.cgi?id=19243
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/cairo/SVGResourceMaskerCairo.cpp: Removed.
+        * svg/graphics/cg/SVGResourceMaskerCg.cpp: Removed.
+        * svg/graphics/cg/SVGResourceMaskerCg.mm: Removed.
+        * svg/graphics/qt/SVGResourceMaskerQt.cpp: Removed.
+        * svg/graphics/skia/SVGResourceMaskerSkia.cpp: Removed.
+
+2009-02-26  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler, Antti Koivisto and Alexey Proskuryakov.
+
+        Test: http/tests/misc/slow-preload-cancel.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=24133
+        Clear all pending preloads in the DocLoader object when we decide to
+        cancel its all requests.
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::clearPendingPreloads):
+        * loader/DocLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::cancelRequests):
+
+2009-02-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24182
+        Add NodeFilter, NodeIterator, and TreeWalker custom V8 bindings.
+
+        * bindings/v8/custom/V8NodeFilterCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp: Added.
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp: Added.
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23500
+        KURL::parse() incorrectly compares its result to original string
+
+        * platform/KURL.cpp: (WebCore::KURL::parse): Take string length into account.
+
+2009-02-26  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Kevin McCullough.
+
+        Manual test for inspector node highlighting.
+
+        * manual-tests/inspector/highlight-nodes.html: Added.
+
+2009-02-16  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23973
+        ScrollView::scrollContents can be invoked during view shutdown.  In
+        this scenario the FrameView::hostWindow method can return NULL, which
+        indicates that the frame/page is being destroyed. This causes a crash
+        when we try to dereference a NULL hostWindow pointer.  Fix is to add a
+        NULL check for this.  
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+
+2009-02-26  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24003
+        Fix a crash caused by unsafe type conversion.
+
+        Test: fast/block/positioning/absolute-in-inline-rtl-4.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+
+2009-02-26  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24202
+        Have drawNodeHighlight clip instead of clearing. This makes it work for
+        both Safari and Chromium since Chromium draws the inspector highlighting
+        in the same buffer as the page.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::quadToPath):
+        (WebCore::drawOutlinedQuad):
+        (WebCore::drawOutlinedQuadWithClip):
+        (WebCore::drawHighlightForBox):
+
+2009-02-26  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein & Darin Adler
+
+        Make sure the border/padding are properly omitted at the start of an inline that is a continuation.
+        
+        Added fast/inline/inline-continuation-borders.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+
+2009-02-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+        
+        Try to fix the wx build after r41218.
+
+        * WebCoreSources.bkl:
+
+2009-02-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19527
+        ASSERTION FAILED: containerA && containerB
+
+        Test: fast/dom/Range/bug-19527.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::isPointInRange):
+        (WebCore::Range::comparePoint):
+        Bring the behavior in line with current Firefox, making it impossible for these methods
+        to pass a null container to compareBoundaryPoints().
+
+2009-02-26  Jonathon Jongsma  <jonathon@quotidian.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20358
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::smallCapsFontData): the small-caps font data
+        should set the computed size rather than the specified size, otherwise
+        the caps just get rendered normal size.
+
 2009-02-26  Benjamin Meyer  <benjamin.meyer@torchmobile.com>
 
         Reviewed by George Staikos.
@@ -419,6 +32634,1248 @@
         * platform/qt/CookieJarQt.cpp:
         (WebCore::setCookies):
 
+2009-02-26  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        make WebKit/Qt compile with SVG disabled
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+
+2009-02-25  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix. Add WebCore/workers to the list of paths
+        searched by the bindings generator perl script.
+
+        * GNUmakefile.am:
+
+2009-02-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add canvas to the list of RenderObjects that can mark a page as
+        visually not empty.
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::RenderHTMLCanvas):
+
+2009-02-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint): Remove assertion fired when child has layer
+        as RenderMedia with controls always has a layer.
+
+2009-02-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=24130
+          <rdar://problem/6618196> Paint very slow when horizontally resizing
+
+        Test: fast/gradients/background-clipped.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Intersect the
+        destination rectangle passed to drawTiledImage() with the dirty
+        rectangle. This makes it more likely for the destination rect to be
+        contained in a single tile rect, which results in a faster code path
+        being taken down the road (just drawing a single tile instead of
+        tiling).
+
+2009-02-25  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix test regressions from positionForCoordinates patch.
+        https://bugs.webkit.org/show_bug.cgi?id=24148
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointWithInlineChildren):
+        Remove ASSERT that placeholder text codepath is hitting.
+
+2009-02-25  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 24143: Crash occurs at WebCore::AccessibilityTable::isTableExposableThroughAccessibility() when applying a link in GMail
+        https://bugs.webkit.org/show_bug.cgi?id=24143
+
+        When an AX object is marked dirty, do not create AX elements while going up the parent chain.
+        Do not allow AXRenderObjects to remove their own IDs from the cache, all the cache to do that work
+        Make sure the AXObjectWrapper's have an object before calling them
+        In AXObjectCache, change get -> getOrCreate. Use get() to only retrieve an element if it exists
+
+        Test: platform/mac-snowleopard/accessibility/table-updating.html
+
+        * WebCore.base.exp:
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::~AXObjectCache):
+        (WebCore::AXObjectCache::get):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::removeAXID):
+        (WebCore::AXObjectCache::handleActiveDescendantChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        * page/AXObjectCache.h:
+        * page/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::parentObject):
+        * page/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::listBoxOptionAccessibilityObject):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * page/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::elementRect):
+        (WebCore::AccessibilityListBoxOption::parentObject):
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::detach):
+        (WebCore::AccessibilityObject::parentObjectIfExists):
+        (WebCore::replacedNodeNeedsCharacter):
+        (WebCore::AccessibilityObject::accessibilityObjectForPosition):
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::firstChild):
+        (WebCore::AccessibilityRenderObject::lastChild):
+        (WebCore::AccessibilityRenderObject::previousSibling):
+        (WebCore::AccessibilityRenderObject::nextSibling):
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::isAttachment):
+        (WebCore::AccessibilityRenderObject::headingLevel):
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::menuForMenuButton):
+        (WebCore::AccessibilityRenderObject::menuButtonForMenu):
+        (WebCore::AccessibilityRenderObject::checkboxOrRadioRect):
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        (WebCore::AccessibilityRenderObject::addRadioButtonGroupMembers):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::observableObject):
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * page/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::setRenderObject):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::headerContainer):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObjectForSection):
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::isTableRow):
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        * page/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postNotificationToElement):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (AXLinkElementForNode):
+        (nsStringForReplacedNode):
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]):
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper _accessibilityParentForSubview:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+
+2009-02-25  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Re-working of <rdar://problem/6487249> repro crash in 
+        WebCore::CSSParser::parseFillImage copying entire contents of this 
+        page
+        -and corresponding: https://bugs.webkit.org/show_bug.cgi?id=24172
+
+        Fixes a bunch of layout test failures I caused!
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseContent):
+        (WebCore::CSSParser::parseFillImage):
+        (WebCore::CSSParser::parseFontFaceSrc):
+        (WebCore::CSSParser::parseBorderImage):
+
+2009-02-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24174
+        Add more V8 custom bindings.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp: Added.
+        (WebCore::hasCSSPropertyNamePrefix):
+        (WebCore::cssPropertyName):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8DOMStringListCustom.cpp: Added.
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8EventCustom.cpp: Added.
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_DELETER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Added.
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NodeListCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+
+2009-02-25  Scott Violet  <sky@google.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24171
+        Provides a RenderTheme method for getting the scroll bar size and
+        changes RenderListBox to use it. RenderTheme returns a size of regular,
+        and Mac's override to return small. Changes ScrollbarThemeChromium to
+        use the scrollbarsize of the scrollbar when getting the size
+        instead of passing in no-args.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect):
+        (WebCore::ScrollbarThemeChromium::buttonSize):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::createScrollbar):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::scrollbarControlSizeForPart):
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        * rendering/RenderThemeMac.h:
+        (WebCore::RenderThemeMac::scrollbarControlSizeForPart):
+
+2009-02-25  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6487249> repro crash in 
+        WebCore::CSSParser::parseFillImage copying entire contents of this 
+        page
+        -and corresponding: https://bugs.webkit.org/show_bug.cgi?id=24172
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Null-check m_styleSheet
+
+2009-02-25  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro:
+
+2009-02-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Not reviewed.
+
+        Add files to the build per r41218.
+        Rename WebkitPoint.h to WebKitPoint.h in DOMWindow.cpp
+
+        * GNUmakefile.am:
+        * page/DOMWindow.cpp:
+
+2009-02-25  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24043
+        When faced with URLs with unsupported protocol on Gtk port,
+        report the error through an idle function and return true, so
+        a proper resource handle is created.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::reportUnknownProtocolError):
+        (WebCore::ResourceHandle::start):
+
+2009-02-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Use struct to forward declare ResourceRequest.
+
+        * history/HistoryItem.h:
+        * inspector/InspectorController.h:
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.h:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/ThreadableLoader.h:
+        * loader/WorkerThreadableLoader.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * xml/XMLHttpRequest.h:
+
+2009-02-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Partial Windows build fix.
+        
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-25  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Ported arcTo to Qt. Qt has no native support for arcTo. This changes
+        calculate the behavior of arcTo and draws it with lineTo and arc.
+
+        [QT] implement Canvas arcTo
+        https://bugs.webkit.org/show_bug.cgi?id=23873
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArcTo):
+
+2009-02-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Remove idl files from Resources, and sort.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-02-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23943
+
+        Added webkitConvertPointFromNodeToPage and webkitConvertPointFromPageToNode on
+        the window object. Also added WebKitPoint object, which is passed in and out
+        of these functions.
+
+        Test: fast/dom/Window/webkitConvertPoint.html
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseWebKitPoint):
+        (setJSDOMWindowBaseWebKitPoint):
+        * bindings/js/JSWebKitPointConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        (WebCore::constructWebKitPoint):
+        (WebCore::JSWebKitPointConstructor::getConstructData):
+        * bindings/js/JSWebKitPointConstructor.h: Added.
+        (WebCore::JSWebKitPointConstructor::classInfo):
+        * dom/Node.cpp:
+        (WebCore::Node::convertToPage):
+        (WebCore::Node::convertFromPage):
+        * dom/Node.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitConvertPointFromNodeToPage):
+        (WebCore::DOMWindow::webkitConvertPointFromPageToNode):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/WebKitPoint.h: Added.
+        (WebCore::WebKitPoint::create):
+        (WebCore::WebKitPoint::x):
+        (WebCore::WebKitPoint::y):
+        (WebCore::WebKitPoint::setX):
+        (WebCore::WebKitPoint::setY):
+        (WebCore::WebKitPoint::WebKitPoint):
+        * page/WebKitPoint.idl: Added.
+
+2009-02-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove "#if ENABLE(WORKERS)" wrap from CrossThreadCopier files.
+        https://bugs.webkit.org/show_bug.cgi?id=24145
+
+        * platform/CrossThreadCopier.cpp:
+        * platform/CrossThreadCopier.h:
+
+2009-02-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23688: ThreadableLoader needs a sync implementation for Workers.
+        <https://bugs.webkit.org/show_bug.cgi?id=23688>
+
+        No observable change in behavior, so no test.
+
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::clearClient):
+        (WebCore::ThreadableLoaderClientWrapper::done):
+        (WebCore::ThreadableLoaderClientWrapper::didFinishLoading):
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        (WebCore::ThreadableLoaderClientWrapper::didFailRedirectCheck):
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        Expose whether the loader is done (based on what callbacks were done).
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        Each loader is given its own mode so that only its callbacks get through the run loop.
+
+        The xhr spec says that the readystatechange events are synchronous, so in the case of a
+        nested sync xhr no readystatechange events should be fired for the outer xhr.
+
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        (WebCore::WorkerThreadableLoader::done):
+
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        * workers/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::createUniqueId):
+        Simple method to create a uniqueId on demand with respect to the run loop.
+
+        * workers/WorkerThread.h:
+
+2009-02-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24089: ThreadableLoader::loadResourceSynchronously should do callbacks like the async code.
+        <https://bugs.webkit.org/show_bug.cgi?id=24089>
+
+        Make threadable loader callbacks to happen during the sync load call.
+
+        Changes the behavior of sync xhr for insecure redirects in two ways:
+        + Sends an error event instead of an abort event (which is the same as async xhr's behavior).
+        + Throws a network exception which is what other browsers do and what the spec
+        says to do (http://www.w3.org/TR/XMLHttpRequest/).
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::loadRequestSynchronously):
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::didFail):
+        (WebCore::XMLHttpRequest::didFailRedirectCheck):
+        * xml/XMLHttpRequest.h:
+
+2009-02-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23368
+
+        Added logic to correctly hit test accelerated layers.
+
+        Tests: animations/animation-hit-test-transform.html
+               animations/animation-hit-test.html
+               transitions/transition-hit-test-transform.html
+               transitions/transition-hit-test.html
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateClipRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2009-02-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24067
+        REGRESSION: Crash in WebCore::Document::initSecurityContext
+
+        The crash started to happen when we removed a check for frame->document() being null.
+        However, the original document shouldn't be null here, because it is needed to alias
+        security origins. So, this patch fixes the crash by correcting security origin behavior.
+
+        Test: http/tests/security/aboutBlank/window-open-self-about-blank.html
+        This tests for not crashing, and for inheriting the domain from the document being replaced.
+        Preserving the aliasing cannot be tested for automatically, because we'd need a non-trivial
+        domain to remove a prefix from.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::begin): Create a new document before
+        clearing the frame, so that Document::initSecurityContext() could access the old one.
+
+2009-02-25  Jay Campan  <jcampan@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24066
+
+        Items in drop-downs were not painted correctly.  Makes sure the
+        PopupListBox invalidates in the coordinates of the window as this is
+        FramelessScrollView::invalidateRect paints to.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::invalidateRow):
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        https://bugs.webkit.org/show_bug.cgi?id=15081
+        
+        Make display:none work for applet, emebed and object elements
+        by calling rendererIsNeeded() on superclasses.
+
+        Tests: fast/replaced/applet-display-none.html
+               fast/replaced/embed-display-none.html
+               fast/replaced/object-display-none.html
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::rendererIsNeeded):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::rendererIsNeeded):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24137
+        
+        Fix localToAbsolute() and absoluteToLocal() to map points through 3d transforms,
+        taking perspective and transform-style: preserve-3d into account.
+        
+        In order to support transform-style: preserve-3d, which keeps elements in a
+        3d space, we have to carry along an accumulated matrix in TransformState.
+        We also need to apply the perspective from the parent, if any, with the
+        appropriate origin.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::translate3d):
+        (WebCore::TransformationMatrix::translateRight3d):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToAbsolutePoint):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::perspectiveTransform):
+        (WebCore::RenderLayer::perspectiveOrigin):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::requiresCompositingLayerForTransform):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::mapLocalToAbsolutePoint):
+        (WebCore::RenderObject::mapAbsoluteToLocalPoint):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::mapLocalToAbsolutePoint):
+        (WebCore::RenderTableCell::mapAbsoluteToLocalPoint):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::mapLocalToAbsolutePoint):
+        (WebCore::RenderView::mapAbsoluteToLocalPoint):
+        * rendering/RenderView.h:
+        * rendering/TransformState.cpp: Added.
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::applyTransform):
+        (WebCore::TransformState::flatten):
+        * rendering/TransformState.h: Added.
+        (WebCore::TransformState::):
+        (WebCore::TransformState::TransformState):
+        (WebCore::TransformState::move):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasPerspective):
+
+2009-02-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23990
+        Regression (r40837): JavaScript image popup doesn't work
+
+        Make the getClientRects and getBoundingClientRect methods return rects
+        relative to the viewport.
+
+        Test: fast/dom/getBoundingClientRect-getClientRects-relative-to-viewport.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+
+2009-02-24  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG pages don't have a body or an html element! 
+        Don't return early if there is no body.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+
+2009-02-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=23740, painting order wrong for normal flow elements with overflow: hidden
+        
+        This patch reworks the painting of overflow.  There is now the concept of a "self-painting layer."  All
+        layers are considered to be self-painting except for overflow layers that are normal flow (and that don't have
+        reflections or masks).
+        
+        If an overflow layer is not self-painting, then it ends up painted by its parent just like any other normal flow object.
+        The only difference is that the clip has to be pushed and popped when painting the object's children.
+        
+        The lightweight clipping scheme used for controls has been extended to cover overflow now in this simplified case.  With
+        the code consolidated into reusable push/pop functions, all of the renderers that use overflow have been patched to
+        use the new functions.
+        
+        Hit testing has also been patched to check the overflow clip rect first before recurring into children.
+        
+        Scrollbar paint has been moved into RenderBlock for now, since none of the table objects support scrollbars
+        yet, and scrollbar hit testing was already there anyway.  Now the two code paths are more symmetrical.
+        
+        Masks are now treated like normal flow layers (just like reflections).
+
+        A couple of test cases have been added to fast/overflow to test the stacking order. 
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::paintObject):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::hasSelfPaintingLayer):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint):
+        (WebCore::RenderTable::paintObject):
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::nodeAtPoint):
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paint):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        (WebCore::writeLayers):
+
+2009-02-24  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Attempted build fix for wx-mac.
+
+        * WebCoreSources.bkl:
+
+2009-02-24  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Attempted build fixes for qt-linux and wx-mac.
+
+        * WebCore.pro:
+        * webcore-base.bkl:
+
+2009-02-24  Ojan Vafai  <ojan@dhcp-172-31-134-214.sfo.corp.google.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix null pointer error. If the node is the Document, then ownerDocument() 
+        returns null, document() does not.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+
+2009-02-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (attempted build fixes).
+
+        Fix build break for Windows and Linux.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24131
+        Fix-up COM/RefCounted dichotomy in Chromium port.
+
+        * page/chromium/AccessibilityObjectWrapper.h:
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper): Added
+        explicit setting of recount.
+
+2009-02-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24141
+        Add clarity to V8 interceptor helper function.
+
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Renamed to notHandledByInterceptor.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_GETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_SETTER): Ditto.
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Minor numeric cleanup: convert float literals to doubles.
+        
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+
+2009-02-24  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24139
+        Add missing include.
+
+        * bindings/v8/ScriptInstance.h:
+
+2009-02-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move worker related files from dom directory to worker directory under WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=24123
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/MigrateIDLAndScripts:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/CrossThreadCopier.cpp: Renamed from WebCore/dom/CrossThreadCopier.cpp.
+        * platform/CrossThreadCopier.h: Renamed from WebCore/dom/CrossThreadCopier.h.
+        * workers/GenericWorkerTask.h: Renamed from WebCore/dom/GenericWorkerTask.h.
+        * workers/Worker.cpp: Renamed from WebCore/dom/Worker.cpp.
+        * workers/Worker.h: Renamed from WebCore/dom/Worker.h.
+        * workers/Worker.idl: Renamed from WebCore/dom/Worker.idl.
+        * workers/WorkerContext.cpp: Renamed from WebCore/dom/WorkerContext.cpp.
+        * workers/WorkerContext.h: Renamed from WebCore/dom/WorkerContext.h.
+        * workers/WorkerContext.idl: Renamed from WebCore/dom/WorkerContext.idl.
+        * workers/WorkerContextProxy.h: Renamed from WebCore/dom/WorkerContextProxy.h.
+        * workers/WorkerLocation.cpp: Renamed from WebCore/dom/WorkerLocation.cpp.
+        * workers/WorkerLocation.h: Renamed from WebCore/dom/WorkerLocation.h.
+        * workers/WorkerLocation.idl: Renamed from WebCore/dom/WorkerLocation.idl.
+        * workers/WorkerMessagingProxy.cpp: Renamed from WebCore/dom/WorkerMessagingProxy.cpp.
+        * workers/WorkerMessagingProxy.h: Renamed from WebCore/dom/WorkerMessagingProxy.h.
+        * workers/WorkerObjectProxy.h: Renamed from WebCore/dom/WorkerObjectProxy.h.
+        * workers/WorkerRunLoop.cpp: Renamed from WebCore/dom/WorkerRunLoop.cpp.
+        * workers/WorkerRunLoop.h: Renamed from WebCore/dom/WorkerRunLoop.h.
+        * workers/WorkerThread.cpp: Renamed from WebCore/dom/WorkerThread.cpp.
+        * workers/WorkerThread.h: Renamed from WebCore/dom/WorkerThread.h.
+
+2009-02-05  Ojan Vafai  <ojan@chromium.org> and Eric Seidel <eric@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Make cursor positions match IE6/IE7/FF3 when clicking in margins/padding
+        around divs inside editable regions.
+        https://bugs.webkit.org/show_bug.cgi?id=23605
+
+        Fix clicks outside editable regions from focusing the editable region.
+        https://bugs.webkit.org/show_bug.cgi?id=23607
+
+        Removed editing/selection/contenteditable-click-outside.html as it's
+        not as useful as our new tests.
+
+        Clean up RenderBlock::positionForCoordinates to remove dead code,
+        duplicate code, and generally make it more readable.
+
+        Tests: editing/selection/click-in-margins-inside-editable-div.html
+               editing/selection/click-in-padding-with-multiple-line-boxes.html
+               editing/selection/click-outside-editable-div.html
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries):
+        (WebCore::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::updateFirstLetter):
+
+2009-02-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Related to <rdar://problem/6590295>
+        Allow disabling javascript: urls.
+
+        * WebCore.base.exp:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::setJavaScriptURLsAreAllowed):
+        (WebCore::Page::javaScriptURLsAreAllowed):
+        * page/Page.h:
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on
+        (overflowList() -> normalFlowList()).
+    
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24135
+        
+        Round the FloatPoint returned by absoluteToLocal(), rather than
+        truncating it.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+
+2009-02-24  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24004 REGRESSION: 
+        Ordered list item marker misaligned when line height is not 1.2 
+        -and corresponding <rdar://problem/6602506>
+
+        This is a regression from http://trac.webkit.org/changeset/40880 
+        where createInlineBox was taken off of RenderObject and moved to 
+        RenderBox. The problem was that the RenderBox version still needs 
+        to be virtual because there is still an existing implementation in 
+        RenderListMarker. 
+
+        * rendering/RenderBox.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::createInlineBox):
+        * rendering/RenderListMarker.h:
+
+2009-02-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24128
+        Upstream more V8 custom bindings: constructors, XSLTProcessor.
+
+        * bindings/v8/custom/V8DOMParserConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-24  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24090: WorkerThreadableLoader needs to be able to post tasks for a mode.
+        <https://bugs.webkit.org/show_bug.cgi?id=24090>
+
+        No observable change in behavior, so no test.
+
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToWorkerContext):
+        Fixed the bug that m_unconfirmedMessageCount was getting incremented for non-message tasks.
+
+        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerContext):
+
+        * dom/WorkerMessagingProxy.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation):
+        Changed these methods to post task using a mode.
+
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+
+2009-02-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24091
+        <rdar://problem/6468660> Start of redirect chain ends up as master entry in Application Cache
+
+        Test: http/tests/appcache/access-via-redirect.php
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource): Use the URL we ended up with,
+        not the original one.
+
+2009-02-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Change to include WorkerObjectProxy.h instead of WorkerMessagingProxy.h in WorkerContext.cpp and WorkerScriptController.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=24112
+
+        * bindings/js/WorkerScriptController.cpp:
+        * dom/WorkerContext.cpp:
+
+2009-02-23  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6613796> Extended text codecs registered on webview creation
+
+        Comparing a text encoding with string "GBK" ended up constructing
+        TextEncoding("GBK") which in turn initialized all extended
+        text codecs.
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::decode):
+
+2009-02-23  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+
+2009-02-23  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23956: Safari crashes when cloneNode fails (cloning a XML element with an invalid nodeName)
+
+        The crash occurred because Document::cloneNode would call Document::createElementNS. Unfortunately
+        element created with createElement could have a wrong nodeName (createElement sets the string as the
+        localName without checking for a prefix).
+
+        The fix is to call Document::createElement(const QualifiedName&, bool) that will not do any checks on the QualifiedName
+        and will always succeed.
+        Also rolled-out the HTMLElement specialisation of clonedNode as it was equivalent to what is done now (added an ASSERT
+        to ensure that).
+
+        Test: fast/dom/cloneNode.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneNode): Call createElement(const QualifiedName&, bool) instead of createElementNS as it will
+        always return an element.
+
+        * html/HTMLElement.cpp:
+        * html/HTMLElement.h: Removed HTMLElement::clonedNode as it is equivalent to what is now done.
+
+2009-02-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24109
+        Upstream V8 Script abstractions, all except ScriptController.
+
+        * bindings/v8/ScriptCachedFrameData.h: Added.
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::~ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        * bindings/v8/ScriptCallFrame.cpp: Added.
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        (WebCore::ScriptCallFrame::~ScriptCallFrame):
+        (WebCore::ScriptCallFrame::argumentAt):
+        * bindings/v8/ScriptCallFrame.h: Added.
+        (WebCore::ScriptCallFrame::functionName):
+        (WebCore::ScriptCallFrame::sourceURL):
+        (WebCore::ScriptCallFrame::lineNumber):
+        (WebCore::ScriptCallFrame::argumentCount):
+        * bindings/v8/ScriptCallStack.cpp: Added.
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::~ScriptCallStack):
+        (WebCore::ScriptCallStack::at):
+        * bindings/v8/ScriptCallStack.h: Added.
+        (WebCore::ScriptCallStack::size):
+        * bindings/v8/ScriptInstance.cpp: Added.
+        (WebCore::V8ScriptInstance::V8ScriptInstance):
+        (WebCore::V8ScriptInstance::~V8ScriptInstance):
+        (WebCore::V8ScriptInstance::instance):
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptInstance.h: Added.
+        (WebCore::V8ScriptInstance::create):
+        * bindings/v8/ScriptSourceCode.h: Added.
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::isEmpty):
+        (WebCore::ScriptSourceCode::source):
+        (WebCore::ScriptSourceCode::url):
+        (WebCore::ScriptSourceCode::startLine):
+        * bindings/v8/ScriptState.h: Added.
+        (WebCore::ScriptState::hadException):
+        (WebCore::ScriptState::setException):
+        (WebCore::ScriptState::exception):
+        * bindings/v8/ScriptString.h: Added.
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        * bindings/v8/ScriptValue.cpp: Added.
+        (WebCore::ScriptValue::getString):
+        * bindings/v8/ScriptValue.h: Added.
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::operator==):
+        (WebCore::ScriptValue::operator!=):
+        (WebCore::ScriptValue::isNull):
+        (WebCore::ScriptValue::isUndefined):
+        (WebCore::ScriptValue::clear):
+        (WebCore::ScriptValue::~ScriptValue):
+        (WebCore::ScriptValue::v8Value):
+
+2009-02-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24106
+        The Qt port is crashing on exit because the tear down procedure involves
+        the WebCore::InspectorController trying to access the JS execution context
+        for a page that is being deleted.  This patch amends the inspector so
+        that it does not try and access the execution context of the WebCore::Page
+        in the midst of deletion.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+
+2009-02-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24088: ThreadableLoaderClient::didFailWillSendRequestCheck isn't wired up completely for workers and could use a better name.
+        <https://bugs.webkit.org/show_bug.cgi?id=24088>
+
+        No observable change in behavior, so no test.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        * loader/ThreadableLoaderClient.h:
+        (WebCore::ThreadableLoaderClient::didFailRedirectCheck):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::didFailRedirectCheck):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::workerContextDidFailRedirectCheck):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
+        * loader/WorkerThreadableLoader.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XMLHttpRequest.h:
+
+2009-02-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24047: Need to simplify nested if's in WorkerRunLoop::runInMode
+        <https://bugs.webkit.org/show_bug.cgi?id=24047>
+
+        Made a nested if inside of WorkerRunLoop::runInMode a lot simpler by
+        using only MessageQueue::waitForMessageFilteredWithTimeout instead
+        of three different MessageQueue methods.
+
+        No observable change in behavior, so no test.
+
+        * dom/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::operator()):
+        Minor clean-up to able to pass a const ref point for ModePredicate into runInMode.
+        (WebCore::WorkerRunLoop::runInMode):
+        * dom/WorkerRunLoop.h:
+
+2009-02-23  David Hyatt  <hyatt@apple.com>
+
+        In preparation for making layers for multicol objects (so that they can properly split child layers
+        into multiple columns), rename all of the "overflowOnly" and "overflowList" members and functions
+        of RenderLayer to use the term "normal flow" instead.
+
+        Reviewed by Cameron Zwarich
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        (WebCore::RenderLayer::addChild):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::dirtyNormalFlowList):
+        (WebCore::RenderLayer::updateNormalFlowList):
+        (WebCore::RenderLayer::collectLayers):
+        (WebCore::RenderLayer::updateLayerListsIfNeeded):
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isNormalFlowOnly):
+        (WebCore::RenderLayer::normalFlowList):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeLayers):
+
+2009-02-23  David Hyatt  <hyatt@apple.com>
+
+        Fix the stacking order for column rules in multi-column layout.  Column rules should paint as part of the background of an element, just
+        after all other components of the background have been painted.  This allows negative z-index children to still paint on top of the
+        column rules (rather than ending up above the background of the box but behind the column rules).
+
+        Reviewed by Eric Seidel
+
+        Added fast/multicol/column-rules-stacking.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::paintObject):
+        * rendering/RenderBlock.h:
+
+2009-02-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        No testcases have been added or modified since this patch should not result in
+        a behavior change for ports that have layout tests enabled.
+
+        Currently, the implementation of GraphicsContext::drawLineForText amongst
+        the various ports differ in that some of them are honoring the context's
+        strokeStyle when drawing a text-decoration and some of them are not.
+        For instance, Apple's Mac port *does not* honor the context's strokeStyle(),
+        but the Cairo implementation does and has an explicit workaround that
+        sets the strokeStyle() temporarily.
+
+        This patch fixes so that all ports are consistent by explicitly making sure
+        to set the GraphicsContext strokeStyle to SolidStroke whenever
+        painting the text-decoration of an InlineFlowBox or InlineTextBox as these
+        should always use a solid stroke.
+
+        This patch addresses these bugs:
+        https://bugs.webkit.org/show_bug.cgi?id=19364
+        https://bugs.webkit.org/show_bug.cgi?id=15659
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintDecoration):
+
+2009-02-23  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24098
+        Bugs in ClipboardChromium
+
+        Fixes the following bugs in ClipboardChromium:
+        * It's possible for the extension to be empty, resulting in a bad file
+          name, for example, 'foo.' or just '.'.
+        * We weren't restricting the size of the file to MAX_PATH.
+        * We weren't removing characters that are invalid for file system names.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::writeImageToDataObject):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/chromium/ClipboardChromiumLinux.cpp: Added.
+        (WebCore::ClipboardChromium::validateFileName):
+        * platform/chromium/ClipboardChromiumMac.cpp: Added.
+        (WebCore::ClipboardChromium::validateFileName):
+        * platform/chromium/ClipboardChromiumWin.cpp: Added.
+        (WebCore::isInvalidFileCharacter):
+        (WebCore::ClipboardChromium::validateFileName):
+
 2009-02-23  Thiago Macieira  <thiago.macieira@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -427,36 +33884,1522 @@
 
         * platform/qt/RenderThemeQt.h:
 
-2008-12-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+2009-02-23  Xan Lopez  <xan@gnome.org>
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Alexey Proskuryakov.
 
-        The Qt API exposes a global history patch CSSStyleSelector to make API consumers work again
+        https://bugs.webkit.org/show_bug.cgi?id=22624
+        [SOUP][GTK] Need API to get SoupSession from WebKit.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20952
+        Allow to retrieve the Soup session and modify the code to take
+        into account users changing features on it.
 
-        The QtWebKit port made the mistake of exposing a global history. This broke
-        with the addition of PageGroup and LinkHash. This needs to be repaired
-        for Qt4.5.
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
+        (WebCore::setDefaultCookieJar):
+        * platform/network/soup/CookieJarSoup.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::createSoupSession):
+        (WebCore::ensureSessionIsInitialized):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::defaultSession):
 
-        Add a function to LinkHash.cpp that is resolving a URL. Use this
-        function from within CSSStyleSelector to forward the url to the
-        QWebHistoryInterface API.
+2009-02-23  Xan Lopez  <xan@gnome.org>
 
-        It is sad that there is a path within visitedLinkHash which is now
-        doing a memcpy, it is sad to add a PLATFORM(QT) define to CSSStyleSelector
-        and using QtWebKit types within WebCore is a layering violation as well.
+        Reviewed by Alexey Proskuryakov.
 
-        PageGroup::setShouldTrackVisitedLinks is currently not enabled. For
-        Qt4.6 a second version of the QWebHistoryInterface is going to be
-        added which will fix things up.
+        https://bugs.webkit.org/show_bug.cgi?id=22624
+        [SOUP][GTK] Need API to get SoupSession from WebKit.
+
+        Remove CURL support.
+
+        * GNUmakefile.am:
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Test: fast/dom/empty-hash-and-search.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=21147
+        hash property returns incorrect value for links w/o hash
+
+        Make hash() and search() behavior for empty and missing parts match IE and Firefox.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::query): Changed to return query without '?', as it is already done for ref().
+        (WebCore::KURL::prettyURL): Append the query with the question mark.
+
+        * page/Location.cpp:
+        (WebCore::Location::search): Return an empty string if query is empty or missing.
+        (WebCore::Location::hash): Return an empty string for empty hashes, not only missing ones.
+
+        * dom/WorkerLocation.cpp:
+        (WebCore::WorkerLocation::search):
+        (WebCore::WorkerLocation::hash):
+        Match document.location fixes above.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::hash):
+        (WebCore::HTMLAnchorElement::search):
+        Return an empty string for empty and missing parts.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20184
+        SELECT with no name generates invalid query string
+
+        Test: fast/forms/select-no-name.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::appendFormData): Added a check for empty name.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Apply review comments for the previous check-in (forgot to save the file, oops).
+
+        * dom/ContainerNode.cpp: (WebCore::ContainerNode::removeChildren):
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15707
+        Crash when manipulating document from within an iframe onload function
+
+        Test: fast/dom/onload-open.html
+
+        * dom/ContainerNode.cpp: (WebCore::ContainerNode::removeChildren): Protect the container and
+        the current node, because anything can happen when dispatching events.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18970
+        Numerically named input fields cause document.forms loop problems
+
+        Test: fast/forms/numeric-input-name.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: Try index getter before name getter, even if the
+        latter overrides properties.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24059
+        Tokenizer::write() return value is never used
+
+        * dom/Tokenizer.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * dom/XMLTokenizer.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * html/HTMLTokenizer.h:
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::write):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::write):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaTokenizer::write):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::write):
+        * loader/TextDocument.cpp:
+        (WebCore::TextTokenizer::write):
+        Made write() return void, not bool.
+
+2009-02-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for JavaScriptCore changes to timeout checking.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::forbidExecution):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+
+2009-02-21  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23786
+        [Chromium] line-break characters in a complex text are treated as zero-width spaces
+
+        This change prevents the UniscribeHelper class from treating the line-break characters
+        as whitespaces.
+
+        Tests: fast/text/international/bidi-linebreak-001.html
+               fast/text/international/bidi-linebreak-002.html
+               fast/text/international/bidi-linebreak-003.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::adjustSpaceAdvances):
+        Make the UniscribeHelper::adjustSpaceAdvances() function treat all characters in
+        the treatAsSpace() function (e.g. U+0020, U+000A, U+000D, U+00A0) as whitespaces,
+        so does when Chromium renders a simple text.
+
+2009-02-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23940: Use Document::createElement(const QualifiedName&, bool) when creating a known element inside WebCore
+
+        Document::createElement(const QualifiedName&, bool) does not check for the prefix as opposed the the one taking an AtomicString
+        or Document::createElementNS. This is perfectly fine internally because we know the type of element created and the check is
+        unneeded.
+
+        It also removes the use of an ExceptionCode argument which was here only to check that the prefix check was fine. Finally it
+        enables us to use some generated QualifiedName.
+
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * dom/Document.cpp:
+        (WebCore::Document::setTitle):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::createXHTMLParserErrorHeader):
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::createBlockPlaceholderElement):
+        * editing/htmlediting.cpp:
+        (WebCore::createTabSpanElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength):
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry):
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename):
+        (WebCore::FTPDirectoryTokenizer::loadDocumentTemplate):
+        (WebCore::FTPDirectoryTokenizer::createBasicDocument):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocument::createDocumentStructure):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaTokenizer::createDocumentStructure):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure):
+        * loader/TextDocument.cpp:
+        (WebCore::TextTokenizer::write):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::styleForSelectionStart):
+        Document::createElement(const AtomicString&, ...) to Document::createElement(const QualifiedName&, ...) switch.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Re-use langAttr instead of creating a new attribute.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Use the HTMLAnchorElement directly to get rid of the static cast.
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24060
+        Fix up to accommodate for CanvasPixelArray return.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::getImageData): Added an extra data() to call.
+        (WebCore::ImageBuffer::putImageData): Ditto.
+
+2009-02-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=24042
+        Bug 24042: MediaPlayer should cache plug-in proxy
+
+        The changes in https://bugs.webkit.org/show_bug.cgi?id=23917 assume that
+        MediaPlayer will always have created the private media player object before
+        the plug-in is instantiated and calls back with the proxy object. This is not
+        true on all platforms because of threading latency, so MediaPlayer should
+        cache the plug-in proxy so it can pass it to the media engine at a later time.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setPoster): Null media engine implementation of proxy methods.
+        (WebCore::NullMediaPlayerPrivate::deliverNotification): Ditto.
+        (WebCore::NullMediaPlayerPrivate::setMediaPlayerProxy): Ditto.
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_playerProxy.
+        (WebCore::MediaPlayer::load): Pass m_playerProxy to newly created engine.
+        (WebCore::MediaPlayer::setMediaPlayerProxy): Cache m_playerProxy.
+        * platform/graphics/MediaPlayer.h: Declare m_playerProxy.
+
+2009-02-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24063
+        Make it possible for a port to require a user gesture to play/pause an <audio> or <video> element
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):  Rename m_loadRestrictions to m_Restrictions.
+        Initialize m_internalCall.
+        (WebCore::HTMLMediaElement::loadTimerFired): Increment m_internalCall around call to load().
+        (WebCore::HTMLMediaElement::load): Call loadInternal if restrictions check out.
+        (WebCore::HTMLMediaElement::loadInternal): New, guts of old load()
+        (WebCore::HTMLMediaElement::setNetworkState): Fix bug introduced in r40943
+        (WebCore::HTMLMediaElement::play): Call playInternal if restrictions check out.
+        (WebCore::HTMLMediaElement::playInternal): New, guts of old play()
+        (WebCore::HTMLMediaElement::pause): Call pauseInternal if restrictions check out.
+        (WebCore::HTMLMediaElement::pauseInternal): New, guts of old pause()
+        (WebCore::HTMLMediaElement::togglePlayState): Call playInternal/pauseInternal
+        (WebCore::HTMLMediaElement::deliverNotification): Remove unnecessary white space.
+        * html/HTMLMediaElement.h: Rename m_loadRestrictions to m_Restrictions, add m_internalCall,
+        add RequireUserGestureRateChangeRestriction.
+
+2009-02-20  Darin Fisher  <darin@chromium.org>
+
+        Fix build bustage in FileSystemWin.cpp.
+
+        Need to return CString() instead of 0 since there are now two CString
+        constructors that take a pointer type.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openTemporaryFile):
+
+2009-02-20  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23999
+        Change license headers to accurately reflect code history.
+
+        * platform/ContentType.cpp:
+        * platform/ContentType.h:
+
+2009-02-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23999
+        Split off MIME type parsing into its own class.
+
+        * GNUmakefile.am: Added ContentType sources.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * html/HTMLMediaElement.cpp: Changed to use ContentType.
+        (WebCore::HTMLMediaElement::selectMediaURL):
+        * platform/ContentType.cpp: Added.
+        (WebCore::ContentType::ContentType):
+        (WebCore::ContentType::parameter):
+        (WebCore::ContentType::type):
+        * platform/ContentType.h: Added.
+        (WebCore::ContentType::raw):
+        * platform/MIMETypeRegistry.cpp:
+        * platform/MIMETypeRegistry.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load):
+        * rendering/style/ContentData.h: Renamed ContentType to StyleContentType.
+        * rendering/style/RenderStyleConstants.h: Ditto.
+        (WebCore::):
+
+2009-02-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Use CString() instead of 0.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::openTemporaryFile):
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile):
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        When dealing with local files, use a path instead of an URI. GFile
+        has problems decoding URIs with percent signs on them.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Protect the ResourceHandle instance from being destroyed by
+        didReceiveData inside the GIO readCallback call, so that
+        cancelling caused by scripts is handled correctly.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+
+2009-02-20  David Kilzer  <ddkilzer@apple.com>
+
+        Make IconDatabaseNone.cpp compile with -Wunused and pass check-for-exit-time-destructors
+
+        Reviewed by Sam Weinig.
+
+        * loader/icon/IconDatabaseNone.cpp:
+        (WebCore::IconDatabase::defaultDatabaseFilename): Use DEFINE_STATIC_LOCAL().
+        (WebCore::IconDatabase::open): Commented out unused parameter.
+        (WebCore::IconDatabase::setPrivateBrowsingEnabled): Ditto.
+        (WebCore::IconDatabase::iconForPageURL): Ditto.
+        (WebCore::IconDatabase::iconURLForPageURL): Ditto.
+        (WebCore::IconDatabase::defaultIcon): Ditto.
+        (WebCore::IconDatabase::retainIconForPageURL): Ditto.
+        (WebCore::IconDatabase::releaseIconForPageURL): Ditto.
+        (WebCore::IconDatabase::setIconDataForIconURL): Ditto.
+        (WebCore::IconDatabase::setIconURLForPageURL): Ditto.
+        (WebCore::IconDatabase::setEnabled): Ditto.
+        (WebCore::IconDatabase::pageURLMappingCount): Added stub.
+        (WebCore::IconDatabase::retainedPageURLCount): Ditto.
+        (WebCore::IconDatabase::iconRecordCount): Ditto.
+        (WebCore::IconDatabase::iconRecordCountWithData): Ditto.
+
+2009-02-20  David Kilzer  <ddkilzer@apple.com>
+
+        Add comment to generated code when shadowing a built-in object
+
+        Reviewed by Sam Weinig.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added comment to
+        generated code output.
+
+2009-02-20  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24036
+        Keyboard events need disambiguation on the Linux platform too.
+
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+
+2009-02-19  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24046
+
+        Several improvements to CString:
+        1- Make it possible to initialize a CString from a CStringBuffer
+        2- Make it possible to get a CStringBuffer from a CString
+        3- Change CStringBuffer::data() to return a const pointer to ward off mutation
+        4- Remove unused releaseBuffer() methods.
+        5- Make CStringBuffer::create() private to force consumers to get a CStringBuffer from a CString.
+
+        * platform/text/CString.cpp:
+        (WebCore::CString::init):
+        (WebCore::CString::mutableData):
+        (WebCore::CString::newUninitialized):
+        (WebCore::CString::copyBufferIfNeeded):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::data):
+        (WebCore::CStringBuffer::length):
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::mutableData):
+        (WebCore::CString::CString):
+        (WebCore::CString::buffer):
+
+2009-02-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24017
+        Remove some usage of Document in Worker.
+
+        * dom/WorkerContext.h:
+        (WebCore::WorkerContext::userAgent):
+        * dom/Document.cpp:
+        (WebCore::Document::userAgent):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        Added virtual ScriptExecutionContext::userAgent(const KURL&).
+        Document implementation uses FrameLoader::userAgent and
+        WorkerContext receives the string on creation and stores it in a member.
+
+        * dom/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * dom/Worker.h:
+        (WebCore::Worker::create):
+        Instead of Document the Worker constructor now gets a ScriptExecutionContext.
+        Start using some methods on SEC (like completeURL() and userAgent()).
+        For others, explicitly case to Document and add a FIXME.
+        Remove Worker::document() too.
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Holger Freyther.
+
+        Do not set httpStatus to SOUP_STATUS_OK when serving local files
+        to match other ports' behavior, fixing xmlhttprequest test
+        regressions.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::queryInfoCallback):
+
+2009-02-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - WebCore part of fixing https://bugs.webkit.org/show_bug.cgi?id=24027
+          Do not send loader callbacks during CSS styling
+
+        Undo the iChat-specific quirk added in
+        <http://trac.webkit.org/changeset/41071>. Instead, always suspend memory
+        cache client callbacks during attach() and recalcStyle().
+
+        * WebCore.base.exp: Removed
+        Settings::setNeedsIChatMemoryCacheCallsQuirk().
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks): Disable memory
+        cache client callbacks and remember to enable them afterwards if needed.
+        (WebCore::ContainerNode::resumePostAttachCallbacks): Re-enable memory
+        cache client callbacks if they were disabled in
+        suspendPostAttachCallbacks().
+        (WebCore::ContainerNode::attach): Use suspendPostAttachCallbacks() and
+        resumePostAttachCallbacks().
+        * dom/ContainerNode.h: Made suspendPostAttachCallbacks()
+        and resumePostAttachCallbacks() non-static.
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchImageLoadEventsNow): Reverted iChat-specific
+        workaround.
+        * page/Settings.cpp: Removed m_needsIChatMemoryCacheCallsQuirk and
+        related code.
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-02-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Build fix after r41092. Make the memoryUsage method
+        public. It will be shadowed by cf/mac and for curl/soup/qt
+        the implementation from ResourceResponseBase will be used.
+
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::memoryUsage):
+
+2009-02-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6077775> Should be able to specify
+        inactive ::selection color
+
+        This patch makes the ::selction pseudo-element work with
+        the :window-inactive pseudo type. This was, a user can specify a
+        different ::selection style when a window is inactive.
 
         * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
-        * platform/LinkHash.cpp:
-        (WebCore::visitedURL):
-        (WebCore::visitedLinkHash):
-        * platform/LinkHash.h:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionBackgroundColor):
+        (WebCore::RenderObject::selectionForegroundColor):
+
+2009-02-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=24044
+        Update querySelector/querySelectorAll to match the latest spec
+
+        Update querySelector and querySelectorAll to match the latest version
+        of the Selectors API spec.  We now stringify null and undefined to "null"
+        and "undefined" respectively instead of to "".
+
+        Test: fast/dom/SelectorAPI/undefined-null-stringify.html
+
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/Element.idl:
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23732
+        Rework CachedResource overhead accounting to allow platforms to diverge
+        in numbers.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::overheadSize): Changed to ask ResourceResponse
+        for its size and to use actual URL size.
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::size): Added default size method.
+        * platform/network/cf/ResourceResponse.h:
+        (WebCore::ResourceResponse::size): Added Win/CF size method
+        * platform/network/mac/ResourceResponse.h:
+        (WebCore::ResourceResponse::size): Added Mac size method.
+
+2009-02-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        - Fix for <rdar://problem/6604968>
+
+        On Tiger, create an autorelease pool before creating the NSGraphicsContext and drain it immediately
+        after the call to -[NSView displayRectIgnoringOpacity:inContext:].
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-02-19  David Hyatt  <hyatt@apple.com>
+
+        Fix a bug where reflections didn't work properly if opacity was < 1.  Make sure that replaced elements
+        also consider reflections to be part of their visual overflow.  This had already been done for blocks
+        and lines, but it wasn't being done yet for replaced elements.
+
+        Also make sure that when the object being reflected has opacity < 1 that we don't end up popping the outer
+        transparency layer early.  Since the reflected object paints twice, we don't want to end the transparency
+        layer it pushed until we're done painting the real object (rather than the reflection).
+
+        Reviewed by Dan Bernstein
+
+        Added fast/reflections/reflection-masks-opacity.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect):
+        * rendering/RenderReplaced.h:
+
+2009-02-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23980: WorkerRunLoop needs a way to run in a given mode similar to CFRunLoopInMode.
+        <https://bugs.webkit.org/show_bug.cgi?id=23980>
+
+        WorkerRunLoop has the ability to run in a mode which filters the tasks to be run.
+        * When WorkerRunLoop::runInMode is called, only task for that mode will run.
+        * When WorkerRunLoop::run is called (or the default mode is used), then all tasks
+          will run regardless of their posted mode.
+
+        Here's a demonstration of the api:
+
+            RefPtr<NameResolution> nameResolution = NameResolution::create(workerRunLoop);
+
+            //  Internally nameResolution will do workerRunLoop.postTaskForMode(task, "MyCoolMode")
+            //  for any tasks that need to be run during this loop.
+            nameResolution->setTaskMode("MyCoolMode");
+
+            nameResolution->start();
+            while (!nameResolution->done()) {
+                // Only tasks which are posted for "MyCoolMode" will run.
+                workerRunLoop.runInMode(context, "MyCoolMode");
+            }
+
+        No observable change in behavior, so no test.
+
+        * dom/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::ModePredicate):
+        (WebCore::ModePredicate::operator()):
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        (WebCore::WorkerRunLoop::~WorkerRunLoop):
+        (WebCore::WorkerRunLoop::setSharedTimer):
+        (WebCore::WorkerRunLoop::resetSharedTimer):
+        (WebCore::WorkerRunLoop::run):
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::postTask):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * dom/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::Task::create):
+        (WebCore::WorkerRunLoop::Task::mode):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        (WebCore::WorkerRunLoop::Task::Task):
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24034
+        Fix up Selection->VisibleSelection change.
+
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe): Renamed Selection
+        to VisibleSelection.
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24041
+        Correct Skia type conversion issues, fix Chromium Linux build.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs): changed parameters to RGBA32, not WebCore::Color.
+
+2009-02-19  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20531
+        Chromium-part follow-up to the patch landed in r40636
+        for bug 20531.
+        Remove a static member function alternateFamilyName
+        from Chromium's Win/Linux ports of FontCache. In r40636,
+        alternateFamilyName was customized using #ifdef PLATFORM(WIN_OS).
+        So, there's no more need for the static member function per
+        platform.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+
+2009-02-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Call documentWillBecomeInactive() from Document::detach to ensure that
+        media elements are shut down, because they may be kept alive by references
+        from JS past document teardown.
+
+        documentWillBecomeInactive() calls  renderView()->willMoveOffscreen(), so no
+        need to do that in detach() as well.
+
+        We no longer need to call documentWillBecomeInactive() from ~Page() (which
+        was added for <https://bugs.webkit.org/show_bug.cgi?id=21116>), since this
+        supersedes that change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24028
+        Fix up Skia path changes.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::strokePath): Removed illegal indirection.
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::boundingBoxForCurrentStroke): Changed call name.
+
+2009-02-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ignore ports on local URLs. This fixes a regression in
+        fast/loader/file-URL-with-port-number.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24011
+        KURL's setPort doesn't unset port if 0 is given
+
+        Make setPort remove port if 0 is given to it, as promised by the
+        comment in KURL's header.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::setPort):
+
+2009-02-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        - WebCore part of fixing <rdar://problem/6507512> Crash in iChat at CSSStyleSelector::adjustRenderStyle
+
+        The crash results from re-entry into
+        CSSMutableStyleDeclaration::setCssText, which in turn is caused by
+        the first style change causing a cached image to load from the memory
+        cache, causing load delegate dispatch, and iChat's delegate method
+        calling back into WebKit.
+
+        The workaround is to use defer delegate callbacks for memory cache. In
+        this case, deferring callbacks during image load event dispatch was
+        found to be sufficient.
+
+        The crash is a regression. See also the discussion in
+        <https://bugs.webkit.org/show_bug.cgi?id=22521>.
+
+        * WebCore.base.exp: Added
+        Settings::setNeedsIChatMemoryCacheCallsQuirk().
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchImageLoadEventsNow): If the quirk is
+        enabled, defer memory cache callbacks during image load event dispatch.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize
+        m_needsIChatMemoryCacheCallsQuirk.
+        (WebCore::Settings::setNeedsIChatMemoryCacheCallsQuirk): Added this
+        setter.
+        * page/Settings.h:
+        (WebCore::Settings::needsIChatMemoryCacheCallsQuirk): Added this getter.
+
+2009-02-18  Adam Roben  <aroben@apple.com>
+
+        Export WebCore::handCursor and Cursor.h
+
+        Reviewed by John Sullivan.
+
+        * WebCore.base.exp: Added WebCore::handCursor.
+        * WebCore.xcodeproj/project.pbxproj: Made Cursor.h private.
+
+2009-02-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23992
+        REGRESSION: crash on windows loading http://www.stickam.com/liveStreams.do
+
+        Unable to reduce to a layout test.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::contentRenderer):
+
+2009-02-18  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23861
+        Stroke font outlines on chromium linux
+
+        TEST=LayoutTests/svg/custom/pointer-events-text.svg
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-02-18  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23860
+        Resync some graphics/skia files with their chromium counterparts
+
+        This comes from chromium patches <http://codereview.chromium.org/17633>
+        and <http://codereview.chromium.org/17454>
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::fillPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::addPath):
+        (PlatformContextSkia::currentPath):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed.
+
+        Build fix after r41060.
+
+        * GNUmakefile.am:
+
+2009-02-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24005
+        Add an include to fix Chromium build.
+
+        * page/animation/AnimationController.cpp: Add UnusedParam.h include.
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix symbols.filter location, and add other missing files to the
+        autotools build, so that make dist works.
+
+        * GNUmakefile.am:
+
+2009-02-18  Zan Dobersek  <zandobersek@gmail.com>
+
+        Rubber-stamped by Holger Hans Peter Freyther.
+
+        Allow POST method for local requests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Use KURL in startGio instead of passing a string with the URL, so
+        that we can handle removing refs and queries more elegantly. This
+        is fixing more regressions that came from the curl->soup switch.
+
+        Original work by Zan Dobersek.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Implement ResourceHandle::loadResourceSynchronously in ResourceHandleSoup.cpp
+
+        The implementation is needed to have synchronous loading, e.g. for
+        JavaScript interaction. This is fixing various regressions that
+        came from the curl->soup switch.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::run):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2009-02-18  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23989
+
+        Based on a patch by Bo Yang  <techrazy.yang@gmail.com>
+
+        Make the cursor cache global, that's all we really need and
+        otherwise we can miss cursor transitions in some situations (see
+        the bug for one testcase). Also remove some now useless code.
+
+        * platform/Widget.h:
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::setCursor):
+
+2009-02-17  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * loader/FrameLoader.cpp:
+        (WebCore::toPlugInElement): Don't rely on #if being processed before
+        ASSERT.
+
+2009-02-17  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23977: Unnecessary timer related headers in files.
+        <https://bugs.webkit.org/show_bug.cgi?id=23977>
+
+        No observable change in behavior, so no test.
+
+        * dom/Document.cpp:
+        * dom/WorkerRunLoop.cpp:
+        * dom/WorkerRunLoop.h:
+
+2009-02-17  Peter Abrahamsen  <rainhead@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23958
+        <rdar://problem/6587815>
+
+        Updated XMLHttpRequest with new header names from the latest Access
+        Control draft: http://www.w3.org/TR/access-control/
+        - Access-Control-Origin becomes Access-Control-Allow-Origin
+        - Access-Control-Credentials becomes Access-Control-Allow-Credentials
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::accessControlCheck):
+
+2009-02-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add missing constructor used for empty values.
+
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-02-17  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        <rdar://problem/6592446> dynamically updating page doesn't seem to draw when updated
+
+        Need update after callback.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+
+2009-02-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23917
+        Allow a WebKit plug-in to act as a proxy for the <audio> and <video>
+        element.
+
+        * DerivedSources.make: add media element proxy exports to .exp file when feature is defined.
+
+        * WebCore.VideoProxy.exp: New, define the informal protocol exported by a media element proxy.
+
+        * WebCore.xcodeproj/project.pbxproj: Add MediaPlayerProxy.h.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_needWidgetUpdate.
+        (WebCore::HTMLMediaElement::attributeChanged): Don't detach+attach when PLUGIN_PROXY_FOR_VIDEO, the
+        proxy plug-in handles the poster frame.
+        (WebCore::HTMLMediaElement::rendererIsNeeded): New logic for PLUGIN_PROXY_FOR_VIDEO.
+        (WebCore::HTMLMediaElement::createRenderer): Create RenderPartObject when PLUGIN_PROXY_FOR_VIDEO.
+        (WebCore::HTMLMediaElement::attach): Set m_needWidgetUpdate when PLUGIN_PROXY_FOR_VIDEO
+        (WebCore::HTMLMediaElement::load): Don't reallocate MediaPlayer when PLUGIN_PROXY_FOR_VIDEO, we keep the
+        same plug-in for the life of the element.
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged): update m_networkState when media player
+        network state changes to EMPTY, otherwise we can get out of sync with engine.
+        (WebCore::HTMLMediaElement::defaultEventHandler): pass event to widget when PLUGIN_PROXY_FOR_VIDEO
+        (WebCore::HTMLMediaElement::deliverNotification): New, deliver notification from proxy plug-in to
+        media player.
+        (WebCore::HTMLMediaElement::setMediaPlayerProxy): New, pass proxy object to media player.
+        (WebCore::HTMLMediaElement::initialURL): New, return the url from the "src" attr or the appropriate
+        <source> element to be used as the initial url for the proxy.
+        (WebCore::HTMLMediaElement::finishParsingChildren): New, allocate MediaPlayer and update widget.
+        * html/HTMLMediaElement.h: Declare new methods for proxy, add m_needWidgetUpdate.
+        (WebCore::HTMLMediaElement::setNeedWidgetUpdate):
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::attach): Poster image is handled by proxy when PLUGIN_PROXY_FOR_VIDEO.
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Ditto.
+        * html/HTMLVideoElement.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::toPlugInElement): Allow cast if element is <video> or <audio>
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Remove white space.
+        (WebCore::MediaPlayer::setPoster): New, forward call to private player.
+        (WebCore::MediaPlayer::deliverNotification): Ditto.
+        (WebCore::MediaPlayer::setMediaPlayerProxy): Ditto.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::mediaPlayerClient):
+
+        * platform/graphics/mac/MediaPlayerProxy.h: New, defines media player proxy interface.
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart): Change constructor to take Element* instead of Node* as a
+        non-element node doesn't need a renderer
+        * rendering/RenderPart.h: Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject): Ditto.
+        (WebCore::RenderPartObject::updateWidget): Package params for proxy plug-in when element is
+        <video> or <audio>.
+        * rendering/RenderPartObject.h:
+
+2009-02-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23985
+
+        Don't allow legends to be anything but display:block.
+
+        Added fast/forms/inline-ignored-on-legend.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html4.css:
+        * html/HTMLLegendElement.cpp:
+        * html/HTMLLegendElement.h:
+        * rendering/RenderLegend.cpp: Removed.
+        * rendering/RenderLegend.h: Removed.
+        * wml/WMLInsertedLegendElement.cpp:
+        * wml/WMLInsertedLegendElement.h:
+
+2009-02-13  Brett Wilson  <brettw@dhcp-172-22-71-167.mtv.corp.google.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/attachment.cgi?id=27666
+        Fix Chromium build build: forgotten include in RenderObject, sync
+        RenderTheme to the recent changes in RenderObject.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::updatePressedState):
+
+2009-02-17  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22966
+        crash when destroying a webview that opened a page containing <script>
+        tags
+
+        Fix m_group being set to 0 instead of to m_singlePageGroup when
+        GroupName is set to empty
+
+        * page/Page.cpp:
+        (WebCore::Page::setGroupName):
+
+2009-02-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/6386623>
+
+        I made m_numParsedProperties and m_maxParsedProperties unsigned
+        instead of int, and then added an early return from addPropery() if
+        m_maxParsedProperties exceeds the max value.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addProperty):
+        (WebCore::CSSParser::rollbackLastProperties):
+        (WebCore::CSSParser::clearProperties):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::deleteFontFaceOnlyValues):
+        * css/CSSParser.h:
+
+2009-02-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16309
+        HTML5: The third execCommand argument for insert{un}orderedlist should be ignored
+
+        When we originally implemented this command, MSDN documentation said that IE set the
+        id attribute of inserted lists to the third argument to execCommand, but IE doesn't
+        do this nor do any other browsers.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertOrderedList):
+        (WebCore::executeInsertUnorderedList):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::insertList):
+        (WebCore::InsertListCommand::InsertListCommand):
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertListCommand.h:
+        (WebCore::InsertListCommand::create):
+
+2009-02-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - fix <rdar://problem/6561077> REGRESSION (r39634): Unable to select an item in stocks widget with the mouse
+
+        Test: platform/mac/fast/events/pointer-events-dashboard.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Do not apply the
+        pointer-events property in Dashboard backwards compatibility mode,
+        in order to work around misuse of that property by the Stocks widget.
+
+2009-02-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15381
+        execCommand justify modifies the contentEditable node
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Avoid modifying not just
+        the body element, but any root editable element.
+
+2009-02-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 23979: AX: alt tag not returned for <input type="image">
+        https://bugs.webkit.org/show_bug.cgi?id=23979
+
+        Test: accessibility/input-image-alt.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2009-02-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        The ref data is not properly set unless we use the CreateMatrix function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23978
+
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::operator wxGraphicsMatrix):
+
+2009-02-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6516829> FontPlatformData constructor passes NULL to CTFontCopyGraphicsFont and CTFontGetPlatformFont
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontDataCacheKeyTraits::emptyValue): Changed to use the
+        FontPlatformData(float, bool, bool) constructor.
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::createFontPlatformData): Changed to pass a valid
+        NSFont to the FontPlatformData constructor, instead of implicitly
+        passing 0 and then calling setFont().
+        * platform/graphics/mac/FontPlatformData.h: Made the NSFont parameter
+        of the constructor mandatory.
+
+2009-02-15  David Kilzer  <ddkilzer@apple.com>
+
+        Move duplicate caretWidth constants to RenderObject.h
+
+        Reviewed by Dan Bernstein.
+
+        No test since no change in behavior.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect): Removed caretWidth.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect): Ditto.
+        * rendering/RenderObject.h: Added caretWidth definition.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect): Removed caretWidth.
+
+2009-02-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23955
+        V8HTMLPlugInCustom returns undefined, which fools interceptors.
+
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Use deferToInterceptor() return value.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_GETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_SETTER): Ditto.
+
+2009-02-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23954
+        Add V8 custom bindings for CanvasRenderingContext2D.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp: Added.
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-02-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/6583187>
+
+        * page/NavigatorBase.cpp:
+        Handle PPC64 and X86_64 as well.
+
+2009-02-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix broken tokenizer regression test that reflected a lifetime bug
+        in the document.write optimization. The test failure was trivial to
+        reproduce in COLLECT_ON_EVERY_ALLOCATION mode.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite): Convert strings to String rather than passing
+        the pointer and length to SegmentedString. The optimization is thus
+        mostly gone. However, there are two ways to bring it back: 1) Apply
+        the patch that makes UString and String share the same buffers.
+        2) Add a UString feature to SegmentedString; simple to do but might
+        risk slowing down normal document parsing.
+
+2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
+
+        Caught by Darin Adler.
+
+        No reason to check m_tokenizer twice for 0 in a row.
+
+        * dom/Document.cpp:
+        (WebCore::Document::write):
+
+2009-02-13  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Dave Hyatt.
+
+        Take into account y() + height() when calculating getLowerRightCorner.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getLowerRightCorner):
+
+2009-02-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Most of this code was in RenderBox, restore the copyright lines.
+
+        * rendering/RenderBoxModelObject.cpp:
+        * rendering/RenderBoxModelObject.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Get rid of printBoxDecorations, since it is dead code.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderObject.h:
+
+2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23952
+        Add Document::write overload which takes a SegmentedString since this
+        is what the tokenizer expects anyway.  Modified JSHTMLDocument so it once
+        again calls Document::write instead of injecting the string directly into
+        the tokenizer.  This ensures that all document.write's are funneled through
+        one method again, but should still be just as fast for JSHTMLDocumentCustom.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite):
+        * dom/Document.cpp:
+        (WebCore::Document::write):
+        * dom/Document.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Remove updateWidgetPosition on RenderObject.  Change RenderView's set of widgets
+        to have a tighter type: RenderWidget instead of RenderObject.  Devirtualize
+        updateWidgetPosition, since all RenderWidgets (except for applets) are now
+        RenderParts also.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderPart.cpp:
+        * rendering/RenderPart.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::updateWidgetPositions):
+        (WebCore::RenderView::addWidget):
+        (WebCore::RenderView::removeWidget):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::updateWidgetPosition):
+        * rendering/RenderWidget.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Remove isEditable() on RenderObject.  It is dead code.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Add isTextControl() to RenderObject.  Patch call sites thats asked isTextField() || isTextArea() to just use
+        isTextControl() instead.
+
+        Add a toRenderTextControl converter for doing checked casting to RenderTextControls.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updateSelectionRange):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleReplacedElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::selectionStart):
+        (WebCore::HTMLInputElement::selectionEnd):
+        (WebCore::HTMLInputElement::setSelectionStart):
+        (WebCore::HTMLInputElement::setSelectionEnd):
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::selection):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::selectionStart):
+        (WebCore::HTMLTextAreaElement::selectionEnd):
+        (WebCore::HTMLTextAreaElement::setSelectionStart):
+        (WebCore::HTMLTextAreaElement::setSelectionEnd):
+        (WebCore::HTMLTextAreaElement::select):
+        (WebCore::HTMLTextAreaElement::setSelectionRange):
+        (WebCore::HTMLTextAreaElement::appendFormData):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::selection):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isNativeTextControl):
+        (WebCore::AccessibilityRenderObject::text):
+        (WebCore::AccessibilityRenderObject::selectedText):
+        (WebCore::AccessibilityRenderObject::selectedTextRange):
+        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+        (WebCore::AccessibilityRenderObject::visiblePositionForIndex):
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        (WebCore::AccessibilityRenderObject::observableObject):
+        * page/Frame.cpp:
+        (WebCore::Frame::notifyRendererOfSelectionChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isTextControl):
+        (WebCore::objectIsRelayoutBoundary):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isTextControl):
+        (WebCore::toRenderTextControl):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::select):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::isConformedToInputMask):
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Get rid of isEdited/setEdited on RenderObject.  Devirtualize isEdited/setEdited on RenderTextControl.
+        Callers were already asking if the renderer was a text field (or a text area), so it was especially
+        pointless to waste a second virtual function call after making one just to determine the object type.
+
+        Reviewed by Simon Fraser
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+
+2009-02-13  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23934
+        Skia platform doesn't render text decoration shadows.
+
+        Makes Skia render text decoration shadows correctly. We weren't
+        preparing the SkPaint correctly and didn't have a couple of checks
+        CG has. Additionally makes the fillColor/strokeColor methods
+        consistent.
+
+        This behavior is covered by existing layout tests (see bug for list).
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::effectiveFillColor):
+        (PlatformContextSkia::effectiveStrokeColor):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-02-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23944
+        KURLGoogle's pre-parsed canonicalSpec constructor should take a CString
+
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURLGooglePrivate::setUtf8):
+        (WebCore::KURLGooglePrivate::setAscii):
+        (WebCore::KURLGooglePrivate::init):
+        (WebCore::KURLGooglePrivate::replaceComponents):
+        (WebCore::KURL::KURL):
+        * platform/KURLGooglePrivate.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Remove leftmost/rightmost/lowestPosition from RenderObject.  They only need to be called on boxes.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeScrollDimensions):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::lowestPosition):
+        (WebCore::RenderMedia::rightmostPosition):
+        (WebCore::RenderMedia::leftmostPosition):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build with ACCELERATED_COMPOSITING turned on.
+
+        toRenderBox()->x() asserts for a layer on an inline; use
+        m_owningLayer->renderBoxX() instead.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-02-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speed up document.write a bit.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite): Added. Uses SegmentedString to avoid conversion from
+        UString to String and to avoid appending strings. Also added code to handle
+        newlines efficiently.
+        (WebCore::JSHTMLDocument::write): Changed to use documentWrite.
+        (WebCore::JSHTMLDocument::writeln): Ditto.
+
+        * dom/Document.cpp:
+        (WebCore::Document::prepareToWrite): Added. Refactored the initialization part
+        of write into a separate function for use in the JavaScript binding.
+        (WebCore::Document::write): Changed to call prepareToWrite.
+
+        * dom/Document.h: Added declaration for prepareToWrite.
 
 2009-02-13  Prasanth Ullattil  <pullatti@trolltech.com>
 
@@ -472,6 +35415,3645 @@
         * platform/qt/QWebPopup.cpp:
         (WebCore::QWebPopup::hidePopup):
 
+2009-02-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, typo while tweaking last patch for commit.
+
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+        (GetTextExtent):
+
+2009-02-12  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use Cairo/PANGO to fix text measurements and implement proper
+        non-kerned text drawing on wxGTK.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17727
+
+        * platform/graphics/GlyphBuffer.h:
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::fontWeightToWxFontWeight):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/wx/wxcode/fontprops.h:
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        (GetTextExtent):
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+        (WebCore::pangoFontMap):
+        (WebCore::createPangoFontForFont):
+        (WebCore::createScaledFontForFont):
+        (WebCore::pango_font_get_glyph):
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/non-kerned-drawing.h:
+
+2009-02-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23942
+
+        Hook up 3D CSS transforms to the accelerated compositor backend.
+        Not enabled by default.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        (WebCore::ensurePropertyMap):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::willNeedService):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::willNeedService):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::TransformValueList::makeFunctionList):
+        (WebCore::GraphicsLayer::dumpProperties):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::copyTransform):
+        (WebCore::getValueFunctionNameForTransformOperation):
+        (WebCore::GraphicsLayerCA::animateTransform):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::hasTransformStyle3D):
+        (WebCore::RenderLayer::hasPerspective):
+        (WebCore::RenderLayer::perspectiveTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayers):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::computeTransformOrigin):
+        (WebCore::RenderLayerBacking::computePerspectiveOrigin):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::has3DContent):
+        (WebCore::requiresCompositingLayerForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+        * rendering/RenderLayerCompositor.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Get rid of containingBlockHeight(), since it had only one implementation (despite being virtual) and just returned
+        containingBlock()->availableHeight().  The latter reads better anyway.  Rename containingBlockWidth() to
+        containingBlockWidthForContent() and move it to RenderBoxModelObject.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockWidthForContent):
+        (WebCore::RenderBox::calcWidth):
+        (WebCore::RenderBox::calcReplacedWidthUsing):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+        (WebCore::RenderBoxModelObject::containingBlockWidthForContent):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::marginLeft):
+        (WebCore::RenderInline::marginRight):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::calcReplacedWidth):
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix non-Mac builds by adding Matrix3DTransformOperation.* and
+        PerspectiveTransformOperation.*. Cleaned out some cruft in
+        the WebCore.vcproj fle.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-12  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=23935
+        Nested :not() and non-simple selectors in :not() should be invalid
+
+        * css/CSSGrammar.y: Reject nested :not()
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ASSERT() rather than checking, since the parser enforces it now
+
+2009-02-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes.
+
+        * WebCoreSources.bkl:
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build with ACCELERATED_COMPOSITING turned on.
+
+        Need to cast toRenderBox() in order to call overflowClipRect().
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2009-02-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix windows build.
+
+        * css/CSSParser.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Rename getOverflowClipRect and getClipRect to overflowClipRect and clipRect.  Move them to RenderBox, since these methods
+        only apply to boxes.  Devirtualize clipRect, since it was not subclassed.  Move controlClip stuff to RenderBox also.
+
+        Reviewed by Simon Fraser
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overflowClipRect):
+        (WebCore::RenderBox::clipRect):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasControlClip):
+        (WebCore::RenderBox::controlClipRect):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasClip):
+        (WebCore::RenderObject::hasOverflowClip):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::overflowClipRect):
+        * rendering/RenderTable.h:
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build with ACCELERATED_COMPOSITING turned on (simple copy/paste error)
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+
+2009-02-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Not reviewed.
+
+        Release build fix when VIDEO is disabled (it should also
+        help the builds with WORKERS or XSLT disabled).
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseAudio): Added an UNUSED_PARAM for exec and slot when
+        VIDEO is disabled.
+        (jsDOMWindowBaseWorker): Ditto for WORKERS.
+        (jsDOMWindowBaseXSLTProcessor): Ditto for XSLT.
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23923
+        Implement mediaPlayerVolumeChanged so a media engine can report autonomous volume changes.
+        Supporting this requires that we know when we are processing a media engine callback so
+        we don't turn around and tell the media player to change the volume when it is reporting
+        a volume change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): initialize m_processingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged): call begin/endProcessingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::setNetworkState): logic split out of mediaPlayerNetworkStateChanged
+        to make it easier to maintain m_processingMediaPlayerCallback.
+        (WebCore::HTMLMediaElement::mediaPlayerReadyStateChanged): call begin/endProcessingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Ditto.
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint): Ditto.
+        (WebCore::HTMLMediaElement::mediaPlayerVolumeChanged): New
+        (WebCore::HTMLMediaElement::updateVolume): Don't change media engine volume if we are processing
+        a callback from the engine.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::processingMediaPlayerCallback): New, return true if (m_processingMediaPlayerCallback>0)
+        (WebCore::HTMLMediaElement::beginProcessingMediaPlayerCallback): New, increment m_processingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::endProcessingMediaPlayerCallback): New, decrement m_processingMediaPlayerCallback
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Support MPEG content on Mac and Windows.
+        <rdar://problem/5917509>
+        https://bugs.webkit.org/show_bug.cgi?id=23495
+
+        Test: media/audio-mpeg-supported.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks):
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h: fix typo added in r40925
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Move containsFloats, hasOverhangingFloats, shrinkToAvoidFloats and avoidsFloats down to
+        RenderBox, since these methods only apply to boxes.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::calcBlockPrefWidths):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::containsFloats):
+        (WebCore::RenderBlock::hasOverhangingFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::shrinkToAvoidFloats):
+        (WebCore::RenderBox::avoidsFloats):
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isFloatingOrPositioned):
+        * rendering/RenderView.h:
+
+2009-02-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23908
+
+        Added parsing of 3d transform functions and properties
+        (perspective, perspective-origin, transform-style-3d,
+        and backface-visibility).
+
+        Test: transforms/3d/cssmatrix-3d-interface.xhtml
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::computedTransform):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::CSSParser::parseTransformOriginShorthand):
+        (WebCore::TransformOperationInfo::TransformOperationInfo):
+        (WebCore::CSSParser::parseTransform):
+        (WebCore::CSSParser::parseTransformOrigin):
+        (WebCore::CSSParser::parsePerspectiveOrigin):
+        * css/CSSParser.h:
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::convertToLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillSize):
+        (WebCore::CSSStyleSelector::mapFillXPosition):
+        (WebCore::CSSStyleSelector::mapFillYPosition):
+        (WebCore::getTransformOperationType):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * css/CSSValueKeywords.in:
+        * css/WebKitCSSTransformValue.cpp:
+        (WebCore::WebKitCSSTransformValue::cssText):
+        * css/WebKitCSSTransformValue.h:
+        (WebCore::WebKitCSSTransformValue::):
+        * css/WebKitCSSTransformValue.idl:
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
+        * platform/graphics/transforms/Matrix3DTransformOperation.h:
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
+        * platform/graphics/transforms/PerspectiveTransformOperation.h:
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+        * platform/graphics/transforms/RotateTransformOperation.h:
+        (WebCore::RotateTransformOperation::RotateTransformOperation):
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        (WebCore::ScaleTransformOperation::ScaleTransformOperation):
+        * platform/graphics/transforms/TransformOperation.h:
+        (WebCore::TransformOperation::is3DOperation):
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::has3DOperation):
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        (WebCore::TranslateTransformOperation::TranslateTransformOperation):
+
+2009-02-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix.
+
+        * webcore-base.bkl:
+
+2009-02-12  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        Fix potential ref-count or null-deref problems with C++ objects as Obj-C members.
+
+        * platform/mac/SharedBufferMac.mm: Change to use RefPtr<> instead of ref()/deref().
+        (-[WebCoreSharedBufferData dealloc]):
+        (-[WebCoreSharedBufferData finalize]):
+        (-[WebCoreSharedBufferData initWithSharedBuffer:]):
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Remove calcWidth from RenderObject.  Nobody ever called it on RenderObjects.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderObject.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Fix for regression where form controls would paint yellow highlights.  The containsComposition check needs to
+        null check node() now.
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix
+
+        Change Animation::setDirection() to take the new enum value, and fix
+        the single caller.
+
+        Fix build error in MediaPlayerPrivateQTKit.h.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapAnimationDirection):
+        * platform/animation/Animation.h:
+        (WebCore::Animation::setDirection):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Remove the overrideSize methods from RenderObject.  Devirtualize all of the accessors on RenderBox.
+
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.h:
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Darin Adler, Antti Koivisto, Holger Hans Peter Freyther
+
+        Bug 23797: A platform should be able to use more than one media engine for <video> and <audio>
+        https://bugs.webkit.org/show_bug.cgi?id=23797
+
+        * WebCore.xcodeproj/project.pbxproj: add MediaPlayerPrivate.h
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load): selectMediaURL now also returns a MIME type, pass it to
+        MediaPlayer::load so it can choose the right media engine
+        (WebCore::HTMLMediaElement::selectMediaURL): renamed from pickMedia. use MIMETypeRegistry
+        functions to strip params from the url and extract the codecs parameter. call
+        MediaPlayer::supportsType to see if we can open the file since only a media engine can
+        answer questions about supported type+codecs.
+        * html/HTMLMediaElement.h:
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::MIMETypeRegistry::getParameterFromMIMEType): New, find and return a MIME type parameter
+        (WebCore::MIMETypeRegistry::stripParametersFromMIMEType): New, strip all parameters from a MIME type
+        * platform/MIMETypeRegistry.h:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::NullMediaPlayerPrivate):
+        (WebCore::NullMediaPlayerPrivate::load):
+        (WebCore::NullMediaPlayerPrivate::cancelLoad):
+        (WebCore::NullMediaPlayerPrivate::play):
+        (WebCore::NullMediaPlayerPrivate::pause):
+        (WebCore::NullMediaPlayerPrivate::naturalSize):
+        (WebCore::NullMediaPlayerPrivate::hasVideo):
+        (WebCore::NullMediaPlayerPrivate::setVisible):
+        (WebCore::NullMediaPlayerPrivate::duration):
+        (WebCore::NullMediaPlayerPrivate::currentTime):
+        (WebCore::NullMediaPlayerPrivate::seek):
+        (WebCore::NullMediaPlayerPrivate::seeking):
+        (WebCore::NullMediaPlayerPrivate::setEndTime):
+        (WebCore::NullMediaPlayerPrivate::setRate):
+        (WebCore::NullMediaPlayerPrivate::paused):
+        (WebCore::NullMediaPlayerPrivate::setVolume):
+        (WebCore::NullMediaPlayerPrivate::networkState):
+        (WebCore::NullMediaPlayerPrivate::readyState):
+        (WebCore::NullMediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::NullMediaPlayerPrivate::maxTimeBuffered):
+        (WebCore::NullMediaPlayerPrivate::dataRate):
+        (WebCore::NullMediaPlayerPrivate::totalBytesKnown):
+        (WebCore::NullMediaPlayerPrivate::totalBytes):
+        (WebCore::NullMediaPlayerPrivate::bytesLoaded):
+        (WebCore::NullMediaPlayerPrivate::setRect):
+        (WebCore::NullMediaPlayerPrivate::paint):
+        (WebCore::createNullMediaPlayer):
+        Do nothing media player so MediaPlayer doesn't have to NULL check before calling current engine.
+
+        (WebCore::MediaPlayerFactory::MediaPlayerFactory): New, factory constructor.
+        (WebCore::installedMediaEngines): New, returns vector of all installed engines.
+        (WebCore::addMediaEngine): New, add a media engine to the cache.
+        (WebCore::chooseBestEngineForTypeAndCodecs): New, return an engine that might support a MIME type.
+        (WebCore::MediaPlayer::MediaPlayer): create NULL media player so we have a default. Initialize m_currentMediaEngine.
+        (WebCore::MediaPlayer::~MediaPlayer): don't need to delete m_private, it is now an OwnPtr.
+        (WebCore::MediaPlayer::load): Take MIME type as well as url, since we need it to find the right
+          media engine. If no MIME type is provided, try to devine one from the url. Choose a media engine
+          based on the MIME type and codecs parameter.
+        (WebCore::MediaPlayer::currentTime): Remove excess white space.
+        (WebCore::MediaPlayer::supportsType): Take codecs param as well as MIME type. Return enum so we can
+        indicate "maybe" condition.
+        (WebCore::MediaPlayer::getSupportedTypes): Build up list of MIME types by consulting all engines.
+        (WebCore::MediaPlayer::isAvailable): return true if any media engine is installed.
+
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::):
+        (WebCore::MediaPlayer::frameView): accessor function.
+
+        * platform/graphics/MediaPlayerPrivate.h: New, declares abstract interface for media engines.
+        (WebCore::MediaPlayerPrivateInterface::~MediaPlayerPrivateInterface):
+        (WebCore::MediaPlayerPrivateInterface::totalBytesKnown):
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: Add support for engine factory
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::create): New, media engine factory function
+        (WebCore::MediaPlayerPrivate::registerMediaEngine): Register engine with MediaPlayer factory
+        (WebCore::MediaPlayerPrivate::load): URL is a const String.
+        (WebCore::MediaPlayerPrivate::duration): Declare const.
+        (WebCore::MediaPlayerPrivate::naturalSize): Ditto.
+        (WebCore::MediaPlayerPrivate::hasVideo): Ditto.
+        (WebCore::MediaPlayerPrivate::networkState): Ditto.
+        (WebCore::MediaPlayerPrivate::readyState): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::totalBytesKnown): Ditto.
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::supportsType): Return MediaPlayer::SupportsType enum instead of bool.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::create): New, media engine factory function
+        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine): Register engine with MediaPlayer factory
+        (WebCore::MediaPlayerPrivate::createQTMovieView): don't access MediaPlayer->m_frameView directly,
+        use accessor function.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::mimeTypeCache): New.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes): New, media engine factory function.
+        (WebCore::MediaPlayerPrivate::supportsType): return MediaPlayer::SupportsType enum instead of bool
+        (-[WebCoreMovieObserver initWithCallback:]): fix formatting
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::load): URL is a const String.
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::create): New, media engine factory function
+        (WebCore::MediaPlayerPrivate::registerMediaEngine): New, register engine with MediaPlayer factory
+        (WebCore::MediaPlayerPrivate::load): URL is a const String.
+        (WebCore::MediaPlayerPrivate::paint): don't access MediaPlayer->m_frameView directly,
+        use accessor function.
+        (WebCore::mimeTypeCache): New.
+        (WebCore::MediaPlayerPrivateQTWin::getSupportedTypes): New, media engine factory function.
+        (WebCore::MediaPlayerPrivateQTWin::supportsType): return MediaPlayer::SupportsType enum instead of bool
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+2009-02-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/dom/prefixed-image-tag.xhtml
+
+        Bug 23915: Remove setPrefix work-around in Document::createElement(QualifiedName, bool)
+
+        Instead we now directly propage the QualifiedName inside the generated Factory.
+
+        Test: fast/dom/prefixed-image-tag.xhtml
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement): Removed the setPrefix work-around
+        and replaced it with an ASSERT to catch mistakes inside the Factory code.
+        Remove the unneeded ExceptionCode argument.
+
+        (WebCore::Document::createElementNS): Removed ExceptionCode argument.
+        * dom/Document.h: Updated the signature.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs): Removed ExceptionCode argument.
+        * dom/XMLTokenizerQt.cpp: Ditto.
+        (WebCore::XMLTokenizer::parseStartElement): Ditto.
+
+        * dom/make_names.pl: Implemented the QualifiedName propogation logic
+        in the Factory.
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23188
+
+        Define enum values for Animation::direction(), and one for
+        IterationCountInfinite to make the code more self-documenting.
+
+        Order the member vars of Animation to optimize packing.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * platform/animation/Animation.cpp:
+        (WebCore::Animation::Animation):
+        (WebCore::Animation::operator=):
+        (WebCore::Animation::animationsMatch):
+        * platform/animation/Animation.h:
+        (WebCore::Animation::):
+        (WebCore::Animation::direction):
+        (WebCore::Animation::initialAnimationDirection):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+        (WebCore::GraphicsLayerCA::setKeyframeAnimation):
+
+2009-02-12  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Holger Freyther.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp): Don't use O_CLOEXEC for now.
+
+2009-02-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23826: Potential bug with before/after rule while moving element from one document to another
+
+        Moved the document before/after toggle from the constructor to insertedIntoDocument.
+
+        Test: fast/css-generated-content/beforeAfter-interdocument.html
+
+        * html/HTMLQuoteElement.cpp:
+        (WebCore::HTMLQuoteElement::HTMLQuoteElement):
+        (WebCore::HTMLQuoteElement::insertedIntoDocument):
+        * html/HTMLQuoteElement.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23912
+
+        I have no idea why this broke.  As far as I can tell the old code never should have worked in
+        the first place.  Add code to handleWheelEvent that will find an enclosing renderer for a node
+        in order to attempt a wheel scroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent):
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Move the functions that paint borders, box shadows and border images into RenderBoxModelObject.  drawBorder and drawBorderArc, because they are used
+        for outlines as well as borders, need to stay in RenderObject.  Rename them to drawLineForBoxSide and drawArcForBoxSide in order to reflect their
+        more generic use.  Rename the BorderSide struct to BoxSide, since the concept of "side" is just a rectangle concept and not a border concept.
+
+        Reviewed by Simon Fraser
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxShadow):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumns):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        (WebCore::RenderBoxModelObject::paintBorder):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBorderMinusLegend):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        (WebCore::RenderObject::paintOutline):
+        * rendering/RenderObject.h:
+        (WebCore::):
+        (WebCore::RenderObject::hasBoxDecorations):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::CollapsedBorders::addBorder):
+        (WebCore::RenderTableCell::paintCollapsedBorder):
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Bug 18322: video element should have ui when scripting is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=18322
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls): always return 'true' when JavaScript is disabled.
+        * manual-tests/media-controls-when-javascript-disabled.html: Added.
+
+2009-02-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23906
+        Add custom V8 bindings for HTMLPlugInElement.
+
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+2009-02-12  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        [GTK] Soup backend must handle upload of multiple files
+        https://bugs.webkit.org/show_bug.cgi?id=18343
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+        (WebCore::freeFileMapping):
+        (WebCore::ResourceHandle::startHttp): Support multipart request bodies
+        mmap'ing files to be uploaded.
+
+2009-02-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build following r40871 which changed RenderObject::element()
+        into RenderObject::node().
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::getMediaElementFromRenderObject):
+        (WebCore::RenderThemeQt::getMediaControlForegroundColor):
+
+2009-02-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * platform/graphics/transforms/RotateTransformOperation.cpp: Include <algorithm>.
+
+2009-02-12  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Change worker code to use different proxy class pointers.
+        https://bugs.webkit.org/show_bug.cgi?id=23859
+
+        This is a step towards using separate proxies in multi-process implementation.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * dom/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::~Worker):
+        (WebCore::Worker::postMessage):
+        (WebCore::Worker::terminate):
+        (WebCore::Worker::hasPendingActivity):
+        (WebCore::Worker::notifyFinished):
+        (WebCore::Worker::dispatchMessage):
+        * dom/Worker.h:
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::reportException):
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::postMessage):
+        (WebCore::WorkerContext::dispatchMessage):
+        * dom/WorkerContext.h:
+        * dom/WorkerContextProxy.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerContextProxy::create):
+        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy):
+        (WebCore::WorkerMessagingProxy::~WorkerMessagingProxy):
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        (WebCore::postConsoleMessageTask):
+        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * dom/WorkerMessagingProxy.h:
+        * dom/WorkerObjectProxy.h:
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * dom/WorkerThread.h:
+        (WebCore::WorkerThread::workerObjectProxy):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+
+2009-02-12  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23688: ThreadableLoader needs a sync implementation for Workers.
+        <https://bugs.webkit.org/show_bug.cgi?id=23688>
+
+        Add ResourceError to ThreadableLoaderClient.
+
+        No observable change in behavior, so no test.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        (WebCore::DocumentThreadableLoader::didFail):
+        * loader/ThreadableLoaderClient.h:
+        (WebCore::ThreadableLoaderClient::didFail):
+        (WebCore::ThreadableLoaderClient::didFailWillSendRequestCheck):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        (WebCore::workerContextDidFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        * loader/WorkerThreadableLoader.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFail):
+        (WebCore::XMLHttpRequest::didFailWillSendRequestCheck):
+        * xml/XMLHttpRequest.h:
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Fix the build on Leopard with ACCELERATED_COMPOSITING turned on.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        FloatPoint3D needs to be a private header, since it's included by GraphicsLayer.h
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::caValueFunctionSupported):
+        (WebCore::GraphicsLayerCA::setAnchorPoint):
+        (WebCore::GraphicsLayerCA::setPreserves3D):
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+        (WebCore::GraphicsLayerCA::setKeyframeAnimation):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isRootLayer):
+        Fix isRootLayer to return true for the renderView's layer, not the root
+        renderer's layer.
+
+2009-02-11  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23910
+        <rdar://problem/6160546> REGRESSION: In Full page mode, movie controller hides when I drag the knob if movie is playing
+
+        * rendering/RenderMedia.cpp: (WebCore::RenderMedia::forwardEvent):
+        When we get a mouseOut event, consider the mouse as still within the RenderMedia if the relatedTarget is a descendant.
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Remove all of the inline box wrapper functions from RenderObject, since they only apply to RenderBox.  Devirtualize the functions.
+        Patch all of the call sites to convert to a RenderBox.
+
+        Reviewed by Simon Fraser
+
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable):
+        (WebCore::previousRenderedEditable):
+        (WebCore::Position::getInlineBoxAndOffset):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::deleteLine):
+        (WebCore::InlineBox::extractLine):
+        (WebCore::InlineBox::attachLine):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textWithHardLineBreaks):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Eliminate createInlineBox and dirtyLineBoxes from RenderObject.  These functions have been devirtualized.
+        The single call site now calls a helper function that just bit checks and casts before calling the correct
+        type.  RenderBlock's dirtyLineBoxes function was dead code (caused by the RenderFlow deletion), so it has
+        just been removed.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createRootInlineBox):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::createInlineBox):
+        * rendering/RenderBox.h:
+        * rendering/RenderCounter.cpp:
+        * rendering/RenderCounter.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::createInlineFlowBox):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::isSVGText):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::createTextBox):
+        (WebCore::RenderText::createInlineTextBox):
+        * rendering/RenderText.h:
+        * rendering/bidi.cpp:
+        (WebCore::createInlineBoxForRenderer):
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-02-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23905
+
+        Adds support for 3D CSS properties (transform-style-3d, perspective,
+        perspective-origin, and backface-visibility) to RenderStyle and friends
+
+        * platform/graphics/transforms/TransformOperation.h
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        (WebCore::RenderStyle::applyTransform):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::transformOriginZ):
+        (WebCore::InheritedFlags::hasTransformRelatedProperty):
+        (WebCore::InheritedFlags::transformStyle3D):
+        (WebCore::InheritedFlags::backfaceVisibility):
+        (WebCore::InheritedFlags::perspective):
+        (WebCore::InheritedFlags::perspectiveOriginX):
+        (WebCore::InheritedFlags::perspectiveOriginY):
+        (WebCore::InheritedFlags::setTransformOriginZ):
+        (WebCore::InheritedFlags::setTransformStyle3D):
+        (WebCore::InheritedFlags::setBackfaceVisibility):
+        (WebCore::InheritedFlags::setPerspective):
+        (WebCore::InheritedFlags::setPerspectiveOriginX):
+        (WebCore::InheritedFlags::setPerspectiveOriginY):
+        (WebCore::InheritedFlags::initialTransformOriginZ):
+        (WebCore::InheritedFlags::initialTransformStyle3D):
+        (WebCore::InheritedFlags::initialBackfaceVisibility):
+        (WebCore::InheritedFlags::initialPerspective):
+        (WebCore::InheritedFlags::initialPerspectiveOriginX):
+        (WebCore::InheritedFlags::initialPerspectiveOriginY):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        * rendering/style/StyleTransformData.cpp:
+        (WebCore::StyleTransformData::StyleTransformData):
+        (WebCore::StyleTransformData::operator==):
+        * rendering/style/StyleTransformData.h:
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Fix ACCELERATED_COMPOSITING build.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23862
+
+        Add a bit on RenderStyle that gets set when running accelerated
+        transitions of transform or opacity. These ensure that styles
+        compare as different during the transition, so that interruption
+        can be detected reliably.
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::isRunningAcceleratedAnimation):
+        (WebCore::InheritedFlags::setIsRunningAcceleratedAnimation):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Eliminate the virtual position() function from RenderObject.  Rename the position() overrides
+        in RenderText and RenderBox to positionLineBox and devirtualize them.
+
+        Patch the one call site to just check for isText() and isBox() and call the methods directly.
+
+        Remove some unnecessary overrides of position() on table sections and rows.
+
+        Reviewed by Simon Fraser
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionLineBox):
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::lineHeight):
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::lineHeight):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionLineBox):
+        * rendering/RenderText.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+
+2009-02-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23901
+        Add HTML options/collections V8 custom bindings.
+
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp: Added.
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.h: Added.
+        * bindings/v8/custom/V8NamedNodesCollection.cpp: Added.
+        (WebCore::V8NamedNodesCollection::item):
+        (WebCore::V8NamedNodesCollection::itemWithName):
+        * bindings/v8/custom/V8NamedNodesCollection.h: Added.
+        (WebCore::V8NamedNodesCollection::V8NamedNodesCollection):
+        (WebCore::V8NamedNodesCollection::length):
+
+2009-02-11  Dimitri Dupuis-latour  <dupuislatour@apple.com>
+
+        Added a preference to disable some Inspector's panels (rdar://6419624, rdar://6419645).
+        This is controlled via the 'WebKitInspectorHiddenPanels' key; if nothing is specified, all panels are shown.
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::hiddenPanels):
+        (WebCore::InspectorController::hiddenPanels):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::hiddenPanels):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Combine RenderObject::element() and RenderObject::node() into a single function.
+        node() now has the "anonymous bit" checking behavior of element() and will
+        return 0 for anonymous content.  This patch switches all callers of element()
+        to node() and patches old callers of node() to deal with situations where they
+        did not expect node() to be 0.  A bunch of node() calls were calling stuff on
+        Document that they clearly didn't intend, so overall this is a nice improvement.
+
+        Reviewed by Sam Weinig
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * dom/Element.cpp:
+        (WebCore::Element::offsetParent):
+        * dom/Position.cpp:
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::getStartEndListChildren):
+        (WebCore::IncreaseSelectionListLevelCommand::doApply):
+        (WebCore::DecreaseSelectionListLevelCommand::doApply):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::get):
+        * page/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        (WebCore::AccessibilityList::isOrderedList):
+        (WebCore::AccessibilityList::isDefinitionList):
+        * page/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isPasswordField):
+        (WebCore::AccessibilityRenderObject::isFileUploadButton):
+        (WebCore::AccessibilityRenderObject::isInputImage):
+        (WebCore::AccessibilityRenderObject::isMultiSelect):
+        (WebCore::AccessibilityRenderObject::isControl):
+        (WebCore::AccessibilityRenderObject::getAttribute):
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::actionElement):
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        (WebCore::AccessibilityRenderObject::helpText):
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+        (WebCore::AccessibilityRenderObject::hasIntValue):
+        (WebCore::AccessibilityRenderObject::intValue):
+        (WebCore::AccessibilityRenderObject::labelElementContainer):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        (WebCore::AccessibilityRenderObject::checkboxOrRadioRect):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::text):
+        (WebCore::AccessibilityRenderObject::ariaSelectedTextDOMRange):
+        (WebCore::AccessibilityRenderObject::accessKey):
+        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+        (WebCore::AccessibilityRenderObject::url):
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::setFocused):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::visiblePositionRange):
+        (WebCore::AccessibilityRenderObject::index):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        (WebCore::AccessibilityRenderObject::observableObject):
+        (WebCore::AccessibilityRenderObject::roleValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::title):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObjectForSection):
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::headerObject):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::shouldDragAutoNode):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateOverflowStatus):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationController::cancelAnimations):
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (blockquoteLevel):
+        (AXAttributeStringSetHeadingLevel):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::paint):
+        (WebCore::shouldDrawTextDecoration):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::positionForCoordinates):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::handleRunInChild):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::isSelectionRoot):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::positionForBox):
+        (WebCore::RenderBlock::positionForRenderer):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::hasLineIfEmpty):
+        (WebCore::RenderBlock::updateFirstLetter):
+        (WebCore::RenderBlock::updateHitTestResult):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::positionForCoordinates):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::updateFromElement):
+        (WebCore::RenderButton::canHaveChildren):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::calculateLocalTransform):
+        * rendering/RenderFrame.h:
+        (WebCore::RenderFrame::element):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::imageMap):
+        (WebCore::RenderImage::nodeAtPoint):
+        (WebCore::RenderImage::updateAltText):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::cloneInline):
+        (WebCore::RenderInline::updateHitTestResult):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::isTransparent):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::resize):
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::updateOverflowStatus):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        (WebCore::RenderLayer::enclosingElement):
+        (WebCore::RenderLayer::updateHoverActiveState):
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isRootLayer):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::marqueeSpeed):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::isBody):
+        (WebCore::RenderObject::isHR):
+        (WebCore::RenderObject::isHTMLMarquee):
+        (WebCore::RenderObject::isEditable):
+        (WebCore::RenderObject::addPDFURLRect):
+        (WebCore::RenderObject::showTreeForThis):
+        (WebCore::RenderObject::draggableNode):
+        (WebCore::RenderObject::hasOutlineAnnotation):
+        (WebCore::RenderObject::positionForCoordinates):
+        (WebCore::RenderObject::updateDragState):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::getUncachedPseudoStyle):
+        (WebCore::RenderObject::getTextDecorationColors):
+        (WebCore::RenderObject::caretMaxOffset):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRoot):
+        (WebCore::RenderObject::isInlineContinuation):
+        (WebCore::RenderObject::node):
+        (WebCore::RenderObject::setNode):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::destroyLeftoverChildren):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::updateWidgetPosition):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+        (WebCore::RenderPartObject::viewCleared):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::calculateLocalTransform):
+        (WebCore::RenderPath::layout):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::positionForCoordinates):
+        (WebCore::RenderReplaced::isSelected):
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::gradientElement):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::calculateLocalTransform):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::calcViewport):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::calculateLocalTransform):
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::layoutPath):
+        (WebCore::RenderSVGTextPath::startOffset):
+        (WebCore::RenderSVGTextPath::exactAlignment):
+        (WebCore::RenderSVGTextPath::stretchMethod):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::updateFromElement):
+        (WebCore::RenderTableCell::calcPrefWidths):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::updateFromElement):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText):
+        (WebCore::RenderText::positionForCoordinates):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText):
+        (WebCore::RenderTextFragment::previousCharacter):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isActive):
+        (WebCore::RenderTheme::isChecked):
+        (WebCore::RenderTheme::isIndeterminate):
+        (WebCore::RenderTheme::isEnabled):
+        (WebCore::RenderTheme::isFocused):
+        (WebCore::RenderTheme::isPressed):
+        (WebCore::RenderTheme::isReadOnlyControl):
+        (WebCore::RenderTheme::isHovered):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::updatePressedState):
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaTimelineContainer):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMediaMuteButton):
+        (WebCore::RenderThemeSafari::paintMediaPlayButton):
+        (WebCore::RenderThemeSafari::paintMediaSliderTrack):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeSelection):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        (WebCore::RenderWidget::nodeAtPoint):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::isEditableLeaf):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::prepareToRenderSVGContent):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        (WebCore::SVGRootInlineBox::buildLayoutInformationForTextBox):
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
+        * svg/SVGFont.cpp:
+        (WebCore::SVGTextRunWalker::walk):
+        (WebCore::floatWidthOfSubStringUsingSVGFont):
+        (WebCore::Font::drawTextUsingSVGFont):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::findInlineTextBoxInTextChunks):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::fillPaintServer):
+        (WebCore::SVGPaintServer::strokePaintServer):
+
+2009-02-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/3541409> - Further FrameLoader and page cache cleanup
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::restore): Moved updatePlatformScriptObjects() here.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Rolled opened() into this method.  This method was
+          the only caller and - in the future - will benefit from doing parts of opened()'s work differently.
+        (WebCore::FrameLoader::open): Split off per-frame logic into open(CachedFrame&) method.
+        (WebCore::FrameLoader::closeAndRemoveChild): Added.  Do the non-tree related cleanup that
+          FrameTree::removeChild() used to do.
+        (WebCore::FrameLoader::detachFromParent): Call ::closeAndRemoveChild() instead.
+        (WebCore::FrameLoader::cachePageForHistoryItem): Perform the "can cache page" check here.
+        * loader/FrameLoader.h:
+
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::removeChild): Just remove the Frame from the tree.  Closing it and other
+          cleanup is the responsibility of the FrameLoader.
+        * page/FrameTree.h:
+        (WebCore::FrameTree::detachFromParent): Added to just clear a Frame's parent pointer
+
+2009-02-11  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23882
+        GraphicsContextSkia draws round rects as solid rects
+
+        Fixes two bugs in Skia's GraphicsContext::fillRoundedRect:
+        . fillRoundedRect had an extra call to fillRect, resulting in always
+          drawing a solid rectangle.
+        . if the total radius along a given axis is greater than the size of
+          the axis to draw, a solid rect should be drawn.
+
+        The layout tests LayoutTests/fast/css/shadow-multiple.html and
+        LayoutTests/fast/box-shadow/basic-shadows.html cover this.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+2009-02-11  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23536: Auto-generate HTMLElementFactory
+
+        Remove the HTMLElementFactory files. Farewell.
+
+        * html/HTMLElementFactory.cpp: Removed.
+        * html/HTMLElementFactory.h: Removed.
+
+2009-02-11  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23536: Auto-generate HTMLElementFactory
+
+        Make the platform auto-generate the HTMLElementFactory.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * webcore-base.bkl:
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Remove unneeded ASSERTS.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Add function to RenderStyle to ask whether a background image has been specified.
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasBackgroundImage):
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23548
+
+        When opacity or transform change on an object which has a compositing layer,
+        avoid repainting the layer.
+
+        Added a new StyleDifference value, StyleDifferenceRecompositeLayer, which indicates
+        that the only thing styleChanged() has to do is to update composited properties of
+        the layer. RenderStyle::diff() now has an out param for a bitmask of "context sensitive"
+        properties, currently for opacity and transform. When one of these changes, we need
+        to see if we have a compositing layer before we decide whether to layout/repaint,
+        or just update the composited layer, via adjustStyleDifference().
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-02-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6562920> Pasted text should be normalized to NFC
+
+        Testing requires putting non-HTML content in pasteboard, so it cannot be done with WebKit alone.
+
+        * platform/mac/PasteboardMac.mm: (WebCore::Pasteboard::plainText): Route the text through
+        -[NSString precomposedStringWithCanonicalMapping].
+
+2009-02-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23883
+
+        Added new TransformOperation subclasses and methods to existing ones
+        to support 3D.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/transforms/IdentityTransformOperation.h:
+        (WebCore::IdentityTransformOperation::isAffine):
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp: Added.
+        (WebCore::Matrix3DTransformOperation::blend):
+        * platform/graphics/transforms/Matrix3DTransformOperation.h: Added.
+        (WebCore::Matrix3DTransformOperation::create):
+        (WebCore::Matrix3DTransformOperation::isIdentity):
+        (WebCore::Matrix3DTransformOperation::isAffine):
+        (WebCore::Matrix3DTransformOperation::getOperationType):
+        (WebCore::Matrix3DTransformOperation::isSameType):
+        (WebCore::Matrix3DTransformOperation::operator==):
+        (WebCore::Matrix3DTransformOperation::apply):
+        (WebCore::Matrix3DTransformOperation::Matrix3DTransformOperation):
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        (WebCore::MatrixTransformOperation::isAffine):
+        (WebCore::MatrixTransformOperation::apply):
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp: Added.
+        (WebCore::PerspectiveTransformOperation::blend):
+        * platform/graphics/transforms/PerspectiveTransformOperation.h: Added.
+        (WebCore::PerspectiveTransformOperation::create):
+        (WebCore::PerspectiveTransformOperation::isIdentity):
+        (WebCore::PerspectiveTransformOperation::isAffine):
+        (WebCore::PerspectiveTransformOperation::getOperationType):
+        (WebCore::PerspectiveTransformOperation::isSameType):
+        (WebCore::PerspectiveTransformOperation::operator==):
+        (WebCore::PerspectiveTransformOperation::apply):
+        (WebCore::PerspectiveTransformOperation::PerspectiveTransformOperation):
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+        * platform/graphics/transforms/RotateTransformOperation.h:
+        (WebCore::RotateTransformOperation::create):
+        (WebCore::RotateTransformOperation::angle):
+        (WebCore::RotateTransformOperation::isAffine):
+        (WebCore::RotateTransformOperation::operator==):
+        (WebCore::RotateTransformOperation::apply):
+        (WebCore::RotateTransformOperation::RotateTransformOperation):
+        * platform/graphics/transforms/ScaleTransformOperation.cpp:
+        (WebCore::ScaleTransformOperation::blend):
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        (WebCore::ScaleTransformOperation::create):
+        (WebCore::ScaleTransformOperation::z):
+        (WebCore::ScaleTransformOperation::isIdentity):
+        (WebCore::ScaleTransformOperation::isAffine):
+        (WebCore::ScaleTransformOperation::operator==):
+        (WebCore::ScaleTransformOperation::apply):
+        (WebCore::ScaleTransformOperation::ScaleTransformOperation):
+        * platform/graphics/transforms/SkewTransformOperation.h:
+        (WebCore::SkewTransformOperation::isAffine):
+        * platform/graphics/transforms/TransformOperation.h:
+        (WebCore::TransformOperation::):
+        (WebCore::TransformOperation::is3DOperation):
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::isAffine):
+        (WebCore::TransformOperations::has3DOperation):
+        * platform/graphics/transforms/TranslateTransformOperation.cpp:
+        (WebCore::TranslateTransformOperation::blend):
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        (WebCore::TranslateTransformOperation::create):
+        (WebCore::TranslateTransformOperation::z):
+        (WebCore::TranslateTransformOperation::isIdentity):
+        (WebCore::TranslateTransformOperation::isAffine):
+        (WebCore::TranslateTransformOperation::operator==):
+        (WebCore::TranslateTransformOperation::apply):
+        (WebCore::TranslateTransformOperation::TranslateTransformOperation):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Move createAnonymousBlock() to RenderBlock.  Since anonymous blocks are always parented to some other block,
+        we can move this function to RenderBlock.  Fix a couple of call sites as a result of this restriction.
+
+        Reviewed by Simon Fraser
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        * rendering/RenderObject.h:
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23895
+
+        Remove two complete nonsense lines that I accidentally added from a cut and paste error.  This
+        restores the original logic.
+
+        Reviewed by Simon Fraser
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Rename getBaselineOfFirstLineBox to firstLineBoxBaseline.  Rename getBaselineOfLastLineBox to
+        lastLineBoxBaseline.  Remove the functions from RenderObject and add them to RenderBox instead.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::firstLineBoxBaseline):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::firstLineBoxBaseline):
+        (WebCore::RenderBox::lastLineBoxBaseline):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        * rendering/RenderObject.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::firstLineBoxBaseline):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::baselinePosition):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+        * rendering/RenderTableSection.h:
+
+2009-02-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23877
+        Allow port to disable progress events from <video> and <audio> elements
+
+        * html/HTMLMediaElement.cpp: Initialize m_sendProgressEvents.
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Don't post progress events if m_sendProgressEvents is false.
+        (WebCore::HTMLMediaElement::initAndDispatchProgressEvent): Ditto.
+        (WebCore::HTMLMediaElement::load): Ditto.
+        * html/HTMLMediaElement.h: Add m_sendProgressEvents
+
+2009-02-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * DerivedSources.cpp: Removed SVGElementFactory.cpp, since including
+        it leads to ambiguities for symbols like "aTag", which exist in both
+        the HTMLNames and SVGNames namespaces.
+
+        * WebCore.vcproj/WebCore.vcproj: Added SVGElementFactory.cpp to the
+        project directly. VS also decided to reformat this file a little bit.
+
+2009-02-10  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23536: Auto-generate HTMLElementFactory
+
+        Those are the last auto-generation bits needed to have a working generated HTMLElementFactory:
+
+        - Added a new option mapToTagName that enables a tag to use another's options and tagName (<image>
+          uses imgTag for example) and wired the code generation to be consistent with the current factory.
+
+        - Disabled dashboard compatibility check for HTMLElementFactory as it would make at least one test case fail.
+
+        - Pass the QualifiedName down to the Element constructor for shared constructors to make the generated code as
+          close as possible to the current one. We will pass the QualifiedName for all Element in a forthcoming patch.
+
+        * dom/make_names.pl: Did all the above points and tweaked the code generation to match the current HTMLElementFactory
+          as closely as possible.
+
+        * html/HTMLElementFactory.cpp:
+        (WebCore::quoteConstructor):
+        * html/HTMLQuoteElement.cpp:
+        (WebCore::HTMLQuoteElement::HTMLQuoteElement): Moved setUsesBeforeAfterRules to HTMLQuoteElement' constructor because some
+        part of the code creates elements without using the HTMLElementFactory. Also added a FIXME as it is not the right place.
+
+        * html/HTMLTagNames.in: Corrected <image> parameters.
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Fix for pixel test regression in fast/text.  Make sure not to add in
+        the borderTop and paddingTop of the block to the baseline when painting
+        strict mode text decorations.
+
+        Reviewed by Mark Rowe
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineFlowBox.h:
+
+2009-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix after r40837.
+
+        Not reviewed.
+
+        * DerivedSources.cpp:
+
+2009-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://6349412> REGRESSION(r37204): Page is not repainted during and
+        after pan scrolling
+
+        Reviewed by Steve Falkenburg.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents): Don't repaint the pan scroll
+        icon rect immediately; we will paint after the view has been scrolled.
+
+2009-02-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6156755> onMouseOver events do not fire properly for cross frame drag and drop
+
+        This problem was caused by incorrectly ignoring whether or not the
+        default behaviour of the mousedown event was suppressed.  If a
+        mousedown handler in a frame prevents default handling then the
+        subsequent mousemove events fired for the drag should not be
+        captured by that frame, should the mouse move out of its bounds.
+
+        Test: fast/events/mouse-drag-from-frame.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+            Reset new m_capturesDragging flag
+
+        (WebCore::EventHandler::handleMousePressEvent):
+            Respect the m_capturesDragging flag when we propagate
+            a mousedown event to a subframe.
+
+        * page/EventHandler.h:
+        (WebCore::EventHandler::capturesDragging):
+
+2009-02-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for recent changes to TransformationMatrix and DOMElement.
+
+        * WebCoreSources.bkl:
+        * dom/Element.cpp:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::operator wxGraphicsMatrix):
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Some renames on line boxes.  xPos()/yPos() -> x()/y().  setXPos()/setYPos() -> setX()/setY().  m_object/object() -> m_renderer/renderer().  textObject() -> textRenderer().
+
+        Reviewed by Sam Weinig
+
+        * dom/Position.cpp:
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::localCaretRect):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::showTreeForThis):
+        (WebCore::InlineBox::height):
+        (WebCore::InlineBox::caretMinOffset):
+        (WebCore::InlineBox::caretMaxOffset):
+        (WebCore::InlineBox::deleteLine):
+        (WebCore::InlineBox::extractLine):
+        (WebCore::InlineBox::attachLine):
+        (WebCore::InlineBox::adjustPosition):
+        (WebCore::InlineBox::paint):
+        (WebCore::InlineBox::nodeAtPoint):
+        (WebCore::InlineBox::selectionState):
+        (WebCore::InlineBox::canAccommodateEllipsis):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::renderer):
+        (WebCore::InlineBox::setX):
+        (WebCore::InlineBox::x):
+        (WebCore::InlineBox::setY):
+        (WebCore::InlineBox::y):
+        (WebCore::InlineBox::topOverflow):
+        (WebCore::InlineBox::bottomOverflow):
+        (WebCore::InlineBox::leftOverflow):
+        (WebCore::InlineBox::rightOverflow):
+        (WebCore::InlineBox::visibleToHitTesting):
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::height):
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::attachLineBoxToRenderObject):
+        (WebCore::InlineFlowBox::rendererLineBoxes):
+        (WebCore::InlineFlowBox::onEndChain):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::verticalPositionForBox):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxShadow):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::borderTop):
+        (WebCore::InlineFlowBox::borderBottom):
+        (WebCore::InlineFlowBox::baseline):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::height):
+        (WebCore::InlineTextBox::selectionState):
+        (WebCore::InlineTextBox::selectionRect):
+        (WebCore::InlineTextBox::deleteLine):
+        (WebCore::InlineTextBox::extractLine):
+        (WebCore::InlineTextBox::attachLine):
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        (WebCore::InlineTextBox::isLineBreak):
+        (WebCore::InlineTextBox::nodeAtPoint):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::selectionStartEnd):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintCustomHighlight):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        (WebCore::InlineTextBox::positionForOffset):
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::textRenderer):
+        * rendering/ListMarkerBox.cpp:
+        (WebCore::ListMarkerBox::isText):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintEllipsisBoxes):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::positionForBox):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintCustomHighlight):
+        (WebCore::RenderBox::position):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::relativePositionedInlineOffset):
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::relativeBBox):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteRects):
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRects):
+        (WebCore::RenderText::absoluteRectsForRange):
+        (WebCore::RenderText::absoluteQuads):
+        (WebCore::RenderText::absoluteQuadsForRange):
+        (WebCore::RenderText::localCaretRect):
+        (WebCore::RenderText::linesBoundingBox):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::height):
+        (WebCore::RootInlineBox::clearTruncation):
+        (WebCore::RootInlineBox::placeEllipsis):
+        (WebCore::RootInlineBox::paintEllipsisBox):
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::paintCustomHighlight):
+        (WebCore::RootInlineBox::paint):
+        (WebCore::RootInlineBox::nodeAtPoint):
+        (WebCore::RootInlineBox::childRemoved):
+        (WebCore::RootInlineBox::fillLineSelectionGap):
+        (WebCore::RootInlineBox::block):
+        (WebCore::isEditableLeaf):
+        (WebCore::RootInlineBox::closestLeafChildForXPos):
+        (WebCore::RootInlineBox::setVerticalOverflowPositions):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::bottomOverflow):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::setHorizontalOverflowPositions):
+        (WebCore::RootInlineBox::setVerticalSelectionPositions):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::calculateGlyphWidth):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBoxSelectionRectWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBox::svgCharacterHitsPosition):
+        (WebCore::SVGInlineTextBox::nodeAtPoint):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        (WebCore::SVGInlineTextBox::paintSelection):
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeSVGInlineTextBox):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::SVGRootInlineBoxPaintWalker):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        (WebCore::cummulatedWidthOfInlineBoxCharacterRange):
+        (WebCore::cummulatedHeightOfInlineBoxCharacterRange):
+        (WebCore::svgTextRunForInlineTextBox):
+        (WebCore::cummulatedWidthOrHeightOfTextChunk):
+        (WebCore::applyTextAnchorToTextChunk):
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        (WebCore::SVGRootInlineBox::buildLayoutInformationForTextBox):
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::cumulativeCharacterRangeLength):
+        (WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback):
+        (WebCore::findInlineTextBoxInTextChunks):
+
+2009-02-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Clean up "fallbackAnimating" logic in AnimationBase. This flag indicates
+        that animation of an accelerated property must run in software for some reason.
+
+        Also remove use of private headers in GraphicsLayerCA related to a case
+        where we may have to fall back on software animation of transform.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::blendProperties):
+        * page/animation/AnimationBase.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getValueFunctionNameForTransformOperation):
+        (WebCore::caValueFunctionSupported):
+        (WebCore::GraphicsLayerCA::setBackgroundColor):
+        (WebCore::GraphicsLayerCA::setOpacity):
+        (WebCore::GraphicsLayerCA::animateTransform):
+        (WebCore::GraphicsLayerCA::animateFloat):
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+        (WebCore::GraphicsLayerCA::setKeyframeAnimation):
+
+2009-02-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Move enclosingCompositingLayer() from RenderObject to RenderLayer, since it
+        relates to the RenderLayer z-order/overflow structure, rather than the render tree
+        parent chain. Add a convenience method, ancestorCompositingLayer(), which finds
+        the enclosing layer excluding self.
+
+        Fix enclosingCompositingLayer() to correctly look at stacking context and overflow
+        lists.
+
+        Check for documentBeingDestroyed() in a few places to avoid work on document
+        teardown.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        (WebCore::RenderLayer::setParent):
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyOverflowList):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::ancestorCompositingLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containerForRepaint):
+        * rendering/RenderObject.h:
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Rename xPos() and yPos() on RenderLayer to x() and y() to match RenderBox.  Rename setPos to setLocation.
+
+        Reviewed by Simon Fraser
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::convertToLayerCoords):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::x):
+        (WebCore::RenderLayer::y):
+        (WebCore::RenderLayer::setLocation):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        (WebCore::externalRepresentation):
+
+2009-02-10  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23879
+        Add missing PLATFORM(SKIA) changes to TransformationMatrix.h
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=15897
+        Please implement getBoundingClientRect and getClientRects
+        <rdar://problem/6139669>
+
+        Cursory implementation of Element.getBoundingClientRect and
+        Element.getClientRects. Adds necessary infrastructure classes
+        ClientRect and ClientRectList.
+
+        Tests: fast/dom/getBoundingClientRect.html
+               fast/dom/getClientRects.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/ClientRect.cpp: Added.
+        (WebCore::ClientRect::ClientRect):
+        * dom/ClientRect.h: Added.
+        (WebCore::ClientRect::create):
+        (WebCore::ClientRect::top):
+        (WebCore::ClientRect::right):
+        (WebCore::ClientRect::bottom):
+        (WebCore::ClientRect::left):
+        (WebCore::ClientRect::width):
+        (WebCore::ClientRect::height):
+        * dom/ClientRect.idl: Added.
+        * dom/ClientRectList.cpp: Added.
+        (WebCore::ClientRectList::ClientRectList):
+        (WebCore::ClientRectList::~ClientRectList):
+        (WebCore::ClientRectList::length):
+        (WebCore::ClientRectList::item):
+        * dom/ClientRectList.h: Added.
+        (WebCore::ClientRectList::create):
+        * dom/ClientRectList.idl: Added.
+        * dom/Element.cpp:
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+        * dom/Element.h:
+        * dom/Element.idl:
+        * page/DOMWindow.idl:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Get rid of capsLockStateMayHaveChanged on RenderObject.  It is only implemented by one class (text fields),
+        so devirtualize and just query at the single call site.
+
+        Reviewed by Eric Seidel
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Shrink the size of all RenderObjects (except for RenderInlines) by 4 bytes.  This patch moves the cached vertical position member to RenderInlines,
+        since they were the only objects being queried across multiple lines.
+
+        Reviewed by Sam Weinig
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::verticalPositionForBox):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::verticalPositionFromCache):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::invalidateVerticalPosition):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderText.cpp:
+        * rendering/RenderText.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-02-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23868
+        Fix code style issues: removed 80-col wrapping, incorrect include style, if statement body on same line.
+
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+
+2009-02-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23868
+        Add HTMLInputElement and HTMLOptionsCollection V8 custom bindings.
+
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-02-10  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 23871: Assertion failure beneath WebCore::openFunc when
+        running http/tests/security/xss-DENIED-xsl-document-redirect.xml
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23871>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Covered by existing tests.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::openFunc): Use the two-parameter KURL constructor so that
+        the string will be parsed. libxml2 gives us a UTF-8-encoded string
+        that needs to be parsed.
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Shrink the size of all replaced elements (images, form controls, plugins) by 4 bytes by packing the
+        overflow boolean into the RenderObject base class.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::replacedHasOverflow):
+        (WebCore::RenderObject::setReplacedHasOverflow):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::RenderReplaced):
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadow):
+        (WebCore::RenderReplaced::overflowHeight):
+        (WebCore::RenderReplaced::overflowWidth):
+        (WebCore::RenderReplaced::overflowLeft):
+        (WebCore::RenderReplaced::overflowTop):
+        (WebCore::RenderReplaced::overflowRect):
+        * rendering/RenderReplaced.h:
+
+2009-02-10  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23870
+        Make it possible for a port to require a user gesture for an <audio> or <video> element
+        to load a url.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_loadRestrictions.
+        (WebCore::HTMLMediaElement::attributeChanged): Only one attribute can change so put an "else" between tests.
+        (WebCore::HTMLMediaElement::load): Return INVALID_STATE_ERR if RequireUserGestureLoadRestriction is set
+        and we are not preocessing a user gesture.
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged): Remove unnecessary white space.
+        (WebCore::HTMLMediaElement::play): Ditto.
+        (WebCore::HTMLMediaElement::endScrubbing): Remove unnecessary braces added in r40789.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Cache currentTime() in a local instead of calling it
+        multiple times.
+        (WebCore::HTMLMediaElement::processingUserGesture): New.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::): Define LoadRestrictions, add m_loadRestrictions.
+
+2009-02-10  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Sam Weinig.
+
+        Remove the SVG checks from FloatPoint3D as it is used
+        by TransformationMatrix.
+
+        * platform/graphics/FloatPoint3D.cpp:
+        * platform/graphics/FloatPoint3D.h:
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Remove the m_baseline member variable from all line boxes, since it can easily be computed when needed and did not need to be cached.
+
+        Reviewed by Sam Weinig
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/EllipsisBox.h:
+        (WebCore::EllipsisBox::EllipsisBox):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::marginBorderPaddingLeft):
+        (WebCore::InlineFlowBox::marginBorderPaddingRight):
+        (WebCore::InlineFlowBox::marginLeft):
+        (WebCore::InlineFlowBox::marginRight):
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::borderTop):
+        (WebCore::InlineFlowBox::borderBottom):
+        (WebCore::InlineFlowBox::paddingLeft):
+        (WebCore::InlineFlowBox::paddingRight):
+        (WebCore::InlineFlowBox::paddingTop):
+        (WebCore::InlineFlowBox::paddingBottom):
+        (WebCore::InlineFlowBox::includeLeftEdge):
+        (WebCore::InlineFlowBox::includeRightEdge):
+        (WebCore::InlineFlowBox::baseline):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::baselinePosition):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::placeEllipsis):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::applyTextAnchorToTextChunk):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-02-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23867
+        Eliminate obsolete frame->document() checks
+
+        * page/FrameView.cpp: (WebCore::FrameView::paintContents): Apparently due to a typo
+        (document vs. !document), fillWithRed was always set to false, and other branches were
+        never taken. Removing the check for document restores debug-only red color filling.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::begin): Only call dispatchWindowObjectAvailable()
+        after a document is created. A client can do anything in its delegate method, so we'd need
+        to have frame->document() checks otherwise. DumpRenderTree uses this delegate to add its
+        custom property, and it was crashing due to null document in JSDOMWindowBase::getOwnPropertySlot().
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::needsYouTubeQuirk):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::updateRenderingForBindings):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * editing/Editor.cpp:
+        (WebCore::Editor::deleteWithDirection):
+        (WebCore::Editor::dispatchCPPEvent):
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        * editing/EditorCommand.cpp:
+        (WebCore::Editor::Command::execute):
+        (WebCore::Editor::Command::isEnabled):
+        (WebCore::Editor::Command::state):
+        (WebCore::Editor::Command::value):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::selectAll):
+        (WebCore::SelectionController::setFocused):
+        * inspector/InspectorController.cpp:
+        (WebCore::getResourceDocumentNode):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+        * loader/DocumentLoader.cpp:
+        (WebCore::canonicalizedTitle):
+        (WebCore::DocumentLoader::stopLoading):
+        (WebCore::DocumentLoader::isLoadingInAPISense):
+        (WebCore::DocumentLoader::subresource):
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::stop):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::endIfNotLoadingMainResource):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::gotoAnchor):
+        (WebCore::FrameLoader::loadDone):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::checkCallImplicitClose):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::FrameLoader::outgoingOrigin):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::updatePolicyBaseURL):
+        (WebCore::FrameLoader::setPolicyBaseURL):
+        (WebCore::FrameLoader::frameDetached):
+        (WebCore::FrameLoader::shouldScrollToAnchor):
+        (WebCore::FrameLoader::saveDocumentState):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create):
+        * loader/icon/IconFetcher.cpp:
+        (WebCore::IconFetcher::create):
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::startLoading):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        * page/Chrome.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::alert):
+        (WebCore::DOMWindow::confirm):
+        (WebCore::DOMWindow::prompt):
+        (WebCore::DOMWindow::scrollX):
+        (WebCore::DOMWindow::scrollY):
+        (WebCore::DOMWindow::getMatchedCSSRules):
+        (WebCore::DOMWindow::openDatabase):
+        (WebCore::DOMWindow::scrollBy):
+        (WebCore::DOMWindow::scrollTo):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::allowDHTMLDrag):
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent):
+        * page/FocusController.cpp:
+        (WebCore::deepFocusableNode):
+        (WebCore::FocusController::advanceFocus):
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        (WebCore::Frame::shouldApplyTextZoom):
+        (WebCore::Frame::shouldApplyPageZoom):
+        (WebCore::Frame::setZoomFactor):
+        (WebCore::Frame::setPrinting):
+        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::isContentEditable):
+        (WebCore::Frame::computeAndSetTypingStyle):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::applyEditingStyleToBodyElement):
+        (WebCore::Frame::removeEditingStyleFromBodyElement):
+        (WebCore::Frame::contentRenderer):
+        (WebCore::Frame::styleForSelectionStart):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::markAllMatchesForText):
+        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
+        (WebCore::Frame::documentTypeString):
+        (WebCore::Frame::shouldClose):
+        (WebCore::Frame::respondToChangedSelection):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::~FrameView):
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::layoutTimerFired):
+        (WebCore::FrameView::scheduleRelayout):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::unscheduleRelayout):
+        (WebCore::FrameView::windowClipRect):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame):
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        (WebCore::Page::~Page):
+        (WebCore::Page::unmarkAllTextMatches):
+        (WebCore::Page::setMediaVolume):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateRenderingDispatcherFired):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::currentKeyboardEvent):
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::dashboardRegionsDictionary):
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::setContainerSize):
+        (WebCore::SVGImage::usesContainerSize):
+        (WebCore::SVGImage::size):
+        (WebCore::SVGImage::hasRelativeWidth):
+        (WebCore::SVGImage::hasRelativeHeight):
+        Removed frame->document() checks.
+
+2009-02-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Attempt to fix the Qt build after r40791.
+
+        * rendering/RenderSVGRoot.cpp:
+
+2009-02-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Minor code cleanup.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::replaceChild):
+
+2009-02-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build following r40793.
+
+        * editing/qt/EditorQt.cpp:
+
+2009-02-10  Feng Qian <feng@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix crashes when accessing navigator object of a deleted frame.
+        https://bugs.webkit.org/show_bug.cgi?id=23626
+        A layout test is added: fast/dom/navigator-detached-no-crash.html
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::cookieEnabled):
+        (WebCore::Navigator::javaEnabled):
+
+2009-02-10  Sverrir Berg  <sverrir@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23630
+        Add complex font rendering using Skia instead of Windows ScriptTextOut.
+        This adds support for enhanced webkit styles when drawing complex
+        glyphs.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::containsMissingGlyphs):
+        (WebCore::UniscribeHelper::draw):
+        (WebCore::UniscribeHelper::shape):
+        * platform/graphics/chromium/UniscribeHelper.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::skiaDrawText):
+        (WebCore::paintSkiaText):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2009-02-10  Darin Fisher  <darin@chromium.org>
+
+        Revert r40797 as requested by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23809
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.idl:
+        * html/HTMLCanvasElement.idl:
+
+2009-02-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23855
+        Fix TransformationMatrixSkia.cpp and GraphicsContextSkia.cpp bustage
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::TransformationMatrix::operator SkMatrix):
+
+2009-02-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6568942> REGRESSION: Font rendering in Wikipedia input field is incorrect (default GDI text mode)
+
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::widthForGDIGlyph): Make sure that the DC is
+        in the advanced graphics mode before calling GetCharWidthI(), because
+        otherwise that function returns incorrect results for the default UI
+        font at a certain size.
+
+2009-02-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23689
+
+        Added 3D functions to WebKitCSSMatrix. This depends on the 3D functions
+        added to TransformationMatrix in https://bugs.webkit.org/show_bug.cgi?id=6868
+
+        Test: transforms/3d/cssmatrix-3d-interface.xhtml
+
+        * css/WebKitCSSMatrix.cpp:
+        * css/WebKitCSSMatrix.h:
+        * css/WebKitCSSMatrix.idl:
+
+2009-02-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=23858>
+        Bug 23858: Crash when removing a HTMLSelectElement from the document from inside its focus event handler
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler): Don't store the renderer in a local variable
+        as it can be invalidated by any of the calls to focus() within the function.  Instead, retrieve it and
+        null-check it when it is needed.
+
+2009-02-09  David Hyatt  <hyatt@apple.com>
+
+        Remove the m_height member from InlineBox.  This shaves 4 bytes off of all inline boxes.  Unfortunately SVG
+        sets heights that are independent of the renderer or of the font, and so all SVG boxes have to retain m_height
+        member variables.
+
+        height() on InlineBox is now a virtual function that does a dynamic computation (including shrinking boxes
+        with no text children).  For SVG boxes there is also a non-virtual setHeight function for updating the
+        m_height member variable like before.
+
+        Reviewed by Darin Adler
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/EllipsisBox.h:
+        (WebCore::EllipsisBox::EllipsisBox):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        (WebCore::InlineBox::root):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isInlineFlowBox):
+        (WebCore::InlineBox::isRootInlineBox):
+        (WebCore::InlineBox::topOverflow):
+        (WebCore::InlineBox::bottomOverflow):
+        (WebCore::InlineBox::leftOverflow):
+        (WebCore::InlineBox::rightOverflow):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::height):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::shrinkBoxesWithNoTextChildren):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::isInlineFlowBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::height):
+        (WebCore::InlineTextBox::nodeAtPoint):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/InlineTextBox.h:
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::height):
+        (WebCore::RootInlineBox::placeEllipsis):
+        (WebCore::RootInlineBox::setVerticalOverflowPositions):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::isRootInlineBox):
+        (WebCore::RootInlineBox::topOverflow):
+        (WebCore::RootInlineBox::bottomOverflow):
+        (WebCore::RootInlineBox::leftOverflow):
+        (WebCore::RootInlineBox::rightOverflow):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::Overflow::Overflow):
+        (WebCore::RootInlineBox::setVerticalSelectionPositions):
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::SVGInlineFlowBox):
+        (WebCore::SVGInlineFlowBox::height):
+        (WebCore::SVGInlineFlowBox::setHeight):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::SVGInlineTextBox):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::height):
+        (WebCore::SVGInlineTextBox::setHeight):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::SVGRootInlineBox):
+        (WebCore::SVGRootInlineBox::height):
+        (WebCore::SVGRootInlineBox::setHeight):
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Document our Selection DOM extensions
+        (in preparation for re-writing Selection to work with ranges)
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::type):
+        * page/DOMSelection.h:
+        * page/DOMSelection.idl:
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Attempt to fix wx build
+
+        * WebCoreSources.bkl: change Selection to VisibleSelection
+
+2009-02-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23809
+        Return CanvasRenderingContext2D instead of DOMObject in IDL to avoid V8 #ifdefs
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.idl:
+        * html/HTMLCanvasElement.idl:
+
+2009-02-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Transform the gradient instead of the context for most platforms and
+        transform the context after CGContextReplacePathWithStrokedPath for CG.
+
+        REGRESSION: SVG gradient transformation/BoundingBox can cause ugly stroke thickness
+        https://bugs.webkit.org/show_bug.cgi?id=23547
+
+        * platform/graphics/Gradient.h:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::gradientSpaceTransform):
+        * platform/graphics/cairo/GradientCairo.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        (WebCore::SVGPaintServerGradient::teardown):
+
+2009-02-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix the highlight when inspecting inline elements.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::drawHighlightForBox):
+        (WebCore::drawHighlightForLineBoxes):
+        (WebCore::InspectorController::drawNodeHighlight):
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Fix the gtk build by adding VisibleSelection and removing Selection.
+
+        * GNUmakefile.am:
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Rename Selection to VisibleSelection to allow us to separate
+        the selections the user works with from the ones used by
+        the JS editing APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=23852
+
+        No functional changes, thus no tests.
+
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::updateStartEnd):
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::inputText):
+        (WebCore::CompositeEditCommand::deleteSelection):
+        (WebCore::CompositeEditCommand::rebalanceWhitespace):
+        (WebCore::CompositeEditCommand::pushAnchorElementDown):
+        (WebCore::CompositeEditCommand::pushPartiallySelectedAnchorElementsDown):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/CompositeEditCommand.h:
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::enclosingDeletableElement):
+        (WebCore::DeleteButtonController::respondToChangedSelection):
+        * editing/DeleteButtonController.h:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand):
+        (WebCore::DeleteSelectionCommand::clearTransientState):
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/DeleteSelectionCommand.h:
+        (WebCore::DeleteSelectionCommand::create):
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::setStartingSelection):
+        (WebCore::EditCommand::setEndingSelection):
+        * editing/EditCommand.h:
+        (WebCore::EditCommand::startingSelection):
+        (WebCore::EditCommand::endingSelection):
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionForCommand):
+        (WebCore::Editor::respondToChangedSelection):
+        (WebCore::Editor::respondToChangedContents):
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        (WebCore::Editor::appliedEditing):
+        (WebCore::Editor::unappliedEditing):
+        (WebCore::Editor::reappliedEditing):
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::selectComposition):
+        (WebCore::Editor::confirmComposition):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markMisspellings):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::rangeForPoint):
+        (WebCore::Editor::transpose):
+        * editing/Editor.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::expandSelectionToGranularity):
+        (WebCore::executeSwapWithMark):
+        (WebCore::enabledVisibleSelection):
+        (WebCore::enabledVisibleSelectionAndMark):
+        (WebCore::enableCaretInEditableText):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::modifyRange):
+        (WebCore::FormatBlockCommand::doApply):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion):
+        (WebCore::IndentOutdentCommand::outdentRegion):
+        (WebCore::IndentOutdentCommand::doApply):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::modifyRange):
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::getStartEndListChildren):
+        (WebCore::canIncreaseListLevel):
+        (WebCore::canDecreaseListLevel):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/RemoveFormatCommand.cpp:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::completeHTMLReplacement):
+        * editing/Selection.cpp: Removed.
+        * editing/Selection.h: Removed.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::clear):
+        (WebCore::SelectionController::setBase):
+        (WebCore::SelectionController::setExtent):
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::selectAll):
+        (WebCore::SelectionController::setSelectedRange):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::selection):
+        (WebCore::SelectionController::selectionType):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::insertText):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/TypingCommand.h:
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::honorEditableBoundaryAtOrBefore):
+        (WebCore::VisiblePosition::honorEditableBoundaryAtOrAfter):
+        * editing/VisibleSelection.cpp: Added.
+        (WebCore::VisibleSelection::VisibleSelection):
+        (WebCore::VisibleSelection::selectionFromContentsOfNode):
+        (WebCore::VisibleSelection::setBase):
+        (WebCore::VisibleSelection::setExtent):
+        (WebCore::VisibleSelection::firstRange):
+        (WebCore::VisibleSelection::toNormalizedRange):
+        (WebCore::VisibleSelection::expandUsingGranularity):
+        (WebCore::makeSearchRange):
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        (WebCore::VisibleSelection::setBaseAndExtentToDeepEquivalents):
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        (WebCore::VisibleSelection::updateSelectionType):
+        (WebCore::VisibleSelection::validate):
+        (WebCore::VisibleSelection::setWithoutValidation):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        (WebCore::VisibleSelection::isContentEditable):
+        (WebCore::VisibleSelection::isContentRichlyEditable):
+        (WebCore::VisibleSelection::rootEditableElement):
+        (WebCore::VisibleSelection::shadowTreeRootNode):
+        (WebCore::VisibleSelection::debugPosition):
+        (WebCore::VisibleSelection::formatForDebugger):
+        (WebCore::VisibleSelection::showTreeForThis):
+        (showTree):
+        * editing/VisibleSelection.h: Added.
+        (WebCore::VisibleSelection::):
+        (WebCore::VisibleSelection::selectionType):
+        (WebCore::VisibleSelection::setAffinity):
+        (WebCore::VisibleSelection::affinity):
+        (WebCore::VisibleSelection::base):
+        (WebCore::VisibleSelection::extent):
+        (WebCore::VisibleSelection::start):
+        (WebCore::VisibleSelection::end):
+        (WebCore::VisibleSelection::visibleStart):
+        (WebCore::VisibleSelection::visibleEnd):
+        (WebCore::VisibleSelection::isNone):
+        (WebCore::VisibleSelection::isCaret):
+        (WebCore::VisibleSelection::isRange):
+        (WebCore::VisibleSelection::isCaretOrRange):
+        (WebCore::VisibleSelection::isBaseFirst):
+        (WebCore::VisibleSelection::granularity):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        * editing/htmlediting.cpp:
+        (WebCore::selectionForParagraphIteration):
+        (WebCore::avoidIntersectionWithNode):
+        * editing/htmlediting.h:
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::selection):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::selection):
+        * html/HTMLTextAreaElement.h:
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::selection):
+        (WebCore::AccessibilityObject::visiblePositionRangeForUnorderedPositions):
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::selection):
+        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+        * page/AccessibilityRenderObject.h:
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorNode):
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusNode):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::collapseToEnd):
+        (WebCore::DOMSelection::collapseToStart):
+        (WebCore::DOMSelection::getRangeAt):
+        (WebCore::DOMSelection::addRange):
+        * page/DOMSelection.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::setSelectionToDragCaret):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::prepareClipboardForImageDrag):
+        (WebCore::DragController::startDrag):
+        (WebCore::DragController::placeDragCaret):
+        * page/EditorClient.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
+        (WebCore::EventHandler::handleMousePressEventTripleClick):
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        * page/Frame.cpp:
+        (WebCore::Frame::mark):
+        (WebCore::Frame::setMark):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::shouldChangeSelection):
+        (WebCore::Frame::shouldDeleteSelection):
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::respondToChangedSelection):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::selection):
+        * page/Page.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper textMarkerRangeForSelection]):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
+        (WebCore::RenderTextControl::selection):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeSelection):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::fillLineSelectionGap):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::selectSubString):
+
+2009-02-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23806
+        Fix a regression crash where an empty src value and a "text/html" type
+        on an EMBED element did not finish ResourceRequest initialization due to
+        an early return.
+
+        Test: fast/loader/empty-embed-src-attribute.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+
+2009-02-09  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23816
+        Clean up RenderSVGRoot.cpp
+
+        Clean up RenderSVGRoot.cpp.
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::calcViewport):
+
+2009-02-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=23737
+        Make it possible to control media element playback without knowing so many
+        internal implementation details.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::togglePlayState): New, toggle between playing and paused state.
+        (WebCore::HTMLMediaElement::beginScrubbing): New, pause as necessary for scrubbing mode.
+        (WebCore::HTMLMediaElement::endScrubbing): New, resume playback if paused for scrubbing mode.
+        * html/HTMLMediaElement.h:
+
+        (WebCore::HTMLMediaElement::hasVideo): New, added so clients don't need to access MediaPlayer directly.
+        * html/HTMLVideoElement.h:
+
+        (WebCore::HTMLVideoElement::hasVideo): New.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlPlayButtonElement::defaultEventHandler): Use new media element
+        togglePlayState method.
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Tell media element when scrubbing
+        begins and ends so it can deal with pausing logic. Don't call setCurrentTime unless the time
+        will change.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls): Ask media element if it is able to play instead of including
+        internal logic here.
+        (WebCore::RenderMedia::updateControlVisibility): Ditto.
+
+2009-02-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        Change RenderPart and RenderPartObject constructors to take a Node*
+        instead of a HTMLFrameOwnerElement* since that is all then need.
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart): take Node* instead of HTMLFrameOwnerElement*
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject):  take Node* instead of HTMLFrameOwnerElement*
+        * rendering/RenderPartObject.h:
+
+2009-02-09  Dan Bernstein  <mitz@apple.com>
+
+        - fix -Wmissing-prototypes builds
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::isHeaderElement): Marked this function static.
+        (WebCore::haveSameTagName): Ditto.
+        * editing/markup.cpp:
+        (WebCore::isSpecialAncestorBlock): Ditto.
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::makeMapBetweenRects): Removed unused function.
+        * platform/graphics/transforms/TransformationMatrix.h: Removed unused
+        declaration of private member makeMapBetweenRects().
+
+2009-02-09  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23850
+        Code cleanup of HTMLParser class which was using a mix of m_* and bare
+        class member variable names which helps to obfuscate the code.  Also
+        changed a few of the static helper functions to take a const pointer type
+        as they should not be modifying the node.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser):
+        (WebCore::HTMLParser::~HTMLParser):
+        (WebCore::HTMLParser::reset):
+        (WebCore::HTMLParser::setCurrent):
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::HTMLParser::parseDoctypeToken):
+        (WebCore::isTableSection):
+        (WebCore::isTablePart):
+        (WebCore::isTableRelated):
+        (WebCore::HTMLParser::insertNode):
+        (WebCore::HTMLParser::handleError):
+        (WebCore::HTMLParser::textCreateErrorCheck):
+        (WebCore::HTMLParser::commentCreateErrorCheck):
+        (WebCore::HTMLParser::headCreateErrorCheck):
+        (WebCore::HTMLParser::bodyCreateErrorCheck):
+        (WebCore::HTMLParser::framesetCreateErrorCheck):
+        (WebCore::HTMLParser::formCreateErrorCheck):
+        (WebCore::HTMLParser::isindexCreateErrorCheck):
+        (WebCore::HTMLParser::noscriptCreateErrorCheck):
+        (WebCore::HTMLParser::pCloserStrictCreateErrorCheck):
+        (WebCore::HTMLParser::mapCreateErrorCheck):
+        (WebCore::HTMLParser::getNode):
+        (WebCore::HTMLParser::allowNestedRedundantTag):
+        (WebCore::HTMLParser::processCloseTag):
+        (WebCore::HTMLParser::isInline):
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks):
+        (WebCore::HTMLParser::reopenResidualStyleTags):
+        (WebCore::HTMLParser::pushBlock):
+        (WebCore::HTMLParser::popBlock):
+        (WebCore::HTMLParser::popOneBlockCommon):
+        (WebCore::HTMLParser::popOneBlock):
+        (WebCore::HTMLParser::moveOneBlockToStack):
+        (WebCore::HTMLParser::checkIfHasPElementInScope):
+        (WebCore::HTMLParser::popInlineBlocks):
+        (WebCore::HTMLParser::freeBlock):
+        (WebCore::HTMLParser::createHead):
+        (WebCore::HTMLParser::handleIsindex):
+        (WebCore::HTMLParser::startBody):
+        (WebCore::HTMLParser::finished):
+        (WebCore::HTMLParser::reportErrorToConsole):
+        * html/HTMLParser.h:
+
+2009-02-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Applying review comment on a second location.
+
+        * rendering/RenderText.cpp: (WebCore::RenderText::nextOffset):
+        Use "ifdef BUILDING_ON_TIGER".
+
+2009-02-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23845
+        editing/deleting/backward-deletion.html fails on Tiger
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::previousOffset):
+        (WebCore::RenderText::nextOffset):
+        Work around a bug in older ICU versions by hardcoding narrow voiced marks.
+
+2009-02-09  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Fix the XML syntax.
+
+2009-02-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make WorkerMessagingProxy derive from two base proxy classes.
+        https://bugs.webkit.org/show_bug.cgi?id=23777
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * dom/Worker.cpp:
+        (WebCore::Worker::terminate):
+        (WebCore::Worker::hasPendingActivity):
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerThreadActivityReportTask::performTask):
+        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
+        (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
+        (WebCore::WorkerMessagingProxy::terminateWorkerContext):
+        (WebCore::WorkerMessagingProxy::confirmWorkerThreadMessage):
+        (WebCore::WorkerMessagingProxy::reportPendingActivity):
+        (WebCore::WorkerMessagingProxy::reportPendingActivityInternal):
+        (WebCore::WorkerMessagingProxy::hasPendingActivity):
+        * dom/WorkerMessagingProxy.h:
+
+2009-02-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Introduce 2 base classes to split WorkerMessagingProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=23776
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/WorkerContextProxy.h: Added.
+        (WebCore::WorkerContextProxy::~WorkerContextProxy):
+        * dom/WorkerObjectProxy.h: Added.
+        (WebCore::WorkerObjectProxy::~WorkerObjectProxy):
+
+2009-02-08  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23839
+
+        Make sure that generated content is properly handled when content is moved from a block run-in
+        to an inline run-in.
+
+        Reviewed by Sam Weinig
+
+        Added fast/runin/002.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-02-08  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23832, crash when inspecting an image using the
+        Web inspector.
+
+        Reviewed by Mark Rowe
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRectsForRange):
+        (WebCore::RenderObject::absoluteQuadsForRange):
+
+2009-02-08  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed Qt build fix.
+
+        TransformationMatrix changes in r40761 broke QT build.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::scale):
+
+2009-02-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        This is a follow up of the last commit. It cleans up TransformationMatrix.h
+        and convert to a series of #elif.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-08  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Simon Fraser.
+
+        [CAIRO] build broken by TransformationMatrix rework
+        https://bugs.webkit.org/show_bug.cgi?id=23831
+
+        Fixed cairo build after the TransformationMatrix rework done in
+        revision 40761.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::TransformationMatrix::operator cairo_matrix_t):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-07  David Hyatt  <hyatt@apple.com>
+
+        Shrink the size of all InlineTextBoxes and all InlineBoxes (for images and replaced elements) by four bytes.
+        Change the overflow variable on InlineFlowBoxes into a short and move the bits for InlineFlowBoxes out of the
+        base InlineBox class.  Since the number of bits in the base class was 35, shoving the 3 bits for InlineFlowBoxes
+        back down into that class (into the 16 bits exposed by making the overflow variable into a short), all text
+        boxes and image boxes shrink by 4 bytes.
+
+        Reviewed by Anders
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::maxHorizontalVisualOverflow):
+        (WebCore::InlineFlowBox::hasTextChildren):
+
+2009-02-07  Dean Jackson  <dino@apple.com>
+
+        Attempted build fix for Qt. Not reviewed.
+
+        TransformationMatrix changes in r40761 broke non-Apple builds.
+
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QMatrix):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-07  David Hyatt  <hyatt@apple.com>
+
+        This patch changes the base class of RenderInline from RenderBox to RenderBoxModelObject.  This shift
+        in base class knocks 32 bytes off the size of every RenderInline.  All of the necessary functions
+        for both RenderInline and RenderBox have either been pulled up into RenderBoxModelObject for sharing
+        or split into two functions (one in each derived class).
+
+        Reviewed by Anders and Antti
+
+        * dom/Element.cpp:
+        (WebCore::Element::offsetLeft):
+        (WebCore::Element::offsetTop):
+        (WebCore::Element::offsetWidth):
+        (WebCore::Element::offsetHeight):
+        (WebCore::Element::offsetParent):
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Node.cpp:
+        (WebCore::Node::renderBox):
+        (WebCore::Node::renderBoxModelObject):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::marginLeft):
+        (WebCore::InlineFlowBox::marginRight):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::shrinkBoxesWithNoTextChildren):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::paddingLeft):
+        (WebCore::InlineFlowBox::paddingRight):
+        * rendering/RenderBlock.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::imageChanged):
+        (WebCore::RenderBox::calcReplacedWidthUsing):
+        (WebCore::RenderBox::calcReplacedHeightUsing):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        (WebCore::RenderBox::positionForCoordinates):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderBoundingBox):
+        (WebCore::RenderBox::offsetHeight):
+        (WebCore::RenderBox::marginTop):
+        (WebCore::RenderBox::marginBottom):
+        (WebCore::RenderBox::marginLeft):
+        (WebCore::RenderBox::marginRight):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::offsetLeft):
+        (WebCore::RenderBoxModelObject::offsetTop):
+        (WebCore::RenderBoxModelObject::paddingTop):
+        (WebCore::RenderBoxModelObject::paddingBottom):
+        (WebCore::RenderBoxModelObject::paddingLeft):
+        (WebCore::RenderBoxModelObject::paddingRight):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::borderTop):
+        (WebCore::RenderBoxModelObject::borderBottom):
+        (WebCore::RenderBoxModelObject::borderLeft):
+        (WebCore::RenderBoxModelObject::borderRight):
+        (WebCore::RenderBoxModelObject::hasHorizontalBordersPaddingOrMargin):
+        (WebCore::RenderBoxModelObject::hasHorizontalBordersOrPadding):
+        (WebCore::RenderBoxModelObject::childBecameNonInline):
+        (WebCore::RenderBoxModelObject::isBoxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::continuationBefore):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::marginLeft):
+        (WebCore::RenderInline::marginRight):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::computeRectForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::childBecameNonInline):
+        (WebCore::RenderInline::updateHitTestResult):
+        (WebCore::RenderInline::imageChanged):
+        (WebCore::RenderInline::addFocusRingRects):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::marginTop):
+        (WebCore::RenderInline::marginBottom):
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderLineBoxList.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::addLayers):
+        (WebCore::RenderObject::removeLayers):
+        (WebCore::RenderObject::moveLayers):
+        (WebCore::RenderObject::findNextLayer):
+        (WebCore::RenderObject::enclosingLayer):
+        (WebCore::RenderObject::enclosingCompositingLayer):
+        (WebCore::RenderObject::setLayerNeedsFullRepaint):
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        (WebCore::RenderObject::destroy):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isInlineContinuation):
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteRects):
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setBestTruncatedAt):
+        * rendering/RenderView.h:
+        * rendering/bidi.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::inlineWidth):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::inlineFlowRequiresLineBox):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-02-07  Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher <timothy@hatcher.name>
+
+        Partial fix for <https://bugs.webkit.org/show_bug.cgi?id=21051>
+        Include localStorage and sessionStorage in DatabasesPanel.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorDOMStorageResource::create):
+        (WebCore::InspectorDOMStorageResource::setScriptObject):
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::addDOMStorageScriptResource):
+        (WebCore::InspectorController::removeDOMStorageScriptResource):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorController.h:
+        * inspector/front-end/DOMStorage.js: Added.
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.set domStorage):
+        (WebInspector.DOMStorage.prototype.get domain):
+        (WebInspector.DOMStorage.prototype.set domain):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.set isLocalStorage):
+        * inspector/front-end/DOMStorageItemsView.js: Added.
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.show):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        (WebInspector.DatabaseTableView.prototype._queryError):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.reset):
+        (WebInspector.DatabasesPanel.prototype.addDatabase):
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DatabasesPanel.prototype.showDatabase):
+        (WebInspector.DatabasesPanel.prototype.showDOMStorage):
+        (WebInspector.DatabasesPanel.prototype.closeVisibleView):
+        (WebInspector.DatabasesPanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.onselect):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get subtitle):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.set subtitle):
+        * inspector/front-end/Images/domStorage.png: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+
+2009-02-07  Feng Qian <feng@chromium.org>
+
+        Reviewed by Eric Seidel <eric@webkit.org>
+
+        Put #if ENABLE(PAN_SCROLLING) around EventHandler::setPanScrollCursor.
+        https://bugs.webkit.org/show_bug.cgi?id=23574
+
+        * page/EventHandler.cpp:
+        * page/EventHandler.h:
+
+2009-02-07  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Rob Buis <rwlbuis@gmail.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23788
+        call style()->isOriginalDisplayInlineType() on RenderBox instead of RenderObject.
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+
+2009-02-07  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=3248
+        Bug 3248: Mouse events on OPTION element seem to be ignored
+
+        Support mouse events on options in a select when it forms a list box.
+
+        Test: fast/forms/option-mouseevents.html
+
+        * html/HTMLSelectElement.cpp: Convert to coords relative to the list box.
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        * rendering/RenderListBox.cpp: Handle hit testing for option elements.
+        (WebCore::RenderListBox::nodeAtPoint):
+        * rendering/RenderListBox.h:
+
+2009-02-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for all non-Apple platforms.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-06  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=6868
+
+        I have not only made TransformationMatrix platform independent
+        but I've also added 3D methods, which will be used when I update
+        WebKitCSSMatrix to include 3D (see https://bugs.webkit.org/show_bug.cgi?id=23689).
+        I am now keeping a full 4x4 matrix in TransformationMatrix. I'm also doing all
+        the math as doubles rather than floats. This makes a TransformationMatrix
+        go from 24 bytes to 128 bytes, but I don't think this class is used enough to
+        make this overhead will be significant.
+
+        The change from floats to doubles has caused some differences in rounding and
+        display (sometimes things that displayed as -0.0 now display as 0.0 or vice versa),
+        so I've had to change some LayoutTest results in the SVG tests.
+
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::matrixTransform):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::TransformationMatrix::operator CGAffineTransform):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::determinant2x2):
+        (WebCore::determinant3x3):
+        (WebCore::determinant4x4):
+        (WebCore::adjoint):
+        (WebCore::inverse):
+        (WebCore::transposeMatrix4):
+        (WebCore::v4MulPointByMatrix):
+        (WebCore::v3Length):
+        (WebCore::v3Scale):
+        (WebCore::v3Dot):
+        (WebCore::v3Combine):
+        (WebCore::v3Cross):
+        (WebCore::decompose):
+        (WebCore::slerp):
+        (WebCore::TransformationMatrix::scale):
+        (WebCore::TransformationMatrix::rotateFromVector):
+        (WebCore::TransformationMatrix::flipX):
+        (WebCore::TransformationMatrix::flipY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::TransformationMatrix::projectPoint):
+        (WebCore::TransformationMatrix::mapPoint):
+        (WebCore::TransformationMatrix::mapRect):
+        (WebCore::TransformationMatrix::mapQuad):
+        (WebCore::TransformationMatrix::scale3d):
+        (WebCore::TransformationMatrix::rotate3d):
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::translate3d):
+        (WebCore::TransformationMatrix::skew):
+        (WebCore::TransformationMatrix::applyPerspective):
+        (WebCore::TransformationMatrix::multLeft):
+        (WebCore::TransformationMatrix::multVecMatrix):
+        (WebCore::TransformationMatrix::isInvertible):
+        (WebCore::TransformationMatrix::inverse):
+        (WebCore::blendFloat):
+        (WebCore::TransformationMatrix::blend):
+        (WebCore::TransformationMatrix::decompose):
+        (WebCore::TransformationMatrix::recompose):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::TransformationMatrix):
+        (WebCore::TransformationMatrix::setMatrix):
+        (WebCore::TransformationMatrix::operator =):
+        (WebCore::TransformationMatrix::makeIdentity):
+        (WebCore::TransformationMatrix::isIdentity):
+        (WebCore::TransformationMatrix::map):
+        (WebCore::TransformationMatrix::m11):
+        (WebCore::TransformationMatrix::setM11):
+        (WebCore::TransformationMatrix::m12):
+        (WebCore::TransformationMatrix::setM12):
+        (WebCore::TransformationMatrix::m13):
+        (WebCore::TransformationMatrix::setM13):
+        (WebCore::TransformationMatrix::m14):
+        (WebCore::TransformationMatrix::setM14):
+        (WebCore::TransformationMatrix::m21):
+        (WebCore::TransformationMatrix::setM21):
+        (WebCore::TransformationMatrix::m22):
+        (WebCore::TransformationMatrix::setM22):
+        (WebCore::TransformationMatrix::m23):
+        (WebCore::TransformationMatrix::setM23):
+        (WebCore::TransformationMatrix::m24):
+        (WebCore::TransformationMatrix::setM24):
+        (WebCore::TransformationMatrix::m31):
+        (WebCore::TransformationMatrix::setM31):
+        (WebCore::TransformationMatrix::m32):
+        (WebCore::TransformationMatrix::setM32):
+        (WebCore::TransformationMatrix::m33):
+        (WebCore::TransformationMatrix::setM33):
+        (WebCore::TransformationMatrix::m34):
+        (WebCore::TransformationMatrix::setM34):
+        (WebCore::TransformationMatrix::m41):
+        (WebCore::TransformationMatrix::setM41):
+        (WebCore::TransformationMatrix::m42):
+        (WebCore::TransformationMatrix::setM42):
+        (WebCore::TransformationMatrix::m43):
+        (WebCore::TransformationMatrix::setM43):
+        (WebCore::TransformationMatrix::m44):
+        (WebCore::TransformationMatrix::setM44):
+        (WebCore::TransformationMatrix::a):
+        (WebCore::TransformationMatrix::setA):
+        (WebCore::TransformationMatrix::b):
+        (WebCore::TransformationMatrix::setB):
+        (WebCore::TransformationMatrix::c):
+        (WebCore::TransformationMatrix::setC):
+        (WebCore::TransformationMatrix::d):
+        (WebCore::TransformationMatrix::setD):
+        (WebCore::TransformationMatrix::e):
+        (WebCore::TransformationMatrix::setE):
+        (WebCore::TransformationMatrix::f):
+        (WebCore::TransformationMatrix::setF):
+        (WebCore::TransformationMatrix::multiply):
+        (WebCore::TransformationMatrix::rotate):
+        (WebCore::TransformationMatrix::skewX):
+        (WebCore::TransformationMatrix::skewY):
+        (WebCore::TransformationMatrix::hasPerspective):
+        (WebCore::TransformationMatrix::):
+        (WebCore::TransformationMatrix::isAffine):
+        (WebCore::TransformationMatrix::operator==):
+        (WebCore::TransformationMatrix::operator*=):
+        (WebCore::TransformationMatrix::operator*):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::nodeAtPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::mapAbsolutePointToLocal):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::nodeAtPoint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtPoint):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::resetToBaseValue):
+        (WebCore::SVGAnimateMotionElement::calculateAnimatedValue):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::viewport):
+        * svg/SVGTransform.cpp:
+        (SVGTransform::setTranslate):
+        (SVGTransform::setScale):
+        (SVGTransform::setRotate):
+        (SVGTransform::setSkewX):
+        (SVGTransform::setSkewY):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+
 2009-02-07  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -491,6 +39073,463 @@
         (WebCore::Image::drawPattern): Moved implementation from
         BitmapImage::drawPattern.
 
+2009-02-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        DOMSelection.getRangeAt() returns a different range than the selection
+        https://bugs.webkit.org/show_bug.cgi?id=23601
+
+        Rename toRange to toNormalizedRange and add new firstRange which returns an unmodified range
+
+        Test: fast/dom/Selection/getRangeAt.html
+
+        * WebCore.base.exp:
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::enclosingDeletableElement):
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectedRange):
+        (WebCore::Editor::fontForSelection):
+        (WebCore::Editor::applyStyleToSelection):
+        (WebCore::Editor::applyParagraphStyleToSelection):
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::insertLineBreak):
+        (WebCore::Editor::insertParagraphSeparator):
+        (WebCore::Editor::ignoreSpelling):
+        (WebCore::Editor::isSelectionUngrammatical):
+        (WebCore::Editor::guessesForUngrammaticalSelection):
+        (WebCore::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::rangeForPoint):
+        * editing/EditorCommand.cpp:
+        (WebCore::expandSelectionToGranularity):
+        (WebCore::executeDeleteToMark):
+        (WebCore::executeSelectToMark):
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/Selection.cpp:
+        (WebCore::Selection::firstRange):
+        (WebCore::Selection::toNormalizedRange):
+        * editing/Selection.h:
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::toNormalizedRange):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createFromSelection):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaSelectedTextDOMRange):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::getRangeAt):
+        (WebCore::DOMSelection::addRange):
+        (WebCore::DOMSelection::deleteFromDocument):
+        (WebCore::DOMSelection::containsNode):
+        (WebCore::DOMSelection::toString):
+        * page/DragController.cpp:
+        (WebCore::setSelectionToDragCaret):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::startDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectedText):
+        (WebCore::Frame::shouldChangeSelection):
+        (WebCore::Frame::shouldDeleteSelection):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::selectionTextRects):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::respondToChangedSelection):
+        * platform/ContextMenu.cpp:
+        (WebCore::selectionContainsPossibleWord):
+
+2009-02-06  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6563402> - Workaround a case where ::didReceiveData() might be called on a ResourceHandleClient
+        before ::didReceiveResponse().
+
+        No layout test, as we don't have a concrete way to reproduce these conditions.  To that effect, I've added an ASSERT
+        to catch the conditions before the workaround takes effect in case any WebKit Debug-build developer runs across
+        this case and can come up with something more reproducible.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveData): If the response is null create a dummy response.  This is much
+          like the FrameLoader::init() response that is used for initial document creation.
+
+2009-02-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * WebCore.base.exp:
+
+2009-02-06  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23621
+
+        Do not use m_scrollOffset to check if we are setting the same
+        value than we already have.
+
+        m_scrollOffset starts at 0 for ScrollView, so when opening a new
+        page and scrolling to 0 (the usual case) the check will fail and
+        we won't update the adjustment value, resulting in a possibly
+        mispositioned scrollbar. Use the adjustment value directly
+        instead, which is what we are updating anyway.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+
+2009-02-06  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23800
+        Header elements are not always preserved during paste
+
+        At paste time, don't merge out of header elements.  At copy time, be sure to include
+        headers in the list of special common ancestor blocks, so that copying a paragraph or less
+        of content inside a header will include the header element in the copied markup.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::areSameHeaderElements):
+        (WebCore::ReplaceSelectionCommand::shouldMerge):
+        * editing/markup.cpp:
+        (WebCore::isSpecialAncestorBlock):
+        (WebCore::createMarkup):
+
+2009-02-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Part III of <rdar://problem/6552272>.
+
+        Make redirect data available to WebKit. (I tried having WebKit track this
+        data for itself, but that went wrong -- it's just too hard to figure
+        out the weird corners of the WebCore loader from within another framework.)
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h: Store a flag indicating whether we created
+        a global history entry. If we didn't, then we know that the next redirect
+        should not link to us, since we're not in history.
+
+        (WebCore::DocumentLoader::clientRedirectSourceForHistory):
+        (WebCore::DocumentLoader::clientRedirectDestinationForHistory):
+        (WebCore::DocumentLoader::setClientRedirectSourceForHistory):
+        (WebCore::DocumentLoader::serverRedirectSourceForHistory):
+        (WebCore::DocumentLoader::serverRedirectDestinationForHistory):
+        (WebCore::DocumentLoader::didCreateGlobalHistoryEntry):
+        (WebCore::DocumentLoader::setDidCreateGlobalHistoryEntry): Added accessors
+        to help WebKit wade through the muck of WebCore history.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::updateGlobalHistoryRedirectLinks): Renamed
+        this client function to say what it does, instead of when it's called.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithNavigationAction): In the case of a redirect,
+        store a link to the previous history URL in the new DocumentLoader, so
+        it can update WebKit with that link when the load commits.
+
+        (WebCore::FrameLoader::updateHistory*): Use our new flags and names,
+        described above.
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state): Inlined a few trivial functions because
+        performance mistakes give me the itches.
+
+        * loader/FrameLoaderClient.h: Renamed this client function to say what
+        it does, instead of when it's called.
+
+2009-02-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Minor refactoring and cleanup to Selection code
+        https://bugs.webkit.org/show_bug.cgi?id=23774
+
+        No functional changes, thus no tests.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        * editing/Selection.cpp:
+        (WebCore::Selection::Selection):
+        (WebCore::Selection::setBaseAndExtentToDeepEquivalents):
+        (WebCore::Selection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        (WebCore::Selection::updateSelectionType):
+        (WebCore::Selection::validate):
+        (WebCore::Selection::setWithoutValidation):
+        (WebCore::Selection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/Selection.h:
+        (WebCore::Selection::):
+        (WebCore::Selection::selectionType):
+        (WebCore::Selection::extent):
+        (WebCore::Selection::isNone):
+        (WebCore::Selection::isCaret):
+        (WebCore::Selection::isRange):
+        (WebCore::Selection::isCaretOrRange):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::selectionType):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+
+2009-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23801
+        Add custom V8 bindings for SVG.
+
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23792: unused param is used in RenderLayer.cpp but not #include'd
+        <https://bugs.webkit.org/show_bug.cgi?id=23792>
+
+        Add include file for UnusedParam which is used in this file.
+
+        * rendering/RenderLayer.cpp:
+
+2009-02-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23741>
+
+        Bug 23798: KURLGoogle needs support for protocolInHTTPFamily
+        <https://bugs.webkit.org/show_bug.cgi?id=23798>
+
+        Add protocolInHTTPFamily() to the KURLGoogle implementation.
+        This is another chromium build fix to mirror r40553.
+
+        While in this file, I did some style fixes and consistency fixes:
+        + fixed many_occurences_of_underscoring_naming
+        + usages of NULL
+        + comparisons to 0
+        + changed the copyright remove an extraneous , and capitalize the (C)
+          which was suggested for other files that I've submitted.
+
+        No observable change in behavior, so no test.
+
+        * platform/KURL.h:
+        (WebCore::KURL::protocolInHTTPFamily):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURLCharsetConverter::ConvertFromUTF16):
+        (WebCore::lowerCaseEqualsASCII):
+        (WebCore::KURLGooglePrivate::KURLGooglePrivate):
+        (WebCore::KURLGooglePrivate::setUtf8):
+        (WebCore::KURLGooglePrivate::setAscii):
+        (WebCore::KURLGooglePrivate::init):
+        (WebCore::KURLGooglePrivate::initProtocolInHTTPFamily):
+        (WebCore::KURLGooglePrivate::copyTo):
+        (WebCore::KURLGooglePrivate::replaceComponents):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::createCFURL):
+        (WebCore::KURL::isEmpty):
+        (WebCore::KURL::protocolInHTTPFamily):
+        (WebCore::KURL::query):
+        (WebCore::decodeURLEscapeSequences):
+        (WebCore::KURL::protocolIs):
+        (WebCore::encodeWithURLEscapeSequences):
+        (WebCore::KURL::invalidate):
+        (WebCore::equalIgnoringRef):
+        * platform/KURLGooglePrivate.h:
+
+2009-02-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23741: StyleRareNonInheritedData::operator==() should not compare ContentData objects by pointer
+
+        Reviewed by Darin Adler.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::contentDataEquivalent): Moved method to
+        WebCore::StyleRareNonInheritedData class.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::contentDataEquivalent): Replaced declaration
+        with inline method that calls contentDataEquivalent() on
+        WebCore::StyleRareNonInheritedData instead.
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::operator==): This is the bug fix!
+        Replaced pointer comparison of ContentData objects with call to
+        StyleRareNonInheritedData::contentDataEquivalent().
+        (WebCore::StyleRareNonInheritedData::contentDataEquivalent): Added.
+        * rendering/style/StyleRareNonInheritedData.h:
+        (WebCore::StyleRareNonInheritedData::contentDataEquivalent): Added
+        declaration.
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Factor code that checks whether the object is rooted in
+        repaint() and repaintRectangle() into a common isRooted()
+        method.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::isRooted):
+        * rendering/RenderObject.h:
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Expose an isRootLayer() method on RenderLayer that works whether the
+        layer is rooted or not, and use that in a few places in the
+        accelerated compositing code.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isRootLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintingGoesToWindow):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+
+2009-02-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6552338> FontCache::releaseFontData() called on a small caps font that is not in the cache
+
+        Most platforms do not retrieve the small caps font from the FontCache,
+        but cross-platform code in ~SimpleFontData() assumes the the small caps
+        font data did come from the cache and therefore calls releaseFontData()
+        on it.
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::~SimpleFontData): Reordered to call
+        platformDestroy() before releasing the small caps font and pruning the
+        glyph page tree. This allows platformDestroy() to reset
+        m_smallCapsFontData to 0 if it was not obtained from the cache.
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Set m_smallCapsFontData to
+        0 after deleting it.
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Ditto.
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Ditto.
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::platformCommonDestroy): Ditto.
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Ditto.
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Make RenderStyle::transitionForProperty() const.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::transitionForProperty):
+        * rendering/style/RenderStyle.h:
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        Remove font smoothing changes that will be committed
+        separately.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (WebCore::if):
+
+2009-02-06  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * bridge/npapi.h:
+
+2009-02-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23790
+        Custom -> JSCCustom in SVGPointList.idl
+
+        * svg/SVGPointList.idl:
+
+2009-02-06  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23309
+        Fix whitespace indent errors. The rest of the original patch has already
+        landed.
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-02-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix bug in clearRect(). Use fillRect() instead of eraseRect() to get
+        the context transparent.
+
+        [QT] clearRect fill's a given rect with white
+        https://bugs.webkit.org/show_bug.cgi?id=23728
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clearRect):
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23781
+
+        When the document is attached and detached, and when it becomes active/inactive
+        (e.g. coming out or going into the page cache) we need to call
+        RenderView::didMoveOnscreen()/willMoveOffscreen() to hook and unhook the composited
+        layers.
+
+        Also, if Document::recalcStyle() does not do a layout, it needs to
+        update the compositing layers.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateRendering):
+        (WebCore::Document::updateLayout):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        (WebCore::Document::documentWillBecomeInactive):
+        (WebCore::Document::documentDidBecomeActive):
+
 2009-02-06  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -518,6 +39557,2074 @@
         automatically wrapped QObjects.
         (JSC::Bindings::QtConnectionObject::execute): Ditto.
 
+2009-02-05  Maciej Stachowiak  <mjs@apple.com> and Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein and Geoff Garen.
+
+        - WebCore code to track per-day and per-week visit counts in history
+
+        The basic idea is as follows: we track daily visits for up to 13
+        days, and weekly visits for up to 5 weeks past the end of the
+        current daily visits. As soon as the number of daily counts goes
+        over 13, we squish them down into weeks, and then prune the excess weeks.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem): Remove bogus whitespace.
+        (WebCore::timeToDay): Helper function: convert time to days from the epoch.
+        (WebCore::HistoryItem::padDailyCountsForNewVisit): Insert 0 counts if
+        a site is visited after a span of days.
+        (WebCore::HistoryItem::collapseDailyVisitsToWeekly): Core day/week upgrade
+        algorithm as described above.
+        (WebCore::HistoryItem::recordVisitAtTime): Use above helpers to record all
+        info about a visit to this history item.
+        (WebCore::HistoryItem::setLastVisitedTime): Updated.
+        (WebCore::HistoryItem::visited): Updated.
+        (WebCore::HistoryItem::recordInitialVisit): New function to
+        handle recording data about the very first visit, replacing the
+        prior practice of explicitly setting visit count to 1.
+        (WebCore::HistoryItem::adoptVisitCounts): Take ownership of
+        daily and weekly visit count vectors.
+        (WebCore::HistoryItem::mergeAutoCompleteHints): Added a comment
+        noting that this function doesn't work properly now (though
+        this shouldn't matter much in practice.)
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts): Accessor for daily counts.
+        (WebCore::HistoryItem::weeklyVisitCounts): Ditto for weekly counts.
+        * WebCore.base.exp: Add new symbols and sort.
+
+2009-02-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6438271> Improve backspace handling of accented characters
+
+        Test: platform/mac/editing/deleting/backward-delete.html
+
+        This change makes WebKit behave like AppKit on the Mac. Other platforms are not affected,
+        because the current behavior matches their standards (tested on Windows, assumed elsewhere).
+
+        * dom/Position.cpp:
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::uncheckedPreviousOffsetForBackwardDeletion):
+        * dom/Position.h:
+        Added a new option for previous(), used to move to a next position for backward deletion.
+        Renamed EUsingComposedCharacters to PositionMoveType.
+
+        * editing/TypingCommand.cpp: (WebCore::TypingCommand::deleteKeyPressed):
+        Use previous(BackwardDeletion) to find a proper range to delete. Also, simplified a check
+        surrounding this code a little.
+
+        * editing/htmlediting.cpp:
+        (WebCore::nextVisuallyDistinctCandidate):
+        (WebCore::previousVisuallyDistinctCandidate):
+        Adjusted for renamed enum values.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderText.h:
+        Added previousOffsetForBackwardDeletion().
+
+        * rendering/RenderText.cpp: (WebCore::RenderText::previousOffsetForBackwardDeletion):
+        On PLATFORM(MAC), use an algorithm that matches the one AppKit has for backward deletion.
+
+2009-02-05  Adam Roben  <aroben@apple.com>
+
+        Fix a crash in RenderWidget::destroy when navigating away from a page
+        with an <iframe>
+
+        This was a regression caused by r40679
+
+        Reviewed by Dave Hyatt.
+
+        Tested by many many tests.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Only deref the RenderWidget after we
+        finish accessing its members.
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        getAnimatedStyleForRenderer() should not create a new
+        CompositeAnimation if the object isn't already animating, and
+        it should just fall back to returning renderer->style().
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        Give RenderLayerBacking some love after the great
+        RenderBoxModelObject split.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::contentsBox):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::renderer):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        writeIndent() needs to be static to avoid warnings on some OSes,
+        and remove unused CAToTransform3D() method.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::writeIndent):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Add some methods to the TransformOperation classes that are required
+        by GraphicsLayer when ACCELERATED_COMPOSITING is turned on.
+
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        (WebCore::MatrixTransformOperation::create):
+        (WebCore::MatrixTransformOperation::MatrixTransformOperation):
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        (WebCore::ScaleTransformOperation::x):
+        (WebCore::ScaleTransformOperation::y):
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        (WebCore::TranslateTransformOperation::x):
+        (WebCore::TranslateTransformOperation::y):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Minor clenaup: fix brace style in CompositeAnimationPrivate::updateTransitions(),
+        and correct a usage of UNUSED_PARAM().
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::startAnimation):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        animationOfPropertyIsAccelerated() needs to be public because
+        it is called from AnimationController.
+
+        * page/animation/AnimationBase.h:
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Fix mis-typed enum value which is hidden inside #ifdefs so didn't break
+        the build.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix missing checked toRenderBlock casts.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::availableHeightUsing):
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Patch from Darin Adler.
+        Reviewed by Sam Weinig.
+
+        Fix case where we were casting to RenderView.
+
+        No test case possible.
+
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-02-05  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23708
+        Adds documentElementAvailable() callback to FrameLoaderClient.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        Add call to dispatchDocumentElementAvailable()
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseStartElement):
+        Ditto.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode):
+        Ditto.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::documentElementAvailable):
+        Stub out documentElementAvailable().
+        * loader/FrameLoader.cpp:
+        documentElementAvailable() callback plumbing.
+        * loader/FrameLoader.h:
+        Ditto.
+        * loader/FrameLoaderClient.h:
+        Add new documentElementAvailable() callback.
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23766
+        CanvasRenderingContext2D::setShadow needs else for other platforms.
+
+        Implements the CMYK variant of CanvasRenderingContext2D::setShadow for
+        other platforms using the CMYK color constructor.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23687
+        Wires up Skia'a ImageBuffer::toDataURL to support pngs.
+        This helps Chromium pass a couple of layout tests.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/image-encoders: Added.
+        * platform/image-encoders/skia: Added.
+        * platform/image-encoders/skia/PNGImageEncoder.cpp: Added.
+        (WebCore::):
+        (WebCore::PngEncoderState::EncoderWriteCallback):
+        (WebCore::PngEncoderState::ConvertBGRAtoRGB):
+        (WebCore::PngEncoderState::PngWriteStructDestroyer::PngWriteStructDestroyer):
+        (WebCore::PngEncoderState::PngWriteStructDestroyer::~PngWriteStructDestroyer):
+        (WebCore::PNGImageEncoder::encode):
+        * platform/image-encoders/skia/PNGImageEncoder.h: Added.
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix missing checked cast.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+
+2009-02-05  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds.
+
+        FrameLoader::load() got an additional 'lockHistory' parameter, pass 'false'.
+
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23625
+        Additional fix: Skia platform doesn't render text to a canvas or support clipping to an image buffer
+
+        Fixes three bugs in PlatformContextSkia:
+
+        * When a new layer was started clipped to an image we used the
+          assignment operator to copy the SkBitmap. If the SkBitmap owns it's
+          pixels, this is not the right thing to do. Instead we need to create
+          a copy of the image.
+        * State holds an SkBitmap by value. State's copy constructor does a
+          memcpy. This is confusing and subtle, I've converted to use a member
+          initializer list which I think is clearer and less error prone.
+        * When creating a new layer there is no need to copy the clip image.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::save):
+        (PlatformContextSkia::beginLayerClippedToImage):
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23462
+        Changes call from setFillColor to setStrokeColor.
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+
+2009-02-05  David Hyatt  <hyatt@apple.com>
+
+        Fix crash on svg custom stop test.  A virtual function didn't get patched properly.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::clippedOverflowRectForRepaint):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23765
+
+        Add toRenderBoxModelObject() so that we can cast objects that
+        can have layers.
+
+        Fix getComputedStyle to return the current value of style
+        properties that are undergoing accelerated animations, by
+        asking the AnimationController if the property has accelerated
+        animations, and, if so, asking it to generate an appropriate
+        style.
+
+        Tightened up some type safety (CSSPropertyID), and code clarity
+        (replace bool with enum).
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::hasCompositedLayer):
+        (WebCore::computedTransform):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::isAnimatingPropertyOnRenderer):
+        (WebCore::AnimationController::isAnimatingPropertyOnRenderer):
+        (WebCore::AnimationController::supportsAcceleratedAnimationOfProperty):
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::startAnimation):
+        (WebCore::ImplicitAnimation::endAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::startAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::isBoxModelObject):
+        (WebCore::toRenderBoxModelObject):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isBoxModelObject):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::applyTransform):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::):
+
+2009-02-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23767
+        Add custom V8 bindings for HTML5 database.
+
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp: Added.
+        (WebCore::V8CustomSQLStatementCallback::V8CustomSQLStatementCallback):
+        (WebCore::V8CustomSQLStatementCallback::~V8CustomSQLStatementCallback):
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.h: Added.
+        (WebCore::V8CustomSQLStatementCallback::create):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp: Added.
+        (WebCore::V8CustomSQLStatementErrorCallback::V8CustomSQLStatementErrorCallback):
+        (WebCore::V8CustomSQLStatementErrorCallback::~V8CustomSQLStatementErrorCallback):
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.h: Added.
+        (WebCore::V8CustomSQLStatementErrorCallback::create):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp: Added.
+        (WebCore::V8CustomSQLTransactionCallback::V8CustomSQLTransactionCallback):
+        (WebCore::V8CustomSQLTransactionCallback::~V8CustomSQLTransactionCallback):
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.h: Added.
+        (WebCore::V8CustomSQLTransactionCallback::create):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp: Added.
+        (WebCore::V8CustomSQLTransactionErrorCallback::V8CustomSQLTransactionErrorCallback):
+        (WebCore::V8CustomSQLTransactionErrorCallback::~V8CustomSQLTransactionErrorCallback):
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h: Added.
+        (WebCore::V8CustomSQLTransactionErrorCallback::create):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp: Added.
+        (WebCore::V8CustomVoidCallback::V8CustomVoidCallback):
+        (WebCore::V8CustomVoidCallback::~V8CustomVoidCallback):
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomVoidCallback.h: Added.
+        (WebCore::V8CustomVoidCallback::create):
+        * bindings/v8/custom/V8DatabaseCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23747
+        Add Chromium threading-related files.
+
+        * platform/chromium/TemporaryLinkStubs.cpp: Removed theading-related stubs.
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add toRenderButton methods for casting RenderObjects to RenderButtons. The methods will assert if the object
+        is not a RenderButton. Also add a toRenderButton method that takes a RenderButton but returns void and that
+        is unimplemented. This method will catch anyone trying to do a cast when the object is already a RenderButton.
+
+        * rendering/RenderButton.h:
+        (WebCore::RenderButton::isRenderButton):
+        (WebCore::toRenderButton):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRenderButton):
+
+2009-02-05  David Hyatt  <hyatt@apple.com>
+
+        Move the m_layer member variable of RenderBox up into RenderBoxModelObject.  Refactor styleDidChange'
+        of RenderObject, RenderBoxModelObject and RenderBox to get more of the code in the correct subclass.
+        In order to set the various RenderObject bits properly prior to the test for whether a layer is
+        required, I added an additional method, updateBoxModelInfoAfterStyleChange, that is responsible
+        for setting all of the bits.
+
+        Eliminate hasStaticX/Y, staticX/Y, and setStaticX/Y from the render tree.  Move hasStaticX/Y to
+        RenderStyle, and just use the corresponding layer() methods for the
+        staticX/Y getters/setters.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        (WebCore::RenderBlock::calcPrefWidths):
+        (WebCore::RenderBlock::baselinePosition):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::RenderBox):
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::getOverflowClipRect):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::absoluteToLocal):
+        (WebCore::RenderBox::localToContainerQuad):
+        (WebCore::RenderBox::position):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::destroy):
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        (WebCore::RenderBoxModelObject::updateBoxModelInfoFromStyle):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::layer):
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::updateBoxModelInfoFromStyle):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::relativePositionedInlineOffset):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setStaticY):
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+        * rendering/bidi.cpp:
+        (WebCore::appendRunsForObject):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasStaticX):
+        (WebCore::InheritedFlags::hasStaticY):
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Fix the windows build.
+
+        * bindings/scripts/CodeGeneratorCOM.pm:
+        * dom/Node.idl:
+
+2009-02-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Update to match Gecko.
+
+        * bridge/npapi.h:
+        * plugins/npfunctions.h:
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Finish merging EventTargetNode up into Node.
+
+        This also fixes a small recently introduced issue where EventListeners
+        would not be removed from the document if they were attached to comment
+        nodes outside of the documentElement.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventTargetNodeCustom.cpp: Removed.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::pushEventHandlerScope):
+        * bindings/scripts/CodeGenerator.pm:
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData):
+        (WebCore::CharacterData::rendererIsNeeded):
+        * dom/CharacterData.h:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::willRemove):
+        (WebCore::ContainerNode::attach):
+        (WebCore::ContainerNode::detach):
+        (WebCore::ContainerNode::insertedIntoDocument):
+        (WebCore::ContainerNode::removedFromDocument):
+        (WebCore::ContainerNode::setFocus):
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::ContainerNode):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListenersFromAllNodes):
+        (WebCore::Document::removeAllDisconnectedNodeEventListeners):
+        (WebCore::Document::setFocusedNode):
+        * dom/EventTargetNode.cpp: Removed.
+        * dom/EventTargetNode.h: Removed.
+        * dom/Node.cpp:
+        (WebCore::Node::scriptExecutionContext):
+        (WebCore::Node::eventListeners):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::updateSVGElementInstancesAfterEventListenerChange):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::removeAllEventListenersSlowCase):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::eventTargetAsSVGElementInstance):
+        (WebCore::eventTargetRespectingSVGTargetRules):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchWindowEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchSimulatedMouseEvent):
+        (WebCore::Node::dispatchSimulatedClick):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchWebKitAnimationEvent):
+        (WebCore::Node::dispatchWebKitTransitionEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        (WebCore::Node::dispatchEventForType):
+        (WebCore::Node::dispatchProgressEvent):
+        (WebCore::Node::dispatchStorageEvent):
+        (WebCore::Node::removeInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForTypeAndAttribute):
+        (WebCore::Node::inlineEventListenerForType):
+        (WebCore::Node::disabled):
+        (WebCore::Node::defaultEventHandler):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::onblur):
+        (WebCore::Node::setOnblur):
+        (WebCore::Node::onchange):
+        (WebCore::Node::setOnchange):
+        (WebCore::Node::onclick):
+        (WebCore::Node::setOnclick):
+        (WebCore::Node::oncontextmenu):
+        (WebCore::Node::setOncontextmenu):
+        (WebCore::Node::ondblclick):
+        (WebCore::Node::setOndblclick):
+        (WebCore::Node::onerror):
+        (WebCore::Node::setOnerror):
+        (WebCore::Node::onfocus):
+        (WebCore::Node::setOnfocus):
+        (WebCore::Node::oninput):
+        (WebCore::Node::setOninput):
+        (WebCore::Node::onkeydown):
+        (WebCore::Node::setOnkeydown):
+        (WebCore::Node::onkeypress):
+        (WebCore::Node::setOnkeypress):
+        (WebCore::Node::onkeyup):
+        (WebCore::Node::setOnkeyup):
+        (WebCore::Node::onload):
+        (WebCore::Node::setOnload):
+        (WebCore::Node::onmousedown):
+        (WebCore::Node::setOnmousedown):
+        (WebCore::Node::onmousemove):
+        (WebCore::Node::setOnmousemove):
+        (WebCore::Node::onmouseout):
+        (WebCore::Node::setOnmouseout):
+        (WebCore::Node::onmouseover):
+        (WebCore::Node::setOnmouseover):
+        (WebCore::Node::onmouseup):
+        (WebCore::Node::setOnmouseup):
+        (WebCore::Node::onmousewheel):
+        (WebCore::Node::setOnmousewheel):
+        (WebCore::Node::onbeforecut):
+        (WebCore::Node::setOnbeforecut):
+        (WebCore::Node::oncut):
+        (WebCore::Node::setOncut):
+        (WebCore::Node::onbeforecopy):
+        (WebCore::Node::setOnbeforecopy):
+        (WebCore::Node::oncopy):
+        (WebCore::Node::setOncopy):
+        (WebCore::Node::onbeforepaste):
+        (WebCore::Node::setOnbeforepaste):
+        (WebCore::Node::onpaste):
+        (WebCore::Node::setOnpaste):
+        (WebCore::Node::ondragenter):
+        (WebCore::Node::setOndragenter):
+        (WebCore::Node::ondragover):
+        (WebCore::Node::setOndragover):
+        (WebCore::Node::ondragleave):
+        (WebCore::Node::setOndragleave):
+        (WebCore::Node::ondrop):
+        (WebCore::Node::setOndrop):
+        (WebCore::Node::ondragstart):
+        (WebCore::Node::setOndragstart):
+        (WebCore::Node::ondrag):
+        (WebCore::Node::setOndrag):
+        (WebCore::Node::ondragend):
+        (WebCore::Node::setOndragend):
+        (WebCore::Node::onreset):
+        (WebCore::Node::setOnreset):
+        (WebCore::Node::onresize):
+        (WebCore::Node::setOnresize):
+        (WebCore::Node::onscroll):
+        (WebCore::Node::setOnscroll):
+        (WebCore::Node::onsearch):
+        (WebCore::Node::setOnsearch):
+        (WebCore::Node::onselect):
+        (WebCore::Node::setOnselect):
+        (WebCore::Node::onselectstart):
+        (WebCore::Node::setOnselectstart):
+        (WebCore::Node::onsubmit):
+        (WebCore::Node::setOnsubmit):
+        (WebCore::Node::onunload):
+        (WebCore::Node::setOnunload):
+        * dom/Node.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::dispatchCPPEvent):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::eventTargetNodeForDocument):
+        (WebCore::EventHandler::keyEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleEvent):
+        (WebCore::FrameView::updateOverflowStatus):
+        * page/FrameView.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::updateOverflowStatus):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderMedia.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::toNode):
+        * xml/XPathExpression.cpp:
+        (WebCore::XPathExpression::evaluate):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+
+2009-02-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build now that EventTargetNode.idl was removed in r40672.
+
+        * WebCore.pro:
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23462: Add RGB -> CMYK conversion algorithm
+        <https://bugs.webkit.org/show_bug.cgi?id=23462>
+
+        Adds an RGB -> CMYK converter. This isn't perfect, but better than
+        nothing.
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        (WebCore::CanvasStyle::cmykToRGB):
+        * html/CanvasStyle.h:
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        First stage of merging EventTargetNode up into Node. The intent of this change
+        is to both simplify the inheritance hierarchy (at the same time making it more
+        closely match the spec which states that all Nodes are EventTargets) and save
+        4 bytes per Node that the polymorphic multiple-inheritance was costing us.
+
+        This does the bare minimum to get things compiling, the next patch will clean
+
+        * DerivedSources.make:
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::mark):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::pushEventHandlerScope):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/Attr.idl:
+        * dom/CharacterData.h:
+        * dom/CharacterData.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/Element.idl:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNode):
+        * dom/EventTarget.h:
+        * dom/EventTarget.idl:
+        * dom/EventTargetNode.cpp:
+        (WebCore::Node::scriptExecutionContext):
+        (WebCore::Node::eventListeners):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::removeAllEventListenersSlowCase):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchWindowEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchSimulatedMouseEvent):
+        (WebCore::Node::dispatchSimulatedClick):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchWebKitAnimationEvent):
+        (WebCore::Node::dispatchWebKitTransitionEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        (WebCore::Node::dispatchEventForType):
+        (WebCore::Node::dispatchProgressEvent):
+        (WebCore::Node::dispatchStorageEvent):
+        (WebCore::Node::removeInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForTypeAndAttribute):
+        (WebCore::Node::inlineEventListenerForType):
+        (WebCore::Node::disabled):
+        (WebCore::Node::defaultEventHandler):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::onblur):
+        (WebCore::Node::setOnblur):
+        (WebCore::Node::onchange):
+        (WebCore::Node::setOnchange):
+        (WebCore::Node::onclick):
+        (WebCore::Node::setOnclick):
+        (WebCore::Node::oncontextmenu):
+        (WebCore::Node::setOncontextmenu):
+        (WebCore::Node::ondblclick):
+        (WebCore::Node::setOndblclick):
+        (WebCore::Node::onerror):
+        (WebCore::Node::setOnerror):
+        (WebCore::Node::onfocus):
+        (WebCore::Node::setOnfocus):
+        (WebCore::Node::oninput):
+        (WebCore::Node::setOninput):
+        (WebCore::Node::onkeydown):
+        (WebCore::Node::setOnkeydown):
+        (WebCore::Node::onkeypress):
+        (WebCore::Node::setOnkeypress):
+        (WebCore::Node::onkeyup):
+        (WebCore::Node::setOnkeyup):
+        (WebCore::Node::onload):
+        (WebCore::Node::setOnload):
+        (WebCore::Node::onmousedown):
+        (WebCore::Node::setOnmousedown):
+        (WebCore::Node::onmousemove):
+        (WebCore::Node::setOnmousemove):
+        (WebCore::Node::onmouseout):
+        (WebCore::Node::setOnmouseout):
+        (WebCore::Node::onmouseover):
+        (WebCore::Node::setOnmouseover):
+        (WebCore::Node::onmouseup):
+        (WebCore::Node::setOnmouseup):
+        (WebCore::Node::onmousewheel):
+        (WebCore::Node::setOnmousewheel):
+        (WebCore::Node::onbeforecut):
+        (WebCore::Node::setOnbeforecut):
+        (WebCore::Node::oncut):
+        (WebCore::Node::setOncut):
+        (WebCore::Node::onbeforecopy):
+        (WebCore::Node::setOnbeforecopy):
+        (WebCore::Node::oncopy):
+        (WebCore::Node::setOncopy):
+        (WebCore::Node::onbeforepaste):
+        (WebCore::Node::setOnbeforepaste):
+        (WebCore::Node::onpaste):
+        (WebCore::Node::setOnpaste):
+        (WebCore::Node::ondragenter):
+        (WebCore::Node::setOndragenter):
+        (WebCore::Node::ondragover):
+        (WebCore::Node::setOndragover):
+        (WebCore::Node::ondragleave):
+        (WebCore::Node::setOndragleave):
+        (WebCore::Node::ondrop):
+        (WebCore::Node::setOndrop):
+        (WebCore::Node::ondragstart):
+        (WebCore::Node::setOndragstart):
+        (WebCore::Node::ondrag):
+        (WebCore::Node::setOndrag):
+        (WebCore::Node::ondragend):
+        (WebCore::Node::setOndragend):
+        (WebCore::Node::onreset):
+        (WebCore::Node::setOnreset):
+        (WebCore::Node::onresize):
+        (WebCore::Node::setOnresize):
+        (WebCore::Node::onscroll):
+        (WebCore::Node::setOnscroll):
+        (WebCore::Node::onsearch):
+        (WebCore::Node::setOnsearch):
+        (WebCore::Node::onselect):
+        (WebCore::Node::setOnselect):
+        (WebCore::Node::onselectstart):
+        (WebCore::Node::setOnselectstart):
+        (WebCore::Node::onsubmit):
+        (WebCore::Node::setOnsubmit):
+        (WebCore::Node::onunload):
+        (WebCore::Node::setOnunload):
+        * dom/EventTargetNode.h:
+        (WebCore::toEventTargetNode):
+        (WebCore::EventTargetNodeCast):
+        * dom/EventTargetNode.idl: Removed.
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::MouseEvent):
+        (WebCore::MouseEvent::initMouseEvent):
+        (WebCore::MouseEvent::toElement):
+        (WebCore::MouseEvent::fromElement):
+        * dom/MouseEvent.h:
+        (WebCore::MouseEvent::create):
+        (WebCore::MouseEvent::relatedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        * dom/Node.h:
+        (WebCore::Node::isEventTargetNode):
+        (WebCore::Node::toNode):
+        (WebCore::Node::removeAllEventListeners):
+        (WebCore::Node::refEventTarget):
+        (WebCore::Node::derefEventTarget):
+        * dom/Node.idl:
+        * page/EventHandler.h:
+        * page/FrameView.h:
+        * xml/XPathResult.h:
+        (WebCore::XPathResult::create):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Convert RenderLayer from having a RenderBox* m_renderer to having a RenderBoxModelObject*.  The
+        container-relative repaint methods all had to be changed as a result to use RenderBoxModelObject* also.
+
+        All of RenderLayer.cpp now uses what will be the new style for dealing with an object that can be a block
+        or an inline flow.  x()/y()/width()/height() can't be queried on an inline flow, nor can many other
+        properties (like scrollWidth() / scrollHeight()), so the code has to be tightened up to convert to RenderBox
+        under the right conditions.
+
+        There was a bogus subtraction of renderer()->y() in localBounding box for RenderInlines.  Since y was always
+        0, this subtraction wasn't necessary.  It has been removed.
+
+        Reviewed by Adam Roben
+
+        * page/animation/AnimationBase.cpp:
+        * rendering/RenderBR.h:
+        (WebCore::RenderBR::selectionRectForRepaint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::selectionRectForRepaint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::outlineBoundsForRepaint):
+        (WebCore::RenderBox::localToContainerQuad):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::relativePositionOffset):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::resizerCornerRect):
+        (WebCore::RenderLayer::scrollbarCornerPresent):
+        (WebCore::RenderLayer::invalidateScrollbarRect):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::computeScrollDimensions):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::renderer):
+        (WebCore::RenderLayer::renderBox):
+        (WebCore::RenderLayer::renderBoxX):
+        (WebCore::RenderLayer::renderBoxY):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::selectionRectForRepaint):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        (WebCore::RenderMarquee::timerFired):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containerForRepaint):
+        (WebCore::RenderObject::repaintUsingContainer):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::rectWithOutlineForRepaint):
+        (WebCore::RenderObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::localToContainerQuad):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::selectionRectForRepaint):
+        (WebCore::RenderObject::outlineBoundsForRepaint):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        (WebCore::RenderPath::outlineBoundsForRepaint):
+        * rendering/RenderPath.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRectForRepaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGContainer::outlineBoundsForRepaint):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::selectionRectForRepaint):
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSelectionInfo.h:
+        (WebCore::RenderSelectionInfoBase::repaintContainer):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::computeRectForRepaint):
+        (WebCore::RenderTableCell::localToContainerQuad):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::clippedOverflowRectForRepaint):
+        (WebCore::RenderText::selectionRectForRepaint):
+        * rendering/RenderText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::localToContainerQuad):
+        (WebCore::RenderView::computeRectForRepaint):
+        * rendering/RenderView.h:
+
+2009-02-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * page/animation/KeyframeAnimation.h: A function prototype had two "fromStyle" arguments.
+
+2009-02-05  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+        Landed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23733
+
+        Use a 2 arguments constructor for KURL to avoid ASSERT failure.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-02-04  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android-specific files to WebCore/editing directory.
+        https://bugs.webkit.org/show_bug.cgi?id=23294
+
+        * editing/android: Added.
+        * editing/android/EditorAndroid.cpp: Added.
+        (WebCore::Editor::newGeneralClipboard):
+
+2009-02-04  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove -webkit-animation-play-state
+        The AnimationController still has the code to execute the property, but
+        it is no longer parsed or recorded.
+        https://bugs.webkit.org/show_bug.cgi?id=22907
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseAnimationProperty):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSStyleSelector.h:
+        * platform/animation/Animation.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2009-02-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        Make sure we don't load on removing the media element from the document
+        https://bugs.webkit.org/show_bug.cgi?id=22105
+
+        Test: media/remove-from-document-no-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Add a new RenderBoxModelObject class that will eventually act as the direct base class for RenderInlines.  For
+        now just adding the class and putting it in between RenderObject and RenderBox in the hierarchy.  RenderInline remains
+        derived from RenderBox for now.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::RenderBox):
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp: Added.
+        (WebCore::RenderBoxModelObject::RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        * rendering/RenderBoxModelObject.h: Added.
+        * rendering/RenderObject.h:
+
+2009-02-04  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Added accelerated animation support to AnimationController and friends. The primary
+        changes are:
+        * accelerated animations get their start time from the compositing engine, so we
+          wait for a callback (notifyAnimationStarted()) in order to get the start time.
+        * if software and accelerated animations start in the same cycle, they all need
+          to use the same start time, which is that of the accelerated animations.
+
+        Added AnimationControllerPrivate to preserve the encapsulation under
+        AnimationController.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperBase::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedOpacity::PropertyWrapperAcceleratedOpacity):
+        (WebCore::PropertyWrapperAcceleratedOpacity::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedOpacity::blend):
+        (WebCore::PropertyWrapperAcceleratedTransform::PropertyWrapperAcceleratedTransform):
+        (WebCore::PropertyWrapperAcceleratedTransform::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedTransform::blend):
+        (WebCore::ensurePropertyMap):
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::~AnimationBase):
+        (WebCore::AnimationBase::blendProperties):
+        (WebCore::AnimationBase::animationOfPropertyIsAccelerated):
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
+        (WebCore::AnimationBase::willNeedService):
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        (WebCore::AnimationBase::goIntoEndingOrLoopingState):
+        (WebCore::AnimationBase::beginAnimationUpdateTime):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::onAnimationStartResponse):
+        (WebCore::AnimationBase::getAnimatedStyle):
+        (WebCore::AnimationBase::isAnimatingProperty):
+        (WebCore::AnimationBase::endAnimation):
+        (WebCore::AnimationBase::isFallbackAnimating):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::accessCompositeAnimation):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationControllerPrivate::beginAnimationUpdateTime):
+        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
+        (WebCore::AnimationControllerPrivate::styleAvailable):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::removeFromStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        (WebCore::AnimationController::getAnimatedStyleForRenderer):
+        (WebCore::AnimationController::notifyAnimationStarted):
+        (WebCore::AnimationController::endAnimationUpdate):
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h: Added.
+        (WebCore::AnimationControllerPrivate::hasAnimations):
+        (WebCore::AnimationControllerPrivate::setBeginAnimationUpdateTime):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::CompositeAnimationPrivate):
+        (WebCore::CompositeAnimationPrivate::animationControllerPriv):
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        (WebCore::CompositeAnimationPrivate::updateKeyframeAnimations):
+        (WebCore::CompositeAnimationPrivate::animate):
+        (WebCore::CompositeAnimationPrivate::getAnimatedStyle):
+        (WebCore::CompositeAnimationPrivate::addToStartTimeResponseWaitList):
+        (WebCore::CompositeAnimationPrivate::removeFromStartTimeResponseWaitList):
+        (WebCore::CompositeAnimation::CompositeAnimation):
+        (WebCore::CompositeAnimation::animationControllerPriv):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::addToStartTimeResponseWaitList):
+        (WebCore::CompositeAnimation::removeFromStartTimeResponseWaitList):
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::create):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::shouldSendEventForListener):
+        (WebCore::ImplicitAnimation::animate):
+        (WebCore::ImplicitAnimation::getAnimatedStyle):
+        (WebCore::ImplicitAnimation::startAnimation):
+        (WebCore::ImplicitAnimation::endAnimation):
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        (WebCore::ImplicitAnimation::willNeedService):
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval):
+        (WebCore::KeyframeAnimation::animate):
+        (WebCore::KeyframeAnimation::getAnimatedStyle):
+        (WebCore::KeyframeAnimation::startAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::shouldSendEventForListener):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        (WebCore::KeyframeAnimation::willNeedService):
+        * page/animation/KeyframeAnimation.h:
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (-[WebAnimationDelegate animationDidStart:]):
+        * rendering/RenderLayerBacking.h:
+
+2009-02-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, build fix.
+
+        Remove duplicate definition of msSans in FontCache::alternateFamilyName.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+
+2009-02-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Reverse the meaning of the if check so that Android
+        (dpad devices) do not scroll on focus and normal platforms do
+        http://trac.webkit.org/changeset/40647
+
+        This was caught by George Staikos, and I wrote the patch.
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Eliminate RenderContainer.
+
+        Reviewed by Sam and Anders
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::addChild):
+        (WebCore::RenderBlock::dirtyLineBoxes):
+        (WebCore::RenderBlock::createInlineBox):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::setSelectionState):
+        (WebCore::RenderBlock::avoidsFloats):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        (WebCore::RenderBlock::hoverAncestor):
+        (WebCore::RenderBlock::updateDragState):
+        (WebCore::RenderBlock::localCaretRect):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::virtualChildren):
+        (WebCore::RenderBlock::children):
+        * rendering/RenderContainer.cpp: Removed.
+        * rendering/RenderContainer.h: Removed.
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::RenderFrameSet):
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        (WebCore::RenderFrameSet::layout):
+        * rendering/RenderFrameSet.h:
+        (WebCore::RenderFrameSet::virtualChildren):
+        (WebCore::RenderFrameSet::children):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::continuationBefore):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::virtualChildren):
+        (WebCore::RenderInline::children):
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+        * rendering/RenderLineBoxList.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::RenderSVGRoot):
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        (WebCore::RenderSVGRoot::position):
+        * rendering/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::virtualChildren):
+        (WebCore::RenderSVGRoot::children):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::removeChild):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::RenderTableCol):
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::virtualChildren):
+        (WebCore::RenderTableCol::children):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::RenderTableRow):
+        (WebCore::RenderTableRow::destroy):
+        (WebCore::RenderTableRow::styleWillChange):
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::virtualChildren):
+        (WebCore::RenderTableRow::children):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::destroy):
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::removeChild):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::virtualChildren):
+        (WebCore::RenderTableSection::children):
+
+2009-02-04  Mads Adger  <mad@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        Bug 23180 Reading freed memory at DocumentLoader::checkForPendingPreloads
+        https://bugs.webkit.org/show_bug.cgi?id=23180
+
+        Added a protector for the document potentially holding on the last reference to the loader we are interating with.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+
+2009-02-04  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23163
+        Don't scroll to show current focus on devices that use
+        directional pads for navigation.
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+
+2009-02-04  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler.
+
+        Change RenderBlock::columnGap() access permissions from protected to
+        public. ANDROID creates an array of focus rectangles for navigation
+        with a trackball or directional pad, and needs access to the column gap
+        to implement this logic.
+
+        Android has no testing harness @ webkit.org, thus no tests.
+
+        * rendering/RenderBlock.h:
+
+2009-02-04  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler and Eric Seidel.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22917
+
+        Add ENABLE_ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL to permit the ANDROID
+        platform to select all when focusing on a textarea. This matches
+        the user interface guidelines other applications on the platform.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
+
+2009-02-04  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6386112> Some inline-elements are not
+        becoming proper dashboard-regions
+
+        RenderInline needs its own implementation of addDashboardRegions
+        because otherwise all of the coordinate calculations are
+        inaccurate.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addDashboardRegions):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.h:
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Move addChild/removeChild from RenderContainer to RenderObject.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::RenderObject::addChild):
+        (WebCore::RenderObject::removeChild):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::addChildIgnoringContinuation):
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGContainer.h:
+
+2009-02-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        <rdar://problem/3541409> - Further HistoryItem / BF cache cleanup
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::mainFrameView):
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::isInPageCache):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-02-04  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23743
+        Fix memory corruption with open-source GIF decoders.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::clear):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::clear):
+
+2009-02-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        When using accelerated compositing, make repaints use the correct
+        repaint container. Hook up the RenderLayerCompositor in RenderView,
+        and add to RenderView a method that repaints both the view
+        contents, and any intersecting composited layers.
+
+        Make enclosingCompositingLayer() a method on RenderObject, and update
+        the compositor to use that. Add a helper method on the compositor to
+        get the non-self compositing ancestor: ancestorCompositingLayer().
+
+        Call repaintRectangleInViewAndCompositedLayers() in places that don't do
+        container-relative repainting: selection redraw on focus change, caret,
+        and widget updates.
+
+        Fix a bug in RenderLayerCompositor where the m_compositingLayersNeedUpdate flag
+        would get cleared for partial updates, thus preventing subsequent full updates.
+
+        Fix a bug in RenderLayer::ensureBacking() that made new backing every time.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::compositor):
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::ensureBacking):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::backing):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::notifyTransitionStarted):
+        (WebCore::RenderLayerBacking::notifyAnimationStarted):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::ancestorCompositingLayer):
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::enclosingCompositingLayer):
+        (WebCore::RenderObject::containingBlockWidth):
+        (WebCore::RenderObject::containingBlockHeight):
+        (WebCore::RenderObject::containerForRepaint):
+        (WebCore::RenderObject::repaintUsingContainer):
+        * rendering/RenderObject.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::shouldRepaint):
+        (WebCore::RenderView::repaintViewRectangle):
+        (WebCore::RenderView::repaintRectangleInViewAndCompositedLayers):
+        (WebCore::RenderView::setMaximalOutlineSize):
+        (WebCore::RenderView::usesCompositing):
+        (WebCore::RenderView::compositor):
+        (WebCore::RenderView::didMoveOnscreen):
+        (WebCore::RenderView::willMoveOffscreen):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::updateWidgetPosition):
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Add toRenderImage methods for casting RenderObjects to RenderImages.  The methods will assert if the object
+        is not a RenderImage.  Also add a toRenderImage method that takes a RenderImage but returns void and that
+        is unimplemented.  This method will catch anyone trying to do a cast when the object is already a RenderImage.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::attach):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::attach):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::attach):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * page/DragController.cpp:
+        (WebCore::getCachedImage):
+        (WebCore::getImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+        * rendering/RenderImage.h:
+        (WebCore::toRenderImage):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::parseMappedAttribute):
+        (WebCore::WMLImageElement::attach):
+
+2009-02-04  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel and Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20531
+
+        Make alternateFamilyName customized for Windows and Chromium.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+
+2009-02-04  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This comes from Chromium patch (http://codereview.chromium.org/17624).
+
+        Add m_disableFontFallback to UniscriberHelper class and set it
+        to true when filling up glyph pages for non-BMP code points.
+        When it's set true, UniscriberHelper does not do its own font
+        fallback. Neither does it do glyph placement. Font fallback
+        will be taken care of in the simple script font path and glyph
+        placement is not necessary for simple scripts.
+
+        Layout test is missing at the moment due to the lack of freely
+        distributable font covering a non-BMP code page. A test page
+        is available at http://i18nl10n.com/webkit/nonbmp2.html
+
+        See also https://bugs.webkit.org/show_bug.cgi?id=23602
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillNonBMPGlyphs):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::UniscribeHelper):
+        (WebCore::UniscribeHelper::shape):
+        (WebCore::UniscribeHelper::fillShapes):
+        * platform/graphics/chromium/UniscribeHelper.h:
+        (WebCore::UniscribeHelper::setDisableFontFallback):
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Remove some unnecessary #includes of RenderStyle.h
+
+        * css/CSSPrimitiveValueMappings.h:
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        * dom/Node.h:
+        * rendering/PointerEventsHitRules.h:
+        * rendering/RenderImageGeneratedContent.h:
+        * rendering/RenderMarquee.h:
+        * rendering/RenderScrollbar.h:
+
+2009-02-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23657
+        Clean up WebCore/storage IDLs.
+
+        * storage/SQLError.idl: Changed to match spec.
+        * storage/SQLResultSet.idl: Changed to match spec.
+        * storage/SQLStatementCallback.idl: Removed.
+        * storage/SQLStatementErrorCallback.idl: Removed.
+        * storage/SQLTransactionCallback.idl: Removed.
+        * storage/SQLTransactionErrorCallback.idl: Removed.
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23734, blank content on blogs.msdn.com.
+
+        Add debugging code that will catch the incorrect dirtying of a table section immediately if it happens
+        during calcRowHeight or layoutRows.  This should make it possible to discover future bugs where table sections don't
+        paint.
+
+        The bug in blogs.msdn.com, which was caused by a bad setNeedsLayout in RenderLayer::updateScrollInfoAtferLayout.  Make
+        sure to do only a local setNeedsLayout inside that function.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSetNeedsLayoutForbidden):
+        (WebCore::RenderObject::setNeedsLayoutIsForbidden):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowHeight):
+        (WebCore::RenderTableSection::layoutRows):
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Rename RenderStyle::Diff to StyleDifference and move it to
+        RenderStyleConstants.h.
+
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::styleDidChange):
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBox.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::styleWillChange):
+        (WebCore::RenderButton::styleDidChange):
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::styleDidChange):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::styleDidChange):
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::styleDidChange):
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::styleDidChange):
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::styleWillChange):
+        (WebCore::RenderListMarker::styleDidChange):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::styleDidChange):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::styleDidChange):
+        * rendering/RenderSVGGradientStop.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::styleWillChange):
+        (WebCore::RenderScrollbarPart::styleDidChange):
+        * rendering/RenderScrollbarPart.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::styleDidChange):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleWillChange):
+        (WebCore::RenderTableCell::styleDidChange):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleWillChange):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::styleWillChange):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::styleDidChange):
+        * rendering/RenderWidget.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        (WebCore::RenderStyle::setClip):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-02-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Move PseudoId enum out of RenderStyle and into RenderStyleConstants.h
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchRulesForList):
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::CSSStyleSelector::SelectorChecker::SelectorChecker):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::pseudoStyleForElement):
+        (WebCore::CSSStyleSelector::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSStyleSelector.h:
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::MediaTextDisplayElement):
+        (WebCore::MediaTimeDisplayElement::MediaTimeDisplayElement):
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::updateBeforeAfterContent):
+        (WebCore::RenderBlock::firstLineBlock):
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::isAfterContent):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::updateBeforeAfterContent):
+        * rendering/RenderButton.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::createButtonStyle):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::isAfterContent):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::createScrollbar):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createPanel):
+        (WebCore::RenderMedia::createTimelineContainer):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::createScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionBackgroundColor):
+        (WebCore::RenderObject::selectionForegroundColor):
+        (WebCore::RenderObject::firstLineStyleSlowCase):
+        (WebCore::RenderObject::getCachedPseudoStyle):
+        (WebCore::RenderObject::getUncachedPseudoStyle):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAnonymousBlock):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::destroyLeftoverChildren):
+        (WebCore::beforeAfterContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
+        (WebCore::pseudoForScrollbarPart):
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        (WebCore::RenderTextControlSingleLine::createResultsButtonStyle):
+        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
+        (WebCore::RenderTextControlSingleLine::createScrollbar):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::pseudoBit):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        CrashTracer: [REGRESSION] 53 crashes in Safari at com.apple.WebCore: WebCore::LegacyWebArchive::create + 2706
+
+        <rdar://problem/6509514>
+
+        Reviewed by Mark Rowe.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Fix it correctly this time.
+        Check for the value returned from WebCore::IconDatabase::iconForPageURL(),
+        not WebCore::Image::data().
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Rename removeFromObjectLists and move it into RenderBox, since it only applies to boxes.
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+        (WebCore::RenderBox::styleWillChange):
+        * rendering/RenderBox.h:
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::removeChild):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::removeChild):
+
+2009-02-04  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23471
+        Fix text-overflow:ellipsis; for RTL case.
+
+        Test: fast/css/text-overflow-ellipses.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox): Add support for rtl placement.
+        (WebCore::InlineTextBox::paintDecoration): Correctly draw decorations
+        for rtl truncation.
+
+2009-02-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23700
+        Upstream local changes to due to unforking of SimpleFontData
+        (corresponds to Chromium check-in http://src.chromium.org/viewvc/chrome?view=rev&revision=8646).
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs): Removed extra checks for ZWS chars.
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        <rdar://problem/6554115> REGRESSION (r40475): World leak (JS global object) after viewing a photo on Facebook
+
+        Fix a ginormous leak. (GINORMOUS!) Make sure to disconnect the event listeners attached to the Document,
+        because, like, they point to a lot of stuff... like ... everything...
+
+        Reviewed by Darin Adler
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListenersFromAllNodes):
+
+2009-02-04  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23731
+        Add JSCCustom and V8Custom as extended IDL attributes
+
+        This helps avoid having to add #ifdefs to the IDL files to support V8 bindings.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.idl:
+        * dom/Node.idl:
+        * svg/SVGPathSegList.idl:
+        * svg/SVGPointList.idl:
+        * svg/SVGTransformList.idl:
+
+2009-02-04  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * rendering/RenderImageGeneratedContent.h:
+
+2009-02-04  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Switch to using a ref-counted wxFont pointer for FontPlatformData to fix a crash
+        with assigning to uninitialized HashTable buckets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23669
+
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::getWxFont):
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::computeHash):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Fix a crash in generated content when a generated image with an already-cached background image gets
+        created.  It's not completely clear how to reproduce this crash.
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderImageGeneratedContent.h:
+        (WebCore::RenderImageGeneratedContent::imagePtr):
+
+2009-02-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt build fix.
+
+        Changed ASSERT(image) to ASSERT(!image.isNull()).
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::getImageData):
+
 2009-02-04  Trenton Schulz <trenton.schulz@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -528,6 +41635,519 @@
         * plugins/mac/PluginViewMac.cpp:
         (WebCore::PluginView::invalidateRect):
 
+2009-02-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber stamped by Mark Rowe.
+
+        FramePrivate was removed in r40024 remove the forward
+        declaration as well.
+
+        * page/Frame.h:
+
+2009-02-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23426
+
+        Make isFrameSet virtual and by default return false. Reimplement
+        it in HTMLDocument.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+        (WebCore::Document::isFrameSet):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::isFrameSet):
+        * html/HTMLDocument.h:
+
+2009-02-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6554092> Slow script dialog starts coming up over and over again
+
+        Work around <rdar://problem/6554067> by consuming any exceptions that are
+        thrown by _web_localizedDescription
+
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::platformLazyInit):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Move the isRenderInline checks for clientWidth/Height and scrollWidth/Height to the DOM element
+        versions of the functions.  Since internal render tree usage doesn't ever (incorrectly) call these
+        functions on RenderInlines, this manages to get virtual function calls out of contentWidth/Height and
+        availableWidth/Height.
+
+        Reviewed by Mark Rowe
+
+        * dom/Element.cpp:
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-02-03  Brad Garcia  <bgarcia@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20443
+        Remove call to canResize when trying to determine if pointer
+        is within a frame.
+        Also removed the implementation of canResize as it is no longer used.
+
+        Test: fast/frames/frame-dead-region.html
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        * rendering/RenderFrameSet.h:
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Reduce the number of calls to virtualChildren (indirectly made via RenderObject::firstChild()).
+        This is a small gain on the PLT.
+
+        Reviewed by Mark Rowe
+
+        * rendering/bidi.cpp:
+        (WebCore::inlineWidth):
+        (WebCore::bidiNext):
+
+2009-02-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23628
+
+        Fix selection repainting to do container-relative repaints. RenderView now
+        repaints the selection using the containerForRepaint() for each RenderSelectionInfo.
+        selectionRect() is now a wrapper for selectionRectForRepaint() with no container.
+
+        Pull SelectionInfo out of RenderObject.h, and BlockSelectionInfo out
+        of RenderBlock.h and move them into RenderSelectionInfo.h, with some
+        sharing and refactoring.
+
+        RenderBlock::selectionGapRectsForRepaint() is not yet container-aware.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderBR.h:
+        (WebCore::RenderBR::selectionRectForRepaint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::selectionRectForRepaint):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::selectionRectForRepaint):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::selectionRect):
+        (WebCore::RenderObject::selectionRectForRepaint):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::absoluteRects):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        (WebCore::RenderSVGInlineText::selectionRectForRepaint):
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSelectionInfo.h: Added.
+        (WebCore::RenderSelectionInfoBase::RenderSelectionInfoBase):
+        (WebCore::RenderSelectionInfoBase::object):
+        (WebCore::RenderSelectionInfoBase::repaintContainer):
+        (WebCore::RenderSelectionInfoBase::state):
+        (WebCore::RenderSelectionInfo::RenderSelectionInfo):
+        (WebCore::RenderSelectionInfo::repaint):
+        (WebCore::RenderSelectionInfo::rect):
+        (WebCore::RenderBlockSelectionInfo::RenderBlockSelectionInfo):
+        (WebCore::RenderBlockSelectionInfo::repaint):
+        (WebCore::RenderBlockSelectionInfo::block):
+        (WebCore::RenderBlockSelectionInfo::rects):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::selectionRectForRepaint):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+        (WebCore::RenderView::setSelection):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Add inline capacity back to CSSMutableStyleDeclaration now that the bug in Vector has been fixed.
+
+        Reviewed by Darin Adler & Sam Weinig
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+
+2009-02-03  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13490
+        Implement execCommand("styleWithCSS", ...)
+
+        Determine whether or not to use HTML formatting tags for styling on the new
+        boolean on Editor instead of whether or not the document is quirks mode.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::StyleChange):
+        (WebCore::StyleChange::init):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/Editor.cpp:
+        (WebCore::Editor::Editor):
+        (WebCore::Editor::clear):
+        * editing/Editor.h:
+        (WebCore::Editor::setShouldStyleWithCSS):
+        (WebCore::Editor::shouldStyleWithCSS):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeStyleWithCSS):
+        (WebCore::stateStyleWithCSS):
+        (WebCore::CommandEntry::):
+
+2009-02-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        This is a follow up of r40546. Call toImage() once speeds up ImageBuffer::getImageData()
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::getImageData):
+
+2009-02-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        - Fix for <rdar://problem/6549743>
+
+        On Tiger, create an autorelease pool before creating the NSGraphicsContext and drain it immediately
+        after the call to -[NSView displayRectIgnoringOpacity:inContext:].
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Back this change out since it is causing layout tests to crash.  There is something subtle going on
+        here.
+
+        Reviewed by Darin Adler
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Give the properties vector of mutable style declarations an initial inline capacity to reduce malloc churn.
+
+        Reviewed by Sam Weinig
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Avoid creating extra copies of NSURLRequests for non-HTTP URLs.  Only mark platform requests
+        as needing updating when HTTP fields change if the scheme of the URL is actually HTTP or HTTPS.
+        Thus cuts down significantly on the number of copied NSURLRequests and is about a 1% gain on the PLT.
+
+        Reviewed by Darin Adler
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * platform/KURL.cpp:
+        (WebCore::KURL::invalidate):
+        (WebCore::KURL::KURL):
+        * platform/KURL.h:
+        (WebCore::KURL::isHTTPOrHTTPS):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::setCachePolicy):
+        (WebCore::ResourceRequestBase::setTimeoutInterval):
+        (WebCore::ResourceRequestBase::setMainDocumentURL):
+        (WebCore::ResourceRequestBase::setHTTPMethod):
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):
+        (WebCore::ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray):
+        (WebCore::ResourceRequestBase::setHTTPBody):
+        (WebCore::ResourceRequestBase::setAllowHTTPCookies):
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        Add manual test for floating divs with scrollbars.
+
+        * manual-tests/gtk/floatingdiv.html: Added.
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        There's no need to hold an extra ref to the scrollbar, calling
+        setPlatformWidget takes ownership of it.
+
+        Also do not disconnect the signals when destroying the widget,
+        it's superfluous.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::ScrollbarGtk):
+        * platform/gtk/ScrollbarGtk.h:
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        Declare scrollBar as GtkWidget* to avoid needless
+        casting.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::ScrollbarGtk):
+        (ScrollbarGtk::~ScrollbarGtk):
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        Properly calculate the scrollbar location for their
+        usage in RenderLayout.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::frameRectsChanged):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Rename addLineBoxRects to absoluteRectsForRange, and do the same thing for the corresponding quads methods.  Move the RenderContainer implementations
+        of these methods up to RenderObject.
+
+        Reviewed by Beth Dakin
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode lineBoxRects]):
+        * dom/Range.cpp:
+        (WebCore::Range::addLineBoxRects):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight):
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRectsForRange):
+        (WebCore::RenderObject::absoluteQuadsForRange):
+        * rendering/RenderObject.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRectsForRange):
+        (WebCore::RenderText::absoluteQuadsForRange):
+        * rendering/RenderText.h:
+
+2009-02-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Sam Weinig and Oliver Hunt.
+
+        Added getImageData() support for QtWebKit.
+
+        [QT] lacks getImageData / putImageData support in Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=22186
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::getImageData):
+
+2009-02-03  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix FrameChromium.cpp following r40473 which moved Frame::adjustPageHeight to FrameView::adjustPageHeight.
+
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame):
+
+2009-02-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23358
+
+        Hook accelerated compositing into RenderLayer.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        Init and clean up backing and the hasCompositingDescendant bit.
+
+        (WebCore::RenderLayer::compositor):
+        Shortcut to get to the RenderLayerCompositor.
+
+        (WebCore::RenderLayer::updateLayerPositions):
+        We need to let full repaints propagate to all compositing layers, and
+        update the backing after layout here.
+
+        (WebCore::RenderLayer::transparentAncestor):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        Account for the fact that opacity may be rendered via the compositing
+        layer sometimes.
+
+        (WebCore::RenderLayer::addChild):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        Tell the compositor when the RenderLayer hierarchy changes.
+
+        (WebCore::RenderLayer::scrollToOffset):
+        Update layer geometry after scrolling.
+
+        (WebCore::RenderLayer::paintLayer):
+        We short-circuit painting on composited layers, because these layers
+        are painted on a callback from the compositing system.
+
+        (WebCore::RenderLayer::hitTestLayer):
+        Only apply transforms if we are rendering them in software.
+
+        (WebCore::RenderLayer::localBoundingBox):
+        (WebCore::RenderLayer::boundingBox):
+        (WebCore::RenderLayer::absoluteBoundingBox):
+        Refactor bounding box code that we can compute local, and ancestor-relative
+        bounding box, as well as absolute.
+
+        (WebCore::RenderLayer::ensureBacking):
+        (WebCore::RenderLayer::clearBacking):
+        RenderLayerBacking creation and destruction.
+
+        (WebCore::RenderLayer::setParent):
+        Tell the compositor when the RenderLayer hierarchy changes.
+
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyStackingContextZOrderLists):
+        (WebCore::RenderLayer::dirtyOverflowList):
+        When the z-order and overflow lists change, we need to tell the
+        compositor that the composited layers need to be rejiggered soon.
+
+        (WebCore::RenderLayer::updateZOrderLists):
+        Whitespace cleanup.
+
+        (WebCore::RenderLayer::setBackingNeedsRepaint):
+        (WebCore::RenderLayer::setBackingNeedsRepaintInRect):
+        Dirty composited layer contents for painting.
+
+        (WebCore::RenderLayer::styleChanged):
+        Update the layer backing after style changes.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isComposited):
+        (WebCore::RenderLayer::backing):
+        Accessors for testing and getting the backing for this RenderLayer.
+
+        (WebCore::RenderLayer::paintsWithTransparency):
+        (WebCore::RenderLayer::paintsWithTransform):
+        Transform and opacity can be applied via the compositing layer, or rendered
+        in software. These methods tell us if we need to account for them in the
+        non-compositing path.
+
+        (WebCore::RenderLayer::hasCompositingDescendant):
+        (WebCore::RenderLayer::setHasCompositingDescendant):
+        Maintain a bit to tell if this layer has composited descendants.
+
+2009-02-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23365
+
+        Hook up accelerated compositing layers the native
+        view system on Mac.
+
+        * WebCore.base.exp:
+        Export new Page methods.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::attachRootGraphicsLayer):
+        (WebCore::ChromeClient::setNeedsOneShotDrawingSynchronization):
+        New methods for attaching/detaching the root GraphicsLayer, and
+        synchronizing layer changes with window drawing.
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::setNeedsOneShotDrawingSynchronization):
+        (WebCore::FrameView::didMoveOnscreen):
+        (WebCore::FrameView::willMoveOffscreen):
+        New methods to update the compositing layer hierarchy,
+        and pass-throughs to the RenderLayerCompositor.
+
+        (WebCore::FrameView::layout):
+        Update compositing layers after layout() and updateLayerPositions().
+
+        * page/Page.cpp:
+        (WebCore::Page::didMoveOnscreen):
+        (WebCore::Page::willMoveOffscreen):
+        * page/Page.h:
+        New methods to allow the native view system to tell the Page when it
+        starts to be presented on-screen, and when it will be hidden.
+
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::willMoveOffscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        Rename 'attached' methods to 'moveOnscreen/moveOffscreen' to match
+        the calls through from Page, FrameView.
+
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        Dont' try to repaint or update layers if the document is being torn
+        down.
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::didMoveOnscreen):
+        (WebCore::RenderView::willMoveOffscreen):
+        * rendering/RenderView.h:
+        New methods.
+
+2009-02-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Fixed getImageData and putImageData and respect pre-
+        multiplied colors.
+
+        Cairo's ImageBuffer::getImageData() does not handle alpha=0 case correctly
+        https://bugs.webkit.org/show_bug.cgi?id=21575
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+
+2009-02-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        - fix <rdar://problem/6550530> REGRESSION (r40508): Window opened with window.open has no initial history item (global and back/forward)
+
+        Test: fast/history/window-open.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow): Pass the missing lockBackForwardList parameter
+        to FrameLoader::changeLocation().
+
 2009-02-03  Adam Treat  <adam.treat@torchmobile.com>
 
         Fix the Qt build after r40536.
@@ -535,6 +42155,31 @@
         * bridge/qt/qt_runtime.cpp:
         (JSC::Bindings::convertQVariantToValue):
 
+2009-02-03  Dan Bernstein  <mitz@apple.com>
+
+        - fix -Wmissing-prototypes builds
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::workerContextDidSendData): Marked this function static.
+        (WebCore::workerContextDidReceiveResponse): Ditto.
+        (WebCore::workerContextDidReceiveData): Ditto.
+        (WebCore::workerContextDidFinishLoading): Ditto.
+        (WebCore::workerContextDidFail): Ditto.
+        (WebCore::workerContextDidGetCancelled): Ditto.
+        (WebCore::workerContextDidReceiveAuthenticationCancellation): Ditto.
+
+2009-02-03  David Kilzer  <ddkilzer@apple.com>
+
+        CrashTracer: [REGRESSION] 53 crashes in Safari at com.apple.WebCore: WebCore::LegacyWebArchive::create + 2706
+
+        <rdar://problem/6509514>
+
+        Reviewed by Adam Roben.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Null check the value returned
+        from WebCore::IconDatabase::iconForPageURL().
+
 2009-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -550,6 +42195,1949 @@
         (JSC::Bindings::convertQVariantToValue): Convert from
         QVariant::ByteArray to jsByteArray.
 
+2009-02-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * GNUmakefile.am: Removed WorkerTask.{h,cpp}.
+
+2009-02-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22718
+        Implement WindowTimers interface in Workers.
+
+        This patch moves timeoutID from Document to ScriptExecutionContext
+        and exposes JS methods setTimeout/setInterval/clearTimeout/clearInterval inside of a Worker.
+        Also added a test for those methods.
+
+        Test: fast/workers/worker-timeout.html
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::setTimeoutOrInterval):
+        Creates ScheduledAction and calls WorkerContext::installTimeout to actually add a timer.
+
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::clearTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        (WebCore::JSWorkerContext::clearInterval):
+        Added methods exposed to JS.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::addTimeout):
+        (WebCore::ScriptExecutionContext::removeTimeout):
+        (WebCore::ScriptExecutionContext::findTimeout):
+        * dom/ScriptExecutionContext.h:
+        The timerID map moves from Document to ScriptExecutionContext,
+        to be available to Document and to WorkerContext.
+
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::installTimeout): Adds a DOMTimeout.
+        (WebCore::WorkerContext::removeTimeout): Removes a DOMTimeout.
+        * dom/WorkerContext.h:
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::~DOMTimer):
+        (WebCore::DOMTimer::removeById):
+        Code change here reflects move of timeoutID map to the ScriptExecutionContext.
+        Some checks and casts are no longer needed.
+
+2009-02-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23560
+        Implement SharedTimer for Workers.
+
+        * dom/WorkerRunLoop.cpp:
+        Added private class WorkerSharedTimer that implements SharedTimer interface for worker threads.
+        (WebCore::WorkerSharedTimer::WorkerSharedTimer):
+        (WebCore::WorkerSharedTimer::setFiredFunction):
+        (WebCore::WorkerSharedTimer::setFireTime):
+        (WebCore::WorkerSharedTimer::stop):
+        (WebCore::WorkerSharedTimer::isActive):
+        (WebCore::WorkerSharedTimer::fireTime):
+        (WebCore::WorkerSharedTimer::fire):
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        Initializes a WorkerSharedTimer instance.
+        (WebCore::WorkerRunLoop::~WorkerRunLoop):
+        The destructor is here so compiler is ok with having OwnPtr<WorkerSharedTimer> in .h file w/o defining WorkerSharedTimer.
+        (WebCore::WorkerRunLoop::run):
+        Set/reset shared timer interface on ThreadTimers, use MessageQueue::waitForMessageTimed() if timer is active.
+        * dom/WorkerRunLoop.h:
+        Add member of type OwnPtr<WorkerSharedTimer>
+
+2009-02-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * dom/CrossThreadCopier.h: Changed forward declarations to use struct instead of class where
+        appropriate.
+
+2009-02-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23636: Make the async api of ThreadableLoader functional for the worker context.
+        <https://bugs.webkit.org/show_bug.cgi?id=23636>
+
+        Enable the async portion of ThreadableLoader for workers.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/CrossThreadCopier.h:
+        * dom/GenericWorkerTask.h:
+        * dom/WorkerThread.cpp:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        * loader/ThreadableLoaderClient.h:
+        (WebCore::ThreadableLoaderClient::didFinishLoading):
+        * loader/ThreadableLoaderClientWrapper.h: Added.
+        (WebCore::ThreadableLoaderClientWrapper::create):
+        (WebCore::ThreadableLoaderClientWrapper::clearClient):
+        (WebCore::ThreadableLoaderClientWrapper::didSendData):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveResponse):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveData):
+        (WebCore::ThreadableLoaderClientWrapper::didFinishLoading):
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        (WebCore::ThreadableLoaderClientWrapper::didGetCancelled):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveAuthenticationCancellation):
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        * loader/WorkerThreadableLoader.cpp: Added.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::~WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::cancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadDestroy):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::destroy):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::clearClientWrapper):
+        (WebCore::workerContextDidSendData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
+        (WebCore::workerContextDidReceiveResponse):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
+        (WebCore::workerContextDidReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::workerContextDidFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        (WebCore::workerContextDidFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        (WebCore::workerContextDidGetCancelled):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didGetCancelled):
+        (WebCore::workerContextDidReceiveAuthenticationCancellation):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation):
+        * loader/WorkerThreadableLoader.h: Added.
+        (WebCore::WorkerThreadableLoader::create):
+        (WebCore::WorkerThreadableLoader::refThreadableLoader):
+        (WebCore::WorkerThreadableLoader::derefThreadableLoader):
+
+2009-02-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23636: Make the async api of ThreadableLoader functional for the worker context.
+        <https://bugs.webkit.org/show_bug.cgi?id=23636>
+
+        No observable change in behavior, so no test.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Worker.cpp:
+        * dom/Worker.h:
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::postTask):
+        (WebCore::WorkerContext::postTaskToWorkerObject):
+        * dom/WorkerContext.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToWorkerContext):
+        Expose postTaskToWorkerContext for use by the worker object thread.
+
+        (WebCore::WorkerMessagingProxy::postTaskToWorkerObject):
+        Change the name of postTaskToParentContext to postTaskToWorkerObject for consistency
+        with postMessageToWorkerObject.
+
+        * dom/WorkerMessagingProxy.h:
+        * dom/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::run):
+        (WebCore::WorkerRunLoop::postTask):
+        * dom/WorkerRunLoop.h:
+        * dom/WorkerTask.cpp: Removed.
+        * dom/WorkerTask.h: Removed.
+        Removed WorkerTask and replaced with the existing ScriptExecutionContext::Task.
+
+        The resulted in the class going away along with an adapter that made
+        a ScriptExecutionContext::Task look like a WorkerTask.
+
+        * dom/WorkerThread.cpp:
+        * dom/WorkerThread.h:
+
+2009-02-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23618: Templated worker tasks should be more error proof to use.
+        <https://bugs.webkit.org/show_bug.cgi?id=23618>
+
+        Add the generic worker tasks templates needed for the WorkerThreadableLoader.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/CrossThreadCopier.cpp: Added.
+        * dom/CrossThreadCopier.h: Added.
+        (WebCore::CrossThreadCopierPassThrough::copy):
+        * dom/GenericWorkerTask.h:
+        Stop doing the WorkerMessagingProxy::askedToTerminate call automatically
+        in performTask because was not obvious that it would be done and not always needed.
+
+        (WebCore::GenericWorkerTask1::create):
+        (WebCore::GenericWorkerTask1::GenericWorkerTask1):
+        (WebCore::GenericWorkerTask1::performTask):
+        (WebCore::GenericWorkerTask2::create):
+        (WebCore::GenericWorkerTask2::GenericWorkerTask2):
+        (WebCore::GenericWorkerTask2::performTask):
+        (WebCore::GenericWorkerTask3::create):
+        (WebCore::GenericWorkerTask3::GenericWorkerTask3):
+        (WebCore::GenericWorkerTask3::performTask):
+        (WebCore::GenericWorkerTask4::create):
+        (WebCore::GenericWorkerTask4::GenericWorkerTask4):
+        (WebCore::GenericWorkerTask4::performTask):
+        (WebCore::GenericWorkerTask5::create):
+        (WebCore::GenericWorkerTask5::GenericWorkerTask5):
+        (WebCore::GenericWorkerTask5::performTask):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask6::GenericWorkerTask6):
+        (WebCore::GenericWorkerTask6::performTask):
+        (WebCore::GenericWorkerTask7::create):
+        (WebCore::GenericWorkerTask7::GenericWorkerTask7):
+        (WebCore::GenericWorkerTask7::performTask):
+        (WebCore::createCallbackTask):
+        * dom/WorkerContext.cpp:
+        (WebCore::addMessageTask):
+        (WebCore::WorkerContext::addMessage):
+        * dom/WorkerMessagingProxy.h:
+        (WebCore::WorkerMessagingProxy::askedToTerminate):
+
+2009-02-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David "The Barnabas Jones" Hyatt.
+
+        Move removeChildNode, appendChildNode and insertChildNode from
+        RenderContainer into RenderObjectChildList.  Make moveChildNode
+        static in RenderBlock, as that was the only user.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::moveChild):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addChild):
+        (WebCore::RenderContainer::removeChild):
+        * rendering/RenderContainer.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::createsAnonymousWrapper):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::RenderObjectChildList::removeChildNode):
+        (WebCore::RenderObjectChildList::appendChildNode):
+        (WebCore::RenderObjectChildList::insertChildNode):
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::addChild):
+        (WebCore::RenderSVGContainer::removeChild):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::removeChild):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::removeChild):
+        * rendering/RenderTableSection.h:
+
+2009-02-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23697
+        Leaks seen on Worker tests
+
+        * dom/WorkerMessagingProxy.cpp: (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal):
+        Zero out m_workerThread, so that the proxy could be deleted once workerObjectDestroyed()
+        is called.
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Move positionForCoordinates up from RenderContainer into RenderBox.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForCoordinates):
+        * rendering/RenderBox.h:
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+
+2009-02-02  Hiroaki Nakamura <hnakamur@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=15813
+        Modify pre-build step to properly handle the errorlevel
+        shell command.
+
+        * WebCore.vcproj/WebCore.vcproj: Change errorlevel handling
+        for all targets so prefast is only enabled in builds
+        where /analyze is available.
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Refactor the handling of before/after content and generated content.  Move most of the functions from
+        RenderContainer into RenderObjectChildList.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateBeforeAfterContent):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::isAfterContent):
+        * rendering/RenderBox.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::updateBeforeAfterContent):
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeChildren):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        * rendering/RenderObject.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::beforeAfterContainer):
+        (WebCore::findBeforeAfterParent):
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+        * rendering/RenderObjectChildList.h:
+
+2009-02-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23661
+        Fix Chromium build.
+
+        * history/HistoryItem.h: need to include <wtf/OwnPtr.h>
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle): isEnabled() is now on FormControlElement.
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * WebCore.base.exp:
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Track redirects in global history.
+
+        * WebCore.base.exp: Renamed some exports.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow):
+        (windowProtoFuncOpen):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::assign): Treat any navigation that is not initiated
+        by the user as a redirect from the perspective of global history.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::addRedirectURL): Store the last URL in the redirect
+        chain.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::urlForHistoryReflectsServerRedirect):
+        (WebCore::DocumentLoader::urlForHistoryReflectsClientRedirect):
+        (WebCore::DocumentLoader::setURLForHistoryReflectsClientRedirect): Sadly,
+        added yet another way to track redirect state during loading, since none
+        of the others did what I wanted, and I didn't want to cause behavior
+        changes in existing code.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::updateGlobalHistoryForRedirectWithoutHistoryItem):
+        Stubbed out a client function to keep things building.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState): Renamed FrameLoadTypeRedirect =>
+        FrameLoadTypeRedirectWithLockedBackForwardList, to distinguish from all
+        the other meanings of "redirect" in the loading code.
+
+        (WebCore::FrameLoader::scheduleHTTPRedirection): Treat any HTTP refresh
+        redirect as a redirect from the perspective of global history.
+
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Updated for rename and extra
+        parameter.
+
+        (WebCore::FrameLoader::startRedirectionTimer): Removed unused parameter.
+
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load): Updated for rename and extra parameter.
+
+        (WebCore::FrameLoader::loadWithNavigationAction): Track redirect status
+        in the DocumentLoader, so it's accessible to WebKit's global history code.
+
+        (WebCore::FrameLoader::clientRedirected): Ignore lockHistory, since it
+        only has meaning to global history, and m_quickRedirectComing pertains
+        to other kinds of history.
+
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::loadEmptyDocumentSynchronously):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy):
+        (WebCore::FrameLoader::loadItem): Updated for extra parameter and rename.
+
+        (WebCore::FrameLoader::updateHistory*): Notify WebKit about redirect
+        navigations even if they don't create new history items, so we can track
+        the redirect in the existing history item.
+
+        * loader/FrameLoader.h: See above.
+
+        * loader/FrameLoaderClient.h: New client interface used by
+        FrameLoader::updateHistory* to record a redirect even if it doesn't create
+        a new history item of its own.
+
+        * loader/FrameLoaderTypes.h: See above.
+        (WebCore::):
+
+        * page/DragController.cpp:
+        (WebCore::DragController::performDrag):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Updated for extra parameter.
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Make calcPrefWidths non-abstract on RenderBox and just give it RenderContainer's implementation.
+        Remove RenderSVGContainer's implementation, since it was never called.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::minPrefWidth):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::calcPrefWidths):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::moveChildNode):
+        * rendering/RenderSVGContainer.h:
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add jsObjectForPluginElement to ScriptController, and have createScriptObjectForPluginElement call it.
+
+        * WebCore.LP64.exp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptController.h:
+
+2009-02-02  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel (and Ojan Vafai).
+
+        https://bugs.webkit.org/show_bug.cgi?id=23696
+        Select element doesn't show new value when focus is switched in
+        onchange event.
+
+        Fix PopupMenuChromium to hide itself before calling valueChanged.  This
+        better matches the behavior of the other ports.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Make sure scrollWidth/Height just return 0 for inline flows.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23676: Speed up uses of reserveCapacity on new vectors by adding a new reserveInitialCapacity
+        https://bugs.webkit.org/show_bug.cgi?id=23676
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyName):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::copyPropertiesInSet):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::sortMatchedRules):
+        * dom/Document.cpp:
+        (WebCore::Document::formElementsState):
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedAttrMap::reserveInitialCapacity):
+        * editing/TextIterator.cpp:
+        (WebCore::CharacterIterator::string):
+        (WebCore::SearchBuffer::SearchBuffer):
+        (WebCore::plainTextToMallocAllocatedBuffer):
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::Token::addAttribute):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::items):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::toString):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (convertToVector):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::invalidate):
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::formCreate):
+        * xml/XPathNodeSet.cpp:
+        (WebCore::XPath::NodeSet::sort):
+        Use reserveInitialCapacity instead of of reserveCapacity in all these call sites,
+        which are working on new vectors that are guaranteed not to be empty.
+
+2009-02-26  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Build fix after r40486.
+
+        Rubber-stamped by Ada Chan.
+
+        * dom/Document.h: Changed HitTestRequest to a class from a struct.
+        * page/EventHandler.h: Ditto.
+        * rendering/EllipsisBox.h: Ditto.
+        * rendering/InlineBox.h: Ditto.
+        * rendering/InlineFlowBox.h: Ditto.
+        * rendering/RenderLayer.h: Ditto.
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23694: REGRESSION: Running svg/custom tests crashes, randomly, depending on the order of tests
+        https://bugs.webkit.org/show_bug.cgi?id=23694
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument): Added back the call through to EventTargetNode.
+        (WebCore::ContainerNode::removedFromDocument): Ditto.
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::insertedIntoDocument): Changed this to not call through to Node.
+        (WebCore::EventTargetNode::removedFromDocument): Ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::insertedIntoDocument): Updated comment.
+        (WebCore::Node::removedFromDocument): Ditto.
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        More plug-in cleanup.
+
+        * WebCore.NPAPI.exp:
+        Add new symbols.
+
+        * bindings/objc/DOM.mm:
+        * bindings/objc/DOMPrivate.h:
+        Remove methods that WebKit doesn't use anymore.
+
+2009-02-02  Jay Campan  <jcampan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Clean up PopupMenuChromium a little.
+        https://bugs.webkit.org/show_bug.cgi?id=23653
+
+        No functional changes, only code cleanup, thus no tests.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::selectNextRow):
+        (WebCore::PopupListBox::selectPreviousRow):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change createPlugin to take a HTMLPlugInElement, and createJavaAppletWidget to take a HTMLAppletElement.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::createPlugin):
+        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
+        * loader/FrameLoader.cpp:
+        (WebCore::toPlugInElement):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+
+2009-02-02  Genevieve Mak  <gen@staikos.net>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23508
+        Returns Blank Page for all "about" protocols
+
+        * loader/MainResourceLoader.cpp:
+        Fix shouldLoadAsEmptyDocument() to return a blank page for an empty
+        url or about:blank only (for now, exclusively for Torch Mobile platform).
+
+2009-02-02  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=23691.
+        Correct build break caused by @r40366 by moving the
+        common code implmentations from GraphicsContextCGWin.cpp
+        into the base Windows class (GraphicsContextWin.cpp).  Also
+        move inTransparencyLayer since it is identical in both
+        children.
+
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+          Added member m_shouldIncludeChildWindows to Windows version,
+          similar to GraphicsContextPlatformPrivateCG.h.
+        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove the
+          implementations of shouldIncludeChildWindows,
+          setShouldIncludeChildWindows, and inTransparencyLayer.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
+          the implementation of inTransparencyLayer.
+        * platform/graphics/win/GraphicsContextWin.cpp: Move common code
+          from GraphicsContextCGWin.cpp and GraphicsContextCairoWin.cpp.
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        (WebCore::GraphicsContext::setShouldIncludeChildWindows):
+        (WebCore::GraphicsContext::shouldIncludeChildWindows):
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Try to fix Wx build, and maybe Chromium build too.
+
+        * WebCore.scons: Added IdentifierRep.cpp.
+        * WebCoreSources.bkl: Ditto.
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Try to fix Wx build.
+
+        * html/HTMLAreaElement.cpp: Added missing include of "Path.h".
+
+2009-02-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23587
+        Refactor HitTestRequest to eliminate all the ugly boolean arguments and
+        use an enum bitflag instead.  Cleanup all the code that constructs the
+        various HitTestRequests to make the code more readable.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::prepareMouseEvent):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::contains):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::hoverTimerFired):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::):
+        (WebCore::HitTestRequest::HitTestRequest):
+        (WebCore::HitTestRequest::readOnly):
+        (WebCore::HitTestRequest::active):
+        (WebCore::HitTestRequest::mouseMove):
+        (WebCore::HitTestRequest::mouseUp):
+        (WebCore::HitTestRequest::ignoreClipping):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateHoverActiveState):
+
+2009-02-02  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Niko Zimmermann.
+
+        Fix WML build by including the inlined renderStyle().
+
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptionElement.cpp:
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Niko Zimmermann.
+
+        Bug 23686: REGRESSION (r40475): Failure in fast/xpath/4XPath/Core/test_core_functions.html
+        https://bugs.webkit.org/show_bug.cgi?id=23686
+        rdar://problem/6547971
+
+        Also fix other XPath tests that are crashing.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Fix order of arguments when creating QualifiedName.
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis): Use createAttrIfNeeded() rather than attr() since we
+        need to make Attr nodes here. Yuck!
+
+2009-02-02  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        Test: wml/input-format.html
+
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::formatCodes):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::attach):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::init):
+        (WebCore::WMLInputElement::validateInputMask):
+        (WebCore::WMLInputElement::isConformedToInputMask):
+        (WebCore::WMLInputElement::cursorPositionToMaskIndex):
+        * wml/WMLInputElement.h:
+
+2009-02-02  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix only, no review.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=23685.
+        Correct build break caused by @r40473.
+
+        * page/win/FrameWin.cpp: Correct access for adjustPageHeight.
+        (WebCore::computePageRectsForFrame):
+
+2009-02-02  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds.
+        FrameLoader::urlSelected() got a new parameter: lockBackForwardList. Pass 'false', as HTMLAnchorElement does.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+
+2009-02-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6451610> Reloading a AppCache page doesn't ever hit the server
+
+        Not easily testable.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle): A new method that creates a resource
+        handle in a manner that is closer to what CachedResource does. We now make conditional
+        requests for better performance, and set max-age to ensure that stale responses are not used.
+        (WebCore::ApplicationCacheGroup::update): Use the new createResourceHandle() method.
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): If the response code for the resource
+        is 304, take it from the newest cache.
+        (WebCore::ApplicationCacheGroup::didFail): Pre-compute request URL.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse): Don't create a resource for
+        the manifest if the response code was 304 - it won't be needed.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestData): Replaced an assertion that
+        m_manifestResource is not null with a check.
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest): Treat null m_manifestResource as
+        an indication that the response was 304.
+        (WebCore::ApplicationCacheGroup::startLoadingEntry): Use createResourceHandle().
+
+        * loader/appcache/ApplicationCacheGroup.h: Added createResourceHandle().
+
+2009-02-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23674: Speed up some things based on profiling the page load test
+        https://bugs.webkit.org/show_bug.cgi?id=23674
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Use the newly named cssTarget instead
+        of the old name, getCSSTarget.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument): Moved code from Node in here rather than
+        calling through to EventTargetNode::insertedIntoDocument.
+        (WebCore::ContainerNode::removedFromDocument): Ditto.
+        (WebCore::ContainerNode::insertedIntoTree): Tweaked a bit.
+        (WebCore::ContainerNode::removedFromTree): Ditto.
+
+        * dom/ContainerNode.h: Moved the constructor definition here and made it inline.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListenersFromAllNodes): Iterate the document element and
+        its contents only to avoid the document type node. This allows us to remove the virtual
+        function call to isEventTargetNode from the loop.
+        (WebCore::Document::setCSSTarget): Changed argument to be an Element rather than Node.
+
+        * dom/Document.h: Changed CSS target to be an Element rather than a Node. Renamed
+        getCSSTarget to cssTarget.
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::removeAllEventListenersSlowCase): Renamed and turned the
+        rare data check into an assertion.
+
+        * dom/EventTargetNode.h: Made the fast case of removeAllEventListeners be inline.
+        Also moved the constructor definition here and made it inline. And added toEventTargetNode,
+        matching the design of the render tree checked casts. Later we can migrate all callers
+        from EventTargetNodeCast to toEventTargetNode.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedAttrMap::detachAttributesFromElement): Added. Factored out from
+        clearAttributes, so we could use this loop in cases where we're not clearing the attributes.
+        (WebCore::NamedAttrMap::~NamedAttrMap): Call detachAttributesFromElement instead of
+        clearAttributes here.
+        (WebCore::NamedAttrMap::clearAttributes): Call detachAttributesFromElement here.
+        (WebCore::NamedAttrMap::detachFromElement): Call detachAttributesFromElement instead of
+        clearAttributes. We don't need to clear the attributes array just because the element is
+        going away, so don't.
+        (WebCore::NamedAttrMap::virtualLength): Added.
+
+        * dom/NamedAttrMap.h: Made all the virtual functions inherited from NamedNodeMap be private.
+        These are all unnecessarily inefficient for use outside the DOM. Changed length to be a
+        non-virtual function. This was a fairly hot function.
+
+        * dom/NamedMappedAttrMap.cpp:
+        (WebCore::NamedMappedAttrMap::setClass): Changed to use element() function now that the
+        m_element data member is private.
+
+        * dom/NamedMappedAttrMap.h: Made a few functions private. Made the
+        hasMappedAttributes function non-virtual.
+
+        * dom/NamedNodeMap.h: Made length a non-virtual inline function that calls a virtual
+        function, name virtualLength. This lets NamedAttrMap::length be a non-virtual function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::insertedIntoDocument): Removed call to insertedIntoTree, since it's
+        only non-empty in subclasses of ContainerNode.
+        (WebCore::Node::removedFromDocument): Ditto. Also removed setCSSTarget. Since a CSS
+        target has to be an Element, this can be moved down to ContainerNode (or it could be
+        moved down to Element for that matter).
+
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::QualifiedName): Removed double initialization of m_impl.
+
+        * dom/QualifiedName.h: Moved the destructor, copy constructor, assignment operator, and
+        setPrefix function definitions into the header and made them inline.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::mapMouseEvent): Updated since the stored region is now
+        an OwnPtr.
+        (WebCore::HTMLAreaElement::accessKey): Use AtomicString.
+        (WebCore::HTMLAreaElement::setAccessKey): Ditto.
+        (WebCore::HTMLAreaElement::alt): Ditto.
+        (WebCore::HTMLAreaElement::setAlt): Ditto.
+        (WebCore::HTMLAreaElement::coords): Ditto.
+        (WebCore::HTMLAreaElement::setCoords): Ditto.
+        (WebCore::HTMLAreaElement::setHref): Ditto.
+        (WebCore::HTMLAreaElement::shape): Ditto.
+        (WebCore::HTMLAreaElement::setShape): Ditto.
+        (WebCore::HTMLAreaElement::setTarget): Ditto.
+
+        * html/HTMLAreaElement.h: Use AtomicString in the getter and setter DOM operations.
+        Change the region data member to be an OwnPtr<Path> instead of a Path to optimize
+        the common case where an area element is parsed but never hit-tested. This could
+        also have been done by changing the Path class's null case to be more efficient,
+        but this seems fine.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use addAttribute instead
+        of insertAttribute.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Ditto.
+        (WebCore::HTMLViewSourceDocument::addLine): Ditto.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Use cssTarget under its new name instead
+        of its old name getCSSTarget.
+
+        * platform/graphics/GlyphWidthMap.cpp:
+        (WebCore::GlyphWidthMap::locatePageSlowCase): Refactored from locatePage.
+
+        * platform/graphics/GlyphWidthMap.h: Made most of this class inline.
+        Changed m_pages to use OwnPtr.
+
+        * platform/text/PlatformString.h: Remove include no longer needed since
+        StringImpl.h includes it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::createStrippingNullCharactersSlowCase): Refactored
+        from createStrippingNullCharacters.
+        * platform/text/StringImpl.h: Moved the definition of
+        createStrippingNullCharacters here and made it inline.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::firstLineStyleSlowCase): Refactored from
+        firstLineStyle.
+
+        * rendering/RenderObject.h: Moved the definition of the firstLineStyle
+        function here and made it inline. Moved the definition of the
+        documentBeingDestroyed function here and made it inline.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getCTM): Use getAttributeItem instead of
+        getNamedItem here since it accomplishes the same thing but is more efficient.
+        (WebCore::SVGSVGElement::getScreenCTM): Ditto.
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute): Ditto.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Use getAttributeItem instead of
+        getNamedItemNS.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis): Use attributeItem instead of item here.
+
+2009-02-02  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Move Frame::forceLayout, Frame::adjustPageHeight and Frame::forceLayoutWithPageWidthRange to FrameView
+
+        https://bugs.webkit.org/show_bug.cgi?id=23428
+
+        FrameView::forceLayout could be killed but the comment might
+        contain a value over the the plain FrameView::layout...
+
+        Adjust the WebCore/WebKit consumers of these methods.
+
+        * WebCore.base.exp:
+        * page/Frame.cpp:
+        (WebCore::Frame::setPrinting):
+        * page/Frame.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::forceLayout):
+        (WebCore::FrameView::forceLayoutWithPageWidthRange):
+        (WebCore::FrameView::adjustPageHeight):
+        * page/FrameView.h:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+
+2009-02-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6546625> REGRESSION (r40432): iframes added to global history at haaretz.co.il
+
+        Fixes http/tests/navigation/multiple-back-forward-entries.html
+
+        r40432 added a parameter to FrameLoader::scheduleLocationChange() and
+        failed to update all call sites.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow): Pass the lockBackForwardHistory parameter,
+        giving it the same value as the lockHistory parameter.
+        (windowProtoFuncOpen): Ditto.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation): Ditto.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame): Ditto.
+
+2009-01-31  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6546549> Eliminate some RenderText::width() overhead from findNextLineBreak()
+
+        On the PLT, this results in 0.36x the number of virtual function calls
+        to RenderText::width() and 0.69x the number of calls to
+        Font::isFixedPitch(), but makes 1.0004x the number of calls to
+        Font::width().
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::width): Replaced bounds checks on 'from' and 'len'
+        with an assertion.
+        * rendering/bidi.cpp:
+        (WebCore::textWidth): Added this inlined helper function which calls
+        Font::width() directly in the non-fixed-pitch, non-full-range case, and
+        otherwise calls RenderText::width().
+        (WebCore::RenderBlock::findNextLineBreak): Cache whether the font has
+        fixed pitch (in which case RenderText::width() will be called in order
+        to take advantage of the widthFromCache() optimization for fixed-pitch
+        fonts). Replaced all calls to RenderText::width() with calls to the
+        textWidth() helper function.
+
+2009-01-31  David Hyatt  <hyatt@apple.com>
+
+        Inline all of the setNeedsLayout method and its associated functions.  Also inline setChildNeedsLayout
+        and setNeedsPositionedMovementLayout.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setLayerNeedsFullRepaint):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::setNeedsPositionedMovementLayout):
+        (WebCore::objectIsRelayoutBoundary):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+
+2009-01-31  Darin Adler  <darin@apple.com>
+
+        Fix Mac build.
+
+        * loader/FrameLoader.cpp: Moved FrameLoaderClient::hasHTMLView in here.
+        We need it to not be an inline. Sadly, FrameLoaderClient.cpp was prematurely
+        deleted and I don't want to bring it back just to fix the build.
+
+        * loader/FrameLoaderClient.h: Rearrange virtual functions and corrected
+        a possibly-confusing comment.
+
+2009-01-31  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23664
+        Remove unused dead code from RenderTable class.  The dead code includes
+        two enums and the associated member variables as well as one getter function.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::RenderTable):
+        * rendering/RenderTable.h:
+
+2009-01-31  David Hyatt  <hyatt@apple.com>
+
+        More removal of code from RenderContainer.  Move removeLeftoverAnonymousBlock down into RenderBlock.
+        Move destroyLeftoverChildren into the RenderObjectChildList.  Convert all containers to use the
+        RenderObjectChildList.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::addChild):
+        (WebCore::RenderBlock::removeLeftoverAnonymousBlock):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::childBecameNonInline):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::layout):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::firstChildBox):
+        (WebCore::RenderBox::lastChildBox):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addChild):
+        (WebCore::RenderContainer::removeChildNode):
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        (WebCore::RenderContainer::appendChildNode):
+        (WebCore::RenderContainer::insertChildNode):
+        (WebCore::RenderContainer::positionForCoordinates):
+        (WebCore::RenderContainer::addLineBoxRects):
+        (WebCore::RenderContainer::collectAbsoluteLineBoxQuads):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::virtualChildren):
+        (WebCore::RenderContainer::children):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::layout):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::destroy):
+        (WebCore::RenderMedia::children):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::virtualChildren):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        (WebCore::RenderObject::layout):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::firstChild):
+        (WebCore::RenderObject::lastChild):
+        (WebCore::RenderObject::virtualChildren):
+        (WebCore::RenderObject::canHaveChildren):
+        * rendering/RenderObjectChildList.cpp: Added.
+        (WebCore::RenderObjectChildList::destroyLeftoverChildren):
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderReplaced.h:
+        (WebCore::RenderReplaced::canHaveChildren):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        (WebCore::RenderSVGContainer::destroy):
+        (WebCore::RenderSVGContainer::removeChildNode):
+        (WebCore::RenderSVGContainer::appendChildNode):
+        (WebCore::RenderSVGContainer::insertChildNode):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::virtualChildren):
+        (WebCore::RenderSVGContainer::children):
+
+2009-01-31  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=11363
+
+        Remove the hacks in table code around the DeleteButtonController and fix tables so that positioned children don't get wrapped in anonymous objects.
+        With the removal of a non-positioned DeleteButtonController renderer, table layout can be tightened up to only lay out table sections.  Table section
+        layout is tightened up to ignore non-table rows.  When a table has multiple captions, only the real one will do a layout now.  The other ones will
+        be properly ignored.
+
+        Reviewed by Oliver Hunt
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layout):
+        * rendering/RenderTableSection.h:
+
+2009-01-31  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23663
+        Add a void toRenderBox() method which catches unnecessary casts at compile
+        time and also fix the four cases where this was happening.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::determineHorizontalPosition):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::updateHitTestResult):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+
+2009-01-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Add a pref to disable web security.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::grantUniversalAccess):
+        * page/SecurityOrigin.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebSecurityEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::isWebSecurityEnabled):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        Move the inline virtual destructor after a non-inline virtual
+        function so that the symbol for the vtable is not marked as a
+        weakly exported symbol.
+
+        This trick was previously used at revision 36122 in JSObject.h
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::~FrameLoaderClient):
+
+2009-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Stephanie Lewis
+
+        Inline SimpleFontData::widthForGlyph for a minor page load improvement.
+
+        * platform/graphics/SimpleFontData.cpp:
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::widthForGlyph):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix for WX and maybe even Windows.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Move Frame::sendResizeEvent and Frame::sendScrollEvent to EventHandler
+
+        Carry out the move and catch up in two call sites.
+
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent):
+        * page/EventHandler.h:
+        * page/Frame.cpp:
+        * page/Frame.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::valueChanged):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Move Frame::isFrameSet to Document::isFrameSet
+
+        Changed the FrameLoader callsite. I assume that as this
+        point m_frame.document() might return a null pointer. Change
+        the condition to either not having a document or not having a
+        frame set. This should be semantically equivalent to the
+        old code.
+
+        Make Document::body() const to be able to call it from within
+        Document::isFrameSet. Leave the isHTMLDocument() check as this
+        is a stronger condition than simply having a HTMLElement in the
+        DOM.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::isFrameSet):
+        (WebCore::Document::body):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldScrollToAnchor):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createFromSelection):
+        * page/Frame.cpp:
+        * page/Frame.h:
+
+2009-01-30  Aurelian Maga  <aurelianmaga@yahoo.com>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Logic fixes and build fixes
+
+        https://bugs.webkit.org/show_bug.cgi?id=22022
+
+        Catch up with the internal GeoLocation API and fix the logic of
+        the previous version.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::updateLocationInformation):
+        (WebCore::GeolocationServiceGtk::position_changed):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [GTK] Implement GeolocationService using the Geoclue library
+
+        https://bugs.webkit.org/show_bug.cgi?id=22022
+
+        Untested implementation of the GeolocationService using the geoclue
+        library. Velocity handling is completely missing and the accuracy
+        handling might be wrong.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WTF::GeoclueAccuracy):
+        (WebCore::GeolocationServiceGtk::GeolocationServiceGtk):
+        (WebCore::GeolocationServiceGtk::~GeolocationServiceGtk):
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::stopUpdating):
+        (WebCore::GeolocationServiceGtk::suspend):
+        (WebCore::GeolocationServiceGtk::resume):
+        (WebCore::GeolocationServiceGtk::lastPosition):
+        (WebCore::GeolocationServiceGtk::lastError):
+        (WebCore::GeolocationServiceGtk::updateLocationInformation):
+        (WebCore::GeolocationServiceGtk::updatePosition):
+        (WebCore::GeolocationServiceGtk::position_changed):
+        (WebCore::GeolocationServiceGtk::setError):
+        * platform/gtk/GeolocationServiceGtk.h:
+
+2009-01-30  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Declare preferredSize as static.
+
+        * platform/text/cf/StringImplCF.cpp:
+        (WebCore::StringWrapperCFAllocator::preferredSize):
+
+2009-01-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23622: create CFString and NSString objects from WebCore::String without copying the characters
+        https://bugs.webkit.org/show_bug.cgi?id=23622
+
+        * platform/text/cf/StringImplCF.cpp:
+        (WebCore::StringWrapperCFAllocator::allocator): Added. Returns the allocator.
+        (WebCore::StringWrapperCFAllocator::retain): Added. Callback for allocator.
+        (WebCore::StringWrapperCFAllocator::release): Ditto.
+        (WebCore::StringWrapperCFAllocator::copyDescription): Ditto.
+        (WebCore::StringWrapperCFAllocator::allocate): Ditto.
+        (WebCore::StringWrapperCFAllocator::reallocate): Ditto.
+        (WebCore::StringWrapperCFAllocator::deallocate): Ditto.
+        (WebCore::StringWrapperCFAllocator::preferredSize): Ditto.
+        (WebCore::StringWrapperCFAllocator::create): Added. Creates the allocator, but
+        returns 0 if garbage collection is enabled.
+        (WebCore::StringImpl::createCFString): Use StringWrapperCFAllocator if possible.
+
+        * platform/text/mac/StringImplMac.mm:
+        (WebCore::StringImpl::operator NSString *): Use CFString and toll-free bridging,
+        rather than using NSString directly. This lets NSString benefit from the above.
+
+2009-01-30  Darin Adler  <darin@apple.com>
+
+        * page/Frame.cpp:
+        (WebCore::Frame::createView): Fix debug build by removing get() from assert.
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22056
+
+        Kill FrameLoaderClient.cpp, move the code over to Frame::createView
+
+        FrameLoaderClient is supposed to be an interface, move the
+        to be shared code to Frame which is a controller and is
+        allowed to create a FrameView.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoaderClient.cpp: Removed.
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::~FrameLoaderClient):
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/Frame.h:
+
+2009-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23357
+
+        New files to support accelerated compositing at the RenderLayer
+        level.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        New files added to project, and run through the sort script.
+
+        * rendering/RenderLayerBacking.cpp: Added.
+        * rendering/RenderLayerBacking.h: Added.
+        New object to store compositing-related data for a single
+        RenderLayer.
+
+        * rendering/RenderLayerCompositor.cpp: Added.
+        * rendering/RenderLayerCompositor.h: Added.
+        Per-RenderView controller object for compositing hierarchy
+        maintenance.
+
+2009-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23356
+
+        Add new files related to accelerated compositing:
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add the files to the project. Also add ColorCG.cpp, for the
+        Color(CGColorRef) constructor.
+
+        * platform/graphics/GraphicsLayer.cpp: Added.
+        * platform/graphics/GraphicsLayer.h: Added.
+        GraphicsLayer is a platform abstraction for a hardware-backed
+        layer.
+
+        * platform/graphics/GraphicsLayerClient.h: Added.
+        Client of GraphicsLayer, allowing GraphicsLayer to call out
+        to WebCore code.
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Added.
+        * platform/graphics/mac/GraphicsLayerCA.mm: Added.
+        Mac Core Animation implementation of GraphicsLayer.
+
+        * platform/graphics/mac/WebLayer.h: Added.
+        * platform/graphics/mac/WebLayer.mm: Added.
+        * platform/graphics/mac/WebTiledLayer.h: Added.
+        * platform/graphics/mac/WebTiledLayer.mm: Added.
+        Subclasses of CALayer and CATiledLayer -- helpers for the
+        GraphicsLayerCA implementation.
+
+2009-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Split "lockHistory" into "lockHistory" and "lockBackForwardList" in
+        preparation for setting them differently during a redirect.
+
+        * WebCore.base.exp:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FormSubmission::FormSubmission):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::submitFormAgain):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::clientRedirected):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler):
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6545095>
+        ASSERTION FAILED: RenderBlock.h:519: !o || o->isRenderBlock()
+
+        Test: fast/block/float/crash-replaced-display-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren): Move RenderBlock only code into
+        isRenderBlock if-statement.
+
+2009-01-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23656: AX hierarchy for iFrames is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=23656
+
+        The AX hierarchy when an iFrame was present was incorrect. A different scroll area was
+        returned when going down compared to when going up.
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (convertToNSArray):
+
+2009-01-30  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build to include new class IdentifierRep introduced in revision 40412.
+
+        * WebCore.pro:
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make IdentifierRep.h a private header, and add symbols needed by WebKit to WebCore.LP64.exp.
+
+        * WebCore.LP64.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Commit files I forgot to in the previous commit.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::layoutCount):
+        * page/Frame.cpp:
+        (WebCore::Frame::contentRenderer):
+        (WebCore::Frame::forceLayoutWithPageWidthRange):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintUsingContainer):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::view):
+        (WebCore::RenderObject::scheduleRelayout):
+        (WebCore::RenderObject::maximalOutlineSize):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::clampImageBufferSizeToViewport):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More scaffolding for redirect tracking. No behavior change yet.
+
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit): Added scaffolding necessary for
+        redirect checking in a form submission through JS. (Currently, we
+        just specify "no redirect.")
+
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::isJavaScriptAnchorNavigation): Refactored
+        user gesture check to make it more clear.
+
+        (WebCore::ScriptController::pageIsProcessingUserGesture): Added a helper
+        for checking if there's a user gesture in any frame on the page (a more
+        relaxed rule than our popup blocking rule, which requires the user
+        gesture to occur in the frame that's executing JavaScript.)
+
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit): Added scaffolding necessary for
+        redirect checking in a form submission through the DOM. (Currently, we
+        just specify "no redirect.")
+
+        * html/HTMLFormElement.idl: Made submit custom so it can participate
+        in redirect checking.
+
+        * loader/FrameLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FormSubmission::FormSubmission): Clarified some names, and
+        added a "lockHistory" parameter to form submissions, to match other
+        navigations.
+
+        (WebCore::FrameLoader::submitFormAgain):
+        (WebCore::FrameLoader::submitForm): Use the lockHistory parameter.
+
+        (WebCore::FrameLoader::userGestureHint): Refactored this function for
+        clarity, and added a FIXME for a change I was too scared to make myself.
+        (Really, we should just get rid of this function.)
+
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues): Refactored
+        to pass a FrameLoadType to form posts, too, so they can participate in
+        redirect tracking.
+
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadItem): Use the lockHistory parameter.
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk+] Use AccessibilityObject::stringValue for the AtkObject name
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+
+        The API documentation at http://library.gnome.org/devel/atk/stable/AtkText.html
+        states that: "AtkObjects whose text content is simple, unattributed, and very
+        brief may expose that content via atk_object_get_name instead"
+
+        As we are currently not able to always provide a AtkTextInterface
+        implementation this will make the whole content available to accerciser,
+        and other tools.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Include string.h for strdup.
+
+        * bridge/IdentifierRep.h:
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add toRenderView methods for casting RenderObjects to RenderViews.  The methods will assert if the object
+        is not a RenderView.
+
+        * dom/Document.cpp:
+        (WebCore::Document::renderView):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+        (WebCore::RenderBox::availableHeightUsing):
+        * rendering/RenderView.h:
+        (WebCore::toRenderView):
+
+2009-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        Really use the container-relative repaint rect methods
+        for repaint during layout
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::LayoutRepainter::LayoutRepainter):
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Get rid of PrivateIdentifier and use IdentifierRep instead.
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Invoke):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertNPStringToUTF16):
+        * bridge/c/c_utility.h:
+        * bridge/npruntime.cpp:
+        (_NPN_GetStringIdentifier):
+        (_NPN_GetStringIdentifiers):
+        (_NPN_GetIntIdentifier):
+        (_NPN_IdentifierIsString):
+        (_NPN_UTF8FromIdentifier):
+        (_NPN_IntFromIdentifier):
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig and Darin Adler.
+
+        Make IdentifierRep a real class, add necessary class methods.
+
+        * bridge/IdentifierRep.cpp:
+        (WebCore::identifierSet):
+        Returns a set of all identifiers.
+
+        (WebCore::IdentifierRep::isValid):
+        Return whether an identifier is valid, meaning that it's present in the
+        set of identifiers.
+
+        * bridge/IdentifierRep.h:
+        (WebCore::IdentifierRep::isString):
+        (WebCore::IdentifierRep::number):
+        (WebCore::IdentifierRep::string):
+        (WebCore::IdentifierRep::IdentifierRep):
+        (WebCore::IdentifierRep::):
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add IdentifierRep which will be used by both plug-in implementations.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/IdentifierRep.cpp: Added.
+        (WebCore::IdentifierRep::IdentifierRep):
+        (WebCore::IdentifierRep::):
+        (WebCore::intIdentifierMap):
+        (WebCore::identifierRep):
+        (WebCore::stringIdentifierMap):
+        * bridge/IdentifierRep.h: Added.
+        * bridge/c/c_utility.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::fromUTF8WithLatin1Fallback):
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Add toRenderInline methods for casting RenderObjects to RenderInlines.  The methods will assert if the object
+        is not a RenderInline.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::attachLineBoxToRenderObject):
+        (WebCore::InlineFlowBox::rendererLineBoxes):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::inlineContinuation):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::splitInlines):
+        * rendering/RenderInline.h:
+        (WebCore::toRenderInline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23647
+        Fix PLATFORM(SKIA)'s ImageSource::clear method to match other ports
+
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-01-30  David Hyatt  <hyatt@apple.com>
+
+        Add toRenderBlock methods for casting RenderObjects to RenderBlocks.  The methods will assert if the object
+        is not a RenderBlock.  Also add a toRenderBlock method that takes a RenderBlock but returns void and that
+        is unimplemented.  This method will catch anyone trying to do a cast when the object is already a RenderBlock.
+
+        Making this change caught a bad cast in RenderBlock::layoutBlockChildren, so that is also fixed by this
+        patch with a containsFloats() check.
+
+        Reviewed by Darin Adler
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::isCandidate):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded):
+        * editing/Editor.cpp:
+        (WebCore::Editor::hasBidiSelection):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::fillBlockSelectionGaps):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::firstLineBlock):
+        (WebCore::getLineAtIndex):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::lineCount):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        (WebCore::RenderBlock::clearTruncation):
+        * rendering/RenderBlock.h:
+        (WebCore::toRenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::calcReplacedHeightUsing):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::inlineContinuation):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::positionForCoordinates):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::removeFromObjectLists):
+        (WebCore::RenderObject::getTextDecorationColors):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::recalcSections):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::block):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+
+2009-01-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        - Let CachedFrame handle the suspending/resuming of active DOM objects itself instead of
+          relying on some outside force.
+        - Clear the previous history item inside FrameLoader instead of relying on multiple
+          FrameLoaderClients to do it.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame): Suspend active DOM objects here.
+        (WebCore::CachedFrame::restore): Resume those DOM objects here.
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::domWindow):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let CachedFrame  creation handle the
+          suspending of active DOM objects.
+        (WebCore::FrameLoader::open): Let CachedFrame::restore() handle resuming those DOM objects.
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): Call frameLoadCompleted() instead
+          of performing a client call by itself.
+        (WebCore::FrameLoader::frameLoadCompleted):
+
+2009-01-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6448823> Application Cache is kept after a private browsing session
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::update):
+        Cache update will not be started if private browsing is enabled. Existing cache version
+        from disk database will be used.
+
+        * loader/appcache/ApplicationCacheGroup.h: Made postListenerTask() static, in order to call
+        it when refusing to update from selectCache().
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::addDynamicEntry):
+        (WebCore::ApplicationCache::removeDynamicEntry):
+        Added reminders about private browsing to unimplemented methods.
+
 2009-01-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -559,6 +44147,1361 @@
 
         * html/PreloadScanner.cpp: Use COMPILER(GCC) instead of __GNUC__.
 
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23616: Various "template helpers" should be consolidated from isolated files in JavaScriptCore.
+        <https://bugs.webkit.org/show_bug.cgi?id=23616>
+
+        Added forwarding header.
+
+        * ForwardingHeaders/wtf/TypeTraits.h: Added.
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23599: ResourceError needs to be copyable for use in another thread.
+        <https://bugs.webkit.org/show_bug.cgi?id=23599>
+
+        Add ResourceErrorBase::copy method.  (Not yet used.)
+
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceErrorBase.h:
+
+2009-01-29  Stephanie Lewis <slewis@apple.com>
+
+        RS by Oliver Hunt.
+
+        Update the order files.
+
+        * WebCore.order:
+
+2009-01-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23488
+
+        Make TimerBase thread-aware (for Workers).
+        Added new class ThreadTimers - it keeps a heap of all timers for a thread (previously kept in a static global).
+        Pointer to instance of ThreadTimers is stored in GlobalThreadData.
+        Most static methods of TimerBase went to ThreadTimers.
+
+        The TimerBase functionality did not change (it maintains the timer heap which computes the nearest firing).
+
+        Added new abstract class SharedTimer, so worker threads can provide their own implementation (will be implemented on WorkerRunLoop).
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added new ThreadTimers.cpp to build files.
+
+        * platform/SharedTimer.h:
+        (WebCore::SharedTimer::~SharedTimer):
+        (WebCore::MainThreadSharedTimer::setFiredFunction):
+        (WebCore::MainThreadSharedTimer::setFireTime):
+        (WebCore::MainThreadSharedTimer::stop):
+        Added abstract SharedTimer and MainThreadSharedTimer which redirects to the existing port-supplied functions.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        (WebCore::ThreadGlobalData::threadTimers):
+        Added ThreadTimers to ThreadGlobalData.
+
+        * platform/ThreadTimers.cpp: Added.
+        (WebCore::mainThreadSharedTimer):
+        Static getter for a MainThreadSharedTimer singleton.
+
+        (WebCore::ThreadTimers::ThreadTimers):
+        (WebCore::ThreadTimers::setSharedTimer):
+        (WebCore::ThreadTimers::updateSharedTimer):
+        (WebCore::ThreadTimers::collectFiringTimers):
+        (WebCore::ThreadTimers::fireTimers):
+        (WebCore::ThreadTimers::sharedTimerFired):
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        ThreadTimers implementation. Most of the code is moved from previous static functions on TimerBase.
+        Need a new class so each thread may get ts own copy of the timer heap.
+
+        * platform/ThreadTimers.h: Added.
+        (WebCore::ThreadTimers::timerHeap):
+        (WebCore::ThreadTimers::timersReadyToFire):
+
+        * platform/Timer.cpp:
+        (WebCore::timerHeap):
+        (WebCore::timersReadyToFire):
+        (WebCore::TimerHeapElement::TimerHeapElement):
+        (WebCore::TimerHeapElement::checkConsistency):
+        (WebCore::TimerHeapElement::operator=):
+        (WebCore::TimerHeapIterator::checkConsistency):
+        (WebCore::TimerBase::TimerBase):
+        (WebCore::TimerBase::~TimerBase):
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::checkHeapIndex):
+        (WebCore::TimerBase::heapDelete):
+        (WebCore::TimerBase::heapDeleteMin):
+        (WebCore::TimerBase::heapInsert):
+        (WebCore::TimerBase::heapPopMin):
+        (WebCore::TimerBase::setNextFireTime):
+        (WebCore::TimerBase::fireTimersInNestedEventLoop):
+        Now instead of static timer heap these use accessor functions that pull thread-specific heap instance.
+
+        * platform/Timer.h:
+        static methods moved to ThreadTimers.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Beginning of work to eliminate RenderContainer and make containership "pluggable" into any spot in the render tree.  The first step is to create
+        the new object that will handle children: RenderObjectChildList and move RenderContainer's member variables into it.  Subsequent patches will begin
+        moving RenderContainer's functionality into RenderObjectChildList.
+
+        Reviewed by Eric Seidel
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::RenderContainer):
+        (WebCore::RenderContainer::destroyLeftoverChildren):
+        (WebCore::RenderContainer::addChild):
+        (WebCore::RenderContainer::removeChildNode):
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        (WebCore::RenderContainer::appendChildNode):
+        (WebCore::RenderContainer::insertChildNode):
+        (WebCore::RenderContainer::layout):
+        (WebCore::RenderContainer::removeLeftoverAnonymousBlock):
+        (WebCore::RenderContainer::positionForCoordinates):
+        (WebCore::RenderContainer::addLineBoxRects):
+        (WebCore::RenderContainer::collectAbsoluteLineBoxQuads):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::firstChild):
+        (WebCore::RenderContainer::lastChild):
+        (WebCore::RenderContainer::firstChildBox):
+        (WebCore::RenderContainer::lastChildBox):
+        * rendering/RenderObjectChildList.h: Added.
+        (WebCore::RenderObjectChildList::RenderObjectChildList):
+        (WebCore::RenderObjectChildList::firstChild):
+        (WebCore::RenderObjectChildList::lastChild):
+        (WebCore::RenderObjectChildList::setFirstChild):
+        (WebCore::RenderObjectChildList::setLastChild):
+
+2009-01-29  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=23598
+        Replace smart-quotes in UTF-8 with ASCII double-quotes to avoid
+        the compilation error on CJK Windows
+
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::parseMappedAttribute):
+
+2009-01-29  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23627
+        Fix the PLATFORM(SKIA) build.
+
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::teardown):
+
+2009-01-29  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23625
+        Skia platform doesn't render text to a canvas or support clipping to an image buffer
+
+        Fixes two bugs in Skia rendering to a canvas:
+        . Text was not rendered at all. This is because we never properly
+          fixed up the alpha values. The fix is to create a layer when
+          rendering text to a layer.
+        . We were not honoring clipping to an image buffer.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::setDrawingToImageBuffer):
+        (PlatformContextSkia::isDrawingToImageBuffer):
+        (PlatformContextSkia::beginLayerClippedToImage):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-01-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        First step in tracking the urls a HistoryItem was redirected through.
+
+        * WebCore.base.exp:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::addRedirectURL):
+        (WebCore::HistoryItem::redirectURLs):
+        (WebCore::HistoryItem::setRedirectURLs):
+        * history/HistoryItem.h:
+
+2009-01-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann, Eric Seidel.
+
+        Just transform the pattern directly instead of transforming the context fixes this
+        problem. Texts or strokes are no longer affected by transformations.
+
+        SVG pattern transformation/BoundingBox can cause ugly stroke thickness or text positions
+        https://bugs.webkit.org/show_bug.cgi?id=23472
+
+        Test: svg/custom/pattern-with-transformation.svg
+
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::setPatternSpaceTransform):
+        * platform/graphics/cairo/PatternCairo.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move the line box list member out of RenderFlow and down into RenderBlock and RenderInline.  Eliminate RenderFlow from the tree.
+
+        Reviewed by Sam Weinig
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAnchorElement.cpp:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::rendererLineBoxes):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        * rendering/InlineFlowBox.h:
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::dirtyLineBoxes):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::setSelectionState):
+        (WebCore::RenderBlock::avoidsFloats):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        (WebCore::RenderBlock::hoverAncestor):
+        (WebCore::RenderBlock::updateDragState):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::lineBoxes):
+        (WebCore::RenderBlock::firstLineBox):
+        (WebCore::RenderBlock::lastLineBox):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlow.cpp: Removed.
+        * rendering/RenderFlow.h: Removed.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::cloneInline):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::relativePositionedInlineOffset):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::lineBoxes):
+        (WebCore::RenderInline::firstLineBox):
+        (WebCore::RenderInline::lastLineBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::rendererLineBoxes):
+        * rendering/RootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        * wml/WMLAElement.cpp:
+
+2009-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cleaned up some naming in ScheduledRedirection.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+
+2009-01-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Update to use new API.
+
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::createFontCustomPlatformData):
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23619
+        ASSERT(!error.isNull()) in DocumentLoader::mainReceivedError() when an SVG image load
+        is cancelled
+
+        Covered by existing tests (as a random crash).
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::cancelledError):
+        (WebCore::EmptyFrameLoaderClient::blockedError):
+        (WebCore::EmptyFrameLoaderClient::cannotShowURLError):
+        (WebCore::EmptyFrameLoaderClient::interruptForPolicyChangeError):
+        (WebCore::EmptyFrameLoaderClient::cannotShowMIMETypeError):
+        (WebCore::EmptyFrameLoaderClient::fileDoesNotExistError):
+        (WebCore::EmptyFrameLoaderClient::pluginWillHandleLoadError):
+        Create non-null errors.
+
+2009-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed an unused case of "lockHistory" to help make the other cases
+        clearer.
+
+        * page/FrameLoadRequest.h:
+        (WebCore::FrameLoadRequest::FrameLoadRequest):
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move all of the contination insertion code from RenderFlow to RenderInline.  addChildToFlow is renamed to addChildIgnoringContinuation, and it has been moved to
+        RenderContainer so that it can still be called on either blocks or inlines.  The base class implementation in RenderContainer is what RenderBlock uses.  RenderInline
+        subclasses it to do all the work it used to do in addChildToFlow.
+
+        RenderBlock's old addChildToFlow can just become addChild.  This simplification is possible because addChild was actually never being called on anonymous
+        block continuations.
+
+        The code dealing with anonymous table parts in the old addChildWithContinuation method can now be removed as a result with no harmful side effects.  Falling through to the
+        base class and ignoring a block continuation makes the right thing happen.
+
+        addChildWithContinuation moved to RenderInline and has been renamed to addChildToContinuation.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::addChildIgnoringContinuation):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChild):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::continuationBefore):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+
+2009-01-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        <rdar://problem/6337157> hyundaiusa.com closes window or tab during load
+
+        Test: fast/loader/subframe-self-close.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close): Only allow mainframes to close the window.
+
+2009-01-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23539
+
+        Remove several virtual functions from Node & Element related to form control / input elements,
+        that shouldn't reside there, but move to approriate locations, in the new form control /
+        input element abstract base classes.
+
+        Remove the isControl() method from Node, as it's redundant - isFormControlElement() provides the same information.
+        Move isEnabled( / isReadOnlyControl() / isTextControl() from Node to FormControlElement.
+        Move isAutofilled() / isChecked() / isIndeterminate() from Node to InputElement.
+        Move isInputTypeHidden() / isPasswordField() from Element to InputElement.
+
+        Querying these methods requires using the toInputElement/toFormControlElement casting helper functions
+        to cast Element pointers to InputElement/FormControlElement pointers.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElementWithState):
+        * dom/FormControlElement.h:
+        * dom/InputElement.h:
+        * dom/Node.h:
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isTextControl):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::CheckedRadioButtons::removeButton):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isAutofilled):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isPasswordField):
+        (WebCore::AccessibilityRenderObject::isIndeterminate):
+        (WebCore::AccessibilityRenderObject::isChecked):
+        (WebCore::AccessibilityRenderObject::isControl):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::updateUserModifyProperty):
+        (WebCore::RenderTextControl::adjustInnerTextStyle):
+        (WebCore::RenderTextControl::updateFromElement):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isChecked):
+        (WebCore::RenderTheme::isIndeterminate):
+        (WebCore::RenderTheme::isEnabled):
+        (WebCore::RenderTheme::isReadOnlyControl):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustMenuListStyle):
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+        (WebCore::WMLFormControlElement::isEnabled):
+        (WebCore::WMLFormControlElement::isReadOnlyControl):
+        (WebCore::WMLFormControlElement::isTextControl):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::isKeyboardFocusable):
+        (WebCore::WMLInputElement::isMouseFocusable):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::isAutofilled):
+
+2009-01-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML build - apply same fix as HTMLAnchorElement received.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23620
+        Crash in appcache/resource-redirect.html on Tiger
+
+        There was a bug in the test case - it didn't send a Location header, and on Tiger, this
+        resulted in a failure callback being sent. It turned out that proper redirects weren't
+        caught at all.
+
+        Tests: http/tests/appcache/manifest-redirect-2.html
+               http/tests/appcache/resource-redirect-2.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFail): Fixed this function to not crash if
+        didReceiveResponse() wasn't called for this request.
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fixed to check for redirects correctly.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse): Ditto.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move dirtyLinesFromChangedChild into RenderLineBoxList so that it can be shared by RenderBlock and RenderInline.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::dirtyLinesFromChangedChild):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::dirtyLinesFromChangedChild):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderLineBoxList.h:
+
+2009-01-29  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 23623: Windowed Flash instances aren't captured when a WebView
+        receives a WM_PRINTCLIENT message
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23623>
+        <rdar://problem/6513921>
+        <rdar://problem/6536874>
+
+        Flash doesn't seem to respond to WM_PRINTCLIENT, so we change
+        WM_PRINTCLIENT messages into WM_PAINT messages and hook into the
+        BeginPaint/EndPaint APIs to return the HDC we received from
+        WM_PRINTCLIENT. This causes the plugin to paint into the
+        WM_PRINTCLIENT HDC via its normal WM_PAINT handler. This technique
+        came from <http://www.fengyuan.com/article/wmprint.html>.
+
+        No test possible.
+
+        Reviewed by Darin Adler.
+
+        * platform/graphics/GraphicsContext.h: Added
+        [set]ShouldIncludeChildWindows on Windows.
+
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h: Added
+        m_shouldIncludeChildWindows.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        Initialize the new member.
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::setShouldIncludeChildWindows):
+        (WebCore::GraphicsContext::shouldIncludeChildWindows):
+        Added simple setter and getter.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView): Initialize the new member.
+
+        * plugins/PluginView.h: Added m_wmPrintHDC and various functions
+        required for making WM_PRINTCLIENT work.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+        (WebCore::setUpOffscreenPaintingHooks):
+        Added. Code was modified from code available on fengyuan.com.
+
+        (WebCore::PluginView::wndProc): Turn WM_PRINTCLIENT messages into
+        WM_PAINT messages and save off the HDC that we're supposed to paint
+        into.
+
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Added. Gets an
+        HDC from the GraphicsContext, translates it into client coordinates,
+        gets the plugin to draw into the HDC by sending a WM_PRINTCLIENT
+        message, and returns the HDC to the GraphicsContext.
+
+        (WebCore::PluginView::paint): If we're trying to paint a windowed
+        plugin into the GraphicsContext, call paintWindowedPluginIntoContext.
+
+        (WebCore::PluginView::init): Call setUpOffscreenPaintingHooks to make
+        our WM_PRINTCLIENT trick work.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move RenderFlow::destroy down into RenderBlock and RenderInline.
+
+        Reviewed by Anders Carlsson
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy):
+
+2009-01-29  David Kilzer  <ddkilzer@apple.com>
+
+        Remove semi-colons from the end of ObjC method implementations
+
+        Rubber-stamped by Adam Roben.
+
+        $ find WebCore -name \*.m -o -name \*.mm -exec perl -e 'undef $/; $s = <>; while ($s =~ m/[\n\r][-+].*;[\s\r\n]+\{/g) { print "$ARGV: $&\n"; }' {} \;
+
+        * bridge/testbindings.mm:
+
+2009-01-29  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23609
+        Use the two-arg constructor for implicit QUrl->KURL conversion as the
+        single argument ctors assume that KURL::parse has already been called
+        and assert if the parse results in a different string.  This was causing
+        an assert for QUrl's with no path and without a trailing slash.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::KURL):
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Renamed ApplicationCacheResource::Implicit to Master, because that's the word HTML5 uses,
+        and it describes the meaning better.
+
+        * loader/appcache/ApplicationCache.cpp:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * loader/appcache/ApplicationCacheResource.cpp:
+        * loader/appcache/ApplicationCacheResource.h:
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Release build fix.
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::selectCache):
+        Got rid of a variable that wasn't used in release builds.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Get rid of createAnonymousFlow.  It was only called in one spot, so just inline the code.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23476
+        HTTP redirect should make application cache updating fail
+
+        Tests: http/tests/appcache/manifest-redirect.html
+               http/tests/appcache/resource-redirect.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse):
+        Fail if response code isn't 2xx.
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23592
+        Update appcache manifest signature parsing
+
+        Test: http/tests/appcache/wrong-signature-2.html
+
+        * loader/appcache/ManifestParser.cpp: (WebCore::parseManifest): Allow comments on signature
+        line. Removed code that replaced nulls with 0xFFFD characters, because there is no such
+        requirement in the spec.
+
+2009-01-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23584
+        Update application cache code for the latest round of spec changes
+
+        The changes mostly affect the update process - events are sent at a different
+        time, and caches are associated with documents earlier.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::mainReceivedError): Changed an always passing test to an assertion.
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache): Caches are now associated
+        with DocumentLoader before being complete, but they only affect loading after being completed.
+        (WebCore::DocumentLoader::getApplicationCacheFallbackResource): Ditto.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::setGroup): Allow setting the group to the same one, to simplify
+        ApplicationCacheGroup code.
+        (WebCore::ApplicationCache::isComplete): A new method that tells whether the cache is
+        complete, as defined in HTML5.
+        * loader/appcache/ApplicationCache.h: Added isComplete().
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheUpdateOption): Per HTML5, cache updating should work differently
+        when invoked with or without a browsing context (Frame). A Frame is currently always needed
+        for updating in WebKit, so a new argument to update() tells whether we should pretend that
+        there isn't one.
+        (WebCore::ApplicationCacheGroup::cacheIsBeingUpdated): A helper for ApplicationCache::isComplete().
+        (WebCore::ApplicationCacheGroup::CompletionType): Cache update algorithm now waits for
+        ne main resources to finish loading in more cases. A member variable of this type is used to
+        distinguish between different cases when waiting.
+        (WebCore::ApplicationCacheGroup::m_cacheCandidates): The new algorithm doesn't track cache
+        candidates. Caches are associated with documents much earlier, but the ones whose main resources
+        have not been loaded from a cache are being tracked in a pending master entry list.
+
+        * loader/appcache/DOMApplicationCache.cpp: (WebCore::DOMApplicationCache::update):
+        An explicit call to update() invokes the algorithm without a browsing context.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup):
+        (WebCore::ApplicationCacheGroup::~ApplicationCacheGroup):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::stopLoading):
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
+        (WebCore::ApplicationCacheGroup::cacheDestroyed):
+        (WebCore::ApplicationCacheGroup::setNewestCache):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFinishLoading):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::cacheUpdateFailed):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::deliverDelayedMainResources):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        Rewrote the update algorithm.
+
+2009-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merged FrameLoadTypeReloadAllowingStaleData with FrameLoadTypeReload.
+
+        Technically, selecting View->Text Encoding->[Non-Default Encoding] on
+        a page with frames may now be slightly slower than it used to be. Oh well.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState): Subbed in FrameLoadTypeReload.
+
+        (WebCore::FrameLoader::loadURLIntoChildFrame): No need to account for
+        non-back-forward navigations anymore.
+
+        (WebCore::FrameLoader::canCachePage):
+        (WebCore::FrameLoader::logCanCachePageDecision):
+        (WebCore::FrameLoader::reloadWithOverrideEncoding):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem): Subbed in FrameLoadTypeReload.
+
+        * loader/FrameLoader.h: Renamed reloadAllowingStaleData => reloadWithOverrideEncoding,
+        since that's what it actually does.
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move hit testing and painting of lines from RenderFlow into RenderLineBoxList.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintContents):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paint):
+        (WebCore::RenderInline::nodeAtPoint):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderLineBoxList.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Fix SVG pixel test regressions.  I wish I could say that I understand this fix, but I don't.  For
+        some reason the original code returned 0 for RenderSVGInlineText::yPos() and somehow my literal
+        replacement of yPos() with the body of that method changed the results.  I am completely baffled,
+        but all SVG pixel tests pass again when I just take the code out.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move dirtyLineBoxes from RenderFlow to RenderInline and RenderBlock.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::dirtyLineBoxes):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::dirtyLineBoxes):
+        * rendering/RenderInline.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLineBoxes):
+        * rendering/RenderLineBoxList.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Back out my change to scrollWidth/Height from an earlier checkin since it broke stuff.  The current
+        behavior is not correct, but this will need to be investigated before being changed again.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move paintOutline and paintOutlineWithLine from RenderFlow to RenderInline, since they only apply to inlines.  Tighten up all of the code that
+        called paintOutline to use RenderInline as the type instead of RenderFlow.
+
+        Reviewed by cpst
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::addContinuationWithOutline):
+        (WebCore::RenderBlock::paintContinuationOutlines):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::paintLines):
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutline):
+        (WebCore::RenderInline::paintOutlineForLine):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintOutline):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::PaintInfo::PaintInfo):
+
+2009-01-28  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23596
+        XMLHttpRequest.cpp no longer compiles without USE(JSC)
+
+        * xml/XMLHttpRequest.cpp:
+
+2009-01-28  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23597
+        Make it possible to compile Database.cpp when USE(JSC) is not defined
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-01-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6077047> REGRESSION (r34544): Custom icon does not
+          appear in address field on first visit to any site
+
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::finishLoading): Changed to set the icon data only
+        after establishing a mapping from the page URL(s) to the icon. Doing
+        things the other way around resulted in the data not being cached
+        in the icon-URL to IconRecord map (because there was no interested page
+        at the time) and subsequently having to be fetched asynchronously from
+        the database when the page-to-icon mapping was established.
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move addFocusRingRects from RenderFlow down into RenderBlock and RenderInline.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        * rendering/RenderInline.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move localCaretRect from RenderFlow into RenderBlock, since it only applied to blocks anyway and
+        was misplaced from the start.
+
+        Reviewed by Antti Koivisto.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Add forwarding header.
+
+        * ForwardingHeaders/debugger/DebuggerActivation.h: Added.
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move createInlineBox out of RenderFlow and down into RenderInline and RenderBlock.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createInlineBox):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::createInlineBox):
+        * rendering/RenderInline.h:
+        * rendering/bidi.cpp:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move calcMargins from RenderFlow to RenderInline, since it was only ever called on RenderInlines.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::calcMargins):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Refactor the first and last line box member variables from RenderFlow.  Encapsulate them into a new class called RenderLineBoxList that manages all modifications to
+        the list.  This change will make it easier to give RenderInline and RenderBlock separate versions of the line box list without having to duplicate very much code.
+
+        Reviewed by Oliver Hunt
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::deleteLine):
+        (WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::extractLine):
+        (WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::attachLine):
+        (WebCore::InlineFlowBox::attachLineBoxToRenderObject):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::deleteLineBoxTree):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::destroy):
+        (WebCore::RenderFlow::dirtyLineBoxes):
+        (WebCore::RenderFlow::createInlineBox):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        (WebCore::RenderFlow::lineBoxes):
+        (WebCore::RenderFlow::firstLineBox):
+        (WebCore::RenderFlow::lastLineBox):
+        * rendering/RenderLineBoxList.cpp: Added.
+        (WebCore::RenderLineBoxList::~RenderLineBoxList):
+        (WebCore::RenderLineBoxList::appendLineBox):
+        (WebCore::RenderLineBoxList::deleteLineBoxTree):
+        (WebCore::RenderLineBoxList::extractLineBox):
+        (WebCore::RenderLineBoxList::attachLineBox):
+        (WebCore::RenderLineBoxList::removeLineBox):
+        (WebCore::RenderLineBoxList::deleteLineBoxes):
+        (WebCore::RenderLineBoxList::checkConsistency):
+        * rendering/RenderLineBoxList.h: Added.
+        (WebCore::RenderLineBoxList::RenderLineBoxList):
+        (WebCore::RenderLineBoxList::firstLineBox):
+        (WebCore::RenderLineBoxList::lastLineBox):
+        (WebCore::RenderLineBoxList::checkConsistency):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createInlineBox):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::removeLineBoxFromRenderObject):
+        (WebCore::RootInlineBox::extractLineBoxFromRenderObject):
+        (WebCore::RootInlineBox::attachLineBoxToRenderObject):
+        * rendering/RootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-28  David Kilzer  <ddkilzer@apple.com>
+
+        Clean up FontPlatformData constructor
+
+        Reviewed by David Hyatt.
+
+        * platform/graphics/mac/FontPlatformData.h: Updated copyright.
+        (WebCore::FontPlatformData::FontPlatformData): Provide readable
+        names for constructor arguments and reformat member variables.
+        * platform/graphics/mac/FontPlatformDataMac.mm: Updated copyright.
+        (WebCore::FontPlatformData::FontPlatformData): Provide readable
+        names for constructor arguments and reformat member variables.
+
+2009-01-28  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23593
+        Compile fixes for RenderThemeChromiumMac and RenderThemeChromiumWin.
+        This is a follow up for hyatt's RenderBox changes.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::baselinePosition):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintMenuList):
+
+2009-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23582
+
+        Fix assertions when inline elements have both opacity (or something
+        else that creates a RenderLayer), and transform by ensuring that
+        setHasTransform() is only called for non-inline or replaced elements.
+        We also have to ensure that RenderReplicas will get transforms applied
+        to them by lying about them being replaced.
+
+        Tests: fast/transforms/transform-on-inline.html
+               fast/transforms/transform-table-row.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::RenderReplica):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+
+2009-01-28  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Justin Garcia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18835
+        Spelling underlines disappear when they shouldn't
+
+        The WebCore::InsertLineBreakCommand::doApply() function splits a text node
+        without copying existing markers. To fix this bug, change code which
+        manually splits a text node into a CompositeEditCommand::splitTextNode() call.
+
+        Test: editing/spelling/spelling-linebreak.html
+
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move the m_lineHeight member variable out of RenderFlow and down into RenderBlock and RenderInline.  Shift the line height computation into RenderStyle so
+        that it isn't repeated in three places.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::lineHeight):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::lineHeight):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-01-28  Zachary Kuznia  <zork@chromiuum.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22070
+        Add an option to allow scripts to close windows.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAllowScriptsToCloseWindows):
+        * page/Settings.h:
+        (WebCore::Settings::allowScriptsToCloseWindows):
+
+2009-01-28  Adam Langley  <agl@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23573
+        Make PlatformWidget on chromium an intptr_t to match changes made in Chromium
+
+        * platform/chromium/PlatformWidget.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Fix for
+
+        <rdar://problem/6531287> REGRESSION: CrashTracer: [USER] 12 crashes in Safari at com.apple.WebCore • WebCore::RenderBlock::removeFloatingObject + 59
+
+        My tightening up of markAllDescendantsWithFloatsForLayout exposed a buggy check in that code that could
+        lead to a bad cast.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+
+2009-01-27  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23576
+
+        Work towards eliminating RenderFlow from the tree.
+
+        Move the m_continuation variable down from RenderFlow into RenderInline and RenderBlock.  Since a block can only have an inline continuation following it, the type
+        of the member and methods reflect this (inlineContinuation() and m_inlineContinuation).  Since an inline can have either a block or an inline continuation following it,
+        a base class of RenderBox* is used for the type of object returned (in anticipation of the removal of RenderFlow).
+
+        Since moving the continuation variable down into the subclasses increased the size of RenderInline and RenderBlock by 4 bytes, this patch also moves all of the bitfield
+        members of RenderFlow up to RenderObject.  Since they fit within the available bits on RenderObject, this patch actually results in a net savings of 4 bytes on RenderInlines
+        and RenderBlocks!
+
+        One bitfield member was eliminated rather than moved: m_firstLine.  This was really more of a state variable used during line layout only, so I removed it as a member
+        and just passed firstLine down to various methods as needed.  Doing so uncovered some potential bugs where the first line state was not being respected when querying for
+        line offsets.
+
+        Continuations have been completely hidden from all files except for RenderFlow, RenderBlock and RenderInline.  All of the code that referenced continuations directly
+        from base classes has been refactored to use virtual methods on RenderBlock and RenderInline instead.
+
+        RenderFlow still has a common addChildWithContinuation method that is used by both blocks and inlines.  Since refactoring that method will be pretty tricky, I've held
+        off on that for a later patch.
+
+        Reviewed by Oliver Hunt
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::~RenderBlock):
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::addChildToFlow):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::determineHorizontalPosition):
+        (WebCore::RenderBlock::setCollapsedBottomMargin):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::addContinuationWithOutline):
+        (WebCore::RenderBlock::setSelectionState):
+        (WebCore::RenderBlock::shouldPaintSelectionGaps):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::leftSelectionOffset):
+        (WebCore::RenderBlock::rightSelectionOffset):
+        (WebCore::RenderBlock::leftOffset):
+        (WebCore::RenderBlock::leftRelOffset):
+        (WebCore::RenderBlock::rightOffset):
+        (WebCore::RenderBlock::rightRelOffset):
+        (WebCore::RenderBlock::lineWidth):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        (WebCore::RenderBlock::availableWidth):
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+        (WebCore::RenderBlock::desiredColumnWidth):
+        (WebCore::RenderBlock::desiredColumnCount):
+        (WebCore::RenderBlock::columnRects):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::RenderBlock::adjustPointToColumnContents):
+        (WebCore::RenderBlock::adjustRectForColumns):
+        (WebCore::RenderBlock::absoluteRects):
+        (WebCore::RenderBlock::absoluteQuads):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        (WebCore::RenderBlock::hoverAncestor):
+        (WebCore::RenderBlock::updateDragState):
+        (WebCore::RenderBlock::outlineStyleForRepaint):
+        (WebCore::RenderBlock::childBecameNonInline):
+        (WebCore::RenderBlock::updateHitTestResult):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::rightOffset):
+        (WebCore::RenderBlock::leftOffset):
+        (WebCore::RenderBlock::inlineContinuation):
+        (WebCore::RenderBlock::setInlineContinuation):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        (WebCore::RenderBox::addFocusRingRects):
+        (WebCore::RenderBox::containingBlockWidth):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::collapsedMarginBottom):
+        (WebCore::RenderBox::childBecameNonInline):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        (WebCore::RenderContainer::removeLeftoverAnonymousBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderFlow.cpp:
+        (WebCore::nextContinuation):
+        (WebCore::RenderFlow::continuationBefore):
+        (WebCore::RenderFlow::addChildWithContinuation):
+        (WebCore::RenderFlow::addChild):
+        (WebCore::RenderFlow::destroy):
+        (WebCore::RenderFlow::addFocusRingRects):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::inlineContinuation):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildToFlow):
+        (WebCore::RenderInline::cloneInline):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::childBecameNonInline):
+        (WebCore::RenderInline::updateHitTestResult):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::isRenderInline):
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::RenderListMarker):
+        (WebCore::RenderListMarker::setSelectionState):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::rectWithOutlineForRepaint):
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        (WebCore::RenderObject::updateDragState):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::getTextDecorationColors):
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isInlineBlockOrInlineTable):
+        (WebCore::RenderObject::childrenInline):
+        (WebCore::RenderObject::setChildrenInline):
+        (WebCore::RenderObject::hasColumns):
+        (WebCore::RenderObject::setHasColumns):
+        (WebCore::RenderObject::cellWidthChanged):
+        (WebCore::RenderObject::setCellWidthChanged):
+        (WebCore::RenderObject::isInlineContinuation):
+        (WebCore::RenderObject::hoverAncestor):
+        (WebCore::RenderObject::outlineStyleForRepaint):
+        (WebCore::RenderObject::setHasMarkupTruncation):
+        (WebCore::RenderObject::hasMarkupTruncation):
+        (WebCore::RenderObject::selectionState):
+        (WebCore::RenderObject::setSelectionState):
+        (WebCore::RenderObject::hasSelectedChildren):
+        (WebCore::RenderObject::isTopMarginQuirk):
+        (WebCore::RenderObject::isBottomMarginQuirk):
+        (WebCore::RenderObject::setTopMarginQuirk):
+        (WebCore::RenderObject::setBottomMarginQuirk):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::RenderReplaced):
+        (WebCore::RenderReplaced::setSelectionState):
+        * rendering/RenderReplaced.h:
+        (WebCore::RenderReplaced::canBeSelectionLeaf):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::calcWidth):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::updateWidth):
+        (WebCore::RenderTableCell::layout):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::localCaretRect):
+        (WebCore::RenderText::setSelectionState):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::canBeSelectionLeaf):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::updateHitTestResult):
+        * rendering/RenderView.h:
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::fitBelowFloats):
+        (WebCore::RenderBlock::findNextLineBreak):
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+
+2009-01-28  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann and George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23557
+        Allow option of hit testing frame content without clipping to the visible
+        viewport.
+
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::HitTestRequest):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-01-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the build with Qt on Windows.
+
+        Make sure that the QTWEBKIT_EXPORT macro becomes the Q_DECL_EXPORT macro
+        instead of the import macro when building the dll, by defining
+        QT_MAKEDLL.
+
+        SystemTimeWin.cpp is needed on Windows for userIdleTime(), which for the
+        other Qt platforms comes from TemporaryLinkStubs.cpp.
+
+        * WebCore.pro:
+
 2009-01-28  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -570,6 +45513,288 @@
         * platform/graphics/qt/GraphicsContextQt.cpp:
         (WebCore::GraphicsContext::clip):
 
+2009-01-28  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23546
+        Upstream GoogleURL implementation of KURL
+
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp: Added.
+        * platform/KURLGooglePrivate.h: Added.
+
+2009-01-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r40234): Launching iTunes from a link displays a
+        "Safari can't find the Internet plug-in" sheet in Safari
+        rdar://problem/6533678
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::havePlugin): Put the check for empty string in here.
+        (WebCore::serviceTypeForClassId): Only return activeXType() if
+        we have a plug-in that can handle that type. While it might be logical
+        to return an Active X type for any <object> with a classId in it,
+        even if we don't have a plug-in that implements Active X, existing
+        clients, such as Safari, don't expect that.
+
+2009-01-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        - fix <rdar://problem/6524351> Text looks bad when font smoothing is
+          forced off
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): Changed to use GDI rather than Core
+        Graphics if the client has turned font smoothing off.
+
+2009-01-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        Use the new container-relative repaint methods to compute
+        post-layout repaints, and repaints using RenderLayer's
+        cached repaintRect() relative to that container, rather than
+        using absolute coords.
+
+        Replaced lots of boilerplate old/new rect code in various
+        layout methods with a stack-based LayoutRepainter class, and
+        fixed a bug in RenderTable which set didFullRepaint to
+        'true' every time.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintUsingContainer):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::LayoutRepainter::LayoutRepainter):
+        (WebCore::RenderObject::LayoutRepainter::repaintAfterLayout):
+        (WebCore::RenderObject::LayoutRepainter::checkForRepaint):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-27  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/3541409> - More groundwork and cleanup for CachedFrames
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame): Make the savePlatformDataToCachedFrame() client call here,
+          and add the code for caching subframes.
+        (WebCore::CachedFrame::clear):
+        * history/CachedFrame.h: Change to be RefCounted
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::url):
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::document):
+        (WebCore::CachedPage::documentLoader):
+        (WebCore::CachedPage::view):
+        (WebCore::CachedPage::url):
+        (WebCore::CachedPage::domWindow):
+        (WebCore::CachedPage::cachedMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePageForHistoryItem): Move the platform data saving into the
+          CachedFrame itself.
+
+2009-01-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Flip the arguments of computeRectForRepaint() from
+            computeRectForRepaint(IntRect&, RenderBox* repaintContainer, bool)
+        to
+            computeRectForRepaint(RenderBox* repaintContainer, IntRect&, bool)
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::computeRectForRepaint):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::computeRectForRepaint):
+        * rendering/RenderView.h:
+
+2009-01-27  David Kilzer  <ddkilzer@apple.com>
+
+        Add missing header guards to AccessibilityObjectWrapper.h
+
+        Reviewed by Anders Carlsson.
+
+        * page/mac/AccessibilityObjectWrapper.h: Added missing header guards.
+
+2009-01-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23567
+
+        Fix crash of svg/custom/stop-crash.svg testcase because of
+        infinite recursion, as I missed replacing absoluteClippedOverflowRect()
+        with clippedOverflowRectForRepaint() in RenderSVGGradientStop.
+
+        Also fix a missed conversion in RenderTableCol, and add a couple
+        of comments.
+
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::imageChanged):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::layout):
+
+2009-01-27  Adele Peterson  <adele@apple.com>
+
+        RS by Dave Hyatt
+
+        Use the textfield appearance for search fields in themeWin.css so the border/background
+        styling will work correctly on these fields.
+
+        * css/themeWin.css:
+
+2009-01-27  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::setSelectionStart):
+        (WebCore::JSHTMLInputElement::setSelectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+
+2009-01-27  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setSpreadMethod):
+
+2009-01-27  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23561
+        Explicitly send the MIME type from an image dragged from a web
+        page to the desktop, to Chromium so that it can properly generate
+        a file name.
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::writeImageToDataObject):
+
+2009-01-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23300
+        Follow Firefox in throwing exceptions when using selection
+        functions on HTMLInputElements that cannot have selection.
+
+        This requires custom setSelectionRange, setSelectionStart and
+        setSelectionEnd implementations, but it gets rid of the custom
+        getOwnPropertySlot.
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * html/HTMLInputElement.idl:
+
+2009-01-27  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23435
+        Make spreadMethod a member of Gradient rather than GraphicsContext.
+        Implement spreadMethod for Skia.
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::Gradient):
+        * platform/graphics/Gradient.h:
+        (WebCore::Gradient::setSpreadMethod):
+        (WebCore::Gradient::spreadMethod):
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/GraphicsTypes.h:
+        (WebCore::):
+        * platform/graphics/cairo/GradientCairo.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
+        (WebCore::SVGPaintServerGradient::setup):
+        (WebCore::SVGPaintServerGradient::externalRepresentation):
+        * svg/graphics/SVGPaintServerGradient.h:
+
 2009-01-27  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
         Rubber-stamped by Simon Hausmann.
@@ -581,38 +45806,831 @@
         * platform/qt/PlatformKeyboardEventQt.cpp:
         (WebCore::windowsKeyCodeForKeyEvent):
 
-2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+2009-01-27  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Holger Hans Peter Freyther.
+        Reviewed by Dan Bernstein
 
-        Redo previous patch http://trac.webkit.org/changeset/34260 which fixes a
-        huge memory leak by ensuring that the timer is fired one last time on
-        application tear down thus triggering the GCController thereby freeing
-        JavaScript objects as well as triggering other timer based tear down methods.
+        Rework FrameLoaderClient to work on a CachedFrame basis instead of CachedPage
 
-        * platform/qt/SharedTimerQt.cpp:
-        (WebCore::SharedTimerQt::~SharedTimerQt):
+        * WebCore.base.exp:
+        * history/CachedPage.cpp:
+        * history/CachedPage.h:
+        (WebCore::CachedPage::cachedMainFrame):
 
-2009-01-09  Holger Hans Peter Freyther  <zecke@selfish.org>
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::savePlatformDataToCachedFrame):
+        (WebCore::EmptyFrameLoaderClient::transitionToCommittedFromCachedFrame):
 
-        Reviewed by Simon Hausmann.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::cachePageForHistoryItem):
+        * loader/FrameLoaderClient.h:
 
-        [QT] Make SharedTimer use QBasicTimer
+2009-01-26  Simon Fraser  <simon.fraser@apple.com>
 
-        Kill the SharedTimerQt.h and the usage of signal and slots
-        by using QBasicTimer.
+        Reviewed by Dave Hyatt
 
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        Add variants of all the methods that compute dirty rects for repainting
+        with versions that compute those rects relative to some container
+        RenderBox that acts as a painting root.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::outlineBoundsForRepaint):
+        (WebCore::RenderBox::localToContainerQuad):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containerForRepaint):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::rectWithOutlineForRepaint):
+        (WebCore::RenderObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::localToContainerQuad):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::absoluteClippedOverflowRect):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::absoluteOutlineBounds):
+        (WebCore::RenderObject::outlineBoundsForRepaint):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        (WebCore::RenderPath::outlineBoundsForRepaint):
+        * rendering/RenderPath.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGContainer::outlineBoundsForRepaint):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::computeRectForRepaint):
+        (WebCore::RenderTableCell::localToContainerQuad):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::clippedOverflowRectForRepaint):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::localToContainerQuad):
+        (WebCore::RenderView::computeRectForRepaint):
+        * rendering/RenderView.h:
+
+2009-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by David Hyatt
+
+        Back out r40285, because it was checked in with no bug number, no
+        testcase, is rendering change that did not get thorough review,
+        and broke the Mac build.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::HitTestRequest):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-01-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        -Make the recently added back/forward cache logging much better by actually
+         walking the entire frame tree and indenting the resulting output.
+        -Fix a null-termination bug in HistoryItem tree logging
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::showTreeWithIndent):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::pageCacheLogPrefix):
+        (WebCore::pageCacheLog):
+        (WebCore::FrameLoader::logCanCachePageDecision):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * loader/FrameLoader.h:
+
+2009-01-26  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Allow option of hit testing frame content without clipping to the visible
+        viewport.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::HitTestRequest):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=18141
+        Acid3 tests 77 and 78 fail on reload due to SVG font race
+        <rdar://problem/6504899>
+
+        Match Opera's behavior of loading SVGFonts as soon as <font-face-uri>
+        tag is inserted into the document and not at the first use of the font
+        as is done for CSS web fonts.
+
+        This fixes a race condition noticeable by some in the Acid3 test that
+        happened because the onload event handler for an iframe containing a
+        <font-face-uri> with an external reference was not delayed by the pending
+        load of the font.
+
+        Test: http/tests/misc/SVGFont-delayed-load.html
+
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::~SVGFontFaceUriElement):
+        (WebCore::SVGFontFaceUriElement::parseMappedAttribute): Call loadFont if
+        the href attribute changes.
+        (WebCore::SVGFontFaceUriElement::insertedIntoDocument): Call loadFont.
+        (WebCore::SVGFontFaceUriElement::loadFont): Force a load of the
+        font specified in href attribute.
+        * svg/SVGFontFaceUriElement.h:
+
+2009-01-26  Timothy Hatcher  <timothy@apple.com>
+
+        Change Web Archive serialization back to the binary property list format.
+
+        <rdar://problem/6127865> Web archives saved with Safari 4 cannot be read by Safari 3
+
+        Reviewed by Brady Eidson.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::rawDataRepresentation):
+
+2009-01-26  Anders Carlsson  <andersca@apple.com>
+
+        Fix 64-bit build.
+
+        * WebCore.LP64.exp:
+
+2009-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23511
+        Move DOMTimer from bindings/js to page/.
+        This was prepared by moving all JSC dependencies from DOMTimer
+        to ScheduledAction earlier, and helps unfork the Chromuim version
+        of the DOMTimer.
+
+        * GNUmakefile.am:
         * WebCore.pro:
-        * platform/qt/SharedTimerQt.cpp:
-        (WebCore::SharedTimerQt::SharedTimerQt):
-        (WebCore::SharedTimerQt::inst):
-        (WebCore::SharedTimerQt::start):
-        (WebCore::SharedTimerQt::stop):
-        (WebCore::SharedTimerQt::timerEvent):
-        (WebCore::setSharedTimerFiredFunction):
-        (WebCore::setSharedTimerFireTime):
-        (WebCore::stopSharedTimer):
-        * platform/qt/SharedTimerQt.h: Removed.
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/DOMTimer.cpp: Removed.
+        * bindings/js/DOMTimer.h: Removed.
+        * page/DOMTimer.cpp: Copied from WebCore/bindings/js/DOMTimer.cpp.
+        * page/DOMTimer.h: Copied from WebCore/bindings/js/DOMTimer.h.
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Eliminate rightmostPosition, lowestPosition and leftmostPosition from RenderFlow.  Move the code into
+        RenderBlock's methods.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+
+2009-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23553
+        Upstream changes from jcampan to fix chromium bugs 6692 and 6694.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::setLoopSelectionNavigation):
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupContainer::setLoopSelectionNavigation):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::selectNextRow):
+        (WebCore::PopupListBox::selectPreviousRow):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-01-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Remove some historical CachedPage time stamp fluff.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::timeStamp):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePageForHistoryItem):
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Move absoluteClippedOverflowRect, linesBoundingBox and borderBoundingBox from RenderFlow to RenderInline.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::absoluteClippedOverflowRect):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::borderBoundingBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+
+2009-01-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22650
+        Implement support for "Immutable" attribute to CodeGeneratorJS.pm, thus
+        allowing to explicitly mark methods as immutable (i.e. returning a new
+        instance rather than a reference to an existing instance).
+
+        * bindings/js/JSSVGMatrixCustom.cpp: Removed custom methods.
+        * bindings/scripts/CodeGeneratorJS.pm: Added check for Immutable
+            attribute when generating function call.
+        * svg/SVGMatrix.idl: Replaced Custom attribute with Immutable on
+            methods.
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Eliminate isInlineFlow() now that a RenderBlock can never be an inline flow.  isInlineFlow() is now
+        equivalent to isRenderInline(), so all calls to isInlineFlow() have been replaced with isRenderInline().
+
+        Reviewed by Eric Seidel
+
+        * dom/Text.cpp:
+        (WebCore::Text::rendererIsNeeded):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::shouldDrawTextDecoration):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hitTestContents):
+        (WebCore::InlineMinMaxIterator::next):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::isBlockFlow):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::imageChanged):
+        (WebCore::RenderBox::offsetForPositionedInContainer):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::dirtyLinesFromChangedChild):
+        (WebCore::RenderFlow::createInlineBox):
+        (WebCore::RenderFlow::paintLines):
+        (WebCore::RenderFlow::hitTestLines):
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::lowestPosition):
+        (WebCore::RenderFlow::rightmostPosition):
+        (WebCore::RenderFlow::leftmostPosition):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::borderBoundingBox):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::isRenderInline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::intersectsDamageRect):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::firstLineStyle):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createInlineBox):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::nodeAtPoint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderText.cpp:
+        (WebCore::isInlineFlowOrEmptyText):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/bidi.cpp:
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        (WebCore::appendRunsForObject):
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::inlineFlowRequiresLineBox):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Drop support for display:compact.
+
+        (1) display:compact is no longer part of CSS2.1.
+        (2) Shipping Safari has completely broken compact support with severely broken rendering
+        (all of the compact text just piles on top of the text in the inserted block and on top of itself as well).
+        (3) This has been broken in WebKit for years (ever since blocks converted to painting lines directly) without
+        anyone even noticing.
+
+        Reviewed by Eric Seidel
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleSpecialChild):
+        (WebCore::RenderBlock::handleRunInChild):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::shouldCheckLines):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::renderName):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::sizesToIntrinsicWidth):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::paintLines):
+        (WebCore::RenderFlow::hitTestLines):
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::linesBoundingBox):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isInline):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/bidi.h:
+        (WebCore::BidiRun::BidiRun):
+
+2009-01-26  Adam Langley  <agl@google.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        gtk2drawing: fix compiler warnings
+
+        g_object_set_data expects a gpointer as the last argument. Cast the
+          TRUE/FALSE values to avoid a warning.
+        gtk_tree_view_column_new doesn't return a GtkWidget.
+
+        * platform/gtk/gtk2drawing.c:
+        (setup_widget_prototype):
+        (moz_gtk_get_combo_box_inner_button):
+        (moz_gtk_get_combo_box_button_inner_widgets):
+        (ensure_combo_box_widgets):
+        (moz_gtk_get_combo_box_entry_inner_widgets):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_combo_box_entry_widgets):
+        (ensure_toolbar_widget):
+        (ensure_menu_bar_item_widget):
+        (ensure_menu_popup_widget):
+        (ensure_menu_item_widget):
+        (ensure_image_menu_item_widget):
+        (ensure_menu_separator_widget):
+        (ensure_check_menu_item_widget):
+        (ensure_tree_header_cell_widget):
+        (moz_gtk_entry_paint):
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Change display:run-in handling so that we no longer reuse RenderBlock as though it is an inline flow.
+        Instead we create a new RenderInline, move the RenderBlock's children underneath it, and then set the
+        inline as the new element's renderer.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::renderName):
+
+2009-01-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23480
+        Add missing method stubs to BackForwardListChromium.
+
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::backItem):
+        (WebCore::BackForwardList::forwardItem):
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Try to fix Tiger buildbot.
+
+        * WebCore.xcodeproj/project.pbxproj: Turn off cast-qual for WebDashboardRegion.m.
+        * page/mac/WebDashboardRegion.m:
+        (typeName): Added.
+        (-[WebDashboardRegion description]): Use typeName.
+        (-[WebDashboardRegion isEqual:]): Added comment.
+
+2009-01-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23535
+        Strengthen debug checks in KURL
+
+        Covered (and prompted) by existing tests.
+
+        * platform/KURL.cpp:
+        (WebCore::checkEncodedString): Check that the first character of the URL is an allowed
+        first scheme character, not just that it isn't a slash.
+        (WebCore::KURL::KURL): Assert that parsing didn't affect the string (which must be the case
+        because of parsing being idempotent).
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::create): Added a check for the URL being valid - if it is not, an
+        empty security origin is created.
+        (WebCore::SecurityOrigin::createFromString): Parse the string as URL, do not just convert
+        it - it is not guaranteed to be properly encoded.
+
+        * dom/Document.cpp: (WebCore::Document::updateBaseURL): As documentURI is an arbitrary
+        string, it needs to be parsed into an URL, not just converted into one.
+
+        * html/CanvasRenderingContext2D.cpp: (WebCore::CanvasRenderingContext2D::createPattern):
+        Create the security origin with createFromString() instead of create(). I do not know where
+        the string comes from and whether it might not be properly encoded, but this change can't
+        hurt, and makes the code slightly more clear.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::accessControlCheck): Create the security
+        origin with createFromString() instead of create(). The string comes from an HTTP response
+        header, so it may not be a properly encoded URL.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::requestResource): Do not try to request using
+        invalid URLs.
+
+        * page/DOMWindow.cpp: (WebCore::DOMWindow::postMessage): Updated to call
+        SecurityOrigin::createFromString() (no change in behavior).
+
+2009-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Improve the consistency of settings in our .xcconfig files.
+
+        * Configurations/Base.xcconfig: Enable GCC_OBJC_CALL_CXX_CDTORS to match other projects,
+        and handle all cases in GCC_GENERATE_DEBUGGING_SYMBOLS.
+
+2009-01-25  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23524, lots of missing content in table sections.
+
+        The new table code created a bug involving  markAllDescendantsWithFloatsForLayout, namely that it could
+        end up marking ancestors of a block as needing layout when that block was still in the process of
+        doing a layout.
+
+        The fix is to add a parameter to markAllDescendantsWithFloatsForLayout that says whether or not
+        we are "mid-layout."  If this flag is set, then the method will make sure to do only local dirtying
+        of objects to avoid accidentally marking a clean ancestor as needing layout again.
+
+        Ultimately the second parameter to setNeedsLayout and setChildNeedsLayout should just be removed,
+        with a check of whether or not we are mid-layout being done by those methods instead.
+
+        Reviewed by Oliver Hunt
+
+        Added fast/repaint/dynamic-table-vertical-alignment-change.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        * rendering/RenderBlock.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::removeFromObjectLists):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Turn on the following warnings:
+
+            -Wcast-qual
+            -Wextra-tokens
+            -Wformat=2
+            -Winit-self
+            -Wmissing-noreturn
+            -Wpacked
+            -Wrendundant-decls
+
+        * Configurations/Base.xcconfig: Added the new warnings. Switched to -Wextra instead of
+        -W for clarity since we don't have to support the older versions of gcc that require the
+        old -W syntax. Since we now use -Wformat=2, removed -Wformat-security. Also removed
+        -Wno-format-y2k since we can have that one on now.
+
+2009-01-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6525618> REGRESSION (r39566): NewsFire crashes in
+          string hashing code when opening a Digg RSS article
+
+        Test: fast/loader/null-request-after-willSendRequest.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Null-check the request returned from
+        the client's willSendRequest method.
+
+2009-01-25  David Hyatt  <hyatt@apple.com>
+
+        Fix for <rdar://problem/6525392> REGRESSION (r40180): Scroll wheel events over text scroll the page
+        instead of the ancestor overflow (23525)
+
+        Make sure that we always call scroll() on the nearest enclosing RenderBox.  No test case is possible
+        here, since wheel scrolling is currently untestable (the offset varies from machine to machine).
+
+        Reviewed by Dan Bernstein
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::scrollOverflow):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::enclosingBox):
+        * rendering/RenderObject.h:
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23538: REGRESSION (r39969): Garbage text instead of blank content rendered when plug-ins are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=23538
+        rdar://problem/6523719
+
+        I'm not sure how to make a regression test for this, since it depends on plug-ins being disabled.
+
+        The main problem here is that when plug-ins were disabled, the code ignored the classId attribute and
+        the <embed> element entirely. That resulted in a page treating a Flash document as plain HTML rather
+        than doing fallback.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap): Added. Broke this out into a separate function so we could get rid of an
+        inelegant if statement.
+        (WebCore::activeXType): Added. To avoid repeating the MIME type for ActiveX and possibly having a typo.
+        (WebCore::havePlugin): Added. Helper function to make sure we don't forget the null check.
+        (WebCore::serviceTypeForClassId): Give this function a return value since that's a more natural way to
+        return a string than an "out" parameter.  Fixed the logic to only prefer the ActiveX type over the
+        type guessed from the classId when there actually is an ActiveX plug-in to use. The old function assumed
+        there was one, which I presume right for Chrome on Windows when plug-ins are enabled, but wrong in many
+        other cases, and wrong all the time for all clients on Mac. We don't want to assume either way. Use the
+        new havePlugin function so we handle the case where pluginData is 0.
+        (WebCore::shouldUseEmbedDescendant): Renamed. Simplified the comment. Changed to use serviceTypeForClassId
+        instead of the old version that used an out parameter. Always use the <embed> if there isn't a plug-in
+        that knows how to handle <object> elements.
+        (WebCore::RenderPartObject::updateWidget): Removed null checks of pluginData. The two functions that
+        use this data still need to be called; they still do something even if no plug-ins are present. And
+        they have now been corrected to handle 0 properly.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        * rendering/RenderMenuList.cpp: Fix build by adding back needed include.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Fourth patch: Deal with the last few stray warnings.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::firstLineBlock): Handle the const_cast a little better.
+        Also make the local variable be a RenderBlock so the cast is closer to the code
+        that guarantees it's correct.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStyle): Put the enum into a local variable that's a built-in
+        type before using it with TextStream, so we don't get a warning due to -Wsign-promo.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23522: use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Step one: RenderText.
+
+        Also change set of RenderFlow* to be a ListHashSet as the comment in the
+        header indicated.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::setData): Use toRenderText.
+        (WebCore::CharacterData::appendData): Ditto.
+        (WebCore::CharacterData::insertData): Ditto.
+        (WebCore::CharacterData::deleteData): Ditto.
+        (WebCore::CharacterData::replaceData): Ditto.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner): Ditto.
+        (WebCore::ContainerNode::getLowerRightCorner): Ditto.
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable): Ditto.
+        (WebCore::previousRenderedEditable): Ditto.
+        (WebCore::Position::renderedOffset): Ditto. Also use function members
+        instead of data members of InlineTextBox.
+        (WebCore::Position::upstream): Ditto.
+        (WebCore::Position::downstream): Ditto.
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight): Ditto.
+        (WebCore::Position::inRenderedText): Ditto.
+        (WebCore::Position::isRenderedCharacter): Ditto.
+        (WebCore::searchAheadForBetterMatch): Ditto.
+        (WebCore::Position::getInlineBoxAndOffset): Ditto.
+
+        * dom/Range.cpp: Added include of VisiblePosition.h now that it's no longer
+        included in RenderObject.h.
+
+        * dom/Text.cpp:
+        (WebCore::Text::splitText): Use toRenderText.
+        (WebCore::Text::recalcStyle): Ditto.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText): Ditto.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::debugRenderer): Ditto.
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleTextNode): Ditto.
+        (WebCore::TextIterator::handleTextBox): Ditto.
+        (WebCore::TextIterator::emitText): Ditto.
+        (WebCore::SimplifiedBackwardsTextIterator::handleTextNode): Ditto.
+
+        * editing/VisiblePosition.cpp: Added include of FloatQuad.h now that it's
+        no longer included in RenderObject.h.
+        * inspector/InspectorController.cpp: Ditto.
+        * page/Frame.cpp: Ditto.
+        * rendering/RenderBox.cpp: Ditto.
+        * rendering/RenderInline.cpp: Ditto.
+        * rendering/RenderPath.cpp: Ditto.
+        * rendering/RenderSVGContainer.cpp: Ditto.
+        * rendering/RenderSVGImage.cpp: Ditto.
+        * rendering/RenderSVGInlineText.cpp: Ditto.
+        * rendering/RenderSVGTSpan.cpp: Ditto.
+        * rendering/RenderSVGText.cpp: Ditto.
+        * rendering/RenderSVGTextPath.cpp: Ditto.
+        * rendering/RenderTableCell.cpp: Ditto.
+        * rendering/RenderView.cpp: Ditto.
+
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine): Use function members instead of data
+        members of InlineTextBox.
+        (WebCore::endPositionForLine): Ditto.
+        (WebCore::startOfParagraph): Use toRenderText.
+        (WebCore::endOfParagraph): Ditto.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored): Use toRenderText.
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Ditto.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::deleteLine): Ditto.
+        (WebCore::InlineTextBox::extractLine): Ditto.
+        (WebCore::InlineTextBox::attachLine): Ditto.
+        (WebCore::InlineTextBox::placeEllipsisBox): Ditto.
+        (WebCore::InlineTextBox::paintDecoration): Ditto.
+        (WebCore::InlineTextBox::paintCompositionUnderline): Ditto.
+        (WebCore::InlineTextBox::offsetForPosition): Ditto.
+        (WebCore::InlineTextBox::positionForOffset): Ditto.
+
+        * rendering/InlineTextBox.h: Made most members private. Use toRenderText.
+
+        * rendering/RenderArena.cpp:
+        (WebCore::RenderArena::allocate): Use static_cast instead of C-style cast.
+        (WebCore::RenderArena::free): Ditto.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addContinuationWithOutline): Use ListHashSet<RenderFlow*>
+        instead of RenderFlowSequencedSet.
+        (WebCore::RenderBlock::paintContinuationOutlines): Ditto.
+        (WebCore::stripTrailingSpace): Ditto.
+        (WebCore::RenderBlock::calcInlinePrefWidths): Ditto.
+        (WebCore::RenderBlock::updateFirstLetter): Ditto.
+
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addChild): Use toRenderText.
+
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::dirtyLinesFromChangedChild): Use ListHashSet<RenderFlow*>
+        instead of RenderFlowSequencedSet.
+        (WebCore::RenderFlow::paintLines): Ditto.
+
+        * rendering/RenderMenuList.cpp: Removed some unneeded includes.
+
+        * rendering/RenderMenuList.h: Added now-needed forward declaration of RenderText.
+        Made more members private.
+
+        * rendering/RenderObject.cpp: Updated includes.
+        (WebCore::RenderObject::isEditable): Use toRenderText.
+        (WebCore::RenderObject::positionForPoint): Made non-inline so we wouldn't have to
+        include VisiblePosition.h in the header just for this.
+
+        * rendering/RenderObject.h: Removed unneeded includes and forward declarations.
+        Changed special vertical position values to be constants rather than an enum.
+        Eliminated RenderFlowSequencedSet, and changed clients to use ListHashSet<RenderFlow*>.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::findNextInlineTextBox): Use function members instead of
+        data members of InlineTextBox.
+        (WebCore::RenderText::positionForCoordinates): Ditto.
+        (WebCore::isInlineFlowOrEmptyText): Use toRenderText.
+        (WebCore::RenderText::previousCharacter): Use function members instead of
+        data members of InlineTextBox.
+        (WebCore::RenderText::position): Ditto.
+        (WebCore::RenderText::caretMinOffset): Ditto.
+        (WebCore::RenderText::caretMaxOffset): Ditto.
+        (WebCore::RenderText::caretMaxRenderedOffset): Ditto.
+
+        * rendering/RenderText.h: Added definition of toRenderText.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textWithHardLineBreaks): Use toRenderText.
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Use toRenderText and toRenderBox.
+        (WebCore::writeTextRun): Ditto.
+        (WebCore::write): Ditto.
+
+        * rendering/bidi.cpp:
+        (WebCore::InlineIterator::increment): Use toRenderText.
+        (WebCore::InlineIterator::current): Ditto.
+        (WebCore::checkMidpoints): Ditto.
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine): Ditto.
+        (WebCore::RenderBlock::layoutInlineChildren): Ditto.
+        (WebCore::RenderBlock::determineStartPosition): Ditto.
+        (WebCore::shouldSkipWhitespaceAfterStartObject): Ditto.
+        (WebCore::RenderBlock::findNextLineBreak): Ditto.
 
 2009-01-25  Thiago Macieira  <thiago.macieira@nokia.com>
 
@@ -625,9 +46643,256 @@
         * plugins/PluginStream.cpp:
         (WebCore::PluginStream::destroyStream):
 
-2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+2009-01-24  Alexey Proskuryakov  <ap@webkit.org>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5954398> REGRESSION: 1.1% PLT regression from 33577 and 33578 (encoding fixes)
+
+        Changed single argument KURL constructors back to always expect an already encoded string,
+        eliminating extra conversions.
+
+        This is a rather unstable situation, as it is often unclear whether a given string is safe
+        to convert to KURL without resolving. I think that going forward, the solution is to try to
+        keep encoded URLs as KURL instances, and not as strings.
+
+        * platform/KURL.h: Updated comments.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL): In debug builds, verify that the passed string is ASCII-only. The
+        intention is to verify that it is already parsed and encoded by KURL or equivalent code, but
+        since encoding is scheme-dependent, such a verification would be quite complicated.
+        Don't encode the string as UTF-8, as it supposed to be ASCII-only.
+        Removed a hack that made strings beginning with "/" turn into "file:" URLs. I didn't find
+        any reason for it to exist, but I saw several cases where this code path was taken
+        inadvertently (see examples in LayoutTests/ChangeLog).
+        (WebCore::KURL::setProtocol): Using a user-provided string without validation or encoding
+        is clearly wrong here (e.g., the "protocol" can be set to a full URL, effectively replacing
+        the old one), and an already encoded string is expected by parse().
+        In debug builds, non-ASCII input will make an assertion in parse() fail. Added a FIXME.
+        (WebCore::KURL::setHost): Ditto.
+        (WebCore::KURL::setPort): Ditto.
+        (WebCore::KURL::setHostAndPort): Ditto.
+        (WebCore::KURL::setUser): Ditto.
+        (WebCore::KURL::setPass): Ditto.
+        (WebCore::KURL::setRef): Ditto.
+        (WebCore::KURL::setQuery): Ditto.
+        (WebCore::KURL::setPath): Ditto.
+        (WebCore::KURL::parse): Verify that the passed string is already encoded.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLLinkElement.h:
+        Changed to avoid using invalid URLs (this was causing problems on DNS prefetch tests, see
+        LayoutTests/ChangeLog).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init): Create an empty KURL without indirection for a small speedup.
+        (WebCore::FrameLoader::requestFrame): Resolve and encode javascript URLs properly, now that
+        String to KURL conversion requires the string to be already encoded.
+
+        * page/DOMWindow.cpp: (WebCore::DOMWindow::postMessage): Resolve and encode the origin.
+        HTML5 seems a little unclear on how this should work (it talks about "either parsing it as
+        a URL, or resolving it", and then somehow compares unaltered targetOrigin string to a
+        security origin object), so I just made the code as close to what we already had as possible.
+
+2009-01-24  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build.
+
+        * WebCore.pro: Added JSTextCustom.cpp.
+
+2009-01-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23467
+
+        Change styleAvailable functionality to be a linked list
+        rather than scanning every CompositeAnimation for
+        Animations that are waiting for styleAvailable. This has
+        potential for large performance improvement in cases where
+        there are many animations firing at once. But it will also
+        help in my next fix, which is to synchronize software and
+        accelerated animations.
+
+        I also changed slightly when the beginAnimationUpdate and
+        endAnimationUpdate calls are made. But this has no real
+        effect on performance or behavior.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::updateRendering):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::~AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::next):
+        (WebCore::AnimationBase::setNext):
+        (WebCore::AnimationBase::styleAvailable):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::addToStyleAvailableWaitList):
+        (WebCore::AnimationControllerPrivate::removeFromStyleAvailableWaitList):
+        (WebCore::AnimationControllerPrivate::styleAvailable):
+        (WebCore::AnimationController::AnimationController):
+        (WebCore::AnimationController::endAnimationUpdate):
+        (WebCore::AnimationController::addToStyleAvailableWaitList):
+        (WebCore::AnimationController::removeFromStyleAvailableWaitList):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::addToStyleAvailableWaitList):
+        (WebCore::CompositeAnimationPrivate::removeFromStyleAvailableWaitList):
+        (WebCore::CompositeAnimation::addToStyleAvailableWaitList):
+        (WebCore::CompositeAnimation::removeFromStyleAvailableWaitList):
+        * page/animation/CompositeAnimation.h:
+
+2009-01-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6368059> REGRESSION: URL encoding problems on http://www.cineman.ch
+
+        Test: http/tests/xmlhttprequest/encode-request-url-2.html
+
+        * platform/KURL.cpp:
+        (WebCore::appendASCII): Added a helper function.
+        (WebCore::KURL::KURL): Explicitly encode the URL to call two-argument parse() with better
+        specified behavior.
+        (WebCore::KURL::init): Ditto. This avoids trying to round-trip an URL encoded into a byte
+        stream, but not yet transformed to ASCII-only using percent escapes. Since different parts
+        of the byte stream can use different encodings, round-tripping is not possible.
+        (WebCore::KURL::parse): Reverted an earlier change that made the single-argument version of
+        this function convert the string to utf-8. I think that on the remanining code paths, it is
+        correct to assume that the string is all ASCII, but I'm not yet confident enough to drop a
+        FIXME warning.
+
+2009-01-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix after r40170
+
+        * GNUmakefile.am: Removed editing/RemoveNodeAttributeCommand.cpp
+        and editing/RemoveNodeAttributeCommand.h
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after r40205.
+
+        * WebCore.pro:
+
+2009-01-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        In CachedPage, break off per-Frame pieces of data into a CachedFrame object.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        * history/CachedFrame.cpp: Added.
+        (WebCore::cachedFrameCounter):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::setCachedFramePlatformData):
+        (WebCore::CachedFrame::cachedFramePlatformData):
+        * history/CachedFrame.h: Added.
+        (WebCore::CachedFrame::document):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::view):
+        (WebCore::CachedFrame::mousePressNode):
+        (WebCore::CachedFrame::url):
+        (WebCore::CachedFrame::domWindow):
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::setCachedFramePlatformData):
+        (WebCore::CachedPage::cachedFramePlatformData):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::document):
+        (WebCore::CachedPage::documentLoader):
+        (WebCore::CachedPage::view):
+        (WebCore::CachedPage::mousePressNode):
+        (WebCore::CachedPage::url):
+        (WebCore::CachedPage::domWindow):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePageForHistoryItem): Setting the DocumentLoader independently of
+          creating a CachedPage was a historical relic.  Take the opportunity to clean that up.
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Add ASSERTs to catch anyone trying to obtain the width/height of an inline flow.  Fix up all the places
+        that triggered the ASSERT (since all of these places are effectively regressions from my landing that
+        devirtualized width()/height()).
+
+        Reviewed by Adele
+
+        * dom/Position.cpp:
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::absoluteOutlineBounds):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+        (WebCore::RenderBox::borderBoundingBox):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::borderBoundingBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::styleWillChange):
+        * rendering/RenderScrollbarPart.h:
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Second patch: Slightly less simple cases of various warnings.
+
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaString::_commonInit): Use reinterpret_cast here and avoid casting
+        away const.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::appendStartElementNSCallback): Use static_cast instead of
+        reinterpret_cast; this is casting the result of malloc, and the idiom is to use
+        static_cast, which works because we're casting from void*.
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call): Use const_cast instead
+        C-style casts.
+
+        * xml/XSLTUnicodeSort.cpp:
+        (inlineXSLTTransformError): Tweak soft linking of xsltTransformError to use a macro
+        instead of redefining the function.
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
 
         Bug 23475: fast/text/find-backwards.html fails with ICU disabled SearchBuffer
         https://bugs.webkit.org/show_bug.cgi?id=23475
@@ -642,18 +46907,3632 @@
 
         Reviewed by Anders Carlsson.
 
+        Bug 23510: REGRESSION (r40171): CDATASection objects not getting proper JavaScript wrappers
+        https://bugs.webkit.org/show_bug.cgi?id=23510
+
+        That patch fixed the optimization that's supposed to give a faster path for
+        allocating the wrappers for DOM Text objects. But CDATASection is the one
+        subclass of Text objects.
+
+        * GNUmakefile.am: Added JSCDATASectionCustom.cpp.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCDATASectionCustom.cpp: Copied from bindings/js/JSTextCustom.cpp.
+        (WebCore::toJSNewlyCreated): Changed to do CDATASection, not Text.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added another toJSNewlyCreated function
+        for CDATASection. We don't want to have to check when creating a wrapper for a
+        Text object whether it's a CDATASection object or not, so we need to do this overload
+        at compile time.
+
+2009-01-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Add a base class for WML form control elements: WMLFormControlElement (as it's designed in HTML as well).
+        WMLFormControlElement inherits from WMLElement and FormControlElement (just like the HTMLFormControlElement equivalent).
+
+        WMLInputElement / WMLOptionElement / WMLOptGroupElement are supposed to inherit from the new WMLFormControlElement class.
+        Now WMLInputElement & WMLOptGroupElement only inherit from WMLElement and FormControlElement, but WMLOptionElement inherits
+        from WMLEventHandlingElement (which in turn inherits from WMLElement) and FormControlElement. In order to introduce a shared
+        base class, WMLEventHandlingElement is no longer allowed to inherit from WMLElement directly. Instead it should turn into
+        another base class, just like FormControlElement.
+
+        Add a base class for form control elements 'with state': FormControlElementWithState, serving as base class for
+        HTMLFormControlElementWithState and WMLFormControlElementWithState. -> Make Document operate on FormControlElementWithState
+        objects instead of HTMLFormControlElementWithState objects, to support save/restore control state for non HTMLFormControlElements.
+
+        Rename isGenericFormElement() to isFormControlElement(), and move it to Element.h
+        Add new virtual function isFormControlElementWithState() to Element.h.
+
+        * GNUmakefile.am:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::formElementsState):
+        * dom/Document.h:
+        (WebCore::Document::registerFormElementWithState):
+        (WebCore::Document::unregisterFormElementWithState):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::isFormControlElementWithState):
+        * dom/FormControlElement.cpp:
+        (WebCore::toFormControlElement):
+        * dom/FormControlElement.h:
+        * dom/FormControlElementWithState.cpp: Added.
+        (WebCore::FormControlElementWithState::registerFormControlElementWithState):
+        (WebCore::FormControlElementWithState::unregisterFormControlElementWithState):
+        (WebCore::FormControlElementWithState::finishParsingChildren):
+        (WebCore::toFormControlElementWithState):
+        * dom/FormControlElementWithState.h: Added.
+        (WebCore::FormControlElementWithState::~FormControlElementWithState):
+        (WebCore::FormControlElementWithState::FormControlElementWithState):
+        * html/HTMLElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::willMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::didMoveToNewOwnerDocument):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isFormControlElement):
+        (WebCore::HTMLFormControlElementWithState::isFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::toFormControlElement):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formElementIndex):
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::correspondingControl):
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::formElement):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        (WebCore::scanForForm):
+        (WebCore::Frame::currentForm):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::WMLCardElement):
+        (WebCore::WMLCardElement::parseMappedAttribute):
+        (WebCore::WMLCardElement::insertedIntoDocument):
+        * wml/WMLCardElement.h:
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        * wml/WMLElement.h:
+        (WebCore::WMLElement::isWMLElement):
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLEventHandlingElement::WMLEventHandlingElement):
+        (WebCore::WMLEventHandlingElement::registerDoElement):
+        (WebCore::toWMLEventHandlingElement):
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLFormControlElement.cpp: Added.
+        (WebCore::WMLFormControlElement::WMLFormControlElement):
+        (WebCore::WMLFormControlElement::~WMLFormControlElement):
+        (WebCore::WMLFormControlElementWithState::WMLFormControlElementWithState):
+        (WebCore::WMLFormControlElementWithState::~WMLFormControlElementWithState):
+        * wml/WMLFormControlElement.h: Added.
+        (WebCore::WMLFormControlElement::isFormControlElement):
+        (WebCore::WMLFormControlElement::valueMatchesRenderer):
+        (WebCore::WMLFormControlElement::setValueMatchesRenderer):
+        (WebCore::WMLFormControlElement::name):
+        (WebCore::WMLFormControlElementWithState::isFormControlElementWithState):
+        (WebCore::WMLFormControlElementWithState::toFormControlElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::type):
+        * wml/WMLInputElement.h:
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::WMLOnEventElement::registerTask):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::WMLOptGroupElement):
+        (WebCore::WMLOptGroupElement::type):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::WMLOptionElement):
+        (WebCore::WMLOptionElement::type):
+        * wml/WMLOptionElement.h:
+        * wml/WMLTemplateElement.cpp:
+        (WebCore::WMLTemplateElement::WMLTemplateElement):
+        (WebCore::WMLTemplateElement::parseMappedAttribute):
+        * wml/WMLTemplateElement.h:
+
+2009-01-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 23509: Crash at -[WebCoreAXObject doAXNextSentenceEndTextMarkerForTextMarker:]
+        https://bugs.webkit.org/show_bug.cgi?id=23509
+
+        Add null checking in makeRange instead of AX code
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::makeRange):
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::nextSentenceEndPosition):
+        (WebCore::AccessibilityObject::previousSentenceStartPosition):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Gtk build too after removal of RenderBox::toConstRenderBox
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::baselinePosition):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after rename of RenderBox::toConstRenderBox -> toRenderBox
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after r40168.
+
+        * WebCore.pro:
+
+2009-01-23  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Darin Adler
+
+        Rename CachedPagePlatformData to CachedFramePlatformData to more accurately reflect its true role.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.order:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * history/CachedFramePlatformData.h: Copied from WebCore/history/CachedPagePlatformData.h.
+        (WebCore::CachedFramePlatformData::~CachedFramePlatformData):
+        * history/CachedPagePlatformData.h: Removed.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::setCachedFramePlatformData):
+        (WebCore::CachedPage::cachedFramePlatformData):
+        * history/CachedPage.h:
+
+2009-01-23  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Fix drawing in situations where sub-portions of the bitmap are to be
+        drawn to the screen.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-01-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for recent changes.
+
+        * WebCoreSources.bkl:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::invalidateWindowlessPluginRect):
+
+2009-01-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23407
+
+        Implement QTMovieWin::hasVideo so the controller on an audio-only <video> element
+        is never hidden (as with an <audio> element).
+
+        Test: media/video-controls-visible-audio-only.html
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasVideo):
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Make toRenderBox a non-member function.  Rename toConstRenderBox to just also be called toRenderBox.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::sizingBox):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * dom/Element.cpp:
+        (WebCore::Element::scrollByUnits):
+        * dom/Position.cpp:
+        (WebCore::endsOfNodeAreVisuallyDistinctPositions):
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        (WebCore::Position::isCandidate):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitExtraNewlineForNode):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::width):
+        (WebCore::HTMLFrameElementBase::height):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::scrollOverflow):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::adjustPosition):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::renderBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderBox.h:
+        (WebCore::toRenderBox):
+        (WebCore::RenderBox::previousSiblingBox):
+        (WebCore::RenderBox::nextSiblingBox):
+        (WebCore::RenderBox::parentBox):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::resize):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::addLayers):
+        (WebCore::RenderObject::removeLayers):
+        (WebCore::RenderObject::moveLayers):
+        (WebCore::RenderObject::findNextLayer):
+        (WebCore::RenderObject::enclosingLayer):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setNeedsPositionedMovementLayout):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::offsetFromContainer):
+        (WebCore::RenderObject::removeFromObjectLists):
+        (WebCore::RenderObject::destroy):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::addDashboardRegions):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::hitTestMediaControlPart):
+        (WebCore::RenderTheme::baselinePosition):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::hitTestMediaControlPart):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+        * rendering/bidi.cpp:
+        (WebCore::inlineWidth):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+        * wml/WMLInputElement.cpp:
+        (WebCore::isInputFocusable):
+
+2009-01-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23509: Crash at -[WebCoreAXObject doAXNextSentenceEndTextMarkerForTextMarker:]
+        https://bugs.webkit.org/show_bug.cgi?id=23509
+
+        Add null checking around next/previous sentence retrieval in AX code
+
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::nextSentenceEndPosition):
+        (WebCore::AccessibilityObject::previousSentenceStartPosition):
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Fix for <rdar://problem/6518850> REGRESSION: hover feedback not showing on many sites
+
+        Inline flow repainting was broken because it relied on width() and height().  Give RenderFlow a linesBoundingBox
+        method for obtaining a reasonable bounding box to use for repainting.  Eliminate the methods from RenderInline
+        since compacts/run-ins need them too, so putting them on RenderFlow is necessary.
+
+        For consistency, change RenderText's version of these methods into the single linesBoundingBox method as
+        well.
+
+        Reviewed by Oliver Hunt
+
+        * WebCore.base.exp:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * dom/Position.cpp:
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::linesBoundingBox):
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::offsetWidth):
+        (WebCore::RenderInline::offsetHeight):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::linesBoundingBox):
+        * rendering/RenderText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::write):
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Move layer() into RenderBox and make it non-virtual.  Move all of the scrolling functions from RenderObject
+        to RenderBox and devirtualize as many as possible.  Clean up styleWillChange to factor code specific to
+        RenderBox and RenderBlock into their appropriate subclasses.  Stubbed out an empty styleWillChange on
+        RenderText, since none of the work done in styleWillChange was relevant to text nodes.
+
+        Reviewed by Sam Weinig
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::renderView):
+        (WebCore::Document::prepareMouseEvent):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::scrollByUnits):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::contains):
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::start):
+        (WebCore::HTMLMarqueeElement::stop):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::topRenderer):
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/AccessibilityRenderObject.h:
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::hoverTimerFired):
+        * page/Frame.cpp:
+        (WebCore::Frame::clearTimers):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::verticalScrollbarWidth):
+        (WebCore::RenderBox::horizontalScrollbarHeight):
+        (WebCore::RenderBox::scroll):
+        (WebCore::RenderBox::canBeProgramaticallyScrolled):
+        (WebCore::RenderBox::autoscroll):
+        (WebCore::RenderBox::panScroll):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::layer):
+        (WebCore::RenderBox::requiresLayer):
+        (WebCore::RenderBox::stopAutoscroll):
+        (WebCore::RenderBox::hasAutoVerticalScrollbar):
+        (WebCore::RenderBox::hasAutoHorizontalScrollbar):
+        (WebCore::RenderBox::scrollsOverflow):
+        (WebCore::RenderBox::scrollsOverflowX):
+        (WebCore::RenderBox::scrollsOverflowY):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::addFocusRingRects):
+        * rendering/RenderForeignObject.cpp:
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::requiresLayer):
+        * rendering/RenderInline.cpp:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::requiresLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::childrenClipRect):
+        (WebCore::RenderLayer::selfClipRect):
+        * rendering/RenderListBox.cpp:
+        * rendering/RenderListBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::addLayers):
+        (WebCore::RenderObject::removeLayers):
+        (WebCore::RenderObject::moveLayers):
+        (WebCore::RenderObject::findNextLayer):
+        (WebCore::RenderObject::enclosingLayer):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setNeedsPositionedMovementLayout):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::offsetFromContainer):
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::requiresLayer):
+        * rendering/RenderReplica.h:
+        (WebCore::RenderReplica::requiresLayer):
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::requiresLayer):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::requiresLayer):
+        * rendering/RenderSVGImage.cpp:
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::requiresLayer):
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::requiresLayer):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::requiresLayer):
+        * rendering/RenderSVGText.cpp:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::requiresLayer):
+        * rendering/RenderScrollbarPart.h:
+        (WebCore::RenderScrollbarPart::requiresLayer):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::setCurrentPosition):
+        * rendering/RenderTableCell.cpp:
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::requiresLayer):
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::requiresLayer):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::styleWillChange):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::autoscroll):
+        (WebCore::RenderTextControl::scroll):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        (WebCore::externalRepresentation):
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Fix tyop.
+
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * Configurations/Base.xcconfig:
+        Fix GCC 4.0 build.
+
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+        Pass a const reference to the vector.
+
+        * html/HTMLElement.cpp:
+        * platform/text/String.cpp:
+        Add comments indicating that these functions are for use in the debugger.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Turn on -Wmissing-prototypes and fix the resulting warnings.
+
+        * Configurations/Base.xcconfig:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::customGetOwnPropertySlot):
+        * bindings/objc/DOMRGBColor.mm:
+        (WebCore::getWrapperForRGB):
+        (WebCore::setWrapperForRGB):
+        (WebCore::removeWrapperForRGB):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::globalExceptionString):
+        * bridge/runtime_object.cpp:
+        (JSC::callRuntimeConstructor):
+        * css/CSSParser.cpp:
+        (WebCore::parseGradientColorStop):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::scaleFactorForConversion):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::operator >):
+        (WebCore::operator <=):
+        (WebCore::getTransformOperationType):
+        * dom/make_names.pl:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::updatePositionForTextRemoval):
+        * editing/EditorCommand.cpp:
+        (WebCore::valueBackColor):
+        (WebCore::valueFontName):
+        (WebCore::valueFontSize):
+        (WebCore::valueFontSizeDelta):
+        (WebCore::valueForeColor):
+        * editing/VisiblePosition.cpp:
+        (WebCore::canonicalizeCandidate):
+        * editing/htmlediting.cpp:
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        (WebCore::blockTagList):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::serializeTimeOffset):
+        (WebCore::parseTimeOffset):
+        * page/mac/FrameMac.mm:
+        (WebCore::regExpForLabels):
+        * platform/Arena.cpp:
+        * platform/graphics/Color.cpp:
+        (WebCore::colorFloatToRGBAByte):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::CGPathApplierToPathApplier):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+        * platform/mac/PlatformMouseEventMac.mm:
+        * platform/text/String.cpp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::continuationOutlineTable):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderView.cpp:
+        (WebCore::rendererAfterPosition):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::isEditableLeaf):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::hasFractions):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::positionedObjectMoved):
+        * svg/SVGFont.cpp:
+        (WebCore::floatWidthUsingSVGFontCallback):
+        (WebCore::floatWidthMissingGlyphCallback):
+        (WebCore::drawTextUsingSVGFontCallback):
+        (WebCore::drawTextMissingGlyphCallback):
+        * svg/SVGTransformable.cpp:
+        (WebCore::parseTransformParamList):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::operator<<):
+        * xml/XPathGrammar.y:
+        * xml/XSLTExtensions.cpp:
+
+2009-01-23  Eric Seidel  <eric@webkit.org>
+
+        No review, removing an empty file.
+
+        Remove RemoveNodeAttributeCommand since it was empty.
+
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/RemoveNodeAttributeCommand.cpp: Removed.
+        * editing/RemoveNodeAttributeCommand.h: Removed.
+
+2009-01-23  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        Rework ScriptCachedPageData to ScriptCachedFrameData to more accurately reflect its true purpose
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        * bindings/js/ScriptCachedFrameData.cpp: Copied from bindings/js/ScriptCachedPageData.cpp.
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        (WebCore::ScriptCachedFrameData::~ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h: Copied from bindings/js/ScriptCachedPageData.h.
+        * bindings/js/ScriptCachedPageData.cpp: Removed.
+        * bindings/js/ScriptCachedPageData.h: Removed.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+
+2009-01-23  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::baselinePosition):
+
+2009-01-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23506
+        Upstream Chromium's image decoders for use with PLATFORM(SKIA)
+
+        * platform/image-decoders/skia/BMPImageDecoder.cpp: Added.
+        * platform/image-decoders/skia/BMPImageDecoder.h: Added.
+        * platform/image-decoders/skia/BMPImageReader.cpp: Added.
+        * platform/image-decoders/skia/BMPImageReader.h: Added.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoderPrivate::GIFImageDecoderPrivate):
+        (WebCore::GIFImageDecoderPrivate::decode):
+        (WebCore::GIFImageDecoderPrivate::getColorMap):
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::prepEmptyFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        * platform/image-decoders/skia/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::filenameExtension):
+        (WebCore::GIFImageDecoder::frameDurationAtIndex):
+        (WebCore::GIFImageDecoder::):
+        * platform/image-decoders/skia/GIFImageReader.cpp:
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/skia/GIFImageReader.h:
+        * platform/image-decoders/skia/ICOImageDecoder.cpp: Added.
+        * platform/image-decoders/skia/ICOImageDecoder.h: Added.
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RefCountedNativeImageSkia::create):
+        (WebCore::RefCountedNativeImageSkia::bitmap):
+        (WebCore::RefCountedNativeImageSkia::RefCountedNativeImageSkia):
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::~RGBA32Buffer):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::bitmap):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::rect):
+        (WebCore::RGBA32Buffer::status):
+        (WebCore::RGBA32Buffer::duration):
+        (WebCore::RGBA32Buffer::disposalMethod):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setRect):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setDuration):
+        (WebCore::RGBA32Buffer::setDisposalMethod):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::~ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::isSizeAvailable):
+        (WebCore::ImageDecoder::size):
+        (WebCore::ImageDecoder::frameCount):
+        (WebCore::ImageDecoder::repetitionCount):
+        (WebCore::ImageDecoder::supportsAlpha):
+        (WebCore::ImageDecoder::failed):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::clearFrameBufferCache):
+        (WebCore::ImageDecoder::setSize):
+        (WebCore::ImageDecoder::isOverSize):
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/skia/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        (WebCore::JPEGImageDecoder::supportsAlpha):
+        (WebCore::JPEGImageDecoder::reader):
+        * platform/image-decoders/skia/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageDecoder::PNGImageDecoder):
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::decodingFailed):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::rowAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        * platform/image-decoders/skia/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::reader):
+        * platform/image-decoders/skia/XBMImageDecoder.cpp: Added.
+        * platform/image-decoders/skia/XBMImageDecoder.h: Added.
+
+2009-01-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23506
+        Copy existing ImageDecoder.h in preparation for landing Skia changes on top.
+
+        * platform/image-decoders/skia/ImageDecoder.h: Copied from platform/image-decoders/ImageDecoder.h.
+
+2009-01-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23506
+        Copy existing image-decoders in preparation for landing Skia changes on top.
+
+        * platform/image-decoders/skia: Added.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp: Copied from platform/image-decoders/gif/GIFImageDecoder.cpp.
+        * platform/image-decoders/skia/GIFImageDecoder.h: Copied from platform/image-decoders/gif/GIFImageDecoder.h.
+        * platform/image-decoders/skia/GIFImageReader.cpp: Copied from platform/image-decoders/gif/GIFImageReader.cpp.
+        * platform/image-decoders/skia/GIFImageReader.h: Copied from platform/image-decoders/gif/GIFImageReader.h.
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp: Copied from platform/image-decoders/jpeg/JPEGImageDecoder.cpp.
+        * platform/image-decoders/skia/JPEGImageDecoder.h: Copied from platform/image-decoders/jpeg/JPEGImageDecoder.h.
+        * platform/image-decoders/skia/PNGImageDecoder.cpp: Copied from platform/image-decoders/png/PNGImageDecoder.cpp.
+        * platform/image-decoders/skia/PNGImageDecoder.h: Copied from platform/image-decoders/png/PNGImageDecoder.h.
+
+2009-01-23  Holger Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Based on https://bugs.webkit.org/show_bug.cgi?id=23498
+        from craig.schlenter@gmail.com
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::baselinePosition):
+
+2009-01-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 22720: Make XMLHttpRequest work in Workers
+        <https://bugs.webkit.org/show_bug.cgi?id=22720>
+
+        Add copy/adopt for ResourceResponse(Base)/ResourceRequest(Base) to allow the
+        data to be passed across threads.
+
+        No observable change in behavior, so no test.
+
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        * platform/network/FormData.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        (WebCore::HTTPHeaderMap::adopt):
+        * platform/network/HTTPHeaderMap.h:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/network/ResourceResponseBase.h:
+
+2009-01-23  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23374
+        Add WorkerRunLoop to encapsulate message queue and timer heap.
+        This is first half (timer heap is added as separate patch).
+
+        * GNUmakefile.am: Added WorkerRunLoop.cpp to the build.
+        * WebCore.vcproj/WebCore.vcproj: Same as above.
+        * WebCore.xcodeproj/project.pbxproj: Same as above
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::postTask):
+        * dom/WorkerContext.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * dom/WorkerRunLoop.cpp: Added.
+        (WebCore::WorkerRunLoop::run): Runs the loop until terminate() is called.
+        (WebCore::WorkerRunLoop::terminate): Causes the loop to exit.
+        (WebCore::WorkerRunLoop::postTask): Adds a task to the internal queue.
+        * dom/WorkerRunLoop.h: Added.
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThread::stop):
+        * dom/WorkerThread.h:
+        (WebCore::WorkerThread::runLoop):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Redo previous patch http://trac.webkit.org/changeset/34260 which fixes a
+        huge memory leak by ensuring that the timer is fired one last time on
+        application tear down thus triggering the GCController thereby freeing
+        JavaScript objects as well as triggering other timer based tear down methods.
+
+        * platform/qt/SharedTimerQt.cpp:
+        (WebCore::SharedTimerQt::~SharedTimerQt):
+
+2009-01-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23459
+        Workers are not properly terminated if execution hasn't begun yet
+
+        Doesn't affect observable behavior, so test case is not possible.
+
+        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread): Call forbidExecution() if
+        it couldn't be called earlier.
+
+2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        [Qt] Fix the build after RenderBox refactoring in r40153.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+
+2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Fix the build after RenderBox refactoring in r40153.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::invalidateWindowlessPluginRect):
+
+2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
         [Qt] Simplify the assertion.
 
         * platform/graphics/qt/GraphicsContextQt.cpp:
         (WebCore::GraphicsContext::getWindowsContext):
         (WebCore::GraphicsContext::releaseWindowsContext):
 
-2009-01-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+2009-01-22  David Hyatt  <hyatt@apple.com>
 
-        [Qt] Build fix after r39971.
+        Move the border and padding methods from RenderObject to RenderBox.
 
-        * platform/qt/LoggingQt.cpp:
-        (WebCore::InitializeLoggingChannelsIfNecessary):
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::paddingLeft):
+        (WebCore::InlineFlowBox::paddingRight):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paddingTop):
+        (WebCore::RenderBox::paddingBottom):
+        (WebCore::RenderBox::paddingLeft):
+        (WebCore::RenderBox::paddingRight):
+        (WebCore::RenderBox::calcHeight):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderTop):
+        (WebCore::RenderBox::borderBottom):
+        (WebCore::RenderBox::borderLeft):
+        (WebCore::RenderBox::borderRight):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textBlockWidth):
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::repaintViewRectangle):
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Devirtualize the marginTop/Right/Left/Bottom functions and move them to RenderBox (along with some of the
+        other margin functions that have to come along for the ride).
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitExtraNewlineForNode):
+        * rendering/InlineBox.cpp:
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::renderBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::marginLeft):
+        (WebCore::InlineFlowBox::marginRight):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::shrinkBoxesWithNoTextChildren):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isSelfCollapsingBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::handleCompactChild):
+        (WebCore::RenderBlock::estimateVerticalPosition):
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasHorizontalBordersPaddingOrMargin):
+        (WebCore::RenderBox::hasHorizontalBordersOrPadding):
+        (WebCore::RenderBox::marginTop):
+        (WebCore::RenderBox::marginBottom):
+        (WebCore::RenderBox::marginLeft):
+        (WebCore::RenderBox::marginRight):
+        (WebCore::RenderBox::isSelfCollapsingBlock):
+        (WebCore::RenderBox::collapsedMarginTop):
+        (WebCore::RenderBox::collapsedMarginBottom):
+        (WebCore::RenderBox::isTopMarginQuirk):
+        (WebCore::RenderBox::isBottomMarginQuirk):
+        (WebCore::RenderBox::maxTopMargin):
+        (WebCore::RenderBox::maxBottomMargin):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::lineHeight):
+        (WebCore::RenderSVGContainer::baselinePosition):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcHeight):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::baselinePosition):
+        * rendering/bidi.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::inlineWidth):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::inlineFlowRequiresLineBox):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-01-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Disable GCC_WARN_ABOUT_MISSING_PROTOTYPES temporarily.
+
+        Current versions of Xcode only respect it for C and Objective-C files,
+        and our code doesn't currently compile if it is applied to C++ and
+        Objective-C++ files.
+
+        * Configurations/Base.xcconfig:
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Move the m_widthChanged bit on RenderTableCell into RenderFlow's set of bits.  Let intrinsicPaddingTop and
+        intrinsicPaddingBottom just be normal non-bitfield values.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        (WebCore::RenderTableCell::updateWidth):
+        (WebCore::RenderTableCell::layout):
+        * rendering/RenderTableCell.h:
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Properly encapsulate m_frameRect.y() behind the RenderBox::y() method now that they are the same thing.
+        Make m_frameRect private.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetTop):
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::paint):
+        (WebCore::RenderBox::paintCustomHighlight):
+        (WebCore::RenderBox::containingBlockWidth):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        (WebCore::RenderBox::repaintDuringLayoutIfMoved):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::layout):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paint):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::nodeAtPoint):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::calcWidth):
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint):
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setCellWidths):
+        (WebCore::RenderTableSection::calcRowHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::paint):
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23487.
+
+        This patch completely reworks vertical alignment of table cells.  The current system uses methods called borderTopExtra() and borderBottomExtra() to
+        add extra space above and below the content of a cell.  This system was not confined to the table code and spilled out into all the other RenderObjects.
+        The y-position of the table cell box was set to the outer edge of the cell, but the y() method of RenderBox lied and added in borderTopExtra().  height()
+        also excluded the extra space, so did not accurately reflect the true size of the cell.
+
+        With the new system, the table cell box is completely accurate.  The extra space becomes part of the padding of the cell.  Padding has been reworked so that
+        additional intrinsic padding can be added on to the specified padding from style.  Only the table code has to deal with the extra cell padding.
+
+        localToAbsoluteForContent has now been removed, since there no longer has to be a special hacked content box.
+
+        A number of table layout tests progress with this change, since the new layout system actually fixes existing bugs in baseline alignment of cells.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Make CSSComputedStyleDeclaration ask for padding values that exclude the built-in intrinsic padding.  This ensures that getComputedStyle continues
+        to give the right answer.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowRect):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
+        The expandsToEncloseOverhangingFloats logic has been reworked.  Table cells and fieldsets did not properly handle floats that spilled into the bottom padding.  The
+        resulting box needed to not only expand to encompass the float, but also needed to place the full bottom padding after the float.  The switch to make the extra table cell
+        space into padding exposed this issue.  No extra layout test is required, since an existing table layout test exposes this issue and progresses to match Firefox with
+        this change.
+
+        (WebCore::RenderBlock::selectionGapRects):
+        (WebCore::RenderBlock::paintSelection):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::offsetForContents):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderBlock.h:
+        Add the new simplified method for expanding to encompass overhanging floats.  The method has been devirtualized and made to include all of the cases (and not just a subset).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        (WebCore::RenderBox::absoluteContentBox):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::getOverflowClipRect):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::absoluteToLocal):
+        (WebCore::RenderBox::localToAbsoluteQuad):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::y):
+        (WebCore::RenderBox::location):
+        (WebCore::RenderBox::borderBoxRect):
+        (WebCore::RenderBox::offsetHeight):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addLineBoxRects):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderFieldset.h:
+        (WebCore::RenderFieldset::avoidsFloats):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::localCaretRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::isPointInOverflowControl):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::offsetFromContainer):
+        (WebCore::RenderObject::paddingTop):
+        (WebCore::RenderObject::paddingBottom):
+        (WebCore::RenderObject::paddingLeft):
+        (WebCore::RenderObject::paddingRight):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasOverhangingFloats):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRect):
+        (WebCore::RenderReplaced::localSelectionRect):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.  Also modifed paddingLeft/Top/Right/Bottom to take an argument indicating
+        whether or not the intrinsic padding of an object should be included (by default it is).  getComputedStyle needs to exclude it, which is why this argument is
+        necessary.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        (WebCore::RenderTableCell::paddingTop):
+        (WebCore::RenderTableCell::paddingBottom):
+        The new paddingTop() and paddingBottom() methods on table cells include the extra intrinsic padding.
+
+        (WebCore::RenderTableCell::setOverrideSize):
+        When a table's override size gets altered, the intrinsic padding needs to be cleared.
+
+        (WebCore::RenderTableCell::absoluteClippedOverflowRect):
+        (WebCore::RenderTableCell::computeAbsoluteRepaintRect):
+        (WebCore::RenderTableCell::baselinePosition):
+        (WebCore::RenderTableCell::paint):
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintBoxDecorations):
+        (WebCore::RenderTableCell::paintMask):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::setIntrinsicPaddingTop):
+        (WebCore::RenderTableCell::setIntrinsicPaddingBottom):
+        (WebCore::RenderTableCell::setIntrinsicPadding):
+        (WebCore::RenderTableCell::clearIntrinsicPadding):
+        (WebCore::RenderTableCell::intrinsicPaddingTop):
+        (WebCore::RenderTableCell::intrinsicPaddingBottom):
+        Add new helper methods for getting/setting a cell's intrinsic padding.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowHeight):
+        calcRowHeight has been modified to exclude the intrinsic padding when calculating the base height of rows prior to flexing.  Because a cell now includes that
+        extra space, it has to be subtracted out in this method.
+
+        (WebCore::RenderTableSection::layoutRows):
+        Modify the code that sets up the intrinsic padding so that it does a relayout if the intrinsic padding changes.   There was also an error where the baseline
+        position mismatched leading to negative intrinsic padding being added in (this error exists in ToT).  The code now properly ignores cells that don't establish
+        a baseline.  A number of tests progress with this change.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::addLineBoxRects):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeTextRun):
+        Modify the render tree dumping code to continue to produce the same results as before.  This is really a hack, since we're now capable of indicating the correct
+        position for the descendants of cells with intrinsic padding (and also indicating what the correct cell box is).  A future patch can remove these hacks so that the
+        layout test results can all be regenerated.
+
+2009-01-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove <strong>/<em> tags when toggling bold/italic since IE inserts them instead of <b>/<i>
+        https://bugs.webkit.org/show_bug.cgi?id=23486
+
+        Test: editing/execCommand/toggle-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::isHTMLStyleNode):
+
+2009-01-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Remove <span> turds left by editing commands
+        https://bugs.webkit.org/show_bug.cgi?id=23466
+
+        Tests:
+        * editing/execCommand/empty-span-removal.html
+        * editing/execCommand/toggle-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::styleSpanClassString):
+        (WebCore::isStyleSpan):
+        (WebCore::isUnstyledStyleSpan):
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::ApplyStyleCommand::removeHTMLBidiEmbeddingStyle):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Rename some of the casting functions in dom/*Element.cpp:
+        formControlElementForElement -> toFormControlElement
+        inputElementForElement -> toInputElement
+        optionElementForElement -> toOptionElement
+        optionGroupElementForElement -> toOptionGroupElement
+
+        Suggested by Alexey, while refactoring the Element*->ScriptElement* code.
+        The Element*->ScriptElement* helper function is already named 'toScriptElement'.
+
+        * dom/FormControlElement.cpp:
+        (WebCore::toFormControlElement):
+        * dom/FormControlElement.h:
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::toInputElement):
+        * dom/InputElement.h:
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::toOptionElement):
+        * dom/OptionElement.h:
+        * dom/OptionGroupElement.cpp:
+        (WebCore::toOptionGroupElement):
+        * dom/OptionGroupElement.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::itemText):
+        (WebCore::RenderMenuList::itemIsSelected):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::formControlElement):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::inputElement):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by George Staikos.
+
+        Forgot to include in my last commit: Activate code depending on WMLOptionElement/WMLOptGroupElement.
+
+        * dom/OptionElement.cpp:
+        (WebCore::optionElementForElement):
+        * dom/OptionGroupElement.cpp:
+        (WebCore::optionGroupElementForElement):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23454
+
+        Add WML <option>/<optgroup> element support.
+        Currently the implementation is stubbed, all relevant parts can be enabled
+        once WMLSelectElement/SelectElement has been created.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLOptGroupElement.cpp: Added.
+        (WebCore::WMLOptGroupElement::WMLOptGroupElement):
+        (WebCore::WMLOptGroupElement::~WMLOptGroupElement):
+        (WebCore::WMLOptGroupElement::insertBefore):
+        (WebCore::WMLOptGroupElement::replaceChild):
+        (WebCore::WMLOptGroupElement::removeChild):
+        (WebCore::WMLOptGroupElement::appendChild):
+        (WebCore::WMLOptGroupElement::removeChildren):
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptGroupElement::accessKeyAction):
+        (WebCore::WMLOptGroupElement::childrenChanged):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::attach):
+        (WebCore::WMLOptGroupElement::detach):
+        (WebCore::WMLOptGroupElement::setRenderStyle):
+        (WebCore::WMLOptGroupElement::nonRendererRenderStyle):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        (WebCore::WMLOptGroupElement::recalcSelectOptions):
+        * wml/WMLOptGroupElement.h: Added.
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::valueMatchesRenderer):
+        (WebCore::WMLOptGroupElement::setValueMatchesRenderer):
+        (WebCore::WMLOptGroupElement::rendererIsNeeded):
+        * wml/WMLOptionElement.cpp: Added.
+        (WebCore::WMLOptionElement::WMLOptionElement):
+        (WebCore::WMLOptionElement::~WMLOptionElement):
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptionElement::accessKeyAction):
+        (WebCore::WMLOptionElement::childrenChanged):
+        (WebCore::WMLOptionElement::parseMappedAttribute):
+        (WebCore::WMLOptionElement::attach):
+        (WebCore::WMLOptionElement::detach):
+        (WebCore::WMLOptionElement::setRenderStyle):
+        (WebCore::WMLOptionElement::insertedIntoDocument):
+        (WebCore::WMLOptionElement::selected):
+        (WebCore::WMLOptionElement::setSelectedState):
+        (WebCore::WMLOptionElement::value):
+        (WebCore::WMLOptionElement::textIndentedToRespectGroupLabel):
+        (WebCore::WMLOptionElement::nonRendererRenderStyle):
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLOptionElement.h: Added.
+        (WebCore::WMLOptionElement::valueMatchesRenderer):
+        (WebCore::WMLOptionElement::setValueMatchesRenderer):
+        (WebCore::WMLOptionElement::rendererIsNeeded):
+        * wml/WMLTagNames.in:
+
+2009-01-22  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20806
+        Send referrer for history navigations.
+
+        Test: http/tests/navigation/back-send-referrer.html
+
+        Consolidates HistoryItem::rssFeedReferrer and HistoryItem::formReferrer into a single HistoryItem::referrer property.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::referrer):
+        (WebCore::HistoryItem::setReferrer):
+        (WebCore::HistoryItem::formReferrer):
+        (WebCore::HistoryItem::rssFeedReferrer):
+        (WebCore::HistoryItem::setRSSFeedReferrer):
+        (WebCore::HistoryItem::setFormInfoFromRequest):
+        * history/HistoryItem.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23465
+
+        Further enhancments to share code between HTMLOptionElement and the upcoming WMLOptionElement.
+
+        Rename optionText() to textIndentedToRespectGroupLabel() in (HTML)OptionElement, as it fits better.
+        optionText() returns the options text prefixed with some spaces, in case it got an optgroup parent.
+
+        Add two more pure-virtual functions to OptionElement: setSelectedState(bool) & value().
+        These aren't used outside of html/ at the moment (unlike the other pure-virtual functions
+        used by RenderMenuList/RenderListBox) - but they will be used by SelectElement, once it exists.
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        (WebCore::OptionElement::collectOptionText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        (WebCore::OptionElementData::OptionElementData):
+        (WebCore::OptionElementData::~OptionElementData):
+        * dom/OptionElement.h:
+        (WebCore::OptionElementData::element):
+        (WebCore::OptionElementData::value):
+        (WebCore::OptionElementData::setValue):
+        (WebCore::OptionElementData::label):
+        (WebCore::OptionElementData::setLabel):
+        (WebCore::OptionElementData::selected):
+        (WebCore::OptionElementData::setSelected):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::text):
+        (WebCore::HTMLOptionElement::parseMappedAttribute):
+        (WebCore::HTMLOptionElement::value):
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::setSelected):
+        (WebCore::HTMLOptionElement::setSelectedState):
+        (WebCore::HTMLOptionElement::label):
+        (WebCore::HTMLOptionElement::textIndentedToRespectGroupLabel):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::itemText):
+
+2009-01-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Bug 23464: Infinite recursion at SelectionController::setSelection
+        https://bugs.webkit.org/show_bug.cgi?id=23464
+
+        Check for conditions leading to infinite recursion.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML build problem in RenderBox.cpp, WMLNames is undefined.
+
+        * rendering/RenderBox.cpp:
+
+2009-01-22  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after RenderBox changes.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Fix regressions in list box selection on Mac.  The wrong color was being used for the list box
+        background, and list box colors actually weren't even being properly fetched because of a bug in
+        the RenderTheme base class.  Existing pixel tests cover the bug fix.
+
+        Reviewed by Jon Honeycutt
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::activeListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::activeListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionForegroundColor):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor):
+
+2009-01-22  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 22720: Make XMLHttpRequest work in Workers
+        <https://bugs.webkit.org/show_bug.cgi?id=22720>
+
+        Add copy/adopt for HTTPHeaderMap to allow the data to be passed across threads.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * platform/network/HTTPHeaderMap.cpp: Added.
+        (WebCore::HTTPHeaderMap::copyData):
+        (WebCore::HTTPHeaderMap::adopt):
+        * platform/network/HTTPHeaderMap.h:
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Back out a portion of my patch that I did not mean to land.  Revert paintOutline back to the way it
+        was before my landing.  Fixes failing SVG focus ring tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintOutline):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix Node's renderBox() method on Windows.
+
+        * dom/Node.cpp:
+        (WebCore::Node::renderBox):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix RenderThemeSafari bustage on Win32.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::baselinePosition):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix bustage in RenderThemeWin. It's actually terrible that RenderThemeWin is using absoluteContentBox,
+        but that's a problem for another day.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+
+2009-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23470: Crash when page load occurs while processing scroll event with MallocScribble enabled
+        <https://bugs.webkit.org/show_bug.cgi?id=23470>
+
+        Add a RefPtr protector to handleWheelEvent to guard against destruction
+        while processing the scroll event.  Alas the absurd set of circumstances
+        required to trigger this do not appear to be reproducible in DRT.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23453
+
+        Devirtualize the width/height/x/y methods of the render tree.  The methods are now non-virtual on RenderBox.
+        Many functions that were previously in RenderObject.cpp are now in RenderBox.cpp.
+
+        Reviewed by Eric Seidel and Darin Adler
+
+        * WebCore.base.exp:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::sizingBox):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * dom/Element.cpp:
+        (WebCore::Element::offsetLeft):
+        (WebCore::Element::offsetTop):
+        (WebCore::Element::offsetWidth):
+        (WebCore::Element::offsetHeight):
+        (WebCore::Element::offsetParent):
+        (WebCore::Element::clientLeft):
+        (WebCore::Element::clientTop):
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        (WebCore::Element::scrollLeft):
+        (WebCore::Element::scrollTop):
+        (WebCore::Element::setScrollLeft):
+        (WebCore::Element::setScrollTop):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Node.cpp:
+        (WebCore::Node::renderBox):
+        (WebCore::Node::getRect):
+        * dom/Node.h:
+        * dom/Position.cpp:
+        (WebCore::endsOfNodeAreVisuallyDistinctPositions):
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        (WebCore::Position::isCandidate):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::isCandidate):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea):
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::willDraw):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::width):
+        (WebCore::HTMLFrameElementBase::height):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::width):
+        (WebCore::HTMLImageElement::height):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::updateDashboardRegions):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::imageRect):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::renderBox):
+        (WebCore::InlineBox::adjustPosition):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderApplet.cpp:
+        (WebCore::RenderApplet::createWidgetIfNecessary):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight):
+        (WebCore::RenderBlock::overflowWidth):
+        (WebCore::RenderBlock::overflowRect):
+        (WebCore::RenderBlock::isSelfCollapsingBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::adjustFloatingBlock):
+        (WebCore::RenderBlock::handleSpecialChild):
+        (WebCore::RenderBlock::handlePositionedChild):
+        (WebCore::RenderBlock::handleFloatingChild):
+        (WebCore::RenderBlock::handleCompactChild):
+        (WebCore::RenderBlock::insertCompactIfNeeded):
+        (WebCore::RenderBlock::handleRunInChild):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::estimateVerticalPosition):
+        (WebCore::RenderBlock::determineHorizontalPosition):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::markPositionedObjectsForLayout):
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::paintContinuationOutlines):
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::fillBlockSelectionGaps):
+        (WebCore::RenderBlock::leftSelectionOffset):
+        (WebCore::RenderBlock::rightSelectionOffset):
+        (WebCore::RenderBlock::insertPositionedObject):
+        (WebCore::RenderBlock::removePositionedObject):
+        (WebCore::RenderBlock::removePositionedObjects):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::removeFloatingObject):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::newLine):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect):
+        (WebCore::RenderBlock::hasOverhangingFloats):
+        (WebCore::RenderBlock::CompactInfo::compact):
+        (WebCore::RenderBlock::CompactInfo::set):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::RenderBox):
+        (WebCore::RenderBox::offsetLeft):
+        (WebCore::RenderBox::offsetTop):
+        (WebCore::RenderBox::offsetParent):
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        (WebCore::RenderBox::absoluteContentBox):
+        (WebCore::RenderBox::absoluteContentQuad):
+        (WebCore::RenderBox::absoluteOutlineBounds):
+        (WebCore::RenderBox::addFocusRingRects):
+        (WebCore::RenderBox::reflectionBox):
+        (WebCore::RenderBox::reflectionOffset):
+        (WebCore::RenderBox::reflectedRect):
+        (WebCore::RenderBox::overrideWidth):
+        (WebCore::RenderBox::overrideHeight):
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::paint):
+        (WebCore::RenderBox::maskClipRect):
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+        (WebCore::RenderBox::paintCustomHighlight):
+        (WebCore::RenderBox::getOverflowClipRect):
+        (WebCore::RenderBox::getClipRect):
+        (WebCore::RenderBox::containingBlockWidth):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::position):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        (WebCore::RenderBox::repaintDuringLayoutIfMoved):
+        (WebCore::RenderBox::calcWidth):
+        (WebCore::RenderBox::calcWidthUsing):
+        (WebCore::RenderBox::calcHorizontalMargins):
+        (WebCore::RenderBox::calcHeight):
+        (WebCore::RenderBox::calcPercentageHeight):
+        (WebCore::RenderBox::calcReplacedHeightUsing):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::lowestPosition):
+        (WebCore::RenderBox::rightmostPosition):
+        (WebCore::RenderBox::leftmostPosition):
+        (WebCore::RenderBox::localTransform):
+        * rendering/RenderBox.h:
+        (WebCore::):
+        (WebCore::RenderBox::x):
+        (WebCore::RenderBox::y):
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::setX):
+        (WebCore::RenderBox::setY):
+        (WebCore::RenderBox::setWidth):
+        (WebCore::RenderBox::setHeight):
+        (WebCore::RenderBox::location):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::setLocation):
+        (WebCore::RenderBox::setSize):
+        (WebCore::RenderBox::move):
+        (WebCore::RenderBox::frameRect):
+        (WebCore::RenderBox::setFrameRect):
+        (WebCore::RenderBox::borderBoxRect):
+        (WebCore::RenderBox::contentBoxRect):
+        (WebCore::RenderBox::previousSiblingBox):
+        (WebCore::RenderBox::nextSiblingBox):
+        (WebCore::RenderBox::parentBox):
+        (WebCore::RenderBox::overflowHeight):
+        (WebCore::RenderBox::overflowWidth):
+        (WebCore::RenderBox::setOverflowHeight):
+        (WebCore::RenderBox::setOverflowWidth):
+        (WebCore::RenderBox::overflowLeft):
+        (WebCore::RenderBox::overflowTop):
+        (WebCore::RenderBox::overflowRect):
+        (WebCore::RenderBox::contentWidth):
+        (WebCore::RenderBox::contentHeight):
+        (WebCore::RenderBox::offsetWidth):
+        (WebCore::RenderBox::offsetHeight):
+        (WebCore::RenderBox::clientLeft):
+        (WebCore::RenderBox::clientTop):
+        (WebCore::RenderBox::availableWidth):
+        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::controlClipRect):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::layout):
+        (WebCore::RenderContainer::positionForCoordinates):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::firstChildBox):
+        (WebCore::RenderContainer::lastChildBox):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::calcPrefWidths):
+        (WebCore::RenderFieldset::layoutLegend):
+        (WebCore::RenderFieldset::findLegend):
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::maxFilenameWidth):
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::FlexBoxIterator::FlexBoxIterator):
+        (WebCore::FlexBoxIterator::first):
+        (WebCore::FlexBoxIterator::next):
+        (WebCore::RenderFlexibleBox::calcHorizontalPrefWidths):
+        (WebCore::RenderFlexibleBox::calcVerticalPrefWidths):
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        (WebCore::RenderFlexibleBox::placeChild):
+        (WebCore::RenderFlexibleBox::allowedChildFlex):
+        * rendering/RenderFlexibleBox.h:
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::lowestPosition):
+        (WebCore::RenderFlow::rightmostPosition):
+        (WebCore::RenderFlow::leftmostPosition):
+        (WebCore::RenderFlow::localCaretRect):
+        (WebCore::RenderFlow::addFocusRingRects):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paint):
+        (WebCore::RenderFrameSet::layout):
+        (WebCore::RenderFrameSet::positionFrames):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::paintReplaced):
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged):
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::nodeAtPoint):
+        (WebCore::RenderImage::calcReplacedWidth):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::boundingBoxWidth):
+        (WebCore::RenderInline::boundingBoxHeight):
+        (WebCore::RenderInline::positionForCoordinates):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::offsetWidth):
+        (WebCore::RenderInline::offsetHeight):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::scrollbarCornerPresent):
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::calculateRects):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::calcHeight):
+        (WebCore::RenderListBox::controlClipRect):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        (WebCore::RenderListItem::paint):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::layout):
+        (WebCore::RenderListMarker::imageChanged):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        (WebCore::RenderListMarker::selectionRect):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::layout):
+        (WebCore::RenderMedia::lowestPosition):
+        (WebCore::RenderMedia::rightmostPosition):
+        (WebCore::RenderMedia::leftmostPosition):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::controlClipRect):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderObject::paintOutline):
+        (WebCore::RenderObject::addLineBoxRects):
+        (WebCore::RenderObject::absoluteBoundingBoxRect):
+        (WebCore::RenderObject::addAbsoluteRectForLayer):
+        (WebCore::RenderObject::paintingRootRect):
+        (WebCore::RenderObject::container):
+        (WebCore::RenderObject::removeFromObjectLists):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::addDashboardRegions):
+        (WebCore::RenderObject::localTransform):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isBox):
+        (WebCore::RenderObject::hasMask):
+        (WebCore::RenderObject::setIsText):
+        (WebCore::RenderObject::setIsBox):
+        (WebCore::RenderObject::borderTop):
+        (WebCore::RenderObject::borderBottom):
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::collectAbsoluteLineBoxQuads):
+        (WebCore::RenderObject::absoluteQuads):
+        (WebCore::RenderObject::hasReflection):
+        (WebCore::RenderObject::addFocusRingRects):
+        (WebCore::RenderObject::absoluteOutlineBounds):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::updateWidgetPosition):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::absoluteOutlineBounds):
+        * rendering/RenderPath.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::paint):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForCoordinates):
+        (WebCore::RenderReplaced::localSelectionRect):
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadow):
+        (WebCore::RenderReplaced::overflowRect):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::layout):
+        (WebCore::RenderReplica::calcPrefWidths):
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::absoluteOutlineBounds):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::width):
+        (WebCore::RenderSVGContainer::height):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
+        (WebCore::RenderSVGInlineText::positionForCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        (WebCore::RenderSVGText::relativeBBox):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteRects):
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::createCustomScrollbar):
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        (WebCore::RenderScrollbar::setParent):
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::owningRenderer):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::layoutHorizontalPart):
+        (WebCore::RenderScrollbarPart::layoutVerticalPart):
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
+        (WebCore::RenderSlider::layout):
+        (WebCore::RenderSlider::mouseEventIsInThumb):
+        (WebCore::RenderSlider::positionForOffset):
+        (WebCore::RenderSlider::trackSize):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::calcWidth):
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        (WebCore::RenderTable::getBaselineOfFirstLineBox):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::updateWidth):
+        (WebCore::RenderTableCell::computeAbsoluteRepaintRect):
+        (WebCore::RenderTableCell::localToAbsolute):
+        (WebCore::RenderTableCell::absoluteToLocal):
+        (WebCore::RenderTableCell::localToAbsoluteQuad):
+        (WebCore::RenderTableCell::paint):
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::addCell):
+        (WebCore::RenderTableSection::setCellWidths):
+        (WebCore::RenderTableSection::calcRowHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        (WebCore::RenderTableSection::getBaselineOfFirstLineBox):
+        (WebCore::RenderTableSection::paint):
+        (WebCore::RenderTableSection::recalcCells):
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::overflowWidth):
+        (WebCore::RenderTableSection::overflowHeight):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::boundingBoxX):
+        (WebCore::RenderText::boundingBoxY):
+        (WebCore::RenderText::firstRunX):
+        (WebCore::RenderText::firstRunY):
+        (WebCore::RenderText::boundingBoxHeight):
+        (WebCore::RenderText::boundingBoxWidth):
+        * rendering/RenderText.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textBlockHeight):
+        (WebCore::RenderTextControl::textBlockWidth):
+        (WebCore::RenderTextControl::setSelectionRange):
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::hitInnerTextBlock):
+        (WebCore::RenderTextControl::controlClipRect):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::layout):
+        (WebCore::RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::paint):
+        (WebCore::RenderTextControlSingleLine::layout):
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        (WebCore::RenderTextControlSingleLine::textBlockWidth):
+        (WebCore::RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight):
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::hitTestMediaControlPart):
+        (WebCore::RenderTheme::baselinePosition):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeMac::hitTestMediaControlPart):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::videoBox):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::RenderView):
+        (WebCore::RenderView::calcHeight):
+        (WebCore::RenderView::calcWidth):
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::viewRect):
+        (WebCore::RenderView::docHeight):
+        (WebCore::RenderView::docWidth):
+        (WebCore::RenderView::setBestTruncatedAt):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        (WebCore::RenderWidget::nodeAtPoint):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        * rendering/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::verticallyAlignBoxes):
+        * rendering/SVGInlineFlowBox.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::write):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::verticallyAlignBoxes):
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        * rendering/SVGRootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::fitBelowFloats):
+        (WebCore::RenderBlock::findNextLineBreak):
+        (WebCore::RenderBlock::checkLinesForOverflow):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-01-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.LP64.exp:
+        Add some bridge related symbols.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Make runtime_object.h a private header.
+
+2009-01-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 22720: Make XMLHttpRequest work in Workers
+        <https://bugs.webkit.org/show_bug.cgi?id=22720>
+
+        More removal of document usage from XMLHttpRequest.
+        * Abstracted away the sync and async requests behind the ThreadableLoader class, which
+          will get an implementation for Workers.  ThreadableLoader follows the same model as
+          SubresourceLoader because DocumentThreadableLoader is a thin wrapper around SubresourceLoader.
+          Also, WorkerThreadableLoader (coming soon) will use DocumentThreadableLoader to get things done.
+        * Consolidated dashboard compatibility checks into usesDashboardBackwardCompatibilityMode
+          which handles workers.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/DocumentThreadableLoader.cpp: Added.
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::~DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::cancel):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        (WebCore::DocumentThreadableLoader::didSendData):
+        (WebCore::DocumentThreadableLoader::didReceiveResponse):
+        (WebCore::DocumentThreadableLoader::didReceiveData):
+        (WebCore::DocumentThreadableLoader::didFinishLoading):
+        (WebCore::DocumentThreadableLoader::didFail):
+        (WebCore::DocumentThreadableLoader::receivedCancellation):
+        * loader/DocumentThreadableLoader.h: Added.
+        (WebCore::DocumentThreadableLoader::refThreadableLoader):
+        (WebCore::DocumentThreadableLoader::derefThreadableLoader):
+        * loader/SubresourceLoaderClient.h:
+        (WebCore::SubresourceLoaderClient::didReceiveData):
+        * loader/ThreadableLoader.cpp: Added.
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h: Added.
+        (WebCore::):
+        (WebCore::ThreadableLoader::ref):
+        (WebCore::ThreadableLoader::deref):
+        (WebCore::ThreadableLoader::~ThreadableLoader):
+        * loader/ThreadableLoaderClient.h: Added.
+        (WebCore::ThreadableLoaderClient::didSendData):
+        (WebCore::ThreadableLoaderClient::didReceiveResponse):
+        (WebCore::ThreadableLoaderClient::didReceiveData):
+        (WebCore::ThreadableLoaderClient::didFinishLoading):
+        (WebCore::ThreadableLoaderClient::didFail):
+        (WebCore::ThreadableLoaderClient::didGetCancelled):
+        (WebCore::ThreadableLoaderClient::didReceiveAuthenticationCancellation):
+        (WebCore::ThreadableLoaderClient::~ThreadableLoaderClient):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::usesDashboardBackwardCompatibilityMode):
+        (WebCore::XMLHttpRequest::send):
+        (WebCore::XMLHttpRequest::loadRequestSynchronously):
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        (WebCore::XMLHttpRequest::processSyncLoadResults):
+        (WebCore::XMLHttpRequest::didFail):
+        (WebCore::XMLHttpRequest::didGetCancelled):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        (WebCore::XMLHttpRequest::didFinishLoadingPreflight):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveResponse):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        (WebCore::XMLHttpRequest::didReceiveAuthenticationCancellation):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        * xml/XMLHttpRequest.h:
+
+2009-01-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23317
+
+        The high CPU usage was really from repeatedly firing transitions caused
+        by a bug in the way we handle background-color animations. If animating
+        from a valid background color to no background color, we sometimes left
+        (based on timing) the background color as transparent black, but valid
+        rather than invalid, which it should be. Fixing that got rid of the
+        repeated firing.
+
+        But we really were doing more expensive iteration of all objects with
+        animations or transitions on them (running or not). So I added two
+        optimizations to quickly short circuit when an object had no running
+        animations or transitions. Things are now as zippy as ever.
+
+        Test: transitions/repeated-firing-background-color.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::hasAnimations):
+        (WebCore::CompositeAnimationPrivate::clearRenderer):
+        (WebCore::CompositeAnimationPrivate::animate):
+        (WebCore::CompositeAnimationPrivate::setAnimating):
+        (WebCore::CompositeAnimationPrivate::willNeedService):
+        (WebCore::CompositeAnimationPrivate::getAnimationForProperty):
+        (WebCore::CompositeAnimationPrivate::cleanupFinishedAnimations):
+        (WebCore::CompositeAnimationPrivate::setAnimationStartTime):
+        (WebCore::CompositeAnimationPrivate::setTransitionStartTime):
+        (WebCore::CompositeAnimationPrivate::suspendAnimations):
+        (WebCore::CompositeAnimationPrivate::resumeAnimations):
+        (WebCore::CompositeAnimationPrivate::overrideImplicitAnimations):
+        (WebCore::CompositeAnimationPrivate::resumeOverriddenImplicitAnimations):
+        (WebCore::CompositeAnimationPrivate::styleAvailable):
+        (WebCore::CompositeAnimationPrivate::isAnimatingProperty):
+        (WebCore::CompositeAnimationPrivate::numberOfActiveAnimations):
+        (WebCore::CompositeAnimation::hasAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-01-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Remove the style='' turds left by some editing commands
+        https://bugs.webkit.org/show_bug.cgi?id=23463
+
+        Test: editing/execCommand/toggle-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeCSSStyle): check if we just removed the last CSS property and remove the style attribute as well
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::removeNodeAttribute): remove extra ;
+
+2009-01-21  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix.
+
+        Fix release-only build failure (and do a tiny code-cleanup).
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::createFontElement):
+        (WebCore::createStyleSpanElement):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+
+2009-01-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23443: Table accessibility should be re-enabled after fixing crash that occurs at WebCore::AccessibilityTable::isTableExposableThroughAccessibility()
+        https://bugs.webkit.org/show_bug.cgi?id=23443
+
+        Test: accessibility/table-modification-crash.html
+
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::updateBackingStore):
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        (WebCore::AccessibilityRenderObject::children):
+        (WebCore::AccessibilityRenderObject::updateBackingStore):
+        * page/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::markChildrenDirty):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]):
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2009-01-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Fix execCommand() 'super' and 'sub' commands to add <sup> and <sub> in quirks mode, and to toggle when called twice
+        https://bugs.webkit.org/show_bug.cgi?id=17733
+
+        Test changed: editing/execCommand/toggle-styles-expected.txt
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applySubscript):
+        (WebCore::StyleChange::applySuperscript):
+        (WebCore::StyleChange::StyleChange):
+        (WebCore::StyleChange::init):
+        (WebCore::StyleChange::checkForLegacyHTMLStyleChange):
+        (WebCore::ApplyStyleCommand::isHTMLStyleNode):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeSubscript):
+        (WebCore::executeSuperscript):
+        * editing/htmlediting.cpp:
+        (WebCore::createHTMLElement):
+        * editing/htmlediting.h:
+
+2009-01-21  Anders Carlsson  <andersca@apple.com>
+
+        Fix 64-bit build.
+
+        * WebCore.LP64.exp:
+
+2009-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23458: Reintroduce CanvasPixelArray in ImageData.idl
+        <https://bugs.webkit.org/show_bug.cgi?id=23458>
+
+        Return CanvasPixelArray, et al -- the only difference between this
+        and the original CPA implementation is that it now uses a ByteArray
+        rather than a vector.  JSC still uses a custom wrapper, but this allows
+        ObjC, COM, and V8 bindings to be autogenerated again.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * html/CanvasPixelArray.cpp: Added.
+        (WebCore::CanvasPixelArray::create):
+        (WebCore::CanvasPixelArray::CanvasPixelArray):
+        * html/CanvasPixelArray.h: Added.
+        (WebCore::CanvasPixelArray::data):
+        (WebCore::CanvasPixelArray::length):
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * html/CanvasPixelArray.idl: Added.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::createEmptyImageData):
+        * html/ImageData.cpp:
+        (WebCore::ImageData::ImageData):
+        * html/ImageData.h:
+        (WebCore::ImageData::data):
+        * html/ImageData.idl:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+
+2009-01-21  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Remove last relics of platform dependent PaintServer in SVG.
+        We draw everything with the help of GraphicsContext.
+
+        Remove SVGPaintServerPlatform's
+        [https://bugs.webkit.org/show_bug.cgi?id=23439]
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::draw):
+        (WebCore::SVGPaintServer::renderPath):
+        (WebCore::SVGPaintServer::teardown):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        * svg/graphics/SVGPaintServerSolid.h:
+        * svg/graphics/cairo/SVGPaintServerCairo.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerCg.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerQt.cpp: Removed.
+        * svg/graphics/skia/SVGPaintServerSkia.cpp: Removed.
+
+2009-01-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move "Element -> ScriptElement" casting functionality into ScriptElement.h
+        to be consistent with FormControlElement/InputElement/OptionElement/OptionGroupElement.
+
+        It was living in XMLTokenizer before, which is not an obvious place for this.
+        TODO: Rename 'formControlElementForElement' to 'toFormControlElement' (analogous changes for InputElement etc.)
+              as suggested by Alexey, it really reads better this way.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::toScriptElement):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23444
+
+        Refactor some functionality from HTMLOption/OptGroupElement needed by RenderListBox/RenderMenuList
+        in two abstract base classes: OptionElement & OptionGroupElement living in dom/ - just like it
+        has been done before for FormControlElement and RenderTextControl.
+
+        This is needed to prepare the addtion of WMLOption/OptGroupElement.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/OptionElement.cpp: Added.
+        (WebCore::optionElementForElement):
+        * dom/OptionElement.h: Added.
+        (WebCore::OptionElement::~OptionElement):
+        (WebCore::OptionElement::OptionElement):
+        * dom/OptionGroupElement.cpp: Added.
+        (WebCore::optionGroupElementForElement):
+        * dom/OptionGroupElement.h: Added.
+        (WebCore::OptionGroupElement::~OptionGroupElement):
+        (WebCore::OptionGroupElement::OptionGroupElement):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::optionText):
+        * html/HTMLOptionElement.h:
+        (WebCore::HTMLOptionElement::selected):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::itemText):
+        (WebCore::RenderMenuList::itemIsSelected):
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23448: memory leak in Mac version of preferredExtensionForImageSourceType
+        https://bugs.webkit.org/show_bug.cgi?id=23448
+
+        * platform/graphics/cg/ImageSourceCGMac.mm:
+        (WebCore::preferredExtensionForImageSourceType): Use RetainPtr to avoid the leak.
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Try to fix Wx build.
+
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection): Removed code that replaces backslash
+        with backslashAsCurrencySymbol. I'm pretty sure this is not needed when writing
+        to the clipboard. Other platforms don't do it. If it was needed, the new function
+        to use would be displayStringModifiedByEncoding.
+
+2009-01-19  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Mitz Pettel.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=23423.
+
+        The Windows Cairo post-build targets (Release/Debug) do not
+        copy all of the headers that the CG-based build does.
+
+        * WebCore.vcproj/WebCore.vcproj: Extend WebCore Cairo build targets
+          to copy the page/animation/*.h files into WebKitBuild so that
+          WebKit can find them.
+
+2009-01-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23413
+        Remove unused WebCore::setDeferringTimers()
+
+        * platform/Timer.cpp:
+        (WebCore::updateSharedTimer):
+        * platform/Timer.h:
+
+2009-01-20  David Hyatt  <hyatt@apple.com>
+
+        Tighten up the type of RenderObject owned by RenderLayer to be a RenderBox.  Rename m_object to
+        m_renderer to be consistent with the corresponding member function.
+
+        Reviewed by Jon Honeycutt
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::updateVisibilityStatus):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::stackingContext):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::isTransparent):
+        (WebCore::RenderLayer::convertToLayerCoords):
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::resize):
+        (WebCore::RenderLayer::scrollbarCornerPresent):
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::setHasHorizontalScrollbar):
+        (WebCore::RenderLayer::setHasVerticalScrollbar):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::computeScrollDimensions):
+        (WebCore::RenderLayer::updateOverflowStatus):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateClipRects):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        (WebCore::RenderLayer::clearClipRects):
+        (WebCore::RenderLayer::repaintIncludingDescendants):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::renderer):
+        (WebCore::RenderLayer::hasReflection):
+        (WebCore::RenderLayer::hasTransform):
+
+2009-01-20  David Hyatt  <hyatt@apple.com>
+
+        Fix Mac build bustage from my selection changes.  I forgot to implement the functions on RenderThemeMac
+        for returning the appropriate listbox selection colors.
+
+        Reviewed by Adele
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor):
+
+2009-01-20  Dave Hyatt  <hyatt@apple.com>
+
+        Fix for focus rings on Windows.  Make sure that focus rings draw for all controls but buttons.
+
+        Fix list box selection colors on Windows.  Also add a cache for all of the selection colors (and not just the two
+        background selection colors).
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionForegroundColor):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::activeSelectionBackgroundColor):
+        (WebCore::RenderTheme::inactiveSelectionBackgroundColor):
+        (WebCore::RenderTheme::activeSelectionForegroundColor):
+        (WebCore::RenderTheme::inactiveSelectionForegroundColor):
+        (WebCore::RenderTheme::activeListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::activeListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::platformActiveSelectionForegroundColor):
+        (WebCore::RenderTheme::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderTheme::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderTheme::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::platformColorsDidChange):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::supportsForegroundSelectionColors):
+        (WebCore::RenderTheme::supportsForegroundListBoxSelectionColors):
+        * rendering/RenderThemeMac.h:
+        (WebCore::RenderThemeMac::supportsForegroundSelectionColors):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformActiveListBoxSelectionBackgroundColor):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeWin::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeWin::supportsFocus):
+        (WebCore::RenderThemeWin::supportsFocusRing):
+        * rendering/RenderThemeWin.h:
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23434
+
+        Add WML <input> element support - it required a lot of changes to the RenderText*/HTMLInput* code.
+        Now any language can provide <input>-style elements, without having to inherit from HTML* classes.
+
+        No WML specific features/attributes are handled so far. A follow-up patch will provide those bits.
+        Added very simple fast/wml/input.wml, just checking that input elements can be rendered properly now.
+        Detailed testcases will follow in conjunction with the WML specific attribute support.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * dom/FormControlElement.cpp: Activate disabled code from previous checking.
+        (WebCore::formControlElementForElement):
+        * dom/InputElement.cpp: Ditto.
+        (WebCore::inputElementForElement):
+        * wml/WMLInputElement.cpp: Added.
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::~WMLInputElement):
+        (WebCore::isInputFocusable):
+        (WebCore::WMLInputElement::isKeyboardFocusable):
+        (WebCore::WMLInputElement::isMouseFocusable):
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::updateFocusAppearance):
+        (WebCore::WMLInputElement::aboutToUnload):
+        (WebCore::WMLInputElement::size):
+        (WebCore::WMLInputElement::name):
+        (WebCore::WMLInputElement::value):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueFromRenderer):
+        (WebCore::WMLInputElement::saveState):
+        (WebCore::WMLInputElement::restoreState):
+        (WebCore::WMLInputElement::select):
+        (WebCore::WMLInputElement::accessKeyAction):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::copyNonAttributeProperties):
+        (WebCore::WMLInputElement::createRenderer):
+        (WebCore::WMLInputElement::attach):
+        (WebCore::WMLInputElement::detach):
+        (WebCore::WMLInputElement::appendFormData):
+        (WebCore::WMLInputElement::reset):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::cacheSelection):
+        (WebCore::WMLInputElement::constrainValue):
+        (WebCore::WMLInputElement::documentDidBecomeActive):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+        (WebCore::WMLInputElement::willMoveToNewOwnerDocument):
+        (WebCore::WMLInputElement::didMoveToNewOwnerDocument):
+        * wml/WMLInputElement.h: Added.
+        (WebCore::WMLInputElement::valueMatchesRenderer):
+        (WebCore::WMLInputElement::setValueMatchesRenderer):
+        (WebCore::WMLInputElement::shouldUseInputMethod):
+        (WebCore::WMLInputElement::isChecked):
+        (WebCore::WMLInputElement::isIndeterminate):
+        (WebCore::WMLInputElement::isTextControl):
+        (WebCore::WMLInputElement::isRadioButton):
+        (WebCore::WMLInputElement::isTextField):
+        (WebCore::WMLInputElement::isSearchField):
+        (WebCore::WMLInputElement::isInputTypeHidden):
+        (WebCore::WMLInputElement::isPasswordField):
+        (WebCore::WMLInputElement::searchEventsShouldBeDispatched):
+        (WebCore::WMLInputElement::placeholderValue):
+        * wml/WMLTagNames.in:
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Remove a little dead code left over after the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=11395, which
+        moved pointer-events from SVG to be shared with HTML.
+
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue): Remove SVG's parsing of this
+        property since it's handled in the non-SVG function now so we'll
+        never get here.
+
+2009-01-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23438: Provide a default value to the .in file parser
+
+        Added the default value 1 as it simplifies some of
+        the format by removing some "=1" that were awkward.
+
+        This was suggested by Darin Adler as par of a previous
+        review.
+
+        * bindings/scripts/InFilesParser.pm: When no value
+        was entered (the second part of the split is undef),
+        provide the default value.
+
+        * html/HTMLAttributeNames.in: Removed unnecessary "=1".
+        * html/HTMLTagNames.in: Ditto.
+        * svg/svgattrs.in: Ditto.
+        * svg/svgtags.in: Ditto.
+        * svg/xlinkattrs.in: Ditto.
+        * wml/WMLAttributeNames.in: Ditto.
+
+2009-01-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_class.h:
+        Get rid of CClass::name().
+
+        * bridge/jni/jni_class.h:
+        Get rid of JavaClass::name().
+
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        Get rid of ObjcClass::name().
+
+        * bridge/objc/objc_instance.h:
+        Get rid of supportsSetValueOfUndefinedField.
+
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::setValueOfUndefinedField):
+        Fold supportsSetValueOfUndefinedField into setValueOfUndefinedField.
+
+        * bridge/runtime.cpp:
+        Get rid of getValueOfField and setValueOfField.
+
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::setValueOfUndefinedField):
+        Have this return a bool and get rid of supportsSetValueOfUndefinedField
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::fieldGetter):
+        Call Field::valueFromInstance on the field.
+
+        (JSC::RuntimeObjectImp::put):
+        Call Field::setValueToInstance on the field.
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to land build changes for non-mac platforms.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Fix last-minute regression, introduced by simplifying max length determination - by
+        clamping using min/max, negative maxLength values got broken.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::parseMaxLengthAttribute):
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23433
+
+        Add InputElement abstraction, similar to the FormControlElement refactorization
+        done a month ago. The goal is to share as much code as possible between HTML/WMLInputElement.
+        In a previous patch the RenderTextControl class has been split-up in RenderTextControlSingle/MultiLine,
+        RenderTextControl itself only depends on FormControlElement, RenderTextControlSingleLine still
+        depends on HTMLInputElement directly -> change that and make it use the new InputElement abstraction.
+
+        A lot of code from HTMLInputElement now lives in InputElement, as static member functions - the
+        InputElement class itself is an abstract virtual class, just like ScriptElement. HTML/WMLInputElement
+        derive from InputElement, and hold a InputElementData member variable, that they pass to the
+        static functions in InputElement. The abstraction is equal to the one chosen for HTML/SVGScriptElement.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/FormControlElement.cpp: Added.
+        (WebCore::formControlElementForElement):
+        * dom/FormControlElement.h:
+        * dom/InputElement.cpp: Added.
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::updateFocusAppearance):
+        (WebCore::InputElement::updateSelectionRange):
+        (WebCore::InputElement::aboutToUnload):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::numCharactersInGraphemeClusters):
+        (WebCore::InputElement::constrainValue):
+        (WebCore::numGraphemeClusters):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::parseSizeAttribute):
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        (WebCore::InputElement::updateValueIfNeeded):
+        (WebCore::InputElement::notifyFormStateChanged):
+        (WebCore::InputElementData::InputElementData):
+        (WebCore::InputElementData::~InputElementData):
+        (WebCore::InputElementData::name):
+        (WebCore::inputElementForElement):
+        * dom/InputElement.h: Added.
+        (WebCore::InputElement::~InputElement):
+        (WebCore::InputElement::InputElement):
+        (WebCore::InputElementData::inputElement):
+        (WebCore::InputElementData::element):
+        (WebCore::InputElementData::placeholderShouldBeVisible):
+        (WebCore::InputElementData::setPlaceholderShouldBeVisible):
+        (WebCore::InputElementData::setName):
+        (WebCore::InputElementData::value):
+        (WebCore::InputElementData::setValue):
+        (WebCore::InputElementData::size):
+        (WebCore::InputElementData::setSize):
+        (WebCore::InputElementData::maxLength):
+        (WebCore::InputElementData::setMaxLength):
+        (WebCore::InputElementData::cachedSelectionStart):
+        (WebCore::InputElementData::setCachedSelectionStart):
+        (WebCore::InputElementData::cachedSelectionEnd):
+        (WebCore::InputElementData::setCachedSelectionEnd):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::name):
+        (WebCore::HTMLInputElement::updateFocusAppearance): Moved to InputElement.
+        (WebCore::HTMLInputElement::aboutToUnload): Ditto.
+        (WebCore::HTMLInputElement::dispatchFocusEvent): Ditto.
+        (WebCore::HTMLInputElement::dispatchBlurEvent): Ditto.
+        (WebCore::HTMLInputElement::setSelectionRange): Moved to InputElement::updateSelectionRange, call it from here.
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::size): Make virtual and override InputElements abstract version.
+        (WebCore::HTMLInputElement::copyNonAttributeProperties):
+        (WebCore::HTMLInputElement::value): Make virtual and override InputElements abstract version.
+        (WebCore::HTMLInputElement::setValue): Ditto.
+        (WebCore::HTMLInputElement::placeholderValue): Ditto.
+        (WebCore::HTMLInputElement::searchEventsShouldBeDispatched): Ditto.
+        (WebCore::HTMLInputElement::setValueFromRenderer): Ditto.
+        (WebCore::HTMLInputElement::setFileListFromRenderer): Use new code in InputElement::setValueFromRenderer
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::setDefaultName): Added as helper function for HTMLIsIndexElement.
+        (WebCore::HTMLInputElement::maxLength): Added accesor.
+        (WebCore::HTMLInputElement::constrainValue): Move functionality to InputElement::constrainValue.
+        (WebCore::HTMLInputElement::cacheSelection): Move functionality to InputElement::cacheSelection.
+        (WebCore::HTMLInputElement::selection):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible): Make virtual and override InputElements abstract version.
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isTextField):
+        (WebCore::HTMLInputElement::isSearchField):
+        (WebCore::HTMLInputElement::isAutofilled):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::formControlElement):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::placeholderShouldBeVisible):
+        (WebCore::RenderTextControlSingleLine::addSearchResult):
+        (WebCore::RenderTextControlSingleLine::stopSearchEventTimer):
+        (WebCore::RenderTextControlSingleLine::showPopup):
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        (WebCore::RenderTextControlSingleLine::createSubtreeIfNeeded):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::cacheSelection):
+        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
+        (WebCore::RenderTextControlSingleLine::createResultsButtonStyle):
+        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
+        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
+        (WebCore::RenderTextControlSingleLine::startSearchEventTimer):
+        (WebCore::RenderTextControlSingleLine::searchEventTimerFired):
+        (WebCore::RenderTextControlSingleLine::valueChanged):
+        (WebCore::RenderTextControlSingleLine::setTextFromItem):
+        (WebCore::RenderTextControlSingleLine::inputElement):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-01-20  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Make SVG pattern platform independent and remove platform code.
+
+        Make SVGPattern platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=21205
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::SVGPaintServerPattern):
+        (WebCore::SVGPaintServerPattern::~SVGPaintServerPattern):
+        (WebCore::SVGPaintServerPattern::setup):
+        (WebCore::SVGPaintServerPattern::renderPath):
+        (WebCore::SVGPaintServerPattern::teardown):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/cairo/SVGPaintServerPatternCairo.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerPatternCg.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerPatternQt.cpp: Removed.
+        * svg/graphics/skia/SVGPaintServerPatternSkia.cpp: Removed.
+
+2009-01-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23436
+        Upstream rendering/RenderThemeChromium*
+
+        * rendering/RenderThemeChromiumGtk.cpp: Added.
+        * rendering/RenderThemeChromiumGtk.h: Added.
+        * rendering/RenderThemeChromiumMac.h: Added.
+        * rendering/RenderThemeChromiumMac.mm: Added.
+        * rendering/RenderThemeChromiumWin.cpp: Added.
+        * rendering/RenderThemeChromiumWin.h: Added.
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        First patch: Fix some simple cases of various warnings.
+
+        * platform/DeprecatedPtrListImpl.cpp:
+        (WebCore::DeprecatedPtrListImpl::insert): Use const_cast to change const-ness.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::containsCharacters): Ditto.
+
+        * platform/text/PlatformString.h: Overload for short and unsigned short to avoid
+        ambiguity leading to warnings.
+        * platform/text/String.cpp:
+        (WebCore::String::number): Implemented overloads.
+
+        * platform/text/TextStream.cpp:
+        (WebCore::TextStream::operator<<): Overload for bool to avoid ambiguity leading
+        to warnings.
+        * platform/text/TextStream.h: Ditto.
+
+        * rendering/InlineFlowBox.h: Fix declaration that was specifying the wrong type.
+
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m: Fix stray characters after
+        #endif that should be a comment instead.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h: Ditto.
+
+        * xml/XPathPath.h: Remove unneeded redundant declaration.
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Build fix for WML enabled builds, not reviewed.
+
+        Fix unused variable warning.
+
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Build fix for WML enabled builds, not reviewed.
+
+        Rename 'continuation' to 'virtualContinuation'.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        RS=Dan Bernstein
+
+        Move runtime/ByteArray to wtf/ByteArray
+
+        * ForwardingHeaders/wtf/ByteArray.h: Renamed from WebCore/ForwardingHeaders/runtime/ByteArray.h.
+        * html/CanvasRenderingContext2D.cpp:
+        * html/ImageData.cpp:
+        (WebCore::ImageData::ImageData):
+        * html/ImageData.h:
+        (WebCore::ImageData::data):
+
+2009-01-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23391
+        Upstream plugins/chromium/
+
+        * plugins/chromium: Added.
+        * plugins/chromium/PluginDataChromium.cpp: Added.
+
+2009-01-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix Windows release build.
+        Move SVG files into all-in-one file for Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * svg/SVGAllInOne.cpp: Added.
+
+2009-01-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Partial build fix.
+        Move new derived sources into all-in-one DerivedSources.cpp
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::mark):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        (JSC::Bindings::QtConnectionObject::execute):
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Fix wx build.
+
+        * plugins/PluginView.cpp:
+        (WebCore::getString):
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Remove temporary operator-> from JSValuePtr.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        (WebCore::toVoidCallback):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::valueToStringWithNullCheck):
+        (WebCore::valueToStringWithUndefinedOrNullCheck):
+        (WebCore::reportException):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::findJSUnprotectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener):
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        (windowProtoFuncOpen):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::setTimeoutOrInterval):
+        (WebCore::JSDOMWindow::clearTimeout):
+        (WebCore::JSDOMWindow::clearInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        (WebCore::toDOMWindow):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        (WebCore::JSEventTargetNode::addEventListener):
+        (WebCore::JSEventTargetNode::removeEventListener):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::canGetItemsForName):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        (WebCore::writeHelper):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::setLength):
+        (WebCore::JSHTMLOptionsCollection::add):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        (WebCore::selectIndexSetter):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::mark):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::mark):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::asWrapper):
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::translate):
+        (WebCore::JSSVGMatrix::scale):
+        (WebCore::JSSVGMatrix::scaleNonUniform):
+        (WebCore::JSSVGMatrix::rotate):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        (WebCore::JSSVGMatrix::skewX):
+        (WebCore::JSSVGMatrix::skewY):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::customPut):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::isNull):
+        (WebCore::ScriptValue::isUndefined):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_HasMethod):
+        (_NPN_Construct):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::convertValueToJObject):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::callRuntimeConstructor):
+
+2009-01-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+         Reviewed by Mark Rowe.
+
+         https://bugs.webkit.org/show_bug.cgi?id=23419
+         removal of FramePrivate.h breaks GTK+'s make dist
+
+         * GNUmakefile.am: No longer mention FramePrivate.h in our build,
+         since it was removed.
+
+2009-01-20  Alexander V. Butenko  <alex@digiqube.com>
+
+        Reviewed by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=23116
+        [GTK] Fix crash due a callback called from GIO after the
+        destruction of the ResourceHandle
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::cancel): Only call didFinishLoading if
+        'client' is set, otherwise cancelling a load could lead to a crash.
+
+2009-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: remove duplicate entries in the Xcode project, and
+        sort the project with sort-Xcode-project-file .
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=18078
+
+        Support animations and transitions of shorthand properties by creating
+        PropertyWrappers that simply wrap a vector of atomic wrappers, and implement
+        equal() and blend(). Build that collection of shorthand wrappers using the
+        shorthand map that CSSMutableStyleDeclaration already has. Skip comparing these
+        shorthand wrappers during 'all' transitions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Add CSSPropertyLonghand.h/cpp.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removeShorthandProperty):
+        Move CSSPropertyLonghand to its own file.
+
+        * css/CSSPropertyLonghand.cpp: Added.
+        (WebCore::initShorthandMap):
+        (WebCore::longhandForProperty):
+        * css/CSSPropertyLonghand.h: Added.
+        (WebCore::CSSPropertyLonghand::CSSPropertyLonghand):
+        (WebCore::CSSPropertyLonghand::properties):
+        (WebCore::CSSPropertyLonghand::length):
+        Code moved from CSSMutableStyleDeclaration.h/cpp
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperBase::isShorthandWrapper):
+        (WebCore::ShorthandPropertyWrapper::ShorthandPropertyWrapper):
+        (WebCore::ShorthandPropertyWrapper::isShorthandWrapper):
+        (WebCore::ShorthandPropertyWrapper::equals):
+        (WebCore::ShorthandPropertyWrapper::blend):
+        Add a wrapper class for shorthand properties that simply wraps an
+        array of atomic property wrappers.
+
+        (WebCore::ensurePropertyMap):
+        (WebCore::addPropertyWrapper):
+        (WebCore::addShorthandProperties):
+        (WebCore::wrapperForProperty):
+        (WebCore::AnimationBase::propertiesEqual):
+        (WebCore::AnimationBase::getPropertyAtIndex):
+        Some minor refactoring to re-use wrapperForProperty(), and ensure that gPropertyWrapperMap
+        is filled with an invalid index (-1), not 0.
+
+        (WebCore::AnimationBase::blendProperties):
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        When doing 'all' transitions, skip shorthand wrappers, since 'all' transitions
+        just need to compare all the atomic property wrappers.
+
+2009-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Actually add the new header.
+
+        * dom/GenericWorkerTask.h: Added.
+
+2009-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22720
+
+        Provide a generic class to handle the pattern of task callbacks across worker/parent threads.  It
+        only works for methods that need 6 parameters but similar classes could be added as needed for
+        other numbers of parameters.
+
+        Add addMessage and resourceRetrievedByXMLHttpRequest to ScriptExecutionContext.
+
+        Use these methods and others to remove document() from XMLHttpRequest in a few more places.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Sorted project file while adding GenericWorkerTask.h
+
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::operator==):
+        (WebCore::ScriptString::operator!=):
+        Removed unnecessary JSLock.
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * dom/Document.h:
+        * dom/GenericWorkerTask.h: Added.
+        (WebCore::GenericWorkerTaskBase::GenericWorkerTaskBase):
+        (WebCore::GenericWorkerTaskBase::canPerformTask):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask6::GenericWorkerTask6):
+        (WebCore::GenericWorkerTask6::performTask):
+        (WebCore::createCallbackTask):
+        * dom/ScriptExecutionContext.h:
+        * dom/WorkerContext.cpp:
+        (WebCore::addMessageTask):
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::resourceRetrievedByXMLHttpRequest):
+        (WebCore::WorkerContext::postTaskToParentContext):
+        * dom/WorkerContext.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::postTaskToParentContext):
+        * dom/WorkerMessagingProxy.h:
+        * dom/WorkerThread.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::dropProtection):
+        (WebCore::reportUnsafeUsage):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::create):
+
+
+2009-01-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23422: AX: AXLinks should expose access key information
+        https://bugs.webkit.org/show_bug.cgi?id=23422
+
+        Test: accessibility/accesskey.html
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-01-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23417
+        Implement application cache obsolete state
+
+        Test: http/tests/appcache/remove-cache.html
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * dom/EventNames.h:
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::Status):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        * loader/appcache/DOMApplicationCache.idl:
+        Added "obsolete" event and status.
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::savedNewestCachePointer): Removed, there is no longer
+        any need to track what the newest cache was during teardown.
+        (WebCore::ApplicationCacheGroup::updateStatus): Renamed Status to UpdateStatus, reducing
+        confusion with cache group lifecycle status.
+        (WebCore::ApplicationCacheGroup::m_isObsolete): Added an obsolete state flag.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup): Initialize m_isObsolete.
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest): Assert that the returned cache does
+        not belong to an obsolete group.
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest): Ditto.
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader): Disassociation can now happen
+        via a JS swapCache() call, not only when the loader is destroyed.
+        (WebCore::ApplicationCacheGroup::cacheDestroyed): Don't track m_savedNewestCachePointer.
+        (WebCore::ApplicationCacheGroup::setNewestCache): Remove old newest cache from storage is
+        a caller responsibility, because this method is also used when loading caches from disk.
+        (WebCore::ApplicationCacheGroup::makeObsolete): Added. Mark the cache group as obsolete, and
+        inform cache storage, so that it could be removed.
+        (WebCore::ApplicationCacheGroup::didFailToLoadManifest): Removed, as all this method did
+        was call cacheUpdateFailed().
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Added a FIXME about correct failure
+        handing.
+        (WebCore::ApplicationCacheGroup::didFail): Ditto.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse): Call a new manifestNotFound()
+        method for 404 and 410 responses.
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest): Call cacheUpdateFailed()
+        directly, instead of the removed didFailToLoadManifest().
+        (WebCore::ApplicationCacheGroup::manifestNotFound): Implement "remove a cache" algorithm.
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Remove superceded cache from storage
+        after update successfully finishes (moved from setNewestCache()).
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache): Revive the group using
+        an explicitly passed pointer, without the need to save it during teardown.
+
+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::~DocumentLoader):
+        Call the general ApplicationCacheGroup::disassociateDocumentLoader() method.
+
+        * loader/appcache/ApplicationCacheStorage.h: Added a cacheGroupMadeObsolete() method, updated
+        some comments.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL): Assert that iterated caches are not
+        obsolete.
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL): Ditto.
+        (WebCore::ApplicationCacheStorage::cacheGroupDestroyed): Don't do anything for obsolete
+        groups, as they cannot be in storage.
+        (WebCore::ApplicationCacheStorage::cacheGroupMadeObsolete): Remove the cache group from storage
+        completely, so that a new one could replace it, if necessary.
+        (WebCore::ApplicationCacheStorage::storeNewestCache): Added assertions.
+        (WebCore::ApplicationCacheStorage::remove): Remove cache group if its newest cache is removed.
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::status): Added support for OBSOLETE state.
+        (WebCore::DOMApplicationCache::swapCache): Disassociate document loader from cache if the
+        application was removed server-side.
+        (WebCore::DOMApplicationCache::callObsoleteListener): Added support for obsolete event.
+
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::Status):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        Added support for OBSOLETE state and obsolete event.
+
+        * loader/appcache/DOMApplicationCache.idl: Ditto.
+
+2009-01-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Allow plug-in views to return an instance directly.
+
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+
+2009-01-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Hyatt.
+
+        AX: some buttons don't expose AXPress as an action
+        https://bugs.webkit.org/show_bug.cgi?id=23399
+
+        Test: accessibility/button-press-action.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+
+2009-01-19  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Copy headers from page/animation into
+        $WebKitOutputDir so that WebKit can access them.
+
+        * html/HTMLBaseFontElement.cpp: Touched this file to cause a rebuild
+        and header copy.
 
 2009-01-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
@@ -667,6 +50546,638 @@
         * platform/qt/RenderThemeQt.cpp:
         (WebCore::RenderThemeQt::applyTheme):
 
+2009-01-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        [Qt] Build fix after r39971.
+
+        * platform/qt/LoggingQt.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-01-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23415
+        Remove FramePrivate
+
+        Minor PLT speedup.
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::init):
+        (WebCore::Frame::loader):
+        (WebCore::Frame::view):
+        (WebCore::Frame::setView):
+        (WebCore::Frame::script):
+        (WebCore::Frame::document):
+        (WebCore::Frame::setDocument):
+        (WebCore::Frame::settings):
+        (WebCore::Frame::selection):
+        (WebCore::Frame::editor):
+        (WebCore::Frame::selectionGranularity):
+        (WebCore::Frame::setSelectionGranularity):
+        (WebCore::Frame::dragCaretController):
+        (WebCore::Frame::animation):
+        (WebCore::Frame::mark):
+        (WebCore::Frame::setMark):
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::clearCaretRectIfNeeded):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::caretBlinkTimerFired):
+        (WebCore::Frame::paintCaret):
+        (WebCore::Frame::paintDragCaret):
+        (WebCore::Frame::zoomFactor):
+        (WebCore::Frame::isZoomFactorTextOnly):
+        (WebCore::Frame::shouldApplyTextZoom):
+        (WebCore::Frame::shouldApplyPageZoom):
+        (WebCore::Frame::setZoomFactor):
+        (WebCore::Frame::setPrinting):
+        (WebCore::Frame::setJSStatusBarText):
+        (WebCore::Frame::setJSDefaultStatusBarText):
+        (WebCore::Frame::jsStatusBarText):
+        (WebCore::Frame::jsDefaultStatusBarText):
+        (WebCore::Frame::setNeedsReapplyStyles):
+        (WebCore::Frame::needsReapplyStyles):
+        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::isContentEditable):
+        (WebCore::Frame::updateSecureKeyboardEntryIfActive):
+        (WebCore::Frame::typingStyle):
+        (WebCore::Frame::setTypingStyle):
+        (WebCore::Frame::clearTypingStyle):
+        (WebCore::Frame::computeAndSetTypingStyle):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::applyEditingStyleToBodyElement):
+        (WebCore::Frame::removeEditingStyleFromBodyElement):
+        (WebCore::Frame::keepAlive):
+        (WebCore::Frame::cancelAllKeepAlive):
+        (WebCore::Frame::clearDOMWindow):
+        (WebCore::Frame::ownerElement):
+        (WebCore::Frame::ownerRenderer):
+        (WebCore::Frame::isDisconnected):
+        (WebCore::Frame::setIsDisconnected):
+        (WebCore::Frame::excludeFromTextSearch):
+        (WebCore::Frame::setExcludeFromTextSearch):
+        (WebCore::Frame::selectionBounds):
+        (WebCore::Frame::selectionTextRects):
+        (WebCore::Frame::isFrameSet):
+        (WebCore::Frame::currentForm):
+        (WebCore::Frame::forceLayout):
+        (WebCore::Frame::sendScrollEvent):
+        (WebCore::Frame::clearTimers):
+        (WebCore::Frame::styleForSelectionStart):
+        (WebCore::Frame::inViewSourceMode):
+        (WebCore::Frame::setInViewSourceMode):
+        (WebCore::Frame::markAllMatchesForText):
+        (WebCore::Frame::markedTextMatchesAreHighlighted):
+        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
+        (WebCore::Frame::tree):
+        (WebCore::Frame::setDOMWindow):
+        (WebCore::Frame::domWindow):
+        (WebCore::Frame::clearFormerDOMWindow):
+        (WebCore::Frame::page):
+        (WebCore::Frame::eventHandler):
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::disconnectOwnerElement):
+        (WebCore::Frame::documentAtPoint):
+        * page/Frame.h:
+        * page/FramePrivate.h: Removed.
+        * page/FrameTree.h:
+        * page/chromium/FrameChromium.cpp:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::imageFromRect):
+        (WebCore::Frame::selectionImage):
+        (WebCore::Frame::snapshotDragImage):
+        (WebCore::Frame::nodeImage):
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+        * page/qt/FrameQt.cpp:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+        * page/win/FrameCGWin.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/win/FrameWin.cpp:
+
+2009-01-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix for !ENABLE(VIDEO) following r40016.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::mouseEventIsInThumb):
+
+2009-01-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Optimize isTextNode() the same way isElementNode() was optimized in an earlier checkin.  isTextNode()
+        on Node is now non-virtual and just checks a bit that is set at construction time by Text.
+
+        Reviewed by Sam Weinig
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData):
+        * dom/CharacterData.h:
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::EventTargetNode):
+        * dom/EventTargetNode.h:
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        * dom/Node.h:
+        (WebCore::Node::isTextNode):
+        (WebCore::Node::isAttributeNode):
+        * dom/Text.cpp:
+        (WebCore::Text::Text):
+        * dom/Text.h:
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Change how backslashAsCurrencySymbol() works.  Instead of forcing call sites to do the direct
+        replacement themselves, the exact transformation is instead done by the encoding (indirectly through
+        a method on Document).
+
+        These changes allow the fast case (where no replacement is needed) checks to be completely inlined for
+        a slight speedup, and also allow encodings to do future alterations to displayed string content without
+        having to patch call sites again.
+
+        Reviewed by Oliver Hunt
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        * dom/Document.h:
+        (WebCore::Document::displayStringModifiedByEncoding):
+        (WebCore::Document::displayBufferModifiedByEncoding):
+        * editing/Editor.cpp:
+        (WebCore::Editor::addToKillRing):
+        * editing/TextIterator.cpp:
+        (WebCore::plainTextToMallocAllocatedBuffer):
+        (WebCore::plainText):
+        * editing/TextIterator.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::groupLabelText):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::text):
+        * loader/DocumentLoader.cpp:
+        (WebCore::canonicalizedTitle):
+        * page/Chrome.cpp:
+        (WebCore::displayString):
+        (WebCore::Chrome::runJavaScriptAlert):
+        (WebCore::Chrome::runJavaScriptConfirm):
+        (WebCore::Chrome::runJavaScriptPrompt):
+        (WebCore::Chrome::setStatusbarText):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::encode):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::TextEncoding):
+        * platform/text/TextEncoding.h:
+        (WebCore::TextEncoding::displayString):
+        (WebCore::TextEncoding::displayBuffer):
+        * rendering/HitTestResult.cpp:
+        (WebCore::displayString):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::setTextInternal):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::finishText):
+
+2009-01-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson
+
+        Complete <rdar://problem/6293969>
+
+        * DerivedSources.make: include mediaControlsQT.css for Mac build.
+
+        * WebCore.xcodeproj/project.pbxproj: add mediaControlsQT.css
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): add MediaTimelineContainerPart,
+        CSSValueMediaCurrentTimeDisplay, and CSSValueMediaTimeRemainingDisplay
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): include new media controller element styles
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): Ditto.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):  include new media
+        controller element styles
+
+        * css/CSSValueKeywords.in: add keywords for new media time display controls
+
+        * css/mediaControls.css: adjust css for new control elements
+
+        * css/mediaControlsQT.css: Added.
+
+        * platform/ThemeTypes.h:
+        (WebCore::): add media time display controls to ControlPart
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm: pass controller style to WKSI functions
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::MediaTextDisplayElement): Added
+        (WebCore::MediaTextDisplayElement::attachToParent): Added
+        (WebCore::MediaTextDisplayElement::update): Added
+        (WebCore::MediaTimeDisplayElement::MediaTimeDisplayElement): Added
+        (WebCore::MediaControlInputElement::MediaControlInputElement): Added
+        (WebCore::MediaControlInputElement::hitTest): Added
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Update the time display when
+        dragging the thumb
+        * rendering/MediaControlElements.h:
+        (WebCore::): Add MediaTextDisplayElement
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createTimelineContainer): Added
+        (WebCore::RenderMedia::createTimeline): Parent is now the timeline container
+        (WebCore::RenderMedia::createCurrentTimeDisplay): Added
+        (WebCore::RenderMedia::createTimeRemainingDisplay): Added
+        (WebCore::RenderMedia::updateControls): Create new elements. Don't ever start the time update
+        timer when the time display elements are not visible
+        (WebCore::RenderMedia::formatTime): Handle negative times. Don't display 0 hours or minutes
+        (WebCore::RenderMedia::updateTimeDisplay): Do nothing when the time display elements are not
+        visible. Display time remaining as well as current time.
+        (WebCore::RenderMedia::updateControlVisibility): Don't assume opacity should be set to 0 when
+        visibility changes
+        (WebCore::RenderMedia::forwardEvent): Call element hitTest() method instead of local function
+        as we can't assume that all controls are rectangular
+        * rendering/RenderMedia.h: Updated
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::mouseEventIsInThumb): When slider is media timeline control, call
+        element hitTest() method instead of assuming it is rectangular
+        * rendering/RenderSlider.h: make mouseEventIsInThumb virtual
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint): Deal with time display and timeline container
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaTimelineContainer): Updated
+        (WebCore::RenderTheme::paintMediaCurrentTime): Added
+        (WebCore::RenderTheme::paintMediaTimeRemaining): Added
+
+        * rendering/RenderThemeMac.h: Updated
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize): Call WebKitSystemInterface to get the thumb
+        size when appropriate
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton): pass controller style to render function
+        (WebCore::RenderThemeMac::paintMediaMuteButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSliderTrack): Ditto
+        (WebCore::RenderThemeMac::paintMediaSliderThumb): Ditto
+        (WebCore::RenderThemeMac::paintMediaTimelineContainer): Added
+        (WebCore::RenderThemeMac::paintMediaCurrentTime): Added
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining): Added
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet): Added
+        (WebCore::RenderThemeMac::hitTestMediaControlPart): Added
+        * rendering/style/RenderStyle.h: Updated
+        (WebCore::):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline a few methods in FrameView for speed.
+
+        Reviewed by Oliver Hunt
+
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        (WebCore::FrameView::layoutCount):
+        (WebCore::FrameView::needsFullRepaint):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline Document::documentElement(), since it is used by the (very hot) RenderObject::isRoot().  Split off
+        the code that fetches and caches the document element into a separate function and inline the part that
+        does the null check and the return of the already-cached element.
+
+        Reviewed by Oliver Hunt
+
+        * dom/Document.cpp:
+        (WebCore::Document::cacheDocumentElement):
+        * dom/Document.h:
+        (WebCore::Document::documentElement):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Minor tweaks to RenderBox::styleChange to speed it up.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline FrameLoader::client().
+
+        Reviewed by Oliver Hunt
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::client):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline some Image methods for speed.  Fix CachedImage's addClient method to just use isNull rather
+        than needlessly creating a rect.
+
+        Reviewed by Oliver Hunt
+
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::addClient):
+        * platform/graphics/Image.cpp:
+        * platform/graphics/Image.h:
+        (WebCore::Image::isNull):
+        (WebCore::Image::rect):
+        (WebCore::Image::width):
+        (WebCore::Image::height):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Avoid using the non-inlined isVariable() when adding parsed values during CSS parsing.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValueList::addValue):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline Document::inPageCache(), since - because of animation code - it is now called every time
+        styles change on any element and so is now super-hot.
+
+        Reviewed by Oliver Hunt
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+        (WebCore::Document::inPageCache):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Take Font out of the GraphicsContext.  Fonts are moderately expensive to both compare and to assign to.
+        The Font's presence in the GraphicsContext was making save/restore more expensive than it needed to be,
+        and was also causing expensive comparison checks to be made before doing alterations of the Font in the
+        GraphicsContext.
+
+        A font must now be passed as a parameter to all text drawing functions.
+
+        Reviewed by Oliver Hunt
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawText):
+        (WebCore::GraphicsContext::drawBidiText):
+        (WebCore::GraphicsContext::drawHighlightForText):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        (WebCore::SVGInlineTextBox::paintSelection):
+        * rendering/SVGInlineTextBox.h:
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix a regression from the virtualContinuation()/continuation() split where I accidentally changed
+        two if statements.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::absoluteQuads):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix a regression from my before/after optimization.  Make sure the <q> element puts the document
+        into a mode where it will respect before/after rules, since <q> implicitly uses such rules.
+
+        Make sure view source mode documents also turn on before/after rules, since they are used there also.
+
+        Reviewed by Oliver Hunt
+
+        * html/HTMLElementFactory.cpp:
+        (WebCore::quoteConstructor):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument):
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23397: AXURL is not reported for <INPUT type="image"> elements
+        https://bugs.webkit.org/show_bug.cgi?id=23397
+
+        Report an AXURL for inputs that have an image type.
+
+        Test: accessibility/input-image-url.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isInputImage):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isInputImage):
+        (WebCore::AccessibilityRenderObject::url):
+        * page/AccessibilityRenderObject.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-01-16  Adele Peterson  <adele@apple.com>
+
+        Windows build fix.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::logCanCachePageDecision):
+
+2009-01-16  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6502511> Safari crashes if it's running while the desktop theme is changed.
+
+        This was caused by mismatched ENABLE definitions across WebCore and WebKit.
+
+        Several virtual methods were added to RenderTheme.h, conditionalized by ENABLE(VIDEO).
+        In addition to adding ENABLE_VIDEO to WebKit, this change also adds ENABLE_DATABASE and ENABLE_ICONDATABASE
+        to Windows WebCore/WebKit, and adds ENABLE_WORKERS, and several ENABLE_SVG_ flags to WebKit on Windows.
+        Our Windows ENABLE flags now match Mac.
+
+        Reviewed by Adele Peterson.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-01-16  Mark Rowe  <mrowe@apple.com>
+
+        40,000!
+
+        * ChangeLog: Point out revision 40,000.
+
+2009-01-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Make surroundNodeRangeWithElement call insertNodeBefore implicitly
+        Make insertNodeBefore take PassRefPtr
+        Clean up the use of PassRefPtr vs. raw pointers a few places in the editing code.
+        https://bugs.webkit.org/show_bug.cgi?id=23389
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle):
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::IncreaseSelectionListLevelCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::removeNodePreservingChildren):
+        (WebCore::ReplacementFragment::insertNodeBefore):
+        (WebCore::ReplacementFragment::removeInterchangeNodes):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertNodeAfterAndUpdateNodesInserted):
+        (WebCore::ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted):
+        (WebCore::ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted):
+        * editing/ReplaceSelectionCommand.h:
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23393: TextField has AXTitle and AXTitleUIElement
+        https://bugs.webkit.org/show_bug.cgi?id=23393
+
+        Test: accessibility/double-title.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-01-16  Adam Treat  <adam.treat@torchmobile.com>
+
+        The correct build fix for all platforms.
+
+        * platform/graphics/Font.h:
+
+2009-01-16  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build.
+
+        * platform/graphics/Font.h:
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Add a new flag (similar to first-line and first-letter) to Document to track whether any before/after rules
+        are being used.  If not, don't waste time probing for those pseudo element styles.
+
+        Reviewed by Sam Weinig
+
+        * css/CSSGrammar.y:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::usesBeforeAfterRules):
+        (WebCore::Document::setUsesBeforeAfterRules):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildToFlow):
+        (WebCore::RenderInline::splitInlines):
+
+2009-01-16  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23394
+        Remove unnecessary calls to setDeferringTimers().
+
+        Use of this function was obsoleted by better handling of EINTR.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback): removed setDeferringTimers calls.
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix badness with the cursor CSS property.  For all links and form controls, resetting to a value of auto
+        was resulting in the creation of a cursor list.  clearCursorList was creating a new list rather than just
+        nulling out the pointer.  Since addCursor already lazily recreates the list, in the case of simple cursor types,
+        the clear method was wastefully creating a completely unnecessary list for all of these elements.
+
+        Also optimized the setting of simple cursor values to not alter the RenderStyle's cursor setting if it is already
+        set to the same value.  Since this is the common case, it prevents a fault and copy of StyleInheritedData for
+        all links and form controls.
+
+        This is a PLT speedup.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::clearCursorList):
+
+2009-01-16  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23384
+        PLATFORM(CHROMIUM) needs to delegate BackForwardList.cpp methods to the embedder
+
+        * history/BackForwardList.h:
+        (WebCore::BackForwardListClient::~BackForwardListClient):
+        (WebCore::BackForwardList::setClient):
+        * history/BackForwardListChromium.cpp: Added.
+
 2009-01-16  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Kevin Decker and Adam Roben.
@@ -677,6 +51188,305 @@
         * rendering/RenderPartObject.cpp:
         (WebCore::RenderPartObject::updateWidget): Added a null check.
 
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Split continuation() into virtual and non-virtual versions so that the non-virtual version can
+        be used whereever possible.  Eventually the virtual method can be eliminated completely.
+
+        Reviewed by Sam Weinig and Oliver Hunt
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::virtualContinuation):
+        (WebCore::RenderFlow::continuation):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::positionForCoordinates):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::absoluteQuads):
+        (WebCore::RenderObject::addFocusRingRects):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        (WebCore::RenderObject::hoverAncestor):
+        (WebCore::RenderObject::updateDragState):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::getTextDecorationColors):
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::virtualContinuation):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Inline the methods of Font for obtaining metrics such as ascent, descent and line spacing.
+
+        Reviewed by ggaren
+
+        * platform/graphics/Font.cpp:
+        * platform/graphics/Font.h:
+        (WebCore::Font::width):
+        (WebCore::Font::ascent):
+        (WebCore::Font::descent):
+        (WebCore::Font::lineSpacing):
+        (WebCore::Font::lineGap):
+        (WebCore::Font::xHeight):
+        (WebCore::Font::unitsPerEm):
+        (WebCore::Font::spaceWidth):
+
+2009-01-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23388
+        Remove FrameViewPrivate
+
+        Removes an indirection and is a small speedup on PLT.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::init):
+        (WebCore::FrameView::clear):
+        (WebCore::FrameView::didFirstLayout):
+        (WebCore::FrameView::initScrollbars):
+        (WebCore::FrameView::updateDefaultScrollbarState):
+        (WebCore::FrameView::setCanHaveScrollbars):
+        (WebCore::FrameView::applyOverflowToViewport):
+        (WebCore::FrameView::layoutCount):
+        (WebCore::FrameView::needsFullRepaint):
+        (WebCore::FrameView::layoutRoot):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::setMediaType):
+        (WebCore::FrameView::mediaType):
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::setUseSlowRepaints):
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        (WebCore::FrameView::scrollRectIntoViewRecursively):
+        (WebCore::FrameView::setScrollPosition):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::beginDeferredRepaints):
+        (WebCore::FrameView::endDeferredRepaints):
+        (WebCore::FrameView::scheduleRelayout):
+        (WebCore::FrameView::scheduleRelayoutOfSubtree):
+        (WebCore::FrameView::layoutPending):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::unscheduleRelayout):
+        (WebCore::FrameView::isTransparent):
+        (WebCore::FrameView::setTransparent):
+        (WebCore::FrameView::baseBackgroundColor):
+        (WebCore::FrameView::setBaseBackgroundColor):
+        (WebCore::FrameView::shouldUpdateWhileOffscreen):
+        (WebCore::FrameView::setShouldUpdateWhileOffscreen):
+        (WebCore::FrameView::scheduleEvent):
+        (WebCore::FrameView::pauseScheduledEvents):
+        (WebCore::FrameView::resumeScheduledEvents):
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::updateOverflowStatus):
+        (WebCore::FrameView::dispatchScheduledEvents):
+        (WebCore::FrameView::wasScrolledByUser):
+        (WebCore::FrameView::setWasScrolledByUser):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::setPaintRestriction):
+        (WebCore::FrameView::isPainting):
+        (WebCore::FrameView::setNodeToDraw):
+        * page/FrameView.h:
+        (WebCore::FrameView::setIsVisuallyNonEmpty): Inline.
+
+2009-01-14  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23237: Some HTML constructors in HTMLElementFactory needs
+        an HTMLFormElement argument
+
+        - Added 'constructorNeedsFormElement' parameter to make_names.pl to account
+          for HTML form elements.
+
+        - Added the new information to HTMLTagNames.in.
+
+        * dom/make_names.pl:
+        * html/HTMLTagNames.in:
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Eliminate a bunch of save/restore pairs from commonly used GraphicsContext methods.  The most common reason
+        for needing save/restore in the line-drawing methods was antialiasing, so this has now been made part of
+        the cross-platform graphics state.  By being able to query for the current antialiasing setting, antialiasing
+        can be temporarily changed and then restored back to the real value without needing to do a save/restore.
+
+        The line drawing code also set the fill color to the stroke color and relied on save/restore to prevent
+        a permanent mutation of the fill color in the CGContext.   The new code just restores the fill color back
+        to its original value without doing the much more expensive save/restore.
+
+        Reviewed by Oliver Hunt
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShouldAntialias):
+        (WebCore::GraphicsContext::shouldAntialias):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2009-01-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up the bridge code and get rid of Field::name() and Method::name().
+
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        * bridge/c/c_runtime.cpp:
+        * bridge/c/c_runtime.h:
+        (JSC::Bindings::CField::identifier):
+        (JSC::Bindings::CMethod::identifier):
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        (JavaMethod::methodID):
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaField::name):
+        (JSC::Bindings::JavaMethod::name):
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::methodsNamed):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcMethod::isFallbackMethod):
+        (JSC::Bindings::ObjcMethod::selector):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcMethod::ObjcMethod):
+        (JSC::Bindings::ObjcMethod::getMethodSignature):
+        (JSC::Bindings::ObjcField::ObjcField):
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime.h:
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Optimize RenderText::styleDidChange.  Don't call the base class, which does extra meaningless work.
+        Instead just do the one check we need to do (for a diff of layout) and mark dirty as appropriate.
+        Clean up the base class method also to just bail early if no m_parent is set instead of repeatedly checking
+        for the existence of m_parent in each if clause.
+
+        Reviewed by Darin Adler
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23387: AX hierarchy is incorrect when iframes are present
+        https://bugs.webkit.org/show_bug.cgi?id=23387
+
+        The AX hierarchy is incorrect when iframes are present.
+
+        Test: accessibility/iframe-bastardization.html
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper renderWidgetChildren]):
+
+2009-01-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/3541409> - Split up some back/forward cache decision making and add detailed logging to
+        better understand what the common disqualifiers are.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::canCachePage): Split off what will be per-frame decision making into canCacheSubframe.
+        (WebCore::FrameLoader::logCanCachePageDecision): Detailed logging about why a page may not be considered for
+          the back/forward cache.
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Same detailed logging on the per-frame basis.
+        (WebCore::FrameLoader::commitProvisionalLoad): Move the m_client->canCachePage() call into canCachePageContainingThisFrame().
+        * loader/FrameLoader.h:
+
+2009-01-16  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Test: transitions/hang-with-bad-transition-list.html
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=23088.
+        This was happening because I was calling setChanged() from inside updateRendering()
+        which causes an infinite loop. I fixed this by deferring the setChanged to the next
+        run loop iteration. That made it not infinite loop, but it still retriggers the
+        transition forever. The problem is that there is both an 'all' and specific transition
+        on 'opacity'. This tickled a bug in AnimationController which causes the opacity
+        transition to get constantly cancelled and then retriggered. The problem is that
+        the specific opacity transition has a duration of 0. I got rid of the logic to
+        flush out 0 duration transitions and it is no longer constantly triggered. The
+        logic to flush them was just an optimization, and you really need to keep them
+        around to make the logic to override earlier animations by later ones work. And there is
+        very little overhead in this case anyway, so the optimization was not that useful.
+
+        I made a LayoutTest from the original testcase which tests both the infinite
+        loop and constantly triggering animation cases.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateRenderingDispatcherFired):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationController::addNodeChangeToDispatch):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::adjustAnimations):
+        (WebCore::RenderStyle::adjustTransitions):
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 23385: crash at com.apple.WebCore  WebCore::HTMLAnchorElement::isKeyboardFocusable
+        https://bugs.webkit.org/show_bug.cgi?id=23385
+
+        Option-tabbing through the page mentioned in the bug causes a crash
+
+        Test: fast/events/tab-crash-with-image-map.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+
 2009-01-16  Thiago Macieira  <thiago.macieira@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -716,25 +51526,1002 @@
         * rendering/RenderPartObject.cpp:
         (WebCore::RenderPartObject::updateWidget):
 
-2009-01-09  Darin Adler  <darin@apple.com>
+2009-01-15  Chris Marrin  <cmarrin@apple.com>
 
-        Reviewed by Jon Honeycutt.
+        Reviewed by Sam Weinig.
 
-        Bug 22913: REGRESSION: Space bar doesn't scroll on windows
-        https://bugs.webkit.org/show_bug.cgi?id=22913
-        rdar://problem/6479834
+        Got rid of .idl file in Resources for bug https://bugs.webkit.org/show_bug.cgi?id=21421.
+        Also fixed the test case to work on ppc.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-01-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Another attempt at fixing the Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getInstance):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix for 1.85% PLT regression.  Since asking if a frame is "complete" actually aggressively decodes
+        the frame, we add an optimization when advancing animations.  If we have received all of the animated
+        image's data, then obviously we can go ahead and advance safely.  This prevents the first draw of an image
+        from decoding two frames' worth of data in the case where all of the image's data has been received.
+
+        While this fixes the cached case, there could in fact be a regression on the uncached PLT from this change
+        as well.  It's not immediately clear how that regression would be fixed, though, and it would likely be
+        a much smaller percentage of that overall uncached time.
+
+        Reviewed by Dan Bernstein
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
+
+2009-01-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23349
+        Don't store obsolete caches in disk storage
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::ResourceLoader):
+        (WebCore::ResourceLoader::load):
+        (WebCore::ResourceLoader::scheduleLoadFallbackResourceFromApplicationCache):
+        * loader/ResourceLoader.h:
+        Don't maintain m_wasLoadedFromApplicationCache, which was never used.
+
+        * loader/appcache/ApplicationCache.cpp: (WebCore::ApplicationCache::addResource):
+        Assert that only implicit and dynamic resources can be added after the cache has been fully
+        loaded and stored to disk database.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheDestroyed): Don't remove non-newest caches from disk
+        database, as this is now done whenever the cache becomes obsolete.
+        (WebCore::ApplicationCacheGroup::setNewestCache): Remove an obsolete cache from disk storage.
+
+        * loader/appcache/ApplicationCacheStorage.cpp: (WebCore::ApplicationCacheStorage::cacheGroupDestroyed):
+        A cache group that has never been saved should not be remembered in m_cacheHostSet. Changed
+        the check to no longer rely on savedNewestCachePointer.
+
+2009-01-15  Dimitri Dupuis-Latour  <dupuislatour@apple.com>
+
+        <rdar://problem/5870656> selectorText and cssText are clipped for :nth-child() and :nth-of-type();
+
+        Reviewed by Timothy Hatcher.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::selectorText):
+
+2009-01-15  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6444148> Styling a selection that ends in a line break can sometimes style what's after the break
+
+        If the range to style ended at [node, 0] or inside node (and if for some reason the node didn't get split),
+        applyInlineStyle would style node.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle): Rename pastLast to pastEndNode, since it doesn't come from
+        Range::pastLastNode() anymore.  pastEndNode is the node after the last one that is fully selected, since
+        the work done in the loop that follows should only be performed on fully selected nodes.
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply): Explicitly handle insertion into containers and after non-text nodes.
+        Those were handled accidently before.
+        * editing/htmlediting.cpp:
+        (WebCore::caretMaxOffset): In various places we call this with a container and expect to be given the number
+        of children in that container, so I changed it to match that.  RenderBR and RenderObject::caretMaxOffset() should
+        also be eliminated since maxDeepOffset handles non-text nodes.
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Get rid of the dreaded BindingLanguage once and for all. Also get rid of Instance::getInstance.
+
+        * bridge/c/c_instance.h:
+        * bridge/jni/jni_instance.h:
+        * bridge/objc/objc_instance.h:
+        * bridge/qt/qt_instance.h:
+        * bridge/runtime.cpp:
+        * bridge/runtime.h:
+        * bridge/runtime_object.h:
+
+2009-01-15  David Hyatt  <hyatt@apple.com>
+
+        Eliminate an extra virtual function call that occurs for every single RenderText by moving the SVG-specific
+        code that was placed into RenderText::styleDidChange into RenderSVGInlineText::styleDidChange.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Another attempt at fixing the Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getOwnPropertySlot):
+        (JSC::Bindings::QtInstance::put):
+        * bridge/qt/qt_instance.h:
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertySlot):
+        (JSC::Bindings::Instance::put):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::put):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add QtInstance::getInstance and start using it.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::mark):
+        (JSC::Bindings::QtRuntimeObjectImp::classInfo):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtInstance::getInstance):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add the ability for Instance objects to override getOwnPropertySlot/put for runtime objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getOwnPropertySlot):
+        (JSC::Bindings::QtInstance::put):
+        * bridge/qt/qt_instance.h:
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertySlot):
+        (JSC::Bindings::Instance::put):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::put):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Fix the QT build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::createRuntimeObject):
+        * bridge/qt/qt_instance.h:
+
+2009-01-15  David Hyatt  <hyatt@apple.com>
+
+        Fix for <rdar://problem/6500278> REGRESSION: 3.5% of samples on iBench in WebCore::Frame::setZoomFactor
+
+        setZoomFactor was supposed to bail if both the zoom factor and mode were the same.  The mode check was
+        buggy and doing the wrong thing.
+
+        Reviewed by Darin Adler
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setZoomFactor):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Instance::createRuntimeObject a virtual function and override it for QtInstance.
+
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::getRuntimeObject):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        (JavaArray::valueAt):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getRuntimeObject):
+        (JSC::Bindings::QtInstance::createRuntimeObject):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtConnectionObject::execute):
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        * bridge/runtime.h:
+
+2009-01-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23354
+        Fix up graphics/chromium files to account for Uniscribe style scrubbing.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillNonBMPGlyphs):
+
+2009-01-15  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23333
+        Adjust due to a name change that happened in a WebKit.
+
+        * svg/graphics/skia/SVGPaintServerPatternSkia.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-01-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23340
+        Add remaining bits of graphics/chromium.
+
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp: Added.
+        (WebCore::scaleEmToUnits):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/chromium/ThemeHelperChromiumWin.cpp: Added.
+        (WebCore::ThemeHelperWin::ThemeHelperWin):
+        (WebCore::ThemeHelperWin::~ThemeHelperWin):
+        * platform/graphics/chromium/ThemeHelperChromiumWin.h: Added.
+        (WebCore::ThemeHelperWin::):
+        (WebCore::ThemeHelperWin::context):
+        (WebCore::ThemeHelperWin::rect):
+        * platform/graphics/chromium/UniscribeHelper.cpp: Added.
+        (WebCore::treatAsSpace):
+        (WebCore::containsMissingGlyphs):
+        (WebCore::setLogFontAndStyle):
+        (WebCore::UniscribeHelper::UniscribeHelper):
+        (WebCore::UniscribeHelper::~UniscribeHelper):
+        (WebCore::UniscribeHelper::initWithOptionalLengthProtection):
+        (WebCore::UniscribeHelper::width):
+        (WebCore::UniscribeHelper::justify):
+        (WebCore::UniscribeHelper::characterToX):
+        (WebCore::UniscribeHelper::xToCharacter):
+        (WebCore::UniscribeHelper::draw):
+        (WebCore::UniscribeHelper::firstGlyphForCharacter):
+        (WebCore::UniscribeHelper::fillRuns):
+        (WebCore::UniscribeHelper::shape):
+        (WebCore::UniscribeHelper::fillShapes):
+        (WebCore::UniscribeHelper::fillScreenOrder):
+        (WebCore::UniscribeHelper::adjustSpaceAdvances):
+        (WebCore::UniscribeHelper::applySpacing):
+        (WebCore::UniscribeHelper::advanceForItem):
+        * platform/graphics/chromium/UniscribeHelper.h: Added.
+        (WebCore::UniscribeHelper::directionalOverride):
+        (WebCore::UniscribeHelper::setDirectionalOverride):
+        (WebCore::UniscribeHelper::inhibitLigate):
+        (WebCore::UniscribeHelper::setInhibitLigate):
+        (WebCore::UniscribeHelper::letterSpacing):
+        (WebCore::UniscribeHelper::setLetterSpacing):
+        (WebCore::UniscribeHelper::spaceWidth):
+        (WebCore::UniscribeHelper::setSpaceWidth):
+        (WebCore::UniscribeHelper::wordSpacing):
+        (WebCore::UniscribeHelper::setWordSpacing):
+        (WebCore::UniscribeHelper::setAscent):
+        (WebCore::UniscribeHelper::init):
+        (WebCore::UniscribeHelper::tryToPreloadFont):
+        (WebCore::UniscribeHelper::Shaping::Shaping):
+        (WebCore::UniscribeHelper::Shaping::glyphLength):
+        (WebCore::UniscribeHelper::Shaping::charLength):
+        (WebCore::UniscribeHelper::Shaping::effectiveAdvances):
+        (WebCore::UniscribeHelper::nextWinFontData):
+        (WebCore::UniscribeHelper::resetFontIndex):
+        * platform/graphics/chromium/UniscribeHelperTextRun.cpp: Added.
+        (WebCore::UniscribeHelperTextRun::UniscribeHelperTextRun):
+        (WebCore::UniscribeHelperTextRun::tryToPreloadFont):
+        (WebCore::UniscribeHelperTextRun::nextWinFontData):
+        (WebCore::UniscribeHelperTextRun::resetFontIndex):
+        * platform/graphics/chromium/UniscribeHelperTextRun.h: Added.
+
+2009-01-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed Windows project file after https://bugs.webkit.org/show_bug.cgi?id=21421
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-01-15  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15279
+        Right clicking over text (or multiple spaces) auto selects the word
+        (or multiple spaces) under it, which is not a desirable effect for some
+        platforms.
 
         * page/EventHandler.cpp:
-        (WebCore::EventHandler::defaultKeyboardEventHandler): Added code to call
-        defaultSpaceEventHandler.
-        (WebCore::EventHandler::defaultSpaceEventHandler): Added. Scrolls down or up based
-        on the shift key.
-        * page/EventHandler.h: Added defaultSpaceEventHandler.
+        (WebCore::EventHandler::sendContextMenuEvent):
+        Don't select words on right-click on Chromium.
 
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformScroll): Return false, because this function does
-        not scroll. In an earlier version of this patch, I used this to prevent the
-        patch from affecting the Mac, but I decided to use #if instead.
+2009-01-15  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23345
+        SharedBuffer.h should include wtf/OwnPtr.h
+
+        * platform/SharedBuffer.h:
+
+2009-01-14  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23338: Make "Streamline Inspector Source" build script check for a directory before using it
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23338>
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCore.xcodeproj/project.pbxproj: Check to see if
+        "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+        exists before trying to change directories into it and then
+        deleting, modifying and adding files to it.
+
+2009-01-14  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Fixing wx compilation for wx 2.9/trunk.
+
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::computeHash):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::contains):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+
+2009-01-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding WebKitCSSMatrix.
+
+        * WebCoreSources.bkl:
+
+2009-01-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for Qt following r39922.
+
+        * WebCore.pro:
+
+2009-01-14  Darin Adler  <darin@apple.com>
+
+        Fix debug build.
+
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        Use ASSERT_UNUSED.
+
+2009-01-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23335
+        <rdar://problem/6247650> Update <input type="search"> for RenderThemeWin
+
+        No new tests added.  In the future, we need to update DumpRenderTree to be able to run with different RenderThemes and
+        we'll need a separate set of results for different themes.
+
+        * css/themeWin.css: Renable search fields.  Added new rules for sub-element placement.
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::textBlockWidth): Consider margin set on the sub-elements when computing the
+        desired width for the text block.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::supportsFocus): Treat SearchFieldPart the same as TextFieldPart.
+        (WebCore::RenderThemeWin::determineState): ditto.
+        (WebCore::RenderThemeWin::getClassicThemeData): ditto.
+        (WebCore::RenderThemeWin::getThemeData): ditto.
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton): Draw a scaled, vertically centered, version of the new artwork.
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration): ditto.
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton): ditto.
+        (WebCore::RenderThemeWin::adjustSearchFieldCancelButtonStyle): Set the scaled width and height.
+        (WebCore::RenderThemeWin::adjustSearchFieldResultsDecorationStyle): ditto.
+        (WebCore::RenderThemeWin::adjustSearchFieldResultsButtonStyle): ditto.
+
+2009-01-14  Alp Toker  <alp@nuanti.com>
+
+        GTK+ build fix following r39922.
+        Add WebKitCSSMatrix to the build system.
+
+        * GNUmakefile.am:
+
+2009-01-14  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implemented 2D WebKitCSSMatrix
+        https://bugs.webkit.org/show_bug.cgi?id=21421
+
+        Test: transforms/2d/cssmatrix-interface.xhtml
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseWebKitCSSMatrix):
+        (setJSDOMWindowBaseWebKitCSSMatrix):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        (WebCore::constructWebKitCSSMatrix):
+        (WebCore::JSWebKitCSSMatrixConstructor::getConstructData):
+        * bindings/js/JSWebKitCSSMatrixConstructor.h: Added.
+        (WebCore::JSWebKitCSSMatrixConstructor::classInfo):
+        * bindings/objc/DOMInternal.h:
+        * css/WebKitCSSMatrix.cpp: Added.
+        (WebCore::WebKitCSSMatrix::WebKitCSSMatrix):
+        (WebCore::WebKitCSSMatrix::~WebKitCSSMatrix):
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        (WebCore::WebKitCSSMatrix::multiply):
+        (WebCore::WebKitCSSMatrix::inverse):
+        (WebCore::WebKitCSSMatrix::translate):
+        (WebCore::WebKitCSSMatrix::scale):
+        (WebCore::WebKitCSSMatrix::rotate):
+        (WebCore::WebKitCSSMatrix::toString):
+        * css/WebKitCSSMatrix.h: Added.
+        (WebCore::WebKitCSSMatrix::create):
+        (WebCore::WebKitCSSMatrix::a):
+        (WebCore::WebKitCSSMatrix::b):
+        (WebCore::WebKitCSSMatrix::c):
+        (WebCore::WebKitCSSMatrix::d):
+        (WebCore::WebKitCSSMatrix::e):
+        (WebCore::WebKitCSSMatrix::f):
+        (WebCore::WebKitCSSMatrix::setA):
+        (WebCore::WebKitCSSMatrix::setB):
+        (WebCore::WebKitCSSMatrix::setC):
+        (WebCore::WebKitCSSMatrix::setD):
+        (WebCore::WebKitCSSMatrix::setE):
+        (WebCore::WebKitCSSMatrix::setF):
+        (WebCore::WebKitCSSMatrix::transform):
+        * css/WebKitCSSMatrix.idl: Added.
+
+2009-01-14  Michael Moss  <mmoss@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Workaround a skia limitation on repeated patterns, and remove extra
+        transformations applied to pattern.
+        https://bugs.webkit.org/show_bug.cgi?id=23332
+
+        Fixes:
+        LayoutTests/fast/canvas/patternfill-repeat.html
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-06-b.svg
+
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-01-14  Mark Rowe  <mrowe@apple.com>
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=23334
+        Bug 23334: Compile failure in XMLTokenizerLibxml2.cpp
+
+        Include wtf/UnusedParam.h to get UNUSED_PARAM.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::hackAroundLibXMLEntityBug):
+
+2009-01-14  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23333
+        Platform code fixes. These compensate for changes in platform
+        callbacks from WebKit and minor API tweaks.
+
+        I enumerated a few below.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        fontExists has been gone since r34794.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+
+        (WebCore::FrameData::clear):
+        r39751 changes this api to take and return a bool.
+
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::apply):
+        (WebCore::boundingBoxForCurrentStroke):
+        (WebCore::Path::strokeContains):
+        * svg/graphics/skia/RenderPathSkia.cpp: Removed due to r39805.
+
+2009-01-14  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=16829>
+        Implement NPN_SetException()
+
+        This mirrors the implementation in the obj-c bindings.
+
+        Test: plugins/netscape-throw-exception.html
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::getExceptionString):
+        (JSC::Bindings::CInstance::setGlobalException):
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_instance.h:
+
+2009-01-14  Pierre-Olivier Latour  <pol@apple.com>
+
+        Fixed build warning when LIBXML_VERSION >= 20627.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::hackAroundLibXMLEntityBug):
+
+2009-01-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23326
+        Resources are never deleted from application cache disk database
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase): Create a trigger that deletes resources when
+        a cache is deleted. Note that this change doesn't require bumping schema version. We should
+        consider switching to foreign keys and cascade delete instead of triggers in the future.
+        (WebCore::ApplicationCacheStorage::remove): Added a comment explaining why it's sufficient
+        to only remove the cache itself.
+        (WebCore::ApplicationCacheStorage::empty): Don't delete from CacheResources, now that this
+        is done automatically when a cache is deleted.
+
+2009-01-14  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22795: favicons should be saved to webarchives
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22795>
+
+        Reviewed by Darin Adler.
+
+        Test: webarchive/test-link-rel-icon.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs): Do not add
+        favicon URLs to the list since no ArchiveResource or CachedResource
+        is ever created for them.
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Handle favicons as a special
+        case for all main resources.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::close): Actually close the SQLite database
+        so that isOpen() returns false when called.  Added an ASSERT() for
+        good measure.
+
+2009-01-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23321
+        Upstream more bits of graphics/chromium.
+
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::RefCountedHFONT::~RefCountedHFONT):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        (WebCore::FontPlatformData::scriptFontProperties):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h: Added.
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::scriptCache):
+        (WebCore::FontPlatformData::RefCountedHFONT::create):
+        (WebCore::FontPlatformData::RefCountedHFONT::hfont):
+        (WebCore::FontPlatformData::RefCountedHFONT::hash):
+        (WebCore::FontPlatformData::RefCountedHFONT::operator==):
+        (WebCore::FontPlatformData::RefCountedHFONT::RefCountedHFONT):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::setupPaint):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isFixedPitch):
+        * platform/graphics/chromium/FontPlatformDataLinux.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp: Added.
+        (WebCore::):
+        (WebCore::FontMap::getAscent):
+        (WebCore::FontMap::FontData::FontData):
+        (WebCore::getFontFamilyForScript):
+        (WebCore::getFallbackFamily):
+        (WebCore::getDerivedFontData):
+        (WebCore::getStyleFromLogfont):
+        * platform/graphics/chromium/FontUtilsChromiumWin.h: Added.
+        (WebCore::):
+
+2009-01-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23325
+        Upstream even more graphics/chromium bits.
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp: Added.
+        (WebCore::fillEmptyGlyphs):
+        (WebCore::initSpaceGlyph):
+        (WebCore::fillBMPGlyphs):
+        (WebCore::fillNonBMPGlyphs):
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/chromium/GlyphPageTreeNodeLinux.cpp: Added.
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/chromium/IconChromiumLinux.cpp: Added.
+        (WebCore::Icon::Icon):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/chromium/IconChromiumMac.cpp: Added.
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::paint):
+        * platform/graphics/chromium/IconChromiumWin.cpp: Added.
+        (WebCore::Icon::Icon):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/chromium/ImageBufferData.h: Added.
+        * platform/graphics/chromium/ImageChromiumMac.mm: Added.
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: Added.
+        * platform/graphics/chromium/PlatformIcon.h: Added.
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23328
+        Upstream remaining files from platform/chromium/
+
+        * platform/chromium/CursorChromium.cpp:
+        (WebCore::pointerCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::middlePanningCursor):
+        (WebCore::eastPanningCursor):
+        (WebCore::northPanningCursor):
+        (WebCore::northEastPanningCursor):
+        (WebCore::northWestPanningCursor):
+        (WebCore::southPanningCursor):
+        (WebCore::southEastPanningCursor):
+        (WebCore::southWestPanningCursor):
+        (WebCore::westPanningCursor):
+        (WebCore::moveCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::aliasCursor):
+        (WebCore::progressCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        * platform/chromium/DragDataRef.h: Added.
+        * platform/chromium/DragImageChromium.cpp: Added.
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::dissolveDragImageToFraction):
+        (WebCore::createDragImageFromImage):
+        (WebCore::createDragImageIconForCachedImage):
+        * platform/chromium/DragImageRef.h:
+        * platform/chromium/KeyCodeConversion.h: Added.
+        * platform/chromium/KeyCodeConversionGtk.cpp: Added.
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/chromium/KeyboardCodes.h: Added.
+        * platform/chromium/KeyboardCodesPosix.h: Added.
+        (WebCore::):
+        * platform/chromium/KeyboardCodesWin.h: Added.
+        (WebCore::):
+        * platform/chromium/Language.cpp: Added.
+        (WebCore::defaultLanguage):
+        * platform/chromium/LinkHashChromium.cpp: Added.
+        (WebCore::visitedLinkHash):
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+        * platform/chromium/PasteboardChromium.cpp: Added.
+        (WebCore::Pasteboard::generalPasteboard):
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::clear):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        * platform/chromium/PlatformCursor.h: Added.
+        (WebCore::PlatformCursor::):
+        (WebCore::PlatformCursor::PlatformCursor):
+        (WebCore::PlatformCursor::customImage):
+        (WebCore::PlatformCursor::hotSpot):
+        (WebCore::PlatformCursor::type):
+        * platform/chromium/PlatformKeyboardEventChromium.cpp: Added.
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/chromium/PlatformScreenChromium.cpp: Added.
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/chromium/PlatformWidget.h:
+        * platform/chromium/PopupMenuChromium.cpp: Added.
+        (WebCore::PopupListBox::selectedIndex):
+        (WebCore::PopupListBox::numItems):
+        (WebCore::PopupListBox::setBaseWidth):
+        (WebCore::PopupListBox::setTextOnIndexChange):
+        (WebCore::PopupListBox::setAcceptOnAbandon):
+        (WebCore::PopupListBox::):
+        (WebCore::PopupListBox::ListItem::ListItem):
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupListBox::~PopupListBox):
+        (WebCore::PopupListBox::disconnectClient):
+        (WebCore::PopupListBox::scrollToRevealSelection):
+        (WebCore::constructRelativeMouseEvent):
+        (WebCore::constructRelativeWheelEvent):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupContainer::layout):
+        (WebCore::PopupContainer::handleMouseDownEvent):
+        (WebCore::PopupContainer::handleMouseMoveEvent):
+        (WebCore::PopupContainer::handleMouseReleaseEvent):
+        (WebCore::PopupContainer::handleWheelEvent):
+        (WebCore::PopupContainer::handleKeyEvent):
+        (WebCore::PopupContainer::hide):
+        (WebCore::PopupContainer::paint):
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupContainer::isInterestedInEventForKey):
+        (WebCore::PopupContainer::show):
+        (WebCore::PopupContainer::setTextOnIndexChange):
+        (WebCore::PopupContainer::setAcceptOnAbandon):
+        (WebCore::PopupContainer::refresh):
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        (WebCore::PopupListBox::handleMouseReleaseEvent):
+        (WebCore::PopupListBox::handleWheelEvent):
+        (WebCore::PopupListBox::isInterestedInEventForKey):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::hostWindow):
+        (WebCore::PopupListBox::invalidateRect):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::PopupListBox::typeAheadFind):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::getRowFont):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::pointToRowIndex):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::setOriginalIndex):
+        (WebCore::PopupListBox::getRowHeight):
+        (WebCore::PopupListBox::getRowBounds):
+        (WebCore::PopupListBox::invalidateRow):
+        (WebCore::PopupListBox::scrollToRevealRow):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::adjustSelectedIndex):
+        (WebCore::PopupListBox::updateFromElement):
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupListBox::clear):
+        (WebCore::PopupListBox::isPointInBounds):
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::updateFromElement):
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+        * platform/chromium/PopupMenuChromium.h: Added.
+        (WebCore::PopupContainer::listBox):
+        * platform/chromium/PopupMenuPrivate.h: Added.
+        * platform/chromium/SSLKeyGeneratorChromium.cpp: Added.
+        (WebCore::supportedKeySizes):
+        * platform/chromium/ScrollbarThemeChromium.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromium::ScrollbarThemeChromium):
+        (WebCore::ScrollbarThemeChromium::~ScrollbarThemeChromium):
+        (WebCore::ScrollbarThemeChromium::themeChanged):
+        (WebCore::ScrollbarThemeChromium::hasThumb):
+        (WebCore::ScrollbarThemeChromium::backButtonRect):
+        (WebCore::ScrollbarThemeChromium::forwardButtonRect):
+        (WebCore::ScrollbarThemeChromium::trackRect):
+        (WebCore::ScrollbarThemeChromium::paintTrackBackground):
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        (WebCore::ScrollbarThemeChromium::paintScrollCorner):
+        (WebCore::ScrollbarThemeChromium::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromium::buttonSize):
+        * platform/chromium/ScrollbarThemeChromium.h: Added.
+        (WebCore::ScrollbarThemeChromium::hasButtons):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp: Added.
+        (WebCore::ScrollbarThemeChromium::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromium::invalidateOnMouseEnterExit):
+        (WebCore::initMozState):
+        (WebCore::paintScrollbarWidget):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintButton):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        * platform/chromium/SearchPopupMenuChromium.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::enabled):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/chromium/SharedTimerChromium.cpp: Added.
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/chromium/TemporaryLinkStubs.cpp: Added.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23323
+        Upstream platform/text/chromium/
+
+        * platform/text/chromium: Added.
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp: Added.
+        (WebCore::currentTextBreakLocaleID):
+
+2009-01-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Update copyright year in version resources.
+
+        Reviewed by Adam Roben.
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23324
+        Move platform/chromium/EditorChromium.cpp into editing/chromium/
+
+        * editing/chromium: Added.
+        * editing/chromium/EditorChromium.cpp: Copied from platform/chromium/EditorChromium.cpp.
+        * platform/chromium/EditorChromium.cpp: Removed.
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23320
+        Make it possible to use notImplemented outside of the WebCore namespace
+
+        * platform/NotImplemented.h:
+
+2009-01-14  Nigel Tao  <nigel.tao.gnome@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=22476
+        Check that the document's SecurityOrigin canLoadLocalResources,
+        when pages try to put NSFilenamesPboardtype data on the clipboard,
+        by calling event.dataTransfer.setData('URL', 'file:///foo/bar');
+
+        Tests: http/tests/security/dataTransfer-set-data-file-url.html
+               platform/mac/editing/pasteboard/dataTransfer-set-data-file-url.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::setData):
+
+2009-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - update copyright
+
+        * Info.plist:
+
+2009-01-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23316
+        Application cache updating always fails with an assertion
+
+        Test: http/tests/appcache/update-cache.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::documentLoaderDestroyed): Correctly handle the case where
+        multiple caches survive the last DocumentLoader destruction, preventing a crash in release
+        builds.
+        (WebCore::ApplicationCacheGroup::setNewestCache): Removed a bogus assertion.
 
 2009-01-14  Alexey Proskuryakov  <ap@webkit.org>
 
@@ -771,6 +52558,105 @@
 
         * loader/appcache/ApplicationCacheStorage.h: Added storeUpdatedType().
 
+2009-01-13  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger WebCore build after r39880.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markBadGrammar):
+        * loader/mac/DocumentLoaderMac.cpp:
+        (WebCore::DocumentLoader::schedule):
+        (WebCore::DocumentLoader::unschedule):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCFinalizeOnMainThread):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::schedule):
+        (WebCore::ResourceHandle::unschedule):
+
+2009-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Last step: Turn on the warning and fix the last few instances.
+
+        * Configurations/Base.xcconfig: Removed -Wno-unused-parameter from
+        WARNING_CFLAGS_BASE, so the unused parameter warning will fire.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseMessageChannel): Separate the version for use when
+        CHANNEL_MESSAGING is turned off, so we can omit the argument names.
+        It would be better to not even have this property in that case,
+        rather than having the function return undefined, but I don't know
+        how to do that with the bindings script.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Leave out argument names in
+        functions where they're not used (the SVG context, and the property
+        name in the index getter). Use UNUSED_PARAM where arguments are
+        sometimes not used.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::put): Use UNUSED_PARAM for non-QT.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::animationMediaFeatureEval): Omit argument names for style and frame.
+        (WebCore::transitionMediaFeatureEval): Ditto.
+        (WebCore::transform_2dMediaFeatureEval): Ditto.
+        (WebCore::transform_3dMediaFeatureEval): Ditto.
+
+        * dom/make_names.pl: Leave out the createdByParser property name in
+        cases where it's not used.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused): Separate the
+        version for the Mac platform so we can omit the argument names.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::contentsSizeChanged): Removed argument name.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldUsePluginDocument): Commented out
+        argument name.
+
+        * loader/icon/IconFetcher.cpp:
+        (WebCore::IconFetcher::didReceiveResponse): Use ASSERT_UNUSED.
+        (WebCore::IconFetcher::didReceiveData): Ditto.
+        (WebCore::IconFetcher::didFinishLoading): Ditto.
+        (WebCore::IconFetcher::didFail): Ditto.
+
+        * platform/KURL.cpp:
+        (WebCore::assertProtocolIsGood): Separate out the NDEBUG version so
+        we can omit the argument names.
+
+        * platform/Timer.cpp:
+        (WebCore::TimerHeapIterator::checkConsistency): Use ASSERT_UNUSED.
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::offsetAt): Use UNUSED_PARAM in the non-WIN case.
+        (WebCore::GlyphBuffer::add): Use UNUSED_PARAM in the non-CAIRO case.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear): Removed argument name.
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::prepareToRenderSVGContent): Use UNUSED_PARAM when SVG_FILTERS
+        is not enabled.
+        (WebCore::finishRenderSVGContent): Ditto.
+
+2009-01-13  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implemented https://bugs.webkit.org/show_bug.cgi?id=23298
+        Simple fix to convertToLength to catch style==null cases
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength):
+
 2009-01-13  Eric Seidel  <eric@webkit.org>
 
         Reviewed by Mark Rowe.
@@ -781,6 +52667,39 @@
         * bindings/js/JSSVGPODTypeWrapper.h:
         (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
 
+2009-01-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Land portions of platform/graphics/chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=23297
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::EOTStream::EOTStream):
+        (WebCore::EOTStream::read):
+        (WebCore::readEmbedProc):
+        (WebCore::createUniqueFontName):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/chromium/FontLinux.cpp: Added.
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/FontPlatformData.h: Added.
+
+2009-01-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Don't copy DOMStringList.idl into the framework bundle.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
 2009-01-13  Christian Dywan  <christian@twotoasts.de>
 
         Build fix, StorageEvent is only defined if we have DOM_STORAGE
@@ -813,19 +52732,222 @@
         keydown event. Without the change above, making this change would have restored the old
         behavior, reintroducing bug 22913 where the space bar doesn't scroll at all on Windows.
 
-2009-01-12  Robert Blaut  <webkit@blaut.biz>
+2009-01-13  Darin Fisher  <darin@chromium.org>
 
-        Reviewed by Darin Adler
+        Reviewed by Eric Seidel.
 
-        Fix for <https://bugs.webkit.org/show_bug.cgi?id=22096>
-        Bug 22096: REGRESSION (r35879) scrolldelay is counted in seconds 
-        instead of miliseconds
+        Landing portions of platform/chromium/, taken from here:
+        http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/WebKit/WebCore/platform/chromium/
+
+        * platform/chromium/ChromiumBridge.h: Added.
+        * platform/chromium/ChromiumDataObject.cpp: Added.
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        * platform/chromium/ChromiumDataObject.h: Added.
+        (WebCore::ChromiumDataObject::create):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp: Added.
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::ClipboardChromium):
+        (WebCore::ClipboardChromium::create):
+        (WebCore::ClipboardChromium::clearData):
+        (WebCore::ClipboardChromium::clearAllData):
+        (WebCore::ClipboardChromium::getData):
+        (WebCore::ClipboardChromium::setData):
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::setDragImage):
+        (WebCore::ClipboardChromium::setDragImageElement):
+        (WebCore::ClipboardChromium::createDragImage):
+        (WebCore::imageToMarkup):
+        (WebCore::getCachedImage):
+        (WebCore::writeImageToDataObject):
+        (WebCore::ClipboardChromium::declareAndWriteDragImage):
+        (WebCore::ClipboardChromium::writeURL):
+        (WebCore::ClipboardChromium::writeRange):
+        (WebCore::ClipboardChromium::hasData):
+        * platform/chromium/ClipboardChromium.h: Added.
+        (WebCore::ClipboardChromium::~ClipboardChromium):
+        (WebCore::ClipboardChromium::dataObject):
+        * platform/chromium/ClipboardUtilitiesChromium.cpp: Added.
+        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
+        (WebCore::replaceNBSPWithSpace):
+        (WebCore::urlToMarkup):
+        * platform/chromium/ClipboardUtilitiesChromium.h: Added.
+        * platform/chromium/ContextMenuChromium.cpp: Added.
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::~ContextMenu):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemWithAction):
+        (WebCore::ContextMenu::itemAtIndex):
+        (WebCore::ContextMenu::setPlatformDescription):
+        (WebCore::ContextMenu::platformDescription):
+        (WebCore::ContextMenu::releasePlatformDescription):
+        * platform/chromium/ContextMenuItemChromium.cpp: Added.
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::~ContextMenuItem):
+        (WebCore::ContextMenuItem::releasePlatformDescription):
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::platformSubMenu):
+        (WebCore::ContextMenuItem::setType):
+        (WebCore::ContextMenuItem::setAction):
+        (WebCore::ContextMenuItem::setTitle):
+        (WebCore::ContextMenuItem::setSubMenu):
+        (WebCore::ContextMenuItem::setChecked):
+        (WebCore::ContextMenuItem::setEnabled):
+        (WebCore::ContextMenuItem::enabled):
+        * platform/chromium/CursorChromium.cpp: Added.
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::~Cursor):
+        (WebCore::Cursor::operator=):
+        (WebCore::pointerCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::middlePanningCursor):
+        (WebCore::eastPanningCursor):
+        (WebCore::northPanningCursor):
+        (WebCore::northEastPanningCursor):
+        (WebCore::northWestPanningCursor):
+        (WebCore::southPanningCursor):
+        (WebCore::southEastPanningCursor):
+        (WebCore::southWestPanningCursor):
+        (WebCore::westPanningCursor):
+        (WebCore::moveCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::aliasCursor):
+        (WebCore::progressCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+        * platform/chromium/DragDataChromium.cpp: Added.
+        (WebCore::containsHTML):
+        (WebCore::DragData::createClipboard):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::containsColor):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::asFragment):
+        (WebCore::DragData::asColor):
+        * platform/chromium/EditorChromium.cpp: Added.
+        (WebCore::Editor::newGeneralClipboard):
+        * platform/chromium/FileChooserChromium.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/chromium/FileSystemChromium.cpp: Added.
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::directoryName):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::makeAllDirectories):
+        (WebCore::fileExists):
+        * platform/chromium/FileSystemChromiumLinux.cpp: Added.
+        (WebCore::pathGetFileName):
+        * platform/chromium/FileSystemChromiumMac.mm: Added.
+        (WebCore::pathGetFileName):
+        * platform/chromium/FileSystemChromiumWin.cpp: Added.
+        (WebCore::pathGetFileName):
+        * platform/chromium/FramelessScrollView.cpp: Added.
+        (WebCore::FramelessScrollView::~FramelessScrollView):
+        (WebCore::FramelessScrollView::invalidateScrollbarRect):
+        (WebCore::FramelessScrollView::isActive):
+        (WebCore::FramelessScrollView::invalidateRect):
+        (WebCore::FramelessScrollView::hostWindow):
+        (WebCore::FramelessScrollView::windowClipRect):
+        (WebCore::FramelessScrollView::paintContents):
+        (WebCore::FramelessScrollView::contentsResized):
+        (WebCore::FramelessScrollView::visibleContentsResized):
+        * platform/chromium/FramelessScrollView.h: Added.
+        (WebCore::FramelessScrollView::FramelessScrollView):
+        (WebCore::FramelessScrollView::client):
+        (WebCore::FramelessScrollView::setClient):
+        * platform/chromium/FramelessScrollViewClient.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp: Added.
+        (WebCore::):
+        (WebCore::ScrollbarThemeChromium::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromium::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintButton):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+        (WebCore::ScrollbarThemeChromium::getThemeState):
+        (WebCore::ScrollbarThemeChromium::getThemeArrowState):
+        (WebCore::ScrollbarThemeChromium::getClassicThemeState):
+        * platform/chromium/SoundChromiumPosix.cpp: Added.
+        (WebCore::systemBeep):
+        * platform/chromium/SoundChromiumWin.cpp: Added.
+        (WebCore::systemBeep):
+        * platform/chromium/SystemTimeChromium.cpp: Added.
+        (WebCore::currentTime):
+        (WebCore::userIdleTime):
+        * platform/chromium/WidgetChromium.cpp: Added.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        * platform/chromium/WindowsVersion.cpp: Added.
+        (WebCore::isVistaOrNewer):
+        * platform/chromium/WindowsVersion.h: Added.
 
-        Test: fast/css/webkit-marquee-speed-unit-in-quirksmode.html
+2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit): treat unitless values in quirks mode 
-        as miliseconds instead of seconds.
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make sure media elements dispatch the 'loaded' event
+
+        We assume that when Phonon goes into paused state that we have the
+        complete media file. Once we do media loading ourselves we can
+        distinguish between loading the first frame and the complete media.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add more verbose error output when loading NPAPI plugins
+
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
 
 2009-01-13  Simon Hausmann  <simon.hausmann@nokia.com>
 
@@ -839,39 +52961,84 @@
         combobox item (i.e. the call to the JS handler) from a different
         call stack by using a queued connection.
 
-2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
+2009-01-12  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Tor Arne Vestbø.
 
-        [Qt] Make sure media elements dispatch the 'loaded' event
-        
-        We assume that when Phonon goes into paused state that we have the
-        complete media file. Once we do media loading ourselves we can
-        distinguish between loading the first frame and the complete media.
+        [GIO] Make sure to untef the GFile and the GInputStream on destruction
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::updateStates):
+        Make sure to call cleanupGioOperation from the ResourceHandleInternal
+        d'tor. Change the signature of cleanupGioOperation so we can do the
+        cleanup of GIO next to the cleanup of SOUP.
 
-2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
+        This is happening with many tests from dom/html/level2/html e.g.
+        LayoutTests/dom/html/level2/html/HTMLBodyElement07.html.
 
-        Reviewed by Simon Hausmann.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::cleanupGioOperation):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
 
-        [Qt] Add more verbose error output when loading NPAPI plugins
+2009-01-12  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::load):
+        Reviewed by Tor Arne Vestbø.
+
+        [GIO] Attach the ResourceHandle to the GObject and get it from the GObject
+
+        https://bugs.webkit.org/show_bug.cgi?id=23116 discussed with Benjamin Otte
+
+        Sometimes it is not possible to cancel a pending GIO operation and the
+        callback might be invoked with a pointer to an already destructed
+        ResourceHandle. To avoid this issue we will attach the ResourceHandle
+        to the GObject* and in the callback attempt to get the ResourceHandle
+        from the GObject*. If no ResourceHandle is attached we silently fail
+        as the cleanup has been already done.
+
+        This is happening with many tests from dom/html/level2/html e.g.
+        LayoutTests/dom/html/level2/html/HTMLBodyElement07.html.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::cleanupGioOperation):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+        (WebCore::ResourceHandle::startGio):
+
+2009-01-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [GIO] Invoke cleanupGioOperation before calling didFail to avoid crashes
+
+        https://bugs.webkit.org/show_bug.cgi?id=23116
+
+        The ResourceHandle becomes invalid (e.g. got destructed) from within
+        the invocation of didFail. Avoid this by cleaning up everything before
+        calling didFail and simply return afterwards.
+
+        This is happening with many tests from dom/html/level2/html e.g.
+        LayoutTests/dom/html/level2/html/HTMLBodyElement07.html.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
 
 2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
 
         Reviewed by Simon Hausmann.
 
         Change how themes adjust mediaControls.css to match html4/quicks.css
-        
+
         Instead of providing the full style sheet, the themes provide extra
         overrides to the default style defined in UserAgentStyleSheetsData.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=23210
-        
+
         Also, merge WebKitResources.qrc and WebCoreResources.qrc to speed up
         build time for the Qt port.
 
@@ -890,41 +53057,300 @@
         * rendering/RenderTheme.h:
         (WebCore::RenderTheme::extraMediaControlsStyleSheet):
 
-2009-01-10  Eric Carlson  <eric.carlson@apple.com>
+2009-01-12  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Oliver Hunt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=23210
-        Make it easier for ports to define custom UI for media controls
+        Deprecate JSValuePtr::getNumber() - two ways to get a number should  be enough.
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement): call theme()->styleSheetForMediaControls to
-        get the media controller style sheet 
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlInputElement::hitTest): Added
-        * rendering/MediaControlElements.h: Updated
+2009-01-12  Chris Marrin  <cmarrin@apple.com>
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::forwardEvent): Call element hitTest() method instead of local function
-        so control elements don't necessarily have to be rectangular
+        Reviewed by Dan Bernstein.
 
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::styleSheetForMediaControls):  Added
-        (WebCore::RenderTheme::hitTestMediaControlPart):  Added
-        * rendering/RenderTheme.h: Updated
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22919
+
+        I added a common getElapsedTime() function to AnimationBase which uses a combination of
+        the techniques from KeyframeAnimation and AnimationBase to compute elapsedTime in all
+        states.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::progress):
+        (WebCore::AnimationBase::getElapsedTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+
+2009-01-12  Robert Blaut  <webkit@blaut.biz>
+
+        Reviewed by Darin Adler
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=22096>
+        Bug 22096: REGRESSION (r35879) scrolldelay is counted in seconds
+        instead of miliseconds
+
+        Test: fast/css/webkit-marquee-speed-unit-in-quirksmode.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit): treat unitless values in quirks mode
+        as miliseconds instead of seconds.
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Apply the same idea as the previous fix but for matched declarations.
+
+        Reviewed by Dan Bernstein
+
+        * css/CSSStyleSelector.h:
+
+2009-01-12  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6468274> - Track Non-get requests in global history
+
+        * WebCore.base.exp:
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::lastVisitWasHTTPNonGet):
+        (WebCore::HistoryItem::setLastVisitWasHTTPNonGet):
 
 2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
 
         !ENABLE(SVG_FONTS) build fix. Move defaultUnitsPerEm into a non-SVG header
         so it can be used by all builds.
-        
+
         * platform/graphics/Font.h:
         * platform/graphics/SimpleFontData.cpp:
         * svg/SVGFontFaceElement.cpp:
         * svg/SVGFontFaceElement.h:
 
-2008-01-12  Dimitri Glazkov  <dglazkov@chromium.org>
+2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build typo fix.
+
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::TransformationMatrix):
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Make sure the set of matched rules has a reserved capacity of 32.  This prevents remalloc thrash as
+        elements are matched, since the Vector is shrinking and growing over and over.  1% PLT speedup.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSStyleSelector.h:
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Optimize Element::attributeChanged to just check if accessibility is enabled up front before looking at the
+        two accessibility-related attributes.  This avoids the rest of the code for all attributes on the PLT.
+        Tiny speedup.
+
+        Reviewed by Oliver Hunt
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Optimize the retrieval of line height.  If the document is not using any first-line rules, just immediately
+        default to the normal case.  Tiny speedup on PLT.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::lineHeight):
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Fix 0.6% regression in PLT.  Make sure not to waste time updating NSScrollView's can blit on scroll state
+        in the ScrollView constructor, since this is always going to be properly updated by FrameView anyway.
+
+        Reviewed by Oliver Hunt
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+
+2009-01-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=23273
+
+        In RenderBox::repaintLayerRectsForImage(), the repaint rect does not have
+        to be computed in absolute coordintes. Instead, we compute a repaintRect
+        relative to the RenderObject, which can repaint itself.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+
+2009-01-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=23220
+
+        Merge layoutDelta into LayoutState. This requires that we
+        push even when layoutState is disabled, so that layoutDelta
+        can still be stored.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/LayoutState.h:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::absoluteToLocal):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeAbsoluteRepaintRect):
+        (WebCore::RenderTableCell::localToAbsolute):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::pushLayoutState):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::layoutDelta):
+        (WebCore::RenderView::addLayoutDelta):
+        (WebCore::RenderView::doingFullRepaint):
+        (WebCore::RenderView::pushLayoutState):
+        (WebCore::RenderView::popLayoutState):
+        (WebCore::RenderView::layoutStateEnabled):
+        (WebCore::RenderView::layoutState):
+        (WebCore::LayoutStateMaintainer::LayoutStateMaintainer):
+        (WebCore::LayoutStateMaintainer::push):
+        (WebCore::LayoutStateMaintainer::pop):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-12  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Build fix after turning the fontCache to a singleton
+        https://bugs.webkit.org/show_bug.cgi?id=23253
+
+        Add a stub implementation for WebCore::fontCache() and FontCache::FontCache().
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+
+2009-01-12  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix some bugs with Selection::appendTrailingWhitespace().
+        https://bugs.webkit.org/show_bug.cgi?id=23232
+
+        Test: editing/selection/doubleclick-whitespace-crash.html
+
+        * editing/Selection.cpp:
+        (WebCore::makeSearchRange):
+        (WebCore::Selection::appendTrailingWhitespace):
+
+2009-01-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add the first pieces of platform/graphics/chromium
+        https://bugs.webkit.org/show_bug.cgi?id=23257
+
+        * platform/graphics/chromium/ColorChromium.cpp: Added.
+        (WebCore::focusRingColor):
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::isStringASCII):
+        (WebCore::LookupAltName):
+        (WebCore::FontCodepage::):
+        (WebCore::FontCodepage::if):
+        (WebCore::createFontIndirectAndGetWinName):
+        (WebCore::fontContainsCharacter):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::alternateFamilyName):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::toGDIFontWeight):
+        (WebCore::FontCache::getGenericFontForScript):
+        (WebCore::FillLogFont):
+        (WebCore::FontCache::fontExists):
+        (WebCore::TraitsInFamilyProcData::TraitsInFamilyProcData):
+        (WebCore::traitsInFamilyEnumProc):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/chromium/FontCacheLinux.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::alternateFamilyName):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getGenericFontForScript):
+        * platform/graphics/chromium/FontChromiumWin.cpp: Added.
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::skiaDrawText):
+        (WebCore::PaintSkiaText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+
+2009-01-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23254
+        Upstream page/chromium/
+
+        * page/chromium/AXObjectCacheChromium.cpp: Added.
+        (WebCore::AXObjectCache::detachWrapper):
+        (WebCore::AXObjectCache::attachWrapper):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postNotificationToElement):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * page/chromium/AccessibilityObjectChromium.cpp:
+        * page/chromium/AccessibilityObjectWrapper.h:
+        * page/chromium/ChromeClientChromium.h: Added.
+        * page/chromium/DragControllerChromium.cpp: Added.
+        (WebCore::DragController::dragOperation):
+        (WebCore::DragController::isCopyKeyDown):
+        (WebCore::DragController::maxDragImageSize):
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/chromium/EventHandlerChromium.cpp: Added.
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/chromium/FrameChromium.cpp: Added.
+        (WebCore::computePageRectsForFrame):
+        (WebCore::Frame::dragImageForSelection):
+        * page/chromium/FrameChromium.h: Added.
+
+2009-01-12  Dimitri Glazkov  <dglazkov@chromium.org>
 
         Reviewed by Darin Adler.
 
@@ -949,6 +53375,948 @@
         * loader/FrameLoaderClient.cpp:
         (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
 
+2009-01-12  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22861: Turn the FontCache into a singleton
+        https://bugs.webkit.org/show_bug.cgi?id=22861
+
+        - Added fontCache() to get the global FontCache.
+
+        - Made all the methods in FontCache instance method.
+
+        - Changed FontCache:: to fontCache()-> in WebCore.
+
+        * WebCore.base.exp: Now export fontCache().
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::CSSFontSelector):
+        (WebCore::CSSFontSelector::~CSSFontSelector):
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        (WebCore::fontDataForGenericFamily):
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::~SimpleFontData):
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::fontCacheATSNotificationCallback):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::smallCapsFontData):
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::getCJKCodePageMasks):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23247: createSVGPathSegCurvetoCubicSmoothAbs doesn't set y2 correctly
+        https://bugs.webkit.org/show_bug.cgi?id=23247
+
+        Also fix problems where partially parsed paths will still have an effect
+        rather than failing parsing and being ignored.
+
+        Test: dom/path-segments.html
+
+        * platform/graphics/Path.h:
+        (WebCore::Path::swap): Added.
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG): Removed unneeded special case for empty string.
+        (WebCore::PathBuilder::build): Changed to not modify the path if parsing fails.
+        (WebCore::SVGPathSegListBuilder::build): Changed to not modify the segment list if
+        parsing fails.
+        (WebCore::SVGPathSegListBuilder::svgMoveTo): Put the path element into the vector,
+        not directly into the segment list.
+        (WebCore::SVGPathSegListBuilder::svgLineTo): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgLineToHorizontal): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgLineToVertical): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToCubic): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToCubicSmooth): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToQuadratic): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToQuadraticSmooth): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgArcTo): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgClosePath): Ditto.
+
+        * svg/SVGPathSegCurvetoCubicSmooth.h:
+        (WebCore::SVGPathSegCurvetoCubicSmooth::SVGPathSegCurvetoCubicSmooth):
+        Set y2 to y2, not to y.
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Fourth step: Remove arguments entirely in the many cases where they are not
+        needed at all. This step is a little less mechanical than the earlier ones.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::isXMLMIMEType): Pass TextCaseSensitive when creating
+        the regular expression, since we already specify a-zA-Z in our expression.
+
+        * dom/Document.cpp:
+        (WebCore::Document::databaseThread): Don't pass in the document when creating
+        a DatabaseThread.
+
+        * dom/Element.cpp:
+        (WebCore::Element::createRareData): Don't pass the element when creating an
+        ElementRareData.
+        (WebCore::Element::detach): Don't pass the element when calling resetComputedStyle.
+        (WebCore::Element::recalcStyle): Ditto.
+
+        * dom/ElementRareData.h: Remove the unused Element* from the constructor and
+        the resetComputedStyle function.
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::dispatchEvent): Don't pass ec to dispatchGenericEvent.
+        (WebCore::EventTargetNode::dispatchGenericEvent): Remove the unused ec argument.
+        (WebCore::EventTargetNode::dispatchWindowEvent): Don't pass ec to dispatchGenericEvent.
+        * dom/EventTargetNode.h: Remove the ExceptionCode& argument form disaptchGenericEvent.
+
+        * editing/ApplyStyleCommand.cpp: Remove the empty removeBlockStyle function.
+        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Remove the unused
+        start and end arguments.
+        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAtBoundaries): Don't pass start
+        and end to pushDownTextDecorationStyleAroundNode.
+
+        * editing/ApplyStyleCommand.h: Remove the empty removeBlockStyle function. Removed the
+        unused start and end arguments from pushDownTextDecorationStyleAroundNode.
+
+        * editing/htmlediting.cpp: Removed include of unused RegularExpression.h header.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::Token::addAttribute): Removed unused Document* argument.
+        (WebCore::HTMLTokenizer::parseTag): Don't pass document to addAttribute.
+
+        * html/HTMLTokenizer.h: Removed unused Document* argument to to addAttribute.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage): Don't pass the frame to storageArea.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragIsMove): Removed unused DragData argument.
+        (WebCore::DragController::performDrag): Call concludeEditDrag rather than
+        concludeDrag.
+        (WebCore::DragController::tryDocumentDrag): Don't pass dragData to dragIsMove.
+        (WebCore::DragController::concludeEditDrag): Renamed to make it clear this
+        should only be called for edit drags. Removed the action mask argument. Also
+        changed dragIsMove call sites to not pass dragData.
+
+        * page/DragController.h: Updated for above changes and tweaked comment format.
+
+        * page/Frame.cpp:
+        (WebCore::createRegExpForLabels): Pass TextCaseSensitive and TextCaseInsensitive
+        when creating regular expressions for clarity. Call match instead of search,
+        since both do the same thing except for with negative start offsets, and none
+        used here are negative.
+        (WebCore::Frame::matchLabelsAgainstElement): Ditto.
+
+        * page/Page.h: Moved TextCaseSensitivity from here to StringImpl.h in platform.
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetHeadingLevel): Removed unused object argument.
+        (AXAttributedStringAppendText): Ditto.
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]): Ditto.
+
+        * page/mac/FrameMac.mm:
+        (WebCore::regExpForLabels): Pass TextCaseSensitive and TextCaseInsensitive
+        when creating regular expressions for clarity. Call match instead of search,
+        since both do the same thing except for with negative start offsets, and none
+        used here are negative.
+        (WebCore::Frame::matchLabelsAgainstElement): Ditto.
+
+        * platform/graphics/SegmentedFontData.cpp:
+        (WebCore::SegmentedFontData::containsCharacter): Added.
+        (WebCore::SegmentedFontData::containsCharacters): Updated to check all characters
+        instead of just the first one, using containsCharacter.
+
+        * platform/graphics/SegmentedFontData.h: Made more members private.
+        Added containsCharacter function member.
+
+        * platform/mac/DragImageMac.mm:
+        (WebCore::dragImageSize): Changed to use RetainPtr<NSImage> directly instead of
+        DragImageRef for clarity, since this is platform-specific code.
+        (WebCore::deleteDragImage): Ditto. Also remove argument name to get rid of unused
+        variable warning.
+        (WebCore::scaleDragImage): Ditto.
+        (WebCore::dissolveDragImageToFraction): Ditto.
+        (WebCore::createDragImageFromImage): Ditto.
+        (WebCore::createDragImageIconForCachedImage): Ditto.
+
+        * platform/mac/WebFontCache.mm:
+        (acceptableChoice): Removed the unused weight-related arguments.
+        (betterChoice): Ditto.
+        (+[WebFontCache internalFontWithFamily:traits:weight:size:]): Ditto.
+
+        * platform/posix/FileSystemPOSIX.cpp: Removed the implementation of listDirectory
+        because we'd rather get a link error rather than a runtime error if we use it
+        for anything, and right now it's not used.
+
+        * platform/text/RegularExpression.cpp: Removed unused private data,
+        including pattern, lastMatchString, lastMatchOffsets, lastMatchCount,
+        and lastMatchPos. Made the RegularExpression::Private::regex be private
+        and use an accessor function to get at it.
+        (WebCore::RegularExpression::RegularExpression): Removed the const char* version
+        of the constructor because it's not any more efficient. Changed the boolean
+        constructor argument to use TextCaseSensitivity instead to make it less likely
+        we'll use it wrong.
+        (WebCore::RegularExpression::operator=): Since the only member is a single RefPtr,
+        just use plain old assignment on it. The only reason we do this instead of using
+        the compiler generated assignment operator is that we want the Private structure
+        to be internal to the .cpp file.
+        (WebCore::RegularExpression::match): Added a null check so we won't crash if
+        we fail to compile the regular expression. Removed the code to handle multiple
+        match strings, since that was unused.
+
+        * platform/text/RegularExpression.h: Changed the case sensitivity argument to use
+        TextCaseSensitivity and not have a default value. Removed the default constructor,
+        and the pattern, match, and pos functions.
+
+        * platform/text/StringImpl.h: Moved the TextCaseSensitivity enum here from
+        Page.h, because we should eventually use it in all the places where we have
+        an argument to control case sensitivity, starting with the functions in this
+        class.
+
+        * platform/text/mac/ShapeArabic.c:
+        (shapeUnicode): Removed the unused options and pErrorCode arguments. Even though
+        this is code borrowed from ICU, this seems like a simple safe change to make.
+        (shapeArabic): Don't pass options or pErrorCode in to shapeUnicode.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::RenderPath): Removed the unused style argument.
+        Also removed the type check. The argument already has the correct type,
+        so it's not helpful to upcast it and then check its type again, unless
+        we have some reason to believe the type is not reliable. And we don't.
+
+        * rendering/RenderPath.h: Removed the RenderStyle* argument to the
+        constructor. Also removed the explicit declaration of the destructor.
+        It's not helpful or needed.
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::localCaretRect): Updated the comment here to
+        make it clear that just returning an empty rect is not a good implementation.
+        Removed the argument names to get rid of the warning.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::printBorderStyle): Removed the unused RenderObject argument.
+        (WebCore::operator<<): Updated for the change to printBorderStyle function.
+
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread): Removed the unused document argument.
+        * storage/DatabaseThread.h: Ditto.
+
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea): Removed the unused Frame* argument.
+        * storage/LocalStorage.h: Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible): Don't pass an exception
+        code location to dispatchGenericEvent.
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::dispatchEvent): Ditto.
+
+        * svg/SVGStyledTransformableElement.cpp: Removed include of unused RegularExpression.h.
+        (WebCore::SVGStyledTransformableElement::createRenderer): Don't pass style in to
+        the RenderPath constructor.
+
+        * svg/SVGTransformable.cpp: Removed include of unused RegularExpression.h.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Removed unused sourceNode argument.
+        (WebCore::XSLTProcessor::transformToFragment): Don't pass sourceNode to createFragmentFromSource.
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23165
+        Disable application cache dynamic entries support.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * loader/appcache/DOMApplicationCache.idl:
+
+2009-01-11  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Correct coordinate transformation for deeply nested frames on resizing.  This
+        fixes https://bugs.webkit.org/show_bug.cgi?id=20766.
+
+        Test: fast/frames/frame-deep-nested-resize.html
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::userResize):
+
+2009-01-11  Mark Rowe  <mrowe@apple.com>
+
+        Tiger build fix.  The connection parameter is still used on Tiger in this method.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]):
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Third step: Deal with cases of arguments used only in assertions.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePortCloseEventTask::performTask): Use ASSERT_UNUSED.
+        * dom/Worker.cpp:
+        (WebCore::Worker::notifyFinished): Ditto.
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished): Ditto.
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource): Ditto.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Ditto.
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::didReceiveData): Since loader and size are only
+        used when logging, use UNUSED_PARAM when logging is disabled.
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::beforeMouseDown): Use ASSERT_UNUSED.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Use the
+        argument since it's probably a tiny bit more efficient and gets rid
+        of the unused argument warning.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::createInlineBox): Use ASSERT_UNUSED.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createInlineBox): Ditto.
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineBox): Use UNUSED_PARAM.
+        I couldn't use ASSERT_UNUSED because it's a single assertion, but it's
+        the only use for two different arguments.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::createInlineBox): Use ASSERT_UNUSED.
+        * rendering/RenderThemeMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]): Ditto.
+
+2009-01-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23242
+
+        Fix CanvasRenderingContext2D::transform to do a pre-multiply,
+        rather than a post-multiply into m_transform. This bug did not affect
+        drawing, but did cause m_transform to be incorrect, which impacted
+        willDraw(), and isPointInPath.
+
+        Test: fast/canvas/canvas-incremental-repaint-2.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::transform):
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Second step: Fix simple Objective-C cases where we need to use UNUSED_PARAM.
+        That's because you can't omit an argument name in Objective-C methods.
+
+        * bindings/objc/DOMObject.mm:
+        (-[DOMObject copyWithZone:]): Use UNUSED_PARAM. Also rename argument to include
+        the word "unused" so we don't just start using it without removing the macro.
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebUndefined allocWithZone:]): Ditto.
+        (-[WebUndefined initWithCoder:]): Ditto.
+        (-[WebUndefined encodeWithCoder:]): Ditto.
+        (-[WebUndefined copyWithZone:]): Ditto.
+        * page/mac/WebDashboardRegion.m:
+        (-[WebDashboardRegion copyWithZone:]): Ditto.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::mainThreadSetNeedsDisplay): Omit argument name.
+        (-[WebCoreMovieObserver loadStateChanged:]): Use UNUSED_PARAM as above.
+        (-[WebCoreMovieObserver rateChanged:]): Ditto.
+        (-[WebCoreMovieObserver sizeChanged:]): Ditto.
+        (-[WebCoreMovieObserver timeChanged:]): Ditto.
+        (-[WebCoreMovieObserver didEnd:]): Ditto.
+        (-[WebCoreMovieObserver newImageAvailable:]): Ditto.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (+[ScrollbarPrefsObserver appearancePrefsChanged:]): Ditto.
+        (+[ScrollbarPrefsObserver behaviorPrefsChanged:]): Ditto.
+        * platform/mac/SharedTimerMac.mm:
+        (-[WebCorePowerNotifier didWake:]): Ditto.
+        * platform/mac/WebCoreKeyGenerator.m:
+        (-[WebCoreKeyGenerator signedPublicKeyAndChallengeStringWithStrengthIndex:challenge:pageURL:]): Ditto.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didCancelAuthenticationChallenge:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
+        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
+
+2009-01-11  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move platform dependent strokeContains back to RenderPath, Path and delete
+        unneeded Code in svg.
+
+        RenderPath clean-up for strokeContains
+        [https://bugs.webkit.org/show_bug.cgi?id=22957]
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::strokeContains):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::strokeContains):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeContains):
+        * svg/graphics/cairo/RenderPathCairo.cpp: Removed.
+        * svg/graphics/cg/CgSupport.cpp: Removed.
+        * svg/graphics/cg/CgSupport.h: Removed.
+        * svg/graphics/cg/RenderPathCg.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerPatternCg.cpp:
+        * svg/graphics/cg/SVGResourceMaskerCg.mm:
+        * svg/graphics/qt/RenderPathQt.cpp: Removed.
+
+2009-01-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Anders Carlsson.
+
+        [GTK] make distcheck complains that distclean is not deleting JSWorkerContextBase.lut.h
+
+        make distcheck pass by adding JSWorkerContextBase.lut.h to the
+        CLEANFILES that will be cleaned on a make distclean.
+
+        * GNUmakefile.am:
+
+2009-01-11  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23235
+        Build fix for non-VIDEO builds.
+
+        * rendering/RenderTheme.cpp:
+        * rendering/RenderTheme.h:
+
+2009-01-11  Gabriella Toth  <gtoth@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19287
+        return value of malloc() is not checked in npruntime.cpp
+
+        Checking whether malloc can allocate memory or not. If it can't, CRASH macro is invoked
+        (like in fastMalloc).
+
+        * bridge/npruntime.cpp:
+        (_NPN_GetStringIdentifier):
+        (_NPN_GetIntIdentifier):
+        (NPN_InitializeVariantWithStringCopy):
+        (_NPN_CreateObject):
+
+2009-01-11  Glenn Wilson  <gwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        Changes radio buttons so they can be 'checked' even if they
+        don't have the name attribute set.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=21534
+
+        Test: fast/html/select-unnamed-radio.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::preDispatchEventHandler):
+
+2009-01-11  Bernhard Rosenkraenzer <bero@arklinux.ch>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22205
+        Fix compatibility with bison 2.4, partially based on older patch by
+        Priit Laes <amd@store20.com>
+
+        * WebCore/css/CSSGrammar.y: Made compatible with bison 2.4
+
+2009-01-11  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16001
+        Incorrect assumption that selection is always contiguous LTR.
+
+        Test: editing/selection/extend-selection-bidi.html
+
+        * rendering/RootInlineBox.cpp: (WebCore::RootInlineBox::fillLineSelectionGap):
+        Make this function  not assume a contiguous visual LTR selection range.
+
+2009-01-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23207
+        Moved currentTime() to from WebCore to WTF.
+
+        Most of these files only have a different header file included.
+        Various build files reflect removal of SystemTimeGtk, Wx, Qt and Linux
+        which were removed since they only implemented currentTime().
+
+        * ForwardingHeaders/wtf/CurrentTime.h: Added.
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * dom/ContainerNode.cpp:
+        * dom/Document.cpp:
+        * dom/Event.cpp:
+        * history/CachedPage.cpp:
+        * history/PageCache.cpp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        * html/PreloadScanner.cpp:
+        * inspector/InspectorController.cpp:
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        * loader/CachedImage.cpp:
+        * loader/CachedResource.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/icon/IconDatabase.cpp:
+        * loader/icon/IconRecord.cpp:
+        * page/DragController.cpp:
+        * page/Frame.cpp:
+        * page/FrameView.cpp:
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationController.cpp:
+        * page/animation/KeyframeAnimation.cpp:
+        * platform/SystemTime.h:
+        * platform/Timer.cpp:
+        * platform/graphics/BitmapImage.cpp:
+        * platform/gtk/MouseEventGtk.cpp:
+        * platform/gtk/SharedTimerGtk.cpp:
+        * platform/gtk/SystemTimeGtk.cpp: Removed.
+        * platform/gtk/SystemTimeLinux.cpp: Removed.
+        * platform/mac/SystemTimeMac.cpp:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/SharedTimerQt.cpp:
+        * platform/qt/SharedTimerQt.h:
+        * platform/qt/SystemTimeQt.cpp: Removed.
+        * platform/win/SharedTimerWin.cpp:
+        * platform/win/SystemTimeWin.cpp:
+        * platform/wx/MouseEventWx.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/wx/SharedTimerWx.cpp:
+        * platform/wx/SystemTimeWx.cpp: Removed.
+        * rendering/RenderImage.cpp:
+        * rendering/RenderMedia.cpp:
+        * svg/animation/SMILTimeContainer.cpp:
+        * webcore-wx.bkl:
+        * xml/XMLHttpRequest.cpp:
+
+2009-01-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make ScheduledAction (Timeout callback) able to execute the callback under WorkerContext.
+        Part of 'Timers in Workers' work.
+        https://bugs.webkit.org/show_bug.cgi?id=23223
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): new method that takes WorkerContext.
+        (WebCore::ScheduledAction::executeFunctionInContext): Executes a JSFunction in proper context with 'this' object.
+        * bindings/js/ScheduledAction.h:
+
+2009-01-10  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23210
+        Make it easier for ports to define custom UI for media controls
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement): call theme()->styleSheetForMediaControls to
+        get the media controller style sheet
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::hitTest): Added
+        * rendering/MediaControlElements.h: Updated
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::forwardEvent): Call element hitTest() method instead of local function
+        so control elements don't necessarily have to be rectangular
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::styleSheetForMediaControls):  Added
+        (WebCore::RenderTheme::hitTestMediaControlPart):  Added
+        * rendering/RenderTheme.h: Updated
+
+2009-01-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=23222
+
+        We need to disable LayoutState when an object has transforms,
+        because LayoutState is not transform-aware and therefore
+        repaint rects can be computed incorrectly.
+
+        Test: fast/repaint/transform-disable-layoutstate.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+
+2009-01-09  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [QT] Make SharedTimer use QBasicTimer
+
+        Kill the SharedTimerQt.h and the usage of signal and slots
+        by using QBasicTimer.
+
+        * WebCore.pro:
+        * platform/qt/SharedTimerQt.cpp:
+        (WebCore::SharedTimerQt::SharedTimerQt):
+        (WebCore::SharedTimerQt::inst):
+        (WebCore::SharedTimerQt::start):
+        (WebCore::SharedTimerQt::stop):
+        (WebCore::SharedTimerQt::timerEvent):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/qt/SharedTimerQt.h: Removed.
+
+2009-01-09  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Holger Freyther.
+
+        [CURL] POST without body becomes GET
+        https://bugs.webkit.org/show_bug.cgi?id=23182
+
+        Make sure that method is always set to POST even when the body is
+        empty. Cleaned up httpBody null check.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setupPOST):
+
+2009-01-09  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix.
+
+        * plugins/PluginView.cpp:
+
+2009-01-09  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix infinite recursion in clientPaddingLeft and clientPaddingRight.  This changes the code back to
+        how it was before RenderTextControlSingleLine was split out from RenderTextControl.
+
+        No test added since this code is only exercised when trying to place a search field's recent searches popup menu.
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+
+2009-01-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Bug 22913: REGRESSION: Space bar doesn't scroll on windows
+        https://bugs.webkit.org/show_bug.cgi?id=22913
+        rdar://problem/6479834
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultKeyboardEventHandler): Added code to call
+        defaultSpaceEventHandler.
+        (WebCore::EventHandler::defaultSpaceEventHandler): Added. Scrolls down or up based
+        on the shift key.
+        * page/EventHandler.h: Added defaultSpaceEventHandler.
+
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformScroll): Return false, because this function does
+        not scroll. In an earlier version of this patch, I used this to prevent the
+        patch from affecting the Mac, but I decided to use #if instead.
+
+2009-01-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Delete references to JSValue, removing this class.
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::self):
+        * bindings/js/ScriptCallStack.h:
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add svg/graphics/skia files.
+        https://bugs.webkit.org/show_bug.cgi?id=23147
+
+        * svg/graphics/skia/RenderPathSkia.cpp: Added.
+        (WebCore::RenderPath::strokeContains):
+        * svg/graphics/skia/SVGPaintServerPatternSkia.cpp: Added.
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/skia/SVGPaintServerSkia.cpp: Added.
+        (WebCore::SVGPaintServer::draw):
+        (WebCore::SVGPaintServer::teardown):
+        (WebCore::SVGPaintServer::renderPath):
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp: Added.
+        (WebCore::SVGResourceFilter::createPlatformData):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/skia/SVGResourceMaskerSkia.cpp: Added.
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add SkiaFontWin to platform/graphics/chromium
+        https://bugs.webkit.org/show_bug.cgi?id=23215
+
+        * platform/graphics/skia/SkiaFontWin.cpp: Added.
+        (WebCore::CachedOutlineKey::CachedOutlineKey):
+        (WebCore::operator==):
+        (WebCore::CachedOutlineKeyHash::hash):
+        (WebCore::CachedOutlineKeyHash::equal):
+        (WebCore::FIXEDToSkScalar):
+        (WebCore::deleteOutline):
+        (WebCore::addPolyCurveToPath):
+        (WebCore::getPathForGlyph):
+        (WebCore::SkiaWinOutlineCache::lookupOrCreatePathForGlyph):
+        (WebCore::SkiaWinOutlineCache::removePathsForFont):
+        * platform/graphics/skia/SkiaFontWin.h: Added.
+
+2009-01-09  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * WebCore.LP64.exp:
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add PlatformContextSkia and PlatformGraphics.h to platform/graphics/skia
+        https://bugs.webkit.org/show_bug.cgi?id=23215
+
+        * platform/graphics/skia/PlatformContextSkia.cpp: Added.
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::State::~State):
+        (PlatformContextSkia::State::applyAlpha):
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::~PlatformContextSkia):
+        (PlatformContextSkia::setCanvas):
+        (PlatformContextSkia::save):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setupPaintForFilling):
+        (PlatformContextSkia::setupPaintForStroking):
+        (PlatformContextSkia::setDrawLooper):
+        (PlatformContextSkia::setMiterLimit):
+        (PlatformContextSkia::setAlpha):
+        (PlatformContextSkia::setLineCap):
+        (PlatformContextSkia::setLineJoin):
+        (PlatformContextSkia::setPorterDuffMode):
+        (PlatformContextSkia::setFillColor):
+        (PlatformContextSkia::getDrawLooper):
+        (PlatformContextSkia::getStrokeStyle):
+        (PlatformContextSkia::setStrokeStyle):
+        (PlatformContextSkia::setStrokeColor):
+        (PlatformContextSkia::getStrokeThickness):
+        (PlatformContextSkia::setStrokeThickness):
+        (PlatformContextSkia::getTextDrawingMode):
+        (PlatformContextSkia::setTextDrawingMode):
+        (PlatformContextSkia::setUseAntialiasing):
+        (PlatformContextSkia::fillColor):
+        (PlatformContextSkia::beginPath):
+        (PlatformContextSkia::addPath):
+        (PlatformContextSkia::setFillRule):
+        (PlatformContextSkia::setGradient):
+        (PlatformContextSkia::setPattern):
+        (PlatformContextSkia::setDashPathEffect):
+        (PlatformContextSkia::paintSkPaint):
+        (PlatformContextSkia::bitmap):
+        (PlatformContextSkia::isPrinting):
+        * platform/graphics/skia/PlatformContextSkia.h: Added.
+        (PlatformContextSkia::currentPath):
+        (PlatformContextSkia::canvas):
+        (PlatformContextSkia::gdk_skia):
+        * platform/graphics/skia/PlatformGraphics.h: Added.
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add TransformationMatrixSkia to platform/graphics/skia
+        https://bugs.webkit.org/show_bug.cgi?id=23215
+
+        * platform/graphics/skia/TransformationMatrixSkia.cpp: Added.
+        (WebCore::TransformationMatrix::TransformationMatrix):
+        (WebCore::TransformationMatrix::setMatrix):
+        (WebCore::TransformationMatrix::map):
+        (WebCore::TransformationMatrix::mapRect):
+        (WebCore::TransformationMatrix::isIdentity):
+        (WebCore::TransformationMatrix::reset):
+        (WebCore::TransformationMatrix::scale):
+        (WebCore::TransformationMatrix::rotate):
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::shear):
+        (WebCore::TransformationMatrix::det):
+        (WebCore::TransformationMatrix::inverse):
+        (WebCore::TransformationMatrix::operator SkMatrix):
+        (WebCore::TransformationMatrix::operator==):
+        (WebCore::TransformationMatrix::operator*=):
+        (WebCore::TransformationMatrix::operator*):
+        (WebCore::TransformationMatrix::a):
+        (WebCore::TransformationMatrix::setA):
+        (WebCore::TransformationMatrix::b):
+        (WebCore::TransformationMatrix::setB):
+        (WebCore::TransformationMatrix::c):
+        (WebCore::TransformationMatrix::setC):
+        (WebCore::TransformationMatrix::d):
+        (WebCore::TransformationMatrix::setD):
+        (WebCore::TransformationMatrix::e):
+        (WebCore::TransformationMatrix::setE):
+        (WebCore::TransformationMatrix::f):
+        (WebCore::TransformationMatrix::setF):
+
+2009-01-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6477502> Repro crash reloading page using HTML5 AppCache on Windows
+
+        Test: http/tests/appcache/reload.html
+
+        On Windows, reloading resulted in the following sequence of events:
+        1) A new main resource loader was created and associated with the cache. Its document loader
+        was not associated with the cache yet.
+        2) The old document loader was destroyed, and since it was the last one, ApplicationCacheGroup
+        teardown started, with newestCache being zeroed out.
+        3) The new document loader was associated with the cache group, and cache update started.
+        4) Since newestCache was null, this caused many problems.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::documentLoaderDestroyed): Improve comments and assertions,
+        no functional changes.
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache): Revive the cache group
+        if its newest cache pointer is already saved for teardown. Note that the cache pointer
+        validity is ensured by MainResourceLoader that holds a reference to it.
+
+2009-01-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23214
+        Upstream platform/network/chromium/
+
+        * platform/network/chromium/AuthenticationChallenge.h: Added.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        (WebCore::AuthenticationChallenge::sourceHandle):
+        * platform/network/chromium/AuthenticationChallengeChromium.cpp: Added.
+        (WebCore::AuthenticationChallenge::platformCompare):
+        * platform/network/chromium/CookieJarChromium.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/network/chromium/DNSChromium.cpp: Added.
+        (WebCore::prefetchDNS):
+        * platform/network/chromium/NetworkStateNotifierChromium.cpp: Added.
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        * platform/network/chromium/NetworkStateNotifierPrivate.h: Added.
+        * platform/network/chromium/ResourceError.h: Added.
+        (WebCore::ResourceError::ResourceError):
+        * platform/network/chromium/ResourceRequest.h: Added.
+        (WebCore::ResourceRequest::):
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::frame):
+        (WebCore::ResourceRequest::setFrame):
+        (WebCore::ResourceRequest::setTargetType):
+        (WebCore::ResourceRequest::targetType):
+        (WebCore::ResourceRequest::originPid):
+        (WebCore::ResourceRequest::setOriginPid):
+        (WebCore::ResourceRequest::securityInfo):
+        (WebCore::ResourceRequest::setSecurityInfo):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::getSecurityInfo):
+        (WebCore::ResourceResponse::setSecurityInfo):
+        (WebCore::ResourceResponse::isContentFiltered):
+        (WebCore::ResourceResponse::setIsContentFiltered):
+        (WebCore::ResourceResponse::doUpdateResourceResponse):
+
+2009-01-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22995
+        Fix flaky image animation by resetting the metadata for a frame when
+        we get new data for that frame.  This fixes animations that halted
+        when the next frame of the animation wasn't complete by the time the
+        current frame's duration expired.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData):
+        (WebCore::BitmapImage::dataChanged):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::FrameData::~FrameData):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::FrameData::clear):
+
 2009-01-09  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Rubber-stamped by Tor Arne Vestbø.
@@ -959,12 +54327,22 @@
 
         * WebCore.pro:
 
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Added forwarding header.
+
+        * ForwardingHeaders/wtf/PtrAndFlags.h: Added.
+
 2009-01-09  Tor Arne Vestbø  <tavestbo@trolltech.com>
 
         Reviewed by Simon Hausmann.
 
         Prevent qmake from generating duplicate rules for embedded stylesheets
-        
+
         The STYLESHEETS_EMBED variable used to contain only one file name, but
         now that it is a list of files we need to change it to be a dependency
         for the stylesheet generator instead of the input.
@@ -1085,7 +54463,7 @@
 
         Add ImageSourceSkia to platform/graphics/skia
         https://bugs.webkit.org/show_bug.cgi?id=23200
-        
+
         ImageSourceSkia is mostly a hack to support our
         ICO decoder model.  See ImageSourceSkia.h for more
         explanation.  Eventually we'd like to make our ICO
@@ -1176,9 +54554,9 @@
 
         Reviewed by Oliver Hunt.
 
-        Fix <rdar://problem/6467206> 
+        Fix <rdar://problem/6467206>
         Resources loaded from the memory cache do not get correctly inserted into the DocLoader resource map (22994)
-        
+
         Use CachedResourceHandle in document resource map so resources get updated correctly when using
         using cache validation conditionals.
 
@@ -1485,7 +54863,7 @@
 
         Reviewed by Darin Adler.
 
-        Part one of 
+        Part one of
         https://bugs.webkit.org/show_bug.cgi?id=23165
         Add support for application cache dynamic entries
 
@@ -1519,7 +54897,7 @@
         * loader/appcache/ApplicationCache.h: Added a list of pending dynamic entry actions, to be
         used in the near future.
 
-        * loader/appcache/DOMApplicationCache.idl: Updated for spec changes. Instead of length 
+        * loader/appcache/DOMApplicationCache.idl: Updated for spec changes. Instead of length
         attribute and item(), we now have an items attribute that returns a DOMStringList, and a
         hasItem convenience method.
 
@@ -1665,7 +55043,7 @@
 2009-01-07  Anders Carlsson  <andersca@apple.com>
 
         Another build fix.
-        
+
         * WebCore.LP64.exp:
 
 2008-12-16  David Hyatt  <hyatt@apple.com>
@@ -1752,7 +55130,7 @@
         Reviewed by Oliver Hunt.
 
         <rdar://problem/6391734> SnowLeopard: Crash doing Copy Image from context menu
-        
+
         Can't create an automated test case for specific contextual menu items yet and
         a normal Copy doesn't cause a crash.
 
@@ -2409,18 +55787,18 @@
                animations/simultaneous-start-transform.html
 
         Fixed https://bugs.webkit.org/show_bug.cgi?id=22870
- 
+
         I added calls beginAnimationUpdate() and endAnimationUpdate() calls
         to AnimationController. These are called by Document at the start
-        and end of the recalcStyle cycle. Right now, I'm just using the 
+        and end of the recalcStyle cycle. Right now, I'm just using the
         beginAnimationUpdate() method to reset an animation time value.
         The first time the animation time is accessed after this reset I set
         it to the currentTime. So all animations in that cycle get the same
-        start time. 
+        start time.
 
         The test cases checked in test this, but in the case of the 'left'
         test it actually doesn't make any difference in most cases. This is
-        because values are clamped to whole pixels, so the start times would 
+        because values are clamped to whole pixels, so the start times would
         have to be pretty far off for the test to fail using the old
         currentTime() model. Still, under really heavy load, it's possible for
         the test to fail without these changes.
@@ -2476,9 +55854,9 @@
 
         Reviewed by Sam Weinig.
 
-        Add a way for frame loader clients to always create a PluginDocument, regardless of 
+        Add a way for frame loader clients to always create a PluginDocument, regardless of
         the real document MIME type.
-        
+
         * loader/FrameLoader.cpp:
         (WebCore::FrameLoader::begin):
         (WebCore::FrameLoader::shouldUsePlugin):
@@ -2547,7 +55925,7 @@
 2009-01-06  David Smith  <catfish.man@gmail.com>
 
         Reviewed by Darin Adler.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=23129
         Devirtualize Node::childNodes().
 
@@ -2612,18 +55990,18 @@
         Reviewed by Dave Hyatt
 
         https://bugs.webkit.org/show_bug.cgi?id=22985
-        
+
         Add an assertion that clip rects are being used when painting with the same
         rootLayer that they were computed with.
-        
+
         Fix two issues detected by the assertion:
 
         RenderLayer::updateClipRects() should not unconditionally update the clip rects
         on its parent, but stop when reaching rootLayer (just like calculateClipRects()).
-        
+
         We need to pass the temporaryClipRects flag down through reflection painting
         to handle the case of nested reflections.
-        
+
         Also use temporary clip rects in RenderTreeAsText, since that code does not
         reset the painting root for transformed layers, so cached clip rects will not
         match those used for painting.
@@ -2687,17 +56065,17 @@
 
         Implement 'pointer-events' for HTML content. This involved
         adding a new value 'auto' which behaves as 'visiblePainted'
-        in SVG content. 
-        
+        in SVG content.
+
         Moved the property out of the SVG CSS code and into
-        the general CSS (both parsing and RenderStyle). 
-        
+        the general CSS (both parsing and RenderStyle).
+
         Changes to the hit testing functionality of the Render tree,
-        specifically the nodeAtPoint methods. Where they used to 
+        specifically the nodeAtPoint methods. Where they used to
         test for visibility, they now use a helper function defined
         on base classes (RenderObject and InlineBox) that checks both
         visibility and pointer-events.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=11395
 
         Tests: fast/events/pointer-events-2.html
@@ -2774,7 +56152,7 @@
 
         Reviewed by Gavin Barraclough.
 
-        CanvasPixelArray performance is too slow 
+        CanvasPixelArray performance is too slow
         <https://bugs.webkit.org/show_bug.cgi?id=23123>
 
         Remove the WebCore CanvasPixelArray implementation and replace
@@ -2829,18 +56207,18 @@
 2009-01-05  Anders Carlsson  <andersca@apple.com>
 
         Build fix.
-        
+
         * plugins/PluginView.h:
         (WebCore::PluginManualLoader::~PluginManualLoader):
 
 2009-01-05  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Kevin Decker.
-        
-        Add an abstract PluginManualLoader class and make PluginView inherit from it. 
-        
+
+        Add an abstract PluginManualLoader class and make PluginView inherit from it.
+
         Add some error checking that currently exists in WebKit (but not for long!)
-        
+
         * plugins/PluginView.cpp:
         (WebCore::PluginView::didReceiveResponse):
         (WebCore::PluginView::didReceiveData):
@@ -3138,7 +56516,7 @@
         Reviewed by Darin Adler
 
         https://bugs.webkit.org/show_bug.cgi?id=23090
-        
+
         If an object gets a Layout hint, and the style change will result in
         the creation of a RenderLayer, then we need to repaint the old position
         of the object. This was done for transform, but we have to test opacity too.
@@ -3221,9 +56599,9 @@
 
         Reverse the order in the icon database main thread loop to
         write the pending icons to the database before trying
-        to read any requested icons. This ensures that a requested icon 
+        to read any requested icons. This ensures that a requested icon
         has the correct data when read.
-        
+
         * loader/icon/IconDatabase.cpp:
         (WebCore::IconDatabase::syncThreadMainLoop):
 
@@ -3240,7 +56618,7 @@
         https://bugs.webkit.org/show_bug.cgi?id=23025
         DOMTimer lifetime cleanup: timeoutMap methods on Document now do not delete the timer.
         Instead, all 3 places that delete timers do it directly calling 'delete' and then timer's dtor removes the ID from the timeoutMap.
-        Note that in case the context is destroyed and timers are deleted at once, the check in ~DOMTimer() prevents 
+        Note that in case the context is destroyed and timers are deleted at once, the check in ~DOMTimer() prevents
         unnecessary HashMap remove in case the Document is being destroyed.
 
         * bindings/js/DOMTimer.cpp:
@@ -3311,10 +56689,10 @@
         Reviewed by Darin Adler
 
         https://bugs.webkit.org/show_bug.cgi?id=23082
-        
+
         Fix GIF animation by ensuring that the signature of
         startAnimation() in the base class matches the method in BitmapImage.
-        
+
         Test: fast/backgrounds/animated-gif-as-background.html
 
         * platform/graphics/Image.h:
@@ -3323,10 +56701,10 @@
 2009-01-02  David Smith  <catfish.man@gmail.com>
 
         Reviewed by Darin Adler.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22699
         Enable NodeList caching for getElementsByTagName
-        
+
         test: fast/dom/getelementsbytagnamens-mixed-namespaces.html
 
         * dom/Document.cpp:
@@ -3342,7 +56720,7 @@
         (WebCore::MappedAttributeHash::hash): Use WTF::stringHashingStartValue
         * dom/TagNodeList.cpp:
         (WebCore::TagNodeList::TagNodeList): Add a NodeList cache argument
-        * dom/TagNodeList.h: 
+        * dom/TagNodeList.h:
         (WebCore::TagNodeList::create): Add a NodeList cache argument
         * platform/text/StringHash.h:
         (WebCore::CaseFoldingHash::hash): Use WTF::stringHashingStartValue
@@ -3353,7 +56731,7 @@
 
         Reviewed by Darin Adler
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=23066 & <rdar://problem/6028417> 
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23066 & <rdar://problem/6028417>
         Full Page Zoom: a <video> element that doesn't include width/height attribute does not scale
 
         * rendering/RenderVideo.cpp:
@@ -3418,7 +56796,7 @@
         Reviewed by Darin Adler
 
         Use an OwnPtr for m_chromeClient.
-        
+
         * svg/graphics/SVGImage.cpp:
         (WebCore::SVGImage::~SVGImage):
         (WebCore::SVGImage::dataChanged):
@@ -3437,7 +56815,7 @@
         a rect parameter for the changed rect, allowing incremental repaints.
         Fix RenderImage::imageChanged to take advantage of this changedRect to
         only repaint the changed parts of the image.
-        
+
         This also enables incremental painting for canvas-as-image, so
         add tests for that too.
 
@@ -3681,11 +57059,11 @@
         Reviewed by Darin Adler, Oliver Hunt
 
         https://bugs.webkit.org/show_bug.cgi?id=23065
-        
+
         Enable incremental painting of canvas. This turns incremental painting
         back on, and fixes issues with stroke width and miters, calling willDraw()
         for strokeText and fillText, and taking shadows into account.
-        
+
         Test: fast/canvas/canvas-incremental-repaint.html
 
         * html/CanvasRenderingContext2D.cpp:
@@ -3852,11 +57230,11 @@
         Reviewed by Darin Adler
 
         https://bugs.webkit.org/show_bug.cgi?id=23042
-        
+
         Rather than doing a repaint() inside of computeAbsoluteRepaintRect()
         when there is a reflection, compute the location of the rect inside
         the reflection and take the union of the unreflected and reflected rects.
-        
+
         Test: fast/repaint/reflection-redraw.html
 
         * rendering/RenderBox.cpp:
@@ -4016,9 +57394,9 @@
         Reviewed by Brady Eidson.
 
         Fix for https://bugs.webkit.org/show_bug.cgi?id=21797
-        <rdar://problem/6310682> REGRESSION: Crash in CFHTTPCookieStorageCopy beneath WebCore::cookies() when 
+        <rdar://problem/6310682> REGRESSION: Crash in CFHTTPCookieStorageCopy beneath WebCore::cookies() when
         running fast/dom/document-attribute-js-null.html and http/tests/security/cookies/create-document.html
-        
+
         Return early if the document is trying to get or set a cookie with an empty cookie url.
 
         * dom/Document.cpp:
@@ -4304,7 +57682,7 @@
         Prepare to add create/remove timeout methods to JSWorkerContext by moving
         timer-specific code from JSDOMWindowBase to DOMTimer.
         Moved everything JS-related from DOMTimer to ScheduledAction.
-        Now ScheduledAction is what it wanted to be all the time: a JS engine-specific 
+        Now ScheduledAction is what it wanted to be all the time: a JS engine-specific
         container for timer callback that knows how to invoke it.
         DOMTimer is not anymore JS-specific.
 
@@ -4414,9 +57792,9 @@
         Reviewed by Oliver Hunt.
 
         <rdar://problem/6465669> Frequent !isPurgeable() assertion in WebCore::CachedResource::addClient
-        
+
         Disallow turning resources that are being revalidated to purgable state.
-        
+
         No test, the condition is difficult to produce in DRT.
 
         * loader/CachedCSSStyleSheet.cpp:
@@ -4513,10 +57891,10 @@
         Reviewed by Dan Bernstein
 
         https://bugs.webkit.org/show_bug.cgi?id=22941
-        
+
         If the document element has opacity, we need to erase the view background to
         white before painting.
-        
+
         Test: fast/backgrounds/opacity-on-document-element.html
 
         * rendering/RenderView.cpp:
@@ -4527,10 +57905,10 @@
         Reviewed by Dan Bernstein
 
         https://bugs.webkit.org/show_bug.cgi?id=21910
-        
+
         Fix SVGImage painting by ensuring that the SVGImage resizes its FrameView correctly.
         Otherwise the FrameView is left at 0x0, and nothing paints.
-        
+
         * svg/graphics/SVGImage.cpp:
         (WebCore::SVGImage::draw):
 
@@ -5441,7 +58819,7 @@
         Reviewed by Kevin Ollivier.
 
         Add Context Menu support to wx bindings.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22675
 
         * platform/ContextMenu.h:
@@ -5458,12 +58836,12 @@
 
         Reviewed by Darin Adler.
 
-        Temporary band-aide fix for <rdar://problem/6372481> In Gmail, a 
-        crash occurs at 
-        AccessibilityTable::isTableExposableThroughAccessibility() when 
+        Temporary band-aide fix for <rdar://problem/6372481> In Gmail, a
+        crash occurs at
+        AccessibilityTable::isTableExposableThroughAccessibility() when
         attempting to create a link in a rich text message
 
-        We need to disable Accessibility Tables until we get this fixed for 
+        We need to disable Accessibility Tables until we get this fixed for
         real to prevent rampant crashing.
 
         * page/AccessibilityTable.cpp:
@@ -5474,10 +58852,10 @@
         Reviewed by Darin Adler
 
         https://bugs.webkit.org/show_bug.cgi?id=22938
-        
+
         When the document element is transformed, we need to paint
         the view background to avoid unpainted areas.
-        
+
         Test: fast/transforms/transformed-document-element.html
 
         * rendering/RenderView.cpp:
@@ -5595,7 +58973,7 @@
           storage is disallowed, all authentication challenges are sent to
           the client.
         - let the FrameLoaderClient decide whether to use the credential
-          storage. 
+          storage.
 
         * loader/EmptyClients.h:
         (WebCore::EmptyFrameLoaderClient::shouldUseCredentialStorage): Added.
@@ -5605,7 +58983,7 @@
         to the FrameLoaderClient.
         * loader/FrameLoader.h: Declared shouldUseCredentialStorage().
         * loader/FrameLoaderClient.h: Declared shouldUseCredentialStorage().
-        * loader/ResourceLoader.cpp: 
+        * loader/ResourceLoader.cpp:
         (WebCore::ResourceLoader::shouldUseCredentialStorage): Added. Calls
         through to the FrameLoader.
         * loader/ResourceLoader.h:
@@ -5679,7 +59057,7 @@
 
         Reviewed by John Sullivan.
 
-        Add new FrameLoaderClient method to indicate the first visually 
+        Add new FrameLoaderClient method to indicate the first visually
         non-empty layout based on an heuristic.  Right now that heuristic
         is the first layout after an image, text or plugin has been added
         to the render tree, but I can imagine it becoming much smarter.
@@ -5853,7 +59231,7 @@
         If JavaScript is not currently executing, the handleEvent member function
         of JSAbstractEventListener should set the dynamic global object to the
         global object of the context in which the event occurred.
-        
+
         If this is not set, then JavaScriptCore will simply take the global object
         of the context where the event handler function was created, which may be
         a different frame. This will cause the popup blocker to incorrectly block
@@ -5869,13 +59247,13 @@
         Reviewed by Dave Hyatt
 
         https://bugs.webkit.org/show_bug.cgi?id=22570
-        
+
         Add the ability to compute clip rects independently from
-        caching them on the RenderLayer. When painting reflections, use 
+        caching them on the RenderLayer. When painting reflections, use
         such temporarily computed clipRects, otherwise the layer may cache
         clipRects which are invalid, since they have been computed with
         a rootLayer that is not the one usually used to paint.
-        
+
         Test: fast/reflections/reflection-overflow-hidden.html
 
         * rendering/RenderLayer.cpp:
@@ -5905,7 +59283,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=22618
 
-        Fix MinGW QtWebKit linking problems and also make the 
+        Fix MinGW QtWebKit linking problems and also make the
         QtWebKit build system more robust.
 
         * WebCore.pro:
@@ -6018,9 +59396,9 @@
 
         Reviewed by Geoff Garen.
 
-        Change HTTPHeaderMap to use an AtomicString as its key.  
+        Change HTTPHeaderMap to use an AtomicString as its key.
         Shaves ~1MB off of the Mozilla Memory Test
-        No functionality difference    
+        No functionality difference
 
         * WebCore.xcodeproj/project.pbxproj:
         * inspector/InspectorController.cpp:
@@ -6109,7 +59487,7 @@
         Fix for https://bugs.webkit.org/show_bug.cgi?id=22871
         <rdar://problem/6417316> RenderThemeWin buttons are too short/thin
 
-        * rendering/RenderButton.cpp: (WebCore::RenderButton::setupInnerStyle): 
+        * rendering/RenderButton.cpp: (WebCore::RenderButton::setupInnerStyle):
         Check if the button's style (not the new inner style) has appearance set to determine whether we should set padding on the inner style.
 
 2008-12-15  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
@@ -6189,7 +59567,7 @@
 
         * bindings/js/JSGeolocationCustom.cpp:
         (WebCore::createPositionOptions): Added. Extracts the enableHighAccuracy
-        and timeout fields from a vanilla JS object in order to create the 
+        and timeout fields from a vanilla JS object in order to create the
         PositionOptions object, checking for exceptions as necessary.
         (WebCore::JSGeolocation::getCurrentPosition): Use createPositionOptions
         instead of toPositionOptions.
@@ -6311,13 +59689,13 @@
         Reviewed by Darin Adler.
 
         When a resource is cached locally, WebKit should follow RFC 2616 "Specific end-to-end revalidation" instead of "Unspecified end-to-end revalidation"
-        https://bugs.webkit.org/show_bug.cgi?id=17998 
-        
-        - Enable conditional revalidation for reloads by default. 
+        https://bugs.webkit.org/show_bug.cgi?id=17998
+
+        - Enable conditional revalidation for reloads by default.
         - Add a parameter to FrameLoader::reload() for forcing end-to-end reload.
-        - To avoid duplicating state remove m_cachePolicy variables from FrameLoader and DocLoader. 
+        - To avoid duplicating state remove m_cachePolicy variables from FrameLoader and DocLoader.
           Instead synthezise the policy on demand.
-        
+
         This speeds up reloads and makes them use way less bandwidth.
 
         * WebCore.base.exp:
@@ -6328,10 +59706,10 @@
         (WebCore::DocLoader::checkForReload): Support CachePolicyRevalidate.
         (WebCore::DocLoader::requestResource):
         (WebCore::DocLoader::cachePolicy):
-        * loader/DocLoader.h: Get rid of m_cachePolicy member. 
+        * loader/DocLoader.h: Get rid of m_cachePolicy member.
         * loader/FrameLoader.cpp:
-        (WebCore::ScheduledRedirection::ScheduledRedirection): 
-            Add parameter to differentiate refresh from other types of redirects. 
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+            Add parameter to differentiate refresh from other types of redirects.
             m_cachePolicy was used for signaling this before.
         (WebCore::isBackForwardLoadType):
         (WebCore::FrameLoader::FrameLoader):
@@ -6347,11 +59725,11 @@
         (WebCore::FrameLoader::redirectionTimerFired):
         (WebCore::FrameLoader::canCachePage):
         (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::reload): 
+        (WebCore::FrameLoader::reload):
             Differentiate between revalidation and reload.
             No need to use setHTTPHeaderField here, addExtraFieldsToRequest will set the headers.
         (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::cachePolicy): Determine the cache policy based on current load type. 
+        (WebCore::FrameLoader::cachePolicy): Determine the cache policy based on current load type.
         (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
         (WebCore::FrameLoader::addExtraFieldsToRequest): Set Cache-control: no-cache for FrameLoadTypeReloadFromOrigin
         (WebCore::FrameLoader::shouldScrollToAnchor):
@@ -6362,7 +59740,7 @@
         * loader/FrameLoader.h:
         * loader/FrameLoaderTypes.h: Add FrameLoadTypeReloadFromOrigin
         (WebCore::):
-        * loader/NavigationAction.cpp: 
+        * loader/NavigationAction.cpp:
         (WebCore::navigationType):  Support FrameLoadTypeReloadFromOrigin
         * loader/loader.cpp:
         (WebCore::Loader::Host::servePendingRequests):
@@ -6755,7 +60133,7 @@
         * platform/win/DragImageCGWin.cpp:
         (WebCore::deallocContext): Add a generic CGContextRef destructor.
         * platform/win/DragImageCairoWin.cpp:
-        (WebCore::deallocContext): Add a generic cairo_* destructor. 
+        (WebCore::deallocContext): Add a generic cairo_* destructor.
         (WebCore::allocImage):  New implementation to allocate a Cairo
         surface of a specified size.
         (WebCore::createCairoContextFromBitmap): New implementation to
@@ -6774,7 +60152,7 @@
         WebKitCSSKeyframesRule to Window object.
         This required generating constructors for the event
         interfaces.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=20560
 
         * dom/WebKitAnimationEvent.idl:
@@ -6837,19 +60215,19 @@
 
         Delete the previous timer-queue timer in the main thread, just prior to scheduling a new timer.
         The code previously called DeleteTimerQueueTimer in the timer callback proc.
-        
+
         The new technique simplifies the code, since we now create and delete timers on the
         same thread, and don't access the timer queue or timer handles in the callback.
         This allows us to remove some mutex use, and more importantly, it solves a race
         condition that was occuring between ChangeTimerQueueTimer and DeleteTimerQueueTimer.
-        
+
         Since the timer callback isn't passed the timer handle, we were retrieving that handle
         via a global. If the timer callback code was entered, but then a new timer was immediately
         scheduled (prior to the callback acquiring the mutex and calling DeleteTimerQueueTimer),
         there was a small window where the timer could be re-scheduled via ChangeTimerQueueTimer
         and then immediately deleted once the already running callback acquired the mutex and
         then called DeleteTimerQueueTimer. This resulted in the newly scheduled timer never firing.
-        
+
         Reviewed by Oliver Hunt.
 
         * platform/win/SharedTimerWin.cpp:
@@ -6986,7 +60364,7 @@
         Reviewed by Simon Hausmann.
 
         Implement ImageSource::filenameExtension() for the Qt port
-        
+
         We're using QImageReader::imageFormat().toLower() to check
         that the image format is supported, and if it is we store
         the resulting extension when creating the ImageDecoderQt.
@@ -7005,11 +60383,11 @@
         Reviewed by Geoff Garen
 
         Account for the size of the response and request headers as well as other overhead
-        when calculating the size a resource takes up in the cache.  Halts unbounded 
+        when calculating the size a resource takes up in the cache.  Halts unbounded
         growth in the cache.  Reduced stress test memory high water marks by > 50%.
 
-        Uses estimates gathered from the stress test to set the overhead size.  
-        A version of the patch was created that calculated most of the sizes, but it was 
+        Uses estimates gathered from the stress test to set the overhead size.
+        A version of the patch was created that calculated most of the sizes, but it was
         decided that the patch was still at a basic level an estimate.  What gains it made
         in accuracy was offset by the complexity involved in creating and updating the
         estimate.
@@ -7186,7 +60564,7 @@
         I had to add one more bit of code. When animation timers used to fire the animation events.
         This would always happen from the RunLoop, so any style changes that happened in the
         event handler would get picked up on the next updateRendering() call. But now the start
-        event is generated during the styleIsAvailable() call, which is in the middle of the 
+        event is generated during the styleIsAvailable() call, which is in the middle of the
         updateRendering() cycle. And calling an event handler in the middle of updateRendering()
         is not allowed and causes style changes to get missed. We already have a mechanism in
         AnimationController to defer updateRendering() calls. So I added logic to defer all
@@ -7545,7 +60923,7 @@
         Reviewed by Antti Koivisto
 
         <rdar://problem/6431224>
-        
+
         When updating the value of a slider, don't mark the parents
         as needing layout, because the size of the slider can never
         change. This fixes full-page repaints in some cases.
@@ -7557,7 +60935,7 @@
 
         Potential build fix. The forward declaration of FloatPoint should
         be inside the WebCore namespace.
-        
+
         * platform/graphics/FloatPoint3D.h:
 
 2008-12-10  Simon Fraser  <simon.fraser@apple.com>
@@ -7569,7 +60947,7 @@
         Cleanup FloatPoint3D: inline the getters and setters,
         fix a potential divide-by-zero in normalize(), and add
         a FloatPoint constructor.
-        
+
         * platform/graphics/FloatPoint3D.cpp:
         (WebCore::FloatPoint3D::FloatPoint3D):
         (WebCore::FloatPoint3D::normalize):
@@ -7661,7 +61039,7 @@
 
         Part of
         https://bugs.webkit.org/show_bug.cgi?id=22570
-        
+
         Rename methods on RenderLayer for clarity:
             clearClipRects -> clearClipRectsIncludingDescendants
             clearClipRect  -> clearClipRects
@@ -7683,7 +61061,7 @@
 2008-12-10  Kevin Ollivier  <kevino@theolliviers.com>
 
         wx build fix after the script call stack/frame additions.
-        
+
         * WebCoreSources.bkl:
 
 2008-12-10   Srinivasa Rao M. Hamse  <msrinirao@gmail.com>
@@ -7923,7 +61301,7 @@
         * bindings/js/ScriptValue.h: Added isNull and isUndefined
         * bindings/scripts/CodeGeneratorJS.pm: Add handling for
         CustomArgumentHandling attribute.
-        * inspector/InspectorController.cpp: Refactored to use 
+        * inspector/InspectorController.cpp: Refactored to use
         ScriptCallFrame and ScriptCallStack.
         (WebCore::ConsoleMessage::ConsoleMessage):
         (WebCore::InspectorController::addMessageToConsole):
@@ -8378,11 +61756,11 @@
 
         Fix issues which break reading inline style for -webkit-transition
         and -webkit-transform-origin.
-        
+
         Test: fast/css/transform-inline-style.html
 
         * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue): Add cases 
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue): Add cases
         for CSSPropertyWebkitTransformOrigin and CSSPropertyWebkitTransition
         so that these shorthand properties are returned correctly.
         * css/CSSParser.cpp:
@@ -8399,12 +61777,12 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=22717
         Make CSS values use less memory
-        
+
         Share CSSPrimitiveValue objects for commonly used values including
         - idents
         - colors
         - small integers
-        
+
         This reduces the amount CSSPrimitiveValue instances by > 80%.
 
         * css/CSSPrimitiveValue.cpp:
@@ -8424,11 +61802,11 @@
         Get CSSValues off from the common StyleBase base class. They don't
         need a parent pointer or anything else there and there is no real
         reason to have them in same data structures with other CSSOM objects.
-        
-        Disabled (instead of refactoring around the lack of common base) the ability 
-        to have style declaration blocks as CSS variable values. They don't exist in 
-        the spec so I wasn't sure if they have future or not. It would not be hard to 
-        get them back. CSS variables are in any case an experimental feature and 
+
+        Disabled (instead of refactoring around the lack of common base) the ability
+        to have style declaration blocks as CSS variable values. They don't exist in
+        the spec so I wasn't sure if they have future or not. It would not be hard to
+        get them back. CSS variables are in any case an experimental feature and
         not enabled by default.
 
         * css/CSSInitialValue.h:
@@ -8528,9 +61906,9 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=22379
         Make CSSOM use less memory
-        
+
         Use vector instead of a double linked list for properties in CSSMutableStyleDeclaration.
-        
+
         Taught setter functions to use existing slots to avoid memory moves, plus some
         other optimizations.
 
@@ -8605,7 +61983,7 @@
         Fix logic related to repainting when transform changes:
         If an object has a layer, and the transform changes, then we need
         to do a repaintIncludingDescendants(), not just a repaint.
-        
+
         Test: fast/repaint/transform-repaint-descendants.html
 
         * rendering/RenderObject.cpp:
@@ -8631,7 +62009,7 @@
         Reviewed by Dave Hyatt
 
         https://bugs.webkit.org/show_bug.cgi?id=15671
-        
+
         Fix caret rendering to behave correctly with transforms:
         * Rename caretRect() methods to localCaretRect() and
           absoluteCaretBounds() as appropriate
@@ -8969,7 +62347,7 @@
 
         Bug 22579: Providing a function to ScrollbarClient.h which allows us to get at the tickmarks
         without relying on high-level WebCore types, as requested by Dave Hyatt.
-        
+
         No functional changes, thus no test cases.
 
         * page/FrameView.cpp:
@@ -9119,9 +62497,9 @@
         Reviewed by Kevin Ollivier.
 
         Add a MIME mapping for the .htm extension to wx and GTK ports.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22668
-        
+
         * platform/gtk/MIMETypeRegistryGtk.cpp:
         (WebCore::):
         * platform/wx/MimeTypeRegistryWx.cpp:
@@ -9133,7 +62511,7 @@
 
         Implement basic text paste support in wx and add notImplemented stubs
         to catch other methods.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22667
 
         * platform/wx/PasteboardWx.cpp:
@@ -9165,7 +62543,7 @@
         Reviewed by Kevin Ollivier.
 
         Turn off styled controls until we can implement them properly.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22662
 
         * platform/wx/RenderThemeWx.cpp:
@@ -9456,7 +62834,7 @@
         makes it unnecessary to 'serialize' them into special PausedTimeouts
         instance, so pause/resumeTimeouts implementation in JSDOMWindowBase can also be removed.
         Also, moving TimeoutMap from JSDOMWindowBase to Document matches lifetime
-        of timeouts and makes it possible to not roundtrip them via PausedTimeouts 
+        of timeouts and makes it possible to not roundtrip them via PausedTimeouts
         every time when JSDOMWindow wrapper is destroyed while the page is in the b/f cache.
 
         Timeouts are now paused with other ActiveDOMObjects:
@@ -9485,7 +62863,7 @@
 
         * bindings/js/DOMTimer.h:
         * bindings/js/JSDOMBinding.cpp: ActiveDOMObject can have no JS wrapper
-        (WebCore::markActiveObjectsForContext): 
+        (WebCore::markActiveObjectsForContext):
 
         * bindings/js/JSDOMWindowBase.cpp:
         (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
@@ -9514,7 +62892,7 @@
         * inspector/JavaScriptDebugServer.h:
 
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad): 
+        (WebCore::FrameLoader::commitProvisionalLoad):
         removed clearAllTimeouts since all ActiveDOMObjects will be stopped in FrameLoader::clear();
         I don't see how the old comment can be correct - the code in the same method proceeds to invoke 'onunload'
         and then calls into client which can be external code and can cause any active object created in onunload
@@ -9531,13 +62909,13 @@
         Reviewed by Beth Dakin.
 
         <rdar://problem/6018653> Extra blank line when pasting paragraph in plain text
-        
+
         In SnowLeopard, Mail occasionally adds an empty, unstyled paragraph at the
         end of pasted content so that users don't get stuck with non-standard pargraph
         spacing.  This content threw off our handling of interchange newlines.  Any interchange
         newline, regardless of it's position in the incoming fragment was considered to be
-        "at the start" of the fragment, and would result in us inserting in a newline before 
-        inserted content.  This patch makes the checks for interchange newlines more strict, 
+        "at the start" of the fragment, and would result in us inserting in a newline before
+        inserted content.  This patch makes the checks for interchange newlines more strict,
         and treats interchange newlines found elsewhere as normal <br>s.
 
         * editing/ReplaceSelectionCommand.cpp:
@@ -9939,7 +63317,7 @@
         Reduce size of the CSSSelector by 3/8 by moving rarely used fields to a rare data
         struct. Browsing around with some instrumentation showed that ~0.1% of all selectors
         encountered had rare data.
-        
+
         This also eliminates the CSSNthSelector subclass which will make possible to store
         CSSSelectors in an array instead of a linked list for futher memory savings.
 
@@ -10059,11 +63437,11 @@
         Reviewed by Dave Hyatt
 
         https://bugs.webkit.org/show_bug.cgi?id=22472
-        
+
         Override absoluteClippedOverflowRect() in RenderReplaced to return a rect
         that is large enough to encompass the selection, so that the repainting of
         selected replaced elements works correctly.
-        
+
         Test: fast/repaint/selected-replaced.html
 
         * rendering/RenderReplaced.cpp:
@@ -10115,7 +63493,7 @@
 
         Bug 22596: Some elements don't report AXBlockQuoteLevel
         https://bugs.webkit.org/show_bug.cgi?id=22596
- 
+
         Reviewed by John Sullivan.
 
         * page/mac/AccessibilityObjectWrapper.mm:
@@ -10151,14 +63529,14 @@
         Reviewed by Eric Seidel.
 
         https://bugs.webkit.org/show_bug.cgi?id=22538
-        
+
         startsWith uses find which searches through the whole string if no match is found.
         Using reverseFind with an index of 0 has the benefit of only searching for the match
         at the beginning of the string.  This may only be a small benefit in the overall program,
         but it may help in some cases when the string is big.
 
         No observable change in behavior, so no test.
- 
+
         * platform/text/StringImpl.h:
         (WebCore::StringImpl::startsWith):
 
@@ -10243,7 +63621,7 @@
         Move securityOrigin() from Document and WorkerContext into ScriptExecutionContext.
 
         No observable change in behavior, so no test.
-        
+
         * dom/Document.cpp:
         (WebCore::Document::open):
         (WebCore::Document::domain):
@@ -10259,7 +63637,7 @@
         (WebCore::WorkerContext::WorkerContext):
         * dom/WorkerContext.h:
         These changes are for the move of securityOrigin().
-        
+
         * xml/XMLHttpRequest.cpp:
         (WebCore::XMLHttpRequest::createRequest):
         (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
@@ -10288,22 +63666,22 @@
 
         Reviewed by Dan Bernstein.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=13736 REGRESSION 
-        (r19811): Using the down arrow in a textarea gets "stuck" at the 
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=13736 REGRESSION
+        (r19811): Using the down arrow in a textarea gets "stuck" at the
         end of a wrapped line
         And corresponding: <rdar://problem/5347931>
 
-        The basic problem here is that Position::getInlineBoxAndOffset() 
-        failed to look beyond a single renderer. This patch looks for a 
-        better match beyond the first renderer when the affinity is 
-        downstream and we failed to find a "perfect" match. 
+        The basic problem here is that Position::getInlineBoxAndOffset()
+        failed to look beyond a single renderer. This patch looks for a
+        better match beyond the first renderer when the affinity is
+        downstream and we failed to find a "perfect" match.
         * dom/Position.cpp:
         (WebCore::isNonTextLeafChild):
         (WebCore::searchAheadForBetterMatch):
         (WebCore::Position::getInlineBoxAndOffset):
 
-        This is a fix I made based on code inspection. It looks like the 
-        old code here and skipped over the parent as a possible match. 
+        This is a fix I made based on code inspection. It looks like the
+        old code here and skipped over the parent as a possible match.
         * rendering/RenderObject.cpp:
         (WebCore::RenderObject::nextInPreOrderAfterChildren):
 
@@ -10316,7 +63694,7 @@
 
         * WebCore.vcproj/WebCore.vcproj:
           1. Add files from the wml directory to the set of windows files.
-          2. Extend include paths with new wml directory. 
+          2. Extend include paths with new wml directory.
           3. Add new autogenerated WML files to DerivedSources.
           4. Alphabetize preprocesor includes (holdover from earlier debugging).
 
@@ -10324,7 +63702,7 @@
 
         Revise node/selection image fix.
         Moved updateLayout call so selection rect is fetched after the layout.
-        
+
         Reviewed by Adam Roben.
 
         * page/win/FrameCGWin.cpp:
@@ -10352,7 +63730,7 @@
         Reviewed by Dan Bernstein
 
         https://bugs.webkit.org/show_bug.cgi?id=22581
-        
+
         Fix the painting of the caps lock indicator for transformed text inputs,
         by replacing a call to absoluteContentBox() with code that computes the
         painting rect for the input contents.
@@ -10562,7 +63940,7 @@
         them. So now the pointer is valid throughout the entire sequence of callback code.
 
         The testcase for https://bugs.webkit.org/show_bug.cgi?id=22052 also exhibits a
-        crash which this patch fixes. 
+        crash which this patch fixes.
 
         * page/animation/AnimationBase.cpp:
         (WebCore::AnimationBase::updateStateMachine):
@@ -10745,7 +64123,7 @@
 
         Fixes: https://bugs.webkit.org/show_bug.cgi?id=22549
 
-        Add <do> element support. It provides a way to bind a task element to a <template>/<card> element. 
+        Add <do> element support. It provides a way to bind a task element to a <template>/<card> element.
         Changes numerous of layout tests which contain <do> elements, as they render as buttons now.
 
         * WebCore.xcodeproj/project.pbxproj:
@@ -10943,7 +64321,7 @@
         upper-case glyph defined in the set of available fonts.
 
         This changes Font.cpp to check if the font being used exists before trying to apply the small-caps variant.
-        
+
         Test: fast/css/small-caps-crash.html
 
         * platform/graphics/Font.cpp:
@@ -11472,7 +64850,7 @@
 2008-11-25  Kevin Ollivier  <kevino@theolliviers.com>
 
         wx build fix - we don't support PurgeableBuffer on Leopard for now.
-        
+
         * platform/PurgeableBuffer.h:
 
 2008-11-25  Antti Koivisto  <antti@apple.com>
@@ -11481,7 +64859,7 @@
 
         Fix https://bugs.webkit.org/show_bug.cgi?id=22483
         Assertion failure in CachedResource::makePurgeable during layout tests
-        
+
         Deleting SVG image can re-enter destroyDecodedData.
 
         * loader/CachedImage.cpp:
@@ -11548,7 +64926,7 @@
                http/tests/misc/url-in-utf32be.html
                http/tests/misc/url-in-utf32le.html
                http/tests/misc/url-in-utf7.html
- 
+
         * html/HTMLFormElement.cpp:
         (WebCore::HTMLFormElement::formData):
         * loader/TextResourceDecoder.cpp:
@@ -11578,13 +64956,13 @@
 2008-11-24  Antti Koivisto  <antti@apple.com>
 
         Reviewed by Darin Adler.
-        
+
         Fix for https://bugs.webkit.org/show_bug.cgi?id=22073
         REGRESSION(r33544): Palace in the Sky crashes WebKit
-        
+
         HTMLTokenizer::m_hasScriptsWaitingForStylesheets would still be set while
-        there were no scripts left to execute. 
-        
+        there were no scripts left to execute.
+
         If m_hasScriptsWaitingForStylesheets becomes true during script execution
         bail out from executing more scripts synchronously.
 
@@ -11651,11 +65029,11 @@
         https://bugs.webkit.org/show_bug.cgi?id=22214
         Keep dead resources in memory cache in purgeable memory.
         <rdar://problem/6333088>
-        
+
         OS X 10.5 has purgeable memory kernel facility that allows marking reserved memory
         areas as less important. Under memory pressure system can steal pages that have
         been marked purgeable for (hopefully) better uses. This is ideal for caches.
-        
+
         Only resources larger than 16KB will be moved to the purgeable memory.
 
         * WebCore.base.exp:
@@ -11890,7 +65268,7 @@
 
         Bug 22461: AccessibilityListBox::doAccessibilityHitTest() signature does not match the base class
         https://bugs.webkit.org/show_bug.cgi?id=22461
- 
+
         Changing AccessibilityListBox to use its parent's signature for hit testing
 
         * page/AccessibilityListBox.cpp:
@@ -11911,8 +65289,8 @@
         http://bugs.webkit.org/show_bug.cgi?id=18703
         "Changing the 'size' property on a text input does not affect its length"
 
-        Text fields would not repaint themselves after having their "size" 
-        attributes modified.  This fix tells the object to recalculate its 
+        Text fields would not repaint themselves after having their "size"
+        attributes modified.  This fix tells the object to recalculate its
         width and repaint itself when its "size" attribute is parsed.
 
         Test: fast/js/text-field-resize.html
@@ -11925,7 +65303,7 @@
         Reviewed by Darin Adler
 
         Followup from changes for https://bugs.webkit.org/show_bug.cgi?id=22433
-        
+
         Make RenderView::selectionRect() private to cause compile-time
         errors if someone tries to call it.
 
@@ -11936,7 +65314,7 @@
         Reviewed by Dan Bernstein
 
         Via: https://bugs.webkit.org/show_bug.cgi?id=22433
-        
+
         Rename RenderView::selectionRect() to selectionBounds(), to remove
         longstanding ambiguity with the base class selectionRect() method.
         Do the same on Frame for consistency with RenderView. Assert
@@ -12238,7 +65616,7 @@
 
         Improve wx image drawing performance considerably when using wxGraphicsContext
         by avoiding unnecessary copies and drawing.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22404
 
         * platform/graphics/wx/ImageWx.cpp:
@@ -12251,7 +65629,7 @@
         Reviewed by Kevin Ollivier.
 
         Implementation of AffineTransform::mapRect for wx.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22401
 
         * platform/graphics/wx/AffineTransformWx.cpp:
@@ -12262,20 +65640,20 @@
         Reviewed by Darin Adler.
 
         <rdar://problem/5381788> Match NSTextView editing behavior at the end of hyperlink text
-        
-        Change link editing behavior to match TextEdit and MS Word when editing before and after 
-        a link (Pages has two caret positions at link boundaries, Thunderbird and FF behave like we 
+
+        Change link editing behavior to match TextEdit and MS Word when editing before and after
+        a link (Pages has two caret positions at link boundaries, Thunderbird and FF behave like we
         used to, so it's difficult to get out of link editing mode):
         When inserting before or after a link, always insert content outside of the link.  This
-        makes it impossible to get stuck in link editing mode, while making it slightly more 
-        difficult to edit link labels.  WebKit editors that care about this can add UI for editing 
+        makes it impossible to get stuck in link editing mode, while making it slightly more
+        difficult to edit link labels.  WebKit editors that care about this can add UI for editing
         link labels, like GMail and GoogleDocs have done.  We never actually had any bugs complaining
-        about how it was difficult to edit link labels at the start/end, the code was just introduced 
+        about how it was difficult to edit link labels at the start/end, the code was just introduced
         with another bug fix without much thought.
-        
-        Don't remember removed links anymore, no other editor does this and it made it 
+
+        Don't remember removed links anymore, no other editor does this and it made it
         difficult/impossible to get out of link editing mode.  This code was added to fix
-        <rdar://problem/4069359>, which is fixed instead by removing the styles from an 
+        <rdar://problem/4069359>, which is fixed instead by removing the styles from an
         enclosing anchor element from those styles that we remember when we delete content.
 
         * editing/CompositeEditCommand.cpp:
@@ -12360,7 +65738,7 @@
         RenderBox::absoluteClippedOverflowRect() needs to inflate the rect by
         maximalOutlineSize(), since a child might have an outline which projects
         outside the parent overflowRect().
-        
+
         We also need to ensure that maximalOutlineSize() is updated early in styleDidChange,
         so that it is valid for these repaints.
 
@@ -12422,12 +65800,12 @@
         Reviewed by Darin Adler.
 
         Bug 22388: Add JSInterfaceName to the .in files
-        https://bugs.webkit.org/show_bug.cgi?id=22388        
+        https://bugs.webkit.org/show_bug.cgi?id=22388
 
         Add JSInterfaceName that is similar to interfaceName but
         for the JS wrappers. JSInterfaceName is always equal to interfaceName
         unless explicitly set.
-        
+
         * dom/make_names.pl:
         * html/HTMLTagNames.in:
         * svg/svgtags.in:
@@ -12637,12 +66015,12 @@
         Reviewed by Dan Bernstein
 
         https://bugs.webkit.org/show_bug.cgi?id=19623
-        
+
         When an non-layer object gained a transform, it would only repaint
         the bounds of the new layer, which could result in redraw artifacts
         if the new layer was smaller. So if we're gaining a transform, we
         repaint.
-        
+
         Test: fast/repaint/change-transform.html
 
         * rendering/RenderObject.cpp:
@@ -12650,7 +66028,7 @@
 
 2008-11-20  Adele Peterson  <adele@apple.com>
 
-        Reviewed by Darin Adler. 
+        Reviewed by Darin Adler.
 
         Fix for <rdar://problem/6111436> Support upload progress events on Windows
 
@@ -12663,7 +66041,7 @@
         Reviewed by Darin Adler.
 
         <rdar://problem/2610675> Blank line that is quoted can't be deleted
-        
+
         If the caret is in an empty quoted paragraph, and either there is nothing before that
         paragraph, or what is before is unquoted, and the user presses delete, unquote that
         paragraph.
@@ -12717,7 +66095,7 @@
         computed values for transform-origin-x, transform-origin-y, and just
         return transform-origin instead. Return "none" for default animation-name,
         and fix the initial value.
-        
+
         Tests: animations/computed-style.html
                transforms/computed-style-origin.html
 
@@ -12733,25 +66111,25 @@
 2008-11-20  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by Beth Dakin.
-        
+
         Preparation for:
         <rdar://problem/2610675> Blank line that is quoted can't be deleted
-        
+
         To fix this we need to make changes to the code that creates selections to delete
         when the user does a backward or forward delete with a caret selection.  For certain
         caret positions, we now want to remove something other than the standard "caret extended
-        backward/forward by one unit".  The problem is that there were two pieces of code 
-        responsible for doing this, one in Editor::deleteWithDirection, and another inside 
-        TypingCommand::deleteKeyPressed.  The code in deleteWithDirection is a recent 
-        addition (r19172), and adding it there caused regressions because it prevented the 
-        code in deleteKeyPressed from ever running.  The regressions were never caught because 
+        backward/forward by one unit".  The problem is that there were two pieces of code
+        responsible for doing this, one in Editor::deleteWithDirection, and another inside
+        TypingCommand::deleteKeyPressed.  The code in deleteWithDirection is a recent
+        addition (r19172), and adding it there caused regressions because it prevented the
+        code in deleteKeyPressed from ever running.  The regressions were never caught because
         JS deletion uses deleteKeyPressed while manual deletion uses deleteWithDirection.
-        
+
         This patch removes selection creation code from deleteWithDirection so that deleteKeyPressed
         can handle it.  That required moving code to handle the kill ring down into deleteKeyPressed.
-        
-        Follow up patches will fix <rdar://problem/2610675>, and attempt to eliminate the rest of the 
-        discrepancies between the behavior of JS deletions and manual deletions, so that we 
+
+        Follow up patches will fix <rdar://problem/2610675>, and attempt to eliminate the rest of the
+        discrepancies between the behavior of JS deletions and manual deletions, so that we
         have better test coverage.
 
         * editing/Editor.cpp:
@@ -12842,11 +66220,11 @@
         it into the coords of the part's renderer (which is the one that is painting).
         To do this we need to compute an offset relative to some container, so expose
         a method on RenderObject for that.
-        
+
         Also fix the location at which the search popup shows up to take transforms
         into account, and fix the math that is used to figure out if the search
         results button, or the cancel button should get the mouse events.
-        
+
         Test: fast/forms/search-transformed.html
 
         * rendering/RenderBox.h:
@@ -12895,7 +66273,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=22379
         Make CSSOM use less memory
-        
+
         - Shrink CSSProperty by half by using bitfields.
         - Get rid of m_strictParsing field in StyleBase by moving it up to CSSStyleSheet
           and CSSMutableStyleDeclaration. This reduces size of many highly popular objects.
@@ -12922,7 +66300,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=22373
         Ports busted by addition of ScriptValue.{h,cpp}
-        
+
         * plugins/PluginView.cpp:
         (WebCore::PluginView::performRequest):
 
@@ -12970,11 +66348,11 @@
 
         Reviewed by Justin Garcia.
 
-        Fix for <rdar://problem/5472507> Remove color property when a user 
+        Fix for <rdar://problem/5472507> Remove color property when a user
         sets color to black
 
-        This patch prevents us from inserting font nodes during the 
-        ApplyStyleCommand if they will not change the computed style of an 
+        This patch prevents us from inserting font nodes during the
+        ApplyStyleCommand if they will not change the computed style of an
         element.
 
         * editing/ApplyStyleCommand.cpp:
@@ -12986,9 +66364,9 @@
 2008-11-19  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Antti Koivisto
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22111
-        
+
         Fix hit testing in controls on transformed video elements
         by replacing absoluteBoundingBoxRect().contains() with
         code that maps the point into local coords, taking
@@ -13006,7 +66384,7 @@
         Reviewed by Darin Adler
 
         https://bugs.webkit.org/show_bug.cgi?id=22348
-        
+
         Need to educate style sharing about autofill, so that style does not
         get shared between input elements that are autofilled, and those
         that are not. Setting autofill should also do a setChanged on the node.
@@ -13683,7 +67061,7 @@
 2008-11-17  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
-        
+
         Updated for JavaScriptCore renames.
 
         * WebCore.pro:
@@ -13694,8 +67072,8 @@
         Reviewed by Beth Dakin.
 
         <rdar://problem/4922709> Copying less than a paragraph of quoted text and pasting it doesn't retain quote level
-        
-        There was code to intentionally avoid quoting pasted content if less than a paragraph of 
+
+        There was code to intentionally avoid quoting pasted content if less than a paragraph of
         it was copied.  That was added for <rdar://problem/5006779>, but was unnecessary because
         that bug was about Paste and Match style for single paragraphs.  And quote stripping for
         Paste and Match style is handled elsewhere.
@@ -13706,7 +67084,7 @@
 2008-11-17  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
-        
+
         Updated for JavaScriptCore rename.
 
         * ForwardingHeaders/interpreter/CallFrame.h: Copied from WebCore/ForwardingHeaders/runtime/ExecState.h.
@@ -13758,7 +67136,7 @@
 2008-11-17  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
-        
+
         Updated for JavaScriptCore renames.
 
         * ForwardingHeaders/VM: Removed.
@@ -13803,7 +67181,7 @@
         Remove use of static C++ objects that are destroyed at exit time (destructors)
 
         Find some missing DEFINE_STATIC_LOCAL use cases.
-        
+
         * bindings/js/JSSVGPODTypeWrapper.h:
         (WebCore::PODTypeWrapperCacheInfoTraits::emptyValue):
         (WebCore::JSSVGDynamicPODTypeWrapperCache::dynamicWrapperHashMap):
@@ -13829,11 +67207,11 @@
         Reviewed by Dan Bernstein
 
         https://bugs.webkit.org/show_bug.cgi?id=22118
-        
-        Fix resize corner tracking in transformed elements by using 
+
+        Fix resize corner tracking in transformed elements by using
         mapping the point into local coords using absoluteToLocal,
         rather than convertToLayerCoords.
-        
+
         Test: fast/css/resize-corner-tracking-transformed.html
 
         * page/EventHandler.h:
@@ -14196,7 +67574,7 @@
         Reviewed by Timothy Hatcher.
 
         Initialize m_networkStateChangedFunction to 0 as otherwise the check for null will fail.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22284
 
         * platform/network/NetworkStateNotifier.h:
@@ -14233,7 +67611,7 @@
 2008-11-15  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
-        
+
         Updated for JavaScriptCore renames.
 
         * bindings/js/JSNodeCustom.cpp:
@@ -14261,10 +67639,10 @@
         https://bugs.webkit.org/show_bug.cgi?id=21810
         Remove use of static C++ objects that are destroyed at exit time (destructors)
 
-        Create DEFINE_STATIC_LOCAL macro. Change static local objects to leak to avoid 
-        exit-time destructor. Update code that was changed to fix this issue that ran 
-        into a gcc bug (<rdar://problem/6354696> Codegen issue with C++ static reference 
-        in gcc build 5465). Also typdefs for template types needed to be added in some 
+        Create DEFINE_STATIC_LOCAL macro. Change static local objects to leak to avoid
+        exit-time destructor. Update code that was changed to fix this issue that ran
+        into a gcc bug (<rdar://problem/6354696> Codegen issue with C++ static reference
+        in gcc build 5465). Also typdefs for template types needed to be added in some
         cases so the type could make it through the macro successfully.
 
         Basically code of the form:
@@ -14646,7 +68024,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=22264
         Need to update to latest Geolocation spec (13 November 2008)
-        
+
         Update to new error code constants and values.
 
         * page/Geolocation.cpp: Use new named ErrorCode enums
@@ -14661,23 +68039,23 @@
 
         Reviewed by Justin Garcia.
 
-        Fix (again) for <rdar://problem/5089327> Too much indentation when 
+        Fix (again) for <rdar://problem/5089327> Too much indentation when
         pasting quoted paragraphs
 
-        This patch goes back to Justin's original approach to fix this bug, 
-        written in revision 38273. That fix was mostly rolled out by 
-        revision 38310 because of styling issues created by the addition of 
-        extra blockquote nodes. This patch again goes back to Justin's 
-        original fix because of cases we discovered the newer fix could not 
-        possibly cover. This version of the patch minimizes the styling 
-        issues of extra blockquotes by opting into the merge start code. 
+        This patch goes back to Justin's original approach to fix this bug,
+        written in revision 38273. That fix was mostly rolled out by
+        revision 38310 because of styling issues created by the addition of
+        extra blockquote nodes. This patch again goes back to Justin's
+        original fix because of cases we discovered the newer fix could not
+        possibly cover. This version of the patch minimizes the styling
+        issues of extra blockquotes by opting into the merge start code.
 
         * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::hasMatchingQuoteLevel): We want shouldMergeStart to 
-        return true when the quoting level of the end of the inserted 
-        content matches the quoting level of the end of the existing 
+        (WebCore::hasMatchingQuoteLevel): We want shouldMergeStart to
+        return true when the quoting level of the end of the inserted
+        content matches the quoting level of the end of the existing
         content.
-        (WebCore::ReplaceSelectionCommand::shouldMergeStart): Now calls 
+        (WebCore::ReplaceSelectionCommand::shouldMergeStart): Now calls
         hasMatchingQuoteLevel
         (WebCore::ReplaceSelectionCommand::doApply):
 
@@ -14767,15 +68145,15 @@
         Reviewed by Beth Dakin.
 
         <rdar://problem/4230923> "Make Plain Text" doesn't reset text alignment in single paragraph messages
-        
+
         When applying block styles, we would add block properties to the body element, and Mail's
         Make Plain Text feature isn't equipped to remove those.  This could have been fixed on our side,
         but this change has the advantage that it fixes the bug on Tiger, where Mail does not plan future updates.
-        
+
         We have code that puts the paragraphs that we're operating on into blocks of their own before
-        adding or removing block properties from the blocks that enclose them.  We need to run this code 
+        adding or removing block properties from the blocks that enclose them.  We need to run this code
         when the enclosing block is the body element.
-        
+
         * editing/CompositeEditCommand.cpp:
         (WebCore::CompositeEditCommand::insertNewDefaultParagraphElementAt): Added, moved code from moveParagraphContents
         to here.
@@ -14839,11 +68217,11 @@
 
         * platform/text/AtomicString.cpp:
         (WebCore::AtomicString::add):
-        
+
 2008-11-13  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by Darin Adler.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=18620
         Long hang under TextIterator::advance() when loading http://www.lsvd.de/
 
@@ -14851,8 +68229,8 @@
         we create VisiblePositions unnecessarily.
 
         * editing/TextIterator.cpp:
-        (WebCore::TextIterator::shouldRepresentNodeOffsetZero): Don't proceed to VisiblePosition 
-        creation if m_node is unrendered or invisible.  The answers wouldn't have much meaning 
+        (WebCore::TextIterator::shouldRepresentNodeOffsetZero): Don't proceed to VisiblePosition
+        creation if m_node is unrendered or invisible.  The answers wouldn't have much meaning
         and would be wasteful.  Also fixed some comments to reflect the fact that this function
         isn't specifically about emitting a newline.
 
@@ -15133,15 +68511,15 @@
         it may be the bounding outline box of a transformed element, and fix it
         to respect transforms by mapping the outline box to an absolute quad and
         taking the enclosing rect.
-        
+
         RenderBox::localToAbsoluteQuad() can no longer assert that there is no
         LayoutState, but LayoutState cannot be used during quad mapping (it knows
         nothing about transforms).
-        
+
         Finally, fix a bug in RenderBox::localToAbsoluteQuad() which was getting
         borderTopExtra() from the object, rather than its container (as localToAbsolute()
         does).
-        
+
         Test: fast/repaint/transform-absolute-child.html
 
         * rendering/RenderBlock.cpp:
@@ -15182,14 +68560,14 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=21942
         https://bugs.webkit.org/show_bug.cgi?id=18557
-        
+
         Add methods which can be used to map renderer-local rectangles
         to quads in absolute coordinates, taking transforms into account:
             localToAbsoluteQuad() converts a local rect into an absolute quad.
             collectAbsoluteLineBoxQuads() is an analogue of addLineBoxRects()
                 that works with quads.
             absoluteQuads() is an analogue of absoluteRects(), for quads.
-        
+
         Use the quad methods to fix the inspector highlight for transformed
         elements.
 
@@ -15312,7 +68690,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=17840
         Patch 2
-        
+
         Code cleanup in RenderBox::computeAbsoluteRepaintRect().
 
         * rendering/RenderBox.cpp:
@@ -15336,24 +68714,24 @@
         (WebCore::RenderBox::computeAbsoluteRepaintRect):
 
 2008-11-12  Justin Garcia  <justin.garcia@apple.com>
- 
+
         Reviewed by Beth Dakin.
- 
+
         <rdar://problem/5495723> Selecting and deleting quoted text quotes other text
         <rdar://problem/4775313> Deleting lines from the bottom of a messages leaves the last blank line quoted
-        
-        We don't want to merge into a block if it will mean changing the quote level of content after deleting 
-        selections that contain a whole number paragraphs plus a line break, since it is unclear to most users 
+
+        We don't want to merge into a block if it will mean changing the quote level of content after deleting
+        selections that contain a whole number paragraphs plus a line break, since it is unclear to most users
         that such a selection actually ends at the start of the next paragraph.  Instead we want to completely
-        remove the selected paragraph(s) and all evidence of the first one's quote level.  This matches TextEdit behavior 
+        remove the selected paragraph(s) and all evidence of the first one's quote level.  This matches TextEdit behavior
         for indented paragraphs.
- 
+
         * editing/DeleteSelectionCommand.cpp:
         (WebCore::DeleteSelectionCommand::initializePositionData): For the selections described above, do not
         try to merge after the deletion.  Instead try and prune the start block or blocks if they've been emptied
         so that we remove evidence of the deleted paragraphs' quote level.
-        (WebCore::DeleteSelectionCommand::mergeParagraphs): Try and prune the start block(s) if necessary.  Also 
-        make sure that the caret is placed correctly so that it ends up on the same line that the deleted selection 
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Try and prune the start block(s) if necessary.  Also
+        make sure that the caret is placed correctly so that it ends up on the same line that the deleted selection
         started on, instead of one higher.
         * editing/DeleteSelectionCommand.h:
         * editing/htmlediting.cpp:
@@ -15568,22 +68946,22 @@
 
         Reviewed by Darin Adler.
 
-        Fix for <rdar://problem/5089327> Too much indentation when pasting 
+        Fix for <rdar://problem/5089327> Too much indentation when pasting
         quoted paragraphs
 
-        This patch re-addresses pasting blockquotes into blockquotes. It 
-        backs out most of revision 38273. 38273 fixed the bug by inserting 
-        the pasted content as a sibling blockquote node to the pre-existing 
-        blockquote node. The problem with that is that by default, 
-        blockquotes have a giant margin, so visually, this can be weird. 
-        This patch instead inserts the pasted content as siblings of the 
-        the content already inside the outer blockquote, and then removes 
-        the blockquote node from the pasted content itself, so that it 
+        This patch re-addresses pasting blockquotes into blockquotes. It
+        backs out most of revision 38273. 38273 fixed the bug by inserting
+        the pasted content as a sibling blockquote node to the pre-existing
+        blockquote node. The problem with that is that by default,
+        blockquotes have a giant margin, so visually, this can be weird.
+        This patch instead inserts the pasted content as siblings of the
+        the content already inside the outer blockquote, and then removes
+        the blockquote node from the pasted content itself, so that it
         doesn't nest itself into the outer blockquote.
         * editing/ReplaceSelectionCommand.cpp:
         (WebCore::ReplaceSelectionCommand::doApply):
 
-        Move contains() from Element to Node since there is nothing 
+        Move contains() from Element to Node since there is nothing
         Element-specific about it.
         * dom/Element.cpp:
         * dom/Element.h:
@@ -15657,7 +69035,7 @@
 
         PatternCairo needs to invert the pattern matrix because
         of transformation from user space to pattern space.
-        Give a identity matrix to pattern for Qt and Cairo. Because the 
+        Give a identity matrix to pattern for Qt and Cairo. Because the
         context is transformed already.
 
         [CAIRO][QT] Canvas transformations applied twice to Patterns
@@ -15704,15 +69082,15 @@
 
         Reviewed by Beth Dakin.
 
-        <rdar://problem/4037481> REGRESSION (Mail): pasting quoted text 
+        <rdar://problem/4037481> REGRESSION (Mail): pasting quoted text
         into quoted text yields double-quoting
-        
-        Don't nest inserted content in Mail blockquotes.  Perform a 
+
+        Don't nest inserted content in Mail blockquotes.  Perform a
         BreakBlockquoteCommand if we're in
         one and insert the incoming fragment between the split blockquotes.
 
         * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::shouldMerge): Renamed from -> 
+        (WebCore::ReplaceSelectionCommand::shouldMerge): Renamed from ->
         source and to -> destination.
         (WebCore::ReplaceSelectionCommand::doApply):
 
@@ -15863,10 +69241,10 @@
 2008-11-08  Antti Koivisto  <antti@apple.com>
 
         Reviewed by Sam Weinig.
-        
+
         Fix https://bugs.webkit.org/show_bug.cgi?id=22141
         REGRESSION: Safari error page is not fully styled when loaded from cache
-        
+
         Reset text decoder on flush so it does not pass through the BOM when it is reused.
 
         Test: fast/encoding/css-cached-bom.html
@@ -15875,7 +69253,7 @@
         (WebCore::TextResourceDecoder::flush):
 
 2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
- 
+
         Reviewed by Mark Rowe.
 
         Send URL errors to stderr rather than stdout. While debugging wx DumpRenderTree,
@@ -15886,7 +69264,7 @@
 
 2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
 
-        wx build fixes after addition of JSCore parser and bycompiler dirs. 
+        wx build fixes after addition of JSCore parser and bycompiler dirs.
 
         * webcore-base.bkl:
         * webcore-wx.bkl:
@@ -15896,13 +69274,13 @@
         Reviewed by Dan Bernstein
 
         https://bugs.webkit.org/show_bug.cgi?id=21906
-        
+
         Override addFocusRingRects() in RenderTextControl to avoid
         the RenderFlow behavior of recursing on descendent renderers.
         RenderTextControl should only ever need a simple focus rect.
-        
+
         This fixes focus ring issues with transforms on text controls.
-        
+
         Test: fast/transforms/transformed-focused-text-input.html
 
         * rendering/RenderTextControl.cpp:
@@ -15996,7 +69374,7 @@
         Reviewed by Dan Bernstein
 
         https://bugs.webkit.org/show_bug.cgi?id=22122
-        
+
         Use a stack-based object to simplify the pushLayoutState/popLayoutState
         code. LayoutStateMaintainer either pushes in the constructor, or allows
         an explicit push() later. Both cases require an explicit pop().
@@ -16072,10 +69450,10 @@
         Reviewed by Dan Bernstein.
 
         https://bugs.webkit.org/show_bug.cgi?id=22093
-        
+
         Delaying the text decoding caused regression since the decoding
-        also determines the encoding in case of @charset rule. 
-        
+        also determines the encoding in case of @charset rule.
+
         Decode immediately in data() and keep the decoded string around
         during the checkNotify().
 
@@ -16130,7 +69508,7 @@
         NPN_HasPropertyUPP and NPN_HasMethodUPP entries in NPNetscapeFuncs are NULL
 
         Export _NPN_HasMethod and _NPN_HasProperty.
-        
+
         * WebCore.NPAPI.exp:
 
 2008-11-06  Simon Fraser  <simon.fraser@apple.com>
@@ -16138,7 +69516,7 @@
         Reviewed by Antti Koivisto
 
         https://bugs.webkit.org/show_bug.cgi?id=15678
-        
+
         Fix transformed menu selects to show the popup in the correct
         location.
 
@@ -16226,7 +69604,7 @@
 2008-11-06  Steve Falkenburg  <sfalken@apple.com>
 
         Fix failed assert at launch caused by unintialized data member.
-        
+
         Reviewed by Maciej Stachowiak.
 
         * platform/network/win/NetworkStateNotifierWin.cpp:
@@ -16455,10 +69833,10 @@
         Reviewed by Dave Hyatt
 
         https://bugs.webkit.org/show_bug.cgi?id=21870
-        
+
         Implement absoluteToLocal() to convert a point from absolute
         to local coordinates, optionally taking transforms into account.
-        
+
         Use this to set offsetX/offsetY in mouse events, thus fixing
         offsetX/offsetY in events on elements with transforms.
 
@@ -16651,15 +70029,15 @@
 2008-11-05  Antti Koivisto  <antti@apple.com>
 
         Reviewed by Dan Bernstein.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=22093
         Don't keep decoded stylesheet data in cache
-        
+
         <rdar://problem/6343588>
 
         Don't keep decoded stylesheet string around in the cache. There are no sharing benefits and
         performance benefits are negligible (no measured PLT impact). Reduces memory consumption of
-        style sheet data in cache by 2/3 in common case.  
+        style sheet data in cache by 2/3 in common case.
 
         * loader/CachedCSSStyleSheet.cpp:
         (WebCore::CachedCSSStyleSheet::sheetText):
@@ -16755,10 +70133,10 @@
         Reviewed by Beth Dakin.
 
         <rdar://problem/5480736> In Mail and Gmail, copied indented text pastes with line break
-        
-        As a rule, we don't allow merges out of blockquotes.  In the bug, we are inserting a text node 
+
+        As a rule, we don't allow merges out of blockquotes.  In the bug, we are inserting a text node
         between two blockquotes.  Because the start merge moves the text node into a blockquote, when we
-        determine whether or not we should do the end merge, it incorrectly appears as though the end merge 
+        determine whether or not we should do the end merge, it incorrectly appears as though the end merge
         is merging out of a blockquote.  The fix is to determine whether or not we should do the end merge
         before we do the start merge, so that the start merge doesn't effect our decision.
 
@@ -16870,7 +70248,7 @@
         Reviewed by Dan Bernstein.
 
         Remove two global destructors from CoreTextController.
-        
+
         * platform/graphics/mac/CoreTextController.cpp:
         (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
 
@@ -17021,12 +70399,12 @@
         reported by zdobersek in #webkit.
 
 2008-11-04  Darin Fisher  <darin@chromium.org>
- 
+
         Reviewed by Anders Carlsson.
- 
+
         No need to clobber all ResourceRequest fields in FrameLoader::reload()
         https://bugs.webkit.org/show_bug.cgi?id=21949
- 
+
         * loader/FrameLoader.cpp:
         (WebCore::FrameLoader::reload):
 
@@ -17684,7 +71062,7 @@
 
         When computing the bounds of the transparency layer, we need to
         map the clipRect through the enclosing transform.
-        
+
         Test: fast/layers/opacity-transforms.html
 
         * rendering/RenderLayer.cpp:
@@ -17696,7 +71074,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=22053
 
-        Added additional support needed for the NPDrawingModelCoreAnimation drawing model. 
+        Added additional support needed for the NPDrawingModelCoreAnimation drawing model.
 
         * bridge/npapi.h:
 
@@ -17910,7 +71288,7 @@
         WebCore Windows part of fix for <rdar://problem/5839256> FILE CONTROL: multi-file upload.
         https://bugs.webkit.org/show_bug.cgi?id=22008
 
-        * platform/FileChooser.cpp: (WebCore::FileChooser::chooseIcon): 
+        * platform/FileChooser.cpp: (WebCore::FileChooser::chooseIcon):
         Rename newIconForFile and newIconForFiles to createIconForFile and createIconForFiles.
         * platform/graphics/Icon.h: ditto.
         * platform/graphics/gtk/IconGtk.cpp:
@@ -17929,9 +71307,9 @@
         (WebCore::Icon::createIconForFile): ditto.
         (WebCore::Icon::createIconForFiles): Add creation of an icon for multiple files.
 
-        * rendering/RenderThemeWin.cpp: (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):        
+        * rendering/RenderThemeWin.cpp: (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
         Improve icon creation code to match new code in Icon::createIconForFiles
-        
+
 2008-10-31  Timothy Hatcher  <timothy@apple.com>
 
         Add manual tests that check breakpoints on a blockless body of "for" loops.
@@ -18091,7 +71469,7 @@
         Reviewed by Sam Weinig
 
         https://bugs.webkit.org/show_bug.cgi?id=21967
-        
+
         For some platforms the GeolocationService must be suspended and resumed.
 
         * page/Geolocation.cpp:
@@ -18110,7 +71488,7 @@
         Reviewed by Sam Weinig
 
         https://bugs.webkit.org/show_bug.cgi?id=21966
-        
+
         The Geolocation spec was updated on 10/27/2008. This brings WebCore up to date.
         http://dev.w3.org/geo/api/spec-source.html
 
@@ -18144,15 +71522,15 @@
         <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
 
         * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): 
-        Don't store the endingSelection() in selection, just call endingSelection() in the few places it's 
+        (WebCore::BreakBlockquoteCommand::doApply):
+        Don't store the endingSelection() in selection, just call endingSelection() in the few places it's
         needed.  This function is cheap since it just returns a reference to a Selection instead of creating one.
         Don't store an affinity.  In the one place that it was used, isLastVisiblePositionInNode(VisiblePosition(pos, affinity), topBlockquote),
         we now use visiblePos (in order to avoid VisiblePosition creation).
-        Set pos after we delete the current selection (if there is one), and be consistent about what we set 
+        Set pos after we delete the current selection (if there is one), and be consistent about what we set
         pos to.  Before, we upstream()ed it if there was a selection to delete and left it alone otherwise.  In fact...
-        ...we need to use downstream() for pos so that when a caret is at the boundary between two nodes, pos is 
-        in the first node that we want to move.  This fixes the bug, since it lets code that checks for the case 
+        ...we need to use downstream() for pos so that when a caret is at the boundary between two nodes, pos is
+        in the first node that we want to move.  This fixes the bug, since it lets code that checks for the case
         where the caret is between text and a br work correctly.
 
 2008-10-30  Yael Aharon  <yael.aharon@nokia.com>
@@ -18179,10 +71557,10 @@
         <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
 
         * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): Added comments.  Don't need to use newStartNode.  If the 
-        startNode needs to change, change it.  Afterwords, check to make sure that it hasn't left topBlockquote.  
-        This is slightly stricter than before, where we just made sure that it still had a topBlockquote.  This 
-        doesn't really fix a bug, since we can't really get into a situation where we move to a different 
+        (WebCore::BreakBlockquoteCommand::doApply): Added comments.  Don't need to use newStartNode.  If the
+        startNode needs to change, change it.  Afterwords, check to make sure that it hasn't left topBlockquote.
+        This is slightly stricter than before, where we just made sure that it still had a topBlockquote.  This
+        doesn't really fix a bug, since we can't really get into a situation where we move to a different
         topBlockquote, but it simplifies the code.
 
 2008-10-30  Dirk Schulze  <vbs85@gmx.de>
@@ -18348,7 +71726,7 @@
 
         Some preparation for:
         <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
-        
+
         Added an early return to avoid a level of if-nesting.  No other changes.  We probably don't
         need to rebalance whitespace before the early return but for now don't risk any change in behavior
         I'll revisit that later.
@@ -18359,7 +71737,7 @@
 2008-10-29  Kevin Ollivier  <kevino@theolliviers.com>
 
         wx build fixes after addition of runtime and ImageBuffer changes.
-        
+
         * platform/graphics/wx/ImageBufferData.h: Added.
         * platform/graphics/wx/ImageBufferWx.cpp:
         (WebCore::ImageBufferData::ImageBufferData):
@@ -18507,7 +71885,7 @@
         (WebCore::Document::~Document):
         Moved active object and MessagePort tracking up to ScriptExecutionContext, to share code
         with workers.
-        
+
         * dom/Document.h:
         (WebCore::Document::isDocument):
         (WebCore::Document::refScriptExecutionContext):
@@ -18580,8 +71958,8 @@
 
         * editing/Editor.cpp:
         (WebCore::Editor::ignoreSpelling): Remove misspelling markers from the word.
-        (WebCore::Editor::learnSpelling): Added a FIXME about <rdar://problem/5396072>, which 
-        will probably require a change more complicated than just marking the learned word as 
+        (WebCore::Editor::learnSpelling): Added a FIXME about <rdar://problem/5396072>, which
+        will probably require a change more complicated than just marking the learned word as
         misspelled.  I'll address it with a separate patch.
         * editing/EditorCommand.cpp:
         (WebCore::executeIgnoreSpelling): Added.
@@ -19028,10 +72406,10 @@
 2008-10-27  Kevin Watters  <kevinwatters@gmail.com>
 
         Reviewed by Kevin Ollivier.
-        
+
         Update the active state as well as the focused state as both need to be true
         for the caret to be drawn.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=21900
 
         * WebView.cpp:
@@ -19119,7 +72497,7 @@
         Reviewed by Sam Weinig.
 
         No need to call release if the connection is null.
-        
+
         * platform/network/mac/ResourceHandleMac.mm:
         (WebCore::ResourceHandle::start):
 
@@ -19128,9 +72506,9 @@
         Reviewed by Kevin Decker.
 
         <rdar://problem/6322650> Crash in fast/loader/simultaneous-reloads-assert.html
-        
+
         Make sure to null check the NSURLConnection object.
-        
+
         * platform/network/mac/ResourceHandleMac.mm:
         (WebCore::ResourceHandle::start):
         (WebCore::ResourceHandle::setDefersLoading):
@@ -19172,7 +72550,7 @@
 2008-10-25  Geoffrey Garen  <ggaren@apple.com>
 
         Not reviewed.
-        
+
         Try to fix Mac debug build on the buildbot.
 
         * platform/FileChooser.cpp:
@@ -19301,40 +72679,40 @@
         Reviewed by Sam Weinig.
 
         <rdar://problem/5440917> Support NPN_Construct
-                
+
         * WebCore.NPAPI.exp:
         Export _NPN_Construct.
-        
+
         * bridge/NP_jsobject.cpp:
         (_NPN_Construct):
         Implement this.
-        
+
         * bridge/c/c_instance.cpp:
         (JSC::Bindings::CInstance::supportsConstruct):
         (JSC::Bindings::CInstance::invokeConstruct):
         Have this call the appropriate NPClass method.
-        
+
         * bridge/npruntime.h:
         Add NPN_Construct.
 
         * bridge/npruntime_impl.h:
         Add _NPN_Construct.
-        
+
         * bridge/runtime.h:
         (JSC::Bindings::Instance::supportsConstruct):
         (JSC::Bindings::Instance::invokeConstruct):
         New methods.
-        
+
         * bridge/runtime_object.cpp:
         (JSC::callRuntimeConstructor):
         Call the native instance.
-        
+
         (JSC::RuntimeObjectImp::getConstructData):
         Implement this.
-        
+
         * bridge/runtime_object.h:
         Add new method declarations.
-        
+
         * plugins/gtk/PluginPackageGtk.cpp:
         (WebCore::PluginPackage::load):
         * plugins/qt/PluginPackageQt.cpp:
@@ -19376,9 +72754,9 @@
         This is consistent with the direction HTML5 will be going in the future.
 
         The initial implementation here will show "n files" as the text next to the control when multiple files are selected.  You can view
-        the individual files in a tooltip for now.  Improvements to this control will come later.  
+        the individual files in a tooltip for now.  Improvements to this control will come later.
 
-        Web developers will be able to access the FileList from the HTMLInputElement element, where they can get a base name and a size for each file.  
+        Web developers will be able to access the FileList from the HTMLInputElement element, where they can get a base name and a size for each file.
         These FileList Files can also be sent in an XMLHTTPRequest.
 
         * manual-tests/post-multi-file-upload.html: Added.
@@ -19396,7 +72774,7 @@
         but we don't want to break the behavior for existing websites that may rely on this.
         (WebCore::HTMLInputElement::setValue): ditto.
         (WebCore::HTMLInputElement::setValueFromRenderer): This is no longer used for file upload controls. setFileListFromRenderer is used instead.
-        (WebCore::HTMLInputElement::setFileListFromRenderer): Added. 
+        (WebCore::HTMLInputElement::setFileListFromRenderer): Added.
         * html/HTMLInputElement.h:
 
         * page/Chrome.cpp: (WebCore::Chrome::setToolTip): Show a tooltip with the file name list for the multi-file upload control.
@@ -19466,9 +72844,9 @@
         Reviewed by Sam Weinig.
 
         https://bugs.webkit.org/show_bug.cgi?id=21475
-        
+
         Provide support for the Geolocation API
-        
+
         http://dev.w3.org/geo/api/spec-source.html
 
         Test: geolocation/geolocation-not-implemented.html
@@ -19583,7 +72961,7 @@
         Reviewed by Darin Adler
 
         https://bugs.webkit.org/show_bug.cgi?id=21818
-        
+
         Add HashTraits for AtomicString so that AtomicString can be used as
         the key for a HashMap or HashSet.
 
@@ -19611,7 +72989,7 @@
 
         Add WebKitCSSKeyframeRule and WebKitCSSKeyframesRule to the
         switch in _wrapCSSRule.
-        
+
         * bindings/objc/DOMCSS.mm:
         (+[DOMCSSRule _wrapCSSRule:WebCore::]):
 
@@ -19917,9 +73295,9 @@
         Reviewed by Sam Weinig.
 
         https://bugs.webkit.org/show_bug.cgi?id=21475
-        
+
         Provide support for the Geolocation API
-        
+
         http://dev.w3.org/geo/api/spec-source.html
 
         Test: geolocation/geolocation-not-implemented.html
@@ -20142,7 +73520,7 @@
         Reviewed by Oliver Hunt.
 
         * platform/network/curl/ResourceRequest.h:  A better implementation
-          of CFURLRequest, rather than void*.  This gives better compatibility 
+          of CFURLRequest, rather than void*.  This gives better compatibility
           with the WebKit.idl interface.
         (WebCore::ResourceRequest::cfURLRequest):
 
@@ -20342,7 +73720,7 @@
 
         - fix https://bugs.webkit.org/show_bug.cgi?id=21809
 
-        Remove PLATFORM(MAC) wrapping USE(ATSUI). It's redundant and inhibits 
+        Remove PLATFORM(MAC) wrapping USE(ATSUI). It's redundant and inhibits
         its use for PLATFORM(CHROMIUM) in the future.
 
         * platform/graphics/SimpleFontData.h:
@@ -20350,7 +73728,7 @@
 2008-10-22  David Smith  <catfish.man@gmail.com>
 
         Reviewed by Anders Carlsson.
-               
+
         https://bugs.webkit.org/show_bug.cgi?id=19974
         getElementsByClassName not live enough
 
@@ -20423,11 +73801,11 @@
 
         <rdar://6261773> - autocomplete="off" doesn't work on Windows
 
-        Visual Studio makes a poor decision regarding the combination of enums and bitfields, such that a 
-        statement like "m_autocomplete = Off" followed by "return m_autocomplete == Off" would return "false" 
+        Visual Studio makes a poor decision regarding the combination of enums and bitfields, such that a
+        statement like "m_autocomplete = Off" followed by "return m_autocomplete == Off" would return "false"
         instead of the much more correct "true."
-        
-        In the past we have worked around this by declaring the bitfield member as an unsigned instead 
+
+        In the past we have worked around this by declaring the bitfield member as an unsigned instead
         of the enum type.
 
         For more discussion, see http://trac.webkit.org/changeset/25329
@@ -20511,11 +73889,11 @@
 
         Make sure that the AtomicString that identifies a set of animation keyframes
         stays live by keeping a copy in the WebKitCSSKeyframesRule.
-        
+
         Also call styleSheetChanged() when the keyframes name changes, but
         add an internal method that doesn't call styleSheetChanged() for use
         during normal stylesheet parsing.
-        
+
         Test: animations/change-keyframes-name.html
 
         * css/CSSGrammar.y:
@@ -20647,14 +74025,14 @@
 
         Reviewed by Darin Adler.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20352 
-        REGRESSION(r31030-31055): Choosing "Print window" from frame set 
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20352
+        REGRESSION(r31030-31055): Choosing "Print window" from frame set
         prints blank page
         and corresponding: <rdar://problem/6142398>
 
-        viewHeight() and viewWidth() only return valuable information if we 
-        are not printing. Everywhere else in the code, we make sure we are 
-        not printing before we call these functions. Adding a check for 
+        viewHeight() and viewWidth() only return valuable information if we
+        are not printing. Everywhere else in the code, we make sure we are
+        not printing before we call these functions. Adding a check for
         printing here fixes this bug, and framesets print again.
 
         * rendering/RenderFrameSet.cpp:
@@ -20677,7 +74055,7 @@
 
         Add a comment explaining layoutDelta(), and an assertion
         that checks that delta changes were correctly paired during layout.
-        
+
         * rendering/RenderView.cpp:
         (WebCore::RenderView::layout):
         * rendering/RenderView.h:
@@ -20733,9 +74111,9 @@
         Fix https://bugs.webkit.org/show_bug.cgi?id=21763
         REGRESSION (r36108-r36113): Can't load picture content on wired.com galleries
         <rdar://problem/6285025
-        
+
         If we get 304 response we need to explicitly check if that completes the frame load.
-        
+
         No test case, simulating the condition is pretty difficult.
 
         * loader/loader.cpp:
@@ -20746,9 +74124,9 @@
         Reviewed by Mark Rowe.
 
         Work around <rdar://problem/6301728>.
-        
+
         Don't assert that loads are deferred when we're using CFNetwork on Mac or Windows.
-        
+
         * loader/MainResourceLoader.cpp:
         (WebCore::MainResourceLoader::didReceiveResponse):
         (WebCore::MainResourceLoader::didReceiveData):
@@ -20759,13 +74137,13 @@
 
         Reviewed by Adele Peterson.
 
-        Speculative fix for <rdar://problem/6242585> CrashTracer: [USER] 19 
+        Speculative fix for <rdar://problem/6242585> CrashTracer: [USER] 19
         crashes in Safari at com.apple.WebCore
         WebCore::ScrollView::visibleContentRect const + 153
 
-        d->m_view can be null and is null-checked at other points in the 
-        code. The logs indicate that this crash occurs when closing a 
-        window containing a PDF, so in case where we crash, the PDF's view 
+        d->m_view can be null and is null-checked at other points in the
+        code. The logs indicate that this crash occurs when closing a
+        window containing a PDF, so in case where we crash, the PDF's view
         is probably already null. So the fix is to simply add a null-check.
 
         * page/Frame.cpp:
@@ -20996,7 +74374,7 @@
 
         Reviewed by Jon Honeycutt
 
-        Fix a crash in Accessibility where a table section was being 
+        Fix a crash in Accessibility where a table section was being
         referenced without first checking if it was null
 
         https://bugs.webkit.org/show_bug.cgi?id=21721
@@ -21114,7 +74492,7 @@
         (WebCore::JavaScriptDebugServer::recompileAllJSFunctionsSoon):
         (WebCore::JavaScriptDebugServer::didAddListener):
         (WebCore::JavaScriptDebugServer::didRemoveListener):
-        * inspector/JavaScriptDebugServer.h: Exported an API for recompiling, 
+        * inspector/JavaScriptDebugServer.h: Exported an API for recompiling,
         used by the Settings object.
 
         * page/Settings.cpp:
@@ -21955,9 +75333,9 @@
 2008-10-17  Kevin Watters  <kevinwatters@gmail.com>
 
         Reviewed by Kevin Ollivier
-        
+
         Fix wx port's scrollbar and drawing handling after recent changes.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=21720
 
         * platform/ScrollView.h:
@@ -22496,7 +75874,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=21587
         NPN_PluginThreadAsyncCall does not work properly
-        
+
         * plugins/PluginMainThreadScheduler.cpp:
         (WebCore::PluginMainThreadScheduler::dispatchCalls):
         Make sure to set m_callPending to false once the queue has been cleared.
@@ -22619,7 +75997,7 @@
 
         Reviewed by Sam Weinig.
 
-        Implement didSendBodyData delegate method, and use older code path when that delegate doesn't exist. 
+        Implement didSendBodyData delegate method, and use older code path when that delegate doesn't exist.
 
         * platform/network/ResourceHandle.h:
         * platform/network/mac/FormDataStreamMac.mm: (WebCore::formRead):
@@ -22704,11 +76082,11 @@
 
         Reviewed by Darin Adler, tweaked and landed by Beth.
 
-        * WebCore.base.exp: Exposes two functions to be able to create a 
-        selection from a point on the screen. Also exposes the new 
+        * WebCore.base.exp: Exposes two functions to be able to create a
+        selection from a point on the screen. Also exposes the new
         TextIterator::currentNode function.
         * WebCore/editing/TextIterator.cpp:
-        (TextIterator::currentNode) : New function that returns the current 
+        (TextIterator::currentNode) : New function that returns the current
         text node or NULL if there is no text node.
 
 2008-10-15  Marco Barisione  <marco.barisione@collabora.co.uk>
@@ -22951,7 +76329,7 @@
 2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
 
         Reviewed by Simon.
-        
+
         Fix QtWebKit scrollbar painting errors
 
         * platform/qt/ScrollbarThemeQt.cpp:
@@ -22972,7 +76350,7 @@
         Reviewed by Simon.
 
         Use style-painter to draw scrollbars in ScrollbarThemeQt
-        
+
         This has the benefit of setting up the painter properly without
         antialiasing and saving and restoring the brush. It also ensures
         that we use the style of the QWebView over the QApplication style
@@ -23053,7 +76431,7 @@
 2008-10-13  Maciej Stachowiak  <mjs@apple.com>
 
         Rubber stamped by Mark Rowe.
-        
+
         - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
 
         * Configurations/DebugRelease.xcconfig:
@@ -23085,7 +76463,7 @@
         Links from image maps were not being included in the web area's AXLinkUIElements attribute.
         The position of image map links was being reported incorrectly and the parent-chain
         hierarchy for image map links was incorrect because image map links did not have a reference
-        to their parent image. 
+        to their parent image.
 
         Test: accessibility/document-links.html
 
@@ -23309,7 +76687,7 @@
         but changes \r, \n, and \r\n to a single space.
 
         Tests: editing/pasteboard/paste-multiline-text-input.html
-               
+
         * html/HTMLInputElement.cpp:
         (WebCore::HTMLInputElement::constrainValue):
 
@@ -23351,8 +76729,8 @@
 
         Reviewed by Alp Toker.
 
-        Add version parsing for Flash, and the PluginQuirkDontSetNullWindowHandleOnDestroy 
-        plugin quirk if Flash 10 or newer since at least in b218, setting a NULL window 
+        Add version parsing for Flash, and the PluginQuirkDontSetNullWindowHandleOnDestroy
+        plugin quirk if Flash 10 or newer since at least in b218, setting a NULL window
         handler on destroy crashes WebKit <https://bugs.webkit.org/show_bug.cgi?id=19859>
 
         * plugins/gtk/PluginPackageGtk.cpp:
@@ -23747,7 +77125,7 @@
         Reviewed by Darin Adler
 
         https://bugs.webkit.org/show_bug.cgi?id=21538
-        
+
         The blendFunc() for TransformOperations should never mess with the
         operation lists by replacing some ops with identity, otherwise the lists
         no longer match and transitions break.
@@ -23765,7 +77143,7 @@
 
         Fix re-targetting a running transition; if the target property
         changes, we do need to make a new ImplicitAnimation.
-        
+
         Test: transitions/retargetted-transition.html
 
         * page/animation/CompositeAnimation.cpp:
@@ -23996,7 +77374,7 @@
 
         Redesigned how animation events are sent in order to get rid of
         AnimationEventDispatcher. ImplicitAnimation and KeyframeAnimation
-        are now ref counted. While calling the event handler, I keep a 
+        are now ref counted. While calling the event handler, I keep a
         reference to this class to avoid it getting destroyed out from under me.
 
         I also moved most of the functionality of CompositeAnimation to
@@ -24112,7 +77490,7 @@
         Media controls should not show when element is not visible
 
         https://bugs.webkit.org/show_bug.cgi?id=21155
-        
+
         Reviewed by Adele Peterson.
 
         * html/HTMLMediaElement.cpp:
@@ -24369,7 +77747,7 @@
         Gradient clips were not getting cleared after filling the
         gradient, this was causing nothing to draw in Canvex
         https://bugs.webkit.org/show_bug.cgi?id=21498
-        
+
         Tests forthcoming.
 
         * WebCore.xcodeproj/project.pbxproj:
@@ -24381,10 +77759,10 @@
 2008-10-09  Eric Seidel  <eric@webkit.org>
 
         Reviewed by Oliver Hunt.
-        
+
         Fix transformed patterns
         https://bugs.webkit.org/show_bug.cgi?id=21498
-        
+
         Test: fast/canvas/patternfill-repeat.html
 
         * WebCore.xcodeproj/project.pbxproj:
@@ -24793,7 +78171,7 @@
         Reviewed by Antti Koivisto.
 
         <rdar://problem/6273887> Crash in ApplicationCacheGroup
-        
+
         Make sure to stop loading even before a cache update is in progress so that the
         manifest load will be stopped.
 
@@ -24895,7 +78273,7 @@
             scrollbar-corner
             scrollbar-thumb
             scrollbar-track
-        
+
         These elements will work with all the usual pseudo-classes (:hover, :active, :enabled, :disabled, etc.) and with
         the following new pseudo-classes:
             scrollbar-active
@@ -24903,7 +78281,7 @@
             scrollbar-forward
             scrollbar-horizontal
             scrollbar-vertical
-        
+
         Reviewed by Adele
 
         * css/CSSSelector.cpp:
@@ -25036,7 +78414,7 @@
 2008-10-06  Jeremy Moskovich  <jeremy@chromium.org>
 
         Reviewed by Dan Bernstein.
-        
+
         Added C++ forward declaration for the NSURLAuthenticationChallenge class
         so that the m_currentMacChallenge variable doesn't cause a
         compilation error when ResourceHandleInternal.h is included from a C++ file.
@@ -25054,7 +78432,7 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=21416
         Add missing null checks identified by Application Verifier.
-        
+
         Reviewed by Darin Adler.
 
         * platform/win/SharedTimerWin.cpp:
@@ -25098,7 +78476,7 @@
 2008-10-03  Steve Falkenburg  <sfalken@apple.com>
 
         <rdar://problem/6249833> Fix default button appearance
-        
+
         Reviewed by Adele Peterson.
 
         * rendering/RenderThemeWin.cpp:
@@ -25178,7 +78556,7 @@
 
         SVG should support ascent and descent properties <font-face> instead of <font>!
         https://bugs.webkit.org/show_bug.cgi?id=21365
-        
+
         Tested by many many existing SVG tests.
 
         * svg/SVGFontFaceElement.cpp:
@@ -25293,7 +78671,7 @@
 
         The solution is to track whether we are entering or reentering the parsing
         of a script element.  We do this simply by 0 checking scriptStartLineno,
-        and resetting it after we complete parsing of each script element. 
+        and resetting it after we complete parsing of each script element.
 
         Test: http/tests/incremental/pause-in-script-element.pl
 
@@ -25925,11 +79303,11 @@
 2008-10-03  David Hyatt  <hyatt@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=21340
-        
+
         Remove "containingWindow()/setContainingWindow()" from Widget.  HostWindow covers this now.
-    
+
         Reviewed by Dan Bernstein & Darin Adler
-        
+
         * platform/ScrollView.cpp:
         (WebCore::ScrollView::addChild):
         * platform/Widget.cpp:
@@ -25996,7 +79374,7 @@
 
         Reviewed by Dan Bernstein.
 
-        Fix for <rdar://problem/6012018> 
+        Fix for <rdar://problem/6012018>
         https://bugs.webkit.org/show_bug.cgi?id=21335
         CrashTracer: [USER] 4959 crashes in Safari at com.apple.WebCore: WebCore::Frame::settings const + 8
 
@@ -26026,7 +79404,7 @@
 2008-10-03  David Hyatt  <hyatt@apple.com>
 
         Remove addToDirtyRegion.
-        
+
         Reviewed by Oliver Hunt
 
         * page/Chrome.cpp:
@@ -26041,7 +79419,7 @@
 
         Reviewed by Maciej Stachowiak.
 
-        - fix a CachedResource leak introduced in r37176 
+        - fix a CachedResource leak introduced in r37176
 
         Undo r37176 and instead allow pruneDeadResources() to be re-entered, but
         afterwards bail out of the outer pruneDeadResources().
@@ -26058,7 +79436,7 @@
 
         Fix Gtk adjustments so that they are properly checked again before creating horizontal/vertical
         scrollbars.
-        
+
         Reviewed by Oliver Hunt
 
         * platform/ScrollView.cpp:
@@ -26113,16 +79491,16 @@
 2008-10-02  David Hyatt  <hyatt@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=21328
-        
+
         Make widget invalidation more cross-platform.
-        
+
         (1) Make invalidateRect a pure virtual function on Widget.  All leaf widgets must now implement this function.
-        
+
         (2) Scrollbars now send invalidations through the ScrollbarClient.  windowClipRect on ScrollbarClient has been removed and replaced with this invalidation call.
         This allows all scrollbar invalidations to go through the render tree so that transforms and reflections will be respected.
-        
+
         (3) Plugins now have the native window invalidation code for windowed plugins.  Windowless plugins do a repaintRectangle on the plugin's renderer.
-        
+
         (4) FrameViews now do a repaintRectangle on their owner element's renderer.
 
         Reviewed by Sam Weinig
@@ -26197,7 +79575,7 @@
 
         Reviewed by Dave Hyatt
 
-        Fix RenderFileUploadControl::setStyle() and 
+        Fix RenderFileUploadControl::setStyle() and
         RenderMenuList::setStyle() to not touch the style; replace
         with html4.css and CSSStyleSelector changes.
 
@@ -26218,9 +79596,9 @@
 
         Clean up code that changes the RenderStyle passed in to
         table renderer setStyle() methods.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=21287
-        
+
         Tests: fast/table/floating-th.html
                fast/table/table-display-types-strict.html
                fast/table/table-display-types.html
@@ -26308,7 +79686,7 @@
         - fix a Database leak that resulted in Document leaks
 
         * storage/Database.cpp:
-        (WebCore::Database::openDatabase): Account for the fact that RefCounted 
+        (WebCore::Database::openDatabase): Account for the fact that RefCounted
         objects start out with a ref count of 1.
 
 2008-10-02  Sam Weinig  <sam@webkit.org>
@@ -26323,7 +79701,7 @@
 2008-10-02  David Hyatt  <hyatt@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=21314
-        
+
         Make scrollBackingStore cross-platform.
 
         Reviewed by Sam Weinig
@@ -26406,14 +79784,14 @@
 2008-10-01  David Hyatt  <hyatt@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=21298
-        
+
         Make updateScrollbars cross-platform.  For now a stubbed out scrollContents function is invoked to do the scrolling of the backing store.  Next patch
-        will make that cross-platform.  
-        
+        will make that cross-platform.
+
         The ScrollView now implements ScrollbarClient, which means that there was a clash of windowClipRect methods from the
         multiple inheritance.  For now I solved this by adding a Scrollbar* to the ScrollbarClient version of the method, but longer term
         windowClipRect is going to be removed from ScrollbarClient (when Widget invalidation gets rewritten).
-        
+
         Reviewed by Sam Weinig
 
         * page/FrameView.cpp:
@@ -26507,7 +79885,7 @@
         (WebCore::XMLHttpRequest::detachRequests):
         (WebCore::XMLHttpRequest::setPendingActivity):
         (WebCore::XMLHttpRequest::unsetPendingActivity):
-        Moved XMLHttpRequest tracking from a global map to Document. 
+        Moved XMLHttpRequest tracking from a global map to Document.
 
         * bindings/js/JSDOMBinding.cpp:
         (WebCore::wrapperSet):
@@ -26595,7 +79973,7 @@
 2008-10-02  Geoffrey Garen  <ggaren@apple.com>
 
         Not reviewed.
-        
+
         Try to fix Windows build.
 
         * WebCore.vcproj/WebCore.vcproj:
@@ -26666,7 +80044,7 @@
         (WebCore::JavaScriptDebugServer::didExecuteProgram):
         (WebCore::JavaScriptDebugServer::didReachBreakpoint):
         * page/JavaScriptDebugServer.h:
-        * page/inspector/ScriptsPanel.js: Renamed internal uses of sourceId and 
+        * page/inspector/ScriptsPanel.js: Renamed internal uses of sourceId and
         sourceIdentifier to sourceID.
 
 2008-10-01  Dan Bernstein  <mitz@apple.com>
@@ -26739,7 +80117,7 @@
 2008-10-01  Evan Martin  <evan@chromium.org>
 
         Reviewed by Eric Seidel.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=20669
 
         * css/makeprop.pl:
@@ -26759,7 +80137,7 @@
         - fix an assertion failure in http/tests/security/canvas-remote-read-svg-image.html due to re-entry into Cache::pruneDeadResources()
 
         * loader/Cache.cpp:
-        (WebCore::Cache::remove): Disable pruning temporarily during 
+        (WebCore::Cache::remove): Disable pruning temporarily during
         CachedResource deletion.
 
 2008-10-01  Dan Bernstein  <mitz@apple.com>
@@ -26899,9 +80277,9 @@
 2008-10-01  David Hyatt  <hyatt@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=21282
-        
+
         Make contentsToScreen/screenToContents cross-platform.  Only implemented by Mac/Win right now.
-        
+
         Reviewed by Adam Roben
 
         * loader/EmptyClients.h:
@@ -27113,7 +80491,7 @@
         Reviewed by Sam Weinig.
 
         - fix HTMLViewSourceDocument leaks by breaking a ref cycle which
-          was fixed in r17249 and re-introduced in r31435. 
+          was fixed in r17249 and re-introduced in r31435.
 
         * html/HTMLViewSourceDocument.cpp:
         (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument):
@@ -27129,7 +80507,7 @@
         More for https://bugs.webkit.org/show_bug.cgi?id=21122
         Autogenerate JS event listeners
 
-        - Make EventListener getter/setters names in c++ files match those in 
+        - Make EventListener getter/setters names in c++ files match those in
           JS (ie. onLoadListener -> onload).
         - Add standard way to access the frame associated with the EventTarget
           for EventListener lookup.
@@ -27319,12 +80697,12 @@
 
         Reviewed by Darin Adler.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20396 Abort caused 
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20396 Abort caused
         by failed allocation due to invalid counter/attr
         and corresponding: <rdar://problem/6152371>
 
         * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseCounterContent): The spec indicates that 
+        (WebCore::CSSParser::parseCounterContent): The spec indicates that
         only identifiers should be accepted here.
 
 2008-09-30  Kevin McCullough  <kmccullough@apple.com>
@@ -27358,7 +80736,7 @@
         (3) Used on Qt, but implemented incorrectly to cause a full repaint for no reason.
         (4) Used on Gtk, but implemented incorrectly to cause a full repaint for no reason.
         (5) Used on wx, but probably not needed (since wx has platform widgets like Mac).
-        
+
         There is now a paint method on HostWindow that does an immediate mode repaint of an empty rect to
         cause the display/flush to happen if needed (thus saving an extra method on ChromeClient).
         With the changes to this method, the new behavior is as follows:
@@ -27367,10 +80745,10 @@
         (3) Nothing happens on Qt, but only because they have not implemented immediate mode updating.
         (4) Gtk now behaves like Windows and will process updates but not do any incorrect additional invalidation.
         (5) Not used on wx
-        
+
         This method was originally added for Windows. It's not clear the display/flush is really even necessary on the other
         platforms.  At the very least stopping unnecessary full invalidations on Qt/Gtk is a good thing. :)
-        
+
         Reviewed by Sam Weinig
 
         * ChangeLog:
@@ -27441,7 +80819,7 @@
 2008-09-30  Dave Hyatt  <hyatt@apple.com>
 
         http://bugs.webkit.org/show_bug.cgi?id=21250
-        
+
         Rename updateContents to repaintContentRectangle and make it cross-platform by always sending
         repaints up through the ChromeClient.
 
@@ -27656,8 +81034,8 @@
 
         Reviewed by Anders Carlsson.
 
-        * bridge/npapi.h: Tweaked NPNVariable enum. NPNVsupportsCocoaBool,  NPNVsupportsCarbonBool are now in the 3000 range instead of 
-        2000. 
+        * bridge/npapi.h: Tweaked NPNVariable enum. NPNVsupportsCocoaBool,  NPNVsupportsCarbonBool are now in the 3000 range instead of
+        2000.
 
 2008-09-29  Dan Bernstein  <mitz@apple.com>
 
@@ -27750,7 +81128,7 @@
 
         Reviewed by Anders Carlsson
 
-        Fix RenderStyle leak in animation code, and assert that 
+        Fix RenderStyle leak in animation code, and assert that
         keyframe resolution in CSSStyleSelector is not going to clobber
         m_style.
 
@@ -27765,7 +81143,7 @@
 
         Fixed https://bugs.webkit.org/show_bug.cgi?id=20995
         Rewrite keyframe resolution to be like styleForElement()
-        
+
         Test: animations/lineheight-animation.html
 
         * css/CSSStyleSelector.cpp:
@@ -27817,7 +81195,7 @@
 
         Clean up fix in PropertyWrapperGetter::equals
         https://bugs.webkit.org/show_bug.cgi?id=21011
-        
+
         Test: transitions/override-transition-crash.html
 
         * page/animation/AnimationBase.cpp:
@@ -28412,10 +81790,10 @@
 
         fix https://bugs.webkit.org/show_bug.cgi?id=20994
         <rdar://problem/6171023> HTMLVideoElement width and height attributes are now unsigned
-        
+
         HTML5 spec says HTMLVideoElement width and height attributes should be unsigned. Convert
         all unsigned media attributes from string with toUInt() instead of toInt().
-        
+
         * html/HTMLMediaElement.cpp:
         (WebCore::HTMLMediaElement::playCount): convert from attribute with toUInt().
 
@@ -28466,7 +81844,7 @@
 
         There was a lot wrong with 17589, so more patches will be coming to deal with the fallout of this patch
         (which should never have landed in the first place).
-       
+
         Reviewed by Tim Hatcher, Sam Weinig
 
         * platform/win/ScrollViewWin.cpp:
@@ -29231,7 +82609,7 @@
         Reviewed by Antti
 
         https://bugs.webkit.org/show_bug.cgi?id=21116
-        <rdar://problem/5726325> Audio from <video> can still be heard after navigating 
+        <rdar://problem/5726325> Audio from <video> can still be heard after navigating
         back to page with <video>, then closing tab
 
         Rename willSaveToCache/didRestoreFromCache callbacks to documentWillBecomeInactive/
@@ -29328,8 +82706,8 @@
         The solution to this is to make sure we cache these constructors
         in the same way as all the other DOM constructors.  To achieve this
         without causing any refcount cycles it is necessary to replace the
-        refcounted document pointer in the Image, MessageChannel, Option, 
-        XMLHttpRequest, and Audio constructor objects with a reference to 
+        refcounted document pointer in the Image, MessageChannel, Option,
+        XMLHttpRequest, and Audio constructor objects with a reference to
         the document's JS wrapper.
 
         Tests: fast/dom/constructors-cached-navigate.html
@@ -29422,7 +82800,7 @@
 2008-09-25  David Hyatt  <hyatt@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=21133
-        
+
         Rename resizeContents method on ScrollView to setContentsSize (to match contentsSize()).  Make it
         cross-platform.
 
@@ -29617,15 +82995,15 @@
 2008-09-25  David Smith  <catfish.man@gmail.com>
 
         Reviewed by Darin Adler.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=20980
         Split off uncommonly used data from Node similar to ElementRareData
-        
+
         Saves an OwnPtr and a short on Node, as well as providing room for an isContainer bit,
         which in turn allows inlining firstChild(), lastChild(), childNodeCount(), and childNode()
         for a 5-10+% performance win on SlickSpeed and assorted speedups on other tests.
 
-        * WebCore.base.exp: 
+        * WebCore.base.exp:
         * WebCore.xcodeproj/project.pbxproj:
         * dom/ChildNodeList.cpp: Include ContainerNode to pick up its definitions for childNodeCount(), etc...
         * dom/ContainerNode.cpp: Set isContainer to true
@@ -29636,7 +83014,7 @@
         (WebCore::Node::containerFirstChild): ditto
         (WebCore::Node::containerLastChild): ditto
         * dom/Element.cpp: Most of the changes here are moving ElementRareData to ElementRareData.h and NodeRareData.h
-        (WebCore::Element::Element): 
+        (WebCore::Element::Element):
         (WebCore::Element::~Element):
         (WebCore::Element::rareData):
         (WebCore::Element::ensureRareData): Renamed from createRareData
@@ -29807,9 +83185,9 @@
 
         https://bugs.webkit.org/show_bug.cgi?id=21052
         Generalize id selector special case for querySelectorAll
-        
+
         By checking the element we get with getElementById against the selector, we can use the special case in many more circumstances.
-        Changes results on http://native.khan.mozilla.org 
+        Changes results on http://native.khan.mozilla.org
         from
             #title: 2ms
             h1#title: 55ms
@@ -29819,7 +83197,7 @@
             #title: 1ms
             h1#title: 2ms
             div #title: 5ms
-        
+
         * dom/Node.cpp:
         (WebCore::Node::querySelector):
         * dom/SelectorNodeList.cpp:
@@ -29983,7 +83361,7 @@
 2008-09-25  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Eric Seidel.
-        
+
         <rdar://problem/6171047> HTMLMediaElement "begin" event is now "loadstart"
         https://bugs.webkit.org/show_bug.cgi?id=21003
 
@@ -30120,10 +83498,10 @@
 2008-09-25  David Smith  <catfish.man@gmail.com>
 
         Reviewed by Eric Seidel
-        
+
         fix https://bugs.webkit.org/show_bug.cgi?id=21091
         Regression: querySelector matches tag names case sensitively
-        
+
         Tests: fast/dom/SelectorAPI/caseTag.html
                fast/dom/SelectorAPI/caseTagX.xhtml
 
@@ -30210,7 +83588,7 @@
         Reviewed by Dan Bernstein.
 
         Test: editing/spelling/inline_spelling_markers.html
-        
+
         - https://bugs.webkit.org/show_bug.cgi?id=20092
         Spelling markers positioned incorrectly in RTL text
 
@@ -30861,7 +84239,7 @@
 
         Fix for bug 21012.  The Aqua scrollbar was returning the wrong track rect on Windows Aqua theme.  Make
         sure to not accidentally fall into the vertical scrollbar case for horizontal scrollbars. :)
-        
+
         Reviewed by Sam Weinig
 
         * platform/mac/ScrollbarThemeMac.mm:
@@ -30874,11 +84252,11 @@
 
         Reviewed by Sam Weinig.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21041 "Add Contact" 
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21041 "Add Contact"
         link at gmail does not support AXPress action
         and corresponding: <rdar://problem/6216178>
 
-        I fixed this bug by making AccessibilityObject::anchorElement 
+        I fixed this bug by making AccessibilityObject::anchorElement
         support ARIA links.
 
         * page/AccessibilityImageMapLink.cpp:
@@ -30903,7 +84281,7 @@
 
         Bug 20949: Catch repeated messages in Inspector Controller to limit
         memory usage
-        - Store the repeat count in the Console Message object, in the 
+        - Store the repeat count in the Console Message object, in the
         Inspector Controller and JS ConsoleMessage object.
 
         * page/InspectorController.cpp:
@@ -31090,7 +84468,7 @@
         ~2% speedup on EarleyBoyer
 
         (WebCore updates.)
-        
+
         * bindings/js/JSQuarantinedObjectWrapper.h:
         (WebCore::JSQuarantinedObjectWrapper::createStructureID):
 
@@ -31133,7 +84511,7 @@
 2008-09-23  Eric Seidel  <eric@webkit.org>
 
         No review, build fix only.
-        
+
         Third time's the charm, eh?  My local build is sadly still not done...
 
         * platform/graphics/AffineTransform.cpp: remove extra &
@@ -31313,7 +84691,7 @@
         transition end event when -webkit-transition-property: all puts wrong
         propertyName in event
         https://bugs.webkit.org/show_bug.cgi?id=20903
-        
+
         * page/animation/ImplicitAnimation.cpp:
         (WebCore::ImplicitAnimation::sendTransitionEvent):
 
@@ -31378,7 +84756,7 @@
         - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag
 
         Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>
-        
+
         2.2% speedup on EarleyBoyer benchmark.
 
         * bindings/js/JSQuarantinedObjectWrapper.cpp:
@@ -31397,11 +84775,11 @@
         Reviewed by Dave Hyatt.
 
         Based on initial work by Darin Adler.
-        
+
         - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
         - use this to JIT inline code for eq_null and neq_null
         https://bugs.webkit.org/show_bug.cgi?id=20823
-        
+
         * WebCore.xcodeproj/project.pbxproj:
         * WebCore.vcproj/WebCore.vcproj:
         * bindings/js/JSCSSStyleDeclarationCustom.cpp:
@@ -31526,7 +84904,7 @@
 
         - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
         https://bugs.webkit.org/show_bug.cgi?id=20981
-        
+
         * bindings/js/JSAudioConstructor.cpp:
         (WebCore::JSAudioConstructor::JSAudioConstructor):
         * bindings/js/JSCSSStyleDeclarationCustom.cpp:
@@ -31589,7 +84967,7 @@
 2008-09-21  Steve Falkenburg  <sfalken@apple.com>
 
         Removed unnecessary nested timer check.
-        
+
         Rubber-stamped by Dan Bernstein.
 
         * platform/win/SharedTimerWin.cpp:
@@ -31599,14 +84977,14 @@
 
         Improve timer resolution on WinXP.
         https://bugs.webkit.org/show_bug.cgi?id=20979
-        
+
         Removed last-chance timer. It should not be necessary.
         Change timeEndPeriod timer to fire in 300ms instead of 20ms. Calling timeBeginPeriod/timeEndPeriod too often throws off accuracy.
         Remove Vista checks. We now run the same code on both XP and Vista.
-        
+
         Call through to JSC::getCurrentUTCTimeWithMicroseconds from WebCore::currentTime.
         The code previously called GetSystemTimeAsFileTime, which is always low-resolution on XP, even within timeBeginPeriod(1).
-        
+
         Reviewed by Maciej Stachowiak.
 
         * platform/win/SharedTimerWin.cpp:
@@ -31740,7 +85118,7 @@
         Reviewed by Dan Bernstein.
 
         Fix memory leak.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=20505
 
         * platform/wx/wxcode/mac/carbon/fontprops.cpp:
@@ -32032,7 +85410,7 @@
 
 2008-09-19  David Hyatt  <hyatt@apple.com>
 
-        Add support for hit testing of all five possible scrollbar button placements. 
+        Add support for hit testing of all five possible scrollbar button placements.
 
         Reviewed by Sam Weinig
 
@@ -32176,7 +85554,7 @@
 
         Fix for <rdar://problem/6231308> crash in AutoTableLayout
 
-        The code assumes later on that a TableSection's grid's row vector 
+        The code assumes later on that a TableSection's grid's row vector
         will never be empty. So make 1 the minimum number of columns.
 
         * rendering/RenderTableSection.cpp:
@@ -32206,7 +85584,7 @@
 2008-09-19  Steve Falkenburg  <sfalken@apple.com>
 
         Roll out r36626. It is causing variance in SunSpider numbers on XP.
-        
+
         Rubber stamped by Mark Rowe.
 
         * platform/win/SharedTimerWin.cpp:
@@ -32436,7 +85814,7 @@
         (WebCore::CoreTextController::CoreTextController): Added a
         mayUseNaturalWritingDirection parameter.
         (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Changed
-        to force the bidi embedding level whenever 
+        to force the bidi embedding level whenever
         m_mayUseNaturalWritingDirectrion is false. Since this is now a common
         case, made the typesetter options dictionaries static.
         * platform/graphics/mac/CoreTextController.h:
@@ -32494,7 +85872,7 @@
 
         <rdar://problem/6213171> WebKit should use new array-centric methods for AX performance
 
-        Implement a few AX API methods that will be called by AppKit, which will 
+        Implement a few AX API methods that will be called by AppKit, which will
         speed up access to accessibility objects
 
         * page/mac/AccessibilityObjectWrapper.mm:
@@ -32744,7 +86122,7 @@
         https://bugs.webkit.org/show_bug.cgi?id=20690
 
         Invoke WebCore::prefetchDNS() on host names that appear in
-        in the href of hyperlinks and <link rel="dns-prefetch">. This 
+        in the href of hyperlinks and <link rel="dns-prefetch">. This
         can be used to implement DNS prefetching.
 
         * WebCore.vcproj/WebCore.vcproj:
@@ -33067,7 +86445,7 @@
 
         Reviewed by Beth Dakin
 
-        <rdar://problem/6224222> AX: should not expose a <table> as an AXTable if ARIA 
+        <rdar://problem/6224222> AX: should not expose a <table> as an AXTable if ARIA
         role specifies otherwise
 
         If a <table> isn't an AXTable, the rows and cells should default to AccessibilityRenderObject
@@ -33094,7 +86472,7 @@
 2008-09-18  Steve Falkenburg  <sfalken@apple.com>
 
         Use higher-resolution timers on all variants of Windows.
-        
+
         Reviewed by Darin Adler.
 
         * platform/win/SharedTimerWin.cpp:
@@ -33133,17 +86511,17 @@
 
         Reviewed by Dave Hyatt.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20515 Crash upon 
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20515 Crash upon
         parsing CSS: unicode-range: searchfield-cancel-buttonpt=-webkit-
         dashboard-region=
         and corresponding: <rdar://problem/6174100>
 
-        This patch makes CSSParserValue::createCSSValue handle unknown 
+        This patch makes CSSParserValue::createCSSValue handle unknown
         identifiers.
 
         * css/CSSParserValues.cpp:
-        (WebCore::CSSParserValue::createCSSValue): If we have an identifier 
-        with no id (an unknown identifier) create a CSSPrimitiveValue of 
+        (WebCore::CSSParserValue::createCSSValue): If we have an identifier
+        with no id (an unknown identifier) create a CSSPrimitiveValue of
         type CSS_PARSER_IDENTIFIER
         * css/CSSPrimitiveValue.cpp:
         (WebCore::CSSPrimitiveValue::cssText):
@@ -33332,7 +86710,7 @@
 
         <rdar://problem/5722310> gracefully handle too many console messages
         (20904)
-        - Keep track of the most previous message and then compare it to the 
+        - Keep track of the most previous message and then compare it to the
         subsequent messages as they come in.  If there are multiple of the same
         message create a count that indicates the current number.
 
@@ -33424,7 +86802,7 @@
 
         Rubber-stamped with love by David Hyatt.
 
-        Split IdentityTransformOperation, MatrixTransformOperation, RotateTransformOperation, 
+        Split IdentityTransformOperation, MatrixTransformOperation, RotateTransformOperation,
         ScaleTransformOperation, SkewTransformOperation, StyleTransformData, TransformOperation,
         TransformOperations and TranslateTransformOperation out of RenderStyle.h/cpp
 
@@ -33640,7 +87018,7 @@
 2008-09-17  Steve Falkenburg  <sfalken@apple.com>
 
         Add back isFrameView check to fix failed assertion during scroll bar teardown.
-        
+
         Reviewed by Dave Hyatt.
 
         * platform/Scrollbar.cpp:
@@ -33719,7 +87097,7 @@
         This is a better fix for: Invalid CSS code crashes Safari
         https://bugs.webkit.org/show_bug.cgi?id=20512
 
-        The spec indicates that the only valid input for a counter is a 
+        The spec indicates that the only valid input for a counter is a
         number or an identifier. So that is exactly what we allow.
 
         * css/CSSParser.cpp:
@@ -33742,7 +87120,7 @@
 
         Reviewed by Adele Peterson.
 
-        Patch for <rdar://problem/6133884> 
+        Patch for <rdar://problem/6133884>
         Calling window.resizeTo() on a subframe shouldn't change the window size
 
         Test: fast/dom/Window/window-resize-and-move-sub-frame.html
@@ -33757,13 +87135,13 @@
 
         Reviewed by Adam Roben.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20512 Invalid CSS 
-        code crashes Safari 
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20512 Invalid CSS
+        code crashes Safari
         and corresponding: <rdar://problem/6173832>
 
-        Reading through the spec, it seems like a function is not valid 
-        input for a counter. So this patch checks for that and bails in the 
-        case of invalid input. 
+        Reading through the spec, it seems like a function is not valid
+        input for a counter. So this patch checks for that and bails in the
+        case of invalid input.
 
         * css/CSSParser.cpp:
         (WebCore::CSSParser::parseCounterContent):
@@ -33772,9 +87150,9 @@
 
         Reviewed by Antti Koivisto.
 
-        Fix <rdar://problem/6227089> 
+        Fix <rdar://problem/6227089>
         Crash in WebCore::Frame::setNeedsReapplyStyles()
-        
+
         View is null checked elsewhere too.
 
         * page/Frame.cpp:
@@ -34317,7 +87695,7 @@
 
         Convert Qt over to its ScrollbarTheme.  Add cross-platform support for jumping the thumb location directly
         to a pressed location on the track (this is done with the middle mouse on Qt and with Shift-Click on Windows).
-      
+
         Reviewed by Sam Weinig
 
         * platform/ScrollBar.cpp:
@@ -34360,9 +87738,9 @@
 2008-09-15  David Smith  <catfish.man@gmail.com>
 
         Reviewed by Sam Weinig.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=20180
-        
+
         Cache the result of parsing the an+b expression in :nth-child(an+b). Roughly a 2x speedup for :nth-child on SlickSpeed.
 
         * GNUmakefile.am: Add CSSNthSelector
@@ -34412,10 +87790,10 @@
 
         Completely switch Windows scrollbars over to ScrollbarTheme.  The Aqua windows scrollbar and native scrollbar
         now share most of their code.
-       
+
         Also removing mini size scrollbar support, since it would have crashed Windows had it ever been used, and it
         also is never used in our code anyway.
-       
+
         Reviewed by Sam Weinig
 
         * WebCore.vcproj/WebCore.vcproj:
@@ -34460,7 +87838,7 @@
 
         Lists are now exposed through AX. On the mac (in SnowLeopard) they use two new subroles
         AXContentList for <ul>, <ol> and AXDefinitionList for <dl>
-        Inside the definition list, each <dt> "term" has an accessibility description ("term"), 
+        Inside the definition list, each <dt> "term" has an accessibility description ("term"),
         as does each <dd> tag ("definition")
 
         Test: accessibility/lists.html
@@ -34648,7 +88026,7 @@
 
         Convert PlatformScrollbarWin to use ScrollbarTheme for hit testing.  PlatformScrollbarQt/Gtk still
         need to be converted.
-        
+
         Reviewed by Sam Weinig
 
         * platform/ScrollBar.cpp:
@@ -34836,12 +88214,12 @@
 
         Reviewed by Maciej.
 
-        <rdar://problem/6163988> 
+        <rdar://problem/6163988>
         https://bugs.webkit.org/show_bug.cgi?id=20457
         Canvas: createPattern crashes WebKit in WTF::RefPtr<WebCore::Image>::operator!() const + 9 with a 1D pattern
-        
+
         Check the width and height and throw an exception if any of them are 0.
-        
+
         * html/CanvasRenderingContext2D.cpp:
         (WebCore::CanvasRenderingContext2D::createPattern):
 
@@ -34896,11 +88274,11 @@
         Reviewed by Dave Hyatt.
 
         https://bugs.webkit.org/show_bug.cgi?id=20180
-        
+
         >2x speedup on querySelector[All] with :nth-child by removing the collectRulesOnly argument on SelectorChecker.
         With collectRulesOnly set to true (the default) an optimization is turned off, and no callers were intentionally leaving it true.
         querySelector[All] assumed that the default was probably the right way to go, and so ended up being slow.
-        
+
         * css/CSSStyleSelector.cpp:
         (WebCore::CSSStyleSelector::CSSStyleSelector):
         (WebCore::CSSStyleSelector::SelectorChecker::SelectorChecker):
@@ -34910,7 +88288,7 @@
 
         Refactor PlatformScrollbarWin's painting so that it is now done by ScrollbarThemeWin.  PlatformScrollbarSafari
         is still painting itself (a subsequent patch will move its painting into ScrollbarThemeSafari).
-       
+
         Reviewed by Sam Weinig
 
         * platform/ScrollBar.h:
@@ -35020,7 +88398,7 @@
         Add a new ScrollbarThemeComposite base class that is shared by ScrollbarThemeSafari and
         ScrollbarThemeWin.  Any scrollbar that wants to render by ScrollbarPart can subclass from this
         theme.
-        
+
         Reviewed by Sam Weinig
 
         * WebCore.vcproj/WebCore.vcproj:
@@ -35190,7 +88568,7 @@
 
         Remove scrollbar's setRect method.  Clients can now just call setFrameGeometry (the corresponding Widget) method
         to set the dimensions of a scrollbar.
-        
+
         Reviewed by Sam Weinig
 
         * platform/ScrollBar.h:
@@ -35225,7 +88603,7 @@
 2008-09-13  Dave Hyatt  <hyatt@apple.com>
 
         Remove setEnabled() from all Scrollbar classes that were just using their Widget base class methods.
-       
+
         Reviewed by Sam Weinig
 
         * platform/ScrollBar.h:
@@ -35302,17 +88680,17 @@
         (WebCore::FontCache::getLastResortFallbackFont): Removed an outdated
         comment (the user's preferred standard font is included in the search
         thanks to code in FontCache::getFontData()) and changed to return the
-        LastResort font.  
+        LastResort font.
 
 2008-09-13  Dave Hyatt  <hyatt@apple.com>
 
         This patch adds ScrollbarTheme to the build.  ScrollbarTheme is similar to RenderTheme (but for
         scrollbars only).  For now ScrollbarTheme just handles returning the size of scrollbars.  Subsequent
         patches will move rendering and hit testing functionality into this class.
-        
+
         Implemented ScrollbarTheme subclasses for four ports (Mac, Win, Gtk, Qt).  The wxWidgets port does not
         implement scrollbars yet, so I added a temporary link stub to keep things compiling on wx.
-       
+
         Reviewed by Sam Weinig
 
         * GNUmakefile.am:
@@ -35414,7 +88792,7 @@
         Move the member variables of PlatformScrollbar up into Scrollbar.  Move autoscroll timer handling
         up into scrollbar.  Make sure a bunch of cross-platform code now just uses "Scrollbar" instead of
         "PlatformScrollbar."
-        
+
         Reviewed by Sam Weinig
 
         * WebCore.vcproj/WebCore.vcproj:
@@ -35535,7 +88913,7 @@
 
         * page/EventHandler.cpp: (WebCore::EventHandler::hitTestResultAtPoint):
         Hit testing again on the main frame will only work if we aren't already on the main frame.  If we are already on the main frame, that will
-        cause infinite recursion.  This change checks that we're not already on the main frame before hit testing again. 
+        cause infinite recursion.  This change checks that we're not already on the main frame before hit testing again.
 
 2008-09-12  Kevin McCullough  <kmccullough@apple.com>
 
@@ -35586,7 +88964,7 @@
         Preparation for major scrollbar rearchitecture.  Eliminate the concept of non-widget based
         scrollbars (which we never supported anyway).  Make Scrollbar derive from Widget directly.
         Remove all the isWidget and hasPlatformScrollbars guards.
-        
+
         Reviewed by Tim Hatcher
 
         * platform/ScrollBar.h:
@@ -35709,7 +89087,7 @@
         Reviewed by Darin
 
         https://bugs.webkit.org/show_bug.cgi?id=20180
-        
+
         This speeds up :nth-child matching as tested by querySelectorAll by around 10% by inlining the common case of Node::renderStyle(). Many thanks to mitzpettel and othermaciej for suggestions and help.
 
         * WebCore.xcodeproj/project.pbxproj: Add NodeRenderStyle.h
@@ -35843,7 +89221,7 @@
 2008-09-09  Dave Hyatt  <hyatt@apple.com
 
         Resurrect PlatformScrollbarWin.
-        
+
         Reviewed by Adam Roben
 
         * WebCore.vcproj/WebCore.vcproj:
@@ -35928,7 +89306,7 @@
         Make the Windows classic case work again.  Overlap in slider constants and other constants broke
         the push state for buttons and checkboxes.  Make sure to check the RenderObject's appearance
         value to make sure it's really a slider thumb to resolve this conflict.
-       
+
         Reviewed by Adam Roben
 
         * rendering/RenderThemeWin.cpp:
@@ -35953,11 +89331,11 @@
         RenderThemeWin that does not have any Skia dependencies should provide a good basis for a potential
         merge of Google Chrome's RenderThemeWin (to help us see where the Skia stuff can be cut and to see
         what changes have been made as compared with the old RenderThemeWin).
-        
+
         Fix CSS2 system fonts to properly set both the rendering mode (so that they properly pick up GDI vs. CG
         text rendering modes) and the printer font setting (so that OS X system fonts properly pick up screen
         vs. printer advancement rounding).
-    
+
         Reviewed by Adam/Sam
 
         * css/CSSStyleSelector.cpp:
@@ -36074,7 +89452,7 @@
 
         Reviewed by Alexey Proskuryakov.
 
-        Try MIME charset names before trying IANA names 
+        Try MIME charset names before trying IANA names
         ( https://bugs.webkit.org/show_bug.cgi?id=17537 )
 
         With this change, shorter and more widely used names (preferred MIME
@@ -36082,8 +89460,8 @@
         document.inputEncoding rather than IANA names. This  helps
         fixing bug 18085 in addition to web developers who are more familiar
         with MIME names. For instance, EUC-JP, ISO-8859-X and US-ASCII will be
-        returned instead of Extended_UNIX_Code_Packed_Format_for_Japanese, 
-        ISO-8859-X:19xx, and ANSI_X3.4-1968. It also replaces IBM8xx with cp8xx. 
+        returned instead of Extended_UNIX_Code_Packed_Format_for_Japanese,
+        ISO-8859-X:19xx, and ANSI_X3.4-1968. It also replaces IBM8xx with cp8xx.
         Note that cp/IBM 8xx are extremly rare in today's web. Even if they're
         used, the former is still recognized as aliases to the latter so that
         there's very little, if any, to worry about.
@@ -36187,12 +89565,12 @@
         Reviewed by Maciej.
 
         <rdar://problem/5850387> Showing bookmarks reloads Google Reader instead.
-        
+
         In some cases, timeouts scheduled by a page in the onunload handler could fire even when the
         page had been unloaded and replaced by a non-HTML representation based view (such as the bookmarks view).
-        
+
         Fix this by clearing timeouts for pages that aren't cached when the provisional load is committed.
-        
+
         * bindings/js/JSDOMWindowBase.h:
         * loader/FrameLoader.cpp:
         (WebCore::FrameLoader::commitProvisionalLoad):
@@ -36699,7 +90077,7 @@
         (WebCore::): Added NodeMessageLevel.
         * page/Console.idl: Added console.dirxml.
         * page/inspector/Console.js: A NodeMessage creates a ElementsTreeOutline.
-        * page/inspector/ElementsPanel.js: Modified to use ElementsTreeOutline. The ElementsTreeOutline 
+        * page/inspector/ElementsPanel.js: Modified to use ElementsTreeOutline. The ElementsTreeOutline
         in the ElementsPanel has includeRootDOMNode and selectEnabled set to true.
         * page/inspector/ElementsTreeOutline.js: Added.
         (WebInspector.ElementsTreeOutline): A subclass of TreeOutline for displaying a DOM node tree.
@@ -36760,19 +90138,19 @@
 
         Reviewed by Dave Hyatt.
 
-        <rdar://problem/6187043> 
+        <rdar://problem/6187043>
         Don't parse full HTML user agent style sheet unless it is actually needed
-        <rdar://problem/6131889> 
+        <rdar://problem/6131889>
         WebView is significantly more expensive to create recently
-        
+
         Parsing the html4.css takes significant amount of time and memory (~50kb) on application
         startup. Some clients may never use most of the rules.
-        
-        With this patch we use simplified UA stylesheet until we hit something it can't handle. 
+
+        With this patch we use simplified UA stylesheet until we hit something it can't handle.
         This avoids full stylesheet parsing on application startup (due to empty document construction)
-        and also makes it possible for clients with very simple demands (divs and spans only) never to load 
+        and also makes it possible for clients with very simple demands (divs and spans only) never to load
         the full style.
-        
+
         It also delays view source style parsing until it is used.
 
         * css/CSSStyleSelector.cpp:
@@ -36806,7 +90184,7 @@
         Fix <rdar://problem/6201644>
         https://bugs.webkit.org/show_bug.cgi?id=20493
         Crash after OK in dialog box and reloading page in secure mode
-        
+
         Limited loader only fix since the general timer fix is causing problems on Windows.
 
         * loader/loader.cpp:
@@ -36990,7 +90368,7 @@
 2008-09-05  Antti Koivisto  <antti@apple.com>
 
         Build fixes.
-        
+
         * WebCore.xcodeproj/project.pbxproj:
         * svg/graphics/filters/SVGFEImage.cpp:
         (WebCore::FEImage::cachedImage):
@@ -37005,17 +90383,17 @@
         Implement HTTP 1.1 "Specific end-to-end revalidation" for WebCore memory cache. This patch does
         not yet enable it for the biggest use case, reloading. However it is good for general browsing as
         well. Doing this in WebCore level as opposed to relying on disk cache has big benefit that
-        we avoid re-decoding resources, especially images. 
-        
+        we avoid re-decoding resources, especially images.
+
         To be exact the enabled case is not actually the "Specific end-to-end revalidation" since it does not include
         CacheControl: max-age=0 header. That would be added in reload case.
-        
+
         The approach for revalidation is to kick the original resource out from the memory cache
         and create a new CachedResource that represents the revalidation request. In case
-        we get 304 back for the request we put the original resource back to the cache, update 
+        we get 304 back for the request we put the original resource back to the cache, update
         its expiration date and switch the clients registered to revalidation resource to be
         clients of the original resource.
-        
+
         All heap allocated CachedImage pointers now use CachedResourceHandle<CachedImage> (and so on) instead.
         This allows updating the handles to point to the original resource when the revalidation succeeds. It
         also acts as refcounting smart pointer.
@@ -37115,10 +90493,10 @@
 
         <rdar://problem/6180236> - Safari times out connections after 1 or 2 minutes
 
-        A 60-second default timeout was added in http://trac.webkit.org/changeset/17144 in an attempt 
-        to model default NSURLRequest behavior in a cross-platform manner.  
+        A 60-second default timeout was added in http://trac.webkit.org/changeset/17144 in an attempt
+        to model default NSURLRequest behavior in a cross-platform manner.
 
-        Sadly by always enforcing this 60 second timeout, WebCore was stomping over the wishes of any Webkit 
+        Sadly by always enforcing this 60 second timeout, WebCore was stomping over the wishes of any Webkit
         client that wished to enforce a much larger default timeout using NSURLRequest API.
 
         Additionally, upon reviewing what all other browsers do, it seems apparent that "no limit" is desirable
@@ -37134,7 +90512,7 @@
         (WebCore::ResourceRequestBase::ResourceRequestBase):  Rename the constant to "unspecifiedTimeoutInterval"
           and make it UINT_MAX so platforms that do set it have an effective "no timeout."  (Windows, for example)
         * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):  If the timeout for this request is 
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):  If the timeout for this request is
           "unspecifiedTimeoutInterval", then don't bother setting the timeout using NSURLRequest API, allowing
           WebKit applications to enforce their own default timeout.
 
@@ -37148,7 +90526,7 @@
 
         * rendering/RenderButton.cpp:
         (WebCore::RenderButton::setStyle): Reset the inner block's style box
-        flex to 0 to avoid getting a spurious layout hint. 
+        flex to 0 to avoid getting a spurious layout hint.
 
 2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
 
@@ -37277,11 +90655,11 @@
         Reviewed by Simon.
 
         Re-enable support for user stylesheets in QtWebKit
-        
+
         QtWebKit now follows the FRAME_LOADS_USER_STYLESHEET
         code path, which allows us to keep API support for
         loading user style sheets from remote URLs.
-        
+
         As part of the change UserStyleSheetLoader.cpp/h was
         moved from WebCore/loader/mac to WebCore/loader.
 
@@ -37452,7 +90830,7 @@
         Remove the rest of the "zombie" code from the profiler.
         - There is no longer a need for the ProfilerClient callback mechanism.
 
-        * page/Console.cpp: 
+        * page/Console.cpp:
         (WebCore::Console::Console):
         (WebCore::Console::profile):
         (WebCore::Console::profileEnd): Move the variables from the header to
@@ -37695,7 +91073,7 @@
         style="color:#gray;" would apply the color gray when it should not.
 
         In the bison template, "hexcolor" was defined as both "HEX maybe_space" OR "IDENT maybe_space".
-        This caused identifiers not fitting the appropriate hex format but preceded by a '#' to be 
+        This caused identifiers not fitting the appropriate hex format but preceded by a '#' to be
         interpreted as a valid color (CSSPrimitiveValue::CSS_PARSER_HEXCOLOR), when it was really just
         an ignorable token.
 
@@ -37795,7 +91173,7 @@
 
         AnimationController.cpp should be split into separate files
         https://bugs.webkit.org/show_bug.cgi?id=20604
-        
+
         Note: All makefiles, except WebCore.xcodeproj have been changed without testing, upon
         recommendation of Dave Hyatt.
 
@@ -37805,7 +91183,7 @@
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
             Build files.
-        
+
         * page/AnimationController.cpp: Removed.
         * page/AnimationController.h: Removed.
         * page/animation: Added.
@@ -38125,16 +91503,16 @@
 
         Fix for <rdar://problem/6181588>
 
-        This patch makes hit testing take into account the new concept of a 
-        disconnected frame, in which some of the content may not be 
-        visible. The current hit testing mechanism starts at a target frame 
-        and drills down for a HitTestResult. In some cases, drilling down 
-        will find a non-visible result. When this happens, we need to try 
-        again, starting at a higher level -- namely, starting at the main 
+        This patch makes hit testing take into account the new concept of a
+        disconnected frame, in which some of the content may not be
+        visible. The current hit testing mechanism starts at a target frame
+        and drills down for a HitTestResult. In some cases, drilling down
+        will find a non-visible result. When this happens, we need to try
+        again, starting at a higher level -- namely, starting at the main
         frame.
 
         * editing/Editor.cpp:
-        (WebCore::Editor::insideVisibleArea): New function that tests if a 
+        (WebCore::Editor::insideVisibleArea): New function that tests if a
         point is inside the visible area for a disconnected frame.
         * editing/Editor.h:
         * page/EventHandler.cpp:
@@ -38142,7 +91520,7 @@
 
 2008-08-29  Adele Peterson  <adele@apple.com>
 
-        Reviewed by Adam Roben. 
+        Reviewed by Adam Roben.
 
         Rename HTMLTextFieldInnerElement.h/.cpp to TextControlInnerElements.h/.cpp
 
@@ -38186,7 +91564,7 @@
         Fix GeneratedImage to respect Image's refcounting
         Fixing potential crashers (future if not current)
         https://bugs.webkit.org/show_bug.cgi?id=20567
-        
+
         I don't know if it's possible to make the current code
         crash, thus I've not made a test.
 
@@ -38222,9 +91600,9 @@
 
         Fix for https://bugs.webkit.org/show_bug.cgi?id=20525
         <rdar://problem/6169301>
-        
+
         Return the size of the movie data instead of 1000.
-        
+
         Test: media/progress-event-total.html
 
         * platform/graphics/win/QTMovieWin.cpp:
@@ -38389,9 +91767,9 @@
 
         Make all the 'isFoo()' methods on CSSValue const,
         and fix the subclasses.
-        
+
         https://bugs.webkit.org/show_bug.cgi?id=20561
-        
+
         * css/CSSTimingFunctionValue.h:
         * css/CSSValue.h:
         (WebCore::CSSValue::isFontValue):
@@ -38486,9 +91864,9 @@
         <rdar://problem/6182541>
         https://bugs.webkit.org/show_bug.cgi?id=20202
         Missing http status line from the http headers.
-        
+
         Add a status line to the header string.
-        
+
         * plugins/PluginStream.cpp:
         (WebCore::PluginStream::startStream):
 
@@ -38573,12 +91951,12 @@
         https://bugs.webkit.org/show_bug.cgi?id=20373
 
         Changed pattern() to canvasPattern() on CanvasStyle to match canvasGradient()
-        
+
         Made Generator (aka Gradient) RefCounted so that GraphicsContext didn't
         have to store large Gradient objects in the GraphicsContextState
-        
+
         Made Pattern RefCounted for the same reason.
-        
+
         Many updates to GraphicsContext to support easier drawing with
         Patterns and Gradients.
 
@@ -38655,14 +92033,14 @@
         Close a leak of PausedTimeouts if the JavaScriptDebugServer was destroyed
         with timeouts paused.
         https://bugs.webkit.org/show_bug.cgi?id=20469
-        
+
         I attempted to clean up the memory management of PausedTimeouts, I'm not
         sure the solution I came up with is "cleaner", but it's in some ways
         "safer", since it no longer uses raw pointers and manual new/delete.
-        
+
         This also now prevents CachedPage from needlessly creating Window
         objects when caching pages which didn't already have one. :)
-        
+
         I also made Chrome.cpp no longer depend on the JavaScript bindings
         (aka JSDOMWindowBase.h), since there was no real reason for it to.
 
@@ -38738,7 +92116,7 @@
 2008-08-27  Mario Bensi  <mbensi@pleyo.com>
 
         Reviewed by Eric Seidel.
-        
+
         Fix the data content of an image with a base64.
 
         * platform/network/curl/ResourceHandleManager.cpp:
@@ -38753,10 +92131,10 @@
 
         Crash after OK in dialog box and reloading page in secure mode
         https://bugs.webkit.org/show_bug.cgi?id=20493
-        
-        The new run loop spawned by a modal dialog causes a timer in the loader to run 
+
+        The new run loop spawned by a modal dialog causes a timer in the loader to run
         synchronously inside didFinishLoading() deleting "this" object.
-        
+
         Defer all WebCore timers when a modal dialog is up. They are not
         safe to execute.
 
@@ -38958,7 +92336,7 @@
         Reviewed by Darin Adler.
 
         Change canvas tainting logic to ask the image if it contains
-        any resources outside of its own origin. Since there is no 
+        any resources outside of its own origin. Since there is no
         way to determine if SVG images contain any resources outside its
         origin, we always assume it does.
 
@@ -39086,8 +92464,8 @@
         Reviewed by Mark.
 
         <rdar://problem/6149787> crash @ com.apple.JavaScriptCore: WTF::callOnMainThread + 37.
-        
-        Initialize threading in the call to WebCoreObjCFinalizeOnMainThread. We currently assume 
+
+        Initialize threading in the call to WebCoreObjCFinalizeOnMainThread. We currently assume
         (safely) that any class that needs finalization on the main thread will also need to be deallocated
         on the main thread, and calling initializeThreading from WebCoreObjCFinalizeOnMainThread instead of
         calling it from WebCoreObjCScheduleDeallocateOnMainThread seems safer.
@@ -39138,7 +92516,7 @@
 
         * ForwardingHeaders/VM: Added.
         * ForwardingHeaders/VM/Machine.h: Added.
-        * page/Console.cpp: Gather the line number and file information when 
+        * page/Console.cpp: Gather the line number and file information when
         profileEnd has been called, but don't use it until didFinishProfiling is
         called.  We won't need to wait once we remove the profiler "zombie" mode
         which this patch helps pave the foundation for.
@@ -39179,21 +92557,21 @@
 2008-08-24  Steve Falkenburg  <sfalken@apple.com>
 
         Add a "last chance" WM_TIMER to the Windows shared timer.
-        
+
         The last chance timer fires every 5 seconds to run any lost WM_TIMER based timers.
         Failure to fire a timer is fatal to the cross-platform Timer code, since it won't re-schedule
         timers if a timer with an earlier expiration is already pending. This results in no timers
         firing from that point on.
-        
+
         We lose WM_TIMER messages occasionally (in the neighborhood of 1 per hour) probably due to a
         buggy window message hook.
-        
+
         This timer will start when the first WM_TIMER is scheduled, and will
         fire every 5 seconds thereafter, causing any lost timers to be fired.
-        
+
         Found this via one of its symptoms: leaking WebFrames. The fix prevents timers from stalling
         and prevents the WebFrame leak.
-        
+
         Reviewed by Darin Adler, Geoff Garen.
 
         * platform/win/SharedTimerWin.cpp:
@@ -39432,7 +92810,7 @@
 
         Test: fast/events/autoscroll-nonscrollable-iframe-in-scrollable-div.html
         https://bugs.webkit.org/show_bug.cgi?id=20451
-   
+
         rdar://problem/6166435 Inspector doesn't auto scroll when selecting text (20451)
         When we climb up the rendering tree looking for a scrollable renderer, we need to be able to jump outside of an iframe.
         This way we can see if what is embedding the iframe can be scrolled even if the iframe content can't.
@@ -39533,9 +92911,9 @@
 
         Fix a race condition in Windows timer code.
         Timer function could end up being called with a 0 timer, leading to a Windows exception.
-        
+
         Don't post a timer message if one is already pending.
-        
+
         Reviewed by Ada Chan.
 
         * platform/win/SharedTimerWin.cpp:
@@ -39631,15 +93009,15 @@
 
         <rdar://problem/6153432> - Many images broken in Mail
 
-        This can be traced back to the preload scanner.  With that change, CachedResources are created a lot 
-        sooner than before and confuse the WebArchive machinery.  
+        This can be traced back to the preload scanner.  With that change, CachedResources are created a lot
+        sooner than before and confuse the WebArchive machinery.
 
-        When referencing WebArchive subresources directly through the WebKit API it is appropriate to ignore 
-        such CachedResources since they are placeholders and have not been submitted to the ResourceLoadDelegate 
+        When referencing WebArchive subresources directly through the WebKit API it is appropriate to ignore
+        such CachedResources since they are placeholders and have not been submitted to the ResourceLoadDelegate
         machinery and nothing is known about where the data will eventually come from.
 
         * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::subresource):  Ignore a CachedResource if its preloadResult is 
+        (WebCore::DocumentLoader::subresource):  Ignore a CachedResource if its preloadResult is
           CachedResource::PreloadReferenced.
 
 2008-08-20  Holger Hans Peter Freyther  <zecke@selfish.org>
@@ -39672,7 +93050,7 @@
         getComputedStyle() for webkitTransform should return a transform
         that does not have the transform origin baked into it.
         https://bugs.webkit.org/show_bug.cgi?id=20464
-        
+
         Test: fast/css/getComputedStyle-transform.html
 
         * css/CSSComputedStyleDeclaration.cpp:
@@ -39685,9 +93063,9 @@
 
         Reviewed and landed by Anders.
 
-        <rdar://problem/6163636> 
+        <rdar://problem/6163636>
         rename NPCocoaEvent's "event" struct to "data" (20446)
-        
+
         * bridge/npapi.h:
         (_NPCocoaEvent::):
 
@@ -39695,38 +93073,38 @@
 
         Reviewed by Darin Adler.
 
-        Fix for <rdar://problem/6145626> 
-        This patch fixes a number of remaining problems getting 
-        disconnected frames to work correctly with markAllMatchesForText() 
-        and findString(). Details inline. 
+        Fix for <rdar://problem/6145626>
+        This patch fixes a number of remaining problems getting
+        disconnected frames to work correctly with markAllMatchesForText()
+        and findString(). Details inline.
 
-        This was a static helper function in Frame, but this patch requires 
-        the same functionality in Editor, so I just added it as a function 
+        This was a static helper function in Frame, but this patch requires
+        the same functionality in Editor, so I just added it as a function
         on Node.
         * dom/Node.cpp:
         (WebCore::Node::isInShadowTree):
         * dom/Node.h:
 
         * editing/Editor.cpp:
-        (WebCore::Editor::insideVisibleArea): Returns false if 
+        (WebCore::Editor::insideVisibleArea): Returns false if
         excludeFromTextSearch() is true.
 
-        In a normal (non-disconnected) frame, findString returns a range of 
-        the document node if the text is not found in the frame. I changed 
-        firstVisibleRange and lastVisibleRange to match that behavior when 
+        In a normal (non-disconnected) frame, findString returns a range of
+        the document node if the text is not found in the frame. I changed
+        firstVisibleRange and lastVisibleRange to match that behavior when
         the text is not found
         (WebCore::Editor::firstVisibleRange):
         (WebCore::Editor::lastVisibleRange):
 
-        Here are the bulk of the changes in the patch. A lot of text was 
-        not being found in disconnected frames because I failed to account 
-        for all of the possible problems associated with shadow trees. That 
+        Here are the bulk of the changes in the patch. A lot of text was
+        not being found in disconnected frames because I failed to account
+        for all of the possible problems associated with shadow trees. That
         is fixed here.
         (WebCore::Editor::nextVisibleRange):
         * editing/Editor.h:
 
-        excludeFromTextSearch() is new. It allows a WebKit client to mark a 
-        frame as not-text-searchable through SPI. 
+        excludeFromTextSearch() is new. It allows a WebKit client to mark a
+        frame as not-text-searchable through SPI.
         * WebCore.base.exp:
         * page/Frame.cpp:
         (WebCore::Frame::excludeFromTextSearch):
@@ -39736,8 +93114,8 @@
         * page/FramePrivate.h:
 
         (WebCore::Frame::findString):
-        (WebCore::Frame::markAllMatchesForText):  I kept running into an 
-        assertion failure in paining code because of the forced paint on 
+        (WebCore::Frame::markAllMatchesForText):  I kept running into an
+        assertion failure in paining code because of the forced paint on
         empty visible rects.
 
 2008-08-20  Timothy Hatcher  <timothy@apple.com>
@@ -40042,7 +93420,7 @@
         Reviewed by Beth Dakin.
 
         <rdar://problem/4003764> Expose tables as AXTables
- 
+
         Tests: accessibility/table-attributes.html
                accessibility/table-cell-spans.html
                accessibility/table-cells.html
@@ -40404,7 +93782,7 @@
         * rendering/RenderBox.h:
         * rendering/RenderImage.cpp:
         (WebCore::RenderImage::calcReplacedWidth):
-        (WebCore::RenderImage::calcPrefWidths): 
+        (WebCore::RenderImage::calcPrefWidths):
         * rendering/RenderImage.h:
         * rendering/RenderReplaced.cpp:
         (WebCore::RenderReplaced::calcPrefWidths):
@@ -40501,7 +93879,7 @@
 2008-08-17  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Cameron Zwarich.
-        
+
         Updated project files to XCode 3.1.
 
         * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj/project.pbxproj:
@@ -40511,10 +93889,10 @@
         Reviewed by Cameron Zwarich.
 
         Made room for a free word in JSCell.
-        
+
         Changed JSDOMWindowBase to store its auxiliary data in a subclass of
         JSGlobalData, so the two could share a pointer.
-        
+
         Added a bunch of ASSERTs, to help catch over-sized objects.
 
 2008-08-15  Mark Rowe  <mrowe@apple.com>
@@ -40543,10 +93921,10 @@
         Don't start preloading body resources before the head is complete. This prevents
         body preloads from slowing down initial display when there is limited amount
         of bandwidth available.
-        
+
         Works by queuing up found body preloads to DocLoader and only issuing them
         after document has rendering.
-        
+
         With bandwidth capped to 300kbit/s this speeds up cnn.com initial display by ~25% or 5s
         without affecting complete load time.
 
@@ -40581,7 +93959,7 @@
 
         Some loader performance tweaks:
         - Make stylesheets highest priority instead of scripts. We block script execution on stylesheets.
-          Especially if a stylesheet @imports other stylesheets it is important to get them to the front of the queue 
+          Especially if a stylesheet @imports other stylesheets it is important to get them to the front of the queue
           to not delay rendering.
         - Issue the first resource load for a host immediately even if the resource is low priority. TCP connection setup
           can take long time when latency is high so it is good to get started early.
@@ -40874,7 +94252,7 @@
 
         - fix <rdar://problem/5993323> REGRESSION (r34210): Apple.com favicon appears stretched/clipped
 
-        * platform/graphics/BitmapImage.cpp: 
+        * platform/graphics/BitmapImage.cpp:
         (WebCore::BitmapImage::BitmapImage): Added initialization of
         m_hasUniformFrameSize.
         (WebCore::BitmapImage::cacheFrame): Added code to get the size of the
@@ -40888,7 +94266,7 @@
         * platform/graphics/ImageSource.h: Added frameSizeAtIndex().
         * platform/graphics/cg/ImageCG.cpp:
         (WebCore::BitmapImage::draw): Changed to use currentFrameSize(). This
-        fixes the bug, which resulted from assuming that the frame being drawn 
+        fixes the bug, which resulted from assuming that the frame being drawn
         was the same size as the first frame.
         * platform/graphics/cg/ImageSourceCG.cpp:
         (WebCore::ImageSource::frameSizeAtIndex): Renamed size() to this and
@@ -41378,7 +94756,7 @@
         Tests: media/video-source-type-params.html
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::pickMedia): only pass the portion before the first ';' 
+        (WebCore::HTMLMediaElement::pickMedia): only pass the portion before the first ';'
         to isSupportedMediaMIMEType()
 
 2008-08-13  Beth Dakin  <bdakin@apple.com>
@@ -41387,21 +94765,21 @@
 
         Fix for <rdar://problem/6141345>
 
-        This patch refines findString and markAllMatchesForText functions' 
-        interactions with disconnected frames. They no longer rely on 
-        knowing where a range is relative to the visible region and work 
+        This patch refines findString and markAllMatchesForText functions'
+        interactions with disconnected frames. They no longer rely on
+        knowing where a range is relative to the visible region and work
         with disconnected frames that contain frames.
 
         * editing/Editor.cpp:
-        (WebCore::Editor::insideVisibleArea): Now returns a bool instead of 
+        (WebCore::Editor::insideVisibleArea): Now returns a bool instead of
         the visiblity enum.
-        (WebCore::Editor::firstVisibleRange): This now returns the very 
-        first visible range in the document. It's no longer dependent on 
+        (WebCore::Editor::firstVisibleRange): This now returns the very
+        first visible range in the document. It's no longer dependent on
         searching forward.
-        (WebCore::Editor::lastVisibleRange): This now returns the very last 
-        visible range in the document. It's no longer dependent on 
+        (WebCore::Editor::lastVisibleRange): This now returns the very last
+        visible range in the document. It's no longer dependent on
         searching backwards.
-        (WebCore::Editor::nextVisibleRange): This returns the next visible 
+        (WebCore::Editor::nextVisibleRange): This returns the next visible
         range in the appropriate direction from the current range.
         * editing/Editor.h:
         * page/Frame.cpp:
@@ -41610,7 +94988,7 @@
 2008-08-12  Nikolas Zimmermann  <zimmermann@kde.org>
 
         Reviewed by Dave.
-    
+
         Fixes: https://bugs.webkit.org/show_bug.cgi?id=19798
         Masks are translated, and the mask images are swapped on the y-axis.
 
@@ -41851,7 +95229,7 @@
         - Because console messages have group levels now, newly created messages
         that do not specify the level lose their message since the number of
         arguments is wrong.
- 
+
         * page/inspector/Console.js:
         * page/inspector/Resource.js:
 
@@ -41940,7 +95318,7 @@
         * html/HTMLElement.cpp:
         * page/AnimationController.cpp:
             do all the new event stuff
-            
+
         * html/HTMLAttributeNames.in:
             the onwebkitanimation* and onwebkittransitionend attrs
 
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index f6989137b2..3b8eeb18cb 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -32,6 +32,8 @@
 #include "JSCanvasRenderingContext2D.cpp"
 #include "JSCDATASection.cpp"
 #include "JSCharacterData.cpp"
+#include "JSClientRect.cpp"
+#include "JSClientRectList.cpp"
 #include "JSClipboard.cpp"
 #include "JSComment.cpp"
 #include "JSConsole.cpp"
@@ -67,7 +69,6 @@
 #include "JSEntityReference.cpp"
 #include "JSEvent.cpp"
 #include "JSEventException.cpp"
-#include "JSEventTargetNode.cpp"
 #include "JSFile.cpp"
 #include "JSFileList.cpp"
 #include "JSHistory.cpp"
@@ -312,8 +313,18 @@
 #include "JSTreeWalker.cpp"
 #include "JSUIEvent.cpp"
 #include "JSVoidCallback.cpp"
+#include "JSWebKitAnimationEvent.cpp"
+#include "JSWebKitCSSKeyframeRule.cpp"
+#include "JSWebKitCSSKeyframesRule.cpp"
 #include "JSWebKitCSSTransformValue.cpp"
+#include "JSWebKitCSSMatrix.cpp"
+#include "JSWebKitPoint.cpp"
+#include "JSWebKitTransitionEvent.cpp"
 #include "JSWheelEvent.cpp"
+#include "JSWorker.cpp"
+#include "JSWorkerContext.cpp"
+#include "JSWorkerLocation.cpp"
+#include "JSWorkerNavigator.cpp"
 #include "JSXMLHttpRequest.cpp"
 #include "JSXMLHttpRequestException.cpp"
 #include "JSXMLHttpRequestProgressEvent.cpp"
@@ -325,7 +336,6 @@
 #include "JSXPathNSResolver.cpp"
 #include "JSXPathResult.cpp"
 #include "JSXSLTProcessor.cpp"
-#include "SVGElementFactory.cpp"
 #include "UserAgentStyleSheetsData.cpp"
 
 // On MSVC, including StaticConstructors.h causes all global objects not to be
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h
index 69b7baebdb..e6cfedef43 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Debugger_h
+#define WebCore_FWD_Debugger_h
 #include <JavaScriptCore/Debugger.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h
new file mode 100644
index 0000000000..c241bb73c6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DebuggerActivation_h
+#define WebCore_FWD_DebuggerActivation_h
+#include <JavaScriptCore/DebuggerActivation.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
index 474fec0f38..4a237425d6 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DebuggerCallFrame_h
+#define WebCore_FWD_DebuggerCallFrame_h
 #include <JavaScriptCore/DebuggerCallFrame.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h
index c8c60d4205..8c3acee475 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CallFrame_h
+#define WebCore_FWD_CallFrame_h
 #include <JavaScriptCore/CallFrame.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h
index 175ddce71d..1235c21d28 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Interpreter_h
+#define WebCore_FWD_Interpreter_h
 #include <JavaScriptCore/Interpreter.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/jit/JITCode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/jit/JITCode.h
new file mode 100644
index 0000000000..b996615d26
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/jit/JITCode.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_JITCode_h
+#define WebCore_FWD_JITCode_h
+#include <JavaScriptCore/JITCode.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h
index e1f0b4dee3..2b7dd6ce28 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_X86Assembler_h
+#define WebCore_FWD_X86Assembler_h
 #include <JavaScriptCore/X86Assembler.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
index 10a2775e22..863df5939d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Parser_h
+#define WebCore_FWD_Parser_h
 #include <JavaScriptCore/Parser.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h
index 17a5069f98..0a1079b1f3 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SourceCode_h
+#define WebCore_FWD_SourceCode_h
 #include <JavaScriptCore/SourceCode.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h
index 487aae9c4c..0eb078b877 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SourceProvider_h
+#define WebCore_FWD_SourceProvider_h
 #include <JavaScriptCore/SourceProvider.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h
index 47c0d3d631..198acc98c0 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_pcre_h
+#define WebCore_FWD_pcre_h
 #include <JavaScriptCore/pcre.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h
index b591262f64..d26bafd5be 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Profile_h
+#define WebCore_FWD_Profile_h
 #include <JavaScriptCore/Profile.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h
index 488449fc4d..a19a07e35b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_ProfileNode_h
+#define WebCore_FWD_ProfileNode_h
 #include <JavaScriptCore/ProfileNode.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h
index 56c6e0eaba..06139ff5be 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Profiler_h
+#define WebCore_FWD_Profiler_h
 #include <JavaScriptCore/Profiler.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h
index 02955d42f4..ce334d48d1 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ArgList_h
+#define WebCore_FWD_ArgList_h
 #include <JavaScriptCore/ArgList.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
index 9719fb0ab8..51b79960e8 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ArrayPrototype_h
+#define WebCore_FWD_ArrayPrototype_h
 #include <JavaScriptCore/ArrayPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h
index 3cea7c6da4..49d6fc3634 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_BooleanObject_h
+#define WebCore_FWD_BooleanObject_h
 #include <JavaScriptCore/BooleanObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ByteArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ByteArray.h
deleted file mode 100644
index f4f40dc3b1..0000000000
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ByteArray.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ByteArray.h>
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h
index 15a6028f70..03ecef8a6a 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CallData_h
+#define WebCore_FWD_CallData_h
 #include <JavaScriptCore/CallData.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h
index 6d8b5cd0cc..d133a275db 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Collector_h
+#define WebCore_FWD_Collector_h
 #include <JavaScriptCore/Collector.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
index 98166ab28c..fcfe26dbc2 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CollectorHeapIterator_h
+#define WebCore_FWD_CollectorHeapIterator_h
 #include <JavaScriptCore/CollectorHeapIterator.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h
index d6a081fc6c..9dd6291805 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Completion_h
+#define WebCore_FWD_Completion_h
 #include <JavaScriptCore/Completion.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h
index f8d3d3ccc4..bd04e51430 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ConstructData_h
+#define WebCore_FWD_ConstructData_h
 #include <JavaScriptCore/ConstructData.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h
index 2429283cea..c75cfedfd8 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DateInstance_h
+#define WebCore_FWD_DateInstance_h
 #include <JavaScriptCore/DateInstance.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateMath.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateMath.h
new file mode 100644
index 0000000000..4135742f2f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateMath.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DateMath_h
+#define WebCore_FWD_DateMath_h
+#include <JavaScriptCore/DateMath.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h
index 4fbaabd957..7ddeab1cf7 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Error_h
+#define WebCore_FWD_Error_h
 #include <JavaScriptCore/Error.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
index bc49dcaaa3..a1962ed061 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FunctionConstructor_h
+#define WebCore_FWD_FunctionConstructor_h
 #include <JavaScriptCore/FunctionConstructor.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
index 3f71e8e1db..1db3b83486 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FunctionPrototype_h
+#define WebCore_FWD_FunctionPrototype_h
 #include <JavaScriptCore/FunctionPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h
index 5c925ebee2..63f1e423a1 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Identifier_h
+#define WebCore_FWD_Identifier_h
 #include <JavaScriptCore/Identifier.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
index 835097bdb0..bd4f735d68 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_InitializeThreadingn_h
+#define WebCore_FWD_InitializeThreading_h
 #include <JavaScriptCore/InitializeThreading.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h
index f447f787c9..78df9aa41e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_InternalFunction_h
+#define WebCore_FWD_InternalFunction_h
 #include <JavaScriptCore/InternalFunction.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h
index 9d70688249..5271c2780b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSArray_h
+#define WebCore_FWD_JSArray_h
 #include <JavaScriptCore/JSArray.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h
index 9e13acec99..ce5140f12d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSByteArray_h
+#define WebCore_FWD_JSByteArray_h
 #include <JavaScriptCore/JSByteArray.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h
index 396407d4ca..614b3da25b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSFunction_h
+#define WebCore_FWD_JSFunction_h
 #include <JavaScriptCore/JSFunction.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
index e5f143a12f..3f98c22bdd 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSGlobalData_h
+#define WebCore_FWD_JSGlobalData_h
 #include <JavaScriptCore/JSGlobalData.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
index 915d87abcf..47e78b226e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSGlobalObject_h
+#define WebCore_FWD_JSGlobalObject_h
 #include <JavaScriptCore/JSGlobalObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h
index 70ad81d732..8e6a629db6 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSLock_h
+#define WebCore_FWD_JSLock_h
 #include <JavaScriptCore/JSLock.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
index 3c68938ce1..e8d3227f5f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSNumberCell_h
+#define WebCore_FWD_JSNumberCell_h
 #include <JavaScriptCore/JSNumberCell.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h
index 45133f3275..6c798558bc 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSObject_h
+#define WebCore_FWD_JSObject_h
 #include <JavaScriptCore/JSObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h
index 195ed2109f..6409607119 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSString_h
+#define WebCore_FWD_JSString_h
 #include <JavaScriptCore/JSString.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h
index ebbed6c68b..d4c21ca13a 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSValue_h
+#define WebCore_FWD_JSValue_h
 #include <JavaScriptCore/JSValue.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h
index 0622dca03d..99936d9e89 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Lookup_h
+#define WebCore_FWD_Lookup_h
 #include <JavaScriptCore/Lookup.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
index 54e60b7e57..f890af1f41 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ObjectPrototype_h
+#define WebCore_FWD_ObjectPrototype_h
 #include <JavaScriptCore/ObjectPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h
index ab763a675d..95ed34c39e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Operations_h
+#define WebCore_FWD_Operations_h
 #include <JavaScriptCore/Operations.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h
index d9348b4320..fc4096382b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PropertyMap_h
+#define WebCore_FWD_PropertyMap_h
 #include <JavaScriptCore/PropertyMap.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
index 0840208c58..2fdf2d077e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PropertyNameArray_h
+#define WebCore_FWD_PropertyNameArray_h
 #include <JavaScriptCore/PropertyNameArray.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h
index 0ba5798c3e..76dc11c103 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Protect_h
+#define WebCore_FWD_Protect_h
 #include <JavaScriptCore/Protect.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
index c3f3ea5f59..9a46fd7133 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PrototypeFunction_h
+#define WebCore_FWD_PrototypeFunction_h
 #include <JavaScriptCore/PrototypeFunction.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h
index ca73cc0556..0b9a23b39a 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringObject_h
+#define WebCore_FWD_StringObject_h
 #include <JavaScriptCore/StringObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
index 9fd96121c5..6faa0563c6 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringObjectThatMasqueradesAsUndefined_h
+#define WebCore_FWD_StringObjectThatMasqueradesAsUndefined_h
 #include <JavaScriptCore/StringObjectThatMasqueradesAsUndefined.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h
index ece7fdb7cf..f0786d423d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringPrototype_h
+#define WebCore_FWD_StringPrototype_h
 #include <JavaScriptCore/StringPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h
index 81853f3129..2333978a6a 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Structure_h
+#define WebCore_FWD_Structure_h
 #include <JavaScriptCore/Structure.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h
index 0868c02830..cb099a048d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SymbolTable_h
+#define WebCore_FWD_SymbolTable_h
 #include <JavaScriptCore/SymbolTable.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h
index 7a36767dff..d985aa521c 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UString_h
+#define WebCore_FWD_UString_h
 #include <JavaScriptCore/UString.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h
index cfc4aff942..5749ed9d9f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_WREC_h
+#define WebCore_FWD_WREC_h
 #include <JavaScriptCore/WREC.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h
index f2258d298d..5851cc6f47 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ASCIICType_h
+#define WebCore_FWD_ASCIICType_h
 #include <JavaScriptCore/ASCIICType.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
index e591f7194a..e234162628 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_AlwaysInline_h
+#define WebCore_FWD_AlwaysInline_h
 #include <JavaScriptCore/AlwaysInline.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h
index 2144410499..5445be411d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Assertions_h
+#define WebCore_FWD_Assertions_h
 #include <JavaScriptCore/Assertions.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ByteArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ByteArray.h
new file mode 100644
index 0000000000..9c078c9fd7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ByteArray.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ByteArray_h
+#define WebCore_FWD_ByteArray_h
+#include <JavaScriptCore/ByteArray.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h
new file mode 100644
index 0000000000..26987ef111
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/CrossThreadRefCounted.h>
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CurrentTime.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CurrentTime.h
new file mode 100644
index 0000000000..00709150ce
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CurrentTime.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_CurrentTime_h
+#define WebCore_FWD_CurrentTime_h
+#include <JavaScriptCore/CurrentTime.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h
index 81bd70aab3..a4eee78e43 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Deque_h
+#define WebCore_FWD_Deque_h
 #include <JavaScriptCore/Deque.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h
index 445944be95..c4d59aca7d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DisallowCType_h
+#define WebCore_FWD_DisallowCType_h
 #include <JavaScriptCore/DisallowCType.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h
index 1701231ee3..b883c0b32d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FastMalloc_h
+#define WebCore_FWD_FastMalloc_h
 #include <JavaScriptCore/FastMalloc.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h
index 2d707ecb72..3e6b8c843f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Forward_h
+#define WebCore_FWD_Forward_h
 #include <JavaScriptCore/Forward.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h
index aedd784738..5a36ce2105 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_GetPtr_h
+#define WebCore_FWD_GetPtr_h
 #include <JavaScriptCore/GetPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
index 7388f5aab0..c92e9f01dc 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashCountedSet_h
+#define WebCore_FWD_HashCountedSet_h
 #include <JavaScriptCore/HashCountedSet.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h
index 0fa568a4cb..65e110ddbf 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashFunctions_h
+#define WebCore_FWD_HashFunctions_h
 #include <JavaScriptCore/HashFunctions.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h
index 9f262e2ea5..68ea68e19b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashMap_h
+#define WebCore_FWD_HashMap_h
 #include <JavaScriptCore/HashMap.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h
index cfe2d80f83..a4cf32bad5 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashSet_h
+#define WebCore_FWD_HashSet_h
 #include <JavaScriptCore/HashSet.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h
index a5e4d5753a..5975685f0f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashTable_h
+#define WebCore_FWD_HashTable_h
 #include <JavaScriptCore/HashTable.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h
index 412fa98565..3cf24cb063 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashTraits_h
+#define WebCore_FWD_HashTraits_h
 #include <JavaScriptCore/HashTraits.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h
index 4aef7730d0..c528b78dca 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ListHashSet_h
+#define WebCore_FWD_ListHashSet_h
 #include <JavaScriptCore/ListHashSet.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
index b7667362d8..379adfb9f1 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ListRefPtr_h
+#define WebCore_FWD_ListRefPtr_h
 #include <JavaScriptCore/ListRefPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h
index 75b0acd594..4dbe13e908 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Locker_h
+#define WebCore_FWD_Locker_h
 #include <JavaScriptCore/Locker.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h
index ff75971f8a..2d8e280fa4 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MainThread_h
+#define WebCore_FWD_MainThread_h
 #include <JavaScriptCore/MainThread.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h
index 29557867ab..8594e644e2 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MathExtras_h
+#define WebCore_FWD_MathExtras_h
 #include <JavaScriptCore/MathExtras.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h
index 986cca5fda..c597e0883f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MessageQueue_h
+#define WebCore_FWD_MessageQueue_h
 #include <JavaScriptCore/MessageQueue.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h
index f8484d2880..c5126776a3 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Noncopyable_h
+#define WebCore_FWD_Noncopyable_h
 #include <JavaScriptCore/Noncopyable.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h
index cfe18967a1..17576837e5 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_NotFound_h
+#define WebCore_FWD_NotFound_h
 #include <JavaScriptCore/NotFound.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
index 595817ddbe..7700641f6e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_OwnArrayPtr_h
+#define WebCore_FWD_OwnArrayPtr_h
 #include <JavaScriptCore/OwnArrayPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h
new file mode 100644
index 0000000000..036d80138e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/OwnFastMallocPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h
index 9211d38595..977382d9ef 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_OwnPtr_h
+#define WebCore_FWD_OwnPtr_h
 #include <JavaScriptCore/OwnPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
new file mode 100644
index 0000000000..58260316ee
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PassOwnPtr_h
+#define WebCore_FWD_PassOwnPtr_h
+#include <JavaScriptCore/PassOwnPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
new file mode 100644
index 0000000000..58260316ee
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PassOwnPtr_h
+#define WebCore_FWD_PassOwnPtr_h
+#include <JavaScriptCore/PassOwnPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
index aafd1a236b..ef57e5fe2d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_PassRefPtr_h
+#define WebCore_FWD_PassRefPtr_h
 #include <JavaScriptCore/PassRefPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h
index 3b229552ac..9f2bb3a4c3 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Platform_h
+#define WebCore_FWD_Platform_h
 #include <JavaScriptCore/Platform.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
new file mode 100644
index 0000000000..bb6ed9a5ef
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_PtrAndFlags_h
+#define WebCore_FWD_PtrAndFlags_h
+#include <JavaScriptCore/PtrAndFlags.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h
index 42e148a1e0..cb156d22d5 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_RandomNumber_h
+#define WebCore_FWD_RandomNumber_h
 #include <JavaScriptCore/RandomNumber.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h
index 628a63b6e5..c6b2deeb31 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RefCounted_h
+#define WebCore_FWD_RefCounted_h
 #include <JavaScriptCore/RefCounted.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
index 3f229d1aa0..2abe37e818 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
@@ -1,2 +1,5 @@
+#ifndef WebCore_FWD_RefCountedLeakCounter_h
+#define WebCore_FWD_RefCountedLeakCounter_h
 #include <JavaScriptCore/RefCountedLeakCounter.h>
+#endif
 
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h
index 0ff621398f..594929deb4 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RefPtr_h
+#define WebCore_FWD_RefPtr_h
 #include <JavaScriptCore/RefPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h
index 65fc27bc93..1352bd8934 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RetainPtr_h
+#define WebCore_FWD_RetainPtr_h
 #include <JavaScriptCore/RetainPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
index 3222ec1f1e..20032951bd 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StdLibExtras_h
+#define WebCore_FWD_StdLibExtras_h
 #include <JavaScriptCore/StdLibExtras.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h
index 063d500ecb..d89f2384f4 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringExtras_h
+#define WebCore_FWD_StringExtras_h
 #include <JavaScriptCore/StringExtras.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
index 48f1db5d16..1e5474ffb8 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ThreadSpecific_h
+#define WebCore_FWD_ThreadSpecific_h
 #include <JavaScriptCore/ThreadSpecific.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h
index 17359e5d29..ad2984721d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Threading_h
+#define WebCore_FWD_Threading_h
 #include <JavaScriptCore/Threading.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/TypeTraits.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/TypeTraits.h
new file mode 100644
index 0000000000..a4ae09facd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/TypeTraits.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_TypeTraits_h
+#define WebCore_FWD_TypeTraits_h
+#include <JavaScriptCore/TypeTraits.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h
index aa3d3d080f..5202740c02 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UnusedParam_h
+#define WebCore_FWD_UnusedParam_h
 #include <JavaScriptCore/UnusedParam.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VMTags.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VMTags.h
new file mode 100644
index 0000000000..ffd1e128ec
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VMTags.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_VMTags_h
+#define WebCore_FWD_VMTags_h
+#include <JavaScriptCore/VMTags.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h
index c6d15fd05b..2c1cf7b977 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Vector_h
+#define WebCore_FWD_Vector_h
 #include <JavaScriptCore/Vector.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h
index 2fc1158274..87a38229e7 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_VectorTraits_h
+#define WebCore_FWD_VectorTraits_h
 #include <JavaScriptCore/VectorTraits.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h
index 887fdfa7bc..7fd92652ff 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_dtoa_h
+#define WebCore_FWD_dtoa_h
 #include <JavaScriptCore/dtoa.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
index 8f341a11e8..f28a117282 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Collator_h
+#define WebCore_FWD_Collator_h
 #include <JavaScriptCore/Collator.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
index c7d9e92aa0..b9daa435d2 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UTF8_h
+#define WebCore_FWD_UTF8_h
 #include <JavaScriptCore/UTF8.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
index 623917f76f..9f06747f1f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Unicode_h
+#define WebCore_FWD_Unicode_h
 #include <JavaScriptCore/Unicode.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
index 6b64eb509f..4819f476fe 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UnicodeIcu_h
+#define WebCore_FWD_UnicodeIcu_h
 #include <JavaScriptCore/UnicodeIcu.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/Info.plist b/src/3rdparty/webkit/WebCore/Info.plist
index a131f44197..525a372d3b 100644
--- a/src/3rdparty/webkit/WebCore/Info.plist
+++ b/src/3rdparty/webkit/WebCore/Info.plist
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2007 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/WebCore/Resources/panIcon.png b/src/3rdparty/webkit/WebCore/Resources/panIcon.png
new file mode 100644
index 0000000000..4ca8d70374
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/Resources/panIcon.png
diff --git a/src/3rdparty/webkit/WebCore/WebCore.LP64.exp b/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
index 71ed666e8e..cc04718f3f 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
@@ -1,3 +1,15 @@
 # This file gets appended to WebCore.exp, only for 64-bit architectures.
 
+__ZN3JSC16RuntimeObjectImp6s_infoE
+__ZN3JSC8Bindings10RootObjectD1Ev
+__ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
+__ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings8InstanceD2Ev
+__ZN7WebCore13IdentifierRep3getEi
+__ZN7WebCore13IdentifierRep3getEPKc
+__ZN7WebCore13IdentifierRep7isValidEPS0_
+__ZN7WebCore16ScriptController16createRootObjectEPv
+__ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
 __ZN7WebCore16ScriptController9isEnabledEv
+__ZN7WebCore6String26fromUTF8WithLatin1FallbackEPKcm
+__ZN7WebCore6String8fromUTF8EPKcm
diff --git a/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp b/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp
index 28dd0514f6..d487adedf3 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp
@@ -21,3 +21,10 @@ __NPN_SetProperty
 __NPN_UTF8FromIdentifier
 __ZN7WebCore16ScriptController20windowScriptNPObjectEv
 __ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
+__ZN7WebCore6String8fromUTF8EPKc
+__ZN7WebCoreplERKNS_6StringEPKc
+__ZNK7WebCore12RenderObject4viewEv
+__ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
+__ZNK7WebCore4KURL7hasPathEv
+__ZNK7WebCore4KURL9prettyURLEv
+__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
diff --git a/src/3rdparty/webkit/WebCore/WebCore.VideoProxy.exp b/src/3rdparty/webkit/WebCore/WebCore.VideoProxy.exp
new file mode 100644
index 0000000000..cead63fa49
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.VideoProxy.exp
@@ -0,0 +1,4 @@
+__ZN7WebCore9HTMLNames8videoTagE
+__ZN7WebCore9HTMLNames8audioTagE
+__ZN7WebCore16HTMLMediaElement19deliverNotificationE32MediaPlayerProxyNotificationType
+__ZN7WebCore16HTMLMediaElement19setMediaPlayerProxyEP19WebMediaPlayerProxy
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index 67de812609..ddce440aea 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -1,30 +1,37 @@
 __ZN7WebCore12IconDatabase20delayDatabaseCleanupEv
-__ZN7WebCore21reportThreadViolationEPKc
+__ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
+__ZN7WebCoreL43readThreadViolationBehaviorFromUserDefaultsEv
 __ZN7WebCore12iconDatabaseEv
+__ZN7WebCore12IconDatabaseC1Ev
 __ZN7WebCore12IconDatabaseC2Ev
-__ZN7WebCore5MutexC2Ev
-__ZN7WebCore15ThreadConditionC2Ev
-__ZN7WebCore13defaultClientEv
+__ZN7WebCore9TimerBaseC2Ev
+__ZN7WebCoreL13defaultClientEv
 __ZN7WebCore14SQLiteDatabaseC1Ev
+__ZN7WebCore14SQLiteDatabaseC2Ev
 __ZN7WebCore12IconDatabase10setEnabledEb
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
 __ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
 __ZN7WebCore6StringC1EP8NSString
+__ZN7WebCore6StringC2EP8NSString
 __ZN7WebCore10StringImpl6createEPKtj
+__ZN7WebCore10StringImpl19createUninitializedEjRPt
+__ZN7WebCore10StringImplnwEmPv
 __ZN3WTF6VectorItLm1024EE6shrinkEm
 __ZN7WebCore12IconDatabase4openERKNS_6StringE
 __ZNK7WebCore12IconDatabase6isOpenEv
-__ZN7WebCore5Mutex4lockEv
-__ZN7WebCore5Mutex6unlockEv
 __ZNK7WebCore6String4copyEv
 __ZN7WebCore10StringImpl4copyEv
 __ZN7WebCore12IconDatabase23defaultDatabaseFilenameEv
 __ZN7WebCore6StringC1EPKc
+__ZN7WebCore6StringC2EPKc
 __ZN7WebCore10StringImpl6createEPKc
+__ZN7WebCore10StringImpl6createEPKcj
 __ZN7WebCore24pathByAppendingComponentERKNS_6StringES2_
 __ZN7WebCore10StringImpl8endsWithEPS0_b
 __ZN7WebCore10StringImpl4findEPS0_ib
 __ZN7WebCore10StringImplD1Ev
+__ZN7WebCore10StringImplD2Ev
+__ZN7WebCore10StringImpldlEPv
 __ZN7WebCoreplERKNS_6StringEPKc
 __ZN7WebCoreplERKNS_6StringES2_
 __ZNK7WebCore6String7isEmptyEv
@@ -32,15 +39,9 @@ __ZN7WebCore6String6appendERKS0_
 __ZNK7WebCore6String6lengthEv
 __ZNK7WebCore6String10charactersEv
 __ZN7WebCore10StringImpl5adoptERNS_12StringBufferE
-__ZN7WebCore12createThreadEPFPvS0_ES0_
-__ZN7WebCore35establishIdentifierForPthreadHandleERP17_opaque_pthread_t
+__ZN7WebCore10StringImplnwEm
 __ZN7WebCore12IconDatabase27iconDatabaseSyncThreadStartEPv
 __ZN7WebCore12IconDatabase22iconDatabaseSyncThreadEv
-__ZN7WebCore14threadMapMutexEv
-__ZN7WebCore9threadMapEv
-__ZNK3WTF7HashMapIjP17_opaque_pthread_tNS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3getERKj
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E3addIjPN7WebCore17SegmentedFontDataENS_17HashMapTranslatorILb1ES1_IjSG_ENS_18PairBaseHashTraitsIS9_NS8_ISG_EEEESB_S6_EEEES1_INS_17HashTableIteratorIjS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E5clearEv
 __ZN7WebCore18makeAllDirectoriesERKNS_6StringE
 __ZN7WebCore24fileSystemRepresentationERKNS_6StringE
 __ZNK7WebCore6String14createCFStringEv
@@ -48,255 +49,99 @@ __ZN7WebCore10StringImpl14createCFStringEv
 __ZN7WebCore7CString16newUninitializedEmRPc
 __ZNK7WebCore7CString4dataEv
 __ZN3WTF6VectorIcLm0EE6shrinkEm
+__ZN7WebCore15AutodrainedPoolC1Ei
 __ZN7WebCore15AutodrainedPoolC2Ei
 __ZN7WebCore10fileExistsERKNS_6StringE
+__ZN7WebCore15AutodrainedPoolD1Ev
 __ZN7WebCore15AutodrainedPoolD2Ev
 __ZN7WebCore14SQLiteDatabase4openERKNS_6StringE
 __ZN7WebCore14SQLiteDatabase5closeEv
 __ZN7WebCore6String29charactersWithNullTerminationEv
 __ZN7WebCore10StringImpl34createWithTerminatingNullCharacterERKS0_
-_sqlite3_open16
-_sqlite3VdbeMemSetStr
-_WebCoreObjCFinalizeOnMainThread
-__ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
-__ZN7WebCore26initialiseMIMETypeRegistryEv
-__ZN7WebCore38initialiseSupportedJavaScriptMIMETypesEv
-__ZN3WTF7HashSetIN7WebCore6StringENS1_10StringHashENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E5clearEv
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplES4_NS_17IdentityExtractorIS4_EENS2_15CaseFoldingHashENS_10HashTraitsIS4_EES9_EENS8_INS2_6StringEEEE8derefAllERSA_
-__ZN7WebCore36initialiseSupportedNonImageMimeTypesEv
-_sqlite3VdbeMemRelease
-_sqlite3ValueText
-_sqlite3VdbeMemTranslate
-_sqlite3VdbeMemNulTerminate
-_openDatabase
-_createCollation
-_findCollSeqEntry
-_sqlite3HashInsert
-_strHash
-_sqlite3MallocX
-_rehash
-_sqlite3Error
-_strCompare
-_sqlite3BtreeOpen
-_sqlite3UnixThreadSpecificData
-_sqlite3UnixEnterMutex
-_sqlite3UnixFullPathname
-_sqlite3SetString
-_allocateUnixFile
-_findLockInfo
-_threadLockingTest
-_binHash
-_unixSectorSize
-_unixSeek
-_unixRead
-_sqlite3Realloc
-_sqlite3SchemaGet
-_sqlite3RegisterBuiltinFunctions
-_sqlite3CreateFunc
-_sqlite3FindFunction
-_sqlite3FreeX
-_sqlite3ApiExit
-_sqlite3RegisterLikeFunctions
-_sqlite3_exec
-_sqlite3Prepare
-_sqlite3RunParser
-_getToken
-_sqlite3Parser
-_yy_find_shift_action
-_yy_reduce
-_sqlite3Pragma
-_sqlite3VdbeAddOp
-_sqlite3VdbeChangeP3
-_freeP3
-_sqlite3VdbeMakeReady
-_yy_destructor
-_sqlite3DeleteTable
-_sqlite3DeleteTrigger
-_sqlite3Step
-_sqlite3VdbeExec
-_sqlite3VdbeHalt
-_sqlite3VdbeFreeCursor
-_sqlite3BtreeCommitPhaseTwo
-_sqlite3VdbeReset
-_Cleanup
-_sqlite3VdbeDelete
-__ZN7WebCore13currentThreadEv
 __ZN7WebCore15SQLiteStatementC1ERNS_14SQLiteDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatementC2ERNS_14SQLiteDatabaseERKNS_6StringE
 __ZN7WebCore15SQLiteStatement14executeCommandEv
 __ZN7WebCore15SQLiteStatement7prepareEv
-_sqlite3_prepare16_v2
-_sqlite3Prepare16
+_WebCoreObjCFinalizeOnMainThread
+__ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
+__ZN7WebCoreL26initializeMIMETypeRegistryEv
+__ZN7WebCoreL38initializeSupportedJavaScriptMIMETypesEv
+__ZN3WTF7HashSetIN7WebCore6StringENS1_10StringHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E13allocateTableEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E15deallocateTableE
+__ZN7WebCore5equalEPNS_10StringImplES1_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_EC1ERKS8_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_EC2ERKS8_
+__ZN7WebCoreL36initializeSupportedNonImageMimeTypesEv
+__ZN7WebCore14ArchiveFactory29registerKnownArchiveMIMETypesEv
+__ZN7WebCoreL16archiveMIMETypesEv
+__ZN3WTF7HashMapIN7WebCore6StringEPFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEENS1_15CaseFoldingHashENS_10HashTraitsIS
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorIS
 __ZN7WebCore15SQLiteStatement4stepEv
-_sqlite3_step
 __ZN7WebCore15SQLiteStatement8finalizeEv
-_sqlite3_finalize
 __ZN7WebCore15SQLiteStatementD1Ev
+__ZN7WebCore15SQLiteStatementD2Ev
 __ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
 __ZN7WebCore12IconDatabase25performOpenInitializationEv
-__ZN7WebCore21databaseVersionNumberERNS_14SQLiteDatabaseE
+__ZN7WebCoreL21databaseVersionNumberERNS_14SQLiteDatabaseE
 __ZN7WebCore15SQLiteStatement12getColumnIntEi
-_sqlite3Expr
-_heightOfSelect
-_sqlite3ExprListAppend
-_sqlite3SrcListAppendFromTerm
-_sqlite3SrcListAppend
-_sqlite3SelectNew
-_sqlite3Select
-_sqlite3SelectResolve
-_prepSelectStmt
-_sqlite3Init
-_sqlite3InitOne
-_sqlite3InitCallback
-_sqlite3StartTable
-_sqlite3FindTable
-_sqlite3EndTable
-_sqlite3BtreeCursor
-_sqlite3BtreeBeginTrans
-_sqlite3PagerAcquire
-_unixLock
-_unixFileSize
-_sqlite3BtreeInitPage
-_sqlite3BtreeGetMeta
-_sqlite3PagerUnref
-_sqlite3MPrintf
-_base_vprintf
-_mout
-_printf_realloc
-_walkExprTree
-_nameResolverStep
-_lookupName
-_sqlite3ExprDelete
-_processOrderGroupBy
-_simpleMinMaxQuery
-_computeLimitRegisters
-_sqlite3WhereBegin
-_findTerm
-_sqlite3OpenTable
-_sqlite3TableLock
-_selectInnerLoop
-_codeOffset
-_sqlite3ExprCode
-_sqlite3ExprCodeGetColumn
-_sqlite3ValueFromExpr
-_sqlite3WhereEnd
-_generateColumnNames
-_columnType
-_clearSelect
-_sqlite3SrcListDelete
-_sqlite3VdbeIntValue
-_moveToRoot
-_sqlite3BtreeParseCellPtr
-_sqlite3MallocRaw
-_sqlite3VdbeSerialGet
-_sqlite3_value_text
-_sqlite3_snprintf
-_sqlite3CreateIndex
-_sqlite3BtreeCommitStmt
-_sqlite3BtreeNext
-_sqlite3FixSrcList
-_sqlite3FixSelect
-_sqlite3AddPrimaryKey
-_pageDestructor
-_sqlite3BtreeCloseCursor
-_sqlite3AnalysisLoad
-_unixUnlock
-_whereClauseInsert
-_exprNodeIsConstant
-_exprAnalyze
-_exprTableUsage
-_exprSelectTableUsage
-_sqlite3GetCollSeq
-_sqlite3LocateCollSeq
-_codeAllEqualityTerms
-_codeEqualityTerm
-_applyAffinity
-_sqlite3VdbeSerialPut
-_sqlite3BtreeMoveto
-_sqlite3VdbeRecordCompare
-_sqlite3MemCompare
-_binCollFunc
-_sqlite3VdbeIdxKeyCompare
-_sqlite3VdbeMemFromBtree
-_sqlite3VdbeIdxRowid
-__ZN7WebCore15SQLiteStatement11columnCountEv
-_sqlite3_data_count
-_sqlite3_column_int
 __ZN7WebCore14SQLiteDatabase11tableExistsERKNS_6StringE
 __ZN7WebCoreplEPKcRKNS_6StringE
-_whereSplit
-_sqlite3ExprIfFalse
-_codeCompare
+__ZN7WebCore14SQLiteDatabase14clearAllTablesEv
+__ZN7WebCore15SQLiteStatement17returnTextResultsEiRN3WTF6VectorINS_6StringELm0EEE
+__ZN3WTF6VectorIN7WebCore6StringELm0EE14shrinkCapacityEm
+__ZN7WebCore14SQLiteDatabase9lastErrorEv
+__ZN7WebCoreL20createDatabaseTablesERNS_14SQLiteDatabaseE
+__ZN7WebCore14SQLiteDatabase14executeCommandERKNS_6StringE
+__ZN7WebCore6String6numberEi
+__ZN7WebCore6String6formatEPKcz
+__ZN3WTF6VectorIcLm256EE4growEm
+__ZN3WTF6VectorIcLm256EE6shrinkEm
 __ZN7WebCore12IconDatabase8importedEv
-__ZN7WebCore12IconDatabase16performURLImportEv
-_sqlite3JoinType
-_setJoinExpr
-_sqlite3ExprDup
-_sqlite3ExprListDup
-_sqlite3SelectDup
-_disableTerm
-_applyNumericAffinity
-__ZN7WebCore15SQLiteStatement13getColumnTextEi
-_sqlite3_column_text16
-__ZN7WebCore6StringC2EPKt
-__ZN3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN7WebCore13PageURLRecordC2ERKNS_6StringE
-__ZN7WebCore12IconDatabase21getOrCreateIconRecordERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN7WebCore10IconRecordC2ERKNS_6StringE
-__ZN7WebCore13PageURLRecord13setIconRecordEN3WTF10PassRefPtrINS_10IconRecordEEE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S6_EEEEbRKT_
-__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIPNS1_10StringImplES8_NS_17IdentityExtractorIS8_EENS1_10StringHashENS_10HashTraitsIS8_EESD_EES2_EEEEvT_SG_
-__ZN7WebCore16callOnMainThreadEPFvPvES0_
--[WebCoreFunctionWrapper initWithFunction:context:]
-__ZN7WebCore12IconDatabase18syncThreadMainLoopEv
-__ZN7WebCore12IconDatabase16readFromDatabaseEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESD_EES3_EEEEvT_SG_
-__ZN7WebCore12IconDatabase15writeToDatabaseEv
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableIPNS1_10StringImplESt4pairIS8_S2_ENS_18PairFirstExtractorISA_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS8_EENSF_IS2_EEEESG_EENS1_6StringES2_EEEEvT_SM_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_12IconSnapshotEENS_18PairFirstExtractorIS7_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IS6_EEEESD_EENS_18PairBaseHashTraitsINSC_INS2_6StringEEESE_EEE8derefAllERSG_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_12IconSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E6expandEv
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableIPNS1_10StringImplESt4pairIS8_S2_ENS_18PairFirstExtractorISA_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS8_EENSF_IS2_EEEESG_EENS1_6StringES2_EEEEvT_SM_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_15PageURLSnapshotEENS_18PairFirstExtractorIS7_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IS6_EEEESD_EENS_18PairBaseHashTraitsINSC_INS2_6StringEEESE_EEE8derefAllERSG_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E6expandEv
 __ZN7WebCore17SQLiteTransactionC1ERNS_14SQLiteDatabaseE
+__ZN7WebCore17SQLiteTransactionC2ERNS_14SQLiteDatabaseE
 __ZN7WebCore17SQLiteTransaction5beginEv
-__ZN7WebCore14SQLiteDatabase14executeCommandERKNS_6StringE
+__ZNK7WebCore12IconDatabase12databasePathEv
+__ZN7WebCore12IconDatabase11setImportedEb
 __ZN7WebCore17SQLiteTransaction6commitEv
-__ZN7WebCore12IconDatabase24checkForDanglingPageURLsEb
-__ZN7WebCore15SQLiteStatement23returnsAtLeastOneResultEv
-_codeInteger
-_sqlite3ExprIfTrue
-_sqlite3CodeSubselect
-_sqlite3PagerBegin
-_sqlite3PagerWrite
-_pager_write
-_zeroPage
-_sqlite3BtreeCreateTable
-_allocateBtreePage
-_sqlite3BtreeInsert
-_fillInCell
-_insertCell
-_allocateSpace
-_sqlite3BtreeClose
-_sqlite3BtreeRollback
-_sqlite3PagerRollback
-_pageReinit
-_pager_truncate_cache
-_sqlite3PagerClose
 __ZN7WebCore17SQLiteTransactionD1Ev
-__ZN7WebCore15ThreadCondition4waitERNS_5MutexE
+__ZN7WebCore17SQLiteTransactionD2Ev
+__ZN7WebCore12IconDatabase16performURLImportEv
+__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtractorIS2
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E5clearEv
+__ZN7WebCore12IconDatabase18syncThreadMainLoopEv
+__ZN7WebCore12IconDatabase15writeToDatabaseEv
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7_S2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_12IconSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashT
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7
+__ZN7WebCore12IconDatabase16readFromDatabaseEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtrac
+__ZN7WebCore6StringC1EPK10__CFString
 __ZN7WebCore6StringC2EPK10__CFString
-__ZN7WebCore17getMIMETypeForUTIERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S6_EEEENS_17HashTableIteratorIS3_S3_S5_S6_S8_S8_EERKT_
+__ZN7WebCore26MIMETypeForImageSourceTypeERKNS_6StringE
+__ZN7WebCore24StringWrapperCFAllocatorL9allocatorEv
+__ZN7WebCore24StringWrapperCFAllocatorL6retainEPKv
+__ZN7WebCore24StringWrapperCFAllocatorL8allocateElmPv
+__ZN7WebCore24StringWrapperCFAllocatorL10deallocateEPvS1_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_22Iden
 __ZN7WebCore10StringImplcvP8NSStringEv
-__ZN7WebCore11FrameLoader24registerURLSchemeAsLocalERKNS_6StringE
-__ZN7WebCore12localSchemesEv
-__ZN3WTF7HashSetIN7WebCore6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6expandEv
 __ZNK7WebCore12IconDatabase9isEnabledEv
 __ZN7WebCore12IconDatabase20retainIconForPageURLERKNS_6StringE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E8containsIS3_NS_22IdentityHashTranslatorIS3_S6_S9_EEEEbRKT_
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN7WebCore13PageURLRecordC1ERKNS_6StringE
+__ZN7WebCore13PageURLRecordC2ERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHas
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairH
+__ZN7WebCore11FrameLoader24registerURLSchemeAsLocalERKNS_6StringE
+__ZN7WebCoreL12localSchemesEv
+__ZN3WTF7HashSetIN7WebCore6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E13allocateTab
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E15deallocateT
 +[WebCoreViewFactory sharedFactory]
 -[WebCoreViewFactory init]
 +[WebCoreKeyGenerator sharedGenerator]
@@ -304,268 +149,374 @@ __ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
 __ZN7WebCore15DatabaseTracker7trackerEv
 __ZN7WebCore15DatabaseTrackerC1Ev
+__ZN7WebCore15DatabaseTrackerC2Ev
 __ZN7WebCore15DatabaseTracker24setDatabaseDirectoryPathERKNS_6StringE
 __ZN7WebCore15DatabaseTracker9setClientEPNS_21DatabaseTrackerClientE
+__ZN7WebCore12cacheStorageEv
+__ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
 __ZN7WebCore4PageC1EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
+__ZN7WebCore4PageC2EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
+__ZN7WebCore6ChromeC1EPNS_4PageEPNS_12ChromeClientE
 __ZN7WebCore6ChromeC2EPNS_4PageEPNS_12ChromeClientE
+__ZN7WebCore19SelectionControllerC1EPNS_5FrameEb
 __ZN7WebCore19SelectionControllerC2EPNS_5FrameEb
-__ZN7WebCore9SelectionC2Ev
+__ZN7WebCore16VisibleSelectionC1Ev
+__ZN7WebCore16VisibleSelectionC2Ev
+__ZN7WebCore14DragControllerC1EPNS_4PageEPNS_10DragClientE
 __ZN7WebCore14DragControllerC2EPNS_4PageEPNS_10DragClientE
-__ZN7WebCore4KURLC1Ev
-__ZN7WebCore16DeprecatedStringC1Ev
-__ZN7WebCore20DeprecatedStringDataC2Ev
-__ZN7WebCore16DeprecatedString20makeSharedNullHandleEv
-__ZN7WebCore16DeprecatedString14makeSharedNullEv
+__ZN7WebCore4KURL10invalidateEv
+__ZN7WebCore15FocusControllerC1EPNS_4PageE
 __ZN7WebCore15FocusControllerC2EPNS_4PageE
+__ZN7WebCore21ContextMenuControllerC1EPNS_4PageEPNS_17ContextMenuClientE
 __ZN7WebCore21ContextMenuControllerC2EPNS_4PageEPNS_17ContextMenuClientE
+__ZN7WebCore19InspectorControllerC1EPNS_4PageEPNS_15InspectorClientE
 __ZN7WebCore19InspectorControllerC2EPNS_4PageEPNS_15InspectorClientE
+__ZN7WebCore8SettingsC1EPNS_4PageE
 __ZN7WebCore8SettingsC2EPNS_4PageE
 __ZN7WebCore12AtomicString4initEv
 __ZN7WebCore12AtomicString3addEPKc
 __ZN7WebCore10StringImpl5emptyEv
+__ZN7WebCore16threadGlobalDataEv
+__ZN7WebCore16ThreadGlobalDataC1Ev
+__ZN7WebCore16ThreadGlobalDataC2Ev
+__ZN7WebCore10StringImplC1Ev
 __ZN7WebCore10StringImplC2Ev
-__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EES4_S6_S6_EES3_EEbERKT_
+__ZN7WebCore10EventNamesC1Ev
+__ZN7WebCore10EventNamesC2Ev
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24H
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E13allocateTa
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E15deallocate
 __ZN7WebCore10StringImplC1EPKcjj
+__ZN7WebCore10StringImplC2EPKcjj
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findIS3_NS_
+__ZN7WebCore12AtomicStringC2EPKc
+__ZN7WebCore12ThreadTimersC1Ev
+__ZN7WebCore12ThreadTimersC2Ev
+__ZN7WebCoreL21mainThreadSharedTimerEv
+__ZN7WebCore12ThreadTimers14setSharedTimerEPNS_11SharedTimerE
+__ZN7WebCore21MainThreadSharedTimer16setFiredFunctionEPFvvE
+__ZN7WebCore27setSharedTimerFiredFunctionEPFvvE
+__ZN7WebCore12ThreadTimers17updateSharedTimerEv
+__ZN7WebCore21MainThreadSharedTimer4stopEv
+__ZN7WebCore15stopSharedTimerEv
+__ZN7WebCore15ProgressTrackerC1Ev
 __ZN7WebCore15ProgressTrackerC2Ev
 __ZN7WebCore15BackForwardListC1EPNS_4PageE
-__ZN7WebCore31setFocusRingColorChangeFunctionEPFvvE
-__ZN7WebCore11observeTintEv
-+[WebCoreControlTintObserver controlTintDidChange]
-__ZN7WebCore19makeRGBAFromNSColorEP7NSColor
-__ZN7WebCore8makeRGBAEiiii
+__ZN7WebCore15BackForwardListC2EPNS_4PageE
+__ZN7WebCore20networkStateNotifierEv
+__ZN7WebCore20NetworkStateNotifierC1Ev
+__ZN7WebCore20NetworkStateNotifierC2Ev
+__ZN7WebCore20NetworkStateNotifier11updateStateEv
+__ZN7WebCore20NetworkStateNotifier30setNetworkStateChangedFunctionEPFvvE
 __ZN3WTF7HashSetIPN7WebCore4PageENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6expandEv
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6rehashEi
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E13allocateTableEi
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E15deallocateTableEPii
--[WebCoreFrameBridge init]
-__ZN7WebCore9TimerBaseC2Ev
-__ZN7WebCore27setSharedTimerFiredFunctionEPFvvE
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
+__ZN7WebCore21JavaScriptDebugServer6sharedEv
+__ZN7WebCore21JavaScriptDebugServerC1Ev
+__ZN7WebCore21JavaScriptDebugServerC2Ev
+__ZN7WebCore21JavaScriptDebugServer11pageCreatedEPNS_4PageE
+__ZN7WebCore21JavaScriptDebugServer28hasListenersInterestedInPageEPNS_4PageE
+__ZNK3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_
+__ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
 __ZN7WebCore5FrameC1EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
-__ZN7WebCore12FramePrivateC2EPNS_4PageEPNS_5FrameES4_PNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
+__ZN7WebCore5FrameC2EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
+__ZN7WebCore11FrameLoaderC1EPNS_5FrameEPNS_17FrameLoaderClientE
+__ZN7WebCore11FrameLoaderC2EPNS_5FrameEPNS_17FrameLoaderClientE
+__ZN7WebCore11PolicyCheckC1Ev
+__ZN7WebCore11PolicyCheckC2Ev
+__ZN3WTF6RefPtrIN7WebCore10StringImplEED2Ev
+__ZN7WebCore16ScriptControllerC1EPNS_5FrameE
+__ZN7WebCore16ScriptControllerC2EPNS_5FrameE
+__ZN7WebCore16ScriptController18initJavaJSBindingsEv
+__ZN3JSC8Bindings12JavaJSObject22initializeJNIThreadingEv
+__ZN3JSC8Bindings8Instance21setDidExecuteFunctionEPFvPNS_9ExecStateEPNS_8JSObjectEE
+__ZN7WebCore6EditorC1EPNS_5FrameE
 __ZN7WebCore6EditorC2EPNS_5FrameE
+__ZN7WebCore22DeleteButtonControllerC1EPNS_5FrameE
 __ZN7WebCore22DeleteButtonControllerC2EPNS_5FrameE
+__ZN7WebCore12EventHandlerC1EPNS_5FrameE
 __ZN7WebCore12EventHandlerC2EPNS_5FrameE
 __ZN7WebCore19AnimationControllerC1EPNS_5FrameE
+__ZN7WebCore19AnimationControllerC2EPNS_5FrameE
 __ZN7WebCore26AnimationControllerPrivateC1EPNS_5FrameE
-__ZN7WebCore11FrameLoaderC2EPNS_5FrameEPNS_17FrameLoaderClientE
-__ZN7WebCore11PolicyCheckC2Ev
-__ZN7WebCore16DeprecatedStringC1ERKS0_
-__ZN7WebCore16DeprecatedStringD1Ev
-__ZN7WebCore20DeprecatedStringDataD2Ev
-__ZN7WebCore10EventNames4initEv
-__ZN3WTF6RefPtrIN7WebCore10StringImplEEC2EPS2_
-__ZN3WTF10RefCountedIN7WebCore10StringImplEE3refEv
+__ZN7WebCore26AnimationControllerPrivateC2EPNS_5FrameE
 __ZN7WebCore9HTMLNames4initEv
+__ZN7WebCore13QualifiedNameC1ERKNS_12AtomicStringES3_S3_
 __ZN7WebCore13QualifiedNameC2ERKNS_12AtomicStringES3_S3_
-__ZN3WTF7HashSetIPN7WebCore13QualifiedName17QualifiedNameImplENS1_9QNameHashENS_10HashTraitsIS4_EEE3addINS1_23QualifiedNameComponentsENS1_25QNameComponentsTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EES5_S7_S7_EES4_EEbERKT_
-__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_9QNameHashENS_10HashTraitsIS4_EES9_E6expandEv
+__ZN3WTF7HashSetIPN7WebCore13QualifiedName17QualifiedNameImplENS1_17QualifiedNameHashENS_10HashTraitsIS4_EEE3addINS1_23Qualifie
+__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_17QualifiedNameHashENS_10Has
 __ZN7WebCore12AtomicString3addEPNS_10StringImplE
-__ZN7WebCore12AtomicStringD1Ev
 __ZN3WTF10RefCountedIN7WebCore10StringImplEE5derefEv
-__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_9QNameHashENS_10HashTraitsIS4_EES9_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S7_EEEENS_17HashTableIteratorIS4_S4_S6_S7_S9_S9_EERKT_
 __ZN7WebCore13QualifiedName4initEv
 __ZN7WebCore17MediaFeatureNames4initEv
 __ZN7WebCore8SVGNames4initEv
 __ZN7WebCore10XLinkNames4initEv
 __ZN7WebCore8XMLNames4initEv
 __ZN7WebCore4Page12setMainFrameEN3WTF10PassRefPtrINS_5FrameEEE
-__ZN7WebCore5Frame9setBridgeEP18WebCoreFrameBridge
 __ZNK7WebCore5Frame4treeEv
 __ZN7WebCore9FrameTree7setNameERKNS_12AtomicStringE
+__ZNK7WebCore9FrameTree6parentEb
 __ZN7WebCore5Frame4initEv
 __ZN7WebCore11FrameLoader4initEv
-__ZNK7WebCore6String16deprecatedStringEv
-__ZN7WebCore16DeprecatedStringC2EPKci
-__ZN7WebCore20DeprecatedStringData10initializeEPKcj
-__ZN7WebCore4KURLC1ERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL5parseEPKcPKNS_16DeprecatedStringE
-__ZN7WebCore16DeprecatedStringaSEPKc
-__ZN7WebCore16DeprecatedString9setLatin1EPKci
-__ZN7WebCore16DeprecatedString26detachAndDiscardCharactersEv
-__ZN7WebCore16DeprecatedString6detachEv
-__ZN7WebCore20DeprecatedStringDataC2EPKcj
-__ZN7WebCore10freeHandleEPPNS_20DeprecatedStringDataE
+__ZN7WebCore4KURLC1EPKc
+__ZN7WebCore4KURLC2EPKc
+__ZN7WebCore4KURL5parseEPKcPKNS_6StringE
 __ZN7WebCore14DocumentLoaderC2ERKNS_15ResourceRequestERKNS_14SubstituteDataE
-__ZN3WTF6RefPtrIN7WebCore18MainResourceLoaderEEC2Ev
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore14ResourceLoaderEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF6RefPtrIN7WebCore12SharedBufferEEC2Ev
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSB_IiEEEESC_EENS_18PairBaseHashTraitsINSB_INS2_6StringEEENSB_IjEEEEE8derefAllERSF_
-__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3setERKS2_S8_
-__ZN7WebCore4KURLD1Ev
-__ZN3WTF9RetainPtrI12NSURLRequestEC2Ev
-__ZN7WebCore6StringC1Ev
-__ZN3WTF9RetainPtrI13NSURLResponseEC2Ev
-__ZN7WebCore13ResourceErrorC1Ev
+__ZN3WTF6VectorIN7WebCore6StringELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore6StringELm0EEC2ERKS3_
 __ZN7WebCore16NavigationActionC1Ev
-__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EEC2Ev
+__ZN7WebCore16NavigationActionC2Ev
 __ZNK7WebCore5Frame4pageEv
 __ZN7WebCore11FrameLoader23setPolicyDocumentLoaderEPNS_14DocumentLoaderE
 __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
 __ZN7WebCore14DocumentLoader13attachToFrameEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E4swapERSE_
 __ZN7WebCore11FrameLoader28setProvisionalDocumentLoaderEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader8setStateENS_10FrameStateE
 __ZN7WebCore11FrameLoader22provisionalLoadStartedEv
-__ZNK7WebCore5Frame8documentEv
-__ZNK7WebCore5Frame6loaderEv
-__ZNK7WebCore11FrameLoader10isCompleteEv
 __ZN7WebCore11FrameLoader17cancelRedirectionEb
 __ZN7WebCore11FrameLoader20stopRedirectionTimerEv
 __ZNK7WebCore9TimerBase8isActiveEv
-__ZN7WebCore14DocumentLoader11setResponseERKNS_16ResourceResponseE
-__ZN7WebCore16DeprecatedStringaSERKS0_
-__ZN7WebCore16DeprecatedString5derefEv
+__ZN7WebCoreL17timersReadyToFireEv
+__ZNK3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8containsIS4
 __ZN7WebCore14DocumentLoader15finishedLoadingEv
 __ZN7WebCore14DocumentLoader13commitIfReadyEv
 __ZNK7WebCore14DocumentLoader11frameLoaderEv
+__ZNK7WebCore5Frame6loaderEv
 __ZN7WebCore11FrameLoader21commitProvisionalLoadEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN7WebCore11FrameLoader23cachePageForHistoryItemEPNS_11HistoryItemE
 __ZN7WebCore11FrameLoader12canCachePageEv
 __ZNK7WebCore11FrameLoader8loadTypeEv
+__ZN7WebCore11FrameLoader31canCachePageContainingThisFrameEv
 __ZN7WebCore11FrameLoader19closeOldDataSourcesEv
 __ZN7WebCore11FrameLoader21transitionToCommittedEN3WTF10PassRefPtrINS_10CachedPageEEE
 __ZN7WebCore11FrameLoader22updateHistoryForCommitEv
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
 __ZN7WebCore11FrameLoader17setDocumentLoaderEPNS_14DocumentLoaderE
-__ZNK7WebCore11FrameLoader14documentLoaderEv
 __ZN7WebCore11FrameLoader14detachChildrenEv
-__ZNK7WebCore14DocumentLoader5titleEv
 __ZN7WebCore11FrameLoader28updateHistoryForStandardLoadEv
-__ZNK7WebCore5Frame12ownerElementEv
-__ZNK7WebCore14DocumentLoader16isClientRedirectEv
+__ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore14DocumentLoader13urlForHistoryEv
 __ZNK7WebCore19ResourceRequestBase3urlEv
 __ZNK7WebCore19ResourceRequestBase21updateResourceRequestEv
 __ZNK7WebCore5Frame4viewEv
-__ZNK7WebCore14DocumentLoader8responseEv
 __ZNK7WebCore16ResourceResponse13nsURLResponseEv
-__ZNK7WebCore4KURL8getNSURLEv
-__ZNK7WebCore16DeprecatedString6isNullEv
--[WebCoreFrameBridge createFrameViewWithNSView:marginWidth:marginHeight:]
+__ZNK7WebCore4KURLcvP5NSURLEv
+-[NSURLResponse(WebCoreURLResponse) _webcore_MIMEType]
+__ZNK7WebCore5Frame13ownerRendererEv
 __ZN7WebCore5Frame7setViewEPNS_9FrameViewE
 __ZNK7WebCore5Frame12eventHandlerEv
 __ZN7WebCore12EventHandler5clearEv
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase15setNextFireTimeEd
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_2
 __ZN7WebCore11FrameLoader37resetMultipleFormSubmissionProtectionEv
+__ZN7WebCore9FrameViewC1EPNS_5FrameE
 __ZN7WebCore9FrameViewC2EPNS_5FrameE
+__ZN7WebCore10ScrollViewC2Ev
+__ZN7WebCore6WidgetC2EP6NSView
+__ZN7WebCore6Widget4initEP6NSView
 __ZN7WebCore9FrameView4initEv
+__ZN7WebCore9FrameView5resetEv
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14shrinkCapacityEm
+__ZNK7WebCore5Frame8documentEv
+__ZN7WebCore10ScrollView4showEv
 __ZN7WebCore6Widget4showEv
-__ZN7WebCore6Widget7setViewEP6NSView
-__ZNK7WebCore5Frame6bridgeEv
--[WebCoreFrameBridge setDrawsBackground:]
 __ZN7WebCore9FrameView14setTransparentEb
--[WebCoreFrameBridge setBaseBackgroundColor:]
 __ZN7WebCore16colorFromNSColorEP7NSColor
+__ZN7WebCoreL19makeRGBAFromNSColorEP7NSColor
+__ZN7WebCore8makeRGBAEiiii
 __ZN7WebCore9FrameView22setBaseBackgroundColorENS_5ColorE
+__ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
--[WebCoreFrameBridge installInFrame:]
-__ZN7WebCore5Frame13ownerRendererEv
+__ZN7WebCore6Widget21releasePlatformWidgetEv
+__ZN7WebCore6Widget20retainPlatformWidgetEv
 __ZN7WebCore9FrameView14initScrollbarsEv
-__ZNK7WebCore10ScrollView14hScrollbarModeEv
-__ZNK7WebCore6Widget7getViewEv
-__ZN7WebCore9FrameView17setScrollbarsModeENS_13ScrollbarModeE
-__ZN7WebCore10ScrollView17setScrollbarsModeENS_13ScrollbarModeE
-__ZNK7WebCore11FrameLoader6clientEv
+__ZN7WebCore9FrameView27updateDefaultScrollbarStateEv
+__ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
+__ZNK7WebCore10ScrollView22platformScrollbarModesERNS_13ScrollbarModeES2_
+__ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
+__ZN7WebCore10ScrollView16setParentVisibleEb
+__ZNK7WebCore5Frame12ownerElementEv
 __ZNK7WebCore14DocumentLoader16responseMIMETypeEv
 __ZNK7WebCore20ResourceResponseBase8mimeTypeEv
-__ZNK7WebCore20ResourceResponseBase22updateResourceResponseEv
+__ZNK7WebCore20ResourceResponseBase8lazyInitEv
+__ZN7WebCore16ResourceResponse16platformLazyInitEv
 __ZNK7WebCore14DocumentLoader3urlEv
 __ZNK7WebCore14DocumentLoader7requestEv
 __ZNK7WebCore14DocumentLoader11responseURLEv
 __ZNK7WebCore20ResourceResponseBase3urlEv
-__ZN7WebCore4KURLC2EPKc
-__ZN7WebCore22appendEscapingBadCharsERPcPKcm
-__ZN7WebCore20DeprecatedStringData14createAndAdoptERS0_
-__ZN7WebCore20DeprecatedStringData5adoptERS0_
+__ZN7WebCore8blankURLEv
+__ZN7WebCoreL22appendEscapingBadCharsERPcPKcm
+__ZN7WebCore6StringC1EPKcj
+__ZN7WebCore6StringC2EPKcj
 __ZN3WTF6VectorIcLm4096EE6shrinkEm
 __ZN7WebCore11FrameLoader10didOpenURLERKNS_4KURLE
 __ZNK7WebCore5Frame6editorEv
-__ZN7WebCore6Editor18setLastEditCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore6Editor20clearLastEditCommandEv
 __ZN7WebCore11FrameLoader8closeURLEv
 __ZN7WebCore11FrameLoader17saveDocumentStateEv
 __ZN7WebCore11FrameLoader11stopLoadingEb
 __ZN7WebCore6Editor23clearUndoRedoOperationsEv
 __ZNK7WebCore6Editor6clientEv
-__ZN7WebCore5Frame18setJSStatusBarTextERKNS_6StringE
-__ZN7WebCore6Chrome16setStatusbarTextEPNS_5FrameERKNS_6StringE
-__ZNK7WebCore5Frame25backslashAsCurrencySymbolEv
-__ZN7WebCore5Frame25setJSDefaultStatusBarTextERKNS_6StringE
-__ZNK7WebCore4KURL8protocolEv
-__ZNK7WebCore16DeprecatedString4leftEj
-__ZNK7WebCore16DeprecatedString3midEjj
-__ZNK7WebCore16DeprecatedString10startsWithEPKc
+__ZNK7WebCore4KURL10protocolIsEPKc
+__ZNK7WebCore6StringixEj
 __ZN7WebCore11FrameLoader7startedEv
-__ZN7WebCore11FrameLoader6openedEv
-__ZNK7WebCore14DocumentLoader23isLoadingFromCachedPageEv
 __ZN7WebCore11FrameLoader23finishedLoadingDocumentEPNS_14DocumentLoaderE
+__ZN7WebCore14ArchiveFactory17isArchiveMimeTypeERKNS_6StringE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorI
 __ZN7WebCore11FrameLoader3endEv
 __ZN7WebCore11FrameLoader27endIfNotLoadingMainResourceEv
-__ZN7WebCore11FrameLoader14checkCompletedEv
-__ZN7WebCore11FrameLoader22checkCallImplicitCloseEv
-__ZN7WebCore11FrameLoader9completedEv
-__ZN7WebCore11FrameLoader15submitFormAgainEv
-__ZN7WebCore11FrameLoader17checkLoadCompleteEv
-__ZN7WebCore11FrameLoader26recursiveCheckLoadCompleteEv
-__ZN7WebCore11FrameLoader29checkLoadCompleteForThisFrameEv
-__ZNK7WebCore14DocumentLoader19isLoadingInAPISenseEv
-__ZNK7WebCore11FrameLoader5stateEv
-__ZNK7WebCore14DocumentLoader9isLoadingEv
-__ZNK7WebCore11FrameLoader17subframeIsLoadingEv
-__ZN7WebCore11FrameLoader16markLoadCompleteEv
-__ZN7WebCore11FrameLoader18frameLoadCompletedEv
-__ZN7WebCore11FrameLoader22setPreviousHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore11currentTimeEv
-__ZN7WebCore14DocumentLoader22stopRecordingResponsesEv
-__ZN7WebCore11FrameLoader15startIconLoaderEv
-__ZNK7WebCore11FrameLoader18isLoadingMainFrameEv
-__ZN7WebCore11FrameLoader7iconURLEv
-__ZN7WebCoreeqERKNS_16DeprecatedStringEPKc
-__ZN7WebCore6StringC1ERKNS_16DeprecatedStringE
-__ZN7WebCore20DeprecatedStringData11makeUnicodeEv
 __ZN7WebCore11FrameLoader5beginERKNS_4KURLEbPNS_14SecurityOriginE
-__ZN7WebCore11FrameLoader5clearEbb
-__ZN7WebCore6Editor5clearEv
-__ZN7WebCore4KURL7setUserERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL7setPassERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL6setRefERKNS_16DeprecatedStringE
 __ZNK7WebCore5Frame16inViewSourceModeEv
-__ZN7WebCore17DOMImplementation8instanceEv
 __ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringEPNS_5FrameEb
 __ZN7WebCore5equalEPNS_10StringImplEPKc
-__ZN7WebCore12HTMLDocumentC2EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore13ContainerNodeC2EPNS_8DocumentE
-__ZN7WebCore15EventTargetNodeC2EPNS_8DocumentE
-__ZN7WebCore4NodeC2EPNS_8DocumentE
+__ZN7WebCore12HTMLDocumentC1EPNS_5FrameE
+__ZN7WebCore12HTMLDocumentC2EPNS_5FrameE
+__ZN7WebCore8DocumentC2EPNS_5FrameEb
+__ZN7WebCore4NodeC2EPNS_8DocumentEbbb
+__ZN7WebCore22ScriptExecutionContextC2Ev
 __ZN7WebCore14StyleSheetListC1EPNS_8DocumentE
-__ZN7WebCore21DeprecatedPtrListImplC2EPFvPvE
-__ZN7WebCore23DeprecatedValueListImplC2EPFvPNS_27DeprecatedValueListImplNodeEEPFS2_S2_E
-__ZN7WebCore14HTMLCollection14CollectionInfoC2Ev
-__ZN7WebCore14HTMLCollection14CollectionInfo5resetEv
-__ZN3WTF20deleteAllPairSecondsIPNS_6VectorIPN7WebCore7ElementELm0EEEKNS_7HashMapIPNS2_16AtomicStringImplES6_NS_7PtrHashIS9_EENS_10HashTraitsIS9_EENSC_IS6_EEEEEEvRT0_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E4swapERSB_
-__ZN7WebCore9DocLoaderC2EPNS_5FrameEPNS_8DocumentE
+__ZN7WebCore14StyleSheetListC2EPNS_8DocumentE
+__ZN7WebCore15CollectionCacheC1Ev
+__ZN7WebCore15CollectionCacheC2Ev
+__ZN7WebCore15CollectionCache5resetEv
+__ZN3WTF20deleteAllPairSecondsIPNS_6VectorIPN7WebCore7ElementELm0EEEKNS_7HashMapIPNS2_16AtomicStringImplES6_NS_7PtrHashIS9_EENS
+__ZN7WebCore9DocLoaderC1EPNS_8DocumentE
+__ZN7WebCore9DocLoaderC2EPNS_8DocumentE
 __ZN7WebCore5cacheEv
+__ZN7WebCore5CacheC1Ev
 __ZN7WebCore5CacheC2Ev
+__ZN7WebCore6LoaderC1Ev
 __ZN7WebCore6LoaderC2Ev
+__ZN7WebCore6Loader4HostC1ERKNS_12AtomicStringEj
+__ZN7WebCore6Loader4HostC2ERKNS_12AtomicStringEj
+__ZN7WebCore43initializeMaximumHTTPConnectionCountPerHostEv
 __ZN7WebCore5Cache12addDocLoaderEPNS_9DocLoaderE
 __ZN3WTF7HashSetIPN7WebCore9DocLoaderENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore8Document14resetLinkColorEv
+__ZN7WebCore7makeRGBEiii
+__ZN7WebCore8Document21resetVisitedLinkColorEv
+__ZN7WebCore8Document20resetActiveLinkColorEv
+__ZN7WebCore5Color13setNamedColorERKNS_6StringE
+__ZN7WebCore8Document19initSecurityContextEv
+__ZN7WebCore14SecurityOrigin6createERKNS_4KURLE
+__ZN7WebCore14SecurityOriginC1ERKNS_4KURLE
+__ZN7WebCore14SecurityOriginC2ERKNS_4KURLE
+__ZNK7WebCore4KURL8protocolEv
+__ZNK7WebCore6String9substringEjj
+__ZN7WebCore10StringImpl9substringEjj
+__ZNK7WebCore6String5lowerEv
+__ZN7WebCore10StringImpl5lowerEv
+__ZNK7WebCore4KURL4hostEv
+__ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringE
+__ZN7WebCore12UTF8EncodingEv
+__ZN7WebCore12TextEncodingC1EPKc
+__ZN7WebCore12TextEncodingC2EPKc
+__ZN7WebCore31atomicCanonicalTextEncodingNameEPKc
+__ZN7WebCore15TextCodecLatin121registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCoreL24addToTextEncodingNameMapEPKcS1_
+__ZNK3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3getERKS2_
+__ZN3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3addERKS2_S9_
+__ZN3WTF9HashTableIPKcSt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10Hash
+__ZN7WebCore15TextCodecLatin114registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCoreL17addToTextCodecMapEPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvES9_
+__ZN3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIPKcSt4pairIS2_N7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14PairHashTraits
+__ZN7WebCore14TextCodecUTF1621registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCore14TextCodecUTF1614registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCore20TextCodecUserDefined21registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCore20TextCodecUserDefined14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCore12TextCodecICU25registerBaseEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecICU18registerBaseCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCoreL21encodingRegistryMutexEv
+__ZNK7WebCore12TextEncoding25backslashAsCurrencySymbolEv
+__ZN7WebCore30noExtendedTextEncodingNameUsedEv
+__ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore10StringImpl4findEti
+__ZN3WTF6VectorItLm0EE6appendItEEvPKT_m
+__ZN7WebCore10StringImpl5adoptERN3WTF6VectorItLm0EEE
+__ZNK7WebCore4KURL4portEv
+__ZN7WebCore11FrameLoader30shouldTreatURLSchemeAsNoAccessERKNS_6StringE
+__ZN7WebCoreL15noAccessSchemesEv
+__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E8containsIS2
+__ZNK7WebCore14SecurityOrigin7isLocalEv
+__ZN7WebCore11FrameLoader27shouldTreatURLSchemeAsLocalERKNS_6StringE
+__ZN7WebCoreL24isDefaultPortForProtocolEtRKNS_6StringE
+__ZN7WebCore22ScriptExecutionContext17setSecurityOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
+__ZN7WebCore11FrameLoader32allowSubstituteDataAccessToLocalEv
 __ZNK7WebCore8Document8settingsEv
-__ZNK7WebCore5Frame8settingsEv
+__ZNK7WebCore14SecurityOrigin7isEmptyEv
+__ZN7WebCore11FrameLoader6openerEv
+__ZN7WebCore8Document15initDNSPrefetchEv
+__ZNK7WebCore8Document14parentDocumentEv
+__ZN7WebCore11FrameLoader5clearEbb
+__ZN7WebCore6Editor5clearEv
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE14shrinkCapacityEm
+__ZN7WebCore5Frame6scriptEv
+__ZN7WebCore16ScriptController27updatePlatformScriptObjectsEv
+__ZN7WebCore4KURL7setUserERKNS_6StringE
+__ZN7WebCore4KURL7setPassERKNS_6StringE
+__ZN7WebCore4KURL6setRefERKNS_6StringE
+__ZN7WebCore5Frame11setDocumentEN3WTF10PassRefPtrINS_8DocumentEEE
+__ZNK7WebCore5Frame9selectionEv
+__ZNK7WebCore19SelectionController18isFocusedAndActiveEv
+__ZN7WebCore8Document6attachEv
+__ZN7WebCore11RenderArenaC1Ej
+__ZN7WebCore11RenderArenaC2Ej
+__ZN7WebCore13InitArenaPoolEPNS_9ArenaPoolEPKcjj
+__ZNK7WebCore8Document4viewEv
+__ZN7WebCore12RenderObjectnwEmPNS_11RenderArenaE
+__ZN7WebCore11RenderArena8allocateEm
+__ZN7WebCore13ArenaAllocateEPNS_9ArenaPoolEj
+__ZN7WebCore10RenderViewC1EPNS_4NodeEPNS_9FrameViewE
+__ZN7WebCore10RenderViewC2EPNS_4NodeEPNS_9FrameViewE
+__ZN7WebCore11RenderBlockC2EPNS_4NodeE
+__ZN7WebCore9RenderBoxC2EPNS_4NodeE
+__ZN7WebCore20RenderBoxModelObjectC2EPNS_4NodeE
+__ZN7WebCore12RenderObjectC2EPNS_4NodeE
+__ZN7WebCore12RenderObject18setPrefWidthsDirtyEbb
+__ZN7WebCore11RenderLayernwEmPNS_11RenderArenaE
+__ZN7WebCore11RenderLayerC1EPNS_20RenderBoxModelObjectE
+__ZN7WebCore11RenderLayerC2EPNS_20RenderBoxModelObjectE
+__ZNK7WebCore11RenderLayer22shouldBeNormalFlowOnlyEv
+__ZNK7WebCore11RenderBlock15virtualChildrenEv
 __ZNK7WebCore8Document14userStyleSheetEv
 __ZN7WebCore16CSSStyleSelectorC1EPNS_8DocumentERKNS_6StringEPNS_14StyleSheetListEPNS_13CSSStyleSheetEbb
-__ZN7WebCore15BackgroundLayerC2Ev
-__ZN7WebCore16CSSStyleSelector4initEv
+__ZN7WebCore16CSSStyleSelectorC2EPNS_8DocumentERKNS_6StringEPNS_14StyleSheetListEPNS_13CSSStyleSheetEbb
+__ZN7WebCore9FillLayerC1ENS_14EFillLayerTypeE
+__ZN7WebCore9FillLayerC2ENS_14EFillLayerTypeE
+__ZN7WebCore16CSSStyleSelector15SelectorCheckerC1EPNS_8DocumentEb
+__ZN7WebCore16CSSStyleSelector15SelectorCheckerC2EPNS_8DocumentEb
+__ZNK7WebCore12HTMLDocument14isHTMLDocumentEv
 __ZN7WebCore15CSSFontSelectorC1EPNS_8DocumentE
-__ZN7WebCore16CSSStyleSelector16loadDefaultStyleEv
+__ZN7WebCore15CSSFontSelectorC2EPNS_8DocumentE
+__ZN7WebCore9fontCacheEv
+__ZN7WebCore9FontCache9addClientEPNS_12FontSelectorE
+__ZN3WTF7HashSetIPN7WebCore12FontSelectorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore16CSSStyleSelector4initEv
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14shrinkCapacityEm
+__ZNK7WebCore8Document20cacheDocumentElementEv
+__ZN7WebCore10CSSRuleSetC1Ev
 __ZN7WebCore10CSSRuleSetC2Ev
-__ZN7WebCore12parseUASheetIA9488_cEEPNS_13CSSStyleSheetERKT_
-__ZN7WebCore12parseUASheetEPKcj
+__ZN7WebCoreL12parseUASheetEPKcj
+__ZN7WebCoreL12parseUASheetERKNS_6StringE
+__ZN7WebCore13CSSStyleSheetC1EPS0_RKNS_6StringES4_
 __ZN7WebCore13CSSStyleSheetC2EPS0_RKNS_6StringES4_
 __ZN7WebCore10StyleSheetC2EPS0_RKNS_6StringE
-__ZN7WebCore6StringC1EPKcj
-__ZN7WebCore10StringImpl6createEPKcj
 __ZN7WebCore13CSSStyleSheet11parseStringERKNS_6StringEb
+__ZN7WebCore9CSSParserC1Eb
 __ZN7WebCore9CSSParserC2Eb
 __ZN7WebCore9CSSParser10parseSheetEPNS_13CSSStyleSheetERKNS_6StringE
 __ZN7WebCore9CSSParser11setupParserEPKcRKNS_6StringES2_
@@ -573,486 +524,548 @@ __Z10cssyyparsePv
 __ZN7WebCore9CSSParser3lexEPv
 __ZN7WebCore9CSSParser3lexEv
 __ZN7WebCore9CSSParser4textEPi
-__ZNK7WebCore13CSSStyleSheet15isCSSStyleSheetEv
-__ZN7WebCore12AtomicString3addEPKti
-__ZN7WebCore13CSSStyleSheet12addNamespaceEPNS_9CSSParserERKNS_12AtomicStringES5_
 __ZNK7WebCore9CSSParser8documentEv
+__ZNK7WebCore13CSSStyleSheet15isCSSStyleSheetEv
 __ZN7WebCore9CSSParser22createFloatingSelectorEv
-__ZN7WebCore13QualifiedNameC2ERKS0_
 __ZN3WTF7HashSetIPN7WebCore11CSSSelectorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore13QualifiedNameaSERKS0_
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateT
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
+__ZN7WebCore12AtomicString3addEPKti
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslat
 __ZN7WebCore13QualifiedName5derefEv
-__ZN7WebCore13QualifiedNameD2Ev
-__ZN7WebCore11ParseString5lowerEv
-__ZN7WebCore16deprecatedStringERKNS_11ParseStringE
-__ZN7WebCore16DeprecatedStringC2EPKNS_14DeprecatedCharEj
-__ZN7WebCore20DeprecatedStringData10initializeEPKNS_14DeprecatedCharEj
-__ZN7WebCore20DeprecatedStringData9makeAsciiEv
-__ZN7WebCore13getPropertyIDEPKci
-__Z8findPropPKcj
-__ZNK7WebCore16DeprecatedString5lowerEv
-__Z9findValuePKcj
+__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE6shrinkEm
+__ZN7WebCore9CSSParser20sinkFloatingSelectorEPNS_11CSSSelectorE
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAnd
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE15reserveCapacityEm
+__ZN7WebCore13cssPropertyIDERKNS_15CSSParserStringE
+__ZN7WebCoreL13cssPropertyIDEPKtj
+__ZN7WebCore17cssValueKeywordIDERKNS_15CSSParserStringE
 __ZN7WebCore9CSSParser23createFloatingValueListEv
-__ZN3WTF7HashSetIPN7WebCore9ValueListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore9CSSParser17sinkFloatingValueERNS_5ValueE
-__ZN7WebCore9CSSParser21sinkFloatingValueListEPNS_9ValueListE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E4findIiNS_22IdentityHashTranslatorIiiS4_EEEENS_17HashTableIteratorIiiS2_S4_S6_S6_EERKT_
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E47removeAndInvalidateWithoutEntryConsistencyCheckEPi
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6removeEPi
+__ZN3WTF7HashSetIPN7WebCore18CSSParserValueListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6exp
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reh
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13al
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15de
+__ZN7WebCore9CSSParser17sinkFloatingValueERNS_14CSSParserValueE
+__ZN7WebCore18CSSParserValueList8addValueERKNS_14CSSParserValueE
+__ZN7WebCore9CSSParser21sinkFloatingValueListEPNS_18CSSParserValueListE
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4fin
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47re
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rem
 __ZN7WebCore9CSSParser10parseValueEib
 __ZN7WebCore9CSSParser21checkForOrphanedUnitsEv
+__ZN7WebCore9CSSParser17checkForVariablesEPNS_18CSSParserValueListE
+__ZN7WebCore17CSSPrimitiveValue16createIdentifierEi
+__ZN7WebCore17CSSPrimitiveValueC1Ei
 __ZN7WebCore17CSSPrimitiveValueC2Ei
 __ZN7WebCore9CSSParser11addPropertyEiN3WTF10PassRefPtrINS_8CSSValueEEEb
-__ZN7WebCore9ValueListD2Ev
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE6shrinkEm
-__ZN7WebCore9CSSParser15createStyleRuleEPNS_11CSSSelectorE
-__ZN7WebCore12CSSStyleRuleC2EPNS_9StyleBaseE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser20sinkFloatingSelectorEPNS_11CSSSelectorE
+__ZN7WebCore18CSSParserValueListD1Ev
+__ZN7WebCore18CSSParserValueListD2Ev
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE6shrinkEm
+__ZN7WebCore9CSSParser15createStyleRuleEPN3WTF6VectorIPNS_11CSSSelectorELm0EEE
+__ZN7WebCore12CSSStyleRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore12CSSStyleRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSSelectorList19adoptSelectorVectorERN3WTF6VectorIPNS_11CSSSelectorELm0EEE
+__ZN7WebCore15CSSSelectorList15deleteSelectorsEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleEPKPKNS_11CSSPropertyEi
 __ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleEPKPKNS_11CSSPropertyEi
 __ZN7WebCore19CSSStyleDeclarationC2EPNS_7CSSRuleE
-__ZN7WebCore23DeprecatedValueListImpl10appendNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore23DeprecatedValueListImpl11copyOnWriteEv
+__ZNK7WebCore9StyleBase16useStrictParsingEv
+__ZNK7WebCore8CSSValue24isVariableDependentValueEv
 __ZN7WebCore12CSSStyleRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE15reserveCapacityEm
 __ZN7WebCore9CSSParser15clearPropertiesEv
 __ZN7WebCore9StyleList6appendEN3WTF10PassRefPtrINS_9StyleBaseEEE
 __ZN7WebCore9StyleBase18insertedIntoParentEv
-__ZN3WTF6VectorIcLm256EE6shrinkEm
+__ZN7WebCore18charactersToDoubleEPKtmPb
 __ZN7WebCore9CSSParser12parse4ValuesEiPKib
-__ZN7WebCore9CSSParser9validUnitEPNS_5ValueENS0_5UnitsEb
+__ZN7WebCore9CSSParser9validUnitEPNS_14CSSParserValueENS0_5UnitsEb
+__ZN7WebCore17CSSPrimitiveValue6createEdNS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC1EdNS0_9UnitTypesE
 __ZN7WebCore17CSSPrimitiveValueC2EdNS0_9UnitTypesE
-__ZN7WebCore10StringImplC1EPKtjj
+__ZN7WebCore15CSSParserString5lowerEv
 __ZNK7WebCore11CSSSelector17extractPseudoTypeEv
-__ZN7WebCore9CSSParser12parseContentEib
+__ZN7WebCoreL9hasPrefixEPKcjS1_
+__ZN7WebCore9CSSParser14parseShorthandEiPKiib
+__ZN7WebCore12CSSValueListC1Eb
 __ZN7WebCore12CSSValueListC2Eb
-__ZN7WebCore6StringC2EPKtj
-__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6StringENS0_9UnitTypesE
 __ZN7WebCore12CSSValueList6appendEN3WTF10PassRefPtrINS_8CSSValueEEE
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser14parseShorthandEiPKiib
-__ZN7WebCore20DeprecatedStringDataC2EPKNS_14DeprecatedCharEj
-__ZN7WebCore9CSSParser10parseColorEPNS_5ValueE
-__ZN7WebCore9CSSParser19parseColorFromValueEPNS_5ValueERjb
-__ZN7WebCore9CSSParser10parseColorERKNS_6StringERjb
-__ZN7WebCore5Color13parseHexColorERKNS_6StringERj
-__ZNK7WebCore16DeprecatedString5toIntEPbi
-__ZN7WebCore24isCharacterAllowedInBaseENS_14DeprecatedCharEi
-__ZN7WebCore17CSSPrimitiveValueC2Ej
-__ZN7WebCore9CSSParser23parseBackgroundPropertyEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
-__ZN7WebCore9CSSParser20parseBackgroundImageERN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore13CSSImageValueC2Ev
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4PairEEE
-__ZN7WebCore9CSSParser15parseFontFamilyEv
+__ZN7WebCore11CSSSelector13setTagHistoryEPS0_
+__ZN7WebCore9CSSParserD1Ev
 __ZN7WebCore9CSSParserD2Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore9ValueListEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore8FunctionEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
+__ZN7WebCore9CSSParser14clearVariablesEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE14shrinkCapacityEm
+__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTr
+__ZN3WTF15deleteAllValuesIPN7WebCore18CSSParserValueListEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_1
+__ZN3WTF15deleteAllValuesIPN7WebCore17CSSParserFunctionEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dea
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE6shrinkEm
-__ZN7WebCore10screenEvalEv
+__ZN7WebCoreL10screenEvalEv
+__ZN7WebCore19MediaQueryEvaluatorC1EPKcb
 __ZN7WebCore19MediaQueryEvaluatorC2EPKcb
 __ZN7WebCore10CSSRuleSet17addRulesFromSheetEPNS_13CSSStyleSheetERKNS_19MediaQueryEvaluatorEPNS_16CSSStyleSelectorE
 __ZN7WebCore12CSSStyleRule11isStyleRuleEv
 __ZN7WebCore10CSSRuleSet7addRuleEPNS_12CSSStyleRuleEPNS_11CSSSelectorE
-__ZN7WebCore10CSSRuleSet12addToRuleSetEPNS_16AtomicStringImplERN3WTF7HashMapIS2_PNS_15CSSRuleDataListENS3_7PtrHashIS2_EENS3_10HashTraitsIS2_EENS9_IS6_EEEEPNS_12CSSStyleRuleEPNS_11CSSSelectorE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E4findIiNS_22IdentityHashTranslatorIiS2_S6_EEEENS_17HashTableIteratorIiS2_S4_S6_SA_S9_EERKT_
-__ZN7WebCore9printEvalEv
-__ZN7WebCore12parseUASheetIA331_cEEPNS_13CSSStyleSheetERKT_
-__ZN7WebCore12parseUASheetIA1931_cEEPNS_13CSSStyleSheetERKT_
-__ZN7WebCore9CSSParser12parseCounterEiib
-__ZN7WebCore9CSSParser22createFloatingFunctionEv
-__ZN3WTF7HashSetIPN7WebCore8FunctionENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore6String5lowerEv
-__ZN7WebCore10StringImpl5lowerEv
-__ZN7WebCore9CSSParser20parseColorParametersEPNS_5ValueEPib
-__ZN7WebCore7makeRGBEiii
-__ZN7WebCore15FontFamilyValueC2ERKNS_16DeprecatedStringE
-__ZN7WebCore17RegularExpressionC2EPKc
-__ZN7WebCore16DeprecatedStringC1EPKc
-__ZN7WebCore17RegularExpression7PrivateC2ENS_16DeprecatedStringEbb
-__ZN7WebCore17RegularExpression7Private7compileEbb
-__ZN7WebCore16DeprecatedString7replaceERKNS_17RegularExpressionERKS0_
-__ZNK7WebCore17RegularExpression5matchERKNS_16DeprecatedStringEiPi
-__ZN7WebCore9CSSParser19parseCounterContentEPNS_9ValueListEb
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_7CounterEEE
-__ZN7WebCore9CSSParser11parseShadowEib
-__ZN7WebCore18ShadowParseContext11commitValueEv
-__ZN7WebCore11ShadowValueC2EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
-__ZN7WebCore16DeprecatedString6appendEc
-__ZN7WebCore16DeprecatedString6appendERKS0_
-__ZN7WebCore16DeprecatedString6insertEjRKS0_
-__ZN7WebCore16DeprecatedString12forceUnicodeEv
-__ZN7WebCore16DeprecatedString9setLengthEj
-__ZN7WebCore20DeprecatedStringData19increaseUnicodeSizeEj
-__ZNK7WebCore8Document4viewEv
+__ZN7WebCore10CSSRuleSet12addToRuleSetEPNS_16AtomicStringImplERN3WTF7HashMapIS2_PNS_15CSSRuleDataListENS3_7PtrHashIS2_EENS3_10H
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CSSRuleDataListEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
 __ZNK7WebCore9FrameView9mediaTypeEv
+__ZN7WebCore19MediaQueryEvaluatorC1ERKNS_6StringEb
 __ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEb
-__ZNK7WebCore8Document15documentElementEv
-__ZN7WebCore29DeprecatedPtrListImplIteratorC2ERKNS_21DeprecatedPtrListImplE
-__ZNK7WebCore21DeprecatedPtrListImpl11addIteratorEPNS_29DeprecatedPtrListImplIteratorE
-__ZNK7WebCore29DeprecatedPtrListImplIterator7currentEv
-__ZN7WebCore29DeprecatedPtrListImplIteratorD2Ev
-__ZNK7WebCore21DeprecatedPtrListImpl14removeIteratorEPNS_29DeprecatedPtrListImplIteratorE
-__ZN7WebCore8Document14resetLinkColorEv
-__ZN7WebCore8Document21resetVisitedLinkColorEv
-__ZN7WebCore8Document20resetActiveLinkColorEv
-__ZN7WebCore5Color13setNamedColorERKNS_6StringE
-__ZNK7WebCore16DeprecatedString10isAllASCIIEv
-__ZN7WebCore8Document18initSecurityOriginEv
-__ZN7WebCore14SecurityOrigin14createForFrameEPNS_5FrameE
-__ZN7WebCore11FrameLoader6openerEv
-__ZNK7WebCore4KURL4portEv
-__ZNK7WebCore4KURL4hostEv
-__ZN7WebCore14SecurityOrigin6createERKNS_6StringES3_tPS0_
-__ZN7WebCore14SecurityOriginC1ERKNS_6StringES3_t
-__ZN7WebCore24isDefaultPortForProtocolEtNS_6StringE
-__ZNK7WebCore14SecurityOrigin7isEmptyEv
-__ZN7WebCore5Frame11setDocumentEN3WTF10PassRefPtrINS_8DocumentEEE
-__ZNK7WebCore5Frame19selectionControllerEv
-__ZNK7WebCore19SelectionController18isFocusedAndActiveEv
-__ZN7WebCore8Document6attachEv
-__ZN7WebCore11RenderArenaC2Ej
-__ZN7WebCore13InitArenaPoolEPNS_9ArenaPoolEPKcjj
-__ZN7WebCore12RenderObjectnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderArena8allocateEm
-__ZN7WebCore13ArenaAllocateEPNS_9ArenaPoolEj
-__ZN7WebCore10RenderViewC2EPNS_4NodeEPNS_9FrameViewE
-__ZN7WebCore15RenderContainerC2EPNS_4NodeE
-__ZN7WebCore9RenderBoxC2EPNS_4NodeE
-__ZN7WebCore12RenderObjectC2EPNS_4NodeE
-__ZN7WebCore12RenderObject18setPrefWidthsDirtyEbb
-__ZN7WebCore11RenderLayernwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderLayerC2EPNS_12RenderObjectE
-__ZNK7WebCore11RenderLayer20shouldBeOverflowOnlyEv
-__ZNK7WebCore15RenderContainer10firstChildEv
+__ZNK7WebCore14StyleSheetList6lengthEv
 __ZN7WebCore8Document11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore5Frame10isPaintingEv
+__ZNK7WebCore9FrameView10isPaintingEv
 __ZN7WebCore13ContainerNode26suspendPostAttachCallbacksEv
-__ZN7WebCore11RenderStylenwEmPNS_11RenderArenaE
+__ZNK7WebCore8Document4pageEv
+__ZN7WebCore4Page32setMemoryCacheClientCallsEnabledEb
+__ZN7WebCore6Loader22suspendPendingRequestsEv
+__ZN7WebCore9FrameView20pauseScheduledEventsEv
+__ZN7WebCore11RenderStyle6createEv
+__ZN7WebCore11RenderStyleC1Ev
 __ZN7WebCore11RenderStyleC2Ev
+__ZN7WebCore11RenderStyle18createDefaultStyleEv
+__ZN7WebCore11RenderStyleC1Eb
 __ZN7WebCore11RenderStyleC2Eb
-__ZN7WebCore11RenderStyle14setBitDefaultsEv
+__ZN7WebCore12StyleBoxDataC1Ev
 __ZN7WebCore12StyleBoxDataC2Ev
+__ZN7WebCore15StyleVisualDataC1Ev
 __ZN7WebCore15StyleVisualDataC2Ev
+__ZN7WebCore19StyleBackgroundDataC1Ev
 __ZN7WebCore19StyleBackgroundDataC2Ev
+__ZN7WebCore17StyleSurroundDataC1Ev
 __ZN7WebCore17StyleSurroundDataC2Ev
+__ZN7WebCore25StyleRareNonInheritedDataC1Ev
 __ZN7WebCore25StyleRareNonInheritedDataC2Ev
+__ZN7WebCore20StyleFlexibleBoxDataC1Ev
 __ZN7WebCore20StyleFlexibleBoxDataC2Ev
+__ZN7WebCore16StyleMarqueeDataC1Ev
 __ZN7WebCore16StyleMarqueeDataC2Ev
+__ZN7WebCore17StyleMultiColDataC1Ev
 __ZN7WebCore17StyleMultiColDataC2Ev
 __ZN7WebCore18StyleTransformDataC1Ev
+__ZN7WebCore18StyleTransformDataC2Ev
+__ZN7WebCore19TransformOperationsC1Eb
+__ZN7WebCore19TransformOperationsC2Eb
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEC2ERKS5_
+__ZN7WebCore22StyleRareInheritedDataC1Ev
 __ZN7WebCore22StyleRareInheritedDataC2Ev
+__ZN7WebCore18StyleInheritedDataC1Ev
 __ZN7WebCore18StyleInheritedDataC2Ev
 __ZN7WebCore4FontC1Ev
+__ZN7WebCore4FontC2Ev
+__ZN7WebCore14SVGRenderStyleC1Ev
 __ZN7WebCore14SVGRenderStyleC2Ev
-__ZN7WebCore14SVGRenderStyleC2Eb
+__ZN7WebCore14SVGRenderStyleC1ENS0_17CreateDefaultTypeE
+__ZN7WebCore14SVGRenderStyleC2ENS0_17CreateDefaultTypeE
+__ZN7WebCore13StyleFillDataC1Ev
 __ZN7WebCore13StyleFillDataC2Ev
 __ZN7WebCore8SVGPaint11defaultFillEv
+__ZN7WebCore8SVGPaintC1ERKNS_5ColorE
 __ZN7WebCore8SVGPaintC2ERKNS_5ColorE
+__ZN7WebCore8SVGColorC2ERKNS_5ColorE
+__ZN7WebCore15StyleStrokeDataC1Ev
 __ZN7WebCore15StyleStrokeDataC2Ev
 __ZN7WebCore8SVGPaint13defaultStrokeEv
+__ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeE
 __ZN7WebCore8SVGPaintC2ENS0_12SVGPaintTypeE
 __ZN7WebCore8SVGColorC2Ev
+__ZN7WebCore13StyleTextDataC1Ev
 __ZN7WebCore13StyleTextDataC2Ev
+__ZN7WebCore13StyleStopDataC1Ev
 __ZN7WebCore13StyleStopDataC2Ev
+__ZN7WebCore13StyleClipDataC1Ev
 __ZN7WebCore13StyleClipDataC2Ev
+__ZN7WebCore13StyleMaskDataC1Ev
 __ZN7WebCore13StyleMaskDataC2Ev
+__ZN7WebCore13StyleMiscDataC1Ev
 __ZN7WebCore13StyleMiscDataC2Ev
+__ZN7WebCore15StyleMarkerDataC1Ev
 __ZN7WebCore15StyleMarkerDataC2Ev
+__ZNK7WebCore5Frame19shouldApplyPageZoomEv
 __ZNK7WebCore8Settings17fontRenderingModeEv
 __ZNK7WebCore16CSSStyleSelector18fontSizeForKeywordEibb
 __ZN7WebCore16CSSStyleSelector11setFontSizeERNS_15FontDescriptionEf
 __ZN7WebCore16CSSStyleSelector32getComputedSizeFromSpecifiedSizeEbf
-__ZNK7WebCore5Frame10zoomFactorEv
-__ZNK7WebCore10FontFamilyeqERKS0_
+__ZNK7WebCore5Frame19shouldApplyTextZoomEv
+__ZN7WebCoreeqERKNS_10FontFamilyES2_
+__ZN7WebCore4FontC1ERKNS_15FontDescriptionEss
 __ZN7WebCore4FontC2ERKNS_15FontDescriptionEss
+__ZN7WebCore10FontFamilyC1ERKS0_
 __ZN7WebCore10FontFamilyC2ERKS0_
+__ZN7WebCore18StyleInheritedDataC1ERKS0_
 __ZN7WebCore18StyleInheritedDataC2ERKS0_
+__ZN7WebCore4FontC1ERKS0_
 __ZN7WebCore4FontC2ERKS0_
 __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore10FontFamilyaSERKS0_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore17GlyphPageTreeNodeEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_
 __ZN7WebCore4FontD1Ev
+__ZN7WebCore4FontD2Ev
 __ZNK7WebCore4Font6updateEN3WTF10PassRefPtrINS_12FontSelectorEEE
+__ZN7WebCore16FontFallbackListC1Ev
 __ZN7WebCore16FontFallbackListC2Ev
+__ZN7WebCore9FontCache10generationEv
 __ZN7WebCore16FontFallbackList10invalidateEN3WTF10PassRefPtrINS_12FontSelectorEEE
-__ZNK7WebCore4Node4diffEPNS_11RenderStyleES2_
-__ZNK7WebCore11RenderStyle14hasPseudoStyleENS0_8PseudoIdE
-__ZN7WebCore11RenderBlock8setStyleEPNS_11RenderStyleE
-__ZN7WebCore9RenderBox8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderObject8setStyleEPNS_11RenderStyleE
+__ZN7WebCore16FontFallbackList15releaseFontDataEv
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14shrinkCapacityEm
+__ZN7WebCore4Node4diffEPNS_11RenderStyleES2_
+__ZNK7WebCore11RenderStyle14hasPseudoStyleENS_8PseudoIdE
+__ZN7WebCore12RenderObject8setStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZNK7WebCore12RenderObject21adjustStyleDifferenceENS_15StyleDifferenceEj
+__ZN7WebCore11RenderBlock15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore20RenderBoxModelObject15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore11RenderLayer19isSelfPaintingLayerEv
+__ZN7WebCore12RenderObject15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore12RenderObject4viewEv
-__ZN7WebCore12RenderObject22updateBackgroundImagesEPNS_11RenderStyleE
+__ZN7WebCore12RenderObject16updateFillImagesEPKNS_9FillLayerES3_
+__ZN7WebCore12RenderObject11updateImageEPNS_10StyleImageES2_
+__ZN7WebCore11RenderBlock14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore20RenderBoxModelObject14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderObject14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox27updateBoxModelInfoFromStyleEv
+__ZN7WebCore20RenderBoxModelObject27updateBoxModelInfoFromStyleEv
 __ZNK7WebCore10RenderView12isRenderViewEv
+__ZNK7WebCore20RenderBoxModelObject13requiresLayerEv
+__ZN7WebCore11RenderLayer12styleChangedENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore11RenderLayer23updateScrollCornerStyleEv
+__ZN7WebCore4Node18shadowAncestorNodeEv
+__ZNK7WebCore4Node12isSVGElementEv
+__ZN7WebCore4Node18shadowTreeRootNodeEv
+__ZNK7WebCore4Node12isShadowNodeEv
+__ZN7WebCore11RenderLayer18updateResizerStyleEv
 __ZNK7WebCore12RenderObject6isBodyEv
-__ZNK7WebCore4Node17virtualHasTagNameERKNS_13QualifiedNameE
-__ZNK7WebCore11RenderBlock13isRenderBlockEv
-__ZN7WebCore12RenderObject13requiresLayerEv
-__ZN7WebCore11RenderLayer12styleChangedEv
-__ZNK7WebCore15RenderContainer15canHaveChildrenEv
-__ZN7WebCore15RenderContainer24updateBeforeAfterContentENS_11RenderStyle8PseudoIdE
-__ZN7WebCore15RenderContainer36updateBeforeAfterContentForContainerENS_11RenderStyle8PseudoIdEPS0_
-__ZNK7WebCore12RenderObject14getPseudoStyleENS_11RenderStyle8PseudoIdEPS1_
-__ZN7WebCore15RenderContainer20beforeAfterContainerENS_11RenderStyle8PseudoIdE
-__ZNK7WebCore15RenderContainer9lastChildEv
 __ZN7WebCore11RenderBlock17updateFirstLetterEv
-__ZN7WebCore4Node10setChangedENS_15StyleChangeTypeE
-__ZN7WebCore8Document18setDocumentChangedEb
+__ZN7WebCore4Node19setNeedsStyleRecalcENS_15StyleChangeTypeE
+__ZN7WebCore8Document21unscheduleStyleRecalcEv
+__ZN7WebCore9FrameView21resumeScheduledEventsEv
+__ZN7WebCore9FrameView23dispatchScheduledEventsEv
 __ZN7WebCore13ContainerNode25resumePostAttachCallbacksEv
+__ZN7WebCore11FrameLoader35tellClientAboutPastMemoryCacheLoadsEv
+__ZN7WebCore6Loader21resumePendingRequestsEv
+__ZNK7WebCore6Loader4Host11hasRequestsEv
 __ZN7WebCore13ContainerNode6attachEv
 __ZN7WebCore4Node6attachEv
-__ZN7WebCore8Document6setURLERKNS_16DeprecatedStringE
-__ZN7WebCoreeqERKNS_16DeprecatedStringES2_
-__ZN7WebCore8Document10setBaseURLERKNS_16DeprecatedStringE
-__ZN7WebCore11FrameLoader19updatePolicyBaseURLEv
-__ZN7WebCore11FrameLoader16setPolicyBaseURLERKNS_6StringE
+__ZN7WebCore16ScriptController14updateDocumentEv
+__ZN7WebCore8Document6setURLERKNS_4KURLE
+__ZN7WebCore8Document13updateBaseURLEv
+__ZN7WebCore4KURLC1ERKS0_RKNS_6StringE
+__ZN7WebCore4KURLC2ERKS0_RKNS_6StringE
+__ZN7WebCore4KURL4initERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCoreL9copyASCIIEPKtiPc
+__ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
+__ZN3WTF6VectorIcLm512EE6shrinkEm
+__ZNK7WebCore5Frame9domWindowEv
+__ZN7WebCore9DOMWindowC1EPNS_5FrameE
+__ZN7WebCore9DOMWindowC2EPNS_5FrameE
+__ZN7WebCore11FrameLoader26updateFirstPartyForCookiesEv
+__ZN7WebCore11FrameLoader23setFirstPartyForCookiesERKNS_4KURLE
 __ZN7WebCore9DocLoader17setAutoLoadImagesEb
+__ZNK7WebCore20ResourceResponseBase15httpHeaderFieldERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3getERKS2_
+__ZN7WebCore12AtomicString6removeEPNS_10StringImplE
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6removeEPS3_
 __ZN7WebCore11FrameLoader20restoreDocumentStateEv
 __ZN7WebCore8Document12implicitOpenEv
 __ZN7WebCore8Document13cancelParsingEv
 __ZN7WebCore8Document5clearEv
 __ZN7WebCore13ContainerNode14removeChildrenEv
-__ZN7WebCore23DeprecatedValueListImpl5clearEv
+__ZNK7WebCore8Document9domWindowEv
+__ZN7WebCore9DOMWindow23removeAllEventListenersEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14shrinkCapacityEm
+__ZN7WebCoreL29pendingUnloadEventListenerMapEv
+__ZN7WebCoreL27removePendingEventListenersERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerE
+__ZN3WTF7HashMapIPN7WebCore9DOMWindowEPNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashTr
+__ZN7WebCoreL35pendingBeforeUnloadEventListenerMapEv
 __ZN7WebCore12HTMLDocument15createTokenizerEv
 __ZN7WebCore19InspectorController13windowVisibleEv
+__ZN7WebCore13HTMLTokenizerC1EPNS_12HTMLDocumentEb
 __ZN7WebCore13HTMLTokenizerC2EPNS_12HTMLDocumentEb
+__ZN7WebCore10HTMLParserC1EPNS_12HTMLDocumentEb
 __ZN7WebCore10HTMLParserC2EPNS_12HTMLDocumentEb
 __ZN7WebCore13HTMLTokenizer5beginEv
 __ZN7WebCore13HTMLTokenizer5resetEv
+__ZN3WTF6VectorItLm0EE14shrinkCapacityEm
 __ZN7WebCore15SegmentedString5clearEv
 __ZN7WebCore8Document10setParsingEb
-__ZN7WebCore10ScrollView14resizeContentsEii
-__ZNK7WebCore10ScrollView15getDocumentViewEv
+__ZNK7WebCore5Frame9animationEv
+__ZN7WebCore19AnimationController20beginAnimationUpdateEv
+__ZN7WebCore9FrameView15setContentsSizeERKNS_7IntSizeE
+__ZN7WebCore10ScrollView15setContentsSizeERKNS_7IntSizeE
+__ZNK7WebCore10ScrollView12contentsSizeEv
+__ZNK7WebCore10ScrollView20platformContentsSizeEv
+__ZNK7WebCore10ScrollView12documentViewEv
+__ZN7WebCore16enclosingIntRectERK6CGRect
+__ZNK7WebCore6Chrome19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
 __ZN7WebCore11FrameLoader5writeEPKcib
 __ZNK7WebCore9Tokenizer12wantsRawDataEv
 __ZN7WebCore12TextEncodingC1ERKNS_6StringE
+__ZN7WebCore12TextEncodingC2ERKNS_6StringE
 __ZN7WebCore31atomicCanonicalTextEncodingNameEPKtm
-__ZN7WebCore31atomicCanonicalTextEncodingNameEPKc
-__ZN7WebCore19TextResourceDecoderC1ERKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore19TextResourceDecoderC1ERKNS_6StringERKNS_12TextEncodingEb
+__ZN7WebCore19TextResourceDecoderC2ERKNS_6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoder20determineContentTypeERKNS_6StringE
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplEPKc
 __ZN7WebCore19TextResourceDecoder15defaultEncodingENS0_11ContentTypeERKNS_12TextEncodingE
 __ZN7WebCore14Latin1EncodingEv
-__ZN7WebCore12TextEncodingC2EPKc
-__ZN7WebCore15TextCodecLatin121registerEncodingNamesEPFvPKcS2_E
-__ZN7WebCore24addToTextEncodingNameMapEPKcS1_
-__ZNK3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3getERKS2_
-__ZN3WTF9HashTableIPKcSt4pairIS2_iENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IiEEEESB_E3addIS2_S2_NS_17HashMapTranslatorILb1ES3_IS2_S2_ENS_18PairBaseHashTraitsISB_SB_EESD_S8_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPKcSt4pairIS2_iENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IiEEEESB_E6expandEv
-__ZN7WebCore15TextCodecLatin114registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore17addToTextCodecMapEPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvES9_
-__ZNK3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3getERKS2_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addIPKcS3_NS_17HashMapTranslatorILb1ES1_ISH_S3_ENS_18PairBaseHashTraitsINSA_ISH_EESC_EESD_NS_7PtrHashISH_EEEEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN7WebCore14TextCodecUTF1621registerEncodingNamesEPFvPKcS2_E
-__ZN3WTF9HashTableIPKcSt4pairIS2_iENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IiEEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S8_EEEENS_17HashTableIteratorIS2_S4_S6_S8_SD_SB_EERKT_
-__ZN7WebCore14TextCodecUTF1614registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore20TextCodecUserDefined21registerEncodingNamesEPFvPKcS2_E
-__ZN7WebCore20TextCodecUserDefined14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore12TextCodecICU25registerBaseEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecICU18registerBaseCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore11TextDecoderC2ERKNS_12TextEncodingE
-__ZN7WebCore8Document10setDecoderEPNS_19TextResourceDecoderE
+__ZN7WebCore8Document10setDecoderEN3WTF10PassRefPtrINS_19TextResourceDecoderEEE
 __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoder11checkForBOMEPKcm
 __ZN7WebCore19TextResourceDecoder19checkForHeadCharsetEPKcmRb
 __ZN3WTF6VectorIcLm0EE4growEm
 __ZN7WebCore19TextResourceDecoder5flushEv
-__ZN7WebCore11TextDecoder11checkForBOMEPKcmb
 __ZN7WebCore12newTextCodecERKNS_12TextEncodingE
-__ZN7WebCore36newStreamingTextDecoderWindowsLatin1ERKNS_12TextEncodingEPKv
-__ZN7WebCore15TextCodecLatin16decodeEPKcmb
+__ZNK3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3getERKS2_
+__ZN7WebCoreL36newStreamingTextDecoderWindowsLatin1ERKNS_12TextEncodingEPKv
+__ZN7WebCore15TextCodecLatin16decodeEPKcmbbRb
+__ZN3WTF6VectorIcLm0EE14shrinkCapacityEm
+__ZN7WebCore15TextCodecLatin1D0Ev
+__ZN7WebCore9TextCodecD2Ev
 __ZN7WebCore8Document13finishParsingEv
 __ZN7WebCore13HTMLTokenizer6finishEv
 __ZN7WebCore13HTMLTokenizer3endEv
 __ZN7WebCore13HTMLTokenizer12processTokenEv
-__ZN7WebCore5Frame11scriptProxyEv
+__ZN7WebCore16ScriptController9isEnabledEv
 __ZN7WebCore10HTMLParser8finishedEv
-__ZNK7WebCore8Document14isDocumentNodeEv
-__ZN7WebCore15HTMLHtmlElementC2EPNS_8DocumentE
+__ZN7WebCore15HTMLHtmlElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLHtmlElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11HTMLElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore13StyledElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore7ElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore10HTMLParser10insertNodeEPNS_4NodeEb
-__ZNK7WebCore7Element9localNameEv
+__ZNK7WebCore7Element16virtualLocalNameEv
 __ZNK7WebCore11HTMLElement13isHTMLElementEv
 __ZNK7WebCore15HTMLHtmlElement11tagPriorityEv
 __ZN7WebCore13ContainerNode8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore12HTMLDocument14isHTMLDocumentEv
 __ZN7WebCore12HTMLDocument12childAllowedEPNS_4NodeE
-__ZNK7WebCore7Element17virtualHasTagNameERKNS_13QualifiedNameE
+__ZN7WebCore22appendChildToContainerINS_4NodeENS_13ContainerNodeEEEvPT_PT0_
+__ZN7WebCore15HTMLHtmlElement20insertedIntoDocumentEv
 __ZN7WebCore7Element20insertedIntoDocumentEv
 __ZN7WebCore13ContainerNode20insertedIntoDocumentEv
-__ZN7WebCore15EventTargetNode20insertedIntoDocumentEv
-__ZN7WebCore11EventTarget20insertedIntoDocumentEPNS_15EventTargetNodeE
 __ZN7WebCore4Node20insertedIntoDocumentEv
+__ZNK7WebCore4Node14eventListenersEv
 __ZN7WebCore13ContainerNode16insertedIntoTreeEb
-__ZN7WebCore8Document15childrenChangedEb
-__ZNK7WebCore7Element13isElementNodeEv
+__ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
+__ZN7WebCore21ApplicationCacheGroup29selectCacheWithoutManifestURLEPNS_5FrameE
+__ZN7WebCore8Document15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13ContainerNode15childrenChangedEbPNS_4NodeES2_i
 __ZN7WebCore10HTMLParser9pushBlockERKNS_12AtomicStringEi
-__ZN7WebCore4Node20beginParsingChildrenEv
+__ZN7WebCoreL12isScopingTagERKNS_12AtomicStringE
+__ZN7WebCore7Element20beginParsingChildrenEv
 __ZN7WebCore7Element6attachEv
 __ZN7WebCore4Node22createRendererIfNeededEv
 __ZN7WebCore8Document21shouldCreateRenderersEv
+__ZNK7WebCore12RenderObject15canHaveChildrenEv
 __ZNK7WebCore4Node25childShouldCreateRendererEPS0_
-__ZN7WebCore7Element16styleForRendererEPNS_12RenderObjectE
+__ZN7WebCore4Node16styleForRendererEv
 __ZN7WebCore16CSSStyleSelector15styleForElementEPNS_7ElementEPNS_11RenderStyleEbb
 __ZN7WebCore16CSSStyleSelector25initElementAndPseudoStateEPNS_7ElementE
 __ZNK7WebCore13StyledElement15isStyledElementEv
 __ZN7WebCore16CSSStyleSelector17locateSharedStyleEv
 __ZN7WebCore16CSSStyleSelector16locateCousinListEPNS_7ElementEj
-__ZNK7WebCore4Node15isStyledElementEv
-__ZN7WebCore16CSSStyleSelector19initForStyleResolveEPNS_7ElementEPNS_11RenderStyleE
-__ZNK7WebCore4Node11renderStyleEv
+__ZN7WebCore16CSSStyleSelector19initForStyleResolveEPNS_7ElementEPNS_11RenderStyleENS_8PseudoIdE
 __ZN7WebCore11RenderStyle11inheritFromEPKS0_
-__ZNK7WebCore4Node12isSVGElementEv
+__ZN7WebCoreL31elementCanUseSimpleDefaultStyleEPNS_7ElementE
 __ZN7WebCore16CSSStyleSelector12matchUARulesERiS1_
 __ZNK7WebCore19MediaQueryEvaluator22mediaTypeMatchSpecificEPKc
 __ZN7WebCore16CSSStyleSelector10matchRulesEPNS_10CSSRuleSetERiS3_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14shrinkCapacityEm
 __ZN7WebCore16CSSStyleSelector17matchRulesForListEPNS_15CSSRuleDataListERiS3_
 __ZN7WebCore16CSSStyleSelector13checkSelectorEPNS_11CSSSelectorE
-__ZN7WebCore16CSSStyleSelector13checkSelectorEPNS_11CSSSelectorEPNS_7ElementEbb
-__ZN7WebCore16CSSStyleSelector16checkOneSelectorEPNS_11CSSSelectorEPNS_7ElementEbb
-__ZNK7WebCore7Element12namespaceURIEv
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker13checkSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicStrin
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkOneSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicSt
 __ZNK7WebCore26CSSMutableStyleDeclaration6lengthEv
-__ZNK7WebCore23DeprecatedValueListImpl5countEv
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE15reserveCapacityEm
 __ZN7WebCore16CSSStyleSelector16sortMatchedRulesEjj
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE6shrinkEm
+__ZN7WebCore16CSSStyleSelector21addMatchedDeclarationEPNS_26CSSMutableStyleDeclarationE
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE6shrinkEm
 __ZNK7WebCore13StyledElement36canHaveAdditionalAttributeStyleDeclsEv
 __ZN7WebCore16CSSStyleSelector17applyDeclarationsEbbii
-__ZNK7WebCore23DeprecatedValueListImpl5beginEv
-__ZNK7WebCore23DeprecatedValueListImpl9firstNodeEv
 __ZN7WebCore16CSSStyleSelector13applyPropertyEiPNS_8CSSValueE
 __ZNK7WebCore17CSSPrimitiveValue16isPrimitiveValueEv
 __ZNK7WebCore17CSSPrimitiveValue12cssValueTypeEv
 __ZN7WebCore16CSSStyleSelector24cacheBorderAndBackgroundEv
 __ZN7WebCore16CSSStyleSelector17adjustRenderStyleEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore12StyleBoxDataC1ERKS0_
 __ZN7WebCore12StyleBoxDataC2ERKS0_
-__ZN7WebCore11RenderStyle22adjustBackgroundLayersEv
+__ZN7WebCore11RenderStyle16adjustAnimationsEv
 __ZN7WebCore11RenderStyle17adjustTransitionsEv
-__ZNK7WebCore4Node9isControlEv
+__ZNK7WebCore7Element20isFormControlElementEv
 __ZN7WebCore11HTMLElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore4Node16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore11HTMLElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZN7WebCore12RenderObject12createObjectEPNS_4NodeEPNS_11RenderStyleE
-__ZN7WebCore11RenderBlockC2EPNS_4NodeE
+__ZN7WebCore11RenderBlockC1EPNS_4NodeE
 __ZNK7WebCore12RenderObject14isChildAllowedEPS0_PNS_11RenderStyleE
-__ZN7WebCore12RenderObject18setAnimatableStyleEPNS_11RenderStyleE
+__ZN7WebCore12RenderObject18setAnimatableStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZNK7WebCore12RenderObject9animationEv
+__ZN7WebCore19AnimationController16updateAnimationsEPNS_12RenderObjectEPNS_11RenderStyleE
+__ZNK7WebCore12RenderObject12isRenderViewEv
 __ZN7WebCore11RenderLayer19insertOnlyThisLayerEv
-__ZN7WebCore11RenderLayer14clearClipRectsEv
+__ZN7WebCore11RenderLayer34clearClipRectsIncludingDescendantsEv
 __ZN7WebCore4Node12nextRendererEv
-__ZN7WebCore10RenderFlow8addChildEPNS_12RenderObjectES2_
-__ZNK7WebCore10RenderFlow12continuationEv
-__ZN7WebCore11RenderBlock14addChildToFlowEPNS_12RenderObjectES2_
-__ZNK7WebCore15RenderContainer14isAfterContentEPNS_12RenderObjectE
+__ZN7WebCore11RenderBlock8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore9RenderBox14isAfterContentEPNS_12RenderObjectE
 __ZN7WebCore11RenderBlock21makeChildrenNonInlineEPNS_12RenderObjectE
-__ZN7WebCore15RenderContainer8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderObject8addChildEPS0_S1_
+__ZN7WebCore11RenderBlock15virtualChildrenEv
 __ZNK7WebCore12RenderObject10isListItemEv
 __ZNK7WebCore12RenderObject10isTableColEv
+__ZNK7WebCore11RenderBlock13isRenderBlockEv
 __ZNK7WebCore12RenderObject14isTableSectionEv
 __ZNK7WebCore12RenderObject10isTableRowEv
 __ZNK7WebCore12RenderObject11isTableCellEv
-__ZN7WebCore15RenderContainer15insertChildNodeEPNS_12RenderObjectES2_b
-__ZN7WebCore15RenderContainer15appendChildNodeEPNS_12RenderObjectEb
+__ZN7WebCore21RenderObjectChildList15insertChildNodeEPNS_12RenderObjectES2_S2_b
+__ZN7WebCore21RenderObjectChildList15appendChildNodeEPNS_12RenderObjectES2_b
 __ZNK7WebCore12RenderObject14enclosingLayerEv
-__ZNK7WebCore9RenderBox5layerEv
 __ZN7WebCore12RenderObject9addLayersEPNS_11RenderLayerEPS0_
-__ZN7WebCore9addLayersEPNS_12RenderObjectEPNS_11RenderLayerERS1_RS3_
+__ZN7WebCoreL9addLayersEPNS_12RenderObjectEPNS_11RenderLayerERS1_RS3_
 __ZN7WebCore12RenderObject13findNextLayerEPNS_11RenderLayerEPS0_b
 __ZN7WebCore11RenderLayer8addChildEPS0_S1_
+__ZN7WebCore11RenderLayer9setParentEPS0_
+__ZN7WebCore11RenderLayer31dirtyStackingContextZOrderListsEv
 __ZNK7WebCore11RenderLayer15stackingContextEv
 __ZN7WebCore11RenderLayer16dirtyZOrderListsEv
 __ZN7WebCore11RenderLayer22updateVisibilityStatusEv
 __ZN7WebCore11RenderLayer22childVisibilityChangedEb
-__ZNK7WebCore11RenderBlock14childrenInlineEv
-__ZN7WebCore12RenderObject14setNeedsLayoutEbb
-__ZN7WebCore12RenderObject29markContainingBlocksForLayoutEbPS0_
 __ZNK7WebCore12RenderObject9containerEv
-__ZNK7WebCore12RenderObject11isTextFieldEv
-__ZNK7WebCore12RenderObject10isTextAreaEv
+__ZNK7WebCore12RenderObject13isTextControlEv
 __ZNK7WebCore12RenderObject9isSVGRootEv
 __ZN7WebCore12RenderObject16scheduleRelayoutEv
 __ZN7WebCore9FrameView16scheduleRelayoutEv
+__ZNK7WebCore9FrameView11needsLayoutEv
+__ZNK7WebCore5Frame15contentRendererEv
+__ZNK7WebCore9FrameView13layoutPendingEv
 __ZN7WebCore8Document20shouldScheduleLayoutEv
-__ZN7WebCore8Document4bodyEv
-__ZNK7WebCore13ContainerNode17virtualFirstChildEv
+__ZNK7WebCore8Document4bodyEv
+__ZN7WebCore12RenderObject24setLayerNeedsFullRepaintEv
 __ZN7WebCore12RenderObject29invalidateContainerPrefWidthsEv
+__ZN7WebCore11FrameLoader32dispatchDocumentElementAvailableEv
 __ZN7WebCore10HTMLParser9freeBlockEv
 __ZN7WebCore10HTMLParser11popOneBlockEv
 __ZN7WebCore7Element21finishParsingChildrenEv
-__ZN7WebCore15checkStyleRulesEPNS_7ElementEPNS_11RenderStyleEb
+__ZN7WebCoreL27checkForSiblingStyleChangesEPNS_7ElementEPNS_11RenderStyleEbPNS_4NodeES5_i
 __ZN7WebCore10HTMLParser10setCurrentEPNS_4NodeE
 __ZN7WebCore8Document15finishedParsingEv
+__ZN7WebCore5EventC1ERKNS_12AtomicStringEbb
 __ZN7WebCore5EventC2ERKNS_12AtomicStringEbb
-__ZN7WebCore15EventTargetNode13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore11EventTarget35eventTargetRespectingSVGTargetRulesERPNS_15EventTargetNodeE
-__ZThn36_N7WebCore15EventTargetNode14refEventTargetEv
-__ZN7WebCore15EventTargetNode14refEventTargetEv
+__ZN7WebCore4Node13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore4Node14refEventTargetEv
 __ZN7WebCore5Event9setTargetEN3WTF10PassRefPtrINS_11EventTargetEEE
 __ZN7WebCore5Event14receivedTargetEv
-__ZN7WebCore11EventTarget20dispatchGenericEventEPNS_15EventTargetNodeEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore21DeprecatedPtrListImpl7prependEPKv
-__ZN7WebCore21DeprecatedPtrListImpl6insertEjPKv
+__ZN7WebCore4Node20dispatchGenericEventEN3WTF10PassRefPtrINS_5EventEEE
 __ZN7WebCore4Node15eventParentNodeEv
 __ZN7WebCore11EventTarget23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore29DeprecatedPtrListImplIterator7toFirstEv
-__ZN7WebCore8Document17handleWindowEventEPNS_5EventEb
-__ZNK7WebCore23DeprecatedValueListImpl7isEmptyEv
-__ZN7WebCore29DeprecatedPtrListImplIterator6toLastEv
-__ZN7WebCore15EventTargetNode17handleLocalEventsEPNS_5EventEb
-__ZNK7WebCore15EventTargetNode8disabledEv
-__ZN7WebCore11EventTarget17handleLocalEventsEPNS_15EventTargetNodeEPNS_5EventEb
-__ZN7WebCore29DeprecatedPtrListImplIteratormmEv
+__ZNK7WebCore9DOMWindow8documentEv
+__ZN7WebCore9DOMWindow11handleEventEPNS_5EventEbPN3WTF6VectorINS3_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore4Node17handleLocalEventsEPNS_5EventEb
+__ZNK7WebCore4Node8disabledEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EEC2ERKS5_
 __ZN7WebCore11EventTarget24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore15EventTargetNode19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore29DeprecatedPtrListImplIteratorppEv
-__ZN7WebCore8Document24updateDocumentsRenderingEv
-__ZN7WebCore21DeprecatedPtrListImpl5clearEb
-__ZN7WebCore21DeprecatedPtrListImplD2Ev
-__ZN7WebCore5EventD1Ev
-__ZThn36_N7WebCore15EventTargetNode16derefEventTargetEv
-__ZN7WebCore15EventTargetNode16derefEventTargetEv
+__ZN7WebCore4Node19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore8Document26updateStyleForAllDocumentsEv
+__ZN7WebCore5EventD0Ev
+__ZN7WebCore4Node16derefEventTargetEv
 __ZN7WebCore11FrameLoader15finishedParsingEv
-__ZN7WebCore8Document7iconURLEv
-__ZN7WebCore13HTMLTokenizerD1Ev
-__ZN7WebCore23DeprecatedValueListImplD2Ev
-__ZN7WebCore23DeprecatedValueListImpl7Private10deleteListEPNS_27DeprecatedValueListImplNodeE
+__ZN7WebCore13HTMLTokenizerD0Ev
+__ZN7WebCore10HTMLParserD0Ev
+__ZN7WebCore9TimerBaseD2Ev
 __ZN7WebCore8Document5closeEv
-__ZN7WebCore11numRequestsEPNS_8DocumentE
+__ZN7WebCore11FrameLoader14checkCompletedEv
+__ZN7WebCore9FrameView33checkStopDelayingDeferredRepaintsEv
+__ZN7WebCoreL11numRequestsEPNS_8DocumentE
 __ZN7WebCore9DocLoader12requestCountEv
+__ZN7WebCore11FrameLoader22checkCallImplicitCloseEv
 __ZN7WebCore8Document13implicitCloseEv
--[WebCoreFrameBridge setTextSizeMultiplier:]
+__ZN7WebCore11FrameLoader9completedEv
+__ZN7WebCore11FrameLoader17checkLoadCompleteEv
+__ZN7WebCore11FrameLoader26recursiveCheckLoadCompleteEv
+__ZN7WebCore11FrameLoader29checkLoadCompleteForThisFrameEv
+__ZNK7WebCore14DocumentLoader19isLoadingInAPISenseEv
+__ZNK7WebCore11FrameLoader17subframeIsLoadingEv
+__ZN7WebCore11FrameLoader16markLoadCompleteEv
+__ZN7WebCore11FrameLoader18frameLoadCompletedEv
+__ZN7WebCore14DocumentLoader22stopRecordingResponsesEv
+__ZN7WebCore8Settings16setZoomsTextOnlyEb
+__ZN7WebCore5Frame13setZoomFactorEfb
+__ZNK7WebCore5Frame20isZoomFactorTextOnlyEv
+__ZN7WebCore12SchedulePairC1EP9NSRunLoopPK10__CFString
+__ZN7WebCore12SchedulePairC2EP9NSRunLoopPK10__CFString
+__ZN7WebCore4Page15addSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore12SchedulePairEEENS2_16SchedulePairHashENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore12SchedulePairEEES4_NS_17IdentityExtractorIS4_EENS2_16SchedulePairHashENS_10HashTraitsIS
+__ZN7WebCore14DocumentLoader8scheduleEPNS_12SchedulePairE
+__ZN7WebCoreL11scheduleAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEPNS_12Sc
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EE
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_4PageENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3addERKS2_RKSB_
+__ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_9PageGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_9PageGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTrai
+__ZN7WebCore9PageGroupC1ERKNS_6StringE
+__ZN7WebCore9PageGroupC2ERKNS_6StringE
+__ZN7WebCoreL19getUniqueIdentifierEv
+__ZN7WebCore9PageGroup7addPageEPNS_4PageE
+__ZN7WebCore12LocalStorage12localStorageERKNS_6StringE
+__ZN7WebCoreL15localStorageMapEv
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_12LocalStorageEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHash
+__ZN7WebCore12LocalStorageC1ERKNS_6StringE
+__ZN7WebCore12LocalStorageC2ERKNS_6StringE
+__ZN7WebCore18LocalStorageThread6createEv
+__ZN7WebCore18LocalStorageThreadC1Ev
+__ZN7WebCore18LocalStorageThreadC2Ev
+__ZN7WebCore18LocalStorageThread5startEv
+__ZN7WebCore18LocalStorageThread14scheduleImportEN3WTF10PassRefPtrINS_12LocalStorageEEE
+__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_12LocalStorageEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_12LocalStorageEEE
+__ZN7WebCore18LocalStorageThread23localStorageThreadStartEPv
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore16LocalStorageTaskEEEE14expandCapacityEv
+__ZN7WebCore18LocalStorageThread18localStorageThreadEv
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_12LocalStorageENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF12MessageQueueINS_6RefPtrIN7WebCore16LocalStorageTaskEEEE19alwaysTruePredicateERS4_
+__ZN7WebCore16LocalStorageTask11performTaskEv
+__ZN7WebCore12LocalStorage13performImportEv
 __ZN7WebCore5Cache13setCapacitiesEjjj
 __ZN7WebCore9pageCacheEv
+__ZN7WebCore9PageCacheC1Ev
 __ZN7WebCore9PageCacheC2Ev
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache5pruneEv
 __ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E3addIS3_S3_NS_17HashSetTranslatorILb1ES3_S8_S8_S6_EEEESt4pairINS_17HashTableIteratorIS3_S3_S5_S6_S8_S8_EEbERKT_RKT0_
 __ZN7WebCore8Settings20setCursiveFontFamilyERKNS_12AtomicStringE
-__ZN7WebCore32setNeedsReapplyStylesInAllFramesEPNS_4PageE
+__ZN7WebCoreL32setNeedsReapplyStylesInAllFramesEPNS_4PageE
 __ZN7WebCore5Frame21setNeedsReapplyStylesEv
-__ZN7WebCore6Widget10invalidateEv
 __ZN7WebCore8Settings23setDefaultFixedFontSizeEi
 __ZN7WebCore8Settings18setDefaultFontSizeEi
 __ZN7WebCore8Settings26setDefaultTextEncodingNameERKNS_6StringE
+__ZN7WebCore8Settings23setUsesEncodingDetectorEb
 __ZN7WebCore8Settings20setFantasyFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings18setFixedFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings28setForceFTPDirectoryListingsEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKNS_6StringE
 __ZN7WebCore8Settings14setJavaEnabledEb
 __ZN7WebCore8Settings20setJavaScriptEnabledEb
+__ZN7WebCore8Settings21setWebSecurityEnabledEb
+__ZN7WebCore8Settings35setAllowUniversalAccessFromFileURLsEb
 __ZN7WebCore8Settings40setJavaScriptCanOpenWindowsAutomaticallyEb
 __ZN7WebCore8Settings18setMinimumFontSizeEi
 __ZN7WebCore8Settings25setMinimumLogicalFontSizeEi
 __ZN7WebCore8Settings17setPluginsEnabledEb
+__ZN7WebCore8Settings19setDatabasesEnabledEb
+__ZN7WebCore8Settings22setLocalStorageEnabledEb
 __ZN7WebCore8Settings25setPrivateBrowsingEnabledEb
 __ZN7WebCore8Settings22setSansSerifFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings18setSerifFontFamilyERKNS_12AtomicStringE
@@ -1062,88 +1075,64 @@ __ZN7WebCore8Settings25setShouldPrintBackgroundsEb
 __ZN7WebCore8Settings24setTextAreasAreResizableEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings23setEditableLinkBehaviorENS_20EditableLinkBehaviorE
+__ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirectionSubmenuInclusionBehaviorE
 __ZN7WebCore8Settings18setDOMPasteAllowedEb
 __ZN7WebCore8Settings16setUsesPageCacheEb
 __ZN7WebCore8Settings22setShowsURLsInToolTipsEb
 __ZN7WebCore8Settings25setDeveloperExtrasEnabledEb
 __ZN7WebCore8Settings29setAuthorAndUserStylesEnabledEb
+__ZN7WebCore8Settings24setApplicationChromeModeEb
 __ZN7WebCore4KURLC1EP5NSURL
-__ZN3WTF6VectorIcLm2048EE6shrinkEm
+__ZN7WebCore4KURLC2EP5NSURL
 __ZN7WebCore8Settings25setUserStyleSheetLocationERKNS_4KURLE
-__ZN7WebCoreeqERKNS_4KURLES2_
+__ZN7WebCore4Page29userStyleSheetLocationChangedEv
 __ZN7WebCore8Settings32setNeedsAdobeFrameReloadingQuirkEb
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
+__ZN7WebCore8Settings25setNeedsLeopardMailQuirksEb
+__ZN7WebCore8Settings23setNeedsTigerMailQuirksEb
+__ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
+__ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
+__ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
+__ZN7WebCore8Settings33setEnforceCSSMIMETypeInStrictModeEb
 __ZN7WebCore4Page15backForwardListEv
 __ZN7WebCore15BackForwardList10setEnabledEb
 __ZN7WebCore15BackForwardList7enabledEv
 __ZN7WebCore15BackForwardList11setCapacityEi
-__ZN7WebCore16FontPlatformDataC1EP6NSFontbb
-__ZN7WebCore4FontC1ERKNS_16FontPlatformDataEb
-__ZN7WebCore16FontFallbackList15setPlatformFontERKNS_16FontPlatformDataE
-__ZN7WebCore9FontCache17getCachedFontDataEPKNS_16FontPlatformDataE
-__ZN3WTF7HashMapIN7WebCore16FontPlatformDataEPNS1_14SimpleFontDataENS1_20FontDataCacheKeyHashENS1_22FontDataCacheKeyTraitsENS_10HashTraitsIS4_EEE3setERKS2_RKS4_
-__ZN7WebCore14SimpleFontDataC1ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
-__ZN7WebCore16FontPlatformDataC2ERKS0_
-__ZN7WebCore14SimpleFontData12platformInitEv
-__ZN7WebCore12initFontDataEPNS_14SimpleFontDataE
-__ZN7WebCore17GlyphPageTreeNode7getRootEj
-__ZN7WebCore17GlyphPageTreeNode8getChildEPKNS_8FontDataEj
-__ZNK7WebCore14SimpleFontData12isCustomFontEv
-__ZNK3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
-__ZN7WebCore17GlyphPageTreeNode14initializePageEPKNS_8FontDataEj
-__ZNK7WebCore14SimpleFontData11isSegmentedEv
-__ZN7WebCore9GlyphPage4fillEjjPtjPKNS_14SimpleFontDataE
-__ZNK7WebCore14SimpleFontData13widthForGlyphEt
-__ZN7WebCore13GlyphWidthMap13widthForGlyphEt
-__ZNK7WebCore14SimpleFontData21platformWidthForGlyphEt
-__ZN7WebCore13GlyphWidthMap16setWidthForGlyphEtf
-__ZN7WebCore14SimpleFontData14determinePitchEv
-__ZNK3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IsEEEES9_E6expandEv
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E3addIS2_PNS1_14SimpleFontDataENS_17HashMapTranslatorILb1ES3_IS2_SG_ENS_18PairBaseHashTraitsIS9_NSA_ISG_EEEESC_S7_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZN7WebCore16FontPlatformDataD1Ev
-__ZN7WebCore15StringTruncator14centerTruncateERKNS_6StringEfRKNS_4FontEb
-__ZN7WebCore14truncateStringERKNS_6StringEfRKNS_4FontEPFjS2_jjPtEb
-__ZN7WebCore11stringWidthERKNS_4FontEPKtjb
-__ZNK7WebCore4Font10floatWidthERKNS_7TextRunE
-__ZNK7WebCore4Font16cachePrimaryFontEv
-__ZNK7WebCore16FontFallbackList10fontDataAtEPKNS_4FontEj
-__ZNK7WebCore14SimpleFontData20fontDataForCharacterEi
-__ZNK7WebCore4Font16canUseGlyphCacheERKNS_7TextRunE
-__ZNK7WebCore4Font23floatWidthForSimpleTextERKNS_7TextRunEPNS_11GlyphBufferE
-__ZN7WebCore13WidthIteratorC1EPKNS_4FontERKNS_7TextRunE
-__ZN7WebCore13WidthIterator7advanceEiPNS_11GlyphBufferE
-__ZNK7WebCore4Font21glyphDataForCharacterEibb
-__ZN3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZNK7WebCore4Font10fontDataAtEj
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE6shrinkEm
-__ZN7WebCore7IntSizeC1ERK7_NSSize
+__ZN7WebCore7IntSizeC1ERK6CGSize
+__ZN7WebCore7IntSizeC2ERK6CGSize
 __ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
+__ZN7WebCore10IconRecordC1ERKNS_6StringE
+__ZN7WebCore10IconRecordC2ERKNS_6StringE
+__ZN7WebCore12SharedBufferC1EPKhi
 __ZN7WebCore12SharedBufferC2EPKhi
 __ZN3WTF6VectorIcLm0EE6appendIhEEvPKT_m
 __ZN3WTF6VectorIcLm0EE14expandCapacityEm
 __ZN3WTF6VectorIcLm0EE15reserveCapacityEm
 __ZN7WebCore10IconRecord12setImageDataEN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore11BitmapImageC1EPNS_13ImageObserverE
 __ZN7WebCore11BitmapImageC2EPNS_13ImageObserverE
 __ZN7WebCore5ImageC2EPNS_13ImageObserverE
+__ZN7WebCore11ImageSourceC1Ev
 __ZN7WebCore11ImageSourceC2Ev
 __ZN7WebCore11BitmapImage16initPlatformDataEv
 __ZN7WebCore5Image7setDataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
 __ZNK7WebCore12SharedBuffer4sizeEv
 __ZNK7WebCore12SharedBuffer15hasPlatformDataEv
 __ZN7WebCore11BitmapImage11dataChangedEb
-__ZN7WebCore11BitmapImage18destroyDecodedDataEb
+__ZN7WebCore11BitmapImage24destroyMetadataAndNotifyEi
+__ZN7WebCore11BitmapImage22invalidatePlatformDataEv
+__ZN7WebCoreL10frameBytesERKNS_7IntSizeE
 __ZN7WebCore11ImageSource7setDataEPNS_12SharedBufferEb
 __ZN7WebCore12SharedBuffer12createCFDataEv
 +[WebCoreSharedBufferData initialize]
+-[WebCoreSharedBufferData .cxx_construct]
 -[WebCoreSharedBufferData initWithSharedBuffer:]
 -[WebCoreSharedBufferData length]
 __ZN7WebCore11BitmapImage15isSizeAvailableEv
 __ZN7WebCore11ImageSource15isSizeAvailableEv
 -[WebCoreSharedBufferData bytes]
 __ZNK7WebCore12SharedBuffer4dataEv
-__ZN7WebCore18imageSourceOptionsEv
+__ZN7WebCoreL18imageSourceOptionsEv
 __ZN7WebCore10IconRecord5imageERKNS_7IntSizeE
 __ZN7WebCore11BitmapImage10getNSImageEv
 __ZN7WebCore11BitmapImage21getTIFFRepresentationEv
@@ -1151,108 +1140,235 @@ __ZN7WebCore11BitmapImage10frameCountEv
 __ZNK7WebCore11ImageSource10frameCountEv
 __ZN7WebCore11BitmapImage12frameAtIndexEm
 __ZN7WebCore11BitmapImage10cacheFrameEm
-__ZN7WebCore11BitmapImage13shouldAnimateEv
 __ZN3WTF6VectorIN7WebCore9FrameDataELm0EE4growEm
 __ZN3WTF6VectorIN7WebCore9FrameDataELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore9FrameDataELm0EE15reserveCapacityEm
 __ZN7WebCore11ImageSource18createFrameAtIndexEm
+__ZNK7WebCore11ImageSource11initializedEv
 __ZN7WebCore11BitmapImage18checkForSolidColorEv
+__ZN7WebCore11ImageSource22frameIsCompleteAtIndexEm
+__ZN7WebCore11BitmapImage15repetitionCountEb
+__ZN7WebCore11ImageSource15repetitionCountEv
 __ZN7WebCore11ImageSource20frameHasAlphaAtIndexEm
 __ZN3WTF6VectorIP7CGImageLm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIP7CGImageLm0EE14expandCapacityEm
 __ZN3WTF6VectorIP7CGImageLm0EE15reserveCapacityEm
 __ZN3WTF6VectorIP7CGImageLm0EE6shrinkEm
-__ZNK7WebCore11FrameLoader25provisionalDocumentLoaderEv
+__ZN7WebCore16FontPlatformDataC1EP6NSFontbb
+__ZN7WebCore16FontPlatformDataC2EP6NSFontbb
+__ZN7WebCore4FontC1ERKNS_16FontPlatformDataEb
+__ZN7WebCore4FontC2ERKNS_16FontPlatformDataEb
+__ZN7WebCore16FontFallbackList15setPlatformFontERKNS_16FontPlatformDataE
+__ZN7WebCore9FontCache17getCachedFontDataEPKNS_16FontPlatformDataE
+__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20FontD
+__ZN7WebCore14SimpleFontDataC1ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
+__ZN7WebCore14SimpleFontDataC2ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
+__ZN7WebCore16FontPlatformDataC1ERKS0_
+__ZN7WebCore16FontPlatformDataC2ERKS0_
+__ZN7WebCore14SimpleFontData12platformInitEv
+__ZN7WebCoreL12initFontDataEPNS_14SimpleFontDataE
+__ZN7WebCore17GlyphPageTreeNode7getRootEj
+__ZN7WebCore17GlyphPageTreeNode8getChildEPKNS_8FontDataEj
+__ZNK3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZNK7WebCore14SimpleFontData12isCustomFontEv
+__ZN3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore8FontDataESt4pairIS4_PNS1_17GlyphPageTreeNodeEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore17GlyphPageTreeNode14initializePageEPKNS_8FontDataEj
+__ZNK7WebCore14SimpleFontData11isSegmentedEv
+__ZN7WebCore9GlyphPage4fillEjjPtjPKNS_14SimpleFontDataE
+__ZN3WTF6VectorItLm512EE6shrinkEm
+__ZN7WebCore14SimpleFontData17platformGlyphInitEv
+__ZN7WebCore13GlyphWidthMap18locatePageSlowCaseEj
+__ZNK7WebCore14SimpleFontData21platformWidthForGlyphEt
+__ZN7WebCore14SimpleFontData14determinePitchEv
+__ZN3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore13GlyphWidthMap14GlyphWidthPageEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore14SimpleFontData21platformCharWidthInitEv
+__ZN7WebCore14SimpleFontData14initCharWidthsEv
+__ZN3WTF7HashMapIN7WebCore16FontPlatformDataESt4pairIPNS1_14SimpleFontDataEjENS1_20FontDataCacheKeyHashENS1_22FontDataCacheKeyT
+__ZN7WebCore16FontPlatformDataaSERKS0_
+__ZN7WebCore16FontPlatformDataD1Ev
+__ZN7WebCore16FontPlatformDataD2Ev
+__ZN7WebCore15StringTruncator14centerTruncateERKNS_6StringEfRKNS_4FontEb
+__ZN7WebCoreL14truncateStringERKNS_6StringEfRKNS_4FontEPFjS2_jjPtEb
 __ZNK7WebCore11FrameLoader14frameHasLoadedEv
-_stringIsFileURL
-__ZN7WebCore12IconDatabase14iconForPageURLERKNS_6StringERKNS_7IntSizeEb
-__ZN7WebCore12IconDatabase24getOrCreatePageURLRecordERKNS_6StringE
-_urlWithDataRelativeToURL
-_urlByRemovingResourceSpecifier
-_urlByRemovingComponent
-_canonicalURL
-_urlOriginalDataAsString
-_urlOriginalData
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN7WebCore9FrameView14setNeedsLayoutEv
+__ZN7WebCore4Page15didMoveOnscreenEv
+__ZN7WebCore9FrameView15didMoveOnscreenEv
+__ZN7WebCore10RenderView15didMoveOnscreenEv
+_WebCoreTextFloatWidth
+__ZNK7WebCore4Font10floatWidthERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTraitsIS8_EEEE
+__ZNK7WebCore4Font16cachePrimaryFontEv
+__ZNK7WebCore16FontFallbackList10fontDataAtEPKNS_4FontEj
+__ZNK7WebCore14SimpleFontData20fontDataForCharacterEi
+__ZNK7WebCore4Font16canUseGlyphCacheERKNS_7TextRunE
+__ZN7WebCore4Font36canReturnFallbackFontsForComplexTextEv
+__ZNK7WebCore4Font23floatWidthForSimpleTextERKNS_7TextRunEPNS_11GlyphBufferEPN3WTF7HashSetIPKNS_14SimpleFontDataENS6_7PtrHashIS
+__ZN7WebCore13WidthIteratorC1EPKNS_4FontERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashTraitsI
+__ZN7WebCore13WidthIteratorC2EPKNS_4FontERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashTraitsI
+__ZN7WebCore13WidthIterator7advanceEiPNS_11GlyphBufferE
+__ZNK7WebCore4Font21glyphDataForCharacterEibb
+__ZNK7WebCore4Font10fontDataAtEj
+__ZN7WebCore9FontCache15releaseFontDataEPKNS_14SimpleFontDataE
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPKN7WebCore14SimpleFontDataEEES7_NS_17IdentityExtractorIS7_EENS_28ListHashSetNodeHashF
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE10appendNodeEPNS_15ListHashSetNodeIS4_EE
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE6shrinkEm
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS4_EE
+__ZN7WebCore12IconDatabase14iconForPageURLERKNS_6StringERKNS_7IntSizeE
+__ZN7WebCoreL11stringWidthERKNS_4FontEPKtjb
+__ZNK3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZN3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestEb
+__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataEb
 __ZN7WebCore11FrameLoader4loadEPNS_14DocumentLoaderE
 __ZN7WebCore14DocumentLoader7requestEv
-__ZN7WebCore11FrameLoader23addExtraFieldsToRequestERNS_15ResourceRequestEbb
-__ZN7WebCore11FrameLoader14applyUserAgentERNS_15ResourceRequestE
+__ZN7WebCore11FrameLoader35addExtraFieldsToMainResourceRequestERNS_15ResourceRequestE
+__ZN7WebCore11FrameLoader23addExtraFieldsToRequestERNS_15ResourceRequestENS_13FrameLoadTypeEbb
+__ZNK7WebCore19ResourceRequestBase20firstPartyForCookiesEv
 __ZN7WebCore15ResourceRequest23doUpdateResourceRequestEv
-__ZN7WebCore16DeprecatedString10setUnicodeEPKNS_14DeprecatedCharEj
-__ZN7WebCore19ResourceRequestBase18setHTTPHeaderFieldERKNS_6StringES3_
-__ZNK7WebCore19ResourceRequestBase15mainDocumentURLEv
-__ZN7WebCore19ResourceRequestBase18setMainDocumentURLERKNS_4KURLE
+__ZNK7WebCore11FrameLoader18isLoadingMainFrameEv
+__ZN7WebCore19ResourceRequestBase23setFirstPartyForCookiesERKNS_4KURLE
+__ZN7WebCore11FrameLoader14applyUserAgentERNS_15ResourceRequestE
+__ZN7WebCore19ResourceRequestBase18setHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN7WebCore11FrameLoader21addHTTPOriginIfNeededERNS_15ResourceRequestENS_6StringE
+__ZNK7WebCore19ResourceRequestBase15httpHeaderFieldERKNS_12AtomicStringE
+__ZNK7WebCore19ResourceRequestBase10httpMethodEv
+__ZN7WebCore19ResourceRequestBase50setResponseContentDispositionEncodingFallbackArrayERKNS_6StringES3_S3_
+__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6StringELm0EE15reserveCapacityEm
 __ZNK7WebCore14DocumentLoader15originalRequestEv
 __ZNK7WebCore11FrameLoader29shouldTreatURLAsSameAsCurrentERKNS_4KURLE
-__ZNK7WebCore14DocumentLoader16overrideEncodingEv
-__ZN7WebCore14DocumentLoader19setOverrideEncodingERKNS_6StringE
 __ZN7WebCore11FrameLoader34shouldReloadToHandleUnreachableURLEPNS_14DocumentLoaderE
 __ZNK7WebCore14DocumentLoader14unreachableURLEv
-__ZN7WebCore11FrameLoader4loadEPNS_14DocumentLoaderENS_13FrameLoadTypeEN3WTF10PassRefPtrINS_9FormStateEEE
+__ZN7WebCore11FrameLoader22loadWithDocumentLoaderEPNS_14DocumentLoaderENS_13FrameLoadTypeEN3WTF10PassRefPtrINS_9FormStateEEE
+__ZN7WebCore11FrameLoader20shouldScrollToAnchorEbNS_13FrameLoadTypeERKNS_4KURLE
+__ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
+__ZNK7WebCore4KURL6hasRefEv
 __ZN7WebCore11FrameLoader15stopPolicyCheckEv
 __ZN7WebCore11PolicyCheck5clearEv
 __ZN7WebCore11PolicyCheck12clearRequestEv
+__ZN3WTF6VectorIN7WebCore6StringELm0EEaSERKS3_
 __ZN7WebCore11PolicyCheck6cancelEv
-__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S9_bESA_
-__ZNK7WebCore14DocumentLoader16triggeringActionEv
-__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
-__ZN7WebCore14DocumentLoader19setTriggeringActionERKNS_16NavigationActionE
-__ZNK7WebCore14DocumentLoader18lastCheckedRequestEv
+__ZN7WebCore15ResourceRequestD2Ev
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEb
+__ZN7WebCoreL14navigationTypeENS_13FrameLoadTypeEbb
+__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEE
 __ZN7WebCore25equalIgnoringHeaderFieldsERKNS_19ResourceRequestBaseES2_
 __ZNK7WebCore19ResourceRequestBase6isNullEv
-__ZN7WebCore14DocumentLoader21setLastCheckedRequestERKNS_15ResourceRequestE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E3addINS1_6StringEjNS_17HashMapTranslatorILb0ES4_ISG_jENS_18PairBaseHashTraitsINSA_ISG_EENSA_IjEEEESD_S8_EEEES4_INS_17HashTableIteratorIS3_S5_S7_S8_SD_SB_EEbERKT_RKT0_
 __ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S7_bES8_
 __ZNK7WebCore15ResourceRequest12nsURLRequestEv
 __ZNK7WebCore19ResourceRequestBase21updatePlatformRequestEv
 __ZN7WebCore15ResourceRequest23doUpdatePlatformRequestEv
 __ZNK7WebCore4KURL11createCFURLEv
+__ZNK7WebCore4KURL12copyToBufferERN3WTF6VectorIcLm512EEE
 __ZNK7WebCore19ResourceRequestBase11cachePolicyEv
 __ZNK7WebCore19ResourceRequestBase15timeoutIntervalEv
-__ZNK7WebCore19ResourceRequestBase10httpMethodEv
 __ZNK7WebCore19ResourceRequestBase16allowHTTPCookiesEv
 __ZNK7WebCore19ResourceRequestBase16httpHeaderFieldsEv
 __ZNK7WebCore19ResourceRequestBase8httpBodyEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
 __ZN7WebCore11FrameLoader29continueAfterNavigationPolicyENS_12PolicyActionE
+__ZN3WTF6VectorIN7WebCore6StringELm0EE6shrinkEm
 __ZN7WebCore11PolicyCheck4callEb
 __ZN7WebCore11FrameLoader37callContinueLoadAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
 __ZN7WebCore11FrameLoader33continueLoadAfterNavigationPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore5Frame11shouldCloseEv
+__ZN7WebCore5Frame11shouldCloseEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
 __ZN7WebCore6Chrome30canRunBeforeUnloadConfirmPanelEv
 __ZN7WebCore11FrameLoader14stopAllLoadersEv
 __ZN7WebCore11FrameLoader20stopLoadingSubframesEv
 __ZN7WebCore14DocumentLoader11stopLoadingEv
-__ZN7WebCore9cancelAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_EC2ERKS7_
+__ZN7WebCoreL9cancelAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
+__ZN7WebCore14DocumentLoader21clearArchiveResourcesEv
+__ZN7WebCore19InspectorController14resumeDebuggerEv
 __ZN7WebCore11FrameLoader31continueLoadAfterWillSubmitFormENS_12PolicyActionE
 __ZN7WebCore14DocumentLoader19prepareForLoadStartEv
 __ZN7WebCore14DocumentLoader22setPrimaryLoadCompleteEb
 __ZN7WebCore14DocumentLoader11clearErrorsEv
-__ZN7WebCore14DocumentLoader10setLoadingEb
 __ZN7WebCore11FrameLoader19prepareForLoadStartEv
 __ZN7WebCore15ProgressTracker15progressStartedEPNS_5FrameE
 __ZN7WebCore15ProgressTracker5resetEv
 __ZN3WTF20deleteAllPairSecondsIPN7WebCore12ProgressItemEKNS_7HashMapImS3_NS_7IntHashImEENS_10HashTraitsImEENS7_IS3_EEEEEEvRT0_
-__ZN3WTF9HashTableImSt4pairImiENS_18PairFirstExtractorIS2_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENS8_IiEEEES9_E6expandEv
+_stringIsCaseInsensitiveEqualToString
+__ZN7WebCore15BackForwardList11currentItemEv
+__ZN7WebCore4Page16setDefersLoadingEb
+__ZN7WebCore11FrameLoader16setDefersLoadingEb
+__ZN7WebCore14DocumentLoader16setDefersLoadingEb
+__ZN7WebCoreL19setAllDefersLoadingERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
 __ZNK7WebCore11FrameLoader20activeDocumentLoaderEv
 __ZNK7WebCore14DocumentLoader21isLoadingMainResourceEv
-__ZN7WebCore14DocumentLoader24setLoadingFromCachedPageEb
 __ZN7WebCore15ProgressTracker22createUniqueIdentifierEv
 __ZN7WebCore11FrameLoader40dispatchAssignIdentifierToInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
 __ZN7WebCore19InspectorController27identifierForInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
 __ZNK7WebCore19InspectorController7enabledEv
 __ZN7WebCore14DocumentLoader24startLoadingMainResourceEm
 __ZN7WebCore18MainResourceLoader6createEPNS_5FrameE
+__ZN7WebCore18MainResourceLoaderC1EPNS_5FrameE
 __ZN7WebCore18MainResourceLoaderC2EPNS_5FrameE
 __ZN7WebCore14ResourceLoaderC2EPNS_5FrameEbb
 __ZN7WebCore18MainResourceLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZNK7WebCore14ResourceLoader11frameLoaderEv
+__ZN7WebCore21ApplicationCacheGroup19cacheForMainRequestERKNS_15ResourceRequestEPNS_14DocumentLoaderE
+__ZN7WebCore16ApplicationCache23requestIsHTTPOrHTTPSGetERKNS_15ResourceRequestE
+__ZN7WebCore23ApplicationCacheStorage16cacheGroupForURLERKNS_4KURLE
+__ZN7WebCore23ApplicationCacheStorage22loadManifestHostHashesEv
+__ZN7WebCore23ApplicationCacheStorage12openDatabaseEb
+__ZN7WebCoreL11urlHostHashERKNS_4KURLE
+__ZNK3WTF9HashTableIjSt4pairIjjENS_18PairFirstExtractorIS2_EEN7WebCore13AlreadyHashedENS_14PairHashTraitsINS_10HashTraitsIjEES9
+__ZN7WebCoreL25shouldLoadAsEmptyDocumentERKNS_4KURLE
+_WebCoreObjCScheduleDeallocateOnMainThread
+__ZN7WebCore15BackForwardList8backItemEv
+__ZN7WebCore15BackForwardList11forwardItemEv
+__ZN7WebCore15FocusController18focusedOrMainFrameEv
+__ZN7WebCore19SelectionController10setFocusedEb
+__ZN7WebCore19SelectionController27focusedOrActiveStateChangedEv
+__ZNK7WebCore5Frame15selectionBoundsEb
+__ZNK7WebCore10RenderView15selectionBoundsEb
+__ZN7WebCore8Document19updateStyleIfNeededEv
+__ZN7WebCoreL21rendererAfterPositionEPNS_12RenderObjectEj
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_19RenderSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZNK7WebCore10ScrollView18visibleContentRectEb
+__ZNK7WebCore10ScrollView26platformVisibleContentRectEb
+__ZN7WebCore7IntRect9intersectERKS0_
+__ZN7WebCore9FloatRectC1ERKNS_7IntRectE
+__ZN7WebCore9FloatRectC2ERKNS_7IntRectE
+__ZN7WebCore10FloatPointC1ERKNS_8IntPointE
+__ZN7WebCore10FloatPointC2ERKNS_8IntPointE
+__ZN7WebCore9FloatSizeC1ERKNS_7IntSizeE
+__ZN7WebCore9FloatSizeC2ERKNS_7IntSizeE
+__ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
+__ZN7WebCore10RenderView41repaintRectangleInViewAndCompositedLayersERKNS_7IntRectEb
+__ZNK7WebCore10RenderView13shouldRepaintERKNS_7IntRectE
+__ZNK7WebCore10RenderView8printingEv
+__ZN7WebCore5Frame15setCaretVisibleEb
+__ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
+__ZNK7WebCore8Document32useSecureKeyboardEntryWhenActiveEv
+__ZN7WebCore8Document19dispatchWindowEventERKNS_12AtomicStringEbb
+__ZN7WebCore9DOMWindow13dispatchEventERKNS_12AtomicStringEbb
+__ZN7WebCore9DOMWindow13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore9DOMWindow14refEventTargetEv
+__ZN7WebCore9DOMWindow16derefEventTargetEv
+__ZN7WebCore9FrameView18updateControlTintsEv
+__ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
+__ZN7WebCore9PageGroup21removeAllVisitedLinksEv
+__ZN7WebCore4Page21removeAllVisitedLinksEv
+__ZN3WTF7HashSetIPN7WebCore9PageGroupENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore9PageGroup18removeVisitedLinksEv
+__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
+__ZN7WebCore12IconDatabase38notifyPendingLoadDecisionsOnMainThreadEPv
+__ZN7WebCore12IconDatabase26notifyPendingLoadDecisionsEv
+__ZN7WebCore14DocumentLoader36deliverSubstituteResourcesAfterDelayEv
+__ZN7WebCore18MainResourceLoader16setDefersLoadingEb
+__ZN7WebCore14ResourceLoader16setDefersLoadingEb
 __ZN7WebCore18MainResourceLoader7loadNowERNS_15ResourceRequestE
-__ZN7WebCore25shouldLoadAsEmptyDocumentERKNS_4KURLE
 __ZN7WebCore18MainResourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZNK7WebCore14ResourceLoader11frameLoaderEv
 __ZN7WebCore18MainResourceLoader25isPostOrRedirectAfterPostERKNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZNK7WebCore20ResourceResponseBase14httpStatusCodeEv
 __ZN7WebCore14ResourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
@@ -1260,67 +1376,113 @@ __ZN7WebCore11FrameLoader15willSendRequestEPNS_14ResourceLoaderERNS_15ResourceRe
 __ZN7WebCore11FrameLoader23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZN7WebCore19InspectorController15willSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZN7WebCore14DocumentLoader10setRequestERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPFvPvS3_N3WTF10PassRefPtrINS_9FormStateEEEbES4_
-__ZN7WebCore5equalEPNS_10StringImplES1_
-__ZN7WebCore18MainResourceLoader33callContinueAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore18MainResourceLoader29continueAfterNavigationPolicyERKNS_15ResourceRequestEb
 __ZN7WebCore11FrameLoader32representationExistsForURLSchemeERKNS_6StringE
 __ZN7WebCore14ResourceHandle6createERKNS_15ResourceRequestEPNS_20ResourceHandleClientEPNS_5FrameEbbb
+__ZN7WebCore14ResourceHandle21shouldContentSniffURLERKNS_4KURLE
+__ZN7WebCore14ResourceHandleC1ERKNS_15ResourceRequestEPNS_20ResourceHandleClientEbbb
 __ZN7WebCore14ResourceHandleC2ERKNS_15ResourceRequestEPNS_20ResourceHandleClientEbbb
-__ZN7WebCore23AuthenticationChallengeC2Ev
+__ZN7WebCore27AuthenticationChallengeBaseC2Ev
+__ZN7WebCore15ProtectionSpaceC1Ev
 __ZN7WebCore15ProtectionSpaceC2Ev
+__ZN7WebCore10CredentialC1Ev
 __ZN7WebCore10CredentialC2Ev
-__ZN7WebCore14ResourceHandle11portAllowedERKNS_15ResourceRequestE
+__ZNK7WebCore4KURL4userEv
+__ZNK7WebCore4KURL4passEv
+__ZN7WebCore19ResourceRequestBase17removeCredentialsEv
+__ZN7WebCore4KURL5parseERKNS_6StringE
+__ZN7WebCoreL11portAllowedERKNS_15ResourceRequestE
 __ZN7WebCore14ResourceHandle5startEPNS_5FrameE
 __ZN7WebCore14ResourceHandle8delegateEv
 -[WebCoreResourceHandleAsDelegate initWithHandle:]
+__ZN7WebCore14ResourceHandle29didSendBodyDataDelegateExistsEv
+-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]
+__ZNK7WebCore14ResourceHandle6clientEv
+-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]
+__ZN7WebCore14ResourceHandle26shouldUseCredentialStorageEv
+__ZN7WebCore14ResourceLoader26shouldUseCredentialStorageEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader26shouldUseCredentialStorageEv
+__ZN7WebCore11FrameLoader26shouldUseCredentialStorageEPNS_14ResourceLoaderE
+__ZNK7WebCore15ProgressTracker17estimatedProgressEv
+__ZN7WebCore12IconDatabase24getOrCreatePageURLRecordERKNS_6StringE
+_WebCoreShouldUseFontSmoothing
+_WebCoreSetShouldUseFontSmoothing
+_WebCoreDrawTextAtPoint
+__ZN7WebCore15GraphicsContextC1EP9CGContext
+__ZN7WebCore15GraphicsContextC2EP9CGContext
+__ZN7WebCore15GraphicsContext28createGraphicsContextPrivateEv
+__ZN7WebCore15GraphicsContext19setPaintingDisabledEb
+__ZNK7WebCore15GraphicsContext9fillColorEv
+__ZN7WebCore15GraphicsContext20setPlatformFillColorERKNS_5ColorE
+__ZNK7WebCore15GraphicsContext16paintingDisabledEv
+__ZNK7WebCore15GraphicsContext15platformContextEv
+__ZN7WebCoreL14setCGFillColorEP9CGContextRKNS_5ColorE
+__ZNK7WebCore5Color7getRGBAERdS1_S1_S1_
+__ZNK7WebCore15GraphicsContext11strokeColorEv
+__ZN7WebCore15GraphicsContext22setPlatformStrokeColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
+__ZNK7WebCore4Font8drawTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZNK7WebCore4Font14drawSimpleTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZNK7WebCore4Font15drawGlyphBufferEPNS_15GraphicsContextERKNS_11GlyphBufferERKNS_7TextRunERKNS_10FloatPointE
+__ZNK7WebCore4Font10drawGlyphsEPNS_15GraphicsContextEPKNS_14SimpleFontDataERKNS_11GlyphBufferEiiRKNS_10FloatPointE
+__ZNK7WebCore15GraphicsContext9getShadowERNS_7IntSizeERiRNS_5ColorE
+__ZN7WebCore15GraphicsContext15textDrawingModeEv
+__ZN3WTF6VectorI6CGSizeLm2048EE6shrinkEm
+__ZN3WTF6VectorItLm2048EE6shrinkEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE6shrinkEm
+__ZN7WebCore15GraphicsContextD1Ev
+__ZN7WebCore15GraphicsContextD2Ev
+__ZN7WebCore15GraphicsContext29destroyGraphicsContextPrivateEPNS_22GraphicsContextPrivateE
+__ZN7WebCore15SQLiteStatement11columnCountEv
+__ZN7WebCore15SQLiteStatement13getColumnTextEi
+__ZN7WebCore6StringC1EPKt
+__ZN7WebCore6StringC2EPKt
+__ZN7WebCore12IconDatabase21getOrCreateIconRecordERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_10IconRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTr
+__ZN7WebCore13PageURLRecord13setIconRecordEN3WTF10PassRefPtrINS_10IconRecordEEE
+__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_2
 __ZN7WebCore11HistoryItemC1ERKNS_6StringES3_S3_d
+__ZN7WebCore11HistoryItemC2ERKNS_6StringES3_S3_d
 __ZN7WebCore11HistoryItem13setVisitCountEi
+__ZN7WebCore11HistoryItem16adoptVisitCountsERN3WTF6VectorIiLm0EEES4_
+__ZN3WTF6VectorIiLm0EE14shrinkCapacityEm
 __ZNK7WebCore11HistoryItem9urlStringEv
 __ZNK7WebCore11HistoryItem15lastVisitedTimeEv
-+[WebCoreHistory setHistoryProvider:]
-__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
--[WebCoreFunctionWrapper invoke]
-__ZN7WebCore12IconDatabase38notifyPendingLoadDecisionsOnMainThreadEPv
-__ZN7WebCore12IconDatabase26notifyPendingLoadDecisionsEv
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E5clearEv
+__ZN7WebCore11HistoryItem15setRedirectURLsESt8auto_ptrIN3WTF6VectorINS_6StringELm0EEEE
+__ZN7WebCore7Console24setShouldPrintExceptionsEb
+__ZN7WebCore10IconRecord15imageDataStatusEv
+__ZN3WTF7HashSetIPN7WebCore10IconRecordENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTa
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocate
+__ZN7WebCore12IconDatabase14wakeSyncThreadEv
+__ZN7WebCore24disableSuddenTerminationEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE15reserveCapacityEm
+__ZN7WebCore12IconDatabase37getImageDataForIconURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatement8bindTextEiRKNS_6StringE
+__ZN7WebCore15SQLiteStatement21getColumnBlobAsVectorEiRN3WTF6VectorIcLm0EEE
+__ZN7WebCore12SharedBufferC1EPKci
+__ZN7WebCore12SharedBufferC2EPKci
+__ZN3WTF6VectorIcLm0EE6appendIcEEvPKT_m
+__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
+__ZN7WebCore15SQLiteStatement5resetEv
+__ZNK3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore15AutodrainedPool5cycleEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE6shrinkEm
+__ZN7WebCore23enableSuddenTerminationEv
 -[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]
-__ZNK7WebCore14ResourceHandle6clientEv
 __ZN7WebCore14ResourceLoader18didReceiveResponseEPNS_14ResourceHandleERKNS_16ResourceResponseE
+-[NSHTTPURLResponse(WebCoreURLResponse) _webcore_MIMEType]
+__ZL24webNSURLResponseMIMETypeP11objc_objectP13objc_selector
 __ZN7WebCore18MainResourceLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore16ResourceResponse24doUpdateResourceResponseEv
-__ZNK7WebCore4KURL11isLocalFileEv
-__ZN7WebCore17equalIgnoringCaseERKNS_16DeprecatedStringES2_
-__ZNK7WebCore4KURL4pathEv
-__ZN7WebCore4KURL13decode_stringERKNS_16DeprecatedStringE
-__ZN7WebCore12UTF8EncodingEv
-__ZN7WebCore4KURL13decode_stringERKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZNK7WebCore16DeprecatedString4findEci
-__ZNK7WebCore16DeprecatedString2atEj
-__ZN3WTF6VectorIcLm2048EE4growEm
-__ZNK7WebCore16DeprecatedString10copyLatin1EPcjj
-__ZNK7WebCore12TextEncoding6decodeEPKcm
-__ZN7WebCore15newTextCodecICUERKNS_12TextEncodingEPKv
-__ZN7WebCore12TextCodecICUC2ERKNS_12TextEncodingE
-__ZN7WebCore12TextCodecICU6decodeEPKcmb
-__ZNK7WebCore12TextCodecICU18createICUConverterEv
-__ZN7WebCore9TextCodec17appendOmittingBOMERN3WTF6VectorItLm0EEEPKtm
-__ZN3WTF6VectorItLm0EE6appendItEEvPKT_m
-__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm0EE14expandCapacityEm
-__ZN3WTF6VectorItLm0EE15reserveCapacityEm
-__ZN7WebCore10StringImpl5adoptERN3WTF6VectorItLm0EEE
-__ZN7WebCore12TextCodecICU29registerExtendedEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecICU22registerExtendedCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E4findIiNS_22IdentityHashTranslatorIiS4_S8_EEEENS_17HashTableIteratorIiS4_S6_S8_SD_SB_EERKT_
-__ZN7WebCore12TextCodecMac21registerEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecMac14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZNK7WebCore12TextCodecICU19releaseICUConverterEv
-__ZNK7WebCore16DeprecatedString11isAllLatin1Ev
-__ZN7WebCore16DeprecatedString6insertEjPKcj
-__ZN7WebCore20DeprecatedStringData17increaseAsciiSizeEj
-__ZN7WebCore16DeprecatedString6appendEPKNS_14DeprecatedCharEj
-__ZN7WebCore16DeprecatedString6insertEjPKNS_14DeprecatedCharEj
+__ZNK7WebCore20ResourceResponseBase16httpHeaderFieldsEv
 __ZN7WebCore11FrameLoader18checkContentPolicyERKNS_6StringEPFvPvNS_12PolicyActionEES4_
 __ZN7WebCore11PolicyCheck3setEPFvPvNS_12PolicyActionEES1_
 __ZN7WebCore11FrameLoader26continueAfterContentPolicyENS_12PolicyActionE
@@ -1328,7 +1490,6 @@ __ZN7WebCore11PolicyCheck4callENS_12PolicyActionE
 __ZN7WebCore18MainResourceLoader30callContinueAfterContentPolicyEPvNS_12PolicyActionE
 __ZN7WebCore18MainResourceLoader26continueAfterContentPolicyENS_12PolicyActionE
 __ZNK7WebCore11FrameLoader10isStoppingEv
-__ZNK7WebCore14DocumentLoader10isStoppingEv
 __ZN7WebCore18MainResourceLoader26continueAfterContentPolicyENS_12PolicyActionERKNS_16ResourceResponseE
 __ZNK7WebCore11FrameLoader15canShowMIMETypeERKNS_6StringE
 __ZNK7WebCore20ResourceResponseBase6isHTTPEv
@@ -1341,9 +1502,11 @@ __ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE15reserveCapacityEm
 __ZN7WebCore15ProgressTracker17incrementProgressEmRKNS_16ResourceResponseE
 __ZNK7WebCore20ResourceResponseBase21expectedContentLengthEv
 __ZNK3WTF7HashMapImPN7WebCore12ProgressItemENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE3getERKm
-__ZN3WTF9HashTableImSt4pairImiENS_18PairFirstExtractorIS2_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENS8_IiEEEES9_E3addImPN7WebCore12ProgressItemENS_17HashMapTranslatorILb1ES1_ImSG_ENS_18PairBaseHashTraitsIS9_NS8_ISG_EEEESB_S6_EEEES1_INS_17HashTableIteratorImS2_S4_S6_SB_S9_EEbERKT_RKT0_
+__ZN3WTF7HashMapImPN7WebCore12ProgressItemENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE3setERKmRKS3_
+__ZN3WTF9HashTableImSt4pairImPN7WebCore12ProgressItemEENS_18PairFirstExtractorIS5_EENS_7IntHashImEENS_14PairHashTraitsINS_10Has
 __ZN7WebCore11FrameLoader26dispatchDidReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
 __ZN7WebCore19InspectorController18didReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
+__ZN7WebCore20ResourceResponseBaseD2Ev
 -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]
 __ZN7WebCore14ResourceLoader14didReceiveDataEPNS_14ResourceHandleEPKcii
 __ZN7WebCore18MainResourceLoader14didReceiveDataEPKcixb
@@ -1356,40 +1519,31 @@ __ZN7WebCore14DocumentLoader12receivedDataEPKci
 __ZNK7WebCore14DocumentLoader19doesProgressiveLoadERKNS_6StringE
 __ZNK7WebCore11FrameLoader11isReplacingEv
 __ZN7WebCore14DocumentLoader10commitLoadEPKci
-__ZNK7WebCore14DocumentLoader17mainDocumentErrorEv
-__ZN7WebCore8Document7appletsEv
-__ZN7WebCore14HTMLCollectionC1EN3WTF10PassRefPtrINS_4NodeEEENS0_4TypeE
-__ZNK7WebCore14HTMLCollection6lengthEv
-__ZNK7WebCore14HTMLCollection19resetCollectionInfoEv
-__ZNK7WebCore14HTMLCollection10calcLengthEv
-__ZNK7WebCore14HTMLCollection9itemAfterEPNS_7ElementE
-__ZN7WebCore17nextNodeOrSiblingEPNS_4NodeES1_b
-__ZNK7WebCore4Node16traverseNextNodeEPKS0_
-__ZN7WebCore8Document22hasWindowEventListenerERKNS_12AtomicStringE
-__ZN7WebCore23DeprecatedValueListImpl5beginEv
-__ZN7WebCore23DeprecatedValueListImpl3endEv
-__ZNK7WebCore23DeprecatedValueListImpl3endEv
-__ZN7WebCore15BackForwardList8capacityEv
-__ZN7WebCore15EventTargetNode19dispatchWindowEventERKNS_12AtomicStringEbb
-__ZN7WebCore8Document15updateRenderingEv
-__ZN7WebCore8Document11inPageCacheEv
-__ZN7WebCore8Document35removeAllEventListenersFromAllNodesEv
+__ZN7WebCore9DOMWindow16hasEventListenerERKNS_12AtomicStringE
+__ZN7WebCore9DOMWindow19dispatchUnloadEventEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore8Document23removeAllEventListenersEv
 __ZN7WebCore8Document39removeAllDisconnectedNodeEventListenersEv
-__ZNK7WebCore15EventTargetNode17isEventTargetNodeEv
-__ZN7WebCore15EventTargetNode23removeAllEventListenersEv
-__ZN7WebCore11EventTarget23removeAllEventListenersEPNS_15EventTargetNodeE
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
+__ZNK7WebCore4Node16traverseNextNodeEPKS0_
 __ZN7WebCore6Loader14cancelRequestsEPNS_9DocLoaderE
-__ZN7WebCore14XMLHttpRequest14cancelRequestsEPNS_8DocumentE
-__ZN7WebCore18requestsByDocumentEv
+__ZN7WebCore9DocLoader20clearPendingPreloadsEv
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14shrinkCapacityEm
+__ZN7WebCore6Loader28scheduleServePendingRequestsEv
+__ZN7WebCore9TimerBase5startEdd
+__ZN7WebCoreL9timerHeapEv
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE15reserveCapacityEm
+__ZN7WebCore9TimerBase15heapDecreaseKeyEv
+__ZSt11__push_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
+__ZN7WebCore21MainThreadSharedTimer11setFireTimeEd
+__ZN7WebCore22setSharedTimerFireTimeEd
+-[WebCorePowerNotifier init]
+__ZN7WebCore8Document13stopDatabasesEv
 __ZN7WebCore14DocumentLoader23stopLoadingSubresourcesEv
 __ZN7WebCore14DocumentLoader18stopLoadingPlugInsEv
 __ZN7WebCore14DocumentLoader15detachFromFrameEv
-__ZN7WebCore11FrameLoader28addHistoryForCurrentLocationEv
-__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_d
-__ZN7WebCore11HistoryItem18setLastVisitedTimeEd
-__ZN7WebCore11HistoryItem22mergeAutoCompleteHintsEPS0_
-__ZN7WebCore11HistoryItemD1Ev
-__ZN7WebCore12IconDatabase21releaseIconForPageURLERKNS_6StringE
 __ZN7WebCore11FrameLoader33addBackForwardItemClippedAtTargetEb
 __ZN7WebCore15BackForwardList7entriesEv
 __ZN7WebCore11FrameLoader21createHistoryItemTreeEPNS_5FrameEb
@@ -1397,6 +1551,7 @@ __ZN7WebCore11FrameLoader17createHistoryItemEb
 __ZNK7WebCore14DocumentLoader11originalURLEv
 __ZNK7WebCore14DocumentLoader10requestURLEv
 __ZN7WebCore11HistoryItemC1ERKNS_4KURLERKNS_6StringES6_S6_
+__ZN7WebCore11HistoryItemC2ERKNS_4KURLERKNS_6StringES6_S6_
 __ZN7WebCore11HistoryItem20setOriginalURLStringERKNS_6StringE
 __ZN7WebCore11HistoryItem22setFormInfoFromRequestERKNS_15ResourceRequestE
 __ZN7WebCore11HistoryItem15setIsTargetItemEb
@@ -1404,1050 +1559,2044 @@ __ZN7WebCore15BackForwardList7addItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE15reserveCapacityEm
 __ZN3WTF7HashSetINS_6RefPtrIN7WebCore11HistoryItemEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore10ScrollView18suppressScrollbarsEbb
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_
+__ZNK7WebCore14DocumentLoader28urlForHistoryReflectsFailureEv
+__ZNK7WebCore14DocumentLoader19originalRequestCopyEv
+__ZN7WebCore11HistoryItem7visitedERKNS_6StringEd
+__ZN7WebCore11HistoryItem17recordVisitAtTimeEd
+__ZN7WebCore11HistoryItem25padDailyCountsForNewVisitEd
+__ZN3WTF6VectorIiLm0EE4fillERKim
+__ZSt4fillIPiiEvT_S1_RKT0_
+__ZN3WTF6VectorIiLm0EE6insertIiEEvmPKT_m
+__ZN7WebCore11HistoryItem27collapseDailyVisitsToWeeklyEv
+__ZNK7WebCore11HistoryItem17originalURLStringEv
+__ZN7WebCore4Page20setGlobalHistoryItemEPNS_11HistoryItemE
+__ZN7WebCore9PageGroup14addVisitedLinkERKNS_4KURLE
+__ZN7WebCore15visitedLinkHashEPKtj
+__ZN3WTF7HashSetIyN7WebCore12LinkHashHashENS_10HashTraitsIyEEE3addERKy
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E6expandEv
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E6rehashEi
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E13allocateTableEi
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E15deallocateTableEPyi
+__ZN7WebCore4Page19visitedStateChangedEPNS_9PageGroupEy
+__ZN7WebCore16CSSStyleSelector15SelectorChecker19visitedStateChangedEy
+__ZNK3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E8containsIyNS_22IdentityHashTran
+__ZN7WebCore10ScrollView23setScrollbarsSuppressedEbb
+__ZN7WebCore10ScrollView31platformSetScrollbarsSuppressedEb
+__ZN7WebCore14DocumentLoaderD2Ev
 __ZNK7WebCore11HistoryItem17isCurrentDocumentEPNS_8DocumentE
-__ZN7WebCoreeqERKNS_6StringERKNS_16DeprecatedStringE
-__ZNK7WebCore12TextEncoding25backslashAsCurrencySymbolEv
-__ZN7WebCore30noExtendedTextEncodingNameUsedEv
+__ZN7WebCore5Frame18setJSStatusBarTextERKNS_6StringE
+__ZN7WebCore6Chrome16setStatusbarTextEPNS_5FrameERKNS_6StringE
+__ZNK7WebCore8Document31displayStringModifiedByEncodingERKNS_6StringE
+__ZN7WebCore5Frame25setJSDefaultStatusBarTextERKNS_6StringE
+__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm0EE14expandCapacityEm
+__ZN3WTF6VectorItLm0EE15reserveCapacityEm
+__ZNK7WebCore4KURL4pathEv
 __ZN7WebCore11FrameLoader13committedLoadEPNS_14DocumentLoaderEPKci
--[WebCoreFrameBridge receivedData:textEncodingName:]
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
 __ZN7WebCore11FrameLoader17receivedFirstDataEv
+__ZN3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3setERKS2_RKj
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZNK3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3getERKS2_
 __ZNK7WebCore14SecurityOrigin20isSecureTransitionToERKNS_4KURLE
+__ZN7WebCore22ScriptExecutionContext20stopActiveDOMObjectsEv
 __ZN7WebCore13ContainerNode10willRemoveEv
 __ZN7WebCore4Node10willRemoveEv
 __ZN7WebCore8Document6detachEv
+__ZN7WebCore8Document18clearAXObjectCacheEv
+__ZNK7WebCore8Document11topDocumentEv
+__ZNK7WebCore8Document12ownerElementEv
+__ZN7WebCore8Document26documentWillBecomeInactiveEv
 __ZN7WebCore13ContainerNode6detachEv
 __ZN7WebCore7Element6detachEv
 __ZN7WebCore7Element27cancelFocusAppearanceUpdateEv
 __ZN7WebCore4Node6detachEv
-__ZN7WebCore10RenderFlow7destroyEv
-__ZN7WebCore15RenderContainer23destroyLeftoverChildrenEv
-__ZNK7WebCore12RenderObject22documentBeingDestroyedEv
-__ZN7WebCore10RenderFlow15deleteLineBoxesEv
-__ZN7WebCore15RenderContainer7destroyEv
+__ZN7WebCore11RenderBlock7destroyEv
+__ZN7WebCore21RenderObjectChildList23destroyLeftoverChildrenEv
+__ZN7WebCore17RenderLineBoxList15deleteLineBoxesEPNS_11RenderArenaE
 __ZN7WebCore9RenderBox7destroyEv
-__ZN7WebCore11RenderLayer13clearClipRectEv
+__ZN7WebCore20RenderBoxModelObject7destroyEv
+__ZN7WebCore11RenderLayer14clearClipRectsEv
 __ZN7WebCore12RenderObject7destroyEv
 __ZNK7WebCore12EventHandler18autoscrollRendererEv
-__ZNK7WebCore12RenderObject19animationControllerEv
-__ZNK7WebCore5Frame19animationControllerEv
-__ZN7WebCore19AnimationController24cancelImplicitAnimationsEPNS_12RenderObjectE
+__ZN7WebCore19AnimationController16cancelAnimationsEPNS_12RenderObjectE
 __ZN7WebCore11RenderBlock11removeChildEPNS_12RenderObjectE
-__ZN7WebCore15RenderContainer11removeChildEPNS_12RenderObjectE
-__ZN7WebCore12RenderObject21removeFromObjectListsEv
-__ZN7WebCore15RenderContainer15removeChildNodeEPNS_12RenderObjectEb
+__ZN7WebCore12RenderObject11removeChildEPS0_
+__ZN7WebCore21RenderObjectChildList15removeChildNodeEPNS_12RenderObjectES2_b
 __ZN7WebCore9RenderBox20deleteLineBoxWrapperEv
+__ZN7WebCore20RenderBoxModelObject12destroyLayerEv
 __ZN7WebCore11RenderLayer7destroyEPNS_11RenderArenaE
+__ZN7WebCore11RenderLayerD0Ev
 __ZN7WebCore11RenderLayer16destroyScrollbarENS_20ScrollbarOrientationE
 __ZN7WebCore11RenderLayerdlEPvm
 __ZN7WebCore11RenderArena4freeEmPv
 __ZN7WebCore12RenderObject11arenaDeleteEPNS_11RenderArenaEPv
-__ZN7WebCore11RenderStyle11arenaDeleteEPNS_11RenderArenaE
+__ZN7WebCore11RenderBlockD0Ev
+__ZN7WebCore9RenderBoxD2Ev
+__ZN7WebCore20RenderBoxModelObjectD2Ev
+__ZN7WebCore12RenderObjectD2Ev
+__ZN7WebCore11RenderStyleD1Ev
 __ZN7WebCore11RenderStyleD2Ev
-__ZN7WebCore11RenderStyledlEPvm
 __ZN7WebCore12RenderObjectdlEPvm
+__ZN7WebCore10RenderViewD0Ev
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore11RenderBlockD2Ev
+__ZN7WebCore18StyleInheritedDataD1Ev
 __ZN7WebCore18StyleInheritedDataD2Ev
+__ZN7WebCore11RenderArenaD1Ev
 __ZN7WebCore11RenderArenaD2Ev
 __ZN7WebCore15FinishArenaPoolEPNS_9ArenaPoolE
-__ZN7WebCore13FreeArenaListEPNS_9ArenaPoolEPNS_5ArenaEb
+__ZN7WebCoreL13FreeArenaListEPNS_9ArenaPoolEPNS_5ArenaEb
 __ZN7WebCore8Document26removeFocusedNodeOfSubtreeEPNS_4NodeEb
 __ZN7WebCore19SelectionController5clearEv
-__ZN7WebCore19SelectionController12setSelectionERKNS_9SelectionEbbb
+__ZN7WebCore19SelectionController12setSelectionERKNS_16VisibleSelectionEbbb
 __ZN7WebCore13TypingCommand11closeTypingEPNS_11EditCommandE
 __ZN7WebCore13TypingCommand26isOpenForMoreTypingCommandEPKNS_11EditCommandE
 __ZN7WebCore5Frame16clearTypingStyleEv
 __ZN7WebCore9FrameView5clearEv
-__ZN7WebCore10ScrollView19setStaticBackgroundEb
+__ZN7WebCore10ScrollView18setCanBlitOnScrollEb
+__ZN7WebCore10ScrollView26platformSetCanBlitOnScrollEb
+__ZN7WebCore5Frame23setSelectionGranularityENS_15TextGranularityE
+__ZThn8_N7WebCore8Document14removedLastRefEv
 __ZN7WebCore8Document14removedLastRefEv
 __ZN7WebCore13ContainerNode17removeAllChildrenEv
-__ZN7WebCore13ContainerNode28addChildNodesToDeletionQueueERPNS_4NodeES3_PS0_
-__ZNK7WebCore13ContainerNode13hasChildNodesEv
+__ZN7WebCore28removeAllChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvPT0_
+__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_4NodeENS_13ContainerNodeEEEvRPT_S6_PT0_
+__ZN7WebCore15HTMLHtmlElementD0Ev
+__ZN7WebCore11HTMLElementD2Ev
+__ZN7WebCore13StyledElementD2Ev
 __ZN7WebCore13StyledElement22destroyInlineStyleDeclEv
-__ZN7WebCore11EventTargetD0Ev
-__ZN3WTF20deleteAllPairSecondsIPSt4pairINS_6VectorIN7WebCore14DocumentMarkerELm0EEENS2_INS3_7IntRectELm0EEEEKNS_7HashMapINS_6RefPtrINS3_4NodeEEES9_NS_7PtrHashISD_EENS_10HashTraitsISD_EENSG_IS9_EEEEEEvRT0_
-__ZN7WebCore12HTMLDocumentD1Ev
-__ZN7WebCore14XMLHttpRequest14detachRequestsEPNS_8DocumentE
-__ZN3KJS17ScriptInterpreter28forgetAllDOMNodesForDocumentEPN7WebCore8DocumentE
-__ZN3KJS19domNodesPerDocumentEv
+__ZN7WebCore7ElementD2Ev
+__ZN7WebCore13ContainerNodeD2Ev
+__ZN7WebCore4NodeD2Ev
+__ZN7WebCore11EventTargetD2Ev
+__ZN3WTF20deleteAllPairSecondsIPSt4pairINS_6VectorIN7WebCore14DocumentMarkerELm0EEENS2_INS3_7IntRectELm0EEEEKNS_7HashMapINS_6Re
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_17HTMLCanvasElementEEEENS_18PairFirstExtractorIS7_EENS1_10StringH
+__ZN7WebCore12HTMLDocumentD0Ev
+__ZN7WebCore8DocumentD2Ev
+__ZN7WebCore28forgetAllDOMNodesForDocumentEPNS_8DocumentE
+__ZN7WebCore16CSSStyleSelectorD1Ev
 __ZN7WebCore16CSSStyleSelectorD2Ev
+__ZN7WebCore19MediaQueryEvaluatorD1Ev
 __ZN7WebCore19MediaQueryEvaluatorD2Ev
+__ZN7WebCore10CSSRuleSetD1Ev
 __ZN7WebCore10CSSRuleSetD2Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CSSRuleDataListEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTraitsIS6_EENS9_IS3_EEEEEEvRT0_
-__ZN7WebCore15CSSFontSelectorD1Ev
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE6shrinkEm
-__ZN7WebCore15BackgroundLayerD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CSSRuleDataListEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTr
+__ZN3WTF15deleteAllValuesIPN7WebCore16MediaQueryResultELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorIS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN7WebCore15CSSFontSelectorD0Ev
+__ZN7WebCore9FontCache12removeClientEPNS_12FontSelectorE
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN3WTF20deleteAllPairSecondsIPNS_6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EEEKNS_7HashMapINS3_6StringES7_NS3_15CaseFold
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE6shrinkEm
+__ZN7WebCore9FillLayerD1Ev
+__ZN7WebCore9FillLayerD2Ev
+__ZN7WebCore9DocLoaderD1Ev
 __ZN7WebCore9DocLoaderD2Ev
+__ZN7WebCore9DocLoader13clearPreloadsEv
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE14deleteAllNodesEv
 __ZN7WebCore5Cache15removeDocLoaderEPNS_9DocLoaderE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore14HTMLCollection14CollectionInfoEKNS_7HashMapIPNS1_16AtomicStringImplES4_NS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSA_IS4_EEEEEEvRT0_
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CollectionCacheEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTr
 __ZN7WebCore14StyleSheetList17documentDestroyedEv
-__ZN7WebCore14HTMLCollection14CollectionInfoD2Ev
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore31HTMLFormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E19removeAndInvalidateEPS6_
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTabl
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CollectionCacheEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZN7WebCore15CollectionCacheD1Ev
+__ZN7WebCore15CollectionCacheD2Ev
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore7ElementEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsI
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore14StyleSheetListD1Ev
 __ZN7WebCore14StyleSheetListD2Ev
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableE
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore22ScriptExecutionContextD2Ev
+__ZN3WTF9HashTableIPN7WebCore11MessagePortES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
 __ZN7WebCore19TextResourceDecoderD1Ev
-__ZN7WebCoreplERKNS_16DeprecatedStringES2_
-__ZNK3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3getERKS2_
-__ZN7WebCore16CSSStyleSelector13setEncodedURLERKNS_4KURLE
-__ZN7WebCore4KURL8setQueryERKNS_16DeprecatedStringE
-__ZNK7WebCore16DeprecatedString7findRevEci
-__ZN7WebCore16DeprecatedString8truncateEj
-__ZN7WebCore4KURL7setPathERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL13encode_stringERKNS_16DeprecatedStringE
-__ZNK7WebCore16DeprecatedString4utf8ERi
-__ZNK7WebCore12TextEncoding6encodeEPKtmb
-__ZN7WebCore7CStringC2EPKc
-__ZN7WebCore7CString4initEPKcj
-__ZNK7WebCore7CString17deprecatedCStringEv
-__ZNK7WebCore7CString6lengthEv
-__ZN7WebCore17DeprecatedCStringC2EPKcj
-__ZN7WebCore9ArrayImplC2Emm
-__ZN7WebCore9ArrayImpl12ArrayPrivateC2Emm
-__ZN7WebCore17DeprecatedCString6resizeEj
-__ZN7WebCore9ArrayImpl6resizeEm
-__ZNK7WebCore9ArrayImpl4dataEv
-__ZNK7WebCore17DeprecatedCString6lengthEv
-__ZN7WebCore9ArrayImplD2Ev
-__ZN7WebCore9ArrayImpl12ArrayPrivateD2Ev
-__ZNK7WebCore8Document35shouldBeAllowedToLoadLocalResourcesEv
-__ZN7WebCore11FrameLoader21shouldTreatURLAsLocalERKNS_6StringE
+__ZN7WebCore19TextResourceDecoderD2Ev
 __ZNK7WebCore11HistoryItem13documentStateEv
 __ZN7WebCore8Document26setStateForNewFormElementsERKN3WTF6VectorINS_6StringELm0EEE
 __ZN7WebCore11FrameLoader21dispatchDidCommitLoadEv
-__ZN7WebCore15BackForwardList11currentItemEv
-__ZNK7WebCore11HistoryItem20getTransientPropertyERKNS_6StringE
+__ZN7WebCore4Page27setJavaScriptURLsAreAllowedEb
 __ZN7WebCore15FocusController9setActiveEb
-__ZN7WebCore15FocusController18focusedOrMainFrameEv
-__ZN7WebCore19SelectionController10setFocusedEb
+__ZN7WebCore19SelectionController21pageActivationChangedEv
+__ZN7WebCore5Frame20setSelectionFromNoneEv
+__ZNK7WebCore5Frame17isContentEditableEv
+__ZNK7WebCore6Editor16clientIsEditableEv
+__ZNK7WebCore8Document12inDesignModeEv
+__ZN7WebCore5Frame22clearCaretRectIfNeededEv
+__ZN7WebCore19SelectionController19invalidateCaretRectEv
+__ZN7WebCore5Frame22selectionLayoutChangedEv
+__ZN7WebCore19SelectionController18recomputeCaretRectEv
+__ZNK7WebCore19SelectionController14localCaretRectEv
+__ZN7WebCore19SelectionController6layoutEv
+__ZNK7WebCore19SelectionController26absoluteBoundsForLocalRectERKNS_7IntRectE
+__ZNK7WebCore19SelectionController13caretRendererEv
+__ZN7WebCore10RenderView14clearSelectionEv
+__ZN7WebCore10RenderView20repaintViewRectangleERKNS_7IntRectEb
+__ZN7WebCore10RenderView12setSelectionEPNS_12RenderObjectEiS2_iNS0_20SelectionRepaintModeE
 __ZNK7WebCore6Editor7canEditEv
-__ZNK7WebCore9Selection17isContentEditableEv
+__ZNK7WebCore16VisibleSelection17isContentEditableEv
 __ZN7WebCore18isEditablePositionERKNS_8PositionE
 __ZN7WebCore19InspectorController13didCommitLoadEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader29dispatchWindowObjectAvailableEv
-__ZN7WebCore8KJSProxyC2EPNS_5FrameE
-__ZN7WebCore9DocLoader14setCachePolicyENS_11CachePolicyE
-__ZNK7WebCore20ResourceResponseBase15httpHeaderFieldERKNS_6StringE
 __ZN7WebCore16parseHTTPRefreshERKNS_6StringEbRdRS0_
--[WebCoreFrameBridge addData:]
 __ZN7WebCore8Document24setShouldCreateRenderersEb
 __ZN7WebCore11FrameLoader7addDataEPKci
+__ZN7WebCore19TextResourceDecoder11setEncodingERKNS_12TextEncodingENS0_14EncodingSourceE
 __ZNK7WebCore12TextEncoding10isJapaneseEv
-__ZN7WebCore15addEncodingNameERN3WTF7HashSetIPKcNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEES3_
-__ZN3WTF7HashSetIPKcNS_7PtrHashIS2_EENS_10HashTraitsIS2_EEE3addERKS2_
-__ZNK3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E8containsIiNS_22IdentityHashTranslatorIiiS4_EEEEbRKT_
-__ZN7WebCore12HTMLDocument18determineParseModeERKNS_6StringE
-__ZN7WebCore10StringImpl4findEti
-__ZNK7WebCore6StringixEj
-__ZN7WebCore14containsStringEPKcRKNS_6StringEi
-__ZNK7WebCore6String9substringEjj
-__ZN7WebCore10StringImpl9substringEjj
-__ZN7WebCore16parseDocTypePartERKNS_6StringEi
-__ZNK7WebCore6String15stripWhiteSpaceEv
-__ZN7WebCore10StringImpl15stripWhiteSpaceEv
-__ZN7WebCore12DocumentTypeC2EPNS_8DocumentERKNS_6StringES5_S5_
-__ZN7WebCore8Document10setDocTypeEN3WTF10PassRefPtrINS_12DocumentTypeEEE
-__ZNK7WebCore6String6latin1Ev
-__ZN7WebCore15TextCodecLatin16encodeEPKtmb
-__Z16findDoctypeEntryPKcj
+__ZNK7WebCore19TextResourceDecoder16shouldAutoDetectEv
+__ZN7WebCoreL15newTextCodecICUERKNS_12TextEncodingEPKv
+__ZN7WebCore12TextCodecICUC1ERKNS_12TextEncodingE
+__ZN7WebCore12TextCodecICUC2ERKNS_12TextEncodingE
+__ZN7WebCore12TextCodecICU6decodeEPKcmbbRb
+__ZNK7WebCore12TextCodecICU18createICUConverterEv
+__ZN7WebCoreL18cachedConverterICUEv
+__ZN7WebCore12TextCodecICU14decodeToBufferEPtS1_RPKcS3_PibR10UErrorCode
 __ZNK7WebCore12TextEncoding18usesVisualOrderingEv
-__ZNK7WebCore11RenderStyle21contentDataEquivalentEPKS0_
+__ZNK7WebCore25StyleRareNonInheritedData21contentDataEquivalentERKS0_
 __ZNK7WebCore11RenderStyleeqERKS0_
-__ZNK7WebCore11RenderStyle17inheritedNotEqualEPS0_
-__ZNK7WebCore11RenderStyle4diffEPKS0_
+__ZNK7WebCore18StyleInheritedDataeqERKS0_
 __ZNK7WebCore4FonteqERKS0_
 __ZN7WebCore13HTMLTokenizer5writeERKNS_15SegmentedStringEb
+__ZN7WebCore15SegmentedStringC1ERKS0_
 __ZN7WebCore15SegmentedStringC2ERKS0_
-__ZN7WebCore23DeprecatedValueListImplC2ERKS0_
 __ZN7WebCore13HTMLTokenizer6setSrcERKNS_15SegmentedStringE
 __ZN7WebCore15SegmentedStringaSERKS0_
-__ZN7WebCore23DeprecatedValueListImplaSERKS0_
 __ZN7WebCore13HTMLTokenizer8parseTagERNS_15SegmentedStringENS0_5StateE
-__ZNK7WebCore15SegmentedString6lengthEv
-__ZN7WebCore12AtomicString3addEPKt
-__ZN7WebCore5Token12addAttributeEPNS_8DocumentERNS_12AtomicStringERKS3_b
-__ZN7WebCore18NamedMappedAttrMapC2EPNS_7ElementE
-__ZNK7WebCore12NamedAttrMap16getAttributeItemERKNS_13QualifiedNameE
-__ZN7WebCore12NamedAttrMap12addAttributeEN3WTF10PassRefPtrINS_9AttributeEEE
-__ZN7WebCore10StringImpl29createStrippingNullCharactersEPKtj
+__ZN7WebCore13HTMLTokenizer12parseDoctypeERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore13HTMLTokenizer19processDoctypeTokenEv
+__ZN7WebCore10HTMLParser17parseDoctypeTokenEPNS_12DoctypeTokenE
+__ZN7WebCore12DocumentTypeC1EPNS_8DocumentERKNS_6StringES5_S5_
+__ZN7WebCore12DocumentTypeC2EPNS_8DocumentERKNS_6StringES5_S5_
+__ZNK7WebCore4Node13isCommentNodeEv
+__ZNK7WebCore12DocumentType8nodeTypeEv
+__ZN7WebCore12DocumentType20insertedIntoDocumentEv
+__ZN7WebCore8Document10setDocTypeEN3WTF10PassRefPtrINS_12DocumentTypeEEE
+__ZN7WebCore4Node11setDocumentEPNS_8DocumentE
+__ZN7WebCore12HTMLDocument18determineParseModeEv
+__ZNK7WebCore6String6latin1Ev
+__ZNK7WebCore12TextEncoding6encodeEPKtmNS_19UnencodableHandlingE
+__ZN7WebCore15TextCodecLatin16encodeEPKtmNS_19UnencodableHandlingE
+__ZNK7WebCore7CString6lengthEv
+__ZN7WebCore8Document19updateStyleSelectorEv
+__ZN7WebCore8Document19recalcStyleSelectorEv
+__ZNK7WebCore11RenderStyle17inheritedNotEqualEPS0_
+__ZNK7WebCore11RenderStyle4diffEPKS0_Rj
+__ZNK7WebCore19TransformOperationseqERKS0_
+__ZN7WebCore4Node11recalcStyleENS0_11StyleChangeE
 __ZN7WebCore10HTMLParser10parseTokenEPNS_5TokenE
+__ZNK7WebCore4Node16virtualLocalNameEv
 __ZN7WebCore4Text21createWithLengthLimitEPNS_8DocumentERKNS_6StringERjj
+__ZN7WebCore4TextC1EPNS_8DocumentERKNS_6StringE
 __ZN7WebCore4TextC2EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore13CharacterDataC2EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore4Node9localNameEv
+__ZN7WebCore13CharacterDataC2EPNS_8DocumentERKNS_6StringEb
 __ZNK7WebCore4Node13isHTMLElementEv
-__ZNK7WebCore4Node13isCommentNodeEv
+__ZNK7WebCore4Text8nodeTypeEv
 __ZN7WebCore10HTMLParser11handleErrorEPNS_4NodeEbRKNS_12AtomicStringEi
-__ZNK7WebCore4Text10isTextNodeEv
 __ZNK7WebCore13CharacterData22containsOnlyWhitespaceEv
 __ZN7WebCore10StringImpl22containsOnlyWhitespaceEv
 __ZN7WebCore10TreeSharedINS_4NodeEE14removedLastRefEv
-__ZN7WebCore4TextD1Ev
-__ZN7WebCore12NamedAttrMap15clearAttributesEv
-__ZN7WebCore12AtomicString6removeEPNS_10StringImplE
+__ZThn8_N7WebCore4TextD0Ev
+__ZN7WebCore4TextD0Ev
+__ZN7WebCore13CharacterDataD2Ev
+__ZN7WebCore13HTMLTokenizer12parseCommentERNS_15SegmentedStringENS0_5StateE
+__ZNK7WebCore15SegmentedString6lengthEv
+__ZN7WebCore13HTMLTokenizer19enlargeScriptBufferEi
+__ZN7WebCore13HTMLTokenizer14processListingENS_15SegmentedStringENS0_5StateE
+__ZN7WebCore15SegmentedString15advanceSlowCaseEv
+__ZN7WebCore15SegmentedString16advanceSubstringEv
 __ZN7WebCore10HTMLParser7getNodeEPNS_5TokenE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSF_ISC_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiMN7WebCore10HTMLParserEFbPNS2_5TokenERNS_6RefPtrINS2_4NodeEEEEENS_18PairFirstExtractorISC_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSI_ISB_EEEESJ_E3addIPNS2_16AtomicStringImplESB_NS_17HashMapTranslatorILb1ES1_ISP_SB_ENS_18PairBaseHashTraitsINSI_ISP_EESK_EESL_NS_7PtrHashISP_EEEEEES1_INS_17HashTableIteratorIiSC_SE_SG_SL_SJ_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiMN7WebCore10HTMLParserEFbPNS2_5TokenERNS_6RefPtrINS2_4NodeEEEEENS_18PairFirstExtractorISC_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSI_ISB_EEEESJ_E6expandEv
-__ZN3WTF9HashTableIiSt4pairIiMN7WebCore10HTMLParserEFbPNS2_5TokenERNS_6RefPtrINS2_4NodeEEEEENS_18PairFirstExtractorISC_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSI_ISB_EEEESJ_E4findIiNS_22IdentityHashTranslatorIiSC_SG_EEEENS_17HashTableIteratorIiSC_SE_SG_SL_SJ_EERKT_
-__ZN7WebCore18HTMLElementFactory17createHTMLElementERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_11HTMLElementEEERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEbE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_12AtomicStringEPNS1_8DocumentEPNS1_15HTMLFormElementEbENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSI_ISF_EEE3getERKS3_
-__ZN7WebCore15htmlConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore7Element15setAttributeMapEPNS_12NamedAttrMapE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10Ha
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_MNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEEENS_18PairF
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10H
+__ZN7WebCore10HTMLParser23commentCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore7CommentC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore7CommentC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore7Comment13isCommentNodeEv
+__ZN7WebCore4Node21finishParsingChildrenEv
+__ZN7WebCore10HTMLParser15processCloseTagEPNS_5TokenE
+__ZN7WebCore12AtomicString3addEPKt
+__ZN7WebCore10StringImplC1EPKtjj
+__ZN7WebCore10StringImplC2EPKtjj
+__ZN7WebCore5Token12addAttributeERNS_12AtomicStringERKS1_b
+__ZNK7WebCore12NamedNodeMap16getAttributeItemERKNS_13QualifiedNameE
+__ZN7WebCore12NamedNodeMap12addAttributeEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14shrinkCapacityEm
+__ZN7WebCore18HTMLElementFactory17createHTMLElementERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCoreL6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_11HTMLElementEEES2_PNS_8DocumentEPNS_15HTMLFormElementEbE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_1
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8Do
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_
+__ZN7WebCoreL15htmlConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore7Element15setAttributeMapEN3WTF10PassRefPtrINS_12NamedNodeMapEEE
+__ZN7WebCore13StyledElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore15MappedAttribute17isMappedAttributeEv
+__ZNK7WebCore11HTMLElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZNK7WebCore13StyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore11HTMLElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore4Node13ownerDocumentEv
+__ZN7WebCore16CSSStyleSelector23hasSelectorForAttributeERKNS_12AtomicStringE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN7WebCore7Element16attributeChangedEPNS_9AttributeEb
+__ZNK7WebCore8Document13axObjectCacheEv
+__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeE
+__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore13StyledElement16createMappedDeclEPNS_15MappedAttributeE
+__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleE
+__ZN7WebCore8Document12elementSheetEv
+__ZN7WebCore13CSSStyleSheetC1EPNS_4NodeERKNS_6StringES5_
+__ZN7WebCore13CSSStyleSheetC2EPNS_4NodeERKNS_6StringES5_
+__ZN7WebCore10StyleSheetC2EPNS_4NodeERKNS_6StringE
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbb
+__ZN7WebCore9CSSParser10parseValueEPNS_26CSSMutableStyleDeclarationEiRKNS_6StringEb
+__ZN7WebCore9StyleBase10stylesheetEv
+__ZNK7WebCore9StyleBase12isStyleSheetEv
+__ZNK7WebCore10StyleSheet12isStyleSheetEv
+__ZN7WebCore26CSSMutableStyleDeclaration19addParsedPropertiesEPKPKNS_11CSSPropertyEi
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE15reserveCapacityEm
+__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyPriorityEi
+__ZNK7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
+__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEibb
+__ZN7WebCore26CSSMutableStyleDeclaration23removeShorthandPropertyEib
+__ZN7WebCore19longhandForPropertyEi
+__ZN7WebCoreL16initShorthandMapERN3WTF7HashMapIiNS_19CSSPropertyLonghandENS0_7IntHashIjEENS0_10HashTraitsIiEENS5_IS2_EEEE
+__ZN3WTF7HashMapIiN7WebCore19CSSPropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiN7WebCore19CSSPropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS
+__ZNK3WTF7HashMapIiN7WebCore19CSSPropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
+__ZN7WebCore26CSSMutableStyleDeclaration19setNeedsStyleRecalcEv
+__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEii
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiibb
+__ZN7WebCore26CSSMutableStyleDeclaration19setPropertyInternalERKNS_11CSSPropertyEPS1_
+__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeEPNS_29CSSMappedAttributeDeclaratio
+__ZN3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttri
+__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_PNS1_29CSSMappedAttributeDeclarationEENS_18PairFirstExtractorIS6_EE
+__ZN7WebCore19MappedAttributeHash4hashERKNS_18MappedAttributeKeyE
 __ZNK7WebCore15HTMLHtmlElement17endTagRequirementEv
+__ZNK7WebCore14DocumentLoader28mainResourceApplicationCacheEv
 __ZN7WebCore11HTMLElement12childAllowedEPNS_4NodeE
 __ZN7WebCore4Node12childAllowedEPS0_
-__ZNK7WebCore4Text8nodeTypeEv
 __ZN7WebCore7Element16childTypeAllowedENS_4Node8NodeTypeE
-__ZNK7WebCore4Node13isElementNodeEv
 __ZN7WebCore15HTMLHtmlElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore10HTMLParser20headCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore15HTMLHeadElementC2EPNS_8DocumentE
+__ZN7WebCore15HTMLHeadElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLHeadElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore15HTMLHeadElement17endTagRequirementEv
 __ZN7WebCore10HTMLParser8popBlockERKNS_12AtomicStringEb
 __ZNK7WebCore15HTMLHeadElement11tagPriorityEv
 __ZNK7WebCore7Element8nodeTypeEv
-__ZN7WebCore7Element15childrenChangedEb
-__ZN7WebCore7Element20beginParsingChildrenEv
+__ZN7WebCore7Element15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore4Node22nonRendererRenderStyleEv
+__ZN7WebCoreL20loadFullDefaultStyleEv
+__ZN7WebCore13CSSStyleSheetD0Ev
+__ZN7WebCore10StyleSheetD2Ev
+__ZN7WebCore12CSSStyleRuleD0Ev
+__ZN7WebCore15CSSSelectorListD1Ev
+__ZN7WebCore15CSSSelectorListD2Ev
+__ZN7WebCore26CSSMutableStyleDeclarationD0Ev
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE6shrinkEm
+__ZN7WebCore12CSSValueListD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE6shrinkEm
+__ZN7WebCore11CSSSelectorD2Ev
+__ZN7WebCore5themeEv
+__ZN7WebCore14RenderThemeMacC1Ev
+__ZN7WebCore14RenderThemeMacC2Ev
+__ZN7WebCore11RenderThemeC2Ev
+__ZN7WebCore13platformThemeEv
+-[WebCoreRenderThemeNotificationObserver initWithTheme:]
+__ZN7WebCore11RenderTheme22extraDefaultStyleSheetEv
+__ZN7WebCore13CSSStyleSheet12addNamespaceEPNS_9CSSParserERKNS_12AtomicStringES5_
+__ZN7WebCore9CSSParser12parseContentEib
+__ZN7WebCore6StringC1EPKtj
+__ZN7WebCore6StringC2EPKtj
+__ZN7WebCore17CSSPrimitiveValue6createERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore9CSSParser15parseFontWeightEb
+__ZN7WebCore11CSSSelector12setAttributeERKNS_13QualifiedNameE
+__ZN7WebCore9CSSParser10parseColorEPNS_14CSSParserValueE
+__ZN7WebCore9CSSParser19parseColorFromValueEPNS_14CSSParserValueERjb
+__ZN7WebCore9CSSParser10parseColorERKNS_6StringERjb
+__ZN7WebCore17CSSPrimitiveValue11createColorEj
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZN7WebCore17CSSPrimitiveValueC1Ej
+__ZN7WebCore17CSSPrimitiveValueC2Ej
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3addERKjRKS4_
+__ZN7WebCore5Color13parseHexColorERKNS_6StringERj
+__ZN7WebCore9CSSParser17parseFillPropertyEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
+__ZN7WebCore9CSSParser14parseFillImageERN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore13CSSImageValueC1Ev
+__ZN7WebCore13CSSImageValueC2Ev
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4PairEEE
+__ZN7WebCore9CSSParser14parseFontStyleEb
+__ZN7WebCore9CSSParser15parseFontFamilyEv
+__ZN7WebCoreL9printEvalEv
+__ZN7WebCore11RenderTheme21extraQuirksStyleSheetEv
+__ZN7WebCore9CSSParser16parseFontVariantEb
+__ZN7WebCore11CSSSelector17setSimpleSelectorEPS0_
 __ZN7WebCore15HTMLHeadElement12childAllowedEPNS_4NodeE
-__ZN7WebCore4Node16insertedIntoTreeEb
 __ZN7WebCore4Text6attachEv
-__ZN7WebCore4Node21finishParsingChildrenEv
-__ZN7WebCore16titleConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLTitleElementC2EPNS_8DocumentE
+__ZN7WebCoreL16titleConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLTitleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLTitleElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore11HTMLElement17endTagRequirementEv
 __ZNK7WebCore11HTMLElement11tagPriorityEv
-__ZNK7WebCore4Node10isTextNodeEv
 __ZN7WebCore15HTMLHeadElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore16HTMLTitleElement20insertedIntoDocumentEv
 __ZN7WebCore8Document8setTitleERKNS_6StringEPNS_7ElementE
 __ZN7WebCore13HTMLTokenizer12parseSpecialERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore13HTMLTokenizer19enlargeScriptBufferEi
-__ZN7WebCore13HTMLTokenizer14processListingENS_15SegmentedStringENS0_5StateE
-__ZN7WebCore15SegmentedString15advanceSlowCaseEv
-__ZN7WebCore15SegmentedString16advanceSubstringEv
 __ZN7WebCore16HTMLTitleElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore16HTMLTitleElement15childrenChangedEb
+__ZN7WebCore16HTMLTitleElement15childrenChangedEbPNS_4NodeES2_i
 __ZNK7WebCore13CharacterData9nodeValueEv
 __ZN7WebCore8Document11updateTitleEv
 __ZN7WebCore11FrameLoader8setTitleERKNS_6StringE
 __ZN7WebCore14DocumentLoader8setTitleERKNS_6StringE
+__ZNK7WebCore8Document31displayBufferModifiedByEncodingEPtj
 __ZN7WebCore11FrameLoader15willChangeTitleEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader14didChangeTitleEPNS_14DocumentLoaderE
-__ZNK7WebCore14DocumentLoader11isCommittedEv
 __ZN7WebCore11HistoryItem8setTitleERKNS_6StringE
-__ZN7WebCore10HTMLParser15processCloseTagEPNS_5TokenE
 __ZN7WebCore10HTMLParser25isAffectedByResidualStyleERKNS_12AtomicStringE
 __ZN3WTF7HashSetIPN7WebCore16AtomicStringImplENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
 __ZN7WebCore10HTMLParser23reopenResidualStyleTagsEPNS_13HTMLStackElemEPNS_4NodeE
-__ZN7WebCore16styleConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLStyleElementC2EPNS_8DocumentE
+__ZN7WebCoreL15metaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLMetaElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMetaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMetaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLMetaElement7processEv
+__ZNK7WebCore15HTMLMetaElement17endTagRequirementEv
+__ZNK7WebCore15HTMLMetaElement11tagPriorityEv
+__ZN7WebCore15HTMLMetaElement20insertedIntoDocumentEv
+__ZN7WebCore8Document16processHttpEquivERKNS_6StringES3_
+__ZN7WebCoreL15linkConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLLinkElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15HTMLLinkElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15HTMLLinkElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLLinkElement20tokenizeRelAttributeERKNS_12AtomicStringERbS4_S4_S4_
+__ZN7WebCore15HTMLLinkElement7processEv
+__ZN7WebCore8parseURLERKNS_6StringE
+__ZNK7WebCore8Document11completeURLERKNS_6StringE
+__ZN7WebCore4KURLC1ERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore4KURLC2ERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZNK7WebCore12TextEncoding25encodingForFormSubmissionEv
+__ZNK7WebCore12TextEncoding22isNonByteBasedEncodingEv
+__ZN7WebCore25UTF16LittleEndianEncodingEv
+__ZN7WebCore22UTF16BigEndianEncodingEv
+__ZNK7WebCore12TextEncoding14isUTF7EncodingEv
+__ZNK7WebCore15HTMLLinkElement17endTagRequirementEv
+__ZNK7WebCore15HTMLLinkElement11tagPriorityEv
+__ZN7WebCore15HTMLLinkElement20insertedIntoDocumentEv
+__ZN7WebCore8Document26addStyleSheetCandidateNodeEPNS_4NodeEb
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore4NodeEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore8Document10setIconURLERKNS_6StringES3_
+__ZN7WebCore15HTMLLinkElement21finishParsingChildrenEv
+__ZN7WebCore10StringImpl7replaceEtt
+__ZNK7WebCore6String5splitEtRN3WTF6VectorIS0_Lm0EEE
+__ZNK7WebCore6String5splitERKS0_bRN3WTF6VectorIS0_Lm0EEE
+__ZN7WebCore4Node23compareDocumentPositionEPS0_
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE6shrinkEm
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeERKS3_S8_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeENS_19ListHashSetIteratorIS3_S5_EERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE16insertNodeBeforeEPNS_15ListHashSetNodeIS3_EES9_
+__ZN7WebCoreL16styleConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16HTMLStyleElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore12StyleElementC2Ev
-__ZNK7WebCore12NamedAttrMap6lengthEv
-__ZN7WebCore13StyledElement16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore11HTMLElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZNK7WebCore13StyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore16HTMLStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11HTMLElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore4Node13ownerDocumentEv
-__ZN7WebCore16CSSStyleSelector23hasSelectorForAttributeERKNS_12AtomicStringE
 __ZNK7WebCore16HTMLStyleElement17endTagRequirementEv
 __ZNK7WebCore16HTMLStyleElement11tagPriorityEv
 __ZN7WebCore16HTMLStyleElement20insertedIntoDocumentEv
-__ZN7WebCore13HTMLTokenizer13enlargeBufferEi
 __ZN7WebCore16HTMLStyleElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore16HTMLStyleElement15childrenChangedEb
+__ZN7WebCore16HTMLStyleElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore16HTMLStyleElement21finishParsingChildrenEv
 __ZN7WebCore12StyleElement7processEPNS_7ElementE
 __ZN7WebCore12StyleElement11createSheetEPNS_7ElementERKNS_6StringE
-__ZThn68_NK7WebCore16HTMLStyleElement4typeEv
+__ZThn112_NK7WebCore16HTMLStyleElement4typeEv
 __ZNK7WebCore16HTMLStyleElement4typeEv
-__ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
-__ZNK7WebCore12AtomicString16deprecatedStringEv
-__ZN7WebCore12AtomicStringC2ERKNS_16DeprecatedStringE
-__ZThn68_NK7WebCore16HTMLStyleElement5mediaEv
+__ZThn112_NK7WebCore16HTMLStyleElement5mediaEv
 __ZNK7WebCore16HTMLStyleElement5mediaEv
+__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetERKNS_6StringEb
 __ZN7WebCore9MediaListC2EPNS_13CSSStyleSheetERKNS_6StringEb
 __ZN7WebCore9MediaList12setMediaTextERKNS_6StringERi
-__ZNK7WebCore6String5splitEtb
-__ZNK7WebCore6String5splitERKS0_b
+__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetEb
+__ZN7WebCore9MediaListC2EPNS_13CSSStyleSheetEb
+__ZNK7WebCore6String15stripWhiteSpaceEv
+__ZN7WebCore10StringImpl15stripWhiteSpaceEv
+__ZN7WebCore9CSSParser15parseMediaQueryEPNS_9MediaListERKNS_6StringE
+__ZN7WebCore9CSSParser31createFloatingMediaQueryExpListEv
+__ZN7WebCore9CSSParser29sinkFloatingMediaQueryExpListEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore9CSSParser24createFloatingMediaQueryENS_10MediaQuery10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0
+__ZN7WebCore10MediaQueryC1ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore10MediaQueryC2ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore9CSSParser22sinkFloatingMediaQueryEPNS_10MediaQueryE
+__ZN7WebCore9MediaList16appendMediaQueryEPNS_10MediaQueryE
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE15reserveCapacityEm
 __ZN3WTF15deleteAllValuesIPN7WebCore10MediaQueryELm0EEEvRKNS_6VectorIT_XT0_EEE
 __ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EEaSERKS4_
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE6shrinkEm
+__ZN7WebCore9MediaList13notifyChangedEv
 __ZN7WebCore9MediaListD0Ev
-__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_9MediaListE
-__ZThn68_N7WebCore16HTMLStyleElement10setLoadingEb
+__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_9MediaListEPNS_16CSSStyleSelectorE
+__ZNK7WebCore19MediaQueryEvaluator14mediaTypeMatchERKNS_6StringE
+__ZN7WebCoreL15applyRestrictorENS_10MediaQuery10RestrictorEb
+__ZThn112_N7WebCore16HTMLStyleElement10setLoadingEb
 __ZN7WebCore16HTMLStyleElement10setLoadingEb
-__ZNK7WebCore8Document13inputEncodingEv
-__ZN7WebCore13CSSStyleSheetC2EPNS_4NodeERKNS_6StringES5_
-__ZN7WebCore10StyleSheetC2EPNS_4NodeERKNS_6StringE
-__ZN7WebCore9CSSParser24parseBackgroundShorthandEb
-__ZN7WebCore9CSSParser23parseBackgroundPositionERN3WTF6RefPtrINS_8CSSValueEEES5_
-__ZN7WebCore9CSSParser25parseBackgroundPositionXYERbS1_
-__ZN7WebCore9CSSParser20parseBackgroundColorEv
-__ZN7WebCore9CSSParser18addBackgroundValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
-__ZN7WebCore9CSSParser9parseFontEb
-__ZN7WebCore10StyleSheet8setMediaEPNS_9MediaListE
+__ZNK7WebCore8Document8encodingEv
+__ZNK7WebCore12TextEncoding7domNameEv
+__ZN7WebCore9CSSParser15createMediaListEv
+__ZN7WebCore9CSSParser16createImportRuleERKNS_15CSSParserStringEPNS_9MediaListE
+__ZN7WebCore13CSSImportRuleC1EPNS_13CSSStyleSheetERKNS_6StringEN3WTF10PassRefPtrINS_9MediaListEEE
+__ZN7WebCore13CSSImportRuleC2EPNS_13CSSStyleSheetERKNS_6StringEN3WTF10PassRefPtrINS_9MediaListEEE
+__ZN7WebCore13CSSImportRule18insertedIntoParentEv
+__ZNK7WebCore7CSSRule16parentStyleSheetEv
+__ZN7WebCore9DocLoader20requestCSSStyleSheetERKNS_6StringES3_
+__ZN7WebCore9DocLoader15requestResourceENS_14CachedResource4TypeERKNS_6StringES5_b
+__ZN7WebCore9DocLoader10canRequestENS_14CachedResource4TypeERKNS_4KURLE
+__ZN7WebCore9DocLoader14checkForReloadERKNS_4KURLE
+__ZN7WebCore5Cache14resourceForURLERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN7WebCore5Cache15requestResourceEPNS_9DocLoaderENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringEb
+__ZN7WebCore11FrameLoader21restrictAccessToLocalEv
+__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringEPKNS_8DocumentE
+__ZN7WebCore11FrameLoader21shouldTreatURLAsLocalERKNS_6StringE
+__ZN7WebCoreL14createResourceENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringE
+__ZN7WebCore19CachedCSSStyleSheetC1ERKNS_6StringES3_
+__ZN7WebCore19CachedCSSStyleSheetC2ERKNS_6StringES3_
+__ZN7WebCore14CachedResourceC2ERKNS_6StringENS0_4TypeE
+__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderE
+__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderEbbb
+__ZN7WebCore6Loader4loadEPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore7RequestC1EPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore7RequestC2EPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore14CachedResource10setRequestEPNS_7RequestE
+__ZN7WebCore4KURLC1ERKNS_6StringE
+__ZN7WebCore4KURLC2ERKNS_6StringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_6Loader4HostENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERKS3_
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_6Loader4HostENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_6Loader4HostEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_
+__ZNK7WebCore6Loader17determinePriorityEPKNS_14CachedResourceE
+__ZN7WebCore6Loader4Host10addRequestEPNS_7RequestENS0_8PriorityE
+__ZN3WTF5DequeIPN7WebCore7RequestEE14expandCapacityEv
+__ZN7WebCore9DocLoader21incrementRequestCountEv
+__ZN7WebCore6Loader4Host20servePendingRequestsENS0_8PriorityE
+__ZN7WebCore6Loader4Host20servePendingRequestsERN3WTF5DequeIPNS_7RequestEEERb
+__ZN7WebCore17SubresourceLoader6createEPNS_5FrameEPNS_23SubresourceLoaderClientERKNS_15ResourceRequestEbbb
+__ZNK7WebCore11FrameLoader16outgoingReferrerEv
+__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
+__ZN7WebCore10protocolIsERKNS_6StringEPKc
+__ZNK7WebCore11FrameLoader14outgoingOriginEv
+__ZNK7WebCore14SecurityOrigin8toStringEv
+__ZNK7WebCore19ResourceRequestBase13isConditionalEv
+__ZNK3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS1_6StringEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14Pai
+__ZNK7WebCore11FrameLoader15originalRequestEv
+__ZN7WebCore19ResourceRequestBase14setCachePolicyENS_26ResourceRequestCachePolicyE
+__ZN7WebCore11FrameLoader34addExtraFieldsToSubresourceRequestERNS_15ResourceRequestE
+__ZNK7WebCore11FrameLoader8encodingEv
+__ZN7WebCore17SubresourceLoaderC1EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
+__ZN7WebCore17SubresourceLoaderC2EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
+__ZN7WebCore14DocumentLoader20addSubresourceLoaderEPNS_14ResourceLoaderE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore14ResourceLoaderEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN7WebCore14ResourceLoader4loadERKNS_15ResourceRequestE
+__ZN7WebCore17SubresourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore11FrameLoader32assignIdentifierToInitialRequestEmRKNS_15ResourceRequestE
+__ZN7WebCore14DocumentLoader19scheduleArchiveLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
+__ZNK7WebCore14DocumentLoader21archiveResourceForURLERKNS_4KURLE
+__ZN7WebCore14DocumentLoader28scheduleApplicationCacheLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
+__ZN7WebCore14DocumentLoader38shouldLoadResourceFromApplicationCacheERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addE
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore17SubresourceLoaderEEESt4pairIS4_PNS2_7RequestEENS_18PairFirstExtractorIS8_EENS_7PtrHash
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_14CachedResourceEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore5Cache16resourceAccessedEPNS_14CachedResourceE
+__ZN7WebCore5Cache17removeFromLRUListEPNS_14CachedResourceE
+__ZNK7WebCore14CachedResource12overheadSizeEv
+__ZN7WebCore5Cache10adjustSizeEbi
+__ZN7WebCore5Cache15insertInLRUListEPNS_14CachedResourceE
+__ZN7WebCore5Cache10lruListForEPNS_14CachedResourceE
+__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE4growEm
+__ZN3WTF7HashMapIN7WebCore6StringENS1_20CachedResourceHandleINS1_14CachedResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_I
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_20CachedResourceHandleINS1_14CachedResourceEEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
+__ZN7WebCore9DocLoader22checkCacheObjectStatusEPNS_14CachedResourceE
+__ZNK7WebCore9DocLoader5frameEv
+__ZN7WebCore19CachedCSSStyleSheet9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore14CachedResource9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore5Cache22addToLiveResourcesSizeEPNS_14CachedResourceE
+__ZN3WTF7HashMapIPN7WebCore20CachedResourceClientEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN7WebCore10StyleSheet8setMediaEN3WTF10PassRefPtrINS_9MediaListEEE
 __ZNK7WebCore11HTMLElement5titleEv
 __ZN7WebCore13CSSStyleSheet11checkLoadedEv
 __ZN7WebCore13CSSStyleSheet9isLoadingEv
+__ZN7WebCore13CSSImportRule12isImportRuleEv
+__ZNK7WebCore13CSSImportRule9isLoadingEv
+__ZN7WebCore12StyleElement5sheetEPNS_7ElementE
+__ZN7WebCore9CSSParser18parseFillShorthandEiPKiib
+__ZN7WebCore9CSSParser12addFillValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
+__ZN7WebCore9CSSParser17parseFillPositionERN3WTF6RefPtrINS_8CSSValueEEES5_
+__ZN7WebCore9CSSParser19parseFillPositionXYERbS1_
+__ZN7WebCore9CSSParser20parseBackgroundColorEv
 __ZN7WebCore9StyleBase12isImportRuleEv
 __ZN7WebCore16HTMLStyleElement11sheetLoadedEv
 __ZNK7WebCore16HTMLStyleElement9isLoadingEv
 __ZN7WebCore8Document18removePendingSheetEv
-__ZN7WebCore8Document19updateStyleSelectorEv
-__ZN7WebCore8Document19recalcStyleSelectorEv
-__ZN7WebCore21DeprecatedPtrListImplC2ERKS0_
-__ZNK7WebCore8Document8nodeTypeEv
-__ZNK7WebCore4Node17virtualFirstChildEv
+__ZNK7WebCore15HTMLLinkElement9isLoadingEv
+__ZNK7WebCore15HTMLLinkElement5sheetEv
 __ZN7WebCore16HTMLStyleElement5sheetEv
-__ZN7WebCore12StyleElement5sheetEPNS_7ElementE
-__ZN7WebCore21DeprecatedPtrListImpl6appendEPKv
-__ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEPNS_4PageEPNS_11RenderStyleE
-__ZNK7WebCore18StyleInheritedDataeqERKS0_
-__ZNK7WebCore12RenderObject12isListMarkerEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE15reserveCapacityEm
+__ZN7WebCore19MediaQueryEvaluatorC1ERKNS_6StringEPNS_5FrameEPNS_11RenderStyleE
+__ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEPNS_5FrameEPNS_11RenderStyleE
+__ZN7WebCore14StyleSheetList4itemEj
+__ZN7WebCore9StyleBase11isStyleRuleEv
 __ZN7WebCore7Element11recalcStyleENS_4Node11StyleChangeE
 __ZNK7WebCore12StyleBoxDataeqERKS0_
-__ZN7WebCore4Node14setRenderStyleEPNS_11RenderStyleE
+__ZN7WebCore4Node14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
 __ZN7WebCore12RenderObject7repaintEb
-__ZNK7WebCore10RenderView8printingEv
-__ZN7WebCore10RenderFlow27absoluteClippedOverflowRectEv
-__ZNK7WebCore11RenderBlock12isInlineFlowEv
-__ZN7WebCore9RenderBox27absoluteClippedOverflowRectEv
+__ZN7WebCore12RenderObject8isRootedEPPNS_10RenderViewE
+__ZNK7WebCore12RenderObject19containerForRepaintEv
+__ZN7WebCore9RenderBox29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
 __ZNK7WebCore11RenderBlock12overflowRectEb
 __ZNK7WebCore11RenderBlock12overflowLeftEb
-__ZNK7WebCore12RenderObject14borderTopExtraEv
 __ZNK7WebCore11RenderBlock11overflowTopEb
-__ZNK7WebCore9RenderBox6heightEv
-__ZNK7WebCore12RenderObject17borderBottomExtraEv
 __ZNK7WebCore11RenderBlock14overflowHeightEb
 __ZNK7WebCore11RenderBlock13overflowWidthEb
-__ZN7WebCore10RenderView26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZN7WebCore10RenderView20repaintViewRectangleERKNS_7IntRectEb
-__ZNK7WebCore12RenderObject23createsAnonymousWrapperEv
-__ZN7WebCore4Text11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore4Node12isShadowNodeEv
-__ZN7WebCore13HTMLTokenizer35executeScriptsWaitingForStylesheetsEv
-__ZN7WebCore16HTMLStyleElement21finishParsingChildrenEv
+__ZN7WebCore10RenderView21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore12RenderObject21repaintUsingContainerEPNS_20RenderBoxModelObjectERKNS_7IntRectEb
+__ZNK7WebCore7Comment8nodeTypeEv
+__ZN7WebCoreL17scriptConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17HTMLScriptElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17ScriptElementDataC1EPNS_13ScriptElementEPNS_7ElementE
+__ZN7WebCore17ScriptElementDataC2EPNS_13ScriptElementEPNS_7ElementE
+__ZN7WebCore17HTMLScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLScriptElement17endTagRequirementEv
+__ZNK7WebCore17HTMLScriptElement11tagPriorityEv
+__ZN7WebCore17HTMLScriptElement20insertedIntoDocumentEv
+__ZNK7WebCore17HTMLScriptElement20sourceAttributeValueEv
+__ZN7WebCore13ScriptElement20insertedIntoDocumentERNS_17ScriptElementDataERKNS_6StringE
+__ZNK7WebCore17HTMLScriptElement13scriptCharsetEv
+__ZNK7WebCore17ScriptElementData13scriptCharsetEv
+__ZThn112_NK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZN7WebCore13HTMLTokenizer13scriptHandlerENS0_5StateE
+__ZNK7WebCore17HTMLScriptElement25shouldExecuteAsJavaScriptEv
+__ZNK7WebCore17ScriptElementData25shouldExecuteAsJavaScriptEv
+__ZThn112_NK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZN7WebCore16MIMETypeRegistry29isSupportedJavaScriptMIMETypeERKNS_6StringE
+__ZN7WebCore13HTMLTokenizer13enlargeBufferEi
+__ZN7WebCore10HTMLParser20textCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore17HTMLScriptElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLScriptElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13ScriptElement15childrenChangedERNS_17ScriptElementDataE
+__ZNK7WebCore4Node11textContentEb
+__ZNK7WebCore4Node17appendTextContentEbRNS_13StringBuilderE
+__ZN7WebCore13StringBuilder6appendERKNS_6StringE
+__ZNK7WebCore13StringBuilder8toStringEv
+__ZN3WTF6VectorIN7WebCore6StringELm16EE6shrinkEm
+__ZN7WebCore17HTMLScriptElement21finishParsingChildrenEv
+__ZN7WebCore13ScriptElement21finishParsingChildrenERNS_17ScriptElementDataERKNS_6StringE
+__ZNK7WebCore17ScriptElementData13scriptContentEv
+__ZN7WebCore15SegmentedString7prependERKS0_
+__ZN7WebCore15SegmentedString7prependERKNS_18SegmentedSubstringE
+__ZNK7WebCore6StringcvN3JSC7UStringEEv
+__ZNK7WebCore20StringSourceProvider6lengthEv
+__ZN7WebCore13HTMLTokenizer15scriptExecutionERKNS_16ScriptSourceCodeENS0_5StateE
+__ZN7WebCore11FrameLoader13executeScriptERKNS_16ScriptSourceCodeE
+__ZN7WebCore16ScriptController8evaluateERKNS_16ScriptSourceCodeE
+__ZN7WebCore16ScriptController10initScriptEv
+__ZN7WebCore16JSDOMWindowShellnwEm
+__ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
+__ZN7WebCore16JSDOMWindowShellC1EN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore16JSDOMWindowShellC2EN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore16JSDOMWindowShell9setWindowEN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore20JSDOMWindowPrototypenwEm
+__ZN7WebCore11JSDOMWindowC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore11JSDOMWindowC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataC1EN3WTF10PassRefPtrINS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataC2EN3WTF10PassRefPtrINS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataC2Ev
+__ZN7WebCore17JSDOMGlobalObjectC2EN3WTF10PassRefPtrIN3JSC9StructureEEEPNS0_21JSDOMGlobalObjectDataEPNS3_8JSObjectE
+__ZN7WebCore15JSDOMWindowBase10globalExecEv
+__ZN7WebCore5Frame9keepAliveEv
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26Symbo
+__ZN7WebCore15JSDOMWindowBase14updateDocumentEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore23getCachedDOMNodeWrapperEPNS_8DocumentEPNS_4NodeE
+__ZNK3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZNK7WebCore8Document8nodeTypeEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DocumentE
+__ZN7WebCore25getCachedDOMObjectWrapperERN3JSC12JSGlobalDataEPv
+__ZNK3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3getERKS1_
+__ZN7WebCore21getCachedDOMStructureEPNS_17JSDOMGlobalObjectEPKN3JSC9ClassInfoE
+__ZNK3WTF7HashMapIPKN3JSC9ClassInfoENS_6RefPtrINS1_9StructureEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSA_IS7_EEE3getERKS4_
+__ZN7WebCore14JSHTMLDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSDocumentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSNodePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSNode15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrIN3JSC9StructureEEEPKNS4_9ClassInfoE
+__ZN3WTF7HashMapIPKN3JSC9ClassInfoENS_6RefPtrINS1_9StructureEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSA_IS7_EEE3setERKS4_RKS7_
+__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_NS_6RefPtrINS1_9StructureEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore14JSHTMLDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12HTMLDocumentEEE
+__ZN7WebCore14JSHTMLDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12HTMLDocumentEEE
+__ZN7WebCore10JSDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DocumentEEE
+__ZN7WebCore6JSNodeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4NodeEEE
+__ZN7WebCore21cacheDOMObjectWrapperERN3JSC12JSGlobalDataEPvPNS_9DOMObjectE
+__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3setERKS1_RKS4_
+__ZN3WTF9HashTableIPvSt4pairIS1_PN7WebCore9DOMObjectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10Ha
+__ZN7WebCore16ScriptController14attachDebuggerEPN3JSC8DebuggerE
+__ZN7WebCore16ScriptController18windowScriptObjectEv
+__ZN7WebCore16ScriptController17bindingRootObjectEv
+__ZN3JSC8Bindings10RootObject6createEPKvPNS_14JSGlobalObjectE
+__ZN3JSC8Bindings10RootObjectC1EPKvPNS_14JSGlobalObjectE
+__ZN3JSC8Bindings10RootObjectC2EPKvPNS_14JSGlobalObjectE
+__ZN3JSC8BindingsL13rootObjectSetEv
+__ZN3WTF7HashSetIPN3JSC8Bindings10RootObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expand
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehash
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloc
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deall
++[WebScriptObject initialize]
++[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]
+__Z16createDOMWrapperPN3JSC8JSObjectEN3WTF10PassRefPtrINS_8Bindings10RootObjectEEES6_
+__ZNK7WebCore16JSDOMWindowShell9classInfoEv
+__ZNK7WebCore16JSDOMWindowShell4implEv
+__Z3kitPN7WebCore9DOMWindowE
+__Z13getDOMWrapperP17DOMObjectInternal
+-[WebScriptObject(WebScriptObjectInternal) _init]
+__Z13addDOMWrapperP8NSObjectP17DOMObjectInternal
+__Z18createWrapperCachev
+-[WebScriptObject _hasImp]
+-[WebScriptObject _setImp:originRootObject:rootObject:]
+__ZN7WebCore12addJSWrapperEP8NSObjectPN3JSC8JSObjectE
+__ZN3JSC8Bindings10RootObject9gcProtectEPNS_8JSObjectE
+__ZNK3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTra
+__ZN3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
+__ZN7WebCore19InspectorController34inspectedWindowScriptObjectClearedEPNS_5FrameE
+__ZN7WebCore6StringC1ERKN3JSC7UStringE
+__ZN7WebCore6StringC2ERKN3JSC7UStringE
+__ZNK7WebCore20StringSourceProvider4dataEv
+__ZNK7WebCore15JSDOMWindowBase17supportsProfilingEv
+__ZN7WebCore16JSDOMWindowShell18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSDOMWindow18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12AtomicString3addERKN3JSC10IdentifierE
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_17HashAndCharactersENS1_27HashAndCharac
+__ZNK7WebCore9FrameTree5childERKNS_12AtomicStringE
+__ZN7WebCore20JSDOMWindowPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSDOMWindowBase12toThisObjectEPN3JSC9ExecStateE
+__ZNK7WebCore15JSDOMWindowBase5shellEv
+__ZN7WebCore44jsDOMWindowPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13toJSDOMWindowEN3JSC7JSValueE
+__ZN7WebCore11JSDOMWindow16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore17JSDOMGlobalObject27findOrCreateJSEventListenerEN3JSC7JSValueE
+__ZN7WebCore17JSDOMGlobalObject19findJSEventListenerEN3JSC7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERKS3_
+__ZN7WebCore15JSEventListenerC1EPN3JSC8JSObjectEPNS_17JSDOMGlobalObjectEb
+__ZN7WebCore15JSEventListenerC2EPN3JSC8JSObjectEPNS_17JSDOMGlobalObjectEb
+__ZN7WebCore17JSDOMGlobalObject16jsEventListenersEv
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore15JSEventListenerEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14P
+__ZN7WebCore12AtomicString3addERKN3JSC7UStringE
+__ZN7WebCore9DOMWindow16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore9DOMWindow19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore8Document23addListenerTypeIfNeededERKNS_12AtomicStringE
+__ZN7WebCore23RegisteredEventListenerC1ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore23RegisteredEventListenerC2ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE15reserveCapacityEm
+__ZN7WebCore15SegmentedString6appendERKS0_
+__ZN7WebCore15SegmentedString6appendERKNS_18SegmentedSubstringE
 __ZN7WebCore10HTMLParser20bodyCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser10createHeadEv
 __ZN7WebCore10HTMLParser9startBodyEv
-__ZN7WebCore15bodyConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLBodyElementC2EPNS_8DocumentE
+__ZN7WebCoreL15bodyConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLBodyElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBodyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore15HTMLBodyElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeE
 __ZN7WebCore15HTMLBodyElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement11addCSSColorEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore13StyledElement16createMappedDeclEPNS_15MappedAttributeE
-__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleE
-__ZN7WebCore8Document12elementSheetEv
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbbRi
-__ZN7WebCore9CSSParser10parseValueEPNS_26CSSMutableStyleDeclarationEiRKNS_6StringEb
-__ZN7WebCore9StyleBase10stylesheetEv
-__ZNK7WebCore9StyleBase12isStyleSheetEv
-__ZNK7WebCore10StyleSheet12isStyleSheetEv
-__ZN7WebCore26CSSMutableStyleDeclaration19addParsedPropertiesEPKPKNS_11CSSPropertyEi
-__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyPriorityEi
-__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEibbRi
-__ZZN7WebCore16initShorthandMapERN3WTF7HashMapIiNS_16PropertyLonghandENS0_7IntHashIjEENS0_10HashTraitsIiEENS5_IS2_EEEEE21borderColorProperties
-__ZNK3WTF7HashMapIiN7WebCore16PropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16PropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addIiS3_NS_17HashMapTranslatorILb1ES4_NS_18PairBaseHashTraitsISB_SC_EESD_S8_EEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16PropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN7WebCore23DeprecatedValueListImpl8fromLastEv
-__ZN7WebCore23DeprecatedValueListImpl8lastNodeEv
-__ZNK7WebCore23DeprecatedValueListImpl8lastNodeEv
-__ZN7WebCore26CSSMutableStyleDeclaration10setChangedENS_15StyleChangeTypeE
-__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeEPNS_29CSSMappedAttributeDeclarationE
-__ZNK3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttributeKeyTraitsENS_10HashTraitsIS4_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIiEEEES9_E3addIS2_PNS1_29CSSMappedAttributeDeclarationENS_17HashMapTranslatorILb1ES3_IS2_SG_ENS_18PairBaseHashTraitsIS9_NSA_ISG_EEEESC_S7_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZN7WebCore19MappedAttributeHash4hashERKNS_18MappedAttributeKeyE
-__ZN7WebCore13StyledElement12addCSSLengthEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore26CSSMutableStyleDeclaration17setLengthPropertyEiRKNS_6StringEbb
+__ZN7WebCore13StyledElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore13StyledElement18getInlineStyleDeclEv
+__ZN7WebCore13StyledElement21createInlineStyleDeclEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1Ev
+__ZN7WebCore26CSSMutableStyleDeclarationC2Ev
+__ZN7WebCore26CSSMutableStyleDeclaration16parseDeclarationERKNS_6StringE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14shrinkCapacityEm
+__ZN7WebCore9CSSParser16parseDeclarationEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
+__ZN7WebCore13StyledElement24invalidateStyleAttributeEv
 __ZNK7WebCore15HTMLBodyElement17endTagRequirementEv
 __ZNK7WebCore15HTMLBodyElement11tagPriorityEv
 __ZN7WebCore15HTMLBodyElement20insertedIntoDocumentEv
-__ZNK7WebCore8Document12ownerElementEv
-__ZN7WebCore8Document18minimumLayoutDelayEv
-__ZNK7WebCore8Document11elapsedTimeEv
-__ZN7WebCore9TimerBase5startEdd
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE15reserveCapacityEm
-__ZN7WebCore9TimerBase15heapDecreaseKeyEv
-__ZSt11__push_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
-__ZN7WebCore17updateSharedTimerEv
-__ZN7WebCore22setSharedTimerFireTimeEd
--[WebCorePowerNotifier init]
-__ZN7WebCore16CSSStyleSelector24canShareStyleWithElementEPNS_4NodeE
-__ZNK7WebCore18NamedMappedAttrMap19hasMappedAttributesEv
-__ZNK7WebCore9StyleBase16isPrimitiveValueEv
+__ZN7WebCore11HTMLElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore11HTMLElement15inEitherTagListEPKNS_4NodeE
+__ZN7WebCore10HTMLParser23pCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL14divConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLDivElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLDivElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore7Element8updateIdERKNS_12AtomicStringES3_
+__ZNK7WebCore14HTMLDivElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore14HTMLDivElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14HTMLDivElement17endTagRequirementEv
+__ZNK7WebCore14HTMLDivElement11tagPriorityEv
+__ZN7WebCoreL13inlineTagListEv
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN7WebCoreL12blockTagListEv
+__ZN7WebCore8Document14addElementByIdERKNS_12AtomicStringEPNS_7ElementE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraits
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14Pa
+__ZN7WebCore13StyledElement21classAttributeChangedERKNS_12AtomicStringE
+__ZN7WebCore18NamedMappedAttrMap8setClassERKNS_6StringE
+__ZN7WebCore4Node28dispatchSubtreeModifiedEventEv
+__ZN7WebCore4Node31notifyNodeListsAttributeChangedEv
+__ZN7WebCore4Node36notifyLocalNodeListsAttributeChangedEv
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE15reserveCapacityEm
+__ZN7WebCore15FontFamilyValueC1ERKNS_6StringE
+__ZN7WebCore15FontFamilyValueC2ERKNS_6StringE
+__ZN7WebCore6String8truncateEj
+__ZN7WebCoreL16imageConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLImageElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore15HTMLImageLoaderC1EPNS_7ElementE
+__ZN7WebCore15HTMLImageLoaderC2EPNS_7ElementE
+__ZN7WebCore11ImageLoaderC2EPNS_7ElementE
+__ZNK7WebCore16HTMLImageElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLImageElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11ImageLoader38updateFromElementIgnoringPreviousErrorEv
+__ZN7WebCore11ImageLoader17updateFromElementEv
+__ZNK7WebCore7Element24imageSourceAttributeNameEv
+__ZNK7WebCore15HTMLImageLoader9sourceURIERKNS_12AtomicStringE
+__ZN7WebCore9DocLoader12requestImageERKNS_6StringE
+__ZN7WebCore11CachedImageC1ERKNS_6StringE
+__ZN7WebCore11CachedImageC2ERKNS_6StringE
+__ZN7WebCore11CachedImage4loadEPNS_9DocLoaderE
+__ZN7WebCore11ImageLoader15setLoadingImageEPNS_11CachedImageE
+__ZN7WebCore11CachedImage9addClientEPNS_20CachedResourceClientE
+__ZNK3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttr
+__ZN7WebCore13StyledElement12addCSSLengthEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore26CSSMutableStyleDeclaration17setLengthPropertyEiRKNS_6StringEbb
+__ZNK7WebCore16HTMLImageElement17endTagRequirementEv
+__ZNK7WebCore16HTMLImageElement11tagPriorityEv
+__ZN7WebCore16HTMLImageElement20insertedIntoDocumentEv
+__ZN7WebCore12HTMLDocument12addNamedItemERKNS_12AtomicStringE
+__ZN7WebCoreL12addItemToMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_12Ato
+__ZN7WebCore12HTMLDocument17addExtraNamedItemERKNS_12AtomicStringE
+__ZN7WebCore16HTMLImageElement6attachEv
+__ZN7WebCore10HTMLParser22nestedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL17anchorConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLAnchorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11prefetchDNSERKNS_6StringE
+__ZNK7WebCore4Page24javaScriptURLsAreAllowedEv
+__ZNK7WebCore17HTMLAnchorElement17endTagRequirementEv
+__ZNK7WebCore17HTMLAnchorElement11tagPriorityEv
+__ZN7WebCore10HTMLParser27nestedStyleCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser23allowNestedRedundantTagERKNS_12AtomicStringE
+__ZN7WebCore11HTMLElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL13brConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLBRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLBRElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLBRElement17endTagRequirementEv
+__ZNK7WebCore13HTMLBRElement11tagPriorityEv
+__ZN7WebCore13HTMLTokenizer11parseEntityERNS_15SegmentedStringERPtNS0_5StateERjbb
+__ZN7WebCoreL20encodeRelativeStringERKNS_6StringERKNS_12TextEncodingERN3WTF6VectorIcLm512EEE
+__ZN3WTF6VectorItLm512EE14shrinkCapacityEm
+__ZN7WebCoreL11findFirstOfEPKtiiPKc
+__ZN3WTF6VectorItLm512EE6appendItEEvPKT_m
+__ZN7WebCoreL21appendEncodedHostnameERN3WTF6VectorItLm512EEEPKtj
+__ZN7WebCore12TextCodecICU6encodeEPKtmNS_19UnencodableHandlingE
+__ZN7WebCore7CStringC1EPKcj
+__ZN7WebCore7CStringC2EPKcj
+__ZN7WebCore7CString4initEPKcj
+__ZN7WebCore12TextCodecICUD0Ev
+__ZNK7WebCore12TextCodecICU19releaseICUConverterEv
+__ZN7WebCoreL18headingConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore18HTMLHeadingElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18HTMLHeadingElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18HTMLHeadingElement17endTagRequirementEv
+__ZNK7WebCore18HTMLHeadingElement11tagPriorityEv
+__ZN7WebCoreL16labelConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLLabelElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLLabelElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLLabelElement11tagPriorityEv
+__ZN7WebCore18HTMLHeadingElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore10HTMLParser20formCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore15HTMLFormElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLFormElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15FormDataBuilderC1Ev
+__ZN7WebCore15FormDataBuilderC2Ev
+__ZN7WebCore15HTMLFormElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore15HTMLFormElement17endTagRequirementEv
+__ZNK7WebCore15HTMLFormElement11tagPriorityEv
+__ZN7WebCore15HTMLFormElement20insertedIntoDocumentEv
+__ZN7WebCore15HTMLFormElement6attachEv
+__ZN7WebCoreL19fieldsetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLFieldSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLFieldSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore22HTMLFormControlElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore15HTMLFormElement19registerFormElementEPNS_22HTMLFormControlElementE
+__ZN7WebCore19CheckedRadioButtons12removeButtonEPNS_22HTMLFormControlElementE
+__ZNK7WebCore22HTMLFormControlElement15formControlNameEv
+__ZN7WebCore19CheckedRadioButtons9addButtonEPNS_22HTMLFormControlElementE
+__ZNK7WebCore22HTMLFormControlElement13isRadioButtonEv
+__ZN7WebCore15HTMLFormElement16formElementIndexEPNS_22HTMLFormControlElementE
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE15reserveCapacityEm
+__ZN7WebCore22HTMLFormControlElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore22HTMLFormControlElement17endTagRequirementEv
+__ZNK7WebCore19HTMLFieldSetElement11tagPriorityEv
+__ZN7WebCore22HTMLFormControlElement16insertedIntoTreeEb
+__ZN7WebCore22HTMLFormControlElement6attachEv
+__ZNK7WebCore22HTMLFormControlElement9autofocusEv
+__ZNK7WebCore7Element12hasAttributeERKNS_13QualifiedNameE
+__ZNK7WebCore7Element14hasAttributeNSERKNS_6StringES3_
+__ZNK7WebCore7Element10attributesEb
+__ZN7WebCore19HTMLFieldSetElement8checkDTDEPKNS_4NodeE
+__ZN7WebCoreL16inputConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLInputElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLInputElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore31HTMLFormControlElementWithStateC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore16InputElementDataC1EPNS_12InputElementEPNS_7ElementE
+__ZN7WebCore16InputElementDataC2EPNS_12InputElementEPNS_7ElementE
+__ZNK7WebCore16HTMLInputElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLInputElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16HTMLInputElement12setInputTypeERKNS_6StringE
+__ZNK7WebCore16HTMLInputElement15formControlNameEv
+__ZNK7WebCore16InputElementData4nameEv
+__ZNK7WebCore16HTMLInputElement13isRadioButtonEv
+__ZN7WebCore12InputElement18parseSizeAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
+__ZNK7WebCore6String5toIntEPb
+__ZN7WebCore10StringImpl5toIntEPb
+__ZN7WebCore15charactersToIntEPKtmPb
+__ZN7WebCoreL27lengthOfCharactersAsIntegerEPKtm
+__ZN7WebCoreL24isCharacterAllowedInBaseEti
+__ZNK7WebCore16HTMLInputElement17endTagRequirementEv
+__ZNK7WebCore16HTMLInputElement11tagPriorityEv
+__ZN7WebCore16HTMLInputElement6attachEv
+__ZNK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZN7WebCore31HTMLFormControlElementWithState21finishParsingChildrenEv
+__ZNK7WebCore8Document26hasStateForNewFormElementsEv
+__ZN7WebCore10HTMLParser22selectCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL17selectConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLSelectElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLSelectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLSelectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore28createAttributeEventListenerEPNS_4NodeEPNS_9AttributeE
+__ZN7WebCore19createJSHTMLWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHashI
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHash
+__ZN7WebCoreL30createHTMLSelectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLSelectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSHTMLElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLSelectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSelectElementEEE
+__ZN7WebCore19JSHTMLSelectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSelectElementEEE
+__ZN7WebCore13JSHTMLElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11HTMLElementEEE
+__ZN7WebCore9JSElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ElementEEE
+__ZN7WebCore19cacheDOMNodeWrapperEPNS_8DocumentEPNS_4NodeEPNS_6JSNodeE
+__ZN3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN7WebCoreL18eventParameterNameEb
+__ZN7WebCore19JSLazyEventListenerC1ERKNS_6StringES3_S3_PNS_17JSDOMGlobalObjectEPNS_4NodeEi
+__ZN7WebCore19JSLazyEventListenerC2ERKNS_6StringES3_S3_PNS_17JSDOMGlobalObjectEPNS_4NodeEi
+__ZN7WebCore4Node25setAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore4Node27clearAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore4Node16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore4Node14ensureRareDataEv
+__ZN7WebCore7Element14createRareDataEv
+__ZN3WTF7HashMapIPKN7WebCore4NodeEPNS1_12NodeRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN7WebCore4Node19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZNK7WebCore4Node8rareDataEv
+__ZNK3WTF7HashMapIPKN7WebCore4NodeEPNS1_12NodeRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore8Document42registerDisconnectedNodeWithEventListenersEPNS_4NodeE
+__ZN3WTF7HashSetIPN7WebCore4NodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZNK7WebCore17HTMLSelectElement11tagPriorityEv
+__ZN7WebCore8Document44unregisterDisconnectedNodeWithEventListenersEPNS_4NodeE
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ident
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore17HTMLSelectElement16insertedIntoTreeEb
+__ZNK7WebCore17HTMLSelectElement15recalcListItemsEb
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14shrinkCapacityEm
+__ZN7WebCore17HTMLSelectElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLSelectElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17HTMLSelectElement18setRecalcListItemsEv
+__ZN7WebCore8Document19scheduleStyleRecalcEv
+__ZN3WTF7HashSetIPN7WebCore8DocumentENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTable
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTab
+__ZN7WebCoreL17optionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLOptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLOptionElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17OptionElementDataC1EPNS_7ElementE
+__ZN7WebCore17OptionElementDataC2EPNS_7ElementE
+__ZN7WebCore17HTMLOptionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLOptionElement17endTagRequirementEv
+__ZNK7WebCore17HTMLOptionElement11tagPriorityEv
+__ZN7WebCore17HTMLOptionElement16insertedIntoTreeEb
+__ZNK7WebCore17HTMLOptionElement18ownerSelectElementEv
+__ZNK7WebCore17HTMLOptionElement8selectedEv
+__ZN7WebCore17HTMLSelectElement17scrollToSelectionEv
+__ZN7WebCore17HTMLOptionElement6attachEv
+__ZN7WebCore17HTMLOptionElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLOptionElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore17HTMLOptionElement22nonRendererRenderStyleEv
+__ZNK7WebCore17HTMLOptionElement5indexEv
+__ZNK7WebCore4Node19traverseNextSiblingEPKS0_
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLOptionElement16setSelectedStateEb
+__ZN7WebCore13OptionElement16setSelectedStateERNS_17OptionElementDataEb
+__ZN7WebCore17HTMLSelectElement16setSelectedIndexEibb
+__ZNK7WebCore17HTMLSelectElement17optionToListIndexEi
+__ZN7WebCore17HTMLSelectElement29setActiveSelectionAnchorIndexEi
+__ZN3WTF6VectorIbLm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIbLm0EE14expandCapacityEmPKb
+__ZN3WTF6VectorIbLm0EE14expandCapacityEm
+__ZN3WTF6VectorIbLm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLSelectElement13deselectItemsEPNS_17HTMLOptionElementE
+__ZNK7WebCore16HTMLInputElement32storesValueSeparateFromAttributeEv
+__ZN7WebCore12InputElement19updateValueIfNeededERNS_16InputElementDataE
+__ZThn128_NK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZN7WebCore12InputElement14constrainValueERKNS_16InputElementDataERKNS_6StringEi
+__ZThn128_NK7WebCore16HTMLInputElement11isTextFieldEv
+__ZNK7WebCore16HTMLInputElement11isTextFieldEv
+__ZN7WebCore12InputElement22notifyFormStateChangedERNS_16InputElementDataEPNS_8DocumentE
+__ZN7WebCore22HTMLFormControlElement34setFormControlValueMatchesRendererEb
+__ZN7WebCoreL13hrConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLHRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLHRElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLHRElement17endTagRequirementEv
+__ZNK7WebCore13HTMLHRElement11tagPriorityEv
+__ZN7WebCore14CachedResource13makePurgeableEb
+__ZNK7WebCore9DocLoader11cachePolicyEv
+__ZNK7WebCore11FrameLoader11cachePolicyEv
+__ZNK7WebCore14CachedResource14mustRevalidateENS_11CachePolicyE
+__ZN3WTF6VectorItLm0EE4growEm
+__ZN3WTF6VectorItLm0EE6shrinkEm
+__ZN3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTra
+__ZNK7WebCore13HTMLBRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLBRElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SegmentedString15advanceSlowCaseERi
+__ZNK7WebCore8Document15isMediaDocumentEv
+__ZN7WebCore11FrameLoader14didReceiveDataEPNS_14ResourceLoaderEPKcii
+__ZN7WebCore15ProgressTracker17incrementProgressEmPKci
+__ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
+__ZNK7WebCore11FrameLoader15firstLayoutDoneEv
+__ZN7WebCore11FrameLoader31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
+__ZN7WebCore19InspectorController23didReceiveContentLengthEPNS_14DocumentLoaderEmi
+-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]
+__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
+__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
+-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
+__ZN7WebCore14ResourceLoader16didFinishLoadingEPNS_14ResourceHandleE
+__ZN7WebCore18MainResourceLoader16didFinishLoadingEv
+__ZN7WebCore11FrameLoader15finishedLoadingEv
+__ZN7WebCoreL24urlEscapedEntityCallbackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE6shrinkEm
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22I
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInva
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore4Text11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore22HTMLFormControlElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore17HTMLSelectElement11recalcStyleENS_4Node11StyleChangeE
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE6shrinkEm
+__ZN7WebCore9TimerBase10heapPopMinEv
+__ZSt13__adjust_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE6shrinkEm
+__ZN7WebCore19AnimationController18endAnimationUpdateEv
+__ZN7WebCore26AnimationControllerPrivate14styleAvailableEv
+__ZN7WebCore26AnimationControllerPrivate24beginAnimationUpdateTimeEv
+__ZN7WebCore26AnimationControllerPrivate17startTimeResponseEd
+__ZN7WebCore9FrameView16restoreScrollbarEv
+__ZN7WebCore11FrameLoader10gotoAnchorEv
+__ZN7WebCore14ResourceLoader12resourceDataEv
+__ZN7WebCore14DocumentLoader13updateLoadingEv
+__ZNK7WebCore11FrameLoader9isLoadingEv
+__ZNK7WebCore14DocumentLoader21isLoadingSubresourcesEv
+__ZN7WebCore14ResourceLoader16didFinishLoadingEv
+__ZN7WebCore14ResourceLoader23didFinishLoadingOnePartEv
+__ZN7WebCore11FrameLoader13didFinishLoadEPNS_14ResourceLoaderE
+__ZN7WebCore15ProgressTracker16completeProgressEm
+__ZN7WebCore11FrameLoader24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore19InspectorController16didFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore14ResourceLoader16releaseResourcesEv
+__ZN7WebCore14ResourceHandle9setClientEPNS_20ResourceHandleClientE
+__ZN7WebCore14ResourceHandleD1Ev
+__ZN7WebCore14ResourceHandleD2Ev
+__ZN7WebCore14ResourceHandle15releaseDelegateEv
+-[WebCoreResourceHandleAsDelegate detachHandle]
+__ZN7WebCore22ResourceHandleInternalD1Ev
+__ZN7WebCore22ResourceHandleInternalD2Ev
+__ZN7WebCore27AuthenticationChallengeBaseD2Ev
+__ZN7WebCore19ResourceRequestBaseD2Ev
+__ZN7WebCore18MainResourceLoaderD0Ev
+__ZN7WebCore16RunLoopTimerBaseD2Ev
+__ZN7WebCore16RunLoopTimerBase4stopEv
+__ZN7WebCore14ResourceLoaderD2Ev
+__ZN7WebCore12ThreadTimers16sharedTimerFiredEv
+__ZN7WebCore12ThreadTimers24sharedTimerFiredInternalEv
+__ZN7WebCore12ThreadTimers19collectFiringTimersEdRN3WTF6VectorIPNS_9TimerBaseELm0EEE
+__ZN3WTF7HashSetIPKN7WebCore9TimerBaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13allocateTab
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deallocateT
+__ZN7WebCore9TimerBase13heapDeleteMinEv
+__ZN7WebCore12ThreadTimers10fireTimersEdRKN3WTF6VectorIPNS_9TimerBaseELm0EEE
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47removeAndIn
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6removeEPS4_
+__ZN7WebCore5TimerINS_6LoaderEE5firedEv
+__ZN7WebCore6Loader17requestTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore6Loader20servePendingRequestsENS0_8PriorityE
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE6shrinkEm
+__ZN7WebCore5TimerINS_5FrameEE5firedEv
+__ZN7WebCore5Frame21lifeSupportTimerFiredEPNS_5TimerIS0_EE
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
+__ZN7WebCore17SubresourceLoader26shouldUseCredentialStorageEv
+__ZN7WebCore23SubresourceLoaderClient29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore17SubresourceLoader18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore6Loader4Host18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3get
+__ZN7WebCore14CachedResource11setResponseERKNS_16ResourceResponseE
+__ZNK7WebCore20ResourceResponseBase14expirationDateEv
+__ZNK7WebCore20ResourceResponseBase16textEncodingNameEv
+__ZN7WebCore17SubresourceLoader14didReceiveDataEPKcixb
+__ZN7WebCore6Loader4Host14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore17SubresourceLoader16didFinishLoadingEv
+__ZN7WebCore6Loader4Host16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZN7WebCore9DocLoader21decrementRequestCountEv
+__ZN7WebCore9DocLoader17setLoadInProgressEb
+__ZN7WebCore19CachedCSSStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore14CachedResource14setEncodedSizeEj
+__ZN7WebCore19TextResourceDecoder18checkForCSSCharsetEPKcmRb
+__ZN7WebCore19CachedCSSStyleSheet11checkNotifyEv
+__ZN7WebCore26CachedResourceClientWalkerC1ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTrait
+__ZN7WebCore26CachedResourceClientWalkerC2ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTrait
+__ZN7WebCore26CachedResourceClientWalker4nextEv
+__ZNK3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTr
+__ZThn24_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore13CSSStyleSheetC1EPNS_7CSSRuleERKNS_6StringES5_
+__ZN7WebCore13CSSStyleSheetC2EPNS_7CSSRuleERKNS_6StringES5_
+__ZN7WebCore10StyleSheetC2EPNS_9StyleBaseERKNS_6StringE
+__ZNK7WebCore19CachedCSSStyleSheet9sheetTextEb
+__ZNK7WebCore19CachedCSSStyleSheet11canUseSheetEb
+__ZN7WebCore28extractMIMETypeFromMediaTypeERKNS_6StringE
+__ZN3WTF6VectorItLm64EE15reserveCapacityEm
+__ZN3WTF6VectorItLm64EE6shrinkEm
+__ZN7WebCore9CSSParser9parseFontEb
+__ZNK7WebCore13CSSStyleSheet11completeURLERKNS_6StringE
+__ZNK7WebCore9StyleBase7baseURLEv
+__ZNK7WebCore4KURL14isHierarchicalEv
+__ZN7WebCoreL20copyPathRemovingDotsEPcPKcii
+__ZN7WebCore13CSSImageValueC1ERKNS_6StringE
+__ZN7WebCore13CSSImageValueC2ERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE6shrinkEm
+__ZN7WebCore11RenderBlock24updateBeforeAfterContentENS_8PseudoIdE
+__ZN7WebCore21RenderObjectChildList24updateBeforeAfterContentEPNS_12RenderObjectENS_8PseudoIdES2_
+__ZNK7WebCore12RenderObject20getCachedPseudoStyleENS_8PseudoIdEPNS_11RenderStyleE
+__ZN7WebCoreL20beforeAfterContainerEPNS_12RenderObjectENS_8PseudoIdE
+__ZNK7WebCore12RenderObject12isListMarkerEv
+__ZNK7WebCore12RenderObject23createsAnonymousWrapperEv
+__ZNK7WebCore8CSSValue16isPrimitiveValueEv
 __ZNK7WebCore8CSSValue12cssValueTypeEv
-__ZN7WebCore9FontValue11isFontValueEv
+__ZNK7WebCore9FontValue11isFontValueEv
 __ZN7WebCore17CSSPrimitiveValue8getIdentEv
-__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEb
-__ZN7WebCore17CSSPrimitiveValue19computeLengthDoubleEPNS_11RenderStyleEb
+__ZN7WebCore11RenderStyle18setFontDescriptionERKNS_15FontDescriptionE
 __ZNK7WebCore12CSSValueList12cssValueTypeEv
-__ZN7WebCore12CSSValueList11isValueListEv
+__ZNK7WebCore12CSSValueList11isValueListEv
+__ZN7WebCore16CSSStyleSelector26getColorFromPrimitiveValueEPNS_17CSSPrimitiveValueE
+__ZN7WebCoreL16colorForCSSValueEi
 __ZN7WebCore16CSSStyleSelector10updateFontEv
 __ZN7WebCore16CSSStyleSelector22checkForTextSizeAdjustEv
 __ZN7WebCore16CSSStyleSelector27checkForGenericFamilyChangeEPNS_11RenderStyleES2_
+__ZN7WebCore16CSSStyleSelector18checkForZoomChangeEPNS_11RenderStyleES2_
 __ZN7WebCore17CSSPrimitiveValue12isQuirkValueEv
-__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleE
+__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleEd
+__ZN7WebCore17CSSPrimitiveValue19computeLengthDoubleEPNS_11RenderStyleEdb
+__ZN7WebCore7DataRefINS_17StyleSurroundDataEE6accessEv
+__ZN7WebCore17StyleSurroundDataC1ERKS0_
 __ZN7WebCore17StyleSurroundDataC2ERKS0_
-__ZN7WebCore16CSSStyleSelector26getColorFromPrimitiveValueEPNS_17CSSPrimitiveValueE
+__ZN7WebCore7DataRefINS_19StyleBackgroundDataEE6accessEv
+__ZN7WebCore19StyleBackgroundDataC1ERKS0_
 __ZN7WebCore19StyleBackgroundDataC2ERKS0_
-__ZN7WebCore15BackgroundLayerC2ERKS0_
+__ZN7WebCore9FillLayerC1ERKS0_
+__ZN7WebCore9FillLayerC2ERKS0_
+__ZNK7WebCore8CSSValue11isValueListEv
+__ZN7WebCore16CSSStyleSelector12mapFillImageEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector10styleImageEPNS_8CSSValueE
+__ZNK7WebCore13CSSImageValue12isImageValueEv
+__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderE
+__ZNK7WebCore17CSSPrimitiveValue14getStringValueEv
+__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderERKNS_6StringE
+__ZN7WebCore16CSSStyleSelector13mapFillRepeatEPNS_9FillLayerEPNS_8CSSValueE
 __ZNK7WebCore15CSSInitialValue12cssValueTypeEv
-__ZNK7WebCore12RenderObject12isRenderViewEv
-__ZN7WebCore11HTMLElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore11HTMLElement15inEitherTagListEPKNS_4NodeE
-__ZN7WebCore4Node16styleForRendererEPNS_12RenderObjectE
+__ZN7WebCore16CSSStyleSelector16mapFillXPositionEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector16mapFillYPositionEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16HTMLInputElement6detachEv
+__ZN7WebCore17HTMLOptionElement6detachEv
 __ZN7WebCore4Text16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore13CharacterData16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore4Node16rendererIsNeededEPNS_11RenderStyleE
 __ZNK7WebCore12RenderObject7isTableEv
 __ZNK7WebCore12RenderObject10isFrameSetEv
 __ZN7WebCore4Node16previousRendererEv
-__ZN7WebCore11HTMLElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore13inlineTagListEv
-__ZN7WebCore12blockTagListEv
-__ZN7WebCore13HTMLTokenizer12parseCommentERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore10HTMLParser23commentCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore7CommentC2EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore7Comment8nodeTypeEv
-__ZNK7WebCore7Comment13isCommentNodeEv
-__ZN7WebCore16tableConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLTableElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLTableElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLTableElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLTableElement11cellBordersEv
-__ZNK7WebCore6String5toIntEPb
-__ZN7WebCore10StringImpl5toIntEPb
-__ZN7WebCore21DeprecatedConstStringC2EPKNS_14DeprecatedCharEj
-__ZN7WebCore20DeprecatedStringDataC2EPNS_14DeprecatedCharEjj
-__ZN7WebCore16DeprecatedStringC2EPNS_20DeprecatedStringDataEb
-__ZN7WebCore21DeprecatedConstStringD2Ev
-__ZN7WebCore6String6numberEi
-__ZN7WebCore6String6formatEPKcz
-__ZN3WTF6VectorIcLm256EE4growEm
-__ZNK7WebCore16HTMLTableElement17endTagRequirementEv
-__ZNK7WebCore16HTMLTableElement11tagPriorityEv
-__ZN7WebCore16HTMLTableElement6attachEv
-__ZNK7WebCore16HTMLTableElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore16HTMLTableElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore17CSSPrimitiveValue18computeLengthShortEPNS_11RenderStyleE
-__ZN7WebCore11RenderTableC2EPNS_4NodeE
-__ZN3WTF6VectorIiLm0EE4fillERKim
-__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
-__ZSt4fillIPiiEvT_S1_RKT0_
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4fillERKS3_m
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE15reserveCapacityEm
-__ZSt4fillIPN7WebCore11RenderTable12ColumnStructES2_EvT_S4_RKT0_
-__ZN7WebCore11RenderTable8setStyleEPNS_11RenderStyleE
-__ZN7WebCore11RenderTable17updateFirstLetterEv
-__ZN7WebCore15AutoTableLayoutC2EPNS_11RenderTableE
-__ZN7WebCore16HTMLTableElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore16HTMLTableElement8checkDTDEPKNS_4NodeE
-__ZNK7WebCore11RenderTable7isTableEv
-__ZN7WebCore10HTMLParser22nestedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore19tableRowConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTableRowElementC2EPNS_8DocumentE
-__ZNK7WebCore19HTMLTableRowElement17endTagRequirementEv
-__ZNK7WebCore19HTMLTableRowElement11tagPriorityEv
-__ZN7WebCore14isTableSectionEPNS_4NodeE
-__ZN7WebCore23HTMLTableSectionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore23HTMLTableSectionElement11tagPriorityEv
-__ZNK7WebCore23HTMLTableSectionElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore23HTMLTableSectionElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore16HTMLTableElement19addSharedGroupDeclsEbRN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZNK7WebCore17CSSInheritedValue12cssValueTypeEv
-__ZN7WebCore18RenderTableSectionC2EPNS_4NodeE
-__ZN7WebCore18RenderTableSection8setStyleEPNS_11RenderStyleE
+__ZNK7WebCore12RenderObject14isRenderInlineEv
+__ZNK7WebCore7Element14getIDAttributeEv
+__ZN7WebCore7DataRefINS_12StyleBoxDataEE6accessEv
+__ZN7WebCore14ClassNamesData12createVectorEv
+__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEb
+__ZN7WebCore7DataRefINS_18StyleInheritedDataEE6accessEv
+__ZN7WebCore16HTMLImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderImageC1EPNS_4NodeE
+__ZN7WebCore11RenderImageC2EPNS_4NodeE
+__ZN7WebCore14RenderReplacedC2EPNS_4NodeERKNS_7IntSizeE
+__ZN7WebCore11RenderImage13updateAltTextEv
+__ZNK7WebCore16HTMLImageElement7altTextEv
+__ZN7WebCore14RenderReplaced14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore12RenderObject13isRenderBlockEv
-__ZNK7WebCore18RenderTableSection14isTableSectionEv
-__ZN7WebCore11RenderTable8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore10RenderFlow26dirtyLinesFromChangedChildEPNS_12RenderObjectE
-__ZN7WebCore23HTMLTableSectionElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore23HTMLTableSectionElement17endTagRequirementEv
-__ZN7WebCore23HTMLTableSectionElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore14RenderTableRowC2EPNS_4NodeE
-__ZN7WebCore14RenderTableRow8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderTableRow10isTableRowEv
-__ZN7WebCore14RenderTableRow13requiresLayerEv
-__ZN7WebCore18RenderTableSection8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore18RenderTableSection10ensureRowsEi
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE4fillERKS3_m
-__ZSt4fillIPN7WebCore18RenderTableSection10CellStructES2_EvT_S4_RKT0_
-__ZNK7WebCore12RenderObject14childrenInlineEv
-__ZN7WebCore19HTMLTableRowElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore19HTMLTableRowElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore10HTMLParser25tableCellCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZNK7WebCore4Font6ascentEv
-__ZNK7WebCore4Font7descentEv
+__ZNK7WebCore12RenderObject15virtualChildrenEv
+__ZN7WebCore11RenderBlock26dirtyLinesFromChangedChildEPNS_12RenderObjectE
+__ZN7WebCore17RenderLineBoxList26dirtyLinesFromChangedChildEPNS_12RenderObjectES2_
+__ZNK7WebCore11RenderImage7isImageEv
+__ZNK7WebCore11RenderImage8hasImageEv
+__ZN7WebCore11RenderImage14setCachedImageEPNS_11CachedImageE
+__ZN7WebCoreeqINS_11CachedImageES1_EEbRKNS_20CachedResourceHandleIT_EEPKT0_
+__ZNK7WebCore12RenderObject4isBREv
+__ZN7WebCore4Text14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10RenderTextC1EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore10RenderTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZNK7WebCore8Document31displayStringModifiedByEncodingEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore10RenderText15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore10RenderText14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkPseudoStateEPNS_7ElementEb
+__ZN7WebCore15visitedLinkHashERKNS_4KURLERKNS_12AtomicStringE
+__ZN7WebCore10visitedURLERKNS_4KURLERKNS_12AtomicStringERN3WTF6VectorItLm512EEE
+__ZN7WebCore9PageGroup13isLinkVisitedEy
+__ZN7WebCore9PageGroup14addVisitedLinkEPKtm
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E4findIyNS_22IdentityHashTranslato
+__ZNK7WebCore11CSSSelector9attributeEv
+__ZN7WebCoreL36htmlAttributeHasCaseInsensitiveValueERKNS_13QualifiedNameE
+__ZN7WebCoreL17addLocalNameToSetEPN3WTF7HashSetIPNS_16AtomicStringImplENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEERKNS_13Qualifi
+__ZN7WebCore10StringImpl11reverseFindEPS0_ib
+__ZN7WebCoregtERNS_11CSSRuleDataES1_
+__ZN7WebCore11CSSSelector11specificityEv
+__ZN7WebCore15StyleVisualDataC1ERKS0_
+__ZN7WebCore15StyleVisualDataC2ERKS0_
+__ZN7WebCore11RenderStyle15clearCursorListEv
+__ZN7WebCoreL19valueOrPropertyNameEi
+__Z12getValueNamet
+__ZN7WebCore12RenderInlineC1EPNS_4NodeE
+__ZN7WebCore12RenderInlineC2EPNS_4NodeE
+__ZN7WebCore12RenderInline14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderInline27updateBoxModelInfoFromStyleEv
+__ZNK7WebCore12RenderInline13requiresLayerEv
+__ZNK7WebCore12RenderInline18inlineContinuationEv
+__ZNK7WebCore12RenderInline15virtualChildrenEv
+__ZNK7WebCore16CSSStyleSelector14largerFontSizeEfb
+__ZN7WebCore12RenderInline8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline28addChildIgnoringContinuationEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline15virtualChildrenEv
+__ZN7WebCore12RenderInline26dirtyLinesFromChangedChildEPNS_12RenderObjectE
+__ZNK7WebCore15FontDescription12bolderWeightEv
+__ZN7WebCore16CSSStyleSelector24canShareStyleWithElementEPNS_4NodeE
+__ZN7WebCore13HTMLBRElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore8RenderBRC1EPNS_4NodeE
+__ZN7WebCore8RenderBRC2EPNS_4NodeE
+__ZN7WebCore8RenderBR14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore8RenderBR4isBREv
+__ZNK7WebCore16CSSStyleSelector15smallerFontSizeEfb
+__ZNK7WebCore12RenderObject22getUncachedPseudoStyleENS_8PseudoIdEPNS_11RenderStyleE
+__ZN7WebCore16CSSStyleSelector21pseudoStyleForElementENS_8PseudoIdEPNS_7ElementEPNS_11RenderStyleE
+__ZN7WebCore22CSSQuirkPrimitiveValue12isQuirkValueEv
+__ZN7WebCore17CSSPrimitiveValue18computeLengthShortEPNS_11RenderStyleEd
+__ZNK7WebCore12RenderInline14isRenderInlineEv
+__ZNK7WebCore10RenderText12originalTextEv
+__ZN7WebCore10RenderText7setTextEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore10RenderText15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZNK7WebCore12RenderObject9isSVGTextEv
+__ZN7WebCore15HTMLFormElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore11RenderBlock17deleteLineBoxTreeEv
+__ZN7WebCore17RenderLineBoxList17deleteLineBoxTreeEPNS_11RenderArenaE
+__ZNK7WebCore11RenderBlock20createAnonymousBlockEv
+__ZN7WebCoreL9moveChildEPNS_12RenderObjectEPNS_21RenderObjectChildListES1_S3_S1_
+__ZNK7WebCore12RenderObject17isSelectionBorderEv
+__ZN7WebCore9RenderBox21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore11RenderBlock11isBlockFlowEv
+__ZNK7WebCore14RenderThemeMac11systemColorEi
+__ZNK3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9
+__ZN3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3setERKiRKj
+__ZN3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9_
+__ZNK3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3getERKi
+__ZNK7WebCore22HTMLFormControlElement20isFormControlElementEv
+__ZN7WebCore19HTMLFieldSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderFieldsetC1EPNS_4NodeE
+__ZN7WebCore14RenderFieldsetC2EPNS_4NodeE
+__ZN7WebCore14RenderFieldset14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore14toInputElementEPNS_7ElementE
+__ZThn128_NK7WebCore16HTMLInputElement12isAutofilledEv
+__ZNK7WebCore16HTMLInputElement12isAutofilledEv
+__ZNK7WebCore14RenderThemeMac10systemFontEiRNS_15FontDescriptionE
+__ZN7WebCoreL12toFontWeightEl
+__ZN7WebCore11RenderStyle13setTextShadowEPNS_10ShadowDataEb
+__ZN7WebCore22StyleRareInheritedDataC1ERKS0_
+__ZN7WebCore22StyleRareInheritedDataC2ERKS0_
+__ZN7WebCore7DataRefINS_25StyleRareNonInheritedDataEE6accessEv
+__ZN7WebCore25StyleRareNonInheritedDataC1ERKS0_
+__ZN7WebCore25StyleRareNonInheritedDataC2ERKS0_
+__ZN7WebCore9FillLayeraSERKS0_
+__ZN7WebCore11RenderTheme11adjustStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementEbRKNS_10BorderDataERKNS_9FillLayer
+__ZNK7WebCore14RenderThemeMac15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
+__ZNK7WebCore14NinePieceImageeqERKS0_
+__ZN7WebCore11RenderStyle12setBoxShadowEPNS_10ShadowDataEb
+__ZNK7WebCore14RenderThemeMac20adjustTextFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore16HTMLInputElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLInputElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore27RenderTextControlSingleLineC1EPNS_4NodeE
+__ZN7WebCore27RenderTextControlSingleLineC2EPNS_4NodeE
+__ZN7WebCore17RenderTextControlC2EPNS_4NodeE
+__ZN7WebCore27RenderTextControlSingleLine14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore17RenderTextControl14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore17RenderTextControl15canHaveChildrenEv
+__ZN7WebCore27RenderTextControlSingleLine17updateFromElementEv
+__ZN7WebCore27RenderTextControlSingleLine21createSubtreeIfNeededEv
+__ZNK7WebCore27RenderTextControlSingleLine12inputElementEv
+__ZThn128_NK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZNK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZN7WebCore17RenderTextControl21createSubtreeIfNeededEPNS_23TextControlInnerElementE
+__ZN7WebCore27TextControlInnerTextElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore27TextControlInnerTextElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore23TextControlInnerElementC2EPNS_8DocumentEPNS_4NodeE
+__ZNK7WebCore27RenderTextControlSingleLine20createInnerTextStyleEPKNS_11RenderStyleE
+__ZNK7WebCore27RenderTextControlSingleLine26placeholderShouldBeVisibleEv
+__ZThn128_NK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZNK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZNK7WebCore17RenderTextControl20adjustInnerTextStyleEPKNS_11RenderStyleEPS1_
+__ZNK7WebCore22HTMLFormControlElement20isEnabledFormControlEv
+__ZNK7WebCore22HTMLFormControlElement8disabledEv
+__ZNK7WebCore22HTMLFormControlElement21isReadOnlyFormControlEv
+__ZN7WebCore9FontCache11getFontDataERKNS_4FontERiPNS_12FontSelectorE
+__ZN7WebCore15CSSFontSelector11getFontDataERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCore9FontCache25getCachedFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringEb
+__ZN7WebCore9FontCache12platformInitEv
+__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_PNS1_16FontPlatformDataEENS_18PairFirstExtractorIS6_EENS1_28F
+__ZN7WebCore9FontCache22createFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCoreL18toAppKitFontWeightENS_10FontWeightE
++[WebFontCache fontWithFamily:traits:weight:size:]
++[WebFontCache internalFontWithFamily:traits:weight:size:]
+__ZL16acceptableChoicemm
+__ZNK7WebCore14SimpleFontData9isLoadingEv
+__ZNK7WebCore11RenderBlock10lineHeightEbb
+__ZN7WebCore23TextControlInnerElement18attachInnerElementEPNS_4NodeEN3WTF10PassRefPtrINS_11RenderStyleEEEPNS_11RenderArenaE
+__ZN7WebCore27TextControlInnerTextElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore23TextControlInnerElement12isShadowNodeEv
+__ZN7WebCore23TextControlInnerElement16shadowParentNodeEv
+__ZNK7WebCore12RenderObject10isTextAreaEv
+__ZNK7WebCore11RenderLayer13isTransparentEv
+__ZNK7WebCore7Element19virtualNamespaceURIEv
+__ZN7WebCore11RenderLayer19dirtyNormalFlowListEv
+__ZNK7WebCore17RenderTextControl13isTextControlEv
+__ZN7WebCore9FrameView25scheduleRelayoutOfSubtreeEPNS_12RenderObjectE
+__ZN7WebCore17RenderTextControl17updateFromElementEv
+__ZNK7WebCore22HTMLFormControlElement31formControlValueMatchesRendererEv
+__ZThn128_NK7WebCore16HTMLInputElement5valueEv
+__ZNK7WebCore16HTMLInputElement5valueEv
+__ZN7WebCore17RenderTextControl17setInnerTextValueERKNS_6StringE
+__ZN7WebCore17RenderTextControl4textEv
+__ZNK7WebCore17RenderTextControl10finishTextERN3WTF6VectorItLm0EEE
+__ZN7WebCore11HTMLElement12setInnerTextERKNS_6StringERi
+__ZNK7WebCore4Node15rareDataFocusedEv
+__ZN7WebCore20StyleFlexibleBoxDataC1ERKS0_
+__ZN7WebCore20StyleFlexibleBoxDataC2ERKS0_
+__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleEd
+__ZNK7WebCore11RenderTheme15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
+__ZNK7WebCore9FillLayereqERKS0_
+__ZNK7WebCore14RenderThemeMac19adjustMenuListStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18controlSizeForFontEPNS_11RenderStyleE
+__ZN7WebCore11RenderStyle11resetBorderEv
+__ZN7WebCoreL19menuListButtonSizesEv
+__ZNK7WebCore14RenderThemeMac15setSizeFromFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac11sizeForFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEm
+__ZN7WebCore10FontFamilyD2Ev
+__ZN7WebCore17HTMLSelectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderMenuListC1EPNS_17HTMLSelectElementE
+__ZN7WebCore14RenderMenuListC2EPNS_17HTMLSelectElementE
+__ZN7WebCore17RenderFlexibleBoxC2EPNS_4NodeE
+__ZN7WebCore14RenderMenuList14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderMenuList15canHaveChildrenEv
+__ZN7WebCore14RenderMenuList18updateOptionsWidthEv
+__ZN7WebCore15toOptionElementEPNS_7ElementE
+__ZThn128_NK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZNK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZN7WebCore13OptionElement37collectOptionTextRespectingGroupLabelERKNS_17OptionElementDataEPNS_8DocumentE
+__ZN7WebCore20toOptionGroupElementEPNS_7ElementE
+__ZN7WebCore13OptionElement17collectOptionTextERKNS_17OptionElementDataEPNS_8DocumentE
+__ZNK7WebCore6String18simplifyWhiteSpaceEv
+__ZN7WebCore10StringImpl18simplifyWhiteSpaceEv
+__ZNK7WebCore11RenderTheme29popupOptionSupportsTextIndentEv
+__ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
+__ZNK3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
+__ZNK7WebCore17HTMLOptionElement8disabledEv
+__ZN7WebCore17HTMLOptionElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore14RenderMenuList17updateFromElementEv
+__ZNK7WebCore17HTMLSelectElement13selectedIndexEv
+__ZN7WebCore14RenderMenuList17setTextFromOptionEi
+__ZN7WebCore14RenderMenuList7setTextERKNS_6StringE
+__ZN7WebCore14RenderMenuList8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore14RenderMenuList16createInnerBlockEv
+__ZN7WebCore14RenderMenuList16adjustInnerStyleEv
+__ZNK7WebCore14RenderThemeMac24popupInternalPaddingLeftEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEm
+__ZNK7WebCore14RenderThemeMac25popupInternalPaddingRightEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac23popupInternalPaddingTopEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac26popupInternalPaddingBottomEPNS_11RenderStyleE
+__ZN7WebCore9PopupMenu29itemWritingDirectionIsNaturalEv
+__ZN7WebCore10StringImpl23defaultWritingDirectionEv
+__ZThn128_NK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZN7WebCoreL21convertNSColorToColorEP7NSColor
+__ZNK7WebCore8ThemeMac13controlBorderENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZNK7WebCore5Theme13controlBorderENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZNK7WebCore8ThemeMac14controlPaddingENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZNK7WebCore8ThemeMac28controlRequiresPreWhiteSpaceENS_11ControlPartE
+__ZNK7WebCore8ThemeMac11controlSizeENS_11ControlPartERKNS_4FontERKNS_10LengthSizeEf
+__ZN7WebCoreL11buttonSizesEv
+__ZN7WebCoreL12sizeFromFontERKNS_4FontERKNS_10LengthSizeEfPKNS_7IntSizeE
+__ZN7WebCoreL18controlSizeForFontERKNS_4FontE
+__ZNK7WebCore8ThemeMac18minimumControlSizeENS_11ControlPartERKNS_4FontEf
+__ZNK7WebCore8ThemeMac11controlFontENS_11ControlPartERKNS_4FontEf
+__ZN7WebCore12RenderButtonC1EPNS_4NodeE
+__ZN7WebCore12RenderButtonC2EPNS_4NodeE
+__ZN7WebCore12RenderButton15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderButton14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore12RenderButton15canHaveChildrenEv
+__ZNK7WebCore11RenderTheme9isDefaultEPKNS_12RenderObjectE
+__ZN7WebCore12RenderButton17updateFromElementEv
+__ZNK7WebCore16HTMLInputElement16valueWithDefaultEv
+__ZN7WebCore12RenderButton7setTextERKNS_6StringE
+__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplE
+__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplE
+__ZN7WebCore12RenderButton8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderButton15setupInnerStyleEPNS_11RenderStyleE
+__ZNK7WebCore11RenderTheme24buttonInternalPaddingTopEv
+__ZNK7WebCore11RenderTheme26buttonInternalPaddingRightEv
+__ZNK7WebCore11RenderTheme27buttonInternalPaddingBottomEv
+__ZNK7WebCore11RenderTheme25buttonInternalPaddingLeftEv
+__ZN7WebCore22StyleRareInheritedDataD1Ev
+__ZN7WebCore22StyleRareInheritedDataD2Ev
+__ZN7WebCore25StyleRareNonInheritedDataD1Ev
+__ZN7WebCore25StyleRareNonInheritedDataD2Ev
+__ZN7WebCore12RenderObject17updateFromElementEv
+__ZNK7WebCore18NamedMappedAttrMap14mapsEquivalentEPKS0_
+__ZNK7WebCore18NamedMappedAttrMap9declCountEv
+__ZN7WebCore8Document18minimumLayoutDelayEv
+__ZNK7WebCore8Document11elapsedTimeEv
+__ZN7WebCore13HTMLTokenizer35executeScriptsWaitingForStylesheetsEv
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE6shrinkEm
+__ZN7WebCore14CachedResource6finishEv
+__ZN7WebCore7RequestD1Ev
+__ZN7WebCore7RequestD2Ev
+__ZN7WebCore11FrameLoader8loadDoneEv
+__ZN7WebCore9DocLoader23checkForPendingPreloadsEv
+__ZN7WebCore14DocumentLoader23removeSubresourceLoaderEPNS_14ResourceLoaderE
+__ZN7WebCore17SubresourceLoaderD0Ev
+__ZN7WebCore11CachedImage4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore11CachedImage23maximumDecodedImageSizeEv
+__ZNK7WebCore11CachedImage9imageSizeEf
+__ZNK7WebCore11BitmapImage4sizeEv
+__ZNK7WebCore11ImageSource4sizeEv
+__ZNK7WebCore11ImageSource16frameSizeAtIndexEm
+__ZN7WebCore11CachedImage15notifyObserversEPKNS_7IntRectE
+__ZN7WebCore12RenderObject12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
+__ZN7WebCore11RenderImage12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore11RenderImage8imagePtrEv
+__ZNK7WebCore11RenderImage13errorOccurredEv
 __ZNK7WebCore14RenderReplaced13intrinsicSizeEv
+__ZNK7WebCore11RenderImage9imageSizeEf
 __ZN7WebCore14RenderReplaced16setIntrinsicSizeERKNS_7IntSizeE
-__ZNK7WebCore11CachedImage9imageSizeEv
+__ZNK7WebCore12RenderObject15containingBlockEv
+__ZNK7WebCore12RenderObject7isMediaEv
+__ZNK7WebCore12RenderObject14isSVGContainerEv
 __ZN7WebCore9RenderBox9calcWidthEv
 __ZNK7WebCore9FrameView10layoutRootEb
-__ZNK7WebCore9FrameView13layoutPendingEv
 __ZNK7WebCore12RenderObject13isFlexibleBoxEv
 __ZNK7WebCore9RenderBox29shouldCalculateSizeAsReplacedEv
 __ZNK7WebCore12RenderObject26isInlineBlockOrInlineTableEv
-__ZNK7WebCore11RenderImage17calcReplacedWidthEv
+__ZNK7WebCore11RenderImage17calcReplacedWidthEb
+__ZNK7WebCore11RenderImage21imageHasRelativeWidthEv
 __ZNK7WebCore11CachedImage21imageHasRelativeWidthEv
+__ZNK7WebCore5Image16hasRelativeWidthEv
 __ZNK7WebCore11RenderImage16isWidthSpecifiedEv
 __ZNK7WebCore9RenderBox22calcReplacedWidthUsingENS_6LengthE
 __ZNK7WebCore9RenderBox19calcContentBoxWidthEi
-__ZNK7WebCore9RenderBox20containingBlockWidthEv
-__ZNK7WebCore12RenderObject19shrinkToAvoidFloatsEv
+__ZNK7WebCore9RenderBox30containingBlockWidthForContentEv
+__ZNK7WebCore9RenderBox19shrinkToAvoidFloatsEv
 __ZNK7WebCore12RenderObject13isHTMLMarqueeEv
 __ZNK7WebCore11RenderBlock14availableWidthEv
-__ZNK7WebCore12RenderObject11clientWidthEv
-__ZNK7WebCore9RenderBox5widthEv
-__ZNK7WebCore15RenderTableCell10borderLeftEv
-__ZNK7WebCore15RenderTableCell11borderRightEv
-__ZNK7WebCore12RenderObject22verticalScrollbarWidthEv
-__ZNK7WebCore12RenderObject11paddingLeftEv
-__ZNK7WebCore12RenderObject12paddingRightEv
+__ZNK7WebCore9RenderBox11clientWidthEv
+__ZNK7WebCore20RenderBoxModelObject10borderLeftEv
+__ZNK7WebCore20RenderBoxModelObject11borderRightEv
+__ZNK7WebCore9RenderBox22verticalScrollbarWidthEv
+__ZNK7WebCore20RenderBoxModelObject11paddingLeftEb
+__ZNK7WebCore20RenderBoxModelObject12paddingRightEb
 __ZNK7WebCore9RenderBox12minPrefWidthEv
 __ZN7WebCore11RenderImage14calcPrefWidthsEv
-__ZNK7WebCore12RenderObject10borderLeftEv
-__ZNK7WebCore12RenderObject11borderRightEv
 __ZN7WebCore9RenderBox10calcHeightEv
 __ZN7WebCore9RenderBox19calcVerticalMarginsEv
 __ZNK7WebCore11RenderImage18calcReplacedHeightEv
 __ZNK7WebCore11RenderImage17isHeightSpecifiedEv
 __ZNK7WebCore9RenderBox23calcReplacedHeightUsingENS_6LengthE
 __ZNK7WebCore9RenderBox20calcContentBoxHeightEi
-__ZNK7WebCore12RenderObject9borderTopEv
-__ZNK7WebCore12RenderObject12borderBottomEv
-__ZNK7WebCore12RenderObject10paddingTopEv
-__ZNK7WebCore12RenderObject13paddingBottomEv
-__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE6shrinkEm
+__ZNK7WebCore20RenderBoxModelObject9borderTopEv
+__ZNK7WebCore20RenderBoxModelObject12borderBottomEv
+__ZNK7WebCore20RenderBoxModelObject10paddingTopEb
+__ZNK7WebCore20RenderBoxModelObject13paddingBottomEb
+__ZN7WebCore20CachedResourceClient12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
+-[WebCoreSharedBufferData dealloc]
+-[WebCoreSharedBufferData .cxx_destruct]
+__ZNK7WebCore9RenderBox12clientHeightEv
+__ZNK7WebCore9RenderBox25horizontalScrollbarHeightEv
+__ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
+__ZNK7WebCore12RenderObject11isBlockFlowEv
+__ZN7WebCore12RenderInline21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
 __ZN7WebCore11CachedImage11checkNotifyEv
+__ZN7WebCore11RenderImage14notifyFinishedEPNS_14CachedResourceE
 __ZN7WebCore15HTMLImageLoader14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore8Document26dispatchImageLoadEventSoonEPNS_15HTMLImageLoaderE
-__ZN7WebCore20CachedResourceClient14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore11FrameLoader8loadDoneEv
-__ZN7WebCore5Cache6removeEPNS_14CachedResourceE
-__ZN7WebCore5Cache34removeFromLiveDecodedResourcesListEPNS_14CachedResourceE
-__ZNK7WebCore9DocLoader20removeCachedResourceEPNS_14CachedResourceE
-__ZN7WebCore7RequestD2Ev
-__ZN7WebCore14DocumentLoader23removeSubresourceLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore14ResourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader13didFailToLoadEPNS_14ResourceLoaderERKNS_13ResourceErrorE
-__ZNK7WebCore13ResourceErrorcvP7NSErrorEv
-__ZN7WebCore9RenderBox12imageChangedEPNS_11CachedImageE
-__ZNK7WebCore12RenderObject12avoidsFloatsEv
-__ZNK7WebCore9RenderBox28stretchesToMinIntrinsicWidthEv
-__ZN7WebCore9RenderBox21calcHorizontalMarginsERKNS_6LengthES3_i
-__ZNK7WebCore11CachedImage22usesImageContainerSizeEv
-__ZNK7WebCore11RenderImage20calcAspectRatioWidthEv
-__ZNK7WebCore11CachedImage22imageHasRelativeHeightEv
-__ZNK7WebCore11RenderImage21calcAspectRatioHeightEv
-__ZNK7WebCore9Tokenizer10wellFormedEv
-__ZN7WebCore8Document26dispatchImageLoadEventsNowEv
-__ZN7WebCore9TimerBase10heapPopMinEv
-__ZSt13__adjust_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE6shrinkEm
-__ZN7WebCore21DeprecatedPtrListImpl6assignERKS0_b
-__ZN7WebCore21DeprecatedPtrListImpl4swapERS0_
-__ZN7WebCore15HTMLImageLoader17dispatchLoadEventEv
-__ZN7WebCore15EventTargetNode17dispatchHTMLEventERKNS_12AtomicStringEbb
-__ZN7WebCore8KJSProxy17finishedWithEventEPNS_5EventE
-__ZN3KJS17ScriptInterpreter15forgetDOMObjectEPv
-__ZN3KJS10domObjectsEv
-__ZN3WTF7HashMapIPvPN3KJS9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE4takeERKS1_
-__ZThn36_N7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore15HTMLFormElement17handleLocalEventsEPNS_5EventEb
-__ZThn36_N7WebCore15EventTargetNode6toNodeEv
-__ZN7WebCore15EventTargetNode6toNodeEv
-__ZThn36_N7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore16HTMLInputElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore5Event12isMouseEventEv
-__ZNK7WebCore5Event25isBeforeTextInsertedEventEv
-__ZN7WebCore11FrameLoader19handledOnloadEventsEv
+__ZN7WebCore11ImageLoader14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCoreL15loadEventSenderEv
+__ZN7WebCore20ImageLoadEventSenderC1Ev
+__ZN7WebCore20ImageLoadEventSenderC2Ev
+__ZN7WebCore20ImageLoadEventSender21dispatchLoadEventSoonEPNS_11ImageLoaderE
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE15reserveCapacityEm
+__ZN7WebCore5TimerINS_9FrameViewEE5firedEv
+__ZN7WebCore9FrameView16layoutTimerFiredEPNS_5TimerIS0_EE
 __ZN7WebCore9FrameView6layoutEb
-__ZN7WebCore15stopSharedTimerEv
+__ZNK7WebCore16CSSStyleSelector24affectedByViewportChangeEv
 __ZNK7WebCore5Frame18needsReapplyStylesEv
 __ZN7WebCore5Frame13reapplyStylesEv
 __ZN7WebCore5Frame17setUserStyleSheetERKNS_6StringE
 __ZN7WebCore8Document17setUserStyleSheetERKNS_6StringE
-__ZN7WebCore4Node11recalcStyleENS0_11StyleChangeE
-__ZN7WebCore10RenderText7setTextEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore11CSSRuleDataD2Ev
+__ZNK7WebCore19StyleBackgroundDataeqERKS0_
+__ZNK7WebCore17StyleSurroundDataeqERKS0_
+__ZN7WebCore15StyleVisualDataD1Ev
+__ZNK7WebCore25StyleRareNonInheritedDataeqERKS0_
+__ZN3WTFeqIN7WebCore20StyleDashboardRegionELm0EEEbRKNS_6VectorIT_XT0_EEES7_
+__ZNK7WebCore25StyleRareNonInheritedData20shadowDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData24reflectionDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData23animationDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData24transitionDataEquivalentERKS0_
+__ZNK7WebCore22StyleRareInheritedDataeqERKS0_
+__ZNK7WebCore22StyleRareInheritedData20shadowDataEquivalentERKS0_
+__ZNK7WebCore20StyleFlexibleBoxDataeqERKS0_
 __ZN7WebCore9FrameView23applyOverflowToViewportEPNS_12RenderObjectERNS_13ScrollbarModeES4_
-__ZNK7WebCore10ScrollView14vScrollbarModeEv
-__ZNK7WebCore6Widget6heightEv
-__ZNK7WebCore6Widget13frameGeometryEv
+__ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore6Widget12getOuterViewEv
-__ZN7WebCore16enclosingIntRectERK7_NSRect
-__ZNK7WebCore6Widget5widthEv
-__ZN7WebCore10ScrollView17setVScrollbarModeENS_13ScrollbarModeE
-__ZN7WebCore10ScrollView17setHScrollbarModeENS_13ScrollbarModeE
-__ZNK7WebCore10ScrollView13visibleHeightEv
-__ZNK7WebCore10ScrollView12visibleWidthEv
-__ZN7WebCore9FrameView20pauseScheduledEventsEv
+__ZN7WebCore10ScrollView25platformSetScrollbarModesEv
+__ZNK7WebCore10ScrollView12layoutHeightEv
+__ZNK7WebCore10ScrollView11layoutWidthEv
+__ZN7WebCore9FrameView21beginDeferredRepaintsEv
 __ZN7WebCore10RenderView6layoutEv
-__ZN7WebCore12RenderObject19setChildNeedsLayoutEbb
+__ZNK7WebCore10RenderView9viewWidthEv
+__ZNK7WebCore10ScrollView14useFixedLayoutEv
 __ZN7WebCore11RenderBlock6layoutEv
 __ZN7WebCore11RenderBlock11layoutBlockEb
 __ZN7WebCore11RenderBlock27layoutOnlyPositionedObjectsEv
-__ZNK7WebCore12RenderObject27checkForRepaintDuringLayoutEv
-__ZNK7WebCore9FrameView16needsFullRepaintEv
 __ZNK7WebCore11RenderBlock18desiredColumnWidthEv
 __ZN7WebCore10RenderView9calcWidthEv
 __ZN7WebCore11RenderBlock15calcColumnWidthEv
 __ZN7WebCore11RenderBlock29setDesiredColumnCountAndWidthEii
 __ZN7WebCore11RenderBlock11clearFloatsEv
 __ZNK7WebCore11RenderBlock12avoidsFloatsEv
+__ZNK7WebCore9RenderBox12avoidsFloatsEv
 __ZNK7WebCore12RenderObject4isHREv
 __ZN7WebCore11RenderBlock19layoutBlockChildrenEbRi
-__ZNK7WebCore12RenderObject25horizontalScrollbarHeightEv
+__ZN7WebCore11RenderBlock10MarginInfoC1EPS0_ii
 __ZN7WebCore11RenderBlock10MarginInfoC2EPS0_ii
 __ZN7WebCore11RenderBlock12layoutLegendEb
 __ZNK7WebCore9RenderBox9marginTopEv
-__ZN7WebCore11RenderBlock18handleSpecialChildEPNS_12RenderObjectERKNS0_10MarginInfoERNS0_11CompactInfoERb
-__ZN7WebCore11RenderBlock21handlePositionedChildEPNS_12RenderObjectERKNS0_10MarginInfoERb
-__ZN7WebCore11RenderBlock19handleFloatingChildEPNS_12RenderObjectERKNS0_10MarginInfoERb
-__ZN7WebCore11RenderBlock18handleCompactChildEPNS_12RenderObjectERNS0_11CompactInfoERb
-__ZN7WebCore11RenderBlock16handleRunInChildEPNS_12RenderObjectERb
-__ZN7WebCore11RenderBlock24estimateVerticalPositionEPNS_12RenderObjectERKNS0_10MarginInfoE
-__ZN7WebCore9RenderBox6setPosEii
+__ZN7WebCore11RenderBlock18handleSpecialChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock21handlePositionedChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock19handleFloatingChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock16handleRunInChildEPNS_9RenderBoxERb
+__ZN7WebCore11RenderBlock24estimateVerticalPositionEPNS_9RenderBoxERKNS0_10MarginInfoE
+__ZN7WebCore11RenderBlock13getClearDeltaEPNS_9RenderBoxEi
 __ZNK7WebCore11RenderBlock11floatBottomEv
 __ZN7WebCore9RenderBox14calcWidthUsingENS_9WidthTypeEi
 __ZNK7WebCore9RenderBox21sizesToIntrinsicWidthENS_9WidthTypeE
 __ZNK7WebCore11RenderBlock26isInlineBlockOrInlineTableEv
 __ZNK7WebCore9RenderBox18calcBorderBoxWidthEi
+__ZNK7WebCore9RenderBox28stretchesToMinIntrinsicWidthEv
 __ZNK7WebCore11RenderBlock12maxTopMarginEb
-__ZNK7WebCore11RenderTable12avoidsFloatsEv
-__ZN7WebCore11RenderTable6layoutEv
-__ZN7WebCore11RenderTable9calcWidthEv
-__ZN7WebCore11RenderTable14calcPrefWidthsEv
-__ZN7WebCore11RenderTable23recalcHorizontalBordersEv
-__ZNK7WebCore11RenderTable14calcBorderLeftEv
-__ZNK7WebCore11RenderTable15calcBorderRightEv
-__ZN7WebCore15AutoTableLayout14calcPrefWidthsERiS1_
-__ZN7WebCore15AutoTableLayout10fullRecalcEv
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6resizeEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE4fillERKS3_m
-__ZSt4fillIPN7WebCore15AutoTableLayout6LayoutES2_EvT_S4_RKT0_
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4fillERKS3_m
-__ZSt4fillIPPN7WebCore15RenderTableCellES2_EvT_S4_RKT0_
-__ZN7WebCore15AutoTableLayout12recalcColumnEi
-__ZN7WebCore15RenderTableCell14calcPrefWidthsEv
-__ZN7WebCore11RenderBlock14calcPrefWidthsEv
-__ZN7WebCore11RenderBlock20calcInlinePrefWidthsEv
-__ZNK7WebCore11RenderTable10borderLeftEv
-__ZNK7WebCore11RenderTable11borderRightEv
-__ZN7WebCore20InlineMinMaxIterator4nextEv
-__ZNK7WebCore12RenderObject12isInlineFlowEv
-__ZNK7WebCore12RenderObject14isRenderInlineEv
-__ZNK7WebCore9RenderBox12maxPrefWidthEv
-__ZNK7WebCore15RenderTableCell15styleOrColWidthEv
-__ZN7WebCore11RenderBlock19calcBlockPrefWidthsEv
-__ZN7WebCore15AutoTableLayout18calcEffectiveWidthEv
-__ZN7WebCore15AutoTableLayout6layoutEv
-__ZN7WebCore11RenderTable13setCellWidthsEv
-__ZN7WebCore18RenderTableSection13setCellWidthsEv
-__ZN7WebCore15RenderTableCell8setWidthEi
-__ZN7WebCore15RenderContainer6layoutEv
-__ZN7WebCore14RenderTableRow6layoutEv
-__ZN7WebCore15RenderTableCell6layoutEv
-__ZNK7WebCore15RenderTableCell4yPosEv
-__ZN7WebCore15RenderTableCell9calcWidthEv
+__ZN7WebCore9RenderBox21calcHorizontalMarginsERKNS_6LengthES3_i
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore11RenderBlock14FloatingObjectEKNS_7HashMapIPNS1_12RenderObjectES4_NS_7PtrHashIS7_EENS_
+__ZN7WebCore11RenderBlock29markLinesDirtyInVerticalRangeEii
 __ZN7WebCore11RenderBlock20layoutInlineChildrenEbRiS1_
-__ZNK7WebCore15RenderTableCell9borderTopEv
-__ZNK7WebCore15RenderTableCell12borderBottomEv
-__ZN7WebCore9bidiFirstEPNS_11RenderBlockERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEEb
+__ZN7WebCoreL9bidiFirstEPNS_11RenderBlockEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEb
+__ZNK7WebCore9RenderBox12marginBottomEv
+__ZNK7WebCore9RenderBox10marginLeftEv
+__ZNK7WebCore9RenderBox11marginRightEv
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE15reserveCapacityEm
+__ZN7WebCore9RenderBox14dirtyLineBoxesEb
 __ZN7WebCore14RenderReplaced6layoutEv
+__ZNK7WebCore12RenderObject27checkForRepaintDuringLayoutEv
 __ZNK7WebCore11RenderImage21minimumReplacedHeightEv
-__ZN7WebCore14RenderReplaced26adjustOverflowForBoxShadowEv
-__ZN7WebCore8bidiNextEPNS_11RenderBlockEPNS_12RenderObjectERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEEbPb
-__ZN7WebCore11RenderBlock22determineStartPositionEbRNS_12BidiIteratorERNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZN7WebCore11RenderBlock17findNextLineBreakERNS_12BidiIteratorERNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZN7WebCore11RenderBlock14skipWhitespaceERNS_12BidiIteratorERNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZNK7WebCore11RenderBlock9lineWidthEi
+__ZN7WebCore14RenderReplaced36adjustOverflowForBoxShadowAndReflectEv
+__ZNK7WebCore12RenderObject9isCounterEv
+__ZN7WebCore10RenderText14dirtyLineBoxesEb
+__ZN7WebCore10RenderText15deleteTextBoxesEv
+__ZN7WebCore11RenderBlock22determineStartPositionERbS1_RNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERN3WTF6VectorINS0_1
+__ZN7WebCore11BidiContext6createEhN3WTF7Unicode9DirectionEbPS0_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE23commitExplicitEmbeddingEv
+__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE14shrinkCapacityEm
+__ZN7WebCore11RenderBlock17findNextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEbPNS_6EClearE
+__ZN7WebCore11RenderBlock21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEb
+__ZNK7WebCore11RenderBlock9lineWidthEib
 __ZNK7WebCore11RenderBlock11rightOffsetEv
 __ZNK7WebCore11RenderBlock14rightRelOffsetEiibPi
 __ZNK7WebCore11RenderBlock10leftOffsetEv
 __ZNK7WebCore11RenderBlock13leftRelOffsetEiibPi
-__ZN7WebCore11RenderBlock20insertFloatingObjectEPNS_12RenderObjectE
-__ZNK7WebCore9RenderBox10marginLeftEv
-__ZNK7WebCore9RenderBox11marginRightEv
-__ZN7WebCore11RenderBlock17positionNewFloatsEv
-__ZN7WebCore21DeprecatedPtrListImpl4lastEv
-__ZNK7WebCore21DeprecatedPtrListImpl7getPrevEv
-__ZNK7WebCore9RenderBox12marginBottomEv
-__ZN7WebCore21DeprecatedPtrListImpl4nextEv
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE10deleteRunsEv
-__ZN7WebCore11RenderBlock21checkLinesForOverflowEv
-__ZNK7WebCore11RenderBlock14hasLineIfEmptyEv
-__ZNK7WebCore11HTMLElement17isContentEditableEv
-__ZNK7WebCore5Frame17isContentEditableEv
-__ZNK7WebCore6Editor16clientIsEditableEv
-__ZNK7WebCore8Document12inDesignModeEv
-__ZNK7WebCore8Document14parentDocumentEv
-__ZN7WebCore11RenderBlock13layoutColumnsEi
-__ZN7WebCore11RenderBlock20hasOverhangingFloatsEv
-__ZNK7WebCore15RenderTableCell33expandsToEncloseOverhangingFloatsEv
-__ZNK7WebCore12RenderObject14hasControlClipEv
-__ZNK7WebCore11RenderBlock9floatRectEv
-__ZNK7WebCore14RenderReplaced12overflowRectEb
-__ZNK7WebCore9RenderBox9borderBoxEv
-__ZN7WebCore7IntRect5uniteERKS0_
-__ZN7WebCore11RenderBlock17addVisualOverflowERKNS_7IntRectE
-__ZN7WebCore11RenderBlock23layoutPositionedObjectsEb
-__ZN7WebCore11RenderBlock18positionListMarkerEv
-__ZN7WebCore9RenderBox14dirtyLineBoxesEbb
-__ZNK7WebCore12BidiIterator7currentEv
-__ZN7WebCore11inlineWidthEPNS_12RenderObjectEbb
-__ZN7WebCore11RenderBlock15bidiReorderLineERKNS_12BidiIteratorES3_RNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE21createBidiRunsForLineERKS1_S5_bb
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE9appendRunEv
+__ZN7WebCoreL11inlineWidthEPNS_12RenderObjectEbb
+__ZNK7WebCore4Font12isFixedPitchEv
+__ZNK7WebCore16FontFallbackList14determinePitchEPKNS_4FontE
+__ZNK7WebCore10RenderText11isWordBreakEv
+__ZNK7WebCore10RenderText5widthEjjRKNS_4FontEiPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTraitsIS8_EEEE
+__ZNK7WebCore10RenderText12maxPrefWidthEv
+__ZN7WebCore10RenderText14calcPrefWidthsEi
+__ZN7WebCore10RenderText14calcPrefWidthsEiRN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZN7WebCore21nextBreakablePositionEPKtiib
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deall
+__ZN7WebCoreL14checkMidpointsERNS_14InlineIteratorE
+__ZN7WebCoreL11addMidpointERKNS_14InlineIteratorE
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE15reserveCapacityEm
+__ZN7WebCore11RenderBlock15bidiReorderLineERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE21createBidiRunsForLineERKS1_bb
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE9appendRunEv
 __ZNK7WebCore12RenderObject6lengthEv
-__ZN7WebCore19appendRunsForObjectEiiPNS_12RenderObjectERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEE
+__ZN7WebCoreL19appendRunsForObjectEiiPNS_12RenderObjectERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEE
 __ZN7WebCore7BidiRunnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock13constructLineERKNS_12BidiIteratorES3_
-__ZN7WebCore12RenderObject15createInlineBoxEbbb
+__ZNK7WebCore10RenderText6lengthEv
+__ZN7WebCore11RenderBlock13constructLineEjPNS_7BidiRunES2_bbPNS_12RenderObjectE
+__ZN7WebCore9RenderBox15createInlineBoxEv
 __ZN7WebCore9InlineBoxnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock15createLineBoxesEPNS_12RenderObjectE
-__ZN7WebCore10RenderFlow15createInlineBoxEbbb
+__ZN7WebCore11RenderBlock15createLineBoxesEPNS_12RenderObjectEb
+__ZN7WebCore11RenderBlock19createRootInlineBoxEv
+__ZN7WebCore11RenderBlock13createRootBoxEv
+__ZN7WebCore17RenderLineBoxList13appendLineBoxEPNS_13InlineFlowBoxE
 __ZN7WebCore13InlineFlowBox9addToLineEPNS_9InlineBoxE
-__ZNK7WebCore9InlineBox6isTextEv
-__ZNK7WebCore14RenderReplaced14selectionStateEv
 __ZN7WebCore9InlineBox15isInlineTextBoxEv
 __ZN7WebCore13InlineFlowBox28determineSpacingForFlowBoxesEbPNS_12RenderObjectE
-__ZN7WebCore9InlineBox15isInlineFlowBoxEv
+__ZNK7WebCore9InlineBox15isInlineFlowBoxEv
 __ZN7WebCore13InlineFlowBox14setConstructedEv
 __ZN7WebCore9InlineBox14setConstructedEv
-__ZN7WebCore11RenderBlock33computeHorizontalPositionsForLineEPNS_13RootInlineBoxEb
+__ZN7WebCore11RenderBlock33computeHorizontalPositionsForLineEPNS_13RootInlineBoxEbPNS_7BidiRunES4_b
 __ZN7WebCore13InlineFlowBox19getFlowSpacingWidthEv
-__ZN7WebCore13InlineFlowBox23marginBorderPaddingLeftEv
-__ZN7WebCore13InlineFlowBox10marginLeftEv
-__ZN7WebCore13InlineFlowBox24marginBorderPaddingRightEv
-__ZN7WebCore13InlineFlowBox11marginRightEv
 __ZNK7WebCore9InlineBox11isLineBreakEv
 __ZN7WebCore13InlineFlowBox22placeBoxesHorizontallyEiRiS1_Rb
 __ZNK7WebCore14RenderReplaced12overflowLeftEb
 __ZNK7WebCore14RenderReplaced13overflowWidthEb
-__ZN7WebCore11RenderBlock31computeVerticalPositionsForLineEPNS_13RootInlineBoxE
-__ZN7WebCore13InlineFlowBox20verticallyAlignBoxesERi
+__ZN7WebCore11RenderBlock31computeVerticalPositionsForLineEPNS_13RootInlineBoxEPNS_7BidiRunE
+__ZN7WebCore13InlineFlowBox20verticallyAlignBoxesEi
 __ZN7WebCore13InlineFlowBox24computeLogicalBoxHeightsERiS1_S1_S1_b
-__ZN7WebCore13RootInlineBox15isRootInlineBoxEv
+__ZNK7WebCore13RootInlineBox15isRootInlineBoxEv
 __ZNK7WebCore11RenderBlock16baselinePositionEbb
 __ZNK7WebCore12RenderObject16baselinePositionEbb
 __ZNK7WebCore14RenderReplaced10lineHeightEbb
 __ZNK7WebCore14RenderReplaced16baselinePositionEbb
-__ZNK7WebCore12RenderObject20verticalPositionHintEb
-__ZNK7WebCore12RenderObject19getVerticalPositionEb
+__ZNK7WebCore20RenderBoxModelObject16verticalPositionEb
 __ZN7WebCore13InlineFlowBox20placeBoxesVerticallyEiiibRiS1_S1_S1_
 __ZNK7WebCore14RenderReplaced11overflowTopEb
 __ZNK7WebCore14RenderReplaced14overflowHeightEb
+__ZNK7WebCore9InlineBox6heightEv
 __ZN7WebCore13RootInlineBox28setVerticalOverflowPositionsEii
 __ZN7WebCore13RootInlineBox8OverflownwEmPNS_11RenderArenaE
 __ZN7WebCore13RootInlineBox29setVerticalSelectionPositionsEii
-__ZN7WebCore13InlineFlowBox29shrinkBoxesWithNoTextChildrenEii
-__ZN7WebCore13RootInlineBox14bottomOverflowEv
-__ZN7WebCore9RenderBox8positionEPNS_9InlineBoxE
+__ZNK7WebCore13RootInlineBox14bottomOverflowEv
+__ZN7WebCore9RenderBox15positionLineBoxEPNS_9InlineBoxE
 __ZN7WebCore13RootInlineBox36computePerCharacterLayoutInformationEv
-__ZN7WebCore7BidiRun7destroyEPNS_11RenderArenaE
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE10deleteRunsEv
+__ZN7WebCore7BidiRun7destroyEv
 __ZN7WebCore7BidiRundlEPvm
 __ZN7WebCore13RootInlineBox16setLineBreakInfoEPNS_12RenderObjectEjRKNS_10BidiStatusE
-__ZN7WebCore11RenderBlock7newLineEv
-__ZN7WebCore13RootInlineBox12leftOverflowEv
-__ZN7WebCore13RootInlineBox11topOverflowEv
-__ZN7WebCore13RootInlineBox13rightOverflowEv
-__ZN7WebCore18RenderTableSection13calcRowHeightEv
-__ZN3WTF6VectorIiLm0EE6resizeEm
-__ZNK7WebCore9RenderBox12overrideSizeEv
-__ZN7WebCore18RenderTableSection10layoutRowsEi
-__ZN7WebCore9RenderBox8setWidthEi
-__ZN7WebCore9RenderBox9setHeightEi
-__ZNK7WebCore15RenderTableCell14borderTopExtraEv
-__ZNK7WebCore15RenderTableCell17borderBottomExtraEv
-__ZNK7WebCore11RenderTable9borderTopEv
-__ZNK7WebCore11RenderTable12borderBottomEv
-__ZNK7WebCore18RenderTableSection12overflowLeftEb
-__ZNK7WebCore18RenderTableSection13overflowWidthEb
-__ZNK7WebCore18RenderTableSection11overflowTopEb
-__ZNK7WebCore18RenderTableSection14overflowHeightEb
-__ZNK7WebCore11RenderTable12sectionBelowEPKNS_18RenderTableSectionEb
-__ZN7WebCore11RenderBlock15collapseMarginsEPNS_12RenderObjectERNS0_10MarginInfoEi
+__ZN7WebCore11RenderBlock7newLineENS_6EClearE
+__ZN7WebCore11RenderBlock17positionNewFloatsEv
+__ZN7WebCore11RenderBlock21checkLinesForOverflowEv
+__ZNK7WebCore13RootInlineBox12leftOverflowEv
+__ZNK7WebCore13RootInlineBox11topOverflowEv
+__ZNK7WebCore13RootInlineBox13rightOverflowEv
+__ZN7WebCore11RenderBlock13layoutColumnsEi
+__ZN7WebCore9RenderBox15calcHeightUsingERKNS_6LengthE
+__ZNK7WebCore9RenderBox19calcBorderBoxHeightEi
+__ZN7WebCore11RenderBlock23layoutPositionedObjectsEb
+__ZN7WebCore11RenderBlock18positionListMarkerEv
+__ZNK7WebCore9RenderBox14hasControlClipEv
+__ZN7WebCore11RenderBlock15collapseMarginsEPNS_9RenderBoxERNS0_10MarginInfoE
 __ZNK7WebCore11RenderBlock21isSelfCollapsingBlockEv
-__ZNK7WebCore11RenderBlock16isTopMarginQuirkEv
+__ZN7WebCore11RenderBlock16setMaxTopMarginsEii
 __ZNK7WebCore11RenderBlock15maxBottomMarginEb
-__ZN7WebCore11RenderBlock19clearFloatsIfNeededEPNS_12RenderObjectERNS0_10MarginInfoEii
-__ZN7WebCore11RenderBlock13getClearDeltaEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock14containsFloatsEv
-__ZN7WebCore11RenderBlock27determineHorizontalPositionEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock20addOverhangingFloatsEPS0_iib
-__ZN7WebCore11RenderBlock21insertCompactIfNeededEPNS_12RenderObjectERNS0_11CompactInfoE
+__ZN7WebCore11RenderBlock19clearFloatsIfNeededEPNS_9RenderBoxERNS0_10MarginInfoEiii
+__ZN7WebCore11RenderBlock27determineHorizontalPositionEPNS_9RenderBoxE
+__ZNK7WebCore20RenderBoxModelObject20hasSelfPaintingLayerEv
+__ZN7WebCore11RenderBlock22insertPositionedObjectEPNS_9RenderBoxE
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore9RenderBoxEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunction
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZNK7WebCore11RenderBlock14hasLineIfEmptyEv
+__ZNK7WebCore11HTMLElement17isContentEditableEv
+__ZN7WebCore9RenderBox22calcAbsoluteHorizontalEv
+__ZNK7WebCore9RenderBox33containingBlockWidthForPositionedEPKNS_20RenderBoxModelObjectE
+__ZN7WebCore9RenderBox28calcAbsoluteHorizontalValuesENS_6LengthEPKNS_20RenderBoxModelObjectENS_13TextDirectionEiiS1_S1_S1_S1_Ri
+__ZN7WebCoreL24fontDataForGenericFamilyEPNS_8DocumentERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCoreeqERKNS_12AtomicStringEPKc
 __ZN7WebCore11RenderBlock19handleBottomOfBlockEiiRNS0_10MarginInfoE
 __ZN7WebCore11RenderBlock24setCollapsedBottomMarginERKNS0_10MarginInfoE
-__ZN7WebCore11RenderBlock16setMaxTopMarginsEii
-__ZN7WebCore10RenderText14dirtyLineBoxesEbb
-__ZNK7WebCore10RenderText6lengthEv
-__ZN7WebCore8RenderBR15createInlineBoxEbbb
-__ZN7WebCore10RenderText15createInlineBoxEbbb
+__ZN7WebCore9RenderBox20calcAbsoluteVerticalEv
+__ZNK7WebCore9RenderBox34containingBlockHeightForPositionedEPKNS_20RenderBoxModelObjectE
+__ZN7WebCore9RenderBox26calcAbsoluteVerticalValuesENS_6LengthEPKNS_20RenderBoxModelObjectEiiS1_S1_S1_S1_RiS5_S5_S5_
+__ZNK7WebCore11RenderBlock9floatRectEv
+__ZN7WebCore11RenderBlock17addVisualOverflowERKNS_7IntRectE
+__ZNK7WebCore9RenderBox12maxPrefWidthEv
+__ZN7WebCore11RenderBlock14calcPrefWidthsEv
+__ZN7WebCore11RenderBlock20calcInlinePrefWidthsEv
+__ZN7WebCore20InlineMinMaxIterator4nextEv
+__ZNK7WebCore12RenderInline10marginLeftEv
+__ZN7WebCoreL11getBPMWidthEiNS_6LengthE
+__ZN7WebCore10RenderText17trimmedPrefWidthsEiRiRbS1_S2_S2_S2_S1_S1_S1_S1_S2_
+__ZL12betterChoicemimimi
+__ZNK7WebCore12RenderInline11marginRightEv
+__ZN7WebCore12RenderInline14dirtyLineBoxesEb
+__ZN7WebCoreL22getBorderPaddingMarginEPNS_20RenderBoxModelObjectEb
 __ZN7WebCore10RenderText19createInlineTextBoxEv
-__ZNK7WebCore13InlineTextBox6isTextEv
+__ZN7WebCore10RenderText13createTextBoxEv
+__ZN7WebCore12RenderInline19createInlineFlowBoxEv
+__ZN7WebCore12RenderInline13createFlowBoxEv
 __ZN7WebCore13InlineTextBox15isInlineTextBoxEv
+__ZNK7WebCore13InlineFlowBox15isInlineFlowBoxEv
+__ZNK7WebCore13InlineFlowBox17rendererLineBoxesEv
+__ZNK7WebCore9InlineBox16nextOnLineExistsEv
 __ZNK7WebCore13InlineTextBox11isLineBreakEv
+__ZNK7WebCore10RenderText5widthEjjibPN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZNK7WebCore12RenderInline10lineHeightEbb
+__ZNK7WebCore12RenderInline25verticalPositionFromCacheEb
+__ZNK7WebCore9InlineBox15isRootInlineBoxEv
+__ZN7WebCore13InlineTextBox17takeFallbackFontsERN3WTF6VectorIPKNS_14SimpleFontDataELm0EEE
+__ZNK7WebCore10RenderText10lineHeightEbb
 __ZNK7WebCore8RenderBR10lineHeightEbb
+__ZNK7WebCore12RenderObject10lineHeightEbb
 __ZNK7WebCore8RenderBR16baselinePositionEbb
-__ZNK7WebCore10RenderText20verticalPositionHintEb
-__ZN7WebCore10RenderText8positionEPNS_9InlineBoxE
-__ZN7WebCore9RenderBox15calcHeightUsingERKNS_6LengthE
-__ZNK7WebCore9RenderBox19calcBorderBoxHeightEi
-__ZNK7WebCore11RenderTable10colElementEiPbS1_
-__ZN7WebCore10RenderFlow14dirtyLineBoxesEbb
-__ZN7WebCore22getBorderPaddingMarginEPNS_12RenderObjectEb
-__ZN7WebCore21nextBreakablePositionEPKtiib
-__ZNK7WebCore10RenderText5widthEjjRKNS_4FontEi
-__ZNK7WebCore4Font12isFixedPitchEv
-__ZNK7WebCore16FontFallbackList14determinePitchEPKNS_4FontE
-__Z12betterChoicejijiji
-__ZNK7WebCore12RenderObject14selectionStateEv
-__ZN7WebCore13InlineFlowBox15isInlineFlowBoxEv
-__ZNK7WebCore9InlineBox16nextOnLineExistsEv
+__ZN7WebCore10RenderText15positionLineBoxEPNS_9InlineBoxE
+__ZN7WebCore17lineBreakIteratorEPKti
+__ZN7WebCoreL13setUpIteratorERbRPNS_17TextBreakIteratorE18UBreakIteratorTypePKti
+__ZN7WebCore24currentTextBreakLocaleIDEv
+__ZN7WebCore18textBreakFollowingEPNS_17TextBreakIteratorEi
+__ZN7WebCore9FontCache26getSimilarFontPlatformDataERKNS_4FontE
+__ZN3WTF7HashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expand
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehash
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloc
+__ZN7WebCore13WidthIterator21normalizeVoicingMarksEi
+__ZN7WebCore13InlineTextBox16setFallbackFontsERKN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZN3WTF7HashMapIPN7WebCore13InlineTextBoxENS_6VectorIPKNS1_14SimpleFontDataELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEC1ERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEC2ERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEaSERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE15reserveCapacityEm
+__ZN3WTF9HashTableIPN7WebCore13InlineTextBoxESt4pairIS3_NS_6VectorIPKNS1_14SimpleFontDataELm0EEEENS_18PairFirstExtractorISA_EEN
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE6shrinkEm
 __ZN7WebCore13InlineFlowBox10onEndChainEPNS_12RenderObjectE
-__ZNK7WebCore10RenderText5widthEjjib
-__ZNK7WebCore10RenderText12maxPrefWidthEv
-__ZN7WebCore10RenderText14calcPrefWidthsEi
-__ZN7WebCore9InlineBox15isRootInlineBoxEv
-__ZNK7WebCore10RenderText10lineHeightEbb
-__ZN7WebCore15HTMLFormElement11isMalformedEv
+__ZNK7WebCore14RenderFieldset12avoidsFloatsEv
+__ZNK7WebCore14RenderFieldset28stretchesToMinIntrinsicWidthEv
+__ZN7WebCore14RenderFieldset14calcPrefWidthsEv
 __ZN7WebCore17RenderTextControl14calcPrefWidthsEv
 __ZNK7WebCore12RenderObject7isImageEv
-__ZN7WebCore15AutoTableLayout14insertSpanCellEPNS_15RenderTableCellE
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4growEm
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE15reserveCapacityEm
-__ZN7WebCore11getBPMWidthEiNS_6LengthE
-__ZNK7WebCore10RenderFlow11isWordBreakEv
-__ZNK7WebCore12RenderInline14isRenderInlineEv
-__ZN7WebCore10RenderText17trimmedPrefWidthsEiRiRbS1_S2_S2_S2_S1_S1_S1_S1_S2_
-__ZN7WebCore17RenderTextControl6layoutEv
+__ZN7WebCore14RenderMenuList14calcPrefWidthsEv
+__ZNK7WebCore14RenderThemeMac19minimumMenuListSizeEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac13menuListSizesEv
+__ZNK7WebCore14RenderThemeMac17sizeForSystemFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac24controlSizeForSystemFontEPNS_11RenderStyleE
+__ZN7WebCore17RenderFlexibleBox14calcPrefWidthsEv
+__ZN7WebCore17RenderFlexibleBox24calcHorizontalPrefWidthsEv
+__ZNK7WebCore14RenderFieldset10findLegendEv
+__ZN7WebCore27RenderTextControlSingleLine6layoutEv
 __ZN7WebCore17RenderTextControl10calcHeightEv
+__ZNK7WebCore4Node9renderBoxEv
+__ZN7WebCore27RenderTextControlSingleLine36adjustControlHeightBasedOnLineHeightEi
+__ZNK7WebCore17RenderTextControl16innerTextElementEv
+__ZNK7WebCore17RenderTextControl15textBlockHeightEv
+__ZNK7WebCore27RenderTextControlSingleLine14textBlockWidthEv
+__ZNK7WebCore17RenderTextControl14textBlockWidthEv
 __ZNK7WebCore17RenderTextControl12avoidsFloatsEv
 __ZNK7WebCore4Node19rootEditableElementEv
 __ZN7WebCore11RenderLayer27updateScrollInfoAfterLayoutEv
 __ZN7WebCore11RenderLayer23computeScrollDimensionsEPbS1_
-__ZNK7WebCore12RenderObject12clientHeightEv
 __ZNK7WebCore11RenderBlock17rightmostPositionEbb
-__ZNK7WebCore10RenderFlow17rightmostPositionEbb
 __ZNK7WebCore11RenderBlock14lowestPositionEbb
-__ZNK7WebCore10RenderFlow14lowestPositionEbb
 __ZN7WebCore11RenderLayer11scrollWidthEv
 __ZN7WebCore11RenderLayer12scrollHeightEv
-__ZNK7WebCore17RenderTextControl14hasControlClipEv
-__ZNK7WebCore11RenderBlock14selectionStateEv
-__ZNK7WebCore17RenderTextControl16baselinePositionEbb
-__ZNK7WebCore11RenderTheme18isControlContainerENS_11EAppearanceE
-__ZNK7WebCore11RenderBlock24getBaselineOfLastLineBoxEv
-__ZN7WebCore25inlineFlowRequiresLineBoxEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock19setMaxBottomMarginsEii
-__ZNK7WebCore11RenderBlock19isBottomMarginQuirkEv
-__ZN7WebCore14RenderMenuList14calcPrefWidthsEv
-__ZNK7WebCore14RenderThemeMac19minimumMenuListSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac13menuListSizesEv
-__ZNK7WebCore14RenderThemeMac17sizeForSystemFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac24controlSizeForSystemFontEPNS_11RenderStyleE
+__ZNK7WebCore27RenderTextControlSingleLine14hasControlClipEv
 __ZN7WebCore17RenderFlexibleBox11layoutBlockEb
 __ZN7WebCore17RenderFlexibleBox19layoutHorizontalBoxEb
 __ZN7WebCore9RenderBox15setOverrideSizeEi
 __ZNK7WebCore17RenderFlexibleBox13isFlexibleBoxEv
 __ZNK7WebCore17RenderFlexibleBox20isStretchingChildrenEv
-__ZN7WebCore17RenderFlexibleBox10placeChildEPNS_12RenderObjectEii
-__ZN7WebCore17RenderFlexibleBox16allowedChildFlexEPNS_12RenderObjectEbj
+__ZN7WebCore15FlexBoxIterator4nextEv
+__ZN7WebCore17RenderFlexibleBox10placeChildEPNS_9RenderBoxEii
+__ZN7WebCore17RenderFlexibleBox16allowedChildFlexEPNS_9RenderBoxEbj
 __ZNK7WebCore9RenderBox13overrideWidthEv
-__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3getERKS4_
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3setERKS4_RKi
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10Ha
 __ZNK7WebCore17RenderFlexibleBox17isFlexingChildrenEv
+__ZNK7WebCore9RenderBox12overrideSizeEv
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3getERKS4_
 __ZN7WebCore13RootInlineBox7destroyEPNS_11RenderArenaE
 __ZN7WebCore13RootInlineBox17detachEllipsisBoxEPNS_11RenderArenaE
 __ZN7WebCore9InlineBox7destroyEPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBoxD0Ev
 __ZN7WebCore9InlineBoxdlEPvm
-__ZN7WebCore13InlineTextBoxD1Ev
+__ZN7WebCore13InlineTextBoxD0Ev
 __ZNK7WebCore14RenderMenuList14hasControlClipEv
-__ZN7WebCore11addMidpointERKNS_12BidiIteratorE
-__ZN3WTF6VectorIN7WebCore12BidiIteratorELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore12BidiIteratorELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12BidiIteratorELm0EE15reserveCapacityEm
-__ZN7WebCore17lineBreakIteratorEPKti
-__ZN7WebCore13setUpIteratorERbRPNS_17TextBreakIteratorE18UBreakIteratorTypePKti
-__ZN7WebCore24currentTextBreakLocaleIDEv
-__ZN7WebCore18textBreakFollowingEPNS_17TextBreakIteratorEi
-__ZNK7WebCore12RenderObject18collapsedMarginTopEv
-__ZNK7WebCore12RenderObject21collapsedMarginBottomEv
+__ZNK7WebCore12RenderButton14hasControlClipEv
+__ZNK7WebCore11RenderTheme18isControlContainerENS_11ControlPartE
+__ZNK7WebCore11RenderBlock19lastLineBoxBaselineEv
+__ZN7WebCore13InlineFlowBox25adjustMaxAscentAndDescentERiS1_ii
+__ZN7WebCore11RenderBlock19setMaxBottomMarginsEii
+__ZNK7WebCore9RenderBox17rightmostPositionEbb
+__ZNK7WebCore20RenderBoxModelObject23relativePositionOffsetXEv
+__ZNK7WebCore9RenderBox14lowestPositionEbb
+__ZNK7WebCore20RenderBoxModelObject23relativePositionOffsetYEv
+__ZNK7WebCore4Font24floatWidthForComplexTextERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTra
+__ZN7WebCore18CoreTextControllerC1EPKNS_4FontERKNS_7TextRunEbPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashT
+__ZN7WebCore18CoreTextControllerC2EPKNS_4FontERKNS_7TextRunEbPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashT
+__ZN7WebCore18CoreTextController19collectCoreTextRunsEv
+__ZN7WebCore18CoreTextController32collectCoreTextRunsForCharactersEPKtjjPKNS_14SimpleFontDataE
+__ZNK7WebCore14SimpleFontData21getCFStringAttributesEv
+__ZNK7WebCore14SimpleFontData9getCTFontEv
+__ZNK7WebCore16FontPlatformData15allowsLigaturesEv
+__ZN7WebCore18CoreTextController11CoreTextRunC1EPK7__CTRunPKNS_14SimpleFontDataEPKtjm
+__ZN7WebCore18CoreTextController11CoreTextRunC2EPK7__CTRunPKNS_14SimpleFontDataEPKtjm
+__ZN7WebCore18CoreTextController23adjustGlyphsAndAdvancesEv
+__ZNK7WebCore16FontPlatformData19roundsGlyphAdvancesEv
+__ZN3WTF6VectorItLm256EE6shrinkEm
+__ZN3WTF6VectorI6CGSizeLm256EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE6shrinkEm
+__ZN7WebCore18CoreTextController11CoreTextRunC1EPKNS_14SimpleFontDataEPKtjmb
+__ZN7WebCore18CoreTextController11CoreTextRunC2EPKNS_14SimpleFontDataEPKtjmb
+__ZN3WTF6VectorIlLm16EE6shrinkEm
+__ZN3WTF6VectorItLm256EE4fillERKtm
+__ZSt4fillIPttEvT_S1_RKT0_
+__ZN3WTF6VectorI6CGSizeLm256EE4fillERKS1_m
+__ZSt4fillIP6CGSizeS0_EvT_S2_RKT0_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE5embedEN3WTF7Unicode9DirectionE
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6_
+__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE6shrinkEm
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
+__ZN3WTF10RefCountedIN7WebCore11BidiContextEE5derefEv
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE11reverseRunsEjj
+__ZNK7WebCore9InlineBox16prevOnLineExistsEv
+__ZN7WebCore11RenderBlock20insertFloatingObjectEPNS_9RenderBoxE
+__ZN7WebCore21DeprecatedPtrListImplC1EPFvPvE
+__ZN7WebCore21DeprecatedPtrListImplC2EPFvPvE
+__ZN7WebCore21DeprecatedPtrListImpl6appendEPKv
+__ZN7WebCore21DeprecatedPtrListImpl6insertEjPKv
+__ZN7WebCore21DeprecatedPtrListImpl4lastEv
+__ZNK7WebCore21DeprecatedPtrListImpl7currentEv
+__ZNK7WebCore21DeprecatedPtrListImpl7getPrevEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorC1ERKNS_21DeprecatedPtrListImplE
+__ZN7WebCore29DeprecatedPtrListImplIteratorC2ERKNS_21DeprecatedPtrListImplE
+__ZNK7WebCore21DeprecatedPtrListImpl11addIteratorEPNS_29DeprecatedPtrListImplIteratorE
+__ZNK7WebCore29DeprecatedPtrListImplIterator7currentEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorppEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorD1Ev
+__ZN7WebCore29DeprecatedPtrListImplIteratorD2Ev
+__ZNK7WebCore21DeprecatedPtrListImpl14removeIteratorEPNS_29DeprecatedPtrListImplIteratorE
+__ZN7WebCore21DeprecatedPtrListImpl4nextEv
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE6shrinkEm
+__ZNK7WebCore11RenderBlock33expandsToEncloseOverhangingFloatsEv
+__ZNK7WebCore12RenderObject10isFieldsetEv
+__ZN7WebCore11RenderBlock20addOverhangingFloatsEPS0_iib
+__ZN7WebCore11RenderBlock13containsFloatEPNS_12RenderObjectE
+__ZNK7WebCore12RenderObject26enclosingSelfPaintingLayerEv
+__ZN7WebCore11RenderBlock37markAllDescendantsWithFloatsForLayoutEPNS_9RenderBoxEb
+__ZN7WebCore11RenderBlock18addIntrudingFloatsEPS0_ii
+__ZN7WebCore21DeprecatedPtrListImpl5firstEv
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_11RenderBlock14FloatingObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE
+__ZN7WebCore7IntRect5uniteERKS0_
 __ZN7WebCore10RenderView10calcHeightEv
-__ZN7WebCore10RenderView20hasOverhangingFloatsEv
+__ZNK7WebCore10RenderView10viewHeightEv
 __ZN7WebCore11RenderBlock16setOverflowWidthEi
 __ZN7WebCore11RenderBlock17setOverflowHeightEi
 __ZNK7WebCore10RenderView8docWidthEv
-__ZNK7WebCore18RenderTableSection17rightmostPositionEbb
-__ZNK7WebCore9RenderBox17rightmostPositionEbb
 __ZNK7WebCore10RenderView9docHeightEv
-__ZNK7WebCore18RenderTableSection14lowestPositionEbb
-__ZNK7WebCore9RenderBox14lowestPositionEbb
+__ZNK7WebCore9RenderBox15availableHeightEv
+__ZNK7WebCore9RenderBox20availableHeightUsingERKNS_6LengthE
+__ZN7WebCore9FrameView19endDeferredRepaintsEv
+__ZNK7WebCore9FrameView28adjustedDeferredRepaintDelayEv
+__ZN7WebCore9FrameView18doDeferredRepaintsEv
+__ZNK7WebCore10ScrollView11isOffscreenEv
+__ZNK7WebCore10ScrollView19platformIsOffscreenEv
+__ZN7WebCore9FrameView26updateDeferredRepaintDelayEv
 __ZN7WebCore5Frame19invalidateSelectionEv
 __ZN7WebCore19SelectionController14setNeedsLayoutEb
-__ZN7WebCore5Frame22selectionLayoutChangedEv
-__ZN7WebCore19SelectionController18recomputeCaretRectEv
-__ZNK7WebCore19SelectionController9caretRectEv
-__ZN7WebCore19SelectionController6layoutEv
-__ZNK7WebCore5Frame8rendererEv
-__ZN7WebCore10RenderView14clearSelectionEv
-__ZN7WebCore10RenderView12setSelectionEPNS_12RenderObjectEiS2_i
 __ZN7WebCore9FrameView14adjustViewSizeEv
--[WebCoreFrameBridge forceLayoutAdjustingViewSize:]
-__ZN7WebCore5Frame11forceLayoutEb
-__ZN7WebCore17DeprecatedPtrListINS_11RenderBlock14FloatingObjectEE10deleteFuncEPv
-__ZN7WebCore13RootInlineBox8Overflow7destroyEPNS_11RenderArenaE
-__ZN7WebCore13RootInlineBox8OverflowdlEPvm
-__ZN7WebCore13InlineFlowBoxD1Ev
+__ZN7WebCore10ScrollView23platformSetContentsSizeEv
 __ZN7WebCore11RenderLayer20updateLayerPositionsEbb
-__ZN7WebCore9FrameView16repaintRectangleERKNS_7IntRectEb
-__ZN7WebCore10ScrollView14updateContentsERKNS_7IntRectEb
-__ZNK7WebCore10ScrollView18visibleContentRectEv
-__ZN7WebCore9FloatRectC1ERK7_NSRect
-__ZN7WebCore10FloatPointC2ERK8_NSPoint
-__ZN7WebCore9FloatSizeC2ERK7_NSSize
-__ZNK7WebCore9FloatRectcv7_NSRectEv
-__ZNK7WebCore7IntRectcv7_NSRectEv
+__ZN7WebCore9FrameView23repaintContentRectangleERKNS_7IntRectEb
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE15reserveCapacityEm
 __ZN7WebCore11RenderLayer19updateLayerPositionEv
-__ZN7WebCore11RenderLayer24positionOverflowControlsEv
+__ZNK7WebCore11RenderLayer20convertToLayerCoordsEPKS0_RiS3_
+__ZN7WebCore11RenderLayer24positionOverflowControlsEii
 __ZN7WebCore11RenderLayer15updateTransformEv
-__ZNK7WebCore12RenderObject18absoluteOutlineBoxEv
-__ZNK7WebCore10RenderView16absolutePositionERiS1_b
+__ZNK7WebCore9RenderBox23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore9RenderBox17borderBoundingBoxEv
 __ZNK7WebCore12RenderObject29adjustRectForOutlineAndShadowERNS_7IntRectE
-__ZN7WebCore11RenderLayer20subtractScrollOffsetERiS1_
-__ZNK7WebCore9RenderBox16absolutePositionERiS1_b
-__ZNK7WebCore15RenderTableCell16absolutePositionERiS1_b
+__ZNK7WebCore11RenderBlock22outlineStyleForRepaintEv
+__ZNK7WebCore12RenderObject20localToContainerQuadERKNS_9FloatQuadEPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore10RenderView19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore14TransformState7flattenEv
+__ZNK7WebCore9FloatQuad11boundingBoxEv
+__ZNK7WebCore11RenderLayer29subtractScrolledContentOffsetERiS1_
+__ZNK7WebCore9RenderBox19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZNK7WebCore9RenderBox19offsetFromContainerEPNS_12RenderObjectE
+__ZNK7WebCore12RenderObject31shouldUseTransformFromContainerEPKS0_
+__ZN7WebCore14TransformState4moveEiiNS0_21TransformAccumulationE
+__ZNK7WebCore11RenderLayer27enclosingPositionedAncestorEv
+__ZN7WebCore10ScrollView23repaintContentRectangleERKNS_7IntRectEb
+__ZN7WebCore10ScrollView31platformRepaintContentRectangleERKNS_7IntRectEb
+__ZNK7WebCore7IntRectcv6CGRectEv
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE6shrinkEm
 __ZN7WebCore9FrameView22updateDashboardRegionsEv
 __ZNK7WebCore9FrameView15useSlowRepaintsEv
 __ZN7WebCore9FrameView22performPostLayoutTasksEv
-__ZN7WebCore10RenderView21updateWidgetPositionsEv
-__ZN7WebCore9FrameView21resumeScheduledEventsEv
-__ZNK7WebCore9FrameView11needsLayoutEv
 __ZN7WebCore11FrameLoader14didFirstLayoutEv
-__ZN7WebCore9FrameView23dispatchScheduledEventsEv
-__ZN7WebCore8Document13svgExtensionsEv
-__ZNK7WebCore14DocumentLoader16isLoadingPlugInsEv
-__ZNK7WebCore8Document16isPluginDocumentEv
-__ZNK7WebCore8Document15isImageDocumentEv
-+[WebScriptObject initialize]
-+[DOMDocument(WebCoreInternal) _wrapDocument:]
-+[DOMNode(WebCoreInternal) _wrapNode:]
-__ZN7WebCore13getDOMWrapperEP17DOMObjectInternal
--[DOMNode(WebCoreInternal) _initWithNode:]
--[DOMObject(WebCoreInternal) _init]
--[WebScriptObject(WebScriptObjectInternal) _init]
-__ZN7WebCore13addDOMWrapperEP8NSObjectP17DOMObjectInternal
-__ZNK3WTF7HashMapIP17DOMObjectInternalP8NSObjectNS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3getERKS2_
--[DOMDocument getElementsByTagName:]
-__ZN7WebCore4Node20getElementsByTagNameERKNS_6StringE
-__ZN7WebCore4Node22getElementsByTagNameNSERKNS_6StringES3_
-__ZN7WebCore11TagNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_
-__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEb
-__ZN7WebCore15DynamicNodeList6CachesC1Ev
-__ZN7WebCore4Node23registerDynamicNodeListEPNS_15DynamicNodeListE
-__ZN3WTF7HashSetIPN7WebCore15DynamicNodeListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-+[DOMNodeList(WebCoreInternal) _wrapNodeList:]
--[DOMNodeList(WebCoreInternal) _initWithNodeList:]
--[DOMNodeList length]
-__ZNK7WebCore15DynamicNodeList6lengthEv
-__ZNK7WebCore11TagNodeList11nodeMatchesEPNS_4NodeE
-__ZN7WebCore15ProgressTracker17progressCompletedEPNS_5FrameE
-__ZN7WebCore15ProgressTracker21finalProgressCompleteEv
--[DOMNodeList dealloc]
-__ZN7WebCore4Node25unregisterDynamicNodeListEPNS_15DynamicNodeListE
--[DOMObject dealloc]
-__ZN7WebCore16removeDOMWrapperEP17DOMObjectInternal
--[WebScriptObject dealloc]
--[DOMNode dealloc]
--[WebCoreFrameBridge needsLayout]
--[WebCoreFrameBridge drawRect:]
-__ZN7WebCore15GraphicsContextC2EP9CGContext
-__ZN7WebCore15GraphicsContext28createGraphicsContextPrivateEv
-__ZN7WebCore22GraphicsContextPrivateC2Ev
-__ZN7WebCore15GraphicsContext19setPaintingDisabledEb
-__ZNK7WebCore15GraphicsContext9fillColorEv
-__ZN7WebCore15GraphicsContext20setPlatformFillColorERKNS_5ColorE
-__ZNK7WebCore15GraphicsContext16paintingDisabledEv
-__ZNK7WebCore15GraphicsContext15platformContextEv
-__ZN7WebCore14setCGFillColorEP9CGContextRKNS_5ColorE
-__ZNK7WebCore5Color7getRGBAERfS1_S1_S1_
-__ZNK7WebCore15GraphicsContext11strokeColorEv
-__ZN7WebCore15GraphicsContext22setPlatformStrokeColorERKNS_5ColorE
-__ZN7WebCore5Frame5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore11FrameLoader30didFirstVisuallyNonEmptyLayoutEv
+__ZN7WebCore10RenderView21updateWidgetPositionsEv
+__ZN7WebCore9FrameView13updateWidgetsEv
+__ZN7WebCore5TimerINS_20ImageLoadEventSenderEE5firedEv
+__ZN7WebCore20ImageLoadEventSender10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore20ImageLoadEventSender25dispatchPendingLoadEventsEv
+__ZN7WebCore11ImageLoader24dispatchPendingLoadEventEv
+__ZN7WebCore15HTMLImageLoader17dispatchLoadEventEv
+__ZN7WebCore4Node13dispatchEventERKNS_12AtomicStringEbb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE6shrinkEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE6shrinkEm
+__ZN7WebCore9FrameView13paintContentsEPNS_15GraphicsContextERKNS_7IntRectE
 __ZN7WebCore8Document39invalidateRenderedRectsForMarkersInRectERKNS_7IntRectE
 __ZN7WebCore11RenderLayer5paintEPNS_15GraphicsContextERKNS_7IntRectENS_16PaintRestrictionEPNS_12RenderObjectE
-__ZN7WebCore11RenderLayer10paintLayerEPS0_PNS_15GraphicsContextERKNS_7IntRectEbNS_16PaintRestrictionEPNS_12RenderObjectE
-__ZNK7WebCore4Node12namespaceURIEv
-__ZNK7WebCore11RenderLayer14calculateRectsEPKS0_RKNS_7IntRectERS3_S6_S6_S6_
-__ZNK7WebCore11RenderLayer20convertToLayerCoordsEPKS0_RiS3_
+__ZN7WebCore11RenderLayer10paintLayerEPS0_PNS_15GraphicsContextERKNS_7IntRectEbNS_16PaintRestrictionEPNS_12RenderObjectEPN3WTF7
+__ZNK7WebCore4Node19virtualNamespaceURIEv
+__ZNK7WebCore11RenderLayer14calculateRectsEPKS0_RKNS_7IntRectERS3_S6_S6_S6_b
+__ZN7WebCore11RenderLayer24updateLayerListsIfNeededEv
 __ZN7WebCore11RenderLayer17updateZOrderListsEv
 __ZN7WebCore11RenderLayer13collectLayersERPN3WTF6VectorIPS0_Lm0EEES6_
 __ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEmPKS3_
 __ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE15reserveCapacityEm
+__ZNSt17_Temporary_bufferIPPN7WebCore11RenderLayerES2_EC1ES3_S3_
 __ZNSt17_Temporary_bufferIPPN7WebCore11RenderLayerES2_EC2ES3_S3_
-__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_iEiS5_
-__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_lElS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
 __ZSt24__merge_sort_with_bufferIPPN7WebCore11RenderLayerES3_PFbS2_S2_EEvT_S6_T0_T1_
-__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerEiPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerElPFbS2_S2_EEvT_S6_T0_T1_
 __ZSt16__insertion_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
-__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerEiS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerElS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
 __ZSt16__merge_backwardIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
 __ZSt23return_temporary_bufferIPN7WebCore11RenderLayerEEvPT_
-__ZN7WebCore11RenderLayer18updateOverflowListEv
+__ZN7WebCore11RenderLayer20updateNormalFlowListEv
 __ZNK7WebCore11RenderLayer20intersectsDamageRectERKNS_7IntRectES3_PKS0_
-__ZN7WebCore7setClipEPNS_15GraphicsContextERKNS_7IntRectES4_
+__ZN7WebCoreL7setClipEPNS_15GraphicsContextERKNS_7IntRectES4_
 __ZN7WebCore10RenderView5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore11RenderBlock11paintObjectERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore10RenderView19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderLayer21paintOverflowControlsEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCore11restoreClipEPNS_15GraphicsContextERKNS_7IntRectES4_
+__ZN7WebCoreL11restoreClipEPNS_15GraphicsContextERKNS_7IntRectES4_
 __ZN7WebCore11RenderBlock13paintContentsERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore11RenderBlock13paintChildrenERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore11RenderBlock14paintSelectionERNS_12RenderObject9PaintInfoEii
 __ZNK7WebCore11RenderBlock24shouldPaintSelectionGapsEv
 __ZN7WebCore11RenderBlock11paintFloatsERNS_12RenderObject9PaintInfoEiib
-__ZN7WebCore11RenderBlock10paintCaretERNS_12RenderObject9PaintInfoENS_9CaretTypeE
+__ZN7WebCore11RenderBlock10paintCaretERNS_12RenderObject9PaintInfoEiiNS_9CaretTypeE
 __ZNK7WebCore5Frame19dragCaretControllerEv
 __ZN7WebCore11RenderBlock25paintContinuationOutlinesERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore24continuationOutlineTableEv
+__ZN7WebCoreL24continuationOutlineTableEv
 __ZNK7WebCore12RenderObject20hasOutlineAnnotationEv
-__ZN7WebCore11RenderLayer18calculateClipRectsEPKS0_
+__ZNK7WebCore11RenderLayer15parentClipRectsEPKS0_RNS_9ClipRectsEb
+__ZN7WebCore11RenderLayer15updateClipRectsEPKS0_
+__ZNK7WebCore11RenderLayer18calculateClipRectsEPKS0_RNS_9ClipRectsEb
 __ZN7WebCore9ClipRectsnwEmPNS_11RenderArenaE
-__ZN7WebCore7IntRect9intersectERKS0_
+__ZN7WebCoreL13compareZIndexEPNS_11RenderLayerES1_
+__ZSt25__unguarded_linear_insertIPPN7WebCore11RenderLayerES2_PFbS2_S2_EEvT_T0_T1_
+__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt5mergeIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
 __ZN7WebCore11RenderBlock5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox16pushContentsClipERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore9RenderBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore9RenderBox23paintRootBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore10ScrollView13contentsWidthEv
-__ZNK7WebCore10ScrollView14contentsHeightEv
-__ZN7WebCore9RenderBox16paintBackgroundsEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore9RenderBox15paintBackgroundEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore9RenderBox23paintBackgroundExtendedEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiiibb
-__ZN7WebCore15GraphicsContext8fillRectERKNS_7IntRectERKNS_5ColorE
-__ZNK7WebCore7IntRectcv6CGRectEv
+__ZN7WebCore9RenderBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
+__ZN7WebCore9RenderBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
+__ZN7WebCore20RenderBoxModelObject22paintFillLayerExtendedERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiPNS_
+__ZN7WebCore9FrameView18setContentIsOpaqueEb
+__ZNK7WebCore9FrameView19baseBackgroundColorEv
+__ZN7WebCore15GraphicsContext4saveEv
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE15reserveCapacityEm
+__ZN7WebCore15GraphicsContext17savePlatformStateEv
+__ZN7WebCore15GraphicsContext21setCompositeOperationENS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorE
+__ZNK7WebCore9FloatRectcv6CGRectEv
+__ZN7WebCore15GraphicsContext7restoreEv
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE6shrinkEm
+__ZN7WebCore15GraphicsContext20restorePlatformStateEv
 __ZNK7WebCore12RenderObject18maximalOutlineSizeENS_10PaintPhaseE
 __ZNK7WebCore7IntRect10intersectsERKS0_
-__ZNK7WebCore11RenderBlock15borderFitAdjustERiS1_
-__ZN7WebCore12RenderObject14paintBoxShadowEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
-__ZN7WebCore11RenderTable5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore18RenderTableSection5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15RenderTableCell26paintBackgroundsBehindCellERNS_12RenderObject9PaintInfoEiiPS1_
-__ZN7WebCore15RenderTableCell5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15RenderTableCell19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore10RenderFlow10paintLinesERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderReplaced5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderReplaced11shouldPaintERNS_12RenderObject9PaintInfoERiS4_
-__ZNK7WebCore14RenderReplaced10isSelectedEv
-__ZN7WebCore11RenderImage13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore17RenderLineBoxList5paintEPNS_20RenderBoxModelObjectERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore9InlineBox4rootEv
 __ZN7WebCore13RootInlineBox12selectionTopEv
 __ZN7WebCore13RootInlineBox5paintERNS_12RenderObject9PaintInfoEii
@@ -2455,1247 +3604,207 @@ __ZN7WebCore13InlineFlowBox5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13InlineFlowBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13InlineFlowBox20paintTextDecorationsERNS_12RenderObject9PaintInfoEiib
 __ZN7WebCore9InlineBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15GraphicsContext14setStrokeStyleERKNS_11StrokeStyleE
-__ZN7WebCore15GraphicsContext14setStrokeColorERKNS_5ColorE
-__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
-__ZN7WebCore15GraphicsContext8drawRectERKNS_7IntRectE
-__ZNK7WebCore15GraphicsContext11strokeStyleEv
-__ZNK7WebCore9FloatRectcv6CGRectEv
-__ZNK7WebCore5Image6isNullEv
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointENS_17CompositeOperatorE
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointERKNS_7IntRectENS_17CompositeOperatorE
+__ZN7WebCore14RenderReplaced5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderReplaced11shouldPaintERNS_12RenderObject9PaintInfoERiS4_
+__ZNK7WebCore14RenderReplaced10isSelectedEv
+__ZN7WebCore11RenderImage13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderImage5imageEii
+__ZNK7WebCore11CachedImage5imageEv
+__ZN7WebCore24RenderImageScaleObserver28shouldImagePaintAtLowQualityEPNS_11RenderImageERKNS_7IntSizeE
+__ZNK7WebCore11BitmapImage13isBitmapImageEv
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectENS_17CompositeOperatorEb
 __ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectES5_NS_17CompositeOperatorEb
-__ZN7WebCore9FloatRectC2ERKNS_7IntRectE
-__ZN7WebCore10FloatPointC2ERKNS_8IntPointE
-__ZN7WebCore9FloatSizeC2ERKNS_7IntSizeE
 __ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_9FloatRectES5_NS_17CompositeOperatorEb
 __ZN7WebCore11BitmapImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
--[DOMDocument forms]
-__ZN7WebCore8Document5formsEv
-+[DOMHTMLCollection(WebCoreInternal) _wrapHTMLCollection:]
--[DOMHTMLCollection(WebCoreInternal) _initWithHTMLCollection:]
--[DOMHTMLCollection length]
--[DOMHTMLCollection item:]
-__ZNK7WebCore14HTMLCollection4itemEj
-__ZN7WebCore12elementClassERKNS_13QualifiedNameEP10objc_class
-__ZN7WebCore15addElementClassERKNS_13QualifiedNameEP10objc_class
-__ZNK3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3getERKS5_
--[DOMHTMLFormElement elements]
-__ZN7WebCore15HTMLFormElement8elementsEv
-__ZN7WebCore18HTMLFormCollectionC1EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
-__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS0_4TypeEPNS0_14CollectionInfoE
-__ZNK7WebCore18HTMLFormCollection10calcLengthEv
-__ZNK7WebCore15HTMLFormElement6lengthEv
-__ZNK7WebCore16HTMLInputElement14isEnumeratableEv
-__ZNK7WebCore18HTMLFormCollection4itemEj
--[DOMHTMLInputElement(FormAutoFillTransition) _isTextField]
--[DOMHTMLInputElement type]
-__ZNK7WebCore16HTMLInputElement4typeEv
--[DOMHTMLCollection dealloc]
-__ZNK7WebCore11HistoryItem17originalURLStringEv
-__ZNK7WebCore5Frame10isFrameSetEv
--[DOMDocument documentElement]
-+[DOMElement(WebCoreInternal) _wrapElement:]
--[DOMDocument createRange]
-__ZN7WebCore8Document11createRangeEv
-__ZN7WebCore5RangeC2EPNS_8DocumentE
-+[DOMRange(WebCoreInternal) _wrapRange:]
--[DOMRange(WebCoreInternal) _initWithRange:]
--[DOMRange selectNode:]
--[DOMNode(WebCoreInternal) _node]
-__ZN7WebCore5Range10selectNodeEPNS_4NodeERi
-__ZN7WebCore5Range14setStartBeforeEPNS_4NodeERi
-__ZNK7WebCore5Range11checkNodeBAEPNS_4NodeERi
-__ZNK7WebCore4Node9nodeIndexEv
-__ZN7WebCore5Range8setStartEPNS_4NodeEiRi
-__ZNK7WebCore5Range16checkNodeWOffsetEPNS_4NodeEiRi
-__ZNK7WebCore13ContainerNode14childNodeCountEv
-__ZN7WebCore5Range21compareBoundaryPointsEPNS_4NodeEiS2_i
-__ZN7WebCore5Range11setEndAfterEPNS_4NodeERi
-__ZN7WebCore5Range6setEndEPNS_4NodeEiRi
--[WebCoreFrameBridge stringForRange:]
--[DOMRange(WebCoreInternal) _range]
-__ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERj
-__ZN7WebCore12TextIteratorC2EPKNS_5RangeEb
-__ZNK7WebCore5Range14startContainerERi
-__ZNK7WebCore5Range11startOffsetERi
-__ZNK7WebCore5Range12endContainerERi
-__ZNK7WebCore5Range9endOffsetERi
-__ZNK7WebCore5Range9startNodeEv
-__ZNK7WebCore4Node18offsetInCharactersEv
-__ZNK7WebCore13ContainerNode9childNodeEj
-__ZNK7WebCore5Range11pastEndNodeEv
-__ZN7WebCore12TextIterator7advanceEv
-__ZN7WebCore12TextIterator17handleNonTextNodeEv
-__ZN7WebCore24shouldEmitNewlineForNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator23representNodeOffsetZeroEv
-__ZN7WebCore23shouldEmitTabBeforeNodeEPNS_4NodeE
-__ZN7WebCore11isTableCellEPKNS_4NodeE
-__ZN7WebCore27shouldEmitNewlineBeforeNodeEPNS_4NodeE
-__ZN7WebCore36shouldEmitNewlinesBeforeAndAfterNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator29shouldRepresentNodeOffsetZeroEv
-__ZNK7WebCore4Node14isDescendantOfEPKS0_
-__ZN7WebCore12TextIterator33shouldEmitSpaceBeforeAndAfterNodeEPNS_4NodeE
-__ZNK7WebCore11RenderTable10cellBeforeEPKNS_15RenderTableCellE
-__ZNK7WebCore11RenderTable9cellAboveEPKNS_15RenderTableCellE
-__ZNK7WebCore11RenderTable12sectionAboveEPKNS_18RenderTableSectionEb
-__ZN7WebCore12TextIterator21handleReplacedElementEv
-__ZN7WebCore12TextIterator8exitNodeEv
-__ZN7WebCore12TextIterator13emitCharacterEtPNS_4NodeES2_ii
-__ZN7WebCore12TextIterator14handleTextNodeEv
-__ZN7WebCore12TextIterator13handleTextBoxEv
-__ZN7WebCore12TextIterator8emitTextEPNS_4NodeEii
-__ZN7WebCore26shouldEmitNewlineAfterNodeEPNS_4NodeE
-__ZN3WTF6VectorItLm0EE6shrinkEm
--[DOMRange dealloc]
-__ZN7WebCore5RangeD1Ev
-__ZN7WebCore9FrameView18updateControlTintsEv
-__ZNK7WebCore14RenderThemeMac20supportsControlTintsEv
-__ZN7WebCore15GraphicsContext23setUpdatingControlTintsEb
-__ZNK7WebCore14RenderThemeMac20controlSupportsTintsEPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
-__ZN7WebCore19SelectionController21pageActivationChangedEv
-__ZN7WebCore19SelectionController27focusedOrActiveStateChangedEv
-__ZNK7WebCore5Frame13selectionRectEb
-__ZNK7WebCore10RenderView13selectionRectEb
-__ZN7WebCore21rendererAfterPositionEPNS_12RenderObjectEj
-__ZN7WebCore9FloatRect9intersectERKS0_
-__ZN7WebCore5Frame15setCaretVisibleEb
-__ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
-__ZNK7WebCore8Document32useSecureKeyboardEntryWhenActiveEv
-__ZN7WebCore5Frame20setSelectionFromNoneEv
-__ZN7WebCore5Frame22clearCaretRectIfNeededEv
-__ZN7WebCore19SelectionController19invalidateCaretRectEv
-__ZNK7WebCore19SelectionController17isInPasswordFieldEv
-__ZNK7WebCore11HistoryItem3urlEv
-__ZNK7WebCore11HistoryItem11originalURLEv
-__ZN7WebCore17BeforeUnloadEventC2Ev
--[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]
-__ZNK7WebCore11FrameLoader21isQuickRedirectComingEv
-__ZN7WebCore11FrameLoader23cachePageForHistoryItemEPNS_11HistoryItemE
-__ZN7WebCore10CachedPage6createEPNS_4PageE
-__ZN7WebCore10CachedPageC2EPNS_4PageE
-__ZNK7WebCore12EventHandler14mousePressNodeEv
-__ZN7WebCore8Document15willSaveToCacheEv
-__ZN3KJS6Window14retrieveWindowEPN7WebCore5FrameE
-__ZN3KJS6Window8retrieveEPN7WebCore5FrameE
-__ZN7WebCore16ScriptController10initScriptEv
-__ZN7WebCore11JSDOMWindowC2EPNS_9DOMWindowE
-__ZN7WebCore20JSDOMWindowPrototype4selfEv
-__ZN3KJS6WindowC2EPNS_8JSObjectEPN7WebCore9DOMWindowE
-__ZNK7WebCore11FrameLoader9userAgentERKNS_4KURLE
-__ZN7WebCore10StringImpl4findEPKcib
-__ZN7WebCore5Frame18windowScriptObjectEv
-__ZN7WebCore5Frame17bindingRootObjectEv
-+[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]
-__ZN7WebCore16createDOMWrapperEPN3KJS8JSObjectEN3WTF10PassRefPtrINS0_8Bindings10RootObjectEEES7_
-__ZNK7WebCore11JSDOMWindow9classInfoEv
-+[DOMAbstractView(WebCoreInternal) _wrapAbstractView:]
--[DOMAbstractView(WebCoreInternal) _initWithDOMWindow:]
--[WebScriptObject _hasImp]
--[WebScriptObject _setImp:originRootObject:rootObject:]
-__ZN7WebCore12addJSWrapperEP8NSObjectPN3KJS8JSObjectE
-__ZNK3WTF7HashMapIPN3KJS8JSObjectEP8NSObjectNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore5Frame11clearTimersEv
-__ZN7WebCore5Frame11clearTimersEPNS_9FrameViewE
-__ZN7WebCore9FrameView18unscheduleRelayoutEv
-__ZN7WebCore11RenderLayer15suspendMarqueesEv
-__ZN7WebCore19AnimationController17suspendAnimationsEv
-__ZNK3KJS6Window8locationEv
-__ZN7WebCore10JSLocationC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN3KJS6Window13pauseTimeoutsEv
-__ZN7WebCore8Document14setInPageCacheEb
-__ZN7WebCore9FrameView15resetScrollbarsEv
-__ZN7WebCore10CachedPage17setTimeStampToNowEv
-__ZN7WebCore10CachedPage17setDocumentLoaderEN3WTF10PassRefPtrINS_14DocumentLoaderEEE
-__ZN7WebCore10CachedPage25setCachedPagePlatformDataEPNS_22CachedPagePlatformDataE
-__ZN7WebCore9PageCache3addEN3WTF10PassRefPtrINS_11HistoryItemEEENS2_INS_10CachedPageEEE
-__ZN7WebCore9PageCache12addToLRUListEPNS_11HistoryItemE
-__ZNK7WebCore8Document17formElementsStateEv
-__ZN3WTF6VectorIN7WebCore6StringELm0EE15reserveCapacityEm
-__ZNK7WebCore16HTMLInputElement9saveStateERNS_6StringE
-__ZNK7WebCore17HTMLSelectElement9saveStateERNS_6StringE
-__ZN3WTF6VectorIcLm1024EE6shrinkEm
-__ZNK7WebCore17HTMLSelectElement4typeEv
-__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS_6StringELm0EEE
-__ZN3WTF6VectorIN7WebCore6StringELm0EEaSERKS3_
-__ZN3WTF6VectorIN7WebCore6StringELm0EE6shrinkEm
-__ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
-__ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE
-__ZN7WebCore5Frame16clearScriptProxyEv
-__ZN7WebCore8KJSProxy5clearEv
-__ZN3KJS6Window5clearEv
-__ZN3KJS6Window16clearAllTimeoutsEv
-__ZN3WTF20deleteAllPairSecondsIPN3KJS14DOMWindowTimerEKNS_7HashMapIiS3_NS_7IntHashIjEENS_10HashTraitsIiEENS7_IS3_EEEEEEvRT0_
-__ZN3KJS6Window27clearHelperObjectPropertiesEv
-__ZN7WebCore12gcControllerEv
-__ZN7WebCore12GCControllerC2Ev
-__ZN7WebCore12GCController18garbageCollectSoonEv
-__ZN7WebCore5Frame14clearDOMWindowEv
-__ZN7WebCore9DOMWindow5clearEv
-__ZN7WebCore8KJSProxy20clearDocumentWrapperEv
-__ZN7WebCore5Frame18clearScriptObjectsEv
-__ZN7WebCore5Frame26clearPlatformScriptObjectsEv
--[WebScriptObject _setOriginRootObject:andRootObject:]
-__ZN7WebCore5Frame25setUseSecureKeyboardEntryEb
-__ZN7WebCore16DeprecatedString6insertEjc
-__ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore19TextResourceDecoder11setEncodingERKNS_12TextEncodingENS0_14EncodingSourceE
-__ZN7WebCore11TextDecoder5resetERKNS_12TextEncodingE
-__ZN7WebCore15metaConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLMetaElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLMetaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLMetaElement7processEv
-__ZNK7WebCore15HTMLMetaElement17endTagRequirementEv
-__ZNK7WebCore15HTMLMetaElement11tagPriorityEv
-__ZN7WebCore15HTMLMetaElement20insertedIntoDocumentEv
-__ZN7WebCore8Document16processHttpEquivERKNS_6StringES3_
-__ZN7WebCore15linkConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLLinkElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLLinkElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLLinkElement20tokenizeRelAttributeERKNS_12AtomicStringE
-__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEm
-__ZN7WebCore15HTMLLinkElement7processEv
-__ZNK7WebCore15HTMLLinkElement17endTagRequirementEv
-__ZNK7WebCore15HTMLLinkElement11tagPriorityEv
-__ZN7WebCore15HTMLLinkElement20insertedIntoDocumentEv
-__ZN7WebCore17scriptConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLScriptElementC2EPNS_8DocumentE
-__ZN7WebCore17HTMLScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLScriptElement17endTagRequirementEv
-__ZNK7WebCore17HTMLScriptElement11tagPriorityEv
-__ZN7WebCore17HTMLScriptElement20insertedIntoDocumentEv
-__ZN7WebCore13HTMLTokenizer13scriptHandlerENS0_5StateE
-__ZN7WebCore9DocLoader13requestScriptERKNS_6StringES3_
-__ZN7WebCore12CachedScriptC2EPNS_9DocLoaderERKNS_6StringES5_
-__ZNK7WebCore19ResourceRequestBase15httpHeaderFieldERKNS_6StringE
-__ZN7WebCore17HTMLScriptElement21finishParsingChildrenEv
-__ZN7WebCore15SegmentedString7prependERKS0_
-__ZN7WebCore15SegmentedString7prependERKNS_18SegmentedSubstringE
-__ZN7WebCore12CachedScript3refEPNS_20CachedResourceClientE
--[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]
-__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
-__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
-__ZN7WebCore4KURL11setProtocolERKNS_16DeprecatedStringE
-__ZN7WebCoreplERKNS_16DeprecatedStringEPKc
-__ZN7WebCore4KURL7setHostERKNS_16DeprecatedStringE
-__ZN7WebCore12TextCodecICU6encodeEPKtmb
-__ZN7WebCore7CStringC2EPKcj
+__ZN7WebCore11BitmapImage14startAnimationEb
+__ZN7WebCore11BitmapImage13shouldAnimateEv
+__ZThn392_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZN7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZN7WebCore14CachedResource14setDecodedSizeEj
+__ZN7WebCore5Cache32insertInLiveDecodedResourcesListEPNS_14CachedResourceE
+__ZN7WebCore11BitmapImage21mayFillWithSolidColorEv
+__ZNK7WebCore11BitmapImage16currentFrameSizeEv
+__ZThn392_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZN7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZN7WebCore14CachedResource20didAccessDecodedDataEd
+__ZN7WebCore5Cache34removeFromLiveDecodedResourcesListEPNS_14CachedResourceE
+__ZNK7WebCore13RootInlineBox16paintEllipsisBoxERNS_12RenderObject9PaintInfoEii
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore9RenderBox16overflowClipRectEii
+__ZNK7WebCore11RenderLayer22verticalScrollbarWidthEv
+__ZNK7WebCore11RenderLayer25horizontalScrollbarHeightEv
+__ZNK7WebCore11RenderLayer11boundingBoxEPKS0_
+__ZNK7WebCore11RenderLayer16localBoundingBoxEv
+__ZN7WebCore13InlineTextBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineTextBox14selectionStateEv
+__ZN7WebCore13InlineTextBox20paintDocumentMarkersEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontEb
+__ZN7WebCore8Document14markersForNodeEPNS_4NodeE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHa
+__ZNK7WebCore13InlineTextBox7textPosEv
+__ZN7WebCore21updateGraphicsContextEPNS_15GraphicsContextERKNS_5ColorES4_f
+__ZN7WebCoreL20paintTextWithShadowsEPNS_15GraphicsContextERKNS_4FontERKNS_7TextRunEiiRKNS_8IntPointEiiiiPNS_10ShadowDataEb
+__ZN7WebCore15GraphicsContext8drawTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEii
+__ZNK7WebCore13RootInlineBox5blockEv
+__ZN7WebCore15GraphicsContext4clipERKNS_9FloatRectE
+__ZN7WebCore11RenderLayer21paintOverflowControlsEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore11RenderLayer17paintScrollCornerEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCoreL16scrollCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCore11RenderLayer12paintResizerEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore14RenderFieldset19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore11RenderBlock15borderFitAdjustERiS1_
+__ZN7WebCore20RenderBoxModelObject14paintBoxShadowEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
+__ZN7WebCore20RenderBoxModelObject11paintBorderEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
+__ZN7WebCore20RenderBoxModelObject19paintNinePieceImageEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleERKNS_14NinePieceImageENS_1
+__ZN7WebCore12RenderObject18drawLineForBoxSideEPNS_15GraphicsContextEiiiiNS_7BoxSideENS_5ColorERKS4_NS_12EBorderStyleEii
+__ZN7WebCore15GraphicsContext14setStrokeStyleERKNS_11StrokeStyleE
+__ZN7WebCore15GraphicsContext8drawRectERKNS_7IntRectE
+__ZNK7WebCore15GraphicsContext11strokeStyleEv
+__ZN7WebCore27RenderTextControlSingleLine5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderTheme5paintEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore15GraphicsContext20updatingControlTintsEv
+__ZN7WebCore11RenderTheme16paintDecorationsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore11RenderTheme15paintBorderOnlyEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac14paintTextFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore27LocalCurrentGraphicsContextC1EPNS_15GraphicsContextE
+__ZN7WebCore27LocalCurrentGraphicsContextC2EPNS_15GraphicsContextE
+__ZNK7WebCore11RenderTheme9isEnabledEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme17isReadOnlyControlEPKNS_12RenderObjectE
+__ZN7WebCore27LocalCurrentGraphicsContextD1Ev
+__ZN7WebCore27LocalCurrentGraphicsContextD2Ev
+__ZN7WebCore9RenderBox15popContentsClipERNS_12RenderObject9PaintInfoENS_10PaintPhaseEii
+__ZN7WebCore14RenderThemeMac13paintMenuListEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac23setPopupButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac11popupButtonEv
+__ZNK7WebCore14RenderThemeMac16popupButtonSizesEv
+__ZN7WebCore14RenderThemeMac14setControlSizeEP6NSCellPKNS_7IntSizeERS4_f
+__ZN7WebCore14RenderThemeMac18updateCheckedStateEP6NSCellPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme15isIndeterminateEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isCheckedEPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updateEnabledStateEP6NSCellPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updatePressedStateEP6NSCellPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updateFocusedStateEP6NSCellPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isFocusedEPKNS_12RenderObjectE
+__ZNK7WebCore14RenderThemeMac18popupButtonMarginsEv
+__ZNK7WebCore14RenderThemeMac11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
+__ZNK7WebCore14RenderMenuList15controlClipRectEii
+__ZNK7WebCore11RenderTheme24controlStatesForRendererEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isHoveredEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isPressedEPKNS_12RenderObjectE
+__ZThn128_NK7WebCore16HTMLInputElement9isCheckedEv
+__ZNK7WebCore16HTMLInputElement9isCheckedEv
+__ZNK7WebCore11RenderTheme8isActiveEPKNS_12RenderObjectE
+__ZThn128_NK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZNK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZNK7WebCore8ThemeMac5paintENS_11ControlPartEjPNS_15GraphicsContextERKNS_7IntRectEfPNS_10ScrollViewE
+__ZN7WebCoreL6buttonENS_11ControlPartEjRKNS_7IntRectEf
+__ZN7WebCoreL14setControlSizeEP6NSCellPKNS_7IntSizeERS3_f
+__ZN7WebCoreL12updateStatesEP6NSCellj
+__ZN7WebCoreL13buttonMarginsEm
+__ZN7WebCoreL11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
+__ZNK7WebCore12RenderButton15controlClipRectEii
+__ZN7WebCore20CachedResourceClient14notifyFinishedEPNS_14CachedResourceE
+__ZNK7WebCore9Tokenizer10wellFormedEv
+__ZN7WebCore11FrameLoader15startIconLoaderEv
+__ZN7WebCore11FrameLoader7iconURLEv
 __ZN7WebCore12IconDatabase22loadDecisionForIconURLERKNS_6StringEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader27commitIconURLToIconDatabaseERKNS_4KURLE
 __ZN7WebCore12IconDatabase20setIconURLForPageURLERKNS_6StringES3_
-__ZNK7WebCore13PageURLRecord8snapshotEb
-__ZN3WTF7HashMapIN7WebCore6StringENS1_15PageURLSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E3addINS1_6StringES5_NS_17HashMapTranslatorILb0ES4_ISH_S5_ENS_18PairBaseHashTraitsINSB_ISH_EESD_EESE_S9_EEEES4_INS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EEbERKT_RKT0_
-__ZN7WebCore12IconDatabase24scheduleOrDeferSyncTimerEv
 __ZNK7WebCore11FrameLoader18originalRequestURLEv
-__ZNK7WebCore14DocumentLoader14initialRequestEv
 __ZN7WebCore12IconDatabase23iconDataKnownForIconURLERKNS_6StringE
-__ZN7WebCore10IconRecord15imageDataStatusEv
-__ZN3WTF7HashSetIPN7WebCore10IconRecordENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore12IconDatabase14wakeSyncThreadEv
-__ZN7WebCore15ThreadCondition6signalEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase37getImageDataForIconURLFromSQLDatabaseERKNS_6StringE
-__ZN7WebCore15SQLiteStatement8bindTextEiRKNS_6StringE
-_sqlite3_bind_text16
-_bindText
-_vdbeUnbind
-_accessPayload
-__ZN7WebCore15SQLiteStatement21getColumnBlobAsVectorEiRN3WTF6VectorIcLm0EEE
-_sqlite3_column_blob
-_sqlite3_column_bytes
-__ZN3WTF6VectorIcLm0EE6resizeEm
-__ZN7WebCore12SharedBufferC2Ev
-__ZN7WebCore12SharedBuffer6appendEPKci
-__ZN7WebCore12SharedBuffer25maybeTransferPlatformDataEv
-__ZN3WTF6VectorIcLm0EE6appendIcEEvPKT_m
-__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
-__ZN7WebCore15SQLiteStatement5resetEv
-_sqlite3_reset
-__ZN7WebCore15AutodrainedPool5cycleEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase33setIconURLForPageURLInSQLDatabaseERKNS_6StringES3_
-__ZN7WebCore12IconDatabase34getIconIDForIconURLFromSQLDatabaseERKNS_6StringE
-__ZN7WebCore15SQLiteStatement14getColumnInt64Ei
-_sqlite3_column_int64
-__ZN7WebCore12IconDatabase32setIconIDForPageURLInSQLDatabaseExRKNS_6StringE
-_sqlite3IdListAppend
-_sqlite3Insert
-_sqlite3ViewGetColumnNames
-_sqlite3BeginWriteOperation
-_autoIncBegin
-_sqlite3OpenTableAndIndices
-_sqlite3GenerateConstraintChecks
-_sqlite3GenerateRowDelete
-_sqlite3GenerateIndexKey
-_sqlite3CompleteInsertion
-_autoIncEnd
-__ZN7WebCore15SQLiteStatement9bindInt64Eix
-_sqlite3_bind_int64
-_pager_open_journal
-_unixSetFullSync
-_unixOpenDirectory
-_writeJournalHdr
-_sqlite3UnixRandomSeed
-_unixWrite
-_sqlite3PagerCommitPhaseOne
-_syncJournal
-_unixSync
-__ZN7WebCore17SubresourceLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore6Loader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZNK7WebCore20ResourceResponseBase16textEncodingNameEv
-__ZN7WebCore17SubresourceLoader14didReceiveDataEPKcixb
-__ZN7WebCore6Loader14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore17SubresourceLoader16didFinishLoadingEv
-__ZN7WebCore6Loader16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZN7WebCore12CachedScript4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore5Cache10adjustSizeEbi
-__ZN7WebCore12CachedScript11checkNotifyEv
-__ZThn8_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZNK7WebCore21DeprecatedPtrListImpl8getFirstEv
-__ZN7WebCore21DeprecatedPtrListImpl11removeFirstEb
-__ZN7WebCore21DeprecatedPtrListImpl6removeEjb
-__ZN7WebCore14CachedResource5derefEPNS_20CachedResourceClientE
-__ZN7WebCore5Cache27removeFromLiveResourcesSizeEPNS_14CachedResourceE
-__ZN7WebCore14CachedResource20allReferencesRemovedEv
-__ZN7WebCore17HTMLScriptElement25shouldExecuteAsJavaScriptEv
-__ZN7WebCore16MIMETypeRegistry29isSupportedJavaScriptMIMETypeERKNS_6StringE
-__ZN7WebCore13HTMLTokenizer15scriptExecutionERKNS_6StringENS0_5StateES3_i
-__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEiS3_
-__ZN7WebCore8KJSProxy8evaluateERKNS_6StringEiS3_
-__ZN3KJS6Window10globalExecEv
-__ZN7WebCore5Frame9keepAliveEv
-__ZNK7WebCore6StringcvN3KJS7UStringEEv
-_pager_write_pagelist
-_pager_end_transaction
-_unixClose
-_binCompare
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE6shrinkEm
-__ZN7WebCore12IconDatabase20pruneUnretainedIconsEv
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IaEEEESB_E8containsIS3_NS_22IdentityHashTranslatorIS3_S5_S8_EEEEbRKT_
-_sqlite3DeleteFrom
-_clearCell
-_freeSpace
-__ZN7WebCore11JSDOMWindow18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore11JSDOMWindow24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11JSDOMWindow4implEv
-__ZNK7WebCore20JSDOMWindowPrototype9classInfoEv
-__ZN3KJS6Window18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN7WebCore12AtomicString3addERKN3KJS10IdentifierE
-__ZNK7WebCore9FrameTree5childERKNS_12AtomicStringE
-__ZNK3KJS6Window16allowsAccessFromEPNS_9ExecStateE
-__ZNK3KJS6Window16allowsAccessFromEPKNS_14JSGlobalObjectERN7WebCore14SecurityOrigin6ReasonERNS4_6StringE
-__ZN7WebCore12HTMLDocument12hasNamedItemERKNS_6StringE
-__ZNK3WTF7HashMapIPN7WebCore10StringImplEiNS1_10StringHashENS_10HashTraitsIS3_EENS5_IiEEE3getERKS3_
-__ZNK7WebCore8Document14getElementByIdERKNS_12AtomicStringE
-__ZN7WebCore20JSDOMWindowPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK3KJS14JSGlobalObject14isGlobalObjectEv
-__ZN3KJS17staticValueGetterIN7WebCore11JSDOMWindowEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSDOMWindow16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore9DOMWindow4selfEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9DOMWindowE
-__ZN3KJS17staticValueGetterINS_6WindowEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS6Window16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS9NavigatorC1EPNS_8JSObjectEPN7WebCore5FrameE
-__ZN3KJS9Navigator18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_9NavigatorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS9Navigator16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore9DOMWindow8documentEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8DocumentE
-__ZN3KJS17ScriptInterpreter12getDOMObjectEPv
-__ZNK3WTF7HashMapIPvPN3KJS9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3getERKS1_
-__ZN7WebCore23JSHTMLDocumentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSDocumentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSNodePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSHTMLDocumentC1EPN3KJS8JSObjectEPNS_12HTMLDocumentE
-__ZN7WebCore10JSDocumentC1EPN3KJS8JSObjectEPNS_8DocumentE
-__ZN7WebCore17JSEventTargetNodeC2EPN3KJS8JSObjectEPNS_4NodeE
-__ZN7WebCore6JSNodeC1EPN3KJS8JSObjectEPNS_4NodeE
-__ZN3KJS17ScriptInterpreter12putDOMObjectEPvPNS_9DOMObjectE
-__ZN3WTF7HashMapIPvPN3KJS9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3setERKS1_RKS4_
-__ZN7WebCore14JSHTMLDocument18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14JSHTMLDocument18canGetItemsForNameEPN3KJS9ExecStateEPNS_12HTMLDocumentERKNS1_10IdentifierE
-__ZN7WebCore6StringC2ERKN3KJS10IdentifierE
-__ZN7WebCore12HTMLDocument20hasDocExtraNamedItemERKNS_6StringE
-__ZN7WebCore10JSDocument18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSEventTargetNode18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore6JSNode18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSHTMLDocumentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSDocumentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS20staticFunctionGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore13JSHTMLElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore40jsDocumentPrototypeFunctionCreateElementEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSHTMLDocument9classInfoEv
-__ZN7WebCore6StringC2ERKN3KJS7UStringE
-__ZN7WebCore12HTMLDocument13createElementERKNS_6StringERi
-__ZN7WebCore8Document11isValidNameERKNS_6StringE
-__ZN7WebCore14divConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLDivElementC2EPNS_8DocumentE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_11EventTargetE
-__ZN7WebCore11EventTarget20toSVGElementInstanceEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN3KJS17ScriptInterpreter21getDOMNodeForDocumentEPN7WebCore8DocumentEPNS1_4NodeE
-__ZN7WebCore19createJSHTMLWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3KJS9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSG_ISD_EEE3getERKS3_
-__ZN7WebCore16createDivWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLDivElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLDivElementC1EPN3KJS8JSObjectEPNS_14HTMLDivElementE
-__ZN7WebCore13JSHTMLElementC1EPN3KJS8JSObjectEPNS_11HTMLElementE
-__ZN7WebCore9JSElementC1EPN3KJS8JSObjectEPNS_7ElementE
-__ZN3KJS17ScriptInterpreter21putDOMNodeForDocumentEPN7WebCore8DocumentEPNS1_4NodeEPNS1_6JSNodeE
-__ZNK3WTF7HashMapIPN7WebCore8DocumentEPNS0_IPNS1_4NodeEPNS1_6JSNodeENS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEEENS8_IS3_EENSA_IS3_EENSA_ISE_EEE3getERKS3_
-__ZNK3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN3KJS15setDOMExceptionEPNS_9ExecStateEi
-__ZN7WebCore16JSHTMLDivElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13JSHTMLElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15formConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17createFormWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLFormElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLFormElementC1EPN3KJS8JSObjectEPNS_15HTMLFormElementE
-__ZN7WebCore17JSHTMLFormElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSHTMLElement4implEv
-__ZNK7WebCore9JSElement4implEv
-__ZN7WebCore17JSHTMLFormElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_15HTMLFormElementERKNS1_10IdentifierE
-__ZN7WebCore15HTMLFormElement16getNamedElementsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZNK7WebCore14HTMLCollection10namedItemsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZNK7WebCore18HTMLFormCollection15updateNameCacheEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE3addERKS3_RKS8_
-__ZN7WebCore15HTMLFormElement15elementForAliasERKNS_12AtomicStringE
-__ZN3KJS8JSObject18isActivationObjectEv
-__ZN7WebCore41jsDocumentPrototypeFunctionCreateTextNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document14createTextNodeERKNS_6StringE
-__ZN7WebCore15JSTextPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSCharacterDataPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore6JSTextC1EPN3KJS8JSObjectEPNS_4TextE
-__ZN7WebCore15JSCharacterDataC2EPN3KJS8JSObjectEPNS_13CharacterDataE
-__ZN3KJS8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN7WebCore18JSElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSEventTargetPrototypeINS_15JSNodePrototypeENS_33JSEventTargetPrototypeInformationEE18getOwnPropertySlotEPN3KJS9ExecStateERKNS4_10IdentifierERNS4_12PropertySlotE
-__ZN7WebCore15JSNodePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34jsNodePrototypeFunctionAppendChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSHTMLDivElement9classInfoEv
-__ZN7WebCore6JSNode11appendChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore6toNodeEPN3KJS7JSValueE
-__ZNK7WebCore6JSText9classInfoEv
-__ZN7WebCore13ContainerNode11appendChildEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore4Node13checkAddChildEPS0_Ri
-__ZN7WebCore4Node14isReadOnlyNodeEv
-__ZN7WebCore28dispatchChildInsertionEventsEPNS_4NodeERi
-__ZN7WebCore15EventTargetNode28dispatchSubtreeModifiedEventEb
-__ZN7WebCore4Node30notifyNodeListsChildrenChangedEv
-__ZN7WebCore4Node35notifyLocalNodeListsChildrenChangedEv
-__ZN7WebCore14JSHTMLDocument3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore10JSDocument3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSEventTargetNode3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore6JSNode3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore6JSNode14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSNodeConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore17JSNodeConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSNodeConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore9JSElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore11JSDOMWindow3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSDOMWindow9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSDOMWindow16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore20JSElementConstructor9classInfoEv
-__ZN7WebCore20JSElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore7JSEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore16JSEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSHTMLElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS26windowProtoFuncSetIntervalEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Window14installTimeoutEPNS_7JSValueERKNS_4ListEib
-__ZN7WebCore15ScheduledActionC1EPN3KJS7JSValueERKNS1_4ListE
-__ZN3KJS12ProtectedPtrINS_7JSValueEEC2EPS1_
-__ZN3KJS6Window14installTimeoutEPN7WebCore15ScheduledActionEib
-__ZN3WTF7HashMapIiPN3KJS14DOMWindowTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE4takeERKi
-__ZNK3KJS8JSObject21masqueradeAsUndefinedEv
-__ZN3KJS6Window3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS31windowProtoFuncAddEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Window27findOrCreateJSEventListenerEPNS_7JSValueEb
-__ZN3KJS6Window19findJSEventListenerEPNS_7JSValueEb
-__ZN3WTF7HashMapIPN3KJS8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore15JSEventListenerC2EPN3KJS8JSObjectEPNS1_6WindowEb
-__ZN7WebCore23JSAbstractEventListenerC2Eb
-__ZN3KJS12ProtectedPtrINS_8JSObjectEEC2EPS1_
-__ZN3KJS12ProtectedPtrINS_6WindowEEC2EPS1_
-__ZN3KJS6Window16jsEventListenersEv
-__ZN7WebCore12AtomicString3addERKN3KJS7UStringE
-__ZN7WebCore8Document22addWindowEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore8Document25removeWindowEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore23RegisteredEventListenerC2ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN3KJS6Window4markEv
-__ZN7WebCore6JSNode4markEv
-__ZN7WebCore10JSDocument4markEv
-__ZN3KJS17ScriptInterpreter23markDOMNodesForDocumentEPN7WebCore8DocumentE
-__ZN3KJS17ScriptInterpreter24forgetDOMNodeForDocumentEPN7WebCore8DocumentEPNS1_4NodeE
-__ZN7WebCore14HTMLDivElementD1Ev
-__ZN7WebCore17JSHTMLFormElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLFormElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLInputElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLInputElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore31JSHTMLInputElementBasePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore29JSHTMLInputElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLSelectElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLSelectElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLSelectElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLTextAreaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
-__ZN7WebCore15PluginInfoStore32createPluginInfoForPluginAtIndexEj
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE15reserveCapacityEm
-__ZN3KJS7Plugins18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_7PluginsEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS7Plugins16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS7Plugins11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS6Plugin18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_6PluginEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS6Plugin16getValuePropertyEPNS_9ExecStateEi
-__ZNK3KJS8JSObject11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZN7WebCore27jsLocationProtoFuncToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore10JSLocation9classInfoEv
-__ZNK7WebCore4KURL7hasPathEv
-__ZNK7WebCore4KURL9prettyURLEv
-__ZN7WebCoreplEPKcRKNS_16DeprecatedStringE
-__ZNK7WebCore8Document8referrerEv
-__ZNK7WebCore11FrameLoader8referrerEv
-__ZN3KJS10PluginBaseD0Ev
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE6shrinkEm
-__ZN3KJS6Window15namedItemGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore8Document16windowNamedItemsERKNS_6StringE
-__ZN7WebCore18HTMLNameCollectionC1EN3WTF10PassRefPtrINS_8DocumentEEENS_14HTMLCollection4TypeERKNS_6StringE
-__ZN7WebCore8Document18nameCollectionInfoENS_14HTMLCollection4TypeERKNS_12AtomicStringE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLCollection14CollectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6_
-__ZNK7WebCore18HTMLNameCollection9itemAfterEPNS_7ElementE
-__ZNK7WebCore14HTMLCollection9firstItemEv
-__ZN7WebCore18JSHTMLImageElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLImageElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLImageElement6setSrcERKNS_6StringE
-__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_6StringE
-__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameEPNS_10StringImplERi
-__ZN7WebCore12NamedAttrMap14isReadOnlyNodeEv
-__ZN7WebCore13StyledElement15createAttributeERKNS_13QualifiedNameEPNS_10StringImplE
-__ZN7WebCore7Element25dispatchAttrAdditionEventEPNS_9AttributeE
-__ZN7WebCore4Node31notifyNodeListsAttributeChangedEv
-__ZN7WebCore4Node36notifyLocalNodeListsAttributeChangedEv
-__ZNK7WebCore15ProgressTracker17estimatedProgressEv
-__ZN7WebCore5TimerINS_9FrameViewEE5firedEv
-__ZN7WebCore9FrameView16layoutTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore12RenderObject33expandsToEncloseOverhangingFloatsEv
-__ZN7WebCore11RenderBlock13containsFloatEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock22insertPositionedObjectEPNS_12RenderObjectE
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore12RenderObjectEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E3addIS4_PNS_24ListHashSetNodeAllocatorIS4_EENS_21ListHashSetTranslatorIS4_SB_EEEESt4pairINS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore12RenderObjectEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E6expandEv
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore11RenderBlock21adjustPositionedBlockEPNS_12RenderObjectERKNS0_10MarginInfoE
-__ZNK7WebCore12RenderObject10hasStaticXEv
-__ZN7WebCore9RenderBox22calcAbsoluteHorizontalEv
-__ZNK7WebCore9RenderBox33containingBlockWidthForPositionedEPKNS_12RenderObjectE
-__ZN7WebCore9RenderBox28calcAbsoluteHorizontalValuesENS_6LengthEPKNS_12RenderObjectENS_13TextDirectionEiiS1_S1_S1_S1_RiS6_S6_S6_
-__ZNK7WebCore25HTMLTextFieldInnerElement12isShadowNodeEv
-__ZN7WebCore9RenderBox20calcAbsoluteVerticalEv
-__ZNK7WebCore9RenderBox34containingBlockHeightForPositionedEPKNS_12RenderObjectE
-__ZN7WebCore9RenderBox26calcAbsoluteVerticalValuesENS_6LengthEPKNS_12RenderObjectEiiS1_S1_S1_S1_RiS5_S5_S5_
-__ZNK7WebCore9RenderBox23relativePositionOffsetXEv
-__ZNK7WebCore9RenderBox23relativePositionOffsetYEv
-__ZN7WebCore9InlineBoxD1Ev
-__ZNK7WebCore11RenderLayer27enclosingPositionedAncestorEv
-__ZN7WebCore5TimerINS_13HTMLTokenizerEE5firedEv
-__ZN7WebCore13HTMLTokenizer10timerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore9RenderBox16inlineBoxWrapperEv
-__ZN7WebCore11RenderBlock17deleteLineBoxTreeEv
-__ZN7WebCore15RenderContainer13moveChildNodeEPNS_12RenderObjectE
-__ZN7WebCore20paragraphConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore20HTMLParagraphElementC2EPNS_8DocumentE
-__ZNK7WebCore20HTMLParagraphElement17endTagRequirementEv
-__ZNK7WebCore20HTMLParagraphElement11tagPriorityEv
-__ZN7WebCore20HTMLParagraphElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore11HTMLElement15inInlineTagListEPKNS_4NodeE
-__ZNK7WebCore20HTMLParagraphElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore20HTMLParagraphElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11HTMLElement20setHTMLEventListenerERKNS_12AtomicStringEPNS_9AttributeE
-__ZN7WebCore8Document23createHTMLEventListenerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore8KJSProxy22createHTMLEventHandlerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore19JSLazyEventListenerC2ERKNS_6StringES3_PN3KJS6WindowEPNS_4NodeEi
-__ZN7WebCore15EventTargetNode20setHTMLEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore15EventTargetNode23removeHTMLEventListenerERKNS_12AtomicStringE
-__ZN7WebCore8Document42registerDisconnectedNodeWithEventListenersEPNS_4NodeE
-__ZN3WTF7HashSetIPN7WebCore4NodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore8Document44unregisterDisconnectedNodeWithEventListenersEPNS_4NodeE
-__ZN7WebCore23JSAbstractEventListener11handleEventEPNS_5EventEb
-__ZNK7WebCore15JSEventListener11listenerObjEv
-__ZNK7WebCore15JSEventListener9windowObjEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_5EventE
-__ZNK7WebCore5Event15isKeyboardEventEv
-__ZNK7WebCore5Event11isTextEventEv
-__ZNK7WebCore5Event12isWheelEventEv
+__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate20updateAnimationTimerEb
+__ZN7WebCore11ImageLoader25dispatchPendingLoadEventsEv
+__ZN7WebCore8Document17dispatchLoadEventEv
+__ZN7WebCore9DOMWindow17dispatchLoadEventEv
+__ZN7WebCore15JSEventListener11handleEventEPNS_5EventEb
+__ZNK7WebCore15JSEventListener10jsFunctionEv
+__ZNK7WebCore15JSDOMWindowBase22scriptExecutionContextEv
+__ZThn88_NK7WebCore8Document10isDocumentEv
+__ZNK7WebCore8Document10isDocumentEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5EventE
 __ZNK7WebCore5Event9isUIEventEv
 __ZNK7WebCore5Event15isMutationEventEv
 __ZNK7WebCore5Event15isOverflowEventEv
 __ZNK7WebCore5Event14isMessageEventEv
 __ZNK7WebCore5Event15isProgressEventEv
-__ZN7WebCore7JSEventC1EPN3KJS8JSObjectEPNS_5EventE
-__ZN3KJS6Window15setCurrentEventEPN7WebCore5EventE
-__ZN3KJS27windowProtoFuncClearTimeoutEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Window12clearTimeoutEib
-__ZN3KJS14DOMWindowTimerD1Ev
-__ZN3KJS12ProtectedPtrINS_7JSValueEED2Ev
-__ZN7WebCore47jsDocumentPrototypeFunctionGetElementsByTagNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8NodeListE
-__ZN7WebCore19JSNodeListPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSNodeListC1EPN3KJS8JSObjectEPNS_8NodeListE
-__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore10JSNodeListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSNodeList16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore10JSNodeList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore15DynamicNodeList4itemEj
-__ZNK7WebCore15DynamicNodeList23itemForwardsFromCurrentEPNS_4NodeEji
-__ZN7WebCore18createInputWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLInputElementC1EPN3KJS8JSObjectEPNS_16HTMLInputElementE
-__ZN7WebCore22JSHTMLInputElementBaseC2EPN3KJS8JSObjectEN3WTF10PassRefPtrINS_16HTMLInputElementEEE
-__ZN7WebCore18JSHTMLInputElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSHTMLInputElementBase18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement16canHaveSelectionEv
-__ZN7WebCore27JSHTMLInputElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSHTMLInputElementBasePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore13JSHTMLElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore13JSHTMLElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore11HTMLElement9classNameEv
-__ZN7WebCore12RenderObject16setStyleInternalEPNS_11RenderStyleE
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE6shrinkEm
-__ZN7WebCore11LayoutStatenwEmPNS_11RenderArenaE
-__ZN7WebCore11LayoutStateC2EPS0_PNS_9RenderBoxERKNS_7IntSizeE
-__ZN7WebCore11RenderBlock20determineEndPositionEPNS_13RootInlineBoxERNS_12BidiIteratorERNS_10BidiStatusERi
-__ZN7WebCore13InlineFlowBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore9InlineBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore9RenderBox19setInlineBoxWrapperEPNS_9InlineBoxE
-__ZN7WebCore10RenderFlow13removeLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore11LayoutState7destroyEPNS_11RenderArenaE
-__ZN7WebCore11LayoutStatedlEPvm
-__ZN7WebCore12RenderObject26repaintAfterLayoutIfNeededERKNS_7IntRectES3_
-__ZNK7WebCore12RenderObject29mustRepaintBackgroundOrBorderEv
-__ZN7WebCore9FrameView14addRepaintInfoEPNS_12RenderObjectERKNS_7IntRectE
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE15reserveCapacityEm
-__ZN7WebCore9RenderBox26repaintDuringLayoutIfMovedERKNS_7IntRectE
-__ZN7WebCore11RenderBlock24repaintOverhangingFloatsEb
-__ZNK7WebCore12RenderObject14isDescendantOfEPKS0_
-__ZN7WebCore11RenderBlock37markAllDescendantsWithFloatsForLayoutEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock18addIntrudingFloatsEPS0_ii
-__ZN7WebCore12RenderObject24repaintOverhangingFloatsEb
-__ZN7WebCore11RenderBlock19adjustFloatingBlockERKNS0_10MarginInfoE
-__ZNK7WebCore11RenderBlock18nearestFloatBottomEi
-__ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE6shrinkEm
-__ZN7WebCore13compareZIndexEPNS_11RenderLayerES1_
-__ZSt25__unguarded_linear_insertIPPN7WebCore11RenderLayerES2_PFbS2_S2_EEvT_T0_T1_
-__ZSt5mergeIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
-__ZN7WebCore9nullImageEv
-__ZN7WebCore12RenderObject11paintBorderEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
-__ZN7WebCore12RenderObject10drawBorderEPNS_15GraphicsContextEiiiiNS0_10BorderSideENS_5ColorERKS4_NS_12EBorderStyleEii
-__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectERKNS_8IntPointERKNS_7IntSizeENS_17CompositeOperatorE
-__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectERKNS_10FloatPointERKNS_9FloatSizeENS_17CompositeOperatorE
-__ZN7WebCore11BitmapImage26nativeImageForCurrentFrameEv
-__ZN7WebCore11ImageSource15repetitionCountEv
-__ZThn256_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
-__ZN7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
-__ZN7WebCore14CachedResource14setDecodedSizeEj
-__ZN7WebCore5Cache32insertInLiveDecodedResourcesListEPNS_14CachedResourceE
-__ZNK7WebCore5Image16hasRelativeWidthEv
-__ZNK7WebCore5Image17hasRelativeHeightEv
-__ZN7WebCore15AffineTransformC2Ev
-__ZN7WebCore15AffineTransform5scaleEdd
-__ZNK7WebCore9FloatRect8containsERKS0_
-__ZThn256_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
-__ZN7WebCore11CachedImage7didDrawEPKNS_5ImageE
-__ZN7WebCore14CachedResource20didAccessDecodedDataEd
-__ZN7WebCore14RenderThemeMac16paintSearchFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac6searchEv
-__ZN7WebCore14RenderThemeMac18setSearchCellStateEPNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore17RenderTextControl15controlClipRectEii
-__ZNK7WebCore12RenderObject10contentBoxEv
-__ZN7WebCore14RenderThemeMac26paintSearchFieldDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore11RenderLayer11boundingBoxEPKS0_
-__ZNK7WebCore5Image4rectEv
-__ZNK7WebCore8Document4pageEv
-__ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectENS_17CompositeOperatorEb
-__ZN7WebCore11ImageSource20frameDurationAtIndexEm
-__ZN7WebCore11BitmapImage22invalidatePlatformDataEv
-__ZN7WebCore38jsDocumentPrototypeFunctionCreateEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document11createEventERKNS_6StringERi
-__ZN7WebCore5EventC2Ev
-__ZN7WebCore7JSEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33jsEventPrototypeFunctionInitEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7JSEvent9classInfoEv
-__ZN7WebCore5Event9initEventERKNS_12AtomicStringEbb
-__ZN7WebCore7JSEvent3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore26jsEventTargetDispatchEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7toEventEPN3KJS7JSValueE
-__ZThn36_N7WebCore15EventTargetNode13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore5TimerINS_8DocumentEE5firedEv
-__ZN7WebCore8Document24imageLoadEventTimerFiredEPNS_5TimerIS0_EE
-__ZN3KJS30JSXMLHttpRequestConstructorImpC2EPNS_9ExecStateEPN7WebCore8DocumentE
-__ZN3KJS25JSXMLHttpRequestPrototype4selfEPNS_9ExecStateE
-__ZNK3KJS30JSXMLHttpRequestConstructorImp19implementsConstructEv
-__ZN3KJS30JSXMLHttpRequestConstructorImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS16JSXMLHttpRequestC1EPNS_8JSObjectEPN7WebCore8DocumentE
-__ZN7WebCore14XMLHttpRequestC2EPNS_8DocumentE
-__ZNK3WTF7HashMapIPN7WebCore8DocumentEPNS_7HashSetIPNS1_14XMLHttpRequestENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EENS9_IS3_EENS9_ISC_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E3addIPN7WebCore16AtomicStringImplESF_NS_17HashMapTranslatorILb1ES1_ISF_SF_ENS_18PairBaseHashTraitsINS8_ISF_EESJ_EESA_NS_7PtrHashISF_EEEEEES1_INS_17HashTableIteratorIiS2_S4_S6_SA_S9_EEbERKT_RKT0_
-__ZN3WTF7HashSetIPN7WebCore14XMLHttpRequestENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E3addIPN7WebCore5XPath4Step8NodeTestESD_NS_17HashSetTranslatorILb1ESD_NS5_ISD_EES6_NS_7PtrHashISD_EEEEEESt4pairINS_17HashTableIteratorIiiS2_S4_S6_S6_EEbERKT_RKT0_
-__ZNK3KJS16JSXMLHttpRequest9toBooleanEPNS_9ExecStateE
-__ZN3KJS16JSXMLHttpRequest18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_16JSXMLHttpRequestEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS16JSXMLHttpRequest16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore14XMLHttpRequest13getReadyStateEv
-__ZN3KJS25JSXMLHttpRequestPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS37jsXMLHttpRequestPrototypeFunctionOpenEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS16JSXMLHttpRequest9classInfoEv
-__ZN3KJS6Window14retrieveActiveEPNS_9ExecStateE
-__ZN7WebCore16DeprecatedStringC2ERKN3KJS7UStringE
-__ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
-__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbRi
-__ZN7WebCore14XMLHttpRequest5abortEv
-__ZNK7WebCore14XMLHttpRequest24urlMatchesDocumentDomainERKNS_4KURLE
-__ZN7WebCore12isValidTokenERKNS_6StringE
-__ZNK7WebCore6String5upperEv
-__ZN7WebCore10StringImpl5upperEv
-__ZN7WebCore14XMLHttpRequest11changeStateENS_19XMLHttpRequestStateE
-__ZN7WebCore14XMLHttpRequest28callReadyStateChangeListenerEv
-__ZN7WebCore14XMLHttpRequest13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN3KJS25windowProtoFuncSetTimeoutEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16JSXMLHttpRequest3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS16JSXMLHttpRequest16putValuePropertyEPNS_9ExecStateEiPNS_7JSValueEi
-__ZN3KJS6Window38findOrCreateJSUnprotectedEventListenerEPNS_7JSValueEb
-__ZN3KJS6Window30findJSUnprotectedEventListenerEPNS_7JSValueEb
-__ZN3WTF7HashMapIPN3KJS8JSObjectEPN7WebCore26JSUnprotectedEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore26JSUnprotectedEventListenerC2EPN3KJS8JSObjectEPNS1_6WindowEb
-__ZN3KJS6Window31jsUnprotectedHTMLEventListenersEv
-__ZN7WebCore14XMLHttpRequest29setOnReadyStateChangeListenerEPNS_13EventListenerE
-__ZN3KJS49jsXMLHttpRequestPrototypeFunctionSetRequestHeaderEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest16setRequestHeaderERKNS_6StringES3_Ri
-__ZN7WebCore19canSetRequestHeaderERKNS_6StringE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S6_EEEEbRKT_
-__ZN3KJS37jsXMLHttpRequestPrototypeFunctionSendEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest4sendERKNS_6StringERi
-__ZN7WebCore19ResourceRequestBase13setHTTPMethodERKNS_6StringE
-__ZN7WebCore19ResourceRequestBase19addHTTPHeaderFieldsERKN3WTF7HashMapINS_6StringES3_NS_15CaseFoldingHashENS1_10HashTraitsIS3_EES6_EE
-__ZN7WebCore19ResourceRequestBase18addHTTPHeaderFieldERKNS_6StringES3_
-__ZN7WebCore41jsDocumentPrototypeFunctionGetElementByIdEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore38jsElementPrototypeFunctionSetAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore5Event14isStorageEventEv
+__ZNK7WebCore5Event22isWebKitAnimationEventEv
+__ZNK7WebCore5Event23isWebKitTransitionEventEv
+__ZN7WebCore7JSEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3JSC9Structure6createENS_7JSValueERKNS_8TypeInfoE
+__ZN7WebCore7JSEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5EventEEE
+__ZN7WebCore7JSEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5EventEEE
+__ZNK7WebCore17JSDOMGlobalObject12currentEventEv
+__ZN7WebCore17JSDOMGlobalObject15setCurrentEventEPNS_5EventE
+__ZN7WebCore14JSHTMLDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14JSHTMLDocument18canGetItemsForNameEPN3JSC9ExecStateEPNS_12HTMLDocumentERKNS1_10IdentifierE
+__ZN7WebCore12AtomicString4findERKN3JSC10IdentifierE
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findINS1_17
+__ZN7WebCore23JSHTMLDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsDocumentPrototypeFunctionGetElementByIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
+__ZNK7WebCore14JSHTMLDocument9classInfoEv
+__ZNK7WebCore8Document14getElementByIdERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCoreL29createHTMLInputElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLInputElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLInputElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLInputElementEEE
+__ZN7WebCore18JSHTMLInputElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLInputElementEEE
+__ZN7WebCore18JSHTMLInputElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13JSHTMLElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLInputElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSHTMLElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsElementPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore18JSHTMLInputElement9classInfoEv
-__ZN7WebCore9JSElement12setAttributeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore7Element12setAttributeERKNS_6StringES3_Ri
-__ZNK7WebCore12NamedAttrMap16getAttributeItemERKNS_6StringE
-__ZN7WebCore38jsElementPrototypeFunctionGetAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element12getAttributeERKNS_6StringE
-__ZNK7WebCore13QualifiedName8toStringEv
-__ZN3KJS14jsStringOrNullERKN7WebCore6StringE
-__ZN7WebCore9InlineBox6removeEv
-__ZN7WebCore13InlineFlowBox11removeChildEPNS_9InlineBoxE
-__ZN7WebCore13RootInlineBox12childRemovedEPNS_9InlineBoxE
-__ZN7WebCore12RenderObject12removeLayersEPNS_11RenderLayerE
-__ZN7WebCore11RenderLayer11removeChildEPS0_
-__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE6shrinkEm
-__ZN7WebCore11RenderLayer28dirtyVisibleDescendantStatusEv
-__ZN7WebCore9InlineBox14dirtyLineBoxesEv
-__ZNK7WebCore14RenderThemeMac39adjustSearchFieldResultsDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore12RenderObject5layerEv
-__ZN7WebCore15DynamicNodeList24rootNodeAttributeChangedEv
-__ZN7WebCore18JSHTMLInputElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore22JSHTMLInputElementBase3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore13JSHTMLElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9JSElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSEventTargetNode16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore25eventNameForPropertyTokenEi
-__ZNK7WebCore17JSEventTargetNode11setListenerEPN3KJS9ExecStateERKNS_12AtomicStringEPNS1_7JSValueE
-__ZN7WebCore26JSHTMLFormElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLFormElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore6JSNodeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSNode16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34jsNodePrototypeFunctionRemoveChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore6JSNode11removeChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi
-__ZN7WebCore15willRemoveChildEPNS_4NodeE
-__ZN7WebCore8Document23notifyBeforeNodeRemovalEPNS_4NodeE
-__ZN7WebCore19SelectionController17nodeWillBeRemovedEPNS_4NodeE
-__ZN7WebCore15DynamicNodeList6Caches5resetEv
-__ZN7WebCore15DynamicNodeList23rootNodeChildrenChangedEv
-__ZN7WebCore7Element19removedFromDocumentEv
-__ZN7WebCore8Document17removeElementByIdERKNS_12AtomicStringEPNS_7ElementE
-__ZN7WebCore13ContainerNode19removedFromDocumentEv
-__ZN7WebCore15EventTargetNode19removedFromDocumentEv
-__ZN7WebCore11EventTarget19removedFromDocumentEPNS_15EventTargetNodeE
-__ZN7WebCore4Node19removedFromDocumentEv
-__ZN7WebCore22HTMLGenericFormElement15removedFromTreeEb
-__ZN7WebCore15HTMLFormElement17removeFormElementEPNS_22HTMLGenericFormElementE
-__ZN7WebCore13ContainerNode15removedFromTreeEb
-__ZNK7WebCore13StyledElement18createAttributeMapEv
-__ZN7WebCore16HTMLImageElement8setWidthEi
-__ZN7WebCore16HTMLImageElement9setHeightEi
-__ZN7WebCore16HTMLImageElement9setBorderERKNS_6StringE
-__ZN7WebCore16HTMLImageElement6setAltERKNS_6StringE
-__ZN7WebCore13JSHTMLElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore11HTMLElement5setIdERKNS_6StringE
-__ZN7WebCore18JSHTMLImageElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore9JSElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore13StyledElement5styleEv
-__ZN7WebCore13StyledElement18getInlineStyleDeclEv
-__ZN7WebCore13StyledElement21createInlineStyleDeclEv
-__ZN7WebCore26CSSMutableStyleDeclarationC1Ev
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19CSSStyleDeclarationE
-__ZN7WebCore30JSCSSStyleDeclarationPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSCSSStyleDeclarationC1EPN3KJS8JSObjectEPNS_19CSSStyleDeclarationE
-__ZN7WebCore21JSCSSStyleDeclaration3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSCSSStyleDeclaration9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17isCSSPropertyNameERKN3KJS10IdentifierE
-__ZN7WebCore15cssPropertyNameERKN3KJS10IdentifierEPb
-__ZN7WebCore16DeprecatedStringC2ERKN3KJS10IdentifierE
-__ZN7WebCore19CSSStyleDeclaration14isPropertyNameERKNS_6StringE
-__ZN7WebCore10propertyIDERKNS_6StringE
-__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
-__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_S3_Ri
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbRi
-__ZN7WebCore13StyledElement24invalidateStyleAttributeEv
-__ZNK7WebCore18JSHTMLImageElement9classInfoEv
-__ZNK7WebCore26CSSMutableStyleDeclaration7cssTextEv
-__ZNK7WebCore11CSSProperty7cssTextEv
-__ZNK7WebCore17CSSPrimitiveValue7cssTextEv
-__Z12getValueNamet
-__Z15getPropertyName13CSSPropertyID
-__ZN7WebCore17JSHTMLFormElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23replaceChildrenWithTextEPNS_11HTMLElementERKNS_6StringERi
-__ZN7WebCore9ClipRects7destroyEPNS_11RenderArenaE
-__ZN7WebCore9ClipRectsdlEPvm
-__ZN7WebCore14RenderThemeMac33paintSearchFieldResultsDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore25HTMLTextFieldInnerElement16shadowParentNodeEv
-__ZN7WebCore12RenderObject23absoluteBoundingBoxRectEv
-__ZN7WebCore12RenderObject13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE6shrinkEm
-__ZThn8_N7WebCore14XMLHttpRequest18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN7WebCore14XMLHttpRequest18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN7WebCore27extractCharsetFromMediaTypeERKNS_6StringE
-__ZThn8_N7WebCore14XMLHttpRequest14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore14XMLHttpRequest14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore14XMLHttpRequest14refEventTargetEv
-__ZNK7WebCore26JSUnprotectedEventListener11listenerObjEv
-__ZNK7WebCore26JSUnprotectedEventListener9windowObjEv
-__ZN7WebCore11EventTarget6toNodeEv
-__ZN7WebCore14XMLHttpRequest16toXMLHttpRequestEv
-__ZNK7WebCore14XMLHttpRequest13responseIsXMLEv
-__ZNK7WebCore14XMLHttpRequest16responseMIMETypeEv
-__ZN7WebCore28extractMIMETypeFromMediaTypeERKNS_6StringE
-__ZN7WebCore17DOMImplementation13isXMLMIMETypeERKNS_6StringE
-__ZNK7WebCore17DeprecatedCString4findEPKcib
-__ZNK7WebCore17DeprecatedCString3midEjj
-__ZNK7WebCore12TextEncoding21closest8BitEquivalentEv
-__ZN7WebCore22UTF16BigEndianEncodingEv
-__ZN7WebCore25UTF16LittleEndianEncodingEv
-__ZNK7WebCore14XMLHttpRequest9getStatusERi
-__ZNK7WebCore14XMLHttpRequest13getStatusTextERi
-__ZNK7WebCore14XMLHttpRequest15getResponseTextERi
-__ZN3KJS19jsOwnedStringOrNullERKNS_7UStringE
-__ZN3KJS50jsXMLHttpRequestPrototypeFunctionGetResponseHeaderEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK7WebCore14XMLHttpRequest17getResponseHeaderERKNS_6StringERi
-__ZThn8_N7WebCore14XMLHttpRequest16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZN7WebCore14XMLHttpRequest16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZNK7WebCore14XMLHttpRequest14getResponseXMLERi
-__ZNK7WebCore8Document14implementationEv
-__ZN7WebCore17DOMImplementation14createDocumentEPNS_5FrameE
-__ZN7WebCore8DocumentC2EPNS_17DOMImplementationEPNS_5FrameEb
-__ZN7WebCore8Document4openEv
-__ZN7WebCore8Document15createTokenizerEv
-__ZN7WebCore12XMLTokenizerC2EPNS_8DocumentEPNS_9FrameViewE
-__ZN7WebCore12XMLTokenizer5writeERKNS_15SegmentedStringEb
-__ZNK7WebCore15SegmentedString8toStringEv
-__ZN7WebCore12XMLTokenizer23initializeParserContextEv
-__ZN7WebCore18createStringParserEP14_xmlSAXHandlerPv
-__ZN7WebCore20startDocumentHandlerEPv
-__ZN7WebCore12XMLTokenizer13startDocumentEPKhS2_i
-__ZN7WebCore8Document13setXMLVersionERKNS_6StringERi
-__ZNK7WebCore17DOMImplementation10hasFeatureERKNS_6StringES3_
-__ZN7WebCore8Document16setXMLStandaloneEbRi
-__ZN7WebCore21startElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore12XMLTokenizer14startElementNsEPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore12XMLTokenizer8exitTextEv
-__ZN7WebCore8toStringEPKh
-__ZN7WebCore8Document13createElementERKNS_13QualifiedNameEbRi
-__ZN7WebCore7ElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore7Element14setAttributeNSERKNS_6StringES3_S3_Ri
-__ZN7WebCore8Document18parseQualifiedNameERKNS_6StringERS1_S4_
-__ZNK7WebCore7Element28updateStyleAttributeIfNeededEv
-__ZNK7WebCore7Element18createAttributeMapEv
-__ZN7WebCore12NamedAttrMapC2EPNS_7ElementE
-__ZN7WebCore7Element15createAttributeERKNS_13QualifiedNameEPNS_10StringImplE
-__ZN7WebCore7Element16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore8Document14isHTMLDocumentEv
-__ZN7WebCore12XMLTokenizer14setCurrentNodeEPNS_4NodeE
-__ZN7WebCore17charactersHandlerEPvPKhi
-__ZN7WebCore12XMLTokenizer10charactersEPKhi
-__ZN7WebCore12XMLTokenizer9enterTextEv
-__ZN3WTF6VectorIhLm0EE6appendIhEEvPKT_m
-__ZN3WTF6VectorIhLm0EE14expandCapacityEmPKh
-__ZN3WTF6VectorIhLm0EE14expandCapacityEm
-__ZN3WTF6VectorIhLm0EE15reserveCapacityEm
-__ZN7WebCore13CharacterData10appendDataERKNS_6StringERi
-__ZN7WebCore13CharacterData21dispatchModifiedEventEPNS_10StringImplE
-__ZN7WebCore4Node15childrenChangedEb
-__ZN3WTF6VectorIhLm0EE6shrinkEm
-__ZN7WebCore19endElementNsHandlerEPvPKhS2_S2_
-__ZN7WebCore12XMLTokenizer12endElementNsEv
-__ZN7WebCore16getEntityHandlerEPvPKh
-__ZN7WebCore12XMLTokenizer6finishEv
-__ZN7WebCore12XMLTokenizer3endEv
-__ZN7WebCore18endDocumentHandlerEPv
-__ZN7WebCore12XMLTokenizer11endDocumentEv
-__ZNK7WebCore12XMLTokenizer10wellFormedEv
-__ZN7WebCore12XMLTokenizerD1Ev
-__ZNK7WebCore8Document13isSVGDocumentEv
-__ZNK7WebCore10JSDocument9classInfoEv
-__ZNK7WebCore10JSNodeList14implementsCallEv
-__ZN7WebCore10JSNodeList18canGetItemsForNameEPN3KJS9ExecStateEPNS_8NodeListERKNS1_10IdentifierE
-__ZNK7WebCore15DynamicNodeList12itemWithNameERKNS_12AtomicStringE
-__ZN7WebCore19JSNodeListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore10JSNodeList9classInfoEv
-__ZNK7WebCore15DynamicNodeList24itemBackwardsFromCurrentEPNS_4NodeEji
-__ZNK7WebCore4Node20traversePreviousNodeEPKS0_
-__ZNK7WebCore4Node16virtualLastChildEv
-__ZN7WebCore46jsElementPrototypeFunctionGetElementsByTagNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9JSElement9classInfoEv
-__ZN7WebCore4Node10childNodesEv
-__ZN7WebCore13ChildNodeListC1EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
-__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS0_6CachesEb
-__ZNK7WebCore13ChildNodeList6lengthEv
-__ZNK7WebCore13ChildNodeList4itemEj
-__ZN7WebCore6JSText18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSCharacterData18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19createAnchorWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLAnchorElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLAnchorElementC1EPN3KJS8JSObjectEPNS_17HTMLAnchorElementE
-__ZN7WebCore19JSHTMLAnchorElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11HTMLElement12setInnerHTMLERKNS_6StringERi
-__ZN7WebCore11HTMLElement24createContextualFragmentERKNS_6StringE
-__ZN7WebCore16DocumentFragmentC2EPNS_8DocumentE
-__ZN7WebCore25parseHTMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentE
-__ZN7WebCore13HTMLTokenizerC2EPNS_16DocumentFragmentE
-__ZN7WebCore10HTMLParserC2EPNS_16DocumentFragmentE
-__ZN7WebCore13HTMLTokenizer19setForceSynchronousEb
-__ZN7WebCore16DocumentFragment16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore27replaceChildrenWithFragmentEPNS_11HTMLElementEN3WTF10PassRefPtrINS_16DocumentFragmentEEERi
-__ZN7WebCore13CharacterData7setDataERKNS_6StringERi
-__ZN7WebCore10RenderText15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore8Document13removeMarkersEPNS_4NodeE
-__ZNK7WebCore4Node13hasChildNodesEv
-__ZN7WebCore14XMLHttpRequest14dropProtectionEv
--[DOMNodeList item:]
--[DOMNode attributes]
-__ZNK7WebCore7Element10attributesEv
-+[DOMNamedNodeMap(WebCoreInternal) _wrapNamedNodeMap:]
--[DOMNamedNodeMap(WebCoreInternal) _initWithNamedNodeMap:]
--[DOMNamedNodeMap getNamedItem:]
-__ZNK7WebCore12NamedAttrMap12getNamedItemERKNS_6StringE
-__ZN7WebCore9Attribute18createAttrIfNeededEPNS_7ElementE
-__ZN7WebCore4AttrC1EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
-__ZN7WebCore4Attr15createTextChildEv
-__ZNK7WebCore4Attr8nodeTypeEv
--[DOMNode nodeValue]
-__ZNK7WebCore4Attr9nodeValueEv
--[DOMNamedNodeMap dealloc]
-__ZNK7WebCore9TimerBase16nextFireIntervalEv
-__ZN7WebCore6Screen15disconnectFrameEv
-__ZNK7WebCore6Screen10availWidthEv
-__ZN7WebCore19screenAvailableRectEPNS_6WidgetE
-__ZN7WebCore16HTMLInputElementD1Ev
-__ZN7WebCore22HTMLGenericFormElement14removeFromFormEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore31HTMLFormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS4_NS_21ListHashSetTranslatorIS4_SB_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore12NamedAttrMap17detachFromElementEv
-__ZN7WebCore18NamedMappedAttrMap15clearAttributesEv
-__ZN7WebCore14XMLHttpRequest16derefEventTargetEv
-__ZN7WebCore14XMLHttpRequest17setOnLoadListenerEPNS_13EventListenerE
-__ZN3WTF9HashTableIiSt4pairIiNS_6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEEENS_18PairFirstExtractorIS8_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore28removeFromRequestsByDocumentEPNS_8DocumentEPNS_14XMLHttpRequestE
-__ZN7WebCore7ElementD1Ev
-__ZN7WebCore12NamedAttrMapD1Ev
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS8_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS7_EEEESE_EENS_18PairBaseHashTraitsINSD_INS2_6StringEEESF_EEE8derefAllERSH_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6expandEv
-__ZN3KJS7Plugins10nameGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore15baseConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLBaseElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLBaseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLBaseElement7processEv
-__ZNK7WebCore15HTMLBaseElement17endTagRequirementEv
-__ZNK7WebCore15HTMLBaseElement11tagPriorityEv
-__ZN7WebCore15HTMLBaseElement20insertedIntoDocumentEv
-__ZN7WebCore10HTMLParser24noscriptCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore9CSSParser22rollbackLastPropertiesEi
-__ZN7WebCore9CSSParser13parseSVGValueEib
-__ZN7WebCore10IconLoader6createEPNS_5FrameE
-__ZN7WebCore10IconLoaderC2EPNS_5FrameE
-__ZN7WebCore10IconLoader12startLoadingEv
-__ZN7WebCore19DeprecatedValueListINS_18SegmentedSubstringEE8copyNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore19DeprecatedValueListINS_18SegmentedSubstringEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore23DeprecatedValueListImpl11prependNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore11HTMLElement19isRecognizedTagNameERKNS_13QualifiedNameE
-__ZN7WebCore9HTMLNames11getHTMLTagsEPm
-__ZN7WebCore11CSSRuleDataD2Ev
-__ZN7WebCore11RenderStyle17setHasPseudoStyleENS0_8PseudoIdE
-__ZN7WebCore11RenderStyle10setContentEPNS_10StringImplEb
-__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplE
-__ZN7WebCore14RenderListItemC2EPNS_4NodeE
-__ZN7WebCore14RenderListItem8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderListItem10isListItemEv
-__ZN7WebCore23updateListMarkerNumbersEPNS_12RenderObjectE
-__ZN7WebCore14RenderListItem18clearExplicitValueEv
-__ZNK7WebCore9DOMWindow7historyEv
-__ZN7WebCore7HistoryC2EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7HistoryE
-__ZN7WebCore18JSHistoryPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSHistoryC1EPN3KJS8JSObjectEPNS_7HistoryE
-__ZN7WebCore9JSHistory18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSHistory24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore7History5frameEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSHistoryEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSHistory16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore7History6lengthEv
-__ZN7WebCore11FrameLoader16getHistoryLengthEv
-__ZN7WebCore15BackForwardList13backListCountEv
-__ZN7WebCore18createUListWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLUListElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLUListElementC1EPN3KJS8JSObjectEPNS_16HTMLUListElementE
-__ZN7WebCore18JSHTMLUListElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15createLIWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore24JSHTMLLIElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLLIElementC1EPN3KJS8JSObjectEPNS_13HTMLLIElementE
-__ZN7WebCore15JSHTMLLIElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11HTMLElement12setClassNameERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE6shrinkEm
-__ZN7WebCore19JSHTMLAnchorElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSHTMLLIElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore11ContentData5clearEv
-__ZN7WebCore12RenderInlineD1Ev
-__ZN7WebCore11RenderBlock20removeFloatingObjectEPNS_12RenderObjectE
-__ZN7WebCore14RenderListItem7destroyEv
-__ZN7WebCore18headingConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLHeadingElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore18HTMLHeadingElement17endTagRequirementEv
-__ZNK7WebCore18HTMLHeadingElement11tagPriorityEv
-__ZN7WebCore18HTMLHeadingElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore10HTMLParser19mapCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore14HTMLMapElementC2EPNS_8DocumentE
-__ZN7WebCore14HTMLMapElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore8Document14removeImageMapEPNS_14HTMLMapElementE
-__ZN7WebCore8Document11addImageMapEPNS_14HTMLMapElementE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZNK7WebCore14HTMLMapElement17endTagRequirementEv
-__ZNK7WebCore14HTMLMapElement11tagPriorityEv
-__ZN7WebCore15areaConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLAreaElementC2EPNS_8DocumentE
-__ZN7WebCore4PathC2Ev
-__ZN7WebCore15HTMLAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore6String13toCoordsArrayERi
-__ZN7WebCore10StringImpl13toCoordsArrayERi
-__ZN7WebCore14countCharacterEPNS_10StringImplEt
-__ZN7WebCore11parseLengthEPKtj
-__ZNK7WebCore15HTMLAreaElement17endTagRequirementEv
-__ZNK7WebCore15HTMLAreaElement11tagPriorityEv
-__ZN7WebCore14HTMLMapElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore26CSSMutableStyleDeclaration16parseDeclarationERKNS_6StringE
-__ZN7WebCore9CSSParser16parseDeclarationEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
-__ZN7WebCore16JSHTMLDivElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore16embedConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLEmbedElementC2EPNS_8DocumentE
-__ZN7WebCore17HTMLPlugInElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore21HTMLFrameOwnerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16HTMLEmbedElement16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore16HTMLEmbedElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZNK7WebCore17HTMLPlugInElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLEmbedElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17HTMLPlugInElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLEmbedElement17endTagRequirementEv
-__ZNK7WebCore16HTMLEmbedElement11tagPriorityEv
-__ZNK7WebCore16DocumentFragment8nodeTypeEv
-__ZN7WebCore16HTMLEmbedElement20insertedIntoDocumentEv
-__ZN7WebCore16HTMLEmbedElement6attachEv
-__ZN7WebCore13ContainerNode23queuePostAttachCallbackEPFvPNS_4NodeEES2_
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEmPKS9_
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE15reserveCapacityEm
-__ZN7WebCore16HTMLEmbedElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLEmbedElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16RenderPartObjectC2EPNS_21HTMLFrameOwnerElementE
-__ZN7WebCore10RenderPartC2EPNS_21HTMLFrameOwnerElementE
-__ZN7WebCore12RenderWidgetC2EPNS_4NodeE
-__ZN7WebCore14RenderReplacedC2EPNS_4NodeE
-__ZN7WebCore10RenderView9addWidgetEPNS_12RenderObjectE
-__ZN3WTF7HashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore12RenderWidget8setStyleEPNS_11RenderStyleE
-__ZN7WebCore13ContainerNode27dispatchPostAttachCallbacksEv
-__ZN7WebCore17HTMLPlugInElement20updateWidgetCallbackEPNS_4NodeE
-__ZN7WebCore16HTMLEmbedElement12updateWidgetEv
-__ZN7WebCore16RenderPartObject12updateWidgetEb
-__ZN7WebCore12isURLAllowedEPNS_8DocumentERKNS_6StringE
-__ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKNS_6StringE
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE6shrinkEm
-__ZN7WebCore16HTMLImageElement9setUseMapERKNS_6StringE
-__ZN7WebCore19fieldsetConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLFieldSetElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZNK7WebCore19HTMLFieldSetElement11tagPriorityEv
-__ZNK7WebCore14RenderThemeMac11systemColorEi
-__ZN3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3setERKiRKj
-__ZNK3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3getERKi
-__ZN7WebCore19HTMLFieldSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderFieldsetC2EPNS_22HTMLGenericFormElementE
-__ZN7WebCore14RenderFieldset8setStyleEPNS_11RenderStyleE
-__ZN7WebCore19HTMLFieldSetElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17legendConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLLegendElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZNK7WebCore22HTMLGenericFormElement11tagPriorityEv
-__ZN7WebCore17HTMLLegendElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore12RenderLegendC2EPNS_22HTMLGenericFormElementE
-__ZN7WebCore13dlConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLDListElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLDListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLDListElement11tagPriorityEv
-__ZN7WebCore10HTMLParser18dtCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreleERNS_11CSSRuleDataES1_
-__ZNK7WebCore10RenderText12originalTextEv
-__ZN7WebCore10HTMLParser18ddCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZNK7WebCore16HTMLInputElement17isInputTypeHiddenEv
-__ZN7WebCore21convertNSColorToColorEP7NSColor
-__ZN7WebCore12RenderButtonC2EPNS_4NodeE
-__ZN7WebCore12RenderButton8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore12RenderButton15canHaveChildrenEv
-__ZN7WebCore12RenderButton17updateFromElementEv
-__ZNK7WebCore16HTMLInputElement16valueWithDefaultEv
-__ZN7WebCore12RenderButton7setTextERKNS_6StringE
-__ZN7WebCore12RenderButton8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore14JSHTMLDocument10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore8Document18documentNamedItemsERKNS_6StringE
-__ZNK7WebCore22HTMLGenericFormElement14isEnumeratableEv
-__ZN7WebCore15HTMLFormElement15addElementAliasEPNS_22HTMLGenericFormElementERKNS_12AtomicStringE
-__ZN7WebCore17JSHTMLFormElement10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLGenericFormElementEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setEPS3_RKS6_
-__ZN7WebCore40jsHTMLInputElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
 __ZN7WebCore7Element5focusEb
 __ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
-__ZN7WebCore9RenderBox10setStaticXEi
-__ZN7WebCore9RenderBox10setStaticYEi
-__ZNK7WebCore9RenderBox7staticXEv
-__ZNK7WebCore9RenderBox7staticYEv
-__ZN7WebCore14RenderReplaced14calcPrefWidthsEv
-__ZNK7WebCore9RenderBox17calcReplacedWidthEv
-__ZN7WebCore16RenderPartObject6layoutEv
-__ZNK7WebCore9RenderBox18calcReplacedHeightEv
-__ZN7WebCore12RenderWidget6layoutEv
-__ZN7WebCore9FrameView17addWidgetToUpdateEPNS_16RenderPartObjectE
-__ZN3WTF7HashSetIPN7WebCore16RenderPartObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore14RenderFieldset12avoidsFloatsEv
-__ZNK7WebCore14RenderFieldset28stretchesToMinIntrinsicWidthEv
-__ZN7WebCore14RenderFieldset14calcPrefWidthsEv
-__ZN7WebCore17RenderFlexibleBox14calcPrefWidthsEv
-__ZNK7WebCore14RenderFieldset10findLegendEv
-__ZN7WebCore14RenderFieldset12layoutLegendEb
-__ZN7WebCore14RenderListItem6layoutEv
-__ZN7WebCore14RenderListItem20updateMarkerLocationEv
-__ZN7WebCore14RenderListItem14calcPrefWidthsEv
-__ZN7WebCore14RenderListItem18positionListMarkerEv
-__ZNK7WebCore17RenderFlexibleBox12avoidsFloatsEv
-__ZNK7WebCore12RenderButton14hasControlClipEv
-__ZNK7WebCore12RenderObject12maxTopMarginEb
-__ZNK7WebCore12RenderObject21isSelfCollapsingBlockEv
-__ZNK7WebCore12RenderObject16isTopMarginQuirkEv
-__ZNK7WebCore12RenderObject15maxBottomMarginEb
-__ZN7WebCore12RenderObject14containsFloatsEv
-__ZNK7WebCore12RenderObject21containingBlockHeightEv
-__ZNK7WebCore12RenderInline5widthEv
-__ZNK7WebCore12RenderInline6heightEv
-__ZNK7WebCore12RenderObject13overflowWidthEb
-__ZNK7WebCore12RenderObject14overflowHeightEb
-__ZN7WebCore10RenderPart20updateWidgetPositionEv
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6resizeEm
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE15reserveCapacityEm
-__ZN7WebCore11FrameLoader13requestObjectEPNS_10RenderPartERKNS_6StringERKNS_12AtomicStringES5_RKN3WTF6VectorIS3_Lm0EEESD_
-__ZN7WebCore11FrameLoader15shouldUsePluginERKNS_4KURLERKNS_6StringEbRb
-__ZN7WebCore11FrameLoader10loadPluginEPNS_10RenderPartERKNS_4KURLERKNS_6StringERKN3WTF6VectorIS6_Lm0EEESD_b
--[WebCoreFrameBridge baseURL]
-__ZN7WebCore6WidgetC1EP6NSView
-__ZN7WebCore10RenderPart9setWidgetEPNS_6WidgetE
-__ZNK7WebCore6Widget11isFrameViewEv
-__ZN7WebCore12RenderWidget9setWidgetEPNS_6WidgetE
-__ZN7WebCore17widgetRendererMapEv
-__ZNK3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
-__ZN7WebCore12RenderWidget12resizeWidgetEPNS_6WidgetEii
-__ZN7WebCore10ScrollView8addChildEPNS_6WidgetE
-__ZN7WebCore6Widget14addToSuperviewEP6NSView
--[DOMElement(WebPrivate) _windowClipRect]
--[DOMElement(WebCoreInternal) _element]
-__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
-__ZNK7WebCore11RenderLayer16childrenClipRectEv
-__ZNK7WebCore10ScrollView16contentsToWindowERKNS_7IntRectE
-__ZN7WebCore7IntRectC2ERKNS_9FloatRectE
-__ZNK7WebCore9FrameView14windowClipRectEv
-__ZNK7WebCore9FrameView14windowClipRectEb
-__ZN7WebCore5Frame20windowScriptNPObjectEv
-__ZNK7WebCore9DOMWindow3topEv
-__ZN7WebCore4Page16setDefersLoadingEb
-__ZN7WebCore11FrameLoader16setDefersLoadingEb
-__ZN7WebCore14DocumentLoader16setDefersLoadingEb
-__ZN7WebCore19setAllDefersLoadingERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEb
-__ZN7WebCore14ResourceLoader16setDefersLoadingEb
-__ZN7WebCore14ResourceHandle16setDefersLoadingEb
-_urlIsEmpty
-__ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
-__ZN7WebCore26NetscapePlugInStreamLoaderC1EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
-__ZN7WebCore14ResourceLoader19setShouldBufferDataEb
-__ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore16RenderPartObject11viewClearedEv
-__ZN7WebCore6Widget16setFrameGeometryERKNS_7IntRectE
-__ZN7WebCore12RenderWidget5derefEPNS_11RenderArenaE
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6shrinkEm
-__ZNK7WebCore22HTMLGenericFormElement13supportsFocusEv
-__ZNK7WebCore22HTMLGenericFormElement11isFocusableEv
+__ZN7WebCore8Document12updateLayoutEv
+__ZNK7WebCore22HTMLFormControlElement13supportsFocusEv
+__ZNK7WebCore22HTMLFormControlElement11isFocusableEv
 __ZN7WebCore15FocusController14setFocusedNodeEPNS_4NodeEN3WTF10PassRefPtrINS_5FrameEEE
 __ZN7WebCore15FocusController15setFocusedFrameEN3WTF10PassRefPtrINS_5FrameEEE
+__ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore16HTMLInputElement18dispatchFocusEventEv
-__ZN7WebCore15EventTargetNode18dispatchFocusEventEv
+__ZN7WebCore12InputElement18dispatchFocusEventERNS_16InputElementDataEPNS_8DocumentE
+__ZN7WebCore12InputElement27updatePlaceholderVisibilityERNS_16InputElementDataEPNS_8DocumentEb
+__ZThn128_NK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZNK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZN7WebCore4Node18dispatchFocusEventEv
+__ZN7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
+__ZN7WebCore15HTMLFormElement17handleLocalEventsEPNS_5EventEb
+__ZN7WebCore4Node6toNodeEv
+__ZN7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
+__ZN7WebCore16HTMLInputElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore5Event25isBeforeTextInsertedEventEv
+__ZNK7WebCore5Event12isMouseEventEv
 __ZNK7WebCore5Event11isDragEventEv
+__ZNK7WebCore5Event12isWheelEventEv
+__ZN7WebCore27RenderTextControlSingleLine12forwardEventEPNS_5EventE
+__ZN7WebCore27RenderTextControlSingleLine27capsLockStateMayHaveChangedEv
 __ZN7WebCore17RenderTextControl12forwardEventEPNS_5EventE
-__ZN7WebCore17RenderTextControl27capsLockStateMayHaveChangedEv
-__ZN7WebCore15EventTargetNode15dispatchUIEventERKNS_12AtomicStringEiN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCore7UIEventC2ERKNS_12AtomicStringEbbPNS_9DOMWindowEi
+__ZN7WebCore4Node15dispatchUIEventERKNS_12AtomicStringEiN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore7UIEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore7UIEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore5Event18setUnderlyingEventEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore7UIEventD0Ev
+__ZN7WebCore5EventD2Ev
 __ZN7WebCore13ContainerNode8setFocusEb
+__ZN7WebCore4Node8setFocusEb
 __ZN7WebCore14focusRingColorEv
++[WebCoreControlTintObserver controlTintDidChange]
 __ZN7WebCore26usesTestModeFocusRingColorEv
 __ZNK7WebCore14SVGRenderStyle17inheritedNotEqualEPKS0_
-__ZN7WebCore13widgetForNodeEPNS_4NodeE
+__ZN7WebCore14RenderThemeMac17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
+__ZN7WebCoreL13widgetForNodeEPNS_4NodeE
+__ZNK7WebCore12RenderObject8isWidgetEv
 __ZN7WebCore6Widget8setFocusEv
 __ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
 __ZN7WebCore12RenderWidget4findEPKNS_6WidgetE
+__ZN7WebCoreL17widgetRendererMapEv
+__ZNK3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
 -[NSScrollView(WebCoreView) _webcore_effectiveFirstResponder]
 -[NSClipView(WebCoreView) _webcore_effectiveFirstResponder]
 -[NSView(WebCoreView) _webcore_effectiveFirstResponder]
@@ -3703,2139 +3812,2584 @@ __ZN7WebCore6Chrome11focusNSViewEP6NSView
 __ZNK7WebCore16HTMLInputElement20shouldUseInputMethodEv
 __ZN7WebCore8Document27cancelFocusAppearanceUpdateEv
 __ZN7WebCore16HTMLInputElement21updateFocusAppearanceEb
+__ZN7WebCore12InputElement21updateFocusAppearanceERNS_16InputElementDataEPNS_8DocumentEb
+__ZThn128_N7WebCore16HTMLInputElement6selectEv
 __ZN7WebCore16HTMLInputElement6selectEv
 __ZN7WebCore17RenderTextControl6selectEv
 __ZN7WebCore17RenderTextControl17setSelectionRangeEii
 __ZN7WebCore17RenderTextControl23visiblePositionForIndexEi
+__ZN7WebCore15VisiblePositionC1EPNS_4NodeEiNS_9EAffinityE
 __ZN7WebCore15VisiblePositionC2EPNS_4NodeEiNS_9EAffinityE
-__ZN7WebCore8PositionC2EPNS_4NodeEi
+__ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
+__ZN7WebCore8PositionC2EN3WTF10PassRefPtrINS_4NodeEEEi
+__ZN7WebCore8Position34anchorTypeForLegacyEditingPositionEPNS_4NodeEi
+__ZN7WebCore21editingIgnoresContentEPKNS_4NodeE
+__ZN7WebCore25canHaveChildrenForEditingEPKNS_4NodeE
 __ZN7WebCore15VisiblePosition4initERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15VisiblePosition17canonicalPositionERKNS_8PositionE
 __ZNK7WebCore8Position8upstreamEv
-__ZN7WebCore14enclosingBlockEPNS_4NodeE
-__ZN7WebCore19enclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEE
-__ZN7WebCore19highestEditableRootERKNS_8PositionE
-__ZN7WebCore23editableRootForPositionERKNS_8PositionE
-__ZN7WebCore17isContentEditableEPKNS_4NodeE
-__ZN7WebCore7isBlockEPKNS_4NodeE
+__ZN7WebCoreL23enclosingVisualBoundaryEPNS_4NodeE
+__ZN7WebCoreL38endsOfNodeAreVisuallyDistinctPositionsEPNS_4NodeE
+__ZNK7WebCore13ContainerNode9childNodeEj
 __ZNK7WebCore16PositionIterator7atStartEv
-__ZN7WebCore8PositionC2ERKNS_16PositionIteratorE
+__ZNK7WebCore16PositionIteratorcvNS_8PositionEEv
 __ZNK7WebCore8Position11isCandidateEv
 __ZN7WebCore14isTableElementEPNS_4NodeE
-__ZN7WebCore21editingIgnoresContentEPKNS_4NodeE
-__ZN7WebCore25canHaveChildrenForEditingEPKNS_4NodeE
 __ZN7WebCore8Position44hasRenderedNonAnonymousDescendantsWithHeightEPNS_12RenderObjectE
 __ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEv
+__ZNK7WebCore8Position29atFirstEditingPositionForNodeEv
 __ZN7WebCore8Position20nodeIsUserSelectNoneEPNS_4NodeE
-__ZN7WebCore9SelectionC2ERKNS_15VisiblePositionES3_
-__ZN7WebCore9Selection8validateEv
+__ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionES3_
+__ZN7WebCore16VisibleSelectionC2ERKNS_15VisiblePositionES3_
+__ZN7WebCore16VisibleSelection8validateEv
+__ZN7WebCore16VisibleSelection33setBaseAndExtentToDeepEquivalentsEv
+__ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15VisiblePositionC2ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore16comparePositionsERKNS_8PositionES2_
-__ZN7WebCore9Selection24adjustForEditableContentEv
+__ZN7WebCore5Range21compareBoundaryPointsEPNS_4NodeEiS2_i
+__ZN7WebCore16VisibleSelection52setStartAndEndFromBaseAndExtentRespectingGranularityEv
+__ZN7WebCore16VisibleSelection47adjustSelectionToAvoidCrossingEditingBoundariesEv
+__ZN7WebCore19highestEditableRootERKNS_8PositionE
+__ZN7WebCore23editableRootForPositionERKNS_8PositionE
 __ZN7WebCore22lowestEditableAncestorEPNS_4NodeE
+__ZN7WebCore16VisibleSelection19updateSelectionTypeEv
 __ZN7WebCore5Frame22setFocusedNodeIfNeededEv
-__ZNK7WebCore9Selection19rootEditableElementEv
-__ZNK7WebCore25HTMLTextFieldInnerElement16isMouseFocusableEv
+__ZNK7WebCore16VisibleSelection19rootEditableElementEv
+__ZNK7WebCore23TextControlInnerElement16isMouseFocusableEv
 __ZNK7WebCore16HTMLInputElement16isMouseFocusableEv
-__ZN7WebCore10RenderFlow9caretRectEiNS_9EAffinityEPi
-__ZNK7WebCore11RenderTheme19caretBlinkFrequencyEv
+__ZNK7WebCore15VisiblePosition14localCaretRectERPNS_12RenderObjectE
+__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityERPNS_9InlineBoxERi
+__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityENS_13TextDirectionERPNS_9InlineBoxERi
+__ZN7WebCore11RenderBlock14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore19SelectionController22caretRendersInsideNodeEPNS_4NodeE
 __ZNK7WebCore19SelectionController16caretRepaintRectEv
+__ZNK7WebCore11RenderTheme18caretBlinkIntervalEv
 __ZN7WebCore19SelectionController41selectFrameElementInParentIfFullySelectedEv
 __ZN7WebCore5Frame31notifyRendererOfSelectionChangeEb
-__ZNK7WebCore17RenderTextControl10isTextAreaEv
 __ZN7WebCore17RenderTextControl16selectionChangedEb
 __ZN7WebCore17RenderTextControl12selectionEndEv
 __ZN7WebCore17RenderTextControl23indexForVisiblePositionERKNS_15VisiblePositionE
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEE
+__ZN7WebCore8Document11attachRangeEPNS_5RangeE
+__ZN3WTF7HashSetIPN7WebCore5RangeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore5Range8setStartEN3WTF10PassRefPtrINS_4NodeEEEiRi
+__ZNK7WebCore5Range16checkNodeWOffsetEPNS_4NodeEiRi
 __ZN7WebCore5Range8collapseEbRi
+__ZN7WebCore5Range6setEndEN3WTF10PassRefPtrINS_4NodeEEEiRi
 __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
+__ZN7WebCore12TextIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore12TextIteratorC2EPKNS_5RangeEbb
+__ZNK7WebCore5Range9firstNodeEv
+__ZNK7WebCore4Node18offsetInCharactersEv
+__ZNK7WebCore5Range12pastLastNodeEv
+__ZN7WebCore12TextIterator7advanceEv
+__ZN7WebCore12TextIterator23representNodeOffsetZeroEv
+__ZN7WebCoreL23shouldEmitTabBeforeNodeEPNS_4NodeE
+__ZN7WebCore11isTableCellEPKNS_4NodeE
+__ZN7WebCoreL27shouldEmitNewlineBeforeNodeEPNS_4NodeE
+__ZN7WebCoreL36shouldEmitNewlinesBeforeAndAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator29shouldRepresentNodeOffsetZeroEv
+__ZN7WebCore5RangeD1Ev
+__ZN7WebCore5RangeD2Ev
+__ZN7WebCore8Document11detachRangeEPNS_5RangeE
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Iden
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalid
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN7WebCore17RenderTextControl14selectionStartEv
-__ZN7WebCore5Frame25respondToChangedSelectionERKNS_9SelectionEb
+__ZN7WebCore27RenderTextControlSingleLine14cacheSelectionEii
+__ZThn128_N7WebCore16HTMLInputElement14cacheSelectionEii
+__ZN7WebCore16HTMLInputElement14cacheSelectionEii
+__ZN7WebCore5Frame25respondToChangedSelectionERKNS_16VisibleSelectionEb
 __ZN7WebCore6Editor32isContinuousSpellCheckingEnabledEv
 __ZN7WebCore6Editor24isGrammarCheckingEnabledEv
 __ZN7WebCore9endOfWordERKNS_15VisiblePositionENS_9EWordSideE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore14endOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCoreL28renderedAsNonInlineTableOrHREPNS_12RenderObjectE
+__ZN7WebCore14enclosingBlockEPNS_4NodeE
+__ZN7WebCore19enclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEEb
+__ZN7WebCore17isContentEditableEPKNS_4NodeE
+__ZN7WebCore7isBlockEPKNS_4NodeE
 __ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
-__ZN7WebCore16previousBoundaryERKNS_15VisiblePositionEPFjPKtjE
+__ZN7WebCoreL16previousBoundaryERKNS_15VisiblePositionEPFjPKtjjNS_33BoundarySearchContextAvailabilityERbE
 __ZNK7WebCore4Node25enclosingBlockFlowElementEv
 __ZNK7WebCore4Node11isBlockFlowEv
 __ZN7WebCore24rangeCompliantEquivalentERKNS_8PositionE
+__ZNK7WebCore15VisiblePosition8previousEb
+__ZN7WebCore33previousVisuallyDistinctCandidateERKNS_8PositionE
+__ZNK7WebCore8Position10downstreamEv
+__ZNK7WebCore16PositionIterator5atEndEv
+__ZN7WebCore20lastOffsetForEditingEPKNS_4NodeE
+__ZNK7WebCore8Position13atStartOfTreeEv
+__ZNK7WebCore15VisiblePosition14characterAfterEv
+__ZN7WebCore31SimplifiedBackwardsTextIteratorC1EPKNS_5RangeE
 __ZN7WebCore31SimplifiedBackwardsTextIteratorC2EPKNS_5RangeE
+__ZNK7WebCore13ContainerNode14childNodeCountEv
 __ZN7WebCore31SimplifiedBackwardsTextIterator7advanceEv
 __ZNK7WebCore31SimplifiedBackwardsTextIterator5rangeEv
-__ZN7WebCore5RangeC1EPNS_8DocumentEPNS_4NodeEiS4_i
-__ZNK7WebCore5Range13startPositionEv
-__ZNK7WebCore9Selection7toRangeEv
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEENS2_INS_4NodeEEEiS6_i
+__ZNK7WebCore16VisibleSelection17toNormalizedRangeEv
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEERKNS_8PositionES7_
 __ZN7WebCore8Document13removeMarkersEPNS_5RangeENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore8Document13removeMarkersENS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore6Editor25respondToChangedSelectionERKNS_9SelectionE
--[WebCoreFrameBridge fontForSelection:]
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore4NodeEEESt4pairIS4_PS5_INS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEEE
+__ZN7WebCore6Editor25respondToChangedSelectionERKNS_16VisibleSelectionE
 __ZNK7WebCore6Editor16fontForSelectionERb
 __ZNK7WebCore5Frame22styleForSelectionStartERPNS_4NodeE
-__ZN7WebCore22DeleteButtonController25respondToChangedSelectionERKNS_9SelectionE
-__ZN7WebCore25enclosingDeletableElementERKNS_9SelectionE
+__ZN7WebCore22DeleteButtonController25respondToChangedSelectionERKNS_16VisibleSelectionE
+__ZN7WebCoreL25enclosingDeletableElementERKNS_16VisibleSelectionE
 __ZNK7WebCore5Range23commonAncestorContainerERi
 __ZN7WebCore5Range23commonAncestorContainerEPNS_4NodeES2_
-__ZN7WebCore18isDeletableElementEPKNS_4NodeE
+__ZN7WebCoreL18isDeletableElementEPKNS_4NodeE
 __ZN7WebCore19SelectionController37notifyAccessibilityForSelectionChangeEv
-__ZNK7WebCore5Frame23setSelectionGranularityENS_15TextGranularityE
-__ZNK7WebCore5Frame15revealSelectionERKNS_11RenderLayer15ScrollAlignmentE
-__ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectERKNS0_15ScrollAlignmentES6_
-__ZN7WebCore11RenderLayer15getRectToExposeERKNS_7IntRectES3_RKNS0_15ScrollAlignmentES6_
-__ZNK7WebCore10ScrollView46visibleContentRectConsideringExternalScrollersEv
+__ZN7WebCore5Frame15revealSelectionERKNS_15ScrollAlignmentEb
+__ZN7WebCore19SelectionController19absoluteCaretBoundsEv
+__ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectEbRKNS_15ScrollAlignmentES6_
+__ZNK7WebCore12RenderObject15localToAbsoluteENS_10FloatPointEbb
+__ZN7WebCore11RenderLayer15getRectToExposeERKNS_7IntRectES3_RKNS_15ScrollAlignmentES6_
+__ZNK7WebCore9RenderBox28canBeProgramaticallyScrolledEb
 __ZN7WebCore9FrameView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
-__ZNK7WebCore5Frame18prohibitsScrollingEv
 __ZN7WebCore10ScrollView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
-__ZN7WebCore17JSHTMLFormElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLFormElement9setActionERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLInputElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLInputElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18JSHTMLInputElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLInputElement8setValueERKNS_6StringE
-__ZNK7WebCore19SelectionController12isInsideNodeEv
-__ZNK7WebCore9FrameView13isTransparentEv
-__ZNK7WebCore9FrameView19baseBackgroundColorEv
-__ZN7WebCore15GraphicsContext17drawConvexPolygonEmPKNS_10FloatPointEb
-__ZN7WebCore12RenderWidget5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore6Widget4moveEii
-__ZN7WebCore6Widget5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore5Frame10paintCaretEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore19SelectionController10paintCaretEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore12RenderButton15controlClipRectEii
-__ZN7WebCore14RenderListItem5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineFlowBox16paintBackgroundsEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore13InlineFlowBox15paintBackgroundEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore12RenderInline5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore10IconLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN7WebCore10IconLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore10IconLoader16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZNK7WebCore14ResourceHandle7requestEv
-__ZN7WebCore10IconLoader13finishLoadingERKNS_4KURLEN3WTF10PassRefPtrINS_12SharedBufferEEE
-__ZN7WebCore12IconDatabase21setIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_6StringE
-__ZNK7WebCore12SharedBuffer4copyEv
-__ZN7WebCore12SharedBufferC2EPKci
-__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_29HashTableConstIteratorAdapterINS_9HashTableIPNS1_10StringImplES8_NS_17IdentityExtractorIS8_EENS1_10StringHashENS_10HashTraitsIS8_EESD_EES2_EEEEvT_SG_
-__ZNK7WebCore10IconRecord8snapshotEb
-__ZN3WTF7HashMapIN7WebCore6StringENS1_12IconSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_12IconSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E3addINS1_6StringES5_NS_17HashMapTranslatorILb0ES4_ISH_S5_ENS_18PairBaseHashTraitsINSB_ISH_EESD_EESE_S9_EEEES4_INS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EEbERKT_RKT0_
-__ZN7WebCore10IconLoader17clearLoadingStateEv
-__ZN7WebCore23DeprecatedValueListImpl9firstNodeEv
-__ZN7WebCore23DeprecatedValueListImpl14removeIteratorERNS_31DeprecatedValueListImplIteratorE
-__ZN7WebCore13olConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLOListElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLOListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLOListElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLOListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLOListElement11tagPriorityEv
-__ZNK7WebCore16CSSStyleSelector15smallerFontSizeEfb
-__ZN7WebCore13hrConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLHRElementC2EPNS_8DocumentE
-__ZNK7WebCore13HTMLHRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLHRElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore13HTMLHRElement17endTagRequirementEv
-__ZNK7WebCore13HTMLHRElement11tagPriorityEv
-__ZN7WebCore11RenderLayer27repaintIncludingDescendantsEv
-__ZN7WebCore11RenderBlock23removePositionedObjectsEPS0_
-__ZN7WebCore19ImageConstructorImpC2EPN3KJS9ExecStateEPNS_8DocumentE
-__ZNK7WebCore19ImageConstructorImp19implementsConstructEv
-__ZN7WebCore19ImageConstructorImp9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore16RenderListMarkerC2EPNS_14RenderListItemE
-__ZN7WebCore16RenderListMarker8setStyleEPNS_11RenderStyleE
-__ZN7WebCore15RenderTableCell27absoluteClippedOverflowRectEv
-__ZN7WebCore9RenderBox30calcAbsoluteHorizontalReplacedEv
-__ZN7WebCore9RenderBox28calcAbsoluteVerticalReplacedEv
-__ZN7WebCore23getParentOfFirstLineBoxEPNS_11RenderBlockEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock32generatesLineBoxesForInlineChildEPNS_12RenderObjectE
-__ZN7WebCore16RenderListMarker14calcPrefWidthsEv
-__ZNK7WebCore16RenderListMarker7isImageEv
-__ZNK7WebCore14RenderListItem14updateValueNowEv
-__ZN7WebCore14listMarkerTextENS_14EListStyleTypeEi
-__ZN7WebCore16RenderListMarker13updateMarginsEv
-__ZNK7WebCore16RenderListMarker8isInsideEv
-__ZN7WebCore16RenderListMarker6layoutEv
-__ZNK7WebCore16RenderListMarker12isListMarkerEv
-__ZN7WebCore36shouldSkipWhitespaceAfterStartObjectEPNS_11RenderBlockEPNS_12RenderObjectERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEE
-__ZN7WebCore16RenderListMarker15createInlineBoxEbbb
-__ZN7WebCore13ListMarkerBoxC2EPNS_12RenderObjectE
-__ZNK7WebCore13ListMarkerBox6isTextEv
-__ZNK7WebCore16RenderListMarker14selectionStateEv
-__ZNK7WebCore9RenderBox13intrinsicSizeEv
-__ZNK7WebCore16RenderListMarker10lineHeightEbb
-__ZNK7WebCore16RenderListMarker16baselinePositionEbb
-__ZN7WebCore9InlineBox14adjustPositionEii
-__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
-__ZNK7WebCore9RenderBox15borderFitAdjustERiS1_
-__ZN7WebCore16RenderListMarker5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore16RenderListMarker21getRelativeMarkerRectEv
-__ZN7WebCore26NetscapePlugInStreamLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore26NetscapePlugInStreamLoader14didReceiveDataEPKcixb
-__ZN7WebCore26NetscapePlugInStreamLoader16didFinishLoadingEv
-__ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore26NetscapePlugInStreamLoader16releaseResourcesEv
-__ZNK7WebCore5Image17usesContainerSizeEv
-__ZZN7WebCore5Image11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_15AffineTransformERKNS_10FloatPointENS_17CompositeOperatorES5_E16patternCallbacks
-__ZNK7WebCore15AffineTransform12isInvertibleEv
-__ZNK7WebCore15AffineTransform3detEv
-__ZNK7WebCore15AffineTransform1dEv
-__ZNK7WebCore15AffineTransform1aEv
-__ZN7WebCore17createHeadWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLHeadElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHeadElementC1EPN3KJS8JSObjectEPNS_15HTMLHeadElementE
-__ZNK7WebCore18JSHTMLUListElement9classInfoEv
-__ZN7WebCore28JSHTMLAnchorElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11HTMLElement2idEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSEventTargetNodeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSEventTargetNode16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17JSEventTargetNode11getListenerERKNS_12AtomicStringE
-__ZN7WebCore15EventTargetNode20getHTMLEventListenerERKNS_12AtomicStringE
-__ZN7WebCore20createHeadingWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore29JSHTMLHeadingElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLHeadingElementC1EPN3KJS8JSObjectEPNS_18HTMLHeadingElementE
-__ZN7WebCore20JSHTMLHeadingElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLAnchorElement9classInfoEv
-__ZNK7WebCore11HTMLElement8nodeNameEv
-__ZNK7WebCore15JSHTMLLIElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLAnchorElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLAnchorElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLAnchorElement4hrefEv
-__ZNK7WebCore13JSHTMLElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLFormElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLFormElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18createOListWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLOListElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLOListElementC1EPN3KJS8JSObjectEPNS_16HTMLOListElementE
-__ZN7WebCore18JSHTMLOListElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLOListElement9classInfoEv
-__ZN7WebCore18createDListWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLDListElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLDListElementC1EPN3KJS8JSObjectEPNS_16HTMLDListElementE
-__ZN7WebCore15highestAncestorEPNS_4NodeE
-__ZN7WebCore4Node15removedFromTreeEb
-__ZN7WebCore11RenderLayer20setHasVisibleContentEb
-__ZN7WebCore7Element12offsetHeightEv
-__ZN7WebCore13InlineTextBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore10RenderText13removeTextBoxEPNS_13InlineTextBoxE
-__ZNK7WebCore13RootInlineBox19lineBreakBidiStatusEv
-__ZNK7WebCore12RenderObject12offsetHeightEv
-__ZN3KJS6Window14installTimeoutERKNS_7UStringEib
-__ZN7WebCore17createLinkWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLLinkElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLLinkElementC1EPN3KJS8JSObjectEPNS_15HTMLLinkElementE
-__ZN7WebCore17JSHTMLLinkElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLLinkElement9classInfoEv
-__ZN7WebCore17JSHTMLHeadElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLHeadElement9classInfoEv
-__ZN7WebCore19createScriptWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLScriptElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLScriptElementC1EPN3KJS8JSObjectEPNS_17HTMLScriptElementE
-__ZN7WebCore19JSHTMLScriptElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLScriptElement9classInfoEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN7WebCore8Document5linksEv
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLCollectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLCollection16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16JSHTMLCollection11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore17createAreaWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLAreaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLAreaElementC1EPN3KJS8JSObjectEPNS_15HTMLAreaElementE
-__ZN7WebCore17JSHTMLAreaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSLazyEventListener11listenerObjEv
-__ZNK7WebCore19JSLazyEventListener9parseCodeEv
-__ZNK7WebCore19JSLazyEventListener18eventParameterNameEv
-__ZNK7WebCore6StringcvN3KJS10IdentifierEEv
-__ZNK7WebCore13JSHTMLElement21pushEventHandlerScopeEPN3KJS9ExecStateERNS1_10ScopeChainE
-__ZNK7WebCore11HTMLElement11virtualFormEv
-__ZNK7WebCore11HTMLElement16findFormAncestorEv
-__ZN7WebCore17JSHTMLAreaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSLazyEventListenerD1Ev
-__ZN3KJS12ProtectedPtrINS_6WindowEED2Ev
-__ZN3KJS12ProtectedPtrINS_8JSObjectEED2Ev
-__ZNK7WebCore17JSHTMLAreaElement9classInfoEv
-__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
-__ZN7WebCore16HTMLEmbedElement6detachEv
-__ZN7WebCore12RenderWidget7destroyEv
-__ZN7WebCore10RenderView12removeWidgetEPNS_12RenderObjectE
-__ZNK7WebCore8Document13axObjectCacheEv
-__ZNK7WebCore8Document11topDocumentEv
-__ZN7WebCore13AXObjectCache6removeEPNS_12RenderObjectE
-__ZN7WebCore9FrameView20removeWidgetToUpdateEPNS_16RenderPartObjectE
-__ZN7WebCore12RenderWidget12deleteWidgetEv
-__ZNK7WebCore12RenderObject12overflowRectEb
-__ZN7WebCore13ListMarkerBoxD1Ev
-__ZThn68_N7WebCore17HTMLScriptElement14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore17HTMLScriptElement14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore17HTMLScriptElement14evaluateScriptERKNS_6StringES3_
-__ZNK7WebCore11HTMLElement9innerHTMLEv
-__ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
-__ZN7WebCore22DeleteButtonController7disableEv
-__ZN7WebCore22DeleteButtonController4hideEv
-__ZN7WebCore12appendMarkupERN3WTF6VectorItLm0EEEPNS_4NodeEbPNS1_IS5_Lm0EEEPKNS0_7HashMapIPNS_16AtomicStringImplESA_NS0_7PtrHashISA_EENS0_10HashTraitsISA_EESE_EE
-__ZZN7WebCore17appendStartMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPNS0_7HashMapIPNS_16AtomicStringImplESD_NS0_7PtrHashISD_EENS0_10HashTraitsISD_EESH_EEE11stylePrefix
-__ZNK7WebCore7Element22nodeNamePreservingCaseEv
-__ZNK7WebCore7Element14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore20appendAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringE
-__ZNK7WebCore17HTMLAnchorElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore29appendQuotedURLAttributeValueERN3WTF6VectorItLm0EEENS_6StringE
-__ZN7WebCore20appendEscapedContentERN3WTF6VectorItLm0EEESt4pairIPKtmE
-__ZN7WebCore15appendEndMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeE
-__ZN7WebCore22DeleteButtonController6enableEv
-__ZN7WebCore22DeleteButtonController4showEPNS_11HTMLElementE
-__ZN7WebCore27removingNodeRemovesPositionEPNS_4NodeERKNS_8PositionE
-__ZNK7WebCore7Element8containsEPKNS_4NodeE
-__ZN7WebCore5Range21compareBoundaryPointsERKNS_8PositionES3_
-__ZN7WebCore11HTMLElementD1Ev
-__ZN7WebCore21createFieldSetWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore30JSHTMLFieldSetElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLFieldSetElementC1EPN3KJS8JSObjectEPNS_19HTMLFieldSetElementE
-__ZN7WebCore21JSHTMLFieldSetElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSHTMLFieldSetElement9classInfoEv
-__ZN7WebCore32jsEventTargetRemoveEventListenerEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZThn36_N7WebCore15EventTargetNode19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore15EventTargetNode19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore16HTMLImageElementD1Ev
-__ZN7WebCore11CachedImage20allReferencesRemovedEv
-__ZN7WebCore11BitmapImage14resetAnimationEv
-__ZN7WebCore11BitmapImage13stopAnimationEv
-__ZN7WebCore8Document11removeImageEPNS_15HTMLImageLoaderE
-__ZN7WebCore17HTMLAnchorElementD1Ev
-__ZNK7WebCore9DOMWindow6lengthEv
-__ZN7WebCore5Frame20caretBlinkTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore12RenderWidget8isWidgetEv
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE6shrinkEm
-__ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
-__ZN7WebCore14DocumentLoader20setMainDocumentErrorERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader6cancelEv
-__ZN7WebCore14ResourceLoader6cancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader14cancelledErrorEv
-__ZN7WebCore17SubresourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceHandle19clearAuthenticationEv
-__ZN7WebCore23AuthenticationChallenge7nullifyEv
-__ZN7WebCore11FrameLoader24cancelPendingArchiveLoadEPNS_14ResourceLoaderE
-__ZN7WebCore14ResourceHandle6cancelEv
-__ZN7WebCore18MainResourceLoader16setDefersLoadingEb
-__ZN7WebCore16HTMLInputElement13aboutToUnloadEv
-__ZN7WebCore5Frame22textFieldDidEndEditingEPNS_7ElementE
-+[DOMHTMLInputElement(WebCoreInternal) _wrapHTMLInputElement:]
-__ZN3KJS34windowProtoFuncRemoveEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore18RenderTextFragment7destroyEv
-__ZN7WebCore18RenderTextFragmentD1Ev
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN7WebCore10ScrollView11removeChildEPNS_6WidgetE
-__ZN7WebCore6Widget19removeFromSuperviewEv
-__ZN7WebCore23safeRemoveFromSuperviewEP6NSView
-__ZN7WebCore5Frame29cleanupScriptObjectsForPluginEPv
-__ZN7WebCore6WidgetD1Ev
-__ZN7WebCore12RenderButton11removeChildEPNS_12RenderObjectE
-__ZN7WebCore15RenderTableCell7destroyEv
-__ZN7WebCore14RenderTableRow7destroyEv
-__ZN7WebCore18RenderTableSection15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore18RenderTableSection7destroyEv
-__ZN7WebCore11RenderTable15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore18RenderTableSection9clearGridEv
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6shrinkEm
-__ZN3WTF6VectorIiLm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6shrinkEm
-__ZN7WebCore7History15disconnectFrameEv
-__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE6shrinkEm
-__ZN7WebCore27JSHTMLImageElementPrototypeD0Ev
-__ZN7WebCore25JSHTMLDivElementPrototypeD0Ev
-__ZN7WebCore24JSHTMLLIElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLUListElementPrototypeD0Ev
-__ZN7WebCore22JSHTMLElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLHeadElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLBodyElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLOListElementPrototypeD0Ev
-__ZN7WebCore13JSHTMLElementD0Ev
-__ZN7WebCore11CachedImageD1Ev
-__ZN7WebCore29JSHTMLHeadingElementPrototypeD0Ev
-__ZN7WebCore30JSHTMLFieldSetElementPrototypeD0Ev
-__ZN7WebCore15HTMLLinkElement19removedFromDocumentEv
-__ZN7WebCore17HTMLScriptElement19removedFromDocumentEv
-__ZN7WebCore17HTMLScriptElementD1Ev
-__ZN7WebCore16HTMLTitleElementD1Ev
-__ZN7WebCore16HTMLStyleElementD1Ev
-__ZN7WebCore14HTMLMapElementD1Ev
-__ZN7WebCore16HTMLImageElement19removedFromDocumentEv
-__ZN7WebCore12HTMLDocument15removeNamedItemERKNS_6StringE
-__ZN7WebCore17removeItemFromMapERN3WTF7HashMapIPNS_10StringImplEiNS_10StringHashENS0_10HashTraitsIS3_EENS5_IiEEEERKNS_6StringE
-__ZN7WebCore12HTMLDocument23removeDocExtraNamedItemERKNS_6StringE
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE6shrinkEm
-__ZN7WebCore16HTMLEmbedElementD1Ev
-__ZN7WebCore16HTMLTableElementD1Ev
-__ZN7WebCore16HTMLLabelElementD1Ev
-__ZN7WebCore23HTMLTableSectionElementD1Ev
-__ZN7WebCore19HTMLTableRowElementD1Ev
-__ZN7WebCore20HTMLTableCellElementD1Ev
-__ZN7WebCore12CSSValueListD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE6shrinkEm
-__ZN7WebCore22JSEventTargetPrototypeINS_15JSNodePrototypeENS_33JSEventTargetPrototypeInformationEED0Ev
-__ZN7WebCore17JSScreenPrototypeD0Ev
-__ZN7WebCore4PathD2Ev
-__ZN7WebCore26JSHTMLAreaElementPrototypeD0Ev
-__ZN7WebCore28JSHTMLScriptElementPrototypeD0Ev
-__ZN7WebCore15HTMLLinkElementD1Ev
-__ZN7WebCore26JSHTMLLinkElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLDListElementPrototypeD0Ev
-__ZN7WebCore13AXObjectCacheD2Ev
-__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEEN7WebCore14AXIDHashTraitsES6_E6expandEv
-__ZN7WebCore12CSSStyleRuleD1Ev
-__ZN7WebCore11CSSSelectorD2Ev
-__ZN7WebCore13CSSImageValueD1Ev
-__ZN7WebCore8Document26setHTMLWindowEventListenerERKNS_12AtomicStringEPNS_9AttributeE
-__ZN7WebCore17iframeConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLIFrameElementC2EPNS_8DocumentE
-__ZN7WebCore20HTMLFrameElementBaseC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore17HTMLIFrameElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore17HTMLIFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore20HTMLFrameElementBase20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore20HTMLFrameElementBase11setLocationERKNS_6StringE
-__ZNK7WebCore17HTMLIFrameElement17endTagRequirementEv
-__ZNK7WebCore17HTMLIFrameElement11tagPriorityEv
-__ZN7WebCore17HTMLIFrameElement20insertedIntoDocumentEv
-__ZN7WebCore20HTMLFrameElementBase20insertedIntoDocumentEv
-__ZN7WebCore17HTMLIFrameElement6attachEv
-__ZN7WebCore20HTMLFrameElementBase6attachEv
-__ZN7WebCore20HTMLFrameElementBase25setNameAndOpenURLCallbackEPNS_4NodeE
-__ZN7WebCore20HTMLFrameElementBase17setNameAndOpenURLEv
-__ZNK7WebCore9FrameTree15uniqueChildNameERKNS_12AtomicStringE
-__ZN7WebCoreeqERKNS_12AtomicStringEPKc
-__ZN7WebCore20HTMLFrameElementBase7openURLEv
-__ZNK7WebCore20HTMLFrameElementBase12isURLAllowedERKNS_12AtomicStringE
-__ZN7WebCore11FrameLoader12requestFrameEPNS_21HTMLFrameOwnerElementERKNS_6StringERKNS_12AtomicStringE
-__ZN7WebCore11FrameLoader12loadSubframeEPNS_21HTMLFrameOwnerElementERKNS_4KURLERKNS_6StringES8_
-__ZNK7WebCore20HTMLFrameElementBase13scrollingModeEv
-__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringE
-__ZN7WebCore9FrameTree11appendChildEN3WTF10PassRefPtrINS_5FrameEEE
--[WebCoreFrameBridge _frame]
-__ZN7WebCore11FrameLoader18currentHistoryItemEv
-__ZNK7WebCore11HistoryItem8childrenEv
-__ZN7WebCore11FrameLoader4loadERKNS_4KURLERKNS_6StringENS_13FrameLoadTypeES6_PNS_5EventEN3WTF10PassRefPtrINS_9FormStateEEE
-__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCore14navigationTypeENS_13FrameLoadTypeEbb
-__ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_16NavigationActionENS_13FrameLoadTypeEN3WTF10PassRefPtrINS_9FormStateEEE
-__ZNK7WebCore5Frame19setInViewSourceModeEb
-__ZN7WebCore13ContainerNode12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Ri
-__ZN7WebCore15HTMLFormElement18registerImgElementEPNS_16HTMLImageElementE
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE15reserveCapacityEm
-__ZN3KJS6Window16childFrameGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14SecurityOrigin9canAccessEPKS0_RNS0_6ReasonE
-__ZN7WebCore11FrameLoader24shouldTreatSchemeAsLocalERKNS_6StringE
-__ZN7WebCore7Element9offsetTopEv
-__ZNK7WebCore11CSSRuleList6lengthEv
-__ZN7WebCore11CSSRuleList4itemEj
-__ZN7WebCore17HTMLOptionElement6detachEv
-__ZN7WebCore17HTMLIFrameElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17HTMLIFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore9FrameView11isFrameViewEv
-__ZN7WebCore6Widget4hideEv
-__ZNK7WebCore14RenderThemeMac17adjustButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac31setButtonPaddingFromControlSizeEPNS_11RenderStyleEj
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
-__ZN7WebCore17RenderFlexibleBox24calcHorizontalPrefWidthsEv
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE15reserveCapacityEm
-__ZNK7WebCore10RenderView8viewRectEv
-__ZNK7WebCore12RenderObject9offsetTopEv
-__ZNK7WebCore12RenderObject12offsetParentEv
-__ZN7WebCore7Element12offsetParentEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
-__ZN7WebCore12RenderObject10moveLayersEPNS_11RenderLayerES2_
-__ZNK7WebCore15RenderTableCell14borderHalfLeftEb
-__ZNK7WebCore15RenderTableCell19collapsedLeftBorderEb
-__ZN7WebCore14compareBordersERKNS_20CollapsedBorderValueES2_
-__ZNK7WebCore15RenderTableCell15borderHalfRightEb
-__ZNK7WebCore15RenderTableCell20collapsedRightBorderEb
-__ZNK7WebCore11RenderTable9cellAfterEPKNS_15RenderTableCellE
-__ZNK7WebCore15RenderTableCell13borderHalfTopEb
-__ZNK7WebCore15RenderTableCell18collapsedTopBorderEv
-__ZNK7WebCore15RenderTableCell16borderHalfBottomEb
-__ZNK7WebCore15RenderTableCell21collapsedBottomBorderEv
-__ZNK7WebCore11RenderTable9cellBelowEPKNS_15RenderTableCellE
-__ZN7WebCore18RenderTableSection17recalcOuterBorderEv
-__ZNK7WebCore18RenderTableSection18calcOuterBorderTopEv
-__ZNK7WebCore18RenderTableSection21calcOuterBorderBottomEv
-__ZNK7WebCore18RenderTableSection19calcOuterBorderLeftEb
-__ZNK7WebCore18RenderTableSection20calcOuterBorderRightEb
-__ZNK7WebCore11RenderTable16outerBorderRightEv
-__ZNK7WebCore11RenderTable15outerBorderLeftEv
-__ZNK7WebCore11RenderTable14outerBorderTopEv
-__ZNK7WebCore11RenderTable17outerBorderBottomEv
-__ZN7WebCore14RenderThemeMac18setButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac6buttonEv
-__ZNK7WebCore16HTMLInputElement15isIndeterminateEv
-__ZNK7WebCore16HTMLInputElement9isCheckedEv
-__ZNK7WebCore14RenderThemeMac13buttonMarginsEv
-__ZN7WebCore13InlineFlowBox25adjustMaxAscentAndDescentERiS1_ii
-__ZN7WebCore11RenderLayer25setHasHorizontalScrollbarEb
-__ZN7WebCore11RenderLayer23setHasVerticalScrollbarEb
-__ZN7WebCore11RenderLayer15createScrollbarENS_20ScrollbarOrientationE
-__ZN7WebCore17PlatformScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
-__ZN7WebCore9ScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
--[WebCoreScrollBar initWithPlatformScrollbar:]
-__ZThn8_NK7WebCore17PlatformScrollbar5widthEv
-__ZNK7WebCore17PlatformScrollbar5widthEv
-__ZThn8_N7WebCore17PlatformScrollbar10setEnabledEb
-__ZN7WebCore17PlatformScrollbar10setEnabledEb
-__ZN7WebCore6Widget10setEnabledEb
-__ZN7WebCore9Scrollbar8setStepsEiii
-__ZN7WebCore9Scrollbar13setProportionEii
-__ZThn8_N7WebCore17PlatformScrollbar21updateThumbProportionEv
-__ZN7WebCore17PlatformScrollbar21updateThumbProportionEv
-__ZThn8_N7WebCore17PlatformScrollbar7setRectERKNS_7IntRectE
-__ZN7WebCore17PlatformScrollbar7setRectERKNS_7IntRectE
-__ZNK7WebCore12RenderObject14nextInPreOrderEv
-__ZNK7WebCore15RenderTableCell19collectBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
-__ZN7WebCore14addBorderStyleERN3WTF6VectorINS_20CollapsedBorderValueELm100EEES2_
-__ZN7WebCore15RenderTableCell16sortBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
-__ZN7WebCore15RenderTableCell20paintCollapsedBorderEPNS_15GraphicsContextEiiii
-__ZN7WebCore20collapsedBorderStyleENS_12EBorderStyleE
-__ZN3WTF6VectorIN7WebCore20CollapsedBorderValueELm100EE6shrinkEm
-__ZNK7WebCore13RootInlineBox11ellipsisBoxEv
-__ZN7WebCore14RenderThemeMac11paintButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore11FrameLoader41updateHistoryForRedirectWithLockedHistoryEv
-__ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
-__ZNK7WebCore17DeprecatedCString5lowerEv
-__ZN7WebCore9ArrayImplC2ERKS0_
-__ZN7WebCore9ArrayImplaSERKS0_
-__ZN7WebCore22characterBreakIteratorEPKti
-__ZNK7WebCore22HTMLGenericFormElement11virtualFormEv
-__ZNK7WebCore17HTMLSelectElement14isEnumeratableEv
-__ZN7WebCore16HTMLInputElement17setSelectionRangeEii
-__ZN7WebCore18createTableWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLTableElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTableElementC1EPN3KJS8JSObjectEPNS_16HTMLTableElementE
-__ZN7WebCore18JSHTMLTableElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22createTableCellWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore31JSHTMLTableCellElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLTableCellElementC1EPN3KJS8JSObjectEPNS_20HTMLTableCellElementE
-__ZN7WebCore22JSHTMLTableCellElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19createSelectWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLSelectElementC1EPN3KJS8JSObjectEPNS_17HTMLSelectElementE
-__ZN7WebCore19JSHTMLSelectElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLSelectElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore22HTMLGenericFormElement11setDisabledEb
-__ZN7WebCore9JSElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore7Element12setScrollTopEi
-__ZN7WebCore12RenderObject12setScrollTopEi
-__ZN7WebCore11RenderLayer14scrollToOffsetEiibb
-__ZN7WebCore9Scrollbar8setValueEi
-__ZN7WebCore9FrameView13scheduleEventEN3WTF10PassRefPtrINS_5EventEEENS2_INS_15EventTargetNodeEEEb
-__ZNK7WebCore13HTMLTokenizer15isHTMLTokenizerEv
-__ZN7WebCore11RenderBlock22removePositionedObjectEPNS_12RenderObjectE
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore12RenderObjectEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS4_NS_21ListHashSetTranslatorIS4_SB_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore10ScrollView17setScrollPositionERKNS_8IntPointE
+__ZN7WebCore10ScrollView25platformSetScrollPositionERKNS_8IntPointE
+__ZN7WebCore12EventHandler15sendScrollEventEv
+__ZN7WebCore9FrameView20setWasScrolledByUserEb
+__ZNK7WebCore11RenderBlock17offsetForContentsERiS1_
+__ZNK7WebCore11RenderLayer24addScrolledContentOffsetERiS1_
+__ZNK7WebCore5Frame10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore19SelectionController10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
 __ZN7WebCore12RenderObject12paintOutlineEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleE
 __ZNK7WebCore11RenderTheme17supportsFocusRingEPKNS_11RenderStyleE
 __ZN7WebCore15GraphicsContext13initFocusRingEii
 __ZN7WebCore15GraphicsContext14clearFocusRingEv
-__ZN7WebCore10RenderFlow17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore17RenderTextControl17addFocusRingRectsEPNS_15GraphicsContextEii
 __ZN7WebCore15GraphicsContext16addFocusRingRectERKNS_7IntRectE
 __ZN7WebCore15GraphicsContext13drawFocusRingERKNS_5ColorE
 __ZNK7WebCore15GraphicsContext14focusRingWidthEv
 __ZNK7WebCore15GraphicsContext15focusRingOffsetEv
-__ZN7WebCore7cgColorERKNS_5ColorE
+__ZN7WebCore13createCGColorERKNS_5ColorE
 __ZN7WebCore7nsColorERKNS_5ColorE
-__ZN7WebCore18CGColorFromNSColorEP7NSColor
+__ZN7WebCoreL18CGColorFromNSColorEP7NSColor
 __ZNK7WebCore15GraphicsContext14focusRingRectsEv
-__ZNK7WebCore11BitmapImage10solidColorEv
-__ZN7WebCore9FloatRectC2ERK6CGRect
-__ZN7WebCore10FloatPointC2ERK7CGPoint
-__ZN7WebCore9FloatSizeC2ERK6CGSize
-__ZN7WebCore5Image18fillWithSolidColorEPNS_15GraphicsContextERKNS_9FloatRectERKNS_5ColorENS_17CompositeOperatorE
-__ZN7WebCore26CSSMutableStyleDeclaration21removePropertiesInSetEPKijb
-__ZNK7WebCore15CSSInitialValue7cssTextEv
-__ZN7WebCore11FrameLoader29loadedResourceFromMemoryCacheEPKNS_14CachedResourceE
-__ZN7WebCore19InspectorController30didLoadResourceFromMemoryCacheEPNS_14DocumentLoaderERKNS_15ResourceRequestERKNS_16ResourceResponseEi
+__ZNK7WebCore9FrameView10hostWindowEv
+__ZNK7WebCore6Chrome18scrollRectIntoViewERKNS_7IntRectEPKNS_10ScrollViewE
+__ZN3WTF6VectorIN3JSC8RegisterELm8EE6shrinkEm
+__ZN7WebCore20jsDOMWindowNavigatorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9navigatorEv
+__ZN7WebCore9NavigatorC1EPNS_5FrameE
+__ZN7WebCore9NavigatorC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9NavigatorE
+__ZN7WebCore11JSNavigator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSNavigatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9NavigatorEEE
+__ZN7WebCore11JSNavigatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9NavigatorEEE
+__ZN7WebCore11JSNavigator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsNavigatorLanguageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator8languageEv
+__ZN7WebCore15defaultLanguageEv
+__ZN7WebCore16jsDocumentCookieEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document6cookieEv
+__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
+__ZN7WebCoreL13filterCookiesEP7NSArray
+__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSHTMLSelectElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26valueToStringWithNullCheckEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement8setValueERKNS_6StringE
+__ZNK7WebCore17HTMLOptionElement5valueEv
+__ZN7WebCore13OptionElement18collectOptionValueERKNS_17OptionElementDataEPNS_8DocumentE
+__ZN3WTF6VectorIbLm0EE6shrinkEm
+__ZN7WebCore11FrameLoader19handledOnloadEventsEv
+__ZN7WebCore8Document13svgExtensionsEv
+__ZNK7WebCore14DocumentLoader16isLoadingPlugInsEv
+__ZNK7WebCore8Document16isPluginDocumentEv
+__ZNK7WebCore8Document15isImageDocumentEv
+__Z3kitPN7WebCore8DocumentE
+__Z3kitPN7WebCore4NodeE
+__Z8kitClassPN7WebCore4NodeE
+-[DOMDocument getElementsByTagName:]
+__ZN7WebCore4Node20getElementsByTagNameERKNS_6StringE
+__ZN7WebCore4Node22getElementsByTagNameNSERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore4Node14createRareDataEv
+__ZN7WebCore15DynamicNodeList6CachesC1Ev
+__ZN7WebCore15DynamicNodeList6CachesC2Ev
+__ZN3WTF7HashMapIN7WebCore13QualifiedNameEPNS1_15DynamicNodeList6CachesENS1_17QualifiedNameHashENS_10HashTraitsIS2_EENS7_IS5_EE
+__ZN3WTF9HashTableIN7WebCore13QualifiedNameESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_17Qualif
+__ZN7WebCore11TagNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_PNS_15DynamicNodeList6CachesE
+__ZN7WebCore11TagNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_PNS_15DynamicNodeList6CachesE
+__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS0_6CachesE
+__ZN7WebCore4Node23registerDynamicNodeListEPNS_15DynamicNodeListE
+__Z3kitPN7WebCore8NodeListE
+-[DOMNodeList length]
+__ZNK7WebCore15DynamicNodeList6lengthEv
+__ZNK7WebCore11TagNodeList11nodeMatchesEPNS_7ElementE
+-[DOMNodeList item:]
+__ZNK7WebCore15DynamicNodeList4itemEj
+__ZNK7WebCore15DynamicNodeList23itemForwardsFromCurrentEPNS_4NodeEji
+__ZN7WebCoreL12elementClassERKNS_13QualifiedNameEP10objc_class
+__ZN7WebCoreL15addElementClassERKNS_13QualifiedNameEP10objc_class
+__ZN3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3s
+__ZN3WTF9HashTableIPKN7WebCore13QualifiedName17QualifiedNameImplESt4pairIS5_P10objc_classENS_18PairFirstExtractorIS9_EENS_7PtrH
+__ZN7WebCoreL18lookupElementClassERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3
+-[DOMNode attributes]
+__ZNK7WebCore7Element10attributesEv
+__Z3kitPN7WebCore12NamedNodeMapE
+-[DOMNamedNodeMap getNamedItem:]
+__ZNK7WebCore12NamedNodeMap12getNamedItemERKNS_6StringE
+__ZNK7WebCore12NamedNodeMap16getAttributeItemERKNS_6StringEb
+__ZNK7WebCore13QualifiedName8toStringEv
+__ZN7WebCore9Attribute18createAttrIfNeededEPNS_7ElementE
+__ZN7WebCore4AttrC1EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN7WebCore4AttrC2EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN7WebCore4Attr15createTextChildEv
+__ZN7WebCore8Document14createTextNodeERKNS_6StringE
+__ZNK7WebCore4Attr8nodeTypeEv
+-[DOMNode nodeValue]
+__ZNK7WebCore4Attr9nodeValueEv
+__ZNK7WebCore11HistoryItem20getTransientPropertyERKNS_6StringE
+__ZN7WebCore15ProgressTracker17progressCompletedEPNS_5FrameE
+__ZN7WebCore15ProgressTracker21finalProgressCompleteEv
+-[DOMNode dealloc]
+__ZThn8_N7WebCore4AttrD0Ev
+__ZN7WebCore4AttrD0Ev
+-[DOMObject dealloc]
+__Z16removeDOMWrapperP17DOMObjectInternal
+-[WebScriptObject dealloc]
+-[DOMNamedNodeMap dealloc]
+-[DOMNodeList dealloc]
+__ZN7WebCore11TagNodeListD0Ev
+__ZN7WebCore15DynamicNodeListD2Ev
+__ZN7WebCore4Node25unregisterDynamicNodeListEPNS_15DynamicNodeListE
+__ZNK7WebCore19SelectionController17isInPasswordFieldEv
+__ZN7WebCore6Loader4HostD0Ev
+-[DOMDocument forms]
+__ZN7WebCore8Document5formsEv
+__ZN7WebCore14HTMLCollection6createEN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__ZN7WebCore14HTMLCollectionC1EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__Z3kitPN7WebCore14HTMLCollectionE
+__Z8kitClassPN7WebCore14HTMLCollectionE
+-[DOMHTMLCollection length]
+__ZNK7WebCore14HTMLCollection6lengthEv
+__ZNK7WebCore14HTMLCollection19resetCollectionInfoEv
+__ZNK7WebCore14HTMLCollection10calcLengthEv
+__ZNK7WebCore14HTMLCollection9itemAfterEPNS_7ElementE
+__ZN7WebCoreL17nextNodeOrSiblingEPNS_4NodeES1_b
+-[DOMHTMLCollection item:]
+__ZNK7WebCore14HTMLCollection4itemEj
+-[DOMHTMLFormElement elements]
+__ZN7WebCore15HTMLFormElement8elementsEv
+__ZN7WebCore18HTMLFormCollection6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore18HTMLFormCollectionC1EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore18HTMLFormCollectionC2EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeEPNS_15CollectionCacheE
+__ZNK7WebCore18HTMLFormCollection10calcLengthEv
+__ZNK7WebCore15HTMLFormElement6lengthEv
+__ZNK7WebCore22HTMLFormControlElement14isEnumeratableEv
+__ZNK7WebCore16HTMLInputElement14isEnumeratableEv
+__ZNK7WebCore17HTMLSelectElement14isEnumeratableEv
+__ZNK7WebCore18HTMLFormCollection4itemEj
+-[DOMHTMLInputElement(FormAutoFillTransition) _isTextField]
+__Z4coreP19DOMHTMLInputElement
+__ZNK7WebCore5Frame11currentFormEv
+__Z3kitPN7WebCore7ElementE
+__Z4coreP10DOMElement
+-[DOMElement offsetWidth]
 __ZN7WebCore7Element11offsetWidthEv
-__ZThn8_NK7WebCore17PlatformScrollbar8isWidgetEv
-__ZNK7WebCore17PlatformScrollbar8isWidgetEv
-__ZN7WebCore6Widget16removeFromParentEv
--[WebCoreScrollBar detachPlatformScrollbar]
-__ZNK7WebCore12RenderObject11offsetWidthEv
-__ZN7WebCore44jsDOMWindowPrototypeFunctionGetComputedStyleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9toElementEPN3KJS7JSValueE
+__ZNK7WebCore4Node20renderBoxModelObjectEv
+__ZNK7WebCore20RenderBoxModelObject16isBoxModelObjectEv
+__ZNK7WebCore9RenderBox11offsetWidthEv
+__ZN7WebCoreL21adjustForAbsoluteZoomEiPNS_12RenderObjectE
+-[DOMElement offsetHeight]
+__ZN7WebCore7Element12offsetHeightEv
+__ZNK7WebCore9RenderBox12offsetHeightEv
+-[DOMNode ownerDocument]
+-[DOMDocument getComputedStyle:pseudoElement:]
 __ZNK7WebCore9DOMWindow16getComputedStyleEPNS_7ElementERKNS_6StringE
+__ZN7WebCore27CSSComputedStyleDeclarationC1EN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore27CSSComputedStyleDeclarationC2EN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSCSSStyleDeclaration18canGetItemsForNameEPN3KJS9ExecStateEPNS_19CSSStyleDeclarationERKNS1_10IdentifierE
-__ZN7WebCore21JSCSSStyleDeclaration10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19CSSStyleDeclaration19getPropertyCSSValueERKNS_6StringE
+__Z3kitPN7WebCore19CSSStyleDeclarationE
+-[DOMCSSStyleDeclaration getPropertyValue:]
+__ZN7WebCore19CSSStyleDeclaration16getPropertyValueERKNS_6StringE
+__ZN7WebCore13cssPropertyIDERKNS_6StringE
+__ZNK7WebCore27CSSComputedStyleDeclaration16getPropertyValueEi
 __ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEi
 __ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEiNS_13EUpdateLayoutE
 __ZN7WebCore7Element13computedStyleEv
-__ZN7WebCore7Element10offsetLeftEv
-__ZNK7WebCore12RenderObject10offsetLeftEv
-__ZN7WebCore19CSSStyleDeclaration16getPropertyValueERKNS_6StringE
-__ZNK7WebCore26CSSMutableStyleDeclaration16getPropertyValueEi
-__ZN7WebCore19CSSCursorImageValueC2ERKNS_6StringERKNS_8IntPointEPNS_9StyleBaseE
-__ZN7WebCore11RenderStyle9addCursorEPNS_11CachedImageERKNS_8IntPointE
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE15reserveCapacityEm
-__ZNK7WebCore12CSSValueList7cssTextEv
-__ZNK7WebCore15FontFamilyValue7cssTextEv
-__ZN7WebCore15JSTextPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSCharacterDataPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore4Font7xHeightEv
-__ZNK7WebCore11RenderTheme19adjustCheckboxStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac15setCheckboxSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac13checkboxSizesEv
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm16EE6shrinkEm
-__ZN7WebCore11RenderLayer25dirtyVisibleContentStatusEv
-__ZN7WebCore14RenderThemeMac20setCheckboxCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac8checkboxEv
-__ZNK7WebCore14RenderThemeMac15checkboxMarginsEv
-__ZNK7WebCore14RenderThemeMac16baselinePositionEPKNS_12RenderObjectE
-__ZN7WebCore7Element11clientWidthEv
-__ZN7WebCore7Element12clientHeightEv
-__ZN7WebCore10RenderView15pushLayoutStateEPNS_12RenderObjectE
-__ZN7WebCore11LayoutStateC2EPNS_12RenderObjectE
-__ZN7WebCore27isObjectAncestorContainerOfEPNS_12RenderObjectES1_
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE6shrinkEm
-__ZN7WebCore22JSHTMLTableCellElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLAnchorElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLAnchorElement7setHrefERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLImageElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLImageElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLImageElement8completeEv
-__ZNK7WebCore16HTMLImageElement3srcEv
-__ZN7WebCore27CSSComputedStyleDeclarationD1Ev
-__ZN7WebCore16HTMLInputElement10setCheckedEbb
-__ZN7WebCore23DeprecatedValueListImpl16removeEqualNodesEPNS_27DeprecatedValueListImplNodeEPFbPKS1_S4_E
-__ZN7WebCore19DeprecatedValueListINS_11CSSPropertyEE10nodesEqualEPKNS_27DeprecatedValueListImplNodeES5_
-__ZN7WebCoreeqERKNS_11CSSPropertyES2_
-__ZNK7WebCore11RenderTheme12stateChangedEPNS_12RenderObjectENS_12ControlStateE
-__ZN7WebCore13textBreakNextEPNS_17TextBreakIteratorE
-__ZN7WebCore18createStyleWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLStyleElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLStyleElementC1EPN3KJS8JSObjectEPNS_16HTMLStyleElementE
-__ZN7WebCore18JSHTMLStyleElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLStyleElement9classInfoEv
-__ZN7WebCore18JSHTMLStyleElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12StyleElement20insertedIntoDocumentEPNS_8DocumentEPNS_7ElementE
-__ZN7WebCore17JSHTMLBodyElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11FrameLoader15parentCompletedEv
-__ZN7WebCore19JSHTMLScriptElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12CachedScript11setEncodingERKNS_6StringE
-__ZN7WebCore12RenderInline11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore13InlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZNK7WebCore17CSSPrimitiveValue7cssTextEv
+__ZN7WebCore17CSSPrimitiveValueD0Ev
+__ZN7WebCore17CSSPrimitiveValue7cleanupEv
+__ZNK7WebCore16HTMLInputElement12autoCompleteEv
+-[DOMHTMLCollection dealloc]
+__ZN7WebCore14HTMLCollectionD0Ev
+-[DOMCSSStyleDeclaration dealloc]
+__ZN7WebCore27CSSComputedStyleDeclarationD0Ev
+__ZN7WebCore18HTMLFormCollectionD0Ev
+__ZN7WebCore14HTMLCollectionD2Ev
+__ZNK7WebCore4Font15drawComplexTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZN7WebCore18CoreTextController7advanceEjPNS_11GlyphBufferE
+__ZN7WebCore5Frame20caretBlinkTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_d
+__ZN7WebCore11HistoryItemC2ERKNS_6StringES3_d
+__ZN7WebCore11HistoryItem18recordInitialVisitEv
+__ZN3WTF6VectorIiLm0EE14expandCapacityEmPKi
+__ZN3WTF6VectorIiLm0EE14expandCapacityEm
+__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
+__ZNK7WebCore11HistoryItem10visitCountEv
+__ZN7WebCore13ScriptElement21handleSourceAttributeERNS_17ScriptElementDataERKNS_6StringE
+__ZNK7WebCore17ScriptElementData18ignoresLoadRequestEv
+__ZN7WebCore9DocLoader13requestScriptERKNS_6StringES3_
+__ZN7WebCore12CachedScriptC1ERKNS_6StringES3_
+__ZN7WebCore12CachedScriptC2ERKNS_6StringES3_
+__ZN7WebCore17DOMImplementation13isXMLMIMETypeERKNS_6StringE
+__ZN7WebCore17RegularExpressionC1ERKNS_6StringENS_19TextCaseSensitivityE
+__ZN7WebCore17RegularExpressionC2ERKNS_6StringENS_19TextCaseSensitivityE
+__ZNK7WebCore17RegularExpression5matchERKNS_6StringEiPi
+__ZN3WTF5DequeIN7WebCore20CachedResourceHandleINS1_12CachedScriptEEEE14expandCapacityEv
+__ZN7WebCore12CachedScript9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore14PreloadScannerC1EPNS_8DocumentE
+__ZN7WebCore14PreloadScannerC2EPNS_8DocumentE
+__ZN7WebCore14PreloadScanner5beginEv
+__ZN7WebCore14PreloadScanner5resetEv
+__ZN3WTF6VectorItLm32EE14shrinkCapacityEm
+__ZN3WTF6VectorItLm16EE14shrinkCapacityEm
+__ZN7WebCore14PreloadScanner5writeERKNS_15SegmentedStringE
+__ZN7WebCore14PreloadScanner8tokenizeERKNS_15SegmentedStringE
+__ZN7WebCore14PreloadScanner16processAttributeEv
+__ZN3WTF6VectorItLm32EE6shrinkEm
+__ZN7WebCore14PreloadScanner7emitTagEv
+__ZNK7WebCore14PreloadScanner12scanningBodyEv
+__ZN7WebCore9DocLoader7preloadENS_14CachedResource4TypeERKNS_6StringES5_b
+__ZN7WebCore9DocLoader14requestPreloadENS_14CachedResource4TypeERKNS_6StringES5_
+__ZNK3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashF
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFu
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN3WTF5DequeIN7WebCore18SegmentedSubstringEE14expandCapacityEv
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE15reserveCapacityEm
+__ZN7WebCore14PreloadScanner13consumeEntityERNS_15SegmentedStringERb
+__ZN3WTF6VectorIcLm10EE6shrinkEm
+__ZN3WTF6VectorItLm10EE6shrinkEm
+__ZNK7WebCore12HTMLDocument10isFrameSetEv
+-[DOMDocument documentElement]
+-[DOMDocument createRange]
+__ZN7WebCore8Document11createRangeEv
+__Z3kitPN7WebCore5RangeE
+-[DOMRange selectNode:]
+__Z4coreP7DOMNode
+__ZN7WebCore5Range10selectNodeEPNS_4NodeERi
+__ZN7WebCore5Range14setStartBeforeEPNS_4NodeERi
+__ZNK7WebCore5Range11checkNodeBAEPNS_4NodeERi
+__ZNK7WebCore4Node9nodeIndexEv
+__ZN7WebCore5Range11setEndAfterEPNS_4NodeERi
+__Z4coreP8DOMRange
+__ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
+__ZN7WebCore12TextIterator17handleNonTextNodeEv
+__ZN7WebCoreL24shouldEmitNewlineForNodeEPNS_4NodeE
+__ZNK7WebCore4Node14isDescendantOfEPKS0_
 __ZNK7WebCore4Node17isContentEditableEv
-__ZNK7WebCore4Node17canStartSelectionEv
-__ZN7WebCore11iBeamCursorEv
-__ZN7WebCore12EventHandler8keyEventEP7NSEvent
-__ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
-__ZN7WebCore25windowsKeyCodeForKeyEventEP7NSEvent
-__ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
-__ZN7WebCore26eventTargetNodeForDocumentEPNS_8DocumentE
-__ZN7WebCore12EventHandler15handleAccessKeyERKNS_21PlatformKeyboardEventE
-__ZNK7WebCore12EventHandler38needsKeyboardEventDisambiguationQuirksEv
-__ZNK7WebCore16DeprecatedString10startsWithEPKcb
-__ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
-__ZN7WebCore13KeyboardEventC2ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
-__ZN7WebCore6Editor24handleInputMethodKeydownEPNS_13KeyboardEventE
-__ZN7WebCore6Editor19selectionForCommandEPNS_5EventE
-__ZNK7WebCore13KeyboardEvent15isKeyboardEventEv
-__ZN7WebCore24JSKeyboardEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSUIEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSKeyboardEventC1EPN3KJS8JSObjectEPNS_13KeyboardEventE
-__ZN7WebCore9JSUIEventC1EPN3KJS8JSObjectEPNS_7UIEventE
-__ZN7WebCore15JSKeyboardEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore15JSKeyboardEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSKeyboardEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore5Event20storesResultAsStringEv
-__ZN7WebCore5Frame27doTextFieldCommandFromEventEPNS_7ElementEPNS_13KeyboardEventE
-__ZN7WebCore12EventHandler27defaultKeyboardEventHandlerEPNS_13KeyboardEventE
-__ZN7WebCore6Editor19handleKeyboardEventEPNS_13KeyboardEventE
-__ZN7WebCore6Editor7commandERKNS_6StringE
-__ZN7WebCore6Editor7commandERKNS_6StringENS_19EditorCommandSourceE
-__ZN7WebCore16createCommandMapEv
-__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN7WebCore6Editor7CommandC1EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command15isTextInsertionEv
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EEaSERKS3_
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE15reserveCapacityEm
-__ZN7WebCore6Editor10insertTextERKNS_6StringEPNS_5EventE
-__ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
-__ZN7WebCore9TextEventC2EPNS_9DOMWindowERKNS_6StringE
-__ZNK7WebCore9TextEvent11isTextEventEv
-__ZN7WebCore12EventHandler28defaultTextInputEventHandlerEPNS_9TextEventE
-__ZN7WebCore6Editor33insertTextWithoutSendingTextEventERKNS_6StringEbPNS_5EventE
-__ZNK7WebCore6Editor16shouldInsertTextERKNS_6StringEPNS_5RangeENS_18EditorInsertActionE
-__ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringERKNS_9SelectionEbb
-__ZN7WebCore23BeforeTextInsertedEventC2ERKNS_6StringE
-__ZN7WebCore29HTMLTextFieldInnerTextElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore23BeforeTextInsertedEvent25isBeforeTextInsertedEventEv
-__ZN7WebCore19numGraphemeClustersEPNS_10StringImplE
-__ZN7WebCore9plainTextEPKNS_5RangeE
-__ZN7WebCore13TypingCommandC2EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityE
-__ZN7WebCore20CompositeEditCommandC2EPNS_8DocumentE
-__ZN7WebCore11EditCommandC2EPNS_8DocumentE
-__ZN7WebCore25avoidIntersectionWithNodeERKNS_9SelectionEPNS_4NodeE
-__ZN7WebCore11EditCommand20setStartingSelectionERKNS_9SelectionE
-__ZN7WebCore11EditCommand18setEndingSelectionERKNS_9SelectionE
-__ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore11EditCommand5applyEv
-__ZNK7WebCore9Selection23isContentRichlyEditableEv
-__ZN7WebCore24isRichlyEditablePositionERKNS_8PositionE
-__ZNK7WebCore11HTMLElement23isContentRichlyEditableEv
-__ZNK7WebCore13TypingCommand13editingActionEv
-__ZNK7WebCore11EditCommand12updateLayoutEv
-__ZN7WebCore13TypingCommand7doApplyEv
-__ZN7WebCore13TypingCommand10insertTextERKNS_6StringEb
-__ZN7WebCore13TypingCommand28insertTextRunWithoutNewlinesERKNS_6StringEb
-__ZNK7WebCore5Frame11typingStyleEv
-__ZN7WebCore17InsertTextCommandC2EPNS_8DocumentE
-__ZN7WebCore20CompositeEditCommand23applyCommandToCompositeEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore11EditCommand9setParentEPNS_20CompositeEditCommandE
-__ZN7WebCore17InsertTextCommand7doApplyEv
-__ZNK7WebCore11EditCommand20preservesTypingStyleEv
-__ZN7WebCore11EditCommand14setTypingStyleEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE15reserveCapacityEm
-__ZN7WebCore17InsertTextCommand5inputERKNS_6StringEb
-__ZN7WebCore18positionBeforeNodeEPKNS_4NodeE
-__ZNK7WebCore8Position10downstreamEv
-__ZNK7WebCore16PositionIterator5atEndEv
-__ZN7WebCore13maxDeepOffsetEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextERKNS_8PositionES3_
-__ZN7WebCore20CompositeEditCommand38positionAvoidingSpecialElementBoundaryERKNS_8PositionEb
-__ZN7WebCore22enclosingAnchorElementERKNS_8PositionE
-__ZN7WebCore17InsertTextCommand23prepareForTextInsertionERKNS_8PositionE
-__ZN7WebCore8Document21createEditingTextNodeERKNS_6StringE
-__ZN7WebCore11EditingTextC2EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore20CompositeEditCommand12insertNodeAtEPNS_4NodeERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand10appendNodeEPNS_4NodeES2_
-__ZN7WebCore17AppendNodeCommandC2EPNS_4NodeEN3WTF10PassRefPtrIS1_EE
-__ZN7WebCore17AppendNodeCommand7doApplyEv
-__ZN7WebCore11EditingText16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore10RenderText6heightEv
-__ZN7WebCore9RenderBox9caretRectEiNS_9EAffinityEPi
-__ZNK7WebCore4Node9childNodeEj
-__ZN7WebCore10isStreamerERKNS_16PositionIteratorE
+__ZN7WebCoreL10isStreamerERKNS_16PositionIteratorE
 __ZN7WebCore12isAtomicNodeEPKNS_4NodeE
+__ZNK7WebCore16PositionIterator13atStartOfNodeEv
 __ZN7WebCore16PositionIterator9decrementEv
-__ZNK7WebCore8Position14inRenderedTextEv
-__ZN7WebCore16PositionIterator9incrementEv
 __ZNK7WebCore13CharacterData18offsetInCharactersEv
 __ZNK7WebCore13CharacterData18maxCharacterOffsetEv
+__ZN7WebCore8Position23uncheckedPreviousOffsetEPKNS_4NodeEi
+__ZN7WebCore18positionBeforeNodeEPKNS_4NodeE
+__ZNK7WebCore12RenderObject14nextInPreOrderEv
+__ZN7WebCore16PositionIterator9incrementEv
 __ZN7WebCore13nextCandidateERKNS_8PositionE
 __ZNK7WebCore16PositionIterator11isCandidateEv
-__ZNK7WebCore16PositionIterator13atStartOfNodeEv
-__ZN7WebCore21canonicalizeCandidateERKNS_8PositionE
+__ZN7WebCore8Position19uncheckedNextOffsetEPKNS_4NodeEi
+__ZN7WebCoreL21canonicalizeCandidateERKNS_8PositionE
+__ZNK7WebCore16PositionIterator11atEndOfNodeEv
 __ZN7WebCore17previousCandidateERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand19removePlaceholderAtERKNS_15VisiblePositionE
-__ZN7WebCore12isEndOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore10endOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore8Position23uncheckedPreviousOffsetEPKNS_4NodeEi
-__ZNK7WebCore12RenderObject14previousOffsetEi
-__ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
-__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionE
-__ZN7WebCore25lineBreakExistsAtPositionERKNS_15VisiblePositionE
-__ZNK7WebCore15VisiblePosition14characterAfterEv
-__ZN7WebCore20CompositeEditCommand18insertTextIntoNodeEPNS_4TextEiRKNS_6StringE
-__ZN7WebCore25InsertIntoTextNodeCommandC2EPNS_4TextEiRKNS_6StringE
-__ZN7WebCore25InsertIntoTextNodeCommand7doApplyEv
-__ZN7WebCore13CharacterData10insertDataEjRKNS_6StringERi
-__ZN7WebCore13CharacterData22checkCharDataOperationEjRi
-__ZN7WebCore6String6insertERKS0_j
-__ZN7WebCore6String6insertEPKtjj
-__ZN7WebCore6String6appendEPKtj
-__ZN7WebCore10RenderText17setTextWithOffsetEN3WTF10PassRefPtrINS_10StringImplEEEjjb
-__ZN7WebCore8Document12shiftMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore20CompositeEditCommand21rebalanceWhitespaceAtERKNS_8PositionE
-__ZN7WebCore9Selection20setWithoutValidationERKNS_8PositionES3_
-__ZNK7WebCore8Position13computedStyleEv
-__ZNK7WebCore8Position7elementEv
-__ZNK7WebCore19CSSStyleDeclaration4diffEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore9SelectionC2ERKNS_8PositionENS_9EAffinityE
-__ZNK7WebCore10RenderText14caretMinOffsetEv
-__ZNK7WebCore13InlineTextBox19containsCaretOffsetEi
-__ZN7WebCore10RenderText9caretRectEiNS_9EAffinityEPi
-__ZNK7WebCore13InlineTextBox17positionForOffsetEi
-__ZNK7WebCore4Font20selectionRectForTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZNK7WebCore4Font26selectionRectForSimpleTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZNK7WebCore12RenderObject16absolutePositionERiS1_b
-__ZNK7WebCore10RenderText14previousOffsetEi
-__ZN7WebCore18textBreakPrecedingEPNS_17TextBreakIteratorEi
-__ZNK7WebCore10RenderText10nextOffsetEi
-__ZN7WebCore13TypingCommand24typingAddedToOpenCommandEv
-__ZN7WebCore13TypingCommand27markMisspellingsAfterTypingEv
-__ZNK7WebCore15VisiblePosition8previousEb
-__ZN7WebCore33previousVisuallyDistinctCandidateERKNS_8PositionE
-__ZNK7WebCore8Position7atStartEv
-__ZNK7WebCore8Position8previousENS_24EUsingComposedCharactersE
-__ZN7WebCore31SimplifiedBackwardsTextIterator8exitNodeEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator13emitCharacterEtPNS_4NodeEii
-__ZN3WTF6VectorItLm1024EE7prependItEEvPKT_m
-__ZN3WTF6VectorItLm1024EE6insertItEEvmPKT_m
-__ZN7WebCore17startWordBoundaryEPKtj
-__ZN7WebCore16findWordBoundaryEPKtiiPiS2_
-__ZN7WebCore31SimplifiedBackwardsTextIterator14handleTextNodeEv
-__ZNK7WebCore5Range11endPositionEv
-__ZNK7WebCore13TypingCommand20preservesTypingStyleEv
-__ZN7WebCore6Editor14appliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore36dispatchEditableContentChangedEventsERKNS_11EditCommandE
-__ZN7WebCore17RenderTextControl17subtreeHasChangedEv
-__ZN7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
-__ZN7WebCore5Frame24textFieldDidBeginEditingEPNS_7ElementE
--[DOMHTMLInputElement value]
--[WebCoreFrameBridge formForElement:]
-__Z26inputElementFromDOMElementP10DOMElement
--[WebCoreFrameBridge controlsInForm:]
-__Z25formElementFromDOMElementP10DOMElement
--[DOMElement offsetWidth]
--[DOMElement offsetHeight]
--[DOMNode ownerDocument]
--[DOMDocument getComputedStyle:pseudoElement:]
-+[DOMCSSStyleDeclaration(WebCoreInternal) _wrapCSSStyleDeclaration:]
--[DOMCSSStyleDeclaration(WebCoreInternal) _initWithCSSStyleDeclaration:]
--[DOMCSSStyleDeclaration getPropertyValue:]
-__ZNK7WebCore27CSSComputedStyleDeclaration16getPropertyValueEi
--[WebCoreFrameBridge elementIsPassword:]
--[WebCoreFrameBridge elementDoesAutoComplete:]
--[DOMElement getAttribute:]
-__ZN7WebCore5Frame24textDidChangeInTextFieldEPNS_7ElementE
-+[WebCoreFrameBridge bridgeForDOMDocument:]
--[DOMDocument(WebCoreInternal) _document]
--[DOMHTMLInputElement form]
-+[DOMHTMLFormElement(WebCoreInternal) _wrapHTMLFormElement:]
--[DOMHTMLFormElement action]
-__ZNK7WebCore15HTMLFormElement6actionEv
--[DOMHTMLInputElement(FormPromptAdditions) _isEdited]
--[DOMNode parentNode]
-__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_9SelectionE
-__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_9SelectionES3_NS_9EAffinityEb
-__ZNK7WebCore10RenderText22caretMaxRenderedOffsetEv
-__ZNK7WebCore10RenderText14caretMaxOffsetEv
-__ZN7WebCore6Editor24respondToChangedContentsERKNS_9SelectionE
--[DOMCSSStyleDeclaration dealloc]
-__ZN7WebCore15EventTargetNode16dispatchKeyEventERKNS_21PlatformKeyboardEventE
-__ZN7WebCore9JSUIEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore9JSUIEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSUIEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore13KeyboardEvent7keyCodeEv
-__ZNK7WebCore13TypingCommand15isTypingCommandEv
-__ZNK7WebCore17InsertTextCommand19isInsertTextCommandEv
-__ZN7WebCore17isTabSpanTextNodeEPKNS_4NodeE
-__ZN7WebCore13isTabSpanNodeEPKNS_4NodeE
-__ZNK7WebCore4Node29traversePreviousNodePostOrderEPKS0_
-__ZN7WebCore6Editor37markMisspellingsAfterTypingToPositionERKNS_15VisiblePositionE
-__ZN7WebCore12nextBoundaryERKNS_15VisiblePositionEPFjPKtjE
-__ZN7WebCore5Range18selectNodeContentsEPNS_4NodeERi
-__ZNK7WebCore5Range12maxEndOffsetEv
-__ZN3WTF6VectorItLm1024EE6appendItEEvPKT_m
-__ZN7WebCore15endWordBoundaryEPKtj
-__ZN7WebCore17CharacterIteratorC2EPKNS_5RangeEb
-__ZN7WebCore17CharacterIterator7advanceEi
-__ZNK7WebCore17CharacterIterator5rangeEv
-__ZNK7WebCore12TextIterator5rangeEv
 __ZN7WebCore10inSameLineERKNS_15VisiblePositionES2_
 __ZN7WebCore11startOfLineERKNS_15VisiblePositionE
-__ZN7WebCore20startPositionForLineERKNS_15VisiblePositionE
-__ZN7WebCore14rootBoxForLineERKNS_15VisiblePositionE
-__ZN7WebCore10RenderText9inlineBoxEiNS_9EAffinityE
+__ZN7WebCoreL20startPositionForLineERKNS_15VisiblePositionE
+__ZN7WebCoreL14rootBoxForLineERKNS_15VisiblePositionE
+__ZNK7WebCore9InlineBox14caretMinOffsetEv
+__ZNK7WebCore12RenderObject14caretMinOffsetEv
+__ZNK7WebCore9InlineBox14caretMaxOffsetEv
+__ZNK7WebCore12RenderObject14caretMaxOffsetEv
+__ZN7WebCore9InlineBox13prevLeafChildEv
+__ZN7WebCore13InlineFlowBox22lastLeafChildBeforeBoxEPNS_9InlineBoxE
 __ZN7WebCore13InlineFlowBox14firstLeafChildEv
 __ZN7WebCore13InlineFlowBox22firstLeafChildAfterBoxEPNS_9InlineBoxE
 __ZN7WebCore9InlineBox14firstLeafChildEv
-__ZN7WebCore36positionAvoidingFirstPositionInTableERKNS_15VisiblePositionE
+__ZN7WebCoreL36positionAvoidingFirstPositionInTableERKNS_15VisiblePositionE
+__ZNK7WebCore8Position8previousENS_16PositionMoveTypeE
+__ZN7WebCore30lastDeepEditingPositionForNodeEPNS_4NodeE
 __ZN7WebCore25isLastPositionBeforeTableERKNS_15VisiblePositionE
 __ZNK7WebCore15VisiblePosition30honorEditableBoundaryAtOrAfterERKS0_
-__ZN7WebCore6Editor16markMisspellingsERKNS_9SelectionE
-__ZN7WebCore28markMisspellingsOrBadGrammarEPNS_6EditorERKNS_9SelectionEb
-__ZNK7WebCore5Range10isDetachedEv
-__ZN7WebCore27findFirstMisspellingInRangeEPNS_12EditorClientEPNS_5RangeERib
-__ZN7WebCore17WordAwareIteratorC2EPKNS_5RangeE
-__ZN7WebCore17WordAwareIterator7advanceEv
-__ZNK7WebCore17WordAwareIterator10charactersEv
-__ZNK7WebCore17WordAwareIterator6lengthEv
-__ZN7WebCore5TimerINS_12IconDatabaseEE5firedEv
-__ZN7WebCore12IconDatabase14syncTimerFiredEPNS_5TimerIS0_EE
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase30writeIconSnapshotToSQLDatabaseERKNS_12IconSnapshotE
-__ZN7WebCore15SQLiteStatement9isExpiredEv
-_sqlite3_expired
-__ZN7WebCore14SQLiteDatabase15lastInsertRowIDEv
-_sqlite3_last_insert_rowid
-__ZN7WebCore15SQLiteStatement8bindBlobEiPKvi
-_sqlite3_bind_blob
-_balance_deeper
-_balance_nonroot
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE6shrinkEm
--[DOMHTMLInputElement disabled]
--[WebCoreFrameBridge matchLabels:againstElement:]
-__ZN7WebCore5Frame25matchLabelsAgainstElementEP7NSArrayPNS_7ElementE
-__ZN7WebCore17RegularExpressionD2Ev
-__ZN7WebCore17RegularExpression7PrivateD2Ev
-__ZNK7WebCore16DeprecatedString4findENS_14DeprecatedCharEi
-__ZN7WebCore16DeprecatedStringC2ENS_14DeprecatedCharE
-__ZNK7WebCore16DeprecatedString4findERKS0_ib
-__ZN7WebCore15regExpForLabelsEP7NSArray
-__ZN7WebCore16DeprecatedString12fromNSStringEP8NSString
-__ZN7WebCore16DeprecatedString21setBufferFromCFStringEPK10__CFString
-__ZNK7WebCore17RegularExpression6searchERKNS_16DeprecatedStringEi
-__ZN7WebCore17RegularExpressionC2ERKNS_16DeprecatedStringEbb
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE15reserveCapacityEm
--[WebCoreFrameBridge searchForLabels:beforeElement:]
-__ZN7WebCore5Frame28searchForLabelsBeforeElementEP7NSArrayPNS_7ElementE
-__ZNK7WebCore11HTMLElement20isGenericFormElementEv
-__ZN7WebCore5Frame24searchForLabelsAboveCellEPNS_17RegularExpressionEPNS_20HTMLTableCellElementE
-__ZNK7WebCore17RegularExpression9searchRevERKNS_16DeprecatedStringE
-__ZNK7WebCore22HTMLGenericFormElement20isGenericFormElementEv
-__ZNK7WebCore6Editor7Command11isSupportedEv
-__ZN7WebCore29supportedFromMenuOrKeyBindingEPNS_5FrameENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command7executeEPNS_5EventE
-__ZNK7WebCore6Editor7Command7executeERKNS_6StringEPNS_5EventE
-__ZNK7WebCore6Editor7Command9isEnabledEPNS_5EventE
-__ZN7WebCore21enabledInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore21executeDeleteBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Editor19deleteWithDirectionENS_19SelectionController10EDirectionENS_15TextGranularityEbb
-__ZN7WebCore19SelectionController6modifyENS0_11EAlterationENS0_10EDirectionENS_15TextGranularityEb
-__ZN7WebCore19SelectionController14willBeModifiedENS0_11EAlterationENS0_10EDirectionE
-__ZN7WebCore9Selection7setBaseERKNS_8PositionE
-__ZN7WebCore9Selection9setExtentERKNS_8PositionE
-__ZN7WebCore19SelectionController27modifyExtendingLeftBackwardENS_15TextGranularityE
-__ZNK7WebCore15VisiblePosition31honorEditableBoundaryAtOrBeforeERKS0_
-__ZN7WebCore19SelectionController30xPosForVerticalArrowNavigationENS0_13EPositionTypeE
-__ZN7WebCore19SelectionController9setExtentERKNS_15VisiblePositionEb
-__ZN7WebCore9SelectionC2ERKNS_8PositionES3_NS_9EAffinityE
-__ZN7WebCore19SelectionController16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
-__ZNK7WebCore5Range9collapsedERi
-__ZN7WebCore10RenderText17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore12RenderObject17selectionStartEndERiS1_
-__ZNK7WebCore10RenderView17selectionStartEndERiS1_
-__ZNK7WebCore13InlineTextBox10isSelectedEii
-__ZN7WebCore13RootInlineBox22setHasSelectedChildrenEb
-__ZN7WebCore11RenderBlock17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore12RenderObject7childAtEj
-__ZNK7WebCore10RenderText18canBeSelectionLeafEv
-__ZN7WebCore10RenderText13selectionRectEb
-__ZN7WebCore13InlineTextBox13selectionRectEiiii
-__ZN7WebCore13InlineTextBox12selectionTopEv
-__ZN7WebCore13InlineTextBox15selectionHeightEv
-__ZN7WebCore12RenderObject26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS2_13SelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore11RenderBlock17selectionGapRectsEv
-__ZNK7WebCore11RenderBlock15isSelectionRootEv
-__ZN7WebCore11RenderBlock19leftSelectionOffsetEPS0_i
-__ZN7WebCore11RenderBlock20rightSelectionOffsetEPS0_i
-__ZN7WebCore11RenderBlock17fillSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZN7WebCore11RenderBlock23fillInlineSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZN7WebCore13RootInlineBox20fillLineSelectionGapEiiPNS_11RenderBlockEiiiiPKNS_12RenderObject9PaintInfoE
-__ZN7WebCore13RootInlineBox14selectionStateEv
-__ZN7WebCore11RenderBlock29getHorizontalSelectionGapInfoENS_12RenderObject14SelectionStateERbS3_
-__ZN7WebCore13RootInlineBox16firstSelectedBoxEv
-__ZN7WebCore13RootInlineBox15lastSelectedBoxEv
-__ZN7WebCore13InlineFlowBox13lastLeafChildEv
-__ZN7WebCore13InlineFlowBox22lastLeafChildBeforeBoxEPNS_9InlineBoxE
-__ZN7WebCore9InlineBox13lastLeafChildEv
-__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS2_18BlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore11RenderBlock22fillBlockSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZNK7WebCore10RenderView14selectionStartEv
-__ZNK7WebCore12RenderObject18canBeSelectionLeafEv
-__ZNK7WebCore5Range20editingStartPositionEv
-__ZN7WebCore13TypingCommand16deleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityE
-__ZN7WebCore13TypingCommand16deleteKeyPressedENS_15TextGranularityE
-__ZN7WebCore25isFirstPositionAfterTableERKNS_15VisiblePositionE
-__ZNK7WebCore5Frame21shouldDeleteSelectionERKNS_9SelectionE
-__ZN7WebCore20CompositeEditCommand15deleteSelectionERKNS_9SelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommandC2ERKNS_9SelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommand7doApplyEv
-__ZN7WebCore5Frame28textWillBeDeletedInTextFieldEPNS_7ElementE
-__ZN7WebCore22DeleteSelectionCommand22initializePositionDataEv
-__ZN7WebCore22DeleteSelectionCommand18initializeStartEndERNS_8PositionES2_
-__ZN7WebCore38positionBeforeContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
-__ZN7WebCore21firstInSpecialElementERKNS_8PositionE
-__ZN7WebCore16isSpecialElementEPKNS_4NodeE
-__ZN7WebCore37positionAfterContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
-__ZN7WebCore20lastInSpecialElementERKNS_8PositionE
-__ZN7WebCore10isTableRowEPKNS_4NodeE
-__ZN7WebCore18enclosingTableCellERKNS_8PositionE
-__ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
-__ZNK7WebCore8Position25previousCharacterPositionENS_9EAffinityE
-__ZN7WebCore13isStartOfLineERKNS_15VisiblePositionE
-__ZNK7WebCore8Position26rendersInDifferentPositionERKS0_
-__ZNK7WebCore8Position14renderedOffsetEv
-__ZNK7WebCore4Node12nextEditableEv
-__ZNK7WebCore4Node12nextLeafNodeEv
-__ZNK7WebCore4Node30nextNodeConsideringAtomicNodesEv
-__ZNK7WebCore4Node16previousEditableEv
-__ZNK7WebCore4Node16previousLeafNodeEv
-__ZNK7WebCore4Node34previousNodeConsideringAtomicNodesEv
-__ZN7WebCore4Node32inSameContainingBlockFlowElementEPS0_
-__ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
-__ZNK7WebCore4Node32enclosingBlockFlowOrTableElementEv
-__ZNK7WebCore4Node23isBlockFlowOrBlockTableEv
-__ZN7WebCore20CompositeEditCommand33deleteInsignificantTextDownstreamERKNS_8PositionE
-__ZNK7WebCore15VisiblePosition4nextEb
-__ZN7WebCore29nextVisuallyDistinctCandidateERKNS_8PositionE
-__ZNK7WebCore8Position5atEndEv
-__ZN7WebCore22DeleteSelectionCommand20saveTypingStyleStateEv
-__ZN7WebCore21positionBeforeTabSpanERKNS_8PositionE
-__ZNK7WebCore27CSSComputedStyleDeclaration25copyInheritablePropertiesEv
-__ZNK7WebCore19CSSStyleDeclaration19copyPropertiesInSetEPKij
-__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6LengthE
-__ZN7WebCore24currentColorOrValidColorEPNS_11RenderStyleERKNS_5ColorE
-__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleERKNS_19DeprecatedValueListINS_11CSSPropertyEEE
-__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEiRi
-__ZNK7WebCore9StyleBase15isCSSStyleSheetEv
-__ZN7WebCore21nearestMailBlockquoteEPKNS_4NodeE
-__ZN7WebCore16isMailBlockquoteEPKNS_4NodeE
-__ZN7WebCore22DeleteSelectionCommand23saveFullySelectedAnchorEv
-__ZN7WebCore20enclosingNodeWithTagERKNS_8PositionERKNS_13QualifiedNameE
-__ZNK7WebCore8Position4nextENS_24EUsingComposedCharactersE
-__ZN7WebCore22DeleteSelectionCommand25handleSpecialCaseBRDeleteEv
-__ZN7WebCore22DeleteSelectionCommand19handleGeneralDeleteEv
-__ZN7WebCore14caretMaxOffsetEPKNS_4NodeE
-__ZN7WebCore22DeleteSelectionCommand18deleteTextFromNodeEPNS_4TextEii
-__ZN7WebCore28updatePositionForTextRemovalEPNS_4NodeEiiRNS_8PositionE
-__ZN7WebCore20CompositeEditCommand18deleteTextFromNodeEPNS_4TextEii
-__ZN7WebCore25DeleteFromTextNodeCommandC2EPNS_4TextEii
-__ZN7WebCore25DeleteFromTextNodeCommand7doApplyEv
-__ZN7WebCore13CharacterData13substringDataEjjRi
-__ZN7WebCore13CharacterData10deleteDataEjjRi
-__ZN7WebCore6String6removeEji
-__ZN7WebCore8Document13removeMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore22DeleteSelectionCommand15fixupWhitespaceEv
-__ZN7WebCore22DeleteSelectionCommand15mergeParagraphsEv
-__ZN7WebCore22DeleteSelectionCommand38removePreviouslySelectedEmptyTableRowsEv
-__ZN7WebCore22DeleteSelectionCommand31calculateTypingStyleAfterDeleteEPNS_4NodeE
-__ZN7WebCore4Node13computedStyleEv
-__ZN3WTF6VectorIiLm0EE14expandCapacityEmPKi
-__ZN7WebCore11quoteStringERKNS_6StringE
-__ZN7WebCore10StringImpl7replaceEtPS0_
+__ZN7WebCore12TextIterator33shouldEmitSpaceBeforeAndAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator21handleReplacedElementEv
+__ZN7WebCore12TextIterator14handleTextNodeEv
+__ZN7WebCore12TextIterator8exitNodeEv
+__ZN7WebCoreL26shouldEmitNewlineAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator13emitCharacterEtPNS_4NodeES2_ii
+__ZN7WebCore12TextIterator13handleTextBoxEv
+__ZN7WebCore12TextIterator8emitTextEPNS_4NodeEii
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE15reserveCapacityEm
+__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxElPFbPKS1_S5_EEvT_S8_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
+__ZSt16__insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE6shrinkEm
+-[DOMRange dealloc]
+__ZN7WebCore12CachedScript4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore12CachedScript11checkNotifyEv
+__ZThn16_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZNK7WebCore26CachedScriptSourceProvider6lengthEv
+__ZN7WebCore12CachedScript6scriptEv
+__ZN7WebCore14CachedResource12removeClientEPNS_20CachedResourceClientE
+__ZNK7WebCore26CachedScriptSourceProvider4dataEv
+__ZN7WebCoreL23addPendingEventListenerERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerEEELm
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowESt4pairIS3_PNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEEENS_18PairFirst
+__ZN7WebCore19MediaQueryEvaluatorC1Eb
+__ZN7WebCore19MediaQueryEvaluatorC2Eb
+__ZN7WebCore11FrameLoader29loadedResourceFromMemoryCacheEPKNS_14CachedResourceE
+__ZN7WebCore19InspectorController30didLoadResourceFromMemoryCacheEPNS_14DocumentLoaderEPKNS_14CachedResourceE
+__ZThn112_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore9CSSParser22createFloatingFunctionEv
+__ZN3WTF7HashSetIPN7WebCore17CSSParserFunctionENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expa
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reha
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13all
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4find
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47rem
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remo
+__ZN7WebCore9CSSParser13parseSVGValueEib
+__ZN7WebCore9CSSParser22rollbackLastPropertiesEi
+__ZN7WebCore9CSSParser12parseReflectEib
+__ZN7WebCore9CSSParser16parseBorderImageEibRN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCoreL17equalIgnoringCaseERKNS_15CSSParserStringEPKc
+__ZN7WebCore9CSSParser13parseGradientERN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore22CSSImageGeneratorValueC2Ev
+__ZN7WebCoreL18parseGradientPointEPNS_14CSSParserValueEb
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser20parseColorParametersEPNS_14CSSParserValueEPib
+__ZN7WebCore23BorderImageParseContext17commitBorderImageEPNS_9CSSParserEb
+__ZN7WebCore19CSSBorderImageValueC1EN3WTF10PassRefPtrINS_8CSSValueEEENS2_INS_4RectEEEii
+__ZN7WebCore19CSSBorderImageValueC2EN3WTF10PassRefPtrINS_8CSSValueEEENS2_INS_4RectEEEii
+__ZN7WebCore9CSSParser19createKeyframesRuleEv
+__ZN7WebCore22WebKitCSSKeyframesRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore22WebKitCSSKeyframesRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore11CSSRuleListC1Ev
+__ZN7WebCore11CSSRuleListC2Ev
+__ZN7WebCore9CSSParser14parseTransformEv
+__ZN7WebCore22TransformOperationInfoC2ERKNS_15CSSParserStringE
+__ZN7WebCore23WebKitCSSTransformValueC1ENS0_22TransformOperationTypeE
+__ZN7WebCore23WebKitCSSTransformValueC2ENS0_22TransformOperationTypeE
+__ZN7WebCore9CSSParser22parseAnimationPropertyEiRN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore9CSSParser28parseAnimationTimingFunctionEv
+__ZN7WebCore9CSSParser18createKeyframeRuleEPNS_18CSSParserValueListE
 __ZN7WebCore6String6numberEd
-__ZN7WebCore5Frame14setTypingStyleEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore22DeleteSelectionCommand19clearTransientStateEv
-__ZN7WebCore8Position5clearEv
-__ZNK7WebCore22DeleteSelectionCommand20preservesTypingStyleEv
-__ZN7WebCore9InlineBox13nextLeafChildEv
-__ZN7WebCore9InlineBox13prevLeafChildEv
-__ZN7WebCore6Editor36revealSelectionAfterEditingOperationEv
-__ZNK7WebCore11HistoryItem5titleEv
-__ZNK7WebCore11EditCommand19isInsertTextCommandEv
-__ZNK7WebCore11HistoryItem14alternateTitleEv
-__ZNK7WebCore11HistoryItem10visitCountEv
-__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
-__ZN7WebCore8Document9addMarkerEPNS_5RangeENS_14DocumentMarker10MarkerTypeENS_6StringE
-__ZN7WebCore8Document9addMarkerEPNS_4NodeENS_14DocumentMarkerE
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE15reserveCapacityEm
-__ZN7WebCore24placeholderRectForMarkerEv
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC2ERKS3_
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE6shrinkEm
-__ZN7WebCore13InlineTextBox28paintSpellingOrGrammarMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleEPKNS_4FontEb
-__ZN7WebCore15GraphicsContext34drawLineForMisspellingOrBadGrammarERKNS_8IntPointEib
+__ZN7WebCore21WebKitCSSKeyframeRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore21WebKitCSSKeyframeRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore21WebKitCSSKeyframeRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN7WebCore22WebKitCSSKeyframesRule6appendEPNS_21WebKitCSSKeyframeRuleE
+__ZN7WebCore11CSSRuleList6appendEPNS_7CSSRuleE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser19parseAnimationDelayEv
+__ZN7WebCore9CSSParser22parseAnimationDurationEv
+__ZN7WebCore9CSSParser18parseAnimationNameEv
+__ZN7WebCore15HTMLLinkElement11sheetLoadedEv
+__ZN7WebCore9StyleBase11isMediaRuleEv
+__ZN7WebCore9StyleBase14isFontFaceRuleEv
+__ZN7WebCore9StyleBase15isVariablesRuleEv
+__ZN7WebCore22WebKitCSSKeyframesRule15isKeyframesRuleEv
+__ZN7WebCore16CSSStyleSelector16addKeyframeStyleEN3WTF10PassRefPtrINS_22WebKitCSSKeyframesRuleEEE
+__ZNK7WebCore22WebKitCSSKeyframesRule4nameEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEN
+__ZN7WebCore10HTMLParser24noscriptCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore18NamedMappedAttrMapD0Ev
+__ZN7WebCore12NamedNodeMapD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE6shrinkEm
+__ZN7WebCore15MappedAttributeD0Ev
+__ZN7WebCoreL16audioConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore11MediaPlayer11isAvailableEv
+__ZN7WebCoreL21installedMediaEnginesEv
+__ZN7WebCore18MediaPlayerPrivate19registerMediaEngineEPFvPFPNS_27MediaPlayerPrivateInterfaceEPNS_11MediaPlayerEEPFvRN3WTF7HashS
+__ZN7WebCore18MediaPlayerPrivate11isAvailableEv
+__ZL12QTKitLibraryv
+__ZN7WebCoreL14addMediaEngineEPFPNS_27MediaPlayerPrivateInterfaceEPNS_11MediaPlayerEEPFvRN3WTF7HashSetINS_6StringENS_10StringHa
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE15reserveCapacityEm
+__ZN7WebCore16HTMLAudioElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLAudioElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLMediaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8Document38registerForDocumentActivationCallbacksEPNS_7ElementE
+__ZN3WTF7HashSetIPN7WebCore7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableE
+__ZN7WebCore8Document31registerForMediaVolumeCallbacksEPNS_7ElementE
+__ZN7WebCore16HTMLMediaElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore16HTMLMediaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLAudioElement11tagPriorityEv
+__ZN7WebCore16HTMLMediaElement20insertedIntoDocumentEv
+__ZNK7WebCore16HTMLMediaElement3srcEv
+__ZN7WebCore16HTMLMediaElement12scheduleLoadEv
+__ZN7WebCore16HTMLMediaElement6attachEv
+__ZN7WebCore14RenderThemeMac28extraMediaControlsStyleSheetEv
+__ZN7WebCoreL20mediaControllerThemeEv
+__ZN7WebCore16HTMLMediaElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore16HTMLMediaElement8controlsEv
+__ZN7WebCore16CSSStyleSelector17mapNinePieceImageEPNS_8CSSValueERNS_14NinePieceImageE
+__ZNK7WebCore8CSSValue12isImageValueEv
+__ZNK7WebCore22CSSImageGeneratorValue21isImageGeneratorValueEv
+__ZN7WebCore22CSSImageGeneratorValue14generatedImageEv
+__ZNK7WebCore22CSSImageGeneratorValue11isFixedSizeEv
+__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEt
+__ZN7WebCore16StyleCachedImage9addClientEPNS_12RenderObjectE
+__ZN7WebCore11RenderLayer16createReflectionEv
+__ZN7WebCore13RenderReplicaC1EPNS_4NodeE
+__ZN7WebCore13RenderReplicaC2EPNS_4NodeE
+__ZN7WebCore11RenderLayer21updateReflectionStyleEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE6shrinkEm
+__ZN7WebCore18StyleTransformDataC1ERKS0_
+__ZN7WebCore18StyleTransformDataC2ERKS0_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEaSERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14shrinkCapacityEm
+__ZN7WebCore19StyleGeneratedImage9addClientEPNS_12RenderObjectE
+__ZN7WebCore22CSSImageGeneratorValue9addClientEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS1_7IntSizeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS1_7IntSizeEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHas
+__ZNK7WebCore13RenderReplica13requiresLayerEv
+__ZNK7WebCore11RenderLayer15reflectionLayerEv
+__ZNK7WebCore9RenderBox13overflowWidthEb
+__ZNK7WebCore9RenderBox14overflowHeightEb
+__ZNK7WebCore11RenderStyle14applyTransformERNS_20TransformationMatrixERKNS_7IntSizeENS0_20ApplyTransformOriginE
+__ZNK7WebCore27TranslateTransformOperation16getOperationTypeEv
+__ZNK7WebCore23ScaleTransformOperation16getOperationTypeEv
+__ZN7WebCore20TransformationMatrix11translate3dEddd
+__ZNK7WebCore27TranslateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZNK7WebCore23ScaleTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix7scale3dEddd
+__ZN7WebCore20TransformationMatrix8multLeftERKS0_
+__ZN7WebCore20TransformationMatrix10makeAffineEv
+__ZNK7WebCore9RenderBox12overflowRectEb
+__ZNK7WebCore20TransformationMatrix7mapRectERKNS_7IntRectE
+__ZNK7WebCore20TransformationMatrix7mapRectERKNS_9FloatRectE
+__ZNK7WebCore20TransformationMatrix7mapQuadERKNS_9FloatQuadE
+__ZNK7WebCore20TransformationMatrix8mapPointERKNS_10FloatPointE
+__ZNK7WebCore20TransformationMatrix13multVecMatrixEddRdS1_
+__ZNK7WebCore9RenderBox13reflectedRectERKNS_7IntRectE
+__ZNK7WebCore9RenderBox16reflectionOffsetEv
+__ZNK7WebCore12RenderObject22outlineStyleForRepaintEv
+__ZNK7WebCore12RenderObject25getTransformFromContainerEPKS0_RKNS_7IntSizeERNS_20TransformationMatrixE
+__ZN7WebCore20TransformationMatrix9translateEdd
+__ZNK7WebCore11RenderLayer16currentTransformEv
+__ZN7WebCore14TransformState14applyTransformERKNS_20TransformationMatrixENS0_21TransformAccumulationE
+__ZN7WebCore14TransformState20flattenWithTransformERKNS_20TransformationMatrixE
+__ZN7WebCore12RenderObject26repaintAfterLayoutIfNeededEPNS_20RenderBoxModelObjectERKNS_7IntRectES5_
+__ZNK7WebCore12RenderObject29mustRepaintBackgroundOrBorderEv
+__ZN7WebCoreL21mustRepaintFillLayersEPKNS_12RenderObjectEPKNS_9FillLayerE
+__ZN7WebCore12RenderObject29markContainingBlocksForLayoutEbPS0_
+__ZN7WebCoreL16videoConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLVideoElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLVideoElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLVideoElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLVideoElement11tagPriorityEv
+__ZN7WebCore16HTMLVideoElement6attachEv
+__ZN7WebCore16HTMLVideoElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLVideoElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderVideoC1EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderVideoC2EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMediaC2EPNS_16HTMLMediaElementE
+__ZN7WebCore14RenderReplacedC2EPNS_4NodeE
+__ZN7WebCore11RenderMedia14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore11RenderMedia15virtualChildrenEv
+__ZN7WebCore11RenderVideo17updateFromElementEv
+__ZN7WebCore11RenderMedia17updateFromElementEv
+__ZN7WebCore11RenderMedia14updateControlsEv
+__ZNK7WebCore11RenderMedia12mediaElementEv
+__ZN7WebCore11RenderVideo12updatePlayerEv
+__ZNK7WebCore11RenderMedia6playerEv
+__ZN7WebCore16HTMLMediaElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore14RenderReplaced15canHaveChildrenEv
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_20CachedResourceHandleINS1_14CachedResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE6shrinkEm
+__ZN7WebCore5TimerINS_12CachedScriptEE5firedEv
+__ZN7WebCore12CachedScript29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore12CachedScript18destroyDecodedDataEv
+__ZNK7WebCore14CachedResource21isSafeToMakePurgeableEv
+__ZN7WebCore16HTMLMediaElement11recalcStyleENS_4Node11StyleChangeE
+__ZNK7WebCore9FillLayer13containsImageEPNS_10StyleImageE
+__ZNK7WebCore16StyleCachedImage4dataEv
+__ZNK7WebCore18StyleTransformDataeqERKS0_
+__ZNK7WebCore27TranslateTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore27TranslateTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZNK7WebCore23ScaleTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore23ScaleTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore27TranslateTransformOperationD0Ev
+__ZN7WebCore23ScaleTransformOperationD0Ev
+__ZN7WebCore11RenderBlock29removePercentHeightDescendantEPNS_9RenderBoxE
+__ZNK7WebCore11RenderImage22usesImageContainerSizeEv
+__ZNK7WebCore11CachedImage22usesImageContainerSizeEv
+__ZNK7WebCore11RenderImage20calcAspectRatioWidthEv
+__ZNK7WebCore11RenderImage22imageHasRelativeHeightEv
+__ZNK7WebCore11CachedImage22imageHasRelativeHeightEv
+__ZNK7WebCore11RenderImage21calcAspectRatioHeightEv
+__ZN7WebCore9RenderBox20calcPercentageHeightERKNS_6LengthE
+__ZNK7WebCore9RenderBox13reflectionBoxEv
+__ZN7WebCore11RenderLayer10setStaticYEi
+__ZN7WebCore11RenderBlock19calcBlockPrefWidthsEv
+__ZN7WebCore11RenderVideo6layoutEv
+__ZN7WebCore11RenderMedia6layoutEv
+__ZNK7WebCore14RenderReplaced21minimumReplacedHeightEv
+__ZNK7WebCore11RenderVideo17calcReplacedWidthEb
+__ZNK7WebCore11RenderVideo16isWidthSpecifiedEv
+__ZN7WebCore11RenderVideo14calcPrefWidthsEv
+__ZNK7WebCore11RenderVideo18calcReplacedHeightEv
+__ZNK7WebCore11RenderVideo17isHeightSpecifiedEv
+__ZNK7WebCore11RenderMedia17rightmostPositionEbb
+__ZNK7WebCore11RenderMedia14lowestPositionEbb
+__ZN7WebCore13RenderReplica6layoutEv
+__ZN7WebCore14RenderReplaced29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore14RenderReplaced12overflowRectEb
+__ZNK7WebCore14RenderReplaced18localSelectionRectEb
+__ZN7WebCore5TimerINS_16HTMLMediaElementEE5firedEv
+__ZN7WebCore16HTMLMediaElement14loadTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement12loadInternalEv
+__ZN7WebCore16HTMLMediaElement18stopPeriodicTimersEv
+__ZN7WebCore16HTMLMediaElement31cancelPendingEventsAndCallbacksEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14shrinkCapacityEm
+__ZNK7WebCore16HTMLMediaElement19defaultPlaybackRateEv
+__ZN7WebCore16HTMLMediaElement15setPlaybackRateEf
+__ZN7WebCore16HTMLMediaElement19selectMediaResourceEv
+__ZN7WebCore16HTMLMediaElement21scheduleProgressEventERKNS_12AtomicStringE
+__ZN7WebCore13ProgressEventC1ERKNS_12AtomicStringEbjj
+__ZN7WebCore13ProgressEventC2ERKNS_12AtomicStringEbjj
+__ZN7WebCore16HTMLMediaElement12enqueueEventEN3WTF6RefPtrINS_5EventEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE15reserveCapacityEm
+__ZN7WebCore11ContentTypeC1ERKNS_6StringE
+__ZN7WebCore11ContentTypeC2ERKNS_6StringE
+__ZN7WebCore16HTMLMediaElement15isSafeToLoadURLERKNS_4KURLENS0_19InvalidSourceActionE
+__ZN7WebCore16HTMLMediaElement12loadResourceERKNS_4KURLERNS_11ContentTypeE
+__ZN7WebCore16HTMLMediaElement23startProgressEventTimerEv
+__ZN7WebCore11MediaPlayerC1EPNS_17MediaPlayerClientE
+__ZN7WebCore11MediaPlayerC2EPNS_17MediaPlayerClientE
+__ZN7WebCoreL21createNullMediaPlayerEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement12updateVolumeEv
+__ZN7WebCore11MediaPlayer9setVolumeEf
+__ZN7WebCore22NullMediaPlayerPrivate9setVolumeEf
+__ZN7WebCore11MediaPlayer4loadERKNS_6StringERKNS_11ContentTypeE
+__ZNK7WebCore11ContentType4typeEv
+__ZNK7WebCore11ContentType9parameterERKNS_6StringE
+__ZN7WebCore16MIMETypeRegistry18getMIMETypeForPathERKNS_6StringE
+__ZN7WebCore10StringImpl11reverseFindEti
+__ZN7WebCore16MIMETypeRegistry23getMIMETypeForExtensionERKNS_6StringE
+__ZN7WebCoreL32chooseBestEngineForTypeAndCodecsERKNS_6StringES2_
+__ZN7WebCore18MediaPlayerPrivate12supportsTypeERKNS_6StringES3_
+__ZN7WebCoreL20mimeModernTypesCacheEv
+__ZL11initQTMoviev
+__ZN7WebCoreL19addFileTypesToCacheEP7NSArrayRN3WTF7HashSetINS_6StringENS_10StringHashENS2_10HashTraitsIS4_EEEE
+__ZN7WebCore22NullMediaPlayerPrivateD0Ev
+__ZN7WebCore18MediaPlayerPrivate6createEPNS_11MediaPlayerE
+__ZN7WebCore18MediaPlayerPrivateC1EPNS_11MediaPlayerE
+__ZN7WebCore18MediaPlayerPrivateC2EPNS_11MediaPlayerE
+-[WebCoreMovieObserver initWithCallback:]
+__ZN7WebCore18MediaPlayerPrivate4loadERKNS_6StringE
+__ZN7WebCore11MediaPlayer19networkStateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore11MediaPlayer12networkStateEv
+__ZNK7WebCore18MediaPlayerPrivate12networkStateEv
+__ZN7WebCore16HTMLMediaElement15setNetworkStateENS_11MediaPlayer12NetworkStateE
+__ZN7WebCore18MediaPlayerPrivate10cancelSeekEv
+-[WebCoreMovieObserver setDelayCallbacks:]
+__ZN7WebCore18MediaPlayerPrivate13createQTMovieERKNS_6StringE
+__ZL32initQTMovieApertureModeAttributev
+__ZL28initQTMovieApertureModeCleanv
+__ZL41initQTMovieAskUnresolvedDataRefsAttributev
+__ZL40initQTSecurityPolicyNoCrossSiteAttributev
+__ZL43initQTMoviePreventExternalURLLinksAttributev
+__ZL23initQTMovieURLAttributev
+__ZL15QTMovieFunctionv
+__ZNK7WebCore11MediaPlayer6volumeEv
+__ZL41initQTMovieLoadStateDidChangeNotificationv
+__ZL36initQTMovieRateDidChangeNotificationv
+__ZL36initQTMovieSizeDidChangeNotificationv
+__ZL36initQTMovieTimeDidChangeNotificationv
+__ZL29initQTMovieDidEndNotificationv
+-[WebCoreMovieObserver loadStateChanged:]
+__ZNK7WebCore11RenderVideo8videoBoxEv
+__ZN7WebCore11MediaPlayer7setSizeERKNS_7IntSizeE
+__ZN7WebCore22NullMediaPlayerPrivate7setSizeERKNS_7IntSizeE
+__ZN7WebCore11MediaPlayer10setVisibleEb
+__ZN7WebCore22NullMediaPlayerPrivate10setVisibleEb
+__ZL36QTMovieApertureModeAttributeFunctionv
+__ZL32QTMovieApertureModeCleanFunctionv
+__ZL45QTMovieAskUnresolvedDataRefsAttributeFunctionv
+__ZL44QTSecurityPolicyNoCrossSiteAttributeFunctionv
+__ZL47QTMoviePreventExternalURLLinksAttributeFunctionv
+__ZL27QTMovieURLAttributeFunctionv
+__ZL45QTMovieLoadStateDidChangeNotificationFunctionv
+__ZL40QTMovieRateDidChangeNotificationFunctionv
+__ZL40QTMovieSizeDidChangeNotificationFunctionv
+__ZL40QTMovieTimeDidChangeNotificationFunctionv
+__ZL33QTMovieDidEndNotificationFunctionv
+__ZN7WebCore18MediaPlayerPrivate7setSizeERKNS_7IntSizeE
+__ZN7WebCore18MediaPlayerPrivate10setVisibleEb
+__ZNK7WebCore20TransformationMatrix12isInvertibleEv
+__ZN7WebCoreL14determinant4x4ERA4_A4_Kd
+__ZN7WebCoreL14determinant3x3Eddddddddd
+__ZN7WebCoreL14determinant2x2Edddd
+__ZN7WebCore11RenderLayer23beginTransparencyLayersEPNS_15GraphicsContextEPKS0_
+__ZN7WebCore11RenderLayer27transparentPaintingAncestorEv
+__ZN7WebCore15GraphicsContext9concatCTMERKNS_20TransformationMatrixE
+__ZNK7WebCore20TransformationMatrixcv17CGAffineTransformEv
+__ZNK7WebCore20TransformationMatrix7inverseEv
+__ZN7WebCoreL7inverseERA4_A4_KdRA4_A4_d
+__ZN7WebCoreL19transparencyClipBoxERKNS_20TransformationMatrixEPKNS_11RenderLayerES5_
+__ZN7WebCore9RenderBox12maskClipRectEv
+__ZN7WebCore15GraphicsContext22beginTransparencyLayerEf
+__ZN7WebCore13RenderReplica5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox9paintMaskERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore9RenderBox15borderFitAdjustERiS1_
+__ZN7WebCore9RenderBox15paintMaskImagesERKNS_12RenderObject9PaintInfoEiiiiii
+__ZNK7WebCore10StyleImage8isLoadedEv
+__ZNK7WebCore10StyleImage9canRenderEf
+__ZN7WebCore19StyleGeneratedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore19StyleGeneratedImage9imageSizeEPKNS_12RenderObjectEf
+__ZNK7WebCore19StyleGeneratedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore16CSSGradientValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore22CSSImageGeneratorValue8getImageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectENS1_7IntSizeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3getERKS3_
+__ZN7WebCore22CSSImageGeneratorValue12removeClientEPNS_12RenderObjectE
+__ZN3WTF7HashMapIN7WebCore7IntSizeEjNS_7IntHashIS2_EENS_10HashTraitsIS2_EENS5_IjEEE3addERKS2_RKj
+__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTr
+__ZNK3WTF7HashMapIN7WebCore7IntSizeENS_6RefPtrINS1_5ImageEEENS_7IntHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3getERKS2_
+__ZN7WebCore16CSSGradientValue14createGradientEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore16CSSGradientValue12resolvePointEPNS_17CSSPrimitiveValueES2_RKNS_7IntSizeEf
+__ZN7WebCore8GradientC1ERKNS_10FloatPointES3_
+__ZN7WebCore8GradientC2ERKNS_10FloatPointES3_
+__ZN7WebCore16CSSGradientValue17sortStopsIfNeededEv
+__ZNSt17_Temporary_bufferIPN7WebCore20CSSGradientColorStopES1_EC1ES2_S2_
+__ZNSt17_Temporary_bufferIPN7WebCore20CSSGradientColorStopES1_EC2ES2_S2_
+__ZSt22__get_temporary_bufferIN7WebCore20CSSGradientColorStopEESt4pairIPT_lElS4_
+__ZSt26__uninitialized_fill_n_auxIPN7WebCore20CSSGradientColorStopElS1_EvT_T0_RKT1_St12__false_type
+__ZSt22__stable_sort_adaptiveIPN7WebCore20CSSGradientColorStopES2_lPFbRKS1_S4_EEvT_S7_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPN7WebCore20CSSGradientColorStopES2_PFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt22__chunk_insertion_sortIPN7WebCore20CSSGradientColorStopElPFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt16__insertion_sortIPN7WebCore20CSSGradientColorStopEPFbRKS1_S4_EEvT_S7_T0_
+__ZN7WebCoreL12compareStopsERKNS_20CSSGradientColorStopES2_
+__ZSt25__unguarded_linear_insertIPN7WebCore20CSSGradientColorStopES1_PFbRKS1_S4_EEvT_T0_T1_
+__ZSt16__merge_adaptiveIPN7WebCore20CSSGradientColorStopElS2_PFbRKS1_S4_EEvT_S7_S7_T0_S8_T1_S8_T2_
+__ZSt16__merge_backwardIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
+__ZSt23return_temporary_bufferIN7WebCore20CSSGradientColorStopEEvPT_
+__ZN7WebCore8Gradient12addColorStopEfRKNS_5ColorE
+__ZNK7WebCore5Color7getRGBAERfS1_S1_S1_
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE15reserveCapacityEm
+__ZN7WebCore8Gradient15platformDestroyEv
+__ZN7WebCore22CSSImageGeneratorValue8putImageERKNS_7IntSizeEN3WTF10PassRefPtrINS_5ImageEEE
+__ZN3WTF7HashMapIN7WebCore7IntSizeENS_6RefPtrINS1_5ImageEEENS_7IntHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3addERKS2_RKS5_
+__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectES5_NS1_8TileRuleES6_NS_17CompositeOperatorE
+__ZN7WebCore14GeneratedImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext9translateEff
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERNS_9GeneratorE
+__ZN7WebCore8Gradient4fillEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZN7WebCore8Gradient16platformGradientEv
+__ZNK7WebCore10FloatPointcv7CGPointEv
+__ZN7WebCoreL16gradientCallbackEPvPKdPd
+__ZNK7WebCore8Gradient8getColorEfPfS1_S1_S1_
+__ZNK7WebCore8Gradient8findStopEf
+__ZN7WebCore15GraphicsContext20endTransparencyLayerEv
+__ZN7WebCore9RenderBox12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore9RenderBox25repaintLayerRectsForImageEPvPKNS_9FillLayerEb
+__ZNK7WebCore16StyleCachedImage9canRenderEf
+__ZN7WebCore20RenderBoxModelObject32calculateBackgroundImageGeometryEPKNS_9FillLayerEiiiiRNS_7IntRectERNS_8IntPointERNS_7IntSiz
+__ZNK7WebCore20RenderBoxModelObject23calculateBackgroundSizeEPKNS_9FillLayerEii
+__ZN7WebCore16StyleCachedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZN7WebCore11CachedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZN7WebCore5Image16setContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore16StyleCachedImage9imageSizeEPKNS_12RenderObjectEf
+__ZN7WebCore12RenderObject12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore14ResourceHandle15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore14ResourceLoader15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore27protocolHostAndPortAreEqualERKNS_4KURLES2_
+__ZN7WebCore23SubresourceLoaderClient15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore18MediaPlayerPrivate16loadStateChangedEv
+__ZN7WebCore18MediaPlayerPrivate12updateStatesEv
+__ZL29initQTMovieLoadStateAttributev
+__ZNK7WebCore18MediaPlayerPrivate7seekingEv
+__ZL33QTMovieLoadStateAttributeFunctionv
+__ZN7WebCore16HTMLMediaElement20asyncEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore13ProgressEventD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE6shrinkEm
+__ZNK7WebCore11RenderMedia7isMediaEv
+__ZN7WebCore11RenderMedia12forwardEventEPNS_5EventE
+__ZNK7WebCore5Image17usesContainerSizeEv
+__ZNK7WebCore9RenderBox18calcReplacedHeightEv
+__ZNK7WebCore5Image17hasRelativeHeightEv
+__ZNK7WebCore9RenderBox17calcReplacedWidthEb
+__ZN7WebCore14PreloadScannerD1Ev
+__ZN7WebCore14PreloadScannerD2Ev
+__ZN7WebCore4KURL11setProtocolERKNS_6StringE
+__ZN7WebCore4KURL7setHostERKNS_6StringE
+__ZN7WebCore4KURL7setPathERKNS_6StringE
+__ZN7WebCore28encodeWithURLEscapeSequencesERKNS_6StringE
+__ZNK7WebCore6String4utf8Ev
+__ZN7WebCore10IconLoader6createEPNS_5FrameE
+__ZN7WebCore10IconLoaderC1EPNS_5FrameE
+__ZN7WebCore10IconLoaderC2EPNS_5FrameE
+__ZN7WebCore10IconLoader12startLoadingEv
+__ZN7WebCore20jsNavigatorUserAgentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator9userAgentEv
+__ZNK7WebCore11FrameLoader9userAgentERKNS_4KURLE
+__ZN7WebCoreL29createHTMLAudioElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLAudioElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLMediaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLMediaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLAudioElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLAudioElementEEE
+__ZN7WebCore18JSHTMLAudioElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLAudioElementEEE
+__ZN7WebCore18JSHTMLMediaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLMediaElementEEE
+__ZN7WebCoreL29createHTMLVideoElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLVideoElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLVideoElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLVideoElementEEE
+__ZN7WebCore18JSHTMLVideoElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLVideoElementEEE
+__ZN7WebCore18JSHTMLAudioElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLMediaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLMediaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSNodePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsNodePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLAudioElement9classInfoEv
+__ZN7WebCore6JSNode16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore4Node22scriptExecutionContextEv
+__ZN7WebCore19toJSDOMGlobalObjectEPNS_22ScriptExecutionContextE
+__ZN7WebCore13toJSDOMWindowEPNS_5FrameE
+__ZN7WebCore47jsDocumentPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8NodeListE
+__ZN7WebCore10JSNodeList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSNodeListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8NodeListEEE
+__ZN7WebCore10JSNodeListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8NodeListEEE
+__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsNodeListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore10JSNodeList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLMediaElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionLoadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLMediaElement4loadERi
+__ZN7WebCore11MediaPlayer15totalBytesKnownEv
+__ZNK7WebCore18MediaPlayerPrivate15totalBytesKnownEv
+__ZNK7WebCore18MediaPlayerPrivate10totalBytesEv
+__ZN7WebCore11MediaPlayer11bytesLoadedEv
+__ZNK7WebCore18MediaPlayerPrivate11bytesLoadedEv
+__ZNK7WebCore18MediaPlayerPrivate8durationEv
+__ZN7WebCore11MediaPlayer10totalBytesEv
+__ZN7WebCore4Node21dispatchProgressEventERKNS_12AtomicStringEbjj
+__ZNK7WebCore16HTMLMediaElement18potentiallyPlayingEv
+__ZNK7WebCore16HTMLMediaElement6pausedEv
+__ZN7WebCore11MediaPlayer5pauseEv
+__ZN7WebCore18MediaPlayerPrivate5pauseEv
+__ZN7WebCore11MediaPlayer4seekEf
+__ZN7WebCore18MediaPlayerPrivate4seekEf
+__ZN7WebCore11MediaPlayerD0Ev
+__ZN7WebCore18MediaPlayerPrivateD0Ev
+__ZN7WebCore18MediaPlayerPrivate22tearDownVideoRenderingEv
+__ZN7WebCore18MediaPlayerPrivate22destroyQTVideoRendererEv
+-[WebCoreMovieObserver disconnect]
+__ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
+__ZN7WebCore18JSHTMLVideoElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLVideoElement9classInfoEv
+__ZN7WebCore21jsDocumentStyleSheetsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document11styleSheetsEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14StyleSheetListE
+__ZN7WebCore16JSStyleSheetList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSStyleSheetListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14StyleSheetListEEE
+__ZN7WebCore16JSStyleSheetListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14StyleSheetListEEE
+__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10StyleSheetE
+__ZN7WebCore15JSCSSStyleSheet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSStyleSheetPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSStyleSheet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCSSStyleSheetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSStyleSheetEEE
+__ZN7WebCore15JSCSSStyleSheetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSStyleSheetEEE
+__ZN7WebCore12JSStyleSheetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10StyleSheetEEE
+__ZN7WebCore15JSCSSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsCSSStyleSheetRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13CSSStyleSheet8cssRulesEb
+__ZN7WebCore11CSSRuleListC1EPNS_9StyleListEb
+__ZN7WebCore11CSSRuleListC2EPNS_9StyleListEb
+__ZN7WebCore7CSSRule6isRuleEv
+__ZN7WebCore9StyleBase13isCharsetRuleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11CSSRuleListE
+__ZN7WebCore13JSCSSRuleList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSCSSRuleListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11CSSRuleListEEE
+__ZN7WebCore13JSCSSRuleListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11CSSRuleListEEE
+__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsCSSRuleListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11CSSRuleList6lengthEv
+__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore13JSCSSRuleList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11CSSRuleList4itemEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CSSRuleE
+__ZNK7WebCore12CSSStyleRule4typeEv
+__ZN7WebCore14JSCSSStyleRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSCSSRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCSSRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSStyleRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSStyleRuleEEE
+__ZN7WebCore14JSCSSStyleRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSStyleRuleEEE
+__ZN7WebCore9JSCSSRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CSSRuleEEE
+__ZN7WebCore14JSCSSStyleRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSCSSRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsCSSRuleCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12CSSStyleRule7cssTextEv
+__ZNK7WebCore12CSSStyleRule12selectorTextEv
+__ZNK7WebCore11CSSSelector12selectorTextEv
+__ZNK7WebCore26CSSMutableStyleDeclaration7cssTextEv
+__ZNK7WebCore11CSSProperty7cssTextEv
+__Z15getPropertyName13CSSPropertyID
+__ZNK7WebCore15CSSInitialValue7cssTextEv
+__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_6StringE
+__ZNK7WebCore9FontValue7cssTextEv
+__ZNK7WebCore12CSSValueList7cssTextEv
+__ZNK7WebCore15FontFamilyValue7cssTextEv
+__ZN7WebCore10StringImpl7replaceEtPS0_
+__ZN7WebCore27jsDOMWindowImageConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPN3JSC9ExecStateE
+__ZNK7WebCore11JSDOMWindow5imageEPN3JSC9ExecStateE
+__ZNK3WTF7HashMapIPKN3JSC9ClassInfoEPNS1_8JSObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore18JSImageConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore18JSImageConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSHTMLImageElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLImageElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3WTF7HashMapIPKN3JSC9ClassInfoEPNS1_8JSObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_PNS1_8JSObjectEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTrai
+__ZN7WebCore18JSImageConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL14constructImageEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore18JSImageConstructor8documentEv
+__ZN7WebCoreL29createHTMLImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLImageElementEEE
+__ZN7WebCore18JSHTMLImageElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLImageElementEEE
+__ZN7WebCore18JSHTMLImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLImageElement9classInfoEv
+__ZN7WebCore18JSHTMLImageElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLImageElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement6setSrcERKNS_6StringE
+__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringERi
+__ZNK7WebCore13StyledElement18createAttributeMapEv
+__ZN7WebCore13StyledElement15createAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE15reserveCapacityEm
+__ZNK7WebCore14CachedResource9isExpiredEv
+__ZNK7WebCore20ResourceResponseBase27parseCacheControlDirectivesEv
+__ZN7WebCoreL16parseCacheHeaderERKNS_6StringERN3WTF6VectorISt4pairIS0_S0_ELm0EEE
+__ZNK7WebCore6String16removeCharactersEPFbtE
+__ZN7WebCore10StringImpl16removeCharactersEPFbtE
+__ZN7WebCoreL18isControlCharacterEt
+__ZN7WebCore10StringImpl4findEPFbtEi
+__ZN7WebCoreL22isCacheHeaderSeparatorEt
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE6shrinkEm
+__ZN7WebCore7Element25dispatchAttrAdditionEventEPNS_9AttributeE
+__ZNK7WebCore15CSSReflectValue7cssTextEv
+__ZNK7WebCore19CSSBorderImageValue7cssTextEv
+__ZNK7WebCore16CSSGradientValue7cssTextEv
+__ZNK7WebCore22WebKitCSSKeyframesRule4typeEv
+__ZN7WebCore24JSWebKitCSSKeyframesRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSWebKitCSSKeyframesRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22WebKitCSSKeyframesRuleEEE
+__ZN7WebCore24JSWebKitCSSKeyframesRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22WebKitCSSKeyframesRuleEEE
+__ZN7WebCore24JSWebKitCSSKeyframesRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22WebKitCSSKeyframesRule7cssTextEv
+__ZNK7WebCore21WebKitCSSKeyframeRule7cssTextEv
+__ZNK7WebCore23WebKitCSSTransformValue7cssTextEv
+__ZN7WebCoreL19quoteStringIfNeededERKNS_6StringE
+__ZN7WebCore11LayoutStatenwEmPNS_11RenderArenaE
+__ZN7WebCore11LayoutStateC1EPS0_PNS_9RenderBoxERKNS_7IntSizeE
+__ZN7WebCore11LayoutStateC2EPS0_PNS_9RenderBoxERKNS_7IntSizeE
+__ZN7WebCore9InlineBox14dirtyLineBoxesEv
+__ZN7WebCore11RenderBlock20determineEndPositionEPNS_13RootInlineBoxERNS_14InlineIteratorERNS_10BidiStatusERi
+__ZN7WebCore13InlineFlowBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore9InlineBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore9InlineBoxD0Ev
+__ZN7WebCore13RootInlineBox29removeLineBoxFromRenderObjectEv
+__ZN7WebCore17RenderLineBoxList13removeLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13RootInlineBox8Overflow7destroyEPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBox8OverflowdlEPvm
+__ZN7WebCore11LayoutState7destroyEPNS_11RenderArenaE
+__ZN7WebCore11LayoutStatedlEPvm
+__ZN7WebCore9ClipRects7destroyEPNS_11RenderArenaE
+__ZN7WebCore9ClipRectsdlEPvm
+__ZN7WebCore11ImageSource20frameDurationAtIndexEm
+__ZN7WebCore10IconLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZN7WebCore10IconLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore10IconLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZNK7WebCore14ResourceHandle7requestEv
+__ZN7WebCore10IconLoader13finishLoadingERKNS_4KURLEN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZNK7WebCore13PageURLRecord8snapshotEb
+__ZN3WTF7HashMapIN7WebCore6StringENS1_15PageURLSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore12IconDatabase24scheduleOrDeferSyncTimerEv
+__ZN7WebCore12IconDatabase21setIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_6StringE
+__ZNK7WebCore12SharedBuffer4copyEv
+__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_29HashTableConstIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtract
+__ZNK7WebCore10IconRecord8snapshotEb
+__ZN3WTF7HashMapIN7WebCore6StringENS1_12IconSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN7WebCore10IconLoader17clearLoadingStateEv
+__ZN7WebCore12SharedBufferD1Ev
+__ZN7WebCore12SharedBufferD2Ev
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11EventTargetE
+__ZN7WebCore11EventTarget20toSVGElementInstanceEv
+__ZN7WebCore18MediaPlayerPrivate24disableUnsupportedTracksEv
+__ZL20initQTMediaTypeVideov
+__ZL20initQTMediaTypeSoundv
+__ZL19initQTMediaTypeTextv
+__ZL19initQTMediaTypeBasev
+__ZL19initQTMediaTypeMPEGv
+__ZL29initQTTrackMediaTypeAttributev
+__ZN7WebCore11MediaPlayer15inMediaDocumentEv
+__ZN7WebCore18MediaPlayerPrivate15cacheMovieScaleEv
+__ZL31initQTMovieNaturalSizeAttributev
+__ZNK7WebCore18MediaPlayerPrivate11currentTimeEv
+__ZNK7WebCore18MediaPlayerPrivate13maxTimeLoadedEv
+__ZN7WebCore11MediaPlayer17readyStateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore11MediaPlayer10readyStateEv
+__ZNK7WebCore18MediaPlayerPrivate10readyStateEv
+__ZN7WebCore16HTMLMediaElement13setReadyStateENS_11MediaPlayer10ReadyStateE
+__ZN7WebCore16HTMLMediaElement13scheduleEventERKNS_12AtomicStringE
+__ZN7WebCore11RenderVideo16videoSizeChangedEv
+__ZN7WebCore11MediaPlayer11naturalSizeEv
+__ZNK7WebCore18MediaPlayerPrivate11naturalSizeEv
+__ZL35QTMovieNaturalSizeAttributeFunctionv
+__ZN7WebCore18MediaPlayerPrivate6doSeekEv
+__ZNK7WebCore18MediaPlayerPrivate12createQTTimeEf
+__ZL29initQTMovieTimeScaleAttributev
+__ZL14initQTMakeTimexl
+__ZN7WebCore16HTMLMediaElement15updatePlayStateEv
+__ZNK7WebCore11MediaPlayer6pausedEv
+__ZNK7WebCore18MediaPlayerPrivate6pausedEv
+__ZNK7WebCore11MediaPlayer7visibleEv
+__ZN7WebCore18MediaPlayerPrivate19setUpVideoRenderingEv
+__ZN7WebCoreL20QTVideoRendererClassEv
+__ZN7WebCore18MediaPlayerPrivate21createQTVideoRendererEv
+__ZL58initQTVideoRendererWebKitOnlyNewImageAvailableNotificationv
+-[WebCoreMovieObserver timeChanged:]
+__ZN7WebCore18MediaPlayerPrivate11timeChangedEv
+__ZNK7WebCore16HTMLMediaElement8autoplayEv
+__ZNK7WebCore16HTMLVideoElement7isVideoEv
+__ZN7WebCore16HTMLVideoElement17updatePosterImageEv
+__ZNK7WebCore16HTMLVideoElement6posterEv
+__ZL28initQTMovieDataSizeAttributev
+__ZL32QTMovieDataSizeAttributeFunctionv
+__ZN7WebCore11MediaPlayer11timeChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
+__ZNK7WebCore16HTMLMediaElement11currentTimeEv
+__ZNK7WebCore11MediaPlayer11currentTimeEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
+__ZNK7WebCore11MediaPlayer8durationEv
+__ZN7WebCore16HTMLMediaElement23progressEventTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore13ProgressEvent15isProgressEventEv
+__ZNK7WebCore5Event29isXMLHttpRequestProgressEventEv
+__ZN7WebCore15JSProgressEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13ProgressEventEEE
+__ZN7WebCore15JSProgressEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13ProgressEventEEE
+__ZNK7WebCore10RenderText16linesBoundingBoxEv
+__ZNK7WebCore8Position14inRenderedTextEv
+__ZNK7WebCore13InlineTextBox19containsCaretOffsetEi
+__ZNK7WebCore13InlineTextBox14caretMinOffsetEv
+__ZNK7WebCore13InlineTextBox14caretMaxOffsetEv
+__ZNK7WebCore10RenderText14caretMinOffsetEv
+-[WebCoreMovieObserver newImageAvailable:]
+-[WebCoreMovieObserver repaint]
+__ZN7WebCore18MediaPlayerPrivate7repaintEv
+__ZN7WebCore11MediaPlayer7repaintEv
+__ZThn112_N7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
+__ZN7WebCore12EventHandler10mouseMovedEP7NSEvent
+__ZN7WebCoreL12currentEventEv
+__ZN7WebCore18PlatformMouseEventC1EP7NSEvent
+__ZN7WebCore18PlatformMouseEventC2EP7NSEvent
+__ZN7WebCore13pointForEventEP7NSEvent
+__ZN7WebCore8IntPointC1ERK7CGPoint
+__ZN7WebCore8IntPointC2ERK7CGPoint
+__ZN7WebCore19globalPointForEventEP7NSEvent
+__ZN7WebCore11globalPointERK7CGPointP8NSWindow
+__ZN7WebCore15screenForWindowEP8NSWindow
+__ZN7WebCore15flipScreenPointERK7CGPointP8NSScreen
+__ZN7WebCore12EventHandler10mouseMovedERKNS_18PlatformMouseEventE
+__ZN7WebCore13HitTestResultC1ERKNS_8IntPointE
+__ZN7WebCore13HitTestResultC2ERKNS_8IntPointE
+__ZN7WebCore12EventHandler20handleMouseMoveEventERKNS_18PlatformMouseEventEPNS_13HitTestResultE
+__ZN7WebCore12EventHandler17prepareMouseEventERKNS_14HitTestRequestERKNS_18PlatformMouseEventE
+__ZN7WebCoreL27documentPointForWindowPointEPNS_5FrameERKNS_8IntPointE
+__ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
+__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_8IntPointE
 __ZNK7WebCore8IntPointcv7CGPointEv
-__ZN7WebCore20executeInsertNewlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore11targetFrameEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor13canEditRichlyEv
-__ZNK7WebCore4Node23isContentRichlyEditableEv
-__ZNK7WebCore17RenderTextControl8isEditedEv
-__ZN7WebCore22HTMLGenericFormElement8onChangeEv
-__ZN7WebCore17RenderTextControl9setEditedEb
-__ZN7WebCore15HTMLFormElement11submitClickEPNS_5EventE
-__ZNK7WebCore16HTMLInputElement24isSuccessfulSubmitButtonEv
-__ZN7WebCore15EventTargetNode22dispatchSimulatedClickEN3WTF10PassRefPtrINS_5EventEEEbb
-__ZN7WebCore15EventTargetNode27dispatchSimulatedMouseEventERKNS_12AtomicStringEN3WTF10PassRefPtrINS_5EventEEE
-__ZNK7WebCore10MouseEvent12isMouseEventEv
-__ZN7WebCore21JSMouseEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSMouseEventC1EPN3KJS8JSObjectEPNS_10MouseEventE
-__ZN7WebCore12JSMouseEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore7JSEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore7JSEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createTableRowWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore30JSHTMLTableRowElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLTableRowElementC1EPN3KJS8JSObjectEPNS_19HTMLTableRowElementE
-__ZN7WebCore21JSHTMLTableRowElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25createTableSectionWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore34JSHTMLTableSectionElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLTableSectionElementC1EPN3KJS8JSObjectEPNS_23HTMLTableSectionElementE
-__ZN7WebCore25JSHTMLTableSectionElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17createHtmlWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLHtmlElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHtmlElementC1EPN3KJS8JSObjectEPNS_15HTMLHtmlElementE
-__ZN7WebCore17JSHTMLHtmlElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore22JSHTMLTableCellElement9classInfoEv
-__ZN7WebCore30JSHTMLTableRowElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSHTMLTableRowElement9classInfoEv
-__ZN7WebCore34JSHTMLTableSectionElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSHTMLTableSectionElement9classInfoEv
-__ZN7WebCore27JSHTMLTableElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLTableElement9classInfoEv
-__ZNK7WebCore17JSHTMLHtmlElement9classInfoEv
-__ZNK7WebCore7UIEvent9isUIEventEv
-__ZN7WebCore15HTMLFormElement13prepareSubmitEPNS_5EventE
-__ZNK7WebCore12AtomicStringcvN3KJS7UStringEEv
-__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLSelectElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLSelectElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLInputElement7setTypeERKNS_6StringE
-__ZN7WebCore22HTMLGenericFormElement7setNameERKNS_12AtomicStringE
-__ZN7WebCore15HTMLFormElement6submitEPNS_5EventEb
-__ZN7WebCore11FrameLoader23clearRecordedFormValuesEv
-__ZNK7WebCore16HTMLInputElement17isActivatedSubmitEv
-__ZN7WebCore11FrameLoader15recordFormValueERKNS_6StringES3_N3WTF10PassRefPtrINS_15HTMLFormElementEEE
-__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3getERKS2_
-__ZNK7WebCore22HTMLGenericFormElement17isActivatedSubmitEv
-__ZNK7WebCore22HTMLGenericFormElement24isSuccessfulSubmitButtonEv
-__ZNK7WebCore15HTMLFormElement8formDataEPKc
-__ZN7WebCore17DeprecatedCStringC2EPKc
-__ZNK7WebCore15HTMLFormElement12dataEncodingEv
-__ZNK7WebCore15HTMLFormElement12isMailtoFormEv
-__ZN7WebCore12FormDataListC2ERKNS_12TextEncodingE
-__ZN7WebCore16HTMLInputElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore12FormDataList12appendStringERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore16FormDataListItemELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore16FormDataListItemELm0EE15reserveCapacityEm
-__ZNK7WebCore17DeprecatedCString7isEmptyEv
-__ZN7WebCoreeqERKNS_7CStringES2_
-__ZN7WebCore13encodeCStringERKNS_7CStringE
-__ZNK7WebCore17DeprecatedCString8containsEcb
-__ZN7WebCore17DeprecatedCStringC2Ei
-__ZN7WebCore17DeprecatedCString8truncateEj
-__ZN7WebCore17DeprecatedCString6appendEPKc
-__ZN7WebCore9ArrayImpl6detachEv
-__ZN3WTF6VectorIN7WebCore16FormDataListItemELm0EE6shrinkEm
-__ZN7WebCore17DeprecatedCString6appendEc
-__ZN7WebCore8FormData10appendDataEPKvm
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIcLm0EEC2ERKS1_
-__ZN7WebCore11FrameLoader10submitFormEPKcRKNS_6StringEN3WTF10PassRefPtrINS_8FormDataEEES5_S5_S5_PNS_5EventE
-__ZN7WebCore19ResourceRequestBaseC2ERKNS_4KURLENS_26ResourceRequestCachePolicyE
-__ZNK7WebCore8FormData15flattenToStringEv
-__ZNK7WebCore8FormData7flattenERN3WTF6VectorIcLm0EEE
-__ZN7WebCore19ResourceRequestBase6setURLERKNS_4KURLE
-__ZN7WebCore11FrameLoader10submitFormERKNS_16FrameLoadRequestEPNS_5EventE
-__ZNK7WebCore9FrameTree4findERKNS_12AtomicStringE
-__ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
-__ZN7WebCore11FrameLoader4loadERKNS_16FrameLoadRequestEbbPNS_5EventEPNS_15HTMLFormElementERKN3WTF7HashMapINS_6StringESA_NS_10StringHashENS8_10HashTraitsISA_EESD_EE
-__ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
-__ZNK7WebCore11FrameLoader21shouldAllowNavigationEPNS_5FrameE
-__ZN7WebCore9FormState6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEERKNS1_7HashMapINS_6StringES6_NS_10StringHashENS1_10HashTraitsIS6_EES9_EENS2_INS_5FrameEEE
-__ZN7WebCore9FormStateC1EN3WTF10PassRefPtrINS_15HTMLFormElementEEERKNS1_7HashMapINS_6StringES6_NS_10StringHashENS1_10HashTraitsIS6_EES9_EENS2_INS_5FrameEEE
+__ZN7WebCore8Document17prepareMouseEventERKNS_14HitTestRequestERKNS_8IntPointERKNS_18PlatformMouseEventE
+__ZNK7WebCore8Document10renderViewEv
+__ZN7WebCore11RenderLayer7hitTestERKNS_14HitTestRequestERNS_13HitTestResultE
+__ZN7WebCore11RenderLayer12hitTestLayerEPS0_S1_RKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointEbPKNS_24H
+__ZN7WebCore11RenderLayer35update3DTransformedDescendantStatusEv
+__ZN7WebCoreL14isHitCandidateEPKNS_11RenderLayerEbPdPKNS_24HitTestingTransformStateE
+__ZN7WebCore13HitTestResultD1Ev
+__ZN7WebCore13HitTestResultD2Ev
+__ZNK7WebCore11RenderLayer15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointENS_13HitTest
+__ZN7WebCore12RenderObject7hitTestERKNS_14HitTestRequestERNS_13HitTestResultERKNS_8IntPointEiiNS_13HitTestFilterE
+__ZN7WebCore11RenderBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore11RenderBlock15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore29DeprecatedPtrListImplIterator6toLastEv
+__ZN7WebCore29DeprecatedPtrListImplIteratormmEv
+__ZN7WebCore11RenderBlock24isPointInOverflowControlERNS_13HitTestResultEiiii
+__ZN7WebCore11RenderBlock19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore13HitTestResult12setInnerNodeEPNS_4NodeE
+__ZN7WebCore13HitTestResult21setInnerNonSharedNodeEPNS_4NodeE
+__ZN7WebCore13HitTestResultaSERKS0_
+__ZN7WebCore11RenderLayer22updateHoverActiveStateERKNS_14HitTestRequestERNS_13HitTestResultE
+__ZN7WebCore8Document12setHoverNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore13ContainerNode9setActiveEbb
+__ZN7WebCore13ContainerNode10setHoveredEb
+__ZNK7WebCore11RenderBlock13hoverAncestorEv
+__ZN7WebCore28MouseEventWithHitTestResultsC1ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
+__ZN7WebCore28MouseEventWithHitTestResultsC2ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
+__ZN7WebCore13HitTestResultC1ERKS0_
+__ZN7WebCore13HitTestResultC2ERKS0_
+__ZN7WebCore10ScrollView19scrollbarUnderMouseERKNS_18PlatformMouseEventE
+__ZNK7WebCore28MouseEventWithHitTestResults9scrollbarEv
+__ZN7WebCoreL24subframeForHitTestResultERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler12selectCursorERKNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
+__ZNK7WebCore28MouseEventWithHitTestResults10targetNodeEv
+__ZNK7WebCore28MouseEventWithHitTestResults10isOverLinkEv
+__ZNK7WebCore11RenderLayer22isPointInResizeControlERKNS_8IntPointE
+__ZN7WebCore13pointerCursorEv
+__ZN7WebCore6CursorC1EP8NSCursor
+__ZN7WebCore6CursorC2EP8NSCursor
+__ZN7WebCore6CursorC1ERKS0_
+__ZN7WebCore6CursorC2ERKS0_
+__ZN7WebCore6Widget9setCursorERKNS_6CursorE
+__ZN7WebCore6CursorD1Ev
+__ZN7WebCore6CursorD2Ev
+__ZN7WebCore12EventHandler18dispatchMouseEventERKNS_12AtomicStringEPNS_4NodeEbiRKNS_18PlatformMouseEventEb
+__ZN7WebCore9FrameView25resetDeferredRepaintDelayEv
+__ZN7WebCore12EventHandler26updateMouseEventTargetNodeEPNS_4NodeERKNS_18PlatformMouseEventEb
+__ZN7WebCore4Node18dispatchMouseEventERKNS_18PlatformMouseEventERKNS_12AtomicStringEiPS0_
+__ZN7WebCore4Node18dispatchMouseEventERKNS_12AtomicStringEiiiiiibbbbbPS0_N3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9C
+__ZN7WebCore10MouseEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9C
+__ZN7WebCore17MouseRelatedEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbb
+__ZN7WebCoreL9contentsXEPNS_9DOMWindowE
+__ZN7WebCoreL9contentsYEPNS_9DOMWindowE
+__ZN7WebCore17MouseRelatedEvent15initCoordinatesEv
+__ZN7WebCore17MouseRelatedEvent19computePageLocationEv
 __ZNK7WebCore17MouseRelatedEvent5pageYEv
 __ZNK7WebCore17MouseRelatedEvent5pageXEv
-__ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEb
--[DOMDocument URL]
-__ZNK7WebCore16DeprecatedString11getNSStringEv
-+[DOMHTMLElement(WebCoreInternal) _wrapHTMLElement:]
--[WebCoreFrameBridge elementWithName:inForm:]
-__ZNK7WebCore6Chrome5focusEv
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE6shrinkEm
-__ZN7WebCore10RenderPart12deleteWidgetEv
-__ZN7WebCore11RenderLayer23hitTestOverflowControlsERNS_13HitTestResultE
-__ZN7WebCore16HTMLTitleElement7setTextERKNS_6StringE
-__ZN7WebCore13ContainerNode12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Ri
-__ZN7WebCore4Node17checkReplaceChildEPS0_S1_Ri
-__ZN7WebCore4Node15canReplaceChildEPS0_S1_
-__ZN7WebCore14RenderTableRow27absoluteClippedOverflowRectEv
-__ZN7WebCore15HTMLFormElement19removedFromDocumentEv
-__ZN7WebCore31jsElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node13supportsFocusEv
-__ZNK7WebCore11HTMLElement11isFocusableEv
-__ZN7WebCore19createIFrameWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLIFrameElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLIFrameElementC1EPN3KJS8JSObjectEPNS_17HTMLIFrameElementE
-__ZN7WebCore19JSHTMLIFrameElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLIFrameElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLIFrameElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore21HTMLFrameOwnerElement13contentWindowEv
-__ZN7WebCore35jsNodePrototypeFunctionReplaceChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore6JSNode12replaceChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore16HTMLStyleElement19removedFromDocumentEv
-__ZN7WebCore12StyleElement19removedFromDocumentEPNS_8DocumentE
-__ZN7WebCore12CSSMediaRuleD1Ev
-__ZN7WebCore11CSSRuleListD2Ev
-__ZN7WebCore10MediaQueryD2Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore13MediaQueryExpELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore13KeyboardEventD1Ev
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE6shrinkEm
-__ZN7WebCore13HitTestResult13setURLElementEPNS_7ElementE
-__ZN7WebCore17HTMLAnchorElement9setActiveEbb
-__ZN7WebCore10handCursorEv
-__ZN7WebCore15leakNamedCursorEPKcii
-__ZN7WebCore17HTMLAnchorElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore13HitTestResult11targetFrameEv
-__ZNK7WebCore17HTMLAnchorElement6targetEv
-_urlByRemovingFragment
+__ZN7WebCore17MouseRelatedEvent14receivedTargetEv
+__ZNK7WebCore12RenderObject15absoluteToLocalENS_10FloatPointEbb
+__ZNK7WebCore9RenderBox23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZNK7WebCore10RenderView23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore10MouseEventD0Ev
+__ZN7WebCore7UIEventD2Ev
+__ZN7WebCore12EventHandler23handleMouseDraggedEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler10handleDragERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore13HitTestResult22setToNonShadowAncestorEv
+__ZN7WebCore6Chrome23mouseDidMoveOverElementERKNS_13HitTestResultEj
+__ZNK7WebCore13HitTestResult15absoluteLinkURLEv
+__ZN7WebCore19InspectorController23mouseDidMoveOverElementERKNS_13HitTestResultEj
+__ZN7WebCore6Chrome10setToolTipERKNS_13HitTestResultE
+__ZNK7WebCore13HitTestResult15spellingToolTipEv
+__ZN7WebCore8Document21markerContainingPointERKNS_8IntPointENS_14DocumentMarker10MarkerTypeE
+__ZNK7WebCore13HitTestResult5titleEv
+__ZNK7WebCore17RenderLineBoxList7hitTestEPNS_20RenderBoxModelObjectERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestA
+__ZN7WebCore13RootInlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore13InlineFlowBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore9InlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore11RenderImage11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore9RenderBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZL33QTTrackMediaTypeAttributeFunctionv
+__ZL33QTMovieTimeScaleAttributeFunctionv
+__ZNK7WebCore16HTMLMediaElement7isVideoEv
+__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionPlayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLMediaElement4playEv
+__ZN7WebCore16HTMLMediaElement12playInternalEv
+__ZNK7WebCore16HTMLMediaElement13endedPlaybackEv
+__ZNK7WebCore16HTMLMediaElement18stoppedDueToErrorsEv
+__ZNK7WebCore16HTMLMediaElement24pausedForUserInteractionEv
+__ZN7WebCore11MediaPlayer7setRateEf
+__ZN7WebCore18MediaPlayerPrivate7setRateEf
+__ZN7WebCore11MediaPlayer4playEv
+__ZN7WebCore18MediaPlayerPrivate4playEv
+__ZNK7WebCore11MediaPlayer4rateEv
+__ZN7WebCore16HTMLMediaElement26startPlaybackProgressTimerEv
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraits
+__ZN7WebCore14jsDocumentBodyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL28createHTMLBodyElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLBodyElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLBodyElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBodyElementEEE
+__ZN7WebCore17JSHTMLBodyElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBodyElementEEE
+__ZN7WebCore17JSHTMLBodyElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore13JSHTMLElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLElementClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setClassNameERKNS_6StringE
+__ZN7WebCore17NodeListsNodeData38invalidateCachesThatDependOnAttributesEv
+__ZNK7WebCore17NodeListsNodeData7isEmptyEv
+__ZN7WebCore12RenderObject16setStyleInternalEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore11RenderStyle16accessAnimationsEv
+__ZN7WebCore9Animation6createEv
+__ZN7WebCore9AnimationC1Ev
+__ZN7WebCore9AnimationC2Ev
+__ZN7WebCore13AnimationList6appendEN3WTF10PassRefPtrINS_9AnimationEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE15reserveCapacityEm
+__ZN7WebCore16CSSStyleSelector17mapAnimationDelayEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector20mapAnimationDurationEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector16mapAnimationNameEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore13AnimationList19fillUnsetPropertiesEv
+__ZN7WebCore26AnimationControllerPrivate24accessCompositeAnimationEPNS_12RenderObjectE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectENS_6RefPtrINS1_18CompositeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS_6RefPtrINS1_18CompositeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_E
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS_6RefPtrINS1_18CompositeAnimationEEEENS_18PairFirstExtractorIS8_EENS_7
+__ZN7WebCore18CompositeAnimation7animateEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN7WebCore18CompositeAnimation24updateKeyframeAnimationsEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14shrinkCapacityEm
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_17KeyframeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_I
+__ZN7WebCore17KeyframeAnimationC1EPKNS_9AnimationEPNS_12RenderObjectEiPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore17KeyframeAnimationC2EPKNS_9AnimationEPNS_12RenderObjectEiPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore13AnimationBaseC2EPKNS_9AnimationEPNS_12RenderObjectEPNS_18CompositeAnimationE
+__ZN7WebCore12KeyframeList6insertEfN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE15reserveCapacityEm
+__ZN7WebCore16CSSStyleSelector26keyframeStylesForAnimationEPNS_7ElementEPKNS_11RenderStyleERNS_12KeyframeListE
+__ZN7WebCore12KeyframeList5clearEv
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE6shrinkEm
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E5clearEv
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E15deallocateTableEPii
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorI
+__ZNK7WebCore22WebKitCSSKeyframesRule6lengthEv
+__ZNK7WebCore22WebKitCSSKeyframesRule4itemEj
+__ZN7WebCore21WebKitCSSKeyframeRule14isKeyframeRuleEv
+__ZN7WebCore11RenderStyle5cloneEPKS0_
+__ZN7WebCore11RenderStyleC1ERKS0_
+__ZN7WebCore11RenderStyleC2ERKS0_
+__ZN7WebCore16CSSStyleSelector25createTransformOperationsEPNS_8CSSValueEPNS_11RenderStyleERNS_19TransformOperationsE
+__ZN7WebCoreL25getTransformOperationTypeENS_23WebKitCSSTransformValue22TransformOperationTypeE
+__ZN7WebCore16CSSStyleSelector26mapAnimationTimingFunctionEPNS_9AnimationEPNS_8CSSValueE
+__ZN3WTF7HashSetIiNS_7IntHashIjEENS_10HashTraitsIiEEE3addERKi
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E6expandEv
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E6rehashEi
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E13allocateTableEi
+__ZN7WebCore21WebKitCSSKeyframeRule14parseKeyStringERKNS_6StringERN3WTF6VectorIfLm0EEE
+__ZN3WTF6VectorIfLm0EE14shrinkCapacityEm
+__ZNK7WebCore6String7toFloatEPb
+__ZN7WebCore10StringImpl7toFloatEPb
+__ZN7WebCore17charactersToFloatEPKtmPb
+__ZN3WTF6VectorIfLm0EE14expandCapacityEmPKf
+__ZN3WTF6VectorIfLm0EE14expandCapacityEm
+__ZN3WTF6VectorIfLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIfLm0EE6shrinkEm
+__ZN7WebCore17KeyframeAnimation29validateTransformFunctionListEv
+__ZNK3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E8containsIiNS_22IdentityHashTranslatorIii
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_17KeyframeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE15reserveCapacityEm
+__ZN7WebCore18CompositeAnimation17updateTransitionsEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN7WebCore17KeyframeAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPKNS_11RenderStyleEPS5_RN3WTF6RefPtrIS5_EE
+__ZN7WebCore13AnimationBase27fireAnimationEventsIfNeededEv
+__ZN7WebCore13AnimationBase18updateStateMachineENS0_14AnimStateInputEd
+__ZNK7WebCore13AnimationBase24beginAnimationUpdateTimeEv
+__ZN7WebCore18CompositeAnimation25cleanupFinishedAnimationsEv
+__ZNK7WebCore18CompositeAnimation17timeToNextServiceEv
+__ZN7WebCore17KeyframeAnimation17timeToNextServiceEv
+__ZN7WebCore13AnimationBase17timeToNextServiceEv
+__ZN7WebCoreL15convertToLengthEPNS_17CSSPrimitiveValueEPNS_11RenderStyleEdPb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE6shrinkEm
+__ZN7WebCore9AnimationD1Ev
+__ZN7WebCore9AnimationD2Ev
+-[WebCoreMovieObserver rateChanged:]
+__ZN7WebCore18MediaPlayerPrivate11rateChangedEv
+__ZN7WebCore11MediaPlayer11rateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerRateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerRateChangedEPNS_11MediaPlayerE
+__ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEbb
 __ZNK7WebCore13HitTestResult10isSelectedEv
 __ZN7WebCore19SelectionController8containsERKNS_8IntPointE
 __ZN7WebCore12EventHandler9mouseDownEP7NSEvent
 __ZN7WebCore12EventHandler21handleMousePressEventERKNS_18PlatformMouseEventE
 __ZN7WebCore8Document13setActiveNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore17HTMLAnchorElement11isFocusableEv
-__ZNK7WebCore17HTMLAnchorElement16isMouseFocusableEv
-__ZNK7WebCore17HTMLAnchorElement17canStartSelectionEv
+__ZNK7WebCore11HTMLElement11isFocusableEv
+__ZNK7WebCore4Node11isFocusableEv
+__ZNK7WebCore4Node16isMouseFocusableEv
+__ZNK7WebCore12EventHandler14mousePressNodeEv
+__ZNK7WebCore4Node17canStartSelectionEv
+__ZN7WebCore6Editor29markMisspellingsAndBadGrammarERKNS_16VisibleSelectionEbS3_
+__ZN7WebCore6Editor40markAllMisspellingsAndBadGrammarInRangesEbPNS_5RangeEbS2_b
+__ZN7WebCoreL29paragraphAlignedRangeForRangeEPNS_5RangeERiRNS_6StringE
+__ZNK7WebCore5Range10cloneRangeERi
+__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore8setStartEPNS_5RangeERKNS_15VisiblePositionE
+__ZN7WebCore24rangeCompliantEquivalentERKNS_15VisiblePositionE
+__ZN7WebCore6setEndEPNS_5RangeERKNS_15VisiblePositionE
+__ZNK7WebCore5Range14startContainerERi
+__ZN7WebCore9plainTextEPKNS_5RangeE
 __ZN7WebCore16HTMLInputElement17dispatchBlurEventEv
-__ZN7WebCore15EventTargetNode17dispatchBlurEventEv
+__ZN7WebCore12InputElement17dispatchBlurEventERNS_16InputElementDataEPNS_8DocumentE
+__ZThn128_NK7WebCore16HTMLInputElement11placeholderEv
+__ZNK7WebCore16HTMLInputElement11placeholderEv
+__ZN7WebCore5Frame22textFieldDidEndEditingEPNS_7ElementE
+__Z3kitPN7WebCore16HTMLInputElementE
+__ZN7WebCore4Node17dispatchBlurEventEv
+__ZN7WebCore11RenderLayer14scrollToOffsetEiibb
 __ZN7WebCore12EventHandler21handleMousePressEventERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler9dragStateEv
 __ZN7WebCore12EventHandler23canMouseDownStartSelectEPNS_4NodeE
-__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetERKNS_28MouseEventWithHitTestResultsE
+__ZNK7WebCore8Document13isSVGDocumentEv
 __ZN7WebCore12EventHandler17focusDocumentViewEv
 __ZN7WebCore12EventHandler32handleMousePressEventSingleClickERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore12RenderObject16shouldAutoscrollEv
+__ZNK7WebCore28MouseEventWithHitTestResults10localPointEv
+__ZN7WebCore11RenderBlock16positionForPointERKNS_8IntPointE
+__ZN7WebCore11RenderBlock34positionForPointWithInlineChildrenERKNS_8IntPointE
+__ZN7WebCore12RenderObject21createVisiblePositionEiNS_9EAffinityE
+__ZNK7WebCore10RenderText14previousOffsetEi
+__ZN7WebCore22cursorMovementIteratorEPKti
+__ZN7WebCore18textBreakPrecedingEPNS_17TextBreakIteratorEi
+__ZNK7WebCore8Position28atLastEditingPositionForNodeEv
+__ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionE
+__ZN7WebCore16VisibleSelectionC2ERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_16VisibleSelectionE
+__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_16VisibleSelectionES3_NS_9EAffinityEb
+__ZN7WebCore9RenderBox14localCaretRectEPNS_9InlineBoxEiPi
+__ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
+__ZN7WebCore11iBeamCursorEv
+__ZN7WebCore12EventHandler27eventLoopHandleMouseDraggedERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler24mouseDownViewIfStillGoodEv
+__ZNK7WebCore12EventHandler14allowDHTMLDragERbS1_
+__ZNK7WebCore10ScrollView16contentsToWindowERKNS_8IntPointE
+__ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
+__ZN7WebCore14DragController24delegateDragSourceActionERKNS_8IntPointE
+__ZNK7WebCore12RenderObject13draggableNodeEbbiiRb
+__ZNK7WebCore12EventHandler18shouldDragAutoNodeEPNS_4NodeERKNS_8IntPointE
+__ZN7WebCore12EventHandler16handleAutoscrollEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler21setAutoscrollRendererEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler20startAutoscrollTimerEv
+__ZN7WebCore12EventHandler27updateSelectionForMouseDragEPNS_4NodeERKNS_8IntPointE
+__ZN7WebCore12EventHandler24canMouseDragExtendSelectEPNS_4NodeE
+__ZN7WebCore16VisibleSelection9setExtentERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame20selectionGranularityEv
+__ZN7WebCore5TimerINS_12EventHandlerEE5firedEv
+__ZN7WebCore12EventHandler20autoscrollTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore9RenderBox10autoscrollEv
+__ZN7WebCore11RenderLayer10autoscrollEv
+__ZN7WebCore12EventHandler27updateSelectionForMouseDragEv
+__ZNK7WebCore12EventHandler20currentMousePositionEv
 __ZN7WebCore12EventHandler7mouseUpEP7NSEvent
 __ZN7WebCore12EventHandler23handleMouseReleaseEventERKNS_18PlatformMouseEventE
-__ZN7WebCore19JSHTMLIFrameElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLIFrameElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLIFrameElement6setSrcEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore20HTMLFrameElementBase6setSrcERKNS_6StringE
-__ZN7WebCore11FrameLoader15userGestureHintEv
-__ZNK7WebCore8KJSProxy21processingUserGestureEv
-__ZN3KJS6Window12currentEventEv
-__ZN7WebCore11FrameLoader22scheduleLocationChangeERKNS_6StringES3_bb
-__ZN7WebCore11FrameLoader19scheduleRedirectionEPNS_20ScheduledRedirectionE
-__ZN7WebCore11FrameLoader21startRedirectionTimerEv
-__ZN7WebCore11FrameLoader16clientRedirectedERKNS_4KURLEddbb
+__ZNK7WebCore7UIEvent9isUIEventEv
 __ZN7WebCore12EventHandler23handleMouseReleaseEventERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler19stopAutoscrollTimerEb
-__ZN7WebCore12EventHandler21setAutoscrollRendererEPNS_12RenderObjectE
+__ZN7WebCore9RenderBox14stopAutoscrollEv
 __ZN7WebCore12EventHandler13handleMouseUpERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler22eventLoopHandleMouseUpERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler24mouseDownViewIfStillGoodEv
 __ZNK7WebCore12EventHandler18eventActivatedViewERKNS_18PlatformMouseEventE
 __ZN7WebCore12EventHandler15invalidateClickEv
+__ZN7WebCore16HTMLMediaElement26playbackProgressTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement23scheduleTimeupdateEventEb
+__ZN7WebCore5TimerINS_26AnimationControllerPrivateEE5firedEv
+__ZN7WebCore26AnimationControllerPrivate19animationTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore13AnimationListeqERKS0_
+__ZNK7WebCore9Animation15animationsMatchEPKS0_b
+__ZN7WebCore26AnimationControllerPrivate27addToStyleAvailableWaitListEPNS_13AnimationBaseE
+__ZN7WebCore26AnimationControllerPrivate23addNodeChangeToDispatchEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE15reserveCapacityEm
+__ZN7WebCore26AnimationControllerPrivate34startUpdateStyleIfNeededDispatcherEv
+__ZNK7WebCore17KeyframeAnimation28getKeyframeAnimationIntervalERPKNS_11RenderStyleES4_Rd
+__ZNK7WebCore13AnimationBase14getElapsedTimeEv
+__ZNK7WebCore13AnimationBase8progressEddPKNS_14TimingFunctionE
+__ZN7WebCore13AnimationBase15blendPropertiesEPKS0_iPNS_11RenderStyleEPKS3_S6_d
+__ZN7WebCoreL17ensurePropertyMapEv
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE15reserveCapacityEm
+__ZN7WebCoreL22addShorthandPropertiesEv
+__ZN7WebCoreL18wrapperForPropertyEi
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEmPKS3_
+__ZN7WebCoreL18addPropertyWrapperEiPNS_19PropertyWrapperBaseE
+__ZNK7WebCore15PropertyWrapperIRKNS_19TransformOperationsEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZNK7WebCore11RenderStyle9transformEv
+__ZN7WebCore23ScaleTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore11RenderStyle12setTransformERKNS_19TransformOperationsE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EEC2ERKS5_
+__ZNK7WebCore15PropertyWrapperIfE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZNK7WebCore11RenderStyle7opacityEv
+__ZN7WebCore11RenderStyle10setOpacityEf
+__ZN7WebCore11RenderLayer27repaintIncludingDescendantsEv
+__ZN7WebCore20TransformationMatrix5blendERKS0_d
+__ZNK7WebCore20TransformationMatrix9decomposeERNS0_14DecomposedTypeE
+__ZN7WebCoreL8v3LengthEPd
+__ZN7WebCoreL7v3ScaleEPdd
+__ZN7WebCoreL5v3DotEPKdS1_
+__ZN7WebCoreL9v3CombineEPKdS1_Pddd
+__ZN7WebCore20TransformationMatrix9recomposeERKNS0_14DecomposedTypeE
+__ZN7WebCore17KeyframeAnimation18overrideAnimationsEv
+__ZN7WebCore18CompositeAnimation26overrideImplicitAnimationsEi
+__ZN7WebCore17KeyframeAnimation16onAnimationStartEd
+__ZN7WebCore17KeyframeAnimation18sendAnimationEventERKNS_12AtomicStringEd
+__ZNK7WebCore17KeyframeAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
+__ZN7WebCore26AnimationControllerPrivate18addEventToDispatchEN3WTF10PassRefPtrINS_7ElementEEERKNS_12AtomicStringERKNS_6StringEd
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE15reserveCapacityEm
+__ZNK7WebCore13AnimationBase10overriddenEv
+__ZN7WebCore17KeyframeAnimation14startAnimationEd
+__ZN7WebCore26AnimationControllerPrivate30addToStartTimeResponseWaitListEPNS_13AnimationBaseEb
+__ZN7WebCore13AnimationBase26goIntoEndingOrLoopingStateEv
+__ZNK7WebCore13AnimationBase18getTimeToNextEventERdRb
+__ZN7WebCore9FrameView11forceLayoutEb
+__ZNK7WebCore26Matrix3DTransformOperation16getOperationTypeEv
+__ZNK7WebCore26Matrix3DTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore26AnimationControllerPrivate34updateStyleIfNeededDispatcherFiredEPNS_5TimerIS0_EE
+__ZN7WebCore4Node28dispatchWebKitAnimationEventERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore20WebKitAnimationEventC1ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore20WebKitAnimationEventC2ERKNS_12AtomicStringERKNS_6StringEd
+__ZNK7WebCore20WebKitAnimationEvent22isWebKitAnimationEventEv
+__ZN7WebCore22JSWebKitAnimationEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSWebKitAnimationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20WebKitAnimationEventEEE
+__ZN7WebCore22JSWebKitAnimationEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20WebKitAnimationEventEEE
+__ZN7WebCore22JSWebKitAnimationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsWebKitAnimationEventAnimationNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20WebKitAnimationEvent13animationNameEv
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE6shrinkEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE6shrinkEm
+__ZNK7WebCore26Matrix3DTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore26Matrix3DTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore26Matrix3DTransformOperationD0Ev
+__ZNK7WebCore16StyleCachedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectERKNS_8IntPointERKNS_7IntSizeENS_17CompositeOperatorE
+__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectERKNS_10FloatPointERKNS_9FloatSizeENS_17CompositeOperatorE
+__ZN7WebCore20TransformationMatrix15scaleNonUniformEdd
+__ZNK7WebCore9FloatRect8containsERKS0_
+__ZNK7WebCore11HistoryItem5titleEv
+__ZN7WebCore24StringWrapperCFAllocatorL22deallocateOnMainThreadEPv
+__ZNK7WebCore24RotateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix8rotate3dEdddd
+__ZNK7WebCore13ResourceErrorcvP7NSErrorEv
+__ZN7WebCore13InlineTextBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore10RenderText13removeTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore5TimerINS_12IconDatabaseEE5firedEv
+__ZN7WebCore12IconDatabase14syncTimerFiredEPNS_5TimerIS0_EE
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE15reserveCapacityEm
+__ZN7WebCore12IconDatabase30writeIconSnapshotToSQLDatabaseERKNS_12IconSnapshotE
+__ZN7WebCore12IconDatabase34getIconIDForIconURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatement9bindInt64Eix
+__ZN7WebCore14SQLiteDatabase15lastInsertRowIDEv
+__ZN7WebCore15SQLiteStatement8bindBlobEiPKvi
+__ZN7WebCore12IconDatabase33setIconURLForPageURLInSQLDatabaseERKNS_6StringES3_
+__ZN7WebCore15SQLiteStatement9isExpiredEv
+__ZN7WebCore15SQLiteStatement14getColumnInt64Ei
+__ZN7WebCore12IconDatabase32setIconIDForPageURLInSQLDatabaseExRKNS_6StringE
+__ZN7WebCore12IconDatabase24checkForDanglingPageURLsEb
+__ZN7WebCore15SQLiteStatement23returnsAtLeastOneResultEv
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE6shrinkEm
+__ZN7WebCore12IconDatabase20pruneUnretainedIconsEv
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore17KeyframeAnimation14onAnimationEndEd
+__ZN7WebCore17KeyframeAnimation12endAnimationEb
+__ZN7WebCore13AnimationBase19setNeedsStyleRecalcEPNS_4NodeE
+__ZN7WebCore17KeyframeAnimation26resumeOverriddenAnimationsEv
+__ZN7WebCore18CompositeAnimation34resumeOverriddenImplicitAnimationsEi
+__ZN7WebCore17KeyframeAnimationD0Ev
+__ZN7WebCore12KeyframeListD1Ev
+__ZN7WebCore12KeyframeListD2Ev
+__ZN7WebCore13AnimationBaseD2Ev
+__ZN7WebCore26AnimationControllerPrivate32removeFromStyleAvailableWaitListEPNS_13AnimationBaseE
+__ZN7WebCore26AnimationControllerPrivate35removeFromStartTimeResponseWaitListEPNS_13AnimationBaseE
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE6shrinkEm
+__ZN7WebCore24RotateTransformOperationD0Ev
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE6shrinkEm
+__ZN7WebCore11RenderVideo13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11MediaPlayer5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore18MediaPlayerPrivate5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext5scaleERKNS_9FloatSizeE
+__ZN7WebCore15GraphicsContext28setImageInterpolationQualityENS_20InterpolationQualityE
+__ZN7WebCore11RenderLayer19removeOnlyThisLayerEv
+__ZN7WebCore11RenderLayer11removeChildEPS0_
+__ZN7WebCore11RenderLayer28dirtyVisibleDescendantStatusEv
+__ZSt21__inplace_stable_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore12RenderObject19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore11RenderImage8imageMapEv
+__ZNK7WebCore16HTMLImageElement6useMapEv
+__ZNK7WebCore8Document11getImageMapERKNS_6StringE
+-[DOMNode(DOMNodeExtensions) boundingBox]
+__ZN7WebCore12RenderObject23absoluteBoundingBoxRectEb
+__ZN7WebCore9RenderBox13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+-[DOMNode parentNode]
+__ZN7WebCore11RenderBlock13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+__Z4coreP11DOMDocument
+__ZN7WebCore25HistoryPropertyListWriterC2Ev
+__ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
+__ZN7WebCore28BinaryPropertyListSerializerC1ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore28BinaryPropertyListSerializerC2ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore22BinaryPropertyListPlanC1ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore22BinaryPropertyListPlanC2ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore25HistoryPropertyListWriter12writeObjectsERNS_30BinaryPropertyListObjectStreamE
+__ZN7WebCore22BinaryPropertyListPlan20writeDictionaryStartEv
+__ZN7WebCore22BinaryPropertyListPlan11writeStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEmNS1_10StringHashENS_10HashTraitsIS2_EENS4_ImEEE3addERKS2_RKm
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_mENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZN7WebCore22BinaryPropertyListPlan17writeStringObjectERKNS_6StringE
+__ZN7WebCoreL25markerPlusLengthByteCountEm
+__ZN7WebCore22BinaryPropertyListPlan12writeIntegerEi
+__ZN3WTF7HashMapIimNS_7IntHashIjEENS_10HashTraitsIiEENS3_ImEEE3addERKiRKm
+__ZN3WTF9HashTableIiSt4pairIimENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_ImEEEES9_
+__ZN7WebCore22BinaryPropertyListPlan15writeArrayStartEv
+__ZN7WebCore25HistoryPropertyListWriter16writeHistoryItemERNS_30BinaryPropertyListObjectStreamEPNS_11HistoryItemE
+__ZNK7WebCore11HistoryItem14alternateTitleEv
+__ZNK7WebCore11HistoryItem12redirectURLsEv
+__ZN7WebCore22BinaryPropertyListPlan17writeUniqueStringERKNS_6StringE
+__ZN7WebCore22BinaryPropertyListPlan17writeUniqueStringEPKc
+__ZN7WebCore22BinaryPropertyListPlan17writeStringObjectEPKc
+__ZN7WebCore22BinaryPropertyListPlan17writeIntegerArrayEPKim
+__ZN3WTF7HashMapIN7WebCore12IntegerArrayEmNS1_16IntegerArrayHashENS1_22IntegerArrayHashTraitsENS_10HashTraitsImEEE3addERKS2_RKm
+__ZN3WTF9HashTableIN7WebCore12IntegerArrayESt4pairIS2_mENS_18PairFirstExtractorIS4_EENS1_16IntegerArrayHashENS_14PairHashTraits
+__ZN7WebCore16IntegerArrayHash4hashERKNS_12IntegerArrayE
+__ZN7WebCore22BinaryPropertyListPlan16writeArrayObjectEm
+__ZN7WebCore22BinaryPropertyListPlan18writeDictionaryEndEm
+__ZN7WebCore22BinaryPropertyListPlan21writeDictionaryObjectEm
+__ZN7WebCore16IntegerArrayHash5equalERKNS_12IntegerArrayES3_
+__ZN7WebCore22BinaryPropertyListPlan16writeBooleanTrueEv
+__ZN7WebCore22BinaryPropertyListPlan13writeArrayEndEm
+__ZN7WebCoreL11bytesNeededEm
+__ZN7WebCore25HistoryPropertyListWriter6bufferEm
+__ZN7WebCore28BinaryPropertyListSerializer20writeDictionaryStartEv
+__ZN7WebCore28BinaryPropertyListSerializer11writeStringERKNS_6StringE
+__ZNK7WebCore22BinaryPropertyListPlan21stringObjectReferenceERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEmNS1_10StringHashENS_10HashTraitsIS2_EENS4_ImEEE3getERKS2_
+__ZN7WebCore28BinaryPropertyListSerializer18appendStringObjectERKNS_6StringE
+__ZN7WebCore28BinaryPropertyListSerializer11startObjectEv
+__ZN7WebCore28BinaryPropertyListSerializer13appendIntegerEm
+__ZN7WebCore28BinaryPropertyListSerializer27addAggregateObjectReferenceEm
+__ZN7WebCore28BinaryPropertyListSerializer12writeIntegerEi
+__ZNK7WebCore22BinaryPropertyListPlan22integerObjectReferenceEi
+__ZNK3WTF7HashMapIimNS_7IntHashIjEENS_10HashTraitsIiEENS3_ImEEE3getERKi
+__ZN7WebCore28BinaryPropertyListSerializer19appendIntegerObjectEi
+__ZN7WebCore28BinaryPropertyListSerializer15writeArrayStartEv
+__ZN7WebCore28BinaryPropertyListSerializer17writeUniqueStringERKNS_6StringE
+__ZN7WebCore28BinaryPropertyListSerializer17writeUniqueStringEPKc
+__ZN7WebCore28BinaryPropertyListSerializer18appendStringObjectEPKc
+__ZN7WebCore28BinaryPropertyListSerializer17writeIntegerArrayEPKim
+__ZNK7WebCore22BinaryPropertyListPlan27integerArrayObjectReferenceEPKim
+__ZNK3WTF7HashMapIN7WebCore12IntegerArrayEmNS1_16IntegerArrayHashENS1_22IntegerArrayHashTraitsENS_10HashTraitsImEEE3getERKS2_
+__ZN7WebCore28BinaryPropertyListSerializer24appendIntegerArrayObjectEPKim
+__ZN7WebCore28BinaryPropertyListSerializer21appendObjectReferenceEm
+__ZN7WebCore28BinaryPropertyListSerializer18writeDictionaryEndEm
+__ZN7WebCoreL19moveAndReverseBytesEPhPKhm
+__ZN7WebCore28BinaryPropertyListSerializer16writeBooleanTrueEv
+__ZNK7WebCore22BinaryPropertyListPlan26booleanTrueObjectReferenceEv
+__ZN7WebCore28BinaryPropertyListSerializer13writeArrayEndEm
+__ZN7WebCore25HistoryPropertyListWriter11releaseDataEv
+__ZN7WebCore13InlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore12RenderInline19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore13HitTestResult13setURLElementEPNS_7ElementE
+__ZNK7WebCore12RenderObject19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore12RenderInline13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+-[WebCoreMovieObserver didEnd:]
+__ZN7WebCore18MediaPlayerPrivate6didEndEv
+__ZNK7WebCore16HTMLMediaElement4loopEv
+__ZN7WebCore10TimeRanges3addEff
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE15reserveCapacityEm
+-[DOMHTMLElement idName]
+__ZNK7WebCore11HTMLElement2idEv
+-[DOMHTMLElement className]
+__ZNK7WebCore11HTMLElement9classNameEv
+-[DOMElement tagName]
+__ZNK7WebCore11HTMLElement8nodeNameEv
+__ZNK7WebCore6String5upperEv
+__ZN7WebCore10StringImpl5upperEv
+-[DOMNode firstChild]
+-[DOMNode nextSibling]
+-[DOMNode previousSibling]
+__ZN7WebCore14JSHTMLDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21setJSDocumentLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSDocument11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK7WebCore16ScriptController21processingUserGestureEv
+__ZNK7WebCore16ScriptController26processingUserGestureEventEv
+__ZNK7WebCore16ScriptController28isJavaScriptAnchorNavigationEv
+__ZNK7WebCore16ScriptController30anyPageIsProcessingUserGestureEv
+__ZN7WebCore11FrameLoader22scheduleLocationChangeERKNS_6StringES3_bbb
+__ZN7WebCore11FrameLoader19scheduleRedirectionEPNS_20ScheduledRedirectionE
+__ZN7WebCore11FrameLoader21startRedirectionTimerEv
+__ZNK7WebCore9TimerBase16nextFireIntervalEv
+__ZN7WebCore11FrameLoader16clientRedirectedERKNS_4KURLEddb
 __ZN7WebCore5TimerINS_11FrameLoaderEE5firedEv
 __ZN7WebCore11FrameLoader21redirectionTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11FrameLoader14changeLocationERKNS_6StringES3_bb
-__ZN7WebCore11FrameLoader14changeLocationERKNS_4KURLERKNS_6StringEbb
+__ZN7WebCore11FrameLoader14changeLocationERKNS_4KURLERKNS_6StringEbbbb
 __ZN7WebCore11FrameLoader22executeIfJavaScriptURLERKNS_4KURLEbb
-__ZN7WebCore11FrameLoader11urlSelectedERKNS_15ResourceRequestERKNS_6StringEPNS_5EventEbb
-__ZN7WebCore11FrameLoader11urlSelectedERKNS_16FrameLoadRequestEPNS_5EventEbb
-__ZN7WebCore14DocumentLoader19setIsClientRedirectEb
-__ZN7WebCore11HistoryItem6setURLERKNS_4KURLE
-__ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
-__ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE
-__ZN7WebCore11HistoryItem18clearDocumentStateEv
+__ZN7WebCore11FrameLoader11urlSelectedERKNS_15ResourceRequestERKNS_6StringEN3WTF10PassRefPtrINS_5EventEEEbbb
+__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
+__ZN7WebCore11FrameLoader7loadURLERKNS_4KURLERKNS_6StringES6_bNS_13FrameLoadTypeEN3WTF10PassRefPtrINS_5EventEEENS9_INS_9FormSta
+__ZN7WebCore14SecurityOrigin16createFromStringERKNS_6StringE
+__ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
+__ZNK7WebCore9FrameTree4findERKNS_12AtomicStringE
+__ZNK7WebCore11FrameLoader21shouldAllowNavigationEPNS_5FrameE
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
+__ZNK7WebCore11HistoryItem3urlEv
+__ZNK7WebCore11HistoryItem11originalURLEv
+__ZN7WebCore11FrameLoader24loadWithNavigationActionERKNS_15ResourceRequestERKNS_16NavigationActionEbNS_13FrameLoadTypeEN3WTF10P
+__ZN7WebCore9DOMWindow25dispatchBeforeUnloadEventEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore17BeforeUnloadEventC1Ev
+__ZN7WebCore17BeforeUnloadEventC2Ev
+__ZN7WebCore17BeforeUnloadEventD0Ev
+__ZN7WebCore18MainResourceLoader15handleEmptyLoadERKNS_4KURLEb
+__ZN7WebCore11FrameLoader29generatedMIMETypeForURLSchemeERKNS_6StringE
+__ZNK7WebCore8Document17formElementsStateEv
+__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS_6StringELm0EEE
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE6shrinkEm
+__ZN7WebCore15JSEventListenerD0Ev
+__ZN7WebCore4Node31removeAllEventListenersSlowCaseEv
+__ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
+__ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE
+__ZN7WebCore11HistoryItem14addRedirectURLERKNS_6StringE
+__ZN7WebCore13AXObjectCacheD1Ev
+__ZN7WebCore13AXObjectCacheD2Ev
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E15deallocateTableEPji
+__ZN7WebCore16HTMLMediaElement26documentWillBecomeInactiveEv
+__ZN7WebCore16HTMLMediaElement17userCancelledLoadEv
+__ZN7WebCore16HTMLMediaElement17setPausedInternalEb
+__ZL62QTVideoRendererWebKitOnlyNewImageAvailableNotificationFunctionv
+__ZN7WebCore10RenderText7destroyEv
+__ZN7WebCore12RenderObject15virtualChildrenEv
+__ZN7WebCore26AnimationControllerPrivate5clearEPNS_12RenderObjectE
+__ZN7WebCore16StyleCachedImage12removeClientEPNS_12RenderObjectE
+__ZN7WebCore10RenderTextD0Ev
+__ZN7WebCore19StyleGeneratedImage12removeClientEPNS_12RenderObjectE
+__ZNK3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashT
+__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_NS_6RefPtrINS1_5ImageEEEENS_18PairFirstExtractorIS7_EENS_7IntHashIS2_EENS_14Pai
+__ZN7WebCore14GeneratedImageD0Ev
+__ZN7WebCore8GradientD0Ev
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE6shrinkEm
+__ZN7WebCore5ImageD2Ev
+__ZN7WebCore13RenderReplicaD0Ev
+__ZN7WebCore18CompositeAnimation13clearRendererEv
+__ZN7WebCore18CompositeAnimationD1Ev
+__ZN7WebCore18CompositeAnimationD2Ev
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_17KeyframeAnimationEEEENS_18PairFirstExtractorIS8_EEN
+__ZN7WebCore9RenderBox45removeFloatingOrPositionedChildFromBlockListsEv
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore16HTMLVideoElement6detachEv
+__ZN7WebCore11RenderMedia7destroyEv
+__ZN7WebCore11RenderMedia15virtualChildrenEv
+__ZN7WebCore11RenderVideoD0Ev
+__ZN7WebCore11RenderMediaD2Ev
+__ZN7WebCore14RenderReplacedD2Ev
+__ZN7WebCore11RenderImageD0Ev
+__ZN7WebCore9FrameView18unscheduleRelayoutEv
+__ZN7WebCore9FrameViewD0Ev
+__ZN7WebCore9FrameView15resetScrollbarsEv
+__ZN7WebCore10ScrollView25setHasHorizontalScrollbarEb
+__ZN7WebCore10ScrollView23setHasVerticalScrollbarEb
+__ZN7WebCore10ScrollViewD2Ev
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTable
+__ZN7WebCore6WidgetD2Ev
 __ZN7WebCore11FrameLoader33clientRedirectCancelledOrFinishedEb
-__ZN7WebCore8Document19hoveredNodeDetachedEPNS_4NodeE
-__ZN7WebCore12EventHandler24scheduleHoverStateUpdateEv
-__ZN7WebCore5TimerINS_12EventHandlerEE5firedEv
-__ZN7WebCore12EventHandler15hoverTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore22centerTruncateToBufferERKNS_6StringEjjPt
-__ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
-__ZN7WebCore17buttonConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLButtonElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLButtonElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore13HTMLBRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLBRElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore10HTMLParser28tableSectionCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore23tableSectionConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19textareaConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTextAreaElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore19HTMLTextAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore41jsElementPrototypeFunctionRemoveAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element15removeAttributeERKNS_6StringERi
-__ZN7WebCore12NamedAttrMap15removeNamedItemERKNS_6StringERi
-__ZN7WebCore18JSHTMLTableElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore25JSHTMLTableSectionElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLTableRowElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore15createBRWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore24JSHTMLBRElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLBRElementC1EPN3KJS8JSObjectEPNS_13HTMLBRElementE
-__ZN7WebCore15JSHTMLBRElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSHTMLBRElement9classInfoEv
-__ZN7WebCore15JSHTMLBRElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore32jsNodePrototypeFunctionCloneNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11HTMLElement9cloneNodeEb
-__ZN7WebCore12NamedAttrMapaSERKS0_
-__ZNK7WebCore15MappedAttribute5cloneEb
-__ZN7WebCore13StyledElement26copyNonAttributePropertiesEPKNS_7ElementE
-__ZN7WebCore13ContainerNode15cloneChildNodesEPS0_
-__ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
-__ZN7WebCore4Text9cloneNodeEb
-__ZN7WebCore12NamedAttrMap15removeNamedItemERKNS_13QualifiedNameERi
-__ZN7WebCore12NamedAttrMap15removeAttributeERKNS_13QualifiedNameE
-__ZN7WebCore7Element24dispatchAttrRemovalEventEPNS_9AttributeE
-__ZN7WebCore35jsNodePrototypeFunctionInsertBeforeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore6JSNode12insertBeforeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore19DeprecatedValueListINS_11CSSPropertyEE8copyNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore12RenderInline9splitFlowEPNS_12RenderObjectEPNS_11RenderBlockES2_PNS_10RenderFlowE
-__ZN7WebCore11RenderBlock17setChildrenInlineEb
-__ZN7WebCore12RenderInline12splitInlinesEPNS_11RenderBlockES2_S2_PNS_12RenderObjectEPNS_10RenderFlowE
-__ZN7WebCore12RenderInline11cloneInlineEPNS_10RenderFlowE
-__ZN7WebCore14mapConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16createMapWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLMapElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLMapElementC1EPN3KJS8JSObjectEPNS_14HTMLMapElementE
-__ZNK7WebCore16JSHTMLMapElement9classInfoEv
-__ZN7WebCore16JSHTMLMapElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS16JSXMLHttpRequest4markEv
-__ZNK7WebCore14XMLHttpRequest26onReadyStateChangeListenerEv
-__ZNK7WebCore14XMLHttpRequest14onLoadListenerEv
-__ZN7WebCore26JSUnprotectedEventListener4markEv
-__ZN7WebCore14CachedResource11setEncodingERKNS_6StringE
-__ZN7WebCore11BitmapImageD1Ev
-__ZN7WebCore11ImageSourceD2Ev
-__ZN7WebCore11ImageSource5clearEv
-__ZN7WebCore11JSDOMParser14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSDOMParserPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore22JSDOMParserConstructor19implementsConstructEv
-__ZN7WebCore22JSDOMParserConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9DOMParserE
-__ZN7WebCore11JSDOMParserC1EPN3KJS8JSObjectEPNS_9DOMParserE
-__ZN7WebCore11JSDOMParser18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSDOMParserPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsDOMParserPrototypeFunctionParseFromStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore11JSDOMParser9classInfoEv
-__ZN7WebCore9DOMParser15parseFromStringERKNS_6StringES3_
-__ZN7WebCore5Image12supportsTypeERKNS_6StringE
-__ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKNS_6StringE
-__ZN7WebCore15PluginInfoStore16supportsMIMETypeERKNS_6StringE
-__ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
-__ZNK7WebCore7Element8nodeNameEv
-__ZN3KJS17staticValueGetterIN7WebCore12JSMouseEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSMouseEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore7Element10scrollLeftEv
-__ZNK7WebCore12RenderObject10scrollLeftEv
-__ZN7WebCore7Element9scrollTopEv
-__ZNK7WebCore12RenderObject9scrollTopEv
-__ZN7WebCore6CursorC2EPNS_5ImageERKNS_8IntPointE
-__ZN7WebCore18createCustomCursorEPNS_5ImageERKNS_8IntPointE
-__ZNK7WebCore8IntPointcv8_NSPointEv
-__ZNK7WebCore4Node11isFocusableEv
-__ZNK7WebCore4Node16isMouseFocusableEv
-__ZN7WebCore21JSMouseEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSUIEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsEventPrototypeFunctionStopPropagationEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSMouseEvent9classInfoEv
-__ZN7WebCore9FrameData5clearEv
-__ZN7WebCore14RenderThemeMac13paintCheckboxEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14XMLHttpRequest16getRequestHeaderERKNS_6StringE
-__ZN7WebCore8FormDataC2ERKNS_7CStringE
-__ZN7WebCore19ResourceRequestBase11setHTTPBodyEN3WTF10PassRefPtrINS_8FormDataEEE
-__ZN7WebCore11setHTTPBodyEP19NSMutableURLRequestN3WTF10PassRefPtrINS_8FormDataEEE
-__ZN7WebCore8FormDataC2EPKvm
-__ZN7WebCore14HTMLMapElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
-__ZN7WebCore15HTMLAreaElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
-__ZNK7WebCore15HTMLAreaElement9getRegionERKNS_7IntSizeE
-__ZN7WebCore4Path6moveToERKNS_10FloatPointE
-__ZN7WebCore4Path9addLineToERKNS_10FloatPointE
-__ZN7WebCore4Path12closeSubpathEv
-__ZN7WebCore4PathC2ERKS0_
-__ZN7WebCore4PathaSERKS0_
-__ZNK7WebCore4Path8containsERKNS_10FloatPointENS_8WindRuleE
-__ZNK7WebCore4Path12boundingRectEv
-__ZN7WebCore34copyClosingSubpathsApplierFunctionEPvPK13CGPathElement
-__ZNK7WebCore10FloatPointcv7CGPointEv
-__ZN7WebCore7Element14createRareDataEv
-__ZN7WebCore11rareDataMapEv
-__ZN3WTF7HashMapIPKN7WebCore7ElementEPNS1_15ElementRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLBodyElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLBodyElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLBodyElement10scrollLeftEv
-__ZNK7WebCore15HTMLBodyElement9scrollTopEv
-__ZNK7WebCore15HTMLAreaElement6targetEv
-__ZNK7WebCore12RenderInline10offsetLeftEv
-__ZNK7WebCore12RenderInline9offsetTopEv
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC2ERKS4_
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE6shrinkEm
-__ZN7WebCore39jsHTMLInputElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element4blurEv
-__ZNK7WebCore16HTMLImageElement17canStartSelectionEv
-__ZN7WebCore38jsEventPrototypeFunctionPreventDefaultEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
-__ZN7WebCore12EventHandler27eventLoopHandleMouseDraggedERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore16HTMLImageElement5widthEb
-__ZNK7WebCore16HTMLImageElement6heightEb
-__ZN3WTF6VectorIN7WebCore9FrameDataELm0EE6shrinkEm
-__ZN7WebCore15rareDataFromMapEPKNS_7ElementE
-__ZN7WebCore15ElementRareData18resetComputedStyleEPNS_7ElementE
-__ZSt21__inplace_stable_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
-__ZN3KJS9MimeTypes18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_9MimeTypesEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS9MimeTypes16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore9RenderBox15availableHeightEv
-__ZNK7WebCore9RenderBox20availableHeightUsingERKNS_6LengthE
-__ZN7WebCore9RenderBox20calcPercentageHeightERKNS_6LengthE
-__ZN7WebCore18createEmbedWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLEmbedElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLEmbedElementC1EPN3KJS8JSObjectEPNS_16HTMLEmbedElementE
-__ZN7WebCore18JSHTMLEmbedElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_16HTMLEmbedElementERKNS1_10IdentifierE
-__ZN7WebCore18JSHTMLEmbedElement24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37runtimeObjectCustomGetOwnPropertySlotEPN3KJS9ExecStateERKNS0_10IdentifierERNS0_12PropertySlotEPNS_13JSHTMLElementEPNS_11HTMLElementE
-__ZN7WebCore16getRuntimeObjectEPN3KJS9ExecStateEPNS_4NodeE
-__ZNK7WebCore16HTMLEmbedElement11getInstanceEv
-__ZN7WebCore5Frame29createScriptInstanceForWidgetEPNS_6WidgetE
-__Z16createRootObjectPv
-__ZN7WebCore5Frame16createRootObjectEPvPN3KJS14JSGlobalObjectE
-__ZN3WTF7HashMapIPvNS_6RefPtrIN3KJS8Bindings10RootObjectEEENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS9_IS6_EEE3setERKS1_RKS6_
-__ZN7WebCore27JSHTMLEmbedElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLEmbedElement9classInfoEv
-__ZN7WebCore12EventHandler27handleMouseDoubleClickEventERKNS_18PlatformMouseEventE
-__ZN7WebCore27runtimeObjectPropertyGetterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19runtimeObjectGetterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17HTMLPlugInElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore6Widget11handleEventEPNS_5EventE
-__ZN7WebCore12EventHandler10wheelEventEP7NSEvent
-__ZN7WebCore18PlatformWheelEventC2EP7NSEvent
-__ZN7WebCore12EventHandler16handleWheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore12EventHandler22passWheelEventToWidgetERNS_18PlatformWheelEventEPNS_6WidgetE
-__ZN7WebCore15EventTargetNode18dispatchWheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore10WheelEventC2EffPNS_9DOMWindowEiiiibbbb
-__ZNK7WebCore10WheelEvent12isWheelEventEv
-__ZN7WebCore21JSWheelEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSWheelEventC1EPN3KJS8JSObjectEPNS_10WheelEventE
-__ZN7WebCore12JSWheelEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore12JSWheelEvent9classInfoEv
-__ZN7WebCore12RenderObject6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore11RenderLayer6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore10ScrollView10wheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore24JSKeyboardEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSKeyboardEvent9classInfoEv
-__ZN7WebCore12EventHandler26passMouseDownEventToWidgetEPNS_6WidgetE
-__ZN7WebCore18lastEventIsMouseUpEv
-__ZN7WebCore18findViewInSubviewsEP6NSViewS1_
-__ZN7WebCore21HTMLFrameOwnerElement10willRemoveEv
-__ZN7WebCore16HTMLEmbedElement19removedFromDocumentEv
-__ZNK7WebCore11RenderTheme13supportsHoverEPKNS_11RenderStyleE
-__ZN7WebCore17RenderTextControl11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore19HTMLTextAreaElement9saveStateERNS_6StringE
-__ZNK7WebCore19HTMLTextAreaElement5valueEv
-__ZNK7WebCore19HTMLTextAreaElement11updateValueEv
-__ZNK7WebCore19HTMLTextAreaElement4typeEv
-__ZN7WebCore11JSDOMWindow14deletePropertyEPN3KJS9ExecStateERKNS1_10IdentifierE
-__ZN7WebCore11FrameLoader16detachFromParentEv
-__ZN7WebCore19InspectorController23frameDetachedFromParentEPNS_5FrameE
-__ZN7WebCore9FrameTree11removeChildEPNS_5FrameE
-__ZN7WebCore5Frame13pageDestroyedEv
-__ZN3KJS6Window15disconnectFrameEv
-__ZN7WebCore11FrameLoader22scheduleCheckCompletedEv
--[WebCoreFrameBridge close]
--[WebCoreFrameBridge clearFrame]
--[WebCoreFrameBridge dealloc]
-__ZN7WebCore11FrameLoader14cancelAndClearEv
-__ZN7WebCore5Frame22disconnectOwnerElementEv
-__ZN7WebCore9DOMWindow15disconnectFrameEv
-__ZN7WebCore12FramePrivateD2Ev
-__ZN7WebCore8KJSProxyD2Ev
-__ZN3KJS12ProtectedPtrIN7WebCore11JSDOMWindowEED1Ev
-__ZN7WebCore11FrameLoaderD2Ev
-__ZN7WebCore11FrameLoader9setOpenerEPNS_5FrameE
--[DOMAbstractView dealloc]
-__ZN7WebCore15removeJSWrapperEPN3KJS8JSObjectE
-__ZN7WebCore19AnimationControllerD1Ev
-__ZN7WebCore26AnimationControllerPrivateD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore26CompositeImplicitAnimationEKNS_7HashMapIPNS1_12RenderObjectES3_NS_7PtrHashIS6_EENS_10HashTraitsIS6_EENS9_IS3_EEEEEEvRT0_
-__ZN7WebCore12EventHandlerD2Ev
-__ZN7WebCore6EditorD2Ev
-__ZN7WebCore9FrameTreeD2Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE6shrinkEm
-__ZN7WebCore11EditCommandD0Ev
-__ZN7WebCore8Document10setIconURLERKNS_6StringES3_
-__ZN7WebCore31JSHTMLTableCellElementPrototypeD0Ev
-__ZN7WebCore25JSHTMLMapElementPrototypeD0Ev
-__ZN3KJS25JSXMLHttpRequestPrototypeD0Ev
-__ZN7WebCore21JSWheelEventPrototypeD0Ev
-__ZN7WebCore27JSHTMLStyleElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLHtmlElementPrototypeD0Ev
-__ZN7WebCore24JSHTMLBRElementPrototypeD0Ev
-__ZN7WebCore17HTMLIFrameElementD1Ev
-__ZN7WebCore17HTMLSelectElementD1Ev
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE6shrinkEm
-__ZN7WebCore17HTMLOptionElementD1Ev
-__ZN7WebCore5Cache18pruneDeadResourcesEv
-__ZNK7WebCore5Cache12deadCapacityEv
-__ZN7WebCore5Cache18pruneLiveResourcesEv
-__ZNK7WebCore5Cache12liveCapacityEv
-__ZN7WebCore16CSSStyleSelector23mapBackgroundAttachmentEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore8Document25registerForCacheCallbacksEPNS_7ElementE
-__ZN3WTF7HashSetIPN7WebCore7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore4KURL3refEv
-__ZN3KJS17staticValueGetterIN7WebCore14JSHTMLDocumentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSHTMLDocument16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14JSHTMLDocument3allEPN3KJS9ExecStateE
-__ZN7WebCore8Document3allEv
-__ZNK7WebCore19JSHTMLAllCollection9toBooleanEPN3KJS9ExecStateE
-__ZN7WebCore15GraphicsContext8drawLineERKNS_8IntPointES3_
-__ZNK7WebCore26NetscapePlugInStreamLoader6isDoneEv
-__ZN7WebCore26NetscapePlugInStreamLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore9FrameView14setMarginWidthEi
-__ZN7WebCore9FrameView15setMarginHeightEi
--[WebCoreFrameBridge stringByEvaluatingJavaScriptFromString:forceUserGesture:]
-__ZN7WebCore11RenderLayer19transparentAncestorEv
-__ZN7WebCore9FrameView18setUseSlowRepaintsEv
-__ZN7WebCore11FrameLoader13frameDetachedEv
-__ZN7WebCore17HTMLIFrameElement19removedFromDocumentEv
-__ZN7WebCore20HTMLFrameElementBase19removedFromDocumentEv
-__ZN7WebCore11FrameLoader24checkCompletedTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11ImageSource22frameIsCompleteAtIndexEm
-__ZN7WebCore11BitmapImage20frameDurationAtIndexEm
-__ZNK7WebCore6Screen10colorDepthEv
-__ZN7WebCore15defaultLanguageEv
-__ZN7WebCore11RenderTable11splitColumnEii
-__ZN7WebCore18RenderTableSection11splitColumnEii
-__ZN7WebCore5TimerINS_11BitmapImageEE5firedEv
-__ZN7WebCore11BitmapImage16advanceAnimationEPNS_5TimerIS0_EE
-__ZThn256_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
-__ZN7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
-__ZN7WebCore20CachedResourceClient15willRenderImageEPNS_11CachedImageE
-__ZN7WebCore12RenderObject15willRenderImageEPNS_11CachedImageE
-__ZNK7WebCore10ScrollView8inWindowEv
-__ZThn256_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
-__ZN7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
-__ZNK7WebCore16HTMLImageElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore27RenderTextControlInnerBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
--[WebCoreFrameBridge sendScrollEvent]
-__ZN7WebCore5Frame15sendScrollEventEv
-__ZN7WebCore9FrameView20setWasScrolledByUserEb
-__ZN7WebCore14ResourceLoader15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore23SubresourceLoaderClient15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore14RenderMenuList11removeChildEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE6shrinkEm
-__ZN7WebCore11FrameLoader23haveToldClientAboutLoadERKNS_6StringE
-__ZN7WebCore16HTMLTitleElement19removedFromDocumentEv
-__ZN7WebCore8Document11removeTitleEPNS_7ElementE
-__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE6resizeEm
-__ZN7WebCore8Document27unregisterForCacheCallbacksEPNS_7ElementE
-__ZN7WebCore11hashForFontERKNS_6StringEbb
-__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE14expandCapacityEm
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE15reserveCapacityEm
-__ZN7WebCore9FontCache26getSimilarFontPlatformDataERKNS_4FontE
-__ZNK7WebCore8Document12lastModifiedEv
-__ZNK7WebCore15HTMLBodyElement12scrollHeightEv
-__ZNK7WebCore6Screen11availHeightEv
-__ZNK7WebCore9DOMWindow4nameEv
-__ZN7WebCore18MainResourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader25receivedMainResourceErrorERKNS_13ResourceErrorEb
-__ZN7WebCore11FrameLoader4stopEv
-__ZN7WebCore17ResourceErrorBase8lazyInitEv
-__ZN7WebCore11FrameLoader13didNotOpenURLERKNS_4KURLE
-__ZN7WebCore11FrameLoader31invalidateCurrentItemCachedPageEv
-__ZN7WebCore14DocumentLoader17mainReceivedErrorERKNS_13ResourceErrorEb
-__ZN7WebCore11FrameLoader25mainReceivedCompleteErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader20clearProvisionalLoadEv
-__ZN7WebCore16FixedTableLayoutC2EPNS_11RenderTableE
+__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE6shrinkEm
+__ZNK7WebCore12RenderObject13hoverAncestorEv
+__ZN7WebCore17HTMLAnchorElement9setActiveEbb
+__ZN7WebCore12RenderInline29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore12RenderInline16linesBoundingBoxEv
+__ZN7WebCore10handCursorEv
+__ZN7WebCoreL15leakNamedCursorEPKcii
+__ZNK7WebCore12RenderObject23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore17HTMLAnchorElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore13HitTestResult11targetFrameEv
+__ZNK7WebCore17HTMLAnchorElement6targetEv
+__ZNK7WebCore13RootInlineBox11ellipsisBoxEv
+__ZN7WebCore15GraphicsContext18setStrokeThicknessEf
+__ZN7WebCore15GraphicsContext26setPlatformStrokeThicknessEf
+__ZN7WebCore15GraphicsContext14setStrokeColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext15drawLineForTextERKNS_8IntPointEib
+__ZNK7WebCore15GraphicsContext15strokeThicknessEv
+__ZN7WebCore15GraphicsContext19roundToDevicePixelsERKNS_9FloatRectE
+__ZNK7WebCore15GraphicsContext15shouldAntialiasEv
+__ZN7WebCoreL32fontCacheATSNotificationCallbackEP27ATSFontNotificationInfoRef_Pv
+__ZN7WebCore9FontCache10invalidateEv
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore16FontPlatformDataEKNS_7HashMapINS1_24FontPlatformDataCacheKeyES3_NS1_28FontPlatformDa
+__ZN7WebCore15CSSFontSelector20fontCacheInvalidatedEv
+__ZN7WebCore9FontCache21purgeInactiveFontDataEi
+__ZN7WebCore14SimpleFontDataD0Ev
+__ZN7WebCore14SimpleFontData15platformDestroyEv
+__ZN7WebCore17GlyphPageTreeNode17pruneTreeFontDataEPKNS_14SimpleFontDataE
+__ZN7WebCore17GlyphPageTreeNode13pruneFontDataEPKNS_14SimpleFontDataEj
+__ZN7WebCore17GlyphPageTreeNodeD1Ev
+__ZN7WebCore17GlyphPageTreeNodeD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore17GlyphPageTreeNodeEKNS_7HashMapIPKNS1_8FontDataES3_NS_7PtrHashIS7_EENS_10HashTraitsIS
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore13GlyphWidthMap14GlyphWidthPageEKNS_7HashMapIiS4_NS_7IntHashIjEENS_10HashTraitsIiEENS8
+__ZN7WebCore8FontDataD2Ev
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE14deleteAllNodesEv
+__ZNK3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20Font
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore12FontSelectorEEELm0EE6shrinkEm
+__ZN7WebCore21DeprecatedPtrListImpl5clearEb
+__ZN7WebCore17DeprecatedPtrListINS_11RenderBlock14FloatingObjectEE10deleteFuncEPv
+__ZN7WebCore21DeprecatedPtrListImpl4takeEv
+__ZN7WebCore21DeprecatedPtrListImpl6removeEb
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_11RenderBlock14FloatingObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_11RenderBlock14FloatingObjectEENS_18PairFirstExtractorIS8_EENS_7Ptr
+__ZN7WebCore13InlineFlowBoxD0Ev
+__ZN7WebCore11RenderTheme17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
+__ZNK7WebCore8ThemeMac23inflateControlPaintRectENS_11ControlPartEjRNS_7IntRectEf
+__ZN7WebCore9RenderBox26repaintDuringLayoutIfMovedERKNS_7IntRectE
+__ZN7WebCore11HistoryItemD1Ev
+__ZN7WebCore11HistoryItemD2Ev
+__ZN7WebCore12IconDatabase21releaseIconForPageURLERKNS_6StringE
+__ZN3WTF6VectorIiLm0EE6shrinkEm
+__ZNK7WebCore14RenderThemeMac20supportsControlTintsEv
+__ZN7WebCore15GraphicsContext23setUpdatingControlTintsEb
+__ZNK7WebCore14RenderThemeMac20controlSupportsTintsEPKNS_12RenderObjectE
+__ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
+__ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
+__ZN7WebCore5Frame14clearDOMWindowEv
+__ZN3WTF7HashSetIPN7WebCore9DOMWindowENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore9DOMWindow5clearEv
+__ZN7WebCore9Navigator15disconnectFrameEv
+__ZN7WebCore16ScriptController16clearWindowShellEv
+__ZN7WebCore15JSDOMWindowBase5clearEv
+__ZN7WebCore15JSDOMWindowBase27clearHelperObjectPropertiesEv
+__ZN7WebCore12gcControllerEv
+__ZN7WebCore12GCControllerC1Ev
+__ZN7WebCore12GCControllerC2Ev
+__ZN7WebCore12GCController18garbageCollectSoonEv
+__ZN7WebCore16ScriptController18clearScriptObjectsEv
+__ZN3JSC8Bindings10RootObject10invalidateEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47remov
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6remove
+-[WebScriptObject _setOriginRootObject:andRootObject:]
+__ZN3JSC8Bindings10RootObjectD1Ev
+__ZN3JSC8Bindings10RootObjectD2Ev
+__ZN7WebCore5Frame25setUseSecureKeyboardEntryEb
+__ZN7WebCore12SharedBuffer6appendEPKci
+__ZN7WebCore12SharedBuffer25maybeTransferPlatformDataEv
+__ZN7WebCore9CSSParser11parseShadowEib
+__ZN7WebCore18ShadowParseContext11commitValueEv
+__ZN7WebCore11ShadowValueC1EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
+__ZN7WebCore11ShadowValueC2EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
+__ZN7WebCore9CSSParser14createRuleListEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser15createMediaRuleEPNS_9MediaListEPNS_11CSSRuleListE
+__ZN7WebCore12CSSMediaRuleC1EPNS_13CSSStyleSheetEN3WTF10PassRefPtrINS_9MediaListEEENS4_INS_11CSSRuleListEEE
+__ZN7WebCore12CSSMediaRuleC2EPNS_13CSSStyleSheetEN3WTF10PassRefPtrINS_9MediaListEEENS4_INS_11CSSRuleListEEE
+__ZN7WebCore9CSSParser27createFloatingMediaQueryExpERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore13MediaQueryExpC1ERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore13MediaQueryExpC2ERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore9CSSParser25sinkFloatingMediaQueryExpEPNS_13MediaQueryExpE
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE6shrinkEm
+__ZN7WebCore12CSSMediaRule11isMediaRuleEv
+__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_13MediaQueryExpE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEENS_7Pt
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeatureP
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEENS_7P
+__ZN7WebCoreL32max_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore10screenRectEPNS_6WidgetE
+__ZN7WebCore11toUserSpaceERK6CGRectP8NSWindow
+__ZN7WebCore9FloatRectC1ERK6CGRect
+__ZN7WebCore9FloatRectC2ERK6CGRect
+__ZN7WebCore10FloatPointC1ERK7CGPoint
+__ZN7WebCore10FloatPointC2ERK7CGPoint
+__ZN7WebCore9FloatSizeC1ERK6CGSize
+__ZN7WebCore9FloatSizeC2ERK6CGSize
+__ZN7WebCore9FloatRect5scaleEf
+__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleE
+__ZN7WebCore12compareValueIiEEbT_S1_NS_18MediaFeaturePrefixE
+__ZN7WebCore17jsDOMWindowOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6onloadEv
+__ZNK7WebCore9DOMWindow25getAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore16JSDOMWindowShell3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore11JSDOMWindow3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSDOMWindowOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17JSDOMGlobalObject30createJSAttributeEventListenerEN3JSC7JSValueE
+__ZN7WebCore9DOMWindow9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9DOMWindow25setAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9DOMWindow27clearAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore20StringSourceProviderD0Ev
+__ZN7WebCoreL16ulistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLUListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLUListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLUListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLUListElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLUListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLUListElement11tagPriorityEv
+__ZN7WebCore10HTMLParser29nestedPCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL13liConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLLIElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLLIElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLLIElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLLIElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore13HTMLLIElement17endTagRequirementEv
+__ZNK7WebCore13HTMLLIElement11tagPriorityEv
+__ZN7WebCore13HTMLLIElement6attachEv
+__ZN7WebCore15FormDataBuilder15parseMethodTypeERKNS_6StringE
+__ZN7WebCore12RenderInline9splitFlowEPNS_12RenderObjectEPNS_11RenderBlockES2_PNS_20RenderBoxModelObjectE
+__ZN7WebCore12RenderInline12splitInlinesEPNS_11RenderBlockES2_S2_PNS_12RenderObjectEPNS_20RenderBoxModelObjectE
+__ZN7WebCore12RenderInline11cloneInlineEPS0_
+__ZNK7WebCore14RenderThemeMac22adjustSearchFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18setSearchFieldSizeEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac16searchFieldSizesEv
+__ZN7WebCore12RenderInline22addChildToContinuationEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline18continuationBeforeEPNS_12RenderObjectE
+__ZN7WebCoreL16nextContinuationEPNS_12RenderObjectE
+__ZN7WebCore23TextControlInnerElementC1EPNS_8DocumentEPNS_4NodeE
+__ZNK7WebCore27RenderTextControlSingleLine21createInnerBlockStyleEPKNS_11RenderStyleE
+__ZN7WebCore31SearchFieldResultsButtonElementC1EPNS_8DocumentE
+__ZN7WebCore31SearchFieldResultsButtonElementC2EPNS_8DocumentE
+__ZNK7WebCore27RenderTextControlSingleLine24createResultsButtonStyleEPKNS_11RenderStyleE
+__ZN7WebCore11RenderStyle20getCachedPseudoStyleENS_8PseudoIdE
+__ZNK7WebCore14RenderThemeMac32adjustSearchFieldDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18resultsButtonSizesEv
+__ZN7WebCore11RenderStyle20addCachedPseudoStyleEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore30SearchFieldCancelButtonElementC1EPNS_8DocumentE
+__ZN7WebCore30SearchFieldCancelButtonElementC2EPNS_8DocumentE
+__ZNK7WebCore27RenderTextControlSingleLine23createCancelButtonStyleEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac34adjustSearchFieldCancelButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac17cancelButtonSizesEv
+__ZNK7WebCore27RenderTextControlSingleLine25visibilityForCancelButtonEv
+__ZNK7WebCore27RenderTextControlSingleLine28updateCancelButtonVisibilityEv
+__ZN7WebCore11RenderStyle17setHasPseudoStyleENS_8PseudoIdE
+__ZNK7WebCore8CSSValue21isImageGeneratorValueEv
+__ZN7WebCore11RenderStyle10setContentEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore11ContentData13deleteContentEv
+__ZN7WebCoreL17iframeConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLIFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLIFrameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLFrameElementBaseC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21HTMLFrameOwnerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore17HTMLIFrameElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore17HTMLIFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore20HTMLFrameElementBase20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore20HTMLFrameElementBase11setLocationERKNS_6StringE
+__ZNK7WebCore17HTMLIFrameElement17endTagRequirementEv
+__ZNK7WebCore17HTMLIFrameElement11tagPriorityEv
+__ZN7WebCore17HTMLIFrameElement20insertedIntoDocumentEv
+__ZN7WebCore20HTMLFrameElementBase20insertedIntoDocumentEv
+__ZN7WebCore17HTMLIFrameElement6attachEv
+__ZN7WebCore20HTMLFrameElementBase6attachEv
+__ZN7WebCore13ContainerNode23queuePostAttachCallbackEPFvPNS_4NodeEES2_
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEmPKS9_
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLIFrameElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore20HTMLFrameElementBase12isURLAllowedERKNS_12AtomicStringE
+__ZN7WebCore16equalIgnoringRefERKNS_4KURLES2_
+__ZN7WebCore17HTMLIFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16RenderPartObjectC1EPNS_7ElementE
+__ZN7WebCore16RenderPartObjectC2EPNS_7ElementE
+__ZN7WebCore10RenderPartC2EPNS_7ElementE
+__ZN7WebCore12RenderWidgetC2EPNS_4NodeE
+__ZN7WebCore10RenderView9addWidgetEPNS_12RenderWidgetE
+__ZN3WTF7HashSetIPN7WebCore12RenderWidgetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN7WebCore12RenderWidget14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore13ContainerNode27dispatchPostAttachCallbacksEv
+__ZN7WebCore20HTMLFrameElementBase25setNameAndOpenURLCallbackEPNS_4NodeE
+__ZN7WebCore20HTMLFrameElementBase17setNameAndOpenURLEv
+__ZNK7WebCore9FrameTree15uniqueChildNameERKNS_12AtomicStringE
+__ZN7WebCore20HTMLFrameElementBase7openURLEv
+__ZN7WebCore11FrameLoader12requestFrameEPNS_21HTMLFrameOwnerElementERKNS_6StringERKNS_12AtomicStringE
+__ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
+__ZN7WebCore11FrameLoader12loadSubframeEPNS_21HTMLFrameOwnerElementERKNS_4KURLERKNS_6StringES8_
+__ZNK7WebCore20HTMLFrameElementBase13scrollingModeEv
+__ZN7WebCore9FrameTree11appendChildEN3WTF10PassRefPtrINS_5FrameEEE
+__ZNK7WebCore10RenderPart12isRenderPartEv
+__ZN7WebCore10RenderPart9setWidgetEPNS_6WidgetE
+__ZNK7WebCore9FrameView11isFrameViewEv
+__ZN7WebCore12RenderWidget9setWidgetEPNS_6WidgetE
+__ZN3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore6WidgetESt4pairIS4_PNS1_12RenderWidgetEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHa
+__ZN7WebCore10ScrollView8addChildEPNS_6WidgetE
+__ZN7WebCore10ScrollView9setParentEPS0_
+__ZN7WebCore6Widget9setParentEPNS_10ScrollViewE
+__ZN3WTF7HashSetIPN7WebCore6WidgetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore10ScrollView16platformAddChildEPNS_6WidgetE
+__ZN7WebCore16RenderPartObject11viewClearedEv
+__ZN7WebCore9FrameView20setCanHaveScrollbarsEb
+__ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
+__ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
+__ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZN7WebCore11FrameLoader18currentHistoryItemEv
+__ZNK7WebCore11HistoryItem8childrenEv
+__ZN7WebCore14DocumentLoader21popArchiveForSubframeERKNS_6StringE
+__ZN7WebCore14ResourceHandle16setDefersLoadingEb
+__ZNK7WebCore12RenderWidget8isWidgetEv
+__ZN7WebCore5Frame19setInViewSourceModeEb
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE6shrinkEm
+__ZN7WebCore16RenderPartObject12updateWidgetEb
+__ZN7WebCore14RenderListItemC1EPNS_4NodeE
+__ZN7WebCore14RenderListItemC2EPNS_4NodeE
+__ZN7WebCore14RenderListItem14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderListItem10isListItemEv
+__ZN7WebCore14RenderListItem18clearExplicitValueEv
+__ZN7WebCoreL20paragraphConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLParagraphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLParagraphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore20HTMLParagraphElement17endTagRequirementEv
+__ZNK7WebCore20HTMLParagraphElement11tagPriorityEv
+__ZN7WebCore20HTMLParagraphElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore11HTMLElement15inInlineTagListEPKNS_4NodeE
 __ZN7WebCore14RenderListItem11updateValueEv
-__ZN7WebCore16FixedTableLayout14calcPrefWidthsERiS1_
-__ZN7WebCore16FixedTableLayout14calcWidthArrayEi
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE4fillERKS2_m
-__ZSt4fillIPN7WebCore6LengthES1_EvT_S3_RKT0_
-__ZN7WebCore16FixedTableLayout6layoutEv
-__ZN7WebCore11RenderTable19getOverflowClipRectEii
-__ZN7WebCore11HistoryItem17setAlternateTitleERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE6shrinkEm
+__ZNK7WebCore20HTMLParagraphElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore20HTMLParagraphElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreleERNS_11CSSRuleDataES1_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE6shrinkEm
+__ZN7WebCore10StringImpl7replaceEPS0_S1_
+__ZN7WebCore22characterBreakIteratorEPKti
+__ZN7WebCoreL16olistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLOListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLOListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLOListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLOListElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLOListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLOListElement11tagPriorityEv
+__ZN7WebCore16RenderListMarkerC1EPNS_14RenderListItemE
+__ZN7WebCore16RenderListMarkerC2EPNS_14RenderListItemE
+__ZN7WebCore16RenderListMarker15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore16RenderListMarker14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore26CSSMutableStyleDeclaration21removePropertiesInSetEPKijb
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEaSERKS3_
+__ZN7WebCoreL30createHTMLIFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLIFrameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLIFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLIFrameElementEEE
+__ZN7WebCore19JSHTMLIFrameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLIFrameElementEEE
+__ZN7WebCore19JSHTMLIFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore6JSNode3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSNodeOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14P
+__ZN7WebCore20JSNavigatorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsDocumentLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10JSDocument8locationEPN3JSC9ExecStateE
+__ZNK7WebCore9DOMWindow8locationEv
+__ZN7WebCore8LocationC1EPNS_5FrameE
+__ZN7WebCore8LocationC2EPNS_5FrameE
+__ZN7WebCore10JSLocation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSLocationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8LocationEEE
+__ZN7WebCore10JSLocationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8LocationEEE
+__ZN7WebCore10JSLocation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSLocation24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameERNS_6StringE
+__ZN7WebCore16jsLocationSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location6searchEv
+__ZNK7WebCore4KURL5queryEv
+__ZN7WebCore21jsNavigatorAppVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator10appVersionEv
+__ZNK7WebCore13NavigatorBase10appVersionEv
+__ZN7WebCore15JSDOMWindowBase3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore11JSDOMWindow4markEv
+__ZN7WebCore17JSDOMGlobalObject4markEv
+__ZN7WebCore16JSDOMWindowShell4markEv
+__ZN7WebCore10JSDocument4markEv
+__ZN7WebCore6JSNode4markEv
+__ZN7WebCore23markDOMNodesForDocumentEPNS_8DocumentE
+__ZN7WebCore15JSEventListener14markJSFunctionEv
+__ZN7WebCore27markActiveObjectsForContextERN3JSC12JSGlobalDataEPNS_22ScriptExecutionContextE
+__ZN7WebCore20markDOMObjectWrapperERN3JSC12JSGlobalDataEPv
+__ZN7WebCore11JSNavigator4markEv
+__ZN7WebCore20JSDOMWindowPrototypeD1Ev
+__ZN7WebCore11JSDOMWindowD1Ev
+__ZN7WebCore11JSDOMWindowD2Ev
+__ZN7WebCore15JSDOMWindowBaseD2Ev
+__ZN7WebCore17JSDOMGlobalObjectD2Ev
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataD0Ev
+__ZN7WebCore9DOMWindowD0Ev
+__ZN7WebCore5Frame20clearFormerDOMWindowEPNS_9DOMWindowE
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN3JSC14JSGlobalObject18JSGlobalObjectDataD2Ev
+__ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore15JSNodePrototypeD1Ev
+__ZN7WebCore19JSDocumentPrototypeD1Ev
+__ZN7WebCore23JSHTMLDocumentPrototypeD1Ev
+__ZN7WebCore14JSHTMLDocumentD1Ev
+__ZN7WebCore10JSDocumentD2Ev
+__ZN7WebCore15forgetDOMObjectERN3JSC12JSGlobalDataEPv
+__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE4takeERKS1_
+__ZN7WebCore6JSNodeD2Ev
+__ZN7WebCore13forgetDOMNodeEPNS_8DocumentEPNS_4NodeE
+__ZN3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE4takeERKS3_
+__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_PNS1_6JSNodeEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsIN
+__ZN7WebCore16JSEventPrototypeD1Ev
+__ZN7WebCore7JSEventD1Ev
+__ZN7WebCore7JSEventD2Ev
+__ZN7WebCore20JSNavigatorPrototypeD1Ev
+__ZN7WebCore11JSNavigatorD1Ev
+__ZN7WebCore11JSNavigatorD2Ev
+__ZN7WebCore9NavigatorD0Ev
+__ZN7WebCore13NavigatorBaseD2Ev
+__ZN7WebCore18JSElementPrototypeD1Ev
+__ZN7WebCore22JSHTMLElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLMediaElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLAudioElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLAudioElementD1Ev
+__ZN7WebCore27JSHTMLVideoElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLVideoElementD1Ev
+__ZN7WebCore26CachedScriptSourceProviderD0Ev
+__ZN7WebCore5Cache27removeFromLiveResourcesSizeEPNS_14CachedResourceE
+__ZN7WebCore12CachedScript17allClientsRemovedEv
+__ZN7WebCore19JSNodeListPrototypeD1Ev
+__ZN7WebCore10JSNodeListD1Ev
+__ZN7WebCore10JSNodeListD2Ev
+__ZN7WebCore25JSStyleSheetListPrototypeD1Ev
+__ZN7WebCore16JSStyleSheetListD1Ev
+__ZN7WebCore16JSStyleSheetListD2Ev
+__ZN7WebCore21JSStyleSheetPrototypeD1Ev
+__ZN7WebCore24JSCSSStyleSheetPrototypeD1Ev
+__ZN7WebCore15JSCSSStyleSheetD1Ev
+__ZN7WebCore12JSStyleSheetD2Ev
+__ZN7WebCore22JSCSSRuleListPrototypeD1Ev
+__ZN7WebCore13JSCSSRuleListD1Ev
+__ZN7WebCore13JSCSSRuleListD2Ev
+__ZN7WebCore11CSSRuleListD1Ev
+__ZN7WebCore11CSSRuleListD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE6shrinkEm
+__ZN7WebCore18JSCSSRulePrototypeD1Ev
+__ZN7WebCore23JSCSSStyleRulePrototypeD1Ev
+__ZN7WebCore14JSCSSStyleRuleD1Ev
+__ZN7WebCore9JSCSSRuleD2Ev
+__ZN7WebCore18JSImageConstructorD1Ev
+__ZN7WebCore27JSHTMLImageElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLImageElementD1Ev
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototypeD1Ev
+__ZN7WebCore24JSWebKitCSSKeyframesRuleD1Ev
+__ZThn8_N7WebCore16HTMLImageElementD0Ev
+__ZN7WebCore16HTMLImageElementD0Ev
+__ZN7WebCore15HTMLImageLoaderD1Ev
+__ZN7WebCore15HTMLImageLoaderD2Ev
+__ZN7WebCore11ImageLoaderD2Ev
+__ZN7WebCore20ImageLoadEventSender15cancelLoadEventEPNS_11ImageLoaderE
+__ZN7WebCore12NamedNodeMap17detachFromElementEv
+__ZN3WTF9HashTableIPKN7WebCore4NodeESt4pairIS4_PNS1_12NodeRareDataEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHash
+__ZN7WebCore24JSProgressEventPrototypeD1Ev
+__ZN7WebCore15JSProgressEventD1Ev
+__ZN7WebCore26JSHTMLBodyElementPrototypeD1Ev
+__ZN7WebCore17JSHTMLBodyElementD1Ev
+__ZN7WebCore31JSWebKitAnimationEventPrototypeD1Ev
+__ZN7WebCore22JSWebKitAnimationEventD1Ev
+__ZN7WebCore20WebKitAnimationEventD0Ev
+__ZN7WebCore12DocumentTypeD0Ev
+__ZN7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCore15HTMLMetaElementD0Ev
+__ZN7WebCore16HTMLTitleElementD0Ev
+__ZN7WebCore17HTMLScriptElementD0Ev
+__ZN7WebCore17ScriptElementDataD1Ev
+__ZN7WebCore17ScriptElementDataD2Ev
+__ZN7WebCore17ScriptElementData15stopLoadRequestEv
+__ZN7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore19CachedCSSStyleSheet17allClientsRemovedEv
+__ZN7WebCore11HTMLElementD0Ev
+__ZN7WebCore16HTMLAudioElementD0Ev
+__ZN7WebCore16HTMLMediaElementD2Ev
+__ZN7WebCore8Document40unregisterForDocumentActivationCallbacksEPNS_7ElementE
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Id
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInval
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore8Document33unregisterForMediaVolumeCallbacksEPNS_7ElementE
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE6shrinkEm
+__ZN7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore11CachedImage17allClientsRemovedEv
+__ZN7WebCore11BitmapImage14resetAnimationEv
+__ZN7WebCore11BitmapImage13stopAnimationEv
+__ZN7WebCore11BitmapImage29destroyDecodedDataIfNecessaryEb
+__ZN7WebCore18HTMLHeadingElementD0Ev
+__ZN7WebCore16HTMLVideoElementD0Ev
+__ZN7WebCore29CSSMappedAttributeDeclarationD0Ev
+__ZN7WebCore13StyledElement25removeMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore14CachedResource16deleteIfPossibleEv
+__ZN7WebCore9FontValueD0Ev
+__ZN7WebCore15FontFamilyValueD0Ev
+__ZN7WebCore17CSSPrimitiveValueD2Ev
+__ZN7WebCore13CSSImageValueD0Ev
+__ZN7WebCore16StyleCachedImageD0Ev
+__ZN7WebCore15CSSReflectValueD0Ev
+__ZN7WebCore19CSSBorderImageValueD0Ev
+__ZN7WebCore16CSSGradientValueD0Ev
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE6shrinkEm
+__ZN7WebCore22CSSImageGeneratorValueD2Ev
+__ZN7WebCore19StyleGeneratedImageD0Ev
+__ZN7WebCore22WebKitCSSKeyframesRuleD0Ev
+__ZN7WebCore21WebKitCSSKeyframeRuleD0Ev
+__ZN7WebCore23WebKitCSSTransformValueD0Ev
+__ZN7WebCore12CSSValueListD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_6StringES4_NS1_10StringHashENS_10HashTraitsI
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_13QualifiedNameES4_NS1_17QualifiedNameHashEN
+__ZN3WTF9HashTableIPN7WebCore15DynamicNodeListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deall
+__ZN7WebCore19jsDOMWindowLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow8locationEPN3JSC9ExecStateE
+__ZN7WebCore18jsLocationProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8protocolEv
+__ZN7WebCoreL28createHTMLHeadElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLHeadElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLHeadElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHeadElementEEE
+__ZN7WebCore17JSHTMLHeadElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHeadElementEEE
+__ZN7WebCore18jsNavigatorAppNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase7appNameEv
+__ZN7WebCore17JSHTMLBodyElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSHTMLBodyElement9classInfoEv
+__ZN7WebCore13jsDocumentURLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsDocumentPrototypeFunctionCreateElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument13createElementERKNS_12AtomicStringERi
+__ZN7WebCore8Document11isValidNameERKNS_6StringE
 __ZN7WebCore10StringImpl7isLowerEv
-__ZN7WebCore11RenderTable19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore13HTMLTokenizer14processingDataEv
-__ZN7WebCore15RenderWordBreakC2EPNS_11HTMLElementE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZNK7WebCore15RenderWordBreak11isWordBreakEv
-__ZThn8_N7WebCore17PlatformScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore17PlatformScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZThn8_NK7WebCore17PlatformScrollbar6heightEv
-__ZNK7WebCore17PlatformScrollbar6heightEv
-__ZN7WebCore16HTMLLabelElement9setActiveEbb
-__ZN7WebCore16HTMLLabelElement10setHoveredEb
-__ZN7WebCore16HTMLLabelElement20correspondingControlEv
-__ZN7WebCore16HTMLLabelElement19defaultEventHandlerEPNS_5EventE
--[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]
-__ZN7WebCore14ResourceLoader21willStopBufferingDataEPNS_14ResourceHandleEPKci
-__ZN7WebCore14ResourceLoader21willStopBufferingDataEPKci
-__ZN7WebCore4Page6goBackEv
-__ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore11FrameLoader8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
-__ZN7WebCore11FrameLoader17recursiveGoToItemEPNS_11HistoryItemES2_NS_13FrameLoadTypeE
-__ZNK7WebCore11HistoryItem12isTargetItemEv
-__ZN7WebCore11FrameLoader8loadItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore11HistoryItem8formDataEv
-__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
-__ZN7WebCore11FrameLoader33loadProvisionalItemFromCachedPageEv
-__ZN7WebCore11FrameLoader37updateHistoryForBackForwardNavigationEv
-__ZN7WebCore14FormElementKeyC2EPNS_16AtomicStringImplES2_
-__ZNK7WebCore14FormElementKey3refEv
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SC_EERKT_
-__ZN3WTF7HashMapIN7WebCore14FormElementKeyENS_6VectorINS1_6StringELm0EEENS1_18FormElementKeyHashENS1_24FormElementKeyHashTraitsENS_10HashTraitsIS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E3addIS2_S6_NS_17HashMapTranslatorILb1ES7_NS_18PairBaseHashTraitsISC_SE_EESF_SA_EEEES3_INS_17HashTableIteratorIS2_S7_S9_SA_SF_SC_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E6expandEv
-__ZN7WebCore14FormElementKeyC2ERKS0_
-__ZN3WTF6VectorIN7WebCore6StringELm0EEC2ERKS3_
-__ZN7WebCore14FormElementKeyD2Ev
-__ZNK7WebCore14FormElementKey5derefEv
-__ZN7WebCore18FormElementKeyHash4hashERKNS_14FormElementKeyE
-__ZN7WebCore14FormElementKeyaSERKS0_
-__ZN7WebCore8Document23takeStateForFormElementEPNS_16AtomicStringImplES2_RNS_6StringE
-__ZN7WebCore24FormElementKeyHashTraits12deletedValueEv
-__ZN7WebCore16HTMLInputElement12restoreStateERKNS_6StringE
-__ZN7WebCore17HTMLSelectElement12restoreStateERKNS_6StringE
-__ZN7WebCore11FrameLoader33restoreScrollPositionAndViewStateEv
-__ZNK7WebCore9FrameView17wasScrolledByUserEv
-__ZNK7WebCore11HistoryItem11scrollPointEv
-__ZN7WebCore9FrameView14setContentsPosEii
-__ZN7WebCore10ScrollView14setContentsPosEii
-__ZN7WebCore7Element15willSaveToCacheEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE6shrinkEm
-__ZNK7WebCore18JSHTMLEmbedElement14implementsCallEv
-__ZN7WebCore27runtimeObjectImplementsCallEPNS_11HTMLElementE
-__ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E4swapERS7_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES7_EENS6_INS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEEEEE8derefAllERS8_
-__ZN7WebCore10HTMLParser10createHeadEv
-__ZNK7WebCore16CSSStyleSelector14largerFontSizeEfb
-__ZN7WebCore10HTMLParser19moveOneBlockToStackERPNS_13HTMLStackElemE
-__ZN7WebCore15GraphicsContext11drawEllipseERKNS_7IntRectE
-__ZN7WebCore12EventHandler22defaultTabEventHandlerEPNS_13KeyboardEventE
-__ZN7WebCore15FocusController12advanceFocusENS_14FocusDirectionEPNS_13KeyboardEventEb
-__ZN7WebCore8Document17nextFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
-__ZN7WebCore25nextNodeWithExactTabIndexEPNS_4NodeEiPNS_13KeyboardEventE
-__ZNK7WebCore4Node19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore16HTMLInputElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZN7WebCore17deepFocusableNodeENS_14FocusDirectionEPNS_4NodeEPNS_13KeyboardEventE
-__ZNK7WebCore4Node19isFrameOwnerElementEv
-__ZN7WebCore8Document35setUseSecureKeyboardEntryWhenActiveEb
-__ZN7WebCore5Frame33updateSecureKeyboardEntryIfActiveEv
-__ZN7WebCore21PlatformKeyboardEvent20currentCapsLockStateEv
-__ZN7WebCore10StringImpl6secureEt
-__ZN7WebCore11FrameLoader4postERKNS_4KURLERKNS_6StringES6_N3WTF10PassRefPtrINS_8FormDataEEES6_PNS_5EventEPNS_15HTMLFormElementERKNS7_7HashMapIS4_S4_NS_10StringHashENS7_10HashTraitsIS4_EESI_EE
-__ZN7WebCore11FrameLoader50didReceiveServerRedirectForProvisionalLoadForFrameEv
-__ZNK7WebCore6String8toDoubleEPb
-__ZN7WebCore10StringImpl8toDoubleEPb
-__ZN7WebCore11FrameLoader23scheduleHTTPRedirectionEdRKNS_6StringE
-__ZN7WebCore11FrameLoader16isLocationChangeERKNS_20ScheduledRedirectionE
-__ZN7WebCore15HTMLBodyElement14createLinkDeclEv
-__ZN7WebCore26jsLocationProtoFuncReplaceEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13HTMLTokenizer11stopParsingEv
-__ZN7WebCore11FrameLoader22tokenizerProcessedDataEv
-__ZN7WebCore13PageURLRecordD2Ev
-__ZN7WebCore17disabledTextColorERKNS_5ColorES2_
-__ZNK7WebCore5Color5lightEv
-__ZNK7WebCore11RenderTheme16adjustRadioStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac12setRadioSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac10radioSizesEv
-__ZN7WebCore14RenderThemeMac10paintRadioEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac17setRadioCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac5radioEv
-__ZNK7WebCore14RenderThemeMac12radioMarginsEv
-__ZNK7WebCore28MouseEventWithHitTestResults10localPointEv
-__ZN7WebCore11RenderBlock22positionForCoordinatesEii
-__ZN7WebCore11RenderLayer12scrollOffsetERiS1_
-__ZN7WebCore9SelectionC2ERKNS_15VisiblePositionE
-__ZN7WebCore12IconDatabase28removePageURLFromSQLDatabaseERKNS_6StringE
-_reparentChildPages
-_reparentPage
--[DOMHTMLFormElement method]
-__ZNK7WebCore15HTMLFormElement6methodEv
-__ZN7WebCore6Chrome19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
-__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
-__ZN7WebCore17HTMLSelectElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore17HTMLSelectElement27menuListDefaultEventHandlerEPNS_5EventE
-__ZN7WebCore17cdataBlockHandlerEPvPKhi
-__ZN7WebCore12XMLTokenizer10cdataBlockEPKhi
-__ZN7WebCore12CDATASectionC1EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore12CDATASection8nodeTypeEv
-__ZN7WebCore23JSCDATASectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSCDATASectionC1EPN3KJS8JSObjectEPNS_12CDATASectionE
-__ZN7WebCore14JSCDATASection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore12EventHandler14allowDHTMLDragERbS1_
-__ZNK7WebCore10ScrollView16contentsToWindowERKNS_8IntPointE
-__ZN7WebCore14DragController24delegateDragSourceActionERKNS_8IntPointE
-__ZNK7WebCore12RenderObject13draggableNodeEbbiiRb
-__ZNK7WebCore12EventHandler18shouldDragAutoNodeEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore14DragController27mayStartDragAtEventLocationEPKNS_5FrameERKNS_8IntPointE
-__ZNK7WebCore13HitTestResult5imageEv
-__ZN7WebCore12EventHandler16handleAutoscrollEPNS_12RenderObjectE
-__ZN7WebCore12EventHandler20startAutoscrollTimerEv
-__ZN7WebCore12EventHandler27updateSelectionForMouseDragEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore12EventHandler24canMouseDragExtendSelectEPNS_4NodeE
-__ZN7WebCore9Selection9setExtentERKNS_15VisiblePositionE
-__ZNK7WebCore5Frame20selectionGranularityEv
-__ZN7WebCore12RenderObject14stopAutoscrollEv
-__ZNK7WebCore17RegularExpression13matchedLengthEv
-__ZN7WebCore22DeleteSelectionCommand10removeNodeEPNS_4NodeE
-__ZN7WebCore20isTableStructureNodeEPKNS_4NodeE
-__ZN7WebCore28updatePositionForNodeRemovalEPNS_4NodeERNS_8PositionE
-__ZN7WebCore20CompositeEditCommand10removeNodeEPNS_4NodeE
-__ZN7WebCore17RemoveNodeCommandC2EPNS_4NodeE
-__ZN7WebCore17RemoveNodeCommand7doApplyEv
-__ZN7WebCore18createBreakElementEPNS_8DocumentE
-__ZN7WebCore8Document15createElementNSERKNS_6StringES3_Ri
-__ZNK7WebCore8RenderBR14caretMinOffsetEv
-__ZNK7WebCore16PositionIterator11atEndOfNodeEv
-__ZN7WebCore20CompositeEditCommand16insertNodeBeforeEPNS_4NodeES2_
-__ZN7WebCore23InsertNodeBeforeCommandC2EN3WTF10PassRefPtrINS_4NodeEEEPS3_
-__ZN7WebCore23InsertNodeBeforeCommand7doApplyEv
-__ZNK7WebCore22HTMLGenericFormElement16isMouseFocusableEv
-__ZNK7WebCore16HTMLInputElement17canStartSelectionEv
-__ZNK7WebCore15HTMLFormElement19CheckedRadioButtons21checkedButtonForGroupERKNS_12AtomicStringE
-__ZN7WebCore17HTMLSelectElement18dispatchFocusEventEv
-__ZN7WebCore17HTMLSelectElement17saveLastSelectionEv
-__ZNK7WebCore4Node20shouldUseInputMethodEv
-__ZN7WebCore7Element21updateFocusAppearanceEb
-__ZNK7WebCore13ContainerNode7getRectEv
-__ZNK7WebCore13ContainerNode18getUpperLeftCornerERiS1_
-__ZNK7WebCore13ContainerNode19getLowerRightCornerERiS1_
-__ZN7WebCore14RenderMenuList9showPopupEv
-__ZN7WebCore9PopupMenuC2EPNS_15PopupMenuClientE
-__ZN7WebCore9PopupMenu4showERKNS_7IntRectEPNS_9FrameViewEi
-__ZN7WebCore9PopupMenu8populateEv
-__ZThn136_NK7WebCore14RenderMenuList13shouldPopOverEv
-__ZNK7WebCore14RenderMenuList13shouldPopOverEv
-__ZThn136_NK7WebCore14RenderMenuList8listSizeEv
-__ZNK7WebCore14RenderMenuList8listSizeEv
-__ZThn136_NK7WebCore14RenderMenuList15itemIsSeparatorEj
-__ZNK7WebCore14RenderMenuList15itemIsSeparatorEj
-__ZThn136_NK7WebCore14RenderMenuList9itemStyleEj
-__ZNK7WebCore14RenderMenuList9itemStyleEj
-__ZThn136_NK7WebCore14RenderMenuList8itemTextEj
-__ZNK7WebCore14RenderMenuList8itemTextEj
-__ZThn136_NK7WebCore14RenderMenuList13itemIsEnabledEj
-__ZNK7WebCore14RenderMenuList13itemIsEnabledEj
-__ZThn136_NK7WebCore14RenderMenuList11clientStyleEv
-__ZNK7WebCore14RenderMenuList11clientStyleEv
-__ZN7WebCore12EventHandler14currentNSEventEv
-__ZN7WebCore5Frame13willPopupMenuEP6NSMenu
--[WebCoreFrameBridge accessibilityTree]
-__ZN7WebCore13AXObjectCache3getEPNS_12RenderObjectE
-__ZN3WTF7HashMapIPN7WebCore12RenderObjectEP15WebCoreAXObjectNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-+[WebCoreAXObject initialize]
--[WebCoreAXObject initWithRenderer:]
--[WebCoreAXObject _accessibilityParentForSubview:]
--[WebCoreAXObject rendererForView:]
-__ZN7WebCore13AXObjectCache25postNotificationToElementEPNS_12RenderObjectERKNS_6StringE
-__ZThn136_N7WebCore14RenderMenuList9hidePopupEv
-__ZN7WebCore14RenderMenuList9hidePopupEv
-__ZN7WebCore9PopupMenu4hideEv
-__ZThn136_N7WebCore14RenderMenuList12valueChangedEjb
-__ZN7WebCore14RenderMenuList12valueChangedEjb
-__ZNK7WebCore17HTMLSelectElement17listToOptionIndexEi
-__ZN7WebCore17HTMLSelectElement16setSelectedIndexEibb
-__ZN7WebCore17HTMLSelectElement29setActiveSelectionAnchorIndexEi
-__ZN3WTF6VectorIbLm0EE14expandCapacityEmPKb
-__ZN3WTF6VectorIbLm0EE14expandCapacityEm
-__ZN3WTF6VectorIbLm0EE15reserveCapacityEm
-__ZN7WebCore17HTMLSelectElement13deselectItemsEPNS_17HTMLOptionElementE
-__ZN7WebCore17HTMLSelectElement16menuListOnChangeEv
-__ZN7WebCore12EventHandler33sendFakeEventsAfterWidgetTrackingEP7NSEvent
-__ZN7WebCore17HTMLSelectElement17dispatchBlurEventEv
-__ZN7WebCore13AXObjectCache29handleFocusedUIElementChangedEv
-__ZNK7WebCore16HTMLLabelElement11isFocusableEv
-__ZN7WebCore10RenderText22positionForCoordinatesEii
-__ZNK7WebCore13InlineTextBox17offsetForPositionEib
-__ZNK7WebCore4Font17offsetForPositionERKNS_7TextRunEib
-__ZNK7WebCore4Font30offsetForPositionForSimpleTextERKNS_7TextRunEib
-__ZN7WebCore13WidthIterator19advanceOneCharacterERfPNS_11GlyphBufferE
-__ZN7WebCore17positionAfterNodeEPKNS_4NodeE
-__ZN7WebCore13AXObjectCache16postNotificationEPNS_12RenderObjectERKNS_6StringE
--[WebCoreAXObject observableObject]
-__ZN7WebCore18createLabelWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLLabelElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLLabelElementC1EPN3KJS8JSObjectEPNS_16HTMLLabelElementE
-__ZN7WebCore18JSHTMLLabelElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22createParagraphWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore31JSHTMLParagraphElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLParagraphElementC1EPN3KJS8JSObjectEPNS_20HTMLParagraphElementE
-__ZN7WebCore22JSHTMLParagraphElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement14appendFormDataERNS_12FormDataListEb
-__ZNK7WebCore17HTMLOptionElement5valueEv
-__ZN7WebCore22HTMLGenericFormElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore13AXObjectCache15childrenChangedEPNS_12RenderObjectE
--[WebCoreAXObject childrenChanged]
--[WebCoreAXObject clearChildren]
--[WebCoreAXObject accessibilityIsIgnored]
--[WebCoreAXObject isAttachment]
--[WebCoreAXObject isWebArea]
--[WebCoreAXObject detach]
--[WebCoreAXObject removeAXObjectID]
--[WebCoreAXObject dealloc]
-__ZN7WebCore20JSHTMLHeadingElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23JSCDATASectionPrototypeD0Ev
-__ZN3WTF6VectorIPN7WebCore5FrameELm16EE6shrinkEm
-__ZNK7WebCore12RenderObject15canHaveChildrenEv
-__ZN7WebCore17objectConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLObjectElementC1EPNS_8DocumentEb
+__ZN7WebCoreL17objectConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLObjectElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17HTMLObjectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22HTMLPlugInImageElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLPlugInElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_7ElementE
+__ZN7WebCoreL30createHTMLObjectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLObjectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLObjectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLObjectElementEEE
+__ZN7WebCore19JSHTMLObjectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLObjectElementEEE
+__ZN7WebCore19JSHTMLObjectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLObjectElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_17HTMLObjectElementERKNS1_10IdentifierE
+__ZN7WebCore19JSHTMLObjectElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore37runtimeObjectCustomGetOwnPropertySlotEPN3JSC9ExecStateERKNS0_10IdentifierERNS0_12PropertySlotEPNS_13JSHTMLElement
+__ZN7WebCoreL16getRuntimeObjectEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCoreL14pluginInstanceEPNS_4NodeE
+__ZNK7WebCore17HTMLPlugInElement11getInstanceEv
+__ZNK7WebCore17HTMLObjectElement25renderWidgetForJSBindingsEv
+__ZN7WebCore28JSHTMLObjectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsElementPrototypeFunctionSetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSHTMLObjectElement9classInfoEv
+__ZN7WebCore9JSElement12setAttributeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore7Element12setAttributeERKNS_12AtomicStringES3_Ri
+__ZNK7WebCore17HTMLPlugInElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore17HTMLObjectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLPlugInElement17endTagRequirementEv
-__ZNK7WebCore17HTMLObjectElement11tagPriorityEv
+__ZN7WebCore17HTMLPlugInElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore19JSHTMLObjectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSHTMLObjectElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22runtimeObjectCustomPutEPN3JSC9ExecStateERKNS0_10IdentifierENS0_7JSValueEPNS_11HTMLElementERNS0_15PutPropertySlotE
+__ZN7WebCore18setJSHTMLElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement5setIdERKNS_6StringE
+__ZN7WebCore17JSHTMLHeadElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsNodePrototypeFunctionAppendChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSHTMLHeadElement9classInfoEv
+__ZN7WebCore6JSNode11appendChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore6toNodeEN3JSC7JSValueE
+__ZN7WebCore13ContainerNode11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
+__ZN7WebCore4Node13checkAddChildEPS0_Ri
+__ZN7WebCore8Document19nodeChildrenChangedEPNS_13ContainerNodeE
+__ZN7WebCoreL20disableRangeMutationEPNS_4PageE
+__ZN7WebCore4Node30notifyNodeListsChildrenChangedEv
+__ZN7WebCore4Node35notifyLocalNodeListsChildrenChangedEv
+__ZN7WebCore17NodeListsNodeData16invalidateCachesEv
+__ZN7WebCore15DynamicNodeList6Caches5resetEv
+__ZN7WebCoreL28dispatchChildInsertionEventsEPNS_4NodeERi
 __ZN7WebCore17HTMLObjectElement20insertedIntoDocumentEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3setERKS3_RKi
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCore4Node10lazyAttachEv
+__ZN7WebCore17HTMLObjectElement13canLazyAttachEv
+__ZN7WebCore17HTMLObjectElement6detachEv
+__ZN7WebCore17HTMLPlugInElement6detachEv
 __ZN7WebCore17HTMLObjectElement6attachEv
-__ZN7WebCore17HTMLObjectElement11isImageTypeEv
-__ZN7WebCore17HTMLObjectElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17HTMLObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore22HTMLPlugInImageElement11isImageTypeEv
+__ZN7WebCore17HTMLPlugInElement20updateWidgetCallbackEPNS_4NodeE
 __ZN7WebCore17HTMLObjectElement12updateWidgetEv
-__ZN7WebCore16paramConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLParamElementC2EPNS_8DocumentE
-__ZN7WebCore16HTMLParamElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLParamElement17endTagRequirementEv
-__ZNK7WebCore16HTMLParamElement11tagPriorityEv
-__ZN7WebCore17HTMLPlugInElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLObjectElement15childrenChangedEb
-__ZN7WebCore17HTMLObjectElement18updateDocNamedItemEv
-__ZN7WebCore17HTMLObjectElement21finishParsingChildrenEv
-__ZN7WebCore17HTMLObjectElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCore17HTMLObjectElement6detachEv
-__ZNK7WebCore17HTMLPlugInElement4nameEv
-__ZN3WTF6VectorIcLm256EE14expandCapacityEm
-__ZN3WTF6VectorIcLm256EE15reserveCapacityEm
-__ZNK3KJS6Window17printErrorMessageERKN7WebCore6StringE
-__ZN7WebCore17HTMLObjectElementD1Ev
-__ZN7WebCore9PageCache11autoreleaseEN3WTF10PassRefPtrINS_10CachedPageEEE
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore10CachedPageEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore9PageCache17removeFromLRUListEPNS_11HistoryItemE
-__ZNK7WebCore14RenderThemeMac19adjustTextAreaStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore19HTMLTextAreaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16scrollCornerRectEPNS_12RenderObjectERKNS_7IntRectE
-__ZN7WebCore5TimerINS_9PageCacheEE5firedEv
-__ZN7WebCore9PageCache39releaseAutoreleasedPagesNowOrRescheduleEPNS_5TimerIS0_EE
-__ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
-__ZN7WebCore12userIdleTimeEv
-__ZN7WebCore10CachedPage5clearEv
-__ZN7WebCore9FrameView10clearFrameEv
-__ZN7WebCore15HTMLImageLoaderD1Ev
-__ZN3KJS21SavedBuiltinsInternalD2Ev
-__ZN3KJS12ProtectedPtrINS_20NativeErrorPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ErrorPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15RegExpPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_13DatePrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15NumberPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15StringPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_16BooleanPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ArrayPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_17FunctionPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15ObjectPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_14NativeErrorImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ErrorObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15RegExpObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_13DateObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15NumberObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15StringObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_16BooleanObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ArrayObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_17FunctionObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15ObjectObjectImpEED1Ev
-__ZN7WebCore10CachedPageD2Ev
-__ZN7WebCore19HTMLTextAreaElement23rendererWillBeDestroyedEv
-__ZN7WebCore13WidthIterator21normalizeVoicingMarksEi
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE5embedEN3WTF7Unicode9DirectionE
-__ZNK7WebCore4Font24floatWidthForComplexTextERKNS_7TextRunE
-__ZN7WebCore20ATSULayoutParameters10initializeEPKNS_4FontEPKNS_15GraphicsContextE
-__ZN7WebCore19initializeATSUStyleEPKNS_14SimpleFontDataE
-__ZNK7WebCore4Font21fontDataForCharactersEPKti
-__ZNK7WebCore16FontFallbackList21fontDataForCharactersEPKNS_4FontEPKti
-__ZNK7WebCore14SimpleFontData17checkShapesArabicEv
-__ZN7WebCore23overrideLayoutOperationEmP14ATSGlyphVectormPvPm
-__ZN7WebCore27disposeATSULayoutParametersEPNS_20ATSULayoutParametersE
-__ZNK7WebCore11BidiContext5derefEv
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE11reverseRunsEii
-__ZNK7WebCore9InlineBox16prevOnLineExistsEv
-__ZNK7WebCore4Font15drawComplexTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZN7WebCore14RenderFieldset19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore8Position19uncheckedNextOffsetEPKNS_4NodeEi
-__ZN7WebCore12RenderObject9inlineBoxEiNS_9EAffinityE
-__ZNK7WebCore14RenderReplaced14caretMinOffsetEv
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE15reserveCapacityEm
-__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxEiPFbPKS1_S5_EEvT_S8_T0_T1_
-__ZSt22__final_insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
-__ZSt16__insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE6shrinkEm
-__ZNK7WebCore12RenderObject10isMenuListEv
--[WebCoreAXObject mouseButtonListener]
--[WebCoreAXObject parentObject]
-__ZNK7WebCore11FrameLoader14initialRequestEv
-__ZN7WebCore27JSHTMLLabelElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLLabelElement9classInfoEv
-__ZN7WebCore11HTMLElement8setTitleERKNS_6StringE
-__ZN7WebCore19CachedCSSStyleSheet11setEncodingERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE15reserveCapacityEm
-__ZN7WebCore17StyleMultiColDataC2ERKS0_
-__ZNK7WebCore12RenderObject11overflowTopEb
-__ZNK7WebCore11RenderBlock9columnGapEv
-__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
-__ZN7WebCore10RenderView18setBestTruncatedAtEiPNS_12RenderObjectEb
-__ZNK7WebCore11RenderBlock11columnRectsEv
-__ZNK7WebCore11RenderBlock20adjustRectForColumnsERNS_7IntRectE
-__ZN7WebCore16RenderListMarker12imageChangedEPNS_11CachedImageE
-__ZN7WebCore13InlineFlowBox11extractLineEv
-__ZN7WebCore10RenderFlow14extractLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore13InlineTextBox11extractLineEv
-__ZN7WebCore10RenderText14extractTextBoxEPNS_13InlineTextBoxE
-__ZZN7WebCore11RenderBlock14matchedEndLineERKNS_12BidiIteratorERKNS_10BidiStatusES3_S6_RPNS_13RootInlineBoxERiSA_SA_E8numLines
-__ZN7WebCoreeqERKNS_11BidiContextES2_
-__ZN7WebCore13InlineFlowBox10attachLineEv
-__ZN7WebCore10RenderFlow13attachLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore13InlineTextBox10attachLineEv
-__ZN7WebCore10RenderText13attachTextBoxEPNS_13InlineTextBoxE
-__ZN7WebCore15compareBoxStartEPKNS_13InlineTextBoxES2_
-__ZSt25__unguarded_linear_insertIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EEvT_T0_T1_
-__ZN7WebCore16equalIgnoringRefERKNS_4KURLES2_
-__ZN7WebCore11FrameLoader47callContinueFragmentScrollAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore11FrameLoader43continueFragmentScrollAfterNavigationPolicyERKNS_15ResourceRequestEb
-__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
-__ZN7WebCore11FrameLoader31addHistoryItemForFragmentScrollEv
-__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
-__ZN7WebCore11FrameLoader10gotoAnchorERKNS_6StringE
-__ZN7WebCore8Document12setCSSTargetEPNS_4NodeE
-__ZNK7WebCore10RenderText7minXPosEv
-__ZNK7WebCore10RenderText5widthEv
-__ZNK7WebCore10RenderText4yPosEv
-__ZN7WebCore14PausedTimeoutsD1Ev
-__ZN7WebCore4Page23clearUndoRedoOperationsEv
-__ZN7WebCore14DragController9dragEndedEv
-__ZN7WebCore4PageD1Ev
-__ZN7WebCore15BackForwardList5closeEv
-__ZN7WebCore15ProgressTrackerD2Ev
-__ZN7WebCore19InspectorControllerD2Ev
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS8_IS5_EEEEKNS1_INS2_INS3_5FrameEEESC_NS_7PtrHashISE_EENS8_ISE_EENS8_ISC_EEEEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore14ConsoleMessageELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS3_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEESA_EESA_EENS_18PairBaseHashTraitsINS9_INS_6RefPtrIN7WebCore17SubresourceLoaderEEEEENS9_IPNSF_7RequestEEEEEE8derefAllERSC_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS3_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS9_IiEEEESA_EENS_18PairBaseHashTraitsISA_NS9_INS_6RefPtrIN7WebCore17InspectorResourceEEEEEEEE6refAllERSD_
-__ZN3WTF9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS2_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS8_IiEEEES9_EC1ERKSC_
-__ZN7WebCore21ContextMenuControllerD2Ev
-__ZN7WebCore14DragControllerD2Ev
-__ZN7WebCore6ChromeD2Ev
-__ZN7WebCore15BackForwardListD1Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore10PluginInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE6shrinkEm
-__ZN3WTF15deleteAllValuesIPN7WebCore13MimeClassInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore13CSSImportRuleD1Ev
-_sqlite3BtreeDelete
--[DOMHTMLInputElement(FormAutoFillTransition) _selectedRange]
--[DOMHTMLInputElement(WebCoreInternal) _HTMLInputElement]
-__ZNK7WebCore16HTMLInputElement14selectionStartEv
-__ZNK7WebCore16HTMLInputElement12selectionEndEv
--[DOMHTMLInputElement(FormAutoFillTransition) _replaceCharactersInRange:withString:selectingFromIndex:]
-__ZN7WebCore10StringImpl7replaceEjjPS0_
-__ZN7WebCore13InlineTextBox14paintSelectionEPNS_15GraphicsContextEiiPNS_11RenderStyleEPKNS_4FontE
-__ZN7WebCore13InlineTextBox17selectionStartEndERiS1_
-__ZNK7WebCore12RenderObject24selectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme30activeSelectionBackgroundColorEv
-__ZNK7WebCore14RenderThemeMac38platformActiveSelectionBackgroundColorEv
-__ZNK7WebCore5Color14blendWithWhiteEv
-__ZN7WebCore14blendComponentEii
-__ZN7WebCore15GraphicsContext20drawHighlightForTextERKNS_7TextRunERKNS_8IntPointEiRKNS_5ColorEii
-__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorE
-__ZNK7WebCore12RenderObject24selectionForegroundColorEv
-__ZNK7WebCore11RenderTheme38platformActiveSelectionForegroundColorEv
-__ZN7WebCore20CompositeEditCommand15deleteSelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommandC2EPNS_8DocumentEbbbb
-__ZN7WebCore11RenderBlock21fillRightSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
-__ZN7WebCore21blockquoteConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore21HTMLBlockquoteElementC2EPNS_8DocumentE
-__ZNK7WebCore21HTMLBlockquoteElement17endTagRequirementEv
-__ZNK7WebCore21HTMLBlockquoteElement11tagPriorityEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLTableElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLTableElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLTableElement4rowsEv
-__ZN7WebCore23HTMLTableRowsCollectionC1EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
-__ZN3KJS17staticValueGetterIN7WebCore15JSCharacterDataEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSCharacterData16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore23HTMLTableRowsCollection9itemAfterEPNS_7ElementE
-__ZN7WebCore23HTMLTableRowsCollection8rowAfterEPNS_16HTMLTableElementEPNS_19HTMLTableRowElementE
-__ZN7WebCore8isInHeadEPNS_7ElementE
-__ZN7WebCore15JSCharacterData3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore15JSCharacterData16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore11RenderTable14recalcSectionsEv
-__ZN7WebCore18RenderTableSection11recalcCellsEv
-__ZNK7WebCore18RenderTableSection10numColumnsEv
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6resizeEm
-__ZN7WebCore23HTMLTableRowsCollectionD1Ev
-__ZN7WebCore8Document9setDomainERKNS_6StringE
-__ZN7WebCore14SecurityOrigin16setDomainFromDOMERKNS_6StringE
-__ZN7WebCore19inputElementAltTextEv
-__ZN7WebCore18MainResourceLoader15handleEmptyLoadERKNS_4KURLEb
-__ZNK7WebCore17HTMLSelectElement6lengthEv
-__ZN7WebCore17HTMLSelectElement7optionsEv
-__ZN7WebCore21HTMLOptionsCollectionC1EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
-__ZN7WebCore32JSHTMLOptionsCollectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore23JSHTMLOptionsCollectionC1EPN3KJS8JSObjectEPNS_21HTMLOptionsCollectionE
-__ZN7WebCore23JSHTMLOptionsCollection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLOptionsCollectionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19createOptionWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLOptionElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLOptionElementC1EPN3KJS8JSObjectEPNS_17HTMLOptionElementE
-__ZN7WebCore19JSHTMLOptionElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLOptionElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLOptionElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore19JSHTMLOptionElement4implEv
-__ZN7WebCore19JSHTMLOptionElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLOptionElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLOptionElement11setSelectedEb
-__ZNK7WebCore17HTMLOptionElement5indexEv
-__ZN7WebCore22JSNamedNodesCollectionC1EPN3KJS8JSObjectERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC2ERKS5_
-__ZN7WebCore22JSNamedNodesCollection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSNamedNodesCollection11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLOptionElementConstructorC2EPN3KJS9ExecStateEPNS_8DocumentE
-__ZNK7WebCore30JSHTMLOptionElementConstructor19implementsConstructEv
-__ZN7WebCore30JSHTMLOptionElementConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore17HTMLOptionElement8setValueERKNS_6StringE
-__ZN7WebCore23JSHTMLOptionsCollection3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23JSHTMLOptionsCollection11indexSetterEPN3KJS9ExecStateEjPNS1_7JSValueEi
-__ZNK7WebCore23JSHTMLOptionsCollection4implEv
-__ZN7WebCore17selectIndexSetterEPNS_17HTMLSelectElementEPN3KJS9ExecStateEjPNS2_7JSValueE
-__ZN7WebCore19toHTMLOptionElementEPN3KJS7JSValueE
-__ZNK7WebCore19JSHTMLOptionElement9classInfoEv
-__ZN7WebCore17HTMLSelectElement9setOptionEjPNS_17HTMLOptionElementERi
-__ZN7WebCore17HTMLSelectElement3addEPNS_11HTMLElementES2_Ri
-__ZN7WebCore17HTMLSelectElement12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Ri
-__ZN7WebCore17HTMLSelectElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore9DOMWindow7setNameERKNS_6StringE
-__ZN3KJS9MimeTypes10nameGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS8MimeType18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_8MimeTypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS8MimeType16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore10CachedPage9timeStampEv
-__ZN7WebCore10CachedPage14documentLoaderEv
-__ZN7WebCore14DocumentLoader18loadFromCachedPageEN3WTF10PassRefPtrINS_10CachedPageEEE
-__ZN7WebCore14DocumentLoader12setCommittedEb
-__ZN7WebCore10CachedPage22cachedPagePlatformDataEv
-__ZN7WebCore11FrameLoader4openERNS_10CachedPageE
-__ZN7WebCore10CachedPage7restoreEPNS_4PageE
-__ZN3KJS6Window14resumeTimeoutsEPN7WebCore14PausedTimeoutsE
-__ZN7WebCore19AnimationController16resumeAnimationsEv
-__ZN7WebCore12EventHandler17setMousePressNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore8Document19didRestoreFromCacheEv
--[WebCoreFrameBridge reapplyStylesForDeviceType:]
-__ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
-__ZNK7WebCore17StyleMultiColDataeqERKS0_
-__ZNK7WebCore14DocumentLoader9responsesEv
-__ZN7WebCore11FrameLoader19requestFromDelegateERNS_15ResourceRequestERmRNS_13ResourceErrorE
-__ZN7WebCore4KURLaSERKS0_
-__ZN7WebCore19ResourceRequestBaseD2Ev
-__ZN7WebCore11FrameLoader29sendRemainingDelegateMessagesEmRKNS_16ResourceResponseEiRKNS_13ResourceErrorE
-__ZN7WebCore28JSHTMLOptionElementPrototypeD0Ev
-__ZN3WTF6VectorIbLm0EE6shrinkEm
-__ZNK7WebCore10HTMLParser8isInlineEPNS_4NodeE
-__ZN7WebCore9PopupMenuD2Ev
-__ZN7WebCore10IconLoaderD1Ev
-__ZN7WebCore31JSHTMLParagraphElementPrototypeD0Ev
-__ZN7WebCore19alternateFamilyNameERKNS_12AtomicStringE
-__ZN7WebCore15HTMLFormElement12parseEnctypeERKNS_6StringE
-__ZN7WebCore19HTMLTextAreaElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore19HTMLTextAreaElement15childrenChangedEb
-__ZNK7WebCore19HTMLTextAreaElement12defaultValueEv
-__ZN7WebCore19HTMLTextAreaElement8setValueERKNS_6StringE
-__ZN7WebCore16DeprecatedString7replaceERKS0_S2_
-__ZN7WebCore21createTextAreaWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLTextAreaElementC1EPN3KJS8JSObjectEPNS_19HTMLTextAreaElementE
-__ZNK7WebCore19HTMLTextAreaElement14isEnumeratableEv
-__ZN7WebCore21JSHTMLTextAreaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLTextAreaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLTextAreaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19HTMLTextAreaElement14selectionStartEv
-__ZN7WebCore14RenderThemeMac13paintTextAreaEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore19HTMLTextAreaElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore19HTMLTextAreaElement16isMouseFocusableEv
-__ZNK7WebCore19HTMLTextAreaElement20shouldUseInputMethodEv
-__ZN7WebCore13RootInlineBox23closestLeafChildForXPosEib
-__ZN3WTF6VectorItLm1024EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm1024EE14expandCapacityEm
-__ZN3WTF6VectorItLm1024EE15reserveCapacityEm
-__ZN7WebCore5Frame23textDidChangeInTextAreaEPNS_7ElementE
-+[DOMHTMLTextAreaElement(WebCoreInternal) _wrapHTMLTextAreaElement:]
--[DOMHTMLTextAreaElement form]
--[DOMHTMLTextAreaElement(FormPromptAdditions) _isEdited]
-__ZN7WebCore8RenderBR9inlineBoxEiNS_9EAffinityE
-__ZN7WebCore11RenderBlock26fillHorizontalSelectionGapEPNS_12RenderObjectEiiiiPKNS1_9PaintInfoE
-__ZN7WebCore8RenderBR13selectionRectEb
-__ZNK7WebCore8Position19isRenderedCharacterEv
-__ZN7WebCore14preConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLPreElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore14HTMLPreElement17endTagRequirementEv
-__ZNK7WebCore14HTMLPreElement11tagPriorityEv
-__ZNK7WebCore4Font10spaceWidthEv
-__ZNK7WebCore4Node11textContentEb
-__ZN7WebCore6JSNode16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore4Node14setTextContentERKNS_6StringERi
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLScriptElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLScriptElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLScriptElement3srcEv
-__ZN7WebCore20HTMLFrameElementBase7setNameERKNS_6StringE
-__ZN7WebCore17HTMLIFrameElement8setWidthERKNS_6StringE
-__ZN7WebCore17HTMLIFrameElement9setHeightERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase14setMarginWidthERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase15setMarginHeightERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase14setFrameBorderERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase12setScrollingERKNS_6StringE
+__ZN7WebCoreL10isHTTPOnlyEP12NSHTTPCookie
+__ZN7WebCore33jsDOMWindowHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSHTMLElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23getCachedDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoE
+__ZN7WebCore19cacheDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoEPNS0_8JSObjectE
+__ZN7WebCoreL27createHTMLDivElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLDivElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLDivElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLDivElementEEE
+__ZN7WebCore16JSHTMLDivElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLDivElementEEE
+__ZN7WebCore16JSHTMLDivElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL15formConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCoreL28createHTMLFormElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLFormElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLFormElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFormElementEEE
+__ZN7WebCore17JSHTMLFormElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFormElementEEE
+__ZN7WebCore17JSHTMLFormElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLFormElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_15HTMLFormElementERKNS1_10IdentifierE
+__ZN7WebCore15HTMLFormElement16getNamedElementsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZNK7WebCore14HTMLCollection10namedItemsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZNK7WebCore18HTMLFormCollection15updateNameCacheEv
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EE
+__ZN7WebCore15HTMLFormElement15elementForAliasERKNS_12AtomicStringE
+__ZN7WebCore41jsDocumentPrototypeFunctionCreateTextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4TextE
+__ZN7WebCore6JSText15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCharacterDataPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCharacterData15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSTextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4TextEEE
+__ZN7WebCore6JSTextC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4TextEEE
+__ZN7WebCore15JSCharacterDataC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CharacterDataEEE
+__ZNK7WebCore16JSHTMLDivElement9classInfoEv
+__ZNK7WebCore6JSText9classInfoEv
+__ZN7WebCore4Node16insertedIntoTreeEb
+__ZN7WebCore16JSHTMLDivElementD1Ev
+__ZThn8_N7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore17JSHTMLFormElementD1Ev
+__ZThn8_N7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore15FormDataBuilderD1Ev
+__ZN7WebCore15FormDataBuilderD2Ev
+__ZNK7WebCore26CachedScriptSourceProvider8getRangeEii
+__ZN7WebCore26jsDOMWindowNodeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSNode14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSNodeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsNodeELEMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMWindowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32setJSDOMWindowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_7JSValueEj
+__ZNK7WebCore20JSElementConstructor9classInfoEv
+__ZN7WebCore20JSElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsDOMWindowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7JSEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore18JSEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSHTMLElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowPrototypeFunctionSetIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow11setIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15ScheduledAction6createEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15ScheduledActionC1EN3JSC7JSValueERKNS1_7ArgListE
+__ZN7WebCore15ScheduledActionC2EN3JSC7JSValueERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow11setIntervalEPNS_15ScheduledActionEi
+__ZNK7WebCore9DOMWindow22scriptExecutionContextEv
+__ZN7WebCore8DOMTimer7installEPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore8DOMTimerC1EPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore8DOMTimerC2EPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore15ActiveDOMObjectC2EPNS_22ScriptExecutionContextEPv
+__ZN7WebCore22ScriptExecutionContext22createdActiveDOMObjectEPNS_15ActiveDOMObjectEPv
+__ZN3WTF7HashMapIPN7WebCore15ActiveDOMObjectEPvNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
+__ZN3WTF9HashTableIPN7WebCore15ActiveDOMObjectESt4pairIS3_PvENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCore22ScriptExecutionContext10addTimeoutEiPNS_8DOMTimerE
+__ZN3WTF7HashMapIiPN7WebCore8DOMTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore8DOMTimerEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTrai
+__ZN7WebCore37jsDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLFormElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLFormElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLFormElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLInputElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLInputElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLInputElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLSelectElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLSelectElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLSelectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTextAreaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTextAreaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTextAreaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTextAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsDocumentDefaultViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMWindowE
+__ZN7WebCore18jsLocationHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8hostnameEv
+__ZN7WebCore19setJSDocumentCookieEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document9setCookieERKNS_6StringE
+__ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
+__ZThn32_NK7WebCore8DOMTimer18hasPendingActivityEv
+__ZNK7WebCore8DOMTimer18hasPendingActivityEv
+__ZN7WebCore14jsLocationHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hrefEv
+__ZNK7WebCore4KURL7hasPathEv
+__ZNK7WebCore4KURL9prettyURLEv
+__ZN7WebCore16jsDocumentImagesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document6imagesEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14HTMLCollectionE
+__ZN7WebCore16JSHTMLCollection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLCollectionEEE
+__ZN7WebCore16JSHTMLCollectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLCollectionEEE
+__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSHTMLCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLImageElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement3srcEv
+__ZN7WebCoreL28createHTMLLinkElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLLinkElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLLinkElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLLinkElementEEE
+__ZN7WebCore17JSHTMLLinkElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLLinkElementEEE
+__ZN7WebCore17JSHTMLLinkElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLLinkElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement4hrefEv
+__ZNK7WebCore17JSHTMLLinkElement9classInfoEv
+__ZN7WebCore19JSHTMLIFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLIFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase3srcEv
+__ZN7WebCore28JSHTMLIFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore19JSHTMLIFrameElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSHTMLOptionsCollectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSHTMLOptionsCollection16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore23JSHTMLOptionsCollection6lengthEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLIFrameElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE15reserveCapacityEm
-__ZNK7WebCore16DeprecatedString8toUShortEPbi
-__ZNK7WebCore16DeprecatedString6toUIntEPbi
-__ZSt13binary_searchIPKttEbT_S2_RKT0_
-__ZSt11lower_boundIPKttET_S2_S2_RKT0_
-__ZN7WebCore10HTMLParser23noembedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore5Frame15sendResizeEventEv
-__ZN7WebCore17HTMLAnchorElement9setTargetERKNS_6StringE
-__ZN7WebCore18JSHTMLUListElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore15RenderContainer28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
-__ZNK7WebCore17HTMLAnchorElement4typeEv
-__ZNK7WebCore17HTMLAnchorElement8protocolEv
-__ZN7WebCore17HTMLObjectElement19removedFromDocumentEv
-__ZN7WebCore17JSHTMLLinkElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSHTMLLinkElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLLinkElement11setDisabledEb
-__ZN7WebCore15HTMLLinkElement16setDisabledStateEb
-__ZN7WebCore19JSHTMLAnchorElement14getConstructorEPN3KJS9ExecStateE
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLDivElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLDivElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16JSHTMLDivElement14getConstructorEPN3KJS9ExecStateE
-__ZN3KJS17staticValueGetterIN7WebCore15JSHTMLLIElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSHTMLLIElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15JSHTMLLIElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19tableColConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTableColElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore19HTMLTableColElement17endTagRequirementEv
-__ZNK7WebCore19HTMLTableColElement11tagPriorityEv
-__ZNK7WebCore19HTMLTableColElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore19HTMLTableColElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19HTMLTableColElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore13JSXPathResult14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSXPathResultPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSXPathResultConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore24JSXPathResultConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore24JSXPathResultConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore35jsDocumentPrototypeFunctionEvaluateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17toXPathNSResolverEPN3KJS7JSValueE
-__ZN7WebCore23JSCustomXPathNSResolver6createEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore13toXPathResultEPN3KJS7JSValueE
+__ZN7WebCore10JSNodeList18canGetItemsForNameEPN3JSC9ExecStateEPNS_8NodeListERKNS1_10IdentifierE
+__ZNK7WebCore15DynamicNodeList12itemWithNameERKNS_12AtomicStringE
+__ZN7WebCore19JSNodeListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsLocationHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hostEv
+__ZN7WebCore22jsHTMLElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLDivElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore36jsDOMWindowXMLHttpRequestConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow14xmlHttpRequestEPN3JSC9ExecStateE
+__ZN7WebCore27JSXMLHttpRequestConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSXMLHttpRequestConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore25JSXMLHttpRequestPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXMLHttpRequest15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXMLHttpRequestConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL23constructXMLHttpRequestEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore27JSXMLHttpRequestConstructor22scriptExecutionContextEv
+__ZN7WebCore14XMLHttpRequestC1EPNS_22ScriptExecutionContextE
+__ZN7WebCore14XMLHttpRequestC2EPNS_22ScriptExecutionContextE
+__ZN7WebCoreL34initializeXMLHttpRequestStaticDataEv
+__ZN7WebCore24XMLHttpRequestStaticDataC1Ev
+__ZN7WebCore24XMLHttpRequestStaticDataC2Ev
+__ZN7WebCore16JSXMLHttpRequestC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XMLHttpRequestEEE
+__ZN7WebCore16JSXMLHttpRequestC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XMLHttpRequestEEE
+__ZN7WebCore16JSXMLHttpRequest18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSXMLHttpRequestTableEPN3JSC9ExecStateE
+__ZN7WebCore25getHashTableForGlobalDataERN3JSC12JSGlobalDataEPKNS0_9HashTableE
+__ZN7WebCore21DOMObjectHashTableMap6mapForERN3JSC12JSGlobalDataE
+__ZN3WTF9HashTableIPKN3JSC9HashTableESt4pairIS4_S2_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10Hash
+__ZN3WTF7HashMapIPKN3JSC9HashTableES2_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IS2_EEE3setERKS4_RS3_
+__ZN7WebCore26jsXMLHttpRequestReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest10readyStateEv
+__ZN7WebCore25JSXMLHttpRequestPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSXMLHttpRequestPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSXMLHttpRequest9classInfoEv
+__ZN7WebCore16JSXMLHttpRequest4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore14XMLHttpRequest22scriptExecutionContextEv
+__ZThn88_NK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZNK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbRi
+__ZN7WebCore14XMLHttpRequest13internalAbortEv
+__ZN7WebCore14XMLHttpRequest13clearResponseEv
+__ZN7WebCore14XMLHttpRequest12clearRequestEv
+__ZN7WebCoreL12isValidTokenERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest11changeStateENS0_5StateE
+__ZN7WebCore14XMLHttpRequest28callReadyStateChangeListenerEv
+__ZN7WebCore14XMLHttpRequest29dispatchReadyStateChangeEventEv
+__ZN7WebCore14XMLHttpRequest13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZNK3WTF7HashMapIN7WebCore12AtomicStringENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS1_16AtomicStringHashENS_10HashTra
+__ZN7WebCore38jsDOMWindowPrototypeFunctionSetTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow10setTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow10setTimeoutEPNS_15ScheduledActionEi
+__ZN7WebCore16JSXMLHttpRequest3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore37setJSXMLHttpRequestOnreadystatechangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionSetRequestHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16setRequestHeaderEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16setRequestHeaderERKNS_12AtomicStringERKNS_6StringERi
+__ZNK7WebCore14XMLHttpRequest19isSafeRequestHeaderERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest24setRequestHeaderInternalERKNS_12AtomicStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3addERKS2_RKS3_
+__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionSendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest4sendEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest4sendERi
+__ZN7WebCore14XMLHttpRequest4sendERKNS_6StringERi
+__ZN7WebCore14XMLHttpRequest8initSendERi
+__ZN7WebCore14XMLHttpRequest13createRequestERi
+__ZN7WebCore14XMLHttpRequest22dispatchLoadStartEventEv
+__ZN7WebCore14XMLHttpRequest35dispatchXMLHttpRequestProgressEventEPNS_13EventListenerERKNS_12AtomicStringEbjj
+__ZN7WebCore27XMLHttpRequestProgressEventD0Ev
+__ZNK7WebCore14SecurityOrigin10canRequestERKNS_4KURLE
+__ZNK7WebCore14SecurityOrigin20isSameSchemeHostPortEPKS0_
+__ZN7WebCore14XMLHttpRequest21makeSameOriginRequestERi
+__ZN7WebCore19ResourceRequestBase13setHTTPMethodERKNS_6StringE
+__ZN7WebCore19ResourceRequestBase19addHTTPHeaderFieldsERKNS_13HTTPHeaderMapE
+__ZN7WebCore19ResourceRequestBase18addHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest25loadRequestAsynchronouslyERNS_15ResourceRequestE
+__ZN7WebCore16ThreadableLoader6createEPNS_22ScriptExecutionContextEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13Loa
+__ZNK7WebCore22ScriptExecutionContext15isWorkerContextEv
+__ZN7WebCore24DocumentThreadableLoader6createEPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallba
+__ZN7WebCore24DocumentThreadableLoaderC1EPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksEN
+__ZN7WebCore24DocumentThreadableLoaderC2EPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksEN
+__ZNK7WebCore11ContentData14dataEquivalentERKS0_
+__ZN7WebCoreL21findBeforeAfterParentEPNS_12RenderObjectE
+__ZN7WebCore11ContentData5clearEv
+__ZN7WebCore41jsDOMWindowPrototypeFunctionClearIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow13clearIntervalEi
+__ZN7WebCore8DOMTimer10removeByIdEPNS_22ScriptExecutionContextEi
+__ZN7WebCore22ScriptExecutionContext11findTimeoutEi
+__ZNK3WTF7HashMapIiPN7WebCore8DOMTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZN7WebCore8DOMTimerD0Ev
+__ZN7WebCore22ScriptExecutionContext13removeTimeoutEi
+__ZN7WebCore15ActiveDOMObjectD2Ev
+__ZN7WebCore22ScriptExecutionContext24destroyedActiveDOMObjectEPNS_15ActiveDOMObjectE
+__ZN7WebCore16jsNodeParentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL29createHTMLLabelElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLLabelElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLLabelElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLLabelElementEEE
+__ZN7WebCore18JSHTMLLabelElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLLabelElementEEE
+__ZN7WebCore18JSHTMLLabelElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsElementTagNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsElementPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLLabelElement9classInfoEv
+__ZN7WebCore4Node22getElementsByClassNameERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_15DynamicNodeList6CachesENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3addERKS2_RKS5
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_
+__ZN7WebCore13ClassNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore13ClassNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore13ClassNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore14ClassNamesData11containsAllERS0_
+__ZN7WebCore16jsNodeFirstChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSText18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSCharacterData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15jsNodeNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCharacterData3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18setJSNodeNodeValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13CharacterData12setNodeValueERKNS_6StringERi
+__ZN7WebCore13CharacterData7setDataERKNS_6StringERi
+__ZN7WebCore13CharacterData21dispatchModifiedEventEPNS_10StringImplE
+__ZN7WebCore8Document11textRemovedEPNS_4NodeEjj
+__ZN7WebCore8Document13removeMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore8Document12shiftMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore12RenderObject12removeLayersEPNS_11RenderLayerE
+__ZN7WebCore27RenderTextControlInnerBlockD0Ev
+__ZN7WebCore27RenderTextControlSingleLineD0Ev
+__ZN7WebCore17RenderTextControlD2Ev
+__ZThn8_N7WebCore27TextControlInnerTextElementD0Ev
+__ZN7WebCore27TextControlInnerTextElementD0Ev
+__ZN7WebCore14HTMLDivElementD2Ev
+__ZN3WTF10RefCountedIN7WebCore16SharedFontFamilyEE5derefEv
+__ZN7WebCore38jsElementPrototypeFunctionGetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element12getAttributeERKNS_6StringE
+__ZThn8_N7WebCore23TextControlInnerElementD0Ev
+__ZN7WebCore23TextControlInnerElementD0Ev
+__ZN7WebCore7Element19removedFromDocumentEv
+__ZN7WebCore13ContainerNode19removedFromDocumentEv
+__ZN7WebCore4Node19removedFromDocumentEv
+__ZN7WebCore13ContainerNode15removedFromTreeEb
+__ZN7WebCore31SearchFieldResultsButtonElementD0Ev
+__ZN7WebCore30SearchFieldCancelButtonElementD0Ev
+__ZNK7WebCore14RenderThemeMac39adjustSearchFieldResultsDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore27RenderTextControlSingleLine27updatePlaceholderVisibilityEv
+__ZN7WebCoreL23replaceChildrenWithTextEPNS_11HTMLElementERKNS_6StringERi
+__ZN7WebCoreL30createHTMLAnchorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLAnchorElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLAnchorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAnchorElementEEE
+__ZN7WebCore19JSHTMLAnchorElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAnchorElementEEE
+__ZN7WebCore19JSHTMLAnchorElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSHTMLAnchorElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setHrefERKNS_12AtomicStringE
+__ZN7WebCore19JSHTMLAnchorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLAnchorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSHTMLAnchorElement9classInfoEv
+__ZN7WebCore25setJSHTMLElementInnerHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setInnerHTMLERKNS_6StringERi
+__ZN7WebCore11HTMLElement24createContextualFragmentERKNS_6StringE
+__ZN7WebCore16DocumentFragmentC1EPNS_8DocumentE
+__ZN7WebCore16DocumentFragmentC2EPNS_8DocumentE
+__ZN7WebCore25parseHTMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizerC1EPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizerC2EPNS_16DocumentFragmentE
+__ZN7WebCore10HTMLParserC1EPNS_16DocumentFragmentE
+__ZN7WebCore10HTMLParserC2EPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizer19setForceSynchronousEb
+__ZN7WebCore16DocumentFragment16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore13HTMLTokenizerD1Ev
+__ZN7WebCore13HTMLTokenizerD2Ev
+__ZN7WebCoreL27replaceChildrenWithFragmentEPNS_11HTMLElementEN3WTF10PassRefPtrINS_16DocumentFragmentEEERi
+__ZNK7WebCore16DocumentFragment8nodeTypeEv
+__ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi
+__ZN7WebCoreL15willRemoveChildEPNS_4NodeE
+__ZN7WebCore8Document17nodeWillBeRemovedEPNS_4NodeE
+__ZN7WebCore19SelectionController17nodeWillBeRemovedEPNS_4NodeE
+__ZThn8_N7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore13ContainerNode12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore4Node17checkReplaceChildEPS0_S1_Ri
+__ZN7WebCore4Node15canReplaceChildEPS0_S1_
+__ZN7WebCoreL11appendASCIIERKNS_6StringEPKcmRN3WTF6VectorIcLm512EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14expandCapacityEm
+__ZN7WebCore16jsNodeChildNodesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4Node10childNodesEv
+__ZN7WebCore13ChildNodeListC1EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore13ChildNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore13ChildNodeList6lengthEv
+__ZN7WebCore14jsLocationHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hashEv
+__ZNK7WebCore4KURL3refEv
+__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node13canLazyAttachEv
+__ZN7WebCore18jsLocationPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8pathnameEv
+__ZN7WebCore33jsDOMWindowXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSXPathResult14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSXPathResultConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSXPathResultPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSXPathResult15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSXPathResultConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsXPathResultORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDocumentPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17toXPathNSResolverEN3JSC7JSValueE
+__ZN7WebCore23JSCustomXPathNSResolver6createEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore13toXPathResultEN3JSC7JSValueE
 __ZN7WebCore8Document8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
 __ZN7WebCore14XPathEvaluator8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
 __ZN7WebCore5XPath18isValidContextNodeEPNS_4NodeE
 __ZN7WebCore14XPathEvaluator16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
 __ZN7WebCore15XPathExpression16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN7WebCore5XPath6ParserC1Ev
 __ZN7WebCore5XPath6ParserC2Ev
 __ZN7WebCore5XPath6Parser5resetERKNS_6StringE
 __ZN7WebCore5XPath6Parser14parseStatementERKNS_6StringEN3WTF10PassRefPtrINS_15XPathNSResolverEEERi
 __Z12xpathyyparsePv
-__Z10xpathyylexP7YYSTYPE
 __ZN7WebCore5XPath6Parser3lexEPv
 __ZN7WebCore5XPath6Parser9nextTokenEv
 __ZN7WebCore5XPath6Parser17nextTokenInternalEv
@@ -5843,10 +6397,17 @@ __ZN7WebCore5XPath6Parser6skipWSEv
 __ZN7WebCore5XPath6Parser13peekCurHelperEv
 __ZN7WebCore5XPath6Parser15peekAheadHelperEv
 __ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEii
+__ZN7WebCore5XPath4StepC1ENS1_4AxisERKNS1_8NodeTestERKN3WTF6VectorIPNS0_9PredicateELm0EEE
 __ZN7WebCore5XPath4StepC2ENS1_4AxisERKNS1_8NodeTestERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EEC1ERKS5_
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EEC2ERKS5_
 __ZN7WebCore5XPath6Parser17registerParseNodeEPNS0_9ParseNodeE
 __ZN3WTF7HashSetIPN7WebCore5XPath9ParseNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloca
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deallo
+__ZN7WebCore5XPath12LocationPathC1Ev
 __ZN7WebCore5XPath12LocationPathC2Ev
 __ZN7WebCore5XPath10ExpressionC2Ev
 __ZN7WebCore5XPath12LocationPath10appendStepEPNS0_4StepE
@@ -5854,15 +6415,26 @@ __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE15reserveCapacityEm
 __ZN7WebCore5XPath6Parser19unregisterParseNodeEPNS0_9ParseNodeE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47remove
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6removeE
 __ZNK7WebCore5XPath6Parser17isOperatorContextEv
 __ZN7WebCore5XPath6Parser14registerStringEPNS_6StringE
 __ZN3WTF7HashSetIPN7WebCore6StringENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTable
 __ZN7WebCore5XPath6Parser9lexNCNameERNS_6StringE
-__ZN7WebCore5XPath7charCatEt
-__ZN7WebCore5XPath14isNodeTypeNameERKNS_6StringE
+__ZN7WebCore5XPathL7charCatEt
+__ZN7WebCore5XPathL14isNodeTypeNameERKNS_6StringE
 __ZN7WebCore5XPath6Parser9lexStringEv
+__ZN7WebCore5XPath16StringExpressionC1ERKNS_6StringE
 __ZN7WebCore5XPath16StringExpressionC2ERKNS_6StringE
 __ZN7WebCore5XPath6Parser12deleteStringEPNS_6StringE
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ide
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvali
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE15reserveCapacityEm
@@ -5870,16 +6442,15 @@ __ZN7WebCore5XPath6Parser24registerExpressionVectorEPN3WTF6VectorIPNS0_10Express
 __ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEE3addERKS7_
 __ZN7WebCore5XPath6Parser11expandQNameERKNS_6StringERS2_S5_
 __ZN7WebCore5XPath14createFunctionERKNS_6StringERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
-__ZN7WebCore5XPath17createFunctionMapEv
+__ZN7WebCore5XPathL17createFunctionMapEv
 __ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath11FunctionRecENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS1_6StringES6_NS_17HashMapTranslatorILb0ES4_ISI_S6_ENS_18PairBaseHashTraitsINSC_ISI_EESE_EESF_SA_EEEES4_INS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SA_EEEENS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore5XPath15createFunConcatEv
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14Pair
+__ZN7WebCore5XPathL15createFunConcatEv
 __ZN7WebCore5XPath8Function12setArgumentsERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
 __ZN7WebCore5XPath6Parser22deleteExpressionVectorEPN3WTF6VectorIPNS0_10ExpressionELm0EEE
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE6shrinkEm
-__ZN7WebCore5XPath17createFunContainsEv
+__ZN7WebCore5XPathL17createFunContainsEv
+__ZN7WebCore5XPath9PredicateC1EPNS0_10ExpressionE
 __ZN7WebCore5XPath9PredicateC2EPNS0_10ExpressionE
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEm
@@ -5889,6 +6460,8 @@ __ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEENS_7PtrHashIS7_EEN
 __ZN7WebCore5XPath6Parser21deletePredicateVectorEPN3WTF6VectorIPNS0_9PredicateELm0EEE
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE6shrinkEm
 __ZN7WebCore5XPath12LocationPath16optimizeStepPairEj
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E15de
 __ZN7WebCore15XPathExpression8evaluateEPNS_4NodeEtPNS_11XPathResultERi
 __ZN7WebCore5XPath10Expression17evaluationContextEv
 __ZNK7WebCore5XPath12LocationPath8evaluateEv
@@ -5902,3361 +6475,6529 @@ __ZNK7WebCore5XPath11FunContains8evaluateEv
 __ZNK7WebCore5XPath9FunConcat8evaluateEv
 __ZNK7WebCore5XPath16StringExpression8evaluateEv
 __ZNK7WebCore5XPath5Value8toStringEv
+__ZN3WTF6VectorItLm1024EE6appendItEEvPKT_m
 __ZN7WebCore7Element18getAttributeNodeNSERKNS_6StringES3_
-__ZNK7WebCore12NamedAttrMap12getNamedItemERKNS_13QualifiedNameE
+__ZNK7WebCore12NamedNodeMap12getNamedItemERKNS_13QualifiedNameE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashT
 __ZNK7WebCore5XPath5Value9toBooleanEv
+__ZNK7WebCore4Attr19virtualNamespaceURIEv
 __ZNK7WebCore4Attr12namespaceURIEv
 __ZNK7WebCore5XPath7NodeSet9firstNodeEv
 __ZNK7WebCore5XPath7NodeSet4sortEv
 __ZN7WebCore5XPath11stringValueEPNS_4NodeE
-__ZN7WebCore11XPathResultC2EPNS_15EventTargetNodeERKNS_5XPath5ValueE
+__ZN7WebCore11XPathResultC1EPNS_4NodeERKNS_5XPath5ValueE
+__ZN7WebCore11XPathResultC2EPNS_4NodeERKNS_5XPath5ValueE
 __ZNK7WebCore5XPath5Value9toNodeSetEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEaSERKS5_
 __ZN7WebCore11XPathResult9convertToEtRi
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEmPKS3_
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE15reserveCapacityEm
-__ZN7WebCore5XPath9sortBlockEjjRN3WTF6VectorINS2_IPNS_4NodeELm0EEELm0EEEb
+__ZN7WebCore5XPathL9sortBlockEjjRN3WTF6VectorINS2_IPNS_4NodeELm0EEELm0EEEb
+__ZNK3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22
 __ZN3WTF6VectorINS0_IPN7WebCore4NodeELm0EEELm0EE6shrinkEm
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE6shrinkEm
+__ZN7WebCore15XPathExpressionD1Ev
 __ZN7WebCore15XPathExpressionD2Ev
-__ZN7WebCore5XPath12LocationPathD1Ev
+__ZN7WebCore5XPath12LocationPathD0Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore5XPath4StepELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore5XPath4StepD1Ev
+__ZN7WebCore5XPath4StepD0Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore5XPath9PredicateELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore5XPath9PredicateD1Ev
 __ZN7WebCore5XPath9PredicateD2Ev
-__ZN7WebCore5XPath8FunctionD0Ev
+__ZN7WebCore5XPath11FunContainsD0Ev
+__ZN7WebCore5XPath10ExpressionD2Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore5XPath10ExpressionELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore5XPath16StringExpressionD1Ev
+__ZN7WebCore5XPath9FunConcatD0Ev
+__ZN7WebCore5XPath16StringExpressionD0Ev
 __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE6shrinkEm
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_11XPathResultE
-__ZN7WebCore13JSXPathResultC1EPN3KJS8JSObjectEPNS_11XPathResultE
-__ZN7WebCore13JSXPathResult18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore13JSXPathResultEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore13JSXPathResult16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11XPathResultE
+__ZN7WebCore13JSXPathResultC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11XPathResultEEE
+__ZN7WebCore13JSXPathResultC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11XPathResultEEE
+__ZN7WebCore13JSXPathResult18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsXPathResultSnapshotLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore11XPathResult14snapshotLengthERi
 __ZNK7WebCore11XPathResult10resultTypeEv
-__ZN7WebCore22JSXPathResultPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsXPathResultPrototypeFunctionSnapshotItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore22JSXPathResultPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsXPathResultPrototypeFunctionSnapshotItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore13JSXPathResult9classInfoEv
 __ZN7WebCore11XPathResult12snapshotItemEmRi
-__ZNK7WebCore19HTMLTableColElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore19HTMLTableColElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore14RenderTableColC2EPNS_4NodeE
-__ZN7WebCore14RenderTableCol17updateFromElementEv
-__ZN7WebCore14RenderTableCol13requiresLayerEv
-__ZNK7WebCore14RenderTableCol10isTableColEv
-__ZNK7WebCore14RenderTableCol15canHaveChildrenEv
-__ZNK7WebCore14RenderTableCol14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
-__ZN7WebCore13MutationEventC2ERKNS_12AtomicStringEbbPNS_4NodeERKNS_6StringES8_S8_t
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionOverrideMimeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16overrideMimeTypeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16overrideMimeTypeERKNS_6StringE
+__ZN7WebCore5XPathL18createFunLocalNameEv
+__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_8EqTestOp6OpcodeEi
+__ZN7WebCore5XPath8EqTestOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath8EqTestOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9LogicalOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9LogicalOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZNK7WebCore5XPath9LogicalOp8evaluateEv
+__ZNK7WebCore5XPath8EqTestOp8evaluateEv
+__ZNK7WebCore5XPath12FunLocalName8evaluateEv
+__ZNK7WebCore5XPath8EqTestOp7compareERKNS0_5ValueES4_
+__ZNK7WebCore5XPath9LogicalOp14shortCircuitOnEv
+__ZN7WebCore5XPath9LogicalOpD0Ev
+__ZN7WebCore5XPath8EqTestOpD0Ev
+__ZN7WebCore5XPath12FunLocalNameD0Ev
+__ZN7WebCoreL26createHTMLLIElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLLIElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLLIElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLLIElementEEE
+__ZN7WebCore15JSHTMLLIElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLLIElementEEE
+__ZN7WebCore15JSHTMLLIElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsNodeNodeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL29createHTMLUListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLUListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLUListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLUListElementEEE
+__ZN7WebCore18JSHTMLUListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLUListElementEEE
+__ZN7WebCore18JSHTMLUListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL28createHTMLHtmlElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLHtmlElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLHtmlElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHtmlElementEEE
+__ZN7WebCore17JSHTMLHtmlElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHtmlElementEEE
+__ZN7WebCore17JSHTMLHtmlElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLUListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore14jsElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13StyledElement5styleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationE
+__ZN7WebCore21JSCSSStyleDeclaration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSCSSStyleDeclarationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19CSSStyleDeclarationEEE
+__ZN7WebCore21JSCSSStyleDeclarationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19CSSStyleDeclarationEEE
+__ZN7WebCore21JSCSSStyleDeclaration3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCoreL17isCSSPropertyNameERKN3JSC10IdentifierE
+__ZN7WebCoreL15cssPropertyNameERKN3JSC10IdentifierEPb
+__ZN7WebCoreL24hasCSSPropertyNamePrefixERKN3JSC10IdentifierEPKc
+__ZN7WebCore19CSSStyleDeclaration14isPropertyNameERKNS_6StringE
+__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
+__ZN7WebCore10StringImpl4findEPKcib
+__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_S3_Ri
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbRi
+__ZN7WebCore34jsNodePrototypeFunctionRemoveChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode11removeChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12RenderInline7destroyEv
+__ZN7WebCore12RenderInlineD0Ev
+__ZN7WebCore8RenderBRD0Ev
+__ZN7WebCore14RenderListItem7destroyEv
+__ZN7WebCore16RenderListMarkerD0Ev
+__ZN7WebCore14RenderListItemD0Ev
+__ZN7WebCore11RenderBlock20removeFloatingObjectEPNS_9RenderBoxE
+__ZN7WebCore11RenderBlock22removePositionedObjectEPNS_9RenderBoxE
+__ZN7WebCore4Node21dispatchMutationEventERKNS_12AtomicStringEbN3WTF10PassRefPtrIS0_EERKNS_6StringES9_Ri
+__ZN7WebCore13MutationEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
+__ZN7WebCore13MutationEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
 __ZN7WebCore25InvalidatingEventListener11handleEventEPNS_5EventEb
 __ZN7WebCore11XPathResult23invalidateIteratorStateEv
+__ZN7WebCore13MutationEventD0Ev
+__ZN7WebCore8Document17removeElementByIdERKNS_12AtomicStringEPNS_7ElementE
+__ZN7WebCore16HTMLImageElement19removedFromDocumentEv
+__ZN7WebCore12HTMLDocument15removeNamedItemERKNS_12AtomicStringE
+__ZN7WebCoreL17removeItemFromMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_
+__ZN7WebCore12HTMLDocument20removeExtraNamedItemERKNS_12AtomicStringE
+__ZN7WebCore23jsHTMLAnchorElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hrefEv
+__ZN7WebCore15jsHTMLElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13StyledElement20updateStyleAttributeEv
+__ZN7WebCore38jsDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document11createEventERKNS_6StringERi
+__ZN7WebCore5EventC1Ev
+__ZN7WebCore5EventC2Ev
+__ZN7WebCore7JSEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL15getJSEventTableEPN3JSC9ExecStateE
+__ZN7WebCore16JSEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSEventPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore33jsEventPrototypeFunctionInitEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7JSEvent9classInfoEv
+__ZN7WebCore5Event9initEventERKNS_12AtomicStringEbb
+__ZN7WebCore7JSEvent3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore36jsNodePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7toEventEN3JSC7JSValueE
+__ZNK7WebCore13ChildNodeList4itemEj
+__ZN7WebCore15JSHTMLLIElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32jsNodePrototypeFunctionCloneNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLUListElement9classInfoEv
+__ZN7WebCore7Element9cloneNodeEb
+__ZN7WebCore7Element27cloneElementWithoutChildrenEv
+__ZN7WebCore8Document13createElementERKNS_13QualifiedNameEb
+__ZN7WebCore13StyledElement26copyNonAttributePropertiesEPKNS_7ElementE
+__ZN7WebCoreL29createHTMLOListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLOListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLOListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLOListElementEEE
+__ZN7WebCore18JSHTMLOListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLOListElementEEE
+__ZN7WebCore4Node15removedFromTreeEb
+__ZNK7WebCore15ActiveDOMObject18hasPendingActivityEv
+__ZN7WebCore16JSXMLHttpRequest4markEv
+__ZN7WebCore27JSXMLHttpRequestConstructor4markEv
+__ZN7WebCore16JSHTMLCollectionD1Ev
+__ZN7WebCore16JSHTMLCollectionD2Ev
+__ZN7WebCore18JSHTMLInputElementD1Ev
+__ZN7WebCore19JSHTMLAnchorElementD1Ev
+__ZN7WebCore13ClassNodeListD0Ev
+__ZN7WebCore13ChildNodeListD0Ev
+__ZN7WebCore6JSTextD1Ev
+__ZN7WebCore18JSHTMLLabelElementD1Ev
+__ZN7WebCore13JSXPathResultD1Ev
+__ZN7WebCore13JSXPathResultD2Ev
+__ZN7WebCore11XPathResultD1Ev
 __ZN7WebCore11XPathResultD2Ev
-__ZN7WebCore27getExceptionCodeDescriptionEiRNS_24ExceptionCodeDescriptionE
-__ZN7WebCore13ExceptionBaseC2ERKNS_24ExceptionCodeDescriptionE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_16DOMCoreExceptionE
-__ZN7WebCore27JSDOMCoreExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDOMCoreExceptionC1EPN3KJS8JSObjectEPNS_16DOMCoreExceptionE
-__ZN7WebCore18JSDOMCoreException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSDOMCoreExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore10RenderText22containsOnlyWhitespaceEjj
-__ZN7WebCore10JSLocation3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore31jsNodeListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore18JSCommentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSCommentC1EPN3KJS8JSObjectEPNS_7CommentE
-__ZN7WebCore9JSComment18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLScriptElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLScriptElement6setSrcERKNS_6StringE
-__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8scrollToEii
-__ZN7WebCore10MouseEventC1Ev
-__ZN7WebCore17MouseRelatedEventC2Ev
-__ZN7WebCore7UIEventC1Ev
-__ZN7WebCore8Document7anchorsEv
-__ZNK7WebCore14HTMLCollection9namedItemERKNS_6StringEb
-__ZNK7WebCore14HTMLCollection17checkForNameMatchEPNS_7ElementEbRKNS_6StringEb
-__ZN7WebCore11RenderLayer19removeOnlyThisLayerEv
-__ZN7WebCore38jsDocumentPrototypeFunctionCreateRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_5RangeE
-__ZN7WebCore16JSRangePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore7JSRangeC1EPN3KJS8JSObjectEPNS_5RangeE
-__ZN7WebCore7JSRange18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSRangePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsRangePrototypeFunctionSelectNodeContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7JSRange9classInfoEv
-__ZN7WebCore32jsRangePrototypeFunctionCollapseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore48jsRangePrototypeFunctionCreateContextualFragmentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore5Range24createContextualFragmentERKNS_6StringERi
-__ZN7WebCore27JSDocumentFragmentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDocumentFragmentC1EPN3KJS8JSObjectEPNS_16DocumentFragmentE
-__ZNK7WebCore18JSDocumentFragment9classInfoEv
-__ZN3KJS6Window11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9FrameTree5childEj
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLEmbedElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLEmbedElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLEmbedElement4typeEv
-__ZNK7WebCore16HTMLEmbedElement3srcEv
-__ZN7WebCore16HTMLImageElement7setNameERKNS_6StringE
-__ZN7WebCore16HTMLImageElement8setAlignERKNS_6StringE
-__ZN7WebCore16HTMLImageElement9setHspaceEi
-__ZN7WebCore16HTMLImageElement9setVspaceEi
-__ZN7WebCore30JSCSSStyleDeclarationPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore54jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21JSCSSStyleDeclaration9classInfoEv
-__ZN7WebCore4Path7addRectERKNS_9FloatRectE
-__ZNK7WebCore11FrameLoader13urlsMatchItemEPNS_11HistoryItemE
-__ZNK7WebCore11HistoryItem6targetEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLLinkElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLLinkElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLLinkElement8disabledEv
-__ZNK7WebCore11HistoryItem17childItemWithNameERKNS_6StringE
-__ZN7WebCore11FrameLoader25setProvisionalHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore18JSCommentPrototypeD0Ev
-__ZN7WebCore27JSDocumentFragmentPrototypeD0Ev
-__ZN7WebCore19HTMLTableColElementD1Ev
-__ZN7WebCore19HTMLTextAreaElement12restoreStateERKNS_6StringE
-__ZN7WebCore19HTMLTextAreaElement15setDefaultValueERKNS_6StringE
-__ZN7WebCore17HTMLOptionElement7setTextERKNS_6StringERi
-__ZN7WebCore17HTMLSelectElement8setValueERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLAreaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLAreaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLAreaElement4hrefEv
-__ZN7WebCore12EventHandler28passMouseMoveEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
-__ZN7WebCore12EventHandler27passSubframeEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
-__ZN7WebCore11FrameLoader22updateHistoryForReloadEv
-__ZNK7WebCore13HTMLLIElement4typeEv
-__ZNK7WebCore13HTMLLIElement5valueEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLUListElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLUListElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLUListElement4typeEv
-__ZNK7WebCore4Page14frameNamespaceEv
-__ZNK7WebCore8Document8nodeNameEv
-__ZN7WebCore14JSHTMLDocument14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore36jsNodePrototypeFunctionHasChildNodesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore5Color4darkEv
-__ZN7WebCore16textBreakCurrentEPNS_17TextBreakIteratorE
-__ZN7WebCore14cookiesEnabledEPKNS_8DocumentE
-__ZN7WebCore18createTitleWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLTitleElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTitleElementC1EPN3KJS8JSObjectEPNS_16HTMLTitleElementE
-__ZN7WebCore17createMetaWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLMetaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLMetaElementC1EPN3KJS8JSObjectEPNS_15HTMLMetaElementE
-__ZN7WebCore18JSHTMLTitleElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLMetaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSEventPrototype9classInfoEv
-__ZNK7WebCore7JSEvent13clipboardDataEPN3KJS9ExecStateE
-__ZNK7WebCore5Event16isClipboardEventEv
-__ZN3KJS17staticValueGetterIN7WebCore16JSEventPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSEventPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLTableElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore20HTMLTableCellElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore7Comment8toStringEv
-__ZNK7WebCore17HTMLScriptElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore17HTMLIFrameElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore15HTMLFormElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLInputElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore17HTMLPlugInElement5widthEv
-__ZNK7WebCore17HTMLPlugInElement6heightEv
+__ZN7WebCore25InvalidatingEventListenerD0Ev
+__ZN7WebCore17JSHTMLHtmlElementD1Ev
+__ZN7WebCore21JSCSSStyleDeclarationD1Ev
+__ZN7WebCore21JSCSSStyleDeclarationD2Ev
+__ZN7WebCore18JSHTMLUListElementD1Ev
+__ZThn8_N7WebCore16HTMLUListElementD0Ev
+__ZN7WebCore16HTMLUListElementD0Ev
+__ZN7WebCoreL31createHTMLHeadingElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLHeadingElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLHeadingElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLHeadingElementEEE
+__ZN7WebCore20JSHTMLHeadingElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLHeadingElementEEE
+__ZN7WebCore20JSHTMLHeadingElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLOListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLOListElement9classInfoEv
+__ZNK7WebCore5XPath4Step15primaryNodeTypeENS1_4AxisE
+__ZN7WebCore13JSHTMLElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11HTMLElementEEE
+__ZN7WebCore22jsHTMLElementInnerHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement9innerHTMLEv
+__ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
+__ZN7WebCore17MarkupAccumulator12appendMarkupEPNS_4NodeENS_13EChildrenOnlyEPKN3WTF7HashMapIPNS_16AtomicStringImplES7_NS4_7PtrHa
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_S3_ENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTrait
+__ZN7WebCoreL17appendStartMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPNS0_7HashMapIPNS_16
+__ZN7WebCoreL20appendEscapedContentERN3WTF6VectorItLm0EEESt4pairIPKtmEb
+__ZN7WebCoreL15appendEndMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeE
+__ZNK7WebCore13JSHTMLElement9classInfoEv
+__ZN7WebCore20jsElementOffsetWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11RenderBlock21adjustPositionedBlockEPNS_9RenderBoxERKNS0_10MarginInfoE
+__ZN7WebCoreL25inlineFlowRequiresLineBoxEPNS_12RenderInlineE
+__ZNK7WebCore9InlineBox4rootEv
+__ZN7WebCore14RenderListItem6layoutEv
+__ZN7WebCore14RenderListItem20updateMarkerLocationEv
+__ZN7WebCore14RenderListItem18positionListMarkerEv
+__ZN7WebCore11RenderBlock19adjustFloatingBlockERKNS0_10MarginInfoE
+__ZN7WebCore14RenderListItem14calcPrefWidthsEv
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE15reserveCapacityEm
+__ZN7WebCoreL8bidiNextEPNS_11RenderBlockEPNS_12RenderObjectEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEbPb
+__ZN7WebCoreL23getParentOfFirstLineBoxEPNS_11RenderBlockEPNS_12RenderObjectE
+__ZN7WebCore11RenderBlock32generatesLineBoxesForInlineChildEPNS_12RenderObjectE
+__ZN7WebCore16RenderListMarker14calcPrefWidthsEv
+__ZNK7WebCore16RenderListMarker7isImageEv
+__ZNK7WebCore14RenderListItem14updateValueNowEv
+__ZN7WebCoreL13enclosingListEPNS_4NodeE
+__ZNK7WebCore4Node20traversePreviousNodeEPKS0_
+__ZN7WebCore14listMarkerTextENS_14EListStyleTypeEi
+__ZN7WebCore16RenderListMarker13updateMarginsEv
+__ZNK7WebCore16RenderListMarker8isInsideEv
+__ZN7WebCore16RenderListMarker6layoutEv
+__ZNK7WebCore16RenderListMarker12isListMarkerEv
+__ZN7WebCoreL36shouldSkipWhitespaceAfterStartObjectEPNS_11RenderBlockEPNS_12RenderObjectE
+__ZN7WebCore16RenderListMarker15createInlineBoxEv
+__ZNK7WebCore9RenderBox13intrinsicSizeEv
+__ZNK7WebCore16RenderListMarker10lineHeightEbb
+__ZNK7WebCore16RenderListMarker16baselinePositionEbb
+__ZN7WebCore9InlineBox14adjustPositionEii
+__ZN7WebCore16RenderPartObject6layoutEv
+__ZN7WebCore9RenderBox30calcAbsoluteHorizontalReplacedEv
+__ZN7WebCore9RenderBox28calcAbsoluteVerticalReplacedEv
+__ZN7WebCore12RenderWidget6layoutEv
+__ZN7WebCore11RenderBlock14fitBelowFloatsEibRi
+__ZNK7WebCore11RenderBlock20nextFloatBottomBelowEi
+__ZN7WebCore12RenderWidget20updateWidgetPositionEv
+__ZN7WebCore10ScrollView12setFrameRectERKNS_7IntRectE
+__ZN7WebCore6Widget12setFrameRectERKNS_7IntRectE
+__ZN7WebCore12RenderWidget5derefEPNS_11RenderArenaE
+__ZNK7WebCore12RenderInline11offsetWidthEv
+__ZN7WebCore9InlineBox6removeEv
+__ZN7WebCore13InlineFlowBox11removeChildEPNS_9InlineBoxE
+__ZN7WebCore13RootInlineBox12childRemovedEPNS_9InlineBoxE
+__ZN7WebCore10RenderText29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore21jsCharacterDataLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13RootInlineBox19lineBreakBidiStatusEv
+__ZN7WebCore13InlineFlowBox11extractLineEv
+__ZN7WebCore13RootInlineBox30extractLineBoxFromRenderObjectEv
+__ZN7WebCore17RenderLineBoxList14extractLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13InlineFlowBox30extractLineBoxFromRenderObjectEv
 __ZN7WebCore9InlineBox11extractLineEv
+__ZN7WebCore13InlineFlowBox29removeLineBoxFromRenderObjectEv
+__ZN7WebCore13InlineFlowBox13lastLeafChildEv
+__ZN7WebCore9InlineBox13lastLeafChildEv
+__ZN7WebCore11RenderBlock14matchedEndLineERKNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_RKNS_10BidiStatusERPNS_13R
+__ZN7WebCoreeqERKNS_11BidiContextES2_
+__ZN7WebCore13InlineFlowBox10attachLineEv
+__ZN7WebCore13RootInlineBox27attachLineBoxToRenderObjectEv
+__ZN7WebCore17RenderLineBoxList13attachLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13InlineFlowBox27attachLineBoxToRenderObjectEv
 __ZN7WebCore9InlineBox10attachLineEv
-__ZN7WebCore15SQLiteStatement8bindNullEi
-_sqlite3_bind_null
-__ZN7WebCore7JSEvent16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore9DOMWindow7scrollXEv
-__ZNK7WebCore9DOMWindow7scrollYEv
-__ZN7WebCore26JSHTMLMetaElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLTitleElementPrototypeD0Ev
-__ZNK7WebCore11RenderBlock14firstLineBlockEv
-__ZN7WebCore10RenderFlow24addChildWithContinuationEPNS_12RenderObjectES2_
-__ZN7WebCore10RenderFlow18continuationBeforeEPNS_12RenderObjectE
-__ZNK7WebCore12RenderObject19isBottomMarginQuirkEv
-__ZN7WebCore27compareBorderStylesForQSortEPKvS1_
-__ZN7WebCore10HTMLParser39handleResidualStyleCloseTagAcrossBlocksEPNS_13HTMLStackElemE
-__ZNK7WebCore12RenderObject24getBaselineOfLastLineBoxEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLMetaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLMetaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLMetaElement4nameEv
-__ZNK7WebCore15HTMLMetaElement7contentEv
-__ZN7WebCore17JSHTMLMetaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSHTMLMetaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLMetaElement7setNameERKNS_6StringE
-__ZN7WebCore15HTMLMetaElement10setContentERKNS_6StringE
+__ZN7WebCore13RootInlineBox14adjustPositionEii
+__ZN7WebCore13InlineFlowBox14adjustPositionEii
+__ZN7WebCore17RenderLineBoxList14dirtyLineBoxesEv
+__ZN7WebCore11RenderBlock24repaintOverhangingFloatsEb
+__ZN7WebCore15JSTextPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSCharacterDataPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsCharacterDataPrototypeFunctionDeleteDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CharacterData10deleteDataEjjRi
+__ZN7WebCore13CharacterData22checkCharDataOperationEjRi
+__ZN7WebCore6String6removeEji
+__ZN7WebCore10RenderText17setTextWithOffsetEN3WTF10PassRefPtrINS_10StringImplEEEjjb
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS_6VectorIPNS1_7ElementELm0EEEENS_18PairFirstExtractorISA_EENS_7Pt
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE15reserveCapacityEm
+__ZN7WebCore26JSHTMLFormElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSHTMLFormElement9classInfoEv
+__ZN7WebCore17JSHTMLFormElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12RenderWidget5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderListItem5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineFlowBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOper
+__ZN7WebCore13InlineFlowBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOpera
+__ZN7WebCoreL9nullImageEv
+__ZN7WebCore14RenderThemeMac16paintSearchFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac6searchEv
+__ZN7WebCore14RenderThemeMac18setSearchCellStateEPNS_12RenderObjectERKNS_7IntRectE
+__ZNK7WebCore17RenderTextControl15controlClipRectEii
+__ZN7WebCore14RenderThemeMac33paintSearchFieldResultsDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac21convertToPaintingRectEPKNS_12RenderObjectES3_RKNS_9FloatRectERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac26paintSearchFieldDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore8DOMTimer5firedEv
+__ZN7WebCore15ScheduledAction7executeEPNS_22ScriptExecutionContextE
+__ZN7WebCore15ScheduledAction7executeEPNS_8DocumentE
+__ZN7WebCore15ScheduledAction24executeFunctionInContextEPN3JSC14JSGlobalObjectENS1_7JSValueE
+__ZN7WebCore20jsDocumentReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document10readyStateEv
+__ZNK7WebCore11FrameLoader10isCompleteEv
+__ZN7WebCore19jsStringOrUndefinedEPN3JSC9ExecStateERKNS_6StringE
+__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
+__ZThn16_N7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore12RenderInline12imageChangedEPvPKNS_7IntRectE
+__ZThn16_N7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZN7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZThn16_N7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore27extractCharsetFromMediaTypeERKNS_6StringE
+__ZThn16_N7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZThn16_N7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZN7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZN7WebCore14XMLHttpRequest14refEventTargetEv
+__ZN7WebCore11EventTarget6toNodeEv
+__ZN7WebCore11EventTarget11toDOMWindowEv
+__ZN7WebCore14XMLHttpRequest16toXMLHttpRequestEv
+__ZN7WebCore14XMLHttpRequest27updateAndDispatchOnProgressEj
+__ZN7WebCore14XMLHttpRequest21dispatchProgressEventEx
+__ZN7WebCore22jsXMLHttpRequestStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest6statusERi
+__ZN7WebCore26jsXMLHttpRequestStatusTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest10statusTextERi
+__ZNK7WebCore20ResourceResponseBase14httpStatusTextEv
+__ZN7WebCore28jsXMLHttpRequestResponseTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16JSXMLHttpRequest12responseTextEPN3JSC9ExecStateE
+__ZNK7WebCore14XMLHttpRequest12responseTextEv
+__ZN7WebCore19jsOwnedStringOrNullEPN3JSC9ExecStateERKNS0_7UStringE
+__ZN7WebCore50jsXMLHttpRequestPrototypeFunctionGetResponseHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest17getResponseHeaderEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore14XMLHttpRequest17getResponseHeaderERKNS_12AtomicStringERi
+__ZN7WebCoreL17isSetCookieHeaderERKNS_12AtomicStringE
+__ZThn16_N7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZN7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZThn16_N7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZN7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZThn88_N7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore19InspectorController33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore11FrameLoader31didLoadResourceByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZThn88_N7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
+__ZN7WebCore24DocumentThreadableLoader21derefThreadableLoaderEv
+__ZN7WebCore24DocumentThreadableLoaderD0Ev
+__ZN7WebCore27jsXMLHttpRequestResponseXMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest11responseXMLEv
+__ZNK7WebCore14XMLHttpRequest13responseIsXMLEv
+__ZNK7WebCore14XMLHttpRequest16responseMIMETypeEv
+__ZN7WebCore16jsDocumentDomainEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document6domainEv
+__ZN7WebCore14jsLocationPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4portEv
+__ZN7WebCore14XMLHttpRequest17dispatchLoadEventEv
+__ZN7WebCore14XMLHttpRequest14dropProtectionEv
+__ZNK7WebCore14XMLHttpRequest8documentEv
+__ZNK7WebCore8Document14implementationEv
+__ZN7WebCore17DOMImplementation14createDocumentEPNS_5FrameE
+__ZN7WebCore8DocumentC1EPNS_5FrameEb
+__ZN7WebCore14SecurityOrigin11createEmptyEv
+__ZN7WebCore8Document4openEPS0_
+__ZN7WebCore8Document15createTokenizerEv
+__ZN7WebCore12XMLTokenizerC1EPNS_8DocumentEPNS_9FrameViewE
+__ZN7WebCore12XMLTokenizerC2EPNS_8DocumentEPNS_9FrameViewE
+__ZN7WebCore8Document5writeERKNS_6StringEPS0_
+__ZN7WebCore8Document5writeERKNS_15SegmentedStringEPS0_
+__ZN7WebCore12XMLTokenizer5writeERKNS_15SegmentedStringEb
+__ZNK7WebCore15SegmentedString8toStringEv
+__ZN7WebCore12XMLTokenizer7doWriteERKNS_6StringE
+__ZN7WebCore12XMLTokenizer23initializeParserContextEPKc
+__ZN7WebCore17XMLTokenizerScopeC1EPNS_9DocLoaderE
+__ZN7WebCore17XMLTokenizerScopeC2EPNS_9DocLoaderE
+__ZN7WebCoreL18createStringParserEP14_xmlSAXHandlerPv
+__ZN7WebCore17XMLTokenizerScopeD1Ev
+__ZN7WebCore17XMLTokenizerScopeD2Ev
+__ZN7WebCoreL20startDocumentHandlerEPv
+__ZN7WebCore12XMLTokenizer13startDocumentEPKhS2_i
+__ZNK7WebCore12TextEncoding6decodeEPKcmbRb
+__ZN7WebCore8Document13setXMLVersionERKNS_6StringERi
+__ZN7WebCore17DOMImplementation10hasFeatureERKNS_6StringES3_
+__ZN7WebCore8Document16setXMLStandaloneEbRi
+__ZN7WebCoreL18normalErrorHandlerEPvPKcz
+__ZN7WebCore12XMLTokenizer5errorENS0_9ErrorTypeEPKcP13__va_list_tag
+__ZNK7WebCore12XMLTokenizer12columnNumberEv
+__ZNK7WebCore12XMLTokenizer10lineNumberEv
+__ZN7WebCore12XMLTokenizer11handleErrorENS0_9ErrorTypeEPKcii
+__ZN7WebCoreL18endDocumentHandlerEPv
+__ZN7WebCore12XMLTokenizer11endDocumentEv
+__ZN7WebCore12XMLTokenizer8exitTextEv
+__ZN7WebCore12XMLTokenizer6finishEv
+__ZN7WebCore12XMLTokenizer3endEv
+__ZN7WebCore12XMLTokenizer5doEndEv
+__ZN7WebCore12XMLTokenizer23insertErrorMessageBlockEv
+__ZN7WebCore8Document16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore13ContainerNode12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore12XMLTokenizer14setCurrentNodeEPNS_4NodeE
+__ZNK7WebCore12XMLTokenizer10wellFormedEv
+__ZN7WebCore12XMLTokenizerD0Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore16PendingCallbacks15PendingCallbackEEEvRKNS_5DequeIT_EE
+__ZN7WebCore16jsDOMWindowEventEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow5eventEPN3JSC9ExecStateE
+__ZN7WebCore20jsEventCurrentTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8DocumentD0Ev
+__ZN7WebCore20JSHTMLHeadingElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSHTMLHeadingElement9classInfoEv
+__ZN7WebCoreL33createHTMLParagraphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLParagraphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLParagraphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLParagraphElementEEE
+__ZN7WebCore22JSHTMLParagraphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLParagraphElementEEE
+__ZN7WebCore22JSHTMLParagraphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSHTMLParagraphElement9classInfoEv
+__ZN7WebCore22JSHTMLParagraphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSNodeList11getCallDataERN3JSC8CallDataE
+__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK7WebCore10JSNodeList9classInfoEv
+__ZN7WebCore20JSHTMLHeadingElementD1Ev
+__ZN7WebCore13JSHTMLElementD1Ev
+__ZThn8_N7WebCore11HTMLElementD0Ev
+__ZN7WebCore16JSXMLHttpRequestD1Ev
+__ZN7WebCore16JSXMLHttpRequestD2Ev
+__ZN7WebCore18JSHTMLOListElementD1Ev
+__ZN7WebCore14XMLHttpRequest16derefEventTargetEv
+__ZN7WebCore14XMLHttpRequestD0Ev
+__ZN7WebCore41jsElementPrototypeFunctionRemoveAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element15removeAttributeERKNS_6StringERi
+__ZN7WebCore12NamedNodeMap15removeNamedItemERKNS_6StringERi
+__ZNK7WebCore4Node15isStyledElementEv
+__ZN7WebCoreL28createHTMLMetaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLMetaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLMetaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMetaElementEEE
+__ZN7WebCore17JSHTMLMetaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMetaElementEEE
+__ZN7WebCore17JSHTMLMetaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore17JSHTMLMetaElement9classInfoEv
-__ZN7WebCore10JSNodeList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore19JSNodeListPrototype9classInfoEv
-__ZNK7WebCore15HTMLMetaElement9httpEquivEv
-__ZN7WebCore17HTMLScriptElement7setTypeERKNS_6StringE
-__ZNK7WebCore10MouseEvent5whichEv
-__ZNK7WebCore17HTMLAnchorElement8hostnameEv
-__ZNK7WebCore17HTMLAnchorElement6searchEv
-__ZNK7WebCore17HTMLAnchorElement8pathnameEv
-__ZNK7WebCore17HTMLAnchorElement4textEv
-__ZNK7WebCore7Element9innerTextEv
-__ZN7WebCore15rangeOfContentsEPNS_4NodeE
-__ZN7WebCore12EventHandler32handleMousePressEventDoubleClickERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler31selectClosestWordFromMouseEventERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore19JSHTMLAllCollection21masqueradeAsUndefinedEv
-__ZNK7WebCore4Text8nodeNameEv
-__ZN7WebCore38jsHTMLDocumentPrototypeFunctionWritelnEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSHTMLDocument7writelnEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore15HTMLFormElement12setMalformedEb
-__ZN7WebCore21DeprecatedPtrListImpl4prevEv
-__ZNK7WebCore15RenderTableCell16baselinePositionEbb
-__ZN7WebCore12RenderInline22positionForCoordinatesEii
-__ZN7WebCore15RenderContainer22positionForCoordinatesEii
-__ZNK7WebCore10RenderText4xPosEv
-__ZN7WebCore11JSDOMWindow16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore11JSDOMWindow22customGetPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore17JSHTMLBaseElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSHTMLBaseElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLBaseFontElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLBaseFontElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLIFrameElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSHTMLBlockquoteElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore32JSHTMLBlockquoteElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLAudioElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLAudioElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLMediaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSSVGPreserveAspectRatio14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore33JSSVGPreserveAspectRatioPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7menubarEv
-__ZN7WebCore7BarInfoC2EPNS_5FrameENS0_4TypeE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7BarInfoE
-__ZN7WebCore18JSBarInfoPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSBarInfoC1EPN3KJS8JSObjectEPNS_7BarInfoE
-__ZN7WebCore10JSSVGAngle14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGAnglePrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow10scrollbarsEv
-__ZN7WebCore19JSCSSPrimitiveValue14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSCSSPrimitiveValuePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSCSSValuePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSSVGPaint14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGPaintPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGColorPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow12frameElementEv
-__ZN7WebCore17checkNodeSecurityEPN3KJS9ExecStateEPNS_4NodeE
-__ZN7WebCore8JSEntity14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSEntityPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLMenuElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSHTMLMenuElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLModElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLModElementPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow6openerEv
-__ZN7WebCore12JSMouseEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore11JSTextEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSTextEventPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow10outerWidthEv
-__ZNK7WebCore6Chrome10windowRectEv
-__ZN7WebCore18JSHTMLQuoteElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLQuoteElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHeadElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLIsIndexElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSHTMLIsIndexElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLImageElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCDATASection14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow6closedEv
-__ZN7WebCore16JSCSSCharsetRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSCSSCharsetRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSCSSRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLAppletElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLAppletElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSCSSValue14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCSSValueList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSCSSValueListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow9statusbarEv
-__ZN7WebCore25JSXMLHttpRequestException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore34JSXMLHttpRequestExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLStyleElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSProcessingInstruction14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore32JSProcessingInstructionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDOMCoreException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLFrameSetElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLFrameSetElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSRangeException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSRangeExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSDOMImplementation14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSDOMImplementationPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSWheelEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLUListElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSCharacterData14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLLegendElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLLegendElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore6JSRect14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSRectPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLPreElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLPreElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSMessageEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSMessageEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSCounter14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSCounterPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSNamedNodeMap14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSNamedNodeMapPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLTableCellElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLOptGroupElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLOptGroupElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLHeadingElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore13JSCSSRuleList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSCSSRuleListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow11outerHeightEv
-__ZN7WebCore22JSHTMLParagraphElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLFieldSetElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore12JSStyleSheet14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSStyleSheetPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow11personalbarEv
-__ZN7WebCore19JSHTMLButtonElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLButtonElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLMapElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSOverflowEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSOverflowEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSXPathException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSXPathExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGGradientElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSSVGGradientElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSSVGElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSProgressEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSProgressEventPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow6statusEv
-__ZNK7WebCore5Frame15jsStatusBarTextEv
-__ZN7WebCore12JSMediaError14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSMediaErrorPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore6JSAttr14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSAttrPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSEntityReference14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSEntityReferencePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLTableCaptionElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore34JSHTMLTableCaptionElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLObjectElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLObjectElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLFrameElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLFrameElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSCSSRule14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow16devicePixelRatioEv
-__ZN7WebCore6Chrome11scaleFactorEv
-__ZN7WebCore21JSCSSStyleDeclaration14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSMutationEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSMutationEventPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7screenXEv
-__ZN7WebCore21JSHTMLTableRowElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLDirectoryElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore31JSHTMLDirectoryElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLScriptElement14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7screenYEv
-__ZNK7WebCore9DOMWindow7toolbarEv
-__ZN7WebCore23JSSVGTextContentElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore32JSSVGTextContentElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLAreaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLOListElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLCanvasElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLCanvasElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSCSSFontFaceRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSCSSFontFaceRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSDocument14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLBRElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCSSStyleRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSCSSStyleRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLFontElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSHTMLFontElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTitleElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLTableSectionElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore6JSText14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSDocumentType14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSDocumentTypePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSUIEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore16JSEventException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSEventExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSStyleSheetList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSStyleSheetListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow13defaultStatusEv
-__ZNK7WebCore5Frame22jsDefaultStatusBarTextEv
-__ZN7WebCore7JSRange14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCSSMediaRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSCSSMediaRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLEmbedElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore10JSNodeList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSSVGMarkerElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSSVGMarkerElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLHRElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSHTMLHRElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSCSSImportRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSCSSImportRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSSVGColor14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLParamElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLParamElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDocumentFragment14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow18offscreenBufferingEv
-__ZN7WebCore13JSCSSPageRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSCSSPageRulePrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow11locationbarEv
-__ZN7WebCore11JSSVGLength14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGLengthPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSXPathEvaluator14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSXPathEvaluatorPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSKeyboardEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore11JSMediaList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSMediaListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7consoleEv
-__ZN7WebCore7ConsoleC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7ConsoleE
-__ZN7WebCore18JSConsolePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSConsoleC1EPN3KJS8JSObjectEPNS_7ConsoleE
-__ZN7WebCore9JSComment14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore10JSNotation14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSNotationPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLBodyElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLDListElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHtmlElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLLabelElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLLinkElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLMarqueeElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSHTMLMarqueeElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLMetaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLTableColElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLTableColElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTableElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore12JSNodeFilter14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSNodeFilterPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSXMLSerializer14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSXMLSerializerPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLMediaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLVideoElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLVideoElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSSVGException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSSVGExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSSVGPathSeg14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSSVGPathSegPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGRenderingIntent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSSVGRenderingIntentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGTextPathElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSSVGTextPathElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSSVGTransform14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSSVGTransformPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSSVGUnitTypes14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSSVGUnitTypesPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore11MediaPlayer11isAvailableEv
-__ZN7WebCore18MediaPlayerPrivate11isAvailableEv
-__ZN7WebCore18JSAudioConstructorC1EPN3KJS9ExecStateEPNS_8DocumentE
-__ZNK7WebCore6Chrome11canRunModalEv
-__ZN3KJS27XSLTProcessorConstructorImpC2EPNS_9ExecStateE
-__ZN3KJS22XSLTProcessorPrototype4selfEPNS_9ExecStateE
-__ZN7WebCore7BarInfo15disconnectFrameEv
-__ZN7WebCore7Console15disconnectFrameEv
-__ZN7WebCore25JSSVGUnitTypesConstructorD0Ev
-__ZN7WebCore25JSSVGTransformConstructorD0Ev
-__ZN7WebCore31JSSVGTextPathElementConstructorD0Ev
-__ZN7WebCore31JSSVGRenderingIntentConstructorD0Ev
-__ZN7WebCore23JSSVGPathSegConstructorD0Ev
-__ZN7WebCore25JSSVGExceptionConstructorD0Ev
-__ZN7WebCore27JSHTMLVideoElementPrototypeD0Ev
-__ZN7WebCore29JSHTMLMediaElementConstructorD0Ev
-__ZN7WebCore30JSHTMLTableColElementPrototypeD0Ev
-__ZN7WebCore19JSNotationPrototypeD0Ev
-__ZN7WebCore9JSConsoleD0Ev
-__ZN7WebCore26JSKeyboardEventConstructorD0Ev
-__ZN7WebCore22JSSVGLengthConstructorD0Ev
-__ZN7WebCore22JSCSSPageRulePrototypeD0Ev
-__ZN7WebCore27JSHTMLParamElementPrototypeD0Ev
-__ZN7WebCore21JSSVGColorConstructorD0Ev
-__ZN7WebCore24JSCSSImportRulePrototypeD0Ev
-__ZN7WebCore24JSHTMLHRElementPrototypeD0Ev
-__ZN7WebCore29JSSVGMarkerElementConstructorD0Ev
-__ZN7WebCore27JSStyleSheetListConstructorD0Ev
-__ZN7WebCore27JSEventExceptionConstructorD0Ev
-__ZN7WebCore20JSUIEventConstructorD0Ev
-__ZN7WebCore23JSDocumentTypePrototypeD0Ev
-__ZN7WebCore26JSHTMLFontElementPrototypeD0Ev
-__ZN7WebCore23JSCSSStyleRulePrototypeD0Ev
-__ZN7WebCore26JSCSSFontFaceRulePrototypeD0Ev
-__ZN7WebCore34JSSVGTextContentElementConstructorD0Ev
-__ZN7WebCore31JSHTMLDirectoryElementPrototypeD0Ev
-__ZN7WebCore34JSHTMLTableCaptionElementPrototypeD0Ev
-__ZN7WebCore26JSEntityReferencePrototypeD0Ev
-__ZN7WebCore15JSAttrPrototypeD0Ev
-__ZN7WebCore23JSMediaErrorConstructorD0Ev
-__ZN7WebCore26JSProgressEventConstructorD0Ev
-__ZN7WebCore21JSSVGElementPrototypeD0Ev
-__ZN7WebCore31JSSVGGradientElementConstructorD0Ev
-__ZN7WebCore27JSXPathExceptionConstructorD0Ev
-__ZN7WebCore26JSOverflowEventConstructorD0Ev
-__ZN7WebCore21JSStyleSheetPrototypeD0Ev
-__ZN7WebCore30JSHTMLOptGroupElementPrototypeD0Ev
-__ZN7WebCore18JSCounterPrototypeD0Ev
-__ZN7WebCore25JSMessageEventConstructorD0Ev
-__ZN7WebCore25JSHTMLPreElementPrototypeD0Ev
-__ZN7WebCore15JSRectPrototypeD0Ev
-__ZN7WebCore30JSHTMLFrameSetElementPrototypeD0Ev
-__ZN7WebCore29JSDOMCoreExceptionConstructorD0Ev
-__ZN7WebCore32JSProcessingInstructionPrototypeD0Ev
-__ZN7WebCore36JSXMLHttpRequestExceptionConstructorD0Ev
-__ZN7WebCore28JSHTMLAppletElementPrototypeD0Ev
-__ZN7WebCore25JSCSSCharsetRulePrototypeD0Ev
-__ZN7WebCore29JSHTMLIsIndexElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLQuoteElementPrototypeD0Ev
-__ZN7WebCore22JSTextEventConstructorD0Ev
-__ZN7WebCore23JSMouseEventConstructorD0Ev
-__ZN7WebCore25JSHTMLModElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLMenuElementPrototypeD0Ev
-__ZN7WebCore17JSEntityPrototypeD0Ev
-__ZN7WebCore21JSSVGPaintConstructorD0Ev
-__ZN7WebCore21JSSVGAngleConstructorD0Ev
-__ZN7WebCore18JSBarInfoPrototypeD0Ev
-__ZN7WebCore35JSSVGPreserveAspectRatioConstructorD0Ev
-__ZN7WebCore27JSHTMLAudioElementPrototypeD0Ev
-__ZN7WebCore32JSHTMLBlockquoteElementPrototypeD0Ev
-__ZN7WebCore30JSHTMLBaseFontElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLBaseElementPrototypeD0Ev
-__ZN3KJS22XSLTProcessorPrototypeD0Ev
-__ZN7WebCore28JSHTMLSelectElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement5valueEv
-__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_15CaseFoldingHashENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore16MIMETypeRegistry20isJavaAppletMIMETypeERKNS_6StringE
-__ZN7WebCore11RenderLayer23beginTransparencyLayersEPNS_15GraphicsContextEPKS0_
-__ZN7WebCore19transparencyClipBoxERKNS_15AffineTransformEPKNS_11RenderLayerES5_
-__ZN7WebCore15GraphicsContext22beginTransparencyLayerEf
-__ZN7WebCore15GraphicsContext20endTransparencyLayerEv
-__ZNK7WebCore14RenderThemeMac25adjustMenuListButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore6Loader4Host14cancelRequestsEPNS_9DocLoaderE
+__ZN7WebCore6Loader4Host21cancelPendingRequestsERN3WTF5DequeIPNS_7RequestEEEPNS_9DocLoaderE
+__ZN7WebCore11FrameLoader49updateHistoryForRedirectWithLockedBackForwardListEv
+__ZN7WebCore11HistoryItem12setChildItemEN3WTF10PassRefPtrIS0_EE
+__ZNK7WebCore10RenderView8viewRectEv
+__ZNK7WebCore9RenderBox12maxTopMarginEb
+__ZNK7WebCore9RenderBox21isSelfCollapsingBlockEv
+__ZNK7WebCore9RenderBox15maxBottomMarginEb
+__ZN7WebCore5TimerINS_12GCControllerEE5firedEv
+__ZN7WebCore12GCController12gcTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore22JSHTMLParagraphElementD1Ev
+__ZN7WebCore17JSHTMLMetaElementD1Ev
+__ZN7WebCore16HTMLLabelElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore27TextControlInnerTextElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore18JSHTMLInputElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSNodeOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE6shrinkEm
+__ZN7WebCore22HTMLFormControlElement15removedFromTreeEb
+__ZN7WebCore15HTMLFormElement17removeFormElementEPNS_22HTMLFormControlElementE
+__ZN7WebCore26setJSHTMLImageElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setWidthEi
+__ZN7WebCore27setJSHTMLImageElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setHeightEi
+__ZN7WebCore27setJSHTMLImageElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setBorderERKNS_6StringE
+__ZN7WebCore24setJSHTMLImageElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement6setAltERKNS_6StringE
+__ZN7WebCore17setJSNodeOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18setJSNodeOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsDOMWindowParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6parentEv
+__ZNK7WebCore5Frame14isDisconnectedEv
+__ZN7WebCore17jsDOMWindowScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6screenEv
+__ZN7WebCore6ScreenC1EPNS_5FrameE
+__ZN7WebCore6ScreenC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6ScreenE
+__ZN7WebCore8JSScreen15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSScreenC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6ScreenEEE
+__ZN7WebCore8JSScreenC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6ScreenEEE
+__ZN7WebCore8JSScreen18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13jsScreenWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen5widthEv
+__ZN7WebCore14jsScreenHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen6heightEv
+__ZN7WebCore39jsNavigatorPrototypeFunctionJavaEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSNavigator9classInfoEv
+__ZNK7WebCore9Navigator11javaEnabledEv
+__ZN7WebCore18jsScreenPixelDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10pixelDepthEv
+__ZN7WebCore11screenDepthEPNS_6WidgetE
+__ZN7WebCore21jsDOMWindowInnerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10innerWidthEv
+__ZN7WebCore22jsDOMWindowInnerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11innerHeightEv
+__ZN7WebCore18jsNavigatorPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator7pluginsEv
+__ZN7WebCore11PluginArrayC1EPNS_5FrameE
+__ZN7WebCore11PluginArrayC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11PluginArrayE
+__ZN7WebCore13JSPluginArray15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSPluginArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11PluginArrayEEE
+__ZN7WebCore13JSPluginArrayC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11PluginArrayEEE
+__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsPluginArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11PluginArray6lengthEv
+__ZNK7WebCore11PluginArray13getPluginDataEv
+__ZNK7WebCore4Page10pluginDataEv
+__ZN7WebCore10PluginDataC1EPKNS_4PageE
+__ZN7WebCore10PluginDataC2EPKNS_4PageE
+__ZN7WebCore10PluginData11initPluginsEv
+_stringEncodingForResource
+__ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE15reserveCapacityEm
+__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore13JSPluginArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11PluginArray4itemEj
+__ZN7WebCore6PluginC1EPNS_10PluginDataEj
+__ZN7WebCore6PluginC2EPNS_10PluginDataEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6PluginE
+__ZN7WebCore8JSPlugin15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSPluginC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6PluginEEE
+__ZN7WebCore8JSPluginC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6PluginEEE
+__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12jsPluginNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin4nameEv
+__ZN7WebCore19jsNavigatorPlatformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase8platformEv
+__ZN7WebCore19JSLocationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSLocation9classInfoEv
+__ZN7WebCore10JSLocation8toStringEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameE
+__ZNK7WebCore8Location8toStringEv
+__ZN7WebCore18jsDocumentReferrerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document8referrerEv
+__ZNK7WebCore11FrameLoader8referrerEv
+__ZN7WebCore20jsNavigatorMimeTypesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator9mimeTypesEv
+__ZN7WebCore13MimeTypeArrayC1EPNS_5FrameE
+__ZN7WebCore13MimeTypeArrayC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13MimeTypeArrayE
+__ZN7WebCore15JSMimeTypeArray15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSMimeTypeArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MimeTypeArrayEEE
+__ZN7WebCore15JSMimeTypeArrayC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MimeTypeArrayEEE
+__ZN7WebCore13JSPluginArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_11PluginArrayERKNS1_10IdentifierE
+__ZN7WebCore11PluginArray18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore22JSPluginArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13JSPluginArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11PluginArray9namedItemERKNS_12AtomicStringE
+__ZN7WebCore19jsPluginDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin11descriptionEv
+__ZN3WTF6VectorIcLm512EE14expandCapacityEm
+__ZN3WTF6VectorIcLm512EE15reserveCapacityEm
+__ZN7WebCore11FrameLoader15parentCompletedEv
+__ZN7WebCore14ResourceLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_16ApplicationCacheE
+__ZN7WebCore14DocumentLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_14ResourceLoaderERKNS_15ResourceRequestEPNS_
+__ZN7WebCore14DocumentLoader35getApplicationCacheFallbackResourceERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceEPNS_16
+__ZN7WebCore15defaultMIMETypeEv
+__ZN7WebCore15GraphicsContext9setShadowERKNS_7IntSizeEiRKNS_5ColorE
+__ZN7WebCore15GraphicsContext17setPlatformShadowERKNS_7IntSizeEiRKNS_5ColorE
+__ZNK7WebCore7IntSizecv6CGSizeEv
+__ZN7WebCore15GraphicsContext11clearShadowEv
+__ZN7WebCore15GraphicsContext19clearPlatformShadowEv
 __ZN7WebCore15GraphicsContext18addRoundedRectClipERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
 __ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeES6_S6_S6_
+__ZN7WebCore4PathC1Ev
+__ZN7WebCore4PathC2Ev
+__ZN7WebCore4Path6moveToERKNS_10FloatPointE
+__ZN7WebCore4Path9addLineToERKNS_10FloatPointE
 __ZN7WebCore4Path16addBezierCurveToERKNS_10FloatPointES3_S3_
+__ZN7WebCore4Path12closeSubpathEv
+__ZN7WebCore4PathC1ERKS0_
+__ZN7WebCore4PathC2ERKS0_
+__ZN7WebCore4PathD1Ev
+__ZN7WebCore4PathD2Ev
 __ZN7WebCore15GraphicsContext4clipERKNS_4PathE
-__ZN7WebCore14RenderThemeMac19paintMenuListButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac28paintMenuListButtonGradientsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore23MainGradientInterpolateEPvPKfPf
-__ZN7WebCore22TopGradientInterpolateEPvPKfPf
-__ZN7WebCore25BottomGradientInterpolateEPvPKfPf
-__ZN7WebCore15GraphicsContext23addInnerRoundedRectClipERKNS_7IntRectEi
-__ZN7WebCore12RenderObject13drawBorderArcEPNS_15GraphicsContextEiifNS_7IntSizeEiiNS0_10BorderSideENS_5ColorERKS5_NS_12EBorderStyleEb
-__ZN7WebCore15GraphicsContext9strokeArcERKNS_7IntRectEii
-__ZNK7WebCore15HTMLLinkElement3relEv
-__ZNK7WebCore15HTMLLinkElement4hrefEv
-__ZNK7WebCore15HTMLLinkElement4typeEv
-__ZN3KJS19windowProtoFuncOpenEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS37valueToStringWithUndefinedOrNullCheckEPNS_9ExecStateEPNS_7JSValueE
-__ZN3KJS10allowPopUpEPNS_9ExecStateE
-__ZN7WebCore14WindowFeaturesC1ERKNS_6StringE
-__ZN7WebCore11isSeparatorEt
-__ZN7WebCore14WindowFeatures16setWindowFeatureERKNS_6StringES3_
-__ZN7WebCore9DOMWindow16adjustWindowRectERKNS_9FloatRectERS1_S3_
-__ZN3KJS12createWindowEPNS_9ExecStateEPN7WebCore5FrameERKNS2_6StringES7_RKNS2_14WindowFeaturesEPNS_7JSValueE
-__ZN7WebCore11FrameLoader12createWindowERKNS_16FrameLoadRequestERKNS_14WindowFeaturesERb
-__ZNK7WebCore6Chrome12createWindowEPNS_5FrameERKNS_16FrameLoadRequestERKNS_14WindowFeaturesE
-__ZNK7WebCore19ResourceRequestBase7isEmptyEv
-__ZNK7WebCore6Chrome18setToolbarsVisibleEb
-__ZNK7WebCore6Chrome19setStatusbarVisibleEb
-__ZNK7WebCore6Chrome20setScrollbarsVisibleEb
-__ZN7WebCore9FrameView17setHScrollbarModeENS_13ScrollbarModeE
-__ZN7WebCore9FrameView17setVScrollbarModeENS_13ScrollbarModeE
-__ZNK7WebCore6Chrome17setMenubarVisibleEb
-__ZNK7WebCore6Chrome12setResizableEb
-__ZNK7WebCore6Chrome8pageRectEv
-__ZNK7WebCore6Chrome13setWindowRectERKNS_9FloatRectE
-__ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
-__ZNK7WebCore6Chrome4showEv
-__ZN3WTF7HashSetIPN7WebCore5FrameENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore11FrameLoader14setOpenedByDOMEv
-__ZN7WebCore33jsDOMWindowPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow5focusEv
-__ZN7WebCore5Frame11focusWindowEv
-__ZN7WebCore20encodeRelativeStringERKNS_4KURLERKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZNK7WebCore16DeprecatedString4findEPKcib
-__ZN7WebCore5equalEPKNS_14DeprecatedCharEPKci
-__ZN7WebCore14encodeHostnameERKNS_16DeprecatedStringE
-__ZNK7WebCore16DeprecatedString4findERKNS_17RegularExpressionEi
-__ZNK7WebCore20JSHTMLHeadingElement9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement4hostEv
-__ZN7WebCore11RenderBlock23deleteEllipsisLineBoxesEv
-__ZN7WebCore11RenderBlock25checkLinesForTextOverflowEv
-__ZNK7WebCore14SimpleFontData18containsCharactersEPKti
-__ZN7WebCore18MainResourceLoader26stopLoadingForPolicyChangeEv
-__ZNK7WebCore18MainResourceLoader32interruptionForPolicyChangeErrorEv
-__ZN7WebCore11FrameLoader32interruptionForPolicyChangeErrorERKNS_15ResourceRequestE
-__ZN7WebCore10IconLoader11stopLoadingEv
-__ZN7WebCore11FrameLoader21handleFallbackContentEv
--[WebScriptObject setValue:forKey:]
--[WebScriptObject _isSafeScript]
--[WebScriptObject _rootObject]
-__ZNK3KJS6Window16allowsAccessFromEPKNS_14JSGlobalObjectE
--[WebScriptObject _imp]
-__Z11_didExecuteP15WebScriptObject
-__Z26updateRenderingForBindingsPN3KJS9ExecStateEPNS_8JSObjectE
-+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]
-__ZN7WebCore12IconDatabase17iconURLForPageURLERKNS_6StringE
-__ZN7WebCore9FrameView20addSlowRepaintObjectEv
-__ZNK7WebCore14RenderThemeMac22adjustSliderTrackStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore12RenderSliderC2EPNS_16HTMLInputElementE
-__ZN7WebCore12RenderSlider8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderSlider17updateFromElementEv
-__ZN7WebCore22HTMLSliderThumbElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore12RenderSlider16createThumbStyleEPNS_11RenderStyleES2_
-__ZNK7WebCore14RenderThemeMac22adjustSliderThumbStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore12RenderSlider20setPositionFromValueEb
-__ZN7WebCore12RenderSlider6layoutEv
-__ZN7WebCore12RenderSlider14calcPrefWidthsEv
-__ZNK7WebCore14RenderThemeMac21adjustSliderThumbSizeEPNS_12RenderObjectE
-__ZN7WebCore12RenderSlider9trackSizeEv
-__ZN7WebCore12RenderSlider18setCurrentPositionEi
-__ZNK7WebCore22HTMLSliderThumbElement12isShadowNodeEv
-__ZN7WebCore22HTMLSliderThumbElement16shadowParentNodeEv
-__ZNK7WebCore12RenderSlider16baselinePositionEbb
-__ZN7WebCore17RenderFlexibleBoxC2EPNS_4NodeE
-__ZN7WebCore17RenderFlexibleBox17layoutVerticalBoxEb
-__ZN7WebCore11RenderBlock30markPositionedObjectsForLayoutEv
-__ZN7WebCore11RenderBlock15clearTruncationEv
-__ZN7WebCore16shouldCheckLinesEPNS_12RenderObjectE
-__ZN7WebCore13RootInlineBox22canAccommodateEllipsisEbiii
-__ZNK7WebCore11RenderBlock25getBaselineOfFirstLineBoxEv
-__ZN7WebCore11RenderBlock9lineCountEv
-__ZN7WebCore13InlineFlowBox22canAccommodateEllipsisEbii
-__ZN7WebCore9InlineBox22canAccommodateEllipsisEbii
-__ZN7WebCore13RootInlineBox13placeEllipsisERKNS_12AtomicStringEbiiPNS_9InlineBoxE
-__ZN7WebCore13RootInlineBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore13InlineFlowBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore13InlineTextBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore14RenderThemeMac16paintSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore24TrackGradientInterpolateEPvPKfPf
-__ZNK7WebCore12RenderSlider8isSliderEv
-__ZN7WebCore14RenderThemeMac16paintSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac21sliderThumbHorizontalEv
-__ZNK7WebCore12RenderSlider10inDragModeEv
-__ZNK7WebCore12RenderObject14caretMaxOffsetEv
-__ZNK7WebCore11HistoryItem15rssFeedReferrerEv
-__ZN7WebCore11FrameLoader6reloadEv
-__ZN7WebCore17RenderFlexibleBoxD1Ev
-__ZN7WebCore11EllipsisBoxD1Ev
-_sqlite3Update
-_defragmentPage
-_getOverflowPage
-_freePage
-__ZNK7WebCore17HTMLSelectElement17canStartSelectionEv
-__ZN7WebCore9PopupMenu5clearEv
-__ZNK7WebCore12RenderObject14caretMinOffsetEv
-__ZN7WebCore11RenderBlock13selectionRectEb
-__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
-__ZN7WebCore5Range11compareNodeEPNS_4NodeERi
-__ZN7WebCore5Range12comparePointEPNS_4NodeEiRi
-__ZNK7WebCore13HitTestResult10isLiveLinkEv
-__ZNK7WebCore17HTMLAnchorElement10isLiveLinkEv
-__ZNK7WebCore12EventHandler22dragHysteresisExceededERKNS_8IntPointE
-__ZN7WebCore39jsHTMLFormElementPrototypeFunctionResetEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLFormElement5resetEv
-__ZN7WebCore16HTMLInputElement5resetEv
-__ZNK7WebCore12RenderObject12scrollHeightEv
-__ZN7WebCore18JSConsolePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsDocumentPrototypeFunctionExecCommandEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document11execCommandERKNS_6StringEbS3_
-__ZN7WebCore7commandEPNS_8DocumentERKNS_6StringEb
-__ZN7WebCore6Editor7CommandC1Ev
-__ZN7WebCore8Document11styleSheetsEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14StyleSheetListE
-__ZN7WebCore16JSStyleSheetListC1EPN3KJS8JSObjectEPNS_14StyleSheetListE
-__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore16JSStyleSheetListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSStyleSheetList16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14StyleSheetList6lengthEv
-__ZN7WebCore16JSStyleSheetList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore14StyleSheetList4itemEj
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10StyleSheetE
-__ZN7WebCore24JSCSSStyleSheetPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSCSSStyleSheetC1EPN3KJS8JSObjectEPNS_13CSSStyleSheetE
-__ZN7WebCore12JSStyleSheetC1EPN3KJS8JSObjectEPNS_10StyleSheetE
-__ZN7WebCore15JSCSSStyleSheet18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSStyleSheet18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore12JSStyleSheetEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSStyleSheet16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore15JSCSSStyleSheetEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSCSSStyleSheet16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore13CSSStyleSheet8cssRulesEb
-__ZN7WebCore11CSSRuleListC2EPNS_9StyleListEb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_11CSSRuleListE
-__ZN7WebCore13JSCSSRuleListC1EPN3KJS8JSObjectEPNS_11CSSRuleListE
-__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13JSCSSRuleList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7CSSRuleE
-__ZNK7WebCore13CSSImportRule4typeEv
-__ZN7WebCore15JSCSSImportRuleC1EPN3KJS8JSObjectEPNS_13CSSImportRuleE
-__ZN7WebCore9JSCSSRuleC1EPN3KJS8JSObjectEPNS_7CSSRuleE
-__ZN7WebCore15JSCSSImportRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSCSSRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSCSSRulePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore12CSSStyleRule4typeEv
-__ZN7WebCore14JSCSSStyleRuleC1EPN3KJS8JSObjectEPNS_12CSSStyleRuleE
-__ZN7WebCore14JSCSSStyleRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSCSSStyleRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCSSStyleRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLInputElement3srcEv
-__ZNK7WebCore21HTMLFrameOwnerElement15contentDocumentEv
-__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_8EqTestOp6OpcodeEi
-__ZN7WebCore5XPath8EqTestOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath8EqTestOp8evaluateEv
-__ZNK7WebCore5XPath8EqTestOp7compareERKNS0_5ValueES4_
-__ZN7WebCore5XPath5ValueD2Ev
-__ZNK7WebCore10ShadowDataeqERKS0_
-__ZN7WebCore15GraphicsContext9setShadowERKNS_7IntSizeEiRKNS_5ColorE
-__ZN7WebCore15GraphicsContext11clearShadowEv
-__ZN7WebCore7Element12scrollHeightEv
-__ZN7WebCore7Element11scrollWidthEv
-__ZNK7WebCore12RenderObject11scrollWidthEv
-__ZNK7WebCore12RenderObject20isInlineContinuationEv
-__ZNK7WebCore18RenderTextFragment12originalTextEv
-__ZN7WebCore18RenderTextFragment15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore18JSHTMLDListElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLDListElement9classInfoEv
-__ZN7WebCore18JSHTMLDListElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore22JSCSSRuleListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSHTMLCollection14implementsCallEv
-__ZNK7WebCore17HTMLAnchorElement3relEv
-__ZN7WebCore9CSSParser17createCharsetRuleERKNS_11ParseStringE
-__ZN7WebCore14CSSCharsetRuleC2EPNS_9StyleBaseERKNS_6StringE
-__ZN7WebCore9StyleBase11isMediaRuleEv
-__ZN7WebCore9StyleBase14isFontFaceRuleEv
-__ZN7WebCore13RootInlineBox14adjustPositionEii
-__ZN7WebCore13InlineFlowBox14adjustPositionEii
-__ZNK7WebCore14CSSCharsetRule4typeEv
-__ZN7WebCore16JSCSSCharsetRuleC1EPN3KJS8JSObjectEPNS_14CSSCharsetRuleE
-__ZN7WebCore16JSCSSCharsetRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSCustomXPathNSResolverC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore23JSCustomXPathNSResolverD1Ev
-__ZN7WebCore23JSCustomXPathNSResolver18lookupNamespaceURIERKNS_6StringE
-__ZN7WebCore22getPositionOffsetValueEPNS_11RenderStyleEi
-__ZNK7WebCore7Comment8nodeNameEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSCommentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSComment16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore44jsHTMLAnchorElementPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17HTMLAnchorElement8toStringEv
-__ZN7WebCore17JSHTMLHeadElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9sizingBoxEPNS_12RenderObjectE
-__ZNK7WebCore13KeyboardEvent8charCodeEv
-__ZNK7WebCore6String19characterStartingAtEj
-__ZN7WebCore10StringImpl19characterStartingAtEj
-__ZN7WebCore40jsHTMLFormElementPrototypeFunctionSubmitEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLFormElement6submitEv
-__ZN7WebCore14CSSCharsetRuleD1Ev
-__ZN7WebCore14RenderTableRow12imageChangedEPNS_11CachedImageE
-__ZN7WebCore12EventHandler29passMousePressEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
-__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetEPNS_12RenderWidgetE
-__ZN7WebCore12EventHandler31passMouseReleaseEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
-__ZNK7WebCore12RenderObject8viewRectEv
-__ZNK7WebCore12RenderObject12overflowLeftEb
-__ZN7WebCore32jsDOMWindowPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow4blurEv
-__ZN7WebCore5Frame13unfocusWindowEv
-__ZNK7WebCore6Chrome7unfocusEv
-__ZN7WebCore11FrameLoader15didExplicitOpenEv
-__ZN7WebCore33jsDOMWindowPrototypeFunctionCloseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow5closeEv
-__ZNK7WebCore11FrameLoader11openedByDOMEv
-__ZN7WebCore5Frame13scheduleCloseEv
-__ZN7WebCore6Chrome15closeWindowSoonEv
-__ZNK3KJS7Plugins9classInfoEv
-__ZNK7WebCore16JSHTMLCollection9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement4nameEv
-__ZNK7WebCore15HTMLFormElement4nameEv
-__ZN7WebCore11FrameLoader25loadResourceSynchronouslyERKNS_15ResourceRequestERNS_13ResourceErrorERNS_16ResourceResponseERN3WTF6VectorIcLm0EEE
-__ZN7WebCore19ResourceRequestBase18setTimeoutIntervalEd
-__ZN7WebCore14ResourceHandle25loadResourceSynchronouslyERKNS_15ResourceRequestERNS_13ResourceErrorERNS_16ResourceResponseERN3WTF6VectorIcLm0EEEPNS_5FrameE
-+[WebCoreSynchronousLoader loadRequest:returningResponse:error:]
--[WebCoreSynchronousLoader _isDone]
--[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]
--[WebCoreSynchronousLoader connection:didReceiveResponse:]
--[WebCoreSynchronousLoader connection:didReceiveData:]
--[WebCoreSynchronousLoader connectionDidFinishLoading:]
--[WebCoreSynchronousLoader _data]
--[WebCoreSynchronousLoader _response]
--[WebCoreSynchronousLoader _error]
--[WebCoreSynchronousLoader dealloc]
-__ZN7WebCore20ResourceResponseBaseD2Ev
-__ZN7WebCore13ResourceErroraSERKS0_
-__ZN7WebCore14XMLHttpRequest22processSyncLoadResultsERKN3WTF6VectorIcLm0EEERKNS_16ResourceResponseE
-__ZN7WebCore19createObjectWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLObjectElementC1EPN3KJS8JSObjectEPNS_17HTMLObjectElementE
-__ZN7WebCore19JSHTMLObjectElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLObjectElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_17HTMLObjectElementERKNS1_10IdentifierE
-__ZN7WebCore19JSHTMLObjectElement24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement11getInstanceEv
-__ZN7WebCore28JSHTMLObjectElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11FrameLoader21fileDoesNotExistErrorERKNS_16ResourceResponseE
-__ZN7WebCore5XPath18createFunLocalNameEv
-__ZN7WebCore5XPath9LogicalOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath9LogicalOp8evaluateEv
-__ZNK7WebCore5XPath12FunLocalName8evaluateEv
-__ZNK7WebCore5XPath9LogicalOp14shortCircuitOnEv
-__ZNK7WebCore12RenderButton14hasLineIfEmptyEv
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLMapElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLMapElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14HTMLMapElement4nameEv
-__ZNK7WebCore15HTMLAreaElement6coordsEv
-__ZN7WebCore26JSUnprotectedEventListener14clearWindowObjEv
-__ZN7WebCore12RenderObject6setPosEii
-__ZN7WebCore11FrameLoader20checkNewWindowPolicyERKNS_16NavigationActionERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringE
-__ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEPFvPvS3_S7_SA_bESB_
-__ZN7WebCore11FrameLoader28continueAfterNewWindowPolicyENS_12PolicyActionE
-__ZN7WebCore11FrameLoader36callContinueLoadAfterNewWindowPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEb
-__ZN7WebCore11FrameLoader32continueLoadAfterNewWindowPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEb
-__ZN3KJS22pluginsFunctionRefreshEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10PluginBase7refreshEb
-__ZN7WebCore14refreshPluginsEb
-__ZNK7WebCore17HTMLIFrameElement6heightEv
-__ZNK7WebCore19JSHTMLObjectElement9classInfoEv
-__ZN7WebCore19JSHTMLObjectElement10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore9Selection22expandUsingGranularityENS_15TextGranularityE
-__ZN7WebCore15isEndOfDocumentERKNS_15VisiblePositionE
-__ZN7WebCore11isEndOfLineERKNS_15VisiblePositionE
-__ZN7WebCore9endOfLineERKNS_15VisiblePositionE
-__ZN7WebCore18endPositionForLineERKNS_15VisiblePositionE
-__ZN7WebCore11RenderBlock24fillVerticalSelectionGapEiiiiPS0_iiPKNS_12RenderObject9PaintInfoE
-__ZN7WebCore18JSHTMLEmbedElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLEmbedElement9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore22runtimeObjectCustomPutEPN3KJS9ExecStateERKNS0_10IdentifierEPNS0_7JSValueEiPNS_11HTMLElementE
-__ZN7WebCore18JSHTMLEmbedElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLPlugInElement8setWidthERKNS_6StringE
-__ZN7WebCore17HTMLPlugInElement9setHeightERKNS_6StringE
-__ZN7WebCore9CSSParser10parseShapeEib
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4RectEEE
-__ZN7WebCore15convertToLengthEPNS_17CSSPrimitiveValueEPNS_11RenderStyleEPb
-__ZN7WebCore11RenderStyle7setClipENS_6LengthES1_S1_S1_
-__ZN7WebCore9RenderBox11getClipRectEii
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S6_S9_EEEENS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EERKT_
-__ZNK7WebCore13HitTestResult16absoluteImageURLEv
-__ZNK7WebCore20HTMLFrameElementBase3srcEv
-_WebCoreDrawTextAtPoint
-__ZNK7WebCore17MouseRelatedEvent1xEv
-__ZNK7WebCore12RenderObject10nextOffsetEi
-__ZN7WebCore12EventHandler20autoscrollTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore12RenderObject10autoscrollEv
-__ZN7WebCore11RenderLayer10autoscrollEv
-__ZN7WebCore12EventHandler27updateSelectionForMouseDragEv
-__ZNK7WebCore12EventHandler20currentMousePositionEv
-__ZNK7WebCore13CharacterData19isCharacterDataNodeEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator17handleNonTextNodeEv
-__ZNK7WebCore4Node19isCharacterDataNodeEv
-__ZN7WebCore18MainResourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore18MainResourceLoader13receivedErrorERKNS_13ResourceErrorE
-__ZN7WebCore18MainResourceLoader18handleDataLoadSoonERNS_15ResourceRequestE
-__ZN7WebCore5TimerINS_18MainResourceLoaderEE5firedEv
-__ZN7WebCore18MainResourceLoader17handleDataLoadNowEPNS_5TimerIS0_EE
-__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
-__ZN7WebCore11EllipsisBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore36jsHTMLDocumentPrototypeFunctionCloseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12RenderInline13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN7WebCore19JSHTMLSelectElement11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement4itemEj
-__ZN7WebCore17HTMLButtonElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore12RenderButton24updateBeforeAfterContentENS_11RenderStyle8PseudoIdE
-__ZN7WebCore12RenderButton28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
-__ZN7WebCore44jsDocumentPrototypeFunctionGetElementsByNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node17getElementsByNameERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringENS1_15DynamicNodeList6CachesENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS1_6StringES6_NS_17HashMapTranslatorILb0ES4_ISI_S6_ENS_18PairBaseHashTraitsINSC_ISI_EESE_EESF_SA_EEEES4_INS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEbERKT_RKT0_
-__ZN7WebCore12NameNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
-__ZNK7WebCore12NameNodeList11nodeMatchesEPNS_4NodeE
-__ZNK7WebCore17HTMLButtonElement14isEnumeratableEv
-__ZNK7WebCore13KeyboardEvent5whichEv
-__ZNK7WebCore17HTMLAnchorElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler11tabsToLinksEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler24invertSenseOfTabsToLinksEPNS_13KeyboardEventE
-__ZNK7WebCore22HTMLGenericFormElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler17tabsToAllControlsEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLButtonElement17isActivatedSubmitEv
-__ZNK7WebCore17HTMLButtonElement24isSuccessfulSubmitButtonEv
-__ZN7WebCore17HTMLButtonElement18setActivatedSubmitEb
-__ZN7WebCore17HTMLButtonElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore12EventHandler32handleMousePressEventTripleClickERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore12HTMLDocument10compatModeEv
-__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8resizeToEff
-__ZN7WebCore19JSHTMLObjectElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLObjectElement9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLObjectElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLObjectElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLObjectElement4typeEv
-__ZN7WebCore15HTMLFormElement16removeImgElementEPNS_16HTMLImageElementE
-__ZN7WebCore23JSHTMLOptionsCollection16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore21HTMLOptionsCollection16setSelectedIndexEi
-__ZNK7WebCore19JSHTMLSelectElement9classInfoEv
-__ZN7WebCore12HTMLDocument5widthEv
-__ZNK7WebCore8Document7doctypeEv
-__ZNK7WebCore12DocumentType8nodeTypeEv
-__ZN7WebCore14JSDocumentTypeC1EPN3KJS8JSObjectEPNS_12DocumentTypeE
-__ZN7WebCore12HTMLDocument6heightEv
-__ZN7WebCore17HTMLSelectElement6removeEi
-__ZN7WebCore17HTMLSelectElement11removeChildEPNS_4NodeERi
-__ZN7WebCore19createButtonWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLButtonElementC1EPN3KJS8JSObjectEPNS_17HTMLButtonElementE
-__ZN7WebCore19JSHTMLButtonElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLButtonElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLButtonElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSCSSStyleDeclarationEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSCSSStyleDeclaration16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore9FontValue7cssTextEv
-__ZN7WebCore17createFontWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLFontElementC1EPN3KJS8JSObjectEPNS_15HTMLFontElementE
-__ZN7WebCore17JSHTMLFontElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLFontElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore14HTMLPreElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore14HTMLPreElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16executeMoveRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController24modifyMovingRightForwardENS_15TextGranularityE
-__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionEb
-__ZNK7WebCore5Frame11revealCaretERKNS_11RenderLayer15ScrollAlignmentE
-__ZNK7WebCore15VisiblePosition9caretRectEv
-__ZN7WebCore10HTMLParser11isHeaderTagERKNS_12AtomicStringE
-__ZN7WebCore14RenderFieldset22paintBorderMinusLegendEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEiii
-__ZNK7WebCore16HTMLImageElement4nameEv
-__ZNK7WebCore10MouseEvent9toElementEv
-__ZN7WebCore10RenderText17previousCharacterEv
-__ZNK7WebCore12RenderObject18previousInPreOrderEv
-__ZN7WebCore10StringImpl10capitalizeEt
-__ZN7WebCore17wordBreakIteratorEPKti
-__ZN7WebCore14textBreakFirstEPNS_17TextBreakIteratorE
-__ZN7WebCore15createHRWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore15JSHTMLHRElementC1EPN3KJS8JSObjectEPNS_13HTMLHRElementE
-__ZN7WebCore15JSHTMLHRElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsLocationProtoFuncReloadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11FrameLoader15scheduleRefreshEb
-__ZN7WebCore17HTMLAnchorElement7setNameERKNS_6StringE
-__ZN7WebCore22JSHTMLParagraphElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore16HTMLInputElement5alignEv
-__ZNK7WebCore16HTMLTableElement6borderEv
-__ZN7WebCore19HTMLTextAreaElement5resetEv
-__ZN7WebCore8Document17setSecurityOriginEPNS_14SecurityOriginE
-__ZN7WebCore11FrameLoader5writeERKNS_6StringE
-__ZN7WebCore17HTMLSelectElement5resetEv
-__ZN7WebCore22HTMLGenericFormElement5resetEv
-__ZN7WebCore40jsHTMLAnchorElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17HTMLScriptElement10setCharsetERKNS_6StringE
-__ZN7WebCore17RenderTextControl6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore9supportedEPNS_5FrameENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command5stateEPNS_5EventE
-__ZN7WebCore9stateNoneEPNS_5FrameEPNS_5EventE
-__ZN7WebCore10enabledCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore6Editor11canDHTMLCutEv
-__ZN7WebCore6Editor16dispatchCPPEventERKNS_12AtomicStringENS_21ClipboardAccessPolicyE
-__ZN7WebCore6Editor19newGeneralClipboardENS_21ClipboardAccessPolicyE
-__ZN7WebCore12ClipboardMacC2EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
-__ZN7WebCore9ClipboardC2ENS_21ClipboardAccessPolicyEb
-__ZN7WebCore14ClipboardEventC2ERKNS_12AtomicStringEbbPNS_9ClipboardE
-__ZN7WebCore9Clipboard15setAccessPolicyENS_21ClipboardAccessPolicyE
-__ZN7WebCore12ClipboardMacD1Ev
-__ZNK7WebCore6Editor6canCutEv
-__ZNK7WebCore6Editor7canCopyEv
-__ZN7WebCore29imageElementFromImageDocumentEPNS_8DocumentE
-__ZN7WebCore11enabledCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore6Editor12canDHTMLCopyEv
-__ZN7WebCore6Editor13canDHTMLPasteEv
-__ZNK7WebCore6Editor8canPasteEv
-__ZN7WebCore13enabledDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore7enabledEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
--[WebCoreFrameBridge canProvideDocumentSource]
-__ZNK7WebCore11FrameLoader16responseMIMETypeEv
-__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16HTMLImageElement3altEv
-__ZN7WebCore14RenderReplaced22positionForCoordinatesEii
-__ZNK7WebCore9JSComment9classInfoEv
-__ZN7WebCore9FrameView20postLayoutTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_12NamedNodeMapE
-__ZN7WebCore14JSNamedNodeMapC1EPN3KJS8JSObjectEPNS_12NamedNodeMapE
-__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSNamedNodeMapPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSNamedNodeMapEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSNamedNodeMap16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS49jsXMLHttpRequestPrototypeFunctionOverrideMIMETypeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest16overrideMIMETypeERKNS_6StringE
-__ZN7WebCore29jsConsolePrototypeFunctionLogEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9JSConsole9classInfoEv
-__ZN7WebCore7Console3logERKNS_6StringE
-__ZN7WebCore9CSSParser27createFloatingMediaQueryExpERKNS_12AtomicStringEPNS_9ValueListE
-__ZN7WebCore13MediaQueryExpC2ERKNS_12AtomicStringEPNS_9ValueListE
-__ZN7WebCore9CSSParser25sinkFloatingMediaQueryExpEPNS_13MediaQueryExpE
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE15reserveCapacityEm
-__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_13MediaQueryExpE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_4PageENS1_18MediaFeaturePrefixEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSF_ISC_EEE3getERKS3_
-__ZN7WebCore25min_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore21widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore12compareValueIiEEbT_S1_NS_18MediaFeaturePrefixE
-__ZN7WebCore27JSHTMLDivElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLDivElementConstructor9classInfoEv
-__ZN7WebCore26JSHTMLLIElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLLIElementConstructor9classInfoEv
-__ZN7WebCore9InlineBox14selectionStateEv
-__ZN7WebCore29JSHTMLImageElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLImageElementConstructor9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLTableCellElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLTableCellElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore33JSHTMLTableCellElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore33JSHTMLTableCellElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLTableElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLTableElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLBodyElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLBodyElementConstructor9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLTableRowElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLTableRowElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore32JSHTMLTableRowElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLTableRowElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLAnchorElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLAnchorElementConstructor9classInfoEv
-__ZN7WebCore13MediaQueryExpD2Ev
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE6shrinkEm
-__ZN7WebCore4Page9goForwardEv
-__ZN7WebCore10JSDocument11setLocationEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
-__ZN3KJS9MimeTypes11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore49jsDocumentPrototypeFunctionCreateDocumentFragmentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document22createDocumentFragmentEv
-__ZNK7WebCore24JSHTMLElementConstructor9classInfoEv
-__ZNK7WebCore11RenderBlock14positionForBoxEPNS_9InlineBoxEb
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLTitleElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLTitleElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLTitleElement4textEv
-__ZNK7WebCore15HTMLBodyElement11scrollWidthEv
-__ZN7WebCore41jsHTMLInputElementPrototypeFunctionSelectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19basefontConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLBaseFontElementC2EPNS_8DocumentE
-__ZNK7WebCore19HTMLBaseFontElement17endTagRequirementEv
-__ZNK7WebCore19HTMLBaseFontElement11tagPriorityEv
-__ZN7WebCore43jsNamedNodeMapPrototypeFunctionGetNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSNamedNodeMap9classInfoEv
-__ZN7WebCore6JSAttrC1EPN3KJS8JSObjectEPNS_4AttrE
-__ZN7WebCore6JSAttr18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore6JSAttrEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSAttr16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16DeprecatedString7replaceEjjRKS0_
-__ZNK7WebCore11RenderTheme32inactiveSelectionBackgroundColorEv
-__ZNK7WebCore14RenderThemeMac40platformInactiveSelectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme40platformInactiveSelectionForegroundColorEv
-__ZN7WebCore10IconRecordD2Ev
-__ZNK7WebCore18JSConsolePrototype9classInfoEv
-__ZN7WebCore19optgroupConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLOptGroupElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore19HTMLOptGroupElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19HTMLOptGroupElement19recalcSelectOptionsEv
-__ZN7WebCore19HTMLOptGroupElement6attachEv
-__ZN7WebCore19HTMLOptGroupElement14setRenderStyleEPNS_11RenderStyleE
-__ZN7WebCore19HTMLOptGroupElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore19HTMLOptGroupElement15childrenChangedEb
-__ZNK7WebCore19HTMLOptGroupElement11renderStyleEv
-__ZN7WebCore12IconDatabase25removeIconFromSQLDatabaseERKNS_6StringE
-__ZNK7WebCore17JSNodeConstructor21implementsHasInstanceEv
-__ZThn8_N7WebCore14XMLHttpRequest7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore14XMLHttpRequest7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore19HTMLOptGroupElement6detachEv
-__ZN7WebCore30JSHTMLTextAreaElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSHTMLTextAreaElement9classInfoEv
-__ZN7WebCore21JSHTMLTextAreaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLTextAreaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore14RenderThemeMac35adjustSearchFieldResultsButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore14RenderThemeMac29paintSearchFieldResultsButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac18searchMenuTemplateEv
-__ZN7WebCore12EventHandler13freeClipboardEv
-__ZNK7WebCore12EventHandler23createDraggingClipboardEv
-__ZN7WebCore12EventHandler20dispatchDragSrcEventERKNS_12AtomicStringERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler17dispatchDragEventERKNS_12AtomicStringEPNS_4NodeERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZNK7WebCore9Clipboard15sourceOperationERNS_13DragOperationE
-__ZN7WebCore14DragController9startDragEPNS_5FrameEPNS_9ClipboardENS_13DragOperationERKNS_18PlatformMouseEventERKNS_8IntPointEb
-__ZN7WebCore8getImageEPNS_7ElementE
-__ZN7WebCore12ClipboardMac7hasDataEv
-__ZNK7WebCore13HitTestResult16altDisplayStringEv
-__ZN7WebCore13displayStringERKNS_6StringEPKNS_4NodeE
-__ZN7WebCore9SelectionC2EPKNS_5RangeENS_9EAffinityE
-__ZN7WebCore14RenderReplaced17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore14RenderReplaced18canBeSelectionLeafEv
-__ZN7WebCore14RenderReplaced13selectionRectEb
-__ZN7WebCore12ClipboardMac24declareAndWriteDragImageEPNS_7ElementERKNS_4KURLERKNS_6StringEPNS_5FrameE
--[WebCoreFrameBridge markupStringFromNode:nodes:]
--[WebCoreFrameBridge nodesFromList:]
--[WebCoreFrameBridge _stringWithDocumentTypeStringAndMarkupString:]
-__ZNK7WebCore5Frame18documentTypeStringEv
-__ZNK7WebCore12DocumentType8toStringEv
--[DOMHTMLImageElement useMap]
-__ZNK7WebCore16HTMLImageElement6useMapEv
--[DOMHTMLImageElement src]
--[WebCoreFrameBridge URLWithAttributeString:]
--[WebCoreFrameBridge getData:andResponse:forURL:]
-__ZN7WebCore12SharedBuffer12createNSDataEv
-__ZNK7WebCore13HitTestResult9imageRectEv
-__ZNK7WebCore12RenderObject18absoluteContentBoxEv
-__ZN7WebCore14DragController11doImageDragEPNS_7ElementERKNS_8IntPointERKNS_7IntRectEPNS_9ClipboardEPNS_5FrameERS3_
-__ZN7WebCore24createDragImageFromImageEPNS_5ImageE
-__ZNK7WebCore7IntSizecv7_NSSizeEv
-__ZN7WebCore14DragController16maxDragImageSizeEv
-__ZN7WebCore21fitDragImageToMaxSizeEN3WTF9RetainPtrI7NSImageEERKNS_7IntSizeES6_
-__ZN7WebCore13dragImageSizeEN3WTF9RetainPtrI7NSImageEE
-__ZN7WebCore27dissolveDragImageToFractionEN3WTF9RetainPtrI7NSImageEEf
-__ZN7WebCore14DragController12doSystemDragEN3WTF9RetainPtrI7NSImageEERKNS_8IntPointES7_PNS_9ClipboardEPNS_5FrameEb
-__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
-__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
-__ZN7WebCore14DragController20dragEnteredOrUpdatedEPNS_8DragDataE
-__ZN7WebCore5Frame15documentAtPointERKNS_8IntPointE
-__ZN7WebCore14DragController15tryDocumentDragEPNS_8DragDataENS_21DragDestinationActionE
-__ZN7WebCore14DragController12tryDHTMLDragEPNS_8DragDataE
-__ZNK7WebCore11FrameLoader7baseURLEv
-__ZNK7WebCore8DragData15createClipboardENS_21ClipboardAccessPolicyE
-__ZN7WebCore9Clipboard18setSourceOperationENS_13DragOperationE
-__ZN7WebCore14IEOpFromDragOpENS_13DragOperationE
-__ZN7WebCore16createMouseEventEPNS_8DragDataE
-__ZN7WebCore12EventHandler17updateDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZN7WebCore14DragController14canProcessDragEPNS_8DragDataE
-__ZNK7WebCore8DragData25containsCompatibleContentEv
-__ZNK7WebCore8DragData13containsFilesEv
-__ZN7WebCore14DragController16operationForLoadEPNS_8DragDataE
-__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
--[WebCoreFrameBridge dragSourceMovedTo:]
-__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
-__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
-__ZN7WebCore12EventHandler17cancelDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZN7WebCore12EventHandler14clearDragStateEv
-__ZN7WebCore14DragController10cancelDragEv
--[WebCoreFrameBridge dragSourceEndedAt:operation:]
-__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
-__ZN7WebCore9Clipboard23setDestinationOperationENS_13DragOperationE
-__ZN7WebCore15deleteDragImageEN3WTF9RetainPtrI7NSImageEE
-__ZN7WebCore34jsDOMWindowPrototypeFunctionScrollEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14SimpleFontData17smallCapsFontDataERKNS_15FontDescriptionE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_17DOMImplementationE
-__ZN7WebCore19JSDOMImplementationC1EPN3KJS8JSObjectEPNS_17DOMImplementationE
-__ZN7WebCore19JSDOMImplementation18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSDOMImplementationPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13HTMLTokenizer26parseProcessingInstructionERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore5XPath12LocationPath15insertFirstStepEPNS0_4StepE
-__ZN7WebCore41jsXPathResultPrototypeFunctionIterateNextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11XPathResult11iterateNextERi
-__ZN7WebCore14JSNamedNodeMap11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore12NamedAttrMap4itemEj
-__ZN7WebCore21JSCSSStyleDeclaration16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore26CSSMutableStyleDeclaration10setCssTextERKNS_6StringERi
-__ZN7WebCore9Scrollbar6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZThn8_N7WebCore17PlatformScrollbar19updateThumbPositionEv
-__ZN7WebCore17PlatformScrollbar19updateThumbPositionEv
-__ZN7WebCore11RenderLayer12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore17HTMLButtonElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore17HTMLButtonElement17canStartSelectionEv
-__ZN7WebCore22JSNamedNodesCollection12lengthGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore21HTMLFrameOwnerElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLSelectElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLOptionElement11isFocusableEv
-__ZN7WebCore12NameNodeList24rootNodeAttributeChangedEv
-__ZN7WebCore30jsElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore11RenderLayer23verticalScrollbarWidgetEv
-__ZN7WebCore13HitTestResult12setScrollbarEPNS_17PlatformScrollbarE
-__ZN7WebCore9Scrollbar20handleMouseMoveEventERKNS_18PlatformMouseEventE
-__ZN7WebCore9Scrollbar19handleMouseOutEventERKNS_18PlatformMouseEventE
-__ZN7WebCore12HTMLDocument7bgColorEv
-__ZNK7WebCore15HTMLBodyElement7bgColorEv
-__ZN7WebCore14JSDocumentType18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSDocumentTypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSDocumentType16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14JSDocumentType4implEv
-__ZN7WebCore22HTMLGenericFormElement11setTabIndexEi
-__ZN7WebCore19JSHTMLButtonElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLButtonElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore17HTMLButtonElement4typeEv
-__ZNK7WebCore14RenderFieldset33expandsToEncloseOverhangingFloatsEv
-__ZNK7WebCore4Node9isEnabledEv
-__ZN7WebCore35jsHTMLDocumentPrototypeFunctionOpenEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSHTMLDocument4openEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow6moveToEff
-__ZNK7WebCore19HTMLFieldSetElement11isFocusableEv
-__ZN7WebCore28JSHTMLButtonElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLButtonElement9classInfoEv
-__ZNK7WebCore7UIEvent7keyCodeEv
-__ZN7WebCore13ImageDocumentC2EPNS_17DOMImplementationEPNS_5FrameE
-__ZNK7WebCore13ImageDocument17shouldShrinkToFitEv
-__ZN7WebCore13ImageDocument15createTokenizerEv
-__ZNK7WebCore14ImageTokenizer12wantsRawDataEv
-__ZN7WebCore14ImageTokenizer12writeRawDataEPKci
-__ZN7WebCore13ImageDocument11cachedImageEv
-__ZN7WebCore13ImageDocument23createDocumentStructureEv
-__ZN7WebCore8Document16childTypeAllowedENS_4Node8NodeTypeE
-__ZNK7WebCore14DocumentLoader16mainResourceDataEv
-__ZN7WebCore13ImageDocument12imageChangedEv
-__ZN7WebCore14ImageTokenizer6finishEv
-__ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
-__ZN7WebCore15finishImageLoadEPNS_8DocumentEPNS_11CachedImageE
-__ZNK7WebCore20ResourceResponseBase17suggestedFilenameEv
-__ZN7WebCore8Document4headEv
-__ZN7WebCore14ImageTokenizerD1Ev
-__ZN7WebCore10IconLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByClassNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node22getElementsByClassNameERKNS_6StringE
-__ZN7WebCore13ClassNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
-__ZNK7WebCore13ClassNodeList11nodeMatchesEPNS_4NodeE
-__ZN7WebCore18createParamWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLParamElementC1EPN3KJS8JSObjectEPNS_16HTMLParamElementE
-__ZN7WebCore18JSHTMLParamElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLParamElement9classInfoEv
-__ZN7WebCore48jsElementPrototypeFunctionGetElementsByClassNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore19JSHTMLObjectElement14implementsCallEv
-__ZN7WebCore13ClassNodeListD1Ev
-__ZN7WebCore46jsDOMImplementationPrototypeFunctionHasFeatureEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore19JSDOMImplementation9classInfoEv
-__ZN7WebCore14isSVG10FeatureERKNS_6StringE
-__ZN7WebCore10ShadowDataC2ERKS0_
-__ZN7WebCore35HTMLSearchFieldResultsButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore34HTMLSearchFieldCancelButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore18JSHTMLOListElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore16HTMLInputElement12setMaxLengthEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLLabelElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLLabelElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLLabelElement7htmlForEv
-__ZNK7WebCore13MutationEvent15isMutationEventEv
-__ZN7WebCore15JSMutationEventC1EPN3KJS8JSObjectEPNS_13MutationEventE
-__ZN7WebCore10JSNodeList10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore42jsElementPrototypeFunctionGetAttributeNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element16getAttributeNodeERKNS_6StringE
-__ZN7WebCore12IconDatabase5closeEv
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE6shrinkEm
-___tcf_0
-___tcf_46
-___tcf_45
-___tcf_44
-___tcf_43
-___tcf_42
-___tcf_41
-___tcf_40
-___tcf_39
-___tcf_38
-___tcf_37
-___tcf_36
-___tcf_35
-___tcf_34
-___tcf_33
-___tcf_32
-___tcf_31
-___tcf_30
-___tcf_29
-___tcf_28
-___tcf_27
-___tcf_26
-___tcf_25
-___tcf_24
-___tcf_23
-___tcf_22
-___tcf_21
-___tcf_20
-___tcf_19
-___tcf_18
-___tcf_17
-___tcf_16
-___tcf_15
-___tcf_14
-___tcf_13
-___tcf_12
-___tcf_11
-___tcf_10
-___tcf_9
-___tcf_8
-___tcf_7
-___tcf_6
-___tcf_5
-___tcf_4
-___tcf_3
-___tcf_2
-__ZN7WebCore5MutexD1Ev
-__ZN7WebCore14SQLiteDatabaseD1Ev
-__ZN7WebCore20tableCellConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore5Image11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointENS_17Compos
+__ZN7WebCore11BitmapImage26nativeImageForCurrentFrameEv
+__ZN7WebCore16RenderListMarker5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore16RenderListMarker21getRelativeMarkerRectEv
+__ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
+__ZN3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZNK3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN7WebCore12RenderWidget11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore7Element20isEnabledFormControlEv
+__ZNK7WebCore4KURL11isLocalFileEv
+__ZN7WebCore14SecurityOrigin20grantUniversalAccessEv
+__ZN7WebCore13StyledElement11addCSSColorEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore10HTMLParser29pCloserStrictCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL16tableConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLTableElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLTableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLTableElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLTableElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLTableElement11cellBordersEv
+__ZNK7WebCore16HTMLTableElement17endTagRequirementEv
+__ZNK7WebCore16HTMLTableElement11tagPriorityEv
+__ZN7WebCore16HTMLTableElement6attachEv
+__ZNK7WebCore16HTMLTableElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14shrinkCapacityEm
+__ZN7WebCore16HTMLTableElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore11RenderTableC1EPNS_4NodeE
+__ZN7WebCore11RenderTableC2EPNS_4NodeE
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4fillERKS3_m
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE15reserveCapacityEm
+__ZSt4fillIPN7WebCore11RenderTable12ColumnStructES2_EvT_S4_RKT0_
+__ZN7WebCore11RenderTable14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore11RenderTable17updateFirstLetterEv
+__ZN7WebCore15AutoTableLayoutC1EPNS_11RenderTableE
+__ZN7WebCore15AutoTableLayoutC2EPNS_11RenderTableE
+__ZN7WebCore16HTMLTableElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore16HTMLTableElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore11RenderTable7isTableEv
+__ZN7WebCoreL19tablerowConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTableRowElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLTableRowElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLTableRowElement17endTagRequirementEv
+__ZNK7WebCore19HTMLTableRowElement11tagPriorityEv
+__ZN7WebCoreL14isTableSectionEPKNS_4NodeE
+__ZN7WebCore23HTMLTableSectionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23HTMLTableSectionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23HTMLTableSectionElement11tagPriorityEv
+__ZNK7WebCore23HTMLTableSectionElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN7WebCore23HTMLTableSectionElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore16HTMLTableElement19addSharedGroupDeclsEbRN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZNK7WebCore17CSSInheritedValue12cssValueTypeEv
+__ZN7WebCore18RenderTableSectionC1EPNS_4NodeE
+__ZN7WebCore18RenderTableSectionC2EPNS_4NodeE
+__ZN7WebCore11RenderTable8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore18RenderTableSection14isTableSectionEv
+__ZNK7WebCore18RenderTableSection15virtualChildrenEv
+__ZN7WebCore23HTMLTableSectionElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZNK7WebCore23HTMLTableSectionElement17endTagRequirementEv
+__ZN7WebCore23HTMLTableSectionElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore14RenderTableRowC1EPNS_4NodeE
+__ZN7WebCore14RenderTableRowC2EPNS_4NodeE
+__ZN7WebCore14RenderTableRow15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderTableRow13requiresLayerEv
+__ZN7WebCore18RenderTableSection8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore14RenderTableRow10isTableRowEv
+__ZN7WebCore18RenderTableSection10ensureRowsEi
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE4fillERKS3_m
+__ZSt4fillIPN7WebCore18RenderTableSection10CellStructES2_EvT_S4_RKT0_
+__ZN7WebCore18RenderTableSection15virtualChildrenEv
+__ZNK7WebCore14RenderTableRow15virtualChildrenEv
+__ZN7WebCore19HTMLTableRowElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore19HTMLTableRowElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore10HTMLParser25tableCellCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL20tablecellConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLTableCellElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore20HTMLTableCellElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore20HTMLTableCellElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore20HTMLTableCellElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore20HTMLTablePartElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore20HTMLTablePartElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore8parseURLERKNS_6StringE
-__ZN3WTF6VectorItLm2048EE6shrinkEm
-__ZN7WebCore8Document11completeURLERKNS_6StringE
-__ZN7WebCore8Document11completeURLERKNS_16DeprecatedStringE
-__ZN7WebCore4KURLC2ERKS0_RKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZN7WebCore4KURL4initERKS0_RKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZNK7WebCore16DeprecatedString8containsEc
-__ZNK7WebCore16DeprecatedString8containsENS_14DeprecatedCharEb
-__ZNK7WebCore4KURL14isHierarchicalEv
-__ZN7WebCore20copyPathRemovingDotsEPcPKcii
 __ZN7WebCore13StyledElement19addCSSImagePropertyEPNS_15MappedAttributeEiRKNS_6StringE
 __ZN7WebCore26CSSMutableStyleDeclaration16setImagePropertyEiRKNS_6StringEb
-__ZN7WebCore13CSSImageValueC2ERKNS_6StringEPNS_9StyleBaseE
 __ZNK7WebCore20HTMLTableCellElement17endTagRequirementEv
 __ZNK7WebCore20HTMLTableCellElement11tagPriorityEv
 __ZNK7WebCore20HTMLTableCellElement36canHaveAdditionalAttributeStyleDeclsEv
 __ZN7WebCore20HTMLTableCellElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
 __ZN7WebCore16HTMLTableElement18addSharedCellDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
 __ZN7WebCore16HTMLTableElement24addSharedCellBordersDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringEPNS_29CS
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE15reserveCapacityEm
 __ZN7WebCore16HTMLTableElement24addSharedCellPaddingDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore9StyleBase11isValueListEv
-__ZN7WebCore16CSSStyleSelector18mapBackgroundImageEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore13CSSImageValue5imageEPNS_9DocLoaderE
-__ZNK7WebCore17CSSPrimitiveValue14getStringValueEv
-__ZN7WebCore9DocLoader12requestImageERKNS_6StringE
-__ZN7WebCore9DocLoader15requestResourceENS_14CachedResource4TypeERKNS_6StringEPS4_bb
-__ZNK7WebCore11FrameLoader11isReloadingEv
-__ZN7WebCore9DocLoader14checkForReloadERKNS_4KURLE
-__ZN7WebCore5Cache14resourceForURLERKNS_6StringE
-__ZN7WebCore5Cache15requestResourceEPNS_9DocLoaderENS_14CachedResource4TypeERKNS_4KURLEPKNS_6StringEbb
-__ZN7WebCore11FrameLoader21restrictAccessToLocalEv
-__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLEPKNS_8DocumentE
-__ZN7WebCore11CachedImageC2EPNS_9DocLoaderERKNS_6StringEb
-__ZN7WebCore14CachedResourceC2ERKNS_6StringENS0_4TypeEbb
-__ZN7WebCore6Loader4loadEPNS_9DocLoaderEPNS_14CachedResourceEbbb
-__ZN7WebCore7RequestC2EPNS_9DocLoaderEPNS_14CachedResourceEbbb
-__ZN7WebCore14CachedResource10setRequestEPNS_7RequestE
-__ZN7WebCore9DocLoader21incrementRequestCountEv
-__ZN7WebCore6Loader20servePendingRequestsEv
-__ZN7WebCore21DeprecatedPtrListImpl4takeEj
-__ZN7WebCore21DeprecatedPtrListImpl2atEj
-__ZN7WebCore21DeprecatedPtrListImpl6removeEb
-__ZN7WebCore13InlineTextBox15paintDecorationEPNS_15GraphicsContextEiii
-__ZN7WebCore12RenderObject23getTextDecorationColorsEiRNS_5ColorES2_S2_b
-__ZN7WebCore15decorationColorEPNS_11RenderStyleE
-__ZN7WebCore15GraphicsContext18setStrokeThicknessEf
-__ZN7WebCore15GraphicsContext26setPlatformStrokeThicknessEf
-__ZN7WebCore15GraphicsContext15drawLineForTextERKNS_8IntPointEib
-__ZNK7WebCore15GraphicsContext15strokeThicknessEv
-__ZN7WebCore17RenderTextControl5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderTheme5paintEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore15GraphicsContext20updatingControlTintsEv
-__ZN7WebCore11RenderTheme16paintDecorationsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore11RenderTheme15paintBorderOnlyEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac14paintTextFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore27LocalCurrentGraphicsContextC2EPNS_15GraphicsContextE
-__ZNK7WebCore11RenderTheme9isEnabledEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme17isReadOnlyControlEPKNS_12RenderObjectE
-__ZN7WebCore27LocalCurrentGraphicsContextD2Ev
-__ZN7WebCore14RenderThemeMac13paintMenuListEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac23setPopupButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac11popupButtonEv
-__ZNK7WebCore14RenderThemeMac16popupButtonSizesEv
-__ZN7WebCore14RenderThemeMac14setControlSizeEP6NSCellPKNS_7IntSizeERS4_
-__ZN7WebCore14RenderThemeMac18updateCheckedStateEP6NSCellPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme15isIndeterminateEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isCheckedEPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updateEnabledStateEP6NSCellPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updatePressedStateEP6NSCellPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updateFocusedStateEP6NSCellPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isFocusedEPKNS_12RenderObjectE
-__ZNK7WebCore14RenderThemeMac18popupButtonMarginsEv
-__ZNK7WebCore14RenderThemeMac11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKi
-__ZN7WebCore15GraphicsContext4clipERKNS_7IntRectE
-__ZNK7WebCore14RenderMenuList15controlClipRectEii
-__ZN7WebCore9RenderBox19getOverflowClipRectEii
-__ZNK7WebCore11RenderLayer22verticalScrollbarWidthEv
-__ZNK7WebCore11RenderLayer25horizontalScrollbarHeightEv
-__ZN7WebCore15GraphicsContextD2Ev
-__ZN7WebCore15GraphicsContext29destroyGraphicsContextPrivateEPNS_22GraphicsContextPrivateE
-__ZN7WebCore15BackForwardList8backItemEv
-__ZN7WebCore15BackForwardList11forwardItemEv
-__ZNK7WebCore12RenderObject8isWidgetEv
-__ZN7WebCore8IntPointC1ERK8_NSPoint
-__ZN7WebCore13HitTestResultC2ERKNS_8IntPointE
-__ZN7WebCore11RenderLayer7hitTestERKNS_14HitTestRequestERNS_13HitTestResultE
-__ZN7WebCore8Document12updateLayoutEv
-__ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
-__ZN7WebCore11RenderLayer12hitTestLayerEPS0_RKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointE
-__ZN7WebCore12RenderObject7hitTestERKNS_14HitTestRequestERNS_13HitTestResultERKNS_8IntPointEiiNS_13HitTestFilterE
-__ZN7WebCore11RenderBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore11RenderBlock24isPointInOverflowControlERNS_13HitTestResultEiiii
-__ZN7WebCore11RenderBlock15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore18RenderTableSection11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore14RenderTableRow11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore10RenderFlow12hitTestLinesERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore13RootInlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore13InlineFlowBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore9InlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore11RenderImage11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore9RenderBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore12RenderObject9lastChildEv
-__ZN7WebCore12RenderObject19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
-__ZNK7WebCore12RenderObject12continuationEv
-__ZN7WebCore13HitTestResult12setInnerNodeEPNS_4NodeE
-__ZN7WebCore13HitTestResult21setInnerNonSharedNodeEPNS_4NodeE
-__ZN7WebCore11RenderImage8imageMapEv
-__ZNK7WebCore8Document11getImageMapERKNS_6StringE
-__ZN7WebCore11RenderLayer22updateHoverActiveStateERKNS_14HitTestRequestERNS_13HitTestResultE
-__ZN7WebCore13HitTestResultC1ERKS0_
-__ZN7WebCore13HitTestResultD1Ev
-__ZN7WebCore13HitTestResult22setToNonShadowAncestorEv
-__ZN7WebCore4Node18shadowAncestorNodeEv
-__ZN7WebCore12EventHandler10mouseMovedEP7NSEvent
-__ZN7WebCore12currentEventEv
-__ZN7WebCore18PlatformMouseEventC1EP7NSEvent
-__ZN7WebCore13pointForEventEP7NSEvent
-__ZN7WebCore19globalPointForEventEP7NSEvent
-__ZN7WebCore11globalPointERK8_NSPointP8NSWindow
-__ZN7WebCore15screenForWindowEP8NSWindow
-__ZN7WebCore15flipScreenPointERK8_NSPointP8NSScreen
-__ZN7WebCore12EventHandler10mouseMovedERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler20handleMouseMoveEventERKNS_18PlatformMouseEventEPNS_13HitTestResultE
-__ZN7WebCore12EventHandler17prepareMouseEventERKNS_14HitTestRequestERKNS_18PlatformMouseEventE
-__ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
-__ZN7WebCore8Document17prepareMouseEventERKNS_14HitTestRequestERKNS_8IntPointERKNS_18PlatformMouseEventE
-__ZN7WebCore8Document12setHoverNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore13ContainerNode9setActiveEbb
-__ZN7WebCore13ContainerNode10setHoveredEb
-__ZNK7WebCore12RenderObject13hoverAncestorEv
-__ZN7WebCore28MouseEventWithHitTestResultsC2ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
-__ZN7WebCore13HitTestResultaSERKS0_
-__ZN7WebCore10ScrollView19scrollbarUnderMouseERKNS_18PlatformMouseEventE
-__ZNK7WebCore28MouseEventWithHitTestResults9scrollbarEv
-__ZNK7WebCore28MouseEventWithHitTestResults10targetNodeEv
-__ZN7WebCore21subframeForTargetNodeEPNS_4NodeE
-__ZN7WebCore12EventHandler12selectCursorERKNS_28MouseEventWithHitTestResultsEPNS_17PlatformScrollbarE
-__ZNK7WebCore28MouseEventWithHitTestResults10isOverLinkEv
-__ZN7WebCore11RenderLayer22isPointInResizeControlERKNS_8IntPointE
-__ZN7WebCore13pointerCursorEv
-__ZN7WebCore6CursorC2EP8NSCursor
-__ZN7WebCore6CursorC2ERKS0_
-__ZN7WebCore6Widget9setCursorERKNS_6CursorE
-__ZN7WebCore6CursorD2Ev
-__ZN7WebCore12EventHandler18dispatchMouseEventERKNS_12AtomicStringEPNS_4NodeEbiRKNS_18PlatformMouseEventEb
-__ZN7WebCore12EventHandler26updateMouseEventTargetNodeEPNS_4NodeERKNS_18PlatformMouseEventEb
-__ZN7WebCore15EventTargetNode18dispatchMouseEventERKNS_18PlatformMouseEventERKNS_12AtomicStringEiPNS_4NodeE
-__ZN7WebCore15EventTargetNode18dispatchMouseEventERKNS_12AtomicStringEiiiiiibbbbbPNS_4NodeEN3WTF10PassRefPtrINS_5EventEEE
-__ZNK7WebCore8Document11defaultViewEv
-__ZNK7WebCore5Frame9domWindowEv
-__ZN7WebCore9DOMWindowC2EPNS_5FrameE
-__ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbPNS_9DOMWindowEiiiiibbbbtPNS_15EventTargetNodeEPNS_9ClipboardEb
-__ZN7WebCore17MouseRelatedEventC2ERKNS_12AtomicStringEbbPNS_9DOMWindowEiiiiibbbbb
-__ZN7WebCore9contentsXEPNS_9DOMWindowE
-__ZNK7WebCore10ScrollView9contentsXEv
-__ZN7WebCore9contentsYEPNS_9DOMWindowE
-__ZNK7WebCore10ScrollView9contentsYEv
-__ZN7WebCore17MouseRelatedEvent15initCoordinatesEv
-__ZN7WebCore5Event18setUnderlyingEventEN3WTF10PassRefPtrIS0_EE
-__ZN7WebCore17MouseRelatedEvent14receivedTargetEv
-__ZN7WebCore12EventHandler23handleMouseDraggedEventERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler10handleDragERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore6Chrome23mouseDidMoveOverElementERKNS_13HitTestResultEj
-__ZNK7WebCore13HitTestResult15absoluteLinkURLEv
-__ZN7WebCore6Chrome10setToolTipERKNS_13HitTestResultE
-__ZNK7WebCore13HitTestResult15spellingToolTipEv
-__ZN7WebCore8Document21markerContainingPointERKNS_8IntPointENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore13HitTestResult5titleEv
-__ZN7WebCore16HTMLInputElement6detachEv
-__ZN7WebCore21DeprecatedPtrListImpl9removeRefEPKvb
-__ZNK7WebCore11ImageSource11initializedEv
-__ZN7WebCore15GraphicsContext19roundToDevicePixelsERKNS_9FloatRectE
-__ZNK7WebCore11BitmapImage21mayFillWithSolidColorEv
-__ZNK7WebCore7IntSizecv6CGSizeEv
-__ZN7WebCore15GraphicsContext4saveEv
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE15reserveCapacityEm
-__ZN7WebCore15GraphicsContext17savePlatformStateEv
-__ZN7WebCore15GraphicsContext21setCompositeOperationENS_17CompositeOperatorE
-__ZN7WebCore15GraphicsContext7restoreEv
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE6shrinkEm
-__ZN7WebCore15GraphicsContext20restorePlatformStateEv
-__ZN7WebCore11BitmapImage14startAnimationEv
-__ZN7WebCore16DeprecatedString7replaceENS_14DeprecatedCharES1_
-__ZN7WebCore15GraphicsContext7setFontERKNS_4FontE
-__ZNK7WebCore13RootInlineBox16paintEllipsisBoxERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineTextBox5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore13RootInlineBox5blockEv
-__ZN7WebCore15GraphicsContext8drawTextERKNS_7TextRunERKNS_8IntPointEii
-__ZNK7WebCore15GraphicsContext4fontEv
-__ZNK7WebCore4Font8drawTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZNK7WebCore4Font14drawSimpleTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZNK7WebCore4Font15drawGlyphBufferEPNS_15GraphicsContextERKNS_11GlyphBufferERKNS_7TextRunERKNS_10FloatPointE
-__ZNK7WebCore4Font10drawGlyphsEPNS_15GraphicsContextEPKNS_14SimpleFontDataERKNS_11GlyphBufferEiiRKNS_10FloatPointE
-_WebCoreShouldUseFontSmoothing
-__ZN3WTF6VectorI6CGSizeLm2048EE6shrinkEm
-__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE6shrinkEm
-__ZN7WebCore13InlineTextBox14selectionStateEv
-__ZN7WebCore13InlineTextBox20paintDocumentMarkersEPNS_15GraphicsContextEiiPNS_11RenderStyleEPKNS_4FontEb
-__ZN7WebCore8Document14markersForNodeEPNS_4NodeE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSF_ISC_EEE3setEPS3_RKSC_
-__ZN7WebCore21updateGraphicsContextEPNS_15GraphicsContextERKNS_5ColorES4_f
-__ZN7WebCore15GraphicsContext15textDrawingModeEv
-__ZNK7WebCore13InlineTextBox7textPosEv
-__ZN7WebCore10RenderText7destroyEv
-__ZN7WebCore10RenderText15deleteTextBoxesEv
-__ZN7WebCore10RenderText27absoluteClippedOverflowRectEv
-__ZNK7WebCore12RenderObject7isMediaEv
-__ZNK7WebCore12RenderObject14isSVGContainerEv
-__ZN7WebCore9RenderBox26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZNK7WebCore11RenderBlock11isBlockFlowEv
-__ZNK7WebCore10RenderFlow10hasColumnsEv
-__ZN7WebCore15RenderTableCell26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZNK7WebCore9RenderBox4yPosEv
-__ZNK7WebCore9RenderBox4xPosEv
-__ZNK7WebCore12RenderObject11isBlockFlowEv
-__ZN7WebCore12RenderObject20deleteLineBoxWrapperEv
-__ZNK7WebCore12RenderObject17isSelectionBorderEv
-__ZNK7WebCore10RenderText14selectionStateEv
-__ZN7WebCore8RenderBRD1Ev
-__ZN7WebCore9FrameView16restoreScrollbarEv
-__ZN7WebCore11FrameLoader10gotoAnchorEv
-__ZNK7WebCore4KURL6hasRefEv
-__ZN7WebCore14ResourceLoader12resourceDataEv
-__ZN7WebCore14ResourceHandle12bufferedDataEv
-__ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
-__ZN7WebCore12SharedBufferC2EP6NSData
-__ZN7WebCore14DocumentLoader13updateLoadingEv
-__ZNK7WebCore11FrameLoader9isLoadingEv
-__ZNK7WebCore14DocumentLoader21isLoadingSubresourcesEv
-__ZN7WebCore14ResourceLoader16didFinishLoadingEv
-__ZN7WebCore14ResourceLoader23didFinishLoadingOnePartEv
-__ZN7WebCore11FrameLoader13didFinishLoadEPNS_14ResourceLoaderE
-__ZN7WebCore15ProgressTracker16completeProgressEm
-__ZN3WTF9HashTableImSt4pairImiENS_18PairFirstExtractorIS2_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENS8_IiEEEES9_E4findImNS_22IdentityHashTranslatorImS2_S6_EEEENS_17HashTableIteratorImS2_S4_S6_SB_S9_EERKT_
-__ZN7WebCore11FrameLoader24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
-__ZN7WebCore19InspectorController16didFinishLoadingEPNS_14DocumentLoaderEm
-__ZN7WebCore14ResourceLoader16releaseResourcesEv
-__ZN7WebCore14ResourceHandle9setClientEPNS_20ResourceHandleClientE
-__ZN7WebCore14ResourceHandleD2Ev
-__ZN7WebCore14ResourceHandle15releaseDelegateEv
--[WebCoreResourceHandleAsDelegate detachHandle]
--[WebCoreResourceHandleAsDelegate dealloc]
-__ZN7WebCore22ResourceHandleInternalD2Ev
+__ZN7WebCore15RenderTableCellC1EPNS_4NodeE
+__ZN7WebCore15RenderTableCellC2EPNS_4NodeE
+__ZN7WebCore15RenderTableCell17updateFromElementEv
+__ZN7WebCore15RenderTableCell15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore15RenderTableCell14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore15RenderTableCell13requiresLayerEv
+__ZN7WebCore14RenderTableRow8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore15RenderTableCell11isTableCellEv
+__ZN7WebCore18RenderTableSection7addCellEPNS_15RenderTableCellEPNS_14RenderTableRowE
+__ZN7WebCore14RenderTableRow15virtualChildrenEv
+__ZN7WebCore11HTMLElement16addHTMLAlignmentEPNS_15MappedAttributeE
+__ZN7WebCore11HTMLElement31addHTMLAlignmentToStyledElementEPNS_13StyledElementEPNS_15MappedAttributeE
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE6shrinkEm
+__ZN7WebCore11RenderTable12appendColumnEi
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14expandCapacityEm
+__ZN7WebCore18RenderTableSection12appendColumnEi
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIiLm0EE4growEm
+__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyCSSValueEi
+__ZN7WebCore10HTMLParser18isResidualStyleTagERKNS_12AtomicStringE
+__ZThn112_NK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZN7WebCoreL29isSupportedJavaScriptLanguageERKNS_6StringE
+__ZN7WebCore15jsDocumentTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
+__ZThn88_N7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZN7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZNK7WebCore9DOMWindow7consoleEv
+__ZN7WebCore7ConsoleC1EPNS_5FrameE
+__ZN7WebCore7ConsoleC2EPNS_5FrameE
+__ZN7WebCore7Console10addMessageENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
+__ZN7WebCore7Console21shouldPrintExceptionsEv
+__ZN7WebCoreL15fontConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLFontElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore15HTMLFontElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLFontElement26cssValueFromFontSizeNumberERKNS_6StringERi
+__ZN7WebCore15FontFamilyValue20appendSpaceSeparatedEPKtj
+__ZN7WebCore6String6appendEc
+__ZN7WebCore6String6appendEPKtj
+__ZNK7WebCore15HTMLFontElement17endTagRequirementEv
+__ZNK7WebCore15HTMLFontElement11tagPriorityEv
+__ZNK7WebCore6String8foldCaseEv
+__ZN7WebCore10StringImpl8foldCaseEv
+__ZN7WebCore10HTMLParser25checkIfHasPElementInScopeEv
+__ZN7WebCore6String6numberEt
+__ZNK7WebCore16HTMLInputElement7altTextEv
+__ZN7WebCore11RenderImage14resetAnimationEv
+__ZNK7WebCore15RenderTableCell10borderLeftEv
+__ZNK7WebCore15RenderTableCell11borderRightEv
+__ZN7WebCore15RenderTableCell21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore15RenderTableCell9borderTopEv
+__ZNK7WebCore15RenderTableCell12borderBottomEv
 -[WebCoreResourceHandleAsDelegate connection:didFailWithError:]
 __ZN7WebCore14ResourceLoader7didFailEPNS_14ResourceHandleERKNS_13ResourceErrorE
 __ZN7WebCore17SubresourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore6Loader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore6Loader7didFailEPNS_17SubresourceLoaderEb
-__ZN7WebCore9DocLoader17setLoadInProgressEb
+__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderEb
 __ZN7WebCore11CachedImage5errorEv
 __ZN7WebCore11CachedImage5clearEv
 __ZN7WebCore11CachedImage18destroyDecodedDataEv
-__ZN7WebCore14CachedResource14setEncodedSizeEj
-__ZN7WebCore11CachedImage15notifyObserversEv
-__ZN7WebCore26CachedResourceClientWalkerC2ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
-__ZN7WebCore26CachedResourceClientWalker4nextEv
-__ZNK3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E8containsIiNS_22IdentityHashTranslatorIiS2_S6_EEEEbRKT_
-__ZN7WebCore20CachedResourceClient12imageChangedEPNS_11CachedImageE
-__ZN7WebCore11RenderImage12imageChangedEPNS_11CachedImageE
 __ZN7WebCore11RenderImage22setImageSizeForAltTextEPNS_11CachedImageE
-__ZNK7WebCore11CachedImage5imageEv
-__ZN7WebCore11brokenImageEv
+__ZN7WebCoreL11brokenImageEv
 __ZN7WebCore5Image20loadPlatformResourceEPKc
+__ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
+__ZN7WebCore12SharedBufferC1EPK8__CFData
+__ZN7WebCore12SharedBufferC2EPK8__CFData
 __ZNK7WebCore12SharedBuffer16platformDataSizeEv
+__ZN7WebCore5Cache5evictEPNS_14CachedResourceE
+__ZN7WebCore14ResourceLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader13didFailToLoadEPNS_14ResourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore17ResourceErrorBaseD2Ev
+__ZNK7WebCore11RenderTable12avoidsFloatsEv
+__ZN7WebCore11RenderTable6layoutEv
+__ZN7WebCore11RenderTable9calcWidthEv
+__ZN7WebCore11RenderTable14calcPrefWidthsEv
+__ZN7WebCore11RenderTable23recalcHorizontalBordersEv
+__ZNK7WebCore11RenderTable14calcBorderLeftEv
+__ZNK7WebCore11RenderTable15calcBorderRightEv
+__ZN7WebCore15AutoTableLayout14calcPrefWidthsERiS1_
+__ZN7WebCore15AutoTableLayout10fullRecalcEv
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE4fillERKS3_m
+__ZSt4fillIPN7WebCore15AutoTableLayout6LayoutES2_EvT_S4_RKT0_
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4fillERKS3_m
+__ZSt4fillIPPN7WebCore15RenderTableCellES2_EvT_S4_RKT0_
+__ZN7WebCore15AutoTableLayout12recalcColumnEi
+__ZN7WebCore15RenderTableCell14calcPrefWidthsEv
+__ZNK7WebCore11RenderTable10borderLeftEv
+__ZNK7WebCore11RenderTable11borderRightEv
+__ZNK7WebCore15RenderTableCell15styleOrColWidthEv
+__ZN7WebCore15AutoTableLayout18calcEffectiveWidthEv
+__ZN7WebCore15AutoTableLayout6layoutEv
+__ZN7WebCore11RenderTable13setCellWidthsEv
+__ZN7WebCore18RenderTableSection13setCellWidthsEv
+__ZN7WebCore15RenderTableCell11updateWidthEi
+__ZN7WebCore18RenderTableSection6layoutEv
+__ZN7WebCore14RenderTableRow6layoutEv
+__ZN7WebCore15RenderTableCell6layoutEv
+__ZN7WebCore15RenderTableCell9calcWidthEv
+__ZNK7WebCore15RenderTableCell10paddingTopEb
+__ZNK7WebCore15RenderTableCell13paddingBottomEb
+__ZNK7WebCore15RenderTableCell16baselinePositionEbb
+__ZN7WebCore18RenderTableSection13calcRowHeightEv
+__ZNK7WebCore11RenderTable9borderTopEv
+__ZNK7WebCore11RenderTable12borderBottomEv
+__ZN7WebCore18RenderTableSection10layoutRowsEi
+__ZNK7WebCore11RenderBlock24percentHeightDescendantsEv
+__ZNK7WebCore18RenderTableSection12overflowLeftEb
+__ZNK7WebCore18RenderTableSection13overflowWidthEb
+__ZNK7WebCore18RenderTableSection11overflowTopEb
+__ZNK7WebCore18RenderTableSection14overflowHeightEb
+__ZNK7WebCore11RenderTable12sectionBelowEPKNS_18RenderTableSectionEb
+__ZNK7WebCore11RenderTable10colElementEiPbS1_
+__ZNK7WebCore27RenderTextControlSingleLine21preferredContentWidthEf
+__ZThn128_NK7WebCore16HTMLInputElement4sizeEv
+__ZNK7WebCore16HTMLInputElement4sizeEv
+__ZN7WebCore15AutoTableLayout14insertSpanCellEPNS_15RenderTableCellE
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4growEm
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE15reserveCapacityEm
+__ZNK7WebCore18RenderTableSection17rightmostPositionEbb
+__ZNK7WebCore18RenderTableSection14lowestPositionEbb
+__ZNK7WebCore15RenderTableCell19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore11RenderTable5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderTable11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore18RenderTableSection5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore18RenderTableSection11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15RenderTableCell26paintBackgroundsBehindCellERNS_12RenderObject9PaintInfoEiiPS1_
+__ZN7WebCore15RenderTableCell5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15RenderTableCell19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineTextBox15paintDecorationEPNS_15GraphicsContextEiiiPNS_10ShadowDataE
+__ZN7WebCore12RenderObject23getTextDecorationColorsEiRNS_5ColorES2_S2_b
+__ZN7WebCoreL15decorationColorEPNS_11RenderStyleE
+__ZNK7WebCore11RenderTable10cellBeforeEPKNS_15RenderTableCellE
+__ZNK7WebCore11RenderTable9cellAboveEPKNS_15RenderTableCellE
+__ZNK7WebCore11RenderTable12sectionAboveEPKNS_18RenderTableSectionEb
+__ZN7WebCore11HistoryItem17setAlternateTitleERKNS_6StringE
+__ZN7WebCore11RenderTable11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore18RenderTableSection11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore14RenderTableRow11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore15RenderTableCell23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore15BackForwardList16forwardListCountEv
+__ZN7WebCore15BackForwardList13backListCountEv
+__ZN7WebCore15BackForwardList11itemAtIndexEi
+__ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
+__ZN7WebCore12IconDatabase5closeEv
+__ZN7WebCore12IconDatabase17cleanupSyncThreadEv
+__ZN7WebCore12IconDatabase27deleteAllPreparedStatementsEv
+__ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
+__ZN7WebCore4Page23clearUndoRedoOperationsEv
+__ZN7WebCore9PageGroup17closeLocalStorageEv
+__ZN7WebCore9PageGroup12localStorageEv
+__ZN7WebCore12LocalStorage5closeEv
+__ZN7WebCore18LocalStorageThread9terminateEv
+__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_18LocalStorageThreadEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_18LocalStorageThreadEEE
+__ZN7WebCore18LocalStorageThread16performTerminateEv
+__ZN3WTF16ThreadSafeSharedIN7WebCore18LocalStorageThreadEE5derefEv
+__ZNK7WebCore10MouseEvent12isMouseEventEv
+__ZN7WebCore5Frame34setMarkedTextMatchesAreHighlightedEb
+__ZN7WebCore5Frame21markAllMatchesForTextERKNS_6StringEbj
+__ZN7WebCore15rangeOfContentsEPNS_4NodeE
+__ZN7WebCore5Range18selectNodeContentsEPNS_4NodeERi
+__ZN7WebCore13findPlainTextEPKNS_5RangeERKNS_6StringEbb
+__ZN7WebCore17CharacterIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore17CharacterIteratorC2EPKNS_5RangeEbb
+__ZN7WebCoreL8searcherEv
+__ZN7WebCore17CharacterIterator7advanceEi
+__ZN7WebCoreL17characterSubrangeERNS_17CharacterIteratorEii
+__ZNK7WebCore17CharacterIterator5rangeEv
+__ZNK7WebCore12TextIterator5rangeEv
+__ZNK7WebCore5Range9collapsedERi
+__ZN7WebCore18endVisiblePositionEPKNS_5RangeENS_9EAffinityE
+__ZNK7WebCore5Range9endOffsetERi
+__ZNK7WebCore5Range12endContainerERi
+__ZNK7WebCore10RenderText10nextOffsetEi
+__ZN7WebCore20startVisiblePositionEPKNS_5RangeENS_9EAffinityE
+__ZNK7WebCore5Range11startOffsetERi
+__ZNK7WebCore6Editor17insideVisibleAreaEPNS_5RangeE
+__ZNK7WebCore5Frame21excludeFromTextSearchEv
+__ZNK7WebCore9FrameTree3topEb
+__ZN7WebCore8Document9addMarkerEPNS_5RangeENS_14DocumentMarker10MarkerTypeENS_6StringE
+__ZN7WebCore8Document9addMarkerEPNS_4NodeENS_14DocumentMarkerE
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE15reserveCapacityEm
+__ZN7WebCoreL24placeholderRectForMarkerEv
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHas
+__ZNK7WebCore5Range18shadowTreeRootNodeEv
+__ZN7WebCoreL19collapsedToBoundaryEPKNS_5RangeEb
+__ZN7WebCore4Node14isInShadowTreeEv
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC2ERKS3_
+__ZN7WebCore13InlineTextBox20paintTextMatchMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4FontE
+__ZN7WebCore13InlineTextBox12selectionTopEv
+__ZN7WebCore13InlineTextBox15selectionHeightEv
+__ZNK7WebCore4Font20selectionRectForTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZNK7WebCore4Font26selectionRectForSimpleTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZN7WebCore8Document24setRenderedRectForMarkerEPNS_4NodeENS_14DocumentMarkerERKNS_7IntRectE
+__ZNK7WebCore5Frame31markedTextMatchesAreHighlightedEv
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE6shrinkEm
+__ZNK7WebCore9FrameTree20traverseNextWithWrapEb
+__ZNK7WebCore11FrameLoader14initialRequestEv
+__ZN7WebCore11FrameLoader50didReceiveServerRedirectForProvisionalLoadForFrameEv
+__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPFvPvS3_N3WTF10PassRefPtrINS_9FormStateEEEbES4_
+__ZN7WebCore18MainResourceLoader33callContinueAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEE
+__ZN7WebCore18MainResourceLoader29continueAfterNavigationPolicyERKNS_15ResourceRequestEb
+__ZN7WebCore15BackForwardList8capacityEv
+__ZN7WebCore10CachedPage6createEPNS_4PageE
+__ZN7WebCore10CachedPageC1EPNS_4PageE
+__ZN7WebCore10CachedPageC2EPNS_4PageE
+__ZN7WebCore11CachedFrameC1EPNS_5FrameE
+__ZN7WebCore11CachedFrameC2EPNS_5FrameE
+__ZN7WebCore22ScriptExecutionContext23suspendActiveDOMObjectsEv
+__ZN7WebCore21ScriptCachedFrameDataC1EPNS_5FrameE
+__ZN7WebCore21ScriptCachedFrameDataC2EPNS_5FrameE
+__ZN7WebCore5Frame11clearTimersEv
+__ZN7WebCore5Frame11clearTimersEPNS_9FrameViewEPNS_8DocumentE
+__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore8Document14setInPageCacheEb
+__ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
+__ZN7WebCore9PageCache3addEN3WTF10PassRefPtrINS_11HistoryItemEEENS2_INS_10CachedPageEEE
+__ZN7WebCore9PageCache12addToLRUListEPNS_11HistoryItemE
+__ZNK7WebCore16HTMLInputElement20saveFormControlStateERNS_6StringE
+__ZNK7WebCore16HTMLInputElement15formControlTypeEv
+__ZNK7WebCore17HTMLSelectElement20saveFormControlStateERNS_6StringE
+__ZN3WTF6VectorIcLm1024EE6shrinkEm
+__ZNK7WebCore17HTMLSelectElement15formControlTypeEv
+__ZN7WebCore7Console15disconnectFrameEv
+__ZThn112_NK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZN7WebCoreL19textareaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTextAreaElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLTextAreaElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZNK7WebCore11HTMLElement16findFormAncestorEv
+__ZN7WebCore19HTMLTextAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore22HTMLFormControlElement11tagPriorityEv
+__ZNK7WebCore14RenderThemeMac19adjustTextAreaStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore11RenderBlock23removePositionedObjectsEPS0_
+__ZN7WebCore15HTMLFormElement18registerImgElementEPNS_16HTMLImageElementE
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE15reserveCapacityEm
+__ZN7WebCore12InputElement23parseMaxLengthAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
+__ZN7WebCore13textBreakNextEPNS_17TextBreakIteratorE
+__ZN7WebCore5TimerINS_8DocumentEE5firedEv
+__ZN7WebCore8Document21styleRecalcTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCoreL23tablecaptionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore23HTMLTableCaptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23HTMLTableCaptionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23HTMLTableCaptionElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore23HTMLTableCaptionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore23HTMLTableCaptionElement17endTagRequirementEv
+__ZNK7WebCore23HTMLTableCaptionElement11tagPriorityEv
+__ZN7WebCoreL30createHTMLScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLScriptElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLScriptElementEEE
+__ZN7WebCore19JSHTMLScriptElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLScriptElementEEE
+__ZN7WebCore19JSHTMLScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLScriptElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement6setSrcERKNS_6StringE
+__ZNK7WebCore19JSHTMLScriptElement9classInfoEv
+__ZN7WebCore17ScriptElementData13requestScriptERKNS_6StringE
+__ZN7WebCore12CachedScript11setEncodingERKNS_6StringE
+__ZN7WebCore17ScriptElementData14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore8Document17executeScriptSoonEPNS_17ScriptElementDataENS_20CachedResourceHandleINS_12CachedScriptEEE
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE14expandCapacityEmP
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE15reserveCapacityEm
+__ZN7WebCore8Document27executeScriptSoonTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore17ScriptElementData7executeEPNS_12CachedScriptE
+__ZN7WebCore17ScriptElementData14evaluateScriptERKNS_16ScriptSourceCodeE
+__ZN7WebCore17jsHTMLDocumentAllEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSHTMLDocument3allEPN3JSC9ExecStateE
+__ZN7WebCore8Document3allEv
+__ZNK7WebCore19JSHTMLAllCollection9toBooleanEPN3JSC9ExecStateE
+__ZN7WebCoreL32createHTMLTextAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTextAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTextAreaElementEEE
+__ZN7WebCore21JSHTMLTextAreaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTextAreaElementEEE
+__ZN7WebCoreL29createHTMLStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLStyleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLStyleElementEEE
+__ZN7WebCore18JSHTMLStyleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLStyleElementEEE
+__ZNK7WebCore18JSHTMLStyleElement9classInfoEv
+__ZN7WebCore12StyleElement20insertedIntoDocumentEPNS_8DocumentEPNS_7ElementE
+__ZN7WebCore18JSHTMLStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsHTMLStyleElementSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn112_N7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZN7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE6shrinkEm
+__ZN7WebCore21JSHTMLTextAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLTextAreaElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTextAreaElement5valueEv
+__ZNK7WebCore19HTMLTextAreaElement11updateValueEv
+__ZN7WebCore21JSHTMLTextAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLTextAreaElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement8setValueERKNS_6StringE
+__ZN7WebCore16setJSNodeOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnerrorEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore15RenderTableCell14borderHalfLeftEb
+__ZNK7WebCore15RenderTableCell19collapsedLeftBorderEb
+__ZN7WebCoreL14compareBordersERKNS_20CollapsedBorderValueES2_
+__ZNK7WebCore15RenderTableCell15borderHalfRightEb
+__ZNK7WebCore15RenderTableCell20collapsedRightBorderEb
+__ZNK7WebCore11RenderTable9cellAfterEPKNS_15RenderTableCellE
+__ZNK7WebCore15RenderTableCell13borderHalfTopEb
+__ZNK7WebCore15RenderTableCell18collapsedTopBorderEv
+__ZNK7WebCore15RenderTableCell16borderHalfBottomEb
+__ZNK7WebCore15RenderTableCell21collapsedBottomBorderEv
+__ZNK7WebCore11RenderTable9cellBelowEPKNS_15RenderTableCellE
+__ZN7WebCore18RenderTableSection17recalcOuterBorderEv
+__ZNK7WebCore18RenderTableSection18calcOuterBorderTopEv
+__ZNK7WebCore18RenderTableSection21calcOuterBorderBottomEv
+__ZNK7WebCore18RenderTableSection19calcOuterBorderLeftEb
+__ZNK7WebCore18RenderTableSection20calcOuterBorderRightEb
+__ZNK7WebCore11RenderTable16outerBorderRightEv
+__ZNK7WebCore11RenderTable15outerBorderLeftEv
+__ZNK7WebCore11RenderTable14outerBorderTopEv
+__ZNK7WebCore11RenderTable17outerBorderBottomEv
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE15reserveCapacityEm
+__ZNK7WebCore15RenderTableCell19collectBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
+__ZN7WebCoreL14addBorderStyleERN3WTF6VectorINS_20CollapsedBorderValueELm100EEES2_
+__ZN7WebCore15RenderTableCell16sortBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
+__ZN7WebCore15RenderTableCell20paintCollapsedBorderEPNS_15GraphicsContextEiiii
+__ZN7WebCoreL20collapsedBorderStyleENS_12EBorderStyleE
+__ZN3WTF6VectorIN7WebCore20CollapsedBorderValueELm100EE6shrinkEm
+__ZN7WebCore12JSStyleSheet4markEv
+__ZN7WebCore18JSImageConstructor4markEv
+__ZN7WebCore19JSHTMLScriptElementD1Ev
+__ZN7WebCore17JSHTMLHeadElementD1Ev
+__ZN7WebCore11BitmapImage18destroyDecodedDataEb
+__ZN7WebCore11ImageSource5clearEbmPNS_12SharedBufferEb
+__ZN7WebCore11BitmapImageD0Ev
+__ZN7WebCore11ImageSourceD1Ev
+__ZN7WebCore11ImageSourceD2Ev
+__ZN7WebCoreL27compareBorderStylesForQSortEPKvS1_
+__ZNK7WebCore19JSLazyEventListener10jsFunctionEv
+__ZNK7WebCore19JSLazyEventListener9parseCodeEv
+__ZThn88_NK7WebCore8Document10virtualURLEv
+__ZNK7WebCore8Document10virtualURLEv
+__ZNK7WebCore13JSHTMLElement21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
+__ZNK7WebCore11HTMLElement11virtualFormEv
+__ZNK7WebCore5Event15isKeyboardEventEv
+__ZNK7WebCore5Event11isTextEventEv
+__ZN7WebCore15getDOMStructureINS_12JSMouseEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore12JSMouseEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSUIEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSUIEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSMouseEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MouseEventEEE
+__ZN7WebCore12JSMouseEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MouseEventEEE
+__ZN7WebCore9JSUIEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7UIEventEEE
+__ZNK3JSC8JSObject16isVariableObjectEv
+__ZNK7WebCore5Event20storesResultAsStringEv
+__ZNK7WebCore17HTMLAnchorElement11isFocusableEv
+__ZNK7WebCore17HTMLAnchorElement16isMouseFocusableEv
+__ZNK7WebCore17HTMLAnchorElement17canStartSelectionEv
+__ZN7WebCore14CachedResource11setEncodingERKNS_6StringE
+__ZNK7WebCore19HTMLTextAreaElement20saveFormControlStateERNS_6StringE
+__ZNK7WebCore19HTMLTextAreaElement15formControlTypeEv
+__ZN7WebCore8Location15disconnectFrameEv
+__ZN7WebCoreL16dlistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLDListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLDListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLDListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLDListElement11tagPriorityEv
+__ZN7WebCore10HTMLParser18dtCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser18ddCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE6shrinkEm
+__ZN7WebCore10JSLocationD1Ev
+__ZN7WebCore10JSLocationD2Ev
+__ZN7WebCore21JSHTMLTextAreaElementD1Ev
+__ZN7WebCore12JSMouseEventD1Ev
+__ZN7WebCore10RenderView19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore28createAttributeEventListenerEPNS_5FrameEPNS_9AttributeE
+__ZN7WebCore8Document31setWindowAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore8Document4headEv
+__ZN7WebCore14RenderReplaced14calcPrefWidthsEv
+__ZN7WebCoreL21subframeForTargetNodeEPNS_4NodeE
+__ZN7WebCore12EventHandler28passMouseMoveEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
+__ZN7WebCore12EventHandler27passSubframeEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
+__ZN7WebCore10ScrollView5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore6Widget5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZNK7WebCore11RenderLayer20requiresSlowRepaintsEv
+__ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
+__ZN7WebCore25setJSHTMLIFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19JSHTMLIFrameElement6setSrcEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase6setSrcERKNS_6StringE
+__ZN7WebCore11FrameLoader15userGestureHintEv
+__ZN7WebCore11HistoryItem6setURLERKNS_4KURLE
+__ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
+__ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E47removeAndInvalid
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6removeEPS2_
+__ZN7WebCore13PageURLRecordD1Ev
+__ZN7WebCore13PageURLRecordD2Ev
+__ZN7WebCore11HistoryItem18clearDocumentStateEv
+__ZN7WebCore6Widget16removeFromParentEv
+__ZN7WebCore10ScrollView11removeChildEPNS_6WidgetE
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ide
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvali
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore10ScrollView19platformRemoveChildEPNS_6WidgetE
+__ZN7WebCore6Widget19removeFromSuperviewEv
+__ZN7WebCoreL23safeRemoveFromSuperviewEP6NSView
+__ZN7WebCore10RenderPart12deleteWidgetEv
+__ZNK7WebCore9RenderBox18absoluteContentBoxEv
+__ZN7WebCore12RenderWidget17setWidgetGeometryERKNS_7IntRectE
+__ZN3WTF7HashMapIPN7WebCore24OverlapTestRequestClientENS1_7IntRectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3setERKS3_R
+__ZThn120_N7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore9FrameView15setIsOverlappedEb
+__ZN7WebCore19JSHTMLIFrameElementD1Ev
+__ZN7WebCore7CommentD0Ev
+__ZN7WebCore25JSHTMLDivElementPrototypeD1Ev
+__ZN7WebCore18setJSDOMWindowNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow7setNameERKNS_6StringE
+__ZN7WebCore15jsDOMWindowNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow4nameEv
+__ZN7WebCore5TimerINS_11CachedImageEE5firedEv
+__ZN7WebCore11CachedImage29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore22setJSDOMWindowLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11JSDOMWindow11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore19JSLazyEventListenerD0Ev
+__ZN7WebCore15JSEventListenerD2Ev
+__ZN7WebCore11FrameLoader16detachFromParentEv
+__ZN7WebCore19InspectorController23frameDetachedFromParentEPNS_5FrameE
+__ZN7WebCore11FrameLoader19closeAndRemoveChildEPNS_5FrameE
+__ZN7WebCore5Frame13pageDestroyedEv
+__ZN7WebCore16JSDOMWindowShell15disconnectFrameEv
+__ZN7WebCore15JSDOMWindowBase15disconnectFrameEv
+__ZN7WebCore9FrameTree11removeChildEPNS_5FrameE
+__ZN7WebCore11FrameLoader22scheduleCheckCompletedEv
+__ZN7WebCore21DeprecatedPtrListImplD1Ev
+__ZN7WebCore21DeprecatedPtrListImplD2Ev
+__ZN7WebCore12RenderWidget7destroyEv
+__ZN7WebCore16RenderPartObjectD0Ev
+__ZN7WebCore9FrameView20removeWidgetToUpdateEPNS_16RenderPartObjectE
+__ZN7WebCore10RenderPartD2Ev
+__ZN7WebCore12RenderWidgetD2Ev
+__ZN7WebCore12RenderWidget12deleteWidgetEv
+__ZN7WebCoreL14preConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLPreElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLPreElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14HTMLPreElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore14HTMLPreElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14HTMLPreElement17endTagRequirementEv
+__ZNK7WebCore14HTMLPreElement11tagPriorityEv
+__ZN7WebCore26setJSHTMLInputElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement8setValueERKNS_6StringE
+__ZN7WebCore5FrameD1Ev
+__ZN7WebCore5FrameD2Ev
+__ZN7WebCore11FrameLoader14cancelAndClearEv
+__ZN7WebCore5Frame22disconnectOwnerElementEv
+__ZN7WebCore9DOMWindow15disconnectFrameEv
+__ZN7WebCore19AnimationControllerD1Ev
+__ZN7WebCore19AnimationControllerD2Ev
+__ZN7WebCore26AnimationControllerPrivateD1Ev
+__ZN7WebCore26AnimationControllerPrivateD2Ev
+__ZN7WebCore12EventHandlerD1Ev
+__ZN7WebCore12EventHandlerD2Ev
+__ZN7WebCore6EditorD1Ev
+__ZN7WebCore6EditorD2Ev
+__ZN7WebCore16ScriptControllerD1Ev
+__ZN7WebCore16ScriptControllerD2Ev
+__ZN7WebCore16ScriptController31disconnectPlatformScriptObjectsEv
+-[DOMAbstractView(Frame) _disconnectFrame]
+-[DOMAbstractView dealloc]
+__ZN7WebCore15removeJSWrapperEPN3JSC8JSObjectE
+__ZN7WebCore11FrameLoaderD1Ev
+__ZN7WebCore11FrameLoaderD2Ev
+__ZN7WebCore11FrameLoader9setOpenerEPNS_5FrameE
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableE
+__ZN7WebCore9FrameTreeD1Ev
+__ZN7WebCore9FrameTreeD2Ev
+__ZN7WebCoreL27createHTMLPreElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLPreElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLPreElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLPreElementEEE
+__ZN7WebCore16JSHTMLPreElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLPreElementEEE
+__ZN7WebCore16JSHTMLPreElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSHTMLPreElement9classInfoEv
+__ZN7WebCoreL26createHTMLBRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLBRElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLBRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLBRElementEEE
+__ZN7WebCore15JSHTMLBRElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLBRElementEEE
+__ZNK7WebCore15JSHTMLBRElement9classInfoEv
+__ZN7WebCore17HTMLIFrameElementD0Ev
+__ZN7WebCore21HTMLFrameOwnerElementD2Ev
+__ZN7WebCore28JSHTMLIFrameElementPrototypeD1Ev
+__ZN7WebCore16JSDOMWindowShellD1Ev
+__ZN7WebCore16JSDOMWindowShellD2Ev
+__ZN7WebCore15JSHTMLBRElementD1Ev
+__ZN7WebCore16JSHTMLPreElementD1Ev
+__ZN7WebCore12IconDatabase28removePageURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore27RenderTextControlSingleLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore27RenderTextControlInnerBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore27RenderTextControlSingleLine11isTextFieldEv
+__ZNK7WebCore11RenderTheme12stateChangedEPNS_12RenderObjectENS_12ControlStateE
+__ZNK7WebCore11RenderTheme13supportsHoverEPKNS_11RenderStyleE
+__ZN7WebCore17RenderTextControl19hitInnerTextElementERNS_13HitTestResultEiiii
+__ZN7WebCoreL22centerTruncateToBufferERKNS_6StringEjjPt
+__ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
+__ZSt13binary_searchIPKttEbT_S2_RKT0_
+__ZSt11lower_boundIPKttET_S2_S2_RKT0_
+__ZN7WebCoreL16findTextEncodingEPKci
+__ZN7WebCore12TextCodecICU29registerExtendedEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecICU22registerExtendedCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCore12TextCodecMac21registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecMac14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN3WTF6VectorIcLm64EE6shrinkEm
+__ZNK7WebCore12TextEncoding26closestByteBasedEquivalentEv
+__ZN7WebCore22UTF32BigEndianEncodingEv
+__ZN7WebCore25UTF32LittleEndianEncodingEv
+__ZN7WebCoreL15addEncodingNameERN3WTF7HashSetIPKcNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEES3_
+__ZN3WTF7HashSetIPKcNS_7PtrHashIS2_EENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E6expandEv
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E6rehashEi
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E13allocateTableEi
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E15deallocateTableEPS2_i
+__ZNK3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E8containsIS2_NS_22IdentityHashT
+__ZN3WTF6VectorItLm512EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm512EE14expandCapacityEm
+__ZN3WTF6VectorItLm512EE15reserveCapacityEm
+__ZN7WebCore4KURL7setPortEt
+__ZNK7WebCore9FrameView13isTransparentEv
+__ZN7WebCore15GraphicsContext11drawEllipseERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext8drawPathEv
+__ZN7WebCoreL12UTF7EncodingEv
+__ZN7WebCore15HTMLBodyElement14createLinkDeclEv
+__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
+__ZN7WebCore8DragDataC2EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
+__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
+__ZN7WebCore14DragController20dragEnteredOrUpdatedEPNS_8DragDataE
+__ZN7WebCore5Frame15documentAtPointERKNS_8IntPointE
+__ZN7WebCore14DragController15tryDocumentDragEPNS_8DragDataENS_21DragDestinationActionE
+__ZN7WebCore14DragController12tryDHTMLDragEPNS_8DragDataE
+__ZNK7WebCore11FrameLoader7baseURLEv
+__ZNK7WebCore8DragData15createClipboardENS_21ClipboardAccessPolicyE
+__ZN7WebCore12ClipboardMacC1EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
+__ZN7WebCore12ClipboardMacC2EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
+__ZN7WebCore9ClipboardC2ENS_21ClipboardAccessPolicyEb
+__ZN7WebCore9Clipboard18setSourceOperationENS_13DragOperationE
+__ZN7WebCoreL14IEOpFromDragOpENS_13DragOperationE
+__ZN7WebCoreL16createMouseEventEPNS_8DragDataE
+__ZN7WebCore12EventHandler17updateDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12EventHandler17dispatchDragEventERKNS_12AtomicStringEPNS_4NodeERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12ClipboardMacD0Ev
+__ZN7WebCore9ClipboardD2Ev
+__ZN7WebCore14DragController14canProcessDragEPNS_8DragDataE
+__ZNK7WebCore8DragData25containsCompatibleContentEv
+__ZNK7WebCore8DragData13containsFilesEv
+__ZN7WebCoreL11asFileInputEPNS_4NodeE
+__ZN7WebCore14DragController16operationForLoadEPNS_8DragDataE
+__ZN7WebCore14DragController13dragOperationEPNS_8DragDataE
+__ZNK7WebCore8DragData11containsURLEv
+__ZNK7WebCore8DragData5asURLEPNS_6StringE
+__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
+__ZN7WebCore14DragController11performDragEPNS_8DragDataE
+__ZN7WebCore14DragController16concludeEditDragEPNS_8DragDataE
+__ZNK7WebCore8Document16elementFromPointEii
+__ZNK7WebCore8DragData13containsColorEv
+__ZN7WebCore15SQLiteStatement8bindNullEi
+__ZN7WebCore12EventHandler10wheelEventEP7NSEvent
+__ZN7WebCore18PlatformWheelEventC1EP7NSEvent
+__ZN7WebCore18PlatformWheelEventC2EP7NSEvent
+__ZN7WebCore12EventHandler16handleWheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore4Node18dispatchWheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore10WheelEventC1EffN3WTF10PassRefPtrINS_9DOMWindowEEEiiiibbbb
+__ZN7WebCore10WheelEventC2EffN3WTF10PassRefPtrINS_9DOMWindowEEEiiiibbbb
+__ZN7WebCore10WheelEventD0Ev
+__ZNK7WebCore12RenderObject12enclosingBoxEv
+__ZN7WebCore9RenderBox6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore11RenderLayer6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore10ScrollView10wheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore16LegacyWebArchive6createEPNS_4NodeE
+__ZN7WebCoreL18appendDocumentTypeERN3WTF6VectorItLm0EEEPKNS_12DocumentTypeE
+__ZNK7WebCore7Element22nodeNamePreservingCaseEv
+__ZNK7WebCore7Element14isURLAttributeEPNS_9AttributeE
+__ZN7WebCoreL20appendAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringEb
+__ZNK7WebCore17HTMLAnchorElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCoreL29appendQuotedURLAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive6createERKNS_6StringEPNS_5FrameERKN3WTF6VectorIPNS_4NodeELm0EEE
+__ZN7WebCore10utf8BufferERKNS_6StringE
+__ZN7WebCore12SharedBuffer11adoptVectorERN3WTF6VectorIcLm0EEE
+__ZN7WebCore12SharedBufferC1Ev
+__ZN7WebCore12SharedBufferC2Ev
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZNK7WebCore4Node18getSubresourceURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore4Node27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE14deleteAllNodesEv
+__ZNK7WebCore13StyledElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore16HTMLStyleElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore13CSSStyleSheet23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF5DequeIPN7WebCore13CSSStyleSheetEE14expandCapacityEv
+__ZN7WebCore12CSSStyleRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore26CSSMutableStyleDeclaration23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore17CSSPrimitiveValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore15HTMLBodyElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore15HTMLBodyElement10backgroundEv
+__ZN7WebCore12IconDatabase17iconURLForPageURLERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive6createEN3WTF10PassRefPtrINS_15ArchiveResourceEEERNS1_6VectorIS4_Lm0EEERNS5_INS2_IS0_EELm0EEE
+__ZN7WebCore16LegacyWebArchive6createEv
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E15deallocateTableEPS2_i
+__ZN7WebCore16LegacyWebArchive21rawDataRepresentationEv
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationEPNS_7ArchiveE
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationEPNS_15ArchiveResourceENS0_18MainResourceStatusE
+__ZN7WebCore15ArchiveResourceD0Ev
+__ZN7WebCore5Cache11setDisabledEb
+__ZN7WebCore5Cache18pruneDeadResourcesEv
+__ZNK7WebCore5Cache12deadCapacityEv
+__ZN7WebCore5Cache18pruneLiveResourcesEv
+__ZNK7WebCore5Cache12liveCapacityEv
+__ZN7WebCore18MainResourceLoader18handleDataLoadSoonERNS_15ResourceRequestE
+__ZN7WebCore18MainResourceLoader18startDataLoadTimerEv
+__ZN7WebCore16RunLoopTimerBase5startEdd
+__ZN7WebCore16RunLoopTimerBase8scheduleERKN3WTF7HashSetINS1_6RefPtrINS_12SchedulePairEEENS_16SchedulePairHashENS1_10HashTraitsI
+__ZN7WebCore16RunLoopTimerBase8scheduleEPKNS_12SchedulePairE
+__ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv
+__ZN7WebCore12RunLoopTimerINS_18MainResourceLoaderEE5firedEv
+__ZN7WebCore18MainResourceLoader17handleDataLoadNowEPNS_12RunLoopTimerIS0_EE
 __ZNK7WebCore12SharedBuffer12platformDataEv
-__ZNK7WebCore5Image5widthEv
-__ZNK7WebCore11BitmapImage4sizeEv
-__ZNK7WebCore11ImageSource4sizeEv
-__ZNK7WebCore5Image6heightEv
-__ZNK7WebCore4Font5widthERKNS_7TextRunE
-__ZN7WebCore7Element8updateIdERKNS_12AtomicStringES3_
-__ZNK7WebCore7Element10attributesEb
-__ZNK7WebCore13StyledElement28updateStyleAttributeIfNeededEv
-__ZN7WebCore8Document14addElementByIdERKNS_12AtomicStringEPNS_7ElementE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZNK7WebCore7Element14getIDAttributeEv
-__ZN3WTF7HashMapIPN7WebCore10StringImplEiNS1_10StringHashENS_10HashTraitsIS3_EENS5_IiEEE3setERKS3_RKi
-__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleEd
-__ZN7WebCore10timerFiredEP16__CFRunLoopTimerPv
-__ZN7WebCore9TimerBase16sharedTimerFiredEv
-__ZN7WebCore9TimerBase19collectFiringTimersEdRN3WTF6VectorIPS0_Lm0EEE
-__ZN3WTF7HashSetIPKN7WebCore9TimerBaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore9TimerBase10fireTimersEdRKN3WTF6VectorIPS0_Lm0EEE
-__ZN7WebCore5TimerINS_12GCControllerEE5firedEv
-__ZN7WebCore12GCController12gcTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11CachedImage4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
--[WebCoreSharedBufferData dealloc]
-__ZN7WebCore14CachedResource6finishEv
-__ZN7WebCore19MediaQueryEvaluatorC2Eb
-__ZNK7WebCore11FrameLoader8encodingEv
-__ZN7WebCore9DocLoader20requestCSSStyleSheetERKNS_6StringES3_b
-__ZN7WebCore19CachedCSSStyleSheetC2EPNS_9DocLoaderERKNS_6StringES5_bb
-__ZN7WebCore19CachedCSSStyleSheet3refEPNS_20CachedResourceClientE
-__ZN7WebCore15SegmentedString6appendERKS0_
-__ZN7WebCore15SegmentedString6appendERKNS_18SegmentedSubstringE
-__ZNK7WebCore23DeprecatedValueListImpl7Private8copyListEPNS_27DeprecatedValueListImplNodeERS3_S4_
-__ZN7WebCore17HTMLScriptElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLScriptElement15childrenChangedEb
-__ZNK7WebCore17HTMLScriptElement4textEv
-__ZN7WebCore13ulConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLUListElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLUListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLUListElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLUListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLUListElement11tagPriorityEv
-__ZN7WebCore13liConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLLIElementC2EPNS_8DocumentE
-__ZNK7WebCore13HTMLLIElement17endTagRequirementEv
-__ZNK7WebCore13HTMLLIElement11tagPriorityEv
-__ZN7WebCore13HTMLLIElement6attachEv
-__ZNK7WebCore9DOMWindow6screenEv
-__ZN7WebCore6ScreenC2EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_6ScreenE
-__ZN7WebCore17JSScreenPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore8JSScreenC1EPN3KJS8JSObjectEPNS_6ScreenE
-__ZN7WebCore8JSScreen18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore8JSScreenEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore8JSScreen16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore6Screen6heightEv
-__ZN7WebCore10screenRectEPNS_6WidgetE
-__ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
-__ZN7WebCore9FloatRect5scaleEf
-__ZN7WebCore11writeHelperEPN3KJS9ExecStateERKNS0_4ListE
-__ZN7WebCore8Document5writeERKNS_6StringE
+__ZN7WebCore4Page9initGroupEv
+__ZN7WebCore9PageGroupC1EPNS_4PageE
+__ZN7WebCore9PageGroupC2EPNS_4PageE
+__ZNK7WebCore9FrameView26shouldUpdateWhileOffscreenEv
+-[DOMNode nodeName]
+__ZNK7WebCore8Document8nodeNameEv
+-[DOMNode nodeType]
+__ZNK7WebCore4Text8nodeNameEv
+-[DOMElement getAttribute:]
+__ZN7WebCore11FrameLoader17stopForUserCancelEb
+__ZN7WebCore15RenderTableCell7destroyEv
+__ZN7WebCore15RenderTableCellD0Ev
+__ZN7WebCore14RenderTableRow7destroyEv
+__ZN7WebCore18RenderTableSection11removeChildEPNS_12RenderObjectE
+__ZN7WebCore14RenderTableRowD0Ev
+__ZN7WebCore18RenderTableSection7destroyEv
+__ZN7WebCore11RenderTable11removeChildEPNS_12RenderObjectE
+__ZN7WebCore18RenderTableSectionD0Ev
+__ZN7WebCore18RenderTableSection9clearGridEv
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE6shrinkEm
+__ZN7WebCore11RenderTableD0Ev
+__ZN7WebCore15AutoTableLayoutD0Ev
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6shrinkEm
+__ZN7WebCore16HTMLStyleElementD0Ev
+__ZN7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore23HTMLTableSectionElementD0Ev
+__ZN7WebCore19HTMLTableRowElementD0Ev
+__ZN7WebCore20HTMLTableCellElementD0Ev
+__ZN7WebCore11CachedImageD0Ev
+__ZN7WebCore14CachedResourceD2Ev
+__ZN7WebCore17HTMLAnchorElementD0Ev
+__ZN7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore13HTMLLIElementD0Ev
+__ZN7WebCore12EventHandler15sendResizeEventEv
+__ZN7WebCore5Frame25setUserStyleSheetLocationERKNS_4KURLE
+__ZN7WebCore12base64DecodeERKN3WTF6VectorIcLm0EEERS2_
+__ZN7WebCore12base64DecodeEPKcjRN3WTF6VectorIcLm0EEE
+__ZN7WebCore6String8fromUTF8EPKc
+__ZNK7WebCore10StyleSheet11completeURLERKNS_6StringE
+__ZN7WebCore7DataRefINS_22StyleRareInheritedDataEE6accessEv
+__ZN7WebCore15RenderTableCell29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore5Frame23visiblePositionForPointERKNS_8IntPointE
+__ZN7WebCoreL43positionForPointRespectingEditingBoundariesEPNS_9RenderBoxES1_RKNS_8IntPointE
+__ZN7WebCore9RenderBox16positionForPointERKNS_8IntPointE
+__ZN7WebCore12RenderObject21createVisiblePositionERKNS_8PositionE
+__ZN7WebCore31firstDeepEditingPositionForNodeEPNS_4NodeE
+__ZN7WebCore17positionAfterNodeEPKNS_4NodeE
+-[DOMRange endOffset]
+-[DOMRange startOffset]
+-[DOMRange startContainer]
+-[DOMNode childNodes]
+-[DOMCharacterData data]
+-[DOMDocument createTextNode:]
+__Z3kitPN7WebCore4TextE
+-[DOMNode insertBefore:refChild:]
+-[DOMDocument createElement:]
+-[DOMHTMLAnchorElement setHref:]
+-[DOMNode appendChild:]
+-[DOMCharacterData setData:]
+-[DOMRange setStart:offset:]
+-[DOMRange setEnd:offset:]
+-[DOMRange(DOMRangeExtensions) lineBoxRects]
+-[DOMRange(DOMRangeExtensions) textRects]
+__ZN7WebCore13InlineTextBox11extractLineEv
+__ZN7WebCore10RenderText14extractTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore13InlineTextBox10attachLineEv
+__ZN7WebCore10RenderText13attachTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore5Range9textRectsERN3WTF6VectorINS_7IntRectELm0EEEb
+__ZN7WebCore10RenderText21absoluteRectsForRangeERN3WTF6VectorINS_7IntRectELm0EEEjjb
+__ZN7WebCore13InlineTextBox13selectionRectEiiii
+__ZN7WebCoreL3kitERKN3WTF6VectorINS_7IntRectELm0EEE
+__ZN7WebCore4Page17willMoveOffscreenEv
+__ZN7WebCore9FrameView17willMoveOffscreenEv
+__ZN7WebCore10RenderView17willMoveOffscreenEv
+__ZN3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE4takeERKS
+__ZN3WTF9HashTableIPN7WebCore11RenderImageESt4pairIS3_PNS1_20RenderImageScaleDataEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZN7WebCore14DragController9dragEndedEv
+__ZN7WebCore4PageD1Ev
+__ZN7WebCore4PageD2Ev
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ident
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore19InspectorController22inspectedPageDestroyedEv
+__ZN7WebCore19InspectorController5closeEv
+__ZN7WebCore15BackForwardList5closeEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore9FrameDataELm0EE6shrinkEm
+__ZN7WebCore9FrameData5clearEb
+__ZN7WebCore15BackForwardListD1Ev
+__ZN7WebCore15BackForwardListD2Ev
+__ZN7WebCore15ProgressTrackerD1Ev
+__ZN7WebCore15ProgressTrackerD2Ev
+__ZN7WebCore19InspectorControllerD0Ev
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS8_IS
+__ZN3WTF15deleteAllValuesIPN7WebCore14ConsoleMessageELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore21ContextMenuControllerD1Ev
+__ZN7WebCore21ContextMenuControllerD2Ev
+__ZN7WebCore14DragControllerD1Ev
+__ZN7WebCore14DragControllerD2Ev
+__ZN7WebCore6ChromeD0Ev
+__ZN7WebCore5Range19nodeChildrenChangedEPNS_13ContainerNodeE
+-[DOMRange endContainer]
+__ZN7WebCore5Range11textRemovedEPNS_4NodeEjj
+-[DOMRange setStartBefore:]
+-[DOMRange setEndAfter:]
+__ZN7WebCore16LegacyWebArchive6createEPNS_5RangeE
+__ZN7WebCore12createMarkupEPKNS_5RangeEPN3WTF6VectorIPNS_4NodeELm0EEENS_23EAnnotateForInterchangeEb
+__ZN7WebCore25avoidIntersectionWithNodeEPKNS_5RangeEPNS_4NodeE
+__ZN7WebCore22DeleteButtonController7disableEv
+__ZN7WebCore22DeleteButtonController4hideEv
+__ZNK7WebCore12RenderObject14previousOffsetEi
+__ZN7WebCoreL27needInterchangeNewlineAfterERKNS_15VisiblePositionE
+__ZNK7WebCore15VisiblePosition4nextEb
+__ZN7WebCore29nextVisuallyDistinctCandidateERKNS_8PositionE
+__ZNK7WebCore8Position11atEndOfTreeEv
+__ZNK7WebCore8Position4nextENS_16PositionMoveTypeE
+__ZN7WebCoreL14getStartMarkupEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPN3WTF7HashMapIPNS_16AtomicStringImplESA_NS7
+__ZNK7WebCore15HTMLBodyElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore26CSSMutableStyleDeclaration4copyEv
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEC1ILm4EEERKNS0_IS2_XT_EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEC2ILm4EEERKNS0_IS2_XT_EEE
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleERKN3WTF6VectorINS_11CSSPropertyELm0EEEj
+__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleERKN3WTF6VectorINS_11CSSPropertyELm0EEEj
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEC1ILm0EEERKNS0_IS2_XT_EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEC2ILm0EEERKNS0_IS2_XT_EEE
+__ZN7WebCoreL31styleFromMatchedRulesForElementEPNS_7ElementEb
+__ZN7WebCore16CSSStyleSelector20styleRulesForElementEPNS_7ElementEb
+__ZN7WebCore26CSSMutableStyleDeclaration5mergeEPS0_b
+__ZN7WebCore20enclosingNodeWithTagERKNS_8PositionERKNS_13QualifiedNameE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE6shrinkEm
+__ZNK7WebCore16HTMLTableElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore20HTMLTableCellElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore34convertHTMLTextToInterchangeFormatERKNS_6StringEPKNS_4TextE
+__ZN7WebCoreL12getEndMarkupEPKNS_4NodeE
+__ZNK7WebCore16HTMLImageElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore12_GLOBAL__N_120convertedSpaceStringEv
+__ZN7WebCore6String6appendEt
+__ZN7WebCore16isMailBlockquoteEPKNS_4NodeE
+__ZNK7WebCore27CSSComputedStyleDeclaration25copyInheritablePropertiesEv
+__ZNK7WebCore19CSSStyleDeclaration19copyPropertiesInSetEPKij
+__ZN7WebCoreL14valueForFamilyERKNS_12AtomicStringE
+__ZN7WebCoreL19identifierForFamilyERKNS_12AtomicStringE
+__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6LengthE
+__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6LengthE
+__ZN7WebCoreL24currentColorOrValidColorEPNS_11RenderStyleERKNS_5ColorE
+__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEiRi
+__ZNK7WebCore9StyleBase15isCSSStyleSheetEv
+__ZN7WebCoreL31cssIdentifierForFontSizeKeywordEi
+__ZN7WebCoreL28propertyMissingOrEqualToNoneEPNS_26CSSMutableStyleDeclarationEi
+__ZN7WebCore17isTabSpanTextNodeEPKNS_4NodeE
+__ZN7WebCore13isTabSpanNodeEPKNS_4NodeE
+__ZN7WebCore21nearestMailBlockquoteEPKNS_4NodeE
+__ZNK7WebCore19CSSStyleDeclaration4diffEPNS_26CSSMutableStyleDeclarationE
+__ZNK7WebCore10RenderText22caretMaxRenderedOffsetEv
+__ZNK7WebCore10RenderText14caretMaxOffsetEv
+__ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore22DeleteButtonController6enableEv
+__ZN7WebCore22DeleteButtonController4showEPNS_11HTMLElementE
+__ZNK7WebCore5Frame18documentTypeStringEv
+__ZNK7WebCore16HTMLTableElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore20HTMLTableCellElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore12CSSValueList23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore16HTMLImageElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE3addERKS2_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIN7WebCore4KURLEEES5_NS_17IdentityExtractorIS5_EENS_28ListHashSetNodeHashFunctionsIS3_N
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE10appendNodeEPNS_15ListHashSetNodeIS2_EE
+__ZNK3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_22Iden
+__ZN3WTF7HashSetIN7WebCore4KURLENS1_8KURLHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E13allocateTableEi
+__ZNK7WebCore14DocumentLoader11subresourceERKNS_4KURLE
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
+__ZN7WebCore12SharedBuffer12createNSDataEv
+-[DOMRange commonAncestorContainer]
+-[DOMRange collapsed]
+-[DOMRange intersectsNode:]
+__ZN7WebCore5Range14intersectsNodeEPNS_4NodeERi
+__ZN7WebCore5Range12comparePointEPNS_4NodeEiRi
+-[DOMNode isSameNode:]
+__ZN7WebCoreL15baseConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLBaseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBaseElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBaseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLBaseElement7processEv
+__ZNK7WebCore15HTMLBaseElement17endTagRequirementEv
+__ZNK7WebCore15HTMLBaseElement11tagPriorityEv
+__ZN7WebCore15HTMLBaseElement20insertedIntoDocumentEv
+__ZN7WebCore8Document17setBaseElementURLERKNS_4KURLE
+-[DOMDocument body]
+__Z3kitPN7WebCore11HTMLElementE
+-[DOMHTMLElement setClassName:]
+-[DOMHTMLDocument(DOMHTMLDocumentExtensions) createDocumentFragmentWithText:]
+__Z4coreP15DOMHTMLDocument
+__ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
+__ZN7WebCore8Document22createDocumentFragmentEv
+__ZNK7WebCore6String5splitEtbRN3WTF6VectorIS0_Lm0EEE
+__ZN7WebCore29createDefaultParagraphElementEPNS_8DocumentE
+__ZN7WebCoreL23fillContainerFromStringEPNS_13ContainerNodeERKNS_6StringE
+__ZN7WebCore30stringWithRebalancedWhitespaceERKNS_6StringEbb
+__ZN7WebCore18createBreakElementEPNS_8DocumentE
+__Z3kitPN7WebCore16DocumentFragmentE
+__ZN7WebCoreL21blockquoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore21HTMLBlockquoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21HTMLBlockquoteElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+-[DOMElement setAttribute:value:]
+-[DOMHTMLDocument(DOMHTMLDocumentExtensions) createDocumentFragmentWithMarkupString:baseURL:]
+__ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
+__ZN7WebCore10HTMLParser28tableSectionCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL23tablesectionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+-[DOMElement hasAttribute:]
+__ZNK7WebCore7Element12hasAttributeERKNS_6StringE
+-[DOMElement style]
+-[DOMCSSStyleDeclaration getPropertyCSSValue:]
+__ZN7WebCore19CSSStyleDeclaration19getPropertyCSSValueERKNS_6StringE
+__Z3kitPN7WebCore8CSSValueE
+__Z8kitClassPN7WebCore8CSSValueE
+-[DOMCSSValue cssValueType]
+-[DOMCSSPrimitiveValue primitiveType]
+-[DOMCSSPrimitiveValue getRGBColorValue]
+__ZNK7WebCore17CSSPrimitiveValue16getRGBColorValueERi
+__Z3kitj
++[DOMRGBColor initialize]
+__Z33createWrapperCacheWithIntegerKeysv
+-[DOMRGBColor red]
+__Z3kitPN7WebCore17CSSPrimitiveValueE
+-[DOMCSSPrimitiveValue getFloatValue:]
+__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEtRi
+-[DOMRGBColor blue]
+-[DOMRGBColor green]
+-[DOMCSSStyleDeclaration removeProperty:]
+__ZN7WebCore19CSSStyleDeclaration14removePropertyERKNS_6StringERi
+__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEdb
+-[DOMHTMLImageElement src]
+-[DOMDocument getElementById:]
+-[DOMDocument createNodeIterator:whatToShow:filter:expandEntityReferences:]
+__ZN7WebCore8Document18createNodeIteratorEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
+__ZN7WebCore12NodeIteratorC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore12NodeIteratorC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore9TraversalC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore12NodeIterator11NodePointerC1EN3WTF10PassRefPtrINS_4NodeEEEb
+__ZN7WebCore12NodeIterator11NodePointerC2EN3WTF10PassRefPtrINS_4NodeEEEb
+__ZN7WebCore12NodeIterator11NodePointerC1Ev
+__ZN7WebCore12NodeIterator11NodePointerC2Ev
+__ZN7WebCore8Document18attachNodeIteratorEPNS_12NodeIteratorE
+__ZN3WTF7HashSetIPN7WebCore12NodeIteratorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__Z3kitPN7WebCore12NodeIteratorE
+-[DOMNodeIterator nextNode]
+__ZN7WebCore19scriptStateFromNodeEPNS_4NodeE
+__ZN7WebCore12NodeIterator8nextNodeEPN3JSC9ExecStateERi
+__ZN7WebCore12NodeIterator11NodePointer10moveToNextEPNS_4NodeE
+__ZNK7WebCore9Traversal10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore12NodeIterator11NodePointer5clearEv
+-[DOMElement removeAttribute:]
+__ZNK7WebCore5Frame30applyEditingStyleToBodyElementEv
+__ZNK7WebCore5Frame26applyEditingStyleToElementEPNS_7ElementE
+__ZN7WebCore16VisibleSelectionC1ERKNS_8PositionENS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2ERKNS_8PositionENS_9EAffinityE
+__ZNK7WebCore8RenderBR14caretMinOffsetEv
+__ZN7WebCore6Editor18shouldBeginEditingEPNS_5RangeE
+__ZN7WebCore6Editor15didBeginEditingEv
+__ZNK7WebCore4Node20shouldUseInputMethodEv
+__ZN7WebCore10RenderText14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore13InlineTextBox17positionForOffsetEi
+__ZNK7WebCore12RenderObject19offsetFromContainerEPS0_
+__ZN7WebCore31SimplifiedBackwardsTextIterator8exitNodeEv
+__ZN7WebCore14caretMaxOffsetEPKNS_4NodeE
+__ZN7WebCore31SimplifiedBackwardsTextIterator17handleNonTextNodeEv
+__ZN7WebCore31SimplifiedBackwardsTextIterator13emitCharacterEtPNS_4NodeEii
+__ZN3WTF6VectorItLm1024EE7prependItEEvPKT_m
+__ZN3WTF6VectorItLm1024EE6insertItEEvmPKT_m
+__ZN7WebCoreL17startWordBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL30startOfLastWordBoundaryContextEPKti
+__ZN7WebCore16findWordBoundaryEPKtiiPiS2_
+__ZN7WebCore26BackwardsCharacterIteratorC1EPKNS_5RangeE
+__ZN7WebCore26BackwardsCharacterIteratorC2EPKNS_5RangeE
+__ZN7WebCore26BackwardsCharacterIterator7advanceEi
+__ZNK7WebCore26BackwardsCharacterIterator5rangeEv
+-[DOMDocument styleSheets]
+__Z3kitPN7WebCore14StyleSheetListE
+-[DOMStyleSheetList length]
+-[DOMElement getAttributeNode:]
+__ZN7WebCore7Element16getAttributeNodeERKNS_6StringE
+__Z3kitPN7WebCore4AttrE
+-[DOMCSSStyleDeclaration length]
+-[DOMCSSStyleDeclaration item:]
+__ZNK7WebCore26CSSMutableStyleDeclaration4itemEj
+-[DOMNode hasChildNodes]
+-[DOMStyleSheetList dealloc]
+-[DOMNodeIterator dealloc]
+-[DOMNodeIterator detach]
+__ZN7WebCore12NodeIterator6detachEv
+__ZN7WebCore8Document18detachNodeIteratorEPNS_12NodeIteratorE
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN7WebCore12NodeIteratorD1Ev
+__ZN7WebCore12NodeIteratorD2Ev
+-[DOMCSSValue dealloc]
+-[DOMRGBColor dealloc]
+__ZN7WebCore12EventHandler8keyEventEP7NSEvent
+__ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
+__ZN7WebCore21PlatformKeyboardEventC2EP7NSEvent
+__ZN7WebCoreL24keyIdentifierForKeyEventEP7NSEvent
+__ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
+__ZN7WebCoreL26eventTargetNodeForDocumentEPNS_8DocumentE
+__ZN7WebCore12EventHandler15handleAccessKeyERKNS_21PlatformKeyboardEventE
+__ZN7WebCore12EventHandler18accessKeyModifiersEv
+__ZNK7WebCore12EventHandler38needsKeyboardEventDisambiguationQuirksEv
+__ZN7WebCore19applicationIsSafariEv
+__ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
+__ZN7WebCore13KeyboardEventC1ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
+__ZN7WebCore13KeyboardEventC2ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
+__ZN7WebCore6Editor24handleInputMethodKeydownEPNS_13KeyboardEventE
+__ZNK7WebCore13KeyboardEvent15isKeyboardEventEv
+__ZN7WebCore12EventHandler27defaultKeyboardEventHandlerEPNS_13KeyboardEventE
+__ZN7WebCore6Editor19handleKeyboardEventEPNS_13KeyboardEventE
+__ZN7WebCore6Editor7commandERKNS_6StringE
+__ZN7WebCore6Editor7commandERKNS_6StringENS_19EditorCommandSourceE
+__ZN7WebCoreL16createCommandMapEv
+__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHas
+__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS
+__ZN7WebCore6Editor7CommandC1EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
+__ZN7WebCore6Editor7CommandC2EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
+__ZNK7WebCore6Editor7Command15isTextInsertionEv
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE15reserveCapacityEm
+__ZN7WebCore6Editor10insertTextERKNS_6StringEPNS_5EventE
+__ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
+__ZN7WebCore9TextEventC1EN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZN7WebCore9TextEventC2EN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZNK7WebCore9TextEvent11isTextEventEv
+__ZN7WebCore12EventHandler28defaultTextInputEventHandlerEPNS_9TextEventE
+__ZN7WebCore6Editor33insertTextWithoutSendingTextEventERKNS_6StringEbPNS_5EventE
+__ZN7WebCore6Editor19selectionForCommandEPNS_5EventE
+__ZNK7WebCore6Editor16shouldInsertTextERKNS_6StringEPNS_5RangeENS_18EditorInsertActionE
+__ZNK7WebCore5Frame11typingStyleEv
+__ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringERKNS_16VisibleSelectionEbb
+__ZN7WebCore23BeforeTextInsertedEventC1ERKNS_6StringE
+__ZN7WebCore23BeforeTextInsertedEventC2ERKNS_6StringE
+__ZN7WebCore23BeforeTextInsertedEventD0Ev
+__ZN7WebCore13TypingCommandC1EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommandC2EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityEb
+__ZN7WebCore20CompositeEditCommandC2EPNS_8DocumentE
+__ZN7WebCore11EditCommandC2EPNS_8DocumentE
+__ZN7WebCore25avoidIntersectionWithNodeERKNS_16VisibleSelectionEPNS_4NodeE
+__ZN7WebCore11EditCommand20setStartingSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore11EditCommand18setEndingSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore11EditCommand5applyEv
+__ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
+__ZN7WebCore24isRichlyEditablePositionERKNS_8PositionE
+__ZNK7WebCore11HTMLElement23isContentRichlyEditableEv
+__ZNK7WebCore11EditCommand12updateLayoutEv
+__ZN7WebCore13TypingCommand7doApplyEv
+__ZN7WebCore13TypingCommand10insertTextERKNS_6StringEb
+__ZN7WebCore13TypingCommand28insertTextRunWithoutNewlinesERKNS_6StringEb
+__ZN7WebCore17InsertTextCommandC1EPNS_8DocumentE
+__ZN7WebCore17InsertTextCommandC2EPNS_8DocumentE
+__ZN7WebCore20CompositeEditCommand23applyCommandToCompositeEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore11EditCommand9setParentEPNS_20CompositeEditCommandE
+__ZN7WebCore17InsertTextCommand7doApplyEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE15reserveCapacityEm
+__ZN7WebCore17InsertTextCommand5inputERKNS_6StringEb
+__ZN7WebCore25lineBreakExistsAtPositionERKNS_8PositionE
+__ZN7WebCore12isEndOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore10endOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextERKNS_8PositionES3_
+__ZN7WebCore5Range21compareBoundaryPointsERKNS_8PositionES3_
+__ZN7WebCore20CompositeEditCommand38positionAvoidingSpecialElementBoundaryERKNS_8PositionE
+__ZN7WebCore22enclosingAnchorElementERKNS_8PositionE
+__ZN7WebCore17InsertTextCommand23prepareForTextInsertionERKNS_8PositionE
+__ZN7WebCore8Document21createEditingTextNodeERKNS_6StringE
+__ZN7WebCore11EditingTextC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore11EditingTextC2EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore20CompositeEditCommand12insertNodeAtEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommandC1EN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommandC2EN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommand7doApplyEv
+__ZN7WebCore11EditingText16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore20CompositeEditCommand18insertTextIntoNodeEN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommand7doApplyEv
+__ZN7WebCore13CharacterData10insertDataEjRKNS_6StringERi
+__ZN7WebCore6String6insertERKS0_j
+__ZN7WebCore6String6insertEPKtjj
+__ZN7WebCore8Document12textInsertedEPNS_4NodeEjj
+__ZN7WebCore5Range12textInsertedEPNS_4NodeEjj
+__ZN7WebCore20CompositeEditCommand21rebalanceWhitespaceAtERKNS_8PositionE
+__ZN7WebCore16VisibleSelection20setWithoutValidationERKNS_8PositionES3_
+__ZNK7WebCore8Position13computedStyleEv
+__ZNK7WebCore8Position7elementEv
+__ZNK7WebCore12RenderObject14nextInPreOrderEPS0_
+__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEPS0_
+__ZN7WebCore9InlineBox13nextLeafChildEv
+__ZN7WebCore13TypingCommand24typingAddedToOpenCommandEv
+__ZN7WebCore6Editor14appliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCoreL36dispatchEditableContentChangedEventsERKNS_11EditCommandE
+__ZN7WebCore6Editor27changeSelectionAfterCommandERKNS_16VisibleSelectionEbbPNS_11EditCommandE
+__ZN7WebCore31SimplifiedBackwardsTextIterator14handleTextNodeEv
+__ZNK7WebCore13TypingCommand20preservesTypingStyleEv
+__ZN7WebCore5Frame14setTypingStyleEPNS_26CSSMutableStyleDeclarationE
+__ZNK7WebCore13TypingCommand13editingActionEv
+__ZN7WebCore6Editor24respondToChangedContentsERKNS_16VisibleSelectionE
+__ZN7WebCore13TypingCommand27markMisspellingsAfterTypingEv
+__ZNK7WebCore13TypingCommand15isTypingCommandEv
+__ZN7WebCore9TextEventD0Ev
+__ZN7WebCore13KeyboardEventD0Ev
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE6shrinkEm
+__ZNK7WebCore17InsertTextCommand19isInsertTextCommandEv
+__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextEN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore4Node16dispatchKeyEventERKNS_21PlatformKeyboardEventE
+__ZNK7WebCore4Node29traversePreviousNodePostOrderEPKS0_
+__ZN7WebCore10StringImpl7replaceEjjPS0_
+__ZN7WebCore6Editor37markMisspellingsAfterTypingToPositionERKNS_15VisiblePositionE
+__ZN7WebCore6Editor35isAutomaticQuoteSubstitutionEnabledEv
+__ZN7WebCore6Editor31isAutomaticLinkDetectionEnabledEv
+__ZN7WebCore6Editor34isAutomaticDashSubstitutionEnabledEv
+__ZN7WebCore6Editor33isAutomaticTextReplacementEnabledEv
+__ZN7WebCore6Editor36isAutomaticSpellingCorrectionEnabledEv
+__ZN7WebCoreL12nextBoundaryERKNS_15VisiblePositionEPFjPKtjjNS_33BoundarySearchContextAvailabilityERbE
+__ZN7WebCoreL15endWordBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL29endOfFirstWordBoundaryContextEPKti
+__ZNK7WebCore12RenderObject11isTextFieldEv
+__ZN7WebCore6Editor13didEndEditingEv
+__ZN7WebCore13TypingCommandD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE6shrinkEm
+__ZN7WebCore17InsertTextCommandD0Ev
+__ZN7WebCore23InsertNodeBeforeCommandD0Ev
+__ZN7WebCore11EditCommandD2Ev
+__ZN7WebCore25InsertIntoTextNodeCommandD0Ev
+__ZN7WebCore15HTMLBaseElementD0Ev
+__ZN7WebCore11EditingTextD0Ev
+__ZN7WebCore4TextD2Ev
+__ZN7WebCore21HTMLBlockquoteElementD0Ev
+__ZN7WebCore13RootInlineBox23closestLeafChildForXPosEib
+__ZN7WebCore10RenderText16positionForPointERKNS_8IntPointE
+__ZNK7WebCore13InlineTextBox17offsetForPositionEib
+__ZNK7WebCore4Font17offsetForPositionERKNS_7TextRunEib
+__ZNK7WebCore4Font30offsetForPositionForSimpleTextERKNS_7TextRunEib
+__ZN7WebCore13WidthIterator19advanceOneCharacterERfPNS_11GlyphBufferE
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14shrinkCapacityEm
+__ZN3WTF6VectorItLm2048EE14shrinkCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE14shrinkCapacityEm
+__ZN7WebCore20UserStyleSheetLoaderC1EN3WTF10PassRefPtrINS_8DocumentEEERKNS_6StringE
+__ZN7WebCore20UserStyleSheetLoaderC2EN3WTF10PassRefPtrINS_8DocumentEEERKNS_6StringE
+__ZN7WebCore9DocLoader24requestUserCSSStyleSheetERKNS_6StringES3_
+__ZN7WebCore5Cache24requestUserCSSStyleSheetEPNS_9DocLoaderERKNS_6StringES5_
+-[WebScriptObject callWebScriptMethod:withArguments:]
+-[WebScriptObject _isSafeScript]
+-[WebScriptObject _rootObject]
+__ZNK3JSC8Bindings10RootObject12globalObjectEv
+__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPKN3JSC14JSGlobalObjectE
+-[WebScriptObject _imp]
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE6shrinkEm
+__ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
+__ZN7WebCore14DocumentLoader20setMainDocumentErrorERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader6cancelEv
+__ZN7WebCore14ResourceLoader6cancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader14cancelledErrorEv
+__ZN7WebCore17SubresourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceHandle19clearAuthenticationEv
+__ZN7WebCore27AuthenticationChallengeBase7nullifyEv
+__ZN7WebCore14DocumentLoader27cancelPendingSubstituteLoadEPNS_14ResourceLoaderE
+__ZN7WebCore14ResourceHandle6cancelEv
+__ZN7WebCore20UserStyleSheetLoaderD0Ev
+__ZN7WebCore19CachedCSSStyleSheetD0Ev
+__ZN7WebCoreL30newStreamingTextDecoderUTF16BEERKNS_12TextEncodingEPKv
+__ZN7WebCore14TextCodecUTF166decodeEPKcmbbRb
+__ZN7WebCore14TextCodecUTF16D0Ev
+__ZN7WebCore20UserStyleSheetLoader16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore9CSSParser17createCharsetRuleERKNS_15CSSParserStringE
+__ZN7WebCore14CSSCharsetRuleC1EPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore14CSSCharsetRuleC2EPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9StyleBase15isKeyframesRuleEv
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE6shrinkEm
+__ZN7WebCore14RenderMenuList11removeChildEPNS_12RenderObjectE
+__ZN7WebCore14RenderMenuListD0Ev
+__ZN7WebCore17RenderFlexibleBoxD2Ev
+__ZN7WebCore9PageGroup10removePageEPNS_4PageE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE6shrinkEm
+__ZN7WebCore15HTMLFontElementD0Ev
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE6shrinkEm
+__ZN7WebCore16HTMLInputElementD0Ev
+__ZN7WebCore16HTMLInputElement23needsActivationCallbackEv
+__ZN7WebCore22HTMLFormControlElement14removeFromFormEv
+__ZN7WebCore16InputElementDataD1Ev
+__ZN7WebCore16InputElementDataD2Ev
+__ZN7WebCore31HTMLFormControlElementWithStateD2Ev
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore22HTMLFormControlElementD2Ev
+__ZN7WebCore15HTMLImageLoaderD0Ev
+__ZN7WebCore28JSHTMLAnchorElementPrototypeD1Ev
+__ZThn8_N7WebCore17HTMLAnchorElementD0Ev
+__ZN7WebCore28JSHTMLSelectElementPrototypeD1Ev
+__ZN7WebCore19JSHTMLSelectElementD1Ev
+__ZThn8_N7WebCore17HTMLSelectElementD0Ev
+__ZN7WebCore17HTMLSelectElementD0Ev
+__ZN7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore17OptionElementDataD1Ev
+__ZN7WebCore17OptionElementDataD2Ev
+-[DOMNode hasAttributes]
+__ZNK7WebCore7Element13hasAttributesEv
+__ZN7WebCore20HTMLParagraphElementD0Ev
+__ZN7WebCore14CSSCharsetRuleD0Ev
+__ZN7WebCore8Document19hoveredNodeDetachedEPNS_4NodeE
+__ZN7WebCore11HTMLElement19isRecognizedTagNameERKNS_13QualifiedNameE
+__ZN7WebCore9HTMLNames11getHTMLTagsEPm
+__ZN7WebCore13RenderListBoxC1EPNS_17HTMLSelectElementE
+__ZN7WebCore13RenderListBoxC2EPNS_17HTMLSelectElementE
+__ZN7WebCore13RenderListBox14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore13RenderListBox17updateFromElementEv
+__ZNK7WebCore13RenderListBox8numItemsEv
+__ZN7WebCore13RenderListBox23setHasVerticalScrollbarEb
+__ZN7WebCore13RenderListBox15createScrollbarEv
+__ZN7WebCore14RenderThemeMac27scrollbarControlSizeForPartENS_11ControlPartE
+__ZN7WebCore9Scrollbar21createNativeScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
+__ZN7WebCore9ScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEPNS_14ScrollbarThemeE
+__ZN7WebCore9ScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEPNS_14ScrollbarThemeE
+__ZN7WebCore14ScrollbarTheme11nativeThemeEv
+__ZN7WebCore17ScrollbarThemeMacC1Ev
+__ZN7WebCore17ScrollbarThemeMacC2Ev
++[ScrollbarPrefsObserver registerAsObserver]
+__ZN7WebCore17ScrollbarThemeMac18preferencesChangedEv
+__ZN7WebCore17ScrollbarThemeMac17registerScrollbarEPNS_9ScrollbarE
+__ZN3WTF7HashSetIPN7WebCore9ScrollbarENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore17ScrollbarThemeMac18scrollbarThicknessENS_20ScrollbarControlSizeE
+__ZN7WebCore9Scrollbar9setParentEPNS_10ScrollViewE
+__ZN7WebCore6Widget16setParentVisibleEb
+__ZN7WebCore9Scrollbar12styleChangedEv
+__ZNK7WebCore13RenderListBox15canHaveChildrenEv
+__ZN7WebCore13RenderListBox16selectionChangedEv
+__ZN7WebCore16HTMLInputElement10setCheckedEbb
+__ZNK7WebCore5Theme14controlPaddingENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZN7WebCoreL13checkboxSizesEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_16HTMLInputElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3
+__ZN7WebCoreL10radioSizesEv
+__ZN7WebCore13RenderListBox14calcPrefWidthsEv
+__ZN7WebCore13RenderListBox6layoutEv
+__ZNK7WebCore13RenderListBox22verticalScrollbarWidthEv
+__ZN7WebCore13RenderListBox10calcHeightEv
+__ZNK7WebCore13RenderListBox10itemHeightEv
+__ZNK7WebCore13RenderListBox4sizeEv
+__ZNK7WebCore13RenderListBox15numVisibleItemsEv
+__ZN7WebCore9Scrollbar10setEnabledEb
+__ZN7WebCore9Scrollbar14invalidateRectERKNS_7IntRectE
+__ZThn200_N7WebCore13RenderListBox23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore13RenderListBox23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore9Scrollbar8setStepsEiii
+__ZN7WebCore9Scrollbar13setProportionEii
+__ZN7WebCore9Scrollbar21updateThumbProportionEv
+__ZN7WebCore23ScrollbarThemeComposite14invalidatePartEPNS_9ScrollbarENS_13ScrollbarPartE
+__ZN7WebCore17ScrollbarThemeMac9trackRectEPNS_9ScrollbarEb
+__ZN7WebCore17ScrollbarThemeMac10hasButtonsEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite10splitTrackEPNS_9ScrollbarERKNS_7IntRectERS3_S6_S6_
+__ZN7WebCore23ScrollbarThemeComposite31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore23ScrollbarThemeComposite13thumbPositionEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite11thumbLengthEPNS_9ScrollbarE
+__ZNK7WebCore13RenderListBox14hasControlClipEv
+__ZN7WebCore13RenderListBox23scrollToRevealSelectionEv
+__ZNK7WebCore17HTMLSelectElement29activeSelectionStartListIndexEv
+__ZNK7WebCore17HTMLSelectElement27activeSelectionEndListIndexEv
+__ZN7WebCore13RenderListBox18listIndexIsVisibleEi
+__ZNK7WebCore13RenderListBox16baselinePositionEbb
+__ZN7WebCore23ScrollbarThemeComposite11trackLengthEPNS_9ScrollbarE
+__ZN7WebCore17ScrollbarThemeMac18minimumThumbLengthEPNS_9ScrollbarE
+__ZNK7WebCore11RenderTheme16baselinePositionEPKNS_12RenderObjectE
+__ZNK7WebCore8ThemeMac26baselinePositionAdjustmentENS_11ControlPartE
+__ZN7WebCore11RenderTable19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15GraphicsContext17drawConvexPolygonEmPKNS_10FloatPointEb
+__ZNK7WebCore5Color4darkEv
+__ZN7WebCore13RenderListBox11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderThemeMac13paintTextAreaEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore13RenderListBox14paintScrollbarERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9Scrollbar12setFrameRectERKNS_7IntRectE
+__ZNK7WebCore9FrameView17windowResizerRectEv
+__ZNK7WebCore6Chrome17windowResizerRectEv
+__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_7IntRectE
+__ZN7WebCore9Scrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore17ScrollbarThemeMac5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
+__ZThn200_NK7WebCore13RenderListBox8isActiveEv
+__ZNK7WebCore13RenderListBox8isActiveEv
+__ZN7WebCore17ScrollbarThemeMac8hasThumbEPNS_9ScrollbarE
+__ZNK7WebCore13RenderListBox15controlClipRectEii
+__ZN7WebCore13RenderListBox19paintItemBackgroundERNS_12RenderObject9PaintInfoEiii
+__ZThn128_NK7WebCore17HTMLOptionElement8selectedEv
+__ZN7WebCore13RenderListBox19itemBoundingBoxRectEiii
+__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac47platformInactiveListBoxSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac40platformInactiveSelectionBackgroundColorEv
+__ZN7WebCore13RenderListBox19paintItemForegroundERNS_12RenderObject9PaintInfoEiii
+__ZN7WebCore15GraphicsContext12drawBidiTextERKNS_4FontERKNS_7TextRunERKNS_10FloatPointE
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE21createBidiRunsForLineERKS1_bb
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE9appendRunEv
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE10deleteRunsEv
+__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionForegroundColorEv
+__ZNK7WebCore11RenderTheme40supportsListBoxSelectionForegroundColorsEv
+__ZNK7WebCore14RenderThemeMac47platformInactiveListBoxSelectionForegroundColorEv
+__ZN7WebCoreL8checkboxEjRKNS_7IntRectEf
+__ZN7WebCoreL15checkboxMarginsEm
+__ZN7WebCore36jsHTMLDocumentPrototypeFunctionWriteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument5writeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL13documentWriteEPN3JSC9ExecStateERKNS0_7ArgListEPNS_12HTMLDocumentENS_18NewlineRequirementE
 __ZN7WebCore15SegmentedString21setExcludeLineNumbersEv
-__ZNK7WebCore14HTMLDivElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore14HTMLDivElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore14HTMLDivElement11tagPriorityEv
-__ZN7WebCore15EventTargetNode16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore11EventTarget16addEventListenerEPNS_15EventTargetNodeERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore11EventTarget19removeEventListenerEPNS_15EventTargetNodeERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore5TimerINS_5FrameEE5firedEv
-__ZN7WebCore5Frame21lifeSupportTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore19CachedCSSStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore19TextResourceDecoder18checkForCSSCharsetEPKcmRb
-__ZN7WebCore19CachedCSSStyleSheet11checkNotifyEv
-__ZThn68_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZNK7WebCore19CachedCSSStyleSheet11canUseSheetEb
-__ZN7WebCore15HTMLLinkElement11sheetLoadedEv
-__ZNK7WebCore15HTMLLinkElement9isLoadingEv
-__ZNK7WebCore15HTMLLinkElement5sheetEv
-__ZNK7WebCore16DeprecatedString7findRevEPKci
-__ZNK7WebCore16DeprecatedString7findRevERKS0_ib
-__ZN7WebCore16DeprecatedString6removeEjj
-__ZN7WebCore19DeprecatedValueListIN3WTF6RefPtrINS_23RegisteredEventListenerEEEE8copyNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore19DeprecatedValueListIN3WTF6RefPtrINS_23RegisteredEventListenerEEEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZNK7WebCore23JSAbstractEventListener19isHTMLEventListenerEv
-__ZN3KJS6Window20jsHTMLEventListenersEv
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE15reserveCapacityEm
-__ZN7WebCore10JSDocument16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN3KJS26valueToStringWithNullCheckEPNS_9ExecStateEPNS_7JSValueE
-__ZN7WebCore8Document9setCookieERKNS_6StringE
-__ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLES4_RKNS_6StringE
-__ZN7WebCore8Document26setHTMLWindowEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore8Document29removeHTMLWindowEventListenerERKNS_12AtomicStringE
-__ZNK7WebCore12RenderObject10hasStaticYEv
-__ZN7WebCore9RenderBox32calculateBackgroundImageGeometryEPKNS_15BackgroundLayerEiiiiRNS_7IntRectERNS_8IntPointERNS_7IntSizeE
-__ZNK7WebCore9RenderBox23calculateBackgroundSizeEPKNS_15BackgroundLayerEii
-__ZN7WebCore11CachedImage21setImageContainerSizeERKNS_7IntSizeE
-__ZN7WebCore5Image16setContainerSizeERKNS_7IntSizeE
-__ZNK7WebCore9RenderBox30offsetForPositionedInContainerEPNS_12RenderObjectE
-__ZN3KJS14DOMWindowTimer5firedEv
-__ZN3KJS6Window10timerFiredEPNS_14DOMWindowTimerE
-__ZN7WebCore15ScheduledAction7executeEPN3KJS6WindowE
-__ZN7WebCore36jsHTMLDocumentPrototypeFunctionWriteEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSHTMLDocument5writeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore14isTableRelatedEPNS_4NodeE
-__ZN7WebCore11isTablePartEPNS_4NodeE
-__ZN7WebCore12RenderObject12imageChangedEPNS_11CachedImageE
-__ZN3KJS17staticValueGetterIN7WebCore10JSDocumentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSDocument16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore8Document6cookieEv
-__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE6shrinkEm
+__ZN7WebCore10HTMLParser11isHeaderTagERKNS_12AtomicStringE
+__ZNK7WebCore10HTMLParser8isInlineEPNS_4NodeE
+__ZThn8_N7WebCore20HTMLTableCellElementD0Ev
+__ZN7WebCore11RenderTable11splitColumnEii
+__ZN7WebCore18RenderTableSection11splitColumnEii
+__ZN7WebCore9FrameView14setMarginWidthEi
+__ZN7WebCore9FrameView15setMarginHeightEi
+__ZN7WebCore12RenderObject28addChildIgnoringContinuationEPS0_S1_
+__ZNK7WebCore11HistoryItem6targetEv
+__ZNK7WebCore13HTMLTokenizer14processingDataEv
+__ZN7WebCoreL19alternateFamilyNameERKNS_12AtomicStringE
+__ZN7WebCore11BitmapImage20frameDurationAtIndexEm
+__ZN7WebCore18RenderTextFragment7destroyEv
+__ZN7WebCore18RenderTextFragmentD0Ev
+__ZN7WebCore12RenderButton11removeChildEPNS_12RenderObjectE
+__ZN7WebCore12RenderButtonD0Ev
+__ZNK7WebCore6String8toDoubleEPb
+__ZN7WebCore10StringImpl8toDoubleEPb
+__ZN7WebCore11FrameLoader23scheduleHTTPRedirectionEdRKNS_6StringE
+__ZN7WebCore11FrameLoader16isLocationChangeERKNS_20ScheduledRedirectionE
+__ZN7WebCore19inputElementAltTextEv
+__ZNK7WebCore13HTMLHRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLHRElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore10HTMLParser19mapCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore14HTMLMapElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLMapElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLMapElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore8Document14removeImageMapEPNS_14HTMLMapElementE
+__ZN7WebCore8Document11addImageMapEPNS_14HTMLMapElementE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_14HTMLMapElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_E
+__ZNK7WebCore14HTMLMapElement17endTagRequirementEv
+__ZNK7WebCore14HTMLMapElement11tagPriorityEv
+__ZN7WebCore14HTMLMapElement8checkDTDEPKNS_4NodeE
+__ZN7WebCoreL15areaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLAreaElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLAreaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14newCoordsArrayERKNS_6StringERi
+__ZN7WebCoreL14countCharacterEPKtjt
+__ZN7WebCoreL11parseLengthEPKtj
+__ZN7WebCore21charactersToIntStrictEPKtmPbi
+__ZNK7WebCore15HTMLAreaElement17endTagRequirementEv
+__ZNK7WebCore15HTMLAreaElement11tagPriorityEv
+__ZNK7WebCore11BitmapImage10solidColorEv
+__ZN7WebCore5Image18fillWithSolidColorEPNS_15GraphicsContextERKNS_9FloatRectERKNS_5ColorENS_17CompositeOperatorE
+__ZN7WebCoreL5radioEjRKNS_7IntRectEf
+__ZN7WebCoreL12radioMarginsEm
+__ZN7WebCore5TimerINS_11BitmapImageEE5firedEv
+__ZN7WebCore11BitmapImage16advanceAnimationEPNS_5TimerIS0_EE
+__ZN7WebCore11BitmapImage24internalAdvanceAnimationEb
+__ZN7WebCore5TimerINS_11BitmapImageEED0Ev
+__ZThn392_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore20CachedResourceClient15willRenderImageEPNS_11CachedImageE
 __ZN7WebCore10HTMLParser24framesetCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore19framesetConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLFrameSetElementC2EPNS_8DocumentE
+__ZN7WebCoreL19framesetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLFrameSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLFrameSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore19HTMLFrameSetElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore19HTMLFrameSetElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore6String13toLengthArrayERi
-__ZN7WebCore10StringImpl13toLengthArrayERi
+__ZN7WebCore14newLengthArrayERKNS_6StringERi
 __ZNK7WebCore19HTMLFrameSetElement17endTagRequirementEv
 __ZNK7WebCore19HTMLFrameSetElement11tagPriorityEv
 __ZN7WebCore19HTMLFrameSetElement6attachEv
 __ZN7WebCore19HTMLFrameSetElement16rendererIsNeededEPNS_11RenderStyleE
 __ZNK7WebCore11RenderStyle16isStyleAvailableEv
 __ZN7WebCore19HTMLFrameSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderFrameSetC1EPNS_19HTMLFrameSetElementE
 __ZN7WebCore14RenderFrameSetC2EPNS_19HTMLFrameSetElementE
+__ZN7WebCore14RenderFrameSet8GridAxisC1Ev
 __ZN7WebCore14RenderFrameSet8GridAxisC2Ev
+__ZNK7WebCore14RenderFrameSet15virtualChildrenEv
 __ZN7WebCore19HTMLFrameSetElement8checkDTDEPKNS_4NodeE
 __ZNK7WebCore14RenderFrameSet10isFrameSetEv
-__ZN7WebCore16frameConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLFrameElementC2EPNS_8DocumentE
+__ZN7WebCoreL16frameConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLFrameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16HTMLFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore16HTMLFrameElement17endTagRequirementEv
 __ZNK7WebCore16HTMLFrameElement11tagPriorityEv
 __ZN7WebCore16HTMLFrameElement6attachEv
 __ZN7WebCore16HTMLFrameElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore16HTMLFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderFrameC1EPNS_16HTMLFrameElementE
 __ZN7WebCore11RenderFrameC2EPNS_16HTMLFrameElementE
 __ZNK7WebCore14RenderFrameSet14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
 __ZNK7WebCore11RenderFrame7isFrameEv
+__ZN7WebCore14RenderFrameSet15virtualChildrenEv
+__ZN3WTF6VectorIPN7WebCore5FrameELm16EE6shrinkEm
 __ZN7WebCore11RenderFrame11viewClearedEv
-__ZN7WebCore10HTMLParser24noframesCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
 __ZN7WebCore14RenderFrameSet6layoutEv
 __ZN7WebCore14RenderFrameSet8GridAxis6resizeEi
-__ZN3WTF6VectorIbLm0EE6resizeEm
 __ZN7WebCore14RenderFrameSet10layOutAxisERNS0_8GridAxisEPKNS_6LengthEi
 __ZN7WebCore14RenderFrameSet14positionFramesEv
+__ZN7WebCore9RenderBox6layoutEv
 __ZN7WebCore14RenderFrameSet15computeEdgeInfoEv
 __ZN3WTF6VectorIbLm0EE4fillERKbm
 __ZSt4fillIPbbEvT_S1_RKT0_
 __ZNK7WebCore11RenderFrame8edgeInfoEv
 __ZN3WTF6VectorIbLm0EEaSERKS1_
 __ZN7WebCore14RenderFrameSet16fillFromEdgeInfoERKNS_13FrameEdgeInfoEii
+__ZNK7WebCore9RenderBox11overflowTopEb
+__ZNK7WebCore9RenderBox12overflowLeftEb
 __ZN7WebCore14RenderFrameSet5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore6Editor17insideVisibleAreaERKNS_8IntPointE
 __ZN7WebCore14RenderFrameSet11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
 __ZN7WebCore19HTMLFrameSetElement19defaultEventHandlerEPNS_5EventE
 __ZN7WebCore14RenderFrameSet10userResizeEPNS_10MouseEventE
-__ZNK7WebCore9DOMWindow6parentEv
-__ZN7WebCore14JSHTMLDocument16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore11RenderFrameD0Ev
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE6shrinkEm
+__ZN7WebCore14RenderFrameSetD0Ev
+__ZN7WebCore12RenderObject15willRenderImageEPNS_11CachedImageE
+__ZThn8_N7WebCore15HTMLHtmlElementD0Ev
+__ZThn8_N7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCore10HTMLParser39handleResidualStyleCloseTagAcrossBlocksEPNS_13HTMLStackElemE
+__ZN7WebCore10HTMLParser19moveOneBlockToStackERPNS_13HTMLStackElemE
+__ZN7WebCore12NamedNodeMap13setAttributesERKS0_
+__ZN7WebCore18NamedMappedAttrMap15clearAttributesEv
+__ZN7WebCore12NamedNodeMap15clearAttributesEv
+__ZNK7WebCore15MappedAttribute5cloneEv
+__ZN7WebCore14JSHTMLDocument10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore6StringC1ERKN3JSC10IdentifierE
+__ZN7WebCore6StringC2ERKN3JSC10IdentifierE
+__ZN7WebCore8Document18documentNamedItemsERKNS_6StringE
+__ZN7WebCore18HTMLNameCollectionC1EN3WTF10PassRefPtrINS_8DocumentEEENS_14CollectionTypeERKNS_6StringE
+__ZN7WebCore18HTMLNameCollectionC2EN3WTF10PassRefPtrINS_8DocumentEEENS_14CollectionTypeERKNS_6StringE
+__ZN7WebCore8Document18nameCollectionInfoENS_14CollectionTypeERKNS_12AtomicStringE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CollectionCacheENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3
+__ZNK7WebCore18HTMLNameCollection9itemAfterEPNS_7ElementE
+__ZNK7WebCore14HTMLCollection9firstItemEv
+__ZN7WebCore18HTMLNameCollectionD0Ev
+__ZN7WebCore15HTMLFormElement15addElementAliasEPNS_22HTMLFormControlElementERKNS_12AtomicStringE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLFormControlElementEEENS_7PtrHashIS4_EENS_10HashTraitsI
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS1_INS2_22HTMLFormControlElementEEEENS_18PairFirstExtra
+__ZN7WebCore17JSHTMLFormElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLFormControlElementEEENS_7PtrHashIS4_EENS_10HashTraits
+__ZN7WebCore15FormDataBuilder17parseEncodingTypeERKNS_6StringE
+__ZN7WebCore15HTMLFormElement19removedFromDocumentEv
+__ZN7WebCore15HTMLFormElement16removeImgElementEPNS_16HTMLImageElementE
+__ZN7WebCore26JSHTMLFormElementPrototypeD1Ev
+__ZN7WebCore19HTMLFrameSetElementD0Ev
+__ZN7WebCore16HTMLFrameElementD0Ev
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointENS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointERKNS_7IntRectENS_17CompositeOperatorE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3
+__ZN7WebCore14HTMLMapElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
+__ZN7WebCore15HTMLAreaElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
+__ZNK7WebCore15HTMLAreaElement9getRegionERKNS_7IntSizeE
+__ZN7WebCore4Path10addEllipseERKNS_9FloatRectE
+__ZNK7WebCore4Path8containsERKNS_10FloatPointENS_8WindRuleE
+__ZNK7WebCore4Path12boundingRectEv
+__ZN7WebCoreL34copyClosingSubpathsApplierFunctionEPvPK13CGPathElement
+__ZN7WebCore9PageCache11autoreleaseEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore10CachedPageEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore10CachedPageEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E
+__ZN7WebCore9PageCache17removeFromLRUListEPNS_11HistoryItemE
+__ZN7WebCore16HTMLInputElement37registerForActivationCallbackIfNeededEv
+__ZNK7WebCore13HTMLTokenizer15isHTMLTokenizerEv
+__ZN7WebCore7Element26documentWillBecomeInactiveEv
+__ZN7WebCore21DeprecatedPtrListImpl4prevEv
+__ZN7WebCore21setJSDOMWindowOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnerrorEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZThn8_N7WebCore19HTMLTableRowElementD0Ev
+__ZN7WebCore14HTMLMapElementD0Ev
+__ZN7WebCore15HTMLAreaElementD0Ev
+__ZN7WebCore17HTMLAnchorElementD2Ev
+__ZThn32_NK7WebCore8DOMTimer10canSuspendEv
+__ZNK7WebCore8DOMTimer10canSuspendEv
+__ZThn32_N7WebCore8DOMTimer7suspendEv
+__ZN7WebCore8DOMTimer7suspendEv
+__ZN7WebCoreL19basefontConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLBaseFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLBaseFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLBaseFontElement17endTagRequirementEv
+__ZNK7WebCore19HTMLBaseFontElement11tagPriorityEv
+__ZNK7WebCore18RenderTextFragment12originalTextEv
+__ZN7WebCore18RenderTextFragment15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore18RenderTextFragment17previousCharacterEv
+__ZN7WebCore10RenderText17previousCharacterEv
+__ZNK7WebCore12RenderObject18previousInPreOrderEv
+__ZN7WebCore10StringImpl10capitalizeEt
+__ZN7WebCore17wordBreakIteratorEPKti
+__ZN7WebCore14textBreakFirstEPNS_17TextBreakIteratorE
+__ZNK7WebCore11RenderBlock20firstLineBoxBaselineEv
+__ZN7WebCore15RenderTableCell15setOverrideSizeEi
+__ZNK7WebCore6String11toIntStrictEPbi
+__ZN7WebCore10StringImpl11toIntStrictEPbi
+__ZN7WebCore4Node21setTabIndexExplicitlyEs
+__ZNK7WebCore12NamedNodeMap14mapsEquivalentEPKS0_
+__ZN7WebCore17HTMLScriptElement19removedFromDocumentEv
+__ZN7WebCore13ScriptElement19removedFromDocumentERNS_17ScriptElementDataE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCoreL28createHTMLAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLAreaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLAreaElementEEE
+__ZN7WebCore17JSHTMLAreaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLAreaElementEEE
+__ZN7WebCoreL14isTableRelatedEPKNS_4NodeE
+__ZN7WebCoreL11isTablePartEPKNS_4NodeE
+__ZN7WebCore16HTMLLabelElementD0Ev
+__ZN7WebCore15jsDOMWindowSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow4selfEv
+__ZNK7WebCore14RenderThemeMac25adjustMenuListButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore14RenderThemeMac19paintMenuListButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac28paintMenuListButtonGradientsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCoreL23MainGradientInterpolateEPvPKdPd
+__ZN7WebCoreL22TopGradientInterpolateEPvPKdPd
+__ZN7WebCoreL25BottomGradientInterpolateEPvPKdPd
+__ZN7WebCore15GraphicsContext8drawLineERKNS_8IntPointES3_
+__ZN7WebCore15GraphicsContext23addInnerRoundedRectClipERKNS_7IntRectEi
+__ZN7WebCore12RenderObject17drawArcForBoxSideEPNS_15GraphicsContextEiifNS_7IntSizeEiiNS_7BoxSideENS_5ColorERKS5_NS_12EBorderSty
+__ZN7WebCore15GraphicsContext9strokeArcERKNS_7IntRectEii
+__ZN7WebCore27JSHTMLInputElementPrototypeD1Ev
+__ZN7WebCore25JSHTMLCollectionPrototypeD1Ev
+__ZN7WebCore19JSHTMLAllCollectionD1Ev
+__ZN7WebCore5TimerINS_9PageCacheEE5firedEv
+__ZN7WebCore9PageCache39releaseAutoreleasedPagesNowOrRescheduleEPNS_5TimerIS0_EE
+__ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
+__ZN7WebCore12userIdleTimeEv
+__ZN7WebCore38jsHTMLDocumentPrototypeFunctionWritelnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument7writelnEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore21HTMLBlockquoteElement17endTagRequirementEv
+__ZNK7WebCore21HTMLBlockquoteElement11tagPriorityEv
+__ZN7WebCore13HTMLHRElementD0Ev
+__ZN7WebCore13JSPluginArrayD1Ev
+__ZN7WebCore13JSPluginArrayD2Ev
+__ZN7WebCore8JSPluginD1Ev
+__ZN7WebCore8JSPluginD2Ev
+__ZN7WebCore6PluginD1Ev
+__ZN7WebCore6PluginD2Ev
+__ZN7WebCore6Screen15disconnectFrameEv
+__ZN7WebCore11PluginArrayD1Ev
+__ZN7WebCore16CSSStyleSelector17mapFillAttachmentEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FrameView20addSlowRepaintObjectEv
+__ZNK7WebCore12RenderObject8viewRectEv
+__ZN7WebCore14RenderFrameSet17paintColumnBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderFrameSet14paintRowBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
+__ZN7WebCoreL15borderFillColorEv
+__ZN7WebCoreL20borderStartEdgeColorEv
+__ZN7WebCoreL18borderEndEdgeColorEv
+__ZN7WebCore13RenderListBoxD0Ev
+__ZN7WebCore13RenderListBox16destroyScrollbarEv
+__ZN7WebCore9ScrollbarD0Ev
+__ZN7WebCore9Scrollbar17stopTimerIfNeededEv
+__ZN7WebCore17ScrollbarThemeMac19unregisterScrollbarEPNS_9ScrollbarE
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore8JSScreenD1Ev
+__ZN7WebCore8JSScreenD2Ev
+__ZN7WebCore10CachedPage5clearEv
+__ZN7WebCore11CachedFrameD1Ev
+__ZN7WebCore11CachedFrameD2Ev
+__ZN7WebCore11CachedFrame5clearEv
+__ZN7WebCore9FrameView10clearFrameEv
+__ZN7WebCore21ScriptCachedFrameDataD1Ev
+__ZN7WebCore21ScriptCachedFrameDataD2Ev
+__ZN7WebCore21ScriptCachedFrameData5clearEv
+__ZThn32_N7WebCore8DOMTimer4stopEv
+__ZN7WebCore8DOMTimer4stopEv
+__ZN7WebCore10CachedPageD1Ev
+__ZN7WebCore10CachedPageD2Ev
+__ZN7WebCore10PluginDataD1Ev
+__ZN7WebCore10PluginDataD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore10PluginInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE6shrinkEm
+__ZN3WTF15deleteAllValuesIPN7WebCore13MimeClassInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE6shrinkEm
+__ZN7WebCore14HTMLPreElementD0Ev
+__ZThn8_N7WebCore16HTMLInputElementD0Ev
+__ZThn32_N7WebCore8DOMTimer16contextDestroyedEv
+__ZN7WebCore8DOMTimer16contextDestroyedEv
+__ZN7WebCore15ActiveDOMObject16contextDestroyedEv
+__ZN7WebCore19HTMLBaseFontElementD0Ev
+__ZN7WebCore19JSLocationPrototypeD1Ev
+__ZN7WebCore16HTMLDListElementD0Ev
+__ZN7WebCore12CSSMediaRuleD0Ev
+__ZN7WebCore10MediaQueryD1Ev
+__ZN7WebCore10MediaQueryD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore13MediaQueryExpELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore26JSHTMLAreaElementPrototypeD1Ev
+__ZN7WebCore17JSHTMLAreaElementD1Ev
+__ZThn8_N7WebCore15HTMLAreaElementD0Ev
+__ZN7WebCore22JSPluginArrayPrototypeD1Ev
+__ZN7WebCore17JSPluginPrototypeD1Ev
+__ZN7WebCore17JSScreenPrototypeD1Ev
+__ZN7WebCore15PurgeableBuffer6createEPKcm
+__ZN7WebCore15PurgeableBufferC1EPcm
+__ZN7WebCore15PurgeableBufferC2EPcm
+__ZN7WebCore15PurgeableBuffer13makePurgeableEb
+__ZN7WebCore12SharedBuffer20adoptPurgeableBufferEPNS_15PurgeableBufferE
+__ZNK7WebCore15PurgeableBuffer4dataEv
+__ZThn392_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore12SharedBuffer22releasePurgeableBufferEv
+__ZN7WebCore4Path7addRectERKNS_9FloatRectE
+__ZN7WebCore11BitmapImage22frameIsCompleteAtIndexEm
+__ZN7WebCore4Page18removeSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
+__ZN7WebCore14DocumentLoader10unscheduleEPNS_12SchedulePairE
+__ZN7WebCoreL13unscheduleAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEPNS_12
+-[DOMStyleSheetList item:]
+__Z3kitPN7WebCore10StyleSheetE
+__Z8kitClassPN7WebCore10StyleSheetE
+-[DOMCSSStyleSheet cssRules]
+__Z3kitPN7WebCore11CSSRuleListE
+-[DOMCSSRuleList length]
+-[DOMCSSStyleSheet insertRule:index:]
+__ZN7WebCore13CSSStyleSheet10insertRuleERKNS_6StringEjRi
+__ZN7WebCore9CSSParser9parseRuleEPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9StyleList6insertEjN3WTF10PassRefPtrINS_9StyleBaseEEE
+__ZN7WebCore13CSSStyleSheet17styleSheetChangedEv
+-[DOMCSSRuleList item:]
+__Z3kitPN7WebCore7CSSRuleE
+__Z8kitClassPN7WebCore7CSSRuleE
+-[DOMCSSStyleRule style]
+-[DOMCSSStyleDeclaration setCssText:]
+__ZN7WebCore26CSSMutableStyleDeclaration10setCssTextERKNS_6StringERi
+-[DOMElement clientHeight]
+__ZN7WebCore7Element12clientHeightEv
+-[DOMDocument createDocumentFragment]
+-[DOMNode lastChild]
+-[DOMElement getElementsByTagName:]
+-[DOMHTMLElement setInnerHTML:]
+-[DOMStyleSheet ownerNode]
+-[DOMNode setTextContent:]
+__ZN7WebCore4Node14setTextContentERKNS_6StringERi
+-[DOMCSSStyleRule selectorText]
+__ZNK7WebCore11RenderTable20firstLineBoxBaselineEv
+__ZNK7WebCore18RenderTableSection20firstLineBoxBaselineEv
+__ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKNS_6StringE
+-[DOMNode replaceChild:oldChild:]
+__ZN7WebCore17HTMLObjectElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore17HTMLObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16MIMETypeRegistry20isJavaAppletMIMETypeERKNS_6StringE
+__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E8conta
+__ZN7WebCoreL12isURLAllowedEPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore17HTMLPlugInElement4nameEv
+__ZN7WebCore11FrameLoader13requestObjectEPNS_10RenderPartERKNS_6StringERKNS_12AtomicStringES5_RKN3WTF6VectorIS3_Lm0EEESD_
+__ZN7WebCore11FrameLoader15shouldUsePluginERKNS_4KURLERKNS_6StringEbRb
+__ZN7WebCore11FrameLoader10loadPluginEPNS_10RenderPartERKNS_4KURLERKNS_6StringERKN3WTF6VectorIS6_Lm0EEESD_b
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E15deall
+__ZNK7WebCore14CachedResource9wasPurgedEv
+-[DOMCSSRuleList dealloc]
+-[DOMCSSRule dealloc]
+-[DOMStyleSheet dealloc]
+__ZN7WebCore4PairD0Ev
+__ZN7WebCore11ShadowValueD0Ev
+-[DOMHTMLElement innerHTML]
+__ZN7WebCore21HTMLFrameOwnerElement10willRemoveEv
+__ZN7WebCore10RenderView12removeWidgetEPNS_12RenderWidgetE
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
+__ZN3WTF9HashTableIPvSt4pairIS1_NS_6RefPtrIN3JSC8Bindings10RootObjectEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS1_EENS_14Pai
+__ZN7WebCore17HTMLObjectElement19removedFromDocumentEv
+-[DOMNode removeChild:]
+__ZN7WebCore14RenderTableRow29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore17HTMLObjectElementD0Ev
+__ZN7WebCore22HTMLPlugInImageElementD2Ev
+__ZN7WebCore17HTMLPlugInElementD2Ev
+__ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
+__ZN7WebCore11FrameLoader18setLocalLoadPolicyENS0_15LocalLoadPolicyE
+__ZN7WebCore18MainResourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader25receivedMainResourceErrorERKNS_13ResourceErrorEb
+__ZN7WebCore11FrameLoader4stopEv
+__ZNK7WebCore17ResourceErrorBase8lazyInitEv
+__ZN7WebCore13ResourceError16platformLazyInitEv
+__ZN7WebCore11FrameLoader31invalidateCurrentItemCachedPageEv
+__ZN7WebCore14DocumentLoader17mainReceivedErrorERKNS_13ResourceErrorEb
+__ZN7WebCore11FrameLoader25mainReceivedCompleteErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader20clearProvisionalLoadEv
+-[DOMNode finalize]
+-[WebScriptObject finalize]
+__ZN7WebCore13HTMLTokenizer26parseProcessingInstructionERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore9CSSParser24parseTransitionShorthandEb
+__ZN7WebCore9CSSParser22parseAnimationPropertyEv
+__ZN7WebCore9CSSParser17addAnimationValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
+__ZN7WebCore11FrameLoader10gotoAnchorERKNS_6StringE
+__ZN7WebCore8Document10findAnchorERKNS_6StringE
+__ZNK7WebCore17HTMLAnchorElement4nameEv
+__ZN7WebCore8Document12setCSSTargetEPNS_7ElementE
+__ZNK7WebCore13ContainerNode7getRectEv
+__ZNK7WebCore13ContainerNode18getUpperLeftCornerERNS_10FloatPointE
+__ZNK7WebCore13ContainerNode19getLowerRightCornerERNS_10FloatPointE
+__ZN7WebCore39jsElementPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node13querySelectorERKNS_6StringERi
+__ZN7WebCore9CSSParser13parseSelectorERKNS_6StringEPNS_8DocumentERNS_15CSSSelectorListE
+__ZN7WebCoreL32selectorNeedsNamespaceResolutionERKNS_15CSSSelectorListE
+__ZN7WebCoreL18forEachTagSelectorINS_39SelectorNeedsNamespaceResolutionFunctorEEEbRT_PNS_11CSSSelectorE
+__ZN7WebCore43jsDocumentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node16querySelectorAllERKNS_6StringERi
+__ZN7WebCore22createSelectorNodeListEPNS_4NodeERKNS_15CSSSelectorListE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker13checkSelectorEPNS_11CSSSelectorEPNS_7ElementE
+__ZNK7WebCore14StaticNodeList6lengthEv
+__ZNK7WebCore14StaticNodeList12itemWithNameERKNS_12AtomicStringE
+-[DOMHTMLElement innerText]
+__ZNK7WebCore7Element9innerTextEv
+-[DOMDocument createExpression:resolver:]
+__ZN7WebCore8Document16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN7WebCore5XPath12LocationPath15insertFirstStepEPNS0_4StepE
+__Z3kitPN7WebCore15XPathExpressionE
+-[DOMXPathExpression evaluate:type:inResult:]
+__Z4coreP14DOMXPathResult
+__Z3kitPN7WebCore11XPathResultE
+-[DOMXPathResult iterateNext]
+__ZN7WebCore11XPathResult11iterateNextERi
+-[WebCoreSharedBufferData finalize]
+-[DOMXPathExpression finalize]
+-[DOMXPathResult finalize]
+-[DOMNodeList finalize]
+__ZNK7WebCore13HitTestResult16absoluteImageURLEv
+__ZNK7WebCore13HitTestResult17isContentEditableEv
+__ZNK7WebCore13HitTestResult5imageEv
+__ZNK7WebCore13HitTestResult18titleDisplayStringEv
+__ZN7WebCore13displayStringERKNS_6StringEPKNS_4NodeE
+__ZNK7WebCore13HitTestResult11textContentEv
+__ZNK7WebCore13HitTestResult9imageRectEv
+__ZNK7WebCore13HitTestResult16altDisplayStringEv
+__ZNK7WebCore13HitTestResult10isLiveLinkEv
+__ZNK7WebCore17HTMLAnchorElement10isLiveLinkEv
+__ZN7WebCore11FrameLoader19requestFromDelegateERNS_15ResourceRequestERmRNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader29sendRemainingDelegateMessagesEmRKNS_16ResourceResponseEiRKNS_13ResourceErrorE
+__ZN7WebCore14StaticNodeListD0Ev
+__ZNK7WebCore16StyleCachedImage13errorOccurredEv
+__ZN7WebCore16RenderListMarker12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore14StaticNodeList4itemEj
+__ZN7WebCore28setJSHTMLAnchorElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement9setTargetERKNS_12AtomicStringE
+__ZN7WebCore15GraphicsContext15fillRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_RKNS_5ColorE
+__ZN7WebCore15GraphicsContext7addPathERKNS_4PathE
+__ZN7WebCore15GraphicsContext8fillPathEv
+__ZNK7WebCore15GraphicsContext8fillRuleEv
+__ZN7WebCore24JSHTMLElementConstructorD1Ev
+__ZN7WebCore24JSCharacterDataPrototypeD1Ev
+__ZN7WebCore15JSTextPrototypeD1Ev
+__ZN7WebCore17JSNodeConstructorD1Ev
+__ZN7WebCore20JSElementConstructorD1Ev
+__ZN7WebCore18JSEventConstructorD1Ev
+__ZN7WebCore28JSHTMLFormElementConstructorD1Ev
+__ZN7WebCore29JSHTMLInputElementConstructorD1Ev
+__ZN7WebCore30JSHTMLSelectElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTextAreaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLTextAreaElementPrototypeD1Ev
+__ZN7WebCore30JSCSSStyleDeclarationPrototypeD1Ev
+__ZN7WebCore15JSHTMLLIElementD1Ev
+__ZN7WebCore11FrameLoader20checkNewWindowPolicyERKNS_16NavigationActionERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateE
+__ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEPFvPvS3_S7_SA_bESB_
+__ZN7WebCore11FrameLoader28continueAfterNewWindowPolicyENS_12PolicyActionE
+__ZN7WebCore11FrameLoader36callContinueLoadAfterNewWindowPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS
+__ZN7WebCore11FrameLoader32continueLoadAfterNewWindowPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6Stri
+__ZN7WebCore11RenderStyle17accessTransitionsEv
+__ZN7WebCore16CSSStyleSelector20mapAnimationPropertyEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore24JSHTMLLIElementPrototypeD1Ev
+__ZN7WebCore29JSHTMLHeadingElementPrototypeD1Ev
+-[DOMRange finalize]
+__ZN7WebCore11FrameLoader47callContinueFragmentScrollAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormS
+__ZN7WebCore11FrameLoader43continueFragmentScrollAfterNavigationPolicyERKNS_15ResourceRequestEb
+__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
+__ZN7WebCore19ResourceRequestBase6setURLERKNS_4KURLE
+__ZN7WebCore11FrameLoader31addHistoryItemForFragmentScrollEv
+__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
+__ZN7WebCore11FrameLoader28updateHistoryForAnchorScrollEv
+__ZNK7WebCore6Editor7Command11isSupportedEv
+__ZN7WebCoreL9supportedEPNS_5FrameENS_19EditorCommandSourceE
+__ZNK7WebCore6Editor7Command5stateEPNS_5EventE
+__ZN7WebCoreL9stateNoneEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor7Command9isEnabledEPNS_5EventE
+__ZN7WebCoreL10enabledCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore6Editor11canDHTMLCutEv
+__ZN7WebCore6Editor16dispatchCPPEventERKNS_12AtomicStringENS_21ClipboardAccessPolicyE
+__ZN7WebCore6Editor19newGeneralClipboardENS_21ClipboardAccessPolicyE
+__ZN7WebCore14ClipboardEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9ClipboardEEE
+__ZN7WebCore14ClipboardEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9ClipboardEEE
+__ZN7WebCore9Clipboard15setAccessPolicyENS_21ClipboardAccessPolicyE
+__ZN7WebCore14ClipboardEventD0Ev
+__ZNK7WebCore6Editor6canCutEv
+__ZNK7WebCore6Editor7canCopyEv
+__ZN7WebCoreL29imageElementFromImageDocumentEPNS_8DocumentE
+__ZN7WebCoreL11enabledCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore6Editor12canDHTMLCopyEv
+__ZN7WebCore6Editor13canDHTMLPasteEv
+__ZNK7WebCore6Editor8canPasteEv
+__ZN7WebCoreL13enabledDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL7enabledEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL14stateUnderlineEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL10stateStyleEPNS_5FrameEiPKc
+__ZNK7WebCore6Editor17selectionHasStyleEPNS_19CSSStyleDeclarationE
+__ZN7WebCore26CSSMutableStyleDeclaration11makeMutableEv
+__ZNK7WebCore5Frame22selectionComputedStyleERPNS_4NodeE
+__ZNK7WebCore5Range20editingStartPositionEv
+__ZN7WebCoreL11updateStateEPNS_26CSSMutableStyleDeclarationEPNS_27CSSComputedStyleDeclarationERbRNS_8TriStateE
+__ZNK7WebCore26CSSMutableStyleDeclaration16getPropertyValueEi
+__ZN7WebCoreL27enabledInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZNK7WebCore4Node23isContentRichlyEditableEv
+__ZN7WebCoreL29supportedFromMenuOrKeyBindingEPNS_5FrameENS_19EditorCommandSourceE
+__ZN7WebCoreL16stateSuperscriptEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL14stateSubscriptEPNS_5FrameEPNS_5EventE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE15reserveCapacityEm
+__ZNK3WTF7HashMapIPN7WebCore9DOMWindowEPNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashT
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE6shrinkEm
+__ZN7WebCore16enclosingIntRectERK7_NSRect
+__ZN7WebCore7IntSizeC1ERK7_NSSize
+__ZN7WebCore7IntSizeC2ERK7_NSSize
+__ZThn4_N7WebCore8Document14removedLastRefEv
+__ZThn4_N7WebCore4TextD0Ev
+__ZThn56_NK7WebCore16HTMLStyleElement4typeEv
+__ZThn56_NK7WebCore16HTMLStyleElement5mediaEv
+__ZThn56_N7WebCore16HTMLStyleElement10setLoadingEb
+__ZThn56_NK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZThn56_NK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZThn64_NK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZThn64_NK7WebCore16HTMLInputElement11isTextFieldEv
+__ZThn12_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZThn64_NK7WebCore16HTMLInputElement12isAutofilledEv
+__ZN7WebCoreL12toFontWeightEi
+__ZThn64_NK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZThn64_NK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZL16acceptableChoicejj
+__ZThn64_NK7WebCore16HTMLInputElement5valueEv
+__ZN7WebCore7DataRefINS_20StyleFlexibleBoxDataEE6accessEv
+__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEj
+__ZThn64_NK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEj
+__ZThn64_NK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZThn44_NK7WebCore8Document10isDocumentEv
+__ZL12betterChoicejijiji
+__ZNK7WebCore7IntRectcv7_NSRectEv
+__ZThn64_NK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZThn64_N7WebCore16HTMLInputElement6selectEv
+__ZThn64_N7WebCore16HTMLInputElement14cacheSelectionEii
+__ZThn4_N7WebCore4AttrD0Ev
+__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_iEiS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerEiPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerEiS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZThn268_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZThn268_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZThn64_NK7WebCore16HTMLInputElement9isCheckedEv
+__ZThn64_NK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZN7WebCoreL13buttonMarginsEj
+__ZN3WTF9HashTableIPN7WebCore24OverlapTestRequestClientESt4pairIS3_NS1_7IntRectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EE
+__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxEiPFbPKS1_S5_EEvT_S8_T0_T1_
+__ZN7WebCore11RenderLayer25setHasHorizontalScrollbarEb
+__ZN7WebCore11RenderLayer23setHasVerticalScrollbarEb
+__ZN7WebCore11RenderLayer15createScrollbarENS_20ScrollbarOrientationE
+__ZN7WebCore11RenderLayer23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZNK7WebCore11RenderLayer8isActiveEv
+__ZN7WebCore11RenderLayer23hitTestOverflowControlsERNS_13HitTestResultE
+__ZN7WebCore18jsElementOffsetTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element9offsetTopEv
+__ZNK7WebCore20RenderBoxModelObject9offsetTopEv
+__ZNK7WebCore12RenderObject12offsetParentEv
+__ZN7WebCoreL18adjustForLocalZoomEiPNS_12RenderObjectE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8scrollToEii
+__ZN7WebCore9FrameView17setScrollPositionERKNS_8IntPointE
+__ZN7WebCore40jsHTMLFormElementPrototypeFunctionSubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17JSHTMLFormElement6submitEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15HTMLFormElement6submitEPNS_5EventEbbb
+__ZN7WebCore9FormState6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEERNS1_6VectorISt4pairINS_6StringES7_ELm0EEENS2_INS_5Frame
+__ZN7WebCore15HTMLFormElement14createFormDataERKNS_7CStringE
+__ZNK7WebCore15HTMLFormElement12dataEncodingEv
+__ZNK7WebCore15HTMLFormElement12isMailtoFormEv
+__ZNK7WebCore15FormDataBuilder12dataEncodingEPNS_8DocumentE
+__ZN7WebCore8FormData6createEv
+__ZN7WebCore12FormDataListC1ERKNS_12TextEncodingE
+__ZN7WebCore12FormDataListC2ERKNS_12TextEncodingE
+__ZN7WebCore16HTMLInputElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore12FormDataList12appendStringERKNS_6StringE
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE15reserveCapacityEm
+__ZN7WebCore7CStringC1EPKc
+__ZN7WebCore7CStringC2EPKc
+__ZN7WebCoreeqERKNS_7CStringES2_
+__ZN7WebCore15FormDataBuilder25addKeyValuePairAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
+__ZN7WebCore15FormDataBuilder22encodeStringAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringE
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE6shrinkEm
+__ZN7WebCore8FormData10appendDataEPKvm
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIcLm0EEC1ERKS1_
+__ZN3WTF6VectorIcLm0EEC2ERKS1_
+__ZN7WebCoreL26generateFormDataIdentifierEv
+__ZN7WebCore11FrameLoader10submitFormEPKcRKNS_6StringEN3WTF10PassRefPtrINS_8FormDataEEES5_S5_S5_bbNS7_INS_5EventEEENS7_INS_9For
+__ZN7WebCore8FormData13generateFilesEPNS_12ChromeClientE
+__ZN7WebCore19ResourceRequestBase11setHTTPBodyEN3WTF10PassRefPtrINS_8FormDataEEE
+__ZN7WebCore11FrameLoader22scheduleFormSubmissionERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
+__ZN7WebCore11FrameLoader15loadPostRequestERKNS_15ResourceRequestERKNS_6StringES6_bNS_13FrameLoadTypeEN3WTF10PassRefPtrINS_5Eve
+__ZN7WebCore11setHTTPBodyEP19NSMutableURLRequestN3WTF10PassRefPtrINS_8FormDataEEE
+__ZN7WebCore8FormData6createEPKvm
+__ZN3WTF10RefCountedIN7WebCore9FormStateEE5derefEv
+-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]
+__ZN7WebCore14ResourceLoader11didSendDataEPNS_14ResourceHandleEyy
+__ZN7WebCore14ResourceLoader11didSendDataEyy
+__ZN7WebCore8FormData28removeGeneratedFilesIfNeededEv
+__ZN7WebCore26setJSHTMLFormElementActionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setActionERKNS_6StringE
+__ZN7WebCore14PreloadScanner3endEv
+__ZN7WebCore9Scrollbar8setValueEi
+__ZN7WebCore9Scrollbar13setCurrentPosEf
+__ZNK7WebCore17ScrollbarThemeMac16buttonsPlacementEv
+__ZN7WebCore9Scrollbar19updateThumbPositionEv
+__ZN7WebCore11RenderLayer12valueChangedEPNS_9ScrollbarE
+__ZN7WebCore9FrameView13scheduleEventEN3WTF10PassRefPtrINS_5EventEEENS2_INS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC1ERKS4_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC2ERKS4_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE6shrinkEm
+__ZN7WebCore10HTMLParser24noframesCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore16HTMLInputElement13aboutToUnloadEv
+__ZN7WebCore12InputElement13aboutToUnloadERNS_16InputElementDataEPNS_8DocumentE
+__ZThn8_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZThn56_NK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZThn56_NK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZThn56_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore14jsNodeNodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSHTMLDocument14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSHTMLDocumentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore17HTMLPlugInElement17endTagRequirementEv
+__ZNK7WebCore17HTMLObjectElement11tagPriorityEv
+__ZN7WebCore17HTMLPlugInElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLObjectElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17HTMLObjectElement18updateDocNamedItemEv
+__ZN7WebCoreL16paramConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLParamElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLParamElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLParamElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLParamElement17endTagRequirementEv
+__ZNK7WebCore16HTMLParamElement11tagPriorityEv
+__ZN7WebCoreL16embedConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLEmbedElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLEmbedElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLEmbedElement16attributeChangedEPNS_9AttributeEb
+__ZNK7WebCore16HTMLEmbedElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLEmbedElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17jsDOMWindowFramesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore9FrameTree5childEj
+__ZN7WebCoreL17canAccessAncestorEPKNS_14SecurityOriginEPNS_5FrameE
+__ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCoreL27isObjectAncestorContainerOfEPNS_12RenderObjectES1_
+__ZNK7WebCore16HTMLEmbedElement17endTagRequirementEv
+__ZNK7WebCore16HTMLEmbedElement11tagPriorityEv
+__ZN7WebCore16HTMLEmbedElement20insertedIntoDocumentEv
+__ZN7WebCore16HTMLEmbedElement6attachEv
+__ZN7WebCore16HTMLEmbedElement12updateWidgetEv
+__ZN7WebCore17HTMLObjectElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore17HTMLObjectElement21finishParsingChildrenEv
+__ZN7WebCore9FrameView17addWidgetToUpdateEPNS_16RenderPartObjectE
+__ZN3WTF7HashSetIPN7WebCore16RenderPartObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE15reserveCapacityEm
+__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
+__ZNK7WebCore11RenderLayer16childrenClipRectEv
+__ZNK7WebCore10ScrollView16contentsToWindowERKNS_7IntRectE
+__ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
+__ZN7WebCore9FloatRectC1ERK7_NSRect
+__ZN7WebCore9FloatRectC2ERK7_NSRect
+__ZN7WebCore10FloatPointC1ERK8_NSPoint
+__ZN7WebCore10FloatPointC2ERK8_NSPoint
+__ZN7WebCore9FloatSizeC1ERK7_NSSize
+__ZN7WebCore9FloatSizeC2ERK7_NSSize
+__ZN7WebCore7IntRectC1ERKNS_9FloatRectE
+__ZN7WebCore7IntRectC2ERKNS_9FloatRectE
+__ZNK7WebCore9FrameView14windowClipRectEb
+__ZN7WebCore25PluginMainThreadScheduler9schedulerEv
+__ZN7WebCore25PluginMainThreadSchedulerC1Ev
+__ZN7WebCore25PluginMainThreadSchedulerC2Ev
+__ZN7WebCore25PluginMainThreadScheduler14registerPluginEP4_NPP
+__ZN3WTF7HashMapIP4_NPPNS_5DequeIN7WebCore25PluginMainThreadScheduler4CallEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENSA_IS7_EEE3
+__ZN7WebCore16ScriptController20windowScriptNPObjectEv
+__Z23_NPN_CreateScriptObjectP4_NPPPN3JSC8JSObjectEN3WTF10PassRefPtrINS1_8Bindings10RootObjectEEE
+__NPN_CreateObject
+__ZL10jsAllocateP4_NPPP7NPClass
+__NPN_RetainObject
+__NPN_Evaluate
+__ZN3JSC8Bindings22convertNPStringToUTF16EPK9_NPString
+__ZN7WebCore6String26fromUTF8WithLatin1FallbackEPKcm
+__ZN7WebCore6String8fromUTF8EPKcm
+__ZN3JSC8Bindings23convertValueToNPVariantEPNS_9ExecStateENS_7JSValueEP10_NPVariant
+__NPN_GetStringIdentifier
+__ZN7WebCore13IdentifierRep3getEPKc
+__ZN7WebCoreL19stringIdentifierMapEv
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPN7WebCore13IdentifierRepENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3add
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PN7WebCore13IdentifierRepEENS_18PairFirstExtractorISA_EENS_7StrHas
+__ZN7WebCoreL13identifierSetEv
+__ZN3WTF7HashSetIPN7WebCore13IdentifierRepENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocat
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloc
+__NPN_Invoke
+__ZN3JSC8Bindings26identifierFromNPIdentifierEPKc
+__ZL22getListFromVariantArgsPN3JSC9ExecStateEPK10_NPVariantjPNS_8Bindings10RootObjectERNS_20MarkedArgumentBufferE
+__ZN3JSC8Bindings14findRootObjectEPNS_14JSGlobalObjectE
+__NPN_ReleaseVariantValue
+__Z35NPN_InitializeVariantWithStringCopyP10_NPVariantPK9_NPString
+__NPN_ReleaseObject
+__NPN_DeallocateObject
+__ZL12jsDeallocateP8NPObject
+__ZN3JSC8Bindings10RootObject11gcUnprotectEPNS_8JSObjectE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3getERKS3_
+__ZN7WebCore14jsDOMWindowTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow3topEv
+__ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore26NetscapePlugInStreamLoaderC1EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore26NetscapePlugInStreamLoaderC2EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore14ResourceLoader19setShouldBufferDataEb
+__ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
+__ZNK3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6shrinkEm
+__ZThn28_NK7WebCore8DOMTimer18hasPendingActivityEv
+__ZN7WebCore5TimerINS_13HTMLTokenizerEE5firedEv
+__ZN7WebCore13HTMLTokenizer10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore26NetscapePlugInStreamLoader18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore26NetscapePlugInStreamLoader14didReceiveDataEPKcixb
+__ZN7WebCore26NetscapePlugInStreamLoader16didFinishLoadingEv
+__ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
+__ZN7WebCore26NetscapePlugInStreamLoader16releaseResourcesEv
+__ZN7WebCore26NetscapePlugInStreamLoaderD0Ev
+__ZN7WebCore18jsDOMWindowHistoryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow7historyEPN3JSC9ExecStateE
+__ZNK7WebCore9DOMWindow7historyEv
+__ZN7WebCore7HistoryC1EPNS_5FrameE
+__ZN7WebCore7HistoryC2EPNS_5FrameE
+__ZN7WebCore9JSHistory15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSHistoryC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7HistoryEEE
+__ZN7WebCore9JSHistoryC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7HistoryEEE
+__ZN7WebCore9JSHistory18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSHistory24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore7History5frameEv
+__ZN7WebCore15jsHistoryLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7History6lengthEv
+__ZN7WebCore11FrameLoader16getHistoryLengthEv
+__ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
+__ZN7WebCore18jsScreenColorDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10colorDepthEv
+__ZN7WebCore22jsDocumentCharacterSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNavigatorCookieEnabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator13cookieEnabledEv
+__ZN7WebCore14cookiesEnabledEPKNS_8DocumentE
+__ZN7WebCoreL29createHTMLTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLTitleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTitleElementEEE
+__ZN7WebCore18JSHTMLTitleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTitleElementEEE
+__ZN7WebCoreL29createHTMLParamElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLParamElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLParamElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLParamElementEEE
+__ZN7WebCore18JSHTMLParamElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLParamElementEEE
+__ZN7WebCoreL29createHTMLEmbedElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLEmbedElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLEmbedElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLEmbedElementEEE
+__ZN7WebCore18JSHTMLEmbedElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLEmbedElementEEE
+__ZN7WebCore19JSHTMLScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSHTMLBRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16ScriptController29createScriptInstanceForWidgetEPNS_6WidgetE
+__ZN7WebCore16ScriptController16createRootObjectEPv
+__ZN3WTF7HashMapIPvNS_6RefPtrIN3JSC8Bindings10RootObjectEEENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS9_IS6_EEE3setERKS1_RKS6_
+__ZN3JSC8Bindings9CInstanceC1EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings9CInstanceC2EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZNK3JSC8Bindings8Instance10rootObjectEv
+__ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
+__ZN3JSC16RuntimeObjectImpC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_8Bindings8InstanceEEE
+__ZN3JSC16RuntimeObjectImpC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_8Bindings8InstanceEEE
+__ZN3JSC8Bindings10RootObject16addRuntimeObjectEPNS_16RuntimeObjectImpE
+__ZN3WTF7HashSetIPN3JSC16RuntimeObjectImpENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN3JSC16RuntimeObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC8Bindings8Instance5beginEv
+__ZN3JSC8Bindings8Instance12virtualBeginEv
+__ZNK3JSC8Bindings9CInstance8getClassEv
+__ZN3JSC8Bindings6CClass11classForIsAEP7NPClass
+__ZNK3WTF7HashMapIP7NPClassPN3JSC8Bindings6CClassENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3getERKS2_
+__ZN3JSC8Bindings6CClassC1EP7NPClass
+__ZN3JSC8Bindings6CClassC2EP7NPClass
+__ZN3WTF7HashMapIP7NPClassPN3JSC8Bindings6CClassENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RKS6_
+__ZN3WTF9HashTableIP7NPClassSt4pairIS2_PN3JSC8Bindings6CClassEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS2_EENS_14PairHashTrait
+__ZNK3JSC8Bindings6CClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings5FieldENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS4
+__ZNK3JSC8Bindings6CClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings6MethodENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS
+__NPN_UTF8FromIdentifier
+__ZN3JSC8Bindings5Class14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings8Instance3endEv
+__ZN3JSC8Bindings8Instance10virtualEndEv
+__ZN3JSC8Bindings8Instance18getOwnPropertySlotEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN7WebCore18JSHTMLParamElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_16HTMLEmbedElementERKNS1_10IdentifierE
+__ZN7WebCore18JSHTMLEmbedElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement25renderWidgetForJSBindingsEv
+__ZN7WebCore13jsEventTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsEventTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12AtomicStringcvN3JSC7UStringEEv
+__ZN7WebCore8FormDataD1Ev
+__ZN7WebCore8FormDataD2Ev
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE6shrinkEm
+__ZN7WebCore21JSMouseEventPrototypeD1Ev
+__ZN7WebCore18JSUIEventPrototypeD1Ev
+__ZN7WebCore12CachedScriptD0Ev
+__ZN7WebCore17JSHTMLLinkElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLLinkElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement7setHrefERKNS_6StringE
+__ZThn4_N7WebCore7CommentD0Ev
+__ZN7WebCore10ScrollView4hideEv
+__ZN7WebCore6Widget4hideEv
+__ZThn4_N7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore11RenderLayer20setHasVisibleContentEb
+__ZN7WebCore24setJSHTMLDocumentBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument10setBgColorERKNS_6StringE
 __ZN7WebCore15HTMLBodyElement10setBgColorERKNS_6StringE
+__ZN7WebCore24setJSHTMLDocumentFgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument10setFgColorERKNS_6StringE
 __ZN7WebCore15HTMLBodyElement7setTextERKNS_6StringE
+__ZN7WebCore26setJSHTMLDocumentLinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument12setLinkColorERKNS_6StringE
 __ZNK7WebCore15HTMLBodyElement4linkEv
 __ZN7WebCore15HTMLBodyElement7setLinkERKNS_6StringE
+__ZN7WebCore27setJSHTMLDocumentVlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument13setVlinkColorERKNS_6StringE
 __ZNK7WebCore15HTMLBodyElement5vLinkEv
 __ZN7WebCore15HTMLBodyElement8setVLinkERKNS_6StringE
-__ZN7WebCore16HTMLFrameElementD1Ev
-__ZN7WebCore8Document18determineParseModeERKNS_6StringE
-__ZN7WebCore28processingInstructionHandlerEPvPKhS2_
-__ZN7WebCore12XMLTokenizer21processingInstructionEPKhS2_
-__ZN7WebCore8Document27createProcessingInstructionERKNS_6StringES3_Ri
-__ZN7WebCore21ProcessingInstructionC2EPNS_8DocumentERKNS_6StringES5_
-__ZN7WebCore21ProcessingInstruction15checkStyleSheetEv
-__ZN7WebCore15parseAttributesERKNS_6StringERb
-__ZN7WebCore31attributesStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S8_EEEENS_22HashTableConstIteratorIS3_S5_S7_S8_SD_SB_EERKT_
-__ZN7WebCore7Element14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore8Document10readyStateEv
-__ZN3KJS19jsStringOrUndefinedERKN7WebCore6StringE
-__ZThn52_N7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore21ProcessingInstruction15parseStyleSheetERKNS_6StringE
-__ZN7WebCore21ProcessingInstruction11sheetLoadedEv
-__ZNK7WebCore21ProcessingInstruction9isLoadingEv
-__ZNK7WebCore21ProcessingInstruction8nodeTypeEv
-__ZN7WebCore9Tokenizer35executeScriptsWaitingForStylesheetsEv
-__ZN7WebCore21ProcessingInstructionD1Ev
-__ZN7WebCore7Element9setPrefixERKNS_12AtomicStringERi
-__ZN7WebCore4Node14checkSetPrefixERKNS_12AtomicStringERi
-__ZN7WebCore13QualifiedName9setPrefixERKNS_12AtomicStringE
-__ZNK7WebCore21ProcessingInstruction18offsetInCharactersEv
-__ZNK7WebCore21ProcessingInstruction18maxCharacterOffsetEv
-__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIPtjELm0EE15reserveCapacityEm
-__ZN3WTF6VectorISt4pairIPtjELm0EE6shrinkEm
-__ZNK7WebCore7Element5titleEv
-__ZN3WTFeqIN7WebCore15FormDataElementELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZN3WTFeqIcLm0EEEbRKNS_6VectorIT_XT0_EEES5_
-__ZN7WebCore11asFileInputEPNS_4NodeE
-__ZN7WebCore14DragController13dragOperationEPNS_8DragDataE
-__ZNK7WebCore8DragData11containsURLEv
-__ZNK7WebCore8DragData5asURLEPNS_6StringE
-__ZNK3KJS7JSValue8toStringEPNS_9ExecStateE
-__ZN7WebCore10JSLocation18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore4KURL5queryEv
-__ZNK7WebCore16DeprecatedStringcvN3KJS7UStringEEv
-__ZN3KJS17staticValueGetterIN7WebCore10JSLocationEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSLocation16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16createPreWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLPreElementC1EPN3KJS8JSObjectEPNS_14HTMLPreElementE
-__ZN7WebCore16JSHTMLPreElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSHTMLPreElement9classInfoEv
-__ZN7WebCore12IconDatabase14removeAllIconsEv
-__ZN7WebCore12IconDatabase22removeAllIconsOnThreadEv
-__ZN7WebCore12IconDatabase27deleteAllPreparedStatementsEv
-__ZN7WebCore14SQLiteDatabase14clearAllTablesEv
-__ZN7WebCore15SQLiteStatement17returnTextResultsEiRN3WTF6VectorINS_6StringELm0EEE
-__ZN7WebCore14SQLiteDatabase9lastErrorEv
-_sqlite3_errcode
-_sqlite3DropTable
-_sqlite3NestedParse
-_sqlite3BtreeDropTable
-_clearDatabasePage
-_sqliteResetColumnNames
-_balance_shallower
-__ZN7WebCore14SQLiteDatabase16runVacuumCommandEv
-_sqlite3RunVacuum
-_execSql
-_codeAttach
-_attachFunc
-_sqlite3UnixTempFileName
-_sqlite3FindDb
-_execExecSql
-_sqlite3VtabOverloadFunction
-_likeFunc
-_patternCompare
-_sqlite3PagerTruncate
-_unixTruncate
-_sqlite3SchemaFree
-_sqlite3ResetInternalSchema
-__ZN7WebCore20createDatabaseTablesERNS_14SQLiteDatabaseE
-_sqlite3OpenMasterTable
-_sqlite3RefillIndex
-__ZNK7WebCore12IconDatabase12databasePathEv
-__ZN7WebCore12IconDatabase11setImportedEb
-__ZN7WebCore9CSSParser31createFloatingMediaQueryExpListEv
-__ZN7WebCore9CSSParser29sinkFloatingMediaQueryExpListEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore9CSSParser24createFloatingMediaQueryENS_10MediaQuery10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore10MediaQueryC2ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore9CSSParser15createMediaListEv
-__ZN7WebCore9CSSParser22sinkFloatingMediaQueryEPNS_10MediaQueryE
-__ZN7WebCore9MediaList16appendMediaQueryEPNS_10MediaQueryE
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser16createImportRuleERKNS_11ParseStringEPNS_9MediaListE
-__ZN7WebCore13CSSImportRuleC2EPNS_9StyleBaseERKNS_6StringEPNS_9MediaListE
-__ZN7WebCore13CSSImportRule18insertedIntoParentEv
-__ZN7WebCore13CSSStyleSheet9docLoaderEv
-__ZNK7WebCore7CSSRule16parentStyleSheetEv
-__ZN7WebCore9StyleBase7baseURLEv
-__ZN7WebCore13CSSImportRule12isImportRuleEv
-__ZNK7WebCore13CSSImportRule9isLoadingEv
-__ZN7WebCore19CachedCSSStyleSheet5errorEv
-__ZThn16_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore13CSSStyleSheetC2EPNS_7CSSRuleERKNS_6StringES5_
-__ZN7WebCore10StyleSheetC2EPNS_9StyleBaseERKNS_6StringE
-__ZN7WebCore9StyleBase11checkLoadedEv
-__ZN7WebCore9StyleBase11isStyleRuleEv
-__ZNK7WebCore19MediaQueryEvaluator14mediaTypeMatchERKNS_6StringE
-__ZN7WebCore15applyRestrictorENS_10MediaQuery10RestrictorEb
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE6shrinkEm
-__ZN7WebCore18createImageWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLImageElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLImageElementC1EPN3KJS8JSObjectEPNS_16HTMLImageElementE
-__ZNK7WebCore13HTMLLIElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLLIElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore4KURLC2ERKS0_RKNS_16DeprecatedStringE
-__ZN7WebCore16CSSStyleSelector19mapBackgroundRepeatEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector22mapBackgroundXPositionEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector22mapBackgroundYPositionEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZNK7WebCore10JSDocument8locationEPN3KJS9ExecStateE
-__ZNK7WebCore6Screen5widthEv
-__ZN7WebCore11screenDepthEPNS_6WidgetE
-__ZN3KJS29navigatorProtoFuncJavaEnabledEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS9Navigator9classInfoEv
-__ZN3KJS10PluginBaseC2EPNS_9ExecStateE
-__ZN3KJS10PluginBase26cachePluginDataIfNecessaryEv
-__ZNK7WebCore15PluginInfoStore11pluginCountEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14HTMLCollectionE
-__ZN7WebCore25JSHTMLCollectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLCollectionC1EPN3KJS8JSObjectEPNS_14HTMLCollectionE
-__ZN7WebCore17createBodyWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLBodyElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLBodyElementC1EPN3KJS8JSObjectEPNS_15HTMLBodyElementE
-__ZN7WebCore17JSHTMLBodyElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsEventTargetAddEventListenerEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore39retrieveEventTargetAndCorrespondingNodeEPN3KJS9ExecStateEPNS0_8JSObjectERPNS_4NodeERPNS_11EventTargetE
-__ZNK7WebCore17JSHTMLBodyElement9classInfoEv
-__ZNK3KJS7JSValue9toBooleanEPNS_9ExecStateE
-__ZThn36_N7WebCore15EventTargetNode16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCoreeqERKNS_23RegisteredEventListenerES2_
-__ZN7WebCore8Document6imagesEv
-__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSHTMLCollectionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSHTMLCollection18canGetItemsForNameEPN3KJS9ExecStateEPNS_14HTMLCollectionERKNS1_10IdentifierE
-__ZN7WebCore13getNamedItemsEPN3KJS9ExecStateEPNS_14HTMLCollectionERKNS0_10IdentifierE
-__ZNK7WebCore14HTMLCollection15updateNameCacheEv
-__ZN7WebCore16JSHTMLCollection10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK3KJS6Window11getListenerEPNS_9ExecStateERKN7WebCore12AtomicStringE
-__ZN7WebCore8Document26getHTMLWindowEventListenerERKNS_12AtomicStringE
-__ZN3KJS6Window11setListenerEPNS_9ExecStateERKN7WebCore12AtomicStringEPNS_7JSValueE
-__ZNK7WebCore6Screen10pixelDepthEv
-__ZNK7WebCore9DOMWindow10innerWidthEv
-__ZNK7WebCore9DOMWindow11innerHeightEv
-__ZNK7WebCore8Document21getElementByAccessKeyERKNS_6StringE
-__ZN3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3setERKS3_RKS5_
-_WebCoreTextFloatWidth
-__ZN7WebCore16labelConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLLabelElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLLabelElement11tagPriorityEv
-__ZN7WebCore13RenderListBoxC2EPNS_17HTMLSelectElementE
-__ZN7WebCore13RenderListBox8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore13RenderListBox15canHaveChildrenEv
-__ZN7WebCore13RenderListBox17updateFromElementEv
-__ZNK7WebCore13RenderListBox8numItemsEv
-__ZN7WebCore13RenderListBox14calcPrefWidthsEv
-__ZN7WebCore13RenderListBox6layoutEv
-__ZNK7WebCore13RenderListBox22verticalScrollbarWidthEv
-__ZN7WebCore13RenderListBox10calcHeightEv
-__ZNK7WebCore13RenderListBox10itemHeightEv
-__ZNK7WebCore13RenderListBox4sizeEv
-__ZNK7WebCore13RenderListBox15numVisibleItemsEv
-__ZNK7WebCore13RenderListBox14hasControlClipEv
-__ZNK7WebCore13RenderListBox16baselinePositionEbb
-__ZN7WebCore13RenderListBox11paintObjectERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13RenderListBox14paintScrollbarERNS_12RenderObject9PaintInfoE
-__ZNK7WebCore13RenderListBox15controlClipRectEii
-__ZN7WebCore13RenderListBox19paintItemBackgroundERNS_12RenderObject9PaintInfoEiii
-__ZN7WebCore13RenderListBox19itemBoundingBoxRectEiii
-__ZN7WebCore13RenderListBox19paintItemForegroundERNS_12RenderObject9PaintInfoEiii
-__ZN7WebCore15GraphicsContext12drawBidiTextERKNS_7TextRunERKNS_8IntPointE
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE21createBidiRunsForLineERKS1_S5_bb
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE9appendRunEv
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE10deleteRunsEv
-__ZN7WebCore9CSSParser15parseMediaQueryEPNS_9MediaListERKNS_6StringE
-__ZN7WebCore30JSHTMLTextAreaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore32JSHTMLTextAreaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase4nameEv
-__ZN7WebCore17JSHTMLHtmlElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore43jsDocumentPrototypeFunctionQuerySelectorAllEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node16querySelectorAllERKNS_6StringERi
-__ZN7WebCore9CSSParser9parseRuleEPNS_13CSSStyleSheetERKNS_6StringE
-__ZN7WebCore16SelectorNodeListC1EN3WTF10PassRefPtrINS_4NodeEEEPNS_11CSSSelectorE
-__ZN7WebCore13CSSStyleSheetD0Ev
-__ZNK7WebCore14StaticNodeList6lengthEv
-__ZN7WebCore5XPath10isAxisNameERKNS_6StringERNS0_4Step4AxisE
-__ZN7WebCore5XPath17setUpAxisNamesMapERN3WTF7HashMapINS_6StringENS0_4Step4AxisENS_10StringHashENS1_10HashTraitsIS3_EENS7_IS5_EEEE
-__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath4Step4AxisENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS1_6StringES7_NS_17HashMapTranslatorILb0ES4_ISJ_S7_ENS_18PairBaseHashTraitsINSD_ISJ_EESF_EESG_SB_EEEES4_INS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SB_EEEENS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EERKT_
-__ZN7WebCore5XPath12createFunNotEv
-__ZNK7WebCore5XPath6FunNot8evaluateEv
-__ZNK7WebCore5XPath4Step15primaryNodeTypeENS1_4AxisE
-__ZN7WebCore5XPath6FunNotD1Ev
-__ZN7WebCore5XPath14createFunCountEv
-__ZN7WebCore5XPath6Parser9lexNumberEv
-__ZN7WebCore5XPath6NumberC1Ed
-__ZN7WebCore5XPath9NumericOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath9NumericOp8evaluateEv
-__ZNK7WebCore5XPath8FunCount8evaluateEv
-__ZNK7WebCore5XPath6Number8evaluateEv
-__ZNK7WebCore5XPath5Value8toNumberEv
-__ZN7WebCore5XPath8FunCountD1Ev
-__ZN7WebCore8parseNthERKNS_6StringERiS3_
-__ZN7WebCore8matchNthEiii
-__ZN7WebCore11HTMLElement8childrenEv
-__ZN7WebCore5XPath17createFunPositionEv
-__ZNK7WebCore5XPath11FunPosition8evaluateEv
-__ZN7WebCore5XPath11FunPositionD1Ev
-__ZN7WebCore5XPath19createFunStartsWithEv
-__ZNK7WebCore5XPath13FunStartsWith8evaluateEv
-__ZN7WebCore5XPath13FunStartsWithD1Ev
-__ZN7WebCore5XPath21createFunStringLengthEv
-__ZN7WebCore5XPath18createFunSubstringEv
-__ZNK7WebCore5XPath12FunSubstring8evaluateEv
-__ZNK7WebCore5XPath15FunStringLength8evaluateEv
-__ZN7WebCore5XPath8FunRound5roundEd
-__ZN7WebCore5XPath12FunSubstringD1Ev
-__ZN7WebCore5XPath15FunStringLengthD1Ev
-__ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore11RenderStyle14getPseudoStyleENS0_8PseudoIdE
-__ZN7WebCore16CSSStyleSelector21pseudoStyleForElementENS_11RenderStyle8PseudoIdEPNS_7ElementEPS1_
-__ZN7WebCore11RenderStyle14addPseudoStyleEPS0_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_5XPath4Step4AxisEENS_18PairFirstExtractorIS9_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS8_EEEESF_EENS_18PairBaseHashTraitsINSE_INS2_6StringEEESG_EEE8derefAllERSI_
-__ZN7WebCore9CSSParser14createRuleListEv
-__ZN7WebCore11CSSRuleListC2Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE15reserveCapacityEm
-__ZN7WebCore11CSSRuleList6appendEPNS_7CSSRuleE
-__ZN7WebCore11CSSRuleList10insertRuleEPNS_7CSSRuleEj
-__ZN7WebCore9CSSParser15createMediaRuleEPNS_9MediaListEPNS_11CSSRuleListE
-__ZN7WebCore12CSSMediaRuleC2EPNS_9StyleBaseEPNS_9MediaListEPNS_11CSSRuleListE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE6shrinkEm
-__ZN7WebCore12CSSMediaRule11isMediaRuleEv
-__ZNK7WebCore14RenderThemeMac22adjustSearchFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18setSearchFieldSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac16searchFieldSizesEv
-__ZN7WebCore25HTMLTextFieldInnerElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore17RenderTextControl21createInnerBlockStyleEPNS_11RenderStyleE
-__ZN7WebCore35HTMLSearchFieldResultsButtonElementC2EPNS_8DocumentE
-__ZN7WebCore17RenderTextControl24createResultsButtonStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac32adjustSearchFieldDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18resultsButtonSizesEv
-__ZN7WebCore34HTMLSearchFieldCancelButtonElementC2EPNS_8DocumentE
-__ZN7WebCore17RenderTextControl23createCancelButtonStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac34adjustSearchFieldCancelButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac17cancelButtonSizesEv
-__ZN7WebCore11RenderStyleC2ERKS0_
-__ZN7WebCore17RenderTextControl28updateCancelButtonVisibilityEPNS_11RenderStyleE
-__ZN7WebCore21ContextMenuController16clearContextMenuEv
-__ZN7WebCore12EventHandler20sendContextMenuEventERKNS_18PlatformMouseEventE
-__ZN7WebCore21ContextMenuController22handleContextMenuEventEPNS_5EventE
-__ZN7WebCore11ContextMenuC2ERKNS_13HitTestResultE
-+[WebCoreMenuTarget sharedMenuTarget]
-__ZNK7WebCore11ContextMenu10controllerEv
--[WebCoreMenuTarget setMenuController:]
-__ZN7WebCore11ContextMenu8populateEv
-__ZN7WebCore26contextMenuItemTagOpenLinkEv
-__ZN7WebCore15ContextMenuItemC2ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
-__ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
-__ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
-__ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
-__ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
-__ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
-__ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
-__ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
-__ZN7WebCore36contextMenuItemTagLookUpInDictionaryEv
-__ZN7WebCore27contextMenuItemTagSearchWebEv
-__ZN7WebCore22contextMenuItemTagCopyEv
-__ZN7WebCore24contextMenuItemTagGoBackEv
-__ZN7WebCore27contextMenuItemTagGoForwardEv
-__ZN7WebCore22contextMenuItemTagStopEv
-__ZN7WebCore24contextMenuItemTagReloadEv
-__ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
-__ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
-__ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
-__ZN7WebCore31contextMenuItemTagLearnSpellingEv
-__ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
-__ZN7WebCore21contextMenuItemTagCutEv
-__ZN7WebCore23contextMenuItemTagPasteEv
-__ZNK7WebCore13HitTestResult17isContentEditableEv
-__ZN7WebCore11FrameLoader16canHandleRequestERKNS_15ResourceRequestE
-__ZN7WebCore11ContextMenu10appendItemERNS_15ContextMenuItemE
-__ZNK7WebCore11ContextMenu21checkOrEnableIfNeededERNS_15ContextMenuItemE
-__ZNK7WebCore15ContextMenuItem4typeEv
-__ZNK7WebCore15ContextMenuItem6actionEv
-__ZN7WebCore15ContextMenuItem10setCheckedEb
-__ZN7WebCore15ContextMenuItem10setEnabledEb
-__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
-__ZN7WebCore17setMenuItemTargetEP10NSMenuItem
-__ZN7WebCore13separatorItemEv
-__ZN7WebCore15ContextMenuItemD2Ev
-__ZNK7WebCore11ContextMenu19platformDescriptionEv
-__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
--[WebCoreAXObject accessibilityAttributeNames]
--[WebCoreAXObject isPasswordField]
-__Z22isPasswordFieldElementPN7WebCore4NodeE
--[WebCoreAXObject accessibilityAttributeValue:]
--[WebCoreAXObject isTextControl]
--[WebCoreAXObject accessibilityShouldUseUniqueId]
--[WebCoreMenuTarget validateMenuItem:]
-__ZN7WebCore15ContextMenuItemC2EP10NSMenuItem
-__ZNK7WebCore15ContextMenuItem7enabledEv
-__ZN7WebCore11ContextMenuD2Ev
-__ZNK7WebCore13HitTestResult18titleDisplayStringEv
-__ZNK7WebCore13HitTestResult11textContentEv
-__ZN7WebCore11FrameLoader29generatedMIMETypeForURLSchemeERKNS_6StringE
--[WebCoreFrameBridge selectionGranularity]
-__ZN7WebCore15BackForwardList12containsItemEPNS_11HistoryItemE
-__ZN7WebCore15HTMLFormElement7setNameERKNS_6StringE
-__ZN7WebCore15HTMLFormElement9setMethodERKNS_6StringE
-__ZN7WebCore15HTMLFormElement9setTargetERKNS_6StringE
-__ZN7WebCore14JSNamedNodeMap18canGetItemsForNameEPN3KJS9ExecStateEPNS_12NamedNodeMapERKNS1_10IdentifierE
-__ZN7WebCore14JSNamedNodeMap10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore11FrameLoader17stopForUserCancelEb
--[DOMElement(WebPrivate) isFocused]
-__ZN7WebCore14RenderThemeMac28paintSearchFieldCancelButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore16HTMLInputElement15addSearchResultEv
-__ZN7WebCore27RenderTextControlSingleLine15addSearchResultEv
-__ZN7WebCore16HTMLInputElement8onSearchEv
-__ZN7WebCore17RenderTextControl20stopSearchEventTimerEv
-__ZN7WebCore13CharacterData12setNodeValueERKNS_6StringERi
-__ZNK7WebCore9FrameTree20traverseNextWithWrapEb
-__ZN7WebCore14DragController11performDragEPNS_8DragDataE
-__ZN7WebCore14DragController12concludeDragEPNS_8DragDataENS_21DragDestinationActionE
-__ZNK7WebCore8Document16elementFromPointEii
-__ZNK7WebCore8DragData13containsColorEv
-__ZN7WebCore5Frame23visiblePositionForPointERKNS_8IntPointE
-__ZN7WebCore14DragController10dragIsMoveEPNS_19SelectionControllerEPNS_8DragDataE
-__ZNK7WebCore5Frame14paintDragCaretEPNS_15GraphicsContextERKNS_7IntRectE
-_filenameByFixingIllegalCharacters
-__ZN7WebCore13ImageDocument17windowSizeChangedEv
-__ZNK7WebCore13ImageDocument17imageFitsInWindowEv
-__ZN7WebCore13ImageDocument16resizeImageToFitEv
-__ZNK7WebCore13ImageDocument5scaleEv
-__ZNK7WebCore13ImageDocument15isImageDocumentEv
-__ZN7WebCore12zoomInCursorEv
-__ZN7WebCore18ImageEventListener11handleEventEPNS_5EventEb
+__ZN7WebCore22jsDocumentLastModifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document12lastModifiedEv
+__ZThn84_N7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore11RenderLayer25dirtyVisibleContentStatusEv
+__ZN7WebCore23jsHTMLInputElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore11FrameLoader22updateHistoryForReloadEv
+__ZN7WebCoreL29createHTMLTableElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLTableElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLTableElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTableElementEEE
+__ZN7WebCore18JSHTMLTableElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTableElementEEE
+__ZN7WebCoreL33createHTMLTableCellElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLTableCellElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLTableCellElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLTableCellElementEEE
+__ZN7WebCore22JSHTMLTableCellElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLTableCellElementEEE
+__ZN7WebCore44jsDOMWindowPrototypeFunctionGetComputedStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9toElementEN3JSC7JSValueE
+__ZNK7WebCore22JSHTMLTableCellElement9classInfoEv
+__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration18canGetItemsForNameEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationERKNS1_10IdentifierE
+__ZN7WebCore30JSCSSStyleDeclarationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore54jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZNK7WebCore21JSCSSStyleDeclaration9classInfoEv
+__ZN7WebCoreL9sizingBoxEPNS_12RenderObjectE
+__ZN7WebCore22JSHTMLTableCellElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHistoryPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSHistory3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSHistory9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore46jsElementPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21setJSHTMLElementTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement8setTitleERKNS_6StringE
+__ZN7WebCore20setJSNodeOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore15JSEventListener18virtualisAttributeEv
+__ZNK7WebCore11RenderTable14recalcSectionsEv
+__ZN7WebCore18RenderTableSection11recalcCellsEv
+__ZNK7WebCore18RenderTableSection10numColumnsEv
+__ZN7WebCore22JSHTMLTableCellElementD1Ev
+__ZN7WebCore18JSHTMLTableElementD1Ev
+__ZN7WebCore12JSMouseEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSUIEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13jsNodeOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onclickEv
+__ZNK7WebCore4Node25getAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore7History15disconnectFrameEv
+__ZNK7WebCore11JSDOMWindow9classInfoEv
+__ZNK7WebCore16JSDOMWindowShell9classNameEv
+__ZN7WebCore17jsDOMWindowLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6lengthEv
+__ZN7WebCoreL26createHTMLHRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLHRElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLHRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLHRElementEEE
+__ZN7WebCore15JSHTMLHRElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLHRElementEEE
+__ZN7WebCore15JSHTMLHRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsNodeNextSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsNodePrototypeFunctionInsertBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode12insertBeforeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore15JSHTMLLIElement9classInfoEv
+__ZN7WebCore9JSHistoryD1Ev
+__ZN7WebCore9JSHistoryD2Ev
+__ZN7WebCore15JSHTMLHRElementD1Ev
+__ZN7WebCore18JSHTMLStyleElementD1Ev
+__ZN7WebCore17JSHTMLLinkElementD1Ev
+__ZN7WebCore18JSHTMLTitleElementD1Ev
+__ZN7WebCore19jsNodeOwnerDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsHTMLElementTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAnchorElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLAnchorElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22setJSCharacterDataDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11FrameLoader6reloadEb
+__ZN7WebCore11FrameLoader33restoreScrollPositionAndViewStateEv
+__ZNK7WebCore9FrameView17wasScrolledByUserEv
+__ZNK7WebCore11HistoryItem11scrollPointEv
+__ZN7WebCore25JSHTMLPreElementPrototypeD1Ev
+__ZThn8_N7WebCore14HTMLPreElementD0Ev
+__ZN7WebCore17HTMLSelectElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore17HTMLSelectElement27menuListDefaultEventHandlerEPNS_5EventE
+__ZN7WebCore21JSCSSStyleDeclaration10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore21DeprecatedPtrListImpl9removeRefEPKvb
+__ZN7WebCore12RenderObject24repaintOverhangingFloatsEb
+__ZNK7WebCore16JSEventPrototype9classInfoEv
+__ZN7WebCore18jsEventReturnValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventTimeStampEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF12bitwise_castIldEET_T0_
+__ZN7WebCore17jsEventEventPhaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsEventSrcElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsEventClipboardDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7JSEvent13clipboardDataEPN3JSC9ExecStateE
+__ZNK7WebCore5Event16isClipboardEventEv
+__ZN7WebCore17jsEventCancelableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9DOMWindow11toDOMWindowEv
+__ZN7WebCore14jsEventBubblesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsEventCancelBubbleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventMOUSEOUTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventFOCUSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsEventCHANGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEMOVEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventAT_TARGETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsEventSELECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsEventBLUREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventKEYUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEDRAGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsEventBUBBLING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsEventMOUSEUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsEventCAPTURING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEOVEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventDBLCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsEventKEYDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventKEYPRESSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventDRAGDROPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsDOMWindowPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL26removePendingEventListenerERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerEE
+__ZNK3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE4findIPS3_EEmRKT_
+__ZN7WebCore17JSHTMLHtmlElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLHeadElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLMetaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLTitleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15JSHTMLBRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22jsHTMLUListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLUListElement4typeEv
+__ZN7WebCore27jsHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLDivElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLDivElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN7WebCore20HTMLFrameElementBase13canLazyAttachEv
+__ZN7WebCore27JSHTMLUListElementPrototypeD1Ev
+__ZN7WebCore24JSHTMLBRElementPrototypeD1Ev
+__ZN7WebCore28JSHTMLScriptElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLLinkElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLTitleElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLMetaElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLHeadElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLHtmlElementPrototypeD1Ev
+__ZThn8_N7WebCore18HTMLHeadingElementD0Ev
+__ZN7WebCore25JSHTMLDocumentConstructorD1Ev
+__ZThn8_N7WebCore13HTMLLIElementD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE15reserveCapacityEm
+__ZNK7WebCore16HTMLInputElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore20StringSourceProvider8getRangeEii
+__ZN7WebCore11CachedImage19httpStatusCodeErrorEv
+__ZNK7WebCore22HTMLFormControlElement16isMouseFocusableEv
+__ZNK7WebCore16HTMLInputElement17canStartSelectionEv
+__ZNK7WebCore12JSMouseEvent9classInfoEv
+__ZNK7WebCore21JSMouseEventPrototype9classInfoEv
+__ZNK7WebCore18JSUIEventPrototype9classInfoEv
+__ZN7WebCore20jsMouseEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsMouseEventToElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent9toElementEv
+__ZN7WebCore19jsMouseEventClientYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsMouseEventYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17MouseRelatedEvent1yEv
-__ZN7WebCore13ImageDocument12imageClickedEii
-__ZN7WebCore13ImageDocument16restoreImageSizeEv
-__ZN7WebCore13zoomOutCursorEv
-__ZN7WebCore11HistoryItem12setViewStateEP11objc_object
-__ZNK7WebCore11HistoryItem9viewStateEv
-__ZNK7WebCore9FrameTree24traversePreviousWithWrapEb
-__ZNK7WebCore9FrameTree13deepLastChildEv
-__ZN7WebCore12CachedScript5errorEv
-__ZN7WebCore14scaleDragImageEN3WTF9RetainPtrI7NSImageEENS_9FloatSizeE
-__ZN7WebCore13HTMLTokenizer11parseEntityERNS_15SegmentedStringERPtNS0_5StateERjbb
-__ZN7WebCore15SegmentedString15advanceSlowCaseERi
-__ZN7WebCore15fontConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLFontElementC2EPNS_8DocumentE
-__ZNK7WebCore15HTMLFontElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore15HTMLFontElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLFontElement26cssValueFromFontSizeNumberERKNS_6StringERi
-__ZN7WebCore13StyledElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore18NamedMappedAttrMap19parseClassAttributeERKNS_6StringE
-__ZN7WebCore10ClassNames19parseClassAttributeERKNS_6StringEb
-__ZNK7WebCore6String8foldCaseEv
-__ZN7WebCore10StringImpl8foldCaseEv
-__ZNK7WebCore15HTMLFontElement17endTagRequirementEv
-__ZNK7WebCore15HTMLFontElement11tagPriorityEv
-__ZNK7WebCore13StyledElement13getClassNamesEv
-__ZN3WTF10RefCountedIN7WebCore10FontFamilyEE5derefEv
-__ZN7WebCore12RenderInlineC2EPNS_4NodeE
-__ZN7WebCore12RenderInline8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderInline13requiresLayerEv
-__ZNK7WebCore12RenderInline12isInlineFlowEv
-__ZN7WebCore4Text14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10RenderTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore12RenderInline14addChildToFlowEPNS_12RenderObjectES2_
-__ZNK7WebCore12RenderInline14childrenInlineEv
-__ZN7WebCore10HTMLParser27nestedStyleCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser23allowNestedRedundantTagERKNS_12AtomicStringE
-__ZN7WebCore17anchorConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLAnchorElementC2EPNS_8DocumentE
-__ZN7WebCore17HTMLAnchorElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLAnchorElement17endTagRequirementEv
-__ZNK7WebCore17HTMLAnchorElement11tagPriorityEv
-__ZN7WebCore16checkPseudoStateEPNS_7ElementEb
-__ZN7WebCore16DeprecatedString7prependERKS0_
-__ZN7WebCore15historyContainsEPKtj
-+[WebCoreHistory historyProvider]
-__ZN7WebCore15StyleVisualDataC2ERKS0_
-__ZN7WebCore11RenderStyle15clearCursorListEv
-__ZN7WebCore10HTMLParser20formCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore15HTMLFormElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLFormElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore15HTMLFormElement17endTagRequirementEv
-__ZNK7WebCore15HTMLFormElement11tagPriorityEv
-__ZN7WebCore15HTMLFormElement20insertedIntoDocumentEv
-__ZN7WebCore15HTMLFormElement6attachEv
-__ZN7WebCore22CSSQuirkPrimitiveValue12isQuirkValueEv
-__ZN7WebCore16inputConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLInputElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore31HTMLFormControlElementWithStateC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore22HTMLGenericFormElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore15HTMLFormElement19registerFormElementEPNS_22HTMLGenericFormElementE
-__ZN7WebCore15HTMLFormElement19CheckedRadioButtons12removeButtonEPNS_22HTMLGenericFormElementE
-__ZNK7WebCore22HTMLGenericFormElement4nameEv
-__ZN7WebCore15HTMLFormElement19CheckedRadioButtons9addButtonEPNS_22HTMLGenericFormElementE
-__ZNK7WebCore22HTMLGenericFormElement13isRadioButtonEv
-__ZN7WebCore15HTMLFormElement16formElementIndexEPNS_22HTMLGenericFormElementE
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE15reserveCapacityEm
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore31HTMLFormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E3addIS4_PNS_24ListHashSetNodeAllocatorIS4_EENS_21ListHashSetTranslatorIS4_SB_EEEESt4pairINS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EEbERKT_RKT0_
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore16HTMLInputElement4initEv
-__ZNK7WebCore16HTMLInputElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLInputElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLInputElement4nameEv
-__ZNK7WebCore16HTMLInputElement13isRadioButtonEv
-__ZN7WebCore16HTMLInputElement12setInputTypeERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement32storesValueSeparateFromAttributeEv
-__ZN7WebCore16HTMLInputElement12recheckValueEv
-__ZNK7WebCore16HTMLInputElement5valueEv
-__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringEi
-__ZNK7WebCore16HTMLInputElement17endTagRequirementEv
-__ZNK7WebCore16HTMLInputElement11tagPriorityEv
-__ZN7WebCore22HTMLGenericFormElement16insertedIntoTreeEb
-__ZN7WebCore16HTMLInputElement6attachEv
-__ZN7WebCore22HTMLGenericFormElement6attachEv
-__ZN7WebCoregtERNS_11CSSRuleDataES1_
-__ZN7WebCore11CSSSelector11specificityEv
-__ZN7WebCore5themeEv
-__ZN7WebCore14RenderThemeMacC2Ev
--[WebCoreRenderThemeNotificationObserver initWithTheme:]
-__ZNK7WebCore14RenderThemeMac10systemFontEiRNS_15FontDescriptionE
-__ZN7WebCore11RenderStyle13setTextShadowEPNS_10ShadowDataEb
-__ZN7WebCore22StyleRareInheritedDataC2ERKS0_
-__ZN7WebCore7DataRefINS_25StyleRareNonInheritedDataEE6accessEv
-__ZN7WebCore25StyleRareNonInheritedDataC2ERKS0_
-__ZNK7WebCore22HTMLGenericFormElement9isControlEv
-__ZN7WebCore16HTMLInputElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore22StyleRareInheritedDataD2Ev
-__ZN7WebCore25StyleRareNonInheritedDataD2Ev
-__ZN7WebCore31HTMLFormControlElementWithState21finishParsingChildrenEv
-__ZNK7WebCore8Document26hasStateForNewFormElementsEv
-__ZN7WebCore15BackgroundLayeraSERKS0_
-__ZN7WebCore11RenderTheme11adjustStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementEbRKNS_10BorderDataERKNS_15BackgroundLayerERKNS_5ColorE
-__ZNK7WebCore14RenderThemeMac15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_15BackgroundLayerERKNS_5ColorE
-__ZNK7WebCore14RenderThemeMac20adjustTextFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore16HTMLInputElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore17RenderTextControlC2EPNS_4NodeEb
-__ZN7WebCore17RenderTextControl8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore17RenderTextControl15canHaveChildrenEv
-__ZN7WebCore17RenderTextControl17updateFromElementEv
-__ZN7WebCore17RenderTextControl21createSubtreeIfNeededEv
-__ZN7WebCore29HTMLTextFieldInnerTextElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore17RenderTextControl20createInnerTextStyleEPNS_11RenderStyleE
-__ZNK7WebCore22HTMLGenericFormElement17isReadOnlyControlEv
-__ZNK7WebCore22HTMLGenericFormElement8disabledEv
-__ZNK7WebCore4Font11lineSpacingEv
-__ZN7WebCore9FontCache11getFontDataERKNS_4FontERiPNS_12FontSelectorE
-__ZN7WebCore15CSSFontSelector11getFontDataERKNS_15FontDescriptionERKNS_12AtomicStringE
-__ZN7WebCore9FontCache25getCachedFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringEb
-__ZN7WebCore9FontCache12platformInitEv
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore9FontCache22createFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringE
-+[WebFontCache fontWithFamily:traits:size:]
-+[WebFontCache internalFontWithFamily:traits:size:]
-__Z16acceptableChoicejiji
-__ZN7WebCore16FontPlatformData7setFontEP6NSFont
-__ZN3WTF7HashMapIN7WebCore24FontPlatformDataCacheKeyEPNS1_16FontPlatformDataENS1_28FontPlatformDataCacheKeyHashENS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIS4_EEE3setERKS2_RKS4_
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E3addIS2_PNS1_16FontPlatformDataENS_17HashMapTranslatorILb1ES3_IS2_SG_ENS_18PairBaseHashTraitsIS9_NSA_ISG_EEEESC_S7_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZNK7WebCore14SimpleFontData9isLoadingEv
-__ZNK7WebCore11RenderBlock10lineHeightEbb
-__ZNK7WebCore10RenderFlow10lineHeightEbb
-__ZNK7WebCore12RenderObject14firstLineStyleEv
-__ZNK7WebCore12RenderObject10lineHeightEbb
-__ZNK7WebCore22HTMLGenericFormElement9isEnabledEv
-__ZNK7WebCore11RenderLayer13isTransparentEv
-__ZN7WebCore11RenderLayer17dirtyOverflowListEv
-__ZNK7WebCore17RenderTextControl11isTextFieldEv
-__ZN7WebCore9FrameView25scheduleRelayoutOfSubtreeEPNS_12RenderObjectE
-__ZN7WebCore17RenderTextControl17updatePlaceholderEv
-__ZN7WebCore17RenderTextControl4textEv
-__ZNK7WebCore17RenderTextControl10finishTextERN3WTF6VectorItLm0EEE
-__ZN7WebCore11HTMLElement12setInnerTextERKNS_6StringERi
-__ZNK7WebCore14HTMLDivElement17endTagRequirementEv
-__ZN7WebCore13StyledElement25removeMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore19DeprecatedValueListINS_11CSSPropertyEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore17CSSPrimitiveValue7cleanupEv
-__ZN7WebCore22HTMLGenericFormElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLInputElement7altTextEv
-__ZN7WebCore12RenderObject17updateFromElementEv
-__ZN7WebCore11RenderImage14resetAnimationEv
-__ZN7WebCore10HTMLParser22selectCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore17selectConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLSelectElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLSelectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore22HTMLGenericFormElement17endTagRequirementEv
-__ZNK7WebCore17HTMLSelectElement11tagPriorityEv
-__ZNK7WebCore7Element17isInputTypeHiddenEv
-__ZN7WebCore20StyleFlexibleBoxDataC2ERKS0_
-__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleE
-__ZNK7WebCore11RenderTheme15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_15BackgroundLayerERKNS_5ColorE
-__ZNK7WebCore15BackgroundLayereqERKS0_
-__ZNK7WebCore14RenderThemeMac19adjustMenuListStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18controlSizeForFontEPNS_11RenderStyleE
-__ZN7WebCore11RenderStyle11resetBorderEv
-__ZNK7WebCore14RenderThemeMac13setButtonSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac11buttonSizesEv
-__ZNK7WebCore14RenderThemeMac15setSizeFromFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac11sizeForFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEj
-__ZN7WebCore11RenderStyle12setBoxShadowEPNS_10ShadowDataEb
-__ZN7WebCore17HTMLSelectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderMenuListC2EPNS_17HTMLSelectElementE
-__ZN7WebCore14RenderMenuList8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderMenuList15canHaveChildrenEv
-__ZN7WebCore14RenderMenuList18updateOptionsWidthEv
-__ZN7WebCore14RenderMenuList17updateFromElementEv
-__ZNK7WebCore17HTMLSelectElement13selectedIndexEv
-__ZN7WebCore14RenderMenuList17setTextFromOptionEi
-__ZNK7WebCore17HTMLSelectElement17optionToListIndexEi
-__ZN7WebCore14RenderMenuList7setTextERKNS_6StringE
-__ZN7WebCore14RenderMenuList8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore14RenderMenuList16createInnerBlockEv
-__ZN7WebCore14RenderMenuList16adjustInnerStyleEv
-__ZNK7WebCore14RenderThemeMac24popupInternalPaddingLeftEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEj
-__ZNK7WebCore14RenderThemeMac25popupInternalPaddingRightEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac23popupInternalPaddingTopEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac26popupInternalPaddingBottomEPNS_11RenderStyleE
-__ZN7WebCore9PopupMenu29itemWritingDirectionIsNaturalEv
-__ZN7WebCore10StringImpl23defaultWritingDirectionEv
-__ZN7WebCore17HTMLSelectElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLSelectElement15childrenChangedEb
-__ZN7WebCore17HTMLSelectElement18setRecalcListItemsEv
-__ZN7WebCore17optionConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLOptionElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLOptionElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLOptionElement17endTagRequirementEv
-__ZNK7WebCore17HTMLOptionElement11tagPriorityEv
-__ZN7WebCore17HTMLOptionElement20insertedIntoDocumentEv
-__ZNK7WebCore17HTMLOptionElement9getSelectEv
-__ZN7WebCore17HTMLSelectElement17scrollToSelectionEv
-__ZN7WebCore17HTMLOptionElement6attachEv
-__ZNK7WebCore17HTMLOptionElement8disabledEv
-__ZN7WebCore17HTMLOptionElement14setRenderStyleEPNS_11RenderStyleE
-__ZN7WebCore17HTMLOptionElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLOptionElement15childrenChangedEb
-__ZNK7WebCore17HTMLOptionElement11renderStyleEv
-__ZN7WebCore11FrameLoader14didReceiveDataEPNS_14ResourceLoaderEPKcii
-__ZN7WebCore15ProgressTracker17incrementProgressEmPKci
-__ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
-__ZNK7WebCore11FrameLoader15firstLayoutDoneEv
-__ZN7WebCore11FrameLoader31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
-__ZN7WebCore19InspectorController23didReceiveContentLengthEPNS_14DocumentLoaderEmi
--[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
-__ZN7WebCore14ResourceLoader16didFinishLoadingEPNS_14ResourceHandleE
-__ZN7WebCore18MainResourceLoader16didFinishLoadingEv
-__ZN7WebCore11FrameLoader15finishedLoadingEv
-__ZNK7WebCore4Node14isDocumentNodeEv
-__ZN7WebCore21DeprecatedPtrListImpl4takeEv
-__ZNK7WebCore21DeprecatedPtrListImpl7currentEv
-__ZNK7WebCore17StyleSurroundDataeqERKS0_
-__ZN7WebCore17HTMLSelectElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore17HTMLSelectElement15recalcListItemsEb
-__ZNK7WebCore4Node19traverseNextSiblingEPKS0_
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE15reserveCapacityEm
-__ZN7WebCore17HTMLOptionElement16setSelectedStateEb
-__ZN7WebCore22HTMLGenericFormElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore19StyleBackgroundDataeqERKS0_
-__ZNK7WebCore25StyleRareNonInheritedDataeqERKS0_
-__ZN3WTFeqIN7WebCore20StyleDashboardRegionELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZNK7WebCore20StyleFlexibleBoxDataeqERKS0_
-__ZNK7WebCore25StyleRareNonInheritedData20shadowDataEquivalentERKS0_
-__ZNK7WebCore25StyleRareNonInheritedData24transitionDataEquivalentERKS0_
-__ZNK7WebCore22StyleRareInheritedDataeqERKS0_
-__ZNK7WebCore22StyleRareInheritedData20shadowDataEquivalentERKS0_
+__ZN7WebCore13jsMouseEventXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent1xEv
+__ZN7WebCore19jsMouseEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsMouseEventRelatedTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventClientXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventOffsetXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsMouseEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventOffsetYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMouseEventFromElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent11fromElementEv
+__ZN7WebCore19jsMouseEventScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsMouseEventDataTransferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent11isDragEventEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ClipboardE
+__ZN7WebCore18jsMouseEventButtonEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsUIEventPageYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsUIEventLayerYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent6layerYEv
+__ZN7WebCore14jsUIEventPageXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsUIEventCharCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent8charCodeEv
+__ZN7WebCore13jsUIEventViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsUIEventWhichEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent5whichEv
+__ZN7WebCore16jsUIEventKeyCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent7keyCodeEv
+__ZN7WebCore15jsUIEventDetailEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsUIEventLayerXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent6layerXEv
+__ZN7WebCore21JSMouseEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSUIEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLParagraphElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLParagraphElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29jsHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLOListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLOListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLOListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore8IntPointC1ERK8_NSPoint
+__ZN7WebCore8IntPointC2ERK8_NSPoint
+__ZN7WebCore11globalPointERK8_NSPointP8NSWindow
+__ZN7WebCore15flipScreenPointERK8_NSPointP8NSScreen
+__ZNK7WebCore8IntPointcv8_NSPointEv
+__ZN7WebCore17HTMLPlugInElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12EventHandler14currentNSEventEv
+__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler26passMouseDownEventToWidgetEPNS_6WidgetE
+__ZN7WebCoreL18lastEventIsMouseUpEv
+__ZN7WebCoreL18findViewInSubviewsEP6NSViewS1_
+__ZN7WebCore11FrameLoader13frameDetachedEv
+__ZN7WebCore17HTMLIFrameElement19removedFromDocumentEv
+__ZN7WebCore20HTMLFrameElementBase19removedFromDocumentEv
+__ZThn4_N7WebCore17HTMLIFrameElementD0Ev
+__ZN7WebCore10RenderView15pushLayoutStateEPNS_12RenderObjectE
+__ZN7WebCore11LayoutStateC1EPNS_12RenderObjectE
+__ZN7WebCore11LayoutStateC2EPNS_12RenderObjectE
+__ZN7WebCore11FrameLoader24checkCompletedTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore5Cache18revalidateResourceEPNS_14CachedResourceEPNS_9DocLoaderE
+__ZNK7WebCore14CachedResource20canUseCacheValidatorEv
+__ZNK7WebCore19CachedCSSStyleSheet8encodingEv
+__ZN7WebCore14CachedResource23setResourceToRevalidateEPS0_
+__ZN3WTF7HashSetIPN7WebCore24CachedResourceHandleBaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZNK7WebCore14CachedResource8encodingEv
+__ZN7WebCore5Cache21revalidationSucceededEPNS_14CachedResourceERKNS_16ResourceResponseE
+__ZN7WebCore14CachedResource34switchClientsToRevalidatedResourceEv
+__ZN3WTF9HashTableIPN7WebCore24CachedResourceHandleBaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE15reserveCapacityEm
+__ZN7WebCore14CachedResource25clearResourceToRevalidateEv
+__ZN7WebCore19JSHTMLObjectElementD1Ev
+__ZN7WebCore18JSHTMLParamElementD1Ev
+__ZN7WebCore18JSHTMLEmbedElementD1Ev
+__ZN3JSC16RuntimeObjectImpD1Ev
+__ZN3JSC16RuntimeObjectImpD2Ev
+__ZN3JSC8Bindings10RootObject19removeRuntimeObjectEPNS_16RuntimeObjectImpE
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN3JSC8Bindings9CInstanceD0Ev
+__ZN3JSC8Bindings8InstanceD2Ev
+__ZThn4_N7WebCore16HTMLImageElementD0Ev
+__ZNK7WebCore13KeyboardEvent8charCodeEv
+__ZNK7WebCore6String19characterStartingAtEj
+__ZN7WebCore10StringImpl19characterStartingAtEj
+__ZN7WebCoreL5equalERKNS_15CSSParserStringEPKc
+__ZN7WebCore18CSSParserValueList13deleteValueAtEj
+__ZNK7WebCore14CSSParserValue10isVariableEv
+__ZN7WebCore19setJSDOMWindowEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14PreloadScanner11emitCSSRuleEv
+__ZN3WTF6VectorItLm16EE6shrinkEm
+__ZN7WebCore24jsHTMLDocumentCompatModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12HTMLDocument10compatModeEv
+__ZN7WebCore25jsDocumentDocumentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn4_N7WebCore11HTMLElementD0Ev
+__ZThn64_NK7WebCore16HTMLInputElement4sizeEv
+__ZNK7WebCore15JSDOMWindowBase29crossDomainAccessErrorMessageEPKN3JSC14JSGlobalObjectE
+__ZN3WTF6VectorIcLm256EE14expandCapacityEm
+__ZN3WTF6VectorIcLm256EE15reserveCapacityEm
+__ZN7WebCore25printErrorMessageForFrameEPNS_5FrameERKNS_6StringE
+__ZNK7WebCore15JSDOMWindowBase17printErrorMessageERKNS_6StringE
+__ZN7WebCore26setJSHTMLScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement7setTypeERKNS_6StringE
+__ZN7WebCore21jsNavigatorProductSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase10productSubEv
+__ZN7WebCore17jsNavigatorVendorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase6vendorEv
+__ZN7WebCore18jsNavigatorProductEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase7productEv
+__ZThn56_N7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZNK7WebCore12RenderObject14isDescendantOfEPKS0_
+__ZN7WebCore7Element24cloneElementWithChildrenEv
+__ZN7WebCore13ContainerNode15cloneChildNodesEPS0_
+__ZN7WebCore4Text9cloneNodeEb
+__ZN7WebCore40jsDOMWindowPrototypeFunctionClearTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12clearTimeoutEi
+__ZN7WebCore16jsHTMLElementDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement3dirEv
+__ZN7WebCore17jsHTMLDocumentDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument3dirEv
+__ZN7WebCore25PluginMainThreadScheduler16unregisterPluginEP4_NPP
+__ZN7WebCore16HTMLParamElementD0Ev
+__ZN7WebCore16HTMLEmbedElementD0Ev
+__ZNK7WebCore16RunLoopTimerBase8isActiveEv
+__ZN7WebCore4Page6goBackEv
+__ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore11FrameLoader8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
+__ZN7WebCore11FrameLoader17recursiveGoToItemEPNS_11HistoryItemES2_NS_13FrameLoadTypeE
+__ZNK7WebCore11HistoryItem12isTargetItemEv
+__ZN7WebCore11FrameLoader8loadItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore11HistoryItem8formDataEv
+__ZNK7WebCore11FrameLoader13urlsMatchItemEPNS_11HistoryItemE
+__ZN7WebCore11FrameLoader33loadProvisionalItemFromCachedPageEv
+__ZN7WebCore14DocumentLoader18loadFromCachedPageEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN7WebCore11FrameLoader37updateHistoryForBackForwardNavigationEv
+__ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
+__ZN7WebCore11FrameLoader4openERNS_10CachedPageE
+__ZN7WebCore11FrameLoader4openERNS_11CachedFrameE
+__ZThn4_N7WebCore27TextControlInnerTextElementD0Ev
+__ZNK7WebCore21ScriptCachedFrameData9domWindowEv
+__ZN7WebCore5Frame12setDOMWindowEPNS_9DOMWindowE
+__ZN7WebCore11CachedFrame7restoreEv
+__ZN7WebCore21ScriptCachedFrameData7restoreEPNS_5FrameE
+__ZN7WebCore12EventHandler17setMousePressNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore22ScriptExecutionContext22resumeActiveDOMObjectsEv
+__ZN7WebCore8Document23documentDidBecomeActiveEv
+__ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
+__ZThn4_N7WebCore17HTMLAnchorElementD0Ev
+__ZThn4_N7WebCore20HTMLParagraphElementD0Ev
+__ZThn4_N7WebCore20HTMLTableCellElementD0Ev
+__ZThn4_N7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore18jsDOMWindowConsoleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7ConsoleE
+__ZN7WebCore9JSConsole15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSConsoleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ConsoleEEE
+__ZN7WebCore9JSConsoleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ConsoleEEE
+__ZN7WebCore9JSConsole18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSConsolePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsNodeAttributesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NamedNodeMapE
+__ZN7WebCore14JSNamedNodeMap15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSNamedNodeMapC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NamedNodeMapEEE
+__ZN7WebCore14JSNamedNodeMapC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NamedNodeMapEEE
+__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSNamedNodeMapPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap18canGetItemsForNameEPN3JSC9ExecStateEPNS_12NamedNodeMapERKNS1_10IdentifierE
+__ZN7WebCore17CSSInheritedValueD0Ev
+__ZThn4_N7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore14JSNamedNodeMapD1Ev
+__ZN7WebCore14JSNamedNodeMapD2Ev
+__ZN7WebCore25jsDOMWindowOnbeforeunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow14onbeforeunloadEv
+__ZN7WebCore28setJSDOMWindowOnbeforeunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow17setOnbeforeunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL34allowsPendingBeforeUnloadListenersEPNS_9DOMWindowE
+__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsMimeTypeArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13MimeTypeArray6lengthEv
+__ZNK7WebCore13MimeTypeArray13getPluginDataEv
+__ZN7WebCore19jsScreenAvailHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen11availHeightEv
+__ZN7WebCore19screenAvailableRectEPNS_6WidgetE
+__ZN7WebCore18jsScreenAvailWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10availWidthEv
+__ZThn4_N7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCoreL17buttonConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLButtonElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLButtonElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLButtonElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17HTMLButtonElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore12RenderButton24updateBeforeAfterContentENS_8PseudoIdE
+__ZN7WebCore22jsHTMLInputElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement14isEnumeratableEv
+__ZN7WebCore16HTMLEmbedElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLEmbedElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN7WebCore43jsNamedNodeMapPrototypeFunctionGetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSNamedNodeMap9classInfoEv
+__ZN7WebCore6JSAttr15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSAttrC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4AttrEEE
+__ZN7WebCore6JSAttrC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4AttrEEE
+__ZNK7WebCore10RenderText22containsOnlyWhitespaceEjj
+__ZNK7WebCore12RenderObject23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore17jsDOMWindowOpenerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6openerEv
+__ZN7WebCore15JSMimeTypeArrayD1Ev
+__ZN7WebCore15JSMimeTypeArrayD2Ev
+__ZN7WebCore15jsDocumentFormsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection18canGetItemsForNameEPN3JSC9ExecStateEPNS_14HTMLCollectionERKNS1_10IdentifierE
+__ZN7WebCoreL13getNamedItemsEPN3JSC9ExecStateEPNS_14HTMLCollectionERKNS0_10IdentifierE
+__ZNK7WebCore14HTMLCollection15updateNameCacheEv
+__ZN7WebCore16JSHTMLCollection10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore16HTMLInputElement26copyNonAttributePropertiesEPKNS_7ElementE
+__ZN7WebCore16JSDOMWindowShell16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore11JSDOMWindow16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore11JSDOMWindow22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore20JSDOMWindowPrototype9classInfoEv
+__ZN7WebCore9DOMWindow18canShowModalDialogEPKNS_5FrameE
+__ZNK7WebCore6Chrome11canRunModalEv
+__ZN7WebCore22jsHTMLInputElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement4typeEPN3JSC9ExecStateE
+__ZN3WTF10RefCountedIN7WebCore5XPath9ValueDataEE5derefEv
+__ZN7WebCoreL30createHTMLButtonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLButtonElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLButtonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLButtonElementEEE
+__ZN7WebCore19JSHTMLButtonElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLButtonElementEEE
+__ZN7WebCore19JSHTMLButtonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLButtonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLButtonElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore19JSHTMLButtonElement9classInfoEv
+__ZN7WebCoreL29createHTMLDListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLDListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLDListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLDListElementEEE
+__ZN7WebCore18JSHTMLDListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLDListElementEEE
+__ZN7WebCore21jsElementOffsetHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsElementOffsetLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element10offsetLeftEv
+__ZNK7WebCore20RenderBoxModelObject10offsetLeftEv
+__ZN7WebCore21jsElementOffsetParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element12offsetParentEv
+__ZN7WebCore18JSHTMLDListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLDListElement9classInfoEv
+__ZNK7WebCore15DynamicNodeList24itemBackwardsFromCurrentEPNS_4NodeEji
+__ZN7WebCore30jsDOMWindowDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSDocument14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore33setJSDOMWindowDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSDOMWindowEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12RenderInline5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL22getPositionOffsetValueEPNS_11RenderStyleEi
+__ZN7WebCore12RenderObject10moveLayersEPNS_11RenderLayerES2_
+__ZNK7WebCore8Document7baseURIEv
+__ZN7WebCore10JSLocation3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSLocation9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17setJSLocationHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHrefEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL17navigateIfAllowedEPN3JSC9ExecStateEPNS_5FrameERKNS_4KURLEbb
+__ZNK7WebCore17RenderFlexibleBox12avoidsFloatsEv
+__ZN7WebCore13HTMLTokenizer11stopParsingEv
+__ZN7WebCore11FrameLoader22tokenizerProcessedDataEv
+__ZN7WebCore18JSHTMLDListElementD1Ev
+__ZN7WebCore21jsNodePreviousSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsStyleSheetListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsStyleSheetTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsCSSStyleSheetCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSStyleRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsConsolePrototypeFunctionLogEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9JSConsole9classInfoEv
+__ZN7WebCore15ScriptCallStackC1EPN3JSC9ExecStateERKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallStackC2EPN3JSC9ExecStateERKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallFrameC1ERKN3JSC7UStringES4_iRKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallFrameC2ERKN3JSC7UStringES4_iRKNS1_7ArgListEj
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EEC2ERKS3_
+__ZN7WebCore15ScriptCallFrameD1Ev
+__ZN7WebCore15ScriptCallFrameD2Ev
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE6shrinkEm
+__ZN7WebCore11ScriptValueD1Ev
+__ZN7WebCore7Console3logEPNS_15ScriptCallStackE
+__ZN7WebCore7Console10addMessageENS_12MessageLevelEPNS_15ScriptCallStackEb
+__ZN7WebCore15ScriptCallStack2atEj
+__ZN7WebCoreL24getFirstArgumentAsStringEPN3JSC9ExecStateERKNS_15ScriptCallFrameERNS_6StringEb
+__ZNK7WebCore15ScriptCallFrame10argumentAtEj
+__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelEPNS_15ScriptCallStackE
+__ZN7WebCore15ScriptCallStackD1Ev
+__ZN7WebCore15ScriptCallStackD2Ev
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE6shrinkEm
+__ZNK7WebCore26CSSMutableStyleDeclaration14getCommonValueEPKii
+__ZNK7WebCore26CSSMutableStyleDeclaration18isPropertyImplicitEi
+__ZN7WebCore24jsHTMLImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6heightEb
+__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL30createHTMLOptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLOptionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLOptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLOptionElementEEE
+__ZN7WebCore19JSHTMLOptionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLOptionElementEEE
+__ZN7WebCore19JSHTMLOptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsHTMLAnchorElementSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement6searchEv
+__ZN7WebCore10JSLocation16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore10JSLocation22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore19JSLocationPrototype9classInfoEv
+__ZNK7WebCore21HTMLFrameOwnerElement15contentDocumentEv
+__ZN7WebCore17checkNodeSecurityEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore33setJSHTMLIFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase14setFrameBorderERKNS_6StringE
+__ZN7WebCore18JSHTMLDListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22reportCurrentExceptionEPN3JSC9ExecStateE
+__ZThn44_N7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZThn4_N7WebCore17HTMLScriptElementD0Ev
+__ZN7WebCore19jsDOMWindowOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onresizeEv
+__ZN7WebCore22setJSDOMWindowOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore19JSHTMLOptionElementD1Ev
+__ZN7WebCore15jsDocumentLinksEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document5linksEv
+__ZN7WebCore23jsHTMLAnchorElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9RenderBox36tryLayoutDoingPositionedMovementOnlyEv
+__ZThn4_N7WebCore18HTMLHeadingElementD0Ev
+__ZThn4_N7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore18jsDOMWindowOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onerrorEv
+__ZN7WebCore22jsHTMLEmbedElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSHTMLEmbedElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14DragController27mayStartDragAtEventLocationEPKNS_5FrameERKNS_8IntPointE
+__ZNK7WebCore12EventHandler22dragHysteresisExceededERKNS_8IntPointE
+__ZN7WebCore47jsElementPrototypeFunctionGetBoundingClientRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element21getBoundingClientRectEv
+__ZN7WebCore11RenderBlock13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE15reserveCapacityEm
+__ZN7WebCore10ClientRectC1ERKNS_7IntRectE
+__ZN7WebCore10ClientRectC2ERKNS_7IntRectE
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE6shrinkEm
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10ClientRectE
+__ZN7WebCore12JSClientRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSClientRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10ClientRectEEE
+__ZN7WebCore12JSClientRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10ClientRectEEE
+__ZN7WebCore12JSClientRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsClientRectLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsElementScrollLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element10scrollLeftEv
+__ZNK7WebCore9RenderBox10scrollLeftEv
+__ZNK7WebCore15HTMLBodyElement10scrollLeftEv
+__ZN7WebCoreL13adjustForZoomEiPNS_9FrameViewE
+__ZNK7WebCore5Frame10zoomFactorEv
+__ZN7WebCore15jsClientRectTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsElementScrollTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element9scrollTopEv
+__ZNK7WebCore9RenderBox9scrollTopEv
+__ZNK7WebCore15HTMLBodyElement9scrollTopEv
+__ZN7WebCore19jsElementClientLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element10clientLeftEv
+__ZN7WebCore18jsElementClientTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element9clientTopEv
+__ZNK7WebCore17JSHTMLHtmlElement9classInfoEv
+__ZN7WebCore40jsDocumentPrototypeFunctionCreateCommentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document13createCommentERKNS_6StringE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore9JSComment15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCommentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CommentEEE
+__ZN7WebCore9JSCommentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CommentEEE
+__ZNK7WebCore9JSComment9classInfoEv
+__ZN7WebCore42jsElementPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15jsNodeLastChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore19setJSDocumentDomainEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document9setDomainERKNS_6StringE
+__ZN7WebCore14SecurityOrigin16setDomainFromDOMERKNS_6StringE
+__ZN7WebCore16ScriptController20updateSecurityOriginEv
+__ZN7WebCore12JSClientRectD1Ev
+__ZN7WebCore12JSClientRectD2Ev
+__ZN7WebCore9JSCommentD1Ev
+__ZN7WebCore19jsDOMWindowOnunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onunloadEv
+__ZN7WebCore22setJSDOMWindowOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore38jsDocumentPrototypeFunctionExecCommandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore37valueToStringWithUndefinedOrNullCheckEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore8Document11execCommandERKNS_6StringEbS3_
+__ZN7WebCoreL7commandEPNS_8DocumentERKNS_6StringEb
+__ZN7WebCore6Editor7CommandC1Ev
+__ZN7WebCore6Editor7CommandC2Ev
+__ZNK7WebCore6Editor7Command7executeERKNS_6StringEPNS_5EventE
+__ZN7WebCore49jsDocumentPrototypeFunctionCreateDocumentFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSDocumentFragment15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSDocumentFragmentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DocumentFragmentEEE
+__ZN7WebCore18JSDocumentFragmentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DocumentFragmentEEE
+__ZN7WebCore18JSDocumentFragment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSDocumentFragmentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSDocumentFragment9classInfoEv
+__ZN7WebCore19setJSNodeOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18JSHTMLTableElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL36createHTMLTableSectionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore25JSHTMLTableSectionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLTableSectionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableSectionElementEEE
+__ZN7WebCore25JSHTMLTableSectionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableSectionElementEEE
+__ZN7WebCore25JSHTMLTableSectionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL32createHTMLTableRowElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTableRowElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTableRowElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableRowElementEEE
+__ZN7WebCore21JSHTMLTableRowElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableRowElementEEE
+__ZN7WebCore21JSHTMLTableRowElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSHTMLTableRowElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLTableRowElement9classInfoEv
+__ZN7WebCore46jsNodePrototypeFunctionCompareDocumentPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12RenderObject32handleDynamicFloatPositionChangeEv
+__ZN7WebCore11RenderBlock20childBecameNonInlineEPNS_12RenderObjectE
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE15reserveCapacityEm
+__ZN7WebCore22jsHTMLAnchorElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement3relEv
+__ZN7WebCore18JSDocumentFragmentD1Ev
+__ZN7WebCore21JSHTMLTableRowElementD1Ev
+__ZN7WebCore25JSHTMLTableSectionElementD1Ev
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE15reserveCapacityEm
+__ZNK7WebCore15FontDescription13lighterWeightEv
+__ZN7WebCore32jsDOMWindowPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow10allowPopUpEPNS_5FrameE
+__ZN7WebCore42jsNodePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15JSMimeTypeArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_13MimeTypeArrayERKNS1_10IdentifierE
+__ZN7WebCore13MimeTypeArray18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore15JSMimeTypeArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore13MimeTypeArray9namedItemERKNS_12AtomicStringE
+__ZN7WebCore8MimeTypeC1EN3WTF10PassRefPtrINS_10PluginDataEEEj
+__ZN7WebCore8MimeTypeC2EN3WTF10PassRefPtrINS_10PluginDataEEEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8MimeTypeE
+__ZN7WebCore10JSMimeType15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSMimeTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8MimeTypeEEE
+__ZN7WebCore10JSMimeTypeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8MimeTypeEEE
+__ZN7WebCore10JSMimeType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsMimeTypeEnabledPluginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType13enabledPluginEv
+__ZNK7WebCore18JSHTMLParamElement9classInfoEv
+__ZN7WebCore35jsNodePrototypeFunctionReplaceChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode12replaceChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_15CaseFoldingHashENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6expand
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6rehash
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E13alloc
+__ZN7WebCore20setJSNodeOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore19setJSNodeOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSNodeOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18jsNodeOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node12onmousewheelEv
+__ZN7WebCore20jsElementClientWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element11clientWidthEv
+__ZN7WebCore21jsElementClientHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Comment9cloneNodeEb
+__ZN7WebCore10JSMimeTypeD1Ev
+__ZN7WebCore10JSMimeTypeD2Ev
+__ZN7WebCore8MimeTypeD1Ev
+__ZN7WebCore8MimeTypeD2Ev
+__ZN7WebCore22jsDOMWindowPageXOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7scrollXEv
+__ZN7WebCore22jsDOMWindowPageYOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7scrollYEv
+__ZN7WebCore21jsElementScrollHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement12scrollHeightEv
+__ZNK7WebCore7Element12scrollHeightEv
+__ZNK7WebCore9RenderBox12scrollHeightEv
+__ZThn4_N7WebCore23TextControlInnerElementD0Ev
+__ZThn64_NK7WebCore16HTMLInputElement11placeholderEv
+__ZN7WebCore22JSHTMLTableCellElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore31jsNodeListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL21imgToimageConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZThn44_NK7WebCore8Document10virtualURLEv
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE6shrinkEm
+__ZN7WebCore32jsHTMLSelectElementSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn44_NK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZN7WebCore19CSSCursorImageValueC1ERKNS_6StringERKNS_8IntPointE
+__ZN7WebCore19CSSCursorImageValueC2ERKNS_6StringERKNS_8IntPointE
+__ZN7WebCore19CSSCursorImageValue23updateIfSVGCursorIsUsedEPNS_7ElementE
+__ZN7WebCore19CSSCursorImageValue11cachedImageEPNS_9DocLoaderE
+__ZN7WebCore11RenderStyle9addCursorEPNS_11CachedImageERKNS_8IntPointE
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE15reserveCapacityEm
+__ZThn8_N7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZThn8_N7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZThn8_N7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZThn8_N7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZThn8_N7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZThn8_N7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZThn8_N7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZThn44_N7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZThn44_N7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCoreL10cornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCoreL14modConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLModElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLModElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14HTMLModElement17endTagRequirementEv
+__ZNK7WebCore14HTMLModElement11tagPriorityEv
+__ZN7WebCore24jsHTMLIFrameElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement5widthEv
+__ZN7WebCore25jsHTMLIFrameElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement6heightEv
+__ZN7WebCore32jsHTMLIFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLFrameOwnerElement13contentWindowEv
+__ZN7WebCore39jsDOMWindowPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow11postMessageEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow11postMessageERKNS_6StringEPNS_11MessagePortES3_PS0_Ri
+__ZN7WebCore12MessageEventC1ERKNS_6StringES3_S3_N3WTF10PassRefPtrINS_9DOMWindowEEENS5_INS_11MessagePortEEE
+__ZN7WebCore12MessageEventC2ERKNS_6StringES3_S3_N3WTF10PassRefPtrINS_9DOMWindowEEENS5_INS_11MessagePortEEE
+__ZN7WebCore26jsHTMLSelectElementOptionsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement7optionsEv
+__ZN7WebCore21HTMLOptionsCollection6createEN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore21HTMLOptionsCollectionC1EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore21HTMLOptionsCollectionC2EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore23JSHTMLOptionsCollection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLCollectionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSHTMLOptionsCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLOptionsCollectionEEE
+__ZN7WebCore23JSHTMLOptionsCollectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLOptionsCollectionEEE
+__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSHTMLOptionsCollectionLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection9setLengthEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore21HTMLOptionsCollection9setLengthEjRi
+__ZN7WebCore17HTMLSelectElement9setLengthEjRi
+__ZNK7WebCore17HTMLSelectElement6lengthEv
+__ZThn4_N7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore25jsHTMLSelectElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsDOMWindowOptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6optionEPN3JSC9ExecStateE
+__ZN7WebCore19JSOptionConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore19JSOptionConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore28JSHTMLOptionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSOptionConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL26constructHTMLOptionElementEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore19JSOptionConstructor8documentEv
+__ZN7WebCore17HTMLOptionElement8setValueERKNS_6StringE
+__ZN7WebCore17HTMLOptionElement18setDefaultSelectedEb
+__ZN7WebCore17HTMLOptionElement11setSelectedEb
+__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection11indexSetterEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore17selectIndexSetterEPNS_17HTMLSelectElementEPN3JSC9ExecStateEjNS2_7JSValueE
+__ZN7WebCore19toHTMLOptionElementEN3JSC7JSValueE
+__ZNK7WebCore19JSHTMLOptionElement9classInfoEv
+__ZN7WebCore17HTMLSelectElement9setOptionEjPNS_17HTMLOptionElementERi
+__ZN7WebCore17HTMLSelectElement3addEPNS_11HTMLElementES2_Ri
+__ZN7WebCore19JSOptionConstructor4markEv
+__ZThn4_N7WebCore16HTMLInputElementD0Ev
+__ZN7WebCore23JSHTMLOptionsCollectionD1Ev
+__ZN7WebCore21HTMLOptionsCollectionD0Ev
+__ZN7WebCore19jsNodeOnselectstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node13onselectstartEv
+__ZN7WebCore22setJSNodeOnselectstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node16setOnselectstartEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore44jsHTMLDocumentPrototypeFunctionCaptureEventsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument13captureEventsEv
+__ZN7WebCore41jsDOMWindowPrototypeFunctionCaptureEventsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow13captureEventsEv
+__ZN7WebCore20setJSNodeOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18setJSNodeOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowScrollXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN3WTFeqIN7WebCore10CursorDataELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZN7WebCore17HTMLOptionElement10optionTextEv
-__ZNK7WebCore17HTMLOptionElement4textEv
-__ZNK7WebCore8Document25backslashAsCurrencySymbolEv
-__ZNK7WebCore6String18simplifyWhiteSpaceEv
-__ZN7WebCore10StringImpl18simplifyWhiteSpaceEv
-__ZN7WebCore12TextDocumentC2EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore12TextDocument15createTokenizerEv
-__ZN7WebCore13TextTokenizerC2EPNS_8DocumentE
-__ZN7WebCore13TextTokenizer5writeERKNS_15SegmentedStringEb
-__ZN7WebCore13TextTokenizer6finishEv
-__ZN7WebCore13TextTokenizerD1Ev
-__ZN7WebCore12EventHandler37selectClosestWordOrLinkFromMouseEventERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore9Selection27selectionFromContentsOfNodeEPNS_4NodeE
-__ZN7WebCore11RenderBlock20fillLeftSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
--[WebCoreMenuTarget forwardContextMenuAction:]
-__ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
-__ZN7WebCore14ResourceHandle12releaseProxyEv
-__ZNK7WebCore14ResourceHandle10connectionEv
-__ZN7WebCore15StringTruncator5widthERKNS_6StringERKNS_4FontEb
-__ZN7WebCore15BackForwardList11itemAtIndexEi
-__ZN7WebCore15BackForwardList16forwardListCountEv
+__ZN7WebCore16PostMessageTimer5firedEv
+__ZN7WebCore9DOMWindow21postMessageTimerFiredEPNS_16PostMessageTimerE
+__ZN7WebCore16PostMessageTimerD0Ev
+__ZN7WebCore12MessageEventD0Ev
+__ZN7WebCore22setJSElementScrollLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore7Element13setScrollLeftEi
-__ZN7WebCore12RenderObject13setScrollLeftEi
-__ZN3KJS6Plugin11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS54jsXMLHttpRequestPrototypeFunctionGetAllResponseHeadersEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK7WebCore14XMLHttpRequest21getAllResponseHeadersERi
-__ZNK7WebCore20ResourceResponseBase16httpHeaderFieldsEv
-__ZN7WebCore18normalErrorHandlerEPvPKcz
-__ZN7WebCore12XMLTokenizer5errorENS0_9ErrorTypeEPKcPc
-__ZNK7WebCore12XMLTokenizer12columnNumberEv
-__ZNK7WebCore12XMLTokenizer10lineNumberEv
-__ZN7WebCore12XMLTokenizer11handleErrorENS0_9ErrorTypeEPKcii
-__ZN7WebCore12XMLTokenizer23insertErrorMessageBlockEv
-__ZN7WebCore21createTableColWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLTableColElementC1EPN3KJS8JSObjectEPNS_19HTMLTableColElementE
-__ZN7WebCore21JSHTMLTableColElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLTableColElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore16HTMLTableElement5tHeadEv
-__ZN3KJS17staticValueGetterIN7WebCore25JSHTMLTableSectionElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSHTMLTableSectionElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSHTMLTableSectionElement4implEv
-__ZN7WebCore23HTMLTableSectionElement4rowsEv
-__ZN7WebCore19HTMLTableRowElement5cellsEv
-__ZN7WebCore14RenderTableCol27absoluteClippedOverflowRectEv
-__ZN7WebCore14commentHandlerEPvPKh
-__ZN7WebCore12XMLTokenizer7commentEPKh
-__ZNK7WebCore22JSHTMLParagraphElement9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement4hashEv
-__ZN7WebCoreplEcRKNS_16DeprecatedStringE
-__ZNK7WebCore17CSSInheritedValue7cssTextEv
-__ZN7WebCore17appletConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLAppletElementC2EPNS_8DocumentE
+__ZN7WebCore9RenderBox13setScrollLeftEi
+__ZN7WebCore18jsDOMWindowScrollYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSXMLHttpRequestOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSXMLHttpRequestOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore9FloatRectcv7_NSRectEv
+__ZN7WebCore23jsDOMWindowFrameElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12frameElementEv
+__ZN7WebCore22jsHTMLScriptElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement3srcEv
+__ZNK7WebCore27XMLHttpRequestProgressEvent29isXMLHttpRequestProgressEventEv
+__ZN7WebCore15getDOMStructureINS_29JSXMLHttpRequestProgressEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSXMLHttpRequestProgressEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSProgressEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSXMLHttpRequestProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27XMLHttpRequestProgressEventEEE
+__ZN7WebCore29JSXMLHttpRequestProgressEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27XMLHttpRequestProgressEventEEE
+__ZN7WebCore35setJSHTMLSelectElementSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9JSComment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLTableElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLTableElement9classInfoEv
+__ZN7WebCore34JSHTMLTableSectionElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSHTMLTableSectionElement9classInfoEv
+__ZN7WebCore28JSHTMLSelectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSHTMLSelectElement9classInfoEv
+__ZNK7WebCore18JSHTMLEmbedElement9classInfoEv
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_39jsDOMWindowPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS1_8JSObject
+__ZN7WebCore18JSHTMLStyleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLStyleElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement7setTypeERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLElementInnerTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSCSSStyleDeclarationCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16jsNodeOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10onmouseoutEv
+__ZN7WebCore26setJSHTMLIFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase7setNameERKNS_6StringE
+__ZN7WebCore31setJSHTMLIFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase12setScrollingERKNS_6StringE
+__ZNK7WebCore12RenderInline30relativePositionedInlineOffsetEPKNS_9RenderBoxE
+__ZNK7WebCore12RenderInline9offsetTopEv
+__ZNK7WebCore12RenderInline10offsetLeftEv
+__ZN7WebCore16FixedTableLayoutC1EPNS_11RenderTableE
+__ZN7WebCore16FixedTableLayoutC2EPNS_11RenderTableE
+__ZN7WebCore16FixedTableLayout14calcPrefWidthsERiS1_
+__ZN7WebCore16FixedTableLayout14calcWidthArrayEi
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE4fillERKS2_m
+__ZSt4fillIPN7WebCore6LengthES1_EvT_S3_RKT0_
+__ZN7WebCore16FixedTableLayout6layoutEv
+__ZN7WebCore29JSXMLHttpRequestProgressEventD1Ev
+__ZThn268_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore23jsHTMLImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5widthEb
+__ZN7WebCore22jsHTMLParamElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLParamElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsDOMWindowDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21ApplicationCacheGroup27fallbackCacheForMainRequestERKNS_15ResourceRequestEPNS_14DocumentLoaderE
+__ZN7WebCore23ApplicationCacheStorage24fallbackCacheGroupForURLERKNS_4KURLE
+__ZNK7WebCore11FrameLoader23isHostedByObjectElementEv
+__ZN7WebCore11FrameLoader21handleFallbackContentEv
+__ZN7WebCoreL12radioMarginsEj
+__ZN7WebCore5Image12supportsTypeERKNS_6StringE
+__ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKNS_6StringE
+__ZN7WebCore13ImageDocumentC1EPNS_5FrameE
+__ZN7WebCore13ImageDocumentC2EPNS_5FrameE
+__ZNK7WebCore13ImageDocument17shouldShrinkToFitEv
+__ZN7WebCore13ImageDocument15createTokenizerEv
+__ZNK7WebCore14ImageTokenizer12wantsRawDataEv
+__ZN7WebCore14ImageTokenizer12writeRawDataEPKci
+__ZN7WebCore13ImageDocument11cachedImageEv
+__ZN7WebCore13ImageDocument23createDocumentStructureEv
+__ZNK7WebCore14DocumentLoader16mainResourceDataEv
+__ZN7WebCore13ImageDocument12imageChangedEv
+__ZN7WebCore14ImageTokenizer6finishEv
+__ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
+__ZNK7WebCore4KURL17lastPathComponentEv
+__ZN7WebCore10imageTitleERKNS_6StringERKNS_7IntSizeE
+__ZN7WebCore14ImageTokenizerD0Ev
+__ZN7WebCore20jsNamedNodeMapLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore12NamedNodeMap4itemEj
+__ZN7WebCore6JSAttr18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10jsAttrNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsAttrValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23jsHTMLIFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase4nameEv
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore17jsHTMLElementLangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement4langEv
+__ZN7WebCore20jsHTMLLinkElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement3relEv
+__ZN7WebCore11RenderTable16overflowClipRectEii
+__ZN7WebCore6JSAttrD1Ev
+__ZN7WebCore40jsDocumentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19jsCharacterDataDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsHTMLMetaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement4nameEv
+__ZN7WebCore21jsHTMLFormElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement4nameEv
+__ZN7WebCore16JSDOMWindowShell15unwrappedObjectEv
+__ZNK3JSC14JSGlobalObject14isGlobalObjectEv
+__ZN7WebCore16HTMLEmbedElement13canLazyAttachEv
+__ZN7WebCore18MainResourceLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18MainResourceLoader13receivedErrorERKNS_13ResourceErrorE
+__ZN7WebCore23setJSHTMLLinkElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement6setRelERKNS_6StringE
+__ZN7WebCore24setJSHTMLLinkElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLLinkElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement8setMediaERKNS_6StringE
+__ZN7WebCore27setJSHTMLIFrameElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement8setWidthERKNS_6StringE
+__ZN7WebCore28setJSHTMLIFrameElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement9setHeightERKNS_6StringE
+__ZN7WebCore33setJSHTMLIFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase14setMarginWidthERKNS_6StringE
+__ZN7WebCore34setJSHTMLIFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase15setMarginHeightERKNS_6StringE
+__ZThn4_N7WebCore15HTMLHtmlElementD0Ev
+__ZN7WebCore11FrameLoader15didExplicitOpenEv
+__ZN7WebCore36jsHTMLDocumentPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26setJSHTMLObjectElementDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement7setDataERKNS_6StringE
+__ZN7WebCore26setJSHTMLObjectElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement7setTypeERKNS_6StringE
+__ZN7WebCore18JSHTMLParamElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLParamElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement7setNameERKNS_6StringE
+__ZN7WebCore26setJSHTMLParamElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement8setValueERKNS_6StringE
+__ZN7WebCore27RenderTextControlInnerBlock16positionForPointERKNS_8IntPointE
+__ZN7WebCore5Frame27doTextFieldCommandFromEventEPNS_7ElementEPNS_13KeyboardEventE
+__ZNK7WebCore23BeforeTextInsertedEvent25isBeforeTextInsertedEventEv
+__ZN7WebCore12InputElement29handleBeforeTextInsertedEventERNS_16InputElementDataEPNS_8DocumentEPNS_5EventE
+__ZN7WebCoreL19numGraphemeClustersEPNS_10StringImplE
+__ZN7WebCore20CompositeEditCommand10appendNodeEN3WTF10PassRefPtrINS_4NodeEEENS2_INS_7ElementEEE
+__ZN7WebCore17AppendNodeCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore17AppendNodeCommandC2EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore17AppendNodeCommand7doApplyEv
+__ZN7WebCore27RenderTextControlSingleLine17subtreeHasChangedEv
+__ZN7WebCore17RenderTextControl17subtreeHasChangedEv
+__ZThn64_N7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZN7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZN7WebCore12InputElement20setValueFromRendererERNS_16InputElementDataEPNS_8DocumentERKNS_6StringE
+__ZThn64_NK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZNK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZN7WebCore5Frame24textFieldDidBeginEditingEPNS_7ElementE
+-[DOMHTMLInputElement value]
+__ZN7WebCore5Frame24textDidChangeInTextFieldEPNS_7ElementE
+-[DOMHTMLInputElement form]
+__Z3kitPN7WebCore15HTMLFormElementE
+-[DOMHTMLFormElement action]
+__ZNK7WebCore15HTMLFormElement6actionEv
+-[DOMHTMLInputElement(FormPromptAdditions) _isEdited]
+-[DOMHTMLInputElement disabled]
+__ZN7WebCore5Frame25matchLabelsAgainstElementEP7NSArrayPNS_7ElementE
+__ZN7WebCore7replaceERNS_6StringERKNS_17RegularExpressionERKS0_
+__ZN7WebCore17RegularExpressionD1Ev
+__ZN7WebCore17RegularExpressionD2Ev
+__ZN7WebCore17RegularExpression7PrivateD1Ev
+__ZN7WebCore17RegularExpression7PrivateD2Ev
+__ZN7WebCoreL15regExpForLabelsEP7NSArray
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE15reserveCapacityEm
+__ZN7WebCore5Frame28searchForLabelsBeforeElementEP7NSArrayPNS_7ElementE
+__ZNK7WebCore17RegularExpression9searchRevERKNS_6StringE
+__ZNK7WebCore17RegularExpression13matchedLengthEv
+__ZNK7WebCore6Editor7Command7executeEPNS_5EventE
+__ZN7WebCoreL21enabledInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL20executeInsertNewlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL11targetFrameEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor13canEditRichlyEv
+__ZN7WebCore22HTMLFormControlElement8onChangeEv
+__ZN7WebCore15HTMLFormElement11submitClickEPNS_5EventE
+__ZNK7WebCore16HTMLInputElement24isSuccessfulSubmitButtonEv
+__ZN7WebCore4Node22dispatchSimulatedClickEN3WTF10PassRefPtrINS_5EventEEEbb
+__ZN7WebCore4Node27dispatchSimulatedMouseEventERKNS_12AtomicStringEN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore15HTMLFormElement13prepareSubmitEPNS_5EventE
+__ZNK7WebCore16HTMLInputElement17isActivatedSubmitEv
+-[DOMDocument URL]
+__ZN7WebCore27runtimeObjectPropertyGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings6MethodENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3setEPS4
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings6MethodEENS_18PairFirstExtractorISA_EENS_7StrHashIS5
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE6shrinkEm
+__ZN3JSC16RuntimeObjectImp12methodGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC13RuntimeMethodC1EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
+__ZN3JSC13RuntimeMethodC2EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EEC1ERKS5_
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EEC2ERKS5_
+__ZN3JSC13RuntimeMethod11getCallDataERNS_8CallDataE
+__ZN3JSCL17callRuntimeMethodEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN7WebCore18JSHTMLEmbedElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore19runtimeObjectGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3JSC16RuntimeObjectImp9classInfoEv
+__ZN3JSC8Bindings9CInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZN3JSC8Bindings9CInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
+__ZN3JSC8BindingsL21globalExceptionStringEv
+__ZN3JSC8Bindings23convertNPVariantToValueEPNS_9ExecStateEPK10_NPVariantPNS0_10RootObjectE
+__ZN3WTF6VectorI10_NPVariantLm8EE6shrinkEm
+__ZN7WebCore18JSHTMLEmbedElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLLabelElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLTableElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25JSHTMLTableSectionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21JSHTMLTableRowElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN3JSC16RuntimeObjectImp10invalidateEv
+__ZN7WebCore17AppendNodeCommandD0Ev
+__ZN7WebCore13MimeTypeArrayD1Ev
+__ZThn4_N7WebCore11EditingTextD0Ev
+__ZN3JSC13RuntimeMethodD1Ev
+__ZN7WebCore15HTMLLinkElement19removedFromDocumentEv
+__ZN7WebCore16HTMLEmbedElement19removedFromDocumentEv
+__ZThn4_N7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore21JSClientRectPrototypeD1Ev
+__ZN7WebCore24JSMimeTypeArrayPrototypeD1Ev
+__ZN7WebCore18JSHistoryPrototypeD1Ev
+__ZN7WebCore27JSHTMLStyleElementPrototypeD1Ev
+__ZThn4_N7WebCore16HTMLUListElementD0Ev
+__ZN7WebCore28JSHTMLObjectElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLParamElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLEmbedElementPrototypeD1Ev
+__ZN7WebCore31JSHTMLParagraphElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLLabelElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLTableElementPrototypeD1Ev
+__ZN7WebCore34JSHTMLTableSectionElementPrototypeD1Ev
+__ZN7WebCore30JSHTMLTableRowElementPrototypeD1Ev
+__ZN7WebCore31JSHTMLTableCellElementPrototypeD1Ev
+__ZN7WebCore16HTMLLabelElement9setActiveEbb
+__ZN7WebCore16HTMLLabelElement10setHoveredEb
+__ZN7WebCore16HTMLLabelElement20correspondingControlEv
+__ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
+__ZThn4_N7WebCore17HTMLObjectElementD0Ev
+__ZN7WebCore19JSHTMLOptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15PurgeableBufferD1Ev
+__ZN7WebCore15PurgeableBufferD2Ev
+__ZN7WebCore30JSHTMLAnchorElementConstructorD1Ev
+__ZN7WebCore27JSHTMLDivElementConstructorD1Ev
+__ZN7WebCore27JSHTMLDListElementPrototypeD1Ev
+__ZN7WebCore28JSHTMLOptionElementPrototypeD1Ev
+__ZNK7WebCore16HTMLImageElement17canStartSelectionEv
+__ZN7WebCoreL17appletConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLAppletElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAppletElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore17HTMLAppletElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore17HTMLAppletElement11tagPriorityEv
 __ZN7WebCore17HTMLAppletElement20insertedIntoDocumentEv
-__ZN7WebCore17HTMLAppletElement21finishParsingChildrenEv
-__ZN7WebCore17HTMLAppletElement6detachEv
 __ZN7WebCore17HTMLAppletElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore17HTMLAppletElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3setERKS2_S8_
 __ZN7WebCore12RenderAppletC1EPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES5_NS_10StringHashENS3_10HashTraitsIS5_EES8_EE
+__ZN7WebCore12RenderAppletC2EPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES5_NS_10StringHashENS3_10HashTraitsIS5_EES8_EE
+__ZN7WebCore17HTMLAppletElement21finishParsingChildrenEv
 __ZN7WebCore12RenderApplet6layoutEv
 __ZN7WebCore12RenderApplet23createWidgetIfNecessaryEv
-__ZN7WebCore11FrameLoader22createJavaAppletWidgetERKNS_7IntSizeEPNS_7ElementERKN3WTF7HashMapINS_6StringES8_NS_10StringHashENS6_10HashTraitsIS8_EESB_EE
-__ZN7WebCore6WidgetC1Ev
-__ZN7WebCore12RenderWidget20updateWidgetPositionEv
-__ZN7WebCore12RenderAppletD1Ev
-__ZN7WebCore17HTMLAppletElementD1Ev
-__ZNK3KJS40StringInstanceThatMasqueradesAsUndefined21masqueradeAsUndefinedEv
-__ZN3KJS40StringInstanceThatMasqueradesAsUndefinedD0Ev
-__ZNK7WebCore21JSMouseEventPrototype9classInfoEv
-__ZNK7WebCore18JSUIEventPrototype9classInfoEv
-__ZNK7WebCore10MouseEvent11fromElementEv
-__ZNK7WebCore10MouseEvent11isDragEventEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9ClipboardE
-__ZNK7WebCore17MouseRelatedEvent6layerYEv
-__ZNK7WebCore7UIEvent8charCodeEv
-__ZNK7WebCore17MouseRelatedEvent6layerXEv
-__ZN7WebCore24JSCSSStyleSheetPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsCSSStyleSheetPrototypeFunctionAddRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore11FrameLoader22createJavaAppletWidgetERKNS_7IntSizeEPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES8_NS_10Stri
+__ZN7WebCore17jsDocumentAppletsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7appletsEv
+__ZN7WebCoreL30createHTMLAppletElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLAppletElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLAppletElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAppletElementEEE
+__ZN7WebCore19JSHTMLAppletElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAppletElementEEE
+__ZN7WebCore19JSHTMLAppletElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_17HTMLAppletElementERKNS1_10IdentifierE
+__ZN7WebCore19JSHTMLAppletElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement25renderWidgetForJSBindingsEv
+__ZN3JSC8Bindings12JavaInstanceC1EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings12JavaInstanceC2EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings14JObjectWrapperC1EP8_jobject
+__ZN3JSC8Bindings14JObjectWrapperC2EP8_jobject
+__ZN3JSC8Bindings9getJNIEnvEv
+__ZN3JSC8Bindings9getJavaVMEv
+__ZN3JSC8BindingsL21KJS_GetCreatedJavaVMsEPP7JavaVM_lPl
+__ZN3JSC8Bindings12JavaInstance12virtualBeginEv
+__ZNK3JSC8Bindings12JavaInstance8getClassEv
+__ZN3JSC8Bindings9JavaClassC1EP8_jobject
+__ZN3JSC8Bindings9JavaClassC2EP8_jobject
+__ZN3JSC8Bindings13callJNIMethodIP8_jobjectEET_S3_PKcS6_z
+__ZN3JSC8BindingsL14callJNIMethodVIP8_jobjectEET_S3_PKcS6_Pc
+__ZN3JSC8Bindings24getCharactersFromJStringEP8_jstring
+__ZN3JSC8Bindings29getCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings27releaseCharactersForJStringEP8_jstringPKc
+__ZN3JSC8Bindings32releaseCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKc
+__ZN3JSC8Bindings9JavaFieldC1EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings9JavaFieldC2EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings30getUCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings33releaseUCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKt
+__ZN3JSC8Bindings20JNITypeFromClassNameEPKc
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings5FieldENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3setEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings5FieldEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_
+__ZN3JSC8Bindings10JavaMethodC1EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings10JavaMethodC2EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings13callJNIMethodIlEET_P8_jobjectPKcS6_z
+__ZN3JSC8BindingsL14callJNIMethodVIlEET_P8_jobjectPKcS6_Pc
+__ZN3JSC8Bindings19callJNIStaticMethodIhEET_P7_jclassPKcS6_z
+__ZN7JNIEnv_23CallStaticBooleanMethodEP7_jclassP10_jmethodIDz
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS_6VectorIPNS2_8Bindings6MethodELm0EEENS_7StrHashIS5_EENS_10HashTraitsIS5_EE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS_6VectorIPNS2_8Bindings6MethodELm0EEENS_7StrHashIS5_EENS_10HashTraitsIS5_EEN
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS_6VectorIPNS2_8Bindings6MethodELm0EEEENS_18PairFirstExtractorIS
+__ZN3JSC8Bindings13JavaParameterC1EP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings13JavaParameterC2EP7JNIEnv_P8_jstring
+__ZNK3JSC8Bindings9JavaClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3JSC8Bindings9JavaClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZN3JSC8Bindings12JavaInstance10virtualEndEv
+__ZNK7WebCore19JSHTMLAppletElement9classInfoEv
+__ZN7WebCore19JSHTMLAppletElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN3JSC8Bindings12JavaInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZNK3JSC8Bindings10JavaMethod13numParametersEv
+__ZN3JSC8Bindings20convertValueToJValueEPNS_9ExecStateENS_7JSValueE7JNITypePKc
+__ZNK3JSC8Bindings10RootObject12nativeHandleEv
+__ZNK3JSC8Bindings10JavaMethod8methodIDEP8_jobject
+__ZNK3JSC8Bindings10JavaMethod9signatureEv
+__ZN3JSC8Bindings26signatureFromPrimitiveTypeE7JNIType
+__ZL15appendClassNameRN3JSC7UStringEPKc
+__ZN3JSC8Bindings11getMethodIDEP8_jobjectPKcS4_
+__ZNK3JSC8Bindings10JavaMethod13JNIReturnTypeEv
+__ZN3JSC8Bindings15dispatchJNICallEPNS_9ExecStateEPKvP8_jobjectb7JNITypeP10_jmethodIDP6jvalueRSA_PKcRNS_7JSValueE
+__ZN7WebCoreL27createHTMLModElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLModElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLModElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLModElementEEE
+__ZN7WebCore16JSHTMLModElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLModElementEEE
+__ZN7WebCore16JSHTMLModElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10ShadowDataeqERKS0_
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE6shrinkEm
+__ZN7WebCoreL15checkboxMarginsEj
+__ZN7WebCore21jsHTMLEmbedElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement3srcEv
+__ZN7WebCore19jsNodeParentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11FrameLoader21fileDoesNotExistErrorERKNS_16ResourceResponseE
+__ZN7WebCore26NetscapePlugInStreamLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore10IconLoaderD0Ev
+__ZN7WebCore19JSHTMLAppletElementD1Ev
+__ZN7WebCore16JSHTMLModElementD1Ev
+__ZThn4_N7WebCore16HTMLEmbedElementD0Ev
+__ZN7WebCore16HTMLTitleElement19removedFromDocumentEv
+__ZN7WebCore8Document11removeTitleEPNS_7ElementE
+__ZN7WebCore16HTMLStyleElement19removedFromDocumentEv
+__ZN7WebCore12StyleElement19removedFromDocumentEPNS_8DocumentE
+__ZN7WebCore5XPathL10isAxisNameERKNS_6StringERNS0_4Step4AxisE
+__ZN7WebCore5XPathL17setUpAxisNamesMapERN3WTF7HashMapINS_6StringENS0_4Step4AxisENS_10StringHashENS1_10HashTraitsIS3_EENS7_IS5_E
+__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath4Step4AxisENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHas
+__ZN7WebCore5XPathL13createFunLastEv
+__ZN7WebCore5XPath6FilterC1EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN7WebCore5XPath6FilterC2EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZNK7WebCore5XPath6Filter8evaluateEv
+__ZN7WebCore5XPath5Value17modifiableNodeSetEv
+__ZNK7WebCore5XPath7FunLast8evaluateEv
+__ZNK7WebCore5XPath5Value8toNumberEv
+__ZN7WebCore5XPath6NumberC1Ed
+__ZN7WebCore5XPath6NumberC2Ed
+__ZN7WebCore5XPathL17createFunPositionEv
+__ZNK7WebCore5XPath11FunPosition8evaluateEv
+__ZNK7WebCore5XPath6Number8evaluateEv
+__ZN7WebCore5XPath11FunPositionD0Ev
+__ZN7WebCore5XPath6NumberD0Ev
+__ZN7WebCore5XPath6FilterD0Ev
+__ZN7WebCore5XPath7FunLastD0Ev
+__ZN7WebCore23jsHTMLAnchorElementHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hostEv
+__ZN7WebCore5XPath6Parser9lexNumberEv
+__ZN7WebCore5XPath9NumericOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9NumericOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9NumericOpD0Ev
+__ZNK7WebCore5XPath9NumericOp8evaluateEv
+__ZN7WebCore11FrameLoader14setOpenedByDOMEv
+__ZN3WTF7HashSetIPN7WebCore5FrameENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore13EventListener14markJSFunctionEv
+__ZN7WebCore12NamedNodeMap15removeAttributeERKNS_13QualifiedNameE
+__ZN7WebCore7Element24dispatchAttrRemovalEventEPNS_9AttributeE
+__ZN7WebCore12RenderInline11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Iden
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalid
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore22JSXPathResultPrototypeD1Ev
+__ZN7WebCore24JSXPathResultConstructorD1Ev
+__ZN7WebCore16HTMLOListElementD0Ev
+__ZN7WebCore13MediaQueryExpD1Ev
+__ZN7WebCore13MediaQueryExpD2Ev
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE6shrinkEm
+__ZN7WebCore13CSSImportRuleD0Ev
+__ZThn12_N7WebCore14XMLHttpRequest4stopEv
+__ZN7WebCore14XMLHttpRequest4stopEv
+__ZN7WebCore21JSDocumentConstructorD1Ev
+__ZN7WebCore25JSXMLHttpRequestPrototypeD1Ev
+__ZN7WebCore27JSXMLHttpRequestConstructorD1Ev
+__ZN7WebCore9JSConsoleD1Ev
+__ZN7WebCore9JSConsoleD2Ev
+__ZN7WebCore18JSConsolePrototypeD1Ev
+__ZThn4_N7WebCore13HTMLLIElementD0Ev
+__ZThn4_N7WebCore17HTMLSelectElementD0Ev
+__ZThn4_N7WebCore16HTMLDListElementD0Ev
+__ZN7WebCore23jsHTMLAnchorElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4typeEv
+__ZNK7WebCore11RenderBlock14positionForBoxEPNS_9InlineBoxEb
+__ZN7WebCore20jsHTMLLIElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLLIElement5valueEv
+__ZN7WebCore26jsHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLLIElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLLIElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19jsHTMLLIElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLLIElement4typeEv
+__ZNK7WebCore26CSSMutableStyleDeclaration24getLayeredShorthandValueEPKij
+__ZNK7WebCore8CSSValue22isImplicitInitialValueEv
+__ZN7WebCore29jsHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLUListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLUListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore38jsEventPrototypeFunctionPreventDefaultEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21setJSEventReturnValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39jsEventPrototypeFunctionStopPropagationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22setJSEventCancelBubbleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore27jsHTMLAnchorElementProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8protocolEv
+__ZN7WebCore25jsHTMLAnchorElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsAttrSpecifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLImageElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLLIElementConstructorD1Ev
+__ZN7WebCore33JSHTMLParagraphElementConstructorD1Ev
+__ZN7WebCore29JSHTMLUListElementConstructorD1Ev
+__ZN7WebCore14WindowFeaturesC1ERKNS_6StringE
+__ZN7WebCore14WindowFeaturesC2ERKNS_6StringE
+__ZN7WebCore9DOMWindow16adjustWindowRectERKNS_9FloatRectERS1_S3_
+__ZN7WebCoreL12createWindowEPN3JSC9ExecStateEPNS_5FrameES4_RKNS_6StringES7_RKNS_14WindowFeaturesENS0_7JSValueE
+__ZN7WebCore11FrameLoader12createWindowEPS0_RKNS_16FrameLoadRequestERKNS_14WindowFeaturesERb
+__ZNK7WebCore6Chrome5focusEv
+__ZN7WebCore15JSDOMWindowBase16childFrameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase15namedItemGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore8Document16windowNamedItemsERKNS_6StringE
+__ZN7WebCore18JSCommentPrototypeD1Ev
+__ZN7WebCore15JSAttrPrototypeD1Ev
+__ZN7WebCore23JSNamedNodeMapPrototypeD1Ev
+__ZN7WebCore29JSHTMLImageElementConstructorD1Ev
+__ZN7WebCore18setJSDocumentTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTitleElement7setTextERKNS_6StringE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionScrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12EventHandler29passMousePressEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
+__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetEPNS_12RenderWidgetE
+__ZNK7WebCore12MessageEvent14isMessageEventEv
+__ZN7WebCore15getDOMStructureINS_14JSMessageEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore14JSMessageEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSMessageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12MessageEventEEE
+__ZN7WebCore14JSMessageEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12MessageEventEEE
+__ZN7WebCore14JSMessageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL22getJSMessageEventTableEPN3JSC9ExecStateE
+__ZN7WebCore20jsMessageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsMessageEventDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsElementScrollWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element11scrollWidthEv
+__ZNK7WebCore9RenderBox11scrollWidthEv
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_
+__ZN7WebCore19JSHTMLObjectElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore14JSMessageEventD1Ev
+__ZN7WebCore20setJSDOMWindowStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow9setStatusERKNS_6StringE
+__ZN7WebCoreL27createHTMLMapElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLMapElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLMapElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLMapElementEEE
+__ZN7WebCore16JSHTMLMapElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLMapElementEEE
+__ZN7WebCore16JSHTMLMapElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSHTMLMapElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16JSHTMLModElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20ImageDocumentElementD0Ev
+__ZN7WebCore16HTMLImageElementD2Ev
+__ZN7WebCore13ImageDocumentD0Ev
+__ZN7WebCore12HTMLDocumentD2Ev
+__ZN7WebCore16FixedTableLayoutD0Ev
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE6shrinkEm
+__ZThn28_N7WebCore8DOMTimer4stopEv
+__ZN7WebCore23JSMessageEventPrototypeD1Ev
+__ZN7WebCore38JSXMLHttpRequestProgressEventPrototypeD1Ev
+__ZN7WebCore19CSSCursorImageValueD0Ev
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocate
+__ZN7WebCore13CSSImageValueD2Ev
+__ZN7WebCore32JSHTMLOptionsCollectionPrototypeD1Ev
+__ZN7WebCore19JSOptionConstructorD1Ev
+__ZN7WebCore12NamedNodeMap15removeNamedItemERKNS_13QualifiedNameERi
+__ZN7WebCore27JSHTMLOListElementPrototypeD1Ev
+__ZN7WebCore16JSHTMLMapElementD1Ev
+__ZN7WebCore25JSHTMLMapElementPrototypeD1Ev
+__ZN7WebCore25JSHTMLModElementPrototypeD1Ev
+__ZN7WebCore14HTMLModElementD0Ev
+__ZThn4_N7WebCore15HTMLAreaElementD0Ev
+__ZThn28_N7WebCore8DOMTimer16contextDestroyedEv
+__ZNK7WebCore20RenderBoxModelObject30containingBlockWidthForContentEv
+__ZN7WebCore28setJSHTMLInputElementCheckedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLOptionsCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23JSHTMLOptionsCollection6lengthEPN3JSC9ExecStateE
+__ZN7WebCore24jsHTMLOptionElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLSelectElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement11setDisabledEb
+__ZN7WebCore11RenderBlock26addPercentHeightDescendantEPNS_9RenderBoxE
+__ZNK3WTF7HashMapIPKN7WebCore11RenderBlockEPNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_I
+__ZN3WTF9HashTableIPKN7WebCore11RenderBlockESt4pairIS4_PNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS
+__ZN3WTF7HashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEPNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_I
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS
+__ZN3WTF7HashSetIPN7WebCore11RenderBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateT
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
+__ZN7WebCore25jsHTMLInputElementCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLSelectElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement5valueEv
+__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLSelectElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement4itemEj
+__ZN7WebCore27setJSHTMLOptionElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLOptionElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLOptionElement7setTextERKNS_6StringERi
+__ZN3WTF7HashMapIPKN7WebCore11RenderBlockEPNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZThn4_N7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore30jsElementPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element4blurEv
+__ZNK7WebCore15HTMLBodyElement11scrollWidthEv
+__ZN7WebCore23JSMessageEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL31getJSMessageEventPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore13HitTestResult12setScrollbarEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar14transformEventERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar10mouseMovedERKNS_18PlatformMouseEventE
+__ZN7WebCore23ScrollbarThemeComposite7hitTestEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar14setHoveredPartENS_13ScrollbarPartE
+__ZN7WebCore14ScrollbarTheme26invalidateOnMouseEnterExitEv
+__ZN7WebCore9Scrollbar11mouseExitedEv
+__ZN7WebCoreL28createHTMLFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFontElementEEE
+__ZN7WebCore17JSHTMLFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFontElementEEE
+__ZN7WebCore17JSHTMLFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLFontElementD1Ev
+__ZN7WebCore26JSHTMLFontElementPrototypeD1Ev
+__ZThn4_N7WebCore19HTMLTableRowElementD0Ev
+__ZThn4_N7WebCore15HTMLFontElementD0Ev
+__ZN7WebCore44jsDocumentPrototypeFunctionGetElementsByNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node17getElementsByNameERKNS_6StringE
+__ZN7WebCore12NameNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore12NameNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore12NameNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore12NameNodeListD0Ev
+__ZN7WebCore27JSDocumentFragmentPrototypeD1Ev
+__ZThn4_N7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore19JSMimeTypePrototypeD1Ev
+__ZN7WebCore19setJSNodeOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSNodeOncontextmenuEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node16setOncontextmenuEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17setJSNodeOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17setJSNodeOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZThn268_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore12EventHandler13freeClipboardEv
+__ZNK7WebCore12EventHandler23createDraggingClipboardEv
+__ZN7WebCore12EventHandler20dispatchDragSrcEventERKNS_12AtomicStringERKNS_18PlatformMouseEventE
+__ZNK7WebCore9Clipboard15sourceOperationERNS_13DragOperationE
+__ZN7WebCore14DragController9startDragEPNS_5FrameEPNS_9ClipboardENS_13DragOperationERKNS_18PlatformMouseEventERKNS_8IntPointEb
+__ZN7WebCoreL8getImageEPNS_7ElementE
+__ZN7WebCore12ClipboardMac7hasDataEv
+__ZNK7WebCore16HTMLImageElement3altEv
+__ZN7WebCore16VisibleSelectionC1EPKNS_5RangeENS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2EPKNS_5RangeENS_9EAffinityE
+__ZN7WebCore14RenderReplaced17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore12RenderObject17selectionStartEndERiS1_
+__ZNK7WebCore10RenderView17selectionStartEndERiS1_
+__ZN7WebCore13RootInlineBox22setHasSelectedChildrenEb
+__ZN7WebCore11RenderBlock17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore12RenderObject7childAtEj
+__ZNK7WebCore14RenderReplaced18canBeSelectionLeafEv
+__ZN7WebCore14RenderReplaced23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_19RenderSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS1_24RenderBlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3get
+__ZN7WebCore11RenderBlock27selectionGapRectsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore11RenderBlock15isSelectionRootEv
+__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS1_24RenderBlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setE
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS1_24RenderBlockSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHash
+__ZN7WebCore11RenderBlock19leftSelectionOffsetEPS0_i
+__ZN7WebCore11RenderBlock20rightSelectionOffsetEPS0_i
+__ZN7WebCore11RenderBlock17fillSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZN7WebCore11RenderBlock22fillBlockSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZNK7WebCore12RenderObject18canBeSelectionLeafEv
+__ZN7WebCore11RenderBlock23fillInlineSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZN7WebCore13RootInlineBox20fillLineSelectionGapEiiPNS_11RenderBlockEiiiiPKNS_12RenderObject9PaintInfoE
+__ZN7WebCore13RootInlineBox14selectionStateEv
+__ZN7WebCore9InlineBox14selectionStateEv
+__ZN7WebCore11RenderBlock29getHorizontalSelectionGapInfoENS_12RenderObject14SelectionStateERbS3_
+__ZN7WebCore13RootInlineBox16firstSelectedBoxEv
+__ZN7WebCore13RootInlineBox15lastSelectedBoxEv
+__ZNK7WebCore10RenderView14selectionStartEv
+__ZN7WebCore12ClipboardMac24declareAndWriteDragImageEPNS_7ElementERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZNK7WebCore11BitmapImage17filenameExtensionEv
+__ZNK7WebCore11ImageSource17filenameExtensionEv
+__ZN7WebCore36preferredExtensionForImageSourceTypeERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationERKNS_16ResourceResponseE
+__ZN7WebCore14DragController11doImageDragEPNS_7ElementERKNS_8IntPointERKNS_7IntRectEPNS_9ClipboardEPNS_5FrameERS3_
+__ZN7WebCore24createDragImageFromImageEPNS_5ImageE
+__ZNK7WebCore7IntSizecv7_NSSizeEv
+__ZN7WebCore14DragController16maxDragImageSizeEv
+__ZN7WebCore21fitDragImageToMaxSizeEN3WTF9RetainPtrI7NSImageEERKNS_7IntSizeES6_
+__ZN7WebCore13dragImageSizeEN3WTF9RetainPtrI7NSImageEE
+__ZN7WebCore27dissolveDragImageToFractionEN3WTF9RetainPtrI7NSImageEEf
+__ZN7WebCore14DragController12doSystemDragEN3WTF9RetainPtrI7NSImageEERKNS_8IntPointES7_PNS_9ClipboardEPNS_5FrameEb
+__ZN7WebCoreL24clipOutPositionedObjectsEPKNS_12RenderObject9PaintInfoEiiPN3WTF11ListHashSetIPNS_9RenderBoxENS4_7PtrHashIS7_EEEE
+__ZN7WebCore15GraphicsContext7clipOutERKNS_7IntRectE
+__ZNK7WebCore12RenderObject24selectionBackgroundColorEv
+__ZNK7WebCore11RenderTheme30activeSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac38platformActiveSelectionBackgroundColorEv
+__ZNK7WebCore5Color14blendWithWhiteEv
+__ZN7WebCoreL14blendComponentEii
+__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
+__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
+__ZN7WebCore12EventHandler17cancelDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12EventHandler14clearDragStateEv
+__ZN7WebCore14DragController10cancelDragEv
+__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
+__ZN7WebCore9Clipboard23setDestinationOperationENS_13DragOperationE
+__ZN7WebCore14DragController22cleanupAfterSystemDragEv
+__ZN7WebCore15deleteDragImageEN3WTF9RetainPtrI7NSImageEE
+__ZN7WebCore15highestAncestorEPNS_4NodeE
+__ZN7WebCoreL27removingNodeRemovesPositionEPNS_4NodeERKNS_8PositionE
+__ZNK7WebCore4Node8containsEPKS0_
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_19RenderSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN7WebCore15jsNodeTEXT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn28_NK7WebCore8DOMTimer10canSuspendEv
+__ZThn28_N7WebCore8DOMTimer7suspendEv
+__ZN7WebCore30JSHTMLTextAreaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLTextAreaElement9classInfoEv
+__ZNK7WebCore19HTMLTextAreaElement14isEnumeratableEv
+__ZN7WebCore16JSStyleSheetList18canGetItemsForNameEPN3JSC9ExecStateEPNS_14StyleSheetListERKNS1_10IdentifierE
+__ZNK7WebCore14StyleSheetList12getNamedItemERKNS_6StringE
+__ZN7WebCore25JSStyleSheetListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSCSSRuleListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL11quoteStringERKNS_6StringE
+__ZN7WebCore21jsHTMLImageElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL21serviceTypeForClassIdERKNS_6StringEPKNS_10PluginDataE
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
+__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3getERKS2_
+__ZN7WebCoreL11activeXTypeEv
+__ZNK7WebCore10PluginData16supportsMimeTypeERKNS_6StringE
+__NPN_GetProperty
+__ZThn8_N7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore17HTMLPlugInElement11getNPObjectEv
+__ZN7WebCore16ScriptController34createScriptObjectForPluginElementEPNS_17HTMLPlugInElementE
+__ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
+__NPN_GetStringIdentifiers
+__ZThn8_N7WebCore20HTMLParagraphElementD0Ev
+__ZThn8_N7WebCore16HTMLDListElementD0Ev
+__ZThn8_N7WebCore7CommentD0Ev
+__ZThn8_N7WebCore16HTMLOListElementD0Ev
+__ZN7WebCore4Path15createRectangleERKNS_9FloatRectE
+__ZN7WebCore5TimerINS_11RenderImageEE5firedEv
+__ZN7WebCore11RenderImage28highQualityRepaintTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsCSSStyleDeclarationCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn28_N7WebCore8DOMTimer6resumeEv
+__ZN7WebCore8DOMTimer6resumeEv
+__ZN7WebCore19HTMLTextAreaElementD0Ev
+__ZN7WebCoreL11isSeparatorEt
+__ZN7WebCore14WindowFeatures16setWindowFeatureERKNS_6StringES3_
+__ZNK7WebCore6Chrome12createWindowEPNS_5FrameERKNS_16FrameLoadRequestERKNS_14WindowFeaturesE
+__ZNK7WebCore19ResourceRequestBase7isEmptyEv
+__ZN7WebCore4Page14sessionStorageEb
+__ZNK7WebCore6Chrome18setToolbarsVisibleEb
+__ZNK7WebCore6Chrome19setStatusbarVisibleEb
+__ZNK7WebCore6Chrome20setScrollbarsVisibleEb
+__ZNK7WebCore6Chrome17setMenubarVisibleEb
+__ZNK7WebCore6Chrome12setResizableEb
+__ZNK7WebCore6Chrome10windowRectEv
+__ZNK7WebCore6Chrome8pageRectEv
+__ZNK7WebCore6Chrome13setWindowRectERKNS_9FloatRectE
+__ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
+__ZNK7WebCore6Chrome4showEv
+__ZNK7WebCore11ScriptValue9getStringERNS_6StringE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8resizeToEff
+__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow6moveToEff
+__ZN7WebCore16JSHTMLPreElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore38jsElementPrototypeFunctionHasAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12CachedScript8encodingEv
+__ZN7WebCore44jsHTMLAnchorElementPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17HTMLAnchorElement8toStringEv
+__ZN7WebCore15JSHTMLHRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+_KJS_JSCreateNativeJSObject
+__ZN3JSC8Bindings12JavaJSObject6invokeEPNS0_19JSObjectCallContextE
+__ZN3JSC8Bindings12JavaJSObject12createNativeEx
+__ZN3JSC8Bindings24findProtectingRootObjectEPNS_8JSObjectE
+__ZN3JSC8Bindings10RootObject13gcIsProtectedEPNS_8JSObjectE
+_KJS_JSObject_JSObjectCall
+__ZN3JSC8Bindings12JavaJSObjectC1Ex
+__ZN3JSC8Bindings12JavaJSObjectC2Ex
+__ZNK3JSC8Bindings12JavaJSObject4callEP8_jstringP13_jobjectArray
+__ZNK3JSC8Bindings12JavaJSObject10rootObjectEv
+__ZNK3JSC8Bindings12JavaJSObject17getListFromJArrayEPNS_9ExecStateEP13_jobjectArrayRNS_20MarkedArgumentBufferE
+__ZNK3JSC8Bindings12JavaJSObject21convertJObjectToValueEPNS_9ExecStateEP8_jobject
+__ZNK3JSC16RuntimeObjectImp12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12JavaInstance12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12JavaInstance11stringValueEPNS_9ExecStateE
+__ZNK3JSC8Bindings12JavaJSObject21convertValueToJObjectENS_7JSValueE
+__ZN7JNIEnv_9NewObjectEP7_jclassP10_jmethodIDz
+_KJS_JSObject_JSFinalize
+__ZNK3JSC8Bindings12JavaJSObject8finalizeEv
+__ZN7WebCore19JSHTMLAppletElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSHTMLAppletElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12RenderAppletD0Ev
+__ZN3JSC8Bindings12JavaInstanceD0Ev
+__ZN3JSC8Bindings14JObjectWrapperD1Ev
+__ZN3JSC8Bindings14JObjectWrapperD2Ev
+__ZN3JSC8Bindings9JavaClassD0Ev
+__ZN3WTF20deleteAllPairSecondsIPN3JSC8Bindings5FieldEKNS_7HashMapINS_6RefPtrINS1_7UString3RepEEES4_NS_7StrHashIS9_EENS_10HashTr
+__ZN3JSC8Bindings9JavaFieldD0Ev
+__ZN3WTF15deleteAllValuesIPN3JSC8Bindings6MethodELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC8Bindings10JavaMethodD0Ev
+__ZN3JSC8Bindings13JavaParameterD1Ev
+__ZN7WebCore17HTMLAppletElementD0Ev
+__ZN7WebCore28JSHTMLAppletElementPrototypeD1Ev
+__ZThn4_N7WebCore19HTMLTextAreaElementD0Ev
+__ZN7WebCore12EventHandler31passMouseReleaseEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
+__ZN7WebCore17setJSLocationHashEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHashEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore12EventHandler22passWheelEventToWidgetERNS_18PlatformWheelEventEPNS_6WidgetE
+__ZN7WebCoreL42setNSScrollViewScrollWheelShouldRetainSelfEb
+__ZN7WebCoreL36selfRetainingNSScrollViewScrollWheelEP12NSScrollViewP13objc_selectorP7NSEvent
+__ZN7WebCore11RenderStyle10setContentEN3WTF10PassRefPtrINS_10StyleImageEEEb
+__ZN7WebCore27RenderImageGeneratedContentC1EPNS_4NodeE
+__ZN7WebCore27RenderImageGeneratedContentC2EPNS_4NodeE
+__ZN7WebCore27RenderImageGeneratedContent13setStyleImageEPNS_10StyleImageE
+__ZNK7WebCore16StyleCachedImage13isCachedImageEv
+__ZNK7WebCore27RenderImageGeneratedContent13errorOccurredEv
+__ZNK7WebCore27RenderImageGeneratedContent21imageHasRelativeWidthEv
+__ZNK7WebCore16StyleCachedImage21imageHasRelativeWidthEv
+__ZNK7WebCore27RenderImageGeneratedContent22usesImageContainerSizeEv
+__ZNK7WebCore16StyleCachedImage22usesImageContainerSizeEv
+__ZNK7WebCore27RenderImageGeneratedContent22imageHasRelativeHeightEv
+__ZNK7WebCore16StyleCachedImage22imageHasRelativeHeightEv
+__ZNK7WebCore27RenderImageGeneratedContent8imagePtrEv
+__ZNK7WebCore27RenderImageGeneratedContent9imageSizeEf
+__ZNK7WebCore27RenderImageGeneratedContent8hasImageEv
+__ZN7WebCore27RenderImageGeneratedContentD0Ev
+__ZN7WebCore11RenderImageD2Ev
+__ZN7WebCore27RenderImageGeneratedContent5imageEii
+__ZN7WebCore19JSHTMLButtonElementD1Ev
+__ZN7WebCore28JSHTMLButtonElementPrototypeD1Ev
+__ZN7WebCore17HTMLButtonElementD0Ev
+__ZN7WebCoreL17legendConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLLegendElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLLegendElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore14RenderFieldset12layoutLegendEb
+__ZNK7WebCore14RenderFieldset10isFieldsetEv
+__ZN7WebCore10JSNodeList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore19JSNodeListPrototype9classInfoEv
+__ZN7WebCore17jsNodeTextContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16setJSNodeOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16StyleCachedImage8cssValueEv
+__ZNK7WebCore26NetscapePlugInStreamLoader6isDoneEv
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE15reserveCapacityEm
+__ZN7WebCore14RenderFieldsetD0Ev
+__ZN7WebCoreL19tablecolConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTableColElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLTableColElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLTableColElement17endTagRequirementEv
+__ZNK7WebCore19HTMLTableColElement11tagPriorityEv
+__ZNK7WebCore19HTMLTableColElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN7WebCore19HTMLTableColElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore14RenderTableColC1EPNS_4NodeE
+__ZN7WebCore14RenderTableColC2EPNS_4NodeE
+__ZN7WebCore14RenderTableCol17updateFromElementEv
+__ZNK7WebCore14RenderTableCol13requiresLayerEv
+__ZNK7WebCore14RenderTableCol10isTableColEv
+__ZNK7WebCore14RenderTableCol15virtualChildrenEv
+__ZN7WebCore19HTMLTableColElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore14RenderTableCol15canHaveChildrenEv
+__ZNK7WebCore19HTMLTableColElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore19HTMLTableColElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14RenderTableCol14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
+__ZN7WebCore14RenderTableCol15virtualChildrenEv
+__ZN7WebCoreL32createHTMLTableColElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTableColElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTableColElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableColElementEEE
+__ZN7WebCore21JSHTMLTableColElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableColElementEEE
+__ZN7WebCore21JSHTMLTableColElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSHTMLTableColElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19HTMLFieldSetElementD0Ev
+__ZN7WebCore17HTMLLegendElementD0Ev
+__ZN7WebCore23jsHTMLTableElementTHeadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5tHeadEv
+__ZN7WebCore29jsHTMLTableSectionElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23HTMLTableSectionElement4rowsEv
+__ZN7WebCore26jsHTMLTableRowElementCellsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTableRowElement5cellsEv
+__ZN7WebCore14RenderTableCol29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore54jsXMLHttpRequestPrototypeFunctionGetAllResponseHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZNK7WebCore14XMLHttpRequest21getAllResponseHeadersERi
+__ZN7WebCoreL21startElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
+__ZN7WebCore12XMLTokenizer14startElementNsEPKhS2_S2_iPS2_iiS3_
+__ZN7WebCore7ElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL23handleElementAttributesEPNS_7ElementEPPKhiRi
+__ZN7WebCore7Element14setAttributeNSERKNS_12AtomicStringES3_S3_Ri
+__ZN7WebCore8Document18parseQualifiedNameERKNS_6StringERS1_S4_Ri
+__ZNK7WebCore7Element18createAttributeMapEv
+__ZN7WebCore7Element15createAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore15toScriptElementEPNS_7ElementE
+__ZNK7WebCore8Document14isHTMLDocumentEv
+__ZN7WebCoreL17charactersHandlerEPvPKhi
+__ZN7WebCore12XMLTokenizer10charactersEPKhi
+__ZN7WebCore12XMLTokenizer9enterTextEv
+__ZN3WTF6VectorIhLm0EE6appendIhEEvPKT_m
+__ZN3WTF6VectorIhLm0EE14expandCapacityEmPKh
+__ZN3WTF6VectorIhLm0EE14expandCapacityEm
+__ZN3WTF6VectorIhLm0EE15reserveCapacityEm
+__ZN7WebCore13CharacterData10appendDataERKNS_6StringERi
+__ZN3WTF6VectorIhLm0EE6shrinkEm
+__ZN7WebCoreL19endElementNsHandlerEPvPKhS2_S2_
+__ZN7WebCore12XMLTokenizer12endElementNsEv
+__ZN7WebCoreL14commentHandlerEPvPKh
+__ZN7WebCore12XMLTokenizer7commentEPKh
+__ZN7WebCore10JSDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DocumentEEE
+__ZN7WebCore10JSDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10JSDocument9classInfoEv
+__ZN7WebCore9JSElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ElementEEE
+__ZN7WebCore9JSElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore9JSElement9classInfoEv
+__ZN7WebCore36jsNodePrototypeFunctionHasChildNodesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSHTMLTableColElementD1Ev
+__ZN7WebCore9JSElementD1Ev
+__ZN7WebCore10JSDocumentD1Ev
+__ZN7WebCore7ElementD0Ev
+__ZN7WebCore12NamedNodeMapD0Ev
+__ZN7WebCore9AttributeD0Ev
+__ZN7WebCore17HTMLButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCoreL21executeDeleteBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor19deleteWithDirectionENS_19SelectionController10EDirectionENS_15TextGranularityEbb
+__ZN7WebCore6Editor20canSmartCopyOrDeleteEv
+__ZN7WebCore13TypingCommand16deleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommand16deleteKeyPressedENS_15TextGranularityEb
+__ZN7WebCore20CompositeEditCommand39breakOutOfEmptyMailBlockquotedParagraphEv
+__ZN7WebCore26highestEnclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEE
+__ZN7WebCore19SelectionController6modifyENS0_11EAlterationENS0_10EDirectionENS_15TextGranularityEb
+__ZN7WebCore19SelectionController14willBeModifiedENS0_11EAlterationENS0_10EDirectionE
+__ZN7WebCore16VisibleSelection7setBaseERKNS_8PositionE
+__ZN7WebCore16VisibleSelection9setExtentERKNS_8PositionE
+__ZN7WebCore19SelectionController23modifyExtendingBackwardENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition31honorEditableBoundaryAtOrBeforeERKS0_
+__ZN7WebCore19SelectionController30xPosForVerticalArrowNavigationENS0_13EPositionTypeE
+__ZNK7WebCore15VisiblePosition28xOffsetForVerticalNavigationEv
+__ZN7WebCore19SelectionController9setExtentERKNS_15VisiblePositionEb
+__ZN7WebCore16VisibleSelectionC1ERKNS_8PositionES3_NS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2ERKNS_8PositionES3_NS_9EAffinityE
+__ZN7WebCore25isFirstPositionAfterTableERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame21shouldDeleteSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore20CompositeEditCommand15deleteSelectionERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommandC1ERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommandC2ERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommand7doApplyEv
+__ZN7WebCore5Frame28textWillBeDeletedInTextFieldEPNS_7ElementE
+__ZN7WebCore22DeleteSelectionCommand22initializePositionDataEv
+__ZN7WebCore22DeleteSelectionCommand18initializeStartEndERNS_8PositionES2_
+__ZN7WebCore38positionBeforeContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
+__ZN7WebCoreL21firstInSpecialElementERKNS_8PositionE
+__ZN7WebCore16isSpecialElementEPKNS_4NodeE
+__ZN7WebCore37positionAfterContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
+__ZN7WebCoreL20lastInSpecialElementERKNS_8PositionE
+__ZN7WebCoreL10isTableRowEPKNS_4NodeE
+__ZN7WebCore27numEnclosingMailBlockquotesERKNS_8PositionE
+__ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
+__ZNK7WebCore8Position25previousCharacterPositionENS_9EAffinityE
+__ZN7WebCore13isStartOfLineERKNS_15VisiblePositionE
+__ZNK7WebCore8Position26rendersInDifferentPositionERKS0_
+__ZNK7WebCore8Position14renderedOffsetEv
+__ZNK7WebCore4Node12nextEditableEv
+__ZNK7WebCore4Node12nextLeafNodeEv
+__ZNK7WebCore4Node30nextNodeConsideringAtomicNodesEv
+__ZNK7WebCore4Node16previousEditableEv
+__ZNK7WebCore4Node16previousLeafNodeEv
+__ZNK7WebCore4Node34previousNodeConsideringAtomicNodesEv
+__ZN7WebCore4Node32inSameContainingBlockFlowElementEPS0_
+__ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
+__ZN7WebCore20CompositeEditCommand33deleteInsignificantTextDownstreamERKNS_8PositionE
+__ZN7WebCore22DeleteSelectionCommand20saveTypingStyleStateEv
+__ZN7WebCore22DeleteSelectionCommand25handleSpecialCaseBRDeleteEv
+__ZN7WebCore22DeleteSelectionCommand19handleGeneralDeleteEv
+__ZN7WebCore22DeleteSelectionCommand18deleteTextFromNodeEN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCoreL28updatePositionForTextRemovalEPNS_4NodeEiiRNS_8PositionE
+__ZN7WebCore20CompositeEditCommand18deleteTextFromNodeEN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore25DeleteFromTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore25DeleteFromTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore25DeleteFromTextNodeCommand7doApplyEv
+__ZN7WebCore13CharacterData13substringDataEjjRi
+__ZN7WebCore22DeleteSelectionCommand15fixupWhitespaceEv
+__ZN7WebCore22DeleteSelectionCommand15mergeParagraphsEv
+__ZN7WebCore22DeleteSelectionCommand38removePreviouslySelectedEmptyTableRowsEv
+__ZN7WebCore22DeleteSelectionCommand31calculateTypingStyleAfterDeleteEv
+__ZN7WebCore22DeleteSelectionCommand19clearTransientStateEv
+__ZN7WebCore6Editor36revealSelectionAfterEditingOperationEv
+__ZNK7WebCore11EditCommand19isInsertTextCommandEv
+__ZNK7WebCore22HTMLFormControlElement17isActivatedSubmitEv
+__ZNK7WebCore22HTMLFormControlElement24isSuccessfulSubmitButtonEv
+__ZNK7WebCore17HTMLButtonElement17isActivatedSubmitEv
+__ZNK7WebCore17HTMLButtonElement24isSuccessfulSubmitButtonEv
+__ZN7WebCore17HTMLButtonElement18setActivatedSubmitEb
+__ZN7WebCore22HTMLFormControlElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore17HTMLButtonElement14appendFormDataERNS_12FormDataListEb
+__ZNK7WebCore8FormData15flattenToStringEv
+__ZNK7WebCore8FormData7flattenERN3WTF6VectorIcLm0EEE
+__ZN7WebCore4KURL8setQueryERKNS_6StringE
+__ZN7WebCore14RenderTableColD0Ev
+__ZN7WebCore22DeleteSelectionCommandD0Ev
+__ZN7WebCore25DeleteFromTextNodeCommandD0Ev
+__ZN7WebCore15RenderWordBreakC1EPNS_11HTMLElementE
+__ZN7WebCore15RenderWordBreakC2EPNS_11HTMLElementE
+__ZN7WebCore15RenderWordBreakD0Ev
+__ZN7WebCore39jsHTMLFormElementPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15HTMLFormElement5resetEv
+__ZN7WebCore16HTMLInputElement5resetEv
+__ZNK7WebCore15RenderWordBreak11isWordBreakEv
+__ZN7WebCore22jsHTMLInputElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24setJSHTMLElementTabIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement11setTabIndexEi
+__ZN7WebCore23jsHTMLFormElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLTableColElementPrototypeD1Ev
+__ZN7WebCore19HTMLTableColElementD0Ev
+__ZN7WebCore22jsNavigatorAppCodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase11appCodeNameEv
+__ZN7WebCore25setJSHTMLInputElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLInputElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement7setNameERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAnchorElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setNameERKNS_12AtomicStringE
+__ZN7WebCore35jsHTMLDocumentPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL23MainGradientInterpolateEPvPKfPf
+__ZN7WebCoreL22TopGradientInterpolateEPvPKfPf
+__ZN7WebCoreL25BottomGradientInterpolateEPvPKfPf
+__ZN7WebCore21jsHTMLDocumentScriptsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7scriptsEv
+__ZN7WebCore16JSHTMLCollection11getCallDataERN3JSC8CallDataE
+__ZN7WebCore17jsDocumentCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSHTMLHRElementPrototypeD1Ev
+__ZN7WebCore27jsHTMLAnchorElementPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8pathnameEv
+__ZN7WebCore9FrameView18setUseSlowRepaintsEv
+__ZL15deallocCallbackPv
+__ZN7WebCore17jsDOMWindowClosedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6closedEv
+__ZN7WebCore33jsDOMWindowPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5focusEv
+__ZN7WebCore5Frame11focusWindowEv
+__ZN7WebCore28jsHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLBodyElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLBodyElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17jsNodeOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmouseoverEv
+__ZN7WebCore13jsNodeOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onfocusEv
+__ZN7WebCore29jsHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLTableElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLTableElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore5Color5lightEv
+__ZN7WebCore17differenceSquaredERKNS_5ColorES2_
+__ZN7WebCore19HTMLTextAreaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore26RenderTextControlMultiLineC1EPNS_4NodeE
+__ZN7WebCore26RenderTextControlMultiLineC2EPNS_4NodeE
+__ZN7WebCore26RenderTextControlMultiLine17updateFromElementEv
+__ZNK7WebCore26RenderTextControlMultiLine20createInnerTextStyleEPKNS_11RenderStyleE
+__ZNK7WebCore26RenderTextControlMultiLine10isTextAreaEv
+__ZN7WebCore26RenderTextControlMultiLine36adjustControlHeightBasedOnLineHeightEi
+__ZNK7WebCore17RenderTextControl14hasControlClipEv
+__ZNK7WebCore26RenderTextControlMultiLine16baselinePositionEbb
+__ZN7WebCoreL17resizerCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCore26RenderTextControlMultiLineD0Ev
+__ZN7WebCore19HTMLTextAreaElement23rendererWillBeDestroyedEv
+__ZN7WebCore28JSHTMLBodyElementConstructorD1Ev
+__ZN7WebCore29JSHTMLTableElementConstructorD1Ev
+__ZNK7WebCore15PurgeableBuffer9wasPurgedEv
+__ZN7WebCore16LegacyWebArchive6createEPNS_12SharedBufferE
+__ZN7WebCore16LegacyWebArchive7extractEPK14__CFDictionary
+__ZN7WebCore16LegacyWebArchive14createResourceEPK14__CFDictionary
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceRespons
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
+__ZN7WebCore16LegacyWebArchive42createResourceResponseFromPropertyListDataEPK8__CFDataPK10__CFString
+__ZN7WebCore16LegacyWebArchive41createResourceResponseFromMacArchivedDataEPK8__CFData
+__ZNK7WebCore20ResourceResponseBase17suggestedFilenameEv
+__ZN3WTF7HashMapIN7WebCore24FontPlatformDataCacheKeyEPNS1_16FontPlatformDataENS1_28FontPlatformDataCacheKeyHashENS1_30FontPlatf
+__ZN3WTF6VectorIN7WebCore24FontPlatformDataCacheKeyELm0EE6shrinkEm
+__ZN7WebCore29jsHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest16getRequestHeaderERKNS_12AtomicStringE
+__ZN7WebCore8FormData6createERKNS_7CStringE
+__ZN7WebCore17SubresourceLoader11didSendDataEyy
+__ZThn16_N7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
+__ZN7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
+__ZThn16_N7WebCore14XMLHttpRequest11didSendDataEyy
+__ZN7WebCore14XMLHttpRequest11didSendDataEyy
+__ZThn24_N7WebCore14XMLHttpRequest4stopEv
+__ZN7WebCore27setJSHTMLImageElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setUseMapERKNS_6StringE
+__ZThn8_N7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore14jsNodeOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onsubmitEv
+__ZNK7WebCore17JSHTMLAreaElement9classInfoEv
+__ZN7WebCoreL32createHTMLFieldSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLFieldSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLFieldSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFieldSetElementEEE
+__ZN7WebCore21JSHTMLFieldSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFieldSetElementEEE
+__ZN7WebCore21JSHTMLFieldSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLFieldSetElement9classInfoEv
+__ZN7WebCore20jsDOMWindowStatusbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9statusbarEv
+__ZN7WebCore7BarInfoC1EPNS_5FrameENS0_4TypeE
+__ZN7WebCore7BarInfoC2EPNS_5FrameENS0_4TypeE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7BarInfoE
+__ZN7WebCore9JSBarInfo15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSBarInfoC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7BarInfoEEE
+__ZN7WebCore9JSBarInfoC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7BarInfoEEE
+__ZN7WebCore9JSBarInfo18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsBarInfoVisibleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7BarInfo7visibleEv
+__ZNK7WebCore6Chrome16statusbarVisibleEv
+__ZNK7WebCore15HTMLFormElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore21JSHTMLFieldSetElementD1Ev
+__ZN7WebCore30JSHTMLFieldSetElementPrototypeD1Ev
+__ZN7WebCore12InputElement20updateSelectionRangeERNS_16InputElementDataEii
+__ZN7WebCore21setJSElementScrollTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7Element12setScrollTopEi
+__ZN7WebCore9RenderBox12setScrollTopEi
+__ZN7WebCore8Document29removeStyleSheetCandidateNodeEPNS_4NodeE
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZThn8_N7WebCore16HTMLStyleElementD0Ev
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm16EE6shrinkEm
+__ZN7WebCore28setJSHTMLLabelElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLLabelElement10setHtmlForERKNS_6StringE
+__ZN7WebCore7BarInfo15disconnectFrameEv
+__ZNK7WebCore12RenderButton14hasLineIfEmptyEv
+__ZNK7WebCore22HTMLFormControlElement11virtualFormEv
+__ZN7WebCore9JSBarInfoD1Ev
+__ZN7WebCore9JSBarInfoD2Ev
+__ZN7WebCore18JSBarInfoPrototypeD1Ev
+__ZThn8_N7WebCore17HTMLIFrameElementD0Ev
+__ZThn8_N7WebCore17HTMLScriptElementD0Ev
+__ZThn8_N7WebCore16HTMLLabelElementD0Ev
+__ZN7WebCore26setJSHTMLEmbedElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement8setWidthERKNS_6StringE
+__ZN7WebCore27setJSHTMLEmbedElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement9setHeightERKNS_6StringE
+__ZN7WebCore9CSSParser10parseShapeEib
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4RectEEE
+__ZN7WebCore11RenderStyle7setClipENS_6LengthES1_S1_S1_
+__ZN7WebCore9RenderBox8clipRectEii
+__ZN7WebCore9RenderBox13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore23jsHTMLFormElementMethodEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement6methodEv
+__ZN7WebCore25jsHTMLFormElementElementsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsHTMLInputElementSelectionStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement14selectionStartEPN3JSC9ExecStateE
+__ZNK7WebCore16HTMLInputElement16canHaveSelectionEv
+__ZNK7WebCore16HTMLInputElement14selectionStartEv
+__ZN7WebCore30jsHTMLInputElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement12selectionEndEPN3JSC9ExecStateE
+__ZNK7WebCore16HTMLInputElement12selectionEndEv
+__ZN7WebCore32setJSHTMLTableElementCellPaddingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement14setCellPaddingERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableElementCellSpacingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement14setCellSpacingERKNS_6StringE
+__ZN7WebCore11RenderBlock28removeLeftoverAnonymousBlockEPS0_
+__ZN7WebCore24JSCSSStyleSheetPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore15JSCSSStyleSheet9classInfoEv
-__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_Ri
-__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_iRi
-__ZN7WebCore13CSSStyleSheet10insertRuleERKNS_6StringEjRi
-__ZN7WebCore9StyleList6insertEjN3WTF10PassRefPtrINS_9StyleBaseEEE
-__ZN7WebCore13CSSStyleSheet17styleSheetChangedEv
-__ZN7WebCore42jsDocumentPrototypeFunctionCreateElementNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLHtmlElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLHtmlElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15headConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLHeadElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLHeadElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore17createBaseWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLBaseElementC1EPN3KJS8JSObjectEPNS_15HTMLBaseElementE
-__ZN7WebCore17JSHTMLBaseElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLBaseElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLBaseElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18isindexConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLIsIndexElementC1EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore16HTMLInputElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore20createIsIndexWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore20JSHTMLIsIndexElementC1EPN3KJS8JSObjectEPNS_18HTMLIsIndexElementE
-__ZN7WebCore20JSHTMLIsIndexElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore20JSHTMLIsIndexElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSHTMLIsIndexElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLStyleElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLStyleElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createOptGroupWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLOptGroupElementC1EPN3KJS8JSObjectEPNS_19HTMLOptGroupElementE
-__ZN7WebCore21JSHTMLOptGroupElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLOptGroupElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLOptGroupElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLFieldSetElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLFieldSetElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19createLegendWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLLegendElementC1EPN3KJS8JSObjectEPNS_17HTMLLegendElementE
-__ZN7WebCore19JSHTMLLegendElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLLegendElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLLegendElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLOListElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLOListElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLDListElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLDListElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore14dirConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore20HTMLDirectoryElementC1EPNS_8DocumentE
-__ZN7WebCore22createDirectoryWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore22JSHTMLDirectoryElementC1EPN3KJS8JSObjectEPNS_20HTMLDirectoryElementE
-__ZN7WebCore22JSHTMLDirectoryElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLDirectoryElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLDirectoryElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15menuConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLMenuElementC2EPNS_8DocumentE
-__ZN7WebCore17createMenuWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLMenuElementC1EPN3KJS8JSObjectEPNS_15HTMLMenuElementE
-__ZN7WebCore17JSHTMLMenuElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLMenuElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLMenuElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLParagraphElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLParagraphElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore20JSHTMLHeadingElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSHTMLHeadingElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16quoteConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLQuoteElementC1EPNS_8DocumentE
-__ZN7WebCore18createQuoteWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLQuoteElementC1EPN3KJS8JSObjectEPNS_16HTMLQuoteElementE
-__ZN7WebCore18JSHTMLQuoteElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLQuoteElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLQuoteElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLPreElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLPreElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore15JSHTMLBRElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSHTMLBRElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createBaseFontWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLBaseFontElementC1EPN3KJS8JSObjectEPNS_19HTMLBaseFontElementE
-__ZN7WebCore21JSHTMLBaseFontElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLBaseFontElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLBaseFontElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLFontElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLFontElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore15JSHTMLHRElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSHTMLHRElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore14modConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLModElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16createModWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLModElementC1EPN3KJS8JSObjectEPNS_14HTMLModElementE
-__ZN7WebCore16JSHTMLModElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLModElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLModElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLParamElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLParamElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19createAppletWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLAppletElementC1EPN3KJS8JSObjectEPNS_17HTMLAppletElementE
-__ZN7WebCore19JSHTMLAppletElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLAppletElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_17HTMLAppletElementERKNS1_10IdentifierE
-__ZN7WebCore19JSHTMLAppletElement24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement11getInstanceEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLAppletElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLAppletElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23tableCaptionConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore23HTMLTableCaptionElementC1EPNS_8DocumentE
-__ZN7WebCore25createTableCaptionWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLTableCaptionElementC1EPN3KJS8JSObjectEPNS_23HTMLTableCaptionElementE
-__ZN7WebCore25JSHTMLTableCaptionElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore25JSHTMLTableCaptionElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSHTMLTableCaptionElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLTableColElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLTableColElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createFrameSetWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLFrameSetElementC1EPN3KJS8JSObjectEPNS_19HTMLFrameSetElementE
-__ZN7WebCore21JSHTMLFrameSetElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLFrameSetElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_19HTMLFrameSetElementERKNS1_10IdentifierE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLFrameSetElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLFrameSetElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18createFrameWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLFrameElementC1EPN3KJS8JSObjectEPNS_16HTMLFrameElementE
-__ZN7WebCore18JSHTMLFrameElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLFrameElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLFrameElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore28JSHTMLHtmlElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore6JSTextEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSText16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18HTMLIsIndexElementD1Ev
-__ZN7WebCore23HTMLTableCaptionElementD1Ev
-__ZN7WebCore18JSHTMLLabelElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore5Frame13setZoomFactorEi
--[WebCoreFrameBridge stringWithData:]
+__ZN7WebCore29setJSHTMLInputElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore17ScrollbarThemeMac20supportsControlTintsEv
+__ZThn8_N7WebCore17HTMLButtonElementD0Ev
+__ZN7WebCore15jsNodeOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node9onkeydownEv
+__ZN7WebCore16jsNodeOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10onkeypressEv
+__ZN7WebCore41jsHTMLInputElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore25jsHTMLTableElementTBodiesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16HTMLTableElement7tBodiesEv
+__ZN7WebCore38jsXMLHttpRequestPrototypeFunctionAbortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14XMLHttpRequest5abortEv
+__ZN7WebCore14XMLHttpRequest18dispatchAbortEventEv
+__ZN7WebCoreL17reportUnsafeUsageEPNS_22ScriptExecutionContextERKNS_6StringE
+__ZN7WebCore15getDOMStructureINS_15JSKeyboardEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSKeyboardEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSKeyboardEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13KeyboardEventEEE
+__ZN7WebCore15JSKeyboardEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13KeyboardEventEEE
+__ZN7WebCore15JSKeyboardEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13KeyboardEvent7keyCodeEv
+__ZN7WebCore23jsKeyboardEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsNodeOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6onblurEv
+__ZThn128_N7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZThn128_NK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZN7WebCore17jsClientRectRightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsClientRectBottomEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn16_N7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZThn16_N7WebCore14XMLHttpRequest7didFailERKNS_13ResourceErrorE
+__ZN7WebCore14XMLHttpRequest7didFailERKNS_13ResourceErrorE
+__ZN7WebCore14XMLHttpRequest10abortErrorEv
+__ZN7WebCore14XMLHttpRequest12genericErrorEv
+__ZN7WebCore24DocumentThreadableLoader6cancelEv
+__ZThn8_N7WebCore11EditingTextD0Ev
+__ZN7WebCore15JSKeyboardEventD1Ev
+__ZN7WebCore27setJSHTMLTableElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement9setBorderERKNS_6StringE
+__ZN7WebCore42jsElementPrototypeFunctionGetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21jsHTMLElementTabIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement8tabIndexEv
+__ZNK7WebCore4Node13supportsFocusEv
+__ZNK7WebCore4Node8tabIndexEv
+__ZN7WebCore24JSKeyboardEventPrototypeD1Ev
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E5clearEv
+__ZN7WebCore4Page22allVisitedStateChangedEPNS_9PageGroupE
+__ZN7WebCore16CSSStyleSelector15SelectorChecker22allVisitedStateChangedEv
+__ZN7WebCore23ApplicationCacheStorage5emptyEv
+__ZN7WebCore31CrossOriginPreflightResultCache6sharedEv
+__ZN7WebCore31CrossOriginPreflightResultCache5emptyEv
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore35CrossOriginPreflightResultCacheItemEKNS_7HashMapISt4pairINS1_6StringENS1_4KURLEES3_N
+__ZN7WebCore12IconDatabase14removeAllIconsEv
+__ZN7WebCore10IconRecordD1Ev
+__ZN7WebCore10IconRecordD2Ev
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN7WebCore12IconDatabase22removeAllIconsOnThreadEv
+__ZN7WebCore14SQLiteDatabase16runVacuumCommandEv
+__ZN7WebCore4Page14setMediaVolumeEf
+__ZN7WebCore8Document20mediaVolumeDidChangeEv
 __ZNK7WebCore12EventHandler20currentKeyboardEventEv
 __ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
-__ZN7WebCore30newStreamingTextDecoderUTF16LEERKNS_12TextEncodingEPKv
-__ZN7WebCore14TextCodecUTF166decodeEPKcmb
-__ZN7WebCore15BackForwardList17backListWithLimitEiRN3WTF6VectorINS1_6RefPtrINS_11HistoryItemEEELm0EEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEmPKS4_
--[WebCoreFrameBridge setMarkedTextMatchesAreHighlighted:]
-__ZN7WebCore5Frame34setMarkedTextMatchesAreHighlightedEb
--[WebCoreFrameBridge markAllMatchesForText:caseSensitive:limit:]
-__ZN7WebCore5Frame21markAllMatchesForTextERKNS_6StringEbj
-__ZN7WebCore13findPlainTextEPKNS_5RangeERKNS_6StringEbb
-__ZNK7WebCore5Range10cloneRangeERi
-__ZN7WebCore20CircularSearchBufferC2ERKNS_6StringEb
-__ZNK7WebCore20CircularSearchBuffer6lengthEv
-__ZN7WebCore18endVisiblePositionEPKNS_5RangeENS_9EAffinityE
-__ZN7WebCore20startVisiblePositionEPKNS_5RangeENS_9EAffinityE
-__ZN7WebCore8setStartEPNS_5RangeERKNS_15VisiblePositionE
-__ZN7WebCore24rangeCompliantEquivalentERKNS_15VisiblePositionE
-__ZN7WebCore13InlineTextBox20paintTextMatchMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleEPKNS_4FontE
-__ZN7WebCore8Document24setRenderedRectForMarkerEPNS_4NodeENS_14DocumentMarkerERKNS_7IntRectE
-__ZNK7WebCore5Frame31markedTextMatchesAreHighlightedEv
--[WebCoreFrameBridge searchFor:direction:caseSensitive:wrap:startInSelection:]
-__ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
--[WebCoreFrameBridge unmarkAllTextMatches]
--[WebCoreFrameBridge rectsForTextMatches]
-__ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
-__ZN7WebCore5Range15addLineBoxRectsERN3WTF6VectorINS_7IntRectELm0EEEb
-__ZN7WebCore10RenderText15addLineBoxRectsERN3WTF6VectorINS_7IntRectELm0EEEjjb
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE15reserveCapacityEm
-__ZNK7WebCore5Frame14selectionImageEb
-__ZNK7WebCore5Frame13imageFromRectE7_NSRect
-__ZN7WebCoreeqERKNS_5RangeES2_
--[WebCoreFrameBridge selectedString]
-__ZNK7WebCore5Frame12selectedTextEv
-__ZNK7WebCore24JSKeyboardEventPrototype9classInfoEv
-__ZNK7WebCore7UIEvent5pageYEv
-__ZNK7WebCore7UIEvent6layerYEv
-__ZNK7WebCore7UIEvent5pageXEv
-__ZNK7WebCore7UIEvent6layerXEv
-__ZN7WebCore6setEndEPNS_5RangeERKNS_15VisiblePositionE
-__ZN7WebCore41jsHTMLAnchorElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17HTMLAnchorElement13supportsFocusEv
-__ZN7WebCore12RenderObject32handleDynamicFloatPositionChangeEv
-__ZN7WebCore40jsDOMWindowPrototypeFunctionGetSelectionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow12getSelectionEv
-__ZN7WebCore12DOMSelectionC2EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_12DOMSelectionE
-__ZN7WebCore23JSDOMSelectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSDOMSelectionC1EPN3KJS8JSObjectEPNS_12DOMSelectionE
-__ZN7WebCore14JSDOMSelection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSDOMSelectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSDOMSelection16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore12DOMSelection10anchorNodeEv
-__ZNK7WebCore12DOMSelection10rangeCountEv
-__ZN7WebCore12DOMSelection15disconnectFrameEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSEventConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSEventConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS29windowProtoFuncNotImplementedEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore20CompositeEditCommand23breakOutOfEmptyListItemEv
-__ZN7WebCore22enclosingEmptyListItemERKNS_15VisiblePositionE
-__ZN7WebCore18enclosingListChildEPNS_4NodeE
-__ZN7WebCore13isListElementEPNS_4NodeE
-__ZN7WebCore44jsHTMLDocumentPrototypeFunctionCaptureEventsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12HTMLDocument13captureEventsEv
-__ZN7WebCore12RenderObject33getAbsoluteRepaintRectWithOutlineEi
-__ZNK7WebCore12RenderInline20isInlineContinuationEv
-__ZN7WebCore13InlineFlowBox10flowObjectEv
-__ZN3WTF7HashSetIPN7WebCore10RenderFlowENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore10RenderFlow12paintOutlineEPNS_15GraphicsContextEii
-__ZN7WebCore12RenderObject17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore15FocusController12advanceFocusENS_14FocusDirectionEPNS_13KeyboardEventEb
+__ZN7WebCore8Document17nextFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
+__ZNK7WebCore4Node19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCoreL25nextNodeWithExactTabIndexEPNS_4NodeEiPNS_13KeyboardEventE
+__ZN7WebCoreL17deepFocusableNodeENS_14FocusDirectionEPNS_4NodeEPNS_13KeyboardEventE
+__ZN7WebCore8Settings41setUsesDashboardBackwardCompatibilityModeEb
+__ZN7WebCore9FrameTree9clearNameEv
+__ZN7WebCore19InspectorController15disableProfilerEv
+__ZN7WebCore29setUsesTestModeFocusRingColorEb
+-[WebScriptObject JSObject]
+__ZN7WebCore16JSDOMWindowShell17putWithAttributesEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueEj
+-[WebScriptObject setValue:forKey:]
+__ZN3JSC8Bindings23convertObjcValueToValueEPNS_9ExecStateEPvNS0_13ObjcValueTypeEPNS0_10RootObjectE
+__ZN3JSC8Bindings17webUndefinedClassEv
+__ZN3JSC8Bindings20webScriptObjectClassEv
+__ZN3JSC8Bindings12ObjcInstanceC1EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings12ObjcInstanceC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZL11_didExecuteP15WebScriptObject
+__ZN3JSC8Bindings8Instance18didExecuteFunctionEv
+__ZN7WebCoreL30updateStyleIfNeededForBindingsEPN3JSC9ExecStateEPNS0_8JSObjectE
+__ZN7WebCore10RenderText17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore13InlineTextBox10isSelectedEii
+__ZNK7WebCore10RenderText18canBeSelectionLeafEv
+__ZN7WebCore10RenderText23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore12RenderObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore11RenderBlock23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore13AXObjectCache11getOrCreateEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache3getEPNS_12RenderObjectE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3getERKS3_
+__ZNK7WebCore12RenderObject9isListBoxEv
+__ZN7WebCore13AXObjectCache14nodeIsAriaTypeEPNS_4NodeENS_6StringE
+__ZN7WebCore25AccessibilityRenderObject6createEPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityRenderObjectC1EPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityRenderObjectC2EPNS_12RenderObjectE
+__ZN7WebCore19AccessibilityObjectC2Ev
+__ZN7WebCore25AccessibilityRenderObject11setAriaRoleEv
+__ZNK7WebCore25AccessibilityRenderObject26determineAriaRoleAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject12getAttributeERKNS_13QualifiedNameE
+__ZN7WebCore13AXObjectCache7getAXIDEPNS_19AccessibilityObjectE
+__ZNK7WebCore19AccessibilityObject10axObjectIDEv
+__ZNK3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E8containsIjNS_22IdentityHashTranslatorIjj
+__ZN3WTF7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEE3addERKj
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6expandEv
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6rehashEi
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E13allocateTableEi
+__ZN7WebCore19AccessibilityObject13setAXObjectIDEj
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3setERKS3_RKj
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_1
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3setERKjRKS4_
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14Pair
+__ZN7WebCore13AXObjectCache13attachWrapperEPNS_19AccessibilityObjectE
++[AccessibilityObjectWrapper initialize]
+-[AccessibilityObjectWrapper initWithAccessibilityObject:]
+-[AccessibilityObjectWrapper accessibilityFocusedUIElement]
+__ZN7WebCore25AccessibilityRenderObject18updateBackingStoreEv
+__ZNK7WebCore25AccessibilityRenderObject16focusedUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject27shouldFocusActiveDescendantEv
+__ZNK7WebCore25AccessibilityRenderObject17ariaRoleAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject22accessibilityIsIgnoredEv
+__ZNK7WebCore25AccessibilityRenderObject31isPresentationalChildOfAriaRoleEv
+__ZNK7WebCore25AccessibilityRenderObject12parentObjectEv
+__ZNK7WebCore25AccessibilityRenderObject33ariaRoleHasPresentationalChildrenEv
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZNK7WebCore12RenderObject10isMenuListEv
+__ZNK7WebCore25AccessibilityRenderObject21labelElementContainerEv
+__ZNK7WebCore25AccessibilityRenderObject9isControlEv
+__ZNK7WebCore25AccessibilityRenderObject9isHeadingEv
+__ZNK7WebCore25AccessibilityRenderObject9roleValueEv
+__ZNK7WebCore25AccessibilityRenderObject6isLinkEv
+-[AccessibilityObjectWrapper accessibilityAttributeValue:]
+__ZNK7WebCore25AccessibilityRenderObject9isWebAreaEv
+__ZNK7WebCore25AccessibilityRenderObject13isTextControlEv
+__ZNK7WebCore25AccessibilityRenderObject12isAttachmentEv
+__ZNK7WebCore25AccessibilityRenderObject5titleEv
+__ZNK7WebCore25AccessibilityRenderObject22ariaLabeledByAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject20ariaAccessiblityNameERKNS_6StringE
+__ZN7WebCoreL21accessibleNameForNodeEPNS_4NodeE
+__ZN7WebCore13AXObjectCache15childrenChangedEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache25postNotificationToElementEPNS_12RenderObjectERKNS_6StringE
+__ZNK7WebCore9DOMWindow27pendingUnloadEventListenersEv
+__ZN7WebCore13InlineTextBox14paintSelectionEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontE
+__ZN7WebCore13InlineTextBox17selectionStartEndERiS1_
+__ZN7WebCore15GraphicsContext20drawHighlightForTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEiRKNS_5ColorEii
+__ZNK7WebCore12RenderObject24selectionForegroundColorEv
+__ZNK7WebCore11RenderTheme30activeSelectionForegroundColorEv
+__ZNK7WebCore14RenderThemeMac33supportsSelectionForegroundColorsEv
+__ZNK7WebCore25AccessibilityRenderObject24accessibilityDescriptionEv
+__ZNK7WebCore25AccessibilityRenderObject24ariaDescribedByAttributeEv
+__ZNK7WebCore11HistoryItem8referrerEv
+__ZThn24_NK7WebCore14XMLHttpRequest10canSuspendEv
+__ZNK7WebCore14XMLHttpRequest10canSuspendEv
+__ZThn24_N7WebCore14XMLHttpRequest16contextDestroyedEv
+__ZN7WebCore14XMLHttpRequest16contextDestroyedEv
+__ZThn8_N7WebCore7ElementD0Ev
+__ZN7WebCore19HTMLTextAreaElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore19HTMLTextAreaElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore19HTMLTextAreaElement12defaultValueEv
+__ZN7WebCore27jsHTMLOptionElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26RenderTextControlMultiLine21preferredContentWidthEf
+__ZNK7WebCore17RenderTextControl18scrollbarThicknessEv
+__ZN7WebCore11RenderBlock22skipTrailingWhitespaceERNS_14InlineIteratorE
+__ZThn8_N7WebCore19HTMLTextAreaElementD0Ev
+__ZNK7WebCore16HTMLLabelElement11isFocusableEv
+__ZN7WebCore12RenderInline16positionForPointERKNS_8IntPointE
+__ZN7WebCore10IconLoader11stopLoadingEv
+__ZNK7WebCore10WheelEvent12isWheelEventEv
+__ZN7WebCore15getDOMStructureINS_12JSWheelEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore12JSWheelEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSWheelEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10WheelEventEEE
+__ZN7WebCore12JSWheelEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10WheelEventEEE
+__ZN7WebCore12JSWheelEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsWheelEventClientXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventClientYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWheelEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsWheelEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsWheelEventWheelDeltaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsWheelEventWheelDeltaXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsElementPrototypeFunctionContainsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13AXObjectCache13detachWrapperEPNS_19AccessibilityObjectE
+-[AccessibilityObjectWrapper detach]
+-[AccessibilityObjectWrapper unregisterUniqueIdForUIElement]
+__ZN7WebCore25AccessibilityRenderObject6detachEv
+__ZN7WebCore19AccessibilityObject13clearChildrenEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14shrinkCapacityEm
+__ZN7WebCore19AccessibilityObject6detachEv
+__ZN7WebCore13AXObjectCache10removeAXIDEPNS_19AccessibilityObjectE
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E4findIjNS_22IdentityHashTranslatorIjjS4_EE
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E47removeAndInvalidateWithoutEntryConsisten
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6removeEPj
+__ZN7WebCore25AccessibilityRenderObjectD0Ev
+__ZN7WebCore19AccessibilityObjectD2Ev
+__ZN7WebCore13AXObjectCache6removeEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache6removeEj
+__ZN3JSC8Bindings12ObjcInstanceD0Ev
+__ZN7WebCore13AXObjectCache21handleAriaRoleChangedEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache29handleFocusedUIElementChangedEv
+__ZN7WebCore7Element21updateFocusAppearanceEb
+__ZN7WebCoreL21ariaRoleToWebCoreRoleENS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringENS1_17AccessibilityRoleENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_17AccessibilityRoleEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_1
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_17AccessibilityRoleENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3getERKS2_
+__ZN7WebCore19AccessibilityObject13isARIAControlENS_17AccessibilityRoleE
+__ZN7WebCore19AccessibilityObject11isARIAInputENS_17AccessibilityRoleE
+-[AccessibilityObjectWrapper accessibilityActionNames]
+__ZNK7WebCore25AccessibilityRenderObject13actionElementEv
+__ZNK7WebCore25AccessibilityRenderObject18isFileUploadButtonEv
+__ZNK7WebCore25AccessibilityRenderObject13isImageButtonEv
+__ZNK7WebCore25AccessibilityRenderObject13isNativeImageEv
+__ZNK7WebCore25AccessibilityRenderObject13anchorElementEv
+__ZNK7WebCore25AccessibilityRenderObject13axObjectCacheEv
+__ZNK7WebCore25AccessibilityRenderObject8isAnchorEv
+__ZN7WebCore11RenderBlock17addFocusRingRectsEPNS_15GraphicsContextEii
 __ZN7WebCore4Node13aboutToUnloadEv
-__ZNK7WebCore23HTMLTableCaptionElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore23HTMLTableCaptionElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore23HTMLTableCaptionElement17endTagRequirementEv
-__ZNK7WebCore23HTMLTableCaptionElement11tagPriorityEv
-__ZNK7WebCore14DocumentLoader19originalRequestCopyEv
-__ZN7WebCore9DocLoader21decrementRequestCountEv
-__ZNK7WebCore8Document6domainEv
-__ZN7WebCore17SubresourceLoader6createEPNS_5FrameEPNS_23SubresourceLoaderClientERKNS_15ResourceRequestEbbb
-__ZNK7WebCore11FrameLoader16outgoingReferrerEv
-__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IaEEEESB_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S8_EEEENS_17HashTableIteratorIS3_S5_S7_S8_SD_SB_EERKT_
-__ZNK7WebCore19ResourceRequestBase13isConditionalEv
-__ZNK7WebCore11FrameLoader15originalRequestEv
-__ZN7WebCore19ResourceRequestBase14setCachePolicyENS_26ResourceRequestCachePolicyE
-__ZN7WebCore17SubresourceLoaderC2EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
-__ZN7WebCore14DocumentLoader20addSubresourceLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore17SubresourceLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader22didTellClientAboutLoadERKNS_6StringE
-__ZN7WebCore14ResourceLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore17SubresourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore11FrameLoader32assignIdentifierToInitialRequestEmRKNS_15ResourceRequestE
-__ZNK7WebCore11FrameLoader14willUseArchiveEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getEPS3_
-__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
-__ZN7WebCore5Cache16resourceAccessedEPNS_14CachedResourceE
-__ZN7WebCore5Cache17removeFromLRUListEPNS_14CachedResourceE
-__ZN7WebCore5Cache15insertInLRUListEPNS_14CachedResourceE
-__ZN7WebCore5Cache10lruListForEPNS_14CachedResourceE
-__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE4growEm
-__ZN7WebCore9DocLoader22checkCacheObjectStatusEPNS_14CachedResourceE
-__ZN7WebCore14CachedResource3refEPNS_20CachedResourceClientE
-__ZN7WebCore5Cache22addToLiveResourcesSizeEPNS_14CachedResourceE
-__ZN3WTF7HashMapIPN7WebCore20CachedResourceClientEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN7WebCore16imageConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLImageElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore15HTMLImageLoaderC2EPNS_7ElementE
-__ZNK7WebCore16HTMLImageElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLImageElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLImageLoader17updateFromElementEv
-__ZNK7WebCore7Element24imageSourceAttributeNameEv
-__ZN7WebCore15HTMLImageLoader15setLoadingImageEPNS_11CachedImageE
-__ZN7WebCore11CachedImage3refEPNS_20CachedResourceClientE
-__ZNK7WebCore11CachedImage9imageRectEv
-__ZNK7WebCore16HTMLImageElement17endTagRequirementEv
-__ZNK7WebCore16HTMLImageElement11tagPriorityEv
-__ZN7WebCore16HTMLImageElement20insertedIntoDocumentEv
-__ZN7WebCore12HTMLDocument12addNamedItemERKNS_6StringE
-__ZN7WebCore12addItemToMapERN3WTF7HashMapIPNS_10StringImplEiNS_10StringHashENS0_10HashTraitsIS3_EENS5_IiEEEERKNS_6StringE
-__ZN7WebCore12HTMLDocument20addDocExtraNamedItemERKNS_6StringE
-__ZN7WebCore16HTMLImageElement6attachEv
-__ZNK7WebCore8Document12getCSSTargetEv
-__ZNK7WebCore14CachedResource9isExpiredEv
-__ZNK7WebCore20ResourceResponseBase14expirationDateEv
-__ZN7WebCore11FrameLoader7canLoadERKNS_14CachedResourceEPKNS_8DocumentE
-__ZNK7WebCore12RenderObject15containingBlockEv
-__ZN7WebCore15RenderTableCellC2EPNS_4NodeE
-__ZN7WebCore15RenderTableCell17updateFromElementEv
-__ZN7WebCore15RenderTableCell8setStyleEPNS_11RenderStyleE
-__ZN7WebCore15RenderTableCell13requiresLayerEv
-__ZN7WebCore14RenderTableRow8addChildEPNS_12RenderObjectES2_
-__ZNK7WebCore15RenderTableCell11isTableCellEv
-__ZN7WebCore18RenderTableSection7addCellEPNS_15RenderTableCellEPNS_12RenderObjectE
-__ZN7WebCore11HTMLElement16addHTMLAlignmentEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEii
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiibb
-__ZN7WebCore36htmlAttributeHasCaseInsensitiveValueERKNS_13QualifiedNameE
-__ZN7WebCore17addLocalNameToSetEPN3WTF7HashSetIPNS_16AtomicStringImplENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEERKNS_13QualifiedNameE
-__ZNK7WebCore18NamedMappedAttrMap14mapsEquivalentEPKS0_
-__ZNK7WebCore18NamedMappedAttrMap9declCountEv
-__ZN7WebCore11RenderTable12appendColumnEi
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14expandCapacityEm
-__ZN7WebCore18RenderTableSection12appendColumnEi
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIiLm0EE4growEm
-__ZN3WTF6VectorIiLm0EE14expandCapacityEm
-__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyCSSValueEi
-__ZNK7WebCore23DeprecatedValueListImpl8fromLastEv
-__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEt
-__ZN7WebCore10HTMLParser18isResidualStyleTagERKNS_12AtomicStringE
-__ZNK7WebCore13ContainerNode16virtualLastChildEv
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore13brConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLBRElementC2EPNS_8DocumentE
-__ZNK7WebCore13HTMLBRElement17endTagRequirementEv
-__ZNK7WebCore13HTMLBRElement11tagPriorityEv
-__ZN7WebCore13HTMLBRElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore8RenderBRC2EPNS_4NodeE
-__ZN7WebCore8RenderBR8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderObject20createAnonymousBlockEv
-__ZNK7WebCore8RenderBR4isBREv
--[WebCoreFrameBridge stringByEvaluatingJavaScriptFromString:]
-__ZN7WebCore16HTMLImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderImageC2EPNS_4NodeE
-__ZN7WebCore14RenderReplacedC2EPNS_4NodeERKNS_7IntSizeE
-__ZN7WebCore11RenderImage13updateAltTextEv
-__ZNK7WebCore16HTMLImageElement7altTextEv
-__ZNK7WebCore12RenderObject10firstChildEv
-__ZNK7WebCore11RenderImage7isImageEv
-__ZN7WebCore11RenderImage14setCachedImageEPNS_11CachedImageE
-__ZNK7WebCore12RenderObject4isBREv
-__ZNK7WebCore12RenderObject25backslashAsCurrencySymbolEv
-__ZN7WebCore10StringImpl7replaceEtt
-__ZN7WebCore10RenderText8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore12RenderObject9isSVGTextEv
-__ZNK7WebCore4Node15isIndeterminateEv
-__ZNK7WebCore4Node9isCheckedEv
-__ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
-__ZN7WebCore6Editor9copyImageERKNS_13HitTestResultE
-__ZN7WebCore10Pasteboard17generalPasteboardEv
-__ZN7WebCore10PasteboardC2EP12NSPasteboard
-__ZN7WebCore10Pasteboard10writeImageEPNS_4NodeERKNS_4KURLERKNS_6StringE
-__ZN7WebCore21writableTypesForImageEv
-__ZN7WebCore19writableTypesForURLEv
-__ZN7WebCore10Pasteboard8writeURLEP12NSPasteboardP7NSArrayRKNS_4KURLERKNS_6StringEPNS_5FrameE
-_suggestedFilenameWithMIMEType
-__ZN7WebCore16MIMETypeRegistry24getExtensionsForMIMETypeERKNS_6StringE
-__ZN7WebCore10Pasteboard32writeFileWrapperAsRTFDAttachmentEP13NSFileWrapper
-__ZN7WebCore5Image19drawPatternCallbackEPvP9CGContext
-__ZN7WebCore18marqueeConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLMarqueeElementC1EPNS_8DocumentE
-__ZNK7WebCore18HTMLMarqueeElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore18HTMLMarqueeElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore18HTMLMarqueeElement17endTagRequirementEv
-__ZNK7WebCore18HTMLMarqueeElement11tagPriorityEv
-__ZN7WebCore16StyleMarqueeDataC1ERKS0_
-__ZN7WebCore7MarqueeC1EPNS_11RenderLayerE
-__ZN7WebCore7Marquee18updateMarqueeStyleEv
-__ZNK7WebCore7Marquee12isHorizontalEv
-__ZNK7WebCore7Marquee9directionEv
-__ZNK7WebCore7Marquee12marqueeSpeedEv
-__ZN7WebCore7Marquee21updateMarqueePositionEv
-__ZN7WebCore7Marquee15computePositionENS_17EMarqueeDirectionEb
-__ZN7WebCore7Marquee5startEv
-__ZN7WebCore5TimerINS_7MarqueeEE5firedEv
-__ZN7WebCore7Marquee10timerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore11HistoryItem12formReferrerEv
-__ZNK7WebCore11HistoryItem15formContentTypeEv
-__ZN7WebCore14ResourceHandle17willLoadFromCacheERNS_15ResourceRequestE
-__ZNK7WebCore15HTMLLinkElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore15HTMLBodyElement14isURLAttributeEPNS_9AttributeE
--[DOMHTMLScriptElement src]
--[DOMHTMLLinkElement rel]
--[DOMHTMLLinkElement href]
--[DOMHTMLBodyElement background]
-__ZNK7WebCore15HTMLBodyElement10backgroundEv
--[DOMHTMLInputElement src]
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_EEEENS_7PtrHashIS4_EENS9_IS4_EENS9_ISD_EEE3setEPS3_RKSD_
-__ZN7WebCore21updateResourceRequestEPNS_17InspectorResourceERKNS_15ResourceRequestE
-__ZN7WebCore19InspectorController11addResourceEPNS_17InspectorResourceE
-__ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
-__ZN3WTF9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS2_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS8_IiEEEES9_E3addIxS2_NS_22IdentityHashTranslatorIxS2_S6_EEEES1_INS_17HashTableIteratorIxS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN7WebCore22updateResourceResponseEPNS_17InspectorResourceERKNS_16ResourceResponseE
-__ZN7WebCore19InspectorController14pruneResourcesEPN3WTF7HashMapIxNS1_6RefPtrINS_17InspectorResourceEEENS1_7IntHashIyEENS1_10HashTraitsIxEENS8_IS5_EEEEPNS_14DocumentLoaderE
-__ZN7WebCore19InspectorController14removeResourceEPNS_17InspectorResourceE
-__ZN3WTF9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS2_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS8_IiEEEES9_E4findIxNS_22IdentityHashTranslatorIxS2_S6_EEEENS_17HashTableIteratorIxS2_S4_S6_SB_S9_EERKT_
-__ZN7WebCore19InspectorController4showEv
-__ZN7WebCore5Frame21setProhibitsScrollingEb
-__ZN7WebCore9CSSParser19parseBackgroundSizeEv
-__ZN7WebCore9CSSParser16parseBorderImageEib
-__ZN7WebCore23BorderImageParseContext17commitBorderImageEPNS_9CSSParserEib
-__ZN7WebCore19CSSBorderImageValueC2EN3WTF10PassRefPtrINS_13CSSImageValueEEENS2_INS_4RectEEEii
-__ZN7WebCore9CSSParser24parseTransitionShorthandEb
-__ZN7WebCore9CSSParser23parseTransitionPropertyEiRN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore9CSSParser23parseTransitionPropertyEv
-__ZNK7WebCore6String4utf8Ev
-__ZN7WebCore9CSSParser18addTransitionValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
-__ZN7WebCore9CSSParser23parseTransitionDurationEv
-__ZN7WebCore9CSSParser29parseTransitionTimingFunctionEv
-__ZN7WebCore19InspectorController27windowScriptObjectAvailableEv
-__ZN7WebCore32JSCSSStyleDeclarationConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16CSSStyleSelector17mapBackgroundSizeEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore11RenderStyle10setContentEPNS_14CachedResourceEb
-__ZN7WebCore11RenderStyle17accessTransitionsEv
-__ZN7WebCore10TransitionC1Ev
-__ZN7WebCore16CSSStyleSelector21mapTransitionPropertyEPNS_10TransitionEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector21mapTransitionDurationEPNS_10TransitionEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector27mapTransitionTimingFunctionEPNS_10TransitionEPNS_8CSSValueE
-__ZN7WebCore10Transition19fillUnsetPropertiesEv
-__ZN7WebCore15BackgroundLayer15cullEmptyLayersEv
-__ZN7WebCore15BackgroundLayer19fillUnsetPropertiesEv
-__ZNK7WebCore15BackgroundLayer13hasFixedImageEv
-__ZN7WebCore16localizedStringsEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController19localizedStringsURLEv
-__ZNK7WebCore10TransitioneqERKS0_
-__ZN7WebCore19AnimationController24updateImplicitAnimationsEPNS_12RenderObjectEPNS_11RenderStyleE
-__ZN7WebCore26AnimationControllerPrivate3getEPNS_12RenderObjectE
-__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_26CompositeImplicitAnimationENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore26CompositeImplicitAnimation7animateEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore17ImplicitAnimationC1EPKNS_10TransitionE
-__ZN3WTF7HashMapIiPN7WebCore17ImplicitAnimationENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZN7WebCore17ImplicitAnimation7animateEPNS_26CompositeImplicitAnimationEPNS_12RenderObjectEPNS_11RenderStyleES6_RS6_
-__ZN7WebCore17ImplicitAnimation5resetEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore26AnimationControllerPrivate11updateTimerEv
-__ZNK7WebCore26CompositeImplicitAnimation9animatingEv
-__ZN7WebCore26AnimationControllerPrivate5clearEPNS_12RenderObjectE
-__ZZN7WebCore8platformEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_E8platform
-__ZN7WebCore17canvasConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLCanvasElementC1EPNS_8DocumentE
-__ZN7WebCore19createCanvasWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLCanvasElementC1EPN3KJS8JSObjectEPNS_17HTMLCanvasElementE
-__ZN7WebCore19JSHTMLCanvasElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLCanvasElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLCanvasElement9classInfoEv
+-[AccessibilityObjectWrapper role]
+__ZL19roleValueToNSStringN7WebCore17AccessibilityRoleE
+__ZL26createAccessibilityRoleMapv
+__ZN3WTF7HashMapIiP8NSStringNS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiP8NSStringENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_
+__ZNK3WTF7HashMapIiP8NSStringNS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore25AccessibilityRenderObject15childrenChangedEv
+__ZNK7WebCore25AccessibilityRenderObject27isAccessibilityRenderObjectEv
+__ZNK7WebCore17HTMLAnchorElement13supportsFocusEv
+__ZN7WebCore13AXObjectCache16postNotificationEPNS_12RenderObjectERKNS_6StringE
+__ZNK7WebCore25AccessibilityRenderObject16observableObjectEv
+__ZNK7WebCore25AccessibilityRenderObject4textEv
+__ZNK7WebCore25AccessibilityRenderObject15isPasswordFieldEv
+__ZNK7WebCore25AccessibilityRenderObject19isNativeTextControlEv
+__ZN7WebCore19HTMLTextAreaElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore19HTMLTextAreaElement20shouldUseInputMethodEv
+__ZN7WebCore19HTMLTextAreaElement21updateFocusAppearanceEb
+__ZN7WebCore19HTMLTextAreaElement17setSelectionRangeEii
+__ZNK7WebCore19HTMLTextAreaElement16isMouseFocusableEv
+__ZN7WebCore26RenderTextControlMultiLine14cacheSelectionEii
+__ZN7WebCore26RenderTextControlMultiLine12forwardEventEPNS_5EventE
+__ZNK7WebCore25AccessibilityRenderObject7isImageEv
+__ZN7WebCore25AccessibilityRenderObject12headingLevelEPNS_4NodeE
+__ZNK7WebCore19AccessibilityObject21parentObjectUnignoredEv
+-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]
+__ZN7WebCore25AccessibilityRenderObject8childrenEv
+__ZN7WebCore25AccessibilityRenderObject11addChildrenEv
+__ZNK7WebCore25AccessibilityRenderObject15canHaveChildrenEv
+__ZNK7WebCore25AccessibilityRenderObject10firstChildEv
+__ZNK7WebCore19AccessibilityObject11hasChildrenEv
+__ZN7WebCore21AccessibilityARIAGrid6createEPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityARIAGridC1EPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityARIAGridC2EPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTableC2EPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTable36isTableExposableThroughAccessibilityEv
+__ZNK7WebCore18AccessibilityTable22accessibilityIsIgnoredEv
+__ZNK7WebCore18AccessibilityTable11isDataTableEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE15reserveCapacityEm
+__ZNK7WebCore25AccessibilityRenderObject11nextSiblingEv
+__ZNK7WebCore25AccessibilityRenderObject19mouseButtonListenerEv
+__ZNK7WebCore12RenderObject13isRenderImageEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEC2ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE6shrinkEm
+-[AccessibilityObjectWrapper accessibilityAttributeNames]
+__ZNK7WebCore18AccessibilityTable9roleValueEv
+-[AccessibilityObjectWrapper subrole]
+__ZNK7WebCore19AccessibilityObject6isListEv
+-[AccessibilityObjectWrapper roleDescription]
+__ZN7WebCore18AccessibilityTable13clearChildrenEv
+__ZN7WebCore21AccessibilityARIAGrid11addChildrenEv
+__ZN7WebCore24AccessibilityARIAGridRow6createEPNS_12RenderObjectE
+__ZN7WebCore24AccessibilityARIAGridRowC1EPNS_12RenderObjectE
+__ZN7WebCore24AccessibilityARIAGridRowC2EPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityTableRowC2EPNS_12RenderObjectE
+__ZNK7WebCore21AccessibilityTableRow22accessibilityIsIgnoredEv
+__ZNK7WebCore21AccessibilityTableRow10isTableRowEv
+__ZNK7WebCore24AccessibilityARIAGridRow11parentTableEv
+__ZN7WebCore21AccessibilityARIAGrid8addChildEPNS_19AccessibilityObjectERN3WTF7HashSetIS2_NS3_7PtrHashIS2_EENS3_10HashTraitsIS2_
+__ZNK3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8c
+__ZNK7WebCore21AccessibilityTableRow9roleValueEv
+__ZN7WebCore25AccessibilityARIAGridCell6createEPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityARIAGridCellC1EPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityARIAGridCellC2EPNS_12RenderObjectE
+__ZN7WebCore22AccessibilityTableCellC2EPNS_12RenderObjectE
+__ZNK7WebCore22AccessibilityTableCell22accessibilityIsIgnoredEv
+__ZNK7WebCore22AccessibilityTableCell11isTableCellEv
+__ZNK7WebCore25AccessibilityARIAGridCell11parentTableEv
+__ZN3WTF7HashSetIPN7WebCore19AccessibilityObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6ex
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6re
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13a
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15d
+__ZN7WebCore13AXObjectCache11getOrCreateENS_17AccessibilityRoleE
+__ZN7WebCore24AccessibilityTableColumn6createEv
+__ZN7WebCore24AccessibilityTableColumnC1Ev
+__ZN7WebCore24AccessibilityTableColumnC2Ev
+__ZN7WebCore24AccessibilityTableColumn14setParentTableEPNS_18AccessibilityTableE
+__ZN7WebCore18AccessibilityTable15headerContainerEv
+__ZN7WebCore33AccessibilityTableHeaderContainer6createEv
+__ZN7WebCore33AccessibilityTableHeaderContainerC1Ev
+__ZN7WebCore33AccessibilityTableHeaderContainerC2Ev
+__ZL16convertToNSArrayRKN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore19AccessibilityObject12isAttachmentEv
+__ZNK7WebCore25AccessibilityRenderObject8helpTextEv
+__ZNK7WebCore25AccessibilityRenderObject21frameViewIfRenderViewEv
+__ZNK7WebCore18AccessibilityTable5titleEv
+__ZNK7WebCore25AccessibilityRenderObject4sizeEv
+__ZNK7WebCore25AccessibilityRenderObject11elementRectEv
+__ZNK7WebCore25AccessibilityRenderObject17isCheckboxOrRadioEv
+__ZNK7WebCore25AccessibilityRenderObject15boundingBoxRectEv
+__ZNK7WebCore25AccessibilityRenderObject12isInputImageEv
+__ZNK7WebCore25AccessibilityRenderObject19isProgressIndicatorEv
+__ZNK7WebCore25AccessibilityRenderObject8isSliderEv
+__ZNK7WebCore25AccessibilityRenderObject11hasIntValueEv
+__ZNK7WebCore25AccessibilityRenderObject11stringValueEv
+__ZNK7WebCore25AccessibilityRenderObject9isFocusedEv
+__ZNK7WebCore25AccessibilityRenderObject9isEnabledEv
+__ZNK7WebCore25AccessibilityRenderObject17documentFrameViewEv
+__ZNK7WebCore19AccessibilityObject10isTableRowEv
+__ZNK7WebCore19AccessibilityObject13isTableColumnEv
+__ZNK7WebCore19AccessibilityObject11isTableCellEv
+__ZNK7WebCore19AccessibilityObject9isListBoxEv
+-[AccessibilityObjectWrapper textMarkerRangeForSelection]
+__ZNK7WebCore25AccessibilityRenderObject9selectionEv
+__ZN7WebCore15startOfDocumentEPKNS_4NodeE
+__ZL28textMarkerForVisiblePositionRKN7WebCore15VisiblePositionE
+__ZN7WebCore13endOfDocumentEPKNS_4NodeE
+__ZNK7WebCore25AccessibilityRenderObject9isVisitedEv
+__ZNK7WebCore25AccessibilityRenderObject16linkedUIElementsERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject10isSelectedEv
+__ZL15blockquoteLevelPN7WebCore12RenderObjectE
+__ZN7WebCore18AccessibilityTable4rowsEv
+__ZN7WebCore18AccessibilityTable7columnsEv
+__ZN7WebCore18AccessibilityTable5cellsERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE6appendIS4_EEvPKT_m
+__ZN7WebCore18AccessibilityTable13columnHeadersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN7WebCore24AccessibilityTableColumn12headerObjectEv
+__ZNK7WebCore21AccessibilityARIAGrid11isAriaTableEv
+__ZN7WebCore24AccessibilityTableColumn8childrenEv
+__ZN7WebCore24AccessibilityTableColumn11addChildrenEv
+__ZN7WebCore18AccessibilityTable8rowCountEv
+__ZN7WebCore21AccessibilityARIAGrid19cellForColumnAndRowEjj
+__ZN7WebCore18AccessibilityTable11columnCountEv
+__ZNK7WebCore22AccessibilityTableCell9roleValueEv
+__ZN7WebCore18AccessibilityTable10rowHeadersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN7WebCore24AccessibilityARIAGridRow12headerObjectEv
+__ZNK7WebCore16HTMLTableElement7captionEv
+-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]
+__ZNK7WebCore19AccessibilityObject11isDataTableEv
+__ZN7WebCore25AccessibilityARIAGridCell13rowIndexRangeERSt4pairIiiE
+__ZN7WebCore25AccessibilityARIAGridCell16columnIndexRangeERSt4pairIiiE
+__ZN7WebCore19AccessibilityObject18updateBackingStoreEv
+__ZNK7WebCore19AccessibilityObject15isPasswordFieldEv
+__ZNK7WebCore19AccessibilityObject9isWebAreaEv
+__ZNK7WebCore19AccessibilityObject13isTextControlEv
+__ZNK7WebCore19AccessibilityObject8isAnchorEv
+__ZNK7WebCore19AccessibilityObject7isImageEv
+__ZNK7WebCore19AccessibilityObject6isLinkEv
+__ZNK7WebCore24AccessibilityTableColumn13isTableColumnEv
+__ZNK7WebCore24AccessibilityTableColumn9roleValueEv
+__ZNK7WebCore19AccessibilityObject8helpTextEv
+__ZNK7WebCore19AccessibilityObject27isAccessibilityRenderObjectEv
+__ZNK7WebCore24AccessibilityTableColumn12parentObjectEv
+__ZNK7WebCore19AccessibilityObject5titleEv
+__ZNK7WebCore24AccessibilityTableColumn4sizeEv
+__ZNK7WebCore24AccessibilityTableColumn11elementRectEv
+__ZNK7WebCore19AccessibilityObject24accessibilityDescriptionEv
+__ZNK7WebCore19AccessibilityObject19isProgressIndicatorEv
+__ZNK7WebCore19AccessibilityObject8isSliderEv
+__ZNK7WebCore19AccessibilityObject11hasIntValueEv
+__ZNK7WebCore19AccessibilityObject11stringValueEv
+__ZNK7WebCore19AccessibilityObject9isFocusedEv
+__ZNK7WebCore19AccessibilityObject9isEnabledEv
+__ZNK7WebCore19AccessibilityObject17documentFrameViewEv
+__ZNK7WebCore19AccessibilityObject9selectionEv
+__ZNK7WebCore19AccessibilityObject9isVisitedEv
+__ZNK7WebCore19AccessibilityObject16linkedUIElementsERN3WTF6VectorINS1_6RefPtrIS0_EELm0EEE
+__ZNK7WebCore19AccessibilityObject10isSelectedEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer9roleValueEv
+__ZNK7WebCore19AccessibilityObject12isInputImageEv
+__ZNK7WebCore19AccessibilityObject9isControlEv
+__ZNK7WebCore19AccessibilityObject7isGroupEv
+__ZNK7WebCore19AccessibilityObject6isMenuEv
+__ZNK7WebCore19AccessibilityObject9isMenuBarEv
+__ZNK7WebCore19AccessibilityObject12isMenuButtonEv
+__ZNK7WebCore19AccessibilityObject10isMenuItemEv
+__ZN7WebCore33AccessibilityTableHeaderContainer8childrenEv
+__ZN7WebCore33AccessibilityTableHeaderContainer11addChildrenEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer12parentObjectEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer4sizeEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer11elementRectEv
+__ZN7WebCore22jsHTMLElementInnerTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21AccessibilityARIAGridD0Ev
+__ZN7WebCore18AccessibilityTableD2Ev
+__ZN7WebCore25AccessibilityRenderObjectD2Ev
+__ZN7WebCore24AccessibilityARIAGridRowD0Ev
+__ZN7WebCore21AccessibilityTableRowD2Ev
+__ZN7WebCore24AccessibilityTableColumnD0Ev
+__ZN7WebCore25AccessibilityARIAGridCellD0Ev
+__ZN7WebCore22AccessibilityTableCellD2Ev
+__ZN7WebCore33AccessibilityTableHeaderContainerD0Ev
+__ZN7WebCoreL17canvasConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLCanvasElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLCanvasElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore17HTMLCanvasElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore17HTMLCanvasElement5resetEv
-__ZN7WebCore19JSHTMLCanvasElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore46jsHTMLCanvasElementPrototypeFunctionGetContextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore17HTMLCanvasElement17endTagRequirementEv
+__ZNK7WebCore17HTMLCanvasElement11tagPriorityEv
+__ZN7WebCore17HTMLCanvasElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16RenderHTMLCanvasC1EPNS_17HTMLCanvasElementE
+__ZN7WebCore16RenderHTMLCanvasC2EPNS_17HTMLCanvasElementE
+-[AccessibilityObjectWrapper renderWidgetChildren]
+__ZNK7WebCore25AccessibilityRenderObject6widgetEv
+__ZNK7WebCore25AccessibilityRenderObject3urlEv
+__ZNK7WebCore25AccessibilityRenderObject9accessKeyEv
+__ZN7WebCoreL30createHTMLCanvasElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLCanvasElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLCanvasElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLCanvasElementEEE
+__ZN7WebCore19JSHTMLCanvasElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLCanvasElementEEE
+__ZN7WebCore19JSHTMLCanvasElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLCanvasElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore46jsHTMLCanvasElementPrototypeFunctionGetContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSHTMLCanvasElement9classInfoEv
 __ZN7WebCore17HTMLCanvasElement10getContextERKNS_6StringE
 __ZN7WebCore24CanvasRenderingContext2DC1EPNS_17HTMLCanvasElementE
+__ZN7WebCore24CanvasRenderingContext2DC2EPNS_17HTMLCanvasElementE
 __ZN7WebCore24CanvasRenderingContext2D5StateC1Ev
+__ZN7WebCore24CanvasRenderingContext2D5StateC2Ev
 __ZN7WebCore11CanvasStyleC1ERKNS_6StringE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_24CanvasRenderingContext2DE
-__ZN7WebCore35JSCanvasRenderingContext2DPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore26JSCanvasRenderingContext2DC1EPN3KJS8JSObjectEPNS_24CanvasRenderingContext2DE
-__ZN7WebCore26JSCanvasRenderingContext2D18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35JSCanvasRenderingContext2DPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClearRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore26JSCanvasRenderingContext2D9classInfoEv
-__ZN7WebCore24CanvasRenderingContext2D9clearRectEffffRi
+__ZN7WebCore11CanvasStyleC2ERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_24CanvasRenderingContext2DE
+__ZN7WebCore26JSCanvasRenderingContext2D15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24CanvasRenderingContext2D3refEv
+__ZN7WebCore26JSCanvasRenderingContext2DC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24CanvasRenderingContext2DEEE
+__ZN7WebCore26JSCanvasRenderingContext2DC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24CanvasRenderingContext2DEEE
+__ZN7WebCore26JSCanvasRenderingContext2D3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore38setJSCanvasRenderingContext2DLineWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D12setLineWidthEf
 __ZNK7WebCore24CanvasRenderingContext2D14drawingContextEv
 __ZNK7WebCore17HTMLCanvasElement14drawingContextEv
-__ZNK7WebCore17HTMLCanvasElement20createDrawingContextEv
-__ZN7WebCore24CanvasRenderingContext2D8willDrawERKNS_9FloatRectE
-__ZNK7WebCore15GraphicsContext6getCTMEv
-__ZN7WebCore15AffineTransformC1E17CGAffineTransform
-__ZNK7WebCore15AffineTransform7mapRectERKNS_9FloatRectE
-__ZN7WebCore17HTMLCanvasElement8willDrawERKNS_9FloatRectE
-__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionBeginPathEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore17HTMLCanvasElement6bufferEv
+__ZNK7WebCore17HTMLCanvasElement17createImageBufferEv
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatSizeE
+__ZN7WebCore6Chrome11scaleFactorEv
+__ZN7WebCore11ImageBufferC1ERKNS_7IntSizeEbRb
+__ZN7WebCore11ImageBufferC2ERKNS_7IntSizeEbRb
+__ZN7WebCore15ImageBufferDataC1ERKNS_7IntSizeE
+__ZN7WebCore15ImageBufferDataC2ERKNS_7IntSizeE
+__ZNK7WebCore11ImageBuffer7contextEv
+__ZN7WebCore15GraphicsContext26setShadowsIgnoreTransformsEb
+__ZN7WebCore36setJSCanvasRenderingContext2DLineCapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D10setLineCapERKNS_6StringE
+__ZN7WebCore12parseLineCapERKNS_6StringERNS_7LineCapE
+__ZN7WebCore15GraphicsContext10setLineCapENS_7LineCapE
+__ZN7WebCore26JSCanvasRenderingContext2D18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35JSCanvasRenderingContext2DPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionBeginPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore26JSCanvasRenderingContext2D9classInfoEv
 __ZN7WebCore24CanvasRenderingContext2D9beginPathEv
 __ZN7WebCore4Path5clearEv
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionMoveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D6moveToEff
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionLineToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D6lineToEff
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClosePathEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D9closePathEv
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionSaveEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4saveEv
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE15reserveCapacityEm
-__ZN7WebCore26JSCanvasRenderingContext2D3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore26JSCanvasRenderingContext2D16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore24CanvasRenderingContext2D13setShadowBlurEf
-__ZN7WebCore24CanvasRenderingContext2D11applyShadowEv
-__ZN7WebCore9CSSParser10parseColorERjRKNS_6StringEb
-__ZNK7WebCore9FloatSizecv6CGSizeEv
-__ZN7WebCore24CanvasRenderingContext2D14setShadowColorERKNS_6StringE
-__ZN7WebCore9CSSParser10parseColorEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
-__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetXEf
-__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetYEf
-__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeStyleEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore17toHTMLCanvasStyleEPN3KJS9ExecStateEPNS0_7JSValueE
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore26JSCanvasRenderingContext2D10strokeRectEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK3JSC7JSValue7toFloatEPNS_9ExecStateE
+__ZN7WebCore24CanvasRenderingContext2D10strokeRectEffff
+__ZN7WebCoreL21validateRectForCanvasERfS0_S0_S0_
+__ZN7WebCore24CanvasRenderingContext2D10strokeRectEfffff
+__ZN7WebCore24CanvasRenderingContext2D8willDrawERKNS_9FloatRectEj
+__ZN7WebCore9FloatRect5uniteERKS0_
+__ZN7WebCore17HTMLCanvasElement8willDrawERKNS_9FloatRectE
+__ZN7WebCore7mapRectERKNS_9FloatRectES2_S2_
+__ZN7WebCore9FloatRect9intersectERKS0_
+__ZN7WebCore15GraphicsContext10strokeRectERKNS_9FloatRectEf
+__ZN7WebCore40setJSCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeStyleEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL17toHTMLCanvasStyleEPN3JSC9ExecStateENS0_7JSValueE
 __ZN7WebCore24CanvasRenderingContext2D14setStrokeStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
 __ZN7WebCore11CanvasStyle16applyStrokeColorEPNS_15GraphicsContextE
-__ZN7WebCore24CanvasRenderingContext2D12setLineWidthEf
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionStrokeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore5ColorC1ERKNS_6StringE
+__ZN7WebCore5ColorC2ERKNS_6StringE
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D6moveToEff
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionLineToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D6lineToEff
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionStrokeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore24CanvasRenderingContext2D6strokeEv
 __ZNK7WebCore4Path7isEmptyEv
+__ZN7WebCore15GraphicsContext9beginPathEv
+__ZN7WebCore4Path18strokeBoundingRectEPNS_18StrokeStyleApplierE
+__ZN7WebCoreL20createScratchContextEv
+__ZN7WebCoreL15putBytesNowhereEPvPKvm
+__ZN7WebCore24CanvasStrokeStyleApplier11strokeStyleEPNS_15GraphicsContextE
+__ZNK7WebCore24CanvasRenderingContext2D9lineWidthEv
+__ZN7WebCore15GraphicsContext11setLineJoinENS_8LineJoinE
+__ZNK7WebCore24CanvasRenderingContext2D10miterLimitEv
+__ZN7WebCore15GraphicsContext13setMiterLimitEf
+__ZN7WebCore15GraphicsContext10strokePathEv
 __ZN7WebCore24CanvasRenderingContext2D46clearPathForDashboardBackwardCompatibilityModeEv
-__ZN7WebCore50jsCanvasRenderingContext2DPrototypeFunctionRestoreEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D7restoreEv
+__ZN7WebCore16RenderHTMLCanvas13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore17HTMLCanvasElement5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZNK7WebCore11ImageBuffer5imageEv
+__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
+__ZN7WebCore11BitmapImageC2EP7CGImagePNS_13ImageObserverE
+__ZN7WebCore26JSCanvasRenderingContext2DD1Ev
+__ZN7WebCore26JSCanvasRenderingContext2DD2Ev
+__ZN7WebCore24CanvasRenderingContext2D5derefEv
+__ZN7WebCore19JSHTMLCanvasElementD1Ev
+__ZN7WebCore16RenderHTMLCanvasD0Ev
+__ZNK7WebCore19AccessibilityObject29accessibilityIgnoreAttachmentEv
+-[AccessibilityObjectWrapper attachmentView]
+__ZNK7WebCore25AccessibilityRenderObject23widgetForAttachmentViewEv
+-[AccessibilityObjectWrapper accessibilityIsIgnored]
+-[AccessibilityObjectWrapper _accessibilityParentForSubview:]
+__ZNK7WebCore25AccessibilityRenderObject7isGroupEv
+__ZNK7WebCore25AccessibilityRenderObject14titleUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject10isFieldsetEv
+__ZNK7WebCore25AccessibilityRenderObject21exposesTitleUIElementEv
+__ZN7WebCore13AXWebAreaTextEv
+__ZN7WebCore10RenderView13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore25AccessibilityRenderObject16getDocumentLinksERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject8isLoadedEv
+__ZNK7WebCore25AccessibilityRenderObject11layoutCountEv
+__ZN7WebCore35JSCanvasRenderingContext2DPrototypeD1Ev
+__ZN7WebCore28JSHTMLCanvasElementPrototypeD1Ev
+__ZN7WebCore17HTMLCanvasElementD0Ev
+__ZN7WebCore11ImageBufferD1Ev
+__ZN7WebCore11ImageBufferD2Ev
 __ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE6shrinkEm
-__ZN7WebCore24CanvasRenderingContext2D27setGlobalCompositeOperationERKNS_6StringE
-__ZN7WebCore22parseCompositeOperatorERKNS_6StringERNS_17CompositeOperatorE
-__ZN7WebCore59jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D16quadraticCurveToEffff
-__ZN7WebCore4Path14addQuadCurveToERKNS_10FloatPointES3_
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionClipEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4clipEv
-__ZN7WebCore26JSCanvasRenderingContext2D12setFillStyleEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore24CanvasRenderingContext2D12setFillStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
-__ZN7WebCore11CanvasStyle14applyFillColorEPNS_15GraphicsContextE
-__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D8fillRectEffffRi
-__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradientEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D20createLinearGradientEffff
-__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointES3_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14CanvasGradientE
-__ZN7WebCore25JSCanvasGradientPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSCanvasGradientC1EPN3KJS8JSObjectEPNS_14CanvasGradientE
-__ZN7WebCore25JSCanvasGradientPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore45jsCanvasGradientPrototypeFunctionAddColorStopEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSCanvasGradient9classInfoEv
-__ZN7WebCore14CanvasGradient12addColorStopEfRKNS_6StringE
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE15reserveCapacityEm
-__ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_14CanvasGradientEEE
-__ZN7WebCore14CanvasGradient15platformShadingEv
-__ZN7WebCore16gradientCallbackEPvPKfPf
-__ZN7WebCore14CanvasGradient8getColorEfPfS1_S1_S1_
-__ZNSt17_Temporary_bufferIPN7WebCore14CanvasGradient9ColorStopES2_EC1ES3_S3_
-__ZSt22__get_temporary_bufferIN7WebCore14CanvasGradient9ColorStopEESt4pairIPT_iEiS5_
-__ZSt26__uninitialized_fill_n_auxIPN7WebCore14CanvasGradient9ColorStopEiS2_EvT_T0_RKT1_12__false_type
-__ZSt22__stable_sort_adaptiveIPN7WebCore14CanvasGradient9ColorStopES3_iPFbRKS2_S5_EEvT_S8_T0_T1_T2_
-__ZSt24__merge_sort_with_bufferIPN7WebCore14CanvasGradient9ColorStopES3_PFbRKS2_S5_EEvT_S8_T0_T1_
-__ZSt22__chunk_insertion_sortIPN7WebCore14CanvasGradient9ColorStopEiPFbRKS2_S5_EEvT_S8_T0_T1_
-__ZSt16__insertion_sortIPN7WebCore14CanvasGradient9ColorStopEPFbRKS2_S5_EEvT_S8_T0_
-__ZN7WebCore12compareStopsERKNS_14CanvasGradient9ColorStopES3_
-__ZSt25__unguarded_linear_insertIPN7WebCore14CanvasGradient9ColorStopES2_PFbRKS2_S5_EEvT_T0_T1_
-__ZSt16__merge_adaptiveIPN7WebCore14CanvasGradient9ColorStopEiS3_PFbRKS2_S5_EEvT_S8_S8_T0_S9_T1_S9_T2_
-__ZSt16__merge_backwardIPN7WebCore14CanvasGradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
-__ZSt23return_temporary_bufferIN7WebCore14CanvasGradient9ColorStopEEvPT_
-__ZNK7WebCore14CanvasGradient8findStopEf
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTranslateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D9translateEff
-__ZN7WebCore15GraphicsContext9translateEff
-__ZN7WebCore15AffineTransform9translateEdd
-__ZN7WebCore4Path9transformERKNS_15AffineTransformE
-__ZNK7WebCore15AffineTransformcv17CGAffineTransformEv
-__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionScaleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D5scaleEff
-__ZN7WebCore15GraphicsContext5scaleERKNS_9FloatSizeE
-__ZN7WebCore6loadedEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController17scriptObjectReadyEv
-__ZN7WebCore19InspectorController16setWindowVisibleEb
-__ZN7WebCore19InspectorController23populateScriptResourcesEv
-__ZN7WebCore19InspectorController20clearScriptResourcesEv
-__ZN7WebCore18callSimpleFunctionEPK15OpaqueJSContextP13OpaqueJSValuePKc
-__ZN7WebCore19InspectorController26clearScriptConsoleMessagesEv
-__ZN7WebCore19InspectorController28clearDatabaseScriptResourcesEv
-__ZN7WebCore19InspectorController20clearNetworkTimelineEv
-__ZN7WebCore19InspectorController26addAndUpdateScriptResourceEPNS_17InspectorResourceE
-__ZN7WebCore19InspectorController17addScriptResourceEPNS_17InspectorResourceE
-__ZNK7WebCore4KURL17lastPathComponentEv
-__ZN7WebCore22scriptObjectForRequestEPK15OpaqueJSContextPKNS_17InspectorResourceE
-__ZN7WebCore10addHeadersEPK15OpaqueJSContextP13OpaqueJSValueRKN3WTF7HashMapINS_6StringES7_NS_15CaseFoldingHashENS5_10HashTraitsIS7_EESA_EE
-__ZNK7WebCore17HTMLCanvasElement17endTagRequirementEv
-__ZNK7WebCore17HTMLCanvasElement11tagPriorityEv
-__ZN7WebCore19InspectorController28updateScriptResourceResponseEPNS_17InspectorResourceE
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEi
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEddd
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEbb
-__ZN7WebCore26JSCanvasRenderingContext2DD0Ev
-__ZN7WebCore16JSCanvasGradientD0Ev
-__ZN7WebCore14CanvasGradientD1Ev
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE6shrinkEm
-__ZN7WebCore17HTMLCanvasElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16RenderHTMLCanvasC1EPNS_17HTMLCanvasElementE
-__ZN7WebCore12RenderObject16paintBorderImageEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleE
-__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectES5_NS1_8TileRuleES6_NS_17CompositeOperatorE
-__ZN7WebCore10TransitionD1Ev
-__ZSt5mergeIPN7WebCore14CanvasGradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
-__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D10strokeRectEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore24CanvasRenderingContext2D10strokeRectEffffRi
-__ZN7WebCore24CanvasRenderingContext2D10strokeRectEfffffRi
-__ZN7WebCore15GraphicsContext10strokeRectERKNS_9FloatRectEf
-__ZN7WebCore19InspectorController11showConsoleEv
-__ZNK7WebCore19HTMLTextAreaElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZN7WebCore18columnResizeCursorEv
-__ZN7WebCore23getResourceDocumentNodeEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore36jsNodePrototypeFunctionHasAttributesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element13hasAttributesEv
-__ZN7WebCore8Document18focusedNodeRemovedEv
-__ZN7WebCore16addSourceToFrameEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZNK7WebCore21HTMLFrameOwnerElement19isFrameOwnerElementEv
-__ZN7WebCore11FrameLoader19setResponseMIMETypeERKNS_6StringE
-__ZN7WebCore11FrameLoader5beginEv
-__ZN7WebCore22HTMLViewSourceDocumentC1EPNS_17DOMImplementationEPNS_5FrameERKNS_6StringE
-__ZN7WebCore22HTMLViewSourceDocument15createTokenizerEv
-__ZN7WebCore13HTMLTokenizerC1EPNS_22HTMLViewSourceDocumentE
-__ZN7WebCore22HTMLViewSourceDocument18addViewSourceTokenEPNS_5TokenE
-__ZN7WebCore22HTMLViewSourceDocument21createContainingTableEv
-__ZN7WebCore16applyCounterListEPNS_11RenderStyleEPNS_12CSSValueListEb
+__ZNK7WebCore11RenderImage13isRenderImageEv
+__ZN7WebCore25AccessibilityImageMapLink6createEv
+__ZN7WebCore25AccessibilityImageMapLinkC1Ev
+__ZN7WebCore25AccessibilityImageMapLinkC2Ev
+__ZNK7WebCore25AccessibilityImageMapLink6isLinkEv
+__ZNK7WebCore25AccessibilityImageMapLink9roleValueEv
+__ZN7WebCore10AXLinkTextEv
+__ZN7WebCore19AccessibilityObject8childrenEv
+__ZNK7WebCore19AccessibilityObject6widgetEv
+__ZNK7WebCore25AccessibilityImageMapLink12parentObjectEv
+__ZNK7WebCore25AccessibilityImageMapLink5titleEv
+__ZNK7WebCore25AccessibilityImageMapLink4sizeEv
+__ZNK7WebCore25AccessibilityImageMapLink11elementRectEv
+__ZNK7WebCore15HTMLAreaElement7getRectEPNS_12RenderObjectE
+__ZN7WebCore4Path9translateERKNS_9FloatSizeE
+__ZNK7WebCore25AccessibilityImageMapLink24accessibilityDescriptionEv
+__ZNK7WebCore25AccessibilityImageMapLink9isEnabledEv
+__ZNK7WebCore25AccessibilityImageMapLink3urlEv
+__ZNK7WebCore15HTMLAreaElement4hrefEv
+__ZNK7WebCore19AccessibilityObject9accessKeyEv
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE4takeERKj
+__ZN7WebCore25AccessibilityImageMapLinkD0Ev
+__ZN7WebCoreL15labelForElementEPNS_7ElementE
+__ZNK7WebCore25AccessibilityRenderObject16textUnderElementEv
+__ZNK7WebCore16HTMLInputElement3srcEv
+__ZN7WebCore9RenderBox17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore12RenderInline25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZN7WebCore12RenderObject25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZNK7WebCore25AccessibilityRenderObject19internalLinkElementEv
+__ZN7WebCore4KURL9removeRefEv
+__ZNK7WebCore25AccessibilityRenderObject6isMenuEv
+__ZNK7WebCore25AccessibilityRenderObject9isMenuBarEv
+__ZNK7WebCore25AccessibilityRenderObject12isMenuButtonEv
+__ZNK7WebCore25AccessibilityRenderObject10isMenuItemEv
+__ZN7WebCore13AXHeadingTextEv
+__ZNK7WebCore25AccessibilityRenderObject8intValueEv
+__ZN7WebCore10RenderText13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore14RenderFieldset22paintBorderMinusLegendEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEiii
+__ZN7WebCore17AccessibilityList6createEPNS_12RenderObjectE
+__ZN7WebCore17AccessibilityListC1EPNS_12RenderObjectE
+__ZN7WebCore17AccessibilityListC2EPNS_12RenderObjectE
+__ZNK7WebCore17AccessibilityList22accessibilityIsIgnoredEv
+__ZNK7WebCore17AccessibilityList9roleValueEv
+__ZNK7WebCore17AccessibilityList6isListEv
+__ZNK7WebCore17AccessibilityList15isUnorderedListEv
+__ZNK7WebCore17AccessibilityList13isOrderedListEv
+__ZNK7WebCore17AccessibilityList16isDefinitionListEv
+__ZN7WebCore24AXDefinitionListTermTextEv
+__ZN7WebCore30AXDefinitionListDefinitionTextEv
+__ZN7WebCore17AccessibilityListD0Ev
+__ZN7WebCore8FileListC1Ev
+__ZN7WebCore8FileListC2Ev
+__ZN7WebCore23RenderFileUploadControlC1EPNS_16HTMLInputElementE
+__ZN7WebCore23RenderFileUploadControlC2EPNS_16HTMLInputElementE
+__ZN7WebCore11FileChooser6createEPNS_17FileChooserClientERKNS_6StringE
+__ZN7WebCore11FileChooser10chooseIconERKNS_6StringE
+__ZN7WebCore4Icon17createIconForFileERKNS_6StringE
+__ZN7WebCore23RenderFileUploadControl14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore23RenderFileUploadControl17updateFromElementEv
+__ZN7WebCore32HTMLFileUploadInnerButtonElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore32HTMLFileUploadInnerButtonElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore25fileButtonChooseFileLabelEv
+__ZNK7WebCore23RenderFileUploadControl17createButtonStyleEPKNS_11RenderStyleE
+__ZN7WebCore16HTMLInputElement5filesEv
+__ZN7WebCore11FileChooser5clearEv
+__ZN7WebCore23RenderFileUploadControl14calcPrefWidthsEv
+__ZN7WebCore23RenderFileUploadControl11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore23RenderFileUploadControl16maxFilenameWidthEv
+__ZNK7WebCore11FileChooser16basenameForWidthERKNS_4FontEi
+__ZN7WebCore29fileButtonNoFileSelectedLabelEv
+__ZN7WebCore23RenderFileUploadControlD0Ev
+__ZN7WebCore11FileChooserD1Ev
+__ZN7WebCore11FileChooserD2Ev
+__ZThn8_N7WebCore32HTMLFileUploadInnerButtonElementD0Ev
+__ZN7WebCore32HTMLFileUploadInnerButtonElementD0Ev
+__ZN7WebCore16HTMLInputElementD2Ev
+__ZN7WebCore17FileChooserClientD2Ev
+__ZL35textMarkerRangeFromVisiblePositionsN7WebCore15VisiblePositionES0_
+__ZNK7WebCore25AccessibilityRenderObject10textLengthEv
+__ZNK7WebCore25AccessibilityRenderObject12selectedTextEv
+__ZNK7WebCore25AccessibilityRenderObject17selectedTextRangeEv
+__ZNK7WebCore19AccessibilityObject12selectionEndEv
+__ZNK7WebCore19AccessibilityObject14selectionStartEv
+__ZNK7WebCore25AccessibilityRenderObject23visiblePositionForIndexEjb
+__ZNK7WebCore25AccessibilityRenderObject23visiblePositionForIndexEi
+__ZNK7WebCore19AccessibilityObject15lineForPositionERKNS_15VisiblePositionE
+__ZN7WebCore13IdentifierRep7isValidEPS0_
+__ZNK3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8contain
+__ZNK7WebCore25AccessibilityRenderObject19checkboxOrRadioRectEv
+__ZN7WebCore12RenderInline13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject26addRadioButtonGroupMembersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EE
+__ZN7WebCore8Document35setUseSecureKeyboardEntryWhenActiveEb
+__ZN7WebCore5Frame33updateSecureKeyboardEntryIfActiveEv
+__ZN7WebCore21PlatformKeyboardEvent20currentCapsLockStateEv
+__ZN7WebCore18AccessibilityTable6createEPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTableC1EPNS_12RenderObjectE
+__ZNK7WebCore16HTMLTableElement7summaryEv
+__ZN7WebCore18AccessibilityTable11addChildrenEv
+__ZN7WebCore21AccessibilityTableRow6createEPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityTableRowC1EPNS_12RenderObjectE
+__ZNK7WebCore21AccessibilityTableRow11parentTableEv
+__ZNK7WebCore18AccessibilityTable11isAriaTableEv
+__ZN7WebCore24AccessibilityTableColumn22headerObjectForSectionEPNS_18RenderTableSectionEb
+__ZN7WebCore22AccessibilityTableCell6createEPNS_12RenderObjectE
+__ZN7WebCore22AccessibilityTableCellC1EPNS_12RenderObjectE
+__ZNK7WebCore22AccessibilityTableCell11parentTableEv
+__ZN7WebCore22AccessibilityTableCell13rowIndexRangeERSt4pairIiiE
+__ZN7WebCore22AccessibilityTableCell16columnIndexRangeERSt4pairIiiE
+__ZN7WebCore21AccessibilityTableRow12headerObjectEv
+__ZN7WebCore18AccessibilityTable19cellForColumnAndRowEjj
+__ZN7WebCore22AccessibilityTableCellD0Ev
+__ZN7WebCore21AccessibilityTableRowD0Ev
+__ZN7WebCore18AccessibilityTableD0Ev
+__ZNK7WebCore16HTMLTableElement5tFootEv
+__ZNK7WebCore16HTMLTableElement5rulesEv
+__ZNK7WebCore20HTMLTableCellElement7headersEv
+__ZNK7WebCore20HTMLTableCellElement4abbrEv
+__ZNK7WebCore20HTMLTableCellElement4axisEv
+__ZNK7WebCore20HTMLTableCellElement5scopeEv
+__ZN7WebCore23HTMLTableCaptionElementD0Ev
+__ZNK7WebCore22AccessibilityTableCell14titleUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject17menuButtonForMenuEv
+__ZNK7WebCore25AccessibilityRenderObject22menuItemElementForMenuEv
+__ZN7WebCoreL19siblingWithAriaRoleENS_6StringEPNS_4NodeE
+__ZN7WebCore38setJSHTMLTextAreaElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement17setSelectionStartEi
+__ZN7WebCore17RenderTextControl17setSelectionStartEi
+__ZN7WebCore36setJSHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement15setSelectionEndEi
+__ZN7WebCore17RenderTextControl15setSelectionEndEi
+__ZN7WebCore20previousLinePositionERKNS_15VisiblePositionEi
+__ZN7WebCoreL34enclosingNodeWithNonInlineRendererEPNS_4NodeE
+__ZN7WebCoreL31previousLeafWithSameEditabilityEPNS_4NodeE
+__ZN7WebCore35jsHTMLTextAreaElementSelectionStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTextAreaElement14selectionStartEv
+__ZN7WebCoreL14isEditableLeafEPNS_9InlineBoxE
+__ZN7WebCore19AccessibilityObject16doAXLineForIndexEj
+-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]
+__ZN7WebCore25AccessibilityRenderObject20setSelectedTextRangeERKNS_14PlainTextRangeE
+__ZN7WebCore9CSSParser20parseTransformOriginEiRiS1_S1_RN3WTF6RefPtrINS_8CSSValueEEES6_S6_
+__ZN7WebCore9CSSParser29parseTransformOriginShorthandERN3WTF6RefPtrINS_8CSSValueEEES5_S5_
+__ZNK7WebCore24RotateTransformOperation16getOperationTypeEv
+__ZNK7WebCore14HTMLCollection8nextItemEv
+__ZNK7WebCore15PropertyWrapperINS_6LengthEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS6_S9_d
+__ZNK7WebCore11RenderStyle4leftEv
+__ZN7WebCore11RenderStyle7setLeftENS_6LengthE
+__ZN7WebCore18CompositeAnimation16resumeAnimationsEv
+__ZN7WebCore13AnimationBase16getNumPropertiesEv
+__ZNK7WebCore18CompositeAnimation23getAnimationForPropertyEi
+__ZNK7WebCore17KeyframeAnimation23hasAnimationForPropertyEi
+__ZNK3WTF7HashMapIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
+__ZN7WebCore13AnimationBase15propertiesEqualEiPKNS_11RenderStyleES3_
+__ZNK7WebCore21PropertyWrapperGetterINS_6LengthEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle3topEv
+__ZN7WebCore17ImplicitAnimationC1EPKNS_9AnimationEiPNS_12RenderObjectEPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore17ImplicitAnimationC2EPKNS_9AnimationEiPNS_12RenderObjectEPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN3WTF7HashMapIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
+__ZNK7WebCore11RenderStyle5widthEv
+__ZN7WebCore17ImplicitAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPKNS_11RenderStyleEPS5_RN3WTF6RefPtrIS5_EE
+__ZN7WebCore17ImplicitAnimation5resetEPNS_11RenderStyleE
+__ZN7WebCore17ImplicitAnimation12endAnimationEb
+__ZN7WebCore17ImplicitAnimation29validateTransformFunctionListEv
+__ZN7WebCore11RenderStyle8setWidthENS_6LengthE
+__ZN7WebCore11RenderStyle6setTopENS_6LengthE
+__ZN7WebCore17ImplicitAnimation17timeToNextServiceEv
+__ZN7WebCore13AnimationBase18overrideAnimationsEv
+__ZN7WebCore13AnimationBase16onAnimationStartEd
+__ZNK7WebCore17ImplicitAnimation10overriddenEv
+__ZN7WebCore17ImplicitAnimation14startAnimationEd
+__ZN7WebCore17ImplicitAnimation21isTargetPropertyEqualEiPKNS_11RenderStyleE
+__ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
+__ZNK7WebCore26AnimationControllerPrivate24numberOfActiveAnimationsEv
+__ZNK7WebCore18CompositeAnimation24numberOfActiveAnimationsEv
+__ZNK7WebCore11RenderStyle6heightEv
+__ZN7WebCore11RenderStyle9setHeightENS_6LengthE
+__ZN7WebCore17ImplicitAnimationD0Ev
+__ZN7WebCore29jsDOMWindowCSSRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCSSRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCSSRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsCSSRuleWEBKIT_KEYFRAMES_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSRuleWEBKIT_KEYFRAME_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore26AnimationControllerPrivate20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore18CompositeAnimation20pauseAnimationAtTimeERKNS_12AtomicStringEd
+__ZNK7WebCore13AnimationBase8durationEv
+__ZN7WebCore13AnimationBase11pauseAtTimeEd
+__ZN7WebCore13AnimationBase15updatePlayStateEb
+__ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
+__ZN7WebCore20writeRenderResourcesERNS_10TextStreamEPNS_4NodeE
+__ZN7WebCoreL11writeLayersERNS_10TextStreamEPKNS_11RenderLayerEPS2_RKNS_7IntRectEi
+__ZN7WebCoreL5writeERNS_10TextStreamERNS_11RenderLayerERKNS_7IntRectES6_S6_S6_ii
+__ZN7WebCoreL11writeIndentERNS_10TextStreamEi
+__ZN7WebCore10TextStreamlsEPKc
+__ZN7WebCorelsERNS_10TextStreamERKNS_7IntRectE
+__ZN7WebCore10TextStreamlsEi
+__ZNK7WebCore7IntRect8containsERKS0_
+__ZN7WebCore5writeERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore12RenderObject12isRenderPathEv
+__ZNK7WebCore12RenderObject10isSVGImageEv
+__ZNK7WebCore10RenderView10renderNameEv
+__ZN7WebCoreL10getTagNameEPNS_4NodeE
+__ZNK7WebCore11RenderBlock10renderNameEv
+__ZN7WebCore10TextStreamlsERKNS_6StringE
+__ZNK7WebCore10RenderText10renderNameEv
+__ZNK7WebCore10RenderText9firstRunYEv
+__ZNK7WebCore10RenderText9firstRunXEv
+__ZN7WebCore27quoteAndEscapeNonPrintablesERKNS_6StringE
+__ZNK7WebCore5Color4nameEv
+__ZN7WebCore10TextStream7releaseEv
+__ZN7WebCore20JSCSSRuleConstructorD1Ev
+__ZN7WebCore27TranslateTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZN7WebCore12GCController17garbageCollectNowEv
+__ZN7WebCore20WebKitAnimationEventC1Ev
+__ZN7WebCore20WebKitAnimationEventC2Ev
+__ZN7WebCore33jsWebKitAnimationEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20WebKitAnimationEvent11elapsedTimeEv
+__ZN7WebCore10MouseEventC1Ev
+__ZN7WebCore10MouseEventC2Ev
+__ZN7WebCore17MouseRelatedEventC2Ev
+__ZN7WebCore7UIEventC2Ev
+__ZN7WebCore43jsDocumentPrototypeFunctionElementFromPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11RenderLayer25createLocalTransformStateEPS0_S1_RKNS_7IntRectERKNS_8IntPointEPKNS_24HitTestingTransformStateE
+__ZN7WebCore24HitTestingTransformState14applyTransformERKNS_20TransformationMatrixENS0_21TransformAccumulationE
+__ZNK7WebCore24HitTestingTransformState11mappedPointEv
+__ZNK7WebCore20TransformationMatrix12projectPointERKNS_10FloatPointE
+__ZNK7WebCore24HitTestingTransformState10mappedQuadEv
+__ZNK7WebCore20TransformationMatrix11projectQuadERKNS_9FloatQuadE
+__ZN7WebCore24HitTestingTransformState7flattenEv
+__ZN7WebCore24HitTestingTransformState20flattenWithTransformERKNS_20TransformationMatrixE
+__ZN7WebCore9CSSParser28parseAnimationIterationCountEv
+__ZN7WebCore16CSSStyleSelector26mapAnimationIterationCountEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore17KeyframeAnimation20onAnimationIterationEd
+__ZNK7WebCore24RotateTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore24RotateTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZNK7WebCore24RotateTransformOperationeqERKNS_18TransformOperationE
+__ZN7WebCore13jsCSSRuleTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsWebKitCSSKeyframesRuleNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSWebKitCSSKeyframesRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore31setJSWebKitCSSKeyframesRuleNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22WebKitCSSKeyframesRule7setNameERKNS_6StringE
+__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8CSSValueE
+__ZNK7WebCore8CSSValue25isWebKitCSSTransformValueEv
+__ZNK7WebCore8CSSValue10isSVGPaintEv
+__ZNK7WebCore8CSSValue10isSVGColorEv
+__ZN7WebCore19JSCSSPrimitiveValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSCSSValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSCSSValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSCSSPrimitiveValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17CSSPrimitiveValueEEE
+__ZN7WebCore19JSCSSPrimitiveValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17CSSPrimitiveValueEEE
+__ZN7WebCore10JSCSSValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8CSSValueEEE
+__ZN7WebCore19JSCSSPrimitiveValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSCSSValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSCSSPrimitiveValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSCSSPrimitiveValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSCSSPrimitiveValueConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore28JSCSSPrimitiveValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSCSSPrimitiveValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsCSSPrimitiveValueCSS_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionGetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSCSSPrimitiveValue9classInfoEv
+__ZN7WebCore19JSCSSPrimitiveValueD1Ev
+__ZN7WebCore10JSCSSValueD2Ev
+__ZN7WebCore19JSCSSValuePrototypeD1Ev
+__ZN7WebCore28JSCSSPrimitiveValuePrototypeD1Ev
+__ZN7WebCore30JSCSSPrimitiveValueConstructorD1Ev
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore24JSWebKitCSSKeyframesRule9classInfoEv
+__ZN7WebCore22WebKitCSSKeyframesRule10deleteRuleERKNS_6StringE
+__ZNK7WebCore22WebKitCSSKeyframesRule13findRuleIndexERKNS_6StringE
+__ZN7WebCore11CSSRuleList10deleteRuleEj
+__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22WebKitCSSKeyframesRule10insertRuleERKNS_6StringE
+__ZN7WebCore9CSSParser17parseKeyframeRuleEPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9CSSParser23parseAnimationDirectionEv
+__ZN7WebCore16CSSStyleSelector21mapAnimationDirectionEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore37jsDOMWindowWebKitCSSMatrixConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow15webKitCSSMatrixEPN3JSC9ExecStateE
+__ZN7WebCore28JSWebKitCSSMatrixConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore28JSWebKitCSSMatrixConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSWebKitCSSMatrixPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSWebKitCSSMatrix15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSWebKitCSSMatrixConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL24constructWebKitCSSMatrixEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore15WebKitCSSMatrixC1ERKNS_6StringERi
+__ZN7WebCore15WebKitCSSMatrixC2ERKNS_6StringERi
+__ZN7WebCore15WebKitCSSMatrix14setMatrixValueERKNS_6StringERi
+__ZNK7WebCore24MatrixTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore24MatrixTransformOperationD0Ev
+__ZN7WebCore17JSWebKitCSSMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WebKitCSSMatrixEEE
+__ZN7WebCore17JSWebKitCSSMatrixC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WebKitCSSMatrixEEE
+__ZN7WebCore17JSWebKitCSSMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixFEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL16getDurationValueEPKNS_13AnimationListE
+__ZN7WebCoreL22getTimingFunctionValueEPKNS_13AnimationListE
+__ZNK7WebCore22CSSTimingFunctionValue7cssTextEv
+__ZN7WebCore22CSSTimingFunctionValueD0Ev
+__ZN7WebCore17JSWebKitCSSMatrixD1Ev
+__ZN7WebCore17JSWebKitCSSMatrixD2Ev
+__ZN7WebCore15WebKitCSSMatrixD0Ev
+__ZN7WebCore26JSWebKitCSSMatrixPrototypeD1Ev
+__ZN7WebCore28JSWebKitCSSMatrixConstructorD1Ev
+__ZN7WebCoreL13getDelayValueEPKNS_13AnimationListE
+__ZN7WebCore43jsDOMWindowWebKitCSSKeyframeRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSWebKitCSSKeyframeRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSWebKitCSSKeyframeRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWebKitCSSKeyframeRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore44jsDOMWindowWebKitCSSKeyframesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSWebKitCSSKeyframesRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37jsStyleSheetListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSStyleSheetList9classInfoEv
+__ZN7WebCore34jsCSSRuleListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore13JSCSSRuleList9classInfoEv
+__ZN7WebCore32jsWebKitCSSKeyframesRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitCSSKeyframeRule4typeEv
+__ZN7WebCore23JSWebKitCSSKeyframeRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitCSSKeyframeRuleEEE
+__ZN7WebCore23JSWebKitCSSKeyframeRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitCSSKeyframeRuleEEE
+__ZN7WebCore23JSWebKitCSSKeyframeRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsWebKitCSSKeyframeRuleKeyTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsWebKitCSSKeyframeRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSCSSStyleDeclarationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27jsCSSStyleDeclarationLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsWebKitCSSKeyframesRulePrototypeFunctionFindRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22WebKitCSSKeyframesRule8findRuleERKNS_6StringE
+__ZN7WebCore22WebKitCSSKeyframesRule4itemEj
+__ZN7WebCore23JSWebKitCSSKeyframeRuleD1Ev
+__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructorD1Ev
+__ZN7WebCore32JSWebKitCSSKeyframeRulePrototypeD1Ev
+__ZN7WebCore34JSWebKitCSSKeyframeRuleConstructorD1Ev
+__ZN7WebCore32JSCSSStyleDeclarationConstructorD1Ev
+__ZNK7WebCore11RenderStyle10lineHeightEv
+__ZN7WebCore11RenderStyle13setLineHeightENS_6LengthE
+__ZNK7WebCore24MatrixTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZNK7WebCore24MatrixTransformOperation16getOperationTypeEv
+__ZN7WebCore24MatrixTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZNK7WebCore24MatrixTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore21PropertyWrapperGetterIRKNS_19TransformOperationsEE6equalsEPKNS_11RenderStyleES7_
+__ZN7WebCore17ImplicitAnimation13setOverriddenEb
+__ZN7WebCoreL16printBorderStyleERNS_10TextStreamENS_12EBorderStyleE
+__ZNK7WebCore14RenderListItem10renderNameEv
+__ZNK7WebCore16RenderListMarker10renderNameEv
+__ZNK7WebCore11RenderTable10renderNameEv
+__ZNK7WebCore18RenderTableSection10renderNameEv
+__ZNK7WebCore14RenderTableRow10renderNameEv
+__ZNK7WebCore15RenderTableCell10renderNameEv
+__ZNK7WebCore12RenderInline10renderNameEv
+__ZNK7WebCore11RenderImage10renderNameEv
+__ZNK7WebCore8RenderBR10renderNameEv
+__ZNK7WebCore12RenderObject16isBoxModelObjectEv
+__ZN7WebCoreL12toAlphabeticEiPKti
+__ZN7WebCoreL7toRomanEib
+__ZN7WebCore11CSSSelector11setArgumentERKNS_12AtomicStringE
+__ZNK7WebCore14SimpleFontData17smallCapsFontDataERKNS_15FontDescriptionE
+__ZN7WebCore16FontPlatformData7setFontEP6NSFont
+__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplEii
+__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplEii
+__ZNK7WebCore12RenderObject22firstLineStyleSlowCaseEv
+__ZNK7WebCore11RenderBlock14firstLineBlockEv
+__ZN7WebCore15RenderScrollbar24scrollbarForStyleResolveEv
+__ZNK7WebCore17HTMLObjectElement24imageSourceAttributeNameEv
+__ZN7WebCore9CSSParser12parseCounterEiib
+__ZN7WebCore9CSSParser19parseCounterContentEPNS_18CSSParserValueListEb
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_7CounterEEE
+__ZN7WebCoreL16applyCounterListEPNS_11RenderStyleEPNS_12CSSValueListEb
 __ZN7WebCore11RenderStyle23accessCounterDirectivesEv
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3getEPS3_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addINS_6RefPtrINS2_16AtomicStringImplEEES3_NS_17HashMapTranslatorILb0ES1_ISI_S3_ENS_18PairBaseHashTraitsINSA_ISI_EESC_EESD_NS_7PtrHashISI_EEEEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN7WebCore22HTMLViewSourceDocument20addSpanWithClassNameERKNS_6StringE
-__ZN7WebCore22HTMLViewSourceDocument7addLineERKNS_6StringE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EENS
 __ZN7WebCore11RenderStyle10setContentEPNS_14CounterContentEb
 __ZN7WebCore13RenderCounterC1EPNS_8DocumentERKNS_14CounterContentE
-__ZN7WebCore22HTMLViewSourceDocument7addTextERKNS_6StringES3_
-__ZN7WebCore22HTMLViewSourceDocument7addLinkERKNS_6StringEb
-__ZN7WebCore17HTMLAnchorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN3WTFeqINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEEEbRKNS_7HashMapIT_T0_T1_T2_T3_EESJ_
-__ZNK3WTF9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E4findIiNS_22IdentityHashTranslatorIiS4_S8_EEEENS_22HashTableConstIteratorIiS4_S6_S8_SD_SB_EERKT_
-__ZN7WebCoreeqERKNS_17CounterDirectivesES2_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS5_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_EENS_18PairBaseHashTraitsINSB_INS_6RefPtrINS3_16AtomicStringImplEEEEESD_EEE8derefAllERSF_
+__ZN7WebCore13RenderCounterC2EPNS_8DocumentERKNS_14CounterContentE
+__ZNK7WebCore13RenderCounter9isCounterEv
 __ZN7WebCore13RenderCounter14calcPrefWidthsEi
 __ZNK7WebCore13RenderCounter12originalTextEv
-__ZN7WebCore7counterEPNS_12RenderObjectERKNS_12AtomicStringEb
+__ZN7WebCoreL7counterEPNS_12RenderObjectERKNS_12AtomicStringEb
 __ZNK7WebCore11RenderStyle17counterDirectivesEv
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS
 __ZN7WebCore11CounterNodeC1EPNS_12RenderObjectEbi
-__ZN7WebCore11counterMapsEv
+__ZN7WebCore11CounterNodeC2EPNS_12RenderObjectEbi
+__ZN7WebCoreL11counterMapsEv
+__ZN3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10H
+__ZN3WTF9HashTableIPKN7WebCore12RenderObjectESt4pairIS4_PNS_7HashMapINS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_PNS2_11CounterNodeEENS_18PairFirstExtractorIS8_EENS_7Ptr
 __ZN7WebCore11CounterNode11insertAfterEPS0_S1_
 __ZNK7WebCore11CounterNode20computeCountInParentEv
-__ZN3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSC_IS9_EEEENSA_IS4_EENSC_IS4_EENSC_ISG_EEE3setERKS4_RKSG_
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setEPS3_RKS6_
-__ZN7WebCore13RenderCounter14dirtyLineBoxesEbb
-__ZNK7WebCore19CachedCSSStyleSheet8encodingEv
-__ZN7WebCore13TextTokenizerC1EPNS_22HTMLViewSourceDocumentE
-__ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
-__ZNK7WebCore14RenderReplaced21minimumReplacedHeightEv
-__ZN7WebCore13RootInlineBox15clearTruncationEv
-__ZN7WebCore13InlineFlowBox15clearTruncationEv
-__ZN7WebCore13InlineTextBox15clearTruncationEv
-__ZN7WebCore16RenderHTMLCanvas13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore17HTMLCanvasElement5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore17HTMLCanvasElement19createPlatformImageEv
-__ZN7WebCore11EllipsisBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZNK7WebCore16HTMLImageElement12naturalWidthEv
-__ZNK3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3getERKS4_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore7IntRectEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addIPKNS2_14RenderReplacedES3_NS_17HashMapTranslatorILb1ES1_ISI_S3_ENS_18PairBaseHashTraitsINSA_ISI_EESC_EESD_NS_7PtrHashISI_EEEEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore7IntRectEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS4_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore7IntRectEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E4findIiNS_22IdentityHashTranslatorIiS4_S8_EEEENS_17HashTableIteratorIiS4_S6_S8_SD_SB_EERKT_
-__ZN7WebCore15GraphicsContext7clipOutERKNS_7IntRectE
-__ZN7WebCore17isStartOfDocumentERKNS_15VisiblePositionE
-__ZN7WebCore6attachEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController12attachWindowEv
+__ZNK3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE
+__ZNK7WebCore13RenderCounter10renderNameEv
+__ZN7WebCore13RenderCounterD0Ev
 __ZN7WebCore13RenderCounter19destroyCounterNodesEPNS_12RenderObjectE
 __ZN7WebCore11CounterNode11removeChildEPS0_
 __ZN7WebCore11CounterNode7recountEv
-__ZNK7WebCore12RenderObject9isCounterEv
-__ZN7WebCore22HTMLViewSourceDocumentD1Ev
-__ZNK7WebCore15BackgroundLayer13containsImageEPNS_11CachedImageE
-__ZN7WebCore6detachEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController12detachWindowEv
-__ZN7WebCore23JSDOMSelectionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore47jsDOMSelectionPrototypeFunctionSetBaseAndExtentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSDOMSelection9classInfoEv
-__ZN7WebCore12DOMSelection16setBaseAndExtentEPNS_4NodeEiS2_iRi
-__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionES3_b
-__ZN7WebCore6Editor18shouldBeginEditingEPNS_5RangeE
-__ZN7WebCore6Editor15didBeginEditingEv
-__ZNK7WebCore6Editor25shouldShowDeleteInterfaceEPNS_11HTMLElementE
-__ZN7WebCore15rowResizeCursorEv
-__ZN7WebCore6Editor15insertLineBreakEv
-__ZN7WebCore13TypingCommand15insertLineBreakEPNS_8DocumentE
-__ZN7WebCore13TypingCommand15insertLineBreakEv
-__ZN7WebCore22InsertLineBreakCommandC2EPNS_8DocumentE
-__ZN7WebCore22InsertLineBreakCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand22positionOutsideTabSpanERKNS_8PositionE
-__ZN7WebCore22InsertLineBreakCommand21shouldUseBreakElementERKNS_8PositionE
-__ZN7WebCore14caretMinOffsetEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand15insertNodeAfterEPNS_4NodeES2_
-__ZN7WebCore20CompositeEditCommand19rebalanceWhitespaceEv
-__ZNK7WebCore22InsertLineBreakCommand20preservesTypingStyleEv
-__ZN7WebCore6Editor16shouldEndEditingEPNS_5RangeE
-__ZN7WebCore6Editor13didEndEditingEv
-__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextEPNS_4TextEii
-__ZN7WebCore12RenderObject27capsLockStateMayHaveChangedEv
-__ZN7WebCore15executeMoveLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController24modifyMovingLeftBackwardENS_15TextGranularityE
-__ZN7WebCore19CSSBorderImageValueD1Ev
-__ZN7WebCore12RenderWidget17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZN7WebCore6Widget13setIsSelectedEb
-__ZN7WebCore52jsCSSStyleDeclarationPrototypeFunctionRemovePropertyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration14removePropertyERKNS_6StringERi
-__ZNK7WebCore6Widget1xEv
-__ZNK7WebCore6Widget1yEv
-__ZN7WebCore11ContextMenu21addInspectElementItemEv
-__ZN7WebCore32contextMenuItemTagInspectElementEv
-__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
-__ZN7WebCore19InspectorController9focusNodeEv
-__ZN7WebCore16highlightDOMNodeEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZNK7WebCore15MappedAttribute5styleEv
-__ZN7WebCore46jsDOMWindowPrototypeFunctionGetMatchedCSSRulesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow18getMatchedCSSRulesEPNS_7ElementERKNS_6StringEb
-__ZN7WebCore16CSSStyleSelector20styleRulesForElementEPNS_7ElementEb
-__ZN3KJS17staticValueGetterIN7WebCore13JSCSSRuleListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore13JSCSSRuleList16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSCSSStyleDeclaration11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore26CSSMutableStyleDeclaration4itemEj
-__ZNK7WebCore23DeprecatedValueListImpl6nodeAtEj
-__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriorityEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration19getPropertyPriorityERKNS_6StringE
-__ZN7WebCore14JSCSSStyleRule3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9JSCSSRule3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore27CSSComputedStyleDeclaration6lengthEv
-__ZNK7WebCore27CSSComputedStyleDeclaration4itemEj
-__ZN7WebCore58jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthandEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration20getPropertyShorthandERKNS_6StringE
-__ZNK7WebCore27CSSComputedStyleDeclaration20getPropertyShorthandEi
-__ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyPriorityEi
-__ZN7WebCore56jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicitEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration18isPropertyImplicitERKNS_6StringE
-__ZNK7WebCore27CSSComputedStyleDeclaration18isPropertyImplicitEi
-__ZN7WebCore26getBorderRadiusCornerValueENS_7IntSizeE
-__ZN7WebCore14valueForShadowEPKNS_10ShadowDataE
-__ZN7WebCore49jsCSSStyleDeclarationPrototypeFunctionSetPropertyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC1ERKS3_
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_15DashboardRegionEEE
-__ZNK7WebCore27CSSComputedStyleDeclaration22getSVGPropertyCSSValueEiNS_13EUpdateLayoutE
-__ZNK7WebCore8SVGPaint7cssTextEv
-__ZNK7WebCore8SVGColor7cssTextEv
-__ZNK7WebCore5Color4nameEv
-__ZN7WebCore35glyphOrientationToCSSPrimitiveValueENS_17EGlyphOrientationE
-__ZNK7WebCore26CSSMutableStyleDeclaration20getPropertyShorthandEi
-__ZNK7WebCore26CSSMutableStyleDeclaration18isPropertyImplicitEi
-__ZNK7WebCore26CSSMutableStyleDeclaration10get4ValuesEPKi
-__ZNK7WebCore14JSCSSStyleRule9classInfoEv
-__ZNK7WebCore12CSSStyleRule12selectorTextEv
-__ZNK7WebCore11CSSSelector12selectorTextEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSCSSRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSCSSRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore26CSSMutableStyleDeclaration17getShorthandValueEPKii
-__ZN7WebCore19InspectorController9highlightEPNS_4NodeE
--[DOMNode(DOMNodeExtensions) boundingBox]
--[DOMElement scrollIntoViewIfNeeded:]
-__ZN7WebCore7Element22scrollIntoViewIfNeededEb
-__ZN7WebCore15GraphicsContext18clipOutRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
-__ZN7WebCore15GraphicsContext7clipOutERKNS_4PathE
-__ZN7WebCore15GraphicsContext15fillRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_RKNS_5ColorE
-__ZN7WebCore15GraphicsContext7addPathERKNS_4PathE
-__ZNK7WebCore11RenderLayer16enclosingElementEv
-__ZNK7WebCore26CSSMutableStyleDeclaration24getLayeredShorthandValueEPKij
-__ZNK7WebCore8CSSValue22isImplicitInitialValueEv
-__ZNK7WebCore15CSSInitialValue22isImplicitInitialValueEv
-__ZN7WebCore9InlineBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore31jsConsolePrototypeFunctionErrorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Console5errorERKNS_6StringE
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE15reserveCapacityEm
-__ZNK7WebCore29JSHTMLHeadingElementPrototype9classInfoEv
-__ZNK7WebCore22JSHTMLElementPrototype9classInfoEv
-__ZNK7WebCore18JSElementPrototype9classInfoEv
-__ZNK7WebCore22JSEventTargetPrototypeINS_15JSNodePrototypeENS_33JSEventTargetPrototypeInformationEE9classInfoEv
-__ZNK7WebCore15JSNodePrototype9classInfoEv
-__ZNK7WebCore18HTMLHeadingElement5alignEv
-__ZN7WebCore14JSNamedNodeMap16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore23JSNamedNodeMapPrototype9classInfoEv
-__ZNK7WebCore7Element7baseURIEv
-__ZNK7WebCore8Document7baseURIEv
-__ZNK7WebCore8Document11documentURIEv
-__ZN3KJS17staticValueGetterIN7WebCore15JSNodePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSNodePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore4Node14lastDescendantEv
-__ZN7WebCore30stringWithRebalancedWhitespaceERKNS_6StringEbb
-__ZNK7WebCore27JSHTMLUListElementPrototype9classInfoEv
-__ZNK7WebCore25JSHTMLDivElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLImageElementPrototype9classInfoEv
-__ZN7WebCore46jsCanvasRenderingContext2DPrototypeFunctionArcEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D3arcEfffffbRi
-__ZN7WebCore4Path6addArcERKNS_10FloatPointEfffb
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionFillEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4fillEv
-__ZN7WebCore19InspectorController20removeScriptResourceEPNS_17InspectorResourceE
-__ZN7WebCore20hideDOMNodeHighlightEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController13hideHighlightEv
-__ZN7WebCore10HTMLParser20reportErrorToConsoleENS_19HTMLParserErrorCodeEPKNS_12AtomicStringES4_b
-__ZNK7WebCore13HTMLTokenizer10lineNumberEv
-__ZN7WebCore30htmlParserErrorMessageTemplateENS_19HTMLParserErrorCodeE
-__ZN7WebCore10StringImpl7replaceEPS0_S1_
-__ZN7WebCore9isWarningENS_19HTMLParserErrorCodeE
-__ZN7WebCore19InspectorController23addScriptConsoleMessageEPKNS_14ConsoleMessageE
-__ZN7WebCore40jsElementPrototypeFunctionScrollIntoViewEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element14scrollIntoViewEb
-__ZNK7WebCore11FrameLoader18canGoBackOrForwardEi
-__ZN7WebCore40lastEditablePositionBeforePositionInRootERKNS_8PositionEPNS_4NodeE
-__ZN7WebCore9unloadingEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController5closeEv
-__ZN7WebCore26CompositeImplicitAnimation5resetEPNS_12RenderObjectE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17ImplicitAnimationEKNS_7HashMapIiS3_NS_7IntHashIjEENS_10HashTraitsIiEENS7_IS3_EEEEEEvRT0_
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE6shrinkEm
-__ZN7WebCore13RenderListBox16selectionChangedEv
-__ZN7WebCore13RenderListBox23scrollToRevealSelectionEv
-__ZNK7WebCore17HTMLSelectElement29activeSelectionStartListIndexEv
-__ZNK7WebCore17HTMLSelectElement27activeSelectionEndListIndexEv
-__ZNK7WebCore17HTMLSelectElement21lastSelectedListIndexEv
-__ZN7WebCore13RenderListBox18listIndexIsVisibleEi
-__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionForegroundColorEv
-__ZN7WebCore18RenderTextFragment17previousCharacterEv
-__ZN7WebCore14RenderFrameSet17paintColumnBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderFrameSet14paintRowBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
-__ZN7WebCore15borderFillColorEv
-__ZN7WebCore20borderStartEdgeColorEv
-__ZN7WebCore18borderEndEdgeColorEv
-__ZN7WebCore5Cache13getStatisticsEv
-__ZNK7WebCore23JSHTMLDocumentPrototype9classInfoEv
-__ZNK7WebCore17JSScreenPrototype9classInfoEv
-__ZNK7WebCore19JSDocumentPrototype9classInfoEv
-__ZN7WebCore12IconDatabase19pageURLMappingCountEv
-__ZN7WebCore12IconDatabase20retainedPageURLCountEv
-__ZN7WebCore12IconDatabase15iconRecordCountEv
-__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
-__ZN7WebCore12GCController17garbageCollectNowEv
--[WebCoreFrameBridge canSaveAsWebArchive]
-__ZN7WebCore29selectionContainsPossibleWordEPNS_5FrameE
-__ZNK7WebCore6Editor9canDeleteEv
--[WebCoreFrameBridge forceLayoutWithMinimumPageWidth:maximumPageWidth:adjustingViewSize:]
-__ZN7WebCore5Frame29forceLayoutWithPageWidthRangeEffb
--[WebCoreFrameBridge computePageRectsWithPrintWidthScaleFactor:printHeight:]
-__ZN7WebCore5Frame16adjustPageHeightEPffff
-__ZN7WebCore18correctedTextColorENS_5ColorES0_
-__ZN7WebCore17differenceSquaredERKNS_5ColorES2_
-__ZN7WebCore15GraphicsContext21focusRingBoundingRectEv
-__ZN7WebCore12RenderObject13addPDFURLRectEPNS_15GraphicsContextENS_7IntRectE
-__ZN7WebCore15GraphicsContext13setURLForRectERKNS_4KURLERKNS_7IntRectE
-__ZN7WebCore38jsElementPrototypeFunctionHasAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element12hasAttributeERKNS_6StringE
-__ZNK7WebCore19HTMLOptGroupElement14groupLabelTextEv
-__ZNK7WebCore16DeprecatedString15stripWhiteSpaceEv
-__ZNK7WebCore16DeprecatedString18simplifyWhiteSpaceEv
-__ZN7WebCore22JSHTMLTableCellElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore20HTMLTableCellElement10setColSpanEi
-__ZN7WebCore44jsHTMLTableElementPrototypeFunctionInsertRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement9insertRowEiRi
-__ZNK7WebCore16HTMLTableElement8lastBodyEv
-__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionInsertCellEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTableRowElement10insertCellEiRi
-__ZN7WebCore20HTMLTableCellElement8setAlignERKNS_6StringE
--[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]
-__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
-__ZN7WebCore23AuthenticationChallengeC1EP28NSURLAuthenticationChallenge
-__ZN7WebCore4coreEP20NSURLProtectionSpace
-__ZN7WebCore15ProtectionSpaceC1ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
-__ZN7WebCore4coreEP15NSURLCredential
-__ZN7WebCore10CredentialC1ERKNS_6StringES3_NS_21CredentialPersistenceE
-__ZN7WebCore14ResourceHandle33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeEPNS_14ResourceHandleERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
-__ZN7WebCore11FrameLoader33didReceiveAuthenticationChallengeEPNS_14ResourceLoaderERKNS_23AuthenticationChallengeE
-__ZN7WebCore3macERKNS_23AuthenticationChallengeE
--[WebCoreResourceHandleAsDelegate useCredential:forAuthenticationChallenge:]
-__ZN7WebCore14ResourceHandle18receivedCredentialERKNS_23AuthenticationChallengeERKNS_10CredentialE
-__ZN7WebCoreneERKNS_23AuthenticationChallengeES2_
-__ZN7WebCoreeqERKNS_23AuthenticationChallengeES2_
-__ZNK7WebCore23AuthenticationChallenge6isNullEv
-__ZNK7WebCore23AuthenticationChallenge15protectionSpaceEv
-__ZN7WebCoreeqERKNS_15ProtectionSpaceES2_
-__ZNK7WebCore15ProtectionSpace4hostEv
-__ZNK7WebCore15ProtectionSpace4portEv
-__ZNK7WebCore15ProtectionSpace10serverTypeEv
-__ZNK7WebCore15ProtectionSpace5realmEv
-__ZNK7WebCore15ProtectionSpace20authenticationSchemeEv
-__ZNK7WebCore23AuthenticationChallenge18proposedCredentialEv
-__ZN7WebCoreeqERKNS_10CredentialES2_
-__ZNK7WebCore10Credential4userEv
-__ZNK7WebCore10Credential8passwordEv
-__ZNK7WebCore10Credential11persistenceEv
-__ZNK7WebCore23AuthenticationChallenge20previousFailureCountEv
-__ZNK7WebCore23AuthenticationChallenge15failureResponseEv
-__ZN7WebCoreeqERKNS_16ResourceResponseES2_
-__ZNK7WebCore20ResourceResponseBase14httpStatusTextEv
-__ZN3WTFeqIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_EEbRKNS_7HashMapIT_T0_T1_T2_T3_EESE_
-__ZNK7WebCore23AuthenticationChallenge5errorEv
-__ZN7WebCore3macERKNS_10CredentialE
-__ZN7WebCore14PluginDocumentC1EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore14PluginDocument15createTokenizerEv
-__ZNK7WebCore15PluginTokenizer12wantsRawDataEv
-__ZN7WebCore15PluginTokenizer12writeRawDataEPKci
-__ZN7WebCore15PluginTokenizer23createDocumentStructureEv
-__ZN7WebCore16HTMLEmbedElement6setSrcERKNS_6StringE
-__ZN7WebCore16HTMLEmbedElement7setTypeERKNS_6StringE
-__ZNK7WebCore14PluginDocument16isPluginDocumentEv
-__ZN7WebCore15PluginTokenizer6finishEv
-__ZN7WebCore15PluginTokenizerD1Ev
-__ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
-__ZN7WebCore14PluginDocumentD1Ev
-__ZNK7WebCore17HTMLIFrameElement5widthEv
-__ZNK7WebCore6Chrome12canTakeFocusENS_14FocusDirectionE
-__ZNK7WebCore6Chrome9takeFocusENS_14FocusDirectionE
-__ZN7WebCore18JSHTMLStyleElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLStyleElement7setTypeERKNS_12AtomicStringE
-__ZNK7WebCore12RenderObject7isFrameEv
-__ZNK7WebCore14RenderFrameSet8edgeInfoEv
-__ZNK7WebCore14RenderFrameSet9canResizeERKNS_8IntPointE
-__ZNK7WebCore14RenderFrameSet12hitTestSplitERKNS0_8GridAxisEi
-__ZNK7WebCore17RenderTextControl12autosaveNameEv
-__ZN7WebCore15SearchPopupMenuC1EPNS_15PopupMenuClientE
-__ZN7WebCore15SearchPopupMenu18saveRecentSearchesERKNS_12AtomicStringERKN3WTF6VectorINS_6StringELm0EEE
-__ZN7WebCore11autosaveKeyERKNS_6StringE
-__ZN7WebCore8RenderBR22positionForCoordinatesEii
-__ZN7WebCore23JSHTMLOptionsCollection9setLengthEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore21HTMLOptionsCollection9setLengthEjRi
-__ZN7WebCore17HTMLSelectElement9setLengthEjRi
-__ZN7WebCore17HTMLOptionElement18setDefaultSelectedEb
-__ZN7WebCore40jsHTMLInputElementPrototypeFunctionClickEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11HTMLElement5clickEv
-__ZN7WebCore21JSDocumentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11HTMLElement3dirEv
-__ZNK7WebCore16HTMLInputElement3altEv
-__ZNK7WebCore12RenderObject24shouldPaintSelectionGapsEv
-__ZN7WebCore17HTMLScriptElement7setTextERKNS_6StringE
-__ZNK7WebCore28JSHTMLAnchorElementPrototype9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement8hreflangEv
-__ZNK7WebCore17HTMLAnchorElement5shapeEv
-__ZNK7WebCore17HTMLAnchorElement3revEv
+__ZN7WebCoreL10toGeorgianEi
+__ZN3WTFeqINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEEEb
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EEN
+__ZN7WebCoreeqERKNS_17CounterDirectivesES2_
+__ZN7WebCore21RenderObjectChildList18invalidateCountersEPNS_12RenderObjectE
+__ZN7WebCoreL29invalidateCountersInContainerEPNS_12RenderObjectE
+__ZN7WebCore13RenderCounter10invalidateEv
+__ZN7WebCore24jsHTMLMetaElementContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement7contentEv
+__ZN7WebCore9CSSParser13parseFillSizeEv
+__ZN7WebCore16CSSStyleSelector11mapFillSizeEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore17jsDocumentDoctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTitleElement4textEv
+__ZN7WebCore24jsDocumentImplementationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17DOMImplementationE
+__ZN7WebCore19JSDOMImplementation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSDOMImplementationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17DOMImplementationEEE
+__ZN7WebCore19JSDOMImplementationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17DOMImplementationEEE
+__ZN7WebCore19JSDOMImplementation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSDOMImplementationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore46jsDOMImplementationPrototypeFunctionHasFeatureEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSDOMImplementation9classInfoEv
+__ZN7WebCore48jsDocumentPrototypeFunctionCreateEntityReferenceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document21createEntityReferenceERKNS_6StringERi
+__ZN7WebCore27getExceptionCodeDescriptionEiRNS_24ExceptionCodeDescriptionE
+__ZN7WebCore13ExceptionBaseC2ERKNS_24ExceptionCodeDescriptionE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16DOMCoreExceptionE
+__ZN7WebCore18JSDOMCoreException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSDOMCoreExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DOMCoreExceptionEEE
+__ZN7WebCore18JSDOMCoreExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DOMCoreExceptionEEE
+__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
+__ZN7WebCore18JSDOMCoreException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSDOMCoreExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK3JSC8JSObject19isWatchdogExceptionEv
+__ZN7WebCore22jsDOMCoreExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12DocumentType19removedFromDocumentEv
+__ZThn8_N7WebCore12DocumentTypeD0Ev
+__ZN7WebCore18JSDOMCoreExceptionD1Ev
+__ZN7WebCore18JSDOMCoreExceptionD2Ev
+__ZN7WebCore19JSDOMImplementationD1Ev
+__ZN7WebCore19JSDOMImplementationD2Ev
+__ZThn8_N7WebCore16HTMLTitleElementD0Ev
+__ZN7WebCore27JSDOMCoreExceptionPrototypeD1Ev
+__ZN7WebCore28JSDOMImplementationPrototypeD1Ev
+__ZN7WebCore54jsDocumentPrototypeFunctionCreateProcessingInstructionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore8Document27createProcessingInstructionERKNS_6StringES3_Ri
+__ZNK7WebCore6JSAttr9classInfoEv
+__ZN7WebCore4Attr16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore4Attr15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore4Node9nodeValueEv
+__ZN7WebCore45jsDocumentPrototypeFunctionCreateCDATASectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document18createCDATASectionERKNS_6StringERi
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_12CDATASectionE
+__ZN7WebCore8Document9cloneNodeEb
+__ZN7WebCore18jsNodeNamespaceURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsDOMImplementationPrototypeFunctionCreateDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14toDocumentTypeEN3JSC7JSValueE
+__ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringES3_PNS_12DocumentTypeERi
+__ZN7WebCore8Document15createElementNSERKNS_6StringES3_Ri
+__ZN7WebCore8Document26hasPrefixNamespaceMismatchERKNS_13QualifiedNameE
+__ZN7WebCore14JSDocumentType15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSDocumentTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DocumentTypeEEE
+__ZN7WebCore14JSDocumentTypeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DocumentTypeEEE
+__ZN7WebCore14JSDocumentType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore8Document13createElementERKNS_12AtomicStringERi
+__ZN7WebCoreL15headConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore35jsNamedNodeMapPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Attr8nodeNameEv
+__ZNK7WebCore18JSHTMLTitleElement9classInfoEv
+__ZN7WebCore4Node26willMoveToNewOwnerDocumentEv
+__ZN7WebCore21updateDOMNodeDocumentEPNS_4NodeEPNS_8DocumentES3_
+__ZN7WebCore4Node25didMoveToNewOwnerDocumentEv
+__ZN7WebCore14JSDocumentTypeD1Ev
+__ZN7WebCore42jsDocumentPrototypeFunctionCreateAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document15createAttributeERKNS_6StringERi
+__ZN7WebCore8Document17createAttributeNSERKNS_6StringES3_Rib
+__ZN7WebCore23JSDocumentTypePrototypeD1Ev
+__ZN7WebCore4Attr9cloneNodeEb
+__ZN7WebCore6JSAttr3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore4Attr12setNodeValueERKNS_6StringERi
+__ZN7WebCore4Attr8setValueERKNS_6StringERi
+__ZN7WebCore14setJSAttrValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore6JSAttr8setValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore32jsNodePrototypeFunctionNormalizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node9normalizeEv
+__ZNK7WebCore4Node25traverseNextNodePostOrderEv
+__ZN7WebCore7Element19normalizeAttributesEv
+__ZN7WebCore8Document15textNodesMergedEPNS_4TextEj
+__ZN7WebCore4Node6removeERi
+__ZN7WebCore42jsCharacterDataPrototypeFunctionAppendDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore45jsCharacterDataPrototypeFunctionSubstringDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore43jsCharacterDataPrototypeFunctionReplaceDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsCharacterDataPrototypeFunctionInsertDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CharacterData11replaceDataEjjRKNS_6StringERi
+__ZNK7WebCore7Comment8nodeNameEv
+__ZNK7WebCore16DocumentFragment8nodeNameEv
+__ZN7WebCore18jsDocumentTypeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsElementPrototypeFunctionSetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement16setAttributeNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore6toAttrEN3JSC7JSValueE
+__ZN7WebCore7Element16setAttributeNodeEPNS_4AttrERi
+__ZN7WebCore12NamedNodeMap12setNamedItemEPNS_4NodeERi
+__ZNK7WebCore4Attr15isAttributeNodeEv
+__ZN7WebCore45jsElementPrototypeFunctionRemoveAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element19removeAttributeNodeEPNS_4AttrERi
+__ZN7WebCore43jsNamedNodeMapPrototypeFunctionSetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore46jsNamedNodeMapPrototypeFunctionRemoveNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13StyledElement25didMoveToNewOwnerDocumentEv
+__ZNK7WebCore12DocumentType8nodeNameEv
+__ZN7WebCore4Node12setNodeValueERKNS_6StringERi
+__ZN7WebCore32jsTextPrototypeFunctionSplitTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Text9splitTextEjRi
+__ZN7WebCore4Text9createNewEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore8Document13textNodeSplitEPNS_4TextE
+__ZN7WebCore44jsDocumentPrototypeFunctionCreateAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateDocumentTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore17DOMImplementation18createDocumentTypeERKNS_6StringES3_S3_Ri
+__ZN7WebCore40jsElementPrototypeFunctionSetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement14setAttributeNSEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13MutationEventC1Ev
+__ZN7WebCore13MutationEventC2Ev
+__ZNK7WebCore13MutationEvent15isMutationEventEv
+__ZN7WebCore15getDOMStructureINS_15JSMutationEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSMutationEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSMutationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MutationEventEEE
+__ZN7WebCore15JSMutationEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MutationEventEEE
+__ZN7WebCore15JSMutationEventD1Ev
+__ZN7WebCore7UIEventC1Ev
+__ZNK7WebCore5Event14isSVGZoomEventEv
+__ZN7WebCore15getDOMStructureINS_9JSUIEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore9JSUIEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7UIEventEEE
+__ZN7WebCore9JSUIEventD1Ev
+__ZN7WebCore24JSMutationEventPrototypeD1Ev
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14EventExceptionE
+__ZN7WebCore16JSEventException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSEventExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14EventExceptionEEE
+__ZN7WebCore16JSEventExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14EventExceptionEEE
+__ZN7WebCore16JSEventException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSEventExceptionTableEPN3JSC9ExecStateE
+__ZN7WebCore25JSEventExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSEventExceptionPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore16JSEventExceptionD1Ev
+__ZN7WebCore16JSEventExceptionD2Ev
+__ZN7WebCore20jsEventExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSEventExceptionPrototypeD1Ev
+__ZNK7WebCore15JSMutationEvent9classInfoEv
+__ZNK7WebCore9JSUIEvent9classInfoEv
+__ZN7WebCore15JSMutationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSMutationEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
+__ZNK7WebCore17HTMLObjectElement4typeEv
+__ZN7WebCore17HTMLObjectElement21renderFallbackContentEv
+__ZN7WebCore28jsHTMLAnchorElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement9accessKeyEv
+__ZN7WebCore26jsHTMLAnchorElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17HTMLAnchorElement7charsetEv
+__ZN7WebCore25jsHTMLAnchorElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17HTMLAnchorElement6coordsEv
-__ZNK7WebCore17HTMLAnchorElement9accessKeyEv
-__ZNK7WebCore17HTMLAnchorElement4portEv
-__ZN7WebCore16DeprecatedString6numberEi
-__ZN7WebCore16DeprecatedString6setNumEi
-__ZN7WebCore16DeprecatedString6formatEPKcz
-__ZNK7WebCore11HTMLElement9outerHTMLEv
-__ZNK7WebCore11HTMLElement4langEv
-__ZNK7WebCore11HTMLElement15contentEditableEv
-__ZNK7WebCore7Element9outerTextEv
-__ZN7WebCore7Element9clientTopEv
-__ZN7WebCore7Element10clientLeftEv
-__ZNK7WebCore4Node9nodeValueEv
-__ZNK7WebCore7Element6prefixEv
-__ZN7WebCore11FrameLoader21reportLocalLoadFailedEPKNS_4PageERKNS_6StringE
-__ZNK7WebCore11FrameLoader23isHostedByObjectElementEv
-__ZN3KJS38jsXMLHttpRequestPrototypeFunctionAbortEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore18JSHTMLTableElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLTableElement14setCellSpacingERKNS_6StringE
-__ZN7WebCore16HTMLTableElement14setCellPaddingERKNS_6StringE
-__ZN7WebCore20setTableCellsChangedEPNS_4NodeE
-__ZN7WebCore15HTMLFormElement16setAcceptCharsetERKNS_6StringE
-__ZN7WebCore37jsDocumentPrototypeFunctionImportNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document10importNodeEPNS_4NodeEbRi
-__ZN7WebCore16HTMLInputElement26copyNonAttributePropertiesEPKNS_7ElementE
-__ZN7WebCore37jsHTMLCollectionPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16JSHTMLCollection4itemEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore17HTMLScriptElement8setDeferEb
-__ZN7WebCore34jsElementPrototypeFunctionContainsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore27jsHTMLAnchorElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8hreflangEv
+__ZN7WebCore22jsHTMLAnchorElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement3revEv
+__ZN7WebCore24jsHTMLAnchorElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement5shapeEv
+__ZNK7WebCore17HTMLAnchorElement8tabIndexEv
+__ZN7WebCore8Document18focusedNodeRemovedEv
+__ZN7WebCore24jsHTMLAppletElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement5alignEv
+__ZN7WebCore17HTMLAppletElement19removedFromDocumentEv
+__ZThn8_N7WebCore17HTMLAppletElementD0Ev
+__ZN7WebCore22jsHTMLAppletElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement3altEv
+__ZN7WebCore26jsHTMLAppletElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement7archiveEv
+__ZN7WebCore23jsHTMLAppletElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement4codeEv
+__ZN7WebCore27jsHTMLAppletElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement8codeBaseEv
+__ZN7WebCore25jsHTMLAppletElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement6heightEv
+__ZN7WebCore25jsHTMLAppletElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6hspaceEv
+__ZN7WebCore23jsHTMLAppletElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLAppletElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6vspaceEv
+__ZN7WebCore24jsHTMLAppletElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement5widthEv
+__ZN7WebCore25jsHTMLAppletElementObjectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6objectEv
+__ZN7WebCore26jsHTMLAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement9accessKeyEv
+__ZN7WebCore20jsHTMLAreaElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement3altEv
+__ZN7WebCore23jsHTMLAreaElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6coordsEv
+__ZN7WebCore21jsHTMLAreaElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLAreaElementNoHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6noHrefEv
+__ZN7WebCore22jsHTMLAreaElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement5shapeEv
+__ZN7WebCore23jsHTMLAreaElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6targetEv
+__ZN7WebCore20jsHTMLBRElementClearEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLBRElement5clearEv
+__ZN7WebCoreL28createHTMLBaseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLBaseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLBaseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBaseElementEEE
+__ZN7WebCore17JSHTMLBaseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBaseElementEEE
+__ZN7WebCore17JSHTMLBaseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLBaseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBaseElement19removedFromDocumentEv
+__ZN7WebCore17JSHTMLBaseElementD1Ev
+__ZThn8_N7WebCore15HTMLBaseElementD0Ev
+__ZNK7WebCore12RenderObject7isFrameEv
+__ZN7WebCore23jsHTMLBaseElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBaseElement6targetEv
+__ZN7WebCore19HTMLFrameSetElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore26JSHTMLBaseElementPrototypeD1Ev
+__ZN7WebCoreL32createHTMLBaseFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLBaseFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLBaseFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLBaseFontElementEEE
+__ZN7WebCore21JSHTMLBaseFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLBaseFontElementEEE
+__ZN7WebCore21JSHTMLBaseFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLBaseFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement5colorEv
+__ZN7WebCore21JSHTMLBaseFontElementD1Ev
+__ZThn8_N7WebCore19HTMLBaseFontElementD0Ev
+__ZN7WebCore25jsHTMLBaseFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement4faceEv
+__ZN7WebCore30JSHTMLBaseFontElementPrototypeD1Ev
+__ZN7WebCore25jsHTMLBaseFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement4sizeEv
+__ZN7WebCore22jsHTMLBodyElementALinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement5aLinkEv
+__ZN7WebCore27jsHTMLBodyElementBackgroundEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLBodyElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement7bgColorEv
+__ZN7WebCore21jsHTMLBodyElementLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14CachedResource18destroyDecodedDataEv
+__ZN7WebCore24JSMimeTypeArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn8_N7WebCore17HTMLObjectElementD0Ev
+__ZThn8_N7WebCore16HTMLParamElementD0Ev
+__ZN7WebCore24setJSHTMLMetaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement7setNameERKNS_6StringE
+__ZN7WebCore27setJSHTMLMetaElementContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement10setContentERKNS_6StringE
+__ZN7WebCore26jsHTMLMetaElementHttpEquivEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement9httpEquivEv
+__ZN7WebCore12RenderButton28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
+__ZN7WebCore9FrameView23removeSlowRepaintObjectEv
+__ZN7WebCore5XPathL12createFunNotEv
+__ZNK7WebCore5XPath6FunNot8evaluateEv
+__ZN7WebCore5XPath6FunNotD0Ev
+__ZN7WebCore5XPath8FunctionD2Ev
+__ZN7WebCore21jsHTMLBodyElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement4textEv
+__ZN7WebCore22jsHTMLBodyElementVLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsNodePrototypeFunctionIsSupportedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node11isSupportedERKNS_6StringES3_
+__ZN3JSC8Bindings12ObjcInstance12virtualBeginEv
+__ZNK3JSC8Bindings12ObjcInstance8getClassEv
+__ZN3JSC8Bindings9ObjcClass11classForIsAEP10objc_class
+__ZN3JSC8Bindings9ObjcClassC1EP10objc_class
+__ZN3JSC8Bindings9ObjcClassC2EP10objc_class
+__ZNK3JSC8Bindings9ObjcClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3JSC8Bindings9ObjcClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZN3JSC8Bindings25convertJSMethodNameToObjcEPKcPcm
+__ZN3JSC8Bindings10ObjcMethodC1EP10objc_classP13objc_selector
+__ZN3JSC8Bindings10ObjcMethodC2EP10objc_classP13objc_selector
+__ZN3JSC8Bindings12ObjcInstance10virtualEndEv
+__ZN3JSC8Bindings12ObjcInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZN3JSC8Bindings12ObjcInstance18setGlobalExceptionEP8NSStringPNS_14JSGlobalObjectE
+__ZNK3JSC8Bindings10ObjcMethod18getMethodSignatureEv
+__ZN3JSC8Bindings20objcValueTypeForTypeEPKc
+__ZN3JSC8Bindings23convertValueToObjcValueEPNS_9ExecStateENS_7JSValueENS0_13ObjcValueTypeE
++[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]
+__ZN3JSC8Bindings23convertNSStringToStringEPNS_9ExecStateEP8NSString
+__ZN3JSC8Bindings12ObjcInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
+__ZNK7WebCore14RenderThemeMac22adjustSliderTrackStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore12RenderSliderC1EPNS_16HTMLInputElementE
+__ZN7WebCore12RenderSliderC2EPNS_16HTMLInputElementE
+__ZN7WebCore12RenderSlider14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderSlider17updateFromElementEv
+__ZN7WebCore11SliderRangeC1EPNS_16HTMLInputElementE
+__ZN7WebCore11SliderRangeC2EPNS_16HTMLInputElementE
+__ZN7WebCore11SliderRange16valueFromElementEPNS_16HTMLInputElementEPb
+__ZN7WebCore11SliderRange10clampValueEd
+__ZN7WebCore18SliderThumbElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore18SliderThumbElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore12RenderSlider16createThumbStyleEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac22adjustSliderThumbStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore17RenderFlexibleBoxC1EPNS_4NodeE
+__ZN7WebCore11RenderBlock23deleteEllipsisLineBoxesEv
+__ZN7WebCore11RenderBlock25checkLinesForTextOverflowEv
+__ZN7WebCore12RenderSlider6layoutEv
+__ZNK7WebCore14RenderThemeMac21adjustSliderThumbSizeEPNS_12RenderObjectE
+__ZN7WebCore12RenderSlider14calcPrefWidthsEv
+__ZNK7WebCore18SliderThumbElement12isShadowNodeEv
+__ZN7WebCore18SliderThumbElement16shadowParentNodeEv
+__ZNK7WebCore12RenderSlider16baselinePositionEbb
+__ZN7WebCore17RenderFlexibleBox17layoutVerticalBoxEb
+__ZN7WebCore11RenderBlock30markPositionedObjectsForLayoutEv
+__ZN7WebCore11RenderBlock15clearTruncationEv
+__ZN7WebCoreL16shouldCheckLinesEPNS_12RenderObjectE
+__ZN7WebCore13RootInlineBox22canAccommodateEllipsisEbiii
+__ZN7WebCore11RenderBlock9lineCountEv
+__ZN7WebCore13InlineFlowBox22canAccommodateEllipsisEbii
+__ZN7WebCore9InlineBox22canAccommodateEllipsisEbii
+__ZN7WebCore13RootInlineBox13placeEllipsisERKNS_12AtomicStringEbiiiPNS_9InlineBoxE
+__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore13RootInlineBoxESt4pairIS4_PNS1_11EllipsisBoxEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore13RootInlineBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore13InlineFlowBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore13InlineTextBox16placeEllipsisBoxEbiiiRb
+__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
+__ZN7WebCore11EllipsisBoxD0Ev
+__ZN7WebCore10ScrollView36adjustScrollbarsAvoidingResizerCountEi
+__ZN7WebCore9FrameView14invalidateRectERKNS_7IntRectE
+__ZN7WebCore6Chrome7repaintERKNS_7IntRectEbbb
+__ZN7WebCore14RenderThemeMac16paintSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCoreL24TrackGradientInterpolateEPvPKdPd
+__ZNK7WebCore12RenderSlider8isSliderEv
+__ZN7WebCore14RenderThemeMac16paintSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac21sliderThumbHorizontalEv
+__ZNK7WebCore12RenderSlider10inDragModeEv
+__ZN7WebCore15ActiveDOMObject7suspendEv
+__ZN7WebCore23jsHTMLButtonElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLButtonElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement9accessKeyEv
+__ZN7WebCore27jsHTMLButtonElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLButtonElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22HTMLFormControlElement8tabIndexEv
+__ZN7WebCore23jsHTMLButtonElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement15formControlTypeEv
+__ZN7WebCore24jsHTMLButtonElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement5valueEv
+__ZN7WebCore22jsHTMLTableElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16HTMLTableElement4rowsEv
+__ZN7WebCore23HTMLTableRowsCollection6createEN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore23HTMLTableRowsCollectionC1EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore23HTMLTableRowsCollectionC2EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore37jsHTMLCollectionPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSHTMLCollection9classInfoEv
+__ZN7WebCore16JSHTMLCollection4itemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore23HTMLTableRowsCollection9itemAfterEPNS_7ElementE
+__ZN7WebCore23HTMLTableRowsCollection8rowAfterEPNS_16HTMLTableElementEPNS_19HTMLTableRowElementE
+__ZN7WebCore29jsHTMLTableRowElementRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement8rowIndexEv
+__ZN7WebCore23HTMLTableRowsCollectionD0Ev
+__ZN7WebCore42jsHTMLCollectionPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSHTMLCollection9namedItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL8isInHeadEPNS_7ElementE
+__ZN7WebCore44jsHTMLTableElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement9insertRowEiRi
+__ZN7WebCore16textBreakCurrentEPNS_17TextBreakIteratorE
+__ZN7WebCore37jsPluginArrayPrototypeFunctionRefreshEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore13JSPluginArray9classInfoEv
+__ZN7WebCore11PluginArray7refreshEb
+__ZN7WebCore4Page14refreshPluginsEb
+__ZN7WebCore10PluginData7refreshEv
+__ZN7WebCore19CachedCSSStyleSheet11setEncodingERKNS_6StringE
+__ZN7WebCoreL38min_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL34device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore12compareValueIfEEbT_S1_NS_18MediaFeaturePrefixE
+__ZN7WebCoreL20directoryConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLDirectoryElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLDirectoryElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore20HTMLDirectoryElement17endTagRequirementEv
 __ZNK7WebCore20HTMLDirectoryElement11tagPriorityEv
-__ZN7WebCore17JSHTMLBodyElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLBodyElement12setScrollTopEi
-__ZN7WebCore43jsHTMLTextAreaElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTextAreaElement17setSelectionStartEi
-__ZN7WebCore17RenderTextControl17setSelectionStartEi
-__ZN7WebCore19HTMLTextAreaElement15setSelectionEndEi
-__ZN7WebCore17RenderTextControl15setSelectionEndEi
-__ZN7WebCore19HTMLTextAreaElement21updateFocusAppearanceEb
-__ZN7WebCore19HTMLTextAreaElement17setSelectionRangeEii
-__ZN7WebCore23getUniqueBoundaryStringERN3WTF6VectorIcLm0EEE
-__ZN7WebCore12randomNumberEv
+__ZN7WebCoreL33createHTMLDirectoryElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLDirectoryElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLDirectoryElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLDirectoryElementEEE
+__ZN7WebCore22JSHTMLDirectoryElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLDirectoryElementEEE
+__ZN7WebCore22JSHTMLDirectoryElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLDirectoryElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLDirectoryElement7compactEv
+__ZN7WebCore22JSHTMLDirectoryElementD1Ev
+__ZThn8_N7WebCore20HTMLDirectoryElementD0Ev
+__ZN7WebCore20HTMLDirectoryElementD0Ev
+__ZN7WebCore21jsHTMLDivElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLDivElement5alignEv
+__ZN7WebCore31JSHTMLDirectoryElementPrototypeD1Ev
+__ZN7WebCore25jsHTMLDListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLDListElement7compactEv
+__ZN7WebCore30jsHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLIFrameElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLIFrameElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23jsHTMLFormElementActionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL30createHTMLLegendElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLLegendElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLLegendElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLLegendElementEEE
+__ZN7WebCore19JSHTMLLegendElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLLegendElementEEE
+__ZN7WebCore19JSHTMLLegendElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLLegendElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore30JSHTMLIFrameElementConstructorD1Ev
+__ZN7WebCore19JSHTMLLegendElementD1Ev
+__ZN7WebCore28JSHTMLLegendElementPrototypeD1Ev
+__ZN7WebCore17jsDocumentAnchorsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7anchorsEv
+__ZNK7WebCore14RenderThemeMac35adjustSearchFieldResultsButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore23jsHTMLSelectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLButtonElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26jsHTMLInputElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore14HTMLMapElementD0Ev
+__ZN7WebCore14RenderThemeMac29paintSearchFieldResultsButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac18searchMenuTemplateEv
+__ZNK7WebCore13HTMLTokenizer15executingScriptEv
+__ZN7WebCore22jsHTMLTitleElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsHTMLDocumentHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument6heightEv
+__ZN7WebCore19jsHTMLDocumentWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument5widthEv
+__ZN7WebCore20jsHTMLDocumentEmbedsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document6embedsEv
+__ZN7WebCore26jsHTMLImageElementCompleteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement8completeEv
+__ZN7WebCore30jsHTMLImageElementNaturalWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement12naturalWidthEv
+__ZN7WebCore21jsHTMLDocumentPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7pluginsEv
+__ZN7WebCore20jsNavigatorVendorSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase9vendorSubEv
+__ZN7WebCore17jsScreenAvailLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen9availLeftEv
+__ZN7WebCore16jsScreenAvailTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen8availTopEv
+__ZN7WebCore14XMLHttpRequest24loadRequestSynchronouslyERNS_15ResourceRequestERi
+__ZN7WebCore16ThreadableLoader25loadResourceSynchronouslyEPNS_22ScriptExecutionContextERKNS_15ResourceRequestERNS_22ThreadableL
+__ZN7WebCore24DocumentThreadableLoader25loadResourceSynchronouslyEPNS_8DocumentERKNS_15ResourceRequestERNS_22ThreadableLoaderCl
+__ZN7WebCore11FrameLoader25loadResourceSynchronouslyERKNS_15ResourceRequestENS_17StoredCredentialsERNS_13ResourceErrorERNS_16Re
+__ZN7WebCore19ResourceRequestBase18setTimeoutIntervalEd
+__ZN7WebCore14ResourceHandle25loadResourceSynchronouslyERKNS_15ResourceRequestENS_17StoredCredentialsERNS_13ResourceErrorERNS_1
++[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]
+-[WebCoreSynchronousLoader _isDone]
+-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]
+-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]
+-[WebCoreSynchronousLoader connection:didReceiveResponse:]
+-[WebCoreSynchronousLoader connection:didReceiveData:]
+-[WebCoreSynchronousLoader connectionDidFinishLoading:]
+-[WebCoreSynchronousLoader _data]
+-[WebCoreSynchronousLoader _response]
+-[WebCoreSynchronousLoader _error]
+-[WebCoreSynchronousLoader dealloc]
+__ZN3WTF6RefPtrIN7WebCore10StringImplEEaSERKS3_
+__ZN7WebCore16ResourceResponseD2Ev
+__ZN7WebCore29setJSDOMWindowTextConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20jsDOMWindowOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9onkeydownEv
+__ZN7WebCore23setJSDOMWindowOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore27jsHTMLInputElementMaxLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement9maxLengthEv
+__ZN7WebCore13jsNodeOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onkeyupEv
+__ZN7WebCoreL25min_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL21widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore16CSSStyleSelector36addViewportDependentMediaQueryResultEPKNS_13MediaQueryExpEb
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE15reserveCapacityEm
+__ZThn8_N7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore21jsHTMLLinkElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement4typeEv
+__ZN7WebCore23jsHTMLScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement4typeEv
+__ZN7WebCore16DocumentFragment9cloneNodeEb
+__ZNK7WebCore26CSSMutableStyleDeclaration10get4ValuesEPKi
+__ZN7WebCore14RenderListItem16setExplicitValueEi
+__ZN7WebCore14RenderListItem20explicitValueChangedEv
+__ZN7WebCore10HTMLParser23noembedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE6shrinkEm
+__ZN7WebCore5Cache18revalidationFailedEPNS_14CachedResourceE
+__ZN7WebCore9FrameView20postLayoutTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore14CachedResource19httpStatusCodeErrorEv
+__ZN7WebCore19CachedCSSStyleSheet5errorEv
+__ZN7WebCore31setJSHTMLAnchorElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement12setAccessKeyERKNS_12AtomicStringE
+__ZN7WebCore21setJSDOMWindowConsoleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL19optgroupConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLOptGroupElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLOptGroupElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLOptGroupElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore19HTMLOptGroupElement19recalcSelectOptionsEv
+__ZN7WebCore19HTMLOptGroupElement6attachEv
+__ZN7WebCore19HTMLOptGroupElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore19HTMLOptGroupElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore19HTMLOptGroupElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore19HTMLOptGroupElement22nonRendererRenderStyleEv
+__ZN7WebCore25jsHTMLFieldSetElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore19HTMLFieldSetElementD0Ev
+__ZN7WebCore22jsHTMLFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement5colorEv
+__ZN7WebCore12CachedScript5errorEv
+__ZThn8_N7WebCore15HTMLFontElementD0Ev
+__ZN7WebCore21jsHTMLFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement4faceEv
+__ZN7WebCore21jsHTMLFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement4sizeEv
+__ZN7WebCore10StringImpl37createStrippingNullCharactersSlowCaseEPKtj
+__ZThn112_N7WebCore17HTMLScriptElement18dispatchErrorEventEv
+__ZN7WebCore17HTMLScriptElement18dispatchErrorEventEv
+__ZN7WebCore30jsHTMLFormElementAcceptCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLFormElementEnctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20setJSNodeTextContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23jsHTMLFormElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement6targetEv
+__ZN7WebCoreL15compareBoxStartEPKNS_13InlineTextBoxES2_
+__ZSt25__unguarded_linear_insertIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EEvT_T0_T1_
+__ZN7WebCore19HTMLTextAreaElement5resetEv
 __ZN7WebCore19HTMLTextAreaElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore17DeprecatedCStringaSEPKc
-__ZN7WebCore9ArrayImpl9duplicateEPKvm
-__ZN7WebCore44jsHTMLTableElementPrototypeFunctionDeleteRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement9deleteRowEiRi
-__ZN7WebCore4Node6removeERi
-__ZNK7WebCore21JSHTMLTableColElement9classInfoEv
-__ZN7WebCore20HTMLTableCellElement9setVAlignERKNS_6StringE
-__ZN7WebCore16HTMLTableElement9setBorderERKNS_6StringE
-__ZN7WebCore21JSHTMLTableRowElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore19HTMLTableRowElement8setAlignERKNS_6StringE
-__ZN7WebCore16HTMLTableElement7tBodiesEv
-__ZN7WebCore19HTMLTableRowElement9setVAlignERKNS_6StringE
-__ZN7WebCore16HTMLTableElement8setWidthERKNS_6StringE
-__ZN7WebCore16HTMLTableElement8setAlignERKNS_6StringE
+__ZN7WebCoreL29createHTMLFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLFrameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLFrameElementEEE
+__ZN7WebCore18JSHTMLFrameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLFrameElementEEE
+__ZN7WebCore18JSHTMLFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase11frameBorderEv
+__ZN7WebCore18JSHTMLFrameElementD1Ev
+__ZThn8_N7WebCore16HTMLFrameElementD0Ev
+__ZN7WebCore26jsHTMLFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase8longDescEv
+__ZN7WebCore27JSHTMLFrameElementPrototypeD1Ev
+__ZN7WebCore30jsHTMLFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase12marginHeightEv
+__ZN7WebCore29jsHTMLFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase11marginWidthEv
+__ZN7WebCore22jsHTMLFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLFrameElementNoResizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase9scrollingEv
+__ZN7WebCore21jsHTMLFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE15reserveCapacityEm
+__ZN7WebCoreL32createHTMLFrameSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLFrameSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLFrameSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFrameSetElementEEE
+__ZN7WebCore21JSHTMLFrameSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFrameSetElementEEE
+__ZN7WebCore21JSHTMLFrameSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSHTMLFrameSetElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_19HTMLFrameSetElementERKNS1_10IdentifierE
+__ZN7WebCore11HTMLElement8childrenEv
+__ZNK7WebCore14HTMLCollection9namedItemERKNS_12AtomicStringE
+__ZNK7WebCore14HTMLCollection17checkForNameMatchEPNS_7ElementEbRKNS_12AtomicStringE
+__ZN7WebCore25jsHTMLFrameSetElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFrameSetElement4colsEv
+__ZN7WebCore21JSHTMLFrameSetElementD1Ev
+__ZThn8_N7WebCore19HTMLFrameSetElementD0Ev
+__ZN7WebCore25jsHTMLFrameSetElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFrameSetElement4rowsEv
+__ZN7WebCore30JSHTMLFrameSetElementPrototypeD1Ev
+__ZN7WebCore20jsHTMLHRElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement5alignEv
+__ZThn8_N7WebCore13HTMLHRElementD0Ev
+__ZN7WebCore22jsHTMLHRElementNoShadeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement7noShadeEv
+__ZNK7WebCore11RenderBlock16leftmostPositionEbb
+__ZNK7WebCore9RenderBox16leftmostPositionEbb
+__ZN7WebCore19jsHTMLHRElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement4sizeEv
+__ZSt21__unguarded_partitionIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EET_S8_S8_T0_T1_
+__ZN7WebCore20jsHTMLHRElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement5widthEv
+__ZN7WebCore24jsHTMLHeadElementProfileEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLHeadElement7profileEv
+__ZN7WebCore25jsHTMLHeadingElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18HTMLHeadingElement5alignEv
+__ZN7WebCore24jsHTMLHtmlElementVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLHtmlElement7versionEv
+__ZN7WebCore24jsHTMLIFrameElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement5alignEv
+__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPtjELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIPtjELm0EE6shrinkEm
+__ZN7WebCore30jsHTMLIFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLElementOuterHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement9outerHTMLEv
+__ZN7WebCore27jsHTMLIFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLIFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLIFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLIFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLIFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLImageElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement4nameEv
+__ZN7WebCore23jsHTMLImageElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5alignEv
+__ZN7WebCore24jsHTMLImageElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6borderEv
+__ZN7WebCore24jsHTMLImageElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6hspaceEv
+__ZN7WebCore23jsHTMLImageElementIsMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5isMapEv
+__ZN7WebCore26jsHTMLImageElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement8longDescEv
+__ZN7WebCore24jsHTMLImageElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLImageElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6vspaceEv
+__ZN7WebCore10StringImpl6secureEt
+__ZN7WebCore30jsHTMLInputElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement12defaultValueEv
+__ZN7WebCore32jsHTMLInputElementDefaultCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement14defaultCheckedEv
+__ZN7WebCore24jsHTMLInputElementAcceptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement6acceptEv
+__ZN7WebCore27jsHTMLInputElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement9accessKeyEv
+__ZN7WebCore23jsHTMLInputElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement5alignEv
+__ZN7WebCore21jsHTMLInputElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement3altEv
+__ZN7WebCore26jsHTMLInputElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLInputElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsHTMLInputElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLInputElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement6useMapEv
+__ZN7WebCore40jsHTMLInputElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement5clickEv
+__ZNK7WebCore19CheckedRadioButtons21checkedButtonForGroupERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERK
+__ZN7WebCore10HTMLParser23isindexCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser13handleIsindexEPNS_5TokenE
+__ZN7WebCore18HTMLIsIndexElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore18HTMLIsIndexElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLInputElement14setDefaultNameERKNS_12AtomicStringE
+__ZN7WebCore18HTMLIsIndexElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore27searchableIndexIntroductionEv
+__ZN7WebCoreL31createHTMLIsIndexElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLIsIndexElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLIsIndexElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLIsIndexElementEEE
+__ZN7WebCore20JSHTMLIsIndexElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLIsIndexElementEEE
+__ZN7WebCore20JSHTMLIsIndexElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLIsIndexElementPromptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18HTMLIsIndexElement6promptEv
+__ZN7WebCore24jsHTMLIsIndexElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18HTMLIsIndexElementD0Ev
+__ZN7WebCore20JSHTMLIsIndexElementD1Ev
+__ZThn8_N7WebCore18HTMLIsIndexElementD0Ev
+__ZN7WebCore29JSHTMLIsIndexElementPrototypeD1Ev
+__ZN7WebCore22jsHTMLLabelElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLLabelElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLLabelElement9accessKeyEv
+__ZN7WebCore33jsDOMWindowPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5closeEv
+__ZNK7WebCore11FrameLoader11openedByDOMEv
+__ZN7WebCore5Frame13scheduleCloseEv
+__ZN7WebCore6Chrome15closeWindowSoonEv
+__ZN7WebCore25jsHTMLLabelElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLLabelElement7htmlForEv
+__ZN7WebCore23jsHTMLLegendElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore17HTMLLegendElementD0Ev
+__ZN7WebCore28jsHTMLLegendElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLLegendElement9accessKeyEv
+__ZN7WebCore24jsHTMLLegendElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLLegendElement5alignEv
+__ZN7WebCore25jsHTMLLinkElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement8disabledEv
+__ZN7WebCore24jsHTMLLinkElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement7charsetEv
+__ZN7WebCore19HTMLOptGroupElement6detachEv
+__ZN7WebCore25jsHTMLLinkElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement8hreflangEv
+__ZN7WebCore19HTMLOptGroupElementD0Ev
+__ZN7WebCore22jsHTMLLinkElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement5mediaEv
+__ZN7WebCore20jsHTMLLinkElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement3revEv
+__ZN7WebCore23jsHTMLLinkElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement6targetEv
+__ZN7WebCore21jsHTMLMapElementAreasEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14HTMLMapElement5areasEv
+__ZN7WebCore20jsHTMLMapElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLMapElement4nameEv
+__ZN7WebCoreL15menuConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLMenuElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMenuElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLMenuElement17endTagRequirementEv
+__ZNK7WebCore15HTMLMenuElement11tagPriorityEv
+__ZN7WebCoreL28createHTMLMenuElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLMenuElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLMenuElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMenuElementEEE
+__ZN7WebCore17JSHTMLMenuElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMenuElementEEE
+__ZN7WebCore17JSHTMLMenuElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsHTMLMenuElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMenuElement7compactEv
+__ZN7WebCore17JSHTMLMenuElementD1Ev
+__ZThn8_N7WebCore15HTMLMenuElementD0Ev
+__ZN7WebCore15HTMLMenuElementD0Ev
+__ZThn8_N7WebCore15HTMLMetaElementD0Ev
+__ZN7WebCore26JSHTMLMenuElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLMetaElementSchemeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement6schemeEv
+__ZN7WebCore20jsHTMLModElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLModElement4citeEv
+__ZThn8_N7WebCore14HTMLModElementD0Ev
+__ZN7WebCore24jsHTMLModElementDateTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLModElement8dateTimeEv
+__ZN7WebCore25jsHTMLOListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLOListElement7compactEv
+__ZN7WebCore23jsHTMLOListElementStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLOListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLOListElement4typeEv
+__ZN7WebCore23jsHTMLObjectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLObjectElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement4codeEv
+__ZN7WebCore24jsHTMLObjectElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLObjectElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7archiveEv
+__ZN7WebCore25jsHTMLObjectElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6borderEv
+__ZN7WebCore27jsHTMLObjectElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement8codeBaseEv
+__ZN7WebCore27jsHTMLObjectElementCodeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement8codeTypeEv
+__ZN7WebCore23jsHTMLObjectElementDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement4dataEv
+__ZN7WebCore26jsHTMLObjectElementDeclareEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7declareEv
+__ZN7WebCore25jsHTMLObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLObjectElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6hspaceEv
+__ZN7WebCore26jsHTMLObjectElementStandbyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7standbyEv
+__ZN7WebCore23jsHTMLObjectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLObjectElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6useMapEv
+__ZN7WebCore25jsHTMLObjectElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6vspaceEv
+__ZN7WebCore24jsHTMLObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLObjectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLObjectElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL32createHTMLOptGroupElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLOptGroupElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLOptGroupElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLOptGroupElementEEE
+__ZN7WebCore21JSHTMLOptGroupElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLOptGroupElementEEE
+__ZN7WebCore21JSHTMLOptGroupElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLOptGroupElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLOptGroupElementD1Ev
+__ZThn8_N7WebCore19HTMLOptGroupElementD0Ev
+__ZN7WebCore26jsHTMLOptGroupElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLOptGroupElement5labelEv
+__ZN7WebCore30JSHTMLOptGroupElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLOptionElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore34jsHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement15defaultSelectedEv
+__ZN7WebCore23jsHTMLOptionElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement4textEv
+__ZN7WebCore24jsHTMLOptionElementIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLOptionElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement5labelEv
+__ZN7WebCore32JSHTMLOptionsCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSHTMLOptionsCollection9classInfoEv
+__ZN7WebCore16HTMLInputElement39unregisterForActivationCallbackIfNeededEv
+__ZN7WebCore27jsHTMLParagraphElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLParagraphElement5alignEv
+__ZN7WebCore27jsHTMLParamElementValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLParamElement9valueTypeEv
+__ZN7WebCore22jsHTMLParamElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLParamElement4typeEv
+__ZN7WebCore21jsHTMLPreElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLPreElement5widthEv
+__ZN7WebCoreL16quoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLQuoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLQuoteElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLQuoteElement17endTagRequirementEv
+__ZNK7WebCore16HTMLQuoteElement11tagPriorityEv
+__ZN7WebCore16HTMLQuoteElement20insertedIntoDocumentEv
+__ZN7WebCoreL29createHTMLQuoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLQuoteElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLQuoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLQuoteElementEEE
+__ZN7WebCore18JSHTMLQuoteElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLQuoteElementEEE
+__ZN7WebCore18JSHTMLQuoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLQuoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLQuoteElement4citeEv
+__ZN7WebCore18JSHTMLQuoteElementD1Ev
+__ZThn8_N7WebCore16HTMLQuoteElementD0Ev
+__ZN7WebCore16HTMLQuoteElementD0Ev
+__ZN7WebCoreL34createHTMLBlockquoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSHTMLBlockquoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLBlockquoteElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLBlockquoteElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsHTMLBlockquoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLBlockquoteElement4citeEv
+__ZN7WebCore23JSHTMLBlockquoteElementD1Ev
+__ZThn8_N7WebCore21HTMLBlockquoteElementD0Ev
+__ZN7WebCore27JSHTMLQuoteElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLScriptElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement4textEv
+__ZN7WebCore32JSHTMLBlockquoteElementPrototypeD1Ev
+__ZN7WebCore26jsHTMLScriptElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement7charsetEv
+__ZN7WebCore24jsHTMLScriptElementDeferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement5deferEv
+__ZN7WebCore26jsHTMLScriptElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement7htmlForEv
+__ZN7WebCore24jsHTMLScriptElementEventEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement5eventEv
+__ZN7WebCore23jsHTMLSelectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLSelectElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLSelectElementMultipleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLSelectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLSelectElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement18dispatchFocusEventEv
+__ZN7WebCore17HTMLSelectElement26listBoxDefaultEventHandlerEPNS_5EventE
+__ZN7WebCore17HTMLSelectElement17dispatchBlurEventEv
+__ZN7WebCore42jsHTMLSelectElementPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19JSHTMLSelectElement6removeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13toHTMLElementEN3JSC7JSValueE
+__ZN7WebCore17HTMLSelectElement6removeEi
+__ZN7WebCore39jsHTMLSelectElementPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26jsHTMLStyleElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLStyleElement8disabledEv
+__ZN7WebCore23jsHTMLStyleElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLStyleElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36createHTMLTableCaptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLTableCaptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableCaptionElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableCaptionElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsHTMLTableCaptionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableCaptionElement5alignEv
+__ZN7WebCore25JSHTMLTableCaptionElementD1Ev
+__ZThn8_N7WebCore23HTMLTableCaptionElementD0Ev
+__ZN7WebCore31jsHTMLTableCellElementCellIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLTableCellElement9cellIndexEv
+__ZN7WebCore34JSHTMLTableCaptionElementPrototypeD1Ev
+__ZN7WebCore26jsHTMLTableCellElementAbbrEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableCellElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5alignEv
+__ZN7WebCore26jsHTMLTableCellElementAxisEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTableCellElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement7bgColorEv
+__ZN7WebCore24jsHTMLTableCellElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement2chEv
+__ZN7WebCore27jsHTMLTableCellElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5chOffEv
+__ZN7WebCore29jsHTMLTableCellElementColSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTableCellElementHeadersEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLTableCellElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6heightEv
+__ZN7WebCore28jsHTMLTableCellElementNoWrapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6noWrapEv
+__ZN7WebCore29jsHTMLTableCellElementRowSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableCellElementScopeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLTableCellElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6vAlignEv
+__ZN7WebCore27jsHTMLTableCellElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5widthEv
+__ZN7WebCore26jsHTMLTableColElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5alignEv
+__ZThn8_N7WebCore19HTMLTableColElementD0Ev
+__ZN7WebCore23jsHTMLTableColElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement2chEv
+__ZN7WebCore26jsHTMLTableColElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5chOffEv
+__ZN7WebCore25jsHTMLTableColElementSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableColElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement6vAlignEv
+__ZN7WebCore26jsHTMLTableColElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5widthEv
+__ZN7WebCore25jsHTMLTableElementCaptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLTableSectionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement5alignEv
+__ZN7WebCore23jsHTMLTableElementTFootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLTableElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5alignEv
+__ZN7WebCore25jsHTMLTableElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement7bgColorEv
+__ZN7WebCore24jsHTMLTableElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement6borderEv
+__ZN7WebCore29jsHTMLTableElementCellPaddingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement11cellPaddingEv
+__ZN7WebCore29jsHTMLTableElementCellSpacingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement11cellSpacingEv
+__ZN7WebCore23jsHTMLTableElementFrameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5frameEv
+__ZN7WebCore23jsHTMLTableElementRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTableElementSummaryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLTableElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5widthEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement11createTHeadEv
+__ZN7WebCore16HTMLTableElement8setTHeadEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
+__ZN7WebCore16HTMLTableElement11deleteTHeadEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZThn8_N7WebCore23HTMLTableSectionElementD0Ev
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement11createTFootEv
+__ZN7WebCore16HTMLTableElement8setTFootEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
+__ZN7WebCore16HTMLTableElement11deleteTFootEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsHTMLTableElementPrototypeFunctionCreateCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement13createCaptionEv
+__ZN7WebCore16HTMLTableElement10setCaptionEN3WTF10PassRefPtrINS_23HTMLTableCaptionElementEEERi
+__ZN7WebCore16HTMLTableElement13deleteCaptionEv
+__ZN7WebCore48jsHTMLTableElementPrototypeFunctionDeleteCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16HTMLTableElement8lastBodyEv
+__ZN7WebCore44jsHTMLTableElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement9deleteRowEiRi
+__ZN7WebCore23HTMLTableRowsCollection7lastRowEPNS_16HTMLTableElementE
+__ZN7WebCore36jsHTMLTableRowElementSectionRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement15sectionRowIndexEv
+__ZN7WebCore26jsHTMLTableRowElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement5alignEv
+__ZN7WebCore28jsHTMLTableRowElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement7bgColorEv
+__ZN7WebCore23jsHTMLTableRowElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement2chEv
+__ZN7WebCore26jsHTMLTableRowElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement5chOffEv
+__ZN7WebCore27jsHTMLTableRowElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement6vAlignEv
+__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionInsertCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTableRowElement10insertCellEiRi
+__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionDeleteCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTableRowElement10deleteCellEiRi
+__ZN7WebCore27jsHTMLTableSectionElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement2chEv
+__ZN7WebCore30jsHTMLTableSectionElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement5chOffEv
+__ZN7WebCore31jsHTMLTableSectionElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement6vAlignEv
+__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23HTMLTableSectionElement9insertRowEiRi
+__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23HTMLTableSectionElement9deleteRowEiRi
+__ZN7WebCore33jsHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTextAreaElement9accessKeyEv
+__ZN7WebCore25jsHTMLTextAreaElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTextAreaElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsHTMLTextAreaElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTextAreaElement6selectEv
+__ZN7WebCore25jsHTMLUListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLUListElement7compactEv
+__ZN7WebCore11MediaPlayer12supportsTypeENS_11ContentTypeE
+__ZN7WebCoreL20mimeCommonTypesCacheEv
+__ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
+__ZN7WebCore11SVGDocumentC1EPNS_5FrameE
+__ZN7WebCore11SVGDocumentC2EPNS_5FrameE
+__ZNK7WebCore11SVGDocument13isSVGDocumentEv
+__ZN7WebCore13JSSVGDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGDocumentEEE
+__ZN7WebCore13JSSVGDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGDocumentEEE
 __ZN7WebCore17SVGElementFactory16createSVGElementERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_10SVGElementEPNS1_8DocumentEbENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSC_IS9_EEE3getERKS3_
-__ZN7WebCore14svgConstructorEPNS_8DocumentEb
+__ZN7WebCoreL6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_10SVGElementEEES2_PNS_8DocumentEbE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEbENS_7P
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8Doc
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEbENS_7
+__ZN7WebCoreL14svgConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore13SVGSVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore12SVGLocatableC2Ev
 __ZN7WebCore25SVGStyledLocatableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16SVGStyledElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore10SVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore10SVGElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore11SVGStylableC2Ev
 __ZN7WebCore8SVGTestsC2Ev
 __ZN7WebCore12SVGLangSpaceC2Ev
 __ZN7WebCore28SVGExternalResourcesRequiredC2Ev
 __ZN7WebCore15SVGFitToViewBoxC2Ev
 __ZN7WebCore22SVGPreserveAspectRatioC1Ev
+__ZN7WebCore22SVGPreserveAspectRatioC2Ev
 __ZN7WebCore13SVGZoomAndPanC2Ev
-__ZN7WebCore9SVGLengthC1EPKNS_16SVGStyledElementENS_13SVGLengthModeERKNS_6StringE
+__ZN7WebCore9SVGLengthC1ENS_13SVGLengthModeERKNS_6StringE
+__ZN7WebCore9SVGLengthC2ENS_13SVGLengthModeERKNS_6StringE
 __ZN7WebCore9SVGLength16setValueAsStringERKNS_6StringE
-__ZN7WebCore13TimeSchedulerC1EPNS_8DocumentE
-__ZN7WebCore8SVGTimerC1EPNS_13TimeSchedulerEdb
+__ZN7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStri
 __ZN7WebCore11parseNumberERPKtS1_Rfb
 __ZN7WebCore18stringToLengthTypeERKNS_6StringE
-__ZN7WebCore13SVGSVGElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore8Document19accessSVGExtensionsEv
-__ZN7WebCore21SVGDocumentExtensionsC1EPNS_8DocumentE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_9SVGLengthEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore13SVGSVGElement8setWidthENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore10SVGElement12isSVGElementEv
-__ZN7WebCore18createJSSVGWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3KJS9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSG_ISD_EEE3getERKS3_
-__ZN7WebCore16createSVGWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore24JSSVGSVGElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSSVGSVGElementC1EPN3KJS8JSObjectEPNS_13SVGSVGElementE
-__ZN7WebCore12JSSVGElementC1EPN3KJS8JSObjectEPNS_10SVGElementE
-__ZN7WebCore15JSSVGSVGElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSSVGElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSSVGSVGElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSSVGSVGElement9classInfoEv
+__ZN7WebCore17SMILTimeContainerC1EPNS_13SVGSVGElementE
+__ZN7WebCore17SMILTimeContainerC2EPNS_13SVGSVGElementE
 __ZN7WebCore10SVGElement16attributeChangedEPNS_9AttributeEb
 __ZNK7WebCore16SVGStyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore16SVGStyledElement32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
-__ZN7WebCore25mapAttributeToCSSPropertyEPN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_13QualifiedNameEPKc
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3getERKS3_
 __ZN7WebCore13SVGSVGElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore25SVGStyledLocatableElement22nearestViewportElementEv
-__ZN7WebCore12SVGLocatable22nearestViewportElementEPKNS_16SVGStyledElementE
+__ZN7WebCore12SVGLocatable22nearestViewportElementEPKNS_10SVGElementE
 __ZN7WebCore8SVGTests20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore12SVGLangSpace20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore28SVGExternalResourcesRequired20parseMappedAttributeEPNS_15MappedAttributeE
@@ -9267,289 +13008,251 @@ __ZN7WebCore10SVGElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore13SVGSVGElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZN7WebCore16SVGStyledElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZNK7WebCore16SVGStyledElement34invalidateResourcesInAncestorChainEv
-__ZNK7WebCore16SVGStyledElement21updateElementInstanceEPNS_21SVGDocumentExtensionsE
-__ZNK7WebCore21SVGDocumentExtensions19instancesForElementEPNS_10SVGElementE
-__ZN3WTF7HashMapIPN7WebCore10SVGElementEPNS_7HashSetIPNS1_18SVGElementInstanceENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EENS9_IS3_EENS9_ISC_EEE3addERKS3_RKSC_
-__ZNK7WebCore13SVGSVGElement5widthEv
-__ZNK7WebCore9SVGLength5valueEv
-__ZNK7WebCore13SVGSVGElement6heightEv
+__ZN7WebCore18SVGElementInstance31invalidateAllInstancesOfElementEPNS_10SVGElementE
+__ZNK7WebCore10SVGElement19instancesForElementEv
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC1ER
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC2ER
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15de
+__ZNK7WebCore10SVGElement12isSVGElementEv
 __ZN7WebCore13SVGSVGElement20insertedIntoDocumentEv
+__ZN7WebCore8Document19accessSVGExtensionsEv
+__ZN7WebCore21SVGDocumentExtensionsC1EPNS_8DocumentE
+__ZN7WebCore21SVGDocumentExtensionsC2EPNS_8DocumentE
 __ZN7WebCore21SVGDocumentExtensions16addTimeContainerEPNS_13SVGSVGElementE
 __ZN3WTF7HashSetIPN7WebCore13SVGSVGElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocat
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloc
 __ZN7WebCore10SVGElement20insertedIntoDocumentEv
 __ZNK7WebCore10SVGElement2idEv
 __ZN7WebCore15SVGURIReference9getTargetERKNS_6StringE
 __ZNK7WebCore21SVGDocumentExtensions17isPendingResourceERKNS_12AtomicStringE
-__ZN7WebCore12parseUASheetIA359_cEEPNS_13CSSStyleSheetERKT_
 __ZNK7WebCore10SVGElement12isShadowNodeEv
 __ZN7WebCore13SVGSVGElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore13SVGSVGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZNK7WebCore13SVGSVGElement14isOutermostSVGEv
 __ZN7WebCore13RenderSVGRootC1EPNS_16SVGStyledElementE
-__ZN7WebCore15defsConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGDefsElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13RenderSVGRootC2EPNS_16SVGStyledElementE
+__ZNK7WebCore13RenderSVGRoot15virtualChildrenEv
+__ZN7WebCoreL15rectConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGRectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore29SVGStyledTransformableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16SVGTransformableC2Ev
 __ZN7WebCore16SVGTransformListC1ERKNS_13QualifiedNameE
-__ZN7WebCore17createDefsWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGDefsElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGDefsElementC1EPN3KJS8JSObjectEPNS_14SVGDefsElementE
-__ZN7WebCore16JSSVGDefsElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGDefsElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGDefsElement9classInfoEv
-__ZN7WebCore29SVGStyledTransformableElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGTransformListC2ERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3getERKS3_
+__ZN7WebCore14SVGRectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore10SVGElement27accessDocumentSVGExtensionsEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_9SVGLengthENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_
+__ZNK7WebCore10SVGElement28setSynchronizedSVGAttributesEb
+__ZN7WebCore14SVGRectElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore10SVGElement26updateAnimatedSVGAttributeERKNS_6StringE
+__ZNK7WebCore9SVGLength5valueEPKNS_10SVGElementE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashE
+__ZN7WebCore16SVGStyledElement15childrenChangedEbPNS_4NodeES2_i
 __ZNK7WebCore10SVGElement25childShouldCreateRendererEPNS_4NodeE
-__ZNK7WebCore14SVGDefsElement7isValidEv
+__ZNK7WebCore14SVGRectElement7isValidEv
 __ZNK7WebCore8SVGTests7isValidEv
 __ZN7WebCore16SVGStyledElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore14SVGDefsElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore24RenderSVGHiddenContainerC1EPNS_16SVGStyledElementE
-__ZN7WebCore18RenderSVGContainerC1EPNS_16SVGStyledElementE
-__ZNK7WebCore18RenderSVGContainer10firstChildEv
+__ZN7WebCore29SVGStyledTransformableElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10RenderPathC1EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore10RenderPathC2EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore20RenderSVGModelObjectC2EPNS_16SVGStyledElementE
+__ZN7WebCore13RenderSVGRoot15virtualChildrenEv
 __ZNK7WebCore13RenderSVGRoot9isSVGRootEv
-__ZN7WebCore16SVGStyledElement15childrenChangedEb
-__ZN7WebCore15JSSVGSVGElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12JSSVGElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12gConstructorEPNS_8DocumentEb
-__ZN7WebCore11SVGGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14createGWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore22JSSVGGElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore13JSSVGGElementC1EPN3KJS8JSObjectEPNS_11SVGGElementE
-__ZN7WebCore15rectConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGRectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17createRectWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGRectElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGRectElementC1EPN3KJS8JSObjectEPNS_14SVGRectElementE
-__ZN7WebCore16JSSVGRectElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGRectElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10SVGElement21finishParsingChildrenEv
+__ZN7WebCore10SVGElement26sendSVGLoadEventIfPossibleEb
+__ZN7WebCore10SVGElement27haveLoadedRequiredResourcesEv
+__ZThn112_NK7WebCore17HTMLScriptElement20sourceAttributeValueEv
+__ZThn112_NK7WebCore17HTMLScriptElement13scriptCharsetEv
+__ZN7WebCore12XMLTokenizer12pauseParsingEv
+__ZN3WTF5DequeIPN7WebCore16PendingCallbacks15PendingCallbackEE14expandCapacityEv
+__ZThn16_N7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore10SVGElement15eventParentNodeEv
+__ZN7WebCore12XMLTokenizer13resumeParsingEv
+__ZN7WebCore16PendingCallbacks25PendingCharactersCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks25PendingCharactersCallbackD0Ev
+__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallbackD0Ev
+__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallbackD0Ev
+__ZN7WebCoreL28processingInstructionHandlerEPvPKhS2_
+__ZN7WebCore12XMLTokenizer21processingInstructionEPKhS2_
+__ZN7WebCore21ProcessingInstructionC1EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore21ProcessingInstructionC2EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore21ProcessingInstruction20insertedIntoDocumentEv
+__ZN7WebCore21ProcessingInstruction15checkStyleSheetEv
+__ZN7WebCore21ProcessingInstruction21finishParsingChildrenEv
+__ZN7WebCoreL21internalSubsetHandlerEPvPKhS2_S2_
+__ZN7WebCore12XMLTokenizer14internalSubsetEPKhS2_S2_
+__ZN7WebCore8Document18determineParseModeEv
+__ZN7WebCoreL16getEntityHandlerEPvPKh
+__ZN7WebCoreL21externalSubsetHandlerEPvPKhS2_S2_
+__ZN7WebCoreL17cdataBlockHandlerEPvPKhi
+__ZN7WebCore12XMLTokenizer10cdataBlockEPKhi
+__ZN7WebCore12CDATASectionC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore12CDATASectionC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore21ProcessingInstruction8nodeTypeEv
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document16createNSResolverEPNS_4NodeE
+__ZN7WebCore14XPathEvaluator16createNSResolverEPNS_4NodeE
+__ZN7WebCore21NativeXPathNSResolverC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore21NativeXPathNSResolverC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15XPathNSResolverE
+__ZN7WebCore17JSXPathNSResolver15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSXPathNSResolverC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathNSResolverEEE
+__ZN7WebCore17JSXPathNSResolverC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathNSResolverEEE
+__ZNK7WebCore17JSXPathNSResolver9classInfoEv
+__ZNK7WebCore12CDATASection8nodeTypeEv
+__ZN7WebCore41jsXPathResultPrototypeFunctionIterateNextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18jsAttrOwnerElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSSVGDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSSVGDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGDocument9classInfoEv
+__ZN7WebCore18createJSSVGWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashIS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashI
+__ZN7WebCoreL27createSVGRectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGRectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSSVGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGRectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGRectElementEEE
+__ZN7WebCore16JSSVGRectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGRectElementEEE
+__ZN7WebCore12JSSVGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGElementEEE
+__ZN7WebCore16JSSVGRectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12JSSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGRectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore16JSSVGRectElement9classInfoEv
-__ZN7WebCore14SVGRectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGRectElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement4setXENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore14SVGRectElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement4setYENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement5widthEv
-__ZN7WebCore14SVGRectElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement6heightEv
+__ZN7WebCore29SVGStyledTransformableElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore9CSSParser13parseSVGPaintEv
-__ZN7WebCore13JSSVGGElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGGElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSSVGGElement9classInfoEv
-__ZN7WebCore11SVGGElement15childrenChangedEb
-__ZN7WebCore13RenderSVGRoot6layoutEv
-__ZN7WebCore13RenderSVGRoot12calcViewportEv
-__ZNK7WebCore9SVGLength8unitTypeEv
-__ZN7WebCore13RenderSVGRoot14calcPrefWidthsEv
-__ZN7WebCore13RenderSVGRoot27absoluteClippedOverflowRectEv
-__ZN7WebCore24RenderSVGHiddenContainer27absoluteClippedOverflowRectEv
-__ZNK7WebCore13SVGSVGElement12currentScaleEv
-__ZN7WebCore24RenderSVGHiddenContainer6layoutEv
-__ZNK7WebCore13RenderSVGRoot10lineHeightEbb
-__ZNK7WebCore13RenderSVGRoot16baselinePositionEbb
-__ZN7WebCore15textConstructorEPNS_8DocumentEb
+__ZNK7WebCore16SVGStyledElement8isStyledEv
+__ZN7WebCore16SVGStyledElement14canvasResourceEv
+__ZN7WebCore8SVGTests16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore12SVGLangSpace16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore28SVGExternalResourcesRequired16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore29SVGStyledTransformableElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore16SVGTransformable16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore16SVGStyledElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore42jsDocumentPrototypeFunctionCreateElementNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL15textConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGTextElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore25SVGTextPositioningElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore21SVGTextContentElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore13SVGLengthListC1ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGLengthListC2ERKNS_13QualifiedNameE
 __ZN7WebCore13SVGNumberListC1ERKNS_13QualifiedNameE
-__ZN7WebCore17createTextWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGTextElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore36JSSVGTextPositioningElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGTextElementC1EPN3KJS8JSObjectEPNS_14SVGTextElementE
-__ZN7WebCore27JSSVGTextPositioningElementC2EPN3KJS8JSObjectEPNS_25SVGTextPositioningElementE
-__ZN7WebCore23JSSVGTextContentElementC2EPN3KJS8JSObjectEPNS_21SVGTextContentElementE
-__ZN7WebCore16JSSVGTextElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGTextPositioningElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSSVGTextContentElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGTextElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSSVGTextContentElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13SVGNumberListC2ERKNS_13QualifiedNameE
+__ZN7WebCoreL27createSVGTextElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGTextElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSSVGTextPositioningElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGTextPositioningElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSSVGTextContentElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGTextContentElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGTextElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTextElementEEE
+__ZN7WebCore16JSSVGTextElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTextElementEEE
+__ZN7WebCore27JSSVGTextPositioningElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGTextPositioningElementEEE
+__ZN7WebCore23JSSVGTextContentElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGTextContentElementEEE
+__ZN7WebCore16JSSVGTextElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGTextPositioningElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSSVGTextContentElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGTextElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32JSSVGTextContentElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore16JSSVGTextElement9classInfoEv
 __ZN7WebCore14SVGTextElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore25SVGTextPositioningElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore21SVGTextContentElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore25SVGTextPositioningElement10xBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_13SVGLengthListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZNK7WebCore25SVGTextPositioningElement1xEv
-__ZN7WebCore13SVGLengthList5parseERKNS_6StringEPKNS_16SVGStyledElementENS_13SVGLengthModeE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_13SVGLengthListENS1_10StringHashENS_10HashTraitsIS6_EENS
+__ZN7WebCore13SVGLengthList5parseERKNS_6StringENS_13SVGLengthModeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14expandCapacityEmPKS6_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE15reserveCapacityEm
-__ZNK7WebCore25SVGTextPositioningElement10yBaseValueEv
-__ZNK7WebCore25SVGTextPositioningElement1yEv
-__ZNK7WebCore11SVGGElement7isValidEv
-__ZN7WebCore11SVGGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore31RenderSVGTransformableContainerC1EPNS_29SVGStyledTransformableElementE
-__ZNK7WebCore18RenderSVGContainer15canHaveChildrenEv
-__ZNK7WebCore14SVGRectElement7isValidEv
+__ZN7WebCore14SVGTextElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL26createSVGSVGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGSVGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSVGElementEEE
+__ZN7WebCore15JSSVGSVGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSVGElementEEE
+__ZN7WebCore15JSSVGSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSSVGSVGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGSVGElement9classInfoEv
 __ZN7WebCore16CSSStyleSelector16applySVGPropertyEiPNS_8CSSValueE
+__ZN7WebCore14SVGRenderStyleC1ERKS0_
 __ZN7WebCore14SVGRenderStyleC2ERKS0_
+__ZNK7WebCore8SVGPaint10isSVGPaintEv
+__ZN7WebCore7DataRefINS_13StyleFillDataEE6accessEv
 __ZN7WebCore13StyleFillDataC1ERKS0_
-__ZN7WebCore29SVGStyledTransformableElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10RenderPathC1EPNS_11RenderStyleEPNS_29SVGStyledTransformableElementE
-__ZN7WebCore18RenderSVGContainer8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore18RenderSVGContainer15insertChildNodeEPNS_12RenderObjectES2_b
-__ZN7WebCore18RenderSVGContainer15appendChildNodeEPNS_12RenderObjectEb
+__ZN7WebCore13StyleFillDataC2ERKS0_
+__ZN3WTF10RefCountedIN7WebCore8CSSValueEE5derefEv
+__ZNK7WebCore14SVGRenderStyleeqERKS0_
+__ZNK7WebCore13StyleFillDataeqERKS0_
+__ZNK7WebCore8SVGColor5colorEv
+__ZN7WebCore16SVGStyledElement6detachEv
+__ZN7WebCore11SVGResource12removeClientEPNS_16SVGStyledElementE
+__ZN7WebCoreL9clientMapEv
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementESt4pairIS3_PNS1_11ResourceSetEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS
 __ZNK7WebCore21SVGTextContentElement7isValidEv
 __ZN7WebCore14SVGTextElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZN7WebCore13RenderSVGTextC1EPNS_14SVGTextElementE
+__ZN7WebCore13RenderSVGTextC2EPNS_14SVGTextElementE
 __ZN7WebCore14RenderSVGBlockC2EPNS_10SVGElementE
-__ZN7WebCore14RenderSVGBlock8setStyleEPNS_11RenderStyleE
-__ZN7WebCore13RenderSVGText13requiresLayerEv
+__ZN7WebCore14RenderSVGBlock8setStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZNK7WebCore13RenderSVGText13requiresLayerEv
 __ZNK7WebCore14SVGTextElement25childShouldCreateRendererEPNS_4NodeE
 __ZN7WebCore19RenderSVGInlineTextC1EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore19RenderSVGInlineTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore19RenderSVGInlineText14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore19RenderSVGInlineText9isSVGTextEv
-__ZN7WebCore16SVGStyledElement6detachEv
-__ZN7WebCore11SVGResource12removeClientEPNS_16SVGStyledElementE
-__ZN7WebCore9clientMapEv
-__ZN7WebCore18RenderSVGContainer7destroyEv
-__ZN7WebCore18RenderSVGContainer23destroyLeftoverChildrenEv
-__ZN7WebCore18RenderSVGContainerD0Ev
-__ZN7WebCore18RenderSVGContainer11removeChildEPNS_12RenderObjectE
-__ZN7WebCore18RenderSVGContainer15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore10RenderPath27absoluteClippedOverflowRectEv
-__ZNK7WebCore10RenderPath12relativeBBoxEb
-__ZNK7WebCore12RenderObject17absoluteTransformEv
-__ZNK7WebCore13RenderSVGRoot17absoluteTransformEv
-__ZNK7WebCore12RenderObject14localTransformEv
-__ZN7WebCore15AffineTransformC1Edddddd
-__ZN7WebCore15AffineTransformmlERKS0_
-__ZNK7WebCore13RenderSVGRoot14localTransformEv
-__ZN7WebCore15AffineTransform5scaleEd
-__ZNK7WebCore13SVGSVGElement16currentTranslateEv
-__ZNK7WebCore13RenderSVGRoot8viewportEv
-__ZNK7WebCore13SVGSVGElement22viewBoxToViewTransformEff
-__ZNK7WebCore13SVGSVGElement14useCurrentViewEv
-__ZNK7WebCore13SVGSVGElement7viewBoxEv
-__ZNK7WebCore15SVGFitToViewBox7viewBoxEv
-__ZNK7WebCore18RenderSVGContainer14localTransformEv
-__ZNK7WebCore10RenderPath14localTransformEv
-__ZN7WebCore9FloatRect5uniteERKS0_
-__ZN7WebCore14SVGRenderStyleD2Ev
-__ZN7WebCore13RenderSVGText27absoluteClippedOverflowRectEv
-__ZNK7WebCore13RenderSVGText12relativeBBoxEb
-__ZNK7WebCore13RenderSVGText14localTransformEv
-__ZN7WebCore19RenderSVGInlineTextD1Ev
-__ZN7WebCore13RenderSVGTextD1Ev
-__ZN7WebCore18RenderSVGContainer27absoluteClippedOverflowRectEv
-__ZN7WebCore13SVGSVGElement19removedFromDocumentEv
-__ZN7WebCore21SVGDocumentExtensions19removeTimeContainerEPNS_13SVGSVGElementE
-__ZNK7WebCore14SVGTextElement18transformBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_16SVGTransformListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZNK7WebCore14SVGTextElement9transformEv
-__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERKNS_12AtomicStringE
-__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERPKtS4_
-__ZN7WebCore12SVGTransformC1Ev
-__ZN7WebCore16SVGTransformable19parseTransformValueEjRPKtS2_RNS_12SVGTransformE
-__ZN7WebCore23parseTransformParamListERPKtS1_Pfii
-__ZN7WebCore12SVGTransform9setRotateEfff
-__ZN7WebCore15AffineTransform5resetEv
-__ZN7WebCore15AffineTransform6rotateEd
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE15reserveCapacityEm
-__ZN7WebCore14SVGTextElement21setTransformBaseValueEPNS_16SVGTransformListE
-__ZN7WebCore14SVGTextElement12setTransformEPNS_16SVGTransformListE
-__ZN7WebCore15pathConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimatedPathDataC2Ev
-__ZN7WebCore17createPathWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGPathElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGPathElementC1EPN3KJS8JSObjectEPNS_14SVGPathElementE
-__ZN7WebCore16JSSVGPathElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGPathElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGPathElement9classInfoEv
-__ZN7WebCore14SVGPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore14SVGPathElement11pathSegListEv
-__ZN7WebCore14SVGPathSegListC1ERKNS_13QualifiedNameE
-__ZN7WebCore22pathSegListFromSVGDataEPNS_14SVGPathSegListERKNS_6StringEb
-__ZN7WebCore13SVGPathParser8parseSVGERKNS_6StringEb
-__ZN7WebCore11parseNumberERPKtS1_Rdb
-__ZN7WebCore21SVGPathSegListBuilder9svgMoveToEddbb
-__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoAbsEff
-__ZN7WebCore19SVGPathSegMovetoAbsC1Eff
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE15reserveCapacityEm
-__ZN7WebCore21SVGPathSegListBuilder9svgLineToEddb
-__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoAbsEff
-__ZN7WebCore19SVGPathSegLinetoAbsC1Eff
-__ZN7WebCore14SVGPathElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore21SVGPathSegListBuilder15svgCurveToCubicEddddddb
-__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicAbsEffffff
-__ZN7WebCore25SVGPathSegCurvetoCubicAbsC1Effffff
-__ZN7WebCore10SVGElement19addSVGEventListenerERKNS_12AtomicStringEPKNS_9AttributeE
-__ZN7WebCore21SVGDocumentExtensions22createSVGEventListenerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore8KJSProxy21createSVGEventHandlerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore22JSSVGLazyEventListenerC1ERKNS_6StringES3_PN3KJS6WindowEPNS_4NodeEi
-__ZNK7WebCore16SVGStyledElement8isStyledEv
-__ZN7WebCore16SVGStyledElement14canvasResourceEv
-__ZN7WebCore15StyleStrokeDataC1ERKS0_
-__ZNK7WebCore14SVGPathElement7isValidEv
-__ZNK7WebCore13SVGSVGElement17hasRelativeValuesEv
-__ZNK7WebCore13SVGSVGElement1xEv
-__ZNK7WebCore13SVGSVGElement1yEv
-__ZN7WebCore18RenderSVGContainer6layoutEv
-__ZNK7WebCore18RenderSVGContainer13selfWillPaintEv
-__ZN7WebCore31RenderSVGTransformableContainer23calculateLocalTransformEv
+__ZN7WebCore13RenderSVGRoot6layoutEv
+__ZNK7WebCore13SVGSVGElement12currentScaleEv
+__ZN7WebCore13RenderSVGRoot12calcViewportEv
+__ZN7WebCore10RenderPath6layoutEv
 __ZNK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
-__ZNK7WebCore29SVGStyledTransformableElement9transformEv
 __ZNK7WebCore16SVGTransformList11concatenateEv
+__ZN7WebCore12SVGTransformC1Ev
+__ZN7WebCore12SVGTransformC2Ev
 __ZNK7WebCore12SVGTransform6matrixEv
-__ZNK7WebCore15AffineTransformeqERKS0_
-__ZN7WebCore10RenderPath6layoutEv
-__ZNK7WebCore12RenderObject9borderBoxEv
-__ZNK7WebCore12RenderObject6heightEv
-__ZNK7WebCore12RenderObject5widthEv
-__ZN7WebCore10RenderPath23calculateLocalTransformEv
+__ZN7WebCore12SVGTransformD1Ev
+__ZN7WebCore12SVGTransformD2Ev
 __ZNK7WebCore14SVGRectElement10toPathDataEv
-__ZNK7WebCore14SVGRectElement1yEv
-__ZNK7WebCore14SVGRectElement1xEv
-__ZNK7WebCore7Element12hasAttributeERKNS_13QualifiedNameE
-__ZNK7WebCore7Element14hasAttributeNSERKNS_6StringES3_
-__ZN7WebCore4Path15createRectangleERKNS_9FloatRectE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_16heightAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_15widthAttrS
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11xAttrStrin
 __ZN7WebCore10RenderPath7setPathERKNS_4PathE
-__ZNK7WebCore10RenderPath10strokeBBoxEv
-__ZNK7WebCore10RenderPath4pathEv
-__ZN7WebCore12RenderObject8setWidthEi
-__ZN7WebCore12RenderObject9setHeightEi
+__ZN7WebCore4PathaSERKS0_
 __ZN7WebCore13RenderSVGText6layoutEv
-__ZN7WebCore13RenderSVGText23calculateLocalTransformEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_25SVGTextPositioningElementENS_13SVGLengthListEXadL_ZNS_35SVGTextPositioningElementIdenti
 __ZNK7WebCore14SVGTextElement22animatedLocalTransformEv
-__ZNK7WebCore18RenderSVGContainer14isSVGContainerEv
-__ZN7WebCore19RenderSVGInlineText19createInlineTextBoxEv
+__ZN7WebCore19RenderSVGInlineText13createTextBoxEv
 __ZN7WebCore16SVGInlineTextBoxC1EPNS_12RenderObjectE
-__ZN7WebCore13RenderSVGText15createInlineBoxEbbb
+__ZN7WebCore16SVGInlineTextBoxC2EPNS_12RenderObjectE
+__ZN7WebCore13RenderSVGText13createRootBoxEv
 __ZN7WebCore16SVGRootInlineBox22placeBoxesHorizontallyEiRiS1_Rb
-__ZN7WebCore16SVGRootInlineBox20verticallyAlignBoxesERi
+__ZN7WebCore16SVGRootInlineBox20verticallyAlignBoxesEi
+__ZNK7WebCore16SVGRootInlineBox12svgBoxHeightEv
 __ZN7WebCore16SVGRootInlineBox36computePerCharacterLayoutInformationEv
+__ZN3WTF6VectorIN7WebCore7SVGCharELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14shrinkCapacityEm
 __ZN7WebCore22SVGCharacterLayoutInfoC1ERN3WTF6VectorINS_7SVGCharELm0EEE
+__ZN7WebCore22SVGCharacterLayoutInfoC2ERN3WTF6VectorINS_7SVGCharELm0EEE
 __ZN7WebCore16SVGRootInlineBox22buildLayoutInformationEPNS_13InlineFlowBoxERNS_22SVGCharacterLayoutInfoE
 __ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_25SVGTextPositioningElementE
-__ZN7WebCore22calculateBaselineShiftEPNS_12RenderObjectE
-__ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGLengthListE
-__ZN3WTF6VectorIfLm0EE14expandCapacityEmPKf
-__ZN3WTF6VectorIfLm0EE14expandCapacityEm
-__ZN3WTF6VectorIfLm0EE15reserveCapacityEm
+__ZN7WebCoreL22calculateBaselineShiftEPNS_12RenderObjectE
+__ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGLengthListEPKNS_10SVGElementE
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeERKNS_21PositionedFloatVectorE
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIfLm0EEC2ERKS1_
-__ZN3WTF6VectorIfLm0EE6shrinkEm
-__ZNK7WebCore25SVGTextPositioningElement2dxEv
-__ZNK7WebCore25SVGTextPositioningElement2dyEv
-__ZNK7WebCore25SVGTextPositioningElement6rotateEv
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGNumberListE
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEf
-__ZN7WebCore16SVGRootInlineBox32buildLayoutInformationForTextBoxERNS_22SVGCharacterLayoutInfoEPNS_13InlineTextBoxE
+__ZN7WebCore16SVGRootInlineBox32buildLayoutInformationForTextBoxERNS_22SVGCharacterLayoutInfoEPNS_13InlineTextBoxERNS_13LastGly
 __ZNK7WebCore22SVGCharacterLayoutInfo12inPathLayoutEv
-__ZNK7WebCore16SVGInlineTextBox19calculateGlyphWidthEPNS_11RenderStyleEi
+__ZNK7WebCore16SVGInlineTextBox19calculateGlyphWidthEPNS_11RenderStyleEiiRiRNS_6StringE
 __ZN7WebCore26svgTextRunForInlineTextBoxEPKtiPNS_11RenderStyleEPKNS_13InlineTextBoxEf
-__ZNK7WebCore16SVGInlineTextBox20calculateGlyphHeightEPNS_11RenderStyleEi
+__ZNK7WebCore4Font10floatWidthERKNS_7TextRunEiRiRNS_6StringE
+__ZNK7WebCore16SVGInlineTextBox20calculateGlyphHeightEPNS_11RenderStyleEii
 __ZNK7WebCore22SVGCharacterLayoutInfo15xValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo10xValueNextEv
 __ZNK7WebCore22SVGCharacterLayoutInfo15yValueAvailableEv
@@ -9558,6 +13261,7 @@ __ZNK7WebCore22SVGCharacterLayoutInfo16dxValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo16dyValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo19angleValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo27baselineShiftValueAvailableEv
+__ZNK7WebCore4Font9isSVGFontEv
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE15reserveCapacityEm
@@ -9569,103 +13273,82 @@ __ZN7WebCore22SVGCharacterLayoutInfo11dxStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo11dyStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo14angleStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo22baselineShiftStackWalkEv
-__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEERNS2_INS_12SVGTextChunkELm0EEEPNS_13InlineFlowBoxE
-__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEEPNS_13InlineFlowBoxERNS_22SVGTextChunkLayoutInfoE
+__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEERNS2_INS_12SVGTextChunkELm0EEEPNS_13InlineFlowB
+__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEEPNS_13InlineFlowBoxERNS_22SVGTextChunkLayoutInf
+__ZNK7WebCore21SVGTextContentElement13isTextContentEv
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE15reserveCapacityEm
-__ZNK7WebCore21SVGTextContentElement10textLengthEv
-__ZNK7WebCore21SVGTextContentElement12lengthAdjustEv
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EEC2ERKS3_
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE6shrinkEm
 __ZN7WebCore16SVGRootInlineBox16layoutTextChunksEv
-__ZN7WebCore41calculateTextLengthCorrectionForTextChunkERNS_12SVGTextChunkENS_21SVGTextContentElement19SVGLengthAdjustTypeERf
-__ZNK7WebCore15AffineTransform10isIdentityEv
-__ZN7WebCore36calculateTextAnchorShiftForTextChunkERNS_12SVGTextChunkENS_11ETextAnchorE
-__ZN7WebCore26cummulatedWidthOfTextChunkERNS_12SVGTextChunkE
-__ZN7WebCore34cummulatedWidthOrHeightOfTextChunkERNS_12SVGTextChunkEb
-__ZN7WebCore40cummulatedWidthOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZN7WebCoreL41calculateTextLengthCorrectionForTextChunkERNS_12SVGTextChunkENS_21SVGTextContentElement19SVGLengthAdjustTypeERf
 __ZN7WebCore31topLeftPositionOfCharacterRangeEPNS_7SVGCharES1_
 __ZNK7WebCore7SVGChar8isHiddenEv
 __ZN7WebCore16SVGRootInlineBox17layoutInlineBoxesEv
 __ZN7WebCore16SVGRootInlineBox17layoutInlineBoxesEPNS_13InlineFlowBoxERPNS_7SVGCharERiS6_S6_S6_
 __ZNK7WebCore16SVGInlineTextBox24calculateGlyphBoundariesEPNS_11RenderStyleEiRKNS_7SVGCharE
 __ZNK7WebCore7SVGChar18characterTransformEv
-__ZN7WebCore12SVGTransformC1ERKNS_15AffineTransformE
-__ZN7WebCore17strokeBoundingBoxERKNS_4PathEPNS_11RenderStyleEPKNS_12RenderObjectE
-__ZN7WebCore14scratchContextEv
-__ZN7WebCore25applyStrokeStyleToContextEPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_12RenderObjectE
-__ZN7WebCore14SVGRenderStyle20cssPrimitiveToLengthEPKNS_12RenderObjectEPNS_8CSSValueEf
-__ZN7WebCore15GraphicsContext10setLineCapENS_7LineCapE
-__ZN7WebCore15GraphicsContext11setLineJoinENS_8LineJoinE
-__ZN7WebCore15GraphicsContext13setMiterLimitEf
-__ZN7WebCore27dashArrayFromRenderingStyleEPKNS_11RenderStyleE
-__ZNK7WebCore14SVGPathElement10toPathDataEv
-__ZN7WebCore14SVGPathSegList10toPathDataEv
-__ZNK7WebCore19SVGPathSegMovetoAbs11pathSegTypeEv
-__ZNK7WebCore19SVGPathSegMovetoAbs1yEv
-__ZNK7WebCore19SVGPathSegMovetoAbs1xEv
-__ZNK7WebCore19SVGPathSegLinetoAbs11pathSegTypeEv
-__ZNK7WebCore19SVGPathSegLinetoAbs1yEv
-__ZNK7WebCore19SVGPathSegLinetoAbs1xEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs11pathSegTypeEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs1yEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs1xEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2y2Ev
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2x2Ev
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2y1Ev
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2x1Ev
-__ZN7WebCore18RenderSVGContainer10calcBoundsEv
-__ZNK7WebCore18RenderSVGContainer17calcReplacedWidthEv
-__ZNK7WebCore18RenderSVGContainer18calcReplacedHeightEv
-__ZN3KJS17staticValueGetterIN7WebCore12JSWheelEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSWheelEvent16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore20TransformationMatrix8rotate3dEddd
+__ZN7WebCore16SVGRootInlineBox18isSVGRootInlineBoxEv
+__ZN7WebCore13RenderSVGRoot21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore13RenderSVGRoot25localToBorderBoxTransformEv
+__ZNK7WebCore13RenderSVGRoot24borderOriginToContentBoxEv
+__ZN7WebCore20TransformationMatrix5scaleEd
+__ZNK7WebCore13SVGSVGElement16currentTranslateEv
+__ZNK7WebCore13SVGSVGElement22viewBoxToViewTransformEff
+__ZNK7WebCore13SVGSVGElement14useCurrentViewEv
+__ZNK7WebCore13RenderSVGRoot19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore21SVGDocumentExtensions15startAnimationsEv
+__ZN7WebCore17SMILTimeContainer5beginEv
+__ZN7WebCore17SMILTimeContainer16updateAnimationsENS_8SMILTimeE
+__ZN7WebCore17SMILTimeContainer14sortByPriorityERN3WTF6VectorIPNS_14SVGSMILElementELm0EEENS_8SMILTimeE
+__ZN7WebCore17SMILTimeContainer10startTimerENS_8SMILTimeES1_
+__ZNK7WebCore17SMILTimeContainer8isPausedEv
 __ZN7WebCore13RenderSVGRoot5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13RenderSVGRoot22applyContentTransformsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore15AffineTransform1fEv
-__ZNK7WebCore15AffineTransform1eEv
-__ZN7WebCore15GraphicsContext9concatCTMERKNS_15AffineTransformE
-__ZNK7WebCore13RenderSVGRoot12relativeBBoxEb
-__ZNK7WebCore24RenderSVGHiddenContainer12relativeBBoxEb
-__ZNK7WebCore24RenderSVGHiddenContainer14localTransformEv
-__ZNK7WebCore24RenderSVGHiddenContainer14isSVGContainerEv
-__ZNK7WebCore18RenderSVGContainer17viewportTransformEv
-__ZNK7WebCore18RenderSVGContainer12relativeBBoxEb
+__ZNK7WebCore13RenderSVGRoot12viewportSizeEv
+__ZNK7WebCore13RenderSVGRoot32localToRepaintContainerTransformERKNS_8IntPointE
+__ZNK7WebCore13RenderSVGRoot22localToParentTransformEv
+__ZNK7WebCore13RenderSVGRoot23parentOriginToBorderBoxEv
+__ZN7WebCore25applyTransformToPaintInfoERNS_12RenderObject9PaintInfoERKNS_20TransformationMatrixE
+__ZNK7WebCore13RenderSVGRoot29repaintRectInLocalCoordinatesEv
+__ZN7WebCore13SVGRenderBase27computeContainerBoundingBoxEPKNS_12RenderObjectEb
+__ZNK7WebCore10RenderPath29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore10RenderPath17objectBoundingBoxEv
+__ZN7WebCore13SVGRenderBase28filterBoundingBoxForRendererEPKNS_12RenderObjectE
+__ZNK7WebCore10RenderPath22localToParentTransformEv
+__ZNK7WebCore13RenderSVGText29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore13RenderSVGText17objectBoundingBoxEv
+__ZNK7WebCore16SVGInlineTextBox12svgBoxHeightEv
+__ZNK7WebCore13RenderSVGText22localToParentTransformEv
 __ZN7WebCore9RenderBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore24RenderSVGHiddenContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore18RenderSVGContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore18RenderSVGContainer13drawsContentsEv
-__ZN7WebCore18RenderSVGContainer22applyContentTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore18RenderSVGContainer25applyAdditionalTransformsERNS_12RenderObject9PaintInfoE
 __ZN7WebCore10RenderPath5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13RenderSVGText5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore15AffineTransform7inverseEv
-__ZNK7WebCore15AffineTransform7mapRectERKNS_7IntRectE
-__ZN7WebCore16enclosingIntRectERK6CGRect
-__ZN7WebCore25prepareToRenderSVGContentEPNS_12RenderObjectERNS0_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilterES8_
+__ZN7WebCore13SVGRenderBase25prepareToRenderSVGContentEPNS_12RenderObjectERNS1_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFil
 __ZN7WebCore14getClipperByIdEPNS_8DocumentERKNS_12AtomicStringE
 __ZN7WebCore15getResourceByIdEPNS_8DocumentERKNS_12AtomicStringE
 __ZN7WebCore13getMaskerByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore15GraphicsContext9beginPathEv
 __ZN7WebCore14SVGPaintServer15fillPaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
 __ZN7WebCore14SVGPaintServer22sharedSolidPaintServerEv
 __ZN7WebCore19SVGPaintServerSolidC1Ev
+__ZN7WebCore19SVGPaintServerSolidC2Ev
 __ZN7WebCore14SVGPaintServerC2Ev
 __ZN7WebCore11SVGResourceC2Ev
-__ZNK7WebCore8SVGColor5colorEv
 __ZN7WebCore19SVGPaintServerSolid8setColorERKNS_5ColorE
 __ZNK7WebCore19SVGPaintServerSolid5colorEv
 __ZNK7WebCore14SVGPaintServer4drawERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
-__ZZNK7WebCore19SVGPaintServerSolid5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEbE19deviceRGBColorSpace
+__ZNK7WebCore19SVGPaintServerSolid5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZN7WebCore15GraphicsContext8setAlphaEf
+__ZN7WebCore15GraphicsContext11setFillRuleENS_8WindRuleE
 __ZNK7WebCore14SVGPaintServer10renderPathERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
-__ZNK7WebCore14SVGPaintServer8fillPathEP9CGContextPKNS_12RenderObjectE
 __ZNK7WebCore14SVGPaintServer8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
 __ZN7WebCore14SVGPaintServer17strokePaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
 __ZNK7WebCore16SVGStyledElement15supportsMarkersEv
-__ZN7WebCore22finishRenderSVGContentEPNS_12RenderObjectERNS0_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilterEPNS_15GraphicsContextE
+__ZN7WebCore13SVGRenderBase22finishRenderSVGContentEPNS_12RenderObjectERNS1_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilter
 __ZN7WebCore16SVGRootInlineBox5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore16SVGRootInlineBox14walkTextChunksEPNS_22SVGTextChunkWalkerBaseEPKNS_16SVGInlineTextBoxE
 __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE5startEPNS_9InlineBoxE
@@ -9674,238 +13357,769 @@ __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE9setupFillEPN
 __ZN7WebCore27SVGRootInlineBoxPaintWalker22chunkSetupFillCallbackEPNS_9InlineBoxE
 __ZN7WebCore15GraphicsContext18setTextDrawingModeEi
 __ZN7WebCore15GraphicsContext26setPlatformTextDrawingModeEi
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharESB_
-__ZN7WebCore27SVGRootInlineBoxPaintWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharES9_
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS
+__ZN7WebCore27SVGRootInlineBoxPaintWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGC
 __ZN7WebCore16SVGInlineTextBox15paintCharactersERNS_12RenderObject9PaintInfoEiiRKNS_7SVGCharEPKtiPNS_14SVGPaintServerE
 __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE11setupStrokeEPNS_9InlineBoxE
 __ZN7WebCore27SVGRootInlineBoxPaintWalker24chunkSetupStrokeCallbackEPNS_9InlineBoxE
 __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE3endEPNS_9InlineBoxE
 __ZN7WebCore27SVGRootInlineBoxPaintWalker16chunkEndCallbackEPNS_9InlineBoxE
-__ZNK7WebCore14SVGPaintServer10strokePathEP9CGContextPKNS_12RenderObjectE
-__ZNK7WebCore14SVGPathElement15supportsMarkersEv
-__ZNK7WebCore10RenderPath19drawMarkersIfNeededEPNS_15GraphicsContextERKNS_9FloatRectERKNS_4PathE
-__ZN7WebCore13getMarkerByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZNK7WebCore11RenderLayer25horizontalScrollbarWidgetEv
-__ZN7WebCore13RenderSVGRoot11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore15AffineTransform3mapEddPdS1_
-__ZN7WebCore18RenderSVGContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore18RenderSVGContainer9lastChildEv
-__ZN7WebCore10RenderPath11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore21PointerEventsHitRulesC1ENS0_14ESVGHitTestingENS_14EPointerEventsE
-__ZNK7WebCore10RenderPath23mapAbsolutePointToLocalERKNS_10FloatPointE
-__ZN7WebCore10FloatPoint15narrowPrecisionEdd
-__ZNK7WebCore10RenderPath14strokeContainsERKNS_10FloatPointEb
-__ZN7WebCore13RenderSVGText11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore16SVGInlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore16SVGInlineTextBox13selectionRectEiiii
-__ZNK7WebCore16SVGInlineTextBox16svgRootInlineBoxEv
-__ZN7WebCore16SVGRootInlineBox18isSVGRootInlineBoxEv
-__ZN7WebCore18SVGTextChunkWalkerINS_35SVGInlineTextBoxSelectionRectWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharESB_
-__ZN7WebCore35SVGInlineTextBoxSelectionRectWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharES9_
-__ZNK7WebCore10RenderPath12fillContainsERKNS_10FloatPointEb
-__ZN7WebCore10SVGElement15eventParentNodeEv
-__ZN7WebCore12EventHandler30passMousePressEventToScrollbarERNS_28MouseEventWithHitTestResultsEPNS_17PlatformScrollbarE
--[WebCoreScrollBar mouseDown:]
-__ZN7WebCore6Widget15beforeMouseDownEP6NSViewPS0_
--[WebCoreScrollBar scroll:]
-__ZN7WebCore17PlatformScrollbar12scrollbarHitEj
-__ZN7WebCore6Widget14afterMouseDownEP6NSViewPS0_
-__ZN7WebCore44jsHTMLTextAreaElementPrototypeFunctionSelectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTextAreaElement6selectEv
-__ZN7WebCore55jsHTMLTextAreaElementPrototypeFunctionSetSelectionRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTextAreaElement12selectionEndEv
-__ZN7WebCore16SVGInlineTextBoxD1Ev
-__ZN7WebCore16SVGRootInlineBoxD1Ev
+-[DOMElement innerText]
+__ZN7WebCore16JSSVGTextElementD1Ev
+__ZN7WebCore15JSSVGSVGElementD1Ev
+__ZN7WebCore16JSSVGRectElementD1Ev
+__ZN7WebCore17JSXPathNSResolverD1Ev
+__ZN7WebCore17JSXPathNSResolverD2Ev
+__ZN7WebCore21NativeXPathNSResolverD0Ev
+__ZN7WebCore15XPathNSResolverD2Ev
+__ZN7WebCore13SVGSVGElement26documentWillBecomeInactiveEv
+__ZN7WebCore13SVGSVGElement15pauseAnimationsEv
+__ZN7WebCore17SMILTimeContainer5pauseEv
+__ZN7WebCore10RenderPathD0Ev
+__ZN7WebCore14SVGRenderStyleD1Ev
+__ZN7WebCore14SVGRenderStyleD2Ev
+__ZN7WebCore19RenderSVGInlineText7destroyEv
+__ZN7WebCore16SVGInlineTextBoxD0Ev
+__ZN7WebCore19RenderSVGInlineTextD0Ev
+__ZN7WebCore16SVGRootInlineBoxD0Ev
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE6shrinkEm
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE6shrinkEm
-__ZN7WebCore11crossCursorEv
-__ZN7WebCore22JSSVGLazyEventListenerD1Ev
-__ZN7WebCore13TimeSchedulerD1Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore8SVGTimerEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN7WebCore15SVGFitToViewBoxD0Ev
-__ZN7WebCore22SVGPreserveAspectRatioD1Ev
-__ZN7WebCore28SVGExternalResourcesRequiredD0Ev
-__ZN7WebCore8SVGTestsD0Ev
-__ZN7WebCore25SVGStyledLocatableElementD0Ev
-__ZN7WebCore10SVGElementD0Ev
-__ZN7WebCore29SVGStyledTransformableElementD0Ev
-__ZN7WebCore16SVGTransformListD1Ev
-__ZN7WebCore16SVGTransformableD0Ev
-__ZN7WebCore25SVGTextPositioningElementD0Ev
-__ZN7WebCore13SVGNumberListD1Ev
-__ZN7WebCore13SVGLengthListD1Ev
+__ZN7WebCore13RenderSVGTextD0Ev
+__ZN7WebCore13RenderSVGRootD0Ev
+__ZN7WebCore36JSSVGTextPositioningElementPrototypeD1Ev
+__ZN7WebCore32JSSVGTextContentElementPrototypeD1Ev
+__ZN7WebCore24JSSVGSVGElementPrototypeD1Ev
+__ZN7WebCore25JSSVGTextElementPrototypeD1Ev
+__ZN7WebCore25JSSVGRectElementPrototypeD1Ev
+__ZN7WebCore21JSSVGElementPrototypeD1Ev
+__ZN7WebCore26JSXPathNSResolverPrototypeD1Ev
+__ZN7WebCore21ProcessingInstructionD0Ev
+__ZN7WebCore12CDATASectionD0Ev
+__ZN7WebCore13JSSVGDocumentD1Ev
+__ZN7WebCore13SVGSVGElementD0Ev
+__ZN7WebCore21SVGDocumentExtensions19removeTimeContainerEPNS_13SVGSVGElementE
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeA
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEP
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallo
+__ZN7WebCore13SVGZoomAndPanD2Ev
+__ZN7WebCore15SVGFitToViewBoxD2Ev
+__ZN7WebCore22SVGPreserveAspectRatioD0Ev
+__ZN7WebCore28SVGExternalResourcesRequiredD2Ev
+__ZN7WebCore12SVGLangSpaceD2Ev
+__ZN7WebCore8SVGTestsD2Ev
+__ZN7WebCore25SVGStyledLocatableElementD2Ev
+__ZN7WebCore16SVGStyledElementD2Ev
+__ZN7WebCore11SVGStylableD2Ev
+__ZN7WebCore10SVGElementD2Ev
+__ZN7WebCore12SVGLocatableD2Ev
+__ZN7WebCore14SVGRectElementD0Ev
+__ZN7WebCore29SVGStyledTransformableElementD2Ev
+__ZN7WebCore16SVGTransformListD0Ev
+__ZN7WebCore16SVGTransformableD2Ev
+__ZN7WebCore8SVGPaintD0Ev
+__ZN7WebCore8SVGColorD2Ev
+__ZN7WebCore14SVGTextElementD0Ev
+__ZN7WebCore25SVGTextPositioningElementD2Ev
+__ZN7WebCore13SVGNumberListD0Ev
+__ZN7WebCore13SVGLengthListD0Ev
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE6shrinkEm
-__ZN7WebCore21SVGTextContentElementD0Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE6shrinkEm
-__ZN7WebCore14SVGPathSegListD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE6shrinkEm
-__ZN7WebCore36JSSVGTextPositioningElementPrototypeD0Ev
+__ZN7WebCore21SVGTextContentElementD2Ev
+__ZN7WebCore11SVGDocumentD0Ev
 __ZN7WebCore21SVGDocumentExtensionsD1Ev
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapINS2_6StringESA_NS2_10StringHashENS7_ISC_EENS7_ISA_EEEEEEvRT0_
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapIPNS2_10SVGElementESA_NS5_ISD_EENS7_ISD_EENS7_ISA_EEEEEEvRT0_
-__ZNK7WebCore14HTMLModElement17endTagRequirementEv
-__ZNK7WebCore14HTMLModElement11tagPriorityEv
-__ZN7WebCore16JSHTMLModElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore16JSHTMLModElement9classInfoEv
-__ZN7WebCore23createBlockquoteWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore23JSHTMLBlockquoteElementC1EPN3KJS8JSObjectEPNS_21HTMLBlockquoteElementE
-__ZN7WebCore10moveCursorEv
-__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByTagNameNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore48jsElementPrototypeFunctionGetElementsByTagNameNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore40jsElementPrototypeFunctionGetAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element14getAttributeNSERKNS_6StringES3_
-__ZNK7WebCore4Node10attributesEv
-__ZNK7WebCore4Attr8nodeNameEv
-__ZN7WebCore11HTMLElement18setContentEditableEPNS_15MappedAttributeE
-__ZNK7WebCore18JSHTMLTitleElement9classInfoEv
+__ZN7WebCore21SVGDocumentExtensionsD2Ev
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapIN
+__ZN7WebCore22JSSVGDocumentPrototypeD1Ev
+__ZN7WebCore5XPath6Parser16registerNodeTestEPNS0_4Step8NodeTestE
+__ZN3WTF7HashSetIPN7WebCore5XPath4Step8NodeTestENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEE3addERKS5_
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6exp
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6reh
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E13al
+__ZN7WebCore5XPath6Parser14deleteNodeTestEPNS0_4Step8NodeTestE
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E4fin
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E47re
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6rem
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateExpressionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15XPathExpressionE
+__ZN7WebCore17JSXPathExpression15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSXPathExpressionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathExpressionEEE
+__ZN7WebCore17JSXPathExpressionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathExpressionEEE
+__ZN7WebCore21NativeXPathNSResolver18lookupNamespaceURIERKNS_6StringE
+__ZNK7WebCore4Node18lookupNamespaceURIERKNS_6StringE
+__ZN7WebCore5XPathL14createFunCountEv
+__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_9NumericOp6OpcodeEi
+__ZN7WebCore5XPathL11createFunIdEv
+__ZN7WebCore5XPathL21createFunNamespaceURIEv
+__ZN7WebCore5XPathL13createFunNameEv
+__ZN7WebCore5XPathL15createFunStringEv
+__ZN7WebCore5XPathL19createFunStartsWithEv
+__ZN7WebCore5XPathL24createFunSubstringBeforeEv
+__ZN7WebCore5XPathL23createFunSubstringAfterEv
+__ZN7WebCore5XPathL18createFunSubstringEv
+__ZN7WebCore5XPathL21createFunStringLengthEv
+__ZN7WebCore5XPathL23createFunNormalizeSpaceEv
+__ZN7WebCore5XPathL18createFunTranslateEv
+__ZN7WebCore5XPathL16createFunBooleanEv
+__ZN7WebCore5XPathL13createFunTrueEv
+__ZN7WebCore5XPathL14createFunFalseEv
+__ZN7WebCore5XPathL13createFunLangEv
+__ZN7WebCore5XPathL15createFunNumberEv
+__ZN7WebCore5XPathL14createFunFloorEv
+__ZN7WebCore5XPathL16createFunCeilingEv
+__ZN7WebCore5XPathL14createFunRoundEv
+__ZN7WebCore17JSXPathExpressionD1Ev
+__ZN7WebCore17JSXPathExpressionD2Ev
+__ZN7WebCore5XPath5UnionD0Ev
+__ZN7WebCore5XPath8FunCountD0Ev
+__ZN7WebCore5XPath8NegativeD0Ev
+__ZN7WebCore5XPath5FunIdD0Ev
+__ZN7WebCore5XPath15FunNamespaceURID0Ev
+__ZN7WebCore5XPath7FunNameD0Ev
+__ZN7WebCore5XPath9FunStringD0Ev
+__ZN7WebCore5XPath13FunStartsWithD0Ev
+__ZN7WebCore5XPath18FunSubstringBeforeD0Ev
+__ZN7WebCore5XPath17FunSubstringAfterD0Ev
+__ZN7WebCore5XPath12FunSubstringD0Ev
+__ZN7WebCore5XPath15FunStringLengthD0Ev
+__ZN7WebCore5XPath17FunNormalizeSpaceD0Ev
+__ZN7WebCore5XPath12FunTranslateD0Ev
+__ZN7WebCore5XPath10FunBooleanD0Ev
+__ZN7WebCore5XPath7FunTrueD0Ev
+__ZN7WebCore5XPath8FunFalseD0Ev
+__ZN7WebCore5XPath7FunLangD0Ev
+__ZN7WebCore5XPath9FunNumberD0Ev
+__ZN7WebCore5XPath8FunFloorD0Ev
+__ZN7WebCore5XPath10FunCeilingD0Ev
+__ZN7WebCore5XPath8FunRoundD0Ev
+__ZNK7WebCore5XPath5FunId8evaluateEv
+__ZN7WebCore26JSXPathExpressionPrototypeD1Ev
+__ZN7WebCore23JSProcessingInstruction15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSProcessingInstructionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21ProcessingInstructionEEE
+__ZN7WebCore23JSProcessingInstructionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21ProcessingInstructionEEE
+__ZN7WebCore23JSProcessingInstruction18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSProcessingInstructionD1Ev
+__ZN7WebCore14JSCDATASection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSTextPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCDATASectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CDATASectionEEE
+__ZN7WebCore14JSCDATASectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CDATASectionEEE
+__ZN7WebCore14JSCDATASectionD1Ev
+__ZN7WebCore32JSProcessingInstructionPrototypeD1Ev
+__ZN7WebCore23JSCDATASectionPrototypeD1Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9ParseNodeEKNS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10Has
+__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTraits
+__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTrai
+__ZN3WTF15deleteAllValuesIPN7WebCore6StringEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4Step8NodeTestEKNS_9HashTableIS5_S5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_1
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E5cle
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14XPathExceptionE
+__ZN7WebCore16JSXPathException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXPathExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathExceptionEEE
+__ZN7WebCore16JSXPathExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathExceptionEEE
+__ZN7WebCore16JSXPathException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSXPathExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsXPathExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathExceptionD1Ev
+__ZN7WebCore16JSXPathExceptionD2Ev
+__ZN7WebCore25JSXPathExceptionPrototypeD1Ev
+__ZNK7WebCore4Node15ancestorElementEv
+__ZN7WebCore15EntityReferenceC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore15EntityReferenceC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore15EntityReference8nodeTypeEv
+__ZN7WebCore17JSEntityReference15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSEntityReferenceC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15EntityReferenceEEE
+__ZN7WebCore17JSEntityReferenceC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15EntityReferenceEEE
+__ZNK7WebCore17JSEntityReference9classInfoEv
+__ZN7WebCore17JSEntityReferenceD1Ev
+__ZThn8_N7WebCore15EntityReferenceD0Ev
+__ZN7WebCore15EntityReferenceD0Ev
+__ZNK7WebCore5XPath9FunString8evaluateEv
+__ZN7WebCore5XPath13isRootDomNodeEPNS_4NodeE
+__ZN7WebCore26JSEntityReferencePrototypeD1Ev
+__ZN7WebCore17JSXPathExpression18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSXPathExpressionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsXPathExpressionPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSXPathExpression9classInfoEv
+__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsElementPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSXPathNSResolverPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore52jsXPathNSResolverPrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12RenderObject10nextOffsetEi
+__ZN7WebCore12jsNodePrefixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element13virtualPrefixEv
+__ZN7WebCore23jsXPathResultResultTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsXPathResultBooleanValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult12booleanValueERi
+__ZN7WebCore24jsXPathResultNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult11numberValueERi
+__ZN7WebCore28jsXPathResultSingleNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult15singleNodeValueERi
+__ZN7WebCore24jsXPathResultStringValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult11stringValueERi
+__ZN7WebCore33jsXPathResultInvalidIteratorStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult20invalidIteratorStateEv
+__ZNK7WebCore5XPath18FunSubstringBefore8evaluateEv
+__ZNK7WebCore5XPath7NodeSet7anyNodeEv
+__ZN7WebCore15jsNodeLocalNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn112_NK7WebCore17HTMLScriptElement13scriptContentEv
+__ZNK7WebCore17HTMLScriptElement13scriptContentEv
+__ZN7WebCore26setJSHTMLTableElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement8setWidthERKNS_6StringE
+__ZNK7WebCore14JSCDATASection9classInfoEv
+__ZThn8_N7WebCore12CDATASectionD0Ev
+__ZNK7WebCore7Element8nodeNameEv
+__ZN7WebCore29jsProcessingInstructionTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsProcessingInstructionDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23JSProcessingInstruction9classInfoEv
+__ZN7WebCore22jsDocumentTypeEntitiesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21ProcessingInstruction8nodeNameEv
+__ZN7WebCore17JSEntityReference18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsDOMCoreExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSDOMCoreException9classInfoEv
+__ZNK7WebCore13ExceptionBase8toStringEv
+__ZN7WebCore23jsDocumentTypeNotationsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL14mapConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZNK7WebCore21JSHTMLFrameSetElement9classInfoEv
+__ZNK7WebCore9Tokenizer14processingDataEv
+__ZN7WebCoreL18isindexConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZNK7WebCore11FrameLoader16responseMIMETypeEv
+__ZN7WebCore13ImageDocument17windowSizeChangedEv
+__ZNK7WebCore13ImageDocument17imageFitsInWindowEv
+__ZN7WebCore13ImageDocument16resizeImageToFitEv
+__ZNK7WebCore13ImageDocument5scaleEv
+__ZNK7WebCore13ImageDocument15isImageDocumentEv
+__ZN7WebCore18ImageEventListenerD0Ev
+__ZN7WebCore12IconDatabase25removeIconFromSQLDatabaseERKNS_6StringE
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14expandCapacityEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE15reserveCapacityEm
+__ZN3WTF6VectorItLm2048EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm2048EE14expandCapacityEm
+__ZN3WTF6VectorItLm2048EE15reserveCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorI6CGSizeLm2048EE14expandCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE15reserveCapacityEm
+__ZN7WebCore13HTMLTokenizer11parseServerERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore31jsDOMWindowDOMParserConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSDOMParser14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSDOMParserConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSDOMParserPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSDOMParser15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSDOMParserConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSDOMParserConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore22JSDOMParserConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMParserE
+__ZN7WebCore11JSDOMParserC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMParserEEE
+__ZN7WebCore11JSDOMParserC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMParserEEE
+__ZN7WebCore11JSDOMParser18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSDOMParserPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsDOMParserPrototypeFunctionParseFromStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSDOMParser9classInfoEv
+__ZN7WebCore9DOMParser15parseFromStringERKNS_6StringES3_
+__ZN7WebCore9Tokenizer35executeScriptsWaitingForStylesheetsEv
+__ZN7WebCore7Element26copyNonAttributePropertiesEPKS0_
+__ZNK7WebCore9Attribute5cloneEv
+__ZNK7WebCore4Attr13virtualPrefixEv
+__ZNK7WebCore4Attr6prefixEv
+__ZN7WebCore37jsDocumentPrototypeFunctionImportNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document10importNodeEPNS_4NodeEbRi
+__ZNK7WebCore4Attr16virtualLocalNameEv
+__ZNK7WebCore4Attr9localNameEv
+__ZN7WebCore11JSDOMParserD1Ev
+__ZN7WebCore11JSDOMParserD2Ev
+__ZN7WebCore20jsNodeATTRIBUTE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeCDATA_SECTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsNodeCOMMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsNodeDOCUMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsNodeDOCUMENT_FRAGMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSDOMParserPrototypeD1Ev
+__ZN7WebCore22JSDOMParserConstructorD1Ev
+__ZNK7WebCore17HTMLScriptElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17HTMLIFrameElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17CSSInheritedValue7cssTextEv
 __ZNK7WebCore17JSHTMLFontElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLInputElementBaseEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLInputElementBase16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17RenderTextControl12scrollHeightEv
-__ZN7WebCore22JSHTMLInputElementBase16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLInputElement17setSelectionStartEi
-__ZN7WebCore16HTMLInputElement15setSelectionEndEi
-__ZN7WebCore12HTMLDocument7fgColorEv
-__ZN7WebCore14RenderListItem16setExplicitValueEi
-__ZN7WebCore14RenderListItem20explicitValueChangedEv
-__ZNK7WebCore12RenderObject14nextInPreOrderEPS0_
-__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEPS0_
-__ZN7WebCore17HTMLButtonElement8setValueERKNS_6StringE
-__ZNK7WebCore17HTMLButtonElement5valueEv
-__ZN7WebCore17HTMLAnchorElement11setTabIndexEi
-__ZN7WebCore15JSHTMLLIElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore13HTMLLIElement8setValueEi
-__ZNK7WebCore17HTMLObjectElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLParamElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLEmbedElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore25JSHTMLDocumentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSDocumentFragmentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore14SVGRenderStyleeqERKS0_
-__ZN7WebCore18JSHTMLLabelElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLLabelElement10setHtmlForERKNS_6StringE
-__ZN7WebCore16JSHTMLMapElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore16JSHTMLMapElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore14HTMLMapElement7setNameERKNS_6StringE
-__ZN7WebCore17JSHTMLAreaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLAreaElement8setShapeERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement9setCoordsERKNS_6StringE
 __ZNK7WebCore15JSHTMLHRElement9classInfoEv
-__ZN7WebCore16HTMLStyleElement8setMediaERKNS_12AtomicStringE
-__ZN7WebCore19HTMLFrameSetElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCore19HTMLTableRowElement10setBgColorERKNS_6StringE
-__ZN7WebCore12ClipboardMac8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
-__ZN7WebCore15HTMLLinkElement6setRelERKNS_6StringE
-__ZN7WebCore15HTMLLinkElement7setTypeERKNS_6StringE
-__ZN7WebCore15HTMLLinkElement7setHrefERKNS_6StringE
-__ZNK7WebCore11RenderBlock16leftmostPositionEbb
-__ZNK7WebCore10RenderFlow16leftmostPositionEbb
-__ZNK7WebCore9RenderBox16leftmostPositionEbb
-__ZNK7WebCore18RenderTableSection16leftmostPositionEbb
-__ZN7WebCore16HTMLInputElement19didRestoreFromCacheEv
-__ZN7WebCore11HTMLElement6setDirERKNS_6StringE
-__ZN7WebCore15HTMLBaseElement19removedFromDocumentEv
-__ZN7WebCore21gbkCallbackSubstituteEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
-__ZN7WebCore10gbkEscapesEv
-__ZN3WTF7HashMapIitNS_7IntHashIjEENS_10HashTraitsIiEENS3_ItEEE3addERKiRKt
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E3addIiPN3KJS14DOMWindowTimerENS_17HashMapTranslatorILb1ES1_IiSF_ENS_18PairBaseHashTraitsIS9_NS8_ISF_EEEESA_S6_EEEES1_INS_17HashTableIteratorIiS2_S4_S6_SA_S9_EEbERKT_RKT0_
-__ZNK3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E8containsIiNS_22IdentityHashTranslatorIiS2_S6_EEEEbRKT_
-__ZNK3WTF7HashMapIitNS_7IntHashIjEENS_10HashTraitsIiEENS3_ItEEE3getERKi
-__ZNK7WebCore13HTMLTokenizer15executingScriptEv
-__ZN7WebCore19JSHTMLObjectElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionInsertRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11HTMLElement12setOuterHTMLERKNS_6StringERi
-__ZNK7WebCore15HTMLBodyElement4textEv
-__ZN7WebCore12HTMLDocument9linkColorEv
-__ZN7WebCore30jsConsolePrototypeFunctionInfoEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Console4infoERKNS_6StringE
-__ZNK7WebCore15HTMLMenuElement17endTagRequirementEv
-__ZNK7WebCore15HTMLMenuElement11tagPriorityEv
-__ZN7WebCore10RenderFlow19createAnonymousFlowEPNS_8DocumentEPNS_11RenderStyleE
-__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplEii
-__ZN7WebCore18JSHTMLParamElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore20createMarqueeWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore20JSHTMLMarqueeElementC1EPN3KJS8JSObjectEPNS_18HTMLMarqueeElementE
-__ZN7WebCore20JSHTMLMarqueeElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLMarqueeElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore7Marquee7suspendEv
-__ZN7WebCore38min_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore34device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore12compareValueIfEEbT_S1_NS_18MediaFeaturePrefixE
-__ZN7WebCore15JSHTMLHRElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12RenderObject37markAllDescendantsWithFloatsForLayoutEPS0_
-__ZN7WebCore28JSHTMLLegendElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLLegendElement9classInfoEv
-__ZN7WebCore12RenderObject13containsFloatEPS0_
-__ZNK7WebCore16HTMLImageElement5alignEv
-__ZN7WebCore18JSHTMLTitleElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLLegendElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLOptGroupElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23RenderFileUploadControlC2EPNS_16HTMLInputElementE
-__ZN7WebCore11FileChooser6createEPNS_17FileChooserClientERKNS_6StringE
-__ZN7WebCore11FileChooserC2EPNS_17FileChooserClientERKNS_6StringE
-__ZN7WebCore11FileChooser10chooseIconERKNS_6StringE
-__ZN7WebCore4Icon14newIconForFileERKNS_6StringE
--[WebCoreOpenPanelController initWithFileChooser:]
-__ZN7WebCore23RenderFileUploadControl8setStyleEPNS_11RenderStyleE
-__ZN7WebCore23RenderFileUploadControl17updateFromElementEv
-__ZN7WebCore32HTMLFileUploadInnerButtonElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore25fileButtonChooseFileLabelEv
-__ZNK7WebCore23RenderFileUploadControl17createButtonStyleEPNS_11RenderStyleE
-__ZN7WebCore23RenderFileUploadControl14calcPrefWidthsEv
-__ZN7WebCore23RenderFileUploadControl11paintObjectERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore23RenderFileUploadControl16maxFilenameWidthEv
-__ZNK7WebCore11FileChooser16basenameForWidthERKNS_4FontEi
-__ZN7WebCore29fileButtonNoFileSelectedLabelEv
-__ZN7WebCore11FileChooserD2Ev
--[WebCoreOpenPanelController disconnectFileChooser]
-__ZN7WebCore17JSTextConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSCommentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSCDATASectionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbS3_S3_Ri
-__ZN3KJS17staticValueGetterIN7WebCore26JSCanvasRenderingContext2DEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore26JSCanvasRenderingContext2D16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore24CanvasRenderingContext2D9lineWidthEv
+__ZN7WebCore26setJSHTMLFormElementMethodEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setMethodERKNS_6StringE
+__ZN7WebCore26setJSHTMLFormElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setTargetERKNS_6StringE
+__ZN7WebCore14jsNodeOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onchangeEv
+__ZN7WebCore21jsHTMLDocumentBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument7bgColorEv
+__ZN7WebCore19JSHTMLCanvasElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore28setJSHTMLCanvasElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLCanvasElement9setHeightEi
+__ZN7WebCore27setJSHTMLCanvasElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLCanvasElement8setWidthEi
+__ZN7WebCore24jsHTMLCanvasElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLCanvasElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClearRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9clearRectEffff
+__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4rectEffff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9closePathEv
+__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZN7WebCore24CanvasRenderingContext2D20createLinearGradientEffffRi
+__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointES3_
+__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointES3_
+__ZNK7WebCore24CanvasRenderingContext2D27prepareGradientForDashboardEPNS_14CanvasGradientE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14CanvasGradientE
+__ZN7WebCore16JSCanvasGradient15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSCanvasGradientC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CanvasGradientEEE
+__ZN7WebCore16JSCanvasGradientC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CanvasGradientEEE
+__ZN7WebCore25JSCanvasGradientPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsCanvasGradientPrototypeFunctionAddColorStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSCanvasGradient9classInfoEv
+__ZN7WebCore14CanvasGradient12addColorStopEfRKNS_6StringERi
+__ZN7WebCore9CSSParser10parseColorERjRKNS_6StringEb
+__ZN7WebCore9CSSParser10parseColorEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
+__ZN3WTF12bitwise_castIdlEET_T0_
+__ZN7WebCore38setJSCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26JSCanvasRenderingContext2D12setFillStyleEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_14CanvasGradientEEE
+__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_14CanvasGradientEEE
+__ZN7WebCore24CanvasRenderingContext2D12setFillStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
+__ZN7WebCore11CanvasStyle14applyFillColorEPNS_15GraphicsContextE
+__ZN7WebCore15GraphicsContext15setFillGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionFillEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4fillEv
+__ZNSt17_Temporary_bufferIPN7WebCore8Gradient9ColorStopES2_EC1ES3_S3_
+__ZNSt17_Temporary_bufferIPN7WebCore8Gradient9ColorStopES2_EC2ES3_S3_
+__ZSt22__get_temporary_bufferIN7WebCore8Gradient9ColorStopEESt4pairIPT_lElS5_
+__ZSt26__uninitialized_fill_n_auxIPN7WebCore8Gradient9ColorStopElS2_EvT_T0_RKT1_St12__false_type
+__ZSt22__stable_sort_adaptiveIPN7WebCore8Gradient9ColorStopES3_lPFbRKS2_S5_EEvT_S8_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPN7WebCore8Gradient9ColorStopES3_PFbRKS2_S5_EEvT_S8_T0_T1_
+__ZSt22__chunk_insertion_sortIPN7WebCore8Gradient9ColorStopElPFbRKS2_S5_EEvT_S8_T0_T1_
+__ZSt16__insertion_sortIPN7WebCore8Gradient9ColorStopEPFbRKS2_S5_EEvT_S8_T0_
+__ZN7WebCoreL12compareStopsERKNS_8Gradient9ColorStopES3_
+__ZSt25__unguarded_linear_insertIPN7WebCore8Gradient9ColorStopES2_PFbRKS2_S5_EEvT_T0_T1_
+__ZSt16__merge_adaptiveIPN7WebCore8Gradient9ColorStopElS3_PFbRKS2_S5_EEvT_S8_S8_T0_S9_T1_S9_T2_
+__ZSt16__merge_backwardIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
+__ZSt23return_temporary_bufferIN7WebCore8Gradient9ColorStopEEvPT_
+__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZN7WebCore24CanvasRenderingContext2D20createRadialGradientEffffffRi
+__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointEfS3_f
+__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointEfS3_f
+__ZN7WebCore8GradientC1ERKNS_10FloatPointEfS3_f
+__ZN7WebCore8GradientC2ERKNS_10FloatPointEfS3_f
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionSaveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4saveEv
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE15reserveCapacityEm
+__ZN7WebCore59jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7A
+__ZN7WebCore24CanvasRenderingContext2D16quadraticCurveToEffff
+__ZN7WebCore4Path14addQuadCurveToERKNS_10FloatPointES3_
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionClipEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4clipEv
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionDrawImageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D9drawImageEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEffffRi
+__ZN7WebCoreL4sizeEPNS_16HTMLImageElementE
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementERKNS_9FloatRectES5_Ri
+__ZN7WebCore24CanvasRenderingContext2D11checkOriginERKNS_4KURLE
+__ZNK7WebCore11BitmapImage23hasSingleSecurityOriginEv
+__ZSt5mergeIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
+__ZN7WebCore15GraphicsContext17setStrokeGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore16JSCanvasGradientD1Ev
+__ZN7WebCore16JSCanvasGradientD2Ev
+__ZThn8_N7WebCore17HTMLCanvasElementD0Ev
+__ZN7WebCore25JSCanvasGradientPrototypeD1Ev
+__ZN7WebCore33jsDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSXMLSerializer14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSXMLSerializerConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSXMLSerializerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSXMLSerializer15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSXMLSerializerPrototypeD1Ev
+__ZN7WebCore26JSXMLSerializerConstructorD1Ev
+__ZN7WebCore20jsMessageEventOriginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL25max_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore29setJSHTMLScriptElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement10setCharsetERKNS_6StringE
+__ZN7WebCore26setJSHTMLImageElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setAlignERKNS_6StringE
+__ZN7WebCore17jsNodeOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmousedownEv
+__ZN7WebCore13jsNodeOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onresetEv
+__ZNK7WebCore26CSSMutableStyleDeclaration17getShorthandValueEPKii
+__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement18insertAdjacentHTMLERKNS_6StringES3_Ri
+__ZN7WebCore11HTMLElement14insertAdjacentERKNS_6StringEPNS_4NodeERi
+__ZN7WebCore14RenderTableRow12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore9StyleBase11checkLoadedEv
+__ZN7WebCore10ShadowDataC1ERKS0_
+__ZN7WebCore10ShadowDataC2ERKS0_
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE15reserveCapacityEm
+__ZN7WebCore28jsHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLHtmlElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLHtmlElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore16JSHTMLModElement9classInfoEv
+__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallbackD0Ev
+__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallbackD0Ev
+__ZN7WebCore21ProcessingInstruction19removedFromDocumentEv
+__ZN7WebCore28JSHTMLHtmlElementConstructorD1Ev
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9translateEff
+__ZN7WebCore4Path9transformERKNS_20TransformationMatrixE
+__ZN7WebCore50jsCanvasRenderingContext2DPrototypeFunctionRestoreEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D7restoreEv
+__ZN7WebCore37setJSCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore24CanvasRenderingContext2D11setLineJoinERKNS_6StringE
 __ZN7WebCore13parseLineJoinERKNS_6StringERNS_8LineJoinE
-__ZNK7WebCore21JSHTMLOptGroupElement9classInfoEv
-__ZNK7WebCore14RenderReplaced14caretMaxOffsetEv
-__ZN7WebCore42jsHTMLMarqueeElementPrototypeFunctionStartEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore20JSHTMLMarqueeElement9classInfoEv
-__ZN7WebCore18HTMLMarqueeElement5startEv
-__ZN7WebCore16JSHTMLCollection14callAsFunctionEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_4ListE
+__ZN7WebCore14JSCDATASection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12CDATASection8nodeNameEv
+__ZNK7WebCore12RenderInline12offsetHeightEv
+__ZN7WebCore23setJSDocumentXMLVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15parseAttributesERKNS_6StringERb
+__ZN7WebCoreL31attributesStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10Hash
+__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3getERKS2_
+__ZN7WebCore9DocLoader20requestXSLStyleSheetERKNS_6StringE
+__ZN7WebCore19CachedXSLStyleSheetC1ERKNS_6StringE
+__ZN7WebCore19CachedXSLStyleSheetC2ERKNS_6StringE
+__ZN7WebCore19CachedXSLStyleSheet9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore12XMLTokenizer11stopParsingEv
+__ZN7WebCore18xmlDocPtrForStringEPNS_9DocLoaderERKNS_6StringES4_
+__ZN7WebCore17XMLTokenizerScopeC1EPNS_9DocLoaderEPFvPvPKczEPFvS3_P9_xmlErrorES3_
+__ZN7WebCore17XMLTokenizerScopeC2EPNS_9DocLoaderEPFvPvPKczEPFvS3_P9_xmlErrorES3_
+__ZN7WebCoreL9matchFuncEPKc
+__ZN7WebCoreL8openFuncEPKc
+__ZN7WebCoreL23shouldAllowExternalLoadERKNS_4KURLE
+__ZN7WebCoreL8readFuncEPvPci
+__ZN7WebCoreL9closeFuncEPv
+__ZN7WebCore8Document18setTransformSourceEPv
+__ZN7WebCore19CachedXSLStyleSheet5errorEv
+__ZN7WebCore19CachedXSLStyleSheet11checkNotifyEv
+__ZThn88_N7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLStyleSheetC1EPNS_4NodeERKNS_6StringEb
+__ZN7WebCore13XSLStyleSheetC2EPNS_4NodeERKNS_6StringEb
+__ZN7WebCore21ProcessingInstruction15parseStyleSheetERKNS_6StringE
+__ZN7WebCore13XSLStyleSheet11parseStringERKNS_6StringEb
+__ZN7WebCore13XSLStyleSheet9docLoaderEv
+__ZN7WebCore13XSLStyleSheet15loadChildSheetsEv
+__ZN7WebCore13XSLStyleSheet8documentEv
+__ZN7WebCore14CachedResource17allClientsRemovedEv
+__ZN7WebCore13XSLStyleSheet11checkLoadedEv
+__ZN7WebCore13XSLStyleSheet9isLoadingEv
+__ZN7WebCore21ProcessingInstruction11sheetLoadedEv
+__ZNK7WebCore21ProcessingInstruction9isLoadingEv
+__ZN7WebCore8Document17applyXSLTransformEPNS_21ProcessingInstructionE
+__ZN7WebCore13XSLTProcessor17transformToStringEPNS_4NodeERNS_6StringES4_S4_
+__ZL21initxsltSetLoaderFuncPFP7_xmlDocPKhP8_xmlDictiPv12xsltLoadTypeE
+__ZN7WebCore13XSLStyleSheetD0Ev
+__ZN7WebCore19CachedXSLStyleSheetD0Ev
+__ZN7WebCore7Element14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore21jsHTMLElementChildrenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26setJSHTMLScriptElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement7setTextERKNS_6StringE
+__ZN7WebCore16PendingCallbacks22PendingCommentCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks22PendingCommentCallbackD0Ev
+__ZN7WebCore36jsDocumentPrototypeFunctionAdoptNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document9adoptNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore15EntityReference8nodeNameEv
+__ZNK7WebCore14JSDocumentType9classInfoEv
+__ZNK7WebCore21ProcessingInstruction9nodeValueEv
+__ZNK7WebCore14RenderFrameSet8edgeInfoEv
+__ZN7WebCore17jsDOMWindowOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6onblurEv
+__ZN7WebCore20setJSDOMWindowOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSText14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSTextConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27jsHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLModElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLModElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZThn8_N7WebCore21ProcessingInstructionD0Ev
+__ZN7WebCore17JSTextConstructorD1Ev
+__ZN7WebCore27JSHTMLModElementConstructorD1Ev
+__ZN7WebCore8Document15canReplaceChildEPNS_4NodeES2_
+__ZN7WebCore22jsDocumentTypeSystemIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsDocumentDocumentURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsDocumentInputEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsDocumentXMLEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsDocumentXMLStandaloneEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsDocumentXMLVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10IconLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore23JSHTMLBlockquoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSDocumentDocumentURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document14setDocumentURIERKNS_6StringE
+__ZN7WebCore26setJSDocumentXMLStandaloneEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSCustomXPathNSResolverC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore23JSCustomXPathNSResolverC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore23JSCustomXPathNSResolverD0Ev
+__ZN7WebCore40jsElementPrototypeFunctionScrollIntoViewEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element14scrollIntoViewEb
+__ZN7WebCore17JSHTMLBaseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+-[WebCoreSynchronousLoader connection:didFailWithError:]
+__ZN7WebCore20ResourceResponseBase17setHTTPStatusCodeEi
+__ZN7WebCore40jsElementPrototypeFunctionGetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element14getAttributeNSERKNS_6StringES3_
+__ZN7WebCore26setJSDOMWindowOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore44jsElementPrototypeFunctionSetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement18setAttributeNodeNSEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore7Element18setAttributeNodeNSEPNS_4AttrERi
+__ZN7WebCore9CSSParser16parseFontFaceSrcEv
+__ZN7WebCore9CSSParser18createFontFaceRuleEv
+__ZN7WebCore15CSSFontFaceRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSFontFaceRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSFontFaceRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN7WebCore15CSSFontFaceRule14isFontFaceRuleEv
+__ZN7WebCore15CSSFontSelector15addFontFaceRuleEPKNS_15CSSFontFaceRuleE
+__ZNK7WebCore19CSSFontFaceSrcValue16isSVGFontFaceSrcEv
+__ZNK7WebCore19CSSFontFaceSrcValue17isSupportedFormatEv
+__ZN7WebCore9DocLoader11requestFontERKNS_6StringE
+__ZN7WebCore10CachedFontC1ERKNS_6StringE
+__ZN7WebCore10CachedFontC2ERKNS_6StringE
+__ZN7WebCore10CachedFont4loadEPNS_9DocLoaderE
+__ZN7WebCore17CSSFontFaceSourceC1ERKNS_6StringEPNS_10CachedFontE
+__ZN7WebCore17CSSFontFaceSourceC2ERKNS_6StringEPNS_10CachedFontE
+__ZN7WebCore10CachedFont9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore11CSSFontFace9addSourceEPNS_17CSSFontFaceSourceE
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE15reserveCapacityEm
+__ZNK7WebCore11CSSFontFace7isValidEv
+__ZNK7WebCore17CSSFontFaceSource7isValidEv
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEN
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEEENS_18PairFirstExtractorISA_EEN
+__ZN7WebCore9FontCache17getTraitsInFamilyERKNS_12AtomicStringERN3WTF6VectorIjLm0EEE
++[WebFontCache getTraits:inFamily:]
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE15reserveCapacityEm
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS0_IjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS0_IjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEEE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashMapIjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTr
+__ZNK7WebCore15FontDescription10traitsMaskEv
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZN7WebCore20CSSSegmentedFontFaceC1EPNS_15CSSFontSelectorE
+__ZN7WebCore20CSSSegmentedFontFaceC2EPNS_15CSSFontSelectorE
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3setERKjRKS4_
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14Pai
+__ZNSt17_Temporary_bufferIPPN7WebCore11CSSFontFaceES2_EC1ES3_S3_
+__ZNSt17_Temporary_bufferIPPN7WebCore11CSSFontFaceES2_EC2ES3_S3_
+__ZSt22__get_temporary_bufferIPN7WebCore11CSSFontFaceEESt4pairIPT_lElS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11CSSFontFaceES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPPN7WebCore11CSSFontFaceES3_PFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11CSSFontFaceElPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt16__insertion_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
+__ZSt16__merge_adaptiveIPPN7WebCore11CSSFontFaceElS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt5mergeIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZN7WebCoreL16compareFontFacesEPNS_11CSSFontFaceES1_
+__ZSt23return_temporary_bufferIPN7WebCore11CSSFontFaceEEvPT_
+__ZN7WebCore20CSSSegmentedFontFace14appendFontFaceEN3WTF10PassRefPtrINS_11CSSFontFaceEEE
+__ZN7WebCore20CSSSegmentedFontFace10pruneTableEv
+__ZN7WebCore11CSSFontFace24addedToSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
+__ZN3WTF7HashSetIPN7WebCore20CSSSegmentedFontFaceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6e
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6r
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSFontFaceELm32EE6shrinkEm
+__ZN7WebCore20CSSSegmentedFontFace11getFontDataERKNS_15FontDescriptionE
+__ZNK7WebCore20CSSSegmentedFontFace7isValidEv
+__ZNK3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZN7WebCore11CSSFontFace11getFontDataERKNS_15FontDescriptionEbb
+__ZN7WebCore17CSSFontFaceSource11getFontDataERKNS_15FontDescriptionEbbPNS_15CSSFontSelectorE
+__ZNK3WTF7HashMapIjPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZNK7WebCore17CSSFontFaceSource8isLoadedEv
+__ZNK7WebCore15CSSFontSelector9docLoaderEv
+__ZN7WebCore10CachedFont17beginLoadIfNeededEPNS_9DocLoaderE
+__ZN7WebCore9FontCache25getLastResortFallbackFontERKNS_15FontDescriptionE
+__ZN3WTF7HashMapIjPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore14SimpleFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10H
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE15reserveCapacityEm
+__ZN3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore17SegmentedFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_
+__ZNK7WebCore17SegmentedFontData12isCustomFontEv
+__ZNK7WebCore17SegmentedFontData9isLoadingEv
+__ZNK7WebCore17SegmentedFontData20fontDataForCharacterEi
+__ZNK7WebCore17SegmentedFontData11isSegmentedEv
+__ZN7WebCore10CachedFont4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore10CachedFont11checkNotifyEv
+__ZN7WebCore17CSSFontFaceSource10fontLoadedEPNS_10CachedFontE
+__ZN7WebCore17CSSFontFaceSource10pruneTableEv
+__ZN7WebCore17GlyphPageTreeNode23pruneTreeCustomFontDataEPKNS_8FontDataE
+__ZN7WebCore17GlyphPageTreeNode19pruneCustomFontDataEPKNS_8FontDataE
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore14SimpleFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEvRT0
+__ZN7WebCore11CSSFontFace10fontLoadedEPNS_17CSSFontFaceSourceE
+__ZN7WebCore20CSSSegmentedFontFace10fontLoadedEPNS_11CSSFontFaceE
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore17SegmentedFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEv
+__ZN7WebCore17SegmentedFontDataD0Ev
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE6shrinkEm
+__ZN7WebCore15CSSFontSelector10fontLoadedEv
+__ZN7WebCore10CachedFont20ensureCustomFontDataEv
+__ZN7WebCore28createFontCustomPlatformDataEPNS_12SharedBufferE
+__ZN7WebCore10CachedFont26platformDataFromCustomDataEfbbNS_17FontRenderingModeE
+__ZN7WebCore22FontCustomPlatformData16fontPlatformDataEibbNS_17FontRenderingModeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE6shrinkEm
+__ZN7WebCore20CSSSegmentedFontFaceD1Ev
+__ZN7WebCore20CSSSegmentedFontFaceD2Ev
+__ZN7WebCore11CSSFontFace28removedFromSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4f
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE6shrinkEm
+__ZN7WebCore11CSSFontFaceD1Ev
+__ZN7WebCore11CSSFontFaceD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore17CSSFontFaceSourceELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore17CSSFontFaceSourceD0Ev
+__ZN7WebCore10CachedFont17allClientsRemovedEv
+__ZN7WebCore22FontCustomPlatformDataD1Ev
+__ZN7WebCore22FontCustomPlatformDataD2Ev
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE6shrinkEm
+__ZN7WebCore10CachedFontD0Ev
+__ZN7WebCore15CSSFontFaceRuleD0Ev
+__ZN7WebCore19CSSFontFaceSrcValueD0Ev
+__ZN7WebCore13jsNodeBaseURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_4KURLE
+__ZNK7WebCore12DocumentType7baseURIEv
+__ZNK7WebCore7Element7baseURIEv
+__ZN7WebCore27setJSHTMLScriptElementDeferEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement8setDeferEb
+__ZN7WebCore22jsDocumentTypePublicIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsDocumentPrototypeFunctionCreateRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5RangeE
+__ZN7WebCore7JSRange15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore7JSRangeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5RangeEEE
+__ZN7WebCore7JSRangeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5RangeEEE
+__ZN7WebCore7JSRange18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSRangePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsRangePrototypeFunctionSetStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7JSRange9classInfoEv
+__ZN7WebCore34jsRangePrototypeFunctionInsertNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range10insertNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore5Range19containedByReadOnlyEv
+__ZN7WebCore5Range13textNodeSplitEPNS_4TextE
+__ZN7WebCore7JSRangeD1Ev
+__ZN7WebCore7JSRangeD2Ev
+__ZN7WebCore5Range17nodeWillBeRemovedEPNS_4NodeE
+__ZN7WebCore16JSRangePrototypeD1Ev
+__ZN7WebCore15jsNodeOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node9onmouseupEv
+__ZN7WebCore44jsElementPrototypeFunctionGetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23jsHTMLAnchorElementHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hashEv
+__ZN7WebCore17jsDOMWindowStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6statusEv
+__ZNK7WebCore5Frame15jsStatusBarTextEv
+__ZN7WebCore4Node12insertBeforeEN3WTF10PassRefPtrIS0_EEPS0_Rib
+__ZN7WebCore41jsNodePrototypeFunctionIsDefaultNamespaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node18isDefaultNamespaceERKNS_12AtomicStringE
+__ZN7WebCore34jsNodePrototypeFunctionIsEqualNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node11isEqualNodeEPS0_
+__ZNK7WebCore4Node13virtualPrefixEv
+__ZN7WebCore33jsNodePrototypeFunctionIsSameNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNamedNodeMap10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore41jsNodePrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore35jsNodePrototypeFunctionLookupPrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node12lookupPrefixERKNS_12AtomicStringE
+__ZNK7WebCore4Node21lookupNamespacePrefixERKNS_12AtomicStringEPKNS_7ElementE
+__ZN7WebCore4Node11removeChildEPS0_Ri
+__ZSt16__merge_backwardIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZN7WebCore24jsDocumentDefaultCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document14defaultCharsetEv
 __ZN7WebCore19TextResourceDecoder22detectJapaneseEncodingEPKcm
 __ZN7WebCore9KanjiCode5judgeEPKci
-__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollByEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8scrollByEii
-__ZN7WebCore10ScrollView8scrollByEii
-__ZN7WebCore9InlineBox15clearTruncationEv
-__ZNK7WebCore16HTMLInputElement12defaultValueEv
-__ZN7WebCore15newTextCodecMacERKNS_12TextEncodingEPKv
-__ZN7WebCore12TextCodecMacC1Em
-__ZN7WebCore12TextCodecMac6decodeEPKcmb
-__ZNK7WebCore12TextCodecMac18createTECConverterEv
-__ZN7WebCore12TextCodecMac6decodeEPKhiRiPviS3_
-__ZNK7WebCore12TextCodecMac19releaseTECConverterEv
-__ZN7WebCore24submitButtonDefaultLabelEv
-__ZN7WebCore10helpCursorEv
-__ZN7WebCore12HTMLDocument13setDesignModeERKNS_6StringE
-__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
-__ZN7WebCore17JSHTMLFormElement11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore15HTMLFormElement4itemEj
-__ZN7WebCore20CompositeEditCommand17replaceTextInNodeEPNS_4TextEiiRKNS_6StringE
-__ZN7WebCore41jsDOMSelectionPrototypeFunctionGetRangeAtEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection10getRangeAtEiRi
-__ZN7WebCore34jsRangePrototypeFunctionCloneRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3KJS17staticValueGetterIN7WebCore7JSRangeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore7JSRange16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15executeFontSizeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore5Frame24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore26CSSMutableStyleDeclaration11makeMutableEv
-__ZNK7WebCore26CSSMutableStyleDeclaration19copyBlockPropertiesEv
+__ZN7WebCore23JSProcessingInstruction3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21ProcessingInstruction12setNodeValueERKNS_6StringERi
+__ZN7WebCore21ProcessingInstruction7setDataERKNS_6StringERi
+__ZN7WebCore26jsCSSStyleRuleSelectorTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore23JSHTMLBlockquoteElement9classInfoEv
+__ZN7WebCore39jsTextPrototypeFunctionReplaceWholeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Text16replaceWholeTextERKNS_6StringERi
+__ZN7WebCoreL33earliestLogicallyAdjacentTextNodeEPKNS_4TextE
+__ZN7WebCoreL31latestLogicallyAdjacentTextNodeEPKNS_4TextE
+__ZN7WebCore15jsTextWholeTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Text9wholeTextEv
+__ZN7WebCore21jsNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNodeList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSNodeListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSNodeListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34jsLocationPrototypeFunctionReplaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation7replaceEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21JSNodeListConstructorD1Ev
+__ZN7WebCore14RenderThemeMac28paintSearchFieldCancelButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore16JSHTMLMapElement9classInfoEv
+__ZN7WebCore24jsHTMLDocumentDesignModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12HTMLDocument10designModeEv
+__ZN7WebCore31jsHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLHeadingElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLHeadingElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLHeadingElementConstructorD1Ev
+__ZN7WebCore11HTMLElement18setContentEditableEPNS_15MappedAttributeE
+__ZN7WebCore40jsDOMWindowPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12getSelectionEv
+__ZN7WebCore12DOMSelectionC1EPNS_5FrameE
+__ZN7WebCore12DOMSelectionC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12DOMSelectionE
+__ZN7WebCore14JSDOMSelection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSDOMSelectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DOMSelectionEEE
+__ZN7WebCore14JSDOMSelectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DOMSelectionEEE
+__ZN7WebCore14JSDOMSelection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSDOMSelectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsDOMSelectionPrototypeFunctionSetPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSDOMSelection9classInfoEv
+__ZN7WebCore12DOMSelection11setPositionEPNS_4NodeEiRi
+__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionEb
+__ZN7WebCore31SimplifiedBackwardsTextIterator21handleReplacedElementEv
+__ZN7WebCoreL13executeDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore32lineBreakExistsAtVisiblePositionERKNS_15VisiblePositionE
+__ZN7WebCore21positionBeforeTabSpanERKNS_8PositionE
+__ZNK7WebCore4Node14lastDescendantEv
+__ZN7WebCore14caretMinOffsetEPKNS_4NodeE
+__ZN7WebCore20CompositeEditCommand21removeChildrenInRangeEN3WTF10PassRefPtrINS_4NodeEEEjj
+__ZNK7WebCore15VisiblePosition19absoluteCaretBoundsEv
+__ZN7WebCore20CompositeEditCommand13moveParagraphERKNS_15VisiblePositionES3_S3_bb
+__ZN7WebCore20CompositeEditCommand14moveParagraphsERKNS_15VisiblePositionES3_S3_bb
+__ZN7WebCore11EditCommand15styleAtPositionERKNS_8PositionE
+__ZN7WebCore26CSSMutableStyleDeclaration21removeBlockPropertiesEv
+__ZN7WebCore20CompositeEditCommand15deleteSelectionEbbbb
+__ZN7WebCore20CompositeEditCommand27removeNodeAndPruneAncestorsEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore22DeleteSelectionCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore20isTableStructureNodeEPKNS_4NodeE
+__ZN7WebCoreL28updatePositionForNodeRemovalEPNS_4NodeERNS_8PositionE
+__ZN7WebCore20CompositeEditCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommandC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand5pruneEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore14isStartOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
+__ZN7WebCore23ReplaceSelectionCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
+__ZN7WebCore23ReplaceSelectionCommand7doApplyEv
+__ZN7WebCore19ReplacementFragmentC1EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_16VisibleSelectionE
+__ZN7WebCore19ReplacementFragmentC2EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_16VisibleSelectionE
+__ZN7WebCore23ReplaceSelectionCommand21performTrivialReplaceERKNS_19ReplacementFragmentE
+__ZNK7WebCore19ReplacementFragment10firstChildEv
+__ZN7WebCore20CompositeEditCommand35prepareWhitespaceAtPositionForSplitERNS_8PositionE
+__ZN7WebCore20CompositeEditCommand22positionOutsideTabSpanERKNS_8PositionE
+__ZN7WebCoreL26isMailPasteAsQuotationNodeEPKNS_4NodeE
+__ZN7WebCore11isStyleSpanEPKNS_4NodeE
+__ZNK7WebCore19ReplacementFragment7isEmptyEv
+__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationENS_10EditActionENS0_14EPropertyLevelE
 __ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationENS_10EditActionENS0_14EPropertyLevelE
 __ZN7WebCore17ApplyStyleCommand7doApplyEv
-__ZNK7WebCore26CSSMutableStyleDeclaration4copyEv
+__ZNK7WebCore26CSSMutableStyleDeclaration19copyBlockPropertiesEv
 __ZN7WebCore17ApplyStyleCommand28applyRelativeFontStyleChangeEPNS_26CSSMutableStyleDeclarationE
 __ZN7WebCore17ApplyStyleCommand16applyInlineStyleEPNS_26CSSMutableStyleDeclarationE
 __ZN7WebCore17ApplyStyleCommand13startPositionEv
@@ -9913,4199 +14127,9872 @@ __ZN7WebCore17ApplyStyleCommand11endPositionEv
 __ZN7WebCore17ApplyStyleCommand31splitTextElementAtStartIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand29splitTextElementAtEndIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand17removeInlineStyleEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEERKNS_8PositionES7_
+__ZN7WebCore17ApplyStyleCommand39pushDownTextDecorationStyleAtBoundariesERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand37pushDownTextDecorationStyleAroundNodeEPNS_4NodeEb
 __ZNK7WebCore17ApplyStyleCommand17nodeFullySelectedEPNS_4NodeERKNS_8PositionES5_
+__ZN7WebCore17ApplyStyleCommand14updateStartEndERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand23applyInlineStyleToRangeEPNS_26CSSMutableStyleDeclarationERKNS_8PositionES5_
+__ZN7WebCore17ApplyStyleCommand30cleanupUnstyledAppleStyleSpansEPNS_4NodeE
+__ZN7WebCore17RemoveNodeCommandD0Ev
+__ZN7WebCore23ReplaceSelectionCommandD0Ev
+__ZN7WebCore17ApplyStyleCommandD0Ev
+__ZN7WebCore12DOMSelection15disconnectFrameEv
+__ZN7WebCore14JSDOMSelectionD1Ev
+__ZN7WebCore14JSDOMSelectionD2Ev
+__ZN7WebCore23JSDOMSelectionPrototypeD1Ev
+__ZN7WebCore4Node13computedStyleEv
+__ZN7WebCore22DeleteSelectionCommandC1EPNS_8DocumentEbbbb
+__ZN7WebCore22DeleteSelectionCommandC2EPNS_8DocumentEbbbb
 __ZN7WebCore17ApplyStyleCommand15isHTMLStyleNodeEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
 __ZN7WebCore17ApplyStyleCommand19removeHTMLFontStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
+__ZN7WebCore17ApplyStyleCommand28removeHTMLBidiEmbeddingStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
 __ZN7WebCore17ApplyStyleCommand14removeCSSStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
-__ZN7WebCore19isUnstyledStyleSpanEPKNS_4NodeE
-__ZN7WebCore17ApplyStyleCommand14updateStartEndERKNS_8PositionES3_
-__ZN7WebCore5RangeC2EPNS_8DocumentERKNS_8PositionES5_
-__ZNK7WebCore4Node14childNodeCountEv
 __ZN7WebCore17ApplyStyleCommand22addInlineStyleIfNeededEPNS_26CSSMutableStyleDeclarationEPNS_4NodeES4_
-__ZN7WebCore11StyleChange21styleModeForParseModeEb
-__ZN7WebCore11StyleChangeC2EPNS_19CSSStyleDeclarationERKNS_8PositionENS0_17ELegacyHTMLStylesE
+__ZN7WebCore11StyleChangeC1EPNS_19CSSStyleDeclarationERKNS_8PositionE
+__ZN7WebCore11StyleChangeC2EPNS_19CSSStyleDeclarationERKNS_8PositionE
 __ZN7WebCore11StyleChange4initEN3WTF10PassRefPtrINS_19CSSStyleDeclarationEEERKNS_8PositionE
 __ZN7WebCore11StyleChange17currentlyHasStyleERKNS_8PositionEPKNS_11CSSPropertyE
-__ZN7WebCore22createStyleSpanElementEPNS_8DocumentE
-__ZN7WebCore20styleSpanClassStringEv
-__ZN7WebCore17ApplyStyleCommand28surroundNodeRangeWithElementEPNS_4NodeES2_PNS_7ElementE
-__ZN7WebCore17ApplyStyleCommand30cleanupUnstyledAppleStyleSpansEPNS_4NodeE
-__ZNK7WebCore17ApplyStyleCommand13editingActionEv
-__ZNK7WebCore11EditCommand15isTypingCommandEv
-__ZN7WebCore27enabledInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore17executeToggleBoldEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore18executeToggleStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiPKcS5_
-__ZNK7WebCore6Editor22selectionStartHasStyleEPNS_19CSSStyleDeclarationE
-__ZNK7WebCore5Frame22selectionComputedStyleERPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand17removeCSSPropertyEPNS_19CSSStyleDeclarationEi
-__ZN7WebCore24RemoveCSSPropertyCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationEi
-__ZN7WebCore24RemoveCSSPropertyCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand28removeNodePreservingChildrenEPNS_4NodeE
-__ZN7WebCore35RemoveNodePreservingChildrenCommandC2EPNS_4NodeE
-__ZN7WebCore35RemoveNodePreservingChildrenCommand7doApplyEv
-__ZN7WebCore19executeToggleItalicEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore16executeForeColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17executeApplyStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
-__ZNK7WebCore12DOMSelection11isCollapsedEv
-__ZN7WebCore34jsDOMWindowPrototypeFunctionPromptEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow6promptERKNS_6StringES3_
-__ZN7WebCore6Chrome19runJavaScriptPromptEPNS_5FrameERKNS_6StringES5_RS3_
-__ZN7WebCore21PageGroupLoadDeferrerC2EPNS_4PageEb
-__ZN7WebCore21PageGroupLoadDeferrerD2Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE6shrinkEm
-__ZN7WebCore17executeCreateLinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17CreateLinkCommandC1EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore17CreateLinkCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand39pushPartiallySelectedAnchorElementsDownEv
-__ZN7WebCore20CompositeEditCommand18applyStyledElementEPNS_7ElementE
-__ZN7WebCore17ApplyStyleCommandC1EPNS_7ElementEbNS_10EditActionE
-__ZNK7WebCore17CreateLinkCommand13editingActionEv
-__ZN7WebCore20executeJustifyCenterEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore26executeApplyParagraphStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
-__ZN7WebCore6Editor19applyParagraphStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore17ApplyStyleCommand15applyBlockStyleEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore20CompositeEditCommand42moveParagraphContentsToNewBlockIfNecessaryERKNS_8PositionE
-__ZN7WebCore17ApplyStyleCommand13addBlockStyleERKNS_11StyleChangeEPNS_11HTMLElementE
-__ZN7WebCore20CompositeEditCommand16setNodeAttributeEPNS_7ElementERKNS_13QualifiedNameERKNS_6StringE
-__ZN7WebCore23SetNodeAttributeCommandC2EPNS_7ElementERKNS_13QualifiedNameERKNS_6StringE
-__ZN7WebCore23SetNodeAttributeCommand7doApplyEv
-__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
-__ZN7WebCore19executeJustifyRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore18executeJustifyFullEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore18executeJustifyLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore24executeInsertOrderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17InsertListCommandC2EPNS_8DocumentENS0_4TypeERKNS_6StringE
-__ZN7WebCore17InsertListCommand7doApplyEv
-__ZN7WebCore17InsertListCommand11modifyRangeEv
-__ZN7WebCore30selectionForParagraphIterationERKNS_9SelectionE
-__ZN7WebCore21createListItemElementEPNS_8DocumentE
-__ZN7WebCore22outermostEnclosingListEPNS_4NodeE
-__ZN7WebCore13enclosingListEPNS_4NodeE
-__ZN7WebCore24createOrderedListElementEPNS_8DocumentE
-__ZN7WebCore20CompositeEditCommand13moveParagraphERKNS_15VisiblePositionES3_S3_bb
-__ZN7WebCore20CompositeEditCommand14moveParagraphsERKNS_15VisiblePositionES3_S3_bb
-__ZN7WebCore12createMarkupEPKNS_5RangeEPN3WTF6VectorIPNS_4NodeELm0EEENS_23EAnnotateForInterchangeEb
-__ZN7WebCore25avoidIntersectionWithNodeEPKNS_5RangeEPNS_4NodeE
-__ZN7WebCore14getStartMarkupEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPN3WTF7HashMapIPNS_16AtomicStringImplESA_NS7_7PtrHashISA_EENS7_10HashTraitsISA_EESE_EE
-__ZN7WebCore12getEndMarkupEPKNS_4NodeE
-__ZN7WebCore13computedStyleEPNS_4NodeE
-__ZN7WebCore28propertyMissingOrEqualToNoneEPNS_26CSSMutableStyleDeclarationEi
-__ZN7WebCore32elementHasTextDecorationPropertyEPKNS_4NodeE
-__ZN7WebCore34styleFromMatchedRulesAndInlineDeclEPKNS_4NodeE
-__ZN7WebCore31styleFromMatchedRulesForElementEPNS_7ElementEb
-__ZN7WebCore26CSSMutableStyleDeclaration5mergeEPS0_b
-__ZN7WebCore26CSSMutableStyleDeclaration21removeBlockPropertiesEv
-__ZN7WebCore11joinMarkupsEN3WTF6VectorINS_6StringELm0EEERKS3_
-__ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
-__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore17ApplyStyleCommand39pushDownTextDecorationStyleAtBoundariesERKNS_8PositionES3_
-__ZN7WebCore17ApplyStyleCommand37pushDownTextDecorationStyleAroundNodeEPNS_4NodeERKNS_8PositionES5_b
-__ZNK7WebCore8RenderBR14caretMaxOffsetEv
-__ZN7WebCore20CompositeEditCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand5pruneEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore22hasARenderedDescendantEPNS_4NodeE
-__ZN7WebCore23ReplaceSelectionCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
-__ZN7WebCore23ReplaceSelectionCommand7doApplyEv
-__ZN7WebCore19ReplacementFragmentC2EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_9SelectionE
+__ZNK7WebCore27CSSComputedStyleDeclaration36getFontSizeCSSValuePreferringKeywordEv
 __ZN7WebCore19ReplacementFragment22removeInterchangeNodesEPNS_4NodeE
-__ZN7WebCore24isInterchangeNewlineNodeEPKNS_4NodeE
-__ZN7WebCore31isInterchangeConvertedSpaceSpanEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand35prepareWhitespaceAtPositionForSplitERNS_8PositionE
-__ZNK7WebCore19ReplacementFragment10firstChildEv
-__ZN7WebCore11isStyleSpanEPKNS_4NodeE
-__ZNK7WebCore19ReplacementFragment7isEmptyEv
+__ZN7WebCoreL24isInterchangeNewlineNodeEPKNS_4NodeE
+__ZN7WebCoreL31isInterchangeConvertedSpaceSpanEPKNS_4NodeE
+__ZNK7WebCore19ReplacementFragment9lastChildEv
+__ZN7WebCoreL20styleSpanClassStringEv
+__ZN7WebCore19ReplacementFragment28removeNodePreservingChildrenEPNS_4NodeE
 __ZN7WebCore19ReplacementFragment10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore23ReplaceSelectionCommand34insertNodeAtAndUpdateNodesInsertedEPNS_4NodeERKNS_8PositionE
+__ZN7WebCore19ReplacementFragment16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_
+__ZN7WebCore23ReplaceSelectionCommand34insertNodeAtAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
 __ZN7WebCore23ReplaceSelectionCommand19updateNodesInsertedEPNS_4NodeE
 __ZN7WebCore23ReplaceSelectionCommand31removeUnrenderedTextNodesAtEndsEv
 __ZN7WebCore23ReplaceSelectionCommand36negateStyleRulesThatAffectAppearanceEv
-__ZN7WebCore23ReplaceSelectionCommand21removeRedundantStylesEPNS_4NodeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore26CSSMutableStyleDeclarationEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore26CSSMutableStyleDeclarationEEELm0EE15reserveCapacityEm
-__ZN7WebCore27CSSComputedStyleDeclaration39removeComputedInheritablePropertiesFromEPNS_26CSSMutableStyleDeclarationE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE6shrinkEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore26CSSMutableStyleDeclarationEEELm0EE6shrinkEm
 __ZN7WebCore23ReplaceSelectionCommand30positionAtEndOfInsertedContentEv
 __ZN7WebCore23ReplaceSelectionCommand32positionAtStartOfInsertedContentEv
 __ZN7WebCore23ReplaceSelectionCommand17shouldRemoveEndBREPNS_4NodeERKNS_15VisiblePositionE
-__ZN7WebCore23ReplaceSelectionCommand16shouldMergeStartEbb
 __ZN7WebCore23ReplaceSelectionCommand14shouldMergeEndEb
+__ZN7WebCore23ReplaceSelectionCommand16shouldMergeStartEbbb
+__ZN7WebCore23ReplaceSelectionCommand16mergeEndIfNeededEv
 __ZN7WebCore23ReplaceSelectionCommand26handlePasteAsQuotationNodeEv
-__ZN7WebCore26isMailPasteAsQuotationNodeEPKNS_4NodeE
 __ZN7WebCore23ReplaceSelectionCommand23completeHTMLReplacementERKNS_8PositionE
-__ZNK7WebCore17InsertListCommand13editingActionEv
-__ZN7WebCore20CompositeEditCommand21removeChildrenInRangeEPNS_4NodeEii
-__ZN7WebCore6Editor24insertParagraphSeparatorEv
-__ZN7WebCore13TypingCommand24insertParagraphSeparatorEPNS_8DocumentE
-__ZN7WebCore13TypingCommand24insertParagraphSeparatorEv
-__ZN7WebCore31InsertParagraphSeparatorCommandC2EPNS_8DocumentEb
-__ZN7WebCore31InsertParagraphSeparatorCommand7doApplyEv
-__ZN7WebCore31InsertParagraphSeparatorCommand29calculateStyleBeforeInsertionERKNS_8PositionE
-__ZN7WebCore11EditCommand15styleAtPositionERKNS_8PositionE
-__ZN7WebCore14isStartOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore12startOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore20CompositeEditCommand22appendBlockPlaceholderEPNS_4NodeE
-__ZN7WebCore29createBlockPlaceholderElementEPNS_8DocumentE
-__ZN7WebCore31InsertParagraphSeparatorCommand24applyStyleAfterInsertionEv
-__ZNK7WebCore31InsertParagraphSeparatorCommand20preservesTypingStyleEv
-__ZN7WebCore29createDefaultParagraphElementEPNS_8DocumentE
-__ZN7WebCore22nonBreakingSpaceStringEv
-__ZN7WebCore26executeInsertUnorderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore23ReplaceSelectionCommand28removeNodePreservingChildrenEPNS_4NodeE
-__ZN7WebCore26createUnorderedListElementEPNS_8DocumentE
-__ZN7WebCore37jsRangePrototypeFunctionCloneContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range13cloneContentsERi
-__ZN7WebCore5Range15processContentsENS0_10ActionTypeERi
-__ZN7WebCore23JSHTMLBlockquoteElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSHTMLBlockquoteElement9classInfoEv
-__ZN7WebCore4Node11setDocumentEPNS_8DocumentE
-__ZN7WebCore4Node26willMoveToNewOwnerDocumentEv
-__ZN3KJS17ScriptInterpreter21updateDOMNodeDocumentEPN7WebCore4NodeEPNS1_8DocumentES5_
-__ZN7WebCore4Node25didMoveToNewOwnerDocumentEv
-__ZN7WebCore46jsDOMSelectionPrototypeFunctionRemoveAllRangesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection15removeAllRangesEv
-__ZN7WebCore38jsRangePrototypeFunctionDeleteContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range14deleteContentsERi
-__ZN7WebCore5Range18checkDeleteExtractERi
-__ZNK7WebCore5Range19containedByReadOnlyEv
-__ZN7WebCore30jsRangePrototypeFunctionSetEndEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16RenderListMarker18canBeSelectionLeafEv
-__ZN7WebCore16RenderListMarker17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZN7WebCore16RenderListMarker13selectionRectEb
-__ZN7WebCore24RemoveCSSPropertyCommandD1Ev
-__ZN7WebCore17CreateLinkCommandD1Ev
-__ZN7WebCore18JSDocumentFragment18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsDOMCoreExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore18JSDOMCoreException9classInfoEv
-__ZNK7WebCore13ExceptionBase8toStringEv
-__ZN7WebCore33jsDOMWindowPrototypeFunctionAlertEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow5alertERKNS_6StringE
-__ZN7WebCore6Chrome18runJavaScriptAlertEPNS_5FrameERKNS_6StringE
-__ZNK7WebCore17BeforeUnloadEvent20storesResultAsStringEv
-__ZN7WebCore17BeforeUnloadEvent11storeResultERKNS_6StringE
-__ZN7WebCore6Chrome27runBeforeUnloadConfirmPanelERKNS_6StringEPNS_5FrameE
-__ZN7WebCore6Editor21isSelectionMisspelledEv
-__ZN7WebCore6Editor29guessesForMisspelledSelectionEv
-__ZN7WebCore30contextMenuItemTagSpellingMenuEv
-__ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
-__ZN7WebCore31contextMenuItemTagCheckSpellingEv
-__ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
-__ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
-__ZN7WebCore6Editor22spellingPanelIsShowingEv
-__ZN7WebCore15ContextMenuItem8setTitleERKNS_6StringE
-__ZN7WebCore15ContextMenuItem10setSubMenuEPNS_11ContextMenuE
-__ZN7WebCore26contextMenuItemTagFontMenuEv
-__ZN7WebCore27contextMenuItemTagShowFontsEv
-__ZN7WebCore22contextMenuItemTagBoldEv
-__ZN7WebCore24contextMenuItemTagItalicEv
-__ZN7WebCore27contextMenuItemTagUnderlineEv
-__ZN7WebCore25contextMenuItemTagOutlineEv
-__ZN7WebCore24contextMenuItemTagStylesEv
-__ZN7WebCore28contextMenuItemTagShowColorsEv
-__ZN7WebCore8Document25createCSSStyleDeclarationEv
-__ZNK7WebCore6Editor17selectionHasStyleEPNS_19CSSStyleDeclarationE
-__ZN7WebCore11updateStateEPNS_26CSSMutableStyleDeclarationEPNS_27CSSComputedStyleDeclarationERbRNS_8TriStateE
-__ZN7WebCore28contextMenuItemTagSpeechMenuEv
-__ZN7WebCore31contextMenuItemTagStartSpeakingEv
-__ZN7WebCore30contextMenuItemTagStopSpeakingEv
-__ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
-__ZN7WebCore34contextMenuItemTagDefaultDirectionEv
-__ZN7WebCore29contextMenuItemTagLeftToRightEv
-__ZN7WebCore29contextMenuItemTagRightToLeftEv
-__ZN7WebCore6Editor21toggleGrammarCheckingEv
-__ZN7WebCore13endOfSentenceERKNS_15VisiblePositionE
-__ZN7WebCore19endSentenceBoundaryEPKtj
-__ZN7WebCore21sentenceBreakIteratorEPKti
-__ZN7WebCore15startOfSentenceERKNS_15VisiblePositionE
-__ZN7WebCore21startSentenceBoundaryEPKtj
-__ZN7WebCore6Editor14markBadGrammarERKNS_9SelectionE
-__ZN7WebCore26findFirstBadGrammarInRangeEPNS_12EditorClientEPNS_5RangeERNS_13GrammarDetailERib
-__ZN3WTF6VectorIN7WebCore13GrammarDetailELm0EE6shrinkEm
-__ZN7WebCore16executeSelectAllEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController9selectAllEv
-__ZNK7WebCore4Node12canSelectAllEv
-__ZN7WebCore6Editor24isSelectionUngrammaticalEv
-__ZN7WebCore20isRangeUngrammaticalEPNS_12EditorClientEPNS_5RangeERN3WTF6VectorINS_6StringELm0EEE
-__ZN7WebCore6Editor24advanceToNextMisspellingEb
-__ZNK7WebCore17RenderTextControl9scrollTopEv
-__ZN7WebCore17RenderTextControl12setScrollTopEi
--[WebCoreFrameBridge replaceSelectionWithText:selectReplacement:smartReplace:]
--[WebCoreFrameBridge documentFragmentWithText:inContext:]
-__ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
-__ZNK7WebCore16DeprecatedString8endsWithERKS0_
-+[DOMDocumentFragment(WebCoreInternal) _wrapDocumentFragment:]
--[WebCoreFrameBridge replaceSelectionWithFragment:selectReplacement:smartReplace:matchStyle:]
--[DOMDocumentFragment(WebCoreInternal) _documentFragment]
-__ZNK7WebCore23ReplaceSelectionCommand13editingActionEv
-__ZN7WebCore19ReplacementFragment30insertFragmentForTestRenderingEPNS_4NodeE
-__ZN7WebCore19ReplacementFragment35restoreTestRenderingNodesToFragmentEPNS_4NodeE
-__ZN7WebCore19ReplacementFragment21removeUnrenderedNodesEPNS_4NodeE
-__ZN7WebCore14isNodeRenderedEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand13splitTextNodeEPNS_4TextEi
-__ZN7WebCore20SplitTextNodeCommandC2EPNS_4TextEi
-__ZN7WebCore20SplitTextNodeCommand7doApplyEv
-__ZN7WebCore8Document11copyMarkersEPNS_4NodeEjiS2_iNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationERKNS_8PositionES5_NS_10EditActionE
-__ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLevelE
--[WebScriptObject valueForKey:]
--[WebScriptObject _originRootObject]
--[DOMDocument body]
-__ZN7WebCore11FrameLoader23reloadAllowingStaleDataERKNS_6StringE
-__ZN7WebCore15DatabaseTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
-__ZN7WebCore15DatabaseTracker15populateOriginsEv
-__ZN7WebCore18OriginQuotaManagerC1Ev
-__ZN7WebCore15DatabaseTracker19openTrackerDatabaseEb
-__ZNK7WebCore15DatabaseTracker19trackerDatabasePathEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE6resizeEm
-___tcf_1
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS6_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_xENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIxEEEESB_EC1ERKSF_
-__ZNK7WebCore32HTMLFileUploadInnerButtonElement12isShadowNodeEv
-__ZN7WebCore32HTMLFileUploadInnerButtonElement16shadowParentNodeEv
-__ZN7WebCore23RenderFileUploadControl5clickEv
-__ZN7WebCore11FileChooser15openFileChooserEPNS_8DocumentE
--[WebCoreOpenPanelController beginSheetWithFrame:]
--[WebCoreOpenPanelController chooseFilename:]
-__ZN7WebCore11FileChooser10chooseFileERKNS_6StringE
-__ZN7WebCore4IconC1EP7NSImage
-__ZThn132_N7WebCore23RenderFileUploadControl12valueChangedEv
-__ZN7WebCore23RenderFileUploadControl12valueChangedEv
-__ZN7WebCore4Icon5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore12FormDataList10appendFileERKNS_6StringES3_
-__ZN7WebCore10StringImpl11reverseFindEti
-__ZN7WebCore16MIMETypeRegistry18getMIMETypeForPathERKNS_6StringE
-__ZN7WebCore16MIMETypeRegistry23getMIMETypeForExtensionERKNS_6StringE
-__ZN7WebCore8FormData10appendFileERKNS_6StringE
-__ZN7WebCore10formCreateEP14__CFReadStreamPv
-__ZN7WebCore18getStreamFormDatasEv
-__ZN7WebCore18httpBodyFromStreamEP13NSInputStream
-__ZN3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RKS6_
-__ZN7WebCore12formFinalizeEP14__CFReadStreamPv
-__ZN7WebCore18closeCurrentStreamEPNS_16FormStreamFieldsE
-__ZN7WebCore12formScheduleEP14__CFReadStreamP11__CFRunLoopPK10__CFStringPv
-__ZN7WebCore8pairHashEPKv
-__ZN7WebCore10pairRetainEPK13__CFAllocatorPKv
-__ZN7WebCore9pairEqualEPKvS1_
-__ZN7WebCore8formOpenEP14__CFReadStreamP13CFStreamErrorPhPv
-__ZN7WebCore14openNextStreamEPNS_16FormStreamFieldsE
-__ZN7WebCore20advanceCurrentStreamEPNS_16FormStreamFieldsE
-__ZN7WebCore16scheduleWithPairEPKvPv
-__ZN7WebCore17formEventCallbackEP14__CFReadStreammPv
-__ZN7WebCore8formReadEP14__CFReadStreamPhlP13CFStreamErrorS2_Pv
-__ZN7WebCore11formCanReadEP14__CFReadStreamPv
-__ZN7WebCore9formCloseEP14__CFReadStreamPv
-__ZN7WebCore4IconD1Ev
-__ZN7WebCore11pairReleaseEPK13__CFAllocatorPKv
-__ZN7WebCore11executeCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Editor4copyEv
-__ZN7WebCore6Editor12tryDHTMLCopyEv
-__ZN7WebCore10Pasteboard5clearEv
-__ZN7WebCore6Editor20canSmartCopyOrDeleteEv
-__ZN7WebCore6Editor13selectedRangeEv
-__ZN7WebCore10Pasteboard14writeSelectionEPNS_5RangeEbPNS_5FrameE
-__ZN7WebCore10Pasteboard14writeSelectionEP12NSPasteboardPNS_5RangeEbPNS_5FrameE
--[DOMRange commonAncestorContainer]
--[DOMRange startContainer]
--[DOMNode nodeType]
--[DOMNode firstChild]
--[DOMNode nextSibling]
--[DOMRange endContainer]
--[DOMElement tagName]
--[DOMObject copyWithZone:]
--[DOMCSSStyleDeclaration getPropertyCSSValue:]
-+[DOMCSSValue(WebCoreInternal) _wrapCSSValue:]
--[DOMCSSValue(WebCoreInternal) _initWithCSSValue:]
--[DOMCSSValue cssValueType]
--[DOMCSSPrimitiveValue primitiveType]
--[DOMCSSPrimitiveValue getStringValue]
-__ZNK7WebCore17CSSPrimitiveValue14getStringValueERi
--[DOMHTMLTableElement cellSpacing]
-__ZNK7WebCore16HTMLTableElement11cellSpacingEv
--[DOMHTMLTableElement cellPadding]
-__ZNK7WebCore16HTMLTableElement11cellPaddingEv
--[DOMCSSPrimitiveValue getFloatValue:]
-__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEtRi
--[DOMElement style]
--[DOMCSSPrimitiveValue getRGBColorValue]
-__ZNK7WebCore17CSSPrimitiveValue16getRGBColorValueERi
-+[DOMRGBColor initialize]
-+[DOMRGBColor(WebCoreInternal) _wrapRGBColor:]
-__ZN7WebCore16getWrapperForRGBEj
--[DOMRGBColor(WebCoreInternal) _initWithRGB:]
-__ZN7WebCore16setWrapperForRGBEP11objc_objectj
--[DOMRGBColor(WebPrivate) _color]
--[DOMRGBColor color]
--[DOMHTMLTableCellElement rowSpan]
--[DOMHTMLTableCellElement colSpan]
--[DOMHTMLTableCellElement width]
-__ZNK7WebCore20HTMLTableCellElement5widthEv
--[DOMHTMLTableCellElement height]
-__ZNK7WebCore20HTMLTableCellElement6heightEv
--[DOMRange startOffset]
--[DOMCharacterData data]
--[DOMElement(WebPrivate) _font]
--[DOMRange endOffset]
--[WebCoreFrameBridge markupStringFromRange:nodes:]
-__ZN7WebCore27needInterchangeNewlineAfterERKNS_15VisiblePositionE
-__ZN7WebCore34convertHTMLTextToInterchangeFormatERKNS_16DeprecatedStringEPKNS_4TextE
-__ZN7WebCore16DeprecatedString6appendENS_14DeprecatedCharE
-__ZN7WebCore16DeprecatedString6insertEjNS_14DeprecatedCharE
-__ZNK7WebCore5Range4textEv
-__ZN7WebCore6Editor29didWriteSelectionToPasteboardEv
--[DOMCSSValue dealloc]
--[DOMRGBColor dealloc]
-__ZN7WebCore19removeWrapperForRGBEj
-__ZN7WebCore8Document6embedsEv
-__ZNK7WebCore17HTMLScriptElement4typeEv
-__ZNK7WebCore16HTMLQuoteElement17endTagRequirementEv
-__ZNK7WebCore16HTMLQuoteElement11tagPriorityEv
-__ZN7WebCore4KURL7setPortEt
--[DOMHTMLElement idName]
--[DOMHTMLElement className]
--[DOMNode previousSibling]
-__ZN7WebCore17HTMLAnchorElement12setAccessKeyERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE15reserveCapacityEm
-__ZN7WebCore9CSSParser16parseFontFaceSrcEv
-__ZN7WebCore9CSSParser18createFontFaceRuleEv
-__ZN7WebCore15CSSFontFaceRuleC1EPNS_9StyleBaseE
-__ZN7WebCore15CSSFontFaceRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
-__ZN7WebCore15CSSFontFaceRule14isFontFaceRuleEv
-__ZN7WebCore15CSSFontSelector15addFontFaceRuleEPKNS_15CSSFontFaceRuleE
-__ZNK7WebCore19CSSFontFaceSrcValue16isSVGFontFaceSrcEv
-__ZNK7WebCore19CSSFontFaceSrcValue17isSupportedFormatEv
-__ZNK7WebCore11CSSFontFace7isValidEv
-__ZN7WebCore11CSSFontFaceD1Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore17CSSFontFaceSourceELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore15CSSFontFaceRuleD1Ev
-__ZN7WebCore19CSSFontFaceSrcValueD1Ev
-__ZN7WebCore32jsNodePrototypeFunctionNormalizeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node9normalizeEv
-__ZN7WebCore21JSNodeListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSNodeListConstructor9classInfoEv
-__ZN7WebCore47jsHTMLInputElementBaseFunctionSetSelectionRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLLinkElement8setMediaERKNS_6StringE
-__ZNK7WebCore24JSHTMLElementConstructor21implementsHasInstanceEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLCanvasElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLCanvasElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionDrawImageEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D9drawImageEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEffffRi
-__ZN7WebCore4sizeEPNS_16HTMLImageElementE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementERKNS_9FloatRectES5_Ri
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4rectEffffRi
-__ZN7WebCore30newStreamingTextDecoderUTF16BEERKNS_12TextEncodingEPKv
-__ZN7WebCore38jsRangePrototypeFunctionSetStartBeforeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore37jsRangePrototypeFunctionSetStartAfterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range13setStartAfterEPNS_4NodeERi
-__ZNK3KJS6Plugin9classInfoEv
-__ZN7WebCore16HTMLInputElement6setSrcERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SA_EEEENS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore23JSHTMLBlockquoteElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore32jsRangePrototypeFunctionSetStartEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore34jsRangePrototypeFunctionInsertNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range10insertNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore4Text9splitTextEjRi
-__ZN7WebCore4Text9createNewEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore11RenderStyle13setCursorListEN3WTF10PassRefPtrINS_10CursorListEEE
-__ZN7WebCore7toRomanEib
-__ZN7WebCore16HTMLInputElement7setSizeEj
-__ZN7WebCore6String6numberEj
-__ZN7WebCore23HTMLTableRowsCollection7lastRowEPNS_16HTMLTableElementE
-__ZN7WebCore42jsDocumentPrototypeFunctionCreateAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document17createAttributeNSERKNS_6StringES3_Ri
-__ZN7WebCore6JSAttr3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore4Attr12setNodeValueERKNS_6StringERi
-__ZN7WebCore4Attr8setValueERKNS_6StringERi
-__ZN7WebCore4Attr16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore4Attr15childrenChangedEb
-__ZN7WebCore42jsElementPrototypeFunctionSetAttributeNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSElement16setAttributeNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore6toAttrEPN3KJS7JSValueERb
-__ZNK7WebCore6JSAttr9classInfoEv
-__ZN7WebCore7Element16setAttributeNodeEPNS_4AttrERi
-__ZN7WebCore12NamedAttrMap12setNamedItemEPNS_4NodeERi
-__ZNK7WebCore4Attr15isAttributeNodeEv
-__ZN7WebCore16JSHTMLPreElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore12HTMLDocument10designModeEv
-__ZN7WebCore42jsHTMLCollectionPrototypeFunctionNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16JSHTMLCollection9namedItemEPN3KJS9ExecStateERKNS1_4ListE
-__ZNK7WebCore8Document14defaultCharsetEv
-__ZN7WebCore21webFallbackFontFamilyEv
-__ZN7WebCore4Node11appendChildEN3WTF10PassRefPtrIS0_EERi
-__ZNK7WebCore16HTMLTableElement5tFootEv
-__ZNK7WebCore19HTMLTableRowElement8rowIndexEv
-__ZN7WebCore16DocumentFragment9cloneNodeEb
-__ZN7WebCore7Element9cloneNodeEb
-__ZN7WebCore7Element26copyNonAttributePropertiesEPKS0_
-__ZNK7WebCore9Attribute5cloneEb
-__ZN7WebCore35jsNamedNodeMapPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Attr6prefixEv
-__ZNK7WebCore4Attr9localNameEv
-__ZN7WebCore46jsNamedNodeMapPrototypeFunctionRemoveNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore43jsNamedNodeMapPrototypeFunctionSetNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21HTMLOptionsCollection13selectedIndexEv
-__ZN7WebCore20HTMLTableCellElement8setWidthERKNS_6StringE
-__ZN7WebCore11HTMLElement7setLangERKNS_6StringE
-__ZN7WebCore13CSSStyleSheet18determineNamespaceERKNS_12AtomicStringE
-__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
-__ZN7WebCore12IconDatabase14checkIntegrityEv
-_sqlite3VdbeAddOpList
-_sqlite3OpenTempDatabase
-_sqlite3BtreeIntegrityCheck
-_checkList
-_checkTreePage
-__ZN7WebCore32max_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore28device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZNK7WebCore12CDATASection8nodeNameEv
-__ZNK7WebCore11RenderTheme11systemColorEi
-__ZN7WebCore16JSHTMLDivElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore14HTMLDivElement8setAlignERKNS_6StringE
-__ZN7WebCore17HTMLAppletElement19removedFromDocumentEv
-__ZN7WebCore17HTMLObjectElement21renderFallbackContentEv
-__ZN7WebCore19JSHTMLCanvasElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLCanvasElement8setWidthEi
-__ZN7WebCore17HTMLCanvasElement9setHeightEi
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementERKNS_9FloatRectES5_Ri
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEffffRi
-__ZThn8_N7WebCore14XMLHttpRequest15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore14XMLHttpRequest15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZNK7WebCore16StyleMarqueeDataeqERKS0_
-__ZN7WebCore22HTMLGenericFormElement11setReadOnlyEb
-__ZN7WebCore12toAlphabeticEiPKti
-__ZNK7WebCore20HTMLFrameElementBase11frameBorderEv
-__ZN7WebCore20HTMLTableCellElement10setRowSpanEi
-__ZN7WebCore18JSHTMLOListElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLOListElement8setStartEi
-__ZN7WebCore9FrameView23removeSlowRepaintObjectEv
-__ZNK7WebCore16HTMLStyleElement8disabledEv
-__ZN3WTF6VectorIxLm0EE14expandCapacityEmPKx
-__ZN3WTF6VectorIxLm0EE14expandCapacityEm
-__ZN3WTF6VectorIxLm0EE15reserveCapacityEm
-__ZN3WTF6VectorIxLm0EE6shrinkEm
-__ZN7WebCore41jsHTMLSelectElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12DOMSelection8baseNodeEv
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection8toStringEv
-__ZN7WebCore13HTMLTokenizer11parseServerERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore21internalSubsetHandlerEPvPKhS2_S2_
-__ZN7WebCore12XMLTokenizer14internalSubsetEPKhS2_S2_
-__ZN7WebCore21externalSubsetHandlerEPvPKhS2_S2_
-__ZN7WebCore23JSProcessingInstructionC1EPN3KJS8JSObjectEPNS_21ProcessingInstructionE
-__ZN7WebCore23JSProcessingInstruction18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21ProcessingInstruction8nodeNameEv
-__ZNK7WebCore16HTMLInputElement9accessKeyEv
-__ZN7WebCore40jsDocumentPrototypeFunctionCreateCommentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document13createCommentERKNS_6StringE
-__ZN7WebCore10HTMLParser15popInlineBlocksEv
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE15reserveCapacityEm
-__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionInsertRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore23HTMLTableSectionElement9insertRowEiRi
-__ZN7WebCore7Comment9cloneNodeEb
-__ZN7WebCore17HTMLIFrameElement8setAlignERKNS_6StringE
-__ZN7WebCore17HTMLSelectElement14removeChildrenEv
-__ZNK3KJS27XSLTProcessorConstructorImp19implementsConstructEv
-__ZN3KJS27XSLTProcessorConstructorImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS15JSXSLTProcessorC1EPNS_8JSObjectE
-__ZN3KJS22XSLTProcessorPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS48jsXSLTProcessorPrototypeFunctionImportStylesheetEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS15JSXSLTProcessor9classInfoEv
-__ZN3KJS44jsXSLTProcessorPrototypeFunctionSetParameterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor12setParameterERKNS_6StringES3_S3_
-__ZN3KJS51jsXSLTProcessorPrototypeFunctionTransformToFragmentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor19transformToFragmentEPNS_4NodeEPNS_8DocumentE
-__ZN7WebCore13XSLTProcessor17transformToStringEPNS_4NodeERNS_6StringES4_S4_
-__Z21initxsltSetLoaderFuncPFP7_xmlDocPKhP8_xmlDictiPv12xsltLoadTypeE
-__ZN7WebCore13XSLStyleSheetC1EPNS_4NodeERKNS_6StringEb
-__ZZN7WebCore22shouldAddNamespaceAttrEPKNS_9AttributeERN3WTF7HashMapIPNS_16AtomicStringImplES6_NS3_7PtrHashIS6_EENS3_10HashTraitsIS6_EESA_EEE8xmlnsURI
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3getERKS3_
-__ZZN7WebCore15appendNamespaceERN3WTF6VectorItLm0EEERKNS_12AtomicStringES6_RNS0_7HashMapIPNS_16AtomicStringImplES9_NS0_7PtrHashIS9_EENS0_10HashTraitsIS9_EESD_EEE5xmlns
-__ZN7WebCore13XSLStyleSheet11parseStringERKNS_6StringEb
-__ZN7WebCore13XSLStyleSheet9docLoaderEv
-__ZN7WebCore27setLoaderForLibXMLCallbacksEPNS_9DocLoaderE
-__ZN7WebCore13XSLStyleSheet15loadChildSheetsEv
-__ZN7WebCore13XSLStyleSheet8documentEv
-__ZN7WebCore13XSLStyleSheet17compileStyleSheetEv
-__Z26initxsltParseStylesheetDocP7_xmlDoc
-__Z14libxsltLibraryv
-__ZN7WebCore13XSLStyleSheet14clearDocumentsEv
-__ZN7WebCore18xmlDocPtrForStringEPNS_9DocLoaderERKNS_6StringERKNS_16DeprecatedStringE
-__Z27initxsltNewTransformContextP15_xsltStylesheetP7_xmlDoc
-__ZN7WebCore22registerXSLTExtensionsEP21_xsltTransformContext
-__Z27initxsltRegisterExtFunctionP21_xsltTransformContextPKhS2_PFvP22_xmlXPathParserContextiE
-__Z23initxsltSetCtxtSortFuncP21_xsltTransformContextPFvS0_PP8_xmlNodeiE
-__Z23initxsltQuoteUserParamsP21_xsltTransformContextPPKc
-__Z27initxsltApplyStylesheetUserP15_xsltStylesheetP7_xmlDocPPKcS4_P7__sFILEP21_xsltTransformContext
-__Z28initxsltFreeTransformContextP21_xsltTransformContext
-__Z20initxsltSaveResultToP16_xmlOutputBufferP7_xmlDocP15_xsltStylesheet
-__ZN7WebCore13writeToVectorEPvPKci
-__ZN7WebCore6String8fromUTF8EPKcm
-__Z22initxsltFreeStylesheetP15_xsltStylesheet
-__ZN3KJS37jsXSLTProcessorPrototypeFunctionResetEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore8Document18setVisuallyOrderedEv
-__ZN7WebCore20HTMLTableCellElement9setHeightERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement14defaultCheckedEv
-__ZN7WebCore16HTMLInputElement17setDefaultCheckedEb
-__ZN7WebCore29JSHTMLUListElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLUListElementConstructor9classInfoEv
-__ZN7WebCore16HTMLStyleElement11setDisabledEb
-__ZN7WebCore20parseMediaDescriptorERKNS_6StringE
-__ZN7WebCore17decodeNamedEntityEPKc
-__ZN7WebCore19HTMLOptGroupElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN3KJS17staticValueGetterIN7WebCore18JSDOMCoreExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSDOMCoreException16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23resetButtonDefaultLabelEv
-__ZNK7WebCore11ShadowValue7cssTextEv
-__ZNK7WebCore17HTMLObjectElement6vspaceEv
-__ZNK7WebCore17HTMLObjectElement6hspaceEv
-__ZN7WebCore26NetscapePlugInStreamLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore42jsHTMLSelectElementPrototypeFunctionRemoveEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19JSHTMLSelectElement6removeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore13toHTMLElementEPN3KJS7JSValueE
-__ZNK7WebCore16HTMLImageElement1xEv
-__ZNK7WebCore16HTMLImageElement1yEv
-__ZN7WebCore12XMLTokenizer11stopParsingEv
-__ZNK7WebCore9Tokenizer14processingDataEv
-__ZN7WebCore17JSHTMLMenuElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore17JSHTMLMenuElement9classInfoEv
-__ZNK7WebCore9FrameTree3topEv
-__ZN7WebCore14JSHTMLDocument6setAllEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore10RenderFlow19paintOutlineForLineEPNS_15GraphicsContextEiiRKNS_7IntRectES5_S5_
-__ZNK7WebCore19JSHTMLAppletElement9classInfoEv
-__ZN7WebCore9Tokenizer11stopParsingEv
-__ZN7WebCore15HTMLLinkElement10setCharsetERKNS_6StringE
-__ZN7WebCore12XMLTokenizer12pauseParsingEv
-__ZThn8_N7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore12XMLTokenizer13resumeParsingEv
-__ZN7WebCore16PendingCallbacks25PendingCharactersCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore17DeprecatedPtrListINS_16PendingCallbacks15PendingCallbackEE10deleteFuncEPv
-__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore8Document13createElementERKNS_6StringERi
-__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore24CanvasRenderingContext2D5resetEv
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE6resizeEm
-__ZN7WebCore12HTMLDocument3dirEv
-__ZN7WebCore43jsMouseEventPrototypeFunctionInitMouseEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11toDOMWindowEPN3KJS7JSValueE
-__ZN7WebCore17toEventTargetNodeEPN3KJS7JSValueE
-__ZN7WebCore10MouseEvent14initMouseEventERKNS_12AtomicStringEbbPNS_9DOMWindowEiiiiibbbbtPNS_15EventTargetNodeE
-__ZN7WebCore7UIEvent11initUIEventERKNS_12AtomicStringEbbPNS_9DOMWindowEi
-__ZN7WebCore17MouseRelatedEvent15initCoordinatesEii
-__ZN7WebCore43jsCharacterDataPrototypeFunctionReplaceDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13CharacterData11replaceDataEjjRKNS_6StringERi
-__ZN7WebCore25max_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore39jsHTMLSelectElementPrototypeFunctionAddEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLBodyElement13setBackgroundERKNS_6StringE
-__ZN7WebCore16PendingCallbacks22PendingCommentCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore24parseXMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentEPNS_7ElementE
-__ZN7WebCore12XMLTokenizerC1EPNS_16DocumentFragmentEPNS_7ElementE
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEmPKS3_
-__ZN7WebCore29balancedStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore25balancedCharactersHandlerEPvPKhi
-__ZN7WebCore27balancedEndElementNsHandlerEPvPKhS2_S2_
-__ZN7WebCore17HTMLAnchorElement6setRelERKNS_6StringE
-__ZN7WebCore7CSSRule6isRuleEv
-__ZN7WebCore9StyleBase13isCharsetRuleEv
-__ZNK7WebCore26JSXMLSerializerConstructor19implementsConstructEv
-__ZN7WebCore26JSXMLSerializerConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_13XMLSerializerE
-__ZN7WebCore15JSXMLSerializerC1EPN3KJS8JSObjectEPNS_13XMLSerializerE
-__ZN7WebCore15JSXMLSerializer18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSXMLSerializerPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore49jsXMLSerializerPrototypeFunctionSerializeToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore15JSXMLSerializer9classInfoEv
-__ZN7WebCore13XMLSerializer17serializeToStringEPNS_4NodeERi
-__ZN7WebCore27JSHTMLFrameElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLObjectElementPrototype9classInfoEv
-__ZNK7WebCore17HTMLObjectElement4dataEv
-__ZNK7WebCore17HTMLObjectElement8codeBaseEv
-__ZNK7WebCore17HTMLObjectElement4codeEv
-__ZNK7WebCore17HTMLObjectElement7archiveEv
-__ZNK7WebCore17HTMLObjectElement8codeTypeEv
-__ZNK7WebCore17HTMLObjectElement7declareEv
-__ZNK7WebCore17HTMLObjectElement7standbyEv
-__ZNK7WebCore17HTMLObjectElement6borderEv
-__ZNK7WebCore17HTMLPlugInElement5alignEv
-__ZNK7WebCore17HTMLObjectElement6useMapEv
-__ZN7WebCore20HTMLTableCellElement9setNoWrapEb
-__ZN3KJS17staticValueGetterIN7WebCore23JSHTMLBlockquoteElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSHTMLBlockquoteElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16JSStyleSheetList18canGetItemsForNameEPN3KJS9ExecStateEPNS_14StyleSheetListERKNS1_10IdentifierE
-__ZNK7WebCore14StyleSheetList12getNamedItemERKNS_6StringE
-__ZN7WebCore16JSStyleSheetList10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore37jsHTMLCollectionPrototypeFunctionTagsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14HTMLCollection4tagsERKNS_6StringE
-__ZN7WebCore42jsDOMSelectionPrototypeFunctionSetPositionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection11setPositionEPNS_4NodeEiRi
-__ZN7WebCore13executeDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore37jsDOMSelectionPrototypeFunctionModifyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection6modifyERKNS_6StringES3_S3_
-__ZN7WebCore19SelectionController27modifyExtendingRightForwardENS_15TextGranularityE
-__ZN7WebCore16nextLinePositionERKNS_15VisiblePositionEi
-__ZNK7WebCore4Node12nextEditableEi
-__ZN7WebCore14isEditableLeafEPNS_9InlineBoxE
-__ZN7WebCore15isTableRowEmptyEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand22insertBlockPlaceholderERKNS_8PositionE
-__ZN7WebCore23ReplaceSelectionCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
-__ZN7WebCore17executeInsertTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20setJSNodeOndragstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOndragstartEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL17executeInsertTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringEbb
+__ZN7WebCore20CompositeEditCommand19removePlaceholderAtERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand23breakOutOfEmptyListItemEv
+__ZN7WebCore22enclosingEmptyListItemERKNS_15VisiblePositionE
+__ZN7WebCore18enclosingListChildEPNS_4NodeE
+__ZN7WebCore13isListElementEPNS_4NodeE
+__ZN7WebCore13TypingCommand21makeEditableRootEmptyEv
+__ZNK7WebCore7Element17firstElementChildEv
+__ZN7WebCore37jsDOMSelectionPrototypeFunctionModifyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection6modifyERKNS_6StringES3_S3_
+__ZN7WebCore19SelectionController19modifyMovingForwardENS_15TextGranularityE
+__ZN7WebCore19SelectionController22modifyExtendingForwardENS_15TextGranularityE
 __ZN7WebCore16nextWordPositionERKNS_15VisiblePositionE
-__ZN7WebCore24nextWordPositionBoundaryEPKtj
+__ZN7WebCoreL24nextWordPositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
 __ZN7WebCore21findNextWordFromIndexEPKtiib
-__ZN7WebCore11StyleChange29checkForLegacyHTMLStyleChangeEPKNS_11CSSPropertyE
-__ZN7WebCore9CSSParser25parseFontFaceUnicodeRangeEv
-__ZN7WebCore9FontCache10fontExistsERKNS_15FontDescriptionERKNS_12AtomicStringE
-__ZN7WebCore17CSSFontFaceSourceC1ERKNS_6StringEPNS_10CachedFontE
-__ZN7WebCore11CSSFontFace9addSourceEPNS_17CSSFontFaceSourceE
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE15reserveCapacityEm
-__ZNK7WebCore17CSSFontFaceSource7isValidEv
-__ZN7WebCore20CSSSegmentedFontFaceC1EPNS_15CSSFontSelectorE
-__ZN7WebCore20CSSSegmentedFontFace12overlayRangeEiiN3WTF10PassRefPtrINS_11CSSFontFaceEEE
-__ZN7WebCore20CSSSegmentedFontFace10pruneTableEv
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm8EEC1ILm1EEERKNS0_IS2_XT_EEE
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm8EE6shrinkEm
-__ZN7WebCore20CSSSegmentedFontFace11getFontDataERKNS_15FontDescriptionEbb
-__ZNK7WebCore20CSSSegmentedFontFace7isValidEv
-__ZN3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
-__ZN7WebCore11CSSFontFace11getFontDataERKNS_15FontDescriptionEbb
-__ZN7WebCore17CSSFontFaceSource11getFontDataERKNS_15FontDescriptionEbbPNS_15CSSFontSelectorE
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE15reserveCapacityEm
-__ZNK7WebCore17SegmentedFontData9isLoadingEv
-__ZNK7WebCore17SegmentedFontData11isSegmentedEv
-__ZNK7WebCore17SegmentedFontData20fontDataForCharacterEi
-__ZNK7WebCore17SegmentedFontData12isCustomFontEv
-__ZN7WebCore40firstEditablePositionAfterPositionInRootERKNS_8PositionEPNS_4NodeE
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionAddRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7toRangeEPN3KJS7JSValueE
-__ZN7WebCore12DOMSelection8addRangeEPNS_5RangeE
+__ZN7WebCore11RenderBlock26fillHorizontalSelectionGapEPNS_12RenderObjectEiiiiPKNS1_9PaintInfoE
+__ZN7WebCoreL12nodePositionEPNS_4NodeE
+__ZN7WebCore6String6numberEj
+__ZN7WebCore4Node16shadowParentNodeEv
+__ZN7WebCore47jsDOMSelectionPrototypeFunctionSetBaseAndExtentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection16setBaseAndExtentEPNS_4NodeEiS2_iRi
+__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionES3_b
+__ZNK7WebCore6Editor25shouldShowDeleteInterfaceEPNS_11HTMLElementE
 __ZN7WebCore21nextParagraphPositionERKNS_15VisiblePositionEi
+__ZN7WebCore16nextLinePositionERKNS_15VisiblePositionEi
+__ZN7WebCoreL27nextLeafWithSameEditabilityEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand15insertNodeAfterEN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore11RenderBlock21fillRightSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
+__ZN7WebCore11RenderBlock24fillVerticalSelectionGapEiiiiPS0_iiPKNS_12RenderObject9PaintInfoE
+__ZN7WebCore11RenderBlock20fillLeftSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
+__ZN7WebCore20setJSDOMWindowParentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore25previousParagraphPositionERKNS_15VisiblePositionEi
-__ZN7WebCore20previousLinePositionERKNS_15VisiblePositionEi
 __ZN7WebCore15inSameParagraphERKNS_15VisiblePositionES2_
-__ZN7WebCore11enabledUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore8RenderBR23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore11StyleChange29checkForLegacyHTMLStyleChangeEPKNS_11CSSPropertyE
+__ZN7WebCore22createStyleSpanElementEPNS_8DocumentE
+__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_13QualifiedNameE
+__ZN7WebCore17ApplyStyleCommand28surroundNodeRangeWithElementEPNS_4NodeES2_N3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore23ReplaceSelectionCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
+__ZN7WebCore16VisibleSelection27selectionFromContentsOfNodeEPNS_4NodeE
+__ZN7WebCoreL16executeSelectAllEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore19SelectionController9selectAllEv
+__ZNK7WebCore4Node12canSelectAllEv
+__ZNK7WebCore8Position19isRenderedCharacterEv
+__ZN7WebCore22nonBreakingSpaceStringEv
+__ZN7WebCore20CompositeEditCommand17replaceTextInNodeEN3WTF10PassRefPtrINS_4TextEEEjjRKNS_6StringE
+__ZN7WebCore23ReplaceSelectionCommand16handleStyleSpansEv
+__ZN7WebCore20CompositeEditCommand16setNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommandC1EN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommandC2EN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommand7doApplyEv
+__ZN7WebCore40firstEditablePositionAfterPositionInRootERKNS_8PositionEPNS_4NodeE
+__ZN7WebCore23SetNodeAttributeCommandD0Ev
+__ZN7WebCore12startOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore30jsRangePrototypeFunctionSetEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionAddRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7toRangeEN3JSC7JSValueE
+__ZN7WebCore12DOMSelection8addRangeEPNS_5RangeE
+__ZN7WebCoreL32elementHasTextDecorationPropertyEPKNS_4NodeE
+__ZN7WebCoreL34styleFromMatchedRulesAndInlineDeclEPKNS_4NodeE
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore12RenderInline12paintOutlineEPNS_15GraphicsContextEii
+__ZN7WebCore12RenderInline17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCoreL15isTableRowEmptyEPNS_4NodeE
+__ZN7WebCore9CSSParser25parseFontFaceUnicodeRangeEv
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIjLm0EE14expandCapacityEm
+__ZN3WTF6VectorIjLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIjLm0EE6shrinkEm
+__ZSt25__unguarded_linear_insertIPPN7WebCore11CSSFontFaceES2_PFbS2_S2_EEvT_T0_T1_
+__ZN7WebCore19SelectionController20modifyMovingBackwardENS_15TextGranularityE
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE6shrinkEm
+__ZN7WebCore20CSSUnicodeRangeValueD0Ev
+__ZN7WebCore27setJSHTMLDocumentDesignModeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument13setDesignModeERKNS_6StringE
+__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
+__ZN7WebCore52jsHTMLInputElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSHTMLInputElement17setSelectionRangeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore16HTMLInputElement17setSelectionRangeEii
+__ZN7WebCoreL17executeCreateLinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17CreateLinkCommandC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore17CreateLinkCommandC2EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore17CreateLinkCommand7doApplyEv
+__ZN7WebCore17HTMLAnchorElementC1EPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElementC2EPNS_8DocumentE
+__ZNK7WebCore11EditCommand15isTypingCommandEv
+__ZNK7WebCore11EditCommand20preservesTypingStyleEv
+__ZNK7WebCore17CreateLinkCommand13editingActionEv
+__ZNK7WebCore17RenderTextControl10renderNameEv
+__ZN7WebCore17CreateLinkCommandD0Ev
+__ZN7WebCore20CompositeEditCommand22insertBlockPlaceholderERKNS_8PositionE
+__ZN7WebCore29createBlockPlaceholderElementEPNS_8DocumentE
+__ZN7WebCore6Editor16shouldEndEditingEPNS_5RangeE
+__ZN7WebCoreL25executeDeleteWordBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20previousWordPositionERKNS_15VisiblePositionE
+__ZN7WebCoreL28previousWordPositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore6Editor13addToKillRingEPNS_5RangeEb
+__ZN7WebCore6Editor24startNewKillRingSequenceEv
+__ZN7WebCoreL26initializeKillRingIfNeededEv
+__ZN7WebCore6Editor16appendToKillRingERKNS_6StringE
+__ZN7WebCore22DeleteButtonController16createDeletionUIEv
+__ZN7WebCore12DeleteButtonC1EPNS_8DocumentE
+__ZN7WebCore12DeleteButtonC2EPNS_8DocumentE
+__ZN7WebCore11CachedImageC1EPNS_5ImageE
+__ZN7WebCore11CachedImageC2EPNS_5ImageE
+__ZN7WebCore11ImageLoader8setImageEPNS_11CachedImageE
+__ZN7WebCore33jsDOMWindowPrototypeFunctionAlertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5alertERKNS_6StringE
+__ZN7WebCore6Chrome18runJavaScriptAlertEPNS_5FrameERKNS_6StringE
+__ZN7WebCore21PageGroupLoadDeferrerC1EPNS_4PageEb
+__ZN7WebCore21PageGroupLoadDeferrerC2EPNS_4PageEb
+__ZN7WebCore21PageGroupLoadDeferrerD1Ev
+__ZN7WebCore21PageGroupLoadDeferrerD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE6shrinkEm
+__ZN7WebCore12DeleteButton19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore22DeleteButtonController12deleteTargetEv
+__ZN7WebCore12EventHandler24scheduleHoverStateUpdateEv
+__ZNK7WebCore11EditCommand13editingActionEv
+__ZN7WebCore12RenderObject17setSelectionStateENS0_14SelectionStateE
+__ZN7WebCore12RenderObject23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
++[WebUndefined undefined]
++[WebUndefined allocWithZone:]
+-[WebScriptObject valueForKey:]
+-[WebScriptObject _originRootObject]
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE14shrinkCapacityEm
+__ZN7WebCore23ReplaceSelectionCommand28removeNodePreservingChildrenEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand28removeNodePreservingChildrenEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommandC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommand7doApplyEv
+__ZN7WebCore35RemoveNodePreservingChildrenCommandD0Ev
+__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
+__ZN3WTF6VectorIN7WebCore18TextCheckingResultELm0EE6shrinkEm
+__ZN7WebCoreeqERKNS_5RangeES2_
+__ZN7WebCore13InlineTextBox28paintSpellingOrGrammarMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4F
+__ZN7WebCore15GraphicsContext34drawLineForMisspellingOrBadGrammarERKNS_8IntPointEib
+__ZN7WebCoreL18createPatternColorEP8NSStringP7NSColorRb
+__ZN7WebCoreL22executeInsertParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand24insertParagraphSeparatorEPNS_8DocumentE
+__ZN7WebCore13TypingCommand24insertParagraphSeparatorEv
+__ZN7WebCore31InsertParagraphSeparatorCommandC1EPNS_8DocumentEb
+__ZN7WebCore31InsertParagraphSeparatorCommandC2EPNS_8DocumentEb
+__ZN7WebCore31InsertParagraphSeparatorCommand7doApplyEv
+__ZN7WebCore31InsertParagraphSeparatorCommand29calculateStyleBeforeInsertionERKNS_8PositionE
+__ZNK7WebCore31InsertParagraphSeparatorCommand32shouldUseDefaultParagraphElementEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand22appendBlockPlaceholderEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore31InsertParagraphSeparatorCommand24applyStyleAfterInsertionEPNS_4NodeE
+__ZN7WebCore31InsertParagraphSeparatorCommandD0Ev
+__ZN7WebCore30setJSHTMLOptionElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL17createFontElementEPNS_8DocumentE
+__ZN7WebCoreL35executeInsertNewlineInQuotedContentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
+__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEv
+__ZN7WebCore22BreakBlockquoteCommandC1EPNS_8DocumentE
+__ZN7WebCore22BreakBlockquoteCommandC2EPNS_8DocumentE
+__ZN7WebCore22BreakBlockquoteCommand7doApplyEv
+__ZN7WebCore28isFirstVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
+__ZN7WebCore27isLastVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
+__ZN7WebCore20CompositeEditCommand19rebalanceWhitespaceEv
+__ZN7WebCore22BreakBlockquoteCommandD0Ev
+__ZN7WebCoreL11enabledUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCore6Editor7canUndoEv
-__ZN7WebCore11executeUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL11executeUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor4undoEv
 __ZN7WebCore11EditCommand7unapplyEv
 __ZN7WebCore20CompositeEditCommand9doUnapplyEv
-__ZN7WebCore17RemoveNodeCommand9doUnapplyEv
-__ZN7WebCore6Editor16unappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore23InsertNodeBeforeCommand9doUnapplyEv
-__ZN7WebCore17AppendNodeCommand9doUnapplyEv
 __ZN7WebCore25DeleteFromTextNodeCommand9doUnapplyEv
+__ZN7WebCore6Editor16unappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore26setJSHTMLTableElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement8setAlignERKNS_6StringE
+__ZNK7WebCore9RenderBox19lastLineBoxBaselineEv
+__ZN7WebCore20CompositeEditCommand27addBlockPlaceholderIfNeededEPNS_7ElementE
+__ZN7WebCoreL20executeForwardDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedENS_15TextGranularityEb
+__ZN7WebCore16VisibleSelectionD2Ev
+__ZN7WebCoreL28fontSizeChangesComputedStyleEPNS_11RenderStyleENS_11StyleChangeE
+__ZN7WebCore15createJSWrapperEPN3JSC8JSObjectEN3WTF10PassRefPtrINS0_8Bindings10RootObjectEEES7_
+__ZN7WebCore12getJSWrapperEPN3JSC8JSObjectE
+-[WebScriptObject _initWithJSObject:originRootObject:rootObject:]
+-[WebScriptObject webScriptValueAtIndex:]
 __ZN7WebCore25InsertIntoTextNodeCommand9doUnapplyEv
-__ZN7WebCore23SetNodeAttributeCommand9doUnapplyEv
-__ZN7WebCore35executeInsertNewlineInQuotedContentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
-__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEv
-__ZN7WebCore22BreakBlockquoteCommandC2EPNS_8DocumentE
-__ZN7WebCore22BreakBlockquoteCommand7doApplyEv
-__ZN7WebCore27isLastVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
-__ZN7WebCore20executeForwardDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityE
-__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedENS_15TextGranularityE
-__ZN7WebCore31SimplifiedBackwardsTextIterator21handleReplacedElementEv
+__ZN7WebCoreL18marqueeConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore18HTMLMarqueeElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18HTMLMarqueeElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18HTMLMarqueeElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore18HTMLMarqueeElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL31createHTMLMarqueeElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLMarqueeElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLMarqueeElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLMarqueeElementEEE
+__ZN7WebCore20JSHTMLMarqueeElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLMarqueeElementEEE
+__ZNK7WebCore18HTMLMarqueeElement17endTagRequirementEv
+__ZNK7WebCore18HTMLMarqueeElement11tagPriorityEv
+__ZN7WebCore16StyleMarqueeDataC1ERKS0_
+__ZN7WebCore16StyleMarqueeDataC2ERKS0_
+__ZN7WebCore13RenderMarqueeC1EPNS_11RenderLayerE
+__ZN7WebCore13RenderMarqueeC2EPNS_11RenderLayerE
+__ZN7WebCore13RenderMarquee18updateMarqueeStyleEv
+__ZNK7WebCore13RenderMarquee12isHorizontalEv
+__ZNK7WebCore13RenderMarquee9directionEv
+__ZNK7WebCore13RenderMarquee12marqueeSpeedEv
+__ZN7WebCore13RenderMarquee21updateMarqueePositionEv
+__ZN7WebCore13RenderMarquee15computePositionENS_17EMarqueeDirectionEb
+__ZN7WebCore13RenderMarquee5startEv
+__ZN7WebCore5TimerINS_13RenderMarqueeEE5firedEv
+__ZN7WebCore13RenderMarquee10timerFiredEPNS_5TimerIS0_EE
+__ZThn112_NK7WebCore18HTMLMarqueeElement10canSuspendEv
+__ZNK7WebCore18HTMLMarqueeElement10canSuspendEv
+__ZThn112_N7WebCore18HTMLMarqueeElement4stopEv
+__ZN7WebCore18HTMLMarqueeElement4stopEv
+__ZN7WebCore13RenderMarquee4stopEv
+__ZN7WebCore20JSHTMLMarqueeElementD1Ev
+__ZN7WebCore29JSHTMLMarqueeElementPrototypeD1Ev
+__ZN7WebCore18HTMLMarqueeElementD0Ev
+__ZNK7WebCore4Font27selectionRectForComplexTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZN7WebCore26RenderTextControlMultiLine17subtreeHasChangedEv
+__ZN7WebCore5Frame23textDidChangeInTextAreaEPNS_7ElementE
+__Z3kitPN7WebCore19HTMLTextAreaElementE
+__ZN7WebCore8Position42uncheckedPreviousOffsetForBackwardDeletionEPKNS_4NodeEi
+__ZNK7WebCore10RenderText33previousOffsetForBackwardDeletionEi
+__ZN7WebCore40lastEditablePositionBeforePositionInRootERKNS_8PositionEPNS_4NodeE
+__ZNK7WebCore16RenderListMarker18canBeSelectionLeafEv
+__ZN7WebCore16RenderListMarker17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZN7WebCore16RenderListMarker23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
 __ZN7WebCore17InsertTextCommand9insertTabERKNS_8PositionE
 __ZN7WebCore20createTabSpanElementEPNS_8DocumentE
 __ZN7WebCore20createTabSpanElementEPNS_8DocumentEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore11tabSpanNodeEPKNS_4NodeE
-__ZN7WebCore25enableCaretInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore16executeTransposeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20CompositeEditCommand13splitTextNodeEN3WTF10PassRefPtrINS_4TextEEEj
+__ZN7WebCore20SplitTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore20SplitTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore20SplitTextNodeCommand7doApplyEv
+__ZN7WebCore8Document11copyMarkersEPNS_4NodeEjiS2_iNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore20SplitTextNodeCommandD0Ev
+__ZN7WebCoreL22executeInsertLineBreakEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand15insertLineBreakEPNS_8DocumentE
+__ZN7WebCore13TypingCommand15insertLineBreakEv
+__ZN7WebCore22InsertLineBreakCommandC1EPNS_8DocumentE
+__ZN7WebCore22InsertLineBreakCommandC2EPNS_8DocumentE
+__ZN7WebCore22InsertLineBreakCommand7doApplyEv
+__ZN7WebCore22InsertLineBreakCommand21shouldUseBreakElementERKNS_8PositionE
+__ZN7WebCore22InsertLineBreakCommandD0Ev
+__ZN7WebCoreL29executeDeleteToEndOfParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore21createListItemElementEPNS_8DocumentE
+__ZN7WebCore39jsDocumentPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8Document12getSelectionEv
+__ZN7WebCore48jsDOMSelectionPrototypeFunctionSelectAllChildrenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection17selectAllChildrenEPNS_4NodeERi
+__ZN7WebCore44jsDOMSelectionPrototypeFunctionCollapseToEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection13collapseToEndEv
+__ZN7WebCore38jsRangePrototypeFunctionSetStartBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore35jsRangePrototypeFunctionSetEndAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL20executeDeleteForwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore36jsDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL25enableCaretInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL16executeTransposeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor9transposeEv
-__ZN7WebCore20SplitTextNodeCommand9doUnapplyEv
-__ZN7WebCore22executeInsertLineBreakEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore22executeInsertParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20CSSSegmentedFontFaceD1Ev
-__ZN7WebCore17CSSFontFaceSource10pruneTableEv
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE6shrinkEm
-__ZN7WebCore17GlyphPageTreeNode23pruneTreeCustomFontDataEPKNS_8FontDataE
-__ZN7WebCore17GlyphPageTreeNode19pruneCustomFontDataEPKNS_8FontDataE
-__ZN7WebCore17GlyphPageTreeNodeD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17GlyphPageTreeNodeEKNS_7HashMapIPKNS1_8FontDataES3_NS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSA_IS3_EEEEEEvRT0_
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17SegmentedFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEvRT0_
-__ZN7WebCore17SegmentedFontDataD1Ev
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE6shrinkEm
-__ZN7WebCore20CSSUnicodeRangeValueD1Ev
-__ZN7WebCore20startOfNextParagraphERKNS_15VisiblePositionE
-__ZN7WebCore27executeInsertHorizontalRuleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17executeInsertNodeEPNS_5FrameEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore21executeInsertFragmentEPNS_5FrameEN3WTF10PassRefPtrINS_16DocumentFragmentEEE
-__ZNK7WebCore14ClipboardEvent16isClipboardEventEv
-__ZNK7WebCore14ClipboardEvent9clipboardEv
-__ZN7WebCore20JSClipboardPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore11JSClipboardC1EPN3KJS8JSObjectEPNS_9ClipboardE
-__ZN7WebCore11JSClipboard18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSClipboardPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35jsClipboardPrototypeFunctionSetDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore11JSClipboard9classInfoEv
-__ZN7WebCore12ClipboardMac7setDataERKNS_6StringES3_
-__ZN7WebCore21cocoaTypeFromMIMETypeERKNS_6StringE
-__ZN7WebCore14supportedPasteEPNS_5FrameENS_19EditorCommandSourceE
-__ZN7WebCore14executeOutdentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore16logicalEndOfLineERKNS_15VisiblePositionE
+__ZN7WebCoreL26getLeafBoxesInLogicalOrderEPNS_13RootInlineBoxERN3WTF6VectorIPNS_9InlineBoxELm0EEE
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE6shrinkEm
+__ZN7WebCore17inSameLogicalLineERKNS_15VisiblePositionES2_
+__ZN7WebCore18logicalStartOfLineERKNS_15VisiblePositionE
+__ZN7WebCore32jsDOMWindowPrototypeFunctionFindEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow4findERKNS_6StringEbbbbbb
+__ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
+__ZNK7WebCore16VisibleSelection18shadowTreeRootNodeEv
+__ZN7WebCoreL20executeJustifyCenterEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL26executeApplyParagraphStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
+__ZN7WebCore6Editor19applyParagraphStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore17ApplyStyleCommand15applyBlockStyleEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore20CompositeEditCommand42moveParagraphContentsToNewBlockIfNecessaryERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand34insertNewDefaultParagraphElementAtERKNS_8PositionE
+__ZN7WebCore17ApplyStyleCommand13addBlockStyleERKNS_11StyleChangeEPNS_11HTMLElementE
+__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
+__ZNK7WebCore17ApplyStyleCommand13editingActionEv
+__ZN7WebCoreL16executeBackColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeApplyStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
+__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore5Frame24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCoreL13executeIndentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20IndentOutdentCommandC1EPNS_8DocumentENS0_11EIndentTypeEi
 __ZN7WebCore20IndentOutdentCommandC2EPNS_8DocumentENS0_11EIndentTypeEi
 __ZN7WebCore20IndentOutdentCommand7doApplyEv
-__ZN7WebCore20IndentOutdentCommand13outdentRegionEv
-__ZN7WebCore20IndentOutdentCommand16outdentParagraphEv
-__ZN7WebCore24isListOrIndentBlockquoteEPKNS_4NodeE
-__ZN7WebCore18isIndentBlockquoteEPKNS_4NodeE
-__ZNK7WebCore20IndentOutdentCommand13editingActionEv
+__ZN7WebCore20IndentOutdentCommand12indentRegionEv
+__ZN7WebCore30selectionForParagraphIterationERKNS_16VisibleSelectionE
+__ZN7WebCore23indexForVisiblePositionERNS_15VisiblePositionE
+__ZN7WebCore13enclosingListEPNS_4NodeE
+__ZN7WebCoreL29createIndentBlockquoteElementEPNS_8DocumentE
+__ZN7WebCoreL22indentBlockquoteStringEv
 __ZN7WebCore20CompositeEditCommand15splitTreeToNodeEPNS_4NodeES2_b
-__ZN7WebCore20CompositeEditCommand12splitElementEPNS_7ElementEPNS_4NodeE
-__ZN7WebCore19SplitElementCommandC2EPNS_7ElementEPNS_4NodeE
-__ZN7WebCore19SplitElementCommand7doApplyEv
-__ZN7WebCore17InsertListCommand20fixOrphanedListChildEPNS_4NodeE
-__ZN7WebCore22indentBlockquoteStringEv
+__ZN7WebCore20IndentOutdentCommand34prepareBlockquoteLevelForInsertionERNS_15VisiblePositionERN3WTF6RefPtrINS_7ElementEEE
+__ZN7WebCoreL18isIndentBlockquoteEPKNS_4NodeE
+__ZNK7WebCore20IndentOutdentCommand20preservesTypingStyleEv
+__ZNK7WebCore20IndentOutdentCommand13editingActionEv
+__ZN7WebCore20IndentOutdentCommandD0Ev
+__ZN7WebCoreL18executeFormatBlockEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13validBlockTagERKNS_6StringE
+__ZN7WebCore18FormatBlockCommandC1EPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18FormatBlockCommandC2EPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18FormatBlockCommand7doApplyEv
+__ZN7WebCore18FormatBlockCommand11modifyRangeEv
 __ZN7WebCore25enclosingBlockFlowElementERKNS_15VisiblePositionE
-__ZN7WebCore26enabledRangeInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore19executeRemoveFormatEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationERKNS_8PositionES5_NS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLeve
+__ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLeve
+__ZNK7WebCore18FormatBlockCommand13editingActionEv
+__ZN7WebCore18FormatBlockCommandD0Ev
+__ZN7WebCoreL26enabledRangeInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL19executeRemoveFormatEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor24removeFormattingAndStyleEv
 __ZN7WebCore19RemoveFormatCommandC1EPNS_8DocumentE
+__ZN7WebCore19RemoveFormatCommandC2EPNS_8DocumentE
 __ZN7WebCore19RemoveFormatCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand9inputTextERKNS_6StringEb
 __ZNK7WebCore19RemoveFormatCommand13editingActionEv
-__ZN7WebCore39jsRangePrototypeFunctionExtractContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range15extractContentsERi
-__ZN7WebCore18executeFormatBlockEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13validBlockTagERKNS_6StringE
-__ZN7WebCore18FormatBlockCommandC2EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore18FormatBlockCommand7doApplyEv
-__ZN7WebCore13createElementEPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore18FormatBlockCommand13editingActionEv
-__ZN7WebCore13executeIndentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20IndentOutdentCommand12indentRegionEv
-__ZN7WebCore23indexForVisiblePositionERNS_15VisiblePositionE
-__ZN7WebCore29createIndentBlockquoteElementEPNS_8DocumentE
-__ZN7WebCore20IndentOutdentCommand34prepareBlockquoteLevelForInsertionERNS_15VisiblePositionEPPNS_4NodeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE15reserveCapacityEm
-__ZN7WebCore17executeInsertHTMLEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore23ReplaceSelectionCommand37insertNodeAfterAndUpdateNodesInsertedEPNS_4NodeES2_
+__ZN7WebCore19RemoveFormatCommandD0Ev
+__ZN7WebCore20CompositeEditCommand39pushPartiallySelectedAnchorElementsDownEv
+__ZN7WebCore20CompositeEditCommand18applyStyledElementEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore17ApplyStyleCommandC1EN3WTF10PassRefPtrINS_7ElementEEEbNS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC2EN3WTF10PassRefPtrINS_7ElementEEEbNS_10EditActionE
+__ZN7WebCoreL26executeInsertUnorderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17InsertListCommandC1EPNS_8DocumentENS0_4TypeE
+__ZN7WebCore17InsertListCommandC2EPNS_8DocumentENS0_4TypeE
+__ZN7WebCore17InsertListCommand7doApplyEv
+__ZN7WebCore22outermostEnclosingListEPNS_4NodeE
+__ZN7WebCore18enclosingTableCellERKNS_8PositionE
+__ZN7WebCore26createUnorderedListElementEPNS_8DocumentE
+__ZNK7WebCore17InsertListCommand20preservesTypingStyleEv
+__ZNK7WebCore17InsertListCommand13editingActionEv
+__ZN7WebCoreL17executeToggleBoldEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL18executeToggleStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiPKcS5_
+__ZNK7WebCore6Editor22selectionStartHasStyleEPNS_19CSSStyleDeclarationE
+__ZN7WebCoreL14executeOutdentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20IndentOutdentCommand13outdentRegionEv
+__ZN7WebCore20IndentOutdentCommand16outdentParagraphEv
+__ZN7WebCoreL24isListOrIndentBlockquoteEPKNS_4NodeE
+__ZN7WebCore17InsertListCommandD0Ev
+__ZN7WebCore32jsDOMWindowPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow4blurEv
+__ZN7WebCore5Frame13unfocusWindowEv
+__ZNK7WebCore6Chrome7unfocusEv
+__ZN7WebCore11inSameBlockERKNS_15VisiblePositionES2_
+__ZN7WebCore8Position12moveToOffsetEi
+__ZN7WebCore20CompositeEditCommand30splitTextNodeContainingElementEN3WTF10PassRefPtrINS_4TextEEEj
+__ZN7WebCore37SplitTextNodeContainingElementCommandC1EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore37SplitTextNodeContainingElementCommandC2EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore37SplitTextNodeContainingElementCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand23wrapContentsInDummySpanEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommandC1EN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommandC2EN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand12splitElementEN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommandC2EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommand7doApplyEv
+__ZN7WebCoreL24dummySpanAncestorForNodeEPKNS_4NodeE
+__ZN7WebCore17ApplyStyleCommand27mergeEndWithNextIfIdenticalERKNS_8PositionES3_
+__ZN7WebCoreL20areIdenticalElementsEPNS_4NodeES1_
+__ZN7WebCore20CompositeEditCommand22mergeIdenticalElementsEN3WTF10PassRefPtrINS_7ElementEEES4_
+__ZN7WebCore29MergeIdenticalElementsCommandC1EN3WTF10PassRefPtrINS_7ElementEEES4_
+__ZN7WebCore29MergeIdenticalElementsCommandC2EN3WTF10PassRefPtrINS_7ElementEEES4_
+__ZN7WebCore29MergeIdenticalElementsCommand7doApplyEv
+__ZN7WebCoreL19isUnstyledStyleSpanEPKNS_4NodeE
+__ZN7WebCore37SplitTextNodeContainingElementCommandD0Ev
+__ZN7WebCore30WrapContentsInDummySpanCommandD0Ev
+__ZN7WebCore19SplitElementCommandD0Ev
+__ZN7WebCore29MergeIdenticalElementsCommandD0Ev
+__ZN7WebCoreL19executeJustifyRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeInsertHTMLEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL21executeInsertFragmentEPNS_5FrameEN3WTF10PassRefPtrINS_16DocumentFragmentEEE
+__ZN7WebCore23ReplaceSelectionCommand37insertNodeAfterAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEEPS3_
 __ZN7WebCore23ReplaceSelectionCommand11shouldMergeERKNS_15VisiblePositionES3_
-__ZN7WebCore16executeUnderlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17executeFindStringEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20previousWordPositionERKNS_15VisiblePositionE
-__ZN7WebCore32enabledRangeInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore13executeUnlinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore23ReplaceSelectionCommand13editingActionEv
+__ZN7WebCoreL11executeCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor4copyEv
+__ZN7WebCore6Editor12tryDHTMLCopyEv
+__ZN7WebCore10Pasteboard17generalPasteboardEv
+__ZN7WebCore10PasteboardC1EP12NSPasteboard
+__ZN7WebCore10PasteboardC2EP12NSPasteboard
+__ZN7WebCore10Pasteboard5clearEv
+__ZN7WebCore6Editor13selectedRangeEv
+__ZN7WebCore10Pasteboard14writeSelectionEPNS_5RangeEbPNS_5FrameE
+__ZN7WebCore10Pasteboard14writeSelectionEP12NSPasteboardPNS_5RangeEbPNS_5FrameE
+-[DOMObject copyWithZone:]
+-[DOMCSSPrimitiveValue getStringValue]
+__ZNK7WebCore17CSSPrimitiveValue14getStringValueERi
+__ZN7WebCoreL14valueForShadowEPKNS_10ShadowDataE
+-[DOMElement(WebPrivate) _font]
+-[DOMRGBColor(WebPrivate) _color]
+-[DOMRGBColor color]
+__ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
+__ZNK7WebCore5Range4textEv
+__ZN7WebCore6Editor29didWriteSelectionToPasteboardEv
+__ZN7WebCoreL14supportedPasteEPNS_5FrameENS_19EditorCommandSourceE
+__ZN7WebCoreL12enabledPasteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL12executePasteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor5pasteEv
+__ZN7WebCore6Editor13tryDHTMLPasteEv
+__ZN7WebCore14DocumentLoader22addAllArchiveResourcesEPNS_7ArchiveE
+__ZN7WebCore25ArchiveResourceCollectionC1Ev
+__ZN7WebCore25ArchiveResourceCollectionC2Ev
+__ZN7WebCore25ArchiveResourceCollection15addAllResourcesEPNS_7ArchiveE
+__Z4coreP19DOMDocumentFragment
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEmPKS3_
+__ZN7WebCore17InsertListCommand11modifyRangeEv
+__ZN7WebCore20CompositeEditCommand9inputTextERKNS_6StringEb
+__ZN7WebCore27jsHTMLOptionElementSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17ApplyStyleCommand26extractTextDecorationStyleEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand17removeCSSPropertyEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand19removeNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameE
+__ZN7WebCore24RemoveCSSPropertyCommandD0Ev
+__ZN7WebCoreL24executeInsertOrderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore24createOrderedListElementEPNS_8DocumentE
+__ZN7WebCore20startOfNextParagraphERKNS_15VisiblePositionE
+__ZN7WebCore39jsRangePrototypeFunctionExtractContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range15extractContentsERi
+__ZN7WebCore5Range18checkDeleteExtractERi
+__ZN7WebCore5Range15processContentsENS0_10ActionTypeERi
+__ZN7WebCore17ApplyStyleCommand19removeHTMLStyleNodeEPNS_11HTMLElementE
+__ZN7WebCore20CompositeEditCommand15insertLineBreakEv
+__ZN3WTF6VectorISt4pairIiiELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorISt4pairIiiELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE6shrinkEm
+__ZN7WebCore15isEndOfDocumentERKNS_15VisiblePositionE
+__ZN7WebCoreL32enabledRangeInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL13executeUnlinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore13UnlinkCommandC1EPNS_8DocumentE
+__ZN7WebCore13UnlinkCommandC2EPNS_8DocumentE
 __ZN7WebCore13UnlinkCommand7doApplyEv
 __ZN7WebCore20CompositeEditCommand21pushAnchorElementDownEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand19removeStyledElementEPNS_7ElementE
+__ZN7WebCore20CompositeEditCommand19removeStyledElementEN3WTF10PassRefPtrINS_7ElementEEE
 __ZNK7WebCore13UnlinkCommand13editingActionEv
-__ZN7WebCore20CompositeEditCommand30splitTextNodeContainingElementEPNS_4TextEi
-__ZN7WebCore37SplitTextNodeContainingElementCommandC2EPNS_4TextEi
-__ZN7WebCore37SplitTextNodeContainingElementCommand7doApplyEv
-__ZN7WebCore24dummySpanAncestorForNodeEPKNS_4NodeE
+__ZN7WebCore13UnlinkCommandD0Ev
+__ZN7WebCoreL16executeUnderlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore17ApplyStyleCommand33mergeStartWithPreviousIfIdenticalERKNS_8PositionES3_
-__ZN7WebCore17ApplyStyleCommand27mergeEndWithNextIfIdenticalERKNS_8PositionES3_
-__ZN7WebCore20areIdenticalElementsEPNS_4NodeES1_
-__ZN7WebCore20CompositeEditCommand22mergeIdenticalElementsEPNS_7ElementES2_
-__ZN7WebCore29MergeIdenticalElementsCommandC2EPNS_7ElementES2_
-__ZN7WebCore29MergeIdenticalElementsCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand15insertLineBreakEv
-__ZN7WebCore12executePrintEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Chrome5printEPNS_5FrameE
-__ZN7WebCore44jsDocumentPrototypeFunctionQueryCommandStateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document17queryCommandStateERKNS_6StringE
-__ZN7WebCore18stateUnorderedListEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor27selectionUnorderedListStateEv
-__ZN7WebCore16stateOrderedListEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor25selectionOrderedListStateEv
-__ZN7WebCore20CompositeEditCommand27addBlockPlaceholderIfNeededEPNS_4NodeE
-__ZNK7WebCore14RenderListItem7isEmptyEv
-__ZN7WebCore28previousWordPositionBoundaryEPKtj
-__ZN7WebCore16executeBackColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20CompositeEditCommand23wrapContentsInDummySpanEPNS_7ElementE
-__ZN7WebCore30WrapContentsInDummySpanCommandC2EPNS_7ElementE
-__ZN7WebCore30WrapContentsInDummySpanCommand7doApplyEv
-__ZN7WebCore11JSClipboardD0Ev
-__ZN7WebCore17ApplyStyleCommand26extractTextDecorationStyleEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand19removeNodeAttributeEPNS_7ElementERKNS_13QualifiedNameE
-__ZN7WebCore26RemoveNodeAttributeCommandC1EPNS_7ElementERKNS_13QualifiedNameE
-__ZN7WebCore26RemoveNodeAttributeCommand7doApplyEv
-__ZN7WebCore7Element15removeAttributeERKNS_13QualifiedNameERi
-__ZN7WebCore20executeStrikethroughEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17ApplyStyleCommand24applyTextDecorationStyleEPNS_4NodeEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore17ApplyStyleCommand19removeHTMLStyleNodeEPNS_11HTMLElementE
-__ZN7WebCore18FormatBlockCommand11modifyRangeEv
-__ZN7WebCore46jsDocumentPrototypeFunctionQueryCommandEnabledEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document19queryCommandEnabledERKNS_6StringE
-__ZN7WebCore18executeInsertImageEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore16HTMLImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore10executeCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore48jsDocumentPrototypeFunctionQueryCommandSupportedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document21queryCommandSupportedERKNS_6StringE
+__ZN7WebCoreL19executeStyleWithCSSEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore46jsCanvasRenderingContext2DPrototypeFunctionArcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D3arcEfffffbRi
+__ZN7WebCore4Path6addArcERKNS_10FloatPointEfffb
+__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D8fillRectEffff
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectE
+__ZN7WebCoreL10executeCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor3cutEv
 __ZN7WebCore6Editor11tryDHTMLCutEv
+__ZN7WebCoreL17executeFindStringEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL27executeInsertHorizontalRuleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeInsertNodeEPNS_5FrameEN3WTF10PassRefPtrINS_4NodeEEE
+__ZNK7WebCore14ClipboardEvent16isClipboardEventEv
+__ZNK7WebCore14ClipboardEvent9clipboardEv
+__ZN7WebCore11JSClipboard15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSClipboardC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ClipboardEEE
+__ZN7WebCore11JSClipboardC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ClipboardEEE
+__ZN7WebCore11JSClipboard18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSClipboardPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsClipboardPrototypeFunctionSetDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSClipboard9classInfoEv
+__ZN7WebCore11JSClipboard7setDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12ClipboardMac7setDataERKNS_6StringES3_
+__ZN7WebCoreL21cocoaTypeFromMIMETypeERKNS_6StringE
+__ZN7WebCore35jsClipboardPrototypeFunctionGetDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSClipboard7getDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore12ClipboardMac7getDataERKNS_6StringERb
+__ZN7WebCore11JSClipboardD1Ev
+__ZN7WebCore11JSClipboardD2Ev
+__ZN7WebCore20JSClipboardPrototypeD1Ev
+__ZN7WebCore31setJSHTMLElementContentEditableEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement18setContentEditableERKNS_6StringE
+__ZN7WebCore46jsDOMSelectionPrototypeFunctionRemoveAllRangesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection15removeAllRangesEv
+__ZNK7WebCore6Editor9canDeleteEv
+__ZN7WebCoreL23enabledVisibleSelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore46jsDocumentPrototypeFunctionQueryCommandEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document19queryCommandEnabledERKNS_6StringE
+__ZN7WebCore17isStartOfDocumentERKNS_15VisiblePositionE
+__ZNK7WebCore16RenderPartObject10renderNameEv
+__ZN7WebCore24setJSHTMLAreaElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement7setHrefERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAreaElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement9setCoordsERKNS_12AtomicStringE
+__ZN7WebCore12EventHandler32handleMousePressEventDoubleClickERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler31selectClosestWordFromMouseEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore16VisibleSelection22expandUsingGranularityENS_15TextGranularityE
+__ZN7WebCore11isEndOfLineERKNS_15VisiblePositionE
+__ZN7WebCore9endOfLineERKNS_15VisiblePositionE
+__ZN7WebCoreL18endPositionForLineERKNS_15VisiblePositionE
+__ZN7WebCore6Editor33isSelectTrailingWhitespaceEnabledEv
+__ZN7WebCore12EventHandler27handleMouseDoubleClickEventERKNS_18PlatformMouseEventE
+__ZN7WebCore11RenderBlock26addContinuationWithOutlineEPNS_12RenderInlineE
+__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS6_EEEENS7_IS3_EENS_10HashTraitsIS3
+__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS6_EEEENS7_IS3_EENS_10HashTraitsIS3_
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS7_EEEEENS_18PairFirstE
+__ZN7WebCore19jsDOMWindowOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onscrollEv
+__ZN7WebCore22setJSDOMWindowOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsNodeOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmousemoveEv
+__ZN7WebCoreL18executeInsertImageEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL19executeToggleItalicEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL16executeForeColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZNK7WebCore6Editor17shouldDeleteRangeEPNS_5RangeE
 __ZNK7WebCore6Editor14canDeleteRangeEPNS_5RangeE
 __ZN7WebCore6Editor30deleteSelectionWithSmartDeleteEb
+__ZNK7WebCore22DeleteSelectionCommand20preservesTypingStyleEv
 __ZNK7WebCore22DeleteSelectionCommand13editingActionEv
-__ZN7WebCore32jsDOMWindowPrototypeFunctionFindEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow4findERKNS_6StringEbbbbbb
-__ZN7WebCore19RemoveFormatCommandD1Ev
-__ZN7WebCore26RemoveNodeAttributeCommandD1Ev
-__ZN7WebCore13UnlinkCommandD1Ev
-__ZN7WebCore11inSameBlockERKNS_15VisiblePositionES2_
-__ZN7WebCore22caretMaxRenderedOffsetEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand27insertNodeAtTabSpanPositionEPNS_4NodeERKNS_8PositionE
-__ZN7WebCore11HTMLElement18setContentEditableERKNS_6StringE
-__ZN7WebCore19SplitElementCommand9doUnapplyEv
-__ZN7WebCore11enabledRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore29isCharacterSmartReplaceExemptEib
+__ZN7WebCoreL11getSmartSetEb
+__ZN7WebCoreL12executePrintEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Chrome5printEPNS_5FrameE
+__ZN7WebCore44jsDocumentPrototypeFunctionQueryCommandStateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document17queryCommandStateERKNS_6StringE
+__ZN7WebCoreL18stateUnorderedListEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor27selectionUnorderedListStateEv
+__ZN7WebCoreL16stateOrderedListEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor25selectionOrderedListStateEv
+__ZN7WebCore17InsertListCommand20fixOrphanedListChildEPNS_4NodeE
+__ZN7WebCoreL20executeStrikethroughEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17ApplyStyleCommand24applyTextDecorationStyleEPNS_4NodeEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore49jsCSSStyleDeclarationPrototypeFunctionSetPropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL16executeSubscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL18executeSuperscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17ApplyStyleCommand35extractAndNegateTextDecorationStyleEPNS_4NodeE
+__ZN7WebCore6Editor24insertParagraphSeparatorEv
+__ZN7WebCoreL19executeMoveBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore55jsHTMLTextAreaElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore17InsertTextCommand21performTrivialReplaceERKNS_6StringEb
+__ZN7WebCore25setJSHTMLAnchorElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement6setRelERKNS_12AtomicStringE
+__ZN7WebCore20CompositeEditCommand27insertNodeAtTabSpanPositionEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
+__ZNK7WebCore11RenderTheme11systemColorEi
+__ZN7WebCore10JSNodeList10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore35jsDOMWindowXSLTProcessorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow13xsltProcessorEPN3JSC9ExecStateE
+__ZN7WebCore26JSXSLTProcessorConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore26JSXSLTProcessorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSXSLTProcessorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSXSLTProcessor15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSXSLTProcessorConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL22constructXSLTProcessorEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XSLTProcessorEEE
+__ZN7WebCore15JSXSLTProcessorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XSLTProcessorEEE
+__ZN7WebCore22HTMLFormControlElement5resetEv
+__ZN7WebCore15JSXSLTProcessorD1Ev
+__ZN7WebCore15JSXSLTProcessorD2Ev
+__ZN7WebCore24JSXSLTProcessorPrototypeD1Ev
+__ZN7WebCore26JSXSLTProcessorConstructorD1Ev
+__ZN7WebCore17AppendNodeCommand9doUnapplyEv
+__ZN7WebCoreL11enabledRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCore6Editor7canRedoEv
-__ZN7WebCore11executeRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL11executeRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor4redoEv
 __ZN7WebCore11EditCommand7reapplyEv
 __ZN7WebCore20CompositeEditCommand9doReapplyEv
 __ZN7WebCore11EditCommand9doReapplyEv
 __ZN7WebCore6Editor16reappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore12EventHandler22defaultTabEventHandlerEPNS_13KeyboardEventE
+__ZN7WebCoreL16executeInsertTabEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore19ReplacementFragment30insertFragmentForTestRenderingEPNS_4NodeE
+__ZN7WebCore19ReplacementFragment35restoreTestRenderingNodesToFragmentEPNS_4NodeE
+__ZN7WebCore19ReplacementFragment21removeUnrenderedNodesEPNS_4NodeE
+__ZN7WebCore14isNodeRenderedEPKNS_4NodeE
 __ZN7WebCore20CompositeEditCommand24insertParagraphSeparatorEb
-__ZN7WebCore105_GLOBAL__N__Volumes_QuickPerf_source_TOT_OpenSource_WebCore_editing_HTMLInterchange.cpp_00000000_A5DBA54420convertedSpaceStringEv
-__ZN7WebCore23fillContainerFromStringEPNS_13ContainerNodeERKNS_16DeprecatedStringE
-__ZN7WebCore20DeprecatedStringList5splitERKNS_14DeprecatedCharERKNS_16DeprecatedStringEb
-__ZN7WebCore20DeprecatedStringList5splitERKNS_16DeprecatedStringES3_b
-__ZN7WebCore20DeprecatedStringList9pop_frontEv
-__ZN7WebCore19DeprecatedValueListINS_16DeprecatedStringEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore25stripAttachmentCharactersEP18NSAttributedString
-__ZN7WebCore34jsRangePrototypeFunctionSelectNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore32jsRangePrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore5Range8toStringERi
-__ZN7WebCore49jsDOMSelectionPrototypeFunctionDeleteFromDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection18deleteFromDocumentEv
+__ZN7WebCoreL25executePasteAndMatchStyleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor16pasteAsPlainTextEv
+__ZN7WebCore6Editor30pasteAsPlainTextWithPasteboardEPNS_10PasteboardE
+__ZN7WebCore10Pasteboard9plainTextEPNS_5FrameE
+__ZN7WebCore6Editor29canSmartReplaceWithPasteboardEPNS_10PasteboardE
+__ZN7WebCore10Pasteboard15canSmartReplaceEv
+__ZN7WebCore6Editor24replaceSelectionWithTextERKNS_6StringEbb
+__ZN7WebCore6Editor28replaceSelectionWithFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbb
+__ZN7WebCoreL19stringValueForRangeEPKNS_4NodeEPKNS_5RangeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
+__ZN7WebCoreL25stripAttachmentCharactersEP18NSAttributedString
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_15ArchiveResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_15ArchiveResourceEEEENS_18PairFirstExtractorIS7_EENS1_10StringHas
+__ZNK7WebCore14RenderMenuList10renderNameEv
+__ZN7WebCore5Range11compareNodeEPNS_4NodeERi
+__ZN7WebCore12ClipboardMac10writeRangeEPNS_5RangeEPNS_5FrameE
+__ZN7WebCore6Editor24smartInsertDeleteEnabledEv
+__ZN7WebCore27createDragImageForSelectionEPNS_5FrameE
+__ZN7WebCore5Frame21dragImageForSelectionEv
+__ZNK7WebCore5Frame14selectionImageEb
+__ZN7WebCore9FrameView19setPaintRestrictionENS_16PaintRestrictionE
+__ZNK7WebCore5Frame13imageFromRectE6CGRect
+__ZN7WebCore14DragController10dragIsMoveEPNS_19SelectionControllerE
+__ZN7WebCore14DragController13isCopyKeyDownEv
+__ZNK7WebCore8DragData10asFragmentEPNS_8DocumentE
+__ZN7WebCore6Editor20shouldInsertFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEENS2_INS_5RangeEEENS_18EditorInsertActionE
+__ZNK7WebCore4Node19isCharacterDataNodeEv
+__ZNK7WebCore8DragData15canSmartReplaceEv
+__ZN7WebCore20MoveSelectionCommandC1EN3WTF10PassRefPtrINS_16DocumentFragmentEEERKNS_8PositionEb
+__ZN7WebCore20MoveSelectionCommandC2EN3WTF10PassRefPtrINS_16DocumentFragmentEEERKNS_8PositionEb
+__ZN7WebCore20MoveSelectionCommand7doApplyEv
+__ZNK7WebCore20MoveSelectionCommand13editingActionEv
+__ZN7WebCore20MoveSelectionCommandD0Ev
+__ZN7WebCore42jsRangePrototypeFunctionSelectNodeContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26setJSHTMLOListElementStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLOListElement8setStartEi
+__ZN7WebCore26CSSMutableStyleDeclaration17addParsedPropertyERKNS_11CSSPropertyE
+__ZN7WebCore10systemBeepEv
+__ZN7WebCore10Pasteboard10writeImageEPNS_4NodeERKNS_4KURLERKNS_6StringE
+__ZN7WebCoreL21writableTypesForImageEv
+__ZN7WebCoreL19writableTypesForURLEv
+__ZN7WebCore10Pasteboard8writeURLEP12NSPasteboardP7NSArrayRKNS_4KURLERKNS_6StringEPNS_5FrameE
+_suggestedFilenameWithMIMEType
+_filenameByFixingIllegalCharacters
+__ZN7WebCore16MIMETypeRegistry24getExtensionsForMIMETypeERKNS_6StringE
+__ZN7WebCore10Pasteboard32writeFileWrapperAsRTFDAttachmentEP13NSFileWrapper
+__ZN7WebCore14DocumentLoader18addArchiveResourceEN3WTF10PassRefPtrINS_15ArchiveResourceEEE
+__ZN7WebCore25ArchiveResourceCollection11addResourceEN3WTF10PassRefPtrINS_15ArchiveResourceEEE
+__ZN7WebCore25ArchiveResourceCollection21archiveResourceForURLERKNS_4KURLE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_15ArchiveResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14ResourceLoaderEEENS1_INS2_18SubstituteResourceEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEN
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEESt4pairIS4_NS1_INS2_18SubstituteResourceEEEENS_18PairFirstExtractorIS
+__ZN7WebCore5TimerINS_14DocumentLoaderEE5firedEv
+__ZN7WebCore14DocumentLoader36substituteResourceDeliveryTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore7Element5styleEv
+__ZNK7WebCore8Document10isFrameSetEv
+__ZN7WebCoreL23setSelectionToDragCaretEPNS_5FrameERNS_16VisibleSelectionERN3WTF6RefPtrINS_5RangeEEERKNS_8IntPointE
+__ZN7WebCoreL22caretMaxRenderedOffsetEPKNS_4NodeE
+__ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
+__ZN7WebCore12EventHandler15hoverTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore11RenderTheme32inactiveSelectionBackgroundColorEv
+__ZN7WebCore14RenderReplaced16positionForPointERKNS_8IntPointE
+__ZN7WebCore12ClipboardMac8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZNK7WebCore12RenderButton10renderNameEv
+__ZNK7WebCore8DragData11asPlainTextEv
+__ZN7WebCoreL11executeYankEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor16yankFromKillRingEv
+__ZN7WebCore6Editor24setKillRingToYankedStateEv
+__ZN7WebCoreL33executeMoveToBeginningOfParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore9Clipboard20destinationOperationERNS_13DragOperationE
+__ZN7WebCore12EventHandler18performDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+-[DOMHTMLInputElement type]
+__ZNK7WebCore16HTMLInputElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK3JSC8JSObject14isGlobalObjectEv
+__ZN3JSC16RuntimeObjectImp11getCallDataERNS_8CallDataE
+__ZNK3JSC8Bindings12ObjcInstance27supportsInvokeDefaultMethodEv
+__ZN3JSCL17callRuntimeObjectEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8Bindings12ObjcInstance19invokeDefaultMethodEPNS_9ExecStateERKNS_7ArgListE
+__ZN7WebCore27jsHTMLAnchorElementHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8hostnameEv
+-[DOMHTMLOListElement start]
+-[DOMHTMLTableElement cellSpacing]
+-[DOMHTMLTableElement cellPadding]
+-[DOMHTMLTableCellElement rowSpan]
+-[DOMHTMLTableCellElement colSpan]
+-[DOMHTMLTableCellElement width]
+-[DOMHTMLTableCellElement height]
+__ZNK7WebCore14CSSCharsetRule4typeEv
+__ZN7WebCore16JSCSSCharsetRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSCSSCharsetRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CSSCharsetRuleEEE
+__ZN7WebCore16JSCSSCharsetRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CSSCharsetRuleEEE
+__ZN7WebCore16JSCSSCharsetRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSCSSRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRuleD1Ev
+__ZN7WebCore25JSCSSCharsetRulePrototypeD1Ev
+__ZN7WebCore30jsHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLButtonElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLButtonElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLButtonElementConstructorD1Ev
+__ZN7WebCore24parseXMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerC1EPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerC2EPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerD1Ev
+__ZN7WebCore12XMLTokenizerD2Ev
+__ZN7WebCore20createTabSpanElementEPNS_8DocumentERKNS_6StringE
+__ZN7WebCore17RemoveNodeCommand9doUnapplyEv
+__ZN7WebCore23InsertNodeBeforeCommand9doUnapplyEv
+__ZN7WebCore8RenderBR16positionForPointERKNS_8IntPointE
+__ZN7WebCore20nextSentencePositionERKNS_15VisiblePositionE
+__ZN7WebCoreL28nextSentencePositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore21sentenceBreakIteratorEPKti
 __ZN7WebCore24previousSentencePositionERKNS_15VisiblePositionE
-__ZN7WebCore32previousSentencePositionBoundaryEPKtj
+__ZN7WebCoreL32previousSentencePositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL46executeMoveToBeginningOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL40executeMoveToEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL51executeMoveToBeginningOfParagraphAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL45executeMoveToEndOfParagraphAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore11ShadowValue7cssTextEv
+__ZN3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3setERKS4_RKS5_
+__ZN3WTF9HashTableIPKN7WebCore14RenderReplacedESt4pairIS4_NS1_7IntRectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS4_EENS_14Pair
+__ZNK3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3getERKS4_
+__ZN7WebCore12EventHandler32handleMousePressEventTripleClickERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore20endOfEditableContentERKNS_15VisiblePositionE
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionCollapseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection8collapseEPNS_4NodeEiRi
-__ZN7WebCore29JSDOMCoreExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore29JSDOMCoreExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSDOMCoreExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore43jsDOMSelectionPrototypeFunctionContainsNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12DOMSelection12containsNodeEPKNS_4NodeEb
-__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateDocumentTypeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17DOMImplementation18createDocumentTypeERKNS_6StringES3_S3_Ri
-__ZN7WebCore24qualifiedNameIsMalformedERKNS_6StringE
-__ZN7WebCore12DocumentTypeC1EPNS_17DOMImplementationEPNS_8DocumentERKNS_6StringES7_S7_
-__ZNK7WebCore14JSDocumentType9classInfoEv
+__ZN7WebCore21ContextMenuController16clearContextMenuEv
+__ZN7WebCore12EventHandler20sendContextMenuEventERKNS_18PlatformMouseEventE
+__ZN7WebCore12EventHandler37selectClosestWordOrLinkFromMouseEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore21ContextMenuController22handleContextMenuEventEPNS_5EventE
+__ZN7WebCore11ContextMenuC1ERKNS_13HitTestResultE
+__ZN7WebCore11ContextMenuC2ERKNS_13HitTestResultE
++[WebCoreMenuTarget sharedMenuTarget]
+__ZNK7WebCore11ContextMenu10controllerEv
+-[WebCoreMenuTarget setMenuController:]
+__ZN7WebCore11ContextMenu8populateEv
+__ZN7WebCore26contextMenuItemTagOpenLinkEv
+__ZN7WebCore15ContextMenuItemC1ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
+__ZN7WebCore15ContextMenuItemC2ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
+__ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
+__ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
+__ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
+__ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
+__ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
+__ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
+__ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
+__ZN7WebCore36contextMenuItemTagLookUpInDictionaryEv
+__ZN7WebCore27contextMenuItemTagSearchWebEv
+__ZN7WebCore22contextMenuItemTagCopyEv
+__ZN7WebCore24contextMenuItemTagGoBackEv
+__ZN7WebCore27contextMenuItemTagGoForwardEv
+__ZN7WebCore22contextMenuItemTagStopEv
+__ZN7WebCore24contextMenuItemTagReloadEv
+__ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
+__ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
+__ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
+__ZN7WebCore31contextMenuItemTagLearnSpellingEv
+__ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
+__ZN7WebCore21contextMenuItemTagCutEv
+__ZN7WebCore23contextMenuItemTagPasteEv
+__ZN7WebCoreL29selectionContainsPossibleWordEPNS_5FrameE
+__ZN7WebCore11ContextMenu10appendItemERNS_15ContextMenuItemE
+__ZNK7WebCore11ContextMenu21checkOrEnableIfNeededERNS_15ContextMenuItemE
+__ZNK7WebCore15ContextMenuItem4typeEv
+__ZNK7WebCore15ContextMenuItem6actionEv
+__ZN7WebCore15ContextMenuItem10setCheckedEb
+__ZN7WebCore15ContextMenuItem10setEnabledEb
+__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
+__ZN7WebCoreL17setMenuItemTargetEP10NSMenuItem
+__ZN7WebCoreL13separatorItemEv
+__ZN7WebCore15ContextMenuItemD1Ev
+__ZN7WebCore15ContextMenuItemD2Ev
+__ZNK7WebCore11ContextMenu19platformDescriptionEv
+__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
+__ZSt5mergeIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
+__ZN7WebCore5Image21mayFillWithSolidColorEv
+__ZNK7WebCore14GeneratedImage4sizeEv
+__ZNK7WebCore14GeneratedImage16hasRelativeWidthEv
+__ZNK7WebCore14GeneratedImage17hasRelativeHeightEv
+__ZN7WebCoreL36executeMoveForwardAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore26jsDOMSelectionExtentOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection12extentOffsetEv
+__ZNK7WebCore12DOMSelection16visibleSelectionEv
+__ZN7WebCoreL14extentPositionERKNS_16VisibleSelectionE
+__ZN7WebCore24jsDOMSelectionBaseOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection10baseOffsetEv
-__ZN7WebCore36jsDOMSelectionPrototypeFunctionEmptyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection5emptyEv
-__ZN7WebCore37jsDOMSelectionPrototypeFunctionExtendEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection6extendEPNS_4NodeEiRi
-__ZN7WebCore19SelectionController22expandUsingGranularityENS_15TextGranularityE
-__ZN7WebCore48jsDOMSelectionPrototypeFunctionSelectAllChildrenEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection17selectAllChildrenEPNS_4NodeERi
+__ZN7WebCoreL12basePositionERKNS_16VisibleSelectionE
+__ZN7WebCoreL37executeMoveBackwardAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore18jsDOMSelectionTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection4typeEv
+__ZN3JSC16RuntimeObjectImp3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8Bindings9ObjcFieldC1EP9objc_ivar
+__ZN3JSC8Bindings9ObjcFieldC2EP9objc_ivar
+__ZNK3JSC8Bindings9ObjcField18setValueToInstanceEPNS_9ExecStateEPKNS0_8InstanceENS_7JSValueE
+__ZN7WebCore13endOfSentenceERKNS_15VisiblePositionE
+__ZN7WebCoreL19endSentenceBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore15startOfSentenceERKNS_15VisiblePositionE
+__ZN7WebCoreL21startSentenceBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore24jsDOMSelectionExtentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10extentNodeEv
+__ZN7WebCore11ContextMenuD1Ev
+__ZN7WebCore11ContextMenuD2Ev
+__ZN7WebCore6Editor44guessesForMisspelledOrUngrammaticalSelectionERbS1_
+__ZNK7WebCore13HitTestResult14replacedStringEv
+__ZN7WebCore30contextMenuItemTagSpellingMenuEv
+__ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
+__ZN7WebCore31contextMenuItemTagCheckSpellingEv
+__ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
+__ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
+__ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
+__ZN7WebCore6Editor22spellingPanelIsShowingEv
+__ZN7WebCore15ContextMenuItem8setTitleERKNS_6StringE
+__ZN7WebCore15ContextMenuItem10setSubMenuEPNS_11ContextMenuE
+__ZN7WebCore35contextMenuItemTagSubstitutionsMenuEv
+__ZN7WebCore35contextMenuItemTagShowSubstitutionsEb
+__ZN7WebCore32contextMenuItemTagSmartCopyPasteEv
+__ZN7WebCore29contextMenuItemTagSmartQuotesEv
+__ZN7WebCore29contextMenuItemTagSmartDashesEv
+__ZN7WebCore28contextMenuItemTagSmartLinksEv
+__ZN7WebCore33contextMenuItemTagTextReplacementEv
+__ZN7WebCore6Editor27substitutionsPanelIsShowingEv
+__ZN7WebCore37contextMenuItemTagTransformationsMenuEv
+__ZN7WebCore31contextMenuItemTagMakeUpperCaseEv
+__ZN7WebCore31contextMenuItemTagMakeLowerCaseEv
+__ZN7WebCore28contextMenuItemTagCapitalizeEv
+__ZN7WebCore26contextMenuItemTagFontMenuEv
+__ZN7WebCore27contextMenuItemTagShowFontsEv
+__ZN7WebCore22contextMenuItemTagBoldEv
+__ZN7WebCore24contextMenuItemTagItalicEv
+__ZN7WebCore27contextMenuItemTagUnderlineEv
+__ZN7WebCore25contextMenuItemTagOutlineEv
+__ZN7WebCore24contextMenuItemTagStylesEv
+__ZN7WebCore28contextMenuItemTagShowColorsEv
+__ZN7WebCore8Document25createCSSStyleDeclarationEv
+__ZN7WebCore28contextMenuItemTagSpeechMenuEv
+__ZN7WebCore31contextMenuItemTagStartSpeakingEv
+__ZN7WebCore30contextMenuItemTagStopSpeakingEv
+__ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
+__ZN7WebCore34contextMenuItemTagDefaultDirectionEv
+__ZN7WebCore29contextMenuItemTagLeftToRightEv
+__ZN7WebCore29contextMenuItemTagRightToLeftEv
+__ZNK7WebCore6Editor16hasBidiSelectionEv
+__ZNK7WebCore11FrameLoader18canGoBackOrForwardEi
+__ZN7WebCore22jsDOMSelectionBaseNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection8baseNodeEv
+__ZN7WebCore19SelectionController16modifyMovingLeftENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition4leftEb
+__ZNK7WebCore15VisiblePosition29leftVisuallyDistinctCandidateEv
+__ZN7WebCore24jsDOMSelectionAnchorNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10anchorNodeEv
+__ZN7WebCoreL14anchorPositionERKNS_16VisibleSelectionE
+__ZN7WebCore26jsDOMSelectionAnchorOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection12anchorOffsetEv
+__ZN7WebCore19SelectionController17modifyMovingRightENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition5rightEb
+__ZNK7WebCore15VisiblePosition30rightVisuallyDistinctCandidateEv
+__ZNK7WebCore5Range21compareBoundaryPointsENS0_10CompareHowEPKS0_Ri
+__ZN7WebCore23jsDOMSelectionFocusNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection9focusNodeEv
+__ZN7WebCoreL13focusPositionERKNS_16VisibleSelectionE
+__ZN7WebCore25jsDOMSelectionFocusOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection11focusOffsetEv
-__ZNK7WebCore12DOMSelection10extentNodeEv
-__ZNK7WebCore12DOMSelection12extentOffsetEv
-__ZNK7WebCore5Range21compareBoundaryPointsENS0_10CompareHowEPKS0_Ri
-__ZNK7WebCore12DOMSelection4typeEv
-__ZN7WebCore20nextSentencePositionERKNS_15VisiblePositionE
-__ZN7WebCore28nextSentencePositionBoundaryEPKtj
+__ZN7WebCore36jsDOMSelectionPrototypeFunctionEmptyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection5emptyEv
 __ZNK7WebCore20HTMLFrameElementBase11isFocusableEv
 __ZN7WebCore20HTMLFrameElementBase8setFocusEb
-__ZN7WebCore17ApplyStyleCommand35extractAndNegateTextDecorationStyleEPNS_4NodeE
-__ZN7WebCore20executeFontSizeDeltaEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore24jsDOMSelectionRangeCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10rangeCountEv
+__ZN7WebCore41jsDOMSelectionPrototypeFunctionGetRangeAtEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection10getRangeAtEiRi
+__ZNK7WebCore16VisibleSelection10firstRangeEv
+__ZN7WebCore21jsRangeStartContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsRangeEndContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsRangeStartOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsRangeEndOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17setJSDOMWindowTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12RenderObject22positionForCoordinatesEii
+__ZN7WebCore25jsDOMSelectionIsCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection11isCollapsedEv
+__ZN7WebCore43jsDOMSelectionPrototypeFunctionContainsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12DOMSelection12containsNodeEPKNS_4NodeEb
+__ZN7WebCore49jsDOMSelectionPrototypeFunctionDeleteFromDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection18deleteFromDocumentEv
+__ZN7WebCore5Range14deleteContentsERi
+__ZN7WebCore33setJSHTMLFormElementAcceptCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement16setAcceptCharsetERKNS_6StringE
+__ZN7WebCore25setJSHTMLInputElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement7setSizeEj
+__ZN7WebCore16VisibleSelection24appendTrailingWhitespaceEv
+__ZN7WebCore32jsRangePrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5Range8toStringERi
+__ZN7WebCore19SelectionController20modifyExtendingRightENS_15TextGranularityE
+__ZN7WebCore19SelectionController25directionOfEnclosingBlockEv
+__ZN7WebCore26jsDOMWindowTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSTextConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19SelectionController19modifyExtendingLeftENS_15TextGranularityE
+__ZSt9__reverseIPPN7WebCore9InlineBoxEEvT_S4_St26random_access_iterator_tag
+__ZN7WebCore37jsDOMSelectionPrototypeFunctionExtendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection6extendEPNS_4NodeEiRi
+__ZN7WebCore19SelectionController22expandUsingGranularityENS_15TextGranularityE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection8toStringEv
+__ZN7WebCore5Range13setStartAfterEPNS_4NodeERi
+__ZNK7WebCore11RenderTheme32inactiveSelectionForegroundColorEv
+__ZN7WebCore12RenderWidget17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZN3WTF6VectorItLm32EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm32EE14expandCapacityEm
+__ZN3WTF6VectorItLm32EE15reserveCapacityEm
+__ZN7WebCoreL15executeMoveLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL27executeMoveToRightEndOfLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL26executeMoveToLeftEndOfLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL45executeMoveToRightEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL16executeMoveRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL44executeMoveToLeftEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN3JSC8Bindings9ObjcArrayC1EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings9ObjcArrayC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings5ArrayC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC12RuntimeArrayC1EPNS_9ExecStateEPNS_8Bindings5ArrayE
+__ZN3JSC12RuntimeArrayC2EPNS_9ExecStateEPNS_8Bindings5ArrayE
+__ZN3JSC12RuntimeArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZNK3JSC8Bindings9ObjcArray9getLengthEv
+__ZN3JSC12RuntimeArray11indexGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC8Bindings9ObjcArray7valueAtEPNS_9ExecStateEj
+__ZNK7WebCore5Frame17firstRectForRangeEPNS_5RangeE
+__ZN3JSC12RuntimeArrayD1Ev
+__ZN3JSC8Bindings9ObjcArrayD0Ev
+__ZN3JSC8Bindings5ArrayD2Ev
+__ZN7WebCore29setJSHTMLInputElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement11setReadOnlyEb
+__ZN7WebCoreL17executeSelectLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL28expandSelectionToGranularityEPNS_5FrameENS_15TextGranularityE
+__ZN7WebCore34jsRangePrototypeFunctionSelectNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection8collapseEPNS_4NodeEiRi
+__ZN7WebCore34jsDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSDOMCoreException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSDOMCoreExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSDOMCoreExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSDOMCoreExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMCoreExceptionINDEX_SIZE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSDOMCoreExceptionConstructorD1Ev
+__ZN7WebCore26setJSHTMLButtonElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSHTMLTableCellElementNoWrapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setNoWrapEb
+__ZN7WebCore17HTMLSelectElement5resetEv
+__ZN7WebCoreL30newStreamingTextDecoderUTF16LEERKNS_12TextEncodingEPKv
+__ZN7WebCore13RootInlineBox15clearTruncationEv
+__ZN7WebCore13InlineFlowBox15clearTruncationEv
+__ZN7WebCore13InlineTextBox15clearTruncationEv
+__ZNK3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore11EllipsisBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL18executeJustifyLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL15executeFontSizeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13RootInlineBox20addHighlightOverflowEv
+__ZN7WebCore13InlineTextBox20paintCustomHighlightEiiRKNS_12AtomicStringE
+__ZN7WebCore13RootInlineBox20paintCustomHighlightERNS_12RenderObject9PaintInfoEiiRKNS_12AtomicStringE
+__ZNK7WebCore9FloatRect10intersectsERKS0_
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet10deleteRuleEjRi
+__ZN7WebCore9StyleList6removeEj
+__ZN7WebCoreL20executeFontSizeDeltaEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore17ApplyStyleCommand18joinChildTextNodesEPNS_4NodeERKNS_8PositionES5_
 __ZN7WebCore17ApplyStyleCommand24splitTextAtStartIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand22splitTextAtEndIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand16computedFontSizeEPKNS_4NodeE
 __ZN3WTF7HashMapIPN7WebCore4NodeEfNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IfEEE3setERKS3_RKf
-__ZN3WTF9HashTableIiSt4pairIifENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IfEEEES9_E3addIPN7WebCore4NodeEfNS_17HashMapTranslatorILb1ES1_ISG_fENS_18PairBaseHashTraitsINS8_ISG_EESA_EESB_NS_7PtrHashISG_EEEEEES1_INS_17HashTableIteratorIiS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIifENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IfEEEES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_fENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
 __ZNK3WTF7HashMapIPN7WebCore4NodeEfNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IfEEE3getERKS3_
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionDeleteRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13CSSStyleSheet10deleteRuleEjRi
-__ZN7WebCore9StyleList6removeEj
-__ZN7WebCore13RootInlineBox20addHighlightOverflowEv
-__ZN7WebCore5Frame23customHighlightLineRectERKNS_12AtomicStringERKNS_9FloatRectEPNS_4NodeE
-__ZN7WebCore13InlineTextBox20paintCustomHighlightEiiRKNS_12AtomicStringE
-__ZN7WebCore5Frame20paintCustomHighlightERKNS_12AtomicStringERKNS_9FloatRectES6_bbPNS_4NodeE
-__ZN7WebCore13RootInlineBox20paintCustomHighlightERNS_12RenderObject9PaintInfoEiiRKNS_12AtomicStringE
-__ZNK7WebCore9FloatRect10intersectsERKS0_
-__ZN7WebCore42jsHTMLTextAreaElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node16shadowParentNodeEv
-__ZNK7WebCore5XPath5Union8evaluateEv
-__ZN7WebCore5XPath5Value17modifiableNodeSetEv
-__ZN7WebCore5XPath5UnionD1Ev
-__ZN7WebCore5XPath13isRootDomNodeEPNS_4NodeE
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9ParseNodeEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESB_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore6StringEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4Step8NodeTestEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESC_EEEEvRT0_
-__ZN7WebCore5XPath6Parser16registerNodeTestEPNS0_4Step8NodeTestE
-__ZN3WTF7HashSetIPN7WebCore5XPath4Step8NodeTestENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEE3addERKS5_
-__ZN7WebCore5XPath6Parser14deleteNodeTestEPNS0_4Step8NodeTestE
-__ZN7WebCore11SVGGElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11SVGGElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore10SVGElement21finishParsingChildrenEv
-__ZN7WebCore10SVGElement26sendSVGLoadEventIfPossibleEb
-__ZN7WebCore10SVGElement27haveLoadedRequiredResourcesEv
-__ZN7WebCore21SVGDocumentExtensions15startAnimationsEv
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateExpressionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_15XPathExpressionE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14XPathExceptionE
-__ZN7WebCore16JSXPathExceptionC1EPN3KJS8JSObjectEPNS_14XPathExceptionE
-__ZN7WebCore16JSXPathException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSXPathExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsXPathExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSXPathException9classInfoEv
-__ZN7WebCore5XPath11createFunIdEv
-__ZNK7WebCore5XPath5FunId8evaluateEv
-__ZN7WebCore5XPath5FunIdD1Ev
-__ZN7WebCore5XPath4PathC1EPNS0_6FilterEPNS0_12LocationPathE
-__ZNK7WebCore5XPath4Path8evaluateEv
-__ZN7WebCore5XPath6FilterC1EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
-__ZNK7WebCore5XPath6Filter8evaluateEv
-__ZN7WebCore5XPath6FilterD1Ev
-__ZN7WebCore5XPath23createFunSubstringAfterEv
-__ZNK7WebCore5XPath17FunSubstringAfter8evaluateEv
-__ZN7WebCore5XPath17FunSubstringAfterD1Ev
-__ZNK7WebCore11XPathResult11stringValueERi
-__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_9NumericOp6OpcodeEi
-__ZN7WebCore5XPath13createFunLastEv
-__ZNK7WebCore5XPath7FunLast8evaluateEv
-__ZN7WebCore5XPath7FunLastD1Ev
-__ZN7WebCore5XPath13createFunNameEv
-__ZNK7WebCore5XPath7FunName8evaluateEv
-__ZN7WebCore5XPath7FunNameD1Ev
-__ZN7WebCore5XPath15createFunStringEv
-__ZNK7WebCore5XPath9FunString8evaluateEv
-__ZN7WebCore5XPath9FunStringD1Ev
-__ZN7WebCore5XPath24createFunSubstringBeforeEv
-__ZNK7WebCore5XPath18FunSubstringBefore8evaluateEv
-__ZN7WebCore5XPath18FunSubstringBeforeD1Ev
-__ZN7WebCore5XPath23createFunNormalizeSpaceEv
-__ZN7WebCore5XPath18createFunTranslateEv
-__ZNK7WebCore5XPath12FunTranslate8evaluateEv
-__ZNK7WebCore5XPath17FunNormalizeSpace8evaluateEv
-__ZN7WebCore5XPath12FunTranslateD1Ev
-__ZN7WebCore5XPath17FunNormalizeSpaceD1Ev
-__ZN7WebCore5XPath16createFunBooleanEv
-__ZN7WebCore5XPath14createFunFalseEv
-__ZNK7WebCore5XPath10FunBoolean8evaluateEv
-__ZNK7WebCore5XPath8FunFalse8evaluateEv
-__ZN7WebCore5XPath10FunBooleanD1Ev
-__ZN7WebCore5XPath8FunFalseD1Ev
-__ZN7WebCore5XPath13createFunTrueEv
-__ZNK7WebCore5XPath7FunTrue8evaluateEv
-__ZN7WebCore5XPath7FunTrueD1Ev
-__ZN7WebCore5XPath13createFunLangEv
-__ZNK7WebCore5XPath7FunLang8evaluateEv
-__ZNK7WebCore12NamedAttrMap14getNamedItemNSERKNS_6StringES3_
-__ZN7WebCore5XPath7FunLangD1Ev
-__ZN7WebCore5XPath15createFunNumberEv
-__ZNK7WebCore5XPath9FunNumber8evaluateEv
-__ZN7WebCore5XPath9FunNumberD1Ev
-__ZN7WebCore5XPath12createFunSumEv
-__ZNK7WebCore5XPath6FunSum8evaluateEv
-__ZN7WebCore5XPath6FunSumD1Ev
-__ZN7WebCore5XPath14createFunFloorEv
-__ZNK7WebCore5XPath8FunFloor8evaluateEv
-__ZN7WebCore5XPath8FunFloorD1Ev
-__ZN7WebCore5XPath16createFunCeilingEv
-__ZNK7WebCore5XPath10FunCeiling8evaluateEv
-__ZN7WebCore5XPath10FunCeilingD1Ev
-__ZN7WebCore5XPath14createFunRoundEv
-__ZNK7WebCore5XPath8FunRound8evaluateEv
-__ZN7WebCore5XPath8FunRoundD1Ev
-__ZNK7WebCore27JSXPathEvaluatorConstructor19implementsConstructEv
-__ZN7WebCore27JSXPathEvaluatorConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14XPathEvaluatorE
-__ZN7WebCore16JSXPathEvaluatorC1EPN3KJS8JSObjectEPNS_14XPathEvaluatorE
-__ZN7WebCore16JSXPathEvaluator18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSXPathEvaluatorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsXPathEvaluatorPrototypeFunctionEvaluateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSXPathEvaluator9classInfoEv
-__ZN7WebCore26JSXPathExpressionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSXPathExpressionC1EPN3KJS8JSObjectEPNS_15XPathExpressionE
-__ZN7WebCore26JSXPathExpressionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsXPathExpressionPrototypeFunctionEvaluateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17JSXPathExpression9classInfoEv
-__ZNK7WebCore11XPathResult11numberValueERi
-__ZNK7WebCore23JSProcessingInstruction9classInfoEv
-__ZNK7WebCore21ProcessingInstruction9nodeValueEv
-__ZNK7WebCore14JSCDATASection9classInfoEv
-__ZN7WebCore40jsElementPrototypeFunctionSetAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSElement14setAttributeNSEPN3KJS9ExecStateERKNS1_4ListE
-__ZNK7WebCore11XPathResult15singleNodeValueERi
-__ZNK7WebCore5XPath7NodeSet7anyNodeEv
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateNSResolverEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document16createNSResolverEPNS_4NodeE
-__ZN7WebCore14XPathEvaluator16createNSResolverEPNS_4NodeE
-__ZN7WebCore21NativeXPathNSResolverC1EN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_15XPathNSResolverE
-__ZN7WebCore26JSXPathNSResolverPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSXPathNSResolverC1EPN3KJS8JSObjectEPNS_15XPathNSResolverE
-__ZNK7WebCore17JSXPathNSResolver9classInfoEv
-__ZN7WebCore21NativeXPathNSResolver18lookupNamespaceURIERKNS_6StringE
-__ZNK7WebCore4Node18lookupNamespaceURIERKNS_6StringE
-__ZN7WebCore14warningHandlerEPvPKcz
-__ZN7WebCore17JSXPathExpressionD0Ev
-__ZN7WebCore17JSXPathNSResolverD0Ev
-__ZN7WebCore21NativeXPathNSResolverD1Ev
-__ZN3KJS51jsXSLTProcessorPrototypeFunctionTransformToDocumentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor19transformToDocumentEPNS_4NodeE
-__Z17initxsltGetNsPropP8_xmlNodePKhS2_
-__ZN7WebCore16DeprecatedString8fromUtf8EPKc
-__ZN7WebCore13XSLStyleSheet14loadChildSheetERKNS_16DeprecatedStringE
-__ZN7WebCore13XSLImportRuleC1EPNS_9StyleBaseERKNS_6StringE
-__ZN7WebCore13XSLImportRule9loadSheetEv
-__ZNK7WebCore13XSLStyleSheet15isXSLStyleSheetEv
-__ZNK7WebCore13XSLImportRule16parentStyleSheetEv
-__ZN7WebCore9DocLoader20requestXSLStyleSheetERKNS_6StringE
-__ZN7WebCore19CachedXSLStyleSheetC1EPNS_9DocLoaderERKNS_6StringE
-__ZN7WebCore19CachedXSLStyleSheet5errorEv
-__ZN7WebCore19CachedXSLStyleSheet11checkNotifyEv
-__ZN7WebCore19CachedXSLStyleSheet3refEPNS_20CachedResourceClientE
-__ZN7WebCore13docLoaderFuncEPKhP8_xmlDictiPv12xsltLoadType
-__ZN7WebCore13XSLStyleSheet27locateStylesheetSubResourceEP7_xmlDocPKh
-__ZThn4_N7WebCore13XSLImportRule12isImportRuleEv
-__ZN7WebCore13XSLImportRule12isImportRuleEv
-__ZN7WebCore50jsDOMImplementationPrototypeFunctionCreateDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14toDocumentTypeEPN3KJS7JSValueE
-__ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringES3_PNS_12DocumentTypeERi
-__ZNK7WebCore21ProcessingInstruction8toStringEv
-__ZN7WebCore13XSLTProcessor24createDocumentFromSourceERKNS_6StringES3_S3_PNS_4NodeEPNS_5FrameE
-__ZN3KJS44jsXSLTProcessorPrototypeFunctionGetParameterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK7WebCore13XSLTProcessor12getParameterERKNS_6StringES3_
-__ZN3KJS47jsXSLTProcessorPrototypeFunctionRemoveParameterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor15removeParameterERKNS_6StringES3_
-__ZN3KJS47jsXSLTProcessorPrototypeFunctionClearParametersEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore7Element5styleEv
-__ZN7WebCore8Document18setTransformSourceEPv
-__ZN7WebCore19CachedXSLStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZThn52_N7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
-__ZN7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
-__ZN7WebCore13XSLStyleSheet11checkLoadedEv
-__ZN7WebCore13XSLStyleSheet9isLoadingEv
-__ZN7WebCore8Document17applyXSLTransformEPNS_21ProcessingInstructionE
-__ZN7WebCore9matchFuncEPKc
-__ZN7WebCore8openFuncEPKc
-__ZN7WebCore8readFuncEPvPci
-__ZN7WebCore9closeFuncEPv
-__ZN7WebCore9errorFuncEPvPKcz
-__ZN7WebCore13XSLTProcessor14parseErrorFuncEPvP9_xmlError
-__Z24initxsltLoadStylesheetPIP7_xmlDoc
-__Z18initxsltNextImportP15_xsltStylesheet
-__ZN7WebCore20exsltNodeSetFunctionEP22_xmlXPathParserContexti
-__Z23initxsltFunctionNodeSetP22_xmlXPathParserContexti
-__ZN7WebCore13XSLImportRule9isLoadingEv
-__ZN7WebCore23xsltUnicodeSortFunctionEP21_xsltTransformContextPP8_xmlNodei
-__Z25initxsltComputeSortResultP21_xsltTransformContextP8_xmlNode
-__ZN7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
-__ZN7WebCore13XSLStyleSheetC1EPNS_13XSLImportRuleERKNS_6StringE
-__ZN7WebCore13XSLStyleSheet15markAsProcessedEv
-__ZN7WebCore17raiseDOMExceptionEi
-__ZN7WebCore16videoConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLVideoElementC1EPNS_8DocumentE
-__ZN7WebCore16HTMLMediaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLVideoElement11tagPriorityEv
-__ZN7WebCore16HTMLMediaElement20insertedIntoDocumentEv
-__ZNK7WebCore16HTMLMediaElement3srcEv
-__ZN7WebCore16HTMLVideoElement6attachEv
-__ZN7WebCore16HTMLMediaElement6attachEv
-__ZN7WebCore16HTMLVideoElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLVideoElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderVideoC1EPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMediaC2EPNS_16HTMLMediaElementERKNS_7IntSizeE
-__ZNK7WebCore11RenderMedia10firstChildEv
-__ZN7WebCore11RenderVideo17updateFromElementEv
-__ZN7WebCore11RenderMedia17updateFromElementEv
-__ZN7WebCore11RenderMedia14updateControlsEv
-__ZNK7WebCore11RenderMedia12mediaElementEv
-__ZNK7WebCore16HTMLMediaElement8controlsEv
-__ZN7WebCore11RenderVideo12updatePlayerEv
-__ZNK7WebCore11RenderMedia6playerEv
-__ZN7WebCore18createVideoWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLVideoElementC1EPN3KJS8JSObjectEPNS_16HTMLVideoElementE
-__ZN7WebCore18JSHTMLMediaElementC2EPN3KJS8JSObjectEPNS_16HTMLMediaElementE
-__ZN7WebCore18JSHTMLVideoElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLMediaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLMediaElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLVideoElement9classInfoEv
-__ZN7WebCore18JSHTMLVideoElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLMediaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLMediaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLMediaElement6setSrcERKNS_6StringE
-__ZN7WebCore16HTMLMediaElement16attributeChangedEPNS_9AttributeEb
-__ZN7WebCore16HTMLVideoElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16HTMLMediaElement12scheduleLoadEv
-__ZN7WebCore11RenderVideo6layoutEv
-__ZN7WebCore11RenderMedia6layoutEv
-__ZNK7WebCore11RenderVideo17calcReplacedWidthEv
-__ZNK7WebCore11RenderVideo16isWidthSpecifiedEv
-__ZNK7WebCore11RenderVideo20calcAspectRatioWidthEv
-__ZN7WebCore11RenderVideo14calcPrefWidthsEv
-__ZNK7WebCore11RenderVideo18calcReplacedHeightEv
-__ZNK7WebCore11RenderVideo17isHeightSpecifiedEv
-__ZNK7WebCore11RenderVideo21calcAspectRatioHeightEv
-__ZN7WebCore11RenderVideo13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore5TimerINS_16HTMLMediaElementEE5firedEv
-__ZN7WebCore16HTMLMediaElement14loadTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore16HTMLMediaElement4loadERi
-__ZNK7WebCore16HTMLMediaElement19defaultPlaybackRateEv
-__ZN7WebCore16HTMLMediaElement15setPlaybackRateEfRi
-__ZNK7WebCore16HTMLMediaElement12networkStateEv
-__ZN7WebCore16HTMLMediaElement9pickMediaEv
-__ZN7WebCore15EventTargetNode21dispatchProgressEventERKNS_12AtomicStringEbjj
-__ZN7WebCore13ProgressEventC1ERKNS_12AtomicStringEbjj
-__ZN7WebCore16HTMLMediaElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore11RenderMedia7isMediaEv
-__ZN7WebCore11RenderMedia12forwardEventEPNS_5EventE
-__ZN7WebCore13ProgressEventD1Ev
-__ZN7WebCore11MediaPlayerC1EPNS_17MediaPlayerClientE
-__ZN7WebCore18MediaPlayerPrivateC1EPNS_11MediaPlayerE
--[WebCoreMovieObserver initWithCallback:]
-__ZN7WebCore16HTMLMediaElement12updateVolumeEv
-__ZN7WebCore11MediaPlayer9setVolumeEf
-__ZNK7WebCore11RenderVideo8videoBoxEv
-__ZN7WebCore11MediaPlayer7setRectERKNS_7IntRectE
-__ZN7WebCore18MediaPlayerPrivate7setRectERKNS_7IntRectE
-__ZN7WebCore11MediaPlayer10setVisibleEb
-__ZN7WebCore18MediaPlayerPrivate10setVisibleEb
-__ZN7WebCore18MediaPlayerPrivate17createQTMovieViewEv
-__ZN7WebCore18MediaPlayerPrivate17detachQTMovieViewEv
-__ZN7WebCore11MediaPlayer4loadENS_6StringE
-__ZN7WebCore18MediaPlayerPrivate4loadERKNS_6StringE
-__ZN7WebCore11MediaPlayer19networkStateChangedEv
-__ZThn68_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore11MediaPlayer12networkStateEv
-__ZN7WebCore18MediaPlayerPrivate10cancelSeekEv
--[WebCoreMovieObserver setDelayCallbacks:]
-__ZN7WebCore18MediaPlayerPrivate13createQTMovieERKNS_6StringE
-__Z40initQTSecurityPolicyNoCrossSiteAttributev
-__Z12QTKitLibraryv
-__Z43initQTMoviePreventExternalURLLinksAttributev
-__Z23initQTMovieURLAttributev
-__Z11initQTMoviev
-__ZNK7WebCore11MediaPlayer7visibleEv
--[WebCoreMovieObserver loadStateChanged:]
-__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionPlayEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLMediaElement4playERi
-__Z44QTSecurityPolicyNoCrossSiteAttributeFunctionv
-__Z47QTMoviePreventExternalURLLinksAttributeFunctionv
-__Z27QTMovieURLAttributeFunctionv
-__Z15QTMovieFunctionv
-__ZNK7WebCore11MediaPlayer6volumeEv
-__Z41initQTMovieLoadStateDidChangeNotificationv
-__Z36initQTMovieRateDidChangeNotificationv
-__Z36initQTMovieSizeDidChangeNotificationv
-__Z36initQTMovieTimeDidChangeNotificationv
-__Z29initQTMovieDidEndNotificationv
-__Z15initQTMovieViewv
--[WebCoreMovieObserver sizeChanged:]
-__ZNK7WebCore16HTMLMediaElement13endedPlaybackEv
-__ZNK7WebCore11MediaPlayer4rateEv
-__ZN7WebCore16HTMLMediaElement18dispatchEventAsyncERKNS_12AtomicStringE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE15reserveCapacityEm
-__ZN7WebCore16HTMLMediaElement15updatePlayStateEv
-__ZNK7WebCore16HTMLMediaElement11currentLoopEv
-__ZNK7WebCore16HTMLMediaElement9playCountEv
-__ZNK7WebCore16HTMLMediaElement12effectiveEndEv
-__ZNK7WebCore11MediaPlayer8durationEv
-__ZNK7WebCore18MediaPlayerPrivate8durationEv
-__ZNK7WebCore16HTMLMediaElement9loopStartEv
-__ZNK7WebCore16HTMLMediaElement22getTimeOffsetAttributeERKNS_13QualifiedNameEf
-__ZN7WebCore15parseTimeOffsetENS_6StringEPb
-__ZNK7WebCore16HTMLMediaElement5startEv
-__ZNK7WebCore16HTMLMediaElement3endEv
-__ZN7WebCore11MediaPlayer10setEndTimeEf
-__ZN7WebCore18MediaPlayerPrivate10setEndTimeEf
-__ZN7WebCore18MediaPlayerPrivate26startEndPointTimerIfNeededEv
-__ZNK7WebCore16HTMLMediaElement15activelyPlayingEv
-__ZNK7WebCore16HTMLMediaElement6pausedEv
-__ZNK7WebCore16HTMLMediaElement10readyStateEv
-__ZNK7WebCore11MediaPlayer6pausedEv
-__ZNK7WebCore18MediaPlayerPrivate6pausedEv
-__ZN7WebCore18MediaPlayerPrivate16loadStateChangedEv
-__ZN7WebCore18MediaPlayerPrivate12updateStatesEv
-__ZNK7WebCore18MediaPlayerPrivate7seekingEv
-__ZN7WebCore16HTMLMediaElement28initAndDispatchProgressEventERKNS_12AtomicStringE
-__ZN7WebCore11MediaPlayer15totalBytesKnownEv
-__ZNK7WebCore18MediaPlayerPrivate15totalBytesKnownEv
-__ZNK7WebCore18MediaPlayerPrivate10totalBytesEv
-__ZN7WebCore11MediaPlayer11bytesLoadedEv
-__ZNK7WebCore18MediaPlayerPrivate11bytesLoadedEv
-__ZN7WebCore11MediaPlayer10totalBytesEv
-__ZNK7WebCore16HTMLVideoElement7isVideoEv
-__ZN7WebCore16HTMLVideoElement17updatePosterImageEv
-__ZNK7WebCore16HTMLVideoElement6posterEv
-__ZN7WebCore16HTMLMediaElement20asyncEventTimerFiredEPNS_5TimerIS0_EE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE6shrinkEm
-__ZN7WebCore11MediaPlayer5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore18MediaPlayerPrivate5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__Z29initQTMovieLoadStateAttributev
-__Z28initQTMovieDataSizeAttributev
-__Z32QTMovieDataSizeAttributeFunctionv
-__Z33QTMovieLoadStateAttributeFunctionv
-__ZN7WebCore16HTMLVideoElement6detachEv
-__ZN7WebCore11RenderMediaD0Ev
-__ZN7WebCore16HTMLVideoElementD1Ev
-__ZN7WebCore11MediaPlayerD1Ev
-__ZN7WebCore18MediaPlayerPrivateD1Ev
--[WebCoreMovieObserver disconnect]
-__Z45QTMovieLoadStateDidChangeNotificationFunctionv
-__Z40QTMovieRateDidChangeNotificationFunctionv
-__Z40QTMovieSizeDidChangeNotificationFunctionv
-__Z40QTMovieTimeDidChangeNotificationFunctionv
-__Z33QTMovieDidEndNotificationFunctionv
-__Z19QTMovieViewFunctionv
-__ZNK7WebCore11RenderMedia9lastChildEv
-__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionLoadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLMediaElement19removedFromDocumentEv
-__ZN7WebCore16HTMLMediaElement5pauseERi
-__ZN7WebCore10HTMLParser23isindexCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser13handleIsindexEPNS_5TokenE
-__ZN7WebCore18HTMLIsIndexElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore27searchableIndexIntroductionEv
-__ZN7WebCore20JSHTMLIsIndexElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore32jsDOMWindowPrototypeFunctionStopEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow4stopEv
-__ZN7WebCore11FrameLoader25scheduleCheckLoadCompleteEv
-__ZNK7WebCore17HTMLObjectElement24imageSourceAttributeNameEv
-__ZN7WebCore11FrameLoader27checkLoadCompleteTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore8Document10setCharsetERKNS_6StringE
-__ZN7WebCore4KURL14setHostAndPortERKNS_16DeprecatedStringE
-__ZN7WebCore25jsLocationProtoFuncAssignEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore18JSHistoryPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore9JSHistory9classInfoEv
-__ZN3KJS49jsXMLHttpRequestPrototypeFunctionAddEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN3WTF9HashTableIiSt4pairIiNS_6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEEENS_18PairFirstExtractorIS8_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSE_IS7_EEEESF_E4findIiNS_22IdentityHashTranslatorIiS8_SC_EEEENS_17HashTableIteratorIiS8_SA_SC_SH_SF_EERKT_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE15reserveCapacityEm
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiNS_6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEEENS_18PairFirstExtractorIS8_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSE_IS7_EEEESF_E3addIPNS4_16AtomicStringImplES7_NS_17HashMapTranslatorILb1ES1_ISL_S7_ENS_18PairBaseHashTraitsINSE_ISL_EESG_EESH_NS_7PtrHashISL_EEEEEES1_INS_17HashTableIteratorIiS8_SA_SC_SH_SF_EEbERKT_RKT0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC1ERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEaSERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE6shrinkEm
-__ZN7WebCore34newStreamingTextDecoderUserDefinedERKNS_12TextEncodingEPKv
-__ZN7WebCore20TextCodecUserDefined6decodeEPKcmb
-__ZN7WebCore20TextCodecUserDefinedD1Ev
--[WebCoreSynchronousLoader connection:didFailWithError:]
-__ZN7WebCore20ResourceResponseBase17setHTTPStatusCodeEi
-__ZNK7WebCore8Document8toStringEv
-__ZNK7WebCore7Element8toStringEv
-__ZNK7WebCore7Element20openTagStartToStringEv
-__ZNK7WebCore4Text8toStringEv
-__ZN7WebCoreplERKNS_16DeprecatedStringEc
-__ZN3KJS46jsXMLHttpRequestPrototypeFunctionDispatchEventEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS52jsXMLHttpRequestPrototypeFunctionRemoveEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore17circleConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGCircleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16SVGCircleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGCircleElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore16SVGCircleElement14setCxBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement5setCxENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement14setCyBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement5setCyENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement13setRBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement4setRENS_9SVGLengthE
-__ZNK7WebCore16SVGCircleElement1rEv
-__ZN7WebCore8Document7scriptsEv
-__ZN7WebCore11RenderMedia24createControlsShadowRootEv
-__ZN7WebCore29MediaControlShadowRootElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia11createPanelEv
-__ZN7WebCore11RenderMedia16createMuteButtonEv
-__ZN7WebCore29MediaControlMuteButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElementC2EPNS_8DocumentENS_11RenderStyle8PseudoIdENS_6StringEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElement14attachToParentEPNS_7ElementE
-__ZN7WebCore11RenderMedia16createPlayButtonEv
-__ZN7WebCore29MediaControlPlayButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia14createTimelineEv
-__ZN7WebCore27MediaControlTimelineElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia20createSeekBackButtonEv
-__ZN7WebCore29MediaControlSeekButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
-__ZN7WebCore11RenderMedia23createSeekForwardButtonEv
-__ZN7WebCore11RenderMedia17createTimeDisplayEv
-__ZN7WebCore11RenderMedia22createFullscreenButtonEv
-__ZN7WebCore35MediaControlFullscreenButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElement6updateEv
-__ZN7WebCore27MediaControlTimelineElement6updateEb
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement11currentTimeEv
-__ZNK7WebCore29MediaControlShadowRootElement12isShadowNodeEv
-__ZN7WebCore29MediaControlShadowRootElement16shadowParentNodeEv
-__ZN7WebCore11RenderMedia17updateTimeDisplayEv
-__ZN7WebCore11RenderMedia10formatTimeEf
-__ZN7WebCore11RenderMedia23updateControlVisibilityEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLMediaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLMediaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLMediaElement8autoplayEv
-__ZN7WebCore16HTMLMediaElement11setAutoplayEb
-__ZN7WebCore7Element19setBooleanAttributeERKNS_13QualifiedNameEb
-__ZN7WebCore29JSHTMLMediaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore29JSHTMLMediaElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSHTMLMediaElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLMediaElement8setStartEf
-__ZN7WebCore16HTMLMediaElement22setTimeOffsetAttributeERKNS_13QualifiedNameEf
-__ZN7WebCore19serializeTimeOffsetEf
-__ZN7WebCore16HTMLMediaElement17checkIfSeekNeededEv
-__ZNK7WebCore11MediaPlayer11currentTimeEv
-__ZNK7WebCore18MediaPlayerPrivate11currentTimeEv
-__ZNK7WebCore16HTMLMediaElement5endedEv
-__ZN7WebCore40jsHTMLMediaElementPrototypeFunctionPauseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLMediaElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17sourceConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLSourceElementC1EPNS_8DocumentE
-__ZNK7WebCore17HTMLSourceElement17endTagRequirementEv
-__ZNK7WebCore17HTMLSourceElement11tagPriorityEv
-__ZN7WebCore17HTMLSourceElement20insertedIntoDocumentEv
-__ZNK7WebCore18JSAudioConstructor19implementsConstructEv
-__ZN7WebCore18JSAudioConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore16audioConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLAudioElementC1EPNS_8DocumentE
-__ZN7WebCore18createAudioWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLAudioElementC1EPN3KJS8JSObjectEPNS_16HTMLAudioElementE
-__ZNK7WebCore29JSHTMLAudioElementConstructor21implementsHasInstanceEv
-__ZN7WebCore29JSHTMLAudioElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLAudioElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLAudioElement9classInfoEv
-__ZNK7WebCore13ProgressEvent15isProgressEventEv
-__ZN7WebCore15JSProgressEventC1EPN3KJS8JSObjectEPNS_13ProgressEventE
-__ZNK7WebCore16HTMLMediaElement10currentSrcEv
-__ZNK7WebCore16HTMLMediaElement7isVideoEv
-__ZNK7WebCore16HTMLAudioElement11tagPriorityEv
-__ZN7WebCore16HTMLMediaElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLMediaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderMediaC1EPNS_16HTMLMediaElementE
-__ZNK7WebCore16HTMLMediaElement16effectiveLoopEndEv
-__ZNK7WebCore16HTMLMediaElement7loopEndEv
-__ZNK7WebCore16HTMLMediaElement8bufferedEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10TimeRangesE
-__ZN7WebCore21JSTimeRangesPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSTimeRangesC1EPN3KJS8JSObjectEPNS_10TimeRangesE
-__ZN7WebCore12JSTimeRanges18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore12JSTimeRangesEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSTimeRanges16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSTimeRangesPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34jsTimeRangesPrototypeFunctionStartEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSTimeRanges9classInfoEv
-__ZNK7WebCore10TimeRanges5startEjRi
-__ZN7WebCore32jsTimeRangesPrototypeFunctionEndEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore10TimeRanges3endEjRi
-__ZNK7WebCore16HTMLVideoElement24imageSourceAttributeNameEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLVideoElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLVideoElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLMediaElement6setEndEf
-__ZN7WebCore16HTMLMediaElement10setLoopEndEf
-__ZNK7WebCore16HTMLMediaElement5mutedEv
-__ZN7WebCore16HTMLMediaElement8setMutedEb
-__ZN7WebCore18MediaPlayerPrivate9setVolumeEf
-__ZN7WebCore19createSourceWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLSourceElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLSourceElementC1EPN3KJS8JSObjectEPNS_17HTMLSourceElementE
-__ZN7WebCore19JSHTMLSourceElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLSourceElement9classInfoEv
-__ZNK7WebCore16HTMLMediaElement5errorEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10MediaErrorE
-__ZNK7WebCore16HTMLVideoElement10videoWidthEv
-__ZNK7WebCore16HTMLVideoElement11videoHeightEv
-__ZN7WebCore16HTMLMediaElement12setPlayCountEjRi
-__ZNK7WebCore29JSHTMLMediaElementConstructor21implementsHasInstanceEv
-__ZNK7WebCore29JSHTMLVideoElementConstructor21implementsHasInstanceEv
-__ZN7WebCore29JSHTMLVideoElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSTimeRangesD0Ev
-__ZNK7WebCore16HTMLMediaElement8seekableEv
-__ZNK7WebCore16HTMLVideoElement5widthEv
-__ZNK7WebCore16HTMLVideoElement6heightEv
-__ZN7WebCore18JSHTMLVideoElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLVideoElement8setWidthEi
-__ZN7WebCore16HTMLVideoElement9setHeightEi
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore16HTMLMediaElement12setLoopStartEf
-__ZN7WebCore14RenderThemeMac20paintMediaMuteButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac20paintMediaPlayButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZN7WebCore14RenderThemeMac21paintMediaSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac21paintMediaSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac24paintMediaSeekBackButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac27paintMediaSeekForwardButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore9CSSParser14parseTransformEv
-__ZN7WebCore23WebKitCSSTransformValueC1ENS0_22TransformOperationTypeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE15reserveCapacityEm
-__ZNK7WebCore19TransformOperationseqERKS0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE6shrinkEm
-__ZN7WebCore18StyleTransformDataC1ERKS0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEaSERKS5_
-__ZNK7WebCore18StyleTransformDataeqERKS0_
-__ZNK7WebCore24RotateTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore24RotateTransformOperation17isRotateOperationEv
-__ZNK7WebCore23ScaleTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore23ScaleTransformOperation16isScaleOperationEv
-__ZNK7WebCore22SkewTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore22SkewTransformOperation15isSkewOperationEv
-__ZNK7WebCore11RenderStyle14applyTransformERNS_15AffineTransformERKNS_7IntSizeE
-__ZNK7WebCore18TransformOperation20isTranslateOperationEv
-__ZN7WebCore24RotateTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore23ScaleTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore22SkewTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore15AffineTransform4skewEdd
-__ZN7WebCore15AffineTransform5shearEdd
-__ZN7WebCore16HTMLMediaElement23progressEventTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore18MediaPlayerPrivate13maxTimeLoadedEv
-__ZN7WebCore15JSProgressEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore15JSProgressEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSProgressEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLSourceElement4typeEv
-__ZN7WebCore16MIMETypeRegistry24isSupportedMediaMIMETypeERKNS_6StringE
-__ZN7WebCore33initialiseSupportedMediaMIMETypesEv
-__ZN7WebCore11MediaPlayer17getSupportedTypesERN3WTF7HashSetINS_6StringENS_10StringHashENS1_10HashTraitsIS3_EEEE
-__ZN7WebCore18MediaPlayerPrivate17getSupportedTypesERN3WTF7HashSetINS_6StringENS_10StringHashENS1_10HashTraitsIS3_EEEE
-__ZNK7WebCore17HTMLSourceElement3srcEv
-__ZN7WebCore12JSMediaErrorC1EPN3KJS8JSObjectEPNS_10MediaErrorE
-__ZN7WebCore12JSMediaError18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore12JSMediaErrorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSMediaError16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSMediaErrorConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore23JSMediaErrorConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSMediaErrorConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLSourceElement5mediaEv
-__ZN7WebCore32min_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore11MediaPlayer15maxTimeBufferedEv
-__ZNK7WebCore18MediaPlayerPrivate15maxTimeBufferedEv
-__ZN7WebCore18MediaPlayerPrivate24disableUnsupportedTracksERj
-__Z20initQTMediaTypeVideov
-__Z20initQTMediaTypeSoundv
-__Z19initQTMediaTypeTextv
-__Z19initQTMediaTypeBasev
-__Z24initQTMediaTypeAttributev
-__ZNK7WebCore16HTMLMediaElement14effectiveStartEv
-__ZN7WebCore11MediaPlayer4seekEf
-__ZN7WebCore18MediaPlayerPrivate4seekEf
-__ZN7WebCore18MediaPlayerPrivate6doSeekEv
-__ZNK7WebCore18MediaPlayerPrivate12createQTTimeEf
-__Z29initQTMovieTimeScaleAttributev
-__Z14initQTMakeTimexl
--[WebCoreMovieObserver rateChanged:]
--[WebCoreMovieObserver timeChanged:]
-__ZN7WebCore16HTMLMediaElement13setReadyStateENS0_10ReadyStateE
-__ZN7WebCore11RenderVideo16videoSizeChangedEv
-__ZN7WebCore11MediaPlayer11naturalSizeEv
-__ZNK7WebCore18MediaPlayerPrivate11naturalSizeEv
-__Z31initQTMovieNaturalSizeAttributev
-__ZN7WebCore11MediaPlayer17readyStateChangedEv
-__ZThn68_N7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore11MediaPlayer10readyStateEv
-__Z28QTMediaTypeAttributeFunctionv
-__Z33QTMovieTimeScaleAttributeFunctionv
-__Z35QTMovieNaturalSizeAttributeFunctionv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement4seekEfRi
-__ZN7WebCore11MediaPlayer15maxTimeSeekableEv
-__ZNK7WebCore18MediaPlayerPrivate15maxTimeSeekableEv
-__ZN7WebCore10TimeRangesC1Eff
-__ZN7WebCore10TimeRanges3addEff
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE15reserveCapacityEm
-__ZNK7WebCore10TimeRanges7containEf
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE6shrinkEm
-__ZN7WebCore35MediaControlFullscreenButtonElementD1Ev
-__ZN7WebCore11MediaPlayer4playEv
-__ZN7WebCore18MediaPlayerPrivate4playEv
--[WebCoreMovieObserver didEnd:]
-__ZN7WebCore18MediaPlayerPrivate6didEndEv
-__ZN7WebCore11MediaPlayer11timeChangedEv
-__ZThn68_N7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
-__ZNK7WebCore16HTMLMediaElement18effectiveLoopStartEv
-__ZN7WebCore11RenderMedia11removeChildEPNS_12RenderObjectE
-__ZN7WebCore16HTMLMediaElement11setControlsEb
-__ZNK7WebCore16HTMLMediaElement7seekingEv
-__ZN7WebCore25mainThreadSetNeedsDisplayEP11objc_objectP13objc_selector
--[WebCoreMovieObserver repaint]
-__ZN7WebCore18MediaPlayerPrivate7repaintEv
-__ZN7WebCore11MediaPlayer7repaintEv
-__ZThn68_N7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
-__ZN7WebCore18MediaPlayerPrivate11rateChangedEv
-__ZN7WebCore18MediaPlayerPrivate11timeChangedEv
-__ZN7WebCore11MediaPlayer5pauseEv
-__ZN7WebCore18MediaPlayerPrivate5pauseEv
-__ZN7WebCore5TimerINS_18MediaPlayerPrivateEE5firedEv
-__ZN7WebCore18MediaPlayerPrivate18endPointTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore5TimerINS_11RenderMediaEE5firedEv
-__ZN7WebCore11RenderMedia26opacityAnimationTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11RenderMedia13changeOpacityEPNS_11HTMLElementEf
-__ZN7WebCore11RenderMedia20timeUpdateTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore23WebKitCSSTransformValueD1Ev
-__ZN7WebCore14RenderReplaced13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore28JSHTMLSourceElementPrototypeD0Ev
-__ZN7WebCore14ResourceHandle22scheduleBlockedFailureEv
-__ZN7WebCore5TimerINS_14ResourceHandleEE5firedEv
-__ZN7WebCore14ResourceHandle18fireBlockedFailureEPNS_5TimerIS0_EE
-__ZN7WebCore14ResourceLoader10wasBlockedEPNS_14ResourceHandleE
-__ZN7WebCore14ResourceLoader10wasBlockedEv
-__ZN7WebCore14ResourceLoader12blockedErrorEv
-__ZNK7WebCore11FrameLoader12blockedErrorERKNS_15ResourceRequestE
-__ZN7WebCore5TimerINS_14ResourceHandleEED1Ev
-__ZN7WebCore40jsDOMWindowPrototypeFunctionOpenDatabaseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow12openDatabaseERKNS_6StringES3_S3_mRi
-__ZN7WebCore8Database12openDatabaseEPNS_8DocumentERKNS_6StringES5_S5_mRi
-__ZN7WebCore15DatabaseTracker20canEstablishDatabaseEPNS_8DocumentERKNS_6StringES5_m
-__ZN7WebCore15DatabaseTracker14usageForOriginEPNS_14SecurityOriginE
-__ZN7WebCore15DatabaseTracker18originQuotaManagerEv
-__ZN7WebCore18OriginQuotaManager4lockEv
-__ZNK7WebCore18OriginQuotaManager12tracksOriginEPNS_14SecurityOriginE
-__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E8containsIS4_NS_22IdentityHashTranslatorIS4_S6_S9_EEEEbRKT_
-__ZN7WebCore18OriginQuotaManager11trackOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
-__ZN7WebCore17OriginUsageRecordC1Ev
-__ZN7WebCore17OriginUsageRecord16unknownDiskUsageEv
-__ZN7WebCore18SecurityOriginHash4hashEN3WTF6RefPtrINS_14SecurityOriginEEE
-__ZN7WebCore15DatabaseTracker22databaseNamesForOriginEPNS_14SecurityOriginERN3WTF6VectorINS_6StringELm0EEE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E6lookupIS4_NS_22IdentityHashTranslatorIS4_S6_S9_EEEEPS6_RKT_
-__ZNK7WebCore18OriginQuotaManager9diskUsageEPNS_14SecurityOriginE
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS2_20SecurityOriginTraitsENS_10HashTraitsIS6_EEE3getERKS4_
-__ZN7WebCore17OriginUsageRecord9diskUsageEv
-__ZN7WebCore18OriginQuotaManager6unlockEv
-__ZN7WebCore15DatabaseTracker19hasEntryForDatabaseEPNS_14SecurityOriginERKNS_6StringE
-__ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS2_20SecurityOriginTraitsENS_10HashTraitsIyEEE3setEPS3_RKy
-__ZN7WebCore15DatabaseTracker23detailsForNameAndOriginERKNS_6StringEPNS_14SecurityOriginE
-__ZN7WebCore15DatabaseTracker8setQuotaEPNS_14SecurityOriginEy
-__ZN7WebCore7CString11mutableDataEv
-__ZN7WebCore7CString18copyBufferIfNeededEv
-__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_xENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIxEEEESB_E8containsIS4_NS_22IdentityHashTranslatorIS4_S6_S9_EEEEbRKT_
-__ZNK7WebCore14SecurityOrigin16stringIdentifierEv
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_xENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIxEEEESB_E3addIS4_S6_NS_22IdentityHashTranslatorIS4_S6_S9_EEEES5_INS_17HashTableIteratorIS4_S6_S8_S9_SE_SB_EEbERKT_RKT0_
-__ZN7WebCore8DatabaseC1EPNS_8DocumentERKNS_6StringES5_
-__ZNK7WebCore14SecurityOrigin8toStringEv
-__ZN7WebCore8Database20guidForOriginAndNameERKNS_6StringES3_
-__ZNK3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3getERKS2_
-__ZN3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3setERKS2_RKi
-__ZN7WebCore8Database9guidMutexEv
-__ZN7WebCore8Database17guidToDatabaseMapEv
-__ZN3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3setERKiRKSA_
-__ZN3WTF7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore8Document14databaseThreadEv
-__ZN7WebCore14DatabaseThreadC1EPNS_8DocumentE
-__ZN7WebCore14DatabaseThread5startEv
-__ZN7WebCore15DatabaseTracker19fullPathForDatabaseEPNS_14SecurityOriginERKNS_6StringEb
-__ZN7WebCore14DatabaseThread19databaseThreadStartEPv
-__ZNK7WebCore15DatabaseTracker10originPathEPNS_14SecurityOriginE
-__ZN7WebCore14DatabaseThread14databaseThreadEv
-__ZN7WebCore14DatabaseThread26dispatchNextTaskIdentifierEv
-__ZN7WebCore15DatabaseTracker11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
-__ZN7WebCore18OriginQuotaManager11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
-__ZN7WebCore17OriginUsageRecord11addDatabaseERKNS_6StringES3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS1_6StringES6_NS_17HashMapTranslatorILb0ES4_ISI_S6_ENS_18PairBaseHashTraitsINSC_ISI_EESE_EESF_SA_EEEES4_INS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS7_
-__ZN7WebCore15DatabaseTracker15addOpenDatabaseEPNS_8DatabaseE
-__ZNK7WebCore8Database18securityOriginCopyEv
-__ZN7WebCore14SecurityOrigin4copyEv
-__ZNK7WebCore8Database16stringIdentifierEv
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEENS2_10StringHashENSB_IS5_EENSB_ISE_EEEENS2_18SecurityOriginHashENS2_20SecurityOriginTraitsENSB_ISJ_EEE3getEPS3_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E3addIS4_PNS2_17OriginUsageRecordENS_17HashMapTranslatorILb1ES5_IS4_SI_ENS_18PairBaseHashTraitsISB_NSC_ISI_EEEESE_S9_EEEES5_INS_17HashTableIteratorIS4_S6_S8_S9_SE_SB_EEbERKT_RKT0_
-__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3setERKS2_RKSB_
-__ZN7WebCore8Database20openAndVerifyVersionERi
-__ZN7WebCore18DatabaseAuthorizerC1Ev
-__ZN7WebCore18DatabaseAuthorizer5resetEv
-__ZN7WebCore16DatabaseOpenTaskC1Ev
-__ZN7WebCore12DatabaseTaskC2Ev
-__ZN7WebCore12DatabaseTask28lockForSynchronousSchedulingEv
-__ZN7WebCore14DatabaseThread21scheduleImmediateTaskEPNS_8DatabaseEPNS_12DatabaseTaskE
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore8DatabaseEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZNK3WTF7HashMapIPN7WebCore8DatabaseEPNS_5DequeINS_6RefPtrINS1_12DatabaseTaskEEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSC_IS9_EEE3getERKS3_
-__ZN7WebCore14DatabaseThread14wakeWorkThreadEv
-__ZN7WebCore12DatabaseTask28waitForSynchronousCompletionEv
-__ZN7WebCore8Database15resetAuthorizerEv
-__ZN7WebCore12DatabaseTask11performTaskEPNS_8DatabaseE
-__ZN7WebCore16DatabaseOpenTask13doPerformTaskEPNS_8DatabaseE
-__ZN7WebCore8Database20performOpenAndVerifyERi
-__ZN7WebCore14SQLiteDatabase13setAuthorizerEN3WTF10PassRefPtrINS_16SQLiteAuthorizerEEE
-__ZN7WebCore14SQLiteDatabase16enableAuthorizerEb
-_sqlite3_set_authorizer
-__ZN7WebCore8Database21databaseInfoTableNameEv
-__ZN7WebCore14SQLiteDatabase18authorizerFunctionEPviPKcS3_S3_S3_
-__ZN7WebCore16SQLiteAuthorizer11allowSelectEv
-__ZN7WebCore18DatabaseAuthorizer9allowReadERKNS_6StringES3_
-__ZN7WebCore18DatabaseAuthorizer20denyBasedOnTableNameERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11allowInsertERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11createTableERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11createIndexERKNS_6StringES3_
-__ZN7WebCore18DatabaseAuthorizer11allowUpdateERKNS_6StringES3_
-__ZN7WebCore8Database16guidToVersionMapEv
-__ZNK3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
-__ZN7WebCore8Database22getVersionFromDatabaseERNS_6StringE
-__ZN7WebCore18databaseVersionKeyEv
-__ZN7WebCore18DatabaseAuthorizer7disableEv
-__ZN7WebCore18DatabaseAuthorizer6enableEv
-__ZN7WebCore8Database20setVersionInDatabaseERKNS_6StringE
-__ZN3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
-__ZN7WebCore8Database19performPolicyChecksEv
-__ZN7WebCore16DatabaseOpenTaskD1Ev
-__ZN7WebCore12DatabaseTaskD0Ev
-__ZN7WebCore15ThreadConditionD1Ev
-__ZN7WebCore15DatabaseTracker18setDatabaseDetailsEPNS_14SecurityOriginERKNS_6StringES5_m
-__ZN7WebCore19InspectorController15didOpenDatabaseEPNS_8DatabaseERKNS_6StringES5_S5_
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8DatabaseE
-__ZN7WebCore19JSDatabasePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSDatabaseC1EPN3KJS8JSObjectEPNS_8DatabaseE
-__ZN7WebCore10JSDatabase18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSDatabasePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsDatabasePrototypeFunctionTransactionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore10JSDatabase9classInfoEv
-__ZN7WebCore10JSDatabase11transactionEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore30JSCustomSQLTransactionCallbackC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore8Database11transactionEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS2_INS_27SQLTransactionErrorCallbackEEENS2_INS_12VoidCallbackEEE
-__ZN7WebCore14SQLTransactionC1EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallbackEEENS4_INS_21SQLTransactionWrapperEEE
-__ZN7WebCore8Database19scheduleTransactionEN3WTF10PassRefPtrINS_14SQLTransactionEEE
-__ZN7WebCore16ThreadSafeSharedINS_14SQLTransactionEE5derefEv
-__ZN7WebCore23DatabaseTransactionTaskC1Ev
-__ZN7WebCore14DatabaseThread12scheduleTaskEPNS_8DatabaseEPNS_12DatabaseTaskE
-__ZN7WebCore23DatabaseTransactionTask13doPerformTaskEPNS_8DatabaseE
-__ZN7WebCore8Database22performTransactionStepEv
-__ZN7WebCore8Database19globalCallbackMutexEv
-__ZN7WebCore14SQLTransaction15performNextStepEv
-__ZN7WebCore14SQLTransaction27openTransactionAndPreflightEv
-__ZNK7WebCore8Database11maximumSizeEv
-__ZN3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN7WebCore11getFileSizeERKNS_6StringERx
-__ZNK7WebCore8Database12databaseSizeEv
-__ZN7WebCore14SQLiteDatabase14setMaximumSizeEx
-__ZN7WebCore14SQLiteDatabase8pageSizeEv
-_returnSingleInt
-__ZN7WebCore6String6numberEx
-__ZN7WebCore18DatabaseAuthorizer16allowTransactionEv
-__ZN7WebCore8Database27scheduleTransactionCallbackEPNS_14SQLTransactionE
-__ZN7WebCore8Database17globalCallbackSetEv
-__ZN7WebCore23DatabaseTransactionTaskD1Ev
-__ZN7WebCore8Database26deliverAllPendingCallbacksEPv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE6resizeEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE15reserveCapacityEm
-__ZN7WebCore8Database22deliverPendingCallbackEv
-__ZN7WebCore14SQLTransaction22performPendingCallbackEv
-__ZN7WebCore14SQLTransaction26deliverTransactionCallbackEv
-__ZN7WebCore30JSCustomSQLTransactionCallback11handleEventEPNS_14SQLTransactionERb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14SQLTransactionE
-__ZN7WebCore25JSSQLTransactionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSQLTransactionC1EPN3KJS8JSObjectEPNS_14SQLTransactionE
-__ZN7WebCore25JSSQLTransactionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsSQLTransactionPrototypeFunctionExecuteSqlEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSSQLTransaction9classInfoEv
-__ZN7WebCore16JSSQLTransaction10executeSqlEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore14SQLTransaction10executeSQLERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_INS_25SQLStatementErrorCallbackEEERi
-__ZN7WebCore12SQLStatementC1ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_INS_25SQLStatementErrorCallbackEEE
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC1ERKS3_
-__ZNK7WebCore8Database22versionMatchesExpectedEv
-__ZN7WebCore14SQLTransaction16enqueueStatementEN3WTF10PassRefPtrINS_12SQLStatementEEE
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE15reserveCapacityEm
-__ZN7WebCore8SQLValueC1ERKS0_
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE6shrinkEm
-__ZN7WebCore28JSCustomSQLStatementCallbackC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore33JSCustomSQLStatementErrorCallbackC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore14SQLTransaction23scheduleToRunStatementsEv
-__ZN7WebCore8Database23scheduleTransactionStepEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE6shrinkEm
-__ZN7WebCore14SQLTransaction13runStatementsEv
-__ZN7WebCore14SQLTransaction16getNextStatementEv
-__ZN7WebCore14SQLTransaction19runCurrentStatementEv
-__ZN7WebCore12SQLStatement7executeEPNS_8DatabaseE
-__ZN7WebCore12SQLStatement22clearFailureDueToQuotaEv
-__ZNK7WebCore12SQLStatement29lastExecutionFailedDueToQuotaEv
-_sqlite3ErrorMsg
-__ZN7WebCore14SQLiteDatabase12lastErrorMsgEv
-_sqlite3_errmsg
-__ZN7WebCore14SQLTransaction27handleCurrentStatementErrorEv
-__ZN7WebCore14SQLTransaction22handleTransactionErrorEb
-__ZN7WebCore14SQLTransaction36cleanupAfterTransactionErrorCallbackEv
-__ZN7WebCore17SQLiteTransaction8rollbackEv
-_sqlite3RollbackTransaction
-_sqlite3RollbackAll
-__ZN7WebCore28JSCustomSQLStatementCallbackD1Ev
-__ZN7WebCore33JSCustomSQLStatementErrorCallbackD1Ev
-__ZN7WebCore30JSCustomSQLTransactionCallbackD1Ev
-__ZN7WebCore30JSCustomSQLTransactionCallback10deleteDataEPv
-__ZN7WebCore10JSDatabaseD0Ev
-__ZN7WebCore16JSSQLTransactionD0Ev
-__ZN7WebCore14DatabaseThread17documentGoingAwayEv
-__ZN7WebCore8Database23databaseThreadGoingAwayEv
-__ZN7WebCore8DatabaseD1Ev
-__ZN7WebCore15DatabaseTracker18removeOpenDatabaseEPNS_8DatabaseE
-_sqlite3_close
-__ZN7WebCore18DatabaseAuthorizerD1Ev
-__ZN7WebCore12detachThreadEj
-__ZN7WebCore26pthreadHandleForIdentifierEj
-__ZN7WebCore31clearPthreadHandleForIdentifierEj
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E4findIjNS_22IdentityHashTranslatorIjS2_S6_EEEENS_17HashTableIteratorIjS2_S4_S6_SB_S9_EERKT_
-__ZN7WebCore14DatabaseThreadD1Ev
-__ZN7WebCore23JSNodeFilterConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore23JSNodeFilterConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSNodeFilterConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore45jsDocumentPrototypeFunctionCreateNodeIteratorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12toNodeFilterEPN3KJS7JSValueE
-__ZN7WebCore8Document18createNodeIteratorEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
-__ZN7WebCore12NodeIteratorC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore9TraversalC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore12NodeIterator11NodePointerC1EN3WTF10PassRefPtrINS_4NodeEEEb
-__ZN7WebCore12NodeIterator11NodePointerC1Ev
-__ZN7WebCore8Document18attachNodeIteratorEPNS_12NodeIteratorE
-__ZN3WTF7HashSetIPN7WebCore12NodeIteratorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_12NodeIteratorE
-__ZN7WebCore23JSNodeIteratorPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSNodeIteratorC1EPN3KJS8JSObjectEPNS_12NodeIteratorE
-__ZN7WebCore14JSNodeIterator18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSNodeIteratorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsNodeIteratorPrototypeFunctionNextNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSNodeIterator9classInfoEv
-__ZN7WebCore14JSNodeIterator8nextNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore12NodeIterator8nextNodeERiRPN3KJS7JSValueE
-__ZN7WebCore12NodeIterator11NodePointer10moveToNextEPNS_4NodeE
-__ZNK7WebCore9Traversal10acceptNodeEPNS_4NodeERPN3KJS7JSValueE
-__ZN7WebCore12NodeIterator11NodePointer5clearEv
-__ZN7WebCore43jsNodeIteratorPrototypeFunctionPreviousNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSNodeIterator12previousNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore12NodeIterator12previousNodeERiRPN3KJS7JSValueE
-__ZN7WebCore12NodeIterator11NodePointer14moveToPreviousEPNS_4NodeE
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateTreeWalkerEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document16createTreeWalkerEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
-__ZN7WebCore10TreeWalkerC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10TreeWalkerE
-__ZN7WebCore21JSTreeWalkerPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSTreeWalkerC1EPN3KJS8JSObjectEPNS_10TreeWalkerE
-__ZN7WebCore12JSTreeWalker18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSTreeWalkerPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37jsTreeWalkerPrototypeFunctionNextNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSTreeWalker9classInfoEv
-__ZN7WebCore12JSTreeWalker8nextNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker8nextNodeERPN3KJS7JSValueE
-__ZN7WebCore41jsTreeWalkerPrototypeFunctionPreviousNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker12previousNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker12previousNodeERPN3KJS7JSValueE
-__ZN7WebCore32jsTextPrototypeFunctionSplitTextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore21JSNodeFilterConditionC1EPN3KJS8JSObjectE
-__ZN7WebCore39jsTreeWalkerPrototypeFunctionFirstChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker10firstChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker10firstChildERPN3KJS7JSValueE
-__ZNK7WebCore10NodeFilter10acceptNodeEPNS_4NodeERPN3KJS7JSValueE
-__ZNK7WebCore21JSNodeFilterCondition10acceptNodeEPNS_4NodeERPN3KJS7JSValueE
-__ZN7WebCore12JSTreeWalker3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12JSTreeWalker16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore10TreeWalker14setCurrentNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN3KJS17staticValueGetterIN7WebCore12JSTreeWalkerEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSTreeWalker16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore40jsTreeWalkerPrototypeFunctionNextSiblingEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker11nextSiblingEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker11nextSiblingERPN3KJS7JSValueE
-__ZN7WebCore44jsTreeWalkerPrototypeFunctionPreviousSiblingEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker15previousSiblingEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker15previousSiblingERPN3KJS7JSValueE
-__ZN7WebCore39jsTreeWalkerPrototypeFunctionParentNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker10parentNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker10parentNodeERPN3KJS7JSValueE
-__ZN7WebCore13takeExceptionEPN3KJS9ExecStateE
-__ZN7WebCore12NodeIterator23notifyBeforeNodeRemovalEPNS_4NodeE
-__ZNK7WebCore12NodeIterator20updateForNodeRemovalEPNS_4NodeERNS0_11NodePointerE
-__ZN7WebCore38jsTreeWalkerPrototypeFunctionLastChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker9lastChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker9lastChildERPN3KJS7JSValueE
-__ZN3KJS17staticValueGetterIN7WebCore14JSNodeIteratorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSNodeIterator16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore14JSNodeIterator4markEv
-__ZN7WebCore21JSNodeFilterCondition4markEv
-__ZN7WebCore12JSTreeWalker4markEv
-__ZN7WebCore12JSTreeWalkerD0Ev
-__ZN7WebCore10TreeWalkerD1Ev
-__ZN7WebCore21JSNodeFilterConditionD1Ev
-__ZN7WebCore14JSNodeIteratorD0Ev
-__ZN7WebCore8Document18detachNodeIteratorEPNS_12NodeIteratorE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_12IconSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S6_S9_EEEENS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EERKT_
-__ZN7WebCore10toGeorgianEi
-__ZN7WebCore11SVGDocumentC1EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore9SVGLength20PercentageOfViewportEfPKNS_16SVGStyledElementENS_13SVGLengthModeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE6shrinkEm
+-[DOMRange text]
+__ZN7WebCore23SetNodeAttributeCommand9doUnapplyEv
+__ZN7WebCore8SVGImageC1EPNS_13ImageObserverE
+__ZN7WebCore8SVGImageC2EPNS_13ImageObserverE
+__ZN7WebCore8SVGImage11dataChangedEb
+__ZN7WebCore22EmptyFrameLoaderClient20createDocumentLoaderERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN7WebCore14DocumentLoaderC1ERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN7WebCore22EmptyFrameLoaderClient22provisionalLoadStartedEv
+__ZN7WebCore22EmptyFrameLoaderClient25setMainFrameDocumentReadyEb
+__ZN7WebCore22EmptyFrameLoaderClient17setCopiesOnScrollEv
+__ZN7WebCore22EmptyFrameLoaderClient31prepareForDataSourceReplacementEv
+__ZN7WebCore22EmptyFrameLoaderClient31transitionToCommittedForNewPageEv
+__ZN7WebCore17EmptyEditorClient23clearUndoRedoOperationsEv
+__ZN7WebCore22EmptyFrameLoaderClient15finishedLoadingEPNS_14DocumentLoaderE
+__ZNK7WebCore17FrameLoaderClient23shouldUsePluginDocumentERKNS_6StringE
+__ZNK7WebCore22EmptyFrameLoaderClient17overrideMediaTypeEv
+__ZN7WebCore17EmptyChromeClient22createHTMLParserQuirksEv
+__ZNK7WebCore17EmptyChromeClient19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
+__ZN7WebCore22EmptyFrameLoaderClient24documentElementAvailableEv
+__ZN7WebCore22EmptyFrameLoaderClient18frameLoadCompletedEv
+__ZN7WebCore22EmptyFrameLoaderClient21forceLayoutForNonHTMLEv
+__ZN7WebCore22EmptyFrameLoaderClient9userAgentERKNS_4KURLE
+__ZN7WebCore22EmptyFrameLoaderClient17cancelPolicyCheckEv
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_14NavigationTypeE
+__ZN7WebCore17EmptyChromeClient30canRunBeforeUnloadConfirmPanelEv
+__ZN7WebCore22EmptyFrameLoaderClient27willChangeEstimatedProgressEv
+__ZN7WebCore22EmptyFrameLoaderClient31postProgressStartedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient26didChangeEstimatedProgressEv
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDidStartProvisionalLoadEv
+__ZN7WebCore22EmptyFrameLoaderClient32assignIdentifierToInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
+__ZN7WebCore22EmptyFrameLoaderClient23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceRespon
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDecidePolicyForMIMETypeEMNS_11FrameLoaderEFvNS_12PolicyActionEERKNS_6StringERKNS_
+__ZN7WebCore11FrameLoader24cancelContentPolicyCheckEv
+__ZN7WebCore22EmptyFrameLoaderClient17dispatchWillCloseEv
+__ZN7WebCore22EmptyFrameLoaderClient18makeRepresentationEPNS_14DocumentLoaderE
+__ZN7WebCore14DocumentLoaderD0Ev
+__ZNK7WebCore17FrameLoaderClient11hasHTMLViewEv
+__ZN7WebCore17EmptyChromeClient16setStatusbarTextERKNS_6StringE
+__ZN7WebCore11FrameLoader19setResponseMIMETypeERKNS_6StringE
+__ZN7WebCore9SVGLength20PercentageOfViewportEfPKNS_10SVGElementENS_13SVGLengthModeE
 __ZNK7WebCore10SVGElement15viewportElementEv
+__ZN7WebCoreL21updateCSSForAttributeEPNS_13SVGSVGElementERKNS_13QualifiedNameE13CSSPropertyIDRKNS_9SVGLengthE
+__ZNK7WebCore9SVGLength13valueAsStringEv
 __ZN7WebCore15SVGFitToViewBox12parseViewBoxERPKtS2_RfS4_S4_S4_b
-__ZThn108_NK7WebCore13SVGSVGElement14contextElementEv
+__ZThn344_NK7WebCore13SVGSVGElement14contextElementEv
 __ZNK7WebCore13SVGSVGElement14contextElementEv
-__ZN7WebCore15SVGFitToViewBox19setViewBoxBaseValueENS_9FloatRectE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_9FloatRectEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore15SVGFitToViewBox10setViewBoxENS_9FloatRectE
-__ZN7WebCore16titleConstructorEPNS_8DocumentEb
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_9FloatRectENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEEN
+__ZN7WebCoreL16titleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore15SVGTitleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTitleElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore15SVGTitleElement20insertedIntoDocumentEv
 __ZNK7WebCore10SVGElement7isValidEv
 __ZN7WebCore15SVGTitleElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore15SVGTitleElement15childrenChangedEb
-__ZN7WebCore15descConstructorEPNS_8DocumentEb
+__ZN7WebCore15SVGTitleElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore22EmptyFrameLoaderClient15willChangeTitleEPNS_14DocumentLoaderE
+__ZN7WebCore22EmptyFrameLoaderClient14didChangeTitleEPNS_14DocumentLoaderE
+__ZN7WebCoreL15descConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGDescElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGDescElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore14SVGDescElement16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore13StyleFillDataeqERKS0_
+__ZN7WebCoreL12gConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore11SVGGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11SVGGElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11SVGGElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore11SVGGElement7isValidEv
+__ZN7WebCore11SVGGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore31RenderSVGTransformableContainerC1EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore31RenderSVGTransformableContainerC2EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore18RenderSVGContainerC2EPNS_16SVGStyledElementE
+__ZNK7WebCore18RenderSVGContainer15virtualChildrenEv
+__ZN7WebCore11SVGGElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore12SVGLangSpace11setXmlspaceERKNS_12AtomicStringE
+__ZN7WebCore15StyleStrokeDataC1ERKS0_
+__ZN7WebCore15StyleStrokeDataC2ERKS0_
+__ZN7WebCore18RenderSVGContainer15virtualChildrenEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_16SVGTransformListENS1_10StringHashENS_10HashTraitsIS6_E
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14shrinkCapacityEm
+__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERKNS_12AtomicStringE
+__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERPKtS4_
+__ZN7WebCore16SVGTransformable19parseTransformValueEjRPKtS2_RNS_12SVGTransformE
+__ZN7WebCore12SVGTransform12setTranslateEff
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE15reserveCapacityEm
+__ZNK7WebCore15StyleStrokeDataeqERKS0_
 __ZN7WebCore14SVGRenderStyle11inheritFromEPKS0_
-__ZN7WebCore15lineConstructorEPNS_8DocumentEb
+__ZN7WebCore21SVGTextContentElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL15lineConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGLineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore14SVGLineElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGLineElement14setX1BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setX1ENS_9SVGLengthE
 __ZN7WebCore14SVGLineElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore14SVGLineElement14setY1BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setY1ENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement14setX2BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setX2ENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement14setY2BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setY2ENS_9SVGLengthE
 __ZNK7WebCore14SVGLineElement7isValidEv
-__ZNK7WebCore15StyleStrokeDataeqERKS0_
-__ZNK7WebCore29SVGStyledTransformableElement18transformBaseValueEv
-__ZN7WebCore12SVGTransform12setTranslateEff
-__ZN7WebCore29SVGStyledTransformableElement21setTransformBaseValueEPNS_16SVGTransformListE
-__ZN7WebCore29SVGStyledTransformableElement12setTransformEPNS_16SVGTransformListE
-__ZN7WebCore21SVGTextContentElement22setTextLengthBaseValueENS_9SVGLengthE
-__ZN7WebCore21SVGTextContentElement13setTextLengthENS_9SVGLengthE
-__ZN7WebCore21SVGTextContentElement24setLengthAdjustBaseValueEi
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIiEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZN7WebCore21SVGTextContentElement15setLengthAdjustEi
-__ZNK7WebCore13SVGSVGElement19preserveAspectRatioEv
-__ZNK7WebCore15SVGFitToViewBox19preserveAspectRatioEv
+__ZN7WebCore7DataRefINS_15StyleStrokeDataEE6accessEv
+__ZN7WebCoreL18animateConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGAnimateElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGAnimateElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimationElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGSMILElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimationElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore14SVGSMILElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore19SVGAnimationElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGSMILElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore10SVGElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL13parseKeyTimesERKNS_6StringERN3WTF6VectorIfLm0EEEb
+__ZN7WebCore14SVGSMILElement15parseBeginOrEndERKNS_6StringENS0_10BeginOrEndE
+__ZN7WebCore14SVGSMILElement15parseClockValueERKNS_6StringE
+__ZN7WebCore14SVGSMILElement16parseOffsetValueERKNS_6StringE
+__ZNK3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E8containsIdNS_22IdentityHashTranslatorI
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE15reserveCapacityEm
+__ZN7WebCoreL12sortTimeListERN3WTF6VectorINS_8SMILTimeELm0EEE
+__ZSt16__introsort_loopIPN7WebCore8SMILTimeElEvT_S3_T0_
+__ZSt22__final_insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
+__ZSt16__insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E15deallocateTableEPdi
+__ZN7WebCore14SVGSMILElement20insertedIntoDocumentEv
+__ZNK7WebCore10SVGElement15ownerSVGElementEv
+__ZN7WebCore14SVGSMILElement10rescheduleEv
+__ZN7WebCore17SMILTimeContainer8scheduleEPNS_14SVGSMILElementE
+__ZNK7WebCore14SVGSMILElement16nextProgressTimeEv
+__ZN3WTF7HashSetIPN7WebCore14SVGSMILElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandE
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13alloca
+__ZN7WebCore14SVGSMILElement21finishParsingChildrenEv
+__ZN7WebCore14SVGSMILElement20resolveFirstIntervalEv
+__ZNK7WebCore14SVGSMILElement15resolveIntervalEbRNS_8SMILTimeES2_
+__ZNK7WebCore14SVGSMILElement16findInstanceTimeENS0_10BeginOrEndENS_8SMILTimeEb
+__ZNK7WebCore14SVGSMILElement16resolveActiveEndENS_8SMILTimeES1_
+__ZNK7WebCore14SVGSMILElement3durEv
+__ZNK7WebCore14SVGSMILElement17repeatingDurationEv
+__ZNK7WebCore14SVGSMILElement11repeatCountEv
+__ZNK7WebCore14SVGSMILElement9repeatDurEv
+__ZNK7WebCore14SVGSMILElement14simpleDurationEv
+__ZNK7WebCore14SVGSMILElement8minValueEv
+__ZNK7WebCore14SVGSMILElement8maxValueEv
+__ZN7WebCoreplERKNS_8SMILTimeES2_
+__ZN7WebCore14SVGSMILElement31notifyDependentsIntervalChangedENS0_21NewOrExistingIntervalE
+__ZNK3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8contai
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remove
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeE
+__ZN7WebCore22EmptyFrameLoaderClient29dispatchDidFinishDocumentLoadEv
+__ZN7WebCore22EmptyFrameLoaderClient29dispatchDidHandleOnloadEventsEv
+__ZN7WebCore10ScrollView16updateScrollbarsERKNS_7IntSizeE
+__ZN7WebCore10ScrollView34platformHandleHorizontalAdjustmentERKNS_7IntSizeE
+__ZN7WebCore10ScrollView32platformHandleVerticalAdjustmentERKNS_7IntSizeE
+__ZN7WebCore18RenderSVGContainer6layoutEv
+__ZN7WebCore18RenderSVGContainer12calcViewportEv
+__ZNK7WebCore18RenderSVGContainer13selfWillPaintEv
+__ZN7WebCore31RenderSVGTransformableContainer23calculateLocalTransformEv
+__ZN7WebCore12SVGTransformC1ERKNS_20TransformationMatrixE
+__ZN7WebCore12SVGTransformC2ERKNS_20TransformationMatrixE
+__ZNK7WebCore14SVGLineElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y2AttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y1AttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStri
+__ZN7WebCore4Path10createLineERKNS_10FloatPointES3_
 __ZN7WebCore22SVGPreserveAspectRatio6getCTMEdddddddd
 __ZNK7WebCore22SVGPreserveAspectRatio5alignEv
+__ZN7WebCore22EmptyFrameLoaderClient22dispatchDidFirstLayoutEv
+__ZN7WebCore22EmptyFrameLoaderClient38dispatchDidFirstVisuallyNonEmptyLayoutEv
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE15reserveCapacityEm
+__ZN7WebCore17SMILTimeContainer26updateDocumentOrderIndexesEv
+__ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
+__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementElNS0_15PriorityCompareEEvT_S5_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
+__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
+__ZNK7WebCore14SVGSMILElement13targetElementEv
+__ZNK7WebCore14SVGSMILElement9xlinkHrefEv
+__ZNK7WebCore14SVGSMILElement13attributeNameEv
+__ZNK3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEEPNS2_14SVGSMILElementENS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EEN
+__ZN7WebCore17SMILTimeContainer12baseValueForESt4pairIPNS_10SVGElementENS_6StringEE
+__ZN7WebCore19SVGAnimationElement14attributeIsCSSERKNS_6StringE
+__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEES5_NS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENS9_IS5_EEE3addERKS6_
+__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_S5_ENS_18PairFirstExtractorIS7_EENS_8PairHashIS4_S5_EENS_
+__ZN7WebCore17SVGAnimateElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore17SVGAnimateElement21determinePropertyTypeERKNS_6StringE
+__ZN7WebCoreL23parseNumberValueAndUnitERKNS_6StringERdRS0_
+__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEEPNS2_14SVGSMILElementENS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENS
+__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_PNS2_14SVGSMILElementEENS_18PairFirstExtractorIS9_EENS_8P
+__ZN7WebCore14SVGSMILElement8progressENS_8SMILTimeEPS0_
+__ZN7WebCore14SVGSMILElement17connectConditionsEv
+__ZN7WebCore19SVGAnimationElement21startedActiveIntervalEv
+__ZNK7WebCore19SVGAnimationElement14hasValidTargetEv
+__ZNK7WebCore19SVGAnimationElement13animationModeEv
+__ZNK7WebCore19SVGAnimationElement13animationPathEv
+__ZNK7WebCore19SVGAnimationElement8calcModeEv
+__ZNK7WebCore14SVGSMILElement34calculateAnimationPercentAndRepeatENS_8SMILTimeERj
+__ZN7WebCoremiERKNS_8SMILTimeES2_
+__ZN7WebCore14SVGSMILElement12checkRestartENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement7restartEv
+__ZNK7WebCore14SVGSMILElement20determineActiveStateENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement14isContributingENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement4fillEv
+__ZN7WebCore19SVGAnimationElement15updateAnimationEfjPNS_14SVGSMILElementE
+__ZNK7WebCore19SVGAnimationElement31currentValuesForValuesAnimationEfRfRNS_6StringES3_
+__ZN7WebCore17SVGAnimateElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZN7WebCore17SVGAnimateElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZNK7WebCore19SVGAnimationElement13isAccumulatedEv
+__ZNK7WebCore19SVGAnimationElement10isAdditiveEv
+__ZNK7WebCore14SVGSMILElement25calculateNextProgressTimeENS_8SMILTimeE
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEmPKS3_
+__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementElPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
+__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore17SVGAnimateElement20applyResultsToTargetEv
+__ZN7WebCore19SVGAnimationElement31setTargetAttributeAnimatedValueERKNS_6StringE
+__ZN7WebCore16SVGStyledElement25setInstanceUpdatesBlockedEb
+__ZN3WTF7HashSetIPKN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expa
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6reha
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13all
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15dea
+__ZNK7WebCore19SVGAnimationElement20targetAttributeIsCSSEv
+__ZNK7WebCore19SVGAnimationElement13attributeTypeEv
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4find
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47rem
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6remo
+__ZNK7WebCore17SMILTimeContainer7elapsedEv
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE6shrinkEm
+__ZNK7WebCore8SVGImage4sizeEv
+__ZNK7WebCore11SVGDocument11rootElementEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStr
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16heightAttrSt
+__ZNK7WebCore9SVGLength8unitTypeEv
+__ZNK7WebCore13SVGSVGElement18relativeWidthValueEv
+__ZNK7WebCore9SVGLength17valueAsPercentageEv
+__ZNK7WebCore9SVGLength21valueInSpecifiedUnitsEv
+__ZNK7WebCore13SVGSVGElement19relativeHeightValueEv
+__ZN7WebCore8SVGImage16setContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore8SVGImage16hasRelativeWidthEv
+__ZNK7WebCore8SVGImage17hasRelativeHeightEv
+__ZN7WebCore8SVGImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
+__ZN7WebCore9FrameView15contentsResizedEv
+__ZN7WebCore10ScrollView17frameRectsChangedEv
+__ZNK7WebCore13SVGSVGElement17hasRelativeValuesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrStringE
 __ZNK7WebCore22SVGPreserveAspectRatio11meetOrSliceEv
-__ZNK7WebCore14SVGLineElement10toPathDataEv
-__ZNK7WebCore14SVGLineElement2y2Ev
-__ZNK7WebCore14SVGLineElement2x2Ev
-__ZNK7WebCore14SVGLineElement2y1Ev
-__ZNK7WebCore14SVGLineElement2x1Ev
-__ZN7WebCore4Path10createLineERKNS_10FloatPointES3_
-__ZN7WebCore27cummulatedHeightOfTextChunkERNS_12SVGTextChunkE
-__ZN7WebCore41cummulatedHeightOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
-__ZNK7WebCore11SVGDocument13isSVGDocumentEv
-__ZN7WebCore21SVGPathSegListBuilder12svgClosePathEv
-__ZN7WebCore14SVGPathElement25createSVGPathSegClosePathEv
-__ZN7WebCore19SVGPathSegClosePathC1Ev
-__ZN7WebCore10SVGElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore19SVGPathSegClosePath11pathSegTypeEv
-__ZN7WebCore15fontConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGFontElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore20font_faceConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGFontFaceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore8Document18mappedElementSheetEv
-__ZN7WebCore18SVGFontFaceElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
-__ZN7WebCore18SVGFontFaceElement15rebuildFontFaceEv
-__ZN7WebCore18SVGFontFaceElement20insertedIntoDocumentEv
-__ZNK7WebCore18SVGFontFaceElement10fontFamilyEv
-__ZN7WebCore16glyphConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGGlyphElement20insertedIntoDocumentEv
-__ZN7WebCore14SVGFontElement15addGlyphToCacheEPNS_15SVGGlyphElementE
-__ZNK7WebCore15SVGGlyphElement20buildGlyphIdentifierEv
-__ZN7WebCore15SVGGlyphElement27buildGenericGlyphIdentifierEPKNS_10SVGElementE
-__ZN7WebCore15pathFromSVGDataERNS_4PathERKNS_6StringE
-__ZN7WebCore11PathBuilder9svgMoveToEddbb
-__ZN7WebCore11PathBuilder9svgLineToEddb
-__ZN7WebCore11PathBuilder12svgClosePathEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SB_EEEENS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EERKT_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE15reserveCapacityEm
-__ZN3WTF7HashMapIN7WebCore6StringENS_6VectorINS1_18SVGGlyphIdentifierELm0EEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3addERKS2_RKS5_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS1_6StringES7_NS_17HashMapTranslatorILb0ES4_ISJ_S7_ENS_18PairBaseHashTraitsINSD_ISJ_EESF_EESG_SB_EEEES4_INS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEbERKT_RKT0_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EEC1ERKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS8_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EEaSERKS3_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6shrinkEm
-__ZN3WTF7HashMapIiPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZNK7WebCore17CSSFontFaceSource8isLoadedEv
-__ZN7WebCore11SVGFontDataC1EPNS_18SVGFontFaceElementE
-__ZNK7WebCore18SVGFontFaceElement17horizontalOriginXEv
-__ZNK7WebCore18SVGFontFaceElement17horizontalOriginYEv
-__ZNK7WebCore18SVGFontFaceElement18horizontalAdvanceXEv
-__ZNK7WebCore6String7toFloatEPb
-__ZN7WebCore10StringImpl7toFloatEPb
-__ZNK7WebCore18SVGFontFaceElement15verticalOriginXEv
-__ZNK7WebCore18SVGFontFaceElement15verticalOriginYEv
-__ZNK7WebCore18SVGFontFaceElement6ascentEv
-__ZNK7WebCore18SVGFontFaceElement10unitsPerEmEv
-__ZNK7WebCore18SVGFontFaceElement16verticalAdvanceYEv
-__ZNK7WebCore18SVGFontFaceElement7descentEv
-__ZNK7WebCore18SVGFontFaceElement7xHeightEv
-__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunE
-__ZN7WebCore33floatWidthOfSubStringUsingSVGFontEPKNS_4FontERKNS_7TextRunEii
-__ZNK7WebCore18SVGFontFaceElement21associatedFontElementEv
-__ZN7WebCore16SVGTextRunWalkerINS_34SVGTextRunWalkerMeasuredLengthDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
-__ZN7WebCore24charactersWithArabicFormERKNS_6StringEb
-__ZNK7WebCore14SVGFontElement25glyphIdentifiersForStringERKNS_6StringE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SB_EEEENS_22HashTableConstIteratorIS3_S8_SA_SB_SG_SE_EERKT_
-__ZN7WebCore15SVGGlyphElement28inheritUnspecifiedAttributesERNS_18SVGGlyphIdentifierEPKNS_11SVGFontDataE
-__ZN7WebCore30floatWidthUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_34SVGTextRunWalkerMeasuredLengthDataE
-__ZNK7WebCore14SVGFontElement24firstMissingGlyphElementEv
-__ZN7WebCore30floatWidthMissingGlyphCallbackERKNS_7TextRunERNS_34SVGTextRunWalkerMeasuredLengthDataE
-__ZNK7WebCore4Font12fontSelectorEv
-__ZN7WebCore18ellipseConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGEllipseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGEllipseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17SVGEllipseElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore17SVGEllipseElement14setCxBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setCxENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement14setCyBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setCyENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement14setRxBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setRxENS_9SVGLengthE
-__ZNK7WebCore17SVGEllipseElement2rxEv
-__ZN7WebCore17SVGEllipseElement14setRyBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setRyENS_9SVGLengthE
-__ZNK7WebCore17SVGEllipseElement2ryEv
-__ZNK7WebCore17SVGEllipseElement7isValidEv
-__ZNK7WebCore17SVGEllipseElement10toPathDataEv
-__ZNK7WebCore17SVGEllipseElement2cyEv
-__ZNK7WebCore17SVGEllipseElement2cxEv
-__ZN7WebCore4Path13createEllipseERKNS_10FloatPointEff
-__ZN7WebCore12aConstructorEPNS_8DocumentEb
-__ZN7WebCore11SVGAElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20SVGImageChromeClient7repaintERKNS_7IntRectEbbb
+__ZThn392_N7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
+__ZN7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
+__ZNK7WebCore18RenderSVGContainer29repaintRectInLocalCoordinatesEv
+__ZN7WebCore30BoundingRectStrokeStyleApplier11strokeStyleEPNS_15GraphicsContextE
+__ZN7WebCore25applyStrokeStyleToContextEPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_12RenderObjectE
+__ZN7WebCore14SVGRenderStyle20cssPrimitiveToLengthEPKNS_12RenderObjectEPNS_8CSSValueEf
+__ZN7WebCore27dashArrayFromRenderingStyleEPKNS_11RenderStyleE
+__ZN7WebCore15GraphicsContext11setLineDashERKN3WTF6VectorIdLm0EEEf
+__ZNK7WebCore31RenderSVGTransformableContainer22localToParentTransformEv
+__ZN7WebCore18RenderSVGContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore18RenderSVGContainer13drawsContentsEv
+__ZN7WebCore18RenderSVGContainer17applyViewportClipERNS_12RenderObject9PaintInfoE
+__ZNK7WebCore14SVGLineElement15supportsMarkersEv
+__ZNK7WebCore10RenderPath19drawMarkersIfNeededEPNS_15GraphicsContextERKNS_9FloatRectERKNS_4PathE
+__ZN7WebCore13getMarkerByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore5TimerINS_17SMILTimeContainerEE5firedEv
+__ZN7WebCore17SMILTimeContainer10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore14SVGSMILElement19resolveNextIntervalEv
+__ZN7WebCore19SVGAnimationElement19endedActiveIntervalEv
+__ZN7WebCore20RenderSVGModelObject29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore13SVGRenderBase29clippedOverflowRectForRepaintEPNS_12RenderObjectEPNS_20RenderBoxModelObjectE
+__ZN7WebCore20RenderSVGModelObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore13SVGRenderBase21computeRectForRepaintEPNS_12RenderObjectEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore20RenderSVGModelObject23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore20RenderSVGModelObject19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore13SVGRenderBase19mapLocalToContainerEPKNS_12RenderObjectEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore16CSSStyleSelector11mapFillClipEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore15GraphicsContext17clipToImageBufferERKNS_9FloatRectEPKNS_11ImageBufferE
+__ZN7WebCore11BitmapImage13getCGImageRefEv
+__ZN7WebCore5Image14resetAnimationEv
+__ZN7WebCore16CSSStyleSelector16mapFillCompositeEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FillLayer7setNextEPS0_
+__ZN7WebCore16CSSStyleSelector13mapFillOriginEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FillLayer15cullEmptyLayersEv
+__ZN7WebCore9FillLayer19fillUnsetPropertiesEv
+__ZN7WebCore13SVGZoomAndPan15parseZoomAndPanERPKtS2_
+__ZN7WebCore13SVGZoomAndPan13setZoomAndPanEt
+__ZN7WebCoreL17scriptConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGScriptElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore15SVGURIReferenceC2Ev
-__ZN7WebCore11SVGAElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGURIReference20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11SVGAElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore16SVGScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGScriptElement7setTypeERKNS_6StringE
+__ZN7WebCore16SVGScriptElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZN7WebCore15SVGURIReference16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore15SVGURIReference16setHrefBaseValueENS_6StringE
-__ZNK7WebCore11SVGAElement14contextElementEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_6StringEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore15SVGURIReference7setHrefENS_6StringE
-__ZNK7WebCore11SVGAElement4hrefEv
-__ZNK7WebCore15SVGURIReference4hrefEv
-__ZN7WebCore11SVGAElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore21SVGTextContentElement13isTextContentEv
-__ZN7WebCore15RenderSVGInlineC1EPNS_4NodeE
-__ZN7WebCore15RenderSVGInline13requiresLayerEv
-__ZNK7WebCore11SVGAElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore11SVGAElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore15RenderSVGInline15createInlineBoxEbbb
-__ZN7WebCore22SVGCharacterLayoutInfo14processedChunkEff
-__ZN7WebCore16styleConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGStyleElement20insertedIntoDocumentEv
+__ZN7WebCore16SVGScriptElement20insertedIntoDocumentEv
+__ZNK7WebCore16SVGScriptElement20sourceAttributeValueEv
 __ZN7WebCore10SVGElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore15SVGStyleElement15childrenChangedEb
-__ZThn72_NK7WebCore15SVGStyleElement4typeEv
-__ZNK7WebCore15SVGStyleElement4typeEv
-__ZThn72_NK7WebCore15SVGStyleElement5mediaEv
-__ZNK7WebCore15SVGStyleElement5mediaEv
-__ZN7WebCore12StyleElement10setLoadingEb
-__ZNK7WebCore15SVGStyleElement5titleEv
-__ZN7WebCore15SVGStyleElement11sheetLoadedEv
-__ZN7WebCore15SVGStyleElement5sheetEv
-__ZN7WebCore15SVGStyleElement21finishParsingChildrenEv
-__ZN7WebCore9CSSParser23parseSVGStrokeDasharrayEv
-__ZN7WebCore14SVGRectElement14setRxBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement5setRxENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement2rxEv
+__ZN7WebCore16SVGScriptElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore16SVGScriptElement21finishParsingChildrenEv
+__ZN7WebCore16SVGScriptElement27haveLoadedRequiredResourcesEv
+__ZThn240_NK7WebCore16SVGScriptElement14contextElementEv
+__ZNK7WebCore16SVGScriptElement14contextElementEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEbNS1_10StringHashENS_10HashTraitsIS6_EENS8_IbEEEENS_7PtrHashI
+__ZThn288_NK7WebCore16SVGScriptElement20sourceAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement13scriptContentEv
+__ZNK7WebCore16SVGScriptElement13scriptContentEv
+__ZN7WebCoreL17circleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGCircleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrSt
+__ZN7WebCore16SVGCircleElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGCircleElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore16SVGCircleElement7isValidEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_12rxAttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_12ryAttrStri
 __ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeE
-__ZN7WebCore25linearGradientConstructorEPNS_8DocumentEb
+__ZNK7WebCore16SVGCircleElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrS
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cyAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cxAttr
+__ZN7WebCore4Path12createCircleERKNS_10FloatPointEf
+__ZN7WebCore4Path13createEllipseERKNS_10FloatPointEff
+__ZN7WebCoreL36calculateTextAnchorShiftForTextChunkERNS_12SVGTextChunkENS_11ETextAnchorE
+__ZN7WebCoreL26cummulatedWidthOfTextChunkERNS_12SVGTextChunkE
+__ZN7WebCoreL34cummulatedWidthOrHeightOfTextChunkERNS_12SVGTextChunkEb
+__ZN7WebCore40cummulatedWidthOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11yAttrStringE
+__ZN7WebCore10SVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL15pathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPathDataC2Ev
+__ZN7WebCore14SVGPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGPathElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL25lineargradientConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore24SVGLinearGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGLinearGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore18SVGGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore24SVGLinearGradientElement14setX2BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setX2ENS_9SVGLengthE
+__ZN7WebCore19SVGAnimatedPropertyINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXad
 __ZN7WebCore24SVGLinearGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore18SVGGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGURIReference20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore24SVGLinearGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZN7WebCore18SVGGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore18SVGGradientElement25setGradientUnitsBaseValueEi
-__ZN7WebCore18SVGGradientElement16setGradientUnitsEi
-__ZN7WebCore24SVGLinearGradientElement14setX1BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setX1ENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement14setY1BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setY1ENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement14setY2BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setY2ENS_9SVGLengthE
-__ZN7WebCore18SVGGradientElement24setSpreadMethodBaseValueEi
-__ZN7WebCore18SVGGradientElement15setSpreadMethodEi
-__ZN7WebCore18SVGGradientElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore18SVGGradientElement15childrenChangedEb
-__ZN7WebCore15stopConstructorEPNS_8DocumentEb
+__ZN7WebCore18SVGGradientElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL15stopConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGStopElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGStopElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEEC1If
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEEC2If
 __ZN7WebCore14SVGStopElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore8SVGColorC1ERKNS_6StringE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE12se
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE12o
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEfNS1_10StringHashENS_10HashTraitsIS6_EENS8_IfEEEENS_7PtrHashI
+__ZN7WebCore9CSSParser13parseSVGColorEv
+__ZN7WebCore8SVGColorC1ERKNS_5ColorE
+__ZN7WebCoreL25radialgradientConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore24SVGRadialGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGRadialGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXad
+__ZN7WebCore24SVGRadialGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore24SVGRadialGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEiNS1_10StringHashENS_10HashTraitsIS6_EENS8_IiEEEENS_7PtrHashI
+__ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
+__ZN7WebCore8SVGPaintC2ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
+__ZN7WebCore8SVGColorC2ERKNS_6StringE
 __ZN7WebCore8SVGColor11setRGBColorERKNS_6StringERi
 __ZN7WebCore8SVGColor23colorFromRGBColorStringERKNS_6StringE
-__ZN7WebCore14SVGStopElement18setOffsetBaseValueEf
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIfEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZN7WebCore14SVGStopElement9setOffsetEf
-__ZNK7WebCore8SVGColor9colorTypeEv
-__ZN7WebCore13StyleStopDataC1ERKS0_
-__ZN7WebCore14SVGStopElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore21RenderSVGGradientStopC1EPNS_14SVGStopElementE
-__ZN7WebCore21RenderSVGGradientStop8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore21RenderSVGGradientStop15gradientElementEv
-__ZN7WebCore18SVGGradientElement14canvasResourceEv
-__ZNK7WebCore24SVGLinearGradientElement12gradientTypeEv
-__ZN7WebCore28SVGPaintServerLinearGradientC1EPKNS_18SVGGradientElementE
-__ZN7WebCore22SVGPaintServerGradientC2EPKNS_18SVGGradientElementE
-__ZN7WebCore22SVGPaintServerGradient10invalidateEv
-__ZN7WebCore11SVGResource10invalidateEv
-__ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
 __ZN7WebCore8SVGPaint6setUriERKNS_6StringE
-__ZNK7WebCore13StyleStopDataeqERKS0_
+__ZNK7WebCore14SVGPathElement11pathSegListEv
+__ZN7WebCore14SVGPathSegListC1ERKNS_13QualifiedNameE
+__ZN7WebCore14SVGPathSegListC2ERKNS_13QualifiedNameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14shrinkCapacityEm
+__ZN7WebCore22pathSegListFromSVGDataEPNS_14SVGPathSegListERKNS_6StringEb
+__ZN7WebCore13SVGPathParser8parseSVGERKNS_6StringEb
+__ZN7WebCoreL11parseNumberERPKtS1_Rdb
+__ZN7WebCore21SVGPathSegListBuilder9svgMoveToEddbb
+__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoAbsEff
+__ZN7WebCore19SVGPathSegMovetoAbsC1Eff
+__ZN7WebCore19SVGPathSegMovetoAbsC2Eff
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE15reserveCapacityEm
+__ZN7WebCore21SVGPathSegListBuilder9svgLineToEddb
+__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoAbsEff
+__ZN7WebCore19SVGPathSegLinetoAbsC1Eff
+__ZN7WebCore19SVGPathSegLinetoAbsC2Eff
+__ZN7WebCore21SVGPathSegListBuilder12svgClosePathEv
+__ZN7WebCore14SVGPathElement25createSVGPathSegClosePathEv
+__ZN7WebCore19SVGPathSegClosePathC1Ev
+__ZN7WebCore19SVGPathSegClosePathC2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE6shrinkEm
+__ZNK7WebCore14SVGPathElement7isValidEv
 __ZNK7WebCore8SVGPaint3uriEv
-__ZN7WebCore21RenderSVGGradientStop6layoutEv
-__ZN7WebCore24missing_glyphConstructorEPNS_8DocumentEb
-__ZN7WebCore22SVGMissingGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16SVGCircleElement7isValidEv
-__ZNK7WebCore16SVGCircleElement10toPathDataEv
-__ZNK7WebCore16SVGCircleElement2cyEv
-__ZNK7WebCore16SVGCircleElement2cxEv
-__ZN7WebCore4Path12createCircleERKNS_10FloatPointEf
-__ZN7WebCore11PathBuilder15svgCurveToCubicEddddddb
-__ZN7WebCore12SVGTransform8setScaleEff
-__ZN7WebCore16imageConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGImageLoaderC1EPNS_15SVGImageElementE
-__ZN7WebCore15SVGImageElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGImageElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement4setXENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore15SVGImageElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement4setYENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore15SVGImageElement5widthEv
-__ZN7WebCore15SVGImageElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore15SVGImageElement6heightEv
-__ZThn116_NK7WebCore15SVGImageElement14contextElementEv
-__ZNK7WebCore15SVGImageElement14contextElementEv
-__ZN7WebCore15SVGImageElement6attachEv
-__ZNK7WebCore15SVGImageElement7isValidEv
-__ZN7WebCore15SVGImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderSVGImageC1EPNS_15SVGImageElementE
-__ZN7WebCore14RenderSVGImage13requiresLayerEv
-__ZN7WebCore14SVGImageLoader17updateFromElementEv
-__ZNK7WebCore15SVGImageElement4hrefEv
-__ZN7WebCore15SVGImageElement27haveLoadedRequiredResourcesEv
-__ZNK7WebCore15SVGImageElement34externalResourcesRequiredBaseValueEv
-__ZNK7WebCore28SVGExternalResourcesRequired34externalResourcesRequiredBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIbEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZNK7WebCore28SVGExternalResourcesRequired25externalResourcesRequiredEv
-__ZN7WebCore14setConstructorEPNS_8DocumentEb
-__ZN7WebCore13SVGSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimationElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimationElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19SVGAnimationElement20parseBeginOrEndValueERdRKNS_6StringE
-__ZN7WebCore13SVGStringListC1ERKNS_13QualifiedNameE
-__ZN7WebCore13SVGStringList5parseERKNS_6StringEt
-__ZN7WebCore19SVGAnimationElement15parseClockValueERKNS_6StringE
-__ZN7WebCore19SVGAnimationElement12isIndefiniteEd
-__ZN7WebCore13SVGStringListD1Ev
-__ZN7WebCore19SVGAnimationElement21finishParsingChildrenEv
-__ZNK7WebCore10SVGElement15ownerSVGElementEv
-__ZNK7WebCore19SVGAnimationElement12getStartTimeEv
-__ZN7WebCore13TimeScheduler8addTimerEPNS_19SVGAnimationElementEj
-__ZNK7WebCore24RenderSVGHiddenContainer17absoluteTransformEv
-__ZN7WebCore14useConstructorEPNS_8DocumentEb
-__ZN7WebCore13SVGUseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore13SVGUseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn116_NK7WebCore13SVGUseElement14contextElementEv
-__ZNK7WebCore13SVGUseElement14contextElementEv
-__ZN7WebCore13SVGUseElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore13SVGUseElement20insertedIntoDocumentEv
-__ZN7WebCore13SVGUseElement20buildPendingResourceEv
-__ZNK7WebCore13SVGUseElement4hrefEv
-__ZN7WebCore18SVGElementInstanceC1EPNS_13SVGUseElementEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore21SVGDocumentExtensions20mapInstanceToElementEPNS_18SVGElementInstanceEPNS_10SVGElementE
-__ZN3WTF7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore18SVGElementInstance14refEventTargetEv
-__ZN7WebCore13SVGUseElement17buildInstanceTreeEPNS_10SVGElementEPNS_18SVGElementInstanceERb
-__ZNK7WebCore13SVGUseElement1xEv
-__ZNK7WebCore13SVGUseElement1yEv
-__ZN7WebCore13SVGUseElement15buildShadowTreeEPNS_10SVGElementEPNS_18SVGElementInstanceE
-__ZN7WebCore19isDisallowedElementEPNS_4NodeE
-__ZNK7WebCore18SVGElementInstance20correspondingElementEv
-__ZN7WebCore32subtreeContainsDisallowedElementEPNS_4NodeE
-__ZN7WebCore13SVGUseElement29expandUseElementsInShadowTreeEPNS_4NodeE
-__ZN7WebCore13SVGUseElement32expandSymbolElementsInShadowTreeEPNS_4NodeE
-__ZN7WebCore13SVGUseElement40associateInstancesWithShadowTreeElementsEPNS_4NodeEPNS_18SVGElementInstanceE
-__ZN7WebCore18SVGElementInstance20setShadowTreeElementEPNS_10SVGElementE
-__ZNK7WebCore18SVGElementInstance10firstChildEv
-__ZN7WebCore13SVGUseElement16attachShadowTreeEv
-__ZN7WebCore13SVGUseElement6attachEv
-__ZNK7WebCore13SVGUseElement7isValidEv
-__ZN7WebCore13SVGUseElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10SVGElement16shadowParentNodeEv
-__ZN7WebCore13SVGUseElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement4setYENS_9SVGLengthE
-__ZN7WebCore18polygonConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGPolygonElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGPolyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGAnimatedPointsC2Ev
-__ZN7WebCore14SVGPolyElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore14SVGPolyElement6pointsEv
-__ZN7WebCore12SVGPointListC1ERKNS_13QualifiedNameE
-__ZN7WebCore21pointsListFromSVGDataEPNS_12SVGPointListERKNS_6StringE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE15reserveCapacityEm
-__ZN7WebCore14SVGPolyElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGPolyElement7isValidEv
-__ZN7WebCore14SVGPolyElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore19polylineConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGPolylineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore13SVGUseElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore17SVGPolygonElement10toPathDataEv
-__ZNK7WebCore18SVGPolylineElement10toPathDataEv
-__ZN7WebCore20parseDelimitedStringERKNS_6StringEc
-__ZN7WebCore12SVGLangSpace10setXmllangERKNS_12AtomicStringE
-__ZN7WebCore13SVGUseElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement4setXENS_9SVGLengthE
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE6shrinkEm
-__ZNK7WebCore11SVGAElement7isValidEv
-__ZNK7WebCore10SVGElement13isTextContentEv
-__ZN7WebCore17scriptConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore22JSSVGLazyEventListener18eventParameterNameEv
-__ZNK7WebCore17JSEventTargetNode21pushEventHandlerScopeEPN3KJS9ExecStateERNS1_10ScopeChainE
-__ZN7WebCore22JSSVGDocumentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore13JSSVGDocumentC1EPN3KJS8JSObjectEPNS_11SVGDocumentE
-__ZN7WebCore13JSSVGDocument18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGDocumentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSSVGDocument9classInfoEv
-__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionSelectSubStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSSVGElement4implEv
-__ZNK7WebCore21SVGTextContentElement15selectSubStringEllRi
-__ZNK7WebCore21SVGTextContentElement16getNumberOfCharsEv
-__ZNK7WebCore13RenderSVGText9isSVGTextEv
-__ZNK7WebCore16SVGRootInlineBox13svgTextChunksEv
-__ZN7WebCore29findInlineTextBoxInTextChunksEPKNS_21SVGTextContentElementERKN3WTF6VectorINS_12SVGTextChunkELm0EEE
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE15reserveCapacityEm
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGInlineTextBoxQueryWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharESB_
-__ZN7WebCore27SVGInlineTextBoxQueryWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharES9_
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE6shrinkEm
-__ZN7WebCore19RenderSVGInlineText13selectionRectEb
-__ZNK7WebCore12RenderObject20isSVGHiddenContainerEv
-__ZN7WebCore19RenderSVGInlineText27computeAbsoluteRectForRangeEii
-__ZN7WebCore17findSVGRootObjectEPNS_12RenderObjectE
-__ZN7WebCore16tspanConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGTSpanElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGTSpanElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderSVGTSpanC1EPNS_4NodeE
-__ZNK7WebCore15SVGTSpanElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore25radialGradientConstructorEPNS_8DocumentEb
-__ZN7WebCore24SVGRadialGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore24SVGRadialGradientElement14setCxBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setCxENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement14setCyBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setCyENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement13setRBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement4setRENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore24SVGRadialGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore24SVGRadialGradientElement14setFxBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setFxENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement14setFyBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setFyENS_9SVGLengthE
-__ZNK7WebCore24SVGRadialGradientElement1rEv
-__ZNK7WebCore24SVGRadialGradientElement12gradientTypeEv
-__ZN7WebCore28SVGPaintServerRadialGradientC1EPKNS_18SVGGradientElementE
-__ZN7WebCore9CSSParser13parseSVGColorEv
-__ZN7WebCore8SVGColorC2ERKNS_5ColorE
-__ZNK7WebCore24SVGRadialGradientElement14contextElementEv
-__ZNK7WebCore4Font10unitsPerEmEv
-__ZN7WebCore23angleToGlyphOrientationEf
-__ZN7WebCore8SVGColorC1Et
-__ZN7WebCore13StyleMiscDataC1ERKS0_
-__ZNK7WebCore13StyleMiscDataeqERKS0_
-__ZNK7WebCore16DeprecatedString8toDoubleEPb
-__ZN7WebCore12SVGLangSpace11setXmlspaceERKNS_12AtomicStringE
-__ZNK7WebCore19SVGAnimationElement7isValidEv
-__ZN7WebCore18SVGElementInstance11appendChildEN3WTF10PassRefPtrIS0_EE
-__ZN7WebCore18SVGElementInstance16derefEventTargetEv
-__ZNK7WebCore18SVGElementInstance11nextSiblingEv
-__ZN7WebCore13SVGUseElement15childrenChangedEb
-__ZN7WebCore21SVGDocumentExtensions21removeInstanceMappingEPNS_18SVGElementInstanceEPNS_10SVGElementE
-__ZN7WebCore12SVGPointListD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE6shrinkEm
-__ZN7WebCore14SVGImageLoaderD0Ev
-__ZN7WebCore15SVGURIReferenceD0Ev
-__ZN7WebCore14RenderSVGImage27absoluteClippedOverflowRectEv
-__ZNK7WebCore25SVGTextPositioningElement15rotateBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_13SVGNumberListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore13SVGNumberList5parseERKNS_6StringE
-__ZNK7WebCore22SVGCharacterLayoutInfo14angleValueNextEv
-__ZNK7WebCore15SVGImageElement28preserveAspectRatioBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_22SVGPreserveAspectRatioEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZNK7WebCore15SVGImageElement19preserveAspectRatioEv
-__ZN7WebCore22SVGPreserveAspectRatio24parsePreserveAspectRatioERPKtS2_b
-__ZNK7WebCore15SVGFitToViewBox28preserveAspectRatioBaseValueEv
-__ZN7WebCore13SVGZoomAndPan15parseZoomAndPanERPKtS2_
-__ZN7WebCore13SVGZoomAndPan13setZoomAndPanEt
-__ZN7WebCore13SVGPathParser12calculateArcEbRdS1_dddddbb
-__ZN7WebCore18patternConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGPatternElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGPatternElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17SVGPatternElement24setPatternUnitsBaseValueEi
-__ZN7WebCore17SVGPatternElement15setPatternUnitsEi
-__ZN7WebCore17SVGPatternElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore17SVGPatternElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement4setXENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement4setYENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore17SVGPatternElement5widthEv
-__ZN7WebCore17SVGPatternElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore17SVGPatternElement7isValidEv
-__ZN7WebCore17SVGPatternElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore18RenderSVGContainer16setDrawsContentsEb
-__ZN7WebCore17SVGPatternElement15childrenChangedEb
-__ZN7WebCore18RenderSVGContainer23calculateLocalTransformEv
-__ZNK7WebCore22SVGCharacterLayoutInfo22baselineShiftValueNextEv
-__ZN7WebCore16SVGScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGScriptElement7setTypeERKNS_6StringE
-__ZN7WebCore13SVGSVGElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement4setXENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement4setYENS_9SVGLengthE
-__ZNK7WebCore13SVGSVGElement7isValidEv
-__ZN7WebCore26RenderSVGViewportContainerC1EPNS_16SVGStyledElementE
-__ZN7WebCore19createCircleWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore27JSSVGCircleElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSSVGCircleElementC1EPN3KJS8JSObjectEPNS_16SVGCircleElementE
-__ZN7WebCore45jsSVGTextElementPrototypeFunctionGetScreenCTMEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14SVGTextElement12getScreenCTMEv
-__ZNK7WebCore16SVGTransformable12getScreenCTMEPKNS_10SVGElementE
-__ZN7WebCore12SVGLocatable12getScreenCTMEPKNS_10SVGElementE
-__ZNK7WebCore25SVGStyledLocatableElement17isStyledLocatableEv
-__ZNK7WebCore29SVGStyledTransformableElement12getScreenCTMEv
-__ZNK7WebCore13SVGSVGElement12getScreenCTMEv
-__ZNK7WebCore26RenderSVGViewportContainer17absoluteTransformEv
-__ZNK7WebCore26RenderSVGViewportContainer8viewportEv
-__ZNK7WebCore26RenderSVGViewportContainer17viewportTransformEv
-__ZN7WebCore26RenderSVGViewportContainer6layoutEv
-__ZN7WebCore26RenderSVGViewportContainer12calcViewportEv
-__ZNK7WebCore25SVGStyledLocatableElement12getScreenCTMEv
-__ZThn80_NK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
-__ZThn152_NK7WebCore14SVGTextElement22animatedLocalTransformEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19JSSVGPODTypeWrapperINS_15AffineTransformEEEPNS_10SVGElementE
-__ZN7WebCore20JSSVGMatrixPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore11JSSVGMatrixC1EPN3KJS8JSObjectEPNS_19JSSVGPODTypeWrapperINS_15AffineTransformEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGMatrix18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore11JSSVGMatrixEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSSVGMatrix16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34JSSVGPODTypeWrapperCreatorReadOnlyINS_15AffineTransformEEcvS1_Ev
-__ZNK7WebCore15AffineTransform1bEv
-__ZNK7WebCore15AffineTransform1cEv
-__ZN7WebCore39jsSVGTextElementPrototypeFunctionGetCTMEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14SVGTextElement6getCTMEv
-__ZNK7WebCore16SVGTransformable6getCTMEPKNS_10SVGElementE
-__ZN7WebCore12SVGLocatable6getCTMEPKNS_10SVGElementE
-__ZNK7WebCore29SVGStyledTransformableElement6getCTMEv
-__ZNK7WebCore13SVGSVGElement6getCTMEv
-__ZN7WebCore54jsSVGTextElementPrototypeFunctionGetTransformToElementEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12toSVGElementEPN3KJS7JSValueE
-__ZNK7WebCore12SVGLocatable21getTransformToElementEPNS_10SVGElementERi
-__ZTv0_n28_NK7WebCore14SVGTextElement6getCTMEv
-__ZN7WebCore15AffineTransformmLERKS0_
-__ZN7WebCore18JSSVGCircleElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGCircleElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsSVGCircleElementPrototypeFunctionGetBBoxEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore18JSSVGCircleElement9classInfoEv
-__ZNK7WebCore29SVGStyledTransformableElement7getBBoxEv
-__ZN7WebCore12SVGLocatable7getBBoxEPKNS_16SVGStyledElementE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
-__ZN7WebCore18JSSVGRectPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSSVGRectC1EPN3KJS8JSObjectEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
-__ZN7WebCore9JSSVGRect18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore9JSSVGRectEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSSVGRect16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34JSSVGPODTypeWrapperCreatorReadOnlyINS_9FloatRectEEcvS1_Ev
-__ZN3KJS17staticValueGetterIN7WebCore18JSSVGCircleElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSSVGCircleElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore29SVGStyledTransformableElement23farthestViewportElementEv
-__ZN7WebCore12SVGLocatable23farthestViewportElementEPKNS_16SVGStyledElementE
-__ZNK7WebCore29SVGStyledTransformableElement22nearestViewportElementEv
-__ZNK7WebCore18RenderSVGContainer6heightEv
-__ZNK7WebCore18RenderSVGContainer5widthEv
-__ZN7WebCore9DocLoader11requestFontERKNS_6StringE
-__ZN7WebCore10CachedFontC1EPNS_9DocLoaderERKNS_6StringE
-__ZN7WebCore10CachedFont3refEPNS_20CachedResourceClientE
-__ZNK7WebCore15CSSFontSelector9docLoaderEv
-__ZN7WebCore10CachedFont17beginLoadIfNeededEPNS_9DocLoaderE
-__ZN7WebCore9FontCache25getLastResortFallbackFontERKNS_15FontDescriptionE
-__ZN7WebCore14SVGRectElement14setRyBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement5setRyENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement2ryEv
-__ZN7WebCore12SVGTransform8setSkewXEf
-__ZN7WebCore15AffineTransform5skewXEd
-__ZN7WebCore17switchConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGSwitchElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16SVGSwitchElement7isValidEv
-__ZN7WebCore16SVGSwitchElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore16SVGSwitchElement25childShouldCreateRendererEPNS_4NodeE
-__ZNK7WebCore8SVGTests14systemLanguageEv
-__ZN7WebCore13SVGStringList5resetERKNS_6StringE
-__ZNK7WebCore26RenderSVGViewportContainer14isSVGContainerEv
-__ZNK7WebCore25SVGTextPositioningElement11dxBaseValueEv
-__ZNK7WebCore25SVGTextPositioningElement11dyBaseValueEv
-__ZNK7WebCore22SVGCharacterLayoutInfo11dxValueNextEv
-__ZNK7WebCore22SVGCharacterLayoutInfo11dyValueNextEv
 __ZNK7WebCore13SVGSVGElement5isSVGEv
-__ZN7WebCore17cursorConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGCursorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16SVGCursorElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn88_NK7WebCore16SVGCursorElement14contextElementEv
-__ZNK7WebCore16SVGCursorElement14contextElementEv
-__ZNK7WebCore16SVGCursorElement4hrefEv
-__ZN7WebCore16SVGCursorElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCursorElement4setXENS_9SVGLengthE
-__ZN7WebCore16SVGCursorElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCursorElement4setYENS_9SVGLengthE
-__ZNK7WebCore16SVGCursorElement7isValidEv
-__ZN7WebCore11RenderStyle12addSVGCursorERKNS_6StringE
-__ZN7WebCore15maskConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGMaskElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGMaskElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement4setXENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement4setYENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement8setWidthENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement9setHeightENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGMaskElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore14SVGMaskElement21setMaskUnitsBaseValueEi
-__ZN7WebCore14SVGMaskElement12setMaskUnitsEi
-__ZNK7WebCore14SVGMaskElement7isValidEv
-__ZN7WebCore14SVGMaskElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14SVGMaskElement15childrenChangedEb
-__ZN7WebCore13StyleMaskDataC1ERKS0_
-__ZNK7WebCore13StyleMaskDataeqERKS0_
-__ZNK7WebCore8SVGTests18requiredExtensionsEv
-__ZN7WebCore19SVGPathSegClosePathD1Ev
-__ZN7WebCore13SVGUseElement24handleDeepUseReferencingEPNS_10SVGElementEPNS_18SVGElementInstanceERb
-__ZNK7WebCore18SVGElementInstance10parentNodeEv
-__ZNK7WebCore13SVGUseElement38transferUseAttributesToReplacedElementEPNS_10SVGElementES2_
-__ZN7WebCore13SVGUseElement19removedFromDocumentEv
-__ZN7WebCore14RenderSVGImage6layoutEv
-__ZN7WebCore14RenderSVGImage23calculateLocalTransformEv
-__ZNK7WebCore15SVGImageElement1yEv
-__ZNK7WebCore15SVGImageElement1xEv
-__ZN7WebCore14RenderSVGImage23calculateAbsoluteBoundsEv
-__ZNK7WebCore14RenderSVGImage12relativeBBoxEb
-__ZNK7WebCore14RenderSVGImage14localTransformEv
-__ZN7WebCore17symbolConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGSymbolElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16SVGSymbolElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn92_NK7WebCore16SVGSymbolElement14contextElementEv
-__ZNK7WebCore16SVGSymbolElement14contextElementEv
-__ZN7WebCore16SVGSymbolElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore13SVGUseElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore13SVGUseElement5widthEv
-__ZN7WebCore13SVGUseElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore13SVGUseElement6heightEv
-__ZN7WebCore16mpathConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGMPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGMPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore15SVGMPathElement14contextElementEv
-__ZN7WebCore21SVGDocumentExtensions18addPendingResourceERKNS_12AtomicStringEPNS_16SVGStyledElementE
-__ZN3WTF7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore17markerConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGMarkerElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore8SVGAngleC1Ev
-__ZN7WebCore16SVGMarkerElement23setMarkerWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement14setMarkerWidthENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement24setMarkerHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement15setMarkerHeightENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGMarkerElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZThn92_NK7WebCore16SVGMarkerElement14contextElementEv
-__ZNK7WebCore16SVGMarkerElement14contextElementEv
-__ZN7WebCore16SVGMarkerElement16setRefXBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement7setRefXENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement16setRefYBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement7setRefYENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16SVGMarkerElement15childrenChangedEb
-__ZN7WebCore16SVGMarkerElement15setOrientToAutoEv
-__ZN7WebCore16SVGMarkerElement22setOrientTypeBaseValueEi
-__ZN7WebCore16SVGMarkerElement13setOrientTypeEi
-__ZN7WebCore15StyleMarkerDataC1ERKS0_
-__ZNK7WebCore15StyleMarkerDataeqERKS0_
-__ZNK7WebCore15SVGFitToViewBox22viewBoxToViewTransformEff
-__ZNK7WebCore16SVGMarkerElement11markerWidthEv
-__ZNK7WebCore16SVGMarkerElement12markerHeightEv
-__ZN7WebCore19clipPathConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGClipPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore18SVGClipPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore18SVGClipPathElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore18SVGClipPathElement25setClipPathUnitsBaseValueEi
-__ZN7WebCore18SVGClipPathElement16setClipPathUnitsEi
-__ZNK7WebCore18SVGClipPathElement7isValidEv
-__ZN7WebCore18SVGClipPathElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore18SVGClipPathElement15childrenChangedEb
-__ZN7WebCore13StyleClipDataC1ERKS0_
-__ZN7WebCore14SVGMaskElement28setMaskContentUnitsBaseValueEi
-__ZN7WebCore14SVGMaskElement19setMaskContentUnitsEi
-__ZNK7WebCore13StyleClipDataeqERKS0_
-__ZN7WebCore12SVGTransform8setSkewYEf
-__ZN7WebCore15AffineTransform5skewYEd
-__ZN7WebCore19textPathConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGTextPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore18SVGTextPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn108_NK7WebCore18SVGTextPathElement14contextElementEv
-__ZNK7WebCore18SVGTextPathElement14contextElementEv
-__ZN7WebCore18SVGTextPathElement20insertedIntoDocumentEv
-__ZNK7WebCore18SVGTextPathElement4hrefEv
-__ZN7WebCore18SVGTextPathElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore18SVGTextPathElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore17RenderSVGTextPathC1EPNS_4NodeE
-__ZNK7WebCore18SVGTextPathElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore18SVGTextPathElement23setStartOffsetBaseValueENS_9SVGLengthE
-__ZN7WebCore18SVGTextPathElement14setStartOffsetENS_9SVGLengthE
-__ZN7WebCore22SVGCharacterLayoutInfo15setInPathLayoutEb
-__ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_13InlineFlowBoxEf
-__ZNK7WebCore17RenderSVGTextPath10layoutPathEv
-__ZN7WebCore4Path6lengthEv
-__ZN7WebCore18PathTraversalStateC1ENS0_19PathTraversalActionE
-__ZNK7WebCore4Path5applyEPvPFvS1_PKNS_11PathElementEE
-__ZN7WebCore26CGPathApplierToPathApplierEPvPK13CGPathElement
-__ZN7WebCore25pathLengthApplierFunctionEPvPKNS_11PathElementE
-__ZN7WebCore18PathTraversalState6moveToERKNS_10FloatPointE
-__ZN7WebCore18PathTraversalState13cubicBezierToERKNS_10FloatPointES3_S3_
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE6shrinkEm
-__ZNK7WebCore17RenderSVGTextPath11startOffsetEv
-__ZNK7WebCore18SVGTextPathElement11startOffsetEv
-__ZNK7WebCore9SVGLength17valueAsPercentageEv
-__ZNK7WebCore9SVGLength21valueInSpecifiedUnitsEv
-__ZN7WebCore22SVGCharacterLayoutInfo27nextPathLayoutPointAndAngleEfff
-__ZN7WebCore4Path13pointAtLengthEfRb
-__ZN7WebCore4Path19normalAngleAtLengthEfRb
-__ZN7WebCore18PathTraversalState6lineToERKNS_10FloatPointE
-__ZN7WebCore15trefConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGTRefElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGTRefElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn108_NK7WebCore14SVGTRefElement14contextElementEv
-__ZNK7WebCore14SVGTRefElement14contextElementEv
-__ZN7WebCore14SVGTRefElement20updateReferencedTextEv
-__ZNK7WebCore14SVGTRefElement4hrefEv
-__ZN7WebCore14SVGTRefElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore14SVGTRefElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore17SVGPatternElement31setPatternContentUnitsBaseValueEi
-__ZN7WebCore17SVGPatternElement22setPatternContentUnitsEi
-__ZN7WebCore11SVGAElement18setTargetBaseValueENS_6StringE
-__ZN7WebCore11SVGAElement9setTargetENS_6StringE
-__ZN7WebCore18SVGFontFaceElement15childrenChangedEb
-__ZN7WebCore24font_face_srcConstructorEPNS_8DocumentEb
-__ZN7WebCore21SVGFontFaceSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore21SVGFontFaceSrcElement8srcValueEv
-__ZN7WebCore21SVGFontFaceSrcElement15childrenChangedEb
-__ZN7WebCore24font_face_uriConstructorEPNS_8DocumentEb
-__ZN7WebCore21SVGFontFaceUriElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore21SVGFontFaceUriElement8srcValueEv
-__ZN7WebCore19metadataConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGMetadataElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore8SVGTests16requiredFeaturesEv
-__ZN7WebCore14isSVG11FeatureERKNS_6StringE
-__ZN7WebCore9addStringERN3WTF7HashSetINS_6StringENS_15CaseFoldingHashENS0_10HashTraitsIS2_EEEEPKc
-__ZN7WebCore8SVGTests16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore12SVGLangSpace16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore28SVGExternalResourcesRequired16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore29SVGStyledTransformableElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore16SVGTransformable16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore16SVGStyledElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore26ignorableWhitespaceHandlerEPvPKhi
-__ZNK7WebCore24SVGLinearGradientElement14contextElementEv
-__ZNK7WebCore17SVGPatternElement14contextElementEv
-__ZN3KJS17staticValueGetterIN7WebCore12JSSVGElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSSVGElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore16JSSVGRectElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSSVGRectElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14SVGRectElement9xAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement20SVGAnimatedTemplateXES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateXC1EPKS0_RKNS_13QualifiedNameE
-__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS6_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore28JSSVGAnimatedLengthPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGAnimatedLengthC1EPN3KJS8JSObjectEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore19JSSVGAnimatedLength18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSSVGAnimatedLengthEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSSVGAnimatedLength16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E8containsIS6_NS_22IdentityHashTranslatorIS6_S8_SC_EEEEbRKT_
-__ZNK3WTF7HashMapIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_35JSSVGPODTypeWrapperCreatorReadWriteIS3_S5_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIS9_EEE3getERKS6_
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E3addIS6_PNS1_35JSSVGPODTypeWrapperCreatorReadWriteIS3_S5_EENS_17HashMapTranslatorILb1ES7_IS6_SN_ENS_18PairBaseHashTraitsISF_NSG_ISN_EEEESI_SC_EEEES7_INS_17HashTableIteratorIS6_S8_SA_SC_SI_SF_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS8_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGLengthC1EPN3KJS8JSObjectEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGLength18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore11JSSVGLengthEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSSVGLength16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore35JSSVGPODTypeWrapperCreatorReadWriteINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEEcvS1_Ev
-__ZNK7WebCore14SVGRectElement20SVGAnimatedTemplateX7baseValEv
-__ZNK7WebCore14SVGRectElement10xBaseValueEv
-__ZNK7WebCore14SVGRectElement9yAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement20SVGAnimatedTemplateYES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateYC1EPKS0_RKNS_13QualifiedNameE
-__ZNK7WebCore14SVGRectElement20SVGAnimatedTemplateY7baseValEv
-__ZNK7WebCore14SVGRectElement10yBaseValueEv
-__ZNK7WebCore14SVGRectElement13widthAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement24SVGAnimatedTemplateWidthES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement24SVGAnimatedTemplateWidthC1EPKS0_RKNS_13QualifiedNameE
-__ZNK7WebCore14SVGRectElement24SVGAnimatedTemplateWidth7baseValEv
-__ZNK7WebCore14SVGRectElement14widthBaseValueEv
-__ZNK7WebCore14SVGRectElement14heightAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement25SVGAnimatedTemplateHeightES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement25SVGAnimatedTemplateHeightC1EPKS0_RKNS_13QualifiedNameE
-__ZNK7WebCore14SVGRectElement25SVGAnimatedTemplateHeight7baseValEv
-__ZNK7WebCore14SVGRectElement15heightBaseValueEv
-__ZN7WebCore11JSSVGLength3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSSVGLength16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore9SVGLength8setValueEf
-__ZN7WebCore35JSSVGPODTypeWrapperCreatorReadWriteINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateX10setBaseValENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateY10setBaseValENS_9SVGLengthE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3addERKS2_RKSB_
-__ZN7WebCore21SVGDocumentExtensions21removePendingResourceERKNS_12AtomicStringE
-__ZN7WebCore11SVGResource17invalidateClientsEN3WTF7HashSetIPNS_16SVGStyledElementENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
-__ZNK7WebCore18SVGGradientElement26gradientTransformBaseValueEv
-__ZNK7WebCore18SVGGradientElement17gradientTransformEv
-__ZNK7WebCore17SVGPatternElement25patternTransformBaseValueEv
-__ZNK7WebCore17SVGPatternElement16patternTransformEv
-__ZN7WebCore13SVGUseElement24alterShadowTreeForSVGTagEPNS_10SVGElementE
-__ZN7WebCore15viewConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGViewElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGViewElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGViewElement16rendererIsNeededEPNS_11RenderStyleE
-__ZThn80_NK7WebCore14SVGViewElement14contextElementEv
-__ZNK7WebCore14SVGViewElement14contextElementEv
-__ZNK7WebCore14SVGViewElement10viewTargetEv
-__ZN7WebCore26RenderSVGViewportContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore26RenderSVGViewportContainer22applyContentTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore26RenderSVGViewportContainer25applyAdditionalTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore26RenderSVGViewportContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore14RenderSVGImage12imageChangedEPNS_11CachedImageE
-__ZN7WebCore14SVGImageLoader17dispatchLoadEventEv
-__ZN7WebCore8SVGImageC1EPNS_13ImageObserverE
-__ZN7WebCore8SVGImage11dataChangedEb
-__ZN7WebCore25SVGEmptyFrameLoaderClient20createDocumentLoaderERKNS_15ResourceRequestERKNS_14SubstituteDataE
-__ZN7WebCore25SVGEmptyFrameLoaderClient22provisionalLoadStartedEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient25setMainFrameDocumentReadyEb
-__ZN7WebCore25SVGEmptyFrameLoaderClient17setCopiesOnScrollEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31prepareForDataSourceReplacementEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31transitionToCommittedForNewPageEv
-__ZN7WebCore20SVGEmptyEditorClient23clearUndoRedoOperationsEv
-__ZN7WebCore20SVGEmptyChromeClient16setStatusbarTextERKNS_6StringE
-__ZN7WebCore25SVGEmptyFrameLoaderClient15finishedLoadingEPNS_14DocumentLoaderE
-__ZN7WebCore25SVGEmptyFrameLoaderClient18frameLoadCompletedEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient21forceLayoutForNonHTMLEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient9userAgentERKNS_4KURLE
-__ZN7WebCore25SVGEmptyFrameLoaderClient17cancelPolicyCheckEv
-__ZN7WebCore20SVGEmptyChromeClient30canRunBeforeUnloadConfirmPanelEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient22clearArchivedResourcesEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient27willChangeEstimatedProgressEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31postProgressStartedNotificationEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient26didChangeEstimatedProgressEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31dispatchDidStartProvisionalLoadEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient32assignIdentifierToInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
-__ZN7WebCore25SVGEmptyFrameLoaderClient23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore25SVGEmptyFrameLoaderClient31dispatchDecidePolicyForMIMETypeEMNS_11FrameLoaderEFvNS_12PolicyActionEERKNS_6StringERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader24cancelContentPolicyCheckEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient17dispatchWillCloseEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient18makeRepresentationEPNS_14DocumentLoaderE
-__ZN7WebCore14DocumentLoaderD2Ev
-__ZNK7WebCore17FrameLoaderClient11hasHTMLViewEv
-__ZNK7WebCore25SVGEmptyFrameLoaderClient17overrideMediaTypeEv
-__ZN7WebCore6Widget6resizeEii
-__ZN7WebCore25SVGEmptyFrameLoaderClient29dispatchDidHandleOnloadEventsEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient22dispatchDidFirstLayoutEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient29dispatchDidFinishDocumentLoadEv
-__ZNK7WebCore8SVGImage4sizeEv
-__ZNK7WebCore11SVGDocument11rootElementEv
-__ZNK7WebCore8SVGImage16hasRelativeWidthEv
-__ZN7WebCore10CachedFont4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore10CachedFont11checkNotifyEv
-__ZN7WebCore17CSSFontFaceSource10fontLoadedEPNS_10CachedFontE
-__ZN7WebCore11CSSFontFace10fontLoadedEPNS_17CSSFontFaceSourceE
-__ZNK7WebCore11CSSFontFace8isLoadedEv
-__ZN7WebCore20CSSSegmentedFontFace10fontLoadedEPNS_11CSSFontFaceE
-__ZNK7WebCore20CSSSegmentedFontFace8isLoadedEv
-__ZN7WebCore15CSSFontSelector10fontLoadedEPNS_20CSSSegmentedFontFaceE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore14SimpleFontDataEKNS_7HashMapIiS3_NS_7IntHashIjEENS_10HashTraitsIiEENS7_IS3_EEEEEEvRT0_
-__ZN7WebCore14SimpleFontDataD1Ev
-__ZN7WebCore14SimpleFontData15platformDestroyEv
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore13GlyphWidthMap14GlyphWidthPageEKNS_7HashMapIiS4_NS_7IntHashIjEENS_10HashTraitsIiEENS8_IS4_EEEEEEvRT0_
-__ZN7WebCore10SVGElement13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore10CachedFont17ensureSVGFontDataEv
-__ZNK7WebCore10CachedFont14getSVGFontByIdERKNS_6StringE
-__ZN7WebCore10CachedFont26platformDataFromCustomDataEfbb
-__ZN7WebCore15SVGTitleElement19removedFromDocumentEv
-__ZN7WebCore16SVGScriptElementD1Ev
-__ZN7WebCore24JSSVGPODTypeWrapperCacheINS_9FloatRectENS_19SVGAnimatedTemplateIS1_EEE13forgetWrapperEPNS_19JSSVGPODTypeWrapperIS1_EE
-__ZN7WebCore18JSSVGRectPrototypeD0Ev
-__ZN7WebCore11JSSVGMatrixD0Ev
-__ZN7WebCore24JSSVGPODTypeWrapperCacheINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE13forgetWrapperEPNS_19JSSVGPODTypeWrapperIS1_EE
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E4findIS6_NS_22IdentityHashTranslatorIS6_S8_SC_EEEENS_17HashTableIteratorIS6_S8_SA_SC_SI_SF_EERKT_
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore16SVGInlineFlowBoxD1Ev
-__ZN7WebCore14RenderSVGTSpanD1Ev
-__ZN7WebCore16SVGInlineTextBox14paintSelectionEiRKNS_7SVGCharEPKtiPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_4FontE
-__ZNK7WebCore14SVGLineElement15supportsMarkersEv
-__ZNK7WebCore4Font20drawTextUsingSVGFontEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZN7WebCore16SVGTextRunWalkerINS_28SVGTextRunWalkerDrawTextDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
-__ZN7WebCore28drawTextUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_28SVGTextRunWalkerDrawTextDataE
-__ZN7WebCore13SVGUseElement6detachEv
-__ZN7WebCore15SVGGlyphElement19removedFromDocumentEv
-__ZN7WebCore14SVGFontElement20removeGlyphFromCacheEPNS_15SVGGlyphElementE
-__ZN7WebCore16SVGRootInlineBox37retrievePaintServersForTextDecorationEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE6shrinkEm
-__ZN7WebCore16SVGInlineTextBox15paintDecorationENS_15ETextDecorationEPNS_15GraphicsContextEiiiRKNS_7SVGCharERKNS_21SVGTextDecorationInfoE
-__ZN3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZN7WebCore17RenderSVGTextPathD1Ev
+__ZNK7WebCore14SVGPathElement10toPathDataEv
+__ZN7WebCore14SVGPathSegList10toPathDataEv
+__ZNK7WebCore19SVGPathSegMovetoAbs11pathSegTypeEv
+__ZNK7WebCore19SVGPathSegLinetoAbs11pathSegTypeEv
+__ZNK7WebCore19SVGPathSegClosePath11pathSegTypeEv
 __ZN7WebCore18getPaintServerByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18SVGGradientElement14canvasResourceEv
+__ZNK7WebCore24SVGLinearGradientElement12gradientTypeEv
+__ZN7WebCore28SVGPaintServerLinearGradientC1EPKNS_18SVGGradientElementE
+__ZN7WebCore28SVGPaintServerLinearGradientC2EPKNS_18SVGGradientElementE
+__ZN7WebCore22SVGPaintServerGradientC2EPKNS_18SVGGradientElementE
 __ZNK7WebCore14SVGPaintServer12resourceTypeEv
 __ZNK7WebCore10RenderPath12isRenderPathEv
 __ZN7WebCore11SVGResource9addClientEPNS_16SVGStyledElementE
-__ZN3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZNK3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZNK3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS
 __ZNK7WebCore22SVGPaintServerGradient5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore24SVGRadialGradientElement13buildGradientEv
-__ZNK7WebCore24SVGRadialGradientElement25collectGradientPropertiesEv
+__ZNK7WebCore24SVGLinearGradientElement13buildGradientEv
+__ZNK7WebCore24SVGLinearGradientElement25collectGradientPropertiesEv
 __ZNK7WebCore18SVGGradientElement10buildStopsEv
 __ZNK7WebCore14SVGStopElement14isGradientStopEv
-__ZNK7WebCore14SVGStopElement6offsetEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE5va
+__ZN7WebCore16SVGStyledElement12resolveStyleEPNS_11RenderStyleE
+__ZN7WebCoreL25colorFromSVGColorCSSValueEPNS_8CSSValueEPNS_11RenderStyleE
+__ZNK7WebCore8SVGColor9colorTypeEv
+__ZN7WebCore13StyleStopDataC1ERKS0_
+__ZN7WebCore13StyleStopDataC2ERKS0_
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEm
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE15reserveCapacityEm
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEaSERKS5_
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE6shrinkEm
+__ZNK7WebCore19SVGAnimatedPropertyINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXa
 __ZN3WTF7HashSetIPKN7WebCore18SVGGradientElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZNK7WebCore18SVGGradientElement4hrefEv
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6ex
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6re
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13a
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15d
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEC1ERKS5_
-__ZN7WebCore22SVGPaintServerGradient16setGradientStopsERKN3WTF6VectorISt4pairIfNS_5ColorEELm0EEE
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEC2ERKS5_
+__ZN7WebCore10FloatPoint15narrowPrecisionEdd
+__ZN7WebCore8Gradient15setSpreadMethodENS_20GradientSpreadMethodE
+__ZN7WebCore22SVGPaintServerGradient11setGradientEN3WTF10PassRefPtrINS_8GradientEEE
 __ZN7WebCore22SVGPaintServerGradient18setBoundingBoxModeEb
-__ZN7WebCore22SVGPaintServerGradient23setGradientSpreadMethodERKNS_23SVGGradientSpreadMethodE
-__ZN7WebCore22SVGPaintServerGradient20setGradientTransformERKNS_15AffineTransformE
-__ZN7WebCore28SVGPaintServerRadialGradient17setGradientCenterERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerRadialGradient16setGradientFocalERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerRadialGradient17setGradientRadiusEf
-__ZN7WebCore22SVGPaintServerGradient25updateQuartzGradientCacheEPKS0_
-__ZNK7WebCore22SVGPaintServerGradient13gradientStopsEv
-__ZN7WebCore22SVGPaintServerGradient30updateQuartzGradientStopsCacheERKN3WTF6VectorISt4pairIfNS_5ColorEELm0EEE
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE15reserveCapacityEm
-__ZNK7WebCore28SVGPaintServerRadialGradient4typeEv
-__ZNK7WebCore28SVGPaintServerRadialGradient14gradientCenterEv
-__ZNK7WebCore28SVGPaintServerRadialGradient13gradientFocalEv
-__ZNK7WebCore28SVGPaintServerRadialGradient14gradientRadiusEv
-__ZNK7WebCore22SVGPaintServerGradient10renderPathERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
+__ZN7WebCore22SVGPaintServerGradient20setGradientTransformERKNS_20TransformationMatrixE
+__ZN7WebCore28SVGPaintServerLinearGradient16setGradientStartERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerLinearGradient14setGradientEndERKNS_10FloatPointE
 __ZNK7WebCore22SVGPaintServerGradient15boundingBoxModeEv
-__ZNK7WebCore14SVGPaintServer14clipToFillPathEP9CGContextPKNS_12RenderObjectE
-__ZNK7WebCore22SVGPaintServerGradient46handleBoundingBoxModeAndGradientTransformationEPNS_15GraphicsContextERKNS_9FloatRectE
-__ZN7WebCore36CGAffineTransformMakeMapBetweenRectsE6CGRectS0_
 __ZNK7WebCore22SVGPaintServerGradient17gradientTransformEv
 __ZNK7WebCore22SVGPaintServerGradient8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZN7WebCore18cgGradientCallbackEPvPKfPf
-__ZN7WebCore18SVGGradientElementD0Ev
-__ZN7WebCore28SVGPaintServerRadialGradientD1Ev
-__ZN7WebCore22SVGPaintServerGradientD0Ev
-__ZN7WebCore18releaseCachedStopsEPv
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE6shrinkEm
-__ZN7WebCore14SVGPaintServerD0Ev
-__ZN7WebCore11SVGResourceD0Ev
-__ZN7WebCore15SVGStyleElementD1Ev
-__ZN7WebCore11SVGAElementD1Ev
-__ZNK7WebCore14SVGPolyElement15supportsMarkersEv
-__ZN7WebCore28SVGPaintServerLinearGradientD1Ev
-__ZN7WebCore8SVGColorD1Ev
-__ZN7WebCore14RenderSVGImage5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderSVGImage25adjustRectsForAspectRatioERNS_9FloatRectES2_PNS_22SVGPreserveAspectRatioE
-__ZN7WebCore8SVGImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
-__ZN7WebCore5Image14resetAnimationEv
-__ZN7WebCore28JSSVGAnimatedLengthPrototypeD0Ev
-__ZN7WebCore17SVGPatternElement14canvasResourceEv
-__ZN7WebCore21SVGPaintServerPatternC1EPKNS_17SVGPatternElementE
-__ZNK7WebCore21SVGPaintServerPattern5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore17SVGPatternElement12buildPatternERKNS_9FloatRectE
-__ZNK7WebCore17SVGPatternElement24collectPatternPropertiesEv
-__ZNK7WebCore17SVGPatternElement1xEv
-__ZNK7WebCore17SVGPatternElement1yEv
-__ZNK7WebCore17SVGPatternElement6heightEv
-__ZN3WTF7HashSetIPKN7WebCore17SVGPatternElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZNK7WebCore17SVGPatternElement4hrefEv
-__ZN7WebCore30clampImageBufferSizeToViewportEPNS_12RenderObjectERNS_7IntSizeE
-__ZN7WebCore11ImageBuffer6createERKNS_7IntSizeEb
-__ZN7WebCore11ImageBufferC1EPvRKNS_7IntSizeESt8auto_ptrINS_15GraphicsContextEE
-__ZNK7WebCore11ImageBuffer7contextEv
-__ZN7WebCore20renderSubtreeToImageEPNS_11ImageBufferEPNS_12RenderObjectE
-__ZN7WebCore21SVGPaintServerPattern19setPatternTransformERKNS_15AffineTransformE
-__ZN7WebCore21SVGPaintServerPattern20setPatternBoundariesERKNS_9FloatRectE
-__ZN7WebCore21SVGPaintServerPattern7setTileESt8auto_ptrINS_11ImageBufferEE
-__ZNK7WebCore21SVGPaintServerPattern4tileEv
-__ZNK7WebCore21SVGPaintServerPattern16patternTransformEv
-__ZNK7WebCore21SVGPaintServerPattern17patternBoundariesEv
-__ZNK7WebCore11ImageBuffer7cgImageEv
-__ZNK7WebCore21SVGPaintServerPattern8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore12RenderObject12isRenderPathEv
-__ZN7WebCore13RenderSVGText13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN7WebCore11ImageBufferD1Ev
-__ZNK7WebCore24SVGLinearGradientElement13buildGradientEv
-__ZNK7WebCore24SVGLinearGradientElement25collectGradientPropertiesEv
-__ZN7WebCore16SVGStyledElement12resolveStyleEPNS_11RenderStyleE
-__ZN7WebCore28SVGPaintServerLinearGradient16setGradientStartERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerLinearGradient14setGradientEndERKNS_10FloatPointE
-__ZNK7WebCore28SVGPaintServerLinearGradient4typeEv
-__ZNK7WebCore28SVGPaintServerLinearGradient13gradientStartEv
-__ZNK7WebCore28SVGPaintServerLinearGradient11gradientEndEv
-__ZNK7WebCore14SVGPaintServer16clipToStrokePathEP9CGContextPKNS_12RenderObjectE
-__ZNK7WebCore24SVGLinearGradientElement2x1Ev
-__ZNK7WebCore24SVGLinearGradientElement2y1Ev
-__ZNK7WebCore24SVGLinearGradientElement2x2Ev
-__ZNK7WebCore24SVGLinearGradientElement2y2Ev
-__ZNK7WebCore18SVGGradientElement12spreadMethodEv
-__ZNK7WebCore24SVGRadialGradientElement2cxEv
-__ZNK7WebCore24SVGRadialGradientElement2cyEv
-__ZNK7WebCore24SVGRadialGradientElement2fxEv
-__ZNK7WebCore24SVGRadialGradientElement2fyEv
-__ZN7WebCore16SVGTransformList11consolidateEv
-__ZN7WebCore15GraphicsContext18setUseAntialiasingEb
-__ZN7WebCore18SVGClipPathElement14canvasResourceEv
-__ZN7WebCore18SVGResourceClipperC1Ev
-__ZNK7WebCore18SVGClipPathElement13clipPathUnitsEv
-__ZNK7WebCore29SVGStyledTransformableElement21isStyledTransformableEv
-__ZNK7WebCore29SVGStyledTransformableElement10toClipPathEv
-__ZN7WebCore18SVGResourceClipper11addClipDataERKNS_4PathENS_8WindRuleEb
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE15reserveCapacityEm
-__ZNK7WebCore18SVGResourceClipper8clipDataEv
-__ZNK7WebCore18SVGResourceClipper12resourceTypeEv
-__ZNK7WebCore18SVGResourceClipper9applyClipEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZNK7WebCore14SVGPathElement15supportsMarkersEv
+__ZN7WebCore18SVGGradientElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore24RenderSVGHiddenContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore24RenderSVGHiddenContainerC2EPNS_16SVGStyledElementE
+__ZN7WebCore14SVGStopElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore21RenderSVGGradientStopC1EPNS_14SVGStopElementE
+__ZN7WebCore21RenderSVGGradientStopC2EPNS_14SVGStopElementE
+__ZN7WebCore21RenderSVGGradientStop14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore21RenderSVGGradientStop15gradientElementEv
+__ZNK7WebCore24SVGRadialGradientElement12gradientTypeEv
+__ZN7WebCore28SVGPaintServerRadialGradientC1EPKNS_18SVGGradientElementE
+__ZN7WebCore28SVGPaintServerRadialGradientC2EPKNS_18SVGGradientElementE
+__ZN7WebCore11SVGResource10invalidateEv
+__ZN7WebCore12SVGTransform8setScaleEff
+__ZN7WebCoreL18ellipseConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGEllipseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGEllipseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore12SVGTransform9setRotateEfff
+__ZN7WebCore17SVGEllipseElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore17SVGEllipseElement7isValidEv
+__ZNK7WebCore13StyleStopDataeqERKS0_
+__ZN7WebCore24RenderSVGHiddenContainer6layoutEv
+__ZN7WebCore21RenderSVGGradientStop6layoutEv
+__ZNK7WebCore17SVGEllipseElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12rxAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cyAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxAt
+__ZNK7WebCore24RenderSVGHiddenContainer29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore12RenderObject22localToParentTransformEv
+__ZNK7WebCore12RenderObject14localTransformEv
+__ZN7WebCore24RenderSVGHiddenContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore24SVGRadialGradientElement13buildGradientEv
+__ZNK7WebCore24SVGRadialGradientElement25collectGradientPropertiesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXa
+__ZN7WebCore28SVGPaintServerRadialGradient17setGradientCenterERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerRadialGradient16setGradientFocalERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerRadialGradient17setGradientRadiusEf
+__ZN7WebCore13SVGPathParser12calculateArcEbRdS1_dddddbb
+__ZN7WebCore21SVGPathSegListBuilder15svgCurveToCubicEddddddb
+__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicAbsEffffff
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsC1Effffff
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsC2Effffff
+__ZNK7WebCore25SVGPathSegCurvetoCubicAbs11pathSegTypeEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_22SVGPreserveAspectRatioENS1_10StringHashENS_10HashTrait
+__ZN7WebCore22SVGPreserveAspectRatio24parsePreserveAspectRatioERPKtS2_b
+__ZN7WebCore19SVGAnimatedPropertyINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames1
+__ZThn184_NK7WebCore16SVGScriptElement14contextElementEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_6StringENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_EEE
+__ZThn288_NK7WebCore16SVGScriptElement13scriptCharsetEv
+__ZNK7WebCore16SVGScriptElement13scriptCharsetEv
+__ZThn288_NK7WebCore16SVGScriptElement21charsetAttributeValueEv
+__ZNK7WebCore16SVGScriptElement21charsetAttributeValueEv
+__ZN7WebCore12SVGTransform9setMatrixENS_20TransformationMatrixE
+__ZN7WebCoreL16tspanConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGTSpanElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTSpanElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTSpanElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderSVGTSpanC1EPNS_4NodeE
+__ZN7WebCore14RenderSVGTSpanC2EPNS_4NodeE
+__ZN7WebCore15RenderSVGInlineC2EPNS_4NodeE
+__ZNK7WebCore15RenderSVGInline13requiresLayerEv
+__ZNK7WebCore15SVGTSpanElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore15RenderSVGInline13createFlowBoxEv
+__ZN7WebCore22SVGCharacterLayoutInfo14processedChunkEff
+__ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14shrinkCapacityEm
+__ZN7WebCore9InlineBox18isSVGRootInlineBoxEv
+__ZNK7WebCore16SVGInlineFlowBox12svgBoxHeightEv
+__ZN7WebCore30jsHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLScriptElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLScriptElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCoreL15defsConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGDefsElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14SVGDefsElement7isValidEv
+__ZN7WebCore14SVGDefsElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore8SVGColorC1ERKNS_6StringE
+__ZN7WebCoreL15maskConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGMaskElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEEC
+__ZN7WebCore14SVGMaskElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGMaskElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore14SVGMaskElement7isValidEv
+__ZN7WebCore14SVGMaskElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore18RenderSVGContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore18RenderSVGContainer16setDrawsContentsEb
+__ZN7WebCore14SVGMaskElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13StyleMaskDataC1ERKS0_
+__ZN7WebCore13StyleMaskDataC2ERKS0_
+__ZNK7WebCore13StyleMaskDataeqERKS0_
+__ZN7WebCore18RenderSVGContainer23calculateLocalTransformEv
 __ZN7WebCore14SVGMaskElement14canvasResourceEv
 __ZN7WebCore17SVGResourceMaskerC1EPKNS_14SVGMaskElementE
+__ZN7WebCore17SVGResourceMaskerC2EPKNS_14SVGMaskElementE
 __ZNK7WebCore17SVGResourceMasker12resourceTypeEv
 __ZN7WebCore17SVGResourceMasker9applyMaskEPNS_15GraphicsContextERKNS_9FloatRectE
 __ZNK7WebCore14SVGMaskElement17drawMaskerContentERKNS_9FloatRectERS1_
-__ZNK7WebCore14SVGMaskElement9maskUnitsEv
-__ZNK7WebCore14SVGMaskElement1xEv
-__ZNK7WebCore14SVGMaskElement1yEv
-__ZNK7WebCore14SVGMaskElement5widthEv
-__ZNK7WebCore14SVGMaskElement6heightEv
-__ZNK7WebCore14SVGMaskElement16maskContentUnitsEv
-__ZN7WebCore33applyExpandAlphatoGrayscaleFilterEP7CIImage
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE6shrinkEm
-__ZN7WebCore24RenderSVGHiddenContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore16SVGMarkerElement14canvasResourceEv
-__ZN7WebCore17SVGResourceMarkerC1Ev
-__ZN7WebCore17SVGResourceMarker9setMarkerEPNS_26RenderSVGViewportContainerE
-__ZN7WebCore13SVGSVGElement14createSVGAngleEv
-__ZN7WebCore16SVGMarkerElement16setOrientToAngleEPNS_8SVGAngleE
-__ZN7WebCore16SVGMarkerElement23setOrientAngleBaseValueEPNS_8SVGAngleE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_8SVGAngleEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore16SVGMarkerElement14setOrientAngleEPNS_8SVGAngleE
-__ZNK7WebCore16SVGMarkerElement10orientTypeEv
-__ZNK7WebCore16SVGMarkerElement11orientAngleEv
-__ZNK7WebCore8SVGAngle5valueEv
-__ZNK7WebCore16SVGMarkerElement4refYEv
-__ZNK7WebCore16SVGMarkerElement4refXEv
-__ZN7WebCore17SVGResourceMarker6setRefEdd
-__ZNK7WebCore16SVGMarkerElement11markerUnitsEv
-__ZNK7WebCore17SVGResourceMarker12resourceTypeEv
-__ZN7WebCore15DrawMarkersDataC1EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
-__ZN7WebCore22drawStartAndMidMarkersEPvPKNS_11PathElementE
-__ZN7WebCore18drawMarkerWithDataEPNS_15GraphicsContextERNS_10MarkerDataE
-__ZN7WebCore17SVGResourceMarker4drawEPNS_15GraphicsContextERKNS_9FloatRectEdddd
-__ZN3WTF7HashSetIPN7WebCore17SVGResourceMarkerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore17SVGResourceMarker12cachedBoundsEv
-__ZN7WebCore17SVGResourceMarkerD1Ev
-__ZN7WebCore18SVGResourceClipper13resetClipDataEv
-__ZNK7WebCore10SVGElement21isStyledTransformableEv
-__ZN7WebCore11SVGFontDataD1Ev
-__ZN7WebCore10CachedFont20allReferencesRemovedEv
-__ZN7WebCore16SVGCursorElementD1Ev
-__ZNK7WebCore4Path11debugStringEv
-__ZN7WebCore31CGPathToCFStringApplierFunctionEPvPK13CGPathElement
-__ZN3WTFeqIN7WebCore6StringELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZNK7WebCore11SVGDocument17zoomAndPanEnabledEv
-__ZNK7WebCore13SVGZoomAndPan10zoomAndPanEv
-__ZNK7WebCore12RenderObject4yPosEv
-__ZNK7WebCore12RenderObject4xPosEv
-__ZN7WebCore12RenderObject22positionForCoordinatesEii
-__ZN7WebCore21SVGDocumentExtensions15pauseAnimationsEv
-__ZN7WebCore13SVGSVGElement15pauseAnimationsEv
-__ZNK7WebCore13TimeScheduler16animationsPausedEv
-__ZN7WebCore9CSSParser18parseHSLParametersEPNS_5ValueEPdb
-__ZN7WebCore16makeRGBAFromHSLAEdddd
-__ZN7WebCore10CachedFont20ensureCustomFontDataEv
-__ZN7WebCore28createFontCustomPlatformDataEPNS_12SharedBufferE
-__ZN7WebCore22FontCustomPlatformData16fontPlatformDataEibb
-__ZN3KJS17staticValueGetterIN7WebCore16JSRangePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSRangePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore45jsRangePrototypeFunctionCompareBoundaryPointsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore35jsRangePrototypeFunctionSetEndAfterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore36jsRangePrototypeFunctionSetEndBeforeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range12setEndBeforeEPNS_4NodeERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14RangeExceptionE
-__ZN7WebCore16JSRangeExceptionC1EPN3KJS8JSObjectEPNS_14RangeExceptionE
-__ZN7WebCore16JSRangeException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSRangeExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore25JSRangeExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSRangeExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore16JSRangeExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSRangeException16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore40jsRangePrototypeFunctionSurroundContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range16surroundContentsEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZNK7WebCore5Range14maxStartOffsetEv
-__ZN7WebCore17HTMLObjectElement7setDataERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore27JSDOMCoreExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSDOMCoreExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore37jsUIEventPrototypeFunctionInitUIEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9JSUIEvent9classInfoEv
-__ZN7WebCore39jsTextPrototypeFunctionReplaceWholeTextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Text16replaceWholeTextERKNS_6StringERi
-__ZN7WebCore33earliestLogicallyAdjacentTextNodeEPKNS_4TextE
-__ZN7WebCore31latestLogicallyAdjacentTextNodeEPKNS_4TextE
-__ZN7WebCore25min_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore21colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore23screenDepthPerComponentEPNS_6WidgetE
-__ZN7WebCore11numberValueEPNS_8CSSValueERf
-__ZN7WebCore30min_monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore26monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore18screenIsMonochromeEPNS_6WidgetE
-__ZN7WebCore26min_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore22heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore26max_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZNK7WebCore16HTMLTableElement7captionEv
-__ZN7WebCore48jsHTMLTableElementPrototypeFunctionCreateCaptionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement13createCaptionEv
-__ZN7WebCore16HTMLTableElement10setCaptionEN3WTF10PassRefPtrINS_23HTMLTableCaptionElementEEERi
-__ZN7WebCore16HTMLTableElement13deleteCaptionEv
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTHeadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement11createTHeadEv
-__ZN7WebCore16HTMLTableElement8setTHeadEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
-__ZN7WebCore16HTMLTableElement11deleteTHeadEv
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTFootEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement11createTFootEv
-__ZN7WebCore16HTMLTableElement8setTFootEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
-__ZN7WebCore16HTMLTableElement11deleteTFootEv
-__ZN7WebCore25toHTMLTableCaptionElementEPN3KJS7JSValueE
-__ZNK7WebCore25JSHTMLTableCaptionElement9classInfoEv
-__ZNK7WebCore25JSHTMLTableCaptionElement4implEv
-__ZN7WebCore25toHTMLTableSectionElementEPN3KJS7JSValueE
-__ZN7WebCore48jsHTMLTableElementPrototypeFunctionDeleteCaptionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTHeadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTFootEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore19HTMLTableRowElement15sectionRowIndexEv
-__ZN7WebCore6JSAttr16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore6JSAttr8setValueEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore45jsElementPrototypeFunctionRemoveAttributeNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element19removeAttributeNodeEPNS_4AttrERi
-__ZN7WebCore15HTMLMetaElement12setHttpEquivERKNS_6StringE
-__ZN7WebCore48jsNamedNodeMapPrototypeFunctionRemoveNamedItemNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12NamedAttrMap17removeNamedItemNSERKNS_6StringES3_Ri
-__ZN7WebCore21createFontFaceWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore29JSSVGFontFaceElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGFontFaceElementC1EPN3KJS8JSObjectEPNS_18SVGFontFaceElementE
-__ZNK7WebCore20JSSVGFontFaceElement9classInfoEv
-__ZN7WebCore25createMissingGlyphWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore33JSSVGMissingGlyphElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSSVGMissingGlyphElementC1EPN3KJS8JSObjectEPNS_22SVGMissingGlyphElementE
-__ZNK7WebCore24JSSVGMissingGlyphElement9classInfoEv
-__ZN7WebCore18createGlyphWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore26JSSVGGlyphElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSSVGGlyphElementC1EPN3KJS8JSObjectEPNS_15SVGGlyphElementE
-__ZNK7WebCore17JSSVGGlyphElement9classInfoEv
-__ZNK7WebCore12JSSVGElement9classInfoEv
-__ZN7WebCore17createFontWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGFontElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGFontElementC1EPN3KJS8JSObjectEPNS_14SVGFontElementE
-__ZNK7WebCore16JSSVGFontElement9classInfoEv
-__ZN7WebCore18createTSpanWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore26JSSVGTSpanElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSSVGTSpanElementC1EPN3KJS8JSObjectEPNS_15SVGTSpanElementE
-__ZNK7WebCore17JSSVGTSpanElement9classInfoEv
-__ZN7WebCore56jsSVGTextContentElementPrototypeFunctionGetNumberOfCharsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore41jsHTMLButtonElementPrototypeFunctionClickEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore50jsHTMLIFrameElementPrototypeFunctionGetSVGDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21HTMLFrameOwnerElement14getSVGDocumentERi
-__ZN7WebCore50jsHTMLObjectElementPrototypeFunctionGetSVGDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16createSetWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore24JSSVGSetElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore30JSSVGAnimationElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSSVGSetElementC1EPN3KJS8JSObjectEPNS_13SVGSetElementE
-__ZN7WebCore21JSSVGAnimationElementC2EPN3KJS8JSObjectEPNS_19SVGAnimationElementE
-__ZN7WebCore21JSSVGAnimationElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSSVGAnimationElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSSVGSetElement9classInfoEv
-__ZN7WebCore22JSSVGLengthConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore22JSSVGLengthConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSSVGLengthConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14SVGRectElement24SVGAnimatedTemplateWidth7animValEv
-__ZN7WebCore61jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21SVGTextContentElement21getComputedTextLengthEv
-__ZN7WebCore21createTextPathWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGTextPathElementC1EPN3KJS8JSObjectEPNS_18SVGTextPathElementE
-__ZN7WebCore20JSSVGTextPathElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSSVGTextPathElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSSVGTextPathElement9classInfoEv
-__ZN7WebCore57jsSVGTextContentElementPrototypeFunctionGetRotationOfCharEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21SVGTextContentElement17getRotationOfCharElRi
-__ZN7WebCore16JSSVGFontElementD0Ev
-__ZN7WebCore17JSSVGGlyphElementD0Ev
-__ZN7WebCore24JSSVGMissingGlyphElementD0Ev
-__ZN7WebCore20JSSVGFontFaceElementD0Ev
-__ZN7WebCore15JSSVGSetElementD0Ev
-__ZN7WebCore17JSSVGTSpanElementD0Ev
-__ZN7WebCore25JSSVGFontElementPrototypeD0Ev
-__ZN7WebCore26JSSVGGlyphElementPrototypeD0Ev
-__ZN7WebCore33JSSVGMissingGlyphElementPrototypeD0Ev
-__ZN7WebCore29JSSVGFontFaceElementPrototypeD0Ev
-__ZN7WebCore24JSSVGSetElementPrototypeD0Ev
-__ZN7WebCore26JSSVGTSpanElementPrototypeD0Ev
-__ZN7WebCore58jsSVGTextContentElementPrototypeFunctionGetSubStringLengthEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21SVGTextContentElement18getSubStringLengthElmRi
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9FloatRectENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS8_
-__ZN7WebCore10JSLocation16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore21allowsAccessFromFrameEPN3KJS9ExecStateEPNS_5FrameE
-__ZNK7WebCore23JSDOMSelectionPrototype9classInfoEv
-__ZN7WebCore9JSHistory3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9JSHistory9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore46jsHTMLOptionsCollectionPrototypeFunctionRemoveEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore23JSHTMLOptionsCollection9classInfoEv
-__ZN7WebCore23JSHTMLOptionsCollection6removeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore13MutationEventC1Ev
-__ZN7WebCore15JSMutationEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore15JSMutationEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSMutationEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore26JSMutationEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSMutationEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsHTMLOptionsCollectionPrototypeFunctionAddEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore23JSHTMLOptionsCollection3addEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEERi
-__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEEiRi
-__ZNK7WebCore15JSTextPrototype9classInfoEv
-__ZNK7WebCore24JSCharacterDataPrototype9classInfoEv
-__ZNK7WebCore17JSTextConstructor9classInfoEv
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTransformEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStrin
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11yAttrStrin
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_16heightAttr
+__ZN7WebCore30clampImageBufferSizeToViewportEPNS_9FrameViewERNS_7IntSizeE
+__ZN7WebCore20renderSubtreeToImageEPNS_11ImageBufferEPNS_12RenderObjectE
+__ZNK7WebCore11ImageBuffer12getImageDataERKNS_7IntRectE
+__ZN7WebCore9ImageData6createEjj
+__ZN7WebCore9ImageDataC1Ejj
+__ZN7WebCore9ImageDataC2Ejj
+__ZN7WebCore16CanvasPixelArray6createEj
+__ZN7WebCore16CanvasPixelArrayC1Ej
+__ZN7WebCore16CanvasPixelArrayC2Ej
+__ZN7WebCore11ImageBuffer12putImageDataEPNS_9ImageDataERKNS_7IntRectERKNS_8IntPointE
+__ZN7WebCore30JSHTMLScriptElementConstructorD1Ev
+__ZNK7WebCore21HTMLFrameOwnerElement13scrollingModeEv
+__ZN7WebCore6Widget11handleEventEPNS_5EventE
+__ZNK7WebCore14RenderFieldset10renderNameEv
+__ZN7WebCore8Document17setSecurityOriginEPNS_14SecurityOriginE
+__ZN7WebCore11FrameLoader5writeERKNS_6StringE
+__ZNK7WebCore15CSSInitialValue22isImplicitInitialValueEv
+__ZN7WebCore10CachedFont5errorEv
+__ZNK7WebCore15HTMLLinkElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore9TextCodec25getUnencodableReplacementEjNS_19UnencodableHandlingEPc
+__ZN7WebCore21setJSDOMWindowOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore17RenderFlexibleBox10renderNameEv
+__ZN7WebCore17RenderFlexibleBoxD0Ev
+__ZN7WebCore24setJSHTMLFormElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement7setNameERKNS_6StringE
+__ZNK7WebCore16StyleCachedImage8isLoadedEv
+__ZNK7WebCore11RenderBlock18adjustForBorderFitEiRiS1_
+__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectES5_NS0_8TileRuleES6_NS_17CompositeOperatorE
+__ZN7WebCore13InlineFlowBox9paintMaskERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore8SVGImage26nativeImageForCurrentFrameEv
+__ZN7WebCore5Image14startAnimationEb
+__ZN7WebCore13InlineFlowBox14paintBoxShadowEPNS_15GraphicsContextEPNS_11RenderStyleEiiii
+__ZN7WebCore15GraphicsContext18clipOutRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
+__ZN7WebCore15GraphicsContext7clipOutERKNS_4PathE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionGetImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore24CanvasRenderingContext2D12getImageDataEffffRi
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatRectE
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_10FloatPointE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ImageDataE
+__ZN7WebCore11JSImageData15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSImageDataC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ImageDataEEE
+__ZN7WebCore11JSImageDataC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ImageDataEEE
+__ZN7WebCore11JSImageData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsImageDataWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsImageDataHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionPutImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore26JSCanvasRenderingContext2D12putImageDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore11toImageDataEN3JSC7JSValueE
+__ZNK7WebCore11JSImageData9classInfoEv
+__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffRi
+__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffffffRi
+__ZN7WebCore11JSImageDataD1Ev
+__ZN7WebCore11JSImageDataD2Ev
+__ZN7WebCore20JSImageDataPrototypeD1Ev
+__ZN7WebCore9CSSParser11parseCanvasERN3WTF6RefPtrINS_8CSSValueEEE
+__ZNK7WebCore14CSSCanvasValue11isFixedSizeEv
+__ZNK7WebCore10StyleImage13isCachedImageEv
+__ZN7WebCore46jsDocumentPrototypeFunctionGetCSSCanvasContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document19getCSSCanvasContextERKNS_6StringES3_ii
+__ZN7WebCore8Document19getCSSCanvasElementERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_17HTMLCanvasElementEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getER
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_17HTMLCanvasElementEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERK
+__ZNK7WebCore10StyleImage13errorOccurredEv
+__ZNK7WebCore19StyleGeneratedImage21imageHasRelativeWidthEv
+__ZN7WebCore14CSSCanvasValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore14CSSCanvasValue7elementEPNS_8DocumentE
+__ZThn104_N7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
+__ZN7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
+__ZNK7WebCore19StyleGeneratedImage4dataEv
+__ZN7WebCore14CSSCanvasValue9fixedSizeEPKNS_12RenderObjectE
+__ZThn104_N7WebCore14CSSCanvasValue15canvasDestroyedEPNS_17HTMLCanvasElementE
+__ZN7WebCore14CSSCanvasValue15canvasDestroyedEPNS_17HTMLCanvasElementE
+__ZN7WebCore14CSSCanvasValueD0Ev
+__ZNK7WebCore16RenderHTMLCanvas10renderNameEv
+__ZN7WebCore53setJSCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D27setGlobalCompositeOperationERKNS_6StringE
+__ZN7WebCore22parseCompositeOperatorERKNS_6StringERNS_17CompositeOperatorE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetFillColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore26JSCanvasRenderingContext2D12setFillColorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D12setFillColorEffff
+__ZN7WebCore11CanvasStyleC1Effff
+__ZN7WebCore11CanvasStyleC2Effff
+__ZN7WebCore20makeRGBA32FromFloatsEffff
+__ZN7WebCoreL20colorFloatToRGBAByteEf
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore24CanvasRenderingContext2D12setTransformEffffff
+__ZNK7WebCore15GraphicsContext6getCTMEv
+__ZNK7WebCore17HTMLCanvasElement13baseTransformEv
 __ZN7WebCore24CanvasRenderingContext2D9transformEffffff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore16RenderHTMLCanvas17canvasSizeChangedEv
-__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradientEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D20createRadialGradientEffffff
-__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointEfS3_f
-__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionArcToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D5arcToEfffffRi
-__ZN7WebCore4Path8addArcToERKNS_10FloatPointES3_f
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionBezierCurveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionScaleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D5scaleEff
+__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetXEf
+__ZN7WebCore24CanvasRenderingContext2D11applyShadowEv
+__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetYEf
+__ZN7WebCore39setJSCanvasRenderingContext2DShadowBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D13setShadowBlurEf
+__ZN7WebCore40setJSCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D14setShadowColorERKNS_6StringE
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionBezierCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
 __ZN7WebCore24CanvasRenderingContext2D13bezierCurveToEffffff
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionCreatePatternEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D13createPatternEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_17HTMLCanvasElementERKNS_6StringERi
-__ZN7WebCore13CanvasPattern19parseRepetitionTypeERKNS_6StringERbS4_Ri
-__ZN7WebCore13CanvasPatternC1EP7CGImagebb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_13CanvasPatternE
-__ZN7WebCore24JSCanvasPatternPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSCanvasPatternC1EPN3KJS8JSObjectEPNS_13CanvasPatternE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEff
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionRotateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionRotateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore24CanvasRenderingContext2D6rotateEf
 __ZN7WebCore15GraphicsContext6rotateEf
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionIsPointInPathEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D13isPointInPathEff
-__ZNK7WebCore15AffineTransform8mapPointERKNS_10FloatPointE
-__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_16HTMLImageElementERKNS_6StringERi
-__ZN7WebCore13CanvasPatternC1EPNS_11CachedImageEbb
+__ZN7WebCore33setJSCanvasRenderingContext2DFontEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D7setFontERKNS_6StringE
+__ZN7WebCore16CSSStyleSelector20applyPropertyToStyleEiPNS_8CSSValueEPNS_11RenderStyleE
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore26JSCanvasRenderingContext2D10strokeTextEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D10strokeTextERKNS_6StringEff
+__ZN7WebCore24CanvasRenderingContext2D16drawTextInternalERKNS_6StringEffbfb
+__ZN7WebCore24CanvasRenderingContext2D10accessFontEv
+__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D8fillTextEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D8fillTextERKNS_6StringEff
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionCreatePatternEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore26JSCanvasRenderingContext2D13createPatternEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_17HTMLCanvasElementERKNS_6StringERi
+__ZN7WebCore13CanvasPattern19parseRepetitionTypeERKNS_6StringERbS4_Ri
+__ZN7WebCore13CanvasPatternC1EPNS_5ImageEbbb
+__ZN7WebCore13CanvasPatternC2EPNS_5ImageEbbb
+__ZN7WebCore7PatternC1EPNS_5ImageEbb
+__ZN7WebCore7PatternC2EPNS_5ImageEbb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13CanvasPatternE
+__ZN7WebCore15JSCanvasPattern15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCanvasPatternC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CanvasPatternEEE
+__ZN7WebCore15JSCanvasPatternC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CanvasPatternEEE
 __ZNK7WebCore15JSCanvasPattern9classInfoEv
 __ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_13CanvasPatternEEE
-__ZN7WebCore24CanvasRenderingContext2D16applyFillPatternEv
-__ZN7WebCore13CanvasPattern13createPatternERK17CGAffineTransform
-__ZN7WebCore15patternCallbackEPvP9CGContext
-__ZN7WebCore11BitmapImage13getCGImageRefEv
-__ZN7WebCore22patternReleaseCallbackEPv
-__ZN7WebCore60jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D17drawImageFromRectEPN3KJS9ExecStateERKNS1_4ListE
+__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_13CanvasPatternEEE
+__ZN7WebCore15GraphicsContext14setFillPatternEN3WTF10PassRefPtrINS_7PatternEEE
+__ZN7WebCore15GraphicsContext16applyFillPatternEv
+__ZNK7WebCore7Pattern21createPlatformPatternERKNS_20TransformationMatrixE
+__ZN7WebCoreL15patternCallbackEPvP9CGContext
+__ZN7WebCoreL22patternReleaseCallbackEPv
+__ZN7WebCore15JSCanvasPatternD1Ev
+__ZN7WebCore15JSCanvasPatternD2Ev
+__ZN7WebCore7PatternD0Ev
+__ZN7WebCore24JSCanvasPatternPrototypeD1Ev
+__ZN7WebCore58jsCanvasRenderingContext2DPrototypeFunctionCreateImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZNK7WebCore24CanvasRenderingContext2D15createImageDataEff
+__ZN7WebCoreL20createEmptyImageDataERKNS_7IntSizeE
+__ZN7WebCore24CanvasRenderingContext2D5resetEv
+__ZN7WebCore35jsCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSCanvasRenderingContext2D9fillStyleEPN3JSC9ExecStateE
+__ZNK7WebCore24CanvasRenderingContext2D9fillStyleEv
+__ZN7WebCoreL4toJSEPN3JSC9ExecStateEPNS_11CanvasStyleE
+__ZN7WebCore37jsCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSCanvasRenderingContext2D11strokeStyleEPN3JSC9ExecStateE
+__ZNK7WebCore24CanvasRenderingContext2D11strokeStyleEv
+__ZN7WebCore38setJSCanvasRenderingContext2DTextAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D12setTextAlignERKNS_6StringE
+__ZN7WebCore14parseTextAlignERKNS_6StringERNS_9TextAlignE
+__ZN7WebCore54jsCanvasRenderingContext2DPrototypeFunctionMeasureTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore24CanvasRenderingContext2D11measureTextERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11TextMetricsE
+__ZN7WebCore13JSTextMetrics15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSTextMetricsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11TextMetricsEEE
+__ZN7WebCore13JSTextMetricsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11TextMetricsEEE
+__ZN7WebCore13JSTextMetrics18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsTextMetricsWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41setJSCanvasRenderingContext2DTextBaselineEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D15setTextBaselineERKNS_6StringE
+__ZN7WebCore17parseTextBaselineERKNS_6StringERNS_12TextBaselineE
+__ZN7WebCore13JSTextMetricsD1Ev
+__ZN7WebCore13JSTextMetricsD2Ev
+__ZN7WebCore22JSTextMetricsPrototypeD1Ev
+__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionArcToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D5arcToEfffffRi
+__ZN7WebCore4Path8addArcToERKNS_10FloatPointES3_f
+__ZN7WebCore22jsHTMLEmbedElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement4typeEv
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementERKNS_9FloatRectES5_Ri
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEff
+__ZN7WebCore60jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZN7WebCore26JSCanvasRenderingContext2D17drawImageFromRectEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore24CanvasRenderingContext2D17drawImageFromRectEPNS_16HTMLImageElementEffffffffRKNS_6StringE
-__ZN7WebCore13CanvasPatternD1Ev
-__ZN7WebCore24JSCanvasPatternPrototypeD0Ev
-__ZN7WebCore42jsCharacterDataPrototypeFunctionDeleteDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore48jsDocumentPrototypeFunctionCreateEntityReferenceEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document21createEntityReferenceERKNS_6StringERi
-__ZN7WebCore45jsDocumentPrototypeFunctionCreateCDATASectionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document18createCDATASectionERKNS_6StringERi
-__ZNK7WebCore16DocumentFragment8nodeNameEv
-__ZN7WebCore8Document9cloneNodeEb
-__ZN7WebCore45jsCharacterDataPrototypeFunctionSubstringDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore42jsCharacterDataPrototypeFunctionInsertDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node12setNodeValueERKNS_6StringERi
-__ZN7WebCore42jsCharacterDataPrototypeFunctionAppendDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore54jsDocumentPrototypeFunctionCreateProcessingInstructionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Attr9cloneNodeEb
-__ZN7WebCore44jsDocumentPrototypeFunctionCreateAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore15JSMutationEvent9classInfoEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14EventExceptionE
-__ZN7WebCore16JSEventExceptionC1EPN3KJS8JSObjectEPNS_14EventExceptionE
-__ZN7WebCore16JSEventException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSEventExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore16JSEventExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSEventException16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
-__ZNK7WebCore15HTMLBaseElement6targetEv
-__ZNK7WebCore16HTMLTableElement7summaryEv
-__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionDeleteCellEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTableRowElement10deleteCellEiRi
-__ZNK7WebCore14HTMLModElement4citeEv
-__ZNK7WebCore15HTMLMenuElement7compactEv
-__ZNK7WebCore20HTMLTableCellElement7bgColorEv
-__ZNK7WebCore23HTMLTableSectionElement6vAlignEv
-__ZNK7WebCore15HTMLLinkElement8hreflangEv
-__ZNK7WebCore15HTMLAreaElement6noHrefEv
-__ZNK7WebCore20HTMLTableCellElement5alignEv
-__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionDeleteRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore23HTMLTableSectionElement9deleteRowEiRi
-__ZN7WebCore34jsNodePrototypeFunctionIsSupportedEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node11isSupportedERKNS_6StringES3_
-__ZNK7WebCore16HTMLInputElement6useMapEv
-__ZNK7WebCore20HTMLParagraphElement5alignEv
-__ZNK7WebCore20HTMLTableCellElement5chOffEv
-__ZNK7WebCore19HTMLTableColElement5widthEv
-__ZNK7WebCore20HTMLTableCellElement5scopeEv
-__ZNK7WebCore16HTMLImageElement6borderEv
-__ZNK7WebCore16HTMLTableElement5frameEv
-__ZNK7WebCore16HTMLTableElement5alignEv
-__ZNK7WebCore17HTMLOptionElement15defaultSelectedEv
-__ZNK7WebCore23HTMLTableSectionElement5alignEv
-__ZNK7WebCore19HTMLTableColElement2chEv
-__ZNK7WebCore16HTMLTableElement5widthEv
-__ZNK7WebCore16HTMLOListElement7compactEv
-__ZNK7WebCore15HTMLLinkElement6targetEv
-__ZNK7WebCore15HTMLLinkElement7charsetEv
-__ZNK7WebCore23HTMLTableSectionElement5chOffEv
-__ZNK7WebCore20HTMLTableCellElement2chEv
-__ZNK7WebCore15HTMLLinkElement5mediaEv
-__ZNK7WebCore16HTMLDListElement7compactEv
-__ZNK7WebCore19HTMLTableRowElement5alignEv
-__ZNK7WebCore23HTMLTableCaptionElement5alignEv
-__ZNK7WebCore16HTMLTableElement7bgColorEv
-__ZNK7WebCore19HTMLOptGroupElement5labelEv
-__ZNK7WebCore17HTMLAppletElement6objectEv
-__ZNK7WebCore20HTMLFrameElementBase9scrollingEv
-__ZNK7WebCore17HTMLAppletElement4codeEv
-__ZNK7WebCore20HTMLTableCellElement6vAlignEv
-__ZNK7WebCore19HTMLTableColElement5alignEv
-__ZNK7WebCore20HTMLTableCellElement4abbrEv
-__ZNK7WebCore17HTMLAppletElement6vspaceEv
-__ZNK7WebCore15HTMLMetaElement6schemeEv
-__ZNK7WebCore13HTMLHRElement5alignEv
-__ZNK7WebCore19HTMLTableRowElement5chOffEv
-__ZNK7WebCore15HTMLFormElement13acceptCharsetEv
-__ZNK7WebCore19HTMLTableColElement5chOffEv
-__ZNK7WebCore19HTMLTableRowElement6vAlignEv
-__ZNK7WebCore15HTMLFontElement4sizeEv
-__ZNK7WebCore16HTMLTableElement5rulesEv
-__ZNK7WebCore20HTMLTableCellElement7headersEv
-__ZNK7WebCore20HTMLTableCellElement6noWrapEv
-__ZNK7WebCore13HTMLHRElement7noShadeEv
-__ZNK7WebCore13HTMLBRElement5clearEv
-__ZNK7WebCore16HTMLImageElement5isMapEv
-__ZNK7WebCore15HTMLAreaElement9accessKeyEv
-__ZNK7WebCore19HTMLBaseFontElement5colorEv
-__ZNK7WebCore15HTMLAreaElement3altEv
-__ZNK7WebCore14HTMLDivElement5alignEv
-__ZNK7WebCore17HTMLAppletElement7archiveEv
-__ZN7WebCore14HTMLMapElement5areasEv
-__ZNK7WebCore20HTMLDirectoryElement7compactEv
-__ZNK7WebCore15HTMLHeadElement7profileEv
-__ZNK7WebCore17HTMLAppletElement8codeBaseEv
-__ZNK7WebCore16HTMLImageElement8longDescEv
-__ZNK7WebCore23HTMLTableSectionElement2chEv
-__ZNK7WebCore18HTMLIsIndexElement6promptEv
-__ZNK7WebCore16HTMLQuoteElement4citeEv
-__ZNK7WebCore19HTMLTableRowElement2chEv
-__ZNK7WebCore16HTMLInputElement6acceptEv
-__ZNK7WebCore15HTMLFontElement4faceEv
-__ZNK7WebCore21HTMLBlockquoteElement4citeEv
-__ZNK7WebCore19HTMLTextAreaElement9accessKeyEv
-__ZNK7WebCore17HTMLButtonElement9accessKeyEv
-__ZNK7WebCore14HTMLModElement8dateTimeEv
-__ZNK7WebCore19HTMLTableColElement6vAlignEv
-__ZNK7WebCore19HTMLBaseFontElement4sizeEv
-__ZNK7WebCore15HTMLHtmlElement7versionEv
-__ZNK7WebCore19HTMLTableRowElement7bgColorEv
-__ZNK7WebCore17HTMLAppletElement6hspaceEv
-__ZNK7WebCore15HTMLAreaElement5shapeEv
-__ZNK7WebCore17HTMLLegendElement5alignEv
-__ZNK7WebCore16HTMLUListElement7compactEv
-__ZNK7WebCore15HTMLFormElement6targetEv
-__ZNK7WebCore16HTMLParamElement4typeEv
-__ZNK7WebCore20HTMLTableCellElement4axisEv
-__ZNK7WebCore16HTMLImageElement6vspaceEv
-__ZNK7WebCore16HTMLImageElement6hspaceEv
-__ZNK7WebCore14HTMLPreElement5widthEv
-__ZN7WebCore17HTMLSelectElement26listBoxDefaultEventHandlerEPNS_5EventE
-__ZNK7WebCore15HTMLBodyElement5aLinkEv
-__ZNK7WebCore19HTMLBaseFontElement4faceEv
-__ZNK7WebCore16HTMLOListElement4typeEv
-__ZNK7WebCore17HTMLAppletElement3altEv
-__ZNK7WebCore17HTMLOptionElement5labelEv
-__ZNK7WebCore13HTMLHRElement4sizeEv
-__ZNK7WebCore15HTMLFontElement5colorEv
-__ZNK7WebCore15HTMLLinkElement3revEv
-__ZNK7WebCore17HTMLLegendElement9accessKeyEv
-__ZNK7WebCore16HTMLLabelElement9accessKeyEv
-__ZNK7WebCore16HTMLParamElement9valueTypeEv
-__ZNK7WebCore13HTMLHRElement5widthEv
-__ZNK7WebCore17HTMLScriptElement7htmlForEv
-__ZNK7WebCore17HTMLScriptElement5deferEv
-__ZNK7WebCore17HTMLScriptElement5eventEv
-__ZNK7WebCore17HTMLScriptElement7charsetEv
-__ZNK7WebCore17HTMLIFrameElement5alignEv
-__ZNK7WebCore20HTMLFrameElementBase8longDescEv
-__ZNK7WebCore20HTMLFrameElementBase11marginWidthEv
-__ZNK7WebCore20HTMLFrameElementBase12marginHeightEv
-__ZNK7WebCore19HTMLFrameSetElement4rowsEv
-__ZNK7WebCore19HTMLFrameSetElement4colsEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSProcessingInstructionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSProcessingInstruction16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15EntityReferenceC1EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore15EntityReference8nodeTypeEv
-__ZN7WebCore17JSEntityReferenceC1EPN3KJS8JSObjectEPNS_15EntityReferenceE
-__ZNK7WebCore17JSEntityReference9classInfoEv
-__ZN7WebCore17JSEntityReference18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15EntityReferenceD1Ev
-__ZNK7WebCore21JSHTMLFrameSetElement9classInfoEv
-__ZN7WebCore19CachedXSLStyleSheetD1Ev
-__ZN7WebCore34jsNodePrototypeFunctionIsEqualNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node11isEqualNodeEPS0_
-__ZNK7WebCore4Node6prefixEv
-__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore41jsNodePrototypeFunctionIsDefaultNamespaceEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node18isDefaultNamespaceERKNS_6StringE
-__ZNK7WebCore4Node15ancestorElementEv
-__ZN7WebCore44jsElementPrototypeFunctionSetAttributeNodeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSElement18setAttributeNodeNSEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore7Element18setAttributeNodeNSEPNS_4AttrERi
-__ZN7WebCore41jsNodePrototypeFunctionLookupNamespaceURIEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document15canReplaceChildEPNS_4NodeES2_
-__ZN7WebCore36jsDocumentPrototypeFunctionAdoptNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document9adoptNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZNK7WebCore15EntityReference8nodeNameEv
-__ZN7WebCore4Node12insertBeforeEN3WTF10PassRefPtrIS0_EEPS0_Ri
-__ZNK7WebCore12NamedAttrMap14mapsEquivalentEPKS0_
-__ZN7WebCore35jsNodePrototypeFunctionLookupPrefixEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node12lookupPrefixERKNS_6StringE
-__ZNK7WebCore4Node21lookupNamespacePrefixERKNS_6StringEPKNS_7ElementE
-__ZN7WebCore8Document14setDocumentURIERKNS_6StringE
-__ZN7WebCore4Node11removeChildEPS0_Ri
-__ZN7WebCore44jsElementPrototypeFunctionGetAttributeNodeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore33jsNodePrototypeFunctionIsSameNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12DocumentType7baseURIEv
-__ZNK7WebCore4Text9wholeTextEv
-__ZN7WebCore23JSProcessingInstruction3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21ProcessingInstruction12setNodeValueERKNS_6StringERi
-__ZN7WebCore21ProcessingInstruction7setDataERKNS_6StringERi
-__ZNK7WebCore12DocumentType8nodeNameEv
-__ZNK7WebCore4Node17isEventTargetNodeEv
-__ZN7WebCore17JSHTMLFontElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLFontElement7setSizeERKNS_6StringE
-__ZN7WebCore16HTMLTableElement10setSummaryERKNS_6StringE
-__ZN7WebCore21JSHTMLTableColElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore19HTMLTableColElement8setWidthERKNS_6StringE
-__ZN7WebCore14RenderTableCol12imageChangedEPNS_11CachedImageE
-__ZN7WebCore18RenderTableSection12imageChangedEPNS_11CachedImageE
-__ZN7WebCore14RenderTableRow5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore16CSSStyleSelector19mapBackgroundOriginEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector22mapBackgroundCompositeEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore9CSSParser20parseTransformOriginEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
-__ZNK7WebCore27TranslateTransformOperation20isTranslateOperationEv
-__ZN7WebCore27TranslateTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore8SVGImage16setContainerSizeERKNS_7IntSizeE
-__ZN7WebCore25SVGEmptyFrameLoaderClient15willChangeTitleEPNS_14DocumentLoaderE
-__ZN7WebCore25SVGEmptyFrameLoaderClient14didChangeTitleEPNS_14DocumentLoaderE
-__ZNK7WebCore13SVGSVGElement18relativeWidthValueEv
-__ZNK7WebCore13SVGSVGElement19relativeHeightValueEv
-__ZNK7WebCore16SVGScriptElement14contextElementEv
-__ZN7WebCore12SVGTransform9setMatrixERKNS_15AffineTransformE
-__ZN7WebCore8SVGImage26nativeImageForCurrentFrameEv
-__ZNK7WebCore5Image21mayFillWithSolidColorEv
-__ZNK7WebCore8SVGImage17hasRelativeHeightEv
-__ZN7WebCore13InlineFlowBox14paintBoxShadowEPNS_15GraphicsContextEPNS_11RenderStyleEiiii
-__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectES5_NS0_8TileRuleES6_NS_17CompositeOperatorE
-__ZN7WebCore5Image14startAnimationEv
-__ZNK7WebCore11RenderBlock18adjustForBorderFitEiRiS1_
-__ZN7WebCore7calcHueEddd
-__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8CSSValueE
-__ZN7WebCore14JSCSSValueListC1EPN3KJS8JSObjectEPNS_12CSSValueListE
-__ZN7WebCore10JSCSSValueC1EPN3KJS8JSObjectEPNS_8CSSValueE
-__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore10JSCSSValue18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSCSSValueListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSCSSValuePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore14JSCSSValueList9classInfoEv
-__ZNK7WebCore9StyleBase10isSVGPaintEv
-__ZNK7WebCore9StyleBase10isSVGColorEv
-__ZN7WebCore19JSCSSPrimitiveValueC1EPN3KJS8JSObjectEPNS_17CSSPrimitiveValueE
-__ZN7WebCore19JSCSSPrimitiveValue18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSCSSPrimitiveValuePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSCSSPrimitiveValue9classInfoEv
-__ZN7WebCore9CSSParser24parseTimingFunctionValueERPNS_9ValueListERd
-__ZN7WebCore22CSSTimingFunctionValue31isTransitionTimingFunctionValueEv
-__ZN7WebCore30jsHistoryPrototypeFunctionBackEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7History4backEv
-__ZN7WebCore11FrameLoader25scheduleHistoryNavigationEi
-__ZN7WebCore11FrameLoader10historyURLEi
-__ZN7WebCore11FrameLoader15goBackOrForwardEi
-__ZN7WebCore43jsDocumentPrototypeFunctionElementFromPointEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore22CSSTimingFunctionValue7cssTextEv
-__ZN7WebCore22CSSTimingFunctionValueD1Ev
-__ZN7WebCore9CSSParser21parseDashboardRegionsEib
-__ZN7WebCore15DashboardRegionD1Ev
+__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_16HTMLImageElementERKNS_6StringERi
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionIsPointInPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore24CanvasRenderingContext2D13isPointInPathEff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionSetShadowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D9setShadowEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringE
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringEf
+__ZN7WebCore22colorWithOverrideAlphaEjf
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEffffffff
+__ZN7WebCore45jsHTMLCanvasElementPrototypeFunctionToDataURLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17HTMLCanvasElement9toDataURLERKNS_6StringERi
+__ZN7WebCore16MIMETypeRegistry35isSupportedImageMIMETypeForEncodingERKNS_6StringE
+__ZN7WebCoreL44initializeSupportedImageMIMETypesForEncodingEv
+__ZNK7WebCore11ImageBuffer9toDataURLERKNS_6StringE
+__ZN7WebCore12base64EncodeERKN3WTF6VectorIcLm0EEERS2_b
+__ZNK7WebCore18JSHTMLQuoteElement9classInfoEv
+__ZNK7WebCore11RenderLayer16enclosingElementEv
+__ZN7WebCore11RenderStyle12clearContentEv
+__ZNK7WebCore15RenderWordBreak10renderNameEv
+__ZN7WebCore30jsCSSPrimitiveValueCSS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSPrimitiveValueCSS_STRINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSPrimitiveValuePrimitiveTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsCSSPrimitiveValueCSS_RECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionGetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore51jsCSSPrimitiveValuePrototypeFunctionGetCounterValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17CSSPrimitiveValue15getCounterValueERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CounterE
+__ZN7WebCore52jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13getJSRGBColorEPN3JSC9ExecStateEj
+__ZN7WebCore10JSRGBColorC1EPN3JSC9ExecStateEj
+__ZN7WebCore10JSRGBColorC2EPN3JSC9ExecStateEj
+__ZN7WebCore31jsCSSPrimitiveValueCSS_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsCSSPrimitiveValuePrototypeFunctionGetRectValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17CSSPrimitiveValue12getRectValueERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4RectE
+__ZN7WebCore10JSRGBColorD1Ev
+__ZN7WebCore19mimeTypeFromDataURLERKNS_6StringE
+__ZNK7WebCore12RenderObject12isRenderPartEv
 __ZN7WebCore11RenderBlock18heightForLineCountEi
-__ZN7WebCore21getHeightForLineCountEPNS_11RenderBlockEibRi
+__ZN7WebCoreL21getHeightForLineCountEPNS_11RenderBlockEibRi
 __ZN7WebCore11RenderBlock11lineAtIndexEi
-__ZN7WebCore14getLineAtIndexEPNS_11RenderBlockEiRi
-__ZNK7WebCore17ImplicitAnimation8progressEv
-__ZNK7WebCore12CSSStyleRule7cssTextEv
-__ZN7WebCore26skipCommaInDashboardRegionEPNS_9ValueListE
-__ZN7WebCore6String6appendEc
-__ZN7WebCore5TimerINS_26AnimationControllerPrivateEE5firedEv
-__ZN7WebCore26AnimationControllerPrivate10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCoreL14getLineAtIndexEPNS_11RenderBlockEiRi
+__ZN7WebCore20jsCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSComment14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCommentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSCommentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSCommentConstructorD1Ev
+__ZN7WebCore11CSSSelector8parseNthEv
+__ZN7WebCore11CSSSelector8RareData8parseNthEv
+__ZN7WebCore11CSSSelector8matchNthEi
+__ZN7WebCore11CSSSelector8RareData8matchNthEi
+__ZN7WebCore52jsCSSStyleDeclarationPrototypeFunctionRemovePropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet18determineNamespaceERKNS_12AtomicStringE
+__ZN7WebCore9CSSParser21parseDashboardRegionsEib
+__ZN3WTF10RefCountedIN7WebCore15DashboardRegionEE5derefEv
+__ZN7WebCoreL35device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL16parseAspectRatioEPNS_8CSSValueERiS2_
+__ZN7WebCore46jsDOMWindowPrototypeFunctionGetMatchedCSSRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow18getMatchedCSSRulesEPNS_7ElementERKNS_6StringEb
+__ZNK7WebCore15CSSFontFaceRule4typeEv
+__ZN7WebCore17JSCSSFontFaceRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSCSSFontFaceRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15CSSFontFaceRuleEEE
+__ZN7WebCore17JSCSSFontFaceRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15CSSFontFaceRuleEEE
+__ZN7WebCore17JSCSSFontFaceRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsCSSFontFaceRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSValueListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSValueListEEE
+__ZN7WebCore14JSCSSValueListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSValueListEEE
+__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsCSSValueCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueListD1Ev
+__ZN7WebCore17JSCSSFontFaceRuleD1Ev
+__ZN7WebCore23JSCSSValueListPrototypeD1Ev
+__ZN7WebCore26JSCSSFontFaceRulePrototypeD1Ev
+__ZSt21__inplace_stable_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriorityEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore19CSSStyleDeclaration19getPropertyPriorityERKNS_6StringE
+__ZN7WebCoreL24scaleFactorForConversionEt
+__ZN7WebCore9CSSParser18parseHSLParametersEPNS_14CSSParserValueEPdb
+__ZN7WebCore16makeRGBAFromHSLAEdddd
+__ZN7WebCoreL7calcHueEddd
+__ZNK7WebCore9FrameView14didFirstLayoutEv
+__ZNK7WebCore13CSSImportRule4typeEv
+__ZN7WebCore15JSCSSImportRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCSSImportRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSImportRuleEEE
+__ZN7WebCore15JSCSSImportRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSImportRuleEEE
+__ZN7WebCore15JSCSSImportRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsCSSImportRuleStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSImportRuleD1Ev
+__ZN7WebCore24JSCSSImportRulePrototypeD1Ev
+__ZNK7WebCore15CSSFontFaceRule7cssTextEv
 __ZNK7WebCore12CSSMediaRule4typeEv
-__ZN7WebCore14JSCSSMediaRuleC1EPN3KJS8JSObjectEPNS_12CSSMediaRuleE
-__ZN7WebCore14JSCSSMediaRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSCSSMediaRulePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsCSSMediaRulePrototypeFunctionInsertRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore14JSCSSMediaRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSMediaRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSMediaRuleEEE
+__ZN7WebCore14JSCSSMediaRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSMediaRuleEEE
+__ZN7WebCore14JSCSSMediaRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12CSSMediaRule7cssTextEv
+__ZNK7WebCore9MediaList9mediaTextEv
+__ZNK7WebCore10MediaQuery7cssTextEv
+__ZN7WebCore14JSCSSMediaRuleD1Ev
+__ZN7WebCore23JSCSSMediaRulePrototypeD1Ev
+__ZN7WebCore18jsDOMWindowScrollXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL39max_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore23JSCSSMediaRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsCSSMediaRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore14JSCSSMediaRule9classInfoEv
 __ZN7WebCore12CSSMediaRule10insertRuleERKNS_6StringEjRi
-__ZN3KJS17staticValueGetterIN7WebCore14JSCSSMediaRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCSSMediaRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore41jsCSSMediaRulePrototypeFunctionDeleteRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore11CSSRuleList10insertRuleEPNS_7CSSRuleEj
+__ZN7WebCore22jsCSSMediaRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsCSSMediaRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore12CSSMediaRule10deleteRuleEjRi
-__ZN7WebCore11CSSRuleList10deleteRuleEj
-__ZN7WebCore42jsCSSStyleDeclarationPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionGetFloatValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24scaleFactorForConversionEt
-__ZN7WebCore11RenderStyle12clearContentEv
-__ZN3KJS17staticValueGetterIN7WebCore15JSCSSImportRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSCSSImportRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore30JSCSSPrimitiveValueConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore30JSCSSPrimitiveValueConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore30JSCSSPrimitiveValueConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore19JSCSSPrimitiveValueEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSCSSPrimitiveValue16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionGetStringValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore51jsCSSPrimitiveValuePrototypeFunctionGetCounterValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17CSSPrimitiveValue15getCounterValueERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7CounterE
-__ZN7WebCore52jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13getJSRGBColorEPN3KJS9ExecStateEj
-__ZN7WebCore10JSRGBColorC1EPN3KJS8JSObjectEj
-__ZN7WebCore48jsCSSPrimitiveValuePrototypeFunctionGetRectValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17CSSPrimitiveValue12getRectValueERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_4RectE
-__ZN7WebCore39min_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore35device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore39max_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore22FontCustomPlatformDataD1Ev
+__ZN7WebCoreL39min_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore14RenderTableRow5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore25jsCSSRuleParentStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore19CSSStyleDeclaration20getPropertyShorthandERKNS_6StringE
+__ZNK7WebCore26CSSMutableStyleDeclaration20getPropertyShorthandEi
+__ZN7WebCore9CSSParser24parseTimingFunctionValueERPNS_18CSSParserValueListERd
+__ZNK7WebCore22CSSTimingFunctionValue21isTimingFunctionValueEv
+__ZNK7WebCore16HTMLInputElement17isTextFormControlEv
+__ZNK7WebCore22HTMLFormControlElement17isTextFormControlEv
+__ZNK7WebCore19HTMLTextAreaElement17isTextFormControlEv
+__ZNK7WebCore11RenderLayer18absoluteToContentsERKNS_8IntPointE
+__ZNK7WebCore11RenderLayer22offsetFromResizeCornerERKNS_8IntPointE
+__ZN7WebCore11RenderLayer6resizeERKNS_18PlatformMouseEventERKNS_7IntSizeE
+__ZNK7WebCore7Element22minimumSizeForResizingEv
+__ZN7WebCore7Element25setMinimumSizeForResizingERKNS_7IntSizeE
+__ZN7WebCore26RenderTextControlMultiLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore5Image13isBitmapImageEv
+__ZN7WebCore8SVGImage18destroyDecodedDataEb
+__ZN7WebCore8SVGImageD0Ev
+__ZN7WebCore22EmptyFrameLoaderClient14cancelledErrorERKNS_15ResourceRequestE
+__ZN7WebCore22EmptyFrameLoaderClient14shouldFallBackERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient27dispatchDidLoadMainResourceEPNS_14DocumentLoaderE
+__ZN7WebCore22EmptyFrameLoaderClient19dispatchDidFailLoadERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient39postProgressEstimateChangedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient32postProgressFinishedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient22dispatchDidFailLoadingEPNS_14DocumentLoaderEmRKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent2Ev
+__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent3Ev
+__ZN7WebCore31RenderSVGTransformableContainerD0Ev
+__ZN7WebCore18RenderSVGContainerD2Ev
+__ZN7WebCore16SVGInlineFlowBoxD0Ev
+__ZN7WebCore14RenderSVGTSpanD0Ev
+__ZN7WebCore12RenderInlineD2Ev
+__ZN7WebCore17EmptyEditorClient13pageDestroyedEv
+__ZN7WebCore20EmptyInspectorClient18inspectorDestroyedEv
+__ZN7WebCore16SVGScriptElementD0Ev
+__ZN7WebCore15SVGURIReferenceD2Ev
+__ZN7WebCore11SVGGElementD0Ev
+__ZN7WebCore14SVGPathElementD0Ev
+__ZN7WebCore14SVGPathSegListD0Ev
+__ZN7WebCore19SVGPathSegMovetoAbsD0Ev
+__ZN7WebCore19SVGPathSegLinetoAbsD0Ev
+__ZN7WebCore19SVGPathSegClosePathD0Ev
+__ZN7WebCore19SVGAnimatedPathDataD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE6shrinkEm
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsD0Ev
+__ZN7WebCore15SVGTSpanElementD0Ev
+__ZN7WebCore22EmptyFrameLoaderClient20frameLoaderDestroyedEv
+__ZN7WebCore22EmptyContextMenuClient20contextMenuDestroyedEv
+__ZN7WebCore15EmptyDragClient23dragControllerDestroyedEv
+__ZN7WebCore20SVGImageChromeClient15chromeDestroyedEv
+__ZN7WebCore20SVGImageChromeClientD0Ev
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN7WebCore10SVGElementD0Ev
+__ZN7WebCore24SVGLinearGradientElementD0Ev
+__ZN7WebCore18SVGGradientElementD2Ev
+__ZN7WebCore24SVGRadialGradientElementD0Ev
+__ZN7WebCore28SVGPaintServerLinearGradientD0Ev
+__ZN7WebCore22SVGPaintServerGradientD2Ev
+__ZN7WebCore14SVGPaintServerD2Ev
+__ZN7WebCore11SVGResourceD2Ev
+__ZN7WebCore14SVGStopElementD0Ev
+__ZN7WebCore8SVGColorD0Ev
+__ZN7WebCore21RenderSVGGradientStopD0Ev
+__ZN7WebCore24RenderSVGHiddenContainerD0Ev
+__ZN7WebCore18RenderSVGContainerD0Ev
+__ZN7WebCore15SVGTitleElementD0Ev
+__ZN7WebCore14SVGDescElementD0Ev
+__ZN7WebCore16SVGCircleElementD0Ev
+__ZN7WebCore14SVGLineElementD0Ev
+__ZN7WebCore14SVGDefsElementD0Ev
+__ZN7WebCore28SVGPaintServerRadialGradientD0Ev
+__ZN7WebCore14SVGMaskElementD0Ev
+__ZN7WebCore17SVGResourceMaskerD0Ev
+__ZN7WebCore17SVGEllipseElementD0Ev
+__ZN7WebCore17SVGAnimateElementD0Ev
+__ZN7WebCore19SVGAnimationElementD2Ev
+__ZN7WebCore14SVGSMILElementD2Ev
+__ZN7WebCore14SVGSMILElement20disconnectConditionsEv
+__ZN7WebCore17SMILTimeContainer10unscheduleEPNS_14SVGSMILElementE
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE6shrinkEm
+__ZN7WebCore30setJSDOMWindowRangeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSHTMLInputElementPlaceholderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement14setPlaceholderERKNS_6StringE
+__ZN7WebCore29jsHTMLInputElementPlaceholderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document18setVisuallyOrderedEv
+__ZN7WebCore10TextStreamlsEf
+__ZN7WebCore10ShadowDataD2Ev
+__ZN7WebCore30jsHistoryPrototypeFunctionBackEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9JSHistory9classInfoEv
+__ZN7WebCore7History4backEv
+__ZN7WebCore11FrameLoader25scheduleHistoryNavigationEi
+__ZN7WebCore11FrameLoader15goBackOrForwardEi
+__ZN7WebCore9CSSParser23parseAnimationShorthandEb
+__ZNK7WebCore15PropertyWrapperIRKNS_5ColorEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZNK7WebCore11RenderStyle15backgroundColorEv
+__ZN7WebCore11RenderStyle18setBackgroundColorERKNS_5ColorE
+__ZN7WebCore13AnimationBase18getPropertyAtIndexEiRb
+__ZNK7WebCore19PropertyWrapperBase18isShorthandWrapperEv
+__ZNK7WebCore11RenderStyle5rightEv
+__ZNK7WebCore11RenderStyle6bottomEv
+__ZNK7WebCore21PropertyWrapperGetterItE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle15borderLeftWidthEv
+__ZNK7WebCore11RenderStyle16borderRightWidthEv
+__ZNK7WebCore11RenderStyle14borderTopWidthEv
+__ZNK7WebCore11RenderStyle17borderBottomWidthEv
+__ZNK7WebCore11RenderStyle10marginLeftEv
+__ZNK7WebCore11RenderStyle11marginRightEv
+__ZNK7WebCore11RenderStyle9marginTopEv
+__ZNK7WebCore11RenderStyle12marginBottomEv
+__ZNK7WebCore11RenderStyle11paddingLeftEv
+__ZNK7WebCore11RenderStyle12paddingRightEv
+__ZNK7WebCore11RenderStyle10paddingTopEv
+__ZNK7WebCore11RenderStyle13paddingBottomEv
+__ZNK7WebCore21PropertyWrapperGetterIRKNS_5ColorEE6equalsEPKNS_11RenderStyleES7_
+__ZNK7WebCore11RenderStyle5colorEv
+__ZNK7WebCore11RenderStyle19backgroundXPositionEv
+__ZNK7WebCore11RenderStyle19backgroundYPositionEv
+__ZNK7WebCore21PropertyWrapperGetterINS_10LengthSizeEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle14backgroundSizeEv
+__ZNK7WebCore11RenderStyle13maskXPositionEv
+__ZNK7WebCore11RenderStyle13maskYPositionEv
+__ZNK7WebCore11RenderStyle8maskSizeEv
+__ZNK7WebCore21PropertyWrapperGetterIiE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle8fontSizeEv
+__ZNK7WebCore11RenderStyle15columnRuleWidthEv
+__ZNK7WebCore21PropertyWrapperGetterIfE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle9columnGapEv
+__ZNK7WebCore11RenderStyle11columnCountEv
+__ZNK7WebCore11RenderStyle11columnWidthEv
+__ZNK7WebCore21PropertyWrapperGetterIsE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle23horizontalBorderSpacingEv
+__ZNK7WebCore11RenderStyle21verticalBorderSpacingEv
+__ZNK7WebCore11RenderStyle6zIndexEv
+__ZNK7WebCore11RenderStyle13outlineOffsetEv
+__ZNK7WebCore11RenderStyle12outlineWidthEv
+__ZNK7WebCore11RenderStyle13letterSpacingEv
+__ZNK7WebCore11RenderStyle11wordSpacingEv
+__ZNK7WebCore11RenderStyle11perspectiveEv
+__ZNK7WebCore11RenderStyle18perspectiveOriginXEv
+__ZNK7WebCore11RenderStyle18perspectiveOriginYEv
+__ZNK7WebCore11RenderStyle16transformOriginXEv
+__ZNK7WebCore11RenderStyle16transformOriginYEv
+__ZNK7WebCore11RenderStyle16transformOriginZEv
+__ZNK7WebCore21PropertyWrapperGetterIRKNS_7IntSizeEE6equalsEPKNS_11RenderStyleES7_
+__ZNK7WebCore11RenderStyle19borderTopLeftRadiusEv
+__ZNK7WebCore11RenderStyle20borderTopRightRadiusEv
+__ZNK7WebCore11RenderStyle22borderBottomLeftRadiusEv
+__ZNK7WebCore11RenderStyle23borderBottomRightRadiusEv
+__ZNK7WebCore21PropertyWrapperGetterINS_11EVisibilityEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle10visibilityEv
+__ZNK7WebCore11RenderStyle4zoomEv
+__ZNK7WebCore32PropertyWrapperMaybeInvalidColor6equalsEPKNS_11RenderStyleES3_
+__ZNK7WebCore11RenderStyle15columnRuleColorEv
+__ZNK7WebCore11RenderStyle15textStrokeColorEv
+__ZNK7WebCore11RenderStyle13textFillColorEv
+__ZNK7WebCore11RenderStyle15borderLeftColorEv
+__ZNK7WebCore11RenderStyle16borderRightColorEv
+__ZNK7WebCore11RenderStyle14borderTopColorEv
+__ZNK7WebCore11RenderStyle17borderBottomColorEv
+__ZNK7WebCore11RenderStyle12outlineColorEv
+__ZNK7WebCore21PropertyWrapperShadow6equalsEPKNS_11RenderStyleES3_
+__ZNK7WebCore11RenderStyle9boxShadowEv
+__ZNK7WebCore11RenderStyle10textShadowEv
+__ZNK7WebCore11RenderStyle11fillOpacityEv
+__ZNK7WebCore11RenderStyle12floodOpacityEv
+__ZNK7WebCore11RenderStyle13strokeOpacityEv
+__ZNK7WebCore24ShorthandPropertyWrapper18isShorthandWrapperEv
+__ZNK7WebCore32PropertyWrapperMaybeInvalidColor5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZN7WebCore11RenderStyle18setBorderLeftColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle20setBorderBottomColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle19setBorderRightColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle17setBorderTopColorERKNS_5ColorE
+__ZN7WebCore17ImplicitAnimation14onAnimationEndEd
+__ZN7WebCore17ImplicitAnimation19sendTransitionEventERKNS_12AtomicStringEd
+__ZNK7WebCore17ImplicitAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
+__ZN7WebCore13AnimationBase26resumeOverriddenAnimationsEv
+__ZN3WTF9HashTableIiSt4pairIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore23JSCSSValueListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsCSSValueListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSCSSValueList9classInfoEv
+__ZN7WebCore12CSSValueList4itemEj
+__ZN7WebCore20JSHTMLMarqueeElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn88_N7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore28jsProcessingInstructionSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsStyleSheetDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBodyElement13setScrollLeftEi
+__ZN7WebCore15HTMLBodyElement12setScrollTopEi
+__ZNK7WebCore27CSSComputedStyleDeclaration6lengthEv
+__ZN7WebCore42jsCSSStyleDeclarationPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore27CSSComputedStyleDeclaration4itemEj
+__ZN7WebCoreL26getBorderRadiusCornerValueENS_7IntSizeE
+__ZN7WebCoreL22valueForNinePieceImageERKNS_14NinePieceImageE
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC2ERKS3_
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_15DashboardRegionEEE
+__ZNK7WebCore27CSSComputedStyleDeclaration22getSVGPropertyCSSValueEiNS_13EUpdateLayoutE
+__ZNK7WebCore8SVGPaint7cssTextEv
+__ZNK7WebCore8SVGColor7cssTextEv
+__ZN7WebCoreL35glyphOrientationToCSSPrimitiveValueENS_17EGlyphOrientationE
+__ZN7WebCore19JSCSSValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19StyleGeneratedImage8cssValueEv
+__ZN7WebCoreL18valueForRepeatRuleEi
+__ZN7WebCore10JSCSSValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8CSSValueEEE
+__ZNK7WebCore10JSCSSValue9classInfoEv
+__ZN7WebCore14GeneratedImage11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointEN
+__ZN7WebCore10JSCSSValueD1Ev
+__ZNK7WebCore22SkewTransformOperation16getOperationTypeEv
+__ZNK7WebCore22SkewTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix4skewEdd
+__ZNK7WebCore22SkewTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore22SkewTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore22SkewTransformOperationD0Ev
+__ZN7WebCore25setJSHTMLElementOuterHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setOuterHTMLERKNS_6StringERi
 __ZN7WebCore12CSSNamespace18namespaceForPrefixERKNS_12AtomicStringE
 __ZN7WebCore12CSSNamespaceD2Ev
-__ZN7WebCore23JSProcessingInstruction16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore12JSSVGElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore9CSSParser21addUnresolvedPropertyEib
+__ZN7WebCore12CSSValueListC1EPNS_18CSSParserValueListE
+__ZN7WebCore12CSSValueListC2EPNS_18CSSParserValueListE
+__ZN7WebCore14CSSParserValue14createCSSValueEv
+__ZN7WebCore25CSSVariableDependentValueC1EN3WTF10PassRefPtrINS_12CSSValueListEEE
+__ZN7WebCore25CSSVariableDependentValueC2EN3WTF10PassRefPtrINS_12CSSValueListEEE
+__ZN7WebCore9CSSParser27addVariableDeclarationBlockERKNS_15CSSParserStringE
+__ZN7WebCore9CSSParser19createVariablesRuleEPNS_9MediaListEb
+__ZNK7WebCore25CSSVariableDependentValue24isVariableDependentValueEv
+__ZNK3WTF7HashMapIPN7WebCore26CSSMutableStyleDeclarationENS_6RefPtrIS2_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getE
+__ZNK7WebCore19CSSStyleDeclaration10parentRuleEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleE
+__ZN3WTF7HashMapIPN7WebCore26CSSMutableStyleDeclarationENS_6RefPtrIS2_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setER
+__ZN3WTF9HashTableIPN7WebCore26CSSMutableStyleDeclarationESt4pairIS3_NS_6RefPtrIS2_EEENS_18PairFirstExtractorIS7_EENS_7PtrHashI
+__ZN7WebCore16CSSStyleSelector30resolveVariablesForDeclarationEPNS_26CSSMutableStyleDeclarationES2_RN3WTF7HashSetINS_6StringENS
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_16CSSVariablesRuleENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZNK7WebCore14XMLHttpRequest38usesDashboardBackwardCompatibilityModeEv
+__ZN7WebCore9CSSParser11addVariableERKNS_15CSSParserStringEPNS_18CSSParserValueListE
+__ZN7WebCore25CSSVariableDependentValueD0Ev
+__ZNK7WebCore17CSSPrimitiveValue11parserValueEv
+__ZN7WebCore9StyleBase6isRuleEv
+__ZN7WebCore26JSXMLSerializerConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSXMLSerializerConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore26JSXMLSerializerConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13XMLSerializerE
+__ZN7WebCore15JSXMLSerializerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XMLSerializerEEE
+__ZN7WebCore15JSXMLSerializerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XMLSerializerEEE
+__ZN7WebCore15JSXMLSerializer18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSXMLSerializerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsXMLSerializerPrototypeFunctionSerializeToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSXMLSerializer9classInfoEv
+__ZN7WebCore13XMLSerializer17serializeToStringEPNS_4NodeERi
+__ZN7WebCore15JSXMLSerializerD1Ev
+__ZN7WebCore15JSXMLSerializerD2Ev
+__ZN7WebCoreL22shouldAddNamespaceElemEPKNS_7ElementE
+__ZN7WebCoreL15appendNamespaceERN3WTF6VectorItLm0EEERKNS_12AtomicStringES6_RNS0_7HashMapIPNS_16AtomicStringImplES9_NS0_7PtrHash
+__ZN7WebCoreL22shouldAddNamespaceAttrEPKNS_9AttributeERN3WTF7HashMapIPNS_16AtomicStringImplES6_NS3_7PtrHashIS6_EENS3_10HashTrai
+__ZN7WebCore23jsHTMLAnchorElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4textEv
+__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14jsSVGElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSSVGSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12JSSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17setJSSVGElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore10SVGElement5setIdERKNS_6StringERi
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionRemoveRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSStyleSheet3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12JSStyleSheet16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateHTMLDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCoreL17isViewportElementEPNS_4NodeE
+__ZN7WebCore13SVGSVGElement19removedFromDocumentEv
+__ZThn8_N7WebCore13SVGSVGElementD0Ev
+__ZN7WebCore9Attribute17isMappedAttributeEv
+__ZN7WebCore22JSNamedNodesCollectionC1EPN3JSC9ExecStateERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZN7WebCore22JSNamedNodesCollectionC2EPN3JSC9ExecStateERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC2ERKS5_
+__ZN7WebCore22JSNamedNodesCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSNamedNodesCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore22JSNamedNodesCollectionD1Ev
+__ZN7WebCore50jsCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D24globalCompositeOperationEv
+__ZN7WebCore21compositeOperatorNameENS_17CompositeOperatorE
+__ZN7WebCore33jsCanvasRenderingContext2DLineCapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D7lineCapEv
+__ZN7WebCore11lineCapNameENS_7LineCapE
+__ZN7WebCore34jsCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D8lineJoinEv
+__ZN7WebCore12lineJoinNameENS_8LineJoinE
+__ZN7WebCore37jsCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D11shadowColorEv
+__ZNK7WebCore19JSHTMLLegendElement9classInfoEv
+__ZN7WebCore28setJSHTMLLinkElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement11setDisabledEb
+__ZN7WebCore15HTMLLinkElement16setDisabledStateEb
+__ZN7WebCore37jsRangePrototypeFunctionCloneContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range13cloneContentsERi
+__ZN7WebCoreL18callHTMLCollectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore31jsCSSStyleDeclarationParentRuleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27CSSComputedStyleDeclaration11setPropertyEiRKNS_6StringEbRi
+__ZN7WebCore21jsCSSRuleUNKNOWN_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSRuleSTYLE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsCSSRuleCHARSET_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSRuleIMPORT_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSRuleMEDIA_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsCSSRuleFONT_FACE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsCSSRulePAGE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsCSSValueCSS_INHERITEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSValueCSS_PRIMITIVE_VALUEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsCSSValueCSS_VALUE_LISTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSValueCSS_CUSTOMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsDOMWindowCSSValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSCSSValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSCSSValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMWindowNodeFilterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSNodeFilter14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSNodeFilterConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSNodeFilterPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSNodeFilter15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSNodeFilterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsNodeFilterSHOW_ELEMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsDocumentPrototypeFunctionCreateNodeIteratorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12toNodeFilterEN3JSC7JSValueE
+__ZN7WebCore21JSNodeFilterConditionC1EN3JSC7JSValueE
+__ZN7WebCore21JSNodeFilterConditionC2EN3JSC7JSValueE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NodeIteratorE
+__ZN7WebCore14JSNodeIterator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSNodeIteratorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NodeIteratorEEE
+__ZN7WebCore14JSNodeIteratorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NodeIteratorEEE
+__ZN7WebCore14JSNodeIterator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsNodeIteratorFilterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10NodeFilterE
+__ZN7WebCore12JSNodeFilterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10NodeFilterEEE
+__ZN7WebCore12JSNodeFilterC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10NodeFilterEEE
+__ZN7WebCore12JSNodeFilter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSNodeFilterPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsNodeFilterFILTER_ACCEPTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterFILTER_REJECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsNodeFilterFILTER_SKIPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsNodeFilterSHOW_ALLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsNodeFilterSHOW_ATTRIBUTEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsNodeFilterSHOW_TEXTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsNodeFilterSHOW_CDATA_SECTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeFilterSHOW_ENTITY_REFERENCEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsNodeFilterSHOW_ENTITYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsNodeFilterSHOW_PROCESSING_INSTRUCTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeFilterSHOW_COMMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterSHOW_DOCUMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsNodeFilterSHOW_DOCUMENT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsNodeFilterSHOW_DOCUMENT_FRAGMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterSHOW_NOTATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSNodeFilter4markEv
+__ZN7WebCore21JSNodeFilterCondition4markEv
+__ZN7WebCore14JSNodeIterator4markEv
+__ZN7WebCore27jsDOMWindowAudioConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow5audioEPN3JSC9ExecStateE
+__ZN7WebCore18JSAudioConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore18JSAudioConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSHTMLAudioElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSAudioConstructor4markEv
+__ZN7WebCore12JSNodeFilterD1Ev
+__ZN7WebCore12JSNodeFilterD2Ev
+__ZN7WebCore14JSNodeIteratorD1Ev
+__ZN7WebCore14JSNodeIteratorD2Ev
+__ZN7WebCore21JSNodeFilterConditionD0Ev
+__ZN7WebCore23JSNodeIteratorPrototypeD1Ev
+__ZN7WebCore21JSNodeFilterPrototypeD1Ev
+__ZN7WebCore23JSNodeFilterConstructorD1Ev
+__ZN7WebCore21JSCSSValueConstructorD1Ev
+__ZN7WebCore18JSAudioConstructorD1Ev
+__ZN7WebCore30setJSDOMWindowImageConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowOptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXMLHttpRequestConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowDOMParserConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowXSLTProcessorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSProcessingInstructionDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSRGBColor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZL13jsRGBColorRedPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZL15jsRGBColorGreenPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZL14jsRGBColorBluePN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore19jsCSSImportRuleHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSImportRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9MediaListE
+__ZN7WebCore11JSMediaList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSMediaListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9MediaListEEE
+__ZN7WebCore11JSMediaListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9MediaListEEE
+__ZN7WebCore11JSMediaList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsMediaListMediaTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSMediaRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13CSSImportRule7cssTextEv
+__ZN7WebCore11JSMediaListD1Ev
+__ZN7WebCore11JSMediaListD2Ev
+__ZN7WebCore20JSMediaListPrototypeD1Ev
+__ZN7WebCore14JSCSSStyleRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSCSSRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSCSSRuleCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7CSSRule10setCssTextERKNS_6StringERi
+__ZN7WebCore29setJSCSSStyleRuleSelectorTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12CSSStyleRule15setSelectorTextERKNS_6StringERi
+__ZN7WebCore10JSCSSValue3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSCSSValueCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11JSMediaList3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23setJSMediaListMediaTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39jsCSSStyleSheetPrototypeFunctionAddRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_Ri
+__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_iRi
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionRemoveRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSStyleSheet3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23setJSStyleSheetDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38jsRangePrototypeFunctionDeleteContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateHTMLDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
 __ZN7WebCore17DOMImplementation18createHTMLDocumentERKNS_6StringE
+__ZN7WebCore20setJSHTMLDocumentDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument6setDirERKNS_6StringE
+__ZN7WebCore17setJSDocumentBodyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore8Document7setBodyEN3WTF10PassRefPtrINS_11HTMLElementEEERi
+__ZN7WebCore20setJSDocumentCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document10setCharsetERKNS_6StringE
+__ZN7WebCore34setJSDocumentSelectedStylesheetSetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore8Document24setSelectedStylesheetSetERKNS_6StringE
+__ZN7WebCore31jsDocumentSelectedStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8Document21selectedStylesheetSetEv
+__ZN7WebCore21jsHTMLDocumentFgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument7fgColorEv
+__ZN7WebCore27setJSHTMLDocumentAlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument13setAlinkColorERKNS_6StringE
+__ZN7WebCore24jsHTMLDocumentAlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore12HTMLDocument10alinkColorEv
+__ZN7WebCore23jsHTMLDocumentLinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument9linkColorEv
+__ZN7WebCore24jsHTMLDocumentVlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore12HTMLDocument10vlinkColorEv
-__ZN7WebCore25JSStyleSheetListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37jsStyleSheetListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSStyleSheetList9classInfoEv
-__ZN7WebCore34jsCSSRuleListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore13JSCSSRuleList9classInfoEv
-__ZN7WebCore20JSCSSRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore20JSCSSRuleConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSCSSRuleConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15HTMLAreaElement11setTabIndexEi
-__ZNK7WebCore27JSHTMLEmbedElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLAppletElementPrototype9classInfoEv
-__ZN7WebCore10JSCSSValue3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore26JSXPathNSResolverPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLFormElementPrototype9classInfoEv
-__ZN7WebCore13KeyboardEventC1Ev
-__ZN7WebCore6JSRectC1EPN3KJS8JSObjectEPNS_4RectE
-__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9MediaListE
-__ZN7WebCore11JSMediaListC1EPN3KJS8JSObjectEPNS_9MediaListE
-__ZN7WebCore9JSCSSRule16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore7CSSRule10setCssTextENS_6StringERi
-__ZN7WebCore14JSCSSStyleRule16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore12CSSStyleRule15setSelectorTextERKNS_6StringERi
-__ZN7WebCore10JSCSSValue16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN3KJS17staticValueGetterIN7WebCore10JSCSSValueEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSCSSValue16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore11JSMediaList3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSMediaList16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore11JSMediaList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore11JSMediaListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSMediaList16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore9MediaList9mediaTextEv
-__ZN7WebCore33jsHistoryPrototypeFunctionForwardEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7History7forwardEv
-__ZN7WebCore13RenderListBox32scrollToRevealElementAtListIndexEi
-__ZN7WebCore18JSHTMLTitleElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore22JSDOMParserConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSXMLSerializerConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSRangeConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSCSSValueConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSXPathEvaluatorConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10NodeFilterE
-__ZN7WebCore12JSNodeFilterC1EPN3KJS8JSObjectEPNS_10NodeFilterE
-__ZN7WebCore21JSNodeFilterPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11HTMLElement6setDirERKNS_6StringE
+__ZNK7WebCore17HTMLObjectElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore16HTMLParamElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore26jsDOMWindowAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSAttr14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore15JSAttrPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSAttrConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSAttrConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCharacterDataConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCharacterData14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCharacterDataConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCharacterDataConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCDATASection14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCDATASectionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCDATASectionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCDATASectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCDATASectionConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSCommentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSCommentConstructor9classInfoEv
+__ZNK7WebCore21JSDocumentConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSDocumentFragment14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSDocumentFragmentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSDocumentFragmentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSDocumentFragmentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSDocumentFragmentConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSDocumentType14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSDocumentTypeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSDocumentTypePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSDocumentTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSDocumentTypeConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowEntityConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8JSEntity14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSEntityConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSEntityPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSEntity15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSEntityConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSEntityConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSEntityReference14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSEntityReferenceConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSEntityReferencePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSEntityReferenceConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSEntityReferenceConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSHTMLDocumentConstructor9classInfoEv
 __ZNK7WebCore17JSNodeConstructor9classInfoEv
-__ZNK7WebCore12CDATASection8toStringEv
-__ZNK3KJS40StringInstanceThatMasqueradesAsUndefined9toBooleanEPNS_9ExecStateE
-__ZNK7WebCore19CSSStyleDeclaration10parentRuleEv
-__ZN7WebCore27CSSComputedStyleDeclaration11setPropertyEiRKNS_6StringEbRi
-__ZNK7WebCore20JSElementConstructor21implementsHasInstanceEv
-__ZN7WebCore11HTMLElement12setOuterTextERKNS_6StringERi
-__ZNK7WebCore24CanvasRenderingContext2D24globalCompositeOperationEv
-__ZN7WebCore21compositeOperatorNameENS_17CompositeOperatorE
-__ZN7WebCore24CanvasRenderingContext2D10setLineCapERKNS_6StringE
-__ZN7WebCore12parseLineCapERKNS_6StringERNS_7LineCapE
-__ZNK7WebCore24CanvasRenderingContext2D7lineCapEv
-__ZN7WebCore11lineCapNameENS_7LineCapE
-__ZNK7WebCore24CanvasRenderingContext2D8lineJoinEv
-__ZN7WebCore12lineJoinNameENS_8LineJoinE
-__ZNK7WebCore24CanvasRenderingContext2D11shadowColorEv
-__ZN7WebCore12JSNodeFilter4markEv
-__ZN7WebCore17HTMLAnchorElement10setCharsetERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement9setCoordsERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement11setHreflangERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement6setRevERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement8setShapeERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement7setTypeERKNS_6StringE
-__ZN7WebCore19JSHTMLAppletElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLAppletElement9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLAppletElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30jsDOMWindowNotationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNotation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSNotationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSNotationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSNotation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSNotationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSNotationConstructor9classInfoEv
+__ZN7WebCore43jsDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSProcessingInstruction14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSProcessingInstructionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSProcessingInstructionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSProcessingInstructionConstructor9classInfoEv
+__ZNK7WebCore17JSTextConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLAnchorElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLAnchorElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLAppletElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLAppletElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLAppletElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLAreaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLAreaElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLBaseElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLBaseElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLBaseElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLBaseElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLBaseFontElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLBaseFontElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLBaseFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLBaseFontElementConstructor9classInfoEv
+__ZN7WebCore43jsDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSHTMLBlockquoteElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSHTMLBlockquoteElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSHTMLBlockquoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSHTMLBlockquoteElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28JSHTMLBodyElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLBodyElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLBRElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLBRElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSHTMLBRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLBRElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLButtonElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLButtonElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLCanvasElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLCanvasElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLCanvasElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLCanvasElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLDirectoryElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLDirectoryElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSHTMLDirectoryElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLDirectoryElementConstructor9classInfoEv
+__ZN7WebCore27JSHTMLDivElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLDivElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLDListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLDListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLDListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLDListElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLEmbedElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLEmbedElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLEmbedElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLFieldSetElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSHTMLFieldSetElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLFieldSetElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLFieldSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLFieldSetElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLFontElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLFontElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLFontElementConstructor9classInfoEv
+__ZNK7WebCore28JSHTMLFormElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLFrameElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLFrameElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLFrameElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLFrameSetElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLFrameSetElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLFrameSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLFrameSetElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31JSHTMLHeadingElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLHeadingElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLHeadElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLHeadElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLHeadElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLHeadElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLHRElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLHRElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSHTMLHRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLHRElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28JSHTMLHtmlElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLHtmlElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLIFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLIFrameElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLImageElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLImageElementConstructor9classInfoEv
+__ZNK7WebCore29JSHTMLInputElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLIsIndexElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLIsIndexElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLIsIndexElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLIsIndexElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLLabelElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLLabelElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLLabelElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLLabelElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLLegendElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLLegendElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLLegendElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLLegendElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSHTMLLIElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLLIElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLLinkElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLLinkElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLLinkElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLLinkElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLMapElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLMapElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLMapElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLMapElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLMarqueeElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLMarqueeElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLMarqueeElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLMarqueeElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLMarqueeElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLMenuElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLMenuElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLMenuElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLMenuElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLMetaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLMetaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLMetaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLMetaElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSHTMLModElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLModElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLObjectElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLObjectElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLObjectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLObjectElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLOListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLOListElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLOptGroupElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLOptGroupElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLOptGroupElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLOptGroupElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLOptionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLOptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLOptionElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33JSHTMLParagraphElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLParagraphElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLParamElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLParamElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLParamElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLParamElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLPreElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLPreElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLPreElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLPreElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLQuoteElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLQuoteElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLQuoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLQuoteElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLScriptElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLScriptElementConstructor9classInfoEv
+__ZNK7WebCore30JSHTMLSelectElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLStyleElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLStyleElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLStyleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLStyleElementConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLTableCaptionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSHTMLTableCaptionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSHTMLTableCaptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSHTMLTableCaptionElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTableColElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTableColElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTableColElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLTableColElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLTableElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLTableElementConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLTableSectionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSHTMLTableSectionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSHTMLTableSectionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSHTMLTableSectionElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLTableCellElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLTableCellElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSHTMLTableCellElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLTableCellElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTableRowElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTableRowElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTableRowElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLTableRowElementConstructor9classInfoEv
+__ZNK7WebCore32JSHTMLTextAreaElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLTitleElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLTitleElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLTitleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLTitleElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLUListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLUListElementConstructor9classInfoEv
+__ZNK7WebCore24JSHTMLElementConstructor9classInfoEv
+__ZN7WebCore46jsDOMWindowCanvasRenderingContext2DConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSCanvasRenderingContext2D14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore35JSCanvasRenderingContext2DPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSCanvasRenderingContext2DConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore37JSCanvasRenderingContext2DConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowClipboardConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSClipboard14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSClipboardPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSClipboardConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSClipboardConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounter14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCounterConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSCounterPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCounter15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSCounterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSCounterConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSCharsetRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSCSSCharsetRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSCSSCharsetRuleConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSCSSFontFaceRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSCSSFontFaceRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSFontFaceRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSCSSFontFaceRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSCSSFontFaceRuleConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSImportRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSImportRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSImportRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSCSSImportRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCSSImportRuleConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSMediaRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSMediaRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSMediaRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSMediaRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSMediaRuleConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSCSSPageRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSCSSPageRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSCSSPageRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCSSPageRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSCSSPageRuleConstructor9classInfoEv
+__ZNK7WebCore30JSCSSPrimitiveValueConstructor9classInfoEv
+__ZNK7WebCore20JSCSSRuleConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSCSSRuleList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSRuleListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSCSSRuleListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCSSRuleListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSCSSRuleListConstructor9classInfoEv
+__ZN7WebCore32JSCSSStyleDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSCSSStyleDeclarationConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSStyleRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSStyleRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSStyleRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSStyleRuleConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSStyleSheet14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSStyleSheetConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSStyleSheetPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSCSSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCSSStyleSheetConstructor9classInfoEv
+__ZNK7WebCore21JSCSSValueConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSValueListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSValueListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSValueListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSValueListConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSDOMImplementation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSDOMImplementationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore28JSDOMImplementationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSDOMImplementationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSDOMImplementationConstructor9classInfoEv
+__ZNK7WebCore18JSEventConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLCollectionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLCollectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLCollectionConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSKeyboardEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSKeyboardEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSKeyboardEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSKeyboardEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSKeyboardEventConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSMediaList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSMediaListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSMediaListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSMediaListConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowMimeTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSMimeType14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSMimeTypeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSMimeTypePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSMimeTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSMimeTypeConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowMimeTypeArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSMimeTypeArray14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSMimeTypeArrayConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSMimeTypeArrayPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSMimeTypeArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSMimeTypeArrayConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSMouseEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSMouseEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSMouseEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSMouseEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSMouseEventConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSMutationEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSMutationEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSMutationEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSMutationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSMutationEventConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSNamedNodeMapConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSNamedNodeMapPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSNamedNodeMapConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSNamedNodeMapConstructor9classInfoEv
+__ZNK7WebCore23JSNodeFilterConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSNodeListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSNodeListConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSOverflowEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSOverflowEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSOverflowEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSOverflowEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSOverflowEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSOverflowEventConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowPluginConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8JSPlugin14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSPluginConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSPluginPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSPluginConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSPluginConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowPluginArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSPluginArray14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSPluginArrayConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSPluginArrayPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSPluginArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSPluginArrayConstructor9classInfoEv
+__ZN7WebCore27jsDOMWindowRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7JSRange14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore18JSRangeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore16JSRangePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSRangeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSRangeConstructor9classInfoEv
+__ZN7WebCore26jsDOMWindowRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSRect14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSRectConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore15JSRectPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSRectConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSRectConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSStyleSheet14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSStyleSheetConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSStyleSheetListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSStyleSheetListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSStyleSheetListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSStyleSheetListConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSTextEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSTextEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSTextEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSTextEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSTextEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSTextEventConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSUIEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSUIEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSUIEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSUIEventConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSWheelEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSWheelEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSWheelEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWheelEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSWheelEventConstructor9classInfoEv
+__ZNK7WebCore24JSXPathResultConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowWorkerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6workerEPN3JSC9ExecStateE
+__ZN7WebCore19JSWorkerConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore19JSWorkerConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSWorkerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSWorker15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSWorkerConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL15constructWorkerEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore36jsDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathEvaluator14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSXPathEvaluatorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSXPathEvaluatorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXPathEvaluator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXPathEvaluatorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSXPathEvaluatorConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore27JSXPathEvaluatorConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14XPathEvaluatorE
+__ZN7WebCore16JSXPathEvaluatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathEvaluatorEEE
+__ZN7WebCore16JSXPathEvaluatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathEvaluatorEEE
+__ZN7WebCore16JSXPathEvaluator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSXPathEvaluatorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSXPathEvaluator9classInfoEv
+__ZN7WebCore24JSXSLTProcessorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSXSLTProcessor9classInfoEv
+__ZN7WebCore18JSAudioConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL14constructAudioEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore18JSAudioConstructor8documentEv
+__ZN7WebCore16JSXPathEvaluatorD1Ev
+__ZN7WebCore16JSXPathEvaluatorD2Ev
+__ZThn8_N7WebCore16HTMLAudioElementD0Ev
+__ZN7WebCore28JSEntityReferenceConstructorD1Ev
+__ZN7WebCore17JSEntityPrototypeD1Ev
+__ZN7WebCore19JSEntityConstructorD1Ev
+__ZN7WebCore25JSDocumentTypeConstructorD1Ev
+__ZN7WebCore29JSDocumentFragmentConstructorD1Ev
+__ZN7WebCore25JSCDATASectionConstructorD1Ev
+__ZN7WebCore26JSCharacterDataConstructorD1Ev
+__ZN7WebCore17JSAttrConstructorD1Ev
+__ZN7WebCore26JSHTMLHRElementConstructorD1Ev
+__ZN7WebCore28JSHTMLHeadElementConstructorD1Ev
+__ZN7WebCore32JSHTMLFrameSetElementConstructorD1Ev
+__ZN7WebCore29JSHTMLFrameElementConstructorD1Ev
+__ZN7WebCore28JSHTMLFontElementConstructorD1Ev
+__ZN7WebCore32JSHTMLFieldSetElementConstructorD1Ev
+__ZN7WebCore29JSHTMLEmbedElementConstructorD1Ev
+__ZN7WebCore29JSHTMLDListElementConstructorD1Ev
+__ZN7WebCore30JSHTMLCanvasElementConstructorD1Ev
+__ZN7WebCore26JSHTMLBRElementConstructorD1Ev
+__ZN7WebCore34JSHTMLBlockquoteElementConstructorD1Ev
+__ZN7WebCore32JSHTMLBaseFontElementConstructorD1Ev
+__ZN7WebCore28JSHTMLBaseElementConstructorD1Ev
+__ZN7WebCore28JSHTMLAreaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLAppletElementConstructorD1Ev
+__ZN7WebCore19JSNotationPrototypeD1Ev
+__ZN7WebCore33JSHTMLDirectoryElementConstructorD1Ev
+__ZN7WebCore21JSNotationConstructorD1Ev
+__ZN7WebCore34JSProcessingInstructionConstructorD1Ev
+__ZN7WebCore31JSHTMLIsIndexElementConstructorD1Ev
+__ZN7WebCore29JSHTMLLabelElementConstructorD1Ev
+__ZN7WebCore30JSHTMLLegendElementConstructorD1Ev
+__ZN7WebCore28JSHTMLLinkElementConstructorD1Ev
+__ZN7WebCore27JSHTMLMapElementConstructorD1Ev
+__ZN7WebCore31JSHTMLMarqueeElementConstructorD1Ev
+__ZN7WebCore28JSHTMLMenuElementConstructorD1Ev
+__ZN7WebCore28JSHTMLMetaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLObjectElementConstructorD1Ev
+__ZN7WebCore29JSHTMLOListElementConstructorD1Ev
+__ZN7WebCore32JSHTMLOptGroupElementConstructorD1Ev
+__ZN7WebCore30JSHTMLOptionElementConstructorD1Ev
+__ZN7WebCore29JSHTMLParamElementConstructorD1Ev
+__ZN7WebCore27JSHTMLPreElementConstructorD1Ev
+__ZN7WebCore29JSHTMLQuoteElementConstructorD1Ev
+__ZN7WebCore29JSHTMLStyleElementConstructorD1Ev
+__ZN7WebCore36JSHTMLTableCaptionElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTableColElementConstructorD1Ev
+__ZN7WebCore36JSHTMLTableSectionElementConstructorD1Ev
+__ZN7WebCore33JSHTMLTableCellElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTableRowElementConstructorD1Ev
+__ZN7WebCore29JSHTMLTitleElementConstructorD1Ev
+__ZN7WebCore37JSCanvasRenderingContext2DConstructorD1Ev
+__ZN7WebCore22JSClipboardConstructorD1Ev
+__ZN7WebCore20JSCounterConstructorD1Ev
+__ZN7WebCore18JSCounterPrototypeD1Ev
+__ZN7WebCore27JSCSSCharsetRuleConstructorD1Ev
+__ZN7WebCore28JSCSSFontFaceRuleConstructorD1Ev
+__ZN7WebCore26JSCSSImportRuleConstructorD1Ev
+__ZN7WebCore25JSCSSMediaRuleConstructorD1Ev
+__ZN7WebCore24JSCSSPageRuleConstructorD1Ev
+__ZN7WebCore22JSCSSPageRulePrototypeD1Ev
+__ZN7WebCore24JSCSSRuleListConstructorD1Ev
+__ZN7WebCore25JSCSSStyleRuleConstructorD1Ev
+__ZN7WebCore26JSCSSStyleSheetConstructorD1Ev
+__ZN7WebCore25JSCSSValueListConstructorD1Ev
+__ZN7WebCore30JSDOMImplementationConstructorD1Ev
+__ZN7WebCore27JSHTMLCollectionConstructorD1Ev
+__ZN7WebCore26JSKeyboardEventConstructorD1Ev
+__ZN7WebCore22JSMediaListConstructorD1Ev
+__ZN7WebCore21JSMimeTypeConstructorD1Ev
+__ZN7WebCore26JSMimeTypeArrayConstructorD1Ev
+__ZN7WebCore23JSMouseEventConstructorD1Ev
+__ZN7WebCore26JSMutationEventConstructorD1Ev
+__ZN7WebCore25JSNamedNodeMapConstructorD1Ev
+__ZN7WebCore26JSOverflowEventConstructorD1Ev
+__ZN7WebCore24JSOverflowEventPrototypeD1Ev
+__ZN7WebCore19JSPluginConstructorD1Ev
+__ZN7WebCore24JSPluginArrayConstructorD1Ev
+__ZN7WebCore18JSRangeConstructorD1Ev
+__ZN7WebCore17JSRectConstructorD1Ev
+__ZN7WebCore15JSRectPrototypeD1Ev
+__ZN7WebCore23JSStyleSheetConstructorD1Ev
+__ZN7WebCore27JSStyleSheetListConstructorD1Ev
+__ZN7WebCore22JSTextEventConstructorD1Ev
+__ZN7WebCore20JSTextEventPrototypeD1Ev
+__ZN7WebCore20JSUIEventConstructorD1Ev
+__ZN7WebCore23JSWheelEventConstructorD1Ev
+__ZN7WebCore21JSWheelEventPrototypeD1Ev
+__ZN7WebCore19JSWorkerConstructorD1Ev
+__ZN7WebCore17JSWorkerPrototypeD1Ev
+__ZN7WebCore27JSXPathEvaluatorConstructorD1Ev
+__ZN7WebCore25JSXPathEvaluatorPrototypeD1Ev
+__ZN7WebCoreL14warningHandlerEPvPKcz
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3setERKS3_SA_
+__ZN7WebCore48jsRangePrototypeFunctionCreateContextualFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5Range24createContextualFragmentERKNS_6StringERi
+__ZN7WebCore16JSHTMLCollection16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore25JSHTMLCollectionPrototype9classInfoEv
+__ZN7WebCore14JSNamedNodeMap16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore23JSNamedNodeMapPrototype9classInfoEv
+__ZN7WebCore17JSHTMLFormElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore26JSHTMLFormElementPrototype9classInfoEv
+__ZNK7WebCore22JSHTMLElementPrototype9classInfoEv
+__ZNK7WebCore18JSElementPrototype9classInfoEv
+__ZNK7WebCore15JSNodePrototype9classInfoEv
+__ZN7WebCore17JSHTMLFormElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore15HTMLFormElement4itemEj
+__ZN7WebCore36jsNodeDOCUMENT_POSITION_CONTAINED_BYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsNodeDOCUMENT_POSITION_CONTAINSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsNodeDOCUMENT_POSITION_DISCONNECTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeDOCUMENT_POSITION_FOLLOWINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeDOCUMENT_POSITION_PRECEDINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeDOCUMENT_TYPE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsNodeENTITY_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsNodeENTITY_REFERENCE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsNodeNOTATION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodePROCESSING_INSTRUCTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsElementChildElementCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element17childElementCountEv
+__ZN7WebCore28jsHTMLElementContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement15contentEditableEv
+__ZN7WebCore25jsHTMLFormElementEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsElementFirstElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLElementIsContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsElementLastElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element16lastElementChildEv
+__ZN7WebCore27jsElementNextElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element18nextElementSiblingEv
+__ZN7WebCore22jsHTMLElementOuterTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element9outerTextEv
+__ZN7WebCore31jsElementPreviousElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element22previousElementSiblingEv
+__ZN7WebCore19JSHTMLSelectElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore28JSHTMLSelectElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLSelectElementAutofocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLSelectElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22HTMLFormControlElement12willValidateEv
+__ZN7WebCore16JSStyleSheetList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore25JSStyleSheetListPrototype9classInfoEv
+__ZN7WebCore13JSCSSRuleList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore22JSCSSRuleListPrototype9classInfoEv
+__ZN7WebCore21JSCSSStyleDeclaration16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore30JSCSSStyleDeclarationPrototype9classInfoEv
+__ZN7WebCore14JSCSSValueList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore23JSCSSValueListPrototype9classInfoEv
+__ZNK7WebCore19JSCSSValuePrototype9classInfoEv
+__ZN7WebCore14JSCSSValueList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore22jsCSSValueCssValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSValueListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSMediaList9classInfoEv
+__ZN7WebCore11JSMediaList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore20JSMediaListPrototype9classInfoEv
+__ZN7WebCore20JSMediaListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSMediaList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore9MediaList4itemEj
+__ZN7WebCore17jsMediaListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsMediaListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15setJSNodePrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7Element9setPrefixERKNS_12AtomicStringERi
+__ZN7WebCore4Node14checkSetPrefixERKNS_12AtomicStringERi
+__ZN7WebCore20setJSHTMLElementLangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement7setLangERKNS_6StringE
+__ZN7WebCore19setJSHTMLElementDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLAnchorElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement10setCharsetERKNS_12AtomicStringE
+__ZN7WebCore28setJSHTMLAnchorElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement9setCoordsERKNS_12AtomicStringE
+__ZN7WebCore30setJSHTMLAnchorElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement11setHreflangERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLAnchorElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement6setRevERKNS_12AtomicStringE
+__ZN7WebCore27setJSHTMLAnchorElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement8setShapeERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAnchorElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setTypeERKNS_12AtomicStringE
+__ZN7WebCore27setJSHTMLAppletElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLPlugInElement8setAlignERKNS_6StringE
+__ZN7WebCore25setJSHTMLAppletElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement6setAltERKNS_6StringE
+__ZN7WebCore29setJSHTMLAppletElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement10setArchiveERKNS_6StringE
+__ZN7WebCore26setJSHTMLAppletElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement7setCodeERKNS_6StringE
+__ZN7WebCore30setJSHTMLAppletElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement11setCodeBaseERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLAppletElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement9setHspaceERKNS_6StringE
+__ZN7WebCore26setJSHTMLAppletElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLPlugInElement7setNameERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementObjectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement9setObjectERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement9setVspaceERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement6setAltERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement7setHrefERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement9setTargetERKNS_6StringE
-__ZN7WebCore17JSHTMLBaseElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSHTMLBaseElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLAppletElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement12setAccessKeyERKNS_12AtomicStringE
+__ZN7WebCore23setJSHTMLAreaElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement6setAltERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLAreaElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement8setShapeERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAreaElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement9setTargetERKNS_12AtomicStringE
+__ZN7WebCore24setJSHTMLBaseElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLBaseElement7setHrefERKNS_6StringE
+__ZN7WebCore26setJSHTMLBaseElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLBaseElement9setTargetERKNS_6StringE
-__ZN7WebCore21JSHTMLBaseFontElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLBaseFontElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore21JSHTMLBaseFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLBaseFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLBaseFontElement8setColorERKNS_6StringE
+__ZN7WebCore28setJSHTMLBaseFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLBaseFontElement7setFaceERKNS_6StringE
-__ZN7WebCore23JSHTMLBlockquoteElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLBlockquoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore21HTMLBlockquoteElement7setCiteERKNS_6StringE
+__ZN7WebCore25setJSHTMLBodyElementALinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLBodyElement8setALinkERKNS_6StringE
-__ZN7WebCore15JSHTMLBRElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLBodyElementBackgroundEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLBodyElement13setBackgroundERKNS_6StringE
+__ZN7WebCore27setJSHTMLBodyElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLBodyElementLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLBodyElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLBodyElementVLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSHTMLBRElementClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLBRElement8setClearERKNS_6StringE
+__ZN7WebCore31setJSHTMLButtonElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLButtonElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore27setJSHTMLButtonElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLButtonElement8setValueERKNS_6StringE
+__ZN7WebCore24setJSHTMLDivElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLDivElement8setAlignERKNS_6StringE
+__ZN7WebCore26setJSHTMLEmbedElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23jsHTMLEmbedElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSHTMLEmbedElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLEmbedElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLEmbedElement6setSrcERKNS_6StringE
+__ZN7WebCore25setJSHTMLEmbedElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLEmbedElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLFontElement8setColorERKNS_6StringE
+__ZN7WebCore24setJSHTMLFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLFontElement7setFaceERKNS_6StringE
+__ZN7WebCore24setJSHTMLFontElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFontElement7setSizeERKNS_6StringE
+__ZN7WebCore28setJSHTMLFormElementEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLFormElement10setEnctypeERKNS_6StringE
-__ZN7WebCore18JSHTMLFrameElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLFrameElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLFormElementEnctypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSHTMLFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLFrameElementBase11setLongDescERKNS_6StringE
-__ZN7WebCore18JSHTMLFrameElement6setSrcEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore18JSHTMLFrameElement11setLocationEPN3KJS9ExecStateEPNS1_7JSValueE
+__ZN7WebCore33setJSHTMLFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSHTMLFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSHTMLFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement6setSrcEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore29setJSHTMLFrameElementLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26jsHTMLFrameElementLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase8locationEv
-__ZN7WebCore21JSHTMLFrameSetElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLFrameSetElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore21JSHTMLFrameSetElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore28setJSHTMLFrameSetElementColsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLFrameSetElement7setColsERKNS_6StringE
+__ZN7WebCore28setJSHTMLFrameSetElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLFrameSetElement7setRowsERKNS_6StringE
-__ZN7WebCore17JSHTMLHeadElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLHeadElementProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLHeadElement10setProfileERKNS_6StringE
-__ZN7WebCore20JSHTMLHeadingElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore28setJSHTMLHeadingElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore18HTMLHeadingElement8setAlignERKNS_6StringE
-__ZN7WebCore15JSHTMLHRElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore23setJSHTMLHRElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLHRElement8setAlignERKNS_6StringE
+__ZN7WebCore22setJSHTMLHRElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLHRElement7setSizeERKNS_6StringE
+__ZN7WebCore23setJSHTMLHRElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLHRElement8setWidthERKNS_6StringE
-__ZN7WebCore17JSHTMLHtmlElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLHtmlElementVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLHtmlElement10setVersionERKNS_6StringE
+__ZN7WebCore27setJSHTMLIFrameElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement8setAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLIFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLImageElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement7setNameERKNS_6StringE
+__ZN7WebCore29setJSHTMLImageElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLImageElement11setLongDescERKNS_6StringE
+__ZN7WebCore27setJSHTMLImageElementLowsrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLImageElement9setLowsrcERKNS_6StringE
+__ZN7WebCore24jsHTMLImageElementLowsrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore16HTMLImageElement6lowsrcEv
+__ZN7WebCore27setJSHTMLInputElementAcceptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement9setAcceptERKNS_6StringE
+__ZN7WebCore30setJSHTMLInputElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore26setJSHTMLInputElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement8setAlignERKNS_6StringE
+__ZN7WebCore24setJSHTMLInputElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement6setAltERKNS_6StringE
+__ZN7WebCore33setJSHTMLInputElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement15setDefaultValueERKNS_6StringE
+__ZN7WebCore24setJSHTMLInputElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement6setSrcERKNS_6StringE
+__ZN7WebCore7Element15removeAttributeERKNS_13QualifiedNameERi
+__ZN7WebCore27setJSHTMLInputElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement9setUseMapERKNS_6StringE
-__ZN7WebCore20JSHTMLIsIndexElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore20JSHTMLIsIndexElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLIsIndexElementPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore18HTMLIsIndexElement9setPromptERKNS_6StringE
+__ZN7WebCore30setJSHTMLLabelElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLLabelElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore19JSHTMLLegendElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore31setJSHTMLLegendElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLLegendElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore27setJSHTMLLegendElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLLegendElement8setAlignERKNS_6StringE
+__ZN7WebCore22setJSHTMLLIElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLLIElement7setTypeERKNS_6StringE
+__ZN7WebCore27setJSHTMLLinkElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement10setCharsetERKNS_6StringE
+__ZN7WebCore28setJSHTMLLinkElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLLinkElement11setHreflangERKNS_6StringE
+__ZN7WebCore23setJSHTMLLinkElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLLinkElement6setRevERKNS_6StringE
+__ZN7WebCore26setJSHTMLLinkElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLLinkElement9setTargetERKNS_6StringE
+__ZN7WebCore23setJSHTMLMapElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLMapElement7setNameERKNS_6StringE
+__ZN7WebCore29setJSHTMLMetaElementHttpEquivEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement12setHttpEquivERKNS_6StringE
+__ZN7WebCore26setJSHTMLMetaElementSchemeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLMetaElement9setSchemeERKNS_6StringE
-__ZN7WebCore16JSHTMLModElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore23setJSHTMLModElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore14HTMLModElement7setCiteERKNS_6StringE
+__ZN7WebCore27setJSHTMLModElementDateTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore14HTMLModElement11setDateTimeERKNS_6StringE
+__ZN7WebCore26setJSHTMLObjectElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement7setCodeERKNS_6StringE
+__ZN7WebCore27setJSHTMLObjectElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLObjectElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement10setArchiveERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement9setBorderERKNS_6StringE
+__ZN7WebCore30setJSHTMLObjectElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement11setCodeBaseERKNS_6StringE
+__ZN7WebCore30setJSHTMLObjectElementCodeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement11setCodeTypeERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLObjectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLObjectElementStandbyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement10setStandbyERKNS_6StringE
-__ZN7WebCore17HTMLObjectElement7setTypeERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement9setUseMapERKNS_6StringE
+__ZN7WebCore27setJSHTMLObjectElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLOListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLOListElement7setTypeERKNS_6StringE
-__ZN7WebCore21JSHTMLOptGroupElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore21JSHTMLOptGroupElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLOptGroupElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLOptGroupElement8setLabelERKNS_6StringE
+__ZN7WebCore27setJSHTMLOptionElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLOptionElement8setLabelERKNS_6StringE
-__ZN7WebCore22JSHTMLParagraphElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLParagraphElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLParagraphElement8setAlignERKNS_6StringE
-__ZN7WebCore18JSHTMLParamElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLParamElement7setNameERKNS_6StringE
+__ZN7WebCore25setJSHTMLParamElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLParamElement7setTypeERKNS_6StringE
-__ZN7WebCore16HTMLParamElement8setValueERKNS_6StringE
+__ZN7WebCore30setJSHTMLParamElementValueTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLParamElement12setValueTypeERKNS_6StringE
-__ZN7WebCore18JSHTMLQuoteElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLQuoteElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore18JSHTMLQuoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLQuoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLQuoteElement7setCiteERKNS_6StringE
+__ZN7WebCore29setJSHTMLScriptElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLScriptElement10setHtmlForERKNS_6StringE
+__ZN7WebCore27setJSHTMLScriptElementEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLScriptElement8setEventERKNS_6StringE
-__ZN7WebCore25JSHTMLTableCaptionElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore25JSHTMLTableCaptionElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore26setJSHTMLSelectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLStyleElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement8setMediaERKNS_12AtomicStringE
+__ZN7WebCore25JSHTMLTableCaptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore33setJSHTMLTableCaptionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableCaptionElement8setAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableCellElementAbbrEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement7setAbbrERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableCellElementAxisEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement7setAxisERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableCellElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement10setBgColorERKNS_6StringE
+__ZN7WebCore27setJSHTMLTableCellElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement5setChERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement8setChOffERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableCellElementHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement10setHeadersERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableCellElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setHeightERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementScopeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement8setScopeERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableCellElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setVAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setWidthERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement8setAlignERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableColElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement5setChERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement8setChOffERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableColElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement9setVAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement8setWidthERKNS_6StringE
+__ZN7WebCore28setJSHTMLTableElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLTableElement10setBgColorERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableElementFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLTableElement8setFrameERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableElementRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLTableElement8setRulesERKNS_6StringE
+__ZN7WebCore28setJSHTMLTableElementSummaryEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement10setSummaryERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableRowElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement8setAlignERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableRowElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement10setBgColorERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableRowElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableRowElement5setChERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableRowElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableRowElement8setChOffERKNS_6StringE
-__ZN7WebCore25JSHTMLTableSectionElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLTableRowElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement9setVAlignERKNS_6StringE
+__ZN7WebCore33setJSHTMLTableSectionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement8setAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableSectionElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement5setChERKNS_6StringE
+__ZN7WebCore33setJSHTMLTableSectionElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement8setChOffERKNS_6StringE
+__ZN7WebCore34setJSHTMLTableSectionElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement9setVAlignERKNS_6StringE
+__ZN7WebCore36setJSHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement15setDefaultValueERKNS_6StringE
+__ZN7WebCore33setJSHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTextAreaElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore18JSHTMLUListElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore28setJSHTMLTextAreaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLTitleElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLUListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLUListElement7setTypeERKNS_6StringE
-__ZN7WebCore28JSHTMLBaseElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLBaseElementConstructor9classInfoEv
-__ZN7WebCore32JSHTMLBaseFontElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLBaseFontElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLIFrameElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLIFrameElementConstructor9classInfoEv
-__ZN7WebCore34JSHTMLBlockquoteElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore34JSHTMLBlockquoteElementConstructor9classInfoEv
+__ZThn8_N7WebCore16HTMLEmbedElementD0Ev
+__ZNK3JSC8Bindings12ObjcInstance12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12ObjcInstance7valueOfEPNS_9ExecStateE
+__ZNK3JSC8Bindings12ObjcInstance11stringValueEPNS_9ExecStateE
+__ZN7WebCore19jsDOMWindowOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onsubmitEv
+__ZN7WebCore38jsDOMWindowHTMLAudioElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLAudioElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLAudioElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLAudioElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSHTMLAudioElementConstructor9classInfoEv
-__ZN7WebCore35JSSVGPreserveAspectRatioConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore44jsDOMWindowSVGPreserveAspectRatioConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSSVGPreserveAspectRatio14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore35JSSVGPreserveAspectRatioConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore35JSSVGPreserveAspectRatioConstructor9classInfoEv
-__ZN7WebCore9JSBarInfo18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsDOMWindowMenubarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7menubarEv
 __ZNK7WebCore9JSBarInfo9classInfoEv
-__ZN7WebCore21JSSVGAngleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsDOMWindowSVGAngleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGAngle14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSSVGAnglePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGAngle15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGAngleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGAngleConstructor9classInfoEv
-__ZNK7WebCore30JSCSSPrimitiveValueConstructor9classInfoEv
-__ZN7WebCore21JSSVGPaintConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsDOMWindowScrollbarsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10scrollbarsEv
+__ZN7WebCore30jsDOMWindowSVGPaintConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGPaint14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGPaintConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSSVGPaintPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGPaint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGColorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGColor15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPaintConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGPaintConstructor9classInfoEv
-__ZN7WebCore19JSEntityConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSEntityConstructor9classInfoEv
-__ZN7WebCore28JSHTMLMenuElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLMenuElementConstructor9classInfoEv
-__ZN7WebCore27JSHTMLModElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLModElementConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLFormElementConstructor9classInfoEv
-__ZN7WebCore23JSMouseEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSMouseEventConstructor9classInfoEv
-__ZN7WebCore22JSTextEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore22JSTextEventConstructor9classInfoEv
-__ZN7WebCore29JSHTMLQuoteElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLQuoteElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLHeadElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLHeadElementConstructor9classInfoEv
-__ZN7WebCore31JSHTMLIsIndexElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31JSHTMLIsIndexElementConstructor9classInfoEv
-__ZNK7WebCore25JSCDATASectionConstructor9classInfoEv
-__ZN7WebCore27JSCSSCharsetRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSCSSCharsetRuleConstructor9classInfoEv
-__ZN7WebCore30JSHTMLAppletElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLAppletElementConstructor9classInfoEv
-__ZNK7WebCore21JSCSSValueConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowDOMStringListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSDOMStringList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSDOMStringListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSDOMStringListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSDOMStringList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSDOMStringListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSDOMStringListConstructor9classInfoEv
+__ZN7WebCore18jsDOMWindowOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onfocusEv
+__ZN7WebCore21jsDOMWindowOuterWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10outerWidthEv
+__ZN7WebCore18jsDOMWindowOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onresetEv
+__ZN7WebCore37jsDOMWindowOnwebkitanimationiterationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow26onwebkitanimationiterationEv
+__ZNK7WebCore28JSWebKitCSSMatrixConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowWebKitPointConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow11webKitPointEPN3JSC9ExecStateE
+__ZN7WebCore24JSWebKitPointConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore24JSWebKitPointConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSWebKitPointPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSWebKitPoint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore24JSWebKitPointConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowXMLHttpRequestUploadConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSXMLHttpRequestUpload14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSXMLHttpRequestUploadPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSXMLHttpRequestUpload15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSXMLHttpRequestUploadConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSXMLHttpRequestUploadConstructor9classInfoEv
 __ZNK7WebCore22JSDOMParserConstructor9classInfoEv
-__ZN7WebCore25JSCSSValueListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSCSSValueListConstructor9classInfoEv
 __ZNK7WebCore8JSScreen9classInfoEv
-__ZN7WebCore36JSXMLHttpRequestExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor9classInfoEv
-__ZN7WebCore29JSHTMLStyleElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLStyleElementConstructor9classInfoEv
-__ZN7WebCore34JSProcessingInstructionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore34JSProcessingInstructionConstructor9classInfoEv
+__ZN7WebCore25jsDOMWindowSessionStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow14sessionStorageEv
+__ZN7WebCore14SessionStorage6createEPNS_4PageE
+__ZN7WebCore14SessionStorageC1EPNS_4PageE
+__ZN7WebCore14SessionStorageC2EPNS_4PageE
+__ZN7WebCore14SessionStorage11storageAreaEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_18SessionStorageAreaEEENS2_18SecurityOriginHashENS_10HashTrai
+__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore18SessionStorageAreaC2EPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginE
+__ZN7WebCore10StorageMap6createEv
+__ZN7WebCore10StorageMapC1Ev
+__ZN7WebCore10StorageMapC2Ev
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_18SessionStorageAreaEEENS2_18SecurityOriginHashENS_10HashTrait
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_18SessionStorageAreaEEEENS_18PairFirstExtractorIS
+__ZN7WebCore19InspectorController16didUseDOMStorageEPNS_11StorageAreaEbPNS_5FrameE
+__ZN7WebCore7Storage6createEPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore7StorageC1EPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore7StorageC2EPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7StorageE
+__ZN7WebCore9JSStorage15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSStorageC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7StorageEEE
+__ZN7WebCore9JSStorageC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7StorageEEE
+__ZN7WebCore9JSStorage18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSStorage18canGetItemsForNameEPN3JSC9ExecStateEPNS_7StorageERKNS1_10IdentifierE
+__ZNK7WebCore7Storage8containsERKNS_6StringE
+__ZNK7WebCore11StorageArea8containsERKNS_6StringE
+__ZNK7WebCore11StorageArea16internalContainsERKNS_6StringE
+__ZNK7WebCore10StorageMap8containsERKNS_6StringE
+__ZN7WebCore18JSStoragePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore9JSStorage9classInfoEv
 __ZNK7WebCore29JSDOMCoreExceptionConstructor9classInfoEv
-__ZN7WebCore32JSHTMLFrameSetElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLFrameSetElementConstructor9classInfoEv
-__ZN7WebCore27JSRangeExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsDOMWindowClientInformationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSRangeException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSRangeExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSRangeExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSRangeException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSRangeExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore27JSRangeExceptionConstructor9classInfoEv
-__ZN7WebCore30JSDOMImplementationConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSDOMImplementationConstructor9classInfoEv
-__ZN7WebCore23JSWheelEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSWheelEventConstructor9classInfoEv
-__ZN7WebCore26JSCharacterDataConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSCharacterDataConstructor9classInfoEv
-__ZN7WebCore30JSHTMLLegendElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLLegendElementConstructor9classInfoEv
-__ZNK7WebCore24JSXPathResultConstructor9classInfoEv
-__ZN7WebCore17JSRectConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSRectConstructor9classInfoEv
-__ZN7WebCore27JSHTMLPreElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLPreElementConstructor9classInfoEv
-__ZN7WebCore25JSMessageEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsDOMWindowLocalStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12localStorageEv
+__ZN7WebCore12LocalStorage11storageAreaEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_16LocalStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraits
+__ZN7WebCore16LocalStorageAreaC1EPNS_14SecurityOriginEPNS_12LocalStorageE
+__ZN7WebCore16LocalStorageAreaC2EPNS_14SecurityOriginEPNS_12LocalStorageE
+__ZN7WebCore12LocalStorage14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_16LocalStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraitsI
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_16LocalStorageAreaEEEENS_18PairFirstExtractorIS8_
+__ZNK7WebCore16LocalStorageArea8containsERKNS_6StringE
+__ZN7WebCore29jsDOMWindowStorageConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSStorage14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSStorageConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSStoragePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSStorageConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSStorageConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSMessageEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSMessageEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSMessageEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSMessageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSMessageEventConstructor9classInfoEv
-__ZN7WebCore20JSCounterConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSCounterConstructor9classInfoEv
-__ZN7WebCore25JSNamedNodeMapConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSNamedNodeMapConstructor9classInfoEv
-__ZN7WebCore32JSHTMLOptGroupElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLOptGroupElementConstructor9classInfoEv
-__ZN7WebCore31JSHTMLHeadingElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31JSHTMLHeadingElementConstructor9classInfoEv
-__ZN7WebCore24JSCSSRuleListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore24JSCSSRuleListConstructor9classInfoEv
-__ZNK7WebCore25JSHTMLDocumentConstructor9classInfoEv
-__ZN7WebCore33JSHTMLParagraphElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore33JSHTMLParagraphElementConstructor9classInfoEv
-__ZN7WebCore32JSHTMLFieldSetElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLFieldSetElementConstructor9classInfoEv
-__ZN7WebCore23JSStyleSheetConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSStyleSheetConstructor9classInfoEv
-__ZN7WebCore30JSHTMLButtonElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLButtonElementConstructor9classInfoEv
-__ZN7WebCore27JSHTMLMapElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLMapElementConstructor9classInfoEv
-__ZN7WebCore26JSOverflowEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSOverflowEventConstructor9classInfoEv
-__ZN7WebCore27JSXPathExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSXPathExceptionConstructor9classInfoEv
-__ZN7WebCore31JSSVGGradientElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsDOMWindowStorageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSStorageEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSStorageEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSStorageEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSStorageEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSStorageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSStorageEventConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowOnwebkitanimationstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow22onwebkitanimationstartEv
+__ZN7WebCore19jsDOMWindowOnsearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onsearchEv
+__ZN7WebCore21jsDOMWindowOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10ondblclickEv
+__ZNK7WebCore26JSXSLTProcessorConstructor9classInfoEv
+__ZNK7WebCore19JSWorkerConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmousemoveEv
+__ZN7WebCore43jsDOMWindowWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSWebKitTransitionEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSWebKitTransitionEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore32JSWebKitTransitionEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWebKitTransitionEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSWebKitTransitionEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitTransitionEventConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowOuterHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11outerHeightEv
+__ZN7WebCore45jsDOMWindowCSSVariablesDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSCSSVariablesDeclaration14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSCSSVariablesDeclarationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSVariablesDeclaration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSCSSVariablesDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSCSSVariablesDeclarationConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowTextMetricsConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSTextMetrics14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSTextMetricsConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSTextMetricsPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSTextMetricsConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSTextMetricsConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowPersonalbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11personalbarEv
+__ZN7WebCore36jsDOMWindowClientRectListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSClientRectList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSClientRectListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSClientRectListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSClientRectList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSClientRectListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSClientRectListConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowSVGGradientElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGGradientElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGGradientElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGGradientElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGGradientElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore31JSSVGGradientElementConstructor9classInfoEv
-__ZN7WebCore26JSProgressEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsDOMWindowProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSProgressEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSProgressEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSProgressEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore26JSProgressEventConstructor9classInfoEv
+__ZN7WebCore19jsDOMWindowOnselectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onselectEv
+__ZN7WebCore32jsDOMWindowMediaErrorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSMediaError14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSMediaErrorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSMediaErrorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSMediaError15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSMediaErrorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSMediaErrorConstructor9classInfoEv
-__ZN7WebCore17JSAttrConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSAttrConstructor9classInfoEv
-__ZN7WebCore28JSEntityReferenceConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSEntityReferenceConstructor9classInfoEv
-__ZN7WebCore36JSHTMLTableCaptionElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore36JSHTMLTableCaptionElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLObjectElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLObjectElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLFrameElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLFrameElementConstructor9classInfoEv
-__ZNK7WebCore20JSCSSRuleConstructor9classInfoEv
-__ZNK7WebCore32JSCSSStyleDeclarationConstructor9classInfoEv
-__ZNK7WebCore26JSMutationEventConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLInputElementConstructor9classInfoEv
-__ZN7WebCore33JSHTMLDirectoryElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore33JSHTMLDirectoryElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLScriptElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLScriptElementConstructor9classInfoEv
-__ZN7WebCore34JSSVGTextContentElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsDOMWindowDevicePixelRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow16devicePixelRatioEv
+__ZN7WebCore21jsDOMWindowScreenLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7screenXEv
+__ZN7WebCore18jsDOMWindowOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onkeyupEv
+__ZNK7WebCore19JSOptionConstructor9classInfoEv
+__ZN7WebCore23jsDOMWindowOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12onmousewheelEv
+__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore35JSWebKitCSSKeyframesRuleConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowOnwebkittransitionendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow21onwebkittransitionendEv
+__ZN7WebCore18jsDOMWindowScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7screenYEv
+__ZN7WebCore21jsDOMWindowOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10onkeypressEv
+__ZN7WebCore18jsDOMWindowToolbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7toolbarEv
+__ZN7WebCore43jsDOMWindowSVGTextContentElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGTextContentElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSSVGTextContentElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore34JSSVGTextContentElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLAreaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLAreaElementConstructor9classInfoEv
-__ZNK7WebCore18JSEventConstructor9classInfoEv
-__ZN7WebCore29JSHTMLOListElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLOListElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLCanvasElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLCanvasElementConstructor9classInfoEv
-__ZN7WebCore28JSCSSFontFaceRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSCSSFontFaceRuleConstructor9classInfoEv
-__ZNK7WebCore21JSDocumentConstructor9classInfoEv
-__ZN7WebCore26JSHTMLBRElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLBRElementConstructor9classInfoEv
-__ZN7WebCore25JSCSSStyleRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSCSSStyleRuleConstructor9classInfoEv
-__ZN7WebCore28JSHTMLFontElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLFontElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLTitleElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLTitleElementConstructor9classInfoEv
-__ZN7WebCore36JSHTMLTableSectionElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore36JSHTMLTableSectionElementConstructor9classInfoEv
-__ZN7WebCore25JSDocumentTypeConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSDocumentTypeConstructor9classInfoEv
-__ZN7WebCore20JSUIEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSUIEventConstructor9classInfoEv
-__ZN7WebCore27JSEventExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsDOMWindowScreenTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsDOMWindowOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onclickEv
+__ZN7WebCore26jsDOMWindowFileConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSFile14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSFileConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore15JSFilePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSFile15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSFileConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSFileConstructor9classInfoEv
+__ZNK7WebCore18JSAudioConstructor9classInfoEv
+__ZN7WebCore17jsDOMWindowCryptoEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6cryptoEPN3JSC9ExecStateE
+__ZN7WebCore36jsDOMWindowEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSEventException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSEventExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSEventExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSEventExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore27JSEventExceptionConstructor9classInfoEv
-__ZN7WebCore27JSStyleSheetListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSStyleSheetListConstructor9classInfoEv
-__ZNK7WebCore18JSRangeConstructor9classInfoEv
-__ZN7WebCore25JSCSSMediaRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSCSSMediaRuleConstructor9classInfoEv
-__ZN7WebCore29JSHTMLEmbedElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLEmbedElementConstructor9classInfoEv
-__ZN7WebCore29JSSVGMarkerElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsDOMWindowDefaultStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow13defaultStatusEv
+__ZNK7WebCore5Frame22jsDefaultStatusBarTextEv
+__ZN7WebCore31jsDOMWindowOnwebkitanimationendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow20onwebkitanimationendEv
+__ZN7WebCore18jsDOMWindowScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsDOMWindowOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmouseoverEv
+__ZN7WebCore38jsDOMWindowSVGMarkerElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSSVGMarkerElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSSVGMarkerElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGMarkerElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGMarkerElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSSVGMarkerElementConstructor9classInfoEv
-__ZN7WebCore26JSHTMLHRElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLHRElementConstructor9classInfoEv
-__ZN7WebCore26JSCSSImportRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSCSSImportRuleConstructor9classInfoEv
-__ZN7WebCore21JSSVGColorConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsDOMWindowOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9onmouseupEv
+__ZN7WebCore24jsDOMWindowDefaultstatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsDOMWindowWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSWebKitAnimationEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSWebKitAnimationEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore31JSWebKitAnimationEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSWebKitAnimationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSWebKitAnimationEventConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowSVGColorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGColor14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGColorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGColorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGColorConstructor9classInfoEv
-__ZN7WebCore29JSHTMLParamElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLParamElementConstructor9classInfoEv
-__ZNK7WebCore29JSDocumentFragmentConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLTextAreaElementConstructor9classInfoEv
-__ZN7WebCore24JSCSSPageRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore24JSCSSPageRuleConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowOffscreenBufferingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow18offscreenBufferingEv
+__ZN7WebCore27jsDOMWindowApplicationCacheEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow16applicationCacheEv
+__ZN7WebCore19DOMApplicationCacheC1EPNS_5FrameE
+__ZN7WebCore19DOMApplicationCacheC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19DOMApplicationCacheE
+__ZN7WebCore21JSDOMApplicationCache15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSDOMApplicationCacheC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19DOMApplicationCacheEEE
+__ZN7WebCore21JSDOMApplicationCacheC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19DOMApplicationCacheEEE
+__ZN7WebCore21JSDOMApplicationCache18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSDOMApplicationCachePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSDOMApplicationCache9classInfoEv
+__ZN7WebCore32jsDOMWindowClientRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSClientRect14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSClientRectConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSClientRectPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSClientRectConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSClientRectConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowLocationbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11locationbarEv
+__ZN7WebCore31jsDOMWindowSVGLengthConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSSVGLength14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSSVGLengthPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGLength15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSSVGLengthConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore22JSSVGLengthConstructor9classInfoEv
 __ZNK7WebCore27JSXPathEvaluatorConstructor9classInfoEv
-__ZN7WebCore26JSKeyboardEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSKeyboardEventConstructor9classInfoEv
-__ZN7WebCore22JSMediaListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore22JSMediaListConstructor9classInfoEv
-__ZNK7WebCore20JSCommentConstructor9classInfoEv
-__ZN7WebCore21JSNotationConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSNotationConstructor9classInfoEv
-__ZN7WebCore29JSHTMLDListElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLDListElementConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLHtmlElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLLabelElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLLabelElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLLinkElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLLinkElementConstructor9classInfoEv
-__ZN7WebCore31JSHTMLMarqueeElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31JSHTMLMarqueeElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLMetaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLMetaElementConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLSelectElementConstructor9classInfoEv
-__ZN7WebCore32JSHTMLTableColElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLTableColElementConstructor9classInfoEv
-__ZNK7WebCore23JSNodeFilterConstructor9classInfoEv
+__ZN7WebCore19jsDOMWindowOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onchangeEv
+__ZN7WebCore18jsDOMWindowOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onabortEv
+__ZN7WebCore22jsDOMWindowOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmousedownEv
+__ZN7WebCore21jsDOMWindowOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10onmouseoutEv
+__ZN7WebCore45jsDOMWindowWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSWebKitCSSTransformValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore36JSWebKitCSSTransformValueConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore34JSWebKitCSSTransformValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSWebKitCSSTransformValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSWebKitCSSTransformValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSWebKitCSSTransformValueConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowCSSVariablesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSCSSVariablesRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSCSSVariablesRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSCSSVariablesRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSCSSVariablesRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSCSSVariablesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSCSSVariablesRuleConstructor9classInfoEv
+__ZNK7WebCore18JSImageConstructor9classInfoEv
+__ZN7WebCore34JSWebKitCSSKeyframeRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitCSSKeyframeRuleConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowFileListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSFileList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSFileListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSFileListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSFileList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSFileListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSFileListConstructor9classInfoEv
 __ZNK7WebCore26JSXMLSerializerConstructor9classInfoEv
+__ZNK7WebCore27JSXMLHttpRequestConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSXMLHttpRequestException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSXMLHttpRequestException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLMediaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLMediaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLMediaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSHTMLMediaElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLVideoElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLVideoElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLVideoElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLVideoElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSHTMLVideoElementConstructor9classInfoEv
-__ZN7WebCore25JSSVGExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore36jsDOMWindowXPathExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSXPathExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSXPathExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXPathExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSXPathExceptionConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSSVGExceptionConstructor9classInfoEv
-__ZN7WebCore23JSSVGPathSegConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMWindowSVGPathSegConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSSVGPathSeg14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGPathSegConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGPathSegPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSSVGPathSeg15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGPathSegConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGPathSegConstructor9classInfoEv
-__ZN7WebCore31JSSVGRenderingIntentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsDOMWindowSVGRenderingIntentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGRenderingIntent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGRenderingIntentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGRenderingIntentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGRenderingIntent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGRenderingIntentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore31JSSVGRenderingIntentConstructor9classInfoEv
-__ZN7WebCore31JSSVGTextPathElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsDOMWindowSVGTextPathElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGTextPathElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGTextPathElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGTextPathElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGTextPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGTextPathElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore31JSSVGTextPathElementConstructor9classInfoEv
-__ZN7WebCore25JSSVGTransformConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsDOMWindowSVGTransformConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGTransform14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGTransformConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGTransformPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGTransform15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGTransformConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSSVGTransformConstructor9classInfoEv
-__ZN7WebCore25JSSVGUnitTypesConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsDOMWindowSVGUnitTypesConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGUnitTypes14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGUnitTypesConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGUnitTypesPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGUnitTypes15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGUnitTypesConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSSVGUnitTypesConstructor9classInfoEv
-__ZN7WebCore8Document7pluginsEv
+__ZNK7WebCore23JSHTMLDocumentPrototype9classInfoEv
+__ZNK7WebCore19JSDocumentPrototype9classInfoEv
+__ZN7WebCore27jsHTMLDocumentActiveElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument13activeElementEv
+__ZN7WebCore32jsDocumentPreferredStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8Document22preferredStylesheetSetEv
-__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionSetFloatValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore21JSDOMApplicationCache4markEv
+__ZN7WebCore19DOMApplicationCache15disconnectFrameEv
+__ZN7WebCore24JSTextMetricsConstructorD1Ev
+__ZN7WebCore34JSCSSVariablesDeclarationPrototypeD1Ev
+__ZN7WebCore36JSCSSVariablesDeclarationConstructorD1Ev
+__ZN7WebCore32JSWebKitTransitionEventPrototypeD1Ev
+__ZN7WebCore34JSWebKitTransitionEventConstructorD1Ev
+__ZN7WebCore23JSStorageEventPrototypeD1Ev
+__ZN7WebCore25JSStorageEventConstructorD1Ev
+__ZN7WebCore25JSMessageEventConstructorD1Ev
+__ZN7WebCore20JSStorageConstructorD1Ev
+__ZN7WebCore9JSStorageD1Ev
+__ZN7WebCore9JSStorageD2Ev
+__ZN7WebCore25JSRangeExceptionPrototypeD1Ev
+__ZN7WebCore27JSRangeExceptionConstructorD1Ev
+__ZN7WebCore18JSStoragePrototypeD1Ev
+__ZN7WebCore31JSXMLHttpRequestUploadPrototypeD1Ev
+__ZN7WebCore33JSXMLHttpRequestUploadConstructorD1Ev
+__ZN7WebCore22JSWebKitPointPrototypeD1Ev
+__ZN7WebCore24JSWebKitPointConstructorD1Ev
+__ZN7WebCore24JSDOMStringListPrototypeD1Ev
+__ZN7WebCore26JSDOMStringListConstructorD1Ev
+__ZN7WebCore19JSSVGPaintPrototypeD1Ev
+__ZN7WebCore19JSSVGColorPrototypeD1Ev
+__ZN7WebCore21JSSVGPaintConstructorD1Ev
+__ZN7WebCore19JSSVGAnglePrototypeD1Ev
+__ZN7WebCore21JSSVGAngleConstructorD1Ev
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototypeD1Ev
+__ZN7WebCore35JSSVGPreserveAspectRatioConstructorD1Ev
+__ZN7WebCore29JSHTMLAudioElementConstructorD1Ev
+__ZN7WebCore20JSSVGLengthPrototypeD1Ev
+__ZN7WebCore22JSSVGLengthConstructorD1Ev
+__ZN7WebCore23JSClientRectConstructorD1Ev
+__ZN7WebCore21JSDOMApplicationCacheD1Ev
+__ZN7WebCore21JSDOMApplicationCacheD2Ev
+__ZN7WebCore19DOMApplicationCacheD0Ev
+__ZN7WebCore30JSDOMApplicationCachePrototypeD1Ev
+__ZN7WebCore21JSSVGColorConstructorD1Ev
+__ZN7WebCore33JSWebKitAnimationEventConstructorD1Ev
+__ZN7WebCore27JSSVGMarkerElementPrototypeD1Ev
+__ZN7WebCore29JSSVGMarkerElementConstructorD1Ev
+__ZN7WebCore23JSSVGUnitTypesPrototypeD1Ev
+__ZN7WebCore25JSSVGUnitTypesConstructorD1Ev
+__ZN7WebCore23JSSVGTransformPrototypeD1Ev
+__ZN7WebCore27JSEventExceptionConstructorD1Ev
+__ZN7WebCore25JSSVGTransformConstructorD1Ev
+__ZN7WebCore29JSSVGTextPathElementPrototypeD1Ev
+__ZN7WebCore31JSSVGTextPathElementConstructorD1Ev
+__ZN7WebCore29JSSVGRenderingIntentPrototypeD1Ev
+__ZN7WebCore31JSSVGRenderingIntentConstructorD1Ev
+__ZN7WebCore21JSSVGPathSegPrototypeD1Ev
+__ZN7WebCore23JSSVGPathSegConstructorD1Ev
+__ZN7WebCore23JSSVGExceptionPrototypeD1Ev
+__ZN7WebCore25JSSVGExceptionConstructorD1Ev
+__ZN7WebCore27JSXPathExceptionConstructorD1Ev
+__ZN7WebCore29JSHTMLVideoElementConstructorD1Ev
+__ZN7WebCore29JSHTMLMediaElementConstructorD1Ev
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototypeD1Ev
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructorD1Ev
+__ZN7WebCore19JSFileListPrototypeD1Ev
+__ZN7WebCore21JSFileListConstructorD1Ev
+__ZN7WebCore15JSFilePrototypeD1Ev
+__ZN7WebCore17JSFileConstructorD1Ev
+__ZN7WebCore27JSCSSVariablesRulePrototypeD1Ev
+__ZN7WebCore29JSCSSVariablesRuleConstructorD1Ev
+__ZN7WebCore34JSWebKitCSSTransformValuePrototypeD1Ev
+__ZN7WebCore36JSWebKitCSSTransformValueConstructorD1Ev
+__ZN7WebCore34JSSVGTextContentElementConstructorD1Ev
+__ZN7WebCore21JSMediaErrorPrototypeD1Ev
+__ZN7WebCore23JSMediaErrorConstructorD1Ev
+__ZN7WebCore26JSProgressEventConstructorD1Ev
+__ZN7WebCore29JSSVGGradientElementPrototypeD1Ev
+__ZN7WebCore31JSSVGGradientElementConstructorD1Ev
+__ZN7WebCore25JSClientRectListPrototypeD1Ev
+__ZN7WebCore27JSClientRectListConstructorD1Ev
+__ZN7WebCore31jsHTMLFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore5Image9nullImageEv
+__ZN7WebCore41jsXPathEvaluatorPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore33jsLocationPrototypeFunctionReloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation6reloadEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore11FrameLoader15scheduleRefreshEb
+__ZN7WebCore40jsElementPrototypeFunctionGetClientRectsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element14getClientRectsEv
+__ZN7WebCore14ClientRectListC1ERKN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore14ClientRectListC2ERKN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14ClientRectListE
+__ZN7WebCore16JSClientRectListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14ClientRectListEEE
+__ZN7WebCore16JSClientRectListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14ClientRectListEEE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8scrollByEii
+__ZN7WebCore16JSClientRectList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZNK7WebCore14ClientRectList6lengthEv
+__ZN7WebCore16JSClientRectList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore14ClientRectList4itemEj
+__ZN7WebCore7DataRefINS_17StyleMultiColDataEE6accessEv
+__ZN7WebCore17StyleMultiColDataC1ERKS0_
+__ZN7WebCore17StyleMultiColDataC2ERKS0_
+__ZNK7WebCore11RenderBlock9columnGapEv
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS1_10ColumnInfoEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairH
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore10RenderView18setBestTruncatedAtEiPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore11RenderBlock11columnRectsEv
+__ZN7WebCore17jsClientRectWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsClientRectHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
+__ZN7WebCore16JSClientRectListD1Ev
+__ZN7WebCore16JSClientRectListD2Ev
+__ZN7WebCore14ClientRectListD1Ev
+__ZN7WebCore14ClientRectListD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10ClientRectEEELm0EE6shrinkEm
+__ZN7WebCore16JSClientRectList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsClientRectListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore11JSDOMWindow12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore16JSDOMWindowShell12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore16JSDOMWindowShell12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore11JSDOMWindow12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore29setJSDOMWindowNodeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13StringBuilder6appendEc
+__ZNK7WebCore21JSHTMLTableColElement9classInfoEv
+__ZN7WebCore33jsLocationPrototypeFunctionAssignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation6assignEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33jsHistoryPrototypeFunctionForwardEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7History7forwardEv
+__ZN7WebCore14SessionStorage4copyEPNS_4PageE
+__ZN7WebCore18SessionStorageArea4copyEPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageEPS0_
+__ZN7WebCore18SessionStorageAreaC2EPNS_14SecurityOriginEPNS_4PageEPS0_
+__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginEPS0_
+__ZN7WebCore4Page17setSessionStorageEN3WTF10PassRefPtrINS_14SessionStorageEEE
+__ZN7WebCore21setJSLocationProtocolEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setProtocolEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore17setJSLocationHostEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHostEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore4KURL14setHostAndPortERKNS_6StringE
+__ZN7WebCore21setJSLocationHostnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setHostnameEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore17setJSLocationPortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setPortEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore21setJSLocationPathnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setPathnameEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore19setJSLocationSearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation9setSearchEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore18SessionStorageAreaD0Ev
+__ZN7WebCore11StorageAreaD2Ev
+__ZNK7WebCore20JSNavigatorPrototype9classInfoEv
+__ZN7WebCore17jsNavigatorOnLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase6onLineEv
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateTreeWalkerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document16createTreeWalkerEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
+__ZN7WebCore10TreeWalkerC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore10TreeWalkerC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TreeWalkerE
+__ZN7WebCore12JSTreeWalker15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSTreeWalkerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TreeWalkerEEE
+__ZN7WebCore12JSTreeWalkerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TreeWalkerEEE
+__ZN7WebCore12JSTreeWalker4markEv
+__ZN7WebCore12JSTreeWalkerD1Ev
+__ZN7WebCore12JSTreeWalkerD2Ev
+__ZN7WebCore21JSTreeWalkerPrototypeD1Ev
+__ZN7WebCore39jsElementPrototypeFunctionScrollByLinesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element13scrollByLinesEi
+__ZN7WebCore7Element13scrollByUnitsEiNS_17ScrollGranularityE
+__ZN7WebCore39jsElementPrototypeFunctionScrollByPagesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element13scrollByPagesEi
+__ZN7WebCore43jsHTMLOptionsCollectionPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23JSHTMLOptionsCollection3addEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEERi
+__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEEiRi
+__ZN7WebCore46jsHTMLOptionsCollectionPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23JSHTMLOptionsCollection6removeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13KeyboardEventC1Ev
+__ZN7WebCore13KeyboardEventC2Ev
+__ZN7WebCore24JSKeyboardEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsKeyboardEventPrototypeFunctionInitKeyboardEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSKeyboardEvent9classInfoEv
+__ZN7WebCore11toDOMWindowEN3JSC7JSValueE
+__ZN7WebCore13KeyboardEvent17initKeyboardEventERKNS_12AtomicStringEbbPNS_9DOMWindowERKNS_6StringEjbbbbb
+__ZN7WebCore7UIEvent11initUIEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore43jsMouseEventPrototypeFunctionInitMouseEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13toEventTargetEN3JSC7JSValueE
+__ZN7WebCore10MouseEvent14initMouseEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTarge
+__ZN7WebCore17MouseRelatedEvent15initCoordinatesEii
+__ZN7WebCore12NodeIterator17nodeWillBeRemovedEPNS_4NodeE
+__ZNK7WebCore12NodeIterator20updateForNodeRemovalEPNS_4NodeERNS0_11NodePointerE
+__ZN7WebCore13ProgressEventC1Ev
+__ZN7WebCore13ProgressEventC2Ev
+__ZN7WebCore15JSProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSProgressEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsProgressEventPrototypeFunctionInitProgressEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSProgressEvent9classInfoEv
+__ZN7WebCore13ProgressEvent17initProgressEventERKNS_12AtomicStringEbbbjj
+__ZN7WebCore36jsRangePrototypeFunctionComparePointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore38jsRangePrototypeFunctionIsPointInRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range14isPointInRangeEPNS_4NodeEiRi
+__ZN7WebCore37jsUIEventPrototypeFunctionInitUIEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow6moveByEff
+__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8resizeByEff
+__ZN7WebCore30setJSHTMLOptionElementSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36jsHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLOptionsCollection13selectedIndexEv
+__ZN7WebCore25setJSHTMLElementOuterTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setOuterTextERKNS_6StringERi
+__ZNK7WebCore28JSHTMLObjectElementPrototype9classInfoEv
+__ZN7WebCore18JSHTMLEmbedElement11getCallDataERN3JSC8CallDataE
+__ZN7WebCore24runtimeObjectGetCallDataEPNS_11HTMLElementERN3JSC8CallDataE
+__ZNK7WebCore27JSHTMLEmbedElementPrototype9classInfoEv
+__ZN7WebCore24jsHTMLEmbedElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLEmbedElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement11getCallDataERN3JSC8CallDataE
+__ZN7WebCore19JSHTMLObjectElement11getCallDataERN3JSC8CallDataE
+__ZNK7WebCore28JSHTMLAppletElementPrototype9classInfoEv
+__ZNK7WebCore25JSHTMLDivElementPrototype9classInfoEv
+__ZNK7WebCore24JSKeyboardEventPrototype9classInfoEv
+__ZN7WebCore6JSRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4RectEEE
+__ZN7WebCore6JSRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4RectEEE
+__ZN7WebCore6JSRectD1Ev
+__ZN7WebCore6JSRectD2Ev
+__ZN7WebCore18setJSDOMWindowSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLSelectElementLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3getERKS3_
+__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionSetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore17CSSPrimitiveValue13setFloatValueEtdRi
-__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionSetStringValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionSetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore17CSSPrimitiveValue14setStringValueEtRKNS_6StringERi
+__ZN7WebCore26setJSHTMLTableElementTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25toHTMLTableSectionElementEN3JSC7JSValueE
+__ZN7WebCore20setJSHTMLDocumentAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14JSHTMLDocument6setAllEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3JSC38StringObjectThatMasqueradesAsUndefined9toBooleanEPNS_9ExecStateE
+__ZN3JSC38StringObjectThatMasqueradesAsUndefinedD1Ev
 __ZNK7WebCore15JSAttrPrototype9classInfoEv
+__ZN7WebCore17jsAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore18JSCommentPrototype9classInfoEv
 __ZNK7WebCore27JSDocumentFragmentPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSDocumentFragmentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSDocumentFragment16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore29jsDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSDOMImplementationPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSDOMImplementationEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSDOMImplementation16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore30jsDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSNodeIterator9classInfoEv
 __ZNK7WebCore23JSNodeIteratorPrototype9classInfoEv
+__ZN7WebCore25jsNodeIteratorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNodeIterator14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSNodeIteratorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSNodeIteratorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore25JSNodeIteratorConstructor9classInfoEv
 __ZNK7WebCore16JSRangePrototype9classInfoEv
+__ZN7WebCore18jsRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSTextPrototype9classInfoEv
+__ZNK7WebCore12JSTreeWalker9classInfoEv
+__ZN7WebCore12JSTreeWalker18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSTreeWalkerPrototype9classInfoEv
+__ZN7WebCore23jsTreeWalkerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSTreeWalker14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSTreeWalkerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore23JSTreeWalkerConstructor9classInfoEv
+__ZN7WebCore21jsDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore23JSCDATASectionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore14JSCDATASectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCDATASection16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore25jsCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSEntityReferencePrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSEntityReferenceEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSEntityReference16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore28jsEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore32JSProcessingInstructionPrototype9classInfoEv
+__ZN7WebCore34jsProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore24JSMutationEventPrototype9classInfoEv
+__ZN7WebCore26jsMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore13OverflowEventC1Ev
+__ZN7WebCore13OverflowEventC2Ev
 __ZNK7WebCore13OverflowEvent15isOverflowEventEv
-__ZN7WebCore15JSOverflowEventC1EPN3KJS8JSObjectEPNS_13OverflowEventE
+__ZN7WebCore15getDOMStructureINS_15JSOverflowEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSOverflowEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13OverflowEventEEE
+__ZN7WebCore15JSOverflowEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13OverflowEventEEE
 __ZNK7WebCore15JSOverflowEvent9classInfoEv
-__ZN7WebCore15JSOverflowEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSOverflowEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore24JSOverflowEventPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore15JSOverflowEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSOverflowEvent16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore26jsOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore9TextEventC1Ev
-__ZN7WebCore11JSTextEventC1EPN3KJS8JSObjectEPNS_9TextEventE
+__ZN7WebCore9TextEventC2Ev
+__ZN7WebCore15getDOMStructureINS_11JSTextEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore11JSTextEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9TextEventEEE
+__ZN7WebCore11JSTextEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9TextEventEEE
 __ZNK7WebCore11JSTextEvent9classInfoEv
-__ZN7WebCore11JSTextEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSTextEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore20JSTextEventPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore11JSTextEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSTextEvent16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore22jsTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore10WheelEventC1Ev
+__ZN7WebCore10WheelEventC2Ev
+__ZNK7WebCore12JSWheelEvent9classInfoEv
 __ZNK7WebCore21JSWheelEventPrototype9classInfoEv
-__ZNK7WebCore25JSStyleSheetListPrototype9classInfoEv
+__ZN7WebCore23jsWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore24JSCSSStyleSheetPrototype9classInfoEv
-__ZNK7WebCore22JSCSSRuleListPrototype9classInfoEv
-__ZNK7WebCore18JSCSSRulePrototype9classInfoEv
-__ZNK7WebCore30JSCSSStyleDeclarationPrototype9classInfoEv
+__ZN7WebCore26jsCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSCSSStyleRule9classInfoEv
+__ZNK7WebCore23JSCSSStyleRulePrototype9classInfoEv
+__ZN7WebCore25jsCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSCSSPrimitiveValuePrototype9classInfoEv
+__ZN7WebCore30jsCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore10JSRGBColor9classInfoEv
-__ZN7WebCore10JSRGBColor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore6JSRect9classInfoEv
-__ZN7WebCore6JSRect18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore6JSRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore15JSRectPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore6JSRectEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSRect16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore23JSCSSValueListPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore14JSCSSValueListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCSSValueList16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore35jsCSSValueListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSCounterC1EPN3KJS8JSObjectEPNS_7CounterE
+__ZN7WebCore17jsRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CounterEEE
+__ZN7WebCore9JSCounterC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CounterEEE
 __ZNK7WebCore9JSCounter9classInfoEv
-__ZN7WebCore9JSCounter18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSCounter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore18JSCounterPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSCounterEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSCounter16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore11JSMediaList9classInfoEv
-__ZNK7WebCore20JSMediaListPrototype9classInfoEv
+__ZN7WebCore20jsCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsStyleSheetMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSXPathExpressionPrototype9classInfoEv
+__ZN7WebCore28jsXPathExpressionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSXPathExpression14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSXPathExpressionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSXPathExpressionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore28JSXPathExpressionConstructor9classInfoEv
 __ZNK7WebCore22JSXPathResultPrototype9classInfoEv
-__ZNK7WebCore25JSHTMLCollectionPrototype9classInfoEv
+__ZN7WebCore24jsXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSHTMLAnchorElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLAreaElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17JSHTMLBaseElement9classInfoEv
 __ZNK7WebCore26JSHTMLBaseElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore21JSHTMLBaseFontElement9classInfoEv
 __ZNK7WebCore30JSHTMLBaseFontElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore32JSHTMLBlockquoteElementPrototype9classInfoEv
+__ZN7WebCore34jsHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLBodyElementPrototype9classInfoEv
 __ZNK7WebCore24JSHTMLBRElementPrototype9classInfoEv
+__ZN7WebCore26jsHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLButtonElementPrototype9classInfoEv
 __ZNK7WebCore28JSHTMLCanvasElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25JSHTMLTableCaptionElement9classInfoEv
 __ZNK7WebCore34JSHTMLTableCaptionElementPrototype9classInfoEv
+__ZN7WebCore36jsHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLTableColElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore25JSHTMLModElementPrototype9classInfoEv
 __ZNK7WebCore22JSHTMLDirectoryElement9classInfoEv
 __ZNK7WebCore31JSHTMLDirectoryElementPrototype9classInfoEv
+__ZN7WebCore33jsHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLDListElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLFieldSetElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounterD1Ev
+__ZN7WebCore9JSCounterD2Ev
+__ZN7WebCore12JSWheelEventD1Ev
+__ZN7WebCore11JSTextEventD1Ev
+__ZN7WebCore15JSOverflowEventD1Ev
+__ZN7WebCore13OverflowEventD0Ev
 __ZNK7WebCore26JSHTMLFontElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore18JSHTMLFrameElement9classInfoEv
 __ZNK7WebCore27JSHTMLFrameElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLFrameSetElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLHeadElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29JSHTMLHeadingElementPrototype9classInfoEv
 __ZNK7WebCore24JSHTMLHRElementPrototype9classInfoEv
+__ZN7WebCore26jsHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLHtmlElementPrototype9classInfoEv
 __ZNK7WebCore28JSHTMLIFrameElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLImageElementPrototype9classInfoEv
 __ZNK7WebCore27JSHTMLInputElementPrototype9classInfoEv
 __ZNK7WebCore20JSHTMLIsIndexElement9classInfoEv
 __ZNK7WebCore29JSHTMLIsIndexElementPrototype9classInfoEv
-__ZN7WebCore17keygenConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLKeygenElementC1EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLSelectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17supportedKeySizesEv
-__ZNK7WebCore28JSHTMLSelectElementPrototype9classInfoEv
+__ZN7WebCore31jsHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL17keygenConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLKeygenElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLKeygenElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore20getSupportedKeySizesERN3WTF6VectorINS_6StringELm0EEE
 __ZNK7WebCore27JSHTMLLabelElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLLegendElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore24JSHTMLLIElementPrototype9classInfoEv
 __ZNK7WebCore26JSHTMLLinkElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore25JSHTMLPreElementPrototype9classInfoEv
+__ZN7WebCore27jsHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore25JSHTMLMapElementPrototype9classInfoEv
+__ZN7WebCore27jsHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20JSHTMLMarqueeElement9classInfoEv
 __ZNK7WebCore29JSHTMLMarqueeElementPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore20JSHTMLMarqueeElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSHTMLMarqueeElement16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore31jsHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17JSHTMLMenuElement9classInfoEv
 __ZNK7WebCore26JSHTMLMenuElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLMetaElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLOListElementPrototype9classInfoEv
+__ZNK7WebCore21JSHTMLOptGroupElement9classInfoEv
 __ZNK7WebCore30JSHTMLOptGroupElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLOptionElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore31JSHTMLParagraphElementPrototype9classInfoEv
 __ZNK7WebCore27JSHTMLParamElementPrototype9classInfoEv
-__ZNK7WebCore18JSHTMLQuoteElement9classInfoEv
+__ZN7WebCore29jsHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLQuoteElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLScriptElementPrototype9classInfoEv
 __ZNK7WebCore27JSHTMLStyleElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLTableElementPrototype9classInfoEv
 __ZNK7WebCore34JSHTMLTableSectionElementPrototype9classInfoEv
+__ZN7WebCore36jsHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore31JSHTMLTableCellElementPrototype9classInfoEv
+__ZN7WebCore33jsHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLTextAreaElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLTitleElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLTableRowElementPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSCSSRulePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSCSSRulePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore19JSCSSValuePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSCSSValuePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSCSSValueConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSCSSValueConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore12JSNodeFilter18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSNodeFilterPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSNodeFilterPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore10MediaQuery7cssTextEv
-__ZNK7WebCore13CSSImportRule7cssTextEv
-__ZNK7WebCore12CSSMediaRule7cssTextEv
-__ZN7WebCore13OverflowEventD1Ev
-__ZN7WebCore17HTMLKeygenElementD1Ev
-__ZN7WebCore39jsElementPrototypeFunctionScrollByLinesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element13scrollByLinesEi
-__ZN7WebCore7Element13scrollByUnitsEiNS_17ScrollGranularityE
-__ZN7WebCore39jsElementPrototypeFunctionScrollByPagesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element13scrollByPagesEi
-__ZN7WebCore15HTMLBodyElement13setScrollLeftEi
-__ZN7WebCore49jsKeyboardEventPrototypeFunctionInitKeyboardEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13KeyboardEvent17initKeyboardEventERKNS_12AtomicStringEbbPNS_9DOMWindowERKNS_6StringEjbbbbb
-__ZN7WebCore20JSMediaListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32jsMediaListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9MediaList4itemEj
-__ZN7WebCore13ProgressEventC1Ev
-__ZN7WebCore24JSProgressEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore49jsProgressEventPrototypeFunctionInitProgressEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore15JSProgressEvent9classInfoEv
-__ZN7WebCore13ProgressEvent17initProgressEventERKNS_12AtomicStringEbbbjj
-__ZN7WebCore36jsRangePrototypeFunctionComparePointEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore38jsRangePrototypeFunctionIsPointInRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range14isPointInRangeEPNS_4NodeEiRi
-__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveByEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow6moveByEff
-__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeByEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8resizeByEff
-__ZN7WebCore16JSHTMLCollection16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore17JSHTMLFormElement16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore19JSHTMLSelectElement16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore16JSStyleSheetList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore13JSCSSRuleList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore21JSCSSStyleDeclaration16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore14JSCSSValueList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore19JSCSSValuePrototype9classInfoEv
-__ZN7WebCore14JSCSSValueList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore11JSMediaList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore11JSMediaList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN3KJS19windowProtoFuncAToBEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore12base64DecodeERKN3WTF6VectorIcLm0EEERS2_
-__ZN7WebCore12base64DecodeEPKcjRN3WTF6VectorIcLm0EEE
-__ZN3KJS19windowProtoFuncBToAEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore12base64EncodeERKN3WTF6VectorIcLm0EEERS2_b
-__ZN7WebCore35jsDOMWindowPrototypeFunctionConfirmEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore32jsHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLUListElementPrototype9classInfoEv
+__ZThn8_N7WebCore18HTMLMarqueeElementD0Ev
+__ZThn8_N7WebCore17HTMLKeygenElementD0Ev
+__ZN7WebCore17HTMLKeygenElementD0Ev
+__ZN7WebCore23JSTreeWalkerConstructorD1Ev
+__ZN7WebCore25JSNodeIteratorConstructorD1Ev
+__ZN7WebCore28JSXPathExpressionConstructorD1Ev
+__ZN7WebCore14XMLHttpRequest12networkErrorEv
+__ZN7WebCore14XMLHttpRequest18dispatchErrorEventEv
+__ZN7WebCore41jsEventExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSEventException9classInfoEv
+__ZNK7WebCore25JSEventExceptionPrototype9classInfoEv
+__ZN7WebCore27jsEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsRangePrototypeFunctionSetStartAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14RangeExceptionE
+__ZN7WebCore16JSRangeExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14RangeExceptionEEE
+__ZN7WebCore16JSRangeExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14RangeExceptionEEE
+__ZN7WebCore16JSRangeException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSRangeExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsRangeExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSRangeException9classInfoEv
+__ZNK7WebCore25JSRangeExceptionPrototype9classInfoEv
+__ZN7WebCore27jsRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsRangeExceptionINVALID_NODE_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsRangeExceptionBAD_BOUNDARYPOINTS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsXPathEvaluatorPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore41jsXPathExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSXPathException9classInfoEv
+__ZNK7WebCore25JSXPathExceptionPrototype9classInfoEv
+__ZN7WebCore27jsXPathExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsXPathExceptionTYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsXPathExceptionINVALID_EXPRESSION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSRangeExceptionD1Ev
+__ZN7WebCore16JSRangeExceptionD2Ev
+__ZNK7WebCore27JSDOMCoreExceptionPrototype9classInfoEv
+__ZN7WebCore29jsDOMCoreExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsDOMCoreExceptionHIERARCHY_REQUEST_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsDOMCoreExceptionINVALID_CHARACTER_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMCoreExceptionNAMESPACE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsElementPrototypeFunctionHasAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore45jsNamedNodeMapPrototypeFunctionGetNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12NamedNodeMap14getNamedItemNSERKNS_6StringES3_
+__ZN7WebCore43jsElementPrototypeFunctionRemoveAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element17removeAttributeNSERKNS_6StringES3_Ri
+__ZN7WebCore48jsNamedNodeMapPrototypeFunctionRemoveNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12NamedNodeMap17removeNamedItemNSERKNS_6StringES3_Ri
+__ZN7WebCore4Node9setPrefixERKNS_12AtomicStringERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5FrameE
+__ZNK7WebCore14RenderFrameSet10renderNameEv
+__ZNK7WebCore11RenderFrame10renderNameEv
+__ZN7WebCore39jsHTMLDocumentPrototypeFunctionHasFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument8hasFocusEv
+__ZN7WebCore33jsHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTextAreaElement12selectionEndEv
+__ZN7WebCore15HTMLFormElement26willMoveToNewOwnerDocumentEv
+__ZN7WebCore15HTMLFormElement25didMoveToNewOwnerDocumentEv
+__ZN7WebCore31jsHTMLImageElementNaturalHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement13naturalHeightEv
+__ZN7WebCore22JSNamedNodesCollection12lengthGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore23resetButtonDefaultLabelEv
+__ZN7WebCore41jsHTMLButtonElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL14isSVG10FeatureERKNS_6StringE
+__ZN7WebCore19jsNodeOncontextmenuEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node13oncontextmenuEv
+__ZNK7WebCore22JSNamedNodesCollection9classInfoEv
+__ZN7WebCore17HTMLSelectElement17saveLastSelectionEv
+__ZN7WebCore17HTMLSelectElement16menuListOnChangeEv
+__ZN7WebCore32setJSHTMLTableCellElementColSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setColSpanEi
+__ZN7WebCore33setJSDOMWindowNodeListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40jsRangePrototypeFunctionSurroundContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range16surroundContentsEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore13CharacterData19isCharacterDataNodeEv
+__ZN7WebCore20jsRangeExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionWRONG_DOCUMENT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsRangePrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range6detachERi
+__ZN7WebCore35jsDOMCoreExceptionINVALID_STATE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsRangeSTART_TO_STARTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsRangePrototypeFunctionCompareBoundaryPointsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19jsRangeSTART_TO_ENDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsRangeEND_TO_STARTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsRangeEND_TO_ENDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore5Range15textNodesMergedERNS_13NodeWithIndexEj
+__ZN7WebCore35jsRangePrototypeFunctionCompareNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore31jsDOMCoreExceptionNOT_FOUND_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Comment16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore16jsRangeCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsRangeCommonAncestorContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsRangePrototypeFunctionIntersectsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21ProcessingInstruction18offsetInCharactersEv
+__ZN7WebCore21ProcessingInstruction9cloneNodeEb
+__ZN7WebCore51jsDocumentFragmentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsDocumentFragmentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17decodeNamedEntityEPKc
+__ZN7WebCoreL17sharedXHTMLEntityEv
+__ZN7WebCore28jsDOMCoreExceptionSYNTAX_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL27createSVGDescElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGDescElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGDescElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDescElementEEE
+__ZN7WebCore16JSSVGDescElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDescElementEEE
+__ZN7WebCore16JSSVGDescElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL29createSVGCircleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGCircleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGCircleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCircleElementEEE
+__ZN7WebCore18JSSVGCircleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCircleElementEEE
+__ZN7WebCore18JSSVGCircleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsDOMCoreExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSSVGCircleElementD1Ev
+__ZN7WebCore16JSSVGDescElementD1Ev
+__ZN7WebCore27JSSVGCircleElementPrototypeD1Ev
+__ZN7WebCore25JSSVGDescElementPrototypeD1Ev
+__ZN7WebCore22jsHTMLLinkElementSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsStyleSheetOwnerNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsTreeWalkerCurrentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSTreeWalkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsTreeWalkerPrototypeFunctionParentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker10parentNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker10parentNodeEPN3JSC9ExecStateE
+__ZN7WebCore12JSTreeWalker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSTreeWalkerCurrentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10TreeWalker14setCurrentNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZN7WebCore37jsTreeWalkerPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker8nextNodeEPN3JSC9ExecStateE
+__ZNK7WebCore10NodeFilter10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZNK7WebCore21JSNodeFilterCondition10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore41jsTreeWalkerPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker12previousNodeEPN3JSC9ExecStateE
+__ZN7WebCore39jsTreeWalkerPrototypeFunctionFirstChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker10firstChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker10firstChildEPN3JSC9ExecStateE
+__ZN7WebCore38jsTreeWalkerPrototypeFunctionLastChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker9lastChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker9lastChildEPN3JSC9ExecStateE
+__ZN7WebCore40jsTreeWalkerPrototypeFunctionNextSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker11nextSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker11nextSiblingEPN3JSC9ExecStateE
+__ZN7WebCore44jsTreeWalkerPrototypeFunctionPreviousSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker15previousSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker15previousSiblingEPN3JSC9ExecStateE
+__ZN7WebCore35jsDOMWindowPrototypeFunctionConfirmEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore9DOMWindow7confirmERKNS_6StringE
 __ZN7WebCore6Chrome20runJavaScriptConfirmEPNS_5FrameERKNS_6StringE
-__ZNK7WebCore6Screen9availLeftEv
-__ZNK7WebCore6Screen8availTopEv
-__ZN7WebCore30jsConsolePrototypeFunctionWarnEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Console4warnERKNS_6StringE
-__ZNK7WebCore14StaticNodeList12itemWithNameERKNS_12AtomicStringE
-__ZNK7WebCore14StaticNodeList4itemEj
-__ZN7WebCore42jsElementPrototypeFunctionQuerySelectorAllEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore40jsDocumentPrototypeFunctionQuerySelectorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node13querySelectorERKNS_6StringERi
-__ZN7WebCore39jsElementPrototypeFunctionQuerySelectorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow6promptERKNS_6StringES3_
+__ZN7WebCore6Chrome19runJavaScriptPromptEPNS_5FrameERKNS_6StringES5_RS3_
+__ZN7WebCore32jsDOMWindowPrototypeFunctionAtobEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4atobEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore32jsDOMWindowPrototypeFunctionBtoaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4btoaEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore30jsConsolePrototypeFunctionInfoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console4infoEPNS_15ScriptCallStackE
+__ZN7WebCore30jsConsolePrototypeFunctionWarnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console4warnEPNS_15ScriptCallStackE
+__ZN7WebCore31jsConsolePrototypeFunctionErrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5errorEPNS_15ScriptCallStackE
+__ZN7WebCore31jsConsolePrototypeFunctionTraceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5traceEPNS_15ScriptCallStackE
+__ZN7WebCore24JSWebKitPointConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL20constructWebKitPointEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11WebKitPointE
+__ZN7WebCore13JSWebKitPointC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11WebKitPointEEE
+__ZN7WebCore13JSWebKitPointC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11WebKitPointEEE
+__ZNK7WebCore13JSWebKitPoint9classInfoEv
+__ZN7WebCore26JSWebKitCSSMatrixPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsWebKitCSSMatrixPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSWebKitCSSMatrix9classInfoEv
+__ZNK7WebCore15WebKitCSSMatrix8toStringEv
+__ZN7WebCore13JSWebKitPointD1Ev
+__ZN7WebCore13JSWebKitPointD2Ev
+__ZN7WebCore41jsDOMWindowPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore29setJSDOMWindowAttrConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCDATASectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCSSRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowCSSValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCharacterDataConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCommentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowEntityConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowHTMLElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowMutationEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowNodeFilterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowNotationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowXPathResultConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowClientInformationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSDOMWindowDevicePixelRatioEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowFramesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowInnerHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowInnerWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowLocationbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowMenubarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowNavigatorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowOffscreenBufferingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowOpenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowOuterHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowOuterWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowPersonalbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowScreenLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowScreenTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScreenXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScreenYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScrollYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowScrollbarsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowStatusbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowToolbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore27setJSDOMWindowDefaultStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow16setDefaultStatusERKNS_6StringE
+__ZN7WebCore27setJSDOMWindowDefaultstatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore23setJSDOMWindowOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnsearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnsearchEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore6Chrome17scrollbarsVisibleEv
+__ZNK7WebCore6Chrome15toolbarsVisibleEv
+__ZNK7WebCore6Chrome14menubarVisibleEv
+__ZN7WebCore60jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZN7WebCore13toWebKitPointEN3JSC7JSValueE
+__ZNK7WebCore9DOMWindow32webkitConvertPointFromNodeToPageEPNS_4NodeEPKNS_11WebKitPointE
+__ZNK7WebCore4Node13convertToPageERKNS_10FloatPointE
+__ZN7WebCore13JSWebKitPoint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsWebKitPointXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsWebKitPointYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore60jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore9DOMWindow32webkitConvertPointFromPageToNodeEPNS_4NodeEPKNS_11WebKitPointE
+__ZNK7WebCore4Node15convertFromPageERKNS_10FloatPointE
+__ZN7WebCore9JSHistory16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore9JSHistory22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore18JSHistoryPrototype9classInfoEv
+__ZNK7WebCore18JSBarInfoPrototype9classInfoEv
+__ZNK7WebCore17JSScreenPrototype9classInfoEv
+__ZN7WebCoreL32min_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore39setJSDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSValueListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCounterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowEventExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowKeyboardEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowMediaListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowMouseEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowOverflowEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowProgressEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSDOMWindowRectConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGAngleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGColorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGGradientElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowSVGLengthConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowSVGMarkerElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGPaintConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowSVGPathSegConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore47setJSDOMWindowSVGPreserveAspectRatioConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGRenderingIntentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowSVGTextContentElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGTextPathElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGTransformConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGUnitTypesConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowStyleSheetListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowTextEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowUIEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowWheelEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXPathExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13toMessagePortEN3JSC7JSValueE
+__ZNK7WebCore27JSHTMLAudioElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLMediaElementPrototype9classInfoEv
+__ZN7WebCore35jsHTMLMediaElementHAVE_CURRENT_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLMediaElementHAVE_ENOUGH_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLMediaElementHAVE_FUTURE_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLMediaElementHAVE_METADATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLMediaElementHAVE_NOTHINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLMediaElementNETWORK_EMPTYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLMediaElementNETWORK_IDLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsHTMLMediaElementNETWORK_LOADEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLMediaElementNETWORK_LOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsHTMLMediaElementNETWORK_NO_SOURCEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSCharacterDataPrototype9classInfoEv
 __ZNK7WebCore25JSCSSCharsetRulePrototype9classInfoEv
+__ZNK7WebCore18JSCSSRulePrototype9classInfoEv
+__ZN7WebCore23jsCSSRuleVARIABLES_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSCSSFontFaceRulePrototype9classInfoEv
 __ZNK7WebCore24JSCSSImportRulePrototype9classInfoEv
 __ZNK7WebCore23JSCSSMediaRulePrototype9classInfoEv
 __ZNK7WebCore22JSCSSPageRulePrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore28JSCSSPrimitiveValuePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore28JSCSSPrimitiveValuePrototype16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore27jsCSSPrimitiveValueCSS_ATTREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_CMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsCSSPrimitiveValueCSS_COUNTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSPrimitiveValueCSS_DIMENSIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_EMSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_EXSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsCSSPrimitiveValueCSS_GRADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_HZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsCSSPrimitiveValueCSS_IDENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_INEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_KHZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_MMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_MSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_PCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsCSSPrimitiveValueCSS_PERCENTAGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_PTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_RADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsCSSPrimitiveValueCSS_SEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_URIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore21JSStyleSheetPrototype9classInfoEv
-__ZNK7WebCore27JSDOMCoreExceptionPrototype9classInfoEv
+__ZN7WebCore34JSCSSVariablesDeclarationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSCSSVariablesDeclarationPrototype9classInfoEv
+__ZNK7WebCore35JSCanvasRenderingContext2DPrototype9classInfoEv
+__ZNK7WebCore21JSClientRectPrototype9classInfoEv
+__ZN7WebCore25JSClientRectListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSClientRectListPrototype9classInfoEv
+__ZNK7WebCore20JSClipboardPrototype9classInfoEv
+__ZN7WebCore27jsDOMCoreExceptionABORT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionDOMSTRING_SIZE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsDOMCoreExceptionINUSE_ATTRIBUTE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionINVALID_ACCESS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsDOMCoreExceptionINVALID_MODIFICATION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMCoreExceptionNETWORK_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDOMCoreExceptionNOT_SUPPORTED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsDOMCoreExceptionNO_DATA_ALLOWED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionQUOTA_EXCEEDED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsDOMCoreExceptionSECURITY_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDOMCoreExceptionTYPE_MISMATCH_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsDOMCoreExceptionURL_MISMATCH_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsDOMCoreExceptionVALIDATION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20JSDOMParserPrototype9classInfoEv
+__ZN7WebCore24JSDOMStringListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSDOMStringListPrototype9classInfoEv
 __ZNK7WebCore23JSDocumentTypePrototype9classInfoEv
 __ZNK7WebCore17JSEntityPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore27JSEventExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSEventExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSEventExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore25JSEventExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSEventExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSMediaErrorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSFilePrototype9classInfoEv
+__ZN7WebCore19JSFileListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSFileListPrototype9classInfoEv
+__ZN7WebCore27JSHTMLFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29JSHTMLMarqueeElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsMediaErrorMEDIA_ERR_ABORTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsMediaErrorMEDIA_ERR_DECODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsMediaErrorMEDIA_ERR_NETWORKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSMediaErrorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSMediaErrorPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSMediaErrorPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSMediaErrorPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSMessageEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore26JSMutationEventConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore26JSMutationEventConstructor16getValuePropertyEPN3KJS9ExecStateEi
+__ZNK7WebCore19JSMimeTypePrototype9classInfoEv
+__ZNK7WebCore24JSMimeTypeArrayPrototype9classInfoEv
+__ZN7WebCore23jsMutationEventADDITIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsMutationEventMODIFICATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsMutationEventREMOVALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore21JSNodeFilterPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore26JSOverflowEventConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore26JSOverflowEventConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore24JSOverflowEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore18JSRangeConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSRangeConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore27JSRangeExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSRangeExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSRangeExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGAngleConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGAngleConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19JSSVGAnglePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsOverflowEventBOTHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsOverflowEventHORIZONTALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsOverflowEventVERTICALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSOverflowEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSPluginPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSPluginPrototype9classInfoEv
+__ZNK7WebCore22JSPluginArrayPrototype9classInfoEv
+__ZN7WebCore17jsRangeNODE_AFTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsRangeNODE_BEFOREEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsRangeNODE_BEFORE_AND_AFTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsRangeNODE_INSIDEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGAngleSVG_ANGLETYPE_GRADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_RADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGAngleSVG_ANGLETYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGAngleSVG_ANGLETYPE_UNSPECIFIEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGAnglePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore19JSSVGAnglePrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSSVGAnglePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSSVGAnglePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGColorConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGColorConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19JSSVGColorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore25JSSVGExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSSVGExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSSVGExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore36jsSVGColorSVG_COLORTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGColorSVG_COLORTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGColorSVG_COLORTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGColorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsSVGExceptionSVG_INVALID_VALUE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGExceptionSVG_MATRIX_NOT_INVERTABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGExceptionSVG_WRONG_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore31JSSVGGradientElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore31JSSVGGradientElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore29JSSVGGradientElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSSVGLengthPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsSVGGradientElementSVG_SPREADMETHOD_PADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_REFLECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGGradientElementSVG_SPREADMETHOD_REPEATEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGGradientElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_CMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EMSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EXSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_INEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_MMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGLengthSVG_LENGTHTYPE_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsSVGLengthSVG_LENGTHTYPE_PERCENTAGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGLengthSVG_LENGTHTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGLengthPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore20JSSVGLengthPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore20JSSVGLengthPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSSVGLengthPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore29JSSVGMarkerElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSSVGMarkerElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore27JSSVGMarkerElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGPaintConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGPaintConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19JSSVGPaintPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGPathSegConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGPathSegConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSSVGPathSegPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGMarkerElementSVG_MARKER_ORIENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSSVGMarkerElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPaintSVG_PAINTTYPE_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGPaintSVG_PAINTTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPaintSVG_PAINTTYPE_URIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_URI_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGPaintPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegPATHSEG_CLOSEPATHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSSVGPathSegPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGPathSegPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGPathSegPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGPathSegPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore35JSSVGPreserveAspectRatioConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore35JSSVGPreserveAspectRatioConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore33JSSVGPreserveAspectRatioPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore44jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore33JSSVGPreserveAspectRatioPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore33JSSVGPreserveAspectRatioPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore33JSSVGPreserveAspectRatioPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore31JSSVGRenderingIntentConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore31JSSVGRenderingIntentConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore29JSSVGRenderingIntentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySl
+__ZN7WebCore41jsSVGRenderingIntentRENDERING_INTENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySl
+__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_SATURATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGRenderingIntentRENDERING_INTENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGRenderingIntentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSSVGRenderingIntentPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore29JSSVGRenderingIntentPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSSVGRenderingIntentPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore34JSSVGTextContentElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore34JSSVGTextContentElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore31JSSVGTextPathElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore31JSSVGTextPathElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore25JSSVGTransformConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSSVGTransformConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSSVGTransformPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_SPACINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore46jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGTextPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGTransformSVG_TRANSFORM_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGTransformSVG_TRANSFORM_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGTransformPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGTransformPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGTransformPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGTransformPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore25JSSVGUnitTypesConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSSVGUnitTypesConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSSVGUnitTypesPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGUnitTypesPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGUnitTypesPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGUnitTypesPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGUnitTypesPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore20JSTextEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK3KJS25JSXMLHttpRequestPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore36JSXMLHttpRequestExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34JSXMLHttpRequestExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSStoragePrototype9classInfoEv
+__ZN7WebCore23JSStorageEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSTextEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSTextMetricsPrototype9classInfoEv
+__ZN7WebCore31JSWebKitAnimationEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSWebKitCSSMatrixPrototype9classInfoEv
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsWebKitCSSTransformValueCSS_MATRIX3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsWebKitCSSTransformValueCSS_PERSPECTIVEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsWebKitCSSTransformValueCSS_ROTATE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_SCALE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsWebKitCSSTransformValueCSS_SKEWEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsWebKitCSSTransformValueCSS_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsWebKitCSSTransformValueCSS_TRANSLATE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34JSWebKitCSSTransformValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSWebKitPointPrototype9classInfoEv
+__ZN7WebCore32JSWebKitTransitionEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSWorkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSWorkerPrototype9classInfoEv
+__ZNK7WebCore25JSXMLHttpRequestPrototype9classInfoEv
+__ZN7WebCore20jsXMLHttpRequestDONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsXMLHttpRequestHEADERS_RECEIVEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsXMLHttpRequestLOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsXMLHttpRequestOPENEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsXMLHttpRequestUNSENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsXMLHttpRequestExceptionABORT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsXMLHttpRequestExceptionNETWORK_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL42getJSXMLHttpRequestExceptionPrototypeTableEPN3JSC9ExecStateE
 __ZNK7WebCore34JSXMLHttpRequestExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore34JSXMLHttpRequestExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore34JSXMLHttpRequestExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore31JSXMLHttpRequestUploadPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL39getJSXMLHttpRequestUploadPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore31JSXMLHttpRequestUploadPrototype9classInfoEv
 __ZNK7WebCore24JSXMLSerializerPrototype9classInfoEv
 __ZNK7WebCore25JSXPathEvaluatorPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore27JSXPathExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSXPathExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSXPathExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore25JSXPathExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSXPathExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore22JSXPathResultPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSXPathResultPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK3KJS22XSLTProcessorPrototype9classInfoEv
-__ZNK3KJS9MimeTypes9classInfoEv
-__ZN7WebCore9JSHistory16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore9JSHistory22customGetPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore18JSHistoryPrototype9classInfoEv
-__ZNK7WebCore18JSBarInfoPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSBarInfoEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSBarInfo16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore7BarInfo7visibleEv
-__ZNK7WebCore6Chrome15toolbarsVisibleEv
-__ZNK7WebCore6Chrome14menubarVisibleEv
-__ZNK7WebCore6Chrome17scrollbarsVisibleEv
-__ZNK7WebCore6Chrome16statusbarVisibleEv
-__ZN7WebCore35jsRangePrototypeFunctionCompareNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore30jsRangePrototypeFunctionDetachEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range6detachERi
-__ZN7WebCore21ProcessingInstruction9cloneNodeEb
-__ZN7WebCore41jsRangeExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSRangeException9classInfoEv
-__ZN7WebCore7Comment16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore38jsRangePrototypeFunctionIntersectsNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range14intersectsNodeEPNS_4NodeERi
-__ZNK7WebCore16HTMLImageElement13naturalHeightEv
-__ZN7WebCore16PendingCallbacks20PendingErrorCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore4Node9setPrefixERKNS_12AtomicStringERi
-__ZN7WebCore40jsElementPrototypeFunctionHasAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore45jsNamedNodeMapPrototypeFunctionGetNamedItemNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore43jsElementPrototypeFunctionRemoveAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element17removeAttributeNSERKNS_6StringES3_Ri
-__ZN7WebCore49jsXPathEvaluatorPrototypeFunctionCreateNSResolverEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3KJS17staticValueGetterIN7WebCore16JSXPathExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSXPathException16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore41jsEventExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSEventException9classInfoEv
-__ZN7WebCore47jsElementPrototypeFunctionInsertAdjacentElementEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element21insertAdjacentElementERKNS_6StringEPNS_4NodeERi
+__ZN7WebCore21jsXPathResultANY_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsXPathResultANY_UNORDERED_NODE_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsXPathResultBOOLEAN_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsXPathResultFIRST_ORDERED_NODE_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsXPathResultNUMBER_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsXPathResultORDERED_NODE_ITERATOR_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsXPathResultSTRING_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsXPathResultUNORDERED_NODE_ITERATOR_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSXSLTProcessorPrototype9classInfoEv
+__ZN7WebCore21JSDOMApplicationCache3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore30JSDOMApplicationCachePrototype9classInfoEv
+__ZN7WebCore29jsDOMApplicationCacheCHECKINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsDOMApplicationCacheDOWNLOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsDOMApplicationCacheIDLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMApplicationCacheOBSOLETEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMApplicationCacheUNCACHEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsDOMApplicationCacheUPDATEREADYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMApplicationCacheOncachedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOncheckingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsDOMApplicationCacheOndownloadingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsDOMApplicationCacheOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOnnoupdateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOnobsoleteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsDOMApplicationCacheOnupdatereadyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsDOMApplicationCacheStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19DOMApplicationCache6statusEv
+__ZNK7WebCore19DOMApplicationCache15associatedCacheEv
+__ZNK7WebCore18JSConsolePrototype9classInfoEv
+__ZN7WebCore17jsConsoleProfilesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9JSConsole8profilesEPN3JSC9ExecStateE
+__ZNK7WebCore14SecurityOrigin5equalEPKS0_
+__ZNK7WebCore23JSDOMSelectionPrototype9classInfoEv
+__ZN7WebCore19JSLocationPrototype12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore19JSLocationPrototype3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSLocationPrototype9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSLocation12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore12JSSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGElementEEE
+__ZN7WebCore12JSSVGElementD1Ev
+__ZN7WebCoreL20setTableCellsChangedEPNS_4NodeE
+__ZN7WebCore28setJSHTMLTextAreaElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTextAreaElement7setRowsEi
+__ZN7WebCore23JSCustomXPathNSResolver18lookupNamespaceURIERKNS_6StringE
+__ZN7WebCore51jsHTMLElementPrototypeFunctionInsertAdjacentElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement21insertAdjacentElementERKNS_6StringEPNS_7ElementERi
+__ZN7WebCore16HTMLMediaElement19removedFromDocumentEv
+__ZN7WebCoreL17sourceConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLSourceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLSourceElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL30createHTMLSourceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLSourceElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLSourceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSourceElementEEE
+__ZN7WebCore19JSHTMLSourceElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSourceElementEEE
+__ZNK7WebCore19JSHTMLSourceElement9classInfoEv
+__ZN7WebCore17HTMLSourceElement20insertedIntoDocumentEv
+__ZN7WebCore19JSHTMLSourceElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn8_N7WebCore16HTMLVideoElementD0Ev
+__ZN7WebCore19JSHTMLSourceElementD1Ev
+__ZThn8_N7WebCore17HTMLSourceElementD0Ev
+__ZN7WebCore17HTMLSourceElementD0Ev
+__ZN7WebCore28JSHTMLSourceElementPrototypeD1Ev
+__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement18insertAdjacentTextERKNS_6StringES3_Ri
 __ZN7WebCore11RenderLayer20updateOverflowStatusEbb
 __ZN7WebCore9FrameView20updateOverflowStatusEbb
 __ZN7WebCore13OverflowEventC1Ebbbb
-__ZN7WebCore22UTF32BigEndianEncodingEv
-__ZN7WebCore25UTF32LittleEndianEncodingEv
+__ZN7WebCore13OverflowEventC2Ebbbb
+__ZNK7WebCore5XPath13FunStartsWith8evaluateEv
+__ZN7WebCoreL17gbkCallbackEscapeEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZN7WebCoreL12getGbkEscapeEi
+__ZNK7WebCore14CSSCharsetRule7cssTextEv
+__ZN7WebCore24jsCSSCharsetRuleEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSCSSCharsetRuleEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore14CSSCharsetRule13isCharsetRuleEv
-__ZN7WebCore17gbkCallbackEscapeEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
-__ZN7WebCore40jsHTMLLabelElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLLabelElement5focusEb
-__ZN7WebCore49jsMutationEventPrototypeFunctionInitMutationEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13MutationEvent17initMutationEventERKNS_12AtomicStringEbbPNS_4NodeERKNS_6StringES8_S8_t
-__ZNK7WebCore18JSEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore20JSUIEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSKeyboardEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore23JSMouseEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore23JSWheelEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSMutationEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSOverflowEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSProgressEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore22JSTextEventConstructor21implementsHasInstanceEv
+__ZN7WebCore26setJSHTMLImageElementIsMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setIsMapEb
+__ZN7WebCoreL15newTextCodecMacERKNS_12TextEncodingEPKv
+__ZN7WebCore12TextCodecMacC1Ej
+__ZN7WebCore12TextCodecMacC2Ej
+__ZN7WebCore12TextCodecMac6decodeEPKcmbbRb
+__ZNK7WebCore12TextCodecMac18createTECConverterEv
+__ZN7WebCoreL18cachedConverterTECEv
+__ZN7WebCore12TextCodecMac6decodeEPKhiRiPviS3_
+__ZN7WebCore12TextCodecMacD0Ev
+__ZNK7WebCore12TextCodecMac19releaseTECConverterEv
+__ZN7WebCoreL26gbkUrlEscapedEntityCallackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZNK7WebCore8Document21getElementByAccessKeyERKNS_6StringE
+__ZN3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHashENS_14Pai
+__ZNK3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3getERKS3_
+__ZN7WebCore17HTMLAnchorElement15accessKeyActionEb
+__ZN7WebCore22jsKeyboardEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsKeyboardEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsKeyboardEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsKeyboardEventKeyIdentifierEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsKeyboardEventKeyLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12EventHandler14scrollOverflowENS_15ScrollDirectionENS_17ScrollGranularityE
+__ZNK7WebCore27RenderTextControlSingleLine10scrollLeftEv
+__ZN7WebCore35setJSHTMLInputElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLInputElement17setSelectionStartEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore16HTMLInputElement17setSelectionStartEi
+__ZN7WebCore33setJSHTMLInputElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLInputElement15setSelectionEndEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore16HTMLInputElement15setSelectionEndEi
+__ZNK7WebCore11RenderBlock24containsNonZeroBidiLevelEv
+__ZN7WebCore22jsXMLHttpRequestUploadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14XMLHttpRequest6uploadEv
+__ZN7WebCore20XMLHttpRequestUploadC1EPNS_14XMLHttpRequestE
+__ZN7WebCore20XMLHttpRequestUploadC2EPNS_14XMLHttpRequestE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_20XMLHttpRequestUploadE
+__ZN7WebCore22JSXMLHttpRequestUploadC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20XMLHttpRequestUploadEEE
+__ZN7WebCore22JSXMLHttpRequestUploadC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20XMLHttpRequestUploadEEE
+__ZN7WebCore6WorkerC1ERKNS_6StringEPNS_22ScriptExecutionContextERi
+__ZN7WebCore6WorkerC2ERKNS_6StringEPNS_22ScriptExecutionContextERi
+__ZN7WebCore18WorkerContextProxy6createEPNS_6WorkerE
+__ZN7WebCore20WorkerMessagingProxyC1EPNS_6WorkerE
+__ZN7WebCore20WorkerMessagingProxyC2EPNS_6WorkerE
+__ZNK7WebCore6Worker22scriptExecutionContextEv
+__ZThn88_N7WebCore8Document25refScriptExecutionContextEv
+__ZN7WebCore8Document25refScriptExecutionContextEv
+__ZThn24_N7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
+__ZThn88_NK7WebCore8Document9userAgentERKNS_4KURLE
+__ZNK7WebCore8Document9userAgentERKNS_4KURLE
+__ZN7WebCore20WorkerMessagingProxy18startWorkerContextERKNS_4KURLERKNS_6StringES6_
+__ZN7WebCore12WorkerThread6createERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore12WorkerThreadC1ERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore12WorkerThreadC2ERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore13WorkerRunLoopC1Ev
+__ZN7WebCore13WorkerRunLoopC2Ev
+__ZN7WebCore23WorkerThreadStartupDataC1ERKNS_4KURLERKNS_6StringES6_
+__ZN7WebCore23WorkerThreadStartupDataC2ERKNS_4KURLERKNS_6StringES6_
+__ZNK7WebCore4KURL4copyEv
+__ZN7WebCore20WorkerMessagingProxy19workerThreadCreatedEN3WTF10PassRefPtrINS_12WorkerThreadEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE14shrinkCapacityEm
+__ZN7WebCore12WorkerThread5startEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6WorkerE
+__ZN7WebCore8JSWorkerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6WorkerEEE
+__ZN7WebCore8JSWorkerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6WorkerEEE
+__ZN7WebCore46jsXMLHttpRequestPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22JSXMLHttpRequestUpload18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL30getJSXMLHttpRequestUploadTableEPN3JSC9ExecStateE
+__ZN7WebCore52jsXMLHttpRequestUploadPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore22JSXMLHttpRequestUpload9classInfoEv
+__ZN7WebCore20XMLHttpRequestUpload13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore51jsDOMApplicationCachePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore8JSWorker18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsWorkerPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8JSWorker9classInfoEv
+__ZN7WebCore6Worker13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore12WorkerThread17workerThreadStartEPv
+__ZN7WebCore12WorkerThread12workerThreadEv
+__ZN7WebCore13WorkerContextC1ERKNS_4KURLERKNS_6StringEPNS_12WorkerThreadE
+__ZN7WebCore13WorkerContextC2ERKNS_4KURLERKNS_6StringEPNS_12WorkerThreadE
+__ZN7WebCore22WorkerScriptControllerC1EPNS_13WorkerContextE
+__ZN7WebCore22WorkerScriptControllerC2EPNS_13WorkerContextE
+__ZN7WebCore22WorkerScriptController8evaluateERKNS_16ScriptSourceCodeE
+__ZN7WebCore22WorkerScriptController8evaluateERKNS_16ScriptSourceCodeEPNS_11ScriptValueE
+__ZN7WebCore22WorkerScriptController10initScriptEv
+__ZN7WebCore24JSWorkerContextPrototypenwEmPN3JSC12JSGlobalDataE
+__ZN7WebCore15JSWorkerContextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore15JSWorkerContextC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore19JSWorkerContextBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataC1Ev
+__ZNK3JSC14JSGlobalObject17supportsProfilingEv
+__ZNK7WebCore13WorkerContext18hasPendingActivityEv
+__ZThn8_N7WebCore20WorkerMessagingProxy21reportPendingActivityEb
+__ZN7WebCore20WorkerMessagingProxy21reportPendingActivityEb
+__ZThn88_N7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop3runEPNS_13WorkerContextE
+__ZN7WebCore17WorkerSharedTimer16setFiredFunctionEPFvvE
+__ZN7WebCore17WorkerSharedTimer4stopEv
+__ZN7WebCore13WorkerRunLoop11defaultModeEv
+__ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_13ModePredicateE
+__ZN7WebCoreL11performTaskEPv
+__ZN7WebCore30WorkerThreadActivityReportTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore20WorkerMessagingProxy29reportPendingActivityInternalEbb
+__ZN7WebCore30WorkerThreadActivityReportTaskD0Ev
+__ZN7WebCore22ScriptExecutionContext4TaskD2Ev
+__ZNK7WebCore6Worker18hasPendingActivityEv
+__ZNK7WebCore20WorkerMessagingProxy18hasPendingActivityEv
+__ZN7WebCore22JSXMLHttpRequestUpload4markEv
+__ZN7WebCore8JSWorker4markEv
+__ZNK7WebCore6Worker10canSuspendEv
+__ZN7WebCore6Worker4stopEv
+__ZN7WebCore6Worker9terminateEv
+__ZN7WebCore20WorkerMessagingProxy22terminateWorkerContextEv
+__ZN7WebCore12WorkerThread4stopEv
+__ZN7WebCore22WorkerScriptController15forbidExecutionEv
+__ZN7WebCore13WorkerRunLoop9terminateEv
+__ZN7WebCore22WorkerScriptControllerD1Ev
+__ZN7WebCore22WorkerScriptControllerD2Ev
+__ZN7WebCore24JSWorkerContextPrototypeD1Ev
+__ZN7WebCore15JSWorkerContextD1Ev
+__ZN7WebCore19JSWorkerContextBaseD2Ev
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataD0Ev
+__ZN7WebCore13WorkerContextD0Ev
+__ZThn8_N7WebCore20WorkerMessagingProxy22workerContextDestroyedEv
+__ZN7WebCore20WorkerMessagingProxy22workerContextDestroyedEv
+__ZN3WTF14ThreadSpecificIN7WebCore16ThreadGlobalDataEE7destroyEPv
+__ZN7WebCore16ThreadGlobalDataD1Ev
+__ZN7WebCore16ThreadGlobalDataD2Ev
+__ZN7WebCore19ICUConverterWrapperD1Ev
+__ZN7WebCore19ICUConverterWrapperD2Ev
+__ZN7WebCore10EventNamesD2Ev
+__ZN7WebCore26WorkerContextDestroyedTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore20WorkerMessagingProxy30workerContextDestroyedInternalEv
+__ZN7WebCore12WorkerThreadD1Ev
+__ZN7WebCore12WorkerThreadD2Ev
+__ZN7WebCore13WorkerRunLoopD1Ev
+__ZN7WebCore13WorkerRunLoopD2Ev
+__ZN7WebCore17WorkerSharedTimerD0Ev
+__ZN7WebCore26WorkerContextDestroyedTaskD0Ev
+__ZN7WebCore8JSWorkerD1Ev
+__ZN7WebCore8JSWorkerD2Ev
+__ZN7WebCore6WorkerD0Ev
+__ZN7WebCore20WorkerMessagingProxy21workerObjectDestroyedEv
+__ZN7WebCore20WorkerMessagingProxyD0Ev
+__ZThn88_N7WebCore8Document27derefScriptExecutionContextEv
+__ZN7WebCore8Document27derefScriptExecutionContextEv
+__ZN7WebCore22JSXMLHttpRequestUploadD1Ev
+__ZN7WebCore22JSXMLHttpRequestUploadD2Ev
+__ZN7WebCore20XMLHttpRequestUploadD0Ev
+__ZN7WebCore49jsMutationEventPrototypeFunctionInitMutationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13MutationEvent17initMutationEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
+__ZN7WebCoreL27createSVGPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathElementEEE
+__ZN7WebCore16JSSVGPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathElementEEE
+__ZN7WebCore16JSSVGPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGPathElement9classInfoEv
+__ZNK7WebCore6JSNode21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
+__ZN7WebCore26jsProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12MessageEventC1Ev
+__ZN7WebCore12MessageEventC2Ev
+__ZN7WebCore25jsMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21WebKitTransitionEventC1Ev
+__ZN7WebCore21WebKitTransitionEventC2Ev
+__ZNK7WebCore21WebKitTransitionEvent23isWebKitTransitionEventEv
+__ZN7WebCore23JSWebKitTransitionEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitTransitionEventEEE
+__ZN7WebCore23JSWebKitTransitionEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitTransitionEventEEE
+__ZN7WebCore23JSWebKitTransitionEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSSVGPathElementD1Ev
+__ZThn8_N7WebCore14SVGPathElementD0Ev
+__ZN7WebCore25JSSVGPathElementPrototypeD1Ev
+__ZN7WebCore23JSWebKitTransitionEventD1Ev
+__ZN7WebCore21WebKitTransitionEventD0Ev
+__ZNK7WebCore21HTMLFrameOwnerElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore21HTMLFrameOwnerElement19isFrameOwnerElementEv
+__ZNK7WebCore17HTMLAnchorElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler11tabsToLinksEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler24invertSenseOfTabsToLinksEPNS_13KeyboardEventE
+__ZNK7WebCore12RenderInline17borderBoundingBoxEv
+__ZNK7WebCore4Node19isFrameOwnerElementEv
+__ZNK7WebCore16HTMLInputElement19isKeyboardFocusableEPNS_13KeyboardEventE
 __ZN7WebCore8Document21previousFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
+__ZN7WebCore26jsKeyboardEventAltGraphKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent6layerXEv
+__ZNK7WebCore7UIEvent6layerYEv
+__ZNK7WebCore7UIEvent5pageXEv
+__ZNK7WebCore7UIEvent5pageYEv
+__ZNK7WebCore13KeyboardEvent5whichEv
+__ZN7WebCore47jsMessageEventPrototypeFunctionInitMessageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSMessageEvent9classInfoEv
+__ZN7WebCore12MessageEvent16initMessageEventERKNS_12AtomicStringEbbRKNS_6StringES6_S6_PNS_9DOMWindowEPNS_11MessagePortE
+__ZN7WebCore25jsMessageEventLastEventIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsMutationEventRelatedNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsMutationEventPrevValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMutationEventNewValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMutationEventAttrNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsMutationEventAttrChangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsOverflowEventPrototypeFunctionInitOverflowEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13OverflowEvent17initOverflowEventEtbb
+__ZN7WebCore21jsOverflowEventOrientEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsOverflowEventHorizontalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsOverflowEventVerticalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsProgressEventLengthComputableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsProgressEventLoadedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsProgressEventTotalEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12StorageEvent14isStorageEventEv
+__ZN7WebCore14JSStorageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12StorageEventEEE
+__ZN7WebCore14JSStorageEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12StorageEventEEE
+__ZN7WebCore14JSStorageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore47jsStorageEventPrototypeFunctionInitStorageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSStorageEvent9classInfoEv
+__ZN7WebCore12StorageEvent16initStorageEventERKNS_12AtomicStringEbbRKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore17jsStorageEventKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsStorageEventOldValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsStorageEventNewValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsStorageEventUriEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsStorageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsTextEventPrototypeFunctionInitTextEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9TextEvent13initTextEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZN7WebCore15jsTextEventDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent5whichEv
+__ZN7WebCore63jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZNK7WebCore22JSWebKitAnimationEvent9classInfoEv
+__ZN7WebCore20WebKitAnimationEvent24initWebKitAnimationEventERKNS_12AtomicStringEbbRKNS_6StringEd
+__ZN7WebCore65jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERK
+__ZNK7WebCore23JSWebKitTransitionEvent9classInfoEv
+__ZN7WebCore21WebKitTransitionEvent25initWebKitTransitionEventERKNS_12AtomicStringEbbRKNS_6StringEd
+__ZN7WebCore35jsWebKitTransitionEventPropertyNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitTransitionEvent12propertyNameEv
+__ZN7WebCore34jsWebKitTransitionEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitTransitionEvent11elapsedTimeEv
+__ZN7WebCore14JSStorageEventD1Ev
+__ZN7WebCore12StorageEventD0Ev
+__ZN7WebCore16HTMLLabelElement5focusEb
+__ZN7WebCore11RenderBlock16paintColumnRulesERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderBlock19paintColumnContentsERNS_12RenderObject9PaintInfoEiib
+__ZN7WebCore16HTMLInputElement15addSearchResultEv
+__ZN7WebCore27RenderTextControlSingleLine15addSearchResultEv
+__ZN7WebCore16HTMLInputElement8onSearchEv
+__ZN7WebCore27RenderTextControlSingleLine20stopSearchEventTimerEv
+__ZN7WebCore17HTMLSelectElement13typeAheadFindEPNS_13KeyboardEventE
+__ZNK7WebCore17HTMLSelectElement17listToOptionIndexEi
+__ZN7WebCore24submitButtonDefaultLabelEv
+__ZN7WebCore17setJSNodeOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore6Chrome12canTakeFocusENS_14FocusDirectionE
+__ZNK7WebCore6Chrome9takeFocusENS_14FocusDirectionE
+__ZN7WebCore17setJSNodeOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9Scrollbar6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore12EventHandler30passMousePressEventToScrollbarERNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar9mouseDownERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar14setPressedPartENS_13ScrollbarPartE
+__ZN7WebCore17ScrollbarThemeMac19shouldCenterOnThumbEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore17ScrollbarThemeMac27initialAutoscrollTimerDelayEv
+__ZN7WebCore9Scrollbar21autoscrollPressedPartEd
+__ZN7WebCoreL15thumbUnderMouseEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite13trackPositionEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar28pressedPartScrollGranularityEv
+__ZN7WebCore9Scrollbar26pressedPartScrollDirectionEv
+__ZN7WebCore9Scrollbar18startTimerIfNeededEd
+__ZN7WebCore17ScrollbarThemeMac20autoscrollTimerDelayEv
+__ZN7WebCore9Scrollbar7mouseUpEv
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE6shrinkEm
+__ZN7WebCore32jsDOMWindowPrototypeFunctionStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow4stopEv
+__ZN7WebCore11FrameLoader25scheduleCheckLoadCompleteEv
+__ZNK7WebCore15HTMLAreaElement11isFocusableEv
+__ZN7WebCore16HTMLMediaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderMediaC1EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMedia24createControlsShadowRootEv
+__ZN7WebCore29MediaControlShadowRootElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlShadowRootElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore29MediaControlShadowRootElement12isShadowNodeEv
+__ZN7WebCore29MediaControlShadowRootElement16shadowParentNodeEv
+__ZN7WebCore11RenderMedia11createPanelEv
+__ZN7WebCore11RenderMedia16createMuteButtonEv
+__ZN7WebCore29MediaControlMuteButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlMuteButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore24MediaControlInputElementC2EPNS_8DocumentENS_8PseudoIdERKNS_6StringEPNS_16HTMLMediaElementENS_23MediaControlElemen
+__ZN7WebCore24MediaControlInputElement14attachToParentEPNS_7ElementE
+__ZN7WebCore11RenderMedia16createPlayButtonEv
+__ZN7WebCore29MediaControlPlayButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlPlayButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZN7WebCore11RenderMedia23createTimelineContainerEv
+__ZN7WebCore11RenderMedia14createTimelineEv
+__ZN7WebCore27MediaControlTimelineElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore27MediaControlTimelineElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMedia20createSeekBackButtonEv
+__ZN7WebCore29MediaControlSeekButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore29MediaControlSeekButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore11RenderMedia23createSeekForwardButtonEv
+__ZN7WebCore11RenderMedia24createCurrentTimeDisplayEv
+__ZN7WebCore23MediaTimeDisplayElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore23MediaTimeDisplayElementC2EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore23MediaTextDisplayElementC2EPNS_8DocumentENS_8PseudoIdEPNS_16HTMLMediaElementE
+__ZN7WebCore23MediaTextDisplayElement14attachToParentEPNS_7ElementE
+__ZN7WebCore11RenderMedia26createTimeRemainingDisplayEv
+__ZN7WebCore11RenderMedia22createFullscreenButtonEv
+__ZN7WebCore35MediaControlFullscreenButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore35MediaControlFullscreenButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore24MediaControlInputElement6updateEv
+__ZN7WebCore29MediaControlMuteButtonElement17updateDisplayTypeEv
+__ZN7WebCore24MediaControlInputElement14setDisplayTypeENS_23MediaControlElementTypeE
+__ZN7WebCore29MediaControlPlayButtonElement17updateDisplayTypeEv
+__ZN7WebCore27MediaControlTimelineElement6updateEb
+__ZN7WebCore24MediaControlInputElement17updateDisplayTypeEv
+__ZN7WebCore11RenderMedia17updateTimeDisplayEv
+__ZN7WebCore11RenderMedia23updateControlVisibilityEv
+__ZNK7WebCore16HTMLMediaElement8hasVideoEv
+__ZNK7WebCore16HTMLVideoElement8hasVideoEv
+__ZNK7WebCore17HTMLSourceElement17endTagRequirementEv
+__ZNK7WebCore17HTMLSourceElement11tagPriorityEv
+__ZNK7WebCore16HTMLMediaElement12networkStateEv
+__ZNK7WebCore22NullMediaPlayerPrivate11currentTimeEv
+__ZN7WebCore17HTMLSourceElement23cancelPendingErrorEventEv
+__ZN7WebCore16HTMLMediaElement24havePotentialSourceChildEv
+__ZN7WebCore16HTMLMediaElement21selectNextSourceChildEPNS_11ContentTypeENS0_19InvalidSourceActionE
+__ZNK7WebCore17HTMLSourceElement4typeEv
+__ZNK7WebCore17HTMLSourceElement3srcEv
+__ZN7WebCore16HTMLMediaElement19loadNextSourceChildEv
+__ZN7WebCore11MediaPlayer8hasVideoEv
+__ZNK7WebCore22NullMediaPlayerPrivate8hasVideoEv
+__ZNK7WebCore18MediaPlayerPrivate8hasVideoEv
+__ZNK7WebCore11RenderVideo20calcAspectRatioWidthEv
+__ZNK7WebCore11RenderVideo21calcAspectRatioHeightEv
+__ZN7WebCore24MediaControlInputElement11updateStyleEv
+__ZN7WebCore23MediaTextDisplayElement11updateStyleEv
+__ZNK7WebCore19HTMLFieldSetElement11isFocusableEv
+__ZN7WebCore17HTMLLegendElement5focusEb
+__ZNK7WebCore17HTMLLegendElement11isFocusableEv
+__ZN7WebCore17HTMLLegendElement11formElementEv
+__ZNK7WebCore19HTMLOptGroupElement11isFocusableEv
+__ZNK7WebCore17HTMLOptionElement11isFocusableEv
+__ZN7WebCore12RenderSliderD0Ev
+__ZThn8_N7WebCore18SliderThumbElementD0Ev
+__ZN7WebCore18SliderThumbElementD0Ev
+__ZN7WebCore28RenderMediaControlShadowRootD0Ev
+__ZThn8_N7WebCore29MediaControlShadowRootElementD0Ev
+__ZN7WebCore29MediaControlShadowRootElementD0Ev
+__ZN7WebCore29MediaControlMuteButtonElementD0Ev
+__ZN7WebCore29MediaControlPlayButtonElementD0Ev
+__ZN7WebCore29MediaControlSeekButtonElementD0Ev
+__ZN7WebCore35MediaControlFullscreenButtonElementD0Ev
+__ZN7WebCore27MediaControlTimelineElementD0Ev
+__ZN7WebCore23MediaTimeDisplayElementD0Ev
+__ZN7WebCore11RenderMediaD0Ev
+__ZN7WebCore11FrameLoader21reportLocalLoadFailedEPNS_5FrameERKNS_6StringE
+__ZN7WebCore16HTMLMediaElement13noneSupportedEv
+__ZN7WebCore16HTMLMediaElement5pauseEv
+__ZN7WebCore16HTMLMediaElement13pauseInternalEv
+__ZN7WebCore19CachedXSLStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore13XSLStyleSheet17compileStyleSheetEv
+__ZL26initxsltParseStylesheetDocP7_xmlDoc
+__ZL14libxsltLibraryv
+__ZN7WebCore13XSLStyleSheet14clearDocumentsEv
+__ZL27initxsltNewTransformContextP15_xsltStylesheetP7_xmlDoc
+__ZN7WebCore22registerXSLTExtensionsEP21_xsltTransformContext
+__ZL27initxsltRegisterExtFunctionP21_xsltTransformContextPKhS2_PFvP22_xmlXPathParserContextiE
+__ZL23initxsltSetCtxtSortFuncP21_xsltTransformContextPFvS0_PP8_xmlNodeiE
+__ZL23initxsltQuoteUserParamsP21_xsltTransformContextPPKc
+__ZL27initxsltApplyStylesheetUserP15_xsltStylesheetP7_xmlDocPPKcS4_P7__sFILEP21_xsltTransformContext
+__ZL28initxsltFreeTransformContextP21_xsltTransformContext
+__ZL20initxsltSaveResultToP16_xmlOutputBufferP7_xmlDocP15_xsltStylesheet
+__ZN7WebCoreL13writeToVectorEPvPKci
+__ZL22initxsltFreeStylesheetP15_xsltStylesheet
+__ZN7WebCore13XSLTProcessor24createDocumentFromSourceERKNS_6StringES3_S3_PNS_4NodeEPNS_5FrameE
 __ZNK7WebCore9RenderBox14overrideHeightEv
 __ZN7WebCore17RenderFlexibleBox22calcVerticalPrefWidthsEv
-__ZN7WebCore13RenderListBox17listIndexAtOffsetEii
-__ZN7WebCore16HTMLInputElement16setIndeterminateEb
-__ZNK7WebCore4Font27selectionRectForComplexTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZN7WebCore45jsHTMLSelectElementPrototypeFunctionNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17HTMLSelectElement9namedItemERKNS_6StringEb
-__ZN7WebCore17RenderTextControl22textWithHardLineBreaksEv
-__ZN7WebCore16getNextSoftBreakERPNS_13RootInlineBoxERPNS_4NodeERj
-__ZN7WebCore17HTMLSelectElement7setSizeEi
-__ZN7WebCore19HTMLOptGroupElement11removeChildEPNS_4NodeERi
-__ZN7WebCore31HTMLFormControlElementWithState26willMoveToNewOwnerDocumentEv
-__ZN7WebCore31HTMLFormControlElementWithState25didMoveToNewOwnerDocumentEv
-__ZN7WebCore16HTMLInputElement26willMoveToNewOwnerDocumentEv
-__ZN7WebCore16HTMLInputElement25didMoveToNewOwnerDocumentEv
+__ZNK7WebCore13RenderListBox10renderNameEv
+__ZN7WebCore17HTMLButtonElement15accessKeyActionEb
+__ZN7WebCore16HTMLInputElement15accessKeyActionEb
+__ZN7WebCore17HTMLLegendElement15accessKeyActionEb
+__ZN7WebCore16HTMLLabelElement15accessKeyActionEb
+__ZN7WebCore27jsHTMLInputElementAutofocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLInputElementAutofocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement12setAutofocusEb
+__ZN7WebCore32setJSHTMLTextAreaElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLTextAreaElementColsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement7setColsEi
+__ZNK7WebCore12RenderSlider10renderNameEv
+__ZNK7WebCore23RenderFileUploadControl10renderNameEv
 __ZNK7WebCore12RenderButton23createsAnonymousWrapperEv
-__ZN3WTF6VectorItLm0EE4growEm
-__ZN7WebCore17HTMLSelectElement11setMultipleEb
-__ZN7WebCore17HTMLSelectElement22updateListBoxSelectionEb
-__ZThn132_N7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore19enabledAnySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore14FormElementKeyC1EPNS_16AtomicStringImplES2_
+__ZN7WebCore14FormElementKeyC2EPNS_16AtomicStringImplES2_
+__ZNK7WebCore14FormElementKey3refEv
+__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormEl
+__ZN3WTF7HashMapIN7WebCore14FormElementKeyENS_6VectorINS1_6StringELm0EEENS1_18FormElementKeyHashENS1_24FormElementKeyHashTraits
+__ZN7WebCore14FormElementKeyC1ERKS0_
+__ZN7WebCore14FormElementKeyC2ERKS0_
+__ZN7WebCore14FormElementKeyD1Ev
+__ZN7WebCore14FormElementKeyD2Ev
+__ZNK7WebCore14FormElementKey5derefEv
+__ZN7WebCore18FormElementKeyHash4hashERKNS_14FormElementKeyE
+__ZN7WebCore14FormElementKeyaSERKS0_
+__ZN7WebCore8Document23takeStateForFormElementEPNS_16AtomicStringImplES2_RNS_6StringE
+__ZN7WebCore16HTMLInputElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore14jsNodeOnselectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onselectEv
+__ZNK7WebCore8DragData11asFilenamesERN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore23RenderFileUploadControl19receiveDroppedFilesERKN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore23RenderFileUploadControl19allowsMultipleFilesEv
+__ZN7WebCore11FileChooser10chooseFileERKNS_6StringE
+__ZThn200_N7WebCore23RenderFileUploadControl12valueChangedEv
+__ZN7WebCore23RenderFileUploadControl12valueChangedEv
+__ZN7WebCore16HTMLInputElement23setFileListFromRendererERKN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore4FileC1ERKNS_6StringE
+__ZN7WebCore4FileC2ERKNS_6StringE
+__ZN7WebCore15pathGetFileNameERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE15reserveCapacityEm
+__ZNK7WebCore8FileList4itemEj
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE6shrinkEm
+__ZNK7WebCore22HTMLFormControlElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler17tabsToAllControlsEPNS_13KeyboardEventE
+__ZNK7WebCore19HTMLTextAreaElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCore19HTMLTextAreaElement15accessKeyActionEb
+__ZN7WebCore39setJSDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore14RenderTableCol10renderNameEv
+__ZN7WebCore34setJSHTMLInputElementIndeterminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement16setIndeterminateEb
+__ZThn128_N7WebCore16HTMLInputElement8setValueERKNS_6StringE
+__ZN7WebCore26jsHTMLInputElementMultipleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement8multipleEv
+__ZN7WebCore29setJSHTMLInputElementMultipleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement11setMultipleEb
+__ZNK7WebCore17RenderTextControl28canBeProgramaticallyScrolledEb
+__ZN7WebCore27RenderTextControlSingleLine10autoscrollEv
+__ZN7WebCore30setJSHTMLInputElementMaxLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement12setMaxLengthEi
 __ZNK7WebCore17HTMLSelectElement12canSelectAllEv
 __ZN7WebCore17HTMLSelectElement9selectAllEv
 __ZN7WebCore17HTMLSelectElement23nextSelectableListIndexEi
 __ZN7WebCore17HTMLSelectElement27previousSelectableListIndexEi
+__ZN7WebCore17HTMLSelectElement22updateListBoxSelectionEb
+__ZN7WebCore13RenderListBox32scrollToRevealElementAtListIndexEi
 __ZN7WebCore17HTMLSelectElement15listBoxOnChangeEv
 __ZN7WebCore13RenderListBox12setScrollTopEi
-__ZNK7WebCore31JSHTMLInputElementBasePrototype9classInfoEv
+__ZThn200_N7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
+__ZN7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
+__ZN7WebCore13RenderListBox17listIndexAtOffsetEii
+__ZNK7WebCore11RenderTheme37activeListBoxSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac45platformActiveListBoxSelectionBackgroundColorEv
+__ZNK7WebCore11RenderTheme37activeListBoxSelectionForegroundColorEv
+__ZNK7WebCore14RenderThemeMac45platformActiveListBoxSelectionForegroundColorEv
+__ZNK7WebCore13RenderListBox9scrollTopEv
+__ZN7WebCore30setJSHTMLSelectElementMultipleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement11setMultipleEb
+__ZN7WebCore26setJSHTMLSelectElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement7setSizeEi
+__ZThn128_NK7WebCore19HTMLOptGroupElement14groupLabelTextEv
+__ZNK7WebCore19HTMLOptGroupElement14groupLabelTextEv
+__ZN7WebCore19HTMLOptGroupElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
+__ZN7WebCore19HTMLOptGroupElement11removeChildEPNS_4NodeERi
+__ZN7WebCore19HTMLOptGroupElement12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore19HTMLOptGroupElement12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
 __ZN7WebCore19HTMLOptGroupElement14removeChildrenEv
+__ZN7WebCore13RenderListBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore13RenderListBox24isPointInOverflowControlERNS_13HitTestResultEiiii
+__ZNK7WebCore17HTMLSelectElement16isMouseFocusableEv
+__ZNK7WebCore17HTMLSelectElement17canStartSelectionEv
+__ZNK7WebCore13RenderListBox28canBeProgramaticallyScrolledEb
+__ZN7WebCore31HTMLFormControlElementWithState26willMoveToNewOwnerDocumentEv
+__ZN7WebCore31HTMLFormControlElementWithState25didMoveToNewOwnerDocumentEv
+__ZN7WebCore16HTMLInputElement26willMoveToNewOwnerDocumentEv
+__ZN7WebCore16HTMLInputElement25didMoveToNewOwnerDocumentEv
+__ZN7WebCore30SearchFieldCancelButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12EventHandler27setCapturingMouseEventsNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZThn8_N7WebCore30SearchFieldCancelButtonElementD0Ev
+__ZN7WebCore27RenderTextControlSingleLine21startSearchEventTimerEv
+__ZN7WebCore5TimerINS_27RenderTextControlSingleLineEE5firedEv
+__ZN7WebCore27RenderTextControlSingleLine21searchEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore24HitTestingTransformState9translateEiiNS0_21TransformAccumulationE
+__ZN7WebCore17HTMLSelectElement15accessKeyActionEb
+__ZNK7WebCore17HTMLSelectElement21lastSelectedListIndexEv
+__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore19JSHTMLSelectElement11indexSetterEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore45jsHTMLSelectElementPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17HTMLSelectElement9namedItemERKNS_12AtomicStringE
+__ZN7WebCore17HTMLSelectElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore12RenderSlider12forwardEventEPNS_5EventE
+__ZN7WebCore18SliderThumbElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12RenderSlider19mouseEventIsInThumbEPNS_10MouseEventE
+__ZN7WebCore12RenderSlider15currentPositionEv
+__ZN7WebCore12RenderSlider17positionForOffsetERKNS_8IntPointE
+__ZN7WebCore12RenderSlider9trackSizeEv
+__ZN7WebCore12RenderSlider19setValueForPositionEi
+__ZN7WebCore12TextDocumentC1EPNS_5FrameE
+__ZN7WebCore12TextDocumentC2EPNS_5FrameE
+__ZN7WebCore12TextDocument15createTokenizerEv
+__ZN7WebCore13TextTokenizerC1EPNS_8DocumentE
+__ZN7WebCore13TextTokenizerC2EPNS_8DocumentE
+__ZN7WebCore13TextTokenizer5writeERKNS_15SegmentedStringEb
+__ZN7WebCore13TextTokenizer6finishEv
+__ZN7WebCore13TextTokenizerD0Ev
+__ZN7WebCore12TextDocumentD0Ev
+__ZN7WebCore17RenderTextControl22textWithHardLineBreaksEv
+__ZN7WebCoreL16getNextSoftBreakERPNS_13RootInlineBoxERPNS_4NodeERj
+__ZN7WebCore15RenderScrollbar21createCustomScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore15RenderScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore15RenderScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore20RenderScrollbarTheme20renderScrollbarThemeEv
+__ZN7WebCore20RenderScrollbarTheme17registerScrollbarEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme18scrollbarThicknessENS_20ScrollbarControlSizeE
+__ZN7WebCore15RenderScrollbar9setParentEPNS_10ScrollViewE
+__ZN7WebCore15RenderScrollbar12styleChangedEv
+__ZN7WebCore15RenderScrollbar20updateScrollbarPartsEb
+__ZN7WebCore15RenderScrollbar19updateScrollbarPartENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar23getScrollbarPseudoStyleENS_13ScrollbarPartENS_8PseudoIdE
+__ZNK7WebCore20RenderScrollbarTheme16buttonsPlacementEv
+__ZNK3WTF7HashMapIjPN7WebCore19RenderScrollbarPartENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZN7WebCore19RenderScrollbarPartC1EPNS_4NodeEPNS_15RenderScrollbarENS_13ScrollbarPartE
+__ZN7WebCore19RenderScrollbarPartC2EPNS_4NodeEPNS_15RenderScrollbarENS_13ScrollbarPartE
+__ZN3WTF7HashMapIjPN7WebCore19RenderScrollbarPartENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore19RenderScrollbarPartEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsIN
+__ZN7WebCore19RenderScrollbarPart15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore19RenderScrollbarPart14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore19RenderScrollbarPart13requiresLayerEv
+__ZN7WebCore19RenderScrollbarPart6layoutEv
+__ZN7WebCore19RenderScrollbarPart18layoutVerticalPartEv
+__ZN7WebCore19RenderScrollbarPart21computeScrollbarWidthEv
+__ZN7WebCoreL27calcScrollbarThicknessUsingERKNS_6LengthEi
+__ZN7WebCore15RenderScrollbar10setEnabledEb
+__ZN7WebCore20RenderScrollbarTheme9trackRectEPNS_9ScrollbarEb
+__ZN7WebCore20RenderScrollbarTheme10hasButtonsEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme25buttonSizesAlongTrackAxisEPNS_9ScrollbarERiS3_
+__ZN7WebCore20RenderScrollbarTheme14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar10buttonRectENS_13ScrollbarPartE
+__ZN7WebCore20RenderScrollbarTheme17forwardButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar9trackRectEii
+__ZN7WebCore20RenderScrollbarTheme31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore15RenderScrollbar25trackPieceRectWithMarginsENS_13ScrollbarPartERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme18minimumThumbLengthEPNS_9ScrollbarE
+__ZN7WebCore15RenderScrollbar18minimumThumbLengthEv
+__ZN7WebCore19RenderScrollbarPartD0Ev
+__ZN7WebCore15RenderScrollbarD0Ev
+__ZN7WebCore9ScrollbarD2Ev
+__ZN7WebCore20RenderScrollbarTheme19unregisterScrollbarEPNS_9ScrollbarE
+__ZNK7WebCore12RenderObject8isSliderEv
+__ZN7WebCore30jsHTMLInputElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement12willValidateEv
+__ZN7WebCore33jsHTMLTextAreaElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLFieldSetElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFieldSetElement12willValidateEv
+__ZN7WebCore31jsHTMLButtonElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement12willValidateEv
+__ZN7WebCoreL31transferMailtoPostFormDataToURLERN3WTF6RefPtrINS_8FormDataEEERNS_4KURLERKNS_6StringE
+__ZN7WebCore14RenderFrameSet13startResizingERNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet12hitTestSplitERKNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet13splitPositionERKNS0_8GridAxisEi
+__ZN7WebCore14RenderFrameSet13setIsResizingEb
+__ZN7WebCore12EventHandler19setResizingFrameSetEPNS_19HTMLFrameSetElementE
+__ZN7WebCore14RenderFrameSet16continueResizingERNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet12canResizeRowERKNS_8IntPointE
+__ZNK7WebCore14RenderFrameSet15canResizeColumnERKNS_8IntPointE
+__ZN7WebCore18columnResizeCursorEv
+__ZN7WebCore15rowResizeCursorEv
+__ZN7WebCore23jsHTMLFrameElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase5widthEv
+__ZN7WebCore24jsHTMLFrameElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase6heightEv
-__ZNK7WebCore17RenderTextControl11scrollWidthEv
-__ZNK7WebCore12RenderObject8isSliderEv
-__ZN7WebCore19JSHTMLSelectElement11indexSetterEPN3KJS9ExecStateEjPNS1_7JSValueEi
-__ZNK7WebCore13RenderListBox9scrollTopEv
-__ZNK7WebCore14RenderThemeMac37activeListBoxSelectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme37activeListBoxSelectionForegroundColorEv
-__ZN7WebCore41jsHTMLLegendElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17HTMLLegendElement5focusEb
-__ZN7WebCore17HTMLLegendElement11formElementEv
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE11reverseRunsEii
-__ZN7WebCore16CSSStyleSelector17mapBackgroundClipEPNS_15BackgroundLayerEPNS_8CSSValueE
+__ZNK7WebCore11FrameLoader20childFramesMatchItemEPNS_11HistoryItemE
+__ZNK7WebCore11HistoryItem19childItemWithTargetERKNS_6StringE
+__ZN7WebCore26setJSXMLHttpRequestOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLOptionElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore22HTMLViewSourceDocumentC1EPNS_5FrameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocumentC2EPNS_5FrameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument15createTokenizerEv
+__ZN7WebCore13HTMLTokenizerC1EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13HTMLTokenizerC2EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore22HTMLViewSourceDocument18addViewSourceTokenEPNS_5TokenE
+__ZN7WebCore22HTMLViewSourceDocument21createContainingTableEv
+__ZN7WebCore22HTMLViewSourceDocument20addSpanWithClassNameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument7addLineERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument7addTextERKNS_6StringES3_
+__ZN7WebCore22HTMLViewSourceDocumentD0Ev
+__ZN7WebCore22HTMLViewSourceDocument25addViewSourceDoctypeTokenEPNS_12DoctypeTokenE
+__ZN7WebCore16CSSGradientValue13resolveRadiusEPNS_17CSSPrimitiveValueEf
+__ZNK7WebCore27RenderImageGeneratedContent21setImageContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore19StyleGeneratedImage22usesImageContainerSizeEv
+__ZN7WebCore28jsHistoryPrototypeFunctionGoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7History2goEi
+__ZNK7WebCore17HTMLButtonElement17canStartSelectionEv
+__ZN7WebCore17HTMLKeygenElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLKeygenElement11tagPriorityEv
+__ZNK7WebCore17HTMLKeygenElement15formControlTypeEv
+__ZN7WebCore7DataRefINS_16StyleMarqueeDataEE6accessEv
+__ZNK7WebCore11RenderImage21setImageContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore16HTMLEmbedElement24imageSourceAttributeNameEv
 __ZN7WebCore16PDFDocumentImageC1Ev
+__ZN7WebCore16PDFDocumentImageC2Ev
 __ZN7WebCore16PDFDocumentImage11dataChangedEb
 __ZN7WebCore16PDFDocumentImage14setCurrentPageEi
 __ZNK7WebCore16PDFDocumentImage9pageCountEv
 __ZNK7WebCore16PDFDocumentImage4sizeEv
-__ZNK7WebCore8SVGImage17usesContainerSizeEv
 __ZN7WebCore16PDFDocumentImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
 __ZNK7WebCore16PDFDocumentImage9adjustCTMEPNS_15GraphicsContextE
 __ZN7WebCore5Image26nativeImageForCurrentFrameEv
-__ZN7WebCore11RenderBlock26addContinuationWithOutlineEPNS_10RenderFlowE
-__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS_7HashSetIPNS1_10RenderFlowENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EENS9_IS3_EENS9_ISC_EEE3getERKS3_
-__ZNK7WebCore17HTMLKeygenElement11tagPriorityEv
-__ZNK7WebCore17HTMLKeygenElement4typeEv
-__ZN7WebCore8toHebrewEi
-__ZN7WebCore17toHebrewUnder1000EiPt
-__ZN7WebCore11RenderBlock12paintColumnsERNS_12RenderObject9PaintInfoEiib
-__ZN7WebCore11RenderBlock14hitTestColumnsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore40jsMediaListPrototypeFunctionAppendMediumEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9MediaList12appendMediumERKNS_6StringERi
-__ZN7WebCore40jsMediaListPrototypeFunctionDeleteMediumEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore8SVGImage17usesContainerSizeEv
+__ZNK7WebCore13RenderSVGRoot13selfWillPaintEv
+__ZN7WebCore11RenderBlock25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZN7WebCore12RenderInline19paintOutlineForLineEPNS_15GraphicsContextEiiRKNS_7IntRectES5_S5_
+__ZN7WebCore13RenderSVGRoot14calcPrefWidthsEv
+__ZNK7WebCore13RenderSVGRoot10lineHeightEbb
+__ZNK7WebCore13RenderSVGRoot16baselinePositionEbb
+__ZN7WebCore56jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore19CSSStyleDeclaration18isPropertyImplicitERKNS_6StringE
+__ZN7WebCore17setJSNodeOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore40jsDOMWindowPrototypeFunctionOpenDatabaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12openDatabaseERKNS_6StringES3_S3_mRi
+__ZN7WebCore8Database12openDatabaseEPNS_8DocumentERKNS_6StringES5_S5_mRi
+__ZN7WebCore15DatabaseTracker20canEstablishDatabaseEPNS_8DocumentERKNS_6StringES5_m
+__ZN7WebCore15DatabaseTracker15populateOriginsEv
+__ZN7WebCore18OriginQuotaManagerC1Ev
+__ZN7WebCore18OriginQuotaManagerC2Ev
+__ZN7WebCore15DatabaseTracker19openTrackerDatabaseEb
+__ZNK7WebCore15DatabaseTracker19trackerDatabasePathEv
+__ZN7WebCore15DatabaseTracker14usageForOriginEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker18originQuotaManagerEv
+__ZN7WebCore18OriginQuotaManager4lockEv
+__ZNK7WebCore18OriginQuotaManager12tracksOriginEPNS_14SecurityOriginE
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS
+__ZN7WebCore18OriginQuotaManager11trackOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
+__ZN7WebCore17OriginUsageRecordC1Ev
+__ZN7WebCore17OriginUsageRecordC2Ev
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS_10HashTraitsIS4_EE
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS2
+__ZN7WebCore15DatabaseTracker22databaseNamesForOriginEPNS_14SecurityOriginERN3WTF6VectorINS_6StringELm0EEE
+__ZNK7WebCore18OriginQuotaManager9diskUsageEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS_10HashTraitsIS4_E
+__ZN7WebCore17OriginUsageRecord9diskUsageEv
+__ZN7WebCore18OriginQuotaManager6unlockEv
+__ZN7WebCore15DatabaseTracker19hasEntryForDatabaseEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS6_IyEEE3getEPS3_
+__ZN7WebCore18SecurityOriginHash4hashEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker8setQuotaEPNS_14SecurityOriginEy
+__ZN7WebCore7CString11mutableDataEv
+__ZN7WebCore7CString18copyBufferIfNeededEv
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashEN
+__ZNK7WebCore14SecurityOrigin18databaseIdentifierEv
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS6_IyEEE3setEPS3_RKy
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS
+__ZN7WebCore8DatabaseC1EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore8DatabaseC2EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCoreL20guidForOriginAndNameERKNS_6StringES2_
+__ZNK3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3getERKS2_
+__ZN3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3setERKS2_RKi
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZN7WebCoreL9guidMutexEv
+__ZN7WebCoreL17guidToDatabaseMapEv
+__ZNK3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3
+__ZN3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3s
+__ZN3WTF9HashTableIiSt4pairIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEEENS_18PairFirstExtractorI
+__ZN3WTF7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTable
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTab
+__ZN7WebCore15DatabaseTracker19fullPathForDatabaseEPNS_14SecurityOriginERKNS_6StringEb
+__ZNK7WebCore15DatabaseTracker10originPathEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
+__ZN7WebCore18OriginQuotaManager11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
+__ZN7WebCore17OriginUsageRecord11addDatabaseERKNS_6StringES3_
+__ZN3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS6_EENS1_10Strin
+__ZN7WebCore15DatabaseTracker15addOpenDatabaseEPNS_8DatabaseE
+__ZNK7WebCore8Database18securityOriginCopyEv
+__ZN7WebCore14SecurityOrigin4copyEv
+__ZN7WebCore14SecurityOriginC1EPKS0_
+__ZN7WebCore14SecurityOriginC2EPKS0_
+__ZNK7WebCore8Database16stringIdentifierEv
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10Ha
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10Has
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS_7HashMapINS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7P
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFi
+__ZN7WebCore8Document15addOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore8Database20openAndVerifyVersionERi
+__ZN7WebCore8Document14databaseThreadEv
+__ZN7WebCore14DatabaseThreadC1Ev
+__ZN7WebCore14DatabaseThreadC2Ev
+__ZN7WebCore14DatabaseThread5startEv
+__ZN7WebCore18DatabaseAuthorizerC1Ev
+__ZN7WebCore18DatabaseAuthorizerC2Ev
+__ZN7WebCore18DatabaseAuthorizer5resetEv
+__ZN7WebCore16DatabaseOpenTaskC1EPNS_8DatabaseE
+__ZN7WebCore16DatabaseOpenTaskC2EPNS_8DatabaseE
+__ZN7WebCore12DatabaseTaskC2EPNS_8DatabaseE
+__ZN7WebCore12DatabaseTask28lockForSynchronousSchedulingEv
+__ZN7WebCore14DatabaseThread21scheduleImmediateTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore12DatabaseTaskEEEE14expandCapacityEv
+__ZN7WebCore12DatabaseTask28waitForSynchronousCompletionEv
+__ZN7WebCore14DatabaseThread19databaseThreadStartEPv
+__ZN7WebCore14DatabaseThread14databaseThreadEv
+__ZN3WTF12MessageQueueINS_6RefPtrIN7WebCore12DatabaseTaskEEEE19alwaysTruePredicateERS4_
+__ZN7WebCore12DatabaseTask11performTaskEv
+__ZN7WebCore8Database15resetAuthorizerEv
+__ZN7WebCore16DatabaseOpenTask13doPerformTaskEv
+__ZN7WebCore8Database20performOpenAndVerifyERi
+__ZN7WebCore14SQLiteDatabase13setAuthorizerEN3WTF10PassRefPtrINS_18DatabaseAuthorizerEEE
+__ZN7WebCore14SQLiteDatabase16enableAuthorizerEb
+__ZN7WebCore8Database21databaseInfoTableNameEv
+__ZN7WebCore14SQLiteDatabase18authorizerFunctionEPviPKcS3_S3_S3_
+__ZN7WebCore18DatabaseAuthorizer9allowReadERKNS_6StringES3_
+__ZN7WebCore18DatabaseAuthorizer20denyBasedOnTableNameERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11allowInsertERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11createTableERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11createIndexERKNS_6StringES3_
+__ZN7WebCore18DatabaseAuthorizer11allowUpdateERKNS_6StringES3_
+__ZN7WebCoreL16guidToVersionMapEv
+__ZN7WebCore8Database22getVersionFromDatabaseERNS_6StringE
+__ZN7WebCoreL18databaseVersionKeyEv
+__ZN7WebCore18DatabaseAuthorizer7disableEv
+__ZN7WebCore18DatabaseAuthorizer6enableEv
+__ZN7WebCore8Database20setVersionInDatabaseERKNS_6StringE
+__ZN3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiN7WebCore6StringEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsI
+__ZN7WebCore8Database19performPolicyChecksEv
+__ZN7WebCore16DatabaseOpenTaskD0Ev
+__ZN7WebCore12DatabaseTaskD2Ev
+__ZN7WebCore15DatabaseTracker18setDatabaseDetailsEPNS_14SecurityOriginERKNS_6StringES5_m
+__ZN7WebCore19InspectorController15didOpenDatabaseEPNS_8DatabaseERKNS_6StringES5_S5_
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DatabaseE
+__ZN7WebCore10JSDatabase15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSDatabaseC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DatabaseEEE
+__ZN7WebCore10JSDatabaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DatabaseEEE
+__ZN7WebCore10JSDatabase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSDatabasePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsDatabasePrototypeFunctionTransactionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSDatabase9classInfoEv
+__ZN7WebCore10JSDatabase11transactionEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore30JSCustomSQLTransactionCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore30JSCustomSQLTransactionCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore8Database11transactionEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS2_INS_27SQLTransactionErrorCallbackEEENS2_
+__ZN7WebCore14SQLTransaction6createEPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionError
+__ZN7WebCore14SQLTransactionC1EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallb
+__ZN7WebCore14SQLTransactionC2EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallb
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore14SQLTransactionEEEE14expandCapacityEv
+__ZN7WebCore8Database19scheduleTransactionEv
+__ZN7WebCore23DatabaseTransactionTaskC1EN3WTF10PassRefPtrINS_14SQLTransactionEEE
+__ZN7WebCore23DatabaseTransactionTaskC2EN3WTF10PassRefPtrINS_14SQLTransactionEEE
+__ZN7WebCore14DatabaseThread12scheduleTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
+__ZN7WebCore23DatabaseTransactionTask13doPerformTaskEv
+__ZN7WebCore14SQLTransaction15performNextStepEv
+__ZN7WebCore14SQLTransaction28checkAndHandleClosedDatabaseEv
+__ZN7WebCore14SQLTransaction27openTransactionAndPreflightEv
+__ZNK7WebCore8Database11maximumSizeEv
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3get
+__ZN7WebCore11getFileSizeERKNS_6StringERx
+__ZNK7WebCore8Database12databaseSizeEv
+__ZN7WebCore14SQLiteDatabase14setMaximumSizeEx
+__ZN7WebCore14SQLiteDatabase8pageSizeEv
+__ZN7WebCore6String6numberEx
+__ZN7WebCore18DatabaseAuthorizer16allowTransactionEv
+__ZN7WebCore8Database27scheduleTransactionCallbackEPNS_14SQLTransactionE
+__ZN7WebCore23DatabaseTransactionTaskD0Ev
+__ZN7WebCore8Database22deliverPendingCallbackEPv
+__ZN7WebCore14SQLTransaction22performPendingCallbackEv
+__ZN7WebCore14SQLTransaction26deliverTransactionCallbackEv
+__ZN7WebCore30JSCustomSQLTransactionCallback11handleEventEPNS_14SQLTransactionERb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SQLTransactionE
+__ZN7WebCore16JSSQLTransaction15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSQLTransactionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SQLTransactionEEE
+__ZN7WebCore16JSSQLTransactionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SQLTransactionEEE
+__ZN7WebCore14SQLTransaction31deliverTransactionErrorCallbackEv
+__ZN7WebCore8Database23scheduleTransactionStepEPNS_14SQLTransactionE
+__ZN7WebCore14SQLTransaction36cleanupAfterTransactionErrorCallbackEv
+__ZN7WebCore17SQLiteTransaction8rollbackEv
+__ZN7WebCore30JSCustomSQLTransactionCallbackD0Ev
+__ZN7WebCore30JSCustomSQLTransactionCallback10deleteDataEPv
+__ZN7WebCore25JSSQLTransactionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSQLTransactionPrototypeFunctionExecuteSqlEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSSQLTransaction9classInfoEv
+__ZN7WebCore16JSSQLTransaction10executeSqlEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore28JSCustomSQLStatementCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore28JSCustomSQLStatementCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore14SQLTransaction10executeSQLERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallb
+__ZN7WebCore12SQLStatement6createERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEEN
+__ZN7WebCore12SQLStatementC1ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_IN
+__ZN7WebCore12SQLStatementC2ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_IN
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC2ERKS3_
+__ZNK7WebCore8Database22versionMatchesExpectedEv
+__ZNK3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore14SQLTransaction16enqueueStatementEN3WTF10PassRefPtrINS_12SQLStatementEEE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore12SQLStatementEEEE14expandCapacityEv
+__ZN3WTF16ThreadSafeSharedIN7WebCore12SQLStatementEE5derefEv
+__ZN7WebCore14SQLTransaction23scheduleToRunStatementsEv
+__ZN7WebCore14SQLTransaction13runStatementsEv
+__ZN7WebCore14SQLTransaction16getNextStatementEv
+__ZN7WebCore14SQLTransaction19runCurrentStatementEv
+__ZN7WebCore12SQLStatement7executeEPNS_8DatabaseE
+__ZN7WebCore12SQLStatement22clearFailureDueToQuotaEv
+__ZNK7WebCore12SQLStatement29lastExecutionFailedDueToQuotaEv
+__ZN7WebCore14SQLiteDatabase12lastErrorMsgEv
+__ZN7WebCore14SQLTransaction27handleCurrentStatementErrorEv
+__ZN7WebCore14SQLTransaction24deliverStatementCallbackEv
+__ZN7WebCore12SQLStatement15performCallbackEPNS_14SQLTransactionE
+__ZN7WebCore33JSCustomSQLStatementErrorCallback11handleEventEPNS_14SQLTransactionEPNS_8SQLErrorE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SQLErrorE
+__ZN7WebCore10JSSQLError15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSQLErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SQLErrorEEE
+__ZN7WebCore10JSSQLErrorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SQLErrorEEE
+__ZN7WebCore28JSCustomSQLStatementCallbackD0Ev
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackD0Ev
+__ZN7WebCore14SQLTransaction22handleTransactionErrorEb
+__ZN7WebCore10JSSQLErrorD1Ev
+__ZN7WebCore10JSSQLErrorD2Ev
+__ZN7WebCore16JSSQLTransactionD1Ev
+__ZN7WebCore16JSSQLTransactionD2Ev
+__ZN7WebCore14SQLTransactionD1Ev
+__ZN7WebCore14SQLTransactionD2Ev
+__ZN7WebCore8Database4stopEv
+__ZN7WebCore14DatabaseThread23unscheduleDatabaseTasksEPNS_8DatabaseE
+__ZN7WebCore14DatabaseThread18requestTerminationEv
+__ZN7WebCore19JSSQLErrorPrototypeD1Ev
+__ZN7WebCore25JSSQLTransactionPrototypeD1Ev
+__ZN7WebCore10JSDatabaseD1Ev
+__ZN7WebCore10JSDatabaseD2Ev
+__ZN7WebCore8DatabaseD1Ev
+__ZN7WebCore8DatabaseD2Ev
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22I
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInva
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore15DatabaseTracker18removeOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore8Document18removeOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore14SQLiteDatabaseD1Ev
+__ZN7WebCore14SQLiteDatabaseD2Ev
+__ZN7WebCore19JSDatabasePrototypeD1Ev
+__ZN7WebCore14DatabaseThreadD1Ev
+__ZN7WebCore14DatabaseThreadD2Ev
+__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore13MimeTypeArray4itemEj
+__ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType4typeEv
+__ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
+__ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
+__ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
+__ZN7WebCore10ClientRectC1Ev
+__ZN7WebCore10ClientRectC2Ev
+__ZN7WebCoreL14isSVG11FeatureERKNS_6StringE
+__ZN7WebCoreL9addStringERN3WTF7HashSetINS_6StringENS_15CaseFoldingHashENS0_10HashTraitsIS2_EEEEPKc
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_2
+__ZN7WebCore40setJSCanvasRenderingContext2DGlobalAlphaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D14setGlobalAlphaEf
+__ZN7WebCore12RenderInline20childBecameNonInlineEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler20resizeLayerDestroyedEv
+__ZN7WebCore14RenderThemeMac20paintMediaMuteButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac20paintMediaPlayButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac21paintMediaSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac21paintMediaSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac24paintMediaSeekBackButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac27paintMediaSeekForwardButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore11RenderVideo10renderNameEv
+__ZN7WebCoreL19metadataConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGMetadataElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGMetadataElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZThn240_NK7WebCore18SVGGradientElement14contextElementEv
+__ZNK7WebCore18SVGGradientElement14contextElementEv
+__ZNK3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8c
+__ZN7WebCore18SVGMetadataElementD0Ev
+__ZN7WebCoreL8toHebrewEi
+__ZN7WebCoreL17toHebrewUnder1000EiPt
+__ZN7WebCore14ResourceHandle15scheduleFailureENS0_11FailureTypeE
+__ZN7WebCore11FrameLoader27checkLoadCompleteTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore9CSSParser24createFloatingMediaQueryEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCoreL21colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore23screenDepthPerComponentEPNS_6WidgetE
+__ZN7WebCoreL20parseMediaDescriptorERKNS_6StringE
+__ZN7WebCoreL30min_monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore18screenIsMonochromeEPNS_6WidgetE
+__ZN7WebCoreL11numberValueEPNS_8CSSValueERf
+__ZN7WebCoreL25animationMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL32min_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL32max_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL20gridMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26max_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL22heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore40jsMediaListPrototypeFunctionDeleteMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore9MediaList12deleteMediumERKNS_6StringERi
+__ZN7WebCore40jsMediaListPrototypeFunctionAppendMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9MediaList12appendMediumERKNS_6StringERi
 __ZNK7WebCore10MediaQueryeqERKS0_
-__ZN7WebCore38max_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore20gridMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZNK7WebCore27TranslateTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore23WebKitCSSTransformValue7cssTextEv
-__ZNK7WebCore12RenderApplet13intrinsicSizeEv
-__ZN7WebCore12RenderInline6layoutEv
-__ZN7WebCore17HTMLOptionElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17CSSPrimitiveValueD2Ev
-__ZN7WebCore22addDirectionalOverrideERKNS_7TextRunEb
+__ZN7WebCoreL38max_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL27orientationMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore32setJSHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL26min_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28transform_2dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28transform_3dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26transitionMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore27MediaControlTimelineElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore16PDFDocumentImage18destroyDecodedDataEb
+__ZN7WebCore16PDFDocumentImageD0Ev
+__ZNK7WebCore17StyleMultiColDataeqERKS0_
+__ZN7WebCoreL26ignorableWhitespaceHandlerEPvPKhi
+__ZL18initxsltNextImportP15_xsltStylesheet
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE6shrinkEm
+__ZN7WebCore13HTMLTokenizer9parseTextERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore19InspectorController14enableProfilerEb
+__ZN7WebCore21JavaScriptDebugServer27recompileAllJSFunctionsSoonEv
+__ZN7WebCore33jsConsolePrototypeFunctionProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console7profileERKN3JSC7UStringEPNS_15ScriptCallStackE
+__ZN7WebCore36jsConsolePrototypeFunctionProfileEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console10profileEndERKN3JSC7UStringEPNS_15ScriptCallStackE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE15reserveCapacityEm
+__ZN7WebCore19InspectorController10addProfileEN3WTF10PassRefPtrIN3JSC7ProfileEEEjRKNS3_7UStringE
+__ZN7WebCore19InspectorController26addProfileMessageToConsoleEN3WTF10PassRefPtrIN3JSC7ProfileEEEjRKNS3_7UStringE
+__ZN7WebCore14ConsoleMessageC1ENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_j
+__ZN7WebCore14ConsoleMessageC2ENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_j
+__ZN7WebCore19InspectorController17addConsoleMessageEPN3JSC9ExecStateEPNS_14ConsoleMessageE
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE15reserveCapacityEm
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS0_7ProfileE
+__ZN7WebCoreL12profileCacheEv
+__ZNK3WTF7HashMapIPN3JSC7ProfileEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCoreL12ProfileClassEv
+__ZN3WTF7HashMapIPN3JSC7ProfileEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC7ProfileESt4pairIS3_PNS1_8JSObjectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCoreL16getTitleCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL15getHeadCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS0_11ProfileNodeE
+__ZN7WebCoreL16profileNodeCacheEv
+__ZNK3WTF7HashMapIPN3JSC11ProfileNodeEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCore16ProfileNodeClassEv
+__ZN3WTF7HashMapIPN3JSC11ProfileNodeEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC11ProfileNodeESt4pairIS3_PNS1_8JSObjectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTr
+__ZN7WebCoreL15getFunctionNameEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL10getVisibleEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL6getURLEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL13getLineNumberEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL11getChildrenEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
+__ZN7WebCore5TimerINS_21JavaScriptDebugServerEE5firedEv
+__ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
+__ZNK3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEdeEv
+__ZN3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEppEv
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC16FunctionBodyNodeEEES4_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EES8_E3addEPS3_RKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC16FunctionBodyNodeEEESt4pairIS4_S4_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairH
+__ZN3JSC6Parser5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStri
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE6shrinkEm
+__ZN7WebCoreL8finalizeEP13OpaqueJSValue
+__ZNK7WebCore14ConsoleMessage7isEqualEPN3JSC9ExecStateEPS0_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE6shrinkEm
+__ZN7WebCoreL12callNodeListEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17InspectorResourceC1ExPNS_14DocumentLoaderE
+__ZN7WebCore17InspectorResourceC2ExPNS_14DocumentLoaderE
+__ZN7WebCore17InspectorResource13updateRequestERKNS_15ResourceRequestE
+__ZN7WebCore19InspectorController11addResourceEPNS_17InspectorResourceE
+__ZN3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3setERKxRKS4_
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_E
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore5FrameEEESt4pairIS4_PNS_7HashMapIxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10Has
+__ZN7WebCore17InspectorResource11startTimingEv
+__ZN7WebCore17InspectorResource14updateResponseERKNS_16ResourceResponseE
+__ZN7WebCore17InspectorResource24markResponseReceivedTimeEv
+__ZN7WebCore19InspectorController14pruneResourcesEPN3WTF7HashMapIxNS1_6RefPtrINS_17InspectorResourceEEENS1_7IntHashIyEENS1_10Ha
+__ZN3WTF9HashTableIxSt4pairIxNS_6RefPtrIN7WebCore17InspectorResourceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIyEENS_14PairHa
+__ZN7WebCore17InspectorResource9addLengthEi
+__ZN7WebCore19InspectorController14removeResourceEPNS_17InspectorResourceE
+__ZN7WebCore17InspectorResource9endTimingEv
+__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
+__ZN7WebCore19InspectorController18toggleRecordButtonEb
+__ZN7WebCore22CSSQuirkPrimitiveValueD0Ev
+__ZN7WebCore16jsStyleSheetHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18RenderTableSection16leftmostPositionEbb
+__ZNK7WebCore4Font31offsetForPositionForComplexTextERKNS_7TextRunEib
+__ZN7WebCore18CoreTextController17offsetForPositionEib
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE11reverseRunsEjj
 __ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE5embedEN3WTF7Unicode9DirectionE
-__ZNK7WebCore24MatrixTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore24MatrixTransformOperation17isMatrixOperationEv
-__ZN7WebCore24MatrixTransformOperationD1Ev
-__ZN7WebCore24MatrixTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZNK7WebCore15AffineTransform8mapPointERKNS_8IntPointE
-__ZN7WebCore10ShadowDataD2Ev
-__ZN7WebCore19HTMLTextAreaElement7setColsEi
-__ZN7WebCore13RenderListBox24isPointInOverflowControlERNS_13HitTestResultEiiii
-__ZN7WebCore4Path10addEllipseERKNS_9FloatRectE
-__ZSt21__unguarded_partitionIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EET_S8_S8_T0_T1_
-__ZN7WebCore24CanvasRenderingContext2D14setGlobalAlphaEf
-__ZN7WebCore15GraphicsContext8setAlphaEf
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEff
-__ZN7WebCore16PDFDocumentImageD1Ev
-__ZNK7WebCore16DeprecatedString5rightEj
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE23commitExplicitEmbeddingEv
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
+__ZN7WebCore36jsRangePrototypeFunctionSetEndBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range12setEndBeforeEPNS_4NodeERi
+__ZN3WTF6VectorI6CGSizeLm256EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorI6CGSizeLm256EE14expandCapacityEm
+__ZN3WTF6VectorI6CGSizeLm256EE15reserveCapacityEm
+__ZN3WTF6VectorItLm256EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm256EE14expandCapacityEm
+__ZN3WTF6VectorItLm256EE15reserveCapacityEm
+__ZN7WebCore32setJSHTMLTableCellElementRowSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setRowSpanEi
+__ZN7WebCore8JSWorker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSWorkerOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17jsWorkerOnmessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSWorkerContext18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSWorkerContext24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL23getJSWorkerContextTableEPN3JSC9ExecStateE
+__ZN7WebCore24JSWorkerContextPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL32getJSWorkerContextPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore15JSWorkerContext9classInfoEv
+__ZN7WebCore15JSWorkerContext4markEv
+__ZNK7WebCore19JSWorkerContextBase22scriptExecutionContextEv
+__ZN7WebCore43jsWorkerContextPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext11postMessageERKNS_6StringE
+__ZThn8_N7WebCore20WorkerMessagingProxy25postMessageToWorkerObjectERKNS_6StringE
+__ZN7WebCore20WorkerMessagingProxy25postMessageToWorkerObjectERKNS_6StringE
+__ZN7WebCore17MessageWorkerTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore6Worker15dispatchMessageERKNS_6StringE
+__ZThn32_N7WebCore6Worker14refEventTargetEv
+__ZN7WebCore6Worker14refEventTargetEv
+__ZN7WebCore11EventTarget16toXMLHttpRequestEv
+__ZN7WebCore11EventTarget22toXMLHttpRequestUploadEv
+__ZN7WebCore11EventTarget21toDOMApplicationCacheEv
+__ZN7WebCore11EventTarget13toMessagePortEv
+__ZThn32_N7WebCore6Worker8toWorkerEv
+__ZN7WebCore6Worker8toWorkerEv
+__ZN7WebCore17MessageWorkerTaskD0Ev
+__ZNK3JSC14JSGlobalObject21shouldInterruptScriptEv
+__ZN7WebCore19WebCoreJSClientDataD0Ev
+__ZThn32_N7WebCore6Worker16derefEventTargetEv
+__ZN7WebCore6Worker16derefEventTargetEv
+__ZN7WebCore18setJSWorkerOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore6Worker18dispatchErrorEventEv
+__ZN7WebCore36jsWorkerPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6Worker11postMessageERKNS_6StringE
+__ZN7WebCore20WorkerMessagingProxy26postMessageToWorkerContextERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE15reserveCapacityEm
+__ZN7WebCore13WorkerRunLoop8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop15postTaskForModeEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEERKNS_6StringE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore13WorkerRunLoop4TaskEEEE14expandCapacityEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE6shrinkEm
+__ZN7WebCore15JSWorkerContext3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSWorkerContextOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24MessageWorkerContextTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore13WorkerContext15dispatchMessageERKNS_6StringE
+__ZThn96_N7WebCore13WorkerContext14refEventTargetEv
+__ZN7WebCore13WorkerContext14refEventTargetEv
+__ZNK7WebCore22ScriptExecutionContext10isDocumentEv
+__ZN7WebCore11EventTarget8toWorkerEv
+__ZThn96_N7WebCore13WorkerContext15toWorkerContextEv
+__ZN7WebCore13WorkerContext15toWorkerContextEv
+__ZNK7WebCore13WorkerContext15isWorkerContextEv
+__ZN7WebCore24jsWorkerContextNavigatorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13WorkerContext9navigatorEv
+__ZN7WebCore15WorkerNavigatorC1ERKNS_6StringE
+__ZN7WebCore15WorkerNavigatorC2ERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15WorkerNavigatorE
+__ZN7WebCore17JSWorkerNavigator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSWorkerNavigatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WorkerNavigatorEEE
+__ZN7WebCore17JSWorkerNavigatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WorkerNavigatorEEE
+__ZN7WebCore17JSWorkerNavigator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL25getJSWorkerNavigatorTableEPN3JSC9ExecStateE
+__ZN7WebCore13WorkerContext13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZThn8_N7WebCore20WorkerMessagingProxy30confirmMessageFromWorkerObjectEb
+__ZN7WebCore20WorkerMessagingProxy30confirmMessageFromWorkerObjectEb
+__ZN7WebCore24MessageWorkerContextTaskD0Ev
+__ZThn96_N7WebCore13WorkerContext16derefEventTargetEv
+__ZN7WebCore13WorkerContext16derefEventTargetEv
+__ZN7WebCore23jsWorkerContextLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13WorkerContext8locationEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14WorkerLocationE
+__ZN7WebCore16JSWorkerLocation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSWorkerLocationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14WorkerLocationEEE
+__ZN7WebCore16JSWorkerLocationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14WorkerLocationEEE
+__ZN7WebCore16JSWorkerLocation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSWorkerLocationTableEPN3JSC9ExecStateE
+__ZN7WebCore17JSWorkerNavigatorD1Ev
+__ZN7WebCore17JSWorkerNavigatorD2Ev
+__ZN7WebCore26JSWorkerNavigatorPrototypeD1Ev
+__ZN7WebCore16JSWorkerLocationD1Ev
+__ZN7WebCore16JSWorkerLocationD2Ev
+__ZN7WebCore25JSWorkerLocationPrototypeD1Ev
+__ZN7WebCore15WorkerNavigatorD0Ev
+__ZN7WebCore48jsWorkerContextPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS1_16AtomicStringHashENS_10HashTrai
+__ZN3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEEENS_18PairFirstExtracto
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC2ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEaSERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE6shrinkEm
+__ZN7WebCore51jsWorkerContextPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore45jsWorkerContextPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore40jsWorkerContextWorkerLocationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSWorkerLocation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSWorkerLocationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSWorkerLocationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSWorkerLocationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSWorkerLocationConstructor9classInfoEv
+__ZN7WebCore25JSWorkerLocationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSWorkerLocationPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore41jsWorkerLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSWorkerLocation9classInfoEv
+__ZNK7WebCore14WorkerLocation8toStringEv
+__ZN7WebCore20jsWorkerLocationHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4hrefEv
+__ZN7WebCore24jsWorkerLocationProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation8protocolEv
+__ZN7WebCore20jsWorkerLocationHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4hostEv
+__ZN7WebCore24jsWorkerLocationHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation8hostnameEv
+__ZN7WebCore20jsWorkerLocationPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4portEv
+__ZN7WebCore24jsWorkerLocationPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation8pathnameEv
+__ZN7WebCore22jsWorkerLocationSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation6searchEv
+__ZN7WebCore20jsWorkerLocationHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4hashEv
+__ZN7WebCore27JSWorkerLocationConstructorD1Ev
+__ZNK7WebCore17JSWorkerNavigator9classInfoEv
+__ZN7WebCore24jsWorkerNavigatorAppNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsWorkerNavigatorAppVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15WorkerNavigator9userAgentEv
+__ZN7WebCore25jsWorkerNavigatorPlatformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsWorkerNavigatorUserAgentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsWorkerNavigatorOnLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWorkerContextSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13WorkerContextE
+__ZN7WebCore41setJSWorkerContextMessageEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22setJSWorkerContextSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34jsWorkerPrototypeFunctionTerminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsWorkerContextPrototypeFunctionSetTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext10setTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext10setTimeoutEPNS_15ScheduledActionEi
+__ZNK7WebCore13WorkerContext22scriptExecutionContextEv
+__ZN7WebCore44jsWorkerContextPrototypeFunctionClearTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext12clearTimeoutEi
+__ZN7WebCore43jsWorkerContextPrototypeFunctionSetIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext11setIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext11setIntervalEPNS_15ScheduledActionEi
+__ZN7WebCore17WorkerSharedTimer11setFireTimeEd
+__ZN7WebCore15ScheduledAction7executeEPNS_13WorkerContextE
+__ZN7WebCore45jsWorkerContextPrototypeFunctionClearIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext13clearIntervalEi
+__ZN7WebCore23jsXMLHttpRequestOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsXMLHttpRequestOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsXMLHttpRequestOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsXMLHttpRequestOnloadstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsXMLHttpRequestOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsXMLHttpRequestOnreadystatechangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsXMLHttpRequestUploadOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsXMLHttpRequestUploadOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsXMLHttpRequestUploadOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsXMLHttpRequestUploadOnloadstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsXMLHttpRequestUploadOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29JSXMLHttpRequestProgressEvent9classInfoEv
+__ZN7WebCoreL37getJSXMLHttpRequestProgressEventTableEPN3JSC9ExecStateE
+__ZNK7WebCore38JSXMLHttpRequestProgressEventPrototype9classInfoEv
+__ZN7WebCoreL46getJSXMLHttpRequestProgressEventPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore24JSProgressEventPrototype9classInfoEv
+__ZN7WebCore29JSXMLHttpRequestProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore37jsXMLHttpRequestProgressEventPositionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsXMLHttpRequestProgressEventTotalSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsRangePrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5XPath5Union8evaluateEv
+__ZNK7WebCore5XPath12FunSubstring8evaluateEv
+__ZN7WebCore5XPath8FunRound5roundEd
+__ZN7WebCore5XPath4PathC1EPNS0_6FilterEPNS0_12LocationPathE
+__ZN7WebCore5XPath4PathC2EPNS0_6FilterEPNS0_12LocationPathE
+__ZNK7WebCore5XPath4Path8evaluateEv
+__ZN7WebCore5XPath4PathD0Ev
+__ZNK7WebCore5XPath9FunNumber8evaluateEv
+__ZNK7WebCore5XPath15FunStringLength8evaluateEv
+__ZNK7WebCore5XPath17FunNormalizeSpace8evaluateEv
+__ZNK7WebCore5XPath7FunName8evaluateEv
+__ZN7WebCoreL24createSVGGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore13JSSVGGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGGElementEEE
+__ZN7WebCore13JSSVGGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGGElementEEE
+__ZN7WebCore13JSSVGGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGGElement9classInfoEv
+__ZNK7WebCore5XPath17FunSubstringAfter8evaluateEv
+__ZNK7WebCore5XPath8FunFalse8evaluateEv
+__ZN7WebCore13JSSVGGElementD1Ev
+__ZN7WebCore22JSSVGGElementPrototypeD1Ev
+__ZThn8_N7WebCore11SVGGElementD0Ev
+__ZN3WTF6VectorItLm1024EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm1024EE14expandCapacityEm
+__ZN3WTF6VectorItLm1024EE15reserveCapacityEm
+__ZNK7WebCore5XPath12FunTranslate8evaluateEv
+__ZNK7WebCore5XPath10FunBoolean8evaluateEv
+__ZNK7WebCore5XPath7FunTrue8evaluateEv
+__ZNK7WebCore5XPath7FunLang8evaluateEv
+__ZN7WebCore5XPathL12createFunSumEv
+__ZNK7WebCore5XPath6FunSum8evaluateEv
+__ZN7WebCore5XPath6FunSumD0Ev
+__ZNK7WebCore5XPath8FunFloor8evaluateEv
+__ZNK7WebCore5XPath10FunCeiling8evaluateEv
+__ZNK7WebCore5XPath8FunRound8evaluateEv
+__ZNK7WebCore5XPath8Negative8evaluateEv
+__ZNK7WebCore5XPath8FunCount8evaluateEv
+__ZNK7WebCore5XPath15FunNamespaceURI8evaluateEv
+__ZN7WebCore48jsXSLTProcessorPrototypeFunctionImportStylesheetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor16importStylesheetEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor19transformToFragmentEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor19transformToFragmentEPNS_4NodeEPNS_8DocumentE
+__ZN7WebCoreL13docLoaderFuncEPKhP8_xmlDictiPv12xsltLoadType
+__ZN7WebCoreL20exsltNodeSetFunctionEP22_xmlXPathParserContexti
+__ZL23initxsltFunctionNodeSetP22_xmlXPathParserContexti
+__ZN7WebCore44jsXSLTProcessorPrototypeFunctionSetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor12setParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor12setParameterERKNS_6StringES3_S3_
+__ZN7WebCore44jsXSLTProcessorPrototypeFunctionGetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor12getParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore13XSLTProcessor12getParameterERKNS_6StringES3_
+__ZL17initxsltGetNsPropP8_xmlNodePKhS2_
+__ZN7WebCore13XSLStyleSheet14loadChildSheetERKNS_6StringE
+__ZN7WebCore13XSLImportRuleC1EPNS_13XSLStyleSheetERKNS_6StringE
+__ZN7WebCore13XSLImportRuleC2EPNS_13XSLStyleSheetERKNS_6StringE
+__ZN7WebCore13XSLImportRule9loadSheetEv
+__ZNK7WebCore13XSLStyleSheet15isXSLStyleSheetEv
+__ZNK7WebCore13XSLImportRule16parentStyleSheetEv
+__ZN7WebCore13XSLImportRule12isImportRuleEv
+__ZN7WebCore13XSLImportRule9isLoadingEv
+__ZThn24_N7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLStyleSheetC1EPNS_13XSLImportRuleERKNS_6StringE
+__ZN7WebCore13XSLStyleSheetC2EPNS_13XSLImportRuleERKNS_6StringE
+__ZN7WebCore13XSLStyleSheet19setParentStyleSheetEPS0_
+__ZN7WebCore13XSLStyleSheet27locateStylesheetSubResourceEP7_xmlDocPKh
+__ZN7WebCore13XSLStyleSheet15markAsProcessedEv
+__ZN7WebCore13XSLImportRuleD0Ev
+__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor19transformToDocumentEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor19transformToDocumentEPNS_4NodeE
+__ZN7WebCore23xsltUnicodeSortFunctionEP21_xsltTransformContextPP8_xmlNodei
+__ZL25initxsltComputeSortResultP21_xsltTransformContextP8_xmlNode
+__ZNK7WebCore9DocLoader24printAccessDeniedMessageERKNS_4KURLE
+__ZNK7WebCore9StyleBase15isXSLStyleSheetEv
+__ZN7WebCore13XSLTProcessor14parseErrorFuncEPvP9_xmlError
+__ZN7WebCore37jsXSLTProcessorPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore47jsXSLTProcessorPrototypeFunctionRemoveParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor15removeParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor15removeParameterERKNS_6StringES3_
+__ZN7WebCore47jsXSLTProcessorPrototypeFunctionClearParametersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZL24initxsltLoadStylesheetPIP7_xmlDoc
+__ZN7WebCore21ApplicationCacheGroup11selectCacheEPNS_5FrameERKNS_4KURLE
+__ZN7WebCore23ApplicationCacheStorage22findOrCreateCacheGroupERKNS_4KURLE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_21ApplicationCacheGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_21ApplicationCacheGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_1
+__ZN7WebCore23ApplicationCacheStorage14loadCacheGroupERKNS_4KURLE
+__ZN7WebCore21ApplicationCacheGroupC1ERKNS_4KURLEb
+__ZN7WebCore21ApplicationCacheGroupC2ERKNS_4KURLEb
+__ZN3WTF7HashMapIjjN7WebCore13AlreadyHashedENS_10HashTraitsIjEES4_E3addERKjS7_
+__ZN3WTF9HashTableIjSt4pairIjjENS_18PairFirstExtractorIS2_EEN7WebCore13AlreadyHashedENS_14PairHashTraitsINS_10HashTraitsIjEES9_
+__ZN7WebCore14DocumentLoader33setCandidateApplicationCacheGroupEPNS_21ApplicationCacheGroupE
+__ZN3WTF7HashSetIPN7WebCore14DocumentLoaderENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandE
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13alloca
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallo
+__ZN7WebCore21ApplicationCacheGroup6updateEPNS_5FrameENS_28ApplicationCacheUpdateOptionE
+__ZN7WebCore21ApplicationCacheGroup16postListenerTaskEMNS_19DOMApplicationCacheEFvvERKN3WTF7HashSetIPNS_14DocumentLoaderENS4_7P
+__ZN7WebCore21ApplicationCacheGroup16postListenerTaskEMNS_19DOMApplicationCacheEFvvEPNS_14DocumentLoaderE
+__ZN7WebCore21ApplicationCacheGroup20createResourceHandleERKNS_4KURLEPNS_24ApplicationCacheResourceE
+__ZN7WebCore54jsDOMApplicationCachePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSDOMApplicationCache16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore19DOMApplicationCache22scriptExecutionContextEv
+__ZN7WebCore19DOMApplicationCache16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore21ApplicationCacheGroup27finishedLoadingMainResourceEPNS_14DocumentLoaderE
+__ZN7WebCore20ResourceHandleClient26shouldUseCredentialStorageEPNS_14ResourceHandleE
+__ZN7WebCore31ScriptExecutionContextTaskTimer5firedEv
+__ZN7WebCore21CallCacheListenerTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore19DOMApplicationCache20callCheckingListenerEv
+__ZN7WebCore19DOMApplicationCache12callListenerERKNS_12AtomicStringEPNS_13EventListenerE
+__ZN7WebCore19DOMApplicationCache14refEventTargetEv
+__ZN7WebCore19DOMApplicationCache21toDOMApplicationCacheEv
+__ZN7WebCore31ScriptExecutionContextTaskTimerD0Ev
+__ZN7WebCore21CallCacheListenerTaskD0Ev
+__ZN7WebCore20ResourceHandleClient17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
+__ZN7WebCore20ResourceHandleClient17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
+__ZN7WebCore21ApplicationCacheGroup18didReceiveResponseEPNS_14ResourceHandleERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup26didReceiveManifestResponseERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup16manifestNotFoundEv
+__ZN7WebCore21ApplicationCacheGroup12makeObsoleteEv
+__ZN7WebCore23ApplicationCacheStorage22cacheGroupMadeObsoleteEPNS_21ApplicationCacheGroupE
+__ZN7WebCore21ApplicationCacheGroup11stopLoadingEv
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remove
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeE
+__ZN7WebCore21ApplicationCacheGroupD0Ev
+__ZN7WebCore23ApplicationCacheStorage19cacheGroupDestroyedEPNS_21ApplicationCacheGroupE
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN7WebCore19DOMApplicationCache17callErrorListenerEv
+__ZN7WebCore19DOMApplicationCache16derefEventTargetEv
+__ZN7WebCore24ApplicationCacheResourceC1ERKNS_4KURLERKNS_16ResourceResponseEjN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore24ApplicationCacheResourceC2ERKNS_4KURLERKNS_16ResourceResponseEjN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore21ApplicationCacheGroup14didReceiveDataEPNS_14ResourceHandleEPKcii
+__ZN7WebCore21ApplicationCacheGroup22didReceiveManifestDataEPKci
+__ZN7WebCore21ApplicationCacheGroup16didFinishLoadingEPNS_14ResourceHandleE
+__ZN7WebCore21ApplicationCacheGroup24didFinishLoadingManifestEv
+__ZN7WebCore13parseManifestERKNS_4KURLEPKciRNS_8ManifestE
+__ZN7WebCore16ApplicationCacheC1Ev
+__ZN7WebCore16ApplicationCacheC2Ev
+__ZN7WebCore16ApplicationCache8setGroupEPNS_21ApplicationCacheGroupE
+__ZN7WebCore21ApplicationCacheGroup32associateDocumentLoaderWithCacheEPNS_14DocumentLoaderEPNS_16ApplicationCacheE
+__ZN7WebCore14DocumentLoader19setApplicationCacheEN3WTF10PassRefPtrINS_16ApplicationCacheEEE
+__ZN7WebCore21ApplicationCacheGroup8addEntryERKNS_6StringEj
+__ZN7WebCore16ApplicationCache14resourceForURLERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_24ApplicationCacheResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EE
+__ZN3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3addERKS2_RKj
+__ZN7WebCore16ApplicationCache18setOnlineWhitelistERKN3WTF6VectorINS_4KURLELm0EEE
+__ZN3WTF6VectorIN7WebCore4KURLELm0EEaSERKS3_
+__ZN7WebCore16ApplicationCache15setFallbackURLsERKN3WTF6VectorISt4pairINS_4KURLES4_ELm0EEE
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EEaSERKS5_
+__ZN7WebCore21ApplicationCacheGroup17startLoadingEntryEv
+__ZN7WebCore19DOMApplicationCache23callDownloadingListenerEv
+__ZN7WebCore19DOMApplicationCache20callProgressListenerEv
+__ZN7WebCore21ApplicationCacheGroup17cacheUpdateFailedEv
+__ZN7WebCore24ApplicationCacheResourceD0Ev
+__ZN7WebCore21ApplicationCacheGroup27deliverDelayedMainResourcesEv
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE15reserveCapacityEm
+__ZN7WebCore16ApplicationCacheD1Ev
+__ZN7WebCore16ApplicationCacheD2Ev
+__ZN7WebCore21ApplicationCacheGroup14cacheDestroyedEPNS_16ApplicationCacheE
+__ZNK3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3
+__ZN7WebCore21ApplicationCacheGroup21checkIfLoadIsCompleteEv
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE6shrinkEm
+__ZN7WebCore16ApplicationCache11addResourceEN3WTF10PassRefPtrINS_24ApplicationCacheResourceEEE
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_24ApplicationCacheResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_24ApplicationCacheResourceEEEENS_18PairFirstExtractorIS7_EENS1_10
+__ZN7WebCore16ApplicationCache19setManifestResourceEN3WTF10PassRefPtrINS_24ApplicationCacheResourceEEE
+__ZN7WebCore21ApplicationCacheGroup14setNewestCacheEN3WTF10PassRefPtrINS_16ApplicationCacheEEE
+__ZN3WTF7HashSetIPN7WebCore16ApplicationCacheENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN7WebCore23ApplicationCacheStorage16storeNewestCacheEPNS_21ApplicationCacheGroupE
+__ZN7WebCore23ApplicationCacheStorage19verifySchemaVersionEv
+__ZN7WebCore23ApplicationCacheStorage16executeStatementERNS_15SQLiteStatementE
+__ZN7WebCore23ApplicationCacheStorage17executeSQLCommandERKNS_6StringE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_21ApplicationCacheGroupE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_16ApplicationCacheE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_24ApplicationCacheResourceEj
+__ZN7WebCore19DOMApplicationCache18callCachedListenerEv
+__ZNK7WebCore16ApplicationCache10isCompleteEv
+__ZN7WebCore16ApplicationCache27urlMatchesFallbackNamespaceERKNS_4KURLEPS1_
+__ZN7WebCore16ApplicationCache22isURLInOnlineWhitelistERKNS_4KURLE
+__ZNK7WebCore11FrameLoader18cannotShowURLErrorERKNS_15ResourceRequestE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_23XMLHttpRequestExceptionE
+__ZN7WebCore25JSXMLHttpRequestExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23XMLHttpRequestExceptionEEE
+__ZN7WebCore25JSXMLHttpRequestExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23XMLHttpRequestExceptionEEE
+__ZN7WebCore25JSXMLHttpRequestException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSXMLHttpRequestExceptionTableEPN3JSC9ExecStateE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_21ApplicationCacheGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_
+__ZN7WebCore25JSXMLHttpRequestExceptionD1Ev
+__ZN7WebCore25JSXMLHttpRequestExceptionD2Ev
+__ZN7WebCore21ApplicationCacheGroup26disassociateDocumentLoaderEPNS_14DocumentLoaderE
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN7WebCore23ApplicationCacheStorage9loadCacheEj
+__ZN7WebCore20ResourceResponseBase18setHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore24ApplicationCacheResource7addTypeEj
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_21ApplicationCacheGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN7WebCore16ApplicationCache18resourceForRequestERKNS_15ResourceRequestE
+__ZN7WebCore19DOMApplicationCache20callNoUpdateListenerEv
+__ZN7WebCore12jsNodeOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6onloadEv
+__ZN7WebCore34setJSDOMApplicationCacheOnnoupdateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMApplicationCacheOncachedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMApplicationCacheOnupdatereadyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMApplicationCacheOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE6shrinkEm
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_24ApplicationCacheResourceEPNS_16ApplicationCacheE
+__ZN7WebCore34setJSDOMApplicationCacheOncheckingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMApplicationCacheOndownloadingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMApplicationCacheOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMApplicationCacheOnobsoleteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44jsDOMApplicationCachePrototypeFunctionUpdateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache6updateERi
+__ZN7WebCore20ResourceHandleClient15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup7didFailEPNS_14ResourceHandleERKNS_13ResourceErrorE
+__ZN7WebCore57jsDOMApplicationCachePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore21JSDOMApplicationCache19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore19DOMApplicationCache19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore29jsXMLHttpRequestExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23ApplicationCacheStorage6removeEPNS_16ApplicationCacheE
+__ZN7WebCore16ApplicationCache14clearStorageIDEv
+__ZN7WebCore21ApplicationCacheGroup14clearStorageIDEv
+__ZN7WebCore19DOMApplicationCache20callObsoleteListenerEv
+__ZN7WebCore19DOMApplicationCache23callUpdateReadyListenerEv
+__ZN7WebCore47jsDOMApplicationCachePrototypeFunctionSwapCacheEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache9swapCacheERi
+__ZN7WebCore19DOMApplicationCache9swapCacheEv
+__ZN7WebCore23ApplicationCacheStorage16storeUpdatedTypeEPNS_24ApplicationCacheResourceEPNS_16ApplicationCacheE
+__ZNK7WebCore11HistoryItem15formContentTypeEv
+__ZN7WebCore14ResourceHandle17willLoadFromCacheERNS_15ResourceRequestE
+__ZN3WTF6VectorIcLm512EE14expandCapacityEmPKc
+__ZN7WebCore18MainResourceLoader26stopLoadingForPolicyChangeEv
+__ZNK7WebCore18MainResourceLoader32interruptionForPolicyChangeErrorEv
+__ZN7WebCore11FrameLoader32interruptionForPolicyChangeErrorERKNS_15ResourceRequestE
+__ZN7WebCore18JSHTMLVideoElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLMediaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLMediaElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement6setSrcERKNS_6StringE
+-[WebCoreMovieObserver sizeChanged:]
+__ZN7WebCore18MediaPlayerPrivate11sizeChangedEv
+__ZN7WebCore11MediaPlayer11sizeChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerSizeChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerSizeChangedEPNS_11MediaPlayerE
+__ZNK7WebCore16HTMLMediaElement5endedEv
+__ZL28initQTMovieHasVideoAttributev
+__ZL32QTMovieHasVideoAttributeFunctionv
+__ZN7WebCore5TimerINS_11RenderMediaEE5firedEv
+__ZN7WebCore11RenderMedia26opacityAnimationTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11RenderMedia13changeOpacityEPNS_11HTMLElementEf
+__ZN7WebCore11RenderMedia20timeUpdateTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsHTMLMediaElementReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10readyStateEv
+__ZN7WebCore32setJSHTMLMediaElementCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement4seekEfRi
+__ZNK7WebCore16HTMLMediaElement8seekableEv
+__ZN7WebCore11MediaPlayer15maxTimeSeekableEv
+__ZNK7WebCore18MediaPlayerPrivate15maxTimeSeekableEv
+__ZN7WebCore10TimeRangesC1Eff
+__ZN7WebCore10TimeRangesC2Eff
+__ZNK7WebCore10TimeRanges7containEf
+__ZNK7WebCore10TimeRanges5startEjRi
+__ZNK7WebCore10TimeRanges3endEjRi
+__ZN7WebCore30jsHTMLMediaElementNetworkStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementSeekableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TimeRangesE
+__ZN7WebCore12JSTimeRanges15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSTimeRangesC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TimeRangesEEE
+__ZN7WebCore12JSTimeRangesC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TimeRangesEEE
+__ZN7WebCore12JSTimeRanges18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsTimeRangesLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSTimeRangesPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsTimeRangesPrototypeFunctionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12JSTimeRanges9classInfoEv
+__ZN7WebCore32jsTimeRangesPrototypeFunctionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26jsHTMLMediaElementDurationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSTimeRangesD1Ev
+__ZN7WebCore12JSTimeRangesD2Ev
+__ZN7WebCore21JSTimeRangesPrototypeD1Ev
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE6shrinkEm
+__ZN7WebCore17InspectorResourceD1Ev
+__ZN7WebCore17InspectorResourceD2Ev
+__ZN7WebCoreL19fontfaceConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGFontFaceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGFontFaceElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8Document18mappedElementSheetEv
+__ZN7WebCore18SVGFontFaceElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
+__ZN7WebCoreL25mapAttributeToCSSPropertyEPN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiE
+__ZN7WebCore18SVGFontFaceElement20insertedIntoDocumentEv
+__ZN7WebCore18SVGFontFaceElement15rebuildFontFaceEv
+__ZN7WebCore18SVGFontFaceElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL22fontfacesrcConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore21SVGFontFaceSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceSrcElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore21SVGFontFaceSrcElement8srcValueEv
+__ZN7WebCore21SVGFontFaceSrcElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL22fontfaceuriConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore21SVGFontFaceUriElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceUriElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceUriElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore21SVGFontFaceUriElement20insertedIntoDocumentEv
+__ZN7WebCore21SVGFontFaceUriElement8loadFontEv
+__ZNK7WebCore21SVGFontFaceUriElement8srcValueEv
+__ZN7WebCore18SVGFontFaceElementD0Ev
+__ZN7WebCore18SVGFontFaceElement28removeFromMappedElementSheetEv
+__ZN7WebCore21SVGFontFaceSrcElementD0Ev
+__ZN7WebCore21SVGFontFaceUriElementD0Ev
+__ZN7WebCore23JSNodeIteratorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsNodeIteratorPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNodeIterator8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore43jsNodeIteratorPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNodeIterator12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12NodeIterator12previousNodeEPN3JSC9ExecStateERi
+__ZN7WebCore12NodeIterator11NodePointer14moveToPreviousEPNS_4NodeE
+__ZN7WebCore34jsRangePrototypeFunctionCloneRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL25min_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL25max_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore28setJSHTMLTableElementCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25toHTMLTableCaptionElementEN3JSC7JSValueE
+__ZN7WebCore26setJSHTMLTableElementTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20CachedResourceClient10fontLoadedEPNS_10CachedFontE
+__ZN7WebCore13RenderSVGText29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore13RenderSVGText21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore13RenderSVGText19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore10CachedFont17ensureSVGFontDataEv
+__ZN7WebCoreL15fontConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18SVGFontFaceElement10fontFamilyEv
+__ZN7WebCoreL23missingglyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGMissingGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGMissingGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL16glyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGGlyphElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGGlyphElement20insertedIntoDocumentEv
+__ZN7WebCore15SVGGlyphElement20invalidateGlyphCacheEv
+__ZN7WebCore14SVGFontElement20invalidateGlyphCacheEv
+__ZNK7WebCore10CachedFont14getSVGFontByIdERKNS_6StringE
+__ZN7WebCore11SVGFontDataC1EPNS_18SVGFontFaceElementE
+__ZN7WebCore11SVGFontDataC2EPNS_18SVGFontFaceElementE
+__ZNK7WebCore18SVGFontFaceElement17horizontalOriginXEv
+__ZNK7WebCore18SVGFontFaceElement17horizontalOriginYEv
+__ZNK7WebCore18SVGFontFaceElement18horizontalAdvanceXEv
+__ZNK7WebCore18SVGFontFaceElement15verticalOriginXEv
+__ZNK7WebCore18SVGFontFaceElement15verticalOriginYEv
+__ZNK7WebCore18SVGFontFaceElement6ascentEv
+__ZNK7WebCore18SVGFontFaceElement16verticalAdvanceYEv
+__ZNK7WebCore18SVGFontFaceElement10unitsPerEmEv
+__ZNK7WebCore18SVGFontFaceElement7descentEv
+__ZNK7WebCore18SVGFontFaceElement7xHeightEv
+__ZNK7WebCore14SVGFontElement28getGlyphIdentifiersForStringERKNS_6StringERN3WTF6VectorINS_18SVGGlyphIdentifierELm0EEE
+__ZNK7WebCore14SVGFontElement16ensureGlyphCacheEv
+__ZNK7WebCore15SVGGlyphElement20buildGlyphIdentifierEv
+__ZN7WebCore15SVGGlyphElement27buildGenericGlyphIdentifierEPKNS_10SVGElementE
+__ZN7WebCore15pathFromSVGDataERNS_4PathERKNS_6StringE
+__ZNK3WTF7HashMapItNS_6RefPtrIN7WebCore12GlyphMapNodeEEENS_7IntHashIjEENS_10HashTraitsItEENS7_IS4_EEE3getERKt
+__ZN3WTF7HashMapItNS_6RefPtrIN7WebCore12GlyphMapNodeEEENS_7IntHashIjEENS_10HashTraitsItEENS7_IS4_EEE3setERKtRKS4_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE15reserveCapacityEm
+__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunE
+__ZN7WebCoreL33floatWidthOfSubStringUsingSVGFontEPKNS_4FontERKNS_7TextRunEiiiRiRNS_6StringE
+__ZN7WebCore16SVGTextRunWalkerINS_34SVGTextRunWalkerMeasuredLengthDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
+__ZN7WebCoreL24charactersWithArabicFormERKNS_6StringEb
+__ZNK7WebCore14SVGFontElement24firstMissingGlyphElementEv
+__ZN7WebCore11PathBuilder9svgMoveToEddbb
+__ZN7WebCore11PathBuilder9svgLineToEddb
+__ZN7WebCore15SVGGlyphElement28inheritUnspecifiedAttributesERNS_18SVGGlyphIdentifierEPKNS_11SVGFontDataE
+__ZN7WebCoreL30floatWidthUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_34SVGTextRunWalkerMeasuredLengthDataE
+__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunEiRiRNS_6StringE
+__ZNK7WebCore4Font7svgFontEv
+__ZN7WebCore28jsDocumentTypeInternalSubsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsHTMLIFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21HTMLFrameOwnerElement14getSVGDocumentERi
+__ZN7WebCore50jsHTMLObjectElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL14setConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore13SVGSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13SVGSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL26createSVGSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSSVGAnimationElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGAnimationElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSetElementEEE
+__ZN7WebCore15JSSVGSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSetElementEEE
+__ZN7WebCore21JSSVGAnimationElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimationElementEEE
+__ZN7WebCore21JSSVGAnimationElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSSVGAnimationElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGSetElement9classInfoEv
+__ZN7WebCore21jsSVGRectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_15widthAttr
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapper
+__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_23SVGAnimatedPropertyBaseENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RK
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashEN
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedLength15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9SVGLengthEEEEEPNS_10S
+__ZN7WebCore19JSSVGAnimatedLengthC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9SVGLengthEEEEEPNS_10S
+__ZN7WebCore19JSSVGAnimatedLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsSVGAnimatedLengthBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGD
+__ZN3WTF7HashMapIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_26JSSVGDynamicPODTypeW
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEEEPNS_10SVGElemen
+__ZN7WebCore11JSSVGLengthC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEEEPNS_10SVGElemen
+__ZN7WebCore26jsSVGAnimatedLengthAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF7HashMapIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_26JSSVGDynamicPODType
+__ZN7WebCore11JSSVGLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsSVGLengthUnitTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEEcvS1_Ev
+__ZN7WebCore32jsSVGLengthValueInSpecifiedUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsSVGLengthValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSSVGLength5valueEPN3JSC9ExecStateE
+__ZN7WebCore50jsSVGAnimationElementPrototypeFunctionBeginElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19SVGAnimationElement12beginElementERi
+__ZN7WebCore19SVGAnimationElement14beginElementAtEfRi
+__ZNK7WebCore14SVGSMILElement7elapsedEv
+__ZN7WebCore14SVGSMILElement12addBeginTimeENS_8SMILTimeE
+__ZN7WebCore14SVGSMILElement16beginListChangedEv
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionSetCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14setCurrentTimeEf
+__ZNK7WebCore19SVGAnimationElement7toValueEv
+__ZN7WebCore19synchronizePropertyINS_14SVGRectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore56jsSVGTextContentElementPrototypeFunctionGetNumberOfCharsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZNK7WebCore21SVGTextContentElement16getNumberOfCharsEv
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6appendIS2_EEvPKT_m
+__ZSt16__introsort_loopIPN7WebCore18SVGGlyphIdentifierElPFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt22__final_insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
+__ZSt16__insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6shrinkEm
+__ZNK7WebCore14SVGFontElement43getHorizontalKerningPairForStringsAndGlyphsERKNS_6StringES3_S3_S3_RNS_24SVGHorizontalKerningPair
+__ZNK7WebCore13RenderSVGText9isSVGTextEv
+__ZNK7WebCore16SVGRootInlineBox13svgTextChunksEv
+__ZN7WebCoreL29findInlineTextBoxInTextChunksEPKNS_21SVGTextContentElementERKN3WTF6VectorINS_12SVGTextChunkELm0EEE
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE15reserveCapacityEm
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGInlineTextBoxQueryWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS
+__ZN7WebCore27SVGInlineTextBoxQueryWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGC
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE6shrinkEm
+__ZN7WebCore61jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_
+__ZNK7WebCore21SVGTextContentElement21getComputedTextLengthEv
+__ZN7WebCore58jsSVGTextContentElementPrototypeFunctionGetSubStringLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZNK7WebCore21SVGTextContentElement18getSubStringLengthEjjRi
+__ZN7WebCore62jsSVGTextContentElementPrototypeFunctionGetStartPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0
+__ZNK7WebCore21SVGTextContentElement22getStartPositionOfCharEjRi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_10FloatPointEEEPNS_10SVGElementE
+__ZN7WebCore10JSSVGPoint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGPointC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_10FloatPointEEEEEPNS_10SVGEleme
+__ZN7WebCore10JSSVGPointC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_10FloatPointEEEEEPNS_10SVGEleme
+__ZN7WebCore10JSSVGPoint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11jsSVGPointXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEEcvS1_Ev
+__ZN7WebCore11jsSVGPointYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetEndPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore21SVGTextContentElement20getEndPositionOfCharEjRi
+__ZN7WebCoreL19textpathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGTextPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGTextPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL31createSVGTextPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGTextPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGTextPathElementEEE
+__ZN7WebCore20JSSVGTextPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGTextPathElementEEE
+__ZN7WebCore20JSSVGTextPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGTextPathElement9classInfoEv
+__ZN7WebCore18SVGTextPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn432_NK7WebCore18SVGTextPathElement14contextElementEv
+__ZNK7WebCore18SVGTextPathElement14contextElementEv
+__ZN7WebCore18SVGTextPathElement20insertedIntoDocumentEv
+__ZN7WebCore57jsSVGTextContentElementPrototypeFunctionGetRotationOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZNK7WebCore21SVGTextContentElement17getRotationOfCharEjRi
+__ZN7WebCore18SVGTextPathElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore18SVGTextPathElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore17RenderSVGTextPathC1EPNS_4NodeE
+__ZN7WebCore17RenderSVGTextPathC2EPNS_4NodeE
+__ZNK7WebCore18SVGTextPathElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore22SVGCharacterLayoutInfo15setInPathLayoutEb
+__ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_13InlineFlowBoxEf
+__ZNK7WebCore17RenderSVGTextPath10layoutPathEv
+__ZN7WebCore4Path6lengthEv
+__ZN7WebCore18PathTraversalStateC1ENS0_19PathTraversalActionE
+__ZN7WebCore18PathTraversalStateC2ENS0_19PathTraversalActionE
+__ZNK7WebCore4Path5applyEPvPFvS1_PKNS_11PathElementEE
+__ZN7WebCoreL26CGPathApplierToPathApplierEPvPK13CGPathElement
+__ZN7WebCoreL25pathLengthApplierFunctionEPvPKNS_11PathElementE
+__ZN7WebCore18PathTraversalState6moveToERKNS_10FloatPointE
+__ZN7WebCore18PathTraversalState6lineToERKNS_10FloatPointE
+__ZNK7WebCore17RenderSVGTextPath11startOffsetEv
+__ZN7WebCore22SVGCharacterLayoutInfo27nextPathLayoutPointAndAngleEfff
+__ZN7WebCore4Path13pointAtLengthEfRb
+__ZN7WebCore4Path19normalAngleAtLengthEfRb
+__ZN7WebCore24RenderSVGHiddenContainer29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore18SVGFontFaceElement19removedFromDocumentEv
+__ZN7WebCore11SVGFontDataD0Ev
+__ZN7WebCoreL31createSVGFontFaceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGFontFaceElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGFontFaceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGFontFaceElementEEE
+__ZN7WebCore20JSSVGFontFaceElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGFontFaceElementEEE
+__ZNK7WebCore20JSSVGFontFaceElement9classInfoEv
+__ZN7WebCoreL35createSVGMissingGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore24JSSVGMissingGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGMissingGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGMissingGlyphElementEEE
+__ZN7WebCore24JSSVGMissingGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGMissingGlyphElementEEE
+__ZNK7WebCore24JSSVGMissingGlyphElement9classInfoEv
+__ZN7WebCoreL28createSVGGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGGlyphElementEEE
+__ZN7WebCore17JSSVGGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGGlyphElementEEE
+__ZNK7WebCore17JSSVGGlyphElement9classInfoEv
+__ZN7WebCoreL16hkernConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGHKernElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGHKernElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore12JSSVGElement9classInfoEv
+__ZN7WebCoreL27createSVGFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGFontElementEEE
+__ZN7WebCore16JSSVGFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGFontElementEEE
+__ZNK7WebCore16JSSVGFontElement9classInfoEv
+__ZN7WebCore14SVGFontElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore15SVGHKernElement20insertedIntoDocumentEv
+__ZN7WebCoreL28createSVGTSpanElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGTSpanElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGTSpanElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTSpanElementEEE
+__ZN7WebCore17JSSVGTSpanElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTSpanElementEEE
+__ZNK7WebCore17JSSVGTSpanElement9classInfoEv
+__ZN7WebCore12SVGLangSpace10setXmllangERKNS_12AtomicStringE
+__ZN7WebCoreL19altglyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGAltGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGAltGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL31createSVGAltGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGAltGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGAltGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGAltGlyphElementEEE
+__ZN7WebCore20JSSVGAltGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGAltGlyphElementEEE
+__ZN7WebCore20JSSVGAltGlyphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGAltGlyphElement9classInfoEv
+__ZN7WebCore18SVGAltGlyphElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore18SVGAltGlyphElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore11PathBuilder12svgClosePathEv
+__ZN7WebCore20parseDelimitedStringERKNS_6StringEc
+__ZNK7WebCore15SVGHKernElement26buildHorizontalKerningPairEv
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE15reserveCapacityEm
+__ZN7WebCore11SVGGlyphMap20compareGlyphPriorityERKNS_18SVGGlyphIdentifierES3_
+__ZSt25__unguarded_linear_insertIPN7WebCore18SVGGlyphIdentifierES1_PFbRKS1_S4_EEvT_T0_T1_
+__ZN7WebCoreL25stringMatchesUnicodeRangeERKNS_6StringES2_
+__ZN3WTF6VectorISt4pairIjjELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE6shrinkEm
+__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEmPKS2_
+__ZNK7WebCore18SVGAltGlyphElement12glyphElementEv
+__ZN7WebCore17RenderSVGTextPathD0Ev
+__ZN7WebCore17JSSVGTSpanElementD1Ev
+__ZN7WebCore16JSSVGFontElementD1Ev
+__ZN7WebCore17JSSVGGlyphElementD1Ev
+__ZN7WebCore24JSSVGMissingGlyphElementD1Ev
+__ZN7WebCore20JSSVGFontFaceElementD1Ev
+__ZN7WebCore20JSSVGTextPathElementD1Ev
+__ZN7WebCore10JSSVGPointD1Ev
+__ZN7WebCore10JSSVGPointD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEED0Ev
+__ZN7WebCore11JSSVGLengthD1Ev
+__ZN7WebCore11JSSVGLengthD2Ev
+__ZN3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGDy
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEED0Ev
+__ZN7WebCore19JSSVGAnimatedLengthD1Ev
+__ZN7WebCore19JSSVGAnimatedLengthD2Ev
+__ZN7WebCore15JSSVGSetElementD1Ev
+__ZN7WebCore14SVGFontElementD0Ev
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE6shrinkEm
+__ZN7WebCore22SVGMissingGlyphElementD0Ev
+__ZN7WebCore15SVGGlyphElementD0Ev
+__ZN7WebCore15SVGHKernElementD0Ev
+__ZN7WebCore13SVGSetElementD0Ev
+__ZN7WebCore17SVGAnimateElementD2Ev
+__ZN7WebCore18SVGTextPathElementD0Ev
+__ZN7WebCore20JSSVGAltGlyphElementD1Ev
+__ZThn8_N7WebCore14SVGTextElementD0Ev
+__ZN7WebCore18SVGAltGlyphElementD0Ev
+__ZN7WebCore26JSSVGTSpanElementPrototypeD1Ev
+__ZN7WebCore25JSSVGFontElementPrototypeD1Ev
+__ZN7WebCore26JSSVGGlyphElementPrototypeD1Ev
+__ZN7WebCore33JSSVGMissingGlyphElementPrototypeD1Ev
+__ZN7WebCore29JSSVGFontFaceElementPrototypeD1Ev
+__ZN7WebCore19JSSVGPointPrototypeD1Ev
+__ZN7WebCore28JSSVGAnimatedLengthPrototypeD1Ev
+__ZN7WebCore24JSSVGSetElementPrototypeD1Ev
+__ZN7WebCore30JSSVGAnimationElementPrototypeD1Ev
+__ZN7WebCore29JSSVGAltGlyphElementPrototypeD1Ev
+__ZN7WebCore8Document29parseDNSPrefetchControlHeaderERKNS_6StringE
+__ZN7WebCore15FormDataBuilder28generateUniqueBoundaryStringEv
+__ZN7WebCore15FormDataBuilder20beginMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
+__ZN7WebCore15FormDataBuilder28addBoundaryToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringEb
+__ZN7WebCore15FormDataBuilder28addFilenameToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_12TextEncodingERKNS_6StringE
+__ZN7WebCore15FormDataBuilder21finishMultiPartHeaderERN3WTF6VectorIcLm0EEE
+__ZN7WebCoreL37nonCachingStaticReplaceFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11FrameLoader27handleUnimplementablePolicyERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader25setupForReplaceByMIMETypeERKNS_6StringE
+__ZN7WebCore14DocumentLoader25setupForReplaceByMIMETypeERKNS_6StringE
+__ZN7WebCore14ResourceLoader17clearResourceDataEv
+__ZN7WebCore11FrameLoader12setReplacingEv
+__ZN7WebCore12SharedBuffer5clearEv
+__ZN7WebCore12SharedBuffer17clearPlatformDataEv
+__ZNK7WebCore11CachedImage7isImageEv
+__ZN7WebCore14DocumentLoader39subresourceLoaderFinishedLoadingOnePartEPNS_14ResourceLoaderE
+__ZN7WebCore17HTMLSelectElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore19HTMLTextAreaElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore14jsNodeOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onresizeEv
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEffffRi
+__ZN7WebCoreL16imageConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGImageLoaderC1EPNS_15SVGImageElementE
+__ZN7WebCore14SVGImageLoaderC2EPNS_15SVGImageElementE
+__ZN7WebCore15SVGImageElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn408_NK7WebCore15SVGImageElement14contextElementEv
+__ZNK7WebCore15SVGImageElement14contextElementEv
+__ZN7WebCore15SVGImageElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore15SVGImageElement20insertedIntoDocumentEv
+__ZNK7WebCore15SVGImageElement24imageSourceAttributeNameEv
+__ZNK7WebCore14SVGImageLoader9sourceURIERKNS_12AtomicStringE
+__ZN7WebCore22EmptyFrameLoaderClient38dispatchDidLoadResourceFromMemoryCacheEPNS_14DocumentLoaderERKNS_15ResourceRequestERKNS_1
+__ZN7WebCore22EmptyFrameLoaderClient26dispatchDidReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
+__ZN7WebCore22EmptyFrameLoaderClient24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore15SVGImageElement6attachEv
+__ZNK7WebCore15SVGImageElement7isValidEv
+__ZN7WebCore15SVGImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderSVGImageC1EPNS_15SVGImageElementE
+__ZN7WebCore14RenderSVGImageC2EPNS_15SVGImageElementE
+__ZNK7WebCore14RenderSVGImage13requiresLayerEv
+__ZN7WebCore14RenderSVGImage12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore14RenderSVGImage29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore14RenderSVGImage29repaintRectInLocalCoordinatesEv
+__ZN7WebCore14RenderSVGImage21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore14RenderSVGImage22localToParentTransformEv
+__ZN7WebCore15SVGImageElement27haveLoadedRequiredResourcesEv
+__ZThn360_NK7WebCore15SVGImageElement14contextElementEv
+__ZN7WebCore14SVGImageLoader17dispatchLoadEventEv
+__ZN7WebCore14RenderSVGImage6layoutEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_16heightAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11yAttrStr
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11xAttrStr
+__ZNK7WebCore5Image23hasSingleSecurityOriginEv
+__ZN7WebCore14RenderSVGImage5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderSVGImage25adjustRectsForAspectRatioERNS_9FloatRectES2_PNS_22SVGPreserveAspectRatioE
+-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]
+__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
+__ZN7WebCore23AuthenticationChallengeC1EP28NSURLAuthenticationChallenge
+__ZN7WebCore23AuthenticationChallengeC2EP28NSURLAuthenticationChallenge
+__ZN7WebCore4coreEP15NSURLCredential
+__ZN7WebCore10CredentialC1ERKNS_6StringES3_NS_21CredentialPersistenceE
+__ZN7WebCore10CredentialC2ERKNS_6StringES3_NS_21CredentialPersistenceE
+__ZN7WebCore4coreEP20NSURLProtectionSpace
+__ZN7WebCore15ProtectionSpaceC1ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
+__ZN7WebCore15ProtectionSpaceC2ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
+__ZN7WebCore27AuthenticationChallengeBaseC2ERKNS_15ProtectionSpaceERKNS_10CredentialEjRKNS_16ResourceResponseERKNS_13ResourceEr
+__ZN7WebCore14ResourceHandle33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceHandle18receivedCredentialERKNS_23AuthenticationChallengeERKNS_10CredentialE
+__ZN7WebCore27AuthenticationChallengeBase7compareERKNS_23AuthenticationChallengeES3_
+__ZNK7WebCore27AuthenticationChallengeBase6isNullEv
+__ZNK7WebCore27AuthenticationChallengeBase15protectionSpaceEv
+__ZN7WebCoreeqERKNS_15ProtectionSpaceES2_
+__ZNK7WebCore15ProtectionSpace4hostEv
+__ZNK7WebCore15ProtectionSpace4portEv
+__ZNK7WebCore15ProtectionSpace10serverTypeEv
+__ZNK7WebCore15ProtectionSpace5realmEv
+__ZNK7WebCore15ProtectionSpace20authenticationSchemeEv
+__ZNK7WebCore27AuthenticationChallengeBase18proposedCredentialEv
+__ZN7WebCoreeqERKNS_10CredentialES2_
+__ZNK7WebCore10Credential4userEv
+__ZNK7WebCore10Credential8passwordEv
+__ZNK7WebCore10Credential11persistenceEv
+__ZNK7WebCore27AuthenticationChallengeBase20previousFailureCountEv
+__ZNK7WebCore27AuthenticationChallengeBase15failureResponseEv
+__ZN7WebCore20ResourceResponseBase7compareERKNS_16ResourceResponseES3_
+__ZN3WTFeqIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEEEbRKNS_7HashMapIT_T0_T1_T2
+__ZN7WebCore16ResourceResponse15platformCompareERKS0_S2_
+__ZNK7WebCore27AuthenticationChallengeBase5errorEv
+__ZN7WebCore17ResourceErrorBase7compareERKNS_13ResourceErrorES3_
+__ZN7WebCore23AuthenticationChallenge15platformCompareERKS0_S2_
+__ZN7WebCore3macERKNS_10CredentialE
+__ZN7WebCore23AuthenticationChallengeD2Ev
+__ZN7WebCore33jsDOMWindowPrototypeFunctionPrintEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28objectToStringFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSHistory14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore10JSLocation14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_33jsDOMWindowPrototypeFunctionFocusEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_32jsDOMWindowPrototypeFunctionBlurEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7J
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_33jsDOMWindowPrototypeFunctionCloseEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7
+__ZN7WebCore17jsDOMWindowWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16setJSNodeOnpasteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnpasteEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore15setJSNodeOndropEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOndropEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL34nonCachingStaticBackFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL37nonCachingStaticForwardFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL32nonCachingStaticGoFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36nonCachingStaticAssignFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36nonCachingStaticReloadFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell12lookupSetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow12lookupSetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore27setJSHTMLVideoElementPosterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement9setPosterERKNS_6StringE
+__ZNK7WebCore16HTMLVideoElement24imageSourceAttributeNameEv
+__ZN7WebCore17HTMLSourceElement18scheduleErrorEventEv
+__ZN7WebCore5TimerINS_17HTMLSourceElementEE5firedEv
+__ZN7WebCore17HTMLSourceElement20errorEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsHTMLMediaElementCurrentSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10currentSrcEv
+__ZN7WebCore11FrameLoader35shouldInterruptLoadForXFrameOptionsERKNS_6StringERKNS_4KURLE
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZNK7WebCore15HTMLLinkElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore17HTMLScriptElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore40jsWorkerContextXMLHttpRequestConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSWorkerContext14xmlHttpRequestEPN3JSC9ExecStateE
+__ZNK7WebCore13WorkerContext18virtualCompleteURLERKNS_6StringE
+__ZNK7WebCore13WorkerContext11completeURLERKNS_6StringE
+__ZN7WebCore22WorkerThreadableLoader25loadResourceSynchronouslyEPNS_13WorkerContextERKNS_15ResourceRequestERNS_22ThreadableLoad
+__ZN7WebCore6String6numberEm
+__ZN7WebCore22WorkerThreadableLoaderC1EPNS_13WorkerContextEPNS_22ThreadableLoaderClientERKNS_6StringERKNS_15ResourceRequestENS_
+__ZN7WebCore22WorkerThreadableLoaderC2EPNS_13WorkerContextEPNS_22ThreadableLoaderClientERKNS_6StringERKNS_15ResourceRequestENS_
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeC1EN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEERNS_20WorkerMes
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeC2EN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEERNS_20WorkerMes
+__ZN7WebCore18createCallbackTaskIPNS_22WorkerThreadableLoader16MainThreadBridgeES3_NS_15ResourceRequestESt8auto_ptrINS_30CrossT
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_15ResourceRequestEE4copyERKS1_
+__ZNK7WebCore19ResourceRequestBase8copyDataEv
+__ZNK7WebCore13HTTPHeaderMap8copyDataEv
+__ZN7WebCore20WorkerMessagingProxy22postTaskToWorkerObjectEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_6StringE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge22mainThreadCreateLoaderEPNS_22ScriptExecutionContextEPS1_St8auto_ptrINS_
+__ZN7WebCore19ResourceRequestBase5adoptESt8auto_ptrINS_30CrossThreadResourceRequestDataEE
+__ZN7WebCore13HTTPHeaderMap5adoptESt8auto_ptrIN3WTF6VectorISt4pairINS_6StringES5_ELm0EEEE
+__ZN7WebCore19ResourceRequestBase19setAllowHTTPCookiesEb
+__ZN7WebCore18GenericWorkerTask5IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_St8auto_ptrINS_30CrossThreadResourceRequestD
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_16Reso
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_16ResourceResponseEE4copyERKS1_
+__ZNK7WebCore20ResourceResponseBase8copyDataEv
+__ZNK7WebCore20ResourceResponseBase16lastModifiedDateEv
+__ZN7WebCore20WorkerMessagingProxy30postTaskForModeToWorkerContextEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEERKNS_6S
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EESt8auto_ptrINS_31Cross
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge14didReceiveDataEPKci
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EESt8auto_p
+__ZN7WebCoreL31workerContextDidReceiveResponseEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEES
+__ZN7WebCore20ResourceResponseBase5adoptESt8auto_ptrINS_31CrossThreadResourceResponseDataEE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge16didFinishLoadingEm
+__ZN7WebCore20ResourceResponseBase6setURLERKNS_4KURLE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EEmmEENS1_1
+__ZN7WebCore20ResourceResponseBase11setMimeTypeERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase24setExpectedContentLengthEx
+__ZN7WebCore20ResourceResponseBase19setTextEncodingNameERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase20setSuggestedFilenameERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase17setHTTPStatusTextERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase17setExpirationDateEl
+__ZN7WebCore20ResourceResponseBase19setLastModifiedDateEl
+__ZN7WebCoreL27workerContextDidReceiveDataEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEESt8au
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EESt8auto_ptrINS1_6Vecto
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EEmmE11performTaskEPNS_2
+__ZN7WebCoreL29workerContextDidFinishLoadingEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEEm
+__ZN7WebCore13WorkerContext33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore13WorkerContext10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZThn8_N7WebCore20WorkerMessagingProxy32postConsoleMessageToWorkerObjectENS_18MessageDestinationENS_13MessageSourceENS_12Messa
+__ZN7WebCore20WorkerMessagingProxy32postConsoleMessageToWorkerObjectENS_18MessageDestinationENS_13MessageSourceENS_12MessageLev
+__ZN7WebCore18createCallbackTaskIPNS_20WorkerMessagingProxyES2_NS_18MessageDestinationES3_NS_13MessageSourceES4_NS_12MessageLev
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_6StringEE4copyERKS1_
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EEmmED0Ev
+__ZN7WebCore18GenericWorkerTask7IPNS_20WorkerMessagingProxyES2_NS_18MessageDestinationES3_NS_13MessageSourceES4_NS_12MessageLev
+__ZN7WebCoreL22postConsoleMessageTaskEPNS_22ScriptExecutionContextEPNS_20WorkerMessagingProxyENS_18MessageDestinationENS_13Mess
+__ZN7WebCore22WorkerThreadableLoaderD0Ev
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge7destroyEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18clearClientWrapperEv
+__ZN7WebCore18createCallbackTaskIPNS_22WorkerThreadableLoader16MainThreadBridgeES3_EEN3WTF10PassRefPtrINS_22ScriptExecutionCont
+__ZN7WebCore18GenericWorkerTask1IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_E11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge17mainThreadDestroyEPNS_22ScriptExecutionContextEPS1_
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeD0Ev
+__ZN7WebCore18GenericWorkerTask1IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_ED0Ev
+__ZN7WebCore45jsWorkerContextPrototypeFunctionImportScriptsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext13importScriptsEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext13importScriptsERKN3WTF6VectorINS_6StringELm0EEERKS3_iRi
+__ZN7WebCore25WorkerImportScriptsClient18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore25WorkerImportScriptsClient14didReceiveDataEPKci
+__ZN7WebCore25WorkerImportScriptsClient16didFinishLoadingEm
+__ZN7WebCore13WorkerContext14scriptImportedEmRKNS_6StringE
+__ZN7WebCore50jsXMLHttpRequestExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore25JSXMLHttpRequestException9classInfoEv
+__ZN7WebCore22WorkerScriptController12setExceptionENS_11ScriptValueE
+__ZN7WebCore36jsXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14XMLHttpRequest28makeCrossOriginAccessRequestERi
+__ZN7WebCore32isSimpleCrossOriginAccessRequestERKNS_6StringERKNS_13HTTPHeaderMapE
+__ZN7WebCore45isOnAccessControlSimpleRequestMethodWhitelistERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest34makeSimpleCrossOriginAccessRequestERi
+__ZN7WebCore24passesAccessControlCheckERKNS_16ResourceResponseEbPNS_14SecurityOriginE
+__ZN7WebCore14XMLHttpRequest41makeCrossOriginAccessRequestWithPreflightERi
+__ZN7WebCore31CrossOriginPreflightResultCache16canSkipPreflightERKNS_6StringERKNS_4KURLEbS3_RKNS_13HTTPHeaderMapE
+__ZN7WebCore14XMLHttpRequest27didReceiveResponsePreflightERKNS_16ResourceResponseE
+__ZN7WebCore35CrossOriginPreflightResultCacheItem5parseERKNS_16ResourceResponseE
+__ZN7WebCoreL27addToAccessControlAllowListINS_10StringHashEEEvRKNS_6StringEjjRN3WTF7HashSetIS2_T_NS5_10HashTraitsIS2_EEEE
+__ZNK7WebCore6String13substringCopyEjj
+__ZN7WebCore10StringImpl13substringCopyEjj
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E5clearEv
+__ZNK7WebCore6String12toUIntStrictEPbi
+__ZN7WebCore10StringImpl12toUIntStrictEPbi
+__ZN7WebCore22charactersToUIntStrictEPKtmPbi
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem23allowsCrossOriginMethodERKNS_6StringE
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem24allowsCrossOriginHeadersERKNS_13HTTPHeaderMapE
+__ZN7WebCore31CrossOriginPreflightResultCache11appendEntryERKNS_6StringERKNS_4KURLEPNS_35CrossOriginPreflightResultCacheItemE
+__ZN3WTF7HashMapISt4pairIN7WebCore6StringENS2_4KURLEEPNS2_35CrossOriginPreflightResultCacheItemENS_8PairHashIS3_S4_EENS_10HashT
+__ZN3WTF9HashTableISt4pairIN7WebCore6StringENS2_4KURLEES1_IS5_PNS2_35CrossOriginPreflightResultCacheItemEENS_18PairFirstExtract
+__ZN7WebCore14XMLHttpRequest25didFinishLoadingPreflightEv
+__ZN7WebCore14XMLHttpRequest33handleAsynchronousPreflightResultEv
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem13allowsRequestEbRKNS_6StringERKNS_13HTTPHeaderMapE
+__ZN7WebCore45isOnAccessControlSimpleRequestHeaderWhitelistERKNS_6StringES2_
+__ZN7WebCoreL27addToAccessControlAllowListINS_15CaseFoldingHashEEEvRKNS_6StringEjjRN3WTF7HashSetIS2_T_NS5_10HashTraitsIS2_EEEE
+__ZN7WebCore32jsXMLHttpRequestExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40isOnAccessControlResponseHeaderWhitelistERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbS3_S3_Ri
+-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]
+__ZN7WebCoreL34newStreamingTextDecoderUserDefinedERKNS_12TextEncodingEPKv
+__ZN7WebCore20TextCodecUserDefined6decodeEPKcmbbRb
+__ZN7WebCore20TextCodecUserDefinedD0Ev
+__ZN7WebCore29jsXMLHttpRequestExceptionNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsXMLHttpRequestPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore29setJSXMLHttpRequestOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSXMLHttpRequestOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZThn16_N7WebCore24DocumentThreadableLoader15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResp
+__ZN7WebCore24DocumentThreadableLoader15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZThn16_N7WebCore14XMLHttpRequest20didFailRedirectCheckEv
+__ZN7WebCore14XMLHttpRequest20didFailRedirectCheckEv
+__ZN7WebCore22JSXMLHttpRequestUpload3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSXMLHttpRequestUploadOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore20XMLHttpRequestUpload22scriptExecutionContextEv
+__ZN7WebCore32setJSXMLHttpRequestUploadOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSXMLHttpRequestUploadOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSXMLHttpRequestUploadOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSXMLHttpRequestUploadOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL10formCreateEP14__CFReadStreamPv
+__ZN7WebCoreL20getStreamFormDataMapEv
+__ZN3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RK
+__ZN3WTF9HashTableIP14__CFReadStreamSt4pairIS2_NS_6RefPtrIN7WebCore8FormDataEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS2_EEN
+__ZN7WebCore18httpBodyFromStreamEP13NSInputStream
+__ZNK3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3getERKS2_
+__ZN7WebCoreL12formScheduleEP14__CFReadStreamP11__CFRunLoopPK10__CFStringPv
+__ZN7WebCore12SchedulePairC1EP11__CFRunLoopPK10__CFString
+__ZN7WebCore12SchedulePairC2EP11__CFRunLoopPK10__CFString
+__ZN7WebCoreL8formOpenEP14__CFReadStreamP13CFStreamErrorPhPv
+__ZN7WebCoreL14openNextStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL20advanceCurrentStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL18closeCurrentStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL17formEventCallbackEP14__CFReadStreammPv
+__ZN7WebCoreL8formReadEP14__CFReadStreamPhlP13CFStreamErrorS2_Pv
+__ZN7WebCoreL11formCanReadEP14__CFReadStreamPv
+__ZN7WebCoreL9formCloseEP14__CFReadStreamPv
+__ZN7WebCore20XMLHttpRequestUpload18dispatchErrorEventEv
+__ZN7WebCore20XMLHttpRequestUpload35dispatchXMLHttpRequestProgressEventEPNS_13EventListenerERKNS_12AtomicStringEbjj
+__ZN7WebCore20XMLHttpRequestUpload14refEventTargetEv
+__ZN7WebCore20XMLHttpRequestUpload22toXMLHttpRequestUploadEv
+__ZN7WebCore20XMLHttpRequestUpload16derefEventTargetEv
+__ZNK7WebCore20XMLHttpRequestUpload12hasListenersEv
+__ZN7WebCore20XMLHttpRequestUpload22dispatchLoadStartEventEv
+__ZN7WebCoreL12formFinalizeEP14__CFReadStreamPv
+__ZN7WebCore20XMLHttpRequestUpload21dispatchProgressEventExx
+__ZN7WebCore20XMLHttpRequestUpload17dispatchLoadEventEv
+__ZN7WebCore10toDocumentEN3JSC7JSValueE
+__ZN7WebCore14XMLHttpRequest4sendEPNS_8DocumentERi
+__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6StringELm16EE15reserveCapacityEm
+__ZN7WebCore5TimerINS_14ResourceHandleEE5firedEv
+__ZN7WebCore14ResourceHandle11fireFailureEPNS_5TimerIS0_EE
+__ZN7WebCore14ResourceLoader10wasBlockedEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader12blockedErrorEv
+__ZNK7WebCore11FrameLoader12blockedErrorERKNS_15ResourceRequestE
+__ZNK7WebCore18JSSVGCircleElement9classInfoEv
+__ZN7WebCoreL12aConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore11SVGAElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11SVGAElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11SVGAElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore11SVGAElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore15RenderSVGInlineC1EPNS_4NodeE
+__ZNK7WebCore11SVGAElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore10SVGElement13isTextContentEv
+__ZN7WebCore22JSSVGGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL28createSVGImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGImageElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGImageElementEEE
+__ZN7WebCore17JSSVGImageElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGImageElementEEE
+__ZN7WebCore17JSSVGImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsSVGImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_16heightA
+__ZN7WebCore22jsSVGImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAt
+__ZNK7WebCore14RenderSVGImage19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore15RenderSVGInlineD0Ev
+__ZN7WebCore14RenderSVGImageD0Ev
+__ZN7WebCore17JSSVGImageElementD1Ev
+__ZN7WebCore26JSSVGImageElementPrototypeD1Ev
+__ZN7WebCore11SVGAElementD0Ev
+__ZN7WebCore15SVGImageElementD0Ev
+__ZN7WebCore14SVGImageLoaderD1Ev
+__ZN7WebCore14SVGImageLoaderD2Ev
+__ZN7WebCore22WorkerThreadableLoader6cancelEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge6cancelEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_13Reso
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_13ResourceErrorEE4copyERKS1_
+__ZNK7WebCore17ResourceErrorBase4copyEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge16mainThreadCancelEPNS_22ScriptExecutionContextEPS1_
+__ZN7WebCore22WorkerThreadableLoader21derefThreadableLoaderEv
+__ZNK7WebCore8FormData8deepCopyEv
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EENS_13ResourceErrorERKS
+__ZN7WebCoreL20workerContextDidFailEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEERKNS_13Resou
+__ZN7WebCore13WorkerContext15reportExceptionERKNS_6StringEiS3_
+__ZThn8_N7WebCore20WorkerMessagingProxy27postExceptionToWorkerObjectERKNS_6StringEiS3_
+__ZN7WebCore20WorkerMessagingProxy27postExceptionToWorkerObjectERKNS_6StringEiS3_
+__ZN7WebCore19WorkerExceptionTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore19WorkerExceptionTaskD0Ev
+__ZN7WebCore14RenderReplaced13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore11RenderMedia10renderNameEv
+__ZN7WebCore29jsHTMLMediaElementCurrentTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLMediaElementErrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement5errorEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10MediaErrorE
+__ZN7WebCore12JSMediaErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MediaErrorEEE
+__ZN7WebCore12JSMediaErrorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MediaErrorEEE
+__ZN7WebCore12JSMediaError18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12JSMediaError9classInfoEv
+__ZN7WebCore12JSMediaErrorD1Ev
+__ZN7WebCore12JSMediaErrorD2Ev
+__ZN7WebCore27jsHTMLMediaElementStartTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement9startTimeEv
+__ZNK7WebCore11MediaPlayer9startTimeEv
+__ZNK7WebCore27MediaPlayerPrivateInterface9startTimeEv
+__ZN7WebCore24jsHTMLMediaElementPausedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsMediaErrorCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementAutoplayEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementBufferedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement8bufferedEv
+__ZN7WebCore11MediaPlayer15maxTimeBufferedEv
+__ZNK7WebCore18MediaPlayerPrivate15maxTimeBufferedEv
+__ZN7WebCore46jsHTMLMediaElementPrototypeFunctionCanPlayTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16HTMLMediaElement11canPlayTypeERKNS_6StringE
+__ZN7WebCore13MediaDocumentC1EPNS_5FrameE
+__ZN7WebCore13MediaDocumentC2EPNS_5FrameE
+__ZN7WebCore13MediaDocument15createTokenizerEv
+__ZNK7WebCore14MediaTokenizer12wantsRawDataEv
+__ZN7WebCore14MediaTokenizer12writeRawDataEPKci
+__ZN7WebCore14MediaTokenizer23createDocumentStructureEv
+__ZNK7WebCore13MediaDocument15isMediaDocumentEv
+__ZN7WebCore14MediaTokenizer6finishEv
+__ZN7WebCore13MediaDocument19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore14MediaTokenizerD0Ev
+__ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
+__ZN7WebCore18MediaPlayerPrivate17createQTMovieViewEv
+__ZN7WebCore18MediaPlayerPrivate17detachQTMovieViewEv
+__ZL15initQTMovieViewv
+-[WebCoreMovieObserver setView:]
+__ZN7WebCore24MediaControlInputElement7hitTestERKNS_8IntPointE
+__ZN7WebCore14RenderThemeMac23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
+__ZN7WebCore11RenderTheme23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
+__ZN7WebCore13MediaDocumentD0Ev
+__ZN7WebCore26jsHTMLMediaElementControlsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29MediaControlPlayButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore16HTMLMediaElement15togglePlayStateEv
+__ZThn8_N7WebCore29MediaControlPlayButtonElementD0Ev
+__ZN7WebCore11RenderVideo20intrinsicSizeChangedEv
+__ZN7WebCore29setJSHTMLMediaElementControlsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement11setControlsEb
+__ZN7WebCore7Element19setBooleanAttributeERKNS_13QualifiedNameEb
+__ZN7WebCore40jsHTMLMediaElementPrototypeFunctionPauseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28jsHTMLMediaElementAutobufferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10autobufferEv
+__ZN7WebCore31setJSHTMLMediaElementAutobufferEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement13setAutobufferEb
+__ZN7WebCore29setJSHTMLMediaElementAutoplayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement11setAutoplayEb
+__ZN7WebCore22jsHTMLMediaElementLoopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSHTMLMediaElementLoopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement7setLoopEb
+__ZN7WebCore23jsHTMLMediaElementEndedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLMediaElementMutedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26setJSHTMLMediaElementMutedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement8setMutedEb
+__ZN7WebCore18MediaPlayerPrivate9setVolumeEf
+__ZN7WebCore24jsHTMLMediaElementPlayedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement6playedEv
+__ZN7WebCore10TimeRanges4copyEv
+__ZN7WebCore24jsHTMLVideoElementPosterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLMediaElementSeekingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement7seekingEv
+__ZN7WebCore28jsHTMLVideoElementVideoWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement10videoWidthEv
+__ZN7WebCore29jsHTMLVideoElementVideoHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement11videoHeightEv
+__ZNK7WebCore17HTMLSourceElement5mediaEv
+__ZN7WebCore22jsHTMLSourceElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22NullMediaPlayerPrivate8durationEv
+__ZN7WebCore24jsHTMLMediaElementVolumeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZN7WebCore27setJSHTMLMediaElementVolumeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
+__ZN7WebCore23jsHTMLVideoElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement5widthEv
+__ZNK7WebCore6String6toUIntEPb
+__ZN7WebCore10StringImpl6toUIntEPb
+__ZN7WebCore16charactersToUIntEPKtmPb
+__ZN7WebCore24jsHTMLVideoElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement6heightEv
+__ZN7WebCore26setJSHTMLVideoElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement8setWidthEj
+__ZN7WebCore27setJSHTMLVideoElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement9setHeightEj
+__ZNK7WebCore25AccessibilityRenderObject13valueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16minValueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16maxValueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16activeDescendantEv
+-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]
+__ZNK7WebCore25AccessibilityRenderObject13isMenuRelatedEv
+__ZNK7WebCore25AccessibilityRenderObject29boundsForVisiblePositionRangeERKNS_20VisiblePositionRangeE
+__ZNK7WebCore10ScrollView16contentsToScreenERKNS_7IntRectE
+__ZNK7WebCore10ScrollView24platformContentsToScreenERKNS_7IntRectE
+__ZN7WebCore9makeRangeERKNS_15VisiblePositionES2_
+__ZN7WebCore5Range11boundingBoxEv
+-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]
+__ZNK7WebCore25AccessibilityRenderObject20canSetValueAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject10isReadOnlyEv
+__ZNK7WebCore25AccessibilityRenderObject30accessibilityParentForImageMapEPNS_14HTMLMapElementE
+-[AccessibilityObjectWrapper accessibilityHitTest:]
+__ZNK7WebCore25AccessibilityRenderObject22doAccessibilityHitTestERKNS_8IntPointE
+__ZNK7WebCore25AccessibilityRenderObject28accessibilityImageMapHitTestEPNS_15HTMLAreaElementERKNS_8IntPointE
+__ZNK7WebCore25AccessibilityImageMapLink22accessibilityIsIgnoredEv
+__ZN7WebCoreL16styleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGStyleElement20insertedIntoDocumentEv
+__ZN7WebCore15SVGStyleElement15childrenChangedEbPNS_4NodeES2_i
+__ZThn184_NK7WebCore15SVGStyleElement4typeEv
+__ZNK7WebCore15SVGStyleElement4typeEv
+__ZThn184_NK7WebCore15SVGStyleElement5mediaEv
+__ZNK7WebCore15SVGStyleElement5mediaEv
+__ZN7WebCore12StyleElement10setLoadingEb
+__ZNK7WebCore15SVGStyleElement5titleEv
+__ZN7WebCore15SVGStyleElement11sheetLoadedEv
+__ZN7WebCore15SVGStyleElement5sheetEv
+__ZN7WebCore15SVGStyleElement21finishParsingChildrenEv
+__ZN7WebCore19SVGAnimatedPropertyINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames1
+__ZN7WebCore6Editor14setCompositionERKNS_6StringERKN3WTF6VectorINS_20CompositionUnderlineELm0EEEjj
+__ZN7WebCore6Editor35setIgnoreCompositionSelectionChangeEb
+__ZN7WebCore6Editor17selectCompositionEv
+__ZNK7WebCore6Editor16compositionRangeEv
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE15reserveCapacityEm
+__ZN7WebCore19SelectionController16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
+__ZN7WebCore13TypingCommand15deleteSelectionEPNS_8DocumentEb
+__ZN7WebCore13TypingCommand15deleteSelectionEb
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE6shrinkEm
+__ZN3JSC12RuntimeArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC12RuntimeArray9classInfoEv
+__ZN3JSC12RuntimeArray12lengthGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore15SVGStyleElementD0Ev
+__ZN7WebCore13InlineTextBox26paintCompositionBackgroundEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontEii
+__ZNK7WebCore6Editor23getCompositionSelectionERjS1_
+__ZN7WebCore6Editor44confirmCompositionWithoutDisturbingSelectionEv
+__ZN7WebCore6Editor18confirmCompositionERKNS_6StringEb
+-[WebScriptObject evaluateWebScript:]
+__ZN7WebCore6Editor18confirmCompositionERKNS_6StringE
+__ZN7WebCore6Editor13performDeleteEv
+__ZN7WebCore6Editor18confirmCompositionEv
+__ZN7WebCoreL26skipCommaInDashboardRegionEPNS_18CSSParserValueListE
+__Z3kitPN7WebCore5EventE
+__Z8kitClassPN7WebCore5EventE
+-[DOMEvent dealloc]
+__ZN7WebCore19implementationFrontEPNS_19JSDOMImplementationE
+__Z3kitPN7WebCore22DOMImplementationFrontE
+__ZN7WebCore22DOMImplementationFront3refEv
+-[DOMImplementation dealloc]
+__ZN7WebCore22DOMImplementationFront5derefEv
+__Z3kitPN7WebCore10TreeWalkerE
+-[DOMTreeWalker dealloc]
+__Z3kitPN7WebCore4RectE
+-[DOMRect dealloc]
+__Z3kitPN7WebCore7CounterE
+-[DOMCounter dealloc]
+__Z3kitPN7WebCore9MediaListE
+-[DOMMediaList dealloc]
+-[DOMXPathExpression dealloc]
+-[DOMXPathResult dealloc]
+-[DOMHTMLOptionsCollection dealloc]
+-[WebScriptObject removeWebScriptKey:]
+-[WebScriptObject setWebScriptValueAtIndex:value:]
+-[WebScriptObject stringRepresentation]
+-[DOMNode addEventListener:listener:useCapture:]
+__ZN7WebCore17ObjCEventListener4wrapEP11objc_object
+__ZN7WebCore17ObjCEventListener4findEP11objc_object
+__ZN7WebCore17ObjCEventListenerC1EP11objc_object
+__ZN7WebCore17ObjCEventListenerC2EP11objc_object
+__ZN3WTF7HashMapIP11objc_objectPN7WebCore17ObjCEventListenerENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3setERKS2_RKS5_
+__ZNK3WTF7HashMapIP11objc_objectPN7WebCore17ObjCEventListenerENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3getERKS2_
+__ZN7WebCore17ObjCEventListener11handleEventEPNS_5EventEb
+-[DOMEvent target]
+__Z3kitPN7WebCore11EventTargetE
+-[DOMEvent type]
+-[DOMEvent eventPhase]
+-[DOMEvent bubbles]
+-[DOMEvent cancelable]
+-[DOMUIEvent detail]
+-[DOMUIEvent view]
+-[DOMAbstractView document]
+-[DOMMouseEvent button]
+-[DOMMouseEvent clientX]
+-[DOMMouseEvent clientY]
+-[DOMMouseEvent screenX]
+-[DOMMouseEvent screenY]
+-[DOMMouseEvent metaKey]
+-[DOMMouseEvent altKey]
+-[DOMMouseEvent shiftKey]
+-[DOMMouseEvent ctrlKey]
+-[DOMMouseEvent relatedTarget]
+-[DOMKeyboardEvent keyIdentifier]
+-[DOMKeyboardEvent keyLocation]
+-[DOMKeyboardEvent metaKey]
+-[DOMKeyboardEvent altKey]
+-[DOMKeyboardEvent shiftKey]
+-[DOMKeyboardEvent ctrlKey]
+-[DOMKeyboardEvent keyCode]
+-[DOMKeyboardEvent charCode]
+__ZN7WebCore17ObjCEventListenerD0Ev
+__ZN3WTF9HashTableIP11objc_objectSt4pairIS2_PN7WebCore17ObjCEventListenerEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS2_EENS_14P
+-[DOMDocument createEvent:]
+-[DOMDocument defaultView]
+-[DOMKeyboardEvent initKeyboardEvent:canBubble:cancelable:view:keyIdentifier:keyLocation:ctrlKey:altKey:shiftKey:metaKey:]
+__Z4coreP15DOMAbstractView
+-[DOMNode dispatchEvent:]
+__Z4coreP8DOMEvent
++[WebScriptObject throwException:]
+__ZN3JSC8Bindings10throwErrorEPNS_9ExecStateENS_9ErrorTypeEP8NSString
+__ZN7WebCoreL10callPluginEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN3JSC13RuntimeMethod18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16RuntimeObjectImp11fieldGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore13IdentifierRep3getEi
+__ZN7WebCoreL16intIdentifierMapEv
+__ZN3WTF7HashMapIiPN7WebCore13IdentifierRepENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3addERKiRKS3_
+__ZN3JSC16RuntimeObjectImp16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL22callRuntimeConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC16RuntimeObjectImp23throwInvalidAccessErrorEPNS_9ExecStateE
+__ZN3JSC16RuntimeObjectImp16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN7WebCore16jsPluginFilenameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin8filenameEv
+__ZN7WebCore14jsPluginLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin6lengthEv
+__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore8JSPlugin11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore6Plugin4itemEj
+__ZN7WebCore21jsMimeTypeDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType11descriptionEv
+__ZN7WebCore18jsMimeTypeSuffixesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType8suffixesEv
+__ZN7WebCore8JSPlugin18canGetItemsForNameEPN3JSC9ExecStateEPNS_6PluginERKNS1_10IdentifierE
+__ZN7WebCore6Plugin18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore29jsPluginPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8JSPlugin9classInfoEv
+__ZN7WebCore34jsPluginPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6Plugin9namedItemERKNS_12AtomicStringE
+__ZN7WebCore34jsPluginArrayPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsPluginArrayPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore36jsMimeTypeArrayPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSMimeTypeArray9classInfoEv
+__ZN7WebCore41jsMimeTypeArrayPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14PluginDocumentC1EPNS_5FrameE
+__ZN7WebCore14PluginDocumentC2EPNS_5FrameE
+__ZN7WebCore14PluginDocument15createTokenizerEv
+__ZNK7WebCore15PluginTokenizer12wantsRawDataEv
+__ZN7WebCore15PluginTokenizer12writeRawDataEPKci
+__ZN7WebCore15PluginTokenizer23createDocumentStructureEv
+__ZNK7WebCore14PluginDocument16isPluginDocumentEv
+__ZN7WebCore15PluginTokenizer6finishEv
+__ZN7WebCore15PluginTokenizerD0Ev
+__ZN7WebCore14PluginDocumentD0Ev
+-[DOMNode(WebCoreInternal) _rootObject]
+-[WebScriptObject setException:]
+__ZN3JSC8Bindings9ObjcClass14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpC1EPNS_9ExecStateEPNS0_12ObjcInstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpC2EPNS_9ExecStateEPNS0_12ObjcInstanceERKNS_10IdentifierE
+__ZN3JSC16RuntimeObjectImp20fallbackObjectGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC8Bindings21ObjcFallbackObjectImp9toBooleanEPNS_9ExecStateE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpD1Ev
+__ZN7WebCore19RenderScrollbarPart22computeScrollbarHeightEv
+__ZN7WebCore15RenderScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore23ScrollbarThemeComposite5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme8hasThumbEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme24paintScrollbarBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarE
+__ZN7WebCore15RenderScrollbar9paintPartEPNS_15GraphicsContextENS_13ScrollbarPartERKNS_7IntRectE
+__ZN7WebCore19RenderScrollbarPart13paintIntoRectEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme11paintButtonEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
+__ZN7WebCore20RenderScrollbarTheme20paintTrackBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme15paintTrackPieceEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
+__ZN7WebCore23ScrollbarThemeComposite14paintTickmarksEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme10paintThumbEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker25checkScrollbarPseudoClassEPNS_11CSSSelectorERNS_8PseudoIdE
+__ZN7WebCore15RenderScrollbar19partForStyleResolveEv
+__ZN7WebCore19RenderScrollbarPart20layoutHorizontalPartEv
+__ZThn200_NK7WebCore13RenderListBox22scrollbarCornerPresentEv
+__ZNK7WebCore13RenderListBox22scrollbarCornerPresentEv
+__ZN7WebCore19RenderScrollbarPart12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore11RenderLayer22scrollbarCornerPresentEv
+__ZNK7WebCore9FillLayer13hasFixedImageEv
+__ZN7WebCore33jsStoragePrototypeFunctionSetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage7setItemERKNS_6StringES3_Ri
+__ZN7WebCore11StorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore11StorageArea15internalSetItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore10StorageMap7setItemERKNS_6StringES3_RS1_
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
+__ZN7WebCore10StorageMap18invalidateIteratorEv
+__ZN7WebCore18SessionStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore18SessionStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE15reserveCapacityEm
+__ZN7WebCore4Node20dispatchStorageEventERKNS_12AtomicStringERKNS_6StringES6_S6_PNS_5FrameE
+__ZN7WebCore12StorageEventC1ERKNS_12AtomicStringERKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore12StorageEventC2ERKNS_12AtomicStringERKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE6shrinkEm
+__ZN7WebCore9JSStorage10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore7Storage7getItemERKNS_6StringE
+__ZNK7WebCore11StorageArea7getItemERKNS_6StringE
+__ZNK7WebCore11StorageArea15internalGetItemERKNS_6StringE
+__ZNK7WebCore10StorageMap7getItemERKNS_6StringE
+__ZN7WebCore36jsStoragePrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage10removeItemERKNS_6StringE
+__ZN7WebCore11StorageArea10removeItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore11StorageArea18internalRemoveItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore10StorageMap10removeItemERKNS_6StringERS1_
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E4takeERKS2_
+__ZN7WebCore18SessionStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
+__ZN7WebCore14SecurityOrigin28createFromDatabaseIdentifierERKNS_6StringE
+__ZNK7WebCore15SQLiteStatement18bindParameterCountEv
+__ZN7WebCore12SQLResultSetC1Ev
+__ZN7WebCore12SQLResultSetC2Ev
+__ZN7WebCore12SQLResultSet11setInsertIdEx
+__ZN7WebCore14SQLiteDatabase11lastChangesEv
+__ZN7WebCore12SQLResultSet15setRowsAffectedEi
+__ZN7WebCore18OriginQuotaManager12markDatabaseEPNS_8DatabaseE
+__ZN7WebCore17OriginUsageRecord12markDatabaseERKNS_6StringE
+__ZN7WebCore28JSCustomSQLStatementCallback11handleEventEPNS_14SQLTransactionEPNS_12SQLResultSetERb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SQLResultSetE
+__ZN7WebCore14JSSQLResultSet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSQLResultSetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SQLResultSetEEE
+__ZN7WebCore14JSSQLResultSetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SQLResultSetEEE
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE15reserveCapacityEm
+__ZN7WebCore8SQLValueC1ERKS0_
+__ZN7WebCore8SQLValueC2ERKS0_
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE6shrinkEm
+__ZN7WebCore15SQLiteStatement9bindValueEiRKNS_8SQLValueE
+__ZNK7WebCore8SQLValue6numberEv
+__ZN7WebCore15SQLiteStatement10bindDoubleEid
+__ZNK7WebCore8SQLValue6stringEv
+__ZN7WebCore14SQLTransaction19postflightAndCommitEv
+__ZN7WebCore15DatabaseTracker29scheduleNotifyDatabaseChangedEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCoreL17notificationMutexEv
+__ZN7WebCoreL17notificationQueueEv
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE15reserveCapacityEm
+__ZN7WebCore15DatabaseTracker23scheduleForNotificationEv
+__ZN7WebCore15DatabaseTracker22notifyDatabasesChangedEPv
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE6shrinkEm
+__ZN7WebCore14SQLTransaction27cleanupAfterSuccessCallbackEv
+__ZNK7WebCore12SQLResultSet4rowsEv
+__ZN7WebCore15SQLiteStatement13getColumnNameEi
+__ZN7WebCore15SQLiteStatement14getColumnValueEi
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEmPKS2_
+__ZN7WebCore17SQLiteTransaction4stopEv
+__ZN7WebCore14JSSQLResultSetD1Ev
+__ZN7WebCore14JSSQLResultSetD2Ev
+__ZN7WebCore23JSSQLResultSetPrototypeD1Ev
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore14toVoidCallbackEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore20JSCustomVoidCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore20JSCustomVoidCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackD0Ev
+__ZN7WebCore14SQLTransaction22deliverSuccessCallbackEv
+__ZN7WebCore20JSCustomVoidCallback11handleEventEv
+__ZN7WebCore20JSCustomVoidCallbackD0Ev
+__ZN7WebCore8Database21setAuthorizerReadOnlyEv
+__ZN7WebCore18DatabaseAuthorizer11setReadOnlyEv
+__ZN7WebCore10JSSQLError18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsSQLErrorMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18DatabaseAuthorizer11allowDeleteERKNS_6StringE
+__ZN7WebCore15DatabaseTracker18deleteAllDatabasesEv
+__ZN7WebCore15DatabaseTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE15reserveCapacityEm
+__ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker18deleteDatabaseFileEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCore10deleteFileERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE15reserveCapacityEm
+__ZN7WebCore8Database21markAsDeletedAndCloseEv
+__ZNK7WebCore14DatabaseThread20terminationRequestedEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE6shrinkEm
+__ZN7WebCore20deleteEmptyDirectoryERKNS_6StringE
+__ZN7WebCore18OriginQuotaManager12removeOriginEPNS_14SecurityOriginE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE6shrinkEm
+__ZN7WebCore18DatabaseAuthorizer13allowFunctionERKNS_6StringE
+__ZN7WebCore12SQLStatement20setFailureDueToQuotaEv
+__ZN7WebCore14SQLTransaction28deliverQuotaIncreaseCallbackEv
+__ZN7WebCore14JSSQLResultSet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsSQLResultSetRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SQLResultSetRowListE
+__ZN7WebCore21JSSQLResultSetRowList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSQLResultSetRowListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SQLResultSetRowListEEE
+__ZN7WebCore21JSSQLResultSetRowListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SQLResultSetRowListEEE
+__ZN7WebCore21JSSQLResultSetRowList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSSQLResultSetRowListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsSQLResultSetRowListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21JSSQLResultSetRowList9classInfoEv
+__ZN7WebCore21JSSQLResultSetRowList4itemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore19SQLResultSetRowList6lengthEv
+__ZN7WebCore18DatabaseAuthorizer9dropTableERKNS_6StringE
+__ZN7WebCore21JSSQLResultSetRowListD1Ev
+__ZN7WebCore21JSSQLResultSetRowListD2Ev
+__ZN7WebCore30JSSQLResultSetRowListPrototypeD1Ev
+__ZN7WebCore9JSStorage16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore9JSStorage22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore7Storage6lengthEv
+__ZNK7WebCore16LocalStorageArea6lengthEv
+__ZNK7WebCore11StorageArea14internalLengthEv
+__ZNK7WebCore10StorageMap6lengthEv
+__ZN7WebCore15jsStorageLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsStoragePrototypeFunctionClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage5clearEv
+__ZN7WebCore11StorageArea5clearEPNS_5FrameE
+__ZN7WebCore11StorageArea13internalClearEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11areaClearedEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea13scheduleClearEv
+__ZN7WebCore16LocalStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore9JSStorage3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSStorage9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16LocalStorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore16LocalStorageArea19scheduleItemForSyncERKNS_6StringES3_
+__ZNK7WebCore16LocalStorageArea7getItemERKNS_6StringE
+__ZN7WebCore9JSStorage14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore16LocalStorageArea10removeItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
+__ZN7WebCore5TimerINS_16LocalStorageAreaEE5firedEv
+__ZN7WebCore16LocalStorageArea14syncTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore12LocalStorage12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZNK7WebCore7Storage3keyEjRi
+__ZNK7WebCore16LocalStorageArea3keyEjRi
+__ZNK7WebCore11StorageArea11internalKeyEjRi
+__ZNK7WebCore10StorageMap3keyEjRNS_6StringE
+__ZNK7WebCore10StorageMap18setIteratorToIndexEj
+__ZN7WebCore33jsStoragePrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore29jsStoragePrototypeFunctionKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11StorageArea6lengthEv
+__ZN7WebCore18SessionStorageArea11areaClearedEPNS_5FrameE
+__ZNK7WebCore11StorageArea3keyEjRi
+__ZN7WebCore10StorageMap4copyEv
+__ZN7WebCoremlERKNS_8SMILTimeES2_
+__ZNK7WebCore14SVGSMILElement8isFrozenEv
+__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEEvT_T0_T1_
+__ZNK7WebCore19SVGAnimationElement9fromValueEv
+__ZN7WebCoreL22applyOrderSortFunctionEPNS_14SVGSMILElementES1_
+__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EEvT_T0_T1_
+__ZNK7WebCore10SVGElement8isStyledEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_13RenderSVGRootEi
+__ZN7WebCoreL19writeStandardPrefixERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore13RenderSVGRoot10renderNameEv
+__ZN7WebCoreL21writePositionAndStyleERNS_10TextStreamERKNS_12RenderObjectE
+__ZNK7WebCore13RenderSVGRoot17absoluteTransformEv
+__ZNK7WebCore12RenderObject17absoluteTransformEv
+__ZNK7WebCore9RenderBox14localTransformEv
+__ZNK7WebCore13RenderSVGRoot14localTransformEv
+__ZN7WebCorelsERNS_10TextStreamERKNS_9FloatRectE
+__ZN7WebCoreL12hasFractionsEd
+__ZN7WebCoreL17writeIfNotDefaultIfEEvRNS_10TextStreamEPKcT_S5_
+__ZN7WebCoreL15writeIfNotEmptyERNS_10TextStreamEPKcRKNS_6StringE
+__ZN7WebCoreL13writeChildrenERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore18RenderSVGContainer14isSVGContainerEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_18RenderSVGContainerEi
+__ZNK7WebCore18RenderSVGContainer10renderNameEv
+__ZNK7WebCore31RenderSVGTransformableContainer14localTransformEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_10RenderPathEi
+__ZNK7WebCore10RenderPath10renderNameEv
+__ZNK7WebCore10RenderPath14localTransformEv
+__ZN7WebCorelsERNS_10TextStreamERNS_19TextStreamSeparatorE
+__ZN7WebCorelsERNS_10TextStreamERKNS_14SVGPaintServerE
+__ZNK7WebCore19SVGPaintServerSolid22externalRepresentationERNS_10TextStreamE
+__ZN7WebCorelsERNS_10TextStreamERKNS_5ColorE
+__ZN7WebCoreL17writeIfNotDefaultIdEEvRNS_10TextStreamEPKcT_S5_
+__ZN7WebCore10TextStreamlsEd
+__ZNK7WebCore10RenderPath4pathEv
+__ZNK7WebCore4Path11debugStringEv
+__ZN7WebCoreL31CGPathToCFStringApplierFunctionEPvPK13CGPathElement
+__ZN7WebCoreL23writeNameAndQuotedValueINS_6StringEEEvRNS_10TextStreamEPKcT_
+__ZN7WebCore5writeERNS_10TextStreamERKNS_13RenderSVGTextEi
+__ZNK7WebCore13RenderSVGText10renderNameEv
+__ZN7WebCore10TextStreamlsEm
+__ZN7WebCore5writeERNS_10TextStreamERKNS_19RenderSVGInlineTextEi
+__ZNK7WebCore19RenderSVGInlineText10renderNameEv
+__ZNK7WebCore10RenderText14firstRunOriginEv
+__ZNK7WebCore16SVGInlineTextBox16svgRootInlineBoxEv
+__ZN7WebCore10TextStreamlsEj
+__ZN7WebCorelsERNS_10TextStreamERKNS_20TransformationMatrixE
+__ZN7WebCore11PathBuilder15svgCurveToCubicEddddddb
+__ZN7WebCore13ColorDistanceC1ERKNS_5ColorES3_
+__ZN7WebCore13ColorDistanceC2ERKNS_5ColorES3_
+__ZNK7WebCore13ColorDistance14scaledDistanceEf
+__ZN7WebCore13ColorDistanceC1Eiii
+__ZN7WebCore13ColorDistanceC2Eiii
+__ZNK7WebCore13ColorDistance18addToColorAndClampERKNS_5ColorE
+__ZN7WebCore16SVGStyledElement5styleEv
+__ZNK7WebCore4Font20drawTextUsingSVGFontEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZN7WebCore16SVGTextRunWalkerINS_28SVGTextRunWalkerDrawTextDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
+__ZN7WebCoreL28drawTextUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_28SVGTextRunWalkerDrawTextDataE
+__ZNK7WebCore24RenderSVGHiddenContainer14isSVGContainerEv
+__ZNK7WebCore24RenderSVGHiddenContainer10renderNameEv
+__ZNK7WebCore24RenderSVGHiddenContainer17absoluteTransformEv
+__ZN7WebCoreL24animatemotionConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGAnimateMotionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGAnimateMotionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGAnimateMotionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore23SVGAnimateMotionElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore23SVGAnimateMotionElement14hasValidTargetEv
+__ZNK7WebCore29SVGStyledTransformableElement21isStyledTransformableEv
+__ZN7WebCore29SVGStyledTransformableElement21supplementalTransformEv
+__ZNK7WebCore23SVGAnimateMotionElement13animationPathEv
+__ZN7WebCore23SVGAnimateMotionElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZN7WebCoreL10parsePointERKNS_6StringERNS_10FloatPointE
+__ZN7WebCore23SVGAnimateMotionElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZN7WebCore23SVGAnimateMotionElement20applyResultsToTargetEv
+__ZN7WebCore23SVGAnimateMotionElementD0Ev
+__ZN7WebCore18PathTraversalState13cubicBezierToERKNS_10FloatPointES3_S3_
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE6shrinkEm
+__ZNK7WebCore23SVGAnimateMotionElement10rotateModeEv
+__ZN7WebCoreL16mpathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGMPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGMPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGMPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn184_NK7WebCore15SVGMPathElement14contextElementEv
+__ZNK7WebCore15SVGMPathElement14contextElementEv
+__ZN7WebCore15SVGMPathElement11pathElementEv
+__ZN7WebCore15SVGMPathElementD0Ev
+__ZN7WebCore19SVGAnimationElement33calculateKeyTimesForCalcModePacedEv
+__ZN7WebCore17SVGAnimateElement17calculateDistanceERKNS_6StringES3_
+__ZN7WebCore23SVGAnimateMotionElement17calculateDistanceERKNS_6StringES3_
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE15reserveCapacityEm
+__ZNK7WebCore19SVGAnimationElement25calculatePercentForSplineEfj
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE6shrinkEm
+__ZThn304_NK7WebCore11SVGAElement14contextElementEv
+__ZNK7WebCore11SVGAElement14contextElementEv
+__ZNK7WebCore11SVGAElement7isValidEv
+__ZN7WebCore14SVGSMILElement14parseConditionERKNS_6StringENS0_10BeginOrEndE
+__ZN7WebCore14SVGSMILElement9ConditionC1ENS1_4TypeENS0_10BeginOrEndERKNS_6StringES6_NS_8SMILTimeEi
+__ZN7WebCore14SVGSMILElement9ConditionC2ENS1_4TypeENS0_10BeginOrEndERKNS_6StringES6_NS_8SMILTimeEi
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE15reserveCapacityEm
+__ZN7WebCore14SVGSMILElement16addTimeDependentEPS0_
+__ZN7WebCore14SVGSMILElement19removedFromDocumentEv
+__ZN7WebCore14SVGSMILElement19removeTimeDependentEPS0_
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE6shrinkEm
+__ZThn8_N7WebCore17SVGAnimateElementD0Ev
+__ZN7WebCoreL23animatecolorConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGAnimateColorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGAnimateColorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL27animatetransformConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore26SVGAnimateTransformElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore26SVGAnimateTransformElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore26SVGAnimateTransformElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore10SVGElement21isStyledTransformableEv
+__ZN7WebCore14SVGTextElement21supplementalTransformEv
+__ZN7WebCore26SVGAnimateTransformElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore26SVGAnimateTransformElement14hasValidTargetEv
+__ZN7WebCore25SVGTextPositioningElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore21SVGTextContentElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore26SVGAnimateTransformElement20applyResultsToTargetEv
+__ZN7WebCoreL16transformListForEPNS_10SVGElementE
+__ZN7WebCore22SVGAnimateColorElementD0Ev
+__ZN7WebCore26SVGAnimateTransformElementD0Ev
+__ZN7WebCoreL19polylineConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGPolylineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGPolyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGAnimatedPointsC2Ev
+__ZN7WebCore14SVGPolyElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore14SVGPolyElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14SVGPolyElement6pointsEv
+__ZN7WebCore12SVGPointListC1ERKNS_13QualifiedNameE
+__ZN7WebCore12SVGPointListC2ERKNS_13QualifiedNameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14shrinkCapacityEm
+__ZN7WebCore21pointsListFromSVGDataEPNS_12SVGPointListERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE15reserveCapacityEm
+__ZNK7WebCore14SVGPolyElement7isValidEv
+__ZN7WebCore14SVGPolyElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore14SVGPolyElement26updateAnimatedSVGAttributeERKNS_6StringE
+__ZN7WebCoreL18polygonConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGPolygonElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL14useConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore13SVGUseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13SVGUseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn408_NK7WebCore13SVGUseElement14contextElementEv
+__ZNK7WebCore13SVGUseElement14contextElementEv
+__ZN7WebCore13SVGUseElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore13SVGUseElement20insertedIntoDocumentEv
+__ZN7WebCore13SVGUseElement20buildPendingResourceEv
+__ZN7WebCore18SVGElementInstanceC1EPNS_13SVGUseElementEPNS_10SVGElementE
+__ZN7WebCore18SVGElementInstanceC2EPNS_13SVGUseElementEPNS_10SVGElementE
+__ZN7WebCore10SVGElement20mapInstanceToElementEPNS_18SVGElementInstanceE
+__ZN3WTF7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6exp
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reh
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13al
+__ZN7WebCore13SVGUseElement17buildInstanceTreeEPNS_10SVGElementEPNS_18SVGElementInstanceERb
+__ZN7WebCoreL19isDisallowedElementEPNS_4NodeE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11xAttrStringE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11yAttrStringE
+__ZN7WebCore13SVGUseElement15buildShadowTreeEPNS_10SVGElementEPNS_18SVGElementInstanceE
+__ZN7WebCoreL32subtreeContainsDisallowedElementEPNS_4NodeE
+__ZN7WebCore13SVGUseElement35removeDisallowedElementsFromSubtreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement29expandUseElementsInShadowTreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement32expandSymbolElementsInShadowTreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement40associateInstancesWithShadowTreeElementsEPNS_4NodeEPNS_18SVGElementInstanceE
+__ZN7WebCore18SVGElementInstance20setShadowTreeElementEPNS_10SVGElementE
+__ZN7WebCore13SVGUseElement34transferEventListenersToShadowTreeEPNS_18SVGElementInstanceE
+__ZN7WebCore13SVGUseElement16attachShadowTreeEv
+__ZN7WebCore13SVGUseElement6attachEv
+__ZNK7WebCore13SVGUseElement7isValidEv
+__ZN7WebCore13SVGUseElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10SVGElement16shadowParentNodeEv
+__ZN7WebCore13SVGUseElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore18SVGElementInstance13forgetWrapperEv
+__ZN7WebCore10TreeSharedINS_18SVGElementInstanceEE14removedLastRefEv
+__ZN7WebCore18SVGElementInstanceD0Ev
+__ZN7WebCore10SVGElement21removeInstanceMappingEPNS_18SVGElementInstanceE
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4fin
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47re
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rem
+__ZN7WebCore28removeAllChildrenInContainerINS_18SVGElementInstanceES1_EEvPT0_
+__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_18SVGElementInstanceES2_EEvRPT_S5_PT0_
+__ZThn8_N7WebCore22SVGAnimateColorElementD0Ev
+__ZThn8_N7WebCore26SVGAnimateTransformElementD0Ev
+__ZThn8_N7WebCore23SVGAnimateMotionElementD0Ev
+__ZN7WebCore18SVGPolylineElementD0Ev
+__ZN7WebCore14SVGPolyElementD2Ev
+__ZN7WebCore12SVGPointListD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE6shrinkEm
+__ZN7WebCore17SVGAnimatedPointsD2Ev
+__ZN7WebCore17SVGPolygonElementD0Ev
+__ZN7WebCore13SVGUseElement11recalcStyleENS_4Node11StyleChangeE
+__ZNK7WebCore18SVGPolylineElement10toPathDataEv
+__ZNK7WebCore17SVGPolygonElement10toPathDataEv
+__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEET_S5_S5_T0_T1_
+__ZN7WebCore26SVGAnimateTransformElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZNK7WebCore26SVGAnimateTransformElement19parseTransformValueERKNS_6StringE
+__ZN7WebCore12SVGTransform7isValidEv
+__ZN7WebCore26SVGAnimateTransformElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZN7WebCore20SVGTransformDistanceC1ERKNS_12SVGTransformES3_
+__ZN7WebCore20SVGTransformDistanceC2ERKNS_12SVGTransformES3_
+__ZNK7WebCore12SVGTransform4typeEv
+__ZNK7WebCore12SVGTransform5scaleEv
+__ZN7WebCore9FloatSize15narrowPrecisionEdd
+__ZNK7WebCore20SVGTransformDistance14scaledDistanceEf
+__ZN7WebCore20SVGTransformDistanceC1ENS_12SVGTransform16SVGTransformTypeEfffRKNS_20TransformationMatrixE
+__ZN7WebCore20SVGTransformDistanceC2ENS_12SVGTransform16SVGTransformTypeEfffRKNS_20TransformationMatrixE
+__ZNK7WebCore20SVGTransformDistance17addToSVGTransformERKNS_12SVGTransformE
+__ZNK7WebCore12SVGTransform9translateEv
+__ZNK7WebCore12SVGTransform14rotationCenterEv
+__ZNK7WebCore12SVGTransform5angleEv
+__ZN7WebCore18SVGElementInstance14setNeedsUpdateEb
+__ZN7WebCoreL30shadowTreeContainsChangedNodesEPNS_18SVGElementInstanceE
+__ZN7WebCore19SVGAnimatedPropertyINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableEle
+__ZNK7WebCore14SVGPolyElement15supportsMarkersEv
+__ZNK7WebCore14RenderSVGImage10isSVGImageEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_14RenderSVGImageEi
+__ZNK7WebCore14RenderSVGImage10renderNameEv
+__ZNK7WebCore14RenderSVGImage14localTransformEv
+__ZN7WebCore13SVGUseElement6detachEv
+__ZN7WebCore13SVGUseElementD0Ev
+__ZThn8_N7WebCore14SVGLineElementD0Ev
+__ZThn8_N7WebCore14SVGRectElementD0Ev
+__ZThn8_N7WebCore16SVGCircleElementD0Ev
+__ZThn8_N7WebCore18SVGPolylineElementD0Ev
+__ZThn8_N7WebCore17SVGPolygonElementD0Ev
+__ZThn8_N7WebCore15SVGImageElementD0Ev
+__ZN7WebCore9CSSParser23parseSVGStrokeDasharrayEv
+__ZNK7WebCore19SVGAnimationElement26currentValuesFromKeyPointsEfRfRNS_6StringES3_
+__ZNK7WebCore19SVGAnimationElement29calculatePercentFromKeyPointsEf
+__ZN3WTF6VectorIdLm0EE14expandCapacityEm
+__ZN3WTF6VectorIdLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIdLm0EE6shrinkEm
+__ZN3WTF6VectorIdLm0EEC1ERKS1_
+__ZN3WTF6VectorIdLm0EEC2ERKS1_
+__ZN7WebCorelsERNS_10TextStreamENS_8WindRuleE
+__ZN7WebCore14SVGSMILElement31createInstanceTimesFromSyncbaseEPS0_NS0_21NewOrExistingIntervalE
+__ZSt25__unguarded_linear_insertIPN7WebCore8SMILTimeES1_EvT_T0_
+__ZThn8_N7WebCore13SVGSetElementD0Ev
+__ZN7WebCore18SVGElementInstance11appendChildEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore22appendChildToContainerINS_18SVGElementInstanceES1_EEvPT_PT0_
+__ZN7WebCore13SVGUseElement24handleDeepUseReferencingEPS0_PNS_18SVGElementInstanceERb
+__ZNK7WebCore13SVGUseElement38transferUseAttributesToReplacedElementEPNS_10SVGElementES2_
+__ZN7WebCore13SVGUseElement19removedFromDocumentEv
+__ZThn8_N7WebCore13SVGUseElementD0Ev
+__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EET_S6_S6_T0_T1_
+__ZN7WebCore22ConditionEventListenerD0Ev
+__ZN7WebCore14SVGSMILElement10addEndTimeENS_8SMILTimeE
+__ZN7WebCore14SVGSMILElement14endListChangedEv
+__ZN7WebCore8SVGColorC1ENS0_12SVGColorTypeE
+__ZN7WebCore8SVGColorC2ENS0_12SVGColorTypeE
+__ZNK7WebCore28SVGPaintServerLinearGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore22SVGPaintServerGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore28SVGPaintServerLinearGradient11gradientEndEv
+__ZNK7WebCore28SVGPaintServerLinearGradient13gradientStartEv
+__ZN7WebCorelsERNS_10TextStreamERKNS_10FloatPointE
+__ZNK7WebCore21RenderSVGGradientStop10renderNameEv
+__ZN7WebCore12SVGTransform8setSkewXEf
+__ZN7WebCore12SVGTransform8setSkewYEf
+__ZN7WebCoreL18patternConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGPatternElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGPatternElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGPatternElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17SVGPatternElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore17SVGPatternElement7isValidEv
+__ZN7WebCore17SVGPatternElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore17SVGPatternElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17SVGPatternElement14canvasResourceEv
+__ZN7WebCore21SVGPaintServerPatternC1EPKNS_17SVGPatternElementE
+__ZN7WebCore21SVGPaintServerPatternC2EPKNS_17SVGPatternElementE
+__ZNK7WebCore21SVGPaintServerPattern5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZNK7WebCore17SVGPatternElement12buildPatternERKNS_9FloatRectE
+__ZNK7WebCore17SVGPatternElement24collectPatternPropertiesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11xAtt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11yAtt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_16heig
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29patternContentUni
+__ZN3WTF7HashSetIPKN7WebCore17SVGPatternElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6exp
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6reh
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13al
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15de
+__ZNK7WebCore15SVGFitToViewBox22viewBoxToViewTransformEff
+__ZN7WebCore21SVGPaintServerPattern19setPatternTransformERKNS_20TransformationMatrixE
+__ZN7WebCore21SVGPaintServerPattern20setPatternBoundariesERKNS_9FloatRectE
+__ZN7WebCore21SVGPaintServerPattern7setTileESt8auto_ptrINS_11ImageBufferEE
+__ZNK7WebCore21SVGPaintServerPattern4tileEv
+__ZNK7WebCore21SVGPaintServerPattern17patternBoundariesEv
+__ZNK7WebCore21SVGPaintServerPattern16patternTransformEv
+__ZNK7WebCore21SVGPaintServerPattern8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZN7WebCore10TextStreamlsEb
+__ZNK7WebCore28SVGPaintServerRadialGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore28SVGPaintServerRadialGradient14gradientRadiusEv
+__ZNK7WebCore28SVGPaintServerRadialGradient13gradientFocalEv
+__ZNK7WebCore28SVGPaintServerRadialGradient14gradientCenterEv
+__ZNK7WebCore21SVGPaintServerPattern22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore17SVGPatternElementD0Ev
+__ZN7WebCore21SVGPaintServerPatternD0Ev
+__ZNK7WebCore13SVGSVGElement7isValidEv
+__ZN7WebCore26RenderSVGViewportContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore26RenderSVGViewportContainerC2EPNS_16SVGStyledElementE
+__ZN7WebCore26RenderSVGViewportContainer12calcViewportEv
+__ZNK7WebCore26RenderSVGViewportContainer22localToParentTransformEv
+__ZNK7WebCore26RenderSVGViewportContainer8viewportEv
+__ZNK7WebCore26RenderSVGViewportContainer17viewportTransformEv
+__ZN7WebCore26RenderSVGViewportContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore26RenderSVGViewportContainer17applyViewportClipERNS_12RenderObject9PaintInfoE
+__ZNK7WebCore26RenderSVGViewportContainer14isSVGContainerEv
+__ZNK7WebCore26RenderSVGViewportContainer10renderNameEv
+__ZNK7WebCore26RenderSVGViewportContainer17absoluteTransformEv
+__ZN7WebCore26RenderSVGViewportContainerD0Ev
+__ZN7WebCore7DataRefINS_13StyleMiscDataEE6accessEv
+__ZN7WebCore13StyleMiscDataC1ERKS0_
+__ZN7WebCore13StyleMiscDataC2ERKS0_
+__ZNK7WebCore13StyleMiscDataeqERKS0_
+__ZN7WebCoreL18writeNameValuePairINS_6StringEEEvRNS_10TextStreamEPKcT_
+__ZN7WebCore15GraphicsContext18setShouldAntialiasEb
+__ZN7WebCore15GraphicsContext26setPlatformShouldAntialiasEb
+__ZNK7WebCore14RenderSVGTSpan10renderNameEv
+__ZN7WebCoreL30floatWidthMissingGlyphCallbackERKNS_7TextRunERNS_34SVGTextRunWalkerMeasuredLengthDataE
+__ZNK7WebCore4Font12fontSelectorEv
+__ZN7WebCoreL28drawTextMissingGlyphCallbackERKNS_7TextRunERNS_28SVGTextRunWalkerDrawTextDataE
+__ZN7WebCoreL17cursorConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGCursorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGCursorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGCursorElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGCursorElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZThn264_NK7WebCore16SVGCursorElement14contextElementEv
+__ZNK7WebCore16SVGCursorElement14contextElementEv
+__ZNK7WebCore16SVGCursorElement7isValidEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11xAttrS
+__ZN7WebCore13CSSImageValue14cachedImageURLEv
+__ZN7WebCore13CSSImageValue16clearCachedImageEv
+__ZN3WTF7HashSetIPN7WebCore10SVGElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTa
+__ZN7WebCore16SVGCursorElement9addClientEPNS_10SVGElementE
+__ZNK7WebCore15RenderSVGInline10renderNameEv
+__ZN7WebCore16SVGCursorElement12removeClientEPNS_10SVGElementE
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore19CSSCursorImageValue23removeReferencedElementEPNS_10SVGElementE
+__ZN7WebCore16SVGCursorElementD0Ev
+__ZN7WebCore19SVGAnimatedPropertyINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEEE
+__ZN7WebCoreL15viewConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGViewElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGViewElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGViewElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGViewElement16rendererIsNeededEPNS_11RenderStyleE
+__ZThn288_NK7WebCore14SVGViewElement14contextElementEv
+__ZNK7WebCore14SVGViewElement14contextElementEv
+__ZNK7WebCore14SVGViewElement10viewTargetEv
+__ZN7WebCore13SVGStringListC1ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGStringListC2ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGStringList5resetERKNS_6StringE
+__ZN7WebCore13SVGStringList5parseERKNS_6StringEt
+__ZN7WebCore14SVGViewElementD0Ev
+__ZN7WebCore13SVGStringListD0Ev
+__ZN7WebCoreL19clippathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGClipPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGClipPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore18SVGClipPathElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore18SVGClipPathElement7isValidEv
+__ZN7WebCore18SVGClipPathElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore18SVGClipPathElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13StyleClipDataC1ERKS0_
+__ZN7WebCore13StyleClipDataC2ERKS0_
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEE1
+__ZNK7WebCore13StyleClipDataeqERKS0_
+__ZN7WebCore18SVGClipPathElement14canvasResourceEv
+__ZN7WebCore18SVGResourceClipperC1Ev
+__ZN7WebCore18SVGResourceClipperC2Ev
+__ZNK7WebCore29SVGStyledTransformableElement10toClipPathEv
+__ZN7WebCore18SVGResourceClipper11addClipDataERKNS_4PathENS_8WindRuleEb
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE15reserveCapacityEm
+__ZNK7WebCore18SVGResourceClipper8clipDataEv
+__ZNK7WebCore18SVGResourceClipper12resourceTypeEv
+__ZNK7WebCore18SVGResourceClipper9applyClipEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZN7WebCore15GraphicsContext8clipPathENS_8WindRuleE
+__ZN7WebCore18SVGResourceClipper13resetClipDataEv
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE6shrinkEm
+__ZN7WebCorelsERNS_10TextStreamERKNS_11SVGResourceE
+__ZNK7WebCore18SVGResourceClipper22externalRepresentationERNS_10TextStreamE
+__ZN7WebCorelsINS_8ClipDataEEERNS_10TextStreamES3_RKN3WTF6VectorIT_Lm0EEE
+__ZN7WebCorelsERNS_10TextStreamERKNS_8ClipDataE
+__ZNK7WebCore17SVGResourceMasker22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore18SVGClipPathElementD0Ev
+__ZN7WebCore18SVGResourceClipperD0Ev
+__ZN7WebCoreL17markerConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGMarkerElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGMarkerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8SVGAngleC1Ev
+__ZN7WebCore8SVGAngleC2Ev
+__ZN7WebCore16SVGMarkerElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGMarkerElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZThn312_NK7WebCore16SVGMarkerElement14contextElementEv
+__ZNK7WebCore16SVGMarkerElement14contextElementEv
+__ZN7WebCore16SVGMarkerElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16SVGMarkerElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore15StyleMarkerDataC1ERKS0_
+__ZN7WebCore15StyleMarkerDataC2ERKS0_
+__ZN7WebCore7DataRefINS_15StyleMarkerDataEE6accessEv
+__ZNK7WebCore15StyleMarkerDataeqERKS0_
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_22marker
+__ZN7WebCore16SVGMarkerElement14canvasResourceEv
+__ZN7WebCore17SVGResourceMarkerC1Ev
+__ZN7WebCore17SVGResourceMarkerC2Ev
+__ZN7WebCore17SVGResourceMarker9setMarkerEPNS_26RenderSVGViewportContainerE
+__ZNK7WebCore8SVGAngle5valueEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refYAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refXAt
+__ZN7WebCore17SVGResourceMarker6setRefEdd
+__ZNK7WebCore17SVGResourceMarker12resourceTypeEv
+__ZN7WebCore15DrawMarkersDataC1EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
+__ZN7WebCore15DrawMarkersDataC2EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
+__ZN7WebCoreL22drawStartAndMidMarkersEPvPKNS_11PathElementE
+__ZN7WebCoreL18drawMarkerWithDataEPNS_15GraphicsContextERNS_10MarkerDataE
+__ZN7WebCore17SVGResourceMarker4drawEPNS_15GraphicsContextERKNS_9FloatRectEdddd
+__ZNK3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8con
+__ZN3WTF7HashSetIPN7WebCore17SVGResourceMarkerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expa
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reha
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13all
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dea
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4find
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47rem
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remo
+__ZNK7WebCore17SVGResourceMarker12cachedBoundsEv
+__ZNK7WebCore17SVGResourceMarker22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore16SVGMarkerElementD0Ev
+__ZN7WebCore17SVGResourceMarkerD0Ev
+__ZN7WebCore8SVGAngleD0Ev
+__ZThn240_NK7WebCore17SVGPatternElement14contextElementEv
+__ZNK7WebCore17SVGPatternElement14contextElementEv
+__ZNK3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8co
+__ZN7WebCore16SVGTransformList11consolidateEv
+__ZNK7WebCore13RenderSVGText14localTransformEv
+__ZN7WebCore15GraphicsContext16setStrokePatternEN3WTF10PassRefPtrINS_7PatternEEE
+__ZN7WebCore15GraphicsContext18applyStrokePatternEv
+__ZN7WebCoreL17switchConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGSwitchElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16SVGSwitchElement7isValidEv
+__ZN7WebCore16SVGSwitchElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore16SVGSwitchElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore8SVGTests18requiredExtensionsEv
+__ZNK7WebCore8SVGTests14systemLanguageEv
+__ZN7WebCore16SVGSwitchElementD0Ev
+__ZNK7WebCore8SVGTests16requiredFeaturesEv
+__ZN7WebCore27jsSVGElementOwnerSVGElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsSVGRectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11xAttrStri
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGRectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_
+__ZN7WebCore17jsSVGRectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStri
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGRectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3
+__ZN7WebCore22jsSVGRectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_16heightAtt
+__ZN7WebCore11JSSVGLength3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSSVGLengthValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9SVGLength8setValueEf
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE12commitChangeES1_PNS_10SVGElementE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStrin
+__ZN7WebCore15SVGTitleElement19removedFromDocumentEv
+__ZN7WebCore16SVGScriptElement19removedFromDocumentEv
+__ZN7WebCore13SVGUseElement24alterShadowTreeForSVGTagEPNS_10SVGElementE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_15widthAttrStr
+__ZN7WebCoreL17symbolConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGSymbolElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGSymbolElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGSymbolElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn312_NK7WebCore16SVGSymbolElement14contextElementEv
+__ZNK7WebCore16SVGSymbolElement14contextElementEv
+__ZN7WebCore16SVGSymbolElement16rendererIsNeededEPNS_11RenderStyleE
+__ZThn8_N7WebCore16SVGSymbolElementD0Ev
+__ZN7WebCore16SVGSymbolElementD0Ev
+__ZThn8_N7WebCore17SVGEllipseElementD0Ev
+__ZN7WebCore21SVGDocumentExtensions18addPendingResourceERKNS_12AtomicStringEPNS_16SVGStyledElementE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHash
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS
+__ZNK7WebCore22SVGCharacterLayoutInfo22baselineShiftValueNextEv
+__ZN7WebCoreL15trefConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGTRefElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGTRefElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGTRefElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn672_NK7WebCore14SVGTRefElement14contextElementEv
+__ZNK7WebCore14SVGTRefElement14contextElementEv
+__ZN7WebCore14SVGTRefElement20updateReferencedTextEv
+__ZN7WebCore14SVGTRefElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore14SVGTRefElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore17RenderSVGTextPath10renderNameEv
+__ZN7WebCoreL23angleToGlyphOrientationEf
+__ZN7WebCoreL27cummulatedHeightOfTextChunkERNS_12SVGTextChunkE
+__ZN7WebCore41cummulatedHeightOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZN7WebCore14SVGTRefElementD0Ev
+__ZN7WebCore16SVGRootInlineBox37retrievePaintServersForTextDecorationEPNS_12RenderObjectE
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE6shrinkEm
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10Has
+__ZN7WebCore16SVGInlineTextBox15paintDecorationENS_15ETextDecorationEPNS_15GraphicsContextEiiiRKNS_7SVGCharERKNS_21SVGTextDecor
+__ZNK3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10Ha
+__ZNK3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZNK7WebCore22SVGCharacterLayoutInfo11dyValueNextEv
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHas
+__ZN7WebCore21SVGDocumentExtensions21removePendingResourceERKNS_12AtomicStringE
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC1ERKS
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC2ERKS
+__ZN7WebCore11SVGResource17invalidateClientsEN3WTF7HashSetIPNS_16SVGStyledElementENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_13SVGNumberListENS1_10StringHashENS_10HashTraitsIS6_EENS
+__ZN7WebCore13SVGNumberList5parseERKNS_6StringE
+__ZNK7WebCore22SVGCharacterLayoutInfo14angleValueNextEv
+__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionSelectSubStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore21SVGTextContentElement15selectSubStringEjjRi
+__ZN7WebCore19RenderSVGInlineText23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore12RenderObject20isSVGHiddenContainerEv
+__ZN7WebCore19RenderSVGInlineText26computeRepaintRectForRangeEPNS_20RenderBoxModelObjectEii
+__ZN7WebCore19RenderSVGInlineText26computeRepaintQuadForRangeEPNS_20RenderBoxModelObjectEii
+__ZN7WebCore17findSVGRootObjectEPNS_12RenderObjectE
+__ZN7WebCore16SVGInlineTextBox13selectionRectEiiii
+__ZN7WebCore18SVGTextChunkWalkerINS_35SVGInlineTextBoxSelectionRectWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatr
+__ZN7WebCore35SVGInlineTextBoxSelectionRectWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKP
+__ZN7WebCore16SVGInlineTextBox14paintSelectionEiRKNS_7SVGCharEPKtiPNS_15GraphicsContextEPNS_11RenderStyleERKNS_4FontE
+__ZNK7WebCore22SVGCharacterLayoutInfo11dxValueNextEv
+__ZN7WebCore45jsSVGTextElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement12getScreenCTMEv
+__ZNK7WebCore16SVGTransformable12getScreenCTMEPKNS_10SVGElementE
+__ZN7WebCore12SVGLocatable12getScreenCTMEPKNS_10SVGElementE
+__ZNK7WebCore25SVGStyledLocatableElement17isStyledLocatableEv
+__ZNK7WebCore29SVGStyledTransformableElement12getScreenCTMEv
+__ZNK7WebCore13SVGSVGElement12getScreenCTMEv
+__ZNK7WebCore25SVGStyledLocatableElement12getScreenCTMEv
+__ZThn240_NK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
+__ZThn672_NK7WebCore14SVGTextElement22animatedLocalTransformEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGMatrix15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEEEPNS
+__ZN7WebCore11JSSVGMatrixC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEEEPNS
+__ZN7WebCore11JSSVGMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEEcvS1_Ev
+__ZN7WebCore12jsSVGMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixFEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGTextElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement6getCTMEv
+__ZNK7WebCore16SVGTransformable6getCTMEPKNS_10SVGElementE
+__ZN7WebCore12SVGLocatable6getCTMEPKNS_10SVGElementE
+__ZNK7WebCore29SVGStyledTransformableElement6getCTMEv
+__ZNK7WebCore13SVGSVGElement6getCTMEv
+__ZN7WebCore54jsSVGTextElementPrototypeFunctionGetTransformToElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore12toSVGElementEN3JSC7JSValueE
+__ZNK7WebCore12SVGLocatable21getTransformToElementEPNS_10SVGElementERi
+__ZTv0_n56_NK7WebCore14SVGTextElement6getCTMEv
+__ZN7WebCore27JSSVGCircleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsSVGCircleElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore29SVGStyledTransformableElement7getBBoxEv
+__ZN7WebCore12SVGLocatable7getBBoxEPKNS_10SVGElementE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSSVGRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9FloatRectEEEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9FloatRectEEEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10jsSVGRectXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEEcvS1_Ev
+__ZN7WebCore10jsSVGRectYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsSVGRectWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsSVGRectHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGCircleElementFarthestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29SVGStyledTransformableElement23farthestViewportElementEv
+__ZN7WebCore12SVGLocatable23farthestViewportElementEPKNS_10SVGElementE
+__ZN7WebCore40jsSVGCircleElementNearestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29SVGStyledTransformableElement22nearestViewportElementEv
+__ZN7WebCore9JSSVGRectD1Ev
+__ZN7WebCore9JSSVGRectD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEED0Ev
+__ZN7WebCore11JSSVGMatrixD1Ev
+__ZN7WebCore11JSSVGMatrixD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEED0Ev
+__ZN7WebCore18JSSVGRectPrototypeD1Ev
+__ZN7WebCore20JSSVGMatrixPrototypeD1Ev
+__ZThn400_NK7WebCore17SVGPatternElement14contextElementEv
+__ZNK7WebCore14RenderSVGTSpan17objectBoundingBoxEv
+__ZN7WebCore13StyleTextDataC1ERKS0_
+__ZN7WebCore13StyleTextDataC2ERKS0_
+__ZNK7WebCore13StyleTextDataeqERKS0_
+__ZN7WebCore20findCharUnicodeRangeEi
+__ZThn288_N7WebCore16SVGScriptElement17dispatchLoadEventEv
+__ZN7WebCore16SVGScriptElement17dispatchLoadEventEv
+__ZN7WebCoreL26createSVGUseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGUseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGUseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGUseElementEEE
+__ZN7WebCore15JSSVGUseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGUseElementEEE
+__ZN7WebCore15JSSVGUseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSSVGUseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGUseElement9classInfoEv
+__ZN7WebCoreL30createSVGEllipseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGEllipseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGEllipseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGEllipseElementEEE
+__ZN7WebCore19JSSVGEllipseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGEllipseElementEEE
+__ZN7WebCore19JSSVGEllipseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSSVGEllipseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGEllipseElement9classInfoEv
+__ZN7WebCoreL27createSVGDefsElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGDefsElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGDefsElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDefsElementEEE
+__ZN7WebCore16JSSVGDefsElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDefsElementEEE
+__ZN7WebCoreL37createSVGLinearGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGLinearGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGLinearGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGLinearGradientElementEEE
+__ZN7WebCore26JSSVGLinearGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGLinearGradientElementEEE
+__ZN7WebCore20JSSVGGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGGradientElementEEE
+__ZN7WebCore26JSSVGLinearGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSSVGGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSSVGLinearGradientElement9classInfoEv
+__ZN7WebCoreL27createSVGStopElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGStopElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGStopElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGStopElementEEE
+__ZN7WebCore16JSSVGStopElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGStopElementEEE
+__ZN7WebCore16JSSVGStopElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGStopElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGStopElement9classInfoEv
+__ZN7WebCore16JSSVGDefsElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGDefsElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGDefsElement9classInfoEv
+__ZN7WebCoreL27createSVGLineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGLineElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGLineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGLineElementEEE
+__ZN7WebCore16JSSVGLineElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGLineElementEEE
+__ZN7WebCore16JSSVGLineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGLineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGLineElement9classInfoEv
+__ZN7WebCore16JSSVGStopElementD1Ev
+__ZN7WebCore26JSSVGLinearGradientElementD1Ev
+__ZN7WebCore19JSSVGEllipseElementD1Ev
+__ZN7WebCore15JSSVGUseElementD1Ev
+__ZN7WebCore28JSSVGEllipseElementPrototypeD1Ev
+__ZN7WebCore24JSSVGUseElementPrototypeD1Ev
+__ZN7WebCore16JSSVGLineElementD1Ev
+__ZN7WebCore25JSSVGLineElementPrototypeD1Ev
+__ZN7WebCore25JSSVGStopElementPrototypeD1Ev
+__ZN7WebCore35JSSVGLinearGradientElementPrototypeD1Ev
+__ZN7WebCore16JSSVGDefsElementD1Ev
+__ZThn8_N7WebCore14SVGDefsElementD0Ev
+__ZN7WebCore25JSSVGDefsElementPrototypeD1Ev
+__ZN7WebCore21SVGDocumentExtensions11reportErrorERKNS_6StringE
+__ZThn8_N7WebCore15SVGTSpanElementD0Ev
+__ZN7WebCoreL29createSVGSymbolElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGSymbolElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGSymbolElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGSymbolElementEEE
+__ZN7WebCore18JSSVGSymbolElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGSymbolElementEEE
+__ZN7WebCore18JSSVGSymbolElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGSymbolElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGSymbolElement9classInfoEv
+__ZN7WebCore18JSSVGSymbolElementD1Ev
+__ZN7WebCore27JSSVGSymbolElementPrototypeD1Ev
+__ZN7WebCore10JSSVGPaintC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGPaintEEE
+__ZN7WebCore10JSSVGPaintC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGPaintEEE
+__ZN7WebCore10JSSVGColorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGColorEEE
+__ZN7WebCore10JSSVGPaint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSSVGColor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10JSSVGPaint9classInfoEv
+__ZN7WebCore10JSSVGPaintD1Ev
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGMatrixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGMatrixEv
+__ZN7WebCore20JSSVGMatrixPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore44jsSVGMatrixPrototypeFunctionRotateFromVectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSSVGMatrix9classInfoEv
+__ZN7WebCore11JSSVGMatrix16rotateFromVectorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore20TransformationMatrix16rotateFromVectorEdd
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGExceptionEPNS_10SVGElementE
+__ZN7WebCore14JSSVGExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGExceptionEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGExceptionEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGException9classInfoEv
+__ZN7WebCore25jsSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGMatrixPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGExceptionD1Ev
+__ZN7WebCore14JSSVGExceptionD2Ev
+__ZN7WebCore24jsSVGDocumentRootElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGNumberEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGNumberEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperIfEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumber15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGNumberC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperIfEEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumberC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperIfEEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumber18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsSVGNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfEcvfEv
+__ZN7WebCore11JSSVGNumber3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSSVGNumberValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfE12commitChangeEfPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumberD1Ev
+__ZN7WebCore11JSSVGNumberD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfED0Ev
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14createSVGPointEv
+__ZN7WebCore10JSSVGPoint3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore14setJSSVGPointXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14setJSSVGPointYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20JSSVGNumberPrototypeD1Ev
+__ZN7WebCore19JSSVGPointPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsSVGMatrixPrototypeFunctionInverseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSSVGMatrix7inverseEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore42jsSVGPointPrototypeFunctionMatrixTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSSVGPoint9classInfoEv
+__ZN7WebCore11toSVGMatrixEN3JSC7JSValueE
+__ZNK7WebCore10FloatPoint15matrixTransformERKNS_20TransformationMatrixE
+__ZN7WebCore23JSSVGTextContentElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore45jsSVGSVGElementPrototypeFunctionCreateSVGRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement13createSVGRectEv
+__ZN7WebCore9JSSVGRect3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore13setJSSVGRectXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore13setJSSVGRectYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17setJSSVGRectWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18setJSSVGRectHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL23dominantBaselineToShiftEbPKNS_12RenderObjectERKNS_4FontE
+__ZNK7WebCore21SVGPathSegSingleCoord8toStringEv
+__ZNK7WebCore19SVGPathSegMovetoAbs19pathSegTypeAsLetterEv
+__ZN7WebCore14SVGPathSegList14createAnimatedEPKS0_S2_f
+__ZNK7WebCore19SVGPathSegLinetoAbs19pathSegTypeAsLetterEv
+__ZNK7WebCore22SVGPathSegCurvetoCubic8toStringEv
+__ZNK7WebCore25SVGPathSegCurvetoCubicAbs19pathSegTypeAsLetterEv
+__ZN7WebCoreL24foreignobjectConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGForeignObjectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23SVGForeignObjectElement7isValidEv
+__ZN7WebCore23SVGForeignObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore19RenderForeignObjectC1EPNS_23SVGForeignObjectElementE
+__ZN7WebCore19RenderForeignObjectC2EPNS_23SVGForeignObjectElementE
+__ZNK7WebCore19RenderForeignObject13requiresLayerEv
+__ZNK7WebCore23SVGForeignObjectElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore16jsSVGSVGElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrString
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11
+__ZN7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrStringEE
+__ZN7WebCore19RenderForeignObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore19RenderForeignObject22localToParentTransformEv
+__ZNK7WebCore19RenderForeignObject24translationForAttributesEv
+__ZNK7WebCore19RenderForeignObject14localTransformEv
+__ZN7WebCore19RenderForeignObject6layoutEv
+__ZNK7WebCore19RenderForeignObject29repaintRectInLocalCoordinatesEv
+__ZN7WebCore19RenderForeignObject5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore19RenderForeignObject10renderNameEv
+__ZN7WebCore19RenderForeignObjectD0Ev
+__ZN7WebCore13RenderSVGRoot11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore10RenderPath16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZN7WebCore21PointerEventsHitRulesC1ENS0_11EHitTestingENS_14EPointerEventsE
+__ZN7WebCore21PointerEventsHitRulesC2ENS0_11EHitTestingENS_14EPointerEventsE
+__ZNK7WebCore10RenderPath12fillContainsERKNS_10FloatPointEb
+__ZNK7WebCore11SVGDocument17zoomAndPanEnabledEv
+__ZN7WebCore23SVGForeignObjectElementD0Ev
+__ZN7WebCore25jsSVGRectElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLName
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_6StringEEENS1_29SVGAnimatedTypeWrapperKey
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_6StringEEENS1_29SVGAnimatedTypeWrapperKeyH
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_6StringEEEENS_18PairFirstExtr
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_6StringEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedString15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedStringC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_6StringEEEEEPNS_10SVGE
+__ZN7WebCore19JSSVGAnimatedStringC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_6StringEEEEEPNS_10SVGE
+__ZN7WebCore19JSSVGAnimatedString3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAnimatedStringBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames
+__ZN7WebCore19synchronizePropertyINS_16SVGStyledElementENS_6StringEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore19JSSVGAnimatedStringD1Ev
+__ZN7WebCore19JSSVGAnimatedStringD2Ev
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGStyledElementES1_NS_6StringES2_XadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZN
+__ZN7WebCore28JSSVGAnimatedStringPrototypeD1Ev
+__ZN7WebCore18RenderSVGContainer16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActi
+__ZN7WebCore18RenderSVGContainer25pointIsInsideViewportClipERKNS_10FloatPointE
+__ZNK7WebCore7Element5titleEv
+__ZNK7WebCore13SVGZoomAndPan10zoomAndPanEv
+__ZN7WebCore12RenderObject16positionForPointERKNS_8IntPointE
+__ZN7WebCoreL31createSVGClipPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGClipPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGClipPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGClipPathElementEEE
+__ZN7WebCore20JSSVGClipPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGClipPathElementEEE
+__ZN7WebCore20JSSVGClipPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSSVGClipPathElementD1Ev
+__ZN7WebCore29JSSVGClipPathElementPrototypeD1Ev
+__ZNK7WebCore13SVGUseElement10toClipPathEv
+__ZN7WebCore33jsSVGClipPathElementClipPathUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGClipPathElementEiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipPathUnitsA
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIiEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIiEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIiEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIiEEPNS_10SVGElementE
+__ZN7WebCore24JSSVGAnimatedEnumeration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGAnimatedEnumerationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIiEEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGAnimatedEnumerationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIiEEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGAnimatedEnumeration3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore34setJSSVGAnimatedEnumerationBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24JSSVGAnimatedEnumerationD1Ev
+__ZN7WebCore24JSSVGAnimatedEnumerationD2Ev
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_18SVGClipPathElementES1_iiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipP
+__ZN7WebCore33JSSVGAnimatedEnumerationPrototypeD1Ev
+__ZN7WebCoreL31createSVGMetadataElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGMetadataElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGMetadataElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGMetadataElementEEE
+__ZN7WebCore20JSSVGMetadataElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGMetadataElementEEE
+__ZNK7WebCore20JSSVGMetadataElement9classInfoEv
+__ZN7WebCore20JSSVGMetadataElementD1Ev
+__ZThn8_N7WebCore18SVGMetadataElementD0Ev
+__ZN7WebCore29JSSVGMetadataElementPrototypeD1Ev
+__ZN7WebCore26RenderSVGViewportContainer25pointIsInsideViewportClipERKNS_10FloatPointE
+__ZNK7WebCore10RenderPath14strokeContainsERKNS_10FloatPointEb
+__ZNK7WebCore4Path14strokeContainsEPNS_18StrokeStyleApplierERKNS_10FloatPointE
+__ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeE
+__ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeEPNS_18SVGElementInstanceE
+__ZThn24_N7WebCore18SVGElementInstance14refEventTargetEv
+__ZN7WebCore18SVGElementInstance14refEventTargetEv
+__ZThn24_N7WebCore18SVGElementInstance6toNodeEv
+__ZN7WebCore18SVGElementInstance6toNodeEv
+__ZThn24_N7WebCore18SVGElementInstance16derefEventTargetEv
+__ZN7WebCore18SVGElementInstance16derefEventTargetEv
+__ZN7WebCore22jsSVGStopElementOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE15a
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEENS_
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIfEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGStopElementES1_ffXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStr
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIfEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIfEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIfEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumber15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedNumberC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIfEEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumberC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIfEEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumber18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsSVGAnimatedNumberBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE9ba
+__ZN7WebCore19JSSVGAnimatedNumber3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAnimatedNumberBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19JSSVGAnimatedNumberD1Ev
+__ZN7WebCore19JSSVGAnimatedNumberD2Ev
+__ZNK7WebCore24JSSVGSVGElementPrototype9classInfoEv
+__ZNK7WebCore21JSSVGElementPrototype9classInfoEv
+__ZN7WebCore29jsSVGSVGElementSystemLanguageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13SVGStringListEPNS_10SVGElementE
+__ZN7WebCore15JSSVGStringList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGStringListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGStringListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGStringListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGStringListEEEPNS_10SVGElementE
+__ZN7WebCore40jsSVGSVGElementExternalResourcesRequiredEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn296_NK7WebCore13SVGSVGElement14contextElementEv
+__ZN7WebCore21lookupOrCreateWrapperINS_28SVGExternalResourcesRequiredEbXadL_ZNS_38SVGExternalResourcesRequiredIdentifierEEEXadL
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIbEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIbEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIbEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIbEEPNS_10SVGElementE
+__ZN7WebCore20JSSVGAnimatedBoolean15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGAnimatedBooleanC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIbEEEEPNS_10SVGElementE
+__ZN7WebCore20JSSVGAnimatedBooleanC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIbEEEEPNS_10SVGElementE
+__ZN7WebCore31jsSVGSVGElementCurrentTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGSVGElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrSt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15
+__ZN7WebCore22jsSVGSVGElementViewBoxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGFitToViewBoxENS_9FloatRectEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXadL_ZNS_8SVGName
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9FloatRectEEENS1_29SVGAnimatedTypeWrapper
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGFitToViewBoxENS_10SVGElementENS_9FloatRectES3_XadL_ZNS_25SVGFitToViewBoxIdenti
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9FloatRectEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_9FloatRectEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_9FloatRectEEEPNS_10SVGElementE
+__ZN7WebCore17JSSVGAnimatedRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGAnimatedRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9FloatRectEEEEEPNS_10SVG
+__ZN7WebCore17JSSVGAnimatedRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9FloatRectEEEEEPNS_10SVG
+__ZN7WebCore37jsSVGSVGElementPixelUnitToMillimeterXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement22pixelUnitToMillimeterXEv
+__ZN7WebCore16jsSVGSVGElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11yAttrString
+__ZN7WebCore39jsSVGSVGElementScreenPixelToMillimeterXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement24screenPixelToMillimeterXEv
+__ZN7WebCore27jsSVGSVGElementCurrentScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGSVGElementViewportEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement8viewportEv
+__ZN7WebCore9FloatRect15narrowPrecisionEdddd
+__ZN7WebCore29jsSVGSVGElementUseCurrentViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGSVGElementXmllangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGLangSpace7xmllangEv
+__ZN7WebCore37jsSVGSVGElementPixelUnitToMillimeterYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement22pixelUnitToMillimeterYEv
+__ZN7WebCore24jsSVGSVGElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGSVGElementFarthestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25SVGStyledLocatableElement23farthestViewportElementEv
+__ZN7WebCore21jsSVGSVGElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16heightAttrS
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16
+__ZN7WebCore39jsSVGSVGElementScreenPixelToMillimeterYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement24screenPixelToMillimeterYEv
+__ZN7WebCore33jsSVGSVGElementRequiredExtensionsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGSVGElementContentStyleTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement16contentStyleTypeEv
+__ZN7WebCore32jsSVGSVGElementContentScriptTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement17contentScriptTypeEv
+__ZN7WebCore31jsSVGSVGElementRequiredFeaturesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGSVGElementXmlspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGLangSpace8xmlspaceEv
+__ZN7WebCore20jsSVGSVGElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementNearestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGSVGElementPreserveAspectRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGFitToViewBoxENS_22SVGPreserveAspectRatioEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXad
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEENS1_29SVGAnim
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGFitToViewBoxENS_10SVGElementENS_22SVGPreserveAspectRatioEPS3_XadL_ZNS_25SVGFit
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEENS1_29SVGAnima
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_22SVGPreserveAspectRatioEEEPNS_10SVGElementE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_22SVGPre
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_22SVGPre
+__ZN7WebCore25jsSVGSVGElementZoomAndPanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGElementXmlbaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10SVGElement7xmlbaseEv
+__ZN7WebCore27jsSVGElementViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_DISABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioD1Ev
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioD2Ev
+__ZN7WebCore15JSSVGStringListD1Ev
+__ZN7WebCore15JSSVGStringListD2Ev
+__ZN7WebCore17JSSVGAnimatedRectD1Ev
+__ZN7WebCore17JSSVGAnimatedRectD2Ev
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEED0Ev
+__ZN7WebCore20JSSVGAnimatedBooleanD1Ev
+__ZN7WebCore20JSSVGAnimatedBooleanD2Ev
+__ZN7WebCore28JSSVGAnimatedNumberPrototypeD1Ev
+__ZN7WebCore41JSSVGAnimatedPreserveAspectRatioPrototypeD1Ev
+__ZN7WebCore26JSSVGAnimatedRectPrototypeD1Ev
+__ZN7WebCore29JSSVGAnimatedBooleanPrototypeD1Ev
+__ZN7WebCore24JSSVGStringListPrototypeD1Ev
+__ZN7WebCore23SVGForeignObjectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore23SVGForeignObjectElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_1
+__ZN7WebCore15SVGFitToViewBox16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore57jsSVGRectElementPrototypeFunctionGetPresentationAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore16SVGStyledElement24getPresentationAttributeERKNS_6StringE
+__ZNK7WebCore15MappedAttribute5styleEv
+__ZN7WebCore38jsSVGColorPrototypeFunctionSetRGBColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8SVGPaintC1ERKNS_6StringERKNS_5ColorE
+__ZN7WebCore8SVGPaintC2ERKNS_6StringERKNS_5ColorE
+__ZN7WebCore10RenderPath17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore18RenderSVGContainer17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore14RenderSVGImage17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCoreL23fontfacenameConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGFontFaceNameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGFontFaceNameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore22SVGFontFaceNameElement8srcValueEv
+__ZN7WebCore15SVGGlyphElement19removedFromDocumentEv
+__ZN7WebCore22SVGFontFaceNameElementD0Ev
+__ZThn8_N7WebCore14SVGFontElementD0Ev
+__ZN7WebCoreL28createSVGStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGStyleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGStyleElementEEE
+__ZN7WebCore17JSSVGStyleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGStyleElementEEE
+__ZN7WebCore17JSSVGStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGStyleElement9classInfoEv
+__ZN7WebCore15SVGStyleElement19removedFromDocumentEv
+__ZN7WebCore17JSSVGStyleElementD1Ev
+__ZN7WebCore26JSSVGStyleElementPrototypeD1Ev
+__ZN7WebCore19RenderForeignObject16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestAct
+__ZN7WebCore49jsHTMLFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore49jsHTMLEmbedElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore37jsSVGGElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18RenderSVGContainer17objectBoundingBoxEv
+__ZN7WebCore40jsSVGTextElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement7getBBoxEv
+__ZN7WebCore26JSSVGImageElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGImageElement9classInfoEv
+__ZN7WebCore41jsSVGImageElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14RenderSVGImage17objectBoundingBoxEv
+__ZN7WebCore40jsSVGRectElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28jsSVGTextContentElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGRectElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21jsSVGRectElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsSVGStopElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13RenderSVGText16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZN7WebCore11SVGAElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore11SVGAElement5titleEv
+__ZNK7WebCore11SVGAElement11isFocusableEv
+__ZNK7WebCore11SVGAElement16isMouseFocusableEv
+__ZN7WebCore19RenderSVGInlineText14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore11SVGAElement6targetEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEE
+__ZN7WebCore21jsSVGPathElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14RenderSVGImage16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZNK7WebCore16SVGScriptElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore15SVGImageElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore41jsSVGDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12SVGZoomEventC1Ev
+__ZN7WebCore12SVGZoomEventC2Ev
+__ZNK7WebCore12SVGZoomEvent14isSVGZoomEventEv
+__ZN7WebCore15getDOMStructureINS_14JSSVGZoomEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore14JSSVGZoomEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGZoomEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGZoomEventEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGZoomEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGZoomEventEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGZoomEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGZoomEventZoomRectScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent14zoomRectScreenEv
+__ZN7WebCore27jsSVGZoomEventPreviousScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent13previousScaleEv
+__ZN7WebCore31jsSVGZoomEventPreviousTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent17previousTranslateEv
+__ZN7WebCore22jsSVGZoomEventNewScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent8newScaleEv
+__ZN7WebCore26jsSVGZoomEventNewTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent12newTranslateEv
+__ZN7WebCore14JSSVGZoomEventD1Ev
+__ZN7WebCore12SVGZoomEventD0Ev
+__ZN7WebCore23JSSVGZoomEventPrototypeD1Ev
+__ZN7WebCore8SVGPaintC1Ev
+__ZN7WebCore8SVGPaintC2Ev
+__ZN7WebCore28jsSVGTextPositioningElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEENS1_29SVGAnimatedTypeW
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEENS1_29SVGAnimatedTypeWr
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore23JSSVGAnimatedLengthList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGAnimatedLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_13SVGLengthListEE
+__ZN7WebCore23JSSVGAnimatedLengthListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_13SVGLengthListEE
+__ZN7WebCore23JSSVGAnimatedLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsSVGAnimatedLengthListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13SVGLengthListEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGLengthListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSSVGLengthListD1Ev
+__ZN7WebCore15JSSVGLengthListD2Ev
+__ZN7WebCore23JSSVGAnimatedLengthListD1Ev
+__ZN7WebCore23JSSVGAnimatedLengthListD2Ev
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEEENS_18Pair
+__ZN7WebCore24JSSVGLengthListPrototypeD1Ev
+__ZN7WebCore32JSSVGAnimatedLengthListPrototypeD1Ev
+__ZN7WebCore29JSSVGClipPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGClipPathElement9classInfoEv
+__ZThn8_N7WebCore14SVGStopElementD0Ev
+__ZN7WebCoreL29createSVGMarkerElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGMarkerElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGMarkerElementEEE
+__ZN7WebCore18JSSVGMarkerElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGMarkerElementEEE
+__ZN7WebCore18JSSVGMarkerElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGMarkerElement9classInfoEv
+__ZN7WebCore18JSSVGMarkerElementD1Ev
+__ZN7WebCoreL27createSVGMaskElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGMaskElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGMaskElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGMaskElementEEE
+__ZN7WebCore16JSSVGMaskElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGMaskElementEEE
+__ZN7WebCore16JSSVGMaskElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGMaskElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGMaskElement9classInfoEv
+__ZN7WebCore16JSSVGMaskElementD1Ev
+__ZN7WebCore25JSSVGMaskElementPrototypeD1Ev
+__ZN7WebCoreL30createSVGPatternElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGPatternElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGPatternElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPatternElementEEE
+__ZN7WebCore19JSSVGPatternElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPatternElementEEE
+__ZN7WebCore19JSSVGPatternElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSSVGPatternElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGPatternElement9classInfoEv
+__ZN7WebCore19JSSVGPatternElementD1Ev
+__ZN7WebCore28JSSVGPatternElementPrototypeD1Ev
+__ZN7WebCore28jsSVGLinearGradientElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEX
+__ZN7WebCore19synchronizePropertyINS_24SVGLinearGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore27jsSVGPathElementPathSegListEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SVGPathSegListEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGPathSegListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathSegListEEEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathSegListEEEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGPathSegListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsSVGPathSegListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSSVGPathSegList9classInfoEv
+__ZN7WebCore16JSSVGPathSegList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10SVGPathSegEPNS_10SVGElementE
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegMovetoAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegMovetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore12JSSVGPathSegC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGPathSegEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegMovetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSSVGPathSegMovetoAbs3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSSVGPathSegMovetoAbsXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21JSSVGPathSegMovetoAbsD1Ev
+__ZN7WebCore12JSSVGPathSegD2Ev
+__ZN7WebCore16JSSVGPathSegListD1Ev
+__ZN7WebCore16JSSVGPathSegListD2Ev
+__ZN7WebCore29jsSVGPathSegListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGPathSegListPrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList10removeItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicAbsEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicAbsEEEPNS_10SVG
+__ZN7WebCore30JSSVGPathSegMovetoAbsPrototypeD1Ev
+__ZN7WebCore25JSSVGPathSegListPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsD1Ev
+__ZN7WebCore36JSSVGPathSegCurvetoCubicAbsPrototypeD1Ev
+__ZN7WebCore24jsSVGPatternElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_15wid
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_15widt
+__ZN7WebCore19synchronizePropertyINS_17SVGPatternElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCoreL30createSVGPolygonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGPolygonElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGPolygonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPolygonElementEEE
+__ZN7WebCore19JSSVGPolygonElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPolygonElementEEE
+__ZN7WebCore19JSSVGPolygonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGPolygonElementPointsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGPointListEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGPointListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGPointListEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGPointListEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsSVGPointListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGPointListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsSVGPointListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGPointList9classInfoEv
+__ZN7WebCore14JSSVGPointList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEEcvS1_Ev
+__ZNK7WebCore14SVGPODListItemINS_10FloatPointEE5valueEv
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14SVGPODListItemINS_10FloatPointEE8setValueES1_
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEED0Ev
+__ZN7WebCore14JSSVGPointListD1Ev
+__ZN7WebCore14JSSVGPointListD2Ev
+__ZN7WebCore41jsSVGPointListPrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGPointList10removeItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore23JSSVGPointListPrototypeD1Ev
+__ZN7WebCore19JSSVGPolygonElementD1Ev
+__ZN7WebCore28JSSVGPolygonElementPrototypeD1Ev
+__ZN7WebCore28jsSVGPolygonElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableE
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEENS1_29SVGAnimatedTy
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEENS1_29SVGAnimatedTyp
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEEENS_18P
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore26JSSVGAnimatedTransformList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGAnimatedTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_16SVGTransform
+__ZN7WebCore26JSSVGAnimatedTransformListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_16SVGTransform
+__ZN7WebCore26JSSVGAnimatedTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore33jsSVGAnimatedTransformListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16SVGTransformListEPNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore50jsSVGSVGElementPrototypeFunctionCreateSVGTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement18createSVGTransformEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGTransformC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEEEPNS_10SV
+__ZN7WebCore14JSSVGTransformC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEEEPNS_10SV
+__ZN7WebCore14JSSVGTransform18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGTransformPrototypeFunctionSetTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGTransform9classInfoEv
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEEcvS1_Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGTransformListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsSVGTransformListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSSVGTransformList9classInfoEv
+__ZN7WebCore18JSSVGTransformList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14toSVGTransformEN3JSC7JSValueE
+__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_16SVGTransformListEN3WTF10PassRefPtrINS_14SVGPODListItemINS
+__ZN7WebCore14JSSVGTransformD1Ev
+__ZN7WebCore14JSSVGTransformD2Ev
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEED0Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEED0Ev
+__ZN7WebCore18JSSVGTransformListD1Ev
+__ZN7WebCore18JSSVGTransformListD2Ev
+__ZN7WebCore26JSSVGAnimatedTransformListD1Ev
+__ZN7WebCore26JSSVGAnimatedTransformListD2Ev
+__ZN7WebCore42jsSVGTransformListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSSVGTransformList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEEcvS1_Ev
+__ZNK7WebCore14SVGPODListItemINS_12SVGTransformEE5valueEv
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14SVGPODListItemINS_12SVGTransformEE8setValueES1_
+__ZN7WebCore27JSSVGTransformListPrototypeD1Ev
+__ZN7WebCore35JSSVGAnimatedTransformListPrototypeD1Ev
+__ZNK7WebCore13SVGSVGElement11currentViewEv
+__ZN7WebCore11SVGViewSpecC1EPKNS_13SVGSVGElementE
+__ZN7WebCore11SVGViewSpecC2EPKNS_13SVGSVGElementE
+__ZN7WebCore11SVGViewSpec13parseViewSpecERKNS_6StringE
+__ZNK7WebCore11SVGViewSpec14contextElementEv
+__ZN7WebCore11SVGViewSpec19setViewTargetStringERKNS_6StringE
+__ZN7WebCore13SVGSVGElement17setUseCurrentViewEb
+__ZN7WebCore11SVGViewSpecD0Ev
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_8SVGAngleENS1_10StringHashENS_10HashTraitsIS6_EENSA_IS8_
+__ZN7WebCore17SVGResourceMasker10invalidateEv
+__ZN7WebCoreL28createSVGTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGTitleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTitleElementEEE
+__ZN7WebCore17JSSVGTitleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTitleElementEEE
+__ZN7WebCore17JSSVGTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSSVGTitleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGTitleElement9classInfoEv
+__ZN7WebCore17JSSVGTitleElementD1Ev
+__ZN7WebCore26JSSVGTitleElementPrototypeD1Ev
+__ZN7WebCore57jsSVGPathElementPrototypeFunctionGetPresentationAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore47jsSVGPathElementPrototypeFunctionGetTotalLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14SVGPathElement14getTotalLengthEv
+__ZN7WebCore18PathTraversalState12closeSubpathEv
+__ZN7WebCore49jsSVGPathElementPrototypeFunctionGetPointAtLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14SVGPathElement16getPointAtLengthEf
+__ZN7WebCore16SVGInlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore19RenderSVGInlineText16positionForPointERKNS_8IntPointE
+__ZNK7WebCore16SVGInlineTextBox24svgCharacterHitsPositionEiiRi
+__ZNK7WebCore16SVGInlineTextBox26closestCharacterToPositionEiiRi
+__ZN7WebCore18SVGTextChunkWalkerINS_48SVGInlineTextBoxClosestCharacterToPositionWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20Trans
+__ZN7WebCore48SVGInlineTextBoxClosestCharacterToPositionWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20Transformat
+__ZN7WebCoreL31createSVGPolylineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGPolylineElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGPolylineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGPolylineElementEEE
+__ZN7WebCore20JSSVGPolylineElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGPolylineElementEEE
+__ZN7WebCore20JSSVGPolylineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29JSSVGPolylineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGPolylineElement9classInfoEv
+__ZN7WebCore28JSSVGPolygonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGPolygonElement9classInfoEv
+__ZN7WebCore20JSSVGPolylineElementD1Ev
+__ZN7WebCore26jsSVGPolylineElementPointsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPointListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGPointList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10toSVGPointEN3JSC7JSValueE
+__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_12SVGPointListEN3WTF10PassRefPtrINS_14SVGPODListItemINS_10F
+__ZN7WebCore19synchronizePropertyINS_14SVGPolyElementEPNS_12SVGPointListEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore12SVGPointList13valueAsStringEv
+__ZN7WebCore29JSSVGPolylineElementPrototypeD1Ev
+__ZN7WebCore18jsSVGExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21RenderSVGGradientStop29repaintRectInLocalCoordinatesEv
+__ZN7WebCore12RenderObject5paintERNS0_9PaintInfoEii
+__ZN7WebCore16jsNodeOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10ondblclickEv
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEEcvS1_Ev
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore13SVGSVGElement19setCurrentTranslateERKNS_10FloatPointE
+__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_23SVGAnimatedPropertyBaseENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS2_
+__ZN7WebCore38jsSVGSVGElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore44jsSVGSVGElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore36jsSVGGElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsSVGGElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore20jsSVGTransformMatrixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSSVGMatrix3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSSVGMatrixAEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42JSSVGStaticPODTypeWrapperWithPODTypeParentINS_20TransformationMatrixENS_12SVGTransformEE12commitChangeES1_PNS_10S
+__ZN7WebCore42JSSVGStaticPODTypeWrapperWithPODTypeParentINS_20TransformationMatrixENS_12SVGTransformEED0Ev
+__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetCharNumAtPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore21SVGTextContentElement20getCharNumAtPositionERKNS_10FloatPointE
+__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionGetExtentOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore21SVGTextContentElement15getExtentOfCharEjRi
+__ZN7WebCore33jsSVGTextContentElementTextLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementENS_9SVGLengthEXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_NS_9SVGLengthES2_XadL_ZNS_31SVGTextContentElementIdenti
+__ZN7WebCore35jsSVGTextContentElementLengthAdjustEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementEiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames
+__ZN7WebCore24JSSVGAnimatedEnumeration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsSVGAnimatedEnumerationBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGAnimatedEnumerationAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_
+__ZN7WebCoreL27createSVGTRefElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGTRefElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGTRefElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTRefElementEEE
+__ZN7WebCore16JSSVGTRefElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTRefElementEEE
+__ZN7WebCore16JSSVGTRefElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGTRefElement9classInfoEv
+__ZN7WebCore16JSSVGTRefElementD1Ev
+__ZN7WebCore24RenderSVGHiddenContainer16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTe
+__ZN7WebCore25JSSVGTRefElementPrototypeD1Ev
+__ZThn24_N7WebCore18SVGElementInstance20toSVGElementInstanceEv
+__ZN7WebCore18SVGElementInstance20toSVGElementInstanceEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_18SVGElementInstanceE
+__ZN7WebCore20JSSVGElementInstance15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGElementInstanceC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGElementInstanceEEE
+__ZN7WebCore20JSSVGElementInstanceC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGElementInstanceEEE
+__ZN7WebCore20JSSVGElementInstance18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGElementInstanceCorrespondingUseElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGElementInstanceCorrespondingElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGElementInstanceD1Ev
+__ZN7WebCore20JSSVGElementInstanceD2Ev
+__ZN7WebCore30jsSVGElementInstanceParentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGElementInstanceNextSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGElementInstanceFirstChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGElementInstanceLastChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGElementInstancePreviousSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGElementInstancePrototypeD1Ev
+__ZNK7WebCore19JSLazyEventListener20wasCreatedFromMarkupEv
+__ZN7WebCore27jsSVGUseElementInstanceRootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGUseElement12instanceRootEv
+__ZN7WebCore29JSSVGElementInstancePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGElementInstance9classInfoEv
+__ZN7WebCore53jsSVGElementInstancePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore20JSSVGElementInstance16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore18SVGElementInstance22scriptExecutionContextEv
+__ZN7WebCore18SVGElementInstance16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZNK7WebCore13EventListener20wasCreatedFromMarkupEv
+__ZN7WebCore56jsSVGElementInstancePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore20JSSVGElementInstance19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore18SVGElementInstance19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore20JSSVGElementInstance4markEv
+__ZN7WebCore50jsSVGElementInstancePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18SVGElementInstance13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore13JSSVGGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16JSSVGRectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15JSSVGUseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19jsSVGUseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkName
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGURIReferenceENS_10SVGElementENS_6StringES3_XadL_ZNS_25SVGURIReferenceIdentifie
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames
+__ZN7WebCore19synchronizePropertyINS_10SVGElementENS_6StringEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore21SVGDocumentExtensions13reportWarningERKNS_6StringE
+__ZThn8_N7WebCore23SVGForeignObjectElementD0Ev
+__ZN7WebCore16jsSVGUseElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11xAttrString
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGUseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11
+__ZN7WebCore16jsSVGUseElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11yAttrString
+__ZN7WebCore13SVGZoomAndPan16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore19synchronizePropertyINS_13SVGSVGElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore26jsSVGAltGlyphElementFormatEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18SVGAltGlyphElement6formatEv
+__ZN7WebCore20JSSVGAltGlyphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAltGlyphElementFormatEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18SVGAltGlyphElement9setFormatERKNS_12AtomicStringERi
+__ZNK7WebCore19JSSVGAnimatedLength9classInfoEv
+__ZNK7WebCore11JSSVGLength9classInfoEv
+__ZN7WebCoreL35createSVGFontFaceNameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore24JSSVGFontFaceNameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGFontFaceNameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGFontFaceNameElementEEE
+__ZN7WebCore24JSSVGFontFaceNameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGFontFaceNameElementEEE
+__ZNK7WebCore24JSSVGFontFaceNameElement9classInfoEv
+__ZN7WebCoreL25fontfaceformatConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore24SVGFontFaceFormatElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGFontFaceFormatElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL37createSVGFontFaceFormatElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGFontFaceFormatElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGFontFaceFormatElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGFontFaceFormatElementEEE
+__ZN7WebCore26JSSVGFontFaceFormatElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGFontFaceFormatElementEEE
+__ZNK7WebCore26JSSVGFontFaceFormatElement9classInfoEv
+__ZN7WebCoreL34createSVGFontFaceSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore23JSSVGFontFaceSrcElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGFontFaceSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceSrcElementEEE
+__ZN7WebCore23JSSVGFontFaceSrcElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceSrcElementEEE
+__ZNK7WebCore23JSSVGFontFaceSrcElement9classInfoEv
+__ZN7WebCoreL34createSVGFontFaceUriElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore23JSSVGFontFaceUriElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGFontFaceUriElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceUriElementEEE
+__ZN7WebCore23JSSVGFontFaceUriElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceUriElementEEE
+__ZNK7WebCore23JSSVGFontFaceUriElement9classInfoEv
+__ZN7WebCoreL24definitionsrcConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGDefinitionSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGDefinitionSrcElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL36createSVGDefinitionSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore25JSSVGDefinitionSrcElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGDefinitionSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGDefinitionSrcElementEEE
+__ZN7WebCore25JSSVGDefinitionSrcElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGDefinitionSrcElementEEE
+__ZNK7WebCore25JSSVGDefinitionSrcElement9classInfoEv
+__ZN7WebCore25JSSVGDefinitionSrcElementD1Ev
+__ZThn8_N7WebCore23SVGDefinitionSrcElementD0Ev
+__ZN7WebCore23SVGDefinitionSrcElementD0Ev
+__ZN7WebCore23JSSVGFontFaceUriElementD1Ev
+__ZThn8_N7WebCore21SVGFontFaceUriElementD0Ev
+__ZN7WebCore23JSSVGFontFaceSrcElementD1Ev
+__ZThn8_N7WebCore21SVGFontFaceSrcElementD0Ev
+__ZN7WebCore26JSSVGFontFaceFormatElementD1Ev
+__ZThn8_N7WebCore24SVGFontFaceFormatElementD0Ev
+__ZN7WebCore24SVGFontFaceFormatElementD0Ev
+__ZN7WebCore24JSSVGFontFaceNameElementD1Ev
+__ZThn8_N7WebCore22SVGFontFaceNameElementD0Ev
+__ZThn8_N7WebCore18SVGFontFaceElementD0Ev
+__ZNK7WebCore13HTMLTokenizer10lineNumberEv
+__ZN7WebCore12JSSVGPathSeg18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsSVGPathSegPathSegTypeAsLetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegClosePathEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegClosePath15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegClosePathC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegClosePathEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegClosePathC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegClosePathEEEPNS_10SVGElementE
+__ZNK7WebCore19SVGPathSegClosePath19pathSegTypeAsLetterEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegLinetoAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegLinetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34JSSVGDefinitionSrcElementPrototypeD1Ev
+__ZN7WebCore32JSSVGFontFaceUriElementPrototypeD1Ev
+__ZN7WebCore32JSSVGFontFaceSrcElementPrototypeD1Ev
+__ZN7WebCore35JSSVGFontFaceFormatElementPrototypeD1Ev
+__ZN7WebCore33JSSVGFontFaceNameElementPrototypeD1Ev
+__ZN7WebCore21JSSVGPathSegClosePathD1Ev
+__ZN7WebCore21JSSVGPathSegLinetoAbsD1Ev
+__ZN7WebCore24JSSVGLengthListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGLengthListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSSVGLengthList9classInfoEv
+__ZN7WebCore24jsSVGLengthValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEEcvS1_Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEED0Ev
+__ZN7WebCore30JSSVGPathSegClosePathPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegLinetoAbsPrototypeD1Ev
+__ZN7WebCore22jsSVGPathSegMovetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore23jsSVGPathSegPathSegTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoRelEff
+__ZN7WebCore19SVGPathSegMovetoRelC1Eff
+__ZN7WebCore19SVGPathSegMovetoRelC2Eff
+__ZNK7WebCore19SVGPathSegMovetoRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegMovetoRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegMovetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19SVGPathSegMovetoRel19pathSegTypeAsLetterEv
+__ZN7WebCore22jsSVGPathSegMovetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegMovetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoRelEff
+__ZN7WebCore19SVGPathSegLinetoRelC1Eff
+__ZN7WebCore19SVGPathSegLinetoRelC2Eff
+__ZNK7WebCore19SVGPathSegLinetoRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegLinetoRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegLinetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19SVGPathSegLinetoRel19pathSegTypeAsLetterEv
+__ZN7WebCore22jsSVGPathSegLinetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKN
+__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKN
+__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicRelEffffff
+__ZN7WebCore25SVGPathSegCurvetoCubicRelC1Effffff
+__ZN7WebCore25SVGPathSegCurvetoCubicRelC2Effffff
+__ZNK7WebCore25SVGPathSegCurvetoCubicRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicRelEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicRelEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25SVGPathSegCurvetoCubicRel19pathSegTypeAsLetterEv
+__ZN7WebCore28jsSVGPathSegCurvetoCubicRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticAbsEffff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsC1Effff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsC2Effff
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticAbsEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticAbsEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticRelEffff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelC1Effff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelC2Effff
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticRelEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticRelEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore14SVGPathElement22createSVGPathSegArcAbsEfffffbb
+__ZN7WebCore16SVGPathSegArcAbsC1Efffffbb
+__ZN7WebCore16SVGPathSegArcAbsC2Efffffbb
+__ZNK7WebCore16SVGPathSegArcAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore18JSSVGPathSegArcAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGPathSegArcAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcAbsEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcAbsEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16SVGPathSegArcAbs19pathSegTypeAsLetterEv
+__ZN7WebCore19jsSVGPathSegArcAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGPathSegArcAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcAbsR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcAbsR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGPathSegArcAbsAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegArcAbsLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegArcAbsSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore14SVGPathElement22createSVGPathSegArcRelEfffffbb
+__ZN7WebCore16SVGPathSegArcRelC1Efffffbb
+__ZN7WebCore16SVGPathSegArcRelC2Efffffbb
+__ZNK7WebCore16SVGPathSegArcRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore18JSSVGPathSegArcRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGPathSegArcRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcRelEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcRelEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16SVGPathSegArcRel19pathSegTypeAsLetterEv
+__ZN7WebCore19jsSVGPathSegArcRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGPathSegArcRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcRelR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcRelR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGPathSegArcRelAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegArcRelLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegArcRelSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalAbsEf
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsC1Ef
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsC2Ef
+__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalAbsEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalAbsEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegLinetoHorizontalAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalRelEf
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelC1Ef
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelC2Ef
+__ZNK7WebCore29SVGPathSegLinetoHorizontalRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalRelEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalRelEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegLinetoHorizontalRel19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegLinetoHorizontalRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueER
+__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalAbsEf
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsC1Ef
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsC2Ef
+__ZNK7WebCore27SVGPathSegLinetoVerticalAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalAbsEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalAbsEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27SVGPathSegLinetoVerticalAbs19pathSegTypeAsLetterEv
+__ZN7WebCore30jsSVGPathSegLinetoVerticalAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueER
+__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalRelEf
+__ZN7WebCore27SVGPathSegLinetoVerticalRelC1Ef
+__ZN7WebCore27SVGPathSegLinetoVerticalRelC2Ef
+__ZNK7WebCore27SVGPathSegLinetoVerticalRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalRelEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalRelEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27SVGPathSegLinetoVerticalRel19pathSegTypeAsLetterEv
+__ZN7WebCore30jsSVGPathSegLinetoVerticalRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSVal
+__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothAbsEffff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsC1Effff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsC2Effff
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothAbs
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothAbs
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs19pathSegTypeAsLetterEv
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSVal
+__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothRelEffff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelC1Effff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelC2Effff
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothRel
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothRel
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel19pathSegTypeAsLetterEv
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7J
+__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothAbsEff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsC1Eff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsC2Eff
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_37JSSVGPathSegCurvetoQuadraticSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs19pathSegTypeAsLetterEv
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7J
+__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothRelEff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelC1Eff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelC2Eff
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel11pathSegTypeEv
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel19pathSegTypeAsLetterEv
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelD1Ev
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelD0Ev
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsD1Ev
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsD0Ev
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelD1Ev
+__ZN7WebCore27SVGPathSegLinetoVerticalRelD0Ev
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsD1Ev
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsD0Ev
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelD1Ev
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelD0Ev
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsD1Ev
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsD0Ev
+__ZN7WebCore18JSSVGPathSegArcRelD1Ev
+__ZN7WebCore16SVGPathSegArcRelD0Ev
+__ZN7WebCore18JSSVGPathSegArcAbsD1Ev
+__ZN7WebCore16SVGPathSegArcAbsD0Ev
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelD1Ev
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelD0Ev
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsD1Ev
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsD0Ev
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelD1Ev
+__ZN7WebCore25SVGPathSegCurvetoCubicRelD0Ev
+__ZN7WebCore21JSSVGPathSegLinetoRelD1Ev
+__ZN7WebCore19SVGPathSegLinetoRelD0Ev
+__ZN7WebCore21JSSVGPathSegMovetoRelD1Ev
+__ZN7WebCore19SVGPathSegMovetoRelD0Ev
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelD1Ev
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelD0Ev
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsD1Ev
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsD0Ev
+__ZN7WebCore42JSSVGPathSegCurvetoCubicSmoothRelPrototypeD1Ev
+__ZN7WebCore42JSSVGPathSegCurvetoCubicSmoothAbsPrototypeD1Ev
+__ZN7WebCore38JSSVGPathSegLinetoVerticalRelPrototypeD1Ev
+__ZN7WebCore38JSSVGPathSegLinetoVerticalAbsPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegLinetoHorizontalRelPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegLinetoHorizontalAbsPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegArcRelPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegArcAbsPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegCurvetoQuadraticRelPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegCurvetoQuadraticAbsPrototypeD1Ev
+__ZN7WebCore36JSSVGPathSegCurvetoCubicRelPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegLinetoRelPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegMovetoRelPrototypeD1Ev
+__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeD1Ev
+__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeD1Ev
+__ZN7WebCore36jsSVGImageElementPreserveAspectRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGAnimatedPreserveAspectRatioBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_22SVGPreserveAspectRatioEPNS_10SVGElementE
+__ZN7WebCore24JSSVGPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGPreserveAspectRatioEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGPreserveAspectRatioC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGPreserveAspectRatioEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsSVGPreserveAspectRatioAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPreserveAspectRatioMeetOrSliceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSSVGPreserveAspectRatioD1Ev
+__ZN7WebCore24JSSVGPreserveAspectRatioD2Ev
+__ZNK7WebCore8SVGColor10isSVGColorEv
+__ZN7WebCore10JSSVGColorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGColorEEE
+__ZNK7WebCore10JSSVGColor9classInfoEv
+__ZN7WebCore10JSSVGColorD1Ev
+__ZN3WTF7HashSetIdNS_9FloatHashIdEENS_10HashTraitsIdEEE3addERKd
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E6expandEv
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E6rehashEi
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E13allocateTableEi
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14shrinkCapacityEm
+__ZSt21__unguarded_partitionIPN7WebCore8SMILTimeES1_ET_S3_S3_T0_
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E4findIdNS_22IdentityHashTranslatorIddS4_
+__ZSt13__heap_selectIPN7WebCore8SMILTimeEEvT_S3_S3_
+__ZSt9make_heapIPN7WebCore8SMILTimeEEvT_S3_
+__ZSt13__adjust_heapIPN7WebCore8SMILTimeElS1_EvT_T0_S4_T1_
+__ZSt11__push_heapIPN7WebCore8SMILTimeElS1_EvT_T0_S4_T1_
+__ZSt9sort_heapIPN7WebCore8SMILTimeEEvT_S3_
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGAngleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14createSVGAngleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SVGAngleEPNS_10SVGElementE
+__ZN7WebCore10JSSVGAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore10JSSVGAngleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGLengthEv
+__ZN7WebCoreL29createSVGScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGScriptElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGScriptElementEEE
+__ZN7WebCore18JSSVGScriptElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGScriptElementEEE
+__ZN7WebCore22setJSSVGElementXmlbaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10SVGElement10setXmlbaseERKNS_6StringERi
+__ZN7WebCore10JSSVGAngle3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSSVGAngleValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8SVGAngle16setValueAsStringERKNS_6StringE
+__ZN7WebCore8SVGAngle9calculateEv
+__ZN7WebCore10JSSVGAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsSVGAngleValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8SVGAngle13valueAsStringEv
+__ZN7WebCore27setJSSVGLengthValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore18JSSVGScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSSVGScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSSVGScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsSVGScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16SVGScriptElement4typeEv
+__ZN7WebCore18JSSVGScriptElementD1Ev
+__ZThn8_N7WebCore16SVGScriptElementD0Ev
+__ZN7WebCore10JSSVGAngleD1Ev
+__ZN7WebCore10JSSVGAngleD2Ev
+__ZN7WebCore49jsSVGPathSegListPrototypeFunctionInsertItemBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList16insertItemBeforeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12toSVGPathSegEN3JSC7JSValueE
+__ZN7WebCore44jsSVGPathSegListPrototypeFunctionReplaceItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList11replaceItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore27JSSVGScriptElementPrototypeD1Ev
+__ZN7WebCore43jsSVGPathSegListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore21JSSVGPathSegMovetoAbs9classInfoEv
+__ZN7WebCore22jsSVGGElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGTransformListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableEl
+__ZN7WebCore19synchronizePropertyINS_29SVGStyledTransformableElementEPNS_16SVGTransformListEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore16SVGTransformList13valueAsStringEv
+__ZN7WebCore22jsSVGScriptElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSSVGScriptElement9classInfoEv
+__ZN7WebCore43jsSVGScriptElementExternalResourcesRequiredEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGAnimatedBoolean3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore30setJSSVGAnimatedBooleanBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZThn288_NK7WebCore16SVGScriptElement18typeAttributeValueEv
+__ZNK7WebCore16SVGScriptElement18typeAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement22languageAttributeValueEv
+__ZNK7WebCore16SVGScriptElement22languageAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement17forAttributeValueEv
+__ZNK7WebCore16SVGScriptElement17forAttributeValueEv
+__ZThn288_N7WebCore16SVGScriptElement18dispatchErrorEventEv
+__ZN7WebCore16SVGScriptElement18dispatchErrorEventEv
+__ZN7WebCoreL24createSVGAElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore13JSSVGAElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGAElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGAElementEEE
+__ZN7WebCore13JSSVGAElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGAElementEEE
+__ZN7WebCore13JSSVGAElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSSVGAElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGAElement9classInfoEv
+__ZN7WebCore22JSSVGAElementPrototypeD1Ev
+__ZN7WebCore13JSSVGAElementD1Ev
+__ZN7WebCore17jsSVGAElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGAElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEE
+__ZN7WebCore20jsSVGCircleElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cxAtt
+__ZN7WebCore20jsSVGCircleElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cyAtt
+__ZN7WebCore19jsSVGCircleElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCircleElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15circleTagStringEEEXadL_Z
+__ZN7WebCoreL29createSVGCursorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGCursorElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGCursorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCursorElementEEE
+__ZN7WebCore18JSSVGCursorElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCursorElementEEE
+__ZN7WebCore18JSSVGCursorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGCursorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGCursorElement9classInfoEv
+__ZN7WebCore6CursorC1EPNS_5ImageERKNS_8IntPointE
+__ZN7WebCore6CursorC2EPNS_5ImageERKNS_8IntPointE
+__ZN7WebCore18JSSVGCursorElementD1Ev
+__ZN7WebCore27JSSVGCursorElementPrototypeD1Ev
+__ZN7WebCore19jsSVGCursorElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11xAttr
+__ZN7WebCore19jsSVGCursorElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11yAttr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCursorElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15cursorTagStringEEEXadL_Z
+__ZN7WebCore21jsSVGEllipseElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxA
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGEllipseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16ellipseTagStringEEEXadL
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGEllipseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16ellipseTagStringEEEXad
+__ZN7WebCore21jsSVGEllipseElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cyA
+__ZN7WebCore21jsSVGEllipseElementRxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12rxA
+__ZN7WebCore21jsSVGEllipseElementRyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12ryA
+__ZN7WebCoreL36createSVGForeignObjectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore25JSSVGForeignObjectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGForeignObjectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGForeignObjectElementEEE
+__ZN7WebCore25JSSVGForeignObjectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGForeignObjectElementEEE
+__ZN7WebCore25JSSVGForeignObjectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34JSSVGForeignObjectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSSVGForeignObjectElement9classInfoEv
+__ZN7WebCore25JSSVGForeignObjectElementD1Ev
+__ZN7WebCore34JSSVGForeignObjectElementPrototypeD1Ev
+__ZN7WebCore31jsSVGForeignObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19synchronizePropertyINS_23SVGForeignObjectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore30jsSVGForeignObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsSVGForeignObjectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXad
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_23SVGForeignObjectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames22foreignObjectTagS
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_23SVGForeignObjectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames22foreignObjectTag
+__ZNK7WebCore19SVGAnimatedPropertyINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXadL
+__ZN7WebCore26jsSVGForeignObjectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19synchronizePropertyINS_15SVGImageElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_Z
+__ZN7WebCore24JSSVGPreserveAspectRatio3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSSVGPreserveAspectRatioAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22SVGPreserveAspectRatio8setAlignEt
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAtt
+__ZN7WebCore18jsSVGImageElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11xAttrSt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZN
+__ZN7WebCore18jsSVGImageElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11yAttrSt
+__ZN7WebCore18jsSVGLineElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGLineElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGLineElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3
+__ZN7WebCore18jsSVGLineElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x2AttrStr
+__ZN7WebCore18jsSVGLineElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y1AttrStr
+__ZN7WebCore18jsSVGLineElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y2AttrStr
+__ZN7WebCore15setJSSVGMatrixEEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18jsSVGTransformTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGTransformAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGGradientElementGradientTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementENS_16SVGTransformListEXadL_ZNS_28SVGGradientElementIdentifierEEEXad
+__ZN7WebCore33jsSVGGradientElementGradientUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementEiXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames23grad
+__ZN7WebCore28jsSVGLinearGradientElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLinearGradientElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGLinearGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23linearGradientTa
+__ZN7WebCore28jsSVGLinearGradientElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19SVGAnimatedTemplateINS_9SVGLengthEED2Ev
+__ZN7WebCore30jsSVGMarkerElementMarkerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_22marke
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_
+__ZN7WebCore29jsSVGMarkerElementMarkerUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUnitsAttrStr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_iiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUni
+__ZN7WebCore29jsSVGMarkerElementMarkerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_21marke
+__ZN7WebCore28jsSVGMarkerElementOrientTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_27SVGOrientTypeAttrId
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_iiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_27SVGOrientT
+__ZN7WebCore29jsSVGMarkerElementOrientAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_8SVGAngleEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_28SVGOrie
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEENS1_29SVGAnimatedTypeWrapper
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGAnimatedAngle15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGAnimatedAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEEEPNS_10SV
+__ZN7WebCore18JSSVGAnimatedAngleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEEEPNS_10SV
+__ZN7WebCore18JSSVGAnimatedAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGAnimatedAngleBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsSVGAngleValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18setJSSVGAngleValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8SVGAngle8setValueEf
+__ZN7WebCore18JSSVGAnimatedAngleD1Ev
+__ZN7WebCore18JSSVGAnimatedAngleD2Ev
+__ZN7WebCore27JSSVGAnimatedAnglePrototypeD1Ev
+__ZN7WebCore22jsSVGMarkerElementRefXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refXA
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_Z
+__ZN7WebCore22jsSVGMarkerElementRefYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refYA
+__ZN7WebCore51jsSVGMarkerElementPrototypeFunctionSetOrientToAngleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10toSVGAngleEN3JSC7JSValueE
+__ZNK7WebCore10JSSVGAngle9classInfoEv
+__ZN7WebCore16SVGMarkerElement16setOrientToAngleEN3WTF10PassRefPtrINS_8SVGAngleEEE
+__ZN7WebCore50jsSVGMarkerElementPrototypeFunctionSetOrientToAutoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16SVGMarkerElement15setOrientToAutoEv
+__ZN7WebCore22jsSVGMaskElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_16heightAtt
+__ZN7WebCore32jsSVGMaskElementMaskContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_26maskContentUnitsAttrSt
+__ZN7WebCore25jsSVGMaskElementMaskUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_iiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttr
+__ZN7WebCore21jsSVGMaskElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_15widthAttr
+__ZN7WebCore17jsSVGMaskElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStri
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3
+__ZN7WebCore17jsSVGMaskElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11yAttrStri
+__ZN7WebCore25jsSVGPatternElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_16hei
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16patternTagStringEEEXad
+__ZN7WebCore38jsSVGPatternElementPatternContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29patternContentUn
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_iiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29pattern
+__ZN7WebCore35jsSVGPatternElementPatternTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_16SVGTransformListEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZN
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_16SVGTransformListEPS2_XadL_ZNS_8SVGNames16patternTagStri
+__ZN7WebCore31jsSVGPatternElementPatternUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttrS
+__ZN7WebCore20jsSVGPatternElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11xAt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16patternTagStringEEEXadL
+__ZN7WebCore20jsSVGPatternElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11yAt
+__ZN7WebCoreL37createSVGRadialGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGRadialGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGRadialGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGRadialGradientElementEEE
+__ZN7WebCore26JSSVGRadialGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGRadialGradientElementEEE
+__ZN7WebCore26JSSVGRadialGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSSVGRadialGradientElement9classInfoEv
+__ZN7WebCore26JSSVGRadialGradientElementD1Ev
+__ZN7WebCore35JSSVGRadialGradientElementPrototypeD1Ev
+__ZN7WebCore28jsSVGRadialGradientElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEX
+__ZN7WebCore19synchronizePropertyINS_24SVGRadialGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore28jsSVGRadialGradientElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGRadialGradientElementFxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGRadialGradientElementFyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGRadialGradientElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGRadialGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23radialGradientTa
+__ZN7WebCore50jsSVGLengthPrototypeFunctionNewValueSpecifiedUnitsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9SVGLength22newValueSpecifiedUnitsEtf
+__ZNK7WebCore24RenderSVGHiddenContainer20isSVGHiddenContainerEv
+__ZNK7WebCore4Font32selectionRectForTextUsingSVGFontERKNS_7TextRunERKNS_8IntPointEiii
+__ZNK7WebCore16SVGCursorElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore16SVGScriptElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore8CSSValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore25jsHTMLAreaElementHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIlLm16EE14expandCapacityEm
+__ZN3WTF6VectorIlLm16EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE15reserveCapacityEm
+__ZN7WebCore14RenderTableCol12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore18RenderTableSection12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore48jsWebKitCSSMatrixPrototypeFunctionSetMatrixValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsWebKitCSSMatrixPrototypeFunctionMultiplyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17toWebKitCSSMatrixEN3JSC7JSValueE
+__ZNK7WebCore15WebKitCSSMatrix8multiplyEPS0_
+__ZN7WebCore15WebKitCSSMatrixC1ERKNS_20TransformationMatrixE
+__ZN7WebCore15WebKitCSSMatrixC2ERKNS_20TransformationMatrixE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15WebKitCSSMatrixE
+__ZN7WebCore41jsWebKitCSSMatrixPrototypeFunctionInverseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix7inverseERi
+__ZN7WebCore43jsWebKitCSSMatrixPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix9translateEddd
+__ZN7WebCore39jsWebKitCSSMatrixPrototypeFunctionScaleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix5scaleEddd
+__ZN7WebCore40jsWebKitCSSMatrixPrototypeFunctionRotateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix6rotateEddd
+__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZNK7WebCore23WebKitCSSTransformValue25isWebKitCSSTransformValueEv
+__ZN7WebCore25JSWebKitCSSTransformValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23WebKitCSSTransformValueEEE
+__ZN7WebCore25JSWebKitCSSTransformValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23WebKitCSSTransformValueEEE
+__ZNK7WebCore25JSWebKitCSSTransformValue9classInfoEv
+__ZN7WebCore25JSWebKitCSSTransformValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitCSSTransformValuePrototype9classInfoEv
+__ZN7WebCore36jsWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsWebKitCSSTransformValueOperationTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSWebKitCSSTransformValueD1Ev
+__ZNK7WebCore24ShorthandPropertyWrapper6equalsEPKNS_11RenderStyleES3_
+__ZNK7WebCore24ShorthandPropertyWrapper5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZN7WebCore11RenderStyle22setBackgroundXPositionENS_6LengthE
+__ZN7WebCore11RenderStyle22setBackgroundYPositionENS_6LengthE
+__ZNK7WebCore15PropertyWrapperINS_10LengthSizeEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS6_S9_d
+__ZN7WebCore11RenderStyle17setBackgroundSizeENS_10LengthSizeE
+__ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore26AnimationControllerPrivate21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore18CompositeAnimation21pauseTransitionAtTimeEid
+__ZN7WebCore4Node29dispatchWebKitTransitionEventERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore21WebKitTransitionEventC1ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore21WebKitTransitionEventC2ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore11RenderStyle16setMaskXPositionENS_6LengthE
+__ZN7WebCore11RenderStyle16setMaskYPositionENS_6LengthE
+__ZN7WebCore11RenderStyle11setMaskSizeENS_10LengthSizeE
+__ZNK7WebCore21PropertyWrapperShadow5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZNK7WebCore15PropertyWrapperItE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZN7WebCore11RenderStyle17setBorderTopWidthEt
+__ZN7WebCore11RenderStyle19setBorderRightWidthEt
+__ZN7WebCore11RenderStyle20setBorderBottomWidthEt
+__ZN7WebCore11RenderStyle18setBorderLeftWidthEt
+__ZN7WebCore11RenderStyle19setTransformOriginXENS_6LengthE
+__ZN7WebCore11RenderStyle19setTransformOriginYENS_6LengthE
+__ZN7WebCore11RenderStyle12setMarginTopENS_6LengthE
+__ZN7WebCore11RenderStyle14setMarginRightENS_6LengthE
+__ZN7WebCore11RenderStyle15setMarginBottomENS_6LengthE
+__ZN7WebCore11RenderStyle13setMarginLeftENS_6LengthE
+__ZNK7WebCore15PropertyWrapperIRKNS_7IntSizeEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZN7WebCore11RenderStyle23setBorderTopRightRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle22setBorderTopLeftRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle25setBorderBottomLeftRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle26setBorderBottomRightRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle15setOutlineColorERKNS_5ColorE
+__ZNK7WebCore15PropertyWrapperIiE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZN7WebCore11RenderStyle16setOutlineOffsetEi
+__ZN7WebCore11RenderStyle15setOutlineWidthEt
+__ZN7WebCore11RenderStyle13setPaddingTopENS_6LengthE
+__ZN7WebCore11RenderStyle15setPaddingRightENS_6LengthE
+__ZN7WebCore11RenderStyle16setPaddingBottomENS_6LengthE
+__ZN7WebCore11RenderStyle14setPaddingLeftENS_6LengthE
+__ZN7WebCore35setJSDOMWindowOnwebkittransitionendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow24setOnwebkittransitionendEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore27jsNodeIteratorReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsNodeIteratorPointerBeforeReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBodyElement25didMoveToNewOwnerDocumentEv
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE6shrinkEm
+__ZN7WebCore16LegacyWebArchive6createEPNS_5FrameE
+__ZNK7WebCore14DocumentLoader15getSubresourcesERN3WTF6VectorINS1_10PassRefPtrINS_15ArchiveResourceEEELm0EEE
+__ZNK7WebCore14DocumentLoader12mainResourceEv
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore13CSSImportRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore15CSSFontFaceRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore19CSSFontFaceSrcValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore19CSSBorderImageValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore15CSSReflectValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore20HTMLFrameElementBase14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17HTMLObjectElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore14ArchiveFactory6createEPNS_12SharedBufferERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEENS1_15CaseFoldingHashENS_10HashTraitsI
+__ZN7WebCoreL20archiveFactoryCreateINS_16LegacyWebArchiveEEEN3WTF10PassRefPtrINS_7ArchiveEEEPNS_12SharedBufferE
+__ZN7WebCore14DocumentLoader20setParsedArchiveDataEN3WTF10PassRefPtrINS_12SharedBufferEEE
+-[DOMElement(WebPrivate) isFocused]
+__ZN7WebCore11RenderStyle13setCursorListEN3WTF10PassRefPtrINS_10CursorListEEE
+__ZNK7WebCore9Tokenizer15isHTMLTokenizerEv
+__ZN7WebCore11HistoryItem12setViewStateEP11objc_object
+__ZN7WebCore9InlineBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore9InlineBox15clearTruncationEv
+__ZN7WebCoreL9stateBoldEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL11stateItalicEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL18stateStrikethroughEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore21ProcessingInstruction18maxCharacterOffsetEv
+__ZN7WebCore15setJSNodeOndragEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOndragEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore39setJSHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21HTMLOptionsCollection16setSelectedIndexEi
+__ZN7WebCore35jsCanvasRenderingContext2DLineWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsCanvasRenderingContext2DMiterLimitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39setJSCanvasRenderingContext2DMiterLimitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D13setMiterLimitEf
+__ZN7WebCore14jsNodeOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onscrollEv
+__ZN7WebCore19JSSVGAnimatedString18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGDefsElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGGradientElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsSVGStopElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGGElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGCircleElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27RenderTextControlSingleLine9scrollTopEv
+__ZN7WebCore32jsCanvasRenderingContext2DCanvasEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18LocalStorageThread14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageArea13performImportEv
+__ZN7WebCore12LocalStorage20fullDatabaseFilenameEPNS_14SecurityOriginE
+__ZN7WebCore10HTMLParser15popInlineBlocksEv
+__ZN7WebCore26NetscapePlugInStreamLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18LocalStorageThread12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageArea11performSyncEv
+__ZN7WebCore16LocalStorageArea4syncEbRKN3WTF7HashMapINS_6StringES3_NS_10StringHashENS1_10HashTraitsIS3_EES6_EE
+__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
+__ZN7WebCore12IconDatabase14checkIntegrityEv
+__ZNK7WebCore32HTMLFileUploadInnerButtonElement12isShadowNodeEv
+__ZN7WebCore32HTMLFileUploadInnerButtonElement16shadowParentNodeEv
+__ZN7WebCore16JSSVGLineElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21jsSVGLineElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14ResourceHandle12releaseProxyEv
+__ZNK7WebCore14ResourceHandle10connectionEv
+__ZN7WebCore31jsConsolePrototypeFunctionDebugEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5debugEPNS_15ScriptCallStackE
+__ZNK7WebCore11RenderBlock20adjustRectForColumnsERNS_7IntRectE
+__ZN7WebCore13jsNodeOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onerrorEv
+__ZNK7WebCore13ChildNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore29setJSHTMLStyleElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement11setDisabledEb
+__ZN7WebCore4Node11appendChildEN3WTF10PassRefPtrIS0_EERib
+__ZN7WebCore27setJSHTMLImageElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setHspaceEi
+__ZN7WebCore27setJSHTMLImageElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setVspaceEi
+__ZN7WebCore14ResourceLoader13cannotShowURLEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader18cannotShowURLErrorEv
+__ZN3WTF6VectorItLm16EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm16EE14expandCapacityEm
+__ZN3WTF6VectorItLm16EE15reserveCapacityEm
+__ZN7WebCore31SearchFieldResultsButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore11RenderStyle8setColorERKNS_5ColorE
+__ZN7WebCore18jsSVGGElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSSVGPathElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore19JSSVGAnimatedString9classInfoEv
+__ZN7WebCore25jsSVGPathElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11HistoryItem20setTransientPropertyERKNS_6StringEP11objc_object
+__ZN3WTF7HashMapIN7WebCore6StringENS_9RetainPtrIP11objc_objectEENS1_10StringHashENS_10HashTraitsIS2_EENS8_IS6_EEE3setERKS2_RKS6
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_9RetainPtrIP11objc_objectEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_
+__ZNK3WTF7HashMapIN7WebCore6StringENS_9RetainPtrIP11objc_objectEENS1_10StringHashENS_10HashTraitsIS2_EENS8_IS6_EEE3getERKS2_
+__ZN7WebCore5TimerINS_12RenderButtonEE5firedEv
+__ZN7WebCore12RenderButton10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore5TimerINS_12RenderButtonEED0Ev
+__ZN7WebCore11RenderStyle9setBottomENS_6LengthE
+__ZN7WebCore23jsHTMLAnchorElementPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4portEv
+__ZN7WebCore16LocalStorageArea17scheduleFinalSyncEv
+__ZN7WebCore10moveCursorEv
+__ZN7WebCore19jsWheelEventOffsetXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
+__ZN7WebCore12zoomInCursorEv
+__ZN7WebCore18ImageEventListener11handleEventEPNS_5EventEb
+__ZN7WebCore13ImageDocument12imageClickedEii
+__ZN7WebCore13ImageDocument16restoreImageSizeEv
+__ZN7WebCore13zoomOutCursorEv
+-[WebCoreMenuTarget validateMenuItem:]
+__ZN7WebCore15ContextMenuItemC1EP10NSMenuItem
+__ZN7WebCore15ContextMenuItemC2EP10NSMenuItem
+__ZNK7WebCore15ContextMenuItem7enabledEv
+__ZThn8_N7WebCore20ImageDocumentElementD0Ev
+__ZThn32_N7WebCore8DOMTimer6resumeEv
+__ZN7WebCore16HTMLInputElement23documentDidBecomeActiveEv
+__ZN7WebCore5Frame24searchForLabelsAboveCellEPNS_17RegularExpressionEPNS_20HTMLTableCellElementE
+__ZN7WebCore15BackForwardList17backListWithLimitEiRN3WTF6VectorINS1_6RefPtrINS_11HistoryItemEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore11HistoryItem10targetItemEv
+__ZN7WebCore11HistoryItem14findTargetItemEv
+__ZN7WebCore27RenderTextControlSingleLine6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore11EllipsisBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCoreL15executeMoveDownEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore25jsHTMLAreaElementProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14RenderMenuList9showPopupEv
+__ZN7WebCore9PopupMenuC1EPNS_15PopupMenuClientE
+__ZN7WebCore9PopupMenuC2EPNS_15PopupMenuClientE
+__ZN7WebCore9PopupMenu4showERKNS_7IntRectEPNS_9FrameViewEi
+__ZN7WebCore9PopupMenu8populateEv
+__ZThn200_NK7WebCore14RenderMenuList13shouldPopOverEv
+__ZNK7WebCore14RenderMenuList13shouldPopOverEv
+__ZThn200_NK7WebCore14RenderMenuList8listSizeEv
+__ZNK7WebCore14RenderMenuList8listSizeEv
+__ZThn200_NK7WebCore14RenderMenuList15itemIsSeparatorEj
+__ZNK7WebCore14RenderMenuList15itemIsSeparatorEj
+__ZThn200_NK7WebCore14RenderMenuList9itemStyleEj
+__ZNK7WebCore14RenderMenuList9itemStyleEj
+__ZNK7WebCore14RenderMenuList19itemBackgroundColorEj
+__ZNK7WebCore5Color5blendERKS0_
+__ZThn200_NK7WebCore14RenderMenuList8itemTextEj
+__ZNK7WebCore14RenderMenuList8itemTextEj
+__ZThn200_NK7WebCore14RenderMenuList13itemIsEnabledEj
+__ZNK7WebCore14RenderMenuList13itemIsEnabledEj
+__ZThn200_NK7WebCore14RenderMenuList9menuStyleEv
+__ZNK7WebCore14RenderMenuList9menuStyleEv
+__ZThn200_N7WebCore14RenderMenuList9hidePopupEv
+__ZN7WebCore14RenderMenuList9hidePopupEv
+__ZN7WebCore9PopupMenu4hideEv
+__ZN7WebCore12EventHandler33sendFakeEventsAfterWidgetTrackingEP7NSEvent
+__ZN7WebCore9PopupMenuD1Ev
+__ZN7WebCore9PopupMenuD2Ev
+__ZN7WebCore10waitCursorEv
+__ZN7WebCore14ScrollbarTheme26shouldSnapBackToDragOriginEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar9moveThumbEi
+__ZThn200_N7WebCore14RenderMenuList12valueChangedEjb
+__ZN7WebCore14RenderMenuList12valueChangedEjb
+__ZN7WebCore9PopupMenu5clearEv
+-[DOMHTMLInputElement(FormAutoFillTransition) _rectOnScreen]
+__ZN7WebCore11RenderImage20intrinsicSizeChangedEv
+__ZNK7WebCore27RenderTextControlSingleLine12scrollHeightEv
+__ZNK7WebCore17HTMLSelectElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCore31jsHTMLInputElementIndeterminateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLInputElementFilesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8FileListE
+__ZN7WebCore12jsNodeOndragEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6ondragEv
+__ZN7WebCore16HTMLInputElement18setActivatedSubmitEb
+__ZN7WebCore23SubresourceLoaderClient11didSendDataEPNS_17SubresourceLoaderEyy
+-[DOMHTMLInputElement(FormAutoFillTransition) _selectedRange]
+-[DOMHTMLInputElement(FormAutoFillTransition) _replaceCharactersInRange:withString:selectingFromIndex:]
+__ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
+__ZNK7WebCore12RenderObject24shouldPaintSelectionGapsEv
+__ZN7WebCore11FrameLoader16canHandleRequestERKNS_15ResourceRequestE
+__ZN7WebCore14scaleDragImageEN3WTF9RetainPtrI7NSImageEENS_9FloatSizeE
+-[WebCoreMenuTarget forwardContextMenuAction:]
+__ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
+__ZN7WebCore6Editor7copyURLERKNS_4KURLERKNS_6StringE
+__ZN7WebCore10Pasteboard8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZN7WebCore13JSPluginArray16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore5Cache13getStatisticsEv
+__ZN7WebCore5Cache13TypeStatistic11addResourceEPNS_14CachedResourceE
+__ZNK7WebCore14CachedResource11isPurgeableEv
+__ZN7WebCore12IconDatabase19pageURLMappingCountEv
+__ZN7WebCore12IconDatabase20retainedPageURLCountEv
+__ZN7WebCore12IconDatabase15iconRecordCountEv
+__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
+__ZN7WebCore9FontCache13fontDataCountEv
+__ZN7WebCore9FontCache21inactiveFontDataCountEv
+__ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
+__ZNK7WebCore17GlyphPageTreeNode9pageCountEv
+__ZN7WebCore13jsNodeOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onabortEv
+__ZN7WebCore34jsConsolePrototypeFunctionGroupEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console8groupEndEv
+__ZN7WebCore19InspectorController8endGroupENS_13MessageSourceEjRKNS_6StringE
+__ZN7WebCore15StringTruncator13rightTruncateERKNS_6StringEfRKNS_4FontEb
+__ZN7WebCore17ScrollbarThemeMac14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCoreL17buttonRepaintRectERKNS_7IntRectENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEb
+__ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
+__ZN7WebCore9FrameView16adjustPageHeightEPffff
+__ZN7WebCore18correctedTextColorENS_5ColorES0_
+__ZN7WebCore15GraphicsContext21focusRingBoundingRectEv
+__ZN7WebCore12RenderObject13addPDFURLRectEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext13setURLForRectERKNS_4KURLERKNS_7IntRectE
+-[DOMHTMLInputElement readOnly]
+__ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
+__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE15reserveCapacityEm
+__ZNK7WebCore9FrameTree24traversePreviousWithWrapEb
+__ZNK7WebCore9FrameTree13deepLastChildEv
+__ZNK7WebCore5Frame12selectedTextEv
+__ZN7WebCore14RenderReplaced20intrinsicSizeChangedEv
+__ZN7WebCore11FrameLoader26reloadWithOverrideEncodingERKNS_6StringE
+__ZN7WebCore15BackForwardList12containsItemEPNS_11HistoryItemE
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA
+_WebCoreSetAlwaysUsesComplexTextCodePath
+__ZN7WebCore4Font11setCodePathENS0_8CodePathE
+__ZN7WebCore20NetworkStateNotifier20dynamicStoreCallbackEPK16__SCDynamicStorePK9__CFArrayPv
+__ZN7WebCore5TimerINS_20NetworkStateNotifierEE5firedEv
+__ZN7WebCore20NetworkStateNotifier28networkStateChangeTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11FrameLoader26saveDocumentAndScrollStateEv
+__ZNK7WebCore11HistoryItem4copyEv
+__ZN3WTF6VectorIiLm0EEC1ERKS1_
+__ZN3WTF6VectorIiLm0EEC2ERKS1_
+__ZN7WebCore19InspectorController4showEv
+__ZN7WebCore19InspectorController20clearConsoleMessagesEv
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14shrinkCapacityEm
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashT
+__ZN7WebCore19InspectorController27windowScriptObjectAvailableEv
+__ZN7WebCore19scriptStateFromPageEPNS_4PageE
+__ZN7WebCore18ScriptGlobalObject3setEPN3JSC9ExecStateEPKcPNS_19InspectorControllerE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19InspectorControllerE
+__ZN7WebCore21JSInspectorController15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSInspectorControllerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19InspectorControllerEEE
+__ZN7WebCore21JSInspectorControllerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19InspectorControllerEEE
+__ZN7WebCoreL15handleExceptionEPN3JSC9ExecStateE
+__ZN7WebCore21JSInspectorController18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSInspectorControllerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore57jsInspectorControllerPrototypeFunctionLocalizedStringsURLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZNK7WebCore21JSInspectorController9classInfoEv
+__ZN7WebCore19InspectorController19localizedStringsURLEv
+__ZN7WebCore46jsInspectorControllerPrototypeFunctionPlatformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19InspectorController8platformEv
+__ZN7WebCore50jsInspectorControllerPrototypeFunctionHiddenPanelsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12hiddenPanelsEv
+__ZN7WebCore50jsInspectorControllerPrototypeFunctionWrapCallbackEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSInspectorController12wrapCallbackEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore26JSInspectorCallbackWrapper4wrapEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSInspectorCallbackWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getE
+__ZN7WebCore26JSInspectorCallbackWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore26JSInspectorCallbackWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore26JSQuarantinedObjectWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSInspectorCallbackWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setER
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore26JSInspectorCallbackWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashI
+__ZN7WebCore58jsInspectorControllerPrototypeFunctionHideDOMNodeHighlightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore19InspectorController13hideHighlightEv
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionSearchingForNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionInspectedWindowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore21JSInspectorController15inspectedWindowEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24JSInspectedObjectWrapper4wrapEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL8wrappersEv
+__ZNK3WTF7HashMapIPN3JSC14JSGlobalObjectEPNS0_IPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS5_EENS_10HashTr
+__ZN7WebCore24JSInspectedObjectWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore24JSInspectedObjectWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN3WTF7HashMapIPN3JSC14JSGlobalObjectEPNS0_IPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS5_EENS_10HashTra
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectESt4pairIS3_PNS_7HashMapIPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHa
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore24JSInspectedObjectWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3
+__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSInspectedObjectWrapper17allowsGetPropertyEv
+__ZNK7WebCore26JSQuarantinedObjectWrapper18unwrappedExecStateEv
+__ZNK7WebCore24JSInspectedObjectWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERK
+__ZNK7WebCore26JSQuarantinedObjectWrapper28transferExceptionToExecStateEPN3JSC9ExecStateE
+__ZN7WebCore26JSQuarantinedObjectWrapper17cachedValueGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionIsWindowVisibleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionDebuggerEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore55jsInspectorControllerPrototypeFunctionPauseOnExceptionsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore19InspectorController17pauseOnExceptionsEv
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionProfilerEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionLoadedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController17scriptObjectReadyEv
+__ZN7WebCore18ScriptGlobalObject3getEPN3JSC9ExecStateEPKcRNS_12ScriptObjectE
+__ZN7WebCore12ScriptObjectC1EPN3JSC8JSObjectE
+__ZN7WebCore12ScriptObjectC2EPN3JSC8JSObjectE
+__ZN7WebCore19InspectorController10showWindowEv
+__ZN7WebCore19InspectorController16setWindowVisibleEbb
+__ZN7WebCore19InspectorController17setAttachedWindowEb
+__ZN7WebCore18ScriptFunctionCallC1EPN3JSC9ExecStateERKNS_12ScriptObjectERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCallC2EPN3JSC9ExecStateERKNS_12ScriptObjectERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEb
+__ZN7WebCore18ScriptFunctionCall4callEv
+__ZN7WebCore18ScriptFunctionCall4callERbb
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionAttachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12attachWindowEv
+__ZN7WebCore19InspectorController21populateScriptObjectsEv
+__ZN7WebCoreL18callSimpleFunctionEPN3JSC9ExecStateERKNS_12ScriptObjectEPKc
+__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
+__ZN7WebCore17InspectorResource18updateScriptObjectEPN3JSC9ExecStateE
+__ZN7WebCore19InspectorController18resetScriptObjectsEv
+__ZN7WebCore17InspectorResource19releaseScriptObjectEPN3JSC9ExecStateERKNS_12ScriptObjectEb
+__ZN7WebCore26JSQuarantinedObjectWrapper11getCallDataERN3JSC8CallDataE
+__ZNK7WebCore24JSInspectedObjectWrapper20allowsCallAsFunctionEv
+__ZN7WebCore26JSQuarantinedObjectWrapper4callEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7JSValueERKNS1_7ArgListE
+__ZNK7WebCore24JSInspectedObjectWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSQuarantinedObjectWrapper9asWrapperEN3JSC7JSValueE
+__ZNK7WebCore24JSInspectedObjectWrapper9classInfoEv
+__ZNK7WebCore26JSQuarantinedObjectWrapper25allowsUnwrappedAccessFromEPN3JSC9ExecStateE
+__ZN7WebCore26JSQuarantinedObjectWrapper15unwrappedObjectEv
+__ZNK7WebCore26JSInspectorCallbackWrapper9classInfoEv
+__ZN7WebCore17InspectorResource18createScriptObjectEPN3JSC9ExecStateERKNS_12ScriptObjectE
+__ZN7WebCoreL19createHeadersObjectEPN3JSC9ExecStateERKNS_13HTTPHeaderMapEb
+__ZN7WebCore12ScriptObject9createNewEPN3JSC9ExecStateE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateERKNS_6StringES6_
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKNS_12ScriptObjectE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEx
+__ZN7WebCore18ScriptFunctionCall9constructERbb
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcRKNS_6StringE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcx
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKci
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcRKS0_
+__ZNK7WebCore17InspectorResource4typeEv
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcd
+__ZN7WebCore26getQuarantinedScriptObjectEPNS_9DOMWindowERNS_12ScriptObjectE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcb
+__ZN7WebCore26JSQuarantinedObjectWrapper4markEv
+__ZN7WebCore24JSInspectedObjectWrapperD1Ev
+__ZN7WebCore24JSInspectedObjectWrapperD2Ev
+__ZN7WebCore26JSQuarantinedObjectWrapperD2Ev
+__ZNK7WebCore26JSQuarantinedObjectWrapper17allowsGetPropertyEv
+__ZNK7WebCore26JSInspectorCallbackWrapper20allowsCallAsFunctionEv
+__ZNK7WebCore26JSInspectorCallbackWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSQuarantinedObjectWrapper3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore24JSInspectedObjectWrapper17allowsSetPropertyEv
+__ZN7WebCore36jsNodePrototypeFunctionHasAttributesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore48jsElementPrototypeFunctionScrollIntoViewIfNeededEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element22scrollIntoViewIfNeededEb
+__ZN7WebCore11jsAttrStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSInspectorCallbackWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSInspectorCallbackWrapperD1Ev
+__ZN7WebCore26JSInspectorCallbackWrapperD2Ev
+__ZN7WebCore17InspectorResource12createCachedExPNS_14DocumentLoaderEPKNS_14CachedResourceE
+__ZN7WebCore14ConsoleMessage12addToConsoleEPN3JSC9ExecStateERKNS_12ScriptObjectE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEj
+__ZN7WebCore17InspectorResource22setXMLHttpResponseTextERKNS_12ScriptStringE
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionHighlightDOMNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSInspectorController16highlightDOMNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore19InspectorController9highlightEPNS_4NodeE
+__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
+__ZN7WebCoreL19drawHighlightForBoxERNS_15GraphicsContextERKNS_9FloatQuadES4_S4_S4_
+__ZN7WebCoreL16drawOutlinedQuadERNS_15GraphicsContextERKNS_9FloatQuadERKNS_5ColorE
+__ZN7WebCoreL10quadToPathERKNS_9FloatQuadE
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12detachWindowEv
+__ZN7WebCore56jsInspectorControllerPrototypeFunctionMoveByUnrestrictedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZNK7WebCore19InspectorController12moveWindowByEff
+__ZN7WebCoreL24drawOutlinedQuadWithClipERNS_15GraphicsContextERKNS_9FloatQuadES4_RKNS_5ColorE
+__ZN7WebCore62jsInspectorControllerPrototypeFunctionAddResourceSourceToFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0
+__ZN7WebCore21JSInspectorController24addResourceSourceToFrameEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore17InspectorResource12sourceStringEv
+__ZN7WebCore19InspectorController16addSourceToFrameERKNS_6StringES3_PNS_4NodeE
+__ZN7WebCore11FrameLoader5beginEv
+__ZN7WebCore22HTMLViewSourceDocument7addLinkERKNS_6StringEb
+__ZN7WebCore19createTextTokenizerEPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13TextTokenizerC1EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13TextTokenizerC2EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableDebuggerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController14enableDebuggerEv
+__ZN7WebCore21JavaScriptDebugServer11addListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
+__ZN3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EE
+__ZN3WTF7HashSetIPN7WebCore23JavaScriptDebugListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore23JavaScriptDebugListenerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_
+__ZN7WebCore21JavaScriptDebugServer14didAddListenerEPNS_4PageE
+__ZN7WebCore4Page11setDebuggerEPN3JSC8DebuggerE
+__ZN7WebCore21JavaScriptDebugServer16clearBreakpointsEv
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEKNS_7HashMapIlS7_NS2_ImEENS4_IlEENS4_IS7_EEEEE
+__ZNK7WebCore25JSCanvasGradientPrototype9classInfoEv
+__ZNK7WebCore30JSInspectorControllerPrototype9classInfoEv
+__ZN3WTF7HashMapIPN3JSC14SourceProviderEPNS1_9ExecStateENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHa
+__ZN7WebCore21JavaScriptDebugServer12sourceParsedEPN3JSC9ExecStateERKNS1_10SourceCodeEiRKNS1_7UStringE
+__ZN7WebCoreL6toPageEPN3JSC14JSGlobalObjectE
+__ZNK3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_E
+__ZN7WebCoreL22dispatchDidParseSourceERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEP
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE15reserveCapacityEm
+__ZN7WebCore19InspectorController14didParseSourceEPN3JSC9ExecStateERKNS1_10SourceCodeE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKN3JSC7UStringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEi
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionAddSourceToFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSInspectorController16addSourceToFrameEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore32jsConsolePrototypeFunctionAssertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console15assertConditionEbPNS_15ScriptCallStackE
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6shrinkEm
+__ZN7WebCore21JavaScriptDebugServer9callEventERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore19JavaScriptCallFrameC1ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
+__ZN7WebCore19JavaScriptCallFrameC2ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
+__ZN7WebCore21JavaScriptDebugServer13pauseIfNeededEPNS_4PageE
+__ZNK7WebCore21JavaScriptDebugServer13hasBreakpointElj
+__ZNK3WTF7HashMapIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEENS2_ImEENS4_IlEENS4_IS7_EEE3getERKl
+__ZN7WebCore21JavaScriptDebugServer11atStatementERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore21JavaScriptDebugServer11returnEventERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore19JavaScriptCallFrame6callerEv
+__ZN3WTF10RefCountedIN7WebCore19JavaScriptCallFrameEE5derefEv
+__ZN7WebCore21JavaScriptDebugServer18willExecuteProgramERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore21JavaScriptDebugServer17didExecuteProgramERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore46jsInspectorControllerPrototypeFunctionProfilesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSInspectorController8profilesEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableProfilerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore32JSHTMLOptionsCollectionPrototype9classInfoEv
+__ZN7WebCore21JavaScriptDebugServer15continueProgramEv
+__ZN7WebCore21JavaScriptDebugServer9exceptionERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionStartProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore51jsInspectorControllerPrototypeFunctionStopProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
+__ZN7WebCore19InspectorController15disableDebuggerEv
+__ZN7WebCore21JavaScriptDebugServer14removeListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
+__ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_E
+__ZN7WebCore21JavaScriptDebugServer17didRemoveListenerEPNS_4PageE
+__ZN7WebCore21JavaScriptDebugServer21didRemoveLastListenerEv
+__ZN7WebCore5Frame17setIsDisconnectedEb
+__ZN7WebCore19InspectorController11closeWindowEv
+__ZN7WebCoreL19getUniqueIdCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore28setJSHTMLTableColElementSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement7setSpanEi
+__ZN7WebCoreL12getTotalTimeEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL7getHeadEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL10getCallUIDEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL9getParentEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL11getSelfTimeEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL16getNumberOfCallsEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionWindowUnloadingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore11HistoryItem11setReferrerERKNS_6StringE
+-[DOMHTMLTextAreaElement form]
+-[DOMHTMLTextAreaElement(FormPromptAdditions) _isEdited]
+__Z4coreP22DOMHTMLTextAreaElement
+__ZN7WebCore4Page9goForwardEv
+__ZN7WebCoreL11scanForFormEPNS_4NodeE
+__ZN7WebCore3macERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeEPNS_14ResourceHandleERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZN7WebCore11FrameLoader33didReceiveAuthenticationChallengeEPNS_14ResourceLoaderERKNS_23AuthenticationChallengeE
+-[WebCoreResourceHandleAsDelegate useCredential:forAuthenticationChallenge:]
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE6shrinkEm
+__ZNK3JSC8Bindings9ObjcField17valueFromInstanceEPNS_9ExecStateEPKNS0_8InstanceE
+__ZN7WebCore12RenderObject23collectDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN7WebCore12RenderObject19addDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE15reserveCapacityEm
+__ZNK7WebCore8Document16dashboardRegionsEv
+__ZN3WTFeqIN7WebCore20DashboardRegionValueELm0EEEbRKNS_6VectorIT_XT0_EEES7_
+__ZN7WebCore8Document19setDashboardRegionsERKN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14shrinkCapacityEm
+__ZN7WebCore5Frame26dashboardRegionsDictionaryEv
+-[WebDashboardRegion initWithRect:clip:type:]
+-[WebDashboardRegion dashboardRegionType]
+-[WebDashboardRegion dashboardRegionClip]
+-[WebDashboardRegion dashboardRegionRect]
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE6shrinkEm
+__ZNK7WebCore16PDFDocumentImage23hasSingleSecurityOriginEv
+__ZN7WebCore11RenderStyle20noneDashboardRegionsEv
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEaSERKS3_
+__ZN7WebCore12RenderInline19addDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3JSC8Bindings12ObjcInstance24setValueOfUndefinedFieldEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueE
+__ZN7WebCore10RenderView13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+__ZN7WebCoreL21printSourceURLAndLineERKNS_6StringEj
+__ZN7WebCoreL32printMessageSourceAndLevelPrefixENS_13MessageSourceENS_12MessageLevelE
+-[AccessibilityObjectWrapper position]
+__ZN7WebCore17SubresourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZThn16_N7WebCore24DocumentThreadableLoader33didReceiveAuthenticationChallengeEPNS_17SubresourceLoaderERKNS_23AuthenticationCh
+__ZN7WebCore24DocumentThreadableLoader33didReceiveAuthenticationChallengeEPNS_17SubresourceLoaderERKNS_23AuthenticationChalleng
+__ZN7WebCore57jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeColorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorERKNS_6StringEf
+__ZN7WebCore11CanvasStyleC1ERKNS_6StringEf
+__ZN7WebCore11CanvasStyleC2ERKNS_6StringEf
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetLineWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionSetLineCapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index 8559ebc071..28ff4ae250 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -13,22 +13,35 @@ CONFIG(QTDIR_build) {
     include($$QT_SOURCE_TREE/src/qbase.pri)
     PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
     DEFINES *= NDEBUG
+} else {
+    !static: DEFINES += QT_MAKEDLL
+
+    CONFIG(debug, debug|release) {
+        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
+        OBJECTS_DIR = obj/debug
+    } else { # Release
+        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
+        OBJECTS_DIR = obj/release
+    }
+
+    DESTDIR = $$OUTPUT_DIR/lib
 }
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
-win32-*|wince*: GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
-unix:QMAKE_PKGCONFIG_REQUIRES = QtCore QtDBus QtGui QtNetwork QtXml
+GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
 
-!CONFIG(QTDIR_build) {
-     OBJECTS_DIR = tmp
-     DESTDIR = $$OUTPUT_DIR/lib
+unix {
+    QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
+    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 include($$OUTPUT_DIR/config.pri)
 
 CONFIG -= warn_on
 *-g++*:QMAKE_CXXFLAGS += -Wreturn-type -fno-strict-aliasing
+
+unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
+unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
+
 #QMAKE_CXXFLAGS += -Wall -Wno-undef -Wno-unused-parameter
 
 CONFIG(release):!CONFIG(QTDIR_build) {
@@ -39,13 +52,6 @@ CONFIG(release):!CONFIG(QTDIR_build) {
 linux-*: DEFINES += HAVE_STDINT_H
 freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
 
-# PRE-BUILD: make the required config.h file
-#config_h.target = config.h
-#config_h.commands = cp config.h.qmake config.h
-#config_h.depends = config.h.qmake
-#QMAKE_EXTRA_TARGETS += config_h
-#PRE_TARGETDEPS += config.h
-
 DEFINES += BUILD_WEBKIT
 
 win32-*: DEFINES += _HAS_TR1=0
@@ -78,58 +84,68 @@ CONFIG(QTDIR_build) {
 
 # Optional components (look for defs in config.h and included files!)
 
-# turn off database support if we do not have sqlite3 support 
-!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0
+}
+
+# turn off SQLITE support if we do not have sqlite3 available
+!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
 
+!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
+!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
 !contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 !contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
 
-# turn on database support if any of the dependent features are turned on
-!contains(DEFINES, ENABLE_DATABASE=1) {
-  contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    DEFINES += ENABLE_DATABASE=1
+# turn on SQLITE support if any of the dependent features are turned on
+!contains(DEFINES, ENABLE_SQLITE=.) {
+  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
+    DEFINES += ENABLE_SQLITE=1
+  } else {
+    DEFINES += ENABLE_SQLITE=0
   }
 }
 
-# if database support is not on by now, turn it off 
-!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=0
-
 !contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
+!contains(DEFINES, ENABLE_XSLT=.): DEFINES += ENABLE_XSLT=0
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
 !contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
-!contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
-!contains(DEFINES, ENABLE_SVG_FILTERS=.): DEFINES += ENABLE_SVG_FILTERS=1
-!contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
-!contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
-!contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
-!contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
+!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
+
+# SVG support
+!contains(DEFINES, ENABLE_SVG=0) {
+    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
+    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
+    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
+    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
+    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
+    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+} else {
+    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+}
 
 # HTML5 media support
-contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
-else:DEFINES += ENABLE_VIDEO=0
+!contains(DEFINES, ENABLE_VIDEO=.) {
+    contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
+    else:DEFINES += ENABLE_VIDEO=0
+}
 
 # Nescape plugins support (NPAPI)
-unix|win32-*:!embedded:!wince*:!symbian {
-    DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
-} else {
-    DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
+!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
+    unix|win32-*:!embedded:!wince*:!symbian {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
+    } else {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
+    }
 }
 
 DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
 
-INCLUDEPATH += $$PWD $$PWD/../JavaScriptCore $$PWD/../JavaScriptCore/ForwardingHeaders \
-               $$PWD/../JavaScriptCore/interpreter \
-               $$PWD/../JavaScriptCore/bytecode \
-               $$PWD/../JavaScriptCore/debugger \
-               $$PWD/../JavaScriptCore/parser \
-               $$PWD/../JavaScriptCore/runtime \
-               $$PWD/../JavaScriptCore/bindings \
-               $$PWD/../JavaScriptCore/wrec \
-               $$PWD/../JavaScriptCore/jit \
-               $$PWD/../JavaScriptCore/wtf \
+# Ensure that we pick up WebCore's config.h over JavaScriptCore's
+INCLUDEPATH = $$PWD $$INCLUDEPATH
 
 include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
 
@@ -142,21 +158,16 @@ INCLUDEPATH += \
     $$PWD/platform/graphics/filters \
     $$PWD/platform/graphics/transforms \
     $$PWD/platform/graphics/qt \
-    $$PWD/svg/graphics/qt \
-    $$PWD/loader \
     $$PWD/page/qt \
     $$PWD/../WebKit/qt/WebCoreSupport \
-    $$PWD/../WebKit/qt/Api \
-    $$PWD/bridge/qt
 
 # Make sure storage/ appears before JavaScriptCore/. Both provide LocalStorage.h
 # but the header from the former include path is included across directories while
 # LocalStorage.h is included only from files within the same directory
 INCLUDEPATH = $$PWD/storage $$INCLUDEPATH
 
-INCLUDEPATH +=  $$PWD \
+INCLUDEPATH +=  $$PWD/accessibility \
                 $$PWD/ForwardingHeaders \
-                $$PWD/.. \
                 $$PWD/platform \
                 $$PWD/platform/animation \
                 $$PWD/platform/network \
@@ -174,7 +185,6 @@ INCLUDEPATH +=  $$PWD \
                 $$PWD/dom \
                 $$PWD/page \
                 $$PWD/page/animation \
-                $$PWD/bridge \
                 $$PWD/editing \
                 $$PWD/rendering \
                 $$PWD/rendering/style \
@@ -183,14 +193,15 @@ INCLUDEPATH +=  $$PWD \
                 $$PWD/xml \
                 $$PWD/html \
                 $$PWD/wml \
+                $$PWD/workers \
                 $$PWD/bindings/js \
                 $$PWD/svg \
                 $$PWD/platform/image-decoders \
                 $$PWD/plugins \
                 $$PWD/bridge \
                 $$PWD/bridge/c \
-                $$PWD/bridge/qt \
-                $$GENERATED_SOURCES_DIR
+                $$PWD/bridge/qt
+INCLUDEPATH *=  $$GENERATED_SOURCES_DIR
 
 QT += network
 lessThan(QT_MINOR_VERSION, 4): QT += xml
@@ -259,9 +270,12 @@ IDL_BINDINGS += \
     css/StyleSheetList.idl \
     css/WebKitCSSKeyframeRule.idl \
     css/WebKitCSSKeyframesRule.idl \
+    css/WebKitCSSMatrix.idl \
     css/WebKitCSSTransformValue.idl \
     dom/Attr.idl \
     dom/CharacterData.idl \
+    dom/ClientRect.idl \
+    dom/ClientRectList.idl \
     dom/Clipboard.idl \
     dom/CDATASection.idl \
     dom/Comment.idl \
@@ -278,7 +292,6 @@ IDL_BINDINGS += \
     dom/EventException.idl \
 #    dom/EventListener.idl \
 #    dom/EventTarget.idl \
-    dom/EventTargetNode.idl \
     dom/KeyboardEvent.idl \
     dom/MouseEvent.idl \
     dom/MessageChannel.idl \
@@ -303,14 +316,12 @@ IDL_BINDINGS += \
     dom/WebKitAnimationEvent.idl \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
-    dom/Worker.idl \
-    dom/WorkerContext.idl \
-    dom/WorkerLocation.idl \
     html/CanvasGradient.idl \
     html/CanvasPattern.idl \
     html/CanvasRenderingContext2D.idl \
     html/File.idl \
     html/FileList.idl \
+    html/HTMLAudioElement.idl \
     html/HTMLAnchorElement.idl \
     html/HTMLAppletElement.idl \
     html/HTMLAreaElement.idl \
@@ -347,6 +358,7 @@ IDL_BINDINGS += \
     html/HTMLLinkElement.idl \
     html/HTMLMapElement.idl \
     html/HTMLMarqueeElement.idl \
+    html/HTMLMediaElement.idl \
     html/HTMLMenuElement.idl \
     html/HTMLMetaElement.idl \
     html/HTMLModElement.idl \
@@ -361,6 +373,7 @@ IDL_BINDINGS += \
     html/HTMLQuoteElement.idl \
     html/HTMLScriptElement.idl \
     html/HTMLSelectElement.idl \
+    html/HTMLSourceElement.idl \
     html/HTMLStyleElement.idl \
     html/HTMLTableCaptionElement.idl \
     html/HTMLTableCellElement.idl \
@@ -371,11 +384,15 @@ IDL_BINDINGS += \
     html/HTMLTextAreaElement.idl \
     html/HTMLTitleElement.idl \
     html/HTMLUListElement.idl \
+    html/HTMLVideoElement.idl \
     html/ImageData.idl \
+    html/MediaError.idl \
     html/TextMetrics.idl \
-    inspector/JavaScriptCallFrame.idl \
+    html/VoidCallback.idl \
+    inspector/InspectorController.idl \
     page/BarInfo.idl \
     page/Console.idl \
+    page/Coordinates.idl \
     page/DOMSelection.idl \
     page/DOMWindow.idl \
     page/Geolocation.idl \
@@ -385,7 +402,7 @@ IDL_BINDINGS += \
     page/Navigator.idl \
     page/PositionError.idl \
     page/Screen.idl \
-    page/WorkerNavigator.idl \
+    page/WebKitPoint.idl \
     plugins/Plugin.idl \
     plugins/MimeType.idl \
     plugins/PluginArray.idl \
@@ -395,20 +412,35 @@ IDL_BINDINGS += \
     xml/XMLHttpRequestException.idl \
     xml/XMLHttpRequestProgressEvent.idl \
     xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XSLTProcessor.idl
+    xml/XMLSerializer.idl
 
 
 SOURCES += \
-    bindings/js/DOMTimer.cpp \
+    accessibility/AccessibilityImageMapLink.cpp \
+    accessibility/AccessibilityObject.cpp \    
+    accessibility/AccessibilityList.cpp \    
+    accessibility/AccessibilityListBox.cpp \    
+    accessibility/AccessibilityListBoxOption.cpp \    
+    accessibility/AccessibilityRenderObject.cpp \    
+    accessibility/AccessibilityARIAGrid.cpp \    
+    accessibility/AccessibilityARIAGridCell.cpp \    
+    accessibility/AccessibilityARIAGridRow.cpp \    
+    accessibility/AccessibilityTable.cpp \    
+    accessibility/AccessibilityTableCell.cpp \    
+    accessibility/AccessibilityTableColumn.cpp \    
+    accessibility/AccessibilityTableHeaderContainer.cpp \    
+    accessibility/AccessibilityTableRow.cpp \    
+    accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
     bindings/js/JSAttrCustom.cpp \
+    bindings/js/JSCDATASectionCustom.cpp \
     bindings/js/JSCanvasRenderingContext2DCustom.cpp \
     bindings/js/JSClipboardCustom.cpp \
     bindings/js/JSConsoleCustom.cpp \
     bindings/js/JSCSSRuleCustom.cpp \
     bindings/js/JSCSSStyleDeclarationCustom.cpp \
     bindings/js/JSCSSValueCustom.cpp \
+    bindings/js/JSCoordinatesCustom.cpp \
     bindings/js/JSCustomPositionCallback.cpp \
     bindings/js/JSCustomPositionErrorCallback.cpp \
     bindings/js/JSCustomVoidCallback.cpp \
@@ -423,11 +455,9 @@ SOURCES += \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
     bindings/js/JSEventTarget.cpp \
-    bindings/js/JSEventTargetNodeCustom.cpp \
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
-    bindings/js/JSJavaScriptCallFrameCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
@@ -445,6 +475,7 @@ SOURCES += \
     bindings/js/JSImageDataCustom.cpp \
     bindings/js/JSInspectedObjectWrapper.cpp \
     bindings/js/JSInspectorCallbackWrapper.cpp \
+    bindings/js/JSInspectorControllerCustom.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
     bindings/js/JSNamedNodesCollection.cpp  \
@@ -459,12 +490,13 @@ SOURCES += \
     bindings/js/JSRGBColor.cpp \
     bindings/js/JSStyleSheetCustom.cpp \
     bindings/js/JSStyleSheetListCustom.cpp \
+    bindings/js/JSTextCustom.cpp \
     bindings/js/JSTreeWalkerCustom.cpp \
+    bindings/js/JSWebKitCSSMatrixConstructor.cpp \
+    bindings/js/JSWebKitPointConstructor.cpp \
     bindings/js/JSXMLHttpRequestConstructor.cpp \
     bindings/js/JSXMLHttpRequestCustom.cpp \
     bindings/js/JSXMLHttpRequestUploadCustom.cpp \
-    bindings/js/JSXSLTProcessorConstructor.cpp \
-    bindings/js/JSXSLTProcessorCustom.cpp \
     bindings/js/JSPluginCustom.cpp \
     bindings/js/JSPluginArrayCustom.cpp \
     bindings/js/JSMessageChannelConstructor.cpp \
@@ -473,13 +505,20 @@ SOURCES += \
     bindings/js/JSMimeTypeArrayCustom.cpp \
     bindings/js/JSDOMBinding.cpp \
     bindings/js/JSEventListener.cpp \
+    bindings/js/JSLazyEventListener.cpp \
     bindings/js/JSPluginElementFunctions.cpp \
-    bindings/js/ScriptCachedPageData.cpp \
+    bindings/js/ScriptCachedFrameData.cpp \
     bindings/js/ScriptCallFrame.cpp \
     bindings/js/ScriptCallStack.cpp \
     bindings/js/ScriptController.cpp \
+    bindings/js/ScriptEventListener.cpp \
+    bindings/js/ScriptFunctionCall.cpp \
+    bindings/js/ScriptObject.cpp \
+    bindings/js/ScriptObjectQuarantine.cpp \
+    bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
+    bridge/IdentifierRep.cpp \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
     bridge/runtime_array.cpp \
@@ -516,6 +555,7 @@ SOURCES += \
     css/CSSParserValues.cpp \
     css/CSSPrimitiveValue.cpp \
     css/CSSProperty.cpp \
+    css/CSSPropertyLonghand.cpp \
     css/CSSReflectValue.cpp \
     css/CSSRule.cpp \
     css/CSSRuleList.cpp \
@@ -546,6 +586,7 @@ SOURCES += \
     css/StyleSheetList.cpp \
     css/WebKitCSSKeyframeRule.cpp \
     css/WebKitCSSKeyframesRule.cpp \
+    css/WebKitCSSMatrix.cpp \
     css/WebKitCSSTransformValue.cpp \
     dom/ActiveDOMObject.cpp \
     dom/Attr.cpp \
@@ -554,9 +595,12 @@ SOURCES += \
     dom/BeforeUnloadEvent.cpp \
     dom/CDATASection.cpp \
     dom/CharacterData.cpp \
+    dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
     dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
+    dom/ClientRect.cpp \
+    dom/ClientRectList.cpp \
     dom/Clipboard.cpp \
     dom/ClipboardEvent.cpp \
     dom/Comment.cpp \
@@ -575,9 +619,9 @@ SOURCES += \
     dom/Event.cpp \
     dom/EventNames.cpp \
     dom/EventTarget.cpp \
-    dom/EventTargetNode.cpp \
     dom/ExceptionBase.cpp \
     dom/ExceptionCode.cpp \
+    dom/InputElement.cpp \
     dom/KeyboardEvent.cpp \
     dom/MappedAttribute.cpp \
     dom/MessageChannel.cpp \
@@ -594,6 +638,8 @@ SOURCES += \
     dom/NodeFilter.cpp \
     dom/NodeIterator.cpp \
     dom/Notation.cpp \
+    dom/OptionGroupElement.cpp \
+    dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
@@ -604,6 +650,7 @@ SOURCES += \
     dom/RegisteredEventListener.cpp \
     dom/ScriptElement.cpp \
     dom/ScriptExecutionContext.cpp \
+    dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
     dom/StaticNodeList.cpp \
     dom/StaticStringList.cpp \
@@ -621,6 +668,7 @@ SOURCES += \
     dom/WheelEvent.cpp \
     dom/XMLTokenizer.cpp \
     dom/XMLTokenizerQt.cpp \
+    dom/XMLTokenizerScope.cpp \
     editing/AppendNodeCommand.cpp \
     editing/ApplyStyleCommand.cpp \
     editing/BreakBlockquoteCommand.cpp \
@@ -650,12 +698,11 @@ SOURCES += \
     editing/MoveSelectionCommand.cpp \
     editing/RemoveCSSPropertyCommand.cpp \
     editing/RemoveFormatCommand.cpp \
-    editing/RemoveNodeAttributeCommand.cpp \
     editing/RemoveNodeCommand.cpp \
     editing/RemoveNodePreservingChildrenCommand.cpp \
+    editing/ReplaceNodeWithSpanCommand.cpp \
     editing/ReplaceSelectionCommand.cpp \
     editing/SelectionController.cpp \
-    editing/Selection.cpp \
     editing/SetNodeAttributeCommand.cpp \
     editing/SmartReplace.cpp \
     editing/SmartReplaceICU.cpp \
@@ -666,16 +713,20 @@ SOURCES += \
     editing/TypingCommand.cpp \
     editing/UnlinkCommand.cpp \
     editing/VisiblePosition.cpp \
+    editing/VisibleSelection.cpp \
     editing/visible_units.cpp \
     editing/WrapContentsInDummySpanCommand.cpp \
     history/BackForwardList.cpp \
+    history/CachedFrame.cpp \
     history/CachedPage.cpp \
     history/HistoryItem.cpp \
     history/PageCache.cpp \
     html/CanvasGradient.cpp \
     html/CanvasPattern.cpp \
+    html/CanvasPixelArray.cpp \
     html/CanvasRenderingContext2D.cpp \
     html/CanvasStyle.cpp \
+    html/CollectionCache.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -695,7 +746,6 @@ SOURCES += \
     html/HTMLDListElement.cpp \
     html/HTMLDocument.cpp \
     html/HTMLElement.cpp \
-    html/HTMLElementFactory.cpp \
     html/HTMLEmbedElement.cpp \
     html/HTMLFieldSetElement.cpp \
     html/HTMLFontElement.cpp \
@@ -740,6 +790,7 @@ SOURCES += \
     html/HTMLPreElement.cpp \
     html/HTMLQuoteElement.cpp \
     html/HTMLScriptElement.cpp \
+    html/HTMLNoScriptElement.cpp \
     html/HTMLSelectElement.cpp \
     html/HTMLStyleElement.cpp \
     html/HTMLTableCaptionElement.cpp \
@@ -757,11 +808,13 @@ SOURCES += \
     html/HTMLViewSourceDocument.cpp \
     html/ImageData.cpp \
     html/PreloadScanner.cpp \
+    inspector/ConsoleMessage.cpp \
+    inspector/InspectorDatabaseResource.cpp \
+    inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorController.cpp \
-    inspector/JavaScriptCallFrame.cpp \
-    inspector/JavaScriptDebugServer.cpp \
-    inspector/JavaScriptProfile.cpp \
-    inspector/JavaScriptProfileNode.cpp \
+    inspector/InspectorFrontend.cpp \
+    inspector/InspectorResource.cpp \
+    inspector/JSONObject.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
@@ -775,11 +828,13 @@ SOURCES += \
     loader/CachedResource.cpp \
     loader/CachedScript.cpp \
     loader/CachedXSLStyleSheet.cpp \
+    loader/CrossOriginAccessControl.cpp \
+    loader/CrossOriginPreflightResultCache.cpp \
     loader/DocLoader.cpp \
     loader/DocumentLoader.cpp \
+    loader/DocumentThreadableLoader.cpp \
     loader/FormState.cpp \
     loader/FrameLoader.cpp \
-    loader/FrameLoaderClient.cpp \
     loader/FTPDirectoryDocument.cpp \
     loader/FTPDirectoryParser.cpp \
     loader/icon/IconLoader.cpp \
@@ -797,28 +852,19 @@ SOURCES += \
     loader/SubresourceLoader.cpp \
     loader/TextDocument.cpp \
     loader/TextResourceDecoder.cpp \
-    page/AccessibilityImageMapLink.cpp \
-    page/AccessibilityObject.cpp \    
-    page/AccessibilityList.cpp \    
-    page/AccessibilityListBox.cpp \    
-    page/AccessibilityListBoxOption.cpp \    
-    page/AccessibilityRenderObject.cpp \    
-    page/AccessibilityTable.cpp \    
-    page/AccessibilityTableCell.cpp \    
-    page/AccessibilityTableColumn.cpp \    
-    page/AccessibilityTableHeaderContainer.cpp \    
-    page/AccessibilityTableRow.cpp \    
+    loader/ThreadableLoader.cpp \
     page/animation/AnimationBase.cpp \
     page/animation/AnimationController.cpp \
     page/animation/CompositeAnimation.cpp \
     page/animation/ImplicitAnimation.cpp \
     page/animation/KeyframeAnimation.cpp \
-    page/AXObjectCache.cpp \
     page/BarInfo.cpp \
     page/Chrome.cpp \
     page/Console.cpp \
     page/ContextMenuController.cpp \
+    page/Coordinates.cpp \
     page/DOMSelection.cpp \
+    page/DOMTimer.cpp \
     page/DOMWindow.cpp \
     page/Navigator.cpp \
     page/NavigatorBase.cpp \
@@ -835,6 +881,7 @@ SOURCES += \
     page/MouseEventWithHitTestResults.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
+    page/PageGroupLoadDeferrer.cpp \
     page/PrintContext.cpp \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
@@ -852,7 +899,9 @@ SOURCES += \
     platform/text/AtomicString.cpp \
     platform/text/Base64.cpp \
     platform/text/BidiContext.cpp \
+    platform/ContentType.cpp \
     platform/ContextMenu.cpp \
+    platform/CrossThreadCopier.cpp \
     platform/text/CString.cpp \
     platform/DeprecatedPtrListImpl.cpp \
     platform/DragData.cpp \
@@ -884,6 +933,8 @@ SOURCES += \
     platform/graphics/SimpleFontData.cpp \
     platform/graphics/transforms/TransformationMatrix.cpp \
     platform/graphics/transforms/MatrixTransformOperation.cpp \
+    platform/graphics/transforms/Matrix3DTransformOperation.cpp \
+    platform/graphics/transforms/PerspectiveTransformOperation.cpp \
     platform/graphics/transforms/RotateTransformOperation.cpp \
     platform/graphics/transforms/ScaleTransformOperation.cpp \
     platform/graphics/transforms/SkewTransformOperation.cpp \
@@ -898,6 +949,7 @@ SOURCES += \
     platform/network/Credential.cpp \
     platform/network/FormData.cpp \
     platform/network/FormDataBuilder.cpp \
+    platform/network/HTTPHeaderMap.cpp \
     platform/network/HTTPParsers.cpp \
     platform/network/NetworkStateNotifier.cpp \
     platform/network/ProtectionSpace.cpp \
@@ -919,11 +971,12 @@ SOURCES += \
     platform/text/TextCodecLatin1.cpp \
     platform/text/TextCodecUserDefined.cpp \
     platform/text/TextCodecUTF16.cpp \
-    platform/text/TextDecoder.cpp \
     platform/text/TextEncoding.cpp \
+    platform/text/TextEncodingDetectorNone.cpp \
     platform/text/TextEncodingRegistry.cpp \
     platform/text/TextStream.cpp \
     platform/ThreadGlobalData.cpp \
+    platform/ThreadTimers.cpp \
     platform/Timer.cpp \
     platform/text/UnicodeRange.cpp \
     platform/Widget.cpp \
@@ -943,19 +996,17 @@ SOURCES += \
     rendering/InlineFlowBox.cpp \
     rendering/InlineTextBox.cpp \
     rendering/LayoutState.cpp \
-    rendering/ListMarkerBox.cpp \
     rendering/RenderApplet.cpp \
     rendering/RenderArena.cpp \
     rendering/RenderBlock.cpp \
     rendering/RenderBox.cpp \
+    rendering/RenderBoxModelObject.cpp \
     rendering/RenderBR.cpp \
     rendering/RenderButton.cpp \
-    rendering/RenderContainer.cpp \
     rendering/RenderCounter.cpp \
     rendering/RenderFieldset.cpp \
     rendering/RenderFileUploadControl.cpp \
     rendering/RenderFlexibleBox.cpp \
-    rendering/RenderFlow.cpp \
     rendering/RenderFrame.cpp \
     rendering/RenderFrameSet.cpp \
     rendering/RenderHTMLCanvas.cpp \
@@ -963,13 +1014,14 @@ SOURCES += \
     rendering/RenderImageGeneratedContent.cpp \
     rendering/RenderInline.cpp \
     rendering/RenderLayer.cpp \
-    rendering/RenderLegend.cpp \
+    rendering/RenderLineBoxList.cpp \
     rendering/RenderListBox.cpp \
     rendering/RenderListItem.cpp \
     rendering/RenderListMarker.cpp \
     rendering/RenderMarquee.cpp \
     rendering/RenderMenuList.cpp \
     rendering/RenderObject.cpp \
+    rendering/RenderObjectChildList.cpp \
     rendering/RenderPart.cpp \
     rendering/RenderPartObject.cpp \
     rendering/RenderReplaced.cpp \
@@ -978,15 +1030,15 @@ SOURCES += \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
     rendering/RenderSlider.cpp \
+    rendering/RenderTable.cpp \
     rendering/RenderTableCell.cpp \
     rendering/RenderTableCol.cpp \
-    rendering/RenderTable.cpp \
     rendering/RenderTableRow.cpp \
     rendering/RenderTableSection.cpp \
+    rendering/RenderText.cpp \
     rendering/RenderTextControl.cpp \
     rendering/RenderTextControlMultiLine.cpp \
     rendering/RenderTextControlSingleLine.cpp \
-    rendering/RenderText.cpp \
     rendering/RenderTextFragment.cpp \
     rendering/RenderTheme.cpp \
     rendering/RenderTreeAsText.cpp \
@@ -995,7 +1047,9 @@ SOURCES += \
     rendering/RenderWordBreak.cpp \
     rendering/RootInlineBox.cpp \
     rendering/SVGRenderTreeAsText.cpp \
+    rendering/ScrollBehavior.cpp \
     rendering/TextControlInnerElements.cpp \
+    rendering/TransformState.cpp \
     rendering/style/BindingURI.cpp \
     rendering/style/ContentData.cpp \
     rendering/style/CounterDirectives.cpp \
@@ -1018,35 +1072,13 @@ SOURCES += \
     rendering/style/StyleTransformData.cpp \
     rendering/style/StyleVisualData.cpp \
     xml/DOMParser.cpp \
-    xml/NativeXPathNSResolver.cpp \
     xml/XMLHttpRequest.cpp \
     xml/XMLHttpRequestUpload.cpp \
-    xml/XMLSerializer.cpp \
-    xml/XPathEvaluator.cpp \
-    xml/XPathExpression.cpp \
-    xml/XPathExpressionNode.cpp \
-    xml/XPathFunctions.cpp \
-    xml/XPathNamespace.cpp \
-    xml/XPathNodeSet.cpp \
-    xml/XPathNSResolver.cpp \
-    xml/XPathParser.cpp \
-    xml/XPathPath.cpp \
-    xml/XPathPredicate.cpp \
-    xml/XPathResult.cpp \
-    xml/XPathStep.cpp \
-    xml/XPathUtil.cpp \
-    xml/XPathValue.cpp \
-    xml/XPathVariableReference.cpp \
-    xml/XSLImportRule.cpp \
-    xml/XSLStyleSheet.cpp \
-    xml/XSLTExtensions.cpp \
-    xml/XSLTUnicodeSort.cpp \
-    xml/XSLTProcessor.cpp
+    xml/XMLSerializer.cpp 
 
 HEADERS += \
     $$PWD/platform/graphics/qt/StillImageQt.h \
     $$PWD/platform/qt/QWebPopup.h \
-    $$PWD/platform/qt/MenuEventProxy.h \
     $$PWD/../WebKit/qt/Api/qwebpluginfactory.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/QNetworkReplyHandler.h \
@@ -1061,11 +1093,11 @@ HEADERS += \
 
 
 SOURCES += \
+    accessibility/qt/AccessibilityObjectQt.cpp \
     bindings/js/ScriptControllerQt.cpp \
     bridge/qt/qt_class.cpp \
     bridge/qt/qt_instance.cpp \
     bridge/qt/qt_runtime.cpp \
-    page/qt/AccessibilityObjectQt.cpp \
     page/qt/DragControllerQt.cpp \
     page/qt/EventHandlerQt.cpp \
     page/qt/FrameQt.cpp \
@@ -1144,6 +1176,7 @@ SOURCES += \
     ../WebKit/qt/Api/qwebframe.cpp \
     ../WebKit/qt/Api/qwebpage.cpp \
     ../WebKit/qt/Api/qwebview.cpp \
+    ../WebKit/qt/Api/qwebelement.cpp \
     ../WebKit/qt/Api/qwebhistory.cpp \
     ../WebKit/qt/Api/qwebsettings.cpp \
     ../WebKit/qt/Api/qwebhistoryinterface.cpp \
@@ -1153,7 +1186,6 @@ SOURCES += \
 
 
     win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp
-    else: SOURCES += platform/qt/SystemTimeQt.cpp
 
     mac {
         SOURCES += \
@@ -1187,6 +1219,8 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
     SOURCES += plugins/npapi.cpp
 
     unix {
+        DEFINES += ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1
+
         mac {
             SOURCES += \
                 plugins/mac/PluginPackageMac.cpp \
@@ -1199,8 +1233,11 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         } else {
             !embedded: CONFIG += x11
             SOURCES += \
+                plugins/qt/PluginContainerQt.cpp \
                 plugins/qt/PluginPackageQt.cpp \
                 plugins/qt/PluginViewQt.cpp
+            HEADERS += \
+                plugins/qt/PluginContainerQt.h
             DEFINES += XP_UNIX
         }
     }
@@ -1223,15 +1260,17 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
             -lversion
     }
 
+} else {
+    SOURCES += \
+        plugins/PluginPackageNone.cpp \
+        plugins/PluginViewNone.cpp
 }
 
 contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
     DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
 }
 
-contains(DEFINES, ENABLE_DATABASE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
-
+contains(DEFINES, ENABLE_SQLITE=1) {
     # somewhat copied from src/plugins/sqldrivers/sqlite/sqlite.pro
     CONFIG(QTDIR_build):system-sqlite {
         LIBS *= $$QT_LFLAGS_SQLITE
@@ -1241,6 +1280,9 @@ contains(DEFINES, ENABLE_DATABASE=1) {
             # we have source - use it
             CONFIG(release, debug|release):DEFINES *= NDEBUG
             DEFINES += SQLITE_CORE SQLITE_OMIT_LOAD_EXTENSION SQLITE_OMIT_COMPLETE 
+            contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+                DEFINES+=SQLITE_THREADSAFE=0
+            }
             INCLUDEPATH += $${SQLITE3SRCDIR}
             SOURCES += $${SQLITE3SRCDIR}/sqlite3.c
         } else {
@@ -1256,20 +1298,21 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         platform/sql/SQLiteStatement.cpp \
         platform/sql/SQLiteTransaction.cpp \
         platform/sql/SQLValue.cpp \
-        storage/ChangeVersionWrapper.cpp \
-        storage/DatabaseAuthorizer.cpp \
         storage/Database.cpp \
+        storage/DatabaseAuthorizer.cpp
+}
+
+
+contains(DEFINES, ENABLE_DATABASE=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
+
+    SOURCES += \
+        storage/ChangeVersionWrapper.cpp \
         storage/DatabaseTask.cpp \
         storage/DatabaseThread.cpp \
         storage/DatabaseTracker.cpp \
-        storage/LocalStorage.cpp \
-        storage/LocalStorageArea.cpp \
-        storage/LocalStorageTask.cpp \
-        storage/LocalStorageThread.cpp \
         storage/OriginQuotaManager.cpp \
         storage/OriginUsageRecord.cpp \
-        storage/StorageArea.cpp \
-        storage/StorageMap.cpp \
         storage/SQLResultSet.cpp \
         storage/SQLResultSetRowList.cpp \
         storage/SQLStatement.cpp \
@@ -1300,7 +1343,13 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/SessionStorageArea.h
 
     SOURCES += \
+        storage/LocalStorage.cpp \
+        storage/LocalStorageArea.cpp \
+        storage/LocalStorageTask.cpp \
+        storage/LocalStorageThread.cpp \
         storage/Storage.cpp \
+        storage/StorageArea.cpp \
+        storage/StorageMap.cpp \
         storage/StorageEvent.cpp \
         storage/SessionStorage.cpp \
         storage/SessionStorageArea.cpp \
@@ -1321,17 +1370,37 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
         loader/icon/IconDatabaseNone.cpp
 }
 
+contains(DEFINES, ENABLE_WORKERS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
+
+    IDL_BINDINGS += \
+        page/WorkerNavigator.idl \
+        workers/Worker.idl \
+        workers/WorkerContext.idl \
+        workers/WorkerLocation.idl
+
+    SOURCES += \
+        bindings/js/JSWorkerConstructor.cpp \
+        bindings/js/JSWorkerContextBase.cpp \
+        bindings/js/JSWorkerContextCustom.cpp \
+        bindings/js/JSWorkerCustom.cpp \
+        bindings/js/WorkerScriptController.cpp \
+        loader/WorkerThreadableLoader.cpp \
+        page/WorkerNavigator.cpp \
+        workers/Worker.cpp \
+        workers/WorkerContext.cpp \
+        workers/WorkerLocation.cpp \
+        workers/WorkerMessagingProxy.cpp \
+        workers/WorkerRunLoop.cpp \
+        workers/WorkerThread.cpp \
+        workers/WorkerImportScriptsClient.cpp
+}
+
 contains(DEFINES, ENABLE_VIDEO=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
 
     IDL_BINDINGS += \
-        html/HTMLAudioElement.idl \
-        html/HTMLMediaElement.idl \
-        html/HTMLSourceElement.idl \
-        html/HTMLVideoElement.idl \
-        html/MediaError.idl \
-        html/TimeRanges.idl \
-        html/VoidCallback.idl 
+        html/TimeRanges.idl
 
     SOURCES += \
         html/HTMLAudioElement.cpp \
@@ -1375,6 +1444,24 @@ contains(DEFINES, ENABLE_XPATH=1) {
         xml/XPathExpression.idl \
         xml/XPathResult.idl \
         xml/XPathEvaluator.idl
+
+    SOURCES += \
+        xml/NativeXPathNSResolver.cpp \
+        xml/XPathEvaluator.cpp \
+        xml/XPathExpression.cpp \
+        xml/XPathExpressionNode.cpp \
+        xml/XPathFunctions.cpp \
+        xml/XPathNamespace.cpp \
+        xml/XPathNodeSet.cpp \
+        xml/XPathNSResolver.cpp \
+        xml/XPathParser.cpp \
+        xml/XPathPath.cpp \
+        xml/XPathPredicate.cpp \
+        xml/XPathResult.cpp \
+        xml/XPathStep.cpp \
+        xml/XPathUtil.cpp \
+        xml/XPathValue.cpp \
+        xml/XPathVariableReference.cpp
 }
 
 unix:!mac:CONFIG += link_pkgconfig
@@ -1391,12 +1478,37 @@ contains(DEFINES, ENABLE_XSLT=1) {
     win32-msvc* {
         LIBS += -llibxml2 -llibxslt
     }
+
+    IDL_BINDINGS += \
+        xml/XSLTProcessor.idl
+
+    SOURCES += \
+        bindings/js/JSXSLTProcessorConstructor.cpp \
+        bindings/js/JSXSLTProcessorCustom.cpp \
+        xml/XSLImportRule.cpp \
+        xml/XSLStyleSheet.cpp \
+        xml/XSLTExtensions.cpp \
+        xml/XSLTProcessor.cpp \
+        xml/XSLTUnicodeSort.cpp
 }
 
 contains(DEFINES, ENABLE_XBL=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
 }
 
+contains(DEFINES, ENABLE_FILTERS=1) {
+    SOURCES += \
+        platform/graphics/filters/FEBlend.cpp \
+        platform/graphics/filters/FEColorMatrix.cpp \
+        platform/graphics/filters/FEComponentTransfer.cpp \
+        platform/graphics/filters/FEComposite.cpp \
+        platform/graphics/filters/FilterEffect.cpp \
+        platform/graphics/filters/SourceAlpha.cpp \
+        platform/graphics/filters/SourceGraphic.cpp
+
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
+}
+
 contains(DEFINES, ENABLE_WML=1) {
     SOURCES += \
         wml/WMLAElement.cpp \
@@ -1409,10 +1521,12 @@ contains(DEFINES, ENABLE_WML=1) {
         wml/WMLElement.cpp \
         wml/WMLErrorHandling.cpp \
         wml/WMLEventHandlingElement.cpp \
+        wml/WMLFormControlElement.cpp \
         wml/WMLFieldSetElement.cpp \
         wml/WMLGoElement.cpp \
         wml/WMLImageElement.cpp \
         wml/WMLImageLoader.cpp \
+        wml/WMLInputElement.cpp \
         wml/WMLInsertedLegendElement.cpp \
         wml/WMLIntrinsicEvent.cpp \
         wml/WMLIntrinsicEventHandler.cpp \
@@ -1420,10 +1534,13 @@ contains(DEFINES, ENABLE_WML=1) {
         wml/WMLNoopElement.cpp \
         wml/WMLOnEventElement.cpp \
         wml/WMLPElement.cpp \
+        wml/WMLOptGroupElement.cpp \
+        wml/WMLOptionElement.cpp \
         wml/WMLPageState.cpp \
         wml/WMLPostfieldElement.cpp \
         wml/WMLPrevElement.cpp \
         wml/WMLRefreshElement.cpp \
+        wml/WMLSelectElement.cpp \
         wml/WMLSetvarElement.cpp \
         wml/WMLTableElement.cpp \
         wml/WMLTaskElement.cpp \
@@ -1435,22 +1552,26 @@ contains(DEFINES, ENABLE_WML=1) {
 
     WML_NAMES = $$PWD/wml/WMLTagNames.in
 
-    wmlnames_a.output = $$GENERATED_SOURCES_DIR/WMLNames.cpp
+    wmlnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
     wmlnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
     wmlnames_a.input = WML_NAMES
     wmlnames_a.dependency_type = TYPE_C
     wmlnames_a.CONFIG = target_predeps
     wmlnames_a.variable_out = GENERATED_SOURCES
     addExtraCompilerWithHeader(wmlnames_a)
-    wmlnames_b.output = $$GENERATED_SOURCES_DIR/WMLElementFactory.cpp
+    wmlnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLElementFactory.cpp
     wmlnames_b.commands = @echo -n ''
     wmlnames_b.input = SVG_NAMES
-    wmlnames_b.depends = $$GENERATED_SOURCES_DIR/WMLNames.cpp
+    wmlnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
     wmlnames_b.CONFIG = target_predeps
     wmlnames_b.variable_out = GENERATED_SOURCES
     addExtraCompilerWithHeader(wmlnames_b)
 }
 
+contains(DEFINES, ENABLE_XHTMLMP=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+}
+
 contains(DEFINES, ENABLE_SVG=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
 
@@ -1609,7 +1730,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/style/SVGRenderStyleDefs.cpp \
         svg/SVGZoomEvent.cpp \
         rendering/PointerEventsHitRules.cpp \
-        svg/FilterEffect.cpp \
         svg/SVGDocumentExtensions.cpp \
         svg/SVGImageLoader.cpp \
         svg/ColorDistance.cpp \
@@ -1743,10 +1863,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
-        platform/graphics/filters/FEBlend.cpp \
-        platform/graphics/filters/FEColorMatrix.cpp \
-        platform/graphics/filters/FEComponentTransfer.cpp \
-        platform/graphics/filters/FEComposite.cpp \
         svg/graphics/filters/SVGFEConvolveMatrix.cpp \
         svg/graphics/filters/SVGFEDiffuseLighting.cpp \
         svg/graphics/filters/SVGFEDisplacementMap.cpp \
@@ -1759,7 +1875,8 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/filters/SVGFESpecularLighting.cpp \
         svg/graphics/filters/SVGFETile.cpp \
         svg/graphics/filters/SVGFETurbulence.cpp \
-        svg/graphics/filters/SVGFilterEffect.cpp \
+        svg/graphics/filters/SVGFilter.cpp \
+        svg/graphics/filters/SVGFilterBuilder.cpp \
         svg/graphics/filters/SVGLightSource.cpp \
         svg/graphics/SVGImage.cpp \
         svg/graphics/SVGPaintServer.cpp \
@@ -1782,6 +1899,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/RenderSVGImage.cpp \
         rendering/RenderSVGInline.cpp \
         rendering/RenderSVGInlineText.cpp \
+        rendering/RenderSVGModelObject.cpp \
         rendering/RenderSVGRoot.cpp \
         rendering/RenderSVGText.cpp \
         rendering/RenderSVGTextPath.cpp \
@@ -1794,46 +1912,39 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/SVGRenderSupport.cpp \
         rendering/SVGRootInlineBox.cpp
 
-SOURCES += \
-        svg/graphics/qt/RenderPathQt.cpp \
-        svg/graphics/qt/SVGPaintServerPatternQt.cpp \
-        svg/graphics/qt/SVGPaintServerQt.cpp \
-        svg/graphics/qt/SVGResourceFilterQt.cpp \
-        svg/graphics/qt/SVGResourceMaskerQt.cpp
-
 
         # GENERATOR 5-C:
-        svgnames_a.output = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
         svgnames_a.input = SVG_NAMES
         svgnames_a.dependency_type = TYPE_C
         svgnames_a.CONFIG = target_predeps
         svgnames_a.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(svgnames_a)
-        svgnames_b.output = $$GENERATED_SOURCES_DIR/SVGElementFactory.cpp
+        svgnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGElementFactory.cpp
         svgnames_b.commands = @echo -n ''
         svgnames_b.input = SVG_NAMES
-        svgnames_b.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgnames_b.CONFIG = target_predeps
         svgnames_b.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(svgnames_b)
-        svgelementwrapper.output = $$GENERATED_SOURCES_DIR/JSSVGElementWrapperFactory.cpp
+        svgelementwrapper.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.cpp
         svgelementwrapper.commands = @echo -n ''
         svgelementwrapper.input = SVG_NAMES
-        svgelementwrapper.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgelementwrapper.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgelementwrapper.CONFIG = target_predeps
         svgelementwrapper.variable_out = GENERATED_SOURCES
         addExtraCompiler(svgelementwrapper)
-        svgelementwrapper_header.output = $$GENERATED_SOURCES_DIR/JSSVGElementWrapperFactory.h
+        svgelementwrapper_header.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.h
         svgelementwrapper_header.commands = @echo -n ''
         svgelementwrapper_header.input = SVG_NAMES
-        svgelementwrapper_header.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgelementwrapper_header.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgelementwrapper_header.CONFIG = target_predeps
         svgelementwrapper_header.variable_out = GENERATED_FILES
         addExtraCompiler(svgelementwrapper_header)
 
         # GENERATOR 5-D:
-        xlinknames.output = $$GENERATED_SOURCES_DIR/XLinkNames.cpp
+        xlinknames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XLinkNames.cpp
         xlinknames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
         xlinknames.input = XLINK_NAMES
         xlinknames.dependency_type = TYPE_C
@@ -1842,38 +1953,52 @@ SOURCES += \
         addExtraCompilerWithHeader(xlinknames)
 
     # GENERATOR 6-A:
-    cssprops.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
     cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
     cssprops.CONFIG = target_predeps no_link
     cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES SVGCSSPROPERTIES
     addExtraCompilerWithHeader(cssprops)
 
     # GENERATOR 6-B:
-    cssvalues.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.c
+    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
     cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
     cssvalues.CONFIG = target_predeps no_link
     cssvalues.depend = ${QMAKE_FILE_NAME} SVGCSSVALUES
     addExtraCompilerWithHeader(cssvalues)
 } else {
     # GENERATOR 6-A:
-    cssprops.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
     cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
     cssprops.CONFIG = target_predeps no_link
     cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES
     addExtraCompilerWithHeader(cssprops)
 
     # GENERATOR 6-B:
-    cssvalues.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.c
+    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
     cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = $(COPY_FILE) ${QMAKE_FILE_NAME} $$GENERATED_SOURCES_DIR && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
     cssvalues.CONFIG = target_predeps no_link
     cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
     addExtraCompiler(cssvalues)
 }
 
+contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
+
+    IDL_BINDINGS += \
+        inspector/JavaScriptCallFrame.idl
+
+    SOURCES += \
+        bindings/js/JSJavaScriptCallFrameCustom.cpp \
+        inspector/JavaScriptCallFrame.cpp \
+        inspector/JavaScriptDebugServer.cpp \
+        inspector/JavaScriptProfile.cpp \
+        inspector/JavaScriptProfileNode.cpp
+}
+
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 
@@ -1891,7 +2016,7 @@ SOURCES += \
 }
 
 # GENERATOR 1: IDL compiler
-idl.output = $$GENERATED_SOURCES_DIR/JS${QMAKE_FILE_BASE}.cpp
+idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
 idl.variable_out = GENERATED_SOURCES
 idl.input = IDL_BINDINGS
 idl.commands = perl -I$$PWD/bindings/scripts $$PWD/bindings/scripts/generate-bindings.pl --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
@@ -1899,7 +2024,7 @@ idl.CONFIG += target_predeps
 addExtraCompilerWithHeader(idl)
 
 # GENERATOR 2-A: LUT creator
-domlut.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.lut.h
+domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
 domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
 domlut.depend = ${QMAKE_FILE_NAME}
 domlut.input = DOMLUT_FILES
@@ -1907,7 +2032,7 @@ domlut.CONFIG += no_link
 addExtraCompiler(domlut)
 
 # GENERATOR 3: tokenizer (flex)
-tokenizer.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
 tokenizer.dependency_type = TYPE_C
 tokenizer.input = TOKENIZER
@@ -1915,8 +2040,8 @@ tokenizer.CONFIG += target_predeps no_link
 addExtraCompiler(tokenizer)
 
 # GENERATOR 4: CSS grammar
-cssbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}
+cssbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}
 cssbison.depend = ${QMAKE_FILE_NAME}
 cssbison.input = CSSBISON
 cssbison.CONFIG = target_predeps
@@ -1925,25 +2050,34 @@ cssbison.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(cssbison)
 
 # GENERATOR 5-A:
-htmlnames.output = $$GENERATED_SOURCES_DIR/HTMLNames.cpp
-htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
+htmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
+htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
 htmlnames.input = HTML_NAMES
 htmlnames.dependency_type = TYPE_C
 htmlnames.CONFIG = target_predeps
 htmlnames.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(htmlnames)
 
-elementwrapperfactory.output = $$GENERATED_SOURCES_DIR/JSHTMLElementWrapperFactory.cpp
+htmlelementfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLElementFactory.cpp
+htmlelementfactory.commands = @echo -n ''
+htmlelementfactory.input = HTML_NAMES
+htmlelementfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
+htmlelementfactory.CONFIG = target_predeps
+htmlelementfactory.variable_out = GENERATED_SOURCES
+htmlelementfactory.clean += ${QMAKE_FILE_OUT}
+addExtraCompilerWithHeader(htmlelementfactory)
+
+elementwrapperfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSHTMLElementWrapperFactory.cpp
 elementwrapperfactory.commands = @echo -n ''
 elementwrapperfactory.input = HTML_NAMES
-elementwrapperfactory.depends = $$GENERATED_SOURCES_DIR/HTMLNames.cpp
+elementwrapperfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
 elementwrapperfactory.CONFIG = target_predeps
 elementwrapperfactory.variable_out = GENERATED_SOURCES
 elementwrapperfactory.clean += ${QMAKE_FILE_OUT}
 addExtraCompilerWithHeader(elementwrapperfactory)
 
 # GENERATOR 5-B:
-xmlnames.output = $$GENERATED_SOURCES_DIR/XMLNames.cpp
+xmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XMLNames.cpp
 xmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
 xmlnames.input = XML_NAMES
 xmlnames.dependency_type = TYPE_C
@@ -1952,8 +2086,8 @@ xmlnames.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(xmlnames)
 
 # GENERATOR 8-A:
-entities.output = $$GENERATED_SOURCES_DIR/HTMLEntityNames.c
-entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $$GENERATED_SOURCES_DIR/HTMLEntityNames.c
+entities.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
+entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
 entities.input = ENTITIES_GPERF
 entities.dependency_type = TYPE_C
 entities.CONFIG = target_predeps no_link
@@ -1961,7 +2095,7 @@ entities.clean = ${QMAKE_FILE_OUT}
 addExtraCompiler(entities)
 
 # GENERATOR 8-B:
-doctypestrings.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+doctypestrings.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 doctypestrings.input = DOCTYPESTRINGS
 doctypestrings.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CEot -L ANSI-C --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 doctypestrings.dependency_type = TYPE_C
@@ -1970,14 +2104,14 @@ doctypestrings.clean = ${QMAKE_FILE_OUT}
 addExtraCompiler(doctypestrings)
 
 # GENERATOR 8-C:
-colordata.output = $$GENERATED_SOURCES_DIR/ColorData.c
+colordata.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}ColorData.c
 colordata.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CDEot -L ANSI-C --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 colordata.input = COLORDAT_GPERF
 colordata.CONFIG = target_predeps no_link
 addExtraCompiler(colordata)
 
 # GENERATOR 9:
-stylesheets.output = $$GENERATED_SOURCES_DIR/UserAgentStyleSheetsData.cpp
+stylesheets.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheetsData.cpp
 stylesheets.commands = perl $$PWD/css/make-css-file-arrays.pl --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
 STYLESHEETS_EMBED_GENERATOR_SCRIPT = $$PWD/css/make-css-file-arrays.pl
 stylesheets.input = STYLESHEETS_EMBED_GENERATOR_SCRIPT
@@ -1985,11 +2119,11 @@ stylesheets.depends = $$STYLESHEETS_EMBED
 stylesheets.CONFIG = target_predeps
 stylesheets.variable_out = GENERATED_SOURCES
 stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h
-addExtraCompilerWithHeader(stylesheets, $$GENERATED_SOURCES_DIR/UserAgentStyleSheets.h)
+addExtraCompilerWithHeader(stylesheets, $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheets.h)
 
 # GENERATOR 10: XPATH grammar
-xpathbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o ${QMAKE_FILE_BASE}.tab.c && $(MOVE) ${QMAKE_FILE_BASE}.tab.c $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp && $(MOVE) ${QMAKE_FILE_BASE}.tab.h $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.h
+xpathbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
 xpathbison.depend = ${QMAKE_FILE_NAME}
 xpathbison.input = XPATHBISON
 xpathbison.CONFIG = target_predeps
@@ -2028,6 +2162,23 @@ HEADERS += $$WEBKIT_API_HEADERS
         lib_replace.replace = $$[QT_INSTALL_LIBS]
         QMAKE_PKGCONFIG_INSTALL_REPLACE += lib_replace
     }
+
+    mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+        !build_pass {
+            message("Building QtWebKit as a framework, as that's how Qt was built. You can")
+            message("override this by passing CONFIG+=webkit_no_framework to build-webkit.")
+        } else {
+            debug_and_release:CONFIG(debug, debug|release) {
+                TARGET = $$qtLibraryTarget($$TARGET)
+            }
+        }
+
+        CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
+        FRAMEWORK_HEADERS.version = Versions
+        FRAMEWORK_HEADERS.files = $$WEBKIT_API_HEADERS
+        FRAMEWORK_HEADERS.path = Headers
+        QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
+    }
 }
 
 CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4) {
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.h b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
index aaa6a0f4ff..e857ecc822 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.h
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
@@ -100,16 +100,6 @@
 #include <CoreFoundation/CoreFoundation.h>
 #include <CoreServices/CoreServices.h>
 
-#include <AvailabilityMacros.h>
-
-#if defined(__APPLE__)
-#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_4
-#define BUILDING_ON_TIGER 1
-#elif MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_5
-#define BUILDING_ON_LEOPARD 1
-#endif
-#endif
-
 #ifdef __OBJC__
 #import <Cocoa/Cocoa.h>
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/AXObjectCache.cpp b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
index d9c4c9abdc..ec250edc74 100644
--- a/src/3rdparty/webkit/WebCore/page/AXObjectCache.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
@@ -29,6 +29,9 @@
 #include "config.h"
 #include "AXObjectCache.h"
 
+#include "AccessibilityARIAGrid.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityARIAGridCell.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
@@ -41,6 +44,7 @@
 #include "AccessibilityTableRow.h"
 #include "HTMLNames.h"
 #include "RenderObject.h"
+#include "RenderView.h"
 
 #include <wtf/PassRefPtr.h>
 
@@ -51,6 +55,11 @@ using namespace HTMLNames;
 bool AXObjectCache::gAccessibilityEnabled = false;
 bool AXObjectCache::gAccessibilityEnhancedUserInterfaceEnabled = false;
 
+AXObjectCache::AXObjectCache()
+    : m_notificationPostTimer(this, &AXObjectCache::notificationPostTimerFired)
+{
+}
+
 AXObjectCache::~AXObjectCache()
 {
     HashMap<AXID, RefPtr<AccessibilityObject> >::iterator end = m_objects.end();
@@ -58,6 +67,7 @@ AXObjectCache::~AXObjectCache()
         AccessibilityObject* obj = (*it).second.get();
         detachWrapper(obj);
         obj->detach();
+        removeAXID(obj);
     }
 }
 
@@ -66,39 +76,71 @@ AccessibilityObject* AXObjectCache::get(RenderObject* renderer)
     if (!renderer)
         return 0;
     
-    RefPtr<AccessibilityObject> obj = 0;
+    AccessibilityObject* obj = 0;
     AXID axID = m_renderObjectMapping.get(renderer);
     ASSERT(!HashTraits<AXID>::isDeletedValue(axID));
 
     if (axID)
         obj = m_objects.get(axID).get();
+    
+    return obj;
+}
+    
+bool AXObjectCache::nodeIsAriaType(Node* node, String role)
+{
+    if (!node || !node->isElementNode())
+        return false;
+    
+    return equalIgnoringCase(static_cast<Element*>(node)->getAttribute(roleAttr), role);
+}
+
+AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
+{
+    if (!renderer)
+        return 0;
+    
+    AccessibilityObject* obj = get(renderer);
 
-    Node* element = renderer->element();
     if (!obj) {
+        Node* node = renderer->node();
+        RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
-            obj = AccessibilityListBox::create(renderer);
-        else if (element && (element->hasTagName(ulTag) || element->hasTagName(olTag) || element->hasTagName(dlTag)))
-            obj = AccessibilityList::create(renderer);
+            newObj = AccessibilityListBox::create(renderer);
+        else if (node && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+            newObj = AccessibilityList::create(renderer);
+        
+        // aria tables
+        else if (nodeIsAriaType(node, "grid"))
+            newObj = AccessibilityARIAGrid::create(renderer);
+        else if (nodeIsAriaType(node, "row"))
+            newObj = AccessibilityARIAGridRow::create(renderer);
+        else if (nodeIsAriaType(node, "gridcell") || nodeIsAriaType(node, "columnheader") || nodeIsAriaType(node, "rowheader"))
+            newObj = AccessibilityARIAGridCell::create(renderer);
+
+        // standard tables
         else if (renderer->isTable())
-            obj = AccessibilityTable::create(renderer);
+            newObj = AccessibilityTable::create(renderer);
         else if (renderer->isTableRow())
-            obj = AccessibilityTableRow::create(renderer);
+            newObj = AccessibilityTableRow::create(renderer);
         else if (renderer->isTableCell())
-            obj = AccessibilityTableCell::create(renderer);
+            newObj = AccessibilityTableCell::create(renderer);
+
         else
-            obj = AccessibilityRenderObject::create(renderer);
+            newObj = AccessibilityRenderObject::create(renderer);
         
-        getAXID(obj.get());
+        obj = newObj.get();
         
-        m_renderObjectMapping.set(renderer, obj.get()->axObjectID());
-        m_objects.set(obj.get()->axObjectID(), obj);    
-        attachWrapper(obj.get());
+        getAXID(obj);
+        
+        m_renderObjectMapping.set(renderer, obj->axObjectID());
+        m_objects.set(obj->axObjectID(), obj);    
+        attachWrapper(obj);
     }
     
-    return obj.get();
+    return obj;
 }
 
-AccessibilityObject* AXObjectCache::get(AccessibilityRole role)
+AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
 {
     RefPtr<AccessibilityObject> obj = 0;
     
@@ -186,6 +228,9 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
 
 void AXObjectCache::removeAXID(AccessibilityObject* obj)
 {
+    if (!obj)
+        return;
+    
     AXID objID = obj->axObjectID();
     if (objID == 0)
         return;
@@ -208,11 +253,68 @@ void AXObjectCache::childrenChanged(RenderObject* renderer)
     if (obj)
         obj->childrenChanged();
 }
+    
+void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
+{
+    m_notificationPostTimer.stop();
 
+    unsigned i = 0, count = m_notificationsToPost.size();
+    for (i = 0; i < count; ++i) {
+        AccessibilityObject* obj = m_notificationsToPost[i].first;
+#ifndef NDEBUG
+        // Make sure none of the render views are in the process of being layed out.
+        // Notifications should only be sent after the renderer has finished
+        if (obj->isAccessibilityRenderObject()) {
+            AccessibilityRenderObject* renderObj = static_cast<AccessibilityRenderObject*>(obj);
+            RenderObject* renderer = renderObj->renderer();
+            if (renderer && renderer->view())
+                ASSERT(!renderer->view()->layoutState());
+        }
+#endif
+        
+        postPlatformNotification(obj, m_notificationsToPost[i].second);
+    }
+    
+    m_notificationsToPost.clear();
+}
+    
 #if HAVE(ACCESSIBILITY)
+void AXObjectCache::postNotification(RenderObject* renderer, const String& message, bool postToElement)
+{
+    // Notifications for text input objects are sent to that object.
+    // All others are sent to the top WebArea.
+    if (!renderer)
+        return;
+    
+    // Get an accessibility object that already exists. One should not be created here
+    // because a render update may be in progress and creating an AX object can re-trigger a layout
+    RefPtr<AccessibilityObject> obj = get(renderer);
+    while (!obj && renderer) {
+        renderer = renderer->parent();
+        obj = get(renderer); 
+    }
+    
+    if (!renderer)
+        return;
+
+    if (obj && !postToElement)
+        obj = obj->observableObject();
+    
+    Document* document = renderer->document();
+    if (!obj && document)
+        obj = get(document->renderer());
+    
+    if (!obj)
+        return;
+
+    m_notificationsToPost.append(make_pair(obj.get(), message));
+    if (!m_notificationPostTimer.isActive())
+        m_notificationPostTimer.startOneShot(0);
+}
+
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
 {
-    postNotificationToElement(renderer, "AXSelectedChildrenChanged");
+    postNotification(renderer, "AXSelectedChildrenChanged", true);
 }
 #endif
 
@@ -221,7 +323,7 @@ void AXObjectCache::handleActiveDescendantChanged(RenderObject* renderer)
 {
     if (!renderer)
         return;
-    AccessibilityObject* obj = get(renderer);
+    AccessibilityObject* obj = getOrCreate(renderer);
     if (obj)
         obj->handleActiveDescendantChanged();
 }
@@ -230,7 +332,7 @@ void AXObjectCache::handleAriaRoleChanged(RenderObject* renderer)
 {
     if (!renderer)
         return;
-    AccessibilityObject* obj = get(renderer);
+    AccessibilityObject* obj = getOrCreate(renderer);
     if (obj && obj->isAccessibilityRenderObject())
         static_cast<AccessibilityRenderObject*>(obj)->setAriaRole();
 }
diff --git a/src/3rdparty/webkit/WebCore/page/AXObjectCache.h b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
index 5e95f74bad..904283cf85 100644
--- a/src/3rdparty/webkit/WebCore/page/AXObjectCache.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
@@ -27,6 +27,8 @@
 #define AXObjectCache_h
 
 #include "AccessibilityObject.h"
+#include "EventHandler.h"
+#include "Timer.h"
 #include <limits.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -57,26 +59,33 @@ namespace WebCore {
 
     class AXObjectCache {
     public:
+        AXObjectCache();
         ~AXObjectCache();
         
         // to be used with render objects
-        AccessibilityObject* get(RenderObject*);
+        AccessibilityObject* getOrCreate(RenderObject*);
         
         // used for objects without backing elements
-        AccessibilityObject* get(AccessibilityRole);
+        AccessibilityObject* getOrCreate(AccessibilityRole);
+        
+        // will only return the AccessibilityObject if it already exists
+        AccessibilityObject* get(RenderObject*);
         
         void remove(RenderObject*);
         void remove(AXID);
 
         void detachWrapper(AccessibilityObject*);
         void attachWrapper(AccessibilityObject*);
-        void postNotification(RenderObject*, const String&);
-        void postNotificationToElement(RenderObject*, const String&);
+        void postNotification(RenderObject*, const String&, bool postToElement);
+        void postPlatformNotification(AccessibilityObject*, const String&);
         void childrenChanged(RenderObject*);
         void selectedChildrenChanged(RenderObject*);
         void handleActiveDescendantChanged(RenderObject*);
         void handleAriaRoleChanged(RenderObject*);
         void handleFocusedUIElementChanged();
+#if PLATFORM(GTK)
+        void handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*);
+#endif
         static void enableAccessibility() { gAccessibilityEnabled = true; }
         static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
         
@@ -94,7 +103,12 @@ namespace WebCore {
         
         HashSet<AXID> m_idsInUse;
         
+        Timer<AXObjectCache> m_notificationPostTimer;
+        Vector<pair<AccessibilityObject*, const String> > m_notificationsToPost;
+        void notificationPostTimerFired(Timer<AXObjectCache>*);
+        
         AXID getAXID(AccessibilityObject*);
+        bool nodeIsAriaType(Node* node, String role);
     };
 
 #if !HAVE(ACCESSIBILITY)
@@ -104,8 +118,11 @@ namespace WebCore {
     inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, const String&) { }
-    inline void AXObjectCache::postNotificationToElement(RenderObject*, const String&) { }
+    inline void AXObjectCache::postNotification(RenderObject*, const String&, bool postToElement) { }
+    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&) { }
+#if PLATFORM(GTK)
+    inline void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*) { }
+#endif
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
new file mode 100644
index 0000000000..69c4512695
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGrid.h"
+
+#include "AccessibilityTableCell.h"
+#include "AccessibilityTableColumn.h"
+#include "AccessibilityTableHeaderContainer.h"
+#include "AccessibilityTableRow.h"
+#include "AXObjectCache.h"
+#include "RenderObject.h"
+
+using namespace std;
+
+namespace WebCore {
+
+AccessibilityARIAGrid::AccessibilityARIAGrid(RenderObject* renderer)
+    : AccessibilityTable(renderer)
+{
+#if ACCESSIBILITY_TABLES
+    m_isAccessibilityTable = true;
+#else
+    m_isAccessibilityTable = false;
+#endif
+}
+
+AccessibilityARIAGrid::~AccessibilityARIAGrid()
+{
+}
+
+PassRefPtr<AccessibilityARIAGrid> AccessibilityARIAGrid::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGrid(renderer));
+}
+
+void AccessibilityARIAGrid::addChild(AccessibilityObject* child, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount)
+{
+    if (!child || !child->isTableRow() || child->ariaRoleAttribute() != RowRole)
+        return;
+        
+    AccessibilityTableRow* row = static_cast<AccessibilityTableRow*>(child);
+    if (appendedRows.contains(row))
+        return;
+        
+    // store the maximum number of columns
+    unsigned rowCellCount = row->children().size();
+    if (rowCellCount > columnCount)
+        columnCount = rowCellCount;
+    
+    row->setRowIndex((int)m_rows.size());        
+    m_rows.append(row);
+    m_children.append(row);
+    appendedRows.add(row);
+}
+    
+void AccessibilityARIAGrid::addChildren()
+{
+    ASSERT(!m_haveChildren); 
+    
+    if (!isDataTable()) {
+        AccessibilityRenderObject::addChildren();
+        return;
+    }
+    
+    m_haveChildren = true;
+    if (!m_renderer)
+        return;
+    
+    AXObjectCache* axCache = m_renderer->document()->axObjectCache();
+    
+    // add only rows that are labeled as aria rows
+    HashSet<AccessibilityObject*> appendedRows;
+    unsigned columnCount = 0;
+    for (RefPtr<AccessibilityObject> child = firstChild(); child; child = child->nextSibling()) {
+
+        // in case the render tree doesn't match the expected ARIA hierarchy, look at the children
+        if (child->accessibilityIsIgnored()) {
+            if (!child->hasChildren())
+                child->addChildren();
+            
+            AccessibilityChildrenVector children = child->children();
+            unsigned length = children.size();
+            for (unsigned i = 0; i < length; ++i)
+                addChild(children[i].get(), appendedRows, columnCount);
+        } else
+            addChild(child.get(), appendedRows, columnCount);            
+    }
+    
+    // make the columns based on the number of columns in the first body
+    for (unsigned i = 0; i < columnCount; ++i) {
+        AccessibilityTableColumn* column = static_cast<AccessibilityTableColumn*>(axCache->getOrCreate(ColumnRole));
+        column->setColumnIndex((int)i);
+        column->setParentTable(this);
+        m_columns.append(column);
+        m_children.append(column);
+    }
+    
+    AccessibilityObject* headerContainerObject = headerContainer();
+    if (headerContainerObject)
+        m_children.append(headerContainerObject);
+}
+    
+AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned column, unsigned row)
+{
+    if (!m_renderer)
+        return 0;
+    
+    if (!hasChildren())
+        addChildren();
+    
+    if (column >= columnCount() || row >= rowCount())
+        return 0;
+    
+    AccessibilityObject *tableRow = m_rows[row].get();
+    if (!tableRow)
+        return 0;
+    
+    AccessibilityChildrenVector children = tableRow->children();
+    // in case this row had fewer columns than other rows
+    AccessibilityObject* tableCell = 0;
+    if (column >= children.size())
+        return 0;
+
+    tableCell = children[column].get();
+    return static_cast<AccessibilityTableCell*>(tableCell);
+}
+    
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
new file mode 100644
index 0000000000..32c8ce9e9b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilityARIAGrid_h
+#define AccessibilityARIAGrid_h
+
+#include "AccessibilityTable.h"
+
+namespace WebCore {
+    
+class String;
+class AccessibilityTableCell;
+class AccessibilityTableHeaderContainer;
+
+class AccessibilityARIAGrid : public AccessibilityTable {
+    
+private:
+    AccessibilityARIAGrid(RenderObject*);
+public:
+    static PassRefPtr<AccessibilityARIAGrid> create(RenderObject*);
+    virtual ~AccessibilityARIAGrid();
+    
+    virtual bool isAriaTable() const { return true; }    
+    
+    virtual void addChildren();
+    
+    virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
+
+private:
+    void addChild(AccessibilityObject* object, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount);
+};
+
+} // namespace WebCore 
+
+#endif // AccessibilityARIAGrid_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.cpp
new file mode 100644
index 0000000000..1771bb87dc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGridCell.h"
+
+#include "AccessibilityObject.h"
+#include "AccessibilityTableRow.h"
+
+using namespace std;
+
+namespace WebCore {
+    
+AccessibilityARIAGridCell::AccessibilityARIAGridCell(RenderObject* renderer)
+    : AccessibilityTableCell(renderer)
+{
+}
+
+AccessibilityARIAGridCell::~AccessibilityARIAGridCell()
+{
+}
+
+PassRefPtr<AccessibilityARIAGridCell> AccessibilityARIAGridCell::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGridCell(renderer));
+}
+
+AccessibilityObject* AccessibilityARIAGridCell::parentTable() const
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return 0;
+    
+    parent = parent->parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return 0;
+    
+    return parent;
+}
+    
+void AccessibilityARIAGridCell::rowIndexRange(pair<int, int>& rowRange)
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return;
+
+    // as far as I can tell, grid cells cannot span rows
+    rowRange.first = static_cast<AccessibilityTableRow*>(parent)->rowIndex();
+    rowRange.second = 1;    
+}
+
+void AccessibilityARIAGridCell::columnIndexRange(pair<int, int>& columnRange)
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return;
+    
+    AccessibilityChildrenVector siblings = parent->children();
+    unsigned childrenSize = siblings.size();
+    for (unsigned k = 0; k < childrenSize; ++k) {
+        if (siblings[k].get() == this) {
+            columnRange.first = k;
+            break;
+        }
+    }
+    
+    // as far as I can tell, grid cells cannot span columns
+    columnRange.second = 1;    
+}
+  
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.h
new file mode 100644
index 0000000000..2923de896d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilityARIAGridCell_h
+#define AccessibilityARIAGridCell_h
+
+#include "AccessibilityTableCell.h"
+
+namespace WebCore {
+    
+class AccessibilityARIAGridCell : public AccessibilityTableCell {
+    
+private:
+    AccessibilityARIAGridCell(RenderObject*);
+public:
+    static PassRefPtr<AccessibilityARIAGridCell> create(RenderObject*);
+    virtual ~AccessibilityARIAGridCell();
+    
+    // fills in the start location and row span of cell
+    virtual void rowIndexRange(pair<int, int>& rowRange);
+    // fills in the start location and column span of cell
+    virtual void columnIndexRange(pair<int, int>& columnRange);
+    
+protected:
+    virtual AccessibilityObject* parentTable() const;
+}; 
+    
+} // namespace WebCore 
+
+#endif // AccessibilityARIAGridCell_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
new file mode 100644
index 0000000000..6e1f1c8122
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGridRow.h"
+
+#include "AccessibilityObject.h"
+#include "RenderObject.h"
+
+using namespace std;
+
+namespace WebCore {
+    
+AccessibilityARIAGridRow::AccessibilityARIAGridRow(RenderObject* renderer)
+    : AccessibilityTableRow(renderer)
+{
+}
+
+AccessibilityARIAGridRow::~AccessibilityARIAGridRow()
+{
+}
+
+PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGridRow(renderer));
+}
+
+AccessibilityObject* AccessibilityARIAGridRow::parentTable() const
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent->isDataTable())
+        return 0;
+    
+    return parent;
+}
+
+AccessibilityObject* AccessibilityARIAGridRow::headerObject()
+{
+    AccessibilityChildrenVector rowChildren = children();
+    unsigned childrenCount = rowChildren.size();
+    for (unsigned i = 0; i < childrenCount; ++i) {
+        AccessibilityObject* cell = rowChildren[i].get();
+        if (cell->ariaRoleAttribute() == RowHeaderRole)
+            return cell;
+    }
+    
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
new file mode 100644
index 0000000000..c2ca8b8e32
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilityARIAGridRow_h
+#define AccessibilityARIAGridRow_h
+
+#include "AccessibilityTableRow.h"
+
+namespace WebCore {
+    
+class AccessibilityARIAGridRow : public AccessibilityTableRow {
+    
+private:
+    AccessibilityARIAGridRow(RenderObject*);
+public:
+    static PassRefPtr<AccessibilityARIAGridRow> create(RenderObject*);
+    virtual ~AccessibilityARIAGridRow();
+    
+    virtual AccessibilityObject* headerObject();
+    virtual AccessibilityObject* parentTable() const;    
+}; 
+    
+} // namespace WebCore 
+
+#endif // AccessibilityARIAGridRow_h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 55574463df..943122e4b9 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -65,7 +65,7 @@ AccessibilityObject* AccessibilityImageMapLink::parentObject() const
     if (!m_mapElement || !m_mapElement->renderer())
         return 0;
     
-    return m_mapElement->document()->axObjectCache()->get(m_mapElement->renderer());
+    return m_mapElement->document()->axObjectCache()->getOrCreate(m_mapElement->renderer());
 }
     
 Element* AccessibilityImageMapLink::actionElement() const
@@ -78,6 +78,14 @@ Element* AccessibilityImageMapLink::anchorElement() const
     return m_areaElement;
 }
 
+KURL AccessibilityImageMapLink::url() const
+{
+    if (!m_areaElement)
+        return KURL();
+    
+    return m_areaElement->href();
+}
+    
 String AccessibilityImageMapLink::accessibilityDescription() const
 {
     if (!m_areaElement)
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
index 7fc8d3c862..2c27e4609a 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -49,11 +49,12 @@ public:
         
     virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
     virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool isEnabled() const { return true; }
 
     virtual AccessibilityObject* parentObject() const;
     virtual Element* anchorElement() const;
     virtual Element* actionElement() const;
-    
+    virtual KURL url() const;
     virtual bool isLink() const { return true; } 
     virtual String title() const;
     virtual String accessibilityDescription() const;
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
index ad71ff4c04..3b7c7a46f3 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityList.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
@@ -56,10 +56,10 @@ PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 bool AccessibilityList::accessibilityIsIgnored() const
 {
     // lists don't appear on tiger/leopard on the mac
-#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
-    return true;
-#else
+#if ACCESSIBILITY_LISTS
     return false;
+#else
+    return true;
 #endif
 }    
     
@@ -68,8 +68,8 @@ bool AccessibilityList::isUnorderedList() const
     if (!m_renderer)
         return false;
     
-    Node* element = m_renderer->element();
-    return element && element->hasTagName(ulTag);
+    Node* node = m_renderer->node();
+    return node && node->hasTagName(ulTag);
 }
 
 bool AccessibilityList::isOrderedList() const
@@ -77,8 +77,8 @@ bool AccessibilityList::isOrderedList() const
     if (!m_renderer)
         return false;
     
-    Node* element = m_renderer->element();
-    return element && element->hasTagName(olTag);    
+    Node* node = m_renderer->node();
+    return node && node->hasTagName(olTag);    
 }
 
 bool AccessibilityList::isDefinitionList() const
@@ -86,8 +86,8 @@ bool AccessibilityList::isDefinitionList() const
     if (!m_renderer)
         return false;
     
-    Node* element = m_renderer->element();
-    return element && element->hasTagName(dlTag);    
+    Node* node = m_renderer->node();
+    return node && node->hasTagName(dlTag);    
 }
     
     
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
index 315ccac282..89befb24fd 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityList.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
@@ -29,6 +29,12 @@
 #ifndef AccessibilityList_h
 #define AccessibilityList_h
 
+#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
+#define ACCESSIBILITY_LISTS 0
+#else
+#define ACCESSIBILITY_LISTS 1
+#endif
+
 #include "AccessibilityRenderObject.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
index b94ccef93d..e38aff5d3a 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
@@ -74,10 +74,12 @@ void AccessibilityListBox::addChildren()
     
     m_haveChildren = true;
     
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
-        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(listItems[i]);
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
         if (listOption)
             m_children.append(listOption);
     }
@@ -144,7 +146,7 @@ AccessibilityObject* AccessibilityListBox::listBoxOptionAccessibilityObject(HTML
     if (!element || element->hasTagName(hrTag))
         return 0;
     
-    AccessibilityObject* listBoxObject = m_renderer->document()->axObjectCache()->get(ListBoxOptionRole);
+    AccessibilityObject* listBoxObject = m_renderer->document()->axObjectCache()->getOrCreate(ListBoxOptionRole);
     static_cast<AccessibilityListBoxOption*>(listBoxObject)->setHTMLElement(element);
     
     return listBoxObject;
@@ -157,21 +159,23 @@ AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint
     if (!m_renderer)
         return 0;
     
-    Node* element = m_renderer->element();
-    if (!element)
+    Node* node = m_renderer->node();
+    if (!node)
         return 0;
     
     IntRect parentRect = boundingBoxRect();
     
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(element)->listItems();
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
         IntRect rect = static_cast<RenderListBox*>(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
         if (rect.contains(point))
-            return listBoxOptionAccessibilityObject(listItems[i]);
+            return listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
     }
     
-    return axObjectCache()->get(m_renderer);
+    return axObjectCache()->getOrCreate(m_renderer);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
index 3f3352d9ad..3f3352d9ad 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
index fedfe915ad..a5cd5da61b 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -97,7 +97,7 @@ IntRect AccessibilityListBoxOption::elementRect() const
     if (!listBoxRenderer)
         return rect;
     
-    IntRect parentRect = listBoxRenderer->document()->axObjectCache()->get(listBoxRenderer)->boundingBoxRect();
+    IntRect parentRect = listBoxRenderer->document()->axObjectCache()->getOrCreate(listBoxRenderer)->boundingBoxRect();
     int index = listBoxOptionIndex();
     if (index != -1)
         rect = static_cast<RenderListBox*>(listBoxRenderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), index);
@@ -153,7 +153,7 @@ AccessibilityObject* AccessibilityListBoxOption::parentObject() const
     if (!parentNode)
         return 0;
     
-    return m_optionElement->document()->axObjectCache()->get(parentNode->renderer());
+    return m_optionElement->document()->axObjectCache()->getOrCreate(parentNode->renderer());
 }
 
 void AccessibilityListBoxOption::setSelected(bool selected)
@@ -195,7 +195,7 @@ int AccessibilityListBoxOption::listBoxOptionIndex() const
     if (!selectElement) 
         return -1;
     
-    const Vector<HTMLElement*>& listItems = selectElement->listItems();
+    const Vector<Element*>& listItems = selectElement->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++)
         if (listItems[i] == m_optionElement)
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
index 1b588cd457..1b588cd457 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index 0b072cf38a..dccff8220b 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -75,7 +75,6 @@ AccessibilityObject::~AccessibilityObject()
 
 void AccessibilityObject::detach()
 {
-    removeAXObjectID();
 #if HAVE(ACCESSIBILITY)
     setWrapper(0);
 #endif    
@@ -114,6 +113,11 @@ AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
     return parent;
 }
 
+AccessibilityObject* AccessibilityObject::parentObjectIfExists() const
+{
+    return 0;
+}
+    
 int AccessibilityObject::layoutCount() const
 {
     return 0;
@@ -231,9 +235,9 @@ const AtomicString& AccessibilityObject::accessKey() const
     return nullAtom;
 }
 
-Selection AccessibilityObject::selection() const
+VisibleSelection AccessibilityObject::selection() const
 {
-    return Selection();
+    return VisibleSelection();
 }
 
 PlainTextRange AccessibilityObject::selectedTextRange() const
@@ -357,7 +361,7 @@ VisiblePositionRange AccessibilityObject::visiblePositionRangeForUnorderedPositi
 
     // use selection order to see if the positions are in order
     else
-        alreadyInOrder = Selection(visiblePos1, visiblePos2).isBaseFirst();
+        alreadyInOrder = VisibleSelection(visiblePos1, visiblePos2).isBaseFirst();
 
     if (alreadyInOrder) {
         startPos = visiblePos1;
@@ -400,7 +404,7 @@ static VisiblePosition updateAXLineStartForVisiblePosition(const VisiblePosition
         if (!p.node())
             break;
         renderer = p.node()->renderer();
-        if (!renderer || renderer->isRenderBlock() && !p.offset())
+        if (!renderer || (renderer->isRenderBlock() && !p.deprecatedEditingOffset()))
             break;
         InlineBox* box;
         int ignoredCaretOffset;
@@ -514,7 +518,7 @@ static VisiblePosition startOfStyleRange(const VisiblePosition visiblePos)
     return VisiblePosition(startRenderer->node(), 0, VP_DEFAULT_AFFINITY);
 }
 
-static VisiblePosition endOfStyleRange(const VisiblePosition visiblePos)
+static VisiblePosition endOfStyleRange(const VisiblePosition& visiblePos)
 {
     RenderObject* renderer = visiblePos.deepEquivalent().node()->renderer();
     RenderObject* endRenderer = renderer;
@@ -534,7 +538,7 @@ static VisiblePosition endOfStyleRange(const VisiblePosition visiblePos)
         endRenderer = r;
     }
 
-    return VisiblePosition(endRenderer->node(), maxDeepOffset(endRenderer->node()), VP_DEFAULT_AFFINITY);
+    return lastDeepEditingPositionForNode(endRenderer->node());
 }
 
 VisiblePositionRange AccessibilityObject::styleRangeForPosition(const VisiblePosition& visiblePos) const
@@ -566,7 +570,7 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
     }
 
     // create an AX object, but skip it if it is not supposed to be seen
-    AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->get(replacedNode->renderer());
+    AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->getOrCreate(replacedNode->renderer());
     if (object->accessibilityIsIgnored())
         return false;
 
@@ -739,7 +743,8 @@ VisiblePosition AccessibilityObject::nextSentenceEndPosition(const VisiblePositi
     // an empty line is considered a sentence. If it's skipped, then the sentence parser will not
     // see this empty line.  Instead, return the end position of the empty line.
     VisiblePosition endPosition;
-    String lineString = plainText(makeRange(startOfLine(visiblePos), endOfLine(visiblePos)).get());
+    
+    String lineString = plainText(makeRange(startOfLine(nextVisiblePos), endOfLine(nextVisiblePos)).get());
     if (lineString.isEmpty())
         endPosition = nextVisiblePos;
     else
@@ -762,6 +767,7 @@ VisiblePosition AccessibilityObject::previousSentenceStartPosition(const Visible
 
     // treat empty line as a separate sentence.
     VisiblePosition startPosition;
+    
     String lineString = plainText(makeRange(startOfLine(previousVisiblePos), endOfLine(previousVisiblePos)).get());
     if (lineString.isEmpty())
         startPosition = previousVisiblePos;
@@ -812,7 +818,7 @@ AccessibilityObject* AccessibilityObject::accessibilityObjectForPosition(const V
     if (!obj)
         return 0;
 
-    return obj->document()->axObjectCache()->get(obj);
+    return obj->document()->axObjectCache()->getOrCreate(obj);
 }
 
 int AccessibilityObject::lineForPosition(const VisiblePosition& visiblePos) const
@@ -994,11 +1000,6 @@ void AccessibilityObject::setAXObjectID(unsigned axObjectID)
     m_id = axObjectID;
 }
 
-void AccessibilityObject::removeAXObjectID()
-{
-    return;
-}
-
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -1028,4 +1029,8 @@ const String& AccessibilityObject::actionVerb() const
     }
 }
 
+void AccessibilityObject::updateBackingStore()
+{
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index e177ee7219..f71be99ba6 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -83,7 +83,7 @@ class IntPoint;
 class IntSize;
 class Node;
 class RenderObject;
-class Selection;
+class VisibleSelection;
 class String;
 class Widget;
 
@@ -136,6 +136,8 @@ enum AccessibilityRole {
     DisclosureTriangleRole,
     GridRole,
     CellRole, 
+    ColumnHeaderRole,
+    RowHeaderRole,
     // AppKit includes SortButtonRole but it is misnamed and really a subrole of ButtonRole so we do not include it here.
 
     // WebCore-specific roles
@@ -213,6 +215,7 @@ public:
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuItem() const { return false; }
     virtual bool isFileUploadButton() const { return false; };
+    virtual bool isInputImage() const { return false; }
     virtual bool isProgressIndicator() const { return false; };
     virtual bool isSlider() const { return false; };
     virtual bool isControl() const { return false; };
@@ -251,7 +254,7 @@ public:
     virtual int intValue() const;
     virtual float valueForRange() const { return 0.0f; }
     virtual float maxValueForRange() const { return 0.0f; }
-    virtual float minValueForRange() const {return 0.0f; }
+    virtual float minValueForRange() const { return 0.0f; }
     virtual int layoutCount() const;
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
@@ -265,9 +268,11 @@ public:
     virtual AccessibilityObject* nextSibling() const;
     virtual AccessibilityObject* parentObject() const;
     virtual AccessibilityObject* parentObjectUnignored() const;
+    virtual AccessibilityObject* parentObjectIfExists() const;
     virtual AccessibilityObject* observableObject() const;
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
     virtual AccessibilityObject* titleUIElement() const;
+    virtual bool exposesTitleUIElement() const { return true; }
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -284,7 +289,7 @@ public:
     
     virtual KURL url() const;
     virtual PlainTextRange selectedTextRange() const;
-    virtual Selection selection() const;
+    virtual VisibleSelection selection() const;
     unsigned selectionStart() const;
     unsigned selectionEnd() const;
     virtual String stringValue() const;
@@ -399,13 +404,16 @@ public:
     bool accessibilityIgnoreAttachment() const { return true; }
 #endif
 
+    // allows for an AccessibilityObject to update its render tree or perform
+    // other operations update type operations
+    virtual void updateBackingStore();
+    
 protected:
     unsigned m_id;
     AccessibilityChildrenVector m_children;
     mutable bool m_haveChildren;
     
     virtual void clearChildren();
-    virtual void removeAXObjectID();
     virtual bool isDetached() const { return true; }
 
 #if PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index dee7eea54d..8c522a1cb9 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -39,6 +39,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLAreaElement.h"
+#include "HTMLFormElement.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
@@ -53,14 +54,16 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
+#include "RenderHTMLCanvas.h"
 #include "RenderImage.h"
+#include "RenderInline.h"
 #include "RenderListBox.h"
 #include "RenderListMarker.h"
 #include "RenderMenuList.h"
+#include "RenderText.h"
 #include "RenderTextControl.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
@@ -119,7 +122,7 @@ AccessibilityObject* AccessibilityRenderObject::firstChild() const
     if (!firstChild)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(firstChild);
+    return m_renderer->document()->axObjectCache()->getOrCreate(firstChild);
 }
 
 AccessibilityObject* AccessibilityRenderObject::lastChild() const
@@ -131,7 +134,7 @@ AccessibilityObject* AccessibilityRenderObject::lastChild() const
     if (!lastChild)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(lastChild);
+    return m_renderer->document()->axObjectCache()->getOrCreate(lastChild);
 }
 
 AccessibilityObject* AccessibilityRenderObject::previousSibling() const
@@ -143,7 +146,7 @@ AccessibilityObject* AccessibilityRenderObject::previousSibling() const
     if (!previousSibling)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(previousSibling);
+    return m_renderer->document()->axObjectCache()->getOrCreate(previousSibling);
 }
 
 AccessibilityObject* AccessibilityRenderObject::nextSibling() const
@@ -155,9 +158,21 @@ AccessibilityObject* AccessibilityRenderObject::nextSibling() const
     if (!nextSibling)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(nextSibling);
+    return m_renderer->document()->axObjectCache()->getOrCreate(nextSibling);
 }
 
+AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
+{
+    if (!m_renderer)
+        return 0;
+    
+    RenderObject *parent = m_renderer->parent();
+    if (!parent)
+        return 0;
+
+    return m_renderer->document()->axObjectCache()->get(parent);
+}
+    
 AccessibilityObject* AccessibilityRenderObject::parentObject() const
 {
     if (!m_renderer)
@@ -168,7 +183,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
         return 0;
     
     if (ariaRoleAttribute() == MenuBarRole)
-        return m_renderer->document()->axObjectCache()->get(parent);
+        return m_renderer->document()->axObjectCache()->getOrCreate(parent);
 
     // menuButton and its corresponding menu are DOM siblings, but Accessibility needs them to be parent/child
     if (ariaRoleAttribute() == MenuRole) {
@@ -177,7 +192,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
             return parent;
     }
     
-    return m_renderer->document()->axObjectCache()->get(parent);
+    return m_renderer->document()->axObjectCache()->getOrCreate(parent);
 }
 
 bool AccessibilityRenderObject::isWebArea() const
@@ -197,7 +212,7 @@ bool AccessibilityRenderObject::isAnchor() const
 
 bool AccessibilityRenderObject::isNativeTextControl() const
 {
-    return m_renderer->isTextField() || m_renderer->isTextArea();
+    return m_renderer->isTextControl();
 }
     
 bool AccessibilityRenderObject::isTextControl() const
@@ -218,6 +233,9 @@ bool AccessibilityRenderObject::isImage() const
 
 bool AccessibilityRenderObject::isAttachment() const
 {
+    if (!m_renderer)
+        return false;
+    
     // Widgets are the replaced elements that we represent to AX as attachments
     bool isWidget = m_renderer && m_renderer->isWidget();
     ASSERT(!isWidget || (m_renderer->isReplaced() && !isImage()));
@@ -227,9 +245,16 @@ bool AccessibilityRenderObject::isAttachment() const
 bool AccessibilityRenderObject::isPasswordField() const
 {
     ASSERT(m_renderer);
-    if (!m_renderer->element() || !m_renderer->element()->isHTMLElement())
+    if (!m_renderer->node() || !m_renderer->node()->isHTMLElement())
+        return false;
+    if (ariaRoleAttribute() != UnknownRole)
+        return false;
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    if (!inputElement)
         return false;
-    return static_cast<HTMLElement*>(m_renderer->element())->isPasswordField() && ariaRoleAttribute() == UnknownRole;
+
+    return inputElement->isPasswordField();
 }
 
 bool AccessibilityRenderObject::isCheckboxOrRadio() const
@@ -240,13 +265,23 @@ bool AccessibilityRenderObject::isCheckboxOrRadio() const
     
 bool AccessibilityRenderObject::isFileUploadButton() const
 {
-    if (m_renderer && m_renderer->element() && m_renderer->element()->hasTagName(inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->element());
+    if (m_renderer && m_renderer->node() && m_renderer->node()->hasTagName(inputTag)) {
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
         return input->inputType() == HTMLInputElement::FILE;
     }
     
     return false;
 }
+    
+bool AccessibilityRenderObject::isInputImage() const
+{
+    if (m_renderer && m_renderer->node() && m_renderer->node()->hasTagName(inputTag)) {
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
+        return input->inputType() == HTMLInputElement::IMAGE;
+    }
+    
+    return false;
+}
 
 bool AccessibilityRenderObject::isProgressIndicator() const
 {
@@ -310,13 +345,27 @@ bool AccessibilityRenderObject::isPressed() const
 bool AccessibilityRenderObject::isIndeterminate() const
 {
     ASSERT(m_renderer);
-    return m_renderer->node() && m_renderer->node()->isIndeterminate();
+    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+        return false;
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    if (!inputElement)
+        return false;
+
+    return inputElement->isIndeterminate();
 }
 
 bool AccessibilityRenderObject::isChecked() const
 {
     ASSERT(m_renderer);
-    return m_renderer->node() && m_renderer->node()->isChecked();
+    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+        return false;
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    if (!inputElement)
+        return false;
+
+    return inputElement->isChecked();
 }
 
 bool AccessibilityRenderObject::isHovered() const
@@ -330,7 +379,7 @@ bool AccessibilityRenderObject::isMultiSelect() const
     ASSERT(m_renderer);
     if (!m_renderer->isListBox())
         return false;
-    return m_renderer->element() && static_cast<HTMLSelectElement*>(m_renderer->element())->multiple();
+    return m_renderer->node() && static_cast<HTMLSelectElement*>(m_renderer->node())->multiple();
 }
     
 bool AccessibilityRenderObject::isReadOnly() const
@@ -373,7 +422,7 @@ int AccessibilityRenderObject::headingLevel(Node* node)
         return 0;
 
     if (RenderObject* renderer = node->renderer()) {
-        AccessibilityObject* axObjectForNode = node->document()->axObjectCache()->get(renderer);
+        AccessibilityObject* axObjectForNode = node->document()->axObjectCache()->getOrCreate(renderer);
         if (axObjectForNode->ariaRoleAttribute() == HeadingRole) {
             if (!node->isElementNode())
                 return 0;
@@ -419,8 +468,9 @@ bool AccessibilityRenderObject::isControl() const
     if (!m_renderer)
         return false;
     
-    Node* node = m_renderer->element();
-    return node && (node->isControl() || AccessibilityObject::isARIAControl(ariaRoleAttribute()));
+    Node* node = m_renderer->node();
+    return node && ((node->isElementNode() && static_cast<Element*>(node)->isFormControlElement())
+                    || AccessibilityObject::isARIAControl(ariaRoleAttribute()));
 }
 
 bool AccessibilityRenderObject::isFieldset() const
@@ -438,7 +488,7 @@ bool AccessibilityRenderObject::isGroup() const
     
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return nullAtom;
 
@@ -458,9 +508,12 @@ Element* AccessibilityRenderObject::anchorElement() const
     RenderObject* currRenderer;
     
     // Search up the render tree for a RenderObject with a DOM node.  Defer to an earlier continuation, though.
-    for (currRenderer = m_renderer; currRenderer && !currRenderer->element(); currRenderer = currRenderer->parent()) {
-        if (currRenderer->continuation())
-            return cache->get(currRenderer->continuation())->anchorElement();
+    for (currRenderer = m_renderer; currRenderer && !currRenderer->node(); currRenderer = currRenderer->parent()) {
+        if (currRenderer->isRenderBlock()) {
+            RenderInline* continuation = toRenderBlock(currRenderer)->inlineContinuation();
+            if (continuation)
+                return cache->getOrCreate(continuation)->anchorElement();
+        }
     }
     
     // bail if none found
@@ -471,7 +524,7 @@ Element* AccessibilityRenderObject::anchorElement() const
     // NOTE: this assumes that any non-image with an anchor is an HTMLAnchorElement
     Node* node = currRenderer->node();
     for ( ; node; node = node->parentNode()) {
-        if (node->hasTagName(aTag) || (node->renderer() && cache->get(node->renderer())->isAnchor()))
+        if (node->hasTagName(aTag) || (node->renderer() && cache->getOrCreate(node->renderer())->isAnchor()))
             return static_cast<Element*>(node);
     }
     
@@ -480,24 +533,31 @@ Element* AccessibilityRenderObject::anchorElement() const
 
 Element* AccessibilityRenderObject::actionElement() const
 {
-    if (m_renderer->element() && m_renderer->element()->hasTagName(inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->element());
-        if (!input->disabled() && (isCheckboxOrRadio() || input->isTextButton()))
-            return input;
+    if (!m_renderer)
+        return 0;
+    
+    Node* node = m_renderer->node();
+    if (node) {
+        if (node->hasTagName(inputTag)) {
+            HTMLInputElement* input = static_cast<HTMLInputElement*>(node);
+            if (!input->disabled() && (isCheckboxOrRadio() || input->isTextButton()))
+                return input;
+        } else if (node->hasTagName(buttonTag))
+            return static_cast<Element*>(node);
     }
             
     if (isFileUploadButton())
-        return static_cast<Element*>(m_renderer->element());
+        return static_cast<Element*>(m_renderer->node());
             
     if (AccessibilityObject::isARIAInput(ariaRoleAttribute()))
-        return static_cast<Element*>(m_renderer->element());
+        return static_cast<Element*>(m_renderer->node());
 
     if (isImageButton())
-        return static_cast<Element*>(m_renderer->element());
+        return static_cast<Element*>(m_renderer->node());
     
     if (m_renderer->isMenuList())
-        return static_cast<RenderMenuList*>(m_renderer)->selectElement();
-    
+        return static_cast<Element*>(m_renderer->node());
+
     Element* elt = anchorElement();
     if (!elt)
         elt = mouseButtonListener();
@@ -506,18 +566,23 @@ Element* AccessibilityRenderObject::actionElement() const
 
 Element* AccessibilityRenderObject::mouseButtonListener() const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return 0;
-    if (!node->isEventTargetNode())
-        return 0;
     
+    // check if our parent is a mouse button listener
+    while (node && !node->isElementNode())
+        node = node->parent();
+
+    if (!node)
+        return 0;
+
     // FIXME: Do the continuation search like anchorElement does
-    for (EventTargetNode* elt = static_cast<EventTargetNode*>(node); elt; elt = static_cast<EventTargetNode*>(elt->parentNode())) {
-        if (elt->inlineEventListenerForType(eventNames().clickEvent) || elt->inlineEventListenerForType(eventNames().mousedownEvent) || elt->inlineEventListenerForType(eventNames().mouseupEvent))
-            return static_cast<Element*>(elt);
+    for (Element* element = static_cast<Element*>(node); element; element = element->parentElement()) {
+        if (element->getAttributeEventListener(eventNames().clickEvent) || element->getAttributeEventListener(eventNames().mousedownEvent) || element->getAttributeEventListener(eventNames().mouseupEvent))
+            return element;
     }
-    
+
     return 0;
 }
 
@@ -548,7 +613,7 @@ AccessibilityObject* AccessibilityRenderObject::menuForMenuButton() const
 {
     Element* menu = menuElementForMenuButton();
     if (menu && menu->renderer())
-        return m_renderer->document()->axObjectCache()->get(menu->renderer());
+        return m_renderer->document()->axObjectCache()->getOrCreate(menu->renderer());
     return 0;
 }
 
@@ -566,7 +631,7 @@ AccessibilityObject* AccessibilityRenderObject::menuButtonForMenu() const
 
     if (menuItem && menuItem->renderer()) {
         // ARIA just has generic menu items.  AppKit needs to know if this is a top level items like MenuBarButton or MenuBarItem
-        AccessibilityObject* menuItemAX = m_renderer->document()->axObjectCache()->get(menuItem->renderer());
+        AccessibilityObject* menuItemAX = m_renderer->document()->axObjectCache()->getOrCreate(menuItem->renderer());
         if (menuItemAX->isMenuButton())
             return menuItemAX;
     }
@@ -579,11 +644,11 @@ String AccessibilityRenderObject::helpText() const
         return String();
     
     for (RenderObject* curr = m_renderer; curr; curr = curr->parent()) {
-        if (curr->element() && curr->element()->isHTMLElement()) {
-            const AtomicString& summary = static_cast<Element*>(curr->element())->getAttribute(summaryAttr);
+        if (curr->node() && curr->node()->isHTMLElement()) {
+            const AtomicString& summary = static_cast<Element*>(curr->node())->getAttribute(summaryAttr);
             if (!summary.isEmpty())
                 return summary;
-            const AtomicString& title = static_cast<Element*>(curr->element())->getAttribute(titleAttr);
+            const AtomicString& title = static_cast<Element*>(curr->node())->getAttribute(titleAttr);
             if (!title.isEmpty())
                 return title;
         }
@@ -602,7 +667,7 @@ String AccessibilityRenderObject::textUnderElement() const
         return uploadControl->buttonValue();
     }
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (node) {
         if (Frame* frame = node->document()->frame()) {
             // catch stale WebCoreAXObject (see <rdar://problem/3960196>)
@@ -622,7 +687,7 @@ bool AccessibilityRenderObject::hasIntValue() const
     if (isHeading())
         return true;
     
-    if (m_renderer->element() && isCheckboxOrRadio())
+    if (m_renderer->node() && isCheckboxOrRadio())
         return true;
     
     return false;
@@ -634,9 +699,9 @@ int AccessibilityRenderObject::intValue() const
         return 0;
     
     if (isHeading())
-        return headingLevel(m_renderer->element());
+        return headingLevel(m_renderer->node());
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node || !isCheckboxOrRadio())
         return 0;
 
@@ -755,7 +820,7 @@ String AccessibilityRenderObject::ariaAccessiblityName(const String& s) const
         if (idElement) {
             String nameFragment = accessibleNameForNode(idElement);
             ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement->nextSibling())) {
+            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
                 nameFragment = accessibleNameForNode(n);
                 ariaLabel.append(nameFragment.characters(), nameFragment.length());
             }
@@ -811,7 +876,7 @@ HTMLLabelElement* AccessibilityRenderObject::labelElementContainer() const
         return false;
     
     // find if this has a parent that is a label
-    for (Node* parentNode = m_renderer->element(); parentNode; parentNode = parentNode->parentNode()) {
+    for (Node* parentNode = m_renderer->node(); parentNode; parentNode = parentNode->parentNode()) {
         if (parentNode->hasTagName(labelTag))
             return static_cast<HTMLLabelElement*>(parentNode);
     }
@@ -826,7 +891,7 @@ String AccessibilityRenderObject::title() const
     if (!m_renderer)
         return String();
 
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return String();
     
@@ -847,8 +912,12 @@ String AccessibilityRenderObject::title() const
     
     if (isInputTag || AccessibilityObject::isARIAInput(ariaRole) || isControl()) {
         HTMLLabelElement* label = labelForElement(static_cast<Element*>(node));
-        if (label)
+        if (label && !titleUIElement())
             return label->innerText();
+        
+        const AtomicString& placeholder = getAttribute(placeholderAttr);
+        if (!placeholder.isEmpty())
+            return placeholder;
     }
     
     if (roleValue() == ButtonRole
@@ -882,9 +951,10 @@ String AccessibilityRenderObject::accessibilityDescription() const
     if (!ariaDescription.isEmpty())
         return ariaDescription;
     
-    if (isImage()) {
-        if (m_renderer->element() && m_renderer->element()->isHTMLElement()) {
-            const AtomicString& alt = static_cast<HTMLElement*>(m_renderer->element())->getAttribute(altAttr);
+    if (isImage() || isInputImage() || isNativeImage()) {
+        Node* node = m_renderer->node();
+        if (node && node->isHTMLElement()) {
+            const AtomicString& alt = static_cast<HTMLElement*>(node)->getAttribute(altAttr);
             if (alt.isEmpty())
                 return String();
             return alt;
@@ -919,29 +989,30 @@ String AccessibilityRenderObject::accessibilityDescription() const
 
 IntRect AccessibilityRenderObject::boundingBoxRect() const
 {
-    IntRect rect;
     RenderObject* obj = m_renderer;
     
     if (!obj)
         return IntRect();
     
-    if (obj->isInlineContinuation())
-        obj = obj->element()->renderer();
+    if (obj->node()) // If we are a continuation, we want to make sure to use the primary renderer.
+        obj = obj->node()->renderer();
     
-    // FIXME: This doesn't work correctly with transforms.
-    Vector<IntRect> rects;
-    FloatPoint absPos = obj->localToAbsolute();
-    obj->absoluteRects(rects, absPos.x(), absPos.y());
-    const size_t n = rects.size();
+    Vector<FloatQuad> quads;
+    obj->absoluteQuads(quads);
+    const size_t n = quads.size();
+    if (!n)
+        return IntRect();
+
+    IntRect result;
     for (size_t i = 0; i < n; ++i) {
-        IntRect r = rects[i];
+        IntRect r = quads[i].enclosingBoundingBox();
         if (!r.isEmpty()) {
             if (obj->style()->hasAppearance())
                 theme()->adjustRepaintRect(obj, r);
-            rect.unite(r);
+            result.unite(r);
         }
     }
-    return rect;
+    return result;
 }
     
 IntRect AccessibilityRenderObject::checkboxOrRadioRect() const
@@ -949,11 +1020,11 @@ IntRect AccessibilityRenderObject::checkboxOrRadioRect() const
     if (!m_renderer)
         return IntRect();
     
-    HTMLLabelElement* label = labelForElement(static_cast<Element*>(m_renderer->element()));
+    HTMLLabelElement* label = labelForElement(static_cast<Element*>(m_renderer->node()));
     if (!label || !label->renderer())
         return boundingBoxRect();
     
-    IntRect labelRect = axObjectCache()->get(label->renderer())->elementRect();
+    IntRect labelRect = axObjectCache()->getOrCreate(label->renderer())->elementRect();
     labelRect.unite(boundingBoxRect());
     return labelRect;
 }
@@ -999,7 +1070,7 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
         return 0;
     
     // the element we find may not be accessible, keep searching until we find a good one
-    AccessibilityObject* linkedAXElement = m_renderer->document()->axObjectCache()->get(linkedNode->renderer());
+    AccessibilityObject* linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
     while (linkedAXElement && linkedAXElement->accessibilityIsIgnored()) {
         linkedNode = linkedNode->traverseNextNode();
         
@@ -1008,7 +1079,7 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
         
         if (!linkedNode)
             return 0;
-        linkedAXElement = m_renderer->document()->axObjectCache()->get(linkedNode->renderer());
+        linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
     }
     
     return linkedAXElement;
@@ -1032,7 +1103,7 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
         unsigned len = formElements.size();
         for (unsigned i = 0; i < len; ++i) {
             Node* associateElement = formElements[i].get();
-            if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->get(associateElement->renderer()))
+            if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->getOrCreate(associateElement->renderer()))
                 linkedUIElements.append(object);        
         } 
     } else {
@@ -1042,7 +1113,7 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
             if (list->item(i)->hasTagName(inputTag)) {
                 HTMLInputElement* associateElement = static_cast<HTMLInputElement*>(list->item(i));
                 if (associateElement->isRadioButton() && associateElement->name() == input->name()) {
-                    if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->get(associateElement->renderer()))
+                    if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->getOrCreate(associateElement->renderer()))
                         linkedUIElements.append(object);
                 }
             }
@@ -1064,6 +1135,18 @@ void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& li
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::exposesTitleUIElement() const
+{
+    if (!isControl())
+        return false;
+
+    // checkbox or radio buttons don't expose the title ui element unless it has a title already
+    if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
+        return false;
+    
+    return true;
+}
+    
 AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
 {
     if (!m_renderer)
@@ -1071,16 +1154,15 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     
     // if isFieldset is true, the renderer is guaranteed to be a RenderFieldset
     if (isFieldset())
-        return axObjectCache()->get(static_cast<RenderFieldset*>(m_renderer)->findLegend());
+        return axObjectCache()->getOrCreate(static_cast<RenderFieldset*>(m_renderer)->findLegend());
     
-    // checkbox and radio hide their labels. Only controls get titleUIElements for now
-    if (isCheckboxOrRadio() || !isControl())
+    if (!exposesTitleUIElement())
         return 0;
     
-    Node* element = m_renderer->element();
+    Node* element = m_renderer->node();
     HTMLLabelElement* label = labelForElement(static_cast<Element*>(element));
     if (label && label->renderer())
-        return axObjectCache()->get(label->renderer());
+        return axObjectCache()->getOrCreate(label->renderer());
 
     return 0;   
 }
@@ -1106,8 +1188,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (labelElement) {
         HTMLElement* correspondingControl = labelElement->correspondingControl();
         if (correspondingControl && correspondingControl->renderer()) {
-            AccessibilityObject* controlObject = axObjectCache()->get(correspondingControl->renderer());
-            if (controlObject->isCheckboxOrRadio())
+            AccessibilityObject* controlObject = axObjectCache()->getOrCreate(correspondingControl->renderer());
+            if (!controlObject->exposesTitleUIElement())
                 return true;
         }
     }
@@ -1124,7 +1206,12 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
             parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
-         return m_renderer->isBR() || !static_cast<RenderText*>(m_renderer)->firstTextBox();
+        RenderText* renderText = toRenderText(m_renderer);
+        if (m_renderer->isBR() || !renderText->firstTextBox())
+            return true;
+        
+        // text elements that are just empty whitespace should not be returned
+        return renderText->text()->containsOnlyWhitespace();
     }
     
     if (isHeading())
@@ -1138,12 +1225,12 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         return false;
     
     // don't ignore labels, because they serve as TitleUIElements
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (node && node->hasTagName(labelTag))
         return false;
     
     if (m_renderer->isBlockFlow() && m_renderer->childrenInline())
-        return !static_cast<RenderBlock*>(m_renderer)->firstLineBox() && !mouseButtonListener();
+        return !toRenderBlock(m_renderer)->firstLineBox() && !mouseButtonListener();
     
     // ignore images seemingly used as spacers
     if (isImage()) {
@@ -1158,13 +1245,20 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
                 return true;
         }
         
+        if (node && node->hasTagName(canvasTag)) {
+            RenderHTMLCanvas* canvas = static_cast<RenderHTMLCanvas*>(m_renderer);
+            if (canvas->height() <= 1 || canvas->width() <= 1)
+                return true;
+            return false;
+        }
+        
         // check for one-dimensional image
-        if (m_renderer->height() <= 1 || m_renderer->width() <= 1)
+        RenderImage* image = toRenderImage(m_renderer);
+        if (image->height() <= 1 || image->width() <= 1)
             return true;
         
         // check whether rendered image was stretched from one-dimensional file image
         if (isNativeImage()) {
-            RenderImage* image = static_cast<RenderImage*>(m_renderer);
             if (image->cachedImage()) {
                 IntSize imageSize = image->cachedImage()->imageSize(image->view()->zoomFactor());
                 return imageSize.height() <= 1 || imageSize.width() <= 1;
@@ -1192,7 +1286,7 @@ int AccessibilityRenderObject::layoutCount() const
 {
     if (!m_renderer->isRenderView())
         return 0;
-    return static_cast<RenderView*>(m_renderer)->frameView()->layoutCount();
+    return toRenderView(m_renderer)->frameView()->layoutCount();
 }
 
 String AccessibilityRenderObject::text() const
@@ -1201,9 +1295,9 @@ String AccessibilityRenderObject::text() const
         return String();
     
     if (isNativeTextControl())
-        return static_cast<RenderTextControl*>(m_renderer)->text();
+        return toRenderTextControl(m_renderer)->text();
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return String();
     if (!node->isElementNode())
@@ -1224,11 +1318,11 @@ int AccessibilityRenderObject::textLength() const
 
 PassRefPtr<Range> AccessibilityRenderObject::ariaSelectedTextDOMRange() const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return 0;
     
-    RefPtr<Range> currentSelectionRange = selection().toRange();
+    RefPtr<Range> currentSelectionRange = selection().toNormalizedRange();
     if (!currentSelectionRange)
         return 0;
     
@@ -1261,7 +1355,7 @@ String AccessibilityRenderObject::selectedText() const
         return String(); // need to return something distinct from empty string
     
     if (isNativeTextControl()) {
-        RenderTextControl* textControl = static_cast<RenderTextControl*>(m_renderer);
+        RenderTextControl* textControl = toRenderTextControl(m_renderer);
         return textControl->text().substring(textControl->selectionStart(), textControl->selectionEnd() - textControl->selectionStart());
     }
     
@@ -1276,7 +1370,7 @@ String AccessibilityRenderObject::selectedText() const
 
 const AtomicString& AccessibilityRenderObject::accessKey() const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return nullAtom;
     if (!node->isElementNode())
@@ -1284,7 +1378,7 @@ const AtomicString& AccessibilityRenderObject::accessKey() const
     return static_cast<Element*>(node)->getAttribute(accesskeyAttr);
 }
 
-Selection AccessibilityRenderObject::selection() const
+VisibleSelection AccessibilityRenderObject::selection() const
 {
     return m_renderer->document()->frame()->selection()->selection();
 }
@@ -1298,7 +1392,7 @@ PlainTextRange AccessibilityRenderObject::selectedTextRange() const
     
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (isNativeTextControl() && ariaRole == UnknownRole) {
-        RenderTextControl* textControl = static_cast<RenderTextControl*>(m_renderer);
+        RenderTextControl* textControl = toRenderTextControl(m_renderer);
         return PlainTextRange(textControl->selectionStart(), textControl->selectionEnd() - textControl->selectionStart());
     }
     
@@ -1314,7 +1408,7 @@ PlainTextRange AccessibilityRenderObject::selectedTextRange() const
 void AccessibilityRenderObject::setSelectedTextRange(const PlainTextRange& range)
 {
     if (isNativeTextControl()) {
-        RenderTextControl* textControl = static_cast<RenderTextControl*>(m_renderer);
+        RenderTextControl* textControl = toRenderTextControl(m_renderer);
         textControl->setSelectionRange(range.start, range.start + range.length);
         return;
     }
@@ -1325,14 +1419,14 @@ void AccessibilityRenderObject::setSelectedTextRange(const PlainTextRange& range
     Frame* frame = document->frame();
     if (!frame)
         return;
-    Node* node = m_renderer->element();
-    frame->selection()->setSelection(Selection(Position(node, range.start),
+    Node* node = m_renderer->node();
+    frame->selection()->setSelection(VisibleSelection(Position(node, range.start),
         Position(node, range.start + range.length), DOWNSTREAM));
 }
 
 KURL AccessibilityRenderObject::url() const
 {
-    if (isAnchor() && m_renderer->element()->hasTagName(aTag)) {
+    if (isAnchor() && m_renderer->node()->hasTagName(aTag)) {
         if (HTMLAnchorElement* anchor = static_cast<HTMLAnchorElement*>(anchorElement()))
             return anchor->href();
     }
@@ -1340,8 +1434,11 @@ KURL AccessibilityRenderObject::url() const
     if (isWebArea())
         return m_renderer->document()->url();
     
-    if (isImage() && m_renderer->element() && m_renderer->element()->hasTagName(imgTag))
-        return static_cast<HTMLImageElement*>(m_renderer->element())->src();
+    if (isImage() && m_renderer->node() && m_renderer->node()->hasTagName(imgTag))
+        return static_cast<HTMLImageElement*>(m_renderer->node())->src();
+    
+    if (isInputImage())
+        return static_cast<HTMLInputElement*>(m_renderer->node())->src();
     
     return KURL();
 }
@@ -1378,7 +1475,7 @@ bool AccessibilityRenderObject::isFocused() const
     
     // A web area is represented by the Document node in the DOM tree, which isn't focusable.
     // Check instead if the frame's selection controller is focused
-    if (focusedNode == m_renderer->element() || 
+    if (focusedNode == m_renderer->node() || 
         (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
         return true;
     
@@ -1393,10 +1490,10 @@ void AccessibilityRenderObject::setFocused(bool on)
     if (!on)
         m_renderer->document()->setFocusedNode(0);
     else {
-        if (m_renderer->element()->isElementNode())
-            static_cast<Element*>(m_renderer->element())->focus();
+        if (m_renderer->node()->isElementNode())
+            static_cast<Element*>(m_renderer->node())->focus();
         else
-            m_renderer->document()->setFocusedNode(m_renderer->element());
+            m_renderer->document()->setFocusedNode(m_renderer->node());
     }
 }
 
@@ -1404,22 +1501,27 @@ void AccessibilityRenderObject::setValue(const String& string)
 {
     // FIXME: Do we want to do anything here for ARIA textboxes?
     if (m_renderer->isTextField()) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->element());
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
         input->setValue(string);
     } else if (m_renderer->isTextArea()) {
-        HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->element());
+        HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->node());
         textArea->setValue(string);
     }
 }
 
 bool AccessibilityRenderObject::isEnabled() const
 {
-    return m_renderer->element() ? m_renderer->element()->isEnabled() : true;
+    ASSERT(m_renderer);
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return true;
+
+    return static_cast<Element*>(node)->isEnabledFormControl();
 }
 
-RenderObject* AccessibilityRenderObject::topRenderer() const
+RenderView* AccessibilityRenderObject::topRenderer() const
 {
-    return m_renderer->document()->topDocument()->renderer();
+    return m_renderer->document()->topDocument()->renderView();
 }
 
 Document* AccessibilityRenderObject::document() const
@@ -1451,6 +1553,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
     if (!m_renderer || !map)
         return 0;
 
+    String mapName = map->getName().string().lower();
     RefPtr<HTMLCollection> coll = m_renderer->document()->images();
     for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
         RenderObject* obj = curr->renderer();
@@ -1459,8 +1562,9 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
         
         // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
         // which has to be stripped off
-        if (static_cast<HTMLImageElement*>(curr)->useMap().substring(1) == map->getName())
-            return axObjectCache()->get(obj);
+        String useMapName = static_cast<HTMLImageElement*>(curr)->useMap().substring(1).lower();
+        if (useMapName == mapName)
+            return axObjectCache()->getOrCreate(obj);
     }
     
     return 0;
@@ -1474,15 +1578,14 @@ void AccessibilityRenderObject::getDocumentLinks(AccessibilityChildrenVector& re
     while (curr) {
         RenderObject* obj = curr->renderer();
         if (obj) {
-            RefPtr<AccessibilityObject> axobj = document->axObjectCache()->get(obj);
+            RefPtr<AccessibilityObject> axobj = document->axObjectCache()->getOrCreate(obj);
             ASSERT(axobj);
-            ASSERT(axobj->roleValue() == WebCoreLinkRole);
-            if (!axobj->accessibilityIsIgnored())
+            if (!axobj->accessibilityIsIgnored() && axobj->isLink())
                 result.append(axobj);
         } else {
             Node* parent = curr->parent();
             if (parent && curr->hasTagName(areaTag) && parent->hasTagName(mapTag)) {
-                AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(axObjectCache()->get(ImageMapLinkRole));
+                AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(axObjectCache()->getOrCreate(ImageMapLinkRole));
                 areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(curr));
                 areaObject->setHTMLMapElement(static_cast<HTMLMapElement*>(parent));
                 areaObject->setParent(accessibilityParentForImageMap(static_cast<HTMLMapElement*>(parent)));
@@ -1526,20 +1629,23 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
         return VisiblePositionRange();
     
     // construct VisiblePositions for start and end
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return VisiblePositionRange();
-    
-    VisiblePosition startPos = VisiblePosition(node, 0, VP_DEFAULT_AFFINITY);
-    VisiblePosition endPos = VisiblePosition(node, maxDeepOffset(node), VP_DEFAULT_AFFINITY);
-    
+
+    VisiblePosition startPos = firstDeepEditingPositionForNode(node);
+    VisiblePosition endPos = lastDeepEditingPositionForNode(node);
+
     // the VisiblePositions are equal for nodes like buttons, so adjust for that
+    // FIXME: Really?  [button, 0] and [button, 1] are distinct (before and after the button)
+    // I expect this code is only hit for things like empty divs?  In which case I don't think
+    // the behavior is correct here -- eseidel
     if (startPos == endPos) {
         endPos = endPos.next();
         if (endPos.isNull())
             endPos = startPos;
     }
-    
+
     return VisiblePositionRange(startPos, endPos);
 }
 
@@ -1565,7 +1671,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsi
     // starting at an empty line.  The resulting selection in that case
     // will be a caret at visiblePos.
     SelectionController selection;
-    selection.setSelection(Selection(visiblePos));
+    selection.setSelection(VisibleSelection(visiblePos));
     selection.modify(SelectionController::EXTEND, SelectionController::RIGHT, LineBoundary);
     
     return VisiblePositionRange(selection.selection().visibleStart(), selection.selection().visibleEnd());
@@ -1577,7 +1683,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForIndex(int index) co
         return VisiblePosition();
     
     if (isNativeTextControl())
-        return static_cast<RenderTextControl*>(m_renderer)->visiblePositionForIndex(index);
+        return toRenderTextControl(m_renderer)->visiblePositionForIndex(index);
     
     if (!isTextControl() && !m_renderer->isText())
         return VisiblePosition();
@@ -1600,7 +1706,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForIndex(int index) co
 int AccessibilityRenderObject::indexForVisiblePosition(const VisiblePosition& pos) const
 {
     if (isNativeTextControl())
-        return static_cast<RenderTextControl*>(m_renderer)->indexForVisiblePosition(pos);
+        return toRenderTextControl(m_renderer)->indexForVisiblePosition(pos);
     
     if (!isTextControl())
         return 0;
@@ -1616,7 +1722,7 @@ int AccessibilityRenderObject::indexForVisiblePosition(const VisiblePosition& po
     ExceptionCode ec = 0;
     RefPtr<Range> range = Range::create(m_renderer->document());
     range->setStart(node, 0, ec);
-    range->setEnd(indexPosition.node(), indexPosition.offset(), ec);
+    range->setEnd(indexPosition.node(), indexPosition.deprecatedEditingOffset(), ec);
     return TextIterator::rangeLength(range.get());
 }
 
@@ -1672,7 +1778,7 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
         m_renderer->document()->frame()->selection()->moveTo(range.start, true);
     }
     else {
-        Selection newSelection = Selection(range.start, range.end);
+        VisibleSelection newSelection = VisibleSelection(range.start, range.end);
         m_renderer->document()->frame()->selection()->setSelection(newSelection);
     }    
 }
@@ -1681,7 +1787,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
 {
     // convert absolute point to view coordinates
     FrameView* frameView = m_renderer->document()->topDocument()->renderer()->view()->frameView();
-    RenderObject* renderer = topRenderer();
+    RenderView* renderView = topRenderer();
     Node* innerNode = 0;
     
     // locate the node containing the point
@@ -1693,9 +1799,10 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
 #else
         ourpoint = point;
 #endif
-        HitTestRequest request(true, true);
+        HitTestRequest request(HitTestRequest::ReadOnly |
+                               HitTestRequest::Active);
         HitTestResult result(ourpoint);
-        renderer->layer()->hitTest(request, result);
+        renderView->layer()->hitTest(request, result);
         innerNode = result.innerNode();
         if (!innerNode || !innerNode->renderer())
             return VisiblePosition();
@@ -1703,7 +1810,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
         pointResult = result.localPoint();
         
         // done if hit something other than a widget
-        renderer = innerNode->renderer();
+        RenderObject* renderer = innerNode->renderer();
         if (!renderer->isWidget())
             break;
         
@@ -1714,10 +1821,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
         Frame* frame = static_cast<FrameView*>(widget)->frame();
         if (!frame)
             break;
-        Document* document = frame->document();
-        if (!document)
-            break;
-        renderer = document->renderer();
+        renderView = frame->document()->renderView();
         frameView = static_cast<FrameView*>(widget);
     }
     
@@ -1750,7 +1854,7 @@ int AccessibilityRenderObject::index(const VisiblePosition& position) const
     if (!node)
         return -1;
     
-    for (RenderObject* renderer = node->renderer(); renderer && renderer->element(); renderer = renderer->parent()) {
+    for (RenderObject* renderer = node->renderer(); renderer && renderer->node(); renderer = renderer->parent()) {
         if (renderer == m_renderer)
             return indexForVisiblePosition(position);
     }
@@ -1780,7 +1884,7 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
     // starting at an empty line.  The resulting selection in that case
     // will be a caret at visiblePos.
     SelectionController selection;
-    selection.setSelection(Selection(visiblePos));
+    selection.setSelection(VisibleSelection(visiblePos));
     selection.modify(SelectionController::EXTEND, SelectionController::LEFT, LineBoundary);
     selection.modify(SelectionController::EXTEND, SelectionController::RIGHT, LineBoundary);
     
@@ -1846,26 +1950,50 @@ IntRect AccessibilityRenderObject::doAXBoundsForRange(const PlainTextRange& rang
     return IntRect();
 }
 
-AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const IntPoint& point) const
+AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTMLAreaElement* area, const IntPoint& point) const
 {
-    if (!m_renderer)
+    if (!area)
         return 0;
     
-    RenderLayer* layer = m_renderer->layer();
-    if (!layer)
+    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    AccessibilityObject* parent = accessibilityParentForImageMap(map);
+    if (!parent)
         return 0;
     
-    HitTestRequest request(true, true);
+    AccessibilityObject::AccessibilityChildrenVector children = parent->children();
+    
+    unsigned count = children.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (children[k]->elementRect().contains(point))
+            return children[k].get();
+    }
+    
+    return 0;
+}
+    
+AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const IntPoint& point) const
+{
+    if (!m_renderer || !m_renderer->hasLayer())
+        return 0;
+    
+    RenderLayer* layer = toRenderBox(m_renderer)->layer();
+     
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active);
     HitTestResult hitTestResult = HitTestResult(point);
     layer->hitTest(request, hitTestResult);
     if (!hitTestResult.innerNode())
         return 0;
     Node* node = hitTestResult.innerNode()->shadowAncestorNode();
+
+    if (node->hasTagName(areaTag)) 
+        return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
+    
     RenderObject* obj = node->renderer();
     if (!obj)
         return 0;
     
-    AccessibilityObject *result = obj->document()->axObjectCache()->get(obj);
+    AccessibilityObject *result = obj->document()->axObjectCache()->getOrCreate(obj);
 
     if (obj->isListBox())
         return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
@@ -1892,7 +2020,7 @@ AccessibilityObject* AccessibilityRenderObject::focusedUIElement() const
     if (!focusedNodeRenderer)
         return 0;
     
-    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->get(focusedNodeRenderer);
+    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
     
     if (obj->shouldFocusActiveDescendant()) {
         if (AccessibilityObject* descendant = obj->activeDescendant())
@@ -1937,9 +2065,9 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
 
 AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 {
-    if (renderer()->element() && !renderer()->element()->isElementNode())
+    if (renderer()->node() && !renderer()->node()->isElementNode())
         return 0;
-    Element* element = static_cast<Element*>(renderer()->element());
+    Element* element = static_cast<Element*>(renderer()->node());
         
     String activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr).string();
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
@@ -1949,7 +2077,7 @@ AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
     if (!target)
         return 0;
     
-    AccessibilityObject* obj = renderer()->document()->axObjectCache()->get(target->renderer());
+    AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
     if (obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
@@ -1959,7 +2087,7 @@ AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 
 void AccessibilityRenderObject::handleActiveDescendantChanged()
 {
-    Element* element = static_cast<Element*>(renderer()->element());
+    Element* element = static_cast<Element*>(renderer()->node());
     if (!element)
         return;
     Document* doc = renderer()->document();
@@ -1968,15 +2096,15 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotificationToElement(activedescendant->renderer(), "AXFocusedUIElementChanged");
+        doc->axObjectCache()->postNotification(activedescendant->renderer(), "AXFocusedUIElementChanged", true);
 }
 
 
 AccessibilityObject* AccessibilityRenderObject::observableObject() const
 {
-    for (RenderObject* renderer = m_renderer; renderer && renderer->element(); renderer = renderer->parent()) {
-        if (renderer->isTextField() || renderer->isTextArea())
-            return renderer->document()->axObjectCache()->get(renderer);
+    for (RenderObject* renderer = m_renderer; renderer && renderer->node(); renderer = renderer->parent()) {
+        if (renderer->isTextControl())
+            return renderer->document()->axObjectCache()->getOrCreate(renderer);
     }
     
     return 0;
@@ -1994,6 +2122,10 @@ static const ARIARoleMap& createARIARoleMap()
     const RoleEntry roles[] = {
         { "button", ButtonRole },
         { "checkbox", CheckBoxRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "rowheader", RowHeaderRole },
         { "group", GroupRole },
         { "heading", HeadingRole },
         { "img", ImageRole },
@@ -2007,6 +2139,7 @@ static const ARIARoleMap& createARIARoleMap()
         { "menuitemradio", MenuItemRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
+        { "row", RowRole },
         { "range", SliderRole },
         { "slider", SliderRole },
         { "spinbutton", ProgressIndicatorRole },
@@ -2069,7 +2202,7 @@ AccessibilityRole AccessibilityRenderObject::roleValue() const
     if (!m_renderer)
         return UnknownRole;
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (ariaRole != UnknownRole)
         return ariaRole;
@@ -2090,6 +2223,9 @@ AccessibilityRole AccessibilityRenderObject::roleValue() const
             return ButtonRole;
         return ImageRole;
     }
+    if (node && node->hasTagName(canvasTag))
+        return ImageRole;
+    
     if (m_renderer->isRenderView())
         return WebAreaRole;
     
@@ -2118,7 +2254,7 @@ AccessibilityRole AccessibilityRenderObject::roleValue() const
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel(m_renderer->element()) != 0)
+    if (headingLevel(m_renderer->node()) != 0)
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2158,12 +2294,18 @@ bool AccessibilityRenderObject::ariaRoleHasPresentationalChildren() const
 
 bool AccessibilityRenderObject::canSetFocusAttribute() const
 {
+    ASSERT(m_renderer);
+    Node* node = m_renderer->node();
+
     // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
     // do anything.  For example, it setFocusedNode() will do nothing if the current focused
     // node will not relinquish the focus.
-    if (!m_renderer->element() || !m_renderer->element()->isEnabled())
+    if (!node || !node->isElementNode())
         return false;
-    
+
+    if (!static_cast<Element*>(node)->isEnabledFormControl())
+        return false;
+
     switch (roleValue()) {
         case WebCoreLinkRole:
         case ImageMapLinkRole:
@@ -2194,12 +2336,20 @@ bool AccessibilityRenderObject::canSetTextRangeAttributes() const
 
 void AccessibilityRenderObject::childrenChanged()
 {
-    clearChildren();
+    // this method is meant as a quick way of marking dirty
+    // a portion of the accessibility tree
     
-    if (accessibilityIsIgnored()) {
-        AccessibilityObject* parent = parentObject();
-        if (parent)
-            parent->childrenChanged();
+    markChildrenDirty();
+    
+    if (!m_renderer)
+        return;
+    
+    // Go up the render parent chain, marking children as dirty.
+    // We can't rely on the accessibilityParent() because it may not exist and we must not create an AX object here either
+    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+        AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
+        if (parent && parent->isAccessibilityRenderObject())
+            static_cast<AccessibilityRenderObject *>(parent)->markChildrenDirty();
     }
 }
     
@@ -2223,6 +2373,11 @@ bool AccessibilityRenderObject::canHaveChildren() const
 
 const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
 {
+    if (m_childrenDirty) {
+        clearChildren();        
+        m_childrenDirty = false;
+    }
+    
     if (!m_haveChildren)
         addChildren();
     return m_children;
@@ -2258,13 +2413,13 @@ void AccessibilityRenderObject::addChildren()
     
     // for a RenderImage, add the <area> elements as individual accessibility objects
     if (m_renderer->isRenderImage()) {
-        HTMLMapElement* map = static_cast<RenderImage*>(m_renderer)->imageMap();
+        HTMLMapElement* map = toRenderImage(m_renderer)->imageMap();
         if (map) {
             for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
 
                 // add an <area> element for this child if it has a link
                 if (current->isLink()) {
-                    AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->get(ImageMapLinkRole));
+                    AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->getOrCreate(ImageMapLinkRole));
                     areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(current));
                     areaObject->setHTMLMapElement(map);
                     areaObject->setParent(this);
@@ -2281,7 +2436,7 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
     AccessibilityObject* child = firstChild();
     bool isMultiselectable = false;
     
-    Element* element = static_cast<Element*>(renderer()->element());        
+    Element* element = static_cast<Element*>(renderer()->node());        
     if (!element || !element->isElementNode()) // do this check to ensure safety of static_cast above
         return;
 
@@ -2295,7 +2450,7 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
         if (child->isAccessibilityRenderObject())
             childRenderer = static_cast<AccessibilityRenderObject*>(child)->renderer();
         if (childRenderer && ariaRole == ListBoxOptionRole) {
-            Element* childElement = static_cast<Element*>(childRenderer->element());
+            Element* childElement = static_cast<Element*>(childRenderer->node());
             if (childElement && childElement->isElementNode()) { // do this check to ensure safety of static_cast above
                 String selectedAttrString = childElement->getAttribute("aria-selected").string();
                 if (equalIgnoringCase(selectedAttrString, "true")) {
@@ -2345,15 +2500,6 @@ void AccessibilityRenderObject::visibleChildren(AccessibilityChildrenVector& res
     return ariaListboxVisibleChildren(result);
 }
  
-void AccessibilityRenderObject::removeAXObjectID()
-{
-    if (!m_id)
-        return;
-#if PLATFORM(MAC)
-    m_renderer->document()->axObjectCache()->removeAXID(this);
-#endif
-}   
-    
 const String& AccessibilityRenderObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -2383,5 +2529,11 @@ const String& AccessibilityRenderObject::actionVerb() const
     }
 }
      
+void AccessibilityRenderObject::updateBackingStore()
+{
+    if (!m_renderer)
+        return;
+    m_renderer->view()->layoutIfNeeded();
+}    
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index 9d43ad824d..3fa88a2c7b 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -50,7 +50,8 @@ class Node;
 class RenderObject;
 class RenderListBox;
 class RenderTextControl;
-class Selection;
+class RenderView;
+class VisibleSelection;
 class String;
 class Widget;
     
@@ -76,6 +77,7 @@ public:
     virtual bool isWebArea() const;
     virtual bool isCheckboxOrRadio() const;
     virtual bool isFileUploadButton() const;
+    virtual bool isInputImage() const;
     virtual bool isProgressIndicator() const;
     virtual bool isSlider() const;
     virtual bool isMenuRelated() const;
@@ -123,8 +125,10 @@ public:
     virtual AccessibilityObject* previousSibling() const;
     virtual AccessibilityObject* nextSibling() const;
     virtual AccessibilityObject* parentObject() const;
+    virtual AccessibilityObject* parentObjectIfExists() const;
     virtual AccessibilityObject* observableObject() const;
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
+    virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
@@ -146,7 +150,7 @@ public:
     
     void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
     RenderObject* renderer() const { return m_renderer; }
-    RenderObject* topRenderer() const;
+    RenderView* topRenderer() const;
     RenderTextControl* textControl() const;
     Document* document() const;
     FrameView* topDocumentFrameView() const;  
@@ -154,7 +158,7 @@ public:
     
     virtual KURL url() const;
     virtual PlainTextRange selectedTextRange() const;
-    virtual Selection selection() const;
+    virtual VisibleSelection selection() const;
     virtual String stringValue() const;
     virtual String ariaAccessiblityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
@@ -208,12 +212,14 @@ public:
     virtual String doAXStringForRange(const PlainTextRange&) const;
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const;
     
+    virtual void updateBackingStore();
+    
 protected:
     RenderObject* m_renderer;
     AccessibilityRole m_ariaRole;
+    mutable bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
-    virtual void removeAXObjectID();
     
     virtual bool isDetached() const { return !m_renderer; }
 
@@ -228,8 +234,10 @@ private:
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
+    AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
+    void markChildrenDirty() const { m_childrenDirty = true; }
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
index ee54496673..6d7dbe2ba9 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
@@ -53,13 +53,11 @@ AccessibilityTable::AccessibilityTable(RenderObject* renderer)
     : AccessibilityRenderObject(renderer),
     m_headerContainer(0)
 {
-    // FIXME: We need to disable Accessibility Tables entirely on the Mac until <rdar://problem/6372481> is resolved.
-#if PLATFORM(MAC)
-    m_isAccessibilityTable = false;
-#else    
+#if ACCESSIBILITY_TABLES
     m_isAccessibilityTable = isTableExposableThroughAccessibility();
+#else
+    m_isAccessibilityTable = false;
 #endif
-
 }
 
 AccessibilityTable::~AccessibilityTable()
@@ -83,8 +81,6 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     // if the developer assigned an aria role to this, then we shouldn't 
     // expose it as a table, unless, of course, the aria role is a table
     AccessibilityRole ariaRole = ariaRoleAttribute();
-    if (ariaRole == TableRole)
-        return true;
     if (ariaRole != UnknownRole)
         return false;
     
@@ -95,7 +91,7 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     // Unfortunately, there is no good way to determine the difference
     // between a "layout" table and a "data" table
     
-    Node* tableNode = table->element();
+    Node* tableNode = table->node();
     if (!tableNode || !tableNode->hasTagName(tableTag))
         return false;
     
@@ -141,7 +137,7 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             RenderTableCell* cell = firstBody->cellAt(row, col).cell;
             if (!cell)
                 continue;
-            Node* cellNode = cell->element();
+            Node* cellNode = cell->node();
             if (!cellNode)
                 continue;
             
@@ -213,7 +209,7 @@ void AccessibilityTable::addChildren()
     ASSERT(!m_haveChildren); 
     
     m_haveChildren = true;
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTable())
         return;
     
     RenderTable* table = static_cast<RenderTable*>(m_renderer);
@@ -243,7 +239,7 @@ void AccessibilityTable::addChildren()
                 if (!cell)
                     continue;
                 
-                AccessibilityObject* rowObject = axCache->get(cell->parent());
+                AccessibilityObject* rowObject = axCache->getOrCreate(cell->parent());
                 if (!rowObject->isTableRow())
                     continue;
                 
@@ -266,7 +262,7 @@ void AccessibilityTable::addChildren()
     // make the columns based on the number of columns in the first body
     unsigned length = initialTableSection->numColumns();
     for (unsigned i = 0; i < length; ++i) {
-        AccessibilityTableColumn* column = static_cast<AccessibilityTableColumn*>(axCache->get(ColumnRole));
+        AccessibilityTableColumn* column = static_cast<AccessibilityTableColumn*>(axCache->getOrCreate(ColumnRole));
         column->setColumnIndex((int)i);
         column->setParentTable(this);
         m_columns.append(column);
@@ -283,7 +279,7 @@ AccessibilityObject* AccessibilityTable::headerContainer()
     if (m_headerContainer)
         return m_headerContainer;
     
-    m_headerContainer = static_cast<AccessibilityTableHeaderContainer*>(axObjectCache()->get(TableHeaderContainerRole));
+    m_headerContainer = static_cast<AccessibilityTableHeaderContainer*>(axObjectCache()->getOrCreate(TableHeaderContainerRole));
     m_headerContainer->setParentTable(this);
     
     return m_headerContainer;
@@ -354,7 +350,7 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     }
 }
     
-const unsigned AccessibilityTable::columnCount()
+unsigned AccessibilityTable::columnCount()
 {
     if (!hasChildren())
         addChildren();
@@ -362,7 +358,7 @@ const unsigned AccessibilityTable::columnCount()
     return m_columns.size();    
 }
     
-const unsigned AccessibilityTable::rowCount()
+unsigned AccessibilityTable::rowCount()
 {
     if (!hasChildren())
         addChildren();
@@ -372,7 +368,7 @@ const unsigned AccessibilityTable::rowCount()
     
 AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column, unsigned row)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTable())
         return 0;
     
     if (!hasChildren())
@@ -388,11 +384,13 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     unsigned rowOffset = 0;
     while (tableSection) {
         
-        rowCount += tableSection->numRows();
+        unsigned numRows = tableSection->numRows();
         unsigned numCols = tableSection->numColumns();
         
-        if (row < rowCount && column < numCols) {
-            int sectionSpecificRow = row - rowOffset;
+        rowCount += numRows;
+        
+        unsigned sectionSpecificRow = row - rowOffset;            
+        if (row < rowCount && column < numCols && sectionSpecificRow < numRows) {
             cell = tableSection->cellAt(sectionSpecificRow, column).cell;
             
             // we didn't find the cell, which means there's spanning happening
@@ -424,9 +422,9 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
         if (cell)
             break;
         
-        rowOffset += rowCount;
+        rowOffset += numRows;
         // we didn't find anything between the rows we should have
-        if (row < rowOffset)
+        if (row < rowCount)
             break;
         tableSection = table->sectionBelow(tableSection, true);        
     }
@@ -434,7 +432,7 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     if (!cell)
         return 0;
     
-    AccessibilityObject* cellObject = axObjectCache()->get(cell);
+    AccessibilityObject* cellObject = axObjectCache()->getOrCreate(cell);
     ASSERT(cellObject->isTableCell());
     
     return static_cast<AccessibilityTableCell*>(cellObject);
@@ -466,8 +464,8 @@ String AccessibilityTable::title() const
         return title;
     
     // see if there is a caption
-    Node *tableElement = m_renderer->element();
-    if (tableElement) {
+    Node* tableElement = m_renderer->node();
+    if (tableElement && tableElement->hasTagName(tableTag)) {
         HTMLTableCaptionElement* caption = static_cast<HTMLTableElement*>(tableElement)->caption();
         if (caption)
             title = caption->innerText();
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
index b98b6b7bc8..b6aa3cac9e 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
@@ -31,6 +31,12 @@
 
 #include "AccessibilityRenderObject.h"
 
+#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
+#define ACCESSIBILITY_TABLES 0
+#else
+#define ACCESSIBILITY_TABLES 1
+#endif
+
 namespace WebCore {
 
 class String;
@@ -39,7 +45,7 @@ class AccessibilityTableHeaderContainer;
     
 class AccessibilityTable : public AccessibilityRenderObject {
 
-private:
+protected:
     AccessibilityTable(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTable> create(RenderObject*);
@@ -47,6 +53,7 @@ public:
     
     virtual bool isDataTable() const;
     virtual AccessibilityRole roleValue() const;
+    virtual bool isAriaTable() const { return false; }
     
     virtual bool accessibilityIsIgnored() const;
     
@@ -56,14 +63,14 @@ public:
     AccessibilityChildrenVector& columns();
     AccessibilityChildrenVector& rows();
     
-    const unsigned columnCount();
-    const unsigned rowCount();
+    unsigned columnCount();
+    unsigned rowCount();
     
     virtual String title() const;
     
     // all the cells in the table
     void cells(AccessibilityChildrenVector&);
-    AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
+    virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
     
     void columnHeaders(AccessibilityChildrenVector&);
     void rowHeaders(AccessibilityChildrenVector&);
@@ -71,7 +78,7 @@ public:
     // an object that contains, as children, all the objects that act as headers
     AccessibilityObject* headerContainer();
     
-private:    
+protected:    
     AccessibilityChildrenVector m_rows;
     AccessibilityChildrenVector m_columns;
     
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
index ff82811c19..4d7cf5a769 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -61,14 +61,19 @@ bool AccessibilityTableCell::accessibilityIsIgnored() const
     
     return false;
 }
-    
-bool AccessibilityTableCell::isTableCell() const
+   
+AccessibilityObject* AccessibilityTableCell::parentTable() const
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return false;
     
-    AccessibilityObject* renderTable = axObjectCache()->get(static_cast<RenderTableCell*>(m_renderer)->table());
-    if (!renderTable->isDataTable())
+    return axObjectCache()->getOrCreate(static_cast<RenderTableCell*>(m_renderer)->table());
+}
+    
+bool AccessibilityTableCell::isTableCell() const
+{
+    AccessibilityObject* table = parentTable();
+    if (!table || !table->isDataTable())
         return false;
     
     return true;
@@ -84,7 +89,7 @@ AccessibilityRole AccessibilityTableCell::roleValue() const
     
 void AccessibilityTableCell::rowIndexRange(pair<int, int>& rowRange)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -114,7 +119,7 @@ void AccessibilityTableCell::rowIndexRange(pair<int, int>& rowRange)
     
 void AccessibilityTableCell::columnIndexRange(pair<int, int>& columnRange)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -127,7 +132,7 @@ AccessibilityObject* AccessibilityTableCell::titleUIElement() const
     // Try to find if the first cell in this row is a <th>. If it is,
     // then it can act as the title ui element. (This is only in the
     // case when the table is not appearing as an AXTable.)
-    if (!m_renderer || isTableCell())
+    if (isTableCell() || !m_renderer || !m_renderer->isTableCell())
         return 0;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -147,11 +152,11 @@ AccessibilityObject* AccessibilityTableCell::titleUIElement() const
     if (!headerCell || headerCell == renderCell)
         return 0;
 
-    Node* cellElement = headerCell->element();
+    Node* cellElement = headerCell->node();
     if (!cellElement || !cellElement->hasTagName(thTag))
         return 0;
     
-    return axObjectCache()->get(headerCell);
+    return axObjectCache()->getOrCreate(headerCell);
 }
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.h
index 8f8dd77ccf..dabbce2049 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.h
@@ -35,7 +35,7 @@ namespace WebCore {
     
 class AccessibilityTableCell : public AccessibilityRenderObject {
     
-private:
+protected:
     AccessibilityTableCell(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableCell> create(RenderObject*);
@@ -47,17 +47,17 @@ public:
     virtual bool accessibilityIsIgnored() const;
 
     // fills in the start location and row span of cell
-    void rowIndexRange(pair<int, int>& rowRange);
+    virtual void rowIndexRange(pair<int, int>& rowRange);
     // fills in the start location and column span of cell
-    void columnIndexRange(pair<int, int>& columnRange);
+    virtual void columnIndexRange(pair<int, int>& columnRange);
     
     // if a table cell is not exposed as a table cell, a TH element can
     // serve as its title ui element
     AccessibilityObject* titleUIElement() const;
     
-private:
+protected:
+    virtual AccessibilityObject* parentTable() const;
     int m_rowIndex;
-    
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
index 6e03af9f9a..ee79444581 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -61,7 +61,6 @@ void AccessibilityTableColumn::setParentTable(AccessibilityTable* table)
     m_parentTable = table;
     
     clearChildren();
-    addChildren();
 }
     
 IntRect AccessibilityTableColumn::elementRect() const
@@ -87,7 +86,26 @@ AccessibilityObject* AccessibilityTableColumn::headerObject()
     if (!m_parentTable)
         return 0;
     
-    RenderTable* table = static_cast<RenderTable*>(m_parentTable->renderer());
+    RenderObject* renderer = m_parentTable->renderer();
+    if (!renderer)
+        return 0;
+    
+    if (m_parentTable->isAriaTable()) {
+        AccessibilityChildrenVector rowChildren = children();
+        unsigned childrenCount = rowChildren.size();
+        for (unsigned i = 0; i < childrenCount; ++i) {
+            AccessibilityObject* cell = rowChildren[i].get();
+            if (cell->ariaRoleAttribute() == ColumnHeaderRole)
+                return cell;
+        }
+        
+        return 0;
+    }
+
+    if (!renderer->isTable())
+        return 0;
+    
+    RenderTable* table = static_cast<RenderTable*>(renderer);
     
     AccessibilityObject* headerObject = 0;
     
@@ -124,7 +142,7 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
         if ((testCell->col() + (testCell->colSpan()-1)) < m_columnIndex)
             break;
         
-        Node* node = testCell->element();
+        Node* node = testCell->node();
         if (!node)
             continue;
         
@@ -137,7 +155,7 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
     if (!cell)
         return 0;
 
-    return m_parentTable->axObjectCache()->get(cell);
+    return m_parentTable->axObjectCache()->getOrCreate(cell);
 }
     
 void AccessibilityTableColumn::addChildren()
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
index 62703980ab..62703980ab 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
index af9de39805..af9de39805 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
index 8a9448a5db..8a9448a5db 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
index caccff57ae..9f5f972927 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -67,11 +67,8 @@ AccessibilityRole AccessibilityTableRow::roleValue() const
 
 bool AccessibilityTableRow::isTableRow() const
 {
-    if (!m_renderer)
-        return true;
-    
-    AccessibilityObject* renderTable = axObjectCache()->get(static_cast<RenderTableRow*>(m_renderer)->table());
-    if (!renderTable->isDataTable())
+    AccessibilityObject* table = parentTable();
+    if (!table || !table->isDataTable())
         return false;
     
     return true;
@@ -85,8 +82,19 @@ bool AccessibilityTableRow::accessibilityIsIgnored() const
     return false;
 }
     
+AccessibilityObject* AccessibilityTableRow::parentTable() const
+{
+    if (!m_renderer || !m_renderer->isTableRow())
+        return 0;
+    
+    return axObjectCache()->getOrCreate(static_cast<RenderTableRow*>(m_renderer)->table());
+}
+    
 AccessibilityObject* AccessibilityTableRow::headerObject()
 {
+    if (!m_renderer || !m_renderer->isTableRow())
+        return 0;
+    
     AccessibilityChildrenVector rowChildren = children();
     if (!rowChildren.size())
         return 0;
@@ -100,7 +108,7 @@ AccessibilityObject* AccessibilityTableRow::headerObject()
     if (!cellRenderer)
         return 0;
     
-    Node* cellNode = cellRenderer->element();
+    Node* cellNode = cellRenderer->node();
     if (!cellNode || !cellNode->hasTagName(thTag))
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.h
index 0ec7f0404f..29ac935c95 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.h
@@ -35,7 +35,7 @@ namespace WebCore {
     
 class AccessibilityTableRow : public AccessibilityRenderObject {
     
-private:
+protected:
     AccessibilityTableRow(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableRow> create(RenderObject*);
@@ -43,11 +43,11 @@ public:
     
     virtual bool isTableRow() const;
     virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
     // retrieves the "row" header (a th tag in the rightmost column)
-    AccessibilityObject* headerObject();
-
-    virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityObject* headerObject();
+    virtual AccessibilityObject* parentTable() const;
     
     void setRowIndex(int rowIndex) { m_rowIndex = rowIndex; }
     int rowIndex() const { return m_rowIndex; }
diff --git a/src/3rdparty/webkit/WebCore/page/qt/AccessibilityObjectQt.cpp b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
index 17100274f4..17100274f4 100644
--- a/src/3rdparty/webkit/WebCore/page/qt/AccessibilityObjectQt.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
index ceb7928af1..db295c2b8e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
@@ -65,7 +65,7 @@ GCController::GCController()
 void GCController::garbageCollectSoon()
 {
     if (!m_GCTimer.isActive())
-        m_GCTimer.startOneShot(0);
+        m_GCTimer.startOneShot(0.5);
 }
 
 void GCController::gcTimerFired(Timer<GCController>*)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index a97d0397f2..4f3c8ee106 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -40,14 +40,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-void JSAttr::setValue(ExecState* exec, JSValuePtr value)
+void JSAttr::setValue(ExecState* exec, JSValue value)
 {
     Attr* imp = static_cast<Attr*>(impl());
     String attrValue = valueToStringWithNullCheck(exec, value);
 
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
-        if (equalIgnoringCase(imp->name(), "src") && protocolIs(parseURL(attrValue), "javascript")) {
+        if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(parseURL(attrValue))) {
             if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
                 return;
         }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index eed5b2ea63..74bcad5ec6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -41,22 +41,33 @@ namespace WebCore {
 
 const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", 0, 0, 0 };
 
-JSAudioConstructor::JSAudioConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSAudioConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
+    putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
+Document* JSAudioConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
+}
+
 static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, static_cast<JSAudioConstructor*>(constructor)->document());
+    Document* document = static_cast<JSAudioConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
+
+    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
     if (args.size() > 0) {
-        audio->setSrc(args.at(exec, 0)->toString(exec));
+        audio->setSrc(args.at(0).toString(exec));
         audio->scheduleLoad();
     }
     return asObject(toJS(exec, audio.release()));
@@ -71,8 +82,8 @@ ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
 void JSAudioConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
index cdff10f1d1..0a3a7ea000 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
@@ -36,9 +36,9 @@ namespace WebCore {
 
     class JSAudioConstructor : public DOMObject {
     public:
-        JSAudioConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSAudioConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        Document* document() const { return m_document->impl(); }
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
 
@@ -48,7 +48,7 @@ namespace WebCore {
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp
new file mode 100644
index 0000000000..44a8957bd9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCDATASection.h"
+
+#include "CDATASection.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue toJSNewlyCreated(ExecState* exec, CDATASection* section)
+{
+    if (!section)
+        return jsNull();
+    
+    return CREATE_DOM_NODE_WRAPPER(exec, CDATASection, section);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 32462fa24b..2c204315dc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -49,7 +49,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSRule* rule)
+JSValue toJS(ExecState* exec, CSSRule* rule)
 {
     if (!rule)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 6c46ae4636..b07f2018f0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -77,7 +77,7 @@ static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPo
         return String();
 
     Vector<UChar> name;
-    name.reserveCapacity(length);
+    name.reserveInitialCapacity(length);
 
     unsigned i = 0;
 
@@ -127,7 +127,7 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
 
 // FIXME: You can get these properties, and set them (see customPut below),
 // but you should also be able to enumerate them.
-JSValuePtr JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
 
@@ -156,7 +156,7 @@ JSValuePtr JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier&
 }
 
 
-bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (!isCSSPropertyName(propertyName))
         return false;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
index 9e313043b9..ad0cee1cd2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSValue* value)
+JSValue toJS(ExecState* exec, CSSValue* value)
 {
     if (!value)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 6eb4fc55f6..76db8718de 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValuePtr toJS(ExecState* exec, CanvasStyle* style)
+static JSValue toJS(ExecState* exec, CanvasStyle* style)
 {
     if (style->canvasGradient())
         return toJS(exec, style->canvasGradient());
@@ -49,11 +49,11 @@ static JSValuePtr toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValuePtr value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 {
-    if (value->isString())
+    if (value.isString())
         return CanvasStyle::create(asString(value)->value());
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
     if (object->inherits(&JSCanvasGradient::s_info))
@@ -63,27 +63,27 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValuePtr value)
     return 0;
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->strokeStyle());        
 }
 
-void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
     impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->fillStyle());
 }
 
-void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
     impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
     CanvasRenderingContext2D* context = impl();
 
@@ -95,24 +95,24 @@ JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgLi
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0)->isString())
-                context->setFillColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value());
             else
-                context->setFillColor(args.at(exec, 0)->toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0)->isString())
-                context->setFillColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -120,7 +120,7 @@ JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgLi
     return jsUndefined();
 }    
 
-JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -132,24 +132,24 @@ JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const Arg
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0)->isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value());
             else
-                context->setStrokeColor(args.at(exec, 0)->toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0)->isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -158,21 +158,21 @@ JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const Arg
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
     if (args.size() <= 4)
-        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
 
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -182,8 +182,8 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
     //     drawImage(img, sx, sy, sw, sh, dx, dy, dw, dh)
     // Composite operation is specified with globalCompositeOperation.
     // The img parameter can be a <img> or <canvas> element.
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
     
@@ -192,18 +192,18 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
         HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(imgElt, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
-                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                context->drawImage(imgElt, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
@@ -213,18 +213,18 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
         HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(canvas, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
-                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                context->drawImage(canvas, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
@@ -237,64 +237,64 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
     
     if (!o->inherits(&JSHTMLImageElement::s_info))
         return throwError(exec, TypeError);
     context->drawImageFromRect(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                               args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                               args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec),
-                               args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                               args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec),
-                               args.at(exec, 9)->toString(exec));    
+                               args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                               args.at(3).toFloat(exec), args.at(4).toFloat(exec),
+                               args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                               args.at(7).toFloat(exec), args.at(8).toFloat(exec),
+                               args.at(9).toString(exec));    
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
     switch (args.size()) {
         case 3:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec));
             break;
         case 4:
-            if (args.at(exec, 3)->isString())
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value());
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
             else
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            if (args.at(exec, 3)->isString())
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value(),
-                                   args.at(exec, 4)->toFloat(exec));
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(4).toFloat(exec));
             else
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                                   args.at(exec, 4)->toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                                   args.at(4).toFloat(exec));
             break;
         case 7:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
-                               args.at(exec, 6)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec));
             break;
         case 8:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
-                               args.at(exec, 6)->toFloat(exec), args.at(exec, 7)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec), args.at(7).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -303,28 +303,28 @@ JSValuePtr JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList&
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
 
     if (o->inherits(&JSHTMLImageElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                                   valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                                   valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
     if (o->inherits(&JSHTMLCanvasElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
@@ -332,7 +332,7 @@ JSValuePtr JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgL
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
 {
     // putImageData has two variants
     // putImageData(ImageData, x, y)
@@ -341,16 +341,16 @@ JSValuePtr JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgLi
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), 
-                              args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), 
+                              args.at(3).toFloat(exec), args.at(4).toFloat(exec), args.at(5).toFloat(exec), args.at(6).toFloat(exec), ec);
     else
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), ec);
 
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -362,13 +362,13 @@ JSValuePtr JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList&
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -380,9 +380,9 @@ JSValuePtr JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
index 8ffb49e4bd..78dca49f8e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,7 +48,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-JSValuePtr JSClipboard::types(ExecState* exec) const
+JSValue JSClipboard::types(ExecState* exec) const
 {
     Clipboard* clipboard = impl();
 
@@ -56,14 +56,14 @@ JSValuePtr JSClipboard::types(ExecState* exec) const
     if (types.isEmpty())
         return jsNull();
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     HashSet<String>::const_iterator end = types.end();
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
         list.append(jsString(exec, UString(*it)));
     return constructArray(exec, list);
 }
 
-JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::clearData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -73,7 +73,7 @@ JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
     }
 
     if (args.size() == 1) {
-        clipboard->clearData(args.at(exec, 0)->toString(exec));
+        clipboard->clearData(args.at(0).toString(exec));
         return jsUndefined();
     }
 
@@ -81,7 +81,7 @@ JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
     return throwError(exec, SyntaxError, "clearData: Invalid number of arguments");
 }
 
-JSValuePtr JSClipboard::getData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::getData(ExecState* exec, const ArgList& args)
 {
     // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments.
     if (args.size() != 1)
@@ -90,14 +90,14 @@ JSValuePtr JSClipboard::getData(ExecState* exec, const ArgList& args)
     Clipboard* clipboard = impl();
 
     bool success;
-    String result = clipboard->getData(args.at(exec, 0)->toString(exec), success);
+    String result = clipboard->getData(args.at(0).toString(exec), success);
     if (!success)
         return jsUndefined();
 
     return jsString(exec, result);
 }
 
-JSValuePtr JSClipboard::setData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -105,10 +105,10 @@ JSValuePtr JSClipboard::setData(ExecState* exec, const ArgList& args)
     if (args.size() != 2)
         return throwError(exec, SyntaxError, "setData: Invalid number of arguments");
 
-    return jsBoolean(clipboard->setData(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec)));
+    return jsBoolean(clipboard->setData(args.at(0).toString(exec), args.at(1).toString(exec)));
 }
 
-JSValuePtr JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -119,11 +119,11 @@ JSValuePtr JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
     if (args.size() != 3)
         return throwError(exec, SyntaxError, "setDragImage: Invalid number of arguments");
 
-    int x = args.at(exec, 1)->toInt32(exec);
-    int y = args.at(exec, 2)->toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
 
     // See if they passed us a node
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
     if (!node)
         return throwError(exec, TypeError);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
index ddfe4f7338..9c484673d8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -34,12 +34,14 @@ using namespace JSC;
 
 namespace WebCore {
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
 
-JSValuePtr JSConsole::profiles(ExecState* exec) const
+JSValue JSConsole::profiles(ExecState* exec) const
 {
     const ProfilesArray& profiles = impl()->profiles();
-    ArgList list;
+    MarkedArgumentBuffer list;
 
     ProfilesArray::const_iterator end = profiles.end();
     for (ProfilesArray::const_iterator iter = profiles.begin(); iter != end; ++iter)
@@ -48,4 +50,6 @@ JSValuePtr JSConsole::profiles(ExecState* exec) const
     return constructArray(exec, list);
 }
 
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp
new file mode 100644
index 0000000000..720bb9b95c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCoordinates.h"
+
+#include "Coordinates.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+JSValue JSCoordinates::altitude(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitude())
+        return jsNull();
+    return jsNumber(exec, imp->altitude());
+}
+
+JSValue JSCoordinates::altitudeAccuracy(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitudeAccuracy())
+        return jsNull();
+    return jsNumber(exec, imp->altitudeAccuracy());
+}
+
+JSValue JSCoordinates::heading(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideHeading())
+        return jsNull();
+    return jsNumber(exec, imp->heading());
+}
+
+JSValue JSCoordinates::speed(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideSpeed())
+        return jsNull();
+    return jsNumber(exec, imp->speed());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index 836ffb9857..6f9efd9f9c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -26,10 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionCallback.h"
 
-#include "CString.h"
 #include "Frame.h"
 #include "JSGeoposition.h"
-#include "Page.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -56,9 +54,9 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -70,17 +68,19 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     
     RefPtr<JSCustomPositionCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, geoposition));
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException()) {
         reportCurrentException(exec);
         raisedException = true;
     }
+    
+    Document::updateStyleForAllDocuments();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index b4e9535f64..cc6cd55637 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -26,10 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionErrorCallback.h"
 
-#include "CString.h"
 #include "Frame.h"
 #include "JSPositionError.h"
-#include "Page.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -56,9 +54,9 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -70,15 +68,17 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     
     RefPtr<JSCustomPositionErrorCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, positionError));
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException())
         reportCurrentException(exec);
+    
+    Document::updateStyleForAllDocuments();
 }
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index 2243564b8e..107a49118c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,9 +28,8 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+#if ENABLE(DATABASE)
 
-#include "CString.h"
-#include "DOMWindow.h"
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLResultSet.h"
@@ -60,9 +59,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
         
     JSC::JSLock lock(false);
 
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -74,13 +73,13 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, resultSet));
         
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -88,7 +87,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
         raisedException = true;
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index 3a3ae211f3..c380670ed6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLStatementCallback_h
 #define JSCustomSQLStatementCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLStatementCallback.h"
 
 #include <runtime/JSObject.h>
@@ -59,4 +61,6 @@ private:
 
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLStatementCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 14080ea503..018dabdf10 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "JSCustomSQLStatementErrorCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLError.h"
@@ -60,9 +60,9 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
     CallType callbackCallType = CallTypeNone;
 
@@ -76,17 +76,17 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, error));
         
-    JSValuePtr result;
-    globalObject->startTimeoutCheck();
+    JSValue result;
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
     else
         result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -98,9 +98,11 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         return true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
-    return result->toBoolean(exec);
+    return result.toBoolean(exec);
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index 2847114ff0..e563393166 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLStatementErrorCallback_h
 #define JSCustomSQLStatementErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLStatementErrorCallback.h"
 
 #include <runtime/JSObject.h>
@@ -59,5 +61,7 @@ private:
     
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLStatementErrorCallback_h
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 7910a88477..a41ac78797 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -29,10 +29,9 @@
 #include "config.h"
 #include "JSCustomSQLTransactionCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
-#include "Logging.h"
 #include "ScriptController.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
@@ -101,9 +100,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
     CallType callbackCallType = CallTypeNone;
 
@@ -117,15 +116,15 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
 
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
     else
         call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -133,7 +132,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         raisedException = true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
     
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 0a21c1a9c1..22c367c148 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLTransactionCallback_h
 #define JSCustomSQLTransactionCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLTransactionCallback.h"
 
 #include <wtf/PassRefPtr.h>
@@ -60,4 +62,6 @@ private:
 
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLTransactionCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 7f95d4cea4..324e2bb6fa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "JSCustomSQLTransactionErrorCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLError.h"
@@ -46,47 +46,46 @@ JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObjec
 {
 }
     
-bool JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
 {
     ASSERT(m_callback);
     ASSERT(m_frame);
-        
+
     if (!m_frame->script()->isEnabled())
-        return true;
-        
+        return;
+
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
-        
+
     JSC::JSLock lock(false);
-        
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Should an exception be thrown here?
-            return true;
+            return;
         }
         function = m_callback;
     }
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
-        
-    ArgList args;
+
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, error));
 
-    JSValuePtr result;
-    globalObject->startTimeoutCheck();
-    result = call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
-        
+    globalObject->globalData()->timeoutChecker.start();
+    call(exec, function, callType, callData, m_callback, args);
+    globalObject->globalData()->timeoutChecker.stop();
+
     if (exec->hadException())
         reportCurrentException(exec);
-        
-    Document::updateDocumentsRendering();
-    
-    return result->toBoolean(exec);
+
+    Document::updateStyleForAllDocuments();
 }
-    
+
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index 122224fa8f..be3df29de5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLTransactionErrorCallback_h
 #define JSCustomSQLTransactionErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLTransactionErrorCallback.h"
 
 #include <runtime/JSObject.h>
@@ -48,7 +50,7 @@ class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
     static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
     
-    virtual bool handleEvent(SQLError*);
+    virtual void handleEvent(SQLError*);
 
 private:
     JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
@@ -58,5 +60,6 @@ private:
 };
 
 }
+#endif // ENABLE(DATABASE)
 
 #endif // JSCustomSQLTransactionErrorCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 527fa41e6f..f3f76c428b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -29,11 +29,8 @@
 #include "config.h"
 #include "JSCustomVoidCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
 #include "Frame.h"
 #include "JSDOMWindowCustom.h"
-#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -60,9 +57,9 @@ void JSCustomVoidCallback::handleEvent()
         
     JSC::JSLock lock(false);
         
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -74,21 +71,21 @@ void JSCustomVoidCallback::handleEvent()
         
     RefPtr<JSCustomVoidCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException())
         reportCurrentException(exec);
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
  
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValuePtr value)
+PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
 {
-    JSObject* object = value->getObject();
+    JSObject* object = value.getObject();
     if (!object)
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
index f54ddb600a..9cd7c34ead 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -55,7 +55,7 @@ namespace WebCore {
         RefPtr<Frame> m_frame;
     };
 
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValuePtr);
+    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 8451dd0ef5..6361e70749 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -28,14 +28,10 @@
 
 #if ENABLE(XPATH)
 
-#include "CString.h"
-#include "Console.h"
-#include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMWindowCustom.h"
-#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -43,12 +39,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValuePtr value)
+PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         return 0;
 
-    JSObject* resolverObject = value->getObject();
+    JSObject* resolverObject = value.getObject();
     if (!resolverObject) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
@@ -81,9 +77,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
         
-    JSValuePtr function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
+    JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -96,22 +92,22 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 
     RefPtr<JSCustomXPathNSResolver> selfProtector(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->startTimeoutCheck();
-    JSValuePtr retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
+    JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
+    globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
         reportCurrentException(exec);
     else {
-        if (!retval->isUndefinedOrNull())
-            result = retval->toString(exec);
+        if (!retval.isUndefinedOrNull())
+            result = retval.toString(exec);
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
index fecbb61ad8..44c44f9643 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -44,7 +44,7 @@ namespace WebCore {
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
-        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValuePtr);
+        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValue);
         
         virtual ~JSCustomXPathNSResolver();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 5e867a1c22..7e8d9ce633 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,44 +46,32 @@ void JSDOMApplicationCache::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onchecking()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onnoupdate()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->ondownloading()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onupdateready()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->oncached()))
-        listener->mark();
+    markIfNotNull(m_impl->onchecking());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onnoupdate());
+    markIfNotNull(m_impl->ondownloading());
+    markIfNotNull(m_impl->onprogress());
+    markIfNotNull(m_impl->onupdateready());
+    markIfNotNull(m_impl->oncached());
+    markIfNotNull(m_impl->onobsolete());
 
     typedef DOMApplicationCache::EventListenersMap EventListenersMap;
     typedef DOMApplicationCache::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
+#if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
+
+JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
 
     ExceptionCode ec = 0;
     bool result = impl()->hasItem(url, ec);
@@ -91,12 +79,12 @@ JSValuePtr JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
     return jsBoolean(result);
 }
 
-JSValuePtr JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->add(url, ec);
@@ -104,12 +92,12 @@ JSValuePtr JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->remove(url, ec);
@@ -117,27 +105,29 @@ JSValuePtr JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
+#endif // ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
+
+JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 4cf083ac05..4f587971d6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
  *
  *  This library is free software; you can redistribute it and/or
@@ -33,6 +33,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLImageElement.h"
+#include "HTMLScriptElement.h"
 #include "HTMLNames.h"
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
@@ -259,32 +260,47 @@ void forgetAllDOMNodesForDocument(Document* document)
     removeWrappers(document->wrapperCache());
 }
 
+static inline bool isObservableThroughDOM(JSNode* jsNode)
+{
+    // Certain conditions implicitly make a JS DOM node wrapper observable
+    // through the DOM, even if no explicit reference to it remains.
+
+    Node* node = jsNode->impl();
+
+    if (node->inDocument()) {
+        // 1. If a node is in the document, and its wrapper has custom properties,
+        // the wrapper is observable because future access to the node through the
+        // DOM must reflect those properties.
+        if (jsNode->hasCustomProperties())
+            return true;
+
+        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // observable because its wrapper is responsible for marking those event listeners.
+        if (node->eventListeners().size())
+            return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+    } else {
+        // 3. If a wrapper is the last reference to an image or script element
+        // that is loading but not in the document, the wrapper is observable
+        // because it is the only thing keeping the image element alive, and if
+        // the image element is destroyed, its load event will not fire.
+        // FIXME: The DOM should manage this issue without the help of JavaScript wrappers.
+        if (node->hasTagName(imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
+            return true;
+        if (node->hasTagName(scriptTag) && !static_cast<HTMLScriptElement*>(node)->haveFiredLoadEvent())
+            return true;
+    }
+
+    return false;
+}
+
 void markDOMNodesForDocument(Document* doc)
 {
-    // If a node's JS wrapper holds custom properties, those properties must
-    // persist every time the node is fetched from the DOM. So, we keep JS
-    // wrappers like that from being garbage collected.
-
     JSWrapperCache& nodeDict = doc->wrapperCache();
     JSWrapperCache::iterator nodeEnd = nodeDict.end();
     for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
         JSNode* jsNode = nodeIt->second;
-        Node* node = jsNode->impl();
-
-        if (jsNode->marked())
-            continue;
-
-        // No need to preserve a wrapper that has no custom properties or is no
-        // longer fetchable through the DOM.
-        if (!jsNode->hasCustomProperties() || !node->inDocument()) {
-            //... unless the wrapper wraps a loading image, since the "new Image"
-            // syntax allows an orphan image wrapper to be the last reference
-            // to a loading image, whose load event might have important side-effects.
-            if (!node->hasTagName(imgTag) || static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
-                continue;
-        }
-
-        jsNode->mark();
+        if (!jsNode->marked() && isObservableThroughDOM(jsNode))
+            jsNode->mark();
     }
 }
 
@@ -340,84 +356,91 @@ void markDOMObjectWrapper(JSGlobalData& globalData, void* object)
     wrapper->mark();
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const String& s)
+JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsNull();
     return jsString(exec, s);
 }
 
-JSValuePtr jsOwnedStringOrNull(ExecState* exec, const UString& s)
+JSValue jsOwnedStringOrNull(ExecState* exec, const UString& s)
 {
     if (s.isNull())
         return jsNull();
     return jsOwnedString(exec, s);
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const String& s)
+JSValue jsStringOrUndefined(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsUndefined();
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const String& s)
+JSValue jsStringOrFalse(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsBoolean(false);
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const KURL& url)
+JSValue jsStringOrNull(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsNull();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const KURL& url)
+JSValue jsStringOrUndefined(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsUndefined();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const KURL& url)
+JSValue jsStringOrFalse(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsBoolean(false);
     return jsString(exec, url.string());
 }
 
-UString valueToStringWithNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithNullCheck(ExecState* exec, JSValue value)
 {
-    if (value->isNull())
+    if (value.isNull())
         return UString();
-    return value->toString(exec);
+    return value.toString(exec);
 }
 
-UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         return UString();
-    return value->toString(exec);
+    return value.toString(exec);
 }
 
-void reportException(JSC::ExecState* exec, JSValuePtr exception)
+void reportException(ExecState* exec, JSValue exception)
 {
-    UString errorMessage = exception->toString(exec);
-    JSObject* exceptionObject = exception->toObject(exec);
-    int lineNumber = exceptionObject->get(exec, Identifier(exec, "line"))->toInt32(exec);
-    UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL"))->toString(exec);
+    UString errorMessage = exception.toString(exec);
+    JSObject* exceptionObject = exception.toObject(exec);
+    int lineNumber = exceptionObject->get(exec, Identifier(exec, "line")).toInt32(exec);
+    UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL")).toString(exec);
     exec->clearException();
 
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    ASSERT(scriptExecutionContext);
+
+    // Crash data indicates null-dereference crashes at this point in the Safari 4 Public Beta.
+    // It's harmless to return here without reporting the exception to the log and the debugger in this case.
+    if (!scriptExecutionContext)
+        return;
+
     scriptExecutionContext->reportException(errorMessage, lineNumber, exceptionSourceURL);
 }
 
-void reportCurrentException(JSC::ExecState* exec)
+void reportCurrentException(ExecState* exec)
 {
-    JSValuePtr exception = exec->exception();
+    JSValue exception = exec->exception();
     exec->clearException();
     reportException(exec, exception);
 }
@@ -430,7 +453,7 @@ void setDOMException(ExecState* exec, ExceptionCode ec)
     ExceptionCodeDescription description;
     getExceptionCodeDescription(ec, description);
 
-    JSValuePtr errorObject = noValue();
+    JSValue errorObject;
     switch (description.type) {
         case DOMExceptionType:
             errorObject = toJS(exec, DOMCoreException::create(description));
@@ -481,6 +504,12 @@ bool allowsAccessFromFrame(ExecState* exec, Frame* frame, String& message)
     return window && window->allowsAccessFrom(exec, message);
 }
 
+bool shouldAllowNavigation(ExecState* exec, Frame* frame)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    return lexicalFrame && lexicalFrame->loader()->shouldAllowNavigation(frame);
+}
+
 void printErrorMessageForFrame(Frame* frame, const String& message)
 {
     if (!frame)
@@ -489,39 +518,59 @@ void printErrorMessageForFrame(Frame* frame, const String& message)
         window->printErrorMessage(message);
 }
 
-JSValuePtr objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+Frame* toLexicalFrame(ExecState* exec)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
+    return asJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
 }
 
-ScriptState* scriptStateFromNode(Node* node)
+Frame* toDynamicFrame(ExecState* exec)
 {
-    if (!node)
-        return 0;
-    Document* document = node->document();
-    if (!document)
-        return 0;
-    Frame* frame = document->frame();
+    return asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+}
+
+bool processingUserGesture(ExecState* exec)
+{
+    Frame* frame = toDynamicFrame(exec);
+    return frame && frame->script()->processingUserGesture();
+}
+
+KURL completeURL(ExecState* exec, const String& relativeURL)
+{
+    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    Frame* frame = toDynamicFrame(exec);
     if (!frame)
-        return 0;
-    if (!frame->script()->isEnabled())
-        return 0;
-    return frame->script()->globalObject()->globalExec();
+        return KURL();
+    return frame->loader()->completeURL(relativeURL);
 }
 
-Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
+}
+
+Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
+{
+    JSDOMStructureMap& structures = globalObject->structures();
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
     return structures.set(classInfo, structure).first->second.get();
 }
 
+Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+{
+    return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
+}
+
+Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+{
+    return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
+}
+
 JSObject* getCachedDOMConstructor(ExecState* exec, const ClassInfo* classInfo)
 {
     JSDOMConstructorMap& constructors = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->constructors();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 71da21b20c..1378c9189e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -25,7 +25,6 @@
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
 #include <runtime/JSFunction.h>
-#include "ScriptState.h"
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -73,21 +72,27 @@ namespace WebCore {
     void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
 
+    JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
-    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
     {
-        if (JSC::Structure* structure = getCachedDOMStructure(exec, &WrapperClass::s_info))
+        if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
             return structure;
-        return cacheDOMStructure(exec, WrapperClass::createStructure(WrapperClass::createPrototype(exec)), &WrapperClass::s_info);
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+    }
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    {
+        return getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()));
     }
-    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
     {
-        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec)->storedPrototype()));
+        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
     #define CREATE_DOM_OBJECT_WRAPPER(exec, className, object) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object))
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
@@ -98,7 +103,7 @@ namespace WebCore {
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
@@ -117,7 +122,7 @@ namespace WebCore {
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
@@ -136,7 +141,7 @@ namespace WebCore {
         cacheDOMNodeWrapper(node->document(), node, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
@@ -147,29 +152,29 @@ namespace WebCore {
 
     const JSC::HashTable* getHashTableForGlobalData(JSC::JSGlobalData&, const JSC::HashTable* staticTable);
 
-    void reportException(JSC::ExecState*, JSC::JSValuePtr exception);
+    void reportException(JSC::ExecState*, JSC::JSValue exception);
     void reportCurrentException(JSC::ExecState*);
 
     // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
     void setDOMException(JSC::ExecState*, ExceptionCode);
 
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
 
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
 
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
 
     // See JavaScriptCore for explanation: Should be used for any UString that is already owned by another
     // object, to let the engine know that collecting the JSString wrapper is unlikely to save memory.
-    JSC::JSValuePtr jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
+    JSC::JSValue jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
 
-    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null
-    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null or undefined
+    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
+    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
 
-    template <typename T> inline JSC::JSValuePtr toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
+    template <typename T> inline JSC::JSValue toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
 
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
@@ -178,10 +183,14 @@ namespace WebCore {
     // because we do not want current property values involved at all.
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*);
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
+    bool shouldAllowNavigation(JSC::ExecState*, Frame*);
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValuePtr objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
 
-    ScriptState* scriptStateFromNode(Node*);
+    Frame* toLexicalFrame(JSC::ExecState*);
+    Frame* toDynamicFrame(JSC::ExecState*);
+    bool processingUserGesture(JSC::ExecState*);
+    KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index ae339ed952..a7f7b2167c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -30,8 +30,11 @@
 #include "Document.h"
 #include "JSDOMWindow.h"
 #include "JSEventListener.h"
+
+#if ENABLE(WORKERS)
 #include "JSWorkerContext.h"
 #include "WorkerContext.h"
+#endif
 
 using namespace JSC;
 
@@ -49,26 +52,10 @@ JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGloba
 
 JSDOMGlobalObject::~JSDOMGlobalObject()
 {
-    // Clear any backpointers to the window
-    ListenersMap::iterator i1 = d()->jsEventListeners.begin();
-    ListenersMap::iterator e1 = d()->jsEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    i1 = d()->jsInlineEventListeners.begin();
-    e1 = d()->jsInlineEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    UnprotectedListenersMap::iterator i2 = d()->jsUnprotectedEventListeners.begin();
-    UnprotectedListenersMap::iterator e2 = d()->jsUnprotectedEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
-
-    i2 = d()->jsUnprotectedInlineEventListeners.begin();
-    e2 = d()->jsUnprotectedInlineEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
+    JSListenersMap::iterator it = d()->jsEventListeners.begin();
+    JSListenersMap::iterator end = d()->jsEventListeners.end();
+    for (; it != end; ++it)
+        it->second->clearGlobalObject();
 }
 
 void JSDOMGlobalObject::mark()
@@ -86,74 +73,45 @@ void JSDOMGlobalObject::mark()
     }
 }
 
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValuePtr val, bool isInline)
+JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
 {
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
-    JSObject* object = asObject(val);
-    ListenersMap& listeners = isInline ? d()->jsInlineEventListeners : d()->jsEventListeners;
-    return listeners.get(object);
+
+    return d()->jsEventListeners.get(asObject(val));
 }
 
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(ExecState*, JSValuePtr val, bool isInline)
+PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
 {
-    if (JSEventListener* listener = findJSEventListener(val, isInline))
+    if (JSEventListener* listener = findJSEventListener(val))
         return listener;
 
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
 
     // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, isInline).get();
-}
-
-JSUnprotectedEventListener* JSDOMGlobalObject::findJSUnprotectedEventListener(ExecState*, JSValuePtr val, bool isInline)
-{
-    if (!val->isObject())
-        return 0;
-
-    UnprotectedListenersMap& listeners = isInline ? d()->jsUnprotectedInlineEventListeners : d()->jsUnprotectedEventListeners;
-    return listeners.get(asObject(val));
+    return JSEventListener::create(asObject(val), this, false).get();
 }
 
-PassRefPtr<JSUnprotectedEventListener> JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener(ExecState* exec, JSValuePtr val, bool isInline)
+PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
 {
-    if (JSUnprotectedEventListener* listener = findJSUnprotectedEventListener(exec, val, isInline))
-        return listener;
-
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
 
-    // The JSUnprotectedEventListener constructor adds it to our jsUnprotectedEventListeners map.
-    return JSUnprotectedEventListener::create(asObject(val), this, isInline).get();
+    return JSEventListener::create(asObject(val), this, true).get();
 }
 
-JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsEventListeners()
+JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
 {
     return d()->jsEventListeners;
 }
 
-JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsInlineEventListeners()
-{
-    return d()->jsInlineEventListeners;
-}
-
-JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedEventListeners()
-{
-    return d()->jsUnprotectedEventListeners;
-}
-
-JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedInlineEventListeners()
-{
-    return d()->jsUnprotectedInlineEventListeners;
-}
-
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
 {
     d()->evt = evt;
 }
 
-Event* JSDOMGlobalObject::currentEvent()
+Event* JSDOMGlobalObject::currentEvent() const
 {
     return d()->evt;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index fbb3eb978f..8e4e8203bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -32,8 +32,8 @@
 namespace WebCore {
 
     class Event;
+    class JSLazyEventListener;
     class JSEventListener;
-    class JSUnprotectedEventListener;
     class ScriptExecutionContext;
 
     typedef HashMap<const JSC::ClassInfo*, RefPtr<JSC::Structure> > JSDOMStructureMap;
@@ -53,28 +53,22 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValuePtr, bool isInline = false);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
-
         // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSUnprotectedEventListener* findJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        JSEventListener* findJSEventListener(JSC::JSValue);
 
         // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSUnprotectedEventListener> findOrCreateJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
+
+        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
+        // These listeners cannot be removed through the removeEventListener API.
+        PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> ListenersMap;
-        typedef HashMap<JSC::JSObject*, JSUnprotectedEventListener*> UnprotectedListenersMap;
+        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
 
-        ListenersMap& jsEventListeners();
-        ListenersMap& jsInlineEventListeners();
-        UnprotectedListenersMap& jsUnprotectedEventListeners();
-        UnprotectedListenersMap& jsUnprotectedInlineEventListeners();
+        JSListenersMap& jsEventListeners();
 
         void setCurrentEvent(Event*);
-        Event* currentEvent();
+        Event* currentEvent() const;
 
         virtual void mark();
 
@@ -85,10 +79,7 @@ namespace WebCore {
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::ListenersMap jsEventListeners;
-            JSDOMGlobalObject::ListenersMap jsInlineEventListeners;
-            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedEventListeners;
-            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedInlineEventListeners;
+            JSDOMGlobalObject::JSListenersMap jsEventListeners;
 
             Event* evt;
         };
@@ -108,11 +99,11 @@ namespace WebCore {
     }
 
     template<class ConstructorClass>
-    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
+    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
     {
         if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info))
             return constructor;
-        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, globalObject->scriptExecutionContext());
+        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, const_cast<JSDOMGlobalObject*>(globalObject));
         ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
         globalObject->constructors().set(&ConstructorClass::s_info, constructor);
         return constructor;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
index ccf0ce88e6..ac088af102 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
@@ -32,14 +32,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
+JSValue JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
 {
     return jsString(exec, impl()->item(index));
 }
 
-JSValuePtr JSDOMStringList::item(ExecState* exec, const ArgList& args)
+JSValue JSDOMStringList::item(ExecState* exec, const ArgList& args)
 {
-    unsigned index = args.at(exec, 0)->toUInt32(exec);
+    unsigned index = args.at(0).toUInt32(exec);
     if (index >= impl()->length())
         return jsNull();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 10fc022881..4fd11390e1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  *  This library is free software; you can redistribute it and/or
@@ -25,107 +25,29 @@
 
 #include "CString.h"
 #include "Console.h"
-#include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "Element.h"
-#include "EventListener.h"
-#include "ExceptionCode.h"
-#include "FloatRect.h"
 #include "Frame.h"
-#include "FrameLoadRequest.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "GCController.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "InspectorController.h"
-#include "JSAudioConstructor.h"
 #include "JSDOMWindowCustom.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
 #include "JSHTMLCollection.h"
-#include "JSImageConstructor.h"
-#include "JSMessageChannelConstructor.h"
 #include "JSNode.h"
-#include "JSOptionConstructor.h"
-#include "JSWorkerConstructor.h"
-#include "JSXMLHttpRequestConstructor.h"
-#include "JSXSLTProcessorConstructor.h"
 #include "Logging.h"
-#include "MediaPlayer.h"
 #include "Page.h"
-#include "PlatformScreen.h"
-#include "PluginInfoStore.h"
-#include "RenderView.h"
-#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
-#include "WindowFeatures.h"
-#include "htmlediting.h"
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-#include <wtf/AlwaysInline.h>
-#include <wtf/MathExtras.h>
 
 using namespace JSC;
 
-static JSValuePtr windowProtoFuncOpen(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncShowModalDialog(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncNotImplemented(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-
-static JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsDOMWindowBaseEvent(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseEvent(ExecState*, JSObject*, JSValuePtr);
-
-// Constructors
-static JSValuePtr jsDOMWindowBaseAudio(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseAudio(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseImage(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseImage(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseMessageChannel(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseMessageChannel(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseWorker(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseWorker(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseOption(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseOption(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXMLHttpRequest(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXSLTProcessor(ExecState*, JSObject*, JSValuePtr);
-
-#include "JSDOMWindowBase.lut.h"
-
 namespace WebCore {
 
-////////////////////// JSDOMWindowBase Object ////////////////////////
-
-const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, &JSDOMWindowBaseTable, 0 };
-
-/*
-@begin JSDOMWindowBaseTable
-# -- Functions --
-  open                          windowProtoFuncOpen                         DontDelete|Function 3
-  showModalDialog               windowProtoFuncShowModalDialog              DontDelete|Function 1
-# Not implemented
-  captureEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-  releaseEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-# -- Attributes --
-  crypto                        jsDOMWindowBaseCrypto                       DontDelete|ReadOnly
-  event                         jsDOMWindowBaseEvent                        DontDelete
-# -- Constructors --
-  Audio                         jsDOMWindowBaseAudio                        DontDelete
-  Image                         jsDOMWindowBaseImage                        DontDelete
-  MessageChannel                jsDOMWindowBaseMessageChannel               DontDelete
-  Option                        jsDOMWindowBaseOption                       DontDelete
-  Worker                        jsDOMWindowBaseWorker                       DontDelete
-  XMLHttpRequest                jsDOMWindowBaseXMLHttpRequest               DontDelete
-  XSLTProcessor                 jsDOMWindowBaseXSLTProcessor                DontDelete
-@end
-*/
+const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
 JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : impl(window)
-    , returnValueSlot(0)
     , shell(shell)
 {
 }
@@ -133,9 +55,6 @@ JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow>
 JSDOMWindowBase::JSDOMWindowBase(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
-    // Time in milliseconds before the script timeout handler kicks in.
-    setTimeoutTime(10000);
-
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(globalExec(), "document"), jsNull(), DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(globalExec(), "window"), d()->shell, DontDelete | ReadOnly)
@@ -151,368 +70,22 @@ void JSDOMWindowBase::updateDocument()
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, d()->impl->document()), DontDelete | ReadOnly);
 }
 
-JSDOMWindowBase::~JSDOMWindowBase()
-{
-    if (d()->impl->frame())
-        d()->impl->frame()->script()->clearFormerWindow(asJSDOMWindow(this));
-}
-
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 {
     return d()->impl->document();
 }
 
-static bool allowPopUp(ExecState* exec)
-{
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-
-    ASSERT(frame);
-    if (frame->script()->processingUserGesture())
-        return true;
-    Settings* settings = frame->settings();
-    return settings && settings->JavaScriptCanOpenWindowsAutomatically();
-}
-
-static HashMap<String, String> parseModalDialogFeatures(const String& featuresArg)
-{
-    HashMap<String, String> map;
-
-    Vector<String> features;
-    featuresArg.split(';', features);
-    Vector<String>::const_iterator end = features.end();
-    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
-        String s = *it;
-        int pos = s.find('=');
-        int colonPos = s.find(':');
-        if (pos >= 0 && colonPos >= 0)
-            continue; // ignore any strings that have both = and :
-        if (pos < 0)
-            pos = colonPos;
-        if (pos < 0) {
-            // null string for value means key without value
-            map.set(s.stripWhiteSpace().lower(), String());
-        } else {
-            String key = s.left(pos).stripWhiteSpace().lower();
-            String val = s.substring(pos + 1).stripWhiteSpace().lower();
-            int spacePos = val.find(' ');
-            if (spacePos != -1)
-                val = val.left(spacePos);
-            map.set(key, val);
-        }
-    }
-
-    return map;
-}
-
-static Frame* createWindow(ExecState* exec, Frame* openerFrame, const String& url,
-    const String& frameName, const WindowFeatures& windowFeatures, JSValuePtr dialogArgs)
-{
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    ASSERT(activeFrame);
-
-    ResourceRequest request;
-
-    request.setHTTPReferrer(activeFrame->loader()->outgoingReferrer());
-    FrameLoader::addHTTPOriginIfNeeded(request, activeFrame->loader()->outgoingOrigin());
-    FrameLoadRequest frameRequest(request, frameName);
-
-    // FIXME: It's much better for client API if a new window starts with a URL, here where we
-    // know what URL we are going to open. Unfortunately, this code passes the empty string
-    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
-    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
-    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
-    // We'd have to resolve all those issues to pass the URL instead of "".
-
-    bool created;
-    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
-    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
-    // "_self" or "_parent".
-    Frame* newFrame = activeFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
-    if (!newFrame)
-        return 0;
-
-    newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
-
-    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
-
-    if (dialogArgs)
-        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
-
-    if (!protocolIs(url, "javascript") || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : activeFrame->document()->completeURL(url);
-        bool userGesture = activeFrame->script()->processingUserGesture();
-
-        if (created)
-            newFrame->loader()->changeLocation(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
-        else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), activeFrame->loader()->outgoingReferrer(), false, userGesture);
-    }
-
-    return newFrame;
-}
-
-static bool canShowModalDialog(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModal();
-}
-
-static bool canShowModalDialogNow(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModalNow();
-}
-
-static JSValuePtr showModalDialog(ExecState* exec, Frame* frame, const String& url, JSValuePtr dialogArgs, const String& featureArgs)
-{
-    if (!canShowModalDialogNow(frame) || !allowPopUp(exec))
-        return jsUndefined();
-
-    const HashMap<String, String> features = parseModalDialogFeatures(featureArgs);
-
-    const bool trusted = false;
-
-    // The following features from Microsoft's documentation are not implemented:
-    // - default font settings
-    // - width, height, left, and top specified in units other than "px"
-    // - edge (sunken or raised, default is raised)
-    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
-    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
-    // - unadorned: trusted && boolFeature(features, "unadorned");
-
-    if (!frame)
-        return jsUndefined();
-
-    FloatRect screenRect = screenAvailableRect(frame->view());
-
-    WindowFeatures wargs;
-    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
-    wargs.widthSet = true;
-    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
-    wargs.heightSet = true;
-
-    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
-    wargs.xSet = wargs.x > 0;
-    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
-    wargs.ySet = wargs.y > 0;
-
-    if (WindowFeatures::boolFeature(features, "center", true)) {
-        if (!wargs.xSet) {
-            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
-            wargs.xSet = true;
-        }
-        if (!wargs.ySet) {
-            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
-            wargs.ySet = true;
-        }
-    }
-
-    wargs.dialog = true;
-    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
-    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
-    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
-    wargs.menuBarVisible = false;
-    wargs.toolBarVisible = false;
-    wargs.locationBarVisible = false;
-    wargs.fullscreen = false;
-
-    Frame* dialogFrame = createWindow(exec, frame, url, "", wargs, dialogArgs);
-    if (!dialogFrame)
-        return jsUndefined();
-
-    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
-
-    // Get the return value either just before clearing the dialog window's
-    // properties (in JSDOMWindowBase::clear), or when on return from runModal.
-    JSValuePtr returnValue = noValue();
-    dialogWindow->setReturnValueSlot(&returnValue);
-    dialogFrame->page()->chrome()->runModal();
-    dialogWindow->setReturnValueSlot(0);
-
-    // If we don't have a return value, get it now.
-    // Either JSDOMWindowBase::clear was not called yet, or there was no return value,
-    // and in that case, there's no harm in trying again (no benefit either).
-    if (!returnValue)
-        returnValue = dialogWindow->getDirect(Identifier(exec, "returnValue"));
-
-    return returnValue ? returnValue : jsUndefined();
-}
-
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&)
-{
-    return jsUndefined(); // FIXME: implement this
-}
-
-JSValuePtr jsDOMWindowBaseEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent())
-        return jsUndefined();
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent());
-}
-
-JSValuePtr jsDOMWindowBaseImage(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSImageConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseMessageChannel(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(CHANNEL_MESSAGING)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSMessageChannelConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseOption(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSOptionConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseAudio(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(VIDEO)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!MediaPlayer::isAvailable())
-        return jsUndefined();
-    return getDOMConstructor<JSAudioConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseWorker(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(WORKERS)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSWorkerConstructor>(exec);
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(XSLT)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
-#else
-    return jsUndefined();
-#endif
-}
-
-void setJSDOMWindowBaseEvent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
-}
-
-void setJSDOMWindowBaseAudio(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Audio"), value);
-}
-
-void setJSDOMWindowBaseImage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Image"), value);
-}
-
-void setJSDOMWindowBaseMessageChannel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "MessageChannel"), value);
-}
-
-void setJSDOMWindowBaseOption(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Option"), value);
-}
-
-void setJSDOMWindowBaseWorker(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Worker"), value);
-}
-
-void setJSDOMWindowBaseXMLHttpRequest(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
-}
-
-void setJSDOMWindowBaseXSLTProcessor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XSLTProcessor"), value);
-}
-
-namespace WebCore {
-
-JSValuePtr JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
 }
 
-JSValuePtr JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
 }
 
-JSValuePtr JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSDOMWindowBase* thisObj = static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()));
     Document* doc = thisObj->impl()->frame()->document();
@@ -538,26 +111,10 @@ bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& prop
         return true;
     }
 
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == windowProtoFuncShowModalDialog) {
-                if (!canShowModalDialog(impl()->frame()))
-                    return false;
-            }
-            if (allowsAccessFrom(exec))
-                setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-            else
-                slot.setUndefined();
-        } else
-            slot.setCustom(this, entry->propertyGetter());
-        return true;
-    }
-
     // Do prototype lookup early so that functions and attributes in the prototype can have
     // precedence over the index and name getters.  
-    JSValuePtr proto = prototype();
-    if (proto->isObject()) {
+    JSValue proto = prototype();
+    if (proto.isObject()) {
         if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
             if (!allowsAccessFrom(exec))
                 slot.setUndefined();
@@ -583,7 +140,7 @@ bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& prop
 
     // Allow shortcuts like 'Image1' instead of document.images.Image1
     Document* document = impl()->frame()->document();
-    if (document && document->isHTMLDocument()) {
+    if (document->isHTMLDocument()) {
         AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
         if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
             slot.setCustom(this, namedItemGetter);
@@ -594,19 +151,8 @@ bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (allowsAccessFrom(exec))
-                Base::put(exec, propertyName, value, slot);
-            return;
-        }
-        if (entry->attributes() & ReadOnly)
-            return;
-    }
-
     if (allowsAccessFrom(exec))
         Base::put(exec, propertyName, value, slot);
 }
@@ -653,6 +199,9 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
+#if !ENABLE(JAVASCRIPT_DEBUGGER)
+    return false;
+#else
     Frame* frame = impl()->frame();
     if (!frame)
         return false;
@@ -662,6 +211,7 @@ bool JSDOMWindowBase::supportsProfiling() const
         return false;
 
     return page->inspectorController()->profilerEnabled();
+#endif
 }
 
 bool JSDOMWindowBase::shouldInterruptScript() const
@@ -682,21 +232,11 @@ bool JSDOMWindowBase::shouldInterruptScript() const
     return page->chrome()->shouldInterruptJavaScript();
 }
 
-void JSDOMWindowBase::clearHelperObjectProperties()
+void JSDOMWindowBase::willRemoveFromWindowShell()
 {
     setCurrentEvent(0);
 }
 
-void JSDOMWindowBase::clear()
-{
-    JSLock lock(false);
-
-    if (d()->returnValueSlot && !*d()->returnValueSlot)
-        *d()->returnValueSlot = getDirect(Identifier(globalExec(), "returnValue"));
-
-    clearHelperObjectProperties();
-}
-
 JSObject* JSDOMWindowBase::toThisObject(ExecState*) const
 {
     return shell();
@@ -709,141 +249,16 @@ JSDOMWindowShell* JSDOMWindowBase::shell() const
 
 JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
 {
-    static JSGlobalData* globalData = JSGlobalData::createLeaked().releaseRef();
-    return globalData;
-}
-
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr windowProtoFuncOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
-        return  jsUndefined();
-
-    Page* page = frame->page();
-
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
-    AtomicString frameName = args.at(exec, 1)->isUndefinedOrNull() ? "_blank" : AtomicString(args.at(exec, 1)->toString(exec));
-
-    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
-    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-    if (!allowPopUp(exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
-        return jsUndefined();
-
-    // Get the target frame for the special cases of _top and _parent.  In those
-    // cases, we can schedule a location change right now and return early.
-    bool topOrParent = false;
-    if (frameName == "_top") {
-        frame = frame->tree()->top();
-        topOrParent = true;
-    } else if (frameName == "_parent") {
-        if (Frame* parent = frame->tree()->parent())
-            frame = parent;
-        topOrParent = true;
+    static JSGlobalData* globalData;
+    if (!globalData) {
+        globalData = JSGlobalData::createLeaked().releaseRef();
+        globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
     }
-    if (topOrParent) {
-        if (!activeFrame->loader()->shouldAllowNavigation(frame))
-            return jsUndefined();
-
-        String completedURL;
-        if (!urlString.isEmpty())
-            completedURL = activeFrame->document()->completeURL(urlString).string();
-
-        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
-        if (!completedURL.isEmpty() && (!protocolIs(completedURL, "javascript") || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
-            bool userGesture = activeFrame->script()->processingUserGesture();
-            frame->loader()->scheduleLocationChange(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
-        }
-        return toJS(exec, frame->domWindow());
-    }
-
-    // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
-                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
-    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
-
-    windowFeatures.x = windowRect.x();
-    windowFeatures.y = windowRect.y();
-    windowFeatures.height = windowRect.height();
-    windowFeatures.width = windowRect.width();
-
-    frame = createWindow(exec, frame, urlString, frameName, windowFeatures, noValue());
-
-    if (!frame)
-        return jsUndefined();
-
-    return toJS(exec, frame->domWindow()); // global object
-}
-
-JSValuePtr windowProtoFuncShowModalDialog(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
 
-    return showModalDialog(exec, frame, valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0)), args.at(exec, 1), valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-}
-
-JSValuePtr windowProtoFuncNotImplemented(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
-{
-    if (!toJSDOMWindow(thisValue))
-        return throwError(exec, TypeError);
-    return jsUndefined();
-}
-
-namespace WebCore {
-
-void JSDOMWindowBase::setReturnValueSlot(JSValuePtr* slot)
-{
-    d()->returnValueSlot = slot;
-}
-
-////////////////////// timeouts ////////////////////////
-
-int JSDOMWindowBase::installTimeout(ScheduledAction* a, int t, bool singleShot)
-{
-    return DOMTimer::install(scriptExecutionContext(), a, t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(const UString& handler, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(handler), t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(ExecState* exec, JSValuePtr func, const ArgList& args, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(exec, func, args), t, singleShot);
-}
-
-void JSDOMWindowBase::removeTimeout(int timeoutId)
-{
-    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
-}
-
-void JSDOMWindowBase::disconnectFrame()
-{
+    return globalData;
 }
 
-JSValuePtr toJS(ExecState*, DOMWindow* domWindow)
+JSValue toJS(ExecState*, DOMWindow* domWindow)
 {
     if (!domWindow)
         return jsNull();
@@ -860,9 +275,9 @@ JSDOMWindow* toJSDOMWindow(Frame* frame)
     return frame->script()->windowShell()->window();
 }
 
-JSDOMWindow* toJSDOMWindow(JSValuePtr value)
+JSDOMWindow* toJSDOMWindow(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     const ClassInfo* classInfo = asObject(value)->classInfo();
     if (classInfo == &JSDOMWindow::s_info)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 2398172b57..6d931965bf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -34,10 +34,8 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class JSDOMWindowShell;
-    class JSEventListener;
     class JSLocation;
-    class JSUnprotectedEventListener;
-    class ScheduledAction;
+    class JSEventListener;
     class SecurityOrigin;
 
     class JSDOMWindowBasePrivate;
@@ -45,32 +43,20 @@ namespace WebCore {
     // This is the only WebCore JS binding which does not inherit from DOMObject
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
-
-        friend class ScheduledAction;
     protected:
         JSDOMWindowBase(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        virtual ~JSDOMWindowBase();
-
         void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        void disconnectFrame();
-
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
 
-        int installTimeout(const JSC::UString& handler, int t, bool singleShot);
-        int installTimeout(JSC::ExecState*, JSC::JSValuePtr function, const JSC::ArgList& args, int t, bool singleShot);
-        void removeTimeout(int timeoutId);
-
-        void clear();
-
-        // Set a place to put a dialog return value when the window is cleared.
-        void setReturnValueSlot(JSC::JSValuePtr* slot);
+        // Called just before removing this window from the JSDOMWindowShell.
+        void willRemoveFromWindowShell();
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
@@ -100,17 +86,12 @@ namespace WebCore {
             JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
             RefPtr<DOMWindow> impl;
-
-            JSC::JSValuePtr* returnValueSlot;
             JSDOMWindowShell* shell;
         };
 
-        static JSC::JSValuePtr childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        void clearHelperObjectProperties();
-        int installTimeout(ScheduledAction*, int interval, bool singleShot);
+        static JSC::JSValue childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
@@ -119,11 +100,11 @@ namespace WebCore {
     };
 
     // Returns a JSDOMWindow or jsNull()
-    JSC::JSValuePtr toJS(JSC::ExecState*, DOMWindow*);
+    JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
 
     // Returns JSDOMWindow or 0
     JSDOMWindow* toJSDOMWindow(Frame*);
-    JSDOMWindow* toJSDOMWindow(JSC::JSValuePtr);
+    JSDOMWindow* toJSDOMWindow(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2c5f882825..b8c30c7cd4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,17 +25,39 @@
 #include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
+#include "FloatRect.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "FrameView.h"
+#include "History.h"
+#include "JSAudioConstructor.h"
 #include "JSDOMWindowShell.h"
+#include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSHistory.h"
+#include "JSImageConstructor.h"
+#include "JSLocation.h"
+#include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSOptionConstructor.h"
+#include "JSWebKitCSSMatrixConstructor.h"
+#include "JSWebKitPointConstructor.h"
+#include "JSWorkerConstructor.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "JSXSLTProcessorConstructor.h"
+#include "Location.h"
+#include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "Page.h"
+#include "PlatformScreen.h"
+#include "RegisteredEventListener.h"
+#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "WindowFeatures.h"
 #include <runtime/JSObject.h>
-#include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
 
@@ -45,6 +67,8 @@ void JSDOMWindow::mark()
 {
     Base::mark();
 
+    markEventListeners(impl()->eventListeners());
+
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
     markDOMObjectWrapper(globalData, impl()->optionalConsole());
@@ -97,6 +121,11 @@ void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName,
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
+
+    // Don't allow shadowing location using defineGetter.
+    if (propertyName == "location")
+        return;
+
     Base::defineGetter(exec, propertyName, getterFunction);
 }
 
@@ -108,7 +137,7 @@ void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName,
     Base::defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -116,7 +145,7 @@ JSValuePtr JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& property
     return Base::lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -124,17 +153,41 @@ JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& property
     return Base::lookupSetter(exec, propertyName);
 }
 
-void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
+// Custom Attributes
+
+JSValue JSDOMWindow::history(ExecState* exec) const
+{
+    History* history = impl()->history();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+        return wrapper;
+
+    JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, const_cast<JSDOMWindow*>(this)), history);
+    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    return jsHistory;
+}
+
+JSValue JSDOMWindow::location(ExecState* exec) const
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    Location* location = impl()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, const_cast<JSDOMWindow*>(this)), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
+}
+
+void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
         return;
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // To avoid breaking old widgets, make "var location =" in a top-level frame create
     // a property named "location" instead of performing a navigation (<rdar://problem/5688039>).
-    if (Settings* settings = activeFrame->settings()) {
-        if (settings->usesDashboardBackwardCompatibilityMode() && !activeFrame->tree()->parent()) {
+    if (Settings* settings = lexicalFrame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode() && !lexicalFrame->tree()->parent()) {
             if (allowsAccessFrom(exec))
                 putDirect(Identifier(exec, "location"), value);
             return;
@@ -142,85 +195,345 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
     }
 #endif
 
-    if (!activeFrame->loader()->shouldAllowNavigation(impl()->frame()))
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    if (!shouldAllowNavigation(exec, frame))
         return;
-    String dstUrl = activeFrame->loader()->completeURL(value->toString(exec)).string();
-    if (!protocolIs(dstUrl, "javascript") || allowsAccessFrom(exec)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
+
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
+        return;
+
+    if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        impl()->frame()->loader()->scheduleLocationChange(dstUrl, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
-JSValuePtr JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::crypto(ExecState*) const
 {
-    DOMWindow* window = impl();
-
-    DOMWindow* source = asJSDOMWindow(exec->dynamicGlobalObject())->impl();
-    String message = args.at(exec, 0)->toString(exec);
+    return jsUndefined();
+}
 
-    if (exec->hadException())
+JSValue JSDOMWindow::event(ExecState* exec) const
+{
+    Event* event = currentEvent();
+    if (!event)
         return jsUndefined();
+    return toJS(exec, event);
+}
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(exec, 1));
+JSValue JSDOMWindow::image(ExecState* exec) const
+{
+    return getDOMConstructor<JSImageConstructor>(exec, this);
+}
 
-    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, (args.size() == 2) ? 1 : 2));
-    if (exec->hadException())
+JSValue JSDOMWindow::option(ExecState* exec) const
+{
+    return getDOMConstructor<JSOptionConstructor>(exec, this);
+}
+
+#if ENABLE(VIDEO)
+JSValue JSDOMWindow::audio(ExecState* exec) const
+{
+    if (!MediaPlayer::isAvailable())
         return jsUndefined();
+    return getDOMConstructor<JSAudioConstructor>(exec, this);
+}
+#endif
 
-    ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
-    setDOMException(exec, ec);
+JSValue JSDOMWindow::webKitPoint(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitPointConstructor>(exec);
+}
 
-    return jsUndefined();
+JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec);
+}
+ 
+JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
+{
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
+}
+
+#if ENABLE(XSLT)
+JSValue JSDOMWindow::xsltProcessor(ExecState* exec) const
+{
+    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
+}
+#endif
+
+#if ENABLE(CHANNEL_MESSAGING)
+JSValue JSDOMWindow::messageChannel(ExecState* exec) const
+{
+    return getDOMConstructor<JSMessageChannelConstructor>(exec, this);
+}
+#endif
+
+#if ENABLE(WORKERS)
+JSValue JSDOMWindow::worker(ExecState* exec) const
+{
+    return getDOMConstructor<JSWorkerConstructor>(exec);
+}
+#endif
+
+// Custom functions
+
+// Helper for window.open() and window.showModalDialog()
+static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicFrame,
+                           Frame* openerFrame, const String& url, const String& frameName, 
+                           const WindowFeatures& windowFeatures, JSValue dialogArgs)
+{
+    ASSERT(lexicalFrame);
+    ASSERT(dynamicFrame);
+
+    ResourceRequest request;
+
+    // For whatever reason, Firefox uses the dynamicGlobalObject to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = dynamicFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, dynamicFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL, here where we
+    // know what URL we are going to open. Unfortunately, this code passes the empty string
+    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
+    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
+    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
+    // We'd have to resolve all those issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
+    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = lexicalFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->loader()->setOpenedByDOM();
+
+    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
+
+    if (dialogArgs)
+        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
+
+    if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
+        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        bool userGesture = processingUserGesture(exec);
+
+        if (created)
+            newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    }
+
+    return newFrame;
 }
 
-static JSValuePtr setTimeoutOrInterval(ExecState* exec, JSDOMWindow* window, const ArgList& args, bool timeout)
+JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr v = args.at(exec, 0);
-    int delay = args.at(exec, 1)->toInt32(exec);
-    if (v->isString())
-        return jsNumber(exec, window->installTimeout(asString(v)->value(), delay, timeout));
-    CallData callData;
-    if (v->getCallData(callData) == CallTypeNone)
+    Frame* frame = impl()->frame();
+    if (!frame)
         return jsUndefined();
-    ArgList argsTail;
-    args.getSlice(2, argsTail);
-    return jsNumber(exec, window->installTimeout(exec, v, argsTail, delay, timeout));
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    Page* page = frame->page();
+
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+
+    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
+    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
+    if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+        return jsUndefined();
+
+    // Get the target frame for the special cases of _top and _parent.  In those
+    // cases, we can schedule a location change right now and return early.
+    bool topOrParent = false;
+    if (frameName == "_top") {
+        frame = frame->tree()->top();
+        topOrParent = true;
+    } else if (frameName == "_parent") {
+        if (Frame* parent = frame->tree()->parent())
+            frame = parent;
+        topOrParent = true;
+    }
+    if (topOrParent) {
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
+        String completedURL;
+        if (!urlString.isEmpty())
+            completedURL = completeURL(exec, urlString).string();
+
+        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
+        if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
+            bool userGesture = processingUserGesture(exec);
+
+            // For whatever reason, Firefox uses the dynamicGlobalObject to
+            // determine the outgoingReferrer.  We replicate that behavior
+            // here.
+            String referrer = dynamicFrame->loader()->outgoingReferrer();
+
+            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+        }
+        return toJS(exec, frame->domWindow());
+    }
+
+    // In the case of a named frame or a new window, we'll use the createWindow() helper
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
+                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
+    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
+
+    windowFeatures.x = windowRect.x();
+    windowFeatures.y = windowRect.y();
+    windowFeatures.height = windowRect.height();
+    windowFeatures.width = windowRect.width();
+
+    frame = createWindow(exec, lexicalFrame, dynamicFrame, frame, urlString, frameName, windowFeatures, JSValue());
+
+    if (!frame)
+        return jsUndefined();
+
+    return toJS(exec, frame->domWindow());
 }
 
-JSValuePtr JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, this, args, true);
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
+        return jsUndefined();
+
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
+    HashMap<String, String> features;
+    DOMWindow::parseModalDialogFeatures(featureArgs, features);
+
+    const bool trusted = false;
+
+    // The following features from Microsoft's documentation are not implemented:
+    // - default font settings
+    // - width, height, left, and top specified in units other than "px"
+    // - edge (sunken or raised, default is raised)
+    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
+    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
+    // - unadorned: trusted && boolFeature(features, "unadorned");
+
+    FloatRect screenRect = screenAvailableRect(frame->view());
+
+    WindowFeatures wargs;
+    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
+    wargs.widthSet = true;
+    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
+    wargs.heightSet = true;
+
+    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
+    wargs.xSet = wargs.x > 0;
+    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
+    wargs.ySet = wargs.y > 0;
+
+    if (WindowFeatures::boolFeature(features, "center", true)) {
+        if (!wargs.xSet) {
+            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
+            wargs.xSet = true;
+        }
+        if (!wargs.ySet) {
+            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
+            wargs.ySet = true;
+        }
+    }
+
+    wargs.dialog = true;
+    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
+    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
+    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
+    wargs.menuBarVisible = false;
+    wargs.toolBarVisible = false;
+    wargs.locationBarVisible = false;
+    wargs.fullscreen = false;
+
+    Frame* dialogFrame = createWindow(exec, lexicalFrame, dynamicFrame, frame, url, "", wargs, dialogArgs);
+    if (!dialogFrame)
+        return jsUndefined();
+
+    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
+    dialogFrame->page()->chrome()->runModal();
+
+    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
 }
 
-JSValuePtr JSDOMWindow::clearTimeout(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 {
-    removeTimeout(args.at(exec, 0)->toInt32(exec));
+    DOMWindow* window = impl();
+
+    DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
+    String message = args.at(0).toString(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+
+    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
+    if (exec->hadException())
+        return jsUndefined();
+
+    ExceptionCode ec = 0;
+    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    setDOMException(exec, ec);
+
     return jsUndefined();
 }
 
-JSValuePtr JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, this, args, false);
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
 }
 
-JSValuePtr JSDOMWindow::clearInterval(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    removeTimeout(args.at(exec, 0)->toInt32(exec));
-    return jsUndefined();
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
 }
 
-JSValuePtr JSDOMWindow::atob(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::atob(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
-    if (v->isNull())
+    JSValue v = args.at(0);
+    if (v.isNull())
         return jsEmptyString(exec);
 
-    UString s = v->toString(exec);
+    UString s = v.toString(exec);
     if (!s.is8Bit()) {
         setDOMException(exec, INVALID_CHARACTER_ERR);
         return jsUndefined();
@@ -237,16 +550,16 @@ JSValuePtr JSDOMWindow::atob(ExecState* exec, const ArgList& args)
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
-    if (v->isNull())
+    JSValue v = args.at(0);
+    if (v.isNull())
         return jsEmptyString(exec);
 
-    UString s = v->toString(exec);
+    UString s = v.toString(exec);
     if (!s.is8Bit()) {
         setDOMException(exec, INVALID_CHARACTER_ERR);
         return jsUndefined();
@@ -262,37 +575,33 @@ JSValuePtr JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(exec, args.at(exec, 1))) {
-        if (Document* doc = frame->document())
-            doc->addWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener.release(), args.at(exec, 2)->toBoolean(exec));
-    }
+    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(exec, 1))) {
-        if (Document* doc = frame->document())
-            doc->removeWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener, args.at(exec, 2)->toBoolean(exec));
-    }
+    if (JSEventListener* listener = findJSEventListener(args.at(1)))
+        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-DOMWindow* toDOMWindow(JSValuePtr value)
+DOMWindow* toDOMWindow(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
     if (object->inherits(&JSDOMWindow::s_info))
@@ -302,24 +611,4 @@ DOMWindow* toDOMWindow(JSValuePtr value)
     return 0;
 }
 
-JSValuePtr nonCachingStaticCloseFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionClose);
-}
-
-JSValuePtr nonCachingStaticBlurFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionBlur);
-}
-
-JSValuePtr nonCachingStaticFocusFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionFocus);
-}
-
-JSValuePtr nonCachingStaticPostMessageFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 2, propertyName, jsDOMWindowPrototypeFunctionPostMessage);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
index 838ababc30..52ef4a06ee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -21,6 +21,7 @@
 
 #include "JSDOMWindow.h"
 #include "JSDOMWindowShell.h"
+#include <runtime/PrototypeFunction.h>
 #include <wtf/AlwaysInline.h>
 
 namespace WebCore {
@@ -35,10 +36,11 @@ inline const JSDOMWindow* asJSDOMWindow(const JSC::JSGlobalObject* globalObject)
     return static_cast<const JSDOMWindow*>(globalObject);
 }
 
-JSC::JSValuePtr nonCachingStaticCloseFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticBlurFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticFocusFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticPostMessageFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+template<JSC::NativeFunction nativeFunction, int length>
+JSC::JSValue nonCachingStaticFunctionGetter(JSC::ExecState* exec, const JSC::Identifier& propertyName, const JSC::PropertySlot&)
+{
+    return new (exec) JSC::PrototypeFunction(exec, length, propertyName, nativeFunction);
+}
 
 ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
 {
@@ -59,7 +61,7 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
         }
         entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
         if (entry && (entry->attributes() & JSC::Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
-            slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
             return true;
         }
 
@@ -74,12 +76,10 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
     // is allowed.
     bool allowsAccess = allowsAccessFromNoErrorMessage(exec);
 
-    // Look for overrides before looking at any of our own properties.
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot)) {
-        // But ignore overrides completely if this is cross-domain access.
-        if (allowsAccess)
-            return true;
-    }
+    // Look for overrides before looking at any of our own properties, but ignore overrides completely
+    // if this is cross-domain access.
+    if (allowsAccess && JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
 
     // We need this code here because otherwise JSC::Window will stop the search before we even get to the
     // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
@@ -90,22 +90,27 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
         if (entry->attributes() & JSC::Function) {
             if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticBlurFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFocusFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticPostMessageFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    slot.setUndefined();
                     return true;
                 }
             }
@@ -123,12 +128,12 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
     return false;
 }
 
-inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValuePtr value, JSC::PutPropertySlot& slot)
+inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValue value, JSC::PutPropertySlot& slot)
 {
     if (!impl()->frame())
         return true;
 
-    // We have a local override (e.g. "var location"), save time and jump directly to JSGlobalObject.
+    // Optimization: access JavaScript global variables directly before involving the DOM.
     JSC::PropertySlot getSlot;
     bool slotIsWriteable;
     if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, getSlot, slotIsWriteable)) {
@@ -146,8 +151,6 @@ inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier&
     return false;
 }
 
-
-
 inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
 {
     if (allowsAccessFromPrivate(other))
@@ -156,7 +159,7 @@ inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
     return false;
 }
 
-    inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
+inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
 {
     if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
         return true;
@@ -185,12 +188,6 @@ ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject
     if (originWindow == targetWindow)
         return true;
 
-    // JS may be attempting to access the "window" object, which should be valid,
-    // even if the document hasn't been constructed yet.  If the document doesn't
-    // exist yet allow JS to access the window object.
-    if (!originWindow->impl()->document())
-        return true;
-
     const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
     const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index d54611e520..1bf478b3eb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
@@ -54,11 +54,17 @@ JSDOMWindowShell::~JSDOMWindowShell()
 {
 }
 
-void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> window)
+void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
 {
+    // Explicitly protect the global object's prototype so it isn't collected
+    // when we allocate the global object. (Once the global object is fully
+    // constructed, it can mark its own prototype.)
     RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(jsNull());
-    RefPtr<Structure> structure = JSDOMWindow::createStructure(new JSDOMWindowPrototype(prototypeStructure.release()));
-    setWindow(new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), window, this));
+    ProtectedPtr<JSDOMWindowPrototype> prototype = new JSDOMWindowPrototype(prototypeStructure.release());
+
+    RefPtr<Structure> structure = JSDOMWindow::createStructure(prototype);
+    JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), domWindow, this);
+    setWindow(jsDOMWindow);
 }
 
 // ----
@@ -82,12 +88,12 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
 }
 
-void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
@@ -117,12 +123,12 @@ void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyN
     m_window->defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupSetter(exec, propertyName);
 }
@@ -141,16 +147,6 @@ DOMWindow* JSDOMWindowShell::impl() const
     return m_window->impl();
 }
 
-void JSDOMWindowShell::disconnectFrame()
-{
-    m_window->disconnectFrame();
-}
-
-void JSDOMWindowShell::clear()
-{
-    m_window->clear();
-}
-
 void* JSDOMWindowShell::operator new(size_t size)
 {
     return JSDOMWindow::commonJSGlobalData()->heap.allocate(size);
@@ -160,7 +156,7 @@ void* JSDOMWindowShell::operator new(size_t size)
 // Conversion methods
 // ----
 
-JSValuePtr toJS(ExecState*, Frame* frame)
+JSValue toJS(ExecState*, Frame* frame)
 {
     if (!frame)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 931a256f57..6f21892533 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -55,12 +55,10 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
         DOMWindow* impl() const;
-        void disconnectFrame();
-        void clear();
 
         void* operator new(size_t);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
         }
@@ -69,22 +67,22 @@ namespace WebCore {
         virtual void mark();
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, unsigned attributes);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
-        virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
-        virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
     };
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, Frame*);
+    JSC::JSValue toJS(JSC::ExecState*, Frame*);
     JSDOMWindowShell* toJSDOMWindowShell(Frame*);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
index 68639d5954..af3b06634f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSDatabase.h"
 
+#if ENABLE(DATABASE)
+
 #include "DOMWindow.h"
 #include "Database.h"
 #include "Document.h"
@@ -45,17 +47,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
 {
-    String oldVersion = args.at(exec, 0)->toString(exec);
-    String newVersion = args.at(exec, 1)->toString(exec);
+    String oldVersion = args.at(0).toString(exec);
+    String newVersion = args.at(1).toString(exec);
 
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
     
-    JSObject *object;
-    if (!(object = args.at(exec, 2)->getObject())) {
+    JSObject* object;
+    if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
@@ -63,8 +65,8 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
-    if (!args.at(exec, 3)->isNull()) {
-        if (!(object = args.at(exec, 3)->getObject())) {
+    if (!args.at(3).isNull()) {
+        if (!(object = args.at(3).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -73,8 +75,8 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<VoidCallback> successCallback;
-    if (!args.at(exec, 4)->isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 4));
+    if (!args.at(4).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(4));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -86,11 +88,11 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
 {
     JSObject* object;
     
-    if (!(object = args.at(exec, 0)->getObject())) {
+    if (!(object = args.at(0).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
@@ -102,8 +104,8 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
-    if (args.size() > 1 && !args.at(exec, 1)->isNull()) {
-        if (!(object = args.at(exec, 1)->getObject())) {
+    if (args.size() > 1 && !args.at(1).isNull()) {
+        if (!(object = args.at(1).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -112,8 +114,8 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
     }
 
     RefPtr<VoidCallback> successCallback;
-    if (args.size() > 2 && !args.at(exec, 2)->isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 2));
+    if (args.size() > 2 && !args.at(2).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(2));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -126,3 +128,4 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
 }
     
 }
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index f292b388ae..956327a3ed 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -20,7 +20,6 @@
 #include "config.h"
 #include "JSDocument.h"
 
-#include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -28,9 +27,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
-#include "JSNodeList.h"
 #include "Location.h"
-#include "NodeList.h"
 #include "ScriptController.h"
 
 #if ENABLE(SVG)
@@ -44,27 +41,34 @@ namespace WebCore {
 
 void JSDocument::mark()
 {
-    JSEventTargetNode::mark();
+    JSNode::mark();
     markDOMNodesForDocument(impl());
     markActiveObjectsForContext(*Heap::heap(this)->globalData(), impl());
 }
 
-JSValuePtr JSDocument::location(ExecState* exec) const
+JSValue JSDocument::location(ExecState* exec) const
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
         return jsNull();
 
-    return toJS(exec, frame->domWindow()->location());
+    Location* location = frame->domWindow()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSDOMWindow* window = static_cast<JSDOMWindow*>(exec->lexicalGlobalObject());
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
 }
 
-void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
+void JSDocument::setLocation(ExecState* exec, JSValue value)
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
         return;
 
-    String str = value->toString(exec);
+    String str = value.toString(exec);
 
     // IE and Mozilla both resolve the URL relative to the source frame,
     // not the target frame.
@@ -73,10 +77,10 @@ void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
-JSValuePtr toJS(ExecState* exec, Document* document)
+JSValue toJS(ExecState* exec, Document* document)
 {
     if (!document)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index 3effe8579b..b12c185cc2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -53,7 +53,7 @@ using namespace HTMLNames;
 
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
-    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIs(parseURL(value), "javascript")) {
+    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(parseURL(value))) {
         HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
         if (!checkNodeSecurity(exec, frame->contentDocument()))
             return false;
@@ -61,11 +61,11 @@ static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* elem
     return true;
 } 
 
-JSValuePtr JSElement::setAttribute(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString name = args.at(exec, 0)->toString(exec);
-    AtomicString value = args.at(exec, 1)->toString(exec);
+    AtomicString name = args.at(0).toString(exec);
+    AtomicString value = args.at(1).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, name, value))
@@ -76,10 +76,10 @@ JSValuePtr JSElement::setAttribute(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -89,17 +89,17 @@ JSValuePtr JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    AtomicString qualifiedName = args.at(exec, 1)->toString(exec);
-    AtomicString value = args.at(exec, 2)->toString(exec);
+    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    AtomicString qualifiedName = args.at(1).toString(exec);
+    AtomicString value = args.at(2).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, qualifiedName, value))
@@ -110,10 +110,10 @@ JSValuePtr JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -123,12 +123,12 @@ JSValuePtr JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Element* element)
+JSValue toJSNewlyCreated(ExecState* exec, Element* element)
 {
     if (!element)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index 1c59f9d8c4..03b97d8c86 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -72,12 +72,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSEvent::clipboardData(ExecState* exec) const
+JSValue JSEvent::clipboardData(ExecState* exec) const
 {
     return impl()->isClipboardEvent() ? toJS(exec, impl()->clipboardData()) : jsUndefined();
 }
 
-JSValuePtr toJS(ExecState* exec, Event* event)
+JSValue toJS(ExecState* exec, Event* event)
 {
     JSLock lock(false);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index f84e537605..b9ed685a69 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -20,19 +20,10 @@
 #include "config.h"
 #include "JSEventListener.h"
 
-#include "CString.h"
-#include "Console.h"
-#include "DOMWindow.h"
-#include "Document.h"
 #include "Event.h"
 #include "Frame.h"
-#include "FrameLoader.h"
-#include "JSDOMWindow.h"
 #include "JSEvent.h"
 #include "JSEventTarget.h"
-#include "JSEventTargetNode.h"
-#include "ScriptController.h"
-#include <runtime/FunctionConstructor.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -40,17 +31,43 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSAbstractEventListener)
+JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
+    : m_jsFunction(function)
+    , m_globalObject(globalObject)
+    , m_isAttribute(isAttribute)
+{
+    if (!m_isAttribute && m_jsFunction)
+        globalObject->jsEventListeners().set(m_jsFunction, this);
+}
+
+JSEventListener::~JSEventListener()
+{
+    if (!m_isAttribute && m_jsFunction && m_globalObject)
+        m_globalObject->jsEventListeners().remove(m_jsFunction);
+}
+
+JSObject* JSEventListener::jsFunction() const
+{
+    return m_jsFunction;
+}
+
+void JSEventListener::markJSFunction()
+{
+    if (m_jsFunction && !m_jsFunction->marked())
+        m_jsFunction->mark();
+    if (m_globalObject && !m_globalObject->marked())
+        m_globalObject->mark();
+}
 
-void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
+void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
 {
     JSLock lock(false);
 
-    JSObject* listener = listenerObj();
-    if (!listener)
+    JSObject* jsFunction = this->jsFunction();
+    if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = this->globalObject();
+    JSDOMGlobalObject* globalObject = m_globalObject;
     // Null check as clearGlobalObject() can clear this and we still get called back by
     // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
     // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
@@ -78,18 +95,18 @@ void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
 
     ExecState* exec = globalObject->globalExec();
 
-    JSValuePtr handleEventFunction = listener->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = handleEventFunction->getCallData(callData);
+    CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
-        handleEventFunction = noValue();
-        callType = listener->getCallData(callData);
+        handleEventFunction = JSValue();
+        callType = jsFunction->getCallData(callData);
     }
 
     if (callType != CallTypeNone) {
         ref();
 
-        ArgList args;
+        MarkedArgumentBuffer args;
         args.append(toJS(exec, event));
 
         Event* savedEvent = globalObject->currentEvent();
@@ -101,240 +118,44 @@ void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValuePtr retval;
+        JSValue retval;
         if (handleEventFunction) {
-            globalObject->startTimeoutCheck();
-            retval = call(exec, handleEventFunction, callType, callData, listener, args);
+            globalObject->globalData()->timeoutChecker.start();
+            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
         } else {
-            JSValuePtr thisValue;
+            JSValue thisValue;
             if (isWindowEvent)
                 thisValue = globalObject->toThisObject(exec);
             else
                 thisValue = toJS(exec, event->currentTarget());
-            globalObject->startTimeoutCheck();
-            retval = call(exec, listener, callType, callData, thisValue, args);
+            globalObject->globalData()->timeoutChecker.start();
+            retval = call(exec, jsFunction, callType, callData, thisValue, args);
         }
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
         if (exec->hadException())
             reportCurrentException(exec);
         else {
-            if (!retval->isUndefinedOrNull() && event->storesResultAsString())
-                event->storeResult(retval->toString(exec));
-            if (m_isInline) {
+            if (!retval.isUndefinedOrNull() && event->storesResultAsString())
+                event->storeResult(retval.toString(exec));
+            if (m_isAttribute) {
                 bool retvalbool;
-                if (retval->getBoolean(retvalbool) && !retvalbool)
+                if (retval.getBoolean(retvalbool) && !retvalbool)
                     event->preventDefault();
             }
         }
 
         if (scriptExecutionContext->isDocument())
-            Document::updateDocumentsRendering();
+            Document::updateStyleForAllDocuments();
         deref();
     }
 }
 
-bool JSAbstractEventListener::isInline() const
-{
-    return m_isInline;
-}
-
-// -------------------------------------------------------------------------
-
-JSUnprotectedEventListener::JSUnprotectedEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::UnprotectedListenersMap& listeners = isInline
-            ? globalObject->jsUnprotectedInlineEventListeners() : globalObject->jsUnprotectedEventListeners();
-        listeners.set(m_listener, this);
-    }
-}
-
-JSUnprotectedEventListener::~JSUnprotectedEventListener()
+bool JSEventListener::virtualisAttribute() const
 {
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::UnprotectedListenersMap& listeners = isInline()
-            ? m_globalObject->jsUnprotectedInlineEventListeners() : m_globalObject->jsUnprotectedEventListeners();
-        listeners.remove(m_listener);
-    }
-}
-
-JSObject* JSUnprotectedEventListener::listenerObj() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSUnprotectedEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSUnprotectedEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
-}
-
-void JSUnprotectedEventListener::mark()
-{
-    if (m_listener && !m_listener->marked())
-        m_listener->mark();
-}
-
-#ifndef NDEBUG
-static WTF::RefCountedLeakCounter eventListenerCounter("EventListener");
-#endif
-
-// -------------------------------------------------------------------------
-
-JSEventListener::JSEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::ListenersMap& listeners = isInline
-            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
-        listeners.set(m_listener, this);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.increment();
-#endif
-}
-
-JSEventListener::~JSEventListener()
-{
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::ListenersMap& listeners = isInline()
-            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
-        listeners.remove(m_listener);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.decrement();
-#endif
-}
-
-JSObject* JSEventListener::listenerObj() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
-}
-
-// -------------------------------------------------------------------------
-
-JSLazyEventListener::JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-    : JSEventListener(0, globalObject, true)
-    , m_functionName(functionName)
-    , m_code(code)
-    , m_parsed(false)
-    , m_lineNumber(lineNumber)
-    , m_originalNode(node)
-    , m_type(type)
-{
-    // We don't retain the original node because we assume it
-    // will stay alive as long as this handler object is around
-    // and we need to avoid a reference cycle. If JS transfers
-    // this handler to another node, parseCode will be called and
-    // then originalNode is no longer needed.
-
-    // A JSLazyEventListener can be created with a line number of zero when it is created with
-    // a setAttribute call from JavaScript, so make the line number 1 in that case.
-    if (m_lineNumber == 0)
-        m_lineNumber = 1;
-}
-
-JSObject* JSLazyEventListener::listenerObj() const
-{
-    parseCode();
-    return m_listener;
-}
-
-// Helper function
-inline JSValuePtr eventParameterName(JSLazyEventListener::LazyEventListenerType type, ExecState* exec)
-{
-    switch (type) {
-    case JSLazyEventListener::HTMLLazyEventListener:
-        return jsNontrivialString(exec, "event");
-#if ENABLE(SVG)
-    case JSLazyEventListener::SVGLazyEventListener:
-        return jsNontrivialString(exec, "evt");
-#endif
-    default:
-        ASSERT_NOT_REACHED();
-        return jsUndefined();
-    }
-}
-
-void JSLazyEventListener::parseCode() const
-{
-    if (m_parsed)
-        return;
-
-    if (globalObject()->scriptExecutionContext()->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject());
-        Frame* frame = window->impl()->frame();
-        if (!frame)
-            return;
-        // FIXME: Is this check needed for non-Document contexts?
-        ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
-            return;
-    }
-
-    m_parsed = true;
-
-    ExecState* exec = globalObject()->globalExec();
-
-    ArgList args;
-    UString sourceURL(globalObject()->scriptExecutionContext()->url().string());
-    args.append(eventParameterName(m_type, exec));
-    args.append(jsString(exec, m_code));
-
-    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
-    // have been added with setAttribute from a script, and we should pass String() in that case.
-    m_listener = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
-
-    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_listener.get());
-
-    if (exec->hadException()) {
-        exec->clearException();
-
-        // failed to parse, so let's just make this listener a no-op
-        m_listener = 0;
-    } else if (m_originalNode) {
-        // Add the event's home element to the scope
-        // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
-        ScopeChain scope = listenerAsFunction->scope();
-
-        JSValuePtr thisObj = toJS(exec, m_originalNode);
-        if (thisObj->isObject()) {
-            static_cast<JSEventTargetNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
-            listenerAsFunction->setScope(scope);
-        }
-    }
-
-    // no more need to keep the unparsed code around
-    m_functionName = String();
-    m_code = String();
-
-    if (m_listener) {
-        ASSERT(isInline());
-        JSDOMWindow::ListenersMap& listeners = globalObject()->jsInlineEventListeners();
-        listeners.set(m_listener, const_cast<JSLazyEventListener*>(this));
-    }
+    return m_isAttribute;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index 859d5d4d4e..ce34832ead 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -21,103 +21,39 @@
 #define JSEventListener_h
 
 #include "EventListener.h"
-#include "PlatformString.h"
+#include "JSDOMWindow.h"
 #include <runtime/Protect.h>
 
 namespace WebCore {
 
-    class Event;
     class JSDOMGlobalObject;
-    class Node;
 
-    class JSAbstractEventListener : public EventListener {
+    class JSEventListener : public EventListener {
     public:
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        virtual bool isInline() const;
-        virtual JSC::JSObject* listenerObj() const = 0;
-        virtual JSDOMGlobalObject* globalObject() const = 0;
-
-    protected:
-        JSAbstractEventListener(bool isInline)
-            : m_isInline(isInline)
-        {
-        }
-
-    private:
-        bool m_isInline;
-    };
-
-    class JSUnprotectedEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSUnprotectedEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-        {
-            return adoptRef(new JSUnprotectedEventListener(listener, globalObject, isInline));
-        }
-        virtual ~JSUnprotectedEventListener();
-
-        virtual JSC::JSObject* listenerObj() const;
-        virtual JSDOMGlobalObject* globalObject() const;
-        void clearGlobalObject();
-        void mark();
-
-    private:
-        JSUnprotectedEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
-
-        JSC::JSObject* m_listener;
-        JSDOMGlobalObject* m_globalObject;
-    };
-
-    class JSEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isAttribute)
         {
-            return adoptRef(new JSEventListener(listener, globalObject, isInline));
+            return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
         }
         virtual ~JSEventListener();
+        void clearGlobalObject() { m_globalObject = 0; }
 
-        virtual JSC::JSObject* listenerObj() const;
-        virtual JSDOMGlobalObject* globalObject() const;
-        void clearGlobalObject();
-
-    protected:
-        JSEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
+        // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
+        bool isAttribute() const { return m_isAttribute; }
 
-        mutable JSC::ProtectedPtr<JSC::JSObject> m_listener;
+        virtual JSC::JSObject* jsFunction() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    };
-
-    class JSLazyEventListener : public JSEventListener {
-    public:
-        enum LazyEventListenerType {
-            HTMLLazyEventListener
-#if ENABLE(SVG)
-            , SVGLazyEventListener
-#endif
-        };
-
-        virtual bool wasCreatedFromMarkup() const { return true; }
-
-        static PassRefPtr<JSLazyEventListener> create(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-        {
-            return adoptRef(new JSLazyEventListener(type, functionName, code, globalObject, node, lineNumber));
-        }
-        virtual JSC::JSObject* listenerObj() const;
+        virtual void markJSFunction();
+        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual bool virtualisAttribute() const;
+        void clearJSFunctionInline();
 
     protected:
-        JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+        JSEventListener(JSC::JSObject* function, JSDOMGlobalObject*, bool isAttribute);
 
-    private:
-        void parseCode() const;
-
-        mutable String m_functionName;
-        mutable String m_code;
-        mutable bool m_parsed;
-        int m_lineNumber;
-        Node* m_originalNode;
-
-        LazyEventListenerType m_type;
+        mutable JSC::JSObject* m_jsFunction;
+        JSDOMGlobalObject* m_globalObject;
+        bool m_isAttribute;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
index 8239897145..20580982dd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
@@ -26,26 +26,41 @@
 #include "config.h"
 #include "JSEventTarget.h"
 
+#include "DOMWindow.h"
 #include "Document.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowShell.h"
 #include "JSEventListener.h"
-#include "JSEventTargetNode.h"
 #include "JSMessagePort.h"
-#include "JSWorker.h"
-#include "JSWorkerContext.h"
+#include "JSNode.h"
+#include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
-#include "Worker.h"
-#include "WorkerContext.h"
+#include "MessagePort.h"
+#include "XMLHttpRequest.h"
+#include "XMLHttpRequestUpload.h"
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "DOMApplicationCache.h"
+#include "JSDOMApplicationCache.h"
+#endif
 
 #if ENABLE(SVG)
 #include "SVGElementInstance.h"
 #include "JSSVGElementInstance.h"
 #endif
 
+#if ENABLE(WORKERS)
+#include "JSWorker.h"
+#include "JSWorkerContext.h"
+#include "Worker.h"
+#include "WorkerContext.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, EventTarget* target)
+JSValue toJS(ExecState* exec, EventTarget* target)
 {
     if (!target)
         return jsNull();
@@ -59,6 +74,9 @@ JSValuePtr toJS(ExecState* exec, EventTarget* target)
     if (Node* node = target->toNode())
         return toJS(exec, node);
 
+    if (DOMWindow* domWindow = target->toDOMWindow())
+        return toJS(exec, domWindow);
+
     if (XMLHttpRequest* xhr = target->toXMLHttpRequest())
         // XMLHttpRequest is always created via JS, so we don't need to use cacheDOMObject() here.
         return getCachedDOMObjectWrapper(exec->globalData(), xhr);
@@ -87,4 +105,34 @@ JSValuePtr toJS(ExecState* exec, EventTarget* target)
     return jsNull();
 }
 
+EventTarget* toEventTarget(JSC::JSValue value)
+{
+    #define CONVERT_TO_EVENT_TARGET(type) \
+        if (value.isObject(&JS##type::s_info)) \
+            return static_cast<JS##type*>(asObject(value))->impl();
+
+    CONVERT_TO_EVENT_TARGET(Node)
+    CONVERT_TO_EVENT_TARGET(XMLHttpRequest)
+    CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
+    CONVERT_TO_EVENT_TARGET(MessagePort)
+
+    if (value.isObject(&JSDOMWindowShell::s_info))
+        return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
+#endif
+
+#if ENABLE(SVG)
+    CONVERT_TO_EVENT_TARGET(SVGElementInstance)
+#endif
+
+#if ENABLE(WORKERS)
+    CONVERT_TO_EVENT_TARGET(Worker)
+    CONVERT_TO_EVENT_TARGET(WorkerContext)
+#endif
+
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
index 00dd84828e..05df0568db 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
@@ -36,7 +36,8 @@ namespace WebCore {
 
     class EventTarget;
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, EventTarget*);
+    JSC::JSValue toJS(JSC::ExecState*, EventTarget*);
+    EventTarget* toEventTarget(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h
deleted file mode 100644
index 2aa2bf2455..0000000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSEventTargetBase_h
-#define JSEventTargetBase_h
-
-#include "Event.h"
-#include "EventNames.h"
-#include "JSEvent.h"
-
-#define JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, macro) \
-    macro(specificEventTarget, OnAbort, abortEvent) \
-    macro(specificEventTarget, OnBlur, blurEvent) \
-    macro(specificEventTarget, OnChange, changeEvent) \
-    macro(specificEventTarget, OnClick, clickEvent) \
-    macro(specificEventTarget, OnContextMenu, contextmenuEvent) \
-    macro(specificEventTarget, OnDblClick, dblclickEvent) \
-    macro(specificEventTarget, OnError, errorEvent) \
-    macro(specificEventTarget, OnFocus, focusEvent) \
-    macro(specificEventTarget, OnInput, inputEvent) \
-    macro(specificEventTarget, OnKeyDown, keydownEvent) \
-    macro(specificEventTarget, OnKeyPress, keypressEvent) \
-    macro(specificEventTarget, OnKeyUp, keyupEvent) \
-    macro(specificEventTarget, OnLoad, loadEvent) \
-    macro(specificEventTarget, OnMouseDown, mousedownEvent) \
-    macro(specificEventTarget, OnMouseMove, mousemoveEvent) \
-    macro(specificEventTarget, OnMouseOut, mouseoutEvent) \
-    macro(specificEventTarget, OnMouseOver, mouseoverEvent) \
-    macro(specificEventTarget, OnMouseUp, mouseupEvent) \
-    macro(specificEventTarget, OnMouseWheel, mousewheelEvent) \
-    macro(specificEventTarget, OnBeforeCut, beforecutEvent) \
-    macro(specificEventTarget, OnCut, cutEvent) \
-    macro(specificEventTarget, OnBeforeCopy, beforecopyEvent) \
-    macro(specificEventTarget, OnCopy, copyEvent) \
-    macro(specificEventTarget, OnBeforePaste, beforepasteEvent) \
-    macro(specificEventTarget, OnPaste, pasteEvent) \
-    macro(specificEventTarget, OnDragEnter, dragenterEvent) \
-    macro(specificEventTarget, OnDragOver, dragoverEvent) \
-    macro(specificEventTarget, OnDragLeave, dragleaveEvent) \
-    macro(specificEventTarget, OnDrop, dropEvent) \
-    macro(specificEventTarget, OnDragStart, dragstartEvent) \
-    macro(specificEventTarget, OnDrag, dragEvent) \
-    macro(specificEventTarget, OnDragEnd, dragendEvent) \
-    macro(specificEventTarget, OnReset, resetEvent) \
-    macro(specificEventTarget, OnResize, resizeEvent) \
-    macro(specificEventTarget, OnScroll, scrollEvent) \
-    macro(specificEventTarget, OnSearch, searchEvent) \
-    macro(specificEventTarget, OnSelect, selectEvent) \
-    macro(specificEventTarget, OnSelectStart, selectstartEvent) \
-    macro(specificEventTarget, OnSubmit, submitEvent) \
-    macro(specificEventTarget, OnUnload, unloadEvent) \
-
-#define EVENT_LISTENER_GETTER(specificEventTarget, name, event) \
-JSC::JSValuePtr js##specificEventTarget##name(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot& slot) \
-{ \
-    return static_cast<JS##specificEventTarget*>(slot.slotBase())->getListener(event); \
-} \
-
-#define EVENT_LISTENER_SETTER(specificEventTarget, name, event) \
-void setJS##specificEventTarget##name(JSC::ExecState* exec, JSC::JSObject* baseObject, JSC::JSValuePtr value) \
-{ \
-    static_cast<JS##specificEventTarget*>(baseObject)->setListener(exec, event, value); \
-} \
-
-#define DECLARE_JS_EVENT_LISTENERS(specificEventTarget) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_GETTER) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_SETTER) \
-
-#endif // JSEventTargetBase_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 2b6fb20d50..493166c052 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -39,35 +39,42 @@ using namespace JSC;
 
 namespace WebCore {
 
-static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValuePtr value)
+static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
 
     JSObject* object = asObject(value);
 
-    JSValuePtr enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
+    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
     if (exec->hadException())
         return 0;
-    bool enableHighAccuracy = enableHighAccuracyValue->toBoolean(exec);
+    bool enableHighAccuracy = enableHighAccuracyValue.toBoolean(exec);
     if (exec->hadException())
         return 0;
 
-    JSValuePtr timeoutValue = object->get(exec, Identifier(exec, "timeout"));
+    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
     if (exec->hadException())
         return 0;
-    unsigned timeout = timeoutValue->toUInt32(exec);
+    unsigned timeout = timeoutValue.toUInt32(exec);
     if (exec->hadException())
         return 0;
 
-    return PositionOptions::create(enableHighAccuracy, timeout);
+    JSValue maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
+    if (exec->hadException())
+        return 0;
+    unsigned maximumAge = maximumAgeValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return PositionOptions::create(enableHighAccuracy, timeout, maximumAge);
 }
 
-JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0)->getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -79,8 +86,8 @@ JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& arg
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -91,22 +98,22 @@ JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& arg
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     
     return jsUndefined();
 }
 
-JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0)->getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -118,8 +125,8 @@ JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -130,13 +137,13 @@ JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     return jsNumber(exec, watchID);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
index 511c9d79e7..d559d3b767 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -40,7 +40,7 @@ namespace WebCore {
         {
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
         }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index a99a36d520..de6565d294 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,7 +38,7 @@ bool JSHTMLAppletElement::customGetOwnPropertySlot(ExecState* exec, const Identi
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLAppletElement::canGetItemsForName(ExecState*, HTMLAppletElement*, con
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index 7ff5392e2b..4100468999 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValuePtr getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
+static JSValue getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
 {
     Vector<RefPtr<Node> > namedItems;
     impl->namedItems(propertyName, namedItems);
@@ -51,7 +51,7 @@ static JSValuePtr getNamedItems(ExecState* exec, HTMLCollection* impl, const Ide
 
 // HTMLCollections are strange objects, they support both get and call,
 // so that document.forms.item(0) and document.forms(0) both work.
-static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callHTMLCollection(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -64,7 +64,7 @@ static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValu
     if (args.size() == 1) {
         // Support for document.all(<index>) etc.
         bool ok;
-        UString string = args.at(exec, 0)->toString(exec);
+        UString string = args.at(0).toString(exec);
         unsigned index = string.toUInt32(&ok, false);
         if (ok)
             return toJS(exec, collection->item(index));
@@ -75,8 +75,8 @@ static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValu
 
     // The second arg, if set, is the index of the item we want
     bool ok;
-    UString string = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toString(exec).toUInt32(&ok, false);
+    UString string = args.at(0).toString(exec);
+    unsigned index = args.at(1).toString(exec).toUInt32(&ok, false);
     if (ok) {
         String pstr = string;
         Node* node = collection->namedItem(pstr);
@@ -99,30 +99,30 @@ CallType JSHTMLCollection::getCallData(CallData& callData)
 
 bool JSHTMLCollection::canGetItemsForName(ExecState* exec, HTMLCollection* thisObj, const Identifier& propertyName)
 {
-    return !getNamedItems(exec, thisObj, propertyName)->isUndefined();
+    return !getNamedItems(exec, thisObj, propertyName).isUndefined();
 }
 
-JSValuePtr JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
     return getNamedItems(exec, thisObj->impl(), propertyName);
 }
 
-JSValuePtr JSHTMLCollection::item(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::item(ExecState* exec, const ArgList& args)
 {
     bool ok;
-    uint32_t index = args.at(exec, 0)->toString(exec).toUInt32(&ok, false);
+    uint32_t index = args.at(0).toString(exec).toUInt32(&ok, false);
     if (ok)
         return toJS(exec, impl()->item(index));
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
 {
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr toJS(ExecState* exec, HTMLCollection* collection)
+JSValue toJS(ExecState* exec, HTMLCollection* collection)
 {
     if (!collection)
         return jsNull();
@@ -133,10 +133,10 @@ JSValuePtr toJS(ExecState* exec, HTMLCollection* collection)
         return wrapper;
 
     switch (collection->type()) {
-        case HTMLCollection::SelectOptions:
+        case SelectOptions:
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLOptionsCollection, collection);
             break;
-        case HTMLCollection::DocAll:
+        case DocAll:
             typedef HTMLCollection HTMLAllCollection;
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLAllCollection, collection);
             break;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index e6abd29b8e..c113ec77dd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSHTMLDocument.h"
 
+#include "CharacterNames.h"
 #include "Frame.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCollection.h"
@@ -37,6 +38,8 @@
 #include "JSDOMWindowCustom.h"
 #include "JSDOMWindowShell.h"
 #include "JSHTMLCollection.h"
+#include "SegmentedString.h"
+#include "Tokenizer.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -51,7 +54,7 @@ bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, cons
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValuePtr JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
@@ -78,17 +81,17 @@ JSValuePtr JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propert
 
 // Custom attributes
 
-JSValuePtr JSHTMLDocument::all(ExecState* exec) const
+JSValue JSHTMLDocument::all(ExecState* exec) const
 {
     // If "all" has been overwritten, return the overwritten value
-    JSValuePtr v = getDirect(Identifier(exec, "all"));
+    JSValue v = getDirect(Identifier(exec, "all"));
     if (v)
         return v;
 
     return toJS(exec, static_cast<HTMLDocument*>(impl())->all().get());
 }
 
-void JSHTMLDocument::setAll(ExecState* exec, JSValuePtr value)
+void JSHTMLDocument::setAll(ExecState* exec, JSValue value)
 {
     // Add "all" to the property map.
     putDirect(Identifier(exec, "all"), value);
@@ -96,7 +99,7 @@ void JSHTMLDocument::setAll(ExecState* exec, JSValuePtr value)
 
 // Custom functions
 
-JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
 {
     // For compatibility with other browsers, pass open calls with more than 2 parameters to the window.
     if (args.size() > 2) {
@@ -104,9 +107,9 @@ JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
         if (frame) {
             JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame);
             if (wrapper) {
-                JSValuePtr function = wrapper->get(exec, Identifier(exec, "open"));
+                JSValue function = wrapper->get(exec, Identifier(exec, "open"));
                 CallData callData;
-                CallType callType = function->getCallData(callData);
+                CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
                 return call(exec, function, callType, callData, wrapper, args);
@@ -124,32 +127,42 @@ JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
     return this;
 }
 
-static String writeHelper(ExecState* exec, const ArgList& args)
-{
-    // DOM only specifies single string argument, but NS & IE allow multiple
-    // or no arguments.
+enum NewlineRequirement { DoNotAddNewline, DoAddNewline };
 
-    unsigned size = args.size();
-    if (size == 1)
-        return args.at(exec, 0)->toString(exec);
+static inline void documentWrite(ExecState* exec, const ArgList& args, HTMLDocument* document, NewlineRequirement addNewline)
+{
+    // DOM only specifies single string argument, but browsers allow multiple or no arguments.
+
+    size_t size = args.size();
+
+    UString firstString = args.at(0).toString(exec);
+    SegmentedString segmentedString = String(firstString);
+    if (size != 1) {
+        if (!size)
+            segmentedString.clear();
+        else {
+            for (size_t i = 1; i < size; ++i) {
+                UString subsequentString = args.at(i).toString(exec);
+                segmentedString.append(SegmentedString(String(subsequentString)));
+            }
+        }
+    }
+    if (addNewline)
+        segmentedString.append(SegmentedString(&newlineCharacter, 1));
 
-    Vector<UChar> result;
-    for (unsigned i = 0; i < size; ++i)
-        append(result, args.at(exec, i)->toString(exec));
-    return String::adopt(result);
+    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
+    document->write(segmentedString, activeDocument);
 }
 
-JSValuePtr JSHTMLDocument::write(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::write(ExecState* exec, const ArgList& args)
 {
-    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
-    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args), activeDocument);
+    documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoNotAddNewline);
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
 {
-    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
-    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args) + "\n", activeDocument);
+    documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoAddNewline);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 28563933ab..19aae8615e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,7 +38,7 @@ bool JSHTMLEmbedElement::customGetOwnPropertySlot(ExecState* exec, const Identif
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLEmbedElement::canGetItemsForName(ExecState*, HTMLEmbedElement*, const
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index 4e16cc55d2..8bf543cdc0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -26,8 +26,10 @@
 #include "config.h"
 #include "JSHTMLFormElement.h"
 
+#include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
+#include "JSDOMWindowCustom.h"
 #include "JSNamedNodesCollection.h"
 
 using namespace JSC;
@@ -41,7 +43,7 @@ bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, co
     return namedItems.size();
 }
 
-JSValuePtr JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     HTMLFormElement* form = static_cast<HTMLFormElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     
@@ -55,4 +57,13 @@ JSValuePtr JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& prop
     return jsUndefined();
 }
 
+JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
+{
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame)
+        return jsUndefined();
+    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture(), false);
+    return jsUndefined();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index a97a72a687..0a5d1f14b5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -40,14 +40,14 @@ namespace WebCore {
 
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
-    if (protocolIs(parseURL(value), "javascript")) {
+    if (protocolIsJavaScript(parseURL(value))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return false;
     }
     return true;
 }
 
-void JSHTMLFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String srcValue = valueToStringWithNullCheck(exec, value);
@@ -59,7 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValuePtr value)
     return;
 }
 
-void JSHTMLFrameElement::setLocation(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String locationValue = valueToStringWithNullCheck(exec, value);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index f17cb895bc..05972e6fb3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSHTMLFrameSetElement.h"
 
 #include "Document.h"
+#include "HTMLCollection.h"
 #include "HTMLFrameElement.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
@@ -46,7 +47,7 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValuePtr JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 1a0fc1c442..afff977dee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -38,13 +38,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
 
     String srcValue = valueToStringWithNullCheck(exec, value);
 
-    if (protocolIs(parseURL(srcValue), "javascript")) {
+    if (protocolIsJavaScript(parseURL(srcValue))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return;
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index d59ef92a01..6b47622163 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -26,47 +26,93 @@
 #include "config.h"
 #include "JSHTMLInputElement.h"
 
+#include "Document.h"
 #include "HTMLInputElement.h"
+#include "Settings.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-bool JSHTMLInputElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+static bool needsGmailQuirk(HTMLInputElement* input)
 {
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
-    if (input->canHaveSelection())
+    Document* document = input->document();
+
+    const KURL& url = document->url();
+    if (url.host() != "mail.google.com")
+        return false;
+
+    // As with other site-specific quirks, allow website developers to turn this off.
+    // In theory, this allows website developers to check if their fixes are effective.
+    Settings* settings = document->settings();
+    if (!settings)
+        return false;
+    if (!settings->needsSiteSpecificQuirks())
         return false;
 
-    const HashEntry* entry = JSHTMLInputElementPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == jsHTMLInputElementPrototypeFunctionSetSelectionRange) {
-                slot.setUndefined();
-                return true;
-            }
-        }
-    }
-
-    return false;
+    return true;
 }
 
-JSValuePtr JSHTMLInputElement::selectionStart(ExecState* exec) const
+JSValue JSHTMLInputElement::type(ExecState* exec) const
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    const AtomicString& type = input->type();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
+    DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
+
+    if (type == url && needsGmailQuirk(input))
+        return jsString(exec, text);
+    return jsString(exec, type);
+}
+
+JSValue JSHTMLInputElement::selectionStart(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
-        return jsUndefined();
+        return throwError(exec, TypeError);
 
     return jsNumber(exec, input->selectionStart());
 }
 
-JSValuePtr JSHTMLInputElement::selectionEnd(ExecState* exec) const
+void JSHTMLInputElement::setSelectionStart(ExecState* exec, JSValue value)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        throwError(exec, TypeError);
+
+    input->setSelectionStart(value.toInt32(exec));
+}
+
+JSValue JSHTMLInputElement::selectionEnd(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
-        return jsUndefined();
+        return throwError(exec, TypeError);
 
     return jsNumber(exec, input->selectionEnd());
 }
 
+void JSHTMLInputElement::setSelectionEnd(ExecState* exec, JSValue value)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        throwError(exec, TypeError);
+
+    input->setSelectionEnd(value.toInt32(exec));
+}
+
+JSValue JSHTMLInputElement::setSelectionRange(ExecState* exec, const ArgList& args)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        return throwError(exec, TypeError);
+
+    int start = args.at(0).toInt32(exec);
+    int end = args.at(1).toInt32(exec);
+
+    input->setSelectionRange(start, end);
+    return jsUndefined();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 5ad34548ec..f7f12b9511 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,7 +38,7 @@ bool JSHTMLObjectElement::customGetOwnPropertySlot(ExecState* exec, const Identi
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLObjectElement::canGetItemsForName(ExecState*, HTMLObjectElement*, con
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
index d60483d3ed..460ba084ac 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
@@ -35,18 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSHTMLOptionsCollection::length(ExecState* exec) const
+JSValue JSHTMLOptionsCollection::length(ExecState* exec) const
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     return jsNumber(exec, imp->length());
 }
 
-void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValuePtr value)
+void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     ExceptionCode ec = 0;
     unsigned newLength = 0;
-    double lengthValue = value->toNumber(exec);
+    double lengthValue = value.toNumber(exec);
     if (!isnan(lengthValue) && !isinf(lengthValue)) {
         if (lengthValue < 0.0)
             ec = INDEX_SIZE_ERR;
@@ -60,23 +60,23 @@ void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValuePtr value)
+void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     HTMLSelectElement* base = static_cast<HTMLSelectElement*>(imp->base());
     selectIndexSetter(base, exec, index, value);
 }
 
-JSValuePtr JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
-    HTMLOptionElement* option = toHTMLOptionElement(args.at(exec, 0));
+    HTMLOptionElement* option = toHTMLOptionElement(args.at(0));
     ExceptionCode ec = 0;
     if (args.size() < 2)
         imp->add(option, ec);
     else {
         bool ok;
-        int index = args.at(exec, 1)->toInt32(exec, ok);
+        int index = args.at(1).toInt32(exec, ok);
         if (exec->hadException())
             return jsUndefined();
         if (!ok)
@@ -88,7 +88,7 @@ JSValuePtr JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(asObject(toJS(exec, imp->base())));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
index 4094418eca..9bb6b757fa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
@@ -32,23 +32,23 @@ namespace WebCore {
 using namespace JSC;
 using namespace HTMLNames;
 
-JSValuePtr JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
 {
     HTMLSelectElement& select = *static_cast<HTMLSelectElement*>(impl());
 
     // we support both options index and options objects
-    HTMLElement* element = toHTMLElement(args.at(exec, 0));
+    HTMLElement* element = toHTMLElement(args.at(0));
     if (element && element->hasTagName(optionTag))
         select.remove(static_cast<HTMLOptionElement*>(element)->index());
     else
-        select.remove(args.at(exec, 0)->toInt32(exec));
+        select.remove(args.at(0).toInt32(exec));
 
     return jsUndefined();
 }
 
-void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         select->remove(index);
     else {
         ExceptionCode ec = 0;
@@ -61,7 +61,7 @@ void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned
     }
 }
 
-void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     selectIndexSetter(static_cast<HTMLSelectElement*>(impl()), exec, index, value);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
index 87344b5a30..a4490380c1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValue);
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index 1baa6d4b92..998a3641f3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -37,17 +37,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
-JSValuePtr nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
-JSValuePtr nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
@@ -92,7 +92,7 @@ bool JSHistory::customGetOwnPropertySlot(ExecState* exec, const Identifier& prop
     return true;
 }
 
-bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValuePtr, PutPropertySlot&)
+bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index 2237c7acfe..4a27bb4a22 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -22,6 +22,7 @@
 
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
+#include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
 
@@ -29,15 +30,23 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor);
 
 const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", 0, 0, 0 };
 
-JSImageConstructor::JSImageConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSImageConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
+
+    putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+}
+
+Document* JSImageConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
 }
 
 static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
@@ -48,14 +57,16 @@ static JSObject* constructImage(ExecState* exec, JSObject* constructor, const Ar
     int height = 0;
     if (args.size() > 0) {
         widthSet = true;
-        width = args.at(exec, 0)->toInt32(exec);
+        width = args.at(0).toInt32(exec);
     }
     if (args.size() > 1) {
         heightSet = true;
-        height = args.at(exec, 1)->toInt32(exec);
+        height = args.at(1).toInt32(exec);
     }
 
     Document* document = static_cast<JSImageConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
 
     // Calling toJS on the document causes the JS document wrapper to be
     // added to the window object. This is done to ensure that JSDocument::mark
@@ -79,8 +90,8 @@ ConstructType JSImageConstructor::getConstructData(ConstructData& constructData)
 void JSImageConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
index 13cce26482..8dc7add2ac 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
@@ -27,8 +27,8 @@ namespace WebCore {
 
     class JSImageConstructor : public DOMObject {
     public:
-        JSImageConstructor(JSC::ExecState*, ScriptExecutionContext*);
-        Document* document() const { return m_document->impl(); }
+        JSImageConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
         
@@ -37,7 +37,7 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
index 920121ea75..32fe58bcf5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, ImageData* imageData)
+JSValue toJS(ExecState* exec, ImageData* imageData)
 {
     if (!imageData)
         return jsNull();
@@ -49,7 +49,7 @@ JSValuePtr toJS(ExecState* exec, ImageData* imageData)
     Identifier dataName(exec, "data");
     DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(jsNull())));
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", 0, 0, 0 };
-    wrapper->putDirect(dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data(), &cpaClassInfo), DontDelete | ReadOnly);
+    wrapper->putDirect(dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data(), &cpaClassInfo), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
     return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index 80c35df450..fff7aee27b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper);
 
 typedef HashMap<JSObject*, JSInspectedObjectWrapper*> WrapperMap;
 typedef HashMap<JSGlobalObject*, WrapperMap*> GlobalObjectWrapperMap;
@@ -47,9 +47,9 @@ static GlobalObjectWrapperMap& wrappers()
 
 const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
 
-JSValuePtr JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
-    if (!unwrappedValue->isObject())
+    if (!unwrappedValue.isObject())
         return unwrappedValue;
 
     JSObject* unwrappedObject = asObject(unwrappedValue);
@@ -57,14 +57,14 @@ JSValuePtr JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValuePtr u
     if (unwrappedObject->inherits(&JSInspectedObjectWrapper::s_info))
         return unwrappedObject;
 
-    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->dynamicGlobalObject()))
+    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->lexicalGlobalObject()))
         if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
             return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
-    ASSERT(prototype->isNull() || prototype->isObject());
+    JSValue prototype = unwrappedObject->prototype();
+    ASSERT(prototype.isNull() || prototype.isObject());
 
-    if (prototype->isNull())
+    if (prototype.isNull())
         return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
     return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
 }
@@ -96,11 +96,11 @@ JSInspectedObjectWrapper::~JSInspectedObjectWrapper()
     }
 }
 
-JSValuePtr JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValuePtr value) const
+JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value) const
 {
     // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
 
-    if (!value->isObject())
+    if (!value.isObject())
         return value;
 
     JSQuarantinedObjectWrapper* wrapper = asWrapper(value);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
index 273c0b0a17..201feb675b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
         virtual ~JSInspectedObjectWrapper();
 
         static const JSC::ClassInfo s_info;
@@ -48,8 +48,8 @@ namespace WebCore {
         virtual bool allowsCallAsFunction() const { return true; }
         virtual bool allowsGetPropertyNames() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 8e13e42360..0e14109c05 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper);
 
 typedef HashMap<JSObject*, JSInspectorCallbackWrapper*> WrapperMap;
 
@@ -53,9 +53,9 @@ static Structure* leakInspectorCallbackWrapperStructure()
     return structure;
 }
 
-JSValuePtr JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
-    if (!unwrappedValue->isObject())
+    if (!unwrappedValue.isObject())
         return unwrappedValue;
 
     JSObject* unwrappedObject = asObject(unwrappedValue);
@@ -66,10 +66,10 @@ JSValuePtr JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValuePtr
     if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
         return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
-    ASSERT(prototype->isNull() || prototype->isObject());
+    JSValue prototype = unwrappedObject->prototype();
+    ASSERT(prototype.isNull() || prototype.isObject());
 
-    if (prototype->isNull()) {
+    if (prototype.isNull()) {
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
@@ -88,7 +88,7 @@ JSInspectorCallbackWrapper::~JSInspectorCallbackWrapper()
     wrappers().remove(unwrappedObject());
 }
 
-JSValuePtr JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValuePtr unwrappedValue) const
+JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue unwrappedValue) const
 {
     if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
         // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
index 49157c0eb4..cfc2fb6ef8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
 
         virtual ~JSInspectorCallbackWrapper();
 
@@ -44,8 +44,8 @@ namespace WebCore {
 
         virtual bool allowsCallAsFunction() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp
new file mode 100644
index 0000000000..b06c9e9802
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorController.h"
+
+#include "Console.h"
+#if ENABLE(DATABASE)
+#include "Database.h"
+#include "JSDatabase.h"
+#endif
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "InspectorController.h"
+#include "InspectorResource.h"
+#include "JSDOMWindow.h"
+#include "JSInspectedObjectWrapper.h"
+#include "JSInspectorCallbackWrapper.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "Node.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JavaScriptDebugServer.h"
+#include "JavaScriptProfile.h"
+#include "JSJavaScriptCallFrame.h"
+#include <profiler/Profile.h>
+#include <profiler/Profiler.h>
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorController::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    impl()->highlight(node);
+
+    return jsUndefined();
+}
+
+JSValue JSInspectorController::getResourceDocumentNode(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    bool ok = false;
+    unsigned identifier = args.at(0).toUInt32(exec, ok);
+    if (!ok)
+        return jsUndefined();
+
+    RefPtr<InspectorResource> resource = impl()->resources().get(identifier);
+    ASSERT(resource);
+    if (!resource)
+        return jsUndefined();
+
+    Frame* frame = resource->frame();
+    Document* document = frame->document();
+
+    if (document->isPluginDocument() || document->isImageDocument() || document->isMediaDocument())
+        return jsUndefined();
+
+    ExecState* resourceExec = toJSDOMWindowShell(frame)->window()->globalExec();
+
+    JSLock lock(false);
+    return JSInspectedObjectWrapper::wrap(resourceExec, toJS(resourceExec, document));
+}
+
+JSValue JSInspectorController::search(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    String target = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result.append(toJS(exec, resultRange.get()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return constructArray(exec, result);
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorController::databaseTableNames(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (!database)
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+
+    Vector<String> tableNames = database->tableNames();
+    unsigned length = tableNames.size();
+    for (unsigned i = 0; i < length; ++i)
+        result.append(jsString(exec, tableNames[i]));
+
+    return constructArray(exec, result);
+}
+#endif
+
+JSValue JSInspectorController::inspectedWindow(ExecState*, const ArgList&)
+{
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(impl()->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
+}
+
+JSValue JSInspectorController::setting(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    String key = args.at(0).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    const InspectorController::Setting& setting = impl()->setting(key);
+
+    switch (setting.type()) {
+        default:
+        case InspectorController::Setting::NoType:
+            return jsUndefined();
+        case InspectorController::Setting::StringType:
+            return jsString(exec, setting.string());
+        case InspectorController::Setting::DoubleType:
+            return jsNumber(exec, setting.doubleValue());
+        case InspectorController::Setting::IntegerType:
+            return jsNumber(exec, setting.integerValue());
+        case InspectorController::Setting::BooleanType:
+            return jsBoolean(setting.booleanValue());
+        case InspectorController::Setting::StringVectorType: {
+            MarkedArgumentBuffer stringsArray;
+            const Vector<String>& strings = setting.stringVector();
+            const unsigned length = strings.size();
+            for (unsigned i = 0; i < length; ++i)
+                stringsArray.append(jsString(exec, strings[i]));
+            return constructArray(exec, stringsArray);
+        }
+    }
+}
+
+JSValue JSInspectorController::setSetting(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    String key = args.at(0).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    InspectorController::Setting setting;
+
+    JSValue value = args.at(1);
+    if (value.isUndefined() || value.isNull()) {
+        // Do nothing. The setting is already NoType.
+        ASSERT(setting.type() == InspectorController::Setting::NoType);
+    } else if (value.isString())
+        setting.set(value.toString(exec));
+    else if (value.isNumber())
+        setting.set(value.toNumber(exec));
+    else if (value.isBoolean())
+        setting.set(value.toBoolean(exec));
+    else {
+        JSArray* jsArray = asArray(value);
+        if (!jsArray)
+            return jsUndefined();
+        Vector<String> strings;
+        for (unsigned i = 0; i < jsArray->length(); ++i) {
+            String item = jsArray->get(exec, i).toString(exec);
+            if (exec->hadException())
+                return jsUndefined();
+            strings.append(item);
+        }
+        setting.set(strings);
+    }
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    impl()->setSetting(key, setting);
+
+    return jsUndefined();
+}
+
+JSValue JSInspectorController::wrapCallback(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return JSInspectorCallbackWrapper::wrap(exec, args.at(0));
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+JSValue JSInspectorController::currentCallFrame(ExecState* exec, const ArgList&)
+{
+    JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
+    if (!callFrame || !callFrame->isValid())
+        return jsUndefined();
+
+    // FIXME: I am not sure if this is actually needed. Can we just use exec?
+    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
+
+    JSLock lock(false);
+    return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
+}
+
+JSValue JSInspectorController::profiles(JSC::ExecState* exec, const JSC::ArgList&)
+{
+    JSLock lock(false);
+    MarkedArgumentBuffer result;
+    const Vector<RefPtr<Profile> >& profiles = impl()->profiles();
+
+    for (size_t i = 0; i < profiles.size(); ++i)
+        result.append(toJS(exec, profiles[i].get()));
+
+    return constructArray(exec, result);
+}
+
+#endif
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index c3f89c3820..08ecf2b126 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSJavaScriptCallFrame.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JavaScriptCallFrame.h"
 #include <runtime/ArrayPrototype.h>
 
@@ -33,10 +35,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
+JSValue JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr exception = noValue();
-    JSValuePtr result = impl()->evaluate(args.at(exec, 0)->toString(exec), exception);
+    JSValue exception;
+    JSValue result = impl()->evaluate(args.at(0).toString(exec), exception);
 
     if (exception)
         exec->setException(exception);
@@ -44,12 +46,12 @@ JSValuePtr JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
     return result;
 }
 
-JSValuePtr JSJavaScriptCallFrame::thisObject(ExecState*) const
+JSValue JSJavaScriptCallFrame::thisObject(ExecState*) const
 {
     return impl()->thisObject() ? impl()->thisObject() : jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::type(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
 {
     switch (impl()->type()) {
         case DebuggerCallFrame::FunctionType:
@@ -62,7 +64,7 @@ JSValuePtr JSJavaScriptCallFrame::type(ExecState* exec) const
     return jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 {
     if (!impl()->scopeChain())
         return jsNull();
@@ -74,7 +76,7 @@ JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
     // we must always have something in the scope chain
     ASSERT(iter != end);
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     do {
         list.append(*iter);
         ++iter;
@@ -84,3 +86,5 @@ JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
new file mode 100644
index 0000000000..f7c74aebd6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -0,0 +1,129 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSLazyEventListener.h"
+
+#include "Frame.h"
+#include "JSNode.h"
+#include <runtime/FunctionConstructor.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefCountedLeakCounter.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
+#endif
+
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+    : JSEventListener(0, globalObject, true)
+    , m_functionName(functionName)
+    , m_eventParameterName(eventParameterName)
+    , m_code(code)
+    , m_parsed(false)
+    , m_lineNumber(lineNumber)
+    , m_originalNode(node)
+{
+    // We don't retain the original node because we assume it
+    // will stay alive as long as this handler object is around
+    // and we need to avoid a reference cycle. If JS transfers
+    // this handler to another node, parseCode will be called and
+    // then originalNode is no longer needed.
+
+    // A JSLazyEventListener can be created with a line number of zero when it is created with
+    // a setAttribute call from JavaScript, so make the line number 1 in that case.
+    if (m_lineNumber == 0)
+        m_lineNumber = 1;
+
+#ifndef NDEBUG
+    eventListenerCounter.increment();
+#endif
+}
+
+JSLazyEventListener::~JSLazyEventListener()
+{
+#ifndef NDEBUG
+    eventListenerCounter.decrement();
+#endif
+}
+
+JSObject* JSLazyEventListener::jsFunction() const
+{
+    parseCode();
+    return m_jsFunction;
+}
+
+void JSLazyEventListener::parseCode() const
+{
+    if (m_parsed)
+        return;
+
+    if (m_globalObject->scriptExecutionContext()->isDocument()) {
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
+        Frame* frame = window->impl()->frame();
+        if (!frame)
+            return;
+        // FIXME: Is this check needed for non-Document contexts?
+        ScriptController* script = frame->script();
+        if (!script->isEnabled() || script->isPaused())
+            return;
+    }
+
+    m_parsed = true;
+
+    ExecState* exec = m_globalObject->globalExec();
+
+    MarkedArgumentBuffer args;
+    UString sourceURL(m_globalObject->scriptExecutionContext()->url().string());
+    args.append(jsNontrivialString(exec, m_eventParameterName));
+    args.append(jsString(exec, m_code));
+
+    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
+    // have been added with setAttribute from a script, and we should pass String() in that case.
+    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
+
+    if (exec->hadException()) {
+        exec->clearException();
+
+        // failed to parse, so let's just make this listener a no-op
+        m_jsFunction = 0;
+    } else if (m_originalNode) {
+        // Add the event's home element to the scope
+        // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
+        ScopeChain scope = listenerAsFunction->scope();
+
+        JSValue thisObj = toJS(exec, m_originalNode);
+        if (thisObj.isObject()) {
+            static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
+            listenerAsFunction->setScope(scope);
+        }
+    }
+
+    // Since we only parse once, there's no need to keep data used for parsing around anymore.
+    m_functionName = String();
+    m_code = String();
+    m_eventParameterName = String();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
new file mode 100644
index 0000000000..a5304cf519
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSLazyEventListener_h
+#define JSLazyEventListener_h
+
+#include "JSEventListener.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class Node;
+
+    class JSLazyEventListener : public JSEventListener {
+    public:
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        {
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, globalObject, node, lineNumber));
+        }
+        virtual ~JSLazyEventListener();
+
+    private:
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+
+        virtual JSC::JSObject* jsFunction() const;
+        virtual bool wasCreatedFromMarkup() const { return true; }
+
+        void parseCode() const;
+
+        mutable String m_functionName;
+        mutable String m_eventParameterName;
+        mutable String m_code;
+        mutable bool m_parsed;
+        int m_lineNumber;
+        Node* m_originalNode;
+    };
+
+} // namespace WebCore
+
+#endif // JSEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index b24a62cd9c..9c5a8347a5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -37,17 +37,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
-JSValuePtr nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
-JSValuePtr nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
@@ -76,7 +76,7 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
             slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
             return true;
         } else if (entry->function() == jsLocationPrototypeFunctionReload) {
-            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
             return true;
         } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
             slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
@@ -93,12 +93,15 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
     return true;
 }
 
-bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return true;
 
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return true;
+
     bool sameDomainAccess = allowsAccessFromFrame(exec, frame);
 
     const HashEntry* entry = JSLocation::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,177 +136,191 @@ bool JSLocation::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
     return false;
 }
 
-static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!url.protocolIs("javascript") || allowsAccessFromFrame(exec, frame)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
-        frame->loader()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, userGesture);
-    }
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
 }
 
-void JSLocation::setHref(ExecState* exec, JSValuePtr value)
+static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return;
+
+    if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
+        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+}
+
+void JSLocation::setHref(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(exec, frame))
         return;
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
         return;
 
-    KURL url = activeFrame->loader()->completeURL(value->toString(exec));
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setProtocol(ExecState* exec, JSValuePtr value)
+void JSLocation::setProtocol(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setProtocol(value->toString(exec));
+    url.setProtocol(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHost(ExecState* exec, JSValuePtr value)
+void JSLocation::setHost(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setHostAndPort(value->toString(exec));
+    url.setHostAndPort(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHostname(ExecState* exec, JSValuePtr value)
+void JSLocation::setHostname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setHost(value->toString(exec));
+    url.setHost(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPort(ExecState* exec, JSValuePtr value)
+void JSLocation::setPort(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
     // FIXME: Could make this a little less ugly if String provided a toUnsignedShort function.
-    const UString& portString = value->toString(exec);
+    const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
         port = 0;
     url.setPort(port);
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPathname(ExecState* exec, JSValuePtr value)
+void JSLocation::setPathname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setPath(value->toString(exec));
+    url.setPath(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setSearch(ExecState* exec, JSValuePtr value)
+void JSLocation::setSearch(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setQuery(value->toString(exec));
+    url.setQuery(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHash(ExecState* exec, JSValuePtr value)
+void JSLocation::setHash(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
     String oldRef = url.ref();
-    String str = value->toString(exec);
+    String str = value.toString(exec);
     if (str.startsWith("#"))
         str = str.substring(1);
     if (oldRef == str || (oldRef.isNull() && str.isEmpty()))
         return;
     url.setRef(str);
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-JSValuePtr JSLocation::replace(ExecState* exec, const ArgList& args)
+JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame) 
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
         return jsUndefined();
 
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), true);
+    navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::reload(ExecState* exec, const ArgList&)
+JSValue JSLocation::reload(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
-    JSDOMWindow* window = toJSDOMWindow(frame);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    if (!frame->loader()->url().protocolIs("javascript") || (window && window->allowsAccessFrom(exec))) {
-        bool userGesture = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()->script()->processingUserGesture();
-        frame->loader()->scheduleRefresh(userGesture);
-    }
+    if (!protocolIsJavaScript(frame->loader()->url()))
+        frame->loader()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::assign(ExecState* exec, const ArgList& args)
+JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
         return jsUndefined();
 
     // We want a new history item if this JS was called via a user gesture
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::toString(ExecState* exec, const ArgList&)
+JSValue JSLocation::toString(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    if (!allowsAccessFromFrame(exec, frame))
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
     return jsString(exec, impl()->toString());
 }
 
+bool JSLocationPrototype::customPut(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&)
+{
+    return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
+}
+
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 6c11bea4a6..495bd53a1c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -29,7 +29,6 @@
 #include "Document.h"
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
-#include "JSWorkerContext.h"
 #include "MessageChannel.h"
 
 using namespace JSC;
@@ -38,26 +37,22 @@ namespace WebCore {
 
 const ClassInfo JSMessageChannelConstructor::s_info = { "MessageChannelConstructor", 0, 0, 0 };
 
-JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, ScriptExecutionContext* scriptExecutionContext)
+JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSMessageChannelConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_scriptExecutionContext(scriptExecutionContext)
+    , m_globalObject(globalObject)
 {
-    if (m_scriptExecutionContext->isDocument())
-        m_contextWrapper = toJS(exec, static_cast<Document*>(scriptExecutionContext));
-#if ENABLE(WORKERS)
-    else if (m_scriptExecutionContext->isWorkerContext())
-        m_contextWrapper = toJSDOMGlobalObject(scriptExecutionContext);
-#endif
-    else
-        ASSERT_NOT_REACHED();
-
-    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 JSMessageChannelConstructor::~JSMessageChannelConstructor()
 {
 }
 
+ScriptExecutionContext* JSMessageChannelConstructor::scriptExecutionContext() const
+{
+    return m_globalObject->scriptExecutionContext();
+}
+
 ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& constructData)
 {
     constructData.native.function = construct;
@@ -66,14 +61,18 @@ ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& const
 
 JSObject* JSMessageChannelConstructor::construct(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    return asObject(toJS(exec, MessageChannel::create(static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext())));
+    ScriptExecutionContext* context = static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "MessageChannel constructor associated document is unavailable");
+
+    return asObject(toJS(exec, MessageChannel::create(context)));
 }
 
 void JSMessageChannelConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_contextWrapper->marked())
-        m_contextWrapper->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
index 614f6ae4a5..90c29a3c11 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
@@ -32,12 +32,12 @@ namespace WebCore {
 
     class JSMessageChannelConstructor : public DOMObject {
     public:
-        JSMessageChannelConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSMessageChannelConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         virtual ~JSMessageChannelConstructor();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
+        ScriptExecutionContext* scriptExecutionContext() const;
 
         virtual bool implementsHasInstance() const { return true; }
         static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
@@ -46,8 +46,7 @@ namespace WebCore {
         virtual void mark();
 
     private:
-        ScriptExecutionContext* m_scriptExecutionContext;
-        JSC::JSValuePtr m_contextWrapper;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index d0615deca6..f4809aeebb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,13 +42,10 @@ void JSMessagePort::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onmessage()))
-        listener->mark();
+    markIfNotNull(m_impl->onmessage());
+    markIfNotNull(m_impl->onclose());
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onclose()))
-        listener->mark();
-
-    if (MessagePort* entangledPort = m_impl->entangledPort()) {
+    if (MessagePortProxy* entangledPort = m_impl->entangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
         if (wrapper && !wrapper->marked())
             wrapper->mark();
@@ -58,42 +55,40 @@ void JSMessagePort::mark()
     typedef MessagePort::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     return toJS(exec, impl()->startConversation(globalObject->scriptExecutionContext(), message).get());
 }
 
-JSValuePtr JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
index 5338d5b63b..c90dadd077 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -33,7 +33,7 @@ bool JSMimeTypeArray::canGetItemsForName(ExecState*, MimeTypeArray* mimeTypeArra
     return mimeTypeArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index e7b0764e35..7bd95b4d95 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -41,7 +41,7 @@ bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Id
     return impl->getNamedItem(propertyName);
 }
 
-JSValuePtr JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
index 8a7ee0e303..93a8937160 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -29,13 +29,13 @@
 #include "AtomicString.h"
 #include "Element.h"
 #include "JSNode.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection)
+ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection);
 
 const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
 
@@ -48,13 +48,13 @@ JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, const Vector<Ref
 {
 }
 
-JSValuePtr JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return jsNumber(exec, thisObj->m_nodes->size());
 }
 
-JSValuePtr JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
index 19f194b9e3..3bbc102b9c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -44,19 +44,19 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
 
     private:
-        static JSC::JSValuePtr lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         OwnPtr<Vector<RefPtr<Node> > > m_nodes;
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
index 2287426824..ea6ccebd26 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -2,7 +2,7 @@
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
  *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  *  This library is free software; you can redistribute it and/or
@@ -23,96 +23,12 @@
 #include "config.h"
 #include "JSNavigator.h"
 
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "KURL.h"
 #include "Navigator.h"
-#include "Settings.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-static bool needsYouTubeQuirk(ExecState*, Frame*);
-
-#if 1
-
-static inline bool needsYouTubeQuirk(ExecState*, Frame*)
-{
-    return false;
-}
-
-#else
-
-static bool needsYouTubeQuirk(ExecState* exec, Frame* frame)
-{
-    // This quirk works around a mistaken check in an ad at youtube.com.
-    // There's a function called isSafari that returns false if the function
-    // called isWindows returns true; thus the site malfunctions with Windows Safari.
-
-    // Do the quirk only if the function's name is "isWindows".
-    JSFunction* function = exec->function();
-    if (!function)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isWindowsFunctionName, (exec, "isWindows"));
-    if (function->functionName() != isWindowsFunctionName)
-        return false;
-
-    // Do the quirk only if the function is called by an "isSafari" function.
-    // However, that function is not itself named -- it is stored in the isSafari
-    // property, though, so that's how we recognize it.
-    ExecState* callingExec = exec->callingExecState();
-    if (!callingExec)
-        return false;
-    JSFunction* callingFunction = callingExec->function();
-    if (!callingFunction)
-        return false;
-    JSObject* thisObject = callingExec->thisValue();
-    if (!thisObject)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isSafariFunction, (exec, "isSafari"));
-    JSValuePtr isSafariFunction = thisObject->getDirect(isSafariFunctionName);
-    if (isSafariFunction != callingFunction)
-        return false;
-
-    Document* document = frame->document();
-    // FIXME: The document is never null, so we should remove this check along with the
-    // other similar ones in this file when we are absolutely sure it's safe.
-    if (!document)
-        return false;
-
-    // Do the quirk only on the front page of the global version of YouTube.
-    const KURL& url = document->url();
-    if (url.host() != "youtube.com" && url.host() != "www.youtube.com")
-        return false;
-    if (url.path() != "/")
-        return false;
-
-    // As with other site-specific quirks, allow website developers to turn this off.
-    // In theory, this allows website developers to check if their fixes are effective.
-    Settings* settings = frame->settings();
-    if (!settings)
-        return false;
-    if (!settings->needsSiteSpecificQuirks())
-        return false;
-
-    return true;
-}
-
-#endif
-
-JSValuePtr JSNavigator::appVersion(ExecState* exec) const
-{
-    Navigator* imp = static_cast<Navigator*>(impl());
-    Frame* frame = imp->frame();
-    if (!frame)
-        return jsString(exec, "");
-
-    if (needsYouTubeQuirk(exec, frame))
-        return jsString(exec, "");
-    return jsString(exec, imp->appVersion());
-}
-
 void JSNavigator::mark()
 {
     Base::mark();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2b4d6d4756..79ac6b78cb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -43,6 +43,7 @@
 #include "JSDocumentType.h"
 #include "JSEntity.h"
 #include "JSEntityReference.h"
+#include "JSEventListener.h"
 #include "JSHTMLElement.h"
 #include "JSHTMLElementWrapperFactory.h"
 #include "JSNotation.h"
@@ -51,6 +52,7 @@
 #include "Node.h"
 #include "Notation.h"
 #include "ProcessingInstruction.h"
+#include "RegisteredEventListener.h"
 #include "Text.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -66,62 +68,90 @@ namespace WebCore {
 
 typedef int ExpectionCode;
 
-JSValuePtr JSNode::insertBefore(ExecState* exec, const ArgList& args)
+JSValue JSNode::insertBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->insertBefore(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->insertBefore(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::replaceChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::replaceChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->replaceChild(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->replaceChild(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 1);
+        return args.at(1);
     return jsNull();
 }
 
-JSValuePtr JSNode::removeChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::removeChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->removeChild(toNode(args.at(exec, 0)), ec);
+    bool ok = impl()->removeChild(toNode(args.at(0)), ec);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::appendChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->appendChild(toNode(args.at(exec, 0)), ec, true);
+    bool ok = impl()->appendChild(toNode(args.at(0)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
+JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    return jsUndefined();
+}
+
+JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    return jsUndefined();
+}
+
+void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
+{
+}
+
 void JSNode::mark()
 {
     ASSERT(!marked());
 
     Node* node = m_impl.get();
 
-    // Nodes in the document are kept alive by JSDocument::mark,
-    // so we have no special responsibilities and can just call the base class here.
+    // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
+    // the document, we need to mark the document, but we don't need to explicitly
+    // mark any other nodes.
     if (node->inDocument()) {
-        // But if the document isn't marked we have to mark it to ensure that
-        // nodes reachable from this one are also marked
+        DOMObject::mark();
+        markEventListeners(node->eventListeners());
         if (Document* doc = node->ownerDocument())
             if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
                 if (!docWrapper->marked())
                     docWrapper->mark();
-        DOMObject::mark();
         return;
     }
 
@@ -131,14 +161,15 @@ void JSNode::mark()
     for (Node* current = m_impl.get(); current; current = current->parentNode())
         root = current;
 
-    // If we're already marking this tree, then we can simply mark this wrapper
-    // by calling the base class; our caller is iterating the tree.
+    // Nodes in a subtree are marked by the tree's root, so, if the root is already
+    // marking the tree, we don't need to explicitly mark any other nodes.
     if (root->inSubtreeMark()) {
         DOMObject::mark();
+        markEventListeners(node->eventListeners());
         return;
     }
 
-    // Mark the whole tree; use the global set of roots to avoid reentering.
+    // Mark the whole tree subtree.
     root->setInSubtreeMark(true);
     for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
         JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
@@ -161,7 +192,7 @@ void JSNode::mark()
     ASSERT(marked());
 }
 
-static ALWAYS_INLINE JSValuePtr createWrapper(ExecState* exec, Node* node)
+static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, Node* node)
 {
     ASSERT(node);
     ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
@@ -218,7 +249,7 @@ static ALWAYS_INLINE JSValuePtr createWrapper(ExecState* exec, Node* node)
     return wrapper;    
 }
     
-JSValuePtr toJSNewlyCreated(ExecState* exec, Node* node)
+JSValue toJSNewlyCreated(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
@@ -226,7 +257,7 @@ JSValuePtr toJSNewlyCreated(ExecState* exec, Node* node)
     return createWrapper(exec, node);
 }
     
-JSValuePtr toJS(ExecState* exec, Node* node)
+JSValue toJS(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 55a282e06f..f5d4d5c363 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -29,17 +29,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition);
 
-JSNodeFilterCondition::JSNodeFilterCondition(JSValuePtr filter)
+JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
     : m_filter(filter)
 {
 }
 
 void JSNodeFilterCondition::mark()
 {
-    if (!m_filter->marked())
-        m_filter->mark();
+    if (!m_filter.marked())
+        m_filter.mark();
 }
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
@@ -47,7 +47,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     JSLock lock(false);
 
     CallData callData;
-    CallType callType = m_filter->getCallData(callData);
+    CallType callType = m_filter.getCallData(callData);
     if (callType == CallTypeNone)
         return NodeFilter::FILTER_ACCEPT;
 
@@ -60,16 +60,16 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (!exec)
         return NodeFilter::FILTER_REJECT;
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, filterNode));
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValuePtr result = call(exec, m_filter, callType, callData, m_filter, args);
+    JSValue result = call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    int intResult = result->toInt32(exec);
+    int intResult = result.toInt32(exec);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
index 2600d90047..3d591c6dff 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -30,18 +30,18 @@ namespace WebCore {
 
     class JSNodeFilterCondition : public NodeFilterCondition {
     public:
-        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValuePtr filter)
+        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValue filter)
         {
             return adoptRef(new JSNodeFilterCondition(filter));
         }
 
     private:
-        JSNodeFilterCondition(JSC::JSValuePtr filter);
+        JSNodeFilterCondition(JSC::JSValue filter);
 
         virtual short acceptNode(ScriptState*, Node*) const;
         virtual void mark();
 
-        JSC::JSValuePtr m_filter;
+        mutable JSC::JSValue m_filter;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
index bca6e3aa6f..ecc12d55f1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -41,14 +41,14 @@ void JSNodeFilter::mark()
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
+JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 {
-    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(exec, 0))));
+    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(0))));
 }
 
-PassRefPtr<NodeFilter> toNodeFilter(JSValuePtr value)
+PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value->isObject(&JSNodeFilter::s_info))
+    if (value.isObject(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
index 6498a7c3d5..8fff82ea78 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -37,7 +37,7 @@ void JSNodeIterator::mark()
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->nextNode(exec, ec);
@@ -52,7 +52,7 @@ JSValuePtr JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
     return toJS(exec, node.get());
 }
 
-JSValuePtr JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->previousNode(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
index a67887e5d9..2821d018c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -36,10 +36,10 @@ using namespace JSC;
 namespace WebCore {
 
 // Need to support call so that list(0) works.
-static JSValuePtr callNodeList(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callNodeList(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     bool ok;
-    unsigned index = args.at(exec, 0)->toString(exec).toUInt32(&ok);
+    unsigned index = args.at(0).toString(exec).toUInt32(&ok);
     if (!ok)
         return jsUndefined();
     return toJS(exec, static_cast<JSNodeList*>(function)->impl()->item(index));
@@ -56,7 +56,7 @@ bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier
     return impl->itemWithName(propertyName);
 }
 
-JSValuePtr JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->itemWithName(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 42136e523e..9e818ff686 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "JSOptionConstructor.h"
 
+#include "HTMLNames.h"
 #include "HTMLOptionElement.h"
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
@@ -29,39 +30,46 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor);
 
 const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", 0, 0, 0 };
 
-JSOptionConstructor::JSOptionConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSOptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
+    putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 4), ReadOnly|DontDelete|DontEnum);
 }
 
+Document* JSOptionConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
+}
+
 static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     Document* document = static_cast<JSOptionConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Option constructor associated document is unavailable");
 
-    ExceptionCode ec = 0;
+    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement(HTMLNames::optionTag, false));
 
-    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement("option", ec));
-    RefPtr<Text> text;
-    if (ec == 0)
-        text = document->createTextNode("");
-    if (ec == 0 && !args.at(exec, 0)->isUndefined())
-        text->setData(args.at(exec, 0)->toString(exec), ec);
+    ExceptionCode ec = 0;
+    RefPtr<Text> text = document->createTextNode("");
+    if (!args.at(0).isUndefined())
+        text->setData(args.at(0).toString(exec), ec);
     if (ec == 0)
         element->appendChild(text.release(), ec);
-    if (ec == 0 && !args.at(exec, 1)->isUndefined())
-        element->setValue(args.at(exec, 1)->toString(exec));
+    if (ec == 0 && !args.at(1).isUndefined())
+        element->setValue(args.at(1).toString(exec));
     if (ec == 0)
-        element->setDefaultSelected(args.at(exec, 2)->toBoolean(exec));
+        element->setDefaultSelected(args.at(2).toBoolean(exec));
     if (ec == 0)
-        element->setSelected(args.at(exec, 3)->toBoolean(exec));
+        element->setSelected(args.at(3).toBoolean(exec));
 
     if (ec) {
         setDOMException(exec, ec);
@@ -80,8 +88,8 @@ ConstructType JSOptionConstructor::getConstructData(ConstructData& constructData
 void JSOptionConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
index 5234c49383..3c87c28f10 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
@@ -28,8 +28,8 @@ namespace WebCore {
 
     class JSOptionConstructor : public DOMObject {
     public:
-        JSOptionConstructor(JSC::ExecState*, ScriptExecutionContext*);
-        Document* document() const { return m_document->impl(); }
+        JSOptionConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
         
@@ -38,7 +38,7 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
index 5e82942336..81d42958dc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -33,7 +33,7 @@ bool JSPluginArray::canGetItemsForName(ExecState*, PluginArray* pluginArray, con
     return pluginArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
index 2cc3bae3c7..555dd9ed64 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
@@ -32,7 +32,7 @@ bool JSPlugin::canGetItemsForName(ExecState*, Plugin* plugin, const Identifier&
     return plugin->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 4d1b8fb9ed..56b0eca2dd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -20,13 +20,9 @@
 #include "config.h"
 #include "JSPluginElementFunctions.h"
 
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "JSHTMLElement.h"
-#include "ScriptController.h"
 #include "runtime.h"
 #include "runtime_object.h"
 
@@ -58,10 +54,10 @@ static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
     Instance* instance = pluginInstance(node);
     if (!instance)
         return 0;
-    return JSC::Bindings::Instance::createRuntimeObject(exec, instance);
+    return instance->createRuntimeObject(exec);
 }
 
-JSValuePtr runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -69,7 +65,7 @@ JSValuePtr runtimeObjectGetter(ExecState* exec, const Identifier&, const Propert
     return runtimeObject ? runtimeObject : jsUndefined();
 }
 
-JSValuePtr runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -90,7 +86,7 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
-bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, HTMLElement* element, PutPropertySlot& slot)
+bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
@@ -101,11 +97,11 @@ bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSV
     return true;
 }
 
-static JSValuePtr callPlugin(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callPlugin(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     Instance* instance = pluginInstance(static_cast<JSHTMLElement*>(function)->impl());
     instance->begin();
-    JSValuePtr result = instance->invokeDefaultMethod(exec, args);
+    JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index a1a86c072f..8c9dfa7f52 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -30,10 +30,10 @@ namespace WebCore {
 
     // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
-    JSC::JSValuePtr runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    JSC::JSValuePtr runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
-    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, HTMLElement*, JSC::PutPropertySlot&);
+    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index cec0dab938..ad1e55619a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -32,13 +32,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper);
 
 const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
 
-JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValuePtr value)
+JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
 
     JSObject* object = asObject(value);
@@ -49,16 +49,16 @@ JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValuePtr val
     return static_cast<JSQuarantinedObjectWrapper*>(object);
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
 {
-    JSValuePtr v = slot.slotBase();
+    JSValue v = slot.slotBase();
     ASSERT(v);
     return v;
 }
 
 JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
     : JSObject(structure)
-    , m_unwrappedGlobalObject(unwrappedExec->dynamicGlobalObject())
+    , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
     , m_unwrappedObject(unwrappedObject)
 {
     ASSERT_ARG(unwrappedExec, unwrappedExec);
@@ -72,7 +72,7 @@ JSQuarantinedObjectWrapper::~JSQuarantinedObjectWrapper()
 
 bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(ExecState* exec) const
 {
-    return m_unwrappedGlobalObject->profileGroup() == exec->dynamicGlobalObject()->profileGroup();
+    return m_unwrappedGlobalObject->profileGroup() == exec->lexicalGlobalObject()->profileGroup();
 }
 
 ExecState* JSQuarantinedObjectWrapper::unwrappedExecState() const
@@ -87,8 +87,9 @@ void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) c
     if (!unwrappedExecState()->hadException())
         return;
 
-    exec->setException(wrapOutgoingValue(unwrappedExecState(), unwrappedExecState()->exception()));
+    JSValue exception = unwrappedExecState()->exception();
     unwrappedExecState()->clearException();
+    exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
 }
 
 void JSQuarantinedObjectWrapper::mark()
@@ -111,7 +112,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Ident
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -130,7 +131,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -139,7 +140,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValuePtr value, PutPropertySlot& slot)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
         return;
@@ -149,7 +150,7 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifi
     transferExceptionToExecState(exec);
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValuePtr value)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue value)
 {
     if (!allowsSetProperty())
         return;
@@ -187,9 +188,9 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
     // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
@@ -197,10 +198,10 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
+    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
 
-    JSValuePtr resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-    ASSERT(resultValue->isObject());
+    JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    ASSERT(resultValue.isObject());
     JSObject* result = asObject(resultValue);
 
     wrapper->transferExceptionToExecState(exec);
@@ -219,7 +220,7 @@ ConstructType JSQuarantinedObjectWrapper::getConstructData(ConstructData& constr
     return ConstructTypeHost;
 }
 
-bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto)
+bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
     if (!allowsHasInstance())
         return false;
@@ -231,15 +232,15 @@ bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValuePtr value,
     return result;
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
 
-    JSValuePtr preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
+    JSValue preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
     // from when we called it in JSQuarantinedObjectWrapper::getCallData.
@@ -247,9 +248,9 @@ JSValuePtr JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function,
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
+    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
 
-    JSValuePtr result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
     wrapper->transferExceptionToExecState(exec);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index d66dc46251..bf8fddbe86 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSQuarantinedObjectWrapper : public JSC::JSObject {
     public:
-        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValuePtr);
+        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue);
 
         virtual ~JSQuarantinedObjectWrapper();
 
@@ -45,7 +45,7 @@ namespace WebCore {
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
         }
@@ -59,8 +59,8 @@ namespace WebCore {
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned, JSC::JSValuePtr);
+        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
@@ -68,7 +68,7 @@ namespace WebCore {
         virtual JSC::CallType getCallData(JSC::CallData&);
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
-        virtual bool hasInstance(JSC::ExecState*, JSC::JSValuePtr, JSC::JSValuePtr proto);
+        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
 
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
@@ -82,14 +82,14 @@ namespace WebCore {
         virtual bool allowsCallAsFunction() const { return false; }
         virtual bool allowsGetPropertyNames() const { return false; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
 
-        static JSC::JSValuePtr cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         void transferExceptionToExecState(JSC::ExecState*) const;
 
-        static JSC::JSValuePtr call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValuePtr thisValue, const JSC::ArgList&);
+        static JSC::JSValue JSC_HOST_CALL call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue thisValue, const JSC::ArgList&);
         static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
 
         JSC::JSGlobalObject* m_unwrappedGlobalObject;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
index 91fe4b39ff..f7c87e2217 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
@@ -28,9 +28,9 @@
 
 using namespace JSC;
 
-static JSValuePtr jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
 
 /*
 @begin JSRGBColorTable
@@ -44,7 +44,7 @@ static JSValuePtr jsRGBColorBlue(ExecState*, const Identifier&, const PropertySl
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRGBColor)
+ASSERT_CLASS_FITS_IN_CELL(JSRGBColor);
 
 const ClassInfo JSRGBColor::s_info = { "RGBColor", 0, &JSRGBColorTable, 0 };
 
@@ -59,7 +59,7 @@ bool JSRGBColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSRGBColor, DOMObject>(exec, &JSRGBColorTable, this, propertyName, slot);
 }
 
-JSValuePtr getJSRGBColor(ExecState* exec, unsigned color)
+JSValue getJSRGBColor(ExecState* exec, unsigned color)
 {
     return new (exec) JSRGBColor(exec, color);
 }
@@ -68,17 +68,17 @@ JSValuePtr getJSRGBColor(ExecState* exec, unsigned color)
 
 using namespace WebCore;
 
-JSValuePtr jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 16) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 8) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create(static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
index d5acff3bcf..cc2870f919 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
@@ -38,12 +38,12 @@ namespace WebCore {
 
         unsigned impl() const { return m_color; }
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
@@ -52,7 +52,7 @@ namespace WebCore {
         unsigned m_color;
     };
 
-    JSC::JSValuePtr getJSRGBColor(JSC::ExecState*, unsigned color);
+    JSC::JSValue getJSRGBColor(JSC::ExecState*, unsigned color);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
index 8c01d0ce85..f40956eb79 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSSQLResultSetRowList.h"
 
+#if ENABLE(DATABASE)
+
 #include "ExceptionCode.h"
 #include "SQLValue.h"
 #include "SQLResultSetRowList.h"
@@ -37,10 +39,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
+JSValue JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    int index = args.at(exec, 0)->toInt32(exec, indexOk);
+    int index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -56,7 +58,7 @@ JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
     unsigned valuesIndex = index * numColumns;
     for (unsigned i = 0; i < numColumns; i++) {
         const SQLValue& value = m_impl->values()[valuesIndex + i];
-        JSValuePtr jsValue = noValue();
+        JSValue jsValue;
 
         switch (value.type()) {
             case SQLValue::StringValue:
@@ -79,3 +81,5 @@ JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index 3cab8c40d0..30d59aadae 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSSQLTransaction.h"
 
+#if ENABLE(DATABASE)
+
 #include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "JSCustomSQLStatementCallback.h"
@@ -40,40 +42,40 @@ using namespace JSC;
 
 namespace WebCore {
     
-JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
+JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 {
-    String sqlStatement = args.at(exec, 0)->toString(exec);
+    String sqlStatement = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
 
     // Now assemble the list of SQL arguments
     Vector<SQLValue> sqlValues;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
 
-        JSValuePtr lengthValue = object->get(exec, exec->propertyNames().length);
+        JSValue lengthValue = object->get(exec, exec->propertyNames().length);
         if (exec->hadException())
             return jsUndefined();
-        unsigned length = lengthValue->toUInt32(exec);
+        unsigned length = lengthValue.toUInt32(exec);
         if (exec->hadException())
             return jsUndefined();
         
         for (unsigned i = 0 ; i < length; ++i) {
-            JSValuePtr value = object->get(exec, i);
+            JSValue value = object->get(exec, i);
             if (exec->hadException())
                 return jsUndefined();
             
-            if (value->isNull())
+            if (value.isNull())
                 sqlValues.append(SQLValue());
-            else if (value->isNumber())
-                sqlValues.append(value->getNumber());
+            else if (value.isNumber())
+                sqlValues.append(value.uncheckedGetNumber());
             else {
                 // Convert the argument to a string and append it
-                sqlValues.append(value->toString(exec));
+                sqlValues.append(value.toString(exec));
                 if (exec->hadException())
                     return jsUndefined();
             }
@@ -81,8 +83,8 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
     }
 
     RefPtr<SQLStatementCallback> callback;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 2)->getObject();
+    if (!args.at(2).isUndefinedOrNull()) {
+        JSObject* object = args.at(2).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -93,8 +95,8 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
-    if (!args.at(exec, 3)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 3)->getObject();
+    if (!args.at(3).isUndefinedOrNull()) {
+        JSObject* object = args.at(3).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -112,3 +114,5 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ea2471e47e..2922740a51 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -26,36 +26,47 @@
 #include "config.h"
 
 #if ENABLE(SVG)
-#include "SVGElementInstance.h"
 #include "JSSVGElementInstance.h"
 
-#include "JSEventListener.h"
 #include "JSDOMWindow.h"
+#include "JSEventListener.h"
+#include "JSSVGElement.h"
+#include "SVGElementInstance.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
+void JSSVGElementInstance::mark()
+{
+    DOMObject::mark();
+
+    // Mark the wrapper for our corresponding element, so it can mark its event handlers.
+    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
+    if (correspondingWrapper && !correspondingWrapper->marked())
+        correspondingWrapper->mark();
+}
+
+JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
@@ -64,6 +75,17 @@ void JSSVGElementInstance::pushEventHandlerScope(ExecState*, ScopeChain&) const
 {
 }
 
+JSC::JSValue toJS(JSC::ExecState* exec, SVGElementInstance* object)
+{
+    JSValue result = getDOMObjectWrapper<JSSVGElementInstance>(exec, object);
+
+    // Ensure that our corresponding element has a JavaScript wrapper to keep its event handlers alive.
+    if (object)
+        toJS(exec, object->correspondingElement());
+
+    return result;
 }
 
-#endif
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
index 6dd8507e7b..bad52ae698 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -26,18 +26,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGLength::value(ExecState* exec) const
+JSValue JSSVGLength::value(ExecState* exec) const
 {
     SVGLength imp(*impl());
     return jsNumber(exec, imp.value(context()));
 }
 
-JSValuePtr JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
+JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
 {
     JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
 
     SVGLength imp(*wrapper);
-    imp.convertToSpecifiedUnits(args.at(exec, 0)->toInt32(exec), context());
+    imp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context());
 
     wrapper->commitChange(imp, context());
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index fdf9d5ebdd..fc1e26612e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -29,18 +29,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
     TransformationMatrix imp(*impl());
-
-    TransformationMatrix secondMatrix = toSVGMatrix(args.at(exec, 0));    
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.multiply(secondMatrix)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
 
     if (!imp.isInvertible())
         setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
@@ -48,50 +40,14 @@ JSValuePtr JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
     return result;
 }
 
-JSValuePtr JSSVGMatrix::translate(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.translate(x, y)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::scale(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float scaleFactor = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scale(scaleFactor)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::scaleNonUniform(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float scaleFactorX = args.at(exec, 0)->toFloat(exec);
-    float scaleFactorY = args.at(exec, 1)->toFloat(exec);
-
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::rotate(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotate(angle)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
+JSValue JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
 {
     TransformationMatrix imp(*impl());
  
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
 
     if (x == 0.0 || y == 0.0)
         setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
@@ -99,34 +55,6 @@ JSValuePtr JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
     return result;
 }
 
-JSValuePtr JSSVGMatrix::flipX(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipX()).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::flipY(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipY()).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::skewX(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewX(angle)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::skewY(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewY(angle)).get(), m_context.get());
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
index c30f97fb1c..51e4e9e64b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
@@ -28,7 +28,6 @@
 #define JSSVGPODTypeWrapper_h
 
 #if ENABLE(SVG)
-#include "Frame.h"
 #include "SVGElement.h"
 #include <wtf/StdLibExtras.h>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index b7490e7104..cb4687c834 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -59,7 +59,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
+JSValue toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
 {
     if (!object)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
index 6197b4896d..b6fc1166bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
 
@@ -48,28 +48,28 @@ JSValuePtr JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
     SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
 
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -78,18 +78,18 @@ JSValuePtr JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
     SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -97,20 +97,20 @@ JSValuePtr JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& ar
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
     
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -118,19 +118,19 @@ JSValuePtr JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,21 +140,21 @@ JSValuePtr JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
 
     RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj.get(), m_context.get());
+    JSC::JSValue result = toJS(exec, obj.get(), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
index a2e74aecb1..a18c2a2697 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
@@ -33,7 +33,7 @@ namespace WebCore {
 typedef SVGPODListItem<FloatPoint> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@ static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@ static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@ static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec,
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGPointList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPointList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@ JSValuePtr JSSVGPointList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@ JSValuePtr JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@ JSValuePtr JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@ JSValuePtr JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@ JSValuePtr JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
index b29b25930e..58b25ad0a1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
@@ -33,7 +33,7 @@ namespace WebCore {
 typedef SVGPODListItem<SVGTransform> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@ static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@ static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@ static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec,
     return toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGTransformList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGTransformList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@ JSValuePtr JSSVGTransformList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@ JSValuePtr JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@ JSValuePtr JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList&
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@ JSValuePtr JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@ JSValuePtr JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index a92da2517a..bc43d796d1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -41,7 +41,7 @@ bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier&
     return impl->contains(propertyName);
 }
 
-JSValuePtr JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
@@ -56,8 +56,8 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
-    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
 
     m_impl->removeItem(propertyName);
@@ -74,7 +74,7 @@ bool JSStorage::customGetPropertyNames(ExecState* exec, PropertyNameArray& prope
     return false;
 }
 
-bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     // Only perform the custom put if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
@@ -83,11 +83,11 @@ bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSVal
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
-    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
     
-    String stringValue = valueToStringWithNullCheck(exec, value);
+    String stringValue = value.toString(exec);
     if (exec->hadException())
         return true;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 04dabf03c8..f8146bdd54 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSStyleSheet.h"
 
 #include "CSSStyleSheet.h"
+#include "Node.h"
 #include "JSCSSStyleSheet.h"
 #include "JSNode.h"
 
@@ -34,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, StyleSheet* styleSheet)
+JSValue toJS(ExecState* exec, StyleSheet* styleSheet)
 {
     if (!styleSheet)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index ea41687ea8..1da641820a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -40,7 +40,7 @@ bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheet
     return styleSheetList->getNamedItem(propertyName);
 }
 
-JSValuePtr JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
     HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
index 8118aef64e..9e66826cbb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Text* text)
+JSValue toJSNewlyCreated(ExecState* exec, Text* text)
 {
     if (!text)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
index aca0f93f01..636901769c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -37,7 +37,7 @@ void JSTreeWalker::mark()
     DOMObject::mark();
 }
     
-JSValuePtr JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->parentNode(exec);
     if (exec->hadException())
@@ -45,7 +45,7 @@ JSValuePtr JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->firstChild(exec);
     if (exec->hadException())
@@ -53,7 +53,7 @@ JSValuePtr JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->lastChild(exec);
     if (exec->hadException())
@@ -61,7 +61,7 @@ JSValuePtr JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextSibling(exec);
     if (exec->hadException())
@@ -69,7 +69,7 @@ JSValuePtr JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousSibling(exec);
     if (exec->hadException())
@@ -77,7 +77,7 @@ JSValuePtr JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousNode(exec);
     if (exec->hadException())
@@ -85,7 +85,7 @@ JSValuePtr JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextNode(exec);
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
new file mode 100644
index 0000000000..c7fe4a5c07
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWebKitCSSMatrixConstructor.h"
+
+#include "WebKitCSSMatrix.h"
+#include "JSWebKitCSSMatrix.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSWebKitCSSMatrixConstructor::s_info = { "WebKitCSSMatrixConstructor", 0, 0, 0 };
+
+JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor(ExecState* exec)
+    : DOMObject(JSWebKitCSSMatrixConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSWebKitCSSMatrixPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructWebKitCSSMatrix(ExecState* exec, JSObject*, const ArgList& args)
+{
+    String s;
+    if (args.size() >= 1)
+        s = args.at(0).toString(exec);
+    
+    ExceptionCode ec = 0;
+    RefPtr<WebKitCSSMatrix> matrix = WebKitCSSMatrix::create(s, ec);
+    setDOMException(exec, ec);
+    return CREATE_DOM_OBJECT_WRAPPER(exec, WebKitCSSMatrix, matrix.get());
+}
+
+ConstructType JSWebKitCSSMatrixConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructWebKitCSSMatrix;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h
new file mode 100644
index 0000000000..d0e0bd1bee
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebKitCSSMatrixConstructor_h
+#define JSWebKitCSSMatrixConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+class JSWebKitCSSMatrixConstructor : public DOMObject {
+public:
+    JSWebKitCSSMatrixConstructor(JSC::ExecState*);
+    static const JSC::ClassInfo s_info;
+
+private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+
+#endif // JSWebKitCSSMatrixConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.cpp
index 12fd98bbe7..c7d4e360c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,52 +20,49 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
-#include "JSEventTargetNode.h"
+#include "JSWebKitPointConstructor.h"
 
-#include "AtomicString.h"
 #include "Document.h"
-#include "Event.h"
-#include "EventTargetNode.h"
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "JSDOMWindow.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
-
-using namespace JSC;
+#include "WebKitPoint.h"
+#include "JSWebKitPoint.h"
 
 namespace WebCore {
 
-JSValuePtr JSEventTargetNode::addEventListener(ExecState* exec, const ArgList& args)
-{
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
+using namespace JSC;
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+const ClassInfo JSWebKitPointConstructor::s_info = { "WebKitPointConstructor", 0, 0, 0 };
 
-    return jsUndefined();
+JSWebKitPointConstructor::JSWebKitPointConstructor(ExecState* exec)
+    : DOMObject(JSWebKitPointConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSWebKitPointPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-JSValuePtr JSEventTargetNode::removeEventListener(ExecState* exec, const ArgList& args)
+static JSObject* constructWebKitPoint(ExecState* exec, JSObject*, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
-
-    return jsUndefined();
+    float x = 0;
+    float y = 0;
+    if (args.size() >= 2) {
+        x = (float)args.at(0).toNumber(exec);
+        y = (float)args.at(1).toNumber(exec);
+        if (isnan(x))
+            x = 0;
+        if (isnan(y))
+            y = 0;
+    }
+    return asObject(toJS(exec, WebKitPoint::create(x, y)));
 }
 
-void JSEventTargetNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
+JSC::ConstructType JSWebKitPointConstructor::getConstructData(JSC::ConstructData& constructData)
 {
+    constructData.native.function = constructWebKitPoint;
+    return ConstructTypeHost;
 }
 
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h
new file mode 100644
index 0000000000..a5bb5c1b4b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebKitPointConstructor_h
+#define JSWebKitPointConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+class JSWebKitPointConstructor : public DOMObject {
+public:
+    JSWebKitPointConstructor(JSC::ExecState*);
+    static const JSC::ClassInfo s_info;
+
+private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+
+#endif // JSWebKitPointConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
index 2c964c3a98..8ea6718301 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -44,6 +44,7 @@ const ClassInfo JSWorkerConstructor::s_info = { "WorkerConstructor", 0, 0, 0 };
 JSWorkerConstructor::JSWorkerConstructor(ExecState* exec)
     : DOMObject(JSWorkerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
+    putDirect(exec->propertyNames().prototype, JSWorkerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -52,7 +53,7 @@ static JSObject* constructWorker(ExecState* exec, JSObject*, const ArgList& args
     if (args.size() == 0)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    UString scriptURL = args.at(exec, 0)->toString(exec);
+    UString scriptURL = args.at(0).toString(exec);
     if (exec->hadException())
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 24dd50f446..c71f45bd4e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,29 +31,16 @@
 
 #include "JSWorkerContextBase.h"
 
-#include "Event.h"
-#include "JSDOMBinding.h"
-#include "JSEventListener.h"
-#include "JSMessageChannelConstructor.h"
-#include "JSMessageEvent.h"
-#include "JSMessagePort.h"
-#include "JSWorkerLocation.h"
-#include "JSWorkerNavigator.h"
+#include "JSWorkerContext.h"
 #include "WorkerContext.h"
-#include "WorkerLocation.h"
 
 using namespace JSC;
 
-/*
-@begin JSWorkerContextBaseTable
-@end
-*/
-
-#include "JSWorkerContextBase.lut.h"
-
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
+
+const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(PassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
     : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
@@ -69,16 +57,14 @@ ScriptExecutionContext* JSWorkerContextBase::scriptExecutionContext() const
     return m_impl.get();
 }
 
-static const HashTable* getJSWorkerContextBaseTable(ExecState* exec)
-{
-    return getHashTableForGlobalData(exec->globalData(), &JSWorkerContextBaseTable);
-}
-
-const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, getJSWorkerContextBaseTable };
-
-void JSWorkerContextBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+JSValue toJS(ExecState*, WorkerContext* workerContext)
 {
-    lookupPut<JSWorkerContextBase, Base>(exec, propertyName, value, getJSWorkerContextBaseTable(exec), this, slot);
+    if (!workerContext)
+        return jsNull();
+    WorkerScriptController* script = workerContext->script();
+    if (!script)
+        return jsNull();
+    return script->workerContextWrapper();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
index d2d5bd29cd..dcbc5c3ba8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,7 +41,6 @@ namespace WebCore {
         JSWorkerContextBase(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
@@ -52,6 +51,9 @@ namespace WebCore {
         RefPtr<WorkerContext> m_impl;
     };
 
+    // Returns a JSWorkerContext or jsNull()
+    JSC::JSValue toJS(JSC::ExecState*, WorkerContext*);
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 2bf4dbc536..6824914dc7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,68 +31,113 @@
 
 #include "JSDOMBinding.h"
 #include "JSEventListener.h"
+#include "JSWorkerLocation.h"
+#include "JSWorkerNavigator.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "ScheduledAction.h"
 #include "WorkerContext.h"
+#include "WorkerLocation.h"
+#include "WorkerNavigator.h"
+#include <interpreter/Interpreter.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-bool JSWorkerContext::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
-{
-    // Look for overrides before looking at any of our own properties.
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
-        return true;
-    return false;
-}
-
 void JSWorkerContext::mark()
 {
     Base::mark();
 
-    markActiveObjectsForContext(*globalData(), scriptExecutionContext());
+    JSGlobalData& globalData = *this->globalData();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(impl()->onmessage()))
-        listener->mark();
+    markActiveObjectsForContext(globalData, scriptExecutionContext());
+
+    markDOMObjectWrapper(globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
+
+    markIfNotNull(impl()->onmessage());
 
     typedef WorkerContext::EventListenersMap EventListenersMap;
     typedef WorkerContext::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = impl()->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorkerContext::self(ExecState*) const
+bool JSWorkerContext::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
+    return false;
+}
+
+JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
-    return asValue();
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
 }
 
-void JSWorkerContext::setSelf(ExecState* exec, JSValuePtr value)
+JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 {
-    putDirect(Identifier(exec, "self"), value);
+    if (!args.size())
+        return jsUndefined();
+
+    Vector<String> urls;
+    for (unsigned i = 0; i < args.size(); i++) {
+        urls.append(args.at(i).toString(exec));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+    ExceptionCode ec = 0;
+    int signedLineNumber;
+    intptr_t sourceID;
+    UString sourceURL;
+    JSValue function;
+    exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
+
+    impl()->importScripts(urls, sourceURL, signedLineNumber >= 0 ? signedLineNumber : 0, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSUnprotectedEventListener> listener = findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSUnprotectedEventListener* listener = findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
+{
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
+}
+
+JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
+{
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
index bb4070598b..f4d30333ea 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,44 +41,39 @@ void JSWorker::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onmessage()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        listener->mark();
+    markIfNotNull(m_impl->onmessage());
+    markIfNotNull(m_impl->onerror());
 
     typedef Worker::EventListenersMap EventListenersMap;
     typedef Worker::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorker::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index d7f54dead7..65cdfc2261 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -28,22 +28,29 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestConstructor);
 
 const ClassInfo JSXMLHttpRequestConstructor::s_info = { "XMLHttpRequestConstructor", 0, 0, 0 };
 
-JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSXMLHttpRequestConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, exec->lexicalGlobalObject()), None);
+}
 
-    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec), None);
+ScriptExecutionContext* JSXMLHttpRequestConstructor::scriptExecutionContext() const
+{
+    return m_globalObject->scriptExecutionContext();
 }
 
 static JSObject* constructXMLHttpRequest(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(static_cast<JSXMLHttpRequestConstructor*>(constructor)->document());
+    ScriptExecutionContext* context = static_cast<JSXMLHttpRequestConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "XMLHttpRequest constructor associated document is unavailable");
+
+    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context);
     return CREATE_DOM_OBJECT_WRAPPER(exec, XMLHttpRequest, xmlHttpRequest.get());
 }
 
@@ -56,8 +63,8 @@ ConstructType JSXMLHttpRequestConstructor::getConstructData(ConstructData& const
 void JSXMLHttpRequestConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
index f235af6360..978a9f056a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
@@ -21,14 +21,13 @@
 #define JSXMLHttpRequestConstructor_h
 
 #include "JSDOMBinding.h"
-#include "JSDocument.h"
 
 namespace WebCore {
 
 class JSXMLHttpRequestConstructor : public DOMObject {
 public:
-    JSXMLHttpRequestConstructor(JSC::ExecState*, ScriptExecutionContext*);
-    Document* document() const { return m_document->impl(); }
+    JSXMLHttpRequestConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+    ScriptExecutionContext* scriptExecutionContext() const;
     static const JSC::ClassInfo s_info;
 
     virtual void mark();
@@ -36,7 +35,7 @@ private:
     virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-    JSDocument* m_document;
+    JSDOMGlobalObject* m_globalObject;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 49813c44b8..06a58175d5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,53 +59,40 @@ void JSXMLHttpRequest::mark()
             wrapper->mark();
     }
 
-    if (JSUnprotectedEventListener* onReadyStateChangeListener = static_cast<JSUnprotectedEventListener*>(m_impl->onreadystatechange()))
-        onReadyStateChangeListener->mark();
-
-    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
-        onAbortListener->mark();
-
-    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        onErrorListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
-        onLoadListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
-        onLoadStartListener->mark();
-    
-    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        onProgressListener->mark();
+    markIfNotNull(m_impl->onreadystatechange());
+    markIfNotNull(m_impl->onabort());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onload());
+    markIfNotNull(m_impl->onloadstart());
+    markIfNotNull(m_impl->onprogress());
     
     typedef XMLHttpRequest::EventListenersMap EventListenersMap;
     typedef XMLHttpRequest::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
 // Custom functions
-JSValuePtr JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(exec, 1)->toString(exec));
-    String method = args.at(exec, 0)->toString(exec);
+    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(1).toString(exec));
+    String method = args.at(0).toString(exec);
     bool async = true;
     if (args.size() >= 3)
-        async = args.at(exec, 2)->toBoolean(exec);
+        async = args.at(2).toBoolean(exec);
 
     ExceptionCode ec = 0;
-    if (args.size() >= 4 && !args.at(exec, 3)->isUndefined()) {
-        String user = valueToStringWithNullCheck(exec, args.at(exec, 3));
+    if (args.size() >= 4 && !args.at(3).isUndefined()) {
+        String user = valueToStringWithNullCheck(exec, args.at(3));
 
-        if (args.size() >= 5 && !args.at(exec, 4)->isUndefined()) {
-            String password = valueToStringWithNullCheck(exec, args.at(exec, 4));
+        if (args.size() >= 5 && !args.at(4).isUndefined()) {
+            String password = valueToStringWithNullCheck(exec, args.at(4));
             impl()->open(method, url, async, user, password, ec);
         } else
             impl()->open(method, url, async, user, ec);
@@ -116,38 +103,38 @@ JSValuePtr JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    impl()->setRequestHeader(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec), ec);
+    impl()->setRequestHeader(args.at(0).toString(exec), args.at(1).toString(exec), ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     if (args.isEmpty())
         impl()->send(ec);
     else {
-        JSValuePtr val = args.at(exec, 0);
-        if (val->isUndefinedOrNull())
+        JSValue val = args.at(0);
+        if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val->isObject(&JSDocument::s_info))
+        else if (val.isObject(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val->isObject(&JSFile::s_info))
+        else if (val.isObject(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
-            impl()->send(val->toString(exec), ec);
+            impl()->send(val.toString(exec), ec);
     }
 
     int signedLineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
     impl()->setLastSendLineNumber(signedLineNumber >= 0 ? signedLineNumber : 0);
     impl()->setLastSendURL(sourceURL);
@@ -156,51 +143,51 @@ JSValuePtr JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    JSValuePtr header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(exec, 0)->toString(exec), ec));
+    JSValue header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(0).toString(exec), ec));
     setDOMException(exec, ec);
     return header;
 }
 
-JSValuePtr JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    impl()->overrideMimeType(args.at(exec, 0)->toString(exec));
+    impl()->overrideMimeType(args.at(0).toString(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::responseText(ExecState* exec) const
+JSValue JSXMLHttpRequest::responseText(ExecState* exec) const
 {
     return jsOwnedStringOrNull(exec, impl()->responseText());
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 5d094dbcee..597010cef4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,53 +51,42 @@ void JSXMLHttpRequestUpload::mark()
             wrapper->mark();
     }
 
-    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
-        onAbortListener->mark();
-
-    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        onErrorListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
-        onLoadListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
-        onLoadStartListener->mark();
-    
-    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        onProgressListener->mark();
+    markIfNotNull(m_impl->onabort());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onload());
+    markIfNotNull(m_impl->onloadstart());
+    markIfNotNull(m_impl->onprogress());
     
     typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
     typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
index ed456e1f43..807b017b3e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
@@ -37,14 +37,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessorConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessorConstructor);
 
 const ClassInfo JSXSLTProcessorConstructor::s_info = { "XSLTProcessorConsructor", 0, 0, 0 };
 
 JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec)
     : DOMObject(JSXSLTProcessorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructXSLTProcessor(ExecState* exec, JSObject*, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index cdd5d1fc17..01e53a6d2a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -46,10 +46,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    if (nodeVal->isObject(&JSNode::s_info)) {
+    JSValue nodeVal = args.at(0);
+    if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -58,11 +58,11 @@ JSValuePtr JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& arg
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    JSValuePtr docVal = args.at(exec, 1);
-    if (nodeVal->isObject(&JSNode::s_info) && docVal->isObject(&JSDocument::s_info)) {
+    JSValue nodeVal = args.at(0);
+    JSValue docVal = args.at(1);
+    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -71,10 +71,10 @@ JSValuePtr JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    if (nodeVal->isObject(&JSNode::s_info)) {
+    JSValue nodeVal = args.at(0);
+    if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
@@ -85,33 +85,33 @@ JSValuePtr JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull() || args.at(exec, 2)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull() || args.at(2).isUndefinedOrNull())
         return jsUndefined(); // Throw exception?
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
-    String value = args.at(exec, 2)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
+    String value = args.at(2).toString(exec);
     impl()->setParameter(namespaceURI, localName, value);
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     String value = impl()->getParameter(namespaceURI, localName);
     return jsStringOrUndefined(exec, value);
 }
 
-JSValuePtr JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     impl()->removeParameter(namespaceURI, localName);
     return jsUndefined();
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index d2471947f3..91bece71bb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -1,8 +1,9 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ *  Copyright (C) 2009 Google Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -32,74 +33,119 @@
 #include "JSDOMWindow.h"
 #include "ScriptController.h"
 #include "ScriptExecutionContext.h"
+#include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include <runtime/JSLock.h>
 
+#if ENABLE(WORKERS)
+#include "JSWorkerContext.h"
+#include "WorkerContext.h"
+#include "WorkerThread.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction::ScheduledAction(ExecState* exec, JSValuePtr function, const ArgList& args)
+ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
+{
+    JSValue v = args.at(0);
+    CallData callData;
+    if (v.getCallData(callData) == CallTypeNone) {
+        UString string = v.toString(exec);
+        if (exec->hadException())
+            return 0;
+        return new ScheduledAction(string);
+    }
+    ArgList argsTail;
+    args.getSlice(2, argsTail);
+    return new ScheduledAction(v, argsTail);
+}
+
+ScheduledAction::ScheduledAction(JSValue function, const ArgList& args)
     : m_function(function)
 {
     ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it) {
-        m_args.append((*it).jsValue(exec));
-    }
+    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
+        m_args.append(*it);
 }
 
 void ScheduledAction::execute(ScriptExecutionContext* context)
 {
-    // FIXME: make it work with Workers SEC too.
+    if (context->isDocument())
+        execute(static_cast<Document*>(context));
+#if ENABLE(WORKERS)
+    else {
+        ASSERT(context->isWorkerContext());
+        execute(static_cast<WorkerContext*>(context));
+    }
+#else
     ASSERT(context->isDocument());
-    Document* document = static_cast<Document*>(context);
-    if (JSDOMWindow* window = toJSDOMWindow(document->frame()))
-        execute(window->shell());
+#endif
 }
 
-void ScheduledAction::execute(JSDOMWindowShell* windowShell)
+void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSValue thisValue)
 {
-    RefPtr<Frame> frame = windowShell->window()->impl()->frame();
-    if (!frame)
+    ASSERT(m_function);
+    JSLock lock(false);
+
+    CallData callData;
+    CallType callType = m_function.get().getCallData(callData);
+    if (callType == CallTypeNone)
         return;
 
-    if (!frame->script()->isEnabled())
+    ExecState* exec = globalObject->globalExec();
+
+    MarkedArgumentBuffer args;
+    size_t size = m_args.size();
+    for (size_t i = 0; i < size; ++i)
+        args.append(m_args[i]);
+
+    globalObject->globalData()->timeoutChecker.start();
+    call(exec, m_function, callType, callData, thisValue, args);
+    globalObject->globalData()->timeoutChecker.stop();
+
+    if (exec->hadException())
+        reportCurrentException(exec);
+}
+
+void ScheduledAction::execute(Document* document)
+{
+    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    if (!window)
         return;
 
-    frame->script()->setProcessingTimerCallback(true);
+    RefPtr<Frame> frame = window->impl()->frame();
+    if (!frame || !frame->script()->isEnabled())
+        return;
 
-    JSLock lock(false);
+    frame->script()->setProcessingTimerCallback(true);
 
     if (m_function) {
-        CallData callData;
-        CallType callType = m_function->getCallData(callData);
-        if (callType != CallTypeNone) {
-            JSDOMWindow* window = windowShell->window();
-            ExecState* exec = window->globalExec();
-
-            ArgList args;
-            size_t size = m_args.size();
-            for (size_t i = 0; i < size; ++i)
-                args.append(m_args[i]);
-
-            window->startTimeoutCheck();
-            call(exec, m_function, callType, callData, windowShell, args);
-            window->stopTimeoutCheck();
-            if (exec->hadException())
-                reportCurrentException(exec);
-        }
+        executeFunctionInContext(window, window->shell());
+        Document::updateStyleForAllDocuments();
     } else
         frame->loader()->executeScript(m_code);
 
-    // Update our document's rendering following the execution of the timeout callback.
-    // FIXME: Why not use updateDocumentsRendering to update rendering of all documents?
-    // FIXME: Is this really the right point to do the update? We need a place that works
-    // for all possible entry points that might possibly execute script, but this seems
-    // to be a bit too low-level.
-    if (Document* document = frame->document())
-        document->updateRendering();
-
     frame->script()->setProcessingTimerCallback(false);
 }
 
+#if ENABLE(WORKERS)
+void ScheduledAction::execute(WorkerContext* workerContext)
+{
+    // In a Worker, the execution should always happen on a worker thread.
+    ASSERT(workerContext->thread()->threadID() == currentThread());
+
+    WorkerScriptController* scriptController = workerContext->script();
+
+    if (m_function) {
+        JSWorkerContext* contextWrapper = scriptController->workerContextWrapper();
+        executeFunctionInContext(contextWrapper, contextWrapper);
+    } else {
+        ScriptSourceCode code(m_code, workerContext->url());
+        scriptController->evaluate(code);
+    }
+}
+#endif // ENABLE(WORKERS)
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index 9bf83ad199..e7d0b750b3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -24,10 +24,15 @@
 #include <runtime/Protect.h>
 #include <wtf/Vector.h>
 
+namespace JSC {
+    class JSGlobalObject;
+}
+
 namespace WebCore {
 
-    class JSDOMWindowShell;
+    class Document;
     class ScriptExecutionContext;
+    class WorkerContext;
 
    /* An action (either function or string) to be executed after a specified
     * time interval, either once or repeatedly. Used for window.setTimeout()
@@ -35,19 +40,25 @@ namespace WebCore {
     */
     class ScheduledAction {
     public:
-        ScheduledAction(JSC::ExecState* exec, JSC::JSValuePtr function, const JSC::ArgList&);
+        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&);
+
+        void execute(ScriptExecutionContext*);
+
+    private:
+        ScheduledAction(JSC::JSValue function, const JSC::ArgList&);
         ScheduledAction(const String& code)
             : m_code(code)
         {
         }
-         
-        void execute(ScriptExecutionContext*);
 
-    private:
-        void execute(JSDOMWindowShell*);
+        void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue thisValue);
+        void execute(Document*);
+#if ENABLE(WORKERS)        
+        void execute(WorkerContext*);
+#endif
 
-        JSC::ProtectedJSValuePtr m_function;
-        Vector<JSC::ProtectedJSValuePtr> m_args;
+        JSC::ProtectedJSValue m_function;
+        Vector<JSC::ProtectedJSValue> m_args;
         String m_code;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index eeccf4321c..213c70893c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,7 +30,7 @@
  */
 
 #include "config.h"
-#include "ScriptCachedPageData.h"
+#include "ScriptCachedFrameData.h"
 
 #include "Frame.h"
 #include "GCController.h"
@@ -42,45 +43,46 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptCachedPageData::ScriptCachedPageData(Page* page)
+ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
 {
     JSLock lock(false);
 
-    ScriptController* scriptController = page->mainFrame()->script();
+    ScriptController* scriptController = frame->script();
     if (scriptController->haveWindowShell()) {
         m_window = scriptController->windowShell()->window();
+        scriptController->attachDebugger(0);
     }
 }
 
-DOMWindow* ScriptCachedPageData::domWindow() const {
+DOMWindow* ScriptCachedFrameData::domWindow() const {
     return m_window ? m_window->impl() : 0;
 }
 
-ScriptCachedPageData::~ScriptCachedPageData()
+ScriptCachedFrameData::~ScriptCachedFrameData()
 {
     clear();
 }
 
-void ScriptCachedPageData::restore(Page* page)
+void ScriptCachedFrameData::restore(Frame* frame)
 {
-    Frame* mainFrame = page->mainFrame();
+    Page* page = frame->page();
 
     JSLock lock(false);
 
-    ScriptController* scriptController = mainFrame->script();
+    ScriptController* scriptController = frame->script();
     if (scriptController->haveWindowShell()) {
         JSDOMWindowShell* windowShell = scriptController->windowShell();
         if (m_window) {
             windowShell->setWindow(m_window.get());
         } else {
-            windowShell->setWindow(mainFrame->domWindow());
+            windowShell->setWindow(frame->domWindow());
             scriptController->attachDebugger(page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
         }
     }
 }
 
-void ScriptCachedPageData::clear()
+void ScriptCachedFrameData::clear()
 {
     JSLock lock(false);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
index 91e47d0b81..c661f28155 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,22 +29,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptCachedPageData_h
-#define ScriptCachedPageData_h
+#ifndef ScriptCachedFrameData_h
+#define ScriptCachedFrameData_h
 
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class Frame;
     class JSDOMWindow;
-    class Page;
     class DOMWindow;
 
-    class ScriptCachedPageData  {
+    class ScriptCachedFrameData  {
     public:
-        ScriptCachedPageData(Page*);
-        ~ScriptCachedPageData();
+        ScriptCachedFrameData(Frame*);
+        ~ScriptCachedFrameData();
 
-        void restore(Page*);
+        void restore(Frame*);
         void clear();
         DOMWindow* domWindow() const;
 
@@ -53,4 +54,4 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ScriptCachedPageData_h
+#endif // ScriptCachedFrameData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
index 29f380a89f..58168d069b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -38,14 +38,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, ExecState* exec, const ArgList& args, unsigned skipArgumentCount)
+ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
     , m_sourceURL(urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
     for (size_t i = skipArgumentCount; i < argumentCount; ++i)
-        m_arguments.append(ScriptValue(args.at(exec, i)));
+        m_arguments.append(ScriptValue(args.at(i)));
 }
 
 ScriptCallFrame::~ScriptCallFrame()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
index 64a1a0802c..b8c0abab65 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
@@ -50,7 +50,7 @@ namespace WebCore {
     // <https://bugs.webkit.org/show_bug.cgi?id=21180>
     class ScriptCallFrame  {
     public:
-        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, JSC::ExecState*, const JSC::ArgList&, unsigned skipArgumentCount);
+        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, const JSC::ArgList&, unsigned skipArgumentCount);
         ~ScriptCallFrame();
 
         const ScriptString& functionName() const { return m_functionName; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
index 88acadb886..021ede5c84 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
@@ -50,18 +50,18 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
     int signedLineNumber;
     intptr_t sourceID;
     UString urlString;
-    JSValuePtr function;
+    JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
 
     if (function) {
         m_caller = asInternalFunction(function);
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), UString(), 0, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(UString(), UString(), 0, args, skipArgumentCount));
     }
 }
 
@@ -90,11 +90,11 @@ void ScriptCallStack::initialize()
     if (!m_caller || m_initialized)
         return;
 
-    JSValuePtr func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
-    while (!func->isNull()) {
+    JSValue func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
+    while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index ebed71d7bd..e570293233 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -21,44 +21,34 @@
 #include "config.h"
 #include "ScriptController.h"
 
-#include "Console.h"
-#include "DOMWindow.h"
-#include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "GCController.h"
-#include "JSDOMWindow.h"
+#include "HTMLPlugInElement.h"
 #include "JSDocument.h"
-#include "JSEventListener.h"
-#include "npruntime_impl.h"
 #include "NP_jsobject.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "runtime_root.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
-
-#include <runtime/Completion.h>
+#include "npruntime_impl.h"
+#include "runtime_root.h"
 #include <debugger/Debugger.h>
 #include <runtime/JSLock.h>
 
-#if ENABLE(NETSCAPE_PLUGIN_API)
-#include "HTMLPlugInElement.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
 
 ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
-    , m_handlerLineno(0)
+    , m_handlerLineNumber(0)
     , m_sourceURL(0)
     , m_processingTimerCallback(false)
     , m_paused(false)
+    , m_allowPopupsFromPlugin(false)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
 #endif
@@ -106,24 +96,26 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     JSLock lock(false);
 
+    RefPtr<Frame> protect = m_frame;
+
+    m_windowShell->window()->globalData()->timeoutChecker.start();
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
+    m_windowShell->window()->globalData()->timeoutChecker.stop();
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
 
-    m_windowShell->window()->startTimeoutCheck();
-    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
-    m_windowShell->window()->stopTimeoutCheck();
-
     if (comp.complType() == Normal || comp.complType() == ReturnValue) {
         m_sourceURL = savedSourceURL;
         return comp.value();
     }
 
-    if (comp.complType() == Throw)
+    if (comp.complType() == Throw || comp.complType() == Interrupted)
         reportException(exec, comp.value());
 
     m_sourceURL = savedSourceURL;
-    return noValue();
+    return JSValue();
 }
 
 void ScriptController::clearWindowShell()
@@ -132,9 +124,13 @@ void ScriptController::clearWindowShell()
         return;
 
     JSLock lock(false);
-    m_windowShell->window()->clear();
-    m_liveFormerWindows.add(m_windowShell->window());
+
+    // Clear the debugger from the current window before setting the new window.
+    attachDebugger(0);
+
+    m_windowShell->window()->willRemoveFromWindowShell();
     m_windowShell->setWindow(m_frame->domWindow());
+
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
         m_windowShell->window()->setProfileGroup(page->group().identifier());
@@ -144,22 +140,6 @@ void ScriptController::clearWindowShell()
     gcController().garbageCollectSoon();
 }
 
-PassRefPtr<EventListener> ScriptController::createInlineEventListener(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::HTMLLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-
-#if ENABLE(SVG)
-PassRefPtr<EventListener> ScriptController::createSVGEventHandler(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::SVGLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-#endif
-
 void ScriptController::initScript()
 {
     if (m_windowShell)
@@ -168,7 +148,7 @@ void ScriptController::initScript()
     JSLock lock(false);
 
     m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    updateDocument();
+    m_windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -180,6 +160,11 @@ void ScriptController::initScript()
 
 bool ScriptController::processingUserGesture() const
 {
+    return m_allowPopupsFromPlugin || processingUserGestureEvent() || isJavaScriptAnchorNavigation();
+}
+
+bool ScriptController::processingUserGestureEvent() const
+{
     if (!m_windowShell)
         return false;
 
@@ -196,13 +181,37 @@ bool ScriptController::processingUserGesture() const
             type == eventNames().focusEvent || type == eventNames().blurEvent ||
             type == eventNames().submitEvent)
             return true;
-    } else { // no event
-        if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback) {
-            // This is the <a href="javascript:window.open('...')> case -> we let it through
-            return true;
+    }
+    
+    return false;
+}
+
+// FIXME: This seems like an insufficient check to verify a click on a javascript: anchor.
+bool ScriptController::isJavaScriptAnchorNavigation() const
+{
+    // This is the <a href="javascript:window.open('...')> case -> we let it through
+    if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback)
+        return true;
+
+    // This is the <script>window.open(...)</script> case or a timer callback -> block it
+    return false;
+}
+
+bool ScriptController::anyPageIsProcessingUserGesture() const
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+
+    const HashSet<Page*>& pages = page->group().pages();
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->script()->processingUserGesture())
+                return true;
         }
-        // This is the <script>window.open(...)</script> case or a timer callback -> block it
     }
+
     return false;
 }
 
@@ -231,9 +240,6 @@ void ScriptController::updateDocument()
     JSLock lock(false);
     if (m_windowShell)
         m_windowShell->window()->updateDocument();
-    HashSet<JSDOMWindow*>::iterator end = m_liveFormerWindows.end();
-    for (HashSet<JSDOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
-        (*it)->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -266,6 +272,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
+
 NPObject* ScriptController::windowScriptNPObject()
 {
     if (!m_windowScriptNPObject) {
@@ -289,23 +296,34 @@ NPObject* ScriptController::windowScriptNPObject()
 
 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
 {
-    // Can't create NPObjects when JavaScript is disabled
-    if (!isEnabled())
+    JSObject* object = jsObjectForPluginElement(plugin);
+    if (!object)
         return _NPN_CreateNoScriptObject();
 
+    // Wrap the JSObject in an NPObject
+    return _NPN_CreateScriptObject(0, object, bindingRootObject());
+}
+
+#endif
+
+JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
+{
+    // Can't create JSObjects when JavaScript is disabled
+    if (!isEnabled())
+        return 0;
+
     // Create a JSObject bound to this element
     JSLock lock(false);
     ExecState* exec = globalObject()->globalExec();
-    JSValuePtr jsElementValue = toJS(exec, plugin);
-    if (!jsElementValue || !jsElementValue->isObject())
-        return _NPN_CreateNoScriptObject();
-
-    // Wrap the JSObject in an NPObject
-    return _NPN_CreateScriptObject(0, jsElementValue->getObject(), bindingRootObject());
+    JSValue jsElementValue = toJS(exec, plugin);
+    if (!jsElementValue || !jsElementValue.isObject())
+        return 0;
+    
+    return jsElementValue.getObject();
 }
-#endif
 
 #if !PLATFORM(MAC)
+
 void ScriptController::updatePlatformScriptObjects()
 {
 }
@@ -313,6 +331,7 @@ void ScriptController::updatePlatformScriptObjects()
 void ScriptController::disconnectPlatformScriptObjects()
 {
 }
+
 #endif
 
 void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index c952cc263a..f700cd98cb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -81,14 +81,12 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
 
-    PassRefPtr<EventListener> createInlineEventListener(const String& functionName, const String& code, Node*);
-#if ENABLE(SVG)
-    PassRefPtr<EventListener> createSVGEventHandler(const String& functionName, const String& code, Node*);
-#endif
-    void setEventHandlerLineno(int lineno) { m_handlerLineno = lineno; }
+    void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
+    int eventHandlerLineNumber() { return m_handlerLineNumber; }
 
     void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
     bool processingUserGesture() const;
+    bool anyPageIsProcessingUserGesture() const;
 
     bool isEnabled();
 
@@ -97,10 +95,12 @@ public:
     void setPaused(bool b) { m_paused = b; }
     bool isPaused() const { return m_paused; }
 
+    void setAllowPopupsFromPlugin(bool allowPopupsFromPlugin) { m_allowPopupsFromPlugin = allowPopupsFromPlugin; }
+    bool allowPopupsFromPlugin() const { return m_allowPopupsFromPlugin; }
+    
     const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
 
     void clearWindowShell();
-    void clearFormerWindow(JSDOMWindow* window) { m_liveFormerWindows.remove(window); }
     void updateDocument();
 
     // Notifies the ScriptController that the securityOrigin of the current
@@ -126,6 +126,8 @@ public:
     WebScriptObject* windowScriptObject();
 #endif
 
+    JSC::JSObject* jsObjectForPluginElement(HTMLPlugInElement*);
+    
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
     NPObject* windowScriptNPObject();
@@ -141,14 +143,17 @@ private:
 
     void disconnectPlatformScriptObjects();
 
+    bool processingUserGestureEvent() const;
+    bool isJavaScriptAnchorNavigation() const;
+
     JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
-    HashSet<JSDOMWindow*> m_liveFormerWindows;
     Frame* m_frame;
-    int m_handlerLineno;
+    int m_handlerLineNumber;
     const String* m_sourceURL;
 
     bool m_processingTimerCallback;
     bool m_paused;
+    bool m_allowPopupsFromPlugin;
 
     // The root object used for objects bound outside the context of a plugin.
     RefPtr<JSC::Bindings::RootObject> m_bindingRootObject;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
index 39fcc67df9..502a504b92 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
@@ -57,6 +57,7 @@
 @interface NSObject (WebPlugin)
 - (id)objectForWebScript;
 - (NPObject *)createPluginScriptableObject;
+- (PassRefPtr<JSC::Bindings::Instance>)createPluginBindingsInstance:(PassRefPtr<JSC::Bindings::RootObject>)rootObject;
 @end
 
 using namespace JSC::Bindings;
@@ -71,6 +72,9 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
 
     RefPtr<RootObject> rootObject = createRootObject(widgetView);
 
+    if ([widgetView respondsToSelector:@selector(createPluginBindingsInstance:)])
+        return [widgetView createPluginBindingsInstance:rootObject.release()];
+        
     if ([widgetView respondsToSelector:@selector(objectForWebScript)]) {
         id objectForWebScript = [widgetView objectForWebScript];
         if (!objectForWebScript)
@@ -137,7 +141,7 @@ void ScriptController::disconnectPlatformScriptObjects()
 
 static pthread_t mainThread;
 
-static void updateRenderingForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
+static void updateStyleIfNeededForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
 {
     if (pthread_self() != mainThread)
         return;
@@ -153,18 +157,14 @@ static void updateRenderingForBindings(JSC::ExecState*, JSC::JSObject* rootObjec
     if (!frame)
         return;
 
-    Document* document = frame->document();
-    if (!document)
-        return;
-
-    document->updateRendering();
+    frame->document()->updateStyleIfNeeded();
 }
 
 void ScriptController::initJavaJSBindings()
 {
     mainThread = pthread_self();
     JSC::Bindings::JavaJSObject::initializeJNIThreading();
-    JSC::Bindings::Instance::setDidExecuteFunction(updateRenderingForBindings);
+    JSC::Bindings::Instance::setDidExecuteFunction(updateStyleIfNeededForBindings);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
new file mode 100644
index 0000000000..0ce7bcaeb4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptEventListener.h"
+
+#include "Attribute.h"
+#include "Document.h"
+#include "JSNode.h"
+#include "Frame.h"
+
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static const String& eventParameterName(bool isSVGEvent)
+{
+    DEFINE_STATIC_LOCAL(const String, eventString, ("event"));
+    DEFINE_STATIC_LOCAL(const String, evtString, ("evt"));
+    return isSVGEvent ? evtString : eventString;
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
+{
+    ASSERT(node);
+
+    Frame* frame = node->document()->frame();
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+    {
+        JSLock lock(false);
+        toJS(globalObject->globalExec(), node);
+    }
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), globalObject, node, scriptController->eventHandlerLineNumber());
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
+{
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), globalObject, 0, scriptController->eventHandlerLineNumber());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h
new file mode 100644
index 0000000000..8299d29560
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptEventListener_h
+#define ScriptEventListener_h
+
+#include "JSLazyEventListener.h"
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class Attribute;
+    class Frame;
+    class Node;
+
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+
+} // namespace WebCore
+
+#endif // ScriptEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
new file mode 100644
index 0000000000..1122931adc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptFunctionCall.h"
+
+#include "JSDOMBinding.h"
+#include "ScriptString.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSLock.h>
+#include <runtime/UString.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name)
+    : m_exec(exec)
+    , m_thisObject(thisObject)
+    , m_name(name)
+{
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptObject& argument)
+{
+    m_arguments.append(argument.jsObject());
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptString& argument)
+{
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptValue& argument)
+{
+    m_arguments.append(argument.jsValue());
+}
+
+void ScriptFunctionCall::appendArgument(const String& argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
+{
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
+{
+    m_arguments.append(argument);
+}
+
+void ScriptFunctionCall::appendArgument(long long argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(unsigned int argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(int argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(bool argument)
+{
+    m_arguments.append(jsBoolean(argument));
+}
+
+ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
+{
+    JSObject* thisObject = m_thisObject.jsObject();
+
+    JSLock lock(false);
+
+    JSValue function = thisObject->get(m_exec, Identifier(m_exec, m_name));
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptValue();
+    }
+
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return ScriptValue();
+
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptValue();
+    }
+
+    return ScriptValue(result);
+}
+
+ScriptValue ScriptFunctionCall::call()
+{
+    bool hadException = false;
+    return call(hadException);
+}
+
+ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExceptions)
+{
+    JSObject* thisObject = m_thisObject.jsObject();
+
+    JSLock lock(false);
+
+    JSObject* constructor = asObject(thisObject->get(m_exec, Identifier(m_exec, m_name)));
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptObject();
+    }
+
+    ConstructData constructData;
+    ConstructType constructType = constructor->getConstructData(constructData);
+    if (constructType == ConstructTypeNone)
+        return ScriptObject();
+
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptObject();
+    }
+
+    return ScriptObject(asObject(result));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
new file mode 100644
index 0000000000..079ac212ab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptFunctionCall_h
+#define ScriptFunctionCall_h
+
+#include "PlatformString.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <runtime/ArgList.h>
+
+namespace JSC {
+    class UString;
+    class JSValue;
+}
+
+namespace WebCore {
+    class ScriptValue;
+    class ScriptString;
+
+    class ScriptFunctionCall {
+    public:
+        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name);
+        virtual ~ScriptFunctionCall() {};
+
+        void appendArgument(const ScriptObject&);
+        void appendArgument(const ScriptString&);
+        void appendArgument(const ScriptValue&);
+        void appendArgument(const String&);
+        void appendArgument(const JSC::UString&);
+        void appendArgument(JSC::JSValue);
+        void appendArgument(long long);
+        void appendArgument(unsigned int);
+        void appendArgument(int);
+        void appendArgument(bool);
+        ScriptValue call(bool& hadException, bool reportExceptions = true);
+        ScriptValue call();
+        ScriptObject construct(bool& hadException, bool reportExceptions = true);
+
+    protected:
+        ScriptState* m_exec;
+        ScriptObject m_thisObject;
+        String m_name;
+        JSC::MarkedArgumentBuffer m_arguments;
+    };
+
+} // namespace WebCore
+
+#endif // ScriptFunctionCall
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
new file mode 100644
index 0000000000..7f6391daef
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObject.h"
+
+#include "JSDOMBinding.h"
+#include "JSInspectorController.h"
+
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject::ScriptObject(JSObject* object)
+    : ScriptValue(object)
+{
+}
+
+static bool handleException(ScriptState* scriptState)
+{
+    if (!scriptState->hadException())
+        return true;
+
+    reportException(scriptState, scriptState->exception());
+    return false;
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const String& name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), value.jsObject(), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, double value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, long long value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, int value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, bool value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsBoolean(value), slot);
+    return handleException(scriptState);
+}
+
+ScriptObject ScriptObject::createNew(ScriptState* scriptState)
+{
+    JSLock lock(false);
+    return ScriptObject(constructEmptyObject(scriptState));
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), value.jsObject());
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorController* value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), toJS(scriptState, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
+{
+    JSLock lock(false);
+    JSValue jsValue = scriptState->lexicalGlobalObject()->get(scriptState, Identifier(scriptState, name));
+    if (!jsValue)
+        return false;
+
+    if (!jsValue.isObject())
+        return false;
+
+    value = ScriptObject(asObject(jsValue));
+    return true;
+}
+
+bool ScriptGlobalObject::remove(ScriptState* scriptState, const char* name)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->deleteProperty(scriptState, Identifier(scriptState, name));
+    return handleException(scriptState);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
new file mode 100644
index 0000000000..ed86659573
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptObject_h
+#define ScriptObject_h
+
+#include "ScriptState.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+
+namespace WebCore {
+    class InspectorController;
+
+    class ScriptObject : public ScriptValue {
+    public:
+        ScriptObject(JSC::JSObject*);
+        ScriptObject() {}
+        JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+
+        bool set(ScriptState*, const String& name, const String&);
+        bool set(ScriptState*, const char* name, const ScriptObject&);
+        bool set(ScriptState*, const char* name, const String&);
+        bool set(ScriptState*, const char* name, double);
+        bool set(ScriptState*, const char* name, long long);
+        bool set(ScriptState*, const char* name, int);
+        bool set(ScriptState*, const char* name, bool);
+
+        static ScriptObject createNew(ScriptState*);
+    };
+
+    class ScriptGlobalObject {
+    public:
+        static bool set(ScriptState*, const char* name, const ScriptObject&);
+        static bool set(ScriptState*, const char* name, InspectorController*);
+        static bool get(ScriptState*, const char* name, ScriptObject&);
+        static bool remove(ScriptState*, const char* name);
+    private:
+        ScriptGlobalObject() { }
+    };
+
+}
+
+#endif // ScriptObject_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
new file mode 100644
index 0000000000..13e180aeeb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObjectQuarantine.h"
+
+#include "Database.h"
+#include "Document.h"
+#include "Frame.h"
+#include "JSDOMBinding.h"
+#include "JSInspectedObjectWrapper.h"
+#include "JSNode.h"
+#include "ScriptObject.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSLock.h>
+
+#if ENABLE(DATABASE)
+#include "JSDatabase.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "JSStorage.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+{
+    JSLock lock(false);
+    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
+}
+
+#if ENABLE(DATABASE)
+bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
+{
+    ASSERT(database);
+
+    Frame* frame = database->document()->frame();
+    if (!frame)
+        return false;
+
+    ExecState* exec = toJSDOMWindow(frame)->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, database))));
+
+    return true;
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+{
+    ASSERT(frame);
+    ASSERT(storage);
+
+    ExecState* exec = toJSDOMWindow(frame)->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, storage))));
+
+    return true;
+}
+#endif
+
+bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
+{
+    ExecState* exec = scriptStateFromNode(node);
+    if (!exec)
+        return false;
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, node))));
+
+    return true;
+}
+
+bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
+{
+    ASSERT(domWindow);
+
+    JSDOMWindow* window = toJSDOMWindow(domWindow->frame());
+    ExecState* exec = window->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, window)));
+
+    return true;
+}
+
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
new file mode 100644
index 0000000000..d70acd75a0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptObjectQuarantine_h
+#define ScriptObjectQuarantine_h
+
+#include "ScriptState.h"
+
+namespace WebCore {
+
+    class Database;
+    class DOMWindow;
+    class Frame;
+    class Node;
+    class ScriptObject;
+    class ScriptValue;
+    class Storage;
+
+    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+
+#if ENABLE(DATABASE)
+    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
+#endif
+#if ENABLE(DOM_STORAGE)
+    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+#endif
+    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+
+}
+
+#endif // ScriptObjectQuarantine_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
new file mode 100644
index 0000000000..8bfa33d15b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptState.h"
+
+#include "Frame.h"
+#include "Node.h"
+#include "Page.h"
+
+namespace WebCore {
+
+ScriptState* scriptStateFromNode(Node* node)
+{
+    if (!node)
+        return 0;
+    Document* document = node->document();
+    if (!document)
+        return 0;
+    Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    if (!frame->script()->isEnabled())
+        return 0;
+    return frame->script()->globalObject()->globalExec();
+}
+
+ScriptState* scriptStateFromPage(Page* page)
+{
+    return page->mainFrame()->script()->globalObject()->globalExec();
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
index 3cce093f4f..fa5c4a8576 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
@@ -32,11 +32,11 @@
 #ifndef ScriptState_h
 #define ScriptState_h
 
-namespace JSC {
-    class ExecState;
-}
+#include "JSDOMBinding.h"
 
 namespace WebCore {
+    class Node;
+    class Page;
 
     // The idea is to expose "state-like" methods (hadException, and any other
     // methods where ExecState just dips into globalData) of JSC::ExecState as a
@@ -44,6 +44,9 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
+    ScriptState* scriptStateFromNode(Node*);
+    ScriptState* scriptStateFromPage(Page*);
+
 } // namespace WebCore
 
 #endif // ScriptState_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
index 3efa1604ba..6dab9a00a2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
@@ -32,7 +32,6 @@
 #define ScriptString_h
 
 #include "PlatformString.h"
-#include <runtime/JSLock.h>
 #include <runtime/UString.h>
 
 namespace WebCore {
@@ -52,27 +51,23 @@ public:
 
     ScriptString& operator=(const char* s)
     {
-        JSC::JSLock lock(false);
         m_str = s;
         return *this;
     }
 
     ScriptString& operator+=(const String& s)
     {
-        JSC::JSLock lock(false);
         m_str += s;
         return *this;
     }
 
     bool operator==(const ScriptString& s) const
     {
-        JSC::JSLock lock(false);
         return m_str == s.m_str;
     }
 
     bool operator!=(const ScriptString& s) const
     {
-        JSC::JSLock lock(false);
         // Avoid exporting an extra symbol by re-using "==" operator.
         return !(m_str == s.m_str);
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index f462e21b05..dfb46dabbc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -29,7 +29,9 @@
 #include "config.h"
 #include "ScriptValue.h"
 
-#include "PlatformString.h"
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSValueRef.h>
+
 #include <runtime/JSLock.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -44,24 +46,32 @@ bool ScriptValue::getString(String& result) const
         return false;
     JSLock lock(false);
     UString ustring;
-    if (!m_value->getString(ustring))
+    if (!m_value.get().getString(ustring))
         return false;
     result = ustring;
     return true;
 }
 
+bool ScriptValue::isEqual(ScriptState* scriptState, const ScriptValue& anotherValue) const
+{
+    if (hasNoValue())
+        return anotherValue.hasNoValue();
+
+    return JSValueIsEqual(toRef(scriptState), toRef(scriptState, jsValue()), toRef(scriptState, anotherValue.jsValue()), 0);
+}
+
 bool ScriptValue::isNull() const
 {
     if (!m_value)
         return false;
-    return m_value->isNull();
+    return m_value.get().isNull();
 }
 
 bool ScriptValue::isUndefined() const
 {
     if (!m_value)
         return false;
-    return m_value->isUndefined();
+    return m_value.get().isUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 855509a6b6..209ce06808 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -31,6 +31,8 @@
 #ifndef ScriptValue_h
 #define ScriptValue_h
 
+#include "PlatformString.h"
+#include "ScriptState.h"
 #include <runtime/Protect.h>
 
 namespace WebCore {
@@ -39,15 +41,19 @@ class String;
 
 class ScriptValue {
 public:
-    ScriptValue(JSC::JSValuePtr value = JSC::noValue()) : m_value(value) {}
+    ScriptValue(JSC::JSValue value = JSC::JSValue()) : m_value(value) {}
+    virtual ~ScriptValue() {}
 
-    JSC::JSValuePtr jsValue() const { return m_value.get(); }
+    JSC::JSValue jsValue() const { return m_value.get(); }
     bool getString(String& result) const;
+    String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
+    bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
-    JSC::ProtectedJSValuePtr m_value;
+    JSC::ProtectedJSValue m_value;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index 0727510e94..dd391bc39f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -35,7 +35,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "WorkerContext.h"
-#include "WorkerMessagingProxy.h"
+#include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
 #include <interpreter/Interpreter.h>
 #include <runtime/Completion.h>
@@ -68,8 +68,13 @@ void WorkerScriptController::initScript()
 
     JSLock lock(false);
 
+    // Explicitly protect the global object's prototype so it isn't collected
+    // when we allocate the global object. (Once the global object is fully
+    // constructed, it can mark its own prototype.)
     RefPtr<Structure> prototypeStructure = JSWorkerContextPrototype::createStructure(jsNull());
-    RefPtr<Structure> structure = JSWorkerContext::createStructure(new (m_globalData.get()) JSWorkerContextPrototype(prototypeStructure.release()));
+    ProtectedPtr<JSWorkerContextPrototype> prototype = new (m_globalData.get()) JSWorkerContextPrototype(prototypeStructure.release());
+
+    RefPtr<Structure> structure = JSWorkerContext::createStructure(prototype);
     m_workerContextWrapper = new (m_globalData.get()) JSWorkerContext(structure.release(), m_workerContext);
 }
 
@@ -78,25 +83,46 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
     {
         MutexLocker lock(m_sharedDataMutex);
         if (m_executionForbidden)
-            return noValue();
+            return JSValue();
+    }
+    ScriptValue exception;
+    ScriptValue result = evaluate(sourceCode, &exception);
+    if (exception.jsValue()) {
+        JSLock lock(false);
+        reportException(m_workerContextWrapper->globalExec(), exception.jsValue());
+    }
+    return result;
+}
+
+ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, ScriptValue* exception)
+{
+    {
+        MutexLocker lock(m_sharedDataMutex);
+        if (m_executionForbidden)
+            return JSValue();
     }
 
     initScriptIfNeeded();
     JSLock lock(false);
 
     ExecState* exec = m_workerContextWrapper->globalExec();
-    m_workerContextWrapper->startTimeoutCheck();
+    m_workerContextWrapper->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
-    m_workerContextWrapper->stopTimeoutCheck();
+    m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
-    m_workerContext->thread()->messagingProxy()->reportWorkerThreadActivity(m_workerContext->hasPendingActivity());
+    m_workerContext->thread()->workerObjectProxy()->reportPendingActivity(m_workerContext->hasPendingActivity());
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();
 
     if (comp.complType() == Throw)
-        reportException(exec, comp.value());
-    return noValue();
+        *exception = comp.value();
+    return JSValue();
+}
+
+void WorkerScriptController::setException(ScriptValue exception)
+{
+    m_workerContextWrapper->globalExec()->setException(exception.jsValue());
 }
 
 void WorkerScriptController::forbidExecution()
@@ -107,7 +133,7 @@ void WorkerScriptController::forbidExecution()
     // It is not critical for Interpreter::m_timeoutTime to be synchronized, we just rely on it reaching the worker thread's processor sooner or later.
     MutexLocker lock(m_sharedDataMutex);
     m_executionForbidden = true;
-    m_globalData->interpreter->setTimeoutTime(1); // 1 ms is the smallest timeout that can be set.
+    m_globalData->timeoutChecker.setTimeoutInterval(1); // 1ms is the smallest timeout that can be set.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
index 1dda5da5d1..0454721566 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
@@ -57,9 +57,11 @@ namespace WebCore {
         }
 
         ScriptValue evaluate(const ScriptSourceCode&);
+        ScriptValue evaluate(const ScriptSourceCode&, ScriptValue* exception);
 
-        void forbidExecution();
+        void setException(ScriptValue);
 
+        void forbidExecution();
     private:
         void initScriptIfNeeded()
         {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
index 7a4d0958c3..d217c37e6f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
@@ -131,9 +131,6 @@ sub AddMethodsConstantsAndAttributesFromParentClasses
     my $functionsRef = $dataNode->functions;
     my $attributesRef = $dataNode->attributes;
 
-    # Exception: For the DOM 'Node' is our topmost baseclass, not EventTargetNode.
-    return if $parentsMax eq 1 and $parents[0] eq "EventTargetNode";
-
     foreach (@{$dataNode->parents}) {
         if ($ignoreParent) {
             # Ignore first parent class, already handled by the generation itself.
@@ -196,9 +193,6 @@ sub GetMethodsAndAttributesFromParentClasses
 
     foreach (@{$dataNode->parents}) {
         my $interface = $object->StripModule($_);
-        if ($interface eq "EventTargetNode") {
-            $interface = "Node";
-        }
 
         # Step #1: Find the IDL file associated with 'interface'
         $endCondition = 0;
@@ -387,6 +381,8 @@ sub WK_lcfirst
     my $ret = lcfirst($param);
     $ret =~ s/uRL/url/ if $ret =~ /^uRL/;
     $ret =~ s/jS/js/ if $ret =~ /^jS/;
+    $ret =~ s/xML/xml/ if $ret =~ /^xML/;
+    $ret =~ s/xSLT/xslt/ if $ret =~ /^xSLT/;
     return $ret;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 0c86ef29bb..7e80a17a61 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -236,7 +236,6 @@ sub GetParentInterface
 {
     my ($dataNode) = @_;
     return "I" . $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return "I" . $TEMP_PREFIX . "DOMNode" if $codeGenerator->StripModule($dataNode->parents(0)) eq "EventTargetNode";
     return GetInterfaceName($codeGenerator->StripModule($dataNode->parents(0)));
 }
 
@@ -244,7 +243,6 @@ sub GetParentClass
 {
     my ($dataNode) = @_;
     return $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return $TEMP_PREFIX . "DOMNode" if $codeGenerator->StripModule($dataNode->parents(0)) eq "EventTargetNode";
     return GetClassName($codeGenerator->StripModule($dataNode->parents(0)));
 }
 
@@ -316,7 +314,6 @@ sub AddIncludesForTypeInCPPImplementation
     }
 
     # Special casing
-    $CPPImplementationWebCoreIncludes{"EventTargetNode.h"} = 1 if $type eq "Node";
     $CPPImplementationWebCoreIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
     $CPPImplementationWebCoreIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
 
@@ -706,7 +703,6 @@ sub GenerateCPPFunction
     my $functionName = $function->signature->name;
     my $returnIDLType = $function->signature->type;
     my $noReturn = ($returnIDLType eq "void");
-    my $requiresEventTargetNodeCast = $function->signature->extendedAttributes->{"EventTargetNodeCast"};
     my $raisesExceptions = @{$function->raisesExceptions};
 
     AddIncludesForTypeInCPPImplementation($returnIDLType);
@@ -756,9 +752,6 @@ sub GenerateCPPFunction
     push(@parameterList, "ec") if $raisesExceptions;
 
     my $implementationGetter = "impl${implementationClassWithoutNamespace}()";
-    if ($requiresEventTargetNodeCast) {
-        $implementationGetter = "WebCore::EventTargetNodeCast(${implementationGetter})";
-    }
 
     my $callSigBegin = "    ";
     my $callSigMiddle = "${implementationGetter}->" . $codeGenerator->WK_lcfirst($functionName) . "(" . join(", ", @parameterList) . ")";
@@ -801,10 +794,6 @@ sub GenerateCPPFunction
     }
     push(@functionImplementation, "    WebCore::ExceptionCode ec = 0;\n") if $raisesExceptions; # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
     push(@functionImplementation, join("\n", @parameterInitialization) . (@parameterInitialization > 0 ? "\n" : ""));
-    if ($requiresEventTargetNodeCast) {
-        push(@functionImplementation, "    if (!impl${implementationClassWithoutNamespace}()->isEventTargetNode())\n");
-        push(@functionImplementation, "        return E_FAIL;\n");
-    }
     push(@functionImplementation, $callSigBegin . $callSigMiddle . $callSigEnd . "\n");
     push(@functionImplementation, "    return S_OK;\n");
     push(@functionImplementation, "}\n\n");
@@ -911,7 +900,7 @@ sub GenerateCPPHeader
                                                                                          "Forwarder" => $parentClassName });
                 push(@CPPHeaderContent, values(%attributes));
             }
-            
+
             # Add attribute names to attribute names set in case other ancestors 
             # also define them.
             $attributeNameSet{$_->signature->name} = 1 foreach @attributeList;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index f1061df5de..4563018b46 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Anders Carlsson <andersca@mac.com>
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
-# Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -145,7 +145,7 @@ sub UsesManualToJSImplementation
 {
     my $type = shift;
 
-    return 1 if $type eq "Node" or $type eq "Document" or $type eq "HTMLCollection" or $type eq "SVGPathSeg" or $type eq "StyleSheet" or $type eq "CSSRule" or $type eq "CSSValue" or $type eq "Event" or $type eq "ImageData" or $type eq "Element" or $type eq "Text";
+    return 1 if $type eq "Node" or $type eq "Document" or $type eq "HTMLCollection" or $type eq "SVGPathSeg" or $type eq "StyleSheet" or $type eq "CSSRule" or $type eq "CSSValue" or $type eq "Event" or $type eq "ImageData" or $type eq "Element" or $type eq "Text" or $type eq "SVGElementInstance";
     return 0;
 }
 
@@ -174,7 +174,7 @@ sub AddIncludesForType
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
     if ($codeGenerator->IsPrimitiveType($type) or AvoidInclusionOfType($type)
-        or $type eq "DOMString" or $type eq "DOMObject" or $type eq "RGBColor") {
+        or $type eq "DOMString" or $type eq "DOMObject" or $type eq "RGBColor" or $type eq "Array") {
     } elsif ($type =~ /SVGPathSeg/) {
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
@@ -279,34 +279,24 @@ sub GenerateGetOwnPropertySlotBody
     my @getOwnPropertySlotImpl = ();
 
     if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
-        push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValuePtr proto = prototype();\n");
-        push(@getOwnPropertySlotImpl, "    if (proto->isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
+        push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
+        push(@getOwnPropertySlotImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
         push(@getOwnPropertySlotImpl, "        return false;\n\n");
     }
 
-    my $hasNameGetterGeneration = sub {
-        push(@getOwnPropertySlotImpl, "    if (canGetItemsForName(exec, static_cast<$implClassName*>(impl()), propertyName)) {\n");
-        push(@getOwnPropertySlotImpl, "        slot.setCustom(this, nameGetter);\n");
-        push(@getOwnPropertySlotImpl, "        return true;\n");
-        push(@getOwnPropertySlotImpl, "    }\n");
-        if ($inlined) {
-            $headerIncludes{"AtomicString.h"} = 1;
-        } else {
-            $implIncludes{"AtomicString.h"} = 1;
+    my $manualLookupGetterGeneration = sub {
+        my $requiresManualLookup = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasNameGetter"};
+        if ($requiresManualLookup) {
+            push(@getOwnPropertySlotImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
+            push(@getOwnPropertySlotImpl, "    if (entry) {\n");
+            push(@getOwnPropertySlotImpl, "        slot.setCustom(this, entry->propertyGetter());\n");
+            push(@getOwnPropertySlotImpl, "        return true;\n");
+            push(@getOwnPropertySlotImpl, "    }\n");
         }
     };
 
-    if ($dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
-        &$hasNameGetterGeneration();
-    }
-
-    my $requiresManualLookup = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasNameGetter"};
-    if ($requiresManualLookup) {
-        push(@getOwnPropertySlotImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
-        push(@getOwnPropertySlotImpl, "    if (entry) {\n");
-        push(@getOwnPropertySlotImpl, "        slot.setCustom(this, entry->propertyGetter());\n");
-        push(@getOwnPropertySlotImpl, "        return true;\n");
-        push(@getOwnPropertySlotImpl, "    }\n");
+    if (!$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
     }
 
     if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
@@ -322,8 +312,20 @@ sub GenerateGetOwnPropertySlotBody
         push(@getOwnPropertySlotImpl, "    }\n");
     }
 
-    if ($dataNode->extendedAttributes->{"HasNameGetter"}) {
-        &$hasNameGetterGeneration();
+    if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        push(@getOwnPropertySlotImpl, "    if (canGetItemsForName(exec, static_cast<$implClassName*>(impl()), propertyName)) {\n");
+        push(@getOwnPropertySlotImpl, "        slot.setCustom(this, nameGetter);\n");
+        push(@getOwnPropertySlotImpl, "        return true;\n");
+        push(@getOwnPropertySlotImpl, "    }\n");
+        if ($inlined) {
+            $headerIncludes{"AtomicString.h"} = 1;
+        } else {
+            $implIncludes{"AtomicString.h"} = 1;
+        }
+    }
+
+    if ($dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
     }
 
     if ($dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}) {
@@ -386,9 +388,6 @@ sub GenerateHeader
         push(@headerContentHeader, "#include <runtime/JSGlobalObject.h>\n");
         push(@headerContentHeader, "#include <runtime/ObjectPrototype.h>\n");
     }
-    if ($interfaceName eq "Node") {
-        push(@headerContentHeader, "#include \"EventTargetNode.h\"\n");
-    }
 
     if ($dataNode->extendedAttributes->{"CustomCall"}) {
         push(@headerContentHeader, "#include <runtime/CallData.h>\n");
@@ -435,10 +434,10 @@ sub GenerateHeader
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
 
     # Prototype
-    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
+    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
 
     $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"};
 
@@ -471,9 +470,9 @@ sub GenerateHeader
 
     # Getters
     if ($hasSetter) {
-        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);\n");
-        push(@headerContent, "    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);\n") if $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
-        push(@headerContent, "    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomPutFunction"};
+        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);\n") if $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
+        push(@headerContent, "    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomPutFunction"};
     }
 
     # Class info
@@ -483,13 +482,13 @@ sub GenerateHeader
     # Structure ID
     if ($interfaceName eq "DOMWindow") {
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));\n" .
             "    }\n\n");
     } elsif ($hasGetter) {
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n\n");
@@ -521,13 +520,13 @@ sub GenerateHeader
     push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
 
     # Custom lookupGetter function
-    push(@headerContent, "    virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
+    push(@headerContent, "    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
 
     # Custom lookupSetter function
-    push(@headerContent, "    virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
+    push(@headerContent, "    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
 
     # Constructor object getter
-    push(@headerContent, "    static JSC::JSValuePtr getConstructor(JSC::ExecState*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
+    push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
 
     my $numCustomFunctions = 0;
     my $numCustomAttributes = 0;
@@ -536,9 +535,9 @@ sub GenerateHeader
     if ($numAttributes > 0) {
         foreach (@{$dataNode->attributes}) {
             my $attribute = $_;
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"Custom"};
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"};
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"};
         }
     }
 
@@ -546,31 +545,31 @@ sub GenerateHeader
         push(@headerContent, "\n    // Custom attributes\n");
 
         foreach my $attribute (@{$dataNode->attributes}) {
-            if ($attribute->signature->extendedAttributes->{"Custom"}) {
-                push(@headerContent, "    JSC::JSValuePtr " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
+            if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"}) {
+                push(@headerContent, "    JSC::JSValue " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
                 if ($attribute->type !~ /^readonly/) {
-                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValuePtr);\n");
+                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
                 }
-            } elsif ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
-                push(@headerContent, "    JSC::JSValuePtr " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
-            } elsif ($attribute->signature->extendedAttributes->{"CustomSetter"}) {
+            } elsif ($attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"}) {
+                push(@headerContent, "    JSC::JSValue " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
+            } elsif ($attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"}) {
                 if ($attribute->type !~ /^readonly/) {
-                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValuePtr);\n");
+                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
                 }
             }
         }
     }
 
     foreach my $function (@{$dataNode->functions}) {
-        $numCustomFunctions++ if $function->signature->extendedAttributes->{"Custom"};
+        $numCustomFunctions++ if $function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"};
     }
 
     if ($numCustomFunctions > 0) {
         push(@headerContent, "\n    // Custom functions\n");
         foreach my $function (@{$dataNode->functions}) {
-            if ($function->signature->extendedAttributes->{"Custom"}) {
+            if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"}) {
                 my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementationFunction"} || $codeGenerator->WK_lcfirst($function->signature->name);
-                push(@headerContent, "    JSC::JSValuePtr " . $functionImplementationName . "(JSC::ExecState*, const JSC::ArgList&);\n");
+                push(@headerContent, "    JSC::JSValue " . $functionImplementationName . "(JSC::ExecState*, const JSC::ArgList&);\n");
             }
         }
     }
@@ -602,21 +601,21 @@ sub GenerateHeader
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@headerContent, "    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
-        push(@headerContent, "    JSC::JSValuePtr getByIndex(JSC::ExecState*, unsigned index);\n");
+        push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
     }
     
     # Index setter
     if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
-        push(@headerContent, "    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValuePtr);\n");
+        push(@headerContent, "    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);\n");
     }
     # Name getter
     if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
         push(@headerContent, "private:\n");
         push(@headerContent, "    static bool canGetItemsForName(JSC::ExecState*, $implClassName*, const JSC::Identifier&);\n");
-        push(@headerContent, "    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
 
     push(@headerContent, "};\n\n");
@@ -630,52 +629,59 @@ sub GenerateHeader
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"}) {
         if ($podType) {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, $implType*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, $implType*, SVGElement* context);\n");
         } else {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, $implType*);\n");
-        }
-
-        # Resolve ambiguity with EventTarget that otherwise exists.
-        if ($interfaceName eq "Node") {
-            push(@headerContent, "inline JSC::JSValuePtr toJS(JSC::ExecState* exec, EventTargetNode* node) { return toJS(exec, static_cast<Node*>(node)); }\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, $implType*);\n");
         }
     }
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateNativeConverter"}) {
         if ($podType) {
-            push(@headerContent, "$podType to${interfaceName}(JSC::JSValuePtr);\n");
+            push(@headerContent, "$podType to${interfaceName}(JSC::JSValue);\n");
         } elsif ($interfaceName eq "NodeFilter") {
-            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValuePtr);\n");
+            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValue);\n");
         } else {
-            push(@headerContent, "$implClassName* to${interfaceName}(JSC::JSValuePtr);\n");
-        }
-        if ($interfaceName eq "Node" or $interfaceName eq "Element" or $interfaceName eq "Text") {
-            push(@headerContent, "JSC::JSValuePtr toJSNewlyCreated(JSC::ExecState*, $interfaceName*);\n");
+            push(@headerContent, "$implClassName* to${interfaceName}(JSC::JSValue);\n");
         }
     }
+    if ($interfaceName eq "Node" or $interfaceName eq "Element" or $interfaceName eq "Text" or $interfaceName eq "CDATASection") {
+        push(@headerContent, "JSC::JSValue toJSNewlyCreated(JSC::ExecState*, $interfaceName*);\n");
+    }
+    
     push(@headerContent, "\n");
 
     # Add prototype declaration.
     push(@headerContent, "class ${className}Prototype : public JSC::JSObject {\n");
+    push(@headerContent, "    typedef JSC::JSObject Base;\n");
     push(@headerContent, "public:\n");
     if ($interfaceName eq "DOMWindow") {
         push(@headerContent, "    void* operator new(size_t);\n");
     } elsif ($interfaceName eq "WorkerContext") {
         push(@headerContent, "    void* operator new(size_t, JSC::JSGlobalData*);\n");
     } else {
-        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*);\n");
+        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);\n");
     }
     push(@headerContent, "    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }\n");
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
-    if ($numFunctions > 0 || $numConstants > 0) {
+    if ($numFunctions > 0 || $numConstants > 0 || $dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"}) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
+        push(@headerContent, "    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"};
+
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n");
     }
+    if ($dataNode->extendedAttributes->{"CustomPrototypePutFunction"}) {
+        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
+    }
+
+    # Custom defineGetter function
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
+
     push(@headerContent, "    ${className}Prototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
     push(@headerContent, "};\n\n");
@@ -684,7 +690,7 @@ sub GenerateHeader
         push(@headerContent,"// Functions\n\n");
         foreach my $function (@{$dataNode->functions}) {
             my $functionName = $codeGenerator->WK_lcfirst($className) . "PrototypeFunction" . $codeGenerator->WK_ucfirst($function->signature->name);
-            push(@headerContent, "JSC::JSValuePtr ${functionName}(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);\n");
+            push(@headerContent, "JSC::JSValue JSC_HOST_CALL ${functionName}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);\n");
         }
     }
 
@@ -692,16 +698,16 @@ sub GenerateHeader
         push(@headerContent,"// Attributes\n\n");
         foreach my $attribute (@{$dataNode->attributes}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-                push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);\n");
+                push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
         }
         
         if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
             my $getter = "js" . $interfaceName . "Constructor";
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
         }
     }
 
@@ -709,7 +715,7 @@ sub GenerateHeader
         push(@headerContent,"// Constants\n\n");
         foreach my $constant (@{$dataNode->constants}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
         }
     }
 
@@ -762,7 +768,7 @@ sub GenerateImplementation
     push(@implContent, "\nusing namespace JSC;\n\n");
     push(@implContent, "namespace WebCore {\n\n");
 
-    push(@implContent, "ASSERT_CLASS_FITS_IN_CELL($className)\n\n");
+    push(@implContent, "ASSERT_CLASS_FITS_IN_CELL($className);\n\n");
 
     # - Add all attributes in a hashtable definition
     my $numAttributes = @{$dataNode->attributes};
@@ -884,7 +890,7 @@ sub GenerateImplementation
         my @specials = ();
         push(@specials, "DontDelete") unless $function->signature->extendedAttributes->{"Deletable"};
         push(@specials, "DontEnum") if $function->signature->extendedAttributes->{"DontEnum"};
-        push(@specials, "Function");        
+        push(@specials, "Function");
         my $special = (@specials > 0) ? join("|", @specials) : "0";
         push(@hashSpecials, $special);
     }
@@ -913,15 +919,23 @@ sub GenerateImplementation
         push(@implContent, "    return globalData->heap.allocate(size);\n");
         push(@implContent, "}\n\n");
     } else {
-        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
-        push(@implContent, "    return getDOMPrototype<${className}>(exec);\n");
+        push(@implContent, "    return getDOMPrototype<${className}>(exec, globalObject);\n");
         push(@implContent, "}\n\n");
     }
-    if ($numConstants > 0 || $numFunctions > 0) {
+    if ($numConstants > 0 || $numFunctions > 0 || $dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"}) {
         push(@implContent, "bool ${className}Prototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
         push(@implContent, "{\n");
-        if ($numConstants eq 0) {
+
+        if ($dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"}) {
+            push(@implContent, "    if (customGetOwnPropertySlot(exec, propertyName, slot))\n");
+            push(@implContent, "        return true;\n");
+        }
+
+        if ($numConstants eq 0 && $numFunctions eq 0) {
+            push(@implContent, "    return Base::getOwnPropertySlot(exec, propertyName, slot);\n");        
+        } elsif ($numConstants eq 0) {
             push(@implContent, "    return getStaticFunctionSlot<JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
         } elsif ($numFunctions eq 0) {
             push(@implContent, "    return getStaticValueSlot<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
@@ -931,6 +945,15 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
+    if ($dataNode->extendedAttributes->{"CustomPrototypePutFunction"}) {
+        push(@implContent, "void ${className}Prototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    if (customPut(exec, propertyName, value, slot))\n");
+        push(@implContent, "        return;\n");
+        push(@implContent, "    Base::put(exec, propertyName, value, slot);\n");
+        push(@implContent, "}\n\n");
+    }
+
     # - Initialize static ClassInfo object
     if ($numAttributes > 0 && $dataNode->extendedAttributes->{"NoStaticTables"}) {
         push(@implContent, "static const HashTable* get${className}Table(ExecState* exec)\n");
@@ -970,7 +993,15 @@ sub GenerateImplementation
         push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
         push(@implContent, "    : $parentClassName(structure, impl, shell)\n");
     } else {
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl" . ($needsSVGContext ? ", SVGElement* context" : "") . ")\n");
+        my $contextArg = "";
+        if ($needsSVGContext) {
+            if ($hasParent && !$parentNeedsSVGContext) {
+                $contextArg = ", SVGElement*";
+            } else {
+                $contextArg = ", SVGElement* context";
+            }
+        }
+        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl$contextArg)\n");
         if ($hasParent) {
             push(@implContent, "    : $parentClassName(structure, impl" . ($parentNeedsSVGContext ? ", context" : "") . ")\n");
         } else {
@@ -983,12 +1014,17 @@ sub GenerateImplementation
     push(@implContent, "}\n\n");
 
     # Destructor
-    if (!$hasParent) {
+    if (!$hasParent || $interfaceName eq "DOMWindow") {
         push(@implContent, "${className}::~$className()\n");
         push(@implContent, "{\n");
 
         if ($interfaceName eq "Node") {
-            push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
+             $implIncludes{"RegisteredEventListener.h"} = 1;
+             push(@implContent, "    invalidateEventListeners(m_impl->eventListeners());\n");
+             push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
+        } elsif ($interfaceName eq "DOMWindow") {
+             $implIncludes{"RegisteredEventListener.h"} = 1;
+             push(@implContent, "    invalidateEventListeners(impl()->eventListeners());\n");
         } else {
             if ($podType) {
                 my $animatedType = $implClassName;
@@ -1002,7 +1038,7 @@ sub GenerateImplementation
             push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());\n");
         }
 
-        push(@implContent, "\n}\n\n");
+        push(@implContent, "}\n\n");
     }
 
     # Document needs a special destructor because it's a special case for caching. It needs
@@ -1013,12 +1049,12 @@ sub GenerateImplementation
     }
 
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
-        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -1069,7 +1105,7 @@ sub GenerateImplementation
                     push(@implContent, "#if ${conditionalString}\n");
                 }
 
-                push(@implContent, "JSValuePtr ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
                 push(@implContent, "{\n");
 
                 my $implClassNameForValueConversion = "";
@@ -1084,7 +1120,7 @@ sub GenerateImplementation
                     push(@implContent, "        return jsUndefined();\n");
                 }
 
-                if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"CustomGetter"}) {
+                if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"}) {
                     push(@implContent, "    return static_cast<$className*>(asObject(slot.slotBase()))->$implGetterFunctionName(exec);\n");
                 } elsif ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
                     $implIncludes{"JSDOMBinding.h"} = 1;
@@ -1096,25 +1132,21 @@ sub GenerateImplementation
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
                     push(@implContent, "    return checkNodeSecurity(exec, imp->contentDocument()) ? " . NativeToJSValue($attribute->signature,  0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName()", "static_cast<$className*>(asObject(slot.slotBase()))") . " : jsUndefined();\n");
                 } elsif ($type eq "EventListener") {
-                    $implIncludes{"JSEventListener.h"} = 1;
                     $implIncludes{"EventListener.h"} = 1;
-                    my $listenerType;
-                    if ($attribute->signature->extendedAttributes->{"ProtectedListener"}) {
-                        $listenerType = "JSEventListener";
-                    } else {
-                        $listenerType = "JSUnprotectedEventListener";
-                    }
+                    push(@implContent, "    UNUSED_PARAM(exec);\n");
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                    push(@implContent, "    if (${listenerType}* listener = static_cast<${listenerType}*>(imp->$implGetterFunctionName())) {\n");
-                    push(@implContent, "        if (JSObject* listenerObj = listener->listenerObj())\n");
-                    push(@implContent, "            return listenerObj;\n");
+                    push(@implContent, "    if (EventListener* listener = imp->$implGetterFunctionName()) {\n");
+                    push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction())\n");
+                    push(@implContent, "            return jsFunction;\n");
                     push(@implContent, "    }\n");
                     push(@implContent, "    return jsNull();\n");
                 } elsif ($attribute->signature->type =~ /Constructor$/) {
                     my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
                     $constructorType =~ s/Constructor$//;
+                    push(@implContent, "    UNUSED_PARAM(slot);\n");
                     push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec);\n");
                 } elsif (!@{$attribute->getterExceptions}) {
+                    push(@implContent, "    UNUSED_PARAM(exec);\n");
                     if ($podType) {
                         push(@implContent, "    $podType imp(*static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
                         if ($podType eq "float") { # Special case for JSSVGNumber
@@ -1137,10 +1169,10 @@ sub GenerateImplementation
 
                     if ($podType) {
                         push(@implContent, "    $podType imp(*static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                        push(@implContent, "    JSC::JSValuePtr result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
                     } else {
                         push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                        push(@implContent, "    JSC::JSValuePtr result = " . NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
                     }
 
                     push(@implContent, "    setDOMException(exec, ec);\n");
@@ -1159,7 +1191,7 @@ sub GenerateImplementation
             if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
                 my $constructorFunctionName = "js" . $interfaceName . "Constructor";
 
-                push(@implContent, "JSValuePtr ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    return static_cast<$className*>(asObject(slot.slotBase()))->getConstructor(exec);\n");
                 push(@implContent, "}\n");
@@ -1177,7 +1209,7 @@ sub GenerateImplementation
                      || $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
 
         if ($hasSetter) {
-            push(@implContent, "void ${className}::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)\n");
+            push(@implContent, "void ${className}::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
             push(@implContent, "{\n");
             if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
                 push(@implContent, "    bool ok;\n");
@@ -1200,7 +1232,7 @@ sub GenerateImplementation
             push(@implContent, "}\n\n");
 
             if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
-                push(@implContent, "void ${className}::put(ExecState* exec, unsigned propertyName, JSValuePtr value)\n");
+                push(@implContent, "void ${className}::put(ExecState* exec, unsigned propertyName, JSValue value)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    indexSetter(exec, propertyName, value);\n");
                 push(@implContent, "    return;\n");
@@ -1215,7 +1247,7 @@ sub GenerateImplementation
                         my $putFunctionName = "setJS" . $interfaceName .  $codeGenerator->WK_ucfirst($name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                         my $implSetterFunctionName = $codeGenerator->WK_ucfirst($name);
 
-                        push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValuePtr value)\n");
+                        push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                         push(@implContent, "{\n");
 
                         if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
@@ -1227,17 +1259,12 @@ sub GenerateImplementation
                             push(@implContent, "        return;\n");
                         }
 
-                        if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"CustomSetter"}) {
+                        if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"}) {
                             push(@implContent, "    static_cast<$className*>(thisObject)->set$implSetterFunctionName(exec, value);\n");
                         } elsif ($type eq "EventListener") {
                             $implIncludes{"JSEventListener.h"} = 1;
+                            push(@implContent, "    UNUSED_PARAM(exec);\n");
                             push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
-                            my $listenerType;
-                            if ($attribute->signature->extendedAttributes->{"ProtectedListener"}) {
-                                $listenerType = "JSEventListener";
-                            } else {
-                                $listenerType = "JSUnprotectedEventListener";
-                            }
                             if ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
                                 push(@implContent, "    JSDOMGlobalObject* globalObject = static_cast<$className*>(thisObject);\n");
                             } else {
@@ -1247,7 +1274,7 @@ sub GenerateImplementation
                                 push(@implContent, "    if (!globalObject)\n");
                                 push(@implContent, "        return;\n");
                             }
-                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->findOrCreate${listenerType}(exec, value, true));\n");
+                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->createJSAttributeEventListener(value));\n");
                         } elsif ($attribute->signature->type =~ /Constructor$/) {
                             my $constructorType = $attribute->signature->type;
                             $constructorType =~ s/Constructor$//;
@@ -1255,6 +1282,7 @@ sub GenerateImplementation
                             push(@implContent, "    // Shadowing a built-in constructor\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
+                            push(@implContent, "    // Shadowing a built-in object\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } else {
                             if ($podType) {
@@ -1303,7 +1331,7 @@ sub GenerateImplementation
     }
 
     if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
-        push(@implContent, "JSValuePtr ${className}::getConstructor(ExecState* exec)\n{\n");
+        push(@implContent, "JSValue ${className}::getConstructor(ExecState* exec)\n{\n");
         push(@implContent, "    return getDOMConstructor<${className}Constructor>(exec);\n");
         push(@implContent, "}\n\n");
     }
@@ -1316,17 +1344,18 @@ sub GenerateImplementation
             my $functionName = $codeGenerator->WK_lcfirst($className) . "PrototypeFunction" . $codeGenerator->WK_ucfirst($function->signature->name);
             my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementationFunction"} || $codeGenerator->WK_lcfirst($function->signature->name);
 
-            push(@implContent, "JSValuePtr ${functionName}(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)\n");
+            push(@implContent, "JSValue JSC_HOST_CALL ${functionName}(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)\n");
             push(@implContent, "{\n");
+            push(@implContent, "    UNUSED_PARAM(args);\n");
 
             $implKJSInclude{"Error.h"} = 1;
 
             if ($interfaceName eq "DOMWindow") {
-                push(@implContent, "    $className* castedThisObj = toJSDOMWindow(thisValue);\n");
+                push(@implContent, "    $className* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));\n");
                 push(@implContent, "    if (!castedThisObj)\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
             } else {
-                push(@implContent, "    if (!thisValue->isObject(&${className}::s_info))\n");
+                push(@implContent, "    if (!thisValue.isObject(&${className}::s_info))\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
                 push(@implContent, "    $className* castedThisObj = static_cast<$className*>(asObject(thisValue));\n");
             }
@@ -1337,7 +1366,7 @@ sub GenerateImplementation
                 push(@implContent, "        return jsUndefined();\n");
             }
 
-            if ($function->signature->extendedAttributes->{"Custom"}) {
+            if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"}) {
                 push(@implContent, "    return castedThisObj->" . $functionImplementationName . "(exec, args);\n");
             } else {
                 if ($podType) {
@@ -1390,15 +1419,15 @@ sub GenerateImplementation
                     
                     if ($parameter->type eq "XPathNSResolver") {
                         push(@implContent, "    RefPtr<XPathNSResolver> customResolver;\n");
-                        push(@implContent, "    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, $paramIndex));\n");
+                        push(@implContent, "    XPathNSResolver* resolver = toXPathNSResolver(args.at($paramIndex));\n");
                         push(@implContent, "    if (!resolver) {\n");
-                        push(@implContent, "        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, $paramIndex));\n");
+                        push(@implContent, "        customResolver = JSCustomXPathNSResolver::create(exec, args.at($paramIndex));\n");
                         push(@implContent, "        if (exec->hadException())\n");
                         push(@implContent, "            return jsUndefined();\n");
                         push(@implContent, "        resolver = customResolver.get();\n");
                         push(@implContent, "    }\n");
                     } else {
-                        push(@implContent, "    " . GetNativeTypeFromSignature($parameter) . " $name = " . JSValueToNative($parameter, "args.at(exec, $paramIndex)") . ";\n");
+                        push(@implContent, "    " . GetNativeTypeFromSignature($parameter) . " $name = " . JSValueToNative($parameter, "args.at($paramIndex)") . ";\n");
 
                         # If a parameter is "an index" and it's negative it should throw an INDEX_SIZE_ERR exception.
                         # But this needs to be done in the bindings, because the type is unsigned and the fact that it
@@ -1437,7 +1466,7 @@ sub GenerateImplementation
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
 
             # FIXME: this casts into int to match our previous behavior which turned 0xFFFFFFFF in -1 for NodeFilter.SHOW_ALL
-            push(@implContent, "JSValuePtr ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
+            push(@implContent, "JSValue ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
             push(@implContent, "{\n");
             push(@implContent, "    return jsNumber(exec, static_cast<int>(" . $constant->value . "));\n");
             push(@implContent, "}\n\n");
@@ -1445,7 +1474,7 @@ sub GenerateImplementation
     }
 
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@implContent, "\nJSValuePtr ${className}::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)\n");
+        push(@implContent, "\nJSValue ${className}::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slot.slotBase()));\n");
         if (IndexGetterReturnsStrings($implClassName)) {
@@ -1463,11 +1492,11 @@ sub GenerateImplementation
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateToJS"}) and !UsesManualToJSImplementation($implClassName)) {
         if ($podType) {
-            push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-             push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, $implType* object, SVGElement* context)\n");
+             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, $implType* object, SVGElement* context)\n");
         } else {
-            push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, $implType* object)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, $implType* object)\n");
         }
 
         push(@implContent, "{\n");
@@ -1483,14 +1512,14 @@ sub GenerateImplementation
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateNativeConverter"}) and !$dataNode->extendedAttributes->{"CustomNativeConverter"}) {
         if ($podType) {
-            push(@implContent, "$podType to${interfaceName}(JSC::JSValuePtr value)\n");
+            push(@implContent, "$podType to${interfaceName}(JSC::JSValue value)\n");
         } else {
-            push(@implContent, "$implClassName* to${interfaceName}(JSC::JSValuePtr value)\n");
+            push(@implContent, "$implClassName* to${interfaceName}(JSC::JSValue value)\n");
         }
 
         push(@implContent, "{\n");
 
-        push(@implContent, "    return value->isObject(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
+        push(@implContent, "    return value.isObject(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
         if ($podType and $podType ne "float") {
             push(@implContent, "$podType();\n}\n");
         } else {
@@ -1534,10 +1563,12 @@ sub GenerateImplementationFunctionCall()
 
         push(@implContent, $indent . "return jsUndefined();\n");
     } else {
-        push(@implContent, "\n" . $indent . "JSC::JSValuePtr result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
+        push(@implContent, "\n" . $indent . "JSC::JSValue result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
         push(@implContent, $indent . "setDOMException(exec, ec);\n") if @{$function->raisesExceptions};
 
-        if ($podType) {
+        if ($podType and not $function->signature->extendedAttributes->{"Immutable"}) {
+            # Immutable methods do not commit changes back to the instance, thus producing
+            # a new instance rather than mutating existing one.
             push(@implContent, $indent . "wrapper->commitChange(imp, castedThisObj->context());\n");
         }
 
@@ -1561,7 +1592,6 @@ sub GetNativeTypeFromSignature
 my %nativeType = (
     "CompareHow" => "Range::CompareHow",
     "DOMString" => "const UString&",
-    "EventTarget" => "EventTargetNode*",
     "NodeFilter" => "RefPtr<NodeFilter>",
     "SVGLength" => "SVGLength",
     "SVGMatrix" => "TransformationMatrix",
@@ -1595,23 +1625,18 @@ sub JSValueToNative
 
     my $type = $codeGenerator->StripModule($signature->type);
 
-    return "$value->toBoolean(exec)" if $type eq "boolean";
-    return "$value->toNumber(exec)" if $type eq "double";
-    return "$value->toFloat(exec)" if $type eq "float" or $type eq "SVGNumber";
-    return "$value->toInt32(exec)" if $type eq "unsigned long" or $type eq "long" or $type eq "unsigned short";
+    return "$value.toBoolean(exec)" if $type eq "boolean";
+    return "$value.toNumber(exec)" if $type eq "double";
+    return "$value.toFloat(exec)" if $type eq "float" or $type eq "SVGNumber";
+    return "$value.toInt32(exec)" if $type eq "unsigned long" or $type eq "long" or $type eq "unsigned short";
 
-    return "static_cast<Range::CompareHow>($value->toInt32(exec))" if $type eq "CompareHow";
-    return "static_cast<SVGPaint::SVGPaintType>($value->toInt32(exec))" if $type eq "SVGPaintType";
+    return "static_cast<Range::CompareHow>($value.toInt32(exec))" if $type eq "CompareHow";
+    return "static_cast<SVGPaint::SVGPaintType>($value.toInt32(exec))" if $type eq "SVGPaintType";
 
     if ($type eq "DOMString") {
         return "valueToStringWithNullCheck(exec, $value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
         return "valueToStringWithUndefinedOrNullCheck(exec, $value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
-        return "$value->toString(exec)";
-    }
-
-    if ($type eq "EventTarget") {
-        $implIncludes{"JSEventTargetNode.h"} = 1;
-        return "toEventTargetNode($value)";
+        return "$value.toString(exec)";
     }
 
     $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
@@ -1709,10 +1734,6 @@ sub NativeToJSValue
         $implIncludes{"CSSMutableStyleDeclaration.h"} = 1;
     }
 
-    if ($type eq "NamedNodeMap") {
-        $implIncludes{"NamedAttrMap.h"} = 1;
-    }
-
     if ($type eq "NodeList") {
         $implIncludes{"NameNodeList.h"} = 1;
     }
@@ -1998,13 +2019,13 @@ public:
     ${className}Constructor(ExecState* exec)
         : DOMObject(${className}Constructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec), None);
+        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 68fce3d0e4..fc265f9efc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Anders Carlsson <andersca@mac.com> 
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
-# Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -33,7 +33,6 @@ my $newPublicClass = 0;
 my $interfaceAvailabilityVersion = "";
 my $isProtocol = 0;
 my $noImpl = 0;
-my @ivars = ();
 
 my @headerContentHeader = ();
 my @headerContent = ();
@@ -79,7 +78,7 @@ my $buildingForTigerOrEarlier = 1 if $ENV{"MACOSX_DEPLOYMENT_TARGET"} and $ENV{"
 my $buildingForLeopardOrLater = 1 if $ENV{"MACOSX_DEPLOYMENT_TARGET"} and $ENV{"MACOSX_DEPLOYMENT_TARGET"} >= 10.5;
 my $exceptionInit = "WebCore::ExceptionCode ec = 0;";
 my $exceptionRaiseOnError = "WebCore::raiseOnDOMError(ec);";
-my $assertMainThread = "{ DOM_ASSERT_MAIN_THREAD(); WebCoreThreadViolationCheck(); }";
+my $assertMainThread = "{ DOM_ASSERT_MAIN_THREAD(); WebCoreThreadViolationCheckRoundOne(); }";
 
 my %conflictMethod = (
     # FIXME: Add C language keywords?
@@ -130,10 +129,10 @@ my %conflictMethod = (
 
 my $fatalError = 0;
 
-# Default Licence Templates
-my $headerLicenceTemplate = << "EOF";
+# Default License Templates
+my $headerLicenseTemplate = << "EOF";
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig\@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -159,7 +158,7 @@ my $headerLicenceTemplate = << "EOF";
  */
 EOF
 
-my $implementationLicenceTemplate = << "EOF";
+my $implementationLicenseTemplate = << "EOF";
 /*
  * This file is part of the WebKit open source project.
  * This file has been generated by generate-bindings.pl. DO NOT MODIFY!
@@ -218,7 +217,7 @@ sub ReadPublicInterfaces
 
     my $fileName = "WebCore/bindings/objc/PublicDOMInterfaces.h";
     open FILE, "-|", "/usr/bin/gcc", "-E", "-P", "-x", "objective-c", 
-        (map { "-D$_" } split(/ /, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
+        (map { "-D$_" } split(/ +/, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
     my @documentContent = <FILE>;
     close FILE;
 
@@ -345,7 +344,6 @@ sub GetParentImplClassName
     my $parent = $codeGenerator->StripModule($dataNode->parents(0));
 
     # special cases
-    return "Node" if $parent eq "EventTargetNode";
     return "Object" if $parent eq "HTMLCollection";
 
     return $parent;
@@ -373,8 +371,6 @@ sub GetParentAndProtocols
         } else {
             if (IsProtocolType($parentName)) {
                 push(@protocols, "DOM" . $parentName);
-            } elsif ($parentName eq "EventTargetNode") {
-                $parent = "DOMNode";
             } elsif ($parentName eq "HTMLCollection") {
                 $parent = "DOMObject";
             } else {
@@ -458,47 +454,24 @@ sub GetPropertyAttributes
 
     push(@attributes, "readonly") if $readOnly;
 
-#    FIXME: uncomment these lines once <rdar://problem/4996504> is fixed.
-#    unless ($readOnly) {
-        if ($codeGenerator->IsStringType($type) || IsNativeObjCType($type)) {
-            push(@attributes, "copy");
-        } elsif ($codeGenerator->IsPodType($type) || $codeGenerator->IsSVGAnimatedType($type)) {
-            push(@attributes, "retain");
-        } elsif (!$codeGenerator->IsStringType($type) && !$codeGenerator->IsPrimitiveType($type) && $type ne "DOMTimeStamp" && $type ne "CompareHow" && $type ne "SVGPaintType") {
-            push(@attributes, "retain");
-        }
-#    }
+    # FIXME: <rdar://problem/5049934> Consider using 'nonatomic' on the DOM @property declarations.
+    if ($codeGenerator->IsStringType($type) || IsNativeObjCType($type)) {
+        push(@attributes, "copy");
+    } elsif ($codeGenerator->IsPodType($type) || $codeGenerator->IsSVGAnimatedType($type)) {
+        push(@attributes, "retain");
+    } elsif (!$codeGenerator->IsStringType($type) && !$codeGenerator->IsPrimitiveType($type) && $type ne "DOMTimeStamp" && $type ne "CompareHow" && $type ne "SVGPaintType") {
+        push(@attributes, "retain");
+    }
 
     return "" unless @attributes > 0;
     return "(" . join(", ", @attributes) . ")";
 }
 
-sub GetObjCTypeMaker
+sub ConversionNeeded
 {
     my $type = $codeGenerator->StripModule(shift);
 
-    return "" if $codeGenerator->IsNonPointerType($type) or $codeGenerator->IsStringType($type) or IsNativeObjCType($type);
-    return "_wrapAbstractView" if $type eq "DOMWindow";
-    return "_wrap$type";
-}
-
-sub GetObjCTypeGetterName
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    my $typeGetter = "";
-    if ($type =~ /^(HTML|CSS|SVG)/ or $type eq "DOMImplementation" or $type eq "CDATASection" or $type eq "RGBColor") {
-        $typeGetter = $type;
-    } elsif ($type =~ /^XPath(.+)/) {
-        $typeGetter = "xpath" . $1;
-    } elsif ($type eq "DOMWindow") {
-        $typeGetter = "abstractView";
-    } else {
-        $typeGetter = lcfirst($type);
-    }
-
-    # put into the form "_fooBar" for type FooBar.
-    return "_" . $typeGetter;
+    return !$codeGenerator->IsNonPointerType($type) && !$codeGenerator->IsStringType($type) && !IsNativeObjCType($type);
 }
 
 sub GetObjCTypeGetter
@@ -507,68 +480,13 @@ sub GetObjCTypeGetter
     my $type = $codeGenerator->StripModule(shift);
 
     return $argName if $codeGenerator->IsPrimitiveType($type) or $codeGenerator->IsStringType($type) or IsNativeObjCType($type);
-    return $argName . "EventTarget" if $type eq "EventTarget";
+    return $argName . "Node" if $type eq "EventTarget";
     return "static_cast<WebCore::Range::CompareHow>($argName)" if $type eq "CompareHow";
     return "static_cast<WebCore::SVGPaint::SVGPaintType>($argName)" if $type eq "SVGPaintType";
-
-    my $typeGetterMethodName = GetObjCTypeGetterName($type);
-
     return "WTF::getPtr(nativeEventListener)" if $type eq "EventListener";
     return "WTF::getPtr(nativeNodeFilter)" if $type eq "NodeFilter";
     return "WTF::getPtr(nativeResolver)" if $type eq "XPathNSResolver";
-    return "[$argName $typeGetterMethodName]";
-}
-
-sub GetInternalTypeGetterSignature
-{
-    my ($interfaceName, $podType) = @_;
-
-    my $implClassNameWithNamespace = "WebCore::" . GetImplClassName($interfaceName);
-    my $podTypeWithNamespace;
-    if ($podType) {
-        $podTypeWithNamespace = ($podType eq "float") ? "$podType" : "WebCore::$podType";
-    }
-
-    # - Type-Getter
-    # - (WebCore::FooBar *)_fooBar for implementation class FooBar
-    my $typeGetterName = GetObjCTypeGetterName($interfaceName);
-    return "- " . ($podType ? "($podTypeWithNamespace)" : "($implClassNameWithNamespace *)") . $typeGetterName;
-}
-
-sub GetInternalTypeMakerSignature
-{
-    my ($interfaceName, $podType) = @_;
-
-    my $className = GetClassName($interfaceName);
-    my $implClassNameWithNamespace = "WebCore::" . GetImplClassName($interfaceName);
-    my $podTypeWithNamespace;
-    if ($podType) {
-        $podTypeWithNamespace = ($podType eq "float") ? "$podType" : "WebCore::$podType";
-    }
- 
-    my @ivarsToRetain = ();
-    my $ivarsToInit = "";
-    my $typeMakerSigAddition = "";
-    if (@ivars > 0) {
-        my @ivarsInitSig = ();
-        my @ivarsInitCall = ();
-        foreach $attribute (@ivars) {
-            my $name = $attribute->signature->name;
-            my $memberName = "m_" . $name;
-            my $varName = "in" . $name;
-            my $type = GetObjCType($attribute->signature->type);
-            push(@ivarsInitSig, "$name:($type)$varName");
-            push(@ivarsInitCall, "$name:$varName");
-            push(@ivarsToRetain, "    $memberName = [$varName retain];\n");
-        }
-        $ivarsToInit = " " . join(" ", @ivarsInitCall);
-        $typeMakerSigAddition = " " . join(" ", @ivarsInitSig);
-    }
-
-    my $typeMakerName = GetObjCTypeMaker($interfaceName);
-    return ("+ ($className *)$typeMakerName:(" . ($podType ? "$podTypeWithNamespace" : "$implClassNameWithNamespace *") . ")impl" . $typeMakerSigAddition,
-            $typeMakerSigAddition,
-            $ivarsToInit);
+    return "core($argName)";
 }
 
 sub AddForwardDeclarationsForType
@@ -605,77 +523,89 @@ sub AddIncludesForType
     }
 
     if ($type eq "RGBColor") {
-        $implIncludes{"Color.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMRGBColorInternal.h"} = 1;
         return;
     }
 
     if ($type eq "DOMWindow") {
-        $implIncludes{"DOMAbstractView.h"} = 1;
-        $implIncludes{"$type.h"} = 1;
+        $implIncludes{"DOMAbstractViewInternal.h"} = 1;
+        $implIncludes{"DOMWindow.h"} = 1;
         return;
     }
 
     if ($type eq "DOMImplementation") {
+        $implIncludes{"DOMDOMImplementationInternal.h"} = 1;
         $implIncludes{"DOMImplementationFront.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
         return;
     }
 
     if ($type eq "EventTarget") {
-        $implIncludes{"EventTargetNode.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"Node.h"} = 1;
+        $implIncludes{"DOMEventTarget.h"} = 1;
         return;
     }
 
     if ($codeGenerator->IsSVGAnimatedType($type)) {
         $implIncludes{"SVGAnimatedTemplate.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOM${type}Internal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGRect") {
         $implIncludes{"FloatRect.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGRectInternal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGPoint") {
         $implIncludes{"FloatPoint.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGPointInternal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGMatrix") {
         $implIncludes{"TransformationMatrix.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGMatrixInternal.h"} = 1;
         $implIncludes{"SVGException.h"} = 1;
         return;
     }
 
     if ($type eq "SVGNumber") {
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGNumberInternal.h"} = 1;
         return;
     }
 
     if ($type =~ /(\w+)(Abs|Rel)$/) {
         $implIncludes{"$1.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOM${type}Internal.h"} = 1;
+        return;
+    }
+
+    if ($type eq "NodeFilter") {
+        $implIncludes{"NodeFilter.h"} = 1;
+        $implIncludes{"ObjCNodeFilterCondition.h"} = 1;
         return;
     }
 
-    $implIncludes{"ObjCEventListener.h"} = 1 if $type eq "EventListener";
-    $implIncludes{"ObjCNodeFilterCondition.h"} = 1 if $type eq "NodeFilter";
-    $implIncludes{"DOMCustomXPathNSResolver.h"} = 1 if $type eq "XPathNSResolver";
+    if ($type eq "EventListener") {
+        $implIncludes{"EventListener.h"} = 1;
+        $implIncludes{"ObjCEventListener.h"} = 1;
+        return;
+    }
+
+    if ($type eq "XPathNSResolver") {
+        $implIncludes{"DOMCustomXPathNSResolver.h"} = 1;
+        $implIncludes{"XPathNSResolver.h"} = 1;
+        return;
+    }
 
     # FIXME: won't compile without these
     $implIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
-    $implIncludes{"NamedAttrMap.h"} = 1 if $type eq "NamedNodeMap";
     $implIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
 
     # Default, include the same named file (the implementation) and the same name prefixed with "DOM". 
     $implIncludes{"$type.h"} = 1;
-    $implIncludes{"DOM$type.h"} = 1;
+    $implIncludes{"DOM${type}Internal.h"} = 1;
 }
 
 sub GenerateHeader
@@ -695,7 +625,7 @@ sub GenerateHeader
     my $numFunctions = @{$dataNode->functions};
 
     # - Add default header template
-    @headerContentHeader = split("\r", $headerLicenceTemplate);
+    @headerContentHeader = split("\r", $headerLicenseTemplate);
     push(@headerContentHeader, "\n");
 
     # - INCLUDES -
@@ -762,23 +692,6 @@ sub GenerateHeader
 
     # - Add attribute getters/setters.
     if ($numAttributes > 0) {
-        # Add ivars, if any, first
-        @ivars = ();
-        foreach my $attribute (@{$dataNode->attributes}) {
-            push(@ivars, $attribute) if $attribute->signature->extendedAttributes->{"ObjCIvar"};
-        }
-
-        if (@ivars > 0) {
-            push(@headerContent, "{\n");
-            foreach my $attribute (@ivars) {
-                my $type = GetObjCType($attribute->signature->type);
-                my $name = "m_" . $attribute->signature->name;
-                my $ivarDeclaration = "$type $name";
-                push(@headerContent, "    $ivarDeclaration;\n");
-            }
-            push(@headerContent, "}\n");
-        }
-
         foreach my $attribute (@{$dataNode->attributes}) {
             my $attributeName = $attribute->signature->name;
 
@@ -974,7 +887,7 @@ sub GenerateHeader
 
     if (@privateHeaderAttributes > 0 or @privateHeaderFunctions > 0 or exists $alwaysGenerateForNoSVGBuild{$className}) {
         # - Private category @interface
-        @privateHeaderContentHeader = split("\r", $headerLicenceTemplate);
+        @privateHeaderContentHeader = split("\r", $headerLicenseTemplate);
         push(@privateHeaderContentHeader, "\n");
 
         my $classHeaderName = GetClassHeaderName($className);
@@ -994,45 +907,66 @@ sub GenerateHeader
     unless ($isProtocol) {
         # Generate internal interfaces
         my $podType = $dataNode->extendedAttributes->{"PODType"};
-        my $typeGetterSig = GetInternalTypeGetterSignature($interfaceName, $podType);
-        my ($typeMakerSig, $typeMakerSigAddition, $ivarsToInit) = GetInternalTypeMakerSignature($interfaceName, $podType);
 
         # Generate interface definitions. 
-        @internalHeaderContent = split("\r", $implementationLicenceTemplate);
+        @internalHeaderContent = split("\r", $implementationLicenseTemplate);
 
         push(@internalHeaderContent, "\n#import <WebCore/$className.h>\n\n");
         push(@internalHeaderContent, $interfaceAvailabilityVersionCheck) if length $interfaceAvailabilityVersion;
 
-        if ($interfaceName eq "Node" or $interfaceName eq "SVGElementInstance") {
+        if ($interfaceName eq "Node") {
             push(@internalHeaderContent, "\@protocol DOMEventTarget;\n\n");
         }
 
+        my $startedNamespace = 0;
+
+        my $implClassName = GetImplClassName($interfaceName);
+
         if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
             push(@internalHeaderContent, "#import <WebCore/SVGAnimatedTemplate.h>\n\n");
         } elsif ($interfaceName eq "RGBColor") {
             push(@internalHeaderContent, "#import <WebCore/Color.h>\n\n");
         } else {
+            push(@internalHeaderContent, "namespace WebCore {\n");
+            $startedNamespace = 1;
             if ($podType and $podType ne "float") {
-                push(@internalHeaderContent, "namespace WebCore { class $podType; }\n\n");
+                push(@internalHeaderContent, "    class $podType;\n");
             } elsif ($interfaceName eq "Node") {
-                push(@internalHeaderContent, "namespace WebCore { class Node; class EventTarget; }\n\n");
-            } elsif ($interfaceName eq "SVGElementInstance") {
-                push(@internalHeaderContent, "namespace WebCore { class SVGElementInstance; class EventTarget; }\n\n");
+                push(@internalHeaderContent, "    class EventTarget;\n    class Node;\n");
+            } else {
+                push(@internalHeaderContent, "    class $implClassName;\n");
+            }
+            push(@internalHeaderContent, "}\n\n");
+        }
+
+        if ($podType) {
+            if ($podType eq "float") {
+                push(@internalHeaderContent, "float core($className *);\n");
+            } else {
+                push(@internalHeaderContent, "WebCore::$podType core($className *);\n");
+            }
+        } else {
+            push(@internalHeaderContent, "WebCore::$implClassName* core($className *);\n");
+        }
+
+        if ($podType) {
+            if ($podType eq "float") {
+                push(@internalHeaderContent, "$className *kit($podType);\n");
             } else {
-                my $implClassName = GetImplClassName($interfaceName);
-                push(@internalHeaderContent, "namespace WebCore { class $implClassName; }\n\n");
+                push(@internalHeaderContent, "$className *kit(WebCore::$podType);\n");
             }
+        } else {
+            push(@internalHeaderContent, "$className *kit(WebCore::$implClassName*);\n");
         }
 
-        push(@internalHeaderContent, "\@interface $className (WebCoreInternal)\n");
-        push(@internalHeaderContent, $typeGetterSig . ";\n");
-        push(@internalHeaderContent, $typeMakerSig . ";\n");
+        if ($dataNode->extendedAttributes->{Polymorphic}) {
+            push(@internalHeaderContent, "Class kitClass(WebCore::$implClassName*);\n");
+        }
 
-        if ($interfaceName eq "Node" or $interfaceName eq "SVGElementInstance") {
-            push(@internalHeaderContent, "+ (id <DOMEventTarget>)_wrapEventTarget:(WebCore::EventTarget *)eventTarget;\n");
+        if ($interfaceName eq "Node") {
+            push(@internalHeaderContent, "id <DOMEventTarget> kit(WebCore::EventTarget*);\n");
         }
 
-        push(@internalHeaderContent, "\@end\n");
         push(@internalHeaderContent, "\n#endif\n") if length $interfaceAvailabilityVersion;
     }
 }
@@ -1066,7 +1000,7 @@ sub GenerateImplementation
     }
 
     # - Add default header template.
-    @implContentHeader = split("\r", $implementationLicenceTemplate);
+    @implContentHeader = split("\r", $implementationLicenseTemplate);
 
     # - INCLUDES -
     push(@implContentHeader, "\n#import \"config.h\"\n");
@@ -1074,13 +1008,25 @@ sub GenerateImplementation
     my $conditionalString;
     if ($conditional) {
         $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
-        push(@implContentHeader, "\n#if ${conditionalString}\n");
+        push(@implContentHeader, "\n#if ${conditionalString}\n\n");
     }
 
-    push(@implContentHeader, "\n#import \"$classHeaderName.h\"\n\n");
+    push(@implContentHeader, "#import \"DOMInternal.h\"\n\n");
+    push(@implContentHeader, "#import \"$classHeaderName.h\"\n\n");
+
+    $implIncludes{"ExceptionHandlers.h"} = 1;
+    $implIncludes{"ThreadCheck.h"} = 1;
+    $implIncludes{"WebScriptObjectPrivate.h"} = 1;
+    $implIncludes{$classHeaderName . "Internal.h"} = 1;
+
+    # FIXME: These includes are only needed when the class is a subclass of one of these polymorphic classes.
+    $implIncludes{"DOMCSSRuleInternal.h"} = 1;
+    $implIncludes{"DOMCSSValueInternal.h"} = 1;
+    $implIncludes{"DOMEventInternal.h"} = 1;
+    $implIncludes{"DOMNodeInternal.h"} = 1;
+    $implIncludes{"DOMStyleSheetInternal.h"} = 1;
 
-    push(@implContentHeader, "#import \"ThreadCheck.h\"\n");
-    push(@implContentHeader, "#import <wtf/GetPtr.h>\n\n");
+    $implIncludes{"DOMSVGPathSegInternal.h"} = 1 if $interfaceName =~ /^SVGPathSeg.+/;
 
     if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
         $implIncludes{"SVGAnimatedTemplate.h"} = 1;
@@ -1094,11 +1040,10 @@ sub GenerateImplementation
         }
     } 
 
-    $implIncludes{"DOMInternal.h"} = 1;
-    $implIncludes{"ExceptionHandlers.h"} = 1;
-
     @implContent = ();
 
+    push(@implContent, "#import <wtf/GetPtr.h>\n\n");
+
     # add implementation accessor
     if ($podType) {
         push(@implContent, "#define IMPL reinterpret_cast<$podTypeWithNamespace*>(_internal)\n\n");
@@ -1114,18 +1059,9 @@ sub GenerateImplementation
 
     # Only generate 'dealloc' and 'finalize' methods for direct subclasses of DOMObject.
     if ($parentImplClassName eq "Object") {
-        my @ivarsToRelease = ();
-        if (@ivars > 0) {
-            foreach $attribute (@ivars) {
-                my $name = "m_" . $attribute->signature->name;
-                push(@ivarsToRelease, "    [$name release];\n");
-            }
-        }
-
         push(@implContent, "- (void)dealloc\n");
         push(@implContent, "{\n");
         push(@implContent, "    $assertMainThread\n");
-        push(@implContent, @ivarsToRelease);
         if ($interfaceName eq "NodeIterator") {
             push(@implContent, "    if (_internal) {\n");
             push(@implContent, "        [self detach];\n");
@@ -1213,17 +1149,16 @@ sub GenerateImplementation
             # special case for EventTarget protocol
             $attributeTypeSansPtr = "DOMNode" if $idlType eq "EventTarget";
 
-            my $typeMaker = GetObjCTypeMaker($attribute->signature->type);
-
             # Special cases
             my @customGetterContent = (); 
             if ($attributeTypeSansPtr eq "DOMImplementation") {
                 # FIXME: We have to special case DOMImplementation until DOMImplementationFront is removed
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:implementationFront(IMPL";
-                $getterContentTail .= "]";
+                $getterContentHead = "kit(implementationFront(IMPL";
+                $getterContentTail .= ")";
             } elsif ($attributeName =~ /(\w+)DisplayString$/) {
                 my $attributeToDisplay = $1;
-                $getterContentHead = "WebCore::displayString(IMPL->$attributeToDisplay(), [self _element]";
+                $getterContentHead = "WebCore::displayString(IMPL->$attributeToDisplay(), core(self)";
+                $implIncludes{"HitTestResult.h"} = 1;
             } elsif ($attributeName =~ /^absolute(\w+)URL$/) {
                 my $typeOfURL = $1;
                 $getterContentHead = "[self _getURLAttribute:";
@@ -1248,15 +1183,14 @@ sub GenerateImplementation
             } elsif ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
                 $getterContentTail .= ".toInt()";
             } elsif ($codeGenerator->IsPodType($idlType)) {
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:" . $getterContentHead;
-                $getterContentTail .= "]";
+                $getterContentHead = "kit($getterContentHead";
+                $getterContentTail .= ")";
             } elsif (IsProtocolType($idlType) and $idlType ne "EventTarget") {
-                $getterContentHead = "[$attributeClassName $typeMaker:WTF::getPtr(" . $getterContentHead;
-                $getterContentTail .= ")]";
-            } elsif ($typeMaker ne "") {
-                # Surround getter with TypeMaker
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:WTF::getPtr(" . $getterContentHead;
-                $getterContentTail .= ")]";
+                $getterContentHead = "kit($getterContentHead";
+                $getterContentTail .= ")";
+            } elsif (ConversionNeeded($attribute->signature->type)) {
+                $getterContentHead = "kit(WTF::getPtr($getterContentHead";
+                $getterContentTail .= "))";
             }
 
             my $getterContent;
@@ -1393,7 +1327,7 @@ sub GenerateImplementation
                 push(@functionContent, "    RefPtr<WebCore::XPathNSResolver> customResolver;\n");
                 push(@functionContent, "    if ($paramName) {\n");
                 push(@functionContent, "        if ([$paramName isMemberOfClass:[DOMNativeXPathNSResolver class]])\n");
-                push(@functionContent, "            nativeResolver = [(DOMNativeXPathNSResolver *)$paramName _xpathNSResolver];\n");
+                push(@functionContent, "            nativeResolver = core(static_cast<DOMNativeXPathNSResolver *>($paramName));\n");
                 push(@functionContent, "        else {\n");
                 push(@functionContent, "            customResolver = WebCore::DOMCustomXPathNSResolver::create($paramName);\n");
                 push(@functionContent, "            nativeResolver = WTF::getPtr(customResolver);\n");
@@ -1405,8 +1339,7 @@ sub GenerateImplementation
             if (defined $needsCustom{"EventTarget"}) {
                 my $paramName = $needsCustom{"EventTarget"};
                 push(@functionContent, "    DOMNode* ${paramName}ObjC = $paramName;\n");
-                push(@functionContent, "    WebCore::Node* ${paramName}Node = [${paramName}ObjC _node];\n");
-                push(@functionContent, "    WebCore::EventTargetNode* ${paramName}EventTarget = (${paramName}Node && ${paramName}Node->isEventTargetNode()) ? static_cast<WebCore::EventTargetNode*>(${paramName}Node) : 0;\n\n");
+                push(@functionContent, "    WebCore::Node* ${paramName}Node = core(${paramName}ObjC);\n");
                 $implIncludes{"DOMNode.h"} = 1;
                 $implIncludes{"Node.h"} = 1;
             }
@@ -1419,16 +1352,6 @@ sub GenerateImplementation
                 $caller = "dv";
             }
 
-            if ($function->signature->extendedAttributes->{"EventTargetNodeCast"}) {
-                if ($dataNode->name =~ /^SVG/) {
-                    $caller = "static_cast<WebCore::SVGElementInstance*>($caller)";
-                } else {
-                    push(@functionContent, "    if (!$caller->isEventTargetNode())\n");
-                    $caller = "WebCore::EventTargetNodeCast($caller)";
-                    push(@functionContent, "        WebCore::raiseDOMException(DOM_NOT_SUPPORTED_ERR);\n");
-                }
-            }
-
             # special case the EventListener
             if (defined $needsCustom{"EventListener"}) {
                 my $paramName = $needsCustom{"EventListener"};
@@ -1457,14 +1380,14 @@ sub GenerateImplementation
                 push(@functionContent, "    if (x == 0.0 || y == 0.0)\n");
                 push(@functionContent, "        ec = WebCore::SVGException::SVG_INVALID_VALUE_ERR;\n");
                 push(@functionContent, "    $exceptionRaiseOnError\n");
-                push(@functionContent, "    return [DOMSVGMatrix _wrapSVGMatrix:$content];\n");
+                push(@functionContent, "    return kit($content);\n");
             } elsif ($svgMatrixInverse) {
                 # Special case with inverse & SVGMatrix
                 push(@functionContent, "    $exceptionInit\n");
                 push(@functionContent, "    if (!$caller->isInvertible())\n");
                 push(@functionContent, "        ec = WebCore::SVGException::SVG_MATRIX_NOT_INVERTABLE;\n");
                 push(@functionContent, "    $exceptionRaiseOnError\n");
-                push(@functionContent, "    return [DOMSVGMatrix _wrapSVGMatrix:$content];\n");
+                push(@functionContent, "    return kit($content);\n");
             } elsif ($svgLengthConvertToSpecifiedUnits) {
                 push(@functionContent, "    IMPL->convertToSpecifiedUnits(inUnitType, 0 /* FIXME */);\n");
             } elsif ($returnType eq "void") {
@@ -1492,26 +1415,11 @@ sub GenerateImplementation
                     push(@functionContent, "    return nil;\n");
                 }
             } else {
-                my $typeMaker = GetObjCTypeMaker($function->signature->type);
-                unless ($typeMaker eq "") {
-                    my $returnTypeClass = "";
-                    if ($function->signature->type eq "XPathNSResolver") {
-                        # Special case XPathNSResolver
-                        $returnTypeClass = "DOMNativeXPathNSResolver";
+                if (ConversionNeeded($function->signature->type)) {
+                    if ($codeGenerator->IsPodType($function->signature->type)) {
+                        $content = "kit($content)";
                     } else {
-                        # Remove trailing " *" from pointer types.
-                        $returnTypeClass = $returnType;
-                        $returnTypeClass =~ s/ \*$//;
-                    }
-
-                    # Surround getter with TypeMaker
-                    my $idlType = $returnTypeClass;
-                    $idlType =~ s/^DOM//;
-
-                    if ($codeGenerator->IsPodType($idlType)) {
-                        $content = "[$returnTypeClass $typeMaker:" . $content . "]";
-                    } else {
-                        $content = "[$returnTypeClass $typeMaker:WTF::getPtr(" . $content . ")]";
+                        $content = "kit(WTF::getPtr($content))";
                     }
                 }
 
@@ -1558,87 +1466,55 @@ sub GenerateImplementation
     push(@implContent, "\@end\n");
 
     # Generate internal interfaces
-    unless ($dataNode->extendedAttributes->{ObjCCustomInternalImpl}) {
-        # - BEGIN WebCoreInternal category @implementation
-        push(@implContent, "\n\@implementation $className (WebCoreInternal)\n\n");
-
-        my $typeGetterSig = GetInternalTypeGetterSignature($interfaceName, $podType);
-        push(@implContent, "$typeGetterSig\n");
+    if ($podType) {
+        my $prefixedPodType = $podType eq "float" ? $podType : "WebCore::$podType";
+        push(@implContent, "\n$prefixedPodType core($className *wrapper)\n");
         push(@implContent, "{\n");
-
-        if ($podType) {
-            push(@implContent, "    return *IMPL;\n");
-        } else {
-            push(@implContent, "    return IMPL;\n");
-        }
-
+        push(@implContent, "    return wrapper ? *reinterpret_cast<$prefixedPodType*>(wrapper->_internal) : $prefixedPodType();\n");
         push(@implContent, "}\n\n");
+    } else {
+        push(@implContent, "\nWebCore::$implClassName* core($className *wrapper)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    return wrapper ? reinterpret_cast<WebCore::$implClassName*>(wrapper->_internal) : 0;\n");
+        push(@implContent, "}\n\n");
+    }
 
-        my ($typeMakerSig, $typeMakerSigAddition, $ivarsToInit) = GetInternalTypeMakerSignature($interfaceName, $podType);
-
-        if ($podType) {
-            # - (id)_initWithFooBar:(WebCore::FooBar)impl for implementation class FooBar
-            my $initWithImplName = "_initWith" . $implClassName;
-            my $initWithSig = "- (id)$initWithImplName:($podTypeWithNamespace)impl" . $typeMakerSigAddition;
-
-            # FIXME: Implement Caching
-            push(@implContent, "$initWithSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    [super _init];\n");
-            push(@implContent, "    $podTypeWithNamespace* _impl = new $podTypeWithNamespace(impl);\n");
-            push(@implContent, "    _internal = reinterpret_cast<DOMObjectInternal*>(_impl);\n");
-            push(@implContent, "    return self;\n");
-            push(@implContent, "}\n\n");
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    return [[[self alloc] $initWithImplName:impl] autorelease];\n");
-            push(@implContent, "}\n\n");
-        } elsif ($parentImplClassName eq "Object") {        
-            # - (id)_initWithFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            my $initWithImplName = "_initWith" . $implClassName;
-            my $initWithSig = "- (id)$initWithImplName:($implClassNameWithNamespace *)impl" . $typeMakerSigAddition;
-
-            push(@implContent, "$initWithSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    [super _init];\n");
-            push(@implContent, "    _internal = reinterpret_cast<DOMObjectInternal*>(impl);\n");
-            push(@implContent, "    impl->ref();\n");
-            push(@implContent, "    WebCore::addDOMWrapper(self, impl);\n");
-            push(@implContent, @ivarsToRetain);
-            push(@implContent, "    return self;\n");
-            push(@implContent, "}\n\n");
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    if (!impl)\n");
+    if ($podType) {
+        # FIXME: Implement caching.
+        my $prefixedPodType = $podType eq "float" ? $podType : "WebCore::$podType";
+        push(@implContent, "$className *kit($prefixedPodType value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    $className *wrapper = [[$className alloc] _init];\n");
+        push(@implContent, "    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(new $prefixedPodType(value));\n");
+        push(@implContent, "    return [wrapper autorelease];\n");
+        push(@implContent, "}\n");
+    } elsif ($parentImplClassName eq "Object") {        
+        push(@implContent, "$className *kit(WebCore::$implClassName* value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    if (!value)\n");
+        push(@implContent, "        return nil;\n");
+        push(@implContent, "    if ($className *wrapper = getDOMWrapper(value))\n");
+        push(@implContent, "        return [[wrapper retain] autorelease];\n");
+        if ($dataNode->extendedAttributes->{Polymorphic}) {
+            push(@implContent, "    $className *wrapper = [[kitClass(value) alloc] _init];\n");
+            push(@implContent, "    if (!wrapper)\n");
             push(@implContent, "        return nil;\n");
-            push(@implContent, "    id cachedInstance;\n");
-            push(@implContent, "    cachedInstance = WebCore::getDOMWrapper(impl);\n");
-            push(@implContent, "    if (cachedInstance)\n");
-            push(@implContent, "        return [[cachedInstance retain] autorelease];\n");
-            push(@implContent, "    return [[[self alloc] $initWithImplName:impl" . $ivarsToInit . "] autorelease];\n");
-            push(@implContent, "}\n\n");
         } else {
-            my $internalBaseType = "DOM$baseClass";
-            my $internalBaseTypeMaker = GetObjCTypeMaker($baseClass);
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    return static_cast<$className*>([$internalBaseType $internalBaseTypeMaker:impl]);\n");
-            push(@implContent, "}\n\n");
+            push(@implContent, "    $className *wrapper = [[$className alloc] _init];\n");
         }
-
-        # END WebCoreInternal category
-        push(@implContent, "\@end\n");
+        push(@implContent, "    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(value);\n");
+        push(@implContent, "    value->ref();\n");
+        push(@implContent, "    addDOMWrapper(wrapper, value);\n");
+        push(@implContent, "    return [wrapper autorelease];\n");
+        push(@implContent, "}\n");
+    } else {
+        push(@implContent, "$className *kit(WebCore::$implClassName* value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    return static_cast<$className*>(kit(static_cast<WebCore::$baseClass*>(value)));\n");
+        push(@implContent, "}\n");
     }
 
     # - End the ifdef conditional if necessary
@@ -1706,8 +1582,6 @@ sub WriteData
 
         print IMPL @implContentHeader;
         print IMPL map { "#import \"$_\"\n" } sort keys(%implIncludes);
-
-        print IMPL "\n" if keys(%implIncludes);
         print IMPL @implContent;
 
         close(IMPL);
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm
index 89664ede1b..c6b3644a59 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm
@@ -109,7 +109,12 @@ sub parse($)
             my ($name, $value) = split '=', $_;
 
             $name = trimWS($name);
-            $value = trimQuoteAndWS($value);
+            if (defined($value)) {
+                $value = trimQuoteAndWS($value);
+            } else {
+                # We default to 1 as it eases the syntax.
+                $value = "1";
+            }
 
             &$commonParameterHandler($name, $value);
         } else {
@@ -125,7 +130,12 @@ sub parse($)
                 for (my $i = 0; $i < @options; ++$i) {
                     ($option, $value) = split "=", $options[$i];
                     $option = trimWS($option);
-                    $value = trimQuoteAndWS($value);
+                    if (defined($value)) {
+                        $value = trimQuoteAndWS($value);
+                    } else {
+                        # We default to 1 as it eases the syntax.
+                        $value = "1";
+                    }
 
                     &$perTagHandler($elementName, $option, $value);
                 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.cpp b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.cpp
new file mode 100644
index 0000000000..11560e35f9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IdentifierRep.h"
+
+#include "PlatformString.h"
+#include <runtime/UString.h>
+#include <wtf/HashMap.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+typedef HashSet<IdentifierRep*> IdentifierSet;
+
+static IdentifierSet& identifierSet()
+{
+    DEFINE_STATIC_LOCAL(IdentifierSet, identifierSet, ());
+    return identifierSet;
+}
+    
+typedef HashMap<int, IdentifierRep*> IntIdentifierMap;
+
+static IntIdentifierMap& intIdentifierMap()
+{
+    DEFINE_STATIC_LOCAL(IntIdentifierMap, intIdentifierMap, ());
+    return intIdentifierMap;
+}
+
+IdentifierRep* IdentifierRep::get(int intID)
+{
+    if (intID == 0 || intID == -1) {
+        static IdentifierRep* negativeOneAndZeroIdentifiers[2];
+
+        IdentifierRep* identifier = negativeOneAndZeroIdentifiers[intID + 1];
+        if (!identifier) {
+            identifier = new IdentifierRep(intID);
+
+            negativeOneAndZeroIdentifiers[intID + 1] = identifier;
+        }
+        
+        return identifier;
+    }
+    
+    pair<IntIdentifierMap::iterator, bool> result = intIdentifierMap().add(intID, 0); 
+    if (result.second) {
+        ASSERT(!result.first->second);
+        result.first->second = new IdentifierRep(intID);
+        
+        identifierSet().add(result.first->second);
+    }
+    
+    return result.first->second;
+}
+
+typedef HashMap<RefPtr<JSC::UString::Rep>, IdentifierRep*> StringIdentifierMap;
+
+static StringIdentifierMap& stringIdentifierMap()
+{
+    DEFINE_STATIC_LOCAL(StringIdentifierMap, stringIdentifierMap, ());
+    return stringIdentifierMap;
+}
+
+IdentifierRep* IdentifierRep::get(const char* name)
+{
+    ASSERT(name);
+    if (!name)
+        return 0;
+  
+    UString string = String::fromUTF8WithLatin1Fallback(name, strlen(name));
+    pair<StringIdentifierMap::iterator, bool> result = stringIdentifierMap().add(string.rep(), 0);
+    if (result.second) {
+        ASSERT(!result.first->second);
+        result.first->second = new IdentifierRep(name);
+        
+        identifierSet().add(result.first->second);
+    }
+    
+    return result.first->second;
+}
+
+bool IdentifierRep::isValid(IdentifierRep* identifier)
+{
+    return identifierSet().contains(identifier);
+}
+    
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
new file mode 100644
index 0000000000..8e0e0d95da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef IdentifierRep_h
+#define IdentifierRep_h
+
+#include <wtf/Assertions.h>
+#include <string.h>
+
+namespace WebCore {
+    
+class IdentifierRep {
+public:
+    static IdentifierRep* get(int);
+    static IdentifierRep* get(const char*);
+
+    static bool isValid(IdentifierRep*);
+    
+    bool isString() const { return m_isString; }
+
+    int number() const { return m_isString ? 0 : m_value.m_number; }
+    const char* string() const { return m_isString ? m_value.m_string : 0; }
+
+private:
+    IdentifierRep(int number) 
+        : m_isString(false)
+    {
+        m_value.m_number = number;
+    }
+    
+    IdentifierRep(const char* name)
+        : m_isString(true)
+    {
+        m_value.m_string = strdup(name);
+    }
+    
+    ~IdentifierRep()
+    {
+        // IdentifierReps should never be deleted.
+        ASSERT_NOT_REACHED();
+    }
+    
+    union {
+        const char* m_string;
+        int m_number;
+    } m_value;
+    bool m_isString;
+};
+
+} // namespace WebCore
+
+#endif // IdentifierRep_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
index 743414adf3..3258c54d60 100644
--- a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
@@ -32,6 +32,8 @@
 #include "PlatformString.h"
 #include "StringSourceProvider.h"
 #include "c_utility.h"
+#include "c_instance.h"
+#include "IdentifierRep.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "runtime_root.h"
@@ -43,12 +45,11 @@
 #include <runtime/Completion.h>
 #include <runtime/Completion.h>
 
-using WebCore::String;
-using WebCore::StringSourceProvider;
 using namespace JSC;
 using namespace JSC::Bindings;
+using namespace WebCore;
 
-static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, ArgList& aList)
+static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, MarkedArgumentBuffer& aList)
 {
     for (unsigned i = 0; i < argCount; ++i)
         aList.append(convertNPVariantToValue(exec, &args[i], rootObject));
@@ -112,18 +113,18 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         JSLock lock(false);
         
         // Call the function object.
-        JSValuePtr function = obj->imp;
+        JSValue function = obj->imp;
         CallData callData;
-        CallType callType = function->getCallData(callData);
+        CallType callType = function.getCallData(callData);
         if (callType == CallTypeNone)
             return false;
         
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
-        JSValuePtr resultV = call(exec, function, callType, callData, function, argList);
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
+        JSValue resultV = call(exec, function, callType, callData, function, argList);
+        globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
         convertValueToNPVariant(exec, resultV, result);
@@ -142,8 +143,8 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
     if (o->_class == NPScriptObjectClass) {
         JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(o); 
 
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(methodName);
-        if (!i->isString)
+        IdentifierRep* i = static_cast<IdentifierRep*>(methodName);
+        if (!i->isString())
             return false;
 
         // Special case the "eval" method.
@@ -161,19 +162,19 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
             return false;
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        JSValuePtr function = obj->imp->get(exec, identifierFromNPIdentifier(i->value.string));
+        JSValue function = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         CallData callData;
-        CallType callType = function->getCallData(callData);
+        CallType callType = function.getCallData(callData);
         if (callType == CallTypeNone)
             return false;
 
         // Call the function object.
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
-        JSValuePtr resultV = call(exec, function, callType, callData, obj->imp, argList);
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
+        JSValue resultV = call(exec, function, callType, callData, obj->imp, argList);
+        globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
         convertValueToNPVariant(exec, resultV, result);
@@ -201,12 +202,12 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         JSLock lock(false);
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
         Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString));
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
-        JSValuePtr result;
+        JSValue result;
         if (type == Normal) {
             result = completion.value();
             if (!result)
@@ -233,14 +234,14 @@ bool _NPN_GetProperty(NPP, NPObject* o, NPIdentifier propertyName, NPVariant* va
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
         
         JSLock lock(false);
-        JSValuePtr result;
-        if (i->isString)
-            result = obj->imp->get(exec, identifierFromNPIdentifier(i->value.string));
+        JSValue result;
+        if (i->isString())
+            result = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         else
-            result = obj->imp->get(exec, i->value.number);
+            result = obj->imp->get(exec, i->number());
 
         convertValueToNPVariant(exec, result, variant);
         exec->clearException();
@@ -268,13 +269,13 @@ bool _NPN_SetProperty(NPP, NPObject* o, NPIdentifier propertyName, const NPVaria
 
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
 
-        if (i->isString) {
+        if (i->isString()) {
             PutPropertySlot slot;
-            obj->imp->put(exec, identifierFromNPIdentifier(i->value.string), convertNPVariantToValue(exec, variant, rootObject), slot);
+            obj->imp->put(exec, identifierFromNPIdentifier(i->string()), convertNPVariantToValue(exec, variant, rootObject), slot);
         } else
-            obj->imp->put(exec, i->value.number, convertNPVariantToValue(exec, variant, rootObject));
+            obj->imp->put(exec, i->number(), convertNPVariantToValue(exec, variant, rootObject));
         exec->clearException();
         return true;
     }
@@ -295,24 +296,24 @@ bool _NPN_RemoveProperty(NPP, NPObject* o, NPIdentifier propertyName)
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
-        if (i->isString) {
-            if (!obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->value.string))) {
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
+        if (i->isString()) {
+            if (!obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->string()))) {
                 exec->clearException();
                 return false;
             }
         } else {
-            if (!obj->imp->hasProperty(exec, i->value.number)) {
+            if (!obj->imp->hasProperty(exec, i->number())) {
                 exec->clearException();
                 return false;
             }
         }
 
         JSLock lock(false);
-        if (i->isString)
-            obj->imp->deleteProperty(exec, identifierFromNPIdentifier(i->value.string));
+        if (i->isString())
+            obj->imp->deleteProperty(exec, identifierFromNPIdentifier(i->string()));
         else
-            obj->imp->deleteProperty(exec, i->value.number);
+            obj->imp->deleteProperty(exec, i->number());
 
         exec->clearException();
         return true;
@@ -330,15 +331,15 @@ bool _NPN_HasProperty(NPP, NPObject* o, NPIdentifier propertyName)
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
         JSLock lock(false);
-        if (i->isString) {
-            bool result = obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->value.string));
+        if (i->isString()) {
+            bool result = obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->string()));
             exec->clearException();
             return result;
         }
 
-        bool result = obj->imp->hasProperty(exec, i->value.number);
+        bool result = obj->imp->hasProperty(exec, i->number());
         exec->clearException();
         return result;
     }
@@ -354,8 +355,8 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
     if (o->_class == NPScriptObjectClass) {
         JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(o); 
 
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(methodName);
-        if (!i->isString)
+        IdentifierRep* i = static_cast<IdentifierRep*>(methodName);
+        if (!i->isString())
             return false;
 
         RootObject* rootObject = obj->rootObject;
@@ -364,9 +365,9 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
 
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        JSValuePtr func = obj->imp->get(exec, identifierFromNPIdentifier(i->value.string));
+        JSValue func = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         exec->clearException();
-        return !func->isUndefined();
+        return !func.isUndefined();
     }
     
     if (o->_class->hasMethod)
@@ -375,11 +376,11 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
     return false;
 }
 
-void _NPN_SetException(NPObject*, const NPUTF8*)
+void _NPN_SetException(NPObject*, const NPUTF8* message)
 {
-    // FIXME:
-    // Bug 19888: Implement _NPN_SetException() correctly
-    // <https://bugs.webkit.org/show_bug.cgi?id=19888>
+    // Ignorning the NPObject param is consistent with the Mozilla implementation.
+    UString exception(message);
+    CInstance::setGlobalException(exception);
 }
 
 bool _NPN_Enumerate(NPP, NPObject* o, NPIdentifier** identifier, uint32_t* count)
@@ -432,18 +433,18 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         JSLock lock(false);
         
         // Call the constructor object.
-        JSValuePtr constructor = obj->imp;
+        JSValue constructor = obj->imp;
         ConstructData constructData;
-        ConstructType constructType = constructor->getConstructData(constructData);
+        ConstructType constructType = constructor.getConstructData(constructData);
         if (constructType == ConstructTypeNone)
             return false;
         
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
-        JSValuePtr resultV = construct(exec, constructor, constructType, constructData, argList);
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
+        JSValue resultV = construct(exec, constructor, constructType, constructData, argList);
+        globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
         convertValueToNPVariant(exec, resultV, result);
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp
index f81fedaeac..7ce9927fbc 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp
@@ -70,11 +70,6 @@ CClass* CClass::classForIsA(NPClass* isa)
     return aClass;
 }
 
-const char* CClass::name() const
-{
-    return "";
-}
-
 MethodList CClass::methodsNamed(const Identifier& identifier, Instance* instance) const
 {
     MethodList methodList;
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
index 9a08605222..7f20af4244 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
@@ -43,7 +43,6 @@ public:
     static CClass* classForIsA(NPClass*);
     virtual ~CClass();
 
-    virtual const char* name() const;    
     virtual MethodList methodsNamed(const Identifier&, Instance*) const;
     virtual Field* fieldNamed(const Identifier&, Instance*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
index 37c3dd836a..71f6c2ff8c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
@@ -32,20 +32,51 @@
 #include "c_class.h"
 #include "c_runtime.h"
 #include "c_utility.h"
+#include "IdentifierRep.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
 #include <runtime/ArgList.h>
+#include <runtime/Error.h>
 #include <interpreter/CallFrame.h>
 #include <runtime/JSLock.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/PropertyNameArray.h>
 #include <wtf/Assertions.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
 
+using namespace WebCore;
+
 namespace JSC {
 namespace Bindings {
 
+using JSC::UString;
+
+static JSC::UString& globalExceptionString()
+{
+    DEFINE_STATIC_LOCAL(JSC::UString, exceptionStr, ());
+    return exceptionStr;
+}
+
+void CInstance::setGlobalException(UString exception)
+{
+    globalExceptionString() = exception;
+}
+
+void CInstance::moveGlobalExceptionToExecState(ExecState* exec)
+{
+    if (globalExceptionString().isNull())
+        return;
+
+    {
+        JSLock lock(false);
+        throwError(exec, GeneralError, globalExceptionString());
+    }
+
+    globalExceptionString() = UString();
+}
+
 CInstance::CInstance(NPObject* o, PassRefPtr<RootObject> rootObject)
     : Instance(rootObject)
 {
@@ -70,7 +101,7 @@ bool CInstance::supportsInvokeDefaultMethod() const
     return _object->_class->invokeDefault;
 }
 
-JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
+JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
 {
     // Overloading methods are not allowed by NPObjects.  Should only be one
     // name match for a particular method.
@@ -78,7 +109,7 @@ JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList
 
     CMethod* method = static_cast<CMethod*>(methodList[0]);
 
-    NPIdentifier ident = _NPN_GetStringIdentifier(method->name());
+    NPIdentifier ident = method->identifier();
     if (!_object->_class->hasMethod(_object, ident))
         return jsUndefined();
 
@@ -87,7 +118,7 @@ JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
     NPVariant resultVariant;
@@ -95,19 +126,21 @@ JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList
 
     {
         JSLock::DropAllLocks dropAllLocks(false);
+        ASSERT(globalExceptionString().isNull());
         _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
+        moveGlobalExceptionToExecState(exec);
     }
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
 
 
-JSValuePtr CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
+JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
 {
     if (!_object->_class->invokeDefault)
         return jsUndefined();
@@ -117,20 +150,22 @@ JSValuePtr CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(false);
+        ASSERT(globalExceptionString().isNull());
         _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
+        moveGlobalExceptionToExecState(exec);
     }
-    
+
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
@@ -140,7 +175,7 @@ bool CInstance::supportsConstruct() const
     return _object->_class->construct;
 }
     
-JSValuePtr CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
+JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
 {
     if (!_object->_class->construct)
         return jsUndefined();
@@ -150,25 +185,27 @@ JSValuePtr CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(false);
+        ASSERT(globalExceptionString().isNull());
         _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
+        moveGlobalExceptionToExecState(exec);
     }
-    
+
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
 
-JSValuePtr CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -177,26 +214,26 @@ JSValuePtr CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint)
     return valueOf(exec);
 }
 
-JSValuePtr CInstance::stringValue(ExecState* exec) const
+JSValue CInstance::stringValue(ExecState* exec) const
 {
     char buf[1024];
     snprintf(buf, sizeof(buf), "NPObject %p, NPClass %p", _object, _object->_class);
     return jsString(exec, buf);
 }
 
-JSValuePtr CInstance::numberValue(ExecState* exec) const
+JSValue CInstance::numberValue(ExecState* exec) const
 {
     // FIXME: Implement something sensible.
     return jsNumber(exec, 0);
 }
 
-JSValuePtr CInstance::booleanValue() const
+JSValue CInstance::booleanValue() const
 {
     // FIXME: Implement something sensible.
     return jsBoolean(false);
 }
 
-JSValuePtr CInstance::valueOf(ExecState* exec) const 
+JSValue CInstance::valueOf(ExecState* exec) const 
 {
     return stringValue(exec);
 }
@@ -211,17 +248,20 @@ void CInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArray)
 
     {
         JSLock::DropAllLocks dropAllLocks(false);
-        if (!_object->_class->enumerate(_object, &identifiers, &count))
+        ASSERT(globalExceptionString().isNull());
+        bool ok = _object->_class->enumerate(_object, &identifiers, &count);
+        moveGlobalExceptionToExecState(exec);
+        if (!ok)
             return;
     }
 
     for (uint32_t i = 0; i < count; i++) {
-        PrivateIdentifier* identifier = static_cast<PrivateIdentifier*>(identifiers[i]);
+        IdentifierRep* identifier = static_cast<IdentifierRep*>(identifiers[i]);
 
-        if (identifier->isString)
-            nameArray.add(identifierFromNPIdentifier(identifier->value.string));
+        if (identifier->isString())
+            nameArray.add(identifierFromNPIdentifier(identifier->string()));
         else
-            nameArray.add(Identifier::from(exec, identifier->value.number));
+            nameArray.add(Identifier::from(exec, identifier->number()));
     }
 
     // FIXME: This should really call NPN_MemFree but that's in WebKit
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
index b16943a8f2..f9e9de3273 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
@@ -36,6 +36,8 @@ typedef struct NPObject NPObject;
 
 namespace JSC {
 
+class UString;
+
 namespace Bindings {
 
 class CClass;
@@ -46,33 +48,35 @@ public:
     {
         return adoptRef(new CInstance(object, rootObject));
     }
+
+    static void setGlobalException(JSC::UString exception);
+
     ~CInstance ();
-    
+
     virtual Class *getClass() const;
 
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
-    
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
+
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
     virtual bool supportsInvokeDefaultMethod() const;
-    virtual JSValuePtr invokeDefaultMethod(ExecState*, const ArgList&);
-    
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&);
+
     virtual bool supportsConstruct() const;
-    virtual JSValuePtr invokeConstruct(ExecState*, const ArgList&);
+    virtual JSValue invokeConstruct(ExecState*, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-    JSValuePtr stringValue(ExecState*) const;
-    JSValuePtr numberValue(ExecState*) const;
-    JSValuePtr booleanValue() const;
-    
-    NPObject *getObject() const { return _object; }
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
 
-    virtual BindingLanguage getBindingLanguage() const { return CLanguage; }
+    NPObject *getObject() const { return _object; }
 
 private:
+    static void moveGlobalExceptionToExecState(ExecState* exec);
     CInstance(NPObject*, PassRefPtr<RootObject>);
-    
+
     mutable CClass *_class;
     NPObject *_object;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
index 0b854f8af1..6beb86c6b8 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
@@ -37,23 +37,7 @@
 namespace JSC {
 namespace Bindings {
 
-// ---------------------- CMethod ----------------------
-
-const char* CMethod::name() const
-{
-    PrivateIdentifier *i = (PrivateIdentifier *)_methodIdentifier;
-    return i->isString ? i->value.string : 0;
-}
-
-// ---------------------- CField ----------------------
-
-const char* CField::name() const
-{
-    PrivateIdentifier *i = (PrivateIdentifier *)_fieldIdentifier;
-    return i->isString ? i->value.string : 0;
-}
-
-JSValuePtr CField::valueFromInstance(ExecState* exec, const Instance* inst) const
+JSValue CField::valueFromInstance(ExecState* exec, const Instance* inst) const
 {
     const CInstance* instance = static_cast<const CInstance*>(inst);
     NPObject* obj = instance->getObject();
@@ -67,7 +51,7 @@ JSValuePtr CField::valueFromInstance(ExecState* exec, const Instance* inst) cons
             result = obj->_class->getProperty(obj, _fieldIdentifier, &property);
         }
         if (result) {
-            JSValuePtr result = convertNPVariantToValue(exec, &property, instance->rootObject());
+            JSValue result = convertNPVariantToValue(exec, &property, instance->rootObject());
             _NPN_ReleaseVariantValue(&property);
             return result;
         }
@@ -75,7 +59,7 @@ JSValuePtr CField::valueFromInstance(ExecState* exec, const Instance* inst) cons
     return jsUndefined();
 }
 
-void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValuePtr aValue) const
+void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValue aValue) const
 {
     const CInstance* instance = static_cast<const CInstance*>(inst);
     NPObject* obj = instance->getObject();
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
index eaac894eb8..e797342b03 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
@@ -38,9 +38,10 @@ class CField : public Field {
 public:
     CField(NPIdentifier ident) : _fieldIdentifier(ident) { }
 
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
-    virtual const char* name() const;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
+
+    NPIdentifier identifier() const { return _fieldIdentifier; }
 
 private:
     NPIdentifier _fieldIdentifier;
@@ -52,7 +53,7 @@ class CMethod : public Method
 public:
     CMethod(NPIdentifier ident) : _methodIdentifier(ident) { }
 
-    virtual const char* name() const;
+    NPIdentifier identifier() const { return _methodIdentifier; }
     virtual int numParameters() const { return 0; }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
index 227c1d9c5e..77b5de20b0 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
@@ -66,24 +66,24 @@ static String convertUTF8ToUTF16WithLatin1Fallback(const NPUTF8* UTF8Chars, int
 }
 
 // Variant value must be released with NPReleaseVariantValue()
-void convertValueToNPVariant(ExecState* exec, JSValuePtr value, NPVariant* result)
+void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)
 {
     JSLock lock(false);
 
     VOID_TO_NPVARIANT(*result);
 
-    if (value->isString()) {
-        UString ustring = value->toString(exec);
+    if (value.isString()) {
+        UString ustring = value.toString(exec);
         CString cstring = ustring.UTF8String();
         NPString string = { (const NPUTF8*)cstring.c_str(), static_cast<uint32_t>(cstring.size()) };
         NPN_InitializeVariantWithStringCopy(result, &string);
-    } else if (value->isNumber()) {
-        DOUBLE_TO_NPVARIANT(value->toNumber(exec), *result);
-    } else if (value->isBoolean()) {
-        BOOLEAN_TO_NPVARIANT(value->toBoolean(exec), *result);
-    } else if (value->isNull()) {
+    } else if (value.isNumber()) {
+        DOUBLE_TO_NPVARIANT(value.toNumber(exec), *result);
+    } else if (value.isBoolean()) {
+        BOOLEAN_TO_NPVARIANT(value.toBoolean(exec), *result);
+    } else if (value.isNull()) {
         NULL_TO_NPVARIANT(*result);
-    } else if (value->isObject()) {
+    } else if (value.isObject()) {
         JSObject* object = asObject(value);
         if (object->classInfo() == &RuntimeObjectImp::s_info) {
             RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(object);
@@ -105,7 +105,7 @@ void convertValueToNPVariant(ExecState* exec, JSValuePtr value, NPVariant* resul
     }
 }
 
-JSValuePtr convertNPVariantToValue(ExecState* exec, const NPVariant* variant, RootObject* rootObject)
+JSValue convertNPVariantToValue(ExecState* exec, const NPVariant* variant, RootObject* rootObject)
 {
     JSLock lock(false);
     
@@ -131,7 +131,7 @@ JSValuePtr convertNPVariantToValue(ExecState* exec, const NPVariant* variant, Ro
             return ((JavaScriptObject*)obj)->imp;
 
         // Wrap NPObject in a CInstance.
-        return Instance::createRuntimeObject(exec, CInstance::create(obj, rootObject));
+        return CInstance::create(obj, rootObject)->createRuntimeObject(exec);
     }
     
     return jsUndefined();
@@ -139,7 +139,7 @@ JSValuePtr convertNPVariantToValue(ExecState* exec, const NPVariant* variant, Ro
 
 String convertNPStringToUTF16(const NPString* string)
 {
-    return convertUTF8ToUTF16WithLatin1Fallback(string->UTF8Characters, string->UTF8Length);
+    return String::fromUTF8WithLatin1Fallback(string->UTF8Characters, string->UTF8Length);
 }
 
 Identifier identifierFromNPIdentifier(const NPUTF8* name)
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h
index 2efc66cb86..f69bba6916 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h
@@ -46,29 +46,11 @@ class RootObject;
     
 typedef uint16_t NPUTF16;
 
-enum NP_ValueType {
-    NP_NumberValueType,
-    NP_StringValueType,
-    NP_BooleanValueType,
-    NP_NullValueType,
-    NP_UndefinedValueType,
-    NP_ObjectValueType,
-    NP_InvalidValueType
-};
-
 WebCore::String convertNPStringToUTF16(const NPString *string);
-void convertValueToNPVariant(ExecState*, JSValuePtr, NPVariant* result);
-JSValuePtr convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
+void convertValueToNPVariant(ExecState*, JSValue, NPVariant* result);
+JSValue convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
 Identifier identifierFromNPIdentifier(const NPUTF8* name);
 
-struct PrivateIdentifier {
-    union {
-        const NPUTF8* string;
-        int32_t number;
-    } value;
-    bool isString;
-};
-
 } }
 
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
index 069089c740..87750aa2af 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
@@ -53,17 +53,15 @@ JavaClass::JavaClass(jobject anInstance)
     int i;
     JNIEnv *env = getJNIEnv();
 
-    JSGlobalData* globalData = WebCore::JSDOMWindow::commonJSGlobalData();
-    
     // Get the fields
     jarray fields = (jarray)callJNIMethod<jobject>(aClass, "getFields", "()[Ljava/lang/reflect/Field;");
     int numFields = env->GetArrayLength(fields);    
     for (i = 0; i < numFields; i++) {
         jobject aJField = env->GetObjectArrayElement((jobjectArray)fields, i);
-        Field *aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
+        JavaField *aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
         {
             JSLock lock(false);
-            _fields.set(Identifier(globalData, UString(aField->name())).ustring().rep(), aField);
+            _fields.set(aField->name(), aField);
         }
         env->DeleteLocalRef(aJField);
     }
@@ -73,15 +71,15 @@ JavaClass::JavaClass(jobject anInstance)
     int numMethods = env->GetArrayLength(methods);
     for (i = 0; i < numMethods; i++) {
         jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
-        Method *aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+        JavaMethod *aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
         MethodList* methodList;
         {
             JSLock lock(false);
 
-            methodList = _methods.get(Identifier(globalData, UString(aMethod->name())).ustring().rep());
+            methodList = _methods.get(aMethod->name());
             if (!methodList) {
                 methodList = new MethodList();
-                _methods.set(Identifier(globalData, UString(aMethod->name())).ustring().rep(), methodList);
+                _methods.set(aMethod->name(), methodList);
             }
         }
         methodList->append(aMethod);
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
index 75cfd89fd0..890b4d3cec 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
@@ -40,8 +40,6 @@ public:
     JavaClass (jobject anInstance);
     ~JavaClass ();
 
-    virtual const char *name() const { return _name; };
-    
     virtual MethodList methodsNamed(const Identifier&, Instance* instance) const;    
     virtual Field *fieldNamed(const Identifier&, Instance* instance) const;
     
@@ -50,8 +48,6 @@ public:
     bool isStringClass() const;
     
 private:
-    JavaClass ();                                 // prevent default construction
-    
     const char *_name;
     FieldMap _fields;
     MethodListMap _methods;
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
index 6508cb3b88..88d79efcb6 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
@@ -80,7 +80,7 @@ Class *JavaInstance::getClass() const
     return _class;
 }
 
-JSValuePtr JavaInstance::stringValue(ExecState* exec) const
+JSValue JavaInstance::stringValue(ExecState* exec) const
 {
     JSLock lock(false);
     
@@ -92,23 +92,23 @@ JSValuePtr JavaInstance::stringValue(ExecState* exec) const
     return jsString(exec, u);
 }
 
-JSValuePtr JavaInstance::numberValue(ExecState* exec) const
+JSValue JavaInstance::numberValue(ExecState* exec) const
 {
     jdouble doubleValue = callJNIMethod<jdouble>(_instance->_instance, "doubleValue", "()D");
     return jsNumber(exec, doubleValue);
 }
 
-JSValuePtr JavaInstance::booleanValue() const
+JSValue JavaInstance::booleanValue() const
 {
     jboolean booleanValue = callJNIMethod<jboolean>(_instance->_instance, "booleanValue", "()Z");
     return jsBoolean(booleanValue);
 }
 
-JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
+JSValue JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
 {
     int i, count = args.size();
     jvalue *jArgs;
-    JSValuePtr resultValue;
+    JSValue resultValue;
     Method *method = 0;
     size_t numMethods = methodList.size();
     
@@ -131,7 +131,7 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
     }
     
     const JavaMethod *jMethod = static_cast<const JavaMethod*>(method);
-    JS_LOG ("call %s %s on %p\n", method->name(), jMethod->signature(), _instance->_instance);
+    JS_LOG ("call %s %s on %p\n", UString(jMethod->name()).UTF8String().c_str(), jMethod->signature(), _instance->_instance);
     
     if (count > 0) {
         jArgs = (jvalue *)malloc (count * sizeof(jvalue));
@@ -141,8 +141,8 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
         
     for (i = 0; i < count; i++) {
         JavaParameter* aParameter = jMethod->parameterAt(i);
-        jArgs[i] = convertValueToJValue(exec, args.at(exec, i), aParameter->getJNIType(), aParameter->type());
-        JS_LOG("arg[%d] = %s\n", i, args.at(exec, i)->toString(exec).ascii());
+        jArgs[i] = convertValueToJValue(exec, args.at(i), aParameter->getJNIType(), aParameter->type());
+        JS_LOG("arg[%d] = %s\n", i, args.at(i).toString(exec).ascii());
     }
         
     jvalue result;
@@ -157,11 +157,11 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
     bool handled = false;
     if (rootObject->nativeHandle()) {
         jobject obj = _instance->_instance;
-        JSValuePtr exceptionDescription = noValue();
+        JSValue exceptionDescription;
         const char *callingURL = 0;  // FIXME, need to propagate calling URL to Java
         handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs, result, callingURL, exceptionDescription);
         if (exceptionDescription) {
-            throwError(exec, GeneralError, exceptionDescription->toString(exec));
+            throwError(exec, GeneralError, exceptionDescription.toString(exec));
             free (jArgs);
             return jsUndefined();
         }
@@ -222,7 +222,7 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
                     resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
                 }
                 else {
-                    resultValue = Instance::createRuntimeObject(exec, JavaInstance::create(result.l, rootObject));
+                    resultValue = JavaInstance::create(result.l, rootObject)->createRuntimeObject(exec);
                 }
             }
             else {
@@ -283,7 +283,7 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
     return resultValue;
 }
 
-JSValuePtr JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -299,7 +299,7 @@ JSValuePtr JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hi
     return valueOf(exec);
 }
 
-JSValuePtr JavaInstance::valueOf(ExecState* exec) const 
+JSValue JavaInstance::valueOf(ExecState* exec) const 
 {
     return stringValue(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
index 4e166f71fc..0dcab3e4b3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
@@ -77,18 +77,16 @@ public:
     
     virtual Class *getClass() const;
     
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValuePtr invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
+    virtual JSValue invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
 
     jobject javaInstance() const { return _instance->_instance; }
     
-    JSValuePtr stringValue(ExecState*) const;
-    JSValuePtr numberValue(ExecState*) const;
-    JSValuePtr booleanValue() const;
-
-    virtual BindingLanguage getBindingLanguage() const { return JavaLanguage; }
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
 
 protected:
     virtual void virtualBegin();
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h
index 4125565422..b4f5719302 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h
@@ -42,6 +42,7 @@ namespace JSC {
 class ArgList;
 class ExecState;
 class JSObject;
+class MarkedArgumentBuffer;
 
 namespace Bindings {
 
@@ -90,9 +91,9 @@ public:
     
     static jvalue invoke(JSObjectCallContext*);
 
-    jobject convertValueToJObject(JSValuePtr) const;
-    JSValuePtr convertJObjectToValue(ExecState*, jobject) const;
-    void getListFromJArray(ExecState*, jobjectArray, ArgList&) const;
+    jobject convertValueToJObject(JSValue) const;
+    JSValue convertJObjectToValue(ExecState*, jobject) const;
+    void getListFromJArray(ExecState*, jobjectArray, MarkedArgumentBuffer&) const;
     
     RootObject* rootObject() const;
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
index 271acf11e7..32d7b0d253 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
@@ -293,18 +293,18 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     JSLock lock(false);
     
     Identifier identifier(exec, JavaString(methodName));
-    JSValuePtr function = _imp->get(exec, identifier);
+    JSValue function = _imp->get(exec, identifier);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return 0;
 
     // Call the function object.
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
-    rootObject->globalObject()->startTimeoutCheck();
-    JSValuePtr result = JSC::call(exec, function, callType, callData, _imp, argList);
-    rootObject->globalObject()->stopTimeoutCheck();
+    rootObject->globalObject()->globalData()->timeoutChecker.start();
+    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
+    rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
 }
@@ -313,7 +313,7 @@ jobject JavaJSObject::eval(jstring script) const
 {
     JS_LOG ("script = %s\n", JavaString(script).UTF8String());
     
-    JSValuePtr result;
+    JSValue result;
 
     JSLock lock(false);
     
@@ -321,9 +321,9 @@ jobject JavaJSObject::eval(jstring script) const
     if (!rootObject)
         return 0;
 
-    rootObject->globalObject()->startTimeoutCheck();
+    rootObject->globalObject()->globalData()->timeoutChecker.start();
     Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)));
-    rootObject->globalObject()->stopTimeoutCheck();
+    rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
     if (type == Normal) {
@@ -347,7 +347,7 @@ jobject JavaJSObject::getMember(jstring memberName) const
     ExecState* exec = rootObject->globalObject()->globalExec();
     
     JSLock lock(false);
-    JSValuePtr result = _imp->get(exec, Identifier(exec, JavaString(memberName)));
+    JSValue result = _imp->get(exec, Identifier(exec, JavaString(memberName)));
 
     return convertValueToJObject(result);
 }
@@ -397,7 +397,7 @@ jobject JavaJSObject::getSlot(jint index) const
     ExecState* exec = rootObject->globalObject()->globalExec();
 
     JSLock lock(false);
-    JSValuePtr result = _imp->get(exec, index);
+    JSValue result = _imp->get(exec, index);
 
     return convertValueToJObject(result);
 }
@@ -485,7 +485,7 @@ jlong JavaJSObject::createNative(jlong nativeHandle)
     return nativeHandle;
 }
 
-jobject JavaJSObject::convertValueToJObject(JSValuePtr value) const
+jobject JavaJSObject::convertValueToJObject(JSValue value) const
 {
     JSLock lock(false);
     
@@ -505,28 +505,28 @@ jobject JavaJSObject::convertValueToJObject(JSValuePtr value) const
     // Java instance -> Java instance
     // Everything else -> JavaJSObject
     
-    if (value->isNumber()) {
+    if (value.isNumber()) {
         jclass JSObjectClass = env->FindClass ("java/lang/Double");
         jmethodID constructorID = env->GetMethodID (JSObjectClass, "<init>", "(D)V");
         if (constructorID != NULL) {
-            result = env->NewObject (JSObjectClass, constructorID, (jdouble)value->toNumber(exec));
+            result = env->NewObject (JSObjectClass, constructorID, (jdouble)value.toNumber(exec));
         }
-    } else if (value->isString()) {
-        UString stringValue = value->toString(exec);
+    } else if (value.isString()) {
+        UString stringValue = value.toString(exec);
         JNIEnv *env = getJNIEnv();
         result = env->NewString ((const jchar *)stringValue.data(), stringValue.size());
-    } else if (value->isBoolean()) {
+    } else if (value.isBoolean()) {
         jclass JSObjectClass = env->FindClass ("java/lang/Boolean");
         jmethodID constructorID = env->GetMethodID (JSObjectClass, "<init>", "(Z)V");
         if (constructorID != NULL) {
-            result = env->NewObject (JSObjectClass, constructorID, (jboolean)value->toBoolean(exec));
+            result = env->NewObject (JSObjectClass, constructorID, (jboolean)value.toBoolean(exec));
         }
     }
     else {
         // Create a JavaJSObject.
         jlong nativeHandle;
         
-        if (value->isObject()) {
+        if (value.isObject()) {
             JSObject* imp = asObject(value);
             
             // We either have a wrapper around a Java instance or a JavaScript
@@ -571,7 +571,7 @@ jobject JavaJSObject::convertValueToJObject(JSValuePtr value) const
     return result;
 }
 
-JSValuePtr JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject) const
+JSValue JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject) const
 {
     // Instances of netscape.javascript.JSObject get converted back to
     // JavaScript objects.  All other objects are wrapped.  It's not
@@ -602,10 +602,10 @@ JSValuePtr JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObjec
 
     JSLock lock(false);
 
-    return JSC::Bindings::Instance::createRuntimeObject(exec, JavaInstance::create(theObject, _rootObject));
+    return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
 }
 
-void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, ArgList& list) const
+void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, MarkedArgumentBuffer& list) const
 {
     JNIEnv *env = getJNIEnv();
     int numObjects = jArray ? env->GetArrayLength(jArray) : 0;
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
index 232d9e962f..7c194423d5 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
@@ -45,7 +45,7 @@ using namespace JSC::Bindings;
        exceptionDescription:(NSString **)exceptionString;
 @end
 
-bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValuePtr& exceptionDescription)
+bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValue& exceptionDescription)
 {
     id view = (id)targetAppletView;
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
index a67d0ec7cf..3cbe8cfdb1 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
@@ -70,7 +70,7 @@ JavaField::JavaField (JNIEnv *env, jobject aField)
     _field = new JObjectWrapper(aField);
 }
 
-JSValuePtr JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
+JSValue JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
 {
     if (type[0] != '[')
         return jsUndefined();
@@ -93,24 +93,24 @@ jvalue JavaField::dispatchValueFromInstance(ExecState *exec, const JavaInstance
         {
             RootObject* rootObject = instance->rootObject();
             if (rootObject && rootObject->nativeHandle()) {
-                JSValuePtr exceptionDescription = noValue();
+                JSValue exceptionDescription;
                 jvalue args[1];
                 
                 args[0].l = jinstance;
                 dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, returnType, mid, args, result, 0, exceptionDescription);
                 if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription->toString(exec));
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
             }
         }
     }
     return result;
 }
 
-JSValuePtr JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
+JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
 {
     const JavaInstance *instance = static_cast<const JavaInstance *>(i);
 
-    JSValuePtr jsresult = jsUndefined();
+    JSValue jsresult = jsUndefined();
     
     switch (_JNIType) {
         case array_type:
@@ -123,7 +123,7 @@ JSValuePtr JavaField::valueFromInstance(ExecState* exec, const Instance* i) cons
                 jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
             }
             else if (anObject != 0){
-                jsresult = Instance::createRuntimeObject(exec, JavaInstance::create(anObject, instance->rootObject()));
+                jsresult = JavaInstance::create(anObject, instance->rootObject())->createRuntimeObject(exec);
             }
         }
         break;
@@ -157,7 +157,7 @@ JSValuePtr JavaField::valueFromInstance(ExecState* exec, const Instance* i) cons
         break;
     }
 
-    JS_LOG ("getting %s = %s\n", name(), jsresult->toString(exec).ascii());
+    JS_LOG ("getting %s = %s\n", UString(name()).UTF8String().c_str(), jsresult.toString(exec).ascii());
     
     return jsresult;
 }
@@ -175,7 +175,7 @@ void JavaField::dispatchSetValueToInstance(ExecState *exec, const JavaInstance *
         {
             RootObject* rootObject = instance->rootObject();
             if (rootObject && rootObject->nativeHandle()) {
-                JSValuePtr exceptionDescription = noValue();
+                JSValue exceptionDescription;
                 jvalue args[2];
                 jvalue result;
                 
@@ -183,18 +183,18 @@ void JavaField::dispatchSetValueToInstance(ExecState *exec, const JavaInstance *
                 args[1] = javaValue;
                 dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
                 if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription->toString(exec));
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
             }
         }
     }
 }
 
-void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValuePtr aValue) const
+void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
 {
     const JavaInstance *instance = static_cast<const JavaInstance *>(i);
     jvalue javaValue = convertValueToJValue (exec, aValue, _JNIType, type());
 
-    JS_LOG ("setting value %s to %s\n", name(), aValue->toString(exec).ascii());
+    JS_LOG ("setting value %s to %s\n", UString(name()).UTF8String().c_str(), aValue.toString(exec).ascii());
 
     switch (_JNIType) {
         case array_type:
@@ -359,7 +359,7 @@ JNIType JavaMethod::JNIReturnType() const
 jmethodID JavaMethod::methodID (jobject obj) const
 {
     if (_methodID == 0) {
-        _methodID = getMethodID (obj, name(), signature());
+        _methodID = getMethodID (obj, _name.UTF8String(), signature());
     }
     return _methodID;
 }
@@ -386,7 +386,7 @@ RootObject* JavaArray::rootObject() const
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
 }
 
-void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) const
+void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
 {
     JNIEnv *env = getJNIEnv();
     char *javaClassName = 0;
@@ -454,7 +454,7 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) c
 }
 
 
-JSValuePtr JavaArray::valueAt(ExecState* exec, unsigned index) const
+JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
 {
     JNIEnv *env = getJNIEnv();
     JNIType arrayType = JNITypeFromPrimitiveType(_type[1]);
@@ -474,7 +474,7 @@ JSValuePtr JavaArray::valueAt(ExecState* exec, unsigned index) const
                 return JavaArray::convertJObjectToArray(exec, anObject, _type+1, rootObject());
             }
             // or array of other object type?
-            return Instance::createRuntimeObject(exec, JavaInstance::create(anObject, rootObject()));
+            return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
         }
             
         case boolean_type: {
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
index ac771b4813..f3cbf2bce4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
@@ -56,7 +56,7 @@ public:
         const jchar *uc = getUCharactersFromJStringInEnv (e, s);
         {
             JSLock lock(false);
-            _rep = UString((UChar *)uc,_size).rep();
+            _rep = UString(reinterpret_cast<const UChar*>(uc), _size).rep();
         }
         releaseUCharactersForJStringInEnv (e, s, uc);
     }
@@ -112,10 +112,10 @@ class JavaField : public Field
 public:
     JavaField (JNIEnv *env, jobject aField);
 
-    virtual JSValuePtr valueFromInstance(ExecState *exec, const Instance *instance) const;
-    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValuePtr aValue) const;
+    virtual JSValue valueFromInstance(ExecState *exec, const Instance *instance) const;
+    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValue aValue) const;
     
-    virtual const char *name() const { return _name.UTF8String(); }
+    UString::Rep* name() const { return ((UString)_name).rep(); }
     virtual RuntimeType type() const { return _type.UTF8String(); }
 
     JNIType getJNIType() const { return _JNIType; }
@@ -137,7 +137,7 @@ public:
     JavaMethod(JNIEnv* env, jobject aMethod);
     ~JavaMethod();
 
-    virtual const char *name() const { return _name.UTF8String(); };
+    UString::Rep* name() const { return ((UString)_name).rep(); }
     RuntimeType returnType() const { return _returnType.UTF8String(); };
     JavaParameter* parameterAt(int i) const { return &_parameters[i]; };
     int numParameters() const { return _numParameters; };
@@ -168,13 +168,13 @@ public:
 
     RootObject* rootObject() const;
 
-    virtual void setValueAt(ExecState *exec, unsigned int index, JSValuePtr aValue) const;
-    virtual JSValuePtr valueAt(ExecState *exec, unsigned int index) const;
+    virtual void setValueAt(ExecState *exec, unsigned int index, JSValue aValue) const;
+    virtual JSValue valueAt(ExecState *exec, unsigned int index) const;
     virtual unsigned int getLength() const;
     
     jobject javaArray() const { return _array->_instance; }
 
-    static JSValuePtr convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
+    static JSValue convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
 
 private:
     RefPtr<JObjectWrapper> _array;
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
index 14dd8ea355..f8a27893a3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
@@ -365,8 +365,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
                 env->FindClass("java/lang/String"),
                 env->NewStringUTF(""));
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                UString stringValue = item->toString(exec);
+                JSValue item = jsArray->get(exec, i);
+                UString stringValue = item.toString(exec);
                 env->SetObjectArrayElement(jarray,i,
                     env->functions->NewString(env, (const jchar *)stringValue.data(), stringValue.size()));
                 }
@@ -377,8 +377,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case boolean_type: {
             jarray = (jobjectArray)env->NewBooleanArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jboolean value = (jboolean)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jboolean value = (jboolean)item.toNumber(exec);
                 env->SetBooleanArrayRegion((jbooleanArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -387,8 +387,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case byte_type: {
             jarray = (jobjectArray)env->NewByteArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jbyte value = (jbyte)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jbyte value = (jbyte)item.toNumber(exec);
                 env->SetByteArrayRegion((jbyteArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -397,8 +397,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case char_type: {
             jarray = (jobjectArray)env->NewCharArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                UString stringValue = item->toString(exec);
+                JSValue item = jsArray->get(exec, i);
+                UString stringValue = item.toString(exec);
                 jchar value = 0;
                 if (stringValue.size() > 0)
                     value = ((const jchar*)stringValue.data())[0];
@@ -410,8 +410,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case short_type: {
             jarray = (jobjectArray)env->NewShortArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jshort value = (jshort)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jshort value = (jshort)item.toNumber(exec);
                 env->SetShortArrayRegion((jshortArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -420,8 +420,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case int_type: {
             jarray = (jobjectArray)env->NewIntArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jint value = (jint)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jint value = (jint)item.toNumber(exec);
                 env->SetIntArrayRegion((jintArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -430,8 +430,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case long_type: {
             jarray = (jobjectArray)env->NewLongArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jlong value = (jlong)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jlong value = (jlong)item.toNumber(exec);
                 env->SetLongArrayRegion((jlongArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -440,8 +440,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case float_type: {
             jarray = (jobjectArray)env->NewFloatArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jfloat value = (jfloat)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jfloat value = (jfloat)item.toNumber(exec);
                 env->SetFloatArrayRegion((jfloatArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -450,8 +450,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case double_type: {
             jarray = (jobjectArray)env->NewDoubleArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jdouble value = (jdouble)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jdouble value = (jdouble)item.toNumber(exec);
                 env->SetDoubleArrayRegion((jdoubleArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -468,7 +468,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
 }
 
 
-jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType, const char* javaClassName)
+jvalue convertValueToJValue(ExecState* exec, JSValue value, JNIType _JNIType, const char* javaClassName)
 {
     JSLock lock(false);
     
@@ -480,7 +480,7 @@ jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType,
             result.l = (jobject)0;
             
             // First see if we have a Java instance.
-            if (value->isObject()){
+            if (value.isObject()){
                 JSObject* objectImp = asObject(value);
                 if (objectImp->classInfo() == &RuntimeObjectImp::s_info) {
                     RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(objectImp);
@@ -512,10 +512,10 @@ jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType,
                 }
                 else 
 #else
-                if (!value->isNull())
+                if (!value.isNull())
 #endif
                 {
-                    UString stringValue = value->toString(exec);
+                    UString stringValue = value.toString(exec);
                     JNIEnv *env = getJNIEnv();
                     jobject javaString = env->functions->NewString (env, (const jchar *)stringValue.data(), stringValue.size());
                     result.l = javaString;
@@ -526,42 +526,42 @@ jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType,
         break;
         
         case boolean_type: {
-            result.z = (jboolean)value->toNumber(exec);
+            result.z = (jboolean)value.toNumber(exec);
         }
         break;
             
         case byte_type: {
-            result.b = (jbyte)value->toNumber(exec);
+            result.b = (jbyte)value.toNumber(exec);
         }
         break;
         
         case char_type: {
-            result.c = (jchar)value->toNumber(exec);
+            result.c = (jchar)value.toNumber(exec);
         }
         break;
 
         case short_type: {
-            result.s = (jshort)value->toNumber(exec);
+            result.s = (jshort)value.toNumber(exec);
         }
         break;
 
         case int_type: {
-            result.i = (jint)value->toNumber(exec);
+            result.i = (jint)value.toNumber(exec);
         }
         break;
 
         case long_type: {
-            result.j = (jlong)value->toNumber(exec);
+            result.j = (jlong)value.toNumber(exec);
         }
         break;
 
         case float_type: {
-            result.f = (jfloat)value->toNumber(exec);
+            result.f = (jfloat)value.toNumber(exec);
         }
         break;
 
         case double_type: {
-            result.d = (jdouble)value->toNumber(exec);
+            result.d = (jdouble)value.toNumber(exec);
         }
         break;
             
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
index a08cc5dd54..c315b1f80e 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
@@ -72,7 +72,7 @@ JNIType JNITypeFromClassName(const char *name);
 JNIType JNITypeFromPrimitiveType(char type);
 const char *signatureFromPrimitiveType(JNIType type);
 
-jvalue convertValueToJValue(ExecState*, JSValuePtr, JNIType, const char* javaClassName);
+jvalue convertValueToJValue(ExecState*, JSValue, JNIType, const char* javaClassName);
 
 jvalue getJNIField(jobject obj, JNIType type, const char *name, const char *signature);
 
@@ -277,7 +277,7 @@ T callJNIStaticMethod(jclass cls, const char* methodName, const char* methodSign
     return result;
 }
     
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValuePtr& exceptionDescription);
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
 
 } // namespace Bindings
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/npapi.h b/src/3rdparty/webkit/WebCore/bridge/npapi.h
index 33535f7562..1904a87094 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npapi.h
+++ b/src/3rdparty/webkit/WebCore/bridge/npapi.h
@@ -108,9 +108,7 @@
 /*----------------------------------------------------------------------*/
 
 #define NP_VERSION_MAJOR 0
-#define NP_VERSION_MINOR 20
-
-
+#define NP_VERSION_MINOR 24
 
 /*----------------------------------------------------------------------*/
 /*             Definition of Basic Types                                */
@@ -343,13 +341,16 @@ typedef enum {
      */
     NPPVpluginWantsAllNetworkStreams = 18,
 
+    NPPVpluginPrivateModeBool = 19,
+    
+    /* Checks to see if the plug-in would like the browser to load the "src" attribute. */
+    NPPVpluginCancelSrcStream = 20,
+
 #ifdef XP_MACOSX
     /* Used for negotiating drawing models */
     NPPVpluginDrawingModel = 1000,
     /* Used for negotiating event models */
     NPPVpluginEventModel = 1001,
-    /* The plug-in text input vtable */
-    NPPVpluginTextInputFuncs = 1002,
     /* In the NPDrawingModelCoreAnimation drawing model, the browser asks the plug-in for a Core Animation layer. */
     NPPVpluginCoreAnimationLayer = 1003
 #endif
@@ -379,7 +380,9 @@ typedef enum {
     /* Get the NPObject wrapper for the plugins DOM element. */
     NPNVPluginElementNPObject = 16,
 
-    NPNVSupportsWindowless = 17
+    NPNVSupportsWindowless = 17,
+    
+    NPNVprivateModeBool = 18
 
 #ifdef XP_MACOSX
     , NPNVpluginDrawingModel = 1000 /* The NPDrawingModel specified by the plugin */
@@ -396,10 +399,14 @@ typedef enum {
 #endif
     , NPNVsupportsCocoaBool = 3001 /* TRUE if the browser supports the Cocoa event model */
     
-    , NPNVbrowserTextInputFuncs = 1002 /* The browser text input vtable */
 #endif /* XP_MACOSX */
 } NPNVariable;
 
+typedef enum {
+   NPNURLVCookie = 501,
+   NPNURLVProxy
+} NPNURLVariable;
+
 /*
  * The type of a NPWindow - it specifies the type of the data structure
  * returned in the window field.
@@ -449,6 +456,7 @@ typedef enum {
     NPCocoaEventFocusChanged,
     NPCocoaEventWindowFocusChanged,
     NPCocoaEventScrollWheel,
+    NPCocoaEventTextInput
 } NPCocoaEventType;
 
 typedef struct _NPNSString NPNSString;
@@ -478,6 +486,8 @@ typedef struct _NPCocoaEvent {
             uint16 keyCode;
         } key;
         struct {
+            CGContextRef context;
+
             double x;
             double y;
             double width;
@@ -485,7 +495,10 @@ typedef struct _NPCocoaEvent {
         } draw;
         struct {
             NPBool hasFocus;
-        } focus;        
+        } focus;
+        struct {
+            NPNSString *text;
+        } text;
     } data;
 } NPCocoaEvent;
 
@@ -538,6 +551,14 @@ typedef NPNSMenu NPMenu;
 typedef void * NPMenu;
 #endif
 
+typedef enum {
+    NPCoordinateSpacePlugin = 1,
+    NPCoordinateSpaceWindow,
+    NPCoordinateSpaceFlippedWindow,
+    NPCoordinateSpaceScreen,
+    NPCoordinateSpaceFlippedScreen
+} NPCoordinateSpace;
+
 #if defined(XP_MAC) || defined(XP_MACOSX)
 
 #ifndef NP_NO_CARBON
@@ -726,7 +747,11 @@ typedef struct NP_Port
 #define NPVERS_HAS_RESPONSE_HEADERS       17
 #define NPVERS_HAS_NPOBJECT_ENUM          18
 #define NPVERS_HAS_PLUGIN_THREAD_ASYNC_CALL 19
-#define NPVERS_MACOSX_HAS_EVENT_MODELS    20
+#define NPVERS_HAS_ALL_NETWORK_STREAMS    20
+#define NPVERS_HAS_URL_AND_AUTH_INFO      21
+#define NPVERS_HAS_PRIVATE_MODE           22
+#define NPVERS_MACOSX_HAS_EVENT_MODELS    23
+#define NPVERS_HAS_CANCEL_SRC_STREAM      24
 
 /*----------------------------------------------------------------------*/
 /*             Function Prototypes                */
@@ -819,10 +844,14 @@ void        NPN_ForceRedraw(NPP instance);
 void        NPN_PushPopupsEnabledState(NPP instance, NPBool enabled);
 void        NPN_PopPopupsEnabledState(NPP instance);
 void        NPN_PluginThreadAsyncCall(NPP instance, void (*func) (void *), void *userData);
+NPError     NPN_GetValueForURL(NPP instance, NPNURLVariable variable, const char* url, char** value, uint32* len);
+NPError     NPN_SetValueForURL(NPP instance, NPNURLVariable variable, const char* url, const char* value, uint32 len);
+NPError     NPN_GetAuthenticationInfo(NPP instance, const char* protocol, const char* host, int32 port, const char* scheme, const char *realm, char** username, uint32* ulen, char** password, uint32* plen);
 uint32      NPN_ScheduleTimer(NPP instance, uint32 interval, NPBool repeat, void (*timerFunc)(NPP npp, uint32 timerID));
 void        NPN_UnscheduleTimer(NPP instance, uint32 timerID);
 NPError     NPN_PopUpContextMenu(NPP instance, NPMenu* menu);
-
+NPBool      NPN_ConvertPoint(NPP instance, double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
+    
 #ifdef __cplusplus
 }  /* end extern "C" */
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp b/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp
index 789114eb6d..ab670762ae 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp
@@ -27,6 +27,7 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
+#include "IdentifierRep.h"
 #include "npruntime_internal.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
@@ -38,50 +39,11 @@
 #include <wtf/HashMap.h>
 
 using namespace JSC::Bindings;
-
-typedef HashMap<RefPtr<JSC::UString::Rep>, PrivateIdentifier*> StringIdentifierMap;
-
-static StringIdentifierMap* getStringIdentifierMap()
-{
-    static StringIdentifierMap* stringIdentifierMap = 0;
-    if (!stringIdentifierMap)
-        stringIdentifierMap = new StringIdentifierMap;
-    return stringIdentifierMap;
-}
-
-typedef HashMap<int, PrivateIdentifier*> IntIdentifierMap;
-
-static IntIdentifierMap* getIntIdentifierMap()
-{
-    static IntIdentifierMap* intIdentifierMap = 0;
-    if (!intIdentifierMap)
-        intIdentifierMap = new IntIdentifierMap;
-    return intIdentifierMap;
-}
+using namespace WebCore;
 
 NPIdentifier _NPN_GetStringIdentifier(const NPUTF8* name)
 {
-    ASSERT(name);
-    
-    if (name) {
-        PrivateIdentifier* identifier = 0;
-        
-        JSC::JSLock lock(false);
-        
-        identifier = getStringIdentifierMap()->get(identifierFromNPIdentifier(name).ustring().rep());
-        if (identifier == 0) {
-            identifier = (PrivateIdentifier*)malloc(sizeof(PrivateIdentifier));
-            // We never release identifier names, so this dictionary will grow, as will
-            // the memory for the identifier name strings.
-            identifier->isString = true;
-            identifier->value.string = strdup(name);
-
-            getStringIdentifierMap()->set(identifierFromNPIdentifier(name).ustring().rep(), identifier);
-        }
-        return (NPIdentifier)identifier;
-    }
-    
-    return 0;
+    return static_cast<NPIdentifier>(IdentifierRep::get(name));
 }
 
 void _NPN_GetStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdentifier* identifiers)
@@ -89,61 +51,34 @@ void _NPN_GetStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdenti
     ASSERT(names);
     ASSERT(identifiers);
     
-    if (names && identifiers)
+    if (names && identifiers) {
         for (int i = 0; i < nameCount; i++)
             identifiers[i] = _NPN_GetStringIdentifier(names[i]);
+    }
 }
 
 NPIdentifier _NPN_GetIntIdentifier(int32_t intid)
 {
-    PrivateIdentifier* identifier;
-
-    if (intid == 0 || intid == -1) {
-        static PrivateIdentifier* negativeOneAndZeroIdentifiers[2];
-
-        identifier = negativeOneAndZeroIdentifiers[intid + 1];
-        if (!identifier) {
-            identifier = (PrivateIdentifier*)malloc(sizeof(PrivateIdentifier));
-            identifier->isString = false;
-            identifier->value.number = intid;
-
-            negativeOneAndZeroIdentifiers[intid + 1] = identifier;
-        }
-    } else {
-        identifier = getIntIdentifierMap()->get(intid);
-        if (!identifier) {
-            identifier = (PrivateIdentifier*)malloc(sizeof(PrivateIdentifier));
-            // We never release identifier names, so this dictionary will grow.
-            identifier->isString = false;
-            identifier->value.number = intid;
-
-            getIntIdentifierMap()->set(intid, identifier);
-        }
-    }
-    return (NPIdentifier)identifier;
+    return static_cast<NPIdentifier>(IdentifierRep::get(intid));
 }
 
 bool _NPN_IdentifierIsString(NPIdentifier identifier)
 {
-    PrivateIdentifier* i = (PrivateIdentifier*)identifier;
-    return i->isString;
+    return static_cast<IdentifierRep*>(identifier)->isString();
 }
 
 NPUTF8 *_NPN_UTF8FromIdentifier(NPIdentifier identifier)
 {
-    PrivateIdentifier* i = (PrivateIdentifier*)identifier;
-    if (!i->isString || !i->value.string)
-        return NULL;
-        
-    return (NPUTF8 *)strdup(i->value.string);
+    const char* string = static_cast<IdentifierRep*>(identifier)->string();
+    if (!string)
+        return 0;
+    
+    return strdup(string);
 }
 
 int32_t _NPN_IntFromIdentifier(NPIdentifier identifier)
 {
-    PrivateIdentifier* i = (PrivateIdentifier*)identifier;
-    if (i->isString)
-        return 0;
-    return i->value.number;
+    return static_cast<IdentifierRep*>(identifier)->number();
 }
 
 void NPN_InitializeVariantWithStringCopy(NPVariant* variant, const NPString* value)
@@ -151,6 +86,8 @@ void NPN_InitializeVariantWithStringCopy(NPVariant* variant, const NPString* val
     variant->type = NPVariantType_String;
     variant->value.stringValue.UTF8Length = value->UTF8Length;
     variant->value.stringValue.UTF8Characters = (NPUTF8 *)malloc(sizeof(NPUTF8) * value->UTF8Length);
+    if (!variant->value.stringValue.UTF8Characters)
+        CRASH();
     memcpy((void*)variant->value.stringValue.UTF8Characters, value->UTF8Characters, sizeof(NPUTF8) * value->UTF8Length);
 }
 
@@ -180,7 +117,8 @@ NPObject *_NPN_CreateObject(NPP npp, NPClass* aClass)
             obj = aClass->allocate(npp, aClass);
         else
             obj = (NPObject*)malloc(sizeof(NPObject));
-
+        if (!obj)
+            CRASH();
         obj->_class = aClass;
         obj->referenceCount = 1;
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
index 3aa218cae0..c39b3aff5f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
@@ -66,7 +66,7 @@ const char* QtClass::name() const
 // and not get wrapped in RuntimeMethod). Also, use this for methods,
 // so we can cache the object and return the same object for the same
 // identifier.
-JSValuePtr QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
+JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
 {
     QtInstance* qtinst = static_cast<QtInstance*>(inst);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
index c83bb0f653..19d42071e3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
@@ -45,7 +45,7 @@ public:
     virtual MethodList methodsNamed(const Identifier&, Instance*) const;
     virtual Field* fieldNamed(const Identifier&, Instance*) const;
 
-    virtual JSValuePtr fallbackObject(ExecState*, Instance*, const Identifier&);
+    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&);
 
 private:
     QtClass(const QtClass&); // prohibit copying
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
index 26323e8ef2..60cf16fdcd 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
@@ -49,22 +49,30 @@ static InstanceJSObjectMap cachedObjects;
 
 // Derived RuntimeObject
 class QtRuntimeObjectImp : public RuntimeObjectImp {
-    public:
-        QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
-        ~QtRuntimeObjectImp();
-        virtual void invalidate();
-
-        virtual void mark() {
-            QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
-            if (instance)
-                instance->mark();
-            RuntimeObjectImp::mark();
-        }
+public:
+    QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
+    ~QtRuntimeObjectImp();
+    virtual void invalidate();
+
+    static const ClassInfo s_info;
+
+    virtual void mark()
+    {
+        QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
+        if (instance)
+            instance->mark();
+        RuntimeObjectImp::mark();
+    }
 
-    protected:
-        void removeFromCache();
+protected:
+    void removeFromCache();
+        
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
 };
 
+const ClassInfo QtRuntimeObjectImp::s_info = { "QtRuntimeObject", &RuntimeObjectImp::s_info, 0, 0 };
+
 QtRuntimeObjectImp::QtRuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
     : RuntimeObjectImp(exec, WebCore::getDOMStructure<QtRuntimeObjectImp>(exec), instance)
 {
@@ -145,17 +153,23 @@ PassRefPtr<QtInstance> QtInstance::getQtInstance(QObject* o, PassRefPtr<RootObje
     return ret.release();
 }
 
-RuntimeObjectImp* QtInstance::getRuntimeObject(ExecState* exec, PassRefPtr<QtInstance> instance)
+bool QtInstance::getOwnPropertySlot(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    JSLock lock(false);
-    QtInstance* qtInstance = instance.get();
-    RuntimeObjectImp* ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(qtInstance));
-    if (!ret) {
-        ret = new (exec) QtRuntimeObjectImp(exec, instance);
-        cachedObjects.insert(qtInstance, ret);
-        ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(qtInstance));
-    }
-    return ret;
+    return object->JSObject::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void QtInstance::put(JSObject* object, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    object->JSObject::put(exec, propertyName, value, slot);
+}
+
+QtInstance* QtInstance::getInstance(JSObject* object)
+{
+    if (!object)
+        return 0;
+    if (!object->inherits(&QtRuntimeObjectImp::s_info))
+        return 0;
+    return static_cast<QtInstance*>(static_cast<RuntimeObjectImp*>(object)->getInternalInstance());
 }
 
 Class* QtInstance::getClass() const
@@ -165,6 +179,18 @@ Class* QtInstance::getClass() const
     return m_class;
 }
 
+RuntimeObjectImp* QtInstance::createRuntimeObject(ExecState* exec)
+{
+    JSLock lock(false);
+    RuntimeObjectImp* ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
+    if (!ret) {
+        ret = new (exec) QtRuntimeObjectImp(exec, this);
+        cachedObjects.insert(this, ret);
+        ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
+    }
+    return ret;
+}
+
 void QtInstance::mark()
 {
     if (m_defaultMethod)
@@ -173,9 +199,9 @@ void QtInstance::mark()
         if (val && !val->marked())
             val->mark();
     }
-    foreach(JSValuePtr val, m_children.values()) {
-        if (val && !val->marked())
-            val->mark();
+    foreach(JSValue val, m_children.values()) {
+        if (val && !val.marked())
+            val.mark();
     }
 }
 
@@ -221,14 +247,14 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
     }
 }
 
-JSValuePtr QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
+JSValue QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
 {
     // Implemented via fallbackMethod & QtRuntimeMetaMethod::callAsFunction
     return jsUndefined();
 }
 
 
-JSValuePtr QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -237,7 +263,7 @@ JSValuePtr QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint
     return valueOf(exec);
 }
 
-JSValuePtr QtInstance::stringValue(ExecState* exec) const
+JSValue QtInstance::stringValue(ExecState* exec) const
 {
     // Hmm.. see if there is a toString defined
     QByteArray buf;
@@ -281,25 +307,25 @@ JSValuePtr QtInstance::stringValue(ExecState* exec) const
     return jsString(exec, buf.constData());
 }
 
-JSValuePtr QtInstance::numberValue(ExecState* exec) const
+JSValue QtInstance::numberValue(ExecState* exec) const
 {
     return jsNumber(exec, 0);
 }
 
-JSValuePtr QtInstance::booleanValue() const
+JSValue QtInstance::booleanValue() const
 {
     // ECMA 9.2
     return jsBoolean(true);
 }
 
-JSValuePtr QtInstance::valueOf(ExecState* exec) const
+JSValue QtInstance::valueOf(ExecState* exec) const
 {
     return stringValue(exec);
 }
 
 // In qt_runtime.cpp
-JSValuePtr convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
-QVariant convertValueToQVariant(ExecState*, JSValuePtr, QMetaType::Type hint, int *distance);
+JSValue convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
+QVariant convertValueToQVariant(ExecState*, JSValue, QMetaType::Type hint, int *distance);
 
 const char* QtField::name() const
 {
@@ -312,7 +338,7 @@ const char* QtField::name() const
     return ""; // deleted child object
 }
 
-JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
+JSValue QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
 {
     const QtInstance* instance = static_cast<const QtInstance*>(inst);
     QObject* obj = instance->getObject();
@@ -329,7 +355,7 @@ JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) con
         else if (m_type == DynamicProperty)
             val = obj->property(m_dynamicProperty);
 
-        JSValuePtr ret = convertQVariantToValue(exec, inst->rootObject(), val);
+        JSValue ret = convertQVariantToValue(exec, inst->rootObject(), val);
 
         // Need to save children so we can mark them
         if (m_type == ChildObject)
@@ -337,12 +363,12 @@ JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) con
 
         return ret;
     } else {
-        QString msg = QString::fromLatin1("cannot access member `%1' of deleted QObject").arg(QLatin1String(name()));
+        QString msg = QString(QLatin1String("cannot access member `%1' of deleted QObject")).arg(QLatin1String(name()));
         return throwError(exec, GeneralError, msg.toLatin1().constData());
     }
 }
 
-void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValuePtr aValue) const
+void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValue aValue) const
 {
     if (m_type == ChildObject) // QtScript doesn't allow setting to a named child
         return;
@@ -362,7 +388,7 @@ void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValueP
         } else if (m_type == DynamicProperty)
             obj->setProperty(m_dynamicProperty.constData(), val);
     } else {
-        QString msg = QString::fromLatin1("cannot access member `%1' of deleted QObject").arg(QLatin1String(name()));
+        QString msg = QString(QLatin1String("cannot access member `%1' of deleted QObject")).arg(QLatin1String(name()));
         throwError(exec, GeneralError, msg.toLatin1().constData());
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
index 50d4cf14cd..590fadfd33 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
@@ -40,29 +40,32 @@ public:
     ~QtInstance();
 
     virtual Class* getClass() const;
+    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
 
     virtual void begin();
     virtual void end();
 
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
     virtual void mark(); // This isn't inherited
 
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-    virtual BindingLanguage getBindingLanguage() const { return QtLanguage; }
-
-    JSValuePtr stringValue(ExecState* exec) const;
-    JSValuePtr numberValue(ExecState* exec) const;
-    JSValuePtr booleanValue() const;
+    JSValue stringValue(ExecState* exec) const;
+    JSValue numberValue(ExecState* exec) const;
+    JSValue booleanValue() const;
 
     QObject* getObject() const { return m_object; }
 
     static PassRefPtr<QtInstance> getQtInstance(QObject*, PassRefPtr<RootObject>, QScriptEngine::ValueOwnership ownership);
-    static RuntimeObjectImp* getRuntimeObject(ExecState* exec, PassRefPtr<QtInstance>);
+
+    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&);
+    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+
+    static QtInstance* getInstance(JSObject*);
 
 private:
     static PassRefPtr<QtInstance> create(QObject *instance, PassRefPtr<RootObject> rootObject, QScriptEngine::ValueOwnership ownership)
@@ -78,7 +81,7 @@ private:
     QObject* m_hashkey;
     mutable QHash<QByteArray, JSObject*> m_methods;
     mutable QHash<QString, QtField*> m_fields;
-    mutable QSet<JSValuePtr> m_children;
+    mutable QSet<JSValue> m_children;
     mutable QtRuntimeMetaMethod* m_defaultMethod;
     QScriptEngine::ValueOwnership m_ownership;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
index 5a73dc7496..e50e120251 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
@@ -113,20 +113,20 @@ QDebug operator<<(QDebug dbg, const JSRealType &c)
 }
 #endif
 
-static JSRealType valueRealType(ExecState* exec, JSValuePtr val)
+static JSRealType valueRealType(ExecState* exec, JSValue val)
 {
-    if (val->isNumber())
+    if (val.isNumber())
         return Number;
-    else if (val->isString())
+    else if (val.isString())
         return String;
-    else if (val->isBoolean())
+    else if (val.isBoolean())
         return Boolean;
-    else if (val->isNull())
+    else if (val.isNull())
         return Null;
-    else if (exec->interpreter()->isJSByteArray(val))
+    else if (isJSByteArray(&exec->globalData(), val))
         return JSByteArray;
-    else if (val->isObject()) {
-        JSObject *object = val->toObject(exec);
+    else if (val.isObject()) {
+        JSObject *object = val.toObject(exec);
         if (object->inherits(&RuntimeArray::s_info))  // RuntimeArray 'inherits' from Array, but not in C++
             return RTArray;
         else if (object->inherits(&JSArray::info))
@@ -143,11 +143,14 @@ static JSRealType valueRealType(ExecState* exec, JSValuePtr val)
     return String; // I don't know.
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
 {
+    if (!value)
+        return QVariant();
+
     JSObject* object = 0;
-    if (value->isObject()) {
-        object = value->toObject(exec);
+    if (value.isObject()) {
+        object = value.toObject(exec);
         if (visitedObjects->contains(object))
             return QVariant();
 
@@ -222,9 +225,9 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
     switch (hint) {
         case QMetaType::Bool:
             if (type == Object && object->inherits(&BooleanObject::info))
-                ret = QVariant(asBooleanObject(value)->internalValue()->toBoolean(exec));
+                ret = QVariant(asBooleanObject(value)->internalValue().toBoolean(exec));
             else
-                ret = QVariant(value->toBoolean(exec));
+                ret = QVariant(value.toBoolean(exec));
             if (type == Boolean)
                 dist = 0;
             else
@@ -241,7 +244,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
         case QMetaType::UShort:
         case QMetaType::Float:
         case QMetaType::Double:
-            ret = QVariant(value->toNumber(exec));
+            ret = QVariant(value.toNumber(exec));
             ret.convert((QVariant::Type)hint);
             if (type == Number) {
                 switch (hint) {
@@ -279,13 +282,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::QChar:
             if (type == Number || type == Boolean) {
-                ret = QVariant(QChar((ushort)value->toNumber(exec)));
+                ret = QVariant(QChar((ushort)value.toNumber(exec)));
                 if (type == Boolean)
                     dist = 3;
                 else
                     dist = 6;
             } else {
-                UString str = value->toString(exec);
+                UString str = value.toString(exec);
                 ret = QVariant(QChar(str.size() ? *(const ushort*)str.rep()->data() : 0));
                 if (type == String)
                     dist = 3;
@@ -295,12 +298,12 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
             break;
 
         case QMetaType::QString: {
-            if (value->isUndefinedOrNull()) {
+            if (value.isUndefinedOrNull()) {
                 if (distance)
                     *distance = 1;
                 return QString();
             } else {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 ret = QVariant(QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size()));
                 if (type == String)
                     dist = 0;
@@ -321,7 +324,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 int objdist = 0;
                 while(it != properties.end()) {
                     if (object->propertyIsEnumerable(exec, *it)) {
-                        JSValuePtr val = object->get(exec, *it);
+                        JSValue val = object->get(exec, *it);
                         QVariant v = convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects);
                         if (objdist >= 0) {
                             UString ustring = (*it).ustring();
@@ -345,7 +348,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -364,7 +367,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = array->get(exec, i);
+                    JSValue val = array->get(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -398,8 +401,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 QStringList result;
                 int len = rtarray->getLength();
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
-                    UString ustring = val->toString(exec);
+                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    UString ustring = val.toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                     result.append(qstring);
@@ -412,8 +415,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 QStringList result;
                 int len = array->length();
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = array->get(exec, i);
-                    UString ustring = val->toString(exec);
+                    JSValue val = array->get(exec, i);
+                    UString ustring = val.toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                     result.append(qstring);
@@ -422,7 +425,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 ret = QVariant(result);
             } else {
                 // Make a single length array
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
                 QStringList result;
                 result.append(qstring);
@@ -434,11 +437,11 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::QByteArray: {
             if (type == JSByteArray) {
-                ByteArray* arr = asByteArray(value)->storage();
+                WTF::ByteArray* arr = asByteArray(value)->storage();
                 ret = QVariant(QByteArray(reinterpret_cast<const char*>(arr->data()), arr->length()));
                 dist = 0;
             } else {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 ret = QVariant(QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size()).toLatin1());
                 if (type == String)
                     dist = 5;
@@ -466,7 +469,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     dist = 2;
                 }
             } else if (type == Number) {
-                double b = value->toNumber(exec);
+                double b = value.toNumber(exec);
                 GregorianDateTime gdt;
                 msToGregorianDateTime(b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
@@ -480,7 +483,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     dist = 10;
                 }
             } else if (type == String) {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                 if (hint == QMetaType::QDateTime) {
@@ -529,7 +532,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 RegExpObject *re = static_cast<RegExpObject*>(object);
 */
                 // Attempt to convert.. a bit risky
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                 // this is of the form '/xxxxxx/i'
@@ -549,7 +552,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     qConvDebug() << "couldn't parse a JS regexp";
                 }
             } else if (type == String) {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                 QRegExp re(qstring);
@@ -562,7 +565,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::QObjectStar:
             if (type == QObj) {
-                QtInstance* qtinst = static_cast<QtInstance*>(Instance::getInstance(object, Instance::QtLanguage));
+                QtInstance* qtinst = QtInstance::getInstance(object);
                 if (qtinst) {
                     if (qtinst->getObject()) {
                         qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
@@ -586,7 +589,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::VoidStar:
             if (type == QObj) {
-                QtInstance* qtinst = static_cast<QtInstance*>(Instance::getInstance(object, Instance::QtLanguage));
+                QtInstance* qtinst = QtInstance::getInstance(object);
                 if (qtinst) {
                     if (qtinst->getObject()) {
                         qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
@@ -605,7 +608,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
             } else if (type == Number) {
                 // I don't think that converting a double to a pointer is a wise
                 // move.  Except maybe 0.
-                qConvDebug() << "got number for void * - not converting, seems unsafe:" << value->toNumber(exec);
+                qConvDebug() << "got number for void * - not converting, seems unsafe:" << value.toNumber(exec);
             } else {
                 qConvDebug() << "void* - unhandled type" << type;
             }
@@ -621,7 +624,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     QObjectList result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -635,12 +638,12 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                         ret = QVariant::fromValue(result);
                     }
                 } else if (type == Array) {
-                    JSObject* object = value->toObject(exec);
+                    JSObject* object = value.toObject(exec);
                     JSArray* array = static_cast<JSArray *>(object);
                     QObjectList result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = array->get(exec, i);
+                        JSValue val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -672,7 +675,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     QList<int> result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -691,7 +694,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     QList<int> result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = array->get(exec, i);
+                        JSValue val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -717,7 +720,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 }
                 break;
             } else if (hint == (QMetaType::Type) qMetaTypeId<QVariant>()) {
-                if (value->isUndefinedOrNull()) {
+                if (value.isUndefinedOrNull()) {
                     if (distance)
                         *distance = 1;
                     return QVariant();
@@ -746,13 +749,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
     return ret;
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance)
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance)
 {
     HashSet<JSObject*> visitedObjects;
     return convertValueToQVariant(exec, value, hint, distance, &visitedObjects);
 }
 
-JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
+JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
 {
     // Variants with QObject * can be isNull but not a null pointer
     // An empty QString variant is also null
@@ -837,14 +840,14 @@ JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root,
 
     if (type == QMetaType::QByteArray) {
         QByteArray qtByteArray = variant.value<QByteArray>();
-        WTF::RefPtr<ByteArray> wtfByteArray = ByteArray::create(qtByteArray.length());
+        WTF::RefPtr<WTF::ByteArray> wtfByteArray = WTF::ByteArray::create(qtByteArray.length());
         qMemCopy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
         return new (exec) JSC::JSByteArray(exec, JSC::JSByteArray::createStructure(jsNull()), wtfByteArray.get());
     }
 
     if (type == QMetaType::QObjectStar || type == QMetaType::QWidgetStar) {
         QObject* obj = variant.value<QObject*>();
-        return Instance::createRuntimeObject(exec, QtInstance::getQtInstance(obj, root, QScriptEngine::QtOwnership));
+        return QtInstance::getQtInstance(obj, root, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
     }
 
     if (type == QMetaType::QVariantMap) {
@@ -854,7 +857,7 @@ JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root,
         QVariantMap::const_iterator i = map.constBegin();
         while (i != map.constEnd()) {
             QString s = i.key();
-            JSValuePtr val = convertQVariantToValue(exec, root, i.value());
+            JSValue val = convertQVariantToValue(exec, root, i.value());
             if (val) {
                 PutPropertySlot slot;
                 ret->put(exec, Identifier(exec, (const UChar *)s.constData(), s.length()), val, slot);
@@ -1181,7 +1184,7 @@ static int findMethodIndex(ExecState* exec,
         bool converted = true;
         int matchDistance = 0;
         for (int i = 0; converted && i < types.count() - 1; ++i) {
-            JSValuePtr arg = i < jsArgs.size() ? jsArgs.at(exec, i) : jsUndefined();
+            JSValue arg = i < jsArgs.size() ? jsArgs.at(i) : jsUndefined();
 
             int argdistance = -1;
             QVariant v = convertValueToQVariant(exec, arg, types.at(i+1).typeId(), &argdistance);
@@ -1333,7 +1336,7 @@ void QtRuntimeMetaMethod::mark()
         d->m_disconnect->mark();
 }
 
-JSValuePtr QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     QtRuntimeMetaMethodData* d = static_cast<QtRuntimeMetaMethod *>(functionObject)->d_func();
 
@@ -1391,13 +1394,13 @@ bool QtRuntimeMetaMethod::getOwnPropertySlot(ExecState* exec, const Identifier&
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValuePtr QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // QtScript always returns 0
     return jsNumber(exec, 0);
 }
 
-JSValuePtr QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1407,7 +1410,7 @@ JSValuePtr QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier&
     return d->m_connect;
 }
 
-JSValuePtr QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1431,7 +1434,7 @@ QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, const Iden
     d->m_isConnect = isConnect;
 }
 
-JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(functionObject)->d_func();
 
@@ -1454,7 +1457,7 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
 
         if (signalIndex != -1) {
             if (args.size() == 1) {
-                funcObject = args.at(exec, 0)->toObject(exec);
+                funcObject = args.at(0).toObject(exec);
                 CallData callData;
                 if (funcObject->getCallData(callData) == CallTypeNone) {
                     if (d->m_isConnect)
@@ -1463,24 +1466,24 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
                         return throwError(exec, TypeError, "QtMetaMethod.disconnect: target is not a function");
                 }
             } else if (args.size() >= 2) {
-                if (args.at(exec, 0)->isObject()) {
-                    thisObject = args.at(exec, 0)->toObject(exec);
+                if (args.at(0).isObject()) {
+                    thisObject = args.at(0).toObject(exec);
 
                     // Get the actual function to call
-                    JSObject *asObj = args.at(exec, 1)->toObject(exec);
+                    JSObject *asObj = args.at(1).toObject(exec);
                     CallData callData;
                     if (asObj->getCallData(callData) != CallTypeNone) {
                         // Function version
                         funcObject = asObj;
                     } else {
                         // Convert it to a string
-                        UString funcName = args.at(exec, 1)->toString(exec);
+                        UString funcName = args.at(1).toString(exec);
                         Identifier funcIdent(exec, funcName);
 
                         // ### DropAllLocks
                         // This is resolved at this point in QtScript
-                        JSValuePtr val = thisObject->get(exec, funcIdent);
-                        JSObject* asFuncObj = val->toObject(exec);
+                        JSValue val = thisObject->get(exec, funcIdent);
+                        JSObject* asFuncObj = val.toObject(exec);
 
                         if (asFuncObj->getCallData(callData) != CallTypeNone) {
                             funcObject = asFuncObj;
@@ -1515,7 +1518,7 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
                 bool ok = QMetaObject::connect(sender, signalIndex, conn, conn->metaObject()->methodOffset());
                 if (!ok) {
                     delete conn;
-                    QString msg = QString::fromLatin1("QtMetaMethod.connect: failed to connect to %1::%2()")
+                    QString msg = QString(QLatin1String("QtMetaMethod.connect: failed to connect to %1::%2()"))
                             .arg(QLatin1String(sender->metaObject()->className()))
                             .arg(QLatin1String(d->m_signature));
                     return throwError(exec, GeneralError, msg.toLatin1().constData());
@@ -1541,14 +1544,14 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
                 }
 
                 if (!ret) {
-                    QString msg = QString::fromLatin1("QtMetaMethod.disconnect: failed to disconnect from %1::%2()")
+                    QString msg = QString(QLatin1String("QtMetaMethod.disconnect: failed to disconnect from %1::%2()"))
                             .arg(QLatin1String(sender->metaObject()->className()))
                             .arg(QLatin1String(d->m_signature));
                     return throwError(exec, GeneralError, msg.toLatin1().constData());
                 }
             }
         } else {
-            QString msg = QString::fromLatin1("QtMetaMethod.%1: %2::%3() is not a signal")
+            QString msg = QString(QLatin1String("QtMetaMethod.%1: %2::%3() is not a signal"))
                     .arg(QLatin1String(d->m_isConnect ? "connect": "disconnect"))
                     .arg(QLatin1String(sender->metaObject()->className()))
                     .arg(QLatin1String(d->m_signature));
@@ -1577,7 +1580,7 @@ bool QtRuntimeConnectionMethod::getOwnPropertySlot(ExecState* exec, const Identi
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValuePtr QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // we have one formal argument, and one optional
     return jsNumber(exec, 1);
@@ -1675,9 +1678,9 @@ void QtConnectionObject::execute(void **argv)
                 ExecState* exec = globalobj->globalExec();
                 if (exec) {
                     // Build the argument list (up to the formal argument length of the slot)
-                    ArgList l;
+                    MarkedArgumentBuffer l;
                     // ### DropAllLocks?
-                    int funcArgC = m_funcObject->get(exec, exec->propertyNames().length)->toInt32(exec);
+                    int funcArgC = m_funcObject->get(exec, exec->propertyNames().length).toInt32(exec);
                     int argTotal = qMax(funcArgC, argc);
                     for(int i=0; i < argTotal; i++) {
                         if (i < argc) {
@@ -1693,7 +1696,7 @@ void QtConnectionObject::execute(void **argv)
                     if (m_funcObject->inherits(&JSFunction::info)) {
                         JSFunction* fimp = static_cast<JSFunction*>(m_funcObject.get());
 
-                        JSObject* qt_sender = Instance::createRuntimeObject(exec, QtInstance::getQtInstance(sender(), ro, QScriptEngine::QtOwnership));
+                        JSObject* qt_sender = QtInstance::getQtInstance(sender(), ro, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
                         JSObject* wrapper = new (exec) JSObject(JSObject::createStructure(jsNull()));
                         PutPropertySlot slot;
                         wrapper->put(exec, Identifier(exec, "__qt_sender__"), qt_sender, slot);
@@ -1743,7 +1746,7 @@ template <typename T> RootObject* QtArray<T>::rootObject() const
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
 }
 
-template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) const
+template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
 {
     // QtScript sets the value, but doesn't forward it to the original source
     // (e.g. if you do 'object.intList[5] = 6', the object is not updated, but the
@@ -1757,7 +1760,7 @@ template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned inde
 }
 
 
-template <typename T> JSValuePtr QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
+template <typename T> JSValue QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
 {
     if (index < m_length) {
         T val = m_list.at(index);
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index 7912a2b930..72d93eb9e7 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -56,8 +56,8 @@ public:
         : m_type(ChildObject), m_childObject(child)
         {}
 
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
     virtual const char* name() const;
     QtFieldType fieldType() const {return m_type;}
 private:
@@ -98,8 +98,8 @@ public:
 
     RootObject* rootObject() const;
 
-    virtual void setValueAt(ExecState*, unsigned index, JSValuePtr) const;
-    virtual JSValuePtr valueAt(ExecState*, unsigned index) const;
+    virtual void setValueAt(ExecState*, unsigned index, JSValue) const;
+    virtual JSValue valueAt(ExecState*, unsigned index) const;
     virtual unsigned int getLength() const {return m_length;}
 
 private:
@@ -144,12 +144,12 @@ public:
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
@@ -174,10 +174,10 @@ protected:
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr connectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue connectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
 };
 
 class QtConnectionObject;
@@ -193,8 +193,8 @@ protected:
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     static QMultiMap<QObject *, QtConnectionObject *> connections;
     friend class QtConnectionObject;
 };
@@ -223,7 +223,8 @@ private:
     ProtectedPtr<JSObject> m_funcObject;
 };
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance);
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance);
+JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant);
 
 } // namespace Bindings
 } // namespace JSC
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
index 3b40825a81..d6b69621a9 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
@@ -78,39 +78,11 @@ void Instance::end()
     virtualEnd();
 }
 
-JSValuePtr Instance::getValueOfField(ExecState* exec, const Field* aField) const
+RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec)
 {
-    return aField->valueFromInstance(exec, this);
-}
-
-void Instance::setValueOfField(ExecState* exec, const Field* aField, JSValuePtr aValue) const
-{
-    aField->setValueToInstance(exec, this, aValue);
-}
-
-RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
-{
-#if PLATFORM(QT)
-    if (instance->getBindingLanguage() == QtLanguage)
-        return QtInstance::getRuntimeObject(exec, static_cast<QtInstance*>(instance.get()));
-#endif
     JSLock lock(false);
-
-    return new (exec) RuntimeObjectImp(exec, instance);
-}
-
-Instance* Instance::getInstance(JSObject* object, BindingLanguage language)
-{
-    if (!object)
-        return 0;
-    if (!object->inherits(&RuntimeObjectImp::s_info))
-        return 0;
-    Instance* instance = static_cast<RuntimeObjectImp*>(object)->getInternalInstance();
-    if (!instance)
-        return 0;
-    if (instance->getBindingLanguage() != language)
-        return 0;
-    return instance;
+    
+    return new (exec) RuntimeObjectImp(exec, this);
 }
 
 RootObject* Instance::rootObject() const 
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.h b/src/3rdparty/webkit/WebCore/bridge/runtime.h
index 3346c744d9..72736d4f32 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime.h
@@ -49,16 +49,14 @@ typedef Vector<Method*> MethodList;
 
 class Field {
 public:
-    virtual const char* name() const = 0;
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const = 0;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const = 0;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const = 0;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const = 0;
 
     virtual ~Field() { }
 };
 
 class Method : Noncopyable {
 public:
-    virtual const char *name() const = 0;
     virtual int numParameters() const = 0;
         
     virtual ~Method() { }
@@ -66,10 +64,9 @@ public:
 
 class Class : Noncopyable {
 public:
-    virtual const char* name() const = 0;
     virtual MethodList methodsNamed(const Identifier&, Instance*) const = 0;
     virtual Field* fieldNamed(const Identifier&, Instance*) const = 0;
-    virtual JSValuePtr fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
+    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
 
     virtual ~Class() { }
 };
@@ -78,27 +75,11 @@ typedef void (*KJSDidExecuteFunctionPtr)(ExecState*, JSObject* rootObject);
 
 class Instance : public RefCounted<Instance> {
 public:
-    typedef enum {
-#if ENABLE(MAC_JAVA_BRIDGE)
-        JavaLanguage,
-#endif
-#if PLATFORM(MAC)
-        ObjectiveCLanguage,
-#endif
-        CLanguage
-#if PLATFORM(QT)
-        , QtLanguage
-#endif
-    } BindingLanguage;
-
     Instance(PassRefPtr<RootObject>);
 
     static void setDidExecuteFunction(KJSDidExecuteFunctionPtr func);
     static KJSDidExecuteFunctionPtr didExecuteFunction();
 
-    static RuntimeObjectImp* createRuntimeObject(ExecState*, PassRefPtr<Instance>);
-    static Instance* getInstance(JSObject*, BindingLanguage);
-
     // These functions are called before and after the main entry points into
     // the native implementations.  They can be used to establish and cleanup
     // any needed state.
@@ -106,32 +87,31 @@ public:
     void end();
     
     virtual Class *getClass() const = 0;
+    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
     
-    virtual JSValuePtr getValueOfField(ExecState*, const Field*) const;
-    virtual JSValuePtr getValueOfUndefinedField(ExecState*, const Identifier&) const { return jsUndefined(); }
-    virtual void setValueOfField(ExecState*, const Field*, JSValuePtr) const;
-    virtual bool supportsSetValueOfUndefinedField() { return false; }
-    virtual void setValueOfUndefinedField(ExecState*, const Identifier&, JSValuePtr) {}
+    // Returns false if the value was not set successfully.
+    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
 
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
 
     virtual bool supportsInvokeDefaultMethod() const { return false; }
-    virtual JSValuePtr invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
     
     virtual bool supportsConstruct() const { return false; }
-    virtual JSValuePtr invokeConstruct(ExecState*, const ArgList&) { return noValue(); }
+    virtual JSValue invokeConstruct(ExecState*, const ArgList&) { return JSValue(); }
     
     virtual void getPropertyNames(ExecState*, PropertyNameArray&) { }
 
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
     
-    virtual JSValuePtr valueOf(ExecState* exec) const { return jsString(exec, getClass()->name()); }
+    virtual JSValue valueOf(ExecState* exec) const = 0;
     
     RootObject* rootObject() const;
     
     virtual ~Instance();
 
-    virtual BindingLanguage getBindingLanguage() const = 0;
+    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
+    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
 
 protected:
     virtual void virtualBegin() { }
@@ -145,8 +125,8 @@ public:
     Array(PassRefPtr<RootObject>);
     virtual ~Array();
     
-    virtual void setValueAt(ExecState *, unsigned index, JSValuePtr) const = 0;
-    virtual JSValuePtr valueAt(ExecState *, unsigned index) const = 0;
+    virtual void setValueAt(ExecState *, unsigned index, JSValue) const = 0;
+    virtual JSValue valueAt(ExecState *, unsigned index) const = 0;
     virtual unsigned int getLength() const = 0;
 
 protected:
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
index 19794320fe..fead83a80f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
@@ -42,13 +42,13 @@ RuntimeArray::RuntimeArray(ExecState* exec, Bindings::Array* a)
 {
 }
 
-JSValuePtr RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
     return jsNumber(exec, thisObj->getLength());
 }
 
-JSValuePtr RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
     return thisObj->getConcreteArray()->valueAt(exec, slot.index());
@@ -83,7 +83,7 @@ bool RuntimeArray::getOwnPropertySlot(ExecState *exec, unsigned index, PropertyS
     return JSObject::getOwnPropertySlot(exec, index, slot);
 }
 
-void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length) {
         throwError(exec, RangeError);
@@ -100,7 +100,7 @@ void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValueP
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void RuntimeArray::put(ExecState* exec, unsigned index, JSValuePtr value)
+void RuntimeArray::put(ExecState* exec, unsigned index, JSValue value)
 {
     if (index >= getLength()) {
         throwError(exec, RangeError);
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index 1ea47a49e4..5a86e9d0ad 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -37,8 +37,8 @@ public:
     
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
-    virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-    virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+    virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+    virtual void put(ExecState*, unsigned propertyName, JSValue);
     
     virtual bool deleteProperty(ExecState *exec, const Identifier &propertyName);
     virtual bool deleteProperty(ExecState *exec, unsigned propertyName);
@@ -51,19 +51,19 @@ public:
 
     static const ClassInfo s_info;
 
-    static ArrayPrototype* createPrototype(ExecState* exec)
+    static ArrayPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->arrayPrototype();
+        return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
 
 private:
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr indexGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     OwnPtr<Bindings::Array> _array;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
index 014541df32..30a3581e0d 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
@@ -47,7 +47,7 @@ RuntimeMethod::RuntimeMethod(ExecState* exec, const Identifier& ident, Bindings:
 {
 }
 
-JSValuePtr RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slot.slotBase()));
 
@@ -70,7 +70,7 @@ bool RuntimeMethod::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return InternalFunction::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-static JSValuePtr callRuntimeMethod(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     RuntimeMethod* method = static_cast<RuntimeMethod*>(function);
 
@@ -79,13 +79,13 @@ static JSValuePtr callRuntimeMethod(ExecState* exec, JSObject* function, JSValue
     
     RuntimeObjectImp* imp;
 
-    if (thisValue->isObject(&RuntimeObjectImp::s_info)) {
+    if (thisValue.isObject(&RuntimeObjectImp::s_info)) {
         imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
     } else {
         // If thisObj is the DOM object for a plugin, get the corresponding
         // runtime object from the DOM object.
-        JSValuePtr value = thisValue->get(exec, Identifier(exec, "__apple_runtime_object"));
-        if (value->isObject(&RuntimeObjectImp::s_info))    
+        JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
+        if (value.isObject(&RuntimeObjectImp::s_info))    
             imp = static_cast<RuntimeObjectImp*>(asObject(value));
         else
             return throwError(exec, TypeError);
@@ -96,7 +96,7 @@ static JSValuePtr callRuntimeMethod(ExecState* exec, JSObject* function, JSValue
         return RuntimeObjectImp::throwInvalidAccessError(exec);
         
     instance->begin();
-    JSValuePtr result = instance->invokeMethod(exec, *method->methods(), args);
+    JSValue result = instance->invokeMethod(exec, *method->methods(), args);
     instance->end();
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index bb983f981e..5333c14c93 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -40,18 +40,18 @@ public:
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
     }
 
 private:
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual CallType getCallData(CallData&);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
index 3a2a93aab3..79afd3fa3f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
@@ -66,7 +66,7 @@ void RuntimeObjectImp::invalidate()
     instance = 0;
 }
 
-JSValuePtr RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -77,14 +77,14 @@ JSValuePtr RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identif
     instance->begin();
 
     Class *aClass = instance->getClass();
-    JSValuePtr result = aClass->fallbackObject(exec, instance.get(), propertyName);
+    JSValue result = aClass->fallbackObject(exec, instance.get(), propertyName);
 
     instance->end();
             
     return result;
 }
 
-JSValuePtr RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {    
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -96,14 +96,14 @@ JSValuePtr RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& prop
 
     Class *aClass = instance->getClass();
     Field* aField = aClass->fieldNamed(propertyName, instance.get());
-    JSValuePtr result = instance->getValueOfField(exec, aField); 
+    JSValue result = aField->valueFromInstance(exec, instance.get());
     
     instance->end();
             
     return result;
 }
 
-JSValuePtr RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -115,7 +115,7 @@ JSValuePtr RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& pro
 
     Class *aClass = instance->getClass();
     MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
-    JSValuePtr result = new (exec) RuntimeMethod(exec, propertyName, methodList);
+    JSValue result = new (exec) RuntimeMethod(exec, propertyName, methodList);
 
     instance->end();
             
@@ -153,7 +153,7 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
         }
 
         // Try a fallback object.
-        if (!aClass->fallbackObject(exec, instance.get(), propertyName)->isUndefined()) {
+        if (!aClass->fallbackObject(exec, instance.get(), propertyName).isUndefined()) {
             slot.setCustom(this, fallbackObjectGetter);
             instance->end();
             return true;
@@ -161,18 +161,11 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
     }
         
     instance->end();
-#if PLATFORM(QT)
-    // For Qt instances we call the baseclass implementation to allow
-    // runtime objects to have custom properties or a prototype
-    if (instance->getBindingLanguage() == Instance::QtLanguage)
-        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
-#endif
-    // For other platforms and/or binding languages we don't allow
-    // runtime properties/prototypes
-    return false;
+    
+    return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
-void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!instance) {
         throwInvalidAccessError(exec);
@@ -185,13 +178,9 @@ void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSVa
     // Set the value of the property.
     Field *aField = instance->getClass()->fieldNamed(propertyName, instance.get());
     if (aField)
-        instance->setValueOfField(exec, aField, value);
-    else if (instance->supportsSetValueOfUndefinedField())
-        instance->setValueOfUndefinedField(exec, propertyName, value);
-#if PLATFORM(QT)
-    else if (instance->getBindingLanguage() == Instance::QtLanguage)
-        JSObject::put(exec, propertyName, value, slot);
-#endif
+        aField->setValueToInstance(exec, instance.get(), value);
+    else if (!instance->setValueOfUndefinedField(exec, propertyName, value))
+        instance->put(this, exec, propertyName, value, slot);
 
     instance->end();
 }
@@ -202,23 +191,23 @@ bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
     return false;
 }
 
-JSValuePtr RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (!instance)
         return throwInvalidAccessError(exec);
     
     RefPtr<Instance> protector(instance);
     instance->begin();
-    JSValuePtr result = instance->defaultValue(exec, hint);
+    JSValue result = instance->defaultValue(exec, hint);
     instance->end();
     return result;
 }
 
-static JSValuePtr callRuntimeObject(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(function)->getInternalInstance());
     instance->begin();
-    JSValuePtr result = instance->invokeDefaultMethod(exec, args);
+    JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
@@ -231,15 +220,15 @@ CallType RuntimeObjectImp::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(constructor)->getInternalInstance());
     instance->begin();
-    JSValuePtr result = instance->invokeConstruct(exec, args);
+    JSValue result = instance->invokeConstruct(exec, args);
     instance->end();
     
     ASSERT(result);
-    return result->isObject() ? static_cast<JSObject*>(result->asCell()) : constructor;
+    return result.isObject() ? static_cast<JSObject*>(result.asCell()) : constructor;
 }
 
 ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index 0e8ea77768..f01fe1e1ea 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -33,12 +33,14 @@ namespace JSC {
 
 class RuntimeObjectImp : public JSObject {
 public:
+    RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
+
     virtual ~RuntimeObjectImp();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-    virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+    virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual bool deleteProperty(ExecState* , const Identifier& propertyName);
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
     
@@ -51,12 +53,12 @@ public:
 
     static const ClassInfo s_info;
 
-    static ObjectPrototype* createPrototype(ExecState* exec)
+    static ObjectPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->objectPrototype();
+        return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
@@ -65,14 +67,11 @@ protected:
     RuntimeObjectImp(ExecState*, PassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
 
 private:
-    friend class Bindings::Instance;
-    RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
-
     virtual const ClassInfo* classInfo() const { return &s_info; }
     
-    static JSValuePtr fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr methodGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     RefPtr<Bindings::Instance> instance;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
index 9215c48a9b..ca70e172f4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
@@ -103,7 +103,7 @@
 }
 
 /*
-- (id)invokeUndefinedMethodFromWebScript:(NSString *)name withArguments:(NSArray *)args;
+- (id)invokeUndefinedMethodFromWebScript:(NSString *)name withArguments:(NSArray *)args
 {
     NSLog (@"Call to undefined method %@", name);
     NSLog (@"%d args\n", [args count]);
diff --git a/src/3rdparty/webkit/WebCore/config.h b/src/3rdparty/webkit/WebCore/config.h
index 9e3dcdf083..97146435d4 100644
--- a/src/3rdparty/webkit/WebCore/config.h
+++ b/src/3rdparty/webkit/WebCore/config.h
@@ -24,6 +24,22 @@
 
 #include <wtf/Platform.h>
 
+#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define JS_EXPORTDATA __declspec(dllexport)
+#else
+#define JS_EXPORTDATA __declspec(dllimport)
+#endif
+#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit)
+#define WEBKIT_EXPORTDATA __declspec(dllexport)
+#else
+#define WEBKIT_EXPORTDATA __declspec(dllimport)
+#endif
+#else
+#define JS_EXPORTDATA
+#define WEBKIT_EXPORTDATA
+#endif
+
 #define MOBILE 0
 
 #ifdef __APPLE__
@@ -100,6 +116,7 @@
 #endif
 
 #if PLATFORM(MAC)
+// ATSUI vs. CoreText
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 #define WTF_USE_ATSUI 0
 #define WTF_USE_CORE_TEXT 1
@@ -107,8 +124,15 @@
 #define WTF_USE_ATSUI 1
 #define WTF_USE_CORE_TEXT 0
 #endif
+
+// New theme
 #define WTF_USE_NEW_THEME 1
+
+// Accelerated compositing
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#define WTF_USE_ACCELERATED_COMPOSITING 0
 #endif
+#endif // PLATFORM(MAC)
 
 #if PLATFORM(SYMBIAN)
 #undef WIN32
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
index 4fd5210f08..cf8cb4221b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
@@ -59,6 +59,13 @@ void CSSCanvasValue::canvasResized(HTMLCanvasElement*)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this));
 }
 
+void CSSCanvasValue::canvasDestroyed(HTMLCanvasElement* element)
+{
+    ASSERT(element == m_element);
+    if (element == m_element)
+        m_element = 0;
+}
+
 IntSize CSSCanvasValue::fixedSize(const RenderObject* renderer)
 {
     if (HTMLCanvasElement* elt = element(renderer->document()))
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h
index a698f31c9e..4cd4280865 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h
@@ -52,8 +52,9 @@ private:
     {
     }
 
-    virtual void canvasChanged(HTMLCanvasElement* element, const FloatRect& changedRect);
-    virtual void canvasResized(HTMLCanvasElement* element);
+    virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect);
+    virtual void canvasResized(HTMLCanvasElement*);
+    virtual void canvasDestroyed(HTMLCanvasElement*);
 
     HTMLCanvasElement* element(Document*);
      
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
index ebe659c123..db0333ac4c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
@@ -26,7 +26,7 @@ module css {
         InterfaceUUID=94180bad-a74e-4df9-adbc-6ce4e5b96155,
         ImplementationUUID=354aa39e-ad53-4e9a-a927-80c3966c47f2
     ] CSSCharsetRule : CSSRule {
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute [ConvertNullStringTo=Null] DOMString encoding;
 #else
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString encoding
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index d84fa31ff1..96aa0d7a77 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2004 Zack Rusin <zack@kde.org>
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  *
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "CSSComputedStyleDeclaration.h"
 
+#include "AnimationController.h"
 #include "CSSBorderImageValue.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
@@ -36,7 +37,8 @@
 #include "ExceptionCode.h"
 #include "Pair.h"
 #include "Rect.h"
-#include "RenderObject.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
 #include "ShadowValue.h"
 #include "WebKitCSSTransformValue.h"
 
@@ -51,8 +53,7 @@ static const int computedProperties[] = {
     CSSPropertyBackgroundAttachment,
     CSSPropertyBackgroundColor,
     CSSPropertyBackgroundImage,
-    // more specific background-position-x/y are non-standard
-    CSSPropertyBackgroundPosition,
+    CSSPropertyBackgroundPosition, // more-specific background-position-x/y are non-standard
     CSSPropertyBackgroundRepeat,
     CSSPropertyBorderBottomColor,
     CSSPropertyBorderBottomStyle,
@@ -70,6 +71,7 @@ static const int computedProperties[] = {
     CSSPropertyBottom,
     CSSPropertyCaptionSide,
     CSSPropertyClear,
+    CSSPropertyClip,
     CSSPropertyColor,
     CSSPropertyCursor,
     CSSPropertyDirection,
@@ -127,6 +129,7 @@ static const int computedProperties[] = {
     CSSPropertyWhiteSpace,
     CSSPropertyWidows,
     CSSPropertyWidth,
+    CSSPropertyWordBreak,
     CSSPropertyWordSpacing,
     CSSPropertyWordWrap,
     CSSPropertyZIndex,
@@ -137,16 +140,20 @@ static const int computedProperties[] = {
     CSSPropertyWebkitAnimationDuration,
     CSSPropertyWebkitAnimationIterationCount,
     CSSPropertyWebkitAnimationName,
-    CSSPropertyWebkitAnimationPlayState,
     CSSPropertyWebkitAnimationTimingFunction,
     CSSPropertyWebkitAppearance,
+    CSSPropertyWebkitBackfaceVisibility,
     CSSPropertyWebkitBackgroundClip,
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
     CSSPropertyWebkitBackgroundSize,
+    CSSPropertyWebkitBorderBottomLeftRadius,
+    CSSPropertyWebkitBorderBottomRightRadius,
     CSSPropertyWebkitBorderFit,
-    CSSPropertyWebkitBorderImage,
     CSSPropertyWebkitBorderHorizontalSpacing,
+    CSSPropertyWebkitBorderImage,
+    CSSPropertyWebkitBorderTopLeftRadius,
+    CSSPropertyWebkitBorderTopRightRadius,
     CSSPropertyWebkitBorderVerticalSpacing,
     CSSPropertyWebkitBoxAlign,
     CSSPropertyWebkitBoxDirection,
@@ -168,6 +175,9 @@ static const int computedProperties[] = {
     CSSPropertyWebkitColumnRuleStyle,
     CSSPropertyWebkitColumnRuleWidth,
     CSSPropertyWebkitColumnWidth,
+#if ENABLE(DASHBOARD_SUPPORT)
+    CSSPropertyWebkitDashboardRegion,
+#endif
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
@@ -179,14 +189,16 @@ static const int computedProperties[] = {
     CSSPropertyWebkitMarqueeStyle,
     CSSPropertyWebkitMaskAttachment,
     CSSPropertyWebkitMaskBoxImage,
-    CSSPropertyWebkitMaskImage,
-    CSSPropertyWebkitMaskPosition,
-    CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskClip,
     CSSPropertyWebkitMaskComposite,
+    CSSPropertyWebkitMaskImage,
     CSSPropertyWebkitMaskOrigin,
+    CSSPropertyWebkitMaskPosition,
+    CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskSize,
     CSSPropertyWebkitNbspMode,
+    CSSPropertyWebkitPerspective,
+    CSSPropertyWebkitPerspectiveOrigin,
     CSSPropertyWebkitRtlOrdering,
     CSSPropertyWebkitTextDecorationsInEffect,
     CSSPropertyWebkitTextFillColor,
@@ -195,21 +207,15 @@ static const int computedProperties[] = {
     CSSPropertyWebkitTextStrokeWidth,
     CSSPropertyWebkitTransform,
     CSSPropertyWebkitTransformOrigin,
+    CSSPropertyWebkitTransformStyle,
     CSSPropertyWebkitTransitionDelay,
     CSSPropertyWebkitTransitionDuration,
     CSSPropertyWebkitTransitionProperty,
     CSSPropertyWebkitTransitionTimingFunction,
     CSSPropertyWebkitUserDrag,
     CSSPropertyWebkitUserModify,
-    CSSPropertyWebkitUserSelect,
-#if ENABLE(DASHBOARD_SUPPORT)
-    CSSPropertyWebkitDashboardRegion,
-#endif
-    CSSPropertyWebkitBorderBottomLeftRadius,
-    CSSPropertyWebkitBorderBottomRightRadius,
-    CSSPropertyWebkitBorderTopLeftRadius,
-    CSSPropertyWebkitBorderTopRightRadius
-    
+    CSSPropertyWebkitUserSelect
+
 #if ENABLE(SVG)
     ,
     CSSPropertyClipPath,
@@ -395,27 +401,64 @@ static PassRefPtr<CSSValue> getBorderRadiusCornerValue(IntSize radius)
 
 static IntRect sizingBox(RenderObject* renderer)
 {
-    return renderer->style()->boxSizing() == CONTENT_BOX ? renderer->contentBox() : renderer->borderBox();
+    if (!renderer->isBox())
+        return IntRect();
+    
+    RenderBox* box = toRenderBox(renderer);
+    return box->style()->boxSizing() == CONTENT_BOX ? box->contentBoxRect() : box->borderBoxRect();
+}
+
+static inline bool hasCompositedLayer(RenderObject* renderer)
+{
+    return renderer && renderer->hasLayer() && toRenderBoxModelObject(renderer)->layer()->isComposited();
 }
 
-static PassRefPtr<CSSValue> computedTransform(RenderObject* renderer)
+static PassRefPtr<CSSValue> computedTransform(RenderObject* renderer, const RenderStyle* style)
 {
-    if (!renderer || renderer->style()->transform().operations().isEmpty())
+    if (!renderer || style->transform().operations().isEmpty())
         return CSSPrimitiveValue::createIdentifier(CSSValueNone);
     
     IntRect box = sizingBox(renderer);
 
     TransformationMatrix transform;
-    renderer->style()->applyTransform(transform, box.size(), false);
+    style->applyTransform(transform, box.size(), RenderStyle::ExcludeTransformOrigin);
+    // Note that this does not flatten to an affine transform if ENABLE(3D_RENDERING) is off, by design.
+
+    RefPtr<WebKitCSSTransformValue> transformVal;
 
-    RefPtr<WebKitCSSTransformValue> transformVal = WebKitCSSTransformValue::create(WebKitCSSTransformValue::MatrixTransformOperation);
+    // FIXME: Need to print out individual functions (https://bugs.webkit.org/show_bug.cgi?id=23924)
+    if (transform.isAffine()) {
+        transformVal = WebKitCSSTransformValue::create(WebKitCSSTransformValue::MatrixTransformOperation);
 
-    transformVal->append(CSSPrimitiveValue::create(transform.a(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.b(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.c(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.d(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.e(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.f(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.a(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.b(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.c(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.d(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.e(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.f(), CSSPrimitiveValue::CSS_NUMBER));
+    } else {
+        transformVal = WebKitCSSTransformValue::create(WebKitCSSTransformValue::Matrix3DTransformOperation);
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m11(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m12(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m13(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m14(), CSSPrimitiveValue::CSS_NUMBER));
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m21(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m22(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m23(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m24(), CSSPrimitiveValue::CSS_NUMBER));
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m31(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m32(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m33(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m34(), CSSPrimitiveValue::CSS_NUMBER));
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m41(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m42(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m43(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m44(), CSSPrimitiveValue::CSS_NUMBER));
+    }
 
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     list->append(transformVal);
@@ -495,11 +538,63 @@ void CSSComputedStyleDeclaration::setCssText(const String&, ExceptionCode& ec)
     ec = NO_MODIFICATION_ALLOWED_ERR;
 }
 
+static int cssIdentifierForFontSizeKeyword(int keywordSize)
+{
+    ASSERT_ARG(keywordSize, keywordSize);
+    ASSERT_ARG(keywordSize, keywordSize <= 8);
+    return CSSValueXxSmall + keywordSize - 1;
+}
+
+PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringKeyword() const
+{
+    Node* node = m_node.get();
+    if (!node)
+        return 0;
+
+    node->document()->updateLayoutIgnorePendingStylesheets();
+
+    RefPtr<RenderStyle> style = node->computedStyle();
+    if (!style)
+        return 0;
+
+    if (int keywordSize = style->fontDescription().keywordSize())
+        return CSSPrimitiveValue::createIdentifier(cssIdentifierForFontSizeKeyword(keywordSize));
+
+    return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID) const
 {
     return getPropertyCSSValue(propertyID, UpdateLayout);
 }
 
+static int identifierForFamily(const AtomicString& family)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, cursiveFamily, ("-webkit-cursive")); 
+    DEFINE_STATIC_LOCAL(AtomicString, fantasyFamily, ("-webkit-fantasy")); 
+    DEFINE_STATIC_LOCAL(AtomicString, monospaceFamily, ("-webkit-monospace")); 
+    DEFINE_STATIC_LOCAL(AtomicString, sansSerifFamily, ("-webkit-sans-serif")); 
+    DEFINE_STATIC_LOCAL(AtomicString, serifFamily, ("-webkit-serif")); 
+    if (family == cursiveFamily)
+        return CSSValueCursive;
+    if (family == fantasyFamily)
+        return CSSValueFantasy;
+    if (family == monospaceFamily)
+        return CSSValueMonospace;
+    if (family == sansSerifFamily)
+        return CSSValueSansSerif;
+    if (family == serifFamily)
+        return CSSValueSerif;
+    return 0;
+}
+
+static PassRefPtr<CSSPrimitiveValue> valueForFamily(const AtomicString& family)
+{
+    if (int familyIdentifier = identifierForFamily(family))
+        return CSSPrimitiveValue::createIdentifier(familyIdentifier);
+    return CSSPrimitiveValue::create(family.string(), CSSPrimitiveValue::CSS_STRING);
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -512,7 +607,11 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
 
     RenderObject* renderer = node->renderer();
 
-    RenderStyle* style = node->computedStyle();
+    RefPtr<RenderStyle> style;
+    if (renderer && hasCompositedLayer(renderer) && AnimationController::supportsAcceleratedAnimationOfProperty(static_cast<CSSPropertyID>(propertyID)))
+        style = renderer->animation()->getAnimatedStyleForRenderer(renderer);
+    else
+       style = node->computedStyle();
     if (!style)
         return 0;
 
@@ -572,13 +671,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitBorderVerticalSpacing:
             return CSSPrimitiveValue::create(style->verticalBorderSpacing(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyBorderTopColor:
-            return currentColorOrValidColor(style, style->borderTopColor());
+            return currentColorOrValidColor(style.get(), style->borderTopColor());
         case CSSPropertyBorderRightColor:
-            return currentColorOrValidColor(style, style->borderRightColor());
+            return currentColorOrValidColor(style.get(), style->borderRightColor());
         case CSSPropertyBorderBottomColor:
-            return currentColorOrValidColor(style, style->borderBottomColor());
+            return currentColorOrValidColor(style.get(), style->borderBottomColor());
         case CSSPropertyBorderLeftColor:
-            return currentColorOrValidColor(style, style->borderLeftColor());
+            return currentColorOrValidColor(style.get(), style->borderLeftColor());
         case CSSPropertyBorderTopStyle:
             return CSSPrimitiveValue::create(style->borderTopStyle());
         case CSSPropertyBorderRightStyle:
@@ -596,7 +695,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyBorderLeftWidth:
             return CSSPrimitiveValue::create(style->borderLeftWidth(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyBottom:
-            return getPositionOffsetValue(style, CSSPropertyBottom);
+            return getPositionOffsetValue(style.get(), CSSPropertyBottom);
         case CSSPropertyWebkitBoxAlign:
             return CSSPrimitiveValue::create(style->boxAlign());
         case CSSPropertyWebkitBoxDirection:
@@ -638,7 +737,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
             return CSSPrimitiveValue::create(style->columnGap(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyWebkitColumnRuleColor:
-            return currentColorOrValidColor(style, style->columnRuleColor());
+            return currentColorOrValidColor(style.get(), style->columnRuleColor());
         case CSSPropertyWebkitColumnRuleStyle:
             return CSSPrimitiveValue::create(style->columnRuleStyle());
         case CSSPropertyWebkitColumnRuleWidth:
@@ -676,9 +775,15 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->emptyCells());
         case CSSPropertyFloat:
             return CSSPrimitiveValue::create(style->floating());
-        case CSSPropertyFontFamily:
-            // FIXME: This only returns the first family.
-            return CSSPrimitiveValue::create(style->fontDescription().family().family().string(), CSSPrimitiveValue::CSS_STRING);
+        case CSSPropertyFontFamily: {
+            const FontFamily& firstFamily = style->fontDescription().family();
+            if (!firstFamily.next())
+                return valueForFamily(firstFamily.family());
+            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+            for (const FontFamily* family = &firstFamily; family; family = family->next())
+                list->append(valueForFamily(family->family()));
+            return list.release();
+        }
         case CSSPropertyFontSize:
             return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyWebkitBinding:
@@ -727,7 +832,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueBorder);
             return CSSPrimitiveValue::createIdentifier(CSSValueLines);
         case CSSPropertyLeft:
-            return getPositionOffsetValue(style, CSSPropertyLeft);
+            return getPositionOffsetValue(style.get(), CSSPropertyLeft);
         case CSSPropertyLetterSpacing:
             if (!style->letterSpacing())
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
@@ -757,24 +862,24 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyListStyleType:
             return CSSPrimitiveValue::create(style->listStyleType());
         case CSSPropertyMarginTop:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginTop(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginTop(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginTop());
         case CSSPropertyMarginRight:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginRight(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginRight(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginRight());
         case CSSPropertyMarginBottom:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginBottom(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginBottom(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginBottom());
         case CSSPropertyMarginLeft:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginLeft(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginLeft(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginLeft());
         case CSSPropertyWebkitMarqueeDirection:
             return CSSPrimitiveValue::create(style->marqueeDirection());
@@ -844,7 +949,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyOrphans:
             return CSSPrimitiveValue::create(style->orphans(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyOutlineColor:
-            return currentColorOrValidColor(style, style->outlineColor());
+            return currentColorOrValidColor(style.get(), style->outlineColor());
         case CSSPropertyOutlineStyle:
             if (style->outlineStyleIsAuto())
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
@@ -858,20 +963,20 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyOverflowY:
             return CSSPrimitiveValue::create(style->overflowY());
         case CSSPropertyPaddingTop:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingTop(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingTop(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingTop());
         case CSSPropertyPaddingRight:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingRight(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingRight(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingRight());
         case CSSPropertyPaddingBottom:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingBottom(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingBottom(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingBottom());
         case CSSPropertyPaddingLeft:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingLeft(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingLeft(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingLeft());
         case CSSPropertyPageBreakAfter:
             return CSSPrimitiveValue::create(style->pageBreakAfter());
@@ -887,7 +992,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyPosition:
             return CSSPrimitiveValue::create(style->position());
         case CSSPropertyRight:
-            return getPositionOffsetValue(style, CSSPropertyRight);
+            return getPositionOffsetValue(style.get(), CSSPropertyRight);
         case CSSPropertyTableLayout:
             return CSSPrimitiveValue::create(style->tableLayout());
         case CSSPropertyTextAlign:
@@ -939,7 +1044,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(string, CSSPrimitiveValue::CSS_STRING);
         }
         case CSSPropertyWebkitTextFillColor:
-            return currentColorOrValidColor(style, style->textFillColor());
+            return currentColorOrValidColor(style.get(), style->textFillColor());
         case CSSPropertyTextIndent:
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
@@ -951,13 +1056,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
             return CSSPrimitiveValue::createIdentifier(CSSValueNone);
         case CSSPropertyWebkitTextStrokeColor:
-            return currentColorOrValidColor(style, style->textStrokeColor());
+            return currentColorOrValidColor(style.get(), style->textStrokeColor());
         case CSSPropertyWebkitTextStrokeWidth:
             return CSSPrimitiveValue::create(style->textStrokeWidth(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyTextTransform:
             return CSSPrimitiveValue::create(style->textTransform());
         case CSSPropertyTop:
-            return getPositionOffsetValue(style, CSSPropertyTop);
+            return getPositionOffsetValue(style.get(), CSSPropertyTop);
         case CSSPropertyUnicodeBidi:
             return CSSPrimitiveValue::create(style->unicodeBidi());
         case CSSPropertyVerticalAlign:
@@ -1075,7 +1180,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (t) {
                 for (size_t i = 0; i < t->size(); ++i) {
                     int iterationCount = t->animation(i)->iterationCount();
-                    if (iterationCount < 0)
+                    if (iterationCount == Animation::IterationCountInfinite)
                         list->append(CSSPrimitiveValue::createIdentifier(CSSValueInfinite));
                     else
                         list->append(CSSPrimitiveValue::create(iterationCount, CSSPrimitiveValue::CSS_NUMBER));
@@ -1095,25 +1200,12 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 list->append(CSSPrimitiveValue::createIdentifier(CSSValueNone));
             return list.release();
         }
-        case CSSPropertyWebkitAnimationPlayState: {
-            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-            const AnimationList* t = style->animations();
-            if (t) {
-                for (size_t i = 0; i < t->size(); ++i) {
-                    int prop = t->animation(i)->playState();
-                    if (prop == AnimPlayStatePlaying)
-                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueRunning));
-                    else
-                        list->append(CSSPrimitiveValue::createIdentifier(CSSValuePaused));
-                }
-            } else
-                list->append(CSSPrimitiveValue::createIdentifier(CSSValueRunning));
-            return list.release();
-        }
         case CSSPropertyWebkitAnimationTimingFunction:
             return getTimingFunctionValue(style->animations());
         case CSSPropertyWebkitAppearance:
             return CSSPrimitiveValue::create(style->appearance());
+        case CSSPropertyWebkitBackfaceVisibility:
+            return CSSPrimitiveValue::createIdentifier((style->backfaceVisibility() == BackfaceVisibilityHidden) ? CSSValueHidden : CSSValueVisible);
         case CSSPropertyWebkitBorderImage:
             return valueForNinePieceImage(style->borderImage());
         case CSSPropertyWebkitMaskBoxImage:
@@ -1125,6 +1217,23 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->marginBottomCollapse());
         case CSSPropertyWebkitMarginTopCollapse:
             return CSSPrimitiveValue::create(style->marginTopCollapse());
+        case CSSPropertyWebkitPerspective:
+            if (!style->hasPerspective())
+                return CSSPrimitiveValue::createIdentifier(CSSValueNone);
+            return CSSPrimitiveValue::create(style->perspective(), CSSPrimitiveValue::CSS_NUMBER);
+        case CSSPropertyWebkitPerspectiveOrigin: {
+            RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+            if (renderer) {
+                IntRect box = sizingBox(renderer);
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginX().calcMinValue(box.width()), CSSPrimitiveValue::CSS_PX));
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginY().calcMinValue(box.height()), CSSPrimitiveValue::CSS_PX));
+            }
+            else {
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginX()));
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginY()));
+            }
+            return list.release();
+        }
         case CSSPropertyWebkitRtlOrdering:
             if (style->visuallyOrdered())
                 return CSSPrimitiveValue::createIdentifier(CSSValueVisual);
@@ -1141,32 +1250,36 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getBorderRadiusCornerValue(style->borderTopLeftRadius());
         case CSSPropertyWebkitBorderTopRightRadius:
             return getBorderRadiusCornerValue(style->borderTopRightRadius());
-        case CSSPropertyClip:
-        {
-            if (style->hasClip()) {
-                RefPtr<Rect> rect = Rect::create();
-                rect->setTop(CSSPrimitiveValue::create(style->clip().top().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setRight(CSSPrimitiveValue::create(style->clip().right().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setBottom(CSSPrimitiveValue::create(style->clip().bottom().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setLeft(CSSPrimitiveValue::create(style->clip().left().value(), CSSPrimitiveValue::CSS_PX));
-                return CSSPrimitiveValue::create(rect.release());
-            }
-            return 0;
+        case CSSPropertyClip: {
+            if (!style->hasClip())
+                return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
+            RefPtr<Rect> rect = Rect::create();
+            rect->setTop(CSSPrimitiveValue::create(style->clip().top().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setRight(CSSPrimitiveValue::create(style->clip().right().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setBottom(CSSPrimitiveValue::create(style->clip().bottom().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setLeft(CSSPrimitiveValue::create(style->clip().left().value(), CSSPrimitiveValue::CSS_PX));
+            return CSSPrimitiveValue::create(rect.release());
         }
         case CSSPropertyWebkitTransform:
-            return computedTransform(renderer);
+            return computedTransform(renderer, style.get());
         case CSSPropertyWebkitTransformOrigin: {
             RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
             if (renderer) {
                 IntRect box = sizingBox(renderer);
                 list->append(CSSPrimitiveValue::create(style->transformOriginX().calcMinValue(box.width()), CSSPrimitiveValue::CSS_PX));
                 list->append(CSSPrimitiveValue::create(style->transformOriginY().calcMinValue(box.height()), CSSPrimitiveValue::CSS_PX));
+                if (style->transformOriginZ() != 0)
+                    list->append(CSSPrimitiveValue::create(style->transformOriginZ(), CSSPrimitiveValue::CSS_PX));
             } else {
                 list->append(CSSPrimitiveValue::create(style->transformOriginX()));
                 list->append(CSSPrimitiveValue::create(style->transformOriginY()));
+                if (style->transformOriginZ() != 0)
+                    list->append(CSSPrimitiveValue::create(style->transformOriginZ(), CSSPrimitiveValue::CSS_PX));
             }
             return list.release();
         }
+        case CSSPropertyWebkitTransformStyle:
+            return CSSPrimitiveValue::createIdentifier((style->transformStyle3D() == TransformStyle3DPreserve3D) ? CSSValuePreserve3d : CSSValueFlat);
         case CSSPropertyWebkitTransitionDelay:
             return getDelayValue(style->transitions());
         case CSSPropertyWebkitTransitionDuration:
@@ -1194,6 +1307,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getTimingFunctionValue(style->transitions());
         case CSSPropertyPointerEvents:
             return CSSPrimitiveValue::create(style->pointerEvents());
+
+        /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
         case CSSPropertyBorder:
         case CSSPropertyBorderBottom:
@@ -1203,27 +1318,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyBorderStyle:
         case CSSPropertyBorderTop:
         case CSSPropertyBorderWidth:
-        case CSSPropertyContent:
-        case CSSPropertyCounterIncrement:
-        case CSSPropertyCounterReset:
         case CSSPropertyFont:
-        case CSSPropertyFontStretch:
         case CSSPropertyListStyle:
         case CSSPropertyMargin:
-        case CSSPropertyOutline:
-        case CSSPropertyOutlineOffset:
         case CSSPropertyPadding:
-        case CSSPropertyPage:
-        case CSSPropertyQuotes:
-        case CSSPropertyScrollbar3dlightColor:
-        case CSSPropertyScrollbarArrowColor:
-        case CSSPropertyScrollbarDarkshadowColor:
-        case CSSPropertyScrollbarFaceColor:
-        case CSSPropertyScrollbarHighlightColor:
-        case CSSPropertyScrollbarShadowColor:
-        case CSSPropertyScrollbarTrackColor:
-        case CSSPropertySrc: // Only used in @font-face rules.
-        case CSSPropertySize:
+            break;
+
+        /* Unimplemented CSS 3 properties (including CSS3 shorthand properties) */
         case CSSPropertyTextLineThrough:
         case CSSPropertyTextLineThroughColor:
         case CSSPropertyTextLineThroughMode:
@@ -1240,7 +1341,26 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyTextUnderlineMode:
         case CSSPropertyTextUnderlineStyle:
         case CSSPropertyTextUnderlineWidth:
-        case CSSPropertyUnicodeRange: // Only used in @font-face rules.
+            break;
+
+        /* Unimplemented @font-face properties */
+        case CSSPropertyFontStretch:
+        case CSSPropertySrc:
+        case CSSPropertyUnicodeRange:
+            break;
+
+        /* Other unimplemented properties */
+        case CSSPropertyContent: // FIXME: needs implementation, bug 23668
+        case CSSPropertyCounterIncrement:
+        case CSSPropertyCounterReset:
+        case CSSPropertyOutline: // FIXME: needs implementation
+        case CSSPropertyOutlineOffset: // FIXME: needs implementation
+        case CSSPropertyPage: // for @page
+        case CSSPropertyQuotes: // FIXME: needs implementation
+        case CSSPropertySize: // for @page
+            break;
+
+        /* Unimplemented -webkit- properties */
         case CSSPropertyWebkitAnimation:
         case CSSPropertyWebkitBorderRadius:
         case CSSPropertyWebkitColumns:
@@ -1251,10 +1371,14 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitMarqueeSpeed:
         case CSSPropertyWebkitMask:
         case CSSPropertyWebkitPaddingStart:
+        case CSSPropertyWebkitPerspectiveOriginX:
+        case CSSPropertyWebkitPerspectiveOriginY:
         case CSSPropertyWebkitTextStroke:
+        case CSSPropertyWebkitTransformOriginX:
+        case CSSPropertyWebkitTransformOriginY:
+        case CSSPropertyWebkitTransformOriginZ:
         case CSSPropertyWebkitTransition:
         case CSSPropertyWebkitVariableDeclarationBlock:
-            // FIXME: The above are unimplemented.
             break;
 #if ENABLE(SVG)
         // FIXME: This default case ruins the point of using an enum for
@@ -1318,7 +1442,7 @@ String CSSComputedStyleDeclaration::item(unsigned i) const
 // This is the list of properties we want to copy in the copyInheritableProperties() function.
 // It is the intersection of the list of inherited CSS properties and the
 // properties for which we have a computed implementation in this file.
-const int inheritableProperties[] = {
+static const int inheritableProperties[] = {
     CSSPropertyBorderCollapse,
     CSSPropertyColor,
     CSSPropertyFontFamily,
@@ -1344,7 +1468,7 @@ const int inheritableProperties[] = {
     CSSPropertyWebkitTextStrokeWidth,
 };
 
-const unsigned numInheritableProperties = sizeof(inheritableProperties) / sizeof(inheritableProperties[0]);
+static const unsigned numInheritableProperties = sizeof(inheritableProperties) / sizeof(inheritableProperties[0]);
 
 void CSSComputedStyleDeclaration::removeComputedInheritablePropertiesFrom(CSSMutableStyleDeclaration* declaration)
 {
@@ -1364,6 +1488,8 @@ PassRefPtr<CSSMutableStyleDeclaration> CSSComputedStyleDeclaration::copyInherita
         if (!m_node->computedStyle()->textStrokeColor().isValid())
             style->removeProperty(CSSPropertyWebkitTextStrokeColor, ec);
         ASSERT(ec == 0);
+        if (int keywordSize = m_node->computedStyle()->fontDescription().keywordSize())
+            style->setProperty(CSSPropertyFontSize, cssIdentifierForFontSizeKeyword(keywordSize));
     }
     return style.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
index 487c02b5d2..23244e2a92 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
@@ -50,6 +50,7 @@ public:
     virtual PassRefPtr<CSSMutableStyleDeclaration> makeMutable();
 
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID, EUpdateLayout) const;
+    PassRefPtr<CSSValue> getFontSizeCSSValuePreferringKeyword() const;
 #if ENABLE(SVG)
     PassRefPtr<CSSValue> getSVGPropertyCSSValue(int propertyID, EUpdateLayout) const;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
index ddd3e6b46d..84ac5654fc 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
@@ -27,6 +27,7 @@
 #include "PlatformString.h"
 #include "RenderStyle.h"
 #include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(SVG)
 #include "SVGCursorElement.h"
@@ -79,7 +80,9 @@ CSSCursorImageValue::~CSSCursorImageValue()
 
 bool CSSCursorImageValue::updateIfSVGCursorIsUsed(Element* element)
 {
-#if ENABLE(SVG)
+#if !ENABLE(SVG)
+    UNUSED_PARAM(element);
+#else
     if (!element || !element->isSVGElement())
         return false;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
index 5e4b69cd84..111cea29ec 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
@@ -107,8 +107,8 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
 #else
     if (!m_font) {
 #endif
-        FontPlatformData* data = FontCache::getCachedFontPlatformData(fontDescription, m_string);
-        SimpleFontData* fontData = FontCache::getCachedFontData(data);
+        FontPlatformData* data = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
+        SimpleFontData* fontData = fontCache()->getCachedFontData(data);
 
         // We're local. Just return a SimpleFontData from the normal cache.
         return fontData;
@@ -179,9 +179,9 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
         if (DocLoader* docLoader = fontSelector->docLoader())
             m_font->beginLoadIfNeeded(docLoader);
         // FIXME: m_string is a URL so it makes no sense to pass it as a family name.
-        FontPlatformData* tempData = FontCache::getCachedFontPlatformData(fontDescription, m_string);
+        FontPlatformData* tempData = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
         if (!tempData)
-            tempData = FontCache::getLastResortFallbackFont(fontDescription);
+            tempData = fontCache()->getLastResortFallbackFont(fontDescription);
         fontData.set(new SimpleFontData(*tempData, true, true));
     }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
index 714be47ecf..35bc876dda 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
@@ -65,12 +65,12 @@ CSSFontSelector::CSSFontSelector(Document* document)
     // seem to be any such guarantee.
 
     ASSERT(m_document);
-    FontCache::addClient(this);
+    fontCache()->addClient(this);
 }
 
 CSSFontSelector::~CSSFontSelector()
 {
-    FontCache::removeClient(this);
+    fontCache()->removeClient(this);
     deleteAllValues(m_fontFaces);
     deleteAllValues(m_locallyInstalledFontFaces);
     deleteAllValues(m_fonts);
@@ -93,7 +93,7 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
     RefPtr<CSSValue> fontFamily = style->getPropertyCSSValue(CSSPropertyFontFamily);
     RefPtr<CSSValue> src = style->getPropertyCSSValue(CSSPropertySrc);
     RefPtr<CSSValue> unicodeRange = style->getPropertyCSSValue(CSSPropertyUnicodeRange);
-    if (!fontFamily || !src || !fontFamily->isValueList() || !src->isValueList() || unicodeRange && !unicodeRange->isValueList())
+    if (!fontFamily || !src || !fontFamily->isValueList() || !src->isValueList() || (unicodeRange && !unicodeRange->isValueList()))
         return;
 
     CSSValueList* familyList = static_cast<CSSValueList*>(fontFamily.get());
@@ -233,10 +233,7 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
     int srcLength = srcList->length();
 
     bool foundLocal = false;
-
-#if ENABLE(SVG_FONTS)
     bool foundSVGFont = false;
-#endif
 
     for (int i = 0; i < srcLength; i++) {
         // An item in the list either specifies a string (local font name) or a URL (remote font to download).
@@ -246,9 +243,10 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
 #if ENABLE(SVG_FONTS)
         foundSVGFont = item->isSVGFontFaceSrc() || item->svgFontFaceElement();
 #endif
-
         if (!item->isLocal()) {
-            if (item->isSupportedFormat() && m_document) {
+            Settings* settings = m_document ? m_document->frame() ? m_document->frame()->settings() : 0 : 0;
+            bool allowDownloading = foundSVGFont || (settings && settings->downloadableBinaryFontsEnabled());
+            if (allowDownloading && item->isSupportedFormat() && m_document) {
                 CachedFont* cachedFont = m_document->docLoader()->requestFont(item->resource());
                 if (cachedFont) {
 #if ENABLE(SVG_FONTS)
@@ -338,7 +336,7 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
             Vector<RefPtr<CSSFontFace> >* familyLocallyInstalledFaces;
 
             Vector<unsigned> locallyInstalledFontsTraitsMasks;
-            FontCache::getTraitsInFamily(familyName, locallyInstalledFontsTraitsMasks);
+            fontCache()->getTraitsInFamily(familyName, locallyInstalledFontsTraitsMasks);
             unsigned numLocallyInstalledFaces = locallyInstalledFontsTraitsMasks.size();
             if (numLocallyInstalledFaces) {
                 familyLocallyInstalledFaces = new Vector<RefPtr<CSSFontFace> >;
@@ -397,7 +395,7 @@ static FontData* fontDataForGenericFamily(Document* document, const FontDescript
         genericFamily = settings->standardFontFamily();
 
     if (!genericFamily.isEmpty())
-        return FontCache::getCachedFontData(FontCache::getCachedFontPlatformData(fontDescription, genericFamily));
+        return fontCache()->getCachedFontData(fontCache()->getCachedFontPlatformData(fontDescription, genericFamily));
 
     return 0;
 }
@@ -433,7 +431,9 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
     // or the next darker otherwise."
     // For '400', we made up our own rule (which then '500' follows).
 
-    static const FontTraitsMask weightFallbackRules[9][8] = {
+    static const unsigned fallbackRuleSets = 9;
+    static const unsigned rulesPerSet = 8;
+    static const FontTraitsMask weightFallbackRuleSets[fallbackRuleSets][rulesPerSet] = {
         { FontWeight200Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight100Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight200Mask, FontWeight100Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
@@ -445,14 +445,16 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
         { FontWeight800Mask, FontWeight700Mask, FontWeight600Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask }
     };
 
-    const FontTraitsMask* weightFallbackRule = weightFallbackRules[0];
+    unsigned ruleSetIndex = 0;
     unsigned w = FontWeight100Bit;
     while (!(desiredTraitsMaskForComparison & (1 << w))) {
         w++;
-        weightFallbackRule += 8;
+        ruleSetIndex++;
     }
 
-    for (unsigned i = 0; i < 8; ++i) {
+    ASSERT(ruleSetIndex < fallbackRuleSets);
+    const FontTraitsMask* weightFallbackRule = weightFallbackRuleSets[ruleSetIndex];
+    for (unsigned i = 0; i < rulesPerSet; ++i) {
         if (secondTraitsMask & weightFallbackRule[i])
             return false;
         if (firstTraitsMask & weightFallbackRule[i])
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
index 9ee9c93a22..4706521aa4 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+++ b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
@@ -26,6 +26,7 @@
 
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
+#include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSRuleList.h"
 #include "CSSSelector.h"
@@ -94,6 +95,8 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %expect 49
 
+%nonassoc LOWEST_PREC
+
 %left UNIMPORTANT_TOK
 
 %token WHITESPACE SGML_CD
@@ -349,7 +352,7 @@ maybe_charset:
 
 closing_brace:
     '}'
-  | %prec maybe_sgml TOKEN_EOF
+  | %prec LOWEST_PREC TOKEN_EOF
   ;
 
 charset:
@@ -1095,6 +1098,11 @@ pseudo:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     }
     | ':' ':' IDENT {
@@ -1109,6 +1117,11 @@ pseudo:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     }
     // used by :nth-*(ax+b)
@@ -1168,7 +1181,7 @@ pseudo:
     }
     // used by :not
     | ':' NOTFUNCTION maybe_space simple_selector maybe_space ')' {
-        if (!$4)
+        if (!$4 || $4->simpleSelector() || $4->tagHistory())
             $$ = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -1355,10 +1368,10 @@ term:
       $$.string = $1;
   }
   /* We might need to actually parse the number from a dimension, but we can't just put something that uses $$.string into unary_term. */
-  | DIMEN maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_DIMENSION }
-  | unary_operator DIMEN maybe_space { $$.id = 0; $$.string = $2; $$.unit = CSSPrimitiveValue::CSS_DIMENSION }
+  | DIMEN maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_DIMENSION; }
+  | unary_operator DIMEN maybe_space { $$.id = 0; $$.string = $2; $$.unit = CSSPrimitiveValue::CSS_DIMENSION; }
   | URI maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_URI; }
-  | UNICODERANGE maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_UNICODE_RANGE }
+  | UNICODERANGE maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; }
   | hexcolor { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; }
   | '#' maybe_space { $$.id = 0; $$.string = CSSParserString(); $$.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; } /* Handle error case: "color: #;" */
   /* FIXME: according to the specs a function can have a unary_operator in front. I know no case where this makes sense */
@@ -1368,7 +1381,9 @@ term:
   | variable_reference maybe_space {
       $$ = $1;
   }
-  | '%' maybe_space {} /* Handle width: %; */
+  | '%' maybe_space { /* Handle width: %; */
+      $$.id = 0; $$.unit = 0;
+  }
   ;
 
 unary_term:
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
index 6b12ced469..67b7da177d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -24,6 +24,7 @@
 #include "CSSImageValue.h"
 #include "CSSParser.h"
 #include "CSSProperty.h"
+#include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
 #include "CSSStyleSheet.h"
@@ -31,7 +32,6 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "StyledElement.h"
-#include <wtf/StdLibExtras.h>
 
 using namespace std;
 
@@ -81,7 +81,7 @@ CSSMutableStyleDeclaration::CSSMutableStyleDeclaration(CSSRule* parent, const CS
     , m_iteratorCount(0)
 #endif
 {
-    m_properties.reserveCapacity(numProperties);
+    m_properties.reserveInitialCapacity(numProperties);
     for (int i = 0; i < numProperties; ++i) {
         ASSERT(properties[i]);
         m_properties.append(*properties[i]);
@@ -217,9 +217,10 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
             return getLayeredShorthandValue(properties, 6);
         }
         case CSSPropertyWebkitTransformOrigin: {
-            const int properties[2] = { CSSPropertyWebkitTransformOriginX,
-                                        CSSPropertyWebkitTransformOriginY };
-            return getShorthandValue(properties, 2);
+            const int properties[3] = { CSSPropertyWebkitTransformOriginX,
+                                        CSSPropertyWebkitTransformOriginY,
+                                        CSSPropertyWebkitTransformOriginZ };
+            return getShorthandValue(properties, 3);
         }
         case CSSPropertyWebkitTransition: {
             const int properties[4] = { CSSPropertyWebkitTransitionProperty, CSSPropertyWebkitTransitionDuration,
@@ -363,207 +364,9 @@ PassRefPtr<CSSValue> CSSMutableStyleDeclaration::getPropertyCSSValue(int propert
     return property ? property->value() : 0;
 }
 
-struct PropertyLonghand {
-    PropertyLonghand()
-        : m_properties(0)
-        , m_length(0)
-    {
-    }
-
-    PropertyLonghand(const int* firstProperty, unsigned numProperties)
-        : m_properties(firstProperty)
-        , m_length(numProperties)
-    {
-    }
-
-    const int* properties() const { return m_properties; }
-    unsigned length() const { return m_length; }
-
-private:
-    const int* m_properties;
-    unsigned m_length;
-};
-    
-typedef HashMap<int, PropertyLonghand> ShorthandMap;
-
-static void initShorthandMap(ShorthandMap& shorthandMap)
-{
-    #define SET_SHORTHAND_MAP_ENTRY(map, propID, array) \
-        map.set(propID, PropertyLonghand(array, sizeof(array) / sizeof(array[0])))
-
-    // FIXME: The 'font' property has "shorthand nature" but is not parsed as a shorthand.
-
-    // Do not change the order of the following four shorthands, and keep them together.
-    static const int borderProperties[4][3] = {
-        { CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth },
-        { CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth },
-        { CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth },
-        { CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth }
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderTop, borderProperties[0]);
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderRight, borderProperties[1]);
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderBottom, borderProperties[2]);
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderLeft, borderProperties[3]);
-
-    shorthandMap.set(CSSPropertyBorder, PropertyLonghand(borderProperties[0], sizeof(borderProperties) / sizeof(borderProperties[0][0])));
-
-    static const int borderColorProperties[] = {
-        CSSPropertyBorderTopColor,
-        CSSPropertyBorderRightColor,
-        CSSPropertyBorderBottomColor,
-        CSSPropertyBorderLeftColor
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderColor, borderColorProperties);
-
-    static const int borderStyleProperties[] = {
-        CSSPropertyBorderTopStyle,
-        CSSPropertyBorderRightStyle,
-        CSSPropertyBorderBottomStyle,
-        CSSPropertyBorderLeftStyle
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderStyle, borderStyleProperties);
-
-    static const int borderWidthProperties[] = {
-        CSSPropertyBorderTopWidth,
-        CSSPropertyBorderRightWidth,
-        CSSPropertyBorderBottomWidth,
-        CSSPropertyBorderLeftWidth
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderWidth, borderWidthProperties);
-
-    static const int backgroundPositionProperties[] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundPosition, backgroundPositionProperties);
-
-    static const int borderSpacingProperties[] = { CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderSpacing, borderSpacingProperties);
-
-    static const int listStyleProperties[] = {
-        CSSPropertyListStyleImage,
-        CSSPropertyListStylePosition,
-        CSSPropertyListStyleType
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyListStyle, listStyleProperties);
-
-    static const int marginProperties[] = {
-        CSSPropertyMarginTop,
-        CSSPropertyMarginRight,
-        CSSPropertyMarginBottom,
-        CSSPropertyMarginLeft
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyMargin, marginProperties);
-
-    static const int marginCollapseProperties[] = { CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBottomCollapse };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarginCollapse, marginCollapseProperties);
-
-    static const int marqueeProperties[] = {
-        CSSPropertyWebkitMarqueeDirection,
-        CSSPropertyWebkitMarqueeIncrement,
-        CSSPropertyWebkitMarqueeRepetition,
-        CSSPropertyWebkitMarqueeStyle,
-        CSSPropertyWebkitMarqueeSpeed
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarquee, marqueeProperties);
-
-    static const int outlineProperties[] = {
-        CSSPropertyOutlineColor,
-        CSSPropertyOutlineOffset,
-        CSSPropertyOutlineStyle,
-        CSSPropertyOutlineWidth
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOutline, outlineProperties);
-
-    static const int paddingProperties[] = {
-        CSSPropertyPaddingTop,
-        CSSPropertyPaddingRight,
-        CSSPropertyPaddingBottom,
-        CSSPropertyPaddingLeft
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyPadding, paddingProperties);
-
-    static const int textStrokeProperties[] = { CSSPropertyWebkitTextStrokeColor, CSSPropertyWebkitTextStrokeWidth };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTextStroke, textStrokeProperties);
-
-    static const int backgroundProperties[] = {
-        CSSPropertyBackgroundAttachment,
-        CSSPropertyWebkitBackgroundClip,
-        CSSPropertyBackgroundColor,
-        CSSPropertyBackgroundImage,
-        CSSPropertyWebkitBackgroundOrigin,
-        CSSPropertyBackgroundPositionX,
-        CSSPropertyBackgroundPositionY,
-        CSSPropertyBackgroundRepeat,
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackground, backgroundProperties);
-
-    static const int columnsProperties[] = { CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumns, columnsProperties);
-
-    static const int columnRuleProperties[] = {
-        CSSPropertyWebkitColumnRuleColor,
-        CSSPropertyWebkitColumnRuleStyle,
-        CSSPropertyWebkitColumnRuleWidth
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumnRule, columnRuleProperties);
-
-    static const int overflowProperties[] = { CSSPropertyOverflowX, CSSPropertyOverflowY };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOverflow, overflowProperties);
-
-    static const int borderRadiusProperties[] = {
-        CSSPropertyWebkitBorderTopRightRadius,
-        CSSPropertyWebkitBorderTopLeftRadius,
-        CSSPropertyWebkitBorderBottomLeftRadius,
-        CSSPropertyWebkitBorderBottomRightRadius
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitBorderRadius, borderRadiusProperties);
-
-    static const int maskPositionProperties[] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskPosition, maskPositionProperties);
-
-    static const int maskProperties[] = {
-        CSSPropertyWebkitMaskAttachment,
-        CSSPropertyWebkitMaskClip,
-        CSSPropertyWebkitMaskImage,
-        CSSPropertyWebkitMaskOrigin,
-        CSSPropertyWebkitMaskPositionX,
-        CSSPropertyWebkitMaskPositionY,
-        CSSPropertyWebkitMaskRepeat,
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMask, maskProperties);
-
-    static const int animationProperties[] = {
-        CSSPropertyWebkitAnimationName,
-        CSSPropertyWebkitAnimationDuration,
-        CSSPropertyWebkitAnimationTimingFunction,
-        CSSPropertyWebkitAnimationDelay,
-        CSSPropertyWebkitAnimationIterationCount,
-        CSSPropertyWebkitAnimationDirection
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitAnimation, animationProperties);
-
-    static const int transitionProperties[] = {
-        CSSPropertyWebkitTransitionProperty,
-        CSSPropertyWebkitTransitionDuration,
-        CSSPropertyWebkitTransitionTimingFunction,
-        CSSPropertyWebkitTransitionDelay
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransition, transitionProperties);
-
-    static const int transformOriginProperties[] = {
-        CSSPropertyWebkitTransformOriginX,
-        CSSPropertyWebkitTransformOriginY
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransformOrigin, transformOriginProperties);
-    
-    #undef SET_SHORTHAND_MAP_ENTRY
-}
-
 bool CSSMutableStyleDeclaration::removeShorthandProperty(int propertyID, bool notifyChanged) 
 {
-    DEFINE_STATIC_LOCAL(ShorthandMap, shorthandMap, ());
-    if (shorthandMap.isEmpty())
-        initShorthandMap(shorthandMap);
-
-    PropertyLonghand longhand = shorthandMap.get(propertyID);
+    CSSPropertyLonghand longhand = longhandForProperty(propertyID);
     if (longhand.length()) {
         removePropertiesInSet(longhand.properties(), longhand.length(), notifyChanged);
         return true;
@@ -594,12 +397,12 @@ String CSSMutableStyleDeclaration::removeProperty(int propertyID, bool notifyCha
     m_properties.remove(foundProperty - m_properties.data());
 
     if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 
     return value;
 }
 
-void CSSMutableStyleDeclaration::setChanged()
+void CSSMutableStyleDeclaration::setNeedsStyleRecalc()
 {
     if (m_node) {
         // FIXME: Ideally, this should be factored better and there
@@ -607,10 +410,10 @@ void CSSMutableStyleDeclaration::setChanged()
         // for inline style declarations that handles this
         bool isInlineStyleDeclaration = m_node->isStyledElement() && this == static_cast<StyledElement*>(m_node)->inlineStyleDecl();
         if (isInlineStyleDeclaration) {
-            m_node->setChanged(InlineStyleChange);
+            m_node->setNeedsStyleRecalc(InlineStyleChange);
             static_cast<StyledElement*>(m_node)->invalidateStyleAttribute();
         } else
-            m_node->setChanged(FullStyleChange);
+            m_node->setNeedsStyleRecalc(FullStyleChange);
         return;
     }
 
@@ -671,7 +474,7 @@ bool CSSMutableStyleDeclaration::setProperty(int propertyID, const String& value
         // CSS DOM requires raising SYNTAX_ERR here, but this is too dangerous for compatibility,
         // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
     } else if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 
     return success;
 }
@@ -695,7 +498,7 @@ bool CSSMutableStyleDeclaration::setProperty(int propertyID, int value, bool imp
     CSSProperty property(propertyID, CSSPrimitiveValue::createIdentifier(value), important);
     setPropertyInternal(property);
     if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
     return true;
 }
 
@@ -704,7 +507,7 @@ void CSSMutableStyleDeclaration::setStringProperty(int propertyId, const String
     ASSERT(!m_iteratorCount);
 
     setPropertyInternal(CSSProperty(propertyId, CSSPrimitiveValue::create(value, type), important));
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::setImageProperty(int propertyId, const String& url, bool important)
@@ -712,7 +515,7 @@ void CSSMutableStyleDeclaration::setImageProperty(int propertyId, const String&
     ASSERT(!m_iteratorCount);
 
     setPropertyInternal(CSSProperty(propertyId, CSSImageValue::create(url), important));
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::parseDeclaration(const String& styleDeclaration)
@@ -722,7 +525,7 @@ void CSSMutableStyleDeclaration::parseDeclaration(const String& styleDeclaration
     m_properties.clear();
     CSSParser parser(useStrictParsing());
     parser.parseDeclaration(this, styleDeclaration);
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::addParsedProperties(const CSSProperty* const* properties, int numProperties)
@@ -741,7 +544,7 @@ void CSSMutableStyleDeclaration::addParsedProperties(const CSSProperty* const* p
                 m_variableDependentValueCount++;
         }
     }
-    // FIXME: This probably should have a call to setChanged() if something changed. We may also wish to add
+    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
     // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
@@ -823,7 +626,7 @@ void CSSMutableStyleDeclaration::setCssText(const String& text, ExceptionCode& e
     CSSParser parser(useStrictParsing());
     parser.parseDeclaration(this, text);
     // FIXME: Detect syntax errors and set ec.
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::merge(CSSMutableStyleDeclaration* other, bool argOverridesOnConflict)
@@ -841,7 +644,7 @@ void CSSMutableStyleDeclaration::merge(CSSMutableStyleDeclaration* other, bool a
         } else
             m_properties.append(toMerge);
     }
-    // FIXME: This probably should have a call to setChanged() if something changed. We may also wish to add
+    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
     // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
@@ -899,8 +702,8 @@ void CSSMutableStyleDeclaration::removePropertiesInSet(const int* set, unsigned
     for (unsigned i = 0; i < length; ++i)
         toRemove.add(set[i]);
     
-    Vector<CSSProperty> newProperties;
-    newProperties.reserveCapacity(m_properties.size());
+    Vector<CSSProperty, 4> newProperties;
+    newProperties.reserveInitialCapacity(m_properties.size());
     
     unsigned size = m_properties.size();
     for (unsigned n = 0; n < size; ++n) {
@@ -917,7 +720,7 @@ void CSSMutableStyleDeclaration::removePropertiesInSet(const int* set, unsigned
     m_properties = newProperties;
     
     if (changed && notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 }
 
 PassRefPtr<CSSMutableStyleDeclaration> CSSMutableStyleDeclaration::makeMutable()
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h
index 9c84916230..5eb8a2747c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h
@@ -144,7 +144,7 @@ private:
 
     virtual PassRefPtr<CSSMutableStyleDeclaration> makeMutable();
 
-    void setChanged();
+    void setNeedsStyleRecalc();
 
     String getShorthandValue(const int* properties, int number) const;
     String getCommonValue(const int* properties, int number) const;
@@ -157,7 +157,7 @@ private:
     Vector<CSSProperty>::const_iterator findPropertyWithId(int propertyId) const;
     Vector<CSSProperty>::iterator findPropertyWithId(int propertyId);
 
-    Vector<CSSProperty> m_properties;
+    Vector<CSSProperty, 4> m_properties;
 
     Node* m_node;
     unsigned m_variableDependentValueCount : 24;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 36b86a45ba..2e8f3bb81f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -363,19 +363,21 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important)
 {
-    CSSProperty* prop = new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand);
+    auto_ptr<CSSProperty> prop(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand));
     if (m_numParsedProperties >= m_maxParsedProperties) {
         m_maxParsedProperties += 32;
+        if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
+            return;
         m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
                                                        m_maxParsedProperties * sizeof(CSSProperty*)));
     }
-    m_parsedProperties[m_numParsedProperties++] = prop;
+    m_parsedProperties[m_numParsedProperties++] = prop.release();
 }
 
 void CSSParser::rollbackLastProperties(int num)
 {
     ASSERT(num >= 0);
-    ASSERT(m_numParsedProperties >= num);
+    ASSERT(m_numParsedProperties >= static_cast<unsigned>(num));
 
     for (int i = 0; i < num; ++i)
         delete m_parsedProperties[--m_numParsedProperties];
@@ -383,7 +385,7 @@ void CSSParser::rollbackLastProperties(int num)
 
 void CSSParser::clearProperties()
 {
-    for (int i = 0; i < m_numParsedProperties; i++)
+    for (unsigned i = 0; i < m_numParsedProperties; i++)
         delete m_parsedProperties[i];
     m_numParsedProperties = 0;
     m_hasFontFaceOnlyValues = false;
@@ -621,7 +623,6 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyContent:              // [ <string> | <uri> | <counter> | attr(X) | open-quote |
         // close-quote | no-open-quote | no-close-quote ]+ | inherit
         return parseContent(propId, important);
-        break;
 
     case CSSPropertyWhiteSpace:          // normal | pre | nowrap | inherit
         if (id == CSSValueNormal ||
@@ -764,16 +765,6 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBorderVerticalSpacing:
         valid_primitive = validUnit(value, FLength|FNonNeg, m_strict);
         break;
-    case CSSPropertyScrollbarFaceColor:         // IE5.5
-    case CSSPropertyScrollbarShadowColor:       // IE5.5
-    case CSSPropertyScrollbarHighlightColor:    // IE5.5
-    case CSSPropertyScrollbar3dlightColor:      // IE5.5
-    case CSSPropertyScrollbarDarkshadowColor:   // IE5.5
-    case CSSPropertyScrollbarTrackColor:        // IE5.5
-    case CSSPropertyScrollbarArrowColor:        // IE5.5
-        if (m_strict)
-            break;
-        /* nobreak */
     case CSSPropertyOutlineColor:        // <color> | invert | inherit
         // Outline color has "invert" as additional keyword.
         // Also, we want to allow the special focus color even in strict parsing mode.
@@ -799,7 +790,7 @@ bool CSSParser::parseValue(int propId, bool important)
                                     // since we use this in our UA sheets.
         else if (id == CSSValueCurrentcolor)
             valid_primitive = true;
-        else if (id >= CSSValueAqua && id <= CSSValueWindowtext || id == CSSValueMenu ||
+        else if ((id >= CSSValueAqua && id <= CSSValueWindowtext) || id == CSSValueMenu ||
              (id >= CSSValueWebkitFocusRingColor && id < CSSValueWebkitText && !m_strict)) {
             valid_primitive = true;
         } else {
@@ -834,7 +825,7 @@ bool CSSParser::parseValue(int propId, bool important)
             } else if (m_strict && nrcoords == 2)
                 hotspot = IntPoint(coords[0], coords[1]);
             if (m_strict || coords.size() == 0) {
-                if (!uri.isNull())
+                if (!uri.isNull() && m_styleSheet)
                     list->append(CSSCursorImageValue::create(m_styleSheet->completeURL(uri), hotspot));
             }
             if ((m_strict && !value) || (value && !(value->unit == CSSParserValue::Operator && value->iValue == ',')))
@@ -900,7 +891,7 @@ bool CSSParser::parseValue(int propId, bool important)
         } else if (value->unit == CSSPrimitiveValue::CSS_URI) {
             // ### allow string in non strict mode?
             String uri = parseURL(value->string);
-            if (!uri.isNull()) {
+            if (!uri.isNull() && m_styleSheet) {
                 parsedValue = CSSImageValue::create(m_styleSheet->completeURL(uri));
                 m_valueList->next();
             }
@@ -1112,7 +1103,7 @@ bool CSSParser::parseValue(int propId, bool important)
             CSSParserValue* val;
             RefPtr<CSSValue> parsedValue;
             while ((val = m_valueList->current())) {
-                if (val->unit == CSSPrimitiveValue::CSS_URI) {
+                if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {
                     String value = parseURL(val->string);
                     parsedValue = CSSPrimitiveValue::create(m_styleSheet->completeURL(value), CSSPrimitiveValue::CSS_URI);
                 }
@@ -1298,11 +1289,51 @@ bool CSSParser::parseValue(int propId, bool important)
         break;
     case CSSPropertyWebkitTransformOrigin:
     case CSSPropertyWebkitTransformOriginX:
-    case CSSPropertyWebkitTransformOriginY: {
+    case CSSPropertyWebkitTransformOriginY:
+    case CSSPropertyWebkitTransformOriginZ: {
+        RefPtr<CSSValue> val1;
+        RefPtr<CSSValue> val2;
+        RefPtr<CSSValue> val3;
+        int propId1, propId2, propId3;
+        if (parseTransformOrigin(propId, propId1, propId2, propId3, val1, val2, val3)) {
+            addProperty(propId1, val1.release(), important);
+            if (val2)
+                addProperty(propId2, val2.release(), important);
+            if (val3)
+                addProperty(propId3, val3.release(), important);
+            return true;
+        }
+        return false;
+    }
+    case CSSPropertyWebkitTransformStyle:
+        if (value->id == CSSValueFlat || value->id == CSSValuePreserve3d)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWebkitBackfaceVisibility:
+        if (value->id == CSSValueVisible || value->id == CSSValueHidden)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWebkitPerspective:
+        if (id == CSSValueNone)
+            valid_primitive = true;
+        else {
+            if (validUnit(value, FNumber|FNonNeg, m_strict)) {
+                RefPtr<CSSValue> val = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
+                if (val) {
+                    addProperty(propId, val.release(), important);
+                    return true;
+                }
+                return false;
+            }
+        }
+        break;
+    case CSSPropertyWebkitPerspectiveOrigin:
+    case CSSPropertyWebkitPerspectiveOriginX:
+    case CSSPropertyWebkitPerspectiveOriginY: {
         RefPtr<CSSValue> val1;
         RefPtr<CSSValue> val2;
         int propId1, propId2;
-        if (parseTransformOrigin(propId, propId1, propId2, val1, val2)) {
+        if (parsePerspectiveOrigin(propId, propId1, propId2, val1, val2)) {
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
@@ -1314,7 +1345,6 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitAnimationDirection:
     case CSSPropertyWebkitAnimationDuration:
     case CSSPropertyWebkitAnimationName:
-    case CSSPropertyWebkitAnimationPlayState:
     case CSSPropertyWebkitAnimationIterationCount:
     case CSSPropertyWebkitAnimationTimingFunction:
     case CSSPropertyWebkitTransitionDelay:
@@ -1595,6 +1625,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyTextLineThrough:
     case CSSPropertyTextOverline:
     case CSSPropertyTextUnderline:
+    case CSSPropertyWebkitVariableDeclarationBlock:
         return false;
 #if ENABLE(SVG)
     default:
@@ -1966,7 +1997,7 @@ bool CSSParser::parseContent(int propId, bool important)
 
     while (CSSParserValue* val = m_valueList->current()) {
         RefPtr<CSSValue> parsedValue;
-        if (val->unit == CSSPrimitiveValue::CSS_URI) {
+        if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {
             // url
             String value = parseURL(val->string);
             parsedValue = CSSImageValue::create(m_styleSheet->completeURL(value));
@@ -1976,16 +2007,13 @@ bool CSSParser::parseContent(int propId, bool important)
             if (!args)
                 return false;
             if (equalIgnoringCase(val->function->name, "attr(")) {
-                if (args->size() != 1)
+                parsedValue = parseAttr(args);
+                if (!parsedValue)
                     return false;
-                CSSParserValue* a = args->current();
-                String attrName = a->string;
-                if (document()->isHTMLDocument())
-                    attrName = attrName.lower();
-                parsedValue = CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
             } else if (equalIgnoringCase(val->function->name, "counter(")) {
                 parsedValue = parseCounterContent(args, false);
-                if (!parsedValue) return false;
+                if (!parsedValue)
+                    return false;
             } else if (equalIgnoringCase(val->function->name, "counters(")) {
                 parsedValue = parseCounterContent(args, true);
                 if (!parsedValue)
@@ -2022,6 +2050,29 @@ bool CSSParser::parseContent(int propId, bool important)
     return false;
 }
 
+PassRefPtr<CSSValue> CSSParser::parseAttr(CSSParserValueList* args)
+{
+    if (args->size() != 1)
+        return 0;
+
+    CSSParserValue* a = args->current();
+
+    if (a->unit != CSSPrimitiveValue::CSS_IDENT)
+        return 0;
+
+    String attrName = a->string;
+    // CSS allows identifiers with "-" at the start, like "-webkit-mask-image".
+    // But HTML attribute names can't have those characters, and we should not
+    // even parse them inside attr().
+    if (attrName[0] == '-')
+        return 0;
+
+    if (document()->isHTMLDocument())
+        attrName = attrName.lower();
+    
+    return CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
+}
+
 PassRefPtr<CSSValue> CSSParser::parseBackgroundColor()
 {
     int id = m_valueList->current()->id;
@@ -2039,7 +2090,7 @@ bool CSSParser::parseFillImage(RefPtr<CSSValue>& value)
     }
     if (m_valueList->current()->unit == CSSPrimitiveValue::CSS_URI) {
         String uri = parseURL(m_valueList->current()->string);
-        if (!uri.isNull())
+        if (!uri.isNull() && m_styleSheet)
             value = CSSImageValue::create(m_styleSheet->completeURL(uri));
         return true;
     }
@@ -2208,7 +2259,10 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                 case CSSPropertyWebkitBackgroundOrigin:
                 case CSSPropertyWebkitMaskClip:
                 case CSSPropertyWebkitMaskOrigin:
-                    if (val->id == CSSValueBorder || val->id == CSSValuePadding || val->id == CSSValueContent || val->id == CSSValueText) {
+                    // The first three values here are deprecated and should not be allowed to apply when we drop the -webkit-
+                    // from the property names.
+                    if (val->id == CSSValueBorder || val->id == CSSValuePadding || val->id == CSSValueContent ||
+                        val->id == CSSValueBorderBox || val->id == CSSValuePaddingBox || val->id == CSSValueContentBox || val->id == CSSValueText) {
                         currValue = CSSPrimitiveValue::createIdentifier(val->id);
                         m_valueList->next();
                     }
@@ -2216,7 +2270,7 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                 case CSSPropertyBackgroundPosition:
                 case CSSPropertyWebkitMaskPosition:
                     parseFillPosition(currValue, currValue2);
-                    // unlike the other functions, parseFillPosition advances the m_valueList pointer
+                    // parseFillPosition advances the m_valueList pointer
                     break;
                 case CSSPropertyBackgroundPositionX:
                 case CSSPropertyWebkitMaskPositionX: {
@@ -2348,14 +2402,6 @@ PassRefPtr<CSSValue> CSSParser::parseAnimationName()
     return 0;
 }
 
-PassRefPtr<CSSValue> CSSParser::parseAnimationPlayState()
-{
-    CSSParserValue* value = m_valueList->current();
-    if (value->id == CSSValueRunning || value->id == CSSValuePaused)
-        return CSSPrimitiveValue::createIdentifier(value->id);
-    return 0;
-}
-
 PassRefPtr<CSSValue> CSSParser::parseAnimationProperty()
 {
     CSSParserValue* value = m_valueList->current();
@@ -2371,6 +2417,18 @@ PassRefPtr<CSSValue> CSSParser::parseAnimationProperty()
     return 0;
 }
 
+void CSSParser::parseTransformOriginShorthand(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& value2, RefPtr<CSSValue>& value3)
+{
+    parseFillPosition(value1, value2);
+
+    // now get z
+    if (m_valueList->current() && validUnit(m_valueList->current(), FLength, m_strict))
+        value3 = CSSPrimitiveValue::create(m_valueList->current()->fValue,
+                                         (CSSPrimitiveValue::UnitTypes)m_valueList->current()->unit);
+    if (value3)
+        m_valueList->next();
+}
+
 bool CSSParser::parseTimingFunctionValue(CSSParserValueList*& args, double& result)
 {
     CSSParserValue* v = args->current();
@@ -2465,11 +2523,6 @@ bool CSSParser::parseAnimationProperty(int propId, RefPtr<CSSValue>& result)
                     if (currValue)
                         m_valueList->next();
                     break;
-                case CSSPropertyWebkitAnimationPlayState:
-                    currValue = parseAnimationPlayState();
-                    if (currValue)
-                        m_valueList->next();
-                    break;
                 case CSSPropertyWebkitTransitionProperty:
                     currValue = parseAnimationProperty();
                     if (currValue)
@@ -3088,7 +3141,7 @@ bool CSSParser::parseFontFaceSrc()
     RefPtr<CSSFontFaceSrcValue> uriValue;
     while ((val = m_valueList->current())) {
         RefPtr<CSSFontFaceSrcValue> parsedValue;
-        if (val->unit == CSSPrimitiveValue::CSS_URI && !expectComma) {
+        if (val->unit == CSSPrimitiveValue::CSS_URI && !expectComma && m_styleSheet) {
             String value = parseURL(val->string);
             parsedValue = CSSFontFaceSrcValue::create(m_styleSheet->completeURL(value));
             uriValue = parsedValue;
@@ -3467,7 +3520,7 @@ bool CSSParser::parseShadow(int propId, bool important)
         else {
             // The only other type of value that's ok is a color value.
             RefPtr<CSSPrimitiveValue> parsedColor;
-            bool isColor = (val->id >= CSSValueAqua && val->id <= CSSValueWindowtext || val->id == CSSValueMenu ||
+            bool isColor = ((val->id >= CSSValueAqua && val->id <= CSSValueWindowtext) || val->id == CSSValueMenu ||
                             (val->id >= CSSValueWebkitFocusRingColor && val->id <= CSSValueWebkitText && !m_strict));
             if (isColor) {
                 if (!context.allowColor)
@@ -3689,7 +3742,7 @@ bool CSSParser::parseBorderImage(int propId, bool important, RefPtr<CSSValue>& r
     // Look for an image initially.  If the first value is not a URI, then we're done.
     BorderImageParseContext context;
     CSSParserValue* val = m_valueList->current();
-    if (val->unit == CSSPrimitiveValue::CSS_URI) {        
+    if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {        
         String uri = parseURL(val->string);
         if (uri.isNull())
             return false;
@@ -3795,7 +3848,7 @@ static PassRefPtr<CSSPrimitiveValue> parseGradientPoint(CSSParserValue* a, bool
     return result;
 }
 
-bool parseGradientColorStop(CSSParser* p, CSSParserValue* a, CSSGradientColorStop& stop)
+static bool parseGradientColorStop(CSSParser* p, CSSParserValue* a, CSSGradientColorStop& stop)
 {
     if (a->unit != CSSParserValue::Function)
         return false;
@@ -4006,17 +4059,37 @@ public:
     , m_allowSingleArgument(false)
     , m_unit(CSSParser::FUnknown)
     {
-        if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "scalex(") || equalIgnoringCase(name, "scaley(")) {
+        if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "scalex(") || equalIgnoringCase(name, "scaley(") || equalIgnoringCase(name, "scalez(")) {
             m_unit = CSSParser::FNumber;
             if (equalIgnoringCase(name, "scale("))
                 m_type = WebKitCSSTransformValue::ScaleTransformOperation;
             else if (equalIgnoringCase(name, "scalex("))
                 m_type = WebKitCSSTransformValue::ScaleXTransformOperation;
-            else
+            else if (equalIgnoringCase(name, "scaley("))
                 m_type = WebKitCSSTransformValue::ScaleYTransformOperation;
+            else
+                m_type = WebKitCSSTransformValue::ScaleZTransformOperation;
+        } else if (equalIgnoringCase(name, "scale3d(")) {
+            m_type = WebKitCSSTransformValue::Scale3DTransformOperation;
+            m_argCount = 5;
+            m_unit = CSSParser::FNumber;
         } else if (equalIgnoringCase(name, "rotate(")) {
             m_type = WebKitCSSTransformValue::RotateTransformOperation;
             m_unit = CSSParser::FAngle;
+        } else if (equalIgnoringCase(name, "rotatex(") ||
+                   equalIgnoringCase(name, "rotatey(") ||
+                   equalIgnoringCase(name, "rotatez(")) {
+            m_unit = CSSParser::FAngle;
+            if (equalIgnoringCase(name, "rotatex("))
+                m_type = WebKitCSSTransformValue::RotateXTransformOperation;
+            else if (equalIgnoringCase(name, "rotatey("))
+                m_type = WebKitCSSTransformValue::RotateYTransformOperation;
+            else
+                m_type = WebKitCSSTransformValue::RotateZTransformOperation;
+        } else if (equalIgnoringCase(name, "rotate3d(")) {
+            m_type = WebKitCSSTransformValue::Rotate3DTransformOperation;
+            m_argCount = 7;
+            m_unit = CSSParser::FNumber;
         } else if (equalIgnoringCase(name, "skew(") || equalIgnoringCase(name, "skewx(") || equalIgnoringCase(name, "skewy(")) {
             m_unit = CSSParser::FAngle;
             if (equalIgnoringCase(name, "skew("))
@@ -4025,20 +4098,33 @@ public:
                 m_type = WebKitCSSTransformValue::SkewXTransformOperation;
             else
                 m_type = WebKitCSSTransformValue::SkewYTransformOperation;
-        } else if (equalIgnoringCase(name, "translate(") || equalIgnoringCase(name, "translatex(") || equalIgnoringCase(name, "translatey(")) {
+        } else if (equalIgnoringCase(name, "translate(") || equalIgnoringCase(name, "translatex(") || equalIgnoringCase(name, "translatey(") || equalIgnoringCase(name, "translatez(")) {
             m_unit = CSSParser::FLength | CSSParser::FPercent;
             if (equalIgnoringCase(name, "translate("))
                 m_type = WebKitCSSTransformValue::TranslateTransformOperation;
             else if (equalIgnoringCase(name, "translatex("))
                 m_type = WebKitCSSTransformValue::TranslateXTransformOperation;
-            else
+            else if (equalIgnoringCase(name, "translatey("))
                 m_type = WebKitCSSTransformValue::TranslateYTransformOperation;
+            else
+                m_type = WebKitCSSTransformValue::TranslateZTransformOperation;
+        } else if (equalIgnoringCase(name, "translate3d(")) {
+            m_type = WebKitCSSTransformValue::Translate3DTransformOperation;
+            m_argCount = 5;
+            m_unit = CSSParser::FLength | CSSParser::FPercent;
         } else if (equalIgnoringCase(name, "matrix(")) {
             m_type = WebKitCSSTransformValue::MatrixTransformOperation;
             m_argCount = 11;
             m_unit = CSSParser::FNumber;
+        } else if (equalIgnoringCase(name, "matrix3d(")) {
+            m_type = WebKitCSSTransformValue::Matrix3DTransformOperation;
+            m_argCount = 31;
+            m_unit = CSSParser::FNumber;
+        } else if (equalIgnoringCase(name, "perspective(")) {
+            m_type = WebKitCSSTransformValue::PerspectiveTransformOperation;
+            m_unit = CSSParser::FNumber;
         }
-        
+
         if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "skew(") || equalIgnoringCase(name, "translate(")) {
             m_allowSingleArgument = true;
             m_argCount = 3;
@@ -4094,7 +4180,11 @@ PassRefPtr<CSSValueList> CSSParser::parseTransform()
         while (a) {
             CSSParser::Units unit = info.unit();
 
-            if (!validUnit(a, unit, true))
+            // 4th param of rotate3d() is an angle rather than a bare number, validate it as such
+            if (info.type() == WebKitCSSTransformValue::Rotate3DTransformOperation && argNumber == 3) {
+                if (!validUnit(a, FAngle, true))
+                    return 0;
+            } else if (!validUnit(a, unit, true))
                 return 0;
             
             // Add the value to the current transform operation.
@@ -4114,19 +4204,21 @@ PassRefPtr<CSSValueList> CSSParser::parseTransform()
     return list.release();
 }
 
-bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, RefPtr<CSSValue>& value, RefPtr<CSSValue>& value2)
+bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, int& propId3, RefPtr<CSSValue>& value, RefPtr<CSSValue>& value2, RefPtr<CSSValue>& value3)
 {
     propId1 = propId;
     propId2 = propId;
+    propId3 = propId;
     if (propId == CSSPropertyWebkitTransformOrigin) {
         propId1 = CSSPropertyWebkitTransformOriginX;
         propId2 = CSSPropertyWebkitTransformOriginY;
+        propId3 = CSSPropertyWebkitTransformOriginZ;
     }
 
     switch (propId) {
         case CSSPropertyWebkitTransformOrigin:
-            parseFillPosition(value, value2);
-            // Unlike the other functions, parseFillPosition advances the m_valueList pointer
+            parseTransformOriginShorthand(value, value2, value3);
+            // parseTransformOriginShorthand advances the m_valueList pointer
             break;
         case CSSPropertyWebkitTransformOriginX: {
             bool xFound = false, yFound = true;
@@ -4142,6 +4234,45 @@ bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, Ref
                 m_valueList->next();
             break;
         }
+        case CSSPropertyWebkitTransformOriginZ: {
+            if (validUnit(m_valueList->current(), FLength, m_strict))
+            value = CSSPrimitiveValue::create(m_valueList->current()->fValue, (CSSPrimitiveValue::UnitTypes)m_valueList->current()->unit);
+            if (value)
+                m_valueList->next();
+            break;
+        }
+    }
+    
+    return value;
+}
+
+bool CSSParser::parsePerspectiveOrigin(int propId, int& propId1, int& propId2, RefPtr<CSSValue>& value, RefPtr<CSSValue>& value2)
+{
+    propId1 = propId;
+    propId2 = propId;
+    if (propId == CSSPropertyWebkitPerspectiveOrigin) {
+        propId1 = CSSPropertyWebkitPerspectiveOriginX;
+        propId2 = CSSPropertyWebkitPerspectiveOriginY;
+    }
+
+    switch (propId) {
+        case CSSPropertyWebkitPerspectiveOrigin:
+            parseFillPosition(value, value2);
+            break;
+        case CSSPropertyWebkitPerspectiveOriginX: {
+            bool xFound = false, yFound = true;
+            value = parseFillPositionXY(xFound, yFound);
+            if (value)
+                m_valueList->next();
+            break;
+        }
+        case CSSPropertyWebkitPerspectiveOriginY: {
+            bool xFound = true, yFound = false;
+            value = parseFillPositionXY(xFound, yFound);
+            if (value)
+                m_valueList->next();
+            break;
+        }
     }
     
     return value;
@@ -4558,7 +4689,7 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 CSSRule* CSSParser::createFontFaceRule()
 {
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
-    for (int i = 0; i < m_numParsedProperties; ++i) {
+    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
         if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isPrimitiveValue()) {
@@ -4699,7 +4830,7 @@ void CSSParser::deleteFontFaceOnlyValues()
     ASSERT(m_hasFontFaceOnlyValues);
     int deletedProperties = 0;
 
-    for (int i = 0; i < m_numParsedProperties; ++i) {
+    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
         if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isValueList()) {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.h b/src/3rdparty/webkit/WebCore/css/CSSParser.h
index 83aafa42b8..d47720fa3d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.h
@@ -75,6 +75,8 @@ namespace WebCore {
         bool parse4Values(int propId, const int* properties, bool important);
         bool parseContent(int propId, bool important);
 
+        PassRefPtr<CSSValue> parseAttr(CSSParserValueList* args);
+
         PassRefPtr<CSSValue> parseBackgroundColor();
 
         bool parseFillImage(RefPtr<CSSValue>&);
@@ -94,10 +96,10 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseAnimationDuration();
         PassRefPtr<CSSValue> parseAnimationIterationCount();
         PassRefPtr<CSSValue> parseAnimationName();
-        PassRefPtr<CSSValue> parseAnimationPlayState();
         PassRefPtr<CSSValue> parseAnimationProperty();
         PassRefPtr<CSSValue> parseAnimationTimingFunction();
 
+        void parseTransformOriginShorthand(RefPtr<CSSValue>&, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseTimingFunctionValue(CSSParserValueList*& args, double& result);
         bool parseAnimationProperty(int propId, RefPtr<CSSValue>&);
         bool parseTransitionShorthand(bool important);
@@ -145,8 +147,8 @@ namespace WebCore {
         bool parseGradient(RefPtr<CSSValue>&);
 
         PassRefPtr<CSSValueList> parseTransform();
-        bool parseTransformOrigin(int propId, int& propId1, int& propId2, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-
+        bool parseTransformOrigin(int propId, int& propId1, int& propId2, int& propId3, RefPtr<CSSValue>&, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
+        bool parsePerspectiveOrigin(int propId, int& propId1, int& propId2,  RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseVariable(CSSVariablesDeclaration*, const String& variableName, const String& variableValue);
         void parsePropertyWithResolvedVariables(int propId, bool important, CSSMutableStyleDeclaration*, CSSParserValueList*);
 
@@ -200,8 +202,8 @@ namespace WebCore {
         CSSParserValueList* m_valueList;
         CSSProperty** m_parsedProperties;
         CSSSelectorList* m_selectorListForParseSelector;
-        int m_numParsedProperties;
-        int m_maxParsedProperties;
+        unsigned m_numParsedProperties;
+        unsigned m_maxParsedProperties;
 
         int m_inParseShorthand;
         int m_currentShorthand;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp b/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp
index 6baa5b0da1..dbfae78396 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp
@@ -42,7 +42,7 @@ CSSParserValueList::~CSSParserValueList()
 
 void CSSParserValueList::addValue(const CSSParserValue& v)
 {
-    if (v.isVariable())
+    if (v.unit == CSSPrimitiveValue::CSS_PARSER_VARIABLE_FUNCTION_SYNTAX) // isVariable() is not inlined. This is hot.
         m_variablesCount++;
     m_values.append(v);
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
index 4e0a280b3b..24bd9b7dc3 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
@@ -83,7 +83,7 @@ public:
     bool containsVariables() const { return m_variablesCount; }
 
 private:
-    Vector<CSSParserValue, 16> m_values;
+    Vector<CSSParserValue, 4> m_values;
     unsigned m_current;
     unsigned m_variablesCount;
 };
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index a1604543c8..15c5a014d6 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -485,7 +485,7 @@ void CSSPrimitiveValue::setFloatValue(unsigned short unitType, double floatValue
     m_type = unitType;
 }
 
-double scaleFactorForConversion(unsigned short unitType)
+static double scaleFactorForConversion(unsigned short unitType)
 {
     double factor = 1.0;
     switch (unitType) {
@@ -754,9 +754,18 @@ String CSSPrimitiveValue::cssText() const
         case CSS_IDENT:
             text = valueOrPropertyName(m_value.ident);
             break;
-        case CSS_ATTR:
-            // FIXME
-            break;
+        case CSS_ATTR: {
+            DEFINE_STATIC_LOCAL(const String, attrParen, ("attr("));
+
+            Vector<UChar> result;
+            result.reserveInitialCapacity(6 + m_value.string->length());
+
+            append(result, attrParen);
+            append(result, m_value.string);
+            result.uncheckedAppend(')');
+
+            return String::adopt(result);
+        }
         case CSS_COUNTER:
             text = "counter(";
             text += String::number(m_value.num);
@@ -768,7 +777,7 @@ String CSSPrimitiveValue::cssText() const
 
             Rect* rectVal = getRectValue();
             Vector<UChar> result;
-            result.reserveCapacity(32);
+            result.reserveInitialCapacity(32);
             append(result, rectParen);
 
             append(result, rectVal->top()->cssText());
@@ -797,7 +806,7 @@ String CSSPrimitiveValue::cssText() const
             Color color(rgbColor);
 
             Vector<UChar> result;
-            result.reserveCapacity(32);
+            result.reserveInitialCapacity(32);
             if (color.hasAlpha())
                 append(result, rgbaParen);
             else
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
index d552ca00ef..ece9fc591f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
@@ -81,6 +81,8 @@ public:
         // This unit is in CSS 3, but that isn't a finished standard yet
         CSS_TURN = 108
     };
+    
+    static bool isUnitTypeLength(int type) { return type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG; }
 
     static PassRefPtr<CSSPrimitiveValue> createIdentifier(int ident);
     static PassRefPtr<CSSPrimitiveValue> createColor(unsigned rgbValue);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
index b049c29544..befe5accf4 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
@@ -69,7 +69,7 @@ module css {
             raises(DOMException);
         Rect getRectValue()
             raises(DOMException);
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         RGBColor getRGBColorValue()
             raises(DOMException);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index fcbf06a123..fd1d203f0b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -29,7 +29,12 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
-#include "RenderStyle.h"
+#include "GraphicsTypes.h"
+#include "Path.h"
+#include "RenderStyleConstants.h"
+#include "SVGRenderStyleDefs.h"
+#include "TextDirection.h"
+#include "ThemeTypes.h"
 
 namespace WebCore {
 
@@ -216,6 +221,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaSliderThumbPart:
             m_value.ident = CSSValueMediaSliderthumb;
             break;
+        case MediaTimelineContainerPart:
+            m_value.ident = CSSValueMediaTimelineContainer;
+            break;
+        case MediaCurrentTimePart:
+            m_value.ident = CSSValueMediaCurrentTimeDisplay;
+            break;
+        case MediaTimeRemainingPart:
+            m_value.ident = CSSValueMediaTimeRemainingDisplay;
+            break;
         case MenulistPart:
             m_value.ident = CSSValueMenulist;
             break;
@@ -283,13 +297,13 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFillBox e)
 {
     switch (e) {
         case BorderFillBox:
-            m_value.ident = CSSValueBorder;
+            m_value.ident = CSSValueBorderBox;
             break;
         case PaddingFillBox:
-            m_value.ident = CSSValuePadding;
+            m_value.ident = CSSValuePaddingBox;
             break;
         case ContentFillBox:
-            m_value.ident = CSSValueContent;
+            m_value.ident = CSSValueContentBox;
             break;
         case TextFillBox:
             m_value.ident = CSSValueText;
@@ -301,10 +315,13 @@ template<> inline CSSPrimitiveValue::operator EFillBox() const
 {
     switch (m_value.ident) {
         case CSSValueBorder:
+        case CSSValueBorderBox:
             return BorderFillBox;
         case CSSValuePadding:
+        case CSSValuePaddingBox:
             return PaddingFillBox;
         case CSSValueContent:
+        case CSSValueContentBox:
             return ContentFillBox;
         case CSSValueText:
             return TextFillBox;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp
new file mode 100644
index 0000000000..310f90e6fc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp
@@ -0,0 +1,213 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "CSSPropertyLonghand.h"
+
+#include "CSSPropertyNames.h"
+#include <wtf/HashMap.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+typedef HashMap<int, CSSPropertyLonghand> ShorthandMap;
+
+static void initShorthandMap(ShorthandMap& shorthandMap)
+{
+    #define SET_SHORTHAND_MAP_ENTRY(map, propID, array) \
+        map.set(propID, CSSPropertyLonghand(array, sizeof(array) / sizeof(array[0])))
+
+    // FIXME: The 'font' property has "shorthand nature" but is not parsed as a shorthand.
+
+    // Do not change the order of the following four shorthands, and keep them together.
+    static const int borderProperties[4][3] = {
+        { CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth },
+        { CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth },
+        { CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth },
+        { CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth }
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderTop, borderProperties[0]);
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderRight, borderProperties[1]);
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderBottom, borderProperties[2]);
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderLeft, borderProperties[3]);
+
+    shorthandMap.set(CSSPropertyBorder, CSSPropertyLonghand(borderProperties[0], sizeof(borderProperties) / sizeof(borderProperties[0][0])));
+
+    static const int borderColorProperties[] = {
+        CSSPropertyBorderTopColor,
+        CSSPropertyBorderRightColor,
+        CSSPropertyBorderBottomColor,
+        CSSPropertyBorderLeftColor
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderColor, borderColorProperties);
+
+    static const int borderStyleProperties[] = {
+        CSSPropertyBorderTopStyle,
+        CSSPropertyBorderRightStyle,
+        CSSPropertyBorderBottomStyle,
+        CSSPropertyBorderLeftStyle
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderStyle, borderStyleProperties);
+
+    static const int borderWidthProperties[] = {
+        CSSPropertyBorderTopWidth,
+        CSSPropertyBorderRightWidth,
+        CSSPropertyBorderBottomWidth,
+        CSSPropertyBorderLeftWidth
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderWidth, borderWidthProperties);
+
+    static const int backgroundPositionProperties[] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundPosition, backgroundPositionProperties);
+
+    static const int borderSpacingProperties[] = { CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderSpacing, borderSpacingProperties);
+
+    static const int listStyleProperties[] = {
+        CSSPropertyListStyleImage,
+        CSSPropertyListStylePosition,
+        CSSPropertyListStyleType
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyListStyle, listStyleProperties);
+
+    static const int marginProperties[] = {
+        CSSPropertyMarginTop,
+        CSSPropertyMarginRight,
+        CSSPropertyMarginBottom,
+        CSSPropertyMarginLeft
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyMargin, marginProperties);
+
+    static const int marginCollapseProperties[] = { CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBottomCollapse };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarginCollapse, marginCollapseProperties);
+
+    static const int marqueeProperties[] = {
+        CSSPropertyWebkitMarqueeDirection,
+        CSSPropertyWebkitMarqueeIncrement,
+        CSSPropertyWebkitMarqueeRepetition,
+        CSSPropertyWebkitMarqueeStyle,
+        CSSPropertyWebkitMarqueeSpeed
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarquee, marqueeProperties);
+
+    static const int outlineProperties[] = {
+        CSSPropertyOutlineColor,
+        CSSPropertyOutlineOffset,
+        CSSPropertyOutlineStyle,
+        CSSPropertyOutlineWidth
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOutline, outlineProperties);
+
+    static const int paddingProperties[] = {
+        CSSPropertyPaddingTop,
+        CSSPropertyPaddingRight,
+        CSSPropertyPaddingBottom,
+        CSSPropertyPaddingLeft
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyPadding, paddingProperties);
+
+    static const int textStrokeProperties[] = { CSSPropertyWebkitTextStrokeColor, CSSPropertyWebkitTextStrokeWidth };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTextStroke, textStrokeProperties);
+
+    static const int backgroundProperties[] = {
+        CSSPropertyBackgroundAttachment,
+        CSSPropertyWebkitBackgroundClip,
+        CSSPropertyBackgroundColor,
+        CSSPropertyBackgroundImage,
+        CSSPropertyWebkitBackgroundOrigin,
+        CSSPropertyBackgroundPositionX,
+        CSSPropertyBackgroundPositionY,
+        CSSPropertyBackgroundRepeat,
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackground, backgroundProperties);
+
+    static const int columnsProperties[] = { CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumns, columnsProperties);
+
+    static const int columnRuleProperties[] = {
+        CSSPropertyWebkitColumnRuleColor,
+        CSSPropertyWebkitColumnRuleStyle,
+        CSSPropertyWebkitColumnRuleWidth
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumnRule, columnRuleProperties);
+
+    static const int overflowProperties[] = { CSSPropertyOverflowX, CSSPropertyOverflowY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOverflow, overflowProperties);
+
+    static const int borderRadiusProperties[] = {
+        CSSPropertyWebkitBorderTopRightRadius,
+        CSSPropertyWebkitBorderTopLeftRadius,
+        CSSPropertyWebkitBorderBottomLeftRadius,
+        CSSPropertyWebkitBorderBottomRightRadius
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitBorderRadius, borderRadiusProperties);
+
+    static const int maskPositionProperties[] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskPosition, maskPositionProperties);
+
+    static const int maskProperties[] = {
+        CSSPropertyWebkitMaskAttachment,
+        CSSPropertyWebkitMaskClip,
+        CSSPropertyWebkitMaskImage,
+        CSSPropertyWebkitMaskOrigin,
+        CSSPropertyWebkitMaskPositionX,
+        CSSPropertyWebkitMaskPositionY,
+        CSSPropertyWebkitMaskRepeat,
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMask, maskProperties);
+
+    static const int animationProperties[] = {
+        CSSPropertyWebkitAnimationName,
+        CSSPropertyWebkitAnimationDuration,
+        CSSPropertyWebkitAnimationTimingFunction,
+        CSSPropertyWebkitAnimationDelay,
+        CSSPropertyWebkitAnimationIterationCount,
+        CSSPropertyWebkitAnimationDirection
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitAnimation, animationProperties);
+
+    static const int transitionProperties[] = {
+        CSSPropertyWebkitTransitionProperty,
+        CSSPropertyWebkitTransitionDuration,
+        CSSPropertyWebkitTransitionTimingFunction,
+        CSSPropertyWebkitTransitionDelay
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransition, transitionProperties);
+
+    static const int transformOriginProperties[] = {
+        CSSPropertyWebkitTransformOriginX,
+        CSSPropertyWebkitTransformOriginY
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransformOrigin, transformOriginProperties);
+    
+    #undef SET_SHORTHAND_MAP_ENTRY
+}
+
+CSSPropertyLonghand longhandForProperty(int propertyID)
+{
+    DEFINE_STATIC_LOCAL(ShorthandMap, shorthandMap, ());
+    if (shorthandMap.isEmpty())
+        initShorthandMap(shorthandMap);
+
+    return shorthandMap.get(propertyID);
+}
+
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.h b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.h
new file mode 100644
index 0000000000..9633c025ab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.h
@@ -0,0 +1,53 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef CSSPropertyLonghand_h
+#define CSSPropertyLonghand_h
+
+namespace WebCore {
+
+class CSSPropertyLonghand {
+public:
+    CSSPropertyLonghand()
+        : m_properties(0)
+        , m_length(0)
+    {
+    }
+
+    CSSPropertyLonghand(const int* firstProperty, unsigned numProperties)
+        : m_properties(firstProperty)
+        , m_length(numProperties)
+    {
+    }
+
+    const int* properties() const { return m_properties; }
+    unsigned length() const { return m_length; }
+
+private:
+    const int* m_properties;
+    unsigned m_length;
+};
+
+// Returns an empty list if the property is not a shorthand
+CSSPropertyLonghand longhandForProperty(int);
+
+} // namespace WebCore
+
+#endif // CSSPropertyLonghand_h
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 3ca14bcc71..df17d975a0 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -99,13 +99,6 @@ position
 quotes
 resize
 right
-scrollbar-3dlight-color
-scrollbar-arrow-color
-scrollbar-darkshadow-color
-scrollbar-face-color
-scrollbar-highlight-color
-scrollbar-shadow-color
-scrollbar-track-color
 size
 src
 table-layout
@@ -149,9 +142,9 @@ zoom
 -webkit-animation-duration
 -webkit-animation-iteration-count
 -webkit-animation-name
--webkit-animation-play-state
 -webkit-animation-timing-function
 -webkit-appearance
+-webkit-backface-visibility
 -webkit-background-clip
 -webkit-background-composite
 -webkit-background-origin
@@ -217,6 +210,10 @@ zoom
 -webkit-match-nearest-mail-blockquote-color
 -webkit-nbsp-mode
 -webkit-padding-start
+-webkit-perspective
+-webkit-perspective-origin
+-webkit-perspective-origin-x
+-webkit-perspective-origin-y
 -webkit-rtl-ordering
 -webkit-text-decorations-in-effect
 -webkit-text-fill-color
@@ -229,6 +226,8 @@ zoom
 -webkit-transform-origin
 -webkit-transform-origin-x
 -webkit-transform-origin-y
+-webkit-transform-origin-z
+-webkit-transform-style
 -webkit-transition
 -webkit-transition-delay
 -webkit-transition-duration
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRule.idl b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
index 4d9e5689f4..f13f293b4f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -23,7 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=548139b4-31ab-4978-b1d5-cfcfdfbaea0e,
         ImplementationUUID=0268e673-2489-4743-9a3a-197dae4b4d9c
     ] CSSRule {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
index cc296d916c..17fbd64cd5 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
@@ -104,11 +104,13 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPanel, ("-webkit-media-controls-panel"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsMuteButton, ("-webkit-media-controls-mute-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPlayButton, ("-webkit-media-controls-play-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeDisplay, ("-webkit-media-controls-time-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeline, ("-webkit-media-controls-timeline"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekBackButton, ("-webkit-media-controls-seek-back-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsCurrentTimeDisplay, ("-webkit-media-controls-current-time-display"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeRemainingDisplay, ("-webkit-media-controls-time-remaining-display"));
     DEFINE_STATIC_LOCAL(AtomicString, notStr, ("not("));
     DEFINE_STATIC_LOCAL(AtomicString, onlyChild, ("only-child"));
     DEFINE_STATIC_LOCAL(AtomicString, onlyOfType, ("only-of-type"));
@@ -219,8 +221,11 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsPlayButton) {
         m_pseudoType = PseudoMediaControlsPlayButton;
         element = true;
-    } else if (m_value == mediaControlsTimeDisplay) {
-        m_pseudoType = PseudoMediaControlsTimeDisplay;
+    } else if (m_value == mediaControlsCurrentTimeDisplay) {
+        m_pseudoType = PseudoMediaControlsCurrentTimeDisplay;
+        element = true;
+    } else if (m_value == mediaControlsTimeRemainingDisplay) {
+        m_pseudoType = PseudoMediaControlsTimeRemainingDisplay;
         element = true;
     } else if (m_value == mediaControlsTimeline) {
         m_pseudoType = PseudoMediaControlsTimeline;
@@ -234,6 +239,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsFullscreenButton) {
         m_pseudoType = PseudoMediaControlsFullscreenButton;
         element = true;
+    } else if (m_value == mediaControlsTimelineContainer) {
+        m_pseudoType = PseudoMediaControlsTimelineContainer;
+        element = true;
     } else if (m_value == notStr)
         m_pseudoType = PseudoNot;
     else if (m_value == nthChild)
@@ -374,7 +382,11 @@ String CSSSelector::selectorText() const
                 if (CSSSelector* subSel = cs->simpleSelector())
                     str += subSel->selectorText();
                 str += ")";
-            } else if (cs->pseudoType() == PseudoLang) {
+            } else if (cs->pseudoType() == PseudoLang
+                    || cs->pseudoType() == PseudoNthChild
+                    || cs->pseudoType() == PseudoNthLastChild
+                    || cs->pseudoType() == PseudoNthOfType
+                    || cs->pseudoType() == PseudoNthLastOfType) {
                 str += cs->argument();
                 str += ")";
             }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.h b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
index 8da11d7ee2..728c34d6a5 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
@@ -167,7 +167,9 @@ namespace WebCore {
             PseudoMediaControlsPanel,
             PseudoMediaControlsMuteButton,
             PseudoMediaControlsPlayButton,
-            PseudoMediaControlsTimeDisplay,
+            PseudoMediaControlsTimelineContainer,
+            PseudoMediaControlsCurrentTimeDisplay,
+            PseudoMediaControlsTimeRemainingDisplay,
             PseudoMediaControlsTimeline,
             PseudoMediaControlsSeekBackButton,
             PseudoMediaControlsSeekForwardButton,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
index 7276141ba7..5ad3809f04 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -54,7 +55,11 @@ void CSSSelectorList::adoptSelectorVector(Vector<CSSSelector*>& selectorVector)
     m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * selectorVector.size()));
     for (size_t i = 0; i < size; ++i) {
         memcpy(&m_selectorArray[i], selectorVector[i], sizeof(CSSSelector));
-        fastFree(selectorVector[i]);
+        // We want to free the memory (which was allocated with new), but we
+        // don't want the destructor to run since it will affect the copy
+        // we've just made. In theory this is undefined, but operator delete
+        // is only defined taking a void*, so in practice it should be ok.
+        delete reinterpret_cast<char*>(selectorVector[i]);
         ASSERT(!m_selectorArray[i].isLastInSelectorList());
     }
     m_selectorArray[size - 1].setLastInSelectorList();
@@ -65,15 +70,25 @@ void CSSSelectorList::deleteSelectors()
 {
     if (!m_selectorArray)
         return;
+
+    // We had two cases in adoptSelectVector. The fast case of a 1 element
+    // vector took the CSSSelector directly, which was allocated with new.
+    // The second case we allocated a new fastMalloc buffer, which should be
+    // freed with fastFree, and the destructors called manually.
     CSSSelector* s = m_selectorArray;
-    while (1) {
-        bool done = s->isLastInSelectorList();
-        s->~CSSSelector();
-        if (done)
-            break;
-        ++s;
+    bool done = s->isLastInSelectorList();
+    if (done)
+        delete s;
+    else {
+        while (1) {
+            s->~CSSSelector();
+            if (done)
+                break;
+            ++s;
+            done = s->isLastInSelectorList();
+        }
+        fastFree(m_selectorArray);
     }
-    fastFree(m_selectorArray); 
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp
index b840e07220..a35f8179b7 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp
@@ -142,7 +142,7 @@ void CSSStyleDeclaration::diff(CSSMutableStyleDeclaration* style) const
 PassRefPtr<CSSMutableStyleDeclaration> CSSStyleDeclaration::copyPropertiesInSet(const int* set, unsigned length) const
 {
     Vector<CSSProperty> list;
-    list.reserveCapacity(length);
+    list.reserveInitialCapacity(length);
     unsigned variableDependentValueCount = 0;
     for (unsigned i = 0; i < length; i++) {
         RefPtr<CSSValue> value = getPropertyCSSValue(set[i]);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h
index e6fede6310..ef4cc21329 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h
@@ -42,6 +42,7 @@ public:
     virtual void setCssText(const String&, ExceptionCode&) = 0;
 
     virtual unsigned length() const = 0;
+    bool isEmpty() const { return !length(); }
     virtual String item(unsigned index) const = 0;
 
     PassRefPtr<CSSValue> getPropertyCSSValue(const String& propertyName);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 3b70cf486c..fbc8be3f48 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -62,16 +62,20 @@
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
 #include "LinkHash.h"
+#include "MappedAttribute.h"
 #include "MatrixTransformOperation.h"
+#include "Matrix3DTransformOperation.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "Pair.h"
+#include "PerspectiveTransformOperation.h"
 #include "Rect.h"
 #include "RenderScrollbar.h"
 #include "RenderScrollbarTheme.h"
+#include "RenderStyleConstants.h"
 #include "RenderTheme.h"
 #include "RotateTransformOperation.h"
 #include "ScaleTransformOperation.h"
@@ -83,6 +87,7 @@
 #include "StyleGeneratedImage.h"
 #include "StyleSheetList.h"
 #include "Text.h"
+#include "TransformationMatrix.h"
 #include "TranslateTransformOperation.h"
 #include "UserAgentStyleSheets.h"
 #include "WebKitCSSKeyframeRule.h"
@@ -138,6 +143,16 @@ if (isInitial) { \
     return;\
 }
 
+#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(prop, Prop) \
+HANDLE_INHERIT_AND_INITIAL(prop, Prop) \
+if (primitiveValue) \
+    m_style->set##Prop(*primitiveValue);
+
+#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(prop, Prop, Value) \
+HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(prop, Prop, Value) \
+if (primitiveValue) \
+    m_style->set##Prop(*primitiveValue);
+
 #define HANDLE_FILL_LAYER_INHERIT_AND_INITIAL(layerType, LayerType, prop, Prop) \
 if (isInherit) { \
     FillLayer* currChild = m_style->access##LayerType##Layers(); \
@@ -374,11 +389,11 @@ static PseudoState pseudoState;
 static void loadFullDefaultStyle();
 static void loadSimpleDefaultStyle();
 // FIXME: It would be nice to use some mechanism that guarantees this is in sync with the real UA stylesheet.
-static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}";
+static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}a:-webkit-any-link{color:-webkit-link;text-decoration:underline}a:-webkit-any-link:active{color:-webkit-activelink}";
 
 static bool elementCanUseSimpleDefaultStyle(Element* e)
 {
-    return e->hasTagName(htmlTag) || e->hasTagName(bodyTag) || e->hasTagName(divTag) || e->hasTagName(spanTag) || e->hasTagName(brTag);
+    return e->hasTagName(htmlTag) || e->hasTagName(bodyTag) || e->hasTagName(divTag) || e->hasTagName(spanTag) || e->hasTagName(brTag) || e->hasTagName(aTag);
 }
 
 static const MediaQueryEvaluator& screenEval()
@@ -687,10 +702,10 @@ void CSSStyleSelector::matchRulesForList(CSSRuleDataList* rules, int& firstRuleI
             
             // If we're matching normal rules, set a pseudo bit if 
             // we really just matched a pseudo-element.
-            if (m_dynamicPseudo != RenderStyle::NOPSEUDO && m_checker.m_pseudoStyle == RenderStyle::NOPSEUDO) {
+            if (m_dynamicPseudo != NOPSEUDO && m_checker.m_pseudoStyle == NOPSEUDO) {
                 if (m_checker.m_collectRulesOnly)
                     return;
-                if (m_dynamicPseudo < RenderStyle::FIRST_INTERNAL_PSEUDOID)
+                if (m_dynamicPseudo < FIRST_INTERNAL_PSEUDOID)
                     m_style->setHasPseudoStyle(m_dynamicPseudo);
             } else {
                 // Update our first/last rule indices in the matched rules array.
@@ -705,13 +720,14 @@ void CSSStyleSelector::matchRulesForList(CSSRuleDataList* rules, int& firstRuleI
     }
 }
 
-bool operator >(CSSRuleData& r1, CSSRuleData& r2)
+static bool operator >(CSSRuleData& r1, CSSRuleData& r2)
 {
     int spec1 = r1.selector()->specificity();
     int spec2 = r2.selector()->specificity();
     return (spec1 == spec2) ? r1.position() > r2.position() : spec1 > spec2; 
 }
-bool operator <=(CSSRuleData& r1, CSSRuleData& r2)
+    
+static bool operator <=(CSSRuleData& r1, CSSRuleData& r2)
 {
     return !(r1 > r2);
 }
@@ -756,7 +772,7 @@ void CSSStyleSelector::sortMatchedRules(unsigned start, unsigned end)
     // We have to merge sort.  Ensure our merge buffer is big enough to hold
     // all the items.
     Vector<CSSRuleData*> rulesMergeBuffer;
-    rulesMergeBuffer.reserveCapacity(end - start); 
+    rulesMergeBuffer.reserveInitialCapacity(end - start); 
 
     unsigned i1 = start;
     unsigned i2 = mid;
@@ -790,7 +806,7 @@ void CSSStyleSelector::initElementAndPseudoState(Element* e)
     pseudoState = PseudoUnknown;
 }
 
-void CSSStyleSelector::initForStyleResolve(Element* e, RenderStyle* parentStyle, RenderStyle::PseudoId pseudoID)
+void CSSStyleSelector::initForStyleResolve(Element* e, RenderStyle* parentStyle, PseudoId pseudoID)
 {
     m_checker.m_pseudoStyle = pseudoID;
 
@@ -848,7 +864,7 @@ CSSStyleSelector::SelectorChecker::SelectorChecker(Document* document, bool stri
     : m_document(document)
     , m_strictParsing(strictParsing)
     , m_collectRulesOnly(false)
-    , m_pseudoStyle(RenderStyle::NOPSEUDO)
+    , m_pseudoStyle(NOPSEUDO)
     , m_documentIsHTML(document->isHTMLDocument())
 {
 }
@@ -862,30 +878,35 @@ PseudoState CSSStyleSelector::SelectorChecker::checkPseudoState(Element* element
     if (!checkVisited)
         return PseudoAnyLink;
 
-    Frame* frame = m_document->frame();
-    if (!frame)
-        return PseudoLink;
-
-    Page* page = frame->page();
-    if (!page)
-        return PseudoLink;
-
+#if PLATFORM(QT)
     Vector<UChar, 512> url;
     visitedURL(m_document->baseURL(), *attr, url);
     if (url.isEmpty())
         return PseudoLink;
 
-#if PLATFORM(QT)
     // If the Qt4.4 interface for the history is used, we will have to fallback
     // to the old global history.
     QWebHistoryInterface* iface = QWebHistoryInterface::defaultInterface();
     if (iface)
         return iface->historyContains(QString(reinterpret_cast<QChar*>(url.data()), url.size())) ? PseudoVisited : PseudoLink;
-#endif
 
     LinkHash hash = visitedLinkHash(url.data(), url.size());
     if (!hash)
         return PseudoLink;
+#else
+    LinkHash hash = visitedLinkHash(m_document->baseURL(), *attr);
+    if (!hash)
+        return PseudoLink;
+#endif
+
+    Frame* frame = m_document->frame();
+    if (!frame)
+        return PseudoLink;
+
+    Page* page = frame->page();
+    if (!page)
+        return PseudoLink;
+
     m_linksCheckedForVisitedState.add(hash);
     return page->group().isLinkVisited(hash) ? PseudoVisited : PseudoLink;
 }
@@ -893,7 +914,7 @@ PseudoState CSSStyleSelector::SelectorChecker::checkPseudoState(Element* element
 bool CSSStyleSelector::SelectorChecker::checkSelector(CSSSelector* sel, Element* element) const
 {
     pseudoState = PseudoUnknown;
-    RenderStyle::PseudoId dynamicPseudo = RenderStyle::NOPSEUDO;
+    PseudoId dynamicPseudo = NOPSEUDO;
 
     return checkSelector(sel, element, 0, dynamicPseudo, true, false) == SelectorMatches;
 }
@@ -948,21 +969,30 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* n)
             (s->hovered() == m_element->hovered()) &&
             (s->active() == m_element->active()) &&
             (s->focused() == m_element->focused()) &&
-            (s != s->document()->getCSSTarget() && m_element != m_element->document()->getCSSTarget()) &&
+            (s != s->document()->cssTarget() && m_element != m_element->document()->cssTarget()) &&
             (s->getAttribute(typeAttr) == m_element->getAttribute(typeAttr)) &&
             (s->getAttribute(XMLNames::langAttr) == m_element->getAttribute(XMLNames::langAttr)) &&
             (s->getAttribute(langAttr) == m_element->getAttribute(langAttr)) &&
             (s->getAttribute(readonlyAttr) == m_element->getAttribute(readonlyAttr)) &&
             (s->getAttribute(cellpaddingAttr) == m_element->getAttribute(cellpaddingAttr))) {
-            bool isControl = s->isControl();
-            if (isControl != m_element->isControl())
+            bool isControl = s->isFormControlElement();
+            if (isControl != m_element->isFormControlElement())
                 return false;
-            if (isControl && (s->isEnabled() != m_element->isEnabled()) ||
-                             (s->isIndeterminate() != m_element->isIndeterminate()) ||
-                             (s->isChecked() != m_element->isChecked()) ||
-                             (s->isAutofilled() != m_element->isAutofilled()))
-                return false;
-            
+            if (isControl) {
+                InputElement* thisInputElement = toInputElement(s);
+                InputElement* otherInputElement = toInputElement(m_element);
+                if (thisInputElement && otherInputElement) {
+                    if ((thisInputElement->isAutofilled() != otherInputElement->isAutofilled()) ||
+                        (thisInputElement->isChecked() != otherInputElement->isChecked()) ||
+                        (thisInputElement->isIndeterminate() != otherInputElement->isIndeterminate()))
+                    return false;
+                } else
+                    return false;
+
+                if (s->isEnabledFormControl() != m_element->isEnabledFormControl())
+                    return false;
+            }
+
             if (style->transitions() || style->animations())
                 return false;
 
@@ -1226,7 +1256,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
         m_style->setPseudoState(pseudoState);
 
     // If we have first-letter pseudo style, do not share this style
-    if (m_style->hasPseudoStyle(RenderStyle::FIRST_LETTER))
+    if (m_style->hasPseudoStyle(FIRST_LETTER))
         m_style->setUnique();
 
     // Now return the style.
@@ -1308,7 +1338,7 @@ void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle*
         list.clear();
 }
 
-PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(RenderStyle::PseudoId pseudo, Element* e, RenderStyle* parentStyle)
+PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(PseudoId pseudo, Element* e, RenderStyle* parentStyle)
 {
     if (!e)
         return 0;
@@ -1442,7 +1472,10 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
         // Table headers with a text-align of auto will change the text-align to center.
         if (e && e->hasTagName(thTag) && style->textAlign() == TAAUTO)
             style->setTextAlign(CENTER);
-        
+
+        if (e && e->hasTagName(legendTag))
+            style->setDisplay(BLOCK);
+
         // Mutate the display to BLOCK or TABLE for certain cases, e.g., if someone attempts to
         // position or float an inline, compact, or run-in.  Cache the original display, since it
         // may be needed for positioned elements that have to compute their static normal flow
@@ -1481,7 +1514,7 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
     // cases where objects that should be blended as a single unit end up with a non-transparent
     // object wedged in between them.  Auto z-index also becomes 0 for objects that specify transforms/masks/reflections.
     if (style->hasAutoZIndex() && ((e && e->document()->documentElement() == e) || style->opacity() < 1.0f || 
-        style->hasTransform() || style->hasMask() || style->boxReflect()))
+        style->hasTransformRelatedProperty() || style->hasMask() || style->boxReflect()))
         style->setZIndex(0);
     
     // Button, legend, input, select and textarea all consider width values of 'auto' to be 'intrinsic'.
@@ -1490,10 +1523,17 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
               e->hasTagName(selectTag) || e->hasTagName(textareaTag)
 #if ENABLE(WML)
               || e->hasTagName(WMLNames::insertedLegendTag)
+              || e->hasTagName(WMLNames::inputTag)
 #endif
        )) {
         if (style->width().isAuto())
             style->setWidth(Length(Intrinsic));
+
+        // Textarea considers overflow visible as auto.
+        if (e && e->hasTagName(textareaTag)) {
+            style->setOverflowX(style->overflowX() == OVISIBLE ? OAUTO : style->overflowX());
+            style->setOverflowY(style->overflowY() == OVISIBLE ? OAUTO : style->overflowY());
+        }
     }
 
     // Finally update our text decorations in effect, but don't allow text-decoration to percolate through
@@ -1540,7 +1580,7 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
 
     // Important: Intrinsic margins get added to controls before the theme has adjusted the style, since the theme will
     // alter fonts and heights/widths.
-    if (e && e->isControl() && style->fontSize() >= 11) {
+    if (e && e->isFormControlElement() && style->fontSize() >= 11) {
         // Don't apply intrinsic margins to image buttons.  The designer knows how big the images are,
         // so we have to treat all image buttons as though they were explicitly sized.
         if (!e->hasTagName(inputTag) || static_cast<HTMLInputElement*>(e)->inputType() != HTMLInputElement::IMAGE)
@@ -1631,14 +1671,14 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element*, c
 
 bool CSSStyleSelector::checkSelector(CSSSelector* sel)
 {
-    m_dynamicPseudo = RenderStyle::NOPSEUDO;
+    m_dynamicPseudo = NOPSEUDO;
 
     // Check the selector
     SelectorMatch match = m_checker.checkSelector(sel, m_element, &m_selectorAttrs, m_dynamicPseudo, true, false, style(), m_parentStyle);
     if (match != SelectorMatches)
         return false;
 
-    if (m_checker.m_pseudoStyle != RenderStyle::NOPSEUDO && m_checker.m_pseudoStyle != m_dynamicPseudo)
+    if (m_checker.m_pseudoStyle != NOPSEUDO && m_checker.m_pseudoStyle != m_dynamicPseudo)
         return false;
 
     return true;
@@ -1649,7 +1689,7 @@ bool CSSStyleSelector::checkSelector(CSSSelector* sel)
 // * SelectorMatches         - the selector matches the element e
 // * SelectorFailsLocally    - the selector fails for the element e
 // * SelectorFailsCompletely - the selector fails for e and any sibling or ancestor of e
-CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
+CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
 {
 #if ENABLE(SVG)
     // Spec: CSS2 selectors cannot be applied to the (conceptually) cloned DOM tree
@@ -1672,7 +1712,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
 
     if (relation != CSSSelector::SubSelector)
         // Bail-out if this selector is irrelevant for the pseudoStyle
-        if (m_pseudoStyle != RenderStyle::NOPSEUDO && m_pseudoStyle != dynamicPseudo)
+        if (m_pseudoStyle != NOPSEUDO && m_pseudoStyle != dynamicPseudo)
             return SelectorFailsCompletely;
 
     switch (relation) {
@@ -1732,8 +1772,8 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
             // a selector is invalid if something follows a pseudo-element
             // We make an exception for scrollbar pseudo elements and allow a set of pseudo classes (but nothing else)
             // to follow the pseudo elements.
-            if (elementStyle && dynamicPseudo != RenderStyle::NOPSEUDO && 
-                !((RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == RenderStyle::SCROLLBAR_CORNER || dynamicPseudo == RenderStyle::RESIZER) && sel->m_match == CSSSelector::PseudoClass))
+            if (elementStyle && dynamicPseudo != NOPSEUDO && dynamicPseudo != SELECTION &&
+                !((RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == SCROLLBAR_CORNER || dynamicPseudo == RESIZER) && sel->m_match == CSSSelector::PseudoClass))
                 return SelectorFailsCompletely;
             return checkSelector(sel, e, selectorAttrs, dynamicPseudo, isAncestor, true, elementStyle, elementParentStyle);
     }
@@ -1808,7 +1848,7 @@ static bool htmlAttributeHasCaseInsensitiveValue(const QualifiedName& attr)
     return isPossibleHTMLAttr && htmlCaseInsensitiveAttributesSet->contains(attr.localName().impl());
 }
 
-bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
+bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
 {
     if (!e)
         return false;
@@ -1906,15 +1946,19 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             for (CSSSelector* subSel = sel->simpleSelector(); subSel; subSel = subSel->tagHistory()) {
                 // :not cannot nest. I don't really know why this is a
                 // restriction in CSS3, but it is, so let's honor it.
-                if (subSel->simpleSelector())
-                    break;
+                // the parser enforces that this never occurs
+                ASSERT(!subSel->simpleSelector());
+
                 if (!checkOneSelector(subSel, e, selectorAttrs, dynamicPseudo, isAncestor, true, elementStyle, elementParentStyle))
                     return true;
             }
-        } else if (dynamicPseudo != RenderStyle::NOPSEUDO && (RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == RenderStyle::SCROLLBAR_CORNER || dynamicPseudo == RenderStyle::RESIZER)) {
+        } else if (dynamicPseudo != NOPSEUDO && (RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == SCROLLBAR_CORNER || dynamicPseudo == RESIZER)) {
             // CSS scrollbars match a specific subset of pseudo classes, and they have specialized rules for each
             // (since there are no elements involved).
             return checkScrollbarPseudoClass(sel, dynamicPseudo);
+        } else if (dynamicPseudo == SELECTION) {
+            if (sel->pseudoType() == CSSSelector::PseudoWindowInactive)
+                return !m_document->page()->focusController()->isActive();
         }
         
         // Normal element pseudo class checking.
@@ -2209,7 +2253,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 break;
             }
             case CSSSelector::PseudoTarget:
-                if (e == e->document()->getCSSTarget())
+                if (e == e->document()->cssTarget())
                     return true;
                 break;
             case CSSSelector::PseudoAnyLink:
@@ -2218,10 +2262,13 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 if (pseudoState == PseudoAnyLink || pseudoState == PseudoLink || pseudoState == PseudoVisited)
                     return true;
                 break;
-            case CSSSelector::PseudoAutofill:
-                if (e)
-                    return e->isAutofilled();
+            case CSSSelector::PseudoAutofill: {
+                if (!e || !e->isFormControlElement())
+                    break;
+                if (InputElement* inputElement = toInputElement(e))
+                    return inputElement->isAutofilled();
                 break;
+            }
             case CSSSelector::PseudoLink:
                 if (pseudoState == PseudoUnknown || pseudoState == PseudoAnyLink)
                     pseudoState = checkPseudoState(e);
@@ -2273,37 +2320,60 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 }
                 break;
             case CSSSelector::PseudoEnabled:
-                if (e && e->isControl() && !e->isInputTypeHidden())
+                if (e && e->isFormControlElement()) {
+                    InputElement* inputElement = toInputElement(e);
+                    if (inputElement && inputElement->isInputTypeHidden())
+                        break;
                     // The UI spec states that you can't match :enabled unless you are an object that can
                     // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
                     // that are non-"hidden" controls.
-                    return e->isEnabled();                    
+                    return e->isEnabledFormControl();
+                }
                 break;
             case CSSSelector::PseudoFullPageMedia:
                 return e && e->document() && e->document()->isMediaDocument();
                 break;
             case CSSSelector::PseudoDisabled:
-                if (e && e->isControl() && !e->isInputTypeHidden())
+                if (e && e->isFormControlElement()) {
+                    InputElement* inputElement = toInputElement(e);
+                    if (inputElement && inputElement->isInputTypeHidden())
+                        break;
+
                     // The UI spec states that you can't match :enabled unless you are an object that can
                     // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
                     // that are non-"hidden" controls.
-                    return !e->isEnabled();                    
+                    return !e->isEnabledFormControl();
+                }
                 break;
-            case CSSSelector::PseudoReadOnly:
-                return e && e->isTextControl() && e->isReadOnlyControl();
-            case CSSSelector::PseudoReadWrite:
-                return e && e->isTextControl() && !e->isReadOnlyControl();
-            case CSSSelector::PseudoChecked:
+            case CSSSelector::PseudoReadOnly: {
+                if (!e || !e->isFormControlElement())
+                    return false;
+                return e->isTextFormControl() && e->isReadOnlyFormControl();
+            }
+            case CSSSelector::PseudoReadWrite: {
+                if (!e || !e->isFormControlElement())
+                    return false;
+                return e->isTextFormControl() && !e->isReadOnlyFormControl();
+            }
+            case CSSSelector::PseudoChecked: {
+                if (!e || !e->isFormControlElement())
+                    break;
                 // Even though WinIE allows checked and indeterminate to co-exist, the CSS selector spec says that
                 // you can't be both checked and indeterminate.  We will behave like WinIE behind the scenes and just
                 // obey the CSS spec here in the test for matching the pseudo.
-                if (e && e->isChecked() && !e->isIndeterminate())
+                InputElement* inputElement = toInputElement(e);
+                if (inputElement && inputElement->isChecked() && !inputElement->isIndeterminate())
                     return true;
                 break;
-            case CSSSelector::PseudoIndeterminate:
-                if (e && e->isIndeterminate())
+            }
+            case CSSSelector::PseudoIndeterminate: {
+                if (!e || !e->isFormControlElement())
+                    break;
+                InputElement* inputElement = toInputElement(e);
+                if (inputElement && inputElement->isIndeterminate())
                     return true;
                 break;
+            }
             case CSSSelector::PseudoRoot:
                 if (e == e->document()->documentElement())
                     return true;
@@ -2347,87 +2417,93 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
         switch (sel->pseudoType()) {
             // Pseudo-elements:
             case CSSSelector::PseudoFirstLine:
-                dynamicPseudo = RenderStyle::FIRST_LINE;
+                dynamicPseudo = FIRST_LINE;
                 return true;
             case CSSSelector::PseudoFirstLetter:
-                dynamicPseudo = RenderStyle::FIRST_LETTER;
+                dynamicPseudo = FIRST_LETTER;
                 if (Document* doc = e->document())
                     doc->setUsesFirstLetterRules(true);
                 return true;
             case CSSSelector::PseudoSelection:
-                dynamicPseudo = RenderStyle::SELECTION;
+                dynamicPseudo = SELECTION;
                 return true;
             case CSSSelector::PseudoBefore:
-                dynamicPseudo = RenderStyle::BEFORE;
+                dynamicPseudo = BEFORE;
                 return true;
             case CSSSelector::PseudoAfter:
-                dynamicPseudo = RenderStyle::AFTER;
+                dynamicPseudo = AFTER;
                 return true;
             case CSSSelector::PseudoFileUploadButton:
-                dynamicPseudo = RenderStyle::FILE_UPLOAD_BUTTON;
+                dynamicPseudo = FILE_UPLOAD_BUTTON;
                 return true;
             case CSSSelector::PseudoInputPlaceholder:
-                dynamicPseudo = RenderStyle::INPUT_PLACEHOLDER;
+                dynamicPseudo = INPUT_PLACEHOLDER;
                 return true;
             case CSSSelector::PseudoSliderThumb:
-                dynamicPseudo = RenderStyle::SLIDER_THUMB;
+                dynamicPseudo = SLIDER_THUMB;
                 return true; 
             case CSSSelector::PseudoSearchCancelButton:
-                dynamicPseudo = RenderStyle::SEARCH_CANCEL_BUTTON;
+                dynamicPseudo = SEARCH_CANCEL_BUTTON;
                 return true; 
             case CSSSelector::PseudoSearchDecoration:
-                dynamicPseudo = RenderStyle::SEARCH_DECORATION;
+                dynamicPseudo = SEARCH_DECORATION;
                 return true;
             case CSSSelector::PseudoSearchResultsDecoration:
-                dynamicPseudo = RenderStyle::SEARCH_RESULTS_DECORATION;
+                dynamicPseudo = SEARCH_RESULTS_DECORATION;
                 return true;
             case CSSSelector::PseudoSearchResultsButton:
-                dynamicPseudo = RenderStyle::SEARCH_RESULTS_BUTTON;
+                dynamicPseudo = SEARCH_RESULTS_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsPanel:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_PANEL;
+                dynamicPseudo = MEDIA_CONTROLS_PANEL;
                 return true;
             case CSSSelector::PseudoMediaControlsMuteButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_MUTE_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_MUTE_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsPlayButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_PLAY_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_PLAY_BUTTON;
                 return true;
-            case CSSSelector::PseudoMediaControlsTimeDisplay:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_TIME_DISPLAY;
+            case CSSSelector::PseudoMediaControlsTimelineContainer:
+                dynamicPseudo = MEDIA_CONTROLS_TIMELINE_CONTAINER;
+                 return true;
+            case CSSSelector::PseudoMediaControlsCurrentTimeDisplay:
+                dynamicPseudo = MEDIA_CONTROLS_CURRENT_TIME_DISPLAY;
+                return true;
+            case CSSSelector::PseudoMediaControlsTimeRemainingDisplay:
+                dynamicPseudo = MEDIA_CONTROLS_TIME_REMAINING_DISPLAY;
                 return true;
             case CSSSelector::PseudoMediaControlsTimeline:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_TIMELINE;
+                dynamicPseudo = MEDIA_CONTROLS_TIMELINE;
                 return true;
             case CSSSelector::PseudoMediaControlsSeekBackButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_SEEK_BACK_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_SEEK_BACK_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsSeekForwardButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_SEEK_FORWARD_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_SEEK_FORWARD_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsFullscreenButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_FULLSCREEN_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_FULLSCREEN_BUTTON;
                 return true;
             case CSSSelector::PseudoScrollbar:
-                dynamicPseudo = RenderStyle::SCROLLBAR;
+                dynamicPseudo = SCROLLBAR;
                 return true;
             case CSSSelector::PseudoScrollbarButton:
-                dynamicPseudo = RenderStyle::SCROLLBAR_BUTTON;
+                dynamicPseudo = SCROLLBAR_BUTTON;
                 return true;
             case CSSSelector::PseudoScrollbarCorner:
-                dynamicPseudo = RenderStyle::SCROLLBAR_CORNER;
+                dynamicPseudo = SCROLLBAR_CORNER;
                 return true;
             case CSSSelector::PseudoScrollbarThumb:
-                dynamicPseudo = RenderStyle::SCROLLBAR_THUMB;
+                dynamicPseudo = SCROLLBAR_THUMB;
                 return true;
             case CSSSelector::PseudoScrollbarTrack:
-                dynamicPseudo = RenderStyle::SCROLLBAR_TRACK;
+                dynamicPseudo = SCROLLBAR_TRACK;
                 return true;
             case CSSSelector::PseudoScrollbarTrackPiece:
-                dynamicPseudo = RenderStyle::SCROLLBAR_TRACK_PIECE;
+                dynamicPseudo = SCROLLBAR_TRACK_PIECE;
                 return true;
             case CSSSelector::PseudoResizer:
-                dynamicPseudo = RenderStyle::RESIZER;
+                dynamicPseudo = RESIZER;
                 return true;
             case CSSSelector::PseudoUnknown:
             case CSSSelector::PseudoNotParsed:
@@ -2441,7 +2517,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
     return true;
 }
 
-bool CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass(CSSSelector* sel, RenderStyle::PseudoId&) const
+bool CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass(CSSSelector* sel, PseudoId&) const
 {
     RenderScrollbar* scrollbar = RenderScrollbar::scrollbarForStyleResolve();
     ScrollbarPart part = RenderScrollbar::partForStyleResolve();
@@ -2652,16 +2728,23 @@ void CSSRuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluat
 // -------------------------------------------------------------------------------------
 // this is mostly boring stuff on how to apply a certain rule to the renderstyle...
 
-static Length convertToLength(CSSPrimitiveValue *primitiveValue, RenderStyle *style, bool *ok = 0)
+static Length convertToLength(CSSPrimitiveValue *primitiveValue, RenderStyle *style, double multiplier = 1, bool *ok = 0)
 {
+    // This function is tolerant of a null style value. The only place style is used is in
+    // length measurements, like 'ems' and 'px'. And in those cases style is only used
+    // when the units are EMS or EXS. So we will just fail in those cases.
     Length l;
     if (!primitiveValue) {
         if (ok)
             *ok = false;
     } else {
         int type = primitiveValue->primitiveType();
-        if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
-            l = Length(primitiveValue->computeLengthIntForLength(style), Fixed);
+        
+        if (!style && (type == CSSPrimitiveValue::CSS_EMS || type == CSSPrimitiveValue::CSS_EXS)) {
+            if (ok)
+                *ok = false;
+        } else if (CSSPrimitiveValue::isUnitTypeLength(type))
+            l = Length(primitiveValue->computeLengthIntForLength(style, multiplier), Fixed);
         else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
         else if (type == CSSPrimitiveValue::CSS_NUMBER)
@@ -2836,26 +2919,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 return;
         }
         return;
-        
     case CSSPropertyBorderTopStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderTopStyle, BorderTopStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderTopStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderTopStyle, BorderTopStyle, BorderStyle)
         return;
     case CSSPropertyBorderRightStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderRightStyle, BorderRightStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderRightStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderRightStyle, BorderRightStyle, BorderStyle)
         return;
     case CSSPropertyBorderBottomStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderBottomStyle, BorderBottomStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderBottomStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderBottomStyle, BorderBottomStyle, BorderStyle)
         return;
     case CSSPropertyBorderLeftStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderLeftStyle, BorderLeftStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderLeftStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderLeftStyle, BorderLeftStyle, BorderStyle)
         return;
     case CSSPropertyOutlineStyle:
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(outlineStyle, OutlineStyle, BorderStyle)
@@ -2867,49 +2941,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     case CSSPropertyCaptionSide:
-    {
-        HANDLE_INHERIT_AND_INITIAL(captionSide, CaptionSide)
-        if (primitiveValue)
-            m_style->setCaptionSide(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(captionSide, CaptionSide)
         return;
-    }
     case CSSPropertyClear:
-    {
-        HANDLE_INHERIT_AND_INITIAL(clear, Clear)
-        if (primitiveValue)
-            m_style->setClear(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(clear, Clear)
         return;
-    }
     case CSSPropertyDirection:
-    {
-        HANDLE_INHERIT_AND_INITIAL(direction, Direction)
-        if (primitiveValue)
-            m_style->setDirection(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(direction, Direction)
         return;
-    }
     case CSSPropertyDisplay:
-    {
-        HANDLE_INHERIT_AND_INITIAL(display, Display)
-        if (primitiveValue)
-            m_style->setDisplay(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(display, Display)
         return;
-    }
-
     case CSSPropertyEmptyCells:
-    {
-        HANDLE_INHERIT_AND_INITIAL(emptyCells, EmptyCells)
-        if (primitiveValue)
-            m_style->setEmptyCells(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
         return;
-    }
     case CSSPropertyFloat:
-    {
-        HANDLE_INHERIT_AND_INITIAL(floating, Floating)
-        if (primitiveValue)
-            m_style->setFloating(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(floating, Floating)
         return;
-    }
-
     case CSSPropertyFontStyle:
     {
         FontDescription fontDescription = m_style->fontDescription();
@@ -2958,7 +3006,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         if (m_style->setFontDescription(fontDescription))
             m_fontDirty = true;
-        return;        
+        return;
     }
 
     case CSSPropertyFontWeight:
@@ -3020,21 +3068,11 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
         
     case CSSPropertyListStylePosition:
-    {
-        HANDLE_INHERIT_AND_INITIAL(listStylePosition, ListStylePosition)
-        if (primitiveValue)
-            m_style->setListStylePosition(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(listStylePosition, ListStylePosition)
         return;
-    }
-
     case CSSPropertyListStyleType:
-    {
-        HANDLE_INHERIT_AND_INITIAL(listStyleType, ListStyleType)
-        if (primitiveValue)
-            m_style->setListStyleType(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(listStyleType, ListStyleType)
         return;
-    }
-
     case CSSPropertyOverflow:
     {
         if (isInherit) {
@@ -3057,35 +3095,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
 
     case CSSPropertyOverflowX:
-    {
-        HANDLE_INHERIT_AND_INITIAL(overflowX, OverflowX)
-        m_style->setOverflowX(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowX, OverflowX)
         return;
-    }
-
     case CSSPropertyOverflowY:
-    {
-        HANDLE_INHERIT_AND_INITIAL(overflowY, OverflowY)
-        m_style->setOverflowY(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowY, OverflowY)
         return;
-    }
-
     case CSSPropertyPageBreakBefore:
-    {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
-        if (primitiveValue)
-            m_style->setPageBreakBefore(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
         return;
-    }
-
     case CSSPropertyPageBreakAfter:
-    {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
-        if (primitiveValue)
-            m_style->setPageBreakAfter(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
         return;
-    }
-
     case CSSPropertyPageBreakInside: {
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakInside, PageBreakInside, PageBreak)
         if (!primitiveValue)
@@ -3097,13 +3117,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
         
     case CSSPropertyPosition:
-    {
-        HANDLE_INHERIT_AND_INITIAL(position, Position)
-        if (primitiveValue)
-            m_style->setPosition(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(position, Position)
         return;
-    }
-
     case CSSPropertyTableLayout: {
         HANDLE_INHERIT_AND_INITIAL(tableLayout, TableLayout)
 
@@ -3115,26 +3130,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
         
-    case CSSPropertyUnicodeBidi: {
-        HANDLE_INHERIT_AND_INITIAL(unicodeBidi, UnicodeBidi)
-        m_style->setUnicodeBidi(*primitiveValue);
+    case CSSPropertyUnicodeBidi: 
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(unicodeBidi, UnicodeBidi)
         return;
-    }
-    case CSSPropertyTextTransform: {
-        HANDLE_INHERIT_AND_INITIAL(textTransform, TextTransform)
-        m_style->setTextTransform(*primitiveValue);
+    case CSSPropertyTextTransform: 
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textTransform, TextTransform)
         return;
-    }
-
     case CSSPropertyVisibility:
-    {
-        HANDLE_INHERIT_AND_INITIAL(visibility, Visibility)
-        m_style->setVisibility(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(visibility, Visibility)
         return;
-    }
     case CSSPropertyWhiteSpace:
-        HANDLE_INHERIT_AND_INITIAL(whiteSpace, WhiteSpace)
-        m_style->setWhiteSpace(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(whiteSpace, WhiteSpace)
         return;
 
     case CSSPropertyBackgroundPosition:
@@ -3176,7 +3182,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(horizontalBorderSpacing, HorizontalBorderSpacing)
         if (!primitiveValue)
             return;
-        short spacing =  primitiveValue->computeLengthShort(style(), zoomFactor);
+        short spacing = primitiveValue->computeLengthShort(style(), zoomFactor);
         m_style->setHorizontalBorderSpacing(spacing);
         return;
     }
@@ -3184,7 +3190,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(verticalBorderSpacing, VerticalBorderSpacing)
         if (!primitiveValue)
             return;
-        short spacing =  primitiveValue->computeLengthShort(style(), zoomFactor);
+        short spacing = primitiveValue->computeLengthShort(style(), zoomFactor);
         m_style->setVerticalBorderSpacing(spacing);
         return;
     }
@@ -3223,7 +3229,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             }
         } else if (primitiveValue) {
             int type = primitiveValue->primitiveType();
-            if (type == CSSPrimitiveValue::CSS_IDENT)
+            if (type == CSSPrimitiveValue::CSS_IDENT && m_style->cursor() != ECursor(*primitiveValue))
                 m_style->setCursor(*primitiveValue);
         }
         return;
@@ -3427,38 +3433,21 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
-    case CSSPropertyWordBreak: {
-        HANDLE_INHERIT_AND_INITIAL(wordBreak, WordBreak)
-        m_style->setWordBreak(*primitiveValue);
+    case CSSPropertyWordBreak:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordBreak, WordBreak)
         return;
-    }
-
-    case CSSPropertyWordWrap: {
-        HANDLE_INHERIT_AND_INITIAL(wordWrap, WordWrap)
-        m_style->setWordWrap(*primitiveValue);
+    case CSSPropertyWordWrap:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordWrap, WordWrap)
         return;
-    }
-
     case CSSPropertyWebkitNbspMode:
-    {
-        HANDLE_INHERIT_AND_INITIAL(nbspMode, NBSPMode)
-        m_style->setNBSPMode(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(nbspMode, NBSPMode)
         return;
-    }
-
     case CSSPropertyWebkitLineBreak:
-    {
-        HANDLE_INHERIT_AND_INITIAL(khtmlLineBreak, KHTMLLineBreak)
-        m_style->setKHTMLLineBreak(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(khtmlLineBreak, KHTMLLineBreak)
         return;
-    }
-
     case CSSPropertyWebkitMatchNearestMailBlockquoteColor:
-    {
-        HANDLE_INHERIT_AND_INITIAL(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
-        m_style->setMatchNearestMailBlockquoteColor(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
         return;
-    }
 
     case CSSPropertyResize:
     {
@@ -3554,7 +3543,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
         if (primitiveValue && !apply) {
             int type = primitiveValue->primitiveType();
-            if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+            if (CSSPrimitiveValue::isUnitTypeLength(type))
                 // Handle our quirky margin units if we have them.
                 l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed, 
                            primitiveValue->isQuirkValue());
@@ -3655,7 +3644,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
         if (primitiveValue && !apply) {
             unsigned short type = primitiveValue->primitiveType();
-            if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+            if (CSSPrimitiveValue::isUnitTypeLength(type))
                 l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
             else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
                 l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -3711,7 +3700,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         } else {
           int type = primitiveValue->primitiveType();
           Length l;
-          if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+          if (CSSPrimitiveValue::isUnitTypeLength(type))
             l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
           else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -3775,7 +3764,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                                               (type != CSSPrimitiveValue::CSS_PERCENTAGE &&
                                                type != CSSPrimitiveValue::CSS_EMS && 
                                                type != CSSPrimitiveValue::CSS_EXS));
-            if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+            if (CSSPrimitiveValue::isUnitTypeLength(type))
                 size = primitiveValue->computeLengthFloat(m_parentStyle, true);
             else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
                 size = (primitiveValue->getFloatValue() * oldSize) / 100.0f;
@@ -3838,7 +3827,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         int type = primitiveValue->primitiveType();
         if (primitiveValue->getIdent() == CSSValueNormal)
             lineHeight = Length(-100.0, Percent);
-        else if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG) {
+        else if (CSSPrimitiveValue::isUnitTypeLength(type)) {
             double multiplier = m_style->effectiveZoom();
             if (m_style->textSizeAdjust() && m_checker.m_document->frame() && m_checker.m_document->frame()->shouldApplyTextZoom())
                 multiplier *= m_checker.m_document->frame()->textZoomFactor();
@@ -3883,8 +3872,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 right = m_parentStyle->clipRight();
                 bottom = m_parentStyle->clipBottom();
                 left = m_parentStyle->clipLeft();
-            }
-            else {
+            } else {
                 hasClip = false;
                 top = right = bottom = left = Length();
             }
@@ -3897,11 +3885,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             Rect* rect = primitiveValue->getRectValue();
             if (!rect)
                 return;
-            top = convertToLength(rect->top(), style());
-            right = convertToLength(rect->right(), style());
-            bottom = convertToLength(rect->bottom(), style());
-            left = convertToLength(rect->left(), style());
-
+            top = convertToLength(rect->top(), style(), zoomFactor);
+            right = convertToLength(rect->right(), style(), zoomFactor);
+            bottom = convertToLength(rect->bottom(), style(), zoomFactor);
+            left = convertToLength(rect->left(), style(), zoomFactor);
         } else if (primitiveValue->getIdent() != CSSValueAuto) {
             return;
         }
@@ -3949,7 +3936,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                     break;
                 case CSSPrimitiveValue::CSS_ATTR: {
                     // FIXME: Can a namespace be specified for an attr(foo)?
-                    if (m_style->styleType() == RenderStyle::NOPSEUDO)
+                    if (m_style->styleType() == NOPSEUDO)
                         m_style->setUnique();
                     else
                         m_parentStyle->setUnique();
@@ -4282,6 +4269,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 m_fontDirty = true;
         } else if (isInitial) {
             Settings* settings = m_checker.m_document->settings();
+            ASSERT(settings); // If we're doing style resolution, this document should always be in a frame and thus have settings
+            if (!settings)
+                return;
             FontDescription fontDescription;
             fontDescription.setGenericFamily(FontDescription::StandardFamily);
             fontDescription.setRenderingMode(settings->fontRenderingMode());
@@ -4308,6 +4298,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (fontDescription.isAbsoluteSize()) {
                 // Make sure the rendering mode and printer font settings are updated.
                 Settings* settings = m_checker.m_document->settings();
+                ASSERT(settings); // If we're doing style resolution, this document should always be in a frame and thus have settings
+                if (!settings)
+                    return;
                 fontDescription.setRenderingMode(settings->fontRenderingMode());
                 fontDescription.setUsePrinterFont(m_checker.m_document->printing());
            
@@ -4567,21 +4560,20 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyUnicodeRange: // Only used in @font-face rules.
         return;
-    case CSSPropertyWebkitBoxDirection:
-        HANDLE_INHERIT_AND_INITIAL(boxDirection, BoxDirection)
+    case CSSPropertyWebkitBackfaceVisibility:
+        HANDLE_INHERIT_AND_INITIAL(backfaceVisibility, BackfaceVisibility)
         if (primitiveValue)
-            m_style->setBoxDirection(*primitiveValue);
-        return;        
+            m_style->setBackfaceVisibility((primitiveValue->getIdent() == CSSValueVisible) ? BackfaceVisibilityVisible : BackfaceVisibilityHidden);
+        return;
+    case CSSPropertyWebkitBoxDirection:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxDirection, BoxDirection)
+        return;
     case CSSPropertyWebkitBoxLines:
-        HANDLE_INHERIT_AND_INITIAL(boxLines, BoxLines)
-        if (primitiveValue)
-            m_style->setBoxLines(*primitiveValue);
-        return;     
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxLines, BoxLines)
+        return;
     case CSSPropertyWebkitBoxOrient:
-        HANDLE_INHERIT_AND_INITIAL(boxOrient, BoxOrient)
-        if (primitiveValue)
-            m_style->setBoxOrient(*primitiveValue);
-        return;     
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxOrient, BoxOrient)
+        return;
     case CSSPropertyWebkitBoxPack:
     {
         HANDLE_INHERIT_AND_INITIAL(boxPack, BoxPack)
@@ -4603,7 +4595,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         if (!primitiveValue || primitiveValue->primitiveType() != CSSPrimitiveValue::CSS_NUMBER)
             return; // Error case.
         m_style->setBoxFlexGroup((unsigned int)(primitiveValue->getDoubleValue()));
-        return;        
+        return;
     case CSSPropertyWebkitBoxOrdinalGroup:
         HANDLE_INHERIT_AND_INITIAL(boxOrdinalGroup, BoxOrdinalGroup)
         if (!primitiveValue || primitiveValue->primitiveType() != CSSPrimitiveValue::CSS_NUMBER)
@@ -4662,19 +4654,14 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
     case CSSPropertyWebkitColumnRuleStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
-        m_style->setColumnRuleStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
         return;
-    case CSSPropertyWebkitColumnBreakBefore: {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
-        m_style->setColumnBreakBefore(*primitiveValue);
+    case CSSPropertyWebkitColumnBreakBefore:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
         return;
-    }
-    case CSSPropertyWebkitColumnBreakAfter: {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
-        m_style->setColumnBreakAfter(*primitiveValue);
+    case CSSPropertyWebkitColumnBreakAfter:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
         return;
-    }
     case CSSPropertyWebkitColumnBreakInside: {
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakInside, ColumnBreakInside, PageBreak)
         EPageBreak pb = *primitiveValue;
@@ -4765,42 +4752,28 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         else {
             bool ok = true;
-            Length l = convertToLength(primitiveValue, style(), &ok);
+            Length l = convertToLength(primitiveValue, style(), 1, &ok);
             if (ok)
                 m_style->setMarqueeIncrement(l);
         }
         return;
     }
-    case CSSPropertyWebkitMarqueeStyle: {
-        HANDLE_INHERIT_AND_INITIAL(marqueeBehavior, MarqueeBehavior)      
-        if (primitiveValue)
-            m_style->setMarqueeBehavior(*primitiveValue);
+    case CSSPropertyWebkitMarqueeStyle:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)      
         return;
-    }
-    case CSSPropertyWebkitMarqueeDirection: {
-        HANDLE_INHERIT_AND_INITIAL(marqueeDirection, MarqueeDirection)
-        if (primitiveValue)
-            m_style->setMarqueeDirection(*primitiveValue);
+    case CSSPropertyWebkitMarqueeDirection:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
         return;
-    }
-    case CSSPropertyWebkitUserDrag: {
-        HANDLE_INHERIT_AND_INITIAL(userDrag, UserDrag)      
-        if (primitiveValue)
-            m_style->setUserDrag(*primitiveValue);
+    case CSSPropertyWebkitUserDrag:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userDrag, UserDrag)      
         return;
-    }
-    case CSSPropertyWebkitUserModify: {
-        HANDLE_INHERIT_AND_INITIAL(userModify, UserModify)      
-        if (primitiveValue)
-            m_style->setUserModify(*primitiveValue);
+    case CSSPropertyWebkitUserModify:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userModify, UserModify)      
         return;
-    }
-    case CSSPropertyWebkitUserSelect: {
-        HANDLE_INHERIT_AND_INITIAL(userSelect, UserSelect)      
-        if (primitiveValue)
-            m_style->setUserSelect(*primitiveValue);
+    case CSSPropertyWebkitUserSelect:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userSelect, UserSelect)      
         return;
-    }
+
     case CSSPropertyTextOverflow: {
         // This property is supported by WinIE, and so we leave off the "-webkit-" in order to
         // work with WinIE-specific pages that use the property.
@@ -4821,18 +4794,13 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     }
-    case CSSPropertyWebkitMarginTopCollapse: {
-        HANDLE_INHERIT_AND_INITIAL(marginTopCollapse, MarginTopCollapse)
-        if (primitiveValue)
-            m_style->setMarginTopCollapse(*primitiveValue);
+
+    case CSSPropertyWebkitMarginTopCollapse:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginTopCollapse, MarginTopCollapse)
         return;
-    }
-    case CSSPropertyWebkitMarginBottomCollapse: {
-        HANDLE_INHERIT_AND_INITIAL(marginBottomCollapse, MarginBottomCollapse)
-        if (primitiveValue)
-            m_style->setMarginBottomCollapse(*primitiveValue);
+    case CSSPropertyWebkitMarginBottomCollapse:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginBottomCollapse, MarginBottomCollapse)
         return;
-    }
 
     // Apple-specific changes.  Do not merge these properties into KHTML.
     case CSSPropertyWebkitLineClamp: {
@@ -4865,12 +4833,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_fontDirty = true;
         return;
     }
-    case CSSPropertyWebkitTextSecurity: {
-        HANDLE_INHERIT_AND_INITIAL(textSecurity, TextSecurity)
-        if (primitiveValue)
-            m_style->setTextSecurity(*primitiveValue);
+    case CSSPropertyWebkitTextSecurity:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textSecurity, TextSecurity)
         return;
-    }
+
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion: {
         HANDLE_INHERIT_AND_INITIAL(dashboardRegions, DashboardRegions)
@@ -4942,13 +4908,14 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitTransformOrigin:
         HANDLE_INHERIT_AND_INITIAL(transformOriginX, TransformOriginX)
         HANDLE_INHERIT_AND_INITIAL(transformOriginY, TransformOriginY)
+        HANDLE_INHERIT_AND_INITIAL(transformOriginZ, TransformOriginZ)
         return;
     case CSSPropertyWebkitTransformOriginX: {
         HANDLE_INHERIT_AND_INITIAL(transformOriginX, TransformOriginX)
         CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
         Length l;
         int type = primitiveValue->primitiveType();
-        if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
             l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
         else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -4962,7 +4929,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
         Length l;
         int type = primitiveValue->primitiveType();
-        if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
             l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
         else if(type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -4971,6 +4938,69 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setTransformOriginY(l);
         break;
     }
+    case CSSPropertyWebkitTransformOriginZ: {
+        HANDLE_INHERIT_AND_INITIAL(transformOriginZ, TransformOriginZ)
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        float f;
+        int type = primitiveValue->primitiveType();
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
+            f = static_cast<float>(primitiveValue->computeLengthIntForLength(style()));
+        else
+            return;
+        m_style->setTransformOriginZ(f);
+        break;
+    }
+    case CSSPropertyWebkitTransformStyle:
+        HANDLE_INHERIT_AND_INITIAL(transformStyle3D, TransformStyle3D)
+        if (primitiveValue)
+            m_style->setTransformStyle3D((primitiveValue->getIdent() == CSSValuePreserve3d) ? TransformStyle3DPreserve3D : TransformStyle3DFlat);
+        return;
+    case CSSPropertyWebkitPerspective: {
+        HANDLE_INHERIT_AND_INITIAL(perspective, Perspective)
+        if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
+            m_style->setPerspective(0);
+            return;
+        }
+
+        if (primitiveValue->primitiveType() != CSSPrimitiveValue::CSS_NUMBER)
+            return;
+        float perspectiveValue = static_cast<float>(primitiveValue->getDoubleValue());
+        if (perspectiveValue >= 0.0f)
+            m_style->setPerspective(perspectiveValue);
+        return;
+    }
+    case CSSPropertyWebkitPerspectiveOrigin:
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginX, PerspectiveOriginX)
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginY, PerspectiveOriginY)
+        return;
+    case CSSPropertyWebkitPerspectiveOriginX: {
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginX, PerspectiveOriginX)
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        Length l;
+        int type = primitiveValue->primitiveType();
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
+            l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
+        else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            l = Length(primitiveValue->getDoubleValue(), Percent);
+        else
+            return;
+        m_style->setPerspectiveOriginX(l);
+        return;
+    }
+    case CSSPropertyWebkitPerspectiveOriginY: {
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginY, PerspectiveOriginY)
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        Length l;
+        int type = primitiveValue->primitiveType();
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
+            l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
+        else if(type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            l = Length(primitiveValue->getDoubleValue(), Percent);
+        else
+            return;
+        m_style->setPerspectiveOriginY(l);
+        return;
+    }
     case CSSPropertyWebkitAnimation:
         if (isInitial)
             m_style->clearAnimations();
@@ -4992,9 +5022,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitAnimationName:
         HANDLE_ANIMATION_VALUE(name, Name, value)
         return;
-    case CSSPropertyWebkitAnimationPlayState:
-        HANDLE_ANIMATION_VALUE(playState, PlayState, value)
-        return;
     case CSSPropertyWebkitAnimationTimingFunction:
         HANDLE_ANIMATION_VALUE(timingFunction, TimingFunction, value)
         return;
@@ -5018,6 +5045,13 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyPointerEvents:
     {
+#if ENABLE(DASHBOARD_SUPPORT)
+        // <rdar://problem/6561077> Work around the Stocks widget's misuse of the
+        // pointer-events property by not applying it in Dashboard.
+        Settings* settings = m_checker.m_document->settings();
+        if (settings && settings->usesDashboardBackwardCompatibilityMode())
+            return;
+#endif
         HANDLE_INHERIT_AND_INITIAL(pointerEvents, PointerEvents)
         if (!primitiveValue)
             return;
@@ -5029,13 +5063,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyFontStretch:
     case CSSPropertyPage:
     case CSSPropertyQuotes:
-    case CSSPropertyScrollbar3dlightColor:
-    case CSSPropertyScrollbarArrowColor:
-    case CSSPropertyScrollbarDarkshadowColor:
-    case CSSPropertyScrollbarFaceColor:
-    case CSSPropertyScrollbarHighlightColor:
-    case CSSPropertyScrollbarShadowColor:
-    case CSSPropertyScrollbarTrackColor:
     case CSSPropertySize:
     case CSSPropertyTextLineThrough:
     case CSSPropertyTextLineThroughColor:
@@ -5057,6 +5084,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitPaddingStart:
     case CSSPropertyWebkitTextDecorationsInEffect:
     case CSSPropertyWebkitTextStroke:
+    case CSSPropertyWebkitVariableDeclarationBlock:
         return;
 #if ENABLE(SVG)
     default:
@@ -5195,7 +5223,7 @@ void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
 
     if (firstType == CSSPrimitiveValue::CSS_UNKNOWN)
         firstLength = Length(Auto);
-    else if (firstType > CSSPrimitiveValue::CSS_PERCENTAGE && firstType < CSSPrimitiveValue::CSS_DEG)
+    else if (CSSPrimitiveValue::isUnitTypeLength(firstType))
         firstLength = Length(first->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (firstType == CSSPrimitiveValue::CSS_PERCENTAGE)
         firstLength = Length(first->getDoubleValue(), Percent);
@@ -5204,7 +5232,7 @@ void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
 
     if (secondType == CSSPrimitiveValue::CSS_UNKNOWN)
         secondLength = Length(Auto);
-    else if (secondType > CSSPrimitiveValue::CSS_PERCENTAGE && secondType < CSSPrimitiveValue::CSS_DEG)
+    else if (CSSPrimitiveValue::isUnitTypeLength(secondType))
         secondLength = Length(second->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (secondType == CSSPrimitiveValue::CSS_PERCENTAGE)
         secondLength = Length(second->getDoubleValue(), Percent);
@@ -5231,7 +5259,7 @@ void CSSStyleSelector::mapFillXPosition(FillLayer* layer, CSSValue* value)
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     Length l;
     int type = primitiveValue->primitiveType();
-    if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+    if (CSSPrimitiveValue::isUnitTypeLength(type))
         l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
         l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -5255,7 +5283,7 @@ void CSSStyleSelector::mapFillYPosition(FillLayer* layer, CSSValue* value)
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     Length l;
     int type = primitiveValue->primitiveType();
-    if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+    if (CSSPrimitiveValue::isUnitTypeLength(type))
         l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
         l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -5286,7 +5314,7 @@ void CSSStyleSelector::mapAnimationDirection(Animation* layer, CSSValue* value)
     }
 
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    layer->setDirection(primitiveValue->getIdent() == CSSValueAlternate);
+    layer->setDirection(primitiveValue->getIdent() == CSSValueAlternate ? Animation::AnimationDirectionAlternate : Animation::AnimationDirectionNormal);
 }
 
 void CSSStyleSelector::mapAnimationDuration(Animation* animation, CSSValue* value)
@@ -5338,17 +5366,6 @@ void CSSStyleSelector::mapAnimationName(Animation* layer, CSSValue* value)
         layer->setName(primitiveValue->getStringValue());
 }
 
-void CSSStyleSelector::mapAnimationPlayState(Animation* layer, CSSValue* value)
-{
-    if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setPlayState(Animation::initialAnimationPlayState());
-        return;
-    }
-
-    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    layer->setPlayState((primitiveValue->getIdent() == CSSValuePaused) ? AnimPlayStatePaused : AnimPlayStatePlaying);
-}
-
 void CSSStyleSelector::mapAnimationProperty(Animation* animation, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
@@ -5737,7 +5754,7 @@ void CSSStyleSelector::SelectorChecker::allVisitedStateChanged()
         return;
     for (Node* node = m_document; node; node = node->traverseNextNode()) {
         if (node->isLink())
-            node->setChanged();
+            node->setNeedsStyleRecalc();
     }
 }
 
@@ -5748,31 +5765,43 @@ void CSSStyleSelector::SelectorChecker::visitedStateChanged(LinkHash visitedHash
     for (Node* node = m_document; node; node = node->traverseNextNode()) {
         const AtomicString* attr = linkAttribute(node);
         if (attr && visitedLinkHash(m_document->baseURL(), *attr) == visitedHash)
-            node->setChanged();
+            node->setNeedsStyleRecalc();
     }
 }
 
-TransformOperation::OperationType getTransformOperationType(WebKitCSSTransformValue::TransformOperationType type)
+static TransformOperation::OperationType getTransformOperationType(WebKitCSSTransformValue::TransformOperationType type)
 {
     switch (type) {
         case WebKitCSSTransformValue::ScaleTransformOperation:          return TransformOperation::SCALE;
         case WebKitCSSTransformValue::ScaleXTransformOperation:         return TransformOperation::SCALE_X;
         case WebKitCSSTransformValue::ScaleYTransformOperation:         return TransformOperation::SCALE_Y;
+        case WebKitCSSTransformValue::ScaleZTransformOperation:         return TransformOperation::SCALE_Z;
+        case WebKitCSSTransformValue::Scale3DTransformOperation:        return TransformOperation::SCALE_3D;
         case WebKitCSSTransformValue::TranslateTransformOperation:      return TransformOperation::TRANSLATE;
         case WebKitCSSTransformValue::TranslateXTransformOperation:     return TransformOperation::TRANSLATE_X;
         case WebKitCSSTransformValue::TranslateYTransformOperation:     return TransformOperation::TRANSLATE_Y;
+        case WebKitCSSTransformValue::TranslateZTransformOperation:     return TransformOperation::TRANSLATE_Z;
+        case WebKitCSSTransformValue::Translate3DTransformOperation:    return TransformOperation::TRANSLATE_3D;
         case WebKitCSSTransformValue::RotateTransformOperation:         return TransformOperation::ROTATE;
+        case WebKitCSSTransformValue::RotateXTransformOperation:        return TransformOperation::ROTATE_X;
+        case WebKitCSSTransformValue::RotateYTransformOperation:        return TransformOperation::ROTATE_Y;
+        case WebKitCSSTransformValue::RotateZTransformOperation:        return TransformOperation::ROTATE_Z;
+        case WebKitCSSTransformValue::Rotate3DTransformOperation:       return TransformOperation::ROTATE_3D;
         case WebKitCSSTransformValue::SkewTransformOperation:           return TransformOperation::SKEW;
         case WebKitCSSTransformValue::SkewXTransformOperation:          return TransformOperation::SKEW_X;
         case WebKitCSSTransformValue::SkewYTransformOperation:          return TransformOperation::SKEW_Y;
         case WebKitCSSTransformValue::MatrixTransformOperation:         return TransformOperation::MATRIX;
+        case WebKitCSSTransformValue::Matrix3DTransformOperation:       return TransformOperation::MATRIX_3D;
+        case WebKitCSSTransformValue::PerspectiveTransformOperation:    return TransformOperation::PERSPECTIVE;
         case WebKitCSSTransformValue::UnknownTransformOperation:        return TransformOperation::NONE;
     }
     return TransformOperation::NONE;
 }
 
-bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle* inStyle, TransformOperations& outOperations)
+bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle* style, TransformOperations& outOperations)
 {
+    float zoomFactor = style ? style->effectiveZoom() : 1;
+
     TransformOperations operations;
     if (inValue && !inValue->isPrimitiveValue()) {
         CSSValueList* list = static_cast<CSSValueList*>(inValue);
@@ -5800,7 +5829,33 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                                 sy = sx;
                         }
                     }
-                    operations.operations().append(ScaleTransformOperation::create(sx, sy, getTransformOperationType(val->operationType())));
+                    operations.operations().append(ScaleTransformOperation::create(sx, sy, 1.0, getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::ScaleZTransformOperation:
+                case WebKitCSSTransformValue::Scale3DTransformOperation: {
+                    double sx = 1.0;
+                    double sy = 1.0;
+                    double sz = 1.0;
+                    if (val->operationType() == WebKitCSSTransformValue::ScaleZTransformOperation)
+                        sz = firstValue->getDoubleValue();
+                    else if (val->operationType() == WebKitCSSTransformValue::ScaleYTransformOperation)
+                        sy = firstValue->getDoubleValue();
+                    else { 
+                        sx = firstValue->getDoubleValue();
+                        if (val->operationType() != WebKitCSSTransformValue::ScaleXTransformOperation) {
+                            if (val->length() > 2) {
+                                CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
+                                sz = thirdValue->getDoubleValue();
+                            }
+                            if (val->length() > 1) {
+                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
+                                sy = secondValue->getDoubleValue();
+                            } else 
+                                sy = sx;
+                        }
+                    }
+                    operations.operations().append(ScaleTransformOperation::create(sx, sy, sz, getTransformOperationType(val->operationType())));
                     break;
                 }
                 case WebKitCSSTransformValue::TranslateTransformOperation:
@@ -5810,13 +5865,43 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     Length tx = Length(0, Fixed);
                     Length ty = Length(0, Fixed);
                     if (val->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                        ty = convertToLength(firstValue, inStyle, &ok);
+                        ty = convertToLength(firstValue, style, zoomFactor, &ok);
+                    else { 
+                        tx = convertToLength(firstValue, style, zoomFactor, &ok);
+                        if (val->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
+                            if (val->length() > 1) {
+                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
+                                ty = convertToLength(secondValue, style, zoomFactor, &ok);
+                            }
+                        }
+                    }
+
+                    if (!ok)
+                        return false;
+
+                    operations.operations().append(TranslateTransformOperation::create(tx, ty, Length(0, Fixed), getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::TranslateZTransformOperation:
+                case WebKitCSSTransformValue::Translate3DTransformOperation: {
+                    bool ok = true;
+                    Length tx = Length(0, Fixed);
+                    Length ty = Length(0, Fixed);
+                    Length tz = Length(0, Fixed);
+                    if (val->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
+                        tz = convertToLength(firstValue, style, zoomFactor, &ok);
+                    else if (val->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
+                        ty = convertToLength(firstValue, style, zoomFactor, &ok);
                     else { 
-                        tx = convertToLength(firstValue, inStyle, &ok);
+                        tx = convertToLength(firstValue, style, zoomFactor, &ok);
                         if (val->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
+                            if (val->length() > 2) {
+                                CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
+                                tz = convertToLength(thirdValue, style, zoomFactor, &ok);
+                            }
                             if (val->length() > 1) {
                                 CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                                ty = convertToLength(secondValue, inStyle, &ok);
+                                ty = convertToLength(secondValue, style, zoomFactor, &ok);
                             }
                         }
                     }
@@ -5824,7 +5909,7 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     if (!ok)
                         return false;
 
-                    operations.operations().append(TranslateTransformOperation::create(tx, ty, getTransformOperationType(val->operationType())));
+                    operations.operations().append(TranslateTransformOperation::create(tx, ty, tz, getTransformOperationType(val->operationType())));
                     break;
                 }
                 case WebKitCSSTransformValue::RotateTransformOperation: {
@@ -5836,7 +5921,43 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
                         angle = turn2deg(angle);
                     
-                    operations.operations().append(RotateTransformOperation::create(angle, getTransformOperationType(val->operationType())));
+                    operations.operations().append(RotateTransformOperation::create(0, 0, 1, angle, getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::RotateXTransformOperation:
+                case WebKitCSSTransformValue::RotateYTransformOperation:
+                case WebKitCSSTransformValue::RotateZTransformOperation: {
+                    double x = 0;
+                    double y = 0;
+                    double z = 0;
+                    double angle = firstValue->getDoubleValue();
+                    if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                        angle = rad2deg(angle);
+                    else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                        angle = grad2deg(angle);
+                    
+                    if (val->operationType() == WebKitCSSTransformValue::RotateXTransformOperation)
+                        x = 1;
+                    else if (val->operationType() == WebKitCSSTransformValue::RotateYTransformOperation)
+                        y = 1;
+                    else
+                        z = 1;
+                    operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::Rotate3DTransformOperation: {
+                    CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
+                    CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
+                    CSSPrimitiveValue* fourthValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3));
+                    double x = firstValue->getDoubleValue();
+                    double y = secondValue->getDoubleValue();
+                    double z = thirdValue->getDoubleValue();
+                    double angle = fourthValue->getDoubleValue();
+                    if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                        angle = rad2deg(angle);
+                    else if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                        angle = grad2deg(angle);
+                    operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(val->operationType())));
                     break;
                 }
                 case WebKitCSSTransformValue::SkewTransformOperation:
@@ -5872,15 +5993,42 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     break;
                 }
                 case WebKitCSSTransformValue::MatrixTransformOperation: {
-                    float a = firstValue->getFloatValue();
-                    float b = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getFloatValue();
-                    float c = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getFloatValue();
-                    float d = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getFloatValue();
-                    float e = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getFloatValue();
-                    float f = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getFloatValue();
+                    double a = firstValue->getDoubleValue();
+                    double b = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getDoubleValue();
+                    double c = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getDoubleValue();
+                    double d = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getDoubleValue();
+                    double e = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getDoubleValue();
+                    double f = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getDoubleValue();
                     operations.operations().append(MatrixTransformOperation::create(a, b, c, d, e, f));
                     break;
                 }
+                case WebKitCSSTransformValue::Matrix3DTransformOperation: {
+                    TransformationMatrix matrix(static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(0))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(6))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(7))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(8))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(9))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(10))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(11))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(12))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(13))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(14))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(15))->getDoubleValue());
+                    operations.operations().append(Matrix3DTransformOperation::create(matrix));
+                    break;
+                }   
+                case WebKitCSSTransformValue::PerspectiveTransformOperation: {
+                    double p = firstValue->getDoubleValue();
+                    if (p < 0.0)
+                        return false;
+                    operations.operations().append(PerspectiveTransformOperation::create(p));
+                    break;
+                }
                 case WebKitCSSTransformValue::UnknownTransformOperation:
                     ASSERT_NOT_REACHED();
                     break;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
index 74f9dd7431..8dd36d795e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
@@ -83,11 +83,11 @@ public:
         ~CSSStyleSelector();
 
         void initElementAndPseudoState(Element*);
-        void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, RenderStyle::PseudoId = RenderStyle::NOPSEUDO);
+        void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
         PassRefPtr<RenderStyle> styleForElement(Element*, RenderStyle* parentStyle = 0, bool allowSharing = true, bool resolveForRootDefault = false);
         void keyframeStylesForAnimation(Element*, const RenderStyle*, KeyframeList& list);
 
-        PassRefPtr<RenderStyle> pseudoStyleForElement(RenderStyle::PseudoId, Element*, RenderStyle* parentStyle = 0);
+        PassRefPtr<RenderStyle> pseudoStyleForElement(PseudoId, Element*, RenderStyle* parentStyle = 0);
 
     private:
         RenderStyle* locateSharedStyle();
@@ -186,10 +186,10 @@ public:
             SelectorChecker(Document*, bool strictParsing);
 
             bool checkSelector(CSSSelector*, Element*) const;
-            SelectorMatch checkSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* = 0, RenderStyle* elementParentStyle = 0) const;
-            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle*, RenderStyle* elementParentStyle) const;
+            SelectorMatch checkSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* = 0, RenderStyle* elementParentStyle = 0) const;
+            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle*, RenderStyle* elementParentStyle) const;
             PseudoState checkPseudoState(Element*, bool checkVisited = true) const;
-            bool checkScrollbarPseudoClass(CSSSelector*, RenderStyle::PseudoId& dynamicPseudo) const;
+            bool checkScrollbarPseudoClass(CSSSelector*, PseudoId& dynamicPseudo) const;
 
             void allVisitedStateChanged();
             void visitedStateChanged(LinkHash visitedHash);
@@ -197,7 +197,7 @@ public:
             Document* m_document;
             bool m_strictParsing;
             bool m_collectRulesOnly;
-            RenderStyle::PseudoId m_pseudoStyle;
+            PseudoId m_pseudoStyle;
             bool m_documentIsHTML;
             mutable HashSet<LinkHash, LinkHashHash> m_linksCheckedForVisitedState;
         };
@@ -226,7 +226,6 @@ public:
         void mapAnimationDuration(Animation*, CSSValue*);
         void mapAnimationIterationCount(Animation*, CSSValue*);
         void mapAnimationName(Animation*, CSSValue*);
-        void mapAnimationPlayState(Animation*, CSSValue*);
         void mapAnimationProperty(Animation*, CSSValue*);
         void mapAnimationTimingFunction(Animation*, CSSValue*);
 
@@ -243,18 +242,18 @@ public:
         // set of matched decls four times, once for those properties that others depend on (like font-size),
         // and then a second time for all the remaining properties.  We then do the same two passes
         // for any !important rules.
-        Vector<CSSMutableStyleDeclaration*> m_matchedDecls;
+        Vector<CSSMutableStyleDeclaration*, 64> m_matchedDecls;
 
         // A buffer used to hold the set of matched rules for an element, and a temporary buffer used for
         // merge sorting.
-        Vector<CSSRuleData*> m_matchedRules;
+        Vector<CSSRuleData*, 32> m_matchedRules;
 
         RefPtr<CSSRuleList> m_ruleList;
 
         MediaQueryEvaluator* m_medium;
         RefPtr<RenderStyle> m_rootDefaultStyle;
 
-        RenderStyle::PseudoId m_dynamicPseudo;
+        PseudoId m_dynamicPseudo;
 
         SelectorChecker m_checker;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
index 47b2c81cf2..ce50af6a45 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
@@ -182,6 +182,10 @@ void CSSStyleSheet::checkLoaded()
         return;
     if (parent())
         parent()->checkLoaded();
+
+    // Avoid |this| being deleted by scripts that run via HTMLTokenizer::executeScriptsWaitingForStylesheets().
+    // See <rdar://problem/6622300>.
+    RefPtr<CSSStyleSheet> protector(this);
     m_loadCompleted = ownerNode() ? ownerNode()->sheetLoaded() : true;
 }
 
@@ -190,7 +194,7 @@ void CSSStyleSheet::styleSheetChanged()
     StyleBase* root = this;
     while (StyleBase* parent = root->parent())
         root = parent;
-    Document* documentToUpdate = (root && root->isCSSStyleSheet()) ? static_cast<CSSStyleSheet*>(root)->doc() : 0;
+    Document* documentToUpdate = root->isCSSStyleSheet() ? static_cast<CSSStyleSheet*>(root)->doc() : 0;
     
     /* FIXME: We don't need to do everything updateStyleSelector does,
      * basically we just need to recreate the document's selector with the
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValue.idl b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
index 8979b61f0c..875d12ee89 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,7 +22,7 @@ module css {
 
     interface [
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=9fd62a7b-539d-4500-bd6c-ec075abbc404,
         ImplementationUUID=e10a2860-f98e-4bd3-96b4-1493ad941dfe
     ] CSSValue {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
index 32711661bc..698dffe6fa 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
@@ -506,6 +506,9 @@ media-seek-back-button
 media-seek-forward-button
 media-slider
 media-sliderthumb
+media-timeline-container
+media-current-time-display
+media-time-remaining-display
 menulist
 menulist-button
 menulist-text
@@ -534,9 +537,13 @@ round
 #
 # CSS_PROP_BACKGROUND_CLIP/ORIGIN
 #
+# border/content/padding are deprecated and ultimately will only apply to the -webkit- form of these properties.
+# border-box/content-box/padding-box should be used instead.
+#
 border
 content
 padding
+padding-box
 
 #
 # CSS_PROP_BOX_SIZING
@@ -572,6 +579,12 @@ running
 paused
 
 #
+# CSS_PROP__WEBKIT_TRANSFORM_STYLE
+#
+flat
+preserve-3d
+
+#
 # CSS_PROP__WEBKIT_TRANSITION_TIMING_FUNCTION
 # CSS_PROP__WEBKIT_ANIMATION_TIMING_FUNCTION
 #
@@ -598,4 +611,4 @@ painted
 fill
 stroke
 #all
-#none
\ No newline at end of file
+#none
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp
index 5f8d601a93..cb852cb85a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp
@@ -72,7 +72,7 @@ String CSSVariablesDeclaration::removeVariable(const String& variableName, Excep
             }
         }
         
-        setChanged();
+        setNeedsStyleRecalc();
     }
     
     // FIXME: Communicate this change so that the document will update.
@@ -86,7 +86,7 @@ void CSSVariablesDeclaration::setVariable(const String& variableName, const Stri
     if (!parser.parseVariable(this, variableName, variableValue)) // If the parse succeeds, it will call addParsedVariable (our internal method for doing the add) with the parsed Value*.
         excCode = SYNTAX_ERR;
     else
-        setChanged();
+        setNeedsStyleRecalc();
 }
 
 void CSSVariablesDeclaration::addParsedVariable(const String& variableName, PassRefPtr<CSSValue> variableValue, bool updateNamesList)
@@ -162,7 +162,7 @@ void CSSVariablesDeclaration::setCssText(const String&)
     // FIXME: It's not clear if this is actually settable.
 }
 
-void CSSVariablesDeclaration::setChanged()
+void CSSVariablesDeclaration::setNeedsStyleRecalc()
 {
     // FIXME: Make this much better (it has the same problem CSSMutableStyleDeclaration does).
     StyleBase* root = this;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h
index aa98158344..f16b01193b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h
@@ -70,7 +70,7 @@ public:
 private:
     CSSVariablesDeclaration(StyleBase* owningRule, const Vector<String>& names, const Vector<RefPtr<CSSValue> >& values);
 
-    void setChanged();
+    void setNeedsStyleRecalc();
 
 protected:
     Vector<String> m_variableNames;
diff --git a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
index bea2b8a911..51965860e9 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
@@ -33,11 +33,14 @@ namespace WebCore {
     macro(monochrome, "monochrome") \
     macro(height, "height") \
     macro(width, "width") \
+    macro(orientation, "orientation") \
+    macro(aspect_ratio, "aspect-ratio") \
     macro(device_aspect_ratio, "device-aspect-ratio") \
     macro(device_pixel_ratio, "-webkit-device-pixel-ratio") \
     macro(device_height, "device-height") \
     macro(device_width, "device-width") \
     macro(max_color, "max-color") \
+    macro(max_aspect_ratio, "max-aspect-ratio") \
     macro(max_device_aspect_ratio, "max-device-aspect-ratio") \
     macro(max_device_pixel_ratio, "-webkit-max-device-pixel-ratio") \
     macro(max_device_height, "max-device-height") \
@@ -46,6 +49,7 @@ namespace WebCore {
     macro(max_monochrome, "max-monochrome") \
     macro(max_width, "max-width") \
     macro(min_color, "min-color") \
+    macro(min_aspect_ratio, "min-aspect-ratio") \
     macro(min_device_aspect_ratio, "min-device-aspect-ratio") \
     macro(min_device_pixel_ratio, "-webkit-min-device-pixel-ratio") \
     macro(min_device_height, "min-device-height") \
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
index 211178c035..c641dfd695 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
@@ -230,6 +230,38 @@ static bool monochromeMediaFeatureEval(CSSValue* value, RenderStyle* style, Fram
     return colorMediaFeatureEval(value, style, frame, op);
 }
 
+static bool orientationMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix)
+{
+    // A missing parameter should fail
+    if (!value)
+        return false;
+
+    FrameView* view = frame->view();
+    int width = view->layoutWidth();
+    int height = view->layoutHeight();
+    if (width > height) // Square viewport is portrait
+        return "landscape" == static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+    return "portrait" == static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+}
+
+static bool aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
+{
+    if (value) {
+        FrameView* view = frame->view();
+        int width = view->layoutWidth();
+        int height = view->layoutHeight();
+        int h = 0;
+        int v = 0;
+        if (parseAspectRatio(value, h, v))
+            return v != 0 && compareValue(width * v, height * h, op);
+        return false;
+    }
+
+    // ({,min-,max-}aspect-ratio)
+    // assume if we have a device, its aspect ratio is non-zero
+    return true;
+}
+
 static bool device_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
 {
     if (value) {
@@ -328,6 +360,16 @@ static bool max_monochromeMediaFeatureEval(CSSValue* value, RenderStyle* style,
     return monochromeMediaFeatureEval(value, style, frame, MaxPrefix);
 }
 
+static bool min_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return aspect_ratioMediaFeatureEval(value, style, frame, MinPrefix);
+}
+
+static bool max_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return aspect_ratioMediaFeatureEval(value, style, frame, MaxPrefix);
+}
+
 static bool min_device_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
 {
     return device_aspect_ratioMediaFeatureEval(value, style, frame, MinPrefix);
@@ -388,7 +430,7 @@ static bool max_device_widthMediaFeatureEval(CSSValue* value, RenderStyle* style
     return device_widthMediaFeatureEval(value, style, frame, MaxPrefix);
 }
 
-static bool animationMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool animationMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
     if (value) {
         float number;
@@ -397,7 +439,7 @@ static bool animationMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame
     return true;
 }
 
-static bool transitionMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool transitionMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
     if (value) {
         float number;
@@ -406,7 +448,7 @@ static bool transitionMediaFeatureEval(CSSValue* value, RenderStyle* style, Fram
     return true;
 }
 
-static bool transform_2dMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool transform_2dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
     if (value) {
         float number;
@@ -415,13 +457,24 @@ static bool transform_2dMediaFeatureEval(CSSValue* value, RenderStyle* style, Fr
     return true;
 }
 
-static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
+    bool returnValueIfNoParameter;
+    int have3dRendering;
+
+#if ENABLE(3D_RENDERING)
+    returnValueIfNoParameter = true;
+    have3dRendering = 1;
+#else
+    returnValueIfNoParameter = false;
+    have3dRendering = 0;
+#endif
+
     if (value) {
         float number;
-        return numberValue(value, number) && compareValue(0, static_cast<int>(number), op);
+        return numberValue(value, number) && compareValue(have3dRendering, static_cast<int>(number), op);
     }
-    return false;
+    return returnValueIfNoParameter;
 }
 
 static void createFunctionMap()
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
index daae2324ea..3036d04736 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
@@ -57,7 +57,11 @@ public:
                                               m_mediaFeature == MediaFeatureNames::min_widthMediaFeature ||
                                               m_mediaFeature == MediaFeatureNames::min_heightMediaFeature ||
                                               m_mediaFeature == MediaFeatureNames::max_widthMediaFeature ||
-                                              m_mediaFeature == MediaFeatureNames::max_heightMediaFeature; }
+                                              m_mediaFeature == MediaFeatureNames::max_heightMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::orientationMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::aspect_ratioMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::min_aspect_ratioMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::max_aspect_ratioMediaFeature;  }
 private:
     AtomicString m_mediaFeature;
     RefPtr<CSSValue> m_value;
diff --git a/src/3rdparty/webkit/WebCore/css/RGBColor.idl b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
index cb14319626..f76b6a253b 100644
--- a/src/3rdparty/webkit/WebCore/css/RGBColor.idl
+++ b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
@@ -33,10 +33,10 @@ module css {
         readonly attribute CSSPrimitiveValue  blue;
 
         // WebKit extensions
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute CSSPrimitiveValue  alpha;
 #endif
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute Color              color;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 1375fc243c..2cd90a9d56 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -26,6 +26,7 @@
 #include "CSSPrimitiveValueMappings.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
+#include "RenderStyle.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
index a6d7fbc990..04ba185a5d 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
@@ -160,14 +160,6 @@ bool CSSParser::parseSVGValue(int propId, bool important)
      * correctly and allows optimization in applyRule(..)
      */
 
-    case CSSPropertyPointerEvents:
-    // none | visiblePainted | visibleFill | visibleStroke | visible |
-    // painted | fill | stroke | none | all | inherit
-        if (id == CSSValueVisible || id == CSSValueNone || id == CSSValueAll ||
-          (id >= CSSValueVisiblepainted && id <= CSSValueStroke))
-            valid_primitive = true;
-        break;
-
     case CSSPropertyTextAnchor:    // start | middle | end | inherit
         if (id == CSSValueStart || id == CSSValueMiddle || id == CSSValueEnd)
             valid_primitive = true;
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
index 34d981c7af..d326dde434 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
@@ -59,25 +59,6 @@ HANDLE_INHERIT(prop, Prop) \
 else if (isInitial) \
     svgstyle->set##Prop(SVGRenderStyle::initial##Prop());
 
-#define HANDLE_INHERIT_COND(propID, prop, Prop) \
-if (id == propID) \
-{\
-    svgstyle->set##Prop(m_parentStyle->svgStyle()->prop());\
-    return;\
-}
-
-#define HANDLE_INITIAL_COND(propID, Prop) \
-if (id == propID) \
-{\
-    svgstyle->set##Prop(SVGRenderStyle::initial##Prop());\
-    return;\
-}
-
-#define HANDLE_INITIAL_COND_WITH_VALUE(propID, Prop, Value) \
-if (id == propID) { \
-    svgstyle->set##Prop(SVGRenderStyle::initial##Value()); \
-    return; \
-}
 
 namespace WebCore {
 
@@ -111,8 +92,21 @@ static int angleToGlyphOrientation(float angle)
     return -1;
 }
 
+static Color colorFromSVGColorCSSValue(CSSValue* value, RenderStyle* style)
+{
+    ASSERT(value->isSVGColor());
+    SVGColor* c = static_cast<SVGColor*>(value);
+    Color color;
+    if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
+        color = style->color();
+    else
+        color = c->color();
+    return color;
+}
+
 void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
 {
+    ASSERT(value);
     CSSPrimitiveValue* primitiveValue = 0;
     if (value->isPrimitiveValue())
         primitiveValue = static_cast<CSSPrimitiveValue*>(value);
@@ -168,15 +162,7 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         }
         case CSSPropertyKerning:
         {
-            if (isInherit) {
-                HANDLE_INHERIT_COND(CSSPropertyKerning, kerning, Kerning)
-                return;
-            }
-            else if (isInitial) {
-                HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyKerning, Kerning, Kerning)
-                return;
-            }
-
+            HANDLE_INHERIT_AND_INITIAL(kerning, Kerning);
             svgstyle->setKerning(primitiveValue);
             break;
         }
@@ -254,52 +240,37 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         case CSSPropertyFill:
         {
             HANDLE_INHERIT_AND_INITIAL(fillPaint, FillPaint)
-            if (!primitiveValue && value) {
-                SVGPaint *paint = static_cast<SVGPaint*>(value);
-                if (paint)
-                    svgstyle->setFillPaint(paint);
-            }
-            
+            if (value->isSVGPaint())
+                svgstyle->setFillPaint(static_cast<SVGPaint*>(value));
             break;
         }
         case CSSPropertyStroke:
         {
             HANDLE_INHERIT_AND_INITIAL(strokePaint, StrokePaint)
-            if (!primitiveValue && value) {
-                SVGPaint *paint = static_cast<SVGPaint*>(value);
-                if (paint)
-                    svgstyle->setStrokePaint(paint);
-            }
+            if (value->isSVGPaint())
+                svgstyle->setStrokePaint(static_cast<SVGPaint*>(value));
             
             break;
         }
         case CSSPropertyStrokeWidth:
         {
             HANDLE_INHERIT_AND_INITIAL(strokeWidth, StrokeWidth)
-            if (!primitiveValue)
-                return;
-        
-            svgstyle->setStrokeWidth(primitiveValue);
+            if (primitiveValue)
+                svgstyle->setStrokeWidth(primitiveValue);
             break;
         }
         case CSSPropertyStrokeDasharray:
         {
             HANDLE_INHERIT_AND_INITIAL(strokeDashArray, StrokeDashArray)
-            if (!primitiveValue && value) {
-                CSSValueList* dashes = static_cast<CSSValueList*>(value);
-                if (dashes)
-                    svgstyle->setStrokeDashArray(dashes);
-            }
-        
+            if (value->isValueList())
+                svgstyle->setStrokeDashArray(static_cast<CSSValueList*>(value));
             break;
         }
         case CSSPropertyStrokeDashoffset:
         {
             HANDLE_INHERIT_AND_INITIAL(strokeDashOffset, StrokeDashOffset)
-            if (!primitiveValue)
-                return;
-
-            svgstyle->setStrokeDashOffset(primitiveValue);
+            if (primitiveValue)
+                svgstyle->setStrokeDashOffset(primitiveValue);
             break;
         }
         case CSSPropertyFillOpacity:
@@ -491,35 +462,13 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         case CSSPropertyStopColor:
         {
             HANDLE_INHERIT_AND_INITIAL(stopColor, StopColor);
-
-            SVGColor* c = static_cast<SVGColor*>(value);
-            if (!c)
-                return CSSStyleSelector::applyProperty(id, value);
-
-            Color col;
-            if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
-                col = m_style->color();
-            else
-                col = c->color();
-
-            svgstyle->setStopColor(col);
+            svgstyle->setStopColor(colorFromSVGColorCSSValue(value, m_style.get()));
             break;
         }
        case CSSPropertyLightingColor:
         {
             HANDLE_INHERIT_AND_INITIAL(lightingColor, LightingColor);
-
-            SVGColor* c = static_cast<SVGColor*>(value);
-            if (!c)
-                return CSSStyleSelector::applyProperty(id, value);
-
-            Color col;
-            if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
-                col = m_style->color();
-            else
-                col = c->color();
-
-            svgstyle->setLightingColor(col);
+            svgstyle->setLightingColor(colorFromSVGColorCSSValue(value, m_style.get()));
             break;
         }
         case CSSPropertyFloodOpacity:
@@ -542,21 +491,11 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         }
         case CSSPropertyFloodColor:
         {
-            Color col;
-            if (isInitial)
-                col = SVGRenderStyle::initialFloodColor();
-            else {
-                SVGColor *c = static_cast<SVGColor*>(value);
-                if (!c)
-                    return CSSStyleSelector::applyProperty(id, value);
-
-                if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
-                    col = m_style->color();
-                else
-                    col = c->color();
+            if (isInitial) {
+                svgstyle->setFloodColor(SVGRenderStyle::initialFloodColor());
+                return;
             }
-
-            svgstyle->setFloodColor(col);
+            svgstyle->setFloodColor(colorFromSVGColorCSSValue(value, m_style.get()));
             break;
         }
         case CSSPropertyGlyphOrientationHorizontal:
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
index 81bbe34009..3a26f2099c 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -24,7 +24,7 @@ module stylesheets {
     interface [
         CustomMarkFunction,
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=2bd2db5f-aaab-4422-96a0-e05455313f35,
         ImplementationUUID=a8ca694d-71f2-4479-8c76-ee9c1c729b49
     ] StyleSheet {
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.cpp b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.cpp
new file mode 100644
index 0000000000..574a01a890
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.cpp
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WebKitCSSMatrix.h"
+
+#include "CSSParser.h"
+#include "CSSStyleSelector.h"
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSPropertyNames.h"
+#include "ExceptionCode.h"
+#include "RenderStyle.h"
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+WebKitCSSMatrix::WebKitCSSMatrix()
+    : StyleBase(0)
+{
+}
+
+WebKitCSSMatrix::WebKitCSSMatrix(const WebKitCSSMatrix& m)
+    : StyleBase(0)
+    , m_matrix(m.m_matrix)
+{
+}
+
+WebKitCSSMatrix::WebKitCSSMatrix(const TransformationMatrix& m)
+    : StyleBase(0)
+    , m_matrix(m)
+{
+}
+
+WebKitCSSMatrix::WebKitCSSMatrix(const String& s, ExceptionCode& ec) 
+    : StyleBase(0)
+{
+    setMatrixValue(s, ec);
+}
+
+WebKitCSSMatrix::~WebKitCSSMatrix()
+{
+}
+
+void WebKitCSSMatrix::setMatrixValue(const String& string, ExceptionCode& ec)
+{
+    CSSParser p(useStrictParsing());
+    RefPtr<CSSMutableStyleDeclaration> styleDeclaration = CSSMutableStyleDeclaration::create();
+    if (p.parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true)) {
+        // Convert to TransformOperations. This can fail if a property 
+        // requires style (i.e., param uses 'ems' or 'exs')
+        PassRefPtr<CSSValue> val =  styleDeclaration->getPropertyCSSValue(CSSPropertyWebkitTransform);
+        TransformOperations operations;
+        if (!CSSStyleSelector::createTransformOperations(val.get(), 0, operations)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+        
+        // Convert transform operations to a TransformationMatrix. This can fail
+        // if a param has a percentage ('%')
+        TransformationMatrix t;
+        for (unsigned i = 0; i < operations.operations().size(); ++i) {
+            if (operations.operations()[i].get()->apply(t, IntSize(0, 0))) {
+                ec = SYNTAX_ERR;
+                return;
+            }
+        }
+        
+        // set the matrix
+        m_matrix = t;
+    } else if (!string.isEmpty()) // There is something there but parsing failed
+        ec = SYNTAX_ERR;
+}
+
+// This is a multRight (this = this * secondMatrix)
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::multiply(WebKitCSSMatrix* secondMatrix) const
+{
+    if (!secondMatrix)
+        return 0;
+
+    TransformationMatrix tmp(m_matrix);
+    tmp.multiply(secondMatrix->m_matrix);
+    return WebKitCSSMatrix::create(tmp);
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::inverse(ExceptionCode& ec) const
+{
+    if (!m_matrix.isInvertible()) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
+    
+    return WebKitCSSMatrix::create(m_matrix.inverse());
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::translate(double x, double y, double z) const
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(z))
+        z = 0;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).translate3d(x, y, z));
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::scale(double scaleX, double scaleY, double scaleZ) const
+{
+    if (isnan(scaleX))
+        scaleX = 1;
+    if (isnan(scaleY))
+        scaleY = scaleX;
+    if (isnan(scaleZ))
+        scaleZ = 1;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).scale3d(scaleX, scaleY, scaleZ));
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::rotate(double rotX, double rotY, double rotZ) const
+{
+    if (isnan(rotX))
+        rotX = 0;
+        
+    if (isnan(rotY) && isnan(rotZ)) {
+        rotZ = rotX;
+        rotX = 0;
+        rotY = 0;
+    }
+
+    if (isnan(rotY))
+        rotY = 0;
+    if (isnan(rotZ))
+        rotZ = 0;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).rotate3d(rotX, rotY, rotZ));
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::rotateAxisAngle(double x, double y, double z, double angle) const
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(z))
+        z = 0;
+    if (isnan(angle))
+        angle = 0;
+    if (x == 0 && y == 0 && z == 0)
+        z = 1;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).rotate3d(x, y, z, angle));
+}
+
+
+String WebKitCSSMatrix::toString() const
+{
+    // FIXME - Need to ensure valid CSS floating point values (https://bugs.webkit.org/show_bug.cgi?id=20674)
+    if (m_matrix.isAffine())
+        return String::format("matrix(%f, %f, %f, %f, %f, %f)",
+                                m_matrix.a(), m_matrix.b(), m_matrix.c(), m_matrix.d(), m_matrix.e(), m_matrix.f());
+    return String::format("matrix3d(%f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f)",
+                            m_matrix.m11(), m_matrix.m12(), m_matrix.m13(), m_matrix.m14(),
+                            m_matrix.m21(), m_matrix.m22(), m_matrix.m23(), m_matrix.m24(),
+                            m_matrix.m31(), m_matrix.m32(), m_matrix.m33(), m_matrix.m34(),
+                            m_matrix.m41(), m_matrix.m42(), m_matrix.m43(), m_matrix.m44());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.h
new file mode 100644
index 0000000000..67ba113f23
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.h
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebKitCSSMatrix_h
+#define WebKitCSSMatrix_h
+
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include "StyleBase.h"
+#include "TransformationMatrix.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class WebKitCSSMatrix : public StyleBase {
+public:
+    static PassRefPtr<WebKitCSSMatrix> create()
+    {
+        return adoptRef(new WebKitCSSMatrix());
+    }
+    static PassRefPtr<WebKitCSSMatrix> create(const WebKitCSSMatrix& m)
+    {
+        return adoptRef(new WebKitCSSMatrix(m));
+    }
+    static PassRefPtr<WebKitCSSMatrix> create(const TransformationMatrix& m)
+    {
+        return adoptRef(new WebKitCSSMatrix(m));
+    }
+    static PassRefPtr<WebKitCSSMatrix> create(const String& s, ExceptionCode& ec)
+    {
+        return adoptRef(new WebKitCSSMatrix(s, ec));
+    }
+    
+    virtual ~WebKitCSSMatrix();
+
+    double a() const { return m_matrix.a(); }
+    double b() const { return m_matrix.b(); }
+    double c() const { return m_matrix.c(); }
+    double d() const { return m_matrix.d(); }
+    double e() const { return m_matrix.e(); }
+    double f() const { return m_matrix.f(); }
+    
+    void setA(double f) { m_matrix.setA(f); }
+    void setB(double f) { m_matrix.setB(f); }
+    void setC(double f) { m_matrix.setC(f); }
+    void setD(double f) { m_matrix.setD(f); }
+    void setE(double f) { m_matrix.setE(f); }
+    void setF(double f) { m_matrix.setF(f); }
+ 
+    double m11() const { return m_matrix.m11(); }
+    double m12() const { return m_matrix.m12(); }
+    double m13() const { return m_matrix.m13(); }
+    double m14() const { return m_matrix.m14(); }
+    double m21() const { return m_matrix.m21(); }
+    double m22() const { return m_matrix.m22(); }
+    double m23() const { return m_matrix.m23(); }
+    double m24() const { return m_matrix.m24(); }
+    double m31() const { return m_matrix.m31(); }
+    double m32() const { return m_matrix.m32(); }
+    double m33() const { return m_matrix.m33(); }
+    double m34() const { return m_matrix.m34(); }
+    double m41() const { return m_matrix.m41(); }
+    double m42() const { return m_matrix.m42(); }
+    double m43() const { return m_matrix.m43(); }
+    double m44() const { return m_matrix.m44(); }
+    
+    void setM11(double f) { m_matrix.setM11(f); }
+    void setM12(double f) { m_matrix.setM12(f); }
+    void setM13(double f) { m_matrix.setM13(f); }
+    void setM14(double f) { m_matrix.setM14(f); }
+    void setM21(double f) { m_matrix.setM21(f); }
+    void setM22(double f) { m_matrix.setM22(f); }
+    void setM23(double f) { m_matrix.setM23(f); }
+    void setM24(double f) { m_matrix.setM24(f); }
+    void setM31(double f) { m_matrix.setM31(f); }
+    void setM32(double f) { m_matrix.setM32(f); }
+    void setM33(double f) { m_matrix.setM33(f); }
+    void setM34(double f) { m_matrix.setM34(f); }
+    void setM41(double f) { m_matrix.setM41(f); }
+    void setM42(double f) { m_matrix.setM42(f); }
+    void setM43(double f) { m_matrix.setM43(f); }
+    void setM44(double f) { m_matrix.setM44(f); }
+ 
+    void setMatrixValue(const String& string, ExceptionCode&);
+    
+    // The following math function return a new matrix with the 
+    // specified operation applied. The this value is not modified.
+    
+    // Multiply this matrix by secondMatrix, on the right (result = this * secondMatrix)
+    PassRefPtr<WebKitCSSMatrix> multiply(WebKitCSSMatrix* secondMatrix) const;
+    
+    // Return the inverse of this matrix. Throw an exception if the matrix is not invertible
+    PassRefPtr<WebKitCSSMatrix> inverse(ExceptionCode&) const;
+    
+    // Return this matrix translated by the passed values.
+    // Passing a NaN will use a value of 0. This allows the 3D form to used for 2D operations
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the translation values on the left (result = translation(x,y,z) * this)
+    PassRefPtr<WebKitCSSMatrix> translate(double x, double y, double z) const;
+    
+    // Returns this matrix scaled by the passed values.
+    // Passing scaleX or scaleZ as NaN uses a value of 1, but passing scaleY of NaN 
+    // makes it the same as scaleX. This allows the 3D form to used for 2D operations
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the scale values on the left (result = scale(x,y,z) * this)
+    PassRefPtr<WebKitCSSMatrix> scale(double scaleX, double scaleY, double scaleZ) const;
+
+    // Returns this matrix rotated by the passed values.
+    // If rotY and rotZ are NaN, rotate about Z (rotX=0, rotateY=0, rotateZ=rotX).
+    // Otherwise use a rotation value of 0 for any passed NaN.    
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the rotation values on the left (result = rotation(x,y,z) * this)
+    PassRefPtr<WebKitCSSMatrix> rotate(double rotX, double rotY, double rotZ) const;
+    
+    // Returns this matrix rotated about the passed axis by the passed angle.
+    // Passing a NaN will use a value of 0. If the axis is (0,0,0) use a value
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the rotation values on the left (result = rotation(x,y,z,angle) * this)
+    PassRefPtr<WebKitCSSMatrix> rotateAxisAngle(double x, double y, double z, double angle) const;
+    
+    const TransformationMatrix& transform() const { return m_matrix; }
+    
+    String toString() const;
+    
+protected:
+    WebKitCSSMatrix();
+    WebKitCSSMatrix(const WebKitCSSMatrix&);
+    WebKitCSSMatrix(const TransformationMatrix&);
+    WebKitCSSMatrix(const String&, ExceptionCode& );
+
+    TransformationMatrix m_matrix;
+};
+
+} // namespace WebCore
+
+#endif // WebKitCSSMatrix_h
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
new file mode 100644
index 0000000000..6b22da1329
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module css {
+
+    // Introduced in DOM Level ?:
+    interface WebKitCSSMatrix {
+
+        // These attributes are simple aliases for certain elements of the 4x4 matrix
+        attribute double a; // alias for m11
+        attribute double b; // alias for m12
+        attribute double c; // alias for m21
+        attribute double d; // alias for m22
+        attribute double e; // alias for m41
+        attribute double f; // alias for m42
+
+        attribute double m11;
+        attribute double m12;
+        attribute double m13;
+        attribute double m14;
+        attribute double m21;
+        attribute double m22;
+        attribute double m23;
+        attribute double m24;
+        attribute double m31;
+        attribute double m32;
+        attribute double m33;
+        attribute double m34;
+        attribute double m41;
+        attribute double m42;
+        attribute double m43;
+        attribute double m44;
+
+        void setMatrixValue(in DOMString string) raises (DOMException);
+        
+        // Multiply this matrix by secondMatrix, on the right (result = this * secondMatrix)
+        [Immutable] WebKitCSSMatrix multiply(in WebKitCSSMatrix secondMatrix);
+        
+        // Return the inverse of this matrix. Throw an exception if the matrix is not invertible
+        [Immutable] WebKitCSSMatrix inverse() raises (DOMException);
+        
+        // Return this matrix translated by the passed values.
+        // Passing a NaN will use a value of 0. This allows the 3D form to used for 2D operations    
+        [Immutable] WebKitCSSMatrix translate(in double x, in double y, in double z);
+        
+        // Returns this matrix scaled by the passed values.
+        // Passing scaleX or scaleZ as NaN uses a value of 1, but passing scaleY of NaN 
+        // makes it the same as scaleX. This allows the 3D form to used for 2D operations
+        [Immutable] WebKitCSSMatrix scale(in double scaleX, in double scaleY, in double scaleZ);
+        
+        // Returns this matrix rotated by the passed values.
+        // If rotY and rotZ are NaN, rotate about Z (rotX=0, rotateY=0, rotateZ=rotX).
+        // Otherwise use a rotation value of 0 for any passed NaN.    
+        [Immutable] WebKitCSSMatrix rotate(in double rotX, in double rotY, in double rotZ);
+        
+        // Returns this matrix rotated about the passed axis by the passed angle.
+        // Passing a NaN will use a value of 0. If the axis is (0,0,0) use a value
+        // of (0,0,1).
+        [Immutable] WebKitCSSMatrix rotateAxisAngle(in double x, in double y, in double z, in double angle);
+        
+        [DontEnum] DOMString toString();
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp
index e6af840179..3b4286ea51 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp
@@ -79,6 +79,36 @@ String WebKitCSSTransformValue::cssText() const
         case MatrixTransformOperation:
             result += "matrix(";
             break;
+        case TranslateZTransformOperation:
+            result += "translateZ(";
+            break;
+        case Translate3DTransformOperation:
+            result += "translate3d(";
+            break;
+        case RotateXTransformOperation:
+            result += "rotateX(";
+            break;
+        case RotateYTransformOperation:
+            result += "rotateY(";
+            break;
+        case RotateZTransformOperation:
+            result += "rotateZ(";
+            break;
+        case Rotate3DTransformOperation:
+            result += "rotate3d(";
+            break;
+        case ScaleZTransformOperation:
+            result += "scaleZ(";
+            break;
+        case Scale3DTransformOperation:
+            result += "scale3d(";
+            break;
+        case PerspectiveTransformOperation:
+            result += "perspective(";
+            break;
+        case Matrix3DTransformOperation:
+            result += "matrix3d(";
+            break;
         default:
             break;
     }
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h
index 2bb2631304..0c3c0387e3 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h
@@ -47,7 +47,17 @@ public:
         SkewTransformOperation,
         SkewXTransformOperation,
         SkewYTransformOperation,
-        MatrixTransformOperation
+        MatrixTransformOperation,
+        TranslateZTransformOperation,
+        Translate3DTransformOperation,
+        RotateXTransformOperation,
+        RotateYTransformOperation,
+        RotateZTransformOperation,
+        Rotate3DTransformOperation,
+        ScaleZTransformOperation,
+        Scale3DTransformOperation,
+        PerspectiveTransformOperation,
+        Matrix3DTransformOperation
     };
 
     static PassRefPtr<WebKitCSSTransformValue> create(TransformOperationType type)
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
index 39e97a3fe8..14a373fbd0 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
@@ -48,6 +48,16 @@ module css {
         const unsigned short CSS_SKEWX       = 9;
         const unsigned short CSS_SKEWY       = 10;
         const unsigned short CSS_MATRIX      = 11;
+        const unsigned short CSS_TRANSLATEZ  = 12;
+        const unsigned short CSS_TRANSLATE3D = 13;
+        const unsigned short CSS_ROTATEX     = 14;
+        const unsigned short CSS_ROTATEY     = 15;
+        const unsigned short CSS_ROTATEZ     = 16;
+        const unsigned short CSS_ROTATE3D    = 17;
+        const unsigned short CSS_SCALEZ      = 18;
+        const unsigned short CSS_SCALE3D     = 19;
+        const unsigned short CSS_PERSPECTIVE = 20;
+        const unsigned short CSS_MATRIX3D    = 21;
 
         readonly attribute unsigned short operationType;
     };
diff --git a/src/3rdparty/webkit/WebCore/css/html4.css b/src/3rdparty/webkit/WebCore/css/html4.css
index 4709a3750e..3e4d11166d 100644
--- a/src/3rdparty/webkit/WebCore/css/html4.css
+++ b/src/3rdparty/webkit/WebCore/css/html4.css
@@ -359,9 +359,10 @@ textarea {
     -webkit-box-orient: vertical;
     resize: auto;
     cursor: auto;
+    padding: 2px;
 }
 
-input::-webkit-input-placeholder {
+input::-webkit-input-placeholder, isindex::-webkit-input-placeholder {
     color: darkGray;
 }
 
@@ -593,4 +594,8 @@ iframe {
     border: 2px inset
 }
 
+img, input[type=image], video, iframe, object, embed, applet {
+    overflow: hidden;   /* Default to overflow:hidden so that border-radius clipping works on the foreground of these elements. */
+}
+
 /* noscript is handled internally, as it depends on settings */
diff --git a/src/3rdparty/webkit/WebCore/css/maketokenizer b/src/3rdparty/webkit/WebCore/css/maketokenizer
index 4f65d17f1c..d14b37ab16 100644
--- a/src/3rdparty/webkit/WebCore/css/maketokenizer
+++ b/src/3rdparty/webkit/WebCore/css/maketokenizer
@@ -126,3 +126,10 @@ while (<>) {
     print;
     last if /end of yylex/;
 }
+
+# We don't want the remainder of flex's output.
+# However, flex may choke with "flex: error writing output file <stdout>"
+# if its stdout is unexpectedly closed on it.
+# Consume the remaining output.
+while (<>) {
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControls.css b/src/3rdparty/webkit/WebCore/css/mediaControls.css
index 1dbb2c3a49..b94abbfd03 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControls.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControls.css
@@ -35,6 +35,7 @@ audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     width: 100%;
     height: 100%;
     -webkit-user-select: none;
+    z-index: 0;
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
@@ -61,7 +62,22 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
     height: 16px;
 }
 
-audio::-webkit-media-controls-time-display, video::-webkit-media-controls-time-display {
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-user-select: none;
+    position: absolute;
+    padding: 0px 16px 0px 0px;
+    top: auto;
+    bottom: 0;
+    left: 32px;
+    right: 32px;
+    height: 16px;
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
     display: none;
 }
 
@@ -70,8 +86,8 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     position: absolute;
     top: auto;
     bottom: 0;
-    left: 32px;
-    right: 32px;
+    left: 0px;
+    right: 0px;
     height: 16px;
     padding: 0px 2px;
 }
@@ -86,7 +102,6 @@ audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-se
     height: 16px;
 }
 
-
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     -webkit-appearance: media-seek-forward-button;
     position: absolute;
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
new file mode 100644
index 0000000000..63eca4bb73
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* Chromium default media controls */
+
+audio {
+    width: 200px;
+    height: 32px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    height: 100%;
+    z-index: 0;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: -16px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    -webkit-appearance: media-mute-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    right: 0;
+    left: auto;
+
+    width: 34px;
+    height: 32px;
+
+    background: rgba(123, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 0px;
+    right: auto;
+
+    width: 30px;
+    height: 32px;
+
+    background: rgba(0, 221, 0, 0.6);
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 34px;
+
+    width: auto;
+    height: 32px;
+
+    background: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: inline-block;
+
+    overflow: hidden;
+    cursor: default;
+
+    position: absolute;
+    line-height: 21px;
+    top: auto;
+    bottom: 6px;
+    left: auto;
+    right: 0px;
+
+    height: 20px;
+    width: 48px;
+
+    text-align: center;
+    font-family: Arial;
+    font-weight: bold;
+    color: white;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
+    -webkit-appearance: media-time-remaining-display;
+    -webkit-user-select: none;
+    display: none;
+
+    overflow: hidden;
+    cursor: default;
+
+    position: absolute;
+    line-height: 21px;
+    top: auto;
+    bottom: 6px;
+    left: auto;
+    right: 0px;
+
+    height: 20px;
+    width: 48px;
+
+    text-align: center;
+    font-family: Arial;
+    font-weight: bold;
+    color: white;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: slider-horizontal;
+    position: absolute;
+    top: auto;
+    bottom: 9px;
+    left: 0px;
+    right: 50px;
+    height: 13px;
+
+    background: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    -webkit-appearance: media-seek-back-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    -webkit-appearance: media-seek-forward-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    display: none;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
new file mode 100644
index 0000000000..918c9bf709
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* alternate media controls */
+
+audio {
+    width: 200px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    height: 100%;
+    z-index: 0;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: -16px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    -webkit-appearance: media-mute-button;
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    right: 0;
+    left: auto;
+    width: 30px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 0px;
+    width: 30px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 30px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: inline-block;
+    position: absolute;
+    cursor: default;
+    font: -webkit-small-control;
+    font-size: .09em;
+    text-align: center;
+    overflow: hidden;
+    line-height: 13px;
+    top: auto;
+    bottom: 6px;
+    left: 0px;
+    height: 13px;
+    width: 45px;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
+    -webkit-appearance: media-time-remaining-display;
+    -webkit-user-select: none;
+    display: inline-block;
+    position: absolute;
+    cursor: default;
+    font: -webkit-small-control;
+    font-size: .09em;
+    text-align: center;
+    overflow: hidden;
+    line-height: 13px;
+    top: auto;
+    bottom: 6px;
+    right: 0px;
+    height: 13px;
+    width: 45px;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: media-slider;
+    position: absolute;
+    top: auto;
+    bottom: 6px;
+    left: 45px;
+    right: 45px;
+    height: 13px;
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    display: none;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/themeWin.css b/src/3rdparty/webkit/WebCore/css/themeWin.css
index 42962c4851..421fed0da9 100644
--- a/src/3rdparty/webkit/WebCore/css/themeWin.css
+++ b/src/3rdparty/webkit/WebCore/css/themeWin.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -34,12 +34,14 @@
 
 input:not([type]), 
 input[type="text"],
-input[type="password"],
-input[type="search"] {
-    margin:0;
+input[type="password"] {
     padding:1px 0;
 }
 
+input[type="search"] {
+    padding:1px;
+}
+
 input[type="checkbox"] {
     margin:3px 3px 3px 4px;
 }
@@ -63,17 +65,21 @@ input[type="search"]:disabled {
     background-color: #EBEBE4; 
 }
 
-/* Windows should render input[type="search"] the same as input with no type.
-   This search thing is an Apple-ism to get mac style search inputs. */
-input[type="search"] {
-    -webkit-appearance: textfield;
-    -webkit-box-sizing: content-box;
+input[type="search"]::-webkit-search-cancel-button {
+   margin-right: 3px; 
+}
+
+input[type="search"]::-webkit-search-results-decoration {
+    margin: 0 3px 0 2px;
+}
+
+input[type="search"]::-webkit-search-results-button {
+    margin: 0 3px 0 2px;
 }
 
 input[type="button"], input[type="submit"], input[type="reset"], input[type="file"]::-webkit-file-upload-button, button {
     /* Matches Firefox */
     padding: 0 6px;
-    margin: 0;
 }
 
 /* Windows selects are not rounded. Custom borders for them shouldn't be either. */
@@ -82,13 +88,15 @@ select,
 select[size="0"],
 select[size="1"] {
     -webkit-border-radius: 0;
-    margin: 0;
+}
+
+/* Option font must be inherited because we depend on computing the size of the
+   <select> based on the size of the options, and they must use the same font
+   for that computation to be correct */
+option {
+    font: inherit !important;
 }
 
 textarea {
   font-family: monospace;
-  margin: 1px 0;
-
-  /* Matches IE */
-  padding: 2px;
 }
diff --git a/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css b/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css
index 688eabc819..c69b74c714 100644
--- a/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css
+++ b/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.h b/src/3rdparty/webkit/WebCore/dom/Attr.h
index 9525251d7a..ed4dc07d08 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.h
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.h
@@ -37,7 +37,7 @@ namespace WebCore {
 // destruction. however, this is not yet implemented.
 
 class Attr : public ContainerNode {
-    friend class NamedAttrMap;
+    friend class NamedNodeMap;
 public:
     Attr(Element*, Document*, PassRefPtr<Attribute>);
     ~Attr();
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.idl b/src/3rdparty/webkit/WebCore/dom/Attr.idl
index 42ac04cae4..29f4be1eac 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.idl
@@ -25,7 +25,7 @@ module core {
         GenerateNativeConverter,
         InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
         ImplementationUUID=41B16348-D8E7-4d21-BFDB-125705B7E91F
-    ] Attr : EventTargetNode {
+    ] Attr : Node {
 
         // DOM Level 1
 
@@ -39,7 +39,7 @@ module core {
         readonly attribute Element ownerElement;
         
         // extensions
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/Attribute.h b/src/3rdparty/webkit/WebCore/dom/Attribute.h
index 2b2863f516..b06d120c8c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attribute.h
+++ b/src/3rdparty/webkit/WebCore/dom/Attribute.h
@@ -32,14 +32,14 @@ namespace WebCore {
 class Attr;
 class CSSStyleDeclaration;
 class Element;
-class NamedAttrMap;
+class NamedNodeMap;
 
 // This has no counterpart in DOM.
 // It is an internal representation of the node value of an Attr.
 // The actual Attr with its value as a Text child is allocated only if needed.
 class Attribute : public RefCounted<Attribute> {
     friend class Attr;
-    friend class NamedAttrMap;
+    friend class NamedNodeMap;
 public:
     static PassRefPtr<Attribute> create(const QualifiedName& name, const AtomicString& value)
     {
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
index 247a5b6e65..9a72de9b2f 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
@@ -23,7 +23,6 @@
 #include "CharacterData.h"
 
 #include "CString.h"
-#include "Document.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "MutationEvent.h"
@@ -31,14 +30,14 @@
 
 namespace WebCore {
 
-CharacterData::CharacterData(Document *doc)
-    : EventTargetNode(doc)
+CharacterData::CharacterData(Document *doc, bool isText)
+    : Node(doc, false, false, isText)
     , m_data(StringImpl::empty())
 {
 }
 
-CharacterData::CharacterData(Document* document, const String& text)
-    : EventTargetNode(document)
+CharacterData::CharacterData(Document* document, const String& text, bool isText)
+    : Node(document, false, false, isText)
 {
     m_data = text.impl() ? text.impl() : StringImpl::empty();
 }
@@ -61,7 +60,7 @@ void CharacterData::setData(const String& data, ExceptionCode&)
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setText(m_data);
+        toRenderText(renderer())->setText(m_data);
     
     dispatchModifiedEvent(oldStr.get());
     
@@ -89,7 +88,7 @@ void CharacterData::appendData(const String& arg, ExceptionCode&)
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, oldStr->length(), 0);
+        toRenderText(renderer())->setTextWithOffset(m_data, oldStr->length(), 0);
     
     dispatchModifiedEvent(oldStr.get());
 }
@@ -110,7 +109,7 @@ void CharacterData::insertData(unsigned offset, const String& arg, ExceptionCode
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, offset, 0);
+        toRenderText(renderer())->setTextWithOffset(m_data, offset, 0);
 
     dispatchModifiedEvent(oldStr.get());
     
@@ -139,7 +138,7 @@ void CharacterData::deleteData(unsigned offset, unsigned count, ExceptionCode& e
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, offset, count);
+        toRenderText(renderer())->setTextWithOffset(m_data, offset, count);
 
     dispatchModifiedEvent(oldStr.get());
 
@@ -169,7 +168,7 @@ void CharacterData::replaceData(unsigned offset, unsigned count, const String& a
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, offset, count);
+        toRenderText(renderer())->setTextWithOffset(m_data, offset, count);
     
     dispatchModifiedEvent(oldStr.get());
     
@@ -199,7 +198,7 @@ void CharacterData::dispatchModifiedEvent(StringImpl* prevValue)
         parentNode()->childrenChanged();
     if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER)) {
         ExceptionCode ec;
-        dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, false, 0, prevValue, m_data, String(), 0), ec);
+        dispatchMutationEvent(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data, ec); 
     }
     dispatchSubtreeModifiedEvent();
 }
@@ -225,7 +224,7 @@ bool CharacterData::rendererIsNeeded(RenderStyle *style)
 {
     if (!m_data || !length())
         return false;
-    return EventTargetNode::rendererIsNeeded(style);
+    return Node::rendererIsNeeded(style);
 }
 
 bool CharacterData::offsetInCharacters() const
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.h b/src/3rdparty/webkit/WebCore/dom/CharacterData.h
index 48ddc36c10..d9e55c0564 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.h
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.h
@@ -23,14 +23,14 @@
 #ifndef CharacterData_h
 #define CharacterData_h
 
-#include "EventTargetNode.h"
+#include "Node.h"
 
 namespace WebCore {
 
-class CharacterData : public EventTargetNode {
+class CharacterData : public Node {
 public:
-    CharacterData(Document*, const String& text);
-    CharacterData(Document*);
+    CharacterData(Document*, const String& text, bool isText = false);
+    CharacterData(Document*, bool isText = false);
     virtual ~CharacterData();
 
     // DOM methods & attributes for CharacterData
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
index 74dc4834e5..7c8c7acca3 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
@@ -23,7 +23,7 @@ module core {
         GenerateConstructor,
         InterfaceUUID=149159F4-D2BA-4040-8137-6BF6424C972A,
         ImplementationUUID=E2095280-B9BD-446a-8C03-79F78417CDFF
-    ] CharacterData : EventTargetNode {
+    ] CharacterData : Node {
 
         attribute [ConvertNullToNullString] DOMString data
             setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
new file mode 100644
index 0000000000..9883f5843e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "CheckedRadioButtons.h"
+
+#include "HTMLInputElement.h"
+
+namespace WebCore {
+
+void CheckedRadioButtons::addButton(HTMLFormControlElement* element)
+{
+    // We only want to add radio buttons.
+    if (!element->isRadioButton())
+        return;
+
+    // Without a name, there is no group.
+    if (element->name().isEmpty())
+        return;
+
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
+
+    // We only track checked buttons.
+    if (!inputElement->checked())
+        return;
+
+    if (!m_nameToCheckedRadioButtonMap)
+        m_nameToCheckedRadioButtonMap.set(new NameToInputMap);
+
+    pair<NameToInputMap::iterator, bool> result = m_nameToCheckedRadioButtonMap->add(element->name().impl(), inputElement);
+    if (result.second)
+        return;
+    
+    HTMLInputElement* oldCheckedButton = result.first->second;
+    if (oldCheckedButton == inputElement)
+        return;
+
+    result.first->second = inputElement;
+    oldCheckedButton->setChecked(false);
+}
+
+HTMLInputElement* CheckedRadioButtons::checkedButtonForGroup(const AtomicString& name) const
+{
+    if (!m_nameToCheckedRadioButtonMap)
+        return 0;
+    
+    return m_nameToCheckedRadioButtonMap->get(name.impl());
+}
+
+void CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
+{
+    if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
+        return;
+    
+    NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
+    if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
+        return;
+    
+    InputElement* inputElement = toInputElement(element);
+    ASSERT_UNUSED(inputElement, inputElement);
+    ASSERT(inputElement->isChecked());
+    ASSERT(element->isRadioButton());
+
+    m_nameToCheckedRadioButtonMap->remove(it);
+    if (m_nameToCheckedRadioButtonMap->isEmpty())
+        m_nameToCheckedRadioButtonMap.clear();
+}
+
+} // namespace
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.cpp b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.h
index 1fac53fc20..5a57955a27 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.h
@@ -1,10 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,14 +18,30 @@
  *
  */
 
-#include "config.h"
-#include "RenderLegend.h"
+#ifndef CheckedRadioButtons_h
+#define CheckedRadioButtons_h
+
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-RenderLegend::RenderLegend(Node* element)
-    : RenderBlock(element)
-{
-}
+class AtomicString;
+class AtomicStringImpl;
+class HTMLInputElement;
+class HTMLFormControlElement;
+
+class CheckedRadioButtons {
+public:
+    void addButton(HTMLFormControlElement*);
+    void removeButton(HTMLFormControlElement*);
+    HTMLInputElement* checkedButtonForGroup(const AtomicString& groupName) const;
+
+private:
+    typedef HashMap<AtomicStringImpl*, HTMLInputElement*> NameToInputMap;
+    OwnPtr<NameToInputMap> m_nameToCheckedRadioButtonMap;
+};
 
 } // namespace WebCore
+
+#endif // CheckedRadioButtons_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNames.h b/src/3rdparty/webkit/WebCore/dom/ClassNames.h
index 7992d54db0..8f4852f0b2 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClassNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/ClassNames.h
@@ -56,8 +56,8 @@ namespace WebCore {
 
         typedef Vector<AtomicString, 8> ClassNameVector;
         String m_string;
-        bool m_shouldFoldCase;
         ClassNameVector m_vector;
+        bool m_shouldFoldCase;
         bool m_createdVector;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerTask.cpp b/src/3rdparty/webkit/WebCore/dom/ClientRect.cpp
index 4a22c593ad..c69a2abbd1 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerTask.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,17 +25,17 @@
  */
 
 #include "config.h"
-
-#if ENABLE(WORKERS)
-
-#include "WorkerTask.h"
+#include "ClientRect.h"
 
 namespace WebCore {
 
-WorkerTask::~WorkerTask()
+ClientRect::ClientRect()
 {
 }
 
-} // namespace WebCore
+ClientRect::ClientRect(const IntRect& rect)
+    : m_rect(rect)
+{
+}
 
-#endif // ENABLE(WORKERS)
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRect.h b/src/3rdparty/webkit/WebCore/dom/ClientRect.h
new file mode 100644
index 0000000000..349ea851e4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef ClientRect_h
+#define ClientRect_h
+
+#include "FloatRect.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class IntRect; 
+
+    class ClientRect : public RefCounted<ClientRect> {
+    public:
+        static PassRefPtr<ClientRect> create() { return adoptRef(new ClientRect); }
+        static PassRefPtr<ClientRect> create(const IntRect& rect) { return adoptRef(new ClientRect(rect)); }
+
+        float top() const { return m_rect.y(); }
+        float right() const { return m_rect.right(); }
+        float bottom() const { return m_rect.bottom(); }
+        float left() const { return m_rect.x(); }
+        float width() const { return m_rect.width(); }
+        float height() const { return m_rect.height(); }
+
+    private:
+        ClientRect();
+        ClientRect(const IntRect&);
+
+        FloatRect m_rect;
+    }; 
+
+} // namespace WebCore
+
+#endif // ClientRect_h
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerTask.h b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
index a842ce26b3..6f0598f135 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerTask.h
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,25 +24,17 @@
  *
  */
 
-#ifndef WorkerTask_h
-#define WorkerTask_h
-
-#if ENABLE(WORKERS)
-
-#include <wtf/Threading.h>
-
-namespace WebCore {
-
-    class WorkerContext;
-
-    class WorkerTask : public ThreadSafeShared<WorkerTask> {
-    public:
-        virtual ~WorkerTask();
-        virtual void performTask(WorkerContext*) = 0;
+module view {
+
+    interface [
+        GenerateConstructor
+    ] ClientRect {
+        readonly attribute float top;
+        readonly attribute float right;
+        readonly attribute float bottom;
+        readonly attribute float left;
+        readonly attribute float width;
+        readonly attribute float height;
     };
 
-} // namespace WebCore
-
-#endif // ENABLE(WORKERS)
-
-#endif // WorkerTask_h
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRectList.cpp b/src/3rdparty/webkit/WebCore/dom/ClientRectList.cpp
new file mode 100644
index 0000000000..95ec75802a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "ClientRectList.h"
+
+#include "ExceptionCode.h"
+#include "ClientRect.h"
+
+namespace WebCore {
+
+ClientRectList::ClientRectList()
+{
+}
+
+ClientRectList::ClientRectList(const Vector<FloatQuad>& quads)
+{
+    m_list.reserveInitialCapacity(quads.size());
+    for (size_t i = 0; i < quads.size(); ++i)
+        m_list.append(ClientRect::create(quads[i].enclosingBoundingBox()));
+}
+
+ClientRectList::~ClientRectList()
+{
+}
+
+unsigned ClientRectList::length() const
+{
+    return m_list.size();
+}
+
+ClientRect* ClientRectList::item(unsigned index)
+{
+    if (index >= m_list.size()) {
+        // FIXME: this should throw an exception.
+        // ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+
+    return m_list[index].get();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRectList.h b/src/3rdparty/webkit/WebCore/dom/ClientRectList.h
new file mode 100644
index 0000000000..03915b1e2c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef ClientRectList_h
+#define ClientRectList_h
+
+#include "FloatQuad.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class ClientRect;
+
+    class ClientRectList : public RefCounted<ClientRectList> {
+    public:
+        static PassRefPtr<ClientRectList> create() { return adoptRef(new ClientRectList); }
+        static PassRefPtr<ClientRectList> create(const Vector<FloatQuad>& quads) { return adoptRef(new ClientRectList(quads)); }
+        ~ClientRectList();
+
+        unsigned length() const;
+        ClientRect* item(unsigned index);
+
+    private:
+        ClientRectList();
+        ClientRectList(const Vector<FloatQuad>&);
+
+        Vector<RefPtr<ClientRect> > m_list;
+    }; 
+
+} // namespace WebCore
+
+#endif // ClientRectList_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
new file mode 100644
index 0000000000..8230f6c699
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module view {
+
+    interface [
+        GenerateConstructor,
+        HasIndexGetter
+    ] ClientRectList {
+        readonly attribute unsigned long length;
+        ClientRect item(in [IsIndex] unsigned long index);
+        // FIXME: Fix list behavior to allow custom exceptions to be thrown.
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
index f7a52efe1e..6d1bc152d5 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "Clipboard.h"
 
+#include "CachedImage.h"
 #include "DOMImplementation.h"
 #include "Frame.h"
 #include "FrameLoader.h"
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 0f46ae6710..2573908111 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,10 +23,9 @@
 #include "config.h"
 #include "ContainerNode.h"
 
+#include "Cache.h"
 #include "ContainerNodeAlgorithms.h"
 #include "DeleteButtonController.h"
-#include "Document.h"
-#include "Editor.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FloatRect.h"
@@ -34,10 +33,11 @@
 #include "FrameView.h"
 #include "InlineTextBox.h"
 #include "MutationEvent.h"
+#include "Page.h"
 #include "RenderTheme.h"
 #include "RootInlineBox.h"
-#include "SystemTime.h"
-#include <wtf/Vector.h>
+#include "loader.h"
+#include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
@@ -45,16 +45,10 @@ static void dispatchChildInsertionEvents(Node*, ExceptionCode&);
 static void dispatchChildRemovalEvents(Node*, ExceptionCode&);
 
 typedef Vector<std::pair<NodeCallback, RefPtr<Node> > > NodeCallbackQueue;
-static NodeCallbackQueue* s_postAttachCallbackQueue = 0;
+static NodeCallbackQueue* s_postAttachCallbackQueue;
 
-static size_t s_attachDepth = 0;
-
-ContainerNode::ContainerNode(Document* doc, bool isElement)
-    : EventTargetNode(doc, isElement, true)
-    , m_firstChild(0)
-    , m_lastChild(0)
-{
-}
+static size_t s_attachDepth;
+static bool s_shouldReEnableMemoryCacheCallsAfterAttach;
 
 void ContainerNode::removeAllChildren()
 {
@@ -101,9 +95,8 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         return true;
 
     RefPtr<Node> next = refChild;
-    RefPtr<Node> prev = refChild->previousSibling();
+    RefPtr<Node> refChildPreviousSibling = refChild->previousSibling();
 
-    int childCountDelta = 0;
     RefPtr<Node> child = isFragment ? newChild->firstChild() : newChild;
     while (child) {
         RefPtr<Node> nextChild = isFragment ? child->nextSibling() : 0;
@@ -131,8 +124,6 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         ASSERT(!child->nextSibling());
         ASSERT(!child->previousSibling());
 
-        childCountDelta++;
-
         // Add child before "next".
         forbidEventDispatch();
         Node* prev = next->previousSibling();
@@ -152,6 +143,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         allowEventDispatch();
 
         // Dispatch the mutation events.
+        childrenChanged(false, refChildPreviousSibling.get(), next.get(), 1);
         dispatchChildInsertionEvents(child.get(), ec);
                 
         // Add child to the rendering tree.
@@ -165,9 +157,6 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
-    if (childCountDelta)
-        childrenChanged(false, prev.get(), next.get(), childCountDelta);
     dispatchSubtreeModifiedEvent();
     return true;
 }
@@ -225,7 +214,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         if (Node* oldParent = child->parentNode())
             oldParent->removeChild(child.get(), ec);
         if (ec)
-            return 0;
+            return false;
 
         // Due to arbitrary code running in response to a DOM mutation event it's
         // possible that "prev" is no longer a child of "this".
@@ -280,7 +269,6 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
     if (childCountDelta)
         childrenChanged(false, prev.get(), next.get(), childCountDelta);
     dispatchSubtreeModifiedEvent();
@@ -291,7 +279,7 @@ void ContainerNode::willRemove()
 {
     for (Node *n = m_firstChild; n != 0; n = n->nextSibling())
         n->willRemove();
-    EventTargetNode::willRemove();
+    Node::willRemove();
 }
 
 static ExceptionCode willRemoveChild(Node *child)
@@ -374,8 +362,6 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
 
     allowEventDispatch();
 
-    document()->setDocumentChanged(true);
-
     // Dispatch post-removal mutation events
     childrenChanged(false, prev, next, -1);
     dispatchSubtreeModifiedEvent();
@@ -395,25 +381,25 @@ bool ContainerNode::removeChildren()
     if (!m_firstChild)
         return false;
 
-    Node* n;
+    // The container node can be removed from event handlers.
+    RefPtr<Node> protect(this);
     
-    // do any prep work needed before actually starting to detach
-    // and remove... e.g. stop loading frames, fire unload events
-    for (n = m_firstChild; n; n = n->nextSibling())
-        willRemoveChild(n);
+    // Do any prep work needed before actually starting to detach
+    // and remove... e.g. stop loading frames, fire unload events.
+    // FIXME: Adding new children from event handlers can cause an infinite loop here.
+    for (RefPtr<Node> n = m_firstChild; n; n = n->nextSibling())
+        willRemoveChild(n.get());
     
     // exclude this node when looking for removed focusedNode since only children will be removed
     document()->removeFocusedNodeOfSubtree(this, true);
 
     forbidEventDispatch();
     int childCountDelta = 0;
-    while ((n = m_firstChild) != 0) {
+    while (RefPtr<Node> n = m_firstChild) {
         childCountDelta--;
 
-        Node *next = n->nextSibling();
+        Node* next = n->nextSibling();
         
-        n->ref();
-
         // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744)
         n->setPreviousSibling(0);
         n->setNextSibling(0);
@@ -428,8 +414,6 @@ bool ContainerNode::removeChildren()
         
         if (n->inDocument())
             n->removedFromDocument();
-
-        n->deref();
     }
     allowEventDispatch();
 
@@ -464,7 +448,6 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         return true;
 
     // Now actually add the child(ren)
-    int childCountDelta = 0;
     RefPtr<Node> prev = lastChild();
     RefPtr<Node> child = isFragment ? newChild->firstChild() : newChild;
     while (child) {
@@ -485,7 +468,6 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         }
 
         // Append child to the end of the list
-        childCountDelta++;
         forbidEventDispatch();
         child->setParent(this);
         if (m_lastChild) {
@@ -497,6 +479,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         allowEventDispatch();
 
         // Dispatch the mutation events
+        childrenChanged(false, prev.get(), 0, 1);
         dispatchChildInsertionEvents(child.get(), ec);
 
         // Add child to the rendering tree
@@ -510,14 +493,13 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
-    childrenChanged(false, prev.get(), 0, childCountDelta);
     dispatchSubtreeModifiedEvent();
     return true;
 }
 
 ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
 {
+    ASSERT(newChild);
     // This function is only used during parsing.
     // It does not send any DOM mutation events.
 
@@ -542,13 +524,31 @@ ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
 
 void ContainerNode::suspendPostAttachCallbacks()
 {
+    if (!s_attachDepth) {
+        ASSERT(!s_shouldReEnableMemoryCacheCallsAfterAttach);
+        if (Page* page = document()->page()) {
+            if (page->areMemoryCacheClientCallsEnabled()) {
+                page->setMemoryCacheClientCallsEnabled(false);
+                s_shouldReEnableMemoryCacheCallsAfterAttach = true;
+            }
+        }
+        cache()->loader()->suspendPendingRequests();
+    }
     ++s_attachDepth;
 }
 
 void ContainerNode::resumePostAttachCallbacks()
 {
-    if (s_attachDepth == 1 && s_postAttachCallbackQueue)
-        dispatchPostAttachCallbacks();
+    if (s_attachDepth == 1) {
+        if (s_postAttachCallbackQueue)
+            dispatchPostAttachCallbacks();
+        if (s_shouldReEnableMemoryCacheCallsAfterAttach) {
+            s_shouldReEnableMemoryCacheCallsAfterAttach = false;
+            if (Page* page = document()->page())
+                page->setMemoryCacheClientCallsEnabled(true);
+        }
+        cache()->loader()->resumePendingRequests();
+    }
     --s_attachDepth;
 }
 
@@ -576,55 +576,50 @@ void ContainerNode::dispatchPostAttachCallbacks()
 
 void ContainerNode::attach()
 {
-    ++s_attachDepth;
-
     for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->attach();
-    EventTargetNode::attach();
-
-    if (s_attachDepth == 1 && s_postAttachCallbackQueue)
-        dispatchPostAttachCallbacks();
-    --s_attachDepth;
+    Node::attach();
 }
 
 void ContainerNode::detach()
 {
     for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->detach();
-    setHasChangedChild(false);
-    EventTargetNode::detach();
+    setChildNeedsStyleRecalc(false);
+    Node::detach();
 }
 
 void ContainerNode::insertedIntoDocument()
 {
-    EventTargetNode::insertedIntoDocument();
-    for (Node *child = m_firstChild; child; child = child->nextSibling())
+    Node::insertedIntoDocument();
+    insertedIntoTree(false);
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->insertedIntoDocument();
 }
 
 void ContainerNode::removedFromDocument()
 {
-    EventTargetNode::removedFromDocument();
-    for (Node *child = m_firstChild; child; child = child->nextSibling())
+    Node::removedFromDocument();
+    setInDocument(false);
+    removedFromTree(false);
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->removedFromDocument();
 }
 
 void ContainerNode::insertedIntoTree(bool deep)
 {
-    EventTargetNode::insertedIntoTree(deep);
-    if (deep) {
-        for (Node *child = m_firstChild; child; child = child->nextSibling())
-            child->insertedIntoTree(deep);
-    }
+    if (!deep)
+        return;
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
+        child->insertedIntoTree(true);
 }
 
 void ContainerNode::removedFromTree(bool deep)
 {
-    EventTargetNode::removedFromTree(deep);
-    if (deep) {
-        for (Node *child = m_firstChild; child; child = child->nextSibling())
-            child->removedFromTree(deep);
-    }
+    if (!deep)
+        return;
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
+        child->removedFromTree(true);
 }
 
 void ContainerNode::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -680,21 +675,24 @@ bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
             if (!o)
                 break;
         }
+        ASSERT(o);
 
         if (!o->isInline() || o->isReplaced()) {
             point = o->localToAbsolute();
             return true;
         }
 
-        if (p->element() && p->element() == this && o->isText() && !o->isBR() && !static_cast<RenderText*>(o)->firstTextBox()) {
+        if (p->node() && p->node() == this && o->isText() && !o->isBR() && !toRenderText(o)->firstTextBox()) {
                 // do nothing - skip unrendered whitespace that is a child or next sibling of the anchor
         } else if ((o->isText() && !o->isBR()) || o->isReplaced()) {
             point = o->container()->localToAbsolute();
-            if (o->isText() && static_cast<RenderText *>(o)->firstTextBox()) {
-                point.move(static_cast<RenderText *>(o)->minXPos(),
-                           static_cast<RenderText *>(o)->firstTextBox()->root()->topOverflow());
-            } else
-                point.move(o->xPos(), o->yPos());
+            if (o->isText() && toRenderText(o)->firstTextBox()) {
+                point.move(toRenderText(o)->linesBoundingBox().x(),
+                           toRenderText(o)->firstTextBox()->root()->topOverflow());
+            } else if (o->isBox()) {
+                RenderBox* box = toRenderBox(o);
+                point.move(box->x(), box->y());
+            }
             return true;
         }
     }
@@ -714,12 +712,11 @@ bool ContainerNode::getLowerRightCorner(FloatPoint& point) const
     if (!renderer())
         return false;
 
-    RenderObject *o = renderer();
-    if (!o->isInline() || o->isReplaced())
-    {
+    RenderObject* o = renderer();
+    if (!o->isInline() || o->isReplaced()) {
+        RenderBox* box = toRenderBox(o);
         point = o->localToAbsolute();
-        point.move(o->width(),
-                   o->height() + o->borderTopExtra() + o->borderBottomExtra());
+        point.move(box->width(), box->height());
         return true;
     }
 
@@ -730,8 +727,8 @@ bool ContainerNode::getLowerRightCorner(FloatPoint& point) const
         else if (o->previousSibling())
             o = o->previousSibling();
         else {
-            RenderObject *prev = 0;
-            while(!prev) {
+            RenderObject* prev = 0;
+            while (!prev) {
                 o = o->parent();
                 if (!o)
                     return false;
@@ -739,15 +736,17 @@ bool ContainerNode::getLowerRightCorner(FloatPoint& point) const
             }
             o = prev;
         }
+        ASSERT(o);
         if (o->isText() || o->isReplaced()) {
             point = o->container()->localToAbsolute();
-            int xOffset;
-            if (o->isText())
-                xOffset = static_cast<RenderText *>(o)->minXPos() + o->width();
-            else
-                xOffset = o->xPos() + o->width();
-            
-            point.move(xOffset, o->yPos() + o->height());
+            if (o->isText()) {
+                RenderText* text = toRenderText(o);
+                IntRect linesBox = text->linesBoundingBox();
+                point.move(linesBox.x() + linesBox.width(), linesBox.y() + linesBox.height());
+            } else {
+                RenderBox* box = toRenderBox(o);
+                point.move(box->x() + box->width(), box->y() + box->height());
+            }
             return true;
         }
     }
@@ -762,8 +761,7 @@ IntRect ContainerNode::getRect() const
     
     // If we've found one corner, but not the other,
     // then we should just return a point at the corner that we did find.
-    if (foundUpperLeft != foundLowerRight)
-    {
+    if (foundUpperLeft != foundLowerRight) {
         if (foundUpperLeft)
             lowerRight = upperLeft;
         else
@@ -781,24 +779,24 @@ void ContainerNode::setFocus(bool received)
     if (focused() == received)
         return;
 
-    EventTargetNode::setFocus(received);
+    Node::setFocus(received);
 
     // note that we need to recalc the style
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void ContainerNode::setActive(bool down, bool pause)
 {
     if (down == active()) return;
 
-    EventTargetNode::setActive(down);
+    Node::setActive(down);
 
     // note that we need to recalc the style
     // FIXME: Move to Element
     if (renderer()) {
         bool reactsToPress = renderer()->style()->affectedByActiveRules();
         if (reactsToPress)
-            setChanged();
+            setNeedsStyleRecalc();
         if (renderer() && renderer()->style()->hasAppearance()) {
             if (theme()->stateChanged(renderer(), PressedState))
                 reactsToPress = true;
@@ -813,7 +811,7 @@ void ContainerNode::setActive(bool down, bool pause)
 #endif
 
             // Ensure there are no pending changes
-            Document::updateDocumentsRendering();
+            Document::updateStyleForAllDocuments();
             // Do an immediate repaint.
             if (renderer())
                 renderer()->repaint(true);
@@ -834,13 +832,13 @@ void ContainerNode::setHovered(bool over)
 {
     if (over == hovered()) return;
 
-    EventTargetNode::setHovered(over);
+    Node::setHovered(over);
 
     // note that we need to recalc the style
     // FIXME: Move to Element
     if (renderer()) {
         if (renderer()->style()->affectedByHoverRules())
-            setChanged();
+            setNeedsStyleRecalc();
         if (renderer() && renderer()->style()->hasAppearance())
             theme()->stateChanged(renderer(), HoverState);
     }
@@ -876,12 +874,11 @@ static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
     else
         c->insertedIntoTree(true);
 
-    if (c->parentNode() && 
-        doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER) &&
-        c->isEventTargetNode()) {
+    doc->incDOMTreeVersion();
+
+    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
         ec = 0;
-        EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, false,
-            c->parentNode(), String(), String(), String(), 0), ec);
+        c->dispatchMutationEvent(eventNames().DOMNodeInsertedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
             return;
     }
@@ -889,12 +886,8 @@ static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
     // dispatch the DOMNodeInsertedIntoDocument event to all descendants
     if (c->inDocument() && doc->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER))
         for (; c; c = c->traverseNextNode(child)) {
-            if (!c->isEventTargetNode())
-                continue;
-          
             ec = 0;
-            EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedIntoDocumentEvent, false, false,
-                0, String(), String(), String(), 0), ec);
+            c->dispatchMutationEvent(eventNames().DOMNodeInsertedIntoDocumentEvent, false, 0, String(), String(), ec); 
             if (ec)
                 return;
         }
@@ -908,13 +901,12 @@ static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
     // update auxiliary doc info (e.g. iterators) to note that node is being removed
     doc->nodeWillBeRemoved(child);
 
+    doc->incDOMTreeVersion();
+
     // dispatch pre-removal mutation events
-    if (c->parentNode() && 
-        doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER) &&
-        c->isEventTargetNode()) {
+    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
         ec = 0;
-        EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, false,
-            c->parentNode(), String(), String(), String(), 0), ec);
+        c->dispatchMutationEvent(eventNames().DOMNodeRemovedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
             return;
     }
@@ -922,11 +914,8 @@ static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
     // dispatch the DOMNodeRemovedFromDocument event to all descendants
     if (c->inDocument() && doc->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
         for (; c; c = c->traverseNextNode(child)) {
-            if (!c->isEventTargetNode())
-                continue;
             ec = 0;
-            EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedFromDocumentEvent, false, false,
-                0, String(), String(), String(), 0), ec);
+            c->dispatchMutationEvent(eventNames().DOMNodeRemovedFromDocumentEvent, false, 0, String(), String(), ec); 
             if (ec)
                 return;
         }
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
index 91ca49a0d9..3ad932c5f6 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
@@ -24,7 +24,7 @@
 #ifndef ContainerNode_h
 #define ContainerNode_h
 
-#include "EventTargetNode.h"
+#include "Node.h"
 #include "FloatPoint.h"
 
 namespace WebCore {
@@ -36,7 +36,7 @@ namespace Private {
     void addChildNodesToDeletionQueue(GenericNode*& head, GenericNode*& tail, GenericNodeContainer* container);
 };
 
-class ContainerNode : public EventTargetNode {
+class ContainerNode : public Node {
 public:
     ContainerNode(Document*, bool isElement = false);
     virtual ~ContainerNode();
@@ -75,8 +75,8 @@ public:
 
 protected:
     static void queuePostAttachCallback(NodeCallback, Node*);
-    static void suspendPostAttachCallbacks();
-    static void resumePostAttachCallbacks();
+    void suspendPostAttachCallbacks();
+    void resumePostAttachCallbacks();
 
     template<class GenericNode, class GenericNodeContainer>
     friend void appendChildToContainer(GenericNode* child, GenericNodeContainer* container);
@@ -96,7 +96,14 @@ private:
     Node* m_firstChild;
     Node* m_lastChild;
 };
-    
+
+inline ContainerNode::ContainerNode(Document* document, bool isElement)
+    : Node(document, isElement, true)
+    , m_firstChild(0)
+    , m_lastChild(0)
+{
+}
+
 inline unsigned Node::containerChildNodeCount() const
 {
     ASSERT(isContainerNode());
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
index c9ac3567f6..3001995283 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
@@ -36,7 +36,7 @@ module core {
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
@@ -66,6 +66,13 @@ module core {
         const unsigned short      VALIDATION_ERR                 = 16;
         // Introduced in DOM Level 3:
         const unsigned short      TYPE_MISMATCH_ERR              = 17;
+        // Introduced as an XHR extension:
+        const unsigned short      SECURITY_ERR                   = 18;
+        // Introduced in HTML5:
+        const unsigned short      NETWORK_ERR                    = 19;
+        const unsigned short      ABORT_ERR                      = 20;
+        const unsigned short      URL_MISMATCH_ERR               = 21;
+        const unsigned short      QUOTA_EXCEEDED_ERR             = 22;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
index 3a60c5b76b..783c62928a 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
@@ -4,7 +4,7 @@
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig (sam@webkit.org)
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "DOMImplementation.h"
 
+#include "ContentType.h"
 #include "CSSStyleSheet.h"
 #include "DocumentType.h"
 #include "Element.h"
@@ -75,7 +76,7 @@ static bool isSVG10Feature(const String &feature)
     static bool initialized = false;
     DEFINE_STATIC_LOCAL(FeatureSet, svgFeatures, ());
     if (!initialized) {
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "svg");
         addString(svgFeatures, "svg.static");
 #endif
@@ -83,7 +84,7 @@ static bool isSVG10Feature(const String &feature)
 //      addString(svgFeatures, "svg.dynamic");
 //      addString(svgFeatures, "svg.dom.animation");
 //      addString(svgFeatures, "svg.dom.dynamic");
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "dom");
         addString(svgFeatures, "dom.svg");
         addString(svgFeatures, "dom.svg.static");
@@ -103,7 +104,7 @@ static bool isSVG11Feature(const String &feature)
         // Sadly, we cannot claim to implement any of the SVG 1.1 generic feature sets
         // lack of Font and Filter support.
         // http://bugs.webkit.org/show_bug.cgi?id=15480
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "SVG");
         addString(svgFeatures, "SVGDOM");
         addString(svgFeatures, "SVG-static");
@@ -140,7 +141,7 @@ static bool isSVG11Feature(const String &feature)
         addString(svgFeatures, "Clip");
         addString(svgFeatures, "BasicClip");
         addString(svgFeatures, "Mask");
-#if ENABLE(SVG_FILTER)
+#if ENABLE(FILTERS)
 //      addString(svgFeatures, "Filter");
         addString(svgFeatures, "BasicFilter");
 #endif
@@ -249,9 +250,10 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
         doc->addChild(doctype);
 
     if (!qualifiedName.isEmpty()) {
-        doc->addChild(doc->createElementNS(namespaceURI, qualifiedName, ec));
-        if (ec != 0)
+        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        if (ec)
             return 0;
+        doc->addChild(documentElement.release());
     }
 
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
@@ -287,8 +289,8 @@ bool DOMImplementation::isXMLMIMEType(const String& mimeType)
 {
     if (mimeType == "text/xml" || mimeType == "application/xml" || mimeType == "text/xsl")
         return true;
-    static const char* validChars = "[0-9a-zA-Z_\\-+~!$\\^{}|.%'`#&*]"; // per RFCs: 3023, 2045
-    DEFINE_STATIC_LOCAL(RegularExpression, xmlTypeRegExp, (String("^") + validChars + "+/" + validChars + "+\\+xml$"));
+    static const char* const validChars = "[0-9a-zA-Z_\\-+~!$\\^{}|.%'`#&*]"; // per RFCs: 3023, 2045
+    DEFINE_STATIC_LOCAL(RegularExpression, xmlTypeRegExp, (String("^") + validChars + "+/" + validChars + "+\\+xml$", TextCaseSensitive));
     return xmlTypeRegExp.match(mimeType) > -1;
 }
 
@@ -313,14 +315,22 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame* frame, bool inViewSourceMode)
 {
     if (inViewSourceMode) {
-        if (type == "text/html" || type == "application/xhtml+xml" || type == "image/svg+xml" || isTextMIMEType(type) || isXMLMIMEType(type))
+        if (type == "text/html" || type == "application/xhtml+xml" || type == "image/svg+xml" || isTextMIMEType(type) || isXMLMIMEType(type)
+#if ENABLE(XHTMLMP)
+            || type == "application/vnd.wap.xhtml+xml"
+#endif
+           )
             return HTMLViewSourceDocument::create(frame, type);
     }
 
     // Plugins cannot take HTML and XHTML from us, and we don't even need to initialize the plugin database for those.
     if (type == "text/html")
         return HTMLDocument::create(frame);
-    if (type == "application/xhtml+xml")
+    if (type == "application/xhtml+xml"
+#if ENABLE(XHTMLMP)
+        || type == "application/vnd.wap.xhtml+xml"
+#endif
+        )
         return Document::createXHTML(frame);
 
 #if ENABLE(WML)
@@ -347,7 +357,7 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
 
 #if ENABLE(VIDEO)
      // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument
-     if (MediaPlayer::supportsType(type))
+     if (MediaPlayer::supportsType(ContentType(type)))
          return MediaDocument::create(frame);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
index 94d75fbded..6f4df80f72 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
@@ -44,7 +44,7 @@ module core {
 
         // DOMImplementationCSS interface from DOM Level 2 CSS
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         [OldStyleObjC] CSSStyleSheet createCSSStyleSheet(in DOMString title,
                                                          in DOMString media)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index a51d1abda2..75c0ba00fb 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -3,8 +3,8 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 David Levin (levin@chromium.org)
  *
  * This library is free software; you can redistribute it and/or
@@ -26,8 +26,9 @@
 #include "config.h"
 #include "Document.h"
 
-#include "AnimationController.h"
 #include "AXObjectCache.h"
+#include "AnimationController.h"
+#include "Attr.h"
 #include "CDATASection.h"
 #include "CSSHelper.h"
 #include "CSSStyleSelector.h"
@@ -39,7 +40,6 @@
 #include "Console.h"
 #include "CookieJar.h"
 #include "DOMImplementation.h"
-#include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "DocLoader.h"
 #include "DocumentFragment.h"
@@ -61,6 +61,7 @@
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCanvasElement.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "HTMLElementFactory.h"
 #include "HTMLFrameOwnerElement.h"
@@ -70,6 +71,7 @@
 #include "HTMLMapElement.h"
 #include "HTMLNameCollection.h"
 #include "HTMLNames.h"
+#include "HTMLParser.h"
 #include "HTMLStyleElement.h"
 #include "HTMLTitleElement.h"
 #include "HTTPParsers.h"
@@ -77,8 +79,11 @@
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "ImageLoader.h"
+#include "InspectorController.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
+#include "MappedAttribute.h"
 #include "MessageEvent.h"
 #include "MouseEvent.h"
 #include "MouseEventWithHitTestResults.h"
@@ -93,22 +98,22 @@
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
 #include "RegisteredEventListener.h"
-#include "RegularExpression.h"
 #include "RenderArena.h"
+#include "RenderTextControl.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
+#include "ScriptElement.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "StyleSheetList.h"
-#include "SystemTime.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
-#include "TreeWalker.h"
 #include "Timer.h"
+#include "TreeWalker.h"
 #include "UIEvent.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitTransitionEvent.h"
@@ -116,12 +121,11 @@
 #include "XMLHttpRequest.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
-#include "JSDOMBinding.h"
-#include "ScriptController.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/HashFunctions.h>
 #include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/StdLibExtras.h>
 
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -161,6 +165,10 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+#endif
+
 using namespace std;
 using namespace WTF;
 using namespace Unicode;
@@ -275,17 +283,29 @@ static bool acceptsEditingFocus(Node *node)
     return frame->editor()->shouldBeginEditing(rangeOfContents(root).get());
 }
 
-static HashSet<Document*>* changedDocuments = 0;
+static bool disableRangeMutation(Page* page)
+{
+#if PLATFORM(MAC)
+    // Disable Range mutation on document modifications in Tiger and Leopard Mail
+    // See <rdar://problem/5865171>
+    return page && (page->settings()->needsLeopardMailQuirks() || page->settings()->needsTigerMailQuirks());
+#else
+    return false;
+#endif
+}
+
+static HashSet<Document*>* documentsThatNeedStyleRecalc = 0;
 
 Document::Document(Frame* frame, bool isXHTML)
     : ContainerNode(0)
     , m_domtree_version(0)
     , m_styleSheets(StyleSheetList::create(this))
+    , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
     , m_frameElementsShouldIgnoreScrolling(false)
     , m_title("")
     , m_titleSetExplicitly(false)
-    , m_imageLoadEventTimer(this, &Document::imageLoadEventTimerFired)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
+    , m_executeScriptSoonTimer(this, &Document::executeScriptSoonTimerFired)
 #if ENABLE(XSLT)
     , m_transformSource(0)
 #endif
@@ -315,9 +335,6 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_hasOpenDatabases(false)
 #endif
     , m_usingGeolocation(false)
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    , m_inLowBandwidthDisplay(false)
-#endif
 {
     m_document.resetSkippingRef(this);
 
@@ -334,7 +351,6 @@ Document::Document(Frame* frame, bool isXHTML)
 
     visuallyOrdered = false;
     m_bParsing = false;
-    m_docChanged = false;
     m_tokenizer = 0;
     m_wellFormed = false;
 
@@ -349,6 +365,7 @@ Document::Document(Frame* frame, bool isXHTML)
     m_usesSiblingRules = false;
     m_usesFirstLineRules = false;
     m_usesFirstLetterRules = false;
+    m_usesBeforeAfterRules = false;
     m_gotoAnchorNeededAfterStylesheetsLoad = false;
  
     m_styleSelector = 0;
@@ -373,6 +390,9 @@ Document::Document(Frame* frame, bool isXHTML)
 
     static int docID = 0;
     m_docID = docID++;
+#if ENABLE(XHTMLMP)
+    m_shouldProcessNoScriptElement = settings() && !settings()->isJavaScriptEnabled();
+#endif
 }
 
 void Document::removedLastRef()
@@ -422,13 +442,17 @@ Document::~Document()
     ASSERT(!m_inPageCache);
     ASSERT(!m_savedRenderer);
     ASSERT(m_ranges.isEmpty());
+    ASSERT(!m_styleRecalcTimer.isActive());
+
+    for (size_t i = 0; i < m_scriptsToExecuteSoon.size(); ++i)
+        m_scriptsToExecuteSoon[i].first->element()->deref(); // Balances ref() in executeScriptSoon().
 
     removeAllEventListeners();
 
+#if USE(JSC)
     forgetAllDOMNodesForDocument(this);
+#endif
 
-    if (m_docChanged && changedDocuments)
-        changedDocuments->remove(this);
     delete m_tokenizer;
     m_document.resetSkippingRef(0);
     delete m_styleSelector;
@@ -513,16 +537,13 @@ void Document::childrenChanged(bool changedByParser, Node* beforeChange, Node* a
     m_documentElement = 0;
 }
 
-Element* Document::documentElement() const
+void Document::cacheDocumentElement() const
 {
-    if (!m_documentElement) {
-        Node* n = firstChild();
-        while (n && !n->isElementNode())
-            n = n->nextSibling();
-        m_documentElement = static_cast<Element*>(n);
-    }
-
-    return m_documentElement.get();
+    ASSERT(!m_documentElement);
+    Node* n = firstChild();
+    while (n && !n->isElementNode())
+        n = n->nextSibling();
+    m_documentElement = static_cast<Element*>(n);
 }
 
 PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionCode& ec)
@@ -535,7 +556,7 @@ PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionC
     if (m_isXHTML)
         return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, name, xhtmlNamespaceURI), this, 0, false);
 
-    return createElement(QualifiedName(nullAtom, name, nullAtom), false, ec);
+    return createElement(QualifiedName(nullAtom, name, nullAtom), false);
 }
 
 PassRefPtr<DocumentFragment> Document::createDocumentFragment()
@@ -629,7 +650,7 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
             if (ec)
                 return 0;
 
-            NamedAttrMap* attrs = oldElement->attributes(true);
+            NamedNodeMap* attrs = oldElement->attributes(true);
             if (attrs) {
                 unsigned length = attrs->length();
                 for (unsigned i = 0; i < length; i++) {
@@ -752,7 +773,7 @@ bool Document::hasPrefixNamespaceMismatch(const QualifiedName& qName)
 }
 
 // FIXME: This should really be in a possible ElementFactory class
-PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool createdByParser, ExceptionCode& ec)
+PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool createdByParser)
 {
     RefPtr<Element> e;
 
@@ -764,25 +785,21 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
         e = SVGElementFactory::createSVGElement(qName, this, createdByParser);
 #endif
 #if ENABLE(WML)
-    else if (qName.namespaceURI() == WMLNames::wmlNamespaceURI || isWMLDocument())
+    else if (qName.namespaceURI() == WMLNames::wmlNamespaceURI)
         e = WMLElementFactory::createWMLElement(qName, this, createdByParser);
+    else if (isWMLDocument())
+        e = WMLElementFactory::createWMLElement(QualifiedName(nullAtom, qName.localName(), WMLNames::wmlNamespaceURI), this, createdByParser);
 #endif
     
     if (!e)
         e = new Element(qName, document());
-    
-    // FIXME: The element factories should be fixed to not ignore qName.prefix()
-    // Instead they should pass the entire qName into element creation so we don't
-    // need to manually set the prefix after creation.
-    // Then this code can become ASSERT(qName == e.qname());
-    // and Document::createElement can stop taking ExceptionCode& as well.
-    if (e && !qName.prefix().isNull()) {
-        ec = 0;
-        e->setPrefix(qName.prefix(), ec);
-        if (ec)
-            return 0;
-    }
-    
+
+    // <image> uses imgTag so we need a special rule.
+#if ENABLE(WML)
+    if (!isWMLDocument())
+#endif
+    ASSERT((qName.matches(imageTag) && e->tagQName().matches(imgTag) && e->tagQName().prefix() == qName.prefix()) || qName == e->tagQName());
+
     return e.release();
 }
 
@@ -798,7 +815,7 @@ PassRefPtr<Element> Document::createElementNS(const String& namespaceURI, const
         return 0;
     }
 
-    return createElement(qName, false, ec);
+    return createElement(qName, false);
 }
 
 Element* Document::getElementById(const AtomicString& elementId) const
@@ -841,10 +858,10 @@ String Document::readyState() const
     return String();
 }
 
-String Document::inputEncoding() const
+String Document::encoding() const
 {
     if (TextResourceDecoder* d = decoder())
-        return d->encoding().name();
+        return d->encoding().domName();
     return String();
 }
 
@@ -900,9 +917,13 @@ Element* Document::elementFromPoint(int x, int y) const
     if (!renderer())
         return 0;
 
-    HitTestRequest request(true, true);
-    HitTestResult result(IntPoint(x, y));
-    renderer()->layer()->hitTest(request, result); 
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active);
+
+    float zoomFactor = frame() ? frame()->pageZoomFactor() : 1.0f;
+
+    HitTestResult result(roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)));
+    renderView()->layer()->hitTest(request, result); 
 
     Node* n = result.innerNode();
     while (n && !n->isElementNode())
@@ -979,9 +1000,8 @@ void Document::setTitle(const String& title, Element* titleElement)
             m_titleElement = 0;
         else if (!m_titleElement) {
             if (HTMLElement* headElement = head()) {
+                m_titleElement = createElement(titleTag, false);
                 ExceptionCode ec = 0;
-                m_titleElement = createElement("title", ec);
-                ASSERT(!ec);
                 headElement->appendChild(m_titleElement, ec);
                 ASSERT(!ec);
             }
@@ -1077,42 +1097,56 @@ PassRefPtr<TreeWalker> Document::createTreeWalker(Node *root, unsigned whatToSho
     return TreeWalker::create(root, whatToShow, filter, expandEntityReferences);
 }
 
-void Document::setDocumentChanged(bool b)
+void Document::scheduleStyleRecalc()
 {
-    if (b) {
-        if (!m_docChanged) {
-            if (!changedDocuments)
-                changedDocuments = new HashSet<Document*>;
-            changedDocuments->add(this);
-        }
-        if (m_accessKeyMapValid) {
-            m_accessKeyMapValid = false;
-            m_elementsByAccessKey.clear();
-        }
-    } else {
-        if (m_docChanged && changedDocuments)
-            changedDocuments->remove(this);
+    if (m_styleRecalcTimer.isActive() || inPageCache())
+        return;
+
+    ASSERT(childNeedsStyleRecalc());
+
+    if (!documentsThatNeedStyleRecalc)
+        documentsThatNeedStyleRecalc = new HashSet<Document*>;
+    documentsThatNeedStyleRecalc->add(this);
+    
+    // FIXME: Why on earth is this here? This is clearly misplaced.
+    if (m_accessKeyMapValid) {
+        m_accessKeyMapValid = false;
+        m_elementsByAccessKey.clear();
     }
+    
+    m_styleRecalcTimer.startOneShot(0);
+}
+
+void Document::unscheduleStyleRecalc()
+{
+    ASSERT(!childNeedsStyleRecalc());
 
-    m_docChanged = b;
+    if (documentsThatNeedStyleRecalc)
+        documentsThatNeedStyleRecalc->remove(this);
+
+    m_styleRecalcTimer.stop();
+}
+
+void Document::styleRecalcTimerFired(Timer<Document>*)
+{
+    updateStyleIfNeeded();
 }
 
 void Document::recalcStyle(StyleChange change)
 {
     // we should not enter style recalc while painting
-    if (frame() && frame()->view() && frame()->view()->isPainting()) {
-        ASSERT(!frame()->view()->isPainting());
+    if (view() && view()->isPainting()) {
+        ASSERT(!view()->isPainting());
         return;
     }
     
     if (m_inStyleRecalc)
         return; // Guard against re-entrancy. -dwh
 
-    if (m_frame)
-        m_frame->animation()->beginAnimationUpdate();
-
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
+    if (view())
+        view()->pauseScheduledEvents();
     
     ASSERT(!renderer() || renderArena());
     if (!renderer() || !renderArena())
@@ -1151,57 +1185,64 @@ void Document::recalcStyle(StyleChange change)
         StyleChange ch = diff(documentStyle.get(), renderer()->style());
         if (renderer() && ch != NoChange)
             renderer()->setStyle(documentStyle.release());
-        if (change != Force)
-            change = ch;
     }
 
     for (Node* n = firstChild(); n; n = n->nextSibling())
-        if (change >= Inherit || n->hasChangedChild() || n->changed())
+        if (change >= Inherit || n->childNeedsStyleRecalc() || n->needsStyleRecalc())
             n->recalcStyle(change);
 
-    if (changed() && view())
-        view()->layout();
+#if USE(ACCELERATED_COMPOSITING)
+    if (view()) {
+        bool layoutPending = view()->layoutPending() || renderer()->needsLayout();
+        // If we didn't update compositing layers because of layout(), we need to do so here.
+        if (!layoutPending)
+            view()->updateCompositingLayers();
+    }
+#endif
 
 bail_out:
-    setChanged(NoStyleChange);
-    setHasChangedChild(false);
-    setDocumentChanged(false);
-    
+    setNeedsStyleRecalc(NoStyleChange);
+    setChildNeedsStyleRecalc(false);
+    unscheduleStyleRecalc();
+
+    if (view())
+        view()->resumeScheduledEvents();
     resumePostAttachCallbacks();
     m_inStyleRecalc = false;
-    
+
     // If we wanted to call implicitClose() during recalcStyle, do so now that we're finished.
     if (m_closeAfterStyleRecalc) {
         m_closeAfterStyleRecalc = false;
         implicitClose();
     }
-
-    if (m_frame)
-        m_frame->animation()->endAnimationUpdate();
 }
 
-void Document::updateRendering()
+void Document::updateStyleIfNeeded()
 {
-    if (hasChangedChild() && !inPageCache())
-        recalcStyle(NoChange);
+    if (!childNeedsStyleRecalc() || inPageCache())
+        return;
+        
+    if (m_frame)
+        m_frame->animation()->beginAnimationUpdate();
+        
+    recalcStyle(NoChange);
     
-    // Tell the animation controller that the style is available and it can start animations
+    // Tell the animation controller that updateStyleIfNeeded is finished and it can do any post-processing
     if (m_frame)
-        m_frame->animation()->styleAvailable();
+        m_frame->animation()->endAnimationUpdate();
 }
 
-void Document::updateDocumentsRendering()
+void Document::updateStyleForAllDocuments()
 {
-    if (!changedDocuments)
+    if (!documentsThatNeedStyleRecalc)
         return;
 
-    while (changedDocuments->size()) {
-        HashSet<Document*>::iterator it = changedDocuments->begin();
+    while (documentsThatNeedStyleRecalc->size()) {
+        HashSet<Document*>::iterator it = documentsThatNeedStyleRecalc->begin();
         Document* doc = *it;
-        changedDocuments->remove(it);
-        
-        doc->m_docChanged = false;
-        doc->updateRendering();
+        documentsThatNeedStyleRecalc->remove(doc);
+        ASSERT(doc->childNeedsStyleRecalc() && !doc->inPageCache());
+        doc->updateStyleIfNeeded();
     }
 }
 
@@ -1210,8 +1251,7 @@ void Document::updateLayout()
     if (Element* oe = ownerElement())
         oe->document()->updateLayout();
 
-    // FIXME: Dave Hyatt's pretty sure we can remove this because layout calls recalcStyle as needed.
-    updateRendering();
+    updateStyleIfNeeded();
 
     // Only do a layout if changes have occurred that make it necessary.      
     FrameView* v = view();
@@ -1263,6 +1303,9 @@ void Document::attach()
     
     // Create the rendering tree
     setRenderer(new (m_renderArena) RenderView(this, view()));
+#if USE(ACCELERATED_COMPOSITING)
+    renderView()->didMoveOnscreen();
+#endif
 
     if (!m_styleSelector) {
         bool matchAuthorAndUserStyles = true;
@@ -1291,29 +1334,30 @@ void Document::detach()
     
     RenderObject* render = renderer();
 
+    // Send out documentWillBecomeInactive() notifications to registered elements,
+    // in order to stop media elements
+    documentWillBecomeInactive();
+    
     // indicate destruction mode,  i.e. attached() but renderer == 0
     setRenderer(0);
-    
-    // Empty out these lists as a performance optimization, since detaching
-    // all the individual render objects will cause all the RenderImage
-    // objects to remove themselves from the lists.
-    m_imageLoadEventDispatchSoonList.clear();
-    m_imageLoadEventDispatchingList.clear();
-    
+
     m_hoverNode = 0;
     m_focusedNode = 0;
     m_activeNode = 0;
 
     ContainerNode::detach();
 
+    unscheduleStyleRecalc();
+
     if (render)
         render->destroy();
     
     // This is required, as our Frame might delete itself as soon as it detaches
-    // us.  However, this violates Node::detach() symantics, as it's never
-    // possible to re-attach.  Eventually Document::detach() should be renamed
-    // or this call made explicit in each of the callers of Document::detach().
-    clearFramePointer();
+    // us. However, this violates Node::detach() symantics, as it's never
+    // possible to re-attach. Eventually Document::detach() should be renamed,
+    // or this setting of the frame to 0 could be made explicit in each of the
+    // callers of Document::detach().
+    m_frame = 0;
     
     if (m_renderArena) {
         delete m_renderArena;
@@ -1321,23 +1365,13 @@ void Document::detach()
     }
 }
 
-void Document::clearFramePointer()
-{
-    m_frame = 0;
-}
-
-void Document::removeAllEventListenersFromAllNodes()
+void Document::removeAllEventListeners()
 {
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_windowEventListeners[i]->setRemoved(true);
-    m_windowEventListeners.clear();
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
     removeAllDisconnectedNodeEventListeners();
-    for (Node *n = this; n; n = n->traverseNextNode()) {
-        if (!n->isEventTargetNode())
-            continue;
-        EventTargetNodeCast(n)->removeAllEventListeners();
-    }
+    for (Node* node = this; node; node = node->traverseNextNode())
+        node->removeAllEventListeners();
 }
 
 void Document::registerDisconnectedNodeWithEventListeners(Node* node)
@@ -1354,10 +1388,15 @@ void Document::removeAllDisconnectedNodeEventListeners()
 {
     HashSet<Node*>::iterator end = m_disconnectedNodesWithEventListeners.end();
     for (HashSet<Node*>::iterator i = m_disconnectedNodesWithEventListeners.begin(); i != end; ++i)
-        EventTargetNodeCast(*i)->removeAllEventListeners();
+        (*i)->removeAllEventListeners();
     m_disconnectedNodesWithEventListeners.clear();
 }
 
+RenderView* Document::renderView() const
+{
+    return toRenderView(renderer());
+}
+
 void Document::clearAXObjectCache()
 {
     // clear cache in top document
@@ -1465,9 +1504,14 @@ void Document::implicitOpen()
     clear();
     m_tokenizer = createTokenizer();
     setParsing(true);
+
+    // If we reload, the animation controller sticks around and has
+    // a stale animation time. We need to update it here.
+    if (m_frame && m_frame->animation())
+        m_frame->animation()->beginAnimationUpdate();
 }
 
-HTMLElement* Document::body()
+HTMLElement* Document::body() const
 {
     Node* de = documentElement();
     if (!de)
@@ -1554,10 +1598,16 @@ void Document::implicitClose()
     // Parser should have picked up all preloads by now
     m_docLoader->clearPreloads();
 
-    // Create a body element if we don't already have one. See Radar 3758785.
+    // Create a head and a body if we don't have those yet (e.g. for about:blank).
     if (!this->body() && isHTMLDocument()) {
         if (Node* documentElement = this->documentElement()) {
             ExceptionCode ec = 0;
+            
+            // The implicit <head> isn't expected in older versions of Mail - <rdar://problem/6863795>
+            if (!head() && shouldCreateImplicitHead(this)) {
+                documentElement->appendChild(new HTMLHeadElement(headTag, this), ec);
+                ASSERT(!ec);
+            }
             documentElement->appendChild(new HTMLBodyElement(bodyTag, this), ec);
             ASSERT(!ec);
         }
@@ -1577,8 +1627,8 @@ void Document::implicitClose()
     if (f)
         f->animation()->resumeAnimations(this);
 
-    dispatchImageLoadEventsNow();
-    this->dispatchWindowEvent(eventNames().loadEvent, false, false);
+    ImageLoader::dispatchPendingLoadEvents();
+    dispatchLoadEvent();
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1605,30 +1655,21 @@ void Document::implicitClose()
 
     frame()->loader()->checkCallImplicitClose();
 
-    // Now do our painting/layout, but only if we aren't in a subframe or if we're in a subframe
-    // that has been sized already.  Otherwise, our view size would be incorrect, so doing any 
-    // layout/painting now would be pointless.
+    // We used to force a synchronous display and flush here.  This really isn't
+    // necessary and can in fact be actively harmful if pages are loading at a rate of > 60fps
+    // (if your platform is syncing flushes and limiting them to 60fps).
+    m_overMinimumLayoutThreshold = true;
     if (!ownerElement() || (ownerElement()->renderer() && !ownerElement()->renderer()->needsLayout())) {
-        updateRendering();
+        updateStyleIfNeeded();
         
         // Always do a layout after loading if needed.
         if (view() && renderer() && (!renderer()->firstChild() || renderer()->needsLayout()))
             view()->layout();
-            
-        // Paint immediately after the document is ready.  We do this to ensure that any timers set by the
-        // onload don't have a chance to fire before we would have painted.  To avoid over-flushing we only
-        // worry about this for the top-level document.  For platforms that use native widgets for ScrollViews, this
-        // call does nothing (Mac, wx).
-        // FIXME: This causes a timing issue with the dispatchDidFinishLoad delegate callback on Mac, so think
-        // before enabling it, even if Mac becomes viewless later.
-        // See <rdar://problem/5092361>
-        if (view() && !ownerElement())
-            view()->hostWindow()->paint();
     }
 
 #if PLATFORM(MAC)
     if (f && renderer() && this == topDocument() && AXObjectCache::accessibilityEnabled())
-        axObjectCache()->postNotificationToElement(renderer(), "AXLoadComplete");
+        axObjectCache()->postNotification(renderer(), "AXLoadComplete", true);
 #endif
 
 #if ENABLE(SVG)
@@ -1660,8 +1701,8 @@ bool Document::shouldScheduleLayout()
     //    (a) Only schedule a layout once the stylesheets are loaded.
     //    (b) Only schedule layout once we have a body element.
 
-    return haveStylesheetsLoaded()
-        && body() || (documentElement() && !documentElement()->hasTagName(htmlTag));
+    return (haveStylesheetsLoaded() && body()) ||
+        (documentElement() && !documentElement()->hasTagName(htmlTag));
 }
 
 int Document::minimumLayoutDelay()
@@ -1681,28 +1722,30 @@ int Document::elapsedTime() const
     return static_cast<int>((currentTime() - m_startTime) * 1000);
 }
 
-void Document::write(const String& text, Document* ownerDocument)
+void Document::write(const SegmentedString& text, Document* ownerDocument)
 {
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!ownerElement())
         printf("Beginning a document.write at %d\n", elapsedTime());
 #endif
-    
-    if (!m_tokenizer) {
+
+    if (!m_tokenizer)
         open(ownerDocument);
-        ASSERT(m_tokenizer);
-        if (!m_tokenizer)
-            return;
-        write("<html>", ownerDocument);
-    }
+
+    ASSERT(m_tokenizer);
     m_tokenizer->write(text, false);
-    
+
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!ownerElement())
         printf("Ending a document.write at %d\n", elapsedTime());
 #endif    
 }
 
+void Document::write(const String& text, Document* ownerDocument)
+{
+    write(SegmentedString(text), ownerDocument);
+}
+
 void Document::writeln(const String& text, Document* ownerDocument)
 {
     write(text, ownerDocument);
@@ -1731,11 +1774,8 @@ void Document::clear()
     m_tokenizer = 0;
 
     removeChildren();
-
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_windowEventListeners[i]->setRemoved(true);
-    m_windowEventListeners.clear();
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
 }
 
 const KURL& Document::virtualURL() const
@@ -1767,7 +1807,15 @@ void Document::setBaseElementURL(const KURL& baseElementURL)
 
 void Document::updateBaseURL()
 {
-    m_baseURL = m_baseElementURL.isEmpty() ? KURL(documentURI()) : m_baseElementURL;
+    // DOM 3 Core: When the Document supports the feature "HTML" [DOM Level 2 HTML], the base URI is computed using
+    // first the value of the href attribute of the HTML BASE element if any, and the value of the documentURI attribute
+    // from the Document interface otherwise.
+    if (m_baseElementURL.isEmpty()) {
+        // The documentURI attribute is an arbitrary string. DOM 3 Core does not specify how it should be resolved,
+        // so we use a null base URL.
+        m_baseURL = KURL(KURL(), documentURI());
+    } else
+        m_baseURL = m_baseElementURL;
     if (!m_baseURL.isValid())
         m_baseURL = KURL();
 
@@ -1777,6 +1825,11 @@ void Document::updateBaseURL()
         m_mappedElementSheet->setHref(m_baseURL.string());
 }
 
+String Document::userAgent(const KURL& url) const
+{
+    return frame() ? frame()->loader()->userAgent(url) : String();
+}
+
 void Document::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
 {
     m_sheet = CSSStyleSheet::create(this, url, charset);
@@ -1953,11 +2006,11 @@ Node *Document::nodeWithAbsIndex(int absIndex)
     return n;
 }
 
-void Document::processHttpEquiv(const String &equiv, const String &content)
+void Document::processHttpEquiv(const String& equiv, const String& content)
 {
     ASSERT(!equiv.isNull() && !content.isNull());
 
-    Frame *frame = this->frame();
+    Frame* frame = this->frame();
 
     if (equalIgnoringCase(equiv, "default-style")) {
         // The preferred style set has been overridden as per section 
@@ -1987,6 +2040,13 @@ void Document::processHttpEquiv(const String &equiv, const String &content)
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
         parseDNSPrefetchControlHeader(content);
+    else if (equalIgnoringCase(equiv, "x-frame-options")) {
+        FrameLoader* frameLoader = frame->loader();
+        if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
+            frameLoader->stopAllLoaders();
+            frameLoader->scheduleHTTPRedirection(0, blankURL());
+        }
+    }
 }
 
 MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& request, const IntPoint& documentPoint, const PlatformMouseEvent& event)
@@ -1997,10 +2057,10 @@ MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& r
         return MouseEventWithHitTestResults(event, HitTestResult(IntPoint()));
 
     HitTestResult result(documentPoint);
-    renderer()->layer()->hitTest(request, result);
+    renderView()->layer()->hitTest(request, result);
 
-    if (!request.readonly)
-        updateRendering();
+    if (!request.readOnly())
+        updateStyleIfNeeded();
 
     return MouseEventWithHitTestResults(event, result);
 }
@@ -2455,21 +2515,23 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
                 
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer());
-        if (r && (r->isTextArea() || r->isTextField()) && r->isEdited()) {
-            EventTargetNodeCast(oldFocusedNode.get())->dispatchEventForType(eventNames().changeEvent, true, false);
-            if ((r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer())))
-                r->setEdited(false);
+        if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
+            oldFocusedNode->dispatchEvent(eventNames().changeEvent, true, false);
+            if ((r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer()))) {
+                if (r->isTextControl())
+                    toRenderTextControl(r)->setEdited(false);
+            }
         }
 
         // Dispatch the blur event and let the node do any other blur related activities (important for text fields)
-        EventTargetNodeCast(oldFocusedNode.get())->dispatchBlurEvent();
+        oldFocusedNode->dispatchBlurEvent();
 
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        EventTargetNodeCast(oldFocusedNode.get())->dispatchUIEvent(eventNames().DOMFocusOutEvent);
+        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent);
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2492,14 +2554,14 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         m_focusedNode = newFocusedNode.get();
 
         // Dispatch the focus event and let the node do any other focus related activities (important for text fields)
-        EventTargetNodeCast(m_focusedNode.get())->dispatchFocusEvent();
+        m_focusedNode->dispatchFocusEvent();
 
         if (m_focusedNode != newFocusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
             goto SetFocusedNodeDone;
         }
-        EventTargetNodeCast(m_focusedNode.get())->dispatchUIEvent(eventNames().DOMFocusInEvent);
+        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent);
         if (m_focusedNode != newFocusedNode) { 
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2529,28 +2591,45 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
    }
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !PLATFORM(CHROMIUM)
     if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled())
         axObjectCache()->handleFocusedUIElementChanged();
+#elif PLATFORM(GTK)
+    if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled()) {
+        RenderObject* oldFocusedRenderer = 0;
+        RenderObject* newFocusedRenderer = 0;
+
+        if (oldFocusedNode)
+            oldFocusedRenderer = oldFocusedNode.get()->renderer();
+        if (newFocusedNode)
+            newFocusedRenderer = newFocusedNode.get()->renderer();
+
+        axObjectCache()->handleFocusedUIElementChangedWithRenderers(oldFocusedRenderer, newFocusedRenderer);
+    }
 #endif
 
 SetFocusedNodeDone:
-    updateRendering();
+    updateStyleIfNeeded();
     return !focusChangeBlocked;
-  }
+}
+    
+void Document::getFocusableNodes(Vector<RefPtr<Node> >& nodes)
+{
+    updateLayout();
+
+    for (Node* node = firstChild(); node; node = node->traverseNextNode()) {
+        if (node->isFocusable())
+            nodes.append(node);
+    }
+}
   
-void Document::setCSSTarget(Node* n)
+void Document::setCSSTarget(Element* n)
 {
     if (m_cssTarget)
-        m_cssTarget->setChanged();
+        m_cssTarget->setNeedsStyleRecalc();
     m_cssTarget = n;
     if (n)
-        n->setChanged();
-}
-
-Node* Document::getCSSTarget() const
-{
-    return m_cssTarget;
+        n->setNeedsStyleRecalc();
 }
 
 void Document::attachNodeIterator(NodeIterator *ni)
@@ -2565,7 +2644,7 @@ void Document::detachNodeIterator(NodeIterator *ni)
 
 void Document::nodeChildrenChanged(ContainerNode* container)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->nodeChildrenChanged(container);
@@ -2578,7 +2657,7 @@ void Document::nodeWillBeRemoved(Node* n)
     for (HashSet<NodeIterator*>::const_iterator it = m_nodeIterators.begin(); it != nodeIteratorsEnd; ++it)
         (*it)->nodeWillBeRemoved(n);
 
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator rangesEnd = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != rangesEnd; ++it)
             (*it)->nodeWillBeRemoved(n);
@@ -2592,7 +2671,7 @@ void Document::nodeWillBeRemoved(Node* n)
 
 void Document::textInserted(Node* text, unsigned offset, unsigned length)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textInserted(text, offset, length);
@@ -2604,7 +2683,7 @@ void Document::textInserted(Node* text, unsigned offset, unsigned length)
 
 void Document::textRemoved(Node* text, unsigned offset, unsigned length)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textRemoved(text, offset, length);
@@ -2617,7 +2696,7 @@ void Document::textRemoved(Node* text, unsigned offset, unsigned length)
 
 void Document::textNodesMerged(Text* oldNode, unsigned offset)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         NodeWithIndex oldNodeWithIndex(oldNode);
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
@@ -2629,7 +2708,7 @@ void Document::textNodesMerged(Text* oldNode, unsigned offset)
 
 void Document::textNodeSplit(Text* oldNode)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textNodeSplit(oldNode);
@@ -2643,9 +2722,51 @@ DOMWindow* Document::domWindow() const
 {
     if (!frame())
         return 0;
+
+    // The m_frame pointer is not (not always?) zeroed out when the document is put into b/f cache, so the frame can hold an unrelated document/window pair.
+    // FIXME: We should always zero out the frame pointer on navigation to avoid accidentally accessing the new frame content.
+    if (m_frame->document() != this)
+        return 0;
+
     return frame()->domWindow();
 }
 
+void Document::setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->setAttributeEventListener(eventType, listener);
+}
+
+void Document::dispatchWindowEvent(PassRefPtr<Event> event)
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    ExceptionCode ec;
+    domWindow->dispatchEvent(event, ec);
+}
+
+void Document::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->dispatchEvent(eventType, canBubbleArg, cancelableArg);
+}
+
+void Document::dispatchLoadEvent()
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->dispatchLoadEvent();
+}
+
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
@@ -2719,191 +2840,6 @@ CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
     return 0;
 }
 
-void Document::handleWindowEvent(Event* event, bool useCapture)
-{
-    if (m_windowEventListeners.isEmpty())
-        return;
-        
-    // If any HTML event listeners are registered on the window, dispatch them here.
-    RegisteredEventListenerVector listenersCopy = m_windowEventListeners;
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, true);
-    }
-}
-
-void Document::setWindowInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    // If we already have it we don't want removeWindowEventListener to delete it
-    removeWindowInlineEventListenerForType(eventType);
-    if (listener)
-        addWindowEventListener(eventType, listener, false);
-}
-
-EventListener* Document::windowInlineEventListenerForType(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline())
-            return r.listener();
-    }
-    return 0;
-}
-
-void Document::removeWindowInlineEventListenerForType(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline()) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingFrameUnloadEventCount();
-            else if (eventType == eventNames().beforeunloadEvent)
-                removePendingFrameBeforeUnloadEventCount();
-            r.setRemoved(true);
-            m_windowEventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-void Document::addWindowEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    if (eventType == eventNames().unloadEvent)
-        addPendingFrameUnloadEventCount();
-    else if (eventType == eventNames().beforeunloadEvent)
-        addPendingFrameBeforeUnloadEventCount();
-    // Remove existing identical listener set with identical arguments.
-    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
-    removeWindowEventListener(eventType, listener.get(), useCapture);
-    addListenerTypeIfNeeded(eventType);
-    m_windowEventListeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
-}
-
-void Document::removeWindowEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingFrameUnloadEventCount();
-            else if (eventType == eventNames().beforeunloadEvent)
-                removePendingFrameBeforeUnloadEventCount();
-            r.setRemoved(true);
-            m_windowEventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-bool Document::hasWindowEventListener(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_windowEventListeners[i]->eventType() == eventType)
-            return true;
-    }
-    return false;
-}
-
-void Document::addPendingFrameUnloadEventCount() 
-{
-    if (m_frame)
-         m_frame->eventHandler()->addPendingFrameUnloadEventCount();
-}
-
-void Document::removePendingFrameUnloadEventCount() 
-{
-    if (m_frame)
-        m_frame->eventHandler()->removePendingFrameUnloadEventCount();
-}
-
-void Document::addPendingFrameBeforeUnloadEventCount() 
-{
-    if (m_frame)
-         m_frame->eventHandler()->addPendingFrameBeforeUnloadEventCount();
-}
-
-void Document::removePendingFrameBeforeUnloadEventCount() 
-{
-    if (m_frame)
-        m_frame->eventHandler()->removePendingFrameBeforeUnloadEventCount();
-}
-
-PassRefPtr<EventListener> Document::createEventListener(const String& functionName, const String& code, Node* node)
-{
-    Frame* frm = frame();
-    if (!frm || !frm->script()->isEnabled())
-        return 0;
-
-#if ENABLE(SVG)
-    if (node ? node->isSVGElement() : isSVGDocument())
-        return frm->script()->createSVGEventHandler(functionName, code, node);
-#endif
-
-    // We may want to treat compound document event handlers in a different way, in future.
-    return frm->script()->createInlineEventListener(functionName, code, node);
-}
-
-void Document::setWindowInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute* attr)
-{
-    setWindowInlineEventListenerForType(eventType, createEventListener(attr->localName().string(), attr->value(), 0));
-}
-
-void Document::dispatchImageLoadEventSoon(ImageLoader* image)
-{
-    m_imageLoadEventDispatchSoonList.append(image);
-    if (!m_imageLoadEventTimer.isActive())
-        m_imageLoadEventTimer.startOneShot(0);
-}
-
-void Document::removeImage(ImageLoader* image)
-{
-    // Remove instances of this image from both lists.
-    // Use loops because we allow multiple instances to get into the lists.
-    size_t size = m_imageLoadEventDispatchSoonList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_imageLoadEventDispatchSoonList[i] == image)
-            m_imageLoadEventDispatchSoonList[i] = 0;
-    }
-    size = m_imageLoadEventDispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_imageLoadEventDispatchingList[i] == image)
-            m_imageLoadEventDispatchingList[i] = 0;
-    }
-    if (m_imageLoadEventDispatchSoonList.isEmpty())
-        m_imageLoadEventTimer.stop();
-}
-
-void Document::dispatchImageLoadEventsNow()
-{
-    // Need to avoid re-entering this function; if new dispatches are
-    // scheduled before the parent finishes processing the list, they
-    // will set a timer and eventually be processed.
-    if (!m_imageLoadEventDispatchingList.isEmpty())
-        return;
-
-    m_imageLoadEventTimer.stop();
-
-    m_imageLoadEventDispatchingList = m_imageLoadEventDispatchSoonList;
-    m_imageLoadEventDispatchSoonList.clear();
-    size_t size = m_imageLoadEventDispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (ImageLoader* image = m_imageLoadEventDispatchingList[i])
-            image->dispatchLoadEvent();
-    }
-    m_imageLoadEventDispatchingList.clear();
-}
-
-void Document::imageLoadEventTimerFired(Timer<Document>*)
-{
-    dispatchImageLoadEventsNow();
-}
-
 Element* Document::ownerElement() const
 {
     if (!frame())
@@ -2932,7 +2868,7 @@ void Document::setCookie(const String& value)
     if (cookieURL.isEmpty())
         return;
 
-    setCookies(this, cookieURL, policyBaseURL(), value);
+    setCookies(this, cookieURL, value);
 }
 
 String Document::referrer() const
@@ -3143,13 +3079,6 @@ void Document::setDecoder(PassRefPtr<TextResourceDecoder> decoder)
     m_decoder = decoder;
 }
 
-UChar Document::backslashAsCurrencySymbol() const
-{
-    if (!m_decoder)
-        return '\\';
-    return m_decoder->encoding().backslashAsCurrencySymbol();
-}
-
 KURL Document::completeURL(const String& url) const
 {
     // Always return a null URL when passed a null string.
@@ -3157,14 +3086,10 @@ KURL Document::completeURL(const String& url) const
     // See also [CSS]StyleSheet::completeURL(const String&)
     if (url.isNull())
         return KURL();
+    const KURL& baseURL = ((m_baseURL.isEmpty() || m_baseURL == blankURL()) && parentDocument()) ? parentDocument()->baseURL() : m_baseURL;
     if (!m_decoder)
-        return KURL(m_baseURL, url);
-    return KURL(m_baseURL, url, m_decoder->encoding());
-}
-
-bool Document::inPageCache()
-{
-    return m_inPageCache;
+        return KURL(baseURL, url);
+    return KURL(baseURL, url, m_decoder->encoding());
 }
 
 void Document::setInPageCache(bool flag)
@@ -3178,16 +3103,24 @@ void Document::setInPageCache(bool flag)
         m_savedRenderer = renderer();
         if (FrameView* v = view())
             v->resetScrollbars();
+        unscheduleStyleRecalc();
     } else {
         ASSERT(renderer() == 0 || renderer() == m_savedRenderer);
         ASSERT(m_renderArena);
         setRenderer(m_savedRenderer);
         m_savedRenderer = 0;
+        if (childNeedsStyleRecalc())
+            scheduleStyleRecalc();
     }
 }
 
 void Document::documentWillBecomeInactive() 
 {
+#if USE(ACCELERATED_COMPOSITING)
+    if (renderer())
+        renderView()->willMoveOffscreen();
+#endif
+
     HashSet<Element*>::iterator end = m_documentActivationCallbackElements.end();
     for (HashSet<Element*>::iterator i = m_documentActivationCallbackElements.begin(); i != end; ++i)
         (*i)->documentWillBecomeInactive();
@@ -3198,6 +3131,11 @@ void Document::documentDidBecomeActive()
     HashSet<Element*>::iterator end = m_documentActivationCallbackElements.end();
     for (HashSet<Element*>::iterator i = m_documentActivationCallbackElements.begin(); i != end; ++i)
         (*i)->documentDidBecomeActive();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (renderer())
+        renderView()->didMoveOnscreen();
+#endif
 }
 
 void Document::registerForDocumentActivationCallbacks(Element* e)
@@ -3289,7 +3227,7 @@ void Document::addMarker(Range *range, DocumentMarker::MarkerType type, String d
     for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
         RefPtr<Range> textPiece = markedText.range();
         int exception = 0;
-        DocumentMarker marker = {type, textPiece->startOffset(exception), textPiece->endOffset(exception), description};
+        DocumentMarker marker = {type, textPiece->startOffset(exception), textPiece->endOffset(exception), description, false};
         addMarker(textPiece->startContainer(exception), marker);
     }
 }
@@ -3714,6 +3652,53 @@ void Document::shiftMarkers(Node *node, unsigned startOffset, int delta, Documen
         node->renderer()->repaint();
 }
 
+void Document::setMarkersActive(Range* range, bool active)
+{
+    if (m_markers.isEmpty())
+        return;
+
+    ExceptionCode ec = 0;
+    Node* startContainer = range->startContainer(ec);
+    Node* endContainer = range->endContainer(ec);
+
+    Node* pastLastNode = range->pastLastNode();
+    for (Node* node = range->firstNode(); node != pastLastNode; node = node->traverseNextNode()) {
+        int startOffset = node == startContainer ? range->startOffset(ec) : 0;
+        int endOffset = node == endContainer ? range->endOffset(ec) : INT_MAX;
+        setMarkersActive(node, startOffset, endOffset, active);
+    }
+}
+
+void Document::setMarkersActive(Node* node, unsigned startOffset, unsigned endOffset, bool active)
+{
+    MarkerMapVectorPair* vectorPair = m_markers.get(node);
+    if (!vectorPair)
+        return;
+
+    Vector<DocumentMarker>& markers = vectorPair->first;
+    ASSERT(markers.size() == vectorPair->second.size());
+
+    bool docDirty = false;
+    for (size_t i = 0; i != markers.size(); ++i) {
+        DocumentMarker &marker = markers[i];
+
+        // Markers are returned in order, so stop if we are now past the specified range.
+        if (marker.startOffset >= endOffset)
+            break;
+
+        // Skip marker that is wrong type or before target.
+        if (marker.endOffset < startOffset || marker.type != DocumentMarker::TextMatch)
+            continue;
+
+        marker.activeMatch = active;
+        docDirty = true;
+    }
+
+    // repaint the affected node
+    if (docDirty && node->renderer())
+        node->renderer()->repaint();
+}
+
 #if ENABLE(XSLT)
 
 void Document::applyXSLTransform(ProcessingInstruction* pi)
@@ -3780,6 +3765,11 @@ Document *Document::topDocument() const
     return doc;
 }
 
+PassRefPtr<Attr> Document::createAttribute(const String& name, ExceptionCode& ec)
+{
+    return createAttributeNS(String(), name, ec, true);
+}
+
 PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode& ec, bool shouldIgnoreNamespaceChecks)
 {
     String prefix, localName;
@@ -3819,75 +3809,75 @@ SVGDocumentExtensions* Document::accessSVGExtensions()
 
 PassRefPtr<HTMLCollection> Document::images()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocImages);
+    return HTMLCollection::create(this, DocImages);
 }
 
 PassRefPtr<HTMLCollection> Document::applets()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocApplets);
+    return HTMLCollection::create(this, DocApplets);
 }
 
 PassRefPtr<HTMLCollection> Document::embeds()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocEmbeds);
+    return HTMLCollection::create(this, DocEmbeds);
 }
 
 PassRefPtr<HTMLCollection> Document::plugins()
 {
     // This is an alias for embeds() required for the JS DOM bindings.
-    return HTMLCollection::create(this, HTMLCollection::DocEmbeds);
+    return HTMLCollection::create(this, DocEmbeds);
 }
 
 PassRefPtr<HTMLCollection> Document::objects()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocObjects);
+    return HTMLCollection::create(this, DocObjects);
 }
 
 PassRefPtr<HTMLCollection> Document::scripts()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocScripts);
+    return HTMLCollection::create(this, DocScripts);
 }
 
 PassRefPtr<HTMLCollection> Document::links()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocLinks);
+    return HTMLCollection::create(this, DocLinks);
 }
 
 PassRefPtr<HTMLCollection> Document::forms()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocForms);
+    return HTMLCollection::create(this, DocForms);
 }
 
 PassRefPtr<HTMLCollection> Document::anchors()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocAnchors);
+    return HTMLCollection::create(this, DocAnchors);
 }
 
 PassRefPtr<HTMLCollection> Document::all()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocAll);
+    return HTMLCollection::create(this, DocAll);
 }
 
 PassRefPtr<HTMLCollection> Document::windowNamedItems(const String &name)
 {
-    return HTMLNameCollection::create(this, HTMLCollection::WindowNamedItems, name);
+    return HTMLNameCollection::create(this, WindowNamedItems, name);
 }
 
 PassRefPtr<HTMLCollection> Document::documentNamedItems(const String &name)
 {
-    return HTMLNameCollection::create(this, HTMLCollection::DocumentNamedItems, name);
+    return HTMLNameCollection::create(this, DocumentNamedItems, name);
 }
 
-HTMLCollection::CollectionInfo* Document::nameCollectionInfo(HTMLCollection::Type type, const AtomicString& name)
+CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicString& name)
 {
-    ASSERT(type >= HTMLCollection::FirstNamedDocumentCachedType);
-    unsigned index = type - HTMLCollection::FirstNamedDocumentCachedType;
-    ASSERT(index < HTMLCollection::NumNamedDocumentCachedTypes);
+    ASSERT(type >= FirstNamedDocumentCachedType);
+    unsigned index = type - FirstNamedDocumentCachedType;
+    ASSERT(index < NumNamedDocumentCachedTypes);
 
     NamedCollectionMap& map = m_nameCollectionInfo[index];
     NamedCollectionMap::iterator iter = map.find(name.impl());
     if (iter == map.end())
-        iter = map.add(name.impl(), new HTMLCollection::CollectionInfo).first;
+        iter = map.add(name.impl(), new CollectionCache).first;
     return iter->second;
 }
 
@@ -3905,15 +3895,15 @@ void Document::finishedParsing()
 Vector<String> Document::formElementsState() const
 {
     Vector<String> stateVector;
-    stateVector.reserveCapacity(m_formElementsWithState.size() * 3);
-    typedef ListHashSet<HTMLFormControlElementWithState*>::const_iterator Iterator;
+    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 3);
+    typedef ListHashSet<Element*>::const_iterator Iterator;
     Iterator end = m_formElementsWithState.end();
     for (Iterator it = m_formElementsWithState.begin(); it != end; ++it) {
-        HTMLFormControlElementWithState* e = *it;
+        Element* e = *it;
         String value;
-        if (e->saveState(value)) {
-            stateVector.append(e->name().string());
-            stateVector.append(e->type().string());
+        if (e->saveFormControlState(value)) {
+            stateVector.append(e->formControlName().string());
+            stateVector.append(e->formControlType().string());
             stateVector.append(value);
         }
     }
@@ -4122,6 +4112,20 @@ void Document::initSecurityContext()
             securityOrigin()->grantLoadLocalResources();
     }
 
+    if (Settings* settings = this->settings()) {
+        if (!settings->isWebSecurityEnabled()) {
+          // Web security is turned off.  We should let this document access every
+          // other document.  This is used primary by testing harnesses for web
+          // sites.
+          securityOrigin()->grantUniversalAccess();
+
+        } else if (settings->allowUniversalAccessFromFileURLs() && securityOrigin()->isLocal()) {
+          // Some clients want file:// URLs to have universal access, but that
+          // setting is dangerous for other clients.
+          securityOrigin()->grantUniversalAccess();
+        }
+    }
+
     if (!securityOrigin()->isEmpty())
         return;
 
@@ -4132,7 +4136,7 @@ void Document::initSecurityContext()
     if (!ownerFrame)
         ownerFrame = m_frame->loader()->opener();
 
-    if (ownerFrame && ownerFrame->document()) {
+    if (ownerFrame) {
         m_cookieURL = ownerFrame->document()->cookieURL();
         // We alias the SecurityOrigins to match Firefox, see Bug 15313
         // https://bugs.webkit.org/show_bug.cgi?id=15313
@@ -4174,6 +4178,34 @@ void Document::updateFocusAppearanceTimerFired(Timer<Document>*)
         element->updateFocusAppearance(false);
 }
 
+void Document::executeScriptSoonTimerFired(Timer<Document>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_executeScriptSoonTimer);
+
+    Vector<pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > scripts;
+    scripts.swap(m_scriptsToExecuteSoon);
+    size_t size = scripts.size();
+    for (size_t i = 0; i < size; ++i) {
+        scripts[i].first->execute(scripts[i].second.get());
+        scripts[i].first->element()->deref(); // Balances ref() in executeScriptSoon().
+    }
+}
+
+void Document::executeScriptSoon(ScriptElementData* data, CachedResourceHandle<CachedScript> cachedScript)
+{
+    ASSERT_ARG(data, data);
+
+    Element* element = data->element();
+    ASSERT(element);
+    ASSERT(element->document() == this);
+    ASSERT(element->inDocument());
+
+    m_scriptsToExecuteSoon.append(make_pair(data, cachedScript));
+    element->ref(); // Balanced by deref()s in executeScriptSoonTimerFired() and ~Document().
+    if (!m_executeScriptSoonTimer.isActive())
+        m_executeScriptSoonTimer.startOneShot(0);
+}
+
 // FF method for accessing the selection added for compatability.
 DOMSelection* Document::getSelection() const
 {
@@ -4205,7 +4237,7 @@ DatabaseThread* Document::databaseThread()
     if (!m_databaseThread && !m_hasOpenDatabases) {
         // Create the database thread on first request - but not if at least one database was already opened,
         // because in that case we already had a database thread and terminated it and should not create another.
-        m_databaseThread = DatabaseThread::create(this);
+        m_databaseThread = DatabaseThread::create();
         if (!m_databaseThread->start())
             m_databaseThread = 0;
     }
@@ -4237,6 +4269,14 @@ void Document::resetWMLPageState()
     if (WMLPageState* pageState = wmlPageStateForDocument(this))
         pageState->reset();
 }
+
+void Document::initializeWMLPageState()
+{
+    if (!isWMLDocument())
+        return;
+
+    static_cast<WMLDocument*>(this)->initialize();
+}
 #endif
 
 void Document::attachRange(Range* range)
@@ -4293,26 +4333,42 @@ void Document::parseDNSPrefetchControlHeader(const String& dnsPrefetchControl)
     m_haveExplicitlyDisabledDNSPrefetch = true;
 }
 
-void Document::addTimeout(int timeoutId, DOMTimer* timer)
+void Document::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
 {
-    ASSERT(!m_timeouts.contains(timeoutId));
-    m_timeouts.set(timeoutId, timer);
+    if (DOMWindow* window = domWindow())
+        window->console()->addMessage(JSMessageSource, ErrorMessageLevel, errorMessage, lineNumber, sourceURL);
 }
 
-void Document::removeTimeout(int timeoutId)
+void Document::addMessage(MessageDestination destination, MessageSource source, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
-    m_timeouts.remove(timeoutId);
+    switch (destination) {
+    case InspectorControllerDestination:
+        if (page())
+            page()->inspectorController()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
+        return;
+    case ConsoleDestination:
+        if (DOMWindow* window = domWindow())
+            window->console()->addMessage(source, level, message, lineNumber, sourceURL);
+        return;
+    }
+    ASSERT_NOT_REACHED();
 }
 
-DOMTimer* Document::findTimeout(int timeoutId)
+void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
-    return m_timeouts.get(timeoutId);
+    if (page())
+        page()->inspectorController()->resourceRetrievedByXMLHttpRequest(identifier, sourceString);
+    Frame* frame = this->frame();
+    if (frame) {
+        FrameLoader* frameLoader = frame->loader();
+        frameLoader->didLoadResourceByXMLHttpRequest(identifier, sourceString);
+    }
 }
 
-void Document::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
+void Document::scriptImported(unsigned long identifier, const String& sourceString)
 {
-    if (DOMWindow* window = domWindow())
-        window->console()->addMessage(JSMessageSource, ErrorMessageLevel, errorMessage, lineNumber, sourceURL);
+    if (page())
+        page()->inspectorController()->scriptImported(identifier, sourceString);
 }
 
 class ScriptExecutionContextTaskTimer : public TimerBase {
@@ -4385,4 +4441,36 @@ Element* Document::findAnchor(const String& name)
     return 0;
 }
 
+String Document::displayStringModifiedByEncoding(const String& str) const
+{
+    if (m_decoder)
+        return m_decoder->encoding().displayString(str.impl());
+    return str;
+}
+
+PassRefPtr<StringImpl> Document::displayStringModifiedByEncoding(PassRefPtr<StringImpl> str) const
+{
+    if (m_decoder)
+        return m_decoder->encoding().displayString(str);
+    return str;
+}
+
+void Document::displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const
+{
+    if (m_decoder)
+        m_decoder->encoding().displayBuffer(buffer, len);
+}
+
+#if ENABLE(XHTMLMP)
+bool Document::isXHTMLMPDocument() const
+{
+    if (!frame() || !frame()->loader())
+        return false;
+    // As per section 7.2 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, a conforming user agent
+    // MUST accept XHTMLMP document identified as "application/vnd.wap.xhtml+xml"
+    // and SHOULD accept it identified as "application/xhtml+xml"
+    return frame()->loader()->responseMIMEType() == "application/vnd.wap.xhtml+xml" || frame()->loader()->responseMIMEType() == "application/xhtml+xml";
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 2fdc8608aa..2747d09662 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -3,8 +3,8 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,16 +26,16 @@
 #ifndef Document_h
 #define Document_h
 
-#include "Attr.h"
+#include "CachedResourceHandle.h"
+#include "CheckedRadioButtons.h"
+#include "ContainerNode.h"
+#include "CollectionCache.h"
+#include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
-#include "HTMLCollection.h"
-#include "HTMLFormElement.h"
 #include "ScriptExecutionContext.h"
-#include "StringHash.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
-#include <wtf/ListHashSet.h>
 
 // FIXME: We should move Mac off of the old Frame-based user stylesheet loading
 // code and onto the new code in Page. We can't do that until the code in Page
@@ -48,11 +48,11 @@
 
 namespace WebCore {
 
-    class AXObjectCache;
     class Attr;
-    class Attribute;
+    class AXObjectCache;
     class CDATASection;
     class CachedCSSStyleSheet;
+    class CachedScript;
     class CanvasRenderingContext2D;
     class CharacterData;
     class CSSStyleDeclaration;
@@ -62,7 +62,6 @@ namespace WebCore {
     class Database;
     class DOMImplementation;
     class DOMSelection;
-    class DOMTimer;
     class DOMWindow;
     class DatabaseThread;
     class DocLoader;
@@ -75,15 +74,15 @@ namespace WebCore {
     class EventListener;
     class Frame;
     class FrameView;
+    class HitTestRequest;
     class HTMLCanvasElement;
+    class HTMLCollection;
     class HTMLDocument;
     class HTMLElement;
-    class HTMLFormControlElementWithState;
     class HTMLFormElement;
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
-    class ImageLoader;
     class IntPoint;
     class JSNode;
     class MouseEventWithHitTestResults;
@@ -95,7 +94,10 @@ namespace WebCore {
     class Range;
     class RegisteredEventListener;
     class RenderArena;
+    class RenderView;
+    class ScriptElementData;
     class SecurityOrigin;
+    class SegmentedString;
     class Settings;
     class StyleSheet;
     class StyleSheetList;
@@ -123,7 +125,6 @@ namespace WebCore {
 #if ENABLE(DASHBOARD_SUPPORT)
     struct DashboardRegionValue;
 #endif
-    struct HitTestRequest;
 
     typedef int ExceptionCode;
 
@@ -214,30 +215,39 @@ public:
 
     DOMImplementation* implementation() const;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    Element* documentElement() const;
+    
+    Element* documentElement() const
+    {
+        if (!m_documentElement)
+            cacheDocumentElement();
+        return m_documentElement.get();
+    }
+    
     virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
     PassRefPtr<DocumentFragment> createDocumentFragment ();
     PassRefPtr<Text> createTextNode(const String& data);
     PassRefPtr<Comment> createComment(const String& data);
     PassRefPtr<CDATASection> createCDATASection(const String& data, ExceptionCode&);
     PassRefPtr<ProcessingInstruction> createProcessingInstruction(const String& target, const String& data, ExceptionCode&);
-    PassRefPtr<Attr> createAttribute(const String& name, ExceptionCode& ec) { return createAttributeNS(String(), name, ec, true); }
+    PassRefPtr<Attr> createAttribute(const String& name, ExceptionCode&);
     PassRefPtr<Attr> createAttributeNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&, bool shouldIgnoreNamespaceChecks = false);
     PassRefPtr<EntityReference> createEntityReference(const String& name, ExceptionCode&);
     PassRefPtr<Node> importNode(Node* importedNode, bool deep, ExceptionCode&);
     virtual PassRefPtr<Element> createElementNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&);
-    PassRefPtr<Element> createElement(const QualifiedName&, bool createdByParser, ExceptionCode& ec);
+    PassRefPtr<Element> createElement(const QualifiedName&, bool createdByParser);
     Element* getElementById(const AtomicString&) const;
     bool hasElementWithId(AtomicStringImpl* id) const;
     bool containsMultipleElementsWithId(const AtomicString& elementId) { return m_duplicateIds.contains(elementId.impl()); }
 
     Element* elementFromPoint(int x, int y) const;
     String readyState() const;
-    String inputEncoding() const;
-    String defaultCharset() const;
 
-    String charset() const { return inputEncoding(); }
-    String characterSet() const { return inputEncoding(); }
+    String defaultCharset() const;
+    
+    // Synonyms backing similar DOM attributes. Use Document::encoding() to avoid virtual dispatch.
+    String inputEncoding() const { return Document::encoding(); }
+    String charset() const { return Document::encoding(); }
+    String characterSet() const { return Document::encoding(); }
 
     void setCharset(const String&);
 
@@ -279,15 +289,15 @@ public:
     // quirks mode for historical compatibility reasons.
     Element* findAnchor(const String& name);
 
-    HTMLCollection::CollectionInfo* collectionInfo(HTMLCollection::Type type)
+    CollectionCache* collectionInfo(CollectionType type)
     {
-        ASSERT(type >= HTMLCollection::FirstUnnamedDocumentCachedType);
-        unsigned index = type - HTMLCollection::FirstUnnamedDocumentCachedType;
-        ASSERT(index < HTMLCollection::NumUnnamedDocumentCachedTypes);
+        ASSERT(type >= FirstUnnamedDocumentCachedType);
+        unsigned index = type - FirstUnnamedDocumentCachedType;
+        ASSERT(index < NumUnnamedDocumentCachedTypes);
         return &m_collectionInfo[index]; 
     }
 
-    HTMLCollection::CollectionInfo* nameCollectionInfo(HTMLCollection::Type, const AtomicString& name);
+    CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
     // DOM methods overridden from  parent classes
 
@@ -299,12 +309,20 @@ public:
     virtual bool isImageDocument() const { return false; }
 #if ENABLE(SVG)
     virtual bool isSVGDocument() const { return false; }
+#else
+    static bool isSVGDocument() { return false; }
 #endif
     virtual bool isPluginDocument() const { return false; }
     virtual bool isMediaDocument() const { return false; }
 #if ENABLE(WML)
     virtual bool isWMLDocument() const { return false; }
 #endif
+#if ENABLE(XHTMLMP)
+    bool isXHTMLMPDocument() const; 
+    bool shouldProcessNoscriptElement() const { return m_shouldProcessNoScriptElement; }
+    void setShouldProcessNoscriptElement(bool shouldDo) { m_shouldProcessNoScriptElement = shouldDo; }
+#endif
+    virtual bool isFrameSet() const { return false; }
     
     CSSStyleSelector* styleSelector() const { return m_styleSelector; }
 
@@ -321,11 +339,7 @@ public:
      */
     bool haveStylesheetsLoaded() const
     {
-        return m_pendingStylesheets <= 0 || m_ignorePendingStylesheets
-#if USE(LOW_BANDWIDTH_DISPLAY)
-            || m_inLowBandwidthDisplay
-#endif
-            ;
+        return m_pendingStylesheets <= 0 || m_ignorePendingStylesheets;
     }
 
     /**
@@ -361,10 +375,12 @@ public:
     void setUsesFirstLineRules(bool b) { m_usesFirstLineRules = b; }
     bool usesFirstLetterRules() const { return m_usesFirstLetterRules; }
     void setUsesFirstLetterRules(bool b) { m_usesFirstLetterRules = b; }
+    bool usesBeforeAfterRules() const { return m_usesBeforeAfterRules; }
+    void setUsesBeforeAfterRules(bool b) { m_usesBeforeAfterRules = b; }
 
     // Machinery for saving and restoring state when you leave and then go back to a page.
-    void registerFormElementWithState(HTMLFormControlElementWithState* e) { m_formElementsWithState.add(e); }
-    void unregisterFormElementWithState(HTMLFormControlElementWithState* e) { m_formElementsWithState.remove(e); }
+    void registerFormElementWithState(Element* e) { m_formElementsWithState.add(e); }
+    void unregisterFormElementWithState(Element* e) { m_formElementsWithState.remove(e); }
     Vector<String> formElementsState() const;
     void setStateForNewFormElements(const Vector<String>&);
     bool hasStateForNewFormElements() const;
@@ -388,19 +404,19 @@ public:
     PassRefPtr<EditingText> createEditingTextNode(const String&);
 
     virtual void recalcStyle( StyleChange = NoChange );
-    virtual void updateRendering();
+    virtual void updateStyleIfNeeded();
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
-    static void updateDocumentsRendering();
+    static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
     DocLoader* docLoader() { return m_docLoader; }
 
     virtual void attach();
     virtual void detach();
 
-    void clearFramePointer();
-
     RenderArena* renderArena() { return m_renderArena; }
 
+    RenderView* renderView() const;
+
     void clearAXObjectCache();
     AXObjectCache* axObjectCache() const;
     
@@ -413,6 +429,7 @@ public:
     void implicitClose();
     void cancelParsing();
 
+    void write(const SegmentedString& text, Document* ownerDocument = 0);
     void write(const String& text, Document* ownerDocument = 0);
     void writeln(const String& text, Document* ownerDocument = 0);
     void finishParsing();
@@ -433,6 +450,8 @@ public:
 
     KURL completeURL(const String&) const;
 
+    virtual String userAgent(const KURL&) const;
+
     // from cachedObjectClient
     virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
 
@@ -502,6 +521,8 @@ public:
     bool setFocusedNode(PassRefPtr<Node>);
     Node* focusedNode() const { return m_focusedNode.get(); }
 
+    void getFocusableNodes(Vector<RefPtr<Node> >&);
+    
     // The m_ignoreAutofocus flag specifies whether or not the document has been changed by the user enough 
     // for WebCore to ignore the autofocus attribute on any form controls
     bool ignoreAutofocus() const { return m_ignoreAutofocus; };
@@ -519,10 +540,12 @@ public:
     void activeChainNodeDetached(Node*);
 
     // Updates for :target (CSS3 selector).
-    void setCSSTarget(Node*);
-    Node* getCSSTarget() const;
+    void setCSSTarget(Element*);
+    Element* cssTarget() const { return m_cssTarget; }
     
-    void setDocumentChanged(bool);
+    void scheduleStyleRecalc();
+    void unscheduleStyleRecalc();
+    void styleRecalcTimerFired(Timer<Document>*);
 
     void attachNodeIterator(NodeIterator*);
     void detachNodeIterator(NodeIterator*);
@@ -541,6 +564,12 @@ public:
     DOMWindow* defaultView() const { return domWindow(); } 
     DOMWindow* domWindow() const;
 
+    // Helper functions for forwarding DOMWindow event related tasks to the DOMWindow if it exists.
+    void setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+    void dispatchWindowEvent(PassRefPtr<Event>);
+    void dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg);
+    void dispatchLoadEvent();
+
     PassRefPtr<Event> createEvent(const String& eventType, ExceptionCode&);
 
     // keep track of what types of event listeners are registered, so we don't
@@ -566,24 +595,6 @@ public:
 
     CSSStyleDeclaration* getOverrideStyle(Element*, const String& pseudoElt);
 
-    void handleWindowEvent(Event*, bool useCapture);
-    void setWindowInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-    EventListener* windowInlineEventListenerForType(const AtomicString& eventType);
-    void removeWindowInlineEventListenerForType(const AtomicString& eventType);
-
-    void setWindowInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute*);
-
-    void addWindowEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    void removeWindowEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    bool hasWindowEventListener(const AtomicString& eventType);
-    
-    void addPendingFrameUnloadEventCount();
-    void removePendingFrameUnloadEventCount();
-    void addPendingFrameBeforeUnloadEventCount();
-    void removePendingFrameBeforeUnloadEventCount();
-
-    PassRefPtr<EventListener> createEventListener(const String& functionName, const String& code, Node*);
-
     /**
      * Searches through the document, starting from fromNode, for the next selectable element that comes after fromNode.
      * The order followed is as specified in section 17.11.1 of the HTML4 spec, which is elements with tab indexes
@@ -624,10 +635,6 @@ public:
      */
     void processHttpEquiv(const String& equiv, const String& content);
     
-    void dispatchImageLoadEventSoon(ImageLoader*);
-    void dispatchImageLoadEventsNow();
-    void removeImage(ImageLoader*);
-    
     // Returns the owning element in the parent document.
     // Returns 0 if this is the top level document.
     Element* ownerElement() const;
@@ -648,8 +655,8 @@ public:
 
     const KURL& cookieURL() const { return m_cookieURL; }
 
-    const KURL& policyBaseURL() const { return m_policyBaseURL; }
-    void setPolicyBaseURL(const KURL& url) { m_policyBaseURL = url; }
+    const KURL& firstPartyForCookies() const { return m_firstPartyForCookies; }
+    void setFirstPartyForCookies(const KURL& url) { m_firstPartyForCookies = url; }
     
     // The following implements the rule from HTML 4 for what valid names are.
     // To get this right for all the XML cases, we probably have to improve this or move it
@@ -671,7 +678,7 @@ public:
     void removeImageMap(HTMLMapElement*);
     HTMLMapElement* getImageMap(const String& url) const;
 
-    HTMLElement* body();
+    HTMLElement* body() const;
     void setBody(PassRefPtr<HTMLElement>, ExceptionCode&);
 
     HTMLHeadElement* head();
@@ -694,6 +701,8 @@ public:
     void setRenderedRectForMarker(Node*, DocumentMarker, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
     void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    void setMarkersActive(Range*, bool);
+    void setMarkersActive(Node*, unsigned startOffset, unsigned endOffset, bool);
 
     DocumentMarker* markerContainingPoint(const IntPoint&, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     Vector<DocumentMarker> markersForNode(Node*);
@@ -710,6 +719,8 @@ public:
 
     int docID() const { return m_docID; }
 
+    void executeScriptSoon(ScriptElementData*, CachedResourceHandle<CachedScript>);
+
 #if ENABLE(XSLT)
     void applyXSLTransform(ProcessingInstruction* pi);
     void setTransformSource(void* doc);
@@ -755,13 +766,7 @@ public:
 
     void setUseSecureKeyboardEntryWhenActive(bool);
     bool useSecureKeyboardEntryWhenActive() const;
-    
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    void setDocLoader(DocLoader* loader) { m_docLoader = loader; }
-    bool inLowBandwidthDisplay() const { return m_inLowBandwidthDisplay; }
-    void setLowBandwidthDisplay(bool lowBandWidth) { m_inLowBandwidthDisplay = lowBandWidth; }
-#endif
-    
+
     void addNodeListCache() { ++m_numNodeListCaches; }
     void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
     bool hasNodeListCaches() const { return m_numNodeListCaches; }
@@ -781,12 +786,11 @@ public:
     void parseDNSPrefetchControlHeader(const String&);
 
     virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
+    virtual void addMessage(MessageDestination, MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
+    virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+    virtual void scriptImported(unsigned long, const String&);
     virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
-    void addTimeout(int timeoutId, DOMTimer*);
-    void removeTimeout(int timeoutId);
-    DOMTimer* findTimeout(int timeoutId);
-    
 protected:
     Document(Frame*, bool isXHTML);
 
@@ -797,6 +801,10 @@ private:
     virtual const KURL& virtualURL() const; // Same as url(), but needed for ScriptExecutionContext to implement it without a performance loss for direct calls.
     virtual KURL virtualCompleteURL(const String&) const; // Same as completeURL() for the same reason as above.
 
+    String encoding() const;
+
+    void executeScriptSoonTimerFired(Timer<Document>*);
+
     CSSStyleSelector* m_styleSelector;
     bool m_didCalculateStyleSelector;
 
@@ -810,7 +818,7 @@ private:
     KURL m_baseURL;  // Node.baseURI: The URL to use when resolving relative URLs.
     KURL m_baseElementURL;  // The URL set by the <base> element.
     KURL m_cookieURL;  // The URL to use for cookie access.
-    KURL m_policyBaseURL;  // The policy URL for third-party cookie blocking.
+    KURL m_firstPartyForCookies; // The policy URL for third-party cookie blocking.
 
     // Document.documentURI:
     // Although URL-like, Document.documentURI can actually be set to any
@@ -872,10 +880,8 @@ private:
     RefPtr<StyleSheetList> m_styleSheets; // All of the stylesheets that are currently in effect for our media type and stylesheet set.
     ListHashSet<Node*> m_styleSheetCandidateNodes; // All of the nodes that could potentially provide stylesheets to the document (<link>, <style>, <?xml-stylesheet>)
 
-    RegisteredEventListenerVector m_windowEventListeners;
-
     typedef HashMap<FormElementKey, Vector<String>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
-    ListHashSet<HTMLFormControlElementWithState*> m_formElementsWithState;
+    ListHashSet<Element*> m_formElementsWithState;
     FormElementStateMap m_stateForNewFormElements;
     
     Color m_linkColor;
@@ -888,13 +894,14 @@ private:
     bool m_loadingSheet;
     bool visuallyOrdered;
     bool m_bParsing;
-    bool m_docChanged;
+    Timer<Document> m_styleRecalcTimer;
     bool m_inStyleRecalc;
     bool m_closeAfterStyleRecalc;
     bool m_usesDescendantRules;
     bool m_usesSiblingRules;
     bool m_usesFirstLineRules;
     bool m_usesFirstLetterRules;
+    bool m_usesBeforeAfterRules;
     bool m_gotoAnchorNeededAfterStylesheetsLoad;
     bool m_isDNSPrefetchEnabled;
     bool m_haveExplicitlyDisabledDNSPrefetch;
@@ -912,17 +919,16 @@ private:
 
     mutable AXObjectCache* m_axObjectCache;
     
-    Vector<ImageLoader*> m_imageLoadEventDispatchSoonList;
-    Vector<ImageLoader*> m_imageLoadEventDispatchingList;
-    Timer<Document> m_imageLoadEventTimer;
-
     Timer<Document> m_updateFocusAppearanceTimer;
 
-    Node* m_cssTarget;
+    Element* m_cssTarget;
     
     bool m_processingLoadEvent;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
+
+    Vector<std::pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > m_scriptsToExecuteSoon;
+    Timer<Document> m_executeScriptSoonTimer;
     
 #if ENABLE(XSLT)
     void* m_transformSource;
@@ -946,8 +952,12 @@ private:
 
     String m_contentLanguage;
 
+#if ENABLE(XHTMLMP)
+    bool m_shouldProcessNoScriptElement;
+#endif
+
 public:
-    bool inPageCache();
+    bool inPageCache() const { return m_inPageCache; }
     void setInPageCache(bool flag);
     
     // Elements can register themselves for the "documentWillBecomeInactive()" and  
@@ -967,7 +977,9 @@ public:
     void setDecoder(PassRefPtr<TextResourceDecoder>);
     TextResourceDecoder* decoder() const { return m_decoder.get(); }
 
-    UChar backslashAsCurrencySymbol() const;
+    String displayStringModifiedByEncoding(const String&) const;
+    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
+    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
 
     // Quirk for the benefit of Apple's Dictionary application.
     void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
@@ -982,12 +994,12 @@ public:
     void setDashboardRegions(const Vector<DashboardRegionValue>&);
 #endif
 
-    void removeAllEventListenersFromAllNodes();
+    void removeAllEventListeners();
 
     void registerDisconnectedNodeWithEventListeners(Node*);
     void unregisterDisconnectedNodeWithEventListeners(Node*);
     
-    HTMLFormElement::CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
+    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
     
 #if ENABLE(SVG)
     const SVGDocumentExtensions* svgExtensions();
@@ -1017,6 +1029,7 @@ public:
 
 #if ENABLE(WML)
     void resetWMLPageState();
+    void initializeWMLPageState();
 #endif
 
 protected:
@@ -1025,10 +1038,11 @@ protected:
 private:
     void updateTitle();
     void removeAllDisconnectedNodeEventListeners();
-    void imageLoadEventTimerFired(Timer<Document>*);
     void updateFocusAppearanceTimerFired(Timer<Document>*);
     void updateBaseURL();
 
+    void cacheDocumentElement() const;
+
     RenderObject* m_savedRenderer;
     int m_secureForms;
     
@@ -1046,11 +1060,11 @@ private:
     
     int m_selfOnlyRefCount;
 
-    HTMLFormElement::CheckedRadioButtons m_checkedRadioButtons;
+    CheckedRadioButtons m_checkedRadioButtons;
 
-    typedef HashMap<AtomicStringImpl*, HTMLCollection::CollectionInfo*> NamedCollectionMap;
-    HTMLCollection::CollectionInfo m_collectionInfo[HTMLCollection::NumUnnamedDocumentCachedTypes];
-    NamedCollectionMap m_nameCollectionInfo[HTMLCollection::NumNamedDocumentCachedTypes];
+    typedef HashMap<AtomicStringImpl*, CollectionCache*> NamedCollectionMap;
+    CollectionCache m_collectionInfo[NumUnnamedDocumentCachedTypes];
+    NamedCollectionMap m_nameCollectionInfo[NumNamedDocumentCachedTypes];
 
 #if ENABLE(XPATH)
     RefPtr<XPathEvaluator> m_xpathEvaluator;
@@ -1096,13 +1110,6 @@ private:
 #endif
     
     bool m_usingGeolocation;
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    bool m_inLowBandwidthDisplay;
-#endif
-
-    typedef HashMap<int, DOMTimer*> TimeoutsMap;
-    TimeoutsMap m_timeouts;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index dfdfe461a4..232ceb4231 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -28,11 +28,11 @@ module core {
         InlineGetOwnPropertySlot,
         InterfaceUUID=48BB95FC-2D08-4c54-BE65-7558736A4CAE,
         ImplementationUUID=FF5CBE81-F817-429c-A6C2-0CCCD2328062
-    ] Document : EventTargetNode {
+    ] Document : Node {
 
         // DOM Level 1 Core
         readonly attribute DocumentType doctype;
-        readonly attribute DOMImplementation implementation;
+        readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
         [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
@@ -81,7 +81,7 @@ module core {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString documentURI;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Events (DocumentEvents interface)
 
         Event              createEvent(in DOMString eventType)
@@ -116,17 +116,17 @@ module core {
 
         [OldStyleObjC] CSSStyleDeclaration getOverrideStyle(in Element element,
                                                             in DOMString pseudoElement);
-#if ENABLE_XPATH
+#if defined(ENABLE_XPATH) && ENABLE_XPATH
         // DOM Level 3 XPath (XPathEvaluator interface)
         [OldStyleObjC] XPathExpression createExpression(in DOMString expression,
                                                         in XPathNSResolver resolver)
             raises(DOMException);
         XPathNSResolver    createNSResolver(in Node nodeResolver);
-        [OldStyleObjC] XPathResult evaluate(in DOMString expression,
-                                            in Node contextNode,
-                                            in XPathNSResolver resolver,
-                                            in unsigned short type,
-                                            in XPathResult inResult)
+        [OldStyleObjC, V8Custom] XPathResult evaluate(in DOMString expression,
+                                                      in Node contextNode,
+                                                      in XPathNSResolver resolver,
+                                                      in unsigned short type,
+                                                      in XPathResult inResult)
             raises(DOMException);
 #endif // ENABLE_XPATH
 #endif // !defined(LANGUAGE_COM)
@@ -137,7 +137,7 @@ module core {
                                        in boolean userInterface,
                                        in [ConvertUndefinedOrNullToNullString] DOMString value);
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // FIXME: remove the these two versions once [Optional] is implemented for Objective-C.
         boolean            execCommand(in DOMString command,
                                        in boolean userInterface);
@@ -154,7 +154,7 @@ module core {
 
                  attribute [ConvertNullToNullString] DOMString title;
         readonly attribute DOMString referrer;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString domain;
 #else
         readonly attribute DOMString domain;
@@ -180,7 +180,7 @@ module core {
 
         NodeList getElementsByName(in DOMString elementName);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [Custom] Location location;
 #endif
 
@@ -193,7 +193,7 @@ module core {
         Element            elementFromPoint(in long x, in long y);
 
         // Mozilla extensions
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         DOMSelection       getSelection();
 #endif
         readonly attribute [ConvertNullStringTo=Null] DOMString characterSet;
@@ -203,13 +203,13 @@ module core {
         readonly attribute [ConvertNullStringTo=Null] DOMString preferredStylesheetSet;
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectedStylesheetSet;
 
-#if !defined(LANGUAGE_COM)
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         CSSStyleDeclaration createCSSStyleDeclaration();
 #endif
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // DOM Level 2 Style Interface
         [OldStyleObjC, UsesView] CSSStyleDeclaration getComputedStyle(in Element element,
                                                                       in DOMString pseudoElement);
@@ -224,9 +224,9 @@ module core {
                                                   
 #endif
 
-#if !defined(LANGUAGE_COM)
-#if !defined(LANGUAGE_OBJECTIVE_C)
-        DOMObject getCSSCanvasContext(in DOMString contextId, in DOMString name, in long width, in long height);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+        [V8Custom] DOMObject getCSSCanvasContext(in DOMString contextId, in DOMString name, in long width, in long height);
 #endif
 #endif
 
@@ -234,14 +234,15 @@ module core {
         NodeList getElementsByClassName(in DOMString tagname);
 
         // NodeSelector - Selector API
-        Element querySelector(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        Element querySelector(in DOMString selectors)
             raises(DOMException);
-        NodeList querySelectorAll(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
-#if ENABLE_WML
+#if defined(ENABLE_WML) && ENABLE_WML
         // Only used from within WML layout tests, WML doesn't have JS support at all.
         void resetWMLPageState();
+        void initializeWMLPageState();
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
index 2cdcdf8c1b..ff6232f415 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
@@ -23,12 +23,11 @@ module core {
         GenerateConstructor,
         InterfaceUUID=F5C8DAF0-D728-4b2b-9D9C-630621B07D35,
         ImplementationUUID=E57BF71F-3FAA-495c-A307-E288F8E5B2EC
-    ] DocumentFragment : EventTargetNode {
+    ] DocumentFragment : Node {
         // NodeSelector - Selector API
-        // FIXME: add support for NSResolver in languages other than JS
-        Element querySelector(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        Element querySelector(in DOMString selectors)
             raises(DOMException);
-        NodeList querySelectorAll(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h b/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h
index 2ba9b47e51..8945eb0a8d 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h
@@ -30,19 +30,23 @@ namespace WebCore {
 
 // A range of a node within a document that is "marked", such as the range of a misspelled word.
 // It optionally includes a description that could be displayed in the user interface.
+// It also optionally includes a flag specifying whether the match is active, which is ignored
+// for all types other than type TextMatch.
 struct DocumentMarker {
 
     enum MarkerType {
         AllMarkers  = -1,
         Spelling,
         Grammar,
-        TextMatch
+        TextMatch,
+        Replacement
     };
 
     MarkerType type;
     unsigned startOffset;
     unsigned endOffset;
     String description;
+    bool activeMatch;
 
     bool operator==(const DocumentMarker& o) const
     {
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 5faeea2f0c..4cf49bb4ac 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -4,7 +4,7 @@
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ -27,8 +27,11 @@
 #include "Element.h"
 
 #include "AXObjectCache.h"
+#include "Attr.h"
 #include "CSSStyleSelector.h"
 #include "CString.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "Document.h"
 #include "Editor.h"
 #include "ElementRareData.h"
@@ -38,7 +41,7 @@
 #include "FrameView.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
@@ -48,6 +51,10 @@
 #include "TextIterator.h"
 #include "XMLNames.h"
 
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -78,30 +85,35 @@ inline ElementRareData* Element::ensureRareData()
     
 NodeRareData* Element::createRareData()
 {
-    return new ElementRareData(this);
+    return new ElementRareData;
 }
     
 PassRefPtr<Node> Element::cloneNode(bool deep)
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> clone = document()->createElementNS(namespaceURI(), nodeName(), ec);
-    ASSERT(!ec);
-    
-    // clone attributes
-    if (namedAttrMap)
-        clone->attributes()->setAttributes(*namedAttrMap);
-
-    clone->copyNonAttributeProperties(this);
-    
-    if (deep)
-        cloneChildNodes(clone.get());
+    return deep ? cloneElementWithChildren() : cloneElementWithoutChildren();
+}
 
+PassRefPtr<Element> Element::cloneElementWithChildren()
+{
+    RefPtr<Element> clone = cloneElementWithoutChildren();
+    cloneChildNodes(clone.get());
     return clone.release();
 }
 
-PassRefPtr<Element> Element::cloneElement()
+PassRefPtr<Element> Element::cloneElementWithoutChildren()
 {
-    return static_pointer_cast<Element>(cloneNode(false));
+    RefPtr<Element> clone = document()->createElement(tagQName(), false);
+    // This will catch HTML elements in the wrong namespace that are not correctly copied.
+    // This is a sanity check as HTML overloads some of the DOM methods.
+    ASSERT(isHTMLElement() == clone->isHTMLElement());
+
+    // Clone attributes.
+    if (namedAttrMap)
+        clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
+
+    clone->copyNonAttributeProperties(this);
+    
+    return clone.release();
 }
 
 void Element::removeAttribute(const QualifiedName& name, ExceptionCode& ec)
@@ -130,12 +142,12 @@ void Element::setBooleanAttribute(const QualifiedName& name, bool b)
 }
 
 // Virtual function, defined in base class.
-NamedAttrMap* Element::attributes() const
+NamedNodeMap* Element::attributes() const
 {
     return attributes(false);
 }
 
-NamedAttrMap* Element::attributes(bool readonly) const
+NamedNodeMap* Element::attributes(bool readonly) const
 {
     if (!m_isStyleAttributeValid)
         updateStyleAttribute();
@@ -189,9 +201,9 @@ void Element::scrollIntoView(bool alignToTop)
     if (renderer()) {
         // Align to the top / bottom and to the closest edge.
         if (alignToTop)
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignTopAlways);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
         else
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignBottomAlways);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignBottomAlways);
     }
 }
 
@@ -201,9 +213,9 @@ void Element::scrollIntoViewIfNeeded(bool centerIfNeeded)
     IntRect bounds = getRect();    
     if (renderer()) {
         if (centerIfNeeded)
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignCenterIfNeeded, RenderLayer::gAlignCenterIfNeeded);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignCenterIfNeeded, ScrollAlignment::alignCenterIfNeeded);
         else
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignToEdgeIfNeeded);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignToEdgeIfNeeded);
     }
 }
 
@@ -217,7 +229,7 @@ void Element::scrollByUnits(int units, ScrollGranularity granularity)
                 direction = ScrollUp;
                 units = -units;
             }
-            rend->layer()->scroll(direction, granularity, units);
+            toRenderBox(rend)->layer()->scroll(direction, granularity, units);
         }
     }
 }
@@ -258,23 +270,54 @@ static float localZoomForRenderer(RenderObject* renderer)
 static int adjustForLocalZoom(int value, RenderObject* renderer)
 {
     float zoomFactor = localZoomForRenderer(renderer);
-    if (zoomFactor == 1.0f)
+    if (zoomFactor == 1)
         return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
     return static_cast<int>(value / zoomFactor);
 }
 
 static int adjustForAbsoluteZoom(int value, RenderObject* renderer)
 {
     float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1.0f)
+    if (zoomFactor == 1)
         return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
     return static_cast<int>(value / zoomFactor);
 }
 
+static FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
+{
+    // The result here is in floats, so we don't need the truncation hack from the integer version above.
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return point;
+    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
+}
+
+static void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
+{
+    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
+    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
+    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
+    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
+}
+
+static void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
+{
+    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
+    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
+    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
+    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
+}
+
 int Element::offsetLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForLocalZoom(rend->offsetLeft(), rend);
     return 0;
 }
@@ -282,7 +325,7 @@ int Element::offsetLeft()
 int Element::offsetTop()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForLocalZoom(rend->offsetTop(), rend);
     return 0;
 }
@@ -290,7 +333,7 @@ int Element::offsetTop()
 int Element::offsetWidth()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForAbsoluteZoom(rend->offsetWidth(), rend);
     return 0;
 }
@@ -298,7 +341,7 @@ int Element::offsetWidth()
 int Element::offsetHeight()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForAbsoluteZoom(rend->offsetHeight(), rend);
     return 0;
 }
@@ -308,7 +351,7 @@ Element* Element::offsetParent()
     document()->updateLayoutIgnorePendingStylesheets();
     if (RenderObject* rend = renderer())
         if (RenderObject* offsetParent = rend->offsetParent())
-            return static_cast<Element*>(offsetParent->element());
+            return static_cast<Element*>(offsetParent->node());
     return 0;
 }
 
@@ -316,7 +359,7 @@ int Element::clientLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientLeft(), rend);
     return 0;
 }
@@ -325,7 +368,7 @@ int Element::clientTop()
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientTop(), rend);
     return 0;
 }
@@ -340,11 +383,10 @@ int Element::clientWidth()
     if ((!inCompatMode && document()->documentElement() == this) ||
         (inCompatMode && isHTMLElement() && document()->body() == this)) {
         if (FrameView* view = document()->view())
-            return view->layoutWidth();
+            return adjustForAbsoluteZoom(view->layoutWidth(), document()->renderer());
     }
     
-
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientWidth(), rend);
     return 0;
 }
@@ -360,26 +402,26 @@ int Element::clientHeight()
     if ((!inCompatMode && document()->documentElement() == this) ||
         (inCompatMode && isHTMLElement() && document()->body() == this)) {
         if (FrameView* view = document()->view())
-            return view->layoutHeight();
+            return adjustForAbsoluteZoom(view->layoutHeight(), document()->renderer());
     }
     
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientHeight(), rend);
     return 0;
 }
 
-int Element::scrollLeft()
+int Element::scrollLeft() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollLeft(), rend);
     return 0;
 }
 
-int Element::scrollTop()
+int Element::scrollTop() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollTop(), rend);
     return 0;
 }
@@ -387,33 +429,85 @@ int Element::scrollTop()
 void Element::setScrollLeft(int newLeft)
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         rend->setScrollLeft(static_cast<int>(newLeft * rend->style()->effectiveZoom()));
 }
 
 void Element::setScrollTop(int newTop)
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         rend->setScrollTop(static_cast<int>(newTop * rend->style()->effectiveZoom()));
 }
 
-int Element::scrollWidth()
+int Element::scrollWidth() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollWidth(), rend);
     return 0;
 }
 
-int Element::scrollHeight()
+int Element::scrollHeight() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollHeight(), rend);
     return 0;
 }
 
+PassRefPtr<ClientRectList> Element::getClientRects() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+
+    RenderBoxModelObject* renderBoxModelObject = this->renderBoxModelObject();
+    if (!renderBoxModelObject)
+        return ClientRectList::create();
+
+    // FIXME: Handle SVG elements.
+    // FIXME: Handle table/inline-table with a caption.
+
+    Vector<FloatQuad> quads;
+    renderBoxModelObject->absoluteQuads(quads);
+
+    if (FrameView* view = document()->view()) {
+        IntRect visibleContentRect = view->visibleContentRect();
+        for (size_t i = 0; i < quads.size(); ++i) {
+            quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
+            adjustFloatQuadForAbsoluteZoom(quads[i], renderBoxModelObject);
+        }
+    }
+
+    return ClientRectList::create(quads);
+}
+
+PassRefPtr<ClientRect> Element::getBoundingClientRect() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+    RenderBoxModelObject* renderBoxModelObject = this->renderBoxModelObject();
+    if (!renderBoxModelObject)
+        return ClientRect::create();
+
+    Vector<FloatQuad> quads;
+    renderBoxModelObject->absoluteQuads(quads);
+
+    if (quads.isEmpty())
+        return ClientRect::create();
+
+    IntRect result = quads[0].enclosingBoundingBox();
+    for (size_t i = 1; i < quads.size(); ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    if (FrameView* view = document()->view()) {
+        IntRect visibleContentRect = view->visibleContentRect();
+        result.move(-visibleContentRect.x(), -visibleContentRect.y());
+    }
+
+    adjustIntRectForAbsoluteZoom(result, renderBoxModelObject);
+
+    return ClientRect::create(result);
+}
+
 static inline bool shouldIgnoreAttributeCase(const Element* e)
 {
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
@@ -496,20 +590,20 @@ PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const
 
 void Element::attributeChanged(Attribute* attr, bool)
 {
+    if (!document()->axObjectCache()->accessibilityEnabled())
+        return;
+
     const QualifiedName& attrName = attr->name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        if (document()->axObjectCache()->accessibilityEnabled())
-            document()->axObjectCache()->handleActiveDescendantChanged(renderer());
-    }
-    if (attrName == roleAttr) {
+        document()->axObjectCache()->handleActiveDescendantChanged(renderer());
+    } else if (attrName == roleAttr) {
         // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        if (document()->axObjectCache()->accessibilityEnabled())
-            document()->axObjectCache()->handleAriaRoleChanged(renderer());
+        document()->axObjectCache()->handleAriaRoleChanged(renderer());
     }
 }
 
-void Element::setAttributeMap(PassRefPtr<NamedAttrMap> list)
+void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
 {
     document()->incDOMTreeVersion();
 
@@ -587,7 +681,7 @@ KURL Element::baseURI() const
 
 void Element::createAttributeMap() const
 {
-    namedAttrMap = NamedAttrMap::create(const_cast<Element*>(this));
+    namedAttrMap = NamedNodeMap::create(const_cast<Element*>(this));
 }
 
 bool Element::isURLAttribute(Attribute*) const
@@ -620,7 +714,7 @@ void Element::insertedIntoDocument()
     ContainerNode::insertedIntoDocument();
 
     if (hasID()) {
-        if (NamedAttrMap* attrs = namedAttrMap.get()) {
+        if (NamedNodeMap* attrs = namedAttrMap.get()) {
             Attribute* idItem = attrs->getAttributeItem(idAttr);
             if (idItem && !idItem->isNull())
                 updateId(nullAtom, idItem->value());
@@ -631,7 +725,7 @@ void Element::insertedIntoDocument()
 void Element::removedFromDocument()
 {
     if (hasID()) {
-        if (NamedAttrMap* attrs = namedAttrMap.get()) {
+        if (NamedNodeMap* attrs = namedAttrMap.get()) {
             Attribute* idItem = attrs->getAttributeItem(idAttr);
             if (idItem && !idItem->isNull())
                 updateId(idItem->value(), nullAtom);
@@ -643,6 +737,8 @@ void Element::removedFromDocument()
 
 void Element::attach()
 {
+    suspendPostAttachCallbacks();
+
     createRendererIfNeeded();
     ContainerNode::attach();
     if (hasRareData()) {   
@@ -653,13 +749,15 @@ void Element::attach()
             data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
         }
     }
+
+    resumePostAttachCallbacks();
 }
 
 void Element::detach()
 {
     cancelFocusAppearanceUpdate();
     if (hasRareData())
-        rareData()->resetComputedStyle(this);
+        rareData()->resetComputedStyle();
     ContainerNode::detach();
 }
 
@@ -667,7 +765,7 @@ void Element::recalcStyle(StyleChange change)
 {
     RenderStyle* currentStyle = renderStyle();
     bool hasParentStyle = parentNode() ? parentNode()->renderStyle() : false;
-    bool hasPositionalRules = changed() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
+    bool hasPositionalRules = needsStyleRecalc() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
 
 #if ENABLE(SVG)
@@ -675,11 +773,11 @@ void Element::recalcStyle(StyleChange change)
         hasParentStyle = true;
 #endif
 
-    if ((change > NoChange || changed())) {
+    if ((change > NoChange || needsStyleRecalc())) {
         if (hasRareData())
-            rareData()->resetComputedStyle(this);
+            rareData()->resetComputedStyle();
     }
-    if (hasParentStyle && (change >= Inherit || changed())) {
+    if (hasParentStyle && (change >= Inherit || needsStyleRecalc())) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(this);
         StyleChange ch = diff(currentStyle, newStyle.get());
         if (ch == Detach || !currentStyle) {
@@ -687,8 +785,8 @@ void Element::recalcStyle(StyleChange change)
                 detach();
             attach(); // FIXME: The style gets computed twice by calling attach. We could do better if we passed the style along.
             // attach recalulates the style for all children. No need to do it twice.
-            setChanged(NoStyleChange);
-            setHasChangedChild(false);
+            setNeedsStyleRecalc(NoStyleChange);
+            setChildNeedsStyleRecalc(false);
             return;
         }
 
@@ -715,7 +813,7 @@ void Element::recalcStyle(StyleChange change)
 
         if (ch != NoChange) {
             setRenderStyle(newStyle);
-        } else if (changed() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
+        } else if (needsStyleRecalc() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
             // fooled into believing this style is the same.  This is only necessary if the document actually uses
             // sibling/descendant rules, since otherwise it isn't possible for ancestor styles to affect sharing of
@@ -740,17 +838,17 @@ void Element::recalcStyle(StyleChange change)
     // without doing way too much re-resolution.
     bool forceCheckOfNextElementSibling = false;
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
-        bool childRulesChanged = n->changed() && n->styleChangeType() == FullStyleChange;
+        bool childRulesChanged = n->needsStyleRecalc() && n->styleChangeType() == FullStyleChange;
         if (forceCheckOfNextElementSibling && n->isElementNode())
-            n->setChanged();
-        if (change >= Inherit || n->isTextNode() || n->hasChangedChild() || n->changed())
+            n->setNeedsStyleRecalc();
+        if (change >= Inherit || n->isTextNode() || n->childNeedsStyleRecalc() || n->needsStyleRecalc())
             n->recalcStyle(change);
         if (n->isElementNode())
             forceCheckOfNextElementSibling = childRulesChanged && hasDirectAdjacentRules;
     }
 
-    setChanged(NoStyleChange);
-    setHasChangedChild(false);
+    setNeedsStyleRecalc(NoStyleChange);
+    setChildNeedsStyleRecalc(false);
 }
 
 bool Element::childTypeAllowed(NodeType type)
@@ -772,7 +870,7 @@ bool Element::childTypeAllowed(NodeType type)
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    if (!style || (e->changed() && style->childrenAffectedByPositionalRules()))
+    if (!style || (e->needsStyleRecalc() && style->childrenAffectedByPositionalRules()))
         return;
 
     // :first-child.  In the parser callback case, we don't have to check anything, since we were right the first time.
@@ -792,11 +890,11 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
         // This is the insert/append case.
         if (newFirstChild != firstElementAfterInsertion && firstElementAfterInsertion && firstElementAfterInsertion->attached() &&
             firstElementAfterInsertion->renderStyle() && firstElementAfterInsertion->renderStyle()->firstChildState())
-            firstElementAfterInsertion->setChanged();
+            firstElementAfterInsertion->setNeedsStyleRecalc();
             
         // We also have to handle node removal.
         if (childCountDelta < 0 && newFirstChild == firstElementAfterInsertion && newFirstChild && newFirstChild->renderStyle() && !newFirstChild->renderStyle()->firstChildState())
-            newFirstChild->setChanged();
+            newFirstChild->setNeedsStyleRecalc();
     }
 
     // :last-child.  In the parser callback case, we don't have to check anything, since we were right the first time.
@@ -814,12 +912,12 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
         
         if (newLastChild != lastElementBeforeInsertion && lastElementBeforeInsertion && lastElementBeforeInsertion->attached() &&
             lastElementBeforeInsertion->renderStyle() && lastElementBeforeInsertion->renderStyle()->lastChildState())
-            lastElementBeforeInsertion->setChanged();
+            lastElementBeforeInsertion->setNeedsStyleRecalc();
             
         // We also have to handle node removal.  The parser callback case is similar to node removal as well in that we need to change the last child
         // to match now.
         if ((childCountDelta < 0 || finishedParsingCallback) && newLastChild == lastElementBeforeInsertion && newLastChild && newLastChild->renderStyle() && !newLastChild->renderStyle()->lastChildState())
-            newLastChild->setChanged();
+            newLastChild->setNeedsStyleRecalc();
     }
 
     // The + selector.  We need to invalidate the first element following the insertion point.  It is the only possible element
@@ -830,7 +928,7 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
              firstElementAfterInsertion && !firstElementAfterInsertion->isElementNode();
              firstElementAfterInsertion = firstElementAfterInsertion->nextSibling()) {};
         if (firstElementAfterInsertion && firstElementAfterInsertion->attached())
-            firstElementAfterInsertion->setChanged();
+            firstElementAfterInsertion->setNeedsStyleRecalc();
     }
 
     // Forward positional selectors include the ~ selector, nth-child, nth-of-type, first-of-type and only-of-type.
@@ -842,11 +940,11 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
     // here.  recalcStyle will then force a walk of the children when it sees that this has happened.
     if ((style->childrenAffectedByForwardPositionalRules() && afterChange) ||
         (style->childrenAffectedByBackwardPositionalRules() && beforeChange))
-        e->setChanged();
+        e->setNeedsStyleRecalc();
     
     // :empty selector.
     if (style->affectedByEmpty() && (!style->emptyState() || e->hasChildNodes()))
-        e->setChanged();
+        e->setNeedsStyleRecalc();
 }
 
 void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -891,7 +989,7 @@ String Element::openTagStartToString() const
 {
     String result = "<" + nodeName();
 
-    NamedAttrMap *attrMap = attributes(true);
+    NamedNodeMap* attrMap = attributes(true);
 
     if (attrMap) {
         unsigned numAttrs = attrMap->length();
@@ -991,7 +1089,7 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
         return 0;
     }
 
-    NamedAttrMap *attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
 
@@ -1026,7 +1124,7 @@ void Element::removeAttributeNS(const String& namespaceURI, const String& localN
 
 PassRefPtr<Attr> Element::getAttributeNode(const String& name)
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
@@ -1035,7 +1133,7 @@ PassRefPtr<Attr> Element::getAttributeNode(const String& name)
 
 PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const String& localName)
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
     return static_pointer_cast<Attr>(attrs->getNamedItem(QualifiedName(nullAtom, localName, namespaceURI)));
@@ -1043,7 +1141,7 @@ PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const S
 
 bool Element::hasAttribute(const String& name) const
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return false;
 
@@ -1055,7 +1153,7 @@ bool Element::hasAttribute(const String& name) const
 
 bool Element::hasAttributeNS(const String& namespaceURI, const String& localName) const
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return false;
     return attrs->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
@@ -1097,14 +1195,19 @@ void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
             return;
 
         // FIXME: We should restore the previous selection if there is one.
-        Selection newSelection = hasTagName(htmlTag) || hasTagName(bodyTag) ? Selection(Position(this, 0), DOWNSTREAM) : Selection::selectionFromContentsOfNode(this);
+        VisibleSelection newSelection = hasTagName(htmlTag) || hasTagName(bodyTag) ? VisibleSelection(Position(this, 0), DOWNSTREAM) : VisibleSelection::selectionFromContentsOfNode(this);
         
         if (frame->shouldChangeSelection(newSelection)) {
             frame->selection()->setSelection(newSelection);
             frame->revealSelection();
         }
-    } else if (renderer() && !renderer()->isWidget())
+    }
+    // FIXME: I'm not sure all devices will want this off, but this is
+    // currently turned off for Andriod.
+#if !ENABLE(DIRECTIONAL_PAD_NAVIGATION)
+    else if (renderer() && !renderer()->isWidget())
         renderer()->enclosingLayer()->scrollRectToVisible(getRect());
+#endif
 }
 
 void Element::blur()
@@ -1184,7 +1287,7 @@ void Element::cancelFocusAppearanceUpdate()
 void Element::normalizeAttributes()
 {
     // Normalize attributes.
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return;
     unsigned numAttrs = attrs->length();
@@ -1238,4 +1341,4 @@ unsigned Element::childElementCount() const
     return count;
 }
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index b48424f127..5e95abdcc8 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -34,6 +34,8 @@ namespace WebCore {
 class Attr;
 class Attribute;
 class CSSStyleDeclaration;
+class ClientRect;
+class ClientRectList;
 class ElementRareData;
 class IntSize;
 
@@ -75,12 +77,15 @@ public:
     int clientTop();
     int clientWidth();
     int clientHeight();
-    int scrollLeft();
-    int scrollTop();
-    void setScrollLeft(int);
-    void setScrollTop(int);
-    int scrollWidth();
-    int scrollHeight();
+    virtual int scrollLeft() const;
+    virtual int scrollTop() const;
+    virtual void setScrollLeft(int);
+    virtual void setScrollTop(int);
+    virtual int scrollWidth() const;
+    virtual int scrollHeight() const;
+
+    PassRefPtr<ClientRectList> getClientRects() const;
+    PassRefPtr<ClientRect> getBoundingClientRect() const;
 
     void removeAttribute(const String& name, ExceptionCode&);
     void removeAttributeNS(const String& namespaceURI, const String& localName, ExceptionCode&);
@@ -110,33 +115,29 @@ public:
 
     // DOM methods overridden from parent classes
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual String nodeName() const;
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    PassRefPtr<Element> cloneElement();
+    PassRefPtr<Element> cloneElementWithChildren();
+    PassRefPtr<Element> cloneElementWithoutChildren();
 
     void normalizeAttributes();
-
-    virtual bool isInputTypeHidden() const { return false; }
-    virtual bool isPasswordField() const { return false; }
-
     String nodeNamePreservingCase() const;
 
     // convenience methods which ignore exceptions
     void setAttribute(const QualifiedName&, const AtomicString& value);
     void setBooleanAttribute(const QualifiedName& name, bool);
 
-    virtual NamedAttrMap* attributes() const;
-    NamedAttrMap* attributes(bool readonly) const;
+    virtual NamedNodeMap* attributes() const;
+    NamedNodeMap* attributes(bool readonly) const;
 
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
     // not part of the DOM
-    void setAttributeMap(PassRefPtr<NamedAttrMap>);
+    void setAttributeMap(PassRefPtr<NamedNodeMap>);
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
 
@@ -198,6 +199,23 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
+    // FormControlElement API
+    virtual bool isFormControlElement() const { return false; }
+    virtual bool isEnabledFormControl() const { return true; }
+    virtual bool isReadOnlyFormControl() const { return false; }
+    virtual bool isTextFormControl() const { return false; }
+
+    virtual bool formControlValueMatchesRenderer() const { return false; }
+    virtual void setFormControlValueMatchesRenderer(bool) { }
+
+    virtual const AtomicString& formControlName() const { return nullAtom; }
+    virtual const AtomicString& formControlType() const { return nullAtom; }
+
+    virtual bool saveFormControlState(String&) const { return false; }
+    virtual void restoreFormControlState(const String&) { }
+
+    virtual void dispatchFormControlChangeEvent() { }
+
 private:
     virtual void createAttributeMap() const;
 
@@ -214,6 +232,10 @@ private:
     virtual const AtomicString& virtualLocalName() const { return localName(); }
     virtual const AtomicString& virtualNamespaceURI() const { return namespaceURI(); }
     
+    // cloneNode is private so that non-virtual cloneElementWithChildren and cloneElementWithoutChildren
+    // are used instead.
+    virtual PassRefPtr<Node> cloneNode(bool deep);
+
     QualifiedName m_tagName;
     virtual NodeRareData* createRareData();
 
@@ -221,7 +243,7 @@ protected:
     ElementRareData* rareData() const;
     ElementRareData* ensureRareData();
     
-    mutable RefPtr<NamedAttrMap> namedAttrMap;
+    mutable RefPtr<NamedNodeMap> namedAttrMap;
 };
     
 inline bool Node::hasTagName(const QualifiedName& name) const
@@ -234,7 +256,7 @@ inline bool Node::hasAttributes() const
     return isElementNode() && static_cast<const Element*>(this)->hasAttributes();
 }
 
-inline NamedAttrMap* Node::attributes() const
+inline NamedNodeMap* Node::attributes() const
 {
     return isElementNode() ? static_cast<const Element*>(this)->attributes() : 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.idl b/src/3rdparty/webkit/WebCore/dom/Element.idl
index ae2c1b8f9d..6e16bfe3ca 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Element.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,7 +26,7 @@ module core {
         InlineGetOwnPropertySlot,
         InterfaceUUID=FEFE9C21-E58C-4b5b-821A-61A514613763,
         ImplementationUUID=12E5B08E-A680-4baf-9D1E-108AEF7ABBFB
-    ] Element : EventTargetNode {
+    ] Element : Node {
 
         // DOM Level 1 Core
 
@@ -66,7 +66,7 @@ module core {
         [OldStyleObjC] boolean hasAttributeNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                               in DOMString localName);
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
 #endif
 
@@ -104,13 +104,13 @@ module core {
         NodeList getElementsByClassName(in DOMString name);
 
         // NodeSelector - Selector API
-        Element querySelector(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        Element querySelector(in DOMString selectors)
             raises(DOMException);
-        NodeList querySelectorAll(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // ElementTraversal API
-#if !defined(LANGUAGE_COM)
         readonly attribute Element firstElementChild;
         readonly attribute Element lastElementChild;
         readonly attribute Element previousElementSibling;
@@ -118,7 +118,13 @@ module core {
         readonly attribute unsigned long childElementCount;
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        // CSSOM View Module API
+        ClientRectList getClientRects();
+        ClientRect getBoundingClientRect();
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extensions
         readonly attribute DOMString innerText;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
index 096f8468da..94e0499974 100644
--- a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
@@ -1,6 +1,5 @@
-/**
- *
- * Copyright (C) 2008 Apple Computer, Inc.
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 David Smith <catfish.man@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -30,9 +29,9 @@ namespace WebCore {
 
 class ElementRareData : public NodeRareData {
 public:
-    ElementRareData(Element*);
+    ElementRareData();
 
-    void resetComputedStyle(Element*);
+    void resetComputedStyle();
 
     using NodeRareData::needsFocusAppearanceUpdateSoonAfterAttach;
     using NodeRareData::setNeedsFocusAppearanceUpdateSoonAfterAttach;
@@ -46,12 +45,12 @@ inline IntSize defaultMinimumSizeForResizing()
     return IntSize(INT_MAX, INT_MAX);
 }
 
-inline ElementRareData::ElementRareData(Element* e)
+inline ElementRareData::ElementRareData()
     : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
 {
 }
 
-inline void ElementRareData::resetComputedStyle(Element* element)
+inline void ElementRareData::resetComputedStyle()
 {
     m_computedStyle.clear();
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index 67ae49254c..b4b87edbcc 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -24,7 +24,7 @@
 #include "Event.h"
 
 #include "AtomicString.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
@@ -35,8 +35,8 @@ Event::Event()
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
-    , m_currentTarget(0)
     , m_eventPhase(0)
+    , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
 {
 }
@@ -49,8 +49,8 @@ Event::Event(const AtomicString& eventType, bool canBubbleArg, bool cancelableAr
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
-    , m_currentTarget(0)
     , m_eventPhase(0)
+    , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index a30dd3920e..69842153c8 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -157,8 +157,8 @@ namespace WebCore {
         bool m_defaultHandled;
         bool m_cancelBubble;
 
-        EventTarget* m_currentTarget;
         unsigned short m_eventPhase;
+        EventTarget* m_currentTarget;
         RefPtr<EventTarget> m_target;
         DOMTimeStamp m_createTime;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.idl b/src/3rdparty/webkit/WebCore/dom/Event.idl
index 99b0bd1c79..5ac9e0c112 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Event.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -24,7 +24,7 @@ module events {
     interface [
         GenerateConstructor,
         NoStaticTables,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=D17495FA-ACAD-4d27-9362-E19E057B189D,
         ImplementationUUID=CFDCDDB2-5B3F-412d-BDA4-80B23C721549
     ] Event {
@@ -34,7 +34,7 @@ module events {
         const unsigned short AT_TARGET           = 2;
         const unsigned short BUBBLING_PHASE      = 3;
 
-#if !defined(LANGUAGE_OBJECTIVE_C)
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // Reverse-engineered from Netscape
         const unsigned short MOUSEDOWN           = 1;
         const unsigned short MOUSEUP             = 2;
@@ -60,7 +60,7 @@ module events {
         readonly attribute unsigned short   eventPhase;
         readonly attribute boolean          bubbles;
         readonly attribute boolean          cancelable;
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute DOMTimeStamp     timeStamp;
 #endif
         void               stopPropagation();
@@ -74,7 +74,7 @@ module events {
                  attribute boolean          returnValue;
                  attribute boolean          cancelBubble;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute [Custom] Clipboard        clipboardData;
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventException.idl b/src/3rdparty/webkit/WebCore/dom/EventException.idl
index 61cfd65d85..3d82f851a8 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventException.idl
@@ -30,14 +30,15 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor
+        GenerateConstructor,
+        NoStaticTables
     ] EventException {
 
         readonly attribute unsigned short   code;
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.h b/src/3rdparty/webkit/WebCore/dom/EventListener.h
index 24fce862ea..dbc41b2252 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,6 +23,10 @@
 
 #include <wtf/RefCounted.h>
 
+namespace JSC {
+    class JSObject;
+}
+
 namespace WebCore {
 
     class Event;
@@ -31,10 +35,23 @@ namespace WebCore {
     public:
         virtual ~EventListener() { }
         virtual void handleEvent(Event*, bool isWindowEvent = false) = 0;
-        virtual bool isInline() const { return false; }
         virtual bool wasCreatedFromMarkup() const { return false; }
+
+#if USE(JSC)
+        virtual JSC::JSObject* jsFunction() const { return 0; }
+        virtual void markJSFunction() { }
+#endif
+
+        bool isAttribute() const { return virtualisAttribute(); }
+
+    private:
+        virtual bool virtualisAttribute() const { return false; }
     };
 
+#if USE(JSC)
+    inline void markIfNotNull(EventListener* listener) { if (listener) listener->markJSFunction(); }
+#endif
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.idl b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
index 9d28703438..9dc2e0af33 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
@@ -22,6 +22,7 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
+        NoStaticTables,
         ObjCProtocol,
         InterfaceUUID=B04F2AE3-71E2-4ebe-ABFE-EF4938354082,
         ImplementationUUID=DDFDD342-A78B-4f19-8F32-A5DF51B56E08
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 35c7571bde..9272ba4a09 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -68,6 +68,7 @@ namespace WebCore {
     macro(mouseup) \
     macro(mousewheel) \
     macro(noupdate) \
+    macro(obsolete) \
     macro(offline) \
     macro(online) \
     macro(overflowchanged) \
@@ -101,24 +102,26 @@ namespace WebCore {
     macro(webkitBeforeTextInserted) \
     macro(webkitEditableContentChanged) \
     \
-    macro(canshowcurrentframe) \
     macro(canplay) \
     macro(canplaythrough) \
-    macro(dataunavailable) \
     macro(durationchange) \
     macro(emptied) \
     macro(ended) \
-    macro(loadedfirstframe) \
+    macro(loadeddata) \
     macro(loadedmetadata) \
     macro(pause) \
     macro(play) \
+    macro(playing) \
     macro(ratechange) \
+    macro(seeked) \
+    macro(seeking) \
     macro(timeupdate) \
     macro(volumechange) \
     macro(waiting) \
     \
     macro(progress) \
     macro(stalled) \
+    macro(suspend) \
     \
     macro(webkitAnimationEnd) \
     macro(webkitAnimationStart) \
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index dcebd64307..06cea07fc1 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -44,7 +44,12 @@ EventTarget::~EventTarget()
 {
 }
 
-EventTargetNode* EventTarget::toNode()
+Node* EventTarget::toNode()
+{
+    return 0;
+}
+
+DOMWindow* EventTarget::toDOMWindow()
 {
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 3a3ec847a3..662902e45f 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -38,12 +38,13 @@ namespace WebCore {
 
     class AtomicString;
     class DOMApplicationCache;
+    class DOMWindow;
     class Event;
     class EventListener;
-    class EventTargetNode;
     class MessagePort;
-    class ScriptExecutionContext;
+    class Node;
     class SVGElementInstance;
+    class ScriptExecutionContext;
     class Worker;
     class WorkerContext;
     class XMLHttpRequest;
@@ -54,7 +55,8 @@ namespace WebCore {
     class EventTarget {
     public:
         virtual MessagePort* toMessagePort();
-        virtual EventTargetNode* toNode();
+        virtual Node* toNode();
+        virtual DOMWindow* toDOMWindow();
         virtual XMLHttpRequest* toXMLHttpRequest();
         virtual XMLHttpRequestUpload* toXMLHttpRequestUpload();
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
index d3f46f7dff..844dc32a9c 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
@@ -26,13 +26,13 @@ module events {
         PureInterface,
         InterfaceUUID=1D71C7EC-0BA0-4044-BDFD-56B3E8F5F9D4
     ] EventTarget {
-        [OldStyleObjC, EventTargetNodeCast] void addEventListener(in DOMString type, 
+        [OldStyleObjC] void addEventListener(in DOMString type, 
                                              in EventListener listener, 
                                              in boolean useCapture);
-        [OldStyleObjC, EventTargetNodeCast] void removeEventListener(in DOMString type, 
+        [OldStyleObjC] void removeEventListener(in DOMString type, 
                                                 in EventListener listener, 
                                                 in boolean useCapture);
-        [EventTargetNodeCast] boolean dispatchEvent(in Event event)
+        boolean dispatchEvent(in Event event)
             raises(EventException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.cpp b/src/3rdparty/webkit/WebCore/dom/EventTargetNode.cpp
deleted file mode 100644
index 8553da7c06..0000000000
--- a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.cpp
+++ /dev/null
@@ -1,1166 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "EventTargetNode.h"
-
-#include "Document.h"
-#include "EventException.h"
-#include "EventHandler.h"
-#include "EventListener.h"
-#include "EventNames.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "KeyboardEvent.h"
-#include "MouseEvent.h"
-#include "MutationEvent.h"
-#include "NodeRareData.h"
-#include "Page.h"
-#include "PlatformMouseEvent.h"
-#include "PlatformWheelEvent.h"
-#include "ProgressEvent.h"
-#include "RegisteredEventListener.h"
-#include "ScriptController.h"
-#include "TextEvent.h"
-#include "WebKitAnimationEvent.h"
-#include "WebKitTransitionEvent.h"
-#include "WheelEvent.h"
-#include <wtf/HashSet.h>
-
-#if ENABLE(DOM_STORAGE)
-#include "StorageEvent.h"
-#endif
-
-#if ENABLE(SVG)
-#include "SVGElementInstance.h"
-#include "SVGUseElement.h"
-#endif
-
-namespace WebCore {
-    
-static HashSet<EventTargetNode*>* gNodesDispatchingSimulatedClicks = 0; 
-
-EventTargetNode::EventTargetNode(Document* doc, bool isElement, bool isContainer)
-    : Node(doc, isElement, isContainer)
-{
-}
-
-EventTargetNode::~EventTargetNode()
-{
-    if (!eventListeners().isEmpty() && !inDocument())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-}
-
-ScriptExecutionContext* EventTargetNode::scriptExecutionContext() const
-{
-    return document();
-}
-
-const RegisteredEventListenerVector& EventTargetNode::eventListeners() const
-{
-    if (hasRareData()) {
-        if (RegisteredEventListenerVector* listeners = rareData()->listeners())
-            return *listeners;
-    }
-    static const RegisteredEventListenerVector* emptyListenersVector = new RegisteredEventListenerVector;
-    return *emptyListenersVector;
-}
-
-void EventTargetNode::insertedIntoDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-    Node::insertedIntoDocument();
-}
-
-void EventTargetNode::removedFromDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
-    Node::removedFromDocument();
-}
-
-void EventTargetNode::willMoveToNewOwnerDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-    Node::willMoveToNewOwnerDocument();
-}
-
-void EventTargetNode::didMoveToNewOwnerDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
-    Node::didMoveToNewOwnerDocument();
-}
-
-static inline void updateSVGElementInstancesAfterEventListenerChange(EventTargetNode* referenceNode)
-{
-    ASSERT(referenceNode);
-
-#if ENABLE(SVG)
-    if (!referenceNode->isSVGElement())
-        return;
-
-    // Elements living inside a <use> shadow tree, never cause any updates!
-    if (referenceNode->shadowTreeRootNode())
-        return;
-
-    // We're possibly (a child of) an element that is referenced by a <use> client
-    // If an event listeners changes on a referenced element, update all instances.
-    for (Node* node = referenceNode; node; node = node->parentNode()) {
-        if (!node->hasID() || !node->isSVGElement())
-            continue;
-
-        SVGElementInstance::invalidateAllInstancesOfElement(static_cast<SVGElement*>(node));
-        break;
-    }
-#endif
-}
-
-void EventTargetNode::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    Document* document = this->document();
-    if (!document->attached())
-        return;
-
-    document->addListenerTypeIfNeeded(eventType);
-
-    RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
-
-    // Remove existing identical listener set with identical arguments.
-    // The DOM2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
-
-    // adding the first one
-    if (listeners.isEmpty() && !inDocument())
-        document->registerDisconnectedNodeWithEventListeners(this);
-
-    listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
-    updateSVGElementInstancesAfterEventListenerChange(this);
-}
-
-void EventTargetNode::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            r.setRemoved(true);
-            listeners->remove(i);
-
-            // removed last
-            if (listeners->isEmpty() && !inDocument())
-                document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-            updateSVGElementInstancesAfterEventListenerChange(this);
-            return;
-        }
-    }
-}
-
-void EventTargetNode::removeAllEventListeners()
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i)
-        listeners->at(i)->setRemoved(true);
-    listeners->clear();
-}
-
-void EventTargetNode::handleLocalEvents(Event* event, bool useCapture)
-{
-    if (disabled() && event->isMouseEvent())
-        return;
-
-    RegisteredEventListenerVector listenersCopy = eventListeners();
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, false);
-    }
-}
-
-#if ENABLE(SVG)
-static inline SVGElementInstance* eventTargetAsSVGElementInstance(EventTargetNode* referenceNode)
-{
-    ASSERT(referenceNode);
-    if (!referenceNode->isSVGElement())
-        return 0;
-
-    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
-    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
-    for (Node* n = referenceNode; n; n = n->parentNode()) {
-        if (!n->isShadowNode() || !n->isSVGElement())
-            continue;
-
-        Node* shadowTreeParentElement = n->shadowParentNode();
-        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
-
-        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
-            return instance;
-    }
-
-    return 0;
-}
-#endif
-
-static inline EventTarget* eventTargetRespectingSVGTargetRules(EventTargetNode* referenceNode)
-{
-    ASSERT(referenceNode);
-
-#if ENABLE(SVG)
-    if (SVGElementInstance* instance = eventTargetAsSVGElementInstance(referenceNode)) {
-        ASSERT(instance->shadowTreeElement() == referenceNode);
-        return instance;
-    }
-#endif
-
-    return referenceNode;
-}
-
-bool EventTargetNode::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
-{
-    RefPtr<Event> evt(e);
-    ASSERT(!eventDispatchForbidden());
-    if (!evt || evt->type().isEmpty()) { 
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return false;
-    }
-
-    evt->setTarget(eventTargetRespectingSVGTargetRules(this));
-
-    RefPtr<FrameView> view = document()->view();
-    return dispatchGenericEvent(evt.release(), ec);
-}
-
-bool EventTargetNode::dispatchGenericEvent(PassRefPtr<Event> prpEvent, ExceptionCode& ec)
-{
-    RefPtr<Event> event(prpEvent);
-
-    ASSERT(!eventDispatchForbidden());
-    ASSERT(event->target());
-    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
-
-    // Make a vector of ancestors to send the event to.
-    // If the node is not in a document just send the event to it.
-    // Be sure to ref all of nodes since event handlers could result in the last reference going away.
-    RefPtr<EventTargetNode> thisNode(this);
-    Vector<RefPtr<ContainerNode> > ancestors;
-    if (inDocument()) {
-        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
-#if ENABLE(SVG)
-            // Skip <use> shadow tree elements.
-            if (ancestor->isSVGElement() && ancestor->isShadowNode())
-                continue;
-#endif
-            ancestors.append(ancestor);
-        }
-    }
-
-    // Set up a pointer to indicate whether to dispatch window events.
-    // We don't dispatch load events to the window. That quirk was originally
-    // added because Mozilla doesn't propagate load events to the window object.
-    Document* documentForWindowEvents = 0;
-    if (event->type() != eventNames().loadEvent) {
-        EventTargetNode* topLevelContainer = ancestors.isEmpty() ? this : ancestors.last().get();
-        if (topLevelContainer->isDocumentNode())
-            documentForWindowEvents = static_cast<Document*>(topLevelContainer);
-    }
-
-    // Give the target node a chance to do some work before DOM event handlers get a crack.
-    void* data = preDispatchEventHandler(event.get());
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    // Trigger capturing event handlers, starting at the top and working our way down.
-    event->setEventPhase(Event::CAPTURING_PHASE);
-
-    if (documentForWindowEvents) {
-        event->setCurrentTarget(documentForWindowEvents);
-        documentForWindowEvents->handleWindowEvent(event.get(), true);
-        if (event->propagationStopped())
-            goto doneDispatching;
-    }
-    for (size_t i = ancestors.size(); i; --i) {
-        ContainerNode* ancestor = ancestors[i - 1].get();
-        event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-        ancestor->handleLocalEvents(event.get(), true);
-        if (event->propagationStopped())
-            goto doneDispatching;
-    }
-
-    event->setEventPhase(Event::AT_TARGET);
-
-    // We do want capturing event listeners to be invoked here, even though
-    // that violates some versions of the DOM specification; Mozilla does it.
-    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
-    handleLocalEvents(event.get(), true);
-    if (event->propagationStopped())
-        goto doneDispatching;
-    handleLocalEvents(event.get(), false);
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    if (event->bubbles() && !event->cancelBubble()) {
-        // Trigger bubbling event handlers, starting at the bottom and working our way up.
-        event->setEventPhase(Event::BUBBLING_PHASE);
-
-        size_t size = ancestors.size();
-        for (size_t i = 0; i < size; ++i) {
-            ContainerNode* ancestor = ancestors[i].get();
-            event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-            ancestor->handleLocalEvents(event.get(), false);
-            if (event->propagationStopped() || event->cancelBubble())
-                goto doneDispatching;
-        }
-        if (documentForWindowEvents) {
-            event->setCurrentTarget(documentForWindowEvents);
-            documentForWindowEvents->handleWindowEvent(event.get(), false);
-            if (event->propagationStopped() || event->cancelBubble())
-                goto doneDispatching;
-        }
-    }
-
-doneDispatching:
-    event->setCurrentTarget(0);
-    event->setEventPhase(0);
-
-    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
-    postDispatchEventHandler(event.get(), data);
-
-    // Call default event handlers. While the DOM does have a concept of preventing
-    // default handling, the detail of which handlers are called is an internal
-    // implementation detail and not part of the DOM.
-    if (!event->defaultPrevented() && !event->defaultHandled()) {
-        // Non-bubbling events call only one default event handler, the one for the target.
-        defaultEventHandler(event.get());
-        ASSERT(!event->defaultPrevented());
-        if (event->defaultHandled())
-            goto doneWithDefault;
-        // For bubbling events, call default event handlers on the same targets in the
-        // same order as the bubbling phase.
-        if (event->bubbles()) {
-            size_t size = ancestors.size();
-            for (size_t i = 0; i < size; ++i) {
-                ContainerNode* ancestor = ancestors[i].get();
-                ancestor->defaultEventHandler(event.get());
-                ASSERT(!event->defaultPrevented());
-                if (event->defaultHandled())
-                    goto doneWithDefault;
-            }
-        }
-    }
-
-doneWithDefault:
-    Document::updateDocumentsRendering();
-
-    return !event->defaultPrevented();
-}
-
-bool EventTargetNode::dispatchSubtreeModifiedEvent()
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    document()->incDOMTreeVersion();
-
-    notifyNodeListsAttributeChanged(); // FIXME: Can do better some day. Really only care about the name attribute changing.
-    
-    if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
-        return false;
-    ExceptionCode ec = 0;
-    return dispatchEvent(MutationEvent::create(eventNames().DOMSubtreeModifiedEvent, true, false, 0, String(), String(), String(), 0), ec);
-}
-
-void EventTargetNode::dispatchWindowEvent(PassRefPtr<Event> e)
-{
-    ASSERT(!eventDispatchForbidden());
-    RefPtr<Event> evt(e);
-    RefPtr<Document> doc = document();
-    evt->setTarget(doc);
-    doc->handleWindowEvent(evt.get(), true);
-    doc->handleWindowEvent(evt.get(), false);
-}
-
-void EventTargetNode::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    RefPtr<Document> doc = document();
-    dispatchWindowEvent(Event::create(eventType, canBubbleArg, cancelableArg));
-    
-    if (eventType == eventNames().loadEvent) {
-        // For onload events, send a separate load event to the enclosing frame only.
-        // This is a DOM extension and is independent of bubbling/capturing rules of
-        // the DOM.
-        Element* ownerElement = doc->ownerElement();
-        if (ownerElement) {
-            RefPtr<Event> ownerEvent = Event::create(eventType, false, cancelableArg);
-            ownerEvent->setTarget(ownerElement);
-            ExceptionCode ec = 0;
-            ownerElement->dispatchGenericEvent(ownerEvent.release(), ec);
-        }
-    }
-}
-
-bool EventTargetNode::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-    ASSERT(eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
-    
-    bool cancelable = eventType == eventNames().DOMActivateEvent;
-    
-    ExceptionCode ec = 0;
-    RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
-    evt->setUnderlyingEvent(underlyingEvent);
-    return dispatchEvent(evt.release(), ec);
-}
-
-bool EventTargetNode::dispatchKeyEvent(const PlatformKeyboardEvent& key)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
-    bool r = dispatchEvent(keyboardEvent, ec);
-    
-    // we want to return false if default is prevented (already taken care of)
-    // or if the element is default-handled by the DOM. Otherwise we let it just
-    // let it get handled by AppKit 
-    if (keyboardEvent->defaultHandled())
-        r = false;
-    
-    return r;
-}
-
-bool EventTargetNode::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType,
-    int detail, Node* relatedTarget)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    IntPoint contentsPos;
-    if (FrameView* view = document()->view())
-        contentsPos = view->windowToContents(event.pos());
-
-    short button = event.button();
-
-    ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
-    
-    return dispatchMouseEvent(eventType, button, detail,
-        contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
-        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
-        false, relatedTarget);
-}
-
-void EventTargetNode::dispatchSimulatedMouseEvent(const AtomicString& eventType,
-    PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    bool ctrlKey = false;
-    bool altKey = false;
-    bool shiftKey = false;
-    bool metaKey = false;
-    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
-        ctrlKey = keyStateEvent->ctrlKey();
-        altKey = keyStateEvent->altKey();
-        shiftKey = keyStateEvent->shiftKey();
-        metaKey = keyStateEvent->metaKey();
-    }
-
-    // Like Gecko, we just pass 0 for everything when we make a fake mouse event.
-    // Internet Explorer instead gives the current mouse position and state.
-    dispatchMouseEvent(eventType, 0, 0, 0, 0, 0, 0,
-        ctrlKey, altKey, shiftKey, metaKey, true, 0, underlyingEvent);
-}
-
-void EventTargetNode::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
-{
-    if (!gNodesDispatchingSimulatedClicks)
-        gNodesDispatchingSimulatedClicks = new HashSet<EventTargetNode*>;
-    else if (gNodesDispatchingSimulatedClicks->contains(this))
-        return;
-    
-    gNodesDispatchingSimulatedClicks->add(this);
-    
-    // send mousedown and mouseup before the click, if requested
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mousedownEvent, event.get());
-    setActive(true, showPressedLook);
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mouseupEvent, event.get());
-    setActive(false);
-
-    // always send click
-    dispatchSimulatedMouseEvent(eventNames().clickEvent, event);
-    
-    gNodesDispatchingSimulatedClicks->remove(this);
-}
-
-bool EventTargetNode::dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
-    int pageX, int pageY, int screenX, int screenY,
-    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, 
-    bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-    if (disabled()) // Don't even send DOM events for disabled controls..
-        return true;
-    
-    if (eventType.isEmpty())
-        return false; // Shouldn't happen.
-    
-    // Dispatching the first event can easily result in this node being destroyed.
-    // Since we dispatch up to three events here, we need to make sure we're referenced
-    // so the pointer will be good for the two subsequent ones.
-    RefPtr<Node> protect(this);
-    
-    bool cancelable = eventType != eventNames().mousemoveEvent;
-    
-    ExceptionCode ec = 0;
-    
-    bool swallowEvent = false;
-    
-    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
-    RefPtr<EventTargetNode> relatedTarget = (relatedTargetArg && relatedTargetArg->isEventTargetNode())
-        ? static_cast<EventTargetNode*>(relatedTargetArg) : 0;
-
-    if (Frame* frame = document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            // Adjust our pageX and pageY to account for the page zoom.
-            pageX = lroundf(pageX / pageZoom);
-            pageY = lroundf(pageY / pageZoom);
-        }
-    }
-
-    RefPtr<Event> mouseEvent = MouseEvent::create(eventType,
-        true, cancelable, document()->defaultView(),
-        detail, screenX, screenY, pageX, pageY,
-        ctrlKey, altKey, shiftKey, metaKey, button,
-        relatedTarget, 0, isSimulated);
-    mouseEvent->setUnderlyingEvent(underlyingEvent.get());
-    
-    dispatchEvent(mouseEvent, ec);
-    bool defaultHandled = mouseEvent->defaultHandled();
-    bool defaultPrevented = mouseEvent->defaultPrevented();
-    if (defaultHandled || defaultPrevented)
-        swallowEvent = true;
-    
-    // Special case: If it's a double click event, we also send the dblclick event. This is not part
-    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute.  This is treated
-    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
-    if (eventType == eventNames().clickEvent && detail == 2) {
-        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
-            true, cancelable, document()->defaultView(),
-            detail, screenX, screenY, pageX, pageY,
-            ctrlKey, altKey, shiftKey, metaKey, button,
-            relatedTarget, 0, isSimulated);
-        doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
-        if (defaultHandled)
-            doubleClickEvent->setDefaultHandled();
-        dispatchEvent(doubleClickEvent, ec);
-        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
-            swallowEvent = true;
-    }
-
-    return swallowEvent;
-}
-
-void EventTargetNode::dispatchWheelEvent(PlatformWheelEvent& e)
-{
-    ASSERT(!eventDispatchForbidden());
-    if (e.deltaX() == 0 && e.deltaY() == 0)
-        return;
-    
-    FrameView* view = document()->view();
-    if (!view)
-        return;
-    
-    IntPoint pos = view->windowToContents(e.pos());
-    
-    // Convert the deltas from pixels to lines if we have a pixel scroll event.
-    float deltaX = e.deltaX();
-    float deltaY = e.deltaY();
-    
-    // FIXME: Should we do anything with a ScrollByPageWheelEvent here?
-    // It will be treated like a line scroll of 1 right now.
-    if (e.granularity() == ScrollByPixelWheelEvent) {
-        deltaX /= cMouseWheelPixelsPerLineStep;
-        deltaY /= cMouseWheelPixelsPerLineStep;
-    }
-
-    RefPtr<WheelEvent> we = WheelEvent::create(e.deltaX(), e.deltaY(),
-        document()->defaultView(), e.globalX(), e.globalY(), pos.x(), pos.y(),
-        e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
-    ExceptionCode ec = 0;
-    if (!dispatchEvent(we.release(), ec))
-        e.accept();
-}
-
-bool EventTargetNode::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    return dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
-}
-
-bool EventTargetNode::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    return dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
-}
-
-void EventTargetNode::dispatchFocusEvent()
-{
-    dispatchEventForType(eventNames().focusEvent, false, false);
-}
-
-void EventTargetNode::dispatchBlurEvent()
-{
-    dispatchEventForType(eventNames().blurEvent, false, false);
-}
-
-bool EventTargetNode::dispatchEventForType(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
-}
-
-bool EventTargetNode::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    return dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
-}
-
-void EventTargetNode::dispatchStorageEvent(const AtomicString &eventType, const String& key, const String& oldValue, const String& newValue, Frame* source)
-{
-#if ENABLE(DOM_STORAGE)
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(StorageEvent::create(eventType, key, oldValue, newValue, source->document()->documentURI(), source->domWindow()), ec);
-#endif
-}
-
-void EventTargetNode::removeInlineEventListenerForType(const AtomicString& eventType)
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() != eventType || !r.listener()->isInline())
-            continue;
-
-        r.setRemoved(true);
-        listeners->remove(i);
-
-        // removed last
-        if (listeners->isEmpty() && !inDocument())
-            document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-        updateSVGElementInstancesAfterEventListenerChange(this);
-        return;
-    }
-}
-
-void EventTargetNode::setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    // In case we are the only one holding a reference to it, we don't want removeInlineEventListenerForType to destroy it.
-    removeInlineEventListenerForType(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-void EventTargetNode::setInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute* attr)
-{
-    setInlineEventListenerForType(eventType, document()->createEventListener(attr->localName().string(), attr->value(), this));
-}
-
-EventListener* EventTargetNode::inlineEventListenerForType(const AtomicString& eventType) const
-{
-    const RegisteredEventListenerVector& listeners = eventListeners();
-    size_t size = listeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline())
-            return r.listener();
-    }
-    return 0;
-}
-
-bool EventTargetNode::disabled() const
-{
-    return false;
-}
-
-void EventTargetNode::defaultEventHandler(Event* event)
-{
-    if (event->target() != this)
-        return;
-    const AtomicString& eventType = event->type();
-    if (eventType == eventNames().keydownEvent || eventType == eventNames().keypressEvent) {
-        if (event->isKeyboardEvent())
-            if (Frame* frame = document()->frame())
-                frame->eventHandler()->defaultKeyboardEventHandler(static_cast<KeyboardEvent*>(event));
-    } else if (eventType == eventNames().clickEvent) {
-        int detail = event->isUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
-        dispatchUIEvent(eventNames().DOMActivateEvent, detail, event);
-    } else if (eventType == eventNames().contextmenuEvent) {
-        if (Frame* frame = document()->frame())
-            if (Page* page = frame->page())
-                page->contextMenuController()->handleContextMenuEvent(event);
-    } else if (eventType == eventNames().textInputEvent) {
-        if (event->isTextEvent())
-            if (Frame* frame = document()->frame())
-                frame->eventHandler()->defaultTextInputEventHandler(static_cast<TextEvent*>(event));
-    }
-}
-
-EventListener* EventTargetNode::onabort() const
-{
-    return inlineEventListenerForType(eventNames().abortEvent);
-}
-
-void EventTargetNode::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().abortEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onblur() const
-{
-    return inlineEventListenerForType(eventNames().blurEvent);
-}
-
-void EventTargetNode::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().blurEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onchange() const
-{
-    return inlineEventListenerForType(eventNames().changeEvent);
-}
-
-void EventTargetNode::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().changeEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onclick() const
-{
-    return inlineEventListenerForType(eventNames().clickEvent);
-}
-
-void EventTargetNode::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().clickEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oncontextmenu() const
-{
-    return inlineEventListenerForType(eventNames().contextmenuEvent);
-}
-
-void EventTargetNode::setOncontextmenu(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().contextmenuEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondblclick() const
-{
-    return inlineEventListenerForType(eventNames().dblclickEvent);
-}
-
-void EventTargetNode::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onerror() const
-{
-    return inlineEventListenerForType(eventNames().errorEvent);
-}
-
-void EventTargetNode::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().errorEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onfocus() const
-{
-    return inlineEventListenerForType(eventNames().focusEvent);
-}
-
-void EventTargetNode::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().focusEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oninput() const
-{
-    return inlineEventListenerForType(eventNames().inputEvent);
-}
-
-void EventTargetNode::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().inputEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onkeydown() const
-{
-    return inlineEventListenerForType(eventNames().keydownEvent);
-}
-
-void EventTargetNode::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onkeypress() const
-{
-    return inlineEventListenerForType(eventNames().keypressEvent);
-}
-
-void EventTargetNode::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onkeyup() const
-{
-    return inlineEventListenerForType(eventNames().keyupEvent);
-}
-
-void EventTargetNode::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onload() const
-{
-    return inlineEventListenerForType(eventNames().loadEvent);
-}
-
-void EventTargetNode::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().loadEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmousedown() const
-{
-    return inlineEventListenerForType(eventNames().mousedownEvent);
-}
-
-void EventTargetNode::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmousemove() const
-{
-    return inlineEventListenerForType(eventNames().mousemoveEvent);
-}
-
-void EventTargetNode::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmouseout() const
-{
-    return inlineEventListenerForType(eventNames().mouseoutEvent);
-}
-
-void EventTargetNode::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmouseover() const
-{
-    return inlineEventListenerForType(eventNames().mouseoverEvent);
-}
-
-void EventTargetNode::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmouseup() const
-{
-    return inlineEventListenerForType(eventNames().mouseupEvent);
-}
-
-void EventTargetNode::setOnmouseup(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmousewheel() const
-{
-    return inlineEventListenerForType(eventNames().mousewheelEvent);
-}
-
-void EventTargetNode::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onbeforecut() const
-{
-    return inlineEventListenerForType(eventNames().beforecutEvent);
-}
-
-void EventTargetNode::setOnbeforecut(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().beforecutEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oncut() const
-{
-    return inlineEventListenerForType(eventNames().cutEvent);
-}
-
-void EventTargetNode::setOncut(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().cutEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onbeforecopy() const
-{
-    return inlineEventListenerForType(eventNames().beforecopyEvent);
-}
-
-void EventTargetNode::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().beforecopyEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oncopy() const
-{
-    return inlineEventListenerForType(eventNames().copyEvent);
-}
-
-void EventTargetNode::setOncopy(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().copyEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onbeforepaste() const
-{
-    return inlineEventListenerForType(eventNames().beforepasteEvent);
-}
-
-void EventTargetNode::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().beforepasteEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onpaste() const
-{
-    return inlineEventListenerForType(eventNames().pasteEvent);
-}
-
-void EventTargetNode::setOnpaste(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().pasteEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragenter() const
-{
-    return inlineEventListenerForType(eventNames().dragenterEvent);
-}
-
-void EventTargetNode::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragover() const
-{
-    return inlineEventListenerForType(eventNames().dragoverEvent);
-}
-
-void EventTargetNode::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragleave() const
-{
-    return inlineEventListenerForType(eventNames().dragleaveEvent);
-}
-
-void EventTargetNode::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondrop() const
-{
-    return inlineEventListenerForType(eventNames().dropEvent);
-}
-
-void EventTargetNode::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dropEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragstart() const
-{
-    return inlineEventListenerForType(eventNames().dragstartEvent);
-}
-
-void EventTargetNode::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondrag() const
-{
-    return inlineEventListenerForType(eventNames().dragEvent);
-}
-
-void EventTargetNode::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragend() const
-{
-    return inlineEventListenerForType(eventNames().dragendEvent);
-}
-
-void EventTargetNode::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onreset() const
-{
-    return inlineEventListenerForType(eventNames().resetEvent);
-}
-
-void EventTargetNode::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().resetEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onresize() const
-{
-    return inlineEventListenerForType(eventNames().resizeEvent);
-}
-
-void EventTargetNode::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onscroll() const
-{
-    return inlineEventListenerForType(eventNames().scrollEvent);
-}
-
-void EventTargetNode::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onsearch() const
-{
-    return inlineEventListenerForType(eventNames().searchEvent);
-}
-
-void EventTargetNode::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().searchEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onselect() const
-{
-    return inlineEventListenerForType(eventNames().selectEvent);
-}
-
-void EventTargetNode::setOnselect(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().selectEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onselectstart() const
-{
-    return inlineEventListenerForType(eventNames().selectstartEvent);
-}
-
-void EventTargetNode::setOnselectstart(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().selectstartEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onsubmit() const
-{
-    return inlineEventListenerForType(eventNames().submitEvent);
-}
-
-void EventTargetNode::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().submitEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onunload() const
-{
-    return inlineEventListenerForType(eventNames().unloadEvent);
-}
-
-void EventTargetNode::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.h b/src/3rdparty/webkit/WebCore/dom/EventTargetNode.h
deleted file mode 100644
index 201b1089fc..0000000000
--- a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.h
+++ /dev/null
@@ -1,206 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef EventTargetNode_h
-#define EventTargetNode_h
-
-#include "EventTarget.h"
-#include "Node.h"
-
-namespace WebCore {
-
-class Attribute;
-class Frame;
-class RegisteredEventListener;
-
-typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
-
-class EventTargetNode : public Node, public EventTarget {
-public:
-    EventTargetNode(Document*, bool isElement = false, bool isContainer = false);
-    virtual ~EventTargetNode();
-
-    virtual bool isEventTargetNode() const { return true; }
-    virtual EventTargetNode* toNode() { return this; }
-
-    virtual ScriptExecutionContext* scriptExecutionContext() const;
-
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    void removeAllEventListeners();
-
-    void setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-    void setInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute*);
-    void removeInlineEventListenerForType(const AtomicString& eventType);
-    bool dispatchEventForType(const AtomicString& eventType, bool canBubble, bool cancelable);
-    EventListener* inlineEventListenerForType(const AtomicString& eventType) const;
-
-    bool dispatchSubtreeModifiedEvent();
-    void dispatchWindowEvent(PassRefPtr<Event>);
-    void dispatchWindowEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
-    bool dispatchUIEvent(const AtomicString& eventType, int detail = 0, PassRefPtr<Event> underlyingEvent = 0);
-    bool dispatchKeyEvent(const PlatformKeyboardEvent&);
-    void dispatchWheelEvent(PlatformWheelEvent&);
-    bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
-        int clickCount = 0, Node* relatedTarget = 0);
-    bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
-        int pageX, int pageY, int screenX, int screenY,
-        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-        bool isSimulated = false, Node* relatedTarget = 0, PassRefPtr<Event> underlyingEvent = 0);
-    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent = 0);
-    void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
-    bool dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
-    void dispatchStorageEvent(const AtomicString &eventType, const String& key, const String& oldValue, const String& newValue, Frame* source);
-    bool dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
-    bool dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
-    bool dispatchGenericEvent(PassRefPtr<Event>, ExceptionCode&);
-
-    virtual void handleLocalEvents(Event*, bool useCapture);
-
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
-
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-    virtual void willMoveToNewOwnerDocument();
-    virtual void didMoveToNewOwnerDocument();
-
-    /**
-     * Perform the default action for an event e.g. submitting a form
-     */
-    virtual void defaultEventHandler(Event*);
-
-    /**
-     * Used for disabled form elements; if true, prevents mouse events from being dispatched
-     * to event listeners, and prevents DOMActivate events from being sent at all.
-     */
-    virtual bool disabled() const;
-
-    const RegisteredEventListenerVector& eventListeners() const;
-
-    EventListener* onabort() const;
-    void setOnabort(PassRefPtr<EventListener>);
-    EventListener* onblur() const;
-    void setOnblur(PassRefPtr<EventListener>);
-    EventListener* onchange() const;
-    void setOnchange(PassRefPtr<EventListener>);
-    EventListener* onclick() const;
-    void setOnclick(PassRefPtr<EventListener>);
-    EventListener* oncontextmenu() const;
-    void setOncontextmenu(PassRefPtr<EventListener>);
-    EventListener* ondblclick() const;
-    void setOndblclick(PassRefPtr<EventListener>);
-    EventListener* onerror() const;
-    void setOnerror(PassRefPtr<EventListener>);
-    EventListener* onfocus() const;
-    void setOnfocus(PassRefPtr<EventListener>);
-    EventListener* oninput() const;
-    void setOninput(PassRefPtr<EventListener>);
-    EventListener* onkeydown() const;
-    void setOnkeydown(PassRefPtr<EventListener>);
-    EventListener* onkeypress() const;
-    void setOnkeypress(PassRefPtr<EventListener>);
-    EventListener* onkeyup() const;
-    void setOnkeyup(PassRefPtr<EventListener>);
-    EventListener* onload() const;
-    void setOnload(PassRefPtr<EventListener>);
-    EventListener* onmousedown() const;
-    void setOnmousedown(PassRefPtr<EventListener>);
-    EventListener* onmousemove() const;
-    void setOnmousemove(PassRefPtr<EventListener>);
-    EventListener* onmouseout() const;
-    void setOnmouseout(PassRefPtr<EventListener>);
-    EventListener* onmouseover() const;
-    void setOnmouseover(PassRefPtr<EventListener>);
-    EventListener* onmouseup() const;
-    void setOnmouseup(PassRefPtr<EventListener>);
-    EventListener* onmousewheel() const;
-    void setOnmousewheel(PassRefPtr<EventListener>);
-    EventListener* onbeforecut() const;
-    void setOnbeforecut(PassRefPtr<EventListener>);
-    EventListener* oncut() const;
-    void setOncut(PassRefPtr<EventListener>);
-    EventListener* onbeforecopy() const;
-    void setOnbeforecopy(PassRefPtr<EventListener>);
-    EventListener* oncopy() const;
-    void setOncopy(PassRefPtr<EventListener>);
-    EventListener* onbeforepaste() const;
-    void setOnbeforepaste(PassRefPtr<EventListener>);
-    EventListener* onpaste() const;
-    void setOnpaste(PassRefPtr<EventListener>);
-    EventListener* ondragenter() const;
-    void setOndragenter(PassRefPtr<EventListener>);
-    EventListener* ondragover() const;
-    void setOndragover(PassRefPtr<EventListener>);
-    EventListener* ondragleave() const;
-    void setOndragleave(PassRefPtr<EventListener>);
-    EventListener* ondrop() const;
-    void setOndrop(PassRefPtr<EventListener>);
-    EventListener* ondragstart() const;
-    void setOndragstart(PassRefPtr<EventListener>);
-    EventListener* ondrag() const;
-    void setOndrag(PassRefPtr<EventListener>);
-    EventListener* ondragend() const;
-    void setOndragend(PassRefPtr<EventListener>);
-    EventListener* onreset() const;
-    void setOnreset(PassRefPtr<EventListener>);
-    EventListener* onresize() const;
-    void setOnresize(PassRefPtr<EventListener>);
-    EventListener* onscroll() const;
-    void setOnscroll(PassRefPtr<EventListener>);
-    EventListener* onsearch() const;
-    void setOnsearch(PassRefPtr<EventListener>);
-    EventListener* onselect() const;
-    void setOnselect(PassRefPtr<EventListener>);
-    EventListener* onselectstart() const;
-    void setOnselectstart(PassRefPtr<EventListener>);
-    EventListener* onsubmit() const;
-    void setOnsubmit(PassRefPtr<EventListener>);
-    EventListener* onunload() const;
-    void setOnunload(PassRefPtr<EventListener>);
-
-    using Node::ref;
-    using Node::deref;
- 
-private:
-    virtual void refEventTarget() { ref(); }
-    virtual void derefEventTarget() { deref(); }
-};
-
-inline EventTargetNode* EventTargetNodeCast(Node* n) 
-{ 
-    ASSERT(n->isEventTargetNode());
-    return static_cast<EventTargetNode*>(n); 
-}
-
-inline const EventTargetNode* EventTargetNodeCast(const Node* n) 
-{ 
-    ASSERT(n->isEventTargetNode());
-    return static_cast<const EventTargetNode*>(n); 
-}
-
-} // namespace WebCore
-
-#endif // EventTargetNode_h
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.idl b/src/3rdparty/webkit/WebCore/dom/EventTargetNode.idl
deleted file mode 100644
index 0049593e0d..0000000000
--- a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.idl
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module core {
-
-    interface [
-        CustomPushEventHandlerScope,
-        GenerateNativeConverter
-    ] EventTargetNode : Node {
-        // EventTarget
-        attribute [DontEnum, ProtectedListener] EventListener onabort;
-        attribute [DontEnum, ProtectedListener] EventListener onblur;
-        attribute [DontEnum, ProtectedListener] EventListener onchange;
-        attribute [DontEnum, ProtectedListener] EventListener onclick;
-        attribute [DontEnum, ProtectedListener] EventListener oncontextmenu;
-        attribute [DontEnum, ProtectedListener] EventListener ondblclick;
-        attribute [DontEnum, ProtectedListener] EventListener onerror;
-        attribute [DontEnum, ProtectedListener] EventListener onfocus;
-        attribute [DontEnum, ProtectedListener] EventListener oninput;
-        attribute [DontEnum, ProtectedListener] EventListener onkeydown;
-        attribute [DontEnum, ProtectedListener] EventListener onkeypress;
-        attribute [DontEnum, ProtectedListener] EventListener onkeyup;
-        attribute [DontEnum, ProtectedListener] EventListener onload;
-        attribute [DontEnum, ProtectedListener] EventListener onmousedown;
-        attribute [DontEnum, ProtectedListener] EventListener onmousemove;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseout;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseover;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseup;
-        attribute [DontEnum, ProtectedListener] EventListener onmousewheel;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecut;
-        attribute [DontEnum, ProtectedListener] EventListener oncut;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecopy;
-        attribute [DontEnum, ProtectedListener] EventListener oncopy;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforepaste;
-        attribute [DontEnum, ProtectedListener] EventListener onpaste;
-        attribute [DontEnum, ProtectedListener] EventListener ondragenter;
-        attribute [DontEnum, ProtectedListener] EventListener ondragover;
-        attribute [DontEnum, ProtectedListener] EventListener ondragleave;
-        attribute [DontEnum, ProtectedListener] EventListener ondrop;
-        attribute [DontEnum, ProtectedListener] EventListener ondragstart;
-        attribute [DontEnum, ProtectedListener] EventListener ondrag;
-        attribute [DontEnum, ProtectedListener] EventListener ondragend;
-        attribute [DontEnum, ProtectedListener] EventListener onreset;
-        attribute [DontEnum, ProtectedListener] EventListener onresize;
-        attribute [DontEnum, ProtectedListener] EventListener onscroll;
-        attribute [DontEnum, ProtectedListener] EventListener onsearch;
-        attribute [DontEnum, ProtectedListener] EventListener onselect;
-        attribute [DontEnum, ProtectedListener] EventListener onselectstart;
-        attribute [DontEnum, ProtectedListener] EventListener onsubmit;
-        attribute [DontEnum, ProtectedListener] EventListener onunload;
-
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
-                                          in EventListener listener, 
-                                          in boolean useCapture);
-        boolean dispatchEvent(in Event event)
-            raises(EventException);
-    };
-
-}
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
index fa0a7a738d..0291a211ff 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
@@ -58,7 +58,11 @@ static const char* const exceptionNames[] = {
     "INVALID_ACCESS_ERR",
     "VALIDATION_ERR",
     "TYPE_MISMATCH_ERR",
-    "SECURITY_ERR"
+    "SECURITY_ERR",
+    "NETWORK_ERR",
+    "ABORT_ERR",
+    "URL_MISMATCH_ERR",
+    "QUOTA_EXCEEDED_ERR"
 };
 
 static const char* const rangeExceptionNames[] = {
@@ -71,7 +75,8 @@ static const char* const eventExceptionNames[] = {
 };
 
 static const char* const xmlHttpRequestExceptionNames[] = {
-    "NETWORK_ERR"
+    "NETWORK_ERR",
+    "ABORT_ERR"
 };
 
 #if ENABLE(XPATH)
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
index 9e34ae0bb0..58b18e2303 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
@@ -51,7 +51,13 @@ namespace WebCore {
         TYPE_MISMATCH_ERR = 17,
 
         // XMLHttpRequest extension:
-        SECURITY_ERR = 18
+        SECURITY_ERR = 18,
+
+        // Others introduced in HTML5:
+        NETWORK_ERR = 19,
+        ABORT_ERR = 20,
+        URL_MISMATCH_ERR = 21,
+        QUOTA_EXCEEDED_ERR = 22,
     };
 
     enum ExceptionType {
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
new file mode 100644
index 0000000000..108d17e838
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -0,0 +1,304 @@
+/*
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "InputElement.h"
+
+#include "BeforeTextInsertedEvent.h"
+#include "ChromeClient.h"
+#include "Document.h"
+#include "Event.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "Page.h"
+#include "RenderTextControlSingleLine.h"
+#include "SelectionController.h"
+#include "TextIterator.h"
+#include "TextBreakIterator.h"
+
+#if ENABLE(WML)
+#include "WMLInputElement.h"
+#include "WMLNames.h"
+#endif
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+// FIXME: According to HTML4, the length attribute's value can be arbitrarily
+// large. However, due to http://bugs.webkit.org/show_bugs.cgi?id=14536 things
+// get rather sluggish when a text field has a larger number of characters than
+// this, even when just clicking in the text field.
+const int InputElement::s_maximumLength = 524288;
+const int InputElement::s_defaultSize = 20;
+
+void InputElement::dispatchFocusEvent(InputElementData& data, InputElement* inputElement, Element* element)
+{
+    if (!inputElement->isTextField())
+        return;
+
+    updatePlaceholderVisibility(data, inputElement, element);
+
+    Document* document = element->document();
+    if (inputElement->isPasswordField() && document->frame())
+        document->setUseSecureKeyboardEntryWhenActive(true);
+}
+
+void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* inputElement, Element* element)
+{
+    if (!inputElement->isTextField())
+        return;
+
+    Document* document = element->document();
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    updatePlaceholderVisibility(data, inputElement, element);
+
+    if (inputElement->isPasswordField())
+        document->setUseSecureKeyboardEntryWhenActive(false);
+
+    frame->textFieldDidEndEditing(element);
+}
+
+void InputElement::updatePlaceholderVisibility(InputElementData& data, InputElement* inputElement, Element* element, bool placeholderValueChanged)
+{
+    ASSERT(inputElement->isTextField());
+    Document* document = element->document();
+
+    bool oldPlaceholderShouldBeVisible = data.placeholderShouldBeVisible();
+    data.setPlaceholderShouldBeVisible(inputElement->value().isEmpty() 
+                                       && document->focusedNode() != element
+                                       && !inputElement->placeholder().isEmpty());
+
+    if ((oldPlaceholderShouldBeVisible != data.placeholderShouldBeVisible() || placeholderValueChanged) && element->renderer())
+        static_cast<RenderTextControlSingleLine*>(element->renderer())->updatePlaceholderVisibility();
+}
+
+void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
+{
+    ASSERT(inputElement->isTextField());
+
+    if (!restorePreviousSelection || data.cachedSelectionStart() == -1)
+        inputElement->select();
+    else
+        // Restore the cached selection.
+        updateSelectionRange(inputElement, element, data.cachedSelectionStart(), data.cachedSelectionEnd());
+
+    Document* document = element->document();
+    if (document && document->frame())
+        document->frame()->revealSelection();
+}
+
+void InputElement::updateSelectionRange(InputElement* inputElement, Element* element, int start, int end)
+{
+    if (!inputElement->isTextField())
+        return;
+
+    if (RenderTextControl* renderer = toRenderTextControl(element->renderer()))
+        renderer->setSelectionRange(start, end);
+}
+
+void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
+{
+    if (!inputElement->isTextField() || !element->focused())
+        return;
+
+    Document* document = element->document();
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    frame->textFieldDidEndEditing(element);
+}
+
+void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
+{
+    // Renderer and our event handler are responsible for constraining values.
+    ASSERT(value == inputElement->constrainValue(value) || inputElement->constrainValue(value).isEmpty());
+
+    if (inputElement->isTextField())
+        updatePlaceholderVisibility(data, inputElement, element);
+
+    // Workaround for bug where trailing \n is included in the result of textContent.
+    // The assert macro above may also be simplified to:  value == constrainValue(value)
+    // http://bugs.webkit.org/show_bug.cgi?id=9661
+    if (value == "\n")
+        data.setValue("");
+    else
+        data.setValue(value);
+
+    element->setFormControlValueMatchesRenderer(true);
+
+    // Fire the "input" DOM event
+    element->dispatchEvent(eventNames().inputEvent, true, false);
+    notifyFormStateChanged(element);
+}
+
+static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
+{
+    if (!s)
+        return 0;
+
+    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
+    if (!it)
+        return 0;
+
+    for (int i = 0; i < numGraphemeClusters; ++i) {
+        if (textBreakNext(it) == TextBreakDone)
+            return s->length();
+    }
+
+    return textBreakCurrent(it);
+}
+
+String InputElement::constrainValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
+{
+    String string = proposedValue;
+    if (!inputElement->isTextField())
+        return string;
+
+    string.replace("\r\n", " ");
+    string.replace('\r', ' ');
+    string.replace('\n', ' ');
+    
+    StringImpl* s = string.impl();
+    int newLength = numCharactersInGraphemeClusters(s, maxLength);
+    for (int i = 0; i < newLength; ++i) {
+        const UChar& current = (*s)[i];
+        if (current < ' ' && current != '\t') {
+            newLength = i;
+            break;
+        }
+    }
+
+    if (newLength < static_cast<int>(string.length()))
+        return string.left(newLength);
+
+    return string;
+}
+
+static int numGraphemeClusters(StringImpl* s)
+{
+    if (!s)
+        return 0;
+
+    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
+    if (!it)
+        return 0;
+
+    int num = 0;
+    while (textBreakNext(it) != TextBreakDone)
+        ++num;
+
+    return num;
+}
+
+void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Document* document, Event* event)
+{
+    ASSERT(event->isBeforeTextInsertedEvent());
+
+    // Make sure that the text to be inserted will not violate the maxLength.
+    int oldLength = numGraphemeClusters(inputElement->value().impl());
+    ASSERT(oldLength <= data.maxLength());
+    int selectionLength = numGraphemeClusters(plainText(document->frame()->selection()->selection().toNormalizedRange().get()).impl());
+    ASSERT(oldLength >= selectionLength);
+    int maxNewLength = data.maxLength() - (oldLength - selectionLength);
+
+    // Truncate the inserted text to avoid violating the maxLength and other constraints.
+    BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(event);
+    textEvent->setText(constrainValue(inputElement, textEvent->text(), maxNewLength));
+}
+
+void InputElement::parseSizeAttribute(InputElementData& data, Element* element, MappedAttribute* attribute)
+{
+    data.setSize(attribute->isNull() ? InputElement::s_defaultSize : attribute->value().toInt());
+
+    if (RenderObject* renderer = element->renderer())
+        renderer->setNeedsLayoutAndPrefWidthsRecalc();
+}
+
+void InputElement::parseMaxLengthAttribute(InputElementData& data, InputElement* inputElement, Element* element, MappedAttribute* attribute)
+{
+    int maxLength = attribute->isNull() ? InputElement::s_maximumLength : attribute->value().toInt();
+    if (maxLength <= 0 || maxLength > InputElement::s_maximumLength)
+        maxLength = InputElement::s_maximumLength;
+
+    int oldMaxLength = data.maxLength();
+    data.setMaxLength(maxLength);
+
+    if (oldMaxLength != maxLength)
+        updateValueIfNeeded(data, inputElement);
+
+    element->setNeedsStyleRecalc();
+}
+
+void InputElement::updateValueIfNeeded(InputElementData& data, InputElement* inputElement)
+{
+    String oldValue = data.value();
+    String newValue = inputElement->constrainValue(oldValue);
+    if (newValue != oldValue)
+        inputElement->setValue(newValue);
+}
+
+void InputElement::notifyFormStateChanged(Element* element)
+{
+    Document* document = element->document();
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    if (Page* page = frame->page())
+        page->chrome()->client()->formStateDidChange(element);
+}
+
+// InputElementData
+InputElementData::InputElementData()
+    : m_placeholderShouldBeVisible(false)
+    , m_size(InputElement::s_defaultSize)
+    , m_maxLength(InputElement::s_maximumLength)
+    , m_cachedSelectionStart(-1)
+    , m_cachedSelectionEnd(-1)
+{
+}
+
+const AtomicString& InputElementData::name() const
+{
+    return m_name.isNull() ? emptyAtom : m_name;
+}
+
+InputElement* toInputElement(Element* element)
+{
+    if (element->isHTMLElement() && (element->hasTagName(inputTag) || element->hasTagName(isindexTag)))
+        return static_cast<HTMLInputElement*>(element);
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::inputTag))
+        return static_cast<WMLInputElement*>(element);
+#endif
+
+    return 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.h b/src/3rdparty/webkit/WebCore/dom/InputElement.h
new file mode 100644
index 0000000000..7ad3cbd01c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef InputElement_h
+#define InputElement_h
+
+#include "AtomicString.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class Document;
+class Element;
+class Event;
+class InputElementData;
+class MappedAttribute;
+
+class InputElement {
+public:
+    virtual ~InputElement() { }
+
+    virtual bool isAutofilled() const = 0;
+    virtual bool isChecked() const = 0;
+    virtual bool isIndeterminate() const = 0;
+    virtual bool isInputTypeHidden() const = 0;
+    virtual bool isPasswordField() const = 0;
+    virtual bool isSearchField() const = 0;
+    virtual bool isTextField() const = 0;
+
+    virtual bool placeholderShouldBeVisible() const = 0;
+    virtual bool searchEventsShouldBeDispatched() const = 0;
+
+    virtual int size() const = 0;
+    virtual String value() const = 0;
+    virtual void setValue(const String&) = 0;
+
+    virtual String placeholder() const = 0;
+    virtual void setPlaceholder(const String&) = 0;
+
+    virtual String constrainValue(const String&) const = 0;
+    virtual void setValueFromRenderer(const String&) = 0;
+
+    virtual void cacheSelection(int start, int end) = 0;
+    virtual void select() = 0;
+
+    static const int s_maximumLength;
+    static const int s_defaultSize;
+
+protected:
+    static void dispatchFocusEvent(InputElementData&, InputElement*, Element*);
+    static void dispatchBlurEvent(InputElementData&, InputElement*, Element*);
+    static void updatePlaceholderVisibility(InputElementData&, InputElement*, Element*, bool placeholderValueChanged = false);
+    static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
+    static void updateSelectionRange(InputElement*, Element*, int start, int end);
+    static void aboutToUnload(InputElement*, Element*);
+    static void setValueFromRenderer(InputElementData&, InputElement*, Element*, const String&);
+    static String constrainValue(const InputElement*, const String& proposedValue, int maxLength);
+    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Document*, Event*);
+    static void parseSizeAttribute(InputElementData&, Element*, MappedAttribute*);
+    static void parseMaxLengthAttribute(InputElementData&, InputElement*, Element*, MappedAttribute*);
+    static void updateValueIfNeeded(InputElementData&, InputElement*);
+    static void notifyFormStateChanged(Element*);
+};
+
+// HTML/WMLInputElement hold this struct as member variable
+// and pass it to the static helper functions in InputElement
+class InputElementData {
+public:
+    InputElementData();
+
+    bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
+    void setPlaceholderShouldBeVisible(bool visible) { m_placeholderShouldBeVisible = visible; }
+
+    const AtomicString& name() const;
+    void setName(const AtomicString& value) { m_name = value; }
+
+    String value() const { return m_value; }
+    void setValue(const String& value) { m_value = value; }
+
+    int size() const { return m_size; }
+    void setSize(int value) { m_size = value; }
+
+    int maxLength() const { return m_maxLength; }
+    void setMaxLength(int value) { m_maxLength = value; }
+
+    int cachedSelectionStart() const { return m_cachedSelectionStart; }
+    void setCachedSelectionStart(int value) { m_cachedSelectionStart = value; }
+
+    int cachedSelectionEnd() const { return m_cachedSelectionEnd; }
+    void setCachedSelectionEnd(int value) { m_cachedSelectionEnd = value; }
+
+private:
+    bool m_placeholderShouldBeVisible;
+    AtomicString m_name;
+    String m_value;
+    int m_size;
+    int m_maxLength;
+    int m_cachedSelectionStart;
+    int m_cachedSelectionEnd;
+};
+
+InputElement* toInputElement(Element*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
index 808319fa1c..58e5da7792 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
@@ -25,7 +25,7 @@ module events {
         GenerateConstructor
     ] KeyboardEvent : UIEvent {
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         // KeyLocationCode
         const unsigned long       KEY_LOCATION_STANDARD      = 0x00;
         const unsigned long       KEY_LOCATION_LEFT          = 0x01;
@@ -41,7 +41,7 @@ module events {
         readonly attribute boolean          metaKey;
         readonly attribute boolean          altGraphKey;
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         boolean getModifierState(in DOMString keyIdentifierArg);
 #endif
 
@@ -59,7 +59,7 @@ module events {
                                in boolean altGraphKey);
 
         // WebKit Extensions
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute long             keyCode;
         readonly attribute long             charCode;
         
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index 75f5a1e91e..efd89e7ac6 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -52,10 +52,10 @@ private:
         ASSERT(m_port);
     }
 
-    virtual void performTask(ScriptExecutionContext* context)
+    virtual void performTask(ScriptExecutionContext* unusedContext)
     {
+        ASSERT_UNUSED(unusedContext, unusedContext == m_port->scriptExecutionContext());
         ASSERT(!m_port->active());
-        ASSERT(context == m_port->scriptExecutionContext());
 
         // Closing may destroy the port, dispatch any remaining messages now.
         if (m_port->queueIsOpen())
@@ -108,7 +108,7 @@ PassRefPtr<MessagePort> MessagePort::clone(ExceptionCode& ec)
         return 0;
     }
 
-    RefPtr<MessagePort> remotePort = m_entangledPort;
+    RefPtr<MessagePortProxy> remotePort = m_entangledPort;
     RefPtr<MessagePort> newPort = MessagePort::create(0);
 
     // Move all the events in the port message queue of original port to the port message queue of new port, if any, leaving the new port's port message queue in its initial closed state.
@@ -137,14 +137,20 @@ void MessagePort::postMessage(const String& message, MessagePort* dataPort, Exce
             ec = INVALID_ACCESS_ERR;
             return;
         }
+        ec = 0;
         newMessagePort = dataPort->clone(ec);
         if (ec)
             return;
     }
 
-    m_entangledPort->m_messageQueue.append(EventData::create(message, newMessagePort));
-    if (m_entangledPort->m_queueIsOpen && m_entangledPort->m_scriptExecutionContext)
-        m_entangledPort->m_scriptExecutionContext->processMessagePortMessagesSoon();
+    m_entangledPort->deliverMessage(message, newMessagePort);
+}
+
+void MessagePort::deliverMessage(const String& message, PassRefPtr<MessagePort> dataPort)
+{
+    m_messageQueue.append(EventData::create(message, dataPort));
+    if (m_queueIsOpen && m_scriptExecutionContext)
+        m_scriptExecutionContext->processMessagePortMessagesSoon();
 }
 
 PassRefPtr<MessagePort> MessagePort::startConversation(ScriptExecutionContext* scriptExecutionContext, const String& message)
@@ -156,9 +162,7 @@ PassRefPtr<MessagePort> MessagePort::startConversation(ScriptExecutionContext* s
 
     entangle(port1.get(), port2.get());
 
-    m_entangledPort->m_messageQueue.append(EventData::create(message, port2));
-    if (m_entangledPort->m_queueIsOpen && m_entangledPort->m_scriptExecutionContext)
-        m_entangledPort->m_scriptExecutionContext->processMessagePortMessagesSoon();
+    m_entangledPort->deliverMessage(message, port2);
     return port1;
 }
 
@@ -176,35 +180,37 @@ void MessagePort::close()
     if (!m_entangledPort)
         return;
 
-    MessagePort* otherPort = m_entangledPort;
+    MessagePortProxy* otherPort = m_entangledPort;
     unentangle();
 
     queueCloseEvent();
     otherPort->queueCloseEvent();
 }
 
-void MessagePort::entangle(MessagePort* port1, MessagePort* port2)
+void MessagePort::entangle(MessagePortProxy* port1, MessagePortProxy* port2)
 {
-    if (port1->m_entangledPort) {
-        ASSERT(port1->m_entangledPort != port2);
-        port1->unentangle();
-    }
+    port1->entangle(port2);
+    port2->entangle(port1);
+}
 
-    if (port2->m_entangledPort) {
-        ASSERT(port2->m_entangledPort != port1);
-        port2->unentangle();
+void MessagePort::entangle(MessagePortProxy* remote)
+{
+    // Unentangle from our current port first.
+    if (m_entangledPort) {
+        ASSERT(m_entangledPort != remote);
+        unentangle();
     }
-
-    port1->m_entangledPort = port2;
-    port2->m_entangledPort = port1;
+    m_entangledPort = remote;
 }
 
 void MessagePort::unentangle()
 {
-    ASSERT(this == m_entangledPort->m_entangledPort);
-
-    m_entangledPort->m_entangledPort = 0;
-    m_entangledPort = 0;
+    // Unentangle our end before unentangling the other end.
+    if (m_entangledPort) {
+        MessagePortProxy* remote = m_entangledPort;
+        m_entangledPort = 0;
+        remote->unentangle();
+    }
 }
 
 void MessagePort::contextDestroyed()
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index 19252a7925..054ae41603 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -30,6 +30,7 @@
 #include "AtomicStringHash.h"
 #include "EventListener.h"
 #include "EventTarget.h"
+#include "MessagePortProxy.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/MessageQueue.h>
@@ -46,7 +47,7 @@ namespace WebCore {
     class String;
     class WorkerContext;
 
-    class MessagePort : public RefCounted<MessagePort>, public EventTarget {
+    class MessagePort : public MessagePortProxy, public EventTarget {
     public:
         static PassRefPtr<MessagePort> create(ScriptExecutionContext* scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
@@ -60,11 +61,16 @@ namespace WebCore {
         void start();
         void close();
 
+        // Implementations of MessagePortProxy APIs
+        virtual void entangle(MessagePortProxy*);
+        virtual void unentangle();
+        virtual void deliverMessage(const String& message, PassRefPtr<MessagePort>);
+        virtual void queueCloseEvent();
+
         bool queueIsOpen() const { return m_queueIsOpen; }
 
-        MessagePort* entangledPort() { return m_entangledPort; }
-        static void entangle(MessagePort*, MessagePort*);
-        void unentangle();
+        MessagePortProxy* entangledPort() { return m_entangledPort; }
+        static void entangle(MessagePortProxy*, MessagePortProxy*);
 
         void contextDestroyed();
         void attachToContext(ScriptExecutionContext*);
@@ -72,7 +78,6 @@ namespace WebCore {
 
         virtual MessagePort* toMessagePort() { return this; }
 
-        void queueCloseEvent();
         void dispatchMessages();
 
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
@@ -83,8 +88,8 @@ namespace WebCore {
         typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
         EventListenersMap& eventListeners() { return m_eventListeners; }
 
-        using RefCounted<MessagePort>::ref;
-        using RefCounted<MessagePort>::deref;
+        using RefCounted<MessagePortProxy>::ref;
+        using RefCounted<MessagePortProxy>::deref;
 
         bool hasPendingActivity();
 
@@ -105,7 +110,7 @@ namespace WebCore {
 
         void dispatchCloseEvent();
 
-        MessagePort* m_entangledPort;
+        MessagePortProxy* m_entangledPort;
 
         // FIXME: EventData is necessary to pass messages to other threads. In single threaded case, we can just queue a created event.
         struct EventData : public RefCounted<EventData> {
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
index 2596c0f6b8..03c6bab79b 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
@@ -33,7 +33,7 @@ module events {
     ] MessagePort {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
 // but we don't want to actually expose the API while it is in flux.
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute boolean active;
         void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortProxy.h b/src/3rdparty/webkit/WebCore/dom/MessagePortProxy.h
new file mode 100644
index 0000000000..9e768ce4ab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortProxy.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MessagePortProxy_h
+#define MessagePortProxy_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class MessagePort;
+    class String;
+
+    class MessagePortProxy : public RefCounted<MessagePortProxy> {
+    public:
+        virtual ~MessagePortProxy() { }
+
+        virtual void entangle(MessagePortProxy*) = 0;
+        virtual void unentangle() = 0;
+        virtual void deliverMessage(const String& message, PassRefPtr<MessagePort>) = 0;
+        virtual void queueCloseEvent() = 0;
+    };
+
+} // namespace WebCore
+
+#endif // MessagePortProxy_h
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp
index 1c975228f0..bdd39d3436 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp
@@ -36,7 +36,7 @@ MouseEvent::MouseEvent()
 MouseEvent::MouseEvent(const AtomicString& eventType, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view,
                        int detail, int screenX, int screenY, int pageX, int pageY,
                        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-                       unsigned short button, PassRefPtr<EventTargetNode> relatedTarget,
+                       unsigned short button, PassRefPtr<EventTarget> relatedTarget,
                        PassRefPtr<Clipboard> clipboard, bool isSimulated)
     : MouseRelatedEvent(eventType, canBubble, cancelable, view, detail, screenX, screenY,
                         pageX, pageY, ctrlKey, altKey, shiftKey, metaKey, isSimulated)
@@ -54,7 +54,7 @@ MouseEvent::~MouseEvent()
 void MouseEvent::initMouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view,
                                 int detail, int screenX, int screenY, int clientX, int clientY,
                                 bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-                                unsigned short button, PassRefPtr<EventTargetNode> relatedTarget)
+                                unsigned short button, PassRefPtr<EventTarget> relatedTarget)
 {
     if (dispatched())
         return;
@@ -101,7 +101,7 @@ Node* MouseEvent::toElement() const
 {
     // MSIE extension - "the object toward which the user is moving the mouse pointer"
     if (type() == eventNames().mouseoutEvent) 
-        return relatedTarget();
+        return relatedTarget() ? relatedTarget()->toNode() : 0;
     
     return target() ? target()->toNode() : 0;
 }
@@ -110,7 +110,7 @@ Node* MouseEvent::fromElement() const
 {
     // MSIE extension - "object from which activation or the mouse pointer is exiting during the event" (huh?)
     if (type() != eventNames().mouseoutEvent)
-        return relatedTarget();
+        return relatedTarget() ? relatedTarget()->toNode() : 0;
     
     return target() ? target()->toNode() : 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.h b/src/3rdparty/webkit/WebCore/dom/MouseEvent.h
index aa3eee5744..7454b0492d 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.h
@@ -25,7 +25,6 @@
 #define MouseEvent_h
 
 #include "Clipboard.h"
-#include "EventTargetNode.h"
 #include "MouseRelatedEvent.h"
 
 namespace WebCore {
@@ -40,7 +39,7 @@ namespace WebCore {
         static PassRefPtr<MouseEvent> create(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view,
             int detail, int screenX, int screenY, int pageX, int pageY,
             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, unsigned short button,
-            PassRefPtr<EventTargetNode> relatedTarget, PassRefPtr<Clipboard> clipboard = 0, bool isSimulated = false)
+            PassRefPtr<EventTarget> relatedTarget, PassRefPtr<Clipboard> clipboard = 0, bool isSimulated = false)
         {
             return adoptRef(new MouseEvent(type, canBubble, cancelable, view, detail, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey, button, relatedTarget, clipboard, isSimulated));
@@ -50,13 +49,13 @@ namespace WebCore {
         void initMouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
                             int detail, int screenX, int screenY, int clientX, int clientY,
                             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-                            unsigned short button, PassRefPtr<EventTargetNode> relatedTarget);
+                            unsigned short button, PassRefPtr<EventTarget> relatedTarget);
 
         // WinIE uses 1,4,2 for left/middle/right but not for click (just for mousedown/up, maybe others),
         // but we will match the standard DOM.
         unsigned short button() const { return m_button; }
         bool buttonDown() const { return m_buttonDown; }
-        EventTargetNode* relatedTarget() const { return m_relatedTarget.get(); }
+        EventTarget* relatedTarget() const { return m_relatedTarget.get(); }
 
         Clipboard* clipboard() const { return m_clipboard.get(); }
 
@@ -74,11 +73,11 @@ namespace WebCore {
         MouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
                    int detail, int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, unsigned short button,
-                   PassRefPtr<EventTargetNode> relatedTarget, PassRefPtr<Clipboard> clipboard, bool isSimulated);
+                   PassRefPtr<EventTarget> relatedTarget, PassRefPtr<Clipboard> clipboard, bool isSimulated);
 
         unsigned short m_button;
         bool m_buttonDown;
-        RefPtr<EventTargetNode> m_relatedTarget;
+        RefPtr<EventTarget> m_relatedTarget;
         RefPtr<Clipboard> m_clipboard;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
index 3195a7af98..c509459d0e 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
@@ -58,7 +58,7 @@ module events {
         readonly attribute Node             fromElement;
         readonly attribute Node             toElement;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute Clipboard        dataTransfer;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
index a69c8a7243..4ed85ce8bc 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
@@ -97,6 +97,8 @@ void MouseRelatedEvent::initCoordinates()
     m_layerY = m_pageY;
     m_offsetX = m_pageX;
     m_offsetY = m_pageY;
+
+    computePageLocation();
 }
 
 void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
@@ -112,6 +114,14 @@ void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
     m_layerY = m_pageY;
     m_offsetX = m_pageX;
     m_offsetY = m_pageY;
+
+    computePageLocation();
+}
+
+void MouseRelatedEvent::computePageLocation()
+{
+    float zoomFactor = (view() && view()->frame()) ? view()->frame()->pageZoomFactor() : 1.0f;
+    setAbsoluteLocation(roundedIntPoint(FloatPoint(pageX() * zoomFactor, pageY() * zoomFactor)));
 }
 
 void MouseRelatedEvent::receivedTarget()
@@ -128,14 +138,15 @@ void MouseRelatedEvent::receivedTarget()
     m_offsetY = m_pageY;
 
     // Must have an updated render tree for this math to work correctly.
-    targ->document()->updateRendering();
+    targ->document()->updateStyleIfNeeded();
 
     // Adjust offsetX/Y to be relative to the target's position.
     if (!isSimulated()) {
         if (RenderObject* r = targ->renderer()) {
-            FloatPoint absPos = r->absoluteToLocal(FloatPoint(m_pageX, m_pageY), false, true);
-            m_offsetX = absPos.x();
-            m_offsetY = absPos.y();
+            FloatPoint localPos = r->absoluteToLocal(absoluteLocation(), false, true);
+            float zoomFactor = (view() && view()->frame()) ? view()->frame()->pageZoomFactor() : 1.0f;
+            m_offsetX = lroundf(localPos.x() / zoomFactor);
+            m_offsetY = lroundf(localPos.y() / zoomFactor);
         }
     }
 
@@ -151,8 +162,8 @@ void MouseRelatedEvent::receivedTarget()
         RenderLayer* layer = n->renderer()->enclosingLayer();
         layer->updateLayerPosition();
         for (; layer; layer = layer->parent()) {
-            m_layerX -= layer->xPos();
-            m_layerY -= layer->yPos();
+            m_layerX -= layer->x();
+            m_layerY -= layer->y();
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
index 35c65ddeda..7649aa9886 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
@@ -26,6 +26,7 @@
 #ifndef MouseRelatedEvent_h
 #define MouseRelatedEvent_h
 
+#include "IntPoint.h"
 #include "UIEventWithKeyState.h"
 
 namespace WebCore {
@@ -33,6 +34,8 @@ namespace WebCore {
     // Internal only: Helper class for what's common between mouse and wheel events.
     class MouseRelatedEvent : public UIEventWithKeyState {
     public:
+        // Note that these values are adjusted to counter the effects of zoom, so that values
+        // exposed via DOM APIs are invariant under zooming.
         int screenX() const { return m_screenX; }
         int screenY() const { return m_screenY; }
         int clientX() const { return m_clientX; }
@@ -46,6 +49,11 @@ namespace WebCore {
         virtual int pageY() const;
         int x() const;
         int y() const;
+
+        // Page point in "absolute" coordinates (i.e. post-zoomed, page-relative coords,
+        // usable with RenderObject::absoluteToLocal).
+        IntPoint absoluteLocation() const { return m_absoluteLocation; }
+        void setAbsoluteLocation(const IntPoint& p) { m_absoluteLocation = p; }
     
     protected:
         MouseRelatedEvent();
@@ -56,6 +64,8 @@ namespace WebCore {
         void initCoordinates();
         void initCoordinates(int clientX, int clientY);
         virtual void receivedTarget();
+
+        void computePageLocation();
         
         // Expose these so MouseEvent::initMouseEvent can set them.
         int m_screenX;
@@ -70,6 +80,7 @@ namespace WebCore {
         int m_layerY;
         int m_offsetX;
         int m_offsetY;
+        IntPoint m_absoluteLocation;
         bool m_isSimulated;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
index 8944b79593..f3e9bb2909 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ -23,8 +23,9 @@
  */
 
 #include "config.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
+#include "Attr.h"
 #include "Document.h"
 #include "Element.h"
 #include "ExceptionCode.h"
@@ -39,17 +40,26 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
 }
 
-NamedAttrMap::~NamedAttrMap()
+inline void NamedNodeMap::detachAttributesFromElement()
 {
-    NamedAttrMap::clearAttributes(); // virtual function, qualify to be explicit and slightly faster
+    size_t size = m_attributes.size();
+    for (size_t i = 0; i < size; i++) {
+        if (Attr* attr = m_attributes[i]->attr())
+            attr->m_element = 0;
+    }
+}
+
+NamedNodeMap::~NamedNodeMap()
+{
+    detachAttributesFromElement();
 }
 
-bool NamedAttrMap::isMappedAttributeMap() const
+bool NamedNodeMap::isMappedAttributeMap() const
 {
     return false;
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItem(const String& name) const
+PassRefPtr<Node> NamedNodeMap::getNamedItem(const String& name) const
 {
     Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a)
@@ -58,12 +68,12 @@ PassRefPtr<Node> NamedAttrMap::getNamedItem(const String& name) const
     return a->createAttrIfNeeded(m_element);
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
+PassRefPtr<Node> NamedNodeMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
 {
     return getNamedItem(QualifiedName(nullAtom, localName, namespaceURI));
 }
 
-PassRefPtr<Node> NamedAttrMap::removeNamedItem(const String& name, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItem(const String& name, ExceptionCode& ec)
 {
     Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a) {
@@ -74,12 +84,12 @@ PassRefPtr<Node> NamedAttrMap::removeNamedItem(const String& name, ExceptionCode
     return removeNamedItem(a->name(), ec);
 }
 
-PassRefPtr<Node> NamedAttrMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
 {
     return removeNamedItem(QualifiedName(nullAtom, localName, namespaceURI), ec);
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItem(const QualifiedName& name) const
+PassRefPtr<Node> NamedNodeMap::getNamedItem(const QualifiedName& name) const
 {
     Attribute* a = getAttributeItem(name);
     if (!a)
@@ -88,7 +98,7 @@ PassRefPtr<Node> NamedAttrMap::getNamedItem(const QualifiedName& name) const
     return a->createAttrIfNeeded(m_element);
 }
 
-PassRefPtr<Node> NamedAttrMap::setNamedItem(Node* arg, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* arg, ExceptionCode& ec)
 {
     if (!m_element || !arg) {
         ec = NOT_FOUND_ERR;
@@ -137,7 +147,7 @@ PassRefPtr<Node> NamedAttrMap::setNamedItem(Node* arg, ExceptionCode& ec)
 // The DOM2 spec doesn't say that removeAttribute[NS] throws NOT_FOUND_ERR
 // if the attribute is not found, but at this level we have to throw NOT_FOUND_ERR
 // because of removeNamedItem, removeNamedItemNS, and removeAttributeNode.
-PassRefPtr<Node> NamedAttrMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
 {
     Attribute* a = getAttributeItem(name);
     if (!a) {
@@ -154,7 +164,7 @@ PassRefPtr<Node> NamedAttrMap::removeNamedItem(const QualifiedName& name, Except
     return r.release();
 }
 
-PassRefPtr<Node> NamedAttrMap::item (unsigned index) const
+PassRefPtr<Node> NamedNodeMap::item (unsigned index) const
 {
     if (index >= length())
         return 0;
@@ -164,7 +174,7 @@ PassRefPtr<Node> NamedAttrMap::item (unsigned index) const
 
 // We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
 // can tune the behaviour (hasAttribute is case sensitive whereas getAttribute is not).
-Attribute* NamedAttrMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
@@ -178,7 +188,7 @@ Attribute* NamedAttrMap::getAttributeItem(const String& name, bool shouldIgnoreA
     return 0;
 }
 
-Attribute* NamedAttrMap::getAttributeItem(const QualifiedName& name) const
+Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
@@ -188,25 +198,21 @@ Attribute* NamedAttrMap::getAttributeItem(const QualifiedName& name) const
     return 0;
 }
 
-void NamedAttrMap::clearAttributes()
+void NamedNodeMap::clearAttributes()
 {
-    unsigned len = length();
-    for (unsigned i = 0; i < len; i++)
-        if (Attr* attr = m_attributes[i]->attr())
-            attr->m_element = 0;
-
+    detachAttributesFromElement();
     m_attributes.clear();
 }
 
-void NamedAttrMap::detachFromElement()
+void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedAttrMap w/o an element in case someone still has a reference
+    // we allow a NamedNodeMap w/o an element in case someone still has a reference
     // to if after the element gets deleted - but the map is now invalid
     m_element = 0;
-    clearAttributes();
+    detachAttributesFromElement();
 }
 
-void NamedAttrMap::setAttributes(const NamedAttrMap& other)
+void NamedNodeMap::setAttributes(const NamedNodeMap& other)
 {
     // clone all attributes in the other map, but attach to our element
     if (!m_element)
@@ -228,13 +234,13 @@ void NamedAttrMap::setAttributes(const NamedAttrMap& other)
 
     // FIXME: This is wasteful.  The class list could be preserved on a copy, and we
     // wouldn't have to waste time reparsing the attribute.
-    // The derived class, HTMLNamedAttrMap, which manages a parsed class list for the CLASS attribute,
+    // The derived class, HTMLNamedNodeMap, which manages a parsed class list for the CLASS attribute,
     // will update its member variable when parse attribute is called.
     for (unsigned i = 0; i < newLength; i++)
         m_element->attributeChanged(m_attributes[i].get(), true);
 }
 
-void NamedAttrMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
+void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 {
     RefPtr<Attribute> attribute = prpAttribute;
     
@@ -256,7 +262,7 @@ void NamedAttrMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
     }
 }
 
-void NamedAttrMap::removeAttribute(const QualifiedName& name)
+void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
     unsigned index = len + 1;
@@ -290,7 +296,7 @@ void NamedAttrMap::removeAttribute(const QualifiedName& name)
     }
 }
 
-bool NamedAttrMap::mapsEquivalent(const NamedAttrMap* otherMap) const
+bool NamedNodeMap::mapsEquivalent(const NamedNodeMap* otherMap) const
 {
     if (!otherMap)
         return false;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
index 693a9e5469..4fb96dee35 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
@@ -1,11 +1,9 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,9 +26,6 @@
 #define NamedAttrMap_h
 
 #include "Attribute.h"
-#include "NamedNodeMap.h"
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
 
 #ifdef __OBJC__
 #define id id_AVOID_KEYWORD
@@ -38,43 +33,49 @@
 
 namespace WebCore {
 
-// the map of attributes of an element
-class NamedAttrMap : public NamedNodeMap {
+class Node;
+
+typedef int ExceptionCode;
+
+class NamedNodeMap : public RefCounted<NamedNodeMap> {
     friend class Element;
+
 protected:
-    NamedAttrMap(Element* element) : m_element(element) { }
-public:
-    static PassRefPtr<NamedAttrMap> create(Element* element) { return adoptRef(new NamedAttrMap(element)); }
+    NamedNodeMap(Element* element) : m_element(element) { }
 
-    virtual ~NamedAttrMap();
+public:
+    static PassRefPtr<NamedNodeMap> create(Element* element) { return adoptRef(new NamedNodeMap(element)); }
 
-    void setAttributes(const NamedAttrMap&);
+    virtual ~NamedNodeMap();
 
-    // DOM methods & attributes for NamedNodeMap
+    // Public DOM interface.
 
-    virtual PassRefPtr<Node> getNamedItem(const String& name) const;
-    virtual PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&);
+    PassRefPtr<Node> getNamedItem(const String& name) const;
+    PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&);
 
-    virtual PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
-    virtual PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
+    PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
+    PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
 
-    virtual PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
-    virtual PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
-    virtual PassRefPtr<Node> setNamedItem(Node* arg, ExceptionCode&);
+    PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
+    PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
+    PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&);
+    PassRefPtr<Node> setNamedItemNS(Node* node, ExceptionCode& ec) { return setNamedItem(node, ec); }
 
-    virtual PassRefPtr<Node> item(unsigned index) const;
+    PassRefPtr<Node> item(unsigned index) const;
     size_t length() const { return m_attributes.size(); }
+    bool isEmpty() const { return !length(); }
+
+    // Internal interface.
+
+    void setAttributes(const NamedNodeMap&);
 
-    // Other methods (not part of DOM)
     Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
-    Attribute* getAttributeItem(const QualifiedName& name) const;
-    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
-    
+    Attribute* getAttributeItem(const QualifiedName&) const;
+
     void shrinkToLength() { m_attributes.shrinkCapacity(length()); }
-    void reserveCapacity(unsigned capacity) { m_attributes.reserveCapacity(capacity); }
+    void reserveInitialCapacity(unsigned capacity) { m_attributes.reserveInitialCapacity(capacity); }
 
-    // used during parsing: only inserts if not already there
-    // no error checking!
+    // Used during parsing: only inserts if not already there. No error checking!
     void insertAttribute(PassRefPtr<Attribute> newAttribute, bool allowDuplicates)
     {
         ASSERT(!m_element);
@@ -85,18 +86,23 @@ public:
     virtual bool isMappedAttributeMap() const;
 
     const AtomicString& id() const { return m_id; }
-    void setID(const AtomicString& _id) { m_id = _id; }
-    
-    bool mapsEquivalent(const NamedAttrMap* otherMap) const;
+    void setID(const AtomicString& newId) { m_id = newId; }
 
-    // These functions are internal, and do no error checking.
+    bool mapsEquivalent(const NamedNodeMap* otherMap) const;
+
+    // These functions do no error checking.
     void addAttribute(PassRefPtr<Attribute>);
-    void removeAttribute(const QualifiedName& name);
+    void removeAttribute(const QualifiedName&);
 
 protected:
     virtual void clearAttributes();
 
+    Element* element() const { return m_element; }
+
+private:
+    void detachAttributesFromElement();
     void detachFromElement();
+    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
 
     Element* m_element;
     Vector<RefPtr<Attribute> > m_attributes;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp
index bc2d9995e2..d8e3c806a9 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp
@@ -27,6 +27,7 @@
 
 #include "Document.h"
 #include "Element.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
@@ -34,7 +35,7 @@ void NamedMappedAttrMap::clearAttributes()
 {
     m_classNames.clear();
     m_mappedAttributeCount = 0;
-    NamedAttrMap::clearAttributes();
+    NamedNodeMap::clearAttributes();
 }
 
 bool NamedMappedAttrMap::isMappedAttributeMap() const
@@ -75,12 +76,12 @@ bool NamedMappedAttrMap::mapsEquivalent(const NamedMappedAttrMap* otherMap) cons
 
 void NamedMappedAttrMap::setClass(const String& classStr) 
 { 
-    if (!m_element->hasClass()) { 
+    if (!element()->hasClass()) { 
         m_classNames.clear(); 
         return;
     }
 
-    m_classNames.set(classStr, m_element->document()->inCompatMode()); 
+    m_classNames.set(classStr, element()->document()->inCompatMode()); 
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
index c4deddcb4c..0afa278408 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
@@ -4,7 +4,7 @@
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,32 +27,32 @@
 #define NamedMappedAttrMap_h
 
 #include "ClassNames.h"
-#include "MappedAttribute.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
 namespace WebCore {
 
-class NamedMappedAttrMap : public NamedAttrMap {
-private:
-    NamedMappedAttrMap(Element* element) : NamedAttrMap(element), m_mappedAttributeCount(0) { }
+class NamedMappedAttrMap : public NamedNodeMap {
 public:
     static PassRefPtr<NamedMappedAttrMap> create(Element* element = 0) { return adoptRef(new NamedMappedAttrMap(element)); }
 
-    virtual void clearAttributes();
-    virtual bool isMappedAttributeMap() const;
-
     void clearClass() { m_classNames.clear(); }
     void setClass(const String&);
     const ClassNames& classNames() const { return m_classNames; }
 
-    virtual bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
+    bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
     void declRemoved() { m_mappedAttributeCount--; }
     void declAdded() { m_mappedAttributeCount++; }
-    
+
     bool mapsEquivalent(const NamedMappedAttrMap*) const;
-    int declCount() const;
 
 private:
+    NamedMappedAttrMap(Element* element) : NamedNodeMap(element), m_mappedAttributeCount(0) { }
+
+    virtual void clearAttributes();
+    virtual bool isMappedAttributeMap() const;
+
+    int declCount() const;
+
     ClassNames m_classNames;
     int m_mappedAttributeCount;
 };
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h
index 504af69f20..37ef870da6 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h
@@ -1,64 +1 @@
-/*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef NamedNodeMap_h
-#define NamedNodeMap_h
-
-#include <wtf/RefCounted.h>
-#include <wtf/PassRefPtr.h>
-
-namespace WebCore {
-
-class Node;
-class QualifiedName;
-class String;
-
-typedef int ExceptionCode;
-
-// Generic NamedNodeMap interface
-// Other classes implement this for more specific situations e.g. attributes of an element.
-class NamedNodeMap : public RefCounted<NamedNodeMap> {
-public:
-    virtual ~NamedNodeMap() { }
-
-    virtual PassRefPtr<Node> getNamedItem(const String& name) const = 0;
-    virtual PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&) = 0;
-
-    virtual PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const = 0;
-    PassRefPtr<Node> setNamedItemNS(Node* arg, ExceptionCode& ec) { return setNamedItem(arg, ec); }
-    virtual PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&) = 0;
-
-    // DOM methods & attributes for NamedNodeMap
-    virtual PassRefPtr<Node> getNamedItem(const QualifiedName& attrName) const = 0;
-    virtual PassRefPtr<Node> removeNamedItem(const QualifiedName& attrName, ExceptionCode&) = 0;
-    virtual PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&) = 0;
-
-    virtual PassRefPtr<Node> item(unsigned index) const = 0;
-    virtual size_t length() const = 0;
-};
-
-} //namespace
-
-#endif
+#include "NamedAttrMap.h"
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index 6c1254f7a9..cd554dfaf6 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -2,8 +2,9 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +25,7 @@
 #include "config.h"
 #include "Node.h"
 
+#include "Attr.h"
 #include "CSSParser.h"
 #include "CSSRule.h"
 #include "CSSRuleList.h"
@@ -39,24 +41,59 @@
 #include "Document.h"
 #include "DynamicNodeList.h"
 #include "Element.h"
+#include "Event.h"
+#include "EventException.h"
+#include "EventHandler.h"
+#include "EventListener.h"
+#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "FrameView.h"
 #include "HTMLNames.h"
-#include "JSDOMBinding.h"
+#include "KeyboardEvent.h"
 #include "Logging.h"
+#include "MouseEvent.h"
+#include "MutationEvent.h"
 #include "NameNodeList.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 #include "NodeRareData.h"
+#include "Page.h"
+#include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
 #include "ProcessingInstruction.h"
+#include "ProgressEvent.h"
+#include "RegisteredEventListener.h"
 #include "RenderObject.h"
 #include "ScriptController.h"
 #include "SelectorNodeList.h"
 #include "StringBuilder.h"
 #include "TagNodeList.h"
 #include "Text.h"
+#include "TextEvent.h"
+#include "UIEvent.h"
+#include "UIEventWithKeyState.h"
+#include "WebKitAnimationEvent.h"
+#include "WebKitTransitionEvent.h"
+#include "WheelEvent.h"
 #include "XMLNames.h"
 #include "htmlediting.h"
+#include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefCountedLeakCounter.h>
+#include <wtf/UnusedParam.h>
+
+#if ENABLE(DOM_STORAGE)
+#include "StorageEvent.h"
+#endif
+
+#if ENABLE(SVG)
+#include "SVGElementInstance.h"
+#include "SVGUseElement.h"
+#endif
+
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+#endif
 
 #define DUMP_NODE_STATISTICS 0
 
@@ -66,6 +103,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
+
 bool Node::isSupported(const String& feature, const String& version)
 {
     return DOMImplementation::hasFeature(feature, version);
@@ -120,7 +159,7 @@ void Node::dumpStatistics()
                     result.first->second++;
 
                 // AttributeMap stats
-                if (NamedAttrMap* attrMap = element->attributes(true)) {
+                if (NamedNodeMap* attrMap = element->attributes(true)) {
                     attributes += attrMap->length();
                     ++attrMaps;
                     if (attrMap->isMappedAttributeMap())
@@ -217,7 +256,7 @@ void Node::dumpStatistics()
     printf("  Number of MappedAttributes: %zu [%zu]\n", mappedAttributes, sizeof(MappedAttribute));
     printf("  Number of MappedAttributes with a StyleDeclaration: %zu\n", mappedAttributesWithStyleDecl);
     printf("  Number of Attributes with an Attr: %zu\n", attributesWithAttr);
-    printf("  Number of NamedAttrMaps: %zu\n", attrMaps);
+    printf("  Number of NamedNodeMaps: %zu\n", attrMaps);
     printf("  Number of NamedMappedAttrMap: %zu\n", mappedAttrMaps);
 #endif
 }
@@ -250,9 +289,9 @@ Node::StyleChange Node::diff( RenderStyle *s1, RenderStyle *s2 )
     // style in cases where you need to.
     StyleChange ch = NoInherit;
     EDisplay display1 = s1 ? s1->display() : NONE;
-    bool fl1 = s1 && s1->hasPseudoStyle(RenderStyle::FIRST_LETTER);
+    bool fl1 = s1 && s1->hasPseudoStyle(FIRST_LETTER);
     EDisplay display2 = s2 ? s2->display() : NONE;
-    bool fl2 = s2 && s2->hasPseudoStyle(RenderStyle::FIRST_LETTER);
+    bool fl2 = s2 && s2->hasPseudoStyle(FIRST_LETTER);
         
     if (display1 != display2 || fl1 != fl2 || (s1 && s2 && !s1->contentDataEquivalent(s2)))
         ch = Detach;
@@ -265,21 +304,21 @@ Node::StyleChange Node::diff( RenderStyle *s1, RenderStyle *s2 )
     
     // If the pseudoStyles have changed, we want any StyleChange that is not NoChange
     // because setStyle will do the right thing with anything else.
-    if (ch == NoChange && s1->hasPseudoStyle(RenderStyle::BEFORE)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(RenderStyle::BEFORE);
+    if (ch == NoChange && s1->hasPseudoStyle(BEFORE)) {
+        RenderStyle* ps2 = s2->getCachedPseudoStyle(BEFORE);
         if (!ps2)
             ch = NoInherit;
         else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(RenderStyle::BEFORE);
+            RenderStyle* ps1 = s1->getCachedPseudoStyle(BEFORE);
             ch = ps1 && *ps1 == *ps2 ? NoChange : NoInherit;
         }
     }
-    if (ch == NoChange && s1->hasPseudoStyle(RenderStyle::AFTER)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(RenderStyle::AFTER);
+    if (ch == NoChange && s1->hasPseudoStyle(AFTER)) {
+        RenderStyle* ps2 = s2->getCachedPseudoStyle(AFTER);
         if (!ps2)
             ch = NoInherit;
         else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(RenderStyle::AFTER);
+            RenderStyle* ps1 = s1->getCachedPseudoStyle(AFTER);
             ch = ps2 && *ps1 == *ps2 ? NoChange : NoInherit;
         }
     }
@@ -287,7 +326,7 @@ Node::StyleChange Node::diff( RenderStyle *s1, RenderStyle *s2 )
     return ch;
 }
 
-Node::Node(Document* doc, bool isElement, bool isContainer)
+Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
     : m_document(doc)
     , m_previous(0)
     , m_next(0)
@@ -296,7 +335,7 @@ Node::Node(Document* doc, bool isElement, bool isContainer)
     , m_hasId(false)
     , m_hasClass(false)
     , m_attached(false)
-    , m_hasChangedChild(false)
+    , m_childNeedsStyleRecalc(false)
     , m_inDocument(false)
     , m_isLink(false)
     , m_active(false)
@@ -307,6 +346,7 @@ Node::Node(Document* doc, bool isElement, bool isContainer)
     , m_hasRareData(false)
     , m_isElement(isElement)
     , m_isContainer(isContainer)
+    , m_isText(isText)
     , m_parsingChildrenFinished(true)
 #if ENABLE(SVG)
     , m_areSVGAttributesValid(true)
@@ -342,6 +382,9 @@ Node::~Node()
     liveNodeSet.remove(this);
 #endif
 
+    if (!eventListeners().isEmpty() && !inDocument())
+        document()->unregisterDisconnectedNodeWithEventListeners(this);
+
     if (!hasRareData())
         ASSERT(!NodeRareData::rareDataMap().contains(this));
     else {
@@ -364,18 +407,51 @@ Node::~Node()
         m_next->setPreviousSibling(0);
 }
 
-void Node::setDocument(Document* doc)
+#ifdef NDEBUG
+
+static inline void setWillMoveToNewOwnerDocumentWasCalled(bool)
+{
+}
+
+static inline void setDidMoveToNewOwnerDocumentWasCalled(bool)
+{
+}
+
+#else
+    
+static bool willMoveToNewOwnerDocumentWasCalled;
+static bool didMoveToNewOwnerDocumentWasCalled;
+
+static void setWillMoveToNewOwnerDocumentWasCalled(bool wasCalled)
 {
-    if (inDocument() || m_document == doc)
+    willMoveToNewOwnerDocumentWasCalled = wasCalled;
+}
+
+static void setDidMoveToNewOwnerDocumentWasCalled(bool wasCalled)
+{
+    didMoveToNewOwnerDocumentWasCalled = wasCalled;
+}
+    
+#endif
+    
+void Node::setDocument(Document* document)
+{
+    if (inDocument() || m_document == document)
         return;
 
+    setWillMoveToNewOwnerDocumentWasCalled(false);
     willMoveToNewOwnerDocument();
+    ASSERT(willMoveToNewOwnerDocumentWasCalled);
 
-    updateDOMNodeDocument(this, m_document.get(), doc);
+#if USE(JSC)
+    updateDOMNodeDocument(this, m_document.get(), document);
+#endif
 
-    m_document = doc;
+    m_document = document;
 
+    setDidMoveToNewOwnerDocumentWasCalled(false);
     didMoveToNewOwnerDocument();
+    ASSERT(didMoveToNewOwnerDocumentWasCalled);
 }
 
 NodeRareData* Node::rareData() const
@@ -431,7 +507,7 @@ PassRefPtr<NodeList> Node::childNodes()
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -491,43 +567,57 @@ void Node::remove(ExceptionCode& ec)
 void Node::normalize()
 {
     // Go through the subtree beneath us, normalizing all nodes. This means that
-    // any two adjacent text nodes are merged together.
+    // any two adjacent text nodes are merged and any empty text nodes are removed.
 
     RefPtr<Node> node = this;
     while (Node* firstChild = node->firstChild())
         node = firstChild;
-    for (; node; node = node->traverseNextNodePostOrder()) {
+    while (node) {
         NodeType type = node->nodeType();
         if (type == ELEMENT_NODE)
             static_cast<Element*>(node.get())->normalizeAttributes();
 
-        Node* firstChild = node->firstChild();
-        if (firstChild && !firstChild->nextSibling() && firstChild->isTextNode()) {
-            Text* text = static_cast<Text*>(firstChild);
-            if (!text->length()) {
-                ExceptionCode ec;
-                text->remove(ec);
-            }
-        }
-
         if (node == this)
             break;
 
-        if (type == TEXT_NODE) {
-            while (1) {
-                Node* nextSibling = node->nextSibling();
-                if (!nextSibling || !nextSibling->isTextNode())
-                    break;
-                // Current child and the next one are both text nodes. Merge them.
-                Text* text = static_cast<Text*>(node.get());
-                RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
-                unsigned offset = text->length();
+        if (type != TEXT_NODE) {
+            node = node->traverseNextNodePostOrder();
+            continue;
+        }
+
+        Text* text = static_cast<Text*>(node.get());
+
+        // Remove empty text nodes.
+        if (!text->length()) {
+            // Care must be taken to get the next node before removing the current node.
+            node = node->traverseNextNodePostOrder();
+            ExceptionCode ec;
+            text->remove(ec);
+            continue;
+        }
+
+        // Merge text nodes.
+        while (Node* nextSibling = node->nextSibling()) {
+            if (!nextSibling->isTextNode())
+                break;
+            RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
+
+            // Remove empty text nodes.
+            if (!nextText->length()) {
                 ExceptionCode ec;
-                text->appendData(nextText->data(), ec);
-                document()->textNodesMerged(nextText.get(), offset);
                 nextText->remove(ec);
+                continue;
             }
+
+            // Both non-empty text nodes. Merge them.
+            unsigned offset = text->length();
+            ExceptionCode ec;
+            text->appendData(nextText->data(), ec);
+            document()->textNodesMerged(nextText.get(), offset);
+            nextText->remove(ec);
         }
+
+        node = node->traverseNextNodePostOrder();
     }
 }
 
@@ -575,18 +665,25 @@ bool Node::shouldUseInputMethod() const
     return isContentEditable();
 }
 
+RenderBox* Node::renderBox() const
+{
+    return m_renderer && m_renderer->isBox() ? toRenderBox(m_renderer) : 0;
+}
+
+RenderBoxModelObject* Node::renderBoxModelObject() const
+{
+    return m_renderer && m_renderer->isBoxModelObject() ? toRenderBoxModelObject(m_renderer) : 0;
+}
+
 IntRect Node::getRect() const
 {
     // FIXME: broken with transforms
-    if (renderer()) {
-        FloatPoint absPos = renderer()->localToAbsolute();
-        return IntRect(roundedIntPoint(absPos),
-                       IntSize(renderer()->width(), renderer()->height() + renderer()->borderTopExtra() + renderer()->borderBottomExtra()));
-    }
+    if (renderer())
+        return renderer()->absoluteBoundingBoxRect();
     return IntRect();
 }
 
-void Node::setChanged(StyleChangeType changeType)
+void Node::setNeedsStyleRecalc(StyleChangeType changeType)
 {
     if ((changeType != NoStyleChange) && !attached()) // changed compared to what?
         return;
@@ -595,9 +692,10 @@ void Node::setChanged(StyleChangeType changeType)
         m_styleChange = changeType;
 
     if (m_styleChange != NoStyleChange) {
-        for (Node* p = parentNode(); p && !p->hasChangedChild(); p = p->parentNode())
-            p->setHasChangedChild(true);
-        document()->setDocumentChanged(true);
+        for (Node* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
+            p->setChildNeedsStyleRecalc(true);
+        if (document()->childNeedsStyleRecalc())
+            document()->scheduleStyleRecalc();
     }
 }
 
@@ -619,7 +717,7 @@ void Node::lazyAttach()
         }
 
         if (n->firstChild())
-            n->setHasChangedChild(true);
+            n->setChildNeedsStyleRecalc(true);
         n->m_styleChange = FullStyleChange;
         n->m_attached = true;
     }
@@ -630,9 +728,10 @@ void Node::lazyAttach()
             lazyAttachedAncestor->detach();
         lazyAttachedAncestor->attach();
     } else {
-        for (Node* p = parentNode(); p && !p->hasChangedChild(); p = p->parentNode())
-            p->setHasChangedChild(true);
-        document()->setDocumentChanged(true);
+        for (Node* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
+            p->setChildNeedsStyleRecalc(true);
+        if (document()->childNeedsStyleRecalc())
+            document()->scheduleStyleRecalc();
     }
 }
 
@@ -681,7 +780,7 @@ void Node::registerDynamicNodeList(DynamicNodeList* list)
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     } else if (!m_document->hasNodeListCaches()) {
         // We haven't been receiving notifications while there were no registered lists, so the cache is invalid now.
@@ -1073,21 +1172,6 @@ void Node::detach()
     m_inDetach = false;
 }
 
-void Node::insertedIntoDocument()
-{
-    setInDocument(true);
-    insertedIntoTree(false);
-}
-
-void Node::removedFromDocument()
-{
-    if (m_document && m_document->getCSSTarget() == this)
-        m_document->setCSSTarget(0);
-
-    setInDocument(false);
-    removedFromTree(false);
-}
-
 Node *Node::previousEditable() const
 {
     Node *node = previousLeafNode();
@@ -1198,7 +1282,7 @@ void Node::createRendererIfNeeded()
     
     RenderObject* parentRenderer = parent->renderer();
     if (parentRenderer && parentRenderer->canHaveChildren()
-#if ENABLE(SVG)
+#if ENABLE(SVG) || ENABLE(XHTMLMP)
         && parent->childShouldCreateRenderer(this)
 #endif
         ) {
@@ -1219,8 +1303,14 @@ void Node::createRendererIfNeeded()
 
 PassRefPtr<RenderStyle> Node::styleForRenderer()
 {
-    if (isElementNode())
-        return document()->styleSelector()->styleForElement(static_cast<Element*>(this));
+    if (isElementNode()) {
+        bool allowSharing = true;
+#if ENABLE(XHTMLMP)
+        // noscript needs the display property protected - it's a special case
+        allowSharing = localName() != HTMLNames::noscriptTag.localName();
+#endif
+        return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, allowSharing);
+    }
     return parentNode() && parentNode()->renderer() ? parentNode()->renderer()->style() : 0;
 }
 
@@ -1309,7 +1399,7 @@ bool Node::isBlockFlow() const
 
 bool Node::isBlockFlowOrBlockTable() const
 {
-    return renderer() && (renderer()->isBlockFlow() || renderer()->isTable() && !renderer()->isInline());
+    return renderer() && (renderer()->isBlockFlow() || (renderer()->isTable() && !renderer()->isInline()));
 }
 
 bool Node::isEditableBlock() const
@@ -1384,7 +1474,7 @@ PassRefPtr<NodeList> Node::getElementsByTagNameNS(const AtomicString& namespaceU
     
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1405,7 +1495,7 @@ PassRefPtr<NodeList> Node::getElementsByName(const String& elementName)
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1420,7 +1510,7 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1585,8 +1675,8 @@ bool Node::isEqualNode(Node *other) const
     if (nodeValue() != other->nodeValue())
         return false;
     
-    NamedAttrMap *attrs = attributes();
-    NamedAttrMap *otherAttrs = other->attributes();
+    NamedNodeMap *attrs = attributes();
+    NamedNodeMap *otherAttrs = other->attributes();
     
     if (!attrs && otherAttrs)
         return false;
@@ -1627,7 +1717,7 @@ bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
                 return elem->namespaceURI() == namespaceURI;
 
             if (elem->hasAttributes()) {
-                NamedAttrMap *attrs = elem->attributes();
+                NamedNodeMap *attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
@@ -1713,7 +1803,7 @@ String Node::lookupNamespaceURI(const String &prefix) const
                 return elem->namespaceURI();
             
             if (elem->hasAttributes()) {
-                NamedAttrMap *attrs = elem->attributes();
+                NamedNodeMap *attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
@@ -1768,7 +1858,7 @@ String Node::lookupNamespacePrefix(const AtomicString &_namespaceURI, const Elem
         return prefix();
     
     if (hasAttributes()) {
-        NamedAttrMap *attrs = attributes();
+        NamedNodeMap *attrs = attributes();
         
         for (unsigned i = 0; i < attrs->length(); i++) {
             Attribute *attr = attrs->attributeItem(i);
@@ -1909,7 +1999,7 @@ unsigned short Node::compareDocumentPosition(Node* otherNode)
     if (attr1 && attr2 && start1 == start2 && start1) {
         // We are comparing two attributes on the same node.  Crawl our attribute map
         // and see which one we hit first.
-        NamedAttrMap* map = attr1->ownerElement()->attributes(true);
+        NamedNodeMap* map = attr1->ownerElement()->attributes(true);
         unsigned length = map->length();
         for (unsigned i = 0; i < length; ++i) {
             // If neither of the two determining nodes is a child node and nodeType is the same for both determining nodes, then an 
@@ -1976,6 +2066,36 @@ unsigned short Node::compareDocumentPosition(Node* otherNode)
                DOCUMENT_POSITION_PRECEDING | DOCUMENT_POSITION_CONTAINS;
 }
 
+FloatPoint Node::convertToPage(const FloatPoint& p) const
+{
+    // If there is a renderer, just ask it to do the conversion
+    if (renderer())
+        return renderer()->localToAbsolute(p, false, true);
+    
+    // Otherwise go up the tree looking for a renderer
+    Element *parent = ancestorElement();
+    if (parent)
+        return parent->convertToPage(p);
+
+    // No parent - no conversion needed
+    return p;
+}
+
+FloatPoint Node::convertFromPage(const FloatPoint& p) const
+{
+    // If there is a renderer, just ask it to do the conversion
+    if (renderer())
+        return renderer()->absoluteToLocal(p, false, true);
+
+    // Otherwise go up the tree looking for a renderer
+    Element *parent = ancestorElement();
+    if (parent)
+        return parent->convertFromPage(p);
+
+    // No parent - no conversion needed
+    return p;
+}
+
 #ifndef NDEBUG
 
 static void appendAttributeDesc(const Node* node, String& string, const QualifiedName& name, const char* attrDesc)
@@ -2112,6 +2232,1067 @@ ContainerNode* Node::eventParentNode()
 
 // --------
 
+ScriptExecutionContext* Node::scriptExecutionContext() const
+{
+    return document();
+}
+
+const RegisteredEventListenerVector& Node::eventListeners() const
+{
+    if (hasRareData()) {
+        if (RegisteredEventListenerVector* listeners = rareData()->listeners())
+            return *listeners;
+    }
+    static const RegisteredEventListenerVector* emptyListenersVector = new RegisteredEventListenerVector;
+    return *emptyListenersVector;
+}
+
+void Node::insertedIntoDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+    setInDocument(true);
+}
+
+void Node::removedFromDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->registerDisconnectedNodeWithEventListeners(this);
+
+    setInDocument(false);
+}
+
+void Node::willMoveToNewOwnerDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+    ASSERT(!willMoveToNewOwnerDocumentWasCalled);
+    setWillMoveToNewOwnerDocumentWasCalled(true);
+}
+
+void Node::didMoveToNewOwnerDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->registerDisconnectedNodeWithEventListeners(this);
+
+    ASSERT(!didMoveToNewOwnerDocumentWasCalled);
+    setDidMoveToNewOwnerDocumentWasCalled(true);
+}
+
+static inline void updateSVGElementInstancesAfterEventListenerChange(Node* referenceNode)
+{
+#if !ENABLE(SVG)
+    UNUSED_PARAM(referenceNode);
+#else
+    ASSERT(referenceNode);
+    if (!referenceNode->isSVGElement())
+        return;
+
+    // Elements living inside a <use> shadow tree, never cause any updates!
+    if (referenceNode->shadowTreeRootNode())
+        return;
+
+    // We're possibly (a child of) an element that is referenced by a <use> client
+    // If an event listeners changes on a referenced element, update all instances.
+    for (Node* node = referenceNode; node; node = node->parentNode()) {
+        if (!node->hasID() || !node->isSVGElement())
+            continue;
+
+        SVGElementInstance::invalidateAllInstancesOfElement(static_cast<SVGElement*>(node));
+        break;
+    }
+#endif
+}
+
+void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+{
+    Document* document = this->document();
+    if (!document->attached())
+        return;
+
+    document->addListenerTypeIfNeeded(eventType);
+
+    RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
+
+    // Remove existing identical listener set with identical arguments.
+    // The DOM2 spec says that "duplicate instances are discarded" in this case.
+    removeEventListener(eventType, listener.get(), useCapture);
+
+    // adding the first one
+    if (listeners.isEmpty() && !inDocument())
+        document->registerDisconnectedNodeWithEventListeners(this);
+
+    listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
+    updateSVGElementInstancesAfterEventListenerChange(this);
+}
+
+void Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+{
+    if (!hasRareData())
+        return;
+
+    RegisteredEventListenerVector* listeners = rareData()->listeners();
+    if (!listeners)
+        return;
+
+    size_t size = listeners->size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listeners->at(i);
+        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
+            r.setRemoved(true);
+            listeners->remove(i);
+
+            // removed last
+            if (listeners->isEmpty() && !inDocument())
+                document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+            updateSVGElementInstancesAfterEventListenerChange(this);
+            return;
+        }
+    }
+}
+
+void Node::removeAllEventListenersSlowCase()
+{
+    ASSERT(hasRareData());
+
+    RegisteredEventListenerVector* listeners = rareData()->listeners();
+    if (!listeners)
+        return;
+
+    size_t size = listeners->size();
+    for (size_t i = 0; i < size; ++i)
+        listeners->at(i)->setRemoved(true);
+    listeners->clear();
+}
+
+void Node::handleLocalEvents(Event* event, bool useCapture)
+{
+    if (disabled() && event->isMouseEvent())
+        return;
+
+    RegisteredEventListenerVector listenersCopy = eventListeners();
+    size_t size = listenersCopy.size();
+    for (size_t i = 0; i < size; ++i) {
+        const RegisteredEventListener& r = *listenersCopy[i];
+        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
+            r.listener()->handleEvent(event, false);
+    }
+}
+
+#if ENABLE(SVG)
+static inline SVGElementInstance* eventTargetAsSVGElementInstance(Node* referenceNode)
+{
+    ASSERT(referenceNode);
+    if (!referenceNode->isSVGElement())
+        return 0;
+
+    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
+    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
+    for (Node* n = referenceNode; n; n = n->parentNode()) {
+        if (!n->isShadowNode() || !n->isSVGElement())
+            continue;
+
+        Node* shadowTreeParentElement = n->shadowParentNode();
+        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
+
+        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
+            return instance;
+    }
+
+    return 0;
+}
+#endif
+
+static inline EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
+{
+    ASSERT(referenceNode);
+
+#if ENABLE(SVG)
+    if (SVGElementInstance* instance = eventTargetAsSVGElementInstance(referenceNode)) {
+        ASSERT(instance->shadowTreeElement() == referenceNode);
+        return instance;
+    }
+#endif
+
+    return referenceNode;
+}
+
+bool Node::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+{
+    RefPtr<Event> evt(e);
+    ASSERT(!eventDispatchForbidden());
+    if (!evt || evt->type().isEmpty()) { 
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return false;
+    }
+
+    evt->setTarget(eventTargetRespectingSVGTargetRules(this));
+
+    RefPtr<FrameView> view = document()->view();
+    return dispatchGenericEvent(evt.release());
+}
+
+bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
+{
+    RefPtr<Event> event(prpEvent);
+
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event->target());
+    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
+
+    // Make a vector of ancestors to send the event to.
+    // If the node is not in a document just send the event to it.
+    // Be sure to ref all of nodes since event handlers could result in the last reference going away.
+    RefPtr<Node> thisNode(this);
+    Vector<RefPtr<ContainerNode> > ancestors;
+    if (inDocument()) {
+        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
+#if ENABLE(SVG)
+            // Skip <use> shadow tree elements.
+            if (ancestor->isSVGElement() && ancestor->isShadowNode())
+                continue;
+#endif
+            ancestors.append(ancestor);
+        }
+    }
+
+    // Set up a pointer to indicate whether / where to dispatch window events.
+    // We don't dispatch load events to the window. That quirk was originally
+    // added because Mozilla doesn't propagate load events to the window object.
+    DOMWindow* targetForWindowEvents = 0;
+    if (event->type() != eventNames().loadEvent) {
+        Node* topLevelContainer = ancestors.isEmpty() ? this : ancestors.last().get();
+        if (topLevelContainer->isDocumentNode())
+            targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
+    }
+
+    // Give the target node a chance to do some work before DOM event handlers get a crack.
+    void* data = preDispatchEventHandler(event.get());
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    // Trigger capturing event handlers, starting at the top and working our way down.
+    event->setEventPhase(Event::CAPTURING_PHASE);
+
+    if (targetForWindowEvents) {
+        event->setCurrentTarget(targetForWindowEvents->document()); // FIXME: targetForWindowEvents should be the event target.
+        targetForWindowEvents->handleEvent(event.get(), true);
+        if (event->propagationStopped())
+            goto doneDispatching;
+    }
+    for (size_t i = ancestors.size(); i; --i) {
+        ContainerNode* ancestor = ancestors[i - 1].get();
+        event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
+        ancestor->handleLocalEvents(event.get(), true);
+        if (event->propagationStopped())
+            goto doneDispatching;
+    }
+
+    event->setEventPhase(Event::AT_TARGET);
+
+    // We do want capturing event listeners to be invoked here, even though
+    // that violates some versions of the DOM specification; Mozilla does it.
+    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
+    handleLocalEvents(event.get(), true);
+    if (event->propagationStopped())
+        goto doneDispatching;
+    handleLocalEvents(event.get(), false);
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    if (event->bubbles() && !event->cancelBubble()) {
+        // Trigger bubbling event handlers, starting at the bottom and working our way up.
+        event->setEventPhase(Event::BUBBLING_PHASE);
+
+        size_t size = ancestors.size();
+        for (size_t i = 0; i < size; ++i) {
+            ContainerNode* ancestor = ancestors[i].get();
+            event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
+            ancestor->handleLocalEvents(event.get(), false);
+            if (event->propagationStopped() || event->cancelBubble())
+                goto doneDispatching;
+        }
+        if (targetForWindowEvents) {
+            event->setCurrentTarget(targetForWindowEvents->document()); // FIXME: targetForWindowEvents should be the event target.
+            targetForWindowEvents->handleEvent(event.get(), false);
+            if (event->propagationStopped() || event->cancelBubble())
+                goto doneDispatching;
+        }
+    }
+
+doneDispatching:
+    event->setCurrentTarget(0);
+    event->setEventPhase(0);
+
+    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
+    postDispatchEventHandler(event.get(), data);
+
+    // Call default event handlers. While the DOM does have a concept of preventing
+    // default handling, the detail of which handlers are called is an internal
+    // implementation detail and not part of the DOM.
+    if (!event->defaultPrevented() && !event->defaultHandled()) {
+        // Non-bubbling events call only one default event handler, the one for the target.
+        defaultEventHandler(event.get());
+        ASSERT(!event->defaultPrevented());
+        if (event->defaultHandled())
+            goto doneWithDefault;
+        // For bubbling events, call default event handlers on the same targets in the
+        // same order as the bubbling phase.
+        if (event->bubbles()) {
+            size_t size = ancestors.size();
+            for (size_t i = 0; i < size; ++i) {
+                ContainerNode* ancestor = ancestors[i].get();
+                ancestor->defaultEventHandler(event.get());
+                ASSERT(!event->defaultPrevented());
+                if (event->defaultHandled())
+                    goto doneWithDefault;
+            }
+        }
+    }
+
+doneWithDefault:
+    Document::updateStyleForAllDocuments();
+
+    return !event->defaultPrevented();
+}
+
+void Node::dispatchSubtreeModifiedEvent()
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    document()->incDOMTreeVersion();
+
+    notifyNodeListsAttributeChanged(); // FIXME: Can do better some day. Really only care about the name attribute changing.
+    
+    if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
+        return;
+
+    ExceptionCode ec = 0;
+    dispatchMutationEvent(eventNames().DOMSubtreeModifiedEvent, true, 0, String(), String(), ec); 
+}
+
+void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
+    
+    bool cancelable = eventType == eventNames().DOMActivateEvent;
+    
+    ExceptionCode ec = 0;
+    RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
+    evt->setUnderlyingEvent(underlyingEvent);
+    dispatchEvent(evt.release(), ec);
+}
+
+bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
+    bool r = dispatchEvent(keyboardEvent, ec);
+    
+    // we want to return false if default is prevented (already taken care of)
+    // or if the element is default-handled by the DOM. Otherwise we let it just
+    // let it get handled by AppKit 
+    if (keyboardEvent->defaultHandled())
+        r = false;
+    
+    return r;
+}
+
+bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType,
+    int detail, Node* relatedTarget)
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    IntPoint contentsPos;
+    if (FrameView* view = document()->view())
+        contentsPos = view->windowToContents(event.pos());
+
+    short button = event.button();
+
+    ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
+    
+    return dispatchMouseEvent(eventType, button, detail,
+        contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
+        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
+        false, relatedTarget);
+}
+
+void Node::dispatchSimulatedMouseEvent(const AtomicString& eventType,
+    PassRefPtr<Event> underlyingEvent)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    bool ctrlKey = false;
+    bool altKey = false;
+    bool shiftKey = false;
+    bool metaKey = false;
+    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
+        ctrlKey = keyStateEvent->ctrlKey();
+        altKey = keyStateEvent->altKey();
+        shiftKey = keyStateEvent->shiftKey();
+        metaKey = keyStateEvent->metaKey();
+    }
+
+    // Like Gecko, we just pass 0 for everything when we make a fake mouse event.
+    // Internet Explorer instead gives the current mouse position and state.
+    dispatchMouseEvent(eventType, 0, 0, 0, 0, 0, 0,
+        ctrlKey, altKey, shiftKey, metaKey, true, 0, underlyingEvent);
+}
+
+void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
+{
+    if (!gNodesDispatchingSimulatedClicks)
+        gNodesDispatchingSimulatedClicks = new HashSet<Node*>;
+    else if (gNodesDispatchingSimulatedClicks->contains(this))
+        return;
+    
+    gNodesDispatchingSimulatedClicks->add(this);
+    
+    // send mousedown and mouseup before the click, if requested
+    if (sendMouseEvents)
+        dispatchSimulatedMouseEvent(eventNames().mousedownEvent, event.get());
+    setActive(true, showPressedLook);
+    if (sendMouseEvents)
+        dispatchSimulatedMouseEvent(eventNames().mouseupEvent, event.get());
+    setActive(false);
+
+    // always send click
+    dispatchSimulatedMouseEvent(eventNames().clickEvent, event);
+    
+    gNodesDispatchingSimulatedClicks->remove(this);
+}
+
+bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
+    int pageX, int pageY, int screenX, int screenY,
+    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, 
+    bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent)
+{
+    ASSERT(!eventDispatchForbidden());
+    if (disabled()) // Don't even send DOM events for disabled controls..
+        return true;
+    
+    if (eventType.isEmpty())
+        return false; // Shouldn't happen.
+    
+    // Dispatching the first event can easily result in this node being destroyed.
+    // Since we dispatch up to three events here, we need to make sure we're referenced
+    // so the pointer will be good for the two subsequent ones.
+    RefPtr<Node> protect(this);
+    
+    bool cancelable = eventType != eventNames().mousemoveEvent;
+    
+    ExceptionCode ec = 0;
+    
+    bool swallowEvent = false;
+    
+    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
+    RefPtr<Node> relatedTarget = relatedTargetArg;
+
+    int adjustedPageX = pageX;
+    int adjustedPageY = pageY;
+    if (Frame* frame = document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            // Adjust our pageX and pageY to account for the page zoom.
+            adjustedPageX = lroundf(pageX / pageZoom);
+            adjustedPageY = lroundf(pageY / pageZoom);
+        }
+    }
+
+    RefPtr<MouseEvent> mouseEvent = MouseEvent::create(eventType,
+        true, cancelable, document()->defaultView(),
+        detail, screenX, screenY, adjustedPageX, adjustedPageY,
+        ctrlKey, altKey, shiftKey, metaKey, button,
+        relatedTarget, 0, isSimulated);
+    mouseEvent->setUnderlyingEvent(underlyingEvent.get());
+    mouseEvent->setAbsoluteLocation(IntPoint(pageX, pageY));
+    
+    dispatchEvent(mouseEvent, ec);
+    bool defaultHandled = mouseEvent->defaultHandled();
+    bool defaultPrevented = mouseEvent->defaultPrevented();
+    if (defaultHandled || defaultPrevented)
+        swallowEvent = true;
+    
+    // Special case: If it's a double click event, we also send the dblclick event. This is not part
+    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute.  This is treated
+    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
+    if (eventType == eventNames().clickEvent && detail == 2) {
+        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
+            true, cancelable, document()->defaultView(),
+            detail, screenX, screenY, pageX, pageY,
+            ctrlKey, altKey, shiftKey, metaKey, button,
+            relatedTarget, 0, isSimulated);
+        doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
+        if (defaultHandled)
+            doubleClickEvent->setDefaultHandled();
+        dispatchEvent(doubleClickEvent, ec);
+        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
+            swallowEvent = true;
+    }
+
+    return swallowEvent;
+}
+
+void Node::dispatchWheelEvent(PlatformWheelEvent& e)
+{
+    ASSERT(!eventDispatchForbidden());
+    if (e.deltaX() == 0 && e.deltaY() == 0)
+        return;
+    
+    FrameView* view = document()->view();
+    if (!view)
+        return;
+    
+    IntPoint pos = view->windowToContents(e.pos());
+
+    int adjustedPageX = pos.x();
+    int adjustedPageY = pos.y();
+    if (Frame* frame = document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            // Adjust our pageX and pageY to account for the page zoom.
+            adjustedPageX = lroundf(pos.x() / pageZoom);
+            adjustedPageY = lroundf(pos.y() / pageZoom);
+        }
+    }
+    
+    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(),
+        document()->defaultView(), e.globalX(), e.globalY(), adjustedPageX, adjustedPageY,
+        e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
+
+    we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
+
+    ExceptionCode ec = 0;
+    if (!dispatchEvent(we.release(), ec))
+        e.accept();
+}
+
+void Node::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    ExceptionCode ec = 0;
+    dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
+}
+
+void Node::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    ExceptionCode ec = 0;
+    dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
+}
+
+void Node::dispatchMutationEvent(const AtomicString& eventType, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode& ec)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    dispatchEvent(MutationEvent::create(eventType, canBubble, false, relatedNode, prevValue, newValue, String(), 0), ec);
+}
+
+void Node::dispatchFocusEvent()
+{
+    dispatchEvent(eventNames().focusEvent, false, false);
+}
+
+void Node::dispatchBlurEvent()
+{
+    dispatchEvent(eventNames().blurEvent, false, false);
+}
+
+bool Node::dispatchEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
+}
+
+void Node::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
+}
+
+void Node::clearAttributeEventListener(const AtomicString& eventType)
+{
+    if (!hasRareData())
+        return;
+
+    RegisteredEventListenerVector* listeners = rareData()->listeners();
+    if (!listeners)
+        return;
+
+    size_t size = listeners->size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listeners->at(i);
+        if (r.eventType() != eventType || !r.listener()->isAttribute())
+            continue;
+
+        r.setRemoved(true);
+        listeners->remove(i);
+
+        // removed last
+        if (listeners->isEmpty() && !inDocument())
+            document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+        updateSVGElementInstancesAfterEventListenerChange(this);
+        return;
+    }
+}
+
+void Node::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (listener)
+        addEventListener(eventType, listener, false);
+}
+
+EventListener* Node::getAttributeEventListener(const AtomicString& eventType) const
+{
+    const RegisteredEventListenerVector& listeners = eventListeners();
+    size_t size = listeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        const RegisteredEventListener& r = *listeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute())
+            return r.listener();
+    }
+    return 0;
+}
+
+bool Node::disabled() const
+{
+    return false;
+}
+
+void Node::defaultEventHandler(Event* event)
+{
+    if (event->target() != this)
+        return;
+    const AtomicString& eventType = event->type();
+    if (eventType == eventNames().keydownEvent || eventType == eventNames().keypressEvent) {
+        if (event->isKeyboardEvent())
+            if (Frame* frame = document()->frame())
+                frame->eventHandler()->defaultKeyboardEventHandler(static_cast<KeyboardEvent*>(event));
+    } else if (eventType == eventNames().clickEvent) {
+        int detail = event->isUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
+        dispatchUIEvent(eventNames().DOMActivateEvent, detail, event);
+    } else if (eventType == eventNames().contextmenuEvent) {
+        if (Frame* frame = document()->frame())
+            if (Page* page = frame->page())
+                page->contextMenuController()->handleContextMenuEvent(event);
+    } else if (eventType == eventNames().textInputEvent) {
+        if (event->isTextEvent())
+            if (Frame* frame = document()->frame())
+                frame->eventHandler()->defaultTextInputEventHandler(static_cast<TextEvent*>(event));
+    }
+}
+
+EventListener* Node::onabort() const
+{
+    return getAttributeEventListener(eventNames().abortEvent);
+}
+
+void Node::setOnabort(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().abortEvent, eventListener);
+}
+
+EventListener* Node::onblur() const
+{
+    return getAttributeEventListener(eventNames().blurEvent);
+}
+
+void Node::setOnblur(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().blurEvent, eventListener);
+}
+
+EventListener* Node::onchange() const
+{
+    return getAttributeEventListener(eventNames().changeEvent);
+}
+
+void Node::setOnchange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().changeEvent, eventListener);
+}
+
+EventListener* Node::onclick() const
+{
+    return getAttributeEventListener(eventNames().clickEvent);
+}
+
+void Node::setOnclick(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().clickEvent, eventListener);
+}
+
+EventListener* Node::oncontextmenu() const
+{
+    return getAttributeEventListener(eventNames().contextmenuEvent);
+}
+
+void Node::setOncontextmenu(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
+}
+
+EventListener* Node::ondblclick() const
+{
+    return getAttributeEventListener(eventNames().dblclickEvent);
+}
+
+void Node::setOndblclick(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
+}
+
+EventListener* Node::onerror() const
+{
+    return getAttributeEventListener(eventNames().errorEvent);
+}
+
+void Node::setOnerror(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().errorEvent, eventListener);
+}
+
+EventListener* Node::onfocus() const
+{
+    return getAttributeEventListener(eventNames().focusEvent);
+}
+
+void Node::setOnfocus(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().focusEvent, eventListener);
+}
+
+EventListener* Node::oninput() const
+{
+    return getAttributeEventListener(eventNames().inputEvent);
+}
+
+void Node::setOninput(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().inputEvent, eventListener);
+}
+
+EventListener* Node::onkeydown() const
+{
+    return getAttributeEventListener(eventNames().keydownEvent);
+}
+
+void Node::setOnkeydown(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().keydownEvent, eventListener);
+}
+
+EventListener* Node::onkeypress() const
+{
+    return getAttributeEventListener(eventNames().keypressEvent);
+}
+
+void Node::setOnkeypress(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().keypressEvent, eventListener);
+}
+
+EventListener* Node::onkeyup() const
+{
+    return getAttributeEventListener(eventNames().keyupEvent);
+}
+
+void Node::setOnkeyup(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().keyupEvent, eventListener);
+}
+
+EventListener* Node::onload() const
+{
+    return getAttributeEventListener(eventNames().loadEvent);
+}
+
+void Node::setOnload(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadEvent, eventListener);
+}
+
+EventListener* Node::onmousedown() const
+{
+    return getAttributeEventListener(eventNames().mousedownEvent);
+}
+
+void Node::setOnmousedown(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
+}
+
+EventListener* Node::onmousemove() const
+{
+    return getAttributeEventListener(eventNames().mousemoveEvent);
+}
+
+void Node::setOnmousemove(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
+}
+
+EventListener* Node::onmouseout() const
+{
+    return getAttributeEventListener(eventNames().mouseoutEvent);
+}
+
+void Node::setOnmouseout(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
+}
+
+EventListener* Node::onmouseover() const
+{
+    return getAttributeEventListener(eventNames().mouseoverEvent);
+}
+
+void Node::setOnmouseover(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
+}
+
+EventListener* Node::onmouseup() const
+{
+    return getAttributeEventListener(eventNames().mouseupEvent);
+}
+
+void Node::setOnmouseup(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
+}
+
+EventListener* Node::onmousewheel() const
+{
+    return getAttributeEventListener(eventNames().mousewheelEvent);
+}
+
+void Node::setOnmousewheel(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
+}
+
+EventListener* Node::onbeforecut() const
+{
+    return getAttributeEventListener(eventNames().beforecutEvent);
+}
+
+void Node::setOnbeforecut(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().beforecutEvent, eventListener);
+}
+
+EventListener* Node::oncut() const
+{
+    return getAttributeEventListener(eventNames().cutEvent);
+}
+
+void Node::setOncut(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().cutEvent, eventListener);
+}
+
+EventListener* Node::onbeforecopy() const
+{
+    return getAttributeEventListener(eventNames().beforecopyEvent);
+}
+
+void Node::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
+}
+
+EventListener* Node::oncopy() const
+{
+    return getAttributeEventListener(eventNames().copyEvent);
+}
+
+void Node::setOncopy(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().copyEvent, eventListener);
+}
+
+EventListener* Node::onbeforepaste() const
+{
+    return getAttributeEventListener(eventNames().beforepasteEvent);
+}
+
+void Node::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
+}
+
+EventListener* Node::onpaste() const
+{
+    return getAttributeEventListener(eventNames().pasteEvent);
+}
+
+void Node::setOnpaste(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().pasteEvent, eventListener);
+}
+
+EventListener* Node::ondragenter() const
+{
+    return getAttributeEventListener(eventNames().dragenterEvent);
+}
+
+void Node::setOndragenter(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
+}
+
+EventListener* Node::ondragover() const
+{
+    return getAttributeEventListener(eventNames().dragoverEvent);
+}
+
+void Node::setOndragover(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
+}
+
+EventListener* Node::ondragleave() const
+{
+    return getAttributeEventListener(eventNames().dragleaveEvent);
+}
+
+void Node::setOndragleave(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
+}
+
+EventListener* Node::ondrop() const
+{
+    return getAttributeEventListener(eventNames().dropEvent);
+}
+
+void Node::setOndrop(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dropEvent, eventListener);
+}
+
+EventListener* Node::ondragstart() const
+{
+    return getAttributeEventListener(eventNames().dragstartEvent);
+}
+
+void Node::setOndragstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
+}
+
+EventListener* Node::ondrag() const
+{
+    return getAttributeEventListener(eventNames().dragEvent);
+}
+
+void Node::setOndrag(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragEvent, eventListener);
+}
+
+EventListener* Node::ondragend() const
+{
+    return getAttributeEventListener(eventNames().dragendEvent);
+}
+
+void Node::setOndragend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragendEvent, eventListener);
+}
+
+EventListener* Node::onreset() const
+{
+    return getAttributeEventListener(eventNames().resetEvent);
+}
+
+void Node::setOnreset(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().resetEvent, eventListener);
+}
+
+EventListener* Node::onresize() const
+{
+    return getAttributeEventListener(eventNames().resizeEvent);
+}
+
+void Node::setOnresize(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().resizeEvent, eventListener);
+}
+
+EventListener* Node::onscroll() const
+{
+    return getAttributeEventListener(eventNames().scrollEvent);
+}
+
+void Node::setOnscroll(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().scrollEvent, eventListener);
+}
+
+EventListener* Node::onsearch() const
+{
+    return getAttributeEventListener(eventNames().searchEvent);
+}
+
+void Node::setOnsearch(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().searchEvent, eventListener);
+}
+
+EventListener* Node::onselect() const
+{
+    return getAttributeEventListener(eventNames().selectEvent);
+}
+
+void Node::setOnselect(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().selectEvent, eventListener);
+}
+
+EventListener* Node::onselectstart() const
+{
+    return getAttributeEventListener(eventNames().selectstartEvent);
+}
+
+void Node::setOnselectstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().selectstartEvent, eventListener);
+}
+
+EventListener* Node::onsubmit() const
+{
+    return getAttributeEventListener(eventNames().submitEvent);
+}
+
+void Node::setOnsubmit(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().submitEvent, eventListener);
+}
+
+EventListener* Node::onunload() const
+{
+    return getAttributeEventListener(eventNames().unloadEvent);
+}
+
+void Node::setOnunload(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().unloadEvent, eventListener);
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index 5478b86ccf..8313ca80ba 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -2,7 +2,8 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,9 +26,12 @@
 #define Node_h
 
 #include "DocPtr.h"
+#include "EventTarget.h"
 #include "KURLHash.h"
 #include "PlatformString.h"
+#include "RegisteredEventListener.h"
 #include "TreeShared.h"
+#include "FloatPoint.h"
 #include <wtf/Assertions.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/OwnPtr.h>
@@ -36,26 +40,31 @@
 namespace WebCore {
 
 class AtomicString;
+class Attribute;
 class ContainerNode;
 class Document;
 class DynamicNodeList;
 class Element;
 class Event;
 class EventListener;
+class Frame;
 class IntRect;
 class KeyboardEvent;
 class NSResolver;
-class NamedAttrMap;
+class NamedNodeMap;
 class NodeList;
+class NodeRareData;
 class PlatformKeyboardEvent;
 class PlatformMouseEvent;
 class PlatformWheelEvent;
 class QualifiedName;
+class RegisteredEventListener;
 class RenderArena;
+class RenderBox;
+class RenderBoxModelObject;
 class RenderObject;
 class RenderStyle;
 class StringBuilder;
-class NodeRareData;
 
 typedef int ExceptionCode;
 
@@ -70,7 +79,7 @@ const unsigned short DOCUMENT_POSITION_CONTAINED_BY = 0x10;
 const unsigned short DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC = 0x20;
 
 // this class implements nodes, which can have a parent but no children:
-class Node : public TreeShared<Node> {
+class Node : public EventTarget, public TreeShared<Node> {
     friend class Document;
 public:
     enum NodeType {
@@ -99,7 +108,7 @@ public:
     enum StyleChange { NoChange, NoInherit, Inherit, Detach, Force };    
     static StyleChange diff(RenderStyle*, RenderStyle*);
 
-    Node(Document*, bool isElement = false, bool isContainer = false);
+    Node(Document*, bool isElement = false, bool isContainer = false, bool isText = false);
     virtual ~Node();
 
     // DOM methods & attributes for Node
@@ -117,7 +126,7 @@ public:
     Node* firstChild() const { return isContainerNode() ? containerFirstChild() : 0; }
     Node* lastChild() const { return isContainerNode() ? containerLastChild() : 0; }
     bool hasAttributes() const;
-    NamedAttrMap* attributes() const;
+    NamedNodeMap* attributes() const;
 
     virtual KURL baseURI() const;
     
@@ -157,6 +166,8 @@ public:
 
     bool isElementNode() const { return m_isElement; }
     bool isContainerNode() const { return m_isContainer; }
+    bool isTextNode() const { return m_isText; }
+
     virtual bool isHTMLElement() const { return false; }
 
 #if ENABLE(SVG)
@@ -174,11 +185,9 @@ public:
     virtual bool isStyledElement() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
     virtual bool isAttributeNode() const { return false; }
-    virtual bool isTextNode() const { return false; }
     virtual bool isCommentNode() const { return false; }
     virtual bool isCharacterDataNode() const { return false; }
     bool isDocumentNode() const;
-    virtual bool isEventTargetNode() const { return false; }
     virtual bool isShadowNode() const { return false; }
     virtual Node* shadowParentNode() { return 0; }
     Node* shadowAncestorNode();
@@ -256,16 +265,16 @@ public:
     bool focused() const { return hasRareData() ? rareDataFocused() : false; }
     bool attached() const { return m_attached; }
     void setAttached(bool b = true) { m_attached = b; }
-    bool changed() const { return m_styleChange != NoStyleChange; }
+    bool needsStyleRecalc() const { return m_styleChange != NoStyleChange; }
     StyleChangeType styleChangeType() const { return static_cast<StyleChangeType>(m_styleChange); }
-    bool hasChangedChild() const { return m_hasChangedChild; }
+    bool childNeedsStyleRecalc() const { return m_childNeedsStyleRecalc; }
     bool isLink() const { return m_isLink; }
     void setHasID(bool b = true) { m_hasId = b; }
     void setHasClass(bool b = true) { m_hasClass = b; }
-    void setHasChangedChild( bool b = true ) { m_hasChangedChild = b; }
+    void setChildNeedsStyleRecalc(bool b = true) { m_childNeedsStyleRecalc = b; }
     void setInDocument(bool b = true) { m_inDocument = b; }
     void setInActiveChain(bool b = true) { m_inActiveChain = b; }
-    void setChanged(StyleChangeType changeType = FullStyleChange);
+    void setNeedsStyleRecalc(StyleChangeType changeType = FullStyleChange);
     void setIsLink(bool b = true) { m_isLink = b; }
 
     bool inSubtreeMark() const { return m_inSubtreeMark; }
@@ -288,14 +297,6 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
 
-    virtual bool isAutofilled() const { return false; }
-    virtual bool isControl() const { return false; } // Eventually the notion of what is a control will be extensible.
-    virtual bool isEnabled() const { return true; }
-    virtual bool isChecked() const { return false; }
-    virtual bool isIndeterminate() const { return false; }
-    virtual bool isReadOnlyControl() const { return false; }
-    virtual bool isTextControl() const { return false; }
-
     virtual bool isContentEditable() const;
     virtual bool isContentRichlyEditable() const;
     virtual bool shouldUseInputMethod() const;
@@ -314,7 +315,7 @@ public:
     Document* document() const
     {
         ASSERT(this);
-        ASSERT(m_document || nodeType() == DOCUMENT_TYPE_NODE && !inDocument());
+        ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
         return m_document.get();
     }
     void setDocument(Document*);
@@ -373,6 +374,10 @@ public:
     RenderObject* previousRenderer();
     void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
     
+    // Use these two methods with caution.
+    RenderBox* renderBox() const;
+    RenderBoxModelObject* renderBoxModelObject() const;
+
     void checkSetPrefix(const AtomicString& prefix, ExceptionCode&);
     bool isDescendantOf(const Node*) const;
     bool contains(const Node*) const;
@@ -399,6 +404,10 @@ public:
     // Whether or not a selection can be started in this object
     virtual bool canStartSelection() const;
 
+    // Getting points into and out of screen space
+    FloatPoint convertToPage(const FloatPoint& p) const;
+    FloatPoint convertFromPage(const FloatPoint& p) const;
+
     // -----------------------------------------------------------------------------
     // Integration with rendering tree
 
@@ -419,7 +428,7 @@ public:
     void createRendererIfNeeded();
     PassRefPtr<RenderStyle> styleForRenderer();
     virtual bool rendererIsNeeded(RenderStyle*);
-#if ENABLE(SVG)
+#if ENABLE(SVG) || ENABLE(XHTMLMP)
     virtual bool childShouldCreateRenderer(Node*) const { return true; }
 #endif
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -491,8 +500,8 @@ public:
     unsigned short compareDocumentPosition(Node*);
 
 protected:
-    virtual void willMoveToNewOwnerDocument() { }
-    virtual void didMoveToNewOwnerDocument() { }
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const { }
     void setTabIndexExplicitly(short);
@@ -502,6 +511,152 @@ protected:
     NodeRareData* rareData() const;
     NodeRareData* ensureRareData();
 
+public:
+    virtual Node* toNode() { return this; }
+
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+    // Used for standard DOM addEventListener / removeEventListener APIs.
+    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+
+    // Used for legacy "onEvent" property APIs.
+    void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+    void clearAttributeEventListener(const AtomicString& eventType);
+    EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+
+    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+    bool dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+
+    void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
+
+    void dispatchSubtreeModifiedEvent();
+    void dispatchUIEvent(const AtomicString& eventType, int detail = 0, PassRefPtr<Event> underlyingEvent = 0);
+    bool dispatchKeyEvent(const PlatformKeyboardEvent&);
+    void dispatchWheelEvent(PlatformWheelEvent&);
+    bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
+        int clickCount = 0, Node* relatedTarget = 0);
+    bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
+        int pageX, int pageY, int screenX, int screenY,
+        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
+        bool isSimulated = false, Node* relatedTarget = 0, PassRefPtr<Event> underlyingEvent = 0);
+    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent = 0);
+    void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
+    void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
+    void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
+    void dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
+    void dispatchMutationEvent(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode&);
+
+    bool dispatchGenericEvent(PassRefPtr<Event>);
+
+    virtual void handleLocalEvents(Event*, bool useCapture);
+
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+
+    /**
+     * Perform the default action for an event e.g. submitting a form
+     */
+    virtual void defaultEventHandler(Event*);
+
+    /**
+     * Used for disabled form elements; if true, prevents mouse events from being dispatched
+     * to event listeners, and prevents DOMActivate events from being sent at all.
+     */
+    virtual bool disabled() const;
+
+    const RegisteredEventListenerVector& eventListeners() const;
+
+    EventListener* onabort() const;
+    void setOnabort(PassRefPtr<EventListener>);
+    EventListener* onblur() const;
+    void setOnblur(PassRefPtr<EventListener>);
+    EventListener* onchange() const;
+    void setOnchange(PassRefPtr<EventListener>);
+    EventListener* onclick() const;
+    void setOnclick(PassRefPtr<EventListener>);
+    EventListener* oncontextmenu() const;
+    void setOncontextmenu(PassRefPtr<EventListener>);
+    EventListener* ondblclick() const;
+    void setOndblclick(PassRefPtr<EventListener>);
+    EventListener* onerror() const;
+    void setOnerror(PassRefPtr<EventListener>);
+    EventListener* onfocus() const;
+    void setOnfocus(PassRefPtr<EventListener>);
+    EventListener* oninput() const;
+    void setOninput(PassRefPtr<EventListener>);
+    EventListener* onkeydown() const;
+    void setOnkeydown(PassRefPtr<EventListener>);
+    EventListener* onkeypress() const;
+    void setOnkeypress(PassRefPtr<EventListener>);
+    EventListener* onkeyup() const;
+    void setOnkeyup(PassRefPtr<EventListener>);
+    EventListener* onload() const;
+    void setOnload(PassRefPtr<EventListener>);
+    EventListener* onmousedown() const;
+    void setOnmousedown(PassRefPtr<EventListener>);
+    EventListener* onmousemove() const;
+    void setOnmousemove(PassRefPtr<EventListener>);
+    EventListener* onmouseout() const;
+    void setOnmouseout(PassRefPtr<EventListener>);
+    EventListener* onmouseover() const;
+    void setOnmouseover(PassRefPtr<EventListener>);
+    EventListener* onmouseup() const;
+    void setOnmouseup(PassRefPtr<EventListener>);
+    EventListener* onmousewheel() const;
+    void setOnmousewheel(PassRefPtr<EventListener>);
+    EventListener* onbeforecut() const;
+    void setOnbeforecut(PassRefPtr<EventListener>);
+    EventListener* oncut() const;
+    void setOncut(PassRefPtr<EventListener>);
+    EventListener* onbeforecopy() const;
+    void setOnbeforecopy(PassRefPtr<EventListener>);
+    EventListener* oncopy() const;
+    void setOncopy(PassRefPtr<EventListener>);
+    EventListener* onbeforepaste() const;
+    void setOnbeforepaste(PassRefPtr<EventListener>);
+    EventListener* onpaste() const;
+    void setOnpaste(PassRefPtr<EventListener>);
+    EventListener* ondragenter() const;
+    void setOndragenter(PassRefPtr<EventListener>);
+    EventListener* ondragover() const;
+    void setOndragover(PassRefPtr<EventListener>);
+    EventListener* ondragleave() const;
+    void setOndragleave(PassRefPtr<EventListener>);
+    EventListener* ondrop() const;
+    void setOndrop(PassRefPtr<EventListener>);
+    EventListener* ondragstart() const;
+    void setOndragstart(PassRefPtr<EventListener>);
+    EventListener* ondrag() const;
+    void setOndrag(PassRefPtr<EventListener>);
+    EventListener* ondragend() const;
+    void setOndragend(PassRefPtr<EventListener>);
+    EventListener* onreset() const;
+    void setOnreset(PassRefPtr<EventListener>);
+    EventListener* onresize() const;
+    void setOnresize(PassRefPtr<EventListener>);
+    EventListener* onscroll() const;
+    void setOnscroll(PassRefPtr<EventListener>);
+    EventListener* onsearch() const;
+    void setOnsearch(PassRefPtr<EventListener>);
+    EventListener* onselect() const;
+    void setOnselect(PassRefPtr<EventListener>);
+    EventListener* onselectstart() const;
+    void setOnselectstart(PassRefPtr<EventListener>);
+    EventListener* onsubmit() const;
+    void setOnsubmit(PassRefPtr<EventListener>);
+    EventListener* onunload() const;
+    void setOnunload(PassRefPtr<EventListener>);
+
+    using TreeShared<Node>::ref;
+    using TreeShared<Node>::deref;
+ 
+private:
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+
+    void removeAllEventListenersSlowCase();
+
 private:
     virtual NodeRareData* createRareData();
     Node* containerChildNode(unsigned index) const;
@@ -529,7 +684,7 @@ private:
     bool m_hasId : 1;
     bool m_hasClass : 1;
     bool m_attached : 1;
-    bool m_hasChangedChild : 1;
+    bool m_childNeedsStyleRecalc : 1;
     bool m_inDocument : 1;
     bool m_isLink : 1;
     bool m_active : 1;
@@ -540,6 +695,7 @@ private:
     bool m_hasRareData : 1;
     const bool m_isElement : 1;
     const bool m_isContainer : 1;
+    const bool m_isText : 1;
 
 protected:
     // These bits are used by the Element derived class, pulled up here so they can
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.idl b/src/3rdparty/webkit/WebCore/dom/Node.idl
index f45eaa687d..45d325a6b3 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Node.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,15 +22,16 @@ module core {
 
     interface [
         CustomMarkFunction,
+        CustomPushEventHandlerScope,
         GenerateConstructor,
         GenerateNativeConverter,
         GenerateToJS,
         InlineGetOwnPropertySlot,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=84BA0D7A-7E3E-4a7b-B6FB-7653E8FB54ED,
         ImplementationUUID=81B47FDB-94B0-40fd-8E0C-FB2A6E53CC04
     ] Node
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
      {
@@ -64,12 +65,12 @@ module core {
         readonly attribute NamedNodeMap     attributes;
         readonly attribute Document         ownerDocument;
 
-        [OldStyleObjC, Custom] Node insertBefore(in [Return] Node newChild, 
+        [OldStyleObjC, Custom] Node insertBefore(in [Return] Node newChild,
                                                  in Node refChild)
             raises(DOMException);
-        [OldStyleObjC, Custom] Node replaceChild(in Node newChild, 
+        [OldStyleObjC, Custom] Node replaceChild(in Node newChild,
                                                  in [Return] Node oldChild)
-            raises(DOMException);
+            raises(DOMExceptionJSC);
         [Custom] Node               removeChild(in [Return] Node oldChild)
             raises(DOMException);
         [Custom] Node               appendChild(in [Return] Node newChild)
@@ -124,13 +125,67 @@ module core {
         DOMUserData        getUserData(in DOMString key);
 #endif /* 0 */
 
-        // IE extentions
-        readonly attribute Node             parentElement;
+        // IE extensions
+        readonly attribute Element          parentElement;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extensions
         readonly attribute boolean          isContentEditable;
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
+
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        attribute [DontEnum] EventListener onabort;
+        attribute [DontEnum] EventListener onblur;
+        attribute [DontEnum] EventListener onchange;
+        attribute [DontEnum] EventListener onclick;
+        attribute [DontEnum] EventListener oncontextmenu;
+        attribute [DontEnum] EventListener ondblclick;
+        attribute [DontEnum] EventListener onerror;
+        attribute [DontEnum] EventListener onfocus;
+        attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener onkeydown;
+        attribute [DontEnum] EventListener onkeypress;
+        attribute [DontEnum] EventListener onkeyup;
+        attribute [DontEnum] EventListener onload;
+        attribute [DontEnum] EventListener onmousedown;
+        attribute [DontEnum] EventListener onmousemove;
+        attribute [DontEnum] EventListener onmouseout;
+        attribute [DontEnum] EventListener onmouseover;
+        attribute [DontEnum] EventListener onmouseup;
+        attribute [DontEnum] EventListener onmousewheel;
+        attribute [DontEnum] EventListener onbeforecut;
+        attribute [DontEnum] EventListener oncut;
+        attribute [DontEnum] EventListener onbeforecopy;
+        attribute [DontEnum] EventListener oncopy;
+        attribute [DontEnum] EventListener onbeforepaste;
+        attribute [DontEnum] EventListener onpaste;
+        attribute [DontEnum] EventListener ondragenter;
+        attribute [DontEnum] EventListener ondragover;
+        attribute [DontEnum] EventListener ondragleave;
+        attribute [DontEnum] EventListener ondrop;
+        attribute [DontEnum] EventListener ondragstart;
+        attribute [DontEnum] EventListener ondrag;
+        attribute [DontEnum] EventListener ondragend;
+        attribute [DontEnum] EventListener onreset;
+        attribute [DontEnum] EventListener onresize;
+        attribute [DontEnum] EventListener onscroll;
+        attribute [DontEnum] EventListener onsearch;
+        attribute [DontEnum] EventListener onselect;
+        attribute [DontEnum] EventListener onselectstart;
+        attribute [DontEnum] EventListener onsubmit;
+        attribute [DontEnum] EventListener onunload;
+
+        [Custom] void addEventListener(in DOMString type, 
+                                       in EventListener listener, 
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type, 
+                                          in EventListener listener, 
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event event)
+            raises(EventException);
+#endif
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
index 4356357446..94c87e3948 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
@@ -25,7 +25,6 @@
 #ifndef NodeFilter_h
 #define NodeFilter_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilterCondition.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
index d7eee36daa..2a992d3ddc 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
@@ -25,7 +25,6 @@
 #ifndef NodeIterator_h
 #define NodeIterator_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilter.h"
 #include "Traversal.h"
 #include <wtf/PassRefPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
index bbcfca825c..ae0e51620e 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
@@ -28,6 +28,7 @@
 #include "StringHash.h"
 #include "QualifiedName.h"
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -44,7 +45,11 @@ struct NodeListsNodeData {
     
     typedef HashMap<QualifiedName, DynamicNodeList::Caches*> TagCacheMap;
     TagCacheMap m_tagNodeListCaches;
-    
+
+    static PassOwnPtr<NodeListsNodeData> create() {
+        return new NodeListsNodeData;
+    }
+
     ~NodeListsNodeData()
     {
         deleteAllValues(m_classNodeListCaches);
@@ -55,6 +60,9 @@ struct NodeListsNodeData {
     void invalidateCaches();
     void invalidateCachesThatDependOnAttributes();
     bool isEmpty() const;
+
+private:
+    NodeListsNodeData() { }
 };
     
 class NodeRareData {
@@ -81,7 +89,7 @@ public:
     }
     
     void clearNodeLists() { m_nodeLists.clear(); }
-    void setNodeLists(std::auto_ptr<NodeListsNodeData> lists) { m_nodeLists.set(lists.release()); }
+    void setNodeLists(PassOwnPtr<NodeListsNodeData> lists) { m_nodeLists = lists; }
     NodeListsNodeData* nodeLists() const { return m_nodeLists.get(); }
     
     short tabIndex() const { return m_tabIndex; }
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp b/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp
new file mode 100644
index 0000000000..581c070ccc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "OptionElement.h"
+
+#include "Document.h"
+#include "Element.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+#include "OptionGroupElement.h"
+#include "ScriptElement.h"
+#include "SelectElement.h"
+#include <wtf/Assertions.h>
+
+#if ENABLE(WML)
+#include "WMLOptionElement.h"
+#include "WMLNames.h"
+#endif
+
+namespace WebCore {
+
+void OptionElement::setSelectedState(OptionElementData& data, Element* element, bool selected)
+{
+    if (data.selected() == selected)
+        return;
+
+    data.setSelected(selected);
+    element->setNeedsStyleRecalc();
+}
+
+int OptionElement::optionIndex(SelectElement* selectElement, const Element* element)
+{
+    if (!selectElement)
+        return 0;
+
+    // Let's do this dynamically. Might be a bit slow, but we're sure
+    // we won't forget to update a member variable in some cases...
+    const Vector<Element*>& items = selectElement->listItems();
+    int length = items.size();
+    int optionIndex = 0;
+    for (int i = 0; i < length; ++i) {
+        if (!isOptionElement(items[i]))
+            continue;
+        if (items[i] == element)
+            return optionIndex;
+        ++optionIndex;
+    }
+
+    return 0;
+}
+
+String OptionElement::collectOptionText(const OptionElementData& data, const Element* element)
+{
+    Document* document = element->document();
+    String text;
+
+    // WinIE does not use the label attribute, so as a quirk, we ignore it.
+    if (!document->inCompatMode())
+        text = data.label();
+
+    if (text.isEmpty()) {
+        Node* n = element->firstChild();
+        while (n) {
+            if (n->nodeType() == Node::TEXT_NODE || n->nodeType() == Node::CDATA_SECTION_NODE)
+                text += n->nodeValue();
+
+            // skip script content
+            if (n->isElementNode() && toScriptElement(static_cast<Element*>(n)))
+                n = n->traverseNextSibling(element);
+            else
+                n = n->traverseNextNode(element);
+        }
+    }
+
+    text = document->displayStringModifiedByEncoding(text);
+
+    // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
+    text = text.stripWhiteSpace();
+
+    // We want to collapse our whitespace too.  This will match other browsers.
+    text = text.simplifyWhiteSpace();
+    return text;
+}
+
+String OptionElement::collectOptionTextRespectingGroupLabel(const OptionElementData& data, const Element* element)
+{
+    Element* parentElement = static_cast<Element*>(element->parentNode());
+    if (parentElement && toOptionGroupElement(parentElement))
+        return "    " + collectOptionText(data, element);
+
+    return collectOptionText(data, element);
+}
+
+String OptionElement::collectOptionValue(const OptionElementData& data, const Element* element)
+{
+    String value = data.value();
+    if (!value.isNull())
+        return value;
+
+    // Use the text if the value wasn't set.
+    return collectOptionText(data, element).stripWhiteSpace();
+}
+
+// OptionElementData
+OptionElementData::OptionElementData()
+    : m_selected(false)
+{
+}
+
+OptionElement* toOptionElement(Element* element)
+{
+    if (element->isHTMLElement() && element->hasTagName(HTMLNames::optionTag))
+        return static_cast<HTMLOptionElement*>(element);
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::optionTag))
+        return static_cast<WMLOptionElement*>(element);
+#endif
+
+    return 0;
+}
+
+bool isOptionElement(Element* element)
+{
+    return element->hasLocalName(HTMLNames::optionTag)
+#if ENABLE(WML)
+        || element->hasLocalName(WMLNames::optionTag)
+#endif
+        ;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.h b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
new file mode 100644
index 0000000000..c6b9778572
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef OptionElement_h
+#define OptionElement_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class Element;
+class Document;
+class OptionElementData;
+class SelectElement;
+
+class OptionElement {
+public:
+    virtual ~OptionElement() { }
+
+    virtual bool selected() const = 0;
+    virtual void setSelectedState(bool) = 0;
+
+    virtual String text() const = 0;
+    virtual String textIndentedToRespectGroupLabel() const = 0;
+    virtual String value() const = 0;
+
+protected:
+    static void setSelectedState(OptionElementData&, Element*, bool selected);
+    static int optionIndex(SelectElement*, const Element*);
+    static String collectOptionText(const OptionElementData&, const Element*);
+    static String collectOptionTextRespectingGroupLabel(const OptionElementData&, const Element*);
+    static String collectOptionValue(const OptionElementData&, const Element*);
+};
+
+// HTML/WMLOptionElement hold this struct as member variable
+// and pass it to the static helper functions in OptionElement
+class OptionElementData {
+public:
+    OptionElementData();
+
+    String value() const { return m_value; }
+    void setValue(const String& value) { m_value = value; }
+
+    String label() const { return m_label; }
+    void setLabel(const String& label) { m_label = label; }
+
+    bool selected() const { return m_selected; }
+    void setSelected(bool selected) { m_selected = selected; }
+
+private:
+    String m_value;
+    String m_label;
+    bool m_selected;
+};
+
+OptionElement* toOptionElement(Element*);
+bool isOptionElement(Element*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.cpp b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.cpp
new file mode 100644
index 0000000000..8a001bc51f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "OptionGroupElement.h"
+
+#include "Element.h"
+#include "HTMLNames.h"
+#include "HTMLOptGroupElement.h"
+#include <wtf/Assertions.h>
+
+#if ENABLE(WML)
+#include "WMLOptGroupElement.h"
+#include "WMLNames.h"
+#endif
+
+namespace WebCore {
+
+OptionGroupElement* toOptionGroupElement(Element* element)
+{
+    if (element->isHTMLElement() && element->hasTagName(HTMLNames::optgroupTag))
+        return static_cast<HTMLOptGroupElement*>(element);
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::optgroupTag))
+        return static_cast<WMLOptGroupElement*>(element);
+#endif
+
+    return 0;
+}
+
+bool isOptionGroupElement(Element* element)
+{
+    return element->hasLocalName(HTMLNames::optgroupTag)
+#if ENABLE(WML)
+        || element->hasLocalName(WMLNames::optgroupTag)
+#endif
+        ;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/FormControlElement.h b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.h
index a22b835951..e4b1566463 100644
--- a/src/3rdparty/webkit/WebCore/dom/FormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -18,22 +18,24 @@
  *
  */
 
-#ifndef FormControlElement_h
-#define FormControlElement_h
+#ifndef OptionGroupElement_h
+#define OptionGroupElement_h
 
 namespace WebCore {
 
-class FormControlElement {
-public:
-    virtual ~FormControlElement() { }
+class Element;
+class String;
 
-    virtual bool valueMatchesRenderer() const = 0;
-    virtual void setValueMatchesRenderer(bool value = true) = 0;
+class OptionGroupElement {
+public:
+    virtual ~OptionGroupElement() { }
 
-protected:
-    FormControlElement() { }
+    virtual String groupLabelText() const = 0;
 };
 
+OptionGroupElement* toOptionGroupElement(Element*);
+bool isOptionGroupElement(Element*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.cpp b/src/3rdparty/webkit/WebCore/dom/Position.cpp
index 8613d55a1e..0dd48d4acc 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Position.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,14 +29,12 @@
 #include "CSSComputedStyleDeclaration.h"
 #include "CString.h"
 #include "CharacterNames.h"
-#include "Document.h"
-#include "Element.h"
-#include "HTMLNames.h"
 #include "Logging.h"
 #include "PositionIterator.h"
 #include "RenderBlock.h"
 #include "Text.h"
 #include "TextIterator.h"
+#include "VisiblePosition.h"
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <stdio.h>
@@ -45,7 +43,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static Node *nextRenderedEditable(Node *node)
+static Node* nextRenderedEditable(Node* node)
 {
     while (1) {
         node = node->nextEditable();
@@ -54,13 +52,13 @@ static Node *nextRenderedEditable(Node *node)
         RenderObject* renderer = node->renderer();
         if (!renderer)
             continue;
-        if (renderer->inlineBoxWrapper() || renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox())
+        if ((renderer->isBox() && toRenderBox(renderer)->inlineBoxWrapper()) || (renderer->isText() && toRenderText(renderer)->firstTextBox()))
             return node;
     }
     return 0;
 }
 
-static Node *previousRenderedEditable(Node *node)
+static Node* previousRenderedEditable(Node* node)
 {
     while (1) {
         node = node->previousEditable();
@@ -69,26 +67,141 @@ static Node *previousRenderedEditable(Node *node)
         RenderObject* renderer = node->renderer();
         if (!renderer)
             continue;
-        if (renderer->inlineBoxWrapper() || renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox())
+        if ((renderer->isBox() && toRenderBox(renderer)->inlineBoxWrapper()) || (renderer->isText() && toRenderText(renderer)->firstTextBox()))
             return node;
     }
     return 0;
 }
 
-Element* Position::documentElement() const
+Position::Position(PassRefPtr<Node> anchorNode, int offset)
+    : m_anchorNode(anchorNode)
+    , m_offset(offset)
+    , m_anchorType(anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset))
+    , m_isLegacyEditingPosition(true)
 {
-    if (Node* n = node())
-        if (Element* e = n->document()->documentElement())
-            return e;
+}
+
+Position::Position(PassRefPtr<Node> anchorNode, AnchorType anchorType)
+    : m_anchorNode(anchorNode)
+    , m_offset(0)
+    , m_anchorType(anchorType)
+    , m_isLegacyEditingPosition(false)
+{
+    ASSERT(anchorType != PositionIsOffsetInAnchor);
+}
+
+Position::Position(PassRefPtr<Node> anchorNode, int offset, AnchorType anchorType)
+    : m_anchorNode(anchorNode)
+    , m_offset(offset)
+    , m_anchorType(anchorType)
+    , m_isLegacyEditingPosition(false)
+{
+    ASSERT(anchorType == PositionIsOffsetInAnchor);
+}
+
+void Position::moveToPosition(PassRefPtr<Node> node, int offset)
+{
+    ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
+    m_anchorNode = node;
+    m_offset = offset;
+    if (m_isLegacyEditingPosition)
+        m_anchorType = anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset);
+}
+void Position::moveToOffset(int offset)
+{
+    ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
+    m_offset = offset;
+    if (m_isLegacyEditingPosition)
+        m_anchorType = anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset);
+}
+
+Node* Position::containerNode() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode.get();
+    case PositionIsBeforeAnchor:
+    case PositionIsAfterAnchor:
+        return m_anchorNode->parentNode();
+    }
+    ASSERT_NOT_REACHED();
     return 0;
 }
 
-Element *Position::element() const
+int Position::computeOffsetInContainerNode() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+    {
+        int maximumValidOffset = m_anchorNode->offsetInCharacters() ? m_anchorNode->maxCharacterOffset() : m_anchorNode->childNodeCount();
+        return std::min(maximumValidOffset, m_offset);
+    }
+    case PositionIsBeforeAnchor:
+        return m_anchorNode->nodeIndex();
+    case PositionIsAfterAnchor:
+        return m_anchorNode->nodeIndex() + 1;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Node* Position::computeNodeBeforePosition() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode->childNode(m_offset - 1); // -1 converts to childNode((unsigned)-1) and returns null.
+    case PositionIsBeforeAnchor:
+        return m_anchorNode->previousSibling();
+    case PositionIsAfterAnchor:
+        return m_anchorNode.get();
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Node* Position::computeNodeAfterPosition() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode->childNode(m_offset);
+    case PositionIsBeforeAnchor:
+        return m_anchorNode.get();
+    case PositionIsAfterAnchor:
+        return m_anchorNode->nextSibling();
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Position::AnchorType Position::anchorTypeForLegacyEditingPosition(Node* anchorNode, int offset)
+{
+    if (anchorNode && editingIgnoresContent(anchorNode)) {
+        if (offset == 0)
+            return Position::PositionIsBeforeAnchor;
+        return Position::PositionIsAfterAnchor;
+    }
+    return Position::PositionIsOffsetInAnchor;
+}
+
+// FIXME: This method is confusing (does it return anchorNode() or containerNode()?) and should be renamed or removed
+Element* Position::element() const
 {
-    Node *n;
-    for (n = node(); n && !n->isElementNode(); n = n->parentNode())
-        ; // empty loop body
-    return static_cast<Element *>(n);
+    Node* n = anchorNode();
+    while (n && !n->isElementNode())
+        n = n->parentNode();
+    return static_cast<Element*>(n);
 }
 
 PassRefPtr<CSSComputedStyleDeclaration> Position::computedStyle() const
@@ -99,60 +212,69 @@ PassRefPtr<CSSComputedStyleDeclaration> Position::computedStyle() const
     return WebCore::computedStyle(elem);
 }
 
-Position Position::previous(EUsingComposedCharacters usingComposedCharacters) const
+Position Position::previous(PositionMoveType moveType) const
 {
-    Node *n = node();
+    Node* n = node();
     if (!n)
         return *this;
     
-    int o = offset();
+    int o = m_offset;
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     if (o > 0) {
-        Node *child = n->childNode(o - 1);
-        if (child) {
-            return Position(child, maxDeepOffset(child));
-        }
+        Node* child = n->childNode(o - 1);
+        if (child)
+            return lastDeepEditingPositionForNode(child);
+
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
         //      Going backward one character at a time is correct.
         //   2) The old offset was a bogus offset like (<br>, 1), and there is no child.
         //      Going from 1 to 0 is correct.
-        return Position(n, usingComposedCharacters ? uncheckedPreviousOffset(n, o) : o - 1);
+        switch (moveType) {
+        case CodePoint:
+            return Position(n, o - 1);
+        case Character:
+            return Position(n, uncheckedPreviousOffset(n, o));
+        case BackwardDeletion:
+            return Position(n, uncheckedPreviousOffsetForBackwardDeletion(n, o));
+        }
     }
 
-    Node *parent = n->parentNode();
+    Node* parent = n->parentNode();
     if (!parent)
         return *this;
 
     return Position(parent, n->nodeIndex());
 }
 
-Position Position::next(EUsingComposedCharacters usingComposedCharacters) const
+Position Position::next(PositionMoveType moveType) const
 {
-    Node *n = node();
+    ASSERT(moveType != BackwardDeletion);
+
+    Node* n = node();
     if (!n)
         return *this;
     
-    int o = offset();
+    int o = m_offset;
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     Node* child = n->childNode(o);
-    if (child || !n->hasChildNodes() && o < maxDeepOffset(n)) {
+    if (child || (!n->hasChildNodes() && o < lastOffsetForEditing(n))) {
         if (child)
-            return Position(child, 0);
-            
+            return firstDeepEditingPositionForNode(child);
+
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
         //      Going forward one character at a time is correct.
         //   2) The new offset is a bogus offset like (<br>, 1), and there is no child.
         //      Going from 0 to 1 is correct.
-        return Position(n, usingComposedCharacters ? uncheckedNextOffset(n, o) : o + 1);
+        return Position(n, (moveType == Character) ? uncheckedNextOffset(n, o) : o + 1);
     }
 
-    Node *parent = n->parentNode();
+    Node* parent = n->parentNode();
     if (!parent)
         return *this;
 
@@ -164,49 +286,64 @@ int Position::uncheckedPreviousOffset(const Node* n, int current)
     return n->renderer() ? n->renderer()->previousOffset(current) : current - 1;
 }
 
+int Position::uncheckedPreviousOffsetForBackwardDeletion(const Node* n, int current)
+{
+    return n->renderer() ? n->renderer()->previousOffsetForBackwardDeletion(current) : current - 1;
+}
+
 int Position::uncheckedNextOffset(const Node* n, int current)
 {
     return n->renderer() ? n->renderer()->nextOffset(current) : current + 1;
 }
 
-bool Position::atStart() const
+bool Position::atFirstEditingPositionForNode() const
 {
-    Node *n = node();
-    if (!n)
+    if (isNull())
         return true;
-    
-    return offset() <= 0 && n->parent() == 0;
+    return m_offset <= 0;
 }
 
-bool Position::atEnd() const
+bool Position::atLastEditingPositionForNode() const
 {
-    Node *n = node();
-    if (!n)
+    if (isNull())
         return true;
-    
-    return n->parent() == 0 && offset() >= maxDeepOffset(n);
+    return m_offset >= lastOffsetForEditing(node());
+}
+
+bool Position::atStartOfTree() const
+{
+    if (isNull())
+        return true;
+    return !node()->parentNode() && m_offset <= 0;
+}
+
+bool Position::atEndOfTree() const
+{
+    if (isNull())
+        return true;
+    return !node()->parentNode() && m_offset >= lastOffsetForEditing(node());
 }
 
 int Position::renderedOffset() const
 {
     if (!node()->isTextNode())
-        return offset();
+        return m_offset;
    
     if (!node()->renderer())
-        return offset();
+        return m_offset;
                     
     int result = 0;
-    RenderText *textRenderer = static_cast<RenderText *>(node()->renderer());
+    RenderText *textRenderer = toRenderText(node()->renderer());
     for (InlineTextBox *box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
-        int start = box->m_start;
-        int end = box->m_start + box->m_len;
-        if (offset() < start)
+        int start = box->start();
+        int end = box->start() + box->len();
+        if (m_offset < start)
             return result;
-        if (offset() <= end) {
-            result += offset() - start;
+        if (m_offset <= end) {
+            result += m_offset - start;
             return result;
         }
-        result += box->m_len;
+        result += box->len();
     }
     return result;
 }
@@ -223,7 +360,7 @@ Position Position::previousCharacterPosition(EAffinity affinity) const
     bool rendered = isCandidate();
     
     Position currentPos = *this;
-    while (!currentPos.atStart()) {
+    while (!currentPos.atStartOfTree()) {
         currentPos = currentPos.previous();
 
         if (currentPos.node()->rootEditableElement() != fromRootEditableElement)
@@ -251,7 +388,7 @@ Position Position::nextCharacterPosition(EAffinity affinity) const
     bool rendered = isCandidate();
     
     Position currentPos = *this;
-    while (!currentPos.atEnd()) {
+    while (!currentPos.atEndOfTree()) {
         currentPos = currentPos.next();
 
         if (currentPos.node()->rootEditableElement() != fromRootEditableElement)
@@ -267,7 +404,7 @@ Position Position::nextCharacterPosition(EAffinity affinity) const
     return *this;
 }
 
-// Whether or not [node, 0] and [node, maxDeepOffset(node)] are their own VisiblePositions.
+// Whether or not [node, 0] and [node, lastOffsetForEditing(node)] are their own VisiblePositions.
 // If true, adjacent candidates are visually distinct.
 // FIXME: Disregard nodes with renderers that have no height, as we do in isCandidate.
 // FIXME: Share code with isCandidate, if possible.
@@ -284,7 +421,7 @@ static bool endsOfNodeAreVisuallyDistinctPositions(Node* node)
         return false;
     
     // There is a VisiblePosition inside an empty inline-block container.
-    return node->renderer()->isReplaced() && canHaveChildrenForEditing(node) && node->renderer()->height() != 0 && !node->firstChild();
+    return node->renderer()->isReplaced() && canHaveChildrenForEditing(node) && toRenderBox(node->renderer())->height() != 0 && !node->firstChild();
 }
 
 static Node* enclosingVisualBoundary(Node* node)
@@ -361,12 +498,12 @@ Position Position::upstream() const
         // Return position after tables and nodes which have content that can be ignored.
         if (editingIgnoresContent(currentNode) || isTableElement(currentNode)) {
             if (currentPos.atEndOfNode())
-                return Position(currentNode, maxDeepOffset(currentNode));
+                return lastDeepEditingPositionForNode(currentNode);
             continue;
         }
 
         // return current position if it is in rendered text
-        if (renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox()) {
+        if (renderer->isText() && toRenderText(renderer)->firstTextBox()) {
             if (currentNode != startNode) {
                 // This assertion fires in layout tests in the case-transform.html test because
                 // of a mix-up between offsets in the text in the DOM tree with text in the
@@ -377,7 +514,7 @@ Position Position::upstream() const
             }
 
             unsigned textOffset = currentPos.offsetInLeafNode();
-            RenderText* textRenderer = static_cast<RenderText*>(renderer);
+            RenderText* textRenderer = toRenderText(renderer);
             InlineTextBox* lastTextBox = textRenderer->lastTextBox();
             for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
                 if (textOffset <= box->start() + box->len()) {
@@ -398,7 +535,7 @@ Position Position::upstream() const
                     otherBox = otherBox->nextLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -407,7 +544,7 @@ Position Position::upstream() const
                     otherBox = otherBox->prevLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -482,14 +619,14 @@ Position Position::downstream() const
         }
 
         // return current position if it is in rendered text
-        if (renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox()) {
+        if (renderer->isText() && toRenderText(renderer)->firstTextBox()) {
             if (currentNode != startNode) {
                 ASSERT(currentPos.atStartOfNode());
                 return Position(currentNode, renderer->caretMinOffset());
             }
 
             unsigned textOffset = currentPos.offsetInLeafNode();
-            RenderText* textRenderer = static_cast<RenderText*>(renderer);
+            RenderText* textRenderer = toRenderText(renderer);
             InlineTextBox* lastTextBox = textRenderer->lastTextBox();
             for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
                 if (textOffset <= box->end()) {
@@ -510,7 +647,7 @@ Position Position::downstream() const
                     otherBox = otherBox->nextLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -519,7 +656,7 @@ Position Position::downstream() const
                     otherBox = otherBox->prevLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -536,9 +673,11 @@ bool Position::hasRenderedNonAnonymousDescendantsWithHeight(RenderObject* render
 {
     RenderObject* stop = renderer->nextInPreOrderAfterChildren();
     for (RenderObject *o = renderer->firstChild(); o && o != stop; o = o->nextInPreOrder())
-        if (o->element() && o->height())
-            return true;
-            
+        if (o->node()) {
+            if ((o->isText() && toRenderText(o)->linesBoundingBox().height()) ||
+                (o->isBox() && toRenderBox(o)->borderBoundingBox().height()))
+                return true;
+        }
     return false;
 }
 
@@ -560,17 +699,17 @@ bool Position::isCandidate() const
         return false;
 
     if (renderer->isBR())
-        return offset() == 0 && !nodeIsUserSelectNone(node()->parent());
+        return m_offset == 0 && !nodeIsUserSelectNone(node()->parent());
 
     if (renderer->isText())
         return inRenderedText() && !nodeIsUserSelectNone(node());
 
     if (isTableElement(node()) || editingIgnoresContent(node()))
-        return (offset() == 0 || offset() == maxDeepOffset(node())) && !nodeIsUserSelectNone(node()->parent());
+        return (atFirstEditingPositionForNode() || atLastEditingPositionForNode()) && !nodeIsUserSelectNone(node()->parent());
 
     if (!node()->hasTagName(htmlTag) && renderer->isBlockFlow() && !hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (renderer->height() || node()->hasTagName(bodyTag)))
-        return offset() == 0 && !nodeIsUserSelectNone(node());
+       (toRenderBox(renderer)->height() || node()->hasTagName(bodyTag)))
+        return atFirstEditingPositionForNode() && !nodeIsUserSelectNone(node());
     
     return false;
 }
@@ -584,17 +723,17 @@ bool Position::inRenderedText() const
     if (!renderer)
         return false;
     
-    RenderText *textRenderer = static_cast<RenderText *>(renderer);
+    RenderText *textRenderer = toRenderText(renderer);
     for (InlineTextBox *box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
-        if (offset() < box->m_start && !textRenderer->containsReversedText()) {
+        if (m_offset < static_cast<int>(box->start()) && !textRenderer->containsReversedText()) {
             // The offset we're looking for is before this node
             // this means the offset must be in content that is
             // not rendered. Return false.
             return false;
         }
-        if (box->containsCaretOffset(offset()))
+        if (box->containsCaretOffset(m_offset))
             // Return false for offsets inside composed characters.
-            return offset() == 0 || offset() == textRenderer->nextOffset(textRenderer->previousOffset(offset()));
+            return m_offset == 0 || m_offset == textRenderer->nextOffset(textRenderer->previousOffset(m_offset));
     }
     
     return false;
@@ -616,19 +755,19 @@ bool Position::isRenderedCharacter() const
     if (isNull() || !node()->isTextNode())
         return false;
         
-    RenderObject *renderer = node()->renderer();
+    RenderObject* renderer = node()->renderer();
     if (!renderer)
         return false;
     
-    RenderText *textRenderer = static_cast<RenderText *>(renderer);
-    for (InlineTextBox *box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
-        if (offset() < box->m_start && !textRenderer->containsReversedText()) {
+    RenderText* textRenderer = toRenderText(renderer);
+    for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
+        if (m_offset < static_cast<int>(box->start()) && !textRenderer->containsReversedText()) {
             // The offset we're looking for is before this node
             // this means the offset must be in content that is
             // not rendered. Return false.
             return false;
         }
-        if (offset() >= box->m_start && offset() < box->m_start + box->m_len)
+        if (m_offset >= static_cast<int>(box->start()) && m_offset < static_cast<int>(box->start() + box->len()))
             return true;
     }
     
@@ -656,11 +795,11 @@ bool Position::rendersInDifferentPosition(const Position &pos) const
         if (node()->hasTagName(brTag))
             return false;
 
-        if (offset() == pos.offset())
+        if (m_offset == pos.deprecatedEditingOffset())
             return false;
             
         if (!node()->isTextNode() && !pos.node()->isTextNode()) {
-            if (offset() != pos.offset())
+            if (m_offset != pos.deprecatedEditingOffset())
                 return true;
         }
     }
@@ -734,7 +873,7 @@ Position Position::leadingWhitespacePosition(EAffinity affinity, bool considerNo
     Position prev = previousCharacterPosition(affinity);
     if (prev != *this && prev.node()->inSameContainingBlockFlowElement(node()) && prev.node()->isTextNode()) {
         String string = static_cast<Text *>(prev.node())->data();
-        UChar c = string[prev.offset()];
+        UChar c = string[prev.deprecatedEditingOffset()];
         if (considerNonCollapsibleWhitespace ? (isSpaceOrNewline(c) || c == noBreakSpace) : isCollapsibleWhitespace(c))
             if (isEditablePosition(prev))
                 return prev;
@@ -795,7 +934,7 @@ static InlineTextBox* searchAheadForBetterMatch(RenderObject* renderer)
         if (isNonTextLeafChild(next))
             break;
         if (next->isText()) {
-            for (InlineTextBox* box = static_cast<RenderText*>(next)->firstTextBox(); box; box = box->nextTextBox()) {
+            for (InlineTextBox* box = toRenderText(next)->firstTextBox(); box; box = box->nextTextBox()) {
                 int caretMinOffset = box->caretMinOffset();
                 if (caretMinOffset < minOffset) {
                     match = box;
@@ -809,14 +948,14 @@ static InlineTextBox* searchAheadForBetterMatch(RenderObject* renderer)
 
 void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDirection, InlineBox*& inlineBox, int& caretOffset) const
 {
-    caretOffset = offset();
+    caretOffset = m_offset;
     RenderObject* renderer = node()->renderer();
     if (!renderer->isText()) {
-        inlineBox = renderer->inlineBoxWrapper();
-        if (!inlineBox || caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset())
+        inlineBox = renderer->isBox() ? toRenderBox(renderer)->inlineBoxWrapper() : 0;
+        if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
             return;
     } else {
-        RenderText* textRenderer = static_cast<RenderText*>(renderer);
+        RenderText* textRenderer = toRenderText(renderer);
 
         InlineTextBox* box;
         InlineTextBox* candidate = 0;
@@ -825,7 +964,7 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             int caretMinOffset = box->caretMinOffset();
             int caretMaxOffset = box->caretMaxOffset();
 
-            if (caretOffset < caretMinOffset || caretOffset > caretMaxOffset || caretOffset == caretMaxOffset && box->isLineBreak())
+            if (caretOffset < caretMinOffset || caretOffset > caretMaxOffset || (caretOffset == caretMaxOffset && box->isLineBreak()))
                 continue;
 
             if (caretOffset > caretMinOffset && caretOffset < caretMaxOffset) {
@@ -943,7 +1082,7 @@ void Position::debugPosition(const char* msg) const
     if (isNull())
         fprintf(stderr, "Position [%s]: null\n", msg);
     else
-        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, node()->nodeName().utf8().data(), node(), offset());
+        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, node()->nodeName().utf8().data(), node(), m_offset);
 }
 
 #ifndef NDEBUG
@@ -957,7 +1096,7 @@ void Position::formatForDebugger(char* buffer, unsigned length) const
     else {
         char s[1024];
         result += "offset ";
-        result += String::number(offset());
+        result += String::number(m_offset);
         result += " of ";
         node()->formatForDebugger(s, sizeof(s));
         result += s;
@@ -984,6 +1123,19 @@ Position endPosition(const Range* r)
     return r ? r->endPosition() : Position();
 }
 
+// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
+// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
+// as "the last position before the img"
+Position firstDeepEditingPositionForNode(Node* node)
+{
+    return Position(node, 0);
+}
+
+Position lastDeepEditingPositionForNode(Node* node)
+{
+    return Position(node, lastOffsetForEditing(node));
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.h b/src/3rdparty/webkit/WebCore/dom/Position.h
index 2624238169..57f73ec8a5 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.h
+++ b/src/3rdparty/webkit/WebCore/dom/Position.h
@@ -28,6 +28,7 @@
 
 #include "TextAffinity.h"
 #include "TextDirection.h"
+#include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -40,28 +41,76 @@ class Node;
 class Range;
 class RenderObject;
 
-enum EUsingComposedCharacters { NotUsingComposedCharacters = false, UsingComposedCharacters = true };
-
-// FIXME: Reduce the number of operations we have on a Position.
-// This should be more like a humble struct, without so many different
-// member functions. We should find better homes for these functions.
+enum PositionMoveType {
+    CodePoint,       // Move by a single code point.
+    Character,       // Move to the next Unicode character break.
+    BackwardDeletion // Subject to platform conventions.
+};
 
 class Position {
 public:
-    RefPtr<Node> container;
-    int posOffset; // to be renamed to offset when we get rid of offset()
-
-    Position() : posOffset(0) { }
-    Position(PassRefPtr<Node> c, int o) : container(c), posOffset(o) { }
-
-    void clear() { container.clear(); posOffset = 0; }
-
-    Node* node() const { return container.get(); }
-    int offset() const { return posOffset; }
-    Element* documentElement() const;
-
-    bool isNull() const { return !container; }
-    bool isNotNull() const { return container; }
+    enum AnchorType {
+        PositionIsOffsetInAnchor,
+        PositionIsAfterAnchor,
+        PositionIsBeforeAnchor
+    };
+
+    Position()
+        : m_offset(0)
+        , m_anchorType(PositionIsOffsetInAnchor)
+        , m_isLegacyEditingPosition(false)
+    {
+    }
+
+    // For creating legacy editing positions: (Anchor type will be determined from editingIgnoresContent(node))
+    Position(PassRefPtr<Node> anchorNode, int offset);
+
+    // For creating before/after positions:
+    Position(PassRefPtr<Node> anchorNode, AnchorType);
+    // For creating offset positions:
+    Position(PassRefPtr<Node> anchorNode, int offset, AnchorType);
+
+    AnchorType anchorType() const { return m_anchorType; }
+
+    void clear() { m_anchorNode.clear(); m_offset = 0; m_anchorType = PositionIsOffsetInAnchor; m_isLegacyEditingPosition = false; }
+
+    // These are always DOM compliant values.  Editing positions like [img, 0] (aka [img, before])
+    // will return img->parentNode() and img->nodeIndex() from these functions.
+    Node* containerNode() const; // NULL for a before/after position anchored to a node with no parent
+    int computeOffsetInContainerNode() const;  // O(n) for before/after-anchored positions, O(1) for parent-anchored positions
+
+    // Inline O(1) access for Positions which callers know to be parent-anchored
+    int offsetInContainerNode() const
+    {
+        ASSERT(anchorType() == PositionIsOffsetInAnchor);
+        return m_offset;
+    }
+
+    // New code should not use this function.
+    int deprecatedEditingOffset() const
+    {
+        // This should probably ASSERT(m_isLegacyEditingPosition);
+        return m_offset;
+    }
+
+    // These are convenience methods which are smart about whether the position is neighbor anchored or parent anchored
+    Node* computeNodeBeforePosition() const;
+    Node* computeNodeAfterPosition() const;
+
+    Node* anchorNode() const { return m_anchorNode.get(); }
+
+    // FIXME: Callers should be moved off of node(), node() is not always the container for this position.
+    // For nodes which editingIgnoresContent(node()) returns true, positions like [ignoredNode, 0]
+    // will be treated as before ignoredNode (thus node() is really after the position, not containing it).
+    Node* node() const { return m_anchorNode.get(); }
+
+    // These should only be used for PositionIsOffsetInAnchor positions, unless
+    // the position is a legacy editing position.
+    void moveToPosition(PassRefPtr<Node> anchorNode, int offset);
+    void moveToOffset(int offset);
+
+    bool isNull() const { return !m_anchorNode; }
+    bool isNotNull() const { return m_anchorNode; }
 
     Element* element() const;
     PassRefPtr<CSSComputedStyleDeclaration> computedStyle() const;
@@ -69,13 +118,19 @@ public:
     // Move up or down the DOM by one position.
     // Offsets are computed using render text for nodes that have renderers - but note that even when
     // using composed characters, the result may be inside a single user-visible character if a ligature is formed.
-    Position previous(EUsingComposedCharacters usingComposedCharacters=NotUsingComposedCharacters) const;
-    Position next(EUsingComposedCharacters usingComposedCharacters=NotUsingComposedCharacters) const;
+    Position previous(PositionMoveType = CodePoint) const;
+    Position next(PositionMoveType = CodePoint) const;
     static int uncheckedPreviousOffset(const Node*, int current);
+    static int uncheckedPreviousOffsetForBackwardDeletion(const Node*, int current);
     static int uncheckedNextOffset(const Node*, int current);
 
-    bool atStart() const;
-    bool atEnd() const;
+    // These can be either inside or just before/after the node, depending on
+    // if the node is ignored by editing or not.
+    bool atFirstEditingPositionForNode() const;
+    bool atLastEditingPositionForNode() const;
+
+    bool atStartOfTree() const;
+    bool atEndOfTree() const;
 
     // FIXME: Make these non-member functions and put them somewhere in the editing directory.
     // These aren't really basic "position" operations. More high level editing helper functions.
@@ -109,11 +164,23 @@ private:
 
     Position previousCharacterPosition(EAffinity) const;
     Position nextCharacterPosition(EAffinity) const;
+
+    static AnchorType anchorTypeForLegacyEditingPosition(Node* anchorNode, int offset);
+
+    RefPtr<Node> m_anchorNode;
+    // m_offset can be the offset inside m_anchorNode, or if editingIgnoresContent(m_anchorNode)
+    // returns true, then other places in editing will treat m_offset == 0 as "before the anchor"
+    // and m_offset > 0 as "after the anchor node".  See rangeCompliantEquivalent for more info.
+    int m_offset;
+    AnchorType m_anchorType : 2;
+    bool m_isLegacyEditingPosition : 1;
 };
 
 inline bool operator==(const Position& a, const Position& b)
 {
-    return a.container == b.container && a.posOffset == b.posOffset;
+    // FIXME: In <div><img></div> [div, 0] != [img, 0] even though most of the
+    // editing code will treat them as identical.
+    return a.anchorNode() == b.anchorNode() && a.deprecatedEditingOffset() == b.deprecatedEditingOffset();
 }
 
 inline bool operator!=(const Position& a, const Position& b)
@@ -124,6 +191,12 @@ inline bool operator!=(const Position& a, const Position& b)
 Position startPosition(const Range*);
 Position endPosition(const Range*);
 
+// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
+// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
+// as "the last position before the img"
+Position firstDeepEditingPositionForNode(Node*);
+Position lastDeepEditingPositionForNode(Node*);
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
index 218ace16dd..a029b5e2b3 100644
--- a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
@@ -27,7 +27,7 @@
 #include "PositionIterator.h"
 
 #include "Node.h"
-#include "RenderObject.h"
+#include "RenderBlock.h"
 #include "htmlediting.h"
 
 namespace WebCore {
@@ -36,105 +36,111 @@ using namespace HTMLNames;
 
 PositionIterator::operator Position() const
 {
-    return Position(m_parent, m_child ? m_child->nodeIndex() : (m_parent->hasChildNodes() ? maxDeepOffset(m_parent) : m_offset));
+    if (m_nodeAfterPositionInAnchor) {
+        ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
+        return positionBeforeNode(m_nodeAfterPositionInAnchor);
+    }
+    if (m_anchorNode->hasChildNodes())
+        return lastDeepEditingPositionForNode(m_anchorNode);
+    return Position(m_anchorNode, m_offsetInAnchor);
 }
 
 void PositionIterator::increment()
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return;
 
-    if (m_child) {
-        m_parent = m_child;
-        m_child = m_parent->firstChild();
-        m_offset = 0;
+    if (m_nodeAfterPositionInAnchor) {
+        m_anchorNode = m_nodeAfterPositionInAnchor;
+        m_nodeAfterPositionInAnchor = m_anchorNode->firstChild();
+        m_offsetInAnchor = 0;
         return;
     }
 
-    if (!m_parent->hasChildNodes() && m_offset < maxDeepOffset(m_parent))
-        m_offset = Position::uncheckedNextOffset(m_parent, m_offset);
+    if (!m_anchorNode->hasChildNodes() && m_offsetInAnchor < lastOffsetForEditing(m_anchorNode))
+        m_offsetInAnchor = Position::uncheckedNextOffset(m_anchorNode, m_offsetInAnchor);
     else {
-        m_child = m_parent;
-        m_parent = m_child->parentNode();
-        m_child = m_child->nextSibling();
-        m_offset = 0;
+        m_nodeAfterPositionInAnchor = m_anchorNode;
+        m_anchorNode = m_nodeAfterPositionInAnchor->parentNode();
+        m_nodeAfterPositionInAnchor = m_nodeAfterPositionInAnchor->nextSibling();
+        m_offsetInAnchor = 0;
     }
 }
 
 void PositionIterator::decrement()
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return;
 
-    if (m_child) {
-        m_parent = m_child->previousSibling();
-        if (m_parent) {
-            m_child = 0;
-            m_offset = m_parent->hasChildNodes() ? 0 : maxDeepOffset(m_parent);
+    if (m_nodeAfterPositionInAnchor) {
+        m_anchorNode = m_nodeAfterPositionInAnchor->previousSibling();
+        if (m_anchorNode) {
+            m_nodeAfterPositionInAnchor = 0;
+            m_offsetInAnchor = m_anchorNode->hasChildNodes() ? 0 : lastOffsetForEditing(m_anchorNode);
         } else {
-            m_child = m_child->parentNode();
-            m_parent = m_child->parentNode();
-            m_offset = 0;
+            m_nodeAfterPositionInAnchor = m_nodeAfterPositionInAnchor->parentNode();
+            m_anchorNode = m_nodeAfterPositionInAnchor->parentNode();
+            m_offsetInAnchor = 0;
         }
         return;
     }
 
-    if (m_offset) {
-        m_offset = Position::uncheckedPreviousOffset(m_parent, m_offset);
+    if (m_offsetInAnchor) {
+        m_offsetInAnchor = Position::uncheckedPreviousOffset(m_anchorNode, m_offsetInAnchor);
     } else {
-        if (m_parent->hasChildNodes()) {
-            m_parent = m_parent->lastChild();
-            if (!m_parent->hasChildNodes())
-                m_offset = maxDeepOffset(m_parent);
+        if (m_anchorNode->hasChildNodes()) {
+            m_anchorNode = m_anchorNode->lastChild();
+            if (!m_anchorNode->hasChildNodes())
+                m_offsetInAnchor = lastOffsetForEditing(m_anchorNode);
         } else {
-            m_child = m_parent;
-            m_parent = m_parent->parentNode();
+            m_nodeAfterPositionInAnchor = m_anchorNode;
+            m_anchorNode = m_anchorNode->parentNode();
         }
     }
 }
 
 bool PositionIterator::atStart() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_parent->parentNode())
+    if (m_anchorNode->parentNode())
         return false;
-    return !m_parent->hasChildNodes() && !m_offset || m_child && !m_child->previousSibling();
+    return (!m_anchorNode->hasChildNodes() && !m_offsetInAnchor) || (m_nodeAfterPositionInAnchor && !m_nodeAfterPositionInAnchor->previousSibling());
 }
 
 bool PositionIterator::atEnd() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_child)
+    if (m_nodeAfterPositionInAnchor)
         return false;
-    return !m_parent->parentNode() && (m_parent->hasChildNodes() || m_offset >= maxDeepOffset(m_parent));
+    return !m_anchorNode->parentNode() && (m_anchorNode->hasChildNodes() || m_offsetInAnchor >= lastOffsetForEditing(m_anchorNode));
 }
 
 bool PositionIterator::atStartOfNode() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (!m_child)
-        return !m_parent->hasChildNodes() && !m_offset;
-    return !m_child->previousSibling();
+    if (!m_nodeAfterPositionInAnchor)
+        return !m_anchorNode->hasChildNodes() && !m_offsetInAnchor;
+    return !m_nodeAfterPositionInAnchor->previousSibling();
 }
 
 bool PositionIterator::atEndOfNode() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_child)
+    if (m_nodeAfterPositionInAnchor)
         return false;
-    return m_parent->hasChildNodes() || m_offset >= maxDeepOffset(m_parent);
+    return m_anchorNode->hasChildNodes() || m_offsetInAnchor >= lastOffsetForEditing(m_anchorNode);
 }
 
 bool PositionIterator::isCandidate() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return false;
 
-    RenderObject* renderer = m_parent->renderer();
+    RenderObject* renderer = m_anchorNode->renderer();
     if (!renderer)
         return false;
     
@@ -142,17 +148,17 @@ bool PositionIterator::isCandidate() const
         return false;
 
     if (renderer->isBR())
-        return !m_offset && !Position::nodeIsUserSelectNone(m_parent->parent());
+        return !m_offsetInAnchor && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
     if (renderer->isText())
-        return Position(*this).inRenderedText() && !Position::nodeIsUserSelectNone(m_parent);
+        return Position(*this).inRenderedText() && !Position::nodeIsUserSelectNone(m_anchorNode);
 
-    if (isTableElement(m_parent) || editingIgnoresContent(m_parent))
-        return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_parent->parent());
+    if (isTableElement(m_anchorNode) || editingIgnoresContent(m_anchorNode))
+        return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
-    if (!m_parent->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (renderer->height() || m_parent->hasTagName(bodyTag)))
-        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_parent);
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
+       (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)))
+        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
     
     return false;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/PositionIterator.h b/src/3rdparty/webkit/WebCore/dom/PositionIterator.h
index 54f502066a..7af8977591 100644
--- a/src/3rdparty/webkit/WebCore/dom/PositionIterator.h
+++ b/src/3rdparty/webkit/WebCore/dom/PositionIterator.h
@@ -37,16 +37,16 @@ namespace WebCore {
 class PositionIterator {
 public:
     PositionIterator()
-        : m_parent(0)
-        , m_child(0)
-        , m_offset(0)
+        : m_anchorNode(0)
+        , m_nodeAfterPositionInAnchor(0)
+        , m_offsetInAnchor(0)
     {
     }
 
     PositionIterator(const Position& pos)
-        : m_parent(pos.node())
-        , m_child(m_parent->childNode(pos.offset()))
-        , m_offset(m_child ? 0 : pos.offset())
+        : m_anchorNode(pos.anchorNode())
+        , m_nodeAfterPositionInAnchor(m_anchorNode->childNode(pos.deprecatedEditingOffset()))
+        , m_offsetInAnchor(m_nodeAfterPositionInAnchor ? 0 : pos.deprecatedEditingOffset())
     {
     }
     operator Position() const;
@@ -54,8 +54,8 @@ public:
     void increment();
     void decrement();
 
-    Node* node() const { return m_parent; }
-    int offsetInLeafNode() const { return m_offset; }
+    Node* node() const { return m_anchorNode; }
+    int offsetInLeafNode() const { return m_offsetInAnchor; }
 
     bool atStart() const;
     bool atEnd() const;
@@ -64,9 +64,9 @@ public:
     bool isCandidate() const;
 
 private:
-    Node* m_parent;
-    Node* m_child;
-    int m_offset;
+    Node* m_anchorNode;
+    Node* m_nodeAfterPositionInAnchor; // If this is non-null, m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode;
+    int m_offsetInAnchor;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
index d0923f1678..578b22e80a 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
@@ -32,7 +32,7 @@ module core {
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString data
                      setter raises(DOMException);
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // interface LinkStyle from DOM Level 2 Style Sheets
         readonly attribute StyleSheet sheet;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
index f40f398b43..607c846afc 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
@@ -1,7 +1,5 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 2005, 2006 Apple Computer, Inc.
+/*
+ * Copyright (C) 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -54,39 +52,16 @@ struct QNameComponentsTranslator {
 static QNameSet* gNameCache;
 
 QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
-    : m_impl(0)
 {
     if (!gNameCache)
         gNameCache = new QNameSet;
-    QualifiedNameComponents components = { p.impl(), l.impl(), n.impl() };
+    QualifiedNameComponents components = { p.impl(), l.impl(), n.isEmpty() ? nullAtom.impl() : n.impl() };
     pair<QNameSet::iterator, bool> addResult = gNameCache->add<QualifiedNameComponents, QNameComponentsTranslator>(components);
     m_impl = *addResult.first;    
     if (!addResult.second)
         m_impl->ref();
 }
 
-QualifiedName::~QualifiedName()
-{
-    deref();
-}
-
-QualifiedName::QualifiedName(const QualifiedName& other)
-{
-    m_impl = other.m_impl;
-    ref();
-}
-
-const QualifiedName& QualifiedName::operator=(const QualifiedName& other)
-{
-    if (m_impl != other.m_impl) {
-        deref();
-        m_impl = other.m_impl;
-        ref();
-    }
-    
-    return *this;
-}
-
 void QualifiedName::deref()
 {
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
@@ -99,12 +74,6 @@ void QualifiedName::deref()
     m_impl->deref();
 }
 
-void QualifiedName::setPrefix(const AtomicString& prefix)
-{
-    QualifiedName other(prefix, localName(), namespaceURI());
-    *this = other;
-}
-
 String QualifiedName::toString() const
 {
     String local = localName();
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
index d09cdeaa35..939927bf11 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
@@ -1,7 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 2005 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,6 +17,7 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #ifndef QualifiedName_h
 #define QualifiedName_h
 
@@ -26,7 +25,7 @@
 #include <wtf/HashFunctions.h>
 
 namespace WebCore {
-    
+
 struct QualifiedNameComponents {
     StringImpl* m_prefix;
     StringImpl* m_localName;
@@ -37,32 +36,33 @@ class QualifiedName {
 public:
     class QualifiedNameImpl : public RefCounted<QualifiedNameImpl> {
     public:
-        static PassRefPtr<QualifiedNameImpl> create(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+        static PassRefPtr<QualifiedNameImpl> create(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
         {
-            return adoptRef(new QualifiedNameImpl(p, l, n));
+            return adoptRef(new QualifiedNameImpl(prefix, localName, namespaceURI));
         }
-        
+
         AtomicString m_prefix;
         AtomicString m_localName;
         AtomicString m_namespace;
 
     private:
-        QualifiedNameImpl(const AtomicString& p, const AtomicString& l, const AtomicString& n)
-            : m_prefix(p)
-            , m_localName(l)
-            , m_namespace(n)
+        QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
+            : m_prefix(prefix)
+            , m_localName(localName)
+            , m_namespace(namespaceURI)
         {
+            ASSERT(!namespaceURI.isEmpty() || namespaceURI.isNull());
         }        
     };
 
     QualifiedName(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
-    ~QualifiedName();
+    ~QualifiedName() { deref(); }
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
     QualifiedName() : m_impl(0) { }
 #endif
 
-    QualifiedName(const QualifiedName&);
-    const QualifiedName& operator=(const QualifiedName&);
+    QualifiedName(const QualifiedName& other) : m_impl(other.m_impl) { ref(); }
+    const QualifiedName& operator=(const QualifiedName& other) { other.ref(); deref(); m_impl = other.m_impl; return *this; }
 
     bool operator==(const QualifiedName& other) const { return m_impl == other.m_impl; }
     bool operator!=(const QualifiedName& other) const { return !(*this == other); }
@@ -70,7 +70,7 @@ public:
     bool matches(const QualifiedName& other) const { return m_impl == other.m_impl || (localName() == other.localName() && namespaceURI() == other.namespaceURI()); }
 
     bool hasPrefix() const { return m_impl->m_prefix != nullAtom; }
-    void setPrefix(const AtomicString& prefix);
+    void setPrefix(const AtomicString& prefix) { *this = QualifiedName(prefix, localName(), namespaceURI()); }
 
     const AtomicString& prefix() const { return m_impl->m_prefix; }
     const AtomicString& localName() const { return m_impl->m_localName; }
@@ -84,7 +84,7 @@ public:
     static void init();
     
 private:
-    void ref() { m_impl->ref(); }
+    void ref() const { m_impl->ref(); }
     void deref();
     
     QualifiedNameImpl* m_impl;
@@ -100,7 +100,6 @@ inline bool operator!=(const AtomicString& a, const QualifiedName& q) { return a
 inline bool operator==(const QualifiedName& q, const AtomicString& a) { return a == q.localName(); }
 inline bool operator!=(const QualifiedName& q, const AtomicString& a) { return a != q.localName(); }
 
-
 inline unsigned hashComponents(const QualifiedNameComponents& buf)
 {
     ASSERT(sizeof(QualifiedNameComponents) % (sizeof(uint16_t) * 2) == 0);
@@ -154,6 +153,7 @@ struct QualifiedNameHash {
 namespace WTF {
     
     template<typename T> struct DefaultHash;
+
     template<> struct DefaultHash<WebCore::QualifiedName> {
         typedef WebCore::QualifiedNameHash Hash;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index ab1a42dce7..8a3ca8f800 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -26,16 +26,13 @@
 #include "RangeException.h"
 
 #include "CString.h"
-#include "Document.h"
 #include "DocumentFragment.h"
-#include "ExceptionCode.h"
 #include "HTMLElement.h"
-#include "HTMLNames.h"
 #include "NodeWithIndex.h"
 #include "ProcessingInstruction.h"
-#include "RenderBlock.h"
 #include "Text.h"
 #include "TextIterator.h"
+#include "VisiblePosition.h"
 #include "markup.h"
 #include "visible_units.h"
 #include <stdio.h>
@@ -44,7 +41,6 @@
 namespace WebCore {
 
 using namespace std;
-using namespace HTMLNames;
 
 #ifndef NDEBUG
 static WTF::RefCountedLeakCounter rangeCounter("Range");
@@ -94,7 +90,7 @@ PassRefPtr<Range> Range::create(PassRefPtr<Document> ownerDocument, PassRefPtr<N
 
 PassRefPtr<Range> Range::create(PassRefPtr<Document> ownerDocument, const Position& start, const Position& end)
 {
-    return adoptRef(new Range(ownerDocument, start.container.get(), start.posOffset, end.container.get(), end.posOffset));
+    return adoptRef(new Range(ownerDocument, start.node(), start.deprecatedEditingOffset(), end.node(), end.deprecatedEditingOffset()));
 }
 
 Range::~Range()
@@ -212,7 +208,7 @@ void Range::setStart(PassRefPtr<Node> refNode, int offset, ExceptionCode& ec)
     if (startRootContainer != endRootContainer)
         collapse(true, ec);
     // check if new start after end
-    else if (compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) > 0)
+    else if (compareBoundaryPoints(m_start, m_end) > 0)
         collapse(true, ec);
 }
 
@@ -250,7 +246,7 @@ void Range::setEnd(PassRefPtr<Node> refNode, int offset, ExceptionCode& ec)
     if (startRootContainer != endRootContainer)
         collapse(false, ec);
     // check if new end before start
-    if (compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) > 0)
+    if (compareBoundaryPoints(m_start, m_end) > 0)
         collapse(false, ec);
 }
 
@@ -269,17 +265,17 @@ void Range::collapse(bool toStart, ExceptionCode& ec)
 
 bool Range::isPointInRange(Node* refNode, int offset, ExceptionCode& ec)
 {
-    if (!refNode) {
-        ec = NOT_FOUND_ERR;
+    if (!m_start.container()) {
+        ec = INVALID_STATE_ERR;
         return false;
     }
 
-    if (!m_start.container() && refNode->attached()) {
-        ec = INVALID_STATE_ERR;
+    if (!refNode) {
+        ec = HIERARCHY_REQUEST_ERR;
         return false;
     }
 
-    if (m_start.container() && !refNode->attached()) {
+    if (!refNode->attached()) {
         // Firefox doesn't throw an exception for this case; it returns false.
         return false;
     }
@@ -304,22 +300,17 @@ short Range::comparePoint(Node* refNode, int offset, ExceptionCode& ec)
     // This method returns -1, 0 or 1 depending on if the point described by the 
     // refNode node and an offset within the node is before, same as, or after the range respectively.
 
-    if (!refNode) {
-        ec = NOT_FOUND_ERR;
-        return 0;
-    }
-
-    if (!m_start.container() && refNode->attached()) {
+    if (!m_start.container()) {
         ec = INVALID_STATE_ERR;
         return 0;
     }
 
-    if (m_start.container() && !refNode->attached()) {
-        // Firefox doesn't throw an exception for this case; it returns -1.
-        return -1;
+    if (!refNode) {
+        ec = HIERARCHY_REQUEST_ERR;
+        return 0;
     }
 
-    if (refNode->document() != m_ownerDocument) {
+    if (!refNode->attached() || refNode->document() != m_ownerDocument) {
         ec = WRONG_DOCUMENT_ERR;
         return 0;
     }
@@ -427,17 +418,13 @@ short Range::compareBoundaryPoints(CompareHow how, const Range* sourceRange, Exc
 
     switch (how) {
         case START_TO_START:
-            return compareBoundaryPoints(m_start.container(), m_start.offset(),
-                sourceRange->m_start.container(), sourceRange->m_start.offset());
+            return compareBoundaryPoints(m_start, sourceRange->m_start);
         case START_TO_END:
-            return compareBoundaryPoints(m_end.container(), m_end.offset(),
-                sourceRange->m_start.container(), sourceRange->m_start.offset());
+            return compareBoundaryPoints(m_end, sourceRange->m_start);
         case END_TO_END:
-            return compareBoundaryPoints(m_end.container(), m_end.offset(),
-                sourceRange->m_end.container(), sourceRange->m_end.offset());
+            return compareBoundaryPoints(m_end, sourceRange->m_end);
         case END_TO_START:
-            return compareBoundaryPoints(m_start.container(), m_start.offset(),
-                sourceRange->m_end.container(), sourceRange->m_end.offset());
+            return compareBoundaryPoints(m_start, sourceRange->m_end);
     }
 
     ec = SYNTAX_ERR;
@@ -446,11 +433,14 @@ short Range::compareBoundaryPoints(CompareHow how, const Range* sourceRange, Exc
 
 short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB)
 {
-    ASSERT(containerA && containerB);
+    ASSERT(containerA);
+    ASSERT(containerB);
+
     if (!containerA)
         return -1;
     if (!containerB)
         return 1;
+
     // see DOM2 traversal & range section 2.5
 
     // case 1: both points have the same container
@@ -532,14 +522,14 @@ short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containe
     return 0;
 }
 
-short Range::compareBoundaryPoints(const Position& a, const Position& b)
+short Range::compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB)
 {
-    return compareBoundaryPoints(a.container.get(), a.posOffset, b.container.get(), b.posOffset);
+    return compareBoundaryPoints(boundaryA.container(), boundaryA.offset(), boundaryB.container(), boundaryB.offset());
 }
 
 bool Range::boundaryPointsValid() const
 {
-    return m_start.container() && compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) <= 0;
+    return m_start.container() && compareBoundaryPoints(m_start, m_end) <= 0;
 }
 
 void Range::deleteContents(ExceptionCode& ec)
@@ -561,8 +551,8 @@ bool Range::intersectsNode(Node* refNode, ExceptionCode& ec)
         return false;
     }
     
-    if (!m_start.container() && refNode->attached()
-            || m_start.container() && !refNode->attached()
+    if ((!m_start.container() && refNode->attached())
+            || (m_start.container() && !refNode->attached())
             || refNode->document() != m_ownerDocument) {
         // Firefox doesn't throw an exception for these cases; it returns false.
         return false;
@@ -847,6 +837,17 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
             processEnd = processEnd->parentNode();
     }
 
+    // Collapse the range, making sure that the result is not within a node that was partially selected.
+    if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
+        if (partialStart)
+            setStart(partialStart->parentNode(), partialStart->nodeIndex() + 1, ec);
+        else if (partialEnd)
+            setStart(partialEnd->parentNode(), partialEnd->nodeIndex(), ec);
+        if (ec)
+            return 0;
+        m_end = m_start;
+    }
+
     // Now add leftContents, stuff in between, and rightContents to the fragment
     // (or just delete the stuff in between)
 
@@ -986,7 +987,7 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
         // This special case doesn't seem to match the DOM specification, but it's currently required
         // to pass Acid3. We might later decide to remove this.
         if (collapsed)
-            m_end.setToChild(newText.get());
+            m_end.setToBeforeChild(newText.get());
     } else {
         RefPtr<Node> lastChild;
         if (collapsed)
@@ -1350,8 +1351,8 @@ void Range::selectNodeContents(Node* refNode, ExceptionCode& ec)
         }
     }
 
-    m_start.setToStart(refNode);
-    m_end.setToEnd(refNode);
+    m_start.setToStartOfNode(refNode);
+    m_end.setToEndOfNode(refNode);
 }
 
 void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
@@ -1580,31 +1581,30 @@ IntRect Range::boundingBox()
 {
     IntRect result;
     Vector<IntRect> rects;
-    addLineBoxRects(rects);
+    textRects(rects);
     const size_t n = rects.size();
     for (size_t i = 0; i < n; ++i)
         result.unite(rects[i]);
     return result;
 }
 
-void Range::addLineBoxRects(Vector<IntRect>& rects, bool useSelectionHeight)
+void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
 {
     if (!m_start.container() || !m_end.container())
         return;
 
-    RenderObject* start = m_start.container()->renderer();
-    RenderObject* end = m_end.container()->renderer();
-    if (!start || !end)
-        return;
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
 
-    RenderObject* stop = end->nextInPreOrderAfterChildren();
-    for (RenderObject* r = start; r && r != stop; r = r->nextInPreOrder()) {
-        // only ask leaf render objects for their line box rects
-        if (!r->firstChild()) {
-            int startOffset = r == start ? m_start.offset() : 0;
-            int endOffset = r == end ? m_end.offset() : INT_MAX;
-            r->addLineBoxRects(rects, startOffset, endOffset, useSelectionHeight);
-        }
+    Node* stopNode = pastLastNode();
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? m_start.offset() : 0;
+        int endOffset = node == endContainer ? m_end.offset() : INT_MAX;
+        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
     }
 }
 
@@ -1700,7 +1700,7 @@ static inline void boundaryNodeWillBeRemoved(RangeBoundaryPoint& boundary, Node*
 
     for (Node* n = boundary.container(); n; n = n->parentNode()) {
         if (n == nodeToBeRemoved) {
-            boundary.setToChild(nodeToBeRemoved);
+            boundary.setToBeforeChild(nodeToBeRemoved);
             return;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index 49dea82262..115f44258c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -66,7 +66,7 @@ public:
     enum CompareHow { START_TO_START, START_TO_END, END_TO_END, END_TO_START };
     short compareBoundaryPoints(CompareHow, const Range* sourceRange, ExceptionCode&) const;
     static short compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB);
-    static short compareBoundaryPoints(const Position&, const Position&);
+    static short compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB);
     bool boundaryPointsValid() const;
     bool intersectsNode(Node* refNode, ExceptionCode&);
     void deleteContents(ExceptionCode&);
@@ -91,8 +91,8 @@ public:
     void surroundContents(PassRefPtr<Node>, ExceptionCode&);
     void setStartBefore(Node*, ExceptionCode&);
 
-    const Position& startPosition() const { return m_start.position(); }
-    const Position& endPosition() const { return m_end.position(); }
+    const Position startPosition() const { return m_start.toPosition(); }
+    const Position endPosition() const { return m_end.toPosition(); }
 
     Node* firstNode() const;
     Node* pastLastNode() const;
@@ -102,7 +102,7 @@ public:
     Node* shadowTreeRootNode() const;
 
     IntRect boundingBox();
-    void addLineBoxRects(Vector<IntRect>&, bool useSelectionHeight = false);
+    void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
     void nodeWillBeRemoved(Node*);
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.idl b/src/3rdparty/webkit/WebCore/dom/Range.idl
index 4344474b1a..0750c32b39 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Range.idl
@@ -112,7 +112,7 @@ module ranges {
                                in long offset)
             raises(RangeException, DOMException);
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute DOMString text;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h b/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h
index 4cb7bf5154..2fda51f0cf 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h
+++ b/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h
@@ -36,7 +36,8 @@ public:
     RangeBoundaryPoint();
     explicit RangeBoundaryPoint(PassRefPtr<Node> container);
 
-    const Position& position() const;
+    const Position toPosition() const;
+
     Node* container() const;
     int offset() const;
     Node* childBefore() const;
@@ -45,122 +46,135 @@ public:
 
     void set(PassRefPtr<Node> container, int offset, Node* childBefore);
     void setOffset(int offset);
-    void setToChild(Node* child);
-    void setToStart(PassRefPtr<Node> container);
-    void setToEnd(PassRefPtr<Node> container);
+
+    void setToBeforeChild(Node*);
+    void setToStartOfNode(PassRefPtr<Node>);
+    void setToEndOfNode(PassRefPtr<Node>);
 
     void childBeforeWillBeRemoved();
     void invalidateOffset() const;
+    void ensureOffsetIsValid() const;
 
 private:
     static const int invalidOffset = -1;
-
-    mutable Position m_position;
-    Node* m_childBefore;
+    
+    RefPtr<Node> m_containerNode;
+    mutable int m_offsetInContainer;
+    Node* m_childBeforeBoundary;
 };
 
 inline RangeBoundaryPoint::RangeBoundaryPoint()
-    : m_childBefore(0)
+    : m_offsetInContainer(0)
+    , m_childBeforeBoundary(0)
 {
 }
 
 inline RangeBoundaryPoint::RangeBoundaryPoint(PassRefPtr<Node> container)
-    : m_position(container, 0)
-    , m_childBefore(0)
+    : m_containerNode(container)
+    , m_offsetInContainer(0)
+    , m_childBeforeBoundary(0)
 {
 }
 
 inline Node* RangeBoundaryPoint::container() const
 {
-    return m_position.container.get();
+    return m_containerNode.get();
 }
 
 inline Node* RangeBoundaryPoint::childBefore() const
 {
-    return m_childBefore;
+    return m_childBeforeBoundary;
+}
+
+inline void RangeBoundaryPoint::ensureOffsetIsValid() const
+{
+    if (m_offsetInContainer >= 0)
+        return;
+
+    ASSERT(m_childBeforeBoundary);
+    m_offsetInContainer = m_childBeforeBoundary->nodeIndex() + 1;
 }
 
-inline const Position& RangeBoundaryPoint::position() const
+inline const Position RangeBoundaryPoint::toPosition() const
 {
-    if (m_position.posOffset >= 0)
-        return m_position;
-    ASSERT(m_childBefore);
-    m_position.posOffset = m_childBefore->nodeIndex() + 1;
-    return m_position;
+    ensureOffsetIsValid();
+    return Position(m_containerNode.get(), m_offsetInContainer);
 }
 
 inline int RangeBoundaryPoint::offset() const
 {
-    return position().posOffset;
+    ensureOffsetIsValid();
+    return m_offsetInContainer;
 }
 
 inline void RangeBoundaryPoint::clear()
 {
-    m_position.clear();
-    m_childBefore = 0;
+    m_containerNode.clear();
+    m_offsetInContainer = 0;
+    m_childBeforeBoundary = 0;
 }
 
 inline void RangeBoundaryPoint::set(PassRefPtr<Node> container, int offset, Node* childBefore)
 {
     ASSERT(offset >= 0);
     ASSERT(childBefore == (offset ? container->childNode(offset - 1) : 0));
-    m_position.container = container;
-    m_position.posOffset = offset;
-    m_childBefore = childBefore;
+    m_containerNode = container;
+    m_offsetInContainer = offset;
+    m_childBeforeBoundary = childBefore;
 }
 
 inline void RangeBoundaryPoint::setOffset(int offset)
 {
-    ASSERT(m_position.container);
-    ASSERT(m_position.container->offsetInCharacters());
-    ASSERT(m_position.posOffset >= 0);
-    ASSERT(!m_childBefore);
-    m_position.posOffset = offset;
+    ASSERT(m_containerNode);
+    ASSERT(m_containerNode->offsetInCharacters());
+    ASSERT(m_offsetInContainer >= 0);
+    ASSERT(!m_childBeforeBoundary);
+    m_offsetInContainer = offset;
 }
 
-inline void RangeBoundaryPoint::setToChild(Node* child)
+inline void RangeBoundaryPoint::setToBeforeChild(Node* child)
 {
     ASSERT(child);
     ASSERT(child->parentNode());
-    m_position.container = child->parentNode();
-    m_childBefore = child->previousSibling();
-    m_position.posOffset = m_childBefore ? invalidOffset : 0;
+    m_childBeforeBoundary = child->previousSibling();
+    m_containerNode = child->parentNode();
+    m_offsetInContainer = m_childBeforeBoundary ? invalidOffset : 0;
 }
 
-inline void RangeBoundaryPoint::setToStart(PassRefPtr<Node> container)
+inline void RangeBoundaryPoint::setToStartOfNode(PassRefPtr<Node> container)
 {
     ASSERT(container);
-    m_position.container = container;
-    m_position.posOffset = 0;
-    m_childBefore = 0;
+    m_containerNode = container;
+    m_offsetInContainer = 0;
+    m_childBeforeBoundary = 0;
 }
 
-inline void RangeBoundaryPoint::setToEnd(PassRefPtr<Node> container)
+inline void RangeBoundaryPoint::setToEndOfNode(PassRefPtr<Node> container)
 {
     ASSERT(container);
-    m_position.container = container;
-    if (m_position.container->offsetInCharacters()) {
-        m_position.posOffset = m_position.container->maxCharacterOffset();
-        m_childBefore = 0;
+    m_containerNode = container;
+    if (m_containerNode->offsetInCharacters()) {
+        m_offsetInContainer = m_containerNode->maxCharacterOffset();
+        m_childBeforeBoundary = 0;
     } else {
-        m_childBefore = m_position.container->lastChild();
-        m_position.posOffset = m_childBefore ? invalidOffset : 0;
+        m_childBeforeBoundary = m_containerNode->lastChild();
+        m_offsetInContainer = m_childBeforeBoundary ? invalidOffset : 0;
     }
 }
 
 inline void RangeBoundaryPoint::childBeforeWillBeRemoved()
 {
-    ASSERT(m_position.posOffset);
-    m_childBefore = m_childBefore->previousSibling();
-    if (!m_childBefore)
-        m_position.posOffset = 0;
-    else if (m_position.posOffset > 0)
-        --m_position.posOffset;
+    ASSERT(m_offsetInContainer);
+    m_childBeforeBoundary = m_childBeforeBoundary->previousSibling();
+    if (!m_childBeforeBoundary)
+        m_offsetInContainer = 0;
+    else if (m_offsetInContainer > 0)
+        --m_offsetInContainer;
 }
 
 inline void RangeBoundaryPoint::invalidateOffset() const
 {
-    m_position.posOffset = invalidOffset;
+    m_offsetInContainer = invalidOffset;
 }
 
 inline bool operator==(const RangeBoundaryPoint& a, const RangeBoundaryPoint& b)
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeException.idl b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
index 36cde169da..d2cf385f0c 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
@@ -27,7 +27,7 @@ module ranges {
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
index 29b061dbec..479c2ff283 100644
--- a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
@@ -25,11 +25,10 @@
 #define RegisteredEventListener_h
 
 #include "AtomicString.h"
+#include "EventListener.h"
 
 namespace WebCore {
 
-    class EventListener;
-
     class RegisteredEventListener : public RefCounted<RegisteredEventListener> {
     public:
         static PassRefPtr<RegisteredEventListener> create(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
@@ -53,6 +52,25 @@ namespace WebCore {
         bool m_removed;
     };
 
+    typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
+
+#if USE(JSC)
+    inline void markEventListeners(const RegisteredEventListenerVector& listeners)
+    {
+        for (size_t i = 0; i < listeners.size(); ++i)
+            listeners[i]->listener()->markJSFunction();
+    }
+
+    inline void invalidateEventListeners(const RegisteredEventListenerVector& listeners)
+    {
+        // For efficiency's sake, we just set the "removed" bit, instead of
+        // actually removing the event listener. The node that owns these
+        // listeners is about to be deleted, anyway.
+        for (size_t i = 0; i < listeners.size(); ++i)
+            listeners[i]->setRemoved(true);
+    }
+#endif
+
 } // namespace WebCore
 
 #endif // RegisteredEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
index aeadc41415..55b15e5b96 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
@@ -29,6 +29,8 @@
 #include "Document.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
 #include "MIMETypeRegistry.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
@@ -37,6 +39,11 @@
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
 
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#include "SVGScriptElement.h"
+#endif
+
 namespace WebCore {
 
 void ScriptElement::insertedIntoDocument(ScriptElementData& data, const String& sourceUrl)
@@ -121,6 +128,7 @@ ScriptElementData::ScriptElementData(ScriptElement* scriptElement, Element* elem
     , m_element(element)
     , m_cachedScript(0)
     , m_createdByParser(false)
+    , m_requested(false)
     , m_evaluated(false)
     , m_firedLoad(false)
 {
@@ -145,6 +153,7 @@ void ScriptElementData::requestScript(const String& sourceUrl)
 
     ASSERT(!m_cachedScript);
     m_cachedScript = document->docLoader()->requestScript(sourceUrl, scriptCharset());
+    m_requested = true;
 
     // m_createdByParser is never reset - always resied at the initial value set while parsing.
     // m_evaluated is left untouched as well to avoid script reexecution, if a <script> element
@@ -171,7 +180,7 @@ void ScriptElementData::evaluateScript(const ScriptSourceCode& sourceCode)
         m_evaluated = true;
 
         frame->script()->evaluate(sourceCode);
-        Document::updateDocumentsRendering();
+        Document::updateStyleForAllDocuments();
     }
 }
 
@@ -183,28 +192,27 @@ void ScriptElementData::stopLoadRequest()
     }
 }
 
-void ScriptElementData::notifyFinished(CachedResource* o)
+void ScriptElementData::execute(CachedScript* cachedScript)
 {
-    CachedScript* cs = static_cast<CachedScript*>(o);
-    ASSERT(cs == m_cachedScript);
-
-    // Evaluating the script could lead to a garbage collection which can
-    // delete the script element so we need to protect it and us with it!
-    RefPtr<Element> protector(m_element);
-
-    if (cs->errorOccurred())
+    ASSERT(cachedScript);
+    if (cachedScript->errorOccurred())
         m_scriptElement->dispatchErrorEvent();
     else {
-        evaluateScript(ScriptSourceCode(cs));
+        evaluateScript(ScriptSourceCode(cachedScript));
         m_scriptElement->dispatchLoadEvent();
     }
+}
 
+void ScriptElementData::notifyFinished(CachedResource* o)
+{
+    ASSERT_UNUSED(o, o == m_cachedScript);
+    m_element->document()->executeScriptSoon(this, m_cachedScript);
     stopLoadRequest();
 }
 
 bool ScriptElementData::ignoresLoadRequest() const
 {
-    return m_evaluated || m_cachedScript || m_createdByParser || !m_element->inDocument();
+    return m_evaluated || m_requested || m_createdByParser || !m_element->inDocument();
 }
 
 bool ScriptElementData::shouldExecuteAsJavaScript() const
@@ -224,8 +232,15 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
     if (!language.isEmpty())
         return isSupportedJavaScriptLanguage(language);
 
-    // No type or language is specified, so we assume the script to be JavaScript
-    return true;
+    // No type or language is specified, so we assume the script to be JavaScript.
+    // We don't yet support setting event listeners via the 'for' attribute for scripts.
+    // If there is such an attribute it's likely better to not execute the script than to do so
+    // immediately and unconditionally.
+    // FIXME: After <rdar://problem/4471751> / https://bugs.webkit.org/show_bug.cgi?id=16915 are resolved 
+    // and we support the for syntax in script tags, this check can be removed and we should just
+    // return 'true' here.
+    String forAttribute = m_scriptElement->forAttributeValue();
+    return forAttribute.isEmpty();
 }
 
 String ScriptElementData::scriptCharset() const
@@ -269,4 +284,17 @@ String ScriptElementData::scriptContent() const
     return String::adopt(val);
 }
 
+ScriptElement* toScriptElement(Element* element)
+{
+    if (element->isHTMLElement() && element->hasTagName(HTMLNames::scriptTag))
+        return static_cast<HTMLScriptElement*>(element);
+
+#if ENABLE(SVG)
+    if (element->isSVGElement() && element->hasTagName(SVGNames::scriptTag))
+        return static_cast<SVGScriptElement*>(element);
+#endif
+
+    return 0;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
index 73cd077a27..0aed5e8ffb 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
@@ -42,6 +42,7 @@ public:
     virtual String charsetAttributeValue() const = 0;
     virtual String typeAttributeValue() const = 0;
     virtual String languageAttributeValue() const = 0;
+    virtual String forAttributeValue() const = 0;
 
     virtual void dispatchLoadEvent() = 0;
     virtual void dispatchErrorEvent() = 0;
@@ -49,6 +50,8 @@ public:
     // A charset for loading the script (may be overridden by HTTP headers or a BOM).
     virtual String scriptCharset() const = 0;
 
+    virtual bool shouldExecuteAsJavaScript() const = 0;
+
 protected:
     // Helper functions used by our parent classes.
     static void insertedIntoDocument(ScriptElementData&, const String& sourceUrl);
@@ -81,6 +84,8 @@ public:
     void evaluateScript(const ScriptSourceCode&);
     void stopLoadRequest();
 
+    void execute(CachedScript*);
+
 private:
     virtual void notifyFinished(CachedResource*);
 
@@ -89,10 +94,13 @@ private:
     Element* m_element;
     CachedResourceHandle<CachedScript> m_cachedScript;
     bool m_createdByParser;
+    bool m_requested;
     bool m_evaluated;
     bool m_firedLoad;
 };
 
+ScriptElement* toScriptElement(Element*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
index 1d1aaec661..c518734198 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
@@ -175,6 +175,22 @@ void ScriptExecutionContext::setSecurityOrigin(PassRefPtr<SecurityOrigin> securi
     m_securityOrigin = securityOrigin;
 }
 
+void ScriptExecutionContext::addTimeout(int timeoutId, DOMTimer* timer)
+{
+    ASSERT(!m_timeouts.contains(timeoutId));
+    m_timeouts.set(timeoutId, timer);
+}
+
+void ScriptExecutionContext::removeTimeout(int timeoutId)
+{
+    m_timeouts.remove(timeoutId);
+}
+
+DOMTimer* ScriptExecutionContext::findTimeout(int timeoutId)
+{
+    return m_timeouts.get(timeoutId);
+}
+
 ScriptExecutionContext::Task::~Task()
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
index 2e9d56c12b..7b2f36aa39 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
@@ -27,6 +27,7 @@
 #ifndef ScriptExecutionContext_h
 #define ScriptExecutionContext_h
 
+#include "Console.h"
 #include "KURL.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -36,10 +37,17 @@
 namespace WebCore {
 
     class ActiveDOMObject;
+    class DOMTimer;
     class MessagePort;
     class SecurityOrigin;
+    class ScriptString;
     class String;
 
+    enum MessageDestination {
+        InspectorControllerDestination,
+        ConsoleDestination,
+    };
+
     class ScriptExecutionContext {
     public:
         ScriptExecutionContext();
@@ -51,10 +59,15 @@ namespace WebCore {
         const KURL& url() const { return virtualURL(); }
         KURL completeURL(const String& url) const { return virtualCompleteURL(url); }
 
+        virtual String userAgent(const KURL&) const = 0;
+
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
 
         virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
-
+        virtual void addMessage(MessageDestination, MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL) = 0;
+        virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString) = 0;
+        virtual void scriptImported(unsigned long, const String&) = 0;
+        
         // Active objects are not garbage collected even if inaccessible, e.g. because their activity may result in callbacks being invoked.
         bool canSuspendActiveDOMObjects();
         // Active objects can be asked to suspend even if canSuspendActiveDOMObjects() returns 'false' -
@@ -85,6 +98,10 @@ namespace WebCore {
 
         virtual void postTask(PassRefPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
 
+        void addTimeout(int timeoutId, DOMTimer*);
+        void removeTimeout(int timeoutId);
+        DOMTimer* findTimeout(int timeoutId);
+
     protected:
         // Explicitly override the security origin for this script context.
         // Note: It is dangerous to change the security origin of a script context
@@ -101,6 +118,8 @@ namespace WebCore {
 
         HashMap<ActiveDOMObject*, void*> m_activeDOMObjects;
 
+        HashMap<int, DOMTimer*> m_timeouts;
+
         virtual void refScriptExecutionContext() = 0;
         virtual void derefScriptExecutionContext() = 0;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
new file mode 100644
index 0000000000..ff8f1c3145
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -0,0 +1,928 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "SelectElement.h"
+
+#include "CharacterNames.h"
+#include "ChromeClient.h"
+#include "Element.h"
+#include "EventHandler.h"
+#include "EventNames.h"
+#include "FormDataList.h"
+#include "Frame.h"
+#include "HTMLFormElement.h"
+#include "HTMLNames.h"
+#include "HTMLKeygenElement.h"
+#include "HTMLSelectElement.h"
+#include "KeyboardEvent.h"
+#include "MappedAttribute.h"
+#include "MouseEvent.h"
+#include "OptionElement.h"
+#include "OptionGroupElement.h"
+#include "Page.h"
+#include "RenderListBox.h"
+#include "RenderMenuList.h"
+#include <wtf/Assertions.h>
+
+#if ENABLE(WML)
+#include "WMLNames.h"
+#include "WMLSelectElement.h"
+#endif
+
+#if PLATFORM(MAC)
+#define ARROW_KEYS_POP_MENU 1
+#else
+#define ARROW_KEYS_POP_MENU 0
+#endif
+
+using std::min;
+using std::max;
+using namespace WTF;
+using namespace Unicode;
+
+namespace WebCore {
+
+static const DOMTimeStamp typeAheadTimeout = 1000;
+
+void SelectElement::selectAll(SelectElementData& data, Element* element)
+{
+    ASSERT(!data.usesMenuList());
+    if (!element->renderer() || !data.multiple())
+        return;
+
+    // Save the selection so it can be compared to the new selectAll selection when dispatching change events
+    saveLastSelection(data, element);
+
+    data.setActiveSelectionState(true);
+    setActiveSelectionAnchorIndex(data, element, nextSelectableListIndex(data, element, -1));
+    setActiveSelectionEndIndex(data, previousSelectableListIndex(data, element, -1));
+
+    updateListBoxSelection(data, element, false);
+    listBoxOnChange(data, element);
+}
+
+void SelectElement::saveLastSelection(SelectElementData& data, Element* element)
+{
+    if (data.usesMenuList()) {
+        data.setLastOnChangeIndex(selectedIndex(data, element));
+        return;
+    }
+
+    Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
+    lastOnChangeSelection.clear();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        lastOnChangeSelection.append(optionElement && optionElement->selected());
+    }
+}
+
+int SelectElement::nextSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int index = startIndex + 1;
+    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
+        ++index;
+    if ((unsigned) index == items.size())
+        return startIndex;
+    return index;
+}
+
+int SelectElement::previousSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    if (startIndex == -1)
+        startIndex = items.size();
+    int index = startIndex - 1;
+    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
+        --index;
+    if (index == -1)
+        return startIndex;
+    return index;
+}
+
+void SelectElement::setActiveSelectionAnchorIndex(SelectElementData& data, Element* element, int index)
+{
+    data.setActiveSelectionAnchorIndex(index);
+
+    // Cache the selection state so we can restore the old selection as the new selection pivots around this anchor index
+    Vector<bool>& cachedStateForActiveSelection = data.cachedStateForActiveSelection(); 
+    cachedStateForActiveSelection.clear();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        cachedStateForActiveSelection.append(optionElement && optionElement->selected());
+    }
+}
+
+void SelectElement::setActiveSelectionEndIndex(SelectElementData& data, int index)
+{
+    data.setActiveSelectionEndIndex(index);
+}
+
+void SelectElement::updateListBoxSelection(SelectElementData& data, Element* element, bool deselectOtherOptions)
+{
+    ASSERT(element->renderer() && element->renderer()->isListBox());
+    ASSERT(data.activeSelectionAnchorIndex() >= 0);
+
+    unsigned start = min(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
+    unsigned end = max(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
+    Vector<bool>& cachedStateForActiveSelection = data.cachedStateForActiveSelection();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (!optionElement || items[i]->disabled())
+            continue;
+
+        if (i >= start && i <= end)
+            optionElement->setSelectedState(data.activeSelectionState());
+        else if (deselectOtherOptions || i >= cachedStateForActiveSelection.size())
+            optionElement->setSelectedState(false);
+        else
+            optionElement->setSelectedState(cachedStateForActiveSelection[i]);
+    }
+
+    scrollToSelection(data, element);
+}
+
+void SelectElement::listBoxOnChange(SelectElementData& data, Element* element)
+{
+    ASSERT(!data.usesMenuList());
+
+    Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
+    const Vector<Element*>& items = data.listItems(element);
+
+    // If the cached selection list is empty, or the size has changed, then fire dispatchFormControlChangeEvent, and return early.
+    if (lastOnChangeSelection.isEmpty() || lastOnChangeSelection.size() != items.size()) {
+        element->dispatchFormControlChangeEvent();
+        return;
+    }
+
+    // Update lastOnChangeSelection and fire dispatchFormControlChangeEvent
+    bool fireOnChange = false;
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        bool selected = optionElement &&  optionElement->selected();
+        if (selected != lastOnChangeSelection[i])
+            fireOnChange = true;
+        lastOnChangeSelection[i] = selected;
+    }
+
+    if (fireOnChange)
+        element->dispatchFormControlChangeEvent();
+}
+
+void SelectElement::menuListOnChange(SelectElementData& data, Element* element)
+{
+    ASSERT(data.usesMenuList());
+
+    int selected = selectedIndex(data, element);
+    if (data.lastOnChangeIndex() != selected) {
+        data.setLastOnChangeIndex(selected);
+        element->dispatchFormControlChangeEvent();
+    }
+}
+
+void SelectElement::scrollToSelection(SelectElementData& data, Element* element)
+{
+    if (data.usesMenuList())
+        return;
+
+    if (RenderObject* renderer = element->renderer())
+        static_cast<RenderListBox*>(renderer)->selectionChanged();
+}
+
+void SelectElement::recalcStyle(SelectElementData& data, Element* element)
+{
+    RenderObject* renderer = element->renderer();
+    if (element->childNeedsStyleRecalc() && renderer) {
+        if (data.usesMenuList())
+            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+        else
+            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+    } else if (data.shouldRecalcListItems())
+        recalcListItems(data, element);
+}
+
+void SelectElement::setRecalcListItems(SelectElementData& data, Element* element)
+{
+    data.setShouldRecalcListItems(true);
+    data.setActiveSelectionAnchorIndex(-1); // Manual selection anchor is reset when manipulating the select programmatically.
+    if (RenderObject* renderer = element->renderer()) {
+        if (data.usesMenuList())
+            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+        else
+            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+    }
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::recalcListItems(SelectElementData& data, const Element* element, bool updateSelectedStates)
+{
+    Vector<Element*>& listItems = data.rawListItems();
+    listItems.clear();
+
+    OptionElement* foundSelected = 0;
+    for (Node* currentNode = element->firstChild(); currentNode;) {
+        if (!currentNode->isElementNode()) {
+            currentNode = currentNode->traverseNextSibling(element);
+            continue;
+        }
+
+        Element* current = static_cast<Element*>(currentNode);
+
+        // optgroup tags may not nest. However, both FireFox and IE will
+        // flatten the tree automatically, so we follow suit.
+        // (http://www.w3.org/TR/html401/interact/forms.html#h-17.6)
+        if (isOptionGroupElement(current)) {
+            listItems.append(current);
+            if (current->firstChild()) {
+                currentNode = current->firstChild();
+                continue;
+            }
+        }
+
+        if (OptionElement* optionElement = toOptionElement(current)) {
+            listItems.append(current);
+
+            if (updateSelectedStates) {
+                if (!foundSelected && (data.usesMenuList() || (!data.multiple() && optionElement->selected()))) {
+                    foundSelected = optionElement;
+                    foundSelected->setSelectedState(true);
+                } else if (foundSelected && !data.multiple() && optionElement->selected()) {
+                    foundSelected->setSelectedState(false);
+                    foundSelected = optionElement;
+                }
+            }
+        }
+
+        if (current->hasTagName(HTMLNames::hrTag))
+            listItems.append(current);
+
+        // In conforming HTML code, only <optgroup> and <option> will be found
+        // within a <select>. We call traverseNextSibling so that we only step
+        // into those tags that we choose to. For web-compat, we should cope
+        // with the case where odd tags like a <div> have been added but we
+        // handle this because such tags have already been removed from the
+        // <select>'s subtree at this point.
+        currentNode = currentNode->traverseNextSibling(element);
+    }
+
+    data.setShouldRecalcListItems(false);
+}
+
+int SelectElement::selectedIndex(const SelectElementData& data, const Element* element)
+{
+    unsigned index = 0;
+
+    // return the number of the first option selected
+    const Vector<Element*>& items = data.listItems(element);
+    for (size_t i = 0; i < items.size(); ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i])) {
+            if (optionElement->selected())
+                return index;
+            ++index;
+        }
+    }
+
+    return -1;
+}
+
+void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChange)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int listIndex = optionToListIndex(data, element, optionIndex);
+    if (!data.multiple())
+        deselect = true;
+
+    Element* excludeElement = 0;
+    if (OptionElement* optionElement = (listIndex >= 0 ? toOptionElement(items[listIndex]) : 0)) {
+        excludeElement = items[listIndex];
+        if (data.activeSelectionAnchorIndex() < 0 || deselect)
+            setActiveSelectionAnchorIndex(data, element, listIndex);
+        if (data.activeSelectionEndIndex() < 0 || deselect)
+            setActiveSelectionEndIndex(data, listIndex);
+        optionElement->setSelectedState(true);
+    }
+
+    if (deselect)
+        deselectItems(data, element, excludeElement);
+
+    // For the menu list case, this is what makes the selected element appear.
+    if (RenderObject* renderer = element->renderer())
+        renderer->updateFromElement();
+
+    scrollToSelection(data, element);
+
+    // This only gets called with fireOnChange for menu lists. 
+    if (fireOnChange && data.usesMenuList())
+        menuListOnChange(data, element);
+
+    if (Frame* frame = element->document()->frame())
+        frame->page()->chrome()->client()->formStateDidChange(element);
+}
+
+int SelectElement::optionToListIndex(const SelectElementData& data, const Element* element, int optionIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int listSize = (int) items.size();
+    if (optionIndex < 0 || optionIndex >= listSize)
+        return -1;
+
+    int optionIndex2 = -1;
+    for (int listIndex = 0; listIndex < listSize; ++listIndex) {
+        if (isOptionElement(items[listIndex])) {
+            ++optionIndex2;
+            if (optionIndex2 == optionIndex)
+                return listIndex;
+        }
+    }
+
+    return -1;
+}
+
+int SelectElement::listToOptionIndex(const SelectElementData& data, const Element* element, int listIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    if (listIndex < 0 || listIndex >= int(items.size()) ||
+        !isOptionElement(items[listIndex]))
+        return -1;
+
+    int optionIndex = 0; // actual index of option not counting OPTGROUP entries that may be in list
+    for (int i = 0; i < listIndex; ++i)
+        if (isOptionElement(items[i]))
+            ++optionIndex;
+
+    return optionIndex;
+}
+
+void SelectElement::dispatchFocusEvent(SelectElementData& data, Element* element)
+{
+    // Save the selection so it can be compared to the new selection when dispatching change events during blur event dispatchal
+    if (data.usesMenuList())
+        saveLastSelection(data, element);
+}
+
+void SelectElement::dispatchBlurEvent(SelectElementData& data, Element* element)
+{
+    // We only need to fire change events here for menu lists, because we fire change events for list boxes whenever the selection change is actually made.
+    // This matches other browsers' behavior.
+    if (data.usesMenuList())
+        menuListOnChange(data, element);
+}
+
+void SelectElement::deselectItems(SelectElementData& data, Element* element, Element* excludeElement)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        if (items[i] == excludeElement)
+            continue;
+
+        if (OptionElement* optionElement = toOptionElement(items[i]))
+            optionElement->setSelectedState(false);
+    }
+}
+
+bool SelectElement::saveFormControlState(const SelectElementData& data, const Element* element, String& value)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int length = items.size();
+
+    // FIXME: Change this code to use the new StringImpl::createUninitialized code path.
+    Vector<char, 1024> characters(length);
+    for (int i = 0; i < length; ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        bool selected = optionElement && optionElement->selected();
+        characters[i] = selected ? 'X' : '.';
+    }
+
+    value = String(characters.data(), length);
+    return true;
+}
+
+void SelectElement::restoreFormControlState(SelectElementData& data, Element* element, const String& state)
+{
+    recalcListItems(data, element);
+
+    const Vector<Element*>& items = data.listItems(element);
+    int length = items.size();
+
+    for (int i = 0; i < length; ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i]))
+            optionElement->setSelectedState(state[i] == 'X');
+    }
+
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::parseMultipleAttribute(SelectElementData& data, Element* element, MappedAttribute* attribute)
+{
+    bool oldUsesMenuList = data.usesMenuList();
+    data.setMultiple(!attribute->isNull());
+    if (oldUsesMenuList != data.usesMenuList() && element->attached()) {
+        element->detach();
+        element->attach();
+    }
+}
+
+bool SelectElement::appendFormData(SelectElementData& data, Element* element, FormDataList& list)
+{
+    const AtomicString& name = element->formControlName();
+    if (name.isEmpty())
+        return false;
+
+    bool successful = false;
+    const Vector<Element*>& items = data.listItems(element);
+
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (optionElement && optionElement->selected()) {
+            list.appendData(name, optionElement->value());
+            successful = true;
+        }
+    }
+
+    // FIXME: This case should not happen. Make sure that we select the first option
+    // in any case, otherwise we have no consistency with the DOM interface.
+    // We return the first one if it was a combobox select
+    if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
+        OptionElement* optionElement = toOptionElement(items[0]);
+        const AtomicString& value = optionElement->value();
+        if (value.isNull())
+            list.appendData(name, optionElement->text().stripWhiteSpace());
+        else
+            list.appendData(name, value);
+        successful = true;
+    }
+
+    return successful;
+} 
+
+void SelectElement::reset(SelectElementData& data, Element* element)
+{
+    bool optionSelected = false;
+    OptionElement* firstOption = 0;
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (!optionElement)
+            continue;
+
+        if (!items[i]->getAttribute(HTMLNames::selectedAttr).isNull()) {
+            optionElement->setSelectedState(true);
+            optionSelected = true;
+        } else
+            optionElement->setSelectedState(false);
+
+        if (!firstOption)
+            firstOption = optionElement;
+    }
+
+    if (!optionSelected && firstOption && data.usesMenuList())
+        firstOption->setSelectedState(true);
+
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+#if !ARROW_KEYS_POP_MENU
+    UNUSED_PARAM(htmlForm);
+#endif
+
+    if (event->type() == eventNames().keydownEvent) {
+        if (!element->renderer() || !event->isKeyboardEvent())
+            return;
+
+        String keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+        bool handled = false;
+
+#if ARROW_KEYS_POP_MENU
+        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
+            element->focus();
+            // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
+            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+            saveLastSelection(data, element);
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+                menuList->showPopup();
+            handled = true;
+        }
+#else
+        const Vector<Element*>& listItems = data.listItems(element);
+        int size = listItems.size();
+
+        int listIndex = optionToListIndex(data, element, selectedIndex(data, element));
+        if (keyIdentifier == "Down" || keyIdentifier == "Right") {
+            for (listIndex += 1;
+                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
+                 ++listIndex) { }
+            if (listIndex >= 0 && listIndex < size)
+                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            handled = true;
+        } else if (keyIdentifier == "Up" || keyIdentifier == "Left") {
+            for (listIndex -= 1;
+                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
+                 --listIndex) { }
+            if (listIndex >= 0 && listIndex < size)
+                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            handled = true;
+        }
+#endif
+        if (handled)
+            event->setDefaultHandled();
+    }
+
+    // Use key press event here since sending simulated mouse events
+    // on key down blocks the proper sending of the key press event.
+    if (event->type() == eventNames().keypressEvent) {
+        if (!element->renderer() || !event->isKeyboardEvent())
+            return;
+
+        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+        bool handled = false;
+
+#if ARROW_KEYS_POP_MENU
+        if (keyCode == ' ') {
+            element->focus();
+            // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
+            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+            saveLastSelection(data, element);
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+                menuList->showPopup();
+            handled = true;
+        } else if (keyCode == '\r') {
+            menuListOnChange(data, element);
+            if (htmlForm)
+                htmlForm->submitClick(event);
+            handled = true;
+        }
+#else
+        int listIndex = optionToListIndex(data, element, selectedIndex(data, element));
+        if (keyCode == '\r') {
+            // listIndex should already be selected, but this will fire the onchange handler.
+            setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex), true, true);
+            handled = true;
+        }
+#endif
+        if (handled)
+            event->setDefaultHandled();
+    }
+
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+        element->focus();
+        if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer())) {
+            if (menuList->popupIsVisible())
+                menuList->hidePopup();
+            else {
+                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
+                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+                saveLastSelection(data, element);
+                menuList->showPopup();
+            }
+        }
+        event->setDefaultHandled();
+    }
+}
+
+void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+    const Vector<Element*>& listItems = data.listItems(element);
+
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+        element->focus();
+
+        // Convert to coords relative to the list box if needed.
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        IntPoint localOffset = roundedIntPoint(element->renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
+        int listIndex = static_cast<RenderListBox*>(element->renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
+        if (listIndex >= 0) {
+            // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
+            saveLastSelection(data, element);
+
+            data.setActiveSelectionState(true);
+            
+            bool multiSelectKeyPressed = false;
+#if PLATFORM(MAC)
+            multiSelectKeyPressed = mouseEvent->metaKey();
+#else
+            multiSelectKeyPressed = mouseEvent->ctrlKey();
+#endif
+
+            bool shiftSelect = data.multiple() && mouseEvent->shiftKey();
+            bool multiSelect = data.multiple() && multiSelectKeyPressed && !mouseEvent->shiftKey();
+
+            Element* clickedElement = listItems[listIndex];            
+            OptionElement* option = toOptionElement(clickedElement);
+            if (option) {
+                // Keep track of whether an active selection (like during drag selection), should select or deselect
+                if (option->selected() && multiSelectKeyPressed)
+                    data.setActiveSelectionState(false);
+
+                if (!data.activeSelectionState())
+                    option->setSelectedState(false);
+            }
+            
+            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
+            // If no option was clicked, then this will deselect all items in the list.
+            if (!shiftSelect && !multiSelect)
+                deselectItems(data, element, clickedElement);
+
+            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
+            if (data.activeSelectionAnchorIndex() < 0 && !multiSelect)
+                setActiveSelectionAnchorIndex(data, element, selectedIndex(data, element));
+
+            // Set the selection state of the clicked option
+            if (option && !clickedElement->disabled())
+                option->setSelectedState(true);
+            
+            // If there was no selectedIndex() for the previous initialization, or
+            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
+            if (listIndex >= 0 && (data.activeSelectionAnchorIndex() < 0 || !shiftSelect))
+                setActiveSelectionAnchorIndex(data, element, listIndex);
+            
+            setActiveSelectionEndIndex(data, listIndex);
+            updateListBoxSelection(data, element, !multiSelect);
+
+            if (Frame* frame = element->document()->frame())
+                frame->eventHandler()->setMouseDownMayStartAutoscroll();
+
+            event->setDefaultHandled();
+        }
+    } else if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton && element->document()->frame()->eventHandler()->autoscrollRenderer() != element->renderer())
+        // This makes sure we fire dispatchFormControlChangeEvent for a single click.  For drag selection, onChange will fire when the autoscroll timer stops.
+        listBoxOnChange(data, element);
+    else if (event->type() == eventNames().keydownEvent) {
+        if (!event->isKeyboardEvent())
+            return;
+        String keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+
+        int endIndex = 0;        
+        if (data.activeSelectionEndIndex() < 0) {
+            // Initialize the end index
+            if (keyIdentifier == "Down")
+                endIndex = nextSelectableListIndex(data, element, lastSelectedListIndex(data, element));
+            else if (keyIdentifier == "Up")
+                endIndex = previousSelectableListIndex(data, element, optionToListIndex(data, element, selectedIndex(data, element)));
+        } else {
+            // Set the end index based on the current end index
+            if (keyIdentifier == "Down")
+                endIndex = nextSelectableListIndex(data, element, data.activeSelectionEndIndex());
+            else if (keyIdentifier == "Up")
+                endIndex = previousSelectableListIndex(data, element, data.activeSelectionEndIndex());    
+        }
+        
+        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
+            // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
+            saveLastSelection(data, element);
+
+            ASSERT(endIndex >= 0 && (unsigned) endIndex < listItems.size()); 
+            setActiveSelectionEndIndex(data, endIndex);
+            
+            // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
+            bool deselectOthers = !data.multiple() || !static_cast<KeyboardEvent*>(event)->shiftKey();
+            if (data.activeSelectionAnchorIndex() < 0 || deselectOthers) {
+                data.setActiveSelectionState(true);
+                if (deselectOthers)
+                    deselectItems(data, element);
+                setActiveSelectionAnchorIndex(data, element, data.activeSelectionEndIndex());
+            }
+
+            static_cast<RenderListBox*>(element->renderer())->scrollToRevealElementAtListIndex(endIndex);
+            updateListBoxSelection(data, element, deselectOthers);
+            listBoxOnChange(data, element);
+            event->setDefaultHandled();
+        }
+    } else if (event->type() == eventNames().keypressEvent) {
+        if (!event->isKeyboardEvent())
+            return;
+        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+
+        if (keyCode == '\r') {
+            if (htmlForm)
+                htmlForm->submitClick(event);
+            event->setDefaultHandled();
+            return;
+        }
+    }
+}
+
+void SelectElement::defaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+    if (!element->renderer())
+        return;
+
+    if (data.usesMenuList())
+        menuListDefaultEventHandler(data, element, event, htmlForm);
+    else 
+        listBoxDefaultEventHandler(data, element, event, htmlForm);
+
+    if (event->defaultHandled())
+        return;
+
+    if (event->type() == eventNames().keypressEvent && event->isKeyboardEvent()) {
+        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+        if (!keyboardEvent->ctrlKey() && !keyboardEvent->altKey() && !keyboardEvent->metaKey() && isPrintableChar(keyboardEvent->charCode())) {
+            typeAheadFind(data, element, keyboardEvent);
+            event->setDefaultHandled();
+            return;
+        }
+    }
+}
+
+int SelectElement::lastSelectedListIndex(const SelectElementData& data, const Element* element)
+{
+    // return the number of the last option selected
+    unsigned index = 0;
+    bool found = false;
+    const Vector<Element*>& items = data.listItems(element);
+    for (size_t i = 0; i < items.size(); ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i])) {
+            if (optionElement->selected()) {
+                index = i;
+                found = true;
+            }
+        }
+    }
+
+    return found ? (int) index : -1;
+}
+
+static String stripLeadingWhiteSpace(const String& string)
+{
+    int length = string.length();
+
+    int i;
+    for (i = 0; i < length; ++i) {
+        if (string[i] != noBreakSpace && (string[i] <= 0x7F ? !isASCIISpace(string[i]) : (direction(string[i]) != WhiteSpaceNeutral)))
+            break;
+    }
+
+    return string.substring(i, length - i);
+}
+
+void SelectElement::typeAheadFind(SelectElementData& data, Element* element, KeyboardEvent* event)
+{
+    if (event->timeStamp() < data.lastCharTime())
+        return;
+
+    DOMTimeStamp delta = event->timeStamp() - data.lastCharTime();
+    data.setLastCharTime(event->timeStamp());
+
+    UChar c = event->charCode();
+
+    String prefix;
+    int searchStartOffset = 1;
+    if (delta > typeAheadTimeout) {
+        prefix = String(&c, 1);
+        data.setTypedString(prefix);
+        data.setRepeatingChar(c);
+    } else {
+        data.typedString().append(c);
+
+        if (c == data.repeatingChar())
+            // The user is likely trying to cycle through all the items starting with this character, so just search on the character
+            prefix = String(&c, 1);
+        else {
+            data.setRepeatingChar(0);
+            prefix = data.typedString();
+            searchStartOffset = 0;
+        }
+    }
+
+    const Vector<Element*>& items = data.listItems(element);
+    int itemCount = items.size();
+    if (itemCount < 1)
+        return;
+
+    int selected = selectedIndex(data, element);
+    int index = (optionToListIndex(data, element, selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
+    ASSERT(index >= 0);
+
+    for (int i = 0; i < itemCount; ++i, index = (index + 1) % itemCount) {
+        OptionElement* optionElement = toOptionElement(items[index]);
+        if (!optionElement || items[index]->disabled())
+            continue;
+
+        String text = optionElement->textIndentedToRespectGroupLabel();
+        if (stripLeadingWhiteSpace(text).startsWith(prefix, false)) {
+            setSelectedIndex(data, element, listToOptionIndex(data, element, index));
+            if (!data.usesMenuList())
+                listBoxOnChange(data, element);
+            element->setNeedsStyleRecalc();
+            return;
+        }
+    }
+}
+
+void SelectElement::insertedIntoTree(SelectElementData& data, Element* element)
+{
+    // When the element is created during document parsing, it won't have any items yet - but for innerHTML
+    // and related methods, this method is called after the whole subtree is constructed.
+    recalcListItems(data, element, true);
+}
+
+void SelectElement::accessKeySetSelectedIndex(SelectElementData& data, Element* element, int index)
+{    
+    // first bring into focus the list box
+    if (!element->focused())
+        element->accessKeyAction(false);
+    
+    // if this index is already selected, unselect. otherwise update the selected index
+    const Vector<Element*>& items = data.listItems(element);
+    int listIndex = optionToListIndex(data, element, index);
+    if (OptionElement* optionElement = (listIndex >= 0 ? toOptionElement(items[listIndex]) : 0)) {
+        if (optionElement->selected())
+            optionElement->setSelectedState(false);
+        else
+            setSelectedIndex(data, element, index, false, true);
+    }
+ 
+    listBoxOnChange(data, element);
+    scrollToSelection(data, element);
+}
+
+// SelectElementData
+SelectElementData::SelectElementData()
+    : m_multiple(false) 
+    , m_size(0)
+    , m_lastOnChangeIndex(-1)
+    , m_activeSelectionState(false)
+    , m_activeSelectionAnchorIndex(-1)
+    , m_activeSelectionEndIndex(-1)
+    , m_recalcListItems(false)
+    , m_repeatingChar(0)
+    , m_lastCharTime(0)
+{
+}
+
+void SelectElementData::checkListItems(const Element* element) const
+{
+#ifndef NDEBUG
+    const Vector<Element*>& items = m_listItems;
+    SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element, false);
+    ASSERT(items == m_listItems);
+#else
+    UNUSED_PARAM(element);
+#endif
+}
+
+Vector<Element*>& SelectElementData::listItems(const Element* element)
+{
+    if (m_recalcListItems)
+        SelectElement::recalcListItems(*this, element);
+    else
+        checkListItems(element);
+
+    return m_listItems;
+}
+
+const Vector<Element*>& SelectElementData::listItems(const Element* element) const
+{
+    if (m_recalcListItems)
+        SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element);
+    else
+        checkListItems(element);
+
+    return m_listItems;
+}
+
+SelectElement* toSelectElement(Element* element)
+{
+    if (element->isHTMLElement()) {
+        if (element->hasTagName(HTMLNames::selectTag))
+            return static_cast<HTMLSelectElement*>(element);
+        if (element->hasTagName(HTMLNames::keygenTag))
+            return static_cast<HTMLKeygenElement*>(element);
+    }
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::selectTag))
+        return static_cast<WMLSelectElement*>(element);
+#endif
+
+    return 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.h b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
new file mode 100644
index 0000000000..bad9b791ea
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http//www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef SelectElement_h
+#define SelectElement_h
+
+#include "Event.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Element;
+class Event;
+class FormDataList;
+class HTMLFormElement;
+class KeyboardEvent;
+class MappedAttribute;
+class SelectElementData;
+class String;
+
+class SelectElement {
+public:
+    virtual bool multiple() const = 0;
+
+    virtual int size() const = 0;
+    virtual const Vector<Element*>& listItems() const = 0;
+
+    virtual void listBoxOnChange() = 0;
+    virtual void updateListBoxSelection(bool deselectOtherOptions) = 0;
+
+    virtual void menuListOnChange() = 0;
+
+    virtual int activeSelectionStartListIndex() const = 0;
+    virtual int activeSelectionEndListIndex() const = 0;
+
+    virtual void setActiveSelectionAnchorIndex(int index) = 0;
+    virtual void setActiveSelectionEndIndex(int index) = 0;
+
+    virtual int listToOptionIndex(int listIndex) const = 0;
+    virtual int optionToListIndex(int optionIndex) const = 0;
+
+    virtual int selectedIndex() const = 0;
+    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false) = 0;
+
+protected:
+    virtual ~SelectElement() { }
+
+    friend class SelectElementData;
+
+    static void selectAll(SelectElementData&, Element*);
+    static void saveLastSelection(SelectElementData&, Element*);
+    static int nextSelectableListIndex(SelectElementData&, Element*, int startIndex);
+    static int previousSelectableListIndex(SelectElementData&, Element*, int startIndex);
+    static void setActiveSelectionAnchorIndex(SelectElementData&, Element*, int index);
+    static void setActiveSelectionEndIndex(SelectElementData&, int index);
+    static void updateListBoxSelection(SelectElementData&, Element*, bool deselectOtherOptions);
+    static void listBoxOnChange(SelectElementData&, Element*);
+    static void menuListOnChange(SelectElementData&, Element*);
+    static void scrollToSelection(SelectElementData&, Element*);
+    static void recalcStyle(SelectElementData&, Element*);
+    static void setRecalcListItems(SelectElementData&, Element*);
+    static void recalcListItems(SelectElementData&, const Element*, bool updateSelectedStates = true);
+    static int selectedIndex(const SelectElementData&, const Element*);
+    static void setSelectedIndex(SelectElementData&, Element*, int optionIndex, bool deselect = true, bool fireOnChange = false);
+    static int optionToListIndex(const SelectElementData&, const Element*, int optionIndex);
+    static int listToOptionIndex(const SelectElementData&, const Element*, int listIndex);
+    static void dispatchFocusEvent(SelectElementData&, Element*);
+    static void dispatchBlurEvent(SelectElementData&, Element*);
+    static void deselectItems(SelectElementData&, Element*, Element* excludeElement = 0);
+    static bool saveFormControlState(const SelectElementData&, const Element*, String& state);
+    static void restoreFormControlState(SelectElementData&, Element*, const String& state);
+    static void parseMultipleAttribute(SelectElementData&, Element*, MappedAttribute*);
+    static bool appendFormData(SelectElementData&, Element*, FormDataList&);
+    static void reset(SelectElementData&, Element*);
+    static void defaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement* = 0);
+    static int lastSelectedListIndex(const SelectElementData&, const Element*);
+    static void typeAheadFind(SelectElementData&, Element*, KeyboardEvent*);
+    static void insertedIntoTree(SelectElementData&, Element*);
+    static void accessKeySetSelectedIndex(SelectElementData&, Element*, int index);
+
+private:
+    static void menuListDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+    static void listBoxDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+};
+
+// HTML/WMLSelectElement hold this struct as member variable
+// and pass it to the static helper functions in SelectElement
+class SelectElementData {
+public:
+    SelectElementData();
+
+    bool multiple() const { return m_multiple; }
+    void setMultiple(bool value) { m_multiple = value; }
+
+    int size() const { return m_size; }
+    void setSize(int value) { m_size = value; }
+
+    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
+
+    int lastOnChangeIndex() const { return m_lastOnChangeIndex; }
+    void setLastOnChangeIndex(int value) { m_lastOnChangeIndex = value; }
+
+    Vector<bool>& lastOnChangeSelection() { return m_lastOnChangeSelection; }
+
+    bool activeSelectionState() const { return m_activeSelectionState; }
+    void setActiveSelectionState(bool value) { m_activeSelectionState = value; }
+
+    int activeSelectionAnchorIndex() const { return m_activeSelectionAnchorIndex; }
+    void setActiveSelectionAnchorIndex(int value) { m_activeSelectionAnchorIndex = value; }
+
+    int activeSelectionEndIndex() const { return m_activeSelectionEndIndex; }
+    void setActiveSelectionEndIndex(int value) { m_activeSelectionEndIndex = value; }
+
+    Vector<bool>& cachedStateForActiveSelection() { return m_cachedStateForActiveSelection; }
+
+    bool shouldRecalcListItems() const { return m_recalcListItems; }
+    void setShouldRecalcListItems(bool value) { m_recalcListItems = value; }
+
+    Vector<Element*>& rawListItems() { return m_listItems; }
+    Vector<Element*>& listItems(const Element*);
+    const Vector<Element*>& listItems(const Element*) const;
+
+    UChar repeatingChar() const { return m_repeatingChar; }
+    void setRepeatingChar(const UChar& value) { m_repeatingChar = value; }
+
+    DOMTimeStamp lastCharTime() const { return m_lastCharTime; }
+    void setLastCharTime(const DOMTimeStamp& value) { m_lastCharTime = value; }
+
+    String& typedString() { return m_typedString; }
+    void setTypedString(const String& value) { m_typedString = value; }
+
+private:
+    void checkListItems(const Element*) const;
+
+    bool m_multiple;
+    int m_size;
+
+    int m_lastOnChangeIndex;
+    Vector<bool> m_lastOnChangeSelection;
+
+    bool m_activeSelectionState;
+    int m_activeSelectionAnchorIndex;
+    int m_activeSelectionEndIndex;
+    Vector<bool> m_cachedStateForActiveSelection;
+
+    bool m_recalcListItems;
+    Vector<Element*> m_listItems;
+
+    // Instance variables for type-ahead find
+    UChar m_repeatingChar;
+    DOMTimeStamp m_lastCharTime;
+    String m_typedString;
+};
+
+SelectElement* toSelectElement(Element*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
index 68c3ec7ecd..a21959df77 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
@@ -61,13 +61,28 @@ void StyleElement::process(Element* e)
     if (!e || !e->inDocument())
         return;
 
-    Vector<UChar> text;
-
-    for (Node* c = e->firstChild(); c; c = c->nextSibling())
-        if (c->nodeType() == Node::TEXT_NODE || c->nodeType() == Node::CDATA_SECTION_NODE || c->nodeType() == Node::COMMENT_NODE)
-            append(text, c->nodeValue());
+    unsigned resultLength = 0;
+    for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
+        Node::NodeType nodeType = c->nodeType();
+        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE)
+            resultLength += c->nodeValue().length();
+    }
+    UChar* text;
+    String sheetText = String::createUninitialized(resultLength, text);
+
+    UChar* p = text;
+    for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
+        Node::NodeType nodeType = c->nodeType();
+        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE) {
+            String nodeValue = c->nodeValue();
+            unsigned nodeLength = nodeValue.length();
+            memcpy(p, nodeValue.characters(), nodeLength * sizeof(UChar));
+            p += nodeLength;
+        }
+    }
+    ASSERT(p == text + resultLength);
 
-    createSheet(e, String::adopt(text));
+    createSheet(e, sheetText);
 }
 
 void StyleElement::createSheet(Element* e, const String& text)
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index d5af1b7e99..8ddfd3147c 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -29,6 +29,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include <wtf/HashFunctions.h>
 
 using namespace std;
@@ -157,7 +158,7 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
     MappedAttribute* mappedAttr = static_cast<MappedAttribute*>(attr);
     if (mappedAttr->decl() && !preserveDecls) {
         mappedAttr->setDecl(0);
-        setChanged();
+        setNeedsStyleRecalc();
         if (namedAttrMap)
             mappedAttributes()->declRemoved();
     }
@@ -167,7 +168,7 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
     bool needToParse = mapToEntry(attr->name(), entry);
     if (preserveDecls) {
         if (mappedAttr->decl()) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (namedAttrMap)
                 mappedAttributes()->declAdded();
             checkDecl = false;
@@ -177,7 +178,7 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
         CSSMappedAttributeDeclaration* decl = getMappedAttributeDecl(entry, attr);
         if (decl) {
             mappedAttr->setDecl(decl);
-            setChanged();
+            setNeedsStyleRecalc();
             if (namedAttrMap)
                 mappedAttributes()->declAdded();
             checkDecl = false;
@@ -185,11 +186,16 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
             needToParse = true;
     }
 
+    // parseMappedAttribute() might create a CSSMappedAttributeDeclaration on the attribute.  
+    // Normally we would be concerned about reseting the parent of those declarations in StyledElement::didMoveToNewOwnerDocument().
+    // But currently we always clear its parent and node below when adding it to the decl table.  
+    // If that changes for some reason moving between documents will be buggy.
+    // webarchive/adopt-attribute-styled-node-webarchive.html should catch any resulting crashes.
     if (needToParse)
         parseMappedAttribute(mappedAttr);
 
     if (entry == eNone && ownerDocument()->attached() && ownerDocument()->styleSelector()->hasSelectorForAttribute(attr->name().localName()))
-        setChanged();
+        setNeedsStyleRecalc();
 
     if (checkDecl && mappedAttr->decl()) {
         // Add the decl to the table in the appropriate spot.
@@ -227,7 +233,7 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
         else
             mappedAttributes()->clearClass();
     }
-    setChanged();
+    setNeedsStyleRecalc();
     dispatchSubtreeModifiedEvent();
 }
 
@@ -244,7 +250,7 @@ void StyledElement::parseMappedAttribute(MappedAttribute *attr)
             else
                 namedAttrMap->setID(attr->value());
         }
-        setChanged();
+        setNeedsStyleRecalc();
     } else if (attr->name() == classAttr)
         classAttributeChanged(attr->value());
     else if (attr->name() == styleAttr) {
@@ -253,7 +259,7 @@ void StyledElement::parseMappedAttribute(MappedAttribute *attr)
         else
             getInlineStyleDecl()->parseDeclaration(attr->value());
         m_isStyleAttributeValid = true;
-        setChanged();
+        setNeedsStyleRecalc();
     }
 }
 
@@ -502,4 +508,13 @@ void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
         style->addSubresourceStyleURLs(urls);
 }
 
+
+void StyledElement::didMoveToNewOwnerDocument()
+{
+    if (m_inlineStyleDecl)
+        m_inlineStyleDecl->setParent(document()->elementSheet());
+
+    Element::didMoveToNewOwnerDocument();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.h b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
index 4ca48e969b..158992e5c2 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
@@ -25,12 +25,15 @@
 #ifndef StyledElement_h
 #define StyledElement_h
 
+#include "CSSPrimitiveValue.h"
 #include "Element.h"
+#include "MappedAttributeEntry.h"
 #include "NamedMappedAttrMap.h"
 
 namespace WebCore {
 
 class CSSMappedAttributeDeclaration;
+class CSSMutableStyleDeclaration;
 class MappedAttribute;
 
 class StyledElement : public Element {
@@ -87,6 +90,8 @@ protected:
     // parseMappedAttribute (called via setAttribute()) and
     // svgAttributeChanged (called when element.className.baseValue is set)
     void classAttributeChanged(const AtomicString& newClassString);
+    
+    virtual void didMoveToNewOwnerDocument();
 
     RefPtr<CSSMutableStyleDeclaration> m_inlineStyleDecl;
 };
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.cpp b/src/3rdparty/webkit/WebCore/dom/Text.cpp
index 187e39d24d..04e499afbe 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Text.cpp
@@ -23,13 +23,13 @@
 #include "Text.h"
 
 #include "CString.h"
-#include "Document.h"
 #include "ExceptionCode.h"
 #include "RenderText.h"
 #include "TextBreakIterator.h"
 
 #if ENABLE(SVG)
 #include "RenderSVGInlineText.h"
+#include "SVGNames.h"
 #endif
 
 #if ENABLE(WML)
@@ -42,12 +42,12 @@ namespace WebCore {
 // DOM Section 1.1.1
 
 Text::Text(Document* document, const String& text)
-    : CharacterData(document, text)
+    : CharacterData(document, text, true)
 {
 }
 
 Text::Text(Document* document)
-    : CharacterData(document)
+    : CharacterData(document, true)
 {
 }
 
@@ -81,7 +81,7 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
         document()->textNodeSplit(this);
 
     if (renderer())
-        static_cast<RenderText*>(renderer())->setText(m_data);
+        toRenderText(renderer())->setText(m_data);
 
     return newText.release();
 }
@@ -125,17 +125,30 @@ String Text::wholeText() const
     const Text* startText = earliestLogicallyAdjacentTextNode(this);
     const Text* endText = latestLogicallyAdjacentTextNode(this);
 
-    Vector<UChar> result;
     Node* onePastEndText = endText->nextSibling();
+    unsigned resultLength = 0;
     for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
         if (!n->isTextNode())
             continue;
         const Text* t = static_cast<const Text*>(n);
         const String& data = t->data();
-        result.append(data.characters(), data.length());
+        resultLength += data.length();
     }
+    UChar* resultData;
+    String result = String::createUninitialized(resultLength, resultData);
+    UChar* p = resultData;
+    for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
+        if (!n->isTextNode())
+            continue;
+        const Text* t = static_cast<const Text*>(n);
+        const String& data = t->data();
+        unsigned dataLength = data.length();
+        memcpy(p, data.characters(), dataLength * sizeof(UChar));
+        p += dataLength;
+    }
+    ASSERT(p == resultData + resultLength);
 
-    return String::adopt(result);
+    return result;
 }
 
 PassRefPtr<Text> Text::replaceWholeText(const String& newText, ExceptionCode&)
@@ -210,7 +223,7 @@ bool Text::rendererIsNeeded(RenderStyle *style)
     if (prev && prev->isBR()) // <span><br/> <br/></span>
         return false;
         
-    if (par->isInlineFlow()) {
+    if (par->isRenderInline()) {
         // <span><div/> <div/></span>
         if (prev && !prev->isInline())
             return false;
@@ -234,7 +247,11 @@ bool Text::rendererIsNeeded(RenderStyle *style)
 RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
 {
 #if ENABLE(SVG)
-    if (parentNode()->isSVGElement())
+    if (parentNode()->isSVGElement()
+#if ENABLE(SVG_FOREIGN_OBJECT)
+        && !parentNode()->hasTagName(SVGNames::foreignObjectTag)
+#endif
+    )
         return new (arena) RenderSVGInlineText(this, m_data);
 #endif
     
@@ -253,17 +270,17 @@ void Text::recalcStyle(StyleChange change)
         if (renderer())
             renderer()->setStyle(parentNode()->renderer()->style());
     }
-    if (changed()) {
+    if (needsStyleRecalc()) {
         if (renderer()) {
             if (renderer()->isText())
-                static_cast<RenderText*>(renderer())->setText(m_data);
+                toRenderText(renderer())->setText(m_data);
         } else {
             if (attached())
                 detach();
             attach();
         }
     }
-    setChanged(NoStyleChange);
+    setNeedsStyleRecalc(NoStyleChange);
 }
 
 // DOM Section 1.1.1
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.h b/src/3rdparty/webkit/WebCore/dom/Text.h
index 27b1945ea6..5e711d02c1 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.h
+++ b/src/3rdparty/webkit/WebCore/dom/Text.h
@@ -51,7 +51,6 @@ public:
 
     // Other methods (not part of DOM)
 
-    virtual bool isTextNode() const { return true; }
     virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
index 1ed9484ec8..f9c6dc4a17 100644
--- a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
@@ -37,7 +37,7 @@ namespace WebCore {
         // received during executing a script must be appended, hence the
         // extra bool to be able to distinguish between both cases.
         // document.write() always uses false, while the loader uses true.
-        virtual bool write(const SegmentedString&, bool appendData) = 0;
+        virtual void write(const SegmentedString&, bool appendData) = 0;
         virtual void finish() = 0;
         virtual bool isWaitingForScripts() const = 0;
         virtual void stopParsing() { m_parserStopped = true; }
diff --git a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
index d06acb9862..4cc8e9a770 100644
--- a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
@@ -25,7 +25,6 @@
 #ifndef TreeWalker_h
 #define TreeWalker_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilter.h"
 #include "Traversal.h"
 #include <wtf/PassRefPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
index a3c806e4f2..2039541d40 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
@@ -34,20 +34,15 @@ WheelEvent::WheelEvent()
 {
 }
 
-WheelEvent::WheelEvent(float wheelDeltaX, float wheelDeltaY, PassRefPtr<AbstractView> view,
+WheelEvent::WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
                        int screenX, int screenY, int pageX, int pageY,
                        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
     : MouseRelatedEvent(eventNames().mousewheelEvent,
                         true, true, view, 0, screenX, screenY, pageX, pageY, 
                         ctrlKey, altKey, shiftKey, metaKey)
-    , m_wheelDeltaX(lroundf(wheelDeltaX) * 120)
-    , m_wheelDeltaY(lroundf(wheelDeltaY) * 120) // Normalize to the Windows 120 multiple
+    , m_wheelDeltaX(lroundf(wheelTicksX * 120))
+    , m_wheelDeltaY(lroundf(wheelTicksY * 120)) // Normalize to the Windows 120 multiple
 {
-    // Rounding delta to zero makes no sense and breaks Google Maps, <http://bugs.webkit.org/show_bug.cgi?id=16078>.
-    if (wheelDeltaX && !m_wheelDeltaX)
-        m_wheelDeltaX = (wheelDeltaX > 0) ? 120 : -120;
-    if (wheelDeltaY && !m_wheelDeltaY)
-        m_wheelDeltaY = (wheelDeltaY > 0) ? 120 : -120;
 }
 
 void WheelEvent::initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<AbstractView> view,
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
index 015796e5ce..04d54213c5 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
@@ -35,11 +35,11 @@ namespace WebCore {
         {
             return adoptRef(new WheelEvent);
         }
-        static PassRefPtr<WheelEvent> create(float wheelDeltaX, float wheelDeltaY, PassRefPtr<AbstractView> view,
+        static PassRefPtr<WheelEvent> create(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
             int screenX, int screenY, int pageX, int pageY,
             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
         {
-            return adoptRef(new WheelEvent(wheelDeltaX, wheelDeltaY, view, screenX, screenY, pageX, pageY,
+            return adoptRef(new WheelEvent(wheelTicksX, wheelTicksY, view, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey));
         }
 
@@ -56,7 +56,7 @@ namespace WebCore {
 
     private:
         WheelEvent();
-        WheelEvent(float wheelDeltaX, float wheelDeltaY, PassRefPtr<AbstractView>,
+        WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView>,
                    int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
 
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
index 1445509431..4cba4ac0cb 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
@@ -42,11 +42,11 @@ module events {
         readonly attribute long    x;
         readonly attribute long    y;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute boolean isHorizontal;
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         void initWheelEvent(in long wheelDeltaX,
                             in long wheelDeltaY, 
                             in DOMWindow view, 
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index c411e50e05..1747c3c548 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -39,7 +39,6 @@
 #include "FrameView.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
-#include "HTMLScriptElement.h"
 #include "HTMLStyleElement.h"
 #include "ProcessingInstruction.h"
 #include "ResourceError.h"
@@ -47,6 +46,7 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptController.h"
+#include "ScriptElement.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
@@ -57,7 +57,6 @@
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
-#include "SVGScriptElement.h"
 #include "SVGStyleElement.h"
 #endif
 
@@ -65,32 +64,9 @@ using namespace std;
 
 namespace WebCore {
 
-const int maxErrors = 25;
+using namespace HTMLNames;
 
-bool isScriptElement(Element* element)
-{
-    return element->hasTagName(HTMLNames::scriptTag)
-#if ENABLE(SVG)
-        || element->hasTagName(SVGNames::scriptTag)
-#endif
-        ;
-}
-
-ScriptElement* castToScriptElement(Element* element)
-{
-    ASSERT(isScriptElement(element));
-
-    if (element->hasTagName(HTMLNames::scriptTag))
-        return static_cast<HTMLScriptElement*>(element);
-
-#if ENABLE(SVG)
-    if (element->hasTagName(SVGNames::scriptTag))
-        return static_cast<SVGScriptElement*>(element);
-#endif
-
-    ASSERT_NOT_REACHED();
-    return 0;
-}
+const int maxErrors = 25;
 
 #if ENABLE(WML)
 bool XMLTokenizer::isWMLDocument() const
@@ -113,7 +89,7 @@ void XMLTokenizer::setCurrentNode(Node* n)
     m_currentNodeIsReferenced = nodeNeedsReference;
 }
 
-bool XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
+void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
 {
     String parseString = s.toString();
     
@@ -121,15 +97,14 @@ bool XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
         m_originalSourceForTransform += parseString;
 
     if (m_parserStopped || m_sawXSLTransform)
-        return false;
+        return;
     
     if (m_parserPaused) {
         m_pendingSrc.append(s);
-        return false;
+        return;
     }
     
     doWrite(s.toString());
-    return false;
 }
 
 void XMLTokenizer::handleError(ErrorType type, const char* m, int lineNumber, int columnNumber)
@@ -226,20 +201,20 @@ void XMLTokenizer::finish()
 
 static inline RefPtr<Element> createXHTMLParserErrorHeader(Document* doc, const String& errorMessages) 
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> reportElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "parsererror", ec);
-    reportElement->setAttribute(HTMLNames::styleAttr, "display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black");
+    RefPtr<Element> reportElement = doc->createElement(QualifiedName(nullAtom, "parsererror", xhtmlNamespaceURI), false);
+    reportElement->setAttribute(styleAttr, "display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black");
     
-    RefPtr<Element> h3 = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "h3", ec);
+    ExceptionCode ec = 0;
+    RefPtr<Element> h3 = doc->createElement(h3Tag, false);
     reportElement->appendChild(h3.get(), ec);
     h3->appendChild(doc->createTextNode("This page contains the following errors:"), ec);
-    
-    RefPtr<Element> fixed = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "div", ec);
+
+    RefPtr<Element> fixed = doc->createElement(divTag, false);
     reportElement->appendChild(fixed.get(), ec);
-    fixed->setAttribute(HTMLNames::styleAttr, "font-family:monospace;font-size:12px");
+    fixed->setAttribute(styleAttr, "font-family:monospace;font-size:12px");
     fixed->appendChild(doc->createTextNode(errorMessages), ec);
-    
-    h3 = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "h3", ec);
+
+    h3 = doc->createElement(h3Tag, false);
     reportElement->appendChild(h3.get(), ec);
     h3->appendChild(doc->createTextNode("Below is a rendering of the page up to the first error."), ec);
     
@@ -261,16 +236,16 @@ void XMLTokenizer::insertErrorMessageBlock()
     Document* doc = m_doc;
     Node* documentElement = doc->documentElement();
     if (!documentElement) {
-        RefPtr<Node> rootElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "html", ec);
+        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
         doc->appendChild(rootElement, ec);
-        RefPtr<Node> body = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "body", ec);
+        RefPtr<Node> body = doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         documentElement = body.get();
     }
 #if ENABLE(SVG)
     else if (documentElement->namespaceURI() == SVGNames::svgNamespaceURI) {
-        RefPtr<Node> rootElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "html", ec);
-        RefPtr<Node> body = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "body", ec);
+        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
+        RefPtr<Node> body = doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         body->appendChild(documentElement, ec);
         doc->appendChild(rootElement.get(), ec);
@@ -279,8 +254,8 @@ void XMLTokenizer::insertErrorMessageBlock()
 #endif
 #if ENABLE(WML)
     else if (isWMLDocument()) {
-        RefPtr<Node> rootElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "html", ec);
-        RefPtr<Node> body = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "body", ec);
+        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
+        RefPtr<Node> body = doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         body->appendChild(documentElement, ec);
         doc->appendChild(rootElement.get(), ec);
@@ -292,18 +267,18 @@ void XMLTokenizer::insertErrorMessageBlock()
     documentElement->insertBefore(reportElement, documentElement->firstChild(), ec);
 #if ENABLE(XSLT)
     if (doc->transformSourceDocument()) {
-        RefPtr<Element> par = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "p", ec);
+        RefPtr<Element> par = doc->createElement(pTag, false);
         reportElement->appendChild(par, ec);
-        par->setAttribute(HTMLNames::styleAttr, "white-space: normal");
+        par->setAttribute(styleAttr, "white-space: normal");
         par->appendChild(doc->createTextNode("This document was created as the result of an XSL transformation. The line and column numbers given are from the transformed result."), ec);
     }
 #endif
-    doc->updateRendering();
+    doc->updateStyleIfNeeded();
 }
 
-void XMLTokenizer::notifyFinished(CachedResource* finishedObj)
+void XMLTokenizer::notifyFinished(CachedResource* unusedResource)
 {
-    ASSERT(m_pendingScript == finishedObj);
+    ASSERT_UNUSED(unusedResource, unusedResource == m_pendingScript);
     ASSERT(m_pendingScript->accessCount() > 0);
         
     ScriptSourceCode sourceCode(m_pendingScript.get());
@@ -315,7 +290,7 @@ void XMLTokenizer::notifyFinished(CachedResource* finishedObj)
     RefPtr<Element> e = m_scriptElement;
     m_scriptElement = 0;
 
-    ScriptElement* scriptElement = castToScriptElement(e.get());
+    ScriptElement* scriptElement = toScriptElement(e.get());
     ASSERT(scriptElement);
 
     if (errorOccurred) 
@@ -345,4 +320,3 @@ void XMLTokenizer::pauseParsing()
 }
 
 }
-
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
index 6d54eeb0a0..019a831f17 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
@@ -3,6 +3,7 @@
  * Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -60,7 +61,7 @@ namespace WebCore {
         enum ErrorType { warning, nonFatal, fatal };
 
         // from Tokenizer
-        virtual bool write(const SegmentedString&, bool appendData);
+        virtual void write(const SegmentedString&, bool appendData);
         virtual void finish();
         virtual bool isWaitingForScripts() const;
         virtual void stopParsing();
@@ -72,6 +73,10 @@ namespace WebCore {
 
         void setIsXHTMLDocument(bool isXHTML) { m_isXHTMLDocument = isXHTML; }
         bool isXHTMLDocument() const { return m_isXHTMLDocument; }
+#if ENABLE(XHTMLMP)
+        void setIsXHTMLMPDocument(bool isXHTML) { m_isXHTMLMPDocument = isXHTML; }
+        bool isXHTMLMPDocument() const { return m_isXHTMLMPDocument; }
+#endif
 #if ENABLE(WML)
         bool isWMLDocument() const;
 #endif
@@ -149,6 +154,10 @@ public:
         bool m_sawXSLTransform;
         bool m_sawFirstElement;
         bool m_isXHTMLDocument;
+#if ENABLE(XHTMLMP)
+        bool m_isXHTMLMPDocument;
+        bool m_hasDocTypeDeclaration;
+#endif
 
         bool m_parserPaused;
         bool m_requestingScript;
@@ -173,15 +182,11 @@ public:
 
 #if ENABLE(XSLT)
 void* xmlDocPtrForString(DocLoader*, const String& source, const String& url);
-void setLoaderForLibXMLCallbacks(DocLoader*);
 #endif
 
 HashMap<String, String> parseAttributes(const String&, bool& attrsOK);
 bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent = 0);
 
-bool isScriptElement(Element*);
-ScriptElement* castToScriptElement(Element*);
-
 } // namespace WebCore
 
 #endif // XMLTokenizer_h
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index d0eacdc751..4098eaaf81 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -50,17 +50,24 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
+#include "XMLTokenizerScope.h"
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
 #include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
+#include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
 #if ENABLE(XSLT)
 #include <libxslt/xslt.h>
 #endif
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -81,12 +88,12 @@ public:
         callback->xmlPrefix = xmlStrdup(xmlPrefix);
         callback->xmlURI = xmlStrdup(xmlURI);
         callback->nb_namespaces = nb_namespaces;
-        callback->namespaces = reinterpret_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_namespaces * 2));
+        callback->namespaces = static_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_namespaces * 2));
         for (int i = 0; i < nb_namespaces * 2 ; i++)
             callback->namespaces[i] = xmlStrdup(namespaces[i]);
         callback->nb_attributes = nb_attributes;
         callback->nb_defaulted = nb_defaulted;
-        callback->attributes = reinterpret_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_attributes * 5));
+        callback->attributes = static_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_attributes * 5));
         for (int i = 0; i < nb_attributes; i++) {
             // Each attribute has 5 elements in the array:
             // name, prefix, uri, value and an end pointer.
@@ -203,8 +210,8 @@ private:
         
         virtual void call(XMLTokenizer* tokenizer) {
             tokenizer->startElementNs(xmlLocalName, xmlPrefix, xmlURI, 
-                                      nb_namespaces, (const xmlChar**)namespaces,
-                                      nb_attributes, nb_defaulted, (const xmlChar**)(attributes));
+                                      nb_namespaces, const_cast<const xmlChar**>(namespaces),
+                                      nb_attributes, nb_defaulted, const_cast<const xmlChar**>(attributes));
         }
 
         xmlChar* xmlLocalName;
@@ -324,14 +331,13 @@ private:
 // --------------------------------
 
 static int globalDescriptor = 0;
-static DocLoader* globalDocLoader = 0;
 static ThreadIdentifier libxmlLoaderThread = 0;
 
 static int matchFunc(const char*)
 {
     // Only match loads initiated due to uses of libxml2 from within XMLTokenizer to avoid
     // interfering with client applications that also use libxml2.  http://bugs.webkit.org/show_bug.cgi?id=17353
-    return globalDocLoader && currentThread() == libxmlLoaderThread;
+    return XMLTokenizerScope::currentDocLoader && currentThread() == libxmlLoaderThread;
 }
 
 class OffsetBuffer {
@@ -381,8 +387,8 @@ static bool shouldAllowExternalLoad(const KURL& url)
     // retrieved content.  If we had more context, we could potentially allow
     // the parser to load a DTD.  As things stand, we take the conservative
     // route and allow same-origin requests only.
-    if (!globalDocLoader->doc()->securityOrigin()->canRequest(url)) {
-        globalDocLoader->printAccessDeniedMessage(url);
+    if (!XMLTokenizerScope::currentDocLoader->doc()->securityOrigin()->canRequest(url)) {
+        XMLTokenizerScope::currentDocLoader->printAccessDeniedMessage(url);
         return false;
     }
 
@@ -391,10 +397,10 @@ static bool shouldAllowExternalLoad(const KURL& url)
 
 static void* openFunc(const char* uri)
 {
-    ASSERT(globalDocLoader);
+    ASSERT(XMLTokenizerScope::currentDocLoader);
     ASSERT(currentThread() == libxmlLoaderThread);
 
-    KURL url(uri);
+    KURL url(KURL(), uri);
 
     if (!shouldAllowExternalLoad(url))
         return &globalDescriptor;
@@ -402,15 +408,16 @@ static void* openFunc(const char* uri)
     ResourceError error;
     ResourceResponse response;
     Vector<char> data;
-    
-    DocLoader* docLoader = globalDocLoader;
-    globalDocLoader = 0;
-    // FIXME: We should restore the original global error handler as well.
 
-    if (docLoader->frame()) 
-        docLoader->frame()->loader()->loadResourceSynchronously(url, error, response, data);
 
-    globalDocLoader = docLoader;
+    {
+        DocLoader* docLoader = XMLTokenizerScope::currentDocLoader;
+        XMLTokenizerScope scope(0);
+        // FIXME: We should restore the original global error handler as well.
+
+        if (docLoader->frame()) 
+            docLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
+    }
 
     // We have to check the URL again after the load to catch redirects.
     // See <https://bugs.webkit.org/show_bug.cgi?id=21963>.
@@ -452,11 +459,6 @@ static void errorFunc(void*, const char*, ...)
 }
 #endif
 
-void setLoaderForLibXMLCallbacks(DocLoader* docLoader)
-{
-    globalDocLoader = docLoader;
-}
-
 static bool didInit = false;
 
 static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
@@ -529,6 +531,10 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -552,6 +558,10 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -582,7 +592,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         return;
     
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -624,6 +634,7 @@ void XMLTokenizer::doWrite(const String& parseString)
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
         xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
+        XMLTokenizerScope scope(m_doc->docLoader());
         xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
@@ -705,8 +716,14 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
                                                          nb_attributes, nb_defaulted, libxmlAttributes);
         return;
     }
-    
-    m_sawFirstElement = true;
+
+#if ENABLE(XHTMLMP) 
+    // check if the DOCTYPE Declaration of XHTMLMP document exists
+    if (!m_hasDocTypeDeclaration && m_doc->isXHTMLMPDocument()) {
+        handleError(fatal, "DOCTYPE declaration lost.", lineNumber(), columnNumber());
+        return;
+    }
+#endif
 
     exitText();
 
@@ -721,14 +738,35 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
             uri = m_defaultNamespaceURI;
     }
 
-    ExceptionCode ec = 0;
+#if ENABLE(XHTMLMP)
+    if (!m_sawFirstElement && isXHTMLMPDocument()) {
+        // As per the section 7.1 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, 
+        // we should make sure that the root element MUST be 'html' and 
+        // ensure the name of the default namespace on the root elment 'html' 
+        // MUST be 'http://www.w3.org/1999/xhtml'
+        if (localName != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "XHTMLMP document expects 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        }
+
+        if (uri.isNull()) {
+            m_defaultNamespaceURI = HTMLNames::xhtmlNamespaceURI; 
+            uri = m_defaultNamespaceURI;
+        }
+    }
+#endif
+
+    bool isFirstElement = !m_sawFirstElement;
+    m_sawFirstElement = true;
+
     QualifiedName qName(prefix, localName, uri);
-    RefPtr<Element> newElement = m_doc->createElement(qName, true, ec);
+    RefPtr<Element> newElement = m_doc->createElement(qName, true);
     if (!newElement) {
         stopParsing();
         return;
     }
     
+    ExceptionCode ec = 0;
     handleElementNamespaces(newElement.get(), libxmlNamespaces, nb_namespaces, ec);
     if (ec) {
         stopParsing();
@@ -737,7 +775,7 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
 
     ScriptController* jsProxy = m_doc->frame() ? m_doc->frame()->script() : 0;
     if (jsProxy && m_doc->frame()->script()->isEnabled())
-        jsProxy->setEventHandlerLineno(lineNumber());
+        jsProxy->setEventHandlerLineNumber(lineNumber());
 
     handleElementAttributes(newElement.get(), libxmlAttributes, nb_attributes, ec);
     if (ec) {
@@ -746,11 +784,12 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     }
 
     if (jsProxy)
-        jsProxy->setEventHandlerLineno(0);
+        jsProxy->setEventHandlerLineNumber(0);
 
     newElement->beginParsingChildren();
 
-    if (isScriptElement(newElement.get()))
+    ScriptElement* scriptElement = toScriptElement(newElement.get());
+    if (scriptElement)
         m_scriptStartLine = lineNumber();
 
     if (!m_currentNode->addChild(newElement.get())) {
@@ -761,6 +800,9 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     setCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
+
+    if (isFirstElement && m_doc->frame())
+        m_doc->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
 void XMLTokenizer::endElementNs()
@@ -778,15 +820,29 @@ void XMLTokenizer::endElementNs()
     Node* n = m_currentNode;
     RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
-    
-    // don't load external scripts for standalone documents (for now)
-    if (n->isElementNode() && m_view && isScriptElement(static_cast<Element*>(n))) {
-        ASSERT(!m_pendingScript);
-        m_requestingScript = true;
 
-        Element* element = static_cast<Element*>(n); 
-        ScriptElement* scriptElement = castToScriptElement(element);
+    if (!n->isElementNode() || !m_view) {
+        setCurrentNode(parent.get());
+        return;
+    }
+
+    Element* element = static_cast<Element*>(n);
+    ScriptElement* scriptElement = toScriptElement(element);
+    if (!scriptElement) {
+        setCurrentNode(parent.get());
+        return;
+    }
 
+    // don't load external scripts for standalone documents (for now)
+    ASSERT(!m_pendingScript);
+    m_requestingScript = true;
+
+#if ENABLE(XHTMLMP)
+    if (!scriptElement->shouldExecuteAsJavaScript())
+        m_doc->setShouldProcessNoscriptElement(true);
+    else 
+#endif
+    {
         String scriptHref = scriptElement->sourceAttributeValue();
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
@@ -802,10 +858,8 @@ void XMLTokenizer::endElementNs()
                 m_scriptElement = 0;
         } else
             m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
-
-        m_requestingScript = false;
     }
-
+    m_requestingScript = false;
     setCurrentNode(parent.get());
 }
 
@@ -833,7 +887,8 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
     char* m;
-    vasprintf(&m, message, args);
+    if (vasprintf(&m, message, args) == -1)
+        return;
 #endif
     
     if (m_parserPaused)
@@ -932,6 +987,9 @@ void XMLTokenizer::startDocument(const xmlChar* version, const xmlChar* encoding
 void XMLTokenizer::endDocument()
 {
     exitText();
+#if ENABLE(XHTMLMP)
+    m_hasDocTypeDeclaration = false;
+#endif
 }
 
 void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID, const xmlChar* systemID)
@@ -945,8 +1003,10 @@ void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID
     }
     
     if (m_doc) {
-#if ENABLE(WML)
+#if ENABLE(WML) || ENABLE(XHTMLMP)
         String extId = toString(externalID);
+#endif
+#if ENABLE(WML)
         if (isWMLDocument()
             && extId != "-//WAPFORUM//DTD WML 1.3//EN"
             && extId != "-//WAPFORUM//DTD WML 1.2//EN"
@@ -954,8 +1014,31 @@ void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID
             && extId != "-//WAPFORUM//DTD WML 1.0//EN")
             handleError(fatal, "Invalid DTD Public ID", lineNumber(), columnNumber());
 #endif
+#if ENABLE(XHTMLMP)
+        String dtdName = toString(name);
+        if (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN"
+            || extId == "-//WAPFORUM//DTD XHTML Mobile 1.1//EN") {
+            if (dtdName != HTMLNames::htmlTag.localName()) {
+                handleError(fatal, "Invalid DOCTYPE declaration, expected 'html' as root element.", lineNumber(), columnNumber());
+                return;
+            } 
+
+            if (m_doc->isXHTMLMPDocument())
+                setIsXHTMLMPDocument(true);
+            else
+                setIsXHTMLDocument(true);
+
+            m_hasDocTypeDeclaration = true;
+        }
+#endif
 
+#if ENABLE(XHTMLMP)
+        m_doc->addChild(DocumentType::create(m_doc, dtdName, extId, toString(systemID)));
+#elif ENABLE(WML)
+        m_doc->addChild(DocumentType::create(m_doc, toString(name), extId, toString(systemID)));
+#else
         m_doc->addChild(DocumentType::create(m_doc, toString(name), toString(externalID), toString(systemID)));
+#endif
     }
 }
 
@@ -970,6 +1053,8 @@ static inline XMLTokenizer* getTokenizer(void* closure)
 static inline bool hackAroundLibXMLEntityBug(void* closure)
 {
 #if LIBXML_VERSION >= 20627
+    UNUSED_PARAM(closure);
+
     // This bug has been fixed in libxml 2.6.27.
     return false;
 #else
@@ -1052,19 +1137,22 @@ static void normalErrorHandler(void* closure, const char* message, ...)
     va_end(args);
 }
 
-// Using a global variable entity and marking it XML_INTERNAL_PREDEFINED_ENTITY is
+// Using a static entity and marking it XML_INTERNAL_PREDEFINED_ENTITY is
 // a hack to avoid malloc/free. Using a global variable like this could cause trouble
 // if libxml implementation details were to change
-static xmlChar sharedXHTMLEntityResult[5] = {0,0,0,0,0};
-static xmlEntity sharedXHTMLEntity = {
-    0, XML_ENTITY_DECL, 0, 0, 0, 0, 0, 0, 0, 
-    sharedXHTMLEntityResult, sharedXHTMLEntityResult, 0,
-    XML_INTERNAL_PREDEFINED_ENTITY, 0, 0, 0, 0, 0,
-#if LIBXML_VERSION >= 20627
-    // xmlEntity gained an extra member in 2.6.27.
-    1
-#endif
-};
+static xmlChar sharedXHTMLEntityResult[5] = {0, 0, 0, 0, 0};
+
+static xmlEntityPtr sharedXHTMLEntity()
+{
+    static xmlEntity entity;
+    if (!entity.type) {
+        entity.type = XML_ENTITY_DECL;
+        entity.orig = sharedXHTMLEntityResult;
+        entity.content = sharedXHTMLEntityResult;
+        entity.etype = XML_INTERNAL_PREDEFINED_ENTITY;
+    }
+    return &entity;
+}
 
 static xmlEntityPtr getXHTMLEntity(const xmlChar* name)
 {
@@ -1074,11 +1162,12 @@ static xmlEntityPtr getXHTMLEntity(const xmlChar* name)
 
     CString value = String(&c, 1).utf8();
     ASSERT(value.length() < 5);
-    sharedXHTMLEntity.length = value.length();
-    sharedXHTMLEntity.name = name;
-    memcpy(sharedXHTMLEntityResult, value.data(), sharedXHTMLEntity.length + 1);
+    xmlEntityPtr entity = sharedXHTMLEntity();
+    entity->length = value.length();
+    entity->name = name;
+    memcpy(sharedXHTMLEntityResult, value.data(), entity->length + 1);
 
-    return &sharedXHTMLEntity;
+    return entity;
 }
 
 static xmlEntityPtr getEntityHandler(void* closure, const xmlChar* name)
@@ -1092,6 +1181,9 @@ static xmlEntityPtr getEntityHandler(void* closure, const xmlChar* name)
 
     ent = xmlGetDocEntity(ctxt->myDoc, name);
     if (!ent && (getTokenizer(closure)->isXHTMLDocument()
+#if ENABLE(XHTMLMP)
+                 || getTokenizer(closure)->isXHTMLMPDocument()
+#endif
 #if ENABLE(WML)
                  || getTokenizer(closure)->isWMLDocument()
 #endif
@@ -1133,7 +1225,10 @@ static void externalSubsetHandler(void* closure, const xmlChar*, const xmlChar*
         || (extId == "-//W3C//DTD XHTML Basic 1.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN")
-        || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))
+#if !ENABLE(XHTMLMP)
+        || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN")
+#endif
+       )
         getTokenizer(closure)->setIsXHTMLDocument(true); // controls if we replace entities or not.
 }
 
@@ -1171,6 +1266,7 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
     m_sawXSLTransform = false;
     m_sawFirstElement = false;
 
+    XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
         m_context = createMemoryParser(&sax, this, chunk);
     else
@@ -1192,8 +1288,11 @@ void XMLTokenizer::doEnd()
 
     if (m_context) {
         // Tell libxml we're done.
-        xmlParseChunk(m_context, 0, 0, 1);
-        
+        {
+            XMLTokenizerScope scope(m_doc->docLoader());
+            xmlParseChunk(m_context, 0, 0, 1);
+        }
+
         if (m_context->myDoc)
             xmlFreeDoc(m_context->myDoc);
         xmlFreeParserCtxt(m_context);
@@ -1213,21 +1312,12 @@ void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const Strin
     const UChar BOM = 0xFEFF;
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
 
-    xmlGenericErrorFunc oldErrorFunc = xmlGenericError;
-    void* oldErrorContext = xmlGenericErrorContext;
-    
-    setLoaderForLibXMLCallbacks(docLoader);        
-    xmlSetGenericErrorFunc(0, errorFunc);
-    
+    XMLTokenizerScope scope(docLoader, errorFunc, 0);
     xmlDocPtr sourceDoc = xmlReadMemory(reinterpret_cast<const char*>(source.characters()),
                                         source.length() * sizeof(UChar),
                                         url.latin1().data(),
                                         BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
                                         XSLT_PARSE_OPTIONS);
-    
-    setLoaderForLibXMLCallbacks(0);
-    xmlSetGenericErrorFunc(oldErrorContext, oldErrorFunc);
-    
     return sourceDoc;
 }
 #endif
@@ -1281,7 +1371,8 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
 
     XMLTokenizer tokenizer(fragment, parent);
     
-    tokenizer.initializeParserContext(chunk.utf8().data());
+    CString chunkAsUtf8 = chunk.utf8();
+    tokenizer.initializeParserContext(chunkAsUtf8.data());
 
     xmlParseContent(tokenizer.m_context);
 
@@ -1289,7 +1380,7 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
 
     // Check if all the chunk has been processed.
     long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
-    if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) == sizeof(UChar) * chunk.length())
+    if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 39ccefec53..3173708e27 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -56,6 +56,11 @@
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -85,6 +90,10 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -110,6 +119,10 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -141,7 +154,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     
 #if QT_VERSION < 0x040400
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -154,7 +167,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
 #else
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -357,7 +370,7 @@ HashMap<String, String> parseAttributes(const String& string, bool& attrsOK)
     state.gotAttributes = false;
 
     QXmlStreamReader stream;
-    QString dummy = QString::fromLatin1("<?xml version=\"1.0\"?><attrs %1 />").arg(string);
+    QString dummy = QString(QLatin1String("<?xml version=\"1.0\"?><attrs %1 />")).arg(string);
     stream.addData(dummy);
     while (!stream.atEnd()) {
         stream.readNext();
@@ -419,6 +432,12 @@ void XMLTokenizer::parse()
         }
             break;
         case QXmlStreamReader::StartElement: {
+#if ENABLE(XHTMLMP)
+            if (m_doc->isXHTMLMPDocument() && !m_hasDocTypeDeclaration) {
+                handleError(fatal, "DOCTYPE declaration lost.", lineNumber(), columnNumber());
+                break;
+            }
+#endif 
             parseStartElement();
         }
             break;
@@ -443,12 +462,18 @@ void XMLTokenizer::parse()
         case QXmlStreamReader::DTD: {
             //qDebug()<<"------------- DTD";
             parseDtd();
+#if ENABLE(XHTMLMP)
+            m_hasDocTypeDeclaration = true;
+#endif
         }
             break;
         case QXmlStreamReader::EntityReference: {
             //qDebug()<<"---------- ENTITY = "<<m_stream.name().toString()
             //        <<", t = "<<m_stream.text().toString();
             if (isXHTMLDocument()
+#if ENABLE(XHTMLMP)
+                || isXHTMLMPDocument()
+#endif
 #if ENABLE(WML)
                 || isWMLDocument()
 #endif
@@ -507,7 +532,6 @@ void XMLTokenizer::parseStartElement()
         m_sawFirstElement = true;
         return;
     }
-    m_sawFirstElement = true;
 
     exitText();
 
@@ -520,14 +544,36 @@ void XMLTokenizer::parseStartElement()
         uri = m_defaultNamespaceURI;
     }
 
-    ExceptionCode ec = 0;
     QualifiedName qName(prefix, localName, uri);
-    RefPtr<Element> newElement = m_doc->createElement(qName, true, ec);
+    RefPtr<Element> newElement = m_doc->createElement(qName, true);
     if (!newElement) {
         stopParsing();
         return;
     }
 
+#if ENABLE(XHTMLMP)
+    if (!m_sawFirstElement && isXHTMLMPDocument()) {
+        // As per 7.1 section of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, 
+        // we should make sure that the root element MUST be 'html' and 
+        // ensure the name of the default namespace on the root elment 'html' 
+        // MUST be 'http://www.w3.org/1999/xhtml'
+        if (localName != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "XHTMLMP document expects 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        } 
+
+        if (uri.isNull()) {
+            m_defaultNamespaceURI = HTMLNames::xhtmlNamespaceURI; 
+            uri = m_defaultNamespaceURI;
+            m_stream.addExtraNamespaceDeclaration(QXmlStreamNamespaceDeclaration(prefix, HTMLNames::xhtmlNamespaceURI));
+        }
+    }
+#endif
+
+    bool isFirstElement = !m_sawFirstElement;
+    m_sawFirstElement = true;
+
+    ExceptionCode ec = 0;
     handleElementNamespaces(newElement.get(), m_stream.namespaceDeclarations(), ec);
     if (ec) {
         stopParsing();
@@ -540,7 +586,8 @@ void XMLTokenizer::parseStartElement()
         return;
     }
 
-    if (isScriptElement(newElement.get()))
+    ScriptElement* scriptElement = toScriptElement(newElement.get());
+    if (scriptElement)
         m_scriptStartLine = lineNumber();
 
     if (!m_currentNode->addChild(newElement.get())) {
@@ -551,6 +598,9 @@ void XMLTokenizer::parseStartElement()
     setCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
+
+    if (isFirstElement && m_doc->frame())
+        m_doc->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
 void XMLTokenizer::parseEndElement()
@@ -561,17 +611,31 @@ void XMLTokenizer::parseEndElement()
     RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
 
-    // don't load external scripts for standalone documents (for now)
-    if (n->isElementNode() && m_view && isScriptElement(static_cast<Element*>(n))) {
-        ASSERT(!m_pendingScript);
-        m_requestingScript = true;
+    if (!n->isElementNode() || !m_view) {
+        setCurrentNode(parent.get());
+        return;
+    }
 
-        Element* element = static_cast<Element*>(n); 
-        ScriptElement* scriptElement = castToScriptElement(element);
+    Element* element = static_cast<Element*>(n);
+    ScriptElement* scriptElement = toScriptElement(element);
+    if (!scriptElement) {
+        setCurrentNode(parent.get());
+        return;
+    }
+
+    // don't load external scripts for standalone documents (for now)
+    ASSERT(!m_pendingScript);
+    m_requestingScript = true;
 
+#if ENABLE(XHTMLMP)
+    if (!scriptElement->shouldExecuteAsJavaScript())
+        m_doc->setShouldProcessNoscriptElement(true);
+    else
+#endif
+    {
         String scriptHref = scriptElement->sourceAttributeValue();
         if (!scriptHref.isEmpty()) {
-            // we have a src attribute
+            // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
             if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
@@ -580,14 +644,12 @@ void XMLTokenizer::parseEndElement()
                 // m_pendingScript will be 0 if script was already loaded and ref() executed it
                 if (m_pendingScript)
                     pauseParsing();
-            } else
+            } else 
                 m_scriptElement = 0;
         } else
             m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
-
-        m_requestingScript = false;
     }
-
+    m_requestingScript = false;
     setCurrentNode(parent.get());
 }
 
@@ -622,7 +684,7 @@ void XMLTokenizer::parseProcessingInstruction()
 
 #if ENABLE(XSLT)
     m_sawXSLTransform = !m_sawFirstElement && pi->isXSL();
-    if (m_sawXSLTransform && !m_doc->transformSourceDocument())
+    if (m_sawXSLTransform && !m_doc->transformSourceDocument()))
         stopParsing();
 #endif
 }
@@ -650,6 +712,9 @@ void XMLTokenizer::parseComment()
 
 void XMLTokenizer::endDocument()
 {
+#if ENABLE(XHTMLMP)
+    m_hasDocTypeDeclaration = false;
+#endif
 }
 
 bool XMLTokenizer::hasError() const
@@ -743,9 +808,25 @@ void XMLTokenizer::parseDtd()
         || (publicId == QLatin1String("-//W3C//DTD XHTML Basic 1.0//EN"))
         || (publicId == QLatin1String("-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"))
         || (publicId == QLatin1String("-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN"))
-        || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))) {
+#if !ENABLE(XHTMLMP)
+        || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))
+#endif
+       )
         setIsXHTMLDocument(true); // controls if we replace entities or not.
+#if ENABLE(XHTMLMP)
+    else if ((publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.1//EN"))
+             || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))) {
+        if (AtomicString(name) != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "Invalid DOCTYPE declaration, expected 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        } 
+
+        if (m_doc->isXHTMLMPDocument()) // check if the MIME type is correct with this method
+            setIsXHTMLMPDocument(true);
+        else
+            setIsXHTMLDocument(true);
     }
+#endif
 #if ENABLE(WML)
     else if (m_doc->isWMLDocument()
              && publicId != QLatin1String("-//WAPFORUM//DTD WML 1.3//EN")
@@ -760,4 +841,3 @@ void XMLTokenizer::parseDtd()
 }
 }
 
-
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.cpp
new file mode 100644
index 0000000000..3769f59705
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "XMLTokenizerScope.h"
+
+namespace WebCore {
+
+DocLoader* XMLTokenizerScope::currentDocLoader = 0;
+
+XMLTokenizerScope::XMLTokenizerScope(DocLoader* docLoader)
+    : m_oldDocLoader(currentDocLoader)
+#if ENABLE(XSLT)
+    , m_oldGenericErrorFunc(xmlGenericError)
+    , m_oldStructuredErrorFunc(xmlStructuredError)
+    , m_oldErrorContext(xmlGenericErrorContext)
+#endif
+{
+    currentDocLoader = docLoader;
+}
+
+#if ENABLE(XSLT)
+XMLTokenizerScope::XMLTokenizerScope(DocLoader* docLoader, xmlGenericErrorFunc genericErrorFunc, xmlStructuredErrorFunc structuredErrorFunc, void* errorContext)
+    : m_oldDocLoader(currentDocLoader)
+    , m_oldGenericErrorFunc(xmlGenericError)
+    , m_oldStructuredErrorFunc(xmlStructuredError)
+    , m_oldErrorContext(xmlGenericErrorContext)
+{
+    currentDocLoader = docLoader;
+    if (genericErrorFunc)
+        xmlSetGenericErrorFunc(errorContext, genericErrorFunc);
+    if (structuredErrorFunc)
+        xmlSetStructuredErrorFunc(errorContext, structuredErrorFunc);
+}
+#endif
+
+XMLTokenizerScope::~XMLTokenizerScope()
+{
+    currentDocLoader = m_oldDocLoader;
+#if ENABLE(XSLT)
+    xmlSetGenericErrorFunc(m_oldErrorContext, m_oldGenericErrorFunc);
+    xmlSetStructuredErrorFunc(m_oldErrorContext, m_oldStructuredErrorFunc);
+#endif
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/page/chromium/AccessibilityObjectWrapper.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h
index 0846d203e1..a3c1188b48 100644
--- a/src/3rdparty/webkit/WebCore/page/chromium/AccessibilityObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +20,43 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef AccessibilityObjectWrapper_h
-#define AccessibilityObjectWrapper_h
+#ifndef XMLTokenizerScope_h
+#define XMLTokenizerScope_h
+
+#include <wtf/Noncopyable.h>
+
+#if ENABLE(XSLT)
+#include <libxml/tree.h>
+#endif
 
 namespace WebCore {
 
-    class AccessibilityObject;
+    class DocLoader;
 
-    class AccessibilityObjectWrapper : public RefCounted<AccessibilityObjectWrapper> {
+    class XMLTokenizerScope : Noncopyable {
     public:
-        virtual ~AccessibilityObjectWrapper() {}
-        virtual void detach() = 0;
-        bool attached() const { return m_object; }
-        AccessibilityObject* accessibilityObject() const { return m_object; }
+        XMLTokenizerScope(DocLoader* docLoader);
+        ~XMLTokenizerScope();
+
+        static DocLoader* currentDocLoader;
+
+#if ENABLE(XSLT)
+        XMLTokenizerScope(DocLoader* docLoader, xmlGenericErrorFunc genericErrorFunc, xmlStructuredErrorFunc structuredErrorFunc = 0, void* errorContext = 0);
+#endif
 
-    protected:
-        AccessibilityObjectWrapper(AccessibilityObject* obj)
-            : RefCounted<AccessibilityObjectWrapper>(0), m_object(obj) { }
-        AccessibilityObjectWrapper() : m_object(0) { }
+    private:
+        DocLoader* m_oldDocLoader;
 
-        AccessibilityObject* m_object;
+#if ENABLE(XSLT)
+        xmlGenericErrorFunc m_oldGenericErrorFunc;
+        xmlStructuredErrorFunc m_oldStructuredErrorFunc;
+        void* m_oldErrorContext;
+#endif
     };
 
 } // namespace WebCore
 
-#endif // AccessibilityObjectWrapper_h
+#endif // XMLTokenizerScope_h
diff --git a/src/3rdparty/webkit/WebCore/dom/make_names.pl b/src/3rdparty/webkit/WebCore/dom/make_names.pl
index 8541c0bbbc..12f0ec7f61 100755
--- a/src/3rdparty/webkit/WebCore/dom/make_names.pl
+++ b/src/3rdparty/webkit/WebCore/dom/make_names.pl
@@ -1,6 +1,8 @@
 #!/usr/bin/perl -w
 
-# Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
+# Copyright (C) 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009, Julien Chaffraix <jchaffraix@webkit.org>
+# Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -87,10 +89,12 @@ if ($printWrapperFactory) {
 sub initializeTagPropertyHash
 {
     return ('constructorNeedsCreatedByParser' => 0,
+            'constructorNeedsFormElement' => 0,
             'exportString' => 0,
             'interfaceName' => defaultInterfaceName($_[0]),
             # By default, the JSInterfaceName is the same as the interfaceName.
             'JSInterfaceName' => defaultInterfaceName($_[0]),
+            'mapToTagName' => '',
             'wrapperOnlyIfMediaIsAvailable' => 0,
             'conditional' => 0);
 }
@@ -216,32 +220,147 @@ sub printMacros
     }
 }
 
+sub usesDefaultWrapper
+{
+    my $tagName = shift;
+    return $tagName eq $parameters{'namespace'} . "Element";
+}
+
+# Build a direct mapping from the tags to the Element to create, excluding
+# Element that have not constructor.
+sub buildConstructorMap
+{
+    my %tagConstructorMap = ();
+    for my $tagName (keys %tags) {
+        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        next if (usesDefaultWrapper($interfaceName));
+
+        if ($tags{$tagName}{'mapToTagName'}) {
+            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{'mapToTagName'}}{'mapToTagName'};
+            $interfaceName = $tags{ $tags{$tagName}{'mapToTagName'} }{'interfaceName'};
+        }
+
+        # Chop the string to keep the interesting part.
+        $interfaceName =~ s/$parameters{'namespace'}(.*)Element/$1/;
+        $tagConstructorMap{$tagName} = lc($interfaceName);
+    }
+
+    return %tagConstructorMap;
+}
+
+# Helper method that print the constructor's signature avoiding
+# unneeded arguments.
+sub printConstructorSignature
+{
+    my ($F, $tagName, $constructorName, $constructorTagName) = @_;
+
+    print F "static PassRefPtr<$parameters{'namespace'}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* doc";
+    if ($parameters{'namespace'} eq "HTML") {
+        print F ", HTMLFormElement*";
+        if ($tags{$tagName}{'constructorNeedsFormElement'}) {
+            print F " formElement";
+        }
+    }
+    print F ", bool";
+    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
+        print F " createdByParser"; 
+    }
+    print F ")\n{\n";
+}
+
+# Helper method to dump the constructor interior and call the 
+# Element constructor with the right arguments.
+# The variable names should be kept in sync with the previous method.
+sub printConstructorInterior
+{
+    my ($F, $tagName, $interfaceName, $constructorTagName) = @_;
+
+    # Handle media elements.
+    if ($tags{$tagName}{'wrapperOnlyIfMediaIsAvailable'}) {
+        print F <<END
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement($constructorTagName, doc);
+END
+;
+    }
+
+    # Now call the constructor with the right parameters.
+    print F "    return new ${interfaceName}($constructorTagName, doc";
+    if ($tags{$tagName}{'constructorNeedsFormElement'}) {
+        print F ", formElement";
+    }
+    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
+        print F ", createdByParser";
+    }
+    print F ");\n}\n\n";
+}
+
 sub printConstructors
 {
-    my $F = shift;
+    my ($F, $tagConstructorMapRef) = @_;
+    my %tagConstructorMap = %$tagConstructorMapRef;
 
     print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
-    for my $name (sort keys %tags) {
-        my $ucName = $tags{$name}{'interfaceName'};
 
-        print F "static PassRefPtr<$parameters{'namespace'}Element> ${name}Constructor(Document* doc, bool createdByParser)\n";
-        print F "{\n";
-        if ($tags{$name}{'constructorNeedsCreatedByParser'}) {
-            print F "    return new ${ucName}($parameters{'namespace'}Names::${name}Tag, doc, createdByParser);\n";
-        } else {
-            print F "    return new ${ucName}($parameters{'namespace'}Names::${name}Tag, doc);\n";
+    # This is to avoid generating the same constructor several times.
+    my %uniqueTags = ();
+    for my $tagName (sort keys %tagConstructorMap) {
+        my $interfaceName = $tags{$tagName}{'interfaceName'};
+
+        # Ignore the mapped tag
+        # FIXME: It could be moved inside this loop but was split for readibility.
+        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{'mapToTagName'});
+
+        $uniqueTags{$interfaceName} = '1';
+
+        my $conditional = $tags{$tagName}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n\n";
+        }
+
+        printConstructorSignature($F, $tagName, $tagConstructorMap{$tagName}, "tagName");
+        printConstructorInterior($F, $tagName, $interfaceName, "tagName");
+
+        if ($conditional) {
+            print F "#endif\n\n";
         }
-        print F "}\n\n";
     }
+
+    # Mapped tag name uses a special wrapper to keep their prefix and namespaceURI while using the mapped localname.
+    for my $tagName (sort keys %tagConstructorMap) {
+        if ($tags{$tagName}{'mapToTagName'}) {
+            my $mappedName = $tags{$tagName}{'mapToTagName'};
+            printConstructorSignature($F, $mappedName, $mappedName . "To" . $tagName, "tagName");
+            printConstructorInterior($F, $mappedName, $tags{$mappedName}{'interfaceName'}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
+        }
+    }
+
     print F "#endif\n" if $parameters{'guardFactoryWith'};
 }
 
 sub printFunctionInits
 {
-    my $F = shift;
+    my ($F, $tagConstructorMap) = @_;
+    my %tagConstructorMap = %$tagConstructorMap;
+
+    for my $tagName (sort keys %tagConstructorMap) {
+
+        my $conditional = $tags{$tagName}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n";
+        }
 
-    for my $name (sort keys %tags) {
-        print F "    gFunctionMap->set($parameters{'namespace'}Names::${name}Tag.localName().impl(), ${name}Constructor);\n";
+        if ($tags{$tagName}{'mapToTagName'}) {
+            print F "    addTag(${tagName}Tag, $tags{$tagName}{'mapToTagName'}To${tagName}Constructor);\n";
+        } else {
+            print F "    addTag(${tagName}Tag, $tagConstructorMap{$tagName}Constructor);\n";
+        }
+
+        if ($conditional) {
+            print F "#endif\n\n";
+        }
     }
 }
 
@@ -325,16 +444,23 @@ sub printNamesHeaderFile
     if (keys %tags) {
         print F "// Tags\n";
         printMacros($F, "extern const WebCore::QualifiedName", "Tag", \%tags);
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size);\n";
     }
     
     if (keys %attrs) {
         print F "// Attributes\n";
         printMacros($F, "extern const WebCore::QualifiedName", "Attr", \%attrs);
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Attr(size_t* size);\n";
     }
     print F "#endif\n\n";
-    print F "void init();\n\n";
+    
+    if (keys %tags) {
+        print F "WebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size);\n";
+    }
+
+    if (keys %attrs) {
+        print F "WebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size);\n";
+    }
+    
+    print F "\nvoid init();\n\n";
     print F "} }\n\n";
     print F "#endif\n\n";
     
@@ -536,28 +662,49 @@ print F <<END
 END
 ;
 
+if ($parameters{'namespace'} eq "HTML") {
+    print F "#include \"HTMLFormElement.h\"\n";
+}
+
 printElementIncludes($F);
 
 print F <<END
 #include <wtf/HashMap.h>
 
-using namespace WebCore;
+namespace WebCore {
 
-typedef PassRefPtr<$parameters{'namespace'}Element> (*ConstructorFunction)(Document*, bool createdByParser);
-typedef WTF::HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
+using namespace $parameters{'namespace'}Names;
 
-static FunctionMap* gFunctionMap = 0;
+END
+;
 
-namespace WebCore {
+print F "typedef PassRefPtr<$parameters{'namespace'}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
+
+if ($parameters{'namespace'} eq "HTML") {
+    print F ", HTMLFormElement*";
+}
+
+print F ", bool createdByParser);\n";
+print F <<END
+typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
+
+static FunctionMap* gFunctionMap = 0;
 
 END
 ;
 
-printConstructors($F);
+my %tagConstructorMap = buildConstructorMap();
+
+printConstructors($F, \%tagConstructorMap);
 
 print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
 
 print F <<END
+static void addTag(const QualifiedName& tag, ConstructorFunction func)
+{
+    gFunctionMap->set(tag.localName().impl(), func);
+}
+
 static inline void createFunctionMapIfNecessary()
 {
     if (gFunctionMap)
@@ -569,16 +716,18 @@ static inline void createFunctionMapIfNecessary()
 END
 ;
 
-printFunctionInits($F);
+printFunctionInits($F, \%tagConstructorMap);
 
 print F "}\n";
-print F "#endif\n\n" if $parameters{'guardFactoryWith'};
+print F "#endif\n" if $parameters{'guardFactoryWith'};
 
-print F <<END
-PassRefPtr<$parameters{'namespace'}Element> $parameters{'namespace'}ElementFactory::create$parameters{'namespace'}Element(const QualifiedName& qName, Document* doc, bool createdByParser)
-{
-END
-;
+print F "\nPassRefPtr<$parameters{'namespace'}Element> $parameters{'namespace'}ElementFactory::create$parameters{'namespace'}Element(const QualifiedName& qName, Document* doc";
+
+if ($parameters{"namespace"} eq "HTML") {
+    print F ", HTMLFormElement* formElement";
+}
+
+print F ", bool createdByParser)\n{\n";
 
 print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
 
@@ -587,21 +736,36 @@ print F <<END
     if (!doc)
         return 0;
 
+END
+;
+
+if ($parameters{'namespace'} ne "HTML") {
+print F <<END
 #if ENABLE(DASHBOARD_SUPPORT)
     Settings* settings = doc->settings();
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
+END
+;
 
+}
+
+print F <<END
     createFunctionMapIfNecessary();
     ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
     if (func)
-        return func(doc, createdByParser);
-
-    return new $parameters{'namespace'}Element(qName, doc);
 END
 ;
 
+if ($parameters{"namespace"} eq "HTML") {
+    print F "        return func(qName, doc, formElement, createdByParser);\n";
+} else {
+    print F "        return func(qName, doc, createdByParser);\n";
+}
+
+print F "    return new $parameters{'namespace'}Element(qName, doc);\n";
+
 if ($parameters{'guardFactoryWith'}) {
 
 print F <<END
@@ -648,13 +812,30 @@ namespace WebCore {
 namespace WebCore {
 
     class $parameters{'namespace'}Element;
+END
+;
+
+if ($parameters{'namespace'} eq "HTML") {
+    print F "     class HTMLFormElement;\n";
+}
 
+print F<<END
     // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
     // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
     class $parameters{'namespace'}ElementFactory {
     public:
         PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
-        static PassRefPtr<$parameters{'namespace'}Element> create$parameters{'namespace'}Element(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
+END
+;
+print F "        static PassRefPtr<$parameters{'namespace'}Element> create$parameters{'namespace'}Element(const WebCore::QualifiedName&, WebCore::Document*";
+
+if ($parameters{'namespace'} eq "HTML") {
+    print F ", HTMLFormElement* = 0";
+}
+
+print F ", bool /*createdByParser*/ = true);\n";
+
+printf F<<END
     };
 }
 
@@ -673,7 +854,7 @@ sub usesDefaultJSWrapper
     my $name = shift;
 
     # A tag reuses the default wrapper if its JSInterfaceName matches the default namespace Element.
-    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element";
+    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element" || $tags{$name}{'JSInterfaceName'} eq "HTMLNoScriptElement";
 }
 
 sub printWrapperFunctions
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index eecec4d0ce..8d0312b697 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,11 +27,14 @@
 #include "ApplyStyleCommand.h"
 
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSParser.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
+#include "Editor.h"
+#include "Frame.h"
 #include "HTMLElement.h"
 #include "HTMLInterchange.h"
 #include "HTMLNames.h"
@@ -50,16 +53,13 @@ using namespace HTMLNames;
 
 class StyleChange {
 public:
-    enum ELegacyHTMLStyles { DoNotUseLegacyHTMLStyles, UseLegacyHTMLStyles };
-
-    explicit StyleChange(CSSStyleDeclaration *, ELegacyHTMLStyles usesLegacyStyles=UseLegacyHTMLStyles);
-    StyleChange(CSSStyleDeclaration *, const Position &, ELegacyHTMLStyles usesLegacyStyles=UseLegacyHTMLStyles);
-
-    static ELegacyHTMLStyles styleModeForParseMode(bool);
+    explicit StyleChange(CSSStyleDeclaration*, const Position&);
 
     String cssStyle() const { return m_cssStyle; }
     bool applyBold() const { return m_applyBold; }
     bool applyItalic() const { return m_applyItalic; }
+    bool applySubscript() const { return m_applySubscript; }
+    bool applySuperscript() const { return m_applySuperscript; }
     bool applyFontColor() const { return m_applyFontColor.length() > 0; }
     bool applyFontFace() const { return m_applyFontFace.length() > 0; }
     bool applyFontSize() const { return m_applyFontSize.length() > 0; }
@@ -68,38 +68,39 @@ public:
     String fontFace() { return m_applyFontFace; }
     String fontSize() { return m_applyFontSize; }
 
-    bool usesLegacyStyles() const { return m_usesLegacyStyles; }
-
 private:
-    void init(PassRefPtr<CSSStyleDeclaration>, const Position &);
-    bool checkForLegacyHTMLStyleChange(const CSSProperty *);
-    static bool currentlyHasStyle(const Position &, const CSSProperty *);
+    void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
+    bool checkForLegacyHTMLStyleChange(const CSSProperty*);
+    static bool currentlyHasStyle(const Position&, const CSSProperty*);
     
     String m_cssStyle;
     bool m_applyBold;
     bool m_applyItalic;
+    bool m_applySubscript;
+    bool m_applySuperscript;
     String m_applyFontColor;
     String m_applyFontFace;
     String m_applyFontSize;
-    bool m_usesLegacyStyles;
 };
 
 
-
-StyleChange::StyleChange(CSSStyleDeclaration *style, ELegacyHTMLStyles usesLegacyStyles)
-    : m_applyBold(false), m_applyItalic(false), m_usesLegacyStyles(usesLegacyStyles)
-{
-    init(style, Position());
-}
-
-StyleChange::StyleChange(CSSStyleDeclaration *style, const Position &position, ELegacyHTMLStyles usesLegacyStyles)
-    : m_applyBold(false), m_applyItalic(false), m_usesLegacyStyles(usesLegacyStyles)
+StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
+    : m_applyBold(false)
+    , m_applyItalic(false)
+    , m_applySubscript(false)
+    , m_applySuperscript(false)
 {
     init(style, position);
 }
 
-void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &position)
+void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& position)
 {
+    Document* document = position.node() ? position.node()->document() : 0;
+    if (!document || !document->frame())
+        return;
+        
+    bool useHTMLFormattingTags = !document->frame()->editor()->shouldStyleWithCSS();
+            
     RefPtr<CSSMutableStyleDeclaration> mutableStyle = style->makeMutable();
     
     String styleText("");
@@ -119,7 +120,7 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &po
             continue;
         
         // If needed, figure out if this change is a legacy HTML style change.
-        if (m_usesLegacyStyles && checkForLegacyHTMLStyleChange(property))
+        if (useHTMLFormattingTags && checkForLegacyHTMLStyleChange(property))
             continue;
 
         if (property->id() == CSSPropertyDirection) {
@@ -132,6 +133,7 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &po
 
         if (property->id() == CSSPropertyWebkitTextDecorationsInEffect) {
             // we have to special-case text decorations
+            // FIXME: Why?
             CSSProperty alteredProperty(CSSPropertyTextDecoration, property->value(), property->isImportant());
             styleText += alteredProperty.cssText();
         } else
@@ -147,16 +149,11 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &po
     m_cssStyle = styleText.stripWhiteSpace();
 }
 
-StyleChange::ELegacyHTMLStyles StyleChange::styleModeForParseMode(bool isQuirksMode)
+// This function is the mapping from CSS styles to styling tags (like font-weight: bold to <b>)
+bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
 {
-    return isQuirksMode ? UseLegacyHTMLStyles : DoNotUseLegacyHTMLStyles;
-}
-
-bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty *property)
-{
-    if (!property || !property->value()) {
+    if (!property || !property->value())
         return false;
-    }
     
     String valueText(property->value()->cssText());
     switch (property->id()) {
@@ -166,6 +163,16 @@ bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty *property)
                 return true;
             }
             break;
+        case CSSPropertyVerticalAlign:
+            if (equalIgnoringCase(valueText, "sub")) {
+                m_applySubscript = true;
+                return true;
+            }
+            if (equalIgnoringCase(valueText, "super")) {
+                m_applySuperscript = true;
+                return true;
+            }
+            break;
         case CSSPropertyFontStyle:
             if (equalIgnoringCase(valueText, "italic") || equalIgnoringCase(valueText, "oblique")) {
                 m_applyItalic = true;
@@ -222,13 +229,17 @@ bool StyleChange::currentlyHasStyle(const Position &pos, const CSSProperty *prop
 {
     ASSERT(pos.isNotNull());
     RefPtr<CSSComputedStyleDeclaration> style = pos.computedStyle();
-    RefPtr<CSSValue> value = style->getPropertyCSSValue(property->id(), DoNotUpdateLayout);
+    RefPtr<CSSValue> value;
+    if (property->id() == CSSPropertyFontSize)
+        value = style->getFontSizeCSSValuePreferringKeyword();
+    else
+        value = style->getPropertyCSSValue(property->id(), DoNotUpdateLayout);
     if (!value)
         return false;
     return equalIgnoringCase(value->cssText(), property->value()->cssText());
 }
 
-static String &styleSpanClassString()
+static String& styleSpanClassString()
 {
     DEFINE_STATIC_LOCAL(String, styleSpanClassString, ((AppleStyleSpanClass)));
     return styleSpanClassString;
@@ -239,18 +250,31 @@ bool isStyleSpan(const Node *node)
     if (!node || !node->isHTMLElement())
         return false;
 
-    const HTMLElement *elem = static_cast<const HTMLElement *>(node);
+    const HTMLElement* elem = static_cast<const HTMLElement*>(node);
     return elem->hasLocalName(spanAttr) && elem->getAttribute(classAttr) == styleSpanClassString();
 }
 
-static bool isUnstyledStyleSpan(const Node *node)
+static bool isUnstyledStyleSpan(const Node* node)
 {
     if (!node || !node->isHTMLElement() || !node->hasTagName(spanTag))
         return false;
 
-    const HTMLElement *elem = static_cast<const HTMLElement *>(node);
-    CSSMutableStyleDeclaration *inlineStyleDecl = elem->inlineStyleDecl();
-    return (!inlineStyleDecl || inlineStyleDecl->length() == 0) && elem->getAttribute(classAttr) == styleSpanClassString();
+    const HTMLElement* elem = static_cast<const HTMLElement*>(node);
+    CSSMutableStyleDeclaration* inlineStyleDecl = elem->inlineStyleDecl();
+    return (!inlineStyleDecl || inlineStyleDecl->isEmpty()) && elem->getAttribute(classAttr) == styleSpanClassString();
+}
+
+static bool isSpanWithoutAttributesOrUnstyleStyleSpan(const Node* node)
+{
+    if (!node || !node->isHTMLElement() || !node->hasTagName(spanTag))
+        return false;
+
+    const HTMLElement* elem = static_cast<const HTMLElement*>(node);
+    NamedNodeMap* attributes = elem->attributes(true); // readonly
+    if (attributes->isEmpty())
+        return true;
+
+    return isUnstyledStyleSpan(node);
 }
 
 static bool isEmptyFontTag(const Node *node)
@@ -259,22 +283,20 @@ static bool isEmptyFontTag(const Node *node)
         return false;
 
     const Element *elem = static_cast<const Element *>(node);
-    NamedAttrMap *map = elem->attributes(true); // true for read-only
+    NamedNodeMap *map = elem->attributes(true); // true for read-only
     return (!map || map->length() == 1) && elem->getAttribute(classAttr) == styleSpanClassString();
 }
 
 static PassRefPtr<Element> createFontElement(Document* document)
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> fontNode = document->createElementNS(xhtmlNamespaceURI, "font", ec);
-    ASSERT(ec == 0);
+    RefPtr<Element> fontNode = createHTMLElement(document, fontTag);
     fontNode->setAttribute(classAttr, styleSpanClassString());
     return fontNode.release();
 }
 
 PassRefPtr<HTMLElement> createStyleSpanElement(Document* document)
 {
-    RefPtr<HTMLElement> styleElement = new HTMLElement(spanTag, document);
+    RefPtr<HTMLElement> styleElement = createHTMLElement(document, spanTag);
     styleElement->setAttribute(classAttr, styleSpanClassString());
     return styleElement.release();
 }
@@ -320,12 +342,12 @@ ApplyStyleCommand::ApplyStyleCommand(PassRefPtr<Element> element, bool removeOnl
 
 void ApplyStyleCommand::updateStartEnd(const Position& newStart, const Position& newEnd)
 {
-    ASSERT(Range::compareBoundaryPoints(newEnd, newStart) >= 0);
+    ASSERT(comparePositions(newEnd, newStart) >= 0);
 
     if (!m_useEndingSelection && (newStart != m_start || newEnd != m_end))
         m_useEndingSelection = true;
 
-    setEndingSelection(Selection(newStart, newEnd, VP_DEFAULT_AFFINITY));
+    setEndingSelection(VisibleSelection(newStart, newEnd, VP_DEFAULT_AFFINITY));
     m_start = newStart;
     m_end = newEnd;
 }
@@ -386,7 +408,7 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
     // get positions we want to use for applying style
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -408,8 +430,8 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
     VisiblePosition nextParagraphStart(endOfParagraph(paragraphStart).next());
     VisiblePosition beyondEnd(endOfParagraph(visibleEnd).next());
     while (paragraphStart.isNotNull() && paragraphStart != beyondEnd) {
-        StyleChange styleChange(style, paragraphStart.deepEquivalent(), StyleChange::styleModeForParseMode(document()->inCompatMode()));
-        if (styleChange.cssStyle().length() > 0 || m_removeOnly) {
+        StyleChange styleChange(style, paragraphStart.deepEquivalent());
+        if (styleChange.cssStyle().length() || m_removeOnly) {
             RefPtr<Node> block = enclosingBlock(paragraphStart.deepEquivalent().node());
             RefPtr<Node> newBlock = moveParagraphContentsToNewBlockIfNecessary(paragraphStart.deepEquivalent());
             if (newBlock)
@@ -462,7 +484,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
     
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -503,7 +525,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
     
     start = start.upstream(); // Move upstream to ensure we do not add redundant spans.
     Node *startNode = start.node();
-    if (startNode->isTextNode() && start.offset() >= caretMaxOffset(startNode)) // Move out of text node if range does not include its characters.
+    if (startNode->isTextNode() && start.deprecatedEditingOffset() >= caretMaxOffset(startNode)) // Move out of text node if range does not include its characters.
         startNode = startNode->traverseNextNode();
 
     // Store away font size before making any changes to the document.
@@ -527,7 +549,6 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
             // Last styled node was not parent node of this text node, but we wish to style this
             // text node. To make this possible, add a style span to surround this text node.
             RefPtr<HTMLElement> span = createStyleSpanElement(document());
-            insertNodeBefore(span.get(), node);
             surroundNodeRangeWithElement(node, node, span.get());
             element = span.release();
         }  else {
@@ -548,8 +569,9 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
             inlineStyleDecl->setProperty(CSSPropertyFontSize, String::number(desiredFontSize) + "px", false, false);
             setNodeAttribute(element.get(), styleAttr, inlineStyleDecl->cssText());
         }
-        if (inlineStyleDecl->length() == 0) {
+        if (inlineStyleDecl->isEmpty()) {
             removeNodeAttribute(element.get(), styleAttr);
+            // FIXME: should this be isSpanWithoutAttributesOrUnstyleStyleSpan?  Need a test.
             if (isUnstyledStyleSpan(element.get()))
                 unstyledSpans.append(element.release());
         }
@@ -674,6 +696,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
                     inlineStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueNormal);
                     inlineStyle->removeProperty(CSSPropertyDirection);
                     setNodeAttribute(element, styleAttr, inlineStyle->cssText());
+                    // FIXME: should this be isSpanWithoutAttributesOrUnstyleStyleSpan?  Need a test.
                     if (isUnstyledStyleSpan(element))
                         removeNodePreservingChildren(element);
                 }
@@ -696,7 +719,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     // adjust to the positions we want to use for applying style
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -757,7 +780,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
         RefPtr<CSSMutableStyleDeclaration> embeddingStyle = CSSMutableStyleDeclaration::create();
         embeddingStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
         embeddingStyle->setProperty(CSSPropertyDirection, static_cast<CSSPrimitiveValue*>(direction.get())->getIdent());
-        if (Range::compareBoundaryPoints(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
+        if (comparePositions(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
             removeInlineStyle(embeddingStyle, embeddingRemoveStart, embeddingRemoveEnd);
 
         RefPtr<CSSMutableStyleDeclaration> styleWithoutEmbedding = style->copy();
@@ -850,21 +873,24 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
 
     bool rangeIsEmpty = false;
 
-    if (start.offset() >= caretMaxOffset(start.node())) {
+    if (start.deprecatedEditingOffset() >= caretMaxOffset(start.node())) {
         node = node->traverseNextNode();
         Position newStart = Position(node, 0);
-        if (Range::compareBoundaryPoints(end, newStart) < 0)
+        if (!node || comparePositions(end, newStart) < 0)
             rangeIsEmpty = true;
     }
 
     if (!rangeIsEmpty) {
+        // pastEndNode is the node after the last fully selected node.
+        Node* pastEndNode = end.node();
+        if (end.deprecatedEditingOffset() >= caretMaxOffset(end.node()))
+            pastEndNode = end.node()->traverseNextSibling();
         // FIXME: Callers should perform this operation on a Range that includes the br
         // if they want style applied to the empty line.
         if (start == end && start.node()->hasTagName(brTag))
-            end = positionAfterNode(start.node());
+            pastEndNode = start.node()->traverseNextNode();
         // Add the style to selected inline runs.
-        Node* pastLast = Range::create(document(), rangeCompliantEquivalent(start), rangeCompliantEquivalent(end))->pastLastNode();
-        for (Node* next; node && node != pastLast; node = next) {
+        for (Node* next; node && node != pastEndNode; node = next) {
             
             next = node->traverseNextNode();
             
@@ -873,7 +899,9 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
             
             if (!node->isContentRichlyEditable() && node->isHTMLElement()) {
                 // This is a plaintext-only region. Only proceed if it's fully selected.
-                if (end.node()->isDescendantOf(node))
+                // pastEndNode is the node after the last fully selected node, so if it's inside node then
+                // node isn't fully selected.
+                if (pastEndNode && pastEndNode->isDescendantOf(node))
                     break;
                 // Add to this element's inline style and skip over its contents.
                 HTMLElement* element = static_cast<HTMLElement*>(node);
@@ -898,7 +926,7 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
             Node* runStart = node;
             // Find the end of the run.
             Node* sibling = node->nextSibling();
-            while (sibling && sibling != pastLast && (!sibling->isElementNode() || sibling->hasTagName(brTag)) && !isBlock(sibling)) {
+            while (sibling && sibling != pastEndNode && (!sibling->isElementNode() || sibling->hasTagName(brTag)) && !isBlock(sibling)) {
                 node = sibling;
                 sibling = node->nextSibling();
             }
@@ -910,32 +938,57 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
     }
 }
 
-bool ApplyStyleCommand::isHTMLStyleNode(CSSMutableStyleDeclaration *style, HTMLElement *elem)
+// This function maps from styling tags to CSS styles.  Used for knowing which
+// styling tags should be removed when toggling styles.
+bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement* elem, CSSMutableStyleDeclaration* style)
 {
     CSSMutableStyleDeclaration::const_iterator end = style->end();
     for (CSSMutableStyleDeclaration::const_iterator it = style->begin(); it != end; ++it) {
-        switch ((*it).id()) {
-            case CSSPropertyFontWeight:
-                if (elem->hasLocalName(bTag))
-                    return true;
-                break;
-            case CSSPropertyFontStyle:
-                if (elem->hasLocalName(iTag))
-                    return true;
+        const CSSProperty& property = *it;
+        // FIXME: This should probably be re-written to lookup the tagname in a
+        // hash and match against an expected property/value pair.
+        switch (property.id()) {
+        case CSSPropertyFontWeight:
+            // IE inserts "strong" tags for execCommand("bold"), so we remove them, even though they're not strictly presentational
+            if (elem->hasLocalName(bTag) || elem->hasLocalName(strongTag))
+                return true;
+            break;
+        case CSSPropertyVerticalAlign:
+            if (elem->hasLocalName(subTag) || elem->hasLocalName(supTag))
+                return true;
+            break;
+        case CSSPropertyFontStyle:
+            // IE inserts "em" tags for execCommand("italic"), so we remove them, even though they're not strictly presentational
+            if (elem->hasLocalName(iTag) || elem->hasLocalName(emTag))
+                return true;
+            break;
         }
     }
-
     return false;
 }
 
-void ApplyStyleCommand::removeHTMLStyleNode(HTMLElement *elem)
+void ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*& elem)
 {
-    // This node can be removed.
-    // EDIT FIXME: This does not handle the case where the node
-    // has attributes. But how often do people add attributes to <B> tags? 
-    // Not so often I think.
-    ASSERT(elem);
-    removeNodePreservingChildren(elem);
+    bool removeNode = false;
+
+    // Similar to isSpanWithoutAttributesOrUnstyleStyleSpan, but does not look for Apple-style-span.
+    NamedNodeMap* attributes = elem->attributes(true); // readonly
+    if (!attributes || attributes->isEmpty())
+        removeNode = true;
+    else if (attributes->length() == 1 && elem->hasAttribute(styleAttr)) {
+        // Remove the element even if it has just style='' (this might be redundantly checked later too)
+        CSSMutableStyleDeclaration* inlineStyleDecl = elem->inlineStyleDecl();
+        if (!inlineStyleDecl || inlineStyleDecl->isEmpty())
+            removeNode = true;
+    }
+
+    if (removeNode)
+        removeNodePreservingChildren(elem);
+    else {
+        HTMLElement* newSpanElement = replaceNodeWithSpanPreservingChildrenAndAttributes(elem);
+        ASSERT(newSpanElement && newSpanElement->inDocument());
+        elem = newSpanElement;
+    }
 }
 
 void ApplyStyleCommand::removeHTMLFontStyle(CSSMutableStyleDeclaration *style, HTMLElement *elem)
@@ -978,16 +1031,17 @@ void ApplyStyleCommand::removeHTMLBidiEmbeddingStyle(CSSMutableStyleDeclaration
 
     removeNodeAttribute(elem, dirAttr);
 
+    // FIXME: should this be isSpanWithoutAttributesOrUnstyleStyleSpan?  Need a test.
     if (isUnstyledStyleSpan(elem))
         removeNodePreservingChildren(elem);
 }
 
-void ApplyStyleCommand::removeCSSStyle(CSSMutableStyleDeclaration *style, HTMLElement *elem)
+void ApplyStyleCommand::removeCSSStyle(CSSMutableStyleDeclaration* style, HTMLElement* elem)
 {
     ASSERT(style);
     ASSERT(elem);
 
-    CSSMutableStyleDeclaration *decl = elem->inlineStyleDecl();
+    CSSMutableStyleDeclaration* decl = elem->inlineStyleDecl();
     if (!decl)
         return;
 
@@ -1002,18 +1056,12 @@ void ApplyStyleCommand::removeCSSStyle(CSSMutableStyleDeclaration *style, HTMLEl
         }
     }
 
-    if (isUnstyledStyleSpan(elem))
-        removeNodePreservingChildren(elem);
-}
+    // No need to serialize <foo style=""> if we just removed the last css property
+    if (decl->isEmpty())
+        removeNodeAttribute(elem, styleAttr);
 
-void ApplyStyleCommand::removeBlockStyle(CSSMutableStyleDeclaration *style, const Position &start, const Position &end)
-{
-    ASSERT(start.isNotNull());
-    ASSERT(end.isNotNull());
-    ASSERT(start.node()->inDocument());
-    ASSERT(end.node()->inDocument());
-    ASSERT(Range::compareBoundaryPoints(start, end) <= 0);
-    
+    if (isSpanWithoutAttributesOrUnstyleStyleSpan(elem))
+        removeNodePreservingChildren(elem);
 }
 
 static bool hasTextDecorationProperty(Node *node)
@@ -1090,12 +1138,11 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
 {
     ASSERT(node);
 
-    if (!style || !style->cssText().length())
+    if (!style || style->cssText().isEmpty())
         return;
 
     if (node->isTextNode()) {
         RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
-        insertNodeBefore(styleSpan.get(), node);
         surroundNodeRangeWithElement(node, node, styleSpan.get());
         node = styleSpan.get();
     }
@@ -1105,8 +1152,8 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
 
     HTMLElement *element = static_cast<HTMLElement *>(node);
         
-    StyleChange styleChange(style, Position(element, 0), StyleChange::styleModeForParseMode(document()->inCompatMode()));
-    if (styleChange.cssStyle().length() > 0) {
+    StyleChange styleChange(style, Position(element, 0));
+    if (styleChange.cssStyle().length()) {
         String cssText = styleChange.cssStyle();
         CSSMutableStyleDeclaration *decl = element->inlineStyleDecl();
         if (decl)
@@ -1115,7 +1162,7 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
     }
 }
 
-void ApplyStyleCommand::pushDownTextDecorationStyleAroundNode(Node *node, const Position &start, const Position &end, bool force)
+void ApplyStyleCommand::pushDownTextDecorationStyleAroundNode(Node* node, bool force)
 {
     Node *highestAncestor = highestAncestorWithTextDecoration(node);
     
@@ -1152,13 +1199,13 @@ void ApplyStyleCommand::pushDownTextDecorationStyleAtBoundaries(const Position &
     // styles (caused by stylesheets) and explicitly negate text
     // decoration while pushing down.
 
-    pushDownTextDecorationStyleAroundNode(start.node(), start, end, false);
+    pushDownTextDecorationStyleAroundNode(start.node(), false);
     updateLayout();
-    pushDownTextDecorationStyleAroundNode(start.node(), start, end, true);
+    pushDownTextDecorationStyleAroundNode(start.node(), true);
 
-    pushDownTextDecorationStyleAroundNode(end.node(), start, end, false);
+    pushDownTextDecorationStyleAroundNode(end.node(), false);
     updateLayout();
-    pushDownTextDecorationStyleAroundNode(end.node(), start, end, true);
+    pushDownTextDecorationStyleAroundNode(end.node(), true);
 }
 
 static int maxRangeOffset(Node *n)
@@ -1178,7 +1225,7 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
     ASSERT(end.isNotNull());
     ASSERT(start.node()->inDocument());
     ASSERT(end.node()->inDocument());
-    ASSERT(Range::compareBoundaryPoints(start, end) <= 0);
+    ASSERT(comparePositions(start, end) <= 0);
     
     RefPtr<CSSValue> textDecorationSpecialProperty = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
 
@@ -1194,18 +1241,22 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
     Position s = start;
     Position e = end;
 
-    Node *node = start.node();
+    Node* node = start.node();
     while (node) {
-        Node *next = node->traverseNextNode();
+        Node* next = node->traverseNextNode();
         if (node->isHTMLElement() && nodeFullySelected(node, start, end)) {
-            HTMLElement *elem = static_cast<HTMLElement *>(node);
-            Node *prev = elem->traversePreviousNodePostOrder();
-            Node *next = elem->traverseNextNode();
+            HTMLElement* elem = static_cast<HTMLElement*>(node);
+            Node* prev = elem->traversePreviousNodePostOrder();
+            Node* next = elem->traverseNextNode();
             if (m_styledInlineElement && elem->hasTagName(m_styledInlineElement->tagQName()))
                 removeNodePreservingChildren(elem);
-            if (isHTMLStyleNode(style.get(), elem))
-                removeHTMLStyleNode(elem);
-            else {
+
+            if (implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(elem, style.get()))
+                replaceWithSpanOrRemoveIfWithoutAttributes(elem);
+
+            // If the node was converted to a span, the span may still contain relevant
+            // styles which must be removed (e.g. <b style='font-weight: bold'>)
+            if (elem->inDocument()) {
                 removeHTMLFontStyle(style.get(), elem);
                 removeHTMLBidiEmbeddingStyle(style.get(), elem);
                 removeCSSStyle(style.get(), elem);
@@ -1214,14 +1265,14 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
                 if (s.node() == elem) {
                     // Since elem must have been fully selected, and it is at the start
                     // of the selection, it is clear we can set the new s offset to 0.
-                    ASSERT(s.offset() <= caretMinOffset(s.node()));
+                    ASSERT(s.deprecatedEditingOffset() <= caretMinOffset(s.node()));
                     s = Position(next, 0);
                 }
                 if (e.node() == elem) {
                     // Since elem must have been fully selected, and it is at the end
                     // of the selection, it is clear we can set the new e offset to
                     // the max range offset of prev.
-                    ASSERT(e.offset() >= maxRangeOffset(e.node()));
+                    ASSERT(e.deprecatedEditingOffset() >= maxRangeOffset(e.node()));
                     e = Position(prev, maxRangeOffset(prev));
                 }
             }
@@ -1242,8 +1293,7 @@ bool ApplyStyleCommand::nodeFullySelected(Node *node, const Position &start, con
     ASSERT(node->isElementNode());
 
     Position pos = Position(node, node->childNodeCount()).upstream();
-    return Range::compareBoundaryPoints(node, 0, start.node(), start.offset()) >= 0 &&
-        Range::compareBoundaryPoints(pos, end) <= 0;
+    return comparePositions(Position(node, 0), start) >= 0 && comparePositions(pos, end) <= 0;
 }
 
 bool ApplyStyleCommand::nodeFullyUnselected(Node *node, const Position &start, const Position &end) const
@@ -1252,8 +1302,8 @@ bool ApplyStyleCommand::nodeFullyUnselected(Node *node, const Position &start, c
     ASSERT(node->isElementNode());
 
     Position pos = Position(node, node->childNodeCount()).upstream();
-    bool isFullyBeforeStart = Range::compareBoundaryPoints(pos, start) < 0;
-    bool isFullyAfterEnd = Range::compareBoundaryPoints(node, 0, end.node(), end.offset()) > 0;
+    bool isFullyBeforeStart = comparePositions(pos, start) < 0;
+    bool isFullyAfterEnd = comparePositions(Position(node, 0), end) > 0;
 
     return isFullyBeforeStart || isFullyAfterEnd;
 }
@@ -1261,11 +1311,11 @@ bool ApplyStyleCommand::nodeFullyUnselected(Node *node, const Position &start, c
 
 bool ApplyStyleCommand::splitTextAtStartIfNeeded(const Position &start, const Position &end)
 {
-    if (start.node()->isTextNode() && start.offset() > caretMinOffset(start.node()) && start.offset() < caretMaxOffset(start.node())) {
-        int endOffsetAdjustment = start.node() == end.node() ? start.offset() : 0;
+    if (start.node()->isTextNode() && start.deprecatedEditingOffset() > caretMinOffset(start.node()) && start.deprecatedEditingOffset() < caretMaxOffset(start.node())) {
+        int endOffsetAdjustment = start.node() == end.node() ? start.deprecatedEditingOffset() : 0;
         Text *text = static_cast<Text *>(start.node());
-        splitTextNode(text, start.offset());
-        updateStartEnd(Position(start.node(), 0), Position(end.node(), end.offset() - endOffsetAdjustment));
+        splitTextNode(text, start.deprecatedEditingOffset());
+        updateStartEnd(Position(start.node(), 0), Position(end.node(), end.deprecatedEditingOffset() - endOffsetAdjustment));
         return true;
     }
     return false;
@@ -1273,15 +1323,15 @@ bool ApplyStyleCommand::splitTextAtStartIfNeeded(const Position &start, const Po
 
 bool ApplyStyleCommand::splitTextAtEndIfNeeded(const Position &start, const Position &end)
 {
-    if (end.node()->isTextNode() && end.offset() > caretMinOffset(end.node()) && end.offset() < caretMaxOffset(end.node())) {
+    if (end.node()->isTextNode() && end.deprecatedEditingOffset() > caretMinOffset(end.node()) && end.deprecatedEditingOffset() < caretMaxOffset(end.node())) {
         Text *text = static_cast<Text *>(end.node());
-        splitTextNode(text, end.offset());
+        splitTextNode(text, end.deprecatedEditingOffset());
         
         Node *prevNode = text->previousSibling();
         ASSERT(prevNode);
         Node *startNode = start.node() == end.node() ? prevNode : start.node();
         ASSERT(startNode);
-        updateStartEnd(Position(startNode, start.offset()), Position(prevNode, caretMaxOffset(prevNode)));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(prevNode, caretMaxOffset(prevNode)));
         return true;
     }
     return false;
@@ -1289,12 +1339,12 @@ bool ApplyStyleCommand::splitTextAtEndIfNeeded(const Position &start, const Posi
 
 bool ApplyStyleCommand::splitTextElementAtStartIfNeeded(const Position &start, const Position &end)
 {
-    if (start.node()->isTextNode() && start.offset() > caretMinOffset(start.node()) && start.offset() < caretMaxOffset(start.node())) {
-        int endOffsetAdjustment = start.node() == end.node() ? start.offset() : 0;
+    if (start.node()->isTextNode() && start.deprecatedEditingOffset() > caretMinOffset(start.node()) && start.deprecatedEditingOffset() < caretMaxOffset(start.node())) {
+        int endOffsetAdjustment = start.node() == end.node() ? start.deprecatedEditingOffset() : 0;
         Text *text = static_cast<Text *>(start.node());
-        splitTextNodeContainingElement(text, start.offset());
+        splitTextNodeContainingElement(text, start.deprecatedEditingOffset());
 
-        updateStartEnd(Position(start.node()->parentNode(), start.node()->nodeIndex()), Position(end.node(), end.offset() - endOffsetAdjustment));
+        updateStartEnd(Position(start.node()->parentNode(), start.node()->nodeIndex()), Position(end.node(), end.deprecatedEditingOffset() - endOffsetAdjustment));
         return true;
     }
     return false;
@@ -1302,15 +1352,15 @@ bool ApplyStyleCommand::splitTextElementAtStartIfNeeded(const Position &start, c
 
 bool ApplyStyleCommand::splitTextElementAtEndIfNeeded(const Position &start, const Position &end)
 {
-    if (end.node()->isTextNode() && end.offset() > caretMinOffset(end.node()) && end.offset() < caretMaxOffset(end.node())) {
+    if (end.node()->isTextNode() && end.deprecatedEditingOffset() > caretMinOffset(end.node()) && end.deprecatedEditingOffset() < caretMaxOffset(end.node())) {
         Text *text = static_cast<Text *>(end.node());
-        splitTextNodeContainingElement(text, end.offset());
+        splitTextNodeContainingElement(text, end.deprecatedEditingOffset());
 
         Node *prevNode = text->parent()->previousSibling()->lastChild();
         ASSERT(prevNode);
         Node *startNode = start.node() == end.node() ? prevNode : start.node();
         ASSERT(startNode);
-        updateStartEnd(Position(startNode, start.offset()), Position(prevNode->parent(), prevNode->nodeIndex() + 1));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(prevNode->parent(), prevNode->nodeIndex() + 1));
         return true;
     }
     return false;
@@ -1332,8 +1382,8 @@ static bool areIdenticalElements(Node *first, Node *second)
     if (!firstElement->tagQName().matches(secondElement->tagQName()))
         return false;
 
-    NamedAttrMap *firstMap = firstElement->attributes();
-    NamedAttrMap *secondMap = secondElement->attributes();
+    NamedNodeMap *firstMap = firstElement->attributes();
+    NamedNodeMap *secondMap = secondElement->attributes();
 
     unsigned firstLength = firstMap->length();
 
@@ -1354,10 +1404,10 @@ static bool areIdenticalElements(Node *first, Node *second)
 bool ApplyStyleCommand::mergeStartWithPreviousIfIdentical(const Position &start, const Position &end)
 {
     Node *startNode = start.node();
-    int startOffset = start.offset();
+    int startOffset = start.deprecatedEditingOffset();
 
     if (isAtomicNode(start.node())) {
-        if (start.offset() != 0)
+        if (start.deprecatedEditingOffset() != 0)
             return false;
 
         // note: prior siblings could be unrendered elements. it's silly to miss the
@@ -1386,7 +1436,7 @@ bool ApplyStyleCommand::mergeStartWithPreviousIfIdentical(const Position &start,
 
         int startOffsetAdjustment = startChild->nodeIndex();
         int endOffsetAdjustment = startNode == end.node() ? startOffsetAdjustment : 0;
-        updateStartEnd(Position(startNode, startOffsetAdjustment), Position(end.node(), end.offset() + endOffsetAdjustment)); 
+        updateStartEnd(Position(startNode, startOffsetAdjustment), Position(end.node(), end.deprecatedEditingOffset() + endOffsetAdjustment)); 
         return true;
     }
 
@@ -1396,7 +1446,7 @@ bool ApplyStyleCommand::mergeStartWithPreviousIfIdentical(const Position &start,
 bool ApplyStyleCommand::mergeEndWithNextIfIdentical(const Position &start, const Position &end)
 {
     Node *endNode = end.node();
-    int endOffset = end.offset();
+    int endOffset = end.deprecatedEditingOffset();
 
     if (isAtomicNode(endNode)) {
         if (endOffset < caretMaxOffset(endNode))
@@ -1426,22 +1476,25 @@ bool ApplyStyleCommand::mergeEndWithNextIfIdentical(const Position &start, const
         ASSERT(startNode);
 
         int endOffset = nextChild ? nextChild->nodeIndex() : nextElement->childNodes()->length();
-        updateStartEnd(Position(startNode, start.offset()), Position(nextElement, endOffset));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(nextElement, endOffset));
         return true;
     }
 
     return false;
 }
 
-void ApplyStyleCommand::surroundNodeRangeWithElement(Node *startNode, Node *endNode, Element *element)
+void ApplyStyleCommand::surroundNodeRangeWithElement(Node* startNode, Node* endNode, PassRefPtr<Element> elementToInsert)
 {
     ASSERT(startNode);
     ASSERT(endNode);
-    ASSERT(element);
+    ASSERT(elementToInsert);
+    RefPtr<Element> element = elementToInsert;
+
+    insertNodeBefore(element, startNode);
     
-    Node *node = startNode;
+    Node* node = startNode;
     while (1) {
-        Node *next = node->traverseNextNode();
+        Node* next = node->traverseNextNode();
         if (node->childNodeCount() == 0 && node->renderer() && node->renderer()->isInline()) {
             removeNode(node);
             appendNode(node, element);
@@ -1452,7 +1505,7 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(Node *startNode, Node *endN
     }
     // FIXME: We should probably call updateStartEnd if the start or end was in the node
     // range so that the endingSelection() is canonicalized.  See the comments at the end of
-    // Selection::validate().
+    // VisibleSelection::validate().
 }
 
 void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElement* block)
@@ -1500,16 +1553,14 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
 {
     if (m_removeOnly)
         return;
-        
-    StyleChange styleChange(style, Position(startNode, 0), StyleChange::styleModeForParseMode(document()->inCompatMode()));
-    ExceptionCode ec = 0;
-    
+
+    StyleChange styleChange(style, Position(startNode, 0));
+
     //
     // Font tags need to go outside of CSS so that CSS font sizes override leagcy font sizes.
     //
     if (styleChange.applyFontColor() || styleChange.applyFontFace() || styleChange.applyFontSize()) {
         RefPtr<Element> fontElement = createFontElement(document());
-        ASSERT(ec == 0);
         RenderStyle* computedStyle = startNode->computedStyle();
 
         // We only want to insert a font element if it will end up changing the style of the
@@ -1518,7 +1569,6 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
         if (fontColorChangesComputedStyle(computedStyle, styleChange)
                 || fontFaceChangesComputedStyle(computedStyle, styleChange)
                 || fontSizeChangesComputedStyle(computedStyle, styleChange)) {
-            insertNodeBefore(fontElement.get(), startNode);
             if (styleChange.applyFontColor())
                 fontElement->setAttribute(colorAttr, styleChange.fontColor());
             if (styleChange.applyFontFace())
@@ -1529,32 +1579,25 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
         }
     }
 
-    if (styleChange.cssStyle().length() > 0) {
+    if (styleChange.cssStyle().length()) {
         RefPtr<Element> styleElement = createStyleSpanElement(document());
         styleElement->setAttribute(styleAttr, styleChange.cssStyle());
-        insertNodeBefore(styleElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, styleElement.get());
+        surroundNodeRangeWithElement(startNode, endNode, styleElement.release());
     }
 
-    if (styleChange.applyBold()) {
-        RefPtr<Element> boldElement = document()->createElementNS(xhtmlNamespaceURI, "b", ec);
-        ASSERT(ec == 0);
-        insertNodeBefore(boldElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, boldElement.get());
-    }
+    if (styleChange.applyBold())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), bTag));
 
-    if (styleChange.applyItalic()) {
-        RefPtr<Element> italicElement = document()->createElementNS(xhtmlNamespaceURI, "i", ec);
-        ASSERT(ec == 0);
-        insertNodeBefore(italicElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, italicElement.get());
-    }
-    
-    if (m_styledInlineElement) {
-        RefPtr<Element> clonedElement = m_styledInlineElement->cloneElement();
-        insertNodeBefore(clonedElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, clonedElement.get());
-    }
+    if (styleChange.applyItalic())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), iTag));
+
+    if (styleChange.applySubscript())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), subTag));
+    else if (styleChange.applySuperscript())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), supTag));
+
+    if (m_styledInlineElement)
+        surroundNodeRangeWithElement(startNode, endNode, m_styledInlineElement->cloneElementWithoutChildren());
 }
 
 float ApplyStyleCommand::computedFontSize(const Node *node)
@@ -1589,9 +1632,9 @@ void ApplyStyleCommand::joinChildTextNodes(Node *node, const Position &start, co
             Text *childText = static_cast<Text *>(child);
             Text *nextText = static_cast<Text *>(next);
             if (next == start.node())
-                newStart = Position(childText, childText->length() + start.offset());
+                newStart = Position(childText, childText->length() + start.deprecatedEditingOffset());
             if (next == end.node())
-                newEnd = Position(childText, childText->length() + end.offset());
+                newEnd = Position(childText, childText->length() + end.deprecatedEditingOffset());
             String textToMove = nextText->data();
             insertTextIntoNode(childText, childText->length(), textToMove);
             removeNode(next);
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
index c6462339aa..74fe605ef9 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -62,19 +62,18 @@ private:
     CSSMutableStyleDeclaration* style() const { return m_style.get(); }
 
     // style-removal helpers
-    bool isHTMLStyleNode(CSSMutableStyleDeclaration*, HTMLElement*);
-    void removeHTMLStyleNode(HTMLElement*);
+    bool implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement*, CSSMutableStyleDeclaration*);
+    void replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*&);
     void removeHTMLFontStyle(CSSMutableStyleDeclaration*, HTMLElement*);
     void removeHTMLBidiEmbeddingStyle(CSSMutableStyleDeclaration*, HTMLElement*);
     void removeCSSStyle(CSSMutableStyleDeclaration*, HTMLElement*);
-    void removeBlockStyle(CSSMutableStyleDeclaration*, const Position& start, const Position& end);
     void removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>, const Position& start, const Position& end);
     bool nodeFullySelected(Node*, const Position& start, const Position& end) const;
     bool nodeFullyUnselected(Node*, const Position& start, const Position& end) const;
     PassRefPtr<CSSMutableStyleDeclaration> extractTextDecorationStyle(Node*);
     PassRefPtr<CSSMutableStyleDeclaration> extractAndNegateTextDecorationStyle(Node*);
     void applyTextDecorationStyle(Node*, CSSMutableStyleDeclaration *style);
-    void pushDownTextDecorationStyleAroundNode(Node*, const Position& start, const Position& end, bool force);
+    void pushDownTextDecorationStyleAroundNode(Node*, bool force);
     void pushDownTextDecorationStyleAtBoundaries(const Position& start, const Position& end);
     
     // style-application helpers
@@ -92,7 +91,7 @@ private:
     bool mergeEndWithNextIfIdentical(const Position& start, const Position& end);
     void cleanupUnstyledAppleStyleSpans(Node* dummySpanAncestor);
 
-    void surroundNodeRangeWithElement(Node* start, Node* end, Element* element);
+    void surroundNodeRangeWithElement(Node* start, Node* end, PassRefPtr<Element>);
     float computedFontSize(const Node*);
     void joinChildTextNodes(Node*, const Position& start, const Position& end);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp b/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
index 76a0890ba1..e3d66ba518 100644
--- a/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -26,12 +26,12 @@
 #include "config.h"
 #include "BreakBlockquoteCommand.h"
 
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "RenderListItem.h"
 #include "Text.h"
 #include "VisiblePosition.h"
 #include "htmlediting.h"
-#include "RenderListItem.h"
 
 namespace WebCore {
 
@@ -56,48 +56,65 @@ void BreakBlockquoteCommand::doApply()
     // be in the first node that we need to move (there are a few exceptions to this, see below).
     Position pos = endingSelection().start().downstream();
     
-    // startNode is the first node that we need to move to the new blockquote.
-    Node* startNode = pos.node();
     // Find the top-most blockquote from the start.
     Element* topBlockquote = 0;
-    for (Node *node = startNode->parentNode(); node; node = node->parentNode()) {
+    for (Node *node = pos.node()->parentNode(); node; node = node->parentNode()) {
         if (isMailBlockquote(node))
             topBlockquote = static_cast<Element*>(node);
     }
     if (!topBlockquote || !topBlockquote->parentNode())
         return;
     
-    // Insert a break after the top blockquote.
     RefPtr<Element> breakNode = createBreakElement(document());
+
+    // If the position is at the beginning of the top quoted content, we don't need to break the quote.
+    // Instead, insert the break before the blockquote.
+    if (isFirstVisiblePositionInNode(visiblePos, topBlockquote)) {
+        insertNodeBefore(breakNode.get(), topBlockquote);
+        setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
+        rebalanceWhitespace();   
+        return;
+    }
+    
+    // Insert a break after the top blockquote.
     insertNodeAfter(breakNode.get(), topBlockquote);
     
+    // If we're inserting the break at the end of the quoted content, we don't need to break the quote.
     if (isLastVisiblePositionInNode(visiblePos, topBlockquote)) {
-        setEndingSelection(Selection(Position(breakNode.get(), 0), DOWNSTREAM));
-        rebalanceWhitespace();   
+        setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
+        rebalanceWhitespace();
         return;
     }
     
     // Don't move a line break just after the caret.  Doing so would create an extra, empty paragraph
     // in the new blockquote.
-    if (lineBreakExistsAtPosition(visiblePos))
+    if (lineBreakExistsAtVisiblePosition(visiblePos))
         pos = pos.next();
         
+    // Adjust the position so we don't split at the beginning of a quote.  
+    while (isFirstVisiblePositionInNode(VisiblePosition(pos), nearestMailBlockquote(pos.node())))
+        pos = pos.previous();
+    
+    // startNode is the first node that we need to move to the new blockquote.
+    Node* startNode = pos.node();
+        
     // Split at pos if in the middle of a text node.
     if (startNode->isTextNode()) {
         Text* textNode = static_cast<Text*>(startNode);
-        if ((unsigned)pos.offset() >= textNode->length()) {
+        if ((unsigned)pos.deprecatedEditingOffset() >= textNode->length()) {
             startNode = startNode->traverseNextNode();
             ASSERT(startNode);
-        } else if (pos.offset() > 0)
-            splitTextNode(textNode, pos.offset());
-    } else if (pos.offset() > 0) {
-        startNode = startNode->traverseNextNode();
+        } else if (pos.deprecatedEditingOffset() > 0)
+            splitTextNode(textNode, pos.deprecatedEditingOffset());
+    } else if (pos.deprecatedEditingOffset() > 0) {
+        Node* childAtOffset = startNode->childNode(pos.deprecatedEditingOffset());
+        startNode = childAtOffset ? childAtOffset : startNode->traverseNextNode();
         ASSERT(startNode);
     }
     
     // If there's nothing inside topBlockquote to move, we're finished.
     if (!startNode->isDescendantOf(topBlockquote)) {
-        setEndingSelection(Selection(VisiblePosition(Position(startNode, 0))));
+        setEndingSelection(VisibleSelection(VisiblePosition(Position(startNode, 0))));
         return;
     }
     
@@ -107,7 +124,7 @@ void BreakBlockquoteCommand::doApply()
         ancestors.append(node);
     
     // Insert a clone of the top blockquote after the break.
-    RefPtr<Element> clonedBlockquote = topBlockquote->cloneElement();
+    RefPtr<Element> clonedBlockquote = topBlockquote->cloneElementWithoutChildren();
     insertNodeAfter(clonedBlockquote.get(), breakNode.get());
     
     // Clone startNode's ancestors into the cloned blockquote.
@@ -116,7 +133,7 @@ void BreakBlockquoteCommand::doApply()
     // or clonedBlockquote if ancestors is empty).
     RefPtr<Element> clonedAncestor = clonedBlockquote;
     for (size_t i = ancestors.size(); i != 0; --i) {
-        RefPtr<Element> clonedChild = ancestors[i - 1]->cloneElement(); // shallow clone
+        RefPtr<Element> clonedChild = ancestors[i - 1]->cloneElementWithoutChildren();
         // Preserve list item numbering in cloned lists.
         if (clonedChild->isElementNode() && clonedChild->hasTagName(olTag)) {
             Node* listChildNode = i > 1 ? ancestors[i - 2] : startNode;
@@ -141,10 +158,7 @@ void BreakBlockquoteCommand::doApply()
         moveNode = next;
     }
 
-    // Hold open startNode's original parent if we emptied it
     if (!ancestors.isEmpty()) {
-        addBlockPlaceholderIfNeeded(ancestors.first());
-
         // Split the tree up the ancestor chain until the topBlockquote
         // Throughout this loop, clonedParent is the clone of ancestor's parent.
         // This is so we can clone ancestor's siblings and place the clones
@@ -162,13 +176,18 @@ void BreakBlockquoteCommand::doApply()
                 moveNode = next;
             }
         }
+        
+        // If the startNode's original parent is now empty, remove it
+        Node* originalParent = ancestors.first();
+        if (!originalParent->hasChildNodes())
+            removeNode(originalParent);
     }
     
     // Make sure the cloned block quote renders.
     addBlockPlaceholderIfNeeded(clonedBlockquote.get());
     
     // Put the selection right before the break.
-    setEndingSelection(Selection(Position(breakNode.get(), 0), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
     rebalanceWhitespace();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
index d75aa827ea..89a0f8a668 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
@@ -36,7 +36,7 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "EditorInsertAction.h"
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "InsertIntoTextNodeCommand.h"
@@ -50,7 +50,10 @@
 #include "RemoveCSSPropertyCommand.h"
 #include "RemoveNodeCommand.h"
 #include "RemoveNodePreservingChildrenCommand.h"
+#include "ReplaceNodeWithSpanCommand.h"
 #include "ReplaceSelectionCommand.h"
+#include "RenderBlock.h"
+#include "RenderText.h"
 #include "SetNodeAttributeCommand.h"
 #include "SplitElementCommand.h"
 #include "SplitTextNodeCommand.h"
@@ -155,7 +158,7 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
     // likewise for replaced elements, brs, etc.
     Position p = rangeCompliantEquivalent(editingPosition);
     Node* refChild = p.node();
-    int offset = p.offset();
+    int offset = p.deprecatedEditingOffset();
     
     if (canHaveChildrenForEditing(refChild)) {
         Node* child = refChild->firstChild();
@@ -165,14 +168,17 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
             insertNodeBefore(insertChild, child);
         else
             appendNode(insertChild, static_cast<Element*>(refChild));
-    } else if (caretMinOffset(refChild) >= offset) {
+    } else if (caretMinOffset(refChild) >= offset)
         insertNodeBefore(insertChild, refChild);
-    } else if (refChild->isTextNode() && caretMaxOffset(refChild) > offset) {
+    else if (refChild->isTextNode() && caretMaxOffset(refChild) > offset) {
         splitTextNode(static_cast<Text *>(refChild), offset);
+
+        // Mutation events (bug 22634) from the text node insertion may have removed the refChild
+        if (!refChild->inDocument())
+            return;
         insertNodeBefore(insertChild, refChild);
-    } else {
+    } else
         insertNodeAfter(insertChild, refChild);
-    }
 }
 
 void CompositeEditCommand::appendNode(PassRefPtr<Node> node, PassRefPtr<Element> parent)
@@ -210,6 +216,20 @@ void CompositeEditCommand::removeNodeAndPruneAncestors(PassRefPtr<Node> node)
     prune(parent.release());
 }
 
+HTMLElement* CompositeEditCommand::replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node> node)
+{
+    // It would also be possible to implement all of ReplaceNodeWithSpanCommand
+    // as a series of existing smaller edit commands.  Someone who wanted to
+    // reduce the number of edit commands could do so here.
+    RefPtr<ReplaceNodeWithSpanCommand> command = ReplaceNodeWithSpanCommand::create(node);
+    applyCommandToComposite(command);
+    // Returning a raw pointer here is OK because the command is retained by
+    // applyCommandToComposite (thus retaining the span), and the span is also
+    // in the DOM tree, and thus alive whie it has a parent.
+    ASSERT(command->spanElement()->inDocument());
+    return command->spanElement();
+}
+
 static bool hasARenderedDescendant(Node* node)
 {
     Node* n = node->firstChild();
@@ -295,7 +315,7 @@ void CompositeEditCommand::inputText(const String& text, bool selectInsertedText
     
     if (selectInsertedText) {
         RefPtr<Range> selectedRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, length);
-        setEndingSelection(Selection(selectedRange.get()));
+        setEndingSelection(VisibleSelection(selectedRange.get()));
     }
 }
 
@@ -322,13 +342,13 @@ Position CompositeEditCommand::positionOutsideTabSpan(const Position& pos)
     
     Node* tabSpan = tabSpanNode(pos.node());
     
-    if (pos.offset() <= caretMinOffset(pos.node()))
+    if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node()))
         return positionBeforeNode(tabSpan);
         
-    if (pos.offset() >= caretMaxOffset(pos.node()))
+    if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()))
         return positionAfterNode(tabSpan);
 
-    splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.offset());
+    splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.deprecatedEditingOffset());
     return positionBeforeNode(tabSpan);
 }
 
@@ -344,7 +364,7 @@ void CompositeEditCommand::deleteSelection(bool smartDelete, bool mergeBlocksAft
         applyCommandToComposite(DeleteSelectionCommand::create(document(), smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
 }
 
-void CompositeEditCommand::deleteSelection(const Selection &selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
+void CompositeEditCommand::deleteSelection(const VisibleSelection &selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
 {
     if (selection.isRange())
         applyCommandToComposite(DeleteSelectionCommand::create(selection, smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
@@ -357,7 +377,7 @@ void CompositeEditCommand::removeCSSProperty(PassRefPtr<CSSMutableStyleDeclarati
 
 void CompositeEditCommand::removeNodeAttribute(PassRefPtr<Element> element, const QualifiedName& attribute)
 {
-    setNodeAttribute(element, attribute, AtomicString());;
+    setNodeAttribute(element, attribute, AtomicString());
 }
 
 void CompositeEditCommand::setNodeAttribute(PassRefPtr<Element> element, const QualifiedName& attribute, const AtomicString& value)
@@ -387,7 +407,7 @@ void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
     String text = textNode->data();
     ASSERT(!text.isEmpty());
 
-    int offset = position.offset();
+    int offset = position.deprecatedEditingOffset();
     // If neither text[offset] nor text[offset - 1] are some form of whitespace, do nothing.
     if (!isWhitespace(text[offset])) {
         offset--;
@@ -444,14 +464,14 @@ void CompositeEditCommand::prepareWhitespaceAtPositionForSplit(Position& positio
     Position previous(previousVisiblePos.deepEquivalent());
     
     if (isCollapsibleWhitespace(previousVisiblePos.characterAfter()) && previous.node()->isTextNode() && !previous.node()->hasTagName(brTag))
-        replaceTextInNode(static_cast<Text*>(previous.node()), previous.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(static_cast<Text*>(previous.node()), previous.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     if (isCollapsibleWhitespace(visiblePos.characterAfter()) && position.node()->isTextNode() && !position.node()->hasTagName(brTag))
-        replaceTextInNode(static_cast<Text*>(position.node()), position.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(static_cast<Text*>(position.node()), position.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
 }
 
 void CompositeEditCommand::rebalanceWhitespace()
 {
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     if (selection.isNone())
         return;
         
@@ -465,7 +485,7 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
     if (!textNode || start >= end)
         return;
 
-    RenderText* textRenderer = static_cast<RenderText*>(textNode->renderer());
+    RenderText* textRenderer = toRenderText(textNode->renderer());
     if (!textRenderer)
         return;
 
@@ -487,12 +507,12 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
     // This loop structure works to process all gaps preceding a box,
     // and also will look at the gap after the last box.
     while (prevBox || box) {
-        unsigned gapStart = prevBox ? prevBox->m_start + prevBox->m_len : 0;
+        unsigned gapStart = prevBox ? prevBox->start() + prevBox->len() : 0;
         if (end < gapStart)
             // No more chance for any intersections
             break;
 
-        unsigned gapEnd = box ? box->m_start : length;
+        unsigned gapEnd = box ? box->start() : length;
         bool indicesIntersect = start <= gapEnd && end >= gapStart;
         int gapLen = gapEnd - gapStart;
         if (indicesIntersect && gapLen > 0) {
@@ -529,7 +549,7 @@ void CompositeEditCommand::deleteInsignificantText(const Position& start, const
     if (start.isNull() || end.isNull())
         return;
 
-    if (Range::compareBoundaryPoints(start, end) >= 0)
+    if (comparePositions(start, end) >= 0)
         return;
 
     Node* next;
@@ -537,8 +557,8 @@ void CompositeEditCommand::deleteInsignificantText(const Position& start, const
         next = node->traverseNextNode();
         if (node->isTextNode()) {
             Text* textNode = static_cast<Text*>(node);
-            int startOffset = node == start.node() ? start.offset() : 0;
-            int endOffset = node == end.node() ? end.offset() : textNode->length();
+            int startOffset = node == start.node() ? start.deprecatedEditingOffset() : 0;
+            int endOffset = node == end.node() ? end.deprecatedEditingOffset() : textNode->length();
             deleteInsignificantText(textNode, startOffset, endOffset);
         }
         if (node == end.node())
@@ -591,30 +611,25 @@ PassRefPtr<Node> CompositeEditCommand::addBlockPlaceholderIfNeeded(Element* cont
     
     // append the placeholder to make sure it follows
     // any unrendered blocks
-    if (renderer->height() == 0 || (renderer->isListItem() && renderer->isEmpty()))
+    RenderBlock* block = toRenderBlock(renderer);
+    if (block->height() == 0 || (block->isListItem() && block->isEmpty()))
         return appendBlockPlaceholder(container);
 
     return 0;
 }
 
-// Removes '\n's and brs that will collapse when content is inserted just before them.
-// FIXME: We shouldn't really have to remove placeholders, but removing them is a workaround for 9661.
-void CompositeEditCommand::removePlaceholderAt(const VisiblePosition& visiblePosition)
+// Assumes that the position is at a placeholder and does the removal without much checking.
+void CompositeEditCommand::removePlaceholderAt(const Position& p)
 {
-    if (visiblePosition.isNull())
+    ASSERT(lineBreakExistsAtPosition(p));
+    
+    // We are certain that the position is at a line break, but it may be a br or a preserved newline.
+    if (p.anchorNode()->hasTagName(brTag)) {
+        removeNode(p.anchorNode());
         return;
-        
-    Position p = visiblePosition.deepEquivalent().downstream();
-    // If a br or '\n' is at the end of a block and not at the start of a paragraph,
-    // then it is superfluous, so adding content before a br or '\n' that is at
-    // the start of a paragraph will render it superfluous.
-    // FIXME: This doesn't remove placeholders at the end of anonymous blocks.
-    if (isEndOfBlock(visiblePosition) && isStartOfParagraph(visiblePosition)) {
-        if (p.node()->hasTagName(brTag) && p.offset() == 0)
-            removeNode(p.node());
-        else if (lineBreakExistsAtPosition(visiblePosition))
-            deleteTextFromNode(static_cast<Text*>(p.node()), p.offset(), 1);
     }
+    
+    deleteTextFromNode(static_cast<Text*>(p.anchorNode()), p.offsetInContainerNode(), 1);
 }
 
 PassRefPtr<Node> CompositeEditCommand::insertNewDefaultParagraphElementAt(const Position& position)
@@ -648,18 +663,17 @@ PassRefPtr<Node> CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessar
 
     // If there are no VisiblePositions in the same block as pos then 
     // upstreamStart will be outside the paragraph
-    if (Range::compareBoundaryPoints(pos, upstreamStart) < 0)
+    if (comparePositions(pos, upstreamStart) < 0)
         return 0;
 
     // Perform some checks to see if we need to perform work in this function.
     if (isBlock(upstreamStart.node())) {
-        // If the block is the body element, always move content to a new block, so that
-        // we avoid adding styles to the body element, since Mail's Make Plain Text feature
-        // can't handle those.
-        if (upstreamStart.node()->hasTagName(bodyTag)) {
-            // If the block is the body element and there is nothing insde of it, create a new
-            // block but don't try and move content into it, since there's nothing to move.
-            if (upstreamStart == upstreamEnd)
+        // If the block is the root editable element, always move content to a new block,
+        // since it is illegal to modify attributes on the root editable element for editing.
+        if (upstreamStart.node() == editableRootForPosition(upstreamStart)) {
+            // If the block is the root editable element and it contains no visible content, create a new
+            // block but don't try and move content into it, since there's nothing for moveParagraphs to move.
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(upstreamStart.node()->renderer()))
                 return insertNewDefaultParagraphElementAt(upstreamStart);
         } else if (isBlock(upstreamEnd.node())) {
             if (!upstreamEnd.node()->isDescendantOf(upstreamStart.node())) {
@@ -694,7 +708,7 @@ void CompositeEditCommand::pushAnchorElementDown(Node* anchorNode)
     
     ASSERT(anchorNode->isLink());
     
-    setEndingSelection(Selection::selectionFromContentsOfNode(anchorNode));
+    setEndingSelection(VisibleSelection::selectionFromContentsOfNode(anchorNode));
     applyStyledElement(static_cast<Element*>(anchorNode));
     // Clones of anchorNode have been pushed down, now remove it.
     if (anchorNode->inDocument())
@@ -707,7 +721,7 @@ void CompositeEditCommand::pushAnchorElementDown(Node* anchorNode)
 // Anchors cannot be nested.
 void CompositeEditCommand::pushPartiallySelectedAnchorElementsDown()
 {
-    Selection originalSelection = endingSelection();
+    VisibleSelection originalSelection = endingSelection();
     VisiblePosition visibleStart(originalSelection.start());
     VisiblePosition visibleEnd(originalSelection.end());
     
@@ -745,12 +759,12 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         VisiblePosition visibleStart = endingSelection().visibleStart();
         VisiblePosition visibleEnd = endingSelection().visibleEnd();
         
-        bool startAfterParagraph = Range::compareBoundaryPoints(visibleStart.deepEquivalent(), endOfParagraphToMove.deepEquivalent()) > 0;
-        bool endBeforeParagraph = Range::compareBoundaryPoints(visibleEnd.deepEquivalent(), startOfParagraphToMove.deepEquivalent()) < 0;
+        bool startAfterParagraph = comparePositions(visibleStart, endOfParagraphToMove) > 0;
+        bool endBeforeParagraph = comparePositions(visibleEnd, startOfParagraphToMove) < 0;
         
         if (!startAfterParagraph && !endBeforeParagraph) {
-            bool startInParagraph = Range::compareBoundaryPoints(visibleStart.deepEquivalent(), startOfParagraphToMove.deepEquivalent()) >= 0;
-            bool endInParagraph = Range::compareBoundaryPoints(visibleEnd.deepEquivalent(), endOfParagraphToMove.deepEquivalent()) <= 0;
+            bool startInParagraph = comparePositions(visibleStart, startOfParagraphToMove) >= 0;
+            bool endInParagraph = comparePositions(visibleEnd, endOfParagraphToMove) <= 0;
             
             startIndex = 0;
             if (startInParagraph) {
@@ -777,7 +791,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     // start and end can't be used directly to create a Range; they are "editing positions"
     Position startRangeCompliant = rangeCompliantEquivalent(start);
     Position endRangeCompliant = rangeCompliantEquivalent(end);
-    RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.offset(), endRangeCompliant.node(), endRangeCompliant.offset());
+    RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.deprecatedEditingOffset(), endRangeCompliant.node(), endRangeCompliant.deprecatedEditingOffset());
 
     // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move.  It 
     // shouldn't matter though, since moved paragraphs will usually be quite small.
@@ -795,7 +809,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     
     // FIXME (5098931): We should add a new insert action "WebViewInsertActionMoved" and call shouldInsertFragment here.
     
-    setEndingSelection(Selection(start, end, DOWNSTREAM));
+    setEndingSelection(VisibleSelection(start, end, DOWNSTREAM));
     deleteSelection(false, false, false, false);
 
     ASSERT(destination.deepEquivalent().node()->inDocument());
@@ -820,13 +834,13 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         // expects this behavior).
         else if (isBlock(node))
             removeNodeAndPruneAncestors(node);
-        else if (lineBreakExistsAtPosition(caretAfterDelete)) {
+        else if (lineBreakExistsAtVisiblePosition(caretAfterDelete)) {
             // There is a preserved '\n' at caretAfterDelete.
             Text* textNode = static_cast<Text*>(node);
             if (textNode->length() == 1)
                 removeNodeAndPruneAncestors(node);
             else 
-                deleteTextFromNode(textNode, position.offset(), 1);
+                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
         }
     }
 
@@ -851,8 +865,10 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     
     setEndingSelection(destination);
     applyCommandToComposite(ReplaceSelectionCommand::create(document(), fragment, true, false, !preserveStyle, false, true));
-    // Restore styles from an empty paragraph to the new empty paragraph.
-    if (styleInEmptyParagraph)
+    
+    // If the selection is in an empty paragraph, restore styles from the old empty paragraph to the new empty paragraph.
+    bool selectionIsEmptyParagraph = endingSelection().isCaret() && isStartOfParagraph(endingSelection().visibleStart()) && isEndOfParagraph(endingSelection().visibleStart());
+    if (styleInEmptyParagraph && selectionIsEmptyParagraph)
         applyStyle(styleInEmptyParagraph.get());
     
     if (preserveSelection && startIndex != -1) {
@@ -864,7 +880,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         RefPtr<Range> start = TextIterator::rangeFromLocationAndLength(document()->documentElement(), destinationIndex + startIndex, 0, true);
         RefPtr<Range> end = TextIterator::rangeFromLocationAndLength(document()->documentElement(), destinationIndex + endIndex, 0, true);
         if (start && end)
-            setEndingSelection(Selection(start->startPosition(), end->startPosition(), DOWNSTREAM));
+            setEndingSelection(VisibleSelection(start->startPosition(), end->startPosition(), DOWNSTREAM));
     }
 }
 
@@ -895,7 +911,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
     }
     
     appendBlockPlaceholder(newBlock);
-    setEndingSelection(Selection(Position(newBlock.get(), 0), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(Position(newBlock.get(), 0), DOWNSTREAM));
     
     computedStyle(endingSelection().start().node())->diff(style.get());
     if (style->length() > 0)
@@ -933,10 +949,10 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     // a second one.
     if (!isStartOfParagraph(atBR))
         insertNodeBefore(createBreakElement(document()), br);
-    setEndingSelection(Selection(atBR));
+    setEndingSelection(VisibleSelection(atBR));
     
     // If this is an empty paragraph there must be a line break here.
-    if (!lineBreakExistsAtPosition(caret))
+    if (!lineBreakExistsAtVisiblePosition(caret))
         return false;
     
     Position caretPos(caret.deepEquivalent());
@@ -948,7 +964,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
         removeNode(caretPos.node());
         prune(beforeBR.node());
     } else {
-        ASSERT(caretPos.offset() == 0);
+        ASSERT(caretPos.deprecatedEditingOffset() == 0);
         Text* textNode = static_cast<Text*>(caretPos.node());
         Node* parentNode = textNode->parentNode();
         // The preserved newline must be the first thing in the node, since otherwise the previous
@@ -974,8 +990,8 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
     Position result = original;
     // Don't avoid block level anchors, because that would insert content into the wrong paragraph.
     if (enclosingAnchor && !isBlock(enclosingAnchor)) {
-        VisiblePosition firstInAnchor(Position(enclosingAnchor, 0));
-        VisiblePosition lastInAnchor(Position(enclosingAnchor, maxDeepOffset(enclosingAnchor)));
+        VisiblePosition firstInAnchor(firstDeepEditingPositionForNode(enclosingAnchor));
+        VisiblePosition lastInAnchor(lastDeepEditingPositionForNode(enclosingAnchor));
         // If visually just after the anchor, insert *inside* the anchor unless it's the last 
         // VisiblePosition in the document, to match NSTextView.
         if (visiblePos == lastInAnchor) {
@@ -990,7 +1006,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             // Don't insert outside an anchor if doing so would skip over a line break.  It would
             // probably be safe to move the line break so that we could still avoid the anchor here.
             Position downstream(visiblePos.deepEquivalent().downstream());
-            if (lineBreakExistsAtPosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
+            if (lineBreakExistsAtVisiblePosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
                 return original;
             
             result = positionAfterNode(enclosingAnchor);
@@ -1025,16 +1041,16 @@ PassRefPtr<Node> CompositeEditCommand::splitTreeToNode(Node* start, Node* end, b
         if (positionInParent != positionInNode)
             applyCommandToComposite(SplitElementCommand::create(static_cast<Element*>(node->parent()), node));
     }
-    if (splitAncestor)
-        return splitTreeToNode(end, end->parent());
+    if (splitAncestor) {
+        splitElement(static_cast<Element*>(end), node);
+        return node->parent();
+    }
     return node.release();
 }
 
 PassRefPtr<Element> createBlockPlaceholderElement(Document* document)
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> breakNode = document->createElementNS(xhtmlNamespaceURI, "br", ec);
-    ASSERT(ec == 0);
+    RefPtr<Element> breakNode = document->createElement(brTag, false);
     return breakNode.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
index 6bb142ba51..2c6403e79a 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
@@ -33,6 +33,7 @@
 namespace WebCore {
 
 class CSSStyleDeclaration;
+class HTMLElement;
 class Text;
 
 class CompositeEditCommand : public EditCommand {
@@ -52,7 +53,7 @@ protected:
     void applyStyledElement(PassRefPtr<Element>);
     void removeStyledElement(PassRefPtr<Element>);
     void deleteSelection(bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = true);
-    void deleteSelection(const Selection&, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = true);
+    void deleteSelection(const VisibleSelection&, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = true);
     virtual void deleteTextFromNode(PassRefPtr<Text>, unsigned offset, unsigned count);
     void inputText(const String&, bool selectInsertedText = false);
     void insertNodeAfter(PassRefPtr<Node>, PassRefPtr<Node> refChild);
@@ -71,6 +72,7 @@ protected:
     void removeNodeAttribute(PassRefPtr<Element>, const QualifiedName& attribute);
     void removeChildrenInRange(PassRefPtr<Node>, unsigned from, unsigned to);
     virtual void removeNode(PassRefPtr<Node>);
+    HTMLElement* replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node>);
     void removeNodePreservingChildren(PassRefPtr<Node>);
     void removeNodeAndPruneAncestors(PassRefPtr<Node>);
     void prune(PassRefPtr<Node>);
@@ -89,7 +91,7 @@ protected:
     PassRefPtr<Node> appendBlockPlaceholder(PassRefPtr<Element>);
     PassRefPtr<Node> insertBlockPlaceholder(const Position&);
     PassRefPtr<Node> addBlockPlaceholderIfNeeded(Element*);
-    void removePlaceholderAt(const VisiblePosition&);
+    void removePlaceholderAt(const Position&);
 
     PassRefPtr<Node> insertNewDefaultParagraphElementAt(const Position&);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
index c5d68dd9c6..263feabf3b 100644
--- a/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
@@ -53,7 +53,7 @@ void CreateLinkCommand::doApply()
         insertNodeAt(anchorElement.get(), endingSelection().start());
         RefPtr<Text> textNode = new Text(document(), m_url);
         appendNode(textNode.get(), anchorElement.get());
-        setEndingSelection(Selection(positionBeforeNode(anchorElement.get()), positionAfterNode(anchorElement.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionBeforeNode(anchorElement.get()), positionAfterNode(anchorElement.get()), DOWNSTREAM));
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
index e1832c3488..725c01d52d 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,7 +42,7 @@
 #include "Node.h"
 #include "Range.h"
 #include "RemoveNodeCommand.h"
-#include "RenderObject.h"
+#include "RenderBox.h"
 #include "SelectionController.h"
 
 namespace WebCore {
@@ -66,42 +66,86 @@ static bool isDeletableElement(const Node* node)
     if (!node || !node->isHTMLElement() || !node->inDocument() || !node->isContentEditable())
         return false;
 
-    const int minimumWidth = 25;
-    const int minimumHeight = 25;
-    const unsigned minimumVisibleBorders = 3;
+    // In general we want to only draw the UI arround object of a certain area, but we still keep the min width/height to
+    // make sure we don't end up with very thin or very short elements getting the UI.
+    const int minimumArea = 2500;
+    const int minimumWidth = 48;
+    const int minimumHeight = 16;
+    const unsigned minimumVisibleBorders = 1;
 
     RenderObject* renderer = node->renderer();
-    if (!renderer || renderer->width() < minimumWidth || renderer->height() < minimumHeight)
+    if (!renderer || !renderer->isBox())
+        return false;
+
+    // Disallow the body element since it isn't practical to delete, and the deletion UI would be clipped.
+    if (node->hasTagName(bodyTag))
+        return false;
+
+    // Disallow elements with any overflow clip, since the deletion UI would be clipped as well. <rdar://problem/6840161>
+    if (renderer->hasOverflowClip())
+        return false;
+
+    // Disallow Mail blockquotes since the deletion UI would get in the way of editing for these.
+    if (isMailBlockquote(node))
+        return false;
+
+    RenderBox* box = toRenderBox(renderer);
+    IntRect borderBoundingBox = box->borderBoundingBox();
+    if (borderBoundingBox.width() < minimumWidth || borderBoundingBox.height() < minimumHeight)
+        return false;
+
+    if ((borderBoundingBox.width() * borderBoundingBox.height()) < minimumArea)
         return false;
 
     if (renderer->isTable())
         return true;
 
-    if (node->hasTagName(ulTag) || node->hasTagName(olTag))
+    if (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(iframeTag))
         return true;
 
     if (renderer->isPositioned())
         return true;
 
-    // allow block elements (excluding table cells) that have some non-transparent borders
     if (renderer->isRenderBlock() && !renderer->isTableCell()) {
         RenderStyle* style = renderer->style();
-        if (style && style->hasBorder()) {
-            unsigned visibleBorders = style->borderTop().isVisible() + style->borderBottom().isVisible() + style->borderLeft().isVisible() + style->borderRight().isVisible();
-            if (visibleBorders >= minimumVisibleBorders)
-                return true;
-        }
+        if (!style)
+            return false;
+
+        // Allow blocks that have background images
+        if (style->hasBackgroundImage() && style->backgroundImage()->canRender(1.0f))
+            return true;
+
+        // Allow blocks with a minimum number of non-transparent borders
+        unsigned visibleBorders = style->borderTop().isVisible() + style->borderBottom().isVisible() + style->borderLeft().isVisible() + style->borderRight().isVisible();
+        if (visibleBorders >= minimumVisibleBorders)
+            return true;
+
+        // Allow blocks that have a different background from it's parent
+        Node* parentNode = node->parentNode();
+        if (!parentNode)
+            return false;
+
+        RenderObject* parentRenderer = parentNode->renderer();
+        if (!parentRenderer)
+            return false;
+
+        RenderStyle* parentStyle = parentRenderer->style();
+        if (!parentStyle)
+            return false;
+
+        if (style->hasBackground() && (!parentStyle->hasBackground() || style->backgroundColor() != parentStyle->backgroundColor()))
+            return true;
     }
 
     return false;
 }
 
-static HTMLElement* enclosingDeletableElement(const Selection& selection)
+static HTMLElement* enclosingDeletableElement(const VisibleSelection& selection)
 {
     if (!selection.isContentEditable())
         return 0;
 
-    RefPtr<Range> range = selection.toRange();
+    RefPtr<Range> range = selection.toNormalizedRange();
     if (!range)
         return 0;
 
@@ -123,7 +167,7 @@ static HTMLElement* enclosingDeletableElement(const Selection& selection)
     return static_cast<HTMLElement*>(element);
 }
 
-void DeleteButtonController::respondToChangedSelection(const Selection& oldSelection)
+void DeleteButtonController::respondToChangedSelection(const VisibleSelection& oldSelection)
 {
     if (!enabled())
         return;
@@ -149,6 +193,13 @@ void DeleteButtonController::createDeletionUI()
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
     style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
     style->setProperty(CSSPropertyWebkitUserModify, CSSValueNone);
+    style->setProperty(CSSPropertyVisibility, CSSValueHidden);
+    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
+    style->setProperty(CSSPropertyCursor, CSSValueDefault);
+    style->setProperty(CSSPropertyTop, "0");
+    style->setProperty(CSSPropertyRight, "0");
+    style->setProperty(CSSPropertyBottom, "0");
+    style->setProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = new HTMLDivElement(divTag, m_target->document());
     outline->setId(outlineElementIdentifier);
@@ -158,17 +209,14 @@ void DeleteButtonController::createDeletionUI()
 
     style = outline->getInlineStyleDecl();
     style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyCursor, CSSValueDefault);
-    style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserModify, CSSValueNone);
     style->setProperty(CSSPropertyZIndex, String::number(-1000000));
-    style->setProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderer()->borderTop()) + "px");
-    style->setProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderer()->borderRight()) + "px");
-    style->setProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderer()->borderBottom()) + "px");
-    style->setProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderer()->borderLeft()) + "px");
+    style->setProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderBox()->borderTop()) + "px");
+    style->setProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderBox()->borderRight()) + "px");
+    style->setProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderBox()->borderBottom()) + "px");
+    style->setProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderBox()->borderLeft()) + "px");
     style->setProperty(CSSPropertyBorder, String::number(borderWidth) + "px solid rgba(0, 0, 0, 0.6)");
     style->setProperty(CSSPropertyWebkitBorderRadius, String::number(borderRadius) + "px");
+    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
 
     ExceptionCode ec = 0;
     container->appendChild(outline.get(), ec);
@@ -185,15 +233,12 @@ void DeleteButtonController::createDeletionUI()
 
     style = button->getInlineStyleDecl();
     style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyCursor, CSSValueDefault);
-    style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserModify, CSSValueNone);
     style->setProperty(CSSPropertyZIndex, String::number(1000000));
-    style->setProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderer()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
-    style->setProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderer()->borderLeft() - (borderWidth / 2)) + "px");
+    style->setProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderBox()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
+    style->setProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderBox()->borderLeft() - (borderWidth / 2)) + "px");
     style->setProperty(CSSPropertyWidth, String::number(buttonWidth) + "px");
     style->setProperty(CSSPropertyHeight, String::number(buttonHeight) + "px");
+    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
 
     RefPtr<Image> buttonImage = Image::loadPlatformResource("deleteButton");
     if (buttonImage->isNull())
@@ -278,8 +323,13 @@ void DeleteButtonController::enable()
     ASSERT(m_disableStack > 0);
     if (m_disableStack > 0)
         m_disableStack--;
-    if (enabled())
+    if (enabled()) {
+        // Determining if the element is deletable currently depends on style
+        // because whether something is editable depends on style, so we need
+        // to recalculate style before calling enclosingDeletableElement.
+        m_frame->document()->updateStyleIfNeeded();
         show(enclosingDeletableElement(m_frame->selection()->selection()));
+    }
 }
 
 void DeleteButtonController::disable()
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
index ab2d0b0704..713ae8bccb 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
@@ -34,7 +34,7 @@ class DeleteButton;
 class Frame;
 class HTMLElement;
 class RenderObject;
-class Selection;
+class VisibleSelection;
 
 class DeleteButtonController {
 public:
@@ -45,7 +45,7 @@ public:
     HTMLElement* target() const { return m_target.get(); }
     HTMLElement* containerElement() const { return m_containerElement.get(); }
 
-    void respondToChangedSelection(const Selection& oldSelection);
+    void respondToChangedSelection(const VisibleSelection& oldSelection);
 
     void show(HTMLElement*);
     void hide();
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
index 738ce64b63..5a0d8fcd6f 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DeleteSelectionCommand.h"
 
+#include "CSSMutableStyleDeclaration.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "Editor.h"
@@ -38,6 +39,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "markup.h"
+#include "RenderTableCell.h"
 #include "ReplaceSelectionCommand.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -55,9 +57,7 @@ static bool isTableRow(const Node* node)
 static bool isTableCellEmpty(Node* cell)
 {
     ASSERT(isTableCell(cell));
-    VisiblePosition firstInCell(Position(cell, 0));
-    VisiblePosition lastInCell(Position(cell, maxDeepOffset(cell)));
-    return firstInCell == lastInCell;
+    return VisiblePosition(firstDeepEditingPositionForNode(cell)) == VisiblePosition(lastDeepEditingPositionForNode(cell));
 }
 
 static bool isTableRowEmpty(Node* row)
@@ -80,6 +80,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(Document *document, bool smartDel
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
+      m_startsAtEmptyLine(false),
       m_startBlock(0),
       m_endBlock(0),
       m_typingStyle(0),
@@ -87,7 +88,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(Document *document, bool smartDel
 {
 }
 
-DeleteSelectionCommand::DeleteSelectionCommand(const Selection& selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
+DeleteSelectionCommand::DeleteSelectionCommand(const VisibleSelection& selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
     : CompositeEditCommand(selection.start().node()->document()), 
       m_hasSelectionToDelete(true), 
       m_smartDelete(smartDelete), 
@@ -95,6 +96,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(const Selection& selection, bool
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
+      m_startsAtEmptyLine(false),
       m_selectionToDelete(selection),
       m_startBlock(0),
       m_endBlock(0),
@@ -136,11 +138,12 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
             break;
         
         // If we're going to expand to include the startSpecialContainer, it must be fully selected.
-        if (startSpecialContainer && !endSpecialContainer && Range::compareBoundaryPoints(positionAfterNode(startSpecialContainer), end) > -1)
+
+        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionAfterNode(startSpecialContainer), end) > -1)
             break;
 
-        // If we're going to expand to include the endSpecialContainer, it must be fully selected.         
-        if (endSpecialContainer && !startSpecialContainer && Range::compareBoundaryPoints(start, positionBeforeNode(endSpecialContainer)) > -1)
+        // If we're going to expand to include the endSpecialContainer, it must be fully selected.
+        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionBeforeNode(endSpecialContainer)) > -1)
             break;
         
         if (startSpecialContainer && startSpecialContainer->isDescendantOf(endSpecialContainer))
@@ -196,7 +199,11 @@ void DeleteSelectionCommand::initializePositionData()
     // selections that contain a whole number paragraphs plus a line break, since it is unclear to most users 
     // that such a selection actually ends at the start of the next paragraph. This matches TextEdit behavior 
     // for indented paragraphs.
-    if (numEnclosingMailBlockquotes(start) != numEnclosingMailBlockquotes(end) && isStartOfParagraph(visibleEnd) && isStartOfParagraph(VisiblePosition(start))) {
+    // Only apply this rule if the endingSelection is a range selection.  If it is a caret, then other operations have created
+    // the selection we're deleting (like the process of creating a selection to delete during a backspace), and the user isn't in the situation described above.
+    if (numEnclosingMailBlockquotes(start) != numEnclosingMailBlockquotes(end) 
+            && isStartOfParagraph(visibleEnd) && isStartOfParagraph(VisiblePosition(start)) 
+            && endingSelection().isRange()) {
         m_mergeBlocksAfterDelete = false;
         m_pruneStartBlockIfNecessary = true;
     }
@@ -300,7 +307,7 @@ bool DeleteSelectionCommand::handleSpecialCaseBRDelete()
     // Not a special-case delete per se, but we can detect that the merging of content between blocks
     // should not be done.
     if (upstreamStartIsBR && downstreamStartIsBR) {
-        m_mergeBlocksAfterDelete = false;
+        m_startsAtEmptyLine = true;
         m_endingPosition = m_downstreamEnd;
     }
     
@@ -311,8 +318,8 @@ static void updatePositionForNodeRemoval(Node* node, Position& position)
 {
     if (position.isNull())
         return;
-    if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.offset())
-        position = Position(position.node(), position.offset() - 1);
+    if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.deprecatedEditingOffset())
+        position = Position(position.node(), position.deprecatedEditingOffset() - 1);
     if (position.node() == node || position.node()->isDescendantOf(node))
         position = positionBeforeNode(node);
 }
@@ -357,14 +364,14 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         // make sure empty cell has some height
         updateLayout();
         RenderObject *r = node->renderer();
-        if (r && r->isTableCell() && r->contentHeight() <= 0)
+        if (r && r->isTableCell() && static_cast<RenderTableCell*>(r)->contentHeight() <= 0)
             insertBlockPlaceholder(Position(node,0));
         return;
     }
     
-    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(m_startBlock.get(), 0, DOWNSTREAM).previous()))
+    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(firstDeepEditingPositionForNode(m_startBlock.get())).previous()))
         m_needPlaceholder = true;
-    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(m_endBlock.get(), maxDeepOffset(m_endBlock.get()), DOWNSTREAM).next()))
+    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(lastDeepEditingPositionForNode(m_startBlock.get())).next()))
         m_needPlaceholder = true;
     
     // FIXME: Update the endpoints of the range being deleted.
@@ -375,13 +382,12 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
     CompositeEditCommand::removeNode(node);
 }
 
-
-void updatePositionForTextRemoval(Node* node, int offset, int count, Position& position)
+static void updatePositionForTextRemoval(Node* node, int offset, int count, Position& position)
 {
     if (position.node() == node) {
-        if (position.offset() > offset + count)
-            position = Position(position.node(), position.offset() - count);
-        else if (position.offset() > offset)
+        if (position.deprecatedEditingOffset() > offset + count)
+            position = Position(position.node(), position.deprecatedEditingOffset() - count);
+        else if (position.deprecatedEditingOffset() > offset)
             position = Position(position.node(), offset);
     }
 }
@@ -392,13 +398,14 @@ void DeleteSelectionCommand::deleteTextFromNode(PassRefPtr<Text> node, unsigned
     updatePositionForTextRemoval(node.get(), offset, count, m_endingPosition);
     updatePositionForTextRemoval(node.get(), offset, count, m_leadingWhitespace);
     updatePositionForTextRemoval(node.get(), offset, count, m_trailingWhitespace);
+    updatePositionForTextRemoval(node.get(), offset, count, m_downstreamEnd);
     
     CompositeEditCommand::deleteTextFromNode(node, offset, count);
 }
 
 void DeleteSelectionCommand::handleGeneralDelete()
 {
-    int startOffset = m_upstreamStart.offset();
+    int startOffset = m_upstreamStart.deprecatedEditingOffset();
     Node* startNode = m_upstreamStart.node();
     
     // Never remove the start block unless it's a table, in which case we won't merge content in.
@@ -413,7 +420,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
             deleteTextFromNode(text, caretMaxOffset(startNode), text->length() - caretMaxOffset(startNode));
     }
 
-    if (startOffset >= maxDeepOffset(startNode)) {
+    if (startOffset >= lastOffsetForEditing(startNode)) {
         startNode = startNode->traverseNextSibling();
         startOffset = 0;
     }
@@ -424,17 +431,16 @@ void DeleteSelectionCommand::handleGeneralDelete()
 
     if (startNode == m_downstreamEnd.node()) {
         // The selection to delete is all in one node.
-        if (!startNode->renderer() || 
-            (startOffset == 0 && m_downstreamEnd.offset() >= maxDeepOffset(startNode))) {
+        if (!startNode->renderer() || (startOffset == 0 && m_downstreamEnd.atLastEditingPositionForNode())) {
             // just delete
             removeNode(startNode);
-        } else if (m_downstreamEnd.offset() - startOffset > 0) {
+        } else if (m_downstreamEnd.deprecatedEditingOffset() - startOffset > 0) {
             if (startNode->isTextNode()) {
                 // in a text node that needs to be trimmed
-                Text *text = static_cast<Text *>(startNode);
-                deleteTextFromNode(text, startOffset, m_downstreamEnd.offset() - startOffset);
+                Text* text = static_cast<Text*>(startNode);
+                deleteTextFromNode(text, startOffset, m_downstreamEnd.deprecatedEditingOffset() - startOffset);
             } else {
-                removeChildrenInRange(startNode, startOffset, m_downstreamEnd.offset());
+                removeChildrenInRange(startNode, startOffset, m_downstreamEnd.deprecatedEditingOffset());
                 m_endingPosition = m_upstreamStart;
             }
         }
@@ -457,7 +463,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
         
         // handle deleting all nodes that are completely selected
         while (node && node != m_downstreamEnd.node()) {
-            if (Range::compareBoundaryPoints(Position(node.get(), 0), m_downstreamEnd) >= 0) {
+            if (comparePositions(Position(node.get(), 0), m_downstreamEnd) >= 0) {
                 // traverseNextSibling just blew past the end position, so stop deleting
                 node = 0;
             } else if (!m_downstreamEnd.node()->isDescendantOf(node.get())) {
@@ -465,14 +471,14 @@ void DeleteSelectionCommand::handleGeneralDelete()
                 // if we just removed a node from the end container, update end position so the
                 // check above will work
                 if (node->parentNode() == m_downstreamEnd.node()) {
-                    ASSERT(node->nodeIndex() < (unsigned)m_downstreamEnd.offset());
-                    m_downstreamEnd = Position(m_downstreamEnd.node(), m_downstreamEnd.offset() - 1);
+                    ASSERT(node->nodeIndex() < (unsigned)m_downstreamEnd.deprecatedEditingOffset());
+                    m_downstreamEnd = Position(m_downstreamEnd.node(), m_downstreamEnd.deprecatedEditingOffset() - 1);
                 }
                 removeNode(node.get());
                 node = nextNode.get();
             } else {
                 Node* n = node->lastDescendant();
-                if (m_downstreamEnd.node() == n && m_downstreamEnd.offset() >= caretMaxOffset(n)) {
+                if (m_downstreamEnd.node() == n && m_downstreamEnd.deprecatedEditingOffset() >= caretMaxOffset(n)) {
                     removeNode(node.get());
                     node = 0;
                 } else
@@ -480,17 +486,16 @@ void DeleteSelectionCommand::handleGeneralDelete()
             }
         }
         
-        if (m_downstreamEnd.node() != startNode && !m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node()) && m_downstreamEnd.node()->inDocument() && m_downstreamEnd.offset() >= caretMinOffset(m_downstreamEnd.node())) {
-            if (m_downstreamEnd.offset() >= maxDeepOffset(m_downstreamEnd.node()) && !canHaveChildrenForEditing(m_downstreamEnd.node())) {
+        if (m_downstreamEnd.node() != startNode && !m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node()) && m_downstreamEnd.node()->inDocument() && m_downstreamEnd.deprecatedEditingOffset() >= caretMinOffset(m_downstreamEnd.node())) {
+            if (m_downstreamEnd.atLastEditingPositionForNode() && !canHaveChildrenForEditing(m_downstreamEnd.node())) {
                 // The node itself is fully selected, not just its contents.  Delete it.
                 removeNode(m_downstreamEnd.node());
             } else {
                 if (m_downstreamEnd.node()->isTextNode()) {
                     // in a text node that needs to be trimmed
                     Text *text = static_cast<Text *>(m_downstreamEnd.node());
-                    if (m_downstreamEnd.offset() > 0) {
-                        deleteTextFromNode(text, 0, m_downstreamEnd.offset());
-                        m_downstreamEnd = Position(text, 0);
+                    if (m_downstreamEnd.deprecatedEditingOffset() > 0) {
+                        deleteTextFromNode(text, 0, m_downstreamEnd.deprecatedEditingOffset());
                     }
                 // Remove children of m_downstreamEnd.node() that come after m_upstreamStart.
                 // Don't try to remove children if m_upstreamStart was inside m_downstreamEnd.node()
@@ -507,7 +512,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
                         if (n)
                             offset = n->nodeIndex() + 1;
                     }
-                    removeChildrenInRange(m_downstreamEnd.node(), offset, m_downstreamEnd.offset());
+                    removeChildrenInRange(m_downstreamEnd.node(), offset, m_downstreamEnd.deprecatedEditingOffset());
                     m_downstreamEnd = Position(m_downstreamEnd.node(), offset);
                 }
             }
@@ -522,12 +527,12 @@ void DeleteSelectionCommand::fixupWhitespace()
     if (m_leadingWhitespace.isNotNull() && !m_leadingWhitespace.isRenderedCharacter()) {
         Text* textNode = static_cast<Text*>(m_leadingWhitespace.node());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, m_leadingWhitespace.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, m_leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     if (m_trailingWhitespace.isNotNull() && !m_trailingWhitespace.isRenderedCharacter()) {
         Text* textNode = static_cast<Text*>(m_trailingWhitespace.node());
         ASSERT(!textNode->renderer() ||textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, m_trailingWhitespace.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, m_trailingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
 }
 
@@ -540,7 +545,7 @@ void DeleteSelectionCommand::mergeParagraphs()
             // Make sure that the ending position isn't inside the block we're about to prune.
             m_endingPosition = m_downstreamEnd;
             // We aren't going to merge into the start block, so remove it if it's empty.
-            prune(m_upstreamStart.node());
+            prune(m_startBlock);
             // Removing the start block during a deletion is usually an indication that we need
             // a placeholder, but not in this case.
             m_needPlaceholder = false;
@@ -556,12 +561,11 @@ void DeleteSelectionCommand::mergeParagraphs()
          return;
          
     // FIXME: The deletion algorithm shouldn't let this happen.
-    if (Range::compareBoundaryPoints(m_upstreamStart, m_downstreamEnd) > 0)
+    if (comparePositions(m_upstreamStart, m_downstreamEnd) > 0)
         return;
         
-    // FIXME: Merging will always be unnecessary in this case, but we really bail here because this is a case where
-    // deletion commonly fails to adjust its endpoints, which would cause the visible position comparison below to false negative.
-    if (m_endBlock == m_startBlock)
+    // There's nothing to merge.
+    if (m_upstreamStart == m_downstreamEnd)
         return;
         
     VisiblePosition startOfParagraphToMove(m_downstreamEnd);
@@ -576,7 +580,7 @@ void DeleteSelectionCommand::mergeParagraphs()
     }
     
     // We need to merge into m_upstreamStart's block, but it's been emptied out and collapsed by deletion.
-    if (!mergeDestination.deepEquivalent().node() || !mergeDestination.deepEquivalent().node()->isDescendantOf(m_upstreamStart.node()->enclosingBlockFlowElement())) {
+    if (!mergeDestination.deepEquivalent().node() || !mergeDestination.deepEquivalent().node()->isDescendantOf(m_upstreamStart.node()->enclosingBlockFlowElement()) || m_startsAtEmptyLine) {
         insertNodeAt(createBreakElement(document()).get(), m_upstreamStart);
         mergeDestination = VisiblePosition(m_upstreamStart);
     }
@@ -591,8 +595,7 @@ void DeleteSelectionCommand::mergeParagraphs()
     
     // The rule for merging into an empty block is: only do so if its farther to the right.
     // FIXME: Consider RTL.
-    // FIXME: handleSpecialCaseBRDelete prevents us from getting here in a case like <ul><li>foo<br><br></li></ul>^foo
-    if (isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
+    if (!m_startsAtEmptyLine && isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
         ASSERT(mergeDestination.deepEquivalent().downstream().node()->hasTagName(brTag));
         removeNodeAndPruneAncestors(mergeDestination.deepEquivalent().downstream().node());
         m_endingPosition = startOfParagraphToMove.deepEquivalent();
@@ -674,7 +677,7 @@ void DeleteSelectionCommand::calculateTypingStyleAfterDelete()
     if (m_typingStyle && 
         isStartOfParagraph(visibleEnd) &&
         isEndOfParagraph(visibleEnd) &&
-        lineBreakExistsAtPosition(visibleEnd)) {
+        lineBreakExistsAtVisiblePosition(visibleEnd)) {
         // Apply style to the placeholder that is now holding open the empty paragraph. 
         // This makes sure that the paragraph has the right height, and that the paragraph 
         // takes on the right style and retains it even if you move the selection away and
@@ -696,7 +699,7 @@ void DeleteSelectionCommand::calculateTypingStyleAfterDelete()
 
 void DeleteSelectionCommand::clearTransientState()
 {
-    m_selectionToDelete = Selection();
+    m_selectionToDelete = VisibleSelection();
     m_upstreamStart.clear();
     m_downstreamStart.clear();
     m_upstreamEnd.clear();
@@ -732,7 +735,7 @@ void DeleteSelectionCommand::doApply()
     Position downstreamEnd = m_selectionToDelete.end().downstream();
     m_needPlaceholder = isStartOfParagraph(m_selectionToDelete.visibleStart()) &&
                         isEndOfParagraph(m_selectionToDelete.visibleEnd()) &&
-                        !lineBreakExistsAtPosition(m_selectionToDelete.visibleEnd());
+                        !lineBreakExistsAtVisiblePosition(m_selectionToDelete.visibleEnd());
     if (m_needPlaceholder) {
         // Don't need a placeholder when deleting a selection that starts just before a table
         // and ends inside it (we do need placeholders to hold open empty cells, but that's
@@ -755,7 +758,7 @@ void DeleteSelectionCommand::doApply()
     // want to replace it with a placeholder BR!
     if (handleSpecialCaseBRDelete()) {
         calculateTypingStyleAfterDelete();
-        setEndingSelection(Selection(m_endingPosition, affinity));
+        setEndingSelection(VisibleSelection(m_endingPosition, affinity));
         clearTransientState();
         rebalanceWhitespace();
         return;
@@ -778,7 +781,7 @@ void DeleteSelectionCommand::doApply()
 
     calculateTypingStyleAfterDelete();
     
-    setEndingSelection(Selection(m_endingPosition, affinity));
+    setEndingSelection(VisibleSelection(m_endingPosition, affinity));
     clearTransientState();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
index 0f9f2f77f0..c8872efd44 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
@@ -36,14 +36,14 @@ public:
     {
         return adoptRef(new DeleteSelectionCommand(document, smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
     }
-    static PassRefPtr<DeleteSelectionCommand> create(const Selection& selection, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = false)
+    static PassRefPtr<DeleteSelectionCommand> create(const VisibleSelection& selection, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = false)
     {
         return adoptRef(new DeleteSelectionCommand(selection, smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
     }
 
 private:
     DeleteSelectionCommand(Document*, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements);
-    DeleteSelectionCommand(const Selection&, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements);
+    DeleteSelectionCommand(const VisibleSelection&, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements);
 
     virtual void doApply();
     virtual EditAction editingAction() const;
@@ -72,9 +72,10 @@ private:
     bool m_replace;
     bool m_expandForSpecialElements;
     bool m_pruneStartBlockIfNecessary;
+    bool m_startsAtEmptyLine;
 
     // This data is transient and should be cleared at the end of the doApply function.
-    Selection m_selectionToDelete;
+    VisibleSelection m_selectionToDelete;
     Position m_upstreamStart;
     Position m_downstreamStart;
     Position m_upstreamEnd;
@@ -90,6 +91,7 @@ private:
     RefPtr<Node> m_endRoot;
     RefPtr<Node> m_startTableRow;
     RefPtr<Node> m_endTableRow;
+    RefPtr<Node> m_temporaryPlaceholder;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
index 7ec0c192a7..fefe658da4 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
@@ -47,8 +47,7 @@ EditCommand::EditCommand(Document* document)
 {
     ASSERT(m_document);
     ASSERT(m_document->frame());
-    DeleteButtonController* deleteButton = m_document->frame()->editor()->deleteButtonController();
-    setStartingSelection(avoidIntersectionWithNode(m_document->frame()->selection()->selection(), deleteButton ? deleteButton->containerElement() : 0));
+    setStartingSelection(avoidIntersectionWithNode(m_document->frame()->selection()->selection(), m_document->frame()->editor()->deleteButtonController()->containerElement()));
     setEndingSelection(m_startingSelection);
 }
 
@@ -94,7 +93,10 @@ void EditCommand::apply()
 
     if (!m_parent) {
         updateLayout();
-        frame->editor()->appliedEditing(this);
+        // Only need to call appliedEditing for top-level commands, and TypingCommands do it on their
+        // own (see TypingCommand::typingAddedToOpenCommand).
+        if (!isTypingCommand())
+            frame->editor()->appliedEditing(this);
     }
 }
 
@@ -158,7 +160,7 @@ EditAction EditCommand::editingAction() const
     return EditActionUnspecified;
 }
 
-void EditCommand::setStartingSelection(const Selection& s)
+void EditCommand::setStartingSelection(const VisibleSelection& s)
 {
     Element* root = s.rootEditableElement();
     for (EditCommand* cmd = this; ; cmd = cmd->m_parent) {
@@ -169,7 +171,7 @@ void EditCommand::setStartingSelection(const Selection& s)
     }
 }
 
-void EditCommand::setEndingSelection(const Selection &s)
+void EditCommand::setEndingSelection(const VisibleSelection &s)
 {
     Element* root = s.rootEditableElement();
     for (EditCommand* cmd = this; cmd; cmd = cmd->m_parent) {
diff --git a/src/3rdparty/webkit/WebCore/editing/EditCommand.h b/src/3rdparty/webkit/WebCore/editing/EditCommand.h
index 78490f8a4c..c4969f6011 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/EditCommand.h
@@ -28,7 +28,7 @@
 
 #include "EditAction.h"
 #include "Element.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 
 namespace WebCore {
 
@@ -47,8 +47,8 @@ public:
 
     virtual EditAction editingAction() const;
 
-    const Selection& startingSelection() const { return m_startingSelection; }
-    const Selection& endingSelection() const { return m_endingSelection; }
+    const VisibleSelection& startingSelection() const { return m_startingSelection; }
+    const VisibleSelection& endingSelection() const { return m_endingSelection; }
 
     Element* startingRootEditableElement() const { return m_startingRootEditableElement.get(); }
     Element* endingRootEditableElement() const { return m_endingRootEditableElement.get(); }
@@ -63,8 +63,8 @@ protected:
 
     Document* document() const { return m_document.get(); }
 
-    void setStartingSelection(const Selection&);
-    void setEndingSelection(const Selection&);
+    void setStartingSelection(const VisibleSelection&);
+    void setEndingSelection(const VisibleSelection&);
 
     PassRefPtr<CSSMutableStyleDeclaration> styleAtPosition(const Position&);
     void updateLayout() const;
@@ -75,8 +75,8 @@ private:
     virtual void doReapply(); // calls doApply()
 
     RefPtr<Document> m_document;
-    Selection m_startingSelection;
-    Selection m_endingSelection;
+    VisibleSelection m_startingSelection;
+    VisibleSelection m_endingSelection;
     RefPtr<Element> m_startingRootEditableElement;
     RefPtr<Element> m_endingRootEditableElement;
     CompositeEditCommand* m_parent;
diff --git a/src/3rdparty/webkit/WebCore/editing/Editor.cpp b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
index ce0bcd2c8b..2c303f9c21 100644
--- a/src/3rdparty/webkit/WebCore/editing/Editor.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
@@ -29,7 +29,10 @@
 
 #include "AXObjectCache.h"
 #include "ApplyStyleCommand.h"
+#include "CharacterNames.h"
+#include "CreateLinkCommand.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -65,6 +68,7 @@
 #include "htmlediting.h"
 #include "markup.h"
 #include "visible_units.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -73,9 +77,9 @@ using namespace HTMLNames;
 
 // When an event handler has moved the selection outside of a text control
 // we should use the target control's selection for this editing operation.
-Selection Editor::selectionForCommand(Event* event)
+VisibleSelection Editor::selectionForCommand(Event* event)
 {
-    Selection selection = m_frame->selection()->selection();
+    VisibleSelection selection = m_frame->selection()->selection();
     if (!event)
         return selection;
     // If the target is a text control, and the current selection is outside of its shadow tree,
@@ -221,7 +225,7 @@ bool Editor::isSelectTrailingWhitespaceEnabled()
 
 bool Editor::deleteWithDirection(SelectionController::EDirection direction, TextGranularity granularity, bool killRing, bool isTypingAction)
 {
-    if (!canEdit() || !m_frame->document())
+    if (!canEdit())
         return false;
 
     if (m_frame->selection()->isRange()) {
@@ -316,7 +320,7 @@ PassRefPtr<Range> Editor::selectedRange()
 {
     if (!m_frame)
         return 0;
-    return m_frame->selection()->toRange();
+    return m_frame->selection()->toNormalizedRange();
 }
 
 bool Editor::shouldDeleteRange(Range* range) const
@@ -375,19 +379,19 @@ bool Editor::shouldShowDeleteInterface(HTMLElement* element) const
     return client() && client()->shouldShowDeleteInterface(element);
 }
 
-void Editor::respondToChangedSelection(const Selection& oldSelection)
+void Editor::respondToChangedSelection(const VisibleSelection& oldSelection)
 {
     if (client())
         client()->respondToChangedSelection();
     m_deleteButtonController->respondToChangedSelection(oldSelection);
 }
 
-void Editor::respondToChangedContents(const Selection& endingSelection)
+void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
 {
     if (AXObjectCache::accessibilityEnabled()) {
         Node* node = endingSelection.start().node();
         if (node)
-            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged");
+            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged", false);
     }
     
     if (client())
@@ -418,7 +422,7 @@ const SimpleFontData* Editor::fontForSelection(bool& hasMultipleFonts) const
 
     const SimpleFontData* font = 0;
 
-    RefPtr<Range> range = m_frame->selection()->toRange();
+    RefPtr<Range> range = m_frame->selection()->toNormalizedRange();
     Node* startNode = range->editingStartPosition().node();
     if (startNode) {
         Node* pastEnd = range->pastLastNode();
@@ -571,7 +575,7 @@ bool Editor::hasBidiSelection() const
     if (style->direction() == RTL)
         return true;
 
-    return static_cast<RenderBlock*>(renderer)->containsNonZeroBidiLevel();
+    return toRenderBlock(renderer)->containsNonZeroBidiLevel();
 }
 
 TriState Editor::selectionUnorderedListState() const
@@ -688,7 +692,7 @@ void Editor::clearLastEditCommand()
 bool Editor::dispatchCPPEvent(const AtomicString &eventType, ClipboardAccessPolicy policy)
 {
     Node* target = m_frame->selection()->start().element();
-    if (!target && m_frame->document())
+    if (!target)
         target = m_frame->document()->body();
     if (!target)
         return true;
@@ -698,7 +702,7 @@ bool Editor::dispatchCPPEvent(const AtomicString &eventType, ClipboardAccessPoli
 
     ExceptionCode ec = 0;
     RefPtr<Event> evt = ClipboardEvent::create(eventType, true, true, clipboard);
-    EventTargetNodeCast(target)->dispatchEvent(evt, ec);
+    target->dispatchEvent(evt, ec);
     bool noDefaultProcessing = evt->defaultPrevented();
 
     // invalidate clipboard here for security
@@ -709,15 +713,15 @@ bool Editor::dispatchCPPEvent(const AtomicString &eventType, ClipboardAccessPoli
 
 void Editor::applyStyle(CSSStyleDeclaration* style, EditAction editingAction)
 {
-    switch (m_frame->selection()->state()) {
-        case Selection::NONE:
+    switch (m_frame->selection()->selectionType()) {
+        case VisibleSelection::NoSelection:
             // do nothing
             break;
-        case Selection::CARET:
+        case VisibleSelection::CaretSelection:
             m_frame->computeAndSetTypingStyle(style, editingAction);
             break;
-        case Selection::RANGE:
-            if (m_frame->document() && style)
+        case VisibleSelection::RangeSelection:
+            if (style)
                 applyCommand(ApplyStyleCommand::create(m_frame->document(), style, editingAction));
             break;
     }
@@ -730,13 +734,13 @@ bool Editor::shouldApplyStyle(CSSStyleDeclaration* style, Range* range)
     
 void Editor::applyParagraphStyle(CSSStyleDeclaration* style, EditAction editingAction)
 {
-    switch (m_frame->selection()->state()) {
-        case Selection::NONE:
+    switch (m_frame->selection()->selectionType()) {
+        case VisibleSelection::NoSelection:
             // do nothing
             break;
-        case Selection::CARET:
-        case Selection::RANGE:
-            if (m_frame->document() && style)
+        case VisibleSelection::CaretSelection:
+        case VisibleSelection::RangeSelection:
+            if (style)
                 applyCommand(ApplyStyleCommand::create(m_frame->document(), style, editingAction, ApplyStyleCommand::ForceBlockProperties));
             break;
     }
@@ -747,7 +751,7 @@ void Editor::applyStyleToSelection(CSSStyleDeclaration* style, EditAction editin
     if (!style || style->length() == 0 || !canEditRichly())
         return;
 
-    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toRange().get()))
+    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
         applyStyle(style, editingAction);
 }
 
@@ -756,7 +760,7 @@ void Editor::applyParagraphStyleToSelection(CSSStyleDeclaration* style, EditActi
     if (!style || style->length() == 0 || !canEditRichly())
         return;
     
-    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toRange().get()))
+    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
         applyParagraphStyle(style, editingAction);
 }
 
@@ -869,14 +873,9 @@ void Editor::appliedEditing(PassRefPtr<EditCommand> cmd)
 {
     dispatchEditableContentChangedEvents(*cmd);
     
-    Selection newSelection(cmd->endingSelection());
-    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
-    // because there is work that it must do in this situation.
-    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
-    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
+    VisibleSelection newSelection(cmd->endingSelection());
     // Don't clear the typing style with this selection change.  We do those things elsewhere if necessary.
-    if (newSelection == m_frame->selection()->selection() || m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, false, false);
+    changeSelectionAfterCommand(newSelection, false, false, cmd.get());
         
     if (!cmd->preservesTypingStyle())
         m_frame->setTypingStyle(0);
@@ -898,13 +897,8 @@ void Editor::unappliedEditing(PassRefPtr<EditCommand> cmd)
 {
     dispatchEditableContentChangedEvents(*cmd);
     
-    Selection newSelection(cmd->startingSelection());
-    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
-    // because there is work that it must do in this situation.
-    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
-    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
-    if (newSelection == m_frame->selection()->selection() || m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, true);
+    VisibleSelection newSelection(cmd->startingSelection());
+    changeSelectionAfterCommand(newSelection, true, true, cmd.get());
     
     m_lastEditCommand = 0;
     if (client())
@@ -916,13 +910,8 @@ void Editor::reappliedEditing(PassRefPtr<EditCommand> cmd)
 {
     dispatchEditableContentChangedEvents(*cmd);
     
-    Selection newSelection(cmd->endingSelection());
-    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
-    // because there is work that it must do in this situation.
-    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
-    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
-    if (newSelection == m_frame->selection()->selection() || m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, true);
+    VisibleSelection newSelection(cmd->endingSelection());
+    changeSelectionAfterCommand(newSelection, true, true, cmd.get());
     
     m_lastEditCommand = 0;
     if (client())
@@ -935,6 +924,8 @@ Editor::Editor(Frame* frame)
     , m_deleteButtonController(new DeleteButtonController(frame))
     , m_ignoreCompositionSelectionChange(false)
     , m_shouldStartNewKillRingSequence(false)
+    // This is off by default, since most editors want this behavior (this matches IE but not FF).
+    , m_shouldStyleWithCSS(false)
 { 
 }
 
@@ -946,6 +937,7 @@ void Editor::clear()
 {
     m_compositionNode = 0;
     m_customCompositionUnderlines.clear();
+    m_shouldStyleWithCSS = false;
 }
 
 bool Editor::insertText(const String& text, Event* triggeringEvent)
@@ -958,10 +950,10 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
     if (text.isEmpty())
         return false;
 
-    Selection selection = selectionForCommand(triggeringEvent);
+    VisibleSelection selection = selectionForCommand(triggeringEvent);
     if (!selection.isContentEditable())
         return false;
-    RefPtr<Range> range = selection.toRange();
+    RefPtr<Range> range = selection.toNormalizedRange();
 
     if (!shouldInsertText(text, range.get(), EditorInsertActionTyped))
         return true;
@@ -980,7 +972,7 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
             // Reveal the current selection 
             if (Frame* editedFrame = document->frame())
                 if (Page* page = editedFrame->page())
-                    page->focusController()->focusedOrMainFrame()->revealSelection(RenderLayer::gAlignToEdgeIfNeeded);
+                    page->focusController()->focusedOrMainFrame()->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
         }
     }
 
@@ -992,7 +984,7 @@ bool Editor::insertLineBreak()
     if (!canEdit())
         return false;
 
-    if (!shouldInsertText("\n", m_frame->selection()->toRange().get(), EditorInsertActionTyped))
+    if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
     TypingCommand::insertLineBreak(m_frame->document());
@@ -1008,7 +1000,7 @@ bool Editor::insertParagraphSeparator()
     if (!canEditRichly())
         return insertLineBreak();
 
-    if (!shouldInsertText("\n", m_frame->selection()->toRange().get(), EditorInsertActionTyped))
+    if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
     TypingCommand::insertParagraphSeparator(m_frame->document());
@@ -1133,6 +1125,110 @@ int Editor::spellCheckerDocumentTag()
     return client() ? client()->spellCheckerDocumentTag() : 0;
 }
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+void Editor::uppercaseWord()
+{
+    if (client())
+        client()->uppercaseWord();
+}
+
+void Editor::lowercaseWord()
+{
+    if (client())
+        client()->lowercaseWord();
+}
+
+void Editor::capitalizeWord()
+{
+    if (client())
+        client()->capitalizeWord();
+}
+
+void Editor::showSubstitutionsPanel()
+{
+    if (!client()) {
+        LOG_ERROR("No NSSpellChecker");
+        return;
+    }
+
+    if (client()->substitutionsPanelIsShowing()) {
+        client()->showSubstitutionsPanel(false);
+        return;
+    }
+    client()->showSubstitutionsPanel(true);
+}
+
+bool Editor::substitutionsPanelIsShowing()
+{
+    if (!client())
+        return false;
+    return client()->substitutionsPanelIsShowing();
+}
+
+void Editor::toggleSmartInsertDelete()
+{
+    if (client())
+        client()->toggleSmartInsertDelete();
+}
+
+bool Editor::isAutomaticQuoteSubstitutionEnabled()
+{
+    return client() && client()->isAutomaticQuoteSubstitutionEnabled();
+}
+
+void Editor::toggleAutomaticQuoteSubstitution()
+{
+    if (client())
+        client()->toggleAutomaticQuoteSubstitution();
+}
+
+bool Editor::isAutomaticLinkDetectionEnabled()
+{
+    return client() && client()->isAutomaticLinkDetectionEnabled();
+}
+
+void Editor::toggleAutomaticLinkDetection()
+{
+    if (client())
+        client()->toggleAutomaticLinkDetection();
+}
+
+bool Editor::isAutomaticDashSubstitutionEnabled()
+{
+    return client() && client()->isAutomaticDashSubstitutionEnabled();
+}
+
+void Editor::toggleAutomaticDashSubstitution()
+{
+    if (client())
+        client()->toggleAutomaticDashSubstitution();
+}
+
+bool Editor::isAutomaticTextReplacementEnabled()
+{
+    return client() && client()->isAutomaticTextReplacementEnabled();
+}
+
+void Editor::toggleAutomaticTextReplacement()
+{
+    if (client())
+        client()->toggleAutomaticTextReplacement();
+}
+
+bool Editor::isAutomaticSpellingCorrectionEnabled()
+{
+    return client() && client()->isAutomaticSpellingCorrectionEnabled();
+}
+
+void Editor::toggleAutomaticSpellingCorrection()
+{
+    if (client())
+        client()->toggleAutomaticSpellingCorrection();
+}
+
+#endif
+
 bool Editor::shouldEndEditing(Range* range)
 {
     return client() && client()->shouldEndEditing(range);
@@ -1203,12 +1299,12 @@ void Editor::setBaseWritingDirection(WritingDirection direction)
 {
     Node* focusedNode = frame()->document()->focusedNode();
     if (focusedNode && (focusedNode->hasTagName(textareaTag)
-                        || focusedNode->hasTagName(inputTag) && (static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::TEXT
-                                                                || static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::SEARCH))) {
+                        || (focusedNode->hasTagName(inputTag) && (static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::TEXT
+                                                                || static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::SEARCH)))) {
         if (direction == NaturalWritingDirection)
             return;
         static_cast<HTMLElement*>(focusedNode)->setAttribute(dirAttr, direction == LeftToRightWritingDirection ? "ltr" : "rtl");
-        frame()->document()->updateRendering();
+        frame()->document()->updateStyleIfNeeded();
         return;
     }
 
@@ -1225,7 +1321,7 @@ void Editor::selectComposition()
     
     // The composition can start inside a composed character sequence, so we have to override checks.
     // See <http://bugs.webkit.org/show_bug.cgi?id=15781>
-    Selection selection;
+    VisibleSelection selection;
     selection.setWithoutValidation(range->startPosition(), range->endPosition());
     m_frame->selection()->setSelection(selection, false, false);
 }
@@ -1253,7 +1349,7 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
 {
     setIgnoreCompositionSelectionChange(true);
 
-    Selection oldSelection = m_frame->selection()->selection();
+    VisibleSelection oldSelection = m_frame->selection()->selection();
 
     selectComposition();
 
@@ -1301,9 +1397,9 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         TypingCommand::insertText(m_frame->document(), text, true, true);
 
         Node* baseNode = m_frame->selection()->base().node();
-        unsigned baseOffset = m_frame->selection()->base().offset();
+        unsigned baseOffset = m_frame->selection()->base().deprecatedEditingOffset();
         Node* extentNode = m_frame->selection()->extent().node();
-        unsigned extentOffset = m_frame->selection()->extent().offset();
+        unsigned extentOffset = m_frame->selection()->extent().deprecatedEditingOffset();
 
         if (baseNode && baseNode == extentNode && baseNode->isTextNode() && baseOffset + text.length() == extentOffset) {
             m_compositionNode = static_cast<Text*>(baseNode);
@@ -1333,7 +1429,7 @@ void Editor::ignoreSpelling()
     if (!client())
         return;
         
-    RefPtr<Range> selectedRange = frame()->selection()->toRange();
+    RefPtr<Range> selectedRange = frame()->selection()->toNormalizedRange();
     if (selectedRange)
         frame()->document()->removeMarkers(selectedRange.get(), DocumentMarker::Spelling);
 
@@ -1355,7 +1451,7 @@ void Editor::learnSpelling()
     client()->learnWord(text);
 }
 
-static String findFirstMisspellingInRange(EditorClient* client, Range* searchRange, int& firstMisspellingOffset, bool markAll)
+static String findFirstMisspellingInRange(EditorClient* client, Range* searchRange, int& firstMisspellingOffset, bool markAll, RefPtr<Range>& firstMisspellingRange)
 {
     ASSERT_ARG(client, client);
     ASSERT_ARG(searchRange, searchRange);
@@ -1389,23 +1485,24 @@ static String findFirstMisspellingInRange(EditorClient* client, Range* searchRan
             
             if (misspellingLocation >= 0 && misspellingLength > 0 && misspellingLocation < len && misspellingLength <= len && misspellingLocation + misspellingLength <= len) {
                 
-                // Remember first-encountered misspelling and its offset
+                // Compute range of misspelled word
+                RefPtr<Range> misspellingRange = TextIterator::subrange(searchRange, currentChunkOffset + misspellingLocation, misspellingLength);
+
+                // Remember first-encountered misspelling and its offset.
                 if (!firstMisspelling) {
                     firstMisspellingOffset = currentChunkOffset + misspellingLocation;
                     firstMisspelling = String(chars + misspellingLocation, misspellingLength);
+                    firstMisspellingRange = misspellingRange;
                 }
-                
-                // Mark this instance if we're marking all instances. Otherwise bail out because we found the first one.
-                if (!markAll)
-                    break;
-                
-                // Compute range of misspelled word
-                RefPtr<Range> misspellingRange = TextIterator::subrange(searchRange, currentChunkOffset + misspellingLocation, misspellingLength);
-                
-                // Store marker for misspelled word
+
+                // Store marker for misspelled word.
                 ExceptionCode ec = 0;
                 misspellingRange->startContainer(ec)->document()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
                 ASSERT(ec == 0);
+
+                // Bail out if we're marking only the first misspelling, and not all instances.
+                if (!markAll)
+                    break;
             }
         }
         
@@ -1547,6 +1644,131 @@ static String findFirstBadGrammarInRange(EditorClient* client, Range* searchRang
     
 #endif /* not BUILDING_ON_TIGER */
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+static String findFirstMisspellingOrBadGrammarInRange(EditorClient* client, Range* searchRange, bool checkGrammar, bool& outIsSpelling, int& outFirstFoundOffset, GrammarDetail& outGrammarDetail)
+{
+    ASSERT_ARG(client, client);
+    ASSERT_ARG(searchRange, searchRange);
+    
+    String firstFoundItem;
+    String misspelledWord;
+    String badGrammarPhrase;
+    ExceptionCode ec = 0;
+    
+    // Initialize out parameters; these will be updated if we find something to return.
+    outIsSpelling = true;
+    outFirstFoundOffset = 0;
+    outGrammarDetail.location = -1;
+    outGrammarDetail.length = 0;
+    outGrammarDetail.guesses.clear();
+    outGrammarDetail.userDescription = "";
+    
+    // Expand the search range to encompass entire paragraphs, since text checking needs that much context.
+    // Determine the character offset from the start of the paragraph to the start of the original search range,
+    // since we will want to ignore results in this area.
+    RefPtr<Range> paragraphRange = searchRange->cloneRange(ec);
+    setStart(paragraphRange.get(), startOfParagraph(searchRange->startPosition()));
+    int totalRangeLength = TextIterator::rangeLength(paragraphRange.get());
+    setEnd(paragraphRange.get(), endOfParagraph(searchRange->startPosition()));
+    
+    RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), searchRange->startPosition());
+    int searchRangeStartOffset = TextIterator::rangeLength(offsetAsRange.get());
+    int totalLengthProcessed = 0;
+    
+    bool firstIteration = true;
+    bool lastIteration = false;
+    while (totalLengthProcessed < totalRangeLength) {
+        // Iterate through the search range by paragraphs, checking each one for spelling and grammar.
+        int currentLength = TextIterator::rangeLength(paragraphRange.get());
+        int currentStartOffset = firstIteration ? searchRangeStartOffset : 0;
+        int currentEndOffset = currentLength;
+        if (inSameParagraph(paragraphRange->startPosition(), searchRange->endPosition())) {
+            // Determine the character offset from the end of the original search range to the end of the paragraph,
+            // since we will want to ignore results in this area.
+            RefPtr<Range> endOffsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), searchRange->endPosition());
+            currentEndOffset = TextIterator::rangeLength(endOffsetAsRange.get());
+            lastIteration = true;
+        }
+        if (currentStartOffset < currentEndOffset) {
+            String paragraphString = plainText(paragraphRange.get());
+            if (paragraphString.length() > 0) {
+                bool foundGrammar = false;
+                int spellingLocation = 0;
+                int grammarPhraseLocation = 0;
+                int grammarDetailLocation = 0;
+                unsigned grammarDetailIndex = 0;
+                
+                Vector<TextCheckingResult> results;
+                uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+                client->checkTextOfParagraph(paragraphString.characters(), paragraphString.length(), checkingTypes, results);
+                
+                for (unsigned i = 0; i < results.size(); i++) {
+                    const TextCheckingResult* result = &results[i];
+                    if (result->type == TextCheckingTypeSpelling && result->location >= currentStartOffset && result->location + result->length <= currentEndOffset) {
+                        ASSERT(result->length > 0 && result->location >= 0);
+                        spellingLocation = result->location;
+                        misspelledWord = paragraphString.substring(result->location, result->length);
+                        ASSERT(misspelledWord.length() != 0);
+                        break;
+                    } else if (checkGrammar && result->type == TextCheckingTypeGrammar && result->location < currentEndOffset && result->location + result->length > currentStartOffset) {
+                        ASSERT(result->length > 0 && result->location >= 0);
+                        // We can't stop after the first grammar result, since there might still be a spelling result after
+                        // it begins but before the first detail in it, but we can stop if we find a second grammar result.
+                        if (foundGrammar) break;
+                        for (unsigned j = 0; j < result->details.size(); j++) {
+                            const GrammarDetail* detail = &result->details[j];
+                            ASSERT(detail->length > 0 && detail->location >= 0);
+                            if (result->location + detail->location >= currentStartOffset && result->location + detail->location + detail->length <= currentEndOffset && (!foundGrammar || result->location + detail->location < grammarDetailLocation)) {
+                                grammarDetailIndex = j;
+                                grammarDetailLocation = result->location + detail->location;
+                                foundGrammar = true;
+                            }
+                        }
+                        if (foundGrammar) {
+                            grammarPhraseLocation = result->location;
+                            outGrammarDetail = result->details[grammarDetailIndex];
+                            badGrammarPhrase = paragraphString.substring(result->location, result->length);
+                            ASSERT(badGrammarPhrase.length() != 0);
+                        }
+                    }
+                }
+
+                if (!misspelledWord.isEmpty() && (!checkGrammar || badGrammarPhrase.isEmpty() || spellingLocation <= grammarDetailLocation)) {
+                    int spellingOffset = spellingLocation - currentStartOffset;
+                    if (!firstIteration) {
+                        RefPtr<Range> paragraphOffsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), searchRange->startPosition(), paragraphRange->startPosition());
+                        spellingOffset += TextIterator::rangeLength(paragraphOffsetAsRange.get());
+                    }
+                    outIsSpelling = true;
+                    outFirstFoundOffset = spellingOffset;
+                    firstFoundItem = misspelledWord;
+                    break;
+                } else if (checkGrammar && !badGrammarPhrase.isEmpty()) {
+                    int grammarPhraseOffset = grammarPhraseLocation - currentStartOffset;
+                    if (!firstIteration) {
+                        RefPtr<Range> paragraphOffsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), searchRange->startPosition(), paragraphRange->startPosition());
+                        grammarPhraseOffset += TextIterator::rangeLength(paragraphOffsetAsRange.get());
+                    }
+                    outIsSpelling = false;
+                    outFirstFoundOffset = grammarPhraseOffset;
+                    firstFoundItem = badGrammarPhrase;
+                    break;
+                }
+            }
+        }
+        if (lastIteration || totalLengthProcessed + currentLength >= totalRangeLength)
+            break;
+        setStart(paragraphRange.get(), startOfNextParagraph(paragraphRange->endPosition()));
+        setEnd(paragraphRange.get(), endOfParagraph(paragraphRange->startPosition()));
+        firstIteration = false;
+        totalLengthProcessed += currentLength;
+    }
+    return firstFoundItem;
+}
+
+#endif
+
 void Editor::advanceToNextMisspelling(bool startBeforeSelection)
 {
     ExceptionCode ec = 0;
@@ -1556,7 +1778,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     
     // Start at the end of the selection, search to edge of document.  Starting at the selection end makes
     // repeated "check spelling" commands work.
-    Selection selection(frame()->selection()->selection());
+    VisibleSelection selection(frame()->selection()->selection());
     RefPtr<Range> spellingSearchRange(rangeOfContents(frame()->document()));
     bool startedWithSelection = false;
     if (selection.start().node()) {
@@ -1583,13 +1805,14 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
             return;
         
         Position rangeCompliantPosition = rangeCompliantEquivalent(position);
-        spellingSearchRange->setStart(rangeCompliantPosition.node(), rangeCompliantPosition.offset(), ec);
+        spellingSearchRange->setStart(rangeCompliantPosition.node(), rangeCompliantPosition.deprecatedEditingOffset(), ec);
         startedWithSelection = false;   // won't need to wrap
     }
     
     // topNode defines the whole range we want to operate on 
     Node* topNode = highestEditableRoot(position);
-    spellingSearchRange->setEnd(topNode, maxDeepOffset(topNode), ec);
+    // FIXME: lastOffsetForEditing() is wrong here if editingIgnoresContent(highestEditableRoot()) returns true (e.g. a <table>)
+    spellingSearchRange->setEnd(topNode, lastOffsetForEditing(topNode), ec);
 
     // If spellingSearchRange starts in the middle of a word, advance to the next word so we start checking
     // at a word boundary. Going back by one char and then forward by a word does the trick.
@@ -1613,9 +1836,26 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     Node *searchEndNodeAfterWrap = spellingSearchRange->endContainer(ec);
     int searchEndOffsetAfterWrap = spellingSearchRange->endOffset(ec);
     
-    int misspellingOffset;
-    String misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false);
-    
+    int misspellingOffset = 0;
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    RefPtr<Range> grammarSearchRange = spellingSearchRange->cloneRange(ec);
+    String misspelledWord;
+    String badGrammarPhrase;
+    int grammarPhraseOffset = 0;
+    bool isSpelling = true;
+    int foundOffset = 0;
+    GrammarDetail grammarDetail;
+    String foundItem = findFirstMisspellingOrBadGrammarInRange(client(), spellingSearchRange.get(), isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
+    if (isSpelling) {
+        misspelledWord = foundItem;
+        misspellingOffset = foundOffset;
+    } else {
+        badGrammarPhrase = foundItem;
+        grammarPhraseOffset = foundOffset;
+    }
+#else
+    RefPtr<Range> firstMisspellingRange;
+    String misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false, firstMisspellingRange);
     String badGrammarPhrase;
 
 #ifndef BUILDING_ON_TIGER
@@ -1634,6 +1874,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     if (isGrammarCheckingEnabled())
         badGrammarPhrase = findFirstBadGrammarInRange(client(), grammarSearchRange.get(), grammarDetail, grammarPhraseOffset, false);
 #endif
+#endif
     
     // If we found neither bad grammar nor a misspelled word, wrap and try again (but don't bother if we started at the beginning of the
     // block rather than at a selection).
@@ -1642,7 +1883,18 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         // going until the end of the very first chunk we tested is far enough
         spellingSearchRange->setEnd(searchEndNodeAfterWrap, searchEndOffsetAfterWrap, ec);
         
-        misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+        grammarSearchRange = spellingSearchRange->cloneRange(ec);
+        foundItem = findFirstMisspellingOrBadGrammarInRange(client(), spellingSearchRange.get(), isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
+        if (isSpelling) {
+            misspelledWord = foundItem;
+            misspellingOffset = foundOffset;
+        } else {
+            badGrammarPhrase = foundItem;
+            grammarPhraseOffset = foundOffset;
+        }
+#else
+        misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false, firstMisspellingRange);
 
 #ifndef BUILDING_ON_TIGER
         grammarSearchRange = spellingSearchRange->cloneRange(ec);
@@ -1655,6 +1907,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         if (isGrammarCheckingEnabled())
             badGrammarPhrase = findFirstBadGrammarInRange(client(), grammarSearchRange.get(), grammarDetail, grammarPhraseOffset, false);
 #endif
+#endif
     }
     
     if (!badGrammarPhrase.isEmpty()) {
@@ -1670,7 +1923,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         
         // FIXME 4859190: This gets confused with doubled punctuation at the end of a paragraph
         RefPtr<Range> badGrammarRange = TextIterator::subrange(grammarSearchRange.get(), grammarPhraseOffset + grammarDetail.location, grammarDetail.length);
-        frame()->selection()->setSelection(Selection(badGrammarRange.get(), SEL_DEFAULT_AFFINITY));
+        frame()->selection()->setSelection(VisibleSelection(badGrammarRange.get(), SEL_DEFAULT_AFFINITY));
         frame()->revealSelection();
         
         client()->updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
@@ -1681,7 +1934,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         // a marker so we draw the red squiggle later.
         
         RefPtr<Range> misspellingRange = TextIterator::subrange(spellingSearchRange.get(), misspellingOffset, misspelledWord.length());
-        frame()->selection()->setSelection(Selection(misspellingRange.get(), DOWNSTREAM));
+        frame()->selection()->setSelection(VisibleSelection(misspellingRange.get(), DOWNSTREAM));
         frame()->revealSelection();
         
         client()->updateSpellingUIWithMisspelledWord(misspelledWord);
@@ -1769,7 +2022,7 @@ bool Editor::isSelectionUngrammatical()
     return false;
 #else
     Vector<String> ignoredGuesses;
-    return isRangeUngrammatical(client(), frame()->selection()->toRange().get(), ignoredGuesses);
+    return isRangeUngrammatical(client(), frame()->selection()->toNormalizedRange().get(), ignoredGuesses);
 #endif
 }
 
@@ -1780,7 +2033,7 @@ Vector<String> Editor::guessesForUngrammaticalSelection()
 #else
     Vector<String> guesses;
     // Ignore the result of isRangeUngrammatical; we just want the guesses, whether or not there are any
-    isRangeUngrammatical(client(), frame()->selection()->toRange().get(), guesses);
+    isRangeUngrammatical(client(), frame()->selection()->toNormalizedRange().get(), guesses);
     return guesses;
 #endif
 }
@@ -1796,6 +2049,87 @@ Vector<String> Editor::guessesForMisspelledSelection()
     return guesses;
 }
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+static Vector<String> guessesForMisspelledOrUngrammaticalRange(EditorClient* client, Range *range, bool checkGrammar, bool& misspelled, bool& ungrammatical)
+{
+    Vector<String> guesses;
+    ExceptionCode ec;
+    misspelled = false;
+    ungrammatical = false;
+    
+    if (!client || !range || range->collapsed(ec))
+        return guesses;
+
+    // Expand the range to encompass entire paragraphs, since text checking needs that much context.
+    int rangeStartOffset;
+    String paragraphString;
+    RefPtr<Range> paragraphRange = paragraphAlignedRangeForRange(range, rangeStartOffset, paragraphString);
+    int rangeLength = TextIterator::rangeLength(range);
+    if (rangeLength == 0 || paragraphString.length() == 0)
+        return guesses;
+
+    Vector<TextCheckingResult> results;
+    uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+    client->checkTextOfParagraph(paragraphString.characters(), paragraphString.length(), checkingTypes, results);
+    
+    for (unsigned i = 0; i < results.size(); i++) {
+        const TextCheckingResult* result = &results[i];
+        if (result->type == TextCheckingTypeSpelling && result->location == rangeStartOffset && result->length == rangeLength) {
+            String misspelledWord = paragraphString.substring(rangeStartOffset, rangeLength);
+            ASSERT(misspelledWord.length() != 0);
+            client->getGuessesForWord(misspelledWord, guesses);
+            client->updateSpellingUIWithMisspelledWord(misspelledWord);
+            misspelled = true;
+            return guesses;
+        }
+    }
+    
+    if (!checkGrammar)
+        return guesses;
+        
+    for (unsigned i = 0; i < results.size(); i++) {
+        const TextCheckingResult* result = &results[i];
+        if (result->type == TextCheckingTypeGrammar && result->location <= rangeStartOffset && result->location + result->length >= rangeStartOffset + rangeLength) {
+            for (unsigned j = 0; j < result->details.size(); j++) {
+                const GrammarDetail* detail = &result->details[j];
+                ASSERT(detail->length > 0 && detail->location >= 0);
+                if (result->location + detail->location == rangeStartOffset && detail->length == rangeLength) {
+                    String badGrammarPhrase = paragraphString.substring(result->location, result->length);
+                    ASSERT(badGrammarPhrase.length() != 0);
+                    for (unsigned k = 0; k < detail->guesses.size(); k++)
+                        guesses.append(detail->guesses[k]);
+                    client->updateSpellingUIWithGrammarString(badGrammarPhrase, *detail);
+                    ungrammatical = true;
+                    return guesses;
+                }
+            }
+        }
+    }
+    return guesses;
+}
+
+#endif
+
+Vector<String> Editor::guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical)
+{
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    return guessesForMisspelledOrUngrammaticalRange(client(), frame()->selection()->toNormalizedRange().get(), isGrammarCheckingEnabled(), misspelled, ungrammatical);
+#else
+    misspelled = isSelectionMisspelled();
+    if (misspelled) {
+        ungrammatical = false;
+        return guessesForMisspelledSelection();
+    }
+    if (isGrammarCheckingEnabled() && isSelectionUngrammatical()) {
+        ungrammatical = true;
+        return guessesForUngrammaticalSelection();
+    }
+    ungrammatical = false;
+    return Vector<String>();
+#endif
+}
+
 void Editor::showSpellingGuessPanel()
 {
     if (!client()) {
@@ -1825,25 +2159,72 @@ bool Editor::spellingPanelIsShowing()
 
 void Editor::markMisspellingsAfterTypingToPosition(const VisiblePosition &p)
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    bool markSpelling = isContinuousSpellCheckingEnabled();
+    bool markGrammar = markSpelling && isGrammarCheckingEnabled();
+    bool performTextCheckingReplacements = isAutomaticQuoteSubstitutionEnabled() 
+                                        || isAutomaticLinkDetectionEnabled()
+                                        || isAutomaticDashSubstitutionEnabled()
+                                        || isAutomaticTextReplacementEnabled()
+                                        || (markSpelling && isAutomaticSpellingCorrectionEnabled());
+    if (!markSpelling && !performTextCheckingReplacements)
+        return;
+    
+    VisibleSelection adjacentWords = VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary));
+    if (markGrammar) {
+        VisibleSelection selectedSentence = VisibleSelection(startOfSentence(p), endOfSentence(p));
+        markAllMisspellingsAndBadGrammarInRanges(true, adjacentWords.toNormalizedRange().get(), true, selectedSentence.toNormalizedRange().get(), performTextCheckingReplacements);
+    } else {
+        markAllMisspellingsAndBadGrammarInRanges(markSpelling, adjacentWords.toNormalizedRange().get(), false, adjacentWords.toNormalizedRange().get(), performTextCheckingReplacements);
+    }
+#else
     if (!isContinuousSpellCheckingEnabled())
         return;
     
     // Check spelling of one word
-    markMisspellings(Selection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary)));
+    RefPtr<Range> misspellingRange;
+    markMisspellings(VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary)), misspellingRange);
+
+    // Autocorrect the misspelled word.
+    if (misspellingRange == 0)
+        return;
     
+    // Get the misspelled word.
+    const String misspelledWord = plainText(misspellingRange.get());
+    String autocorrectedString = client()->getAutoCorrectSuggestionForMisspelledWord(misspelledWord);
+
+    // If autocorrected word is non empty, replace the misspelled word by this word.
+    if (!autocorrectedString.isEmpty()) {
+        VisibleSelection newSelection(misspellingRange.get(), DOWNSTREAM);
+        if (newSelection != frame()->selection()->selection()) {
+            if (!frame()->shouldChangeSelection(newSelection))
+                return;
+            frame()->selection()->setSelection(newSelection);
+        }
+
+        if (!frame()->editor()->shouldInsertText(autocorrectedString, misspellingRange.get(), EditorInsertActionTyped))
+            return;
+        frame()->editor()->replaceSelectionWithText(autocorrectedString, false, true);
+
+        // Reset the charet one character further.
+        frame()->selection()->moveTo(frame()->selection()->end());
+        frame()->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+    }
+
     if (!isGrammarCheckingEnabled())
         return;
     
     // Check grammar of entire sentence
-    markBadGrammar(Selection(startOfSentence(p), endOfSentence(p)));
+    markBadGrammar(VisibleSelection(startOfSentence(p), endOfSentence(p)));
+#endif
 }
 
-static void markAllMisspellingsInRange(EditorClient* client, Range* searchRange)
+static void markAllMisspellingsInRange(EditorClient* client, Range* searchRange, RefPtr<Range>& firstMisspellingRange)
 {
     // Use the "markAll" feature of findFirstMisspellingInRange. Ignore the return value and the "out parameter";
     // all we need to do is mark every instance.
     int ignoredOffset;
-    findFirstMisspellingInRange(client, searchRange, ignoredOffset, true);
+    findFirstMisspellingInRange(client, searchRange, ignoredOffset, true, firstMisspellingRange);
 }
 
 #ifndef BUILDING_ON_TIGER
@@ -1857,7 +2238,7 @@ static void markAllBadGrammarInRange(EditorClient* client, Range* searchRange)
 }
 #endif
     
-static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& selection, bool checkSpelling)
+static void markMisspellingsOrBadGrammar(Editor* editor, const VisibleSelection& selection, bool checkSpelling, RefPtr<Range>& firstMisspellingRange)
 {
     // This function is called with a selection already expanded to word boundaries.
     // Might be nice to assert that here.
@@ -1867,7 +2248,7 @@ static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& select
     if (!editor->isContinuousSpellCheckingEnabled())
         return;
     
-    RefPtr<Range> searchRange(selection.toRange());
+    RefPtr<Range> searchRange(selection.toNormalizedRange());
     if (!searchRange)
         return;
     
@@ -1876,12 +2257,26 @@ static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& select
     if (!editableNode || !editableNode->isContentEditable())
         return;
     
+    // Ascend the DOM tree to find a "spellcheck" attribute.
+    // When we find a "spellcheck" attribute, retrieve its value and exit if its value is "false".
+    const Node* node = editor->frame()->document()->focusedNode();
+    while (node) {
+        if (node->isElementNode()) {
+            const WebCore::AtomicString& value = static_cast<const Element*>(node)->getAttribute(spellcheckAttr);
+            if (equalIgnoringCase(value, "true"))
+                break;
+            if (equalIgnoringCase(value, "false"))
+                return;
+        }
+        node = node->parent();
+    }
+
     // Get the spell checker if it is available
     if (!editor->client())
         return;
     
     if (checkSpelling)
-        markAllMisspellingsInRange(editor->client(), searchRange.get());
+        markAllMisspellingsInRange(editor->client(), searchRange.get(), firstMisspellingRange);
     else {
 #ifdef BUILDING_ON_TIGER
         ASSERT_NOT_REACHED();
@@ -1892,15 +2287,245 @@ static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& select
     }    
 }
 
-void Editor::markMisspellings(const Selection& selection)
+void Editor::markMisspellings(const VisibleSelection& selection, RefPtr<Range>& firstMisspellingRange)
 {
-    markMisspellingsOrBadGrammar(this, selection, true);
+    markMisspellingsOrBadGrammar(this, selection, true, firstMisspellingRange);
 }
     
-void Editor::markBadGrammar(const Selection& selection)
+void Editor::markBadGrammar(const VisibleSelection& selection)
 {
 #ifndef BUILDING_ON_TIGER
-    markMisspellingsOrBadGrammar(this, selection, false);
+    RefPtr<Range> firstMisspellingRange;
+    markMisspellingsOrBadGrammar(this, selection, false, firstMisspellingRange);
+#else
+    UNUSED_PARAM(selection);
+#endif
+}
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+static inline bool isAmbiguousBoundaryCharacter(UChar character)
+{
+    // These are characters that can behave as word boundaries, but can appear within words.
+    // If they are just typed, i.e. if they are immediately followed by a caret, we want to delay text checking until the next character has been typed.
+    // FIXME: this is required until 6853027 is fixed and text checking can do this for us.
+    return character == '\'' || character == rightSingleQuotationMark || character == hebrewPunctuationGershayim;
+}
+
+void Editor::markAllMisspellingsAndBadGrammarInRanges(bool markSpelling, Range* spellingRange, bool markGrammar, Range* grammarRange, bool performTextCheckingReplacements)
+{
+    // This function is called with selections already expanded to word boundaries.
+    ExceptionCode ec = 0;
+    if (!client() || !spellingRange || (markGrammar && !grammarRange))
+        return;
+    
+    // If we're not in an editable node, bail.
+    Node* editableNode = spellingRange->startContainer();
+    if (!editableNode || !editableNode->isContentEditable())
+        return;
+    
+    // Expand the range to encompass entire paragraphs, since text checking needs that much context.
+    int spellingRangeStartOffset = 0;
+    int spellingRangeEndOffset = 0;
+    int grammarRangeStartOffset = 0;
+    int grammarRangeEndOffset = 0;
+    int offsetDueToReplacement = 0;
+    int paragraphLength = 0;
+    int selectionOffset = 0;
+    int ambiguousBoundaryOffset = -1;
+    bool selectionChanged = false;
+    bool restoreSelectionAfterChange = false;
+    bool adjustSelectionForParagraphBoundaries = false;
+    String paragraphString;
+    RefPtr<Range> paragraphRange;
+    
+    if (markGrammar) {
+        // The spelling range should be contained in the paragraph-aligned extension of the grammar range.
+        paragraphRange = paragraphAlignedRangeForRange(grammarRange, grammarRangeStartOffset, paragraphString);
+        RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), spellingRange->startPosition());
+        spellingRangeStartOffset = TextIterator::rangeLength(offsetAsRange.get());
+        grammarRangeEndOffset = grammarRangeStartOffset + TextIterator::rangeLength(grammarRange);
+    } else {
+        paragraphRange = paragraphAlignedRangeForRange(spellingRange, spellingRangeStartOffset, paragraphString);
+    }
+    spellingRangeEndOffset = spellingRangeStartOffset + TextIterator::rangeLength(spellingRange);
+    paragraphLength = paragraphString.length();
+    if (paragraphLength <= 0 || (spellingRangeStartOffset >= spellingRangeEndOffset && (!markGrammar || grammarRangeStartOffset >= grammarRangeEndOffset)))
+        return;
+    
+    if (performTextCheckingReplacements) {
+        if (m_frame->selection()->selectionType() == VisibleSelection::CaretSelection) {
+            // Attempt to save the caret position so we can restore it later if needed
+            RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), paragraphRange->startPosition());
+            Position caretPosition = m_frame->selection()->end();
+            offsetAsRange->setEnd(caretPosition.containerNode(), caretPosition.computeOffsetInContainerNode(), ec);
+            if (!ec) {
+                selectionOffset = TextIterator::rangeLength(offsetAsRange.get());
+                restoreSelectionAfterChange = true;
+                if (selectionOffset > 0 && (selectionOffset > paragraphLength || paragraphString[selectionOffset - 1] == newlineCharacter))
+                    adjustSelectionForParagraphBoundaries = true;
+                if (selectionOffset > 0 && selectionOffset <= paragraphLength && isAmbiguousBoundaryCharacter(paragraphString[selectionOffset - 1]))
+                    ambiguousBoundaryOffset = selectionOffset - 1;
+            }
+        }
+    }
+    
+    Vector<TextCheckingResult> results;
+    uint64_t checkingTypes = 0;
+    if (markSpelling)
+        checkingTypes |= TextCheckingTypeSpelling;
+    if (markGrammar)
+        checkingTypes |= TextCheckingTypeGrammar;
+    if (performTextCheckingReplacements) {
+        if (isAutomaticLinkDetectionEnabled())
+            checkingTypes |= TextCheckingTypeLink;
+        if (isAutomaticQuoteSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeQuote;
+        if (isAutomaticDashSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeDash;
+        if (isAutomaticTextReplacementEnabled())
+            checkingTypes |= TextCheckingTypeReplacement;
+        if (markSpelling && isAutomaticSpellingCorrectionEnabled())
+            checkingTypes |= TextCheckingTypeCorrection;
+    }
+    client()->checkTextOfParagraph(paragraphString.characters(), paragraphLength, checkingTypes, results);
+    
+    for (unsigned i = 0; i < results.size(); i++) {
+        const TextCheckingResult* result = &results[i];
+        int resultLocation = result->location + offsetDueToReplacement;
+        int resultLength = result->length;
+        if (markSpelling && result->type == TextCheckingTypeSpelling && resultLocation >= spellingRangeStartOffset && resultLocation + resultLength <= spellingRangeEndOffset) {
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            RefPtr<Range> misspellingRange = TextIterator::subrange(spellingRange, resultLocation - spellingRangeStartOffset, resultLength);
+            misspellingRange->startContainer(ec)->document()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
+        } else if (markGrammar && result->type == TextCheckingTypeGrammar && resultLocation < grammarRangeEndOffset && resultLocation + resultLength > grammarRangeStartOffset) {
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            for (unsigned j = 0; j < result->details.size(); j++) {
+                const GrammarDetail* detail = &result->details[j];
+                ASSERT(detail->length > 0 && detail->location >= 0);
+                if (resultLocation + detail->location >= grammarRangeStartOffset && resultLocation + detail->location + detail->length <= grammarRangeEndOffset) {
+                    RefPtr<Range> badGrammarRange = TextIterator::subrange(grammarRange, resultLocation + detail->location - grammarRangeStartOffset, detail->length);
+                    grammarRange->startContainer(ec)->document()->addMarker(badGrammarRange.get(), DocumentMarker::Grammar, detail->userDescription);
+                }
+            }
+        } else if (performTextCheckingReplacements && resultLocation + resultLength <= spellingRangeEndOffset && resultLocation + resultLength >= spellingRangeStartOffset &&
+                    (result->type == TextCheckingTypeLink
+                    || result->type == TextCheckingTypeQuote
+                    || result->type == TextCheckingTypeDash
+                    || result->type == TextCheckingTypeReplacement
+                    || result->type == TextCheckingTypeCorrection)) {
+            // In this case the result range just has to touch the spelling range, so we can handle replacing non-word text such as punctuation.
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            int replacementLength = result->replacement.length();
+            bool doReplacement = (replacementLength > 0);
+            RefPtr<Range> rangeToReplace = TextIterator::subrange(paragraphRange.get(), resultLocation, resultLength);
+            VisibleSelection selectionToReplace(rangeToReplace.get(), DOWNSTREAM);
+        
+            // avoid correcting text after an ambiguous boundary character has been typed
+            // FIXME: this is required until 6853027 is fixed and text checking can do this for us
+            if (ambiguousBoundaryOffset >= 0 && resultLocation + resultLength == ambiguousBoundaryOffset)
+                doReplacement = false;
+
+            // adding links should be done only immediately after they are typed
+            if (result->type == TextCheckingTypeLink && selectionOffset > resultLocation + resultLength + 1)
+                doReplacement = false;
+
+            // Don't correct spelling in an already-corrected word.
+            if (doReplacement && result->type == TextCheckingTypeCorrection) {
+                Node* node = rangeToReplace->startContainer();
+                int startOffset = rangeToReplace->startOffset();
+                int endOffset = startOffset + replacementLength;
+                Vector<DocumentMarker> markers = node->document()->markersForNode(node);
+                size_t markerCount = markers.size();
+                for (size_t i = 0; i < markerCount; ++i) {
+                    const DocumentMarker& marker = markers[i];
+                    if (marker.type == DocumentMarker::Replacement && static_cast<int>(marker.startOffset) < endOffset && static_cast<int>(marker.endOffset) > startOffset) {
+                        doReplacement = false;
+                        break;
+                    }
+                    if (static_cast<int>(marker.startOffset) >= endOffset)
+                        break;
+                }
+            }
+            if (doReplacement && selectionToReplace != m_frame->selection()->selection()) {
+                if (m_frame->shouldChangeSelection(selectionToReplace)) {
+                    m_frame->selection()->setSelection(selectionToReplace);
+                    selectionChanged = true;
+                } else {
+                    doReplacement = false;
+                }
+            }
+            if (doReplacement) {
+                if (result->type == TextCheckingTypeLink) {
+                    restoreSelectionAfterChange = false;
+                    if (canEditRichly())
+                        applyCommand(CreateLinkCommand::create(m_frame->document(), result->replacement));
+                } else if (canEdit() && shouldInsertText(result->replacement, rangeToReplace.get(), EditorInsertActionTyped)) {
+                    String replacedString;
+                    if (result->type == TextCheckingTypeCorrection)
+                        replacedString = plainText(rangeToReplace.get());
+                    replaceSelectionWithText(result->replacement, false, false);
+                    spellingRangeEndOffset += replacementLength - resultLength;
+                    offsetDueToReplacement += replacementLength - resultLength;
+                    if (resultLocation < selectionOffset)
+                        selectionOffset += replacementLength - resultLength;
+                    if (result->type == TextCheckingTypeCorrection) {
+                        // Add a marker so that corrections can easily be undone and won't be re-corrected.
+                        RefPtr<Range> replacedRange = TextIterator::subrange(paragraphRange.get(), resultLocation, replacementLength);
+                        replacedRange->startContainer()->document()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
+                    }
+                }
+            }
+        }
+    }
+    
+    if (selectionChanged) {
+        // Restore the caret position if we have made any replacements
+        setEnd(paragraphRange.get(), endOfParagraph(startOfNextParagraph(paragraphRange->startPosition())));
+        int newLength = TextIterator::rangeLength(paragraphRange.get());
+        if (restoreSelectionAfterChange && selectionOffset >= 0 && selectionOffset <= newLength) {
+            RefPtr<Range> selectionRange = TextIterator::subrange(paragraphRange.get(), 0, selectionOffset);
+            m_frame->selection()->moveTo(selectionRange->endPosition(), DOWNSTREAM);
+            if (adjustSelectionForParagraphBoundaries)
+                m_frame->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+        } else {
+            // If this fails for any reason, the fallback is to go one position beyond the last replacement
+            m_frame->selection()->moveTo(m_frame->selection()->end());
+            m_frame->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+        }
+    }
+}
+
+void Editor::changeBackToReplacedString(const String& replacedString)
+{
+    if (replacedString.isEmpty())
+        return;
+
+    RefPtr<Range> selection = selectedRange();
+    if (!shouldInsertText(replacedString, selection.get(), EditorInsertActionPasted))
+        return;
+        
+    String paragraphString;
+    int selectionOffset;
+    RefPtr<Range> paragraphRange = paragraphAlignedRangeForRange(selection.get(), selectionOffset, paragraphString);
+    replaceSelectionWithText(replacedString, false, false);
+    RefPtr<Range> changedRange = TextIterator::subrange(paragraphRange.get(), selectionOffset, replacedString.length());
+    changedRange->startContainer()->document()->addMarker(changedRange.get(), DocumentMarker::Replacement, String());
+}
+
+#endif
+
+void Editor::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection)
+{
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    if (!isContinuousSpellCheckingEnabled())
+        return;
+    markAllMisspellingsAndBadGrammarInRanges(true, spellingSelection.toNormalizedRange().get(), markGrammar && isGrammarCheckingEnabled(), grammarSelection.toNormalizedRange().get(), false);
+#else
+    RefPtr<Range> firstMisspellingRange;
+    markMisspellings(spellingSelection, firstMisspellingRange);
+    if (markGrammar)
+        markBadGrammar(grammarSelection);
 #endif
 }
 
@@ -1916,8 +2541,8 @@ PassRefPtr<Range> Editor::rangeForPoint(const IntPoint& windowPoint)
     if (!frameView)
         return 0;
     IntPoint framePoint = frameView->windowToContents(windowPoint);
-    Selection selection(frame->visiblePositionForPoint(framePoint));
-    return avoidIntersectionWithNode(selection.toRange().get(), deleteButtonController() ? deleteButtonController()->containerElement() : 0);
+    VisibleSelection selection(frame->visiblePositionForPoint(framePoint));
+    return avoidIntersectionWithNode(selection.toNormalizedRange().get(), m_deleteButtonController->containerElement());
 }
 
 void Editor::revealSelectionAfterEditingOperation()
@@ -1925,7 +2550,7 @@ void Editor::revealSelectionAfterEditingOperation()
     if (m_ignoreCompositionSelectionChange)
         return;
 
-    m_frame->revealSelection(RenderLayer::gAlignToEdgeIfNeeded);
+    m_frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
 }
 
 void Editor::setIgnoreCompositionSelectionChange(bool ignore)
@@ -1961,13 +2586,13 @@ bool Editor::getCompositionSelection(unsigned& selectionStart, unsigned& selecti
     if (end.node() != m_compositionNode)
         return false;
 
-    if (static_cast<unsigned>(start.offset()) < m_compositionStart)
+    if (static_cast<unsigned>(start.deprecatedEditingOffset()) < m_compositionStart)
         return false;
-    if (static_cast<unsigned>(end.offset()) > m_compositionEnd)
+    if (static_cast<unsigned>(end.deprecatedEditingOffset()) > m_compositionEnd)
         return false;
 
-    selectionStart = start.offset() - m_compositionStart;
-    selectionEnd = start.offset() - m_compositionEnd;
+    selectionStart = start.deprecatedEditingOffset() - m_compositionStart;
+    selectionEnd = start.deprecatedEditingOffset() - m_compositionEnd;
     return true;
 }
 
@@ -1976,7 +2601,7 @@ void Editor::transpose()
     if (!canEdit())
         return;
 
-     Selection selection = m_frame->selection()->selection();
+     VisibleSelection selection = m_frame->selection()->selection();
      if (!selection.isCaret())
          return;
 
@@ -1992,7 +2617,7 @@ void Editor::transpose()
     RefPtr<Range> range = makeRange(previous, next);
     if (!range)
         return;
-    Selection newSelection(range.get(), DOWNSTREAM);
+    VisibleSelection newSelection(range.get(), DOWNSTREAM);
 
     // Transpose the two characters.
     String text = plainText(range.get());
@@ -2018,8 +2643,7 @@ void Editor::addToKillRing(Range* range, bool prepend)
     if (m_shouldStartNewKillRingSequence)
         startNewKillRingSequence();
 
-    String text = plainText(range);
-    text.replace('\\', m_frame->backslashAsCurrencySymbol());
+    String text = m_frame->displayStringModifiedByEncoding(plainText(range));
     if (prepend)
         prependToKillRing(text);
     else
@@ -2068,8 +2692,8 @@ bool Editor::insideVisibleArea(const IntPoint& point) const
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
 
-    IntRect rectInPageCoords = container->getOverflowClipRect(0, 0);
-    IntRect rectInFrameCoords = IntRect(renderer->xPos() * -1, renderer->yPos() * -1,
+    IntRect rectInPageCoords = container->overflowClipRect(0, 0);
+    IntRect rectInFrameCoords = IntRect(renderer->x() * -1, renderer->y() * -1,
                                     rectInPageCoords.width(), rectInPageCoords.height());
 
     return rectInFrameCoords.contains(point);
@@ -2094,8 +2718,8 @@ bool Editor::insideVisibleArea(Range* range) const
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
 
-    IntRect rectInPageCoords = container->getOverflowClipRect(0, 0);
-    IntRect rectInFrameCoords = IntRect(renderer->xPos() * -1, renderer->yPos() * -1,
+    IntRect rectInPageCoords = container->overflowClipRect(0, 0);
+    IntRect rectInFrameCoords = IntRect(renderer->x() * -1, renderer->y() * -1,
                                     rectInPageCoords.width(), rectInPageCoords.height());
     IntRect resultRect = range->boundingBox();
     
@@ -2184,4 +2808,25 @@ PassRefPtr<Range> Editor::nextVisibleRange(Range* currentRange, const String& ta
     return lastVisibleRange(target, caseFlag);
 }
 
+void Editor::changeSelectionAfterCommand(const VisibleSelection& newSelection, bool closeTyping, bool clearTypingStyle, EditCommand* cmd)
+{
+    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
+    // because there is work that it must do in this situation.
+    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
+    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
+    bool selectionDidNotChangeDOMPosition = newSelection == m_frame->selection()->selection();
+    if (selectionDidNotChangeDOMPosition || m_frame->shouldChangeSelection(newSelection))
+        m_frame->selection()->setSelection(newSelection, closeTyping, clearTypingStyle);
+        
+    // Some kinds of deletes and line break insertions change the selection's position within the document without 
+    // changing its position within the DOM.  For example when you press return in the following (the caret is marked by ^): 
+    // <div contentEditable="true"><div>^Hello</div></div>
+    // WebCore inserts <div><br></div> *before* the current block, which correctly moves the paragraph down but which doesn't
+    // change the caret's DOM position (["hello", 0]).  In these situations the above SelectionController::setSelection call
+    // does not call EditorClient::respondToChangedSelection(), which, on the Mac, sends selection change notifications and 
+    // starts a new kill ring sequence, but we want to do these things (matches AppKit).
+    if (selectionDidNotChangeDOMPosition && cmd->isTypingCommand())
+        client()->respondToChangedSelection();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/Editor.h b/src/3rdparty/webkit/WebCore/editing/Editor.h
index d97f670d9e..67a4b5973c 100644
--- a/src/3rdparty/webkit/WebCore/editing/Editor.h
+++ b/src/3rdparty/webkit/WebCore/editing/Editor.h
@@ -110,8 +110,8 @@ public:
     bool shouldDeleteRange(Range*) const;
     bool shouldApplyStyle(CSSStyleDeclaration*, Range*);
     
-    void respondToChangedSelection(const Selection& oldSelection);
-    void respondToChangedContents(const Selection& endingSelection);
+    void respondToChangedSelection(const VisibleSelection& oldSelection);
+    void respondToChangedContents(const VisibleSelection& endingSelection);
 
     TriState selectionHasStyle(CSSStyleDeclaration*) const;
     const SimpleFontData* fontForSelection(bool&) const;
@@ -151,6 +151,9 @@ public:
     bool selectionStartHasStyle(CSSStyleDeclaration*) const;
 
     bool clientIsEditable() const;
+    
+    void setShouldStyleWithCSS(bool flag) { m_shouldStyleWithCSS = flag; }
+    bool shouldStyleWithCSS() const { return m_shouldStyleWithCSS; }
 
     class Command {
     public:
@@ -192,9 +195,31 @@ public:
     bool isSelectionMisspelled();
     Vector<String> guessesForMisspelledSelection();
     Vector<String> guessesForUngrammaticalSelection();
+    Vector<String> guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical);
     void markMisspellingsAfterTypingToPosition(const VisiblePosition&);
-    void markMisspellings(const Selection&);
-    void markBadGrammar(const Selection&);
+    void markMisspellings(const VisibleSelection&, RefPtr<Range>& firstMisspellingRange);
+    void markBadGrammar(const VisibleSelection&);
+    void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    void uppercaseWord();
+    void lowercaseWord();
+    void capitalizeWord();
+    void showSubstitutionsPanel();
+    bool substitutionsPanelIsShowing();
+    void toggleSmartInsertDelete();
+    bool isAutomaticQuoteSubstitutionEnabled();
+    void toggleAutomaticQuoteSubstitution();
+    bool isAutomaticLinkDetectionEnabled();
+    void toggleAutomaticLinkDetection();
+    bool isAutomaticDashSubstitutionEnabled();
+    void toggleAutomaticDashSubstitution();
+    bool isAutomaticTextReplacementEnabled();
+    void toggleAutomaticTextReplacement();
+    bool isAutomaticSpellingCorrectionEnabled();
+    void toggleAutomaticSpellingCorrection();
+    void markAllMisspellingsAndBadGrammarInRanges(bool markSpelling, Range* spellingRange, bool markGrammar, Range* grammarRange, bool performTextCheckingReplacements);
+    void changeBackToReplacedString(const String& replacedString);
+#endif
     void advanceToNextMisspelling(bool startBeforeSelection = false);
     void showSpellingGuessPanel();
     bool spellingPanelIsShowing();
@@ -250,7 +275,7 @@ public:
 
     void clear();
 
-    Selection selectionForCommand(Event*);
+    VisibleSelection selectionForCommand(Event*);
 
     void appendToKillRing(const String&);
     void prependToKillRing(const String&);
@@ -278,6 +303,7 @@ private:
     Vector<CompositionUnderline> m_customCompositionUnderlines;
     bool m_ignoreCompositionSelectionChange;
     bool m_shouldStartNewKillRingSequence;
+    bool m_shouldStyleWithCSS;
 
     bool canDeleteRange(Range*) const;
     bool canSmartReplaceWithPasteboard(Pasteboard*);
@@ -295,6 +321,8 @@ private:
 
     PassRefPtr<Range> firstVisibleRange(const String&, bool caseFlag);
     PassRefPtr<Range> lastVisibleRange(const String&, bool caseFlag);
+    
+    void changeSelectionAfterCommand(const VisibleSelection& newSelection, bool closeTyping, bool clearTypingStyle, EditCommand*);
 };
 
 inline void Editor::setStartNewKillRingSequence(bool flag)
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index cc680a6ebd..5a189d4d88 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "CreateLinkCommand.h"
@@ -35,13 +36,14 @@
 #include "EditorClient.h"
 #include "Event.h"
 #include "EventHandler.h"
-#include "Frame.h"
 #include "FormatBlockCommand.h"
+#include "Frame.h"
 #include "HTMLFontElement.h"
 #include "HTMLImageElement.h"
 #include "IndentOutdentCommand.h"
 #include "InsertListCommand.h"
 #include "Page.h"
+#include "RenderBox.h"
 #include "ReplaceSelectionCommand.h"
 #include "Scrollbar.h"
 #include "Settings.h"
@@ -184,15 +186,15 @@ static bool executeInsertNode(Frame* frame, PassRefPtr<Node> content)
 
 static bool expandSelectionToGranularity(Frame* frame, TextGranularity granularity)
 {
-    Selection selection = frame->selection()->selection();
+    VisibleSelection selection = frame->selection()->selection();
     selection.expandUsingGranularity(granularity);
-    RefPtr<Range> newRange = selection.toRange();
+    RefPtr<Range> newRange = selection.toNormalizedRange();
     if (!newRange)
         return false;
     ExceptionCode ec = 0;
     if (newRange->collapsed(ec))
         return false;
-    RefPtr<Range> oldRange = frame->selection()->selection().toRange();
+    RefPtr<Range> oldRange = frame->selection()->selection().toNormalizedRange();
     EAffinity affinity = frame->selection()->affinity();
     if (!frame->editor()->client()->shouldChangeSelectedRange(oldRange.get(), newRange.get(), affinity, false))
         return false;
@@ -225,14 +227,14 @@ static int verticalScrollDistance(Frame* frame)
     if (!focusedNode)
         return 0;
     RenderObject* renderer = focusedNode->renderer();
-    if (!renderer)
+    if (!renderer || !renderer->isBox())
         return 0;
     RenderStyle* style = renderer->style();
     if (!style)
         return 0;
     if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || renderer->isTextArea()))
         return 0;
-    int height = renderer->clientHeight();
+    int height = toRenderBox(renderer)->clientHeight();
     return max((height + 1) / 2, height - cAmountToKeepWhenPaging);
 }
 
@@ -342,7 +344,7 @@ static bool executeDeleteToEndOfParagraph(Frame* frame, Event*, EditorCommandSou
 
 static bool executeDeleteToMark(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    RefPtr<Range> mark = frame->mark().toRange();
+    RefPtr<Range> mark = frame->mark().toNormalizedRange();
     if (mark) {
         SelectionController* selection = frame->selection();
         bool selected = selection->setSelectedRange(unionDOMRanges(mark.get(), frame->editor()->selectedRange().get()).get(), DOWNSTREAM, true);
@@ -491,9 +493,9 @@ static bool executeInsertNewlineInQuotedContent(Frame* frame, Event*, EditorComm
     return true;
 }
 
-static bool executeInsertOrderedList(Frame* frame, Event*, EditorCommandSource, const String& value)
+static bool executeInsertOrderedList(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::OrderedList, value));
+    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::OrderedList));
     return true;
 }
 
@@ -514,9 +516,9 @@ static bool executeInsertText(Frame* frame, Event*, EditorCommandSource, const S
     return true;
 }
 
-static bool executeInsertUnorderedList(Frame* frame, Event*, EditorCommandSource, const String& value)
+static bool executeInsertUnorderedList(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::UnorderedList, value));
+    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::UnorderedList));
     return true;
 }
 
@@ -826,6 +828,30 @@ static bool executeMoveWordRightAndModifySelection(Frame* frame, Event*, EditorC
     return true;
 }
 
+static bool executeMoveToLeftEndOfLine(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::MOVE, SelectionController::LEFT, LineBoundary, true);
+    return true;
+}
+
+static bool executeMoveToLeftEndOfLineAndModifySelection(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::EXTEND, SelectionController::LEFT, LineBoundary, true);
+    return true;
+}
+
+static bool executeMoveToRightEndOfLine(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::MOVE, SelectionController::RIGHT, LineBoundary, true);
+    return true;
+}
+
+static bool executeMoveToRightEndOfLineAndModifySelection(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::EXTEND, SelectionController::RIGHT, LineBoundary, true);
+    return true;
+}
+
 static bool executeOutdent(Frame* frame, Event*, EditorCommandSource, const String&)
 {
     applyCommand(IndentOutdentCommand::create(frame->document(), IndentOutdentCommand::Outdent));
@@ -888,7 +914,7 @@ static bool executeSelectSentence(Frame* frame, Event*, EditorCommandSource, con
 
 static bool executeSelectToMark(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    RefPtr<Range> mark = frame->mark().toRange();
+    RefPtr<Range> mark = frame->mark().toNormalizedRange();
     RefPtr<Range> selection = frame->editor()->selectedRange();
     if (!mark || !selection) {
         systemBeep();
@@ -914,20 +940,29 @@ static bool executeStrikethrough(Frame* frame, Event*, EditorCommandSource sourc
     return executeToggleStyle(frame, source, EditActionChangeAttributes, CSSPropertyWebkitTextDecorationsInEffect, "none", "line-through");
 }
 
+static bool executeStyleWithCSS(Frame* frame, Event*, EditorCommandSource, const String& value)
+{
+    if (value != "false" && value != "true")
+        return false;
+    
+    frame->editor()->setShouldStyleWithCSS(value == "true" ? true : false);
+    return true;
+}
+
 static bool executeSubscript(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    return executeApplyStyle(frame, source, EditActionSubscript, CSSPropertyVerticalAlign, "sub");
+    return executeToggleStyle(frame, source, EditActionSubscript, CSSPropertyVerticalAlign, "baseline", "sub");
 }
 
 static bool executeSuperscript(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    return executeApplyStyle(frame, source, EditActionSuperscript, CSSPropertyVerticalAlign, "super");
+    return executeToggleStyle(frame, source, EditActionSuperscript, CSSPropertyVerticalAlign, "baseline", "super");
 }
 
 static bool executeSwapWithMark(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    const Selection& mark = frame->mark();
-    const Selection& selection = frame->selection()->selection();
+    const VisibleSelection& mark = frame->mark();
+    const VisibleSelection& selection = frame->selection()->selection();
     if (mark.isNone() || selection.isNone()) {
         systemBeep();
         return false;
@@ -1033,20 +1068,20 @@ static bool enabled(Frame*, Event*, EditorCommandSource)
 static bool enabledVisibleSelection(Frame* frame, Event* event, EditorCommandSource)
 {
     // The term "visible" here includes a caret in editable text or a range in any text.
-    const Selection& selection = frame->editor()->selectionForCommand(event);
+    const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
     return (selection.isCaret() && selection.isContentEditable()) || selection.isRange();
 }
 
 static bool enabledVisibleSelectionAndMark(Frame* frame, Event* event, EditorCommandSource)
 {
-    const Selection& selection = frame->editor()->selectionForCommand(event);
+    const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
     return ((selection.isCaret() && selection.isContentEditable()) || selection.isRange())
         && frame->mark().isCaretOrRange();
 }
 
 static bool enableCaretInEditableText(Frame* frame, Event* event, EditorCommandSource)
 {
-    const Selection& selection = frame->editor()->selectionForCommand(event);
+    const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
     return selection.isCaret() && selection.isContentEditable();
 }
 
@@ -1138,6 +1173,11 @@ static TriState stateStrikethrough(Frame* frame, Event*)
     return stateStyle(frame, CSSPropertyTextDecoration, "line-through");
 }
 
+static TriState stateStyleWithCSS(Frame* frame, Event*)
+{
+    return frame->editor()->shouldStyleWithCSS() ? TrueTriState : FalseTriState;
+}
+
 static TriState stateSubscript(Frame* frame, Event*)
 {
     return stateStyle(frame, CSSPropertyVerticalAlign, "sub");
@@ -1180,27 +1220,27 @@ static String valueNull(Frame*, Event*)
     return String();
 }
 
-String valueBackColor(Frame* frame, Event*)
+static String valueBackColor(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyBackgroundColor);
 }
 
-String valueFontName(Frame* frame, Event*)
+static String valueFontName(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyFontFamily);
 }
 
-String valueFontSize(Frame* frame, Event*)
+static String valueFontSize(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyFontSize);
 }
 
-String valueFontSizeDelta(Frame* frame, Event*)
+static String valueFontSizeDelta(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyWebkitFontSizeDelta);
 }
 
-String valueForeColor(Frame* frame, Event*)
+static String valueForeColor(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyColor);
 }
@@ -1244,8 +1284,8 @@ static const CommandMap& createCommandMap()
         { "IgnoreSpelling", { executeIgnoreSpelling, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Indent", { executeIndent, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertBacktab", { executeInsertBacktab, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, isTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "InsertHorizontalRule", { executeInsertHorizontalRule, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertHTML", { executeInsertHTML, supported, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "InsertHorizontalRule", { executeInsertHorizontalRule, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertImage", { executeInsertImage, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertLineBreak", { executeInsertLineBreak, supported, enabledInEditableText, stateNone, valueNull, isTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertNewline", { executeInsertNewline, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, isTextInsertion, doNotAllowExecutionWhenDisabled } },    
@@ -1296,6 +1336,10 @@ static const CommandMap& createCommandMap()
         { "MoveToEndOfParagraphAndModifySelection", { executeMoveToEndOfParagraphAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToEndOfSentence", { executeMoveToEndOfSentence, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToEndOfSentenceAndModifySelection", { executeMoveToEndOfSentenceAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToLeftEndOfLine", { executeMoveToLeftEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToLeftEndOfLineAndModifySelection", { executeMoveToLeftEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToRightEndOfLine", { executeMoveToRightEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToRightEndOfLineAndModifySelection", { executeMoveToRightEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackward", { executeMoveWordBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1320,6 +1364,7 @@ static const CommandMap& createCommandMap()
         { "SelectWord", { executeSelectWord, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "SetMark", { executeSetMark, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Strikethrough", { executeStrikethrough, supported, enabledInRichlyEditableText, stateStrikethrough, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "StyleWithCSS", { executeStyleWithCSS, supported, enabledInRichlyEditableText, stateStyleWithCSS, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Subscript", { executeSubscript, supported, enabledInRichlyEditableText, stateSubscript, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Superscript", { executeSuperscript, supported, enabledInRichlyEditableText, stateSuperscript, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "SwapWithMark", { executeSwapWithMark, supportedFromMenuOrKeyBinding, enabledVisibleSelectionAndMark, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1428,7 +1473,7 @@ bool Editor::Command::execute(const String& parameter, Event* triggeringEvent) c
 {
     if (!isEnabled(triggeringEvent)) {
         // Let certain commands be executed when performed explicitly even if they are disabled.
-        if (!isSupported() || !m_frame || !m_frame->document() || !m_command->allowExecutionWhenDisabled)
+        if (!isSupported() || !m_frame || !m_command->allowExecutionWhenDisabled)
             return false;
     }
     m_frame->document()->updateLayoutIgnorePendingStylesheets();
@@ -1447,21 +1492,21 @@ bool Editor::Command::isSupported() const
 
 bool Editor::Command::isEnabled(Event* triggeringEvent) const
 {
-    if (!isSupported() || !m_frame || !m_frame->document())
+    if (!isSupported() || !m_frame)
         return false;
     return m_command->isEnabled(m_frame.get(), triggeringEvent, m_source);
 }
 
 TriState Editor::Command::state(Event* triggeringEvent) const
 {
-    if (!isSupported() || !m_frame || !m_frame->document())
+    if (!isSupported() || !m_frame)
         return FalseTriState;
     return m_command->state(m_frame.get(), triggeringEvent);
 }
 
 String Editor::Command::value(Event* triggeringEvent) const
 {
-    if (!isSupported() || !m_frame || !m_frame->document())
+    if (!isSupported() || !m_frame)
         return String();
     return m_command->value(m_frame.get(), triggeringEvent);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp b/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp
index 6a4ee7ed2b..d92f3659a9 100644
--- a/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp
@@ -63,7 +63,7 @@ bool FormatBlockCommand::modifyRange()
     setEndingSelection(visibleEnd);
     doApply();
     visibleEnd = endingSelection().visibleEnd();
-    setEndingSelection(Selection(visibleStart.deepEquivalent(), visibleEnd.deepEquivalent(), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(visibleStart.deepEquivalent(), visibleEnd.deepEquivalent(), DOWNSTREAM));
 
     return true;
 }
@@ -87,7 +87,7 @@ void FormatBlockCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(Selection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
     if (endingSelection().isRange() && modifyRange())
         return;
@@ -124,7 +124,7 @@ void FormatBlockCommand::doApply()
     appendNode(placeholder, blockNode);
     
     VisiblePosition destination(Position(placeholder.get(), 0));
-    if (paragraphStart == paragraphEnd && !lineBreakExistsAtPosition(paragraphStart)) {
+    if (paragraphStart == paragraphEnd && !lineBreakExistsAtVisiblePosition(paragraphStart)) {
         setEndingSelection(destination);
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 03c59d39ed..0f9b1064d1 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -103,13 +103,13 @@ PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(Vis
     // Add another br before the placeholder if it collapsed.
     VisiblePosition visiblePos(Position(placeholder.get(), 0));
     if (!isStartOfParagraph(visiblePos))
-        insertNodeBefore(createBreakElement(document()).get(), placeholder.get());
-    return placeholder.get();
+        insertNodeBefore(createBreakElement(document()), placeholder);
+    return placeholder.release();
 }
 
 void IndentOutdentCommand::indentRegion()
 {
-    Selection selection = selectionForParagraphIteration(endingSelection());
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     VisiblePosition startOfSelection = selection.visibleStart();
     VisiblePosition endOfSelection = selection.visibleEnd();
     int startIndex = indexForVisiblePosition(startOfSelection);
@@ -126,7 +126,7 @@ void IndentOutdentCommand::indentRegion()
         insertNodeAt(blockquote, start);
         RefPtr<Element> placeholder = createBreakElement(document());
         appendNode(placeholder, blockquote);
-        setEndingSelection(Selection(Position(placeholder.get(), 0), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(Position(placeholder.get(), 0), DOWNSTREAM));
         return;
     }
     
@@ -151,7 +151,7 @@ void IndentOutdentCommand::indentRegion()
                 appendNode(placeholder, listItem);
             } else {
                 // Clone the list element, insert it before the current paragraph, and move the paragraph into it.
-                RefPtr<Element> clonedList = listNode->cloneElement();
+                RefPtr<Element> clonedList = listNode->cloneElementWithoutChildren();
                 insertNodeBefore(clonedList, enclosingListChild(endOfCurrentParagraph.deepEquivalent().node()));
                 appendNode(listItem, clonedList);
                 appendNode(placeholder, listItem);
@@ -191,7 +191,7 @@ void IndentOutdentCommand::indentRegion()
     RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
     RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
     if (startRange && endRange)
-        setEndingSelection(Selection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::outdentParagraph()
@@ -200,27 +200,40 @@ void IndentOutdentCommand::outdentParagraph()
     VisiblePosition visibleEndOfParagraph = endOfParagraph(visibleStartOfParagraph);
 
     Node* enclosingNode = enclosingNodeOfType(visibleStartOfParagraph.deepEquivalent(), &isListOrIndentBlockquote);
-    if (!enclosingNode)
+    if (!enclosingNode || !isContentEditable(enclosingNode->parentNode()))  // We can't outdent if there is no place to go!
         return;
 
     // Use InsertListCommand to remove the selection from the list
     if (enclosingNode->hasTagName(olTag)) {
-        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::OrderedList, ""));
+        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::OrderedList));
         return;        
     }
     if (enclosingNode->hasTagName(ulTag)) {
-        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::UnorderedList, ""));
+        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::UnorderedList));
         return;
     }
     
     // The selection is inside a blockquote
     VisiblePosition positionInEnclosingBlock = VisiblePosition(Position(enclosingNode, 0));
     VisiblePosition startOfEnclosingBlock = startOfBlock(positionInEnclosingBlock);
-    VisiblePosition endOfEnclosingBlock = endOfBlock(positionInEnclosingBlock);
+    VisiblePosition lastPositionInEnclosingBlock = VisiblePosition(Position(enclosingNode, enclosingNode->childNodeCount()));
+    VisiblePosition endOfEnclosingBlock = endOfBlock(lastPositionInEnclosingBlock);
     if (visibleStartOfParagraph == startOfEnclosingBlock &&
         visibleEndOfParagraph == endOfEnclosingBlock) {
         // The blockquote doesn't contain anything outside the paragraph, so it can be totally removed.
+        Node* splitPoint = enclosingNode->nextSibling();
         removeNodePreservingChildren(enclosingNode);
+        // outdentRegion() assumes it is operating on the first paragraph of an enclosing blockquote, but if there are multiply nested blockquotes and we've
+        // just removed one, then this assumption isn't true. By splitting the next containing blockquote after this node, we keep this assumption true
+        if (splitPoint) {
+            if (Node* splitPointParent = splitPoint->parentNode()) {
+                if (isIndentBlockquote(splitPointParent)
+                    && !isIndentBlockquote(splitPoint)
+                    && isContentEditable(splitPointParent->parentNode())) // We can't outdent if there is no place to go!
+                    splitElement(static_cast<Element*>(splitPointParent), splitPoint);
+            }
+        }
+        
         updateLayout();
         visibleStartOfParagraph = VisiblePosition(visibleStartOfParagraph.deepEquivalent());
         visibleEndOfParagraph = VisiblePosition(visibleEndOfParagraph.deepEquivalent());
@@ -228,6 +241,7 @@ void IndentOutdentCommand::outdentParagraph()
             insertNodeAt(createBreakElement(document()), visibleStartOfParagraph.deepEquivalent());
         if (visibleEndOfParagraph.isNotNull() && !isEndOfParagraph(visibleEndOfParagraph))
             insertNodeAt(createBreakElement(document()), visibleEndOfParagraph.deepEquivalent());
+
         return;
     }
     Node* enclosingBlockFlow = enclosingBlockFlowElement(visibleStartOfParagraph);
@@ -262,13 +276,13 @@ void IndentOutdentCommand::outdentRegion()
     while (endOfCurrentParagraph != endAfterSelection) {
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (endOfCurrentParagraph == endOfLastParagraph)
-            setEndingSelection(Selection(originalSelectionEnd, DOWNSTREAM));
+            setEndingSelection(VisibleSelection(originalSelectionEnd, DOWNSTREAM));
         else
             setEndingSelection(endOfCurrentParagraph);
         outdentParagraph();
         endOfCurrentParagraph = endOfNextParagraph;
     }
-    setEndingSelection(Selection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::doApply()
@@ -290,7 +304,7 @@ void IndentOutdentCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(Selection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
     if (m_typeOfAction == Indent)
         indentRegion();
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
index 15750feb41..f020459933 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
@@ -28,13 +28,14 @@
 
 #include "CSSMutableStyleDeclaration.h"
 #include "Document.h"
-#include "Element.h"
 #include "Frame.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "Range.h"
+#include "RenderObject.h"
 #include "Text.h"
 #include "VisiblePosition.h"
-#include "Range.h"
 #include "htmlediting.h"
-#include "HTMLNames.h"
 #include "visible_units.h"
 
 namespace WebCore {
@@ -88,7 +89,7 @@ bool InsertLineBreakCommand::shouldUseBreakElement(const Position& insertionPos)
 void InsertLineBreakCommand::doApply()
 {
     deleteSelection();
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     if (selection.isNone())
         return;
     
@@ -107,38 +108,37 @@ void InsertLineBreakCommand::doApply()
     
     // FIXME: Need to merge text nodes when inserting just after or before text.
     
-    if (isEndOfParagraph(caret) && !lineBreakExistsAtPosition(caret)) {
+    if (isEndOfParagraph(caret) && !lineBreakExistsAtVisiblePosition(caret)) {
         bool needExtraLineBreak = !pos.node()->hasTagName(hrTag) && !pos.node()->hasTagName(tableTag);
         
         insertNodeAt(nodeToInsert.get(), pos);
         
         if (needExtraLineBreak)
-            insertNodeBefore(nodeToInsert->cloneNode(false).get(), nodeToInsert.get());
+            insertNodeBefore(nodeToInsert->cloneNode(false), nodeToInsert);
         
         VisiblePosition endingPosition(Position(nodeToInsert.get(), 0));
-        setEndingSelection(Selection(endingPosition));
-    } else if (pos.offset() <= caretMinOffset(pos.node())) {
+        setEndingSelection(VisibleSelection(endingPosition));
+    } else if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node())) {
         insertNodeAt(nodeToInsert.get(), pos);
         
         // Insert an extra br or '\n' if the just inserted one collapsed.
         if (!isStartOfParagraph(VisiblePosition(Position(nodeToInsert.get(), 0))))
             insertNodeBefore(nodeToInsert->cloneNode(false).get(), nodeToInsert.get());
         
-        setEndingSelection(Selection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
-    } else if (pos.offset() >= caretMaxOffset(pos.node())) {
+        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+    // If we're inserting after all of the rendered text in a text node, or into a non-text node,
+    // a simple insertion is sufficient.
+    } else if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()) || !pos.node()->isTextNode()) {
         insertNodeAt(nodeToInsert.get(), pos);
-        setEndingSelection(Selection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
     } else {
         // Split a text node
         ASSERT(pos.node()->isTextNode());
         
         // Do the split
-        ExceptionCode ec = 0;
-        Text *textNode = static_cast<Text *>(pos.node());
-        RefPtr<Text> textBeforeNode = document()->createTextNode(textNode->substringData(0, selection.start().offset(), ec));
-        deleteTextFromNode(textNode, 0, pos.offset());
-        insertNodeBefore(textBeforeNode.get(), textNode);
-        insertNodeBefore(nodeToInsert.get(), textNode);
+        Text* textNode = static_cast<Text*>(pos.node());
+        splitTextNode(textNode, pos.deprecatedEditingOffset());
+        insertNodeBefore(nodeToInsert, textNode);
         Position endingPosition = Position(textNode, 0);
         
         // Handle whitespace that occurs after the split
@@ -158,7 +158,7 @@ void InsertLineBreakCommand::doApply()
             }
         }
         
-        setEndingSelection(Selection(endingPosition, DOWNSTREAM));
+        setEndingSelection(VisibleSelection(endingPosition, DOWNSTREAM));
     }
 
     // Handle the case where there is a typing style.
@@ -170,10 +170,9 @@ void InsertLineBreakCommand::doApply()
         // leaves and then comes back, new input will have the right style.
         // FIXME: We shouldn't always apply the typing style to the line break here,
         // see <rdar://problem/5794462>.
-        applyStyle(typingStyle, Position(nodeToInsert.get(), 0),
-                                Position(nodeToInsert.get(), maxDeepOffset(nodeToInsert.get())));
+        applyStyle(typingStyle, firstDeepEditingPositionForNode(nodeToInsert.get()), lastDeepEditingPositionForNode(nodeToInsert.get()));
         // Even though this applyStyle operates on a Range, it still sets an endingSelection().
-        // It tries to set a Selection around the content it operated on. So, that Selection
+        // It tries to set a VisibleSelection around the content it operated on. So, that VisibleSelection
         // will either (a) select the line break we inserted, or it will (b) be a caret just 
         // before the line break (if the line break is at the end of a block it isn't selectable).
         // So, this next call sets the endingSelection() to a caret just after the line break 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
index 20c63b8685..ec707d26f6 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
@@ -39,7 +39,7 @@ using namespace HTMLNames;
 
 PassRefPtr<HTMLElement> InsertListCommand::insertList(Document* document, Type type)
 {
-    RefPtr<InsertListCommand> insertCommand = new InsertListCommand(document, type, "");
+    RefPtr<InsertListCommand> insertCommand = new InsertListCommand(document, type);
     insertCommand->apply();
     return insertCommand->m_listElement;
 }
@@ -54,14 +54,14 @@ HTMLElement* InsertListCommand::fixOrphanedListChild(Node* node)
     return listElement.get();
 }
 
-InsertListCommand::InsertListCommand(Document* document, Type type, const String& id) 
-    : CompositeEditCommand(document), m_type(type), m_id(id), m_forceCreateList(false)
+InsertListCommand::InsertListCommand(Document* document, Type type) 
+    : CompositeEditCommand(document), m_type(type), m_forceCreateList(false)
 {
 }
 
 bool InsertListCommand::modifyRange()
 {
-    Selection selection = selectionForParagraphIteration(endingSelection());
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     ASSERT(selection.isRange());
     VisiblePosition startOfSelection = selection.visibleStart();
     VisiblePosition endOfSelection = selection.visibleEnd();
@@ -99,7 +99,7 @@ bool InsertListCommand::modifyRange()
     doApply();
     // Fetch the end of the selection, for the reason mentioned above.
     endOfSelection = endingSelection().visibleEnd();
-    setEndingSelection(Selection(startOfSelection, endOfSelection));
+    setEndingSelection(VisibleSelection(startOfSelection, endOfSelection));
     m_forceCreateList = false;
     return true;
 }
@@ -123,7 +123,7 @@ void InsertListCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(Selection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
     if (endingSelection().isRange() && modifyRange())
         return;
@@ -148,8 +148,8 @@ void InsertListCommand::doApply()
         VisiblePosition start;
         VisiblePosition end;
         if (listChildNode->hasTagName(liTag)) {
-            start = VisiblePosition(Position(listChildNode, 0));
-            end = VisiblePosition(Position(listChildNode, maxDeepOffset(listChildNode)));
+            start = firstDeepEditingPositionForNode(listChildNode);
+            end = lastDeepEditingPositionForNode(listChildNode);
             nextListChild = listChildNode->nextSibling();
             previousListChild = listChildNode->previousSibling();
         } else {
@@ -202,7 +202,8 @@ void InsertListCommand::doApply()
     }
     if (!listChildNode || switchListType || m_forceCreateList) {
         // Create list.
-        VisiblePosition start = startOfParagraph(endingSelection().visibleStart());
+        VisiblePosition originalStart = endingSelection().visibleStart();
+        VisiblePosition start = startOfParagraph(originalStart);
         VisiblePosition end = endOfParagraph(endingSelection().visibleEnd());
         
         // Check for adjoining lists.
@@ -230,8 +231,6 @@ void InsertListCommand::doApply()
             // Create the list.
             RefPtr<HTMLElement> listElement = m_type == OrderedList ? createOrderedListElement(document()) : createUnorderedListElement(document());
             m_listElement = listElement;
-            if (!m_id.isEmpty())
-                listElement->setId(m_id);
             appendNode(listItemElement, listElement);
             
             if (start == end && isBlock(start.deepEquivalent().node())) {
@@ -253,12 +252,17 @@ void InsertListCommand::doApply()
             Node* listChild = enclosingListChild(insertionPos.node());
             if (listChild && listChild->hasTagName(liTag))
                 insertionPos = positionBeforeNode(listChild);
-                
+
             insertNodeAt(listElement, insertionPos);
+
+            // We inserted the list at the start of the content we're about to move
+            // Update the start of content, so we don't try to move the list into itself.  bug 19066
+            if (insertionPos == start.deepEquivalent())
+                start = startOfParagraph(originalStart);
         }
         moveParagraph(start, end, VisiblePosition(Position(placeholder.get(), 0)), true);
         if (nextList && previousList)
-            mergeIdenticalElements(static_cast<Element*>(previousList), static_cast<Element*>(nextList));
+            mergeIdenticalElements(previousList, nextList);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h
index b39f2b581d..ecdd2cf8f3 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h
@@ -36,9 +36,9 @@ class InsertListCommand : public CompositeEditCommand {
 public:
     enum Type { OrderedList, UnorderedList };
 
-    static PassRefPtr<InsertListCommand> create(Document* document, Type listType, const String& listID)
+    static PassRefPtr<InsertListCommand> create(Document* document, Type listType)
     {
-        return adoptRef(new InsertListCommand(document, listType, listID));
+        return adoptRef(new InsertListCommand(document, listType));
     }
 
     static PassRefPtr<HTMLElement> insertList(Document*, Type);
@@ -46,7 +46,7 @@ public:
     virtual bool preservesTypingStyle() const { return true; }
 
 private:
-    InsertListCommand(Document*, Type, const String&);
+    InsertListCommand(Document*, Type);
 
     virtual void doApply();
     virtual EditAction editingAction() const { return EditActionInsertList; }
@@ -55,7 +55,6 @@ private:
     bool modifyRange();
     RefPtr<HTMLElement> m_listElement;
     Type m_type;
-    String m_id;
     bool m_forceCreateList;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 8d82836295..734d8fc0e7 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -26,16 +26,17 @@
 #include "config.h"
 #include "InsertParagraphSeparatorCommand.h"
 
-#include "Document.h"
-#include "Logging.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
-#include "Text.h"
-#include "htmlediting.h"
+#include "Document.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InsertLineBreakCommand.h"
+#include "Logging.h"
 #include "RenderObject.h"
+#include "Text.h"
+#include "htmlediting.h"
 #include "visible_units.h"
 
 namespace WebCore {
@@ -106,42 +107,42 @@ void InsertParagraphSeparatorCommand::doApply()
     if (endingSelection().isNone())
         return;
     
-    Position pos = endingSelection().start();
+    Position insertionPosition = endingSelection().start();
         
     EAffinity affinity = endingSelection().affinity();
         
     // Delete the current selection.
     if (endingSelection().isRange()) {
-        calculateStyleBeforeInsertion(pos);
+        calculateStyleBeforeInsertion(insertionPosition);
         deleteSelection(false, true);
-        pos = endingSelection().start();
+        insertionPosition = endingSelection().start();
         affinity = endingSelection().affinity();
     }
     
     // FIXME: The rangeCompliantEquivalent conversion needs to be moved into enclosingBlock.
-    Node* startBlockNode = enclosingBlock(rangeCompliantEquivalent(pos).node());
-    Position canonicalPos = VisiblePosition(pos).deepEquivalent();
+    Node* startBlockNode = enclosingBlock(rangeCompliantEquivalent(insertionPosition).node());
+    Position canonicalPos = VisiblePosition(insertionPosition).deepEquivalent();
     Element* startBlock = static_cast<Element*>(startBlockNode);
     if (!startBlockNode
             || !startBlockNode->isElementNode()
             || !startBlock->parentNode()
             || isTableCell(startBlock)
             || startBlock->hasTagName(formTag)
-            || canonicalPos.node()->renderer() && canonicalPos.node()->renderer()->isTable()
+            || (canonicalPos.node()->renderer() && canonicalPos.node()->renderer()->isTable())
             || canonicalPos.node()->hasTagName(hrTag)) {
         applyCommandToComposite(InsertLineBreakCommand::create(document()));
         return;
     }
     
     // Use the leftmost candidate.
-    pos = pos.upstream();
-    if (!pos.isCandidate())
-        pos = pos.downstream();
+    insertionPosition = insertionPosition.upstream();
+    if (!insertionPosition.isCandidate())
+        insertionPosition = insertionPosition.downstream();
 
     // Adjust the insertion position after the delete
-    pos = positionAvoidingSpecialElementBoundary(pos);
-    VisiblePosition visiblePos(pos, affinity);
-    calculateStyleBeforeInsertion(pos);
+    insertionPosition = positionAvoidingSpecialElementBoundary(insertionPosition);
+    VisiblePosition visiblePos(insertionPosition, affinity);
+    calculateStyleBeforeInsertion(insertionPosition);
 
     //---------------------------------------------------------------------
     // Handle special case of typing return on an empty list item
@@ -150,10 +151,6 @@ void InsertParagraphSeparatorCommand::doApply()
 
     //---------------------------------------------------------------------
     // Prepare for more general cases.
-    // FIXME: We shouldn't peel off the node here because then we lose track of
-    // the fact that it's the node that belongs to an editing position and
-    // not a rangeCompliantEquivalent.
-    Node *startNode = pos.node();
 
     bool isFirstInBlock = isStartOfBlock(visiblePos);
     bool isLastInBlock = isEndOfBlock(visiblePos);
@@ -167,14 +164,14 @@ void InsertParagraphSeparatorCommand::doApply()
     } else if (shouldUseDefaultParagraphElement(startBlock)) 
         blockToInsert = createDefaultParagraphElement(document());
     else
-        blockToInsert = startBlock->cloneElement();
-    
+        blockToInsert = startBlock->cloneElementWithoutChildren();
+
     //---------------------------------------------------------------------
     // Handle case when position is in the last visible position in its block,
     // including when the block is empty. 
     if (isLastInBlock) {
         if (nestNewBlock) {
-            if (isFirstInBlock && !lineBreakExistsAtPosition(visiblePos)) {
+            if (isFirstInBlock && !lineBreakExistsAtVisiblePosition(visiblePos)) {
                 // The block is empty.  Create an empty block to
                 // represent the paragraph that we're leaving.
                 RefPtr<Element> extraBlock = createDefaultParagraphElement(document());
@@ -182,11 +179,15 @@ void InsertParagraphSeparatorCommand::doApply()
                 appendBlockPlaceholder(extraBlock);
             }
             appendNode(blockToInsert, startBlock);
-        } else
-            insertNodeAfter(blockToInsert, startBlock);
+        } else {
+            // We can get here if we pasted a copied portion of a blockquote with a newline at the end and are trying to paste it
+            // into an unquoted area. We then don't want the newline within the blockquote or else it will also be quoted.
+            Node* highestBlockquote = highestEnclosingNodeOfType(canonicalPos, &isMailBlockquote);
+            insertNodeAfter(blockToInsert, highestBlockquote ? highestBlockquote : startBlock);
+        }
 
         appendBlockPlaceholder(blockToInsert);
-        setEndingSelection(Selection(Position(blockToInsert.get(), 0), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
         applyStyleAfterInsertion(startBlock);
         return;
     }
@@ -198,20 +199,20 @@ void InsertParagraphSeparatorCommand::doApply()
         Node *refNode;
         if (isFirstInBlock && !nestNewBlock)
             refNode = startBlock;
-        else if (pos.node() == startBlock && nestNewBlock) {
-            refNode = startBlock->childNode(pos.offset());
+        else if (insertionPosition.node() == startBlock && nestNewBlock) {
+            refNode = startBlock->childNode(insertionPosition.deprecatedEditingOffset());
             ASSERT(refNode); // must be true or we'd be in the end of block case
         } else
-            refNode = pos.node();
+            refNode = insertionPosition.node();
 
         // find ending selection position easily before inserting the paragraph
-        pos = pos.downstream();
+        insertionPosition = insertionPosition.downstream();
         
-        insertNodeBefore(blockToInsert.get(), refNode);
+        insertNodeBefore(blockToInsert, refNode);
         appendBlockPlaceholder(blockToInsert.get());
-        setEndingSelection(Selection(Position(blockToInsert.get(), 0), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
         applyStyleAfterInsertion(startBlock);
-        setEndingSelection(Selection(pos, DOWNSTREAM));
+        setEndingSelection(VisibleSelection(insertionPosition, DOWNSTREAM));
         return;
     }
 
@@ -224,41 +225,45 @@ void InsertParagraphSeparatorCommand::doApply()
     // content will move down a line.
     if (isStartOfParagraph(visiblePos)) {
         RefPtr<Element> br = createBreakElement(document());
-        insertNodeAt(br.get(), pos);
-        pos = positionAfterNode(br.get());
+        insertNodeAt(br.get(), insertionPosition);
+        insertionPosition = positionAfterNode(br.get());
     }
     
     // Move downstream. Typing style code will take care of carrying along the 
     // style of the upstream position.
-    pos = pos.downstream();
-    startNode = pos.node();
+    insertionPosition = insertionPosition.downstream();
+
+    // At this point, the insertionPosition's node could be a container, and we want to make sure we include
+    // all of the correct nodes when building the ancestor list.  So this needs to be the deepest representation of the position
+    // before we walk the DOM tree.
+    insertionPosition = VisiblePosition(insertionPosition).deepEquivalent();
 
     // Build up list of ancestors in between the start node and the start block.
     Vector<Element*> ancestors;
-    if (startNode != startBlock) {
-        for (Element* n = startNode->parentElement(); n && n != startBlock; n = n->parentElement())
+    if (insertionPosition.node() != startBlock) {
+        for (Element* n = insertionPosition.node()->parentElement(); n && n != startBlock; n = n->parentElement())
             ancestors.append(n);
     }
 
     // Make sure we do not cause a rendered space to become unrendered.
     // FIXME: We need the affinity for pos, but pos.downstream() does not give it
-    Position leadingWhitespace = pos.leadingWhitespacePosition(VP_DEFAULT_AFFINITY);
+    Position leadingWhitespace = insertionPosition.leadingWhitespacePosition(VP_DEFAULT_AFFINITY);
     // FIXME: leadingWhitespacePosition is returning the position before preserved newlines for positions
     // after the preserved newline, causing the newline to be turned into a nbsp.
     if (leadingWhitespace.isNotNull()) {
         Text* textNode = static_cast<Text*>(leadingWhitespace.node());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, leadingWhitespace.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     
     // Split at pos if in the middle of a text node.
-    if (startNode->isTextNode()) {
-        Text *textNode = static_cast<Text *>(startNode);
-        bool atEnd = (unsigned)pos.offset() >= textNode->length();
-        if (pos.offset() > 0 && !atEnd) {
-            splitTextNode(textNode, pos.offset());
-            pos = Position(startNode, 0);
-            visiblePos = VisiblePosition(pos);
+    if (insertionPosition.node()->isTextNode()) {
+        Text* textNode = static_cast<Text*>(insertionPosition.node());
+        bool atEnd = (unsigned)insertionPosition.deprecatedEditingOffset() >= textNode->length();
+        if (insertionPosition.deprecatedEditingOffset() > 0 && !atEnd) {
+            splitTextNode(textNode, insertionPosition.deprecatedEditingOffset());
+            insertionPosition.moveToOffset(0);
+            visiblePos = VisiblePosition(insertionPosition);
             splitText = true;
         }
     }
@@ -274,7 +279,7 @@ void InsertParagraphSeparatorCommand::doApply()
     // Make clones of ancestors in between the start node and the start block.
     RefPtr<Element> parent = blockToInsert;
     for (size_t i = ancestors.size(); i != 0; --i) {
-        RefPtr<Element> child = ancestors[i - 1]->cloneElement(); // shallow clone
+        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
         appendNode(child, parent);
         parent = child.release();
     }
@@ -282,14 +287,14 @@ void InsertParagraphSeparatorCommand::doApply()
     // If the paragraph separator was inserted at the end of a paragraph, an empty line must be
     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
     // element.  If the first node to be inserted won't be one that will hold an empty line open, add a br.
-    if (isEndOfParagraph(visiblePos) && !lineBreakExistsAtPosition(visiblePos))
+    if (isEndOfParagraph(visiblePos) && !lineBreakExistsAtVisiblePosition(visiblePos))
         appendNode(createBreakElement(document()).get(), blockToInsert.get());
         
     // Move the start node and the siblings of the start node.
-    if (startNode != startBlock) {
-        Node *n = startNode;
-        if (pos.offset() >= caretMaxOffset(startNode))
-            n = startNode->nextSibling();
+    if (insertionPosition.node() != startBlock) {
+        Node* n = insertionPosition.node();
+        if (insertionPosition.deprecatedEditingOffset() >= caretMaxOffset(n))
+            n = n->nextSibling();
 
         while (n && n != blockToInsert) {
             Node *next = n->nextSibling();
@@ -320,18 +325,17 @@ void InsertParagraphSeparatorCommand::doApply()
     // Handle whitespace that occurs after the split
     if (splitText) {
         updateLayout();
-        pos = Position(startNode, 0);
-        if (!pos.isRenderedCharacter()) {
+        insertionPosition = Position(insertionPosition.node(), 0);
+        if (!insertionPosition.isRenderedCharacter()) {
             // Clear out all whitespace and insert one non-breaking space
-            ASSERT(startNode);
-            ASSERT(startNode->isTextNode());
-            ASSERT(!startNode->renderer() || startNode->renderer()->style()->collapseWhiteSpace());
-            deleteInsignificantTextDownstream(pos);
-            insertTextIntoNode(static_cast<Text*>(startNode), 0, nonBreakingSpaceString());
+            ASSERT(insertionPosition.node()->isTextNode());
+            ASSERT(!insertionPosition.node()->renderer() || insertionPosition.node()->renderer()->style()->collapseWhiteSpace());
+            deleteInsignificantTextDownstream(insertionPosition);
+            insertTextIntoNode(static_cast<Text*>(insertionPosition.node()), 0, nonBreakingSpaceString());
         }
     }
 
-    setEndingSelection(Selection(Position(blockToInsert.get(), 0), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
     applyStyleAfterInsertion(startBlock);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
index 2f42f726dc..bf6fd19db3 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
@@ -89,19 +89,19 @@ bool InsertTextCommand::performTrivialReplace(const String& text, bool selectIns
     if (start.node() != end.node() || !start.node()->isTextNode() || isTabSpanTextNode(start.node()))
         return false;
         
-    replaceTextInNode(static_cast<Text*>(start.node()), start.offset(), end.offset() - start.offset(), text);
+    replaceTextInNode(static_cast<Text*>(start.node()), start.deprecatedEditingOffset(), end.deprecatedEditingOffset() - start.deprecatedEditingOffset(), text);
     
-    Position endPosition(start.node(), start.offset() + text.length());
+    Position endPosition(start.node(), start.deprecatedEditingOffset() + text.length());
     
     // We could have inserted a part of composed character sequence,
     // so we are basically treating ending selection as a range to avoid validation.
     // <http://bugs.webkit.org/show_bug.cgi?id=15781>
-    Selection forcedEndingSelection;
+    VisibleSelection forcedEndingSelection;
     forcedEndingSelection.setWithoutValidation(start, endPosition);
     setEndingSelection(forcedEndingSelection);
     
     if (!selectInsertedText)
-        setEndingSelection(Selection(endingSelection().visibleEnd()));
+        setEndingSelection(VisibleSelection(endingSelection().visibleEnd()));
     
     return true;
 }
@@ -130,8 +130,27 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
         deleteSelection(false, true, true, false);
     }
     
+    Position startPosition(endingSelection().start());
+    
+    Position placeholder;
+    // We want to remove preserved newlines and brs that will collapse (and thus become unnecessary) when content 
+    // is inserted just before them.
+    // FIXME: We shouldn't really have to do this, but removing placeholders is a workaround for 9661.
+    // If the caret is just before a placeholder, downstream will normalize the caret to it.
+    Position downstream(startPosition.downstream());
+    if (lineBreakExistsAtPosition(downstream)) {
+        // FIXME: This doesn't handle placeholders at the end of anonymous blocks.
+        VisiblePosition caret(startPosition);
+        if (isEndOfBlock(caret) && isStartOfParagraph(caret))
+            placeholder = downstream;
+        // Don't remove the placeholder yet, otherwise the block we're inserting into would collapse before
+        // we get a chance to insert into it.  We check for a placeholder now, though, because doing so requires
+        // the creation of a VisiblePosition, and if we did that post-insertion it would force a layout.
+    }
+    
     // Insert the character at the leftmost candidate.
-    Position startPosition = endingSelection().start().upstream();
+    startPosition = startPosition.upstream();
+    
     // It is possible for the node that contains startPosition to contain only unrendered whitespace,
     // and so deleteInsignificantText could remove it.  Save the position before the node in case that happens.
     Position positionBeforeStartNode(positionBeforeNode(startPosition.node()));
@@ -148,14 +167,16 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
     if (text == "\t") {
         endPosition = insertTab(startPosition);
         startPosition = endPosition.previous();
-        removePlaceholderAt(VisiblePosition(startPosition));
+        if (placeholder.isNotNull())
+            removePlaceholderAt(placeholder);
         m_charactersAdded += 1;
     } else {
         // Make sure the document is set up to receive text
         startPosition = prepareForTextInsertion(startPosition);
-        removePlaceholderAt(VisiblePosition(startPosition));
+        if (placeholder.isNotNull())
+            removePlaceholderAt(placeholder);
         Text *textNode = static_cast<Text *>(startPosition.node());
-        int offset = startPosition.offset();
+        int offset = startPosition.deprecatedEditingOffset();
 
         insertTextIntoNode(textNode, offset, text);
         endPosition = Position(textNode, offset + text.length());
@@ -172,7 +193,7 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
     // We could have inserted a part of composed character sequence,
     // so we are basically treating ending selection as a range to avoid validation.
     // <http://bugs.webkit.org/show_bug.cgi?id=15781>
-    Selection forcedEndingSelection;
+    VisibleSelection forcedEndingSelection;
     forcedEndingSelection.setWithoutValidation(startPosition, endPosition);
     setEndingSelection(forcedEndingSelection);
 
@@ -199,7 +220,7 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
         applyStyle(typingStyle);
 
     if (!selectInsertedText)
-        setEndingSelection(Selection(endingSelection().end(), endingSelection().affinity()));
+        setEndingSelection(VisibleSelection(endingSelection().end(), endingSelection().affinity()));
 }
 
 Position InsertTextCommand::insertTab(const Position& pos)
@@ -207,7 +228,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
     Position insertPos = VisiblePosition(pos, DOWNSTREAM).deepEquivalent();
         
     Node *node = insertPos.node();
-    unsigned int offset = insertPos.offset();
+    unsigned int offset = insertPos.deprecatedEditingOffset();
 
     // keep tabs coalesced in tab span
     if (isTabSpanTextNode(node)) {
@@ -232,7 +253,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
             // insert the span before it.
             if (offset > 0)
                 splitTextNode(textNode, offset);
-            insertNodeBefore(spanNode.get(), textNode);
+            insertNodeBefore(spanNode, textNode);
         }
     }
     
diff --git a/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp b/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp
index 7c14868510..9a7e105e32 100644
--- a/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp
@@ -27,8 +27,8 @@
 #include "ModifySelectionListLevel.h"
 
 #include "Document.h"
-#include "Element.h"
 #include "Frame.h"
+#include "HTMLElement.h"
 #include "RenderObject.h"
 #include "SelectionController.h"
 #include "htmlediting.h"
@@ -46,7 +46,7 @@ bool ModifySelectionListLevelCommand::preservesTypingStyle() const
 }
 
 // This needs to be static so it can be called by canIncreaseSelectionListLevel and canDecreaseSelectionListLevel
-static bool getStartEndListChildren(const Selection& selection, Node*& start, Node*& end)
+static bool getStartEndListChildren(const VisibleSelection& selection, Node*& start, Node*& end)
 {
     if (selection.isNone())
         return false;
@@ -79,8 +79,8 @@ static bool getStartEndListChildren(const Selection& selection, Node*& start, No
     // if the selection ends on a list item with a sublist, include the entire sublist
     if (endListChild->renderer()->isListItem()) {
         RenderObject* r = endListChild->renderer()->nextSibling();
-        if (r && isListElement(r->element()))
-            endListChild = r->element();
+        if (r && isListElement(r->node()))
+            endListChild = r->node();
     }
 
     start = startListChild;
@@ -141,7 +141,7 @@ IncreaseSelectionListLevelCommand::IncreaseSelectionListLevelCommand(Document* d
 }
 
 // This needs to be static so it can be called by canIncreaseSelectionListLevel
-static bool canIncreaseListLevel(const Selection& selection, Node*& start, Node*& end)
+static bool canIncreaseListLevel(const VisibleSelection& selection, Node*& start, Node*& end)
 {
     if (!getStartEndListChildren(selection, start, end))
         return false;
@@ -175,7 +175,7 @@ void IncreaseSelectionListLevelCommand::doApply()
     if (!canIncreaseListLevel(endingSelection(), startListChild, endListChild))
         return;
 
-    Node* previousItem = startListChild->renderer()->previousSibling()->element();
+    Node* previousItem = startListChild->renderer()->previousSibling()->node();
     if (isListElement(previousItem)) {
         // move nodes up into preceding list
         appendSiblingNodeRange(startListChild, endListChild, static_cast<Element*>(previousItem));
@@ -187,7 +187,7 @@ void IncreaseSelectionListLevelCommand::doApply()
             case InheritedListType:
                 newParent = startListChild->parentElement();
                 if (newParent)
-                    newParent = newParent->cloneElement();
+                    newParent = newParent->cloneElementWithoutChildren();
                 break;
             case OrderedList:
                 newParent = createOrderedListElement(document());
@@ -196,9 +196,9 @@ void IncreaseSelectionListLevelCommand::doApply()
                 newParent = createUnorderedListElement(document());
                 break;
         }
-        insertNodeBefore(newParent.get(), startListChild);
+        insertNodeBefore(newParent, startListChild);
         appendSiblingNodeRange(startListChild, endListChild, newParent.get());
-        m_listElement = newParent.get();
+        m_listElement = newParent.release();
     }
 }
 
@@ -239,7 +239,7 @@ DecreaseSelectionListLevelCommand::DecreaseSelectionListLevelCommand(Document* d
 }
 
 // This needs to be static so it can be called by canDecreaseSelectionListLevel
-static bool canDecreaseListLevel(const Selection& selection, Node*& start, Node*& end)
+static bool canDecreaseListLevel(const VisibleSelection& selection, Node*& start, Node*& end)
 {
     if (!getStartEndListChildren(selection, start, end))
         return false;
@@ -258,8 +258,8 @@ void DecreaseSelectionListLevelCommand::doApply()
     if (!canDecreaseListLevel(endingSelection(), startListChild, endListChild))
         return;
 
-    Node* previousItem = startListChild->renderer()->previousSibling() ? startListChild->renderer()->previousSibling()->element() : 0;
-    Node* nextItem = endListChild->renderer()->nextSibling() ? endListChild->renderer()->nextSibling()->element() : 0;
+    Node* previousItem = startListChild->renderer()->previousSibling() ? startListChild->renderer()->previousSibling()->node() : 0;
+    Node* nextItem = endListChild->renderer()->nextSibling() ? endListChild->renderer()->nextSibling()->node() : 0;
     Element* listNode = startListChild->parentElement();
 
     if (!previousItem) {
diff --git a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
index 08587cb5d1..0a2d3f4b0a 100644
--- a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
@@ -39,7 +39,7 @@ MoveSelectionCommand::MoveSelectionCommand(PassRefPtr<DocumentFragment> fragment
 
 void MoveSelectionCommand::doApply()
 {
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     ASSERT(selection.isRange());
 
     Position pos = m_position;
@@ -48,14 +48,14 @@ void MoveSelectionCommand::doApply()
         
     // Update the position otherwise it may become invalid after the selection is deleted.
     Node *positionNode = m_position.node();
-    int positionOffset = m_position.offset();
+    int positionOffset = m_position.deprecatedEditingOffset();
     Position selectionEnd = selection.end();
-    int selectionEndOffset = selectionEnd.offset();    
+    int selectionEndOffset = selectionEnd.deprecatedEditingOffset();
     if (selectionEnd.node() == positionNode && selectionEndOffset < positionOffset) {
         positionOffset -= selectionEndOffset;
         Position selectionStart = selection.start();
         if (selectionStart.node() == positionNode) {
-            positionOffset += selectionStart.offset();
+            positionOffset += selectionStart.deprecatedEditingOffset();
         }
         pos = Position(positionNode, positionOffset);
     }
@@ -69,7 +69,11 @@ void MoveSelectionCommand::doApply()
     if (!pos.node()->inDocument())
         pos = endingSelection().start();
 
-    setEndingSelection(Selection(pos, endingSelection().affinity()));
+    setEndingSelection(VisibleSelection(pos, endingSelection().affinity()));
+    if (!positionNode->inDocument()) {
+        // Document was modified out from under us.
+        return;
+    }
     applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartMove));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h b/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h
index fd8130775c..836f9d7e6c 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h
@@ -27,6 +27,7 @@
 #define RemoveCSSPropertyCommand_h
 
 #include "EditCommand.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
index 80e0ee7d4f..6d681ee4ee 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
@@ -27,10 +27,11 @@
 #include "RemoveFormatCommand.h"
 
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "Editor.h"
 #include "Frame.h"
 #include "HTMLNames.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
 #include "TypingCommand.h"
@@ -49,7 +50,7 @@ void RemoveFormatCommand::doApply()
     Frame* frame = document()->frame();
     
     // Make a plain text string from the selection to remove formatting like tables and lists.
-    String string = plainText(frame->selection()->selection().toRange().get());
+    String string = plainText(frame->selection()->selection().toNormalizedRange().get());
 
     // Get the default style for this editable root, it's the style that we'll give the
     // content that we're operating on.
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.cpp
deleted file mode 100644
index 817773dbef..0000000000
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.cpp
+++ /dev/null
@@ -1 +0,0 @@
-/* delete this file */
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.h b/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.h
deleted file mode 100644
index 8a2a98f212..0000000000
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.h
+++ /dev/null
@@ -1 +0,0 @@
-#error delete this file
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
index 98f4282bbf..1452f8803f 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
@@ -32,7 +32,8 @@
 namespace WebCore {
 
 RemoveNodePreservingChildrenCommand::RemoveNodePreservingChildrenCommand(PassRefPtr<Node> node)
-    : CompositeEditCommand(node->document()), m_node(node)
+    : CompositeEditCommand(node->document())
+    , m_node(node)
 {
     ASSERT(m_node);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
new file mode 100644
index 0000000000..21ca924629
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ReplaceNodeWithSpanCommand.h"
+
+#include "htmlediting.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "NamedAttrMap.h"
+
+#include <wtf/Assertions.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand(PassRefPtr<Node> node)
+    : CompositeEditCommand(node->document())
+    , m_node(node)
+{
+    ASSERT(m_node);
+}
+
+static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeToReplace)
+{
+    ASSERT(nodeToReplace->inDocument());
+    ExceptionCode ec = 0;
+    Node* parentNode = nodeToReplace->parentNode();
+    parentNode->insertBefore(newNode, nodeToReplace, ec);
+    ASSERT(!ec);
+
+    for (Node* child = nodeToReplace->firstChild(); child; child = child->nextSibling()) {
+        newNode->appendChild(child, ec);
+        ASSERT(!ec);
+    }
+
+    newNode->attributes()->setAttributes(*nodeToReplace->attributes());
+
+    parentNode->removeChild(nodeToReplace, ec);
+    ASSERT(!ec);
+}
+
+void ReplaceNodeWithSpanCommand::doApply()
+{
+    if (!m_node->inDocument())
+        return;
+    if (!m_spanElement)
+        m_spanElement = createHTMLElement(m_node->document(), spanTag);
+    swapInNodePreservingAttributesAndChildren(m_spanElement.get(), m_node.get());
+}
+
+void ReplaceNodeWithSpanCommand::doUnapply()
+{
+    if (!m_spanElement->inDocument())
+        return;
+    swapInNodePreservingAttributesAndChildren(m_node.get(), m_spanElement.get());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.h b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.h
new file mode 100644
index 0000000000..7b375b6976
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ReplaceNodeWithSpanCommand_h
+#define ReplaceNodeWithSpanCommand_h
+
+#include "CompositeEditCommand.h"
+
+namespace WebCore {
+
+class HTMLElement;
+
+// More accurately, this is ReplaceNodeWithSpanPreservingChildrenAndAttributesCommand
+class ReplaceNodeWithSpanCommand : public CompositeEditCommand {
+public:
+    static PassRefPtr<ReplaceNodeWithSpanCommand> create(PassRefPtr<Node> node)
+    {
+        return adoptRef(new ReplaceNodeWithSpanCommand(node));
+    }
+
+    HTMLElement* spanElement() { return m_spanElement.get(); }
+
+private:
+    ReplaceNodeWithSpanCommand(PassRefPtr<Node>);
+
+    virtual void doApply();
+    virtual void doUnapply();
+
+    RefPtr<Node> m_node;
+    RefPtr<HTMLElement> m_spanElement;
+};
+
+} // namespace WebCore
+
+#endif // ReplaceNodeWithSpanCommand
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
index 0a19c5e717..c6da8642af 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -28,20 +28,21 @@
 
 #include "ApplyStyleCommand.h"
 #include "BeforeTextInsertedEvent.h"
-#include "BreakBlockquoteCommand.h" 
+#include "BreakBlockquoteCommand.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "EditingText.h"
-#include "EventNames.h"
 #include "Element.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "HTMLElement.h"
-#include "HTMLInterchange.h"
 #include "HTMLInputElement.h"
+#include "HTMLInterchange.h"
 #include "HTMLNames.h"
 #include "SelectionController.h"
 #include "SmartReplace.h"
@@ -61,7 +62,7 @@ enum EFragmentType { EmptyFragment, SingleTextNodeFragment, TreeFragment };
 
 class ReplacementFragment : Noncopyable {
 public:
-    ReplacementFragment(Document*, DocumentFragment*, bool matchStyle, const Selection&);
+    ReplacementFragment(Document*, DocumentFragment*, bool matchStyle, const VisibleSelection&);
 
     Node* firstChild() const;
     Node* lastChild() const;
@@ -80,7 +81,7 @@ private:
     void restoreTestRenderingNodesToFragment(Node*);
     void removeInterchangeNodes(Node*);
     
-    void insertNodeBefore(Node* node, Node* refNode);
+    void insertNodeBefore(PassRefPtr<Node> node, Node* refNode);
 
     RefPtr<Document> m_document;
     RefPtr<DocumentFragment> m_fragment;
@@ -103,7 +104,7 @@ static bool isInterchangeConvertedSpaceSpan(const Node *node)
            static_cast<const HTMLElement *>(node)->getAttribute(classAttr) == convertedSpaceSpanClassString;
 }
 
-ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* fragment, bool matchStyle, const Selection& selection)
+ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* fragment, bool matchStyle, const VisibleSelection& selection)
     : m_document(document),
       m_fragment(fragment),
       m_matchStyle(matchStyle), 
@@ -124,10 +125,9 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     
     Node* shadowAncestorNode = editableRoot->shadowAncestorNode();
     
-    if (!editableRoot->inlineEventListenerForType(eventNames().webkitBeforeTextInsertedEvent) &&
+    if (!editableRoot->getAttributeEventListener(eventNames().webkitBeforeTextInsertedEvent) &&
         // FIXME: Remove these checks once textareas and textfields actually register an event handler.
-        !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextField()) &&
-        !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextArea()) &&
+        !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextControl()) &&
         editableRoot->isContentRichlyEditable()) {
         removeInterchangeNodes(m_fragment.get());
         return;
@@ -136,7 +136,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     Node* styleNode = selection.base().node();
     RefPtr<Node> holder = insertFragmentForTestRendering(styleNode);
     
-    RefPtr<Range> range = Selection::selectionFromContentsOfNode(holder.get()).toRange();
+    RefPtr<Range> range = VisibleSelection::selectionFromContentsOfNode(holder.get()).toNormalizedRange();
     String text = plainText(range.get());
     // Give the root a chance to change the text.
     RefPtr<BeforeTextInsertedEvent> evt = BeforeTextInsertedEvent::create(text);
@@ -147,7 +147,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
         restoreTestRenderingNodesToFragment(holder.get());
         removeNode(holder);
 
-        m_fragment = createFragmentFromText(selection.toRange().get(), evt->text());
+        m_fragment = createFragmentFromText(selection.toNormalizedRange().get(), evt->text());
         if (!m_fragment->firstChild())
             return;
         holder = insertFragmentForTestRendering(styleNode);
@@ -182,7 +182,7 @@ void ReplacementFragment::removeNodePreservingChildren(Node *node)
 
     while (RefPtr<Node> n = node->firstChild()) {
         removeNode(n);
-        insertNodeBefore(n.get(), node);
+        insertNodeBefore(n.release(), node);
     }
     removeNode(node);
 }
@@ -201,12 +201,12 @@ void ReplacementFragment::removeNode(PassRefPtr<Node> node)
     ASSERT(ec == 0);
 }
 
-void ReplacementFragment::insertNodeBefore(Node *node, Node *refNode)
+void ReplacementFragment::insertNodeBefore(PassRefPtr<Node> node, Node* refNode)
 {
     if (!node || !refNode)
         return;
         
-    Node *parent = refNode->parentNode();
+    Node* parent = refNode->parentNode();
     if (!parent)
         return;
         
@@ -311,7 +311,7 @@ void ReplacementFragment::removeInterchangeNodes(Node* container)
             RefPtr<Node> n = 0;
             while ((n = node->firstChild())) {
                 removeNode(n);
-                insertNodeBefore(n.get(), node);
+                insertNodeBefore(n, node);
             }
             removeNode(node);
             if (n)
@@ -344,14 +344,22 @@ static bool hasMatchingQuoteLevel(VisiblePosition endOfExistingContent, VisibleP
     return isInsideMailBlockquote && (numEnclosingMailBlockquotes(existing) == numEnclosingMailBlockquotes(inserted));
 }
 
-bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfParagraph, bool fragmentHasInterchangeNewlineAtStart)
+bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfParagraph, bool fragmentHasInterchangeNewlineAtStart, bool selectionStartWasInsideMailBlockquote)
 {
+    if (m_movingParagraph)
+        return false;
+    
     VisiblePosition startOfInsertedContent(positionAtStartOfInsertedContent());
     VisiblePosition prev = startOfInsertedContent.previous(true);
     if (prev.isNull())
         return false;
     
-    if (!m_movingParagraph && hasMatchingQuoteLevel(prev, positionAtEndOfInsertedContent()))
+    // When we have matching quote levels, its ok to merge more frequently.
+    // For a successful merge, we still need to make sure that the inserted content starts with the beginning of a paragraph.
+    // And we should only merge here if the selection start was inside a mail blockquote.  This prevents against removing a 
+    // blockquote from newly pasted quoted content that was pasted into an unquoted position.  If that unquoted position happens 
+    // to be right after another blockquote, we don't want to merge and risk stripping a valid block (and newline) from the pasted content.
+    if (isStartOfParagraph(startOfInsertedContent) && selectionStartWasInsideMailBlockquote && hasMatchingQuoteLevel(prev, positionAtEndOfInsertedContent()))
         return true;
 
     return !selectionStartWasStartOfParagraph && 
@@ -406,6 +414,23 @@ void ReplaceSelectionCommand::removeNodeAndPruneAncestors(Node* node)
         m_firstNodeInserted = m_lastLeafInserted && m_lastLeafInserted->inDocument() ? afterFirst : 0;
 }
 
+static bool isHeaderElement(Node* a)
+{
+    if (!a)
+        return false;
+        
+    return a->hasTagName(h1Tag) ||
+           a->hasTagName(h2Tag) ||
+           a->hasTagName(h3Tag) ||
+           a->hasTagName(h4Tag) ||
+           a->hasTagName(h5Tag);
+}
+
+static bool haveSameTagName(Node* a, Node* b)
+{
+    return a && b && a->isElementNode() && b->isElementNode() && static_cast<Element*>(a)->tagName() == static_cast<Element*>(b)->tagName();
+}
+
 bool ReplaceSelectionCommand::shouldMerge(const VisiblePosition& source, const VisiblePosition& destination)
 {
     if (source.isNull() || destination.isNull())
@@ -414,10 +439,12 @@ bool ReplaceSelectionCommand::shouldMerge(const VisiblePosition& source, const V
     Node* sourceNode = source.deepEquivalent().node();
     Node* destinationNode = destination.deepEquivalent().node();
     Node* sourceBlock = enclosingBlock(sourceNode);
+    Node* destinationBlock = enclosingBlock(destinationNode);
     return !enclosingNodeOfType(source.deepEquivalent(), &isMailPasteAsQuotationNode) &&
            sourceBlock && (!sourceBlock->hasTagName(blockquoteTag) || isMailBlockquote(sourceBlock))  &&
            enclosingListChild(sourceBlock) == enclosingListChild(destinationNode) &&
            enclosingTableCell(source.deepEquivalent()) == enclosingTableCell(destination.deepEquivalent()) &&
+           (!isHeaderElement(sourceBlock) || haveSameTagName(sourceBlock, destinationBlock)) &&
            // Don't merge to or from a position before or after a block because it would
            // be a no-op and cause infinite recursion.
            !isBlock(sourceNode) && !isBlock(destinationNode);
@@ -491,10 +518,11 @@ void ReplaceSelectionCommand::handlePasteAsQuotationNode()
 VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent()
 {
     Node* lastNode = m_lastLeafInserted.get();
-    Node* enclosingSelect = enclosingNodeWithTag(Position(lastNode, 0), selectTag);
+    // FIXME: Why is this hack here?  What's special about <select> tags?
+    Node* enclosingSelect = enclosingNodeWithTag(firstDeepEditingPositionForNode(lastNode), selectTag);
     if (enclosingSelect)
         lastNode = enclosingSelect;
-    return VisiblePosition(Position(lastNode, maxDeepOffset(lastNode)));
+    return lastDeepEditingPositionForNode(lastNode);
 }
 
 VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent()
@@ -509,8 +537,9 @@ static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const
 {
     Node* topNode = fragment.firstChild();
     
-    // Handling this case is more complicated (see handleStyleSpans) and doesn't receive the optimization.
-    if (isMailPasteAsQuotationNode(topNode))
+    // Handling the case where we are doing Paste as Quotation or pasting into quoted content is more complicated (see handleStyleSpans)
+    // and doesn't receive the optimization.
+    if (isMailPasteAsQuotationNode(topNode) || nearestMailBlockquote(topNode))
         return false;
     
     // Either there are no style spans in the fragment or a WebKit client has added content to the fragment
@@ -573,11 +602,12 @@ void ReplaceSelectionCommand::handleStyleSpans()
     RefPtr<CSSMutableStyleDeclaration> sourceDocumentStyle = static_cast<HTMLElement*>(sourceDocumentStyleSpan)->getInlineStyleDecl()->copy();
     Node* context = sourceDocumentStyleSpan->parentNode();
     
-    // If Mail wraps the fragment with a Paste as Quotation blockquote, styles from that element are
-    // allowed to override those from the source document, see <rdar://problem/4930986>.
-    if (isMailPasteAsQuotationNode(context)) {
-        RefPtr<CSSMutableStyleDeclaration> blockquoteStyle = computedStyle(context)->copyInheritableProperties();
-        RefPtr<CSSMutableStyleDeclaration> parentStyle = computedStyle(context->parentNode())->copyInheritableProperties();
+    // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
+    // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
+    Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : nearestMailBlockquote(context);
+    if (blockquoteNode) {
+        RefPtr<CSSMutableStyleDeclaration> blockquoteStyle = computedStyle(blockquoteNode)->copyInheritableProperties();
+        RefPtr<CSSMutableStyleDeclaration> parentStyle = computedStyle(blockquoteNode->parentNode())->copyInheritableProperties();
         parentStyle->diff(blockquoteStyle.get());
 
         CSSMutableStyleDeclaration::const_iterator end = blockquoteStyle->end();
@@ -586,7 +616,7 @@ void ReplaceSelectionCommand::handleStyleSpans()
             sourceDocumentStyle->removeProperty(property.id());
         }        
 
-        context = context->parentNode();
+        context = blockquoteNode->parentNode();
     }
     
     RefPtr<CSSMutableStyleDeclaration> contextStyle = computedStyle(context)->copyInheritableProperties();
@@ -669,7 +699,8 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
     // Merging forward will remove m_lastLeafInserted from the document.
     // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
-    // only ever used to create positions where inserted content starts/ends.
+    // only ever used to create positions where inserted content starts/ends.  Also, we sometimes insert content
+    // directly into text nodes already in the document, in which case tracking inserted nodes is inadequate.
     if (mergeForward) {
         m_lastLeafInserted = destination.previous().deepEquivalent().node();
         if (!m_firstNodeInserted->inDocument())
@@ -679,7 +710,7 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
 
 void ReplaceSelectionCommand::doApply()
 {
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     ASSERT(selection.isCaretOrRange());
     ASSERT(selection.start().node());
     if (selection.isNone() || !selection.start().node())
@@ -690,6 +721,9 @@ void ReplaceSelectionCommand::doApply()
     Element* currentRoot = selection.rootEditableElement();
     ReplacementFragment fragment(document(), m_documentFragment.get(), m_matchStyle, selection);
     
+    if (performTrivialReplace(fragment))
+        return;
+    
     if (m_matchStyle)
         m_insertionStyle = styleAtPosition(selection.start());
     
@@ -704,9 +738,9 @@ void ReplaceSelectionCommand::doApply()
     Position insertionPos = selection.start();
     bool startIsInsideMailBlockquote = nearestMailBlockquote(insertionPos.node());
     
-    if (selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote ||
+    if ((selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote) ||
         startBlock == currentRoot ||
-        startBlock && startBlock->renderer() && startBlock->renderer()->isListItem() ||
+        (startBlock && startBlock->renderer() && startBlock->renderer()->isListItem()) ||
         selectionIsPlainText)
         m_preventNesting = false;
     
@@ -751,9 +785,10 @@ void ReplaceSelectionCommand::doApply()
         insertionPos = endingSelection().start();
     }
     
-    if (startIsInsideMailBlockquote && m_preventNesting) { 
-        // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break 
-        // out of any surrounding Mail blockquotes. 
+    // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break 
+    // out of any surrounding Mail blockquotes. Unless we're inserting in a table, in which case
+    // breaking the blockquote will prevent the content from actually being inserted in the table.
+    if (startIsInsideMailBlockquote && m_preventNesting && !(enclosingNodeOfType(insertionPos, &isTableStructureNode))) { 
         applyCommandToComposite(BreakBlockquoteCommand::create(document())); 
         // This will leave a br between the split. 
         Node* br = endingSelection().start().node(); 
@@ -800,6 +835,9 @@ void ReplaceSelectionCommand::doApply()
     
     bool handledStyleSpans = handleStyleSpansBeforeInsertion(fragment, insertionPos);
     
+    // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
+    // again here if they've been removed.
+    
     // We're finished if there is nothing to add.
     if (fragment.isEmpty() || !fragment.firstChild())
         return;
@@ -820,12 +858,21 @@ void ReplaceSelectionCommand::doApply()
     RefPtr<Node> node = refNode->nextSibling();
     
     fragment.removeNode(refNode);
-    insertNodeAtAndUpdateNodesInserted(refNode.get(), insertionPos);
-    
+    insertNodeAtAndUpdateNodesInserted(refNode, insertionPos);
+
+    // Mutation events (bug 22634) may have already removed the inserted content
+    if (!refNode->inDocument())
+        return;
+
     while (node) {
         Node* next = node->nextSibling();
         fragment.removeNode(node);
-        insertNodeAfterAndUpdateNodesInserted(node.get(), refNode.get());
+        insertNodeAfterAndUpdateNodesInserted(node, refNode.get());
+
+        // Mutation events (bug 22634) may have already removed the inserted content
+        if (!node->inDocument())
+            return;
+
         refNode = node;
         node = next;
     }
@@ -846,7 +893,7 @@ void ReplaceSelectionCommand::doApply()
     
     // We inserted before the startBlock to prevent nesting, and the content before the startBlock wasn't in its own block and
     // didn't have a br after it, so the inserted content ended up in the same paragraph.
-    if (startBlock && insertionPos.node() == startBlock->parentNode() && (unsigned)insertionPos.offset() < startBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
+    if (startBlock && insertionPos.node() == startBlock->parentNode() && (unsigned)insertionPos.deprecatedEditingOffset() < startBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
         insertNodeAt(createBreakElement(document()).get(), startOfInsertedContent.deepEquivalent());
     
     Position lastPositionToSelect;
@@ -860,13 +907,7 @@ void ReplaceSelectionCommand::doApply()
     // the start merge so that the start merge doesn't effect our decision.
     m_shouldMergeEnd = shouldMergeEnd(selectionEndWasEndOfParagraph);
     
-    if (shouldMergeStart(selectionStartWasStartOfParagraph, fragment.hasInterchangeNewlineAtStart())) {
-        // Bail to avoid infinite recursion.
-        if (m_movingParagraph) {
-            // setting display:inline does not work for td elements in quirks mode
-            ASSERT(m_firstNodeInserted->hasTagName(tdTag));
-            return;
-        }
+    if (shouldMergeStart(selectionStartWasStartOfParagraph, fragment.hasInterchangeNewlineAtStart(), startIsInsideMailBlockquote)) {
         VisiblePosition destination = startOfInsertedContent.previous();
         VisiblePosition startOfParagraphToMove = startOfInsertedContent;
         
@@ -878,9 +919,13 @@ void ReplaceSelectionCommand::doApply()
         // Insert a line break just after the inserted content to separate it from what 
         // comes after and prevent that from happening.
         VisiblePosition endOfInsertedContent = positionAtEndOfInsertedContent();
-        if (startOfParagraph(endOfInsertedContent) == startOfParagraphToMove)
+        if (startOfParagraph(endOfInsertedContent) == startOfParagraphToMove) {
             insertNodeAt(createBreakElement(document()).get(), endOfInsertedContent.deepEquivalent());
-        
+            // Mutation events (bug 22634) triggered by inserting the <br> might have removed the content we're about to move
+            if (!startOfParagraphToMove.deepEquivalent().node()->inDocument())
+                return;
+        }
+
         // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
         // only ever used to create positions where inserted content starts/ends.
         moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
@@ -938,7 +983,7 @@ void ReplaceSelectionCommand::doApply()
                 insertTextIntoNode(text, text->length(), collapseWhiteSpace ? nonBreakingSpaceString() : " ");
             } else {
                 RefPtr<Node> node = document()->createEditingTextNode(collapseWhiteSpace ? nonBreakingSpaceString() : " ");
-                insertNodeAfterAndUpdateNodesInserted(node.get(), endNode);
+                insertNodeAfterAndUpdateNodesInserted(node, endNode);
             }
         }
     
@@ -955,7 +1000,7 @@ void ReplaceSelectionCommand::doApply()
                 RefPtr<Node> node = document()->createEditingTextNode(collapseWhiteSpace ? nonBreakingSpaceString() : " ");
                 // Don't updateNodesInserted.  Doing so would set m_lastLeafInserted to be the node containing the 
                 // leading space, but m_lastLeafInserted is supposed to mark the end of pasted content.
-                insertNodeBefore(node.get(), startNode);
+                insertNodeBefore(node, startNode);
                 // FIXME: Use positions to track the start/end of inserted content.
                 m_firstNodeInserted = node;
             }
@@ -1013,9 +1058,9 @@ void ReplaceSelectionCommand::completeHTMLReplacement(const Position &lastPositi
         return;
     
     if (m_selectReplacement)
-        setEndingSelection(Selection(start, end, SEL_DEFAULT_AFFINITY));
+        setEndingSelection(VisibleSelection(start, end, SEL_DEFAULT_AFFINITY));
     else
-        setEndingSelection(Selection(end, SEL_DEFAULT_AFFINITY));
+        setEndingSelection(VisibleSelection(end, SEL_DEFAULT_AFFINITY));
 }
 
 EditAction ReplaceSelectionCommand::editingAction() const
@@ -1023,22 +1068,25 @@ EditAction ReplaceSelectionCommand::editingAction() const
     return m_editAction;
 }
 
-void ReplaceSelectionCommand::insertNodeAfterAndUpdateNodesInserted(Node *insertChild, Node *refChild)
+void ReplaceSelectionCommand::insertNodeAfterAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild)
 {
+    Node* nodeToUpdate = insertChild.get(); // insertChild will be cleared when passed
     insertNodeAfter(insertChild, refChild);
-    updateNodesInserted(insertChild);
+    updateNodesInserted(nodeToUpdate);
 }
 
-void ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted(Node *insertChild, const Position& p)
+void ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted(PassRefPtr<Node> insertChild, const Position& p)
 {
+    Node* nodeToUpdate = insertChild.get(); // insertChild will be cleared when passed
     insertNodeAt(insertChild, p);
-    updateNodesInserted(insertChild);
+    updateNodesInserted(nodeToUpdate);
 }
 
-void ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted(Node *insertChild, Node *refChild)
+void ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild)
 {
+    Node* nodeToUpdate = insertChild.get(); // insertChild will be cleared when passed
     insertNodeBefore(insertChild, refChild);
-    updateNodesInserted(insertChild);
+    updateNodesInserted(nodeToUpdate);
 }
 
 void ReplaceSelectionCommand::updateNodesInserted(Node *node)
@@ -1055,4 +1103,38 @@ void ReplaceSelectionCommand::updateNodesInserted(Node *node)
     m_lastLeafInserted = node->lastDescendant();
 }
 
+// During simple pastes, where we're just pasting a text node into a run of text, we insert the text node
+// directly into the text node that holds the selection.  This is much faster than the generalized code in
+// ReplaceSelectionCommand, and works around <https://bugs.webkit.org/show_bug.cgi?id=6148> since we don't 
+// split text nodes.
+bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& fragment)
+{
+    if (!fragment.firstChild() || fragment.firstChild() != fragment.lastChild() || !fragment.firstChild()->isTextNode())
+        return false;
+        
+    // FIXME: Would be nice to handle smart replace in the fast path.
+    if (m_smartReplace || fragment.hasInterchangeNewlineAtStart() || fragment.hasInterchangeNewlineAtEnd())
+        return false;
+    
+    Text* textNode = static_cast<Text*>(fragment.firstChild());
+    // Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
+    String text(textNode->data());
+    
+    Position start = endingSelection().start();
+    Position end = endingSelection().end();
+    
+    if (start.anchorNode() != end.anchorNode() || !start.anchorNode()->isTextNode())
+        return false;
+        
+    replaceTextInNode(static_cast<Text*>(start.anchorNode()), start.offsetInContainerNode(), end.offsetInContainerNode() - start.offsetInContainerNode(), text);
+    
+    end = Position(start.anchorNode(), start.offsetInContainerNode() + text.length());
+    
+    VisibleSelection selectionAfterReplace(m_selectReplacement ? start : end, end);
+    
+    setEndingSelection(selectionAfterReplace);
+    
+    return true;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
index 76f0a58ee9..1cb93c369b 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
@@ -31,6 +31,7 @@
 namespace WebCore {
 
 class DocumentFragment;
+class ReplacementFragment;
 
 class ReplaceSelectionCommand : public CompositeEditCommand {
 public:
@@ -50,14 +51,14 @@ private:
 
     void completeHTMLReplacement(const Position& lastPositionToSelect);
 
-    void insertNodeAfterAndUpdateNodesInserted(Node* insertChild, Node* refChild);
-    void insertNodeAtAndUpdateNodesInserted(Node*, const Position&);
-    void insertNodeBeforeAndUpdateNodesInserted(Node* insertChild, Node* refChild);
+    void insertNodeAfterAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
+    void insertNodeAtAndUpdateNodesInserted(PassRefPtr<Node>, const Position&);
+    void insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
 
     void updateNodesInserted(Node*);
     bool shouldRemoveEndBR(Node*, const VisiblePosition&);
     
-    bool shouldMergeStart(bool, bool);
+    bool shouldMergeStart(bool, bool, bool);
     bool shouldMergeEnd(bool selectEndWasEndOfParagraph);
     bool shouldMerge(const VisiblePosition&, const VisiblePosition&);
     
@@ -74,6 +75,8 @@ private:
     
     VisiblePosition positionAtStartOfInsertedContent();
     VisiblePosition positionAtEndOfInsertedContent();
+    
+    bool performTrivialReplace(const ReplacementFragment&);
 
     RefPtr<Node> m_firstNodeInserted;
     RefPtr<Node> m_lastLeafInserted;
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
index a027aa4d60..d0427c00d4 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
@@ -32,9 +32,9 @@
 #include "Editor.h"
 #include "Element.h"
 #include "EventHandler.h"
-#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FocusController.h"
+#include "FloatQuad.h"
 #include "Frame.h"
 #include "FrameTree.h"
 #include "FrameView.h"
@@ -69,36 +69,36 @@ SelectionController::SelectionController(Frame* frame, bool isDragCaretControlle
     , m_lastChangeWasHorizontalExtension(false)
     , m_isDragCaretController(isDragCaretController)
     , m_isCaretBlinkingSuspended(false)
-    , m_focused(false)
+    , m_focused(frame && frame->page() && frame->page()->focusController()->focusedFrame() == frame)
 {
 }
 
 void SelectionController::moveTo(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(Selection(pos.deepEquivalent(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(pos.deepEquivalent(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const VisiblePosition &base, const VisiblePosition &extent, bool userTriggered)
 {
-    setSelection(Selection(base.deepEquivalent(), extent.deepEquivalent(), base.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(base.deepEquivalent(), extent.deepEquivalent(), base.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(pos, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(pos, affinity), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Range *r, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(startPosition(r), endPosition(r), affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(startPosition(r), endPosition(r), affinity), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Position &base, const Position &extent, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(base, extent, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(base, extent, affinity), true, true, userTriggered);
 }
 
-void SelectionController::setSelection(const Selection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered)
+void SelectionController::setSelection(const VisibleSelection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered)
 {
     if (m_isDragCaretController) {
         invalidateCaretRect();
@@ -111,9 +111,16 @@ void SelectionController::setSelection(const Selection& s, bool closeTyping, boo
         m_sel = s;
         return;
     }
+
+    Node* baseNode = s.base().node();
+    Document* document = 0;
+    if (baseNode)
+        document = baseNode->document();
     
-    if (s.base().node() && s.base().node()->document() != m_frame->document()) {
-        s.base().node()->document()->frame()->selection()->setSelection(s, closeTyping, clearTypingStyle, userTriggered);
+    // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at SelectionController::setSelection
+    // if document->frame() == m_frame we can get into an infinite loop
+    if (document && document->frame() != m_frame && document != m_frame->document()) {
+        document->frame()->selection()->setSelection(s, closeTyping, clearTypingStyle, userTriggered);
         return;
     }
     
@@ -126,7 +133,7 @@ void SelectionController::setSelection(const Selection& s, bool closeTyping, boo
     if (m_sel == s)
         return;
     
-    Selection oldSelection = m_sel;
+    VisibleSelection oldSelection = m_sel;
 
     m_sel = s;
     
@@ -143,7 +150,7 @@ void SelectionController::setSelection(const Selection& s, bool closeTyping, boo
     m_frame->notifyRendererOfSelectionChange(userTriggered);
     m_frame->respondToChangedSelection(oldSelection, closeTyping);
     if (userTriggered)
-        m_frame->revealCaret(RenderLayer::gAlignToEdgeIfNeeded);
+        m_frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded, true);
 
     notifyAccessibilityForSelectionChange();
 }
@@ -195,8 +202,7 @@ void SelectionController::nodeWillBeRemoved(Node *node)
         else
             m_sel.setWithoutValidation(m_sel.end(), m_sel.start());
     // FIXME: This could be more efficient if we had an isNodeInRange function on Ranges.
-    } else if (Range::compareBoundaryPoints(m_sel.start(), Position(node, 0)) == -1 &&
-               Range::compareBoundaryPoints(m_sel.end(), Position(node, 0)) == 1) {
+    } else if (comparePositions(m_sel.start(), Position(node, 0)) == -1 && comparePositions(m_sel.end(), Position(node, 0)) == 1) {
         // If we did nothing here, when this node's renderer was destroyed, the rect that it 
         // occupied would be invalidated, but, selection gaps that change as a result of 
         // the removal wouldn't be invalidated.
@@ -206,13 +212,13 @@ void SelectionController::nodeWillBeRemoved(Node *node)
 
     if (clearRenderTreeSelection) {
         RefPtr<Document> document = m_sel.start().node()->document();
-        document->updateRendering();
-        if (RenderView* view = static_cast<RenderView*>(document->renderer()))
+        document->updateStyleIfNeeded();
+        if (RenderView* view = toRenderView(document->renderer()))
             view->clearSelection();
     }
 
     if (clearDOMTreeSelection)
-        setSelection(Selection(), false, false);
+        setSelection(VisibleSelection(), false, false);
 }
 
 void SelectionController::willBeModified(EAlteration alter, EDirection direction)
@@ -244,7 +250,53 @@ void SelectionController::willBeModified(EAlteration alter, EDirection direction
     }
 }
 
-VisiblePosition SelectionController::modifyExtendingRightForward(TextGranularity granularity)
+TextDirection SelectionController::directionOfEnclosingBlock() {
+    Node* n = m_sel.extent().node();
+    Node* enclosingBlockNode = enclosingBlock(n);
+    if (!enclosingBlockNode)
+        return LTR;
+    RenderObject* renderer = enclosingBlockNode->renderer();
+    if (renderer)
+        return renderer->style()->direction();
+    return LTR;
+}
+
+VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granularity)
+{
+    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+
+    // The difference between modifyExtendingRight and modifyExtendingForward is:
+    // modifyExtendingForward always extends forward logically.
+    // modifyExtendingRight behaves the same as modifyExtendingForward except for extending character or word,
+    // it extends forward logically if the enclosing block is LTR direction,
+    // but it extends backward logically if the enclosing block is RTL direction.
+    switch (granularity) {
+        case CharacterGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = pos.next(true);                
+            else
+                pos = pos.previous(true);
+            break;
+        case WordGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = nextWordPosition(pos);
+            else
+                pos = previousWordPosition(pos);
+            break;
+        case SentenceGranularity:
+        case LineGranularity:
+        case ParagraphGranularity:
+        case SentenceBoundary:
+        case LineBoundary:
+        case ParagraphBoundary:
+        case DocumentBoundary:
+            // FIXME: implement all of the above?
+            pos = modifyExtendingForward(granularity);
+    }
+    return pos;
+}    
+        
+VisiblePosition SelectionController::modifyExtendingForward(TextGranularity granularity)
 {
     VisiblePosition pos(m_sel.extent(), m_sel.affinity());
     switch (granularity) {
@@ -267,7 +319,7 @@ VisiblePosition SelectionController::modifyExtendingRightForward(TextGranularity
             pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = endOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
@@ -341,7 +393,7 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
             pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = endOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
@@ -358,10 +410,44 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
     return pos;
 }
 
-VisiblePosition SelectionController::modifyExtendingLeftBackward(TextGranularity granularity)
+VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granularity)
 {
     VisiblePosition pos(m_sel.extent(), m_sel.affinity());
-        
+
+    // The difference between modifyExtendingLeft and modifyExtendingBackward is:
+    // modifyExtendingBackward always extends backward logically.
+    // modifyExtendingLeft behaves the same as modifyExtendingBackward except for extending character or word,
+    // it extends backward logically if the enclosing block is LTR direction,
+    // but it extends forward logically if the enclosing block is RTL direction.
+    switch (granularity) {
+        case CharacterGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = pos.previous(true);
+            else
+                pos = pos.next(true);
+            break;
+        case WordGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = previousWordPosition(pos);
+            else
+                pos = nextWordPosition(pos);
+            break;
+        case SentenceGranularity:
+        case LineGranularity:
+        case ParagraphGranularity:
+        case SentenceBoundary:
+        case LineBoundary:
+        case ParagraphBoundary:
+        case DocumentBoundary:
+            pos = modifyExtendingBackward(granularity);
+    }
+    return pos;
+}
+       
+VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity granularity)
+{
+    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+
     // Extending a selection backward by word or character from just after a table selects
     // the table.  This "makes sense" from the user perspective, esp. when deleting.
     // It was done here instead of in VisiblePosition because we want VPs to iterate
@@ -386,7 +472,7 @@ VisiblePosition SelectionController::modifyExtendingLeftBackward(TextGranularity
             pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = startOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
@@ -453,7 +539,7 @@ VisiblePosition SelectionController::modifyMovingBackward(TextGranularity granul
             pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = startOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
@@ -493,11 +579,11 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
             if (alter == MOVE)
                 pos = modifyMovingRight(granularity);
             else
-                pos = modifyExtendingRightForward(granularity);
+                pos = modifyExtendingRight(granularity);
             break;
         case FORWARD:
             if (alter == EXTEND)
-                pos = modifyExtendingRightForward(granularity);
+                pos = modifyExtendingForward(granularity);
             else
                 pos = modifyMovingForward(granularity);
             break;
@@ -505,11 +591,11 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
             if (alter == MOVE)
                 pos = modifyMovingLeft(granularity);
             else
-                pos = modifyExtendingLeftBackward(granularity);
+                pos = modifyExtendingLeft(granularity);
             break;
         case BACKWARD:
             if (alter == EXTEND)
-                pos = modifyExtendingLeftBackward(granularity);
+                pos = modifyExtendingBackward(granularity);
             else
                 pos = modifyMovingBackward(granularity);
             break;
@@ -692,27 +778,27 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
 
 void SelectionController::clear()
 {
-    setSelection(Selection());
+    setSelection(VisibleSelection());
 }
 
 void SelectionController::setBase(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(Selection(pos.deepEquivalent(), m_sel.extent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(pos.deepEquivalent(), m_sel.extent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(Selection(m_sel.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(m_sel.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setBase(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(pos, m_sel.extent(), affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(pos, m_sel.extent(), affinity), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(m_sel.base(), pos, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(m_sel.base(), pos, affinity), true, true, userTriggered);
 }
 
 void SelectionController::setNeedsLayout(bool flag)
@@ -727,7 +813,7 @@ void SelectionController::layout()
         return;
     }
 
-    m_sel.start().node()->document()->updateRendering();
+    m_sel.start().node()->document()->updateStyleIfNeeded();
     
     m_caretRect = IntRect();
         
@@ -788,11 +874,20 @@ RenderObject* SelectionController::caretRenderer() const
 IntRect SelectionController::localCaretRect() const
 {
     if (m_needsLayout)
-        const_cast<SelectionController *>(this)->layout();
+        const_cast<SelectionController*>(this)->layout();
     
     return m_caretRect;
 }
 
+IntRect SelectionController::absoluteBoundsForLocalRect(const IntRect& rect) const
+{
+    RenderObject* caretPainter = caretRenderer();
+    if (!caretPainter)
+        return IntRect();
+        
+    return caretPainter->localToAbsoluteQuad(FloatRect(rect)).enclosingBoundingBox();
+}
+
 IntRect SelectionController::absoluteCaretBounds()
 {
     recomputeCaretRect();
@@ -811,18 +906,12 @@ static IntRect repaintRectForCaret(IntRect caret)
 
 IntRect SelectionController::caretRepaintRect() const
 {
-    IntRect localRect = repaintRectForCaret(localCaretRect());
-    
-    RenderObject* caretPainter = caretRenderer();
-    if (caretPainter)
-        return caretPainter->localToAbsoluteQuad(FloatRect(localRect)).enclosingBoundingBox();
-
-    return IntRect();
+    return absoluteBoundsForLocalRect(repaintRectForCaret(localCaretRect()));
 }
 
 bool SelectionController::recomputeCaretRect()
 {
-    if (!m_frame || !m_frame->document())
+    if (!m_frame)
         return false;
         
     FrameView* v = m_frame->document()->view();
@@ -833,21 +922,26 @@ bool SelectionController::recomputeCaretRect()
         return false;
 
     IntRect oldRect = m_caretRect;
-    m_needsLayout = true;
     IntRect newRect = localCaretRect();
     if (oldRect == newRect && !m_absCaretBoundsDirty)
         return false;
 
-    IntRect oldAbsRepaintRect = m_absCaretBounds;
-    m_absCaretBounds = caretRepaintRect();
+    IntRect oldAbsCaretBounds = m_absCaretBounds;
+    // FIXME: Rename m_caretRect to m_localCaretRect.
+    m_absCaretBounds = absoluteBoundsForLocalRect(m_caretRect);
     m_absCaretBoundsDirty = false;
     
-    if (oldAbsRepaintRect == m_absCaretBounds)
+    if (oldAbsCaretBounds == m_absCaretBounds)
         return false;
+        
+    IntRect oldAbsoluteCaretRepaintBounds = m_absoluteCaretRepaintBounds;
+    // We believe that we need to inflate the local rect before transforming it to obtain the repaint bounds.
+    m_absoluteCaretRepaintBounds = caretRepaintRect();
     
-    if (RenderView* view = static_cast<RenderView*>(m_frame->document()->renderer())) {
-        view->repaintViewRectangle(oldAbsRepaintRect, false);
-        view->repaintViewRectangle(m_absCaretBounds, false);
+    if (RenderView* view = toRenderView(m_frame->document()->renderer())) {
+        // FIXME: make caret repainting container-aware.
+        view->repaintRectangleInViewAndCompositedLayers(oldAbsoluteCaretRepaintBounds, false);
+        view->repaintRectangleInViewAndCompositedLayers(m_absoluteCaretRepaintBounds, false);
     }
 
     return true;
@@ -878,8 +972,8 @@ void SelectionController::invalidateCaretRect()
     m_needsLayout = true;
 
     if (!caretRectChanged) {
-        if (RenderView* view = static_cast<RenderView*>(d->renderer()))
-            view->repaintViewRectangle(caretRepaintRect(), false);
+        if (RenderView* view = toRenderView(d->renderer()))
+            view->repaintRectangleInViewAndCompositedLayers(caretRepaintRect(), false);
     }
 }
 
@@ -911,7 +1005,7 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         fprintf(stderr, "%s%s\n", selected ? "==> " : "    ", element->localName().string().utf8().data());
     }
     else if (r->isText()) {
-        RenderText* textRenderer = static_cast<RenderText*>(r);
+        RenderText* textRenderer = toRenderText(r);
         if (textRenderer->textLength() == 0 || !textRenderer->firstTextBox()) {
             fprintf(stderr, "%s#text (empty)\n", selected ? "==> " : "    ");
             return;
@@ -923,13 +1017,13 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         if (selected) {
             int offset = 0;
             if (r->node() == m_sel.start().node())
-                offset = m_sel.start().offset();
+                offset = m_sel.start().deprecatedEditingOffset();
             else if (r->node() == m_sel.end().node())
-                offset = m_sel.end().offset();
+                offset = m_sel.end().deprecatedEditingOffset();
                 
             int pos;
             InlineTextBox *box = textRenderer->findNextInlineTextBox(offset, pos);
-            text = text.substring(box->m_start, box->m_len);
+            text = text.substring(box->start(), box->len());
             
             String show;
             int mid = max / 2;
@@ -987,9 +1081,10 @@ bool SelectionController::contains(const IntPoint& point)
     if (!document->renderer()) 
         return false;
     
-    HitTestRequest request(true, true);
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active);
     HitTestResult result(point);
-    document->renderer()->layer()->hitTest(request, result);
+    document->renderView()->layer()->hitTest(request, result);
     Node* innerNode = result.innerNode();
     if (!innerNode || !innerNode->renderer())
         return false;
@@ -1033,8 +1128,6 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
 
     // Get to the <iframe> or <frame> (or even <object>) element in the parent frame.
     Document* doc = m_frame->document();
-    if (!doc)
-        return;
     Element* ownerElement = doc->ownerElement();
     if (!ownerElement)
         return;
@@ -1052,7 +1145,7 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
     VisiblePosition afterOwnerElement(VisiblePosition(ownerElementParent, ownerElementNodeIndex + 1, VP_UPSTREAM_IF_POSSIBLE));
 
     // Focus on the parent frame, and then select from before this element to after.
-    Selection newSelection(beforeOwnerElement, afterOwnerElement);
+    VisibleSelection newSelection(beforeOwnerElement, afterOwnerElement);
     if (parent->shouldChangeSelection(newSelection)) {
         page->focusController()->setFocusedFrame(parent);
         parent->selection()->setSelection(newSelection);
@@ -1062,8 +1155,6 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
 void SelectionController::selectAll()
 {
     Document* document = m_frame->document();
-    if (!document)
-        return;
     
     if (document->focusedNode() && document->focusedNode()->canSelectAll()) {
         document->focusedNode()->selectAll();
@@ -1080,7 +1171,7 @@ void SelectionController::selectAll()
     }
     if (!root)
         return;
-    Selection newSelection(Selection::selectionFromContentsOfNode(root));
+    VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root));
     if (m_frame->shouldChangeSelection(newSelection))
         setSelection(newSelection);
     selectFrameElementInParentIfFullySelected();
@@ -1124,7 +1215,7 @@ bool SelectionController::setSelectedRange(Range* range, EAffinity affinity, boo
     // FIXME: Can we provide extentAffinity?
     VisiblePosition visibleStart(startContainer, startOffset, collapsed ? affinity : DOWNSTREAM);
     VisiblePosition visibleEnd(endContainer, endOffset, SEL_DEFAULT_AFFINITY);
-    setSelection(Selection(visibleStart, visibleEnd), closeTyping);
+    setSelection(VisibleSelection(visibleStart, visibleEnd), closeTyping);
     return true;
 }
 
@@ -1158,8 +1249,8 @@ void SelectionController::focusedOrActiveStateChanged()
     // Because RenderObject::selectionBackgroundColor() and
     // RenderObject::selectionForegroundColor() check if the frame is active,
     // we have to update places those colors were painted.
-    if (RenderView* view = static_cast<RenderView*>(m_frame->document()->renderer()))
-        view->repaintViewRectangle(enclosingIntRect(m_frame->selectionBounds()));
+    if (RenderView* view = toRenderView(m_frame->document()->renderer()))
+        view->repaintRectangleInViewAndCompositedLayers(enclosingIntRect(m_frame->selectionBounds()));
 
     // Caret appears in the active frame.
     if (activeAndFocused)
@@ -1173,7 +1264,7 @@ void SelectionController::focusedOrActiveStateChanged()
     // RenderTheme::isFocused() check if the frame is active, we have to
     // update style and theme state that depended on those.
     if (Node* node = m_frame->document()->focusedNode()) {
-        node->setChanged();
+        node->setNeedsStyleRecalc();
         if (RenderObject* renderer = node->renderer())
             if (renderer && renderer->style()->hasAppearance())
                 theme()->stateChanged(renderer, FocusState);
@@ -1196,9 +1287,6 @@ void SelectionController::setFocused(bool flag)
     m_focused = flag;
 
     focusedOrActiveStateChanged();
-
-    if (Document* doc = m_frame->document())
-        doc->dispatchWindowEvent(flag ? eventNames().focusEvent : eventNames().blurEvent, false, false);
 }
 
 bool SelectionController::isFocusedAndActive() const
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.h b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
index fe5e90d810..bbd343cd10 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.h
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
@@ -27,8 +27,8 @@
 #define SelectionController_h
 
 #include "IntRect.h"
-#include "Selection.h"
 #include "Range.h"
+#include "VisibleSelection.h"
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
@@ -56,8 +56,8 @@ public:
     void moveTo(const Position&, EAffinity, bool userTriggered = false);
     void moveTo(const Position&, const Position&, EAffinity, bool userTriggered = false);
 
-    const Selection& selection() const { return m_sel; }
-    void setSelection(const Selection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false);
+    const VisibleSelection& selection() const { return m_sel; }
+    void setSelection(const VisibleSelection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false);
     bool setSelectedRange(Range*, EAffinity, bool closeTyping);
     void selectAll();
     void clear();
@@ -67,7 +67,7 @@ public:
 
     bool contains(const IntPoint&);
 
-    Selection::EState state() const { return m_sel.state(); }
+    VisibleSelection::SelectionType selectionType() const { return m_sel.selectionType(); }
 
     EAffinity affinity() const { return m_sel.affinity(); }
 
@@ -102,8 +102,9 @@ public:
     bool isRange() const { return m_sel.isRange(); }
     bool isCaretOrRange() const { return m_sel.isCaretOrRange(); }
     bool isInPasswordField() const;
+    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_sel.isAll(stayInEditableContent); }
     
-    PassRefPtr<Range> toRange() const { return m_sel.toRange(); }
+    PassRefPtr<Range> toNormalizedRange() const { return m_sel.toNormalizedRange(); }
 
     void debugRenderer(RenderObject*, bool selected) const;
     
@@ -119,6 +120,7 @@ public:
 
     // Focus
     void setFocused(bool);
+    bool isFocused() const { return m_focused; }
     bool isFocusedAndActive() const;
     void pageActivationChanged();
 
@@ -130,10 +132,14 @@ public:
 private:
     enum EPositionType { START, END, BASE, EXTENT };
 
-    VisiblePosition modifyExtendingRightForward(TextGranularity);
+    TextDirection directionOfEnclosingBlock();
+
+    VisiblePosition modifyExtendingRight(TextGranularity);
+    VisiblePosition modifyExtendingForward(TextGranularity);
     VisiblePosition modifyMovingRight(TextGranularity);
     VisiblePosition modifyMovingForward(TextGranularity);
-    VisiblePosition modifyExtendingLeftBackward(TextGranularity);
+    VisiblePosition modifyExtendingLeft(TextGranularity);
+    VisiblePosition modifyExtendingBackward(TextGranularity);
     VisiblePosition modifyMovingLeft(TextGranularity);
     VisiblePosition modifyMovingBackward(TextGranularity);
 
@@ -142,7 +148,7 @@ private:
 
     int xPosForVerticalArrowNavigation(EPositionType);
     
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(GTK)
     void notifyAccessibilityForSelectionChange();
 #else
     void notifyAccessibilityForSelectionChange() {};
@@ -150,14 +156,17 @@ private:
 
     void focusedOrActiveStateChanged();
     bool caretRendersInsideNode(Node*) const;
+    
+    IntRect absoluteBoundsForLocalRect(const IntRect&) const;
 
     Frame* m_frame;
     int m_xPosForVerticalArrowNavigation;
 
-    Selection m_sel;
+    VisibleSelection m_sel;
 
     IntRect m_caretRect;        // caret rect in coords local to the renderer responsible for painting the caret
     IntRect m_absCaretBounds;   // absolute bounding rect for the caret
+    IntRect m_absoluteCaretRepaintBounds;
     
     bool m_needsLayout : 1;       // true if the caret and expectedVisible rectangles need to be calculated
     bool m_absCaretBoundsDirty: 1;
@@ -187,3 +196,4 @@ void showTree(const WebCore::SelectionController*);
 #endif
 
 #endif // SelectionController_h
+
diff --git a/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp b/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp
index f2fd985cc3..c5fa9a809c 100644
--- a/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp
@@ -30,6 +30,7 @@
 #include "SmartReplace.h"
 
 #include <CoreFoundation/CFCharacterSet.h>
+#include <CoreFoundation/CFString.h>
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
index 69447d4824..35dfc6f044 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
@@ -43,7 +43,7 @@ SplitElementCommand::SplitElementCommand(PassRefPtr<Element> element, PassRefPtr
 
 void SplitElementCommand::doApply()
 {
-    RefPtr<Element> prefixElement = m_element2->cloneElement();
+    RefPtr<Element> prefixElement = m_element2->cloneElementWithoutChildren();
 
     if (m_atChild->parentNode() != m_element2)
         return;
diff --git a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
index 5562cc4292..a5565c7e10 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
+++ b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
@@ -38,20 +38,22 @@ namespace WebCore {
 // From NSTextView.h:
 // NSSelectionAffinityUpstream = 0
 // NSSelectionAffinityDownstream = 1
-typedef enum { UPSTREAM = 0, DOWNSTREAM = 1 } EAffinity;
+enum EAffinity { UPSTREAM = 0, DOWNSTREAM = 1 };
+
+} // namespace WebCore
 
 #ifdef __OBJC__
-inline NSSelectionAffinity kit(EAffinity affinity)
+
+inline NSSelectionAffinity kit(WebCore::EAffinity affinity)
 {
     return static_cast<NSSelectionAffinity>(affinity);
 }
 
-inline EAffinity core(NSSelectionAffinity affinity)
+inline WebCore::EAffinity core(NSSelectionAffinity affinity)
 {
-    return static_cast<EAffinity>(affinity);
+    return static_cast<WebCore::EAffinity>(affinity);
 }
-#endif
 
-} // namespace WebCore
+#endif
 
 #endif // TextAffinity_h
diff --git a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
index 79f134436d..b3118531ec 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
@@ -29,7 +29,7 @@
 
 #include "CharacterNames.h"
 #include "Document.h"
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "htmlediting.h"
 #include "InlineTextBox.h"
@@ -38,6 +38,7 @@
 #include "RenderTableCell.h"
 #include "RenderTableRow.h"
 #include "RenderTextControl.h"
+#include "VisiblePosition.h"
 #include "visible_units.h"
 
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
@@ -102,6 +103,8 @@ TextIterator::TextIterator()
     , m_endContainer(0)
     , m_endOffset(0)
     , m_positionNode(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
     , m_lastCharacter(0)
     , m_emitCharactersBetweenAllVisiblePositions(false)
     , m_enterTextControls(false)
@@ -115,6 +118,8 @@ TextIterator::TextIterator(const Range* r, bool emitCharactersBetweenAllVisibleP
     , m_endContainer(0)
     , m_endOffset(0)
     , m_positionNode(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
     , m_emitCharactersBetweenAllVisiblePositions(emitCharactersBetweenAllVisiblePositions)
     , m_enterTextControls(enterTextControls)
 {
@@ -223,7 +228,9 @@ void TextIterator::advance()
             if (!m_handledNode) {
                 if (renderer->isText() && m_node->nodeType() == Node::TEXT_NODE) // FIXME: What about CDATA_SECTION_NODE?
                     m_handledNode = handleTextNode();
-                else if (renderer && (renderer->isImage() || renderer->isWidget() || (renderer->element() && renderer->element()->isControl())))
+                else if (renderer && (renderer->isImage() || renderer->isWidget() ||
+                         (renderer->node() && renderer->node()->isElementNode() &&
+                          static_cast<Element*>(renderer->node())->isFormControlElement())))
                     m_handledNode = handleReplacedElement();
                 else
                     m_handledNode = handleNonTextNode();
@@ -246,7 +253,7 @@ void TextIterator::advance()
                     parentNode = m_node->shadowParentNode();
                 }
                 while (!next && parentNode) {
-                    if (pastEnd && parentNode == m_endContainer || m_endContainer->isDescendantOf(parentNode))
+                    if ((pastEnd && parentNode == m_endContainer) || m_endContainer->isDescendantOf(parentNode))
                         return;
                     bool haveRenderer = m_node->renderer();
                     m_node = parentNode;
@@ -285,7 +292,7 @@ static inline bool compareBoxStart(const InlineTextBox *first, const InlineTextB
 
 bool TextIterator::handleTextNode()
 {
-    RenderText* renderer = static_cast<RenderText*>(m_node->renderer());
+    RenderText* renderer = toRenderText(m_node->renderer());
     if (renderer->style()->visibility() != VISIBLE)
         return false;
         
@@ -332,12 +339,12 @@ bool TextIterator::handleTextNode()
 
 void TextIterator::handleTextBox()
 {    
-    RenderText *renderer = static_cast<RenderText *>(m_node->renderer());
+    RenderText *renderer = toRenderText(m_node->renderer());
     String str = renderer->text();
     int start = m_offset;
     int end = (m_node == m_endContainer) ? m_endOffset : INT_MAX;
     while (m_textBox) {
-        int textBoxStart = m_textBox->m_start;
+        int textBoxStart = m_textBox->start();
         int runStart = max(textBoxStart, start);
 
         // Check for collapsed space at the start of this run.
@@ -354,7 +361,7 @@ void TextIterator::handleTextBox()
                 emitCharacter(' ', m_node, 0, runStart, runStart);
             return;
         }
-        int textBoxEnd = textBoxStart + m_textBox->m_len;
+        int textBoxEnd = textBoxStart + m_textBox->len();
         int runEnd = min(textBoxEnd, end);
         
         // Determine what the next text box will be, but don't advance yet
@@ -387,7 +394,7 @@ void TextIterator::handleTextBox()
                 return;
 
             // Advance and return
-            int nextRunStart = nextTextBox ? nextTextBox->m_start : str.length();
+            int nextRunStart = nextTextBox ? nextTextBox->start() : str.length();
             if (nextRunStart > runEnd)
                 m_lastTextNodeEndedWithCollapsedSpace = true; // collapsed space between runs or at the end
             m_textBox = nextTextBox;
@@ -413,8 +420,8 @@ bool TextIterator::handleReplacedElement()
         return false;
     }
 
-    if (m_enterTextControls && (renderer->isTextArea() || renderer->isTextField())) {
-        m_node = static_cast<RenderTextControl*>(renderer)->innerTextElement();
+    if (m_enterTextControls && renderer->isTextControl()) {
+        m_node = toRenderTextControl(renderer)->innerTextElement();
         m_offset = 0;
         m_inShadowContent = true;
         return false;
@@ -535,7 +542,7 @@ static bool shouldEmitExtraNewlineForNode(Node* node)
     // result even without margin collapsing. For example: <div><p>text</p></div>
     // will work right even if both the <div> and the <p> have bottom margins.
     RenderObject* r = node->renderer();
-    if (!r)
+    if (!r || !r->isBox())
         return false;
     
     // NOTE: We only do this for a select set of nodes, and fwiw WinIE appears
@@ -549,7 +556,7 @@ static bool shouldEmitExtraNewlineForNode(Node* node)
         || node->hasTagName(pTag)) {
         RenderStyle* style = r->style();
         if (style) {
-            int bottomMargin = r->collapsedMarginBottom();
+            int bottomMargin = toRenderBox(r)->collapsedMarginBottom();
             int fontSize = style->fontDescription().computedPixelSize();
             if (bottomMargin * 2 >= fontSize)
                 return true;
@@ -606,11 +613,13 @@ bool TextIterator::shouldRepresentNodeOffsetZero()
     if (!m_node->renderer() || m_node->renderer()->style()->visibility() != VISIBLE)
         return false;
     
-    // The currPos.isNotNull() check is needed because positions in non-html content
-    // (like svg) do not have visible positions, and we don't want to emit for them either.
+    // The startPos.isNotNull() check is needed because the start could be before the body,
+    // and in that case we'll get null. We don't want to put in newlines at the start in that case.
+    // The currPos.isNotNull() check is needed because positions in non-HTML content
+    // (like SVG) do not have visible positions, and we don't want to emit for them either.
     VisiblePosition startPos = VisiblePosition(m_startContainer, m_startOffset, DOWNSTREAM);
     VisiblePosition currPos = VisiblePosition(m_node, 0, DOWNSTREAM);
-    return currPos.isNotNull() && !inSameLine(startPos, currPos);
+    return startPos.isNotNull() && currPos.isNotNull() && !inSameLine(startPos, currPos);
 }
 
 bool TextIterator::shouldEmitSpaceBeforeAndAfterNode(Node* node)
@@ -712,7 +721,7 @@ void TextIterator::emitCharacter(UChar c, Node *textNode, Node *offsetBaseNode,
 
 void TextIterator::emitText(Node* textNode, int textStartOffset, int textEndOffset)
 {
-    RenderText* renderer = static_cast<RenderText*>(m_node->renderer());
+    RenderText* renderer = toRenderText(m_node->renderer());
     String str = renderer->text();
     ASSERT(str.characters());
 
@@ -857,7 +866,7 @@ void SimplifiedBackwardsTextIterator::advance()
             if (!m_handledNode &&
                 canHaveChildrenForEditing(m_node) && 
                 m_node->parentNode() && 
-                (!m_node->lastChild() || m_node == m_endNode && m_endOffset == 0)) {
+                (!m_node->lastChild() || (m_node == m_endNode && m_endOffset == 0))) {
                 exitNode();
                 if (m_positionNode) {
                     m_handledNode = true;
@@ -895,7 +904,7 @@ bool SimplifiedBackwardsTextIterator::handleTextNode()
 {
     m_lastTextNode = m_node;
 
-    RenderText *renderer = static_cast<RenderText *>(m_node->renderer());
+    RenderText *renderer = toRenderText(m_node->renderer());
     String str = renderer->text();
 
     if (!renderer->firstTextBox() && str.length() > 0)
@@ -1056,7 +1065,7 @@ void CharacterIterator::advance(int count)
 String CharacterIterator::string(int numChars)
 {
     Vector<UChar> result;
-    result.reserveCapacity(numChars);
+    result.reserveInitialCapacity(numChars);
     while (numChars > 0 && !atEnd()) {
         int runSize = min(numChars, length());
         result.append(characters(), runSize);
@@ -1080,6 +1089,81 @@ static PassRefPtr<Range> characterSubrange(CharacterIterator& it, int offset, in
         end->endContainer(), end->endOffset());
 }
 
+BackwardsCharacterIterator::BackwardsCharacterIterator()
+    : m_offset(0)
+    , m_runOffset(0)
+    , m_atBreak(true)
+{
+}
+
+BackwardsCharacterIterator::BackwardsCharacterIterator(const Range* range)
+    : m_offset(0)
+    , m_runOffset(0)
+    , m_atBreak(true)
+    , m_textIterator(range)
+{
+    while (!atEnd() && !m_textIterator.length())
+        m_textIterator.advance();
+}
+
+PassRefPtr<Range> BackwardsCharacterIterator::range() const
+{
+    RefPtr<Range> r = m_textIterator.range();
+    if (!m_textIterator.atEnd()) {
+        if (m_textIterator.length() <= 1)
+            ASSERT(m_runOffset == 0);
+        else {
+            Node* n = r->startContainer();
+            ASSERT(n == r->endContainer());
+            int offset = r->endOffset() - m_runOffset;
+            ExceptionCode ec = 0;
+            r->setStart(n, offset - 1, ec);
+            r->setEnd(n, offset, ec);
+            ASSERT(!ec);
+        }
+    }
+    return r.release();
+}
+
+void BackwardsCharacterIterator::advance(int count)
+{
+    if (count <= 0) {
+        ASSERT(!count);
+        return;
+    }
+
+    m_atBreak = false;
+
+    int remaining = m_textIterator.length() - m_runOffset;
+    if (count < remaining) {
+        m_runOffset += count;
+        m_offset += count;
+        return;
+    }
+
+    count -= remaining;
+    m_offset += remaining;
+
+    for (m_textIterator.advance(); !atEnd(); m_textIterator.advance()) {
+        int runLength = m_textIterator.length();
+        if (runLength == 0)
+            m_atBreak = true;
+        else {
+            if (count < runLength) {
+                m_runOffset = count;
+                m_offset += count;
+                return;
+            }
+            
+            count -= runLength;
+            m_offset += runLength;
+        }
+    }
+
+    m_atBreak = true;
+    m_runOffset = 0;
+}
+
 // --------
 
 WordAwareIterator::WordAwareIterator()
@@ -1224,7 +1308,7 @@ inline SearchBuffer::SearchBuffer(const String& target, bool isCaseSensitive)
     ASSERT(!m_target.isEmpty());
 
     size_t targetLength = target.length();
-    m_buffer.reserveCapacity(max(targetLength * 8, minimumSearchBufferSize));
+    m_buffer.reserveInitialCapacity(max(targetLength * 8, minimumSearchBufferSize));
     m_overlap = m_buffer.capacity() / 4;
 
     // Grab the single global searcher.
@@ -1480,7 +1564,7 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element *scope, int r
                 Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
                 if (runEnd.isNotNull()) {
                     ExceptionCode ec = 0;
-                    textRunRange->setEnd(runEnd.node(), runEnd.offset(), ec);
+                    textRunRange->setEnd(runEnd.node(), runEnd.deprecatedEditingOffset(), ec);
                     ASSERT(!ec);
                 }
             }
@@ -1530,7 +1614,7 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element *scope, int r
 
 // --------
     
-UChar* plainTextToMallocAllocatedBuffer(const Range* r, unsigned& bufferLength) 
+UChar* plainTextToMallocAllocatedBuffer(const Range* r, unsigned& bufferLength, bool isDisplayString) 
 {
     UChar* result = 0;
 
@@ -1541,7 +1625,7 @@ UChar* plainTextToMallocAllocatedBuffer(const Range* r, unsigned& bufferLength)
     typedef pair<UChar*, unsigned> TextSegment;
     Vector<TextSegment>* textSegments = 0;
     Vector<UChar> textBuffer;
-    textBuffer.reserveCapacity(cMaxSegmentSize);
+    textBuffer.reserveInitialCapacity(cMaxSegmentSize);
     for (TextIterator it(r); !it.atEnd(); it.advance()) {
         if (textBuffer.size() && textBuffer.size() + it.length() > cMaxSegmentSize) {
             UChar* newSegmentBuffer = static_cast<UChar*>(malloc(textBuffer.size() * sizeof(UChar)));
@@ -1585,13 +1669,17 @@ exit:
             free(textSegments->at(i).first);
         delete textSegments;
     }
+    
+    if (isDisplayString && r->ownerDocument())
+        r->ownerDocument()->displayBufferModifiedByEncoding(result, bufferLength);
+
     return result;
 }
 
 String plainText(const Range* r)
 {
     unsigned length;
-    UChar* buf = plainTextToMallocAllocatedBuffer(r, length);
+    UChar* buf = plainTextToMallocAllocatedBuffer(r, length, false);
     if (!buf)
         return "";
     String result(buf, length);
diff --git a/src/3rdparty/webkit/WebCore/editing/TextIterator.h b/src/3rdparty/webkit/WebCore/editing/TextIterator.h
index 11a835422d..f00bea45e4 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextIterator.h
+++ b/src/3rdparty/webkit/WebCore/editing/TextIterator.h
@@ -46,7 +46,7 @@ inline bool isCollapsibleWhitespace(UChar c)
 }
 
 String plainText(const Range*);
-UChar* plainTextToMallocAllocatedBuffer(const Range*, unsigned& bufferLength);
+UChar* plainTextToMallocAllocatedBuffer(const Range*, unsigned& bufferLength, bool isDisplayString);
 PassRefPtr<Range> findPlainText(const Range*, const String&, bool forward, bool caseSensitive);
 
 // Iterates through the DOM range, returning all the text, and 0-length boundaries
@@ -216,6 +216,25 @@ private:
     TextIterator m_textIterator;
 };
     
+class BackwardsCharacterIterator {
+public:
+    BackwardsCharacterIterator();
+    explicit BackwardsCharacterIterator(const Range*);
+
+    void advance(int);
+
+    bool atEnd() const { return m_textIterator.atEnd(); }
+
+    PassRefPtr<Range> range() const;
+
+private:
+    int m_offset;
+    int m_runOffset;
+    bool m_atBreak;
+
+    SimplifiedBackwardsTextIterator m_textIterator;
+};
+
 // Very similar to the TextIterator, except that the chunks of text returned are "well behaved",
 // meaning they never end split up a word.  This is useful for spellcheck or (perhaps one day) searching.
 class WordAwareIterator {
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
index 414680f8ae..5ce4e560e2 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
@@ -33,9 +33,11 @@
 #include "Editor.h"
 #include "Element.h"
 #include "Frame.h"
+#include "HTMLNames.h"
 #include "InsertLineBreakCommand.h"
 #include "InsertParagraphSeparatorCommand.h"
 #include "InsertTextCommand.h"
+#include "RenderObject.h"
 #include "SelectionController.h"
 #include "VisiblePosition.h"
 #include "htmlediting.h"
@@ -43,12 +45,13 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, bool selectInsertedText, TextGranularity granularity, bool killRing)
     : CompositeEditCommand(document), 
       m_commandType(commandType), 
       m_textToInsert(textToInsert), 
       m_openForMoreTyping(true), 
-      m_applyEditing(false), 
       m_selectInsertedText(selectInsertedText),
       m_smartDelete(false),
       m_granularity(granularity),
@@ -125,14 +128,14 @@ void TypingCommand::insertText(Document* document, const String& text, bool sele
     insertText(document, text, frame->selection()->selection(), selectInsertedText, insertedTextIsComposition);
 }
 
-void TypingCommand::insertText(Document* document, const String& text, const Selection& selectionForInsertion, bool selectInsertedText, bool insertedTextIsComposition)
+void TypingCommand::insertText(Document* document, const String& text, const VisibleSelection& selectionForInsertion, bool selectInsertedText, bool insertedTextIsComposition)
 {
     ASSERT(document);
     
     RefPtr<Frame> frame = document->frame();
     ASSERT(frame);
     
-    Selection currentSelection = frame->selection()->selection();
+    VisibleSelection currentSelection = frame->selection()->selection();
     bool changeSelection = currentSelection != selectionForInsertion;
     
     String newText = text;
@@ -281,8 +284,17 @@ EditAction TypingCommand::editingAction() const
 
 void TypingCommand::markMisspellingsAfterTyping()
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    if (!document()->frame()->editor()->isContinuousSpellCheckingEnabled()
+     && !document()->frame()->editor()->isAutomaticQuoteSubstitutionEnabled()
+     && !document()->frame()->editor()->isAutomaticLinkDetectionEnabled()
+     && !document()->frame()->editor()->isAutomaticDashSubstitutionEnabled()
+     && !document()->frame()->editor()->isAutomaticTextReplacementEnabled())
+        return;
+#else
     if (!document()->frame()->editor()->isContinuousSpellCheckingEnabled())
         return;
+#endif
     // Take a look at the selection that results after typing and determine whether we need to spellcheck. 
     // Since the word containing the current selection is never marked, this does a check to
     // see if typing made a new word that is not in the current selection. Basically, you
@@ -299,14 +311,15 @@ void TypingCommand::markMisspellingsAfterTyping()
 
 void TypingCommand::typingAddedToOpenCommand()
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    document()->frame()->editor()->appliedEditing(this);
+    // Since the spellchecking code may also perform corrections and other replacements, it should happen after the typing changes.
+    markMisspellingsAfterTyping();
+#else
+    // The old spellchecking code requires that checking be done first, to prevent issues like that in 6864072, where <doesn't> is marked as misspelled.
     markMisspellingsAfterTyping();
-    // Do not apply editing to the frame on the first time through.
-    // The frame will get told in the same way as all other commands.
-    // But since this command stays open and is used for additional typing, 
-    // we need to tell the frame here as other commands are added.
-    if (m_applyEditing)
-        document()->frame()->editor()->appliedEditing(this);
-    m_applyEditing = true;
+    document()->frame()->editor()->appliedEditing(this);
+#endif
 }
 
 void TypingCommand::insertText(const String &text, bool selectInsertedText)
@@ -364,25 +377,53 @@ void TypingCommand::insertParagraphSeparator()
 
 void TypingCommand::insertParagraphSeparatorInQuotedContent()
 {
+    // If the selection starts inside a table, just insert the paragraph separator normally
+    // Breaking the blockquote would also break apart the table, which is unecessary when inserting a newline
+    if (enclosingNodeOfType(endingSelection().start(), &isTableStructureNode)) {
+        insertParagraphSeparator();
+        return;
+    }
+        
     applyCommandToComposite(BreakBlockquoteCommand::create(document()));
     typingAddedToOpenCommand();
 }
 
+bool TypingCommand::makeEditableRootEmpty()
+{
+    Element* root = endingSelection().rootEditableElement();
+    if (!root->firstChild())
+        return false;
+
+    if (root->firstChild() == root->lastChild() && root->firstElementChild() && root->firstElementChild()->hasTagName(brTag)) {
+        // If there is a single child and it could be a placeholder, leave it alone.
+        if (root->renderer() && root->renderer()->isBlockFlow())
+            return false;
+    }
+
+    while (Node* child = root->firstChild())
+        removeNode(child);
+
+    addBlockPlaceholderIfNeeded(root);
+    setEndingSelection(VisibleSelection(Position(root, 0), DOWNSTREAM));
+
+    return true;
+}
+
 void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
 {
-    Selection selectionToDelete;
-    Selection selectionAfterUndo;
+    VisibleSelection selectionToDelete;
+    VisibleSelection selectionAfterUndo;
     
-    switch (endingSelection().state()) {
-        case Selection::RANGE:
+    switch (endingSelection().selectionType()) {
+        case VisibleSelection::RangeSelection:
             selectionToDelete = endingSelection();
             selectionAfterUndo = selectionToDelete;
             break;
-        case Selection::CARET: {
-            if (breakOutOfEmptyMailBlockquotedParagraph()) {
+        case VisibleSelection::CaretSelection: {
+            // After breaking out of an empty mail blockquote, we still want continue with the deletion
+            // so actual content will get deleted, and not just the quote style.
+            if (breakOutOfEmptyMailBlockquotedParagraph())
                 typingAddedToOpenCommand();
-                return;
-            }
         
             m_smartDelete = false;
 
@@ -392,12 +433,17 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             if (killRing && selection.isCaret() && granularity != CharacterGranularity) 
                 selection.modify(SelectionController::EXTEND, SelectionController::BACKWARD, CharacterGranularity); 
             
-            // When the caret is at the start of the editable area in an empty list item, break out of the list item.
             if (endingSelection().visibleStart().previous(true).isNull()) {
+                // When the caret is at the start of the editable area in an empty list item, break out of the list item.
                 if (breakOutOfEmptyListItem()) {
                     typingAddedToOpenCommand();
                     return;
                 }
+                // When there are no visible positions in the editing root, delete its entire contents.
+                if (endingSelection().visibleStart().next(true).isNull() && makeEditableRootEmpty()) {
+                    typingAddedToOpenCommand();
+                    return;
+                }
             }
             
             VisiblePosition visibleStart(endingSelection().visibleStart());
@@ -410,63 +456,62 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
                 selection.modify(SelectionController::EXTEND, SelectionController::BACKWARD, granularity);
             // If the caret is just after a table, select the table and don't delete anything.
             } else if (Node* table = isFirstPositionAfterTable(visibleStart)) {
-                setEndingSelection(Selection(Position(table, 0), endingSelection().start(), DOWNSTREAM));
+                setEndingSelection(VisibleSelection(Position(table, 0), endingSelection().start(), DOWNSTREAM));
                 typingAddedToOpenCommand();
                 return;
             }
 
             selectionToDelete = selection.selection();
 
-            if (granularity == CharacterGranularity && selectionToDelete.end().offset() - selectionToDelete.start().offset() > 1) {
-                // When we delete a ligature consisting of multiple Unicode characters with a backspace key,
-                // we should not delete the ligature but delete only its last characeter. To check we are deleting
-                // a ligature, we retrieve the previous position of the caret and count the number of
-                // characters to be deleted.
-                // To prevent from calculating the previous position every time when pressing a backspace key,
-                // we retrieve the previous position only when the given selection consists of two or more characters.
-                if (selectionToDelete.end().offset() - selectionToDelete.end().previous(UsingComposedCharacters).offset() > 1)
-                    selectionToDelete.setWithoutValidation(selectionToDelete.end(), selectionToDelete.end().previous(NotUsingComposedCharacters));
+            if (granularity == CharacterGranularity && selectionToDelete.end().node() == selectionToDelete.start().node() && selectionToDelete.end().deprecatedEditingOffset() - selectionToDelete.start().deprecatedEditingOffset() > 1) {
+                // If there are multiple Unicode code points to be deleted, adjust the range to match platform conventions.
+                selectionToDelete.setWithoutValidation(selectionToDelete.end(), selectionToDelete.end().previous(BackwardDeletion));
             }
 
             if (!startingSelection().isRange() || selectionToDelete.base() != startingSelection().start())
                 selectionAfterUndo = selectionToDelete;
             else
                 // It's a little tricky to compute what the starting selection would have been in the original document.
-                // We can't let the Selection class's validation kick in or it'll adjust for us based on
+                // We can't let the VisibleSelection class's validation kick in or it'll adjust for us based on
                 // the current state of the document and we'll get the wrong result.
                 selectionAfterUndo.setWithoutValidation(startingSelection().end(), selectionToDelete.extent());
             break;
         }
-        case Selection::NONE:
+        case VisibleSelection::NoSelection:
             ASSERT_NOT_REACHED();
             break;
     }
     
-    if (selectionToDelete.isCaretOrRange() && document()->frame()->shouldDeleteSelection(selectionToDelete)) {
-        if (killRing)
-            document()->frame()->editor()->addToKillRing(selectionToDelete.toRange().get(), false);
-        // Make undo select everything that has been deleted, unless an undo will undo more than just this deletion.
-        // FIXME: This behaves like TextEdit except for the case where you open with text insertion and then delete
-        // more text than you insert.  In that case all of the text that was around originally should be selected.
-        if (m_openedByBackwardDelete)
-            setStartingSelection(selectionAfterUndo);
-        CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
-        setSmartDelete(false);
-        typingAddedToOpenCommand();
-    }
+    ASSERT(!selectionToDelete.isNone());
+    if (selectionToDelete.isNone())
+        return;
+    
+    if (selectionToDelete.isCaret() || !document()->frame()->shouldDeleteSelection(selectionToDelete))
+        return;
+    
+    if (killRing)
+        document()->frame()->editor()->addToKillRing(selectionToDelete.toNormalizedRange().get(), false);
+    // Make undo select everything that has been deleted, unless an undo will undo more than just this deletion.
+    // FIXME: This behaves like TextEdit except for the case where you open with text insertion and then delete
+    // more text than you insert.  In that case all of the text that was around originally should be selected.
+    if (m_openedByBackwardDelete)
+        setStartingSelection(selectionAfterUndo);
+    CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
+    setSmartDelete(false);
+    typingAddedToOpenCommand();
 }
 
 void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool killRing)
 {
-    Selection selectionToDelete;
-    Selection selectionAfterUndo;
+    VisibleSelection selectionToDelete;
+    VisibleSelection selectionAfterUndo;
 
-    switch (endingSelection().state()) {
-        case Selection::RANGE:
+    switch (endingSelection().selectionType()) {
+        case VisibleSelection::RangeSelection:
             selectionToDelete = endingSelection();
             selectionAfterUndo = selectionToDelete;
             break;
-        case Selection::CARET: {
+        case VisibleSelection::CaretSelection: {
             m_smartDelete = false;
 
             // Handle delete at beginning-of-block case.
@@ -483,8 +528,8 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
             if (visibleEnd == endOfParagraph(visibleEnd))
                 downstreamEnd = visibleEnd.next(true).deepEquivalent().downstream();
             // When deleting tables: Select the table first, then perform the deletion
-            if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.offset() == 0) {
-                setEndingSelection(Selection(endingSelection().end(), Position(downstreamEnd.node(), maxDeepOffset(downstreamEnd.node())), DOWNSTREAM));
+            if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.deprecatedEditingOffset() == 0) {
+                setEndingSelection(VisibleSelection(endingSelection().end(), lastDeepEditingPositionForNode(downstreamEnd.node()), DOWNSTREAM));
                 typingAddedToOpenCommand();
                 return;
             }
@@ -498,7 +543,7 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
                 selectionAfterUndo = selectionToDelete;
             else {
                 // It's a little tricky to compute what the starting selection would have been in the original document.
-                // We can't let the Selection class's validation kick in or it'll adjust for us based on
+                // We can't let the VisibleSelection class's validation kick in or it'll adjust for us based on
                 // the current state of the document and we'll get the wrong result.
                 Position extent = startingSelection().end();
                 if (extent.node() != selectionToDelete.end().node())
@@ -506,29 +551,34 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
                 else {
                     int extraCharacters;
                     if (selectionToDelete.start().node() == selectionToDelete.end().node())
-                        extraCharacters = selectionToDelete.end().offset() - selectionToDelete.start().offset();
+                        extraCharacters = selectionToDelete.end().deprecatedEditingOffset() - selectionToDelete.start().deprecatedEditingOffset();
                     else
-                        extraCharacters = selectionToDelete.end().offset();
-                    extent = Position(extent.node(), extent.offset() + extraCharacters);
+                        extraCharacters = selectionToDelete.end().deprecatedEditingOffset();
+                    extent = Position(extent.node(), extent.deprecatedEditingOffset() + extraCharacters);
                 }
                 selectionAfterUndo.setWithoutValidation(startingSelection().start(), extent);
             }
             break;
         }
-        case Selection::NONE:
+        case VisibleSelection::NoSelection:
             ASSERT_NOT_REACHED();
             break;
     }
     
-    if (selectionToDelete.isCaretOrRange() && document()->frame()->shouldDeleteSelection(selectionToDelete)) {
-        if (killRing)
-            document()->frame()->editor()->addToKillRing(selectionToDelete.toRange().get(), false);
-        // make undo select what was deleted
-        setStartingSelection(selectionAfterUndo);
-        CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
-        setSmartDelete(false);
-        typingAddedToOpenCommand();
-    }
+    ASSERT(!selectionToDelete.isNone());
+    if (selectionToDelete.isNone())
+        return;
+    
+    if (selectionToDelete.isCaret() || !document()->frame()->shouldDeleteSelection(selectionToDelete))
+        return;
+        
+    if (killRing)
+        document()->frame()->editor()->addToKillRing(selectionToDelete.toNormalizedRange().get(), false);
+    // make undo select what was deleted
+    setStartingSelection(selectionAfterUndo);
+    CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
+    setSmartDelete(false);
+    typingAddedToOpenCommand();
 }
 
 void TypingCommand::deleteSelection(bool smartDelete)
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
index b4e10913b8..2c524477a6 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
@@ -46,7 +46,7 @@ public:
     static void deleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
     static void forwardDeleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
     static void insertText(Document*, const String&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
-    static void insertText(Document*, const String&, const Selection&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
+    static void insertText(Document*, const String&, const VisibleSelection&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
     static void insertLineBreak(Document*);
     static void insertParagraphSeparator(Document*);
     static void insertParagraphSeparatorInQuotedContent(Document*);
@@ -83,11 +83,11 @@ private:
 
     void markMisspellingsAfterTyping();
     void typingAddedToOpenCommand();
+    bool makeEditableRootEmpty();
     
     ETypingCommand m_commandType;
     String m_textToInsert;
     bool m_openForMoreTyping;
-    bool m_applyEditing;
     bool m_selectInsertedText;
     bool m_smartDelete;
     TextGranularity m_granularity;
diff --git a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp
index 9ecc4d8c61..2db6d31031 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,8 +28,8 @@
 
 #include "CString.h"
 #include "Document.h"
-#include "Element.h"
-#include "FloatRect.h"
+#include "FloatQuad.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "Logging.h"
@@ -81,7 +81,7 @@ VisiblePosition VisiblePosition::previous(bool stayInEditableContent) const
     Position pos = previousVisuallyDistinctCandidate(m_deepPosition);
     
     // return null visible position if there is no previous visible position
-    if (pos.atStart())
+    if (pos.atStartOfTree())
         return VisiblePosition();
         
     VisiblePosition prev = VisiblePosition(pos, DOWNSTREAM);
@@ -125,7 +125,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
         if (!box)
             return primaryDirection == LTR ? previousVisuallyDistinctCandidate(m_deepPosition) : nextVisuallyDistinctCandidate(m_deepPosition);
 
-        RenderObject* renderer = box->object();
+        RenderObject* renderer = box->renderer();
 
         while (true) {
             if ((renderer->isReplaced() || renderer->isBR()) && offset == box->caretRightmostOffset())
@@ -147,7 +147,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
 
                 // Reposition at the other logical position corresponding to our edge's visual position and go for another round.
                 box = prevBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = prevBox->caretRightmostOffset();
                 continue;
             }
@@ -176,7 +176,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
                         break;
                     box = prevBox;
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretRightmostOffset();
                 if (box->direction() == primaryDirection)
                     break;
@@ -185,7 +185,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
 
             if (prevBox) {
                 box = prevBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretRightmostOffset();
                 if (box->bidiLevel() > level) {
                     do {
@@ -215,15 +215,15 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
                         break;
                     level = box->bidiLevel();
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = primaryDirection == LTR ? box->caretMinOffset() : box->caretMaxOffset();
             }
             break;
         }
 
-        p = Position(renderer->element(), offset);
+        p = Position(renderer->node(), offset);
 
-        if (p.isCandidate() && p.downstream() != downstreamStart || p.atStart() || p.atEnd())
+        if ((p.isCandidate() && p.downstream() != downstreamStart) || p.atStartOfTree() || p.atEndOfTree())
             return p;
     }
 }
@@ -231,7 +231,8 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
 VisiblePosition VisiblePosition::left(bool stayInEditableContent) const
 {
     Position pos = leftVisuallyDistinctCandidate();
-    if (pos.atStart() || pos.atEnd())
+    // FIXME: Why can't we move left from the last position in a tree?
+    if (pos.atStartOfTree() || pos.atEndOfTree())
         return VisiblePosition();
 
     VisiblePosition left = VisiblePosition(pos, DOWNSTREAM);
@@ -266,7 +267,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
         if (!box)
             return primaryDirection == LTR ? nextVisuallyDistinctCandidate(m_deepPosition) : previousVisuallyDistinctCandidate(m_deepPosition);
 
-        RenderObject* renderer = box->object();
+        RenderObject* renderer = box->renderer();
 
         while (true) {
             if ((renderer->isReplaced() || renderer->isBR()) && offset == box->caretLeftmostOffset())
@@ -288,7 +289,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
 
                 // Reposition at the other logical position corresponding to our edge's visual position and go for another round.
                 box = nextBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = nextBox->caretLeftmostOffset();
                 continue;
             }
@@ -318,7 +319,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
                         break;
                     box = nextBox;
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretLeftmostOffset();
                 if (box->direction() == primaryDirection)
                     break;
@@ -327,7 +328,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
 
             if (nextBox) {
                 box = nextBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretLeftmostOffset();
                 if (box->bidiLevel() > level) {
                     do {
@@ -357,15 +358,15 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
                         break;
                     level = box->bidiLevel();
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = primaryDirection == LTR ? box->caretMaxOffset() : box->caretMinOffset();
             }
             break;
         }
 
-        p = Position(renderer->element(), offset);
+        p = Position(renderer->node(), offset);
 
-        if (p.isCandidate() && p.downstream() != downstreamStart || p.atStart() || p.atEnd())
+        if ((p.isCandidate() && p.downstream() != downstreamStart) || p.atStartOfTree() || p.atEndOfTree())
             return p;
     }
 }
@@ -373,7 +374,8 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
 VisiblePosition VisiblePosition::right(bool stayInEditableContent) const
 {
     Position pos = rightVisuallyDistinctCandidate();
-    if (pos.atStart() || pos.atEnd())
+    // FIXME: Why can't we move left from the last position in a tree?
+    if (pos.atStartOfTree() || pos.atEndOfTree())
         return VisiblePosition();
 
     VisiblePosition right = VisiblePosition(pos, DOWNSTREAM);
@@ -399,7 +401,7 @@ VisiblePosition VisiblePosition::honorEditableBoundaryAtOrBefore(const VisiblePo
         
     // Return pos itself if the two are from the very same editable region, or both are non-editable
     // FIXME: In the non-editable case, just because the new position is non-editable doesn't mean movement
-    // to it is allowed.  Selection::adjustForEditableContent has this problem too.
+    // to it is allowed.  VisibleSelection::adjustForEditableContent has this problem too.
     if (highestEditableRoot(pos.deepEquivalent()) == highestRoot)
         return pos;
   
@@ -425,7 +427,7 @@ VisiblePosition VisiblePosition::honorEditableBoundaryAtOrAfter(const VisiblePos
     
     // Return pos itself if the two are from the very same editable region, or both are non-editable
     // FIXME: In the non-editable case, just because the new position is non-editable doesn't mean movement
-    // to it is allowed.  Selection::adjustForEditableContent has this problem too.
+    // to it is allowed.  VisibleSelection::adjustForEditableContent has this problem too.
     if (highestEditableRoot(pos.deepEquivalent()) == highestRoot)
         return pos;
 
@@ -438,7 +440,7 @@ VisiblePosition VisiblePosition::honorEditableBoundaryAtOrAfter(const VisiblePos
     return firstEditablePositionAfterPositionInRoot(pos.deepEquivalent(), highestRoot);
 }
 
-Position canonicalizeCandidate(const Position& candidate)
+static Position canonicalizeCandidate(const Position& candidate)
 {
     if (candidate.isNull())
         return Position();
@@ -478,24 +480,24 @@ Position VisiblePosition::canonicalPosition(const Position& position)
 
     // The new position must be in the same editable element. Enforce that first.
     // Unless the descent is from a non-editable html element to an editable body.
-    if (node->hasTagName(htmlTag) && !node->isContentEditable())
+    if (node->hasTagName(htmlTag) && !node->isContentEditable() && node->document()->body() && node->document()->body()->isContentEditable())
         return next.isNotNull() ? next : prev;
 
     Node* editingRoot = editableRootForPosition(position);
         
     // If the html element is editable, descending into its body will look like a descent 
     // from non-editable to editable content since rootEditableElement() always stops at the body.
-    if (editingRoot && editingRoot->hasTagName(htmlTag) || position.node()->isDocumentNode())
+    if ((editingRoot && editingRoot->hasTagName(htmlTag)) || position.node()->isDocumentNode())
         return next.isNotNull() ? next : prev;
         
     bool prevIsInSameEditableElement = prevNode && editableRootForPosition(prev) == editingRoot;
     bool nextIsInSameEditableElement = nextNode && editableRootForPosition(next) == editingRoot;
     if (prevIsInSameEditableElement && !nextIsInSameEditableElement)
         return prev;
-        
+
     if (nextIsInSameEditableElement && !prevIsInSameEditableElement)
         return next;
-        
+
     if (!nextIsInSameEditableElement && !prevIsInSameEditableElement)
         return Position();
 
@@ -509,7 +511,7 @@ Position VisiblePosition::canonicalPosition(const Position& position)
     return next;
 }
 
-UChar VisiblePosition::characterAfter() const
+UChar32 VisiblePosition::characterAfter() const
 {
     // We canonicalize to the first of two equivalent candidates, but the second of the two candidates
     // is the one that will be inside the text node containing the character after this visible position.
@@ -518,10 +520,15 @@ UChar VisiblePosition::characterAfter() const
     if (!node || !node->isTextNode())
         return 0;
     Text* textNode = static_cast<Text*>(pos.node());
-    int offset = pos.offset();
-    if ((unsigned)offset >= textNode->length())
+    unsigned offset = pos.deprecatedEditingOffset();
+    unsigned length = textNode->length();
+    if (offset >= length)
         return 0;
-    return textNode->data()[offset];
+
+    UChar32 ch;
+    const UChar* characters = textNode->data().characters();
+    U16_NEXT(characters, offset, length, ch);
+    return ch;
 }
 
 IntRect VisiblePosition::localCaretRect(RenderObject*& renderer) const
@@ -541,7 +548,7 @@ IntRect VisiblePosition::localCaretRect(RenderObject*& renderer) const
     getInlineBoxAndOffset(inlineBox, caretOffset);
 
     if (inlineBox)
-        renderer = inlineBox->object();
+        renderer = inlineBox->renderer();
 
     return renderer->localCaretRect(inlineBox, caretOffset);
 }
@@ -574,7 +581,7 @@ void VisiblePosition::debugPosition(const char* msg) const
     if (isNull())
         fprintf(stderr, "Position [%s]: null\n", msg);
     else
-        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, m_deepPosition.node()->nodeName().utf8().data(), m_deepPosition.node(), m_deepPosition.offset());
+        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, m_deepPosition.node()->nodeName().utf8().data(), m_deepPosition.node(), m_deepPosition.deprecatedEditingOffset());
 }
 
 #ifndef NDEBUG
@@ -593,9 +600,12 @@ void VisiblePosition::showTreeForThis() const
 
 PassRefPtr<Range> makeRange(const VisiblePosition &start, const VisiblePosition &end)
 {
+    if (start.isNull() || end.isNull())
+        return 0;
+    
     Position s = rangeCompliantEquivalent(start);
     Position e = rangeCompliantEquivalent(end);
-    return Range::create(s.node()->document(), s.node(), s.offset(), e.node(), e.offset());
+    return Range::create(s.node()->document(), s.node(), s.deprecatedEditingOffset(), e.node(), e.deprecatedEditingOffset());
 }
 
 VisiblePosition startVisiblePosition(const Range *r, EAffinity affinity)
@@ -616,7 +626,7 @@ bool setStart(Range *r, const VisiblePosition &visiblePosition)
         return false;
     Position p = rangeCompliantEquivalent(visiblePosition);
     int code = 0;
-    r->setStart(p.node(), p.offset(), code);
+    r->setStart(p.node(), p.deprecatedEditingOffset(), code);
     return code == 0;
 }
 
@@ -626,7 +636,7 @@ bool setEnd(Range *r, const VisiblePosition &visiblePosition)
         return false;
     Position p = rangeCompliantEquivalent(visiblePosition);
     int code = 0;
-    r->setEnd(p.node(), p.offset(), code);
+    r->setEnd(p.node(), p.deprecatedEditingOffset(), code);
     return code == 0;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h
index 403c816714..d888806d02 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h
+++ b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h
@@ -47,6 +47,8 @@ namespace WebCore {
 
 class InlineBox;
 
+enum StayInEditableContent { MayLeaveEditableContent, MustStayInEditableContent };
+
 class VisiblePosition {
 public:
     // NOTE: UPSTREAM affinity will be used only if pos is at end of a wrapped line,
@@ -64,6 +66,8 @@ public:
     EAffinity affinity() const { ASSERT(m_affinity == UPSTREAM || m_affinity == DOWNSTREAM); return m_affinity; }
     void setAffinity(EAffinity affinity) { m_affinity = affinity; }
 
+    // FIXME: Change the following functions' parameter from a boolean to StayInEditableContent.
+
     // next() and previous() will increment/decrement by a character cluster.
     VisiblePosition next(bool stayInEditableContent = false) const;
     VisiblePosition previous(bool stayInEditableContent = false) const;
@@ -73,8 +77,8 @@ public:
     VisiblePosition left(bool stayInEditableContent = false) const;
     VisiblePosition right(bool stayInEditableContent = false) const;
 
-    UChar characterAfter() const;
-    UChar characterBefore() const { return previous().characterAfter(); }
+    UChar32 characterAfter() const;
+    UChar32 characterBefore() const { return previous().characterAfter(); }
     
     void debugPosition(const char* msg = "") const;
     
diff --git a/src/3rdparty/webkit/WebCore/editing/Selection.cpp b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
index ea30f193c2..56ad6b3910 100644
--- a/src/3rdparty/webkit/WebCore/editing/Selection.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
@@ -24,29 +24,32 @@
  */
   
 #include "config.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 
+#include "CharacterNames.h"
 #include "CString.h"
 #include "Document.h"
 #include "Element.h"
 #include "htmlediting.h"
+#include "TextIterator.h"
 #include "VisiblePosition.h"
 #include "visible_units.h"
 #include "Range.h"
+
 #include <wtf/Assertions.h>
 #include <stdio.h>
 
 namespace WebCore {
 
-Selection::Selection()
+VisibleSelection::VisibleSelection()
     : m_affinity(DOWNSTREAM)
     , m_granularity(CharacterGranularity)
-    , m_state(NONE)
+    , m_selectionType(NoSelection)
     , m_baseIsFirst(true)
 {
 }
 
-Selection::Selection(const Position& pos, EAffinity affinity)
+VisibleSelection::VisibleSelection(const Position& pos, EAffinity affinity)
     : m_base(pos)
     , m_extent(pos)
     , m_affinity(affinity)
@@ -55,7 +58,7 @@ Selection::Selection(const Position& pos, EAffinity affinity)
     validate();
 }
 
-Selection::Selection(const Position& base, const Position& extent, EAffinity affinity)
+VisibleSelection::VisibleSelection(const Position& base, const Position& extent, EAffinity affinity)
     : m_base(base)
     , m_extent(extent)
     , m_affinity(affinity)
@@ -64,7 +67,7 @@ Selection::Selection(const Position& base, const Position& extent, EAffinity aff
     validate();
 }
 
-Selection::Selection(const VisiblePosition& pos)
+VisibleSelection::VisibleSelection(const VisiblePosition& pos)
     : m_base(pos.deepEquivalent())
     , m_extent(pos.deepEquivalent())
     , m_affinity(pos.affinity())
@@ -73,7 +76,7 @@ Selection::Selection(const VisiblePosition& pos)
     validate();
 }
 
-Selection::Selection(const VisiblePosition& base, const VisiblePosition& extent)
+VisibleSelection::VisibleSelection(const VisiblePosition& base, const VisiblePosition& extent)
     : m_base(base.deepEquivalent())
     , m_extent(extent.deepEquivalent())
     , m_affinity(base.affinity())
@@ -82,7 +85,7 @@ Selection::Selection(const VisiblePosition& base, const VisiblePosition& extent)
     validate();
 }
 
-Selection::Selection(const Range* range, EAffinity affinity)
+VisibleSelection::VisibleSelection(const Range* range, EAffinity affinity)
     : m_base(range->startPosition())
     , m_extent(range->endPosition())
     , m_affinity(affinity)
@@ -91,36 +94,45 @@ Selection::Selection(const Range* range, EAffinity affinity)
     validate();
 }
 
-Selection Selection::selectionFromContentsOfNode(Node* node)
+VisibleSelection VisibleSelection::selectionFromContentsOfNode(Node* node)
 {
-    return Selection(Position(node, 0), Position(node, maxDeepOffset(node)), DOWNSTREAM);
+    return VisibleSelection(firstDeepEditingPositionForNode(node), lastDeepEditingPositionForNode(node), DOWNSTREAM);
 }
 
-void Selection::setBase(const Position& position)
+void VisibleSelection::setBase(const Position& position)
 {
     m_base = position;
     validate();
 }
 
-void Selection::setBase(const VisiblePosition& visiblePosition)
+void VisibleSelection::setBase(const VisiblePosition& visiblePosition)
 {
     m_base = visiblePosition.deepEquivalent();
     validate();
 }
 
-void Selection::setExtent(const Position& position)
+void VisibleSelection::setExtent(const Position& position)
 {
     m_extent = position;
     validate();
 }
 
-void Selection::setExtent(const VisiblePosition& visiblePosition)
+void VisibleSelection::setExtent(const VisiblePosition& visiblePosition)
 {
     m_extent = visiblePosition.deepEquivalent();
     validate();
 }
 
-PassRefPtr<Range> Selection::toRange() const
+PassRefPtr<Range> VisibleSelection::firstRange() const
+{
+    if (isNone())
+        return 0;
+    Position start = rangeCompliantEquivalent(m_start);
+    Position end = rangeCompliantEquivalent(m_end);
+    return Range::create(start.node()->document(), start, end);
+}
+
+PassRefPtr<Range> VisibleSelection::toNormalizedRange() const
 {
     if (isNone())
         return 0;
@@ -157,7 +169,7 @@ PassRefPtr<Range> Selection::toRange() const
         ASSERT(isRange());
         s = m_start.downstream();
         e = m_end.upstream();
-        if (Range::compareBoundaryPoints(s.node(), s.offset(), e.node(), e.offset()) > 0) {
+        if (comparePositions(s, e) > 0) {
             // Make sure the start is before the end.
             // The end can wind up before the start if collapsed whitespace is the only thing selected.
             Position tmp = s;
@@ -168,22 +180,12 @@ PassRefPtr<Range> Selection::toRange() const
         e = rangeCompliantEquivalent(e);
     }
 
-    ExceptionCode ec = 0;
-    RefPtr<Range> result(Range::create(s.node()->document()));
-    result->setStart(s.node(), s.offset(), ec);
-    if (ec) {
-        LOG_ERROR("Exception setting Range start from Selection: %d", ec);
-        return 0;
-    }
-    result->setEnd(e.node(), e.offset(), ec);
-    if (ec) {
-        LOG_ERROR("Exception setting Range end from Selection: %d", ec);
-        return 0;
-    }
-    return result.release();
+    // VisibleSelections are supposed to always be valid.  This constructor will ASSERT
+    // if a valid range could not be created, which is fine for this callsite.
+    return Range::create(s.node()->document(), s, e);
 }
 
-bool Selection::expandUsingGranularity(TextGranularity granularity)
+bool VisibleSelection::expandUsingGranularity(TextGranularity granularity)
 {
     if (isNone())
         return false;
@@ -193,15 +195,55 @@ bool Selection::expandUsingGranularity(TextGranularity granularity)
     return true;
 }
 
-void Selection::appendTrailingWhitespace()
+static PassRefPtr<Range> makeSearchRange(const Position& pos)
+{
+    Node* n = pos.node();
+    if (!n)
+        return 0;
+    Document* d = n->document();
+    Node* de = d->documentElement();
+    if (!de)
+        return 0;
+    Node* boundary = n->enclosingBlockFlowElement();
+    if (!boundary)
+        return 0;
+
+    RefPtr<Range> searchRange(Range::create(d));
+    ExceptionCode ec = 0;
+
+    Position start(rangeCompliantEquivalent(pos));
+    searchRange->selectNodeContents(boundary, ec);
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
+
+    ASSERT(!ec);
+    if (ec)
+        return 0;
+
+    return searchRange.release();
+}
+
+bool VisibleSelection::isAll(StayInEditableContent stayInEditableContent) const
 {
-    VisiblePosition end = VisiblePosition(m_end, m_affinity);
-    while (end.isNotNull() && isSpaceOrNewline(end.characterAfter()))
-        end = end.next();
-    m_end = end.deepEquivalent();
+    return !shadowTreeRootNode() && visibleStart().previous(stayInEditableContent).isNull() && visibleEnd().next(stayInEditableContent).isNull();
 }
 
-void Selection::validate()
+void VisibleSelection::appendTrailingWhitespace()
+{
+    RefPtr<Range> searchRange = makeSearchRange(m_end);
+    if (!searchRange)
+        return;
+
+    CharacterIterator charIt(searchRange.get(), true);
+
+    for (; charIt.length(); charIt.advance(1)) {
+        UChar c = charIt.characters()[0];
+        if (!isSpaceOrNewline(c) && c != noBreakSpace)
+            break;
+        m_end = charIt.range()->endPosition();
+    }
+}
+
+void VisibleSelection::setBaseAndExtentToDeepEquivalents()
 {
     // Move the selection to rendered positions, if possible.
     bool baseAndExtentEqual = m_base == m_extent;
@@ -222,10 +264,12 @@ void Selection::validate()
     } else if (m_extent.isNull()) {
         m_extent = m_base;
         m_baseIsFirst = true;
-    } else {
+    } else
         m_baseIsFirst = comparePositions(m_base, m_extent) <= 0;
-    }
+}
 
+void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
+{
     if (m_baseIsFirst) {
         m_start = m_base;
         m_end = m_extent;
@@ -234,7 +278,6 @@ void Selection::validate()
         m_end = m_base;
     }
 
-    // Expand the selection if requested.
     switch (m_granularity) {
         case CharacterGranularity:
             // Don't do any expansion.
@@ -348,26 +391,31 @@ void Selection::validate()
         m_start = m_end;
     if (m_end.isNull())
         m_end = m_start;
-    
-    adjustForEditableContent();
+}
 
-    // adjust the state
+void VisibleSelection::updateSelectionType()
+{
     if (m_start.isNull()) {
         ASSERT(m_end.isNull());
-        m_state = NONE;
-
-        // enforce downstream affinity if not caret, as affinity only
-        // makes sense for caret
-        m_affinity = DOWNSTREAM;
+        m_selectionType = NoSelection;
     } else if (m_start == m_end || m_start.upstream() == m_end.upstream()) {
-        m_state = CARET;
-    } else {
-        m_state = RANGE;
+        m_selectionType = CaretSelection;
+    } else
+        m_selectionType = RangeSelection;
 
-        // enforce downstream affinity if not caret, as affinity only
-        // makes sense for caret
+    // Affinity only makes sense for a caret
+    if (m_selectionType != CaretSelection)
         m_affinity = DOWNSTREAM;
+}
+
+void VisibleSelection::validate()
+{
+    setBaseAndExtentToDeepEquivalents();
+    setStartAndEndFromBaseAndExtentRespectingGranularity();
+    adjustSelectionToAvoidCrossingEditingBoundaries();
+    updateSelectionType();
 
+    if (selectionType() == RangeSelection) {
         // "Constrain" the selection to be the smallest equivalent range of nodes.
         // This is a somewhat arbitrary choice, but experience shows that it is
         // useful to make to make the selection "canonical" (if only for
@@ -382,12 +430,12 @@ void Selection::validate()
 }
 
 // FIXME: This function breaks the invariant of this class.
-// But because we use Selection to store values in editing commands for use when
+// But because we use VisibleSelection to store values in editing commands for use when
 // undoing the command, we need to be able to create a selection that while currently
 // invalid, will be valid once the changes are undone. This is a design problem.
-// To fix it we either need to change the invariants of Selection or create a new
+// To fix it we either need to change the invariants of VisibleSelection or create a new
 // class for editing to use that can manipulate selections that are not currently valid.
-void Selection::setWithoutValidation(const Position& base, const Position& extent)
+void VisibleSelection::setWithoutValidation(const Position& base, const Position& extent)
 {
     ASSERT(!base.isNull());
     ASSERT(!extent.isNull());
@@ -404,10 +452,10 @@ void Selection::setWithoutValidation(const Position& base, const Position& exten
         m_start = extent;
         m_end = base;
     }
-    m_state = RANGE;
+    m_selectionType = RangeSelection;
 }
 
-void Selection::adjustForEditableContent()
+void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
 {
     if (m_base.isNull() || m_start.isNull() || m_end.isNull())
         return;
@@ -459,17 +507,19 @@ void Selection::adjustForEditableContent()
             Position p = previousVisuallyDistinctCandidate(m_end);
             Node* shadowAncestor = endRoot ? endRoot->shadowAncestorNode() : 0;
             if (p.isNull() && endRoot && (shadowAncestor != endRoot))
-                p = Position(shadowAncestor, maxDeepOffset(shadowAncestor));
+                p = lastDeepEditingPositionForNode(shadowAncestor);
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
                 p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
-                    p = Position(shadowAncestor, maxDeepOffset(shadowAncestor));
+                    p = lastDeepEditingPositionForNode(shadowAncestor);
             }
             VisiblePosition previous(p);
-            
+
             if (previous.isNull()) {
+                // The selection crosses an Editing boundary.  This is a
+                // programmer error in the editing code.  Happy debugging!
                 ASSERT_NOT_REACHED();
                 m_base = Position();
                 m_extent = Position();
@@ -497,6 +547,8 @@ void Selection::adjustForEditableContent()
             VisiblePosition next(p);
             
             if (next.isNull()) {
+                // The selection crosses an Editing boundary.  This is a
+                // programmer error in the editing code.  Happy debugging!
                 ASSERT_NOT_REACHED();
                 m_base = Position();
                 m_extent = Position();
@@ -512,42 +564,42 @@ void Selection::adjustForEditableContent()
         m_extent = m_baseIsFirst ? m_end : m_start;
 }
 
-bool Selection::isContentEditable() const
+bool VisibleSelection::isContentEditable() const
 {
     return isEditablePosition(start());
 }
 
-bool Selection::isContentRichlyEditable() const
+bool VisibleSelection::isContentRichlyEditable() const
 {
     return isRichlyEditablePosition(start());
 }
 
-Element* Selection::rootEditableElement() const
+Element* VisibleSelection::rootEditableElement() const
 {
     return editableRootForPosition(start());
 }
 
-Node* Selection::shadowTreeRootNode() const
+Node* VisibleSelection::shadowTreeRootNode() const
 {
     return start().node() ? start().node()->shadowTreeRootNode() : 0;
 }
 
-void Selection::debugPosition() const
+void VisibleSelection::debugPosition() const
 {
     if (!m_start.node())
         return;
 
-    fprintf(stderr, "Selection =================\n");
+    fprintf(stderr, "VisibleSelection =================\n");
 
     if (m_start == m_end) {
         Position pos = m_start;
-        fprintf(stderr, "pos:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.offset());
+        fprintf(stderr, "pos:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
     } else {
         Position pos = m_start;
-        fprintf(stderr, "start:      %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.offset());
+        fprintf(stderr, "start:      %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
         fprintf(stderr, "-----------------------------------\n");
         pos = m_end;
-        fprintf(stderr, "end:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.offset());
+        fprintf(stderr, "end:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
         fprintf(stderr, "-----------------------------------\n");
     }
 
@@ -556,7 +608,7 @@ void Selection::debugPosition() const
 
 #ifndef NDEBUG
 
-void Selection::formatForDebugger(char* buffer, unsigned length) const
+void VisibleSelection::formatForDebugger(char* buffer, unsigned length) const
 {
     String result;
     String s;
@@ -577,11 +629,11 @@ void Selection::formatForDebugger(char* buffer, unsigned length) const
     strncpy(buffer, result.utf8().data(), length - 1);
 }
 
-void Selection::showTreeForThis() const
+void VisibleSelection::showTreeForThis() const
 {
     if (start().node()) {
         start().node()->showTreeAndMark(start().node(), "S", end().node(), "E");
-        fprintf(stderr, "start offset: %d, end offset: %d\n", start().offset(), end().offset());
+        fprintf(stderr, "start offset: %d, end offset: %d\n", start().deprecatedEditingOffset(), end().deprecatedEditingOffset());
     }
 }
 
@@ -591,12 +643,12 @@ void Selection::showTreeForThis() const
 
 #ifndef NDEBUG
 
-void showTree(const WebCore::Selection& sel)
+void showTree(const WebCore::VisibleSelection& sel)
 {
     sel.showTreeForThis();
 }
 
-void showTree(const WebCore::Selection* sel)
+void showTree(const WebCore::VisibleSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
diff --git a/src/3rdparty/webkit/WebCore/editing/Selection.h b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
index 5e21701ec5..e346b27e72 100644
--- a/src/3rdparty/webkit/WebCore/editing/Selection.h
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef Selection_h
-#define Selection_h
+#ifndef VisibleSelection_h
+#define VisibleSelection_h
 
 #include "TextGranularity.h"
 #include "VisiblePosition.h"
@@ -35,24 +35,23 @@ class Position;
 
 const EAffinity SEL_DEFAULT_AFFINITY = DOWNSTREAM;
 
-class Selection {
+class VisibleSelection {
 public:
-    enum EState { NONE, CARET, RANGE };
-    enum EDirection { FORWARD, BACKWARD, RIGHT, LEFT };
+    enum SelectionType { NoSelection, CaretSelection, RangeSelection };
 
-    Selection();
+    VisibleSelection();
 
-    Selection(const Position&, EAffinity);
-    Selection(const Position&, const Position&, EAffinity);
+    VisibleSelection(const Position&, EAffinity);
+    VisibleSelection(const Position&, const Position&, EAffinity = SEL_DEFAULT_AFFINITY);
 
-    Selection(const Range*, EAffinity = SEL_DEFAULT_AFFINITY);
+    VisibleSelection(const Range*, EAffinity = SEL_DEFAULT_AFFINITY);
     
-    Selection(const VisiblePosition&);
-    Selection(const VisiblePosition&, const VisiblePosition&);
+    VisibleSelection(const VisiblePosition&);
+    VisibleSelection(const VisiblePosition&, const VisiblePosition&);
 
-    static Selection selectionFromContentsOfNode(Node*);
+    static VisibleSelection selectionFromContentsOfNode(Node*);
 
-    EState state() const { return m_state; }
+    SelectionType selectionType() const { return m_selectionType; }
 
     void setAffinity(EAffinity affinity) { m_affinity = affinity; }
     EAffinity affinity() const { return m_affinity; }
@@ -63,26 +62,34 @@ public:
     void setExtent(const VisiblePosition&);
     
     Position base() const { return m_base; }
-    Position extent() const { return m_extent; }    
+    Position extent() const { return m_extent; }
     Position start() const { return m_start; }
     Position end() const { return m_end; }
     
     VisiblePosition visibleStart() const { return VisiblePosition(m_start, isRange() ? DOWNSTREAM : affinity()); }
     VisiblePosition visibleEnd() const { return VisiblePosition(m_end, isRange() ? UPSTREAM : affinity()); }
 
-    bool isNone() const { return state() == NONE; }
-    bool isCaret() const { return state() == CARET; }
-    bool isRange() const { return state() == RANGE; }
-    bool isCaretOrRange() const { return state() != NONE; }
+    bool isNone() const { return selectionType() == NoSelection; }
+    bool isCaret() const { return selectionType() == CaretSelection; }
+    bool isRange() const { return selectionType() == RangeSelection; }
+    bool isCaretOrRange() const { return selectionType() != NoSelection; }
 
     bool isBaseFirst() const { return m_baseIsFirst; }
 
+    bool isAll(StayInEditableContent) const;
+
     void appendTrailingWhitespace();
 
     bool expandUsingGranularity(TextGranularity granularity);
     TextGranularity granularity() const { return m_granularity; }
 
-    PassRefPtr<Range> toRange() const;
+    // We don't yet support multi-range selections, so we only ever have one range to return.
+    PassRefPtr<Range> firstRange() const;
+
+    // FIXME: Most callers probably don't want this function, but are using it
+    // for historical reasons.  toNormalizedRange contracts the range around
+    // text, and moves the caret upstream before returning the range.
+    PassRefPtr<Range> toNormalizedRange() const;
     
     Element* rootEditableElement() const;
     bool isContentEditable() const;
@@ -100,27 +107,33 @@ public:
 
 private:
     void validate();
-    void adjustForEditableContent();
 
-    Position m_base;                  // base position for the selection
-    Position m_extent;                // extent position for the selection
-    Position m_start;                 // start position for the selection
-    Position m_end;                   // end position for the selection
+    // Support methods for validate()
+    void setBaseAndExtentToDeepEquivalents();
+    void setStartAndEndFromBaseAndExtentRespectingGranularity();
+    void adjustSelectionToAvoidCrossingEditingBoundaries();
+    void updateSelectionType();
+
+    // FIXME: These should all be VisiblePositions
+    Position m_base;   // Where the first click happened
+    Position m_extent; // Where the end click happened
+    Position m_start;  // Leftmost position when expanded to respect granularity
+    Position m_end;    // Rightmost position when expanded to respect granularity
 
-    EAffinity m_affinity;             // the upstream/downstream affinity of the caret
-    TextGranularity m_granularity;   // granularity of start/end selection
+    EAffinity m_affinity;           // the upstream/downstream affinity of the caret
+    TextGranularity m_granularity;  // granularity of start/end selection
 
     // these are cached, can be recalculated by validate()
-    EState m_state;                   // the state of the selection
+    SelectionType m_selectionType;    // None, Caret, Range
     bool m_baseIsFirst;               // true if base is before the extent
 };
 
-inline bool operator==(const Selection& a, const Selection& b)
+inline bool operator==(const VisibleSelection& a, const VisibleSelection& b)
 {
     return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity() && a.granularity() == b.granularity() && a.isBaseFirst() == b.isBaseFirst();
 }
 
-inline bool operator!=(const Selection& a, const Selection& b)
+inline bool operator!=(const VisibleSelection& a, const VisibleSelection& b)
 {
     return !(a == b);
 }
@@ -129,8 +142,8 @@ inline bool operator!=(const Selection& a, const Selection& b)
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
-void showTree(const WebCore::Selection&);
-void showTree(const WebCore::Selection*);
+void showTree(const WebCore::VisibleSelection&);
+void showTree(const WebCore::VisibleSelection*);
 #endif
 
-#endif // Selection_h
+#endif // VisibleSelection_h
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/SystemTimeQt.cpp b/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp
index a9f3d9875d..8e003264ce 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/SystemTimeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp
@@ -1,7 +1,6 @@
 /*
- * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
- *
- * All rights reserved.
+ * Copyright 2009, The Android Open Source Project
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,25 +21,19 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
-#include "SystemTime.h"
+#include "Editor.h"
 
-#include <sys/time.h>
+#include "ClipboardAndroid.h"
 
 namespace WebCore {
 
-double currentTime()
+PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
 {
-    struct timeval tv;
-    struct timezone tz;
-
-    gettimeofday(&tv, &tz);
-    return (double)tv.tv_sec + (double)(tv.tv_usec / 1000000.0);
-}
-
+    return new ClipboardAndroid(policy, false);
 }
 
-// vim: ts=4 sw=4 et
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp b/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp
new file mode 100644
index 0000000000..1ea085b7d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Editor.h"
+
+#include "ChromiumDataObject.h"
+#include "ClipboardChromium.h"
+
+namespace WebCore {
+
+PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
+{
+    return ClipboardChromium::create(false, ChromiumDataObject::create(), policy);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/ListMarkerBox.cpp b/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp
index 0455eae29a..52fbbab539 100644
--- a/src/3rdparty/webkit/WebCore/rendering/ListMarkerBox.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp
@@ -1,10 +1,5 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
- * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
+/*
+ * Copyright (C) 2009 Igalia S.L.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,26 +15,31 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
-
+ 
 #include "config.h"
-#include "ListMarkerBox.h"
+#include "SelectionController.h"
 
-#include "InlineFlowBox.h"
-#include "RenderArena.h"
-#include "RenderListMarker.h"
+#include "AXObjectCache.h"
+#include "Frame.h"
+
+#include <gtk/gtk.h>
 
 namespace WebCore {
 
-ListMarkerBox::ListMarkerBox(RenderObject* obj)
-    : InlineBox(obj)
+void SelectionController::notifyAccessibilityForSelectionChange()
 {
-}
+    if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull()) {
+        RenderObject* focusedNode = m_sel.start().node()->renderer();
+        AccessibilityObject* accessibilityObject = m_frame->document()->axObjectCache()->getOrCreate(focusedNode);
+        AtkObject* wrapper = accessibilityObject->wrapper();
+        if (ATK_IS_TEXT(wrapper)) {
+            g_signal_emit_by_name(wrapper, "text-caret-moved", m_sel.start().offsetInContainerNode());
 
-bool ListMarkerBox::isText() const
-{
-    return static_cast<RenderListMarker*>(object())->isText();
+            if (m_sel.isRange())
+                g_signal_emit_by_name(wrapper, "text-selection-changed");
+        }
+    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
index ab2e397575..7b51295cdc 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
@@ -39,9 +39,8 @@
 #include "HTMLUListElement.h"
 #include "PositionIterator.h"
 #include "RenderObject.h"
-#include "RegularExpression.h"
 #include "Range.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "Text.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
@@ -99,8 +98,8 @@ int comparePositions(const Position& a, const Position& b)
     ASSERT(nodeA);
     Node* nodeB = b.node();
     ASSERT(nodeB);
-    int offsetA = a.offset();
-    int offsetB = b.offset();
+    int offsetA = a.deprecatedEditingOffset();
+    int offsetB = b.deprecatedEditingOffset();
 
     Node* shadowAncestorA = nodeA->shadowAncestorNode();
     if (shadowAncestorA == nodeA)
@@ -127,6 +126,11 @@ int comparePositions(const Position& a, const Position& b)
     return result ? result : bias;
 }
 
+int comparePositions(const VisiblePosition& a, const VisiblePosition& b)
+{
+    return comparePositions(a.deepEquivalent(), b.deepEquivalent());
+}
+
 Node* highestEditableRoot(const Position& position)
 {
     Node* node = position.node();
@@ -222,8 +226,8 @@ Position nextVisuallyDistinctCandidate(const Position& position)
 {
     Position p = position;
     Position downstreamStart = p.downstream();
-    while (!p.atEnd()) {
-        p = p.next(UsingComposedCharacters);
+    while (!p.atEndOfTree()) {
+        p = p.next(Character);
         if (p.isCandidate() && p.downstream() != downstreamStart)
             return p;
     }
@@ -245,8 +249,8 @@ Position previousVisuallyDistinctCandidate(const Position& position)
 {
     Position p = position;
     Position downstreamStart = p.downstream();
-    while (!p.atStart()) {
-        p = p.previous(UsingComposedCharacters);
+    while (!p.atStartOfTree()) {
+        p = p.previous(Character);
         if (p.isCandidate() && p.downstream() != downstreamStart)
             return p;
     }
@@ -256,14 +260,14 @@ Position previousVisuallyDistinctCandidate(const Position& position)
 VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& position, Node* highestRoot)
 {
     // position falls before highestRoot.
-    if (comparePositions(position, Position(highestRoot, 0)) == -1 && highestRoot->isContentEditable())
-        return VisiblePosition(Position(highestRoot, 0));
-        
+    if (comparePositions(position, firstDeepEditingPositionForNode(highestRoot)) == -1 && highestRoot->isContentEditable())
+        return firstDeepEditingPositionForNode(highestRoot);
+
     Position p = position;
     
     if (Node* shadowAncestor = p.node()->shadowAncestorNode())
         if (shadowAncestor != p.node())
-            p = Position(shadowAncestor, maxDeepOffset(shadowAncestor));
+            p = lastDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
@@ -277,14 +281,14 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
 VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& position, Node* highestRoot)
 {
     // When position falls after highestRoot, the result is easy to compute.
-    if (comparePositions(position, Position(highestRoot, maxDeepOffset(highestRoot))) == 1)
-        return VisiblePosition(Position(highestRoot, maxDeepOffset(highestRoot)));
-        
+    if (comparePositions(position, lastDeepEditingPositionForNode(highestRoot)) == 1)
+        return lastDeepEditingPositionForNode(highestRoot);
+
     Position p = position;
     
     if (Node* shadowAncestor = p.node()->shadowAncestorNode())
         if (shadowAncestor != p.node())
-            p = Position(shadowAncestor, 0);
+            p = firstDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
@@ -295,6 +299,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
     return VisiblePosition(p);
 }
 
+// FIXME: The method name, comment, and code say three different things here!
 // Whether or not content before and after this node will collapse onto the same line as it.
 bool isBlock(const Node* node)
 {
@@ -310,39 +315,44 @@ Node* enclosingBlock(Node* node)
     return static_cast<Element*>(enclosingNodeOfType(Position(node, 0), isBlock));
 }
 
+// Internally editing uses "invalid" positions for historical reasons.  For
+// example, in <div><img /></div>, Editing might use (img, 1) for the position
+// after <img>, but we have to convert that to (div, 1) before handing the
+// position to a Range object.  Ideally all internal positions should
+// be "range compliant" for simplicity.
 Position rangeCompliantEquivalent(const Position& pos)
 {
     if (pos.isNull())
         return Position();
 
-    Node *node = pos.node();
-    
-    if (pos.offset() <= 0) {
+    Node* node = pos.node();
+
+    if (pos.deprecatedEditingOffset() <= 0) {
         if (node->parentNode() && (editingIgnoresContent(node) || isTableElement(node)))
             return positionBeforeNode(node);
         return Position(node, 0);
     }
-    
+
     if (node->offsetInCharacters())
-        return Position(node, min(node->maxCharacterOffset(), pos.offset()));
-    
+        return Position(node, min(node->maxCharacterOffset(), pos.deprecatedEditingOffset()));
+
     int maxCompliantOffset = node->childNodeCount();
-    if (pos.offset() > maxCompliantOffset) {
+    if (pos.deprecatedEditingOffset() > maxCompliantOffset) {
         if (node->parentNode())
             return positionAfterNode(node);
-        
+
         // there is no other option at this point than to
         // use the highest allowed position in the node
         return Position(node, maxCompliantOffset);
     } 
 
     // Editing should never generate positions like this.
-    if ((pos.offset() < maxCompliantOffset) && editingIgnoresContent(node)) {
+    if ((pos.deprecatedEditingOffset() < maxCompliantOffset) && editingIgnoresContent(node)) {
         ASSERT_NOT_REACHED();
         return node->parentNode() ? positionBeforeNode(node) : Position(node, 0);
     }
     
-    if (pos.offset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
+    if (pos.deprecatedEditingOffset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
         return positionAfterNode(node);
     
     return Position(pos);
@@ -357,7 +367,7 @@ Position rangeCompliantEquivalent(const VisiblePosition& vpos)
 // in a node.  It returns 1 for some elements even though they do not have children, which
 // creates technically invalid DOM Positions.  Be sure to call rangeCompliantEquivalent
 // on a Position before using it to create a DOM Range, or an exception will be thrown.
-int maxDeepOffset(const Node *node)
+int lastOffsetForEditing(const Node* node)
 {
     ASSERT(node);
     if (!node)
@@ -537,7 +547,7 @@ Position positionOutsideContainingSpecialElement(const Position &pos, Node **con
 Node* isFirstPositionAfterTable(const VisiblePosition& visiblePosition)
 {
     Position upstream(visiblePosition.deepEquivalent().upstream());
-    if (upstream.node() && upstream.node()->renderer() && upstream.node()->renderer()->isTable() && upstream.offset() == maxDeepOffset(upstream.node()))
+    if (upstream.node() && upstream.node()->renderer() && upstream.node()->renderer()->isTable() && upstream.atLastEditingPositionForNode())
         return upstream.node();
     
     return 0;
@@ -546,19 +556,21 @@ Node* isFirstPositionAfterTable(const VisiblePosition& visiblePosition)
 Node* isLastPositionBeforeTable(const VisiblePosition& visiblePosition)
 {
     Position downstream(visiblePosition.deepEquivalent().downstream());
-    if (downstream.node() && downstream.node()->renderer() && downstream.node()->renderer()->isTable() && downstream.offset() == 0)
+    if (downstream.node() && downstream.node()->renderer() && downstream.node()->renderer()->isTable() && downstream.atFirstEditingPositionForNode())
         return downstream.node();
     
     return 0;
 }
 
-Position positionBeforeNode(const Node *node)
+Position positionBeforeNode(const Node* node)
 {
+    // FIXME: This should ASSERT(node->parentNode())
     return Position(node->parentNode(), node->nodeIndex());
 }
 
-Position positionAfterNode(const Node *node)
+Position positionAfterNode(const Node* node)
 {
+    // FIXME: This should ASSERT(node->parentNode())
     return Position(node->parentNode(), node->nodeIndex() + 1);
 }
 
@@ -695,16 +707,17 @@ static Node* appendedSublist(Node* listItem)
     return 0;
 }
 
+// FIXME: This method should not need to call isStartOfParagraph/isEndOfParagraph
 Node* enclosingEmptyListItem(const VisiblePosition& visiblePos)
 {
     // Check that position is on a line by itself inside a list item
     Node* listChildNode = enclosingListChild(visiblePos.deepEquivalent().node());
     if (!listChildNode || !isStartOfParagraph(visiblePos) || !isEndOfParagraph(visiblePos))
         return 0;
-        
-    VisiblePosition firstInListChild(Position(listChildNode, 0));
-    VisiblePosition lastInListChild(Position(listChildNode, maxDeepOffset(listChildNode)));
-    
+
+    VisiblePosition firstInListChild(firstDeepEditingPositionForNode(listChildNode));
+    VisiblePosition lastInListChild(lastDeepEditingPositionForNode(listChildNode));
+
     if (firstInListChild != visiblePos || lastInListChild != visiblePos)
         return 0;
     
@@ -714,15 +727,6 @@ Node* enclosingEmptyListItem(const VisiblePosition& visiblePos)
     return listChildNode;
 }
 
-Node* outermostEnclosingListChild(Node* node)
-{
-    Node* listNode = 0;
-    Node* nextNode = node;
-    while ((nextNode = enclosingListChild(nextNode)))
-        listNode = nextNode;
-    return listNode;
-}
-
 HTMLElement* outermostEnclosingList(Node* node)
 {
     HTMLElement* list = enclosingList(node);
@@ -786,9 +790,14 @@ PassRefPtr<HTMLElement> createListItemElement(Document* document)
     return new HTMLLIElement(liTag, document);
 }
 
+PassRefPtr<HTMLElement> createHTMLElement(Document* document, const QualifiedName& name)
+{
+    return HTMLElementFactory::createHTMLElement(name, document, 0, false);
+}
+
 PassRefPtr<HTMLElement> createHTMLElement(Document* document, const AtomicString& tagName)
 {
-    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, tagName, xhtmlNamespaceURI), document, 0, false);
+    return createHTMLElement(document, QualifiedName(nullAtom, tagName, xhtmlNamespaceURI));
 }
 
 bool isTabSpanNode(const Node *node)
@@ -819,16 +828,16 @@ Position positionBeforeTabSpan(const Position& pos)
 
 PassRefPtr<Element> createTabSpanElement(Document* document, PassRefPtr<Node> tabTextNode)
 {
-    // make the span to hold the tab
-    ExceptionCode ec = 0;
-    RefPtr<Element> spanElement = document->createElementNS(xhtmlNamespaceURI, "span", ec);
-    ASSERT(ec == 0);
+    // Make the span to hold the tab.
+    RefPtr<Element> spanElement = document->createElement(spanTag, false);
     spanElement->setAttribute(classAttr, AppleTabSpanClass);
     spanElement->setAttribute(styleAttr, "white-space:pre");
 
-    // add tab text to that span
+    // Add tab text to that span.
     if (!tabTextNode)
         tabTextNode = document->createEditingTextNode("\t");
+
+    ExceptionCode ec = 0;
     spanElement->appendChild(tabTextNode, ec);
     ASSERT(ec == 0);
 
@@ -878,7 +887,7 @@ unsigned numEnclosingMailBlockquotes(const Position& p)
 
 bool isMailBlockquote(const Node *node)
 {
-    if (!node || !node->isElementNode() && !node->hasTagName(blockquoteTag))
+    if (!node || (!node->isElementNode() && !node->hasTagName(blockquoteTag)))
         return false;
         
     return static_cast<const Element *>(node)->getAttribute("type") == "cite";
@@ -891,36 +900,44 @@ int caretMinOffset(const Node* n)
     return r ? r->caretMinOffset() : 0;
 }
 
+// If a node can contain candidates for VisiblePositions, return the offset of the last candidate, otherwise 
+// return the number of children for container nodes and the length for unrendered text nodes.
 int caretMaxOffset(const Node* n)
 {
-    RenderObject* r = n->renderer();
-    ASSERT(!n->isCharacterDataNode() || !r || r->isText()); // FIXME: This was a runtime check that seemingly couldn't fail; changed it to an assertion for now.
-    if (r)
-        return r->caretMaxOffset();
+    // For rendered text nodes, return the last position that a caret could occupy.
+    if (n->isTextNode() && n->renderer())
+        return n->renderer()->caretMaxOffset();
+    // For containers return the number of children.  For others do the same as above.
+    return lastOffsetForEditing(n);
+}
 
-    if (n->isCharacterDataNode()) {
-        const CharacterData* c = static_cast<const CharacterData*>(n);
-        return static_cast<int>(c->length());
-    }
-    return 1;
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition& visiblePosition)
+{
+    return lineBreakExistsAtPosition(visiblePosition.deepEquivalent().downstream());
 }
 
-bool lineBreakExistsAtPosition(const VisiblePosition& visiblePosition)
+bool lineBreakExistsAtPosition(const Position& position)
 {
-    if (visiblePosition.isNull())
+    if (position.isNull())
         return false;
-        
-    Position downstream(visiblePosition.deepEquivalent().downstream());
-    return downstream.node()->hasTagName(brTag) ||
-           downstream.node()->isTextNode() && downstream.node()->renderer()->style()->preserveNewline() && visiblePosition.characterAfter() == '\n';
+    
+    if (position.anchorNode()->hasTagName(brTag) && position.atFirstEditingPositionForNode())
+        return true;
+    
+    if (!position.anchorNode()->isTextNode() || !position.anchorNode()->renderer()->style()->preserveNewline())
+        return false;
+    
+    Text* textNode = static_cast<Text*>(position.anchorNode());
+    unsigned offset = position.offsetInContainerNode();
+    return offset < textNode->length() && textNode->data()[offset] == '\n';
 }
 
 // Modifies selections that have an end point at the edge of a table
 // that contains the other endpoint so that they don't confuse
 // code that iterates over selected paragraphs.
-Selection selectionForParagraphIteration(const Selection& original)
+VisibleSelection selectionForParagraphIteration(const VisibleSelection& original)
 {
-    Selection newSelection(original);
+    VisibleSelection newSelection(original);
     VisiblePosition startOfSelection(newSelection.visibleStart());
     VisiblePosition endOfSelection(newSelection.visibleEnd());
     
@@ -930,7 +947,7 @@ Selection selectionForParagraphIteration(const Selection& original)
     // (a table is itself a paragraph).
     if (Node* table = isFirstPositionAfterTable(endOfSelection))
         if (startOfSelection.deepEquivalent().node()->isDescendantOf(table))
-            newSelection = Selection(startOfSelection, endOfSelection.previous(true));
+            newSelection = VisibleSelection(startOfSelection, endOfSelection.previous(true));
     
     // If the start of the selection to modify is just before a table,
     // and if the end of the selection is inside that table, then the first paragraph
@@ -938,7 +955,7 @@ Selection selectionForParagraphIteration(const Selection& original)
     // containing the table itself.
     if (Node* table = isLastPositionBeforeTable(startOfSelection))
         if (endOfSelection.deepEquivalent().node()->isDescendantOf(table))
-            newSelection = Selection(startOfSelection.next(true), endOfSelection);
+            newSelection = VisibleSelection(startOfSelection.next(true), endOfSelection);
     
     return newSelection;
 }
@@ -984,12 +1001,12 @@ PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
     return Range::create(document, startContainer, startOffset, endContainer, endOffset);
 }
 
-Selection avoidIntersectionWithNode(const Selection& selection, Node* node)
+VisibleSelection avoidIntersectionWithNode(const VisibleSelection& selection, Node* node)
 {
     if (selection.isNone())
-        return Selection(selection);
+        return VisibleSelection(selection);
         
-    Selection updatedSelection(selection);
+    VisibleSelection updatedSelection(selection);
     Node* base = selection.base().node();
     Node* extent = selection.extent().node();
     ASSERT(base);
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.h b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
index 634bbd4239..374b512d57 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.h
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
@@ -37,13 +37,13 @@ class HTMLElement;
 class Node;
 class Position;
 class Range;
-class Selection;
 class String;
 class VisiblePosition;
+class VisibleSelection;
 
 Position rangeCompliantEquivalent(const Position&);
 Position rangeCompliantEquivalent(const VisiblePosition&);
-int maxDeepOffset(const Node*);
+int lastOffsetForEditing(const Node*);
 bool isAtomicNode(const Node*);
 bool editingIgnoresContent(const Node*);
 bool canHaveChildrenForEditing(const Node*);
@@ -51,6 +51,7 @@ Node* highestEditableRoot(const Position&);
 VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
 VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
 int comparePositions(const Position&, const Position&);
+int comparePositions(const VisiblePosition&, const VisiblePosition&);
 Node* lowestEditableAncestor(Node*);
 bool isContentEditable(const Node*);
 Position nextCandidate(const Position&);
@@ -72,7 +73,7 @@ Position positionBeforeNode(const Node*);
 Position positionAfterNode(const Node*);
 
 PassRefPtr<Range> avoidIntersectionWithNode(const Range*, Node*);
-Selection avoidIntersectionWithNode(const Selection&, Node*);
+VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
 
 bool isSpecialElement(const Node*);
 bool validBlockTag(const String&);
@@ -82,6 +83,7 @@ PassRefPtr<HTMLElement> createBreakElement(Document*);
 PassRefPtr<HTMLElement> createOrderedListElement(Document*);
 PassRefPtr<HTMLElement> createUnorderedListElement(Document*);
 PassRefPtr<HTMLElement> createListItemElement(Document*);
+PassRefPtr<HTMLElement> createHTMLElement(Document*, const QualifiedName&);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const AtomicString&);
 
 bool isTabSpanNode(const Node*);
@@ -126,9 +128,10 @@ Node* highestAncestor(Node*);
 bool isTableElement(Node*);
 bool isTableCell(const Node*);
 
-bool lineBreakExistsAtPosition(const VisiblePosition&);
+bool lineBreakExistsAtPosition(const Position&);
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
 
-Selection selectionForParagraphIteration(const Selection&);
+VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
 
 int indexForVisiblePosition(VisiblePosition&);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 83445f744b..d6fe1cea10 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
 #include "CharacterNames.h"
 #include "Comment.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
@@ -52,7 +53,7 @@
 #include "ProcessingInstruction.h"
 #include "QualifiedName.h"
 #include "Range.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
 #include "visible_units.h"
@@ -190,7 +191,7 @@ static void appendQuotedURLAttributeValue(Vector<UChar>& result, const String& u
 {
     UChar quoteChar = '\"';
     String strippedURLString = urlString.stripWhiteSpace();
-    if (protocolIs(strippedURLString, "javascript")) {
+    if (protocolIsJavaScript(strippedURLString)) {
         // minimal escaping for javascript urls
         if (strippedURLString.contains('"')) {
             if (strippedURLString.contains('\''))
@@ -387,7 +388,14 @@ static void appendDocumentType(Vector<UChar>& result, const DocumentType* n)
     append(result, ">");
 }
 
-static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Range *range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+static void removeExteriorStyles(CSSMutableStyleDeclaration* style)
+{
+    style->removeProperty(CSSPropertyFloat);
+}
+
+enum RangeFullySelectsNode { DoesFullySelectNode, DoesNotFullySelectNode };
+
+static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
     bool documentIsHTML = node->document()->isHTMLDocument();
     switch (node->nodeType()) {
@@ -408,8 +416,7 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
             
             bool useRenderedText = !enclosingNodeWithTag(Position(const_cast<Node*>(node), 0), selectTag);
             String markup = escapeContentText(useRenderedText ? renderedText(node, range) : stringValueForRange(node, range), false);
-            if (annotate)
-                markup = convertHTMLTextToInterchangeFormat(markup, static_cast<const Text*>(node));
+            markup = convertHTMLTextToInterchangeFormat(markup, static_cast<const Text*>(node));
             append(result, markup);
             break;
         }
@@ -438,9 +445,9 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
         case Node::ELEMENT_NODE: {
             result.append('<');
             const Element* el = static_cast<const Element*>(node);
-            bool convert = convertBlocksToInlines & isBlock(const_cast<Node*>(node));
+            bool convert = convertBlocksToInlines && isBlock(const_cast<Node*>(node));
             append(result, el->nodeNamePreservingCase());
-            NamedAttrMap *attrs = el->attributes();
+            NamedNodeMap *attrs = el->attributes();
             unsigned length = attrs->length();
             if (!documentIsHTML && namespaces && shouldAddNamespaceElem(el))
                 appendNamespace(result, el->prefix(), el->namespaceURI(), *namespaces);
@@ -503,6 +510,10 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
                 }
                 if (convert)
                     style->setProperty(CSSPropertyDisplay, CSSValueInline, true);
+                // If the node is not fully selected by the range, then we don't want to keep styles that affect its relationship to the nodes around it
+                // only the ones that affect it and the nodes within it.
+                if (rangeFullySelectsNode == DoesNotFullySelectNode)
+                    removeExteriorStyles(style.get());
                 if (style->length() > 0) {
                     DEFINE_STATIC_LOCAL(const String, stylePrefix, (" style=\""));
                     append(result, stylePrefix);
@@ -537,10 +548,10 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
     }
 }
 
-static String getStartMarkup(const Node *node, const Range *range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+static String getStartMarkup(const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
     Vector<UChar> result;
-    appendStartMarkup(result, node, range, annotate, convertBlocksToInlines, namespaces);
+    appendStartMarkup(result, node, range, annotate, convertBlocksToInlines, namespaces, rangeFullySelectsNode);
     return String::adopt(result);
 }
 
@@ -587,26 +598,50 @@ static String getEndMarkup(const Node *node)
     return String::adopt(result);
 }
 
-static void appendMarkup(Vector<UChar>& result, Node* startNode, bool onlyIncludeChildren, Vector<Node*>* nodes, const HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+class MarkupAccumulator {
+public:
+    MarkupAccumulator(Node* nodeToSkip, Vector<Node*>* nodes)
+        : m_nodeToSkip(nodeToSkip)
+        , m_nodes(nodes)
+    {
+    }
+
+    void appendMarkup(Node* startNode, EChildrenOnly, const HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0);
+
+    String takeResult() { return String::adopt(m_result); }
+
+private:
+    Vector<UChar> m_result;
+    Node* m_nodeToSkip;
+    Vector<Node*>* m_nodes;
+};
+
+// FIXME: Would be nice to do this in a non-recursive way.
+void MarkupAccumulator::appendMarkup(Node* startNode, EChildrenOnly childrenOnly, const HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces)
 {
+    if (startNode == m_nodeToSkip)
+        return;
+
     HashMap<AtomicStringImpl*, AtomicStringImpl*> namespaceHash;
     if (namespaces)
         namespaceHash = *namespaces;
-    
-    if (!onlyIncludeChildren) {
-        if (nodes)
-            nodes->append(startNode);
-        
-        appendStartMarkup(result,startNode, 0, DoNotAnnotateForInterchange, false, &namespaceHash);
+
+    // start tag
+    if (!childrenOnly) {
+        if (m_nodes)
+            m_nodes->append(startNode);
+        appendStartMarkup(m_result, startNode, 0, DoNotAnnotateForInterchange, false, &namespaceHash);
     }
-    // print children
-    if (!(startNode->document()->isHTMLDocument() && doesHTMLForbidEndTag(startNode)))
+
+    // children
+    if (!(startNode->document()->isHTMLDocument() && doesHTMLForbidEndTag(startNode))) {
         for (Node* current = startNode->firstChild(); current; current = current->nextSibling())
-            appendMarkup(result, current, false, nodes, &namespaceHash);
-    
-    // Print my ending tag
-    if (!onlyIncludeChildren)
-        appendEndMarkup(result, startNode);
+            appendMarkup(current, IncludeNode, &namespaceHash);
+    }
+
+    // end tag
+    if (!childrenOnly)
+        appendEndMarkup(m_result, startNode);
 }
 
 static void completeURLs(Node* node, const String& baseURL)
@@ -619,7 +654,7 @@ static void completeURLs(Node* node, const String& baseURL)
     for (Node* n = node; n != end; n = n->traverseNextNode()) {
         if (n->isElementNode()) {
             Element* e = static_cast<Element*>(n);
-            NamedAttrMap* attrs = e->attributes();
+            NamedNodeMap* attrs = e->attributes();
             unsigned length = attrs->length();
             for (unsigned i = 0; i < length; i++) {
                 Attribute* attr = attrs->attributeItem(i);
@@ -677,7 +712,7 @@ static bool elementHasTextDecorationProperty(const Node* node)
     return !propertyMissingOrEqualToNone(style.get(), CSSPropertyTextDecoration);
 }
 
-String joinMarkups(const Vector<String> preMarkups, const Vector<String>& postMarkups)
+static String joinMarkups(const Vector<String>& preMarkups, const Vector<String>& postMarkups)
 {
     size_t length = 0;
 
@@ -690,7 +725,7 @@ String joinMarkups(const Vector<String> preMarkups, const Vector<String>& postMa
         length += postMarkups[i].length();
 
     Vector<UChar> result;
-    result.reserveCapacity(length);
+    result.reserveInitialCapacity(length);
 
     for (size_t i = preCount; i > 0; --i)
         append(result, preMarkups[i - 1]);
@@ -701,6 +736,33 @@ String joinMarkups(const Vector<String> preMarkups, const Vector<String>& postMa
     return String::adopt(result);
 }
 
+static bool isSpecialAncestorBlock(Node* node)
+{
+    if (!node || !isBlock(node))
+        return false;
+        
+    return node->hasTagName(listingTag) ||
+           node->hasTagName(olTag) ||
+           node->hasTagName(preTag) ||
+           node->hasTagName(tableTag) ||
+           node->hasTagName(ulTag) ||
+           node->hasTagName(xmpTag) ||
+           node->hasTagName(h1Tag) ||
+           node->hasTagName(h2Tag) ||
+           node->hasTagName(h3Tag) ||
+           node->hasTagName(h4Tag) ||
+           node->hasTagName(h5Tag);
+}
+
+static bool shouldIncludeWrapperForFullySelectedRoot(Node* fullySelectedRoot, CSSMutableStyleDeclaration* style)
+{
+    if (fullySelectedRoot->isElementNode() && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
+        return true;
+        
+    return style->getPropertyCSSValue(CSSPropertyBackgroundImage) ||
+           style->getPropertyCSSValue(CSSPropertyBackgroundColor);
+}
+
 // FIXME: Shouldn't we omit style info when annotate == DoNotAnnotateForInterchange? 
 // FIXME: At least, annotation and style info should probably not be included in range.markupString()
 String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterchange annotate, bool convertBlocksToInlines)
@@ -757,14 +819,20 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
 
         markups.append(interchangeNewlineString);
         startNode = visibleStart.next().deepEquivalent().node();
+
+        if (pastEnd && Range::compareBoundaryPoints(startNode, 0, pastEnd, 0) >= 0) {
+            if (deleteButton)
+                deleteButton->enable();
+            return interchangeNewlineString;
+        }
     }
 
     Node* next;
     for (Node* n = startNode; n != pastEnd; n = next) {
-    
-        // According to <rdar://problem/5730668>, it is possible for n to blow past pastEnd and become null here.  This 
-        // shouldn't be possible.  This null check will prevent crashes (but create too much markup) and the ASSERT will 
-        // hopefully lead us to understanding the problem.
+        // According to <rdar://problem/5730668>, it is possible for n to blow
+        // past pastEnd and become null here. This shouldn't be possible.
+        // This null check will prevent crashes (but create too much markup)
+        // and the ASSERT will hopefully lead us to understanding the problem.
         ASSERT(n);
         if (!n)
             break;
@@ -837,7 +905,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
             // We added markup for this node, and we're descending into it.  Set it to close eventually.
             ancestorsToClose.append(n);
     }
-    
+
     // Include ancestors that aren't completely inside the range but are required to retain 
     // the structure and appearance of the copied markup.
     Node* specialCommonAncestor = 0;
@@ -849,12 +917,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                 table = table->parentNode();
             if (table)
                 specialCommonAncestor = table;
-        } else if (commonAncestorBlock->hasTagName(listingTag)
-                    || commonAncestorBlock->hasTagName(olTag)
-                    || commonAncestorBlock->hasTagName(preTag)
-                    || commonAncestorBlock->hasTagName(tableTag)
-                    || commonAncestorBlock->hasTagName(ulTag)
-                    || commonAncestorBlock->hasTagName(xmpTag))
+        } else if (isSpecialAncestorBlock(commonAncestorBlock))
             specialCommonAncestor = commonAncestorBlock;
     }
                                       
@@ -885,29 +948,29 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
         specialCommonAncestor = enclosingAnchor;
     
     Node* body = enclosingNodeWithTag(Position(commonAncestor, 0), bodyTag);
-    // FIXME: Only include markup for a fully selected root (and ancestors of lastClosed up to that root) if
-    // there are styles/attributes on those nodes that need to be included to preserve the appearance of the copied markup.
     // FIXME: Do this for all fully selected blocks, not just the body.
-    Node* fullySelectedRoot = body && *Selection::selectionFromContentsOfNode(body).toRange() == *updatedRange ? body : 0;
-    if (annotate && fullySelectedRoot)
-        specialCommonAncestor = fullySelectedRoot;
+    Node* fullySelectedRoot = body && *VisibleSelection::selectionFromContentsOfNode(body).toNormalizedRange() == *updatedRange ? body : 0;
+    RefPtr<CSSMutableStyleDeclaration> fullySelectedRootStyle = fullySelectedRoot ? styleFromMatchedRulesAndInlineDecl(fullySelectedRoot) : 0;
+    if (annotate && fullySelectedRoot) {
+        if (shouldIncludeWrapperForFullySelectedRoot(fullySelectedRoot, fullySelectedRootStyle.get()))
+            specialCommonAncestor = fullySelectedRoot;
+    }
         
     if (specialCommonAncestor && lastClosed) {
         // Also include all of the ancestors of lastClosed up to this special ancestor.
         for (Node* ancestor = lastClosed->parentNode(); ancestor; ancestor = ancestor->parentNode()) {
             if (ancestor == fullySelectedRoot && !convertBlocksToInlines) {
-                RefPtr<CSSMutableStyleDeclaration> style = styleFromMatchedRulesAndInlineDecl(fullySelectedRoot);
                 
                 // Bring the background attribute over, but not as an attribute because a background attribute on a div
                 // appears to have no effect.
-                if (!style->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
-                    style->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
+                if (!fullySelectedRootStyle->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
+                    fullySelectedRootStyle->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
                 
-                if (style->length()) {
+                if (fullySelectedRootStyle->length()) {
                     Vector<UChar> openTag;
                     DEFINE_STATIC_LOCAL(const String, divStyle, ("<div style=\""));
                     append(openTag, divStyle);
-                    appendAttributeValue(openTag, style->cssText(), documentIsHTML);
+                    appendAttributeValue(openTag, fullySelectedRootStyle->cssText(), documentIsHTML);
                     openTag.append('\"');
                     openTag.append('>');
                     preMarkups.append(String::adopt(openTag));
@@ -916,7 +979,9 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                     markups.append(divCloseTag);
                 }
             } else {
-                preMarkups.append(getStartMarkup(ancestor, updatedRange.get(), annotate, convertBlocksToInlines));
+                // Since this node and all the other ancestors are not in the selection we want to set RangeFullySelectsNode to DoesNotFullySelectNode
+                // so that styles that affect the exterior of the node are not included.
+                preMarkups.append(getStartMarkup(ancestor, updatedRange.get(), annotate, convertBlocksToInlines, 0, DoesNotFullySelectNode));
                 markups.append(getEndMarkup(ancestor));
             }
             if (nodes)
@@ -1004,30 +1069,21 @@ PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const
     return fragment.release();
 }
 
-String createMarkup(const Node* node, EChildrenOnly includeChildren, Vector<Node*>* nodes)
+String createMarkup(const Node* node, EChildrenOnly childrenOnly, Vector<Node*>* nodes)
 {
-    Vector<UChar> result;
-
     if (!node)
         return "";
 
-    Document* document = node->document();
-    Frame* frame = document->frame();
-    DeleteButtonController* deleteButton = frame ? frame->editor()->deleteButtonController() : 0;
-
-    // disable the delete button so it's elements are not serialized into the markup
-    if (deleteButton) {
-        if (node->isDescendantOf(deleteButton->containerElement()))
+    HTMLElement* deleteButtonContainerElement = 0;
+    if (Frame* frame = node->document()->frame()) {
+        deleteButtonContainerElement = frame->editor()->deleteButtonController()->containerElement();
+        if (node->isDescendantOf(deleteButtonContainerElement))
             return "";
-        deleteButton->disable();
     }
 
-    appendMarkup(result, const_cast<Node*>(node), includeChildren, nodes);
-
-    if (deleteButton)
-        deleteButton->enable();
-
-    return String::adopt(result);
+    MarkupAccumulator accumulator(deleteButtonContainerElement, nodes);
+    accumulator.appendMarkup(const_cast<Node*>(node), childrenOnly);
+    return accumulator.takeResult();
 }
 
 static void fillContainerFromString(ContainerNode* paragraph, const String& string)
@@ -1140,7 +1196,7 @@ PassRefPtr<DocumentFragment> createFragmentFromText(Range* context, const String
             element->setAttribute(classAttr, AppleInterchangeNewline);            
         } else {
             if (useClonesOfEnclosingBlock)
-                element = block->cloneElement();
+                element = block->cloneElementWithoutChildren();
             else
                 element = createDefaultParagraphElement(document);
             fillContainerFromString(element.get(), s);
diff --git a/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp b/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp
index 89ee78ed38..e74e2f36b9 100644
--- a/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp
@@ -31,7 +31,7 @@
 #include "ClipboardQt.h"
 #include "Document.h"
 #include "Element.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
diff --git a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
index 2e151b998b..02e9fb859b 100644
--- a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,13 +34,44 @@
 #include "TextBoundaries.h"
 #include "TextBreakIterator.h"
 #include "TextIterator.h"
+#include "VisiblePosition.h"
 #include "htmlediting.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
 using namespace HTMLNames;
+using namespace WTF::Unicode;
 
-static VisiblePosition previousBoundary(const VisiblePosition &c, unsigned (*searchFunction)(const UChar *, unsigned))
+static int endOfFirstWordBoundaryContext(const UChar* characters, int length)
+{
+    for (int i = 0; i < length; ) {
+        int first = i;
+        UChar32 ch;
+        U16_NEXT(characters, i, length, ch);
+        if (!requiresContextForWordBoundary(ch))
+            return first;
+    }
+    return length;
+}
+
+static int startOfLastWordBoundaryContext(const UChar* characters, int length)
+{
+    for (int i = length; i > 0; ) {
+        int last = i;
+        UChar32 ch;
+        U16_PREV(characters, 0, i, ch);
+        if (!requiresContextForWordBoundary(ch))
+            return last;
+    }
+    return 0;
+}
+
+enum BoundarySearchContextAvailability { DontHaveMoreContext, MayHaveMoreContext };
+
+typedef unsigned (*BoundarySearchFunction)(const UChar*, unsigned length, unsigned offset, BoundarySearchContextAvailability, bool& needMoreContext);
+
+static VisiblePosition previousBoundary(const VisiblePosition& c, BoundarySearchFunction searchFunction)
 {
     Position pos = c.deepEquivalent();
     Node *n = pos.node();
@@ -61,18 +92,38 @@ static VisiblePosition previousBoundary(const VisiblePosition &c, unsigned (*sea
     Position end = rangeCompliantEquivalent(pos);
     RefPtr<Range> searchRange = Range::create(d);
     
-    int exception = 0;
-    searchRange->setStart(start.node(), start.offset(), exception);
-    searchRange->setEnd(end.node(), end.offset(), exception);
+    Vector<UChar, 1024> string;
+    unsigned suffixLength = 0;
+
+    ExceptionCode ec = 0;
+    if (requiresContextForWordBoundary(c.characterBefore())) {
+        RefPtr<Range> forwardsScanRange(d->createRange());
+        forwardsScanRange->setEndAfter(boundary, ec);
+        forwardsScanRange->setStart(end.node(), end.deprecatedEditingOffset(), ec);
+        TextIterator forwardsIterator(forwardsScanRange.get());
+        while (!forwardsIterator.atEnd()) {
+            const UChar* characters = forwardsIterator.characters();
+            int length = forwardsIterator.length();
+            int i = endOfFirstWordBoundaryContext(characters, length);
+            string.append(characters, i);
+            suffixLength += i;
+            if (i < length)
+                break;
+            forwardsIterator.advance();
+        }
+    }
+
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
+    searchRange->setEnd(end.node(), end.deprecatedEditingOffset(), ec);
     
-    ASSERT(!exception);
-    if (exception)
+    ASSERT(!ec);
+    if (ec)
         return VisiblePosition();
-        
+
     SimplifiedBackwardsTextIterator it(searchRange.get());
-    Vector<UChar, 1024> string;
     unsigned next = 0;
     bool inTextSecurityMode = start.node() && start.node()->renderer() && start.node()->renderer()->style()->textSecurity() != TSNONE;
+    bool needMoreContext = false;
     while (!it.atEnd()) {
         // iterate to get chunks until the searchFunction returns a non-zero value.
         if (!inTextSecurityMode) 
@@ -83,36 +134,37 @@ static VisiblePosition previousBoundary(const VisiblePosition &c, unsigned (*sea
             iteratorString = iteratorString.impl()->secure('x');
             string.prepend(iteratorString.characters(), iteratorString.length());
         }
-        
-        next = searchFunction(string.data(), string.size());
+        next = searchFunction(string.data(), string.size(), string.size() - suffixLength, MayHaveMoreContext, needMoreContext);
         if (next != 0)
             break;
         it.advance();
     }
-    
+    if (needMoreContext) {
+        // The last search returned the beginning of the buffer and asked for more context,
+        // but there is no earlier text. Force a search with what's available.
+        next = searchFunction(string.data(), string.size(), string.size() - suffixLength, DontHaveMoreContext, needMoreContext);
+        ASSERT(!needMoreContext);
+    }
+
     if (it.atEnd() && next == 0) {
         pos = it.range()->startPosition();
     } else if (next != 0) {
-        Node *node = it.range()->startContainer(exception);
-        if (node->isTextNode() || (node->renderer() && node->renderer()->isBR()))
+        Node *node = it.range()->startContainer(ec);
+        if ((node->isTextNode() && static_cast<int>(next) <= node->maxCharacterOffset()) || (node->renderer() && node->renderer()->isBR() && !next))
             // The next variable contains a usable index into a text node
             pos = Position(node, next);
         else {
-            // Use the end of the found range, the start is not guaranteed to
-            // be correct.
-            Position end = it.range()->endPosition();
-            VisiblePosition boundary(end);
-            unsigned i = it.length() - next;
-            while (i--)
-                boundary = boundary.previous();
-            return boundary;
+            // Use the character iterator to translate the next value into a DOM position.
+            BackwardsCharacterIterator charIt(searchRange.get());
+            charIt.advance(string.size() - suffixLength - next);
+            pos = charIt.range()->endPosition();
         }
     }
 
     return VisiblePosition(pos, DOWNSTREAM);
 }
 
-static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchFunction)(const UChar *, unsigned))
+static VisiblePosition nextBoundary(const VisiblePosition& c, BoundarySearchFunction searchFunction)
 {
     Position pos = c.deepEquivalent();
     Node *n = pos.node();
@@ -131,13 +183,33 @@ static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchF
 
     RefPtr<Range> searchRange(d->createRange());
     Position start(rangeCompliantEquivalent(pos));
+
+    Vector<UChar, 1024> string;
+    unsigned prefixLength = 0;
+
     ExceptionCode ec = 0;
+    if (requiresContextForWordBoundary(c.characterAfter())) {
+        RefPtr<Range> backwardsScanRange(d->createRange());
+        backwardsScanRange->setEnd(start.node(), start.deprecatedEditingOffset(), ec);
+        SimplifiedBackwardsTextIterator backwardsIterator(backwardsScanRange.get());
+        while (!backwardsIterator.atEnd()) {
+            const UChar* characters = backwardsIterator.characters();
+            int length = backwardsIterator.length();
+            int i = startOfLastWordBoundaryContext(characters, length);
+            string.prepend(characters + i, length - i);
+            prefixLength += length - i;
+            if (i > 0)
+                break;
+            backwardsIterator.advance();
+        }
+    }
+
     searchRange->selectNodeContents(boundary, ec);
-    searchRange->setStart(start.node(), start.offset(), ec);
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
     TextIterator it(searchRange.get(), true);
-    Vector<UChar, 1024> string;
     unsigned next = 0;
     bool inTextSecurityMode = start.node() && start.node()->renderer() && start.node()->renderer()->style()->textSecurity() != TSNONE;
+    bool needMoreContext = false;
     while (!it.atEnd()) {
         // Keep asking the iterator for chunks until the search function
         // returns an end value not equal to the length of the string passed to it.
@@ -149,25 +221,32 @@ static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchF
             iteratorString = iteratorString.impl()->secure('x');
             string.append(iteratorString.characters(), iteratorString.length());
         }
-
-        next = searchFunction(string.data(), string.size());
+        next = searchFunction(string.data(), string.size(), prefixLength, MayHaveMoreContext, needMoreContext);
         if (next != string.size())
             break;
         it.advance();
     }
+    if (needMoreContext) {
+        // The last search returned the end of the buffer and asked for more context,
+        // but there is no further text. Force a search with what's available.
+        next = searchFunction(string.data(), string.size(), prefixLength, DontHaveMoreContext, needMoreContext);
+        ASSERT(!needMoreContext);
+    }
     
     if (it.atEnd() && next == string.size()) {
         pos = it.range()->startPosition();
-    } else if (next != 0) {
+    } else if (next != prefixLength) {
         // Use the character iterator to translate the next value into a DOM position.
         CharacterIterator charIt(searchRange.get(), true);
-        charIt.advance(next - 1);
+        charIt.advance(next - prefixLength - 1);
         pos = charIt.range()->endPosition();
         
-        // FIXME: workaround for collapsed range (where only start position is correct) emitted for some emitted newlines (see rdar://5192593)
-        VisiblePosition visPos = VisiblePosition(pos);
-        if (visPos == VisiblePosition(charIt.range()->startPosition()))
-            pos = visPos.next(true).deepEquivalent();
+        if (*charIt.characters() == '\n') {
+            // FIXME: workaround for collapsed range (where only start position is correct) emitted for some emitted newlines (see rdar://5192593)
+            VisiblePosition visPos = VisiblePosition(pos);
+            if (visPos == VisiblePosition(charIt.range()->startPosition()))
+                pos = visPos.next(true).deepEquivalent();
+        }
     }
 
     // generate VisiblePosition, use UPSTREAM affinity if possible
@@ -176,10 +255,16 @@ static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchF
 
 // ---------
 
-static unsigned startWordBoundary(const UChar* characters, unsigned length)
+static unsigned startWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
+    ASSERT(offset);
+    if (mayHaveMoreContext && !startOfLastWordBoundaryContext(characters, offset)) {
+        needMoreContext = true;
+        return 0;
+    }
+    needMoreContext = false;
     int start, end;
-    findWordBoundary(characters, length, length, &start, &end);
+    findWordBoundary(characters, length, offset - 1, &start, &end);
     return start;
 }
 
@@ -200,10 +285,16 @@ VisiblePosition startOfWord(const VisiblePosition &c, EWordSide side)
     return previousBoundary(p, startWordBoundary);
 }
 
-static unsigned endWordBoundary(const UChar* characters, unsigned length)
+static unsigned endWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
+    ASSERT(offset <= length);
+    if (mayHaveMoreContext && endOfFirstWordBoundaryContext(characters + offset, length - offset) == static_cast<int>(length - offset)) {
+        needMoreContext = true;
+        return length;
+    }
+    needMoreContext = false;
     int start, end;
-    findWordBoundary(characters, length, 0, &start, &end);
+    findWordBoundary(characters, length, offset, &start, &end);
     return end;
 }
 
@@ -223,9 +314,14 @@ VisiblePosition endOfWord(const VisiblePosition &c, EWordSide side)
     return nextBoundary(p, endWordBoundary);
 }
 
-static unsigned previousWordPositionBoundary(const UChar* characters, unsigned length)
+static unsigned previousWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
-    return findNextWordFromIndex(characters, length, length, false);
+    if (mayHaveMoreContext && !startOfLastWordBoundaryContext(characters, offset)) {
+        needMoreContext = true;
+        return 0;
+    }
+    needMoreContext = false;
+    return findNextWordFromIndex(characters, length, offset, false);
 }
 
 VisiblePosition previousWordPosition(const VisiblePosition &c)
@@ -234,9 +330,14 @@ VisiblePosition previousWordPosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrAfter(prev);
 }
 
-static unsigned nextWordPositionBoundary(const UChar* characters, unsigned length)
+static unsigned nextWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
-    return findNextWordFromIndex(characters, length, 0, true);
+    if (mayHaveMoreContext && endOfFirstWordBoundaryContext(characters + offset, length - offset) == static_cast<int>(length - offset)) {
+        needMoreContext = true;
+        return length;
+    }
+    needMoreContext = false;
+    return findNextWordFromIndex(characters, length, offset, true);
 }
 
 VisiblePosition nextWordPosition(const VisiblePosition &c)
@@ -285,7 +386,7 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
         // There are VisiblePositions at offset 0 in blocks without
         // RootInlineBoxes, like empty editable blocks and bordered blocks.
         Position p = c.deepEquivalent();
-        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.offset() == 0)
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.deprecatedEditingOffset() == 0)
             return positionAvoidingFirstPositionInTable(c);
         
         return VisiblePosition();
@@ -300,11 +401,11 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
         if (!startBox)
             return VisiblePosition();
 
-        RenderObject *startRenderer = startBox->object();
+        RenderObject *startRenderer = startBox->renderer();
         if (!startRenderer)
             return VisiblePosition();
 
-        startNode = startRenderer->element();
+        startNode = startRenderer->node();
         if (startNode)
             break;
         
@@ -314,7 +415,7 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
     int startOffset = 0;
     if (startBox->isInlineTextBox()) {
         InlineTextBox *startTextBox = static_cast<InlineTextBox *>(startBox);
-        startOffset = startTextBox->m_start;
+        startOffset = startTextBox->start();
     }
   
     VisiblePosition visPos = VisiblePosition(startNode, startOffset, DOWNSTREAM);
@@ -332,7 +433,7 @@ VisiblePosition startOfLine(const VisiblePosition& c)
         // greater than the input position.  This fix is to account for the discrepancy between lines with webkit-line-break:after-white-space 
         // style versus lines without that style, which would break before a space by default. 
         Position p = visPos.deepEquivalent();
-        if (p.offset() > c.deepEquivalent().offset() && p.node()->isSameNode(c.deepEquivalent().node())) {
+        if (p.deprecatedEditingOffset() > c.deepEquivalent().deprecatedEditingOffset() && p.node()->isSameNode(c.deepEquivalent().node())) {
             visPos = c.previous();
             if (visPos.isNull())
                 return VisiblePosition();
@@ -353,7 +454,7 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c)
         // There are VisiblePositions at offset 0 in blocks without
         // RootInlineBoxes, like empty editable blocks and bordered blocks.
         Position p = c.deepEquivalent();
-        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.offset() == 0)
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.deprecatedEditingOffset() == 0)
             return c;
         return VisiblePosition();
     }
@@ -367,11 +468,11 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c)
         if (!endBox)
             return VisiblePosition();
 
-        RenderObject *endRenderer = endBox->object();
+        RenderObject *endRenderer = endBox->renderer();
         if (!endRenderer)
             return VisiblePosition();
 
-        endNode = endRenderer->element();
+        endNode = endRenderer->node();
         if (endNode)
             break;
         
@@ -383,9 +484,9 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c)
         endOffset = 0;
     } else if (endBox->isInlineTextBox()) {
         InlineTextBox *endTextBox = static_cast<InlineTextBox *>(endBox);
-        endOffset = endTextBox->m_start;
+        endOffset = endTextBox->start();
         if (!endTextBox->isLineBreak())
-            endOffset += endTextBox->m_len;
+            endOffset += endTextBox->len();
     }
     
     return VisiblePosition(endNode, endOffset, VP_UPSTREAM_IF_POSSIBLE);
@@ -438,6 +539,15 @@ static Node* previousLeafWithSameEditability(Node* node)
     return 0;
 }
 
+static Node* enclosingNodeWithNonInlineRenderer(Node* n)
+{
+    for (Node* p = n; p; p = p->parentNode()) {
+        if (p->renderer() && !p->renderer()->isInline())
+            return p;
+    }
+    return 0;
+}
+
 VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int x)
 {
     Position p = visiblePosition.deepEquivalent();
@@ -467,9 +577,9 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         // This containing editable block does not have a previous line.
         // Need to move back to previous containing editable block in this root editable
         // block and find the last root line box in that block.
-        Node* startBlock = enclosingBlock(node);
+        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
         Node* n = previousLeafWithSameEditability(node);
-        while (n && startBlock == enclosingBlock(n))
+        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = previousLeafWithSameEditability(n);
         while (n) {
             if (highestEditableRoot(Position(n, 0)) != highestRoot)
@@ -494,20 +604,20 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     
     if (root) {
         // FIXME: Can be wrong for multi-column layout and with transforms.
-        FloatPoint absPos = containingBlock->localToAbsoluteForContent(FloatPoint());
+        FloatPoint absPos = containingBlock->localToAbsolute(FloatPoint());
         if (containingBlock->hasOverflowClip())
             absPos -= containingBlock->layer()->scrolledContentOffset();
-        RenderObject *renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->object();
+        RenderObject* renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
-        if (editingIgnoresContent(node))
+        if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForCoordinates(x - absPos.x(), root->topOverflow());
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
     }
     
     // Could not find a previous line. This means we must already be on the first line.
     // Move to the start of the content in this block, which effectively moves us
     // to the start of the line we're on.
-    Node* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    Element* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
     return VisiblePosition(rootElement, 0, DOWNSTREAM);
 }
 
@@ -569,9 +679,9 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
         // This containing editable block does not have a next line.
         // Need to move forward to next containing editable block in this root editable
         // block and find the first root line box in that block.
-        Node* startBlock = enclosingBlock(node);
-        Node* n = nextLeafWithSameEditability(node, p.offset());
-        while (n && startBlock == enclosingBlock(n))
+        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
+        Node* n = nextLeafWithSameEditability(node, p.deprecatedEditingOffset());
+        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = nextLeafWithSameEditability(n);
         while (n) {
             if (highestEditableRoot(Position(n, 0)) != highestRoot)
@@ -595,14 +705,14 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
     
     if (root) {
         // FIXME: Can be wrong for multi-column layout and with transforms.
-        FloatPoint absPos = containingBlock->localToAbsoluteForContent(FloatPoint());
+        FloatPoint absPos = containingBlock->localToAbsolute(FloatPoint());
         if (containingBlock->hasOverflowClip())
             absPos -= containingBlock->layer()->scrolledContentOffset();
-        RenderObject *renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->object();
+        RenderObject* renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
-        if (editingIgnoresContent(node))
+        if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForCoordinates(x - absPos.x(), root->topOverflow());
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
     }    
 
     // Could not find a next line. This means we must already be on the last line.
@@ -614,7 +724,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
 
 // ---------
 
-static unsigned startSentenceBoundary(const UChar* characters, unsigned length)
+static unsigned startSentenceBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
     // FIXME: The following function can return -1; we don't handle that.
@@ -626,7 +736,7 @@ VisiblePosition startOfSentence(const VisiblePosition &c)
     return previousBoundary(c, startSentenceBoundary);
 }
 
-static unsigned endSentenceBoundary(const UChar* characters, unsigned length)
+static unsigned endSentenceBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
     return textBreakNext(iterator);
@@ -638,7 +748,7 @@ VisiblePosition endOfSentence(const VisiblePosition &c)
     return nextBoundary(c, endSentenceBoundary);
 }
 
-static unsigned previousSentencePositionBoundary(const UChar* characters, unsigned length)
+static unsigned previousSentencePositionBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     // FIXME: This is identical to startSentenceBoundary. I'm pretty sure that's not right.
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
@@ -652,7 +762,7 @@ VisiblePosition previousSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrAfter(prev);
 }
 
-static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned length)
+static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     // FIXME: This is identical to endSentenceBoundary.  This isn't right, it needs to 
     // move to the equivlant position in the following sentence.
@@ -666,8 +776,13 @@ VisiblePosition nextSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrBefore(next);
 }
 
+static bool renderedAsNonInlineTableOrHR(RenderObject* renderer)
+{
+    return renderer && ((renderer->isTable() && !renderer->isInline()) || renderer->isHR());
+}
+
 // FIXME: Broken for positions before/after images that aren't inline (5027702)
-VisiblePosition startOfParagraph(const VisiblePosition &c)
+VisiblePosition startOfParagraph(const VisiblePosition& c)
 {
     Position p = c.deepEquivalent();
     Node *startNode = p.node();
@@ -675,16 +790,13 @@ VisiblePosition startOfParagraph(const VisiblePosition &c)
     if (!startNode)
         return VisiblePosition();
     
-    if (startNode->renderer()
-        && ((startNode->renderer()->isTable() && !startNode->renderer()->isInline())
-            || startNode->renderer()->isHR())
-        && p.offset() == maxDeepOffset(startNode))
-        return VisiblePosition(Position(startNode, 0));
+    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atLastEditingPositionForNode())
+        return firstDeepEditingPositionForNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
 
     Node *node = startNode;
-    int offset = p.offset();
+    int offset = p.deprecatedEditingOffset();
 
     Node *n = startNode;
     while (n) {
@@ -706,8 +818,8 @@ VisiblePosition startOfParagraph(const VisiblePosition &c)
             
         if (r->isText()) {
             if (style->preserveNewline()) {
-                const UChar* chars = static_cast<RenderText*>(r)->characters();
-                int i = static_cast<RenderText*>(r)->textLength();
+                const UChar* chars = toRenderText(r)->characters();
+                int i = toRenderText(r)->textLength();
                 int o = offset;
                 if (n == startNode && o < i)
                     i = max(0, o);
@@ -738,17 +850,14 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
     Position p = c.deepEquivalent();
     Node* startNode = p.node();
 
-    if (startNode->renderer()
-        && ((startNode->renderer()->isTable() && !startNode->renderer()->isInline())
-            || startNode->renderer()->isHR())
-        && p.offset() == 0)
-        return VisiblePosition(Position(startNode, maxDeepOffset(startNode)));
+    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atFirstEditingPositionForNode())
+        return lastDeepEditingPositionForNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
     Node *stayInsideBlock = startBlock;
     
     Node *node = startNode;
-    int offset = p.offset();
+    int offset = p.deprecatedEditingOffset();
 
     Node *n = startNode;
     while (n) {
@@ -771,9 +880,9 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
         // FIXME: We avoid returning a position where the renderer can't accept the caret.
         // We should probably do this in other cases such as startOfParagraph.
         if (r->isText() && r->caretMaxRenderedOffset() > 0) {
-            int length = static_cast<RenderText*>(r)->textLength();
+            int length = toRenderText(r)->textLength();
             if (style->preserveNewline()) {
-                const UChar* chars = static_cast<RenderText*>(r)->characters();
+                const UChar* chars = toRenderText(r)->characters();
                 int o = n == startNode ? offset : 0;
                 for (int i = o; i < length; ++i)
                     if (chars[i] == '\n')
@@ -784,7 +893,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
             n = n->traverseNextNode(stayInsideBlock);
         } else if (editingIgnoresContent(n) || isTableElement(n)) {
             node = n;
-            offset = maxDeepOffset(n);
+            offset = lastOffsetForEditing(n);
             n = n->traverseNextSibling(stayInsideBlock);
         } else
             n = n->traverseNextNode(stayInsideBlock);
@@ -819,25 +928,25 @@ bool isEndOfParagraph(const VisiblePosition &pos)
     return pos.isNotNull() && pos == endOfParagraph(pos);
 }
 
-VisiblePosition previousParagraphPosition(const VisiblePosition &p, int x)
+VisiblePosition previousParagraphPosition(const VisiblePosition& p, int x)
 {
     VisiblePosition pos = p;
     do {
         VisiblePosition n = previousLinePosition(pos, x);
         if (n.isNull() || n == pos)
-            return p;
+            break;
         pos = n;
     } while (inSameParagraph(p, pos));
     return pos;
 }
 
-VisiblePosition nextParagraphPosition(const VisiblePosition &p, int x)
+VisiblePosition nextParagraphPosition(const VisiblePosition& p, int x)
 {
     VisiblePosition pos = p;
     do {
         VisiblePosition n = nextLinePosition(pos, x);
         if (n.isNull() || n == pos)
-            return p;
+            break;
         pos = n;
     } while (inSameParagraph(p, pos));
     return pos;
@@ -943,7 +1052,7 @@ VisiblePosition startOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return VisiblePosition(highestRoot, 0, DOWNSTREAM);
+    return firstDeepEditingPositionForNode(highestRoot);
 }
 
 VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
@@ -952,7 +1061,181 @@ VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return VisiblePosition(highestRoot, maxDeepOffset(highestRoot), DOWNSTREAM);
+    return lastDeepEditingPositionForNode(highestRoot);
+}
+
+static void getLeafBoxesInLogicalOrder(RootInlineBox* rootBox, Vector<InlineBox*>& leafBoxesInLogicalOrder)
+{
+    unsigned char minLevel = 128;
+    unsigned char maxLevel = 0;
+    unsigned count = 0;
+    InlineBox* r = rootBox->firstLeafChild();
+    // First find highest and lowest levels,
+    // and initialize leafBoxesInLogicalOrder with the leaf boxes in visual order.
+    while (r) {
+        if (r->bidiLevel() > maxLevel)
+            maxLevel = r->bidiLevel();
+        if (r->bidiLevel() < minLevel)
+            minLevel = r->bidiLevel();
+        leafBoxesInLogicalOrder.append(r);
+        r = r->nextLeafChild();
+        ++count;
+    }
+
+    if (rootBox->renderer()->style()->visuallyOrdered())
+        return;
+    // Reverse of reordering of the line (L2 according to Bidi spec):
+    // L2. From the highest level found in the text to the lowest odd level on each line,
+    // reverse any contiguous sequence of characters that are at that level or higher.
+
+    // Reversing the reordering of the line is only done up to the lowest odd level.
+    if (!(minLevel % 2))
+        minLevel++;
+    
+    InlineBox** end = leafBoxesInLogicalOrder.end();
+    while (minLevel <= maxLevel) {
+        InlineBox** iter = leafBoxesInLogicalOrder.begin();
+        while (iter != end) {
+            while (iter != end) {
+                if ((*iter)->bidiLevel() >= minLevel)
+                    break;
+                ++iter;
+            }
+            InlineBox** first = iter;
+            while (iter != end) {
+                if ((*iter)->bidiLevel() < minLevel)
+                    break;
+                ++iter;
+            }
+            InlineBox** last = iter;
+            std::reverse(first, last);
+        }                
+        ++minLevel;
+    }
+}
+
+static void getLogicalStartBoxAndNode(RootInlineBox* rootBox, InlineBox*& startBox, Node*& startNode)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
+    startBox = 0;
+    startNode = 0;
+    for (size_t i = 0; i < leafBoxesInLogicalOrder.size(); ++i) {
+        startBox = leafBoxesInLogicalOrder[i];
+        startNode = startBox->renderer()->node();
+        if (startNode)
+            return; 
+    }
+}
+
+static void getLogicalEndBoxAndNode(RootInlineBox* rootBox, InlineBox*& endBox, Node*& endNode)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
+    endBox = 0;
+    endNode = 0;
+    // Generated content (e.g. list markers and CSS :before and :after
+    // pseudoelements) have no corresponding DOM element, and so cannot be
+    // represented by a VisiblePosition.  Use whatever precedes instead.
+    for (size_t i = leafBoxesInLogicalOrder.size(); i > 0; --i) { 
+        endBox = leafBoxesInLogicalOrder[i - 1];
+        endNode = endBox->renderer()->node();
+        if (endNode)
+            return;
+    }
+}
+
+static VisiblePosition logicalStartPositionForLine(const VisiblePosition& c)
+{
+    if (c.isNull())
+        return VisiblePosition();
+
+    RootInlineBox* rootBox = rootBoxForLine(c);
+    if (!rootBox) {
+        // There are VisiblePositions at offset 0 in blocks without
+        // RootInlineBoxes, like empty editable blocks and bordered blocks.
+        Position p = c.deepEquivalent();
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && !p.deprecatedEditingOffset())
+            return positionAvoidingFirstPositionInTable(c);
+        
+        return VisiblePosition();
+    }
+    
+    InlineBox* logicalStartBox;
+    Node* logicalStartNode;
+    getLogicalStartBoxAndNode(rootBox, logicalStartBox, logicalStartNode);
+
+    if (!logicalStartNode)
+        return VisiblePosition();
+
+    int startOffset = logicalStartBox->caretMinOffset();
+  
+    VisiblePosition visPos = VisiblePosition(logicalStartNode, startOffset, DOWNSTREAM);
+    return positionAvoidingFirstPositionInTable(visPos);
+}
+
+VisiblePosition logicalStartOfLine(const VisiblePosition& c)
+{
+    VisiblePosition visPos = logicalStartPositionForLine(c);
+    
+    if (visPos.isNull())
+        return c.honorEditableBoundaryAtOrAfter(visPos);
+
+    return c.honorEditableBoundaryAtOrAfter(visPos);
+}
+
+static VisiblePosition logicalEndPositionForLine(const VisiblePosition& c)
+{
+    if (c.isNull())
+        return VisiblePosition();
+
+    RootInlineBox* rootBox = rootBoxForLine(c);
+    if (!rootBox) {
+        // There are VisiblePositions at offset 0 in blocks without
+        // RootInlineBoxes, like empty editable blocks and bordered blocks.
+        Position p = c.deepEquivalent();
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && !p.deprecatedEditingOffset())
+            return c;
+        return VisiblePosition();
+    }
+    
+    InlineBox* logicalEndBox;
+    Node* logicalEndNode;
+    getLogicalEndBoxAndNode(rootBox, logicalEndBox, logicalEndNode);
+    if (!logicalEndNode)
+        return VisiblePosition();
+    
+    int endOffset = 1;
+    if (logicalEndNode->hasTagName(brTag))
+        endOffset = 0;
+    else if (logicalEndBox->isInlineTextBox()) {
+        InlineTextBox* endTextBox = static_cast<InlineTextBox*>(logicalEndBox);
+        endOffset = endTextBox->start();
+        if (!endTextBox->isLineBreak())
+            endOffset += endTextBox->len();
+    }
+    
+    return VisiblePosition(logicalEndNode, endOffset, VP_UPSTREAM_IF_POSSIBLE);
+}
+
+bool inSameLogicalLine(const VisiblePosition& a, const VisiblePosition& b)
+{
+    return a.isNotNull() && logicalStartOfLine(a) == logicalStartOfLine(b);
+}
+
+VisiblePosition logicalEndOfLine(const VisiblePosition& c)
+{
+    VisiblePosition visPos = logicalEndPositionForLine(c);
+    
+    // Make sure the end of line is at the same line as the given input position. For a wrapping line, the logical end
+    // position for the not-last-2-lines might incorrectly hand back the logical beginning of the next line. 
+    // For example, <div contenteditable dir="rtl" style="line-break:before-white-space">abcdefg abcdefg abcdefg
+    // a abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg </div>
+    // In this case, use the previous position of the computed logical end position.
+    if (!inSameLogicalLine(c, visPos))
+        visPos = visPos.previous();
+    
+    return c.honorEditableBoundaryAtOrBefore(visPos);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/visible_units.h b/src/3rdparty/webkit/WebCore/editing/visible_units.h
index 26638882cc..a20b588897 100644
--- a/src/3rdparty/webkit/WebCore/editing/visible_units.h
+++ b/src/3rdparty/webkit/WebCore/editing/visible_units.h
@@ -53,8 +53,11 @@ VisiblePosition endOfLine(const VisiblePosition &);
 VisiblePosition previousLinePosition(const VisiblePosition &, int x);
 VisiblePosition nextLinePosition(const VisiblePosition &, int x);
 bool inSameLine(const VisiblePosition &, const VisiblePosition &);
+bool inSameLogicalLine(const VisiblePosition &, const VisiblePosition &);
 bool isStartOfLine(const VisiblePosition &);
 bool isEndOfLine(const VisiblePosition &);
+VisiblePosition logicalStartOfLine(const VisiblePosition &);
+VisiblePosition logicalEndOfLine(const VisiblePosition &);
 
 // paragraphs (perhaps a misnomer, can be divided by line break elements)
 VisiblePosition startOfParagraph(const VisiblePosition&);
diff --git a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
index 9beec6b373..da67f2e731 100644
--- a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue arrayTableValues[20] = {
+static const struct HashTableValue arrayTableValues[22] = {
    { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
    { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
    { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
@@ -23,15 +23,12 @@ static const struct HashTableValue arrayTableValues[20] = {
    { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
    { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
    { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
+   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
+   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
    { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
 extern const struct HashTable arrayTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 127, arrayTableValues, 0 };
-#else
     { 65, 63, arrayTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
index b980a0ac11..1c2da0693e 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton implementation for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton implementation for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,7 +28,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -47,7 +46,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.3"
+#define YYBISON_VERSION "2.4.1"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -55,157 +54,28 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
+/* Push parsers.  */
+#define YYPUSH 0
+
+/* Pull parsers.  */
+#define YYPULL 1
+
 /* Using locations.  */
 #define YYLSP_NEEDED 0
 
 /* Substitute the variable and function names.  */
-#define yyparse cssyyparse
-#define yylex   cssyylex
-#define yyerror cssyyerror
-#define yylval  cssyylval
-#define yychar  cssyychar
-#define yydebug cssyydebug
-#define yynerrs cssyynerrs
-
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     TOKEN_EOF = 0,
-     UNIMPORTANT_TOK = 258,
-     WHITESPACE = 259,
-     SGML_CD = 260,
-     INCLUDES = 261,
-     DASHMATCH = 262,
-     BEGINSWITH = 263,
-     ENDSWITH = 264,
-     CONTAINS = 265,
-     STRING = 266,
-     IDENT = 267,
-     NTH = 268,
-     HEX = 269,
-     IDSEL = 270,
-     IMPORT_SYM = 271,
-     PAGE_SYM = 272,
-     MEDIA_SYM = 273,
-     FONT_FACE_SYM = 274,
-     CHARSET_SYM = 275,
-     NAMESPACE_SYM = 276,
-     WEBKIT_RULE_SYM = 277,
-     WEBKIT_DECLS_SYM = 278,
-     WEBKIT_KEYFRAME_RULE_SYM = 279,
-     WEBKIT_KEYFRAMES_SYM = 280,
-     WEBKIT_VALUE_SYM = 281,
-     WEBKIT_MEDIAQUERY_SYM = 282,
-     WEBKIT_SELECTOR_SYM = 283,
-     WEBKIT_VARIABLES_SYM = 284,
-     WEBKIT_DEFINE_SYM = 285,
-     VARIABLES_FOR = 286,
-     WEBKIT_VARIABLES_DECLS_SYM = 287,
-     ATKEYWORD = 288,
-     IMPORTANT_SYM = 289,
-     MEDIA_ONLY = 290,
-     MEDIA_NOT = 291,
-     MEDIA_AND = 292,
-     QEMS = 293,
-     EMS = 294,
-     EXS = 295,
-     PXS = 296,
-     CMS = 297,
-     MMS = 298,
-     INS = 299,
-     PTS = 300,
-     PCS = 301,
-     DEGS = 302,
-     RADS = 303,
-     GRADS = 304,
-     TURNS = 305,
-     MSECS = 306,
-     SECS = 307,
-     HERZ = 308,
-     KHERZ = 309,
-     DIMEN = 310,
-     PERCENTAGE = 311,
-     FLOATTOKEN = 312,
-     INTEGER = 313,
-     URI = 314,
-     FUNCTION = 315,
-     NOTFUNCTION = 316,
-     UNICODERANGE = 317,
-     VARCALL = 318
-   };
-#endif
-/* Tokens.  */
-#define TOKEN_EOF 0
-#define UNIMPORTANT_TOK 258
-#define WHITESPACE 259
-#define SGML_CD 260
-#define INCLUDES 261
-#define DASHMATCH 262
-#define BEGINSWITH 263
-#define ENDSWITH 264
-#define CONTAINS 265
-#define STRING 266
-#define IDENT 267
-#define NTH 268
-#define HEX 269
-#define IDSEL 270
-#define IMPORT_SYM 271
-#define PAGE_SYM 272
-#define MEDIA_SYM 273
-#define FONT_FACE_SYM 274
-#define CHARSET_SYM 275
-#define NAMESPACE_SYM 276
-#define WEBKIT_RULE_SYM 277
-#define WEBKIT_DECLS_SYM 278
-#define WEBKIT_KEYFRAME_RULE_SYM 279
-#define WEBKIT_KEYFRAMES_SYM 280
-#define WEBKIT_VALUE_SYM 281
-#define WEBKIT_MEDIAQUERY_SYM 282
-#define WEBKIT_SELECTOR_SYM 283
-#define WEBKIT_VARIABLES_SYM 284
-#define WEBKIT_DEFINE_SYM 285
-#define VARIABLES_FOR 286
-#define WEBKIT_VARIABLES_DECLS_SYM 287
-#define ATKEYWORD 288
-#define IMPORTANT_SYM 289
-#define MEDIA_ONLY 290
-#define MEDIA_NOT 291
-#define MEDIA_AND 292
-#define QEMS 293
-#define EMS 294
-#define EXS 295
-#define PXS 296
-#define CMS 297
-#define MMS 298
-#define INS 299
-#define PTS 300
-#define PCS 301
-#define DEGS 302
-#define RADS 303
-#define GRADS 304
-#define TURNS 305
-#define MSECS 306
-#define SECS 307
-#define HERZ 308
-#define KHERZ 309
-#define DIMEN 310
-#define PERCENTAGE 311
-#define FLOATTOKEN 312
-#define INTEGER 313
-#define URI 314
-#define FUNCTION 315
-#define NOTFUNCTION 316
-#define UNICODERANGE 317
-#define VARCALL 318
-
-
+#define yyparse         cssyyparse
+#define yylex           cssyylex
+#define yyerror         cssyyerror
+#define yylval          cssyylval
+#define yychar          cssyychar
+#define yydebug         cssyydebug
+#define yynerrs         cssyynerrs
 
 
 /* Copy the first part of user declarations.  */
+
+/* Line 189 of yacc.c  */
 #line 1 "../css/CSSGrammar.y"
 
 
@@ -235,6 +105,7 @@
 
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
+#include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSRuleList.h"
 #include "CSSSelector.h"
@@ -261,6 +132,9 @@ using namespace HTMLNames;
 
 
 
+/* Line 189 of yacc.c  */
+#line 137 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -279,10 +153,88 @@ using namespace HTMLNames;
 # define YYTOKEN_TABLE 0
 #endif
 
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     TOKEN_EOF = 0,
+     LOWEST_PREC = 258,
+     UNIMPORTANT_TOK = 259,
+     WHITESPACE = 260,
+     SGML_CD = 261,
+     INCLUDES = 262,
+     DASHMATCH = 263,
+     BEGINSWITH = 264,
+     ENDSWITH = 265,
+     CONTAINS = 266,
+     STRING = 267,
+     IDENT = 268,
+     NTH = 269,
+     HEX = 270,
+     IDSEL = 271,
+     IMPORT_SYM = 272,
+     PAGE_SYM = 273,
+     MEDIA_SYM = 274,
+     FONT_FACE_SYM = 275,
+     CHARSET_SYM = 276,
+     NAMESPACE_SYM = 277,
+     WEBKIT_RULE_SYM = 278,
+     WEBKIT_DECLS_SYM = 279,
+     WEBKIT_KEYFRAME_RULE_SYM = 280,
+     WEBKIT_KEYFRAMES_SYM = 281,
+     WEBKIT_VALUE_SYM = 282,
+     WEBKIT_MEDIAQUERY_SYM = 283,
+     WEBKIT_SELECTOR_SYM = 284,
+     WEBKIT_VARIABLES_SYM = 285,
+     WEBKIT_DEFINE_SYM = 286,
+     VARIABLES_FOR = 287,
+     WEBKIT_VARIABLES_DECLS_SYM = 288,
+     ATKEYWORD = 289,
+     IMPORTANT_SYM = 290,
+     MEDIA_ONLY = 291,
+     MEDIA_NOT = 292,
+     MEDIA_AND = 293,
+     QEMS = 294,
+     EMS = 295,
+     EXS = 296,
+     PXS = 297,
+     CMS = 298,
+     MMS = 299,
+     INS = 300,
+     PTS = 301,
+     PCS = 302,
+     DEGS = 303,
+     RADS = 304,
+     GRADS = 305,
+     TURNS = 306,
+     MSECS = 307,
+     SECS = 308,
+     HERZ = 309,
+     KHERZ = 310,
+     DIMEN = 311,
+     PERCENTAGE = 312,
+     FLOATTOKEN = 313,
+     INTEGER = 314,
+     URI = 315,
+     FUNCTION = 316,
+     NOTFUNCTION = 317,
+     UNICODERANGE = 318,
+     VARCALL = 319
+   };
+#endif
+
+
+
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 57 "../css/CSSGrammar.y"
 {
+
+/* Line 214 of yacc.c  */
+#line 58 "../css/CSSGrammar.y"
+
     bool boolean;
     char character;
     int integer;
@@ -304,19 +256,22 @@ typedef union YYSTYPE
     WebKitCSSKeyframeRule* keyframeRule;
     WebKitCSSKeyframesRule* keyframesRule;
     float val;
-}
-/* Line 187 of yacc.c.  */
-#line 310 "WebCore/tmp/../generated/CSSGrammar.tab.c"
-	YYSTYPE;
+
+
+
+/* Line 214 of yacc.c  */
+#line 264 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
-
 /* Copy the second part of user declarations.  */
-#line 81 "../css/CSSGrammar.y"
+
+/* Line 264 of yacc.c  */
+#line 82 "../css/CSSGrammar.y"
 
 
 static inline int cssyyerror(const char*)
@@ -331,8 +286,8 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 
 
-/* Line 216 of yacc.c.  */
-#line 336 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+/* Line 264 of yacc.c  */
+#line 291 "WebCore/tmp/../generated/CSSGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -407,14 +362,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int i)
+YYID (int yyi)
 #else
 static int
-YYID (i)
-    int i;
+YYID (yyi)
+    int yyi;
 #endif
 {
-  return i;
+  return yyi;
 }
 #endif
 
@@ -495,9 +450,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss;
-  YYSTYPE yyvs;
-  };
+  yytype_int16 yyss_alloc;
+  YYSTYPE yyvs_alloc;
+};
 
 /* The size of the maximum gap between one aligned stack and the next.  */
 # define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1)
@@ -531,12 +486,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack)					\
+# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack, Stack, yysize);				\
-	Stack = &yyptr->Stack;						\
+	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
+	Stack = &yyptr->Stack_alloc;					\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -547,10 +502,10 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  28
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   1274
+#define YYLAST   1315
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  84
+#define YYNTOKENS  85
 /* YYNNTS -- Number of nonterminals.  */
 #define YYNNTS  90
 /* YYNRULES -- Number of rules.  */
@@ -560,7 +515,7 @@ union yyalloc
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   318
+#define YYMAXUTOK   319
 
 #define YYTRANSLATE(YYX)						\
   ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -571,16 +526,16 @@ static const yytype_uint8 yytranslate[] =
        0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,    82,     2,    83,     2,     2,
-      72,    73,    19,    75,    74,    78,    17,    81,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,    16,    71,
-       2,    80,    77,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,    83,     2,    84,     2,     2,
+      73,    74,    20,    76,    75,    79,    18,    82,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,    17,    72,
+       2,    81,    78,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,    18,     2,    79,     2,     2,     2,     2,     2,     2,
+       2,    19,     2,    80,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,    69,    20,    70,    76,     2,     2,     2,
+       2,     2,     2,    70,    21,    71,    77,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
@@ -595,11 +550,11 @@ static const yytype_uint8 yytranslate[] =
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
        5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
-      15,    21,    22,    23,    24,    25,    26,    27,    28,    29,
+      15,    16,    22,    23,    24,    25,    26,    27,    28,    29,
       30,    31,    32,    33,    34,    35,    36,    37,    38,    39,
       40,    41,    42,    43,    44,    45,    46,    47,    48,    49,
       50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    68
+      60,    61,    62,    63,    64,    65,    66,    67,    68,    69
 };
 
 #if YYDEBUG
@@ -639,130 +594,130 @@ static const yytype_uint16 yyprhs[] =
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-      85,     0,    -1,    96,    95,    99,   100,   101,   102,    -1,
-      87,    94,    -1,    89,    94,    -1,    91,    94,    -1,    92,
-      94,    -1,    93,    94,    -1,    90,    94,    -1,    88,    94,
-      -1,   103,    -1,   108,    -1,    27,    69,    94,    86,    94,
-      70,    -1,    29,    69,    94,   132,    94,    70,    -1,    28,
-      69,    94,   154,    70,    -1,    37,    69,    94,   111,    70,
-      -1,    31,    69,    94,   159,    70,    -1,    32,     4,    94,
-     124,    70,    -1,    33,    69,    94,   140,    70,    -1,    -1,
-      94,     4,    -1,    -1,    95,     5,    -1,    95,     4,    -1,
-      -1,    98,    -1,    70,    -1,     0,    -1,    25,    94,    11,
-      94,    71,    -1,    25,     1,   172,    -1,    25,     1,    71,
-      -1,    -1,    99,   108,    95,    -1,   168,    -1,    -1,   100,
-     109,    95,    -1,    -1,   101,   115,    95,    -1,    -1,   102,
-     104,    95,    -1,   139,    -1,   127,    -1,   135,    -1,   136,
-      -1,   129,    -1,   103,    -1,   171,    -1,   167,    -1,   169,
-      -1,    -1,   105,   107,    95,    -1,   139,    -1,   135,    -1,
-     136,    -1,   129,    -1,   106,    -1,   171,    -1,   167,    -1,
-     169,    -1,   170,    -1,    21,    94,   117,    94,   125,    71,
-      -1,    21,    94,   117,    94,   125,   172,    -1,    21,     1,
-      71,    -1,    21,     1,   172,    -1,    34,    94,   125,    69,
-      94,   111,    70,    -1,    35,    94,   110,    69,    94,   111,
-      70,    -1,    -1,    36,     4,   126,    -1,   113,    -1,   112,
-     113,    -1,   112,    -1,     1,   173,     1,    -1,     1,    -1,
-     112,     1,    -1,   113,    71,    94,    -1,   113,   173,    71,
-      94,    -1,     1,    71,    94,    -1,     1,   173,     1,    71,
-      94,    -1,   112,   113,    71,    94,    -1,   112,     1,    71,
-      94,    -1,   112,     1,   173,     1,    71,    94,    -1,   114,
-      16,    94,   159,    -1,   114,    94,    69,    94,   154,    70,
-      94,    -1,   114,     1,    -1,   114,    16,    94,     1,   159,
-      -1,   114,    16,    94,    -1,   114,    16,    94,     1,    -1,
-      12,    94,    -1,    26,    94,   116,   117,    94,    71,    -1,
-      26,     1,   172,    -1,    26,     1,    71,    -1,    -1,    12,
-       4,    -1,    11,    -1,    64,    -1,    12,    94,    -1,    -1,
-      16,    94,   159,    94,    -1,    72,    94,   118,    94,   119,
-      73,    94,    -1,   120,    -1,   121,    94,    42,    94,   120,
-      -1,    -1,    42,    94,   121,    -1,    -1,    40,    -1,    41,
-      -1,   121,    -1,   123,    94,   128,   122,    -1,    -1,   126,
-      -1,   124,    -1,   126,    74,    94,   124,    -1,   126,     1,
-      -1,    23,    94,   126,    69,    94,   105,   166,    -1,    23,
-      94,    69,    94,   105,   166,    -1,    12,    94,    -1,    30,
-      94,   130,    94,    69,    94,   131,    70,    -1,    12,    -1,
-      11,    -1,    -1,   131,   132,    94,    -1,   133,    94,    69,
-      94,   154,    70,    -1,   134,    -1,   133,    94,    74,    94,
-     134,    -1,    61,    -1,    12,    -1,    22,     1,   172,    -1,
-      22,     1,    71,    -1,    24,    94,    69,    94,   154,    70,
-      94,    -1,    24,     1,   172,    -1,    24,     1,    71,    -1,
-      75,    94,    -1,    76,    94,    -1,    77,    94,    -1,    78,
-      -1,    75,    -1,   140,    69,    94,   154,    97,    -1,   142,
-      -1,   140,    74,    94,   142,    -1,   140,     1,    -1,   142,
-       4,    -1,   144,    -1,   141,    -1,   141,   144,    -1,   142,
-     137,   144,    -1,   142,     1,    -1,    20,    -1,    19,    20,
-      -1,    12,    20,    -1,   145,    -1,   145,   146,    -1,   146,
-      -1,   143,   145,    -1,   143,   145,   146,    -1,   143,   146,
-      -1,    12,    -1,    19,    -1,   147,    -1,   146,   147,    -1,
-     146,     1,    -1,    15,    -1,    14,    -1,   148,    -1,   150,
-      -1,   153,    -1,    17,    12,    -1,    12,    94,    -1,    18,
-      94,   149,    79,    -1,    18,    94,   149,   151,    94,   152,
-      94,    79,    -1,    18,    94,   143,   149,    79,    -1,    18,
-      94,   143,   149,   151,    94,   152,    94,    79,    -1,    80,
-      -1,     6,    -1,     7,    -1,     8,    -1,     9,    -1,    10,
-      -1,    12,    -1,    11,    -1,    16,    12,    -1,    16,    16,
-      12,    -1,    16,    65,    13,    73,    -1,    16,    65,    63,
-      73,    -1,    16,    65,    12,    73,    -1,    16,    66,    94,
-     144,    94,    73,    -1,   156,    -1,   155,   156,    -1,   155,
-      -1,     1,   173,     1,    -1,     1,    -1,   155,     1,    -1,
-     155,   173,    -1,   156,    71,    94,    -1,   156,   173,    71,
-      94,    -1,     1,    71,    94,    -1,     1,   173,     1,    71,
-      94,    -1,   155,   156,    71,    94,    -1,   155,     1,    71,
-      94,    -1,   155,     1,   173,     1,    71,    94,    -1,   157,
-      16,    94,   159,   158,    -1,   163,    94,    -1,   157,     1,
-      -1,   157,    16,    94,     1,   159,   158,    -1,   157,    16,
-      94,   159,   158,     1,    -1,    39,    94,    -1,   157,    16,
-      94,    -1,   157,    16,    94,     1,    -1,   157,   172,    -1,
-      12,    94,    -1,    39,    94,    -1,    -1,   161,    -1,   159,
-     160,   161,    -1,   159,     1,    -1,    81,    94,    -1,    74,
-      94,    -1,    -1,   162,    -1,   138,   162,    -1,    11,    94,
-      -1,    12,    94,    -1,    60,    94,    -1,   138,    60,    94,
-      -1,    64,    94,    -1,    67,    94,    -1,   165,    -1,    82,
-      94,    -1,   164,    -1,   163,    94,    -1,    83,    94,    -1,
-      63,    94,    -1,    62,    94,    -1,    61,    94,    -1,    46,
-      94,    -1,    47,    94,    -1,    48,    94,    -1,    49,    94,
-      -1,    50,    94,    -1,    51,    94,    -1,    52,    94,    -1,
-      53,    94,    -1,    54,    94,    -1,    55,    94,    -1,    56,
-      94,    -1,    57,    94,    -1,    58,    94,    -1,    59,    94,
-      -1,    44,    94,    -1,    43,    94,    -1,    45,    94,    -1,
-      68,    -1,    65,    94,   159,    73,    94,    -1,    65,    94,
-       1,    -1,    14,    94,    -1,    15,    94,    -1,    97,    -1,
-       1,    97,    -1,    38,     1,   172,    -1,    38,     1,    71,
-      -1,   167,    95,    -1,   168,   167,    95,    -1,   108,    -1,
-     127,    -1,     1,   172,    -1,    69,     1,   173,     1,    97,
-      -1,    69,     1,    97,    -1,   172,    -1,   173,     1,   172,
+      86,     0,    -1,    97,    96,   100,   101,   102,   103,    -1,
+      88,    95,    -1,    90,    95,    -1,    92,    95,    -1,    93,
+      95,    -1,    94,    95,    -1,    91,    95,    -1,    89,    95,
+      -1,   104,    -1,   109,    -1,    28,    70,    95,    87,    95,
+      71,    -1,    30,    70,    95,   133,    95,    71,    -1,    29,
+      70,    95,   155,    71,    -1,    38,    70,    95,   112,    71,
+      -1,    32,    70,    95,   160,    71,    -1,    33,     5,    95,
+     125,    71,    -1,    34,    70,    95,   141,    71,    -1,    -1,
+      95,     5,    -1,    -1,    96,     6,    -1,    96,     5,    -1,
+      -1,    99,    -1,    71,    -1,     0,    -1,    26,    95,    12,
+      95,    72,    -1,    26,     1,   173,    -1,    26,     1,    72,
+      -1,    -1,   100,   109,    96,    -1,   169,    -1,    -1,   101,
+     110,    96,    -1,    -1,   102,   116,    96,    -1,    -1,   103,
+     105,    96,    -1,   140,    -1,   128,    -1,   136,    -1,   137,
+      -1,   130,    -1,   104,    -1,   172,    -1,   168,    -1,   170,
+      -1,    -1,   106,   108,    96,    -1,   140,    -1,   136,    -1,
+     137,    -1,   130,    -1,   107,    -1,   172,    -1,   168,    -1,
+     170,    -1,   171,    -1,    22,    95,   118,    95,   126,    72,
+      -1,    22,    95,   118,    95,   126,   173,    -1,    22,     1,
+      72,    -1,    22,     1,   173,    -1,    35,    95,   126,    70,
+      95,   112,    71,    -1,    36,    95,   111,    70,    95,   112,
+      71,    -1,    -1,    37,     5,   127,    -1,   114,    -1,   113,
+     114,    -1,   113,    -1,     1,   174,     1,    -1,     1,    -1,
+     113,     1,    -1,   114,    72,    95,    -1,   114,   174,    72,
+      95,    -1,     1,    72,    95,    -1,     1,   174,     1,    72,
+      95,    -1,   113,   114,    72,    95,    -1,   113,     1,    72,
+      95,    -1,   113,     1,   174,     1,    72,    95,    -1,   115,
+      17,    95,   160,    -1,   115,    95,    70,    95,   155,    71,
+      95,    -1,   115,     1,    -1,   115,    17,    95,     1,   160,
+      -1,   115,    17,    95,    -1,   115,    17,    95,     1,    -1,
+      13,    95,    -1,    27,    95,   117,   118,    95,    72,    -1,
+      27,     1,   173,    -1,    27,     1,    72,    -1,    -1,    13,
+       5,    -1,    12,    -1,    65,    -1,    13,    95,    -1,    -1,
+      17,    95,   160,    95,    -1,    73,    95,   119,    95,   120,
+      74,    95,    -1,   121,    -1,   122,    95,    43,    95,   121,
+      -1,    -1,    43,    95,   122,    -1,    -1,    41,    -1,    42,
+      -1,   122,    -1,   124,    95,   129,   123,    -1,    -1,   127,
+      -1,   125,    -1,   127,    75,    95,   125,    -1,   127,     1,
+      -1,    24,    95,   127,    70,    95,   106,   167,    -1,    24,
+      95,    70,    95,   106,   167,    -1,    13,    95,    -1,    31,
+      95,   131,    95,    70,    95,   132,    71,    -1,    13,    -1,
+      12,    -1,    -1,   132,   133,    95,    -1,   134,    95,    70,
+      95,   155,    71,    -1,   135,    -1,   134,    95,    75,    95,
+     135,    -1,    62,    -1,    13,    -1,    23,     1,   173,    -1,
+      23,     1,    72,    -1,    25,    95,    70,    95,   155,    71,
+      95,    -1,    25,     1,   173,    -1,    25,     1,    72,    -1,
+      76,    95,    -1,    77,    95,    -1,    78,    95,    -1,    79,
+      -1,    76,    -1,   141,    70,    95,   155,    98,    -1,   143,
+      -1,   141,    75,    95,   143,    -1,   141,     1,    -1,   143,
+       5,    -1,   145,    -1,   142,    -1,   142,   145,    -1,   143,
+     138,   145,    -1,   143,     1,    -1,    21,    -1,    20,    21,
+      -1,    13,    21,    -1,   146,    -1,   146,   147,    -1,   147,
+      -1,   144,   146,    -1,   144,   146,   147,    -1,   144,   147,
+      -1,    13,    -1,    20,    -1,   148,    -1,   147,   148,    -1,
+     147,     1,    -1,    16,    -1,    15,    -1,   149,    -1,   151,
+      -1,   154,    -1,    18,    13,    -1,    13,    95,    -1,    19,
+      95,   150,    80,    -1,    19,    95,   150,   152,    95,   153,
+      95,    80,    -1,    19,    95,   144,   150,    80,    -1,    19,
+      95,   144,   150,   152,    95,   153,    95,    80,    -1,    81,
+      -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,    11,
+      -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,    17,
+      13,    -1,    17,    66,    14,    74,    -1,    17,    66,    64,
+      74,    -1,    17,    66,    13,    74,    -1,    17,    67,    95,
+     145,    95,    74,    -1,   157,    -1,   156,   157,    -1,   156,
+      -1,     1,   174,     1,    -1,     1,    -1,   156,     1,    -1,
+     156,   174,    -1,   157,    72,    95,    -1,   157,   174,    72,
+      95,    -1,     1,    72,    95,    -1,     1,   174,     1,    72,
+      95,    -1,   156,   157,    72,    95,    -1,   156,     1,    72,
+      95,    -1,   156,     1,   174,     1,    72,    95,    -1,   158,
+      17,    95,   160,   159,    -1,   164,    95,    -1,   158,     1,
+      -1,   158,    17,    95,     1,   160,   159,    -1,   158,    17,
+      95,   160,   159,     1,    -1,    40,    95,    -1,   158,    17,
+      95,    -1,   158,    17,    95,     1,    -1,   158,   173,    -1,
+      13,    95,    -1,    40,    95,    -1,    -1,   162,    -1,   160,
+     161,   162,    -1,   160,     1,    -1,    82,    95,    -1,    75,
+      95,    -1,    -1,   163,    -1,   139,   163,    -1,    12,    95,
+      -1,    13,    95,    -1,    61,    95,    -1,   139,    61,    95,
+      -1,    65,    95,    -1,    68,    95,    -1,   166,    -1,    83,
+      95,    -1,   165,    -1,   164,    95,    -1,    84,    95,    -1,
+      64,    95,    -1,    63,    95,    -1,    62,    95,    -1,    47,
+      95,    -1,    48,    95,    -1,    49,    95,    -1,    50,    95,
+      -1,    51,    95,    -1,    52,    95,    -1,    53,    95,    -1,
+      54,    95,    -1,    55,    95,    -1,    56,    95,    -1,    57,
+      95,    -1,    58,    95,    -1,    59,    95,    -1,    60,    95,
+      -1,    45,    95,    -1,    44,    95,    -1,    46,    95,    -1,
+      69,    -1,    66,    95,   160,    74,    95,    -1,    66,    95,
+       1,    -1,    15,    95,    -1,    16,    95,    -1,    98,    -1,
+       1,    98,    -1,    39,     1,   173,    -1,    39,     1,    72,
+      -1,   168,    96,    -1,   169,   168,    96,    -1,   109,    -1,
+     128,    -1,     1,   173,    -1,    70,     1,   174,     1,    98,
+      -1,    70,     1,    98,    -1,   173,    -1,   174,     1,   173,
       -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   263,   263,   264,   265,   266,   267,   268,   269,   270,
-     274,   275,   279,   285,   291,   297,   303,   317,   324,   334,
-     335,   338,   340,   341,   344,   346,   351,   352,   356,   362,
-     364,   368,   370,   375,   379,   381,   388,   390,   393,   395,
-     403,   404,   405,   406,   407,   411,   412,   413,   414,   418,
-     419,   430,   431,   432,   433,   437,   438,   439,   440,   441,
-     446,   449,   452,   455,   461,   465,   471,   475,   481,   484,
-     489,   492,   495,   498,   504,   507,   510,   513,   516,   521,
-     524,   530,   534,   538,   542,   546,   551,   558,   564,   569,
-     570,   574,   575,   579,   580,   584,   590,   593,   599,   606,
-     611,   618,   621,   627,   630,   633,   639,   644,   652,   655,
-     659,   664,   669,   675,   678,   684,   690,   697,   698,   702,
-     703,   711,   717,   722,   731,   732,   756,   759,   765,   769,
-     772,   778,   779,   780,   784,   785,   789,   795,   804,   812,
-     818,   824,   827,   831,   847,   867,   873,   874,   875,   879,
-     884,   891,   897,   907,   919,   932,   940,   948,   951,   964,
-     970,   978,   990,   991,   992,   996,  1007,  1018,  1023,  1029,
-    1037,  1049,  1052,  1055,  1058,  1061,  1064,  1070,  1071,  1075,
-    1100,  1115,  1133,  1151,  1170,  1185,  1188,  1193,  1196,  1199,
-    1202,  1205,  1211,  1214,  1217,  1220,  1223,  1228,  1231,  1237,
-    1251,  1263,  1267,  1274,  1279,  1284,  1289,  1294,  1301,  1307,
-    1308,  1312,  1317,  1331,  1337,  1340,  1343,  1349,  1350,  1351,
-    1352,  1358,  1359,  1360,  1361,  1362,  1363,  1365,  1368,  1371,
-    1375,  1376,  1377,  1378,  1379,  1380,  1381,  1382,  1383,  1384,
-    1385,  1386,  1387,  1388,  1389,  1390,  1391,  1392,  1393,  1394,
-    1398,  1406,  1415,  1431,  1432,  1439,  1442,  1448,  1451,  1457,
-    1458,  1462,  1468,  1474,  1492,  1493,  1497,  1498
+       0,   266,   266,   267,   268,   269,   270,   271,   272,   273,
+     277,   278,   282,   288,   294,   300,   306,   320,   327,   337,
+     338,   341,   343,   344,   347,   349,   354,   355,   359,   365,
+     367,   371,   373,   378,   382,   384,   391,   393,   396,   398,
+     406,   407,   408,   409,   410,   414,   415,   416,   417,   421,
+     422,   433,   434,   435,   436,   440,   441,   442,   443,   444,
+     449,   452,   455,   458,   464,   468,   474,   478,   484,   487,
+     492,   495,   498,   501,   507,   510,   513,   516,   519,   524,
+     527,   533,   537,   541,   545,   549,   554,   561,   567,   572,
+     573,   577,   578,   582,   583,   587,   593,   596,   602,   609,
+     614,   621,   624,   630,   633,   636,   642,   647,   655,   658,
+     662,   667,   672,   678,   681,   687,   693,   700,   701,   705,
+     706,   714,   720,   725,   734,   735,   759,   762,   768,   772,
+     775,   781,   782,   783,   787,   788,   792,   798,   807,   815,
+     821,   827,   830,   834,   850,   870,   876,   877,   878,   882,
+     887,   894,   900,   910,   922,   935,   943,   951,   954,   967,
+     973,   981,   993,   994,   995,   999,  1010,  1021,  1026,  1032,
+    1040,  1052,  1055,  1058,  1061,  1064,  1067,  1073,  1074,  1078,
+    1108,  1128,  1146,  1164,  1183,  1198,  1201,  1206,  1209,  1212,
+    1215,  1218,  1224,  1227,  1230,  1233,  1236,  1241,  1244,  1250,
+    1264,  1276,  1280,  1287,  1292,  1297,  1302,  1307,  1314,  1320,
+    1321,  1325,  1330,  1344,  1350,  1353,  1356,  1362,  1363,  1364,
+    1365,  1371,  1372,  1373,  1374,  1375,  1376,  1378,  1381,  1384,
+    1390,  1391,  1392,  1393,  1394,  1395,  1396,  1397,  1398,  1399,
+    1400,  1401,  1402,  1403,  1404,  1405,  1406,  1407,  1408,  1409,
+    1413,  1421,  1430,  1446,  1447,  1454,  1457,  1463,  1466,  1472,
+    1473,  1477,  1483,  1489,  1507,  1508,  1512,  1513
 };
 #endif
 
@@ -771,27 +726,28 @@ static const yytype_uint16 yyrline[] =
    First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
 static const char *const yytname[] =
 {
-  "TOKEN_EOF", "error", "$undefined", "UNIMPORTANT_TOK", "WHITESPACE",
-  "SGML_CD", "INCLUDES", "DASHMATCH", "BEGINSWITH", "ENDSWITH", "CONTAINS",
-  "STRING", "IDENT", "NTH", "HEX", "IDSEL", "':'", "'.'", "'['", "'*'",
-  "'|'", "IMPORT_SYM", "PAGE_SYM", "MEDIA_SYM", "FONT_FACE_SYM",
-  "CHARSET_SYM", "NAMESPACE_SYM", "WEBKIT_RULE_SYM", "WEBKIT_DECLS_SYM",
-  "WEBKIT_KEYFRAME_RULE_SYM", "WEBKIT_KEYFRAMES_SYM", "WEBKIT_VALUE_SYM",
-  "WEBKIT_MEDIAQUERY_SYM", "WEBKIT_SELECTOR_SYM", "WEBKIT_VARIABLES_SYM",
-  "WEBKIT_DEFINE_SYM", "VARIABLES_FOR", "WEBKIT_VARIABLES_DECLS_SYM",
-  "ATKEYWORD", "IMPORTANT_SYM", "MEDIA_ONLY", "MEDIA_NOT", "MEDIA_AND",
-  "QEMS", "EMS", "EXS", "PXS", "CMS", "MMS", "INS", "PTS", "PCS", "DEGS",
-  "RADS", "GRADS", "TURNS", "MSECS", "SECS", "HERZ", "KHERZ", "DIMEN",
-  "PERCENTAGE", "FLOATTOKEN", "INTEGER", "URI", "FUNCTION", "NOTFUNCTION",
-  "UNICODERANGE", "VARCALL", "'{'", "'}'", "';'", "'('", "')'", "','",
-  "'+'", "'~'", "'>'", "'-'", "']'", "'='", "'/'", "'#'", "'%'", "$accept",
-  "stylesheet", "valid_rule_or_import", "webkit_rule",
-  "webkit_keyframe_rule", "webkit_decls", "webkit_variables_decls",
-  "webkit_value", "webkit_mediaquery", "webkit_selector", "maybe_space",
-  "maybe_sgml", "maybe_charset", "closing_brace", "charset", "import_list",
-  "variables_list", "namespace_list", "rule_list", "valid_rule", "rule",
-  "block_rule_list", "block_valid_rule", "block_rule", "import",
-  "variables_rule", "variables_media_list", "variables_declaration_list",
+  "TOKEN_EOF", "error", "$undefined", "LOWEST_PREC", "UNIMPORTANT_TOK",
+  "WHITESPACE", "SGML_CD", "INCLUDES", "DASHMATCH", "BEGINSWITH",
+  "ENDSWITH", "CONTAINS", "STRING", "IDENT", "NTH", "HEX", "IDSEL", "':'",
+  "'.'", "'['", "'*'", "'|'", "IMPORT_SYM", "PAGE_SYM", "MEDIA_SYM",
+  "FONT_FACE_SYM", "CHARSET_SYM", "NAMESPACE_SYM", "WEBKIT_RULE_SYM",
+  "WEBKIT_DECLS_SYM", "WEBKIT_KEYFRAME_RULE_SYM", "WEBKIT_KEYFRAMES_SYM",
+  "WEBKIT_VALUE_SYM", "WEBKIT_MEDIAQUERY_SYM", "WEBKIT_SELECTOR_SYM",
+  "WEBKIT_VARIABLES_SYM", "WEBKIT_DEFINE_SYM", "VARIABLES_FOR",
+  "WEBKIT_VARIABLES_DECLS_SYM", "ATKEYWORD", "IMPORTANT_SYM", "MEDIA_ONLY",
+  "MEDIA_NOT", "MEDIA_AND", "QEMS", "EMS", "EXS", "PXS", "CMS", "MMS",
+  "INS", "PTS", "PCS", "DEGS", "RADS", "GRADS", "TURNS", "MSECS", "SECS",
+  "HERZ", "KHERZ", "DIMEN", "PERCENTAGE", "FLOATTOKEN", "INTEGER", "URI",
+  "FUNCTION", "NOTFUNCTION", "UNICODERANGE", "VARCALL", "'{'", "'}'",
+  "';'", "'('", "')'", "','", "'+'", "'~'", "'>'", "'-'", "']'", "'='",
+  "'/'", "'#'", "'%'", "$accept", "stylesheet", "valid_rule_or_import",
+  "webkit_rule", "webkit_keyframe_rule", "webkit_decls",
+  "webkit_variables_decls", "webkit_value", "webkit_mediaquery",
+  "webkit_selector", "maybe_space", "maybe_sgml", "maybe_charset",
+  "closing_brace", "charset", "import_list", "variables_list",
+  "namespace_list", "rule_list", "valid_rule", "rule", "block_rule_list",
+  "block_valid_rule", "block_rule", "import", "variables_rule",
+  "variables_media_list", "variables_declaration_list",
   "variables_decl_list", "variables_declaration", "variable_name",
   "namespace", "maybe_ns_prefix", "string_or_uri", "media_feature",
   "maybe_media_value", "media_query_exp", "media_query_exp_list",
@@ -816,47 +772,47 @@ static const char *const yytname[] =
 static const yytype_uint16 yytoknum[] =
 {
        0,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     265,   266,   267,   268,   269,   270,    58,    46,    91,    42,
-     124,   271,   272,   273,   274,   275,   276,   277,   278,   279,
+     265,   266,   267,   268,   269,   270,   271,    58,    46,    91,
+      42,   124,   272,   273,   274,   275,   276,   277,   278,   279,
      280,   281,   282,   283,   284,   285,   286,   287,   288,   289,
      290,   291,   292,   293,   294,   295,   296,   297,   298,   299,
      300,   301,   302,   303,   304,   305,   306,   307,   308,   309,
-     310,   311,   312,   313,   314,   315,   316,   317,   318,   123,
-     125,    59,    40,    41,    44,    43,   126,    62,    45,    93,
-      61,    47,    35,    37
+     310,   311,   312,   313,   314,   315,   316,   317,   318,   319,
+     123,   125,    59,    40,    41,    44,    43,   126,    62,    45,
+      93,    61,    47,    35,    37
 };
 # endif
 
 /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint8 yyr1[] =
 {
-       0,    84,    85,    85,    85,    85,    85,    85,    85,    85,
-      86,    86,    87,    88,    89,    90,    91,    92,    93,    94,
-      94,    95,    95,    95,    96,    96,    97,    97,    98,    98,
-      98,    99,    99,    99,   100,   100,   101,   101,   102,   102,
-     103,   103,   103,   103,   103,   104,   104,   104,   104,   105,
-     105,   106,   106,   106,   106,   107,   107,   107,   107,   107,
-     108,   108,   108,   108,   109,   109,   110,   110,   111,   111,
-     111,   111,   111,   111,   112,   112,   112,   112,   112,   112,
-     112,   113,   113,   113,   113,   113,   113,   114,   115,   115,
-     115,   116,   116,   117,   117,   118,   119,   119,   120,   121,
-     121,   122,   122,   123,   123,   123,   124,   124,   125,   125,
-     126,   126,   126,   127,   127,   128,   129,   130,   130,   131,
-     131,   132,   133,   133,   134,   134,   135,   135,   136,   136,
-     136,   137,   137,   137,   138,   138,   139,   140,   140,   140,
-     141,   142,   142,   142,   142,   142,   143,   143,   143,   144,
-     144,   144,   144,   144,   144,   145,   145,   146,   146,   146,
-     147,   147,   147,   147,   147,   148,   149,   150,   150,   150,
-     150,   151,   151,   151,   151,   151,   151,   152,   152,   153,
-     153,   153,   153,   153,   153,   154,   154,   154,   154,   154,
-     154,   154,   155,   155,   155,   155,   155,   155,   155,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   157,   158,
-     158,   159,   159,   159,   160,   160,   160,   161,   161,   161,
-     161,   161,   161,   161,   161,   161,   161,   161,   161,   161,
-     162,   162,   162,   162,   162,   162,   162,   162,   162,   162,
+       0,    85,    86,    86,    86,    86,    86,    86,    86,    86,
+      87,    87,    88,    89,    90,    91,    92,    93,    94,    95,
+      95,    96,    96,    96,    97,    97,    98,    98,    99,    99,
+      99,   100,   100,   100,   101,   101,   102,   102,   103,   103,
+     104,   104,   104,   104,   104,   105,   105,   105,   105,   106,
+     106,   107,   107,   107,   107,   108,   108,   108,   108,   108,
+     109,   109,   109,   109,   110,   110,   111,   111,   112,   112,
+     112,   112,   112,   112,   113,   113,   113,   113,   113,   113,
+     113,   114,   114,   114,   114,   114,   114,   115,   116,   116,
+     116,   117,   117,   118,   118,   119,   120,   120,   121,   122,
+     122,   123,   123,   124,   124,   124,   125,   125,   126,   126,
+     127,   127,   127,   128,   128,   129,   130,   131,   131,   132,
+     132,   133,   134,   134,   135,   135,   136,   136,   137,   137,
+     137,   138,   138,   138,   139,   139,   140,   141,   141,   141,
+     142,   143,   143,   143,   143,   143,   144,   144,   144,   145,
+     145,   145,   145,   145,   145,   146,   146,   147,   147,   147,
+     148,   148,   148,   148,   148,   149,   150,   151,   151,   151,
+     151,   152,   152,   152,   152,   152,   152,   153,   153,   154,
+     154,   154,   154,   154,   154,   155,   155,   155,   155,   155,
+     155,   155,   156,   156,   156,   156,   156,   156,   156,   157,
+     157,   157,   157,   157,   157,   157,   157,   157,   158,   159,
+     159,   160,   160,   160,   161,   161,   161,   162,   162,   162,
      162,   162,   162,   162,   162,   162,   162,   162,   162,   162,
-     163,   164,   164,   165,   165,   166,   166,   167,   167,   168,
-     168,   169,   170,   171,   172,   172,   173,   173
+     163,   163,   163,   163,   163,   163,   163,   163,   163,   163,
+     163,   163,   163,   163,   163,   163,   163,   163,   163,   163,
+     164,   165,   165,   166,   166,   167,   167,   168,   168,   169,
+     169,   170,   171,   172,   173,   173,   174,   174
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
@@ -966,75 +922,75 @@ static const yytype_int16 yydefgoto[] =
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -299
+#define YYPACT_NINF -435
 static const yytype_int16 yypact[] =
 {
-     466,   425,   -26,   -20,    75,   118,   189,   139,   151,   263,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,   359,
-     300,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,   278,
-     278,   278,   278,   278,   278,   278,    33,   338,  -299,  -299,
-    -299,  -299,   749,   313,    32,  1074,    12,   545,    44,  -299,
-    -299,   345,   346,  -299,   335,   223,   194,   354,  -299,  -299,
-     419,   380,  -299,   383,  -299,   403,   408,  -299,   163,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,    86,   561,
-     199,   620,  -299,   626,   161,  -299,  -299,  -299,  -299,   374,
-    -299,  -299,  -299,   351,   239,   378,   179,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,   645,   882,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,    30,  -299,   363,    82,
-     402,  -299,   364,   185,   410,   190,   421,    28,  -299,   301,
-    -299,  -299,  -299,  -299,  -299,   423,  -299,  -299,  -299,   426,
-     337,  -299,  -299,    35,  -299,   542,   397,   640,     1,   691,
-      26,   448,   220,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,   561,  -299,  -299,   626,   343,   381,  -299,  -299,
-    -299,   443,   278,   278,  -299,   705,   377,    27,  -299,    59,
-    -299,  -299,  -299,   278,   242,   178,   278,   278,   278,   278,
-     278,   278,   278,   278,   278,   278,   278,   278,   278,   278,
-     278,   278,   278,   278,   278,   278,   278,   278,   278,   278,
-     278,   278,  1012,   278,   278,   278,  -299,  -299,  -299,  -299,
-    -299,  -299,  1132,   278,   201,   368,   312,  -299,  -299,  -299,
-     464,   278,  -299,   706,   395,  -299,    87,  -299,  -299,   188,
-    -299,  -299,  -299,  -299,   442,  -299,   301,   301,   223,  -299,
-     409,   413,   414,   545,   354,   383,   488,    69,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,   135,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,   313,   545,   278,   278,   278,
-    -299,   554,   278,   709,  -299,   475,  -299,   432,   278,  -299,
-     539,  -299,  -299,  -299,  -299,   947,   278,   278,   278,  -299,
-    -299,  -299,  -299,  -299,   462,   278,   712,  -299,   528,  -299,
-     278,  -299,   744,  -299,   294,   165,   382,  1229,  -299,   301,
-    -299,  -299,  -299,  -299,  -299,  -299,   278,  -299,   209,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,   339,   278,  -299,
-    -299,  -299,   313,   257,   174,   210,  -299,   278,   713,   278,
-     278,  1132,   463,   313,    32,  -299,   278,    42,   181,   278,
-    -299,  -299,  -299,   278,   754,   278,   278,  1132,   604,   313,
-     467,    97,   531,   473,   764,   329,   432,  -299,  -299,  -299,
-    -299,  -299,  -299,   301,    61,  -299,  -299,   458,   765,  1204,
-     278,    12,   477,  -299,  -299,   278,  -299,   463,  -299,   172,
-     478,  -299,   278,  -299,   479,  -299,   181,   278,  -299,   669,
-     486,  -299,    10,  -299,  -299,  -299,   562,   217,  -299,   301,
-    -299,   458,  -299,  -299,  -299,  -299,  -299,   223,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  1204,  -299,  -299,   278,   278,  -299,   278,  -299,  -299,
-    1074,  -299,    30,   278,  -299,    44,   152,    44,  -299,  -299,
-    -299,     2,  -299,   301,  -299,   278,   307,   817,   278,   278,
-     497,   504,   225,    15,  -299,  -299,  -299,   278,  -299,  -299,
-    -299,  -299,   278
+     818,    44,   -36,   -18,   112,   127,    66,   141,   162,   243,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,   239,
+      43,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,   250,
+     250,   250,   250,   250,   250,   250,    37,   304,  -435,  -435,
+    -435,  -435,   763,   354,    31,  1114,   144,   622,    49,  -435,
+    -435,   346,   344,  -435,   332,    27,    23,   358,  -435,  -435,
+     401,   370,  -435,   371,  -435,   381,   406,  -435,   193,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,   171,   702,
+     143,   631,  -435,   756,   159,  -435,  -435,  -435,  -435,   240,
+    -435,  -435,  -435,   329,   303,   254,   199,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,   949,   903,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,    34,  -435,   342,     4,
+     274,  -435,   353,    59,   291,   223,   331,   395,  -435,   438,
+    -435,  -435,  -435,  -435,  -435,   437,  -435,  -435,  -435,   448,
+      24,  -435,  -435,   415,  -435,   349,   295,   377,   375,   399,
+     198,   421,   190,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,   702,  -435,  -435,   756,   334,   380,  -435,  -435,
+    -435,   463,   250,   250,  -435,   409,   398,   180,  -435,    15,
+    -435,  -435,  -435,   250,   221,   182,   250,   250,   250,   250,
+     250,   250,   250,   250,   250,   250,   250,   250,   250,   250,
+     250,   250,   250,   250,   250,   250,   250,   250,   250,   250,
+     250,   250,  1052,   250,   250,   250,  -435,  -435,  -435,  -435,
+    -435,  -435,  1172,   250,   188,   166,   301,  -435,  -435,  -435,
+     472,   250,  -435,   412,   404,  -435,    62,  -435,  -435,   220,
+    -435,  -435,  -435,  -435,   458,  -435,   438,   438,    27,  -435,
+     413,   417,   430,   622,   358,   371,   473,   158,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,   172,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,   354,   622,   250,   250,   250,
+    -435,   555,   250,   420,  -435,   502,  -435,   459,   250,  -435,
+     535,  -435,  -435,  -435,  -435,   976,   250,   250,   250,  -435,
+    -435,  -435,  -435,  -435,   496,   250,   423,  -435,   541,  -435,
+     250,  -435,   754,  -435,   424,    36,   552,   685,  -435,   438,
+    -435,  -435,  -435,  -435,  -435,  -435,   250,  -435,   277,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,   856,   250,  -435,
+    -435,  -435,   354,   226,    65,   203,  -435,   250,   428,   250,
+     250,  1172,   462,   354,    31,  -435,   250,    53,   186,   250,
+    -435,  -435,  -435,   250,   429,   250,   250,  1172,   608,   354,
+     479,    83,   538,   485,   482,   320,   459,  -435,  -435,  -435,
+    -435,  -435,  -435,   438,    78,  -435,  -435,   447,   489,  1244,
+     250,   144,   487,  -435,  -435,   250,  -435,   462,  -435,   205,
+     491,  -435,   250,  -435,   492,  -435,   186,   250,  -435,   681,
+     497,  -435,     5,  -435,  -435,  -435,   558,   150,  -435,   438,
+    -435,   447,  -435,  -435,  -435,  -435,  -435,    27,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  1244,  -435,  -435,   250,   250,  -435,   250,  -435,  -435,
+    1114,  -435,    34,   250,  -435,    49,   178,    49,  -435,  -435,
+    -435,     1,  -435,   438,  -435,   250,   306,   827,   250,   250,
+     498,   504,   151,    14,  -435,  -435,  -435,   250,  -435,  -435,
+    -435,  -435,   250
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-      -1,   -21,  -299,   -51,  -299,  -299,  -299,  -299,  -299,   265,
-    -299,   200,  -299,  -299,   258,  -299,  -299,   352,  -299,   472,
-    -299,  -299,  -299,   186,  -299,  -299,   238,   240,  -299,  -299,
-     -45,   279,  -176,  -238,  -299,  -194,  -299,  -299,   149,  -299,
-     293,  -116,   -66,  -299,  -299,   -48,   663,  -299,   429,   568,
-     -61,   661,   -50,   -55,  -299,   460,  -299,   391,   303,  -299,
-    -298,  -299,   692,  -299,   330,  -185,  -299,   533,   675,   -35,
-    -299,  -299,   349,   -19,  -299,   469,  -299,   470,   -16,    -3
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+      -1,   -21,  -435,   -51,  -435,  -435,  -435,  -435,  -435,   229,
+    -435,   147,  -435,  -435,   256,  -435,  -435,  -434,  -435,   425,
+    -435,  -435,  -435,   130,  -435,  -435,   214,   174,  -435,  -435,
+     -45,   241,  -176,  -389,  -435,  -227,  -435,  -435,   116,  -435,
+     231,  -154,  -137,  -435,  -435,  -130,   566,  -435,   310,   449,
+     -61,   547,   -50,   -55,  -435,   348,  -435,   278,   194,  -435,
+    -298,  -435,   581,  -435,   261,  -185,  -435,   443,   546,   -35,
+    -435,  -435,   218,   -19,  -435,   352,  -435,   364,   -16,    -3
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -1044,324 +1000,332 @@ static const yytype_int16 yypgoto[] =
 #define YYTABLE_NINF -217
 static const yytype_int16 yytable[] =
 {
-      20,   148,   297,    39,   163,    40,    40,   374,    97,    29,
-      30,    31,    32,    33,    34,    35,    40,    53,   186,    40,
-      42,    43,    44,    45,    46,    47,    48,  -191,   317,   199,
-      40,   196,   159,   197,   -19,   160,    40,    49,    50,    40,
-      56,   142,   143,    21,    98,   150,    40,   284,    40,    22,
-     142,   143,   142,   143,   285,    64,   151,   325,   433,    97,
-     317,   173,   272,   273,   176,    40,   178,   180,   181,   182,
-     295,    51,   -19,   144,   422,   359,   360,   361,   362,   363,
-     212,   504,   144,   183,   144,   430,   201,   183,   317,   202,
-     203,   207,   209,    99,   511,   300,   213,  -191,   369,   214,
+      20,   148,   297,    39,   163,   183,    40,   374,    97,    29,
+      30,    31,    32,    33,    34,    35,   317,    53,   186,    40,
+      42,    43,    44,    45,    46,    47,    48,   161,    40,   199,
+     461,   196,   159,   197,    21,   160,    40,   280,   281,   -19,
+      56,    40,    49,    50,    98,    19,   142,   143,    40,   -19,
+     150,   500,    22,   501,    40,    41,   -19,   325,    40,    97,
+     263,   173,   151,   317,   176,   161,   178,   180,   181,   182,
+     433,    25,   151,   402,   422,   258,    51,   -19,   144,   185,
+     212,   504,   461,    40,   369,   430,   201,   319,   282,   202,
+     203,   207,   209,    99,   511,   166,   213,    37,   162,   214,
      215,   440,   216,   217,   218,   219,   220,   221,   222,   223,
      224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
      234,   235,   236,   237,   238,   239,   240,   241,   242,   243,
-     319,   310,   244,   245,   450,   382,   369,   276,   253,   277,
-     271,   199,   199,   254,    23,   311,   256,   260,   364,   365,
-     261,   266,   258,   369,   269,   184,   185,   398,   341,   289,
-     185,   294,   198,   299,   179,  -151,  -109,   -19,  -109,    40,
-     283,   371,  -199,   478,   161,    58,    59,    60,    61,    62,
-     210,   461,    40,   305,   306,    40,   263,    24,   307,   308,
-     309,   267,    40,    25,   -19,   211,   427,   151,    40,   312,
-     187,   402,   315,   188,   370,    40,   268,   318,    26,   371,
-     320,   187,   439,   330,   188,   359,   360,   361,   362,   363,
-      27,   -67,   355,   161,    40,   462,   371,   350,   290,    40,
-    -151,  -151,   -19,   461,  -151,  -151,  -151,  -151,  -151,  -187,
-     205,  -199,  -199,  -199,   162,   326,    40,   322,    37,   327,
-     328,    90,   323,   144,   349,   -70,   199,   343,   335,   -19,
-     338,    40,   351,    28,   340,   166,   486,   342,  -137,  -137,
-      97,   344,   345,  -137,   189,   190,   191,   462,    91,  -138,
-    -138,   291,    40,   356,  -138,   189,   190,   191,   415,   365,
-     304,   367,    37,   162,   368,   497,   510,   351,    40,   372,
-      72,   351,   373,   463,    40,    49,    50,    92,    37,  -187,
-     158,    41,   321,   377,    89,   379,    40,    40,   380,    98,
-     351,   383,   384,   424,   333,    90,   423,   413,   410,   386,
-     387,   388,   389,    40,   142,   143,   393,    97,   395,    55,
-     396,   446,   399,    40,   198,   405,   156,  -154,    97,   280,
-     281,  -103,    91,   464,   414,   463,   356,    58,    59,    60,
-      61,    62,   351,  -108,    97,   417,   144,    65,    99,   420,
-     421,   465,    40,    51,   167,   425,   472,   505,   351,   142,
-     143,    92,   198,   404,   432,  -150,   -19,   449,   445,   436,
-     448,   437,   172,   -19,   -19,    58,    59,    60,    61,    62,
-     282,    40,   456,   174,   175,   464,   492,   -19,   290,   177,
-     332,   144,  -154,  -154,   -19,   451,  -154,  -154,  -154,  -154,
-    -154,   204,   474,   465,   278,   475,    19,   477,    37,   -19,
-      38,   168,   480,   257,   262,   169,   -19,   483,   279,   493,
-     485,   448,   487,    37,   313,   200,   -19,    37,   316,   208,
-    -150,  -150,    40,   491,  -150,  -150,  -150,  -150,  -150,   301,
-     302,   291,    40,  -210,   248,   336,   339,   -19,   346,   452,
-     453,    37,   495,   259,  -216,  -216,   378,  -216,  -216,    37,
-     498,   265,   352,   499,   170,   171,   353,   354,   502,   503,
-      37,     1,   270,     2,     3,     4,   507,     5,     6,     7,
-     357,    37,   428,     8,   390,   512,  -216,  -216,  -216,  -216,
+     -70,   310,   244,   245,   341,   382,   162,   276,   253,   277,
+     271,   199,   199,   254,   187,   311,   256,   260,   188,    40,
+     261,   266,   450,  -109,   269,  -109,    40,   398,   371,   289,
+     198,   294,   290,   299,  -151,   359,   360,   361,   362,   363,
+     283,    40,   183,   369,    58,    59,    60,    61,    62,   369,
+    -191,   317,    23,   305,   306,   142,   143,    40,   307,   308,
+     309,    40,   462,    40,   179,    40,   427,    24,   -19,   312,
+     210,   330,   315,    40,   187,  -199,   478,   318,   188,   332,
+     320,    26,   439,  -137,  -137,   291,   211,   144,  -137,   189,
+     190,   191,   355,   510,   267,    40,    40,   350,   -19,  -151,
+    -151,    40,    27,  -151,  -151,  -151,  -151,  -151,   364,   365,
+     268,   184,   370,    28,   462,   326,   185,   371,   -67,   327,
+     328,  -191,   322,   371,   349,    40,   199,   323,   335,   144,
+     338,   304,   351,   -19,   340,   463,   486,   342,   300,    37,
+      97,   344,   345,  -138,  -138,  -199,  -199,  -199,  -138,   189,
+     190,   191,   464,   356,   359,   360,   361,   362,   363,   465,
+     343,   367,   321,   -19,   368,   497,   423,   351,    72,   372,
+      40,   351,   373,  -187,   205,    55,    40,   290,   158,    37,
+      37,    38,   200,   377,   333,   379,    90,   463,   380,    98,
+     351,   383,   384,   424,    37,    40,   208,   413,   410,   386,
+     387,   388,   389,   446,   464,   198,   393,    97,   395,  -154,
+     396,   465,   399,    91,    37,   405,   259,   156,    97,    58,
+      59,    60,    61,    62,   414,    89,   356,   415,   365,    40,
+     291,    37,   351,   265,    97,   417,    65,    90,    99,   420,
+     421,    51,    92,    37,  -187,   425,   472,   505,   351,   167,
+      40,   198,   175,   172,   432,  -150,   -19,   449,   445,   436,
+     448,   437,   174,   -19,    91,    58,    59,    60,    61,    62,
+     204,    37,   456,   270,  -154,  -154,   492,   177,  -154,  -154,
+    -154,  -154,  -154,   257,   168,   451,   142,   143,   169,    37,
+      40,   288,   474,    92,   262,   475,    40,   477,   284,    40,
+     272,   273,   480,   301,   302,   285,    64,   483,   278,   493,
+     485,   448,   487,    49,    50,   295,   -19,    37,   144,   293,
+    -150,  -150,    40,   491,  -150,  -150,  -150,  -150,  -150,   452,
+     453,   279,  -210,   248,   313,   142,   143,   170,   171,    37,
+     316,   298,   495,   336,  -216,  -216,   339,  -216,  -216,    37,
+     498,   314,    37,   499,   337,   346,   357,   352,   502,   503,
+      37,   353,   376,    37,  -108,   392,   507,   144,    37,    37,
+     426,   438,   428,   378,   354,   512,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   394,
-    -216,  -216,  -210,  -210,  -210,   442,   441,   250,  -216,  -205,
-     381,  -216,   443,    40,   251,  -216,  -216,   473,   479,    40,
-     103,   104,   481,   105,   106,   198,   484,    57,  -153,    58,
-      59,    60,    61,    62,    63,    64,   488,   508,    58,    59,
-      60,    61,    62,    57,   509,    58,    59,    60,    61,    62,
-      63,    64,   107,   108,   109,   110,   111,   112,   113,   114,
-     115,   116,   117,   118,   119,   120,   121,   122,   123,   124,
-     125,   126,   127,   128,   129,   248,   130,    92,  -205,  -205,
-    -205,    37,   407,   288,   131,  -216,  -216,   132,  -216,  -216,
-     471,   133,   134,  -153,  -153,   264,   435,  -153,  -153,  -153,
-    -153,  -153,   193,   489,    58,    59,    60,    61,    62,   194,
-      58,    59,    60,    61,    62,   506,   418,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,    37,
+    -216,  -216,  -210,  -210,  -210,  -205,   381,   250,  -216,   390,
+      40,  -216,   394,   442,   251,  -216,  -216,   103,   104,   441,
+     105,   106,    37,   404,   444,   443,   198,   -19,   473,    37,
+    -153,   455,   479,   488,   -19,   -19,   481,   471,   484,   508,
+      58,    59,    60,    61,    62,   509,   407,   489,   264,   107,
+     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
+     118,   119,   120,   121,   122,   123,   124,   125,   126,   127,
+     128,   129,   435,   130,    92,  -205,  -205,  -205,   418,   248,
+     482,   131,   506,   149,   132,   431,   375,   -19,   133,   134,
+    -216,  -216,   286,  -216,  -216,  -153,  -153,    40,   195,  -153,
+    -153,  -153,  -153,  -153,   358,    57,   416,    58,    59,    60,
+      61,    62,    63,    64,   193,   490,    58,    59,    60,    61,
+      62,   194,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,   206,  -216,  -216,   -81,   -81,
+     -81,   247,   248,   250,  -216,    -2,   406,  -216,   476,   494,
+     251,  -216,  -216,  -216,  -216,   329,  -216,  -216,    57,   411,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
+      68,   412,     0,     0,     0,    57,    69,    58,    59,    60,
+      61,    62,    63,    64,    51,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-     248,  -216,  -216,   -81,   -81,   -81,   482,   431,   250,  -216,
-    -216,  -216,  -216,  -216,  -216,   251,  -216,  -216,   107,   108,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,  -216,
+    -216,   -84,   -84,   -84,     0,   397,   250,  -216,     0,    40,
+    -216,     0,     0,   251,  -216,  -216,   103,   104,    40,   105,
+     106,    58,    59,    60,    61,    62,    57,     0,    58,    59,
+      60,    61,    62,    63,    64,    65,    66,    67,    68,     0,
+       0,     0,     0,     0,    69,     0,     0,     0,   107,   108,
      109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
-     119,   120,   121,   122,   123,   246,   125,   126,   127,    37,
-     149,   293,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+     119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
+     129,     0,   130,    92,   -85,   -85,   -85,     0,   248,     0,
+     131,     0,   -19,   132,     0,     0,     0,   133,   134,  -216,
+    -216,     0,  -216,  -216,     1,     0,     2,     3,     4,     0,
+       5,     6,     7,     0,     0,     0,     8,     0,     0,     0,
+       0,    40,     0,     0,     0,     0,     0,     0,     0,  -103,
+       0,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,   375,  -216,  -216,   -84,   -84,
-     -84,   286,   195,   250,  -216,   397,   358,  -216,    40,   416,
-     251,  -216,  -216,    40,   490,   103,   104,   476,   105,   106,
-      37,    57,   298,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    68,    37,    37,   314,   337,    37,    69,
-     376,    37,    37,   392,   426,   329,   206,   107,   108,   109,
-     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
-     120,   121,   122,   123,   124,   125,   126,   127,   128,   129,
-     247,   130,    92,   -85,   -85,   -85,   411,   412,   248,   131,
-     494,   -19,   132,    37,     0,   438,   133,   134,  -216,  -216,
-       0,  -216,  -216,    37,    37,   444,   455,   500,     0,   501,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+    -216,  -216,  -216,  -216,     0,  -216,  -216,   142,   143,     0,
+       0,   -19,   250,  -216,   248,     0,  -216,     0,     0,   251,
+    -216,  -216,     0,     0,     0,  -216,  -216,     0,  -216,  -216,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,   144,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,   248,  -216,  -216,     0,     0,     0,     0,
-     -19,   250,  -216,  -216,  -216,  -216,  -216,  -216,   251,  -216,
-    -216,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,
+       0,  -216,  -216,     0,   249,     0,     0,   248,   250,  -216,
+       0,     0,  -216,     0,     0,   251,  -216,  -216,  -216,  -216,
+       0,  -216,  -216,   107,   108,   109,   110,   111,   112,   113,
+     114,   115,   116,   117,   118,   119,   120,   121,   122,   123,
+     246,   125,   126,   127,     0,     0,     0,     0,     0,     0,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   248,  -216,
-    -216,     0,   249,     0,     0,     0,   250,  -216,  -216,  -216,
-    -216,  -216,  -216,   251,  -216,  -216,     0,     0,     0,     0,
+    -216,  -216,  -216,     0,  -216,  -216,     0,     0,     0,     0,
+     385,   250,  -216,   324,     0,  -216,     0,    40,   251,  -216,
+    -216,     0,     0,     0,   103,   104,     0,   105,   106,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,   324,  -216,  -216,    40,     0,     0,     0,
-     385,   250,  -216,   103,   104,  -216,   105,   106,   251,  -216,
-    -216,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,   107,   108,   109,   110,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     121,   122,   123,   124,   125,   126,   127,   128,   129,    40,
+     130,    92,     0,     0,     0,     0,   103,   104,   131,   105,
+     106,   132,     0,     0,     0,   133,   134,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,   107,   108,   109,   110,   111,
-     112,   113,   114,   115,   116,   117,   118,   119,   120,   121,
-     122,   123,   124,   125,   126,   127,   128,   129,    40,   130,
-      92,     0,     0,     0,     0,   103,   104,   131,   105,   106,
-     132,     0,     0,     0,   133,   134,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,   107,   108,
+     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
+     119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
+     129,     0,   130,    92,   103,   104,     0,   105,   106,     0,
+     131,     0,     0,   132,     0,     0,     0,   133,   134,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,   107,   108,   109,
-     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
-     120,   121,   122,   123,   124,   125,   126,   127,   128,   129,
-       0,   130,    92,   103,   104,     0,   105,   106,     0,   131,
-       0,     0,   132,     0,     0,     0,   133,   134,     0,     0,
+       0,     0,     0,     0,     0,     0,   107,   108,   109,   110,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     121,   122,   123,   124,   125,   126,   127,   128,   129,     0,
+     130,    92,     0,     0,   161,   457,     0,     0,   131,     0,
+       0,   132,     0,     0,     0,   133,   134,    57,     0,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    68,
+       0,     0,     0,     0,     0,    69,     0,     0,     0,     0,
+       0,     0,     0,    51,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,   107,   108,   109,   110,   111,
-     112,   113,   114,   115,   116,   117,   118,   119,   120,   121,
-     122,   123,   124,   125,   126,   127,   128,   129,     0,   130,
-      92,     0,     0,     0,   161,   457,     0,   131,     0,     0,
-     132,     0,     0,     0,   133,   134,    57,     0,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    68,    -2,
-     406,     0,     0,     0,    69,     0,     0,     0,     0,     0,
-       0,    57,    51,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    68,     0,     0,     0,     0,     0,    69,
-       0,     0,     0,     0,     0,     0,     0,    51,     0,     0,
-       0,     0,     0,     0,   162
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,   162
 };
 
 static const yytype_int16 yycheck[] =
 {
-       1,    46,   178,    19,    55,     4,     4,   305,    43,    10,
-      11,    12,    13,    14,    15,    16,     4,    36,    79,     4,
-      21,    22,    23,    24,    25,    26,    27,     0,     1,    84,
-       4,    81,    53,    83,     4,    54,     4,     4,     5,     4,
-      41,    40,    41,    69,    12,     1,     4,    12,     4,    69,
-      40,    41,    40,    41,    19,    20,    12,   242,    16,    94,
-       1,    62,    34,    35,    65,     4,    67,    68,    69,    70,
-      69,    38,    42,    72,   372,     6,     7,     8,     9,    10,
-      96,    79,    72,     1,    72,   383,    89,     1,     1,    90,
-      91,    94,    95,    61,    79,    69,    97,    70,     1,   100,
+       1,    46,   178,    19,    55,     1,     5,   305,    43,    10,
+      11,    12,    13,    14,    15,    16,     1,    36,    79,     5,
+      21,    22,    23,    24,    25,    26,    27,     0,     5,    84,
+     419,    81,    53,    83,    70,    54,     5,    13,    14,     5,
+      41,     5,     5,     6,    13,     1,    41,    42,     5,     5,
+       1,   485,    70,   487,     5,    12,    12,   242,     5,    94,
+       1,    62,    13,     1,    65,     0,    67,    68,    69,    70,
+      17,     5,    13,    37,   372,    71,    39,    43,    73,    75,
+      96,    80,   471,     5,     1,   383,    89,    72,    64,    90,
+      91,    94,    95,    62,    80,    72,    97,    70,    71,   100,
      101,   399,   103,   104,   105,   106,   107,   108,   109,   110,
      111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
      121,   122,   123,   124,   125,   126,   127,   128,   129,   130,
-      71,   192,   133,   134,    73,   320,     1,   158,   139,   160,
-     156,   196,   197,   144,    69,   195,   147,   150,    79,    80,
-     151,   154,    70,     1,   155,    69,    74,   342,    71,   175,
-      74,   177,     1,   179,     1,     4,    69,     4,    71,     4,
-     171,    74,     0,     1,     0,    14,    15,    16,    17,    18,
-       1,   419,     4,   184,   185,     4,     1,    69,   189,   190,
-     191,     1,     4,     4,     4,    16,   381,    12,     4,   200,
-       1,    36,   205,     4,    69,     4,    16,   208,    69,    74,
-     211,     1,   397,    12,     4,     6,     7,     8,     9,    10,
-      69,    69,   283,     0,     4,   419,    74,   278,    11,     4,
-      69,    70,    69,   471,    73,    74,    75,    76,    77,     0,
-       1,    69,    70,    71,    70,   246,     4,    69,    69,   250,
-     251,    12,    74,    72,   275,    70,   311,    69,   259,    69,
-     263,     4,   278,     0,   265,    71,   442,   268,    69,    70,
-     305,   272,   273,    74,    75,    76,    77,   471,    39,    69,
-      70,    64,     4,   284,    74,    75,    76,    77,    79,    80,
-      70,   292,    69,    70,   295,   480,    71,   313,     4,   300,
-      42,   317,   303,   419,     4,     4,     5,    68,    69,    70,
-      52,    11,    70,   314,     1,   316,     4,     4,   319,    12,
-     336,   322,   323,   374,    12,    12,    69,   348,   347,   330,
-     331,   332,   333,     4,    40,    41,   337,   372,   339,     1,
-     341,    12,   343,     4,     1,   346,     1,     4,   383,    12,
-      13,    12,    39,   419,   355,   471,   357,    14,    15,    16,
-      17,    18,   378,    69,   399,   366,    72,    21,    61,   370,
-     371,   419,     4,    38,    20,   376,   421,    70,   394,    40,
-      41,    68,     1,     1,   385,     4,     4,   408,   404,   390,
-     406,   392,    12,    11,    12,    14,    15,    16,    17,    18,
-      63,     4,   418,    20,     1,   471,   457,     4,    11,     1,
-      42,    72,    69,    70,    11,   416,    73,    74,    75,    76,
-      77,    70,   423,   471,     1,   426,     1,   428,    69,     4,
-      71,    12,   433,    70,    70,    16,    11,   438,    12,   460,
-     441,   457,   443,    69,     1,    71,    64,    69,    71,    71,
-      69,    70,     4,   454,    73,    74,    75,    76,    77,    11,
-      12,    64,     4,     0,     1,     1,    71,    64,    26,    11,
-      12,    69,   473,    71,    11,    12,     1,    14,    15,    69,
-     481,    71,    73,   484,    65,    66,    73,    73,   489,   490,
-      69,    25,    71,    27,    28,    29,   497,    31,    32,    33,
-      12,    69,    39,    37,    42,   506,    43,    44,    45,    46,
-      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
-      57,    58,    59,    60,    61,    62,    63,    64,    65,     1,
-      67,    68,    69,    70,    71,     4,    69,    74,    75,     0,
-       1,    78,    69,     4,    81,    82,    83,    70,    70,     4,
-      11,    12,    73,    14,    15,     1,    70,    12,     4,    14,
-      15,    16,    17,    18,    19,    20,     4,    70,    14,    15,
-      16,    17,    18,    12,    70,    14,    15,    16,    17,    18,
-      19,    20,    43,    44,    45,    46,    47,    48,    49,    50,
-      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,     1,    67,    68,    69,    70,
-      71,    69,   347,    71,    75,    11,    12,    78,    14,    15,
-     420,    82,    83,    69,    70,   153,   388,    73,    74,    75,
-      76,    77,    12,   447,    14,    15,    16,    17,    18,    19,
-      14,    15,    16,    17,    18,   496,   367,    43,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-       1,    67,    68,    69,    70,    71,   436,   384,    74,    75,
-      11,    12,    78,    14,    15,    81,    82,    83,    43,    44,
+      71,   192,   133,   134,    72,   320,    71,   158,   139,   160,
+     156,   196,   197,   144,     1,   195,   147,   150,     5,     5,
+     151,   154,    74,    70,   155,    72,     5,   342,    75,   175,
+       1,   177,    12,   179,     5,     7,     8,     9,    10,    11,
+     171,     5,     1,     1,    15,    16,    17,    18,    19,     1,
+       0,     1,    70,   184,   185,    41,    42,     5,   189,   190,
+     191,     5,   419,     5,     1,     5,   381,    70,     5,   200,
+       1,    13,   205,     5,     1,     0,     1,   208,     5,    43,
+     211,    70,   397,    70,    71,    65,    17,    73,    75,    76,
+      77,    78,   283,    72,     1,     5,     5,   278,     5,    70,
+      71,     5,    70,    74,    75,    76,    77,    78,    80,    81,
+      17,    70,    70,     0,   471,   246,    75,    75,    70,   250,
+     251,    71,    70,    75,   275,     5,   311,    75,   259,    73,
+     263,    71,   278,    70,   265,   419,   442,   268,    70,    70,
+     305,   272,   273,    70,    71,    70,    71,    72,    75,    76,
+      77,    78,   419,   284,     7,     8,     9,    10,    11,   419,
+      70,   292,    71,    70,   295,   480,    70,   313,    42,   300,
+       5,   317,   303,     0,     1,     1,     5,    12,    52,    70,
+      70,    72,    72,   314,    13,   316,    13,   471,   319,    13,
+     336,   322,   323,   374,    70,     5,    72,   348,   347,   330,
+     331,   332,   333,    13,   471,     1,   337,   372,   339,     5,
+     341,   471,   343,    40,    70,   346,    72,     1,   383,    15,
+      16,    17,    18,    19,   355,     1,   357,    80,    81,     5,
+      65,    70,   378,    72,   399,   366,    22,    13,    62,   370,
+     371,    39,    69,    70,    71,   376,   421,    71,   394,    21,
+       5,     1,     1,    13,   385,     5,     5,   408,   404,   390,
+     406,   392,    21,    12,    40,    15,    16,    17,    18,    19,
+      71,    70,   418,    72,    70,    71,   457,     1,    74,    75,
+      76,    77,    78,    71,    13,   416,    41,    42,    17,    70,
+       5,    72,   423,    69,    71,   426,     5,   428,    13,     5,
+      35,    36,   433,    12,    13,    20,    21,   438,     1,   460,
+     441,   457,   443,     5,     6,    70,    65,    70,    73,    72,
+      70,    71,     5,   454,    74,    75,    76,    77,    78,    12,
+      13,    13,     0,     1,     1,    41,    42,    66,    67,    70,
+      72,    72,   473,     1,    12,    13,    72,    15,    16,    70,
+     481,    72,    70,   484,    72,    27,    13,    74,   489,   490,
+      70,    74,    72,    70,    70,    72,   497,    73,    70,    70,
+      72,    72,    40,     1,    74,   506,    44,    45,    46,    47,
+      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    70,
+      68,    69,    70,    71,    72,     0,     1,    75,    76,    43,
+       5,    79,     1,     5,    82,    83,    84,    12,    13,    70,
+      15,    16,    70,     1,    72,    70,     1,     5,    71,    70,
+       5,    72,    71,     5,    12,    13,    74,   420,    71,    71,
+      15,    16,    17,    18,    19,    71,   347,   447,   153,    44,
       45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    69,
-      47,    71,    43,    44,    45,    46,    47,    48,    49,    50,
-      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,   306,    67,    68,    69,    70,
-      71,   173,    81,    74,    75,     1,   286,    78,     4,   358,
-      81,    82,    83,     4,   451,    11,    12,   427,    14,    15,
-      69,    12,    71,    14,    15,    16,    17,    18,    19,    20,
-      21,    22,    23,    24,    69,    69,    71,    71,    69,    30,
-      71,    69,    69,    71,    71,   252,    94,    43,    44,    45,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,   388,    68,    69,    70,    71,    72,   367,     1,
+     436,    76,   496,    47,    79,   384,   306,    65,    83,    84,
+      12,    13,   173,    15,    16,    70,    71,     5,    81,    74,
+      75,    76,    77,    78,   286,    13,   358,    15,    16,    17,
+      18,    19,    20,    21,    13,   451,    15,    16,    17,    18,
+      19,    20,    44,    45,    46,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
+      62,    63,    64,    65,    66,    94,    68,    69,    70,    71,
+      72,   135,     1,    75,    76,     0,     1,    79,   427,   471,
+      82,    83,    84,    12,    13,   252,    15,    16,    13,   347,
+      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
+      25,   347,    -1,    -1,    -1,    13,    31,    15,    16,    17,
+      18,    19,    20,    21,    39,    44,    45,    46,    47,    48,
+      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    -1,    68,
+      69,    70,    71,    72,    -1,     1,    75,    76,    -1,     5,
+      79,    -1,    -1,    82,    83,    84,    12,    13,     5,    15,
+      16,    15,    16,    17,    18,    19,    13,    -1,    15,    16,
+      17,    18,    19,    20,    21,    22,    23,    24,    25,    -1,
+      -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-     135,    67,    68,    69,    70,    71,   347,   347,     1,    75,
-     471,     4,    78,    69,    -1,    71,    82,    83,    11,    12,
-      -1,    14,    15,    69,    69,    71,    71,   485,    -1,   487,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      43,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      66,    -1,    68,    69,    70,    71,    72,    -1,     1,    -1,
+      76,    -1,     5,    79,    -1,    -1,    -1,    83,    84,    12,
+      13,    -1,    15,    16,    26,    -1,    28,    29,    30,    -1,
+      32,    33,    34,    -1,    -1,    -1,    38,    -1,    -1,    -1,
+      -1,     5,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    13,
+      -1,    44,    45,    46,    47,    48,    49,    50,    51,    52,
       53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,     1,    67,    68,    -1,    -1,    -1,    -1,
-      73,    74,    75,    11,    12,    78,    14,    15,    81,    82,
-      83,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      63,    64,    65,    66,    -1,    68,    69,    41,    42,    -1,
+      -1,    74,    75,    76,     1,    -1,    79,    -1,    -1,    82,
+      83,    84,    -1,    -1,    -1,    12,    13,    -1,    15,    16,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    73,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    43,    44,    45,    46,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,     1,    67,
-      68,    -1,    70,    -1,    -1,    -1,    74,    75,    11,    12,
-      78,    14,    15,    81,    82,    83,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      -1,    68,    69,    -1,    71,    -1,    -1,     1,    75,    76,
+      -1,    -1,    79,    -1,    -1,    82,    83,    84,    12,    13,
+      -1,    15,    16,    44,    45,    46,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
+      61,    62,    63,    64,    -1,    -1,    -1,    -1,    -1,    -1,
+      44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
+      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
+      64,    65,    66,    -1,    68,    69,    -1,    -1,    -1,    -1,
+      74,    75,    76,     1,    -1,    79,    -1,     5,    82,    83,
+      84,    -1,    -1,    -1,    12,    13,    -1,    15,    16,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      43,    44,    45,    46,    47,    48,    49,    50,    51,    52,
-      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,     1,    67,    68,     4,    -1,    -1,    -1,
-      73,    74,    75,    11,    12,    78,    14,    15,    81,    82,
-      83,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    43,    44,    45,    46,    47,
+      -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,     4,    67,
-      68,    -1,    -1,    -1,    -1,    11,    12,    75,    14,    15,
-      78,    -1,    -1,    -1,    82,    83,    -1,    -1,    -1,    -1,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,     5,
+      68,    69,    -1,    -1,    -1,    -1,    12,    13,    76,    15,
+      16,    79,    -1,    -1,    -1,    83,    84,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,    44,    45,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      -1,    67,    68,    11,    12,    -1,    14,    15,    -1,    75,
-      -1,    -1,    78,    -1,    -1,    -1,    82,    83,    -1,    -1,
+      66,    -1,    68,    69,    12,    13,    -1,    15,    16,    -1,
+      76,    -1,    -1,    79,    -1,    -1,    -1,    83,    84,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    43,    44,    45,    46,    47,
+      -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    -1,    67,
-      68,    -1,    -1,    -1,     0,     1,    -1,    75,    -1,    -1,
-      78,    -1,    -1,    -1,    82,    83,    12,    -1,    14,    15,
-      16,    17,    18,    19,    20,    21,    22,    23,    24,     0,
-       1,    -1,    -1,    -1,    30,    -1,    -1,    -1,    -1,    -1,
-      -1,    12,    38,    14,    15,    16,    17,    18,    19,    20,
-      21,    22,    23,    24,    -1,    -1,    -1,    -1,    -1,    30,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    38,    -1,    -1,
-      -1,    -1,    -1,    -1,    70
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    -1,
+      68,    69,    -1,    -1,     0,     1,    -1,    -1,    76,    -1,
+      -1,    79,    -1,    -1,    -1,    83,    84,    13,    -1,    15,
+      16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
+      -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    39,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    71
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint8 yystos[] =
 {
-       0,    25,    27,    28,    29,    31,    32,    33,    37,    85,
-      87,    88,    89,    90,    91,    92,    93,    96,    98,     1,
-      94,    69,    69,    69,    69,     4,    69,    69,     0,    94,
-      94,    94,    94,    94,    94,    94,    95,    69,    71,   172,
-       4,    11,    94,    94,    94,    94,    94,    94,    94,     4,
-       5,    38,    99,   167,   168,     1,    94,    12,    14,    15,
-      16,    17,    18,    19,    20,    21,    22,    23,    24,    30,
-      86,   103,   108,   127,   129,   135,   136,   139,   140,   141,
-     142,   143,   144,   145,   146,   147,   148,   150,   153,     1,
-      12,    39,    68,   154,   155,   156,   157,   163,    12,    61,
-     132,   133,   134,    11,    12,    14,    15,    43,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      67,    75,    78,    82,    83,   138,   159,   161,   162,   163,
-     164,   165,    40,    41,    72,   120,   121,   123,   124,   140,
-       1,    12,   111,   112,   113,   114,     1,   100,   108,    95,
-     167,     0,    70,    97,   172,   173,    71,    20,    12,    16,
-      65,    66,    12,    94,    20,     1,    94,     1,    94,     1,
-      94,    94,    94,     1,    69,    74,   144,     1,     4,    75,
-      76,    77,   137,    12,    19,   145,   146,   146,     1,   147,
-      71,   173,    94,    94,    70,     1,   156,   173,    71,   173,
-       1,    16,   172,    94,    94,    94,    94,    94,    94,    94,
-      94,    94,    94,    94,    94,    94,    94,    94,    94,    94,
-      94,    94,    94,    94,    94,    94,    94,    94,    94,    94,
-      94,    94,    94,    94,    94,    94,    60,   162,     1,    70,
-      74,    81,   160,    94,    94,    94,    94,    70,    70,    71,
-     173,    94,    70,     1,   113,    71,   173,     1,    16,    94,
-      71,   172,    34,    35,   101,   109,    95,    95,     1,    12,
-      12,    13,    63,    94,    12,    19,   143,   149,    71,   172,
-      11,    64,   117,    71,   172,    69,   124,   126,    71,   172,
-      69,    11,    12,   130,    70,    94,    94,    94,    94,    94,
-     144,   146,    94,     1,    71,   173,    71,     1,    94,    71,
-      94,    70,    69,    74,     1,   159,    94,    94,    94,   161,
-      12,   118,    42,    12,   128,    94,     1,    71,   173,    71,
-      94,    71,    94,    69,    94,    94,    26,   102,   115,    95,
-      97,   172,    73,    73,    73,   144,    94,    12,   149,     6,
-       7,     8,     9,    10,    79,    80,   151,    94,    94,     1,
-      69,    74,    94,    94,   154,   142,    71,    94,     1,    94,
-      94,     1,   159,    94,    94,    73,    94,    94,    94,    94,
-      42,   122,    71,    94,     1,    94,    94,     1,   159,    94,
-     125,   126,    36,   110,     1,    94,     1,   103,   104,   108,
-     167,   169,   171,    95,    94,    79,   151,    94,   125,   105,
-      94,    94,   154,    69,    97,    94,    71,   159,    39,   158,
-     154,   134,    94,    16,   119,   120,    94,    94,    71,   159,
-     154,    69,     4,    69,    71,   172,    12,   116,   172,    95,
-      73,    94,    11,    12,   152,    71,   172,     1,    97,   106,
-     107,   127,   129,   135,   136,   139,   166,   167,   169,   170,
-     171,   105,   124,    70,    94,    94,   158,    94,     1,    70,
-      94,    73,   121,    94,    70,    94,   126,    94,     4,   117,
-     152,    94,    97,    95,   166,    94,   131,   159,    94,    94,
-     111,   111,    94,    94,    79,    70,   132,    94,    70,    70,
-      71,    79,    94
+       0,    26,    28,    29,    30,    32,    33,    34,    38,    86,
+      88,    89,    90,    91,    92,    93,    94,    97,    99,     1,
+      95,    70,    70,    70,    70,     5,    70,    70,     0,    95,
+      95,    95,    95,    95,    95,    95,    96,    70,    72,   173,
+       5,    12,    95,    95,    95,    95,    95,    95,    95,     5,
+       6,    39,   100,   168,   169,     1,    95,    13,    15,    16,
+      17,    18,    19,    20,    21,    22,    23,    24,    25,    31,
+      87,   104,   109,   128,   130,   136,   137,   140,   141,   142,
+     143,   144,   145,   146,   147,   148,   149,   151,   154,     1,
+      13,    40,    69,   155,   156,   157,   158,   164,    13,    62,
+     133,   134,   135,    12,    13,    15,    16,    44,    45,    46,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      68,    76,    79,    83,    84,   139,   160,   162,   163,   164,
+     165,   166,    41,    42,    73,   121,   122,   124,   125,   141,
+       1,    13,   112,   113,   114,   115,     1,   101,   109,    96,
+     168,     0,    71,    98,   173,   174,    72,    21,    13,    17,
+      66,    67,    13,    95,    21,     1,    95,     1,    95,     1,
+      95,    95,    95,     1,    70,    75,   145,     1,     5,    76,
+      77,    78,   138,    13,    20,   146,   147,   147,     1,   148,
+      72,   174,    95,    95,    71,     1,   157,   174,    72,   174,
+       1,    17,   173,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    61,   163,     1,    71,
+      75,    82,   161,    95,    95,    95,    95,    71,    71,    72,
+     174,    95,    71,     1,   114,    72,   174,     1,    17,    95,
+      72,   173,    35,    36,   102,   110,    96,    96,     1,    13,
+      13,    14,    64,    95,    13,    20,   144,   150,    72,   173,
+      12,    65,   118,    72,   173,    70,   125,   127,    72,   173,
+      70,    12,    13,   131,    71,    95,    95,    95,    95,    95,
+     145,   147,    95,     1,    72,   174,    72,     1,    95,    72,
+      95,    71,    70,    75,     1,   160,    95,    95,    95,   162,
+      13,   119,    43,    13,   129,    95,     1,    72,   174,    72,
+      95,    72,    95,    70,    95,    95,    27,   103,   116,    96,
+      98,   173,    74,    74,    74,   145,    95,    13,   150,     7,
+       8,     9,    10,    11,    80,    81,   152,    95,    95,     1,
+      70,    75,    95,    95,   155,   143,    72,    95,     1,    95,
+      95,     1,   160,    95,    95,    74,    95,    95,    95,    95,
+      43,   123,    72,    95,     1,    95,    95,     1,   160,    95,
+     126,   127,    37,   111,     1,    95,     1,   104,   105,   109,
+     168,   170,   172,    96,    95,    80,   152,    95,   126,   106,
+      95,    95,   155,    70,    98,    95,    72,   160,    40,   159,
+     155,   135,    95,    17,   120,   121,    95,    95,    72,   160,
+     155,    70,     5,    70,    72,   173,    13,   117,   173,    96,
+      74,    95,    12,    13,   153,    72,   173,     1,    98,   107,
+     108,   128,   130,   136,   137,   140,   167,   168,   170,   171,
+     172,   106,   125,    71,    95,    95,   159,    95,     1,    71,
+      95,    74,   122,    95,    71,    95,   127,    95,     5,   118,
+     153,    95,    98,    96,   167,    95,   132,   160,    95,    95,
+     112,   112,    95,    95,    80,    71,   133,    95,    71,    71,
+      72,    80,    95
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -1546,17 +1510,20 @@ yy_symbol_print (yyoutput, yytype, yyvaluep)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
+yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
 #else
 static void
-yy_stack_print (bottom, top)
-    yytype_int16 *bottom;
-    yytype_int16 *top;
+yy_stack_print (yybottom, yytop)
+    yytype_int16 *yybottom;
+    yytype_int16 *yytop;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; bottom <= top; ++bottom)
-    YYFPRINTF (stderr, " %d", *bottom);
+  for (; yybottom <= yytop; yybottom++)
+    {
+      int yybot = *yybottom;
+      YYFPRINTF (stderr, " %d", yybot);
+    }
   YYFPRINTF (stderr, "\n");
 }
 
@@ -1590,11 +1557,11 @@ yy_reduce_print (yyvsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      fprintf (stderr, "   $%d = ", yyi + 1);
+      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       		       );
-      fprintf (stderr, "\n");
+      YYFPRINTF (stderr, "\n");
     }
 }
 
@@ -1874,10 +1841,8 @@ yydestruct (yymsg, yytype, yyvaluep)
 	break;
     }
 }
-
 
 /* Prevent warnings from -Wmissing-prototypes.  */
-
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -1896,10 +1861,9 @@ int yyparse ();
 
 
 
-
-/*----------.
-| yyparse.  |
-`----------*/
+/*-------------------------.
+| yyparse or yypush_parse.  |
+`-------------------------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -1923,74 +1887,75 @@ yyparse ()
 #endif
 #endif
 {
-  /* The look-ahead symbol.  */
+/* The lookahead symbol.  */
 int yychar;
 
-/* The semantic value of the look-ahead symbol.  */
+/* The semantic value of the lookahead symbol.  */
 YYSTYPE yylval;
 
-/* Number of syntax errors so far.  */
-int yynerrs;
-
-  int yystate;
-  int yyn;
-  int yyresult;
-  /* Number of tokens to shift before error messages enabled.  */
-  int yyerrstatus;
-  /* Look-ahead token as an internal (translated) token number.  */
-  int yytoken = 0;
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
-
-  /* Three stacks and their tools:
-     `yyss': related to states,
-     `yyvs': related to semantic values,
-     `yyls': related to locations.
-
-     Refer to the stacks thru separate pointers, to allow yyoverflow
-     to reallocate them elsewhere.  */
+    /* Number of syntax errors so far.  */
+    int yynerrs;
 
-  /* The state stack.  */
-  yytype_int16 yyssa[YYINITDEPTH];
-  yytype_int16 *yyss = yyssa;
-  yytype_int16 *yyssp;
+    int yystate;
+    /* Number of tokens to shift before error messages enabled.  */
+    int yyerrstatus;
 
-  /* The semantic value stack.  */
-  YYSTYPE yyvsa[YYINITDEPTH];
-  YYSTYPE *yyvs = yyvsa;
-  YYSTYPE *yyvsp;
+    /* The stacks and their tools:
+       `yyss': related to states.
+       `yyvs': related to semantic values.
 
+       Refer to the stacks thru separate pointers, to allow yyoverflow
+       to reallocate them elsewhere.  */
 
+    /* The state stack.  */
+    yytype_int16 yyssa[YYINITDEPTH];
+    yytype_int16 *yyss;
+    yytype_int16 *yyssp;
 
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
+    /* The semantic value stack.  */
+    YYSTYPE yyvsa[YYINITDEPTH];
+    YYSTYPE *yyvs;
+    YYSTYPE *yyvsp;
 
-  YYSIZE_T yystacksize = YYINITDEPTH;
+    YYSIZE_T yystacksize;
 
+  int yyn;
+  int yyresult;
+  /* Lookahead token as an internal (translated) token number.  */
+  int yytoken;
   /* The variables used to return semantic value and location from the
      action routines.  */
   YYSTYPE yyval;
 
+#if YYERROR_VERBOSE
+  /* Buffer for error messages, and its allocated size.  */
+  char yymsgbuf[128];
+  char *yymsg = yymsgbuf;
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
+#endif
+
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
 
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
+  yytoken = 0;
+  yyss = yyssa;
+  yyvs = yyvsa;
+  yystacksize = YYINITDEPTH;
+
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY;		/* Cause a token to be read.  */
+  yychar = YYEMPTY; /* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
-
   yyssp = yyss;
   yyvsp = yyvs;
 
@@ -2020,7 +1985,6 @@ int yynerrs;
 	YYSTYPE *yyvs1 = yyvs;
 	yytype_int16 *yyss1 = yyss;
 
-
 	/* Each stack pointer address is followed by the size of the
 	   data in use in that stack, in bytes.  This used to be a
 	   conditional around just the two extra args, but that might
@@ -2028,7 +1992,6 @@ int yynerrs;
 	yyoverflow (YY_("memory exhausted"),
 		    &yyss1, yysize * sizeof (*yyssp),
 		    &yyvs1, yysize * sizeof (*yyvsp),
-
 		    &yystacksize);
 
 	yyss = yyss1;
@@ -2051,9 +2014,8 @@ int yynerrs;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss);
-	YYSTACK_RELOCATE (yyvs);
-
+	YYSTACK_RELOCATE (yyss_alloc, yyss);
+	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -2064,7 +2026,6 @@ int yynerrs;
       yyssp = yyss + yysize - 1;
       yyvsp = yyvs + yysize - 1;
 
-
       YYDPRINTF ((stderr, "Stack size increased to %lu\n",
 		  (unsigned long int) yystacksize));
 
@@ -2074,6 +2035,9 @@ int yynerrs;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
+  if (yystate == YYFINAL)
+    YYACCEPT;
+
   goto yybackup;
 
 /*-----------.
@@ -2082,16 +2046,16 @@ int yynerrs;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     look-ahead token if we need one and don't already have one.  */
+     lookahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to look-ahead token.  */
+  /* First try to decide what to do without reference to lookahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a look-ahead token if don't already have one.  */
+  /* Not known => get a lookahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -2123,20 +2087,16 @@ yybackup:
       goto yyreduce;
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the look-ahead token.  */
+  /* Shift the lookahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token unless it is eof.  */
-  if (yychar != YYEOF)
-    yychar = YYEMPTY;
+  /* Discard the shifted token.  */
+  yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -2176,35 +2136,45 @@ yyreduce:
   switch (yyn)
     {
         case 12:
-#line 279 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 282 "../css/CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_rule = (yyvsp[(4) - (6)].rule);
     ;}
     break;
 
   case 13:
-#line 285 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 288 "../css/CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_keyframe = (yyvsp[(4) - (6)].keyframeRule);
     ;}
     break;
 
   case 14:
-#line 291 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 294 "../css/CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
   case 15:
-#line 297 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 300 "../css/CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
   case 16:
-#line 303 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 306 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         if ((yyvsp[(4) - (5)].valueList)) {
@@ -2219,7 +2189,9 @@ yyreduce:
     break;
 
   case 17:
-#line 317 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 320 "../css/CSSGrammar.y"
     {
          CSSParser* p = static_cast<CSSParser*>(parser);
          p->m_mediaQuery = p->sinkFloatingMediaQuery((yyvsp[(4) - (5)].mediaQuery));
@@ -2227,7 +2199,9 @@ yyreduce:
     break;
 
   case 18:
-#line 324 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 327 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(4) - (5)].selectorList)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2238,13 +2212,17 @@ yyreduce:
     break;
 
   case 25:
-#line 346 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 349 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 28:
-#line 356 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 359 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      (yyval.rule) = static_cast<CSSParser*>(parser)->createCharsetRule((yyvsp[(3) - (5)].string));
@@ -2254,19 +2232,25 @@ yyreduce:
     break;
 
   case 29:
-#line 362 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 365 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 30:
-#line 364 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 367 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 32:
-#line 370 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 373 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2275,13 +2259,17 @@ yyreduce:
     break;
 
   case 33:
-#line 375 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 378 "../css/CSSGrammar.y"
     {
  ;}
     break;
 
   case 35:
-#line 381 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 384 "../css/CSSGrammar.y"
     {
     CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2290,7 +2278,9 @@ yyreduce:
     break;
 
   case 39:
-#line 395 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 398 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2299,12 +2289,16 @@ yyreduce:
     break;
 
   case 49:
-#line 418 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 421 "../css/CSSGrammar.y"
     { (yyval.ruleList) = 0; ;}
     break;
 
   case 50:
-#line 419 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 422 "../css/CSSGrammar.y"
     {
       (yyval.ruleList) = (yyvsp[(1) - (3)].ruleList);
       if ((yyvsp[(2) - (3)].rule)) {
@@ -2316,70 +2310,90 @@ yyreduce:
     break;
 
   case 60:
-#line 446 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 449 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createImportRule((yyvsp[(3) - (6)].string), (yyvsp[(5) - (6)].mediaList));
     ;}
     break;
 
   case 61:
-#line 449 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 452 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 62:
-#line 452 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 455 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 63:
-#line 455 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 458 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 64:
-#line 461 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 464 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), true);
     ;}
     break;
 
   case 65:
-#line 465 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 468 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), false);
     ;}
     break;
 
   case 66:
-#line 471 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 474 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
     ;}
     break;
 
   case 67:
-#line 475 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 478 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(3) - (3)].mediaList);
     ;}
     break;
 
   case 68:
-#line 481 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 484 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 69:
-#line 484 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 487 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ((yyvsp[(2) - (2)].boolean))
@@ -2388,63 +2402,81 @@ yyreduce:
     break;
 
   case 70:
-#line 489 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 492 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 71:
-#line 492 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 495 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 72:
-#line 495 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 498 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 73:
-#line 498 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 501 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
   case 74:
-#line 504 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 507 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
   case 75:
-#line 507 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 510 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 76:
-#line 510 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 513 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 77:
-#line 513 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 516 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 78:
-#line 516 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 519 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -2453,49 +2485,63 @@ yyreduce:
     break;
 
   case 79:
-#line 521 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 524 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
   case 80:
-#line 524 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 527 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
   case 81:
-#line 530 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 533 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariable((yyvsp[(1) - (4)].string), (yyvsp[(4) - (4)].valueList));
     ;}
     break;
 
   case 82:
-#line 534 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 537 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariableDeclarationBlock((yyvsp[(1) - (7)].string));
     ;}
     break;
 
   case 83:
-#line 538 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 541 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 84:
-#line 542 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 545 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 85:
-#line 546 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 549 "../css/CSSGrammar.y"
     {
         /* @variables { varname: } Just reduce away this variable with no value. */
         (yyval.boolean) = false;
@@ -2503,7 +2549,9 @@ yyreduce:
     break;
 
   case 86:
-#line 551 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 554 "../css/CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: @variables { varname: *; }, just discard the property/value pair */
         (yyval.boolean) = false;
@@ -2511,14 +2559,18 @@ yyreduce:
     break;
 
   case 87:
-#line 558 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 561 "../css/CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
   case 88:
-#line 564 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 567 "../css/CSSGrammar.y"
     {
     CSSParser* p = static_cast<CSSParser*>(parser);
     if (p->m_styleSheet)
@@ -2527,38 +2579,50 @@ yyreduce:
     break;
 
   case 91:
-#line 574 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 577 "../css/CSSGrammar.y"
     { (yyval.string).characters = 0; ;}
     break;
 
   case 92:
-#line 575 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 578 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 95:
-#line 584 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 587 "../css/CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
   case 96:
-#line 590 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 593 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
     break;
 
   case 97:
-#line 593 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 596 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = (yyvsp[(3) - (4)].valueList);
     ;}
     break;
 
   case 98:
-#line 599 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 602 "../css/CSSGrammar.y"
     {
         (yyvsp[(3) - (7)].string).lower();
         (yyval.mediaQueryExp) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExp((yyvsp[(3) - (7)].string), (yyvsp[(5) - (7)].valueList));
@@ -2566,7 +2630,9 @@ yyreduce:
     break;
 
   case 99:
-#line 606 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 609 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQueryExpList) = p->createFloatingMediaQueryExpList();
@@ -2575,7 +2641,9 @@ yyreduce:
     break;
 
   case 100:
-#line 611 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 614 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(1) - (5)].mediaQueryExpList);
         (yyval.mediaQueryExpList)->append(static_cast<CSSParser*>(parser)->sinkFloatingMediaQueryExp((yyvsp[(5) - (5)].mediaQueryExp)));
@@ -2583,42 +2651,54 @@ yyreduce:
     break;
 
   case 101:
-#line 618 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 621 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExpList();
     ;}
     break;
 
   case 102:
-#line 621 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 624 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(3) - (3)].mediaQueryExpList);
     ;}
     break;
 
   case 103:
-#line 627 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 630 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::None;
     ;}
     break;
 
   case 104:
-#line 630 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 633 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Only;
     ;}
     break;
 
   case 105:
-#line 633 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 636 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Not;
     ;}
     break;
 
   case 106:
-#line 639 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 642 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQuery) = p->createFloatingMediaQuery(p->sinkFloatingMediaQueryExpList((yyvsp[(1) - (1)].mediaQueryExpList)));
@@ -2626,7 +2706,9 @@ yyreduce:
     break;
 
   case 107:
-#line 644 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 647 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyvsp[(3) - (4)].string).lower();
@@ -2635,14 +2717,18 @@ yyreduce:
     break;
 
   case 108:
-#line 652 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 655 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
      ;}
     break;
 
   case 110:
-#line 659 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 662 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaList) = p->createMediaList();
@@ -2651,7 +2737,9 @@ yyreduce:
     break;
 
   case 111:
-#line 664 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 667 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(1) - (4)].mediaList);
         if ((yyval.mediaList))
@@ -2660,35 +2748,45 @@ yyreduce:
     break;
 
   case 112:
-#line 669 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 672 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = 0;
     ;}
     break;
 
   case 113:
-#line 675 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 678 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule((yyvsp[(3) - (7)].mediaList), (yyvsp[(6) - (7)].ruleList));
     ;}
     break;
 
   case 114:
-#line 678 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 681 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule(0, (yyvsp[(5) - (6)].ruleList));
     ;}
     break;
 
   case 115:
-#line 684 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 687 "../css/CSSGrammar.y"
     {
       (yyval.string) = (yyvsp[(1) - (2)].string);
   ;}
     break;
 
   case 116:
-#line 690 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 693 "../css/CSSGrammar.y"
     {
         (yyval.rule) = (yyvsp[(7) - (8)].keyframesRule);
         (yyvsp[(7) - (8)].keyframesRule)->setNameInternal((yyvsp[(3) - (8)].string));
@@ -2696,12 +2794,16 @@ yyreduce:
     break;
 
   case 119:
-#line 702 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 705 "../css/CSSGrammar.y"
     { (yyval.keyframesRule) = static_cast<CSSParser*>(parser)->createKeyframesRule(); ;}
     break;
 
   case 120:
-#line 703 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 706 "../css/CSSGrammar.y"
     {
         (yyval.keyframesRule) = (yyvsp[(1) - (3)].keyframesRule);
         if ((yyvsp[(2) - (3)].keyframeRule))
@@ -2710,14 +2812,18 @@ yyreduce:
     break;
 
   case 121:
-#line 711 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 714 "../css/CSSGrammar.y"
     {
         (yyval.keyframeRule) = static_cast<CSSParser*>(parser)->createKeyframeRule((yyvsp[(1) - (6)].valueList));
     ;}
     break;
 
   case 122:
-#line 717 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 720 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -2726,7 +2832,9 @@ yyreduce:
     break;
 
   case 123:
-#line 722 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 725 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (5)].valueList);
@@ -2736,12 +2844,16 @@ yyreduce:
     break;
 
   case 124:
-#line 731 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 734 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (1)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 125:
-#line 732 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 735 "../css/CSSGrammar.y"
     {
         (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER;
         CSSParserString& str = (yyvsp[(1) - (1)].string);
@@ -2755,74 +2867,98 @@ yyreduce:
     break;
 
   case 126:
-#line 756 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 759 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 127:
-#line 759 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 762 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 128:
-#line 766 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 769 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createFontFaceRule();
     ;}
     break;
 
   case 129:
-#line 769 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 772 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 130:
-#line 772 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 775 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 131:
-#line 778 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 781 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::DirectAdjacent; ;}
     break;
 
   case 132:
-#line 779 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 782 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::IndirectAdjacent; ;}
     break;
 
   case 133:
-#line 780 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 783 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::Child; ;}
     break;
 
   case 134:
-#line 784 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 787 "../css/CSSGrammar.y"
     { (yyval.integer) = -1; ;}
     break;
 
   case 135:
-#line 785 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 788 "../css/CSSGrammar.y"
     { (yyval.integer) = 1; ;}
     break;
 
   case 136:
-#line 789 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 792 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createStyleRule((yyvsp[(1) - (5)].selectorList));
     ;}
     break;
 
   case 137:
-#line 795 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 798 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2835,7 +2971,9 @@ yyreduce:
     break;
 
   case 138:
-#line 804 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 807 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (4)].selectorList) && (yyvsp[(4) - (4)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2847,35 +2985,45 @@ yyreduce:
     break;
 
   case 139:
-#line 812 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 815 "../css/CSSGrammar.y"
     {
         (yyval.selectorList) = 0;
     ;}
     break;
 
   case 140:
-#line 818 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 821 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (2)].selector);
     ;}
     break;
 
   case 141:
-#line 824 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 827 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
   case 142:
-#line 828 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 831 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
   case 143:
-#line 832 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 835 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if (!(yyvsp[(1) - (2)].selector))
@@ -2894,7 +3042,9 @@ yyreduce:
     break;
 
   case 144:
-#line 847 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 850 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if (!(yyvsp[(1) - (3)].selector))
@@ -2918,29 +3068,39 @@ yyreduce:
     break;
 
   case 145:
-#line 867 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 870 "../css/CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
   case 146:
-#line 873 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 876 "../css/CSSGrammar.y"
     { (yyval.string).characters = 0; (yyval.string).length = 0; ;}
     break;
 
   case 147:
-#line 874 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 877 "../css/CSSGrammar.y"
     { static UChar star = '*'; (yyval.string).characters = &star; (yyval.string).length = 1; ;}
     break;
 
   case 148:
-#line 875 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 878 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 149:
-#line 879 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 882 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -2949,7 +3109,9 @@ yyreduce:
     break;
 
   case 150:
-#line 884 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 887 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -2960,7 +3122,9 @@ yyreduce:
     break;
 
   case 151:
-#line 891 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 894 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2970,7 +3134,9 @@ yyreduce:
     break;
 
   case 152:
-#line 897 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 900 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2984,7 +3150,9 @@ yyreduce:
     break;
 
   case 153:
-#line 907 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 910 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if ((yyval.selector)) {
@@ -3000,7 +3168,9 @@ yyreduce:
     break;
 
   case 154:
-#line 919 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 922 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -3014,7 +3184,9 @@ yyreduce:
     break;
 
   case 155:
-#line 932 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 935 "../css/CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (1)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3026,7 +3198,9 @@ yyreduce:
     break;
 
   case 156:
-#line 940 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 943 "../css/CSSGrammar.y"
     {
         static UChar star = '*';
         (yyval.string).characters = &star;
@@ -3035,14 +3209,18 @@ yyreduce:
     break;
 
   case 157:
-#line 948 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 951 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
   case 158:
-#line 951 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 954 "../css/CSSGrammar.y"
     {
         if (!(yyvsp[(2) - (2)].selector))
             (yyval.selector) = 0;
@@ -3059,14 +3237,18 @@ yyreduce:
     break;
 
   case 159:
-#line 964 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 967 "../css/CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
   case 160:
-#line 970 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 973 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3078,7 +3260,9 @@ yyreduce:
     break;
 
   case 161:
-#line 978 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 981 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].string).characters[0] >= '0' && (yyvsp[(1) - (1)].string).characters[0] <= '9') {
             (yyval.selector) = 0;
@@ -3094,7 +3278,9 @@ yyreduce:
     break;
 
   case 165:
-#line 996 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 999 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3106,7 +3292,9 @@ yyreduce:
     break;
 
   case 166:
-#line 1007 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1010 "../css/CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3118,7 +3306,9 @@ yyreduce:
     break;
 
   case 167:
-#line 1018 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1021 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (4)].string), nullAtom));
@@ -3127,7 +3317,9 @@ yyreduce:
     break;
 
   case 168:
-#line 1023 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1026 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (8)].string), nullAtom));
@@ -3137,7 +3329,9 @@ yyreduce:
     break;
 
   case 169:
-#line 1029 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1032 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (5)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3149,7 +3343,9 @@ yyreduce:
     break;
 
   case 170:
-#line 1037 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1040 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (9)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3162,49 +3358,63 @@ yyreduce:
     break;
 
   case 171:
-#line 1049 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1052 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Exact;
     ;}
     break;
 
   case 172:
-#line 1052 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1055 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::List;
     ;}
     break;
 
   case 173:
-#line 1055 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1058 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Hyphen;
     ;}
     break;
 
   case 174:
-#line 1058 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1061 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Begin;
     ;}
     break;
 
   case 175:
-#line 1061 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1064 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::End;
     ;}
     break;
 
   case 176:
-#line 1064 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1067 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Contain;
     ;}
     break;
 
   case 179:
-#line 1075 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1078 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
@@ -3228,12 +3438,19 @@ yyreduce:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     ;}
     break;
 
   case 180:
-#line 1100 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1108 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoElement;
@@ -3246,12 +3463,19 @@ yyreduce:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     ;}
     break;
 
   case 181:
-#line 1115 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1128 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3272,7 +3496,9 @@ yyreduce:
     break;
 
   case 182:
-#line 1133 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1146 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3293,7 +3519,9 @@ yyreduce:
     break;
 
   case 183:
-#line 1151 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1164 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3315,9 +3543,11 @@ yyreduce:
     break;
 
   case 184:
-#line 1170 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1183 "../css/CSSGrammar.y"
     {
-        if (!(yyvsp[(4) - (6)].selector))
+        if (!(yyvsp[(4) - (6)].selector) || (yyvsp[(4) - (6)].selector)->simpleSelector() || (yyvsp[(4) - (6)].selector)->tagHistory())
             (yyval.selector) = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3331,14 +3561,18 @@ yyreduce:
     break;
 
   case 185:
-#line 1185 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1198 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 186:
-#line 1188 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1201 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ( (yyvsp[(2) - (2)].boolean) )
@@ -3347,70 +3581,90 @@ yyreduce:
     break;
 
   case 187:
-#line 1193 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1206 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 188:
-#line 1196 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1209 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 189:
-#line 1199 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1212 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 190:
-#line 1202 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1215 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
   case 191:
-#line 1205 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1218 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
   case 192:
-#line 1211 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1224 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
   case 193:
-#line 1214 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1227 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 194:
-#line 1217 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1230 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 195:
-#line 1220 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1233 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 196:
-#line 1223 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1236 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -3419,21 +3673,27 @@ yyreduce:
     break;
 
   case 197:
-#line 1228 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1241 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
   case 198:
-#line 1231 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1244 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
   case 199:
-#line 1237 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1250 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3450,7 +3710,9 @@ yyreduce:
     break;
 
   case 200:
-#line 1251 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1264 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         p->m_valueList = new CSSParserValueList;
@@ -3465,14 +3727,18 @@ yyreduce:
     break;
 
   case 201:
-#line 1263 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1276 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 202:
-#line 1267 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1280 "../css/CSSGrammar.y"
     {
         /* The default movable type template has letter-spacing: .none;  Handle this by looking for
         error tokens at the start of an expr, recover the expr and then treat as an error, cleaning
@@ -3482,7 +3748,9 @@ yyreduce:
     break;
 
   case 203:
-#line 1274 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1287 "../css/CSSGrammar.y"
     {
         /* When we encounter something like p {color: red !important fail;} we should drop the declaration */
         (yyval.boolean) = false;
@@ -3490,7 +3758,9 @@ yyreduce:
     break;
 
   case 204:
-#line 1279 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1292 "../css/CSSGrammar.y"
     {
         /* Handle this case: div { text-align: center; !important } Just reduce away the stray !important. */
         (yyval.boolean) = false;
@@ -3498,7 +3768,9 @@ yyreduce:
     break;
 
   case 205:
-#line 1284 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1297 "../css/CSSGrammar.y"
     {
         /* div { font-family: } Just reduce away this property with no value. */
         (yyval.boolean) = false;
@@ -3506,7 +3778,9 @@ yyreduce:
     break;
 
   case 206:
-#line 1289 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1302 "../css/CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: p { weight: *; }, just discard the rule */
         (yyval.boolean) = false;
@@ -3514,7 +3788,9 @@ yyreduce:
     break;
 
   case 207:
-#line 1294 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1307 "../css/CSSGrammar.y"
     {
         /* if we come across: div { color{;color:maroon} }, ignore everything within curly brackets */
         (yyval.boolean) = false;
@@ -3522,24 +3798,32 @@ yyreduce:
     break;
 
   case 208:
-#line 1301 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1314 "../css/CSSGrammar.y"
     {
         (yyval.integer) = cssPropertyID((yyvsp[(1) - (2)].string));
     ;}
     break;
 
   case 209:
-#line 1307 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1320 "../css/CSSGrammar.y"
     { (yyval.boolean) = true; ;}
     break;
 
   case 210:
-#line 1308 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1321 "../css/CSSGrammar.y"
     { (yyval.boolean) = false; ;}
     break;
 
   case 211:
-#line 1312 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1325 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -3548,7 +3832,9 @@ yyreduce:
     break;
 
   case 212:
-#line 1317 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1330 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (3)].valueList);
@@ -3566,50 +3852,66 @@ yyreduce:
     break;
 
   case 213:
-#line 1331 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1344 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
     break;
 
   case 214:
-#line 1337 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1350 "../css/CSSGrammar.y"
     {
         (yyval.character) = '/';
     ;}
     break;
 
   case 215:
-#line 1340 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1353 "../css/CSSGrammar.y"
     {
         (yyval.character) = ',';
     ;}
     break;
 
   case 216:
-#line 1343 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1356 "../css/CSSGrammar.y"
     {
         (yyval.character) = 0;
   ;}
     break;
 
   case 217:
-#line 1349 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1362 "../css/CSSGrammar.y"
     { (yyval.value) = (yyvsp[(1) - (1)].value); ;}
     break;
 
   case 218:
-#line 1350 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1363 "../css/CSSGrammar.y"
     { (yyval.value) = (yyvsp[(2) - (2)].value); (yyval.value).fValue *= (yyvsp[(1) - (2)].integer); ;}
     break;
 
   case 219:
-#line 1351 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1364 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_STRING; ;}
     break;
 
   case 220:
-#line 1352 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1365 "../css/CSSGrammar.y"
     {
       (yyval.value).id = cssValueKeywordID((yyvsp[(1) - (2)].string));
       (yyval.value).unit = CSSPrimitiveValue::CSS_IDENT;
@@ -3618,156 +3920,218 @@ yyreduce:
     break;
 
   case 221:
-#line 1358 "../css/CSSGrammar.y"
-    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION ;}
+
+/* Line 1455 of yacc.c  */
+#line 1371 "../css/CSSGrammar.y"
+    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
   case 222:
-#line 1359 "../css/CSSGrammar.y"
-    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(2) - (3)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION ;}
+
+/* Line 1455 of yacc.c  */
+#line 1372 "../css/CSSGrammar.y"
+    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(2) - (3)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
   case 223:
-#line 1360 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1373 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_URI; ;}
     break;
 
   case 224:
-#line 1361 "../css/CSSGrammar.y"
-    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_UNICODE_RANGE ;}
+
+/* Line 1455 of yacc.c  */
+#line 1374 "../css/CSSGrammar.y"
+    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; ;}
     break;
 
   case 225:
-#line 1362 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1375 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (1)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
   case 226:
-#line 1363 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1376 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = CSSParserString(); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
   case 227:
-#line 1365 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1378 "../css/CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (1)].value);
   ;}
     break;
 
   case 228:
-#line 1368 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1381 "../css/CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (2)].value);
   ;}
     break;
 
   case 229:
-#line 1371 "../css/CSSGrammar.y"
-    {;}
+
+/* Line 1455 of yacc.c  */
+#line 1384 "../css/CSSGrammar.y"
+    { /* Handle width: %; */
+      (yyval.value).id = 0; (yyval.value).unit = 0;
+  ;}
     break;
 
   case 230:
-#line 1375 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1390 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = true; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 231:
-#line 1376 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1391 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 232:
-#line 1377 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1392 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PERCENTAGE; ;}
     break;
 
   case 233:
-#line 1378 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1393 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PX; ;}
     break;
 
   case 234:
-#line 1379 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1394 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_CM; ;}
     break;
 
   case 235:
-#line 1380 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1395 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MM; ;}
     break;
 
   case 236:
-#line 1381 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1396 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_IN; ;}
     break;
 
   case 237:
-#line 1382 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1397 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PT; ;}
     break;
 
   case 238:
-#line 1383 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1398 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PC; ;}
     break;
 
   case 239:
-#line 1384 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1399 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_DEG; ;}
     break;
 
   case 240:
-#line 1385 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1400 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_RAD; ;}
     break;
 
   case 241:
-#line 1386 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1401 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_GRAD; ;}
     break;
 
   case 242:
-#line 1387 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1402 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_TURN; ;}
     break;
 
   case 243:
-#line 1388 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1403 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MS; ;}
     break;
 
   case 244:
-#line 1389 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1404 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_S; ;}
     break;
 
   case 245:
-#line 1390 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1405 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_HZ; ;}
     break;
 
   case 246:
-#line 1391 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1406 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_KHZ; ;}
     break;
 
   case 247:
-#line 1392 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1407 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EMS; ;}
     break;
 
   case 248:
-#line 1393 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1408 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSParserValue::Q_EMS; ;}
     break;
 
   case 249:
-#line 1394 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1409 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EXS; ;}
     break;
 
   case 250:
-#line 1398 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1413 "../css/CSSGrammar.y"
     {
       (yyval.value).id = 0;
       (yyval.value).string = (yyvsp[(1) - (1)].string);
@@ -3776,7 +4140,9 @@ yyreduce:
     break;
 
   case 251:
-#line 1406 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1421 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -3789,7 +4155,9 @@ yyreduce:
     break;
 
   case 252:
-#line 1415 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1430 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -3802,67 +4170,86 @@ yyreduce:
     break;
 
   case 253:
-#line 1431 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1446 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 254:
-#line 1432 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1447 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 255:
-#line 1439 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1454 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 256:
-#line 1442 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1457 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 257:
-#line 1448 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1463 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 258:
-#line 1451 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1466 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 261:
-#line 1462 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1477 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 262:
-#line 1468 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1483 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 263:
-#line 1474 "../css/CSSGrammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1489 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
 
-/* Line 1267 of yacc.c.  */
-#line 3866 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+
+/* Line 1455 of yacc.c  */
+#line 4253 "WebCore/tmp/../generated/CSSGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -3873,7 +4260,6 @@ yyreduce:
 
   *++yyvsp = yyval;
 
-
   /* Now `shift' the result of the reduction.  Determine what state
      that goes to, based on the state we popped back to and the rule
      number reduced by.  */
@@ -3938,7 +4324,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse look-ahead token after an
+      /* If just tried and failed to reuse lookahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -3955,7 +4341,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse look-ahead token after shifting the error
+  /* Else will try to reuse lookahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -4012,9 +4398,6 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   *++yyvsp = yylval;
 
 
@@ -4039,7 +4422,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#ifndef yyoverflow
+#if !defined(yyoverflow) || YYERROR_VERBOSE
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -4050,7 +4433,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEOF && yychar != YYEMPTY)
+  if (yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -4076,6 +4459,8 @@ yyreturn:
 }
 
 
-#line 1501 "../css/CSSGrammar.y"
+
+/* Line 1675 of yacc.c  */
+#line 1516 "../css/CSSGrammar.y"
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
index 1b60c68199..4223680d50 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
@@ -1,26 +1,25 @@
 #ifndef CSSGRAMMAR_H
 #define CSSGRAMMAR_H
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton interface for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton interface for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -31,10 +30,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -42,140 +42,80 @@
       know about them.  */
    enum yytokentype {
      TOKEN_EOF = 0,
-     UNIMPORTANT_TOK = 258,
-     WHITESPACE = 259,
-     SGML_CD = 260,
-     INCLUDES = 261,
-     DASHMATCH = 262,
-     BEGINSWITH = 263,
-     ENDSWITH = 264,
-     CONTAINS = 265,
-     STRING = 266,
-     IDENT = 267,
-     NTH = 268,
-     HEX = 269,
-     IDSEL = 270,
-     IMPORT_SYM = 271,
-     PAGE_SYM = 272,
-     MEDIA_SYM = 273,
-     FONT_FACE_SYM = 274,
-     CHARSET_SYM = 275,
-     NAMESPACE_SYM = 276,
-     WEBKIT_RULE_SYM = 277,
-     WEBKIT_DECLS_SYM = 278,
-     WEBKIT_KEYFRAME_RULE_SYM = 279,
-     WEBKIT_KEYFRAMES_SYM = 280,
-     WEBKIT_VALUE_SYM = 281,
-     WEBKIT_MEDIAQUERY_SYM = 282,
-     WEBKIT_SELECTOR_SYM = 283,
-     WEBKIT_VARIABLES_SYM = 284,
-     WEBKIT_DEFINE_SYM = 285,
-     VARIABLES_FOR = 286,
-     WEBKIT_VARIABLES_DECLS_SYM = 287,
-     ATKEYWORD = 288,
-     IMPORTANT_SYM = 289,
-     MEDIA_ONLY = 290,
-     MEDIA_NOT = 291,
-     MEDIA_AND = 292,
-     QEMS = 293,
-     EMS = 294,
-     EXS = 295,
-     PXS = 296,
-     CMS = 297,
-     MMS = 298,
-     INS = 299,
-     PTS = 300,
-     PCS = 301,
-     DEGS = 302,
-     RADS = 303,
-     GRADS = 304,
-     TURNS = 305,
-     MSECS = 306,
-     SECS = 307,
-     HERZ = 308,
-     KHERZ = 309,
-     DIMEN = 310,
-     PERCENTAGE = 311,
-     FLOATTOKEN = 312,
-     INTEGER = 313,
-     URI = 314,
-     FUNCTION = 315,
-     NOTFUNCTION = 316,
-     UNICODERANGE = 317,
-     VARCALL = 318
+     LOWEST_PREC = 258,
+     UNIMPORTANT_TOK = 259,
+     WHITESPACE = 260,
+     SGML_CD = 261,
+     INCLUDES = 262,
+     DASHMATCH = 263,
+     BEGINSWITH = 264,
+     ENDSWITH = 265,
+     CONTAINS = 266,
+     STRING = 267,
+     IDENT = 268,
+     NTH = 269,
+     HEX = 270,
+     IDSEL = 271,
+     IMPORT_SYM = 272,
+     PAGE_SYM = 273,
+     MEDIA_SYM = 274,
+     FONT_FACE_SYM = 275,
+     CHARSET_SYM = 276,
+     NAMESPACE_SYM = 277,
+     WEBKIT_RULE_SYM = 278,
+     WEBKIT_DECLS_SYM = 279,
+     WEBKIT_KEYFRAME_RULE_SYM = 280,
+     WEBKIT_KEYFRAMES_SYM = 281,
+     WEBKIT_VALUE_SYM = 282,
+     WEBKIT_MEDIAQUERY_SYM = 283,
+     WEBKIT_SELECTOR_SYM = 284,
+     WEBKIT_VARIABLES_SYM = 285,
+     WEBKIT_DEFINE_SYM = 286,
+     VARIABLES_FOR = 287,
+     WEBKIT_VARIABLES_DECLS_SYM = 288,
+     ATKEYWORD = 289,
+     IMPORTANT_SYM = 290,
+     MEDIA_ONLY = 291,
+     MEDIA_NOT = 292,
+     MEDIA_AND = 293,
+     QEMS = 294,
+     EMS = 295,
+     EXS = 296,
+     PXS = 297,
+     CMS = 298,
+     MMS = 299,
+     INS = 300,
+     PTS = 301,
+     PCS = 302,
+     DEGS = 303,
+     RADS = 304,
+     GRADS = 305,
+     TURNS = 306,
+     MSECS = 307,
+     SECS = 308,
+     HERZ = 309,
+     KHERZ = 310,
+     DIMEN = 311,
+     PERCENTAGE = 312,
+     FLOATTOKEN = 313,
+     INTEGER = 314,
+     URI = 315,
+     FUNCTION = 316,
+     NOTFUNCTION = 317,
+     UNICODERANGE = 318,
+     VARCALL = 319
    };
 #endif
-/* Tokens.  */
-#define TOKEN_EOF 0
-#define UNIMPORTANT_TOK 258
-#define WHITESPACE 259
-#define SGML_CD 260
-#define INCLUDES 261
-#define DASHMATCH 262
-#define BEGINSWITH 263
-#define ENDSWITH 264
-#define CONTAINS 265
-#define STRING 266
-#define IDENT 267
-#define NTH 268
-#define HEX 269
-#define IDSEL 270
-#define IMPORT_SYM 271
-#define PAGE_SYM 272
-#define MEDIA_SYM 273
-#define FONT_FACE_SYM 274
-#define CHARSET_SYM 275
-#define NAMESPACE_SYM 276
-#define WEBKIT_RULE_SYM 277
-#define WEBKIT_DECLS_SYM 278
-#define WEBKIT_KEYFRAME_RULE_SYM 279
-#define WEBKIT_KEYFRAMES_SYM 280
-#define WEBKIT_VALUE_SYM 281
-#define WEBKIT_MEDIAQUERY_SYM 282
-#define WEBKIT_SELECTOR_SYM 283
-#define WEBKIT_VARIABLES_SYM 284
-#define WEBKIT_DEFINE_SYM 285
-#define VARIABLES_FOR 286
-#define WEBKIT_VARIABLES_DECLS_SYM 287
-#define ATKEYWORD 288
-#define IMPORTANT_SYM 289
-#define MEDIA_ONLY 290
-#define MEDIA_NOT 291
-#define MEDIA_AND 292
-#define QEMS 293
-#define EMS 294
-#define EXS 295
-#define PXS 296
-#define CMS 297
-#define MMS 298
-#define INS 299
-#define PTS 300
-#define PCS 301
-#define DEGS 302
-#define RADS 303
-#define GRADS 304
-#define TURNS 305
-#define MSECS 306
-#define SECS 307
-#define HERZ 308
-#define KHERZ 309
-#define DIMEN 310
-#define PERCENTAGE 311
-#define FLOATTOKEN 312
-#define INTEGER 313
-#define URI 314
-#define FUNCTION 315
-#define NOTFUNCTION 316
-#define UNICODERANGE 317
-#define VARCALL 318
-
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 57 "../css/CSSGrammar.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 58 "../css/CSSGrammar.y"
+
     bool boolean;
     char character;
     int integer;
@@ -197,15 +137,18 @@ typedef union YYSTYPE
     WebKitCSSKeyframeRule* keyframeRule;
     WebKitCSSKeyframesRule* keyframesRule;
     float val;
-}
-/* Line 1489 of yacc.c.  */
-#line 201 "WebCore/tmp/../generated/CSSGrammar.tab.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 143 "WebCore/tmp/../generated/CSSGrammar.tab.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
 
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index 25313ac1dc..dc000542b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -37,7 +37,7 @@ struct props {
     const char* name;
     int id;
 };
-/* maximum key range = 1766, duplicates = 0 */
+/* maximum key range = 1603, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -51,32 +51,32 @@ hash_prop (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769,    0, 1769, 1769, 1769, 1769,
-      1769,    0, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769,    5,   20,    0,
-        10,    0,  325,  135,  210,    5,    0,    0,    0,   30,
-        10,    0,    0,   30,    0,   10,    0,  185,  170,   40,
-       355,  625,   45, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609,    0, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609,    5,    0,   75,
+         0,    0,  325,    5,  295,    0,    0,    0,  105,    0,
+         5,    0,   55,   20,    5,   25,    0,   50,   55,   15,
+       400,  295,  145, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609
     };
   register int hval = len;
 
@@ -226,664 +226,676 @@ findProp (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 270,
+      TOTAL_KEYWORDS = 269,
       MIN_WORD_LENGTH = 3,
       MAX_WORD_LENGTH = 43,
-      MIN_HASH_VALUE = 3,
-      MAX_HASH_VALUE = 1768
+      MIN_HASH_VALUE = 6,
+      MAX_HASH_VALUE = 1608
     };
 
   static const struct props wordlist_prop[] =
     {
-#line 132 "CSSPropertyNames.gperf"
-      {"top", CSSPropertyTop},
-#line 44 "CSSPropertyNames.gperf"
-      {"color", CSSPropertyColor},
-#line 43 "CSSPropertyNames.gperf"
-      {"clip", CSSPropertyClip},
-#line 42 "CSSPropertyNames.gperf"
-      {"clear", CSSPropertyClear},
-#line 109 "CSSPropertyNames.gperf"
-      {"src", CSSPropertySrc},
-#line 263 "CSSPropertyNames.gperf"
-      {"stroke", CSSPropertyStroke},
-#line 248 "CSSPropertyNames.gperf"
-      {"stop-color", CSSPropertyStopColor},
-#line 45 "CSSPropertyNames.gperf"
-      {"content", CSSPropertyContent},
+#line 40 "CSSPropertyNames.gperf"
+      {"bottom", CSSPropertyBottom},
 #line 18 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 97 "CSSPropertyNames.gperf"
-      {"position", CSSPropertyPosition},
-#line 49 "CSSPropertyNames.gperf"
-      {"direction", CSSPropertyDirection},
-#line 35 "CSSPropertyNames.gperf"
-      {"border-top", CSSPropertyBorderTop},
-#line 258 "CSSPropertyNames.gperf"
+#line 257 "CSSPropertyNames.gperf"
       {"marker", CSSPropertyMarker},
-#line 24 "CSSPropertyNames.gperf"
-      {"border-color", CSSPropertyBorderColor},
-#line 266 "CSSPropertyNames.gperf"
-      {"stroke-linecap", CSSPropertyStrokeLinecap},
-#line 36 "CSSPropertyNames.gperf"
-      {"border-top-color", CSSPropertyBorderTopColor},
-#line 242 "CSSPropertyNames.gperf"
-      {"mask", CSSPropertyMask},
-#line 250 "CSSPropertyNames.gperf"
-      {"color-interpolation", CSSPropertyColorInterpolation},
-#line 267 "CSSPropertyNames.gperf"
-      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
-#line 40 "CSSPropertyNames.gperf"
-      {"bottom", CSSPropertyBottom},
-#line 41 "CSSPropertyNames.gperf"
-      {"caption-side", CSSPropertyCaptionSide},
-#line 23 "CSSPropertyNames.gperf"
-      {"border-collapse", CSSPropertyBorderCollapse},
-#line 107 "CSSPropertyNames.gperf"
-      {"scrollbar-track-color", CSSPropertyScrollbarTrackColor},
-#line 261 "CSSPropertyNames.gperf"
-      {"marker-start", CSSPropertyMarkerStart},
-#line 108 "CSSPropertyNames.gperf"
-      {"size", CSSPropertySize},
+#line 19 "CSSPropertyNames.gperf"
+      {"border-bottom", CSSPropertyBorderBottom},
 #line 259 "CSSPropertyNames.gperf"
+      {"marker-mid", CSSPropertyMarkerMid},
+#line 68 "CSSPropertyNames.gperf"
+      {"margin", CSSPropertyMargin},
+#line 276 "CSSPropertyNames.gperf"
+      {"kerning", CSSPropertyKerning},
+#line 258 "CSSPropertyNames.gperf"
       {"marker-end", CSSPropertyMarkerEnd},
-#line 99 "CSSPropertyNames.gperf"
-      {"resize", CSSPropertyResize},
-#line 144 "CSSPropertyNames.gperf"
-      {"zoom", CSSPropertyZoom},
-#line 140 "CSSPropertyNames.gperf"
+#line 69 "CSSPropertyNames.gperf"
+      {"margin-bottom", CSSPropertyMarginBottom},
+#line 241 "CSSPropertyNames.gperf"
+      {"mask", CSSPropertyMask},
+#line 262 "CSSPropertyNames.gperf"
+      {"stroke", CSSPropertyStroke},
+#line 133 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
-#line 260 "CSSPropertyNames.gperf"
-      {"marker-mid", CSSPropertyMarkerMid},
-#line 19 "CSSPropertyNames.gperf"
-      {"border-bottom", CSSPropertyBorderBottom},
-#line 20 "CSSPropertyNames.gperf"
-      {"border-bottom-color", CSSPropertyBorderBottomColor},
-#line 102 "CSSPropertyNames.gperf"
-      {"scrollbar-arrow-color", CSSPropertyScrollbarArrowColor},
-#line 268 "CSSPropertyNames.gperf"
-      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 142 "CSSPropertyNames.gperf"
-      {"word-wrap", CSSPropertyWordWrap},
-#line 153 "CSSPropertyNames.gperf"
-      {"-webkit-appearance", CSSPropertyWebkitAppearance},
+#line 278 "CSSPropertyNames.gperf"
+      {"writing-mode", CSSPropertyWritingMode},
+#line 151 "CSSPropertyNames.gperf"
+      {"-webkit-binding", CSSPropertyWebkitBinding},
+#line 256 "CSSPropertyNames.gperf"
+      {"image-rendering", CSSPropertyImageRendering},
 #line 138 "CSSPropertyNames.gperf"
-      {"widows", CSSPropertyWidows},
-#line 204 "CSSPropertyNames.gperf"
+      {"-webkit-animation", CSSPropertyWebkitAnimation},
+#line 156 "CSSPropertyNames.gperf"
+      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
+#line 197 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
-#line 192 "CSSPropertyNames.gperf"
-      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 231 "CSSPropertyNames.gperf"
-      {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 207 "CSSPropertyNames.gperf"
-      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
-#line 193 "CSSPropertyNames.gperf"
-      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 214 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
-#line 274 "CSSPropertyNames.gperf"
-      {"dominant-baseline", CSSPropertyDominantBaseline},
+#line 125 "CSSPropertyNames.gperf"
+      {"top", CSSPropertyTop},
+#line 131 "CSSPropertyNames.gperf"
+      {"widows", CSSPropertyWidows},
+#line 260 "CSSPropertyNames.gperf"
+      {"marker-start", CSSPropertyMarkerStart},
+#line 143 "CSSPropertyNames.gperf"
+      {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
 #line 92 "CSSPropertyNames.gperf"
       {"page", CSSPropertyPage},
-#line 145 "CSSPropertyNames.gperf"
-      {"-webkit-animation", CSSPropertyWebkitAnimation},
-#line 211 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 217 "CSSPropertyNames.gperf"
-      {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
-#line 277 "CSSPropertyNames.gperf"
-      {"kerning", CSSPropertyKerning},
-#line 208 "CSSPropertyNames.gperf"
-      {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 62 "CSSPropertyNames.gperf"
-      {"letter-spacing", CSSPropertyLetterSpacing},
+#line 202 "CSSPropertyNames.gperf"
+      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
+#line 35 "CSSPropertyNames.gperf"
+      {"border-top", CSSPropertyBorderTop},
 #line 87 "CSSPropertyNames.gperf"
       {"padding", CSSPropertyPadding},
-#line 253 "CSSPropertyNames.gperf"
-      {"color-rendering", CSSPropertyColorRendering},
+#line 230 "CSSPropertyNames.gperf"
+      {"-webkit-transition", CSSPropertyWebkitTransition},
+#line 203 "CSSPropertyNames.gperf"
+      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
+#line 88 "CSSPropertyNames.gperf"
+      {"padding-bottom", CSSPropertyPaddingBottom},
+#line 72 "CSSPropertyNames.gperf"
+      {"margin-top", CSSPropertyMarginTop},
+#line 189 "CSSPropertyNames.gperf"
+      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
+#line 45 "CSSPropertyNames.gperf"
+      {"content", CSSPropertyContent},
+#line 97 "CSSPropertyNames.gperf"
+      {"position", CSSPropertyPosition},
+#line 49 "CSSPropertyNames.gperf"
+      {"direction", CSSPropertyDirection},
+#line 98 "CSSPropertyNames.gperf"
+      {"quotes", CSSPropertyQuotes},
+#line 102 "CSSPropertyNames.gperf"
+      {"src", CSSPropertySrc},
+#line 135 "CSSPropertyNames.gperf"
+      {"word-wrap", CSSPropertyWordWrap},
+#line 191 "CSSPropertyNames.gperf"
+      {"-webkit-marquee", CSSPropertyWebkitMarquee},
+#line 210 "CSSPropertyNames.gperf"
+      {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
+#line 95 "CSSPropertyNames.gperf"
+      {"page-break-inside", CSSPropertyPageBreakInside},
+#line 141 "CSSPropertyNames.gperf"
+      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
+#line 235 "CSSPropertyNames.gperf"
+      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
+#line 207 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
+#line 157 "CSSPropertyNames.gperf"
+      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
 #line 91 "CSSPropertyNames.gperf"
       {"padding-top", CSSPropertyPaddingTop},
-#line 215 "CSSPropertyNames.gperf"
-      {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
-#line 68 "CSSPropertyNames.gperf"
-      {"margin", CSSPropertyMargin},
-#line 147 "CSSPropertyNames.gperf"
+#line 211 "CSSPropertyNames.gperf"
+      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
+#line 126 "CSSPropertyNames.gperf"
+      {"unicode-bidi", CSSPropertyUnicodeBidi},
+#line 140 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 72 "CSSPropertyNames.gperf"
-      {"margin-top", CSSPropertyMarginTop},
-#line 241 "CSSPropertyNames.gperf"
-      {"clip-rule", CSSPropertyClipRule},
+#line 137 "CSSPropertyNames.gperf"
+      {"zoom", CSSPropertyZoom},
+#line 204 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
+#line 232 "CSSPropertyNames.gperf"
+      {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
+#line 185 "CSSPropertyNames.gperf"
+      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
+#line 10 "CSSPropertyNames.gperf"
+      {"background", CSSPropertyBackground},
+#line 267 "CSSPropertyNames.gperf"
+      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
+#line 266 "CSSPropertyNames.gperf"
+      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
+#line 127 "CSSPropertyNames.gperf"
+      {"unicode-range", CSSPropertyUnicodeRange},
+#line 96 "CSSPropertyNames.gperf"
+      {"pointer-events", CSSPropertyPointerEvents},
+#line 216 "CSSPropertyNames.gperf"
+      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
 #line 48 "CSSPropertyNames.gperf"
       {"cursor", CSSPropertyCursor},
-#line 150 "CSSPropertyNames.gperf"
-      {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
 #line 79 "CSSPropertyNames.gperf"
       {"outline", CSSPropertyOutline},
-#line 33 "CSSPropertyNames.gperf"
-      {"border-spacing", CSSPropertyBorderSpacing},
-#line 80 "CSSPropertyNames.gperf"
-      {"outline-color", CSSPropertyOutlineColor},
+#line 13 "CSSPropertyNames.gperf"
+      {"background-image", CSSPropertyBackgroundImage},
+#line 273 "CSSPropertyNames.gperf"
+      {"dominant-baseline", CSSPropertyDominantBaseline},
+#line 101 "CSSPropertyNames.gperf"
+      {"size", CSSPropertySize},
+#line 41 "CSSPropertyNames.gperf"
+      {"caption-side", CSSPropertyCaptionSide},
 #line 47 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 96 "CSSPropertyNames.gperf"
-      {"pointer-events", CSSPropertyPointerEvents},
-#line 95 "CSSPropertyNames.gperf"
-      {"page-break-inside", CSSPropertyPageBreakInside},
-#line 141 "CSSPropertyNames.gperf"
+#line 99 "CSSPropertyNames.gperf"
+      {"resize", CSSPropertyResize},
+#line 194 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
+#line 44 "CSSPropertyNames.gperf"
+      {"color", CSSPropertyColor},
+#line 33 "CSSPropertyNames.gperf"
+      {"border-spacing", CSSPropertyBorderSpacing},
+#line 42 "CSSPropertyNames.gperf"
+      {"clear", CSSPropertyClear},
+#line 195 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
+#line 149 "CSSPropertyNames.gperf"
+      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
+#line 134 "CSSPropertyNames.gperf"
       {"word-spacing", CSSPropertyWordSpacing},
-#line 240 "CSSPropertyNames.gperf"
-      {"clip-path", CSSPropertyClipPath},
-#line 98 "CSSPropertyNames.gperf"
-      {"quotes", CSSPropertyQuotes},
-#line 88 "CSSPropertyNames.gperf"
-      {"padding-bottom", CSSPropertyPaddingBottom},
-#line 78 "CSSPropertyNames.gperf"
-      {"orphans", CSSPropertyOrphans},
-#line 219 "CSSPropertyNames.gperf"
-      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
-#line 279 "CSSPropertyNames.gperf"
-      {"writing-mode", CSSPropertyWritingMode},
-#line 69 "CSSPropertyNames.gperf"
-      {"margin-bottom", CSSPropertyMarginBottom},
-#line 133 "CSSPropertyNames.gperf"
-      {"unicode-bidi", CSSPropertyUnicodeBidi},
-#line 272 "CSSPropertyNames.gperf"
-      {"alignment-baseline", CSSPropertyAlignmentBaseline},
+#line 192 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
+#line 24 "CSSPropertyNames.gperf"
+      {"border-color", CSSPropertyBorderColor},
+#line 193 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
+#line 142 "CSSPropertyNames.gperf"
+      {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
+#line 20 "CSSPropertyNames.gperf"
+      {"border-bottom-color", CSSPropertyBorderBottomColor},
+#line 201 "CSSPropertyNames.gperf"
+      {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
+#line 252 "CSSPropertyNames.gperf"
+      {"color-rendering", CSSPropertyColorRendering},
+#line 17 "CSSPropertyNames.gperf"
+      {"background-repeat", CSSPropertyBackgroundRepeat},
+#line 208 "CSSPropertyNames.gperf"
+      {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
+#line 43 "CSSPropertyNames.gperf"
+      {"clip", CSSPropertyClip},
 #line 46 "CSSPropertyNames.gperf"
       {"counter-increment", CSSPropertyCounterIncrement},
-#line 139 "CSSPropertyNames.gperf"
+#line 145 "CSSPropertyNames.gperf"
+      {"-webkit-appearance", CSSPropertyWebkitAppearance},
+#line 14 "CSSPropertyNames.gperf"
+      {"background-position", CSSPropertyBackgroundPosition},
+#line 36 "CSSPropertyNames.gperf"
+      {"border-top-color", CSSPropertyBorderTopColor},
+#line 247 "CSSPropertyNames.gperf"
+      {"stop-color", CSSPropertyStopColor},
+#line 242 "CSSPropertyNames.gperf"
+      {"enable-background", CSSPropertyEnableBackground},
+#line 271 "CSSPropertyNames.gperf"
+      {"alignment-baseline", CSSPropertyAlignmentBaseline},
+#line 265 "CSSPropertyNames.gperf"
+      {"stroke-linecap", CSSPropertyStrokeLinecap},
+#line 182 "CSSPropertyNames.gperf"
+      {"-webkit-columns", CSSPropertyWebkitColumns},
+#line 62 "CSSPropertyNames.gperf"
+      {"letter-spacing", CSSPropertyLetterSpacing},
+#line 200 "CSSPropertyNames.gperf"
+      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
+#line 212 "CSSPropertyNames.gperf"
+      {"-webkit-perspective", CSSPropertyWebkitPerspective},
+#line 100 "CSSPropertyNames.gperf"
+      {"right", CSSPropertyRight},
+#line 132 "CSSPropertyNames.gperf"
       {"width", CSSPropertyWidth},
-#line 158 "CSSPropertyNames.gperf"
-      {"-webkit-binding", CSSPropertyWebkitBinding},
-#line 218 "CSSPropertyNames.gperf"
-      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
-#line 137 "CSSPropertyNames.gperf"
-      {"white-space", CSSPropertyWhiteSpace},
-#line 210 "CSSPropertyNames.gperf"
-      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
-#line 196 "CSSPropertyNames.gperf"
-      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
-#line 270 "CSSPropertyNames.gperf"
-      {"stroke-width", CSSPropertyStrokeWidth},
-#line 195 "CSSPropertyNames.gperf"
-      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
-#line 238 "CSSPropertyNames.gperf"
+#line 174 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
+#line 237 "CSSPropertyNames.gperf"
       {"-webkit-user-select", CSSPropertyWebkitUserSelect},
-#line 163 "CSSPropertyNames.gperf"
-      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 197 "CSSPropertyNames.gperf"
-      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
-#line 209 "CSSPropertyNames.gperf"
-      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
-#line 39 "CSSPropertyNames.gperf"
-      {"border-width", CSSPropertyBorderWidth},
-#line 38 "CSSPropertyNames.gperf"
-      {"border-top-width", CSSPropertyBorderTopWidth},
-#line 189 "CSSPropertyNames.gperf"
-      {"-webkit-columns", CSSPropertyWebkitColumns},
 #line 76 "CSSPropertyNames.gperf"
       {"min-width", CSSPropertyMinWidth},
-#line 61 "CSSPropertyNames.gperf"
-      {"left", CSSPropertyLeft},
-#line 198 "CSSPropertyNames.gperf"
-      {"-webkit-marquee", CSSPropertyWebkitMarquee},
-#line 164 "CSSPropertyNames.gperf"
-      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 106 "CSSPropertyNames.gperf"
-      {"scrollbar-shadow-color", CSSPropertyScrollbarShadowColor},
-#line 254 "CSSPropertyNames.gperf"
-      {"fill", CSSPropertyFill},
-#line 52 "CSSPropertyNames.gperf"
-      {"float", CSSPropertyFloat},
-#line 244 "CSSPropertyNames.gperf"
-      {"filter", CSSPropertyFilter},
+#line 213 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
+#line 29 "CSSPropertyNames.gperf"
+      {"border-right", CSSPropertyBorderRight},
+#line 39 "CSSPropertyNames.gperf"
+      {"border-width", CSSPropertyBorderWidth},
+#line 176 "CSSPropertyNames.gperf"
+      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
 #line 53 "CSSPropertyNames.gperf"
       {"font", CSSPropertyFont},
-#line 252 "CSSPropertyNames.gperf"
-      {"color-profile", CSSPropertyColorProfile},
-#line 194 "CSSPropertyNames.gperf"
-      {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
-#line 245 "CSSPropertyNames.gperf"
-      {"flood-color", CSSPropertyFloodColor},
-#line 135 "CSSPropertyNames.gperf"
-      {"vertical-align", CSSPropertyVerticalAlign},
-#line 103 "CSSPropertyNames.gperf"
-      {"scrollbar-darkshadow-color", CSSPropertyScrollbarDarkshadowColor},
-#line 233 "CSSPropertyNames.gperf"
-      {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
-#line 100 "CSSPropertyNames.gperf"
-      {"right", CSSPropertyRight},
-#line 202 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 239 "CSSPropertyNames.gperf"
-      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 257 "CSSPropertyNames.gperf"
-      {"image-rendering", CSSPropertyImageRendering},
-#line 201 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
+#line 71 "CSSPropertyNames.gperf"
+      {"margin-right", CSSPropertyMarginRight},
 #line 22 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 25 "CSSPropertyNames.gperf"
-      {"border-left", CSSPropertyBorderLeft},
-#line 199 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
-#line 26 "CSSPropertyNames.gperf"
-      {"border-left-color", CSSPropertyBorderLeftColor},
-#line 134 "CSSPropertyNames.gperf"
-      {"unicode-range", CSSPropertyUnicodeRange},
-#line 10 "CSSPropertyNames.gperf"
-      {"background", CSSPropertyBackground},
 #line 148 "CSSPropertyNames.gperf"
-      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
+      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
 #line 12 "CSSPropertyNames.gperf"
       {"background-color", CSSPropertyBackgroundColor},
-#line 181 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
-#line 104 "CSSPropertyNames.gperf"
-      {"scrollbar-face-color", CSSPropertyScrollbarFaceColor},
-#line 17 "CSSPropertyNames.gperf"
-      {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 149 "CSSPropertyNames.gperf"
-      {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
-#line 29 "CSSPropertyNames.gperf"
-      {"border-right", CSSPropertyBorderRight},
-#line 205 "CSSPropertyNames.gperf"
-      {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
-#line 200 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
-#line 30 "CSSPropertyNames.gperf"
-      {"border-right-color", CSSPropertyBorderRightColor},
-#line 112 "CSSPropertyNames.gperf"
-      {"text-decoration", CSSPropertyTextDecoration},
-#line 113 "CSSPropertyNames.gperf"
-      {"text-indent", CSSPropertyTextIndent},
-#line 251 "CSSPropertyNames.gperf"
-      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
-#line 55 "CSSPropertyNames.gperf"
-      {"font-size", CSSPropertyFontSize},
-#line 262 "CSSPropertyNames.gperf"
-      {"shape-rendering", CSSPropertyShapeRendering},
-#line 14 "CSSPropertyNames.gperf"
-      {"background-position", CSSPropertyBackgroundPosition},
-#line 243 "CSSPropertyNames.gperf"
-      {"enable-background", CSSPropertyEnableBackground},
-#line 101 "CSSPropertyNames.gperf"
-      {"scrollbar-3dlight-color", CSSPropertyScrollbar3dlightColor},
-#line 236 "CSSPropertyNames.gperf"
-      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
-#line 143 "CSSPropertyNames.gperf"
-      {"z-index", CSSPropertyZIndex},
-#line 161 "CSSPropertyNames.gperf"
-      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
-#line 183 "CSSPropertyNames.gperf"
-      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 224 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
-#line 225 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
+#line 269 "CSSPropertyNames.gperf"
+      {"stroke-width", CSSPropertyStrokeWidth},
+#line 150 "CSSPropertyNames.gperf"
+      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
+#line 80 "CSSPropertyNames.gperf"
+      {"outline-color", CSSPropertyOutlineColor},
 #line 154 "CSSPropertyNames.gperf"
-      {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
+      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
+#line 128 "CSSPropertyNames.gperf"
+      {"vertical-align", CSSPropertyVerticalAlign},
+#line 186 "CSSPropertyNames.gperf"
+      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
+#line 249 "CSSPropertyNames.gperf"
+      {"color-interpolation", CSSPropertyColorInterpolation},
+#line 90 "CSSPropertyNames.gperf"
+      {"padding-right", CSSPropertyPaddingRight},
+#line 38 "CSSPropertyNames.gperf"
+      {"border-top-width", CSSPropertyBorderTopWidth},
+#line 23 "CSSPropertyNames.gperf"
+      {"border-collapse", CSSPropertyBorderCollapse},
+#line 78 "CSSPropertyNames.gperf"
+      {"orphans", CSSPropertyOrphans},
 #line 175 "CSSPropertyNames.gperf"
-      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
-#line 227 "CSSPropertyNames.gperf"
+      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
+#line 224 "CSSPropertyNames.gperf"
       {"-webkit-transform", CSSPropertyWebkitTransform},
+#line 240 "CSSPropertyNames.gperf"
+      {"clip-rule", CSSPropertyClipRule},
+#line 58 "CSSPropertyNames.gperf"
+      {"font-variant", CSSPropertyFontVariant},
+#line 147 "CSSPropertyNames.gperf"
+      {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
+#line 261 "CSSPropertyNames.gperf"
+      {"shape-rendering", CSSPropertyShapeRendering},
+#line 106 "CSSPropertyNames.gperf"
+      {"text-indent", CSSPropertyTextIndent},
+#line 94 "CSSPropertyNames.gperf"
+      {"page-break-before", CSSPropertyPageBreakBefore},
+#line 225 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
+#line 93 "CSSPropertyNames.gperf"
+      {"page-break-after", CSSPropertyPageBreakAfter},
+#line 188 "CSSPropertyNames.gperf"
+      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
+#line 177 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
+#line 61 "CSSPropertyNames.gperf"
+      {"left", CSSPropertyLeft},
+#line 187 "CSSPropertyNames.gperf"
+      {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
+#line 77 "CSSPropertyNames.gperf"
+      {"opacity", CSSPropertyOpacity},
+#line 270 "CSSPropertyNames.gperf"
+      {"text-rendering", CSSPropertyTextRendering},
+#line 52 "CSSPropertyNames.gperf"
+      {"float", CSSPropertyFloat},
+#line 243 "CSSPropertyNames.gperf"
+      {"filter", CSSPropertyFilter},
 #line 167 "CSSPropertyNames.gperf"
-      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 174 "CSSPropertyNames.gperf"
       {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
+#line 34 "CSSPropertyNames.gperf"
+      {"border-style", CSSPropertyBorderStyle},
+#line 206 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
+#line 153 "CSSPropertyNames.gperf"
+      {"-webkit-border-bottom-right-radius", CSSPropertyWebkitBorderBottomRightRadius},
+#line 25 "CSSPropertyNames.gperf"
+      {"border-left", CSSPropertyBorderLeft},
+#line 198 "CSSPropertyNames.gperf"
+      {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
+#line 21 "CSSPropertyNames.gperf"
+      {"border-bottom-style", CSSPropertyBorderBottomStyle},
+#line 70 "CSSPropertyNames.gperf"
+      {"margin-left", CSSPropertyMarginLeft},
+#line 139 "CSSPropertyNames.gperf"
+      {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
+#line 221 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
+#line 160 "CSSPropertyNames.gperf"
+      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
+#line 268 "CSSPropertyNames.gperf"
+      {"stroke-opacity", CSSPropertyStrokeOpacity},
+#line 199 "CSSPropertyNames.gperf"
+      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
+#line 130 "CSSPropertyNames.gperf"
+      {"white-space", CSSPropertyWhiteSpace},
 #line 83 "CSSPropertyNames.gperf"
       {"outline-width", CSSPropertyOutlineWidth},
-#line 172 "CSSPropertyNames.gperf"
-      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
-#line 169 "CSSPropertyNames.gperf"
-      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
-#line 184 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
 #line 190 "CSSPropertyNames.gperf"
-      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
-#line 185 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 155 "CSSPropertyNames.gperf"
-      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 182 "CSSPropertyNames.gperf"
-      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
-#line 93 "CSSPropertyNames.gperf"
-      {"page-break-after", CSSPropertyPageBreakAfter},
+      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
+#line 231 "CSSPropertyNames.gperf"
+      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
+#line 129 "CSSPropertyNames.gperf"
+      {"visibility", CSSPropertyVisibility},
+#line 50 "CSSPropertyNames.gperf"
+      {"display", CSSPropertyDisplay},
+#line 159 "CSSPropertyNames.gperf"
+      {"-webkit-border-top-right-radius", CSSPropertyWebkitBorderTopRightRadius},
+#line 233 "CSSPropertyNames.gperf"
+      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
+#line 105 "CSSPropertyNames.gperf"
+      {"text-decoration", CSSPropertyTextDecoration},
+#line 37 "CSSPropertyNames.gperf"
+      {"border-top-style", CSSPropertyBorderTopStyle},
+#line 55 "CSSPropertyNames.gperf"
+      {"font-size", CSSPropertyFontSize},
 #line 89 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
-#line 157 "CSSPropertyNames.gperf"
-      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
-#line 247 "CSSPropertyNames.gperf"
-      {"lighting-color", CSSPropertyLightingColor},
-#line 212 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
-#line 111 "CSSPropertyNames.gperf"
-      {"text-align", CSSPropertyTextAlign},
-#line 70 "CSSPropertyNames.gperf"
-      {"margin-left", CSSPropertyMarginLeft},
-#line 256 "CSSPropertyNames.gperf"
-      {"fill-rule", CSSPropertyFillRule},
-#line 94 "CSSPropertyNames.gperf"
-      {"page-break-before", CSSPropertyPageBreakBefore},
-#line 90 "CSSPropertyNames.gperf"
-      {"padding-right", CSSPropertyPaddingRight},
-#line 271 "CSSPropertyNames.gperf"
-      {"text-rendering", CSSPropertyTextRendering},
-#line 58 "CSSPropertyNames.gperf"
-      {"font-variant", CSSPropertyFontVariant},
 #line 84 "CSSPropertyNames.gperf"
       {"overflow", CSSPropertyOverflow},
-#line 71 "CSSPropertyNames.gperf"
-      {"margin-right", CSSPropertyMarginRight},
-#line 120 "CSSPropertyNames.gperf"
-      {"text-overline", CSSPropertyTextOverline},
-#line 13 "CSSPropertyNames.gperf"
-      {"background-image", CSSPropertyBackgroundImage},
-#line 121 "CSSPropertyNames.gperf"
-      {"text-overline-color", CSSPropertyTextOverlineColor},
-#line 60 "CSSPropertyNames.gperf"
-      {"height", CSSPropertyHeight},
-#line 56 "CSSPropertyNames.gperf"
-      {"font-stretch", CSSPropertyFontStretch},
+#line 30 "CSSPropertyNames.gperf"
+      {"border-right-color", CSSPropertyBorderRightColor},
 #line 162 "CSSPropertyNames.gperf"
-      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 188 "CSSPropertyNames.gperf"
-      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
-#line 63 "CSSPropertyNames.gperf"
-      {"line-height", CSSPropertyLineHeight},
-#line 127 "CSSPropertyNames.gperf"
-      {"text-underline", CSSPropertyTextUnderline},
-#line 278 "CSSPropertyNames.gperf"
-      {"text-anchor", CSSPropertyTextAnchor},
-#line 128 "CSSPropertyNames.gperf"
-      {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 122 "CSSPropertyNames.gperf"
-      {"text-overline-mode", CSSPropertyTextOverlineMode},
-#line 156 "CSSPropertyNames.gperf"
-      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
-#line 168 "CSSPropertyNames.gperf"
-      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 273 "CSSPropertyNames.gperf"
-      {"baseline-shift", CSSPropertyBaselineShift},
-#line 75 "CSSPropertyNames.gperf"
-      {"min-height", CSSPropertyMinHeight},
-#line 228 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
-#line 129 "CSSPropertyNames.gperf"
-      {"text-underline-mode", CSSPropertyTextUnderlineMode},
-#line 28 "CSSPropertyNames.gperf"
-      {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 125 "CSSPropertyNames.gperf"
-      {"text-shadow", CSSPropertyTextShadow},
-#line 77 "CSSPropertyNames.gperf"
-      {"opacity", CSSPropertyOpacity},
+      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
+#line 248 "CSSPropertyNames.gperf"
+      {"stop-opacity", CSSPropertyStopOpacity},
+#line 104 "CSSPropertyNames.gperf"
+      {"text-align", CSSPropertyTextAlign},
+#line 144 "CSSPropertyNames.gperf"
+      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
+#line 253 "CSSPropertyNames.gperf"
+      {"fill", CSSPropertyFill},
+#line 196 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
+#line 16 "CSSPropertyNames.gperf"
+      {"background-position-y", CSSPropertyBackgroundPositionY},
 #line 11 "CSSPropertyNames.gperf"
       {"background-attachment", CSSPropertyBackgroundAttachment},
-#line 216 "CSSPropertyNames.gperf"
-      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 249 "CSSPropertyNames.gperf"
-      {"stop-opacity", CSSPropertyStopOpacity},
-#line 269 "CSSPropertyNames.gperf"
-      {"stroke-opacity", CSSPropertyStrokeOpacity},
+#line 161 "CSSPropertyNames.gperf"
+      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
+#line 205 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
+#line 136 "CSSPropertyNames.gperf"
+      {"z-index", CSSPropertyZIndex},
+#line 234 "CSSPropertyNames.gperf"
+      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
 #line 64 "CSSPropertyNames.gperf"
       {"list-style", CSSPropertyListStyle},
-#line 50 "CSSPropertyNames.gperf"
-      {"display", CSSPropertyDisplay},
-#line 32 "CSSPropertyNames.gperf"
-      {"border-right-width", CSSPropertyBorderRightWidth},
-#line 74 "CSSPropertyNames.gperf"
-      {"max-width", CSSPropertyMaxWidth},
+#line 168 "CSSPropertyNames.gperf"
+      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
 #line 165 "CSSPropertyNames.gperf"
-      {"-webkit-border-top-left-radius", CSSPropertyWebkitBorderTopLeftRadius},
-#line 178 "CSSPropertyNames.gperf"
+      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
+#line 228 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
+#line 152 "CSSPropertyNames.gperf"
+      {"-webkit-border-bottom-left-radius", CSSPropertyWebkitBorderBottomLeftRadius},
+#line 103 "CSSPropertyNames.gperf"
+      {"table-layout", CSSPropertyTableLayout},
+#line 181 "CSSPropertyNames.gperf"
+      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
+#line 65 "CSSPropertyNames.gperf"
+      {"list-style-image", CSSPropertyListStyleImage},
+#line 113 "CSSPropertyNames.gperf"
+      {"text-overline", CSSPropertyTextOverline},
+#line 120 "CSSPropertyNames.gperf"
+      {"text-underline", CSSPropertyTextUnderline},
+#line 115 "CSSPropertyNames.gperf"
+      {"text-overline-mode", CSSPropertyTextOverlineMode},
+#line 122 "CSSPropertyNames.gperf"
+      {"text-underline-mode", CSSPropertyTextUnderlineMode},
+#line 82 "CSSPropertyNames.gperf"
+      {"outline-style", CSSPropertyOutlineStyle},
+#line 239 "CSSPropertyNames.gperf"
+      {"clip-path", CSSPropertyClipPath},
+#line 60 "CSSPropertyNames.gperf"
+      {"height", CSSPropertyHeight},
+#line 238 "CSSPropertyNames.gperf"
+      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
+#line 75 "CSSPropertyNames.gperf"
+      {"min-height", CSSPropertyMinHeight},
+#line 171 "CSSPropertyNames.gperf"
       {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
-#line 179 "CSSPropertyNames.gperf"
+#line 246 "CSSPropertyNames.gperf"
+      {"lighting-color", CSSPropertyLightingColor},
+#line 173 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
+#line 178 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
+#line 172 "CSSPropertyNames.gperf"
       {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
+#line 215 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
+#line 158 "CSSPropertyNames.gperf"
+      {"-webkit-border-top-left-radius", CSSPropertyWebkitBorderTopLeftRadius},
+#line 244 "CSSPropertyNames.gperf"
+      {"flood-color", CSSPropertyFloodColor},
+#line 26 "CSSPropertyNames.gperf"
+      {"border-left-color", CSSPropertyBorderLeftColor},
+#line 32 "CSSPropertyNames.gperf"
+      {"border-right-width", CSSPropertyBorderRightWidth},
+#line 183 "CSSPropertyNames.gperf"
+      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
+#line 15 "CSSPropertyNames.gperf"
+      {"background-position-x", CSSPropertyBackgroundPositionX},
+#line 222 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
+#line 59 "CSSPropertyNames.gperf"
+      {"font-weight", CSSPropertyFontWeight},
+#line 66 "CSSPropertyNames.gperf"
+      {"list-style-position", CSSPropertyListStylePosition},
 #line 51 "CSSPropertyNames.gperf"
       {"empty-cells", CSSPropertyEmptyCells},
-#line 34 "CSSPropertyNames.gperf"
-      {"border-style", CSSPropertyBorderStyle},
-#line 37 "CSSPropertyNames.gperf"
-      {"border-top-style", CSSPropertyBorderTopStyle},
-#line 206 "CSSPropertyNames.gperf"
-      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 180 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
 #line 166 "CSSPropertyNames.gperf"
-      {"-webkit-border-top-right-radius", CSSPropertyWebkitBorderTopRightRadius},
-#line 66 "CSSPropertyNames.gperf"
-      {"list-style-position", CSSPropertyListStylePosition},
-#line 223 "CSSPropertyNames.gperf"
+      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
+#line 263 "CSSPropertyNames.gperf"
+      {"stroke-dasharray", CSSPropertyStrokeDasharray},
+#line 251 "CSSPropertyNames.gperf"
+      {"color-profile", CSSPropertyColorProfile},
+#line 220 "CSSPropertyNames.gperf"
       {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 159 "CSSPropertyNames.gperf"
-      {"-webkit-border-bottom-left-radius", CSSPropertyWebkitBorderBottomLeftRadius},
-#line 226 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
-#line 177 "CSSPropertyNames.gperf"
+#line 255 "CSSPropertyNames.gperf"
+      {"fill-rule", CSSPropertyFillRule},
+#line 63 "CSSPropertyNames.gperf"
+      {"line-height", CSSPropertyLineHeight},
+#line 227 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
+#line 74 "CSSPropertyNames.gperf"
+      {"max-width", CSSPropertyMaxWidth},
+#line 214 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
+#line 236 "CSSPropertyNames.gperf"
+      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
+#line 56 "CSSPropertyNames.gperf"
+      {"font-stretch", CSSPropertyFontStretch},
+#line 180 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
+#line 118 "CSSPropertyNames.gperf"
+      {"text-shadow", CSSPropertyTextShadow},
+#line 31 "CSSPropertyNames.gperf"
+      {"border-right-style", CSSPropertyBorderRightStyle},
+#line 57 "CSSPropertyNames.gperf"
+      {"font-style", CSSPropertyFontStyle},
+#line 28 "CSSPropertyNames.gperf"
+      {"border-left-width", CSSPropertyBorderLeftWidth},
+#line 170 "CSSPropertyNames.gperf"
       {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
-#line 21 "CSSPropertyNames.gperf"
-      {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 59 "CSSPropertyNames.gperf"
-      {"font-weight", CSSPropertyFontWeight},
-#line 160 "CSSPropertyNames.gperf"
-      {"-webkit-border-bottom-right-radius", CSSPropertyWebkitBorderBottomRightRadius},
-#line 126 "CSSPropertyNames.gperf"
+#line 114 "CSSPropertyNames.gperf"
+      {"text-overline-color", CSSPropertyTextOverlineColor},
+#line 121 "CSSPropertyNames.gperf"
+      {"text-underline-color", CSSPropertyTextUnderlineColor},
+#line 223 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
+#line 119 "CSSPropertyNames.gperf"
       {"text-transform", CSSPropertyTextTransform},
-#line 234 "CSSPropertyNames.gperf"
-      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
-#line 187 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
-#line 15 "CSSPropertyNames.gperf"
-      {"background-position-x", CSSPropertyBackgroundPositionX},
-#line 221 "CSSPropertyNames.gperf"
-      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
-#line 232 "CSSPropertyNames.gperf"
-      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
-#line 176 "CSSPropertyNames.gperf"
-      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 213 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
-#line 146 "CSSPropertyNames.gperf"
-      {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 151 "CSSPropertyNames.gperf"
-      {"-webkit-animation-play-state", CSSPropertyWebkitAnimationPlayState},
-#line 173 "CSSPropertyNames.gperf"
-      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 124 "CSSPropertyNames.gperf"
-      {"text-overline-width", CSSPropertyTextOverlineWidth},
-#line 65 "CSSPropertyNames.gperf"
-      {"list-style-image", CSSPropertyListStyleImage},
-#line 82 "CSSPropertyNames.gperf"
-      {"outline-style", CSSPropertyOutlineStyle},
-#line 110 "CSSPropertyNames.gperf"
-      {"table-layout", CSSPropertyTableLayout},
-#line 136 "CSSPropertyNames.gperf"
-      {"visibility", CSSPropertyVisibility},
-#line 131 "CSSPropertyNames.gperf"
-      {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 235 "CSSPropertyNames.gperf"
-      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
+#line 155 "CSSPropertyNames.gperf"
+      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
+#line 277 "CSSPropertyNames.gperf"
+      {"text-anchor", CSSPropertyTextAnchor},
+#line 272 "CSSPropertyNames.gperf"
+      {"baseline-shift", CSSPropertyBaselineShift},
+#line 86 "CSSPropertyNames.gperf"
+      {"overflow-y", CSSPropertyOverflowY},
+#line 226 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
+#line 229 "CSSPropertyNames.gperf"
+      {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
 #line 81 "CSSPropertyNames.gperf"
       {"outline-offset", CSSPropertyOutlineOffset},
-#line 152 "CSSPropertyNames.gperf"
-      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
-#line 264 "CSSPropertyNames.gperf"
-      {"stroke-dasharray", CSSPropertyStrokeDasharray},
+#line 250 "CSSPropertyNames.gperf"
+      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
+#line 179 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
+#line 245 "CSSPropertyNames.gperf"
+      {"flood-opacity", CSSPropertyFloodOpacity},
+#line 27 "CSSPropertyNames.gperf"
+      {"border-left-style", CSSPropertyBorderLeftStyle},
+#line 219 "CSSPropertyNames.gperf"
+      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
+#line 117 "CSSPropertyNames.gperf"
+      {"text-overline-width", CSSPropertyTextOverlineWidth},
+#line 124 "CSSPropertyNames.gperf"
+      {"text-underline-width", CSSPropertyTextUnderlineWidth},
 #line 85 "CSSPropertyNames.gperf"
       {"overflow-x", CSSPropertyOverflowX},
-#line 119 "CSSPropertyNames.gperf"
+#line 112 "CSSPropertyNames.gperf"
       {"text-overflow", CSSPropertyTextOverflow},
-#line 265 "CSSPropertyNames.gperf"
-      {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
+#line 67 "CSSPropertyNames.gperf"
+      {"list-style-type", CSSPropertyListStyleType},
+#line 169 "CSSPropertyNames.gperf"
+      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
+#line 254 "CSSPropertyNames.gperf"
+      {"fill-opacity", CSSPropertyFillOpacity},
+#line 146 "CSSPropertyNames.gperf"
+      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
 #line 73 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 105 "CSSPropertyNames.gperf"
-      {"scrollbar-highlight-color", CSSPropertyScrollbarHighlightColor},
-#line 203 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 255 "CSSPropertyNames.gperf"
-      {"fill-opacity", CSSPropertyFillOpacity},
-#line 57 "CSSPropertyNames.gperf"
-      {"font-style", CSSPropertyFontStyle},
-#line 229 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
-#line 246 "CSSPropertyNames.gperf"
-      {"flood-opacity", CSSPropertyFloodOpacity},
-#line 191 "CSSPropertyNames.gperf"
-      {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 27 "CSSPropertyNames.gperf"
-      {"border-left-style", CSSPropertyBorderLeftStyle},
-#line 31 "CSSPropertyNames.gperf"
-      {"border-right-style", CSSPropertyBorderRightStyle},
-#line 16 "CSSPropertyNames.gperf"
-      {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 114 "CSSPropertyNames.gperf"
-      {"text-line-through", CSSPropertyTextLineThrough},
-#line 115 "CSSPropertyNames.gperf"
-      {"text-line-through-color", CSSPropertyTextLineThroughColor},
-#line 186 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
-#line 170 "CSSPropertyNames.gperf"
-      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
-#line 220 "CSSPropertyNames.gperf"
-      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
-#line 86 "CSSPropertyNames.gperf"
-      {"overflow-y", CSSPropertyOverflowY},
 #line 116 "CSSPropertyNames.gperf"
-      {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 123 "CSSPropertyNames.gperf"
       {"text-overline-style", CSSPropertyTextOverlineStyle},
-#line 276 "CSSPropertyNames.gperf"
-      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
-#line 130 "CSSPropertyNames.gperf"
+#line 123 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
-#line 230 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 222 "CSSPropertyNames.gperf"
-      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 237 "CSSPropertyNames.gperf"
-      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 67 "CSSPropertyNames.gperf"
-      {"list-style-type", CSSPropertyListStyleType},
+#line 209 "CSSPropertyNames.gperf"
+      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
+#line 184 "CSSPropertyNames.gperf"
+      {"-webkit-highlight", CSSPropertyWebkitHighlight},
 #line 275 "CSSPropertyNames.gperf"
-      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
+      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
+#line 264 "CSSPropertyNames.gperf"
+      {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
 #line 54 "CSSPropertyNames.gperf"
       {"font-family", CSSPropertyFontFamily},
-#line 118 "CSSPropertyNames.gperf"
-      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
-#line 171 "CSSPropertyNames.gperf"
+#line 218 "CSSPropertyNames.gperf"
+      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
+#line 107 "CSSPropertyNames.gperf"
+      {"text-line-through", CSSPropertyTextLineThrough},
+#line 109 "CSSPropertyNames.gperf"
+      {"text-line-through-mode", CSSPropertyTextLineThroughMode},
+#line 163 "CSSPropertyNames.gperf"
+      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
+#line 217 "CSSPropertyNames.gperf"
+      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
+#line 274 "CSSPropertyNames.gperf"
+      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
+#line 108 "CSSPropertyNames.gperf"
+      {"text-line-through-color", CSSPropertyTextLineThroughColor},
+#line 164 "CSSPropertyNames.gperf"
       {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
-#line 117 "CSSPropertyNames.gperf"
+#line 111 "CSSPropertyNames.gperf"
+      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
+#line 110 "CSSPropertyNames.gperf"
       {"text-line-through-style", CSSPropertyTextLineThroughStyle}
     };
 
   static const short lookup[] =
     {
-       -1,  -1,  -1,   0,  -1,   1,  -1,  -1,  -1,   2,
-        3,  -1,  -1,   4,  -1,  -1,   5,  -1,  -1,  -1,
-        6,  -1,  -1,  -1,  -1,  -1,  -1,   7,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,   8,  -1,   9,  10,
-       11,  12,  13,  -1,  14,  -1,  15,  -1,  -1,  16,
-       -1,  -1,  -1,  -1,  17,  18,  19,  20,  -1,  -1,
-       21,  22,  23,  -1,  24,  25,  26,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  27,
-       -1,  -1,  -1,  -1,  -1,  28,  -1,  -1,  -1,  -1,
-       29,  -1,  -1,  30,  -1,  -1,  -1,  -1,  -1,  31,
-       -1,  32,  33,  -1,  34,  -1,  -1,  -1,  35,  -1,
-       -1,  36,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  37,  38,  -1,  -1,  -1,  -1,  39,  -1,
-       -1,  -1,  40,  41,  42,  -1,  -1,  43,  -1,  -1,
-       -1,  -1,  -1,  -1,  44,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  45,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  46,  47,  -1,  -1,  -1,  -1,  48,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  49,  -1,  50,
-       -1,  -1,  51,  -1,  -1,  52,  53,  54,  -1,  -1,
-       -1,  55,  56,  -1,  -1,  57,  -1,  -1,  -1,  58,
-       -1,  59,  60,  -1,  -1,  -1,  -1,  61,  -1,  62,
-       -1,  -1,  -1,  63,  -1,  -1,  -1,  -1,  64,  65,
-       -1,  -1,  66,  -1,  -1,  -1,  -1,  67,  -1,  68,
-       -1,  69,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  70,
-       -1,  -1,  71,  -1,  -1,  72,  -1,  73,  74,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  75,  76,  -1,  -1,  -1,  77,  -1,  -1,
-       78,  -1,  -1,  -1,  -1,  79,  80,  -1,  -1,  -1,
-       -1,  81,  -1,  -1,  82,  83,  -1,  84,  85,  86,
-       87,  -1,  88,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  89,  -1,  -1,  -1,  90,  -1,  -1,
-       -1,  91,  -1,  -1,  -1,  92,  -1,  -1,  -1,  93,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  94,
-       95,  96,  97,  -1,  98,  99, 100,  -1,  -1, 101,
-       -1,  -1,  -1, 102,  -1, 103, 104,  -1,  -1, 105,
-       -1, 106, 107,  -1,  -1, 108, 109,  -1,  -1, 110,
-      111, 112,  -1,  -1, 113,  -1, 114,  -1,  -1,  -1,
-      115,  -1, 116, 117,  -1, 118, 119,  -1,  -1,  -1,
-       -1, 120, 121,  -1,  -1, 122,  -1, 123, 124,  -1,
-       -1,  -1, 125, 126,  -1, 127,  -1,  -1, 128,  -1,
-      129, 130, 131,  -1, 132,  -1,  -1,  -1,  -1,  -1,
-      133,  -1,  -1,  -1, 134,  -1,  -1, 135, 136,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 137,  -1,  -1,
-       -1,  -1, 138,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 139,  -1,  -1,  -1,  -1, 140, 141,
-       -1,  -1,  -1,  -1,  -1, 142,  -1,  -1, 143,  -1,
-       -1, 144, 145,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 146,  -1, 147,  -1,  -1,  -1,  -1, 148,  -1,
-       -1,  -1, 149,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 150,  -1,  -1, 151,  -1,  -1,  -1, 152,  -1,
-      153,  -1,  -1, 154,  -1, 155,  -1,  -1,  -1,  -1,
-       -1, 156, 157, 158, 159,  -1,  -1,  -1, 160,  -1,
-      161, 162,  -1,  -1, 163,  -1,  -1, 164,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 165, 166,
-       -1,  -1, 167, 168,  -1,  -1,  -1, 169,  -1,  -1,
-       -1,  -1,  -1, 170,  -1,  -1, 171,  -1,  -1, 172,
-       -1,  -1,  -1,  -1,  -1,  -1, 173, 174, 175,  -1,
-       -1,  -1,  -1,  -1,  -1, 176,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 177,  -1,  -1, 178,
-       -1, 179,  -1,  -1,  -1, 180,  -1,  -1, 181,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      182,  -1, 183,  -1, 184, 185,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 186,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 187,  -1,  -1, 188,  -1,  -1,
-       -1, 189, 190,  -1,  -1,  -1, 191,  -1,  -1,  -1,
-       -1,  -1,  -1, 192,  -1,  -1,  -1, 193,  -1, 194,
-      195,  -1, 196, 197, 198, 199,  -1,  -1, 200,  -1,
-       -1, 201,  -1,  -1,  -1,  -1, 202, 203,  -1,  -1,
-       -1, 204, 205,  -1,  -1,  -1,  -1, 206,  -1,  -1,
-       -1, 207,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 208,
+       -1,  -1,  -1,  -1,  -1,  -1,   0,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,   1,  -1,  -1,  -1,
+       -1,   2,  -1,   3,  -1,   4,   5,   6,  -1,  -1,
+        7,  -1,  -1,   8,   9,  -1,  10,  -1,  -1,  -1,
+       11,  -1,  12,  -1,  -1,  13,  -1,  -1,  -1,  -1,
+       14,  -1,  15,  -1,  -1,  16,  -1,  17,  18,  -1,
+       -1,  19,  20,  -1,  -1,  -1,  -1,  21,  -1,  22,
+       -1,  -1,  -1,  23,  -1,  24,  -1,  25,  26,  27,
+       -1,  -1,  -1,  -1,  28,  29,  -1,  -1,  -1,  -1,
+       30,  -1,  31,  32,  33,  -1,  -1,  -1,  -1,  -1,
+       -1,  34,  -1,  -1,  -1,  -1,  -1,  -1,  35,  36,
+       37,  -1,  -1,  -1,  -1,  -1,  -1,  38,  -1,  -1,
+       -1,  -1,  39,  -1,  -1,  -1,  40,  41,  -1,  42,
+       -1,  43,  -1,  -1,  -1,  -1,  44,  -1,  -1,  -1,
+       -1,  45,  46,  -1,  -1,  -1,  -1,  47,  -1,  48,
+       -1,  49,  50,  51,  -1,  52,  -1,  53,  -1,  -1,
+       54,  -1,  -1,  55,  56,  57,  58,  59,  -1,  -1,
+       -1,  60,  61,  -1,  62,  -1,  -1,  63,  64,  -1,
+       -1,  65,  -1,  -1,  -1,  -1,  66,  -1,  -1,  -1,
+       67,  -1,  -1,  -1,  68,  69,  70,  -1,  -1,  -1,
+       71,  -1,  72,  -1,  -1,  73,  -1,  74,  -1,  -1,
+       75,  -1,  -1,  76,  77,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  78,  -1,  -1,  79,  -1,  80,  -1,  -1,
+       -1,  -1,  81,  -1,  -1,  -1,  -1,  -1,  -1,  82,
+       -1,  -1,  83,  84,  -1,  -1,  -1,  -1,  -1,  85,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  86,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  87,  -1,  88,  -1,  -1,
+       -1,  -1,  -1,  89,  -1,  -1,  -1,  -1,  -1,  90,
+       91,  -1,  -1,  -1,  92,  -1,  -1,  93,  -1,  -1,
+       -1,  -1,  -1,  -1,  94,  -1,  -1,  -1,  -1,  -1,
+       95,  -1,  -1,  -1,  -1,  96,  -1,  97,  -1,  98,
+       -1,  -1,  -1,  -1,  99,  -1, 100, 101,  -1,  -1,
+       -1,  -1, 102, 103, 104,  -1,  -1, 105,  -1, 106,
+       -1,  -1,  -1, 107,  -1,  -1, 108,  -1,  -1,  -1,
+       -1,  -1, 109, 110,  -1,  -1,  -1,  -1, 111,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 112,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 113,
+       -1,  -1,  -1, 114, 115,  -1,  -1,  -1, 116,  -1,
+       -1, 117,  -1,  -1,  -1, 118,  -1, 119,  -1,  -1,
+      120,  -1, 121,  -1, 122,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 123, 124,  -1,
+      125, 126, 127,  -1, 128,  -1, 129,  -1, 130, 131,
+       -1,  -1,  -1,  -1, 132, 133,  -1, 134,  -1, 135,
+      136, 137,  -1, 138,  -1,  -1,  -1, 139, 140, 141,
+       -1, 142,  -1, 143, 144,  -1,  -1,  -1,  -1,  -1,
+       -1, 145,  -1, 146, 147,  -1,  -1,  -1,  -1,  -1,
+       -1, 148,  -1,  -1, 149,  -1,  -1, 150,  -1,  -1,
+       -1, 151,  -1, 152,  -1,  -1,  -1, 153,  -1, 154,
+      155,  -1, 156,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 157, 158,  -1,  -1, 159, 160,  -1,  -1, 161,
+       -1,  -1, 162, 163,  -1,  -1,  -1,  -1, 164,  -1,
+       -1, 165, 166,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      167,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 168, 169,
+       -1, 170,  -1,  -1,  -1,  -1, 171,  -1,  -1,  -1,
+       -1, 172, 173, 174,  -1,  -1,  -1, 175,  -1,  -1,
+       -1,  -1,  -1,  -1, 176, 177, 178, 179,  -1,  -1,
+       -1, 180,  -1, 181,  -1,  -1,  -1, 182,  -1,  -1,
+      183, 184,  -1, 185, 186,  -1,  -1,  -1, 187, 188,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 189, 190,
+       -1, 191,  -1,  -1, 192,  -1,  -1,  -1,  -1,  -1,
+      193,  -1,  -1, 194, 195,  -1,  -1, 196,  -1,  -1,
+      197, 198,  -1, 199,  -1, 200, 201,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 202, 203,  -1,  -1,  -1,  -1, 204,  -1,
+       -1, 205,  -1,  -1,  -1, 206, 207,  -1,  -1, 208,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 209,  -1,  -1,  -1, 210,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 211,  -1, 212, 213,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 214,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 215,  -1,  -1,  -1,
+       -1, 216,  -1,  -1, 217,  -1,  -1,  -1, 218,  -1,
+       -1,  -1,  -1,  -1, 219,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 220,  -1,  -1, 221,  -1,  -1,  -1,  -1,
+       -1, 222,  -1,  -1,  -1,  -1,  -1,  -1, 223,  -1,
+       -1,  -1,  -1,  -1,  -1, 224,  -1, 225,  -1,  -1,
+       -1,  -1,  -1, 226, 227, 228,  -1,  -1,  -1,  -1,
+      229,  -1,  -1,  -1, 230,  -1,  -1,  -1, 231,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 232,  -1,  -1, 233,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      234,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 235,  -1,  -1,  -1,
+       -1,  -1,  -1, 236,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 237,
+       -1,  -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      239,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 240,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 241,  -1,  -1,  -1, 242,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 243,
+      244,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 245,  -1,  -1, 246,  -1,
+      247,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 248,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 249,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 250,  -1,  -1,
+      251,  -1,  -1,  -1, 252, 253,  -1,  -1, 254,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 255,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 256, 257,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 209,  -1,  -1,  -1, 210,  -1,
-      211,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 212, 213,  -1, 214,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 215,  -1,  -1,  -1,  -1, 216,
+       -1, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 217,  -1,  -1, 218,  -1,  -1,  -1,  -1,
-       -1, 219,  -1, 220, 221,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 222,  -1,  -1,  -1, 223,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 224,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 225,  -1,
-       -1,  -1,  -1,  -1,  -1, 226,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 227,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 228,  -1,  -1,  -1,  -1,  -1,  -1, 229,  -1,
-       -1,  -1, 230,  -1,  -1, 231,  -1,  -1,  -1,  -1,
-      232,  -1,  -1,  -1, 233,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 234,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 235,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 236,  -1,  -1,  -1,
-      237,  -1,  -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 239,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      240,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      241, 242,  -1,  -1,  -1,  -1,  -1, 243,  -1,  -1,
-      244, 245,  -1, 246,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 247,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 248,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 259,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 249,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 250,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 260,  -1,  -1,
+       -1,  -1, 261,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -891,47 +903,30 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 251,  -1,  -1,
-       -1,  -1,  -1, 252,  -1, 253, 254,  -1,  -1,  -1,
+       -1, 262,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 255,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      256,  -1, 257,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 258,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 259,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      260,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 261,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,  -1,
        -1,  -1,  -1,  -1, 263,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      264,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 265,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 266,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 267,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 264,  -1,  -1,  -1,  -1, 265,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 266,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 268,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 267,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -942,20 +937,7 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 269
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 268
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -977,9 +959,9 @@ findProp (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 280 "CSSPropertyNames.gperf"
+#line 279 "CSSPropertyNames.gperf"
 
-static const char * const propertyNameStrings[270] = {
+static const char * const propertyNameStrings[269] = {
 "background",
 "background-attachment",
 "background-color",
@@ -1071,13 +1053,6 @@ static const char * const propertyNameStrings[270] = {
 "quotes",
 "resize",
 "right",
-"scrollbar-3dlight-color",
-"scrollbar-arrow-color",
-"scrollbar-darkshadow-color",
-"scrollbar-face-color",
-"scrollbar-highlight-color",
-"scrollbar-shadow-color",
-"scrollbar-track-color",
 "size",
 "src",
 "table-layout",
@@ -1121,9 +1096,9 @@ static const char * const propertyNameStrings[270] = {
 "-webkit-animation-duration",
 "-webkit-animation-iteration-count",
 "-webkit-animation-name",
-"-webkit-animation-play-state",
 "-webkit-animation-timing-function",
 "-webkit-appearance",
+"-webkit-backface-visibility",
 "-webkit-background-clip",
 "-webkit-background-composite",
 "-webkit-background-origin",
@@ -1189,6 +1164,10 @@ static const char * const propertyNameStrings[270] = {
 "-webkit-match-nearest-mail-blockquote-color",
 "-webkit-nbsp-mode",
 "-webkit-padding-start",
+"-webkit-perspective",
+"-webkit-perspective-origin",
+"-webkit-perspective-origin-x",
+"-webkit-perspective-origin-y",
 "-webkit-rtl-ordering",
 "-webkit-text-decorations-in-effect",
 "-webkit-text-fill-color",
@@ -1201,6 +1180,8 @@ static const char * const propertyNameStrings[270] = {
 "-webkit-transform-origin",
 "-webkit-transform-origin-x",
 "-webkit-transform-origin-y",
+"-webkit-transform-origin-z",
+"-webkit-transform-style",
 "-webkit-transition",
 "-webkit-transition-delay",
 "-webkit-transition-duration",
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index 095c2c0522..aaddf05631 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -96,189 +96,188 @@ enum CSSPropertyID {
     CSSPropertyQuotes = 1089,
     CSSPropertyResize = 1090,
     CSSPropertyRight = 1091,
-    CSSPropertyScrollbar3dlightColor = 1092,
-    CSSPropertyScrollbarArrowColor = 1093,
-    CSSPropertyScrollbarDarkshadowColor = 1094,
-    CSSPropertyScrollbarFaceColor = 1095,
-    CSSPropertyScrollbarHighlightColor = 1096,
-    CSSPropertyScrollbarShadowColor = 1097,
-    CSSPropertyScrollbarTrackColor = 1098,
-    CSSPropertySize = 1099,
-    CSSPropertySrc = 1100,
-    CSSPropertyTableLayout = 1101,
-    CSSPropertyTextAlign = 1102,
-    CSSPropertyTextDecoration = 1103,
-    CSSPropertyTextIndent = 1104,
-    CSSPropertyTextLineThrough = 1105,
-    CSSPropertyTextLineThroughColor = 1106,
-    CSSPropertyTextLineThroughMode = 1107,
-    CSSPropertyTextLineThroughStyle = 1108,
-    CSSPropertyTextLineThroughWidth = 1109,
-    CSSPropertyTextOverflow = 1110,
-    CSSPropertyTextOverline = 1111,
-    CSSPropertyTextOverlineColor = 1112,
-    CSSPropertyTextOverlineMode = 1113,
-    CSSPropertyTextOverlineStyle = 1114,
-    CSSPropertyTextOverlineWidth = 1115,
-    CSSPropertyTextShadow = 1116,
-    CSSPropertyTextTransform = 1117,
-    CSSPropertyTextUnderline = 1118,
-    CSSPropertyTextUnderlineColor = 1119,
-    CSSPropertyTextUnderlineMode = 1120,
-    CSSPropertyTextUnderlineStyle = 1121,
-    CSSPropertyTextUnderlineWidth = 1122,
-    CSSPropertyTop = 1123,
-    CSSPropertyUnicodeBidi = 1124,
-    CSSPropertyUnicodeRange = 1125,
-    CSSPropertyVerticalAlign = 1126,
-    CSSPropertyVisibility = 1127,
-    CSSPropertyWhiteSpace = 1128,
-    CSSPropertyWidows = 1129,
-    CSSPropertyWidth = 1130,
-    CSSPropertyWordBreak = 1131,
-    CSSPropertyWordSpacing = 1132,
-    CSSPropertyWordWrap = 1133,
-    CSSPropertyZIndex = 1134,
-    CSSPropertyZoom = 1135,
-    CSSPropertyWebkitAnimation = 1136,
-    CSSPropertyWebkitAnimationDelay = 1137,
-    CSSPropertyWebkitAnimationDirection = 1138,
-    CSSPropertyWebkitAnimationDuration = 1139,
-    CSSPropertyWebkitAnimationIterationCount = 1140,
-    CSSPropertyWebkitAnimationName = 1141,
-    CSSPropertyWebkitAnimationPlayState = 1142,
-    CSSPropertyWebkitAnimationTimingFunction = 1143,
-    CSSPropertyWebkitAppearance = 1144,
-    CSSPropertyWebkitBackgroundClip = 1145,
-    CSSPropertyWebkitBackgroundComposite = 1146,
-    CSSPropertyWebkitBackgroundOrigin = 1147,
-    CSSPropertyWebkitBackgroundSize = 1148,
-    CSSPropertyWebkitBinding = 1149,
-    CSSPropertyWebkitBorderBottomLeftRadius = 1150,
-    CSSPropertyWebkitBorderBottomRightRadius = 1151,
-    CSSPropertyWebkitBorderFit = 1152,
-    CSSPropertyWebkitBorderHorizontalSpacing = 1153,
-    CSSPropertyWebkitBorderImage = 1154,
-    CSSPropertyWebkitBorderRadius = 1155,
-    CSSPropertyWebkitBorderTopLeftRadius = 1156,
-    CSSPropertyWebkitBorderTopRightRadius = 1157,
-    CSSPropertyWebkitBorderVerticalSpacing = 1158,
-    CSSPropertyWebkitBoxAlign = 1159,
-    CSSPropertyWebkitBoxDirection = 1160,
-    CSSPropertyWebkitBoxFlex = 1161,
-    CSSPropertyWebkitBoxFlexGroup = 1162,
-    CSSPropertyWebkitBoxLines = 1163,
-    CSSPropertyWebkitBoxOrdinalGroup = 1164,
-    CSSPropertyWebkitBoxOrient = 1165,
-    CSSPropertyWebkitBoxPack = 1166,
-    CSSPropertyWebkitBoxReflect = 1167,
-    CSSPropertyWebkitBoxShadow = 1168,
-    CSSPropertyWebkitBoxSizing = 1169,
-    CSSPropertyWebkitColumnBreakAfter = 1170,
-    CSSPropertyWebkitColumnBreakBefore = 1171,
-    CSSPropertyWebkitColumnBreakInside = 1172,
-    CSSPropertyWebkitColumnCount = 1173,
-    CSSPropertyWebkitColumnGap = 1174,
-    CSSPropertyWebkitColumnRule = 1175,
-    CSSPropertyWebkitColumnRuleColor = 1176,
-    CSSPropertyWebkitColumnRuleStyle = 1177,
-    CSSPropertyWebkitColumnRuleWidth = 1178,
-    CSSPropertyWebkitColumnWidth = 1179,
-    CSSPropertyWebkitColumns = 1180,
-    CSSPropertyWebkitFontSizeDelta = 1181,
-    CSSPropertyWebkitHighlight = 1182,
-    CSSPropertyWebkitLineBreak = 1183,
-    CSSPropertyWebkitLineClamp = 1184,
-    CSSPropertyWebkitMarginBottomCollapse = 1185,
-    CSSPropertyWebkitMarginCollapse = 1186,
-    CSSPropertyWebkitMarginStart = 1187,
-    CSSPropertyWebkitMarginTopCollapse = 1188,
-    CSSPropertyWebkitMarquee = 1189,
-    CSSPropertyWebkitMarqueeDirection = 1190,
-    CSSPropertyWebkitMarqueeIncrement = 1191,
-    CSSPropertyWebkitMarqueeRepetition = 1192,
-    CSSPropertyWebkitMarqueeSpeed = 1193,
-    CSSPropertyWebkitMarqueeStyle = 1194,
-    CSSPropertyWebkitMask = 1195,
-    CSSPropertyWebkitMaskAttachment = 1196,
-    CSSPropertyWebkitMaskBoxImage = 1197,
-    CSSPropertyWebkitMaskClip = 1198,
-    CSSPropertyWebkitMaskComposite = 1199,
-    CSSPropertyWebkitMaskImage = 1200,
-    CSSPropertyWebkitMaskOrigin = 1201,
-    CSSPropertyWebkitMaskPosition = 1202,
-    CSSPropertyWebkitMaskPositionX = 1203,
-    CSSPropertyWebkitMaskPositionY = 1204,
-    CSSPropertyWebkitMaskRepeat = 1205,
-    CSSPropertyWebkitMaskSize = 1206,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1207,
-    CSSPropertyWebkitNbspMode = 1208,
-    CSSPropertyWebkitPaddingStart = 1209,
-    CSSPropertyWebkitRtlOrdering = 1210,
-    CSSPropertyWebkitTextDecorationsInEffect = 1211,
-    CSSPropertyWebkitTextFillColor = 1212,
-    CSSPropertyWebkitTextSecurity = 1213,
-    CSSPropertyWebkitTextSizeAdjust = 1214,
-    CSSPropertyWebkitTextStroke = 1215,
-    CSSPropertyWebkitTextStrokeColor = 1216,
-    CSSPropertyWebkitTextStrokeWidth = 1217,
-    CSSPropertyWebkitTransform = 1218,
-    CSSPropertyWebkitTransformOrigin = 1219,
-    CSSPropertyWebkitTransformOriginX = 1220,
-    CSSPropertyWebkitTransformOriginY = 1221,
-    CSSPropertyWebkitTransition = 1222,
-    CSSPropertyWebkitTransitionDelay = 1223,
-    CSSPropertyWebkitTransitionDuration = 1224,
-    CSSPropertyWebkitTransitionProperty = 1225,
-    CSSPropertyWebkitTransitionTimingFunction = 1226,
-    CSSPropertyWebkitUserDrag = 1227,
-    CSSPropertyWebkitUserModify = 1228,
-    CSSPropertyWebkitUserSelect = 1229,
-    CSSPropertyWebkitVariableDeclarationBlock = 1230,
-    CSSPropertyClipPath = 1231,
-    CSSPropertyClipRule = 1232,
-    CSSPropertyMask = 1233,
-    CSSPropertyEnableBackground = 1234,
-    CSSPropertyFilter = 1235,
-    CSSPropertyFloodColor = 1236,
-    CSSPropertyFloodOpacity = 1237,
-    CSSPropertyLightingColor = 1238,
-    CSSPropertyStopColor = 1239,
-    CSSPropertyStopOpacity = 1240,
-    CSSPropertyColorInterpolation = 1241,
-    CSSPropertyColorInterpolationFilters = 1242,
-    CSSPropertyColorProfile = 1243,
-    CSSPropertyColorRendering = 1244,
-    CSSPropertyFill = 1245,
-    CSSPropertyFillOpacity = 1246,
-    CSSPropertyFillRule = 1247,
-    CSSPropertyImageRendering = 1248,
-    CSSPropertyMarker = 1249,
-    CSSPropertyMarkerEnd = 1250,
-    CSSPropertyMarkerMid = 1251,
-    CSSPropertyMarkerStart = 1252,
-    CSSPropertyShapeRendering = 1253,
-    CSSPropertyStroke = 1254,
-    CSSPropertyStrokeDasharray = 1255,
-    CSSPropertyStrokeDashoffset = 1256,
-    CSSPropertyStrokeLinecap = 1257,
-    CSSPropertyStrokeLinejoin = 1258,
-    CSSPropertyStrokeMiterlimit = 1259,
-    CSSPropertyStrokeOpacity = 1260,
-    CSSPropertyStrokeWidth = 1261,
-    CSSPropertyTextRendering = 1262,
-    CSSPropertyAlignmentBaseline = 1263,
-    CSSPropertyBaselineShift = 1264,
-    CSSPropertyDominantBaseline = 1265,
-    CSSPropertyGlyphOrientationHorizontal = 1266,
-    CSSPropertyGlyphOrientationVertical = 1267,
-    CSSPropertyKerning = 1268,
-    CSSPropertyTextAnchor = 1269,
-    CSSPropertyWritingMode = 1270,
+    CSSPropertySize = 1092,
+    CSSPropertySrc = 1093,
+    CSSPropertyTableLayout = 1094,
+    CSSPropertyTextAlign = 1095,
+    CSSPropertyTextDecoration = 1096,
+    CSSPropertyTextIndent = 1097,
+    CSSPropertyTextLineThrough = 1098,
+    CSSPropertyTextLineThroughColor = 1099,
+    CSSPropertyTextLineThroughMode = 1100,
+    CSSPropertyTextLineThroughStyle = 1101,
+    CSSPropertyTextLineThroughWidth = 1102,
+    CSSPropertyTextOverflow = 1103,
+    CSSPropertyTextOverline = 1104,
+    CSSPropertyTextOverlineColor = 1105,
+    CSSPropertyTextOverlineMode = 1106,
+    CSSPropertyTextOverlineStyle = 1107,
+    CSSPropertyTextOverlineWidth = 1108,
+    CSSPropertyTextShadow = 1109,
+    CSSPropertyTextTransform = 1110,
+    CSSPropertyTextUnderline = 1111,
+    CSSPropertyTextUnderlineColor = 1112,
+    CSSPropertyTextUnderlineMode = 1113,
+    CSSPropertyTextUnderlineStyle = 1114,
+    CSSPropertyTextUnderlineWidth = 1115,
+    CSSPropertyTop = 1116,
+    CSSPropertyUnicodeBidi = 1117,
+    CSSPropertyUnicodeRange = 1118,
+    CSSPropertyVerticalAlign = 1119,
+    CSSPropertyVisibility = 1120,
+    CSSPropertyWhiteSpace = 1121,
+    CSSPropertyWidows = 1122,
+    CSSPropertyWidth = 1123,
+    CSSPropertyWordBreak = 1124,
+    CSSPropertyWordSpacing = 1125,
+    CSSPropertyWordWrap = 1126,
+    CSSPropertyZIndex = 1127,
+    CSSPropertyZoom = 1128,
+    CSSPropertyWebkitAnimation = 1129,
+    CSSPropertyWebkitAnimationDelay = 1130,
+    CSSPropertyWebkitAnimationDirection = 1131,
+    CSSPropertyWebkitAnimationDuration = 1132,
+    CSSPropertyWebkitAnimationIterationCount = 1133,
+    CSSPropertyWebkitAnimationName = 1134,
+    CSSPropertyWebkitAnimationTimingFunction = 1135,
+    CSSPropertyWebkitAppearance = 1136,
+    CSSPropertyWebkitBackfaceVisibility = 1137,
+    CSSPropertyWebkitBackgroundClip = 1138,
+    CSSPropertyWebkitBackgroundComposite = 1139,
+    CSSPropertyWebkitBackgroundOrigin = 1140,
+    CSSPropertyWebkitBackgroundSize = 1141,
+    CSSPropertyWebkitBinding = 1142,
+    CSSPropertyWebkitBorderBottomLeftRadius = 1143,
+    CSSPropertyWebkitBorderBottomRightRadius = 1144,
+    CSSPropertyWebkitBorderFit = 1145,
+    CSSPropertyWebkitBorderHorizontalSpacing = 1146,
+    CSSPropertyWebkitBorderImage = 1147,
+    CSSPropertyWebkitBorderRadius = 1148,
+    CSSPropertyWebkitBorderTopLeftRadius = 1149,
+    CSSPropertyWebkitBorderTopRightRadius = 1150,
+    CSSPropertyWebkitBorderVerticalSpacing = 1151,
+    CSSPropertyWebkitBoxAlign = 1152,
+    CSSPropertyWebkitBoxDirection = 1153,
+    CSSPropertyWebkitBoxFlex = 1154,
+    CSSPropertyWebkitBoxFlexGroup = 1155,
+    CSSPropertyWebkitBoxLines = 1156,
+    CSSPropertyWebkitBoxOrdinalGroup = 1157,
+    CSSPropertyWebkitBoxOrient = 1158,
+    CSSPropertyWebkitBoxPack = 1159,
+    CSSPropertyWebkitBoxReflect = 1160,
+    CSSPropertyWebkitBoxShadow = 1161,
+    CSSPropertyWebkitBoxSizing = 1162,
+    CSSPropertyWebkitColumnBreakAfter = 1163,
+    CSSPropertyWebkitColumnBreakBefore = 1164,
+    CSSPropertyWebkitColumnBreakInside = 1165,
+    CSSPropertyWebkitColumnCount = 1166,
+    CSSPropertyWebkitColumnGap = 1167,
+    CSSPropertyWebkitColumnRule = 1168,
+    CSSPropertyWebkitColumnRuleColor = 1169,
+    CSSPropertyWebkitColumnRuleStyle = 1170,
+    CSSPropertyWebkitColumnRuleWidth = 1171,
+    CSSPropertyWebkitColumnWidth = 1172,
+    CSSPropertyWebkitColumns = 1173,
+    CSSPropertyWebkitFontSizeDelta = 1174,
+    CSSPropertyWebkitHighlight = 1175,
+    CSSPropertyWebkitLineBreak = 1176,
+    CSSPropertyWebkitLineClamp = 1177,
+    CSSPropertyWebkitMarginBottomCollapse = 1178,
+    CSSPropertyWebkitMarginCollapse = 1179,
+    CSSPropertyWebkitMarginStart = 1180,
+    CSSPropertyWebkitMarginTopCollapse = 1181,
+    CSSPropertyWebkitMarquee = 1182,
+    CSSPropertyWebkitMarqueeDirection = 1183,
+    CSSPropertyWebkitMarqueeIncrement = 1184,
+    CSSPropertyWebkitMarqueeRepetition = 1185,
+    CSSPropertyWebkitMarqueeSpeed = 1186,
+    CSSPropertyWebkitMarqueeStyle = 1187,
+    CSSPropertyWebkitMask = 1188,
+    CSSPropertyWebkitMaskAttachment = 1189,
+    CSSPropertyWebkitMaskBoxImage = 1190,
+    CSSPropertyWebkitMaskClip = 1191,
+    CSSPropertyWebkitMaskComposite = 1192,
+    CSSPropertyWebkitMaskImage = 1193,
+    CSSPropertyWebkitMaskOrigin = 1194,
+    CSSPropertyWebkitMaskPosition = 1195,
+    CSSPropertyWebkitMaskPositionX = 1196,
+    CSSPropertyWebkitMaskPositionY = 1197,
+    CSSPropertyWebkitMaskRepeat = 1198,
+    CSSPropertyWebkitMaskSize = 1199,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1200,
+    CSSPropertyWebkitNbspMode = 1201,
+    CSSPropertyWebkitPaddingStart = 1202,
+    CSSPropertyWebkitPerspective = 1203,
+    CSSPropertyWebkitPerspectiveOrigin = 1204,
+    CSSPropertyWebkitPerspectiveOriginX = 1205,
+    CSSPropertyWebkitPerspectiveOriginY = 1206,
+    CSSPropertyWebkitRtlOrdering = 1207,
+    CSSPropertyWebkitTextDecorationsInEffect = 1208,
+    CSSPropertyWebkitTextFillColor = 1209,
+    CSSPropertyWebkitTextSecurity = 1210,
+    CSSPropertyWebkitTextSizeAdjust = 1211,
+    CSSPropertyWebkitTextStroke = 1212,
+    CSSPropertyWebkitTextStrokeColor = 1213,
+    CSSPropertyWebkitTextStrokeWidth = 1214,
+    CSSPropertyWebkitTransform = 1215,
+    CSSPropertyWebkitTransformOrigin = 1216,
+    CSSPropertyWebkitTransformOriginX = 1217,
+    CSSPropertyWebkitTransformOriginY = 1218,
+    CSSPropertyWebkitTransformOriginZ = 1219,
+    CSSPropertyWebkitTransformStyle = 1220,
+    CSSPropertyWebkitTransition = 1221,
+    CSSPropertyWebkitTransitionDelay = 1222,
+    CSSPropertyWebkitTransitionDuration = 1223,
+    CSSPropertyWebkitTransitionProperty = 1224,
+    CSSPropertyWebkitTransitionTimingFunction = 1225,
+    CSSPropertyWebkitUserDrag = 1226,
+    CSSPropertyWebkitUserModify = 1227,
+    CSSPropertyWebkitUserSelect = 1228,
+    CSSPropertyWebkitVariableDeclarationBlock = 1229,
+    CSSPropertyClipPath = 1230,
+    CSSPropertyClipRule = 1231,
+    CSSPropertyMask = 1232,
+    CSSPropertyEnableBackground = 1233,
+    CSSPropertyFilter = 1234,
+    CSSPropertyFloodColor = 1235,
+    CSSPropertyFloodOpacity = 1236,
+    CSSPropertyLightingColor = 1237,
+    CSSPropertyStopColor = 1238,
+    CSSPropertyStopOpacity = 1239,
+    CSSPropertyColorInterpolation = 1240,
+    CSSPropertyColorInterpolationFilters = 1241,
+    CSSPropertyColorProfile = 1242,
+    CSSPropertyColorRendering = 1243,
+    CSSPropertyFill = 1244,
+    CSSPropertyFillOpacity = 1245,
+    CSSPropertyFillRule = 1246,
+    CSSPropertyImageRendering = 1247,
+    CSSPropertyMarker = 1248,
+    CSSPropertyMarkerEnd = 1249,
+    CSSPropertyMarkerMid = 1250,
+    CSSPropertyMarkerStart = 1251,
+    CSSPropertyShapeRendering = 1252,
+    CSSPropertyStroke = 1253,
+    CSSPropertyStrokeDasharray = 1254,
+    CSSPropertyStrokeDashoffset = 1255,
+    CSSPropertyStrokeLinecap = 1256,
+    CSSPropertyStrokeLinejoin = 1257,
+    CSSPropertyStrokeMiterlimit = 1258,
+    CSSPropertyStrokeOpacity = 1259,
+    CSSPropertyStrokeWidth = 1260,
+    CSSPropertyTextRendering = 1261,
+    CSSPropertyAlignmentBaseline = 1262,
+    CSSPropertyBaselineShift = 1263,
+    CSSPropertyDominantBaseline = 1264,
+    CSSPropertyGlyphOrientationHorizontal = 1265,
+    CSSPropertyGlyphOrientationVertical = 1266,
+    CSSPropertyKerning = 1267,
+    CSSPropertyTextAnchor = 1268,
+    CSSPropertyWritingMode = 1269,
 };
 
 const int firstCSSProperty = 1001;
-const int numCSSProperties = 270;
+const int numCSSProperties = 269;
 const size_t maxCSSPropertyNameLength = 43;
 
 const char* getPropertyName(CSSPropertyID);
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
index 5ff0858c64..e84ca9e05b 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
@@ -38,7 +38,7 @@ struct css_value {
     const char* name;
     int id;
 };
-/* maximum key range = 5296, duplicates = 0 */
+/* maximum key range = 8752, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -52,32 +52,32 @@ hash_val (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296,   90,   37, 5296, 5296,    0,
-        55,   50,   40,   35,   30,   25,   20,    5, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296,    5,  200,   15,
-       285,    0,    1, 1005,  565,   35,  226,  850,   10,   20,
-        30,   10,   45,  661,  325,    5,   80,  305,  805,   32,
-       511,  256,  790,    0, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752,  970,   27, 8752, 8752,    0,
+        55,    5,   50,   40,   35,   30,   25,   20, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752,    5,  200,   15,
+       590,    0,  515,  251,   21,   35,    1,  905,   10,   20,
+        30,   10,   45,  651,  160,    5,   80,  145,  960,  136,
+       920,  971,  105,    0, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752
     };
   register int hval = 0;
 
@@ -188,1402 +188,1537 @@ findValue (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 531,
+      TOTAL_KEYWORDS = 537,
       MIN_WORD_LENGTH = 2,
       MAX_WORD_LENGTH = 30,
       MIN_HASH_VALUE = 0,
-      MAX_HASH_VALUE = 5295
+      MAX_HASH_VALUE = 8751
     };
 
   static const struct css_value wordlist_value[] =
     {
 #line 40 "CSSValueKeywords.gperf"
       {"100", CSSValue100},
-#line 48 "CSSValueKeywords.gperf"
-      {"900", CSSValue900},
+#line 42 "CSSValueKeywords.gperf"
+      {"300", CSSValue300},
 #line 287 "CSSValueKeywords.gperf"
       {"end", CSSValueEnd},
-#line 539 "CSSValueKeywords.gperf"
+#line 545 "CSSValueKeywords.gperf"
       {"lr", CSSValueLr},
+#line 48 "CSSValueKeywords.gperf"
+      {"900", CSSValue900},
+#line 256 "CSSValueKeywords.gperf"
+      {"hide", CSSValueHide},
 #line 47 "CSSValueKeywords.gperf"
       {"800", CSSValue800},
+#line 369 "CSSValueKeywords.gperf"
+      {"lines", CSSValueLines},
 #line 46 "CSSValueKeywords.gperf"
       {"700", CSSValue700},
 #line 45 "CSSValueKeywords.gperf"
       {"600", CSSValue600},
+#line 209 "CSSValueKeywords.gperf"
+      {"alias", CSSValueAlias},
 #line 44 "CSSValueKeywords.gperf"
       {"500", CSSValue500},
-#line 43 "CSSValueKeywords.gperf"
-      {"400", CSSValue400},
+#line 81 "CSSValueKeywords.gperf"
+      {"lime", CSSValueLime},
 #line 34 "CSSValueKeywords.gperf"
       {"all", CSSValueAll},
-#line 207 "CSSValueKeywords.gperf"
-      {"cell", CSSValueCell},
-#line 69 "CSSValueKeywords.gperf"
-      {"serif", CSSValueSerif},
-#line 42 "CSSValueKeywords.gperf"
-      {"300", CSSValue300},
-#line 273 "CSSValueKeywords.gperf"
-      {"pre", CSSValuePre},
-#line 260 "CSSValueKeywords.gperf"
-      {"level", CSSValueLevel},
+#line 164 "CSSValueKeywords.gperf"
+      {"circle", CSSValueCircle},
+#line 43 "CSSValueKeywords.gperf"
+      {"400", CSSValue400},
+#line 463 "CSSValueKeywords.gperf"
+      {"linen", CSSValueLinen},
 #line 41 "CSSValueKeywords.gperf"
       {"200", CSSValue200},
-#line 473 "CSSValueKeywords.gperf"
+#line 479 "CSSValueKeywords.gperf"
       {"oldlace", CSSValueOldlace},
 #line 252 "CSSValueKeywords.gperf"
       {"cross", CSSValueCross},
-#line 394 "CSSValueKeywords.gperf"
+#line 400 "CSSValueKeywords.gperf"
       {"coral", CSSValueCoral},
+#line 312 "CSSValueKeywords.gperf"
+      {"clip", CSSValueClip},
 #line 13 "CSSValueKeywords.gperf"
       {"none", CSSValueNone},
-#line 499 "CSSValueKeywords.gperf"
-      {"snow", CSSValueSnow},
-#line 541 "CSSValueKeywords.gperf"
+#line 403 "CSSValueKeywords.gperf"
+      {"crimson", CSSValueCrimson},
+#line 547 "CSSValueKeywords.gperf"
       {"tb", CSSValueTb},
-#line 205 "CSSValueKeywords.gperf"
-      {"move", CSSValueMove},
-#line 300 "CSSValueKeywords.gperf"
-      {"slow", CSSValueSlow},
 #line 251 "CSSValueKeywords.gperf"
       {"crop", CSSValueCrop},
 #line 36 "CSSValueKeywords.gperf"
       {"normal", CSSValueNormal},
-#line 279 "CSSValueKeywords.gperf"
-      {"show", CSSValueShow},
 #line 183 "CSSValueKeywords.gperf"
       {"inline", CSSValueInline},
 #line 176 "CSSValueKeywords.gperf"
       {"armenian", CSSValueArmenian},
+#line 367 "CSSValueKeywords.gperf"
+      {"logical", CSSValueLogical},
 #line 241 "CSSValueKeywords.gperf"
       {"collapse", CSSValueCollapse},
-#line 308 "CSSValueKeywords.gperf"
-      {"element", CSSValueElement},
-#line 507 "CSSValueKeywords.gperf"
-      {"wheat", CSSValueWheat},
+#line 282 "CSSValueKeywords.gperf"
+      {"thin", CSSValueThin},
 #line 73 "CSSValueKeywords.gperf"
       {"monospace", CSSValueMonospace},
+#line 235 "CSSValueKeywords.gperf"
+      {"ltr", CSSValueLtr},
 #line 313 "CSSValueKeywords.gperf"
       {"ellipsis", CSSValueEllipsis},
+#line 12 "CSSValueKeywords.gperf"
+      {"initial", CSSValueInitial},
+#line 215 "CSSValueKeywords.gperf"
+      {"e-resize", CSSValueEResize},
+#line 546 "CSSValueKeywords.gperf"
+      {"rl", CSSValueRl},
+#line 221 "CSSValueKeywords.gperf"
+      {"s-resize", CSSValueSResize},
+#line 375 "CSSValueKeywords.gperf"
+      {"linear", CSSValueLinear},
+#line 505 "CSSValueKeywords.gperf"
+      {"snow", CSSValueSnow},
+#line 205 "CSSValueKeywords.gperf"
+      {"move", CSSValueMove},
 #line 15 "CSSValueKeywords.gperf"
       {"inset", CSSValueInset},
-#line 393 "CSSValueKeywords.gperf"
+#line 300 "CSSValueKeywords.gperf"
+      {"slow", CSSValueSlow},
+#line 218 "CSSValueKeywords.gperf"
+      {"n-resize", CSSValueNResize},
+#line 509 "CSSValueKeywords.gperf"
+      {"thistle", CSSValueThistle},
+#line 455 "CSSValueKeywords.gperf"
+      {"lightsalmon", CSSValueLightsalmon},
+#line 399 "CSSValueKeywords.gperf"
       {"chocolate", CSSValueChocolate},
-#line 274 "CSSValueKeywords.gperf"
-      {"pre-line", CSSValuePreLine},
+#line 279 "CSSValueKeywords.gperf"
+      {"show", CSSValueShow},
+#line 257 "CSSValueKeywords.gperf"
+      {"higher", CSSValueHigher},
+#line 520 "CSSValueKeywords.gperf"
+      {"srgb", CSSValueSrgb},
 #line 187 "CSSValueKeywords.gperf"
       {"compact", CSSValueCompact},
-#line 522 "CSSValueKeywords.gperf"
-      {"bevel", CSSValueBevel},
-#line 504 "CSSValueKeywords.gperf"
+#line 309 "CSSValueKeywords.gperf"
+      {"ignore", CSSValueIgnore},
+#line 510 "CSSValueKeywords.gperf"
       {"tomato", CSSValueTomato},
-#line 365 "CSSValueKeywords.gperf"
-      {"lines", CSSValueLines},
+#line 90 "CSSValueKeywords.gperf"
+      {"white", CSSValueWhite},
 #line 51 "CSSValueKeywords.gperf"
       {"small", CSSValueSmall},
-#line 379 "CSSValueKeywords.gperf"
-      {"fill", CSSValueFill},
-#line 359 "CSSValueKeywords.gperf"
+#line 362 "CSSValueKeywords.gperf"
       {"content", CSSValueContent},
-#line 209 "CSSValueKeywords.gperf"
-      {"alias", CSSValueAlias},
-#line 246 "CSSValueKeywords.gperf"
-      {"below", CSSValueBelow},
-#line 317 "CSSValueKeywords.gperf"
-      {"wave", CSSValueWave},
-#line 81 "CSSValueKeywords.gperf"
-      {"lime", CSSValueLime},
-#line 164 "CSSValueKeywords.gperf"
-      {"circle", CSSValueCircle},
+#line 285 "CSSValueKeywords.gperf"
+      {"stretch", CSSValueStretch},
 #line 82 "CSSValueKeywords.gperf"
       {"maroon", CSSValueMaroon},
-#line 457 "CSSValueKeywords.gperf"
-      {"linen", CSSValueLinen},
-#line 368 "CSSValueKeywords.gperf"
+#line 293 "CSSValueKeywords.gperf"
+      {"single", CSSValueSingle},
+#line 374 "CSSValueKeywords.gperf"
       {"ease", CSSValueEase},
-#line 490 "CSSValueKeywords.gperf"
+#line 155 "CSSValueKeywords.gperf"
+      {"right", CSSValueRight},
+#line 496 "CSSValueKeywords.gperf"
       {"salmon", CSSValueSalmon},
-#line 502 "CSSValueKeywords.gperf"
+#line 508 "CSSValueKeywords.gperf"
       {"tan", CSSValueTan},
-#line 89 "CSSValueKeywords.gperf"
-      {"teal", CSSValueTeal},
-#line 494 "CSSValueKeywords.gperf"
-      {"sienna", CSSValueSienna},
-#line 348 "CSSValueKeywords.gperf"
+#line 544 "CSSValueKeywords.gperf"
+      {"tb-rl", CSSValueTbRl},
+#line 39 "CSSValueKeywords.gperf"
+      {"lighter", CSSValueLighter},
+#line 202 "CSSValueKeywords.gperf"
+      {"crosshair", CSSValueCrosshair},
+#line 59 "CSSValueKeywords.gperf"
+      {"wider", CSSValueWider},
+#line 351 "CSSValueKeywords.gperf"
       {"caret", CSSValueCaret},
 #line 189 "CSSValueKeywords.gperf"
       {"table", CSSValueTable},
-#line 312 "CSSValueKeywords.gperf"
-      {"clip", CSSValueClip},
-#line 397 "CSSValueKeywords.gperf"
-      {"crimson", CSSValueCrimson},
-#line 389 "CSSValueKeywords.gperf"
+#line 332 "CSSValueKeywords.gperf"
+      {"listitem", CSSValueListitem},
+#line 475 "CSSValueKeywords.gperf"
+      {"mintcream", CSSValueMintcream},
+#line 222 "CSSValueKeywords.gperf"
+      {"w-resize", CSSValueWResize},
+#line 542 "CSSValueKeywords.gperf"
+      {"lr-tb", CSSValueLrTb},
+#line 179 "CSSValueKeywords.gperf"
+      {"hiragana", CSSValueHiragana},
+#line 236 "CSSValueKeywords.gperf"
+      {"rtl", CSSValueRtl},
+#line 527 "CSSValueKeywords.gperf"
+      {"miter", CSSValueMiter},
+#line 448 "CSSValueKeywords.gperf"
+      {"lightcoral", CSSValueLightcoral},
+#line 440 "CSSValueKeywords.gperf"
+      {"indigo", CSSValueIndigo},
+#line 243 "CSSValueKeywords.gperf"
+      {"absolute", CSSValueAbsolute},
+#line 289 "CSSValueKeywords.gperf"
+      {"horizontal", CSSValueHorizontal},
+#line 404 "CSSValueKeywords.gperf"
+      {"cyan", CSSValueCyan},
+#line 11 "CSSValueKeywords.gperf"
+      {"inherit", CSSValueInherit},
+#line 464 "CSSValueKeywords.gperf"
+      {"magenta", CSSValueMagenta},
+#line 516 "CSSValueKeywords.gperf"
+      {"nonzero", CSSValueNonzero},
+#line 204 "CSSValueKeywords.gperf"
+      {"pointer", CSSValuePointer},
+#line 283 "CSSValueKeywords.gperf"
+      {"underline", CSSValueUnderline},
+#line 130 "CSSValueKeywords.gperf"
+      {"no-repeat", CSSValueNoRepeat},
+#line 387 "CSSValueKeywords.gperf"
+      {"aliceblue", CSSValueAliceblue},
+#line 112 "CSSValueKeywords.gperf"
+      {"match", CSSValueMatch},
+#line 325 "CSSValueKeywords.gperf"
+      {"radio", CSSValueRadio},
+#line 249 "CSSValueKeywords.gperf"
+      {"both", CSSValueBoth},
+#line 17 "CSSValueKeywords.gperf"
+      {"ridge", CSSValueRidge},
+#line 57 "CSSValueKeywords.gperf"
+      {"smaller", CSSValueSmaller},
+#line 395 "CSSValueKeywords.gperf"
       {"brown", CSSValueBrown},
-#line 235 "CSSValueKeywords.gperf"
-      {"ltr", CSSValueLtr},
+#line 230 "CSSValueKeywords.gperf"
+      {"wait", CSSValueWait},
+#line 258 "CSSValueKeywords.gperf"
+      {"invert", CSSValueInvert},
+#line 540 "CSSValueKeywords.gperf"
+      {"no-change", CSSValueNoChange},
+#line 32 "CSSValueKeywords.gperf"
+      {"italic", CSSValueItalic},
+#line 224 "CSSValueKeywords.gperf"
+      {"ns-resize", CSSValueNsResize},
+#line 304 "CSSValueKeywords.gperf"
+      {"alternate", CSSValueAlternate},
+#line 272 "CSSValueKeywords.gperf"
+      {"portrait", CSSValuePortrait},
+#line 105 "CSSValueKeywords.gperf"
+      {"highlight", CSSValueHighlight},
+#line 53 "CSSValueKeywords.gperf"
+      {"large", CSSValueLarge},
+#line 310 "CSSValueKeywords.gperf"
+      {"intrinsic", CSSValueIntrinsic},
+#line 317 "CSSValueKeywords.gperf"
+      {"wave", CSSValueWave},
+#line 501 "CSSValueKeywords.gperf"
+      {"skyblue", CSSValueSkyblue},
+#line 302 "CSSValueKeywords.gperf"
+      {"infinite", CSSValueInfinite},
+#line 280 "CSSValueKeywords.gperf"
+      {"static", CSSValueStatic},
+#line 462 "CSSValueKeywords.gperf"
+      {"limegreen", CSSValueLimegreen},
+#line 543 "CSSValueKeywords.gperf"
+      {"rl-tb", CSSValueRlTb},
+#line 447 "CSSValueKeywords.gperf"
+      {"lightblue", CSSValueLightblue},
+#line 85 "CSSValueKeywords.gperf"
+      {"orange", CSSValueOrange},
+#line 151 "CSSValueKeywords.gperf"
+      {"bottom", CSSValueBottom},
+#line 210 "CSSValueKeywords.gperf"
+      {"progress", CSSValueProgress},
+#line 318 "CSSValueKeywords.gperf"
+      {"continuous", CSSValueContinuous},
+#line 385 "CSSValueKeywords.gperf"
+      {"fill", CSSValueFill},
+#line 144 "CSSValueKeywords.gperf"
+      {"baseline", CSSValueBaseline},
+#line 538 "CSSValueKeywords.gperf"
+      {"mathematical", CSSValueMathematical},
+#line 207 "CSSValueKeywords.gperf"
+      {"cell", CSSValueCell},
+#line 273 "CSSValueKeywords.gperf"
+      {"pre", CSSValuePre},
+#line 452 "CSSValueKeywords.gperf"
+      {"lightgreen", CSSValueLightgreen},
+#line 460 "CSSValueKeywords.gperf"
+      {"lightsteelblue", CSSValueLightsteelblue},
+#line 456 "CSSValueKeywords.gperf"
+      {"lightseagreen", CSSValueLightseagreen},
+#line 500 "CSSValueKeywords.gperf"
+      {"sienna", CSSValueSienna},
+#line 286 "CSSValueKeywords.gperf"
+      {"start", CSSValueStart},
+#line 231 "CSSValueKeywords.gperf"
+      {"help", CSSValueHelp},
+#line 303 "CSSValueKeywords.gperf"
+      {"slide", CSSValueSlide},
+#line 145 "CSSValueKeywords.gperf"
+      {"middle", CSSValueMiddle},
+#line 58 "CSSValueKeywords.gperf"
+      {"larger", CSSValueLarger},
 #line 277 "CSSValueKeywords.gperf"
       {"scroll", CSSValueScroll},
-#line 87 "CSSValueKeywords.gperf"
-      {"red", CSSValueRed},
-#line 91 "CSSValueKeywords.gperf"
-      {"yellow", CSSValueYellow},
 #line 253 "CSSValueKeywords.gperf"
       {"embed", CSSValueEmbed},
-#line 297 "CSSValueKeywords.gperf"
-      {"ahead", CSSValueAhead},
-#line 536 "CSSValueKeywords.gperf"
-      {"lr-tb", CSSValueLrTb},
+#line 92 "CSSValueKeywords.gperf"
+      {"transparent", CSSValueTransparent},
+#line 14 "CSSValueKeywords.gperf"
+      {"hidden", CSSValueHidden},
+#line 397 "CSSValueKeywords.gperf"
+      {"cadetblue", CSSValueCadetblue},
+#line 478 "CSSValueKeywords.gperf"
+      {"navajowhite", CSSValueNavajowhite},
+#line 502 "CSSValueKeywords.gperf"
+      {"slateblue", CSSValueSlateblue},
+#line 308 "CSSValueKeywords.gperf"
+      {"element", CSSValueElement},
+#line 260 "CSSValueKeywords.gperf"
+      {"level", CSSValueLevel},
+#line 87 "CSSValueKeywords.gperf"
+      {"red", CSSValueRed},
+#line 494 "CSSValueKeywords.gperf"
+      {"royalblue", CSSValueRoyalblue},
+#line 163 "CSSValueKeywords.gperf"
+      {"disc", CSSValueDisc},
+#line 433 "CSSValueKeywords.gperf"
+      {"ghostwhite", CSSValueGhostwhite},
 #line 25 "CSSValueKeywords.gperf"
       {"menu", CSSValueMenu},
-#line 540 "CSSValueKeywords.gperf"
-      {"rl", CSSValueRl},
-#line 483 "CSSValueKeywords.gperf"
+#line 21 "CSSValueKeywords.gperf"
+      {"solid", CSSValueSolid},
+#line 24 "CSSValueKeywords.gperf"
+      {"icon", CSSValueIcon},
+#line 60 "CSSValueKeywords.gperf"
+      {"narrower", CSSValueNarrower},
+#line 484 "CSSValueKeywords.gperf"
+      {"palegreen", CSSValuePalegreen},
+#line 489 "CSSValueKeywords.gperf"
       {"peru", CSSValuePeru},
-#line 301 "CSSValueKeywords.gperf"
-      {"fast", CSSValueFast},
 #line 131 "CSSValueKeywords.gperf"
       {"clear", CSSValueClear},
-#line 282 "CSSValueKeywords.gperf"
-      {"thin", CSSValueThin},
-#line 90 "CSSValueKeywords.gperf"
-      {"white", CSSValueWhite},
 #line 52 "CSSValueKeywords.gperf"
       {"medium", CSSValueMedium},
-#line 21 "CSSValueKeywords.gperf"
-      {"solid", CSSValueSolid},
-#line 24 "CSSValueKeywords.gperf"
-      {"icon", CSSValueIcon},
-#line 12 "CSSValueKeywords.gperf"
-      {"initial", CSSValueInitial},
-#line 245 "CSSValueKeywords.gperf"
-      {"avoid", CSSValueAvoid},
-#line 35 "CSSValueKeywords.gperf"
-      {"small-caps", CSSValueSmallCaps},
-#line 229 "CSSValueKeywords.gperf"
-      {"text", CSSValueText},
-#line 116 "CSSValueKeywords.gperf"
-      {"threedface", CSSValueThreedface},
-#line 197 "CSSValueKeywords.gperf"
-      {"table-cell", CSSValueTableCell},
-#line 156 "CSSValueKeywords.gperf"
-      {"center", CSSValueCenter},
-#line 370 "CSSValueKeywords.gperf"
-      {"ease-in", CSSValueEaseIn},
-#line 503 "CSSValueKeywords.gperf"
-      {"thistle", CSSValueThistle},
-#line 471 "CSSValueKeywords.gperf"
+#line 477 "CSSValueKeywords.gperf"
       {"moccasin", CSSValueMoccasin},
-#line 271 "CSSValueKeywords.gperf"
-      {"overline", CSSValueOverline},
 #line 162 "CSSValueKeywords.gperf"
       {"inside", CSSValueInside},
-#line 526 "CSSValueKeywords.gperf"
+#line 499 "CSSValueKeywords.gperf"
+      {"seashell", CSSValueSeashell},
+#line 513 "CSSValueKeywords.gperf"
+      {"wheat", CSSValueWheat},
+#line 150 "CSSValueKeywords.gperf"
+      {"top", CSSValueTop},
+#line 156 "CSSValueKeywords.gperf"
+      {"center", CSSValueCenter},
+#line 474 "CSSValueKeywords.gperf"
+      {"midnightblue", CSSValueMidnightblue},
+#line 532 "CSSValueKeywords.gperf"
       {"central", CSSValueCentral},
-#line 340 "CSSValueKeywords.gperf"
+#line 298 "CSSValueKeywords.gperf"
+      {"up", CSSValueUp},
+#line 521 "CSSValueKeywords.gperf"
+      {"linearrgb", CSSValueLinearrgb},
+#line 537 "CSSValueKeywords.gperf"
+      {"hanging", CSSValueHanging},
+#line 398 "CSSValueKeywords.gperf"
+      {"chartreuse", CSSValueChartreuse},
+#line 80 "CSSValueKeywords.gperf"
+      {"green", CSSValueGreen},
+#line 89 "CSSValueKeywords.gperf"
+      {"teal", CSSValueTeal},
+#line 245 "CSSValueKeywords.gperf"
+      {"avoid", CSSValueAvoid},
+#line 372 "CSSValueKeywords.gperf"
+      {"flat", CSSValueFlat},
+#line 343 "CSSValueKeywords.gperf"
       {"menulist", CSSValueMenulist},
-#line 538 "CSSValueKeywords.gperf"
-      {"tb-rl", CSSValueTbRl},
-#line 258 "CSSValueKeywords.gperf"
-      {"invert", CSSValueInvert},
-#line 374 "CSSValueKeywords.gperf"
+#line 255 "CSSValueKeywords.gperf"
+      {"hand", CSSValueHand},
+#line 380 "CSSValueKeywords.gperf"
       {"reset", CSSValueReset},
-#line 265 "CSSValueKeywords.gperf"
-      {"mix", CSSValueMix},
-#line 243 "CSSValueKeywords.gperf"
-      {"absolute", CSSValueAbsolute},
-#line 232 "CSSValueKeywords.gperf"
-      {"all-scroll", CSSValueAllScroll},
-#line 190 "CSSValueKeywords.gperf"
-      {"inline-table", CSSValueInlineTable},
-#line 83 "CSSValueKeywords.gperf"
-      {"navy", CSSValueNavy},
-#line 11 "CSSValueKeywords.gperf"
-      {"inherit", CSSValueInherit},
-#line 332 "CSSValueKeywords.gperf"
-      {"listitem", CSSValueListitem},
-#line 303 "CSSValueKeywords.gperf"
-      {"slide", CSSValueSlide},
-#line 230 "CSSValueKeywords.gperf"
-      {"wait", CSSValueWait},
-#line 145 "CSSValueKeywords.gperf"
-      {"middle", CSSValueMiddle},
-#line 513 "CSSValueKeywords.gperf"
-      {"new", CSSValueNew},
-#line 275 "CSSValueKeywords.gperf"
-      {"pre-wrap", CSSValuePreWrap},
+#line 175 "CSSValueKeywords.gperf"
+      {"hebrew", CSSValueHebrew},
+#line 219 "CSSValueKeywords.gperf"
+      {"se-resize", CSSValueSeResize},
 #line 37 "CSSValueKeywords.gperf"
       {"bold", CSSValueBold},
-#line 144 "CSSValueKeywords.gperf"
-      {"baseline", CSSValueBaseline},
-#line 72 "CSSValueKeywords.gperf"
-      {"fantasy", CSSValueFantasy},
-#line 141 "CSSValueKeywords.gperf"
-      {"xor", CSSValueXor},
-#line 27 "CSSValueKeywords.gperf"
-      {"small-caption", CSSValueSmallCaption},
-#line 130 "CSSValueKeywords.gperf"
-      {"no-repeat", CSSValueNoRepeat},
-#line 325 "CSSValueKeywords.gperf"
-      {"radio", CSSValueRadio},
+#line 154 "CSSValueKeywords.gperf"
+      {"left", CSSValueLeft},
+#line 528 "CSSValueKeywords.gperf"
+      {"bevel", CSSValueBevel},
+#line 439 "CSSValueKeywords.gperf"
+      {"indianred", CSSValueIndianred},
+#line 432 "CSSValueKeywords.gperf"
+      {"gainsboro", CSSValueGainsboro},
+#line 322 "CSSValueKeywords.gperf"
+      {"space", CSSValueSpace},
+#line 301 "CSSValueKeywords.gperf"
+      {"fast", CSSValueFast},
+#line 33 "CSSValueKeywords.gperf"
+      {"oblique", CSSValueOblique},
+#line 216 "CSSValueKeywords.gperf"
+      {"ne-resize", CSSValueNeResize},
 #line 259 "CSSValueKeywords.gperf"
       {"landscape", CSSValueLandscape},
-#line 369 "CSSValueKeywords.gperf"
-      {"linear", CSSValueLinear},
-#line 57 "CSSValueKeywords.gperf"
-      {"smaller", CSSValueSmaller},
-#line 59 "CSSValueKeywords.gperf"
-      {"wider", CSSValueWider},
+#line 246 "CSSValueKeywords.gperf"
+      {"below", CSSValueBelow},
 #line 120 "CSSValueKeywords.gperf"
       {"window", CSSValueWindow},
-#line 32 "CSSValueKeywords.gperf"
-      {"italic", CSSValueItalic},
-#line 163 "CSSValueKeywords.gperf"
-      {"disc", CSSValueDisc},
-#line 198 "CSSValueKeywords.gperf"
-      {"table-caption", CSSValueTableCaption},
-#line 272 "CSSValueKeywords.gperf"
-      {"portrait", CSSValuePortrait},
-#line 185 "CSSValueKeywords.gperf"
-      {"list-item", CSSValueListItem},
-#line 231 "CSSValueKeywords.gperf"
-      {"help", CSSValueHelp},
-#line 270 "CSSValueKeywords.gperf"
-      {"overlay", CSSValueOverlay},
-#line 280 "CSSValueKeywords.gperf"
-      {"static", CSSValueStatic},
-#line 166 "CSSValueKeywords.gperf"
-      {"decimal", CSSValueDecimal},
-#line 148 "CSSValueKeywords.gperf"
-      {"text-top", CSSValueTextTop},
-#line 511 "CSSValueKeywords.gperf"
-      {"evenodd", CSSValueEvenodd},
-#line 236 "CSSValueKeywords.gperf"
-      {"rtl", CSSValueRtl},
-#line 151 "CSSValueKeywords.gperf"
-      {"bottom", CSSValueBottom},
-#line 537 "CSSValueKeywords.gperf"
-      {"rl-tb", CSSValueRlTb},
-#line 50 "CSSValueKeywords.gperf"
-      {"x-small", CSSValueXSmall},
-#line 63 "CSSValueKeywords.gperf"
-      {"condensed", CSSValueCondensed},
-#line 70 "CSSValueKeywords.gperf"
-      {"sans-serif", CSSValueSansSerif},
-#line 363 "CSSValueKeywords.gperf"
-      {"logical", CSSValueLogical},
-#line 288 "CSSValueKeywords.gperf"
-      {"reverse", CSSValueReverse},
-#line 435 "CSSValueKeywords.gperf"
-      {"ivory", CSSValueIvory},
-#line 469 "CSSValueKeywords.gperf"
-      {"mintcream", CSSValueMintcream},
-#line 295 "CSSValueKeywords.gperf"
-      {"forwards", CSSValueForwards},
-#line 283 "CSSValueKeywords.gperf"
-      {"underline", CSSValueUnderline},
-#line 433 "CSSValueKeywords.gperf"
-      {"indianred", CSSValueIndianred},
-#line 440 "CSSValueKeywords.gperf"
-      {"lemonchiffon", CSSValueLemonchiffon},
-#line 354 "CSSValueKeywords.gperf"
-      {"textfield", CSSValueTextfield},
-#line 204 "CSSValueKeywords.gperf"
-      {"pointer", CSSValuePointer},
-#line 355 "CSSValueKeywords.gperf"
-      {"textarea", CSSValueTextarea},
-#line 194 "CSSValueKeywords.gperf"
-      {"table-row", CSSValueTableRow},
-#line 371 "CSSValueKeywords.gperf"
-      {"ease-out", CSSValueEaseOut},
-#line 254 "CSSValueKeywords.gperf"
-      {"fixed", CSSValueFixed},
-#line 304 "CSSValueKeywords.gperf"
-      {"alternate", CSSValueAlternate},
-#line 514 "CSSValueKeywords.gperf"
-      {"srgb", CSSValueSrgb},
-#line 291 "CSSValueKeywords.gperf"
-      {"inline-axis", CSSValueInlineAxis},
+#line 271 "CSSValueKeywords.gperf"
+      {"overline", CSSValueOverline},
+#line 434 "CSSValueKeywords.gperf"
+      {"gold", CSSValueGold},
 #line 211 "CSSValueKeywords.gperf"
       {"no-drop", CSSValueNoDrop},
-#line 381 "CSSValueKeywords.gperf"
-      {"aliceblue", CSSValueAliceblue},
-#line 196 "CSSValueKeywords.gperf"
-      {"table-column", CSSValueTableColumn},
-#line 150 "CSSValueKeywords.gperf"
-      {"top", CSSValueTop},
-#line 256 "CSSValueKeywords.gperf"
-      {"hide", CSSValueHide},
-#line 310 "CSSValueKeywords.gperf"
-      {"intrinsic", CSSValueIntrinsic},
-#line 493 "CSSValueKeywords.gperf"
-      {"seashell", CSSValueSeashell},
-#line 244 "CSSValueKeywords.gperf"
-      {"always", CSSValueAlways},
-#line 92 "CSSValueKeywords.gperf"
-      {"transparent", CSSValueTransparent},
+#line 524 "CSSValueKeywords.gperf"
+      {"crispedges", CSSValueCrispedges},
+#line 384 "CSSValueKeywords.gperf"
+      {"painted", CSSValuePainted},
+#line 490 "CSSValueKeywords.gperf"
+      {"pink", CSSValuePink},
 #line 391 "CSSValueKeywords.gperf"
-      {"cadetblue", CSSValueCadetblue},
-#line 338 "CSSValueKeywords.gperf"
-      {"media-slider", CSSValueMediaSlider},
-#line 496 "CSSValueKeywords.gperf"
-      {"slateblue", CSSValueSlateblue},
-#line 64 "CSSValueKeywords.gperf"
-      {"semi-condensed", CSSValueSemiCondensed},
-#line 212 "CSSValueKeywords.gperf"
-      {"not-allowed", CSSValueNotAllowed},
+      {"beige", CSSValueBeige},
+#line 141 "CSSValueKeywords.gperf"
+      {"xor", CSSValueXor},
+#line 288 "CSSValueKeywords.gperf"
+      {"reverse", CSSValueReverse},
 #line 146 "CSSValueKeywords.gperf"
       {"sub", CSSValueSub},
-#line 138 "CSSValueKeywords.gperf"
-      {"destination-in", CSSValueDestinationIn},
-#line 501 "CSSValueKeywords.gperf"
-      {"steelblue", CSSValueSteelblue},
-#line 318 "CSSValueKeywords.gperf"
-      {"continuous", CSSValueContinuous},
-#line 49 "CSSValueKeywords.gperf"
-      {"xx-small", CSSValueXxSmall},
+#line 84 "CSSValueKeywords.gperf"
+      {"olive", CSSValueOlive},
+#line 265 "CSSValueKeywords.gperf"
+      {"mix", CSSValueMix},
 #line 114 "CSSValueKeywords.gperf"
       {"scrollbar", CSSValueScrollbar},
-#line 358 "CSSValueKeywords.gperf"
+#line 361 "CSSValueKeywords.gperf"
       {"border", CSSValueBorder},
-#line 378 "CSSValueKeywords.gperf"
-      {"painted", CSSValuePainted},
-#line 242 "CSSValueKeywords.gperf"
-      {"above", CSSValueAbove},
-#line 299 "CSSValueKeywords.gperf"
-      {"down", CSSValueDown},
-#line 215 "CSSValueKeywords.gperf"
-      {"e-resize", CSSValueEResize},
 #line 38 "CSSValueKeywords.gperf"
       {"bolder", CSSValueBolder},
-#line 521 "CSSValueKeywords.gperf"
-      {"miter", CSSValueMiter},
-#line 221 "CSSValueKeywords.gperf"
-      {"s-resize", CSSValueSResize},
-#line 322 "CSSValueKeywords.gperf"
-      {"space", CSSValueSpace},
-#line 437 "CSSValueKeywords.gperf"
-      {"lavender", CSSValueLavender},
-#line 485 "CSSValueKeywords.gperf"
+#line 23 "CSSValueKeywords.gperf"
+      {"caption", CSSValueCaption},
+#line 242 "CSSValueKeywords.gperf"
+      {"above", CSSValueAbove},
+#line 430 "CSSValueKeywords.gperf"
+      {"floralwhite", CSSValueFloralwhite},
+#line 507 "CSSValueKeywords.gperf"
+      {"steelblue", CSSValueSteelblue},
+#line 536 "CSSValueKeywords.gperf"
+      {"alphabetic", CSSValueAlphabetic},
+#line 281 "CSSValueKeywords.gperf"
+      {"thick", CSSValueThick},
+#line 491 "CSSValueKeywords.gperf"
       {"plum", CSSValuePlum},
-#line 263 "CSSValueKeywords.gperf"
-      {"lower", CSSValueLower},
-#line 460 "CSSValueKeywords.gperf"
-      {"mediumblue", CSSValueMediumblue},
-#line 458 "CSSValueKeywords.gperf"
-      {"magenta", CSSValueMagenta},
-#line 140 "CSSValueKeywords.gperf"
-      {"destination-atop", CSSValueDestinationAtop},
-#line 218 "CSSValueKeywords.gperf"
-      {"n-resize", CSSValueNResize},
-#line 222 "CSSValueKeywords.gperf"
-      {"w-resize", CSSValueWResize},
-#line 149 "CSSValueKeywords.gperf"
-      {"text-bottom", CSSValueTextBottom},
+#line 402 "CSSValueKeywords.gperf"
+      {"cornsilk", CSSValueCornsilk},
 #line 86 "CSSValueKeywords.gperf"
       {"purple", CSSValuePurple},
-#line 286 "CSSValueKeywords.gperf"
-      {"start", CSSValueStart},
+#line 386 "CSSValueKeywords.gperf"
+      {"stroke", CSSValueStroke},
+#line 50 "CSSValueKeywords.gperf"
+      {"x-small", CSSValueXSmall},
+#line 69 "CSSValueKeywords.gperf"
+      {"serif", CSSValueSerif},
+#line 392 "CSSValueKeywords.gperf"
+      {"bisque", CSSValueBisque},
+#line 466 "CSSValueKeywords.gperf"
+      {"mediumblue", CSSValueMediumblue},
+#line 431 "CSSValueKeywords.gperf"
+      {"forestgreen", CSSValueForestgreen},
+#line 535 "CSSValueKeywords.gperf"
+      {"ideographic", CSSValueIdeographic},
+#line 512 "CSSValueKeywords.gperf"
+      {"violet", CSSValueViolet},
+#line 201 "CSSValueKeywords.gperf"
+      {"auto", CSSValueAuto},
+#line 390 "CSSValueKeywords.gperf"
+      {"azure", CSSValueAzure},
+#line 443 "CSSValueKeywords.gperf"
+      {"lavender", CSSValueLavender},
+#line 75 "CSSValueKeywords.gperf"
+      {"aqua", CSSValueAqua},
+#line 263 "CSSValueKeywords.gperf"
+      {"lower", CSSValueLower},
+#line 237 "CSSValueKeywords.gperf"
+      {"capitalize", CSSValueCapitalize},
+#line 468 "CSSValueKeywords.gperf"
+      {"mediumpurple", CSSValueMediumpurple},
+#line 88 "CSSValueKeywords.gperf"
+      {"silver", CSSValueSilver},
+#line 454 "CSSValueKeywords.gperf"
+      {"lightpink", CSSValueLightpink},
+#line 297 "CSSValueKeywords.gperf"
+      {"ahead", CSSValueAhead},
+#line 363 "CSSValueKeywords.gperf"
+      {"padding", CSSValuePadding},
+#line 449 "CSSValueKeywords.gperf"
+      {"lightcyan", CSSValueLightcyan},
+#line 248 "CSSValueKeywords.gperf"
+      {"blink", CSSValueBlink},
 #line 239 "CSSValueKeywords.gperf"
       {"lowercase", CSSValueLowercase},
-#line 372 "CSSValueKeywords.gperf"
-      {"ease-in-out", CSSValueEaseInOut},
-#line 60 "CSSValueKeywords.gperf"
-      {"narrower", CSSValueNarrower},
-#line 311 "CSSValueKeywords.gperf"
-      {"min-intrinsic", CSSValueMinIntrinsic},
-#line 175 "CSSValueKeywords.gperf"
-      {"hebrew", CSSValueHebrew},
-#line 309 "CSSValueKeywords.gperf"
-      {"ignore", CSSValueIgnore},
-#line 121 "CSSValueKeywords.gperf"
-      {"windowframe", CSSValueWindowframe},
-#line 290 "CSSValueKeywords.gperf"
-      {"vertical", CSSValueVertical},
-#line 268 "CSSValueKeywords.gperf"
-      {"nowrap", CSSValueNowrap},
-#line 298 "CSSValueKeywords.gperf"
-      {"up", CSSValueUp},
-#line 285 "CSSValueKeywords.gperf"
-      {"stretch", CSSValueStretch},
-#line 132 "CSSValueKeywords.gperf"
-      {"copy", CSSValueCopy},
-#line 533 "CSSValueKeywords.gperf"
-      {"use-script", CSSValueUseScript},
-#line 395 "CSSValueKeywords.gperf"
-      {"cornflowerblue", CSSValueCornflowerblue},
-#line 396 "CSSValueKeywords.gperf"
-      {"cornsilk", CSSValueCornsilk},
-#line 464 "CSSValueKeywords.gperf"
-      {"mediumslateblue", CSSValueMediumslateblue},
-#line 19 "CSSValueKeywords.gperf"
-      {"dotted", CSSValueDotted},
-#line 470 "CSSValueKeywords.gperf"
-      {"mistyrose", CSSValueMistyrose},
-#line 202 "CSSValueKeywords.gperf"
-      {"crosshair", CSSValueCrosshair},
-#line 113 "CSSValueKeywords.gperf"
-      {"menutext", CSSValueMenutext},
+#line 498 "CSSValueKeywords.gperf"
+      {"seagreen", CSSValueSeagreen},
 #line 294 "CSSValueKeywords.gperf"
       {"multiple", CSSValueMultiple},
 #line 77 "CSSValueKeywords.gperf"
       {"blue", CSSValueBlue},
-#line 23 "CSSValueKeywords.gperf"
-      {"caption", CSSValueCaption},
-#line 398 "CSSValueKeywords.gperf"
-      {"cyan", CSSValueCyan},
-#line 80 "CSSValueKeywords.gperf"
-      {"green", CSSValueGreen},
-#line 33 "CSSValueKeywords.gperf"
-      {"oblique", CSSValueOblique},
-#line 373 "CSSValueKeywords.gperf"
-      {"document", CSSValueDocument},
-#line 255 "CSSValueKeywords.gperf"
-      {"hand", CSSValueHand},
-#line 84 "CSSValueKeywords.gperf"
-      {"olive", CSSValueOlive},
-#line 362 "CSSValueKeywords.gperf"
-      {"content-box", CSSValueContentBox},
-#line 127 "CSSValueKeywords.gperf"
-      {"repeat", CSSValueRepeat},
-#line 278 "CSSValueKeywords.gperf"
-      {"separate", CSSValueSeparate},
-#line 434 "CSSValueKeywords.gperf"
-      {"indigo", CSSValueIndigo},
-#line 154 "CSSValueKeywords.gperf"
-      {"left", CSSValueLeft},
-#line 489 "CSSValueKeywords.gperf"
-      {"saddlebrown", CSSValueSaddlebrown},
-#line 112 "CSSValueKeywords.gperf"
-      {"match", CSSValueMatch},
-#line 14 "CSSValueKeywords.gperf"
-      {"hidden", CSSValueHidden},
-#line 462 "CSSValueKeywords.gperf"
-      {"mediumpurple", CSSValueMediumpurple},
-#line 249 "CSSValueKeywords.gperf"
-      {"both", CSSValueBoth},
-#line 331 "CSSValueKeywords.gperf"
-      {"listbox", CSSValueListbox},
-#line 424 "CSSValueKeywords.gperf"
-      {"floralwhite", CSSValueFloralwhite},
-#line 201 "CSSValueKeywords.gperf"
-      {"auto", CSSValueAuto},
 #line 184 "CSSValueKeywords.gperf"
       {"block", CSSValueBlock},
-#line 484 "CSSValueKeywords.gperf"
-      {"pink", CSSValuePink},
-#line 384 "CSSValueKeywords.gperf"
-      {"azure", CSSValueAzure},
-#line 75 "CSSValueKeywords.gperf"
-      {"aqua", CSSValueAqua},
-#line 172 "CSSValueKeywords.gperf"
-      {"lower-latin", CSSValueLowerLatin},
-#line 262 "CSSValueKeywords.gperf"
-      {"loud", CSSValueLoud},
-#line 139 "CSSValueKeywords.gperf"
-      {"destination-out", CSSValueDestinationOut},
-#line 506 "CSSValueKeywords.gperf"
-      {"violet", CSSValueViolet},
-#line 380 "CSSValueKeywords.gperf"
-      {"stroke", CSSValueStroke},
-#line 320 "CSSValueKeywords.gperf"
-      {"break-all", CSSValueBreakAll},
-#line 482 "CSSValueKeywords.gperf"
-      {"peachpuff", CSSValuePeachpuff},
-#line 476 "CSSValueKeywords.gperf"
-      {"orchid", CSSValueOrchid},
-#line 208 "CSSValueKeywords.gperf"
-      {"context-menu", CSSValueContextMenu},
-#line 431 "CSSValueKeywords.gperf"
-      {"honeydew", CSSValueHoneydew},
-#line 219 "CSSValueKeywords.gperf"
-      {"se-resize", CSSValueSeResize},
+#line 469 "CSSValueKeywords.gperf"
+      {"mediumseagreen", CSSValueMediumseagreen},
+#line 470 "CSSValueKeywords.gperf"
+      {"mediumslateblue", CSSValueMediumslateblue},
+#line 514 "CSSValueKeywords.gperf"
+      {"whitesmoke", CSSValueWhitesmoke},
 #line 18 "CSSValueKeywords.gperf"
       {"outset", CSSValueOutset},
-#line 281 "CSSValueKeywords.gperf"
-      {"thick", CSSValueThick},
-#line 305 "CSSValueKeywords.gperf"
-      {"read-only", CSSValueReadOnly},
-#line 510 "CSSValueKeywords.gperf"
-      {"nonzero", CSSValueNonzero},
-#line 472 "CSSValueKeywords.gperf"
-      {"navajowhite", CSSValueNavajowhite},
-#line 53 "CSSValueKeywords.gperf"
-      {"large", CSSValueLarge},
-#line 314 "CSSValueKeywords.gperf"
-      {"discard", CSSValueDiscard},
-#line 216 "CSSValueKeywords.gperf"
-      {"ne-resize", CSSValueNeResize},
-#line 342 "CSSValueKeywords.gperf"
-      {"menulist-text", CSSValueMenulistText},
-#line 302 "CSSValueKeywords.gperf"
-      {"infinite", CSSValueInfinite},
-#line 250 "CSSValueKeywords.gperf"
-      {"close-quote", CSSValueCloseQuote},
-#line 319 "CSSValueKeywords.gperf"
-      {"skip-white-space", CSSValueSkipWhiteSpace},
-#line 85 "CSSValueKeywords.gperf"
-      {"orange", CSSValueOrange},
-#line 293 "CSSValueKeywords.gperf"
-      {"single", CSSValueSingle},
-#line 508 "CSSValueKeywords.gperf"
-      {"whitesmoke", CSSValueWhitesmoke},
-#line 532 "CSSValueKeywords.gperf"
-      {"mathematical", CSSValueMathematical},
-#line 341 "CSSValueKeywords.gperf"
-      {"menulist-button", CSSValueMenulistButton},
-#line 335 "CSSValueKeywords.gperf"
-      {"media-play-button", CSSValueMediaPlayButton},
-#line 122 "CSSValueKeywords.gperf"
-      {"windowtext", CSSValueWindowtext},
-#line 125 "CSSValueKeywords.gperf"
-      {"grey", CSSValueGrey},
-#line 276 "CSSValueKeywords.gperf"
-      {"relative", CSSValueRelative},
+#line 368 "CSSValueKeywords.gperf"
+      {"visual", CSSValueVisual},
+#line 268 "CSSValueKeywords.gperf"
+      {"nowrap", CSSValueNowrap},
+#line 232 "CSSValueKeywords.gperf"
+      {"all-scroll", CSSValueAllScroll},
+#line 438 "CSSValueKeywords.gperf"
+      {"hotpink", CSSValueHotpink},
+#line 116 "CSSValueKeywords.gperf"
+      {"threedface", CSSValueThreedface},
+#line 481 "CSSValueKeywords.gperf"
+      {"orangered", CSSValueOrangered},
+#line 482 "CSSValueKeywords.gperf"
+      {"orchid", CSSValueOrchid},
+#line 223 "CSSValueKeywords.gperf"
+      {"ew-resize", CSSValueEwResize},
+#line 220 "CSSValueKeywords.gperf"
+      {"sw-resize", CSSValueSwResize},
+#line 388 "CSSValueKeywords.gperf"
+      {"antiquewhite", CSSValueAntiquewhite},
+#line 461 "CSSValueKeywords.gperf"
+      {"lightyellow", CSSValueLightyellow},
+#line 16 "CSSValueKeywords.gperf"
+      {"groove", CSSValueGroove},
+#line 185 "CSSValueKeywords.gperf"
+      {"list-item", CSSValueListItem},
+#line 401 "CSSValueKeywords.gperf"
+      {"cornflowerblue", CSSValueCornflowerblue},
+#line 217 "CSSValueKeywords.gperf"
+      {"nw-resize", CSSValueNwResize},
+#line 63 "CSSValueKeywords.gperf"
+      {"condensed", CSSValueCondensed},
+#line 240 "CSSValueKeywords.gperf"
+      {"visible", CSSValueVisible},
+#line 165 "CSSValueKeywords.gperf"
+      {"square", CSSValueSquare},
+#line 177 "CSSValueKeywords.gperf"
+      {"georgian", CSSValueGeorgian},
+#line 35 "CSSValueKeywords.gperf"
+      {"small-caps", CSSValueSmallCaps},
+#line 331 "CSSValueKeywords.gperf"
+      {"listbox", CSSValueListbox},
+#line 197 "CSSValueKeywords.gperf"
+      {"table-cell", CSSValueTableCell},
+#line 376 "CSSValueKeywords.gperf"
+      {"ease-in", CSSValueEaseIn},
+#line 476 "CSSValueKeywords.gperf"
+      {"mistyrose", CSSValueMistyrose},
+#line 83 "CSSValueKeywords.gperf"
+      {"navy", CSSValueNavy},
 #line 76 "CSSValueKeywords.gperf"
       {"black", CSSValueBlack},
-#line 392 "CSSValueKeywords.gperf"
-      {"chartreuse", CSSValueChartreuse},
-#line 418 "CSSValueKeywords.gperf"
-      {"deeppink", CSSValueDeeppink},
-#line 186 "CSSValueKeywords.gperf"
-      {"run-in", CSSValueRunIn},
-#line 266 "CSSValueKeywords.gperf"
-      {"no-close-quote", CSSValueNoCloseQuote},
-#line 512 "CSSValueKeywords.gperf"
-      {"accumulate", CSSValueAccumulate},
-#line 224 "CSSValueKeywords.gperf"
-      {"ns-resize", CSSValueNsResize},
-#line 487 "CSSValueKeywords.gperf"
-      {"rosybrown", CSSValueRosybrown},
-#line 188 "CSSValueKeywords.gperf"
-      {"inline-block", CSSValueInlineBlock},
-#line 119 "CSSValueKeywords.gperf"
-      {"threedshadow", CSSValueThreedshadow},
 #line 495 "CSSValueKeywords.gperf"
-      {"skyblue", CSSValueSkyblue},
-#line 65 "CSSValueKeywords.gperf"
-      {"semi-expanded", CSSValueSemiExpanded},
+      {"saddlebrown", CSSValueSaddlebrown},
+#line 441 "CSSValueKeywords.gperf"
+      {"ivory", CSSValueIvory},
 #line 227 "CSSValueKeywords.gperf"
       {"col-resize", CSSValueColResize},
-#line 248 "CSSValueKeywords.gperf"
-      {"blink", CSSValueBlink},
-#line 367 "CSSValueKeywords.gperf"
-      {"paused", CSSValuePaused},
-#line 267 "CSSValueKeywords.gperf"
-      {"no-open-quote", CSSValueNoOpenQuote},
-#line 22 "CSSValueKeywords.gperf"
-      {"double", CSSValueDouble},
-#line 134 "CSSValueKeywords.gperf"
-      {"source-in", CSSValueSourceIn},
-#line 334 "CSSValueKeywords.gperf"
-      {"media-mute-button", CSSValueMediaMuteButton},
-#line 491 "CSSValueKeywords.gperf"
-      {"sandybrown", CSSValueSandybrown},
-#line 428 "CSSValueKeywords.gperf"
-      {"gold", CSSValueGold},
-#line 240 "CSSValueKeywords.gperf"
-      {"visible", CSSValueVisible},
-#line 430 "CSSValueKeywords.gperf"
-      {"greenyellow", CSSValueGreenyellow},
-#line 168 "CSSValueKeywords.gperf"
-      {"lower-roman", CSSValueLowerRoman},
-#line 306 "CSSValueKeywords.gperf"
-      {"read-write", CSSValueReadWrite},
-#line 88 "CSSValueKeywords.gperf"
-      {"silver", CSSValueSilver},
-#line 225 "CSSValueKeywords.gperf"
-      {"nesw-resize", CSSValueNeswResize},
-#line 520 "CSSValueKeywords.gperf"
+#line 389 "CSSValueKeywords.gperf"
+      {"aquamarine", CSSValueAquamarine},
+#line 54 "CSSValueKeywords.gperf"
+      {"x-large", CSSValueXLarge},
+#line 526 "CSSValueKeywords.gperf"
       {"butt", CSSValueButt},
-#line 108 "CSSValueKeywords.gperf"
-      {"inactivecaption", CSSValueInactivecaption},
-#line 535 "CSSValueKeywords.gperf"
-      {"reset-size", CSSValueResetSize},
-#line 376 "CSSValueKeywords.gperf"
-      {"visiblefill", CSSValueVisiblefill},
-#line 20 "CSSValueKeywords.gperf"
-      {"dashed", CSSValueDashed},
-#line 129 "CSSValueKeywords.gperf"
-      {"repeat-y", CSSValueRepeatY},
-#line 411 "CSSValueKeywords.gperf"
-      {"darksalmon", CSSValueDarksalmon},
-#line 136 "CSSValueKeywords.gperf"
-      {"source-atop", CSSValueSourceAtop},
+#line 111 "CSSValueKeywords.gperf"
+      {"infotext", CSSValueInfotext},
+#line 190 "CSSValueKeywords.gperf"
+      {"inline-table", CSSValueInlineTable},
+#line 428 "CSSValueKeywords.gperf"
+      {"dodgerblue", CSSValueDodgerblue},
+#line 127 "CSSValueKeywords.gperf"
+      {"repeat", CSSValueRepeat},
+#line 506 "CSSValueKeywords.gperf"
+      {"springgreen", CSSValueSpringgreen},
+#line 278 "CSSValueKeywords.gperf"
+      {"separate", CSSValueSeparate},
 #line 328 "CSSValueKeywords.gperf"
       {"button", CSSValueButton},
-#line 364 "CSSValueKeywords.gperf"
-      {"visual", CSSValueVisual},
-#line 385 "CSSValueKeywords.gperf"
-      {"beige", CSSValueBeige},
-#line 210 "CSSValueKeywords.gperf"
-      {"progress", CSSValueProgress},
-#line 349 "CSSValueKeywords.gperf"
-      {"searchfield", CSSValueSearchfield},
-#line 161 "CSSValueKeywords.gperf"
-      {"outside", CSSValueOutside},
-#line 99 "CSSValueKeywords.gperf"
-      {"buttonface", CSSValueButtonface},
-#line 165 "CSSValueKeywords.gperf"
-      {"square", CSSValueSquare},
+#line 311 "CSSValueKeywords.gperf"
+      {"min-intrinsic", CSSValueMinIntrinsic},
 #line 79 "CSSValueKeywords.gperf"
       {"gray", CSSValueGray},
-#line 386 "CSSValueKeywords.gperf"
-      {"bisque", CSSValueBisque},
-#line 157 "CSSValueKeywords.gperf"
-      {"justify", CSSValueJustify},
-#line 357 "CSSValueKeywords.gperf"
+#line 117 "CSSValueKeywords.gperf"
+      {"threedhighlight", CSSValueThreedhighlight},
+#line 314 "CSSValueKeywords.gperf"
+      {"discard", CSSValueDiscard},
+#line 27 "CSSValueKeywords.gperf"
+      {"small-caption", CSSValueSmallCaption},
+#line 19 "CSSValueKeywords.gperf"
+      {"dotted", CSSValueDotted},
+#line 124 "CSSValueKeywords.gperf"
+      {"currentcolor", CSSValueCurrentcolor},
+#line 525 "CSSValueKeywords.gperf"
+      {"geometricprecision", CSSValueGeometricprecision},
+#line 295 "CSSValueKeywords.gperf"
+      {"forwards", CSSValueForwards},
+#line 519 "CSSValueKeywords.gperf"
+      {"new", CSSValueNew},
+#line 370 "CSSValueKeywords.gperf"
+      {"running", CSSValueRunning},
+#line 119 "CSSValueKeywords.gperf"
+      {"threedshadow", CSSValueThreedshadow},
+#line 20 "CSSValueKeywords.gperf"
+      {"dashed", CSSValueDashed},
+#line 377 "CSSValueKeywords.gperf"
+      {"ease-out", CSSValueEaseOut},
+#line 198 "CSSValueKeywords.gperf"
+      {"table-caption", CSSValueTableCaption},
+#line 485 "CSSValueKeywords.gperf"
+      {"paleturquoise", CSSValuePaleturquoise},
+#line 379 "CSSValueKeywords.gperf"
+      {"document", CSSValueDocument},
+#line 196 "CSSValueKeywords.gperf"
+      {"table-column", CSSValueTableColumn},
+#line 444 "CSSValueKeywords.gperf"
+      {"lavenderblush", CSSValueLavenderblush},
+#line 453 "CSSValueKeywords.gperf"
+      {"lightgrey", CSSValueLightgrey},
+#line 451 "CSSValueKeywords.gperf"
+      {"lightgray", CSSValueLightgray},
+#line 181 "CSSValueKeywords.gperf"
+      {"hiragana-iroha", CSSValueHiraganaIroha},
+#line 106 "CSSValueKeywords.gperf"
+      {"highlighttext", CSSValueHighlighttext},
+#line 108 "CSSValueKeywords.gperf"
+      {"inactivecaption", CSSValueInactivecaption},
+#line 467 "CSSValueKeywords.gperf"
+      {"mediumorchid", CSSValueMediumorchid},
+#line 194 "CSSValueKeywords.gperf"
+      {"table-row", CSSValueTableRow},
+#line 121 "CSSValueKeywords.gperf"
+      {"windowframe", CSSValueWindowframe},
+#line 299 "CSSValueKeywords.gperf"
+      {"down", CSSValueDown},
+#line 518 "CSSValueKeywords.gperf"
+      {"accumulate", CSSValueAccumulate},
+#line 203 "CSSValueKeywords.gperf"
+      {"default", CSSValueDefault},
+#line 445 "CSSValueKeywords.gperf"
+      {"lawngreen", CSSValueLawngreen},
+#line 262 "CSSValueKeywords.gperf"
+      {"loud", CSSValueLoud},
+#line 274 "CSSValueKeywords.gperf"
+      {"pre-line", CSSValuePreLine},
+#line 459 "CSSValueKeywords.gperf"
+      {"lightslategrey", CSSValueLightslategrey},
+#line 458 "CSSValueKeywords.gperf"
+      {"lightslategray", CSSValueLightslategray},
+#line 290 "CSSValueKeywords.gperf"
+      {"vertical", CSSValueVertical},
+#line 238 "CSSValueKeywords.gperf"
+      {"uppercase", CSSValueUppercase},
+#line 522 "CSSValueKeywords.gperf"
+      {"optimizespeed", CSSValueOptimizespeed},
+#line 229 "CSSValueKeywords.gperf"
+      {"text", CSSValueText},
+#line 91 "CSSValueKeywords.gperf"
+      {"yellow", CSSValueYellow},
+#line 261 "CSSValueKeywords.gperf"
+      {"line-through", CSSValueLineThrough},
+#line 132 "CSSValueKeywords.gperf"
+      {"copy", CSSValueCopy},
+#line 504 "CSSValueKeywords.gperf"
+      {"slategrey", CSSValueSlategrey},
+#line 503 "CSSValueKeywords.gperf"
+      {"slategray", CSSValueSlategray},
+#line 435 "CSSValueKeywords.gperf"
+      {"goldenrod", CSSValueGoldenrod},
+#line 471 "CSSValueKeywords.gperf"
+      {"mediumspringgreen", CSSValueMediumspringgreen},
+#line 446 "CSSValueKeywords.gperf"
+      {"lemonchiffon", CSSValueLemonchiffon},
+#line 393 "CSSValueKeywords.gperf"
+      {"blanchedalmond", CSSValueBlanchedalmond},
+#line 125 "CSSValueKeywords.gperf"
+      {"grey", CSSValueGrey},
+#line 161 "CSSValueKeywords.gperf"
+      {"outside", CSSValueOutside},
+#line 166 "CSSValueKeywords.gperf"
+      {"decimal", CSSValueDecimal},
+#line 113 "CSSValueKeywords.gperf"
+      {"menutext", CSSValueMenutext},
+#line 437 "CSSValueKeywords.gperf"
+      {"honeydew", CSSValueHoneydew},
+#line 276 "CSSValueKeywords.gperf"
+      {"relative", CSSValueRelative},
+#line 147 "CSSValueKeywords.gperf"
+      {"super", CSSValueSuper},
+#line 417 "CSSValueKeywords.gperf"
+      {"darksalmon", CSSValueDarksalmon},
+#line 360 "CSSValueKeywords.gperf"
       {"round", CSSValueRound},
-#line 425 "CSSValueKeywords.gperf"
-      {"forestgreen", CSSValueForestgreen},
+#line 72 "CSSValueKeywords.gperf"
+      {"fantasy", CSSValueFantasy},
+#line 465 "CSSValueKeywords.gperf"
+      {"mediumaquamarine", CSSValueMediumaquamarine},
+#line 493 "CSSValueKeywords.gperf"
+      {"rosybrown", CSSValueRosybrown},
+#line 371 "CSSValueKeywords.gperf"
+      {"paused", CSSValuePaused},
+#line 22 "CSSValueKeywords.gperf"
+      {"double", CSSValueDouble},
+#line 270 "CSSValueKeywords.gperf"
+      {"overlay", CSSValueOverlay},
+#line 358 "CSSValueKeywords.gperf"
+      {"textarea", CSSValueTextarea},
+#line 429 "CSSValueKeywords.gperf"
+      {"firebrick", CSSValueFirebrick},
+#line 382 "CSSValueKeywords.gperf"
+      {"visiblefill", CSSValueVisiblefill},
+#line 517 "CSSValueKeywords.gperf"
+      {"evenodd", CSSValueEvenodd},
+#line 118 "CSSValueKeywords.gperf"
+      {"threedlightshadow", CSSValueThreedlightshadow},
+#line 275 "CSSValueKeywords.gperf"
+      {"pre-wrap", CSSValuePreWrap},
+#line 511 "CSSValueKeywords.gperf"
+      {"turquoise", CSSValueTurquoise},
+#line 70 "CSSValueKeywords.gperf"
+      {"sans-serif", CSSValueSansSerif},
 #line 31 "CSSValueKeywords.gperf"
       {"status-bar", CSSValueStatusBar},
-#line 66 "CSSValueKeywords.gperf"
-      {"expanded", CSSValueExpanded},
-#line 449 "CSSValueKeywords.gperf"
-      {"lightsalmon", CSSValueLightsalmon},
-#line 58 "CSSValueKeywords.gperf"
-      {"larger", CSSValueLarger},
-#line 383 "CSSValueKeywords.gperf"
-      {"aquamarine", CSSValueAquamarine},
-#line 17 "CSSValueKeywords.gperf"
-      {"ridge", CSSValueRidge},
-#line 343 "CSSValueKeywords.gperf"
-      {"menulist-textfield", CSSValueMenulistTextfield},
-#line 492 "CSSValueKeywords.gperf"
-      {"seagreen", CSSValueSeagreen},
-#line 289 "CSSValueKeywords.gperf"
-      {"horizontal", CSSValueHorizontal},
-#line 315 "CSSValueKeywords.gperf"
-      {"dot-dash", CSSValueDotDash},
-#line 530 "CSSValueKeywords.gperf"
-      {"alphabetic", CSSValueAlphabetic},
-#line 518 "CSSValueKeywords.gperf"
-      {"crispedges", CSSValueCrispedges},
-#line 360 "CSSValueKeywords.gperf"
-      {"padding", CSSValuePadding},
-#line 171 "CSSValueKeywords.gperf"
-      {"lower-alpha", CSSValueLowerAlpha},
-#line 390 "CSSValueKeywords.gperf"
-      {"burlywood", CSSValueBurlywood},
-#line 461 "CSSValueKeywords.gperf"
-      {"mediumorchid", CSSValueMediumorchid},
-#line 478 "CSSValueKeywords.gperf"
-      {"palegreen", CSSValuePalegreen},
-#line 456 "CSSValueKeywords.gperf"
-      {"limegreen", CSSValueLimegreen},
-#line 124 "CSSValueKeywords.gperf"
-      {"currentcolor", CSSValueCurrentcolor},
-#line 324 "CSSValueKeywords.gperf"
-      {"checkbox", CSSValueCheckbox},
-#line 62 "CSSValueKeywords.gperf"
-      {"extra-condensed", CSSValueExtraCondensed},
-#line 400 "CSSValueKeywords.gperf"
-      {"darkcyan", CSSValueDarkcyan},
-#line 333 "CSSValueKeywords.gperf"
-      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
+#line 483 "CSSValueKeywords.gperf"
+      {"palegoldenrod", CSSValuePalegoldenrod},
+#line 244 "CSSValueKeywords.gperf"
+      {"always", CSSValueAlways},
+#line 436 "CSSValueKeywords.gperf"
+      {"greenyellow", CSSValueGreenyellow},
+#line 250 "CSSValueKeywords.gperf"
+      {"close-quote", CSSValueCloseQuote},
+#line 480 "CSSValueKeywords.gperf"
+      {"olivedrab", CSSValueOlivedrab},
+#line 541 "CSSValueKeywords.gperf"
+      {"reset-size", CSSValueResetSize},
+#line 212 "CSSValueKeywords.gperf"
+      {"not-allowed", CSSValueNotAllowed},
 #line 96 "CSSValueKeywords.gperf"
       {"activecaption", CSSValueActivecaption},
-#line 423 "CSSValueKeywords.gperf"
-      {"firebrick", CSSValueFirebrick},
+#line 99 "CSSValueKeywords.gperf"
+      {"buttonface", CSSValueButtonface},
+#line 122 "CSSValueKeywords.gperf"
+      {"windowtext", CSSValueWindowtext},
+#line 472 "CSSValueKeywords.gperf"
+      {"mediumturquoise", CSSValueMediumturquoise},
+#line 49 "CSSValueKeywords.gperf"
+      {"xx-small", CSSValueXxSmall},
 #line 71 "CSSValueKeywords.gperf"
       {"cursive", CSSValueCursive},
-#line 361 "CSSValueKeywords.gperf"
-      {"border-box", CSSValueBorderBox},
-#line 128 "CSSValueKeywords.gperf"
-      {"repeat-x", CSSValueRepeatX},
-#line 387 "CSSValueKeywords.gperf"
-      {"blanchedalmond", CSSValueBlanchedalmond},
-#line 135 "CSSValueKeywords.gperf"
-      {"source-out", CSSValueSourceOut},
-#line 509 "CSSValueKeywords.gperf"
-      {"yellowgreen", CSSValueYellowgreen},
+#line 266 "CSSValueKeywords.gperf"
+      {"no-close-quote", CSSValueNoCloseQuote},
+#line 427 "CSSValueKeywords.gperf"
+      {"dimgrey", CSSValueDimgrey},
+#line 426 "CSSValueKeywords.gperf"
+      {"dimgray", CSSValueDimgray},
 #line 488 "CSSValueKeywords.gperf"
-      {"royalblue", CSSValueRoyalblue},
-#line 203 "CSSValueKeywords.gperf"
-      {"default", CSSValueDefault},
-#line 78 "CSSValueKeywords.gperf"
-      {"fuchsia", CSSValueFuchsia},
+      {"peachpuff", CSSValuePeachpuff},
+#line 225 "CSSValueKeywords.gperf"
+      {"nesw-resize", CSSValueNeswResize},
+#line 267 "CSSValueKeywords.gperf"
+      {"no-open-quote", CSSValueNoOpenQuote},
+#line 539 "CSSValueKeywords.gperf"
+      {"use-script", CSSValueUseScript},
+#line 405 "CSSValueKeywords.gperf"
+      {"darkblue", CSSValueDarkblue},
+#line 291 "CSSValueKeywords.gperf"
+      {"inline-axis", CSSValueInlineAxis},
+#line 352 "CSSValueKeywords.gperf"
+      {"searchfield", CSSValueSearchfield},
+#line 381 "CSSValueKeywords.gperf"
+      {"visiblepainted", CSSValueVisiblepainted},
+#line 254 "CSSValueKeywords.gperf"
+      {"fixed", CSSValueFixed},
+#line 442 "CSSValueKeywords.gperf"
+      {"khaki", CSSValueKhaki},
+#line 412 "CSSValueKeywords.gperf"
+      {"darkmagenta", CSSValueDarkmagenta},
 #line 103 "CSSValueKeywords.gperf"
       {"captiontext", CSSValueCaptiontext},
-#line 223 "CSSValueKeywords.gperf"
-      {"ew-resize", CSSValueEwResize},
-#line 220 "CSSValueKeywords.gperf"
-      {"sw-resize", CSSValueSwResize},
-#line 61 "CSSValueKeywords.gperf"
-      {"ultra-condensed", CSSValueUltraCondensed},
-#line 206 "CSSValueKeywords.gperf"
-      {"vertical-text", CSSValueVerticalText},
+#line 515 "CSSValueKeywords.gperf"
+      {"yellowgreen", CSSValueYellowgreen},
 #line 486 "CSSValueKeywords.gperf"
-      {"powderblue", CSSValuePowderblue},
-#line 111 "CSSValueKeywords.gperf"
-      {"infotext", CSSValueInfotext},
-#line 534 "CSSValueKeywords.gperf"
-      {"no-change", CSSValueNoChange},
-#line 217 "CSSValueKeywords.gperf"
-      {"nw-resize", CSSValueNwResize},
-#line 463 "CSSValueKeywords.gperf"
-      {"mediumseagreen", CSSValueMediumseagreen},
-#line 443 "CSSValueKeywords.gperf"
-      {"lightcyan", CSSValueLightcyan},
-#line 155 "CSSValueKeywords.gperf"
-      {"right", CSSValueRight},
-#line 455 "CSSValueKeywords.gperf"
-      {"lightyellow", CSSValueLightyellow},
-#line 39 "CSSValueKeywords.gperf"
-      {"lighter", CSSValueLighter},
-#line 459 "CSSValueKeywords.gperf"
-      {"mediumaquamarine", CSSValueMediumaquamarine},
-#line 292 "CSSValueKeywords.gperf"
-      {"block-axis", CSSValueBlockAxis},
-#line 147 "CSSValueKeywords.gperf"
-      {"super", CSSValueSuper},
-#line 321 "CSSValueKeywords.gperf"
-      {"break-word", CSSValueBreakWord},
-#line 442 "CSSValueKeywords.gperf"
-      {"lightcoral", CSSValueLightcoral},
-#line 480 "CSSValueKeywords.gperf"
       {"palevioletred", CSSValuePalevioletred},
-#line 237 "CSSValueKeywords.gperf"
-      {"capitalize", CSSValueCapitalize},
-#line 375 "CSSValueKeywords.gperf"
-      {"visiblepainted", CSSValueVisiblepainted},
-#line 179 "CSSValueKeywords.gperf"
-      {"hiragana", CSSValueHiragana},
-#line 269 "CSSValueKeywords.gperf"
-      {"open-quote", CSSValueOpenQuote},
-#line 481 "CSSValueKeywords.gperf"
+#line 487 "CSSValueKeywords.gperf"
       {"papayawhip", CSSValuePapayawhip},
-#line 399 "CSSValueKeywords.gperf"
-      {"darkblue", CSSValueDarkblue},
-#line 475 "CSSValueKeywords.gperf"
-      {"orangered", CSSValueOrangered},
+#line 492 "CSSValueKeywords.gperf"
+      {"powderblue", CSSValuePowderblue},
+#line 78 "CSSValueKeywords.gperf"
+      {"fuchsia", CSSValueFuchsia},
+#line 409 "CSSValueKeywords.gperf"
+      {"darkgreen", CSSValueDarkgreen},
+#line 100 "CSSValueKeywords.gperf"
+      {"buttonhighlight", CSSValueButtonhighlight},
+#line 418 "CSSValueKeywords.gperf"
+      {"darkseagreen", CSSValueDarkseagreen},
+#line 419 "CSSValueKeywords.gperf"
+      {"darkslateblue", CSSValueDarkslateblue},
+#line 414 "CSSValueKeywords.gperf"
+      {"darkorange", CSSValueDarkorange},
+#line 186 "CSSValueKeywords.gperf"
+      {"run-in", CSSValueRunIn},
+#line 171 "CSSValueKeywords.gperf"
+      {"lower-alpha", CSSValueLowerAlpha},
+#line 101 "CSSValueKeywords.gperf"
+      {"buttonshadow", CSSValueButtonshadow},
+#line 180 "CSSValueKeywords.gperf"
+      {"katakana", CSSValueKatakana},
+#line 347 "CSSValueKeywords.gperf"
+      {"slider-horizontal", CSSValueSliderHorizontal},
+#line 134 "CSSValueKeywords.gperf"
+      {"source-in", CSSValueSourceIn},
+#line 188 "CSSValueKeywords.gperf"
+      {"inline-block", CSSValueInlineBlock},
+#line 172 "CSSValueKeywords.gperf"
+      {"lower-latin", CSSValueLowerLatin},
+#line 394 "CSSValueKeywords.gperf"
+      {"blueviolet", CSSValueBlueviolet},
+#line 136 "CSSValueKeywords.gperf"
+      {"source-atop", CSSValueSourceAtop},
 #line 226 "CSSValueKeywords.gperf"
       {"nwse-resize", CSSValueNwseResize},
-#line 16 "CSSValueKeywords.gperf"
-      {"groove", CSSValueGroove},
-#line 432 "CSSValueKeywords.gperf"
-      {"hotpink", CSSValueHotpink},
-#line 474 "CSSValueKeywords.gperf"
-      {"olivedrab", CSSValueOlivedrab},
-#line 427 "CSSValueKeywords.gperf"
-      {"ghostwhite", CSSValueGhostwhite},
-#line 498 "CSSValueKeywords.gperf"
-      {"slategrey", CSSValueSlategrey},
 #line 497 "CSSValueKeywords.gperf"
-      {"slategray", CSSValueSlategray},
-#line 137 "CSSValueKeywords.gperf"
-      {"destination-over", CSSValueDestinationOver},
-#line 54 "CSSValueKeywords.gperf"
-      {"x-large", CSSValueXLarge},
-#line 505 "CSSValueKeywords.gperf"
-      {"turquoise", CSSValueTurquoise},
-#line 26 "CSSValueKeywords.gperf"
-      {"message-box", CSSValueMessageBox},
-#line 467 "CSSValueKeywords.gperf"
-      {"mediumvioletred", CSSValueMediumvioletred},
-#line 158 "CSSValueKeywords.gperf"
-      {"-webkit-left", CSSValueWebkitLeft},
-#line 410 "CSSValueKeywords.gperf"
+      {"sandybrown", CSSValueSandybrown},
+#line 208 "CSSValueKeywords.gperf"
+      {"context-menu", CSSValueContextMenu},
+#line 168 "CSSValueKeywords.gperf"
+      {"lower-roman", CSSValueLowerRoman},
+#line 344 "CSSValueKeywords.gperf"
+      {"menulist-button", CSSValueMenulistButton},
+#line 319 "CSSValueKeywords.gperf"
+      {"skip-white-space", CSSValueSkipWhiteSpace},
+#line 55 "CSSValueKeywords.gperf"
+      {"xx-large", CSSValueXxLarge},
+#line 338 "CSSValueKeywords.gperf"
+      {"media-slider", CSSValueMediaSlider},
+#line 366 "CSSValueKeywords.gperf"
+      {"content-box", CSSValueContentBox},
+#line 457 "CSSValueKeywords.gperf"
+      {"lightskyblue", CSSValueLightskyblue},
+#line 315 "CSSValueKeywords.gperf"
+      {"dot-dash", CSSValueDotDash},
+#line 531 "CSSValueKeywords.gperf"
+      {"after-edge", CSSValueAfterEdge},
+#line 135 "CSSValueKeywords.gperf"
+      {"source-out", CSSValueSourceOut},
+#line 228 "CSSValueKeywords.gperf"
+      {"row-resize", CSSValueRowResize},
+#line 383 "CSSValueKeywords.gperf"
+      {"visiblestroke", CSSValueVisiblestroke},
+#line 416 "CSSValueKeywords.gperf"
       {"darkred", CSSValueDarkred},
-#line 413 "CSSValueKeywords.gperf"
-      {"darkslateblue", CSSValueDarkslateblue},
-#line 419 "CSSValueKeywords.gperf"
-      {"deepskyblue", CSSValueDeepskyblue},
-#line 441 "CSSValueKeywords.gperf"
-      {"lightblue", CSSValueLightblue},
-#line 388 "CSSValueKeywords.gperf"
-      {"blueviolet", CSSValueBlueviolet},
-#line 438 "CSSValueKeywords.gperf"
-      {"lavenderblush", CSSValueLavenderblush},
-#line 436 "CSSValueKeywords.gperf"
-      {"khaki", CSSValueKhaki},
-#line 238 "CSSValueKeywords.gperf"
-      {"uppercase", CSSValueUppercase},
-#line 339 "CSSValueKeywords.gperf"
-      {"media-sliderthumb", CSSValueMediaSliderthumb},
-#line 479 "CSSValueKeywords.gperf"
-      {"paleturquoise", CSSValuePaleturquoise},
-#line 429 "CSSValueKeywords.gperf"
-      {"goldenrod", CSSValueGoldenrod},
-#line 426 "CSSValueKeywords.gperf"
-      {"gainsboro", CSSValueGainsboro},
-#line 519 "CSSValueKeywords.gperf"
-      {"geometricprecision", CSSValueGeometricprecision},
-#line 382 "CSSValueKeywords.gperf"
-      {"antiquewhite", CSSValueAntiquewhite},
-#line 529 "CSSValueKeywords.gperf"
-      {"ideographic", CSSValueIdeographic},
-#line 316 "CSSValueKeywords.gperf"
-      {"dot-dot-dash", CSSValueDotDotDash},
-#line 454 "CSSValueKeywords.gperf"
-      {"lightsteelblue", CSSValueLightsteelblue},
-#line 109 "CSSValueKeywords.gperf"
-      {"inactivecaptiontext", CSSValueInactivecaptiontext},
+#line 107 "CSSValueKeywords.gperf"
+      {"inactiveborder", CSSValueInactiveborder},
 #line 102 "CSSValueKeywords.gperf"
       {"buttontext", CSSValueButtontext},
-#line 515 "CSSValueKeywords.gperf"
-      {"linearrgb", CSSValueLinearrgb},
-#line 466 "CSSValueKeywords.gperf"
-      {"mediumturquoise", CSSValueMediumturquoise},
-#line 439 "CSSValueKeywords.gperf"
-      {"lawngreen", CSSValueLawngreen},
-#line 228 "CSSValueKeywords.gperf"
-      {"row-resize", CSSValueRowResize},
-#line 421 "CSSValueKeywords.gperf"
-      {"dimgrey", CSSValueDimgrey},
-#line 420 "CSSValueKeywords.gperf"
-      {"dimgray", CSSValueDimgray},
 #line 104 "CSSValueKeywords.gperf"
       {"graytext", CSSValueGraytext},
-#line 67 "CSSValueKeywords.gperf"
-      {"extra-expanded", CSSValueExtraExpanded},
-#line 55 "CSSValueKeywords.gperf"
-      {"xx-large", CSSValueXxLarge},
-#line 422 "CSSValueKeywords.gperf"
-      {"dodgerblue", CSSValueDodgerblue},
-#line 296 "CSSValueKeywords.gperf"
-      {"backwards", CSSValueBackwards},
-#line 516 "CSSValueKeywords.gperf"
-      {"optimizespeed", CSSValueOptimizespeed},
+#line 378 "CSSValueKeywords.gperf"
+      {"ease-in-out", CSSValueEaseInOut},
+#line 138 "CSSValueKeywords.gperf"
+      {"destination-in", CSSValueDestinationIn},
+#line 415 "CSSValueKeywords.gperf"
+      {"darkorchid", CSSValueDarkorchid},
+#line 143 "CSSValueKeywords.gperf"
+      {"plus-lighter", CSSValuePlusLighter},
+#line 473 "CSSValueKeywords.gperf"
+      {"mediumvioletred", CSSValueMediumvioletred},
+#line 97 "CSSValueKeywords.gperf"
+      {"appworkspace", CSSValueAppworkspace},
+#line 140 "CSSValueKeywords.gperf"
+      {"destination-atop", CSSValueDestinationAtop},
+#line 324 "CSSValueKeywords.gperf"
+      {"checkbox", CSSValueCheckbox},
+#line 110 "CSSValueKeywords.gperf"
+      {"infobackground", CSSValueInfobackground},
+#line 326 "CSSValueKeywords.gperf"
+      {"push-button", CSSValuePushButton},
+#line 320 "CSSValueKeywords.gperf"
+      {"break-all", CSSValueBreakAll},
+#line 529 "CSSValueKeywords.gperf"
+      {"optimizelegibility", CSSValueOptimizelegibility},
+#line 109 "CSSValueKeywords.gperf"
+      {"inactivecaptiontext", CSSValueInactivecaptiontext},
+#line 157 "CSSValueKeywords.gperf"
+      {"justify", CSSValueJustify},
+#line 173 "CSSValueKeywords.gperf"
+      {"upper-alpha", CSSValueUpperAlpha},
+#line 349 "CSSValueKeywords.gperf"
+      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
+#line 424 "CSSValueKeywords.gperf"
+      {"deeppink", CSSValueDeeppink},
+#line 139 "CSSValueKeywords.gperf"
+      {"destination-out", CSSValueDestinationOut},
+#line 61 "CSSValueKeywords.gperf"
+      {"ultra-condensed", CSSValueUltraCondensed},
+#line 406 "CSSValueKeywords.gperf"
+      {"darkcyan", CSSValueDarkcyan},
 #line 174 "CSSValueKeywords.gperf"
       {"upper-latin", CSSValueUpperLatin},
-#line 68 "CSSValueKeywords.gperf"
-      {"ultra-expanded", CSSValueUltraExpanded},
-#line 477 "CSSValueKeywords.gperf"
-      {"palegoldenrod", CSSValuePalegoldenrod},
-#line 345 "CSSValueKeywords.gperf"
-      {"slider-vertical", CSSValueSliderVertical},
-#line 366 "CSSValueKeywords.gperf"
-      {"running", CSSValueRunning},
-#line 257 "CSSValueKeywords.gperf"
-      {"higher", CSSValueHigher},
-#line 180 "CSSValueKeywords.gperf"
-      {"katakana", CSSValueKatakana},
-#line 153 "CSSValueKeywords.gperf"
-      {"-webkit-auto", CSSValueWebkitAuto},
+#line 148 "CSSValueKeywords.gperf"
+      {"text-top", CSSValueTextTop},
+#line 296 "CSSValueKeywords.gperf"
+      {"backwards", CSSValueBackwards},
+#line 423 "CSSValueKeywords.gperf"
+      {"darkviolet", CSSValueDarkviolet},
+#line 357 "CSSValueKeywords.gperf"
+      {"textfield", CSSValueTextfield},
+#line 169 "CSSValueKeywords.gperf"
+      {"upper-roman", CSSValueUpperRoman},
 #line 327 "CSSValueKeywords.gperf"
       {"square-button", CSSValueSquareButton},
-#line 417 "CSSValueKeywords.gperf"
-      {"darkviolet", CSSValueDarkviolet},
-#line 326 "CSSValueKeywords.gperf"
-      {"push-button", CSSValuePushButton},
-#line 528 "CSSValueKeywords.gperf"
-      {"text-after-edge", CSSValueTextAfterEdge},
-#line 284 "CSSValueKeywords.gperf"
-      {"-webkit-nowrap", CSSValueWebkitNowrap},
-#line 160 "CSSValueKeywords.gperf"
-      {"-webkit-center", CSSValueWebkitCenter},
-#line 107 "CSSValueKeywords.gperf"
-      {"inactiveborder", CSSValueInactiveborder},
-#line 350 "CSSValueKeywords.gperf"
-      {"searchfield-decoration", CSSValueSearchfieldDecoration},
-#line 101 "CSSValueKeywords.gperf"
-      {"buttonshadow", CSSValueButtonshadow},
+#line 339 "CSSValueKeywords.gperf"
+      {"media-sliderthumb", CSSValueMediaSliderthumb},
+#line 64 "CSSValueKeywords.gperf"
+      {"semi-condensed", CSSValueSemiCondensed},
+#line 66 "CSSValueKeywords.gperf"
+      {"expanded", CSSValueExpanded},
+#line 323 "CSSValueKeywords.gperf"
+      {"after-white-space", CSSValueAfterWhiteSpace},
+#line 306 "CSSValueKeywords.gperf"
+      {"read-write", CSSValueReadWrite},
+#line 95 "CSSValueKeywords.gperf"
+      {"activeborder", CSSValueActiveborder},
+#line 345 "CSSValueKeywords.gperf"
+      {"menulist-text", CSSValueMenulistText},
+#line 396 "CSSValueKeywords.gperf"
+      {"burlywood", CSSValueBurlywood},
+#line 523 "CSSValueKeywords.gperf"
+      {"optimizequality", CSSValueOptimizequality},
+#line 450 "CSSValueKeywords.gperf"
+      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
+#line 422 "CSSValueKeywords.gperf"
+      {"darkturquoise", CSSValueDarkturquoise},
+#line 530 "CSSValueKeywords.gperf"
+      {"before-edge", CSSValueBeforeEdge},
+#line 26 "CSSValueKeywords.gperf"
+      {"message-box", CSSValueMessageBox},
+#line 348 "CSSValueKeywords.gperf"
+      {"slider-vertical", CSSValueSliderVertical},
+#line 149 "CSSValueKeywords.gperf"
+      {"text-bottom", CSSValueTextBottom},
+#line 269 "CSSValueKeywords.gperf"
+      {"open-quote", CSSValueOpenQuote},
+#line 178 "CSSValueKeywords.gperf"
+      {"cjk-ideographic", CSSValueCjkIdeographic},
+#line 98 "CSSValueKeywords.gperf"
+      {"background", CSSValueBackground},
+#line 410 "CSSValueKeywords.gperf"
+      {"darkgrey", CSSValueDarkgrey},
+#line 195 "CSSValueKeywords.gperf"
+      {"table-column-group", CSSValueTableColumnGroup},
+#line 408 "CSSValueKeywords.gperf"
+      {"darkgray", CSSValueDarkgray},
+#line 340 "CSSValueKeywords.gperf"
+      {"media-timeline-container", CSSValueMediaTimelineContainer},
+#line 365 "CSSValueKeywords.gperf"
+      {"border-box", CSSValueBorderBox},
+#line 330 "CSSValueKeywords.gperf"
+      {"default-button", CSSValueDefaultButton},
+#line 292 "CSSValueKeywords.gperf"
+      {"block-axis", CSSValueBlockAxis},
 #line 247 "CSSValueKeywords.gperf"
       {"bidi-override", CSSValueBidiOverride},
-#line 30 "CSSValueKeywords.gperf"
-      {"-webkit-control", CSSValueWebkitControl},
-#line 353 "CSSValueKeywords.gperf"
-      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
-#line 448 "CSSValueKeywords.gperf"
-      {"lightpink", CSSValueLightpink},
-#line 527 "CSSValueKeywords.gperf"
-      {"text-before-edge", CSSValueTextBeforeEdge},
+#line 115 "CSSValueKeywords.gperf"
+      {"threeddarkshadow", CSSValueThreeddarkshadow},
+#line 413 "CSSValueKeywords.gperf"
+      {"darkolivegreen", CSSValueDarkolivegreen},
+#line 191 "CSSValueKeywords.gperf"
+      {"table-row-group", CSSValueTableRowGroup},
+#line 421 "CSSValueKeywords.gperf"
+      {"darkslategrey", CSSValueDarkslategrey},
+#line 420 "CSSValueKeywords.gperf"
+      {"darkslategray", CSSValueDarkslategray},
+#line 364 "CSSValueKeywords.gperf"
+      {"padding-box", CSSValuePaddingBox},
+#line 373 "CSSValueKeywords.gperf"
+      {"preserve-3d", CSSValuePreserve3d},
 #line 133 "CSSValueKeywords.gperf"
       {"source-over", CSSValueSourceOver},
-#line 169 "CSSValueKeywords.gperf"
-      {"upper-roman", CSSValueUpperRoman},
-#line 177 "CSSValueKeywords.gperf"
-      {"georgian", CSSValueGeorgian},
-#line 468 "CSSValueKeywords.gperf"
-      {"midnightblue", CSSValueMidnightblue},
-#line 29 "CSSValueKeywords.gperf"
-      {"-webkit-small-control", CSSValueWebkitSmallControl},
-#line 406 "CSSValueKeywords.gperf"
-      {"darkmagenta", CSSValueDarkmagenta},
-#line 330 "CSSValueKeywords.gperf"
-      {"default-button", CSSValueDefaultButton},
-#line 126 "CSSValueKeywords.gperf"
-      {"-webkit-text", CSSValueWebkitText},
+#line 128 "CSSValueKeywords.gperf"
+      {"repeat-x", CSSValueRepeatX},
+#line 334 "CSSValueKeywords.gperf"
+      {"media-mute-button", CSSValueMediaMuteButton},
+#line 407 "CSSValueKeywords.gperf"
+      {"darkgoldenrod", CSSValueDarkgoldenrod},
+#line 129 "CSSValueKeywords.gperf"
+      {"repeat-y", CSSValueRepeatY},
+#line 182 "CSSValueKeywords.gperf"
+      {"katakana-iroha", CSSValueKatakanaIroha},
+#line 170 "CSSValueKeywords.gperf"
+      {"lower-greek", CSSValueLowerGreek},
+#line 305 "CSSValueKeywords.gperf"
+      {"read-only", CSSValueReadOnly},
+#line 350 "CSSValueKeywords.gperf"
+      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
+#line 321 "CSSValueKeywords.gperf"
+      {"break-word", CSSValueBreakWord},
+#line 62 "CSSValueKeywords.gperf"
+      {"extra-condensed", CSSValueExtraCondensed},
 #line 329 "CSSValueKeywords.gperf"
       {"button-bevel", CSSValueButtonBevel},
-#line 191 "CSSValueKeywords.gperf"
-      {"table-row-group", CSSValueTableRowGroup},
-#line 28 "CSSValueKeywords.gperf"
-      {"-webkit-mini-control", CSSValueWebkitMiniControl},
-#line 195 "CSSValueKeywords.gperf"
-      {"table-column-group", CSSValueTableColumnGroup},
-#line 409 "CSSValueKeywords.gperf"
-      {"darkorchid", CSSValueDarkorchid},
-#line 199 "CSSValueKeywords.gperf"
-      {"-webkit-box", CSSValueWebkitBox},
-#line 95 "CSSValueKeywords.gperf"
-      {"activeborder", CSSValueActiveborder},
+#line 411 "CSSValueKeywords.gperf"
+      {"darkkhaki", CSSValueDarkkhaki},
+#line 137 "CSSValueKeywords.gperf"
+      {"destination-over", CSSValueDestinationOver},
+#line 68 "CSSValueKeywords.gperf"
+      {"ultra-expanded", CSSValueUltraExpanded},
 #line 193 "CSSValueKeywords.gperf"
       {"table-footer-group", CSSValueTableFooterGroup},
-#line 323 "CSSValueKeywords.gperf"
-      {"after-white-space", CSSValueAfterWhiteSpace},
-#line 74 "CSSValueKeywords.gperf"
-      {"-webkit-body", CSSValueWebkitBody},
-#line 97 "CSSValueKeywords.gperf"
-      {"appworkspace", CSSValueAppworkspace},
-#line 377 "CSSValueKeywords.gperf"
-      {"visiblestroke", CSSValueVisiblestroke},
-#line 307 "CSSValueKeywords.gperf"
-      {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
-#line 173 "CSSValueKeywords.gperf"
-      {"upper-alpha", CSSValueUpperAlpha},
-#line 403 "CSSValueKeywords.gperf"
-      {"darkgreen", CSSValueDarkgreen},
-#line 412 "CSSValueKeywords.gperf"
-      {"darkseagreen", CSSValueDarkseagreen},
-#line 408 "CSSValueKeywords.gperf"
-      {"darkorange", CSSValueDarkorange},
+#line 192 "CSSValueKeywords.gperf"
+      {"table-header-group", CSSValueTableHeaderGroup},
+#line 206 "CSSValueKeywords.gperf"
+      {"vertical-text", CSSValueVerticalText},
+#line 65 "CSSValueKeywords.gperf"
+      {"semi-expanded", CSSValueSemiExpanded},
 #line 142 "CSSValueKeywords.gperf"
       {"plus-darker", CSSValuePlusDarker},
+#line 425 "CSSValueKeywords.gperf"
+      {"deepskyblue", CSSValueDeepskyblue},
+#line 333 "CSSValueKeywords.gperf"
+      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
+#line 353 "CSSValueKeywords.gperf"
+      {"searchfield-decoration", CSSValueSearchfieldDecoration},
+#line 346 "CSSValueKeywords.gperf"
+      {"menulist-textfield", CSSValueMenulistTextfield},
+#line 316 "CSSValueKeywords.gperf"
+      {"dot-dot-dash", CSSValueDotDotDash},
+#line 335 "CSSValueKeywords.gperf"
+      {"media-play-button", CSSValueMediaPlayButton},
+#line 67 "CSSValueKeywords.gperf"
+      {"extra-expanded", CSSValueExtraExpanded},
 #line 356 "CSSValueKeywords.gperf"
+      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
+#line 359 "CSSValueKeywords.gperf"
       {"caps-lock-indicator", CSSValueCapsLockIndicator},
-#line 115 "CSSValueKeywords.gperf"
-      {"threeddarkshadow", CSSValueThreeddarkshadow},
+#line 153 "CSSValueKeywords.gperf"
+      {"-webkit-auto", CSSValueWebkitAuto},
+#line 160 "CSSValueKeywords.gperf"
+      {"-webkit-center", CSSValueWebkitCenter},
+#line 167 "CSSValueKeywords.gperf"
+      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
+#line 30 "CSSValueKeywords.gperf"
+      {"-webkit-control", CSSValueWebkitControl},
+#line 355 "CSSValueKeywords.gperf"
+      {"searchfield-results-button", CSSValueSearchfieldResultsButton},
+#line 284 "CSSValueKeywords.gperf"
+      {"-webkit-nowrap", CSSValueWebkitNowrap},
+#line 159 "CSSValueKeywords.gperf"
+      {"-webkit-right", CSSValueWebkitRight},
+#line 534 "CSSValueKeywords.gperf"
+      {"text-after-edge", CSSValueTextAfterEdge},
+#line 158 "CSSValueKeywords.gperf"
+      {"-webkit-left", CSSValueWebkitLeft},
+#line 233 "CSSValueKeywords.gperf"
+      {"-webkit-grab", CSSValueWebkitGrab},
+#line 533 "CSSValueKeywords.gperf"
+      {"text-before-edge", CSSValueTextBeforeEdge},
+#line 354 "CSSValueKeywords.gperf"
+      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
 #line 93 "CSSValueKeywords.gperf"
       {"-webkit-link", CSSValueWebkitLink},
-#line 446 "CSSValueKeywords.gperf"
-      {"lightgreen", CSSValueLightgreen},
-#line 200 "CSSValueKeywords.gperf"
-      {"-webkit-inline-box", CSSValueWebkitInlineBox},
-#line 344 "CSSValueKeywords.gperf"
-      {"slider-horizontal", CSSValueSliderHorizontal},
-#line 450 "CSSValueKeywords.gperf"
-      {"lightseagreen", CSSValueLightseagreen},
+#line 264 "CSSValueKeywords.gperf"
+      {"-webkit-marquee", CSSValueWebkitMarquee},
+#line 126 "CSSValueKeywords.gperf"
+      {"-webkit-text", CSSValueWebkitText},
+#line 199 "CSSValueKeywords.gperf"
+      {"-webkit-box", CSSValueWebkitBox},
+#line 234 "CSSValueKeywords.gperf"
+      {"-webkit-grabbing", CSSValueWebkitGrabbing},
 #line 213 "CSSValueKeywords.gperf"
       {"-webkit-zoom-in", CSSValueWebkitZoomIn},
-#line 531 "CSSValueKeywords.gperf"
-      {"hanging", CSSValueHanging},
-#line 152 "CSSValueKeywords.gperf"
-      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
-#line 337 "CSSValueKeywords.gperf"
-      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
-#line 181 "CSSValueKeywords.gperf"
-      {"hiragana-iroha", CSSValueHiraganaIroha},
-#line 524 "CSSValueKeywords.gperf"
-      {"before-edge", CSSValueBeforeEdge},
-#line 404 "CSSValueKeywords.gperf"
-      {"darkgrey", CSSValueDarkgrey},
-#line 402 "CSSValueKeywords.gperf"
-      {"darkgray", CSSValueDarkgray},
-#line 336 "CSSValueKeywords.gperf"
-      {"media-seek-back-button", CSSValueMediaSeekBackButton},
-#line 143 "CSSValueKeywords.gperf"
-      {"plus-lighter", CSSValuePlusLighter},
-#line 118 "CSSValueKeywords.gperf"
-      {"threedlightshadow", CSSValueThreedlightshadow},
-#line 525 "CSSValueKeywords.gperf"
-      {"after-edge", CSSValueAfterEdge},
-#line 415 "CSSValueKeywords.gperf"
-      {"darkslategrey", CSSValueDarkslategrey},
-#line 414 "CSSValueKeywords.gperf"
-      {"darkslategray", CSSValueDarkslategray},
-#line 447 "CSSValueKeywords.gperf"
-      {"lightgrey", CSSValueLightgrey},
-#line 445 "CSSValueKeywords.gperf"
-      {"lightgray", CSSValueLightgray},
-#line 352 "CSSValueKeywords.gperf"
-      {"searchfield-results-button", CSSValueSearchfieldResultsButton},
-#line 416 "CSSValueKeywords.gperf"
-      {"darkturquoise", CSSValueDarkturquoise},
-#line 451 "CSSValueKeywords.gperf"
-      {"lightskyblue", CSSValueLightskyblue},
-#line 500 "CSSValueKeywords.gperf"
-      {"springgreen", CSSValueSpringgreen},
-#line 453 "CSSValueKeywords.gperf"
-      {"lightslategrey", CSSValueLightslategrey},
-#line 452 "CSSValueKeywords.gperf"
-      {"lightslategray", CSSValueLightslategray},
-#line 351 "CSSValueKeywords.gperf"
-      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
-#line 170 "CSSValueKeywords.gperf"
-      {"lower-greek", CSSValueLowerGreek},
+#line 342 "CSSValueKeywords.gperf"
+      {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
+#line 341 "CSSValueKeywords.gperf"
+      {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
+#line 29 "CSSValueKeywords.gperf"
+      {"-webkit-small-control", CSSValueWebkitSmallControl},
 #line 214 "CSSValueKeywords.gperf"
       {"-webkit-zoom-out", CSSValueWebkitZoomOut},
-#line 264 "CSSValueKeywords.gperf"
-      {"-webkit-marquee", CSSValueWebkitMarquee},
-#line 465 "CSSValueKeywords.gperf"
-      {"mediumspringgreen", CSSValueMediumspringgreen},
-#line 261 "CSSValueKeywords.gperf"
-      {"line-through", CSSValueLineThrough},
-#line 517 "CSSValueKeywords.gperf"
-      {"optimizequality", CSSValueOptimizequality},
-#line 182 "CSSValueKeywords.gperf"
-      {"katakana-iroha", CSSValueKatakanaIroha},
-#line 178 "CSSValueKeywords.gperf"
-      {"cjk-ideographic", CSSValueCjkIdeographic},
-#line 401 "CSSValueKeywords.gperf"
-      {"darkgoldenrod", CSSValueDarkgoldenrod},
-#line 167 "CSSValueKeywords.gperf"
-      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
-#line 192 "CSSValueKeywords.gperf"
-      {"table-header-group", CSSValueTableHeaderGroup},
-#line 233 "CSSValueKeywords.gperf"
-      {"-webkit-grab", CSSValueWebkitGrab},
-#line 347 "CSSValueKeywords.gperf"
-      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
-#line 98 "CSSValueKeywords.gperf"
-      {"background", CSSValueBackground},
-#line 523 "CSSValueKeywords.gperf"
-      {"optimizelegibility", CSSValueOptimizelegibility},
-#line 407 "CSSValueKeywords.gperf"
-      {"darkolivegreen", CSSValueDarkolivegreen},
-#line 105 "CSSValueKeywords.gperf"
-      {"highlight", CSSValueHighlight},
-#line 405 "CSSValueKeywords.gperf"
-      {"darkkhaki", CSSValueDarkkhaki},
+#line 28 "CSSValueKeywords.gperf"
+      {"-webkit-mini-control", CSSValueWebkitMiniControl},
+#line 336 "CSSValueKeywords.gperf"
+      {"media-seek-back-button", CSSValueMediaSeekBackButton},
+#line 74 "CSSValueKeywords.gperf"
+      {"-webkit-body", CSSValueWebkitBody},
+#line 337 "CSSValueKeywords.gperf"
+      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
 #line 94 "CSSValueKeywords.gperf"
       {"-webkit-activelink", CSSValueWebkitActivelink},
-#line 444 "CSSValueKeywords.gperf"
-      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
-#line 159 "CSSValueKeywords.gperf"
-      {"-webkit-right", CSSValueWebkitRight},
-#line 346 "CSSValueKeywords.gperf"
-      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
-#line 110 "CSSValueKeywords.gperf"
-      {"infobackground", CSSValueInfobackground},
+#line 200 "CSSValueKeywords.gperf"
+      {"-webkit-inline-box", CSSValueWebkitInlineBox},
+#line 307 "CSSValueKeywords.gperf"
+      {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
+#line 152 "CSSValueKeywords.gperf"
+      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
 #line 123 "CSSValueKeywords.gperf"
       {"-webkit-focus-ring-color", CSSValueWebkitFocusRingColor},
-#line 117 "CSSValueKeywords.gperf"
-      {"threedhighlight", CSSValueThreedhighlight},
-#line 106 "CSSValueKeywords.gperf"
-      {"highlighttext", CSSValueHighlighttext},
-#line 234 "CSSValueKeywords.gperf"
-      {"-webkit-grabbing", CSSValueWebkitGrabbing},
 #line 56 "CSSValueKeywords.gperf"
-      {"-webkit-xxx-large", CSSValueWebkitXxxLarge},
-#line 100 "CSSValueKeywords.gperf"
-      {"buttonhighlight", CSSValueButtonhighlight}
+      {"-webkit-xxx-large", CSSValueWebkitXxxLarge}
     };
 
   static const short lookup[] =
     {
         0,  -1,  -1,  -1,  -1,   1,  -1,  -1,  -1,  -1,
         2,  -1,  -1,  -1,  -1,   3,  -1,  -1,  -1,  -1,
-        4,  -1,  -1,  -1,  -1,   5,  -1,  -1,  -1,  -1,
-        6,  -1,  -1,  -1,  -1,   7,  -1,  -1,  -1,  -1,
-        8,  -1,  -1,  -1,  -1,   9,  10,  11,  -1,  -1,
-       12,  13,  -1,  14,  -1,  15,  -1,  -1,  -1,  -1,
-       16,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  17,  -1,  -1,  -1,  -1,
-       18,  -1,  -1,  -1,  -1,  19,  -1,  -1,  -1,  -1,
-       -1,  -1,  20,  -1,  -1,  21,  -1,  22,  -1,  -1,
-       -1,  -1,  23,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       24,  -1,  -1,  -1,  -1,  25,  -1,  26,  -1,  -1,
+        4,  -1,   5,  -1,  -1,   6,   7,  -1,  -1,  -1,
+        8,  -1,  -1,  -1,  -1,   9,  10,  -1,  -1,  -1,
+       11,  12,  -1,  -1,  -1,  13,  14,  -1,  -1,  -1,
+       15,  16,  -1,  -1,  -1,  17,  -1,  -1,  -1,  -1,
+       18,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  19,  -1,  -1,  -1,  -1,
+       20,  21,  -1,  -1,  -1,  22,  23,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  24,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       25,  -1,  -1,  -1,  -1,  26,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        27,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       28,  -1,  -1,  -1,  -1,  29,  -1,  -1,  -1,  -1,
-       -1,  30,  -1,  31,  -1,  32,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  33,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  34,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  35,  36,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  37,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  38,  -1,  -1,  -1,  -1,  -1,  -1,
-       39,  40,  -1,  -1,  -1,  41,  -1,  42,  -1,  -1,
-       43,  44,  -1,  45,  46,  -1,  47,  -1,  -1,  -1,
-       -1,  48,  -1,  -1,  -1,  49,  50,  -1,  -1,  -1,
-       51,  -1,  -1,  -1,  -1,  52,  -1,  -1,  -1,  -1,
-       53,  54,  -1,  -1,  -1,  -1,  -1,  55,  -1,  -1,
-       56,  -1,  -1,  -1,  -1,  57,  58,  -1,  -1,  -1,
-       -1,  59,  60,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       61,  -1,  -1,  -1,  -1,  62,  63,  -1,  -1,  64,
-       65,  66,  67,  -1,  -1,  -1,  68,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  69,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  70,  -1,  -1,  -1,
-       -1,  71,  -1,  -1,  -1,  -1,  72,  -1,  -1,  -1,
-       -1,  73,  -1,  74,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  75,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       76,  -1,  -1,  -1,  -1,  77,  -1,  -1,  -1,  -1,
-       -1,  78,  79,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  80,  -1,  81,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  82,  -1,  -1,  -1,
-       83,  84,  -1,  -1,  -1,  85,  86,  -1,  -1,  -1,
-       87,  -1,  -1,  88,  -1,  89,  90,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  91,  92,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  93,  -1,  -1,  -1,  94,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  95,  -1,  -1,  96,  -1,  -1,  -1,  -1,
-       97,  -1,  -1,  -1,  -1,  98,  -1,  -1,  99,  -1,
-      100,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 101,  -1,  -1,  -1,  -1, 102,  -1, 103,  -1,
-       -1, 104, 105,  -1,  -1,  -1,  -1,  -1, 106,  -1,
-      107,  -1,  -1,  -1,  -1, 108,  -1, 109,  -1,  -1,
-       -1, 110,  -1,  -1,  -1, 111,  -1, 112,  -1,  -1,
-      113,  -1,  -1,  -1,  -1, 114, 115,  -1,  -1,  -1,
-      116,  -1,  -1, 117,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 118,  -1,  -1,  -1,  -1,
-      119,  -1,  -1,  -1,  -1,  -1, 120,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 121,  -1,  -1,  -1,  -1,
-      122, 123,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 124,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 125,
-      126, 127, 128, 129,  -1,  -1,  -1,  -1,  -1,  -1,
-      130,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      131,  -1, 132,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 133,  -1, 134, 135,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 136,  -1,  -1, 137,  -1,
-       -1,  -1,  -1, 138,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 139,  -1, 140,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 141,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 142,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 143,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 144,  -1,
-       -1, 145, 146,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 147,  -1,  -1, 148,  -1,  -1, 149,  -1,
-      150,  -1,  -1,  -1,  -1, 151, 152, 153,  -1,  -1,
-       -1, 154,  -1,  -1,  -1, 155, 156,  -1,  -1,  -1,
-       -1, 157,  -1,  -1,  -1, 158, 159,  -1,  -1,  -1,
-       -1,  -1, 160,  -1,  -1, 161,  -1,  -1,  -1,  -1,
-      162, 163,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      164, 165, 166,  -1,  -1, 167, 168,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 169,  -1,  -1,  -1,
-      170,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 171, 172,  -1,  -1,  -1,  -1,
-      173,  -1,  -1,  -1,  -1,  -1, 174,  -1,  -1,  -1,
-      175, 176, 177,  -1,  -1, 178, 179, 180,  -1,  -1,
-       -1, 181, 182,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      183, 184,  -1,  -1,  -1,  -1, 185,  -1,  -1,  -1,
-      186, 187, 188,  -1, 189,  -1,  -1, 190,  -1,  -1,
-      191,  -1,  -1,  -1,  -1, 192, 193,  -1,  -1,  -1,
-      194,  -1,  -1,  -1,  -1,  -1,  -1, 195,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 196,  -1, 197,  -1,
-       -1,  -1,  -1,  -1,  -1, 198, 199,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 200,  -1,  -1,  -1,
-       -1, 201,  -1,  -1,  -1,  -1, 202,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 203,  -1, 204,  -1,  -1,
-       -1, 205,  -1,  -1,  -1,  -1,  -1,  -1, 206,  -1,
-       -1,  -1,  -1,  -1,  -1, 207, 208,  -1,  -1,  -1,
-      209,  -1, 210,  -1,  -1, 211,  -1, 212,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 213,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 214,  -1,  -1,  -1,  -1,
-       -1, 215,  -1,  -1,  -1, 216,  -1,  -1,  -1,  -1,
-       -1, 217,  -1,  -1,  -1,  -1, 218,  -1,  -1,  -1,
-      219,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      220, 221,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 222, 223,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 224,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 225, 226, 227,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 228, 229,  -1,  -1,  -1,
-       -1, 230,  -1,  -1,  -1, 231,  -1, 232, 233,  -1,
-       -1,  -1,  -1,  -1,  -1, 234,  -1,  -1,  -1,  -1,
-      235, 236,  -1,  -1,  -1, 237,  -1,  -1,  -1,  -1,
-      238, 239,  -1,  -1,  -1, 240,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 241,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 242,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 243, 244,  -1, 245,  -1,
-       -1,  -1,  -1,  -1,  -1, 246, 247,  -1,  -1,  -1,
-       -1,  -1,  -1, 248,  -1,  -1,  -1,  -1, 249,  -1,
-       -1,  -1,  -1,  -1,  -1, 250, 251, 252,  -1,  -1,
-      253,  -1,  -1,  -1,  -1, 254,  -1,  -1,  -1,  -1,
-      255, 256,  -1, 257,  -1,  -1,  -1, 258,  -1,  -1,
-      259, 260,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1,
-      262,  -1,  -1,  -1,  -1,  -1, 263,  -1, 264,  -1,
-      265, 266, 267,  -1,  -1,  -1, 268, 269,  -1,  -1,
-       -1, 270,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       28,  29,  -1,  -1,  -1,  30,  31,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  32,  -1,  -1,  -1,  -1,
+       33,  -1,  -1,  -1,  -1,  34,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  35,  36,  -1,  -1,
+       37,  -1,  38,  -1,  -1,  -1,  39,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  40,  -1,  -1,  -1,
+       -1,  41,  -1,  -1,  -1,  42,  43,  44,  -1,  -1,
+       -1,  45,  -1,  46,  -1,  47,  -1,  -1,  -1,  -1,
+       -1,  48,  -1,  -1,  49,  -1,  -1,  -1,  -1,  -1,
+       -1,  50,  -1,  -1,  -1,  51,  52,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       53,  -1,  54,  -1,  -1,  55,  -1,  -1,  -1,  -1,
+       56,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  57,  -1,  -1,  -1,  58,  -1,  59,  -1,  -1,
+       60,  -1,  -1,  61,  -1,  62,  -1,  -1,  -1,  -1,
+       63,  -1,  64,  65,  -1,  -1,  66,  67,  -1,  -1,
+       68,  -1,  -1,  -1,  -1,  69,  70,  -1,  -1,  -1,
+       -1,  71,  -1,  72,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  73,  74,  -1,  75,  76,  -1,  -1,  -1,
+       -1,  -1,  -1,  77,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  78,  -1,  -1,  -1,  79,  80,  -1,  -1,  -1,
+       81,  -1,  -1,  -1,  -1,  82,  83,  -1,  -1,  -1,
+       84,  85,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       86,  -1,  87,  -1,  -1,  -1,  88,  -1,  -1,  -1,
+       -1,  89,  -1,  -1,  -1,  90,  -1,  -1,  -1,  -1,
+       -1,  91,  92,  -1,  -1,  93,  94,  95,  -1,  -1,
+       -1,  96,  -1,  -1,  97,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       98,  -1,  99,  -1,  -1, 100,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 101,  -1,  -1,  -1,  -1,
+       -1, 102,  -1,  -1,  -1,  -1, 103,  -1,  -1,  -1,
+      104,  -1, 105,  -1,  -1, 106, 107,  -1,  -1,  -1,
+      108,  -1, 109,  -1,  -1,  -1,  -1, 110, 111,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 112,  -1,  -1,  -1,
+      113,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 114,  -1,  -1,  -1,
+      115,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 116,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 117, 118,  -1,  -1,  -1,
+      119,  -1,  -1,  -1,  -1, 120,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 121,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 122, 123,  -1, 124,  -1,  -1,  -1,
+      125,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 126,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 127,  -1,  -1,  -1,
+       -1, 128,  -1,  -1,  -1,  -1, 129,  -1,  -1,  -1,
+      130,  -1,  -1,  -1,  -1, 131,  -1,  -1,  -1,  -1,
+      132,  -1, 133,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      134,  -1,  -1,  -1, 135,  -1,  -1,  -1,  -1,  -1,
+      136,  -1,  -1,  -1,  -1, 137,  -1,  -1,  -1,  -1,
+       -1, 138,  -1,  -1,  -1, 139,  -1,  -1,  -1,  -1,
+      140,  -1,  -1,  -1,  -1,  -1, 141,  -1, 142,  -1,
+      143,  -1,  -1,  -1,  -1, 144,  -1,  -1,  -1,  -1,
+      145, 146,  -1,  -1,  -1,  -1, 147,  -1,  -1,  -1,
+      148,  -1,  -1,  -1,  -1, 149,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 150,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 151,  -1,  -1,  -1,  -1,
+      152,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 153,  -1,  -1,  -1,
+       -1, 154,  -1,  -1,  -1,  -1, 155,  -1,  -1,  -1,
+      156,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 157,  -1, 158, 159, 160, 161,  -1,
+      162, 163,  -1,  -1,  -1, 164,  -1,  -1,  -1,  -1,
+       -1, 165,  -1,  -1,  -1, 166,  -1,  -1,  -1,  -1,
+      167, 168,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 169,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 170,  -1,  -1,
+       -1,  -1, 171,  -1,  -1, 172, 173,  -1,  -1,  -1,
+       -1, 174,  -1,  -1,  -1, 175,  -1, 176,  -1,  -1,
+       -1, 177,  -1,  -1,  -1, 178, 179, 180,  -1,  -1,
+      181, 182,  -1, 183,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 184,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 185, 186,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 187,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 188,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 189,  -1,  -1,  -1,  -1,  -1, 190,  -1,  -1,
+      191,  -1,  -1,  -1,  -1,  -1, 192,  -1,  -1,  -1,
+      193,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 194, 195,  -1,  -1, 196,  -1,  -1,  -1,  -1,
+      197,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 198,  -1,  -1,  -1,  -1,
+       -1, 199,  -1,  -1,  -1, 200,  -1, 201,  -1,  -1,
+      202,  -1, 203,  -1,  -1,  -1, 204,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 205,  -1,  -1,  -1,  -1,
+      206,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 207,  -1,  -1,  -1,  -1,
+      208,  -1, 209,  -1,  -1, 210,  -1, 211,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      212, 213, 214,  -1,  -1,  -1, 215,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      216,  -1,  -1,  -1,  -1, 217, 218,  -1,  -1,  -1,
+      219,  -1,  -1,  -1,  -1, 220, 221,  -1,  -1,  -1,
+      222,  -1,  -1,  -1,  -1,  -1, 223,  -1, 224,  -1,
+      225, 226,  -1,  -1, 227,  -1, 228,  -1,  -1,  -1,
+      229, 230,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      231,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      232,  -1,  -1,  -1,  -1, 233, 234,  -1,  -1,  -1,
+      235,  -1, 236,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      237, 238,  -1,  -1,  -1, 239,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 240, 241,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 242, 243,  -1,  -1,  -1,
+       -1, 244, 245,  -1,  -1,  -1,  -1, 246,  -1,  -1,
+       -1,  -1,  -1, 247,  -1,  -1,  -1,  -1,  -1,  -1,
+      248, 249,  -1,  -1,  -1,  -1, 250,  -1,  -1,  -1,
+       -1, 251, 252,  -1,  -1, 253, 254,  -1,  -1,  -1,
+      255,  -1, 256,  -1,  -1, 257,  -1,  -1,  -1,  -1,
+       -1, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      259,  -1,  -1,  -1,  -1, 260,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,
+      263, 264,  -1,  -1,  -1,  -1,  -1, 265,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 266,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      267,  -1,  -1, 268,  -1, 269, 270,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1, 271,  -1,  -1,  -1,  -1,
-      272,  -1, 273,  -1,  -1, 274,  -1,  -1, 275,  -1,
-      276,  -1, 277, 278,  -1, 279,  -1, 280,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      281,  -1, 282,  -1,  -1, 283, 284,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      285,  -1,  -1, 286,  -1, 287,  -1,  -1,  -1,  -1,
-      288, 289,  -1, 290,  -1, 291, 292,  -1,  -1, 293,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 294,  -1, 295,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 296,  -1,  -1,  -1,  -1,  -1,  -1, 297,  -1,
-      298,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      299,  -1,  -1,  -1,  -1,  -1, 300,  -1,  -1,  -1,
-       -1,  -1, 301,  -1,  -1, 302,  -1,  -1, 303,  -1,
-      304,  -1,  -1,  -1,  -1, 305,  -1,  -1,  -1,  -1,
-      306, 307, 308,  -1,  -1, 309,  -1,  -1,  -1,  -1,
-       -1,  -1, 310,  -1,  -1, 311,  -1,  -1,  -1,  -1,
-       -1, 312,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 313, 314,  -1,  -1,  -1,
-       -1,  -1, 315,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 316,  -1,  -1,  -1,  -1,  -1,  -1,
-      317,  -1,  -1,  -1,  -1,  -1, 318,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      319,  -1, 320,  -1,  -1,  -1, 321,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 322,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 323, 324,  -1, 325,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 326,  -1,  -1,  -1,
+       -1, 272,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 273,  -1,  -1,  -1,  -1,  -1,  -1, 274,  -1,
+       -1, 275,  -1,  -1,  -1, 276, 277, 278,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 279,  -1,  -1,  -1,  -1,
+       -1, 280,  -1,  -1,  -1, 281,  -1,  -1,  -1,  -1,
+      282,  -1,  -1,  -1,  -1, 283, 284,  -1,  -1,  -1,
+       -1, 285,  -1,  -1,  -1, 286,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 287, 288,  -1,  -1,
+       -1, 289,  -1,  -1,  -1, 290,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 291, 292,  -1,  -1,  -1,
+      293,  -1,  -1,  -1,  -1, 294,  -1, 295,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 296,  -1,  -1,  -1,  -1,
+      297,  -1,  -1,  -1, 298,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 299,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 300,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 301,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 302,  -1, 303,  -1, 304,  -1,  -1,  -1,  -1,
+      305,  -1,  -1,  -1,  -1,  -1, 306,  -1,  -1,  -1,
+       -1, 307,  -1,  -1,  -1, 308,  -1,  -1,  -1,  -1,
+      309,  -1,  -1,  -1,  -1, 310,  -1,  -1,  -1,  -1,
+      311,  -1,  -1,  -1,  -1, 312,  -1,  -1,  -1,  -1,
+       -1,  -1, 313,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 314,  -1,  -1,  -1,  -1, 315,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 316,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 317,
+       -1,  -1, 318,  -1,  -1,  -1,  -1, 319,  -1,  -1,
+       -1,  -1, 320,  -1,  -1,  -1, 321,  -1,  -1,  -1,
+       -1,  -1, 322,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 323,  -1,  -1,  -1,
+       -1, 324, 325,  -1,  -1, 326,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1, 327,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 328, 329,  -1,  -1,  -1,
-       -1, 330,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      331,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 332,  -1, 333,  -1,  -1, 334,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 335, 336,  -1,  -1,  -1,
-      337,  -1,  -1,  -1,  -1,  -1,  -1, 338,  -1,  -1,
-       -1, 339,  -1,  -1,  -1,  -1, 340, 341,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 342,  -1, 343,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      344, 345,  -1, 346,  -1, 347,  -1,  -1,  -1,  -1,
-      348,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 349,
-      350, 351,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 352, 353, 354,  -1,  -1,  -1,  -1, 355,  -1,
-      356,  -1,  -1,  -1,  -1,  -1,  -1, 357,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 358,  -1,  -1,  -1,
-       -1, 359, 360, 361,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 362, 363,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 364,  -1,  -1, 365,  -1,  -1,  -1,  -1,  -1,
-       -1, 366, 367,  -1,  -1,  -1, 368,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 369,  -1,  -1,  -1,
-       -1,  -1,  -1, 370,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 371,  -1,  -1,  -1, 372,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 373,  -1,  -1,  -1,  -1, 374,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 375,  -1, 376, 377,
-       -1,  -1,  -1,  -1,  -1, 378,  -1,  -1,  -1,  -1,
-      379,  -1,  -1,  -1,  -1,  -1, 380,  -1,  -1,  -1,
-      381,  -1,  -1,  -1,  -1, 382, 383,  -1,  -1,  -1,
-       -1,  -1, 384,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 385,  -1,  -1,  -1,  -1, 386,  -1,  -1,  -1,
-       -1, 387,  -1, 388,  -1,  -1, 389,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 390,  -1,  -1,
-       -1, 391,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 392,  -1,
-      393,  -1,  -1,  -1,  -1, 394,  -1,  -1, 395,  -1,
-       -1, 396,  -1,  -1,  -1, 397,  -1, 398,  -1,  -1,
-      399,  -1,  -1,  -1,  -1,  -1,  -1, 400,  -1,  -1,
-       -1, 401,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 402,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 403,  -1,  -1,  -1,  -1,
-       -1, 404,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 405,  -1,  -1,  -1,
-       -1,  -1,  -1, 406,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 407,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      408,  -1,  -1,  -1,  -1,  -1, 409,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 411,  -1,  -1,  -1,  -1, 412, 413,  -1,  -1,
-       -1, 414,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 415, 416,  -1,  -1,
-       -1,  -1, 417,  -1,  -1,  -1,  -1, 418,  -1,  -1,
-       -1,  -1, 419,  -1,  -1,  -1,  -1,  -1,  -1, 420,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 421,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 422,  -1,  -1,
-       -1, 423,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 424,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 425,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 426, 427,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      428,  -1,  -1,  -1,  -1,  -1, 429,  -1,  -1,  -1,
-      430,  -1,  -1,  -1,  -1,  -1,  -1, 431,  -1,  -1,
+      328,  -1,  -1, 329,  -1, 330, 331,  -1,  -1,  -1,
+      332,  -1,  -1,  -1,  -1, 333, 334,  -1,  -1,  -1,
+       -1, 335, 336,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      337,  -1,  -1,  -1,  -1, 338,  -1, 339,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 340,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 341,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 342,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 343,  -1,  -1, 344,  -1,  -1,  -1,  -1,  -1,
+       -1, 345,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 346,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 347,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 348, 349,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 350,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 351,  -1,
+       -1, 352,  -1,  -1,  -1,  -1, 353,  -1,  -1,  -1,
+      354, 355,  -1,  -1,  -1, 356,  -1,  -1,  -1,  -1,
+      357,  -1,  -1, 358,  -1,  -1, 359,  -1, 360,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      361,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 362,  -1,
+       -1,  -1,  -1, 363,  -1,  -1,  -1,  -1, 364,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 365,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 366,  -1,  -1,  -1,
+       -1,  -1,  -1, 367,  -1,  -1,  -1,  -1,  -1,  -1,
+      368,  -1,  -1,  -1,  -1, 369,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 370, 371,  -1,  -1,  -1,
+       -1, 372,  -1,  -1,  -1,  -1,  -1, 373,  -1,  -1,
+      374,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 375,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 376,  -1, 377,  -1,  -1,  -1,  -1,  -1,  -1,
+      378,  -1,  -1,  -1, 379, 380,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 381,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 382,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      383, 384,  -1,  -1,  -1, 385, 386,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 387,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 388, 389,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      390,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 391,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      392,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      393,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 394,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 395,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 396,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 397,  -1,  -1,  -1,  -1,
+       -1,  -1, 398,  -1,  -1, 399,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      400,  -1,  -1,  -1,  -1, 401,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 402, 403, 404,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      405,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 406,
+       -1, 407, 408,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      409,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 411,  -1,  -1,  -1,
+      412,  -1,  -1,  -1,  -1, 413,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 414,  -1, 415,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      416,  -1,  -1,  -1,  -1, 417,  -1,  -1,  -1,  -1,
+       -1, 418,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 419,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      420,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 421,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      422,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 423,  -1, 424,  -1,  -1,
+       -1, 425,  -1,  -1,  -1, 426,  -1,  -1, 427,  -1,
+       -1,  -1,  -1,  -1,  -1, 428,  -1,  -1,  -1,  -1,
+       -1,  -1, 429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 430,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 431,  -1,
       432,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 433,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 434,  -1,  -1,  -1,  -1,
+       -1, 435,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 438,  -1,  -1,  -1, 439, 440,  -1,  -1,  -1,
+       -1,  -1, 441,  -1,  -1, 442,  -1,  -1,  -1,  -1,
+       -1, 443,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 444,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 445,  -1,  -1,
+       -1,  -1,  -1, 446,  -1,  -1, 447,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 448,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      449,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 450,  -1,  -1,  -1,  -1,  -1, 451,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 452,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 453,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 454,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 455,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      433,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      434,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 435,  -1,
-       -1,  -1,  -1,  -1, 436,  -1,  -1, 437,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 438,  -1, 439,  -1,  -1,
-       -1,  -1, 440,  -1,  -1,  -1, 441, 442,  -1,  -1,
+       -1, 456,  -1,  -1,  -1,  -1, 457,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 458,  -1,  -1,  -1,  -1, 459,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 460, 461,  -1,  -1,  -1, 462, 463,  -1,  -1,
+      464,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      465,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 466,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      467, 468,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 443,  -1,  -1,  -1, 444,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 470,  -1,  -1,  -1,
+       -1,  -1, 471,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 445,  -1, 446,  -1,  -1,  -1,  -1,
-       -1,  -1, 447,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 472,  -1,  -1,  -1,  -1, 473,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 448,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 449, 450,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 451, 452,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 453,  -1,
-       -1,  -1,  -1,  -1,  -1, 454,  -1,  -1,  -1,  -1,
-       -1,  -1, 455,  -1,  -1,  -1,  -1, 456,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 457,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 458,  -1,  -1, 459,  -1,
-      460,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 474,  -1,  -1,  -1, 475,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 461, 462,  -1,  -1,  -1,  -1,  -1, 463,  -1,
-       -1,  -1,  -1,  -1, 464,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 465,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 476,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,  -1,  -1,
+       -1, 477,  -1,  -1,  -1, 478,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 467,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      468,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      469,  -1,  -1,  -1,  -1, 470,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 479, 480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 471,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 472,  -1,  -1,  -1,
-       -1,  -1, 473,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 474,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 475,  -1, 476,  -1,
-       -1, 477,  -1,  -1,  -1,  -1, 478,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 481,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 481,  -1,  -1,
-       -1,  -1,  -1,  -1, 482,  -1, 483,  -1,  -1,  -1,
+       -1, 482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 483,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 484,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 485,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 484,  -1,  -1,  -1,  -1, 485,  -1,  -1,  -1,
        -1, 486,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 487,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 487,  -1,  -1,  -1,  -1,
+       -1, 488,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      489,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 490,  -1,  -1,  -1,  -1,
+       -1, 491, 492,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 493,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 494,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      490,  -1,  -1,  -1,  -1,  -1, 491,  -1,  -1,  -1,
-       -1, 492, 493,  -1,  -1,  -1,  -1, 494,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 495,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 496,  -1,  -1,  -1,
-       -1,  -1, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      495,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 496,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1, 498,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 499,  -1,  -1,  -1,  -1, 500,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 501,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      499, 500,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 501,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1, 502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 503, 504,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,  -1,
-       -1, 506,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 507,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1591,40 +1726,120 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 503,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      506,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 507,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
       508,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      509,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 511,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 512,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 509,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 513,  -1,  -1,  -1, 514,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 512,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 515,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 516,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      517,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 515,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 516,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 517, 518,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 518,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1, 519,  -1,  -1,  -1,  -1,
@@ -1632,36 +1847,47 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 520,  -1, 521,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 522,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 520,  -1, 521,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 524,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      525,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 526,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 522,  -1,  -1,
+      527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 528,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 523,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1672,11 +1898,9 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      524,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1687,11 +1911,10 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 529,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      526,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 527,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1703,6 +1926,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 530,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1718,6 +1942,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      531,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1729,11 +1954,11 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 532,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1745,13 +1970,13 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 529,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 533,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1759,6 +1984,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 534,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1792,7 +2018,139 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 530
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 536
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -1814,7 +2172,7 @@ findValue (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 542 "CSSValueKeywords.gperf"
+#line 548 "CSSValueKeywords.gperf"
 
 static const char * const valueList[] = {
 "",
@@ -2147,6 +2505,9 @@ static const char * const valueList[] = {
 "media-seek-forward-button", 
 "media-slider", 
 "media-sliderthumb", 
+"media-timeline-container", 
+"media-current-time-display", 
+"media-time-remaining-display", 
 "menulist", 
 "menulist-button", 
 "menulist-text", 
@@ -2168,6 +2529,7 @@ static const char * const valueList[] = {
 "border", 
 "content", 
 "padding", 
+"padding-box", 
 "border-box", 
 "content-box", 
 "logical", 
@@ -2175,6 +2537,8 @@ static const char * const valueList[] = {
 "lines", 
 "running", 
 "paused", 
+"flat", 
+"preserve-3d", 
 "ease", 
 "linear", 
 "ease-in", 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
index 505c95e94f..8b6c66983a 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
@@ -333,209 +333,215 @@ const int CSSValueMediaSeekBackButton = 326;
 const int CSSValueMediaSeekForwardButton = 327;
 const int CSSValueMediaSlider = 328;
 const int CSSValueMediaSliderthumb = 329;
-const int CSSValueMenulist = 330;
-const int CSSValueMenulistButton = 331;
-const int CSSValueMenulistText = 332;
-const int CSSValueMenulistTextfield = 333;
-const int CSSValueSliderHorizontal = 334;
-const int CSSValueSliderVertical = 335;
-const int CSSValueSliderthumbHorizontal = 336;
-const int CSSValueSliderthumbVertical = 337;
-const int CSSValueCaret = 338;
-const int CSSValueSearchfield = 339;
-const int CSSValueSearchfieldDecoration = 340;
-const int CSSValueSearchfieldResultsDecoration = 341;
-const int CSSValueSearchfieldResultsButton = 342;
-const int CSSValueSearchfieldCancelButton = 343;
-const int CSSValueTextfield = 344;
-const int CSSValueTextarea = 345;
-const int CSSValueCapsLockIndicator = 346;
-const int CSSValueRound = 347;
-const int CSSValueBorder = 348;
-const int CSSValueContent = 349;
-const int CSSValuePadding = 350;
-const int CSSValueBorderBox = 351;
-const int CSSValueContentBox = 352;
-const int CSSValueLogical = 353;
-const int CSSValueVisual = 354;
-const int CSSValueLines = 355;
-const int CSSValueRunning = 356;
-const int CSSValuePaused = 357;
-const int CSSValueEase = 358;
-const int CSSValueLinear = 359;
-const int CSSValueEaseIn = 360;
-const int CSSValueEaseOut = 361;
-const int CSSValueEaseInOut = 362;
-const int CSSValueDocument = 363;
-const int CSSValueReset = 364;
-const int CSSValueVisiblepainted = 365;
-const int CSSValueVisiblefill = 366;
-const int CSSValueVisiblestroke = 367;
-const int CSSValuePainted = 368;
-const int CSSValueFill = 369;
-const int CSSValueStroke = 370;
-const int CSSValueAliceblue = 371;
-const int CSSValueAntiquewhite = 372;
-const int CSSValueAquamarine = 373;
-const int CSSValueAzure = 374;
-const int CSSValueBeige = 375;
-const int CSSValueBisque = 376;
-const int CSSValueBlanchedalmond = 377;
-const int CSSValueBlueviolet = 378;
-const int CSSValueBrown = 379;
-const int CSSValueBurlywood = 380;
-const int CSSValueCadetblue = 381;
-const int CSSValueChartreuse = 382;
-const int CSSValueChocolate = 383;
-const int CSSValueCoral = 384;
-const int CSSValueCornflowerblue = 385;
-const int CSSValueCornsilk = 386;
-const int CSSValueCrimson = 387;
-const int CSSValueCyan = 388;
-const int CSSValueDarkblue = 389;
-const int CSSValueDarkcyan = 390;
-const int CSSValueDarkgoldenrod = 391;
-const int CSSValueDarkgray = 392;
-const int CSSValueDarkgreen = 393;
-const int CSSValueDarkgrey = 394;
-const int CSSValueDarkkhaki = 395;
-const int CSSValueDarkmagenta = 396;
-const int CSSValueDarkolivegreen = 397;
-const int CSSValueDarkorange = 398;
-const int CSSValueDarkorchid = 399;
-const int CSSValueDarkred = 400;
-const int CSSValueDarksalmon = 401;
-const int CSSValueDarkseagreen = 402;
-const int CSSValueDarkslateblue = 403;
-const int CSSValueDarkslategray = 404;
-const int CSSValueDarkslategrey = 405;
-const int CSSValueDarkturquoise = 406;
-const int CSSValueDarkviolet = 407;
-const int CSSValueDeeppink = 408;
-const int CSSValueDeepskyblue = 409;
-const int CSSValueDimgray = 410;
-const int CSSValueDimgrey = 411;
-const int CSSValueDodgerblue = 412;
-const int CSSValueFirebrick = 413;
-const int CSSValueFloralwhite = 414;
-const int CSSValueForestgreen = 415;
-const int CSSValueGainsboro = 416;
-const int CSSValueGhostwhite = 417;
-const int CSSValueGold = 418;
-const int CSSValueGoldenrod = 419;
-const int CSSValueGreenyellow = 420;
-const int CSSValueHoneydew = 421;
-const int CSSValueHotpink = 422;
-const int CSSValueIndianred = 423;
-const int CSSValueIndigo = 424;
-const int CSSValueIvory = 425;
-const int CSSValueKhaki = 426;
-const int CSSValueLavender = 427;
-const int CSSValueLavenderblush = 428;
-const int CSSValueLawngreen = 429;
-const int CSSValueLemonchiffon = 430;
-const int CSSValueLightblue = 431;
-const int CSSValueLightcoral = 432;
-const int CSSValueLightcyan = 433;
-const int CSSValueLightgoldenrodyellow = 434;
-const int CSSValueLightgray = 435;
-const int CSSValueLightgreen = 436;
-const int CSSValueLightgrey = 437;
-const int CSSValueLightpink = 438;
-const int CSSValueLightsalmon = 439;
-const int CSSValueLightseagreen = 440;
-const int CSSValueLightskyblue = 441;
-const int CSSValueLightslategray = 442;
-const int CSSValueLightslategrey = 443;
-const int CSSValueLightsteelblue = 444;
-const int CSSValueLightyellow = 445;
-const int CSSValueLimegreen = 446;
-const int CSSValueLinen = 447;
-const int CSSValueMagenta = 448;
-const int CSSValueMediumaquamarine = 449;
-const int CSSValueMediumblue = 450;
-const int CSSValueMediumorchid = 451;
-const int CSSValueMediumpurple = 452;
-const int CSSValueMediumseagreen = 453;
-const int CSSValueMediumslateblue = 454;
-const int CSSValueMediumspringgreen = 455;
-const int CSSValueMediumturquoise = 456;
-const int CSSValueMediumvioletred = 457;
-const int CSSValueMidnightblue = 458;
-const int CSSValueMintcream = 459;
-const int CSSValueMistyrose = 460;
-const int CSSValueMoccasin = 461;
-const int CSSValueNavajowhite = 462;
-const int CSSValueOldlace = 463;
-const int CSSValueOlivedrab = 464;
-const int CSSValueOrangered = 465;
-const int CSSValueOrchid = 466;
-const int CSSValuePalegoldenrod = 467;
-const int CSSValuePalegreen = 468;
-const int CSSValuePaleturquoise = 469;
-const int CSSValuePalevioletred = 470;
-const int CSSValuePapayawhip = 471;
-const int CSSValuePeachpuff = 472;
-const int CSSValuePeru = 473;
-const int CSSValuePink = 474;
-const int CSSValuePlum = 475;
-const int CSSValuePowderblue = 476;
-const int CSSValueRosybrown = 477;
-const int CSSValueRoyalblue = 478;
-const int CSSValueSaddlebrown = 479;
-const int CSSValueSalmon = 480;
-const int CSSValueSandybrown = 481;
-const int CSSValueSeagreen = 482;
-const int CSSValueSeashell = 483;
-const int CSSValueSienna = 484;
-const int CSSValueSkyblue = 485;
-const int CSSValueSlateblue = 486;
-const int CSSValueSlategray = 487;
-const int CSSValueSlategrey = 488;
-const int CSSValueSnow = 489;
-const int CSSValueSpringgreen = 490;
-const int CSSValueSteelblue = 491;
-const int CSSValueTan = 492;
-const int CSSValueThistle = 493;
-const int CSSValueTomato = 494;
-const int CSSValueTurquoise = 495;
-const int CSSValueViolet = 496;
-const int CSSValueWheat = 497;
-const int CSSValueWhitesmoke = 498;
-const int CSSValueYellowgreen = 499;
-const int CSSValueNonzero = 500;
-const int CSSValueEvenodd = 501;
-const int CSSValueAccumulate = 502;
-const int CSSValueNew = 503;
-const int CSSValueSrgb = 504;
-const int CSSValueLinearrgb = 505;
-const int CSSValueOptimizespeed = 506;
-const int CSSValueOptimizequality = 507;
-const int CSSValueCrispedges = 508;
-const int CSSValueGeometricprecision = 509;
-const int CSSValueButt = 510;
-const int CSSValueMiter = 511;
-const int CSSValueBevel = 512;
-const int CSSValueOptimizelegibility = 513;
-const int CSSValueBeforeEdge = 514;
-const int CSSValueAfterEdge = 515;
-const int CSSValueCentral = 516;
-const int CSSValueTextBeforeEdge = 517;
-const int CSSValueTextAfterEdge = 518;
-const int CSSValueIdeographic = 519;
-const int CSSValueAlphabetic = 520;
-const int CSSValueHanging = 521;
-const int CSSValueMathematical = 522;
-const int CSSValueUseScript = 523;
-const int CSSValueNoChange = 524;
-const int CSSValueResetSize = 525;
-const int CSSValueLrTb = 526;
-const int CSSValueRlTb = 527;
-const int CSSValueTbRl = 528;
-const int CSSValueLr = 529;
-const int CSSValueRl = 530;
-const int CSSValueTb = 531;
-const int numCSSValueKeywords = 532;
+const int CSSValueMediaTimelineContainer = 330;
+const int CSSValueMediaCurrentTimeDisplay = 331;
+const int CSSValueMediaTimeRemainingDisplay = 332;
+const int CSSValueMenulist = 333;
+const int CSSValueMenulistButton = 334;
+const int CSSValueMenulistText = 335;
+const int CSSValueMenulistTextfield = 336;
+const int CSSValueSliderHorizontal = 337;
+const int CSSValueSliderVertical = 338;
+const int CSSValueSliderthumbHorizontal = 339;
+const int CSSValueSliderthumbVertical = 340;
+const int CSSValueCaret = 341;
+const int CSSValueSearchfield = 342;
+const int CSSValueSearchfieldDecoration = 343;
+const int CSSValueSearchfieldResultsDecoration = 344;
+const int CSSValueSearchfieldResultsButton = 345;
+const int CSSValueSearchfieldCancelButton = 346;
+const int CSSValueTextfield = 347;
+const int CSSValueTextarea = 348;
+const int CSSValueCapsLockIndicator = 349;
+const int CSSValueRound = 350;
+const int CSSValueBorder = 351;
+const int CSSValueContent = 352;
+const int CSSValuePadding = 353;
+const int CSSValuePaddingBox = 354;
+const int CSSValueBorderBox = 355;
+const int CSSValueContentBox = 356;
+const int CSSValueLogical = 357;
+const int CSSValueVisual = 358;
+const int CSSValueLines = 359;
+const int CSSValueRunning = 360;
+const int CSSValuePaused = 361;
+const int CSSValueFlat = 362;
+const int CSSValuePreserve3d = 363;
+const int CSSValueEase = 364;
+const int CSSValueLinear = 365;
+const int CSSValueEaseIn = 366;
+const int CSSValueEaseOut = 367;
+const int CSSValueEaseInOut = 368;
+const int CSSValueDocument = 369;
+const int CSSValueReset = 370;
+const int CSSValueVisiblepainted = 371;
+const int CSSValueVisiblefill = 372;
+const int CSSValueVisiblestroke = 373;
+const int CSSValuePainted = 374;
+const int CSSValueFill = 375;
+const int CSSValueStroke = 376;
+const int CSSValueAliceblue = 377;
+const int CSSValueAntiquewhite = 378;
+const int CSSValueAquamarine = 379;
+const int CSSValueAzure = 380;
+const int CSSValueBeige = 381;
+const int CSSValueBisque = 382;
+const int CSSValueBlanchedalmond = 383;
+const int CSSValueBlueviolet = 384;
+const int CSSValueBrown = 385;
+const int CSSValueBurlywood = 386;
+const int CSSValueCadetblue = 387;
+const int CSSValueChartreuse = 388;
+const int CSSValueChocolate = 389;
+const int CSSValueCoral = 390;
+const int CSSValueCornflowerblue = 391;
+const int CSSValueCornsilk = 392;
+const int CSSValueCrimson = 393;
+const int CSSValueCyan = 394;
+const int CSSValueDarkblue = 395;
+const int CSSValueDarkcyan = 396;
+const int CSSValueDarkgoldenrod = 397;
+const int CSSValueDarkgray = 398;
+const int CSSValueDarkgreen = 399;
+const int CSSValueDarkgrey = 400;
+const int CSSValueDarkkhaki = 401;
+const int CSSValueDarkmagenta = 402;
+const int CSSValueDarkolivegreen = 403;
+const int CSSValueDarkorange = 404;
+const int CSSValueDarkorchid = 405;
+const int CSSValueDarkred = 406;
+const int CSSValueDarksalmon = 407;
+const int CSSValueDarkseagreen = 408;
+const int CSSValueDarkslateblue = 409;
+const int CSSValueDarkslategray = 410;
+const int CSSValueDarkslategrey = 411;
+const int CSSValueDarkturquoise = 412;
+const int CSSValueDarkviolet = 413;
+const int CSSValueDeeppink = 414;
+const int CSSValueDeepskyblue = 415;
+const int CSSValueDimgray = 416;
+const int CSSValueDimgrey = 417;
+const int CSSValueDodgerblue = 418;
+const int CSSValueFirebrick = 419;
+const int CSSValueFloralwhite = 420;
+const int CSSValueForestgreen = 421;
+const int CSSValueGainsboro = 422;
+const int CSSValueGhostwhite = 423;
+const int CSSValueGold = 424;
+const int CSSValueGoldenrod = 425;
+const int CSSValueGreenyellow = 426;
+const int CSSValueHoneydew = 427;
+const int CSSValueHotpink = 428;
+const int CSSValueIndianred = 429;
+const int CSSValueIndigo = 430;
+const int CSSValueIvory = 431;
+const int CSSValueKhaki = 432;
+const int CSSValueLavender = 433;
+const int CSSValueLavenderblush = 434;
+const int CSSValueLawngreen = 435;
+const int CSSValueLemonchiffon = 436;
+const int CSSValueLightblue = 437;
+const int CSSValueLightcoral = 438;
+const int CSSValueLightcyan = 439;
+const int CSSValueLightgoldenrodyellow = 440;
+const int CSSValueLightgray = 441;
+const int CSSValueLightgreen = 442;
+const int CSSValueLightgrey = 443;
+const int CSSValueLightpink = 444;
+const int CSSValueLightsalmon = 445;
+const int CSSValueLightseagreen = 446;
+const int CSSValueLightskyblue = 447;
+const int CSSValueLightslategray = 448;
+const int CSSValueLightslategrey = 449;
+const int CSSValueLightsteelblue = 450;
+const int CSSValueLightyellow = 451;
+const int CSSValueLimegreen = 452;
+const int CSSValueLinen = 453;
+const int CSSValueMagenta = 454;
+const int CSSValueMediumaquamarine = 455;
+const int CSSValueMediumblue = 456;
+const int CSSValueMediumorchid = 457;
+const int CSSValueMediumpurple = 458;
+const int CSSValueMediumseagreen = 459;
+const int CSSValueMediumslateblue = 460;
+const int CSSValueMediumspringgreen = 461;
+const int CSSValueMediumturquoise = 462;
+const int CSSValueMediumvioletred = 463;
+const int CSSValueMidnightblue = 464;
+const int CSSValueMintcream = 465;
+const int CSSValueMistyrose = 466;
+const int CSSValueMoccasin = 467;
+const int CSSValueNavajowhite = 468;
+const int CSSValueOldlace = 469;
+const int CSSValueOlivedrab = 470;
+const int CSSValueOrangered = 471;
+const int CSSValueOrchid = 472;
+const int CSSValuePalegoldenrod = 473;
+const int CSSValuePalegreen = 474;
+const int CSSValuePaleturquoise = 475;
+const int CSSValuePalevioletred = 476;
+const int CSSValuePapayawhip = 477;
+const int CSSValuePeachpuff = 478;
+const int CSSValuePeru = 479;
+const int CSSValuePink = 480;
+const int CSSValuePlum = 481;
+const int CSSValuePowderblue = 482;
+const int CSSValueRosybrown = 483;
+const int CSSValueRoyalblue = 484;
+const int CSSValueSaddlebrown = 485;
+const int CSSValueSalmon = 486;
+const int CSSValueSandybrown = 487;
+const int CSSValueSeagreen = 488;
+const int CSSValueSeashell = 489;
+const int CSSValueSienna = 490;
+const int CSSValueSkyblue = 491;
+const int CSSValueSlateblue = 492;
+const int CSSValueSlategray = 493;
+const int CSSValueSlategrey = 494;
+const int CSSValueSnow = 495;
+const int CSSValueSpringgreen = 496;
+const int CSSValueSteelblue = 497;
+const int CSSValueTan = 498;
+const int CSSValueThistle = 499;
+const int CSSValueTomato = 500;
+const int CSSValueTurquoise = 501;
+const int CSSValueViolet = 502;
+const int CSSValueWheat = 503;
+const int CSSValueWhitesmoke = 504;
+const int CSSValueYellowgreen = 505;
+const int CSSValueNonzero = 506;
+const int CSSValueEvenodd = 507;
+const int CSSValueAccumulate = 508;
+const int CSSValueNew = 509;
+const int CSSValueSrgb = 510;
+const int CSSValueLinearrgb = 511;
+const int CSSValueOptimizespeed = 512;
+const int CSSValueOptimizequality = 513;
+const int CSSValueCrispedges = 514;
+const int CSSValueGeometricprecision = 515;
+const int CSSValueButt = 516;
+const int CSSValueMiter = 517;
+const int CSSValueBevel = 518;
+const int CSSValueOptimizelegibility = 519;
+const int CSSValueBeforeEdge = 520;
+const int CSSValueAfterEdge = 521;
+const int CSSValueCentral = 522;
+const int CSSValueTextBeforeEdge = 523;
+const int CSSValueTextAfterEdge = 524;
+const int CSSValueIdeographic = 525;
+const int CSSValueAlphabetic = 526;
+const int CSSValueHanging = 527;
+const int CSSValueMathematical = 528;
+const int CSSValueUseScript = 529;
+const int CSSValueNoChange = 530;
+const int CSSValueResetSize = 531;
+const int CSSValueLrTb = 532;
+const int CSSValueRlTb = 533;
+const int CSSValueTbRl = 534;
+const int CSSValueLr = 535;
+const int CSSValueRl = 536;
+const int CSSValueTb = 537;
+const int numCSSValueKeywords = 538;
 const size_t maxCSSValueKeywordLength = 30;
 
 const char* getValueName(unsigned short id);
diff --git a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
index 5138355974..80dc604277 100644
--- a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
@@ -12,7 +12,7 @@ static const struct HashTableValue dateTableValues[45] = {
    { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
    { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
    { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncValueOf, (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
    { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
@@ -53,10 +53,5 @@ static const struct HashTableValue dateTableValues[45] = {
 };
 
 extern const struct HashTable dateTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, dateTableValues, 0 };
-#else
     { 134, 127, dateTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
index 6f09be8333..c186e47f86 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton implementation for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton implementation for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,7 +28,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -47,7 +46,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.3"
+#define YYBISON_VERSION "2.4.1"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -55,159 +54,28 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
+/* Push parsers.  */
+#define YYPUSH 0
+
+/* Pull parsers.  */
+#define YYPULL 1
+
 /* Using locations.  */
 #define YYLSP_NEEDED 1
 
 /* Substitute the variable and function names.  */
-#define yyparse jscyyparse
-#define yylex   jscyylex
-#define yyerror jscyyerror
-#define yylval  jscyylval
-#define yychar  jscyychar
-#define yydebug jscyydebug
-#define yynerrs jscyynerrs
-#define yylloc jscyylloc
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-/* Tokens.  */
-#define NULLTOKEN 258
-#define TRUETOKEN 259
-#define FALSETOKEN 260
-#define BREAK 261
-#define CASE 262
-#define DEFAULT 263
-#define FOR 264
-#define NEW 265
-#define VAR 266
-#define CONSTTOKEN 267
-#define CONTINUE 268
-#define FUNCTION 269
-#define RETURN 270
-#define VOIDTOKEN 271
-#define DELETETOKEN 272
-#define IF 273
-#define THISTOKEN 274
-#define DO 275
-#define WHILE 276
-#define INTOKEN 277
-#define INSTANCEOF 278
-#define TYPEOF 279
-#define SWITCH 280
-#define WITH 281
-#define RESERVED 282
-#define THROW 283
-#define TRY 284
-#define CATCH 285
-#define FINALLY 286
-#define DEBUGGER 287
-#define IF_WITHOUT_ELSE 288
-#define ELSE 289
-#define EQEQ 290
-#define NE 291
-#define STREQ 292
-#define STRNEQ 293
-#define LE 294
-#define GE 295
-#define OR 296
-#define AND 297
-#define PLUSPLUS 298
-#define MINUSMINUS 299
-#define LSHIFT 300
-#define RSHIFT 301
-#define URSHIFT 302
-#define PLUSEQUAL 303
-#define MINUSEQUAL 304
-#define MULTEQUAL 305
-#define DIVEQUAL 306
-#define LSHIFTEQUAL 307
-#define RSHIFTEQUAL 308
-#define URSHIFTEQUAL 309
-#define ANDEQUAL 310
-#define MODEQUAL 311
-#define XOREQUAL 312
-#define OREQUAL 313
-#define OPENBRACE 314
-#define CLOSEBRACE 315
-#define NUMBER 316
-#define IDENT 317
-#define STRING 318
-#define AUTOPLUSPLUS 319
-#define AUTOMINUSMINUS 320
-
-
-
+#define yyparse         jscyyparse
+#define yylex           jscyylex
+#define yyerror         jscyyerror
+#define yylval          jscyylval
+#define yychar          jscyychar
+#define yydebug         jscyydebug
+#define yynerrs         jscyynerrs
+#define yylloc          jscyylloc
 
 /* Copy the first part of user declarations.  */
+
+/* Line 189 of yacc.c  */
 #line 3 "../../JavaScriptCore/parser/Grammar.y"
 
 
@@ -238,7 +106,7 @@
 #include <stdlib.h>
 #include "JSValue.h"
 #include "JSObject.h"
-#include "Nodes.h"
+#include "NodeConstructors.h"
 #include "Lexer.h"
 #include "JSString.h"
 #include "JSGlobalData.h"
@@ -308,24 +176,24 @@ static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, Assig
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserRefCountedData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserRefCountedData<DeclarationStacks::FunctionStack>* funcDecls,
+template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
+                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
                                                                        CodeFeatures info,
                                                                        int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = {node, varDecls, funcDecls, info, numConstants};
+    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
 template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = {node, info, numConstants};
+    NodeInfo<T> result = { node, info, numConstants };
     return result;
 }
 
-template <typename T> T mergeDeclarationLists(T decls1, T decls2) 
+template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
 {
     // decls1 or both are null
     if (!decls1)
@@ -337,32 +205,35 @@ template <typename T> T mergeDeclarationLists(T decls1, T decls2)
     // Both are non-null
     decls1->data.append(decls2->data);
     
-    // We manually release the declaration lists to avoid accumulating many many
-    // unused heap allocated vectors
-    decls2->ref();
-    decls2->deref();
+    // Manually release as much as possible from the now-defunct declaration lists
+    // to avoid accumulating so many unused heap allocated vectors.
+    decls2->data.clear();
+
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
 
     varDecls->data.append(make_pair(ident, attrs));
 
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->m_init)
+    if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->m_ident, attrs);
+    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
 }
 
 
 
+/* Line 189 of yacc.c  */
+#line 236 "WebCore/tmp/../generated/Grammar.tab.c"
+
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -381,10 +252,88 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 # define YYTOKEN_TABLE 0
 #endif
 
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     NULLTOKEN = 258,
+     TRUETOKEN = 259,
+     FALSETOKEN = 260,
+     BREAK = 261,
+     CASE = 262,
+     DEFAULT = 263,
+     FOR = 264,
+     NEW = 265,
+     VAR = 266,
+     CONSTTOKEN = 267,
+     CONTINUE = 268,
+     FUNCTION = 269,
+     RETURN = 270,
+     VOIDTOKEN = 271,
+     DELETETOKEN = 272,
+     IF = 273,
+     THISTOKEN = 274,
+     DO = 275,
+     WHILE = 276,
+     INTOKEN = 277,
+     INSTANCEOF = 278,
+     TYPEOF = 279,
+     SWITCH = 280,
+     WITH = 281,
+     RESERVED = 282,
+     THROW = 283,
+     TRY = 284,
+     CATCH = 285,
+     FINALLY = 286,
+     DEBUGGER = 287,
+     IF_WITHOUT_ELSE = 288,
+     ELSE = 289,
+     EQEQ = 290,
+     NE = 291,
+     STREQ = 292,
+     STRNEQ = 293,
+     LE = 294,
+     GE = 295,
+     OR = 296,
+     AND = 297,
+     PLUSPLUS = 298,
+     MINUSMINUS = 299,
+     LSHIFT = 300,
+     RSHIFT = 301,
+     URSHIFT = 302,
+     PLUSEQUAL = 303,
+     MINUSEQUAL = 304,
+     MULTEQUAL = 305,
+     DIVEQUAL = 306,
+     LSHIFTEQUAL = 307,
+     RSHIFTEQUAL = 308,
+     URSHIFTEQUAL = 309,
+     ANDEQUAL = 310,
+     MODEQUAL = 311,
+     XOREQUAL = 312,
+     OREQUAL = 313,
+     OPENBRACE = 314,
+     CLOSEBRACE = 315,
+     NUMBER = 316,
+     IDENT = 317,
+     STRING = 318,
+     AUTOPLUSPLUS = 319,
+     AUTOMINUSMINUS = 320
+   };
+#endif
+
+
+
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 157 "../../JavaScriptCore/parser/Grammar.y"
 {
+
+/* Line 214 of yacc.c  */
+#line 157 "../../JavaScriptCore/parser/Grammar.y"
+
     int                 intValue;
     double              doubleValue;
     Identifier*         ident;
@@ -414,13 +363,15 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-}
-/* Line 187 of yacc.c.  */
-#line 420 "Grammar.tab.c"
-	YYSTYPE;
+
+
+
+/* Line 214 of yacc.c  */
+#line 371 "WebCore/tmp/../generated/Grammar.tab.c"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 #if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
@@ -440,8 +391,8 @@ typedef struct YYLTYPE
 /* Copy the second part of user declarations.  */
 
 
-/* Line 216 of yacc.c.  */
-#line 445 "Grammar.tab.c"
+/* Line 264 of yacc.c  */
+#line 396 "WebCore/tmp/../generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -516,14 +467,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int i)
+YYID (int yyi)
 #else
 static int
-YYID (i)
-    int i;
+YYID (yyi)
+    int yyi;
 #endif
 {
-  return i;
+  return yyi;
 }
 #endif
 
@@ -605,9 +556,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss;
-  YYSTYPE yyvs;
-    YYLTYPE yyls;
+  yytype_int16 yyss_alloc;
+  YYSTYPE yyvs_alloc;
+  YYLTYPE yyls_alloc;
 };
 
 /* The size of the maximum gap between one aligned stack and the next.  */
@@ -642,12 +593,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack)					\
+# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack, Stack, yysize);				\
-	Stack = &yyptr->Stack;						\
+	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
+	Stack = &yyptr->Stack_alloc;					\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -1019,42 +970,42 @@ static const yytype_uint16 yyrline[] =
      804,   805,   806,   807,   808,   809,   810,   811,   815,   817,
      822,   824,   830,   837,   846,   854,   867,   874,   883,   891,
      904,   906,   912,   920,   932,   933,   937,   941,   945,   949,
-     951,   956,   959,   968,   970,   972,   974,   980,   987,   996,
-    1002,  1013,  1014,  1018,  1019,  1023,  1027,  1031,  1035,  1042,
-    1045,  1048,  1051,  1057,  1060,  1063,  1066,  1072,  1078,  1084,
-    1085,  1094,  1095,  1099,  1105,  1115,  1116,  1120,  1121,  1125,
-    1131,  1135,  1142,  1148,  1154,  1164,  1166,  1171,  1172,  1183,
-    1184,  1191,  1192,  1202,  1205,  1211,  1212,  1216,  1217,  1222,
-    1229,  1240,  1241,  1242,  1243,  1244,  1245,  1246,  1250,  1251,
-    1252,  1253,  1254,  1258,  1259,  1263,  1264,  1265,  1267,  1271,
-    1272,  1273,  1274,  1275,  1279,  1280,  1281,  1285,  1286,  1289,
-    1291,  1295,  1296,  1300,  1301,  1302,  1303,  1304,  1308,  1309,
-    1310,  1311,  1315,  1316,  1320,  1321,  1325,  1326,  1327,  1328,
-    1332,  1333,  1334,  1335,  1339,  1340,  1344,  1345,  1349,  1350,
-    1354,  1355,  1359,  1360,  1361,  1365,  1366,  1367,  1371,  1372,
-    1373,  1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1384,
-    1385,  1389,  1390,  1394,  1395,  1396,  1397,  1401,  1402,  1403,
-    1404,  1408,  1409,  1410,  1414,  1415,  1416,  1420,  1421,  1422,
-    1423,  1427,  1428,  1429,  1430,  1434,  1435,  1436,  1437,  1438,
-    1439,  1440,  1444,  1445,  1446,  1447,  1448,  1449,  1453,  1454,
-    1455,  1456,  1457,  1458,  1459,  1463,  1464,  1465,  1466,  1467,
-    1471,  1472,  1473,  1474,  1475,  1479,  1480,  1481,  1482,  1483,
-    1487,  1488,  1492,  1493,  1497,  1498,  1502,  1503,  1507,  1508,
-    1512,  1513,  1517,  1518,  1522,  1523,  1527,  1528,  1532,  1533,
-    1537,  1538,  1542,  1543,  1547,  1548,  1552,  1553,  1557,  1558,
-    1562,  1563,  1567,  1568,  1572,  1573,  1577,  1578,  1582,  1583,
-    1587,  1588,  1592,  1593,  1594,  1595,  1596,  1597,  1598,  1599,
-    1600,  1601,  1602,  1603,  1607,  1608,  1612,  1613,  1617,  1618,
-    1622,  1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,
-    1632,  1633,  1634,  1635,  1636,  1637,  1638,  1642,  1643,  1647,
-    1648,  1652,  1653,  1654,  1655,  1659,  1660,  1661,  1662,  1666,
-    1667,  1671,  1672,  1676,  1677,  1681,  1685,  1689,  1693,  1694,
-    1698,  1699,  1703,  1704,  1705,  1706,  1707,  1708,  1709,  1710,
-    1713,  1715,  1718,  1720,  1724,  1725,  1726,  1727,  1731,  1732,
-    1733,  1734,  1738,  1739,  1740,  1741,  1745,  1749,  1753,  1754,
-    1757,  1759,  1763,  1764,  1768,  1769,  1773,  1774,  1778,  1782,
-    1783,  1787,  1788,  1789,  1793,  1794,  1798,  1799,  1803,  1804,
-    1805,  1806,  1810,  1811,  1814,  1816,  1820,  1821
+     951,   956,   959,   969,   971,   973,   975,   981,   988,   997,
+    1003,  1014,  1015,  1019,  1020,  1024,  1028,  1032,  1036,  1043,
+    1046,  1049,  1052,  1058,  1061,  1064,  1067,  1073,  1079,  1085,
+    1086,  1095,  1096,  1100,  1106,  1116,  1117,  1121,  1122,  1126,
+    1132,  1136,  1143,  1149,  1155,  1165,  1167,  1172,  1173,  1184,
+    1185,  1192,  1193,  1203,  1206,  1212,  1213,  1217,  1218,  1223,
+    1230,  1241,  1242,  1243,  1244,  1245,  1246,  1247,  1251,  1252,
+    1253,  1254,  1255,  1259,  1260,  1264,  1265,  1266,  1268,  1272,
+    1273,  1274,  1275,  1276,  1280,  1281,  1282,  1286,  1287,  1290,
+    1292,  1296,  1297,  1301,  1302,  1303,  1304,  1305,  1309,  1310,
+    1311,  1312,  1316,  1317,  1321,  1322,  1326,  1327,  1328,  1329,
+    1333,  1334,  1335,  1336,  1340,  1341,  1345,  1346,  1350,  1351,
+    1355,  1356,  1360,  1361,  1362,  1366,  1367,  1368,  1372,  1373,
+    1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1382,  1385,
+    1386,  1390,  1391,  1395,  1396,  1397,  1398,  1402,  1403,  1404,
+    1405,  1409,  1410,  1411,  1415,  1416,  1417,  1421,  1422,  1423,
+    1424,  1428,  1429,  1430,  1431,  1435,  1436,  1437,  1438,  1439,
+    1440,  1441,  1445,  1446,  1447,  1448,  1449,  1450,  1454,  1455,
+    1456,  1457,  1458,  1459,  1460,  1464,  1465,  1466,  1467,  1468,
+    1472,  1473,  1474,  1475,  1476,  1480,  1481,  1482,  1483,  1484,
+    1488,  1489,  1493,  1494,  1498,  1499,  1503,  1504,  1508,  1509,
+    1513,  1514,  1518,  1519,  1523,  1524,  1528,  1529,  1533,  1534,
+    1538,  1539,  1543,  1544,  1548,  1549,  1553,  1554,  1558,  1559,
+    1563,  1564,  1568,  1569,  1573,  1574,  1578,  1579,  1583,  1584,
+    1588,  1589,  1593,  1594,  1595,  1596,  1597,  1598,  1599,  1600,
+    1601,  1602,  1603,  1604,  1608,  1609,  1613,  1614,  1618,  1619,
+    1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,  1632,
+    1633,  1634,  1635,  1636,  1637,  1638,  1639,  1643,  1644,  1648,
+    1649,  1653,  1654,  1655,  1656,  1660,  1661,  1662,  1663,  1667,
+    1668,  1672,  1673,  1677,  1678,  1682,  1686,  1690,  1694,  1695,
+    1699,  1700,  1704,  1705,  1706,  1707,  1708,  1709,  1710,  1711,
+    1714,  1716,  1719,  1721,  1725,  1726,  1727,  1728,  1732,  1733,
+    1734,  1735,  1739,  1740,  1741,  1742,  1746,  1750,  1754,  1755,
+    1758,  1760,  1764,  1765,  1769,  1770,  1774,  1775,  1779,  1783,
+    1784,  1788,  1789,  1790,  1794,  1795,  1799,  1800,  1804,  1805,
+    1806,  1807,  1811,  1812,  1815,  1817,  1821,  1822
 };
 #endif
 
@@ -2361,17 +2312,20 @@ yy_symbol_print (yyoutput, yytype, yyvaluep, yylocationp)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
+yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
 #else
 static void
-yy_stack_print (bottom, top)
-    yytype_int16 *bottom;
-    yytype_int16 *top;
+yy_stack_print (yybottom, yytop)
+    yytype_int16 *yybottom;
+    yytype_int16 *yytop;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; bottom <= top; ++bottom)
-    YYFPRINTF (stderr, " %d", *bottom);
+  for (; yybottom <= yytop; yybottom++)
+    {
+      int yybot = *yybottom;
+      YYFPRINTF (stderr, " %d", yybot);
+    }
   YYFPRINTF (stderr, "\n");
 }
 
@@ -2406,11 +2360,11 @@ yy_reduce_print (yyvsp, yylsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      fprintf (stderr, "   $%d = ", yyi + 1);
+      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       , &(yylsp[(yyi + 1) - (yynrhs)])		       );
-      fprintf (stderr, "\n");
+      YYFPRINTF (stderr, "\n");
     }
 }
 
@@ -2692,10 +2646,8 @@ yydestruct (yymsg, yytype, yyvaluep, yylocationp)
 	break;
     }
 }
-
 
 /* Prevent warnings from -Wmissing-prototypes.  */
-
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -2714,10 +2666,9 @@ int yyparse ();
 
 
 
-
-/*----------.
-| yyparse.  |
-`----------*/
+/*-------------------------.
+| yyparse or yypush_parse.  |
+`-------------------------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -2741,88 +2692,97 @@ yyparse ()
 #endif
 #endif
 {
-  /* The look-ahead symbol.  */
+/* The lookahead symbol.  */
 int yychar;
 
-/* The semantic value of the look-ahead symbol.  */
+/* The semantic value of the lookahead symbol.  */
 YYSTYPE yylval;
 
-/* Number of syntax errors so far.  */
-int yynerrs;
-/* Location data for the look-ahead symbol.  */
+/* Location data for the lookahead symbol.  */
 YYLTYPE yylloc;
 
-  int yystate;
-  int yyn;
-  int yyresult;
-  /* Number of tokens to shift before error messages enabled.  */
-  int yyerrstatus;
-  /* Look-ahead token as an internal (translated) token number.  */
-  int yytoken = 0;
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
+    /* Number of syntax errors so far.  */
+    int yynerrs;
 
-  /* Three stacks and their tools:
-     `yyss': related to states,
-     `yyvs': related to semantic values,
-     `yyls': related to locations.
+    int yystate;
+    /* Number of tokens to shift before error messages enabled.  */
+    int yyerrstatus;
 
-     Refer to the stacks thru separate pointers, to allow yyoverflow
-     to reallocate them elsewhere.  */
+    /* The stacks and their tools:
+       `yyss': related to states.
+       `yyvs': related to semantic values.
+       `yyls': related to locations.
 
-  /* The state stack.  */
-  yytype_int16 yyssa[YYINITDEPTH];
-  yytype_int16 *yyss = yyssa;
-  yytype_int16 *yyssp;
+       Refer to the stacks thru separate pointers, to allow yyoverflow
+       to reallocate them elsewhere.  */
 
-  /* The semantic value stack.  */
-  YYSTYPE yyvsa[YYINITDEPTH];
-  YYSTYPE *yyvs = yyvsa;
-  YYSTYPE *yyvsp;
+    /* The state stack.  */
+    yytype_int16 yyssa[YYINITDEPTH];
+    yytype_int16 *yyss;
+    yytype_int16 *yyssp;
 
-  /* The location stack.  */
-  YYLTYPE yylsa[YYINITDEPTH];
-  YYLTYPE *yyls = yylsa;
-  YYLTYPE *yylsp;
-  /* The locations where the error started and ended.  */
-  YYLTYPE yyerror_range[2];
+    /* The semantic value stack.  */
+    YYSTYPE yyvsa[YYINITDEPTH];
+    YYSTYPE *yyvs;
+    YYSTYPE *yyvsp;
 
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
+    /* The location stack.  */
+    YYLTYPE yylsa[YYINITDEPTH];
+    YYLTYPE *yyls;
+    YYLTYPE *yylsp;
 
-  YYSIZE_T yystacksize = YYINITDEPTH;
+    /* The locations where the error started and ended.  */
+    YYLTYPE yyerror_range[2];
 
+    YYSIZE_T yystacksize;
+
+  int yyn;
+  int yyresult;
+  /* Lookahead token as an internal (translated) token number.  */
+  int yytoken;
   /* The variables used to return semantic value and location from the
      action routines.  */
   YYSTYPE yyval;
   YYLTYPE yyloc;
 
+#if YYERROR_VERBOSE
+  /* Buffer for error messages, and its allocated size.  */
+  char yymsgbuf[128];
+  char *yymsg = yymsgbuf;
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
+#endif
+
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
+
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
+  yytoken = 0;
+  yyss = yyssa;
+  yyvs = yyvsa;
+  yyls = yylsa;
+  yystacksize = YYINITDEPTH;
+
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY;		/* Cause a token to be read.  */
+  yychar = YYEMPTY; /* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
-
   yyssp = yyss;
   yyvsp = yyvs;
   yylsp = yyls;
+
 #if YYLTYPE_IS_TRIVIAL
   /* Initialize the default location before parsing starts.  */
   yylloc.first_line   = yylloc.last_line   = 1;
-  yylloc.first_column = yylloc.last_column = 0;
+  yylloc.first_column = yylloc.last_column = 1;
 #endif
 
   goto yysetstate;
@@ -2861,6 +2821,7 @@ YYLTYPE yylloc;
 		    &yyvs1, yysize * sizeof (*yyvsp),
 		    &yyls1, yysize * sizeof (*yylsp),
 		    &yystacksize);
+
 	yyls = yyls1;
 	yyss = yyss1;
 	yyvs = yyvs1;
@@ -2882,9 +2843,9 @@ YYLTYPE yylloc;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss);
-	YYSTACK_RELOCATE (yyvs);
-	YYSTACK_RELOCATE (yyls);
+	YYSTACK_RELOCATE (yyss_alloc, yyss);
+	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
+	YYSTACK_RELOCATE (yyls_alloc, yyls);
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -2905,6 +2866,9 @@ YYLTYPE yylloc;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
+  if (yystate == YYFINAL)
+    YYACCEPT;
+
   goto yybackup;
 
 /*-----------.
@@ -2913,16 +2877,16 @@ YYLTYPE yylloc;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     look-ahead token if we need one and don't already have one.  */
+     lookahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to look-ahead token.  */
+  /* First try to decide what to do without reference to lookahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a look-ahead token if don't already have one.  */
+  /* Not known => get a lookahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -2954,20 +2918,16 @@ yybackup:
       goto yyreduce;
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the look-ahead token.  */
+  /* Shift the lookahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token unless it is eof.  */
-  if (yychar != YYEOF)
-    yychar = YYEMPTY;
+  /* Discard the shifted token.  */
+  yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -3008,37 +2968,49 @@ yyreduce:
   switch (yyn)
     {
         case 2:
+
+/* Line 1455 of yacc.c  */
 #line 290 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NullNode(GLOBAL_DATA), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
+
+/* Line 1455 of yacc.c  */
 #line 291 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
+
+/* Line 1455 of yacc.c  */
 #line 292 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
+
+/* Line 1455 of yacc.c  */
 #line 293 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
+
+/* Line 1455 of yacc.c  */
 #line 294 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
+
+/* Line 1455 of yacc.c  */
 #line 295 "../../JavaScriptCore/parser/Grammar.y"
     {
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3046,12 +3018,14 @@ yyreduce:
     break;
 
   case 8:
+
+/* Line 1455 of yacc.c  */
 #line 304 "../../JavaScriptCore/parser/Grammar.y"
     {
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3059,26 +3033,36 @@ yyreduce:
     break;
 
   case 9:
+
+/* Line 1455 of yacc.c  */
 #line 316 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
+
+/* Line 1455 of yacc.c  */
 #line 317 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
+
+/* Line 1455 of yacc.c  */
 #line 318 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
+
+/* Line 1455 of yacc.c  */
 #line 319 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
+
+/* Line 1455 of yacc.c  */
 #line 321 "../../JavaScriptCore/parser/Grammar.y"
     {
                                                                  (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
@@ -3091,644 +3075,876 @@ yyreduce:
     break;
 
   case 14:
+
+/* Line 1455 of yacc.c  */
 #line 332 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = new PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
+    { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (1)].propertyNode).m_numConstants; ;}
     break;
 
   case 15:
+
+/* Line 1455 of yacc.c  */
 #line 336 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
-                                          (yyval.propertyList).m_node.tail = new PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
+                                          (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (3)].propertyList).m_numConstants + (yyvsp[(3) - (3)].propertyNode).m_numConstants; ;}
     break;
 
   case 17:
+
+/* Line 1455 of yacc.c  */
 #line 344 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
+
+/* Line 1455 of yacc.c  */
 #line 345 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
+
+/* Line 1455 of yacc.c  */
 #line 347 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
+
+/* Line 1455 of yacc.c  */
 #line 351 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
+
+/* Line 1455 of yacc.c  */
 #line 354 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
+
+/* Line 1455 of yacc.c  */
 #line 355 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
+
+/* Line 1455 of yacc.c  */
 #line 359 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
+
+/* Line 1455 of yacc.c  */
 #line 360 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
+
+/* Line 1455 of yacc.c  */
 #line 361 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
+
+/* Line 1455 of yacc.c  */
 #line 365 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.elementList).m_node.head = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
+    { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants; ;}
     break;
 
   case 29:
+
+/* Line 1455 of yacc.c  */
 #line 370 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
-                                          (yyval.elementList).m_node.tail = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
+                                          (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(1) - (4)].elementList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants; ;}
     break;
 
   case 30:
+
+/* Line 1455 of yacc.c  */
 #line 377 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
+
+/* Line 1455 of yacc.c  */
 #line 382 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
+
+/* Line 1455 of yacc.c  */
 #line 383 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
+
+/* Line 1455 of yacc.c  */
 #line 388 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
+
+/* Line 1455 of yacc.c  */
 #line 389 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 37:
+
+/* Line 1455 of yacc.c  */
 #line 393 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 38:
+
+/* Line 1455 of yacc.c  */
 #line 397 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 40:
+
+/* Line 1455 of yacc.c  */
 #line 405 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 41:
+
+/* Line 1455 of yacc.c  */
 #line 409 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 42:
+
+/* Line 1455 of yacc.c  */
 #line 413 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 44:
+
+/* Line 1455 of yacc.c  */
 #line 421 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 46:
+
+/* Line 1455 of yacc.c  */
 #line 429 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 47:
+
+/* Line 1455 of yacc.c  */
 #line 436 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
+
+/* Line 1455 of yacc.c  */
 #line 437 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
+
+/* Line 1455 of yacc.c  */
 #line 438 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 50:
+
+/* Line 1455 of yacc.c  */
 #line 442 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 51:
+
+/* Line 1455 of yacc.c  */
 #line 448 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
+
+/* Line 1455 of yacc.c  */
 #line 449 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
+
+/* Line 1455 of yacc.c  */
 #line 450 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 54:
+
+/* Line 1455 of yacc.c  */
 #line 454 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 55:
+
+/* Line 1455 of yacc.c  */
 #line 461 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
+
+/* Line 1455 of yacc.c  */
 #line 462 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
+
+/* Line 1455 of yacc.c  */
 #line 466 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
+    { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (1)].expressionNode).m_numConstants; ;}
     break;
 
   case 58:
+
+/* Line 1455 of yacc.c  */
 #line 470 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
-                                          (yyval.argumentList).m_node.tail = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
+                                          (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (3)].argumentList).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants; ;}
     break;
 
   case 64:
+
+/* Line 1455 of yacc.c  */
 #line 488 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
+
+/* Line 1455 of yacc.c  */
 #line 489 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
+
+/* Line 1455 of yacc.c  */
 #line 494 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
+
+/* Line 1455 of yacc.c  */
 #line 495 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
+
+/* Line 1455 of yacc.c  */
 #line 499 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
+
+/* Line 1455 of yacc.c  */
 #line 500 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
+
+/* Line 1455 of yacc.c  */
 #line 501 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
+
+/* Line 1455 of yacc.c  */
 #line 502 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
+
+/* Line 1455 of yacc.c  */
 #line 503 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
+
+/* Line 1455 of yacc.c  */
 #line 504 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
+
+/* Line 1455 of yacc.c  */
 #line 505 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
+
+/* Line 1455 of yacc.c  */
 #line 506 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
+
+/* Line 1455 of yacc.c  */
 #line 507 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
+
+/* Line 1455 of yacc.c  */
 #line 508 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
+
+/* Line 1455 of yacc.c  */
 #line 509 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
+
+/* Line 1455 of yacc.c  */
 #line 523 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
+
+/* Line 1455 of yacc.c  */
 #line 524 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
+
+/* Line 1455 of yacc.c  */
 #line 525 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
+
+/* Line 1455 of yacc.c  */
 #line 531 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
+
+/* Line 1455 of yacc.c  */
 #line 533 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
+
+/* Line 1455 of yacc.c  */
 #line 535 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
+
+/* Line 1455 of yacc.c  */
 #line 540 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
+
+/* Line 1455 of yacc.c  */
 #line 541 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
+
+/* Line 1455 of yacc.c  */
 #line 547 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
+
+/* Line 1455 of yacc.c  */
 #line 549 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
+
+/* Line 1455 of yacc.c  */
 #line 554 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
+
+/* Line 1455 of yacc.c  */
 #line 555 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
+
+/* Line 1455 of yacc.c  */
 #line 556 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
+
+/* Line 1455 of yacc.c  */
 #line 561 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
+
+/* Line 1455 of yacc.c  */
 #line 562 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
+
+/* Line 1455 of yacc.c  */
 #line 563 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
+
+/* Line 1455 of yacc.c  */
 #line 568 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
+
+/* Line 1455 of yacc.c  */
 #line 569 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
+
+/* Line 1455 of yacc.c  */
 #line 570 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
+
+/* Line 1455 of yacc.c  */
 #line 571 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
+
+/* Line 1455 of yacc.c  */
 #line 572 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 112:
+
+/* Line 1455 of yacc.c  */
 #line 575 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 114:
+
+/* Line 1455 of yacc.c  */
 #line 582 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
+
+/* Line 1455 of yacc.c  */
 #line 583 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
+
+/* Line 1455 of yacc.c  */
 #line 584 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
+
+/* Line 1455 of yacc.c  */
 #line 585 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
+
+/* Line 1455 of yacc.c  */
 #line 587 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 120:
+
+/* Line 1455 of yacc.c  */
 #line 594 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
+
+/* Line 1455 of yacc.c  */
 #line 595 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
+
+/* Line 1455 of yacc.c  */
 #line 596 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
+
+/* Line 1455 of yacc.c  */
 #line 597 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
+
+/* Line 1455 of yacc.c  */
 #line 599 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 125:
+
+/* Line 1455 of yacc.c  */
 #line 603 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 127:
+
+/* Line 1455 of yacc.c  */
 #line 610 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
+
+/* Line 1455 of yacc.c  */
 #line 611 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
+
+/* Line 1455 of yacc.c  */
 #line 612 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
+
+/* Line 1455 of yacc.c  */
 #line 613 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
+
+/* Line 1455 of yacc.c  */
 #line 619 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
+
+/* Line 1455 of yacc.c  */
 #line 621 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
+
+/* Line 1455 of yacc.c  */
 #line 623 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
+
+/* Line 1455 of yacc.c  */
 #line 625 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
+
+/* Line 1455 of yacc.c  */
 #line 631 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
+
+/* Line 1455 of yacc.c  */
 #line 632 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
+
+/* Line 1455 of yacc.c  */
 #line 634 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
+
+/* Line 1455 of yacc.c  */
 #line 636 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
+
+/* Line 1455 of yacc.c  */
 #line 641 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
+
+/* Line 1455 of yacc.c  */
 #line 647 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
+
+/* Line 1455 of yacc.c  */
 #line 652 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
+
+/* Line 1455 of yacc.c  */
 #line 657 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
+
+/* Line 1455 of yacc.c  */
 #line 663 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
+
+/* Line 1455 of yacc.c  */
 #line 669 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
+
+/* Line 1455 of yacc.c  */
 #line 674 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
+
+/* Line 1455 of yacc.c  */
 #line 680 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
+
+/* Line 1455 of yacc.c  */
 #line 686 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
+
+/* Line 1455 of yacc.c  */
 #line 691 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
+
+/* Line 1455 of yacc.c  */
 #line 697 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
+
+/* Line 1455 of yacc.c  */
 #line 703 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
+
+/* Line 1455 of yacc.c  */
 #line 708 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
+
+/* Line 1455 of yacc.c  */
 #line 714 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
+
+/* Line 1455 of yacc.c  */
 #line 719 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
+
+/* Line 1455 of yacc.c  */
 #line 725 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
+
+/* Line 1455 of yacc.c  */
 #line 731 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
+
+/* Line 1455 of yacc.c  */
 #line 737 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
+
+/* Line 1455 of yacc.c  */
 #line 743 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
@@ -3736,6 +3952,8 @@ yyreduce:
     break;
 
   case 180:
+
+/* Line 1455 of yacc.c  */
 #line 751 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
@@ -3743,6 +3961,8 @@ yyreduce:
     break;
 
   case 182:
+
+/* Line 1455 of yacc.c  */
 #line 759 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
@@ -3750,99 +3970,137 @@ yyreduce:
     break;
 
   case 183:
+
+/* Line 1455 of yacc.c  */
 #line 765 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
+
+/* Line 1455 of yacc.c  */
 #line 766 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
+
+/* Line 1455 of yacc.c  */
 #line 767 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
+
+/* Line 1455 of yacc.c  */
 #line 768 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
+
+/* Line 1455 of yacc.c  */
 #line 769 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
+
+/* Line 1455 of yacc.c  */
 #line 770 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
+
+/* Line 1455 of yacc.c  */
 #line 771 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
+
+/* Line 1455 of yacc.c  */
 #line 772 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
+
+/* Line 1455 of yacc.c  */
 #line 773 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
+
+/* Line 1455 of yacc.c  */
 #line 774 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
+
+/* Line 1455 of yacc.c  */
 #line 775 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
+
+/* Line 1455 of yacc.c  */
 #line 776 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
+
+/* Line 1455 of yacc.c  */
 #line 781 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
+
+/* Line 1455 of yacc.c  */
 #line 786 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
+
+/* Line 1455 of yacc.c  */
 #line 791 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
+
+/* Line 1455 of yacc.c  */
 #line 815 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 219:
+
+/* Line 1455 of yacc.c  */
 #line 817 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 220:
+
+/* Line 1455 of yacc.c  */
 #line 822 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 221:
+
+/* Line 1455 of yacc.c  */
 #line 824 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
@@ -3850,9 +4108,11 @@ yyreduce:
     break;
 
   case 222:
+
+/* Line 1455 of yacc.c  */
 #line 830 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3861,11 +4121,13 @@ yyreduce:
     break;
 
   case 223:
+
+/* Line 1455 of yacc.c  */
 #line 837 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3874,6 +4136,8 @@ yyreduce:
     break;
 
   case 224:
+
+/* Line 1455 of yacc.c  */
 #line 847 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
@@ -3885,8 +4149,10 @@ yyreduce:
     break;
 
   case 225:
+
+/* Line 1455 of yacc.c  */
 #line 855 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
@@ -3898,9 +4164,11 @@ yyreduce:
     break;
 
   case 226:
+
+/* Line 1455 of yacc.c  */
 #line 867 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3909,11 +4177,13 @@ yyreduce:
     break;
 
   case 227:
+
+/* Line 1455 of yacc.c  */
 #line 874 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3922,6 +4192,8 @@ yyreduce:
     break;
 
   case 228:
+
+/* Line 1455 of yacc.c  */
 #line 884 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
@@ -3933,8 +4205,10 @@ yyreduce:
     break;
 
   case 229:
+
+/* Line 1455 of yacc.c  */
 #line 892 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
@@ -3946,22 +4220,28 @@ yyreduce:
     break;
 
   case 230:
+
+/* Line 1455 of yacc.c  */
 #line 904 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 231:
+
+/* Line 1455 of yacc.c  */
 #line 907 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 232:
+
+/* Line 1455 of yacc.c  */
 #line 912 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
-                                          (yyval.constDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(1) - (1)].constDeclNode).m_node);
                                           (yyval.constDeclList).m_funcDeclarations = 0; 
                                           (yyval.constDeclList).m_features = (yyvsp[(1) - (1)].constDeclNode).m_features;
@@ -3970,8 +4250,10 @@ yyreduce:
     break;
 
   case 233:
+
+/* Line 1455 of yacc.c  */
 #line 921 "../../JavaScriptCore/parser/Grammar.y"
-    {  (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
+    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_varDeclarations = (yyvsp[(1) - (3)].constDeclList).m_varDeclarations;
@@ -3982,78 +4264,105 @@ yyreduce:
     break;
 
   case 234:
+
+/* Line 1455 of yacc.c  */
 #line 932 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
+
+/* Line 1455 of yacc.c  */
 #line 933 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
+
+/* Line 1455 of yacc.c  */
 #line 937 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
+
+/* Line 1455 of yacc.c  */
 #line 941 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
+
+/* Line 1455 of yacc.c  */
 #line 945 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
+
+/* Line 1455 of yacc.c  */
 #line 949 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 240:
+
+/* Line 1455 of yacc.c  */
 #line 951 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 241:
+
+/* Line 1455 of yacc.c  */
 #line 957 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 242:
+
+/* Line 1455 of yacc.c  */
 #line 960 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations), mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
     break;
 
   case 243:
-#line 968 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+
+/* Line 1455 of yacc.c  */
+#line 969 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 244:
-#line 970 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+
+/* Line 1455 of yacc.c  */
+#line 971 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 245:
-#line 972 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+
+/* Line 1455 of yacc.c  */
+#line 973 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 246:
-#line 975 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
+
+/* Line 1455 of yacc.c  */
+#line 976 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
@@ -4061,8 +4370,10 @@ yyreduce:
     break;
 
   case 247:
-#line 981 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
+
+/* Line 1455 of yacc.c  */
+#line 982 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
@@ -4071,9 +4382,11 @@ yyreduce:
     break;
 
   case 248:
-#line 988 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 989 "../../JavaScriptCore/parser/Grammar.y"
     {
-                                            ForInNode* node = new ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
+                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
                                             (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
@@ -4083,8 +4396,10 @@ yyreduce:
     break;
 
   case 249:
-#line 997 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
+
+/* Line 1455 of yacc.c  */
+#line 998 "../../JavaScriptCore/parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
@@ -4092,8 +4407,10 @@ yyreduce:
     break;
 
   case 250:
-#line 1003 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
+
+/* Line 1455 of yacc.c  */
+#line 1004 "../../JavaScriptCore/parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
@@ -4103,125 +4420,161 @@ yyreduce:
     break;
 
   case 251:
-#line 1013 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1014 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
-#line 1018 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1019 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
-#line 1023 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1024 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 256:
-#line 1027 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1028 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 257:
-#line 1031 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1032 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 258:
-#line 1035 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1036 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 259:
-#line 1042 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1043 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 260:
-#line 1045 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1046 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 261:
-#line 1048 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1049 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 262:
-#line 1051 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1052 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 263:
-#line 1057 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+
+/* Line 1455 of yacc.c  */
+#line 1058 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 264:
-#line 1060 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+
+/* Line 1455 of yacc.c  */
+#line 1061 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 265:
-#line 1063 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+
+/* Line 1455 of yacc.c  */
+#line 1064 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 266:
-#line 1066 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+
+/* Line 1455 of yacc.c  */
+#line 1067 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 267:
-#line 1072 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
+
+/* Line 1455 of yacc.c  */
+#line 1073 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 268:
-#line 1078 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
+
+/* Line 1455 of yacc.c  */
+#line 1079 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 269:
-#line 1084 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1085 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
-#line 1086 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
+
+/* Line 1455 of yacc.c  */
+#line 1087 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (5)].clauseList).m_features | (yyvsp[(3) - (5)].caseClauseNode).m_features | (yyvsp[(4) - (5)].clauseList).m_features,
@@ -4229,13 +4582,17 @@ yyreduce:
     break;
 
   case 271:
-#line 1094 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1095 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
-#line 1099 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1100 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
                                           (yyval.clauseList).m_funcDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_funcDeclarations; 
@@ -4244,9 +4601,11 @@ yyreduce:
     break;
 
   case 274:
-#line 1105 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1106 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
-                                          (yyval.clauseList).m_node.tail = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
+                                          (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
                                           (yyval.clauseList).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_funcDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_funcDeclarations);
                                           (yyval.clauseList).m_features = (yyvsp[(1) - (2)].clauseList).m_features | (yyvsp[(2) - (2)].caseClauseNode).m_features;
@@ -4255,51 +4614,67 @@ yyreduce:
     break;
 
   case 275:
-#line 1115 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1116 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
-#line 1116 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1117 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
-#line 1120 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1121 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
-#line 1121 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1122 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
-#line 1125 "../../JavaScriptCore/parser/Grammar.y"
-    { LabelNode* node = new LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1126 "../../JavaScriptCore/parser/Grammar.y"
+    { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
     break;
 
   case 280:
-#line 1131 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1132 "../../JavaScriptCore/parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                         ;}
     break;
 
   case 281:
-#line 1135 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+
+/* Line 1455 of yacc.c  */
+#line 1136 "../../JavaScriptCore/parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
                                         ;}
     break;
 
   case 282:
-#line 1142 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
+
+/* Line 1455 of yacc.c  */
+#line 1143 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
@@ -4308,8 +4683,10 @@ yyreduce:
     break;
 
   case 283:
-#line 1148 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
+
+/* Line 1455 of yacc.c  */
+#line 1149 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
@@ -4318,8 +4695,10 @@ yyreduce:
     break;
 
   case 284:
-#line 1155 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
+
+/* Line 1455 of yacc.c  */
+#line 1156 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
@@ -4328,26 +4707,34 @@ yyreduce:
     break;
 
   case 285:
-#line 1164 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+
+/* Line 1455 of yacc.c  */
+#line 1165 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 286:
-#line 1166 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+
+/* Line 1455 of yacc.c  */
+#line 1167 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 287:
-#line 1171 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1172 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
     break;
 
   case 288:
-#line 1173 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1174 "../../JavaScriptCore/parser/Grammar.y"
     { 
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
           DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
@@ -4356,12 +4743,16 @@ yyreduce:
     break;
 
   case 289:
-#line 1183 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1184 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), LEXER->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
-#line 1185 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1186 "../../JavaScriptCore/parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature) 
@@ -4371,12 +4762,16 @@ yyreduce:
     break;
 
   case 291:
-#line 1191 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1192 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
-#line 1193 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1194 "../../JavaScriptCore/parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4386,43 +4781,57 @@ yyreduce:
     break;
 
   case 293:
-#line 1202 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = new ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
+
+/* Line 1455 of yacc.c  */
+#line 1203 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
     break;
 
   case 294:
-#line 1205 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1206 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.parameterList).m_node.tail = new ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
+                                          (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
     break;
 
   case 295:
-#line 1211 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1212 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
-#line 1212 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1213 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
-#line 1216 "../../JavaScriptCore/parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing(new SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
+
+/* Line 1455 of yacc.c  */
+#line 1217 "../../JavaScriptCore/parser/Grammar.y"
+    { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
-#line 1217 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1218 "../../JavaScriptCore/parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
 
   case 299:
-#line 1222 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.sourceElements).m_node = new SourceElements(GLOBAL_DATA);
+
+/* Line 1455 of yacc.c  */
+#line 1223 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
                                           (yyval.sourceElements).m_funcDeclarations = (yyvsp[(1) - (1)].statementNode).m_funcDeclarations;
@@ -4432,7 +4841,9 @@ yyreduce:
     break;
 
   case 300:
-#line 1229 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1230 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4442,188 +4853,261 @@ yyreduce:
     break;
 
   case 304:
-#line 1243 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1244 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 305:
-#line 1244 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1245 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 306:
-#line 1245 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1246 "../../JavaScriptCore/parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 307:
-#line 1246 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1247 "../../JavaScriptCore/parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 308:
-#line 1250 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1251 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 309:
-#line 1251 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1252 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 310:
-#line 1252 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1253 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 311:
-#line 1253 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1254 "../../JavaScriptCore/parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
-#line 1254 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1255 "../../JavaScriptCore/parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
-#line 1264 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1265 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 317:
-#line 1265 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1266 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 318:
-#line 1267 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1268 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 322:
-#line 1274 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1275 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 517:
-#line 1642 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1643 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 518:
-#line 1643 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1644 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 520:
-#line 1648 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1649 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
-#line 1652 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1653 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 522:
-#line 1653 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1654 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 525:
-#line 1659 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1660 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 526:
-#line 1660 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1661 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 530:
-#line 1667 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1668 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
-#line 1676 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1677 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 534:
-#line 1677 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1678 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 539:
-#line 1694 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1695 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
-#line 1725 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1726 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
-#line 1727 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1728 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
-#line 1732 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1733 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
-#line 1734 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1735 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
-#line 1739 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1740 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
-#line 1741 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1742 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
-#line 1753 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1754 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 569:
-#line 1754 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1755 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 578:
-#line 1778 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1779 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 580:
-#line 1783 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1784 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
-#line 1794 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1795 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
-#line 1810 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1455 of yacc.c  */
+#line 1811 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
 
-/* Line 1267 of yacc.c.  */
-#line 4627 "Grammar.tab.c"
+
+/* Line 1455 of yacc.c  */
+#line 5111 "WebCore/tmp/../generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4699,7 +5183,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse look-ahead token after an
+      /* If just tried and failed to reuse lookahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -4716,7 +5200,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse look-ahead token after shifting the error
+  /* Else will try to reuse lookahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -4774,14 +5258,11 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   *++yyvsp = yylval;
 
   yyerror_range[1] = yylloc;
   /* Using YYLLOC is tempting, but would change the location of
-     the look-ahead.  YYLOC is available though.  */
+     the lookahead.  YYLOC is available though.  */
   YYLLOC_DEFAULT (yyloc, (yyerror_range - 1), 2);
   *++yylsp = yyloc;
 
@@ -4806,7 +5287,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#ifndef yyoverflow
+#if !defined(yyoverflow) || YYERROR_VERBOSE
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -4817,7 +5298,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEOF && yychar != YYEMPTY)
+  if (yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval, &yylloc);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -4843,29 +5324,31 @@ yyreturn:
 }
 
 
-#line 1826 "../../JavaScriptCore/parser/Grammar.y"
+
+/* Line 1675 of yacc.c  */
+#line 1827 "../../JavaScriptCore/parser/Grammar.y"
 
 
 static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
             SET_EXCEPTION_LOCATION(node, start, divot, end);
             return node;
         } else
-            return new ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -4873,9 +5356,9 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4883,21 +5366,21 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
 static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
@@ -4905,22 +5388,22 @@ static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Ope
 static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4930,23 +5413,29 @@ static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeIn
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
         if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node = new FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
+        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
+        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else
+        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
@@ -4955,26 +5444,26 @@ static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
     }
-    return new TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new DeleteValueNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
 static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
@@ -4986,7 +5475,7 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
 }
 
 static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
@@ -5000,19 +5489,19 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new NegateNode(GLOBAL_DATA, n);
+    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
 }
 
 static NumberNode* makeNumberNode(void* globalPtr, double d)
 {
-    return new NumberNode(GLOBAL_DATA, d);
+    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
 }
 
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
         return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new BitwiseNotNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5024,12 +5513,12 @@ static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, Expr
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
 
-    return new MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5039,14 +5528,14 @@ static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5056,21 +5545,21 @@ static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 /* called by yyparse on error */
@@ -5089,7 +5578,7 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 {
     if (!list)
         return init;
-    return new VarDeclCommaNode(GLOBAL_DATA, list, init);
+    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
@@ -5098,8 +5587,8 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
 {
     if (!expr)
-        return new EmptyStatementNode(GLOBAL_DATA);
-    return new VarStatementNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
+    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
 }
 
 #undef GLOBAL_DATA
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.h b/src/3rdparty/webkit/WebCore/generated/Grammar.h
index 4805844aba..34b0b37d59 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.h
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton interface for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton interface for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -104,78 +104,16 @@
      AUTOMINUSMINUS = 320
    };
 #endif
-/* Tokens.  */
-#define NULLTOKEN 258
-#define TRUETOKEN 259
-#define FALSETOKEN 260
-#define BREAK 261
-#define CASE 262
-#define DEFAULT 263
-#define FOR 264
-#define NEW 265
-#define VAR 266
-#define CONSTTOKEN 267
-#define CONTINUE 268
-#define FUNCTION 269
-#define RETURN 270
-#define VOIDTOKEN 271
-#define DELETETOKEN 272
-#define IF 273
-#define THISTOKEN 274
-#define DO 275
-#define WHILE 276
-#define INTOKEN 277
-#define INSTANCEOF 278
-#define TYPEOF 279
-#define SWITCH 280
-#define WITH 281
-#define RESERVED 282
-#define THROW 283
-#define TRY 284
-#define CATCH 285
-#define FINALLY 286
-#define DEBUGGER 287
-#define IF_WITHOUT_ELSE 288
-#define ELSE 289
-#define EQEQ 290
-#define NE 291
-#define STREQ 292
-#define STRNEQ 293
-#define LE 294
-#define GE 295
-#define OR 296
-#define AND 297
-#define PLUSPLUS 298
-#define MINUSMINUS 299
-#define LSHIFT 300
-#define RSHIFT 301
-#define URSHIFT 302
-#define PLUSEQUAL 303
-#define MINUSEQUAL 304
-#define MULTEQUAL 305
-#define DIVEQUAL 306
-#define LSHIFTEQUAL 307
-#define RSHIFTEQUAL 308
-#define URSHIFTEQUAL 309
-#define ANDEQUAL 310
-#define MODEQUAL 311
-#define XOREQUAL 312
-#define OREQUAL 313
-#define OPENBRACE 314
-#define CLOSEBRACE 315
-#define NUMBER 316
-#define IDENT 317
-#define STRING 318
-#define AUTOPLUSPLUS 319
-#define AUTOMINUSMINUS 320
-
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 157 "../../JavaScriptCore/parser/Grammar.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 157 "../../JavaScriptCore/parser/Grammar.y"
+
     int                 intValue;
     double              doubleValue;
     Identifier*         ident;
@@ -205,13 +143,15 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-}
-/* Line 1489 of yacc.c.  */
-#line 211 "Grammar.tab.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 151 "WebCore/tmp/../generated/Grammar.tab.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
@@ -230,3 +170,4 @@ typedef struct YYLTYPE
 #endif
 
 
+
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
new file mode 100644
index 0000000000..590c238f28
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
@@ -0,0 +1,546 @@
+/*
+ * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ *
+ * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+#include "HTMLElementFactory.h"
+
+#include "HTMLNames.h"
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
+#include "HTMLFormElement.h"
+#include "HTMLAnchorElement.h"
+#include "HTMLElement.h"
+#include "HTMLAppletElement.h"
+#include "HTMLAreaElement.h"
+#include "HTMLAudioElement.h"
+#include "HTMLBaseElement.h"
+#include "HTMLBaseFontElement.h"
+#include "HTMLBlockquoteElement.h"
+#include "HTMLBodyElement.h"
+#include "HTMLBRElement.h"
+#include "HTMLButtonElement.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLTableCaptionElement.h"
+#include "HTMLTableColElement.h"
+#include "HTMLModElement.h"
+#include "HTMLDirectoryElement.h"
+#include "HTMLDivElement.h"
+#include "HTMLDListElement.h"
+#include "HTMLEmbedElement.h"
+#include "HTMLFieldSetElement.h"
+#include "HTMLFontElement.h"
+#include "HTMLFormElement.h"
+#include "HTMLFrameElement.h"
+#include "HTMLFrameSetElement.h"
+#include "HTMLHeadingElement.h"
+#include "HTMLHeadElement.h"
+#include "HTMLHRElement.h"
+#include "HTMLHtmlElement.h"
+#include "HTMLIFrameElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLIsIndexElement.h"
+#include "HTMLKeygenElement.h"
+#include "HTMLLabelElement.h"
+#include "HTMLLegendElement.h"
+#include "HTMLLIElement.h"
+#include "HTMLLinkElement.h"
+#include "HTMLPreElement.h"
+#include "HTMLMapElement.h"
+#include "HTMLMarqueeElement.h"
+#include "HTMLMenuElement.h"
+#include "HTMLMetaElement.h"
+#include "HTMLObjectElement.h"
+#include "HTMLOListElement.h"
+#include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
+#include "HTMLParagraphElement.h"
+#include "HTMLParamElement.h"
+#include "HTMLQuoteElement.h"
+#include "HTMLScriptElement.h"
+#include "HTMLSelectElement.h"
+#include "HTMLSourceElement.h"
+#include "HTMLStyleElement.h"
+#include "HTMLTableElement.h"
+#include "HTMLTableSectionElement.h"
+#include "HTMLTableCellElement.h"
+#include "HTMLTextAreaElement.h"
+#include "HTMLTitleElement.h"
+#include "HTMLTableRowElement.h"
+#include "HTMLUListElement.h"
+#include "HTMLVideoElement.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+typedef PassRefPtr<HTMLElement> (*ConstructorFunction)(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
+typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
+
+static FunctionMap* gFunctionMap = 0;
+
+static PassRefPtr<HTMLElement> anchorConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLAnchorElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> appletConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLAppletElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> areaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLAreaElement(tagName, doc);
+}
+
+#if ENABLE(VIDEO)
+
+static PassRefPtr<HTMLElement> audioConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement(tagName, doc);
+    return new HTMLAudioElement(tagName, doc);
+}
+
+#endif
+
+static PassRefPtr<HTMLElement> baseConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBaseElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> basefontConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBaseFontElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> blockquoteConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBlockquoteElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> bodyConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBodyElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> brConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBRElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> buttonConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLButtonElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> canvasConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLCanvasElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablecaptionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableCaptionElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablecolConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableColElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> modConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLModElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> directoryConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDirectoryElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> divConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDivElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> dlistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDListElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> embedConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLEmbedElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> fieldsetConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLFieldSetElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> fontConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFontElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> formConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFormElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> frameConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFrameElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> framesetConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFrameSetElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> headingConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHeadingElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> headConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHeadElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> hrConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHRElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> htmlConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHtmlElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> iframeConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLIFrameElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> imageConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLImageElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> inputConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLInputElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> isindexConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLIsIndexElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> keygenConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLKeygenElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> labelConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLLabelElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> legendConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLLegendElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> liConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLLIElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> linkConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLLinkElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> preConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLPreElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> mapConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMapElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> marqueeConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMarqueeElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> menuConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMenuElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> metaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMetaElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> objectConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLObjectElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> olistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLOListElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> optgroupConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLOptGroupElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> optionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLOptionElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> paragraphConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLParagraphElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLParamElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLQuoteElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> scriptConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLScriptElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> selectConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLSelectElement(tagName, doc, formElement);
+}
+
+#if ENABLE(VIDEO)
+
+static PassRefPtr<HTMLElement> sourceConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement(tagName, doc);
+    return new HTMLSourceElement(tagName, doc);
+}
+
+#endif
+
+static PassRefPtr<HTMLElement> styleConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLStyleElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> tableConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablesectionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableSectionElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablecellConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableCellElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> textareaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLTextAreaElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> titleConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTitleElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablerowConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableRowElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> ulistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLUListElement(tagName, doc);
+}
+
+#if ENABLE(VIDEO)
+
+static PassRefPtr<HTMLElement> videoConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement(tagName, doc);
+    return new HTMLVideoElement(tagName, doc);
+}
+
+#endif
+
+static PassRefPtr<HTMLElement> imgToimageConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLImageElement(QualifiedName(tagName.prefix(), imgTag.localName(), tagName.namespaceURI()), doc, formElement);
+}
+
+static void addTag(const QualifiedName& tag, ConstructorFunction func)
+{
+    gFunctionMap->set(tag.localName().impl(), func);
+}
+
+static inline void createFunctionMapIfNecessary()
+{
+    if (gFunctionMap)
+        return;
+    // Create the table.
+    gFunctionMap = new FunctionMap;
+    
+    // Populate it with constructor functions.
+    addTag(aTag, anchorConstructor);
+    addTag(appletTag, appletConstructor);
+    addTag(areaTag, areaConstructor);
+#if ENABLE(VIDEO)
+    addTag(audioTag, audioConstructor);
+#endif
+
+    addTag(baseTag, baseConstructor);
+    addTag(basefontTag, basefontConstructor);
+    addTag(blockquoteTag, blockquoteConstructor);
+    addTag(bodyTag, bodyConstructor);
+    addTag(brTag, brConstructor);
+    addTag(buttonTag, buttonConstructor);
+    addTag(canvasTag, canvasConstructor);
+    addTag(captionTag, tablecaptionConstructor);
+    addTag(colTag, tablecolConstructor);
+    addTag(colgroupTag, tablecolConstructor);
+    addTag(delTag, modConstructor);
+    addTag(dirTag, directoryConstructor);
+    addTag(divTag, divConstructor);
+    addTag(dlTag, dlistConstructor);
+    addTag(embedTag, embedConstructor);
+    addTag(fieldsetTag, fieldsetConstructor);
+    addTag(fontTag, fontConstructor);
+    addTag(formTag, formConstructor);
+    addTag(frameTag, frameConstructor);
+    addTag(framesetTag, framesetConstructor);
+    addTag(h1Tag, headingConstructor);
+    addTag(h2Tag, headingConstructor);
+    addTag(h3Tag, headingConstructor);
+    addTag(h4Tag, headingConstructor);
+    addTag(h5Tag, headingConstructor);
+    addTag(h6Tag, headingConstructor);
+    addTag(headTag, headConstructor);
+    addTag(hrTag, hrConstructor);
+    addTag(htmlTag, htmlConstructor);
+    addTag(iframeTag, iframeConstructor);
+    addTag(imageTag, imgToimageConstructor);
+    addTag(imgTag, imageConstructor);
+    addTag(inputTag, inputConstructor);
+    addTag(insTag, modConstructor);
+    addTag(isindexTag, isindexConstructor);
+    addTag(keygenTag, keygenConstructor);
+    addTag(labelTag, labelConstructor);
+    addTag(legendTag, legendConstructor);
+    addTag(liTag, liConstructor);
+    addTag(linkTag, linkConstructor);
+    addTag(listingTag, preConstructor);
+    addTag(mapTag, mapConstructor);
+    addTag(marqueeTag, marqueeConstructor);
+    addTag(menuTag, menuConstructor);
+    addTag(metaTag, metaConstructor);
+    addTag(objectTag, objectConstructor);
+    addTag(olTag, olistConstructor);
+    addTag(optgroupTag, optgroupConstructor);
+    addTag(optionTag, optionConstructor);
+    addTag(pTag, paragraphConstructor);
+    addTag(paramTag, paramConstructor);
+    addTag(preTag, preConstructor);
+    addTag(qTag, quoteConstructor);
+    addTag(scriptTag, scriptConstructor);
+    addTag(selectTag, selectConstructor);
+#if ENABLE(VIDEO)
+    addTag(sourceTag, sourceConstructor);
+#endif
+
+    addTag(styleTag, styleConstructor);
+    addTag(tableTag, tableConstructor);
+    addTag(tbodyTag, tablesectionConstructor);
+    addTag(tdTag, tablecellConstructor);
+    addTag(textareaTag, textareaConstructor);
+    addTag(tfootTag, tablesectionConstructor);
+    addTag(thTag, tablecellConstructor);
+    addTag(theadTag, tablesectionConstructor);
+    addTag(titleTag, titleConstructor);
+    addTag(trTag, tablerowConstructor);
+    addTag(ulTag, ulistConstructor);
+#if ENABLE(VIDEO)
+    addTag(videoTag, videoConstructor);
+#endif
+
+    addTag(xmpTag, preConstructor);
+}
+
+PassRefPtr<HTMLElement> HTMLElementFactory::createHTMLElement(const QualifiedName& qName, Document* doc, HTMLFormElement* formElement, bool createdByParser)
+{
+    // Don't make elements without a document
+    if (!doc)
+        return 0;
+
+    createFunctionMapIfNecessary();
+    ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
+    if (func)
+        return func(qName, doc, formElement, createdByParser);
+    return new HTMLElement(qName, doc);
+}
+
+} // namespace WebCore
+
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h
new file mode 100644
index 0000000000..566d9cd2e3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h
@@ -0,0 +1,56 @@
+/*
+ * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ *
+ * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#ifndef HTMLElementFactory_h
+#define HTMLElementFactory_h
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+    class Element;
+    class Document;
+    class QualifiedName;
+    class AtomicString;
+}
+
+namespace WebCore {
+
+    class HTMLElement;
+     class HTMLFormElement;
+    // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
+    // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
+    class HTMLElementFactory {
+    public:
+        PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
+        static PassRefPtr<HTMLElement> createHTMLElement(const WebCore::QualifiedName&, WebCore::Document*, HTMLFormElement* = 0, bool /*createdByParser*/ = true);
+    };
+}
+
+#endif // HTMLElementFactory_h
+
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 713c370598..84c48c0d53 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -289,6 +289,7 @@ DEFINE_GLOBAL(QualifiedName, aria_pressedAttr, nullAtom, "aria_pressed", xhtmlNa
 DEFINE_GLOBAL(QualifiedName, aria_valuemaxAttr, nullAtom, "aria_valuemax", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valueminAttr, nullAtom, "aria_valuemin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuenowAttr, nullAtom, "aria_valuenow", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, autobufferAttr, nullAtom, "autobuffer", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autocompleteAttr, nullAtom, "autocomplete", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autofocusAttr, nullAtom, "autofocus", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autoplayAttr, nullAtom, "autoplay", xhtmlNamespaceURI);
@@ -406,6 +407,8 @@ DEFINE_GLOBAL(QualifiedName, onmouseoutAttr, nullAtom, "onmouseout", xhtmlNamesp
 DEFINE_GLOBAL(QualifiedName, onmouseoverAttr, nullAtom, "onmouseover", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmouseupAttr, nullAtom, "onmouseup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousewheelAttr, nullAtom, "onmousewheel", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onofflineAttr, nullAtom, "onoffline", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ononlineAttr, nullAtom, "ononline", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onpasteAttr, nullAtom, "onpaste", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onresetAttr, nullAtom, "onreset", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onresizeAttr, nullAtom, "onresize", xhtmlNamespaceURI);
@@ -444,6 +447,7 @@ DEFINE_GLOBAL(QualifiedName, selectedAttr, nullAtom, "selected", xhtmlNamespaceU
 DEFINE_GLOBAL(QualifiedName, shapeAttr, nullAtom, "shape", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sizeAttr, nullAtom, "size", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, spanAttr, nullAtom, "span", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, spellcheckAttr, nullAtom, "spellcheck", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, srcAttr, nullAtom, "src", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, standbyAttr, nullAtom, "standby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, startAttr, nullAtom, "start", xhtmlNamespaceURI);
@@ -492,6 +496,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&aria_valuemaxAttr,
         (WebCore::QualifiedName*)&aria_valueminAttr,
         (WebCore::QualifiedName*)&aria_valuenowAttr,
+        (WebCore::QualifiedName*)&autobufferAttr,
         (WebCore::QualifiedName*)&autocompleteAttr,
         (WebCore::QualifiedName*)&autofocusAttr,
         (WebCore::QualifiedName*)&autoplayAttr,
@@ -609,6 +614,8 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onmouseoverAttr,
         (WebCore::QualifiedName*)&onmouseupAttr,
         (WebCore::QualifiedName*)&onmousewheelAttr,
+        (WebCore::QualifiedName*)&onofflineAttr,
+        (WebCore::QualifiedName*)&ononlineAttr,
         (WebCore::QualifiedName*)&onpasteAttr,
         (WebCore::QualifiedName*)&onresetAttr,
         (WebCore::QualifiedName*)&onresizeAttr,
@@ -647,6 +654,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&shapeAttr,
         (WebCore::QualifiedName*)&sizeAttr,
         (WebCore::QualifiedName*)&spanAttr,
+        (WebCore::QualifiedName*)&spellcheckAttr,
         (WebCore::QualifiedName*)&srcAttr,
         (WebCore::QualifiedName*)&standbyAttr,
         (WebCore::QualifiedName*)&startAttr,
@@ -672,7 +680,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 198;
+    *size = 202;
     return HTMLAttr;
 }
 
@@ -931,6 +939,7 @@ void init()
     const char *aria_valuemaxAttrString = "aria-valuemax";
     const char *aria_valueminAttrString = "aria-valuemin";
     const char *aria_valuenowAttrString = "aria-valuenow";
+    const char *autobufferAttrString = "autobuffer";
     const char *autocompleteAttrString = "autocomplete";
     const char *autofocusAttrString = "autofocus";
     const char *autoplayAttrString = "autoplay";
@@ -1047,6 +1056,8 @@ void init()
     const char *onmouseoverAttrString = "onmouseover";
     const char *onmouseupAttrString = "onmouseup";
     const char *onmousewheelAttrString = "onmousewheel";
+    const char *onofflineAttrString = "onoffline";
+    const char *ononlineAttrString = "ononline";
     const char *onpasteAttrString = "onpaste";
     const char *onresetAttrString = "onreset";
     const char *onresizeAttrString = "onresize";
@@ -1085,6 +1096,7 @@ void init()
     const char *shapeAttrString = "shape";
     const char *sizeAttrString = "size";
     const char *spanAttrString = "span";
+    const char *spellcheckAttrString = "spellcheck";
     const char *srcAttrString = "src";
     const char *standbyAttrString = "standby";
     const char *startAttrString = "start";
@@ -1128,6 +1140,7 @@ void init()
     new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, aria_valuemaxAttrString, nullAtom);
     new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, aria_valueminAttrString, nullAtom);
     new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, aria_valuenowAttrString, nullAtom);
+    new ((void*)&autobufferAttr) QualifiedName(nullAtom, autobufferAttrString, nullAtom);
     new ((void*)&autocompleteAttr) QualifiedName(nullAtom, autocompleteAttrString, nullAtom);
     new ((void*)&autofocusAttr) QualifiedName(nullAtom, autofocusAttrString, nullAtom);
     new ((void*)&autoplayAttr) QualifiedName(nullAtom, autoplayAttrString, nullAtom);
@@ -1245,6 +1258,8 @@ void init()
     new ((void*)&onmouseoverAttr) QualifiedName(nullAtom, onmouseoverAttrString, nullAtom);
     new ((void*)&onmouseupAttr) QualifiedName(nullAtom, onmouseupAttrString, nullAtom);
     new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, onmousewheelAttrString, nullAtom);
+    new ((void*)&onofflineAttr) QualifiedName(nullAtom, onofflineAttrString, nullAtom);
+    new ((void*)&ononlineAttr) QualifiedName(nullAtom, ononlineAttrString, nullAtom);
     new ((void*)&onpasteAttr) QualifiedName(nullAtom, onpasteAttrString, nullAtom);
     new ((void*)&onresetAttr) QualifiedName(nullAtom, onresetAttrString, nullAtom);
     new ((void*)&onresizeAttr) QualifiedName(nullAtom, onresizeAttrString, nullAtom);
@@ -1283,6 +1298,7 @@ void init()
     new ((void*)&shapeAttr) QualifiedName(nullAtom, shapeAttrString, nullAtom);
     new ((void*)&sizeAttr) QualifiedName(nullAtom, sizeAttrString, nullAtom);
     new ((void*)&spanAttr) QualifiedName(nullAtom, spanAttrString, nullAtom);
+    new ((void*)&spellcheckAttr) QualifiedName(nullAtom, spellcheckAttrString, nullAtom);
     new ((void*)&srcAttr) QualifiedName(nullAtom, srcAttrString, nullAtom);
     new ((void*)&standbyAttr) QualifiedName(nullAtom, standbyAttrString, nullAtom);
     new ((void*)&startAttr) QualifiedName(nullAtom, startAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index 507a0a5367..939c8ec144 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -148,9 +148,6 @@ extern const WebCore::QualifiedName varTag;
 extern const WebCore::QualifiedName videoTag;
 extern const WebCore::QualifiedName wbrTag;
 extern const WebCore::QualifiedName xmpTag;
-
-
-WebCore::QualifiedName** getHTMLTags(size_t* size);
 // Attributes
 extern const WebCore::QualifiedName abbrAttr;
 extern const WebCore::QualifiedName acceptAttr;
@@ -171,6 +168,7 @@ extern const WebCore::QualifiedName aria_pressedAttr;
 extern const WebCore::QualifiedName aria_valuemaxAttr;
 extern const WebCore::QualifiedName aria_valueminAttr;
 extern const WebCore::QualifiedName aria_valuenowAttr;
+extern const WebCore::QualifiedName autobufferAttr;
 extern const WebCore::QualifiedName autocompleteAttr;
 extern const WebCore::QualifiedName autofocusAttr;
 extern const WebCore::QualifiedName autoplayAttr;
@@ -289,6 +287,8 @@ extern const WebCore::QualifiedName onmouseoutAttr;
 extern const WebCore::QualifiedName onmouseoverAttr;
 extern const WebCore::QualifiedName onmouseupAttr;
 extern const WebCore::QualifiedName onmousewheelAttr;
+extern const WebCore::QualifiedName onofflineAttr;
+extern const WebCore::QualifiedName ononlineAttr;
 extern const WebCore::QualifiedName onpasteAttr;
 extern const WebCore::QualifiedName onresetAttr;
 extern const WebCore::QualifiedName onresizeAttr;
@@ -327,6 +327,7 @@ extern const WebCore::QualifiedName selectedAttr;
 extern const WebCore::QualifiedName shapeAttr;
 extern const WebCore::QualifiedName sizeAttr;
 extern const WebCore::QualifiedName spanAttr;
+extern const WebCore::QualifiedName spellcheckAttr;
 extern const WebCore::QualifiedName srcAttr;
 extern const WebCore::QualifiedName standbyAttr;
 extern const WebCore::QualifiedName startAttr;
@@ -351,11 +352,11 @@ extern const WebCore::QualifiedName vlinkAttr;
 extern const WebCore::QualifiedName vspaceAttr;
 extern const WebCore::QualifiedName widthAttr;
 extern const WebCore::QualifiedName wrapAttr;
-
-
-WebCore::QualifiedName** getHTMLAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getHTMLTags(size_t* size);
+WebCore::QualifiedName** getHTMLAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index f7b7de3570..00b9a5feda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSAttr)
+ASSERT_CLASS_FITS_IN_CELL(JSAttr);
 
 /* Hash table */
 
@@ -79,13 +79,13 @@ public:
     JSAttrConstructor(ExecState* exec)
         : DOMObject(JSAttrConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSAttrPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSAttrPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,21 +114,21 @@ static const HashTable JSAttrPrototypeTable =
 
 const ClassInfo JSAttrPrototype::s_info = { "AttrPrototype", 0, &JSAttrPrototypeTable, 0 };
 
-JSObject* JSAttrPrototype::self(ExecState* exec)
+JSObject* JSAttrPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSAttr>(exec);
+    return getDOMPrototype<JSAttr>(exec, globalObject);
 }
 
-const ClassInfo JSAttr::s_info = { "Attr", &JSEventTargetNode::s_info, &JSAttrTable, 0 };
+const ClassInfo JSAttr::s_info = { "Attr", &JSNode::s_info, &JSAttrTable, 0 };
 
 JSAttr::JSAttr(PassRefPtr<Structure> structure, PassRefPtr<Attr> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSAttr::createPrototype(ExecState* exec)
+JSObject* JSAttr::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSAttrPrototype(JSAttrPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSAttrPrototype(JSAttrPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSAttr::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,58 +136,63 @@ bool JSAttr::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSAttr, Base>(exec, &JSAttrTable, this, propertyName, slot);
 }
 
-JSValuePtr jsAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->name());
 }
 
-JSValuePtr jsAttrSpecified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrSpecified(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->specified());
 }
 
-JSValuePtr jsAttrValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->value());
 }
 
-JSValuePtr jsAttrOwnerElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrOwnerElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerElement()));
 }
 
-JSValuePtr jsAttrStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSAttr*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSAttr::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSAttr::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSAttr, Base>(exec, propertyName, value, &JSAttrTable, this, slot);
 }
 
-void setJSAttrValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSAttrValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSAttr*>(thisObject)->setValue(exec, value);
 }
 
-JSValuePtr JSAttr::getConstructor(ExecState* exec)
+JSValue JSAttr::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSAttrConstructor>(exec);
 }
 
-Attr* toAttr(JSC::JSValuePtr value)
+Attr* toAttr(JSC::JSValue value)
 {
-    return value->isObject(&JSAttr::s_info) ? static_cast<JSAttr*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSAttr::s_info) ? static_cast<JSAttr*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index 40b861e168..37f0193a48 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -21,42 +21,43 @@
 #ifndef JSAttr_h
 #define JSAttr_h
 
-#include "JSEventTargetNode.h"
+#include "JSNode.h"
 #include "Attr.h"
 namespace WebCore {
 
 class Attr;
 
-class JSAttr : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSAttr : public JSNode {
+    typedef JSNode Base;
 public:
     JSAttr(PassRefPtr<JSC::Structure>, PassRefPtr<Attr>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    void setValue(JSC::ExecState*, JSC::JSValuePtr);
+    void setValue(JSC::ExecState*, JSC::JSValue);
     Attr* impl() const
     {
         return static_cast<Attr*>(Base::impl());
     }
 };
 
-Attr* toAttr(JSC::JSValuePtr);
+Attr* toAttr(JSC::JSValue);
 
 class JSAttrPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSAttrPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,13 +65,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrSpecified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSAttrValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsAttrOwnerElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrSpecified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSAttrValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsAttrOwnerElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index 566468fb22..89860d2d13 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -31,7 +31,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSBarInfo)
+ASSERT_CLASS_FITS_IN_CELL(JSBarInfo);
 
 /* Hash table */
 
@@ -64,9 +64,9 @@ static const HashTable JSBarInfoPrototypeTable =
 
 const ClassInfo JSBarInfoPrototype::s_info = { "BarInfoPrototype", 0, &JSBarInfoPrototypeTable, 0 };
 
-JSObject* JSBarInfoPrototype::self(ExecState* exec)
+JSObject* JSBarInfoPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSBarInfo>(exec);
+    return getDOMPrototype<JSBarInfo>(exec, globalObject);
 }
 
 const ClassInfo JSBarInfo::s_info = { "BarInfo", 0, &JSBarInfoTable, 0 };
@@ -80,12 +80,11 @@ JSBarInfo::JSBarInfo(PassRefPtr<Structure> structure, PassRefPtr<BarInfo> impl)
 JSBarInfo::~JSBarInfo()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSBarInfo::createPrototype(ExecState* exec)
+JSObject* JSBarInfo::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSBarInfoPrototype(JSBarInfoPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSBarInfoPrototype(JSBarInfoPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSBarInfo::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -93,19 +92,20 @@ bool JSBarInfo::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSBarInfo, Base>(exec, &JSBarInfoTable, this, propertyName, slot);
 }
 
-JSValuePtr jsBarInfoVisible(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBarInfoVisible(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     BarInfo* imp = static_cast<BarInfo*>(static_cast<JSBarInfo*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->visible());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, BarInfo* object)
+JSC::JSValue toJS(JSC::ExecState* exec, BarInfo* object)
 {
     return getDOMObjectWrapper<JSBarInfo>(exec, object);
 }
-BarInfo* toBarInfo(JSC::JSValuePtr value)
+BarInfo* toBarInfo(JSC::JSValue value)
 {
-    return value->isObject(&JSBarInfo::s_info) ? static_cast<JSBarInfo*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSBarInfo::s_info) ? static_cast<JSBarInfo*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index f13a62ce88..c27d6c1994 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -34,12 +34,12 @@ class JSBarInfo : public DOMObject {
 public:
     JSBarInfo(PassRefPtr<JSC::Structure>, PassRefPtr<BarInfo>);
     virtual ~JSBarInfo();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +50,13 @@ private:
     RefPtr<BarInfo> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, BarInfo*);
-BarInfo* toBarInfo(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, BarInfo*);
+BarInfo* toBarInfo(JSC::JSValue);
 
 class JSBarInfoPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSBarInfoPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,7 +64,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsBarInfoVisible(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBarInfoVisible(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index 0374edd6ad..169940146f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCDATASection)
+ASSERT_CLASS_FITS_IN_CELL(JSCDATASection);
 
 /* Hash table */
 
@@ -68,13 +68,13 @@ public:
     JSCDATASectionConstructor(ExecState* exec)
         : DOMObject(JSCDATASectionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCDATASectionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCDATASectionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,9 +103,9 @@ static const HashTable JSCDATASectionPrototypeTable =
 
 const ClassInfo JSCDATASectionPrototype::s_info = { "CDATASectionPrototype", 0, &JSCDATASectionPrototypeTable, 0 };
 
-JSObject* JSCDATASectionPrototype::self(ExecState* exec)
+JSObject* JSCDATASectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCDATASection>(exec);
+    return getDOMPrototype<JSCDATASection>(exec, globalObject);
 }
 
 const ClassInfo JSCDATASection::s_info = { "CDATASection", &JSText::s_info, &JSCDATASectionTable, 0 };
@@ -115,9 +115,9 @@ JSCDATASection::JSCDATASection(PassRefPtr<Structure> structure, PassRefPtr<CDATA
 {
 }
 
-JSObject* JSCDATASection::createPrototype(ExecState* exec)
+JSObject* JSCDATASection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCDATASectionPrototype(JSCDATASectionPrototype::createStructure(JSTextPrototype::self(exec)));
+    return new (exec) JSCDATASectionPrototype(JSCDATASectionPrototype::createStructure(JSTextPrototype::self(exec, globalObject)));
 }
 
 bool JSCDATASection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,11 +125,11 @@ bool JSCDATASection::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCDATASection, Base>(exec, &JSCDATASectionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCDATASection*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCDATASection::getConstructor(ExecState* exec)
+JSValue JSCDATASection::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCDATASectionConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index b92e3ac6b6..724ca0be22 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -31,23 +31,25 @@ class JSCDATASection : public JSText {
     typedef JSText Base;
 public:
     JSCDATASection(PassRefPtr<JSC::Structure>, PassRefPtr<CDATASection>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, CDATASection*);
 
 class JSCDATASectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCDATASectionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,7 +57,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index 8dfe3c31dc..9015d1e08b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSCharsetRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSCharsetRule);
 
 /* Hash table */
 
@@ -70,13 +70,13 @@ public:
     JSCSSCharsetRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSCharsetRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSCharsetRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSCharsetRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -105,9 +105,9 @@ static const HashTable JSCSSCharsetRulePrototypeTable =
 
 const ClassInfo JSCSSCharsetRulePrototype::s_info = { "CSSCharsetRulePrototype", 0, &JSCSSCharsetRulePrototypeTable, 0 };
 
-JSObject* JSCSSCharsetRulePrototype::self(ExecState* exec)
+JSObject* JSCSSCharsetRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSCharsetRule>(exec);
+    return getDOMPrototype<JSCSSCharsetRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSCharsetRule::s_info = { "CSSCharsetRule", &JSCSSRule::s_info, &JSCSSCharsetRuleTable, 0 };
@@ -117,9 +117,9 @@ JSCSSCharsetRule::JSCSSCharsetRule(PassRefPtr<Structure> structure, PassRefPtr<C
 {
 }
 
-JSObject* JSCSSCharsetRule::createPrototype(ExecState* exec)
+JSObject* JSCSSCharsetRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSCharsetRulePrototype(JSCSSCharsetRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSCharsetRulePrototype(JSCSSCharsetRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSCharsetRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -127,22 +127,23 @@ bool JSCSSCharsetRule::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSCSSCharsetRule, Base>(exec, &JSCSSCharsetRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSCharsetRuleEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->encoding());
 }
 
-JSValuePtr jsCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSCharsetRule, Base>(exec, propertyName, value, &JSCSSCharsetRuleTable, this, slot);
 }
 
-void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(static_cast<JSCSSCharsetRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -150,7 +151,7 @@ void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValueP
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSCharsetRule::getConstructor(ExecState* exec)
+JSValue JSCSSCharsetRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSCharsetRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index 9877f1a97b..54c3be3cce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -31,24 +31,25 @@ class JSCSSCharsetRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSCharsetRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSCharsetRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSCharsetRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSCharsetRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSCharsetRuleEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSCharsetRuleEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index 4109ea8174..1490ac6ab6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSFontFaceRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSFontFaceRule);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSCSSFontFaceRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSFontFaceRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSFontFaceRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSFontFaceRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSCSSFontFaceRulePrototypeTable =
 
 const ClassInfo JSCSSFontFaceRulePrototype::s_info = { "CSSFontFaceRulePrototype", 0, &JSCSSFontFaceRulePrototypeTable, 0 };
 
-JSObject* JSCSSFontFaceRulePrototype::self(ExecState* exec)
+JSObject* JSCSSFontFaceRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSFontFaceRule>(exec);
+    return getDOMPrototype<JSCSSFontFaceRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSFontFaceRule::s_info = { "CSSFontFaceRule", &JSCSSRule::s_info, &JSCSSFontFaceRuleTable, 0 };
@@ -119,9 +119,9 @@ JSCSSFontFaceRule::JSCSSFontFaceRule(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSCSSFontFaceRule::createPrototype(ExecState* exec)
+JSObject* JSCSSFontFaceRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSFontFaceRulePrototype(JSCSSFontFaceRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSFontFaceRulePrototype(JSCSSFontFaceRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSFontFaceRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,17 +129,18 @@ bool JSCSSFontFaceRule::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSCSSFontFaceRule, Base>(exec, &JSCSSFontFaceRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSFontFaceRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSFontFaceRule* imp = static_cast<CSSFontFaceRule*>(static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSFontFaceRule::getConstructor(ExecState* exec)
+JSValue JSCSSFontFaceRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSFontFaceRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index 15677186f2..a2acf4cfbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -31,23 +31,24 @@ class JSCSSFontFaceRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSFontFaceRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSFontFaceRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSFontFaceRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSFontFaceRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,8 +56,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSFontFaceRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSFontFaceRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index bc2dad51a6..412dac1fbc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSImportRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSImportRule);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSCSSImportRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSImportRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSImportRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSImportRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSCSSImportRulePrototypeTable =
 
 const ClassInfo JSCSSImportRulePrototype::s_info = { "CSSImportRulePrototype", 0, &JSCSSImportRulePrototypeTable, 0 };
 
-JSObject* JSCSSImportRulePrototype::self(ExecState* exec)
+JSObject* JSCSSImportRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSImportRule>(exec);
+    return getDOMPrototype<JSCSSImportRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSImportRule::s_info = { "CSSImportRule", &JSCSSRule::s_info, &JSCSSImportRuleTable, 0 };
@@ -123,9 +123,9 @@ JSCSSImportRule::JSCSSImportRule(PassRefPtr<Structure> structure, PassRefPtr<CSS
 {
 }
 
-JSObject* JSCSSImportRule::createPrototype(ExecState* exec)
+JSObject* JSCSSImportRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSImportRulePrototype(JSCSSImportRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSImportRulePrototype(JSCSSImportRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSImportRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,29 +133,32 @@ bool JSCSSImportRule::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCSSImportRule, Base>(exec, &JSCSSImportRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSImportRuleHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->href());
 }
 
-JSValuePtr jsCSSImportRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsCSSImportRuleStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->styleSheet()));
 }
 
-JSValuePtr jsCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSImportRule::getConstructor(ExecState* exec)
+JSValue JSCSSImportRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSImportRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
index 19ed0d7ef0..14bae40223 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
@@ -31,23 +31,24 @@ class JSCSSImportRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSImportRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSImportRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSImportRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSImportRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,10 +56,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSImportRuleHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSImportRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSImportRuleStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
index 727157df62..c8f3e09e30 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSMediaRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSMediaRule);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSCSSMediaRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSMediaRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSMediaRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSMediaRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +112,9 @@ static const HashTable JSCSSMediaRulePrototypeTable =
 
 const ClassInfo JSCSSMediaRulePrototype::s_info = { "CSSMediaRulePrototype", 0, &JSCSSMediaRulePrototypeTable, 0 };
 
-JSObject* JSCSSMediaRulePrototype::self(ExecState* exec)
+JSObject* JSCSSMediaRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSMediaRule>(exec);
+    return getDOMPrototype<JSCSSMediaRule>(exec, globalObject);
 }
 
 bool JSCSSMediaRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,9 +129,9 @@ JSCSSMediaRule::JSCSSMediaRule(PassRefPtr<Structure> structure, PassRefPtr<CSSMe
 {
 }
 
-JSObject* JSCSSMediaRule::createPrototype(ExecState* exec)
+JSObject* JSCSSMediaRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSMediaRulePrototype(JSCSSMediaRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSMediaRulePrototype(JSCSSMediaRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSMediaRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,51 +139,55 @@ bool JSCSSMediaRule::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCSSMediaRule, Base>(exec, &JSCSSMediaRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSMediaRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsCSSMediaRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cssRules()));
 }
 
-JSValuePtr jsCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSMediaRule::getConstructor(ExecState* exec)
+JSValue JSCSSMediaRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSMediaRuleConstructor>(exec);
 }
 
-JSValuePtr jsCSSMediaRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSMediaRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSMediaRule::s_info))
         return throwError(exec, TypeError);
     JSCSSMediaRule* castedThisObj = static_cast<JSCSSMediaRule*>(asObject(thisValue));
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rule = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& rule = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->insertRule(rule, index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->insertRule(rule, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSMediaRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSMediaRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSMediaRule::s_info))
         return throwError(exec, TypeError);
     JSCSSMediaRule* castedThisObj = static_cast<JSCSSMediaRule*>(asObject(thisValue));
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
     imp->deleteRule(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
index 79a9332d4f..bccda5d6c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
@@ -31,27 +31,28 @@ class JSCSSMediaRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSMediaRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSMediaRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSMediaRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,13 +61,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSMediaRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSMediaRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSMediaRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSMediaRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
index 588dc5eb95..f5428c3c7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSPageRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSPageRule);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSCSSPageRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSPageRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSPageRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSPageRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSCSSPageRulePrototypeTable =
 
 const ClassInfo JSCSSPageRulePrototype::s_info = { "CSSPageRulePrototype", 0, &JSCSSPageRulePrototypeTable, 0 };
 
-JSObject* JSCSSPageRulePrototype::self(ExecState* exec)
+JSObject* JSCSSPageRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSPageRule>(exec);
+    return getDOMPrototype<JSCSSPageRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSPageRule::s_info = { "CSSPageRule", &JSCSSRule::s_info, &JSCSSPageRuleTable, 0 };
@@ -121,9 +121,9 @@ JSCSSPageRule::JSCSSPageRule(PassRefPtr<Structure> structure, PassRefPtr<CSSPage
 {
 }
 
-JSObject* JSCSSPageRule::createPrototype(ExecState* exec)
+JSObject* JSCSSPageRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSPageRulePrototype(JSCSSPageRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSPageRulePrototype(JSCSSPageRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSPageRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,28 +131,30 @@ bool JSCSSPageRule::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSCSSPageRule, Base>(exec, &JSCSSPageRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSPageRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->selectorText());
 }
 
-JSValuePtr jsCSSPageRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSPageRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSPageRule, Base>(exec, propertyName, value, &JSCSSPageRuleTable, this, slot);
 }
 
-void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -160,7 +162,7 @@ void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSPageRule::getConstructor(ExecState* exec)
+JSValue JSCSSPageRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSPageRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
index 1fda2dfe0d..a8159903ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
@@ -31,24 +31,25 @@ class JSCSSPageRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSPageRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSPageRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSPageRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSPageRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSPageRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSPageRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSPageRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
index 21012ee82b..bf64f1659a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSPrimitiveValue)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSPrimitiveValue);
 
 /* Hash table */
 
@@ -103,13 +103,13 @@ public:
     JSCSSPrimitiveValueConstructor(ExecState* exec)
         : DOMObject(JSCSSPrimitiveValueConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSPrimitiveValuePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSPrimitiveValuePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -171,9 +171,9 @@ static const HashTable JSCSSPrimitiveValuePrototypeTable =
 
 const ClassInfo JSCSSPrimitiveValuePrototype::s_info = { "CSSPrimitiveValuePrototype", 0, &JSCSSPrimitiveValuePrototypeTable, 0 };
 
-JSObject* JSCSSPrimitiveValuePrototype::self(ExecState* exec)
+JSObject* JSCSSPrimitiveValuePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSPrimitiveValue>(exec);
+    return getDOMPrototype<JSCSSPrimitiveValue>(exec, globalObject);
 }
 
 bool JSCSSPrimitiveValuePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -188,9 +188,9 @@ JSCSSPrimitiveValue::JSCSSPrimitiveValue(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSCSSPrimitiveValue::createPrototype(ExecState* exec)
+JSObject* JSCSSPrimitiveValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSPrimitiveValuePrototype(JSCSSPrimitiveValuePrototype::createStructure(JSCSSValuePrototype::self(exec)));
+    return new (exec) JSCSSPrimitiveValuePrototype(JSCSSPrimitiveValuePrototype::createStructure(JSCSSValuePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSPrimitiveValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -198,250 +198,258 @@ bool JSCSSPrimitiveValue::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSCSSPrimitiveValue, Base>(exec, &JSCSSPrimitiveValueTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSPrimitiveValuePrimitiveType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValuePrimitiveType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->primitiveType());
 }
 
-JSValuePtr jsCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSPrimitiveValue::getConstructor(ExecState* exec)
+JSValue JSCSSPrimitiveValue::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSPrimitiveValueConstructor>(exec);
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
-    float floatValue = args.at(exec, 1)->toFloat(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
+    float floatValue = args.at(1).toFloat(exec);
 
     imp->setFloatValue(unitType, floatValue, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getFloatValue(unitType, ec));
+    JSC::JSValue result = jsNumber(exec, imp->getFloatValue(unitType, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetStringValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetStringValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short stringType = args.at(exec, 0)->toInt32(exec);
-    const UString& stringValue = args.at(exec, 1)->toString(exec);
+    unsigned short stringType = args.at(0).toInt32(exec);
+    const UString& stringValue = args.at(1).toString(exec);
 
     imp->setStringValue(stringType, stringValue, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetStringValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetStringValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getStringValue(ec));
+    JSC::JSValue result = jsString(exec, imp->getStringValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getCounterValue(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getCounterValue(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRectValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getRectValue(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getRectValue(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = getJSRGBColor(exec, imp->getRGBColorValue(ec));
+    JSC::JSValue result = getJSRGBColor(exec, imp->getRGBColorValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_CM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_CM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_MM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_MS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_S(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_S(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_HZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_HZ(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_STRING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_STRING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_URI(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_URI(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(20));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(21));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(22));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(23));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_RECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(24));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(25));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
index 94c46f246b..39416aabc3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
@@ -31,27 +31,28 @@ class JSCSSPrimitiveValue : public JSCSSValue {
     typedef JSCSSValue Base;
 public:
     JSCSSPrimitiveValue(PassRefPtr<JSC::Structure>, PassRefPtr<CSSPrimitiveValue>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSPrimitiveValuePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,45 +61,45 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRectValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 3dc2b55370..47bb5ccda8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSRule);
 
 /* Hash table */
 
@@ -86,13 +86,13 @@ public:
     JSCSSRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -131,9 +131,9 @@ static const HashTable JSCSSRulePrototypeTable =
 
 const ClassInfo JSCSSRulePrototype::s_info = { "CSSRulePrototype", 0, &JSCSSRulePrototypeTable, 0 };
 
-JSObject* JSCSSRulePrototype::self(ExecState* exec)
+JSObject* JSCSSRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSRule>(exec);
+    return getDOMPrototype<JSCSSRule>(exec, globalObject);
 }
 
 bool JSCSSRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -152,12 +152,11 @@ JSCSSRule::JSCSSRule(PassRefPtr<Structure> structure, PassRefPtr<CSSRule> impl)
 JSCSSRule::~JSCSSRule()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSRule::createPrototype(ExecState* exec)
+JSObject* JSCSSRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSRulePrototype(JSCSSRulePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSRulePrototype(JSCSSRulePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,40 +164,44 @@ bool JSCSSRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSCSSRule, Base>(exec, &JSCSSRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSRuleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->type());
 }
 
-JSValuePtr jsCSSRuleCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSRuleParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentStyleSheet()));
 }
 
-JSValuePtr jsCSSRuleParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentRule()));
 }
 
-JSValuePtr jsCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSRule, Base>(exec, propertyName, value, &JSCSSRuleTable, this, slot);
 }
 
-void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -206,66 +209,66 @@ void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSRule::getConstructor(ExecState* exec)
+JSValue JSCSSRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSRuleConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsCSSRuleUNKNOWN_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleUNKNOWN_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsCSSRuleSTYLE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleSTYLE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsCSSRuleCHARSET_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleCHARSET_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsCSSRuleIMPORT_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleIMPORT_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsCSSRuleMEDIA_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleMEDIA_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsCSSRuleFONT_FACE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleFONT_FACE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsCSSRulePAGE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRulePAGE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsCSSRuleVARIABLES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleVARIABLES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-CSSRule* toCSSRule(JSC::JSValuePtr value)
+CSSRule* toCSSRule(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSRule::s_info) ? static_cast<JSCSSRule*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSRule::s_info) ? static_cast<JSCSSRule*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
index 0412812154..75bb902559 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
@@ -34,34 +34,35 @@ class JSCSSRule : public DOMObject {
 public:
     JSCSSRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSRule>);
     virtual ~JSCSSRule();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSRule* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSRule> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSRule*);
-CSSRule* toCSSRule(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSRule*);
+CSSRule* toCSSRule(JSC::JSValue);
 
 class JSCSSRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -70,24 +71,24 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSRuleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSRuleCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSRuleParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSRuleCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSRuleParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleSTYLE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleCHARSET_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleIMPORT_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleMEDIA_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRulePAGE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleVARIABLES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleSTYLE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleCHARSET_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleIMPORT_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleMEDIA_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRulePAGE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleVARIABLES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index 5a46eba7fd..5b8c7aa7b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSRuleList)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSRuleList);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSCSSRuleListConstructor(ExecState* exec)
         : DOMObject(JSCSSRuleListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSRuleListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSRuleListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSCSSRuleListPrototypeTable =
 
 const ClassInfo JSCSSRuleListPrototype::s_info = { "CSSRuleListPrototype", 0, &JSCSSRuleListPrototypeTable, 0 };
 
-JSObject* JSCSSRuleListPrototype::self(ExecState* exec)
+JSObject* JSCSSRuleListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSRuleList>(exec);
+    return getDOMPrototype<JSCSSRuleList>(exec, globalObject);
 }
 
 bool JSCSSRuleListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,12 +130,11 @@ JSCSSRuleList::JSCSSRuleList(PassRefPtr<Structure> structure, PassRefPtr<CSSRule
 JSCSSRuleList::~JSCSSRuleList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSRuleList::createPrototype(ExecState* exec)
+JSObject* JSCSSRuleList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSRuleListPrototype(JSCSSRuleListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSRuleListPrototype(JSCSSRuleListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -163,13 +162,14 @@ bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, P
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSRuleListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRuleList* imp = static_cast<CSSRuleList*>(static_cast<JSCSSRuleList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSRuleList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -180,37 +180,38 @@ void JSCSSRuleList::getPropertyNames(ExecState* exec, PropertyNameArray& propert
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSRuleList::getConstructor(ExecState* exec)
+JSValue JSCSSRuleList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSRuleListConstructor>(exec);
 }
 
-JSValuePtr jsCSSRuleListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSRuleList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSRuleList::s_info))
         return throwError(exec, TypeError);
     JSCSSRuleList* castedThisObj = static_cast<JSCSSRuleList*>(asObject(thisValue));
     CSSRuleList* imp = static_cast<CSSRuleList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSCSSRuleList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSRuleList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSRuleList* thisObj = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<CSSRuleList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CSSRuleList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CSSRuleList* object)
 {
     return getDOMObjectWrapper<JSCSSRuleList>(exec, object);
 }
-CSSRuleList* toCSSRuleList(JSC::JSValuePtr value)
+CSSRuleList* toCSSRuleList(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSRuleList::s_info) ? static_cast<JSCSSRuleList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSRuleList::s_info) ? static_cast<JSCSSRuleList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
index 168a1bb65f..ba3180c397 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
@@ -34,36 +34,37 @@ class JSCSSRuleList : public DOMObject {
 public:
     JSCSSRuleList(PassRefPtr<JSC::Structure>, PassRefPtr<CSSRuleList>);
     virtual ~JSCSSRuleList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSRuleList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSRuleList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSRuleList*);
-CSSRuleList* toCSSRuleList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSRuleList*);
+CSSRuleList* toCSSRuleList(JSC::JSValue);
 
 class JSCSSRuleListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,11 +73,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSRuleListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSRuleListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index 331c1537cb..0a4a1a0249 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -41,7 +41,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleDeclaration)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleDeclaration);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSCSSStyleDeclarationConstructor(ExecState* exec)
         : DOMObject(JSCSSStyleDeclarationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSStyleDeclarationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSStyleDeclarationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -123,9 +123,9 @@ static const HashTable JSCSSStyleDeclarationPrototypeTable =
 
 const ClassInfo JSCSSStyleDeclarationPrototype::s_info = { "CSSStyleDeclarationPrototype", 0, &JSCSSStyleDeclarationPrototypeTable, 0 };
 
-JSObject* JSCSSStyleDeclarationPrototype::self(ExecState* exec)
+JSObject* JSCSSStyleDeclarationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSStyleDeclaration>(exec);
+    return getDOMPrototype<JSCSSStyleDeclaration>(exec, globalObject);
 }
 
 bool JSCSSStyleDeclarationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,12 +144,11 @@ JSCSSStyleDeclaration::JSCSSStyleDeclaration(PassRefPtr<Structure> structure, Pa
 JSCSSStyleDeclaration::~JSCSSStyleDeclaration()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSStyleDeclaration::createPrototype(ExecState* exec)
+JSObject* JSCSSStyleDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSStyleDeclarationPrototype(JSCSSStyleDeclarationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSStyleDeclarationPrototype(JSCSSStyleDeclarationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -181,36 +180,39 @@ bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, unsigned propert
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSStyleDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSStyleDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSStyleDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentRule()));
 }
 
-JSValuePtr jsCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
     lookupPut<JSCSSStyleDeclaration, Base>(exec, propertyName, value, &JSCSSStyleDeclarationTable, this, slot);
 }
 
-void setJSCSSStyleDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSStyleDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -225,133 +227,141 @@ void JSCSSStyleDeclaration::getPropertyNames(ExecState* exec, PropertyNameArray&
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSStyleDeclaration::getConstructor(ExecState* exec)
+JSValue JSCSSStyleDeclaration::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSStyleDeclarationConstructor>(exec);
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getPropertyValue(propertyName));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getPropertyValue(propertyName));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPropertyCSSValue(propertyName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPropertyCSSValue(propertyName)));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->removeProperty(propertyName, ec));
+    JSC::JSValue result = jsStringOrNull(exec, imp->removeProperty(propertyName, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getPropertyPriority(propertyName));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getPropertyPriority(propertyName));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionSetProperty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionSetProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
-    const UString& value = valueToStringWithNullCheck(exec, args.at(exec, 1));
-    const UString& priority = args.at(exec, 2)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
+    const UString& value = valueToStringWithNullCheck(exec, args.at(1));
+    const UString& priority = args.at(2).toString(exec);
 
     imp->setProperty(propertyName, value, priority, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->item(index));
+    JSC::JSValue result = jsStringOrNull(exec, imp->item(index));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getPropertyShorthand(propertyName));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getPropertyShorthand(propertyName));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isPropertyImplicit(propertyName));
+    JSC::JSValue result = jsBoolean(imp->isPropertyImplicit(propertyName));
     return result;
 }
 
 
-JSValuePtr JSCSSStyleDeclaration::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CSSStyleDeclaration* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CSSStyleDeclaration* object)
 {
     return getDOMObjectWrapper<JSCSSStyleDeclaration>(exec, object);
 }
-CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValuePtr value)
+CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSStyleDeclaration::s_info) ? static_cast<JSCSSStyleDeclaration*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSStyleDeclaration::s_info) ? static_cast<JSCSSStyleDeclaration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
index 5e9331e629..704048e0d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
@@ -34,41 +34,42 @@ class JSCSSStyleDeclaration : public DOMObject {
 public:
     JSCSSStyleDeclaration(PassRefPtr<JSC::Structure>, PassRefPtr<CSSStyleDeclaration>);
     virtual ~JSCSSStyleDeclaration();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSStyleDeclaration* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSStyleDeclaration> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, CSSStyleDeclaration*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSStyleDeclaration*);
-CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSStyleDeclaration*);
+CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValue);
 
 class JSCSSStyleDeclarationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -77,21 +78,21 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionSetProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionSetProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSStyleDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSStyleDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSStyleDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
index b44b910221..51179c0acf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleRule);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSCSSStyleRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSStyleRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSStyleRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSStyleRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSCSSStyleRulePrototypeTable =
 
 const ClassInfo JSCSSStyleRulePrototype::s_info = { "CSSStyleRulePrototype", 0, &JSCSSStyleRulePrototypeTable, 0 };
 
-JSObject* JSCSSStyleRulePrototype::self(ExecState* exec)
+JSObject* JSCSSStyleRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSStyleRule>(exec);
+    return getDOMPrototype<JSCSSStyleRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSStyleRule::s_info = { "CSSStyleRule", &JSCSSRule::s_info, &JSCSSStyleRuleTable, 0 };
@@ -121,9 +121,9 @@ JSCSSStyleRule::JSCSSStyleRule(PassRefPtr<Structure> structure, PassRefPtr<CSSSt
 {
 }
 
-JSObject* JSCSSStyleRule::createPrototype(ExecState* exec)
+JSObject* JSCSSStyleRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSStyleRulePrototype(JSCSSStyleRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSStyleRulePrototype(JSCSSStyleRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSStyleRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,28 +131,30 @@ bool JSCSSStyleRule::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCSSStyleRule, Base>(exec, &JSCSSStyleRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSStyleRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->selectorText());
 }
 
-JSValuePtr jsCSSStyleRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSStyleRule, Base>(exec, propertyName, value, &JSCSSStyleRuleTable, this, slot);
 }
 
-void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -160,7 +162,7 @@ void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValu
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSStyleRule::getConstructor(ExecState* exec)
+JSValue JSCSSStyleRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSStyleRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
index 9cb2788532..4f65c87de0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
@@ -31,24 +31,25 @@ class JSCSSStyleRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSStyleRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSStyleRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSStyleRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSStyleRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSStyleRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSStyleRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSStyleRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
index 36395c1c30..6a3f2f2b5c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleSheet)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleSheet);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSCSSStyleSheetConstructor(ExecState* exec)
         : DOMObject(JSCSSStyleSheetConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSStyleSheetPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSStyleSheetPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +115,9 @@ static const HashTable JSCSSStyleSheetPrototypeTable =
 
 const ClassInfo JSCSSStyleSheetPrototype::s_info = { "CSSStyleSheetPrototype", 0, &JSCSSStyleSheetPrototypeTable, 0 };
 
-JSObject* JSCSSStyleSheetPrototype::self(ExecState* exec)
+JSObject* JSCSSStyleSheetPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSStyleSheet>(exec);
+    return getDOMPrototype<JSCSSStyleSheet>(exec, globalObject);
 }
 
 bool JSCSSStyleSheetPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,9 +132,9 @@ JSCSSStyleSheet::JSCSSStyleSheet(PassRefPtr<Structure> structure, PassRefPtr<CSS
 {
 }
 
-JSObject* JSCSSStyleSheet::createPrototype(ExecState* exec)
+JSObject* JSCSSStyleSheet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSStyleSheetPrototype(JSCSSStyleSheetPrototype::createStructure(JSStyleSheetPrototype::self(exec)));
+    return new (exec) JSCSSStyleSheetPrototype(JSCSSStyleSheetPrototype::createStructure(JSStyleSheetPrototype::self(exec, globalObject)));
 }
 
 bool JSCSSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,97 +142,104 @@ bool JSCSSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCSSStyleSheet, Base>(exec, &JSCSSStyleSheetTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSStyleSheetOwnerRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetOwnerRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerRule()));
 }
 
-JSValuePtr jsCSSStyleSheetCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cssRules()));
 }
 
-JSValuePtr jsCSSStyleSheetRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rules()));
 }
 
-JSValuePtr jsCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSStyleSheet::getConstructor(ExecState* exec)
+JSValue JSCSSStyleSheet::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSStyleSheetConstructor>(exec);
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rule = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& rule = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->insertRule(rule, index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->insertRule(rule, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
     imp->deleteRule(index, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionAddRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selector = args.at(exec, 0)->toString(exec);
-    const UString& style = args.at(exec, 1)->toString(exec);
+    const UString& selector = args.at(0).toString(exec);
+    const UString& style = args.at(1).toString(exec);
 
     int argsCount = args.size();
     if (argsCount < 3) {
 
-        JSC::JSValuePtr result = jsNumber(exec, imp->addRule(selector, style, ec));
+        JSC::JSValue result = jsNumber(exec, imp->addRule(selector, style, ec));
         setDOMException(exec, ec);
         return result;
     }
 
-    unsigned index = args.at(exec, 2)->toInt32(exec);
+    unsigned index = args.at(2).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->addRule(selector, style, index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->addRule(selector, style, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionRemoveRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionRemoveRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
     imp->removeRule(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
index dedf1ca4bb..bd048f26cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
@@ -31,27 +31,28 @@ class JSCSSStyleSheet : public JSStyleSheet {
     typedef JSStyleSheet Base;
 public:
     JSCSSStyleSheet(PassRefPtr<JSC::Structure>, PassRefPtr<CSSStyleSheet>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSStyleSheetPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,16 +61,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionAddRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionRemoveRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionRemoveRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSStyleSheetOwnerRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleSheetCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleSheetRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetOwnerRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 50ee92bf2d..da216fd846 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSValue)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSValue);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSCSSValueConstructor(ExecState* exec)
         : DOMObject(JSCSSValueConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSValuePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSValuePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +114,9 @@ static const HashTable JSCSSValuePrototypeTable =
 
 const ClassInfo JSCSSValuePrototype::s_info = { "CSSValuePrototype", 0, &JSCSSValuePrototypeTable, 0 };
 
-JSObject* JSCSSValuePrototype::self(ExecState* exec)
+JSObject* JSCSSValuePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSValue>(exec);
+    return getDOMPrototype<JSCSSValue>(exec, globalObject);
 }
 
 bool JSCSSValuePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +135,11 @@ JSCSSValue::JSCSSValue(PassRefPtr<Structure> structure, PassRefPtr<CSSValue> imp
 JSCSSValue::~JSCSSValue()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSValue::createPrototype(ExecState* exec)
+JSObject* JSCSSValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSValuePrototype(JSCSSValuePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSValuePrototype(JSCSSValuePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,28 +147,30 @@ bool JSCSSValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSCSSValue, Base>(exec, &JSCSSValueTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSValueCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSValueCssValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->cssValueType());
 }
 
-JSValuePtr jsCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSValue*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSValue, Base>(exec, propertyName, value, &JSCSSValueTable, this, slot);
 }
 
-void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -177,36 +178,36 @@ void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValuePtr valu
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSValue::getConstructor(ExecState* exec)
+JSValue JSCSSValue::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSValueConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsCSSValueCSS_INHERIT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_INHERIT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsCSSValueCSS_VALUE_LIST(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_VALUE_LIST(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsCSSValueCSS_CUSTOM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_CUSTOM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-CSSValue* toCSSValue(JSC::JSValuePtr value)
+CSSValue* toCSSValue(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSValue::s_info) ? static_cast<JSCSSValue*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSValue::s_info) ? static_cast<JSCSSValue*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
index ece0f07a1c..d38c5c4296 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
@@ -34,34 +34,35 @@ class JSCSSValue : public DOMObject {
 public:
     JSCSSValue(PassRefPtr<JSC::Structure>, PassRefPtr<CSSValue>);
     virtual ~JSCSSValue();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSValue* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSValue> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSValue*);
-CSSValue* toCSSValue(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSValue*);
+CSSValue* toCSSValue(JSC::JSValue);
 
 class JSCSSValuePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -70,16 +71,16 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSValueCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSValueCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSValueCssValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSValueCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSValueCssValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsCSSValueCSS_INHERIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueCSS_CUSTOM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_INHERIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_CUSTOM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
index f5cc5ea34b..5a0096884e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSValueList)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSValueList);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSCSSValueListConstructor(ExecState* exec)
         : DOMObject(JSCSSValueListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSValueListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSValueListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSCSSValueListPrototypeTable =
 
 const ClassInfo JSCSSValueListPrototype::s_info = { "CSSValueListPrototype", 0, &JSCSSValueListPrototypeTable, 0 };
 
-JSObject* JSCSSValueListPrototype::self(ExecState* exec)
+JSObject* JSCSSValueListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSValueList>(exec);
+    return getDOMPrototype<JSCSSValueList>(exec, globalObject);
 }
 
 bool JSCSSValueListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +126,9 @@ JSCSSValueList::JSCSSValueList(PassRefPtr<Structure> structure, PassRefPtr<CSSVa
 {
 }
 
-JSObject* JSCSSValueList::createPrototype(ExecState* exec)
+JSObject* JSCSSValueList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSValueListPrototype(JSCSSValueListPrototype::createStructure(JSCSSValuePrototype::self(exec)));
+    return new (exec) JSCSSValueListPrototype(JSCSSValueListPrototype::createStructure(JSCSSValuePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -156,13 +156,14 @@ bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSValueListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSValueList* imp = static_cast<CSSValueList*>(static_cast<JSCSSValueList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSValueList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -173,26 +174,27 @@ void JSCSSValueList::getPropertyNames(ExecState* exec, PropertyNameArray& proper
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSValueList::getConstructor(ExecState* exec)
+JSValue JSCSSValueList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSValueListConstructor>(exec);
 }
 
-JSValuePtr jsCSSValueListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSValueList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSValueList::s_info))
         return throwError(exec, TypeError);
     JSCSSValueList* castedThisObj = static_cast<JSCSSValueList*>(asObject(thisValue));
     CSSValueList* imp = static_cast<CSSValueList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSCSSValueList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSValueList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSValueList* thisObj = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<CSSValueList*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
index 892698c89f..3d350937a8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
@@ -31,30 +31,31 @@ class JSCSSValueList : public JSCSSValue {
     typedef JSCSSValue Base;
 public:
     JSCSSValueList(PassRefPtr<JSC::Structure>, PassRefPtr<CSSValueList>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSCSSValueListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,11 +64,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSValueListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSValueListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 28b76732b7..24ff9bcd65 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesDeclaration)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesDeclaration);
 
 /* Hash table */
 
@@ -77,13 +77,13 @@ public:
     JSCSSVariablesDeclarationConstructor(ExecState* exec)
         : DOMObject(JSCSSVariablesDeclarationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSVariablesDeclarationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSVariablesDeclarationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +116,9 @@ static const HashTable JSCSSVariablesDeclarationPrototypeTable =
 
 const ClassInfo JSCSSVariablesDeclarationPrototype::s_info = { "CSSVariablesDeclarationPrototype", 0, &JSCSSVariablesDeclarationPrototypeTable, 0 };
 
-JSObject* JSCSSVariablesDeclarationPrototype::self(ExecState* exec)
+JSObject* JSCSSVariablesDeclarationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSVariablesDeclaration>(exec);
+    return getDOMPrototype<JSCSSVariablesDeclaration>(exec, globalObject);
 }
 
 bool JSCSSVariablesDeclarationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,12 +137,11 @@ JSCSSVariablesDeclaration::JSCSSVariablesDeclaration(PassRefPtr<Structure> struc
 JSCSSVariablesDeclaration::~JSCSSVariablesDeclaration()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSVariablesDeclaration::createPrototype(ExecState* exec)
+JSObject* JSCSSVariablesDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSVariablesDeclarationPrototype(JSCSSVariablesDeclarationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSVariablesDeclarationPrototype(JSCSSVariablesDeclarationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -170,37 +169,40 @@ bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, unsigned pro
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSVariablesDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSVariablesDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSVariablesDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentRule()));
 }
 
-JSValuePtr jsCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSVariablesDeclaration, Base>(exec, propertyName, value, &JSCSSVariablesDeclarationTable, this, slot);
 }
 
-void setJSCSSVariablesDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSVariablesDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(thisObject)->impl());
-    imp->setCssText(value->toString(exec));
+    imp->setCssText(value.toString(exec));
 }
 
 void JSCSSVariablesDeclaration::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
@@ -210,80 +212,84 @@ void JSCSSVariablesDeclaration::getPropertyNames(ExecState* exec, PropertyNameAr
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSVariablesDeclaration::getConstructor(ExecState* exec)
+JSValue JSCSSVariablesDeclaration::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSVariablesDeclarationConstructor>(exec);
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
-    const UString& variableName = args.at(exec, 0)->toString(exec);
+    const UString& variableName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getVariableValue(variableName));
+    JSC::JSValue result = jsString(exec, imp->getVariableValue(variableName));
     return result;
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& variableName = args.at(exec, 0)->toString(exec);
+    const UString& variableName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->removeVariable(variableName, ec));
+    JSC::JSValue result = jsString(exec, imp->removeVariable(variableName, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionSetVariable(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& variableName = args.at(exec, 0)->toString(exec);
-    const UString& value = args.at(exec, 1)->toString(exec);
+    const UString& variableName = args.at(0).toString(exec);
+    const UString& value = args.at(1).toString(exec);
 
     imp->setVariable(variableName, value, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->item(index));
+    JSC::JSValue result = jsString(exec, imp->item(index));
     return result;
 }
 
 
-JSValuePtr JSCSSVariablesDeclaration::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSVariablesDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSVariablesDeclaration* thisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CSSVariablesDeclaration* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CSSVariablesDeclaration* object)
 {
     return getDOMObjectWrapper<JSCSSVariablesDeclaration>(exec, object);
 }
-CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValuePtr value)
+CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSVariablesDeclaration::s_info) ? static_cast<JSCSSVariablesDeclaration*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSVariablesDeclaration::s_info) ? static_cast<JSCSSVariablesDeclaration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
index 8d0e2b9457..fe98f8e13c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
@@ -34,37 +34,38 @@ class JSCSSVariablesDeclaration : public DOMObject {
 public:
     JSCSSVariablesDeclaration(PassRefPtr<JSC::Structure>, PassRefPtr<CSSVariablesDeclaration>);
     virtual ~JSCSSVariablesDeclaration();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSVariablesDeclaration* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSVariablesDeclaration> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSVariablesDeclaration*);
-CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSVariablesDeclaration*);
+CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValue);
 
 class JSCSSVariablesDeclarationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,17 +74,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionSetVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSVariablesDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSVariablesDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSVariablesDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
index 1e80477385..7a4753fa14 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesRule);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSCSSVariablesRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSVariablesRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSVariablesRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSVariablesRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSCSSVariablesRulePrototypeTable =
 
 const ClassInfo JSCSSVariablesRulePrototype::s_info = { "CSSVariablesRulePrototype", 0, &JSCSSVariablesRulePrototypeTable, 0 };
 
-JSObject* JSCSSVariablesRulePrototype::self(ExecState* exec)
+JSObject* JSCSSVariablesRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSVariablesRule>(exec);
+    return getDOMPrototype<JSCSSVariablesRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSVariablesRule::s_info = { "CSSVariablesRule", &JSCSSRule::s_info, &JSCSSVariablesRuleTable, 0 };
@@ -121,9 +121,9 @@ JSCSSVariablesRule::JSCSSVariablesRule(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSCSSVariablesRule::createPrototype(ExecState* exec)
+JSObject* JSCSSVariablesRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSVariablesRulePrototype(JSCSSVariablesRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSVariablesRulePrototype(JSCSSVariablesRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSVariablesRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,23 +131,25 @@ bool JSCSSVariablesRule::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSCSSVariablesRule, Base>(exec, &JSCSSVariablesRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSVariablesRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsCSSVariablesRuleVariables(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleVariables(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->variables()));
 }
 
-JSValuePtr jsCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSVariablesRule::getConstructor(ExecState* exec)
+JSValue JSCSSVariablesRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSVariablesRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
index 2c318ff282..c204a1e2cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
@@ -31,23 +31,24 @@ class JSCSSVariablesRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSVariablesRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSVariablesRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSVariablesRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSVariablesRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSVariablesRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesRuleVariables(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleVariables(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
index 69356d2d21..daf71ea50a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasGradient)
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasGradient);
 
 /* Hash table for prototype */
 
@@ -52,9 +52,9 @@ static const HashTable JSCanvasGradientPrototypeTable =
 
 const ClassInfo JSCanvasGradientPrototype::s_info = { "CanvasGradientPrototype", 0, &JSCanvasGradientPrototypeTable, 0 };
 
-JSObject* JSCanvasGradientPrototype::self(ExecState* exec)
+JSObject* JSCanvasGradientPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCanvasGradient>(exec);
+    return getDOMPrototype<JSCanvasGradient>(exec, globalObject);
 }
 
 bool JSCanvasGradientPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -73,36 +73,36 @@ JSCanvasGradient::JSCanvasGradient(PassRefPtr<Structure> structure, PassRefPtr<C
 JSCanvasGradient::~JSCanvasGradient()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCanvasGradient::createPrototype(ExecState* exec)
+JSObject* JSCanvasGradient::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCanvasGradientPrototype(JSCanvasGradientPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCanvasGradientPrototype(JSCanvasGradientPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsCanvasGradientPrototypeFunctionAddColorStop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasGradientPrototypeFunctionAddColorStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasGradient::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasGradient::s_info))
         return throwError(exec, TypeError);
     JSCanvasGradient* castedThisObj = static_cast<JSCanvasGradient*>(asObject(thisValue));
     CanvasGradient* imp = static_cast<CanvasGradient*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float offset = args.at(exec, 0)->toFloat(exec);
-    const UString& color = args.at(exec, 1)->toString(exec);
+    float offset = args.at(0).toFloat(exec);
+    const UString& color = args.at(1).toString(exec);
 
     imp->addColorStop(offset, color, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CanvasGradient* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CanvasGradient* object)
 {
     return getDOMObjectWrapper<JSCanvasGradient>(exec, object);
 }
-CanvasGradient* toCanvasGradient(JSC::JSValuePtr value)
+CanvasGradient* toCanvasGradient(JSC::JSValue value)
 {
-    return value->isObject(&JSCanvasGradient::s_info) ? static_cast<JSCanvasGradient*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCanvasGradient::s_info) ? static_cast<JSCanvasGradient*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
index 0fc34b01a9..e81a3b44a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
@@ -34,7 +34,7 @@ class JSCanvasGradient : public DOMObject {
 public:
     JSCanvasGradient(PassRefPtr<JSC::Structure>, PassRefPtr<CanvasGradient>);
     virtual ~JSCanvasGradient();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -44,16 +44,17 @@ private:
     RefPtr<CanvasGradient> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CanvasGradient*);
-CanvasGradient* toCanvasGradient(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CanvasGradient*);
+CanvasGradient* toCanvasGradient(JSC::JSValue);
 
 class JSCanvasGradientPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,7 +63,7 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCanvasGradientPrototypeFunctionAddColorStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasGradientPrototypeFunctionAddColorStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
index e14937f141..9b3ec21c70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
@@ -31,7 +31,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasPattern)
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasPattern);
 
 /* Hash table for prototype */
 
@@ -49,9 +49,9 @@ static const HashTable JSCanvasPatternPrototypeTable =
 
 const ClassInfo JSCanvasPatternPrototype::s_info = { "CanvasPatternPrototype", 0, &JSCanvasPatternPrototypeTable, 0 };
 
-JSObject* JSCanvasPatternPrototype::self(ExecState* exec)
+JSObject* JSCanvasPatternPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCanvasPattern>(exec);
+    return getDOMPrototype<JSCanvasPattern>(exec, globalObject);
 }
 
 const ClassInfo JSCanvasPattern::s_info = { "CanvasPattern", 0, 0, 0 };
@@ -65,21 +65,20 @@ JSCanvasPattern::JSCanvasPattern(PassRefPtr<Structure> structure, PassRefPtr<Can
 JSCanvasPattern::~JSCanvasPattern()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCanvasPattern::createPrototype(ExecState* exec)
+JSObject* JSCanvasPattern::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCanvasPatternPrototype(JSCanvasPatternPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCanvasPatternPrototype(JSCanvasPatternPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CanvasPattern* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CanvasPattern* object)
 {
     return getDOMObjectWrapper<JSCanvasPattern>(exec, object);
 }
-CanvasPattern* toCanvasPattern(JSC::JSValuePtr value)
+CanvasPattern* toCanvasPattern(JSC::JSValue value)
 {
-    return value->isObject(&JSCanvasPattern::s_info) ? static_cast<JSCanvasPattern*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCanvasPattern::s_info) ? static_cast<JSCanvasPattern*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
index 1d691a240f..776b830694 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
@@ -34,7 +34,7 @@ class JSCanvasPattern : public DOMObject {
 public:
     JSCanvasPattern(PassRefPtr<JSC::Structure>, PassRefPtr<CanvasPattern>);
     virtual ~JSCanvasPattern();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -44,12 +44,13 @@ private:
     RefPtr<CanvasPattern> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CanvasPattern*);
-CanvasPattern* toCanvasPattern(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CanvasPattern*);
+CanvasPattern* toCanvasPattern(JSC::JSValue);
 
 class JSCanvasPatternPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCanvasPatternPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
index 5148f6a5d5..9fb681d7a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext2D)
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext2D);
 
 /* Hash table */
 
@@ -98,13 +98,13 @@ public:
     JSCanvasRenderingContext2DConstructor(ExecState* exec)
         : DOMObject(JSCanvasRenderingContext2DConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext2DPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext2DPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -177,9 +177,9 @@ static const HashTable JSCanvasRenderingContext2DPrototypeTable =
 
 const ClassInfo JSCanvasRenderingContext2DPrototype::s_info = { "CanvasRenderingContext2DPrototype", 0, &JSCanvasRenderingContext2DPrototypeTable, 0 };
 
-JSObject* JSCanvasRenderingContext2DPrototype::self(ExecState* exec)
+JSObject* JSCanvasRenderingContext2DPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCanvasRenderingContext2D>(exec);
+    return getDOMPrototype<JSCanvasRenderingContext2D>(exec, globalObject);
 }
 
 bool JSCanvasRenderingContext2DPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -198,12 +198,11 @@ JSCanvasRenderingContext2D::JSCanvasRenderingContext2D(PassRefPtr<Structure> str
 JSCanvasRenderingContext2D::~JSCanvasRenderingContext2D()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCanvasRenderingContext2D::createPrototype(ExecState* exec)
+JSObject* JSCanvasRenderingContext2D::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCanvasRenderingContext2DPrototype(JSCanvasRenderingContext2DPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCanvasRenderingContext2DPrototype(JSCanvasRenderingContext2DPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCanvasRenderingContext2D::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -211,205 +210,220 @@ bool JSCanvasRenderingContext2D::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSCanvasRenderingContext2D, Base>(exec, &JSCanvasRenderingContext2DTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCanvasRenderingContext2DCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->canvas()));
 }
 
-JSValuePtr jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->globalAlpha());
 }
 
-JSValuePtr jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->globalCompositeOperation());
 }
 
-JSValuePtr jsCanvasRenderingContext2DLineWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->lineWidth());
 }
 
-JSValuePtr jsCanvasRenderingContext2DLineCap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineCap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lineCap());
 }
 
-JSValuePtr jsCanvasRenderingContext2DLineJoin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineJoin(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lineJoin());
 }
 
-JSValuePtr jsCanvasRenderingContext2DMiterLimit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DMiterLimit(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->miterLimit());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->shadowOffsetX());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->shadowOffsetY());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowBlur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowBlur(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->shadowBlur());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->shadowColor());
 }
 
-JSValuePtr jsCanvasRenderingContext2DFont(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFont(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->font());
 }
 
-JSValuePtr jsCanvasRenderingContext2DTextAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->textAlign());
 }
 
-JSValuePtr jsCanvasRenderingContext2DTextBaseline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextBaseline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->textBaseline());
 }
 
-JSValuePtr jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->strokeStyle(exec);
 }
 
-JSValuePtr jsCanvasRenderingContext2DFillStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFillStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->fillStyle(exec);
 }
 
-JSValuePtr jsCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCanvasRenderingContext2D, Base>(exec, propertyName, value, &JSCanvasRenderingContext2DTable, this, slot);
 }
 
-void setJSCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setGlobalAlpha(value->toFloat(exec));
+    imp->setGlobalAlpha(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setGlobalCompositeOperation(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DLineWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DLineWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setLineWidth(value->toFloat(exec));
+    imp->setLineWidth(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DLineCap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DLineCap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setLineCap(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DLineJoin(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DLineJoin(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setLineJoin(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DMiterLimit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DMiterLimit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setMiterLimit(value->toFloat(exec));
+    imp->setMiterLimit(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setShadowOffsetX(value->toFloat(exec));
+    imp->setShadowOffsetX(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setShadowOffsetY(value->toFloat(exec));
+    imp->setShadowOffsetY(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowBlur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowBlur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setShadowBlur(value->toFloat(exec));
+    imp->setShadowBlur(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setShadowColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DFont(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DFont(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setFont(value->toString(exec));
+    imp->setFont(value.toString(exec));
 }
 
-void setJSCanvasRenderingContext2DTextAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DTextAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setTextAlign(value->toString(exec));
+    imp->setTextAlign(value.toString(exec));
 }
 
-void setJSCanvasRenderingContext2DTextBaseline(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DTextBaseline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setTextBaseline(value->toString(exec));
+    imp->setTextBaseline(value.toString(exec));
 }
 
-void setJSCanvasRenderingContext2DStrokeStyle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DStrokeStyle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSCanvasRenderingContext2D*>(thisObject)->setStrokeStyle(exec, value);
 }
 
-void setJSCanvasRenderingContext2DFillStyle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DFillStyle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSCanvasRenderingContext2D*>(thisObject)->setFillStyle(exec, value);
 }
 
-JSValuePtr JSCanvasRenderingContext2D::getConstructor(ExecState* exec)
+JSValue JSCanvasRenderingContext2D::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCanvasRenderingContext2DConstructor>(exec);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -418,9 +432,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -429,149 +444,159 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecState* exec, J
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionScale(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float sx = args.at(exec, 0)->toFloat(exec);
-    float sy = args.at(exec, 1)->toFloat(exec);
+    float sx = args.at(0).toFloat(exec);
+    float sy = args.at(1).toFloat(exec);
 
     imp->scale(sx, sy);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float angle = args.at(exec, 0)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
 
     imp->rotate(angle);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float tx = args.at(exec, 0)->toFloat(exec);
-    float ty = args.at(exec, 1)->toFloat(exec);
+    float tx = args.at(0).toFloat(exec);
+    float ty = args.at(1).toFloat(exec);
 
     imp->translate(tx, ty);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float m11 = args.at(exec, 0)->toFloat(exec);
-    float m12 = args.at(exec, 1)->toFloat(exec);
-    float m21 = args.at(exec, 2)->toFloat(exec);
-    float m22 = args.at(exec, 3)->toFloat(exec);
-    float dx = args.at(exec, 4)->toFloat(exec);
-    float dy = args.at(exec, 5)->toFloat(exec);
+    float m11 = args.at(0).toFloat(exec);
+    float m12 = args.at(1).toFloat(exec);
+    float m21 = args.at(2).toFloat(exec);
+    float m22 = args.at(3).toFloat(exec);
+    float dx = args.at(4).toFloat(exec);
+    float dy = args.at(5).toFloat(exec);
 
     imp->transform(m11, m12, m21, m22, dx, dy);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float m11 = args.at(exec, 0)->toFloat(exec);
-    float m12 = args.at(exec, 1)->toFloat(exec);
-    float m21 = args.at(exec, 2)->toFloat(exec);
-    float m22 = args.at(exec, 3)->toFloat(exec);
-    float dx = args.at(exec, 4)->toFloat(exec);
-    float dy = args.at(exec, 5)->toFloat(exec);
+    float m11 = args.at(0).toFloat(exec);
+    float m12 = args.at(1).toFloat(exec);
+    float m21 = args.at(2).toFloat(exec);
+    float m22 = args.at(3).toFloat(exec);
+    float dx = args.at(4).toFloat(exec);
+    float dy = args.at(5).toFloat(exec);
 
     imp->setTransform(m11, m12, m21, m22, dx, dy);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x0 = args.at(exec, 0)->toFloat(exec);
-    float y0 = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
+    float x0 = args.at(0).toFloat(exec);
+    float y0 = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createLinearGradient(x0, y0, x1, y1, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createLinearGradient(x0, y0, x1, y1, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x0 = args.at(exec, 0)->toFloat(exec);
-    float y0 = args.at(exec, 1)->toFloat(exec);
-    float r0 = args.at(exec, 2)->toFloat(exec);
-    float x1 = args.at(exec, 3)->toFloat(exec);
-    float y1 = args.at(exec, 4)->toFloat(exec);
-    float r1 = args.at(exec, 5)->toFloat(exec);
+    float x0 = args.at(0).toFloat(exec);
+    float y0 = args.at(1).toFloat(exec);
+    float r0 = args.at(2).toFloat(exec);
+    float x1 = args.at(3).toFloat(exec);
+    float y1 = args.at(4).toFloat(exec);
+    float r1 = args.at(5).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createRadialGradient(x0, y0, r0, x1, y1, r1, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createRadialGradient(x0, y0, r0, x1, y1, r1, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float width = args.at(exec, 2)->toFloat(exec);
-    float height = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float width = args.at(2).toFloat(exec);
+    float height = args.at(3).toFloat(exec);
 
     imp->clearRect(x, y, width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float width = args.at(exec, 2)->toFloat(exec);
-    float height = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float width = args.at(2).toFloat(exec);
+    float height = args.at(3).toFloat(exec);
 
     imp->fillRect(x, y, width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -580,9 +605,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecState* exec,
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -591,119 +617,127 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecState* exec,
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->moveTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionLineTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionLineTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->lineTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float cpx = args.at(exec, 0)->toFloat(exec);
-    float cpy = args.at(exec, 1)->toFloat(exec);
-    float x = args.at(exec, 2)->toFloat(exec);
-    float y = args.at(exec, 3)->toFloat(exec);
+    float cpx = args.at(0).toFloat(exec);
+    float cpy = args.at(1).toFloat(exec);
+    float x = args.at(2).toFloat(exec);
+    float y = args.at(3).toFloat(exec);
 
     imp->quadraticCurveTo(cpx, cpy, x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float cp1x = args.at(exec, 0)->toFloat(exec);
-    float cp1y = args.at(exec, 1)->toFloat(exec);
-    float cp2x = args.at(exec, 2)->toFloat(exec);
-    float cp2y = args.at(exec, 3)->toFloat(exec);
-    float x = args.at(exec, 4)->toFloat(exec);
-    float y = args.at(exec, 5)->toFloat(exec);
+    float cp1x = args.at(0).toFloat(exec);
+    float cp1y = args.at(1).toFloat(exec);
+    float cp2x = args.at(2).toFloat(exec);
+    float cp2y = args.at(3).toFloat(exec);
+    float x = args.at(4).toFloat(exec);
+    float y = args.at(5).toFloat(exec);
 
     imp->bezierCurveTo(cp1x, cp1y, cp2x, cp2y, x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArcTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArcTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x1 = args.at(exec, 0)->toFloat(exec);
-    float y1 = args.at(exec, 1)->toFloat(exec);
-    float x2 = args.at(exec, 2)->toFloat(exec);
-    float y2 = args.at(exec, 3)->toFloat(exec);
-    float radius = args.at(exec, 4)->toFloat(exec);
+    float x1 = args.at(0).toFloat(exec);
+    float y1 = args.at(1).toFloat(exec);
+    float x2 = args.at(2).toFloat(exec);
+    float y2 = args.at(3).toFloat(exec);
+    float radius = args.at(4).toFloat(exec);
 
     imp->arcTo(x1, y1, x2, y2, radius, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float width = args.at(exec, 2)->toFloat(exec);
-    float height = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float width = args.at(2).toFloat(exec);
+    float height = args.at(3).toFloat(exec);
 
     imp->rect(x, y, width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArc(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float radius = args.at(exec, 2)->toFloat(exec);
-    float startAngle = args.at(exec, 3)->toFloat(exec);
-    float endAngle = args.at(exec, 4)->toFloat(exec);
-    bool anticlockwise = args.at(exec, 5)->toBoolean(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float radius = args.at(2).toFloat(exec);
+    float startAngle = args.at(3).toFloat(exec);
+    float endAngle = args.at(4).toFloat(exec);
+    bool anticlockwise = args.at(5).toBoolean(exec);
 
     imp->arc(x, y, radius, startAngle, endAngle, anticlockwise, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -712,9 +746,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -723,9 +758,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecState* exec, JS
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -734,124 +770,135 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isPointInPath(x, y));
+    JSC::JSValue result = jsBoolean(imp->isPointInPath(x, y));
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->fillText(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->strokeText(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMeasureText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMeasureText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& text = args.at(exec, 0)->toString(exec);
+    const UString& text = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->measureText(text)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->measureText(text)));
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float alpha = args.at(exec, 0)->toFloat(exec);
+    float alpha = args.at(0).toFloat(exec);
 
     imp->setAlpha(alpha);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& compositeOperation = args.at(exec, 0)->toString(exec);
+    const UString& compositeOperation = args.at(0).toString(exec);
 
     imp->setCompositeOperation(compositeOperation);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float width = args.at(exec, 0)->toFloat(exec);
+    float width = args.at(0).toFloat(exec);
 
     imp->setLineWidth(width);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& cap = args.at(exec, 0)->toString(exec);
+    const UString& cap = args.at(0).toString(exec);
 
     imp->setLineCap(cap);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& join = args.at(exec, 0)->toString(exec);
+    const UString& join = args.at(0).toString(exec);
 
     imp->setLineJoin(join);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float limit = args.at(exec, 0)->toFloat(exec);
+    float limit = args.at(0).toFloat(exec);
 
     imp->setMiterLimit(limit);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearShadow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearShadow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -860,109 +907,119 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearShadow(ExecState* exe
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setStrokeColor(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setFillColor(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->strokeRect(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->drawImage(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->drawImageFromRect(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetShadow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetShadow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setShadow(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->createPattern(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float sw = args.at(exec, 0)->toFloat(exec);
-    float sh = args.at(exec, 1)->toFloat(exec);
+    float sw = args.at(0).toFloat(exec);
+    float sh = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createImageData(sw, sh)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createImageData(sw, sh)));
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionGetImageData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float sx = args.at(exec, 0)->toFloat(exec);
-    float sy = args.at(exec, 1)->toFloat(exec);
-    float sw = args.at(exec, 2)->toFloat(exec);
-    float sh = args.at(exec, 3)->toFloat(exec);
+    float sx = args.at(0).toFloat(exec);
+    float sy = args.at(1).toFloat(exec);
+    float sw = args.at(2).toFloat(exec);
+    float sh = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getImageData(sx, sy, sw, sh, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getImageData(sx, sy, sw, sh, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionPutImageData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->putImageData(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CanvasRenderingContext2D* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CanvasRenderingContext2D* object)
 {
     return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, object);
 }
-CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValuePtr value)
+CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValue value)
 {
-    return value->isObject(&JSCanvasRenderingContext2D::s_info) ? static_cast<JSCanvasRenderingContext2D*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCanvasRenderingContext2D::s_info) ? static_cast<JSCanvasRenderingContext2D*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
index ace29c8226..6c084d1a6c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
@@ -34,52 +34,53 @@ class JSCanvasRenderingContext2D : public DOMObject {
 public:
     JSCanvasRenderingContext2D(PassRefPtr<JSC::Structure>, PassRefPtr<CanvasRenderingContext2D>);
     virtual ~JSCanvasRenderingContext2D();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr strokeStyle(JSC::ExecState*) const;
-    void setStrokeStyle(JSC::ExecState*, JSC::JSValuePtr);
-    JSC::JSValuePtr fillStyle(JSC::ExecState*) const;
-    void setFillStyle(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue strokeStyle(JSC::ExecState*) const;
+    void setStrokeStyle(JSC::ExecState*, JSC::JSValue);
+    JSC::JSValue fillStyle(JSC::ExecState*) const;
+    void setFillStyle(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr fillText(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr strokeText(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setStrokeColor(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setFillColor(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr strokeRect(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr drawImage(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr drawImageFromRect(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setShadow(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr createPattern(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr putImageData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue fillText(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue strokeText(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setStrokeColor(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setFillColor(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue strokeRect(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue drawImage(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue drawImageFromRect(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setShadow(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue createPattern(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue putImageData(JSC::ExecState*, const JSC::ArgList&);
     CanvasRenderingContext2D* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasRenderingContext2D> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CanvasRenderingContext2D*);
-CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CanvasRenderingContext2D*);
+CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValue);
 
 class JSCanvasRenderingContext2DPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -88,84 +89,84 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSave(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRestore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBeginPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionLineTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArcTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFill(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStroke(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClip(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMeasureText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionGetImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionPutImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRestore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBeginPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionLineTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArcTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFill(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStroke(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClip(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMeasureText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCanvasRenderingContext2DCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DLineCap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DFont(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DLineCap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DFont(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
index ba59a0cd9f..4e5d2dba7a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCharacterData)
+ASSERT_CLASS_FITS_IN_CELL(JSCharacterData);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSCharacterDataConstructor(ExecState* exec)
         : DOMObject(JSCharacterDataConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCharacterDataPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCharacterDataPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +114,9 @@ static const HashTable JSCharacterDataPrototypeTable =
 
 const ClassInfo JSCharacterDataPrototype::s_info = { "CharacterDataPrototype", 0, &JSCharacterDataPrototypeTable, 0 };
 
-JSObject* JSCharacterDataPrototype::self(ExecState* exec)
+JSObject* JSCharacterDataPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCharacterData>(exec);
+    return getDOMPrototype<JSCharacterData>(exec, globalObject);
 }
 
 bool JSCharacterDataPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -124,16 +124,16 @@ bool JSCharacterDataPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSCharacterDataPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSCharacterData::s_info = { "CharacterData", &JSEventTargetNode::s_info, &JSCharacterDataTable, 0 };
+const ClassInfo JSCharacterData::s_info = { "CharacterData", &JSNode::s_info, &JSCharacterDataTable, 0 };
 
 JSCharacterData::JSCharacterData(PassRefPtr<Structure> structure, PassRefPtr<CharacterData> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSCharacterData::createPrototype(ExecState* exec)
+JSObject* JSCharacterData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCharacterDataPrototype(JSCharacterDataPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSCharacterDataPrototype(JSCharacterDataPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSCharacterData::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,28 +141,30 @@ bool JSCharacterData::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCharacterData, Base>(exec, &JSCharacterDataTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCharacterDataData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsCharacterDataLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCharacterData*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCharacterData, Base>(exec, propertyName, value, &JSCharacterDataTable, this, slot);
 }
 
-void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -170,81 +172,85 @@ void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValuePtr va
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCharacterData::getConstructor(ExecState* exec)
+JSValue JSCharacterData::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCharacterDataConstructor>(exec);
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionSubstringData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionSubstringData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    int length = args.at(exec, 1)->toInt32(exec);
+    int length = args.at(1).toInt32(exec);
     if (length < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->substringData(offset, length, ec));
+    JSC::JSValue result = jsStringOrNull(exec, imp->substringData(offset, length, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionAppendData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionAppendData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
     imp->appendData(data, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionInsertData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionInsertData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    const UString& data = args.at(exec, 1)->toString(exec);
+    const UString& data = args.at(1).toString(exec);
 
     imp->insertData(offset, data, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    int length = args.at(exec, 1)->toInt32(exec);
+    int length = args.at(1).toInt32(exec);
     if (length < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
@@ -255,24 +261,25 @@ JSValuePtr jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionReplaceData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionReplaceData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    int length = args.at(exec, 1)->toInt32(exec);
+    int length = args.at(1).toInt32(exec);
     if (length < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    const UString& data = args.at(exec, 2)->toString(exec);
+    const UString& data = args.at(2).toString(exec);
 
     imp->replaceData(offset, length, data, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
index 4aad7155c4..273318f6f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
@@ -21,38 +21,39 @@
 #ifndef JSCharacterData_h
 #define JSCharacterData_h
 
-#include "JSEventTargetNode.h"
+#include "JSNode.h"
 
 namespace WebCore {
 
 class CharacterData;
 
-class JSCharacterData : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSCharacterData : public JSNode {
+    typedef JSNode Base;
 public:
     JSCharacterData(PassRefPtr<JSC::Structure>, PassRefPtr<CharacterData>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCharacterDataPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,17 +62,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionSubstringData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionAppendData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionInsertData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionDeleteData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionReplaceData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionSubstringData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionAppendData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionInsertData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionReplaceData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCharacterDataData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCharacterDataData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCharacterDataLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCharacterDataData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCharacterDataLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
new file mode 100644
index 0000000000..8aa1b8eff9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -0,0 +1,200 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "JSClientRect.h"
+
+#include <wtf/GetPtr.h>
+
+#include "ClientRect.h"
+
+#include <runtime/JSNumberCell.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSClientRect);
+
+/* Hash table */
+
+static const HashTableValue JSClientRectTableValues[8] =
+{
+    { "top", DontDelete|ReadOnly, (intptr_t)jsClientRectTop, (intptr_t)0 },
+    { "right", DontDelete|ReadOnly, (intptr_t)jsClientRectRight, (intptr_t)0 },
+    { "bottom", DontDelete|ReadOnly, (intptr_t)jsClientRectBottom, (intptr_t)0 },
+    { "left", DontDelete|ReadOnly, (intptr_t)jsClientRectLeft, (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)jsClientRectWidth, (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)jsClientRectHeight, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 255, JSClientRectTableValues, 0 };
+#else
+    { 18, 15, JSClientRectTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSClientRectConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectConstructorTableValues, 0 };
+#else
+    { 1, 0, JSClientRectConstructorTableValues, 0 };
+#endif
+
+class JSClientRectConstructor : public DOMObject {
+public:
+    JSClientRectConstructor(ExecState* exec)
+        : DOMObject(JSClientRectConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSClientRectPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSClientRectConstructor::s_info = { "ClientRectConstructor", 0, &JSClientRectConstructorTable, 0 };
+
+bool JSClientRectConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSClientRectConstructor, DOMObject>(exec, &JSClientRectConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSClientRectPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSClientRectPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSClientRectPrototype::s_info = { "ClientRectPrototype", 0, &JSClientRectPrototypeTable, 0 };
+
+JSObject* JSClientRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSClientRect>(exec, globalObject);
+}
+
+const ClassInfo JSClientRect::s_info = { "ClientRect", 0, &JSClientRectTable, 0 };
+
+JSClientRect::JSClientRect(PassRefPtr<Structure> structure, PassRefPtr<ClientRect> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSClientRect::~JSClientRect()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSClientRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSClientRectPrototype(JSClientRectPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSClientRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSClientRect, Base>(exec, &JSClientRectTable, this, propertyName, slot);
+}
+
+JSValue jsClientRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->top());
+}
+
+JSValue jsClientRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->right());
+}
+
+JSValue jsClientRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->bottom());
+}
+
+JSValue jsClientRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->left());
+}
+
+JSValue jsClientRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->width());
+}
+
+JSValue jsClientRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->height());
+}
+
+JSValue jsClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSClientRect*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+JSValue JSClientRect::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSClientRectConstructor>(exec);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, ClientRect* object)
+{
+    return getDOMObjectWrapper<JSClientRect>(exec, object);
+}
+ClientRect* toClientRect(JSC::JSValue value)
+{
+    return value.isObject(&JSClientRect::s_info) ? static_cast<JSClientRect*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
new file mode 100644
index 0000000000..13a7b3812e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
@@ -0,0 +1,78 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSClientRect_h
+#define JSClientRect_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class ClientRect;
+
+class JSClientRect : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSClientRect(PassRefPtr<JSC::Structure>, PassRefPtr<ClientRect>);
+    virtual ~JSClientRect();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    ClientRect* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<ClientRect> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, ClientRect*);
+ClientRect* toClientRect(JSC::JSValue);
+
+class JSClientRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSClientRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsClientRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
new file mode 100644
index 0000000000..e1316b7670
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -0,0 +1,222 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "JSClientRectList.h"
+
+#include <wtf/GetPtr.h>
+
+#include <runtime/PropertyNameArray.h>
+#include "ClientRect.h"
+#include "ClientRectList.h"
+#include "ExceptionCode.h"
+#include "JSClientRect.h"
+
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSClientRectList);
+
+/* Hash table */
+
+static const HashTableValue JSClientRectListTableValues[3] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)jsClientRectListLength, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectListConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectListTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSClientRectListTableValues, 0 };
+#else
+    { 5, 3, JSClientRectListTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSClientRectListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSClientRectListConstructorTableValues, 0 };
+#endif
+
+class JSClientRectListConstructor : public DOMObject {
+public:
+    JSClientRectListConstructor(ExecState* exec)
+        : DOMObject(JSClientRectListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSClientRectListPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSClientRectListConstructor::s_info = { "ClientRectListConstructor", 0, &JSClientRectListConstructorTable, 0 };
+
+bool JSClientRectListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSClientRectListConstructor, DOMObject>(exec, &JSClientRectListConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSClientRectListPrototypeTableValues[2] =
+{
+    { "item", DontDelete|Function, (intptr_t)jsClientRectListPrototypeFunctionItem, (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectListPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectListPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSClientRectListPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSClientRectListPrototype::s_info = { "ClientRectListPrototype", 0, &JSClientRectListPrototypeTable, 0 };
+
+JSObject* JSClientRectListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSClientRectList>(exec, globalObject);
+}
+
+bool JSClientRectListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSClientRectListPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSClientRectList::s_info = { "ClientRectList", 0, &JSClientRectListTable, 0 };
+
+JSClientRectList::JSClientRectList(PassRefPtr<Structure> structure, PassRefPtr<ClientRectList> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSClientRectList::~JSClientRectList()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSClientRectList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSClientRectListPrototype(JSClientRectListPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSClientRectList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    const HashEntry* entry = JSClientRectListTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<ClientRectList*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+    return getStaticValueSlot<JSClientRectList, Base>(exec, &JSClientRectListTable, this, propertyName, slot);
+}
+
+bool JSClientRectList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<ClientRectList*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsClientRectListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRectList* imp = static_cast<ClientRectList*>(static_cast<JSClientRectList*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->length());
+}
+
+JSValue jsClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSClientRectList*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSClientRectList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<ClientRectList*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getPropertyNames(exec, propertyNames);
+}
+
+JSValue JSClientRectList::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSClientRectListConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClientRectList::s_info))
+        return throwError(exec, TypeError);
+    JSClientRectList* castedThisObj = static_cast<JSClientRectList*>(asObject(thisValue));
+    ClientRectList* imp = static_cast<ClientRectList*>(castedThisObj->impl());
+    int index = args.at(0).toInt32(exec);
+    if (index < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
+    return result;
+}
+
+
+JSValue JSClientRectList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSClientRectList* thisObj = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
+    return toJS(exec, static_cast<ClientRectList*>(thisObj->impl())->item(slot.index()));
+}
+JSC::JSValue toJS(JSC::ExecState* exec, ClientRectList* object)
+{
+    return getDOMObjectWrapper<JSClientRectList>(exec, object);
+}
+ClientRectList* toClientRectList(JSC::JSValue value)
+{
+    return value.isObject(&JSClientRectList::s_info) ? static_cast<JSClientRectList*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
new file mode 100644
index 0000000000..fcb1f563f6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
@@ -0,0 +1,84 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSClientRectList_h
+#define JSClientRectList_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class ClientRectList;
+
+class JSClientRectList : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSClientRectList(PassRefPtr<JSC::Structure>, PassRefPtr<ClientRectList>);
+    virtual ~JSClientRectList();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    ClientRectList* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<ClientRectList> m_impl;
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, ClientRectList*);
+ClientRectList* toClientRectList(JSC::JSValue);
+
+class JSClientRectListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSClientRectListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsClientRectListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index de87a53985..115b5de736 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSClipboard)
+ASSERT_CLASS_FITS_IN_CELL(JSClipboard);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSClipboardConstructor(ExecState* exec)
         : DOMObject(JSClipboardConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSClipboardPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSClipboardPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +112,9 @@ static const HashTable JSClipboardPrototypeTable =
 
 const ClassInfo JSClipboardPrototype::s_info = { "ClipboardPrototype", 0, &JSClipboardPrototypeTable, 0 };
 
-JSObject* JSClipboardPrototype::self(ExecState* exec)
+JSObject* JSClipboardPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSClipboard>(exec);
+    return getDOMPrototype<JSClipboard>(exec, globalObject);
 }
 
 bool JSClipboardPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,12 +133,11 @@ JSClipboard::JSClipboard(PassRefPtr<Structure> structure, PassRefPtr<Clipboard>
 JSClipboard::~JSClipboard()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSClipboard::createPrototype(ExecState* exec)
+JSObject* JSClipboard::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSClipboardPrototype(JSClipboardPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSClipboardPrototype(JSClipboardPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSClipboard::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,88 +145,94 @@ bool JSClipboard::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSClipboard, Base>(exec, &JSClipboardTable, this, propertyName, slot);
 }
 
-JSValuePtr jsClipboardDropEffect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardDropEffect(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->dropEffect());
 }
 
-JSValuePtr jsClipboardEffectAllowed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardEffectAllowed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->effectAllowed());
 }
 
-JSValuePtr jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->types(exec);
 }
 
-JSValuePtr jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSClipboard, Base>(exec, propertyName, value, &JSClipboardTable, this, slot);
 }
 
-void setJSClipboardDropEffect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSClipboardDropEffect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
-    imp->setDropEffect(value->toString(exec));
+    imp->setDropEffect(value.toString(exec));
 }
 
-void setJSClipboardEffectAllowed(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSClipboardEffectAllowed(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
-    imp->setEffectAllowed(value->toString(exec));
+    imp->setEffectAllowed(value.toString(exec));
 }
 
-JSValuePtr JSClipboard::getConstructor(ExecState* exec)
+JSValue JSClipboard::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSClipboardConstructor>(exec);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionClearData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionClearData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->clearData(exec, args);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionGetData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionGetData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->getData(exec, args);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionSetData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->setData(exec, args);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionSetDragImage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetDragImage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->setDragImage(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Clipboard* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Clipboard* object)
 {
     return getDOMObjectWrapper<JSClipboard>(exec, object);
 }
-Clipboard* toClipboard(JSC::JSValuePtr value)
+Clipboard* toClipboard(JSC::JSValue value)
 {
-    return value->isObject(&JSClipboard::s_info) ? static_cast<JSClipboard*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSClipboard::s_info) ? static_cast<JSClipboard*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index 6f5ea7fc67..a9d51ab280 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -34,43 +34,44 @@ class JSClipboard : public DOMObject {
 public:
     JSClipboard(PassRefPtr<JSC::Structure>, PassRefPtr<Clipboard>);
     virtual ~JSClipboard();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr types(JSC::ExecState*) const;
+    JSC::JSValue types(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr clearData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setDragImage(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clearData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setDragImage(JSC::ExecState*, const JSC::ArgList&);
     Clipboard* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Clipboard> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Clipboard*);
-Clipboard* toClipboard(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Clipboard*);
+Clipboard* toClipboard(JSC::JSValue);
 
 class JSClipboardPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -79,18 +80,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsClipboardPrototypeFunctionClearData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsClipboardPrototypeFunctionGetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsClipboardPrototypeFunctionSetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsClipboardPrototypeFunctionSetDragImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionClearData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionGetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetDragImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsClipboardDropEffect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardDropEffect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
index 8da1d42e51..bb7a0fa4e7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSComment)
+ASSERT_CLASS_FITS_IN_CELL(JSComment);
 
 /* Hash table */
 
@@ -68,13 +68,13 @@ public:
     JSCommentConstructor(ExecState* exec)
         : DOMObject(JSCommentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCommentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCommentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,9 +103,9 @@ static const HashTable JSCommentPrototypeTable =
 
 const ClassInfo JSCommentPrototype::s_info = { "CommentPrototype", 0, &JSCommentPrototypeTable, 0 };
 
-JSObject* JSCommentPrototype::self(ExecState* exec)
+JSObject* JSCommentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSComment>(exec);
+    return getDOMPrototype<JSComment>(exec, globalObject);
 }
 
 const ClassInfo JSComment::s_info = { "Comment", &JSCharacterData::s_info, &JSCommentTable, 0 };
@@ -115,9 +115,9 @@ JSComment::JSComment(PassRefPtr<Structure> structure, PassRefPtr<Comment> impl)
 {
 }
 
-JSObject* JSComment::createPrototype(ExecState* exec)
+JSObject* JSComment::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCommentPrototype(JSCommentPrototype::createStructure(JSCharacterDataPrototype::self(exec)));
+    return new (exec) JSCommentPrototype(JSCommentPrototype::createStructure(JSCharacterDataPrototype::self(exec, globalObject)));
 }
 
 bool JSComment::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,11 +125,11 @@ bool JSComment::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSComment, Base>(exec, &JSCommentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSComment*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSComment::getConstructor(ExecState* exec)
+JSValue JSComment::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCommentConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.h b/src/3rdparty/webkit/WebCore/generated/JSComment.h
index b0dc55b76b..802256e2cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.h
@@ -31,23 +31,24 @@ class JSComment : public JSCharacterData {
     typedef JSCharacterData Base;
 public:
     JSComment(PassRefPtr<JSC::Structure>, PassRefPtr<Comment>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCommentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCommentPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,7 +56,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
index 6adba2870d..7ae8c6e560 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSConsole)
+ASSERT_CLASS_FITS_IN_CELL(JSConsole);
 
 /* Hash table */
 
@@ -82,9 +82,9 @@ static const HashTable JSConsolePrototypeTable =
 
 const ClassInfo JSConsolePrototype::s_info = { "ConsolePrototype", 0, &JSConsolePrototypeTable, 0 };
 
-JSObject* JSConsolePrototype::self(ExecState* exec)
+JSObject* JSConsolePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSConsole>(exec);
+    return getDOMPrototype<JSConsole>(exec, globalObject);
 }
 
 bool JSConsolePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -103,12 +103,11 @@ JSConsole::JSConsole(PassRefPtr<Structure> structure, PassRefPtr<Console> impl)
 JSConsole::~JSConsole()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSConsole::createPrototype(ExecState* exec)
+JSObject* JSConsole::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSConsolePrototype(JSConsolePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSConsolePrototype(JSConsolePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSConsole::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -116,14 +115,15 @@ bool JSConsole::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSConsole, Base>(exec, &JSConsoleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSConsole*>(asObject(slot.slotBase()))->profiles(exec);
 }
 
-JSValuePtr jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -133,9 +133,10 @@ JSValuePtr jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionError(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionError(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -145,9 +146,10 @@ JSValuePtr jsConsolePrototypeFunctionError(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -157,9 +159,10 @@ JSValuePtr jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -169,9 +172,10 @@ JSValuePtr jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -181,9 +185,10 @@ JSValuePtr jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -193,9 +198,10 @@ JSValuePtr jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -205,9 +211,10 @@ JSValuePtr jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -217,22 +224,24 @@ JSValuePtr jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionAssert(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    bool condition = args.at(exec, 0)->toBoolean(exec);
+    bool condition = args.at(0).toBoolean(exec);
 
     imp->assertCondition(condition, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -242,60 +251,65 @@ JSValuePtr jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionProfile(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->profile(title, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionProfileEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->profileEnd(title, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->time(title);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionTimeEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTimeEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->timeEnd(title, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -305,9 +319,10 @@ JSValuePtr jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionGroupEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroupEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -316,13 +331,13 @@ JSValuePtr jsConsolePrototypeFunctionGroupEnd(ExecState* exec, JSObject*, JSValu
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Console* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Console* object)
 {
     return getDOMObjectWrapper<JSConsole>(exec, object);
 }
-Console* toConsole(JSC::JSValuePtr value)
+Console* toConsole(JSC::JSValue value)
 {
-    return value->isObject(&JSConsole::s_info) ? static_cast<JSConsole*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSConsole::s_info) ? static_cast<JSConsole*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.h b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
index d080c11c9d..0b7f0d53b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
@@ -34,35 +34,36 @@ class JSConsole : public DOMObject {
 public:
     JSConsole(PassRefPtr<JSC::Structure>, PassRefPtr<Console>);
     virtual ~JSConsole();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom attributes
-    JSC::JSValuePtr profiles(JSC::ExecState*) const;
+    JSC::JSValue profiles(JSC::ExecState*) const;
     Console* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Console> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Console*);
-Console* toConsole(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Console*);
+Console* toConsole(JSC::JSValue);
 
 class JSConsolePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -71,25 +72,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsConsolePrototypeFunctionDebug(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionError(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionInfo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionWarn(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionDirxml(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionTrace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionAssert(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionProfileEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionTimeEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionGroup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionGroupEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDebug(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionError(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionInfo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionWarn(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTimeEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroupEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsConsoleProfiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsConsoleProfiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
new file mode 100644
index 0000000000..12525b9a0a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "JSCoordinates.h"
+
+#include <wtf/GetPtr.h>
+
+#include "Coordinates.h"
+#include "KURL.h"
+
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCoordinates);
+
+/* Hash table */
+
+static const HashTableValue JSCoordinatesTableValues[8] =
+{
+    { "latitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLatitude, (intptr_t)0 },
+    { "longitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLongitude, (intptr_t)0 },
+    { "altitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitude, (intptr_t)0 },
+    { "accuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAccuracy, (intptr_t)0 },
+    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitudeAccuracy, (intptr_t)0 },
+    { "heading", DontDelete|ReadOnly, (intptr_t)jsCoordinatesHeading, (intptr_t)0 },
+    { "speed", DontDelete|ReadOnly, (intptr_t)jsCoordinatesSpeed, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSCoordinatesTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSCoordinatesTableValues, 0 };
+#else
+    { 16, 15, JSCoordinatesTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCoordinatesPrototypeTableValues[2] =
+{
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsCoordinatesPrototypeFunctionToString, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSCoordinatesPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCoordinatesPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSCoordinatesPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCoordinatesPrototype::s_info = { "CoordinatesPrototype", 0, &JSCoordinatesPrototypeTable, 0 };
+
+JSObject* JSCoordinatesPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCoordinates>(exec, globalObject);
+}
+
+bool JSCoordinatesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSCoordinatesPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSCoordinates::s_info = { "Coordinates", 0, &JSCoordinatesTable, 0 };
+
+JSCoordinates::JSCoordinates(PassRefPtr<Structure> structure, PassRefPtr<Coordinates> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSCoordinates::~JSCoordinates()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSCoordinates::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCoordinatesPrototype(JSCoordinatesPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSCoordinates::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCoordinates, Base>(exec, &JSCoordinatesTable, this, propertyName, slot);
+}
+
+JSValue jsCoordinatesLatitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Coordinates* imp = static_cast<Coordinates*>(static_cast<JSCoordinates*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->latitude());
+}
+
+JSValue jsCoordinatesLongitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Coordinates* imp = static_cast<Coordinates*>(static_cast<JSCoordinates*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->longitude());
+}
+
+JSValue jsCoordinatesAltitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->altitude(exec);
+}
+
+JSValue jsCoordinatesAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Coordinates* imp = static_cast<Coordinates*>(static_cast<JSCoordinates*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->accuracy());
+}
+
+JSValue jsCoordinatesAltitudeAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->altitudeAccuracy(exec);
+}
+
+JSValue jsCoordinatesHeading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->heading(exec);
+}
+
+JSValue jsCoordinatesSpeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->speed(exec);
+}
+
+JSValue JSC_HOST_CALL jsCoordinatesPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCoordinates::s_info))
+        return throwError(exec, TypeError);
+    JSCoordinates* castedThisObj = static_cast<JSCoordinates*>(asObject(thisValue));
+    Coordinates* imp = static_cast<Coordinates*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->toString());
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, Coordinates* object)
+{
+    return getDOMObjectWrapper<JSCoordinates>(exec, object);
+}
+Coordinates* toCoordinates(JSC::JSValue value)
+{
+    return value.isObject(&JSCoordinates::s_info) ? static_cast<JSCoordinates*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
new file mode 100644
index 0000000000..8a8643da29
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
@@ -0,0 +1,91 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCoordinates_h
+#define JSCoordinates_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class Coordinates;
+
+class JSCoordinates : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSCoordinates(PassRefPtr<JSC::Structure>, PassRefPtr<Coordinates>);
+    virtual ~JSCoordinates();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+
+    // Custom attributes
+    JSC::JSValue altitude(JSC::ExecState*) const;
+    JSC::JSValue altitudeAccuracy(JSC::ExecState*) const;
+    JSC::JSValue heading(JSC::ExecState*) const;
+    JSC::JSValue speed(JSC::ExecState*) const;
+    Coordinates* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<Coordinates> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, Coordinates*);
+Coordinates* toCoordinates(JSC::JSValue);
+
+class JSCoordinatesPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSCoordinatesPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsCoordinatesPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCoordinatesLatitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesLongitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesAltitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesAltitudeAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesHeading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesSpeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index 72c22e4c14..da87cd919e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCounter)
+ASSERT_CLASS_FITS_IN_CELL(JSCounter);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSCounterConstructor(ExecState* exec)
         : DOMObject(JSCounterConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCounterPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCounterPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +108,9 @@ static const HashTable JSCounterPrototypeTable =
 
 const ClassInfo JSCounterPrototype::s_info = { "CounterPrototype", 0, &JSCounterPrototypeTable, 0 };
 
-JSObject* JSCounterPrototype::self(ExecState* exec)
+JSObject* JSCounterPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCounter>(exec);
+    return getDOMPrototype<JSCounter>(exec, globalObject);
 }
 
 const ClassInfo JSCounter::s_info = { "Counter", 0, &JSCounterTable, 0 };
@@ -124,12 +124,11 @@ JSCounter::JSCounter(PassRefPtr<Structure> structure, PassRefPtr<Counter> impl)
 JSCounter::~JSCounter()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCounter::createPrototype(ExecState* exec)
+JSObject* JSCounter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCounterPrototype(JSCounterPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCounterPrototype(JSCounterPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCounter::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,40 +136,43 @@ bool JSCounter::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSCounter, Base>(exec, &JSCounterTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCounterIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(static_cast<JSCounter*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->identifier());
 }
 
-JSValuePtr jsCounterListStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterListStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(static_cast<JSCounter*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->listStyle());
 }
 
-JSValuePtr jsCounterSeparator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterSeparator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(static_cast<JSCounter*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->separator());
 }
 
-JSValuePtr jsCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCounter*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCounter::getConstructor(ExecState* exec)
+JSValue JSCounter::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCounterConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Counter* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Counter* object)
 {
     return getDOMObjectWrapper<JSCounter>(exec, object);
 }
-Counter* toCounter(JSC::JSValuePtr value)
+Counter* toCounter(JSC::JSValue value)
 {
-    return value->isObject(&JSCounter::s_info) ? static_cast<JSCounter*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCounter::s_info) ? static_cast<JSCounter*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.h b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
index 6517bc4235..ab195fe3be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
@@ -34,29 +34,30 @@ class JSCounter : public DOMObject {
 public:
     JSCounter(PassRefPtr<JSC::Structure>, PassRefPtr<Counter>);
     virtual ~JSCounter();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Counter* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Counter> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Counter*);
-Counter* toCounter(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Counter*);
+Counter* toCounter(JSC::JSValue);
 
 class JSCounterPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCounterPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,10 +65,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCounterIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCounterListStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCounterSeparator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterListStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterSeparator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
index dd8939b8e6..8b0a79e25f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
@@ -28,12 +28,10 @@
 #include <wtf/GetPtr.h>
 
 #include "DOMApplicationCache.h"
-#include "DOMStringList.h"
 #include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
-#include "JSDOMStringList.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 
@@ -44,14 +42,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMApplicationCache)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMApplicationCache);
 
 /* Hash table */
 
 static const HashTableValue JSDOMApplicationCacheTableValues[10] =
 {
     { "status", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheStatus, (intptr_t)0 },
-    { "items", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheItems, (intptr_t)0 },
     { "onchecking", DontDelete, (intptr_t)jsDOMApplicationCacheOnchecking, (intptr_t)setJSDOMApplicationCacheOnchecking },
     { "onerror", DontDelete, (intptr_t)jsDOMApplicationCacheOnerror, (intptr_t)setJSDOMApplicationCacheOnerror },
     { "onnoupdate", DontDelete, (intptr_t)jsDOMApplicationCacheOnnoupdate, (intptr_t)setJSDOMApplicationCacheOnnoupdate },
@@ -59,6 +56,7 @@ static const HashTableValue JSDOMApplicationCacheTableValues[10] =
     { "onprogress", DontDelete, (intptr_t)jsDOMApplicationCacheOnprogress, (intptr_t)setJSDOMApplicationCacheOnprogress },
     { "onupdateready", DontDelete, (intptr_t)jsDOMApplicationCacheOnupdateready, (intptr_t)setJSDOMApplicationCacheOnupdateready },
     { "oncached", DontDelete, (intptr_t)jsDOMApplicationCacheOncached, (intptr_t)setJSDOMApplicationCacheOncached },
+    { "onobsolete", DontDelete, (intptr_t)jsDOMApplicationCacheOnobsolete, (intptr_t)setJSDOMApplicationCacheOnobsolete },
     { 0, 0, 0, 0 }
 };
 
@@ -71,18 +69,16 @@ static const HashTable JSDOMApplicationCacheTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSDOMApplicationCachePrototypeTableValues[14] =
+static const HashTableValue JSDOMApplicationCachePrototypeTableValues[12] =
 {
     { "UNCACHED", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUNCACHED, (intptr_t)0 },
     { "IDLE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheIDLE, (intptr_t)0 },
     { "CHECKING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheCHECKING, (intptr_t)0 },
     { "DOWNLOADING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheDOWNLOADING, (intptr_t)0 },
     { "UPDATEREADY", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUPDATEREADY, (intptr_t)0 },
+    { "OBSOLETE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheOBSOLETE, (intptr_t)0 },
     { "update", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionUpdate, (intptr_t)0 },
     { "swapCache", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionSwapCache, (intptr_t)0 },
-    { "hasItem", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionHasItem, (intptr_t)1 },
-    { "add", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionAdd, (intptr_t)1 },
-    { "remove", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionRemove, (intptr_t)1 },
     { "addEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionAddEventListener, (intptr_t)3 },
     { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionRemoveEventListener, (intptr_t)3 },
     { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionDispatchEvent, (intptr_t)1 },
@@ -93,14 +89,14 @@ static const HashTable JSDOMApplicationCachePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSDOMApplicationCachePrototypeTableValues, 0 };
 #else
-    { 35, 31, JSDOMApplicationCachePrototypeTableValues, 0 };
+    { 33, 31, JSDOMApplicationCachePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSDOMApplicationCachePrototype::s_info = { "DOMApplicationCachePrototype", 0, &JSDOMApplicationCachePrototypeTable, 0 };
 
-JSObject* JSDOMApplicationCachePrototype::self(ExecState* exec)
+JSObject* JSDOMApplicationCachePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMApplicationCache>(exec);
+    return getDOMPrototype<JSDOMApplicationCache>(exec, globalObject);
 }
 
 bool JSDOMApplicationCachePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -119,12 +115,11 @@ JSDOMApplicationCache::JSDOMApplicationCache(PassRefPtr<Structure> structure, Pa
 JSDOMApplicationCache::~JSDOMApplicationCache()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMApplicationCache::createPrototype(ExecState* exec)
+JSObject* JSDOMApplicationCache::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMApplicationCachePrototype(JSDOMApplicationCachePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMApplicationCachePrototype(JSDOMApplicationCachePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMApplicationCache::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,159 +127,190 @@ bool JSDOMApplicationCache::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSDOMApplicationCache, Base>(exec, &JSDOMApplicationCacheTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMApplicationCacheStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->status());
 }
 
-JSValuePtr jsDOMApplicationCacheItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnchecking(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->items()));
+    if (EventListener* listener = imp->onchecking()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnchecking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onchecking())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnnoupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onnoupdate()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnnoupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOndownloading(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onnoupdate())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondownloading()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOndownloading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->ondownloading())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnupdateready(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onprogress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onupdateready()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnupdateready(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOncached(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onupdateready())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncached()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOncached(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnobsolete(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->oncached())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onobsolete()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-void JSDOMApplicationCache::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMApplicationCache::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSDOMApplicationCache, Base>(exec, propertyName, value, &JSDOMApplicationCacheTable, this, slot);
 }
 
-void setJSDOMApplicationCacheOnchecking(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnchecking(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnchecking(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMApplicationCacheOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnchecking(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnnoupdate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnnoupdate(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnnoupdate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOndownloading(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnnoupdate(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOndownloading(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOndownloading(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndownloading(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnprogress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnupdateready(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnprogress(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnupdateready(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnupdateready(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOncached(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnupdateready(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOncached(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOncached(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnobsolete(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncached(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnobsolete(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
@@ -295,9 +321,10 @@ JSValuePtr jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
@@ -308,95 +335,79 @@ JSValuePtr jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionHasItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
-        return throwError(exec, TypeError);
-    JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
-    return castedThisObj->hasItem(exec, args);
-}
-
-JSValuePtr jsDOMApplicationCachePrototypeFunctionAdd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
-        return throwError(exec, TypeError);
-    JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
-    return castedThisObj->add(exec, args);
-}
-
-JSValuePtr jsDOMApplicationCachePrototypeFunctionRemove(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
-        return throwError(exec, TypeError);
-    JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
-    return castedThisObj->remove(exec, args);
-}
-
-JSValuePtr jsDOMApplicationCachePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsDOMApplicationCacheUNCACHED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUNCACHED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsDOMApplicationCacheIDLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheIDLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsDOMApplicationCacheCHECKING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheCHECKING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsDOMApplicationCacheDOWNLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheDOWNLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsDOMApplicationCacheUPDATEREADY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUPDATEREADY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMApplicationCache* object)
+JSValue jsDOMApplicationCacheOBSOLETE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(5));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, DOMApplicationCache* object)
 {
     return getDOMObjectWrapper<JSDOMApplicationCache>(exec, object);
 }
-DOMApplicationCache* toDOMApplicationCache(JSC::JSValuePtr value)
+DOMApplicationCache* toDOMApplicationCache(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMApplicationCache::s_info) ? static_cast<JSDOMApplicationCache*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMApplicationCache::s_info) ? static_cast<JSDOMApplicationCache*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
index af5612e894..29f0c6412e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
@@ -37,13 +37,13 @@ class JSDOMApplicationCache : public DOMObject {
 public:
     JSDOMApplicationCache(PassRefPtr<JSC::Structure>, PassRefPtr<DOMApplicationCache>);
     virtual ~JSDOMApplicationCache();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -52,27 +52,25 @@ public:
 
 
     // Custom functions
-    JSC::JSValuePtr hasItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr add(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr remove(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     DOMApplicationCache* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMApplicationCache> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMApplicationCache*);
-DOMApplicationCache* toDOMApplicationCache(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMApplicationCache*);
+DOMApplicationCache* toDOMApplicationCache(JSC::JSValue);
 
 class JSDOMApplicationCachePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,39 +79,38 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionUpdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionSwapCache(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionHasItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionSwapCache(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMApplicationCacheStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheOnchecking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOndownloading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnupdateready(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOncached(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsDOMApplicationCacheStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnchecking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOndownloading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnupdateready(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOncached(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnobsolete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnobsolete(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValuePtr jsDOMApplicationCacheUNCACHED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheIDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheCHECKING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheUNCACHED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheIDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheCHECKING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOBSOLETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index 87b6ce49ed..9cbb5398a6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMCoreException)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMCoreException);
 
 /* Hash table */
 
@@ -57,7 +57,7 @@ static const HashTable JSDOMCoreExceptionTable =
 
 /* Hash table for constructor */
 
-static const HashTableValue JSDOMCoreExceptionConstructorTableValues[18] =
+static const HashTableValue JSDOMCoreExceptionConstructorTableValues[23] =
 {
     { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
     { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
@@ -76,6 +76,11 @@ static const HashTableValue JSDOMCoreExceptionConstructorTableValues[18] =
     { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
     { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
     { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,13 +96,13 @@ public:
     JSDOMCoreExceptionConstructor(ExecState* exec)
         : DOMObject(JSDOMCoreExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDOMCoreExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDOMCoreExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,7 +117,7 @@ bool JSDOMCoreExceptionConstructor::getOwnPropertySlot(ExecState* exec, const Id
 
 /* Hash table for prototype */
 
-static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[19] =
+static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[24] =
 {
     { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
     { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
@@ -131,6 +136,11 @@ static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[19] =
     { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
     { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
     { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
     { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMCoreExceptionPrototypeFunctionToString, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -139,14 +149,14 @@ static const HashTable JSDOMCoreExceptionPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 511, JSDOMCoreExceptionPrototypeTableValues, 0 };
 #else
-    { 67, 63, JSDOMCoreExceptionPrototypeTableValues, 0 };
+    { 68, 63, JSDOMCoreExceptionPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSDOMCoreExceptionPrototype::s_info = { "DOMExceptionPrototype", 0, &JSDOMCoreExceptionPrototypeTable, 0 };
 
-JSObject* JSDOMCoreExceptionPrototype::self(ExecState* exec)
+JSObject* JSDOMCoreExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMCoreException>(exec);
+    return getDOMPrototype<JSDOMCoreException>(exec, globalObject);
 }
 
 bool JSDOMCoreExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,12 +175,11 @@ JSDOMCoreException::JSDOMCoreException(PassRefPtr<Structure> structure, PassRefP
 JSDOMCoreException::~JSDOMCoreException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMCoreException::createPrototype(ExecState* exec)
+JSObject* JSDOMCoreException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMCoreExceptionPrototype(JSDOMCoreExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMCoreExceptionPrototype(JSDOMCoreExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMCoreException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -178,139 +187,168 @@ bool JSDOMCoreException::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSDOMCoreException, Base>(exec, &JSDOMCoreExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMCoreExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsDOMCoreExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsDOMCoreExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsDOMCoreExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDOMCoreException::getConstructor(ExecState* exec)
+JSValue JSDOMCoreException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDOMCoreExceptionConstructor>(exec);
 }
 
-JSValuePtr jsDOMCoreExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMCoreException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMCoreException::s_info))
         return throwError(exec, TypeError);
     JSDOMCoreException* castedThisObj = static_cast<JSDOMCoreException*>(asObject(thisValue));
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValuePtr jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValuePtr jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMCoreException* object)
+JSValue jsDOMCoreExceptionSECURITY_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(18));
+}
+
+JSValue jsDOMCoreExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(19));
+}
+
+JSValue jsDOMCoreExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(20));
+}
+
+JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(21));
+}
+
+JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(22));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, DOMCoreException* object)
 {
     return getDOMObjectWrapper<JSDOMCoreException>(exec, object);
 }
-DOMCoreException* toDOMCoreException(JSC::JSValuePtr value)
+DOMCoreException* toDOMCoreException(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMCoreException::s_info) ? static_cast<JSDOMCoreException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMCoreException::s_info) ? static_cast<JSDOMCoreException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
index e5d9b39fad..75b43284eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
@@ -34,33 +34,34 @@ class JSDOMCoreException : public DOMObject {
 public:
     JSDOMCoreException(PassRefPtr<JSC::Structure>, PassRefPtr<DOMCoreException>);
     virtual ~JSDOMCoreException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DOMCoreException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMCoreException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMCoreException*);
-DOMCoreException* toDOMCoreException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMCoreException*);
+DOMCoreException* toDOMCoreException(JSC::JSValue);
 
 class JSDOMCoreExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,32 +70,37 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMCoreExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMCoreExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionSECURITY_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 76d00a89fc..f676df6251 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -42,7 +42,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMImplementation)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMImplementation);
 
 /* Hash table */
 
@@ -78,13 +78,13 @@ public:
     JSDOMImplementationConstructor(ExecState* exec)
         : DOMObject(JSDOMImplementationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDOMImplementationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDOMImplementationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +118,9 @@ static const HashTable JSDOMImplementationPrototypeTable =
 
 const ClassInfo JSDOMImplementationPrototype::s_info = { "DOMImplementationPrototype", 0, &JSDOMImplementationPrototypeTable, 0 };
 
-JSObject* JSDOMImplementationPrototype::self(ExecState* exec)
+JSObject* JSDOMImplementationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMImplementation>(exec);
+    return getDOMPrototype<JSDOMImplementation>(exec, globalObject);
 }
 
 bool JSDOMImplementationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,12 +139,11 @@ JSDOMImplementation::JSDOMImplementation(PassRefPtr<Structure> structure, PassRe
 JSDOMImplementation::~JSDOMImplementation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMImplementation::createPrototype(ExecState* exec)
+JSObject* JSDOMImplementation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMImplementationPrototype(JSDOMImplementationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMImplementationPrototype(JSDOMImplementationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMImplementation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -152,99 +151,104 @@ bool JSDOMImplementation::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSDOMImplementation, Base>(exec, &JSDOMImplementationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDOMImplementation*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDOMImplementation::getConstructor(ExecState* exec)
+JSValue JSDOMImplementation::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDOMImplementationConstructor>(exec);
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionHasFeature(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionHasFeature(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
-    const UString& feature = args.at(exec, 0)->toString(exec);
-    const UString& version = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& feature = args.at(0).toString(exec);
+    const UString& version = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasFeature(feature, version));
+    JSC::JSValue result = jsBoolean(imp->hasFeature(feature, version));
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocumentType(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocumentType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& qualifiedName = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
-    const UString& publicId = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 1));
-    const UString& systemId = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2));
+    const UString& qualifiedName = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    const UString& publicId = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    const UString& systemId = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createDocumentType(qualifiedName, publicId, systemId, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createDocumentType(qualifiedName, publicId, systemId, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(exec, 1));
-    DocumentType* doctype = toDocumentType(args.at(exec, 2));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(1));
+    DocumentType* doctype = toDocumentType(args.at(2));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createDocument(namespaceURI, qualifiedName, doctype, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createDocument(namespaceURI, qualifiedName, doctype, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& title = args.at(exec, 0)->toString(exec);
-    const UString& media = args.at(exec, 1)->toString(exec);
+    const UString& title = args.at(0).toString(exec);
+    const UString& media = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createCSSStyleSheet(title, media, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createCSSStyleSheet(title, media, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateHTMLDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateHTMLDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
-    const UString& title = args.at(exec, 0)->toString(exec);
+    const UString& title = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createHTMLDocument(title)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createHTMLDocument(title)));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMImplementation* object)
+JSC::JSValue toJS(JSC::ExecState* exec, DOMImplementation* object)
 {
     return getDOMObjectWrapper<JSDOMImplementation>(exec, object);
 }
-DOMImplementation* toDOMImplementation(JSC::JSValuePtr value)
+DOMImplementation* toDOMImplementation(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMImplementation::s_info) ? static_cast<JSDOMImplementation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMImplementation::s_info) ? static_cast<JSDOMImplementation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
index 72fd40f076..e0177782ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
@@ -34,33 +34,34 @@ class JSDOMImplementation : public DOMObject {
 public:
     JSDOMImplementation(PassRefPtr<JSC::Structure>, PassRefPtr<DOMImplementation>);
     virtual ~JSDOMImplementation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DOMImplementation* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMImplementation> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMImplementation*);
-DOMImplementation* toDOMImplementation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMImplementation*);
+DOMImplementation* toDOMImplementation(JSC::JSValue);
 
 class JSDOMImplementationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,14 +70,14 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionHasFeature(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocumentType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateHTMLDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionHasFeature(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocumentType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateHTMLDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index 162127ce90..7050472a55 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMParser)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMParser);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSDOMParserConstructor(ExecState* exec)
         : DOMObject(JSDOMParserConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDOMParserPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDOMParserPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +117,9 @@ static const HashTable JSDOMParserPrototypeTable =
 
 const ClassInfo JSDOMParserPrototype::s_info = { "DOMParserPrototype", 0, &JSDOMParserPrototypeTable, 0 };
 
-JSObject* JSDOMParserPrototype::self(ExecState* exec)
+JSObject* JSDOMParserPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMParser>(exec);
+    return getDOMPrototype<JSDOMParser>(exec, globalObject);
 }
 
 bool JSDOMParserPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +138,11 @@ JSDOMParser::JSDOMParser(PassRefPtr<Structure> structure, PassRefPtr<DOMParser>
 JSDOMParser::~JSDOMParser()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMParser::createPrototype(ExecState* exec)
+JSObject* JSDOMParser::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMParserPrototype(JSDOMParserPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMParserPrototype(JSDOMParserPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMParser::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,36 +150,37 @@ bool JSDOMParser::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSDOMParser, Base>(exec, &JSDOMParserTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDOMParser*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDOMParser::getConstructor(ExecState* exec)
+JSValue JSDOMParser::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDOMParserConstructor>(exec);
 }
 
-JSValuePtr jsDOMParserPrototypeFunctionParseFromString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMParserPrototypeFunctionParseFromString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMParser::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMParser::s_info))
         return throwError(exec, TypeError);
     JSDOMParser* castedThisObj = static_cast<JSDOMParser*>(asObject(thisValue));
     DOMParser* imp = static_cast<DOMParser*>(castedThisObj->impl());
-    const UString& str = args.at(exec, 0)->toString(exec);
-    const UString& contentType = args.at(exec, 1)->toString(exec);
+    const UString& str = args.at(0).toString(exec);
+    const UString& contentType = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->parseFromString(str, contentType)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->parseFromString(str, contentType)));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMParser* object)
+JSC::JSValue toJS(JSC::ExecState* exec, DOMParser* object)
 {
     return getDOMObjectWrapper<JSDOMParser>(exec, object);
 }
-DOMParser* toDOMParser(JSC::JSValuePtr value)
+DOMParser* toDOMParser(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMParser::s_info) ? static_cast<JSDOMParser*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMParser::s_info) ? static_cast<JSDOMParser*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
index 0e2b6041a0..cfdbe9b2a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
@@ -34,33 +34,34 @@ class JSDOMParser : public DOMObject {
 public:
     JSDOMParser(PassRefPtr<JSC::Structure>, PassRefPtr<DOMParser>);
     virtual ~JSDOMParser();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DOMParser* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMParser> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMParser*);
-DOMParser* toDOMParser(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMParser*);
+DOMParser* toDOMParser(JSC::JSValue);
 
 class JSDOMParserPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,10 +70,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
index 48f575c482..6ea1bad7b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMSelection)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMSelection);
 
 /* Hash table */
 
@@ -49,13 +49,13 @@ static const HashTableValue JSDOMSelectionTableValues[12] =
     { "anchorOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionAnchorOffset, (intptr_t)0 },
     { "focusNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusNode, (intptr_t)0 },
     { "focusOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusOffset, (intptr_t)0 },
+    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionIsCollapsed, (intptr_t)0 },
+    { "rangeCount", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionRangeCount, (intptr_t)0 },
     { "baseNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseNode, (intptr_t)0 },
     { "baseOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseOffset, (intptr_t)0 },
     { "extentNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentNode, (intptr_t)0 },
     { "extentOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentOffset, (intptr_t)0 },
-    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionIsCollapsed, (intptr_t)0 },
     { "type", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionType, (intptr_t)0 },
-    { "rangeCount", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionRangeCount, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,15 +76,15 @@ static const HashTableValue JSDOMSelectionPrototypeTableValues[16] =
     { "deleteFromDocument", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionDeleteFromDocument, (intptr_t)0 },
     { "containsNode", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionContainsNode, (intptr_t)2 },
     { "selectAllChildren", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSelectAllChildren, (intptr_t)1 },
-    { "empty", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionEmpty, (intptr_t)0 },
-    { "setBaseAndExtent", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetBaseAndExtent, (intptr_t)4 },
-    { "setPosition", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetPosition, (intptr_t)2 },
-    { "modify", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionModify, (intptr_t)3 },
     { "extend", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionExtend, (intptr_t)2 },
     { "getRangeAt", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionGetRangeAt, (intptr_t)1 },
     { "removeAllRanges", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionRemoveAllRanges, (intptr_t)0 },
     { "addRange", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionAddRange, (intptr_t)1 },
     { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMSelectionPrototypeFunctionToString, (intptr_t)0 },
+    { "modify", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionModify, (intptr_t)3 },
+    { "setBaseAndExtent", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetBaseAndExtent, (intptr_t)4 },
+    { "setPosition", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetPosition, (intptr_t)2 },
+    { "empty", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionEmpty, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -97,9 +97,9 @@ static const HashTable JSDOMSelectionPrototypeTable =
 
 const ClassInfo JSDOMSelectionPrototype::s_info = { "DOMSelectionPrototype", 0, &JSDOMSelectionPrototypeTable, 0 };
 
-JSObject* JSDOMSelectionPrototype::self(ExecState* exec)
+JSObject* JSDOMSelectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMSelection>(exec);
+    return getDOMPrototype<JSDOMSelection>(exec, globalObject);
 }
 
 bool JSDOMSelectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,12 +118,11 @@ JSDOMSelection::JSDOMSelection(PassRefPtr<Structure> structure, PassRefPtr<DOMSe
 JSDOMSelection::~JSDOMSelection()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMSelection::createPrototype(ExecState* exec)
+JSObject* JSDOMSelection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMSelectionPrototype(JSDOMSelectionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMSelectionPrototype(JSDOMSelectionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMSelection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,90 +130,103 @@ bool JSDOMSelection::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSDOMSelection, Base>(exec, &JSDOMSelectionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMSelectionAnchorNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->anchorNode()));
 }
 
-JSValuePtr jsDOMSelectionAnchorOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->anchorOffset());
 }
 
-JSValuePtr jsDOMSelectionFocusNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->focusNode()));
 }
 
-JSValuePtr jsDOMSelectionFocusOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->focusOffset());
 }
 
-JSValuePtr jsDOMSelectionBaseNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionIsCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->baseNode()));
+    return jsBoolean(imp->isCollapsed());
 }
 
-JSValuePtr jsDOMSelectionBaseOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionRangeCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->baseOffset());
+    return jsNumber(exec, imp->rangeCount());
 }
 
-JSValuePtr jsDOMSelectionExtentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->extentNode()));
+    return toJS(exec, WTF::getPtr(imp->baseNode()));
 }
 
-JSValuePtr jsDOMSelectionExtentOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->extentOffset());
+    return jsNumber(exec, imp->baseOffset());
 }
 
-JSValuePtr jsDOMSelectionIsCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsBoolean(imp->isCollapsed());
+    return toJS(exec, WTF::getPtr(imp->extentNode()));
 }
 
-JSValuePtr jsDOMSelectionType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->type());
+    return jsNumber(exec, imp->extentOffset());
 }
 
-JSValuePtr jsDOMSelectionRangeCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->rangeCount());
+    return jsString(exec, imp->type());
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
-    int index = args.at(exec, 1)->toInt32(exec);
+    Node* node = toNode(args.at(0));
+    int index = args.at(1).toInt32(exec);
 
     imp->collapse(node, index, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -223,9 +235,10 @@ JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -234,9 +247,10 @@ JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState* exec, JSObj
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -245,163 +259,174 @@ JSValuePtr jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecState* exec, JS
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionContainsNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionContainsNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    Node* node = toNode(args.at(exec, 0));
-    bool allowPartial = args.at(exec, 1)->toBoolean(exec);
+    Node* node = toNode(args.at(0));
+    bool allowPartial = args.at(1).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->containsNode(node, allowPartial));
+    JSC::JSValue result = jsBoolean(imp->containsNode(node, allowPartial));
     return result;
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionSelectAllChildren(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSelectAllChildren(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
     imp->selectAllChildren(node, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionEmpty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionExtend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Node* node = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
-    imp->empty();
+    imp->extend(node, offset, ec);
+    setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionSetBaseAndExtent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionGetRangeAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* baseNode = toNode(args.at(exec, 0));
-    int baseOffset = args.at(exec, 1)->toInt32(exec);
-    Node* extentNode = toNode(args.at(exec, 2));
-    int extentOffset = args.at(exec, 3)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
-    imp->setBaseAndExtent(baseNode, baseOffset, extentNode, extentOffset, ec);
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getRangeAt(index, ec)));
     setDOMException(exec, ec);
-    return jsUndefined();
+    return result;
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionSetPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionRemoveAllRanges(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
 
-    imp->setPosition(node, offset, ec);
-    setDOMException(exec, ec);
+    imp->removeAllRanges();
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionModify(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionAddRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    const UString& alter = args.at(exec, 0)->toString(exec);
-    const UString& direction = args.at(exec, 1)->toString(exec);
-    const UString& granularity = args.at(exec, 2)->toString(exec);
+    Range* range = toRange(args.at(0));
 
-    imp->modify(alter, direction, granularity);
+    imp->addRange(range);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionExtend(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
 
-    imp->extend(node, offset, ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
+
+    JSC::JSValue result = jsString(exec, imp->toString());
+    return result;
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionGetRangeAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionModify(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
-
+    const UString& alter = args.at(0).toString(exec);
+    const UString& direction = args.at(1).toString(exec);
+    const UString& granularity = args.at(2).toString(exec);
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getRangeAt(index, ec)));
-    setDOMException(exec, ec);
-    return result;
+    imp->modify(alter, direction, granularity);
+    return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionRemoveAllRanges(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetBaseAndExtent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Node* baseNode = toNode(args.at(0));
+    int baseOffset = args.at(1).toInt32(exec);
+    Node* extentNode = toNode(args.at(2));
+    int extentOffset = args.at(3).toInt32(exec);
 
-    imp->removeAllRanges();
+    imp->setBaseAndExtent(baseNode, baseOffset, extentNode, extentOffset, ec);
+    setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionAddRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    Range* range = toRange(args.at(exec, 0));
+    ExceptionCode ec = 0;
+    Node* node = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
-    imp->addRange(range);
+    imp->setPosition(node, offset, ec);
+    setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionEmpty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
 
-
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
-    return result;
+    imp->empty();
+    return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMSelection* object)
+JSC::JSValue toJS(JSC::ExecState* exec, DOMSelection* object)
 {
     return getDOMObjectWrapper<JSDOMSelection>(exec, object);
 }
-DOMSelection* toDOMSelection(JSC::JSValuePtr value)
+DOMSelection* toDOMSelection(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMSelection::s_info) ? static_cast<JSDOMSelection*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMSelection::s_info) ? static_cast<JSDOMSelection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
index cfa166c999..2af8cbd088 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
@@ -34,12 +34,12 @@ class JSDOMSelection : public DOMObject {
 public:
     JSDOMSelection(PassRefPtr<JSC::Structure>, PassRefPtr<DOMSelection>);
     virtual ~JSDOMSelection();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,16 +50,17 @@ private:
     RefPtr<DOMSelection> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMSelection*);
-DOMSelection* toDOMSelection(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMSelection*);
+DOMSelection* toDOMSelection(JSC::JSValue);
 
 class JSDOMSelectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,34 +69,34 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionDeleteFromDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionContainsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionSelectAllChildren(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionEmpty(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionSetBaseAndExtent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionSetPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionModify(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionExtend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionGetRangeAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionRemoveAllRanges(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionAddRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionDeleteFromDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionContainsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSelectAllChildren(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionExtend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionGetRangeAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionRemoveAllRanges(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionAddRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionModify(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetBaseAndExtent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionEmpty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMSelectionAnchorNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionAnchorOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionFocusNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionFocusOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionBaseNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionBaseOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionExtentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionExtentOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionIsCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionRangeCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionAnchorNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionAnchorOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionFocusNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionFocusOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionIsCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionRangeCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionBaseNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionBaseOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionExtentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionExtentOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.cpp
index 729cd7db43..9be9b7844e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMStringList)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMStringList);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSDOMStringListConstructor(ExecState* exec)
         : DOMObject(JSDOMStringListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDOMStringListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDOMStringListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +108,9 @@ static const HashTable JSDOMStringListPrototypeTable =
 
 const ClassInfo JSDOMStringListPrototype::s_info = { "DOMStringListPrototype", 0, &JSDOMStringListPrototypeTable, 0 };
 
-JSObject* JSDOMStringListPrototype::self(ExecState* exec)
+JSObject* JSDOMStringListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMStringList>(exec);
+    return getDOMPrototype<JSDOMStringList>(exec, globalObject);
 }
 
 bool JSDOMStringListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,12 +129,11 @@ JSDOMStringList::JSDOMStringList(PassRefPtr<Structure> structure, PassRefPtr<DOM
 JSDOMStringList::~JSDOMStringList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMStringList::createPrototype(ExecState* exec)
+JSObject* JSDOMStringList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMStringListPrototype(JSDOMStringListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMStringListPrototype(JSDOMStringListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMStringList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -157,13 +156,14 @@ bool JSDOMStringList::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsDOMStringListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMStringListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMStringList* imp = static_cast<DOMStringList*>(static_cast<JSDOMStringList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsDOMStringListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMStringListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDOMStringList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -174,39 +174,41 @@ void JSDOMStringList::getPropertyNames(ExecState* exec, PropertyNameArray& prope
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSDOMStringList::getConstructor(ExecState* exec)
+JSValue JSDOMStringList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDOMStringListConstructor>(exec);
 }
 
-JSValuePtr jsDOMStringListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMStringListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMStringList::s_info))
         return throwError(exec, TypeError);
     JSDOMStringList* castedThisObj = static_cast<JSDOMStringList*>(asObject(thisValue));
     return castedThisObj->item(exec, args);
 }
 
-JSValuePtr jsDOMStringListPrototypeFunctionContains(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMStringListPrototypeFunctionContains(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMStringList::s_info))
         return throwError(exec, TypeError);
     JSDOMStringList* castedThisObj = static_cast<JSDOMStringList*>(asObject(thisValue));
     DOMStringList* imp = static_cast<DOMStringList*>(castedThisObj->impl());
-    const UString& str = args.at(exec, 0)->toString(exec);
+    const UString& str = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->contains(str));
+    JSC::JSValue result = jsBoolean(imp->contains(str));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMStringList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, DOMStringList* object)
 {
     return getDOMObjectWrapper<JSDOMStringList>(exec, object);
 }
-DOMStringList* toDOMStringList(JSC::JSValuePtr value)
+DOMStringList* toDOMStringList(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMStringList::s_info) ? static_cast<JSDOMStringList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMStringList::s_info) ? static_cast<JSDOMStringList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.h b/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.h
index a08786b1b1..4d222c8d66 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.h
@@ -34,39 +34,40 @@ class JSDOMStringList : public DOMObject {
 public:
     JSDOMStringList(PassRefPtr<JSC::Structure>, PassRefPtr<DOMStringList>);
     virtual ~JSDOMStringList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr item(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue item(JSC::ExecState*, const JSC::ArgList&);
     DOMStringList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMStringList> m_impl;
-    JSC::JSValuePtr getByIndex(JSC::ExecState*, unsigned index);
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMStringList*);
-DOMStringList* toDOMStringList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMStringList*);
+DOMStringList* toDOMStringList(JSC::JSValue);
 
 class JSDOMStringListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,12 +76,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMStringListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMStringListPrototypeFunctionContains(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMStringListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMStringListPrototypeFunctionContains(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMStringListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMStringListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMStringListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMStringListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index 10b6c3b1a0..bf0809b1d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -35,8 +35,8 @@
 #include "Database.h"
 #include "Document.h"
 #include "Element.h"
+#include "Event.h"
 #include "EventListener.h"
-#include "History.h"
 #include "JSAttr.h"
 #include "JSBarInfo.h"
 #include "JSCDATASection.h"
@@ -57,6 +57,8 @@
 #include "JSCSSVariablesRule.h"
 #include "JSCanvasRenderingContext2D.h"
 #include "JSCharacterData.h"
+#include "JSClientRect.h"
+#include "JSClientRectList.h"
 #include "JSClipboard.h"
 #include "JSComment.h"
 #include "JSConsole.h"
@@ -145,9 +147,7 @@
 #include "JSHTMLTitleElement.h"
 #include "JSHTMLUListElement.h"
 #include "JSHTMLVideoElement.h"
-#include "JSHistory.h"
 #include "JSKeyboardEvent.h"
-#include "JSLocation.h"
 #include "JSMediaError.h"
 #include "JSMediaList.h"
 #include "JSMessageEvent.h"
@@ -195,9 +195,13 @@
 #include "JSWebKitAnimationEvent.h"
 #include "JSWebKitCSSKeyframeRule.h"
 #include "JSWebKitCSSKeyframesRule.h"
+#include "JSWebKitCSSMatrix.h"
 #include "JSWebKitCSSTransformValue.h"
+#include "JSWebKitPoint.h"
 #include "JSWebKitTransitionEvent.h"
 #include "JSWheelEvent.h"
+#include "JSWorker.h"
+#include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestException.h"
 #include "JSXMLHttpRequestUpload.h"
 #include "JSXMLSerializer.h"
@@ -205,10 +209,11 @@
 #include "JSXPathException.h"
 #include "JSXPathResult.h"
 #include "KURL.h"
-#include "Location.h"
 #include "Navigator.h"
+#include "RegisteredEventListener.h"
 #include "Screen.h"
 #include "Storage.h"
+#include "WebKitPoint.h"
 
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
@@ -218,11 +223,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[227] =
+static const HashTableValue JSDOMWindowTableValues[271] =
 {
     { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
     { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
@@ -235,6 +240,8 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "navigator", DontDelete, (intptr_t)jsDOMWindowNavigator, (intptr_t)setJSDOMWindowNavigator },
     { "clientInformation", DontDelete, (intptr_t)jsDOMWindowClientInformation, (intptr_t)setJSDOMWindowClientInformation },
     { "location", DontDelete, (intptr_t)jsDOMWindowLocation, (intptr_t)setJSDOMWindowLocation },
+    { "event", DontDelete, (intptr_t)jsDOMWindowEvent, (intptr_t)setJSDOMWindowEvent },
+    { "crypto", DontDelete|ReadOnly, (intptr_t)jsDOMWindowCrypto, (intptr_t)0 },
     { "frameElement", DontDelete|ReadOnly, (intptr_t)jsDOMWindowFrameElement, (intptr_t)0 },
     { "offscreenBuffering", DontDelete, (intptr_t)jsDOMWindowOffscreenBuffering, (intptr_t)setJSDOMWindowOffscreenBuffering },
     { "outerHeight", DontDelete, (intptr_t)jsDOMWindowOuterHeight, (intptr_t)setJSDOMWindowOuterHeight },
@@ -268,33 +275,66 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "localStorage", DontDelete|ReadOnly, (intptr_t)jsDOMWindowLocalStorage, (intptr_t)0 },
     { "console", DontDelete, (intptr_t)jsDOMWindowConsole, (intptr_t)setJSDOMWindowConsole },
     { "onabort", DontDelete, (intptr_t)jsDOMWindowOnabort, (intptr_t)setJSDOMWindowOnabort },
+    { "onbeforeunload", DontDelete, (intptr_t)jsDOMWindowOnbeforeunload, (intptr_t)setJSDOMWindowOnbeforeunload },
     { "onblur", DontDelete, (intptr_t)jsDOMWindowOnblur, (intptr_t)setJSDOMWindowOnblur },
+    { "oncanplay", DontDelete, (intptr_t)jsDOMWindowOncanplay, (intptr_t)setJSDOMWindowOncanplay },
+    { "oncanplaythrough", DontDelete, (intptr_t)jsDOMWindowOncanplaythrough, (intptr_t)setJSDOMWindowOncanplaythrough },
     { "onchange", DontDelete, (intptr_t)jsDOMWindowOnchange, (intptr_t)setJSDOMWindowOnchange },
     { "onclick", DontDelete, (intptr_t)jsDOMWindowOnclick, (intptr_t)setJSDOMWindowOnclick },
+    { "oncontextmenu", DontDelete, (intptr_t)jsDOMWindowOncontextmenu, (intptr_t)setJSDOMWindowOncontextmenu },
     { "ondblclick", DontDelete, (intptr_t)jsDOMWindowOndblclick, (intptr_t)setJSDOMWindowOndblclick },
+    { "ondrag", DontDelete, (intptr_t)jsDOMWindowOndrag, (intptr_t)setJSDOMWindowOndrag },
+    { "ondragend", DontDelete, (intptr_t)jsDOMWindowOndragend, (intptr_t)setJSDOMWindowOndragend },
+    { "ondragenter", DontDelete, (intptr_t)jsDOMWindowOndragenter, (intptr_t)setJSDOMWindowOndragenter },
+    { "ondragleave", DontDelete, (intptr_t)jsDOMWindowOndragleave, (intptr_t)setJSDOMWindowOndragleave },
+    { "ondragover", DontDelete, (intptr_t)jsDOMWindowOndragover, (intptr_t)setJSDOMWindowOndragover },
+    { "ondragstart", DontDelete, (intptr_t)jsDOMWindowOndragstart, (intptr_t)setJSDOMWindowOndragstart },
+    { "ondrop", DontDelete, (intptr_t)jsDOMWindowOndrop, (intptr_t)setJSDOMWindowOndrop },
+    { "ondurationchange", DontDelete, (intptr_t)jsDOMWindowOndurationchange, (intptr_t)setJSDOMWindowOndurationchange },
+    { "onemptied", DontDelete, (intptr_t)jsDOMWindowOnemptied, (intptr_t)setJSDOMWindowOnemptied },
+    { "onended", DontDelete, (intptr_t)jsDOMWindowOnended, (intptr_t)setJSDOMWindowOnended },
     { "onerror", DontDelete, (intptr_t)jsDOMWindowOnerror, (intptr_t)setJSDOMWindowOnerror },
     { "onfocus", DontDelete, (intptr_t)jsDOMWindowOnfocus, (intptr_t)setJSDOMWindowOnfocus },
+    { "oninput", DontDelete, (intptr_t)jsDOMWindowOninput, (intptr_t)setJSDOMWindowOninput },
     { "onkeydown", DontDelete, (intptr_t)jsDOMWindowOnkeydown, (intptr_t)setJSDOMWindowOnkeydown },
     { "onkeypress", DontDelete, (intptr_t)jsDOMWindowOnkeypress, (intptr_t)setJSDOMWindowOnkeypress },
     { "onkeyup", DontDelete, (intptr_t)jsDOMWindowOnkeyup, (intptr_t)setJSDOMWindowOnkeyup },
     { "onload", DontDelete, (intptr_t)jsDOMWindowOnload, (intptr_t)setJSDOMWindowOnload },
+    { "onloadeddata", DontDelete, (intptr_t)jsDOMWindowOnloadeddata, (intptr_t)setJSDOMWindowOnloadeddata },
+    { "onloadedmetadata", DontDelete, (intptr_t)jsDOMWindowOnloadedmetadata, (intptr_t)setJSDOMWindowOnloadedmetadata },
+    { "onloadstart", DontDelete, (intptr_t)jsDOMWindowOnloadstart, (intptr_t)setJSDOMWindowOnloadstart },
+    { "onmessage", DontDelete, (intptr_t)jsDOMWindowOnmessage, (intptr_t)setJSDOMWindowOnmessage },
     { "onmousedown", DontDelete, (intptr_t)jsDOMWindowOnmousedown, (intptr_t)setJSDOMWindowOnmousedown },
     { "onmousemove", DontDelete, (intptr_t)jsDOMWindowOnmousemove, (intptr_t)setJSDOMWindowOnmousemove },
     { "onmouseout", DontDelete, (intptr_t)jsDOMWindowOnmouseout, (intptr_t)setJSDOMWindowOnmouseout },
     { "onmouseover", DontDelete, (intptr_t)jsDOMWindowOnmouseover, (intptr_t)setJSDOMWindowOnmouseover },
     { "onmouseup", DontDelete, (intptr_t)jsDOMWindowOnmouseup, (intptr_t)setJSDOMWindowOnmouseup },
     { "onmousewheel", DontDelete, (intptr_t)jsDOMWindowOnmousewheel, (intptr_t)setJSDOMWindowOnmousewheel },
-    { "onreset", DontDelete, (intptr_t)jsDOMWindowOnreset, (intptr_t)setJSDOMWindowOnreset },
+    { "onoffline", DontDelete, (intptr_t)jsDOMWindowOnoffline, (intptr_t)setJSDOMWindowOnoffline },
+    { "ononline", DontDelete, (intptr_t)jsDOMWindowOnonline, (intptr_t)setJSDOMWindowOnonline },
+    { "onpause", DontDelete, (intptr_t)jsDOMWindowOnpause, (intptr_t)setJSDOMWindowOnpause },
+    { "onplay", DontDelete, (intptr_t)jsDOMWindowOnplay, (intptr_t)setJSDOMWindowOnplay },
+    { "onplaying", DontDelete, (intptr_t)jsDOMWindowOnplaying, (intptr_t)setJSDOMWindowOnplaying },
+    { "onprogress", DontDelete, (intptr_t)jsDOMWindowOnprogress, (intptr_t)setJSDOMWindowOnprogress },
+    { "onratechange", DontDelete, (intptr_t)jsDOMWindowOnratechange, (intptr_t)setJSDOMWindowOnratechange },
     { "onresize", DontDelete, (intptr_t)jsDOMWindowOnresize, (intptr_t)setJSDOMWindowOnresize },
     { "onscroll", DontDelete, (intptr_t)jsDOMWindowOnscroll, (intptr_t)setJSDOMWindowOnscroll },
-    { "onsearch", DontDelete, (intptr_t)jsDOMWindowOnsearch, (intptr_t)setJSDOMWindowOnsearch },
+    { "onseeked", DontDelete, (intptr_t)jsDOMWindowOnseeked, (intptr_t)setJSDOMWindowOnseeked },
+    { "onseeking", DontDelete, (intptr_t)jsDOMWindowOnseeking, (intptr_t)setJSDOMWindowOnseeking },
     { "onselect", DontDelete, (intptr_t)jsDOMWindowOnselect, (intptr_t)setJSDOMWindowOnselect },
+    { "onstalled", DontDelete, (intptr_t)jsDOMWindowOnstalled, (intptr_t)setJSDOMWindowOnstalled },
+    { "onstorage", DontDelete, (intptr_t)jsDOMWindowOnstorage, (intptr_t)setJSDOMWindowOnstorage },
     { "onsubmit", DontDelete, (intptr_t)jsDOMWindowOnsubmit, (intptr_t)setJSDOMWindowOnsubmit },
+    { "onsuspend", DontDelete, (intptr_t)jsDOMWindowOnsuspend, (intptr_t)setJSDOMWindowOnsuspend },
+    { "ontimeupdate", DontDelete, (intptr_t)jsDOMWindowOntimeupdate, (intptr_t)setJSDOMWindowOntimeupdate },
     { "onunload", DontDelete, (intptr_t)jsDOMWindowOnunload, (intptr_t)setJSDOMWindowOnunload },
-    { "onbeforeunload", DontDelete, (intptr_t)jsDOMWindowOnbeforeunload, (intptr_t)setJSDOMWindowOnbeforeunload },
-    { "onwebkitanimationstart", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationstart, (intptr_t)setJSDOMWindowOnwebkitanimationstart },
-    { "onwebkitanimationiteration", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationiteration, (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
+    { "onvolumechange", DontDelete, (intptr_t)jsDOMWindowOnvolumechange, (intptr_t)setJSDOMWindowOnvolumechange },
+    { "onwaiting", DontDelete, (intptr_t)jsDOMWindowOnwaiting, (intptr_t)setJSDOMWindowOnwaiting },
+    { "onreset", DontDelete, (intptr_t)jsDOMWindowOnreset, (intptr_t)setJSDOMWindowOnreset },
+    { "onsearch", DontDelete, (intptr_t)jsDOMWindowOnsearch, (intptr_t)setJSDOMWindowOnsearch },
     { "onwebkitanimationend", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationend, (intptr_t)setJSDOMWindowOnwebkitanimationend },
+    { "onwebkitanimationiteration", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationiteration, (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
+    { "onwebkitanimationstart", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationstart, (intptr_t)setJSDOMWindowOnwebkitanimationstart },
     { "onwebkittransitionend", DontDelete, (intptr_t)jsDOMWindowOnwebkittransitionend, (intptr_t)setJSDOMWindowOnwebkittransitionend },
     { "StyleSheet", DontDelete, (intptr_t)jsDOMWindowStyleSheetConstructor, (intptr_t)setJSDOMWindowStyleSheetConstructor },
     { "CSSStyleSheet", DontDelete, (intptr_t)jsDOMWindowCSSStyleSheetConstructor, (intptr_t)setJSDOMWindowCSSStyleSheetConstructor },
@@ -395,6 +435,8 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "HTMLTitleElement", DontDelete, (intptr_t)jsDOMWindowHTMLTitleElementConstructor, (intptr_t)setJSDOMWindowHTMLTitleElementConstructor },
     { "HTMLUListElement", DontDelete, (intptr_t)jsDOMWindowHTMLUListElementConstructor, (intptr_t)setJSDOMWindowHTMLUListElementConstructor },
     { "HTMLCollection", DontDelete, (intptr_t)jsDOMWindowHTMLCollectionConstructor, (intptr_t)setJSDOMWindowHTMLCollectionConstructor },
+    { "Image", DontDelete, (intptr_t)jsDOMWindowImageConstructor, (intptr_t)setJSDOMWindowImageConstructor },
+    { "Option", DontDelete, (intptr_t)jsDOMWindowOptionConstructor, (intptr_t)setJSDOMWindowOptionConstructor },
     { "CanvasRenderingContext2D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext2DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
     { "TextMetrics", DontDelete, (intptr_t)jsDOMWindowTextMetricsConstructor, (intptr_t)setJSDOMWindowTextMetricsConstructor },
     { "Event", DontDelete, (intptr_t)jsDOMWindowEventConstructor, (intptr_t)setJSDOMWindowEventConstructor },
@@ -412,6 +454,8 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "EventException", DontDelete, (intptr_t)jsDOMWindowEventExceptionConstructor, (intptr_t)setJSDOMWindowEventExceptionConstructor },
     { "WebKitCSSKeyframeRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframeRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframeRuleConstructor },
     { "WebKitCSSKeyframesRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframesRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframesRuleConstructor },
+    { "WebKitCSSMatrix", DontDelete, (intptr_t)jsDOMWindowWebKitCSSMatrixConstructor, (intptr_t)setJSDOMWindowWebKitCSSMatrixConstructor },
+    { "WebKitPoint", DontDelete, (intptr_t)jsDOMWindowWebKitPointConstructor, (intptr_t)setJSDOMWindowWebKitPointConstructor },
     { "Clipboard", DontDelete, (intptr_t)jsDOMWindowClipboardConstructor, (intptr_t)setJSDOMWindowClipboardConstructor },
     { "File", DontDelete, (intptr_t)jsDOMWindowFileConstructor, (intptr_t)setJSDOMWindowFileConstructor },
     { "FileList", DontDelete, (intptr_t)jsDOMWindowFileListConstructor, (intptr_t)setJSDOMWindowFileListConstructor },
@@ -421,15 +465,22 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "XMLDocument", DontDelete, (intptr_t)jsDOMWindowXMLDocumentConstructor, (intptr_t)setJSDOMWindowXMLDocumentConstructor },
     { "DOMParser", DontDelete, (intptr_t)jsDOMWindowDOMParserConstructor, (intptr_t)setJSDOMWindowDOMParserConstructor },
     { "XMLSerializer", DontDelete, (intptr_t)jsDOMWindowXMLSerializerConstructor, (intptr_t)setJSDOMWindowXMLSerializerConstructor },
+    { "XMLHttpRequest", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestConstructor },
     { "XMLHttpRequestUpload", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestUploadConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestUploadConstructor },
     { "XMLHttpRequestException", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestExceptionConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestExceptionConstructor },
+    { "Worker", DontDelete, (intptr_t)jsDOMWindowWorkerConstructor, (intptr_t)setJSDOMWindowWorkerConstructor },
     { "Plugin", DontDelete, (intptr_t)jsDOMWindowPluginConstructor, (intptr_t)setJSDOMWindowPluginConstructor },
     { "PluginArray", DontDelete, (intptr_t)jsDOMWindowPluginArrayConstructor, (intptr_t)setJSDOMWindowPluginArrayConstructor },
     { "MimeType", DontDelete, (intptr_t)jsDOMWindowMimeTypeConstructor, (intptr_t)setJSDOMWindowMimeTypeConstructor },
     { "MimeTypeArray", DontDelete, (intptr_t)jsDOMWindowMimeTypeArrayConstructor, (intptr_t)setJSDOMWindowMimeTypeArrayConstructor },
+    { "ClientRect", DontDelete, (intptr_t)jsDOMWindowClientRectConstructor, (intptr_t)setJSDOMWindowClientRectConstructor },
+    { "ClientRectList", DontDelete, (intptr_t)jsDOMWindowClientRectListConstructor, (intptr_t)setJSDOMWindowClientRectListConstructor },
     { "Storage", DontDelete, (intptr_t)jsDOMWindowStorageConstructor, (intptr_t)setJSDOMWindowStorageConstructor },
     { "StorageEvent", DontDelete, (intptr_t)jsDOMWindowStorageEventConstructor, (intptr_t)setJSDOMWindowStorageEventConstructor },
 #if ENABLE(VIDEO)
+    { "Audio", DontDelete, (intptr_t)jsDOMWindowAudioConstructor, (intptr_t)setJSDOMWindowAudioConstructor },
+#endif
+#if ENABLE(VIDEO)
     { "HTMLAudioElement", DontDelete, (intptr_t)jsDOMWindowHTMLAudioElementConstructor, (intptr_t)setJSDOMWindowHTMLAudioElementConstructor },
 #endif
 #if ENABLE(VIDEO)
@@ -465,12 +516,12 @@ static const HashTable JSDOMWindowTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 32767, JSDOMWindowTableValues, 0 };
 #else
-    { 553, 511, JSDOMWindowTableValues, 0 };
+    { 1062, 1023, JSDOMWindowTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
+static const HashTableValue JSDOMWindowPrototypeTableValues[37] =
 {
     { "getSelection", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetSelection, (intptr_t)0 },
     { "focus", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionFocus, (intptr_t)0 },
@@ -478,6 +529,8 @@ static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
     { "close", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClose, (intptr_t)0 },
     { "print", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrint, (intptr_t)0 },
     { "stop", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionStop, (intptr_t)0 },
+    { "open", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpen, (intptr_t)3 },
+    { "showModalDialog", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionShowModalDialog, (intptr_t)3 },
     { "alert", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAlert, (intptr_t)1 },
     { "confirm", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionConfirm, (intptr_t)1 },
     { "prompt", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrompt, (intptr_t)2 },
@@ -491,6 +544,8 @@ static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
     { "resizeTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionResizeTo, (intptr_t)2 },
     { "getComputedStyle", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetComputedStyle, (intptr_t)2 },
     { "getMatchedCSSRules", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetMatchedCSSRules, (intptr_t)3 },
+    { "webkitConvertPointFromPageToNode", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode, (intptr_t)2 },
+    { "webkitConvertPointFromNodeToPage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage, (intptr_t)2 },
     { "openDatabase", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpenDatabase, (intptr_t)4 },
     { "postMessage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPostMessage, (intptr_t)3 },
     { "setTimeout", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionSetTimeout, (intptr_t)2 },
@@ -501,14 +556,17 @@ static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
     { "btoa", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionBtoa, (intptr_t)1 },
     { "addEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAddEventListener, (intptr_t)3 },
     { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionRemoveEventListener, (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "captureEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionCaptureEvents, (intptr_t)0 },
+    { "releaseEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionReleaseEvents, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSDOMWindowPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 511, JSDOMWindowPrototypeTableValues, 0 };
+    { 1023, JSDOMWindowPrototypeTableValues, 0 };
 #else
-    { 69, 63, JSDOMWindowPrototypeTableValues, 0 };
+    { 134, 127, JSDOMWindowPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSDOMWindowPrototype::s_info = { "DOMWindowPrototype", 0, &JSDOMWindowPrototypeTable, 0 };
@@ -530,6 +588,11 @@ JSDOMWindow::JSDOMWindow(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow>
 {
 }
 
+JSDOMWindow::~JSDOMWindow()
+{
+    invalidateEventListeners(impl()->eventListeners());
+}
+
 bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (customGetOwnPropertySlot(exec, propertyName, slot))
@@ -537,91 +600,112 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSDOMWindow, Base>(exec, &JSDOMWindowTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->screen()));
 }
 
-JSValuePtr jsDOMWindowHistory(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHistory(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->history()));
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->history(exec);
 }
 
-JSValuePtr jsDOMWindowLocationbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocationbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->locationbar()));
 }
 
-JSValuePtr jsDOMWindowMenubar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMenubar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->menubar()));
 }
 
-JSValuePtr jsDOMWindowPersonalbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPersonalbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->personalbar()));
 }
 
-JSValuePtr jsDOMWindowScrollbars(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollbars(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->scrollbars()));
 }
 
-JSValuePtr jsDOMWindowStatusbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatusbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->statusbar()));
 }
 
-JSValuePtr jsDOMWindowToolbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowToolbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->toolbar()));
 }
 
-JSValuePtr jsDOMWindowNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->navigator()));
 }
 
-JSValuePtr jsDOMWindowClientInformation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientInformation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->clientInformation()));
 }
 
-JSValuePtr jsDOMWindowLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->location()));
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->location(exec);
+}
+
+JSValue jsDOMWindowEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->event(exec);
 }
 
-JSValuePtr jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCrypto(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->crypto(exec);
+}
+
+JSValue jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
@@ -629,2163 +713,3267 @@ JSValuePtr jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const Pro
     return checkNodeSecurity(exec, imp->frameElement()) ? toJS(exec, WTF::getPtr(imp->frameElement())) : jsUndefined();
 }
 
-JSValuePtr jsDOMWindowOffscreenBuffering(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOffscreenBuffering(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->offscreenBuffering());
 }
 
-JSValuePtr jsDOMWindowOuterHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->outerHeight());
 }
 
-JSValuePtr jsDOMWindowOuterWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->outerWidth());
 }
 
-JSValuePtr jsDOMWindowInnerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->innerHeight());
 }
 
-JSValuePtr jsDOMWindowInnerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->innerWidth());
 }
 
-JSValuePtr jsDOMWindowScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenX());
 }
 
-JSValuePtr jsDOMWindowScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenY());
 }
 
-JSValuePtr jsDOMWindowScreenLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenLeft());
 }
 
-JSValuePtr jsDOMWindowScreenTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenTop());
 }
 
-JSValuePtr jsDOMWindowScrollX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollX());
 }
 
-JSValuePtr jsDOMWindowScrollY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollY());
 }
 
-JSValuePtr jsDOMWindowPageXOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageXOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageXOffset());
 }
 
-JSValuePtr jsDOMWindowPageYOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageYOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageYOffset());
 }
 
-JSValuePtr jsDOMWindowClosed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClosed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->closed());
 }
 
-JSValuePtr jsDOMWindowLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsDOMWindowName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsDOMWindowStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->status());
 }
 
-JSValuePtr jsDOMWindowDefaultStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultStatus());
 }
 
-JSValuePtr jsDOMWindowDefaultstatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultstatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultstatus());
 }
 
-JSValuePtr jsDOMWindowSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->self()));
 }
 
-JSValuePtr jsDOMWindowWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->window()));
 }
 
-JSValuePtr jsDOMWindowFrames(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFrames(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->frames()));
 }
 
-JSValuePtr jsDOMWindowOpener(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOpener(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->opener()));
 }
 
-JSValuePtr jsDOMWindowParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parent()));
 }
 
-JSValuePtr jsDOMWindowTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->top()));
 }
 
-JSValuePtr jsDOMWindowDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->document()));
 }
 
-JSValuePtr jsDOMWindowDevicePixelRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDevicePixelRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->devicePixelRatio());
 }
 
-JSValuePtr jsDOMWindowApplicationCache(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowApplicationCache(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->applicationCache()));
 }
 
-JSValuePtr jsDOMWindowSessionStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSessionStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sessionStorage()));
 }
 
-JSValuePtr jsDOMWindowLocalStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocalStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->localStorage()));
 }
 
-JSValuePtr jsDOMWindowConsole(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowConsole(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->console()));
 }
 
-JSValuePtr jsDOMWindowOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforeunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onblur()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOncanplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncanplay()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOncanplaythrough(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncanplaythrough()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncontextmenu()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondblclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrag()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragenter()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragleave()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrop()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndurationchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondurationchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnemptied(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onemptied()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnended(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onended()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onfocus()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oninput()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeydown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeypress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeyup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnloadeddata(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onloadeddata()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnloadedmetadata(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onloadedmetadata()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onloadstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousedown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousemove()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseout()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onblur())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onchange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousewheel()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onoffline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondblclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ononline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpause(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onpause()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onfocus())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onplay()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplaying(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeydown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onplaying()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeypress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnratechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeyup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onratechange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onresize()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousedown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onscroll()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnseeked(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousemove())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onseeked()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnseeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseout())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onseeking()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onselect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnstalled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onstalled()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousewheel())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onstorage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onreset())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onsubmit()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsuspend(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onresize())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onsuspend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOntimeupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onscroll())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ontimeupdate()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsearch())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnvolumechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselect())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onvolumechange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwaiting(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsubmit())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onwaiting()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onreset()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforeunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onsearch()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkitanimationstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationend(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkitanimationstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onwebkitanimationend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkitanimationiteration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationiteration(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkitanimationiteration())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onwebkitanimationiteration()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkitanimationend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkitanimationend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onwebkitanimationstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkittransitionend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkittransitionend(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkittransitionend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onwebkittransitionend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStyleSheet::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSStyleSheet::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSValue::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSPrimitiveValue::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSValueList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitCSSTransformValue::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSCharsetRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSFontFaceRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSImportRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSMediaRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSPageRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSStyleRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSVariablesRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSVariablesDeclaration::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSStyleDeclaration::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMediaList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCounter::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSRuleList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSRect::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStyleSheetList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDOMExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDOMCoreException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDOMStringListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMStringListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDOMStringList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDOMImplementation::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocumentFragment::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocument::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNode::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNodeList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNamedNodeMap::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCharacterData::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSAttr::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSText::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSComment::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCDATASection::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocumentType::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNotation::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEntity::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEntityReference::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSProcessingInstruction::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDocument::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAnchorElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAppletElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAreaElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBRElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBaseElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBaseFontElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBlockquoteElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBodyElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLButtonElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLCanvasElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDListElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDirectoryElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDivElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLEmbedElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFieldSetElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFontElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFormElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFrameElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFrameSetElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHRElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHeadElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHeadingElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHtmlElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLIFrameElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLImageElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLInputElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLIsIndexElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLIElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLabelElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLegendElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLinkElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMapElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMarqueeElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMenuElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMetaElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLModElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLOListElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLObjectElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLOptGroupElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLOptionElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLParagraphElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLParamElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLPreElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLQuoteElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLScriptElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLSelectElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLStyleElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableCaptionElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableCellElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableColElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableRowElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableSectionElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTextAreaElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTitleElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLUListElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLCollection::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowImageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->image(exec);
+}
+
+JSValue jsDOMWindowOptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->option(exec);
+}
+
+JSValue jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCanvasRenderingContext2D::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSTextMetrics::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSKeyboardEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMouseEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMutationEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSOverflowEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSProgressEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSTextEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSUIEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitAnimationEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitTransitionEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWheelEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMessageEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEventException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitCSSKeyframeRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitCSSKeyframesRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->webKitCSSMatrix(exec);
+}
+
+JSValue jsDOMWindowWebKitPointConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->webKitPoint(exec);
+}
+
+JSValue jsDOMWindowClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSClipboard::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSFile::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSFileList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNodeFilter::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSRange::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSRangeException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocument::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDOMParser::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXMLSerializer::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->xmlHttpRequest(exec);
+}
+
+JSValue jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXMLHttpRequestUpload::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXMLHttpRequestException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->worker(exec);
+}
+
+JSValue jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSPlugin::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSPluginArray::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMimeType::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMimeTypeArray::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
+    return JSClientRect::getConstructor(exec);
+}
+
+JSValue jsDOMWindowClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
+    return JSClientRectList::getConstructor(exec);
+}
+
+JSValue jsDOMWindowStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStorage::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStorageEvent::getConstructor(exec);
 }
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAudioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->audio(exec);
+}
+#endif
+
+#if ENABLE(VIDEO)
+JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAudioElement::getConstructor(exec);
 }
 #endif
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMediaElement::getConstructor(exec);
 }
 #endif
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLVideoElement::getConstructor(exec);
 }
 #endif
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMediaError::getConstructor(exec);
 }
 #endif
 
-JSValuePtr jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXPathEvaluator::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXPathResult::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXPathException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGAngle::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGColor::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGGradientElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGLength::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGMarkerElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGPaint::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGPathSeg::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGPreserveAspectRatio::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGRenderingIntent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGTextContentElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGTextPathElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGTransform::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGUnitTypes::getConstructor(exec);
 }
 
-void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
     lookupPut<JSDOMWindow, Base>(exec, propertyName, value, &JSDOMWindowTable, this, slot);
 }
 
-void setJSDOMWindowLocationbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowLocationbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "locationbar"), value);
 }
 
-void setJSDOMWindowMenubar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMenubar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "menubar"), value);
 }
 
-void setJSDOMWindowPersonalbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowPersonalbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "personalbar"), value);
 }
 
-void setJSDOMWindowScrollbars(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScrollbars(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "scrollbars"), value);
 }
 
-void setJSDOMWindowStatusbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStatusbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "statusbar"), value);
 }
 
-void setJSDOMWindowToolbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowToolbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "toolbar"), value);
 }
 
-void setJSDOMWindowNavigator(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNavigator(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "navigator"), value);
 }
 
-void setJSDOMWindowClientInformation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowClientInformation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "clientInformation"), value);
 }
 
-void setJSDOMWindowLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSDOMWindow*>(thisObject)->setLocation(exec, value);
 }
 
-void setJSDOMWindowOffscreenBuffering(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEvent(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in object
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "event"), value);
+}
+
+void setJSDOMWindowOffscreenBuffering(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "offscreenBuffering"), value);
 }
 
-void setJSDOMWindowOuterHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOuterHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "outerHeight"), value);
 }
 
-void setJSDOMWindowOuterWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOuterWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "outerWidth"), value);
 }
 
-void setJSDOMWindowInnerHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowInnerHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "innerHeight"), value);
 }
 
-void setJSDOMWindowInnerWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowInnerWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "innerWidth"), value);
 }
 
-void setJSDOMWindowScreenX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenX"), value);
 }
 
-void setJSDOMWindowScreenY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenY"), value);
 }
 
-void setJSDOMWindowScreenLeft(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenLeft(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenLeft"), value);
 }
 
-void setJSDOMWindowScreenTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenTop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenTop"), value);
 }
 
-void setJSDOMWindowScrollX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScrollX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "scrollX"), value);
 }
 
-void setJSDOMWindowScrollY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScrollY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "scrollY"), value);
 }
 
-void setJSDOMWindowLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "length"), value);
 }
 
-void setJSDOMWindowName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setName(value->toString(exec));
+    imp->setName(value.toString(exec));
 }
 
-void setJSDOMWindowStatus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setStatus(value->toString(exec));
+    imp->setStatus(value.toString(exec));
 }
 
-void setJSDOMWindowDefaultStatus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDefaultStatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setDefaultStatus(value->toString(exec));
+    imp->setDefaultStatus(value.toString(exec));
 }
 
-void setJSDOMWindowDefaultstatus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDefaultstatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setDefaultstatus(value->toString(exec));
+    imp->setDefaultstatus(value.toString(exec));
 }
 
-void setJSDOMWindowSelf(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSelf(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "self"), value);
 }
 
-void setJSDOMWindowFrames(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowFrames(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "frames"), value);
 }
 
-void setJSDOMWindowOpener(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOpener(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "opener"), value);
 }
 
-void setJSDOMWindowParent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowParent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "parent"), value);
 }
 
-void setJSDOMWindowTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "top"), value);
 }
 
-void setJSDOMWindowDevicePixelRatio(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDevicePixelRatio(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "devicePixelRatio"), value);
 }
 
-void setJSDOMWindowConsole(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowConsole(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "console"), value);
 }
 
-void setJSDOMWindowOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnabort(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnblur(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnchange(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOncanplay(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncanplay(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOncanplaythrough(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndblclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncanplaythrough(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnerror(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnfocus(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeydown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeypress(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeyup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousedown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousemove(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseout(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseover(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndurationchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousewheel(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndurationchange(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnemptied(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnreset(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnemptied(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnended(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnresize(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnended(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnscroll(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsearch(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnselect(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOninput(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsubmit(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnunload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnbeforeunload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationstart(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnloadeddata(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationiteration(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnloadeddata(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnloadedmetadata(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationend(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnloadedmetadata(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkittransitionend(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnpause(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnpause(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnplay(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnplay(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnplaying(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnplaying(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnratechange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnratechange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnseeked(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnseeked(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnseeking(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnseeking(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnstalled(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnstalled(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnsuspend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnsuspend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOntimeupdate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOntimeupdate(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnvolumechange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnvolumechange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwaiting(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwaiting(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkitanimationend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkitanimationiteration(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkitanimationstart(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkittransitionend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2793,7 +3981,7 @@ void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "StyleSheet"), value);
 }
 
-void setJSDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2801,7 +3989,7 @@ void setJSDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSStyleSheet"), value);
 }
 
-void setJSDOMWindowCSSValueConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSValueConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2809,7 +3997,7 @@ void setJSDOMWindowCSSValueConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSValue"), value);
 }
 
-void setJSDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2817,7 +4005,7 @@ void setJSDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSPrimitiveValue"), value);
 }
 
-void setJSDOMWindowCSSValueListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSValueListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2825,7 +4013,7 @@ void setJSDOMWindowCSSValueListConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSValueList"), value);
 }
 
-void setJSDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2833,7 +4021,7 @@ void setJSDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSTransformValue"), value);
 }
 
-void setJSDOMWindowCSSRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2841,7 +4029,7 @@ void setJSDOMWindowCSSRuleConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSRule"), value);
 }
 
-void setJSDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2849,7 +4037,7 @@ void setJSDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSCharsetRule"), value);
 }
 
-void setJSDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2857,7 +4045,7 @@ void setJSDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSFontFaceRule"), value);
 }
 
-void setJSDOMWindowCSSImportRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSImportRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2865,7 +4053,7 @@ void setJSDOMWindowCSSImportRuleConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSImportRule"), value);
 }
 
-void setJSDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2873,7 +4061,7 @@ void setJSDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSMediaRule"), value);
 }
 
-void setJSDOMWindowCSSPageRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSPageRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2881,7 +4069,7 @@ void setJSDOMWindowCSSPageRuleConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSPageRule"), value);
 }
 
-void setJSDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2889,7 +4077,7 @@ void setJSDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSStyleRule"), value);
 }
 
-void setJSDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2897,7 +4085,7 @@ void setJSDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSVariablesRule"), value);
 }
 
-void setJSDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2905,7 +4093,7 @@ void setJSDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSVariablesDeclaration"), value);
 }
 
-void setJSDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2913,7 +4101,7 @@ void setJSDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSStyleDeclaration"), value);
 }
 
-void setJSDOMWindowMediaListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMediaListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2921,7 +4109,7 @@ void setJSDOMWindowMediaListConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MediaList"), value);
 }
 
-void setJSDOMWindowCounterConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCounterConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2929,7 +4117,7 @@ void setJSDOMWindowCounterConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Counter"), value);
 }
 
-void setJSDOMWindowCSSRuleListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSRuleListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2937,7 +4125,7 @@ void setJSDOMWindowCSSRuleListConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSRuleList"), value);
 }
 
-void setJSDOMWindowRectConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2945,7 +4133,7 @@ void setJSDOMWindowRectConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Rect"), value);
 }
 
-void setJSDOMWindowStyleSheetListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStyleSheetListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2953,7 +4141,7 @@ void setJSDOMWindowStyleSheetListConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "StyleSheetList"), value);
 }
 
-void setJSDOMWindowDOMExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDOMExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2961,7 +4149,7 @@ void setJSDOMWindowDOMExceptionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMException"), value);
 }
 
-void setJSDOMWindowDOMStringListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDOMStringListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2969,7 +4157,7 @@ void setJSDOMWindowDOMStringListConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMStringList"), value);
 }
 
-void setJSDOMWindowDOMImplementationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDOMImplementationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2977,7 +4165,7 @@ void setJSDOMWindowDOMImplementationConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMImplementation"), value);
 }
 
-void setJSDOMWindowDocumentFragmentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDocumentFragmentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2985,7 +4173,7 @@ void setJSDOMWindowDocumentFragmentConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DocumentFragment"), value);
 }
 
-void setJSDOMWindowDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2993,7 +4181,7 @@ void setJSDOMWindowDocumentConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Document"), value);
 }
 
-void setJSDOMWindowNodeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNodeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3001,7 +4189,7 @@ void setJSDOMWindowNodeConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Node"), value);
 }
 
-void setJSDOMWindowNodeListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNodeListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3009,7 +4197,7 @@ void setJSDOMWindowNodeListConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "NodeList"), value);
 }
 
-void setJSDOMWindowNamedNodeMapConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNamedNodeMapConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3017,7 +4205,7 @@ void setJSDOMWindowNamedNodeMapConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "NamedNodeMap"), value);
 }
 
-void setJSDOMWindowCharacterDataConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCharacterDataConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3025,7 +4213,7 @@ void setJSDOMWindowCharacterDataConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CharacterData"), value);
 }
 
-void setJSDOMWindowAttrConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowAttrConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3033,7 +4221,7 @@ void setJSDOMWindowAttrConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Attr"), value);
 }
 
-void setJSDOMWindowElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3041,7 +4229,7 @@ void setJSDOMWindowElementConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Element"), value);
 }
 
-void setJSDOMWindowTextConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTextConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3049,7 +4237,7 @@ void setJSDOMWindowTextConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Text"), value);
 }
 
-void setJSDOMWindowCommentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCommentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3057,7 +4245,7 @@ void setJSDOMWindowCommentConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Comment"), value);
 }
 
-void setJSDOMWindowCDATASectionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCDATASectionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3065,7 +4253,7 @@ void setJSDOMWindowCDATASectionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CDATASection"), value);
 }
 
-void setJSDOMWindowDocumentTypeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDocumentTypeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3073,7 +4261,7 @@ void setJSDOMWindowDocumentTypeConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DocumentType"), value);
 }
 
-void setJSDOMWindowNotationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNotationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3081,7 +4269,7 @@ void setJSDOMWindowNotationConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Notation"), value);
 }
 
-void setJSDOMWindowEntityConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEntityConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3089,7 +4277,7 @@ void setJSDOMWindowEntityConstructor(ExecState* exec, JSObject* thisObject, JSVa
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Entity"), value);
 }
 
-void setJSDOMWindowEntityReferenceConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEntityReferenceConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3097,7 +4285,7 @@ void setJSDOMWindowEntityReferenceConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "EntityReference"), value);
 }
 
-void setJSDOMWindowProcessingInstructionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowProcessingInstructionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3105,7 +4293,7 @@ void setJSDOMWindowProcessingInstructionConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ProcessingInstruction"), value);
 }
 
-void setJSDOMWindowHTMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3113,7 +4301,7 @@ void setJSDOMWindowHTMLDocumentConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDocument"), value);
 }
 
-void setJSDOMWindowHTMLElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3121,7 +4309,7 @@ void setJSDOMWindowHTMLElementConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLElement"), value);
 }
 
-void setJSDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3129,7 +4317,7 @@ void setJSDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAnchorElement"), value);
 }
 
-void setJSDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3137,7 +4325,7 @@ void setJSDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAppletElement"), value);
 }
 
-void setJSDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3145,7 +4333,7 @@ void setJSDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAreaElement"), value);
 }
 
-void setJSDOMWindowHTMLBRElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBRElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3153,7 +4341,7 @@ void setJSDOMWindowHTMLBRElementConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBRElement"), value);
 }
 
-void setJSDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3161,7 +4349,7 @@ void setJSDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBaseElement"), value);
 }
 
-void setJSDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3169,7 +4357,7 @@ void setJSDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBaseFontElement"), value);
 }
 
-void setJSDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3177,7 +4365,7 @@ void setJSDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBlockquoteElement"), value);
 }
 
-void setJSDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3185,7 +4373,7 @@ void setJSDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBodyElement"), value);
 }
 
-void setJSDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3193,7 +4381,7 @@ void setJSDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLButtonElement"), value);
 }
 
-void setJSDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3201,7 +4389,7 @@ void setJSDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLCanvasElement"), value);
 }
 
-void setJSDOMWindowHTMLDListElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDListElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3209,7 +4397,7 @@ void setJSDOMWindowHTMLDListElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDListElement"), value);
 }
 
-void setJSDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3217,7 +4405,7 @@ void setJSDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDirectoryElement"), value);
 }
 
-void setJSDOMWindowHTMLDivElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDivElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3225,7 +4413,7 @@ void setJSDOMWindowHTMLDivElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDivElement"), value);
 }
 
-void setJSDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3233,7 +4421,7 @@ void setJSDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLEmbedElement"), value);
 }
 
-void setJSDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3241,7 +4429,7 @@ void setJSDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFieldSetElement"), value);
 }
 
-void setJSDOMWindowHTMLFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3249,7 +4437,7 @@ void setJSDOMWindowHTMLFontElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFontElement"), value);
 }
 
-void setJSDOMWindowHTMLFormElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFormElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3257,7 +4445,7 @@ void setJSDOMWindowHTMLFormElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFormElement"), value);
 }
 
-void setJSDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3265,7 +4453,7 @@ void setJSDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFrameElement"), value);
 }
 
-void setJSDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3273,7 +4461,7 @@ void setJSDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFrameSetElement"), value);
 }
 
-void setJSDOMWindowHTMLHRElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHRElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3281,7 +4469,7 @@ void setJSDOMWindowHTMLHRElementConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHRElement"), value);
 }
 
-void setJSDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3289,7 +4477,7 @@ void setJSDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHeadElement"), value);
 }
 
-void setJSDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3297,7 +4485,7 @@ void setJSDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHeadingElement"), value);
 }
 
-void setJSDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3305,7 +4493,7 @@ void setJSDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHtmlElement"), value);
 }
 
-void setJSDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3313,7 +4501,7 @@ void setJSDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLIFrameElement"), value);
 }
 
-void setJSDOMWindowHTMLImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3321,7 +4509,7 @@ void setJSDOMWindowHTMLImageElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLImageElement"), value);
 }
 
-void setJSDOMWindowHTMLInputElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLInputElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3329,7 +4517,7 @@ void setJSDOMWindowHTMLInputElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLInputElement"), value);
 }
 
-void setJSDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3337,7 +4525,7 @@ void setJSDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLIsIndexElement"), value);
 }
 
-void setJSDOMWindowHTMLLIElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLIElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3345,7 +4533,7 @@ void setJSDOMWindowHTMLLIElementConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLIElement"), value);
 }
 
-void setJSDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3353,7 +4541,7 @@ void setJSDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLabelElement"), value);
 }
 
-void setJSDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3361,7 +4549,7 @@ void setJSDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLegendElement"), value);
 }
 
-void setJSDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3369,7 +4557,7 @@ void setJSDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLinkElement"), value);
 }
 
-void setJSDOMWindowHTMLMapElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMapElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3377,7 +4565,7 @@ void setJSDOMWindowHTMLMapElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMapElement"), value);
 }
 
-void setJSDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3385,7 +4573,7 @@ void setJSDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMarqueeElement"), value);
 }
 
-void setJSDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3393,7 +4581,7 @@ void setJSDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMenuElement"), value);
 }
 
-void setJSDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3401,7 +4589,7 @@ void setJSDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMetaElement"), value);
 }
 
-void setJSDOMWindowHTMLModElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLModElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3409,7 +4597,7 @@ void setJSDOMWindowHTMLModElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLModElement"), value);
 }
 
-void setJSDOMWindowHTMLOListElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLOListElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3417,7 +4605,7 @@ void setJSDOMWindowHTMLOListElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLOListElement"), value);
 }
 
-void setJSDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3425,7 +4613,7 @@ void setJSDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLObjectElement"), value);
 }
 
-void setJSDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3433,7 +4621,7 @@ void setJSDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLOptGroupElement"), value);
 }
 
-void setJSDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3441,7 +4629,7 @@ void setJSDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLOptionElement"), value);
 }
 
-void setJSDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3449,7 +4637,7 @@ void setJSDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLParagraphElement"), value);
 }
 
-void setJSDOMWindowHTMLParamElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLParamElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3457,7 +4645,7 @@ void setJSDOMWindowHTMLParamElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLParamElement"), value);
 }
 
-void setJSDOMWindowHTMLPreElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLPreElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3465,7 +4653,7 @@ void setJSDOMWindowHTMLPreElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLPreElement"), value);
 }
 
-void setJSDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3473,7 +4661,7 @@ void setJSDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLQuoteElement"), value);
 }
 
-void setJSDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3481,7 +4669,7 @@ void setJSDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLScriptElement"), value);
 }
 
-void setJSDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3489,7 +4677,7 @@ void setJSDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLSelectElement"), value);
 }
 
-void setJSDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3497,7 +4685,7 @@ void setJSDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLStyleElement"), value);
 }
 
-void setJSDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3505,7 +4693,7 @@ void setJSDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableCaptionElement"), value);
 }
 
-void setJSDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3513,7 +4701,7 @@ void setJSDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableCellElement"), value);
 }
 
-void setJSDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3521,7 +4709,7 @@ void setJSDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableColElement"), value);
 }
 
-void setJSDOMWindowHTMLTableElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3529,7 +4717,7 @@ void setJSDOMWindowHTMLTableElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableElement"), value);
 }
 
-void setJSDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3537,7 +4725,7 @@ void setJSDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableRowElement"), value);
 }
 
-void setJSDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3545,7 +4733,7 @@ void setJSDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableSectionElement"), value);
 }
 
-void setJSDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3553,7 +4741,7 @@ void setJSDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTextAreaElement"), value);
 }
 
-void setJSDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3561,7 +4749,7 @@ void setJSDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTitleElement"), value);
 }
 
-void setJSDOMWindowHTMLUListElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLUListElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3569,7 +4757,7 @@ void setJSDOMWindowHTMLUListElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLUListElement"), value);
 }
 
-void setJSDOMWindowHTMLCollectionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLCollectionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3577,7 +4765,23 @@ void setJSDOMWindowHTMLCollectionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLCollection"), value);
 }
 
-void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowImageConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Image"), value);
+}
+
+void setJSDOMWindowOptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Option"), value);
+}
+
+void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3585,7 +4789,7 @@ void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext2D"), value);
 }
 
-void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3593,7 +4797,7 @@ void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TextMetrics"), value);
 }
 
-void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3601,7 +4805,7 @@ void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSVal
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
 }
 
-void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3609,7 +4813,7 @@ void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "KeyboardEvent"), value);
 }
 
-void setJSDOMWindowMouseEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMouseEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3617,7 +4821,7 @@ void setJSDOMWindowMouseEventConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MouseEvent"), value);
 }
 
-void setJSDOMWindowMutationEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMutationEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3625,7 +4829,7 @@ void setJSDOMWindowMutationEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MutationEvent"), value);
 }
 
-void setJSDOMWindowOverflowEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOverflowEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3633,7 +4837,7 @@ void setJSDOMWindowOverflowEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "OverflowEvent"), value);
 }
 
-void setJSDOMWindowProgressEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowProgressEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3641,7 +4845,7 @@ void setJSDOMWindowProgressEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ProgressEvent"), value);
 }
 
-void setJSDOMWindowTextEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTextEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3649,7 +4853,7 @@ void setJSDOMWindowTextEventConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TextEvent"), value);
 }
 
-void setJSDOMWindowUIEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowUIEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3657,7 +4861,7 @@ void setJSDOMWindowUIEventConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "UIEvent"), value);
 }
 
-void setJSDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3665,7 +4869,7 @@ void setJSDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitAnimationEvent"), value);
 }
 
-void setJSDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3673,7 +4877,7 @@ void setJSDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitTransitionEvent"), value);
 }
 
-void setJSDOMWindowWheelEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWheelEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3681,7 +4885,7 @@ void setJSDOMWindowWheelEventConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WheelEvent"), value);
 }
 
-void setJSDOMWindowMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3689,7 +4893,7 @@ void setJSDOMWindowMessageEventConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MessageEvent"), value);
 }
 
-void setJSDOMWindowEventExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEventExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3697,7 +4901,7 @@ void setJSDOMWindowEventExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "EventException"), value);
 }
 
-void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3705,7 +4909,7 @@ void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSKeyframeRule"), value);
 }
 
-void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3713,7 +4917,23 @@ void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSKeyframesRule"), value);
 }
 
-void setJSDOMWindowClipboardConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSMatrix"), value);
+}
+
+void setJSDOMWindowWebKitPointConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitPoint"), value);
+}
+
+void setJSDOMWindowClipboardConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3721,7 +4941,7 @@ void setJSDOMWindowClipboardConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Clipboard"), value);
 }
 
-void setJSDOMWindowFileConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowFileConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3729,7 +4949,7 @@ void setJSDOMWindowFileConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "File"), value);
 }
 
-void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3737,7 +4957,7 @@ void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "FileList"), value);
 }
 
-void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3745,7 +4965,7 @@ void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "NodeFilter"), value);
 }
 
-void setJSDOMWindowRangeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowRangeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3753,7 +4973,7 @@ void setJSDOMWindowRangeConstructor(ExecState* exec, JSObject* thisObject, JSVal
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Range"), value);
 }
 
-void setJSDOMWindowRangeExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowRangeExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3761,7 +4981,7 @@ void setJSDOMWindowRangeExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "RangeException"), value);
 }
 
-void setJSDOMWindowXMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3769,7 +4989,7 @@ void setJSDOMWindowXMLDocumentConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLDocument"), value);
 }
 
-void setJSDOMWindowDOMParserConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDOMParserConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3777,7 +4997,7 @@ void setJSDOMWindowDOMParserConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMParser"), value);
 }
 
-void setJSDOMWindowXMLSerializerConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLSerializerConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3785,7 +5005,15 @@ void setJSDOMWindowXMLSerializerConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLSerializer"), value);
 }
 
-void setJSDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLHttpRequestConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
+}
+
+void setJSDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3793,7 +5021,7 @@ void setJSDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequestUpload"), value);
 }
 
-void setJSDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3801,7 +5029,15 @@ void setJSDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequestException"), value);
 }
 
-void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWorkerConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Worker"), value);
+}
+
+void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3809,7 +5045,7 @@ void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSVa
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Plugin"), value);
 }
 
-void setJSDOMWindowPluginArrayConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowPluginArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3817,7 +5053,7 @@ void setJSDOMWindowPluginArrayConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "PluginArray"), value);
 }
 
-void setJSDOMWindowMimeTypeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMimeTypeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3825,7 +5061,7 @@ void setJSDOMWindowMimeTypeConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MimeType"), value);
 }
 
-void setJSDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3833,7 +5069,23 @@ void setJSDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MimeTypeArray"), value);
 }
 
-void setJSDOMWindowStorageConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowClientRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ClientRect"), value);
+}
+
+void setJSDOMWindowClientRectListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ClientRectList"), value);
+}
+
+void setJSDOMWindowStorageConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3841,7 +5093,7 @@ void setJSDOMWindowStorageConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Storage"), value);
 }
 
-void setJSDOMWindowStorageEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStorageEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3849,7 +5101,15 @@ void setJSDOMWindowStorageEventConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "StorageEvent"), value);
 }
 
-void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowAudioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Audio"), value);
+}
+
+void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3857,7 +5117,7 @@ void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAudioElement"), value);
 }
 
-void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3865,7 +5125,7 @@ void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMediaElement"), value);
 }
 
-void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3873,7 +5133,7 @@ void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLVideoElement"), value);
 }
 
-void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3881,7 +5141,7 @@ void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MediaError"), value);
 }
 
-void setJSDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3889,7 +5149,7 @@ void setJSDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathEvaluator"), value);
 }
 
-void setJSDOMWindowXPathResultConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXPathResultConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3897,7 +5157,7 @@ void setJSDOMWindowXPathResultConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathResult"), value);
 }
 
-void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3905,7 +5165,7 @@ void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathException"), value);
 }
 
-void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3913,7 +5173,7 @@ void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAngle"), value);
 }
 
-void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3921,7 +5181,7 @@ void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGColor"), value);
 }
 
-void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3929,7 +5189,7 @@ void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGException"), value);
 }
 
-void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3937,7 +5197,7 @@ void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGGradientElement"), value);
 }
 
-void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3945,7 +5205,7 @@ void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLength"), value);
 }
 
-void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3953,7 +5213,7 @@ void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMarkerElement"), value);
 }
 
-void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3961,7 +5221,7 @@ void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPaint"), value);
 }
 
-void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3969,7 +5229,7 @@ void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSeg"), value);
 }
 
-void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3977,7 +5237,7 @@ void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPreserveAspectRatio"), value);
 }
 
-void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3985,7 +5245,7 @@ void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRenderingIntent"), value);
 }
 
-void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3993,7 +5253,7 @@ void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextContentElement"), value);
 }
 
-void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -4001,7 +5261,7 @@ void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextPathElement"), value);
 }
 
-void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -4009,7 +5269,7 @@ void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTransform"), value);
 }
 
-void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -4024,9 +5284,10 @@ void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyN
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4034,13 +5295,14 @@ JSValuePtr jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*,
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSelection()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSelection()));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
@@ -4049,9 +5311,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
@@ -4060,9 +5323,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionClose(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
@@ -4071,9 +5335,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionPrint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4084,9 +5349,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionPrint(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionStop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4097,75 +5363,102 @@ JSValuePtr jsDOMWindowPrototypeFunctionStop(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionAlert(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThisObj->open(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionShowModalDialog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThisObj->showModalDialog(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAlert(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     imp->alert(message);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionConfirm(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionConfirm(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->confirm(message));
+    JSC::JSValue result = jsBoolean(imp->confirm(message));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionPrompt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrompt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
-    const UString& defaultValue = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 1));
+    const UString& message = args.at(0).toString(exec);
+    const UString& defaultValue = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->prompt(message, defaultValue));
+    JSC::JSValue result = jsStringOrNull(exec, imp->prompt(message, defaultValue));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionFind(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFind(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& string = args.at(exec, 0)->toString(exec);
-    bool caseSensitive = args.at(exec, 1)->toBoolean(exec);
-    bool backwards = args.at(exec, 2)->toBoolean(exec);
-    bool wrap = args.at(exec, 3)->toBoolean(exec);
-    bool wholeWord = args.at(exec, 4)->toBoolean(exec);
-    bool searchInFrames = args.at(exec, 5)->toBoolean(exec);
-    bool showDialog = args.at(exec, 6)->toBoolean(exec);
+    const UString& string = args.at(0).toString(exec);
+    bool caseSensitive = args.at(1).toBoolean(exec);
+    bool backwards = args.at(2).toBoolean(exec);
+    bool wrap = args.at(3).toBoolean(exec);
+    bool wholeWord = args.at(4).toBoolean(exec);
+    bool searchInFrames = args.at(5).toBoolean(exec);
+    bool showDialog = args.at(6).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->find(string, caseSensitive, backwards, wrap, wholeWord, searchInFrames, showDialog));
+    JSC::JSValue result = jsBoolean(imp->find(string, caseSensitive, backwards, wrap, wholeWord, searchInFrames, showDialog));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionScrollBy(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollBy(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4173,16 +5466,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionScrollBy(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
     imp->scrollBy(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionScrollTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4190,16 +5484,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionScrollTo(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
     imp->scrollTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionScroll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScroll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4207,16 +5502,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionScroll(ExecState* exec, JSObject*, JSValu
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
     imp->scroll(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionMoveBy(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveBy(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4224,16 +5520,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionMoveBy(ExecState* exec, JSObject*, JSValu
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->moveBy(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4241,16 +5538,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValu
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->moveTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionResizeBy(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeBy(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4258,16 +5556,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionResizeBy(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->resizeBy(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionResizeTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4275,85 +5574,124 @@ JSValuePtr jsDOMWindowPrototypeFunctionResizeTo(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float width = args.at(exec, 0)->toFloat(exec);
-    float height = args.at(exec, 1)->toFloat(exec);
+    float width = args.at(0).toFloat(exec);
+    float height = args.at(1).toFloat(exec);
 
     imp->resizeTo(width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionGetComputedStyle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetComputedStyle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
-    const UString& pseudoElement = args.at(exec, 1)->toString(exec);
+    Element* element = toElement(args.at(0));
+    const UString& pseudoElement = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getComputedStyle(element, pseudoElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getComputedStyle(element, pseudoElement)));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionGetMatchedCSSRules(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetMatchedCSSRules(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
-    const UString& pseudoElement = args.at(exec, 1)->toString(exec);
+    Element* element = toElement(args.at(0));
+    const UString& pseudoElement = args.at(1).toString(exec);
 
     int argsCount = args.size();
     if (argsCount < 3) {
 
-        JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement)));
+        JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement)));
         return result;
     }
 
-    bool authorOnly = args.at(exec, 2)->toBoolean(exec);
+    bool authorOnly = args.at(2).toBoolean(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement, authorOnly)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    Node* node = toNode(args.at(0));
+    WebKitPoint* p = toWebKitPoint(args.at(1));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement, authorOnly)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->webkitConvertPointFromPageToNode(node, p)));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionOpenDatabase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    Node* node = toNode(args.at(0));
+    WebKitPoint* p = toWebKitPoint(args.at(1));
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->webkitConvertPointFromNodeToPage(node, p)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpenDatabase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
-    const UString& version = args.at(exec, 1)->toString(exec);
-    const UString& displayName = args.at(exec, 2)->toString(exec);
-    unsigned estimatedSize = args.at(exec, 3)->toInt32(exec);
+    const UString& name = args.at(0).toString(exec);
+    const UString& version = args.at(1).toString(exec);
+    const UString& displayName = args.at(2).toString(exec);
+    unsigned estimatedSize = args.at(3).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->openDatabase(name, version, displayName, estimatedSize, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->openDatabase(name, version, displayName, estimatedSize, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     return castedThisObj->postMessage(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4361,19 +5699,25 @@ JSValuePtr jsDOMWindowPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JS
     return castedThisObj->setTimeout(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionClearTimeout(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->clearTimeout(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearTimeout(handle);
+    return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionSetInterval(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4381,19 +5725,25 @@ JSValuePtr jsDOMWindowPrototypeFunctionSetInterval(ExecState* exec, JSObject*, J
     return castedThisObj->setInterval(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionClearInterval(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->clearInterval(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearInterval(handle);
+    return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4401,9 +5751,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject*, JSValueP
     return castedThisObj->atob(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4411,9 +5762,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValueP
     return castedThisObj->btoa(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4421,9 +5773,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObjec
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4431,5 +5784,51 @@ JSValuePtr jsDOMWindowPrototypeFunctionRemoveEventListener(ExecState* exec, JSOb
     return castedThisObj->removeEventListener(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Event* evt = toEvent(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionCaptureEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+
+    imp->captureEvents();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionReleaseEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+
+    imp->releaseEvents();
+    return jsUndefined();
+}
+
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index cea74aec81..ccab201be9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -33,14 +33,15 @@ class JSDOMWindow : public JSDOMWindowBase {
     typedef JSDOMWindowBase Base;
 public:
     JSDOMWindow(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+    virtual ~JSDOMWindow();
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));
     }
@@ -53,37 +54,49 @@ public:
     virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
     virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
-    virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
-    virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
 
     // Custom attributes
-    void setLocation(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue history(JSC::ExecState*) const;
+    JSC::JSValue location(JSC::ExecState*) const;
+    void setLocation(JSC::ExecState*, JSC::JSValue);
+    JSC::JSValue event(JSC::ExecState*) const;
+    JSC::JSValue crypto(JSC::ExecState*) const;
+    JSC::JSValue image(JSC::ExecState*) const;
+    JSC::JSValue option(JSC::ExecState*) const;
+    JSC::JSValue webKitCSSMatrix(JSC::ExecState*) const;
+    JSC::JSValue webKitPoint(JSC::ExecState*) const;
+    JSC::JSValue xmlHttpRequest(JSC::ExecState*) const;
+    JSC::JSValue worker(JSC::ExecState*) const;
+    JSC::JSValue audio(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr postMessage(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setTimeout(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr clearTimeout(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setInterval(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr clearInterval(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr atob(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr btoa(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue showModalDialog(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setTimeout(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue atob(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue btoa(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     DOMWindow* impl() const
     {
         return static_cast<DOMWindow*>(Base::impl());
     }
 };
 
-DOMWindow* toDOMWindow(JSC::JSValuePtr);
+DOMWindow* toDOMWindow(JSC::JSValue);
 
 class JSDOMWindowPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
     void* operator new(size_t);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -92,478 +105,572 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionPrint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionAlert(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionConfirm(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionFind(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionScrollBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionScrollTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionScroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionMoveBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionResizeBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionResizeTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionGetComputedStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionGetMatchedCSSRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionOpenDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionSetTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionClearTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionSetInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionClearInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionAtob(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionBtoa(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionShowModalDialog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAlert(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionConfirm(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFind(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetComputedStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetMatchedCSSRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpenDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAtob(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionCaptureEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMWindowScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowHistory(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowLocationbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowLocationbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMenubar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMenubar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPersonalbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowPersonalbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScrollbars(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScrollbars(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStatusbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStatusbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowToolbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowToolbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowClientInformation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowClientInformation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowFrameElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowOffscreenBuffering(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOuterHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOuterHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOuterWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOuterWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowInnerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowInnerHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowInnerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowInnerWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScrollX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScrollX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScrollY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScrollY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPageXOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowPageYOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowClosed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDefaultStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDefaultstatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowFrames(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowFrames(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOpener(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOpener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowParent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowDevicePixelRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowApplicationCache(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowSessionStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowLocalStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowConsole(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowConsole(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkitanimationend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkittransitionend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMStringListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMStringListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowFileConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsDOMWindowScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHistory(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLocationbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowLocationbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMenubar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMenubar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPersonalbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowPersonalbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScrollbars(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScrollbars(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStatusbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStatusbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowToolbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowToolbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClientInformation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClientInformation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCrypto(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFrameElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOffscreenBuffering(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOuterHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOuterHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOuterWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOuterWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowInnerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowInnerHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowInnerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowInnerWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScrollX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScrollX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScrollY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScrollY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPageXOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPageYOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClosed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDefaultStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDefaultstatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFrames(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowFrames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOpener(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOpener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowParent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDevicePixelRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSessionStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLocalStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowConsole(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowConsole(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOncanplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOncanplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOncanplaythrough(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOncanplaythrough(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndurationchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndurationchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnemptied(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnemptied(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnended(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnended(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnloadeddata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnloadeddata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnloadedmetadata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnloadedmetadata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnpause(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnpause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnplaying(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnplaying(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnratechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnratechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnseeked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnseeked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnseeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnseeking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnstalled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnstalled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnsuspend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnsuspend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntimeupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOntimeupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnvolumechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnvolumechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwaiting(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwaiting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkitanimationend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkittransitionend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDOMStringListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDOMStringListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowImageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowImageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitPointConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitPointConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowFileConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClientRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClientRectListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowAudioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowAudioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
index d32e184a27..e69de29bb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
@@ -1,31 +0,0 @@
-// Automatically generated from ../bindings/js/JSDOMWindowBase.cpp using WebCore/../JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-namespace WebCore {
-
-using namespace JSC;
-
-static const struct HashTableValue JSDOMWindowBaseTableValues[14] = {
-   { "open", DontDelete|Function, (intptr_t)windowProtoFuncOpen, (intptr_t)3 },
-   { "showModalDialog", DontDelete|Function, (intptr_t)windowProtoFuncShowModalDialog, (intptr_t)1 },
-   { "captureEvents", DontDelete|Function, (intptr_t)windowProtoFuncNotImplemented, (intptr_t)0 },
-   { "releaseEvents", DontDelete|Function, (intptr_t)windowProtoFuncNotImplemented, (intptr_t)0 },
-   { "crypto", DontDelete|ReadOnly, (intptr_t)jsDOMWindowBaseCrypto, (intptr_t)0 },
-   { "event", DontDelete, (intptr_t)jsDOMWindowBaseEvent, (intptr_t)setJSDOMWindowBaseEvent },
-   { "Audio", DontDelete, (intptr_t)jsDOMWindowBaseAudio, (intptr_t)setJSDOMWindowBaseAudio },
-   { "Image", DontDelete, (intptr_t)jsDOMWindowBaseImage, (intptr_t)setJSDOMWindowBaseImage },
-   { "MessageChannel", DontDelete, (intptr_t)jsDOMWindowBaseMessageChannel, (intptr_t)setJSDOMWindowBaseMessageChannel },
-   { "Option", DontDelete, (intptr_t)jsDOMWindowBaseOption, (intptr_t)setJSDOMWindowBaseOption },
-   { "Worker", DontDelete, (intptr_t)jsDOMWindowBaseWorker, (intptr_t)setJSDOMWindowBaseWorker },
-   { "XMLHttpRequest", DontDelete, (intptr_t)jsDOMWindowBaseXMLHttpRequest, (intptr_t)setJSDOMWindowBaseXMLHttpRequest },
-   { "XSLTProcessor", DontDelete, (intptr_t)jsDOMWindowBaseXSLTProcessor, (intptr_t)setJSDOMWindowBaseXSLTProcessor },
-   { 0, 0, 0, 0 }
-};
-
-extern const struct HashTable JSDOMWindowBaseTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 63, JSDOMWindowBaseTableValues, 0 };
-#else
-    { 34, 31, JSDOMWindowBaseTableValues, 0 };
-#endif
-
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
index e663c52068..76f3fc42f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
@@ -20,6 +20,9 @@
 
 #include "config.h"
 
+
+#if ENABLE(DATABASE)
+
 #include "JSDatabase.h"
 
 #include <wtf/GetPtr.h>
@@ -34,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDatabase)
+ASSERT_CLASS_FITS_IN_CELL(JSDatabase);
 
 /* Hash table */
 
@@ -69,9 +72,9 @@ static const HashTable JSDatabasePrototypeTable =
 
 const ClassInfo JSDatabasePrototype::s_info = { "DatabasePrototype", 0, &JSDatabasePrototypeTable, 0 };
 
-JSObject* JSDatabasePrototype::self(ExecState* exec)
+JSObject* JSDatabasePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDatabase>(exec);
+    return getDOMPrototype<JSDatabase>(exec, globalObject);
 }
 
 bool JSDatabasePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -90,12 +93,11 @@ JSDatabase::JSDatabase(PassRefPtr<Structure> structure, PassRefPtr<Database> imp
 JSDatabase::~JSDatabase()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDatabase::createPrototype(ExecState* exec)
+JSObject* JSDatabase::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDatabasePrototype(JSDatabasePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDatabasePrototype(JSDatabasePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDatabase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -103,35 +105,40 @@ bool JSDatabase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSDatabase, Base>(exec, &JSDatabaseTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Database* imp = static_cast<Database*>(static_cast<JSDatabase*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->version());
 }
 
-JSValuePtr jsDatabasePrototypeFunctionChangeVersion(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDatabase::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDatabase::s_info))
         return throwError(exec, TypeError);
     JSDatabase* castedThisObj = static_cast<JSDatabase*>(asObject(thisValue));
     return castedThisObj->changeVersion(exec, args);
 }
 
-JSValuePtr jsDatabasePrototypeFunctionTransaction(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDatabase::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDatabase::s_info))
         return throwError(exec, TypeError);
     JSDatabase* castedThisObj = static_cast<JSDatabase*>(asObject(thisValue));
     return castedThisObj->transaction(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Database* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Database* object)
 {
     return getDOMObjectWrapper<JSDatabase>(exec, object);
 }
-Database* toDatabase(JSC::JSValuePtr value)
+Database* toDatabase(JSC::JSValue value)
 {
-    return value->isObject(&JSDatabase::s_info) ? static_cast<JSDatabase*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDatabase::s_info) ? static_cast<JSDatabase*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
index f0642e7128..d9eee5886b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
@@ -21,6 +21,9 @@
 #ifndef JSDatabase_h
 #define JSDatabase_h
 
+
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,36 +37,37 @@ class JSDatabase : public DOMObject {
 public:
     JSDatabase(PassRefPtr<JSC::Structure>, PassRefPtr<Database>);
     virtual ~JSDatabase();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr changeVersion(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr transaction(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue changeVersion(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue transaction(JSC::ExecState*, const JSC::ArgList&);
     Database* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Database> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Database*);
-Database* toDatabase(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Database*);
+Database* toDatabase(JSC::JSValue);
 
 class JSDatabasePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,12 +76,14 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDatabasePrototypeFunctionChangeVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDatabasePrototypeFunctionTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDatabaseVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDatabaseVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 13b73f9aac..545a048363 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -92,7 +92,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDocument)
+ASSERT_CLASS_FITS_IN_CELL(JSDocument);
 
 /* Hash table */
 
@@ -157,13 +157,13 @@ public:
     JSDocumentConstructor(ExecState* exec)
         : DOMObject(JSDocumentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDocumentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDocumentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -228,9 +228,9 @@ static const HashTable JSDocumentPrototypeTable =
 
 const ClassInfo JSDocumentPrototype::s_info = { "DocumentPrototype", 0, &JSDocumentPrototypeTable, 0 };
 
-JSObject* JSDocumentPrototype::self(ExecState* exec)
+JSObject* JSDocumentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDocument>(exec);
+    return getDOMPrototype<JSDocument>(exec, globalObject);
 }
 
 bool JSDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -238,10 +238,10 @@ bool JSDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSDocumentPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSDocument::s_info = { "Document", &JSEventTargetNode::s_info, &JSDocumentTable, 0 };
+const ClassInfo JSDocument::s_info = { "Document", &JSNode::s_info, &JSDocumentTable, 0 };
 
 JSDocument::JSDocument(PassRefPtr<Structure> structure, PassRefPtr<Document> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
@@ -250,194 +250,222 @@ JSDocument::~JSDocument()
     forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<Document*>(impl()));
 }
 
-JSObject* JSDocument::createPrototype(ExecState* exec)
+JSObject* JSDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDocumentPrototype(JSDocumentPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSDocumentPrototype(JSDocumentPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValuePtr jsDocumentDoctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDoctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->doctype()));
 }
 
-JSValuePtr jsDocumentImplementation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImplementation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->implementation()));
 }
 
-JSValuePtr jsDocumentDocumentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->documentElement()));
 }
 
-JSValuePtr jsDocumentInputEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentInputEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->inputEncoding());
 }
 
-JSValuePtr jsDocumentXMLEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->xmlEncoding());
 }
 
-JSValuePtr jsDocumentXMLVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->xmlVersion());
 }
 
-JSValuePtr jsDocumentXMLStandalone(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLStandalone(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->xmlStandalone());
 }
 
-JSValuePtr jsDocumentDocumentURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->documentURI());
 }
 
-JSValuePtr jsDocumentDefaultView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultView(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->defaultView()));
 }
 
-JSValuePtr jsDocumentStyleSheets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentStyleSheets(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->styleSheets()));
 }
 
-JSValuePtr jsDocumentTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->title());
 }
 
-JSValuePtr jsDocumentReferrer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReferrer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->referrer());
 }
 
-JSValuePtr jsDocumentDomain(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDomain(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->domain());
 }
 
-JSValuePtr jsDocumentURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->url());
 }
 
-JSValuePtr jsDocumentCookie(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCookie(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cookie());
 }
 
-JSValuePtr jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->body()));
 }
 
-JSValuePtr jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->images()));
 }
 
-JSValuePtr jsDocumentApplets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentApplets(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->applets()));
 }
 
-JSValuePtr jsDocumentLinks(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLinks(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->links()));
 }
 
-JSValuePtr jsDocumentForms(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentForms(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->forms()));
 }
 
-JSValuePtr jsDocumentAnchors(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentAnchors(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->anchors()));
 }
 
-JSValuePtr jsDocumentLastModified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLastModified(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lastModified());
 }
 
-JSValuePtr jsDocumentLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocument*>(asObject(slot.slotBase()))->location(exec);
 }
 
-JSValuePtr jsDocumentCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->charset());
 }
 
-JSValuePtr jsDocumentDefaultCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->defaultCharset());
 }
 
-JSValuePtr jsDocumentReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->readyState());
 }
 
-JSValuePtr jsDocumentCharacterSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharacterSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->characterSet());
 }
 
-JSValuePtr jsDocumentPreferredStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentPreferredStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->preferredStylesheetSet());
 }
 
-JSValuePtr jsDocumentSelectedStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentSelectedStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->selectedStylesheetSet());
 }
 
-JSValuePtr jsDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocument*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSDocument, Base>(exec, propertyName, value, &JSDocumentTable, this, slot);
 }
 
-void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -445,39 +473,39 @@ void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValuePtr v
     setDOMException(exec, ec);
 }
 
-void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setXMLStandalone(value->toBoolean(exec), ec);
+    imp->setXMLStandalone(value.toBoolean(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSDocumentDocumentURI(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentDocumentURI(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setDocumentURI(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentTitle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setTitle(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setDomain(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentCookie(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentCookie(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setCookie(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -485,565 +513,601 @@ void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSDocumentLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSDocument*>(thisObject)->setLocation(exec, value);
 }
 
-void setJSDocumentCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentSelectedStylesheetSet(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentSelectedStylesheetSet(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setSelectedStylesheetSet(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSDocument::getConstructor(ExecState* exec)
+JSValue JSDocument::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDocumentConstructor>(exec);
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& tagName = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& tagName = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElement(tagName, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElement(tagName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateDocumentFragment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateDocumentFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createDocumentFragment()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createDocumentFragment()));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateTextNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createTextNode(data)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createTextNode(data)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateComment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateComment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createComment(data)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createComment(data)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateCDATASection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateCDATASection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createCDATASection(data, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createCDATASection(data, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateProcessingInstruction(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateProcessingInstruction(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& target = args.at(exec, 0)->toString(exec);
-    const UString& data = args.at(exec, 1)->toString(exec);
+    const UString& target = args.at(0).toString(exec);
+    const UString& data = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createProcessingInstruction(target, data, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createProcessingInstruction(target, data, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttribute(name, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttribute(name, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateEntityReference(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEntityReference(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createEntityReference(name, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createEntityReference(name, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& tagname = args.at(exec, 0)->toString(exec);
+    const UString& tagname = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(tagname)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(tagname)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionImportNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionImportNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* importedNode = toNode(args.at(exec, 0));
-    bool deep = args.at(exec, 1)->toBoolean(exec);
+    Node* importedNode = toNode(args.at(0));
+    bool deep = args.at(1).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->importNode(importedNode, deep, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->importNode(importedNode, deep, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateElementNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElementNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElementNS(namespaceURI, qualifiedName, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElementNS(namespaceURI, qualifiedName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttributeNS(namespaceURI, qualifiedName, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttributeNS(namespaceURI, qualifiedName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementById(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementById(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& elementId = args.at(exec, 0)->toString(exec);
+    const UString& elementId = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementById(elementId)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementById(elementId)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionAdoptNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionAdoptNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* source = toNode(args.at(exec, 0));
+    Node* source = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->adoptNode(source, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->adoptNode(source, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& eventType = args.at(exec, 0)->toString(exec);
+    const UString& eventType = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createRange()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createRange()));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateNodeIterator(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNodeIterator(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* root = toNode(args.at(exec, 0));
-    unsigned whatToShow = args.at(exec, 1)->toInt32(exec);
-    RefPtr<NodeFilter> filter = toNodeFilter(args.at(exec, 2));
-    bool expandEntityReferences = args.at(exec, 3)->toBoolean(exec);
+    Node* root = toNode(args.at(0));
+    unsigned whatToShow = args.at(1).toInt32(exec);
+    RefPtr<NodeFilter> filter = toNodeFilter(args.at(2));
+    bool expandEntityReferences = args.at(3).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createNodeIterator(root, whatToShow, filter.get(), expandEntityReferences, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createNodeIterator(root, whatToShow, filter.get(), expandEntityReferences, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateTreeWalker(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTreeWalker(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* root = toNode(args.at(exec, 0));
-    unsigned whatToShow = args.at(exec, 1)->toInt32(exec);
-    RefPtr<NodeFilter> filter = toNodeFilter(args.at(exec, 2));
-    bool expandEntityReferences = args.at(exec, 3)->toBoolean(exec);
+    Node* root = toNode(args.at(0));
+    unsigned whatToShow = args.at(1).toInt32(exec);
+    RefPtr<NodeFilter> filter = toNodeFilter(args.at(2));
+    bool expandEntityReferences = args.at(3).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createTreeWalker(root, whatToShow, filter.get(), expandEntityReferences, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createTreeWalker(root, whatToShow, filter.get(), expandEntityReferences, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetOverrideStyle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetOverrideStyle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
-    const UString& pseudoElement = args.at(exec, 1)->toString(exec);
+    Element* element = toElement(args.at(0));
+    const UString& pseudoElement = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getOverrideStyle(element, pseudoElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getOverrideStyle(element, pseudoElement)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
+    const UString& expression = args.at(0).toString(exec);
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 1));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(1));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 1));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(1));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    Node* nodeResolver = toNode(args.at(exec, 0));
+    Node* nodeResolver = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
-    Node* contextNode = toNode(args.at(exec, 1));
+    const UString& expression = args.at(0).toString(exec);
+    Node* contextNode = toNode(args.at(1));
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 2));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(2));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 2));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
-    unsigned short type = args.at(exec, 3)->toInt32(exec);
-    XPathResult* inResult = toXPathResult(args.at(exec, 4));
+    unsigned short type = args.at(3).toInt32(exec);
+    XPathResult* inResult = toXPathResult(args.at(4));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionExecCommand(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionExecCommand(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
-    bool userInterface = args.at(exec, 1)->toBoolean(exec);
-    const UString& value = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2));
+    const UString& command = args.at(0).toString(exec);
+    bool userInterface = args.at(1).toBoolean(exec);
+    const UString& value = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->execCommand(command, userInterface, value));
+    JSC::JSValue result = jsBoolean(imp->execCommand(command, userInterface, value));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandEnabled(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandEnabled(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandEnabled(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandIndeterm(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandIndeterm(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandIndeterm(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandIndeterm(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandState(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandState(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandState(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandState(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandSupported(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandSupported(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandSupported(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandSupported(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrFalse(exec, imp->queryCommandValue(command));
+    JSC::JSValue result = jsStringOrFalse(exec, imp->queryCommandValue(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& elementName = args.at(exec, 0)->toString(exec);
+    const UString& elementName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByName(elementName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByName(elementName)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionElementFromPoint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionElementFromPoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->elementFromPoint(x, y)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->elementFromPoint(x, y)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSelection()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSelection()));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetCSSCanvasContext(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetCSSCanvasContext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& contextId = args.at(exec, 0)->toString(exec);
-    const UString& name = args.at(exec, 1)->toString(exec);
-    int width = args.at(exec, 2)->toInt32(exec);
-    int height = args.at(exec, 3)->toInt32(exec);
+    const UString& contextId = args.at(0).toString(exec);
+    const UString& name = args.at(1).toString(exec);
+    int width = args.at(2).toInt32(exec);
+    int height = args.at(3).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getCSSCanvasContext(contextId, name, width, height)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getCSSCanvasContext(contextId, name, width, height)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& tagname = args.at(exec, 0)->toString(exec);
+    const UString& tagname = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(tagname)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(tagname)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-Document* toDocument(JSC::JSValuePtr value)
+Document* toDocument(JSC::JSValue value)
 {
-    return value->isObject(&JSDocument::s_info) ? static_cast<JSDocument*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDocument::s_info) ? static_cast<JSDocument*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.h b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
index f3430b7d78..da6442f706 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
@@ -21,7 +21,7 @@
 #ifndef JSDocument_h
 #define JSDocument_h
 
-#include "JSEventTargetNode.h"
+#include "JSNode.h"
 #include <runtime/Lookup.h>
 #include <wtf/AlwaysInline.h>
 #include "Document.h"
@@ -29,29 +29,29 @@ namespace WebCore {
 
 class Document;
 
-class JSDocument : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSDocument : public JSNode {
+    typedef JSNode Base;
 public:
     JSDocument(PassRefPtr<JSC::Structure>, PassRefPtr<Document>);
     virtual ~JSDocument();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr location(JSC::ExecState*) const;
-    void setLocation(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue location(JSC::ExecState*) const;
+    void setLocation(JSC::ExecState*, JSC::JSValue);
     Document* impl() const
     {
         return static_cast<Document*>(Base::impl());
@@ -63,16 +63,17 @@ ALWAYS_INLINE bool JSDocument::getOwnPropertySlot(JSC::ExecState* exec, const JS
     return JSC::getStaticValueSlot<JSDocument, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Document*);
-Document* toDocument(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Document*);
+Document* toDocument(JSC::JSValue);
 
 class JSDocumentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,84 +82,84 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateDocumentFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateTextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateComment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateCDATASection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateProcessingInstruction(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateEntityReference(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionImportNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateElementNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementById(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionAdoptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateNodeIterator(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateTreeWalker(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetOverrideStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandIndeterm(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandState(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionElementFromPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetCSSCanvasContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateDocumentFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateComment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateCDATASection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateProcessingInstruction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEntityReference(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionImportNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElementNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementById(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionAdoptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNodeIterator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTreeWalker(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetOverrideStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandIndeterm(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandState(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionElementFromPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetCSSCanvasContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDocumentDoctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentImplementation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentDocumentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentInputEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentXMLEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentXMLVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentXMLVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentXMLStandalone(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentXMLStandalone(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentDocumentURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentDocumentURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentDefaultView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentStyleSheets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentReferrer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentDomain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentDomain(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentForms(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentAnchors(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentLastModified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentDefaultCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentCharacterSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentPreferredStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentSelectedStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDoctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentImplementation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDocumentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentInputEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentXMLEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentXMLVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentXMLVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentXMLStandalone(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentXMLStandalone(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentDocumentURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentDocumentURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentDefaultView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentStyleSheets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentReferrer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDomain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentDomain(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentForms(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentAnchors(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentLastModified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentDefaultCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentCharacterSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentPreferredStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentSelectedStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
index 6912e4016b..f5e7a5dd2a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDocumentFragment)
+ASSERT_CLASS_FITS_IN_CELL(JSDocumentFragment);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSDocumentFragmentConstructor(ExecState* exec)
         : DOMObject(JSDocumentFragmentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDocumentFragmentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDocumentFragmentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSDocumentFragmentPrototypeTable =
 
 const ClassInfo JSDocumentFragmentPrototype::s_info = { "DocumentFragmentPrototype", 0, &JSDocumentFragmentPrototypeTable, 0 };
 
-JSObject* JSDocumentFragmentPrototype::self(ExecState* exec)
+JSObject* JSDocumentFragmentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDocumentFragment>(exec);
+    return getDOMPrototype<JSDocumentFragment>(exec, globalObject);
 }
 
 bool JSDocumentFragmentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -121,16 +121,16 @@ bool JSDocumentFragmentPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSDocumentFragmentPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSDocumentFragment::s_info = { "DocumentFragment", &JSEventTargetNode::s_info, &JSDocumentFragmentTable, 0 };
+const ClassInfo JSDocumentFragment::s_info = { "DocumentFragment", &JSNode::s_info, &JSDocumentFragmentTable, 0 };
 
 JSDocumentFragment::JSDocumentFragment(PassRefPtr<Structure> structure, PassRefPtr<DocumentFragment> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSDocumentFragment::createPrototype(ExecState* exec)
+JSObject* JSDocumentFragment::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDocumentFragmentPrototype(JSDocumentFragmentPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSDocumentFragmentPrototype(JSDocumentFragmentPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSDocumentFragment::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,41 +138,43 @@ bool JSDocumentFragment::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSDocumentFragment, Base>(exec, &JSDocumentFragmentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocumentFragment*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDocumentFragment::getConstructor(ExecState* exec)
+JSValue JSDocumentFragment::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDocumentFragmentConstructor>(exec);
 }
 
-JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocumentFragment::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocumentFragment::s_info))
         return throwError(exec, TypeError);
     JSDocumentFragment* castedThisObj = static_cast<JSDocumentFragment*>(asObject(thisValue));
     DocumentFragment* imp = static_cast<DocumentFragment*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocumentFragment::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocumentFragment::s_info))
         return throwError(exec, TypeError);
     JSDocumentFragment* castedThisObj = static_cast<JSDocumentFragment*>(asObject(thisValue));
     DocumentFragment* imp = static_cast<DocumentFragment*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
index b157827d96..d5f57a3b8a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
@@ -21,37 +21,38 @@
 #ifndef JSDocumentFragment_h
 #define JSDocumentFragment_h
 
-#include "JSEventTargetNode.h"
+#include "JSNode.h"
 
 namespace WebCore {
 
 class DocumentFragment;
 
-class JSDocumentFragment : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSDocumentFragment : public JSNode {
+    typedef JSNode Base;
 public:
     JSDocumentFragment(PassRefPtr<JSC::Structure>, PassRefPtr<DocumentFragment>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSDocumentFragmentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,11 +61,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
index fb106b2f53..9777374aa5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
@@ -27,7 +27,6 @@
 #include "DocumentType.h"
 #include "JSNamedNodeMap.h"
 #include "KURL.h"
-#include "NamedAttrMap.h"
 #include "NamedNodeMap.h"
 
 #include <runtime/JSNumberCell.h>
@@ -37,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDocumentType)
+ASSERT_CLASS_FITS_IN_CELL(JSDocumentType);
 
 /* Hash table */
 
@@ -79,13 +78,13 @@ public:
     JSDocumentTypeConstructor(ExecState* exec)
         : DOMObject(JSDocumentTypeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDocumentTypePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDocumentTypePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +113,9 @@ static const HashTable JSDocumentTypePrototypeTable =
 
 const ClassInfo JSDocumentTypePrototype::s_info = { "DocumentTypePrototype", 0, &JSDocumentTypePrototypeTable, 0 };
 
-JSObject* JSDocumentTypePrototype::self(ExecState* exec)
+JSObject* JSDocumentTypePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDocumentType>(exec);
+    return getDOMPrototype<JSDocumentType>(exec, globalObject);
 }
 
 const ClassInfo JSDocumentType::s_info = { "DocumentType", &JSNode::s_info, &JSDocumentTypeTable, 0 };
@@ -126,9 +125,9 @@ JSDocumentType::JSDocumentType(PassRefPtr<Structure> structure, PassRefPtr<Docum
 {
 }
 
-JSObject* JSDocumentType::createPrototype(ExecState* exec)
+JSObject* JSDocumentType::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDocumentTypePrototype(JSDocumentTypePrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSDocumentTypePrototype(JSDocumentTypePrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSDocumentType::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,54 +135,60 @@ bool JSDocumentType::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSDocumentType, Base>(exec, &JSDocumentTypeTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDocumentTypeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsDocumentTypeEntities(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeEntities(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->entities()));
 }
 
-JSValuePtr jsDocumentTypeNotations(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeNotations(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->notations()));
 }
 
-JSValuePtr jsDocumentTypePublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypePublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->publicId());
 }
 
-JSValuePtr jsDocumentTypeSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->systemId());
 }
 
-JSValuePtr jsDocumentTypeInternalSubset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeInternalSubset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->internalSubset());
 }
 
-JSValuePtr jsDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocumentType*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDocumentType::getConstructor(ExecState* exec)
+JSValue JSDocumentType::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDocumentTypeConstructor>(exec);
 }
 
-DocumentType* toDocumentType(JSC::JSValuePtr value)
+DocumentType* toDocumentType(JSC::JSValue value)
 {
-    return value->isObject(&JSDocumentType::s_info) ? static_cast<JSDocumentType*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDocumentType::s_info) ? static_cast<JSDocumentType*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
index 56f3c7be2e..1fb4e3e11c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
@@ -31,28 +31,29 @@ class JSDocumentType : public JSNode {
     typedef JSNode Base;
 public:
     JSDocumentType(PassRefPtr<JSC::Structure>, PassRefPtr<DocumentType>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DocumentType* impl() const
     {
         return static_cast<DocumentType*>(Base::impl());
     }
 };
 
-DocumentType* toDocumentType(JSC::JSValuePtr);
+DocumentType* toDocumentType(JSC::JSValue);
 
 class JSDocumentTypePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSDocumentTypePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -60,13 +61,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsDocumentTypeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeEntities(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeNotations(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypePublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeInternalSubset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeEntities(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeNotations(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypePublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeInternalSubset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 8ecc6798a2..1bddbba46a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -27,9 +27,13 @@
 #include "Attr.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "Element.h"
 #include "JSAttr.h"
 #include "JSCSSStyleDeclaration.h"
+#include "JSClientRect.h"
+#include "JSClientRectList.h"
 #include "JSElement.h"
 #include "JSNodeList.h"
 #include "KURL.h"
@@ -44,7 +48,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSElement)
+ASSERT_CLASS_FITS_IN_CELL(JSElement);
 
 /* Hash table */
 
@@ -100,13 +104,13 @@ public:
     JSElementConstructor(ExecState* exec)
         : DOMObject(JSElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -121,7 +125,7 @@ bool JSElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
 
 /* Hash table for prototype */
 
-static const HashTableValue JSElementPrototypeTableValues[26] =
+static const HashTableValue JSElementPrototypeTableValues[28] =
 {
     { "getAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttribute, (intptr_t)1 },
     { "setAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttribute, (intptr_t)2 },
@@ -148,6 +152,8 @@ static const HashTableValue JSElementPrototypeTableValues[26] =
     { "getElementsByClassName", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
     { "querySelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelector, (intptr_t)1 },
     { "querySelectorAll", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
+    { "getClientRects", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetClientRects, (intptr_t)0 },
+    { "getBoundingClientRect", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetBoundingClientRect, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -155,14 +161,14 @@ static const HashTable JSElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSElementPrototypeTableValues, 0 };
 #else
-    { 68, 63, JSElementPrototypeTableValues, 0 };
+    { 69, 63, JSElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSElementPrototype::s_info = { "ElementPrototype", 0, &JSElementPrototypeTable, 0 };
 
-JSObject* JSElementPrototype::self(ExecState* exec)
+JSObject* JSElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSElement>(exec);
+    return getDOMPrototype<JSElement>(exec, globalObject);
 }
 
 bool JSElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -170,351 +176,387 @@ bool JSElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticFunctionSlot<JSObject>(exec, &JSElementPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSElement::s_info = { "Element", &JSEventTargetNode::s_info, &JSElementTable, 0 };
+const ClassInfo JSElement::s_info = { "Element", &JSNode::s_info, &JSElementTable, 0 };
 
 JSElement::JSElement(PassRefPtr<Structure> structure, PassRefPtr<Element> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSElement::createPrototype(ExecState* exec)
+JSObject* JSElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSElementPrototype(JSElementPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSElementPrototype(JSElementPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValuePtr jsElementTagName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementTagName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->tagName());
 }
 
-JSValuePtr jsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsElementOffsetLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetLeft());
 }
 
-JSValuePtr jsElementOffsetTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetTop());
 }
 
-JSValuePtr jsElementOffsetWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetWidth());
 }
 
-JSValuePtr jsElementOffsetHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetHeight());
 }
 
-JSValuePtr jsElementOffsetParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->offsetParent()));
 }
 
-JSValuePtr jsElementClientLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientLeft());
 }
 
-JSValuePtr jsElementClientTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientTop());
 }
 
-JSValuePtr jsElementClientWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientWidth());
 }
 
-JSValuePtr jsElementClientHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientHeight());
 }
 
-JSValuePtr jsElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollLeft());
 }
 
-JSValuePtr jsElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollTop());
 }
 
-JSValuePtr jsElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollWidth());
 }
 
-JSValuePtr jsElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollHeight());
 }
 
-JSValuePtr jsElementFirstElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementFirstElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->firstElementChild()));
 }
 
-JSValuePtr jsElementLastElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementLastElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastElementChild()));
 }
 
-JSValuePtr jsElementPreviousElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementPreviousElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->previousElementSibling()));
 }
 
-JSValuePtr jsElementNextElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementNextElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nextElementSibling()));
 }
 
-JSValuePtr jsElementChildElementCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementChildElementCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->childElementCount());
 }
 
-JSValuePtr jsElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSElement, Base>(exec, propertyName, value, &JSElementTable, this, slot);
 }
 
-void setJSElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    imp->setScrollLeft(value->toInt32(exec));
+    imp->setScrollLeft(value.toInt32(exec));
 }
 
-void setJSElementScrollTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSElementScrollTop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    imp->setScrollTop(value->toInt32(exec));
+    imp->setScrollTop(value.toInt32(exec));
 }
 
-JSValuePtr JSElement::getConstructor(ExecState* exec)
+JSValue JSElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSElementConstructor>(exec);
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getAttribute(name));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getAttribute(name));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttribute(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
     imp->removeAttribute(name, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttributeNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getAttributeNode(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getAttributeNode(name)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttributeNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNode(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionRemoveAttributeNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Attr* oldAttr = toAttr(args.at(exec, 0));
+    Attr* oldAttr = toAttr(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->removeAttributeNode(oldAttr, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->removeAttributeNode(oldAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(name)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getAttributeNS(namespaceURI, localName));
+    JSC::JSValue result = jsString(exec, imp->getAttributeNS(namespaceURI, localName));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNS(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionRemoveAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
     imp->removeAttributeNS(namespaceURI, localName, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttributeNodeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNodeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getAttributeNodeNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getAttributeNodeNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttributeNodeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNodeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNodeNS(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionHasAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasAttribute(name));
+    JSC::JSValue result = jsBoolean(imp->hasAttribute(name));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionHasAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasAttributeNS(namespaceURI, localName));
+    JSC::JSValue result = jsBoolean(imp->hasAttributeNS(namespaceURI, localName));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -523,9 +565,10 @@ JSValuePtr jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -534,9 +577,10 @@ JSValuePtr jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollIntoView(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoView(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -547,28 +591,30 @@ JSValuePtr jsElementPrototypeFunctionScrollIntoView(ExecState* exec, JSObject*,
         return jsUndefined();
     }
 
-    bool alignWithTop = args.at(exec, 0)->toBoolean(exec);
+    bool alignWithTop = args.at(0).toBoolean(exec);
 
     imp->scrollIntoView(alignWithTop);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionContains(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionContains(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
+    Element* element = toElement(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->contains(element));
+    JSC::JSValue result = jsBoolean(imp->contains(element));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -579,82 +625,113 @@ JSValuePtr jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState* exec, JSO
         return jsUndefined();
     }
 
-    bool centerIfNeeded = args.at(exec, 0)->toBoolean(exec);
+    bool centerIfNeeded = args.at(0).toBoolean(exec);
 
     imp->scrollIntoViewIfNeeded(centerIfNeeded);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollByLines(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByLines(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    int lines = args.at(exec, 0)->toInt32(exec);
+    int lines = args.at(0).toInt32(exec);
 
     imp->scrollByLines(lines);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollByPages(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByPages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    int pages = args.at(exec, 0)->toInt32(exec);
+    int pages = args.at(0).toInt32(exec);
 
     imp->scrollByPages(pages);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(name)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-Element* toElement(JSC::JSValuePtr value)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return value->isObject(&JSElement::s_info) ? static_cast<JSElement*>(asObject(value))->impl() : 0;
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
+        return throwError(exec, TypeError);
+    JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getClientRects()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
+        return throwError(exec, TypeError);
+    JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getBoundingClientRect()));
+    return result;
+}
+
+Element* toElement(JSC::JSValue value)
+{
+    return value.isObject(&JSElement::s_info) ? static_cast<JSElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index 391f757306..aecee1dba2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -21,7 +21,7 @@
 #ifndef JSElement_h
 #define JSElement_h
 
-#include "JSEventTargetNode.h"
+#include "JSNode.h"
 #include <runtime/Lookup.h>
 #include <wtf/AlwaysInline.h>
 #include "Element.h"
@@ -29,28 +29,28 @@ namespace WebCore {
 
 class Element;
 
-class JSElement : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSElement : public JSNode {
+    typedef JSNode Base;
 public:
     JSElement(PassRefPtr<JSC::Structure>, PassRefPtr<Element>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr setAttribute(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setAttributeNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setAttributeNS(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setAttributeNodeNS(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttribute(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttributeNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttributeNS(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttributeNodeNS(JSC::ExecState*, const JSC::ArgList&);
     Element* impl() const
     {
         return static_cast<Element*>(Base::impl());
@@ -62,16 +62,17 @@ ALWAYS_INLINE bool JSElement::getOwnPropertySlot(JSC::ExecState* exec, const JSC
     return JSC::getStaticValueSlot<JSElement, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
-Element* toElement(JSC::JSValuePtr);
-JSC::JSValuePtr toJSNewlyCreated(JSC::ExecState*, Element*);
+Element* toElement(JSC::JSValue);
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, Element*);
 
 class JSElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -80,56 +81,58 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionRemoveAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionRemoveAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionRemoveAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionHasAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionHasAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollIntoView(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionContains(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollIntoViewIfNeeded(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollByLines(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollByPages(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoView(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionContains(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoViewIfNeeded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByLines(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByPages(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsElementTagName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementFirstElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementLastElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementPreviousElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementNextElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementChildElementCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementTagName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementFirstElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementLastElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementPreviousElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementNextElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementChildElementCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
index 464a93ff71..c9f355a56e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEntity)
+ASSERT_CLASS_FITS_IN_CELL(JSEntity);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSEntityConstructor(ExecState* exec)
         : DOMObject(JSEntityConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEntityPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEntityPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSEntityPrototypeTable =
 
 const ClassInfo JSEntityPrototype::s_info = { "EntityPrototype", 0, &JSEntityPrototypeTable, 0 };
 
-JSObject* JSEntityPrototype::self(ExecState* exec)
+JSObject* JSEntityPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEntity>(exec);
+    return getDOMPrototype<JSEntity>(exec, globalObject);
 }
 
 const ClassInfo JSEntity::s_info = { "Entity", &JSNode::s_info, &JSEntityTable, 0 };
@@ -119,9 +119,9 @@ JSEntity::JSEntity(PassRefPtr<Structure> structure, PassRefPtr<Entity> impl)
 {
 }
 
-JSObject* JSEntity::createPrototype(ExecState* exec)
+JSObject* JSEntity::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEntityPrototype(JSEntityPrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSEntityPrototype(JSEntityPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSEntity::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,29 +129,32 @@ bool JSEntity::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSEntity, Base>(exec, &JSEntityTable, this, propertyName, slot);
 }
 
-JSValuePtr jsEntityPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(static_cast<JSEntity*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->publicId());
 }
 
-JSValuePtr jsEntitySystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntitySystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(static_cast<JSEntity*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->systemId());
 }
 
-JSValuePtr jsEntityNotationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityNotationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(static_cast<JSEntity*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->notationName());
 }
 
-JSValuePtr jsEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEntity*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSEntity::getConstructor(ExecState* exec)
+JSValue JSEntity::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEntityConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.h b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
index 890204f0d4..b54cf58226 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
@@ -31,23 +31,24 @@ class JSEntity : public JSNode {
     typedef JSNode Base;
 public:
     JSEntity(PassRefPtr<JSC::Structure>, PassRefPtr<Entity>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSEntityPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSEntityPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,10 +56,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsEntityPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEntitySystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEntityNotationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntitySystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityNotationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
index 19effcaaa8..88450e75af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEntityReference)
+ASSERT_CLASS_FITS_IN_CELL(JSEntityReference);
 
 /* Hash table */
 
@@ -68,13 +68,13 @@ public:
     JSEntityReferenceConstructor(ExecState* exec)
         : DOMObject(JSEntityReferenceConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEntityReferencePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEntityReferencePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,9 +103,9 @@ static const HashTable JSEntityReferencePrototypeTable =
 
 const ClassInfo JSEntityReferencePrototype::s_info = { "EntityReferencePrototype", 0, &JSEntityReferencePrototypeTable, 0 };
 
-JSObject* JSEntityReferencePrototype::self(ExecState* exec)
+JSObject* JSEntityReferencePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEntityReference>(exec);
+    return getDOMPrototype<JSEntityReference>(exec, globalObject);
 }
 
 const ClassInfo JSEntityReference::s_info = { "EntityReference", &JSNode::s_info, &JSEntityReferenceTable, 0 };
@@ -115,9 +115,9 @@ JSEntityReference::JSEntityReference(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSEntityReference::createPrototype(ExecState* exec)
+JSObject* JSEntityReference::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEntityReferencePrototype(JSEntityReferencePrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSEntityReferencePrototype(JSEntityReferencePrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSEntityReference::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,11 +125,11 @@ bool JSEntityReference::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSEntityReference, Base>(exec, &JSEntityReferenceTable, this, propertyName, slot);
 }
 
-JSValuePtr jsEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEntityReference*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSEntityReference::getConstructor(ExecState* exec)
+JSValue JSEntityReference::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEntityReferenceConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
index 8a93de79a5..0c0957a7a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
@@ -31,23 +31,24 @@ class JSEntityReference : public JSNode {
     typedef JSNode Base;
 public:
     JSEntityReference(PassRefPtr<JSC::Structure>, PassRefPtr<EntityReference>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSEntityReferencePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSEntityReferencePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,7 +56,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index cf2ee30757..fa1feac5c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSEvent);
 
 /* Hash table */
 
@@ -103,13 +103,13 @@ public:
     JSEventConstructor(ExecState* exec)
         : DOMObject(JSEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -164,9 +164,9 @@ static const HashTable* getJSEventPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSEventPrototype::s_info = { "EventPrototype", 0, 0, getJSEventPrototypeTable };
 
-JSObject* JSEventPrototype::self(ExecState* exec)
+JSObject* JSEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEvent>(exec);
+    return getDOMPrototype<JSEvent>(exec, globalObject);
 }
 
 bool JSEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -189,12 +189,11 @@ JSEvent::JSEvent(PassRefPtr<Structure> structure, PassRefPtr<Event> impl)
 JSEvent::~JSEvent()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSEvent::createPrototype(ExecState* exec)
+JSObject* JSEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEventPrototype(JSEventPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSEventPrototype(JSEventPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -202,100 +201,111 @@ bool JSEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return getStaticValueSlot<JSEvent, Base>(exec, getJSEventTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsEventType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsEventTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->target()));
 }
 
-JSValuePtr jsEventCurrentTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCurrentTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->currentTarget()));
 }
 
-JSValuePtr jsEventEventPhase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventEventPhase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->eventPhase());
 }
 
-JSValuePtr jsEventBubbles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventBubbles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->bubbles());
 }
 
-JSValuePtr jsEventCancelable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->cancelable());
 }
 
-JSValuePtr jsEventTimeStamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTimeStamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->timeStamp());
 }
 
-JSValuePtr jsEventSrcElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSrcElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->srcElement()));
 }
 
-JSValuePtr jsEventReturnValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventReturnValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->returnValue());
 }
 
-JSValuePtr jsEventCancelBubble(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelBubble(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->cancelBubble());
 }
 
-JSValuePtr jsEventClipboardData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventClipboardData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEvent*>(asObject(slot.slotBase()))->clipboardData(exec);
 }
 
-JSValuePtr jsEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSEvent, Base>(exec, propertyName, value, getJSEventTable(exec), this, slot);
 }
 
-void setJSEventReturnValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSEventReturnValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
-    imp->setReturnValue(value->toBoolean(exec));
+    imp->setReturnValue(value.toBoolean(exec));
 }
 
-void setJSEventCancelBubble(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSEventCancelBubble(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
-    imp->setCancelBubble(value->toBoolean(exec));
+    imp->setCancelBubble(value.toBoolean(exec));
 }
 
-JSValuePtr JSEvent::getConstructor(ExecState* exec)
+JSValue JSEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEventConstructor>(exec);
 }
 
-JSValuePtr jsEventPrototypeFunctionStopPropagation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
@@ -304,9 +314,10 @@ JSValuePtr jsEventPrototypeFunctionStopPropagation(ExecState* exec, JSObject*, J
     return jsUndefined();
 }
 
-JSValuePtr jsEventPrototypeFunctionPreventDefault(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
@@ -315,15 +326,16 @@ JSValuePtr jsEventPrototypeFunctionPreventDefault(ExecState* exec, JSObject*, JS
     return jsUndefined();
 }
 
-JSValuePtr jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
-    const UString& eventTypeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
+    const UString& eventTypeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
 
     imp->initEvent(eventTypeArg, canBubbleArg, cancelableArg);
     return jsUndefined();
@@ -331,104 +343,104 @@ JSValuePtr jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObject*, JSValue
 
 // Constant getters
 
-JSValuePtr jsEventCAPTURING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCAPTURING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsEventAT_TARGET(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventAT_TARGET(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsEventBUBBLING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBUBBLING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsEventMOUSEDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsEventMOUSEUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEUP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsEventMOUSEOVER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOVER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsEventMOUSEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsEventMOUSEMOVE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEMOVE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsEventMOUSEDRAG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDRAG(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(32));
 }
 
-JSValuePtr jsEventCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(64));
 }
 
-JSValuePtr jsEventDBLCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDBLCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(128));
 }
 
-JSValuePtr jsEventKEYDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(256));
 }
 
-JSValuePtr jsEventKEYUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYUP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(512));
 }
 
-JSValuePtr jsEventKEYPRESS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYPRESS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1024));
 }
 
-JSValuePtr jsEventDRAGDROP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDRAGDROP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2048));
 }
 
-JSValuePtr jsEventFOCUS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventFOCUS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4096));
 }
 
-JSValuePtr jsEventBLUR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBLUR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8192));
 }
 
-JSValuePtr jsEventSELECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSELECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16384));
 }
 
-JSValuePtr jsEventCHANGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCHANGE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(32768));
 }
 
-Event* toEvent(JSC::JSValuePtr value)
+Event* toEvent(JSC::JSValue value)
 {
-    return value->isObject(&JSEvent::s_info) ? static_cast<JSEvent*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSEvent::s_info) ? static_cast<JSEvent*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.h b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
index 22a33f7da1..281010bee3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
@@ -34,37 +34,38 @@ class JSEvent : public DOMObject {
 public:
     JSEvent(PassRefPtr<JSC::Structure>, PassRefPtr<Event>);
     virtual ~JSEvent();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr clipboardData(JSC::ExecState*) const;
+    JSC::JSValue clipboardData(JSC::ExecState*) const;
     Event* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Event> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Event*);
-Event* toEvent(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Event*);
+Event* toEvent(JSC::JSValue);
 
 class JSEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,46 +74,46 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsEventPrototypeFunctionStopPropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventPrototypeFunctionPreventDefault(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventPrototypeFunctionInitEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsEventType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCurrentTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventEventPhase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventBubbles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCancelable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventTimeStamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventSrcElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventReturnValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventReturnValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventCancelBubble(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventCancelBubble(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventClipboardData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCurrentTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventEventPhase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventBubbles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCancelable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventTimeStamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSrcElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventReturnValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSEventReturnValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsEventCancelBubble(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSEventCancelBubble(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsEventClipboardData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsEventCAPTURING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventAT_TARGET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventBUBBLING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEOVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEMOVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEDRAG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventDBLCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventKEYDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventKEYUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventKEYPRESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventDRAGDROP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventFOCUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventBLUR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventSELECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCHANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCAPTURING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventAT_TARGET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventBUBBLING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEOVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEMOVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEDRAG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventDBLCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventKEYDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventKEYUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventKEYPRESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventDRAGDROP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventFOCUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventBLUR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSELECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCHANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index 547e802795..38cd5517ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEventException)
+ASSERT_CLASS_FITS_IN_CELL(JSEventException);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSEventExceptionConstructor(ExecState* exec)
         : DOMObject(JSEventExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEventExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEventExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,19 +110,27 @@ static const HashTable JSEventExceptionPrototypeTable =
     { 5, 3, JSEventExceptionPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSEventExceptionPrototype::s_info = { "EventExceptionPrototype", 0, &JSEventExceptionPrototypeTable, 0 };
+static const HashTable* getJSEventExceptionPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSEventExceptionPrototypeTable);
+}
+const ClassInfo JSEventExceptionPrototype::s_info = { "EventExceptionPrototype", 0, 0, getJSEventExceptionPrototypeTable };
 
-JSObject* JSEventExceptionPrototype::self(ExecState* exec)
+JSObject* JSEventExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEventException>(exec);
+    return getDOMPrototype<JSEventException>(exec, globalObject);
 }
 
 bool JSEventExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticPropertySlot<JSEventExceptionPrototype, JSObject>(exec, &JSEventExceptionPrototypeTable, this, propertyName, slot);
+    return getStaticPropertySlot<JSEventExceptionPrototype, JSObject>(exec, getJSEventExceptionPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSEventException::s_info = { "EventException", 0, &JSEventExceptionTable, 0 };
+static const HashTable* getJSEventExceptionTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSEventExceptionTable);
+}
+const ClassInfo JSEventException::s_info = { "EventException", 0, 0, getJSEventExceptionTable };
 
 JSEventException::JSEventException(PassRefPtr<Structure> structure, PassRefPtr<EventException> impl)
     : DOMObject(structure)
@@ -133,72 +141,75 @@ JSEventException::JSEventException(PassRefPtr<Structure> structure, PassRefPtr<E
 JSEventException::~JSEventException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSEventException::createPrototype(ExecState* exec)
+JSObject* JSEventException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEventExceptionPrototype(JSEventExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSEventExceptionPrototype(JSEventExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSEventException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSEventException, Base>(exec, &JSEventExceptionTable, this, propertyName, slot);
+    return getStaticValueSlot<JSEventException, Base>(exec, getJSEventExceptionTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsEventExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(static_cast<JSEventException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsEventExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(static_cast<JSEventException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsEventExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(static_cast<JSEventException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEventException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSEventException::getConstructor(ExecState* exec)
+JSValue JSEventException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEventExceptionConstructor>(exec);
 }
 
-JSValuePtr jsEventExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEventException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEventException::s_info))
         return throwError(exec, TypeError);
     JSEventException* castedThisObj = static_cast<JSEventException*>(asObject(thisValue));
     EventException* imp = static_cast<EventException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, EventException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, EventException* object)
 {
     return getDOMObjectWrapper<JSEventException>(exec, object);
 }
-EventException* toEventException(JSC::JSValuePtr value)
+EventException* toEventException(JSC::JSValue value)
 {
-    return value->isObject(&JSEventException::s_info) ? static_cast<JSEventException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSEventException::s_info) ? static_cast<JSEventException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.h b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
index d70dbffeda..bc71abe9e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
@@ -34,33 +34,34 @@ class JSEventException : public DOMObject {
 public:
     JSEventException(PassRefPtr<JSC::Structure>, PassRefPtr<EventException>);
     virtual ~JSEventException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     EventException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<EventException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, EventException*);
-EventException* toEventException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, EventException*);
+EventException* toEventException(JSC::JSValue);
 
 class JSEventExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,16 +70,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsEventExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsEventExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.cpp
deleted file mode 100644
index 3dd23d15c4..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.cpp
+++ /dev/null
@@ -1,944 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#include "JSEventTargetNode.h"
-
-#include <wtf/GetPtr.h>
-
-#include "Event.h"
-#include "EventListener.h"
-#include "EventTargetNode.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
-
-#include <runtime/Error.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSEventTargetNode)
-
-/* Hash table */
-
-static const HashTableValue JSEventTargetNodeTableValues[41] =
-{
-    { "onabort", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnabort, (intptr_t)setJSEventTargetNodeOnabort },
-    { "onblur", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnblur, (intptr_t)setJSEventTargetNodeOnblur },
-    { "onchange", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnchange, (intptr_t)setJSEventTargetNodeOnchange },
-    { "onclick", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnclick, (intptr_t)setJSEventTargetNodeOnclick },
-    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOncontextmenu, (intptr_t)setJSEventTargetNodeOncontextmenu },
-    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndblclick, (intptr_t)setJSEventTargetNodeOndblclick },
-    { "onerror", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnerror, (intptr_t)setJSEventTargetNodeOnerror },
-    { "onfocus", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnfocus, (intptr_t)setJSEventTargetNodeOnfocus },
-    { "oninput", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOninput, (intptr_t)setJSEventTargetNodeOninput },
-    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnkeydown, (intptr_t)setJSEventTargetNodeOnkeydown },
-    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnkeypress, (intptr_t)setJSEventTargetNodeOnkeypress },
-    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnkeyup, (intptr_t)setJSEventTargetNodeOnkeyup },
-    { "onload", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnload, (intptr_t)setJSEventTargetNodeOnload },
-    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmousedown, (intptr_t)setJSEventTargetNodeOnmousedown },
-    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmousemove, (intptr_t)setJSEventTargetNodeOnmousemove },
-    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmouseout, (intptr_t)setJSEventTargetNodeOnmouseout },
-    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmouseover, (intptr_t)setJSEventTargetNodeOnmouseover },
-    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmouseup, (intptr_t)setJSEventTargetNodeOnmouseup },
-    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmousewheel, (intptr_t)setJSEventTargetNodeOnmousewheel },
-    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnbeforecut, (intptr_t)setJSEventTargetNodeOnbeforecut },
-    { "oncut", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOncut, (intptr_t)setJSEventTargetNodeOncut },
-    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnbeforecopy, (intptr_t)setJSEventTargetNodeOnbeforecopy },
-    { "oncopy", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOncopy, (intptr_t)setJSEventTargetNodeOncopy },
-    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnbeforepaste, (intptr_t)setJSEventTargetNodeOnbeforepaste },
-    { "onpaste", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnpaste, (intptr_t)setJSEventTargetNodeOnpaste },
-    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragenter, (intptr_t)setJSEventTargetNodeOndragenter },
-    { "ondragover", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragover, (intptr_t)setJSEventTargetNodeOndragover },
-    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragleave, (intptr_t)setJSEventTargetNodeOndragleave },
-    { "ondrop", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndrop, (intptr_t)setJSEventTargetNodeOndrop },
-    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragstart, (intptr_t)setJSEventTargetNodeOndragstart },
-    { "ondrag", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndrag, (intptr_t)setJSEventTargetNodeOndrag },
-    { "ondragend", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragend, (intptr_t)setJSEventTargetNodeOndragend },
-    { "onreset", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnreset, (intptr_t)setJSEventTargetNodeOnreset },
-    { "onresize", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnresize, (intptr_t)setJSEventTargetNodeOnresize },
-    { "onscroll", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnscroll, (intptr_t)setJSEventTargetNodeOnscroll },
-    { "onsearch", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnsearch, (intptr_t)setJSEventTargetNodeOnsearch },
-    { "onselect", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnselect, (intptr_t)setJSEventTargetNodeOnselect },
-    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnselectstart, (intptr_t)setJSEventTargetNodeOnselectstart },
-    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnsubmit, (intptr_t)setJSEventTargetNodeOnsubmit },
-    { "onunload", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnunload, (intptr_t)setJSEventTargetNodeOnunload },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSEventTargetNodeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, JSEventTargetNodeTableValues, 0 };
-#else
-    { 133, 127, JSEventTargetNodeTableValues, 0 };
-#endif
-
-/* Hash table for prototype */
-
-static const HashTableValue JSEventTargetNodePrototypeTableValues[4] =
-{
-    { "addEventListener", DontDelete|Function, (intptr_t)jsEventTargetNodePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsEventTargetNodePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsEventTargetNodePrototypeFunctionDispatchEvent, (intptr_t)1 },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSEventTargetNodePrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSEventTargetNodePrototypeTableValues, 0 };
-#else
-    { 8, 7, JSEventTargetNodePrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSEventTargetNodePrototype::s_info = { "EventTargetNodePrototype", 0, &JSEventTargetNodePrototypeTable, 0 };
-
-JSObject* JSEventTargetNodePrototype::self(ExecState* exec)
-{
-    return getDOMPrototype<JSEventTargetNode>(exec);
-}
-
-bool JSEventTargetNodePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSEventTargetNodePrototypeTable, this, propertyName, slot);
-}
-
-const ClassInfo JSEventTargetNode::s_info = { "EventTargetNode", &JSNode::s_info, &JSEventTargetNodeTable, 0 };
-
-JSEventTargetNode::JSEventTargetNode(PassRefPtr<Structure> structure, PassRefPtr<EventTargetNode> impl)
-    : JSNode(structure, impl)
-{
-}
-
-JSObject* JSEventTargetNode::createPrototype(ExecState* exec)
-{
-    return new (exec) JSEventTargetNodePrototype(JSEventTargetNodePrototype::createStructure(JSNodePrototype::self(exec)));
-}
-
-bool JSEventTargetNode::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSEventTargetNode, Base>(exec, &JSEventTargetNodeTable, this, propertyName, slot);
-}
-
-JSValuePtr jsEventTargetNodeOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onblur())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onchange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncontextmenu())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondblclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onfocus())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oninput())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeydown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeypress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeyup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousedown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousemove())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseout())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousewheel())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforepaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onpaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragenter())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragleave())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrop())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrag())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onreset())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onresize())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onscroll())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsearch())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselect())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselectstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsubmit())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-void JSEventTargetNode::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
-{
-    lookupPut<JSEventTargetNode, Base>(exec, propertyName, value, &JSEventTargetNodeTable, this, slot);
-}
-
-void setJSEventTargetNodeOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnblur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnblur(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnchange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnchange(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnclick(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOncontextmenu(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOncontextmenu(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndblclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndblclick(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnfocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnfocus(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOninput(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOninput(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnkeydown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnkeydown(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnkeypress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnkeypress(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnkeyup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnkeyup(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmousedown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmousedown(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmousemove(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmousemove(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmouseout(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmouseout(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmouseover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmouseover(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmouseup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmouseup(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmousewheel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmousewheel(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnbeforecut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnbeforecut(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOncut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOncut(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnbeforecopy(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOncopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOncopy(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnbeforepaste(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnpaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnpaste(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragenter(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragenter(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragover(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragleave(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragleave(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndrop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndrop(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragstart(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndrag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndrag(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragend(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnreset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnreset(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnresize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnresize(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnscroll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnscroll(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnsearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnsearch(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnselect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnselect(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnselectstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnselectstart(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnsubmit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnsubmit(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnunload(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-JSValuePtr jsEventTargetNodePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSEventTargetNode::s_info))
-        return throwError(exec, TypeError);
-    JSEventTargetNode* castedThisObj = static_cast<JSEventTargetNode*>(asObject(thisValue));
-    return castedThisObj->addEventListener(exec, args);
-}
-
-JSValuePtr jsEventTargetNodePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSEventTargetNode::s_info))
-        return throwError(exec, TypeError);
-    JSEventTargetNode* castedThisObj = static_cast<JSEventTargetNode*>(asObject(thisValue));
-    return castedThisObj->removeEventListener(exec, args);
-}
-
-JSValuePtr jsEventTargetNodePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSEventTargetNode::s_info))
-        return throwError(exec, TypeError);
-    JSEventTargetNode* castedThisObj = static_cast<JSEventTargetNode*>(asObject(thisValue));
-    EventTargetNode* imp = static_cast<EventTargetNode*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Event* event = toEvent(args.at(exec, 0));
-
-
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(event, ec));
-    setDOMException(exec, ec);
-    return result;
-}
-
-EventTargetNode* toEventTargetNode(JSC::JSValuePtr value)
-{
-    return value->isObject(&JSEventTargetNode::s_info) ? static_cast<JSEventTargetNode*>(asObject(value))->impl() : 0;
-}
-
-}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.h b/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.h
deleted file mode 100644
index 0463376c2d..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.h
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSEventTargetNode_h
-#define JSEventTargetNode_h
-
-#include "JSNode.h"
-#include "EventTargetNode.h"
-namespace WebCore {
-
-class EventTargetNode;
-
-class JSEventTargetNode : public JSNode {
-    typedef JSNode Base;
-public:
-    JSEventTargetNode(PassRefPtr<JSC::Structure>, PassRefPtr<EventTargetNode>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
-
-    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
-
-
-    // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
-    EventTargetNode* impl() const
-    {
-        return static_cast<EventTargetNode*>(Base::impl());
-    }
-};
-
-EventTargetNode* toEventTargetNode(JSC::JSValuePtr);
-
-class JSEventTargetNodePrototype : public JSC::JSObject {
-public:
-    static JSC::JSObject* self(JSC::ExecState*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
-    JSEventTargetNodePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-};
-
-// Functions
-
-JSC::JSValuePtr jsEventTargetNodePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventTargetNodePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventTargetNodePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-// Attributes
-
-JSC::JSValuePtr jsEventTargetNodeOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-
-} // namespace WebCore
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index cbb4281ddf..01c6a2cbd9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSFile)
+ASSERT_CLASS_FITS_IN_CELL(JSFile);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSFileConstructor(ExecState* exec)
         : DOMObject(JSFileConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSFilePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSFilePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSFilePrototypeTable =
 
 const ClassInfo JSFilePrototype::s_info = { "FilePrototype", 0, &JSFilePrototypeTable, 0 };
 
-JSObject* JSFilePrototype::self(ExecState* exec)
+JSObject* JSFilePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSFile>(exec);
+    return getDOMPrototype<JSFile>(exec, globalObject);
 }
 
 const ClassInfo JSFile::s_info = { "File", 0, &JSFileTable, 0 };
@@ -123,12 +123,11 @@ JSFile::JSFile(PassRefPtr<Structure> structure, PassRefPtr<File> impl)
 JSFile::~JSFile()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSFile::createPrototype(ExecState* exec)
+JSObject* JSFile::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSFile::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,34 +135,36 @@ bool JSFile::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSFile, Base>(exec, &JSFileTable, this, propertyName, slot);
 }
 
-JSValuePtr jsFileFileName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileFileName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(static_cast<JSFile*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->fileName());
 }
 
-JSValuePtr jsFileFileSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileFileSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(static_cast<JSFile*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->fileSize());
 }
 
-JSValuePtr jsFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSFile*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSFile::getConstructor(ExecState* exec)
+JSValue JSFile::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSFileConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, File* object)
+JSC::JSValue toJS(JSC::ExecState* exec, File* object)
 {
     return getDOMObjectWrapper<JSFile>(exec, object);
 }
-File* toFile(JSC::JSValuePtr value)
+File* toFile(JSC::JSValue value)
 {
-    return value->isObject(&JSFile::s_info) ? static_cast<JSFile*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSFile::s_info) ? static_cast<JSFile*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.h b/src/3rdparty/webkit/WebCore/generated/JSFile.h
index 0c7b83ca03..efa4744a09 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.h
@@ -34,29 +34,30 @@ class JSFile : public DOMObject {
 public:
     JSFile(PassRefPtr<JSC::Structure>, PassRefPtr<File>);
     virtual ~JSFile();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     File* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<File> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, File*);
-File* toFile(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, File*);
+File* toFile(JSC::JSValue);
 
 class JSFilePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSFilePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,9 +65,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsFileFileName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsFileFileSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileFileName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileFileSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index baf82c8e3b..7b84c66b55 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSFileList)
+ASSERT_CLASS_FITS_IN_CELL(JSFileList);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSFileListConstructor(ExecState* exec)
         : DOMObject(JSFileListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSFileListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSFileListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +110,9 @@ static const HashTable JSFileListPrototypeTable =
 
 const ClassInfo JSFileListPrototype::s_info = { "FileListPrototype", 0, &JSFileListPrototypeTable, 0 };
 
-JSObject* JSFileListPrototype::self(ExecState* exec)
+JSObject* JSFileListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSFileList>(exec);
+    return getDOMPrototype<JSFileList>(exec, globalObject);
 }
 
 bool JSFileListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,12 +131,11 @@ JSFileList::JSFileList(PassRefPtr<Structure> structure, PassRefPtr<FileList> imp
 JSFileList::~JSFileList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSFileList::createPrototype(ExecState* exec)
+JSObject* JSFileList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSFileListPrototype(JSFileListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSFileListPrototype(JSFileListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSFileList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -164,13 +163,14 @@ bool JSFileList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsFileListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FileList* imp = static_cast<FileList*>(static_cast<JSFileList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSFileList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -181,41 +181,42 @@ void JSFileList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSFileList::getConstructor(ExecState* exec)
+JSValue JSFileList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSFileListConstructor>(exec);
 }
 
-JSValuePtr jsFileListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsFileListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSFileList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSFileList::s_info))
         return throwError(exec, TypeError);
     JSFileList* castedThisObj = static_cast<JSFileList*>(asObject(thisValue));
     FileList* imp = static_cast<FileList*>(castedThisObj->impl());
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSFileList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSFileList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFileList* thisObj = static_cast<JSFileList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<FileList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, FileList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, FileList* object)
 {
     return getDOMObjectWrapper<JSFileList>(exec, object);
 }
-FileList* toFileList(JSC::JSValuePtr value)
+FileList* toFileList(JSC::JSValue value)
 {
-    return value->isObject(&JSFileList::s_info) ? static_cast<JSFileList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSFileList::s_info) ? static_cast<JSFileList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.h b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
index 87628cef8a..4a7075d2ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
@@ -34,36 +34,37 @@ class JSFileList : public DOMObject {
 public:
     JSFileList(PassRefPtr<JSC::Structure>, PassRefPtr<FileList>);
     virtual ~JSFileList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     FileList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<FileList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, FileList*);
-FileList* toFileList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, FileList*);
+FileList* toFileList(JSC::JSValue);
 
 class JSFileListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,11 +73,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsFileListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsFileListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsFileListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
index 1d02e9004f..928e5768a5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSGeolocation)
+ASSERT_CLASS_FITS_IN_CELL(JSGeolocation);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSGeolocationPrototypeTable =
 
 const ClassInfo JSGeolocationPrototype::s_info = { "GeolocationPrototype", 0, &JSGeolocationPrototypeTable, 0 };
 
-JSObject* JSGeolocationPrototype::self(ExecState* exec)
+JSObject* JSGeolocationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSGeolocation>(exec);
+    return getDOMPrototype<JSGeolocation>(exec, globalObject);
 }
 
 bool JSGeolocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,12 +91,11 @@ JSGeolocation::JSGeolocation(PassRefPtr<Structure> structure, PassRefPtr<Geoloca
 JSGeolocation::~JSGeolocation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSGeolocation::createPrototype(ExecState* exec)
+JSObject* JSGeolocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSGeolocationPrototype(JSGeolocationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSGeolocationPrototype(JSGeolocationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSGeolocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,47 +103,51 @@ bool JSGeolocation::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSGeolocation, Base>(exec, &JSGeolocationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsGeolocationLastPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeolocationLastPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Geolocation* imp = static_cast<Geolocation*>(static_cast<JSGeolocation*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastPosition()));
 }
 
-JSValuePtr jsGeolocationPrototypeFunctionGetCurrentPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeolocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     return castedThisObj->getCurrentPosition(exec, args);
 }
 
-JSValuePtr jsGeolocationPrototypeFunctionWatchPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionWatchPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeolocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     return castedThisObj->watchPosition(exec, args);
 }
 
-JSValuePtr jsGeolocationPrototypeFunctionClearWatch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionClearWatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeolocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     Geolocation* imp = static_cast<Geolocation*>(castedThisObj->impl());
-    int watchId = args.at(exec, 0)->toInt32(exec);
+    int watchId = args.at(0).toInt32(exec);
 
     imp->clearWatch(watchId);
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Geolocation* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Geolocation* object)
 {
     return getDOMObjectWrapper<JSGeolocation>(exec, object);
 }
-Geolocation* toGeolocation(JSC::JSValuePtr value)
+Geolocation* toGeolocation(JSC::JSValue value)
 {
-    return value->isObject(&JSGeolocation::s_info) ? static_cast<JSGeolocation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSGeolocation::s_info) ? static_cast<JSGeolocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
index d73810205d..736d019817 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
@@ -34,36 +34,37 @@ class JSGeolocation : public DOMObject {
 public:
     JSGeolocation(PassRefPtr<JSC::Structure>, PassRefPtr<Geolocation>);
     virtual ~JSGeolocation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr getCurrentPosition(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr watchPosition(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getCurrentPosition(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue watchPosition(JSC::ExecState*, const JSC::ArgList&);
     Geolocation* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Geolocation> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Geolocation*);
-Geolocation* toGeolocation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Geolocation*);
+Geolocation* toGeolocation(JSC::JSValue);
 
 class JSGeolocationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,12 +73,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsGeolocationPrototypeFunctionGetCurrentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsGeolocationPrototypeFunctionWatchPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsGeolocationPrototypeFunctionClearWatch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionWatchPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionClearWatch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsGeolocationLastPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsGeolocationLastPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
index fea5d2f2e7..5d13cc6816 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
@@ -24,7 +24,9 @@
 
 #include <wtf/GetPtr.h>
 
+#include "Coordinates.h"
 #include "Geoposition.h"
+#include "JSCoordinates.h"
 #include "KURL.h"
 
 #include <runtime/Error.h>
@@ -35,28 +37,22 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSGeoposition)
+ASSERT_CLASS_FITS_IN_CELL(JSGeoposition);
 
 /* Hash table */
 
-static const HashTableValue JSGeopositionTableValues[9] =
+static const HashTableValue JSGeopositionTableValues[3] =
 {
-    { "latitude", DontDelete|ReadOnly, (intptr_t)jsGeopositionLatitude, (intptr_t)0 },
-    { "longitude", DontDelete|ReadOnly, (intptr_t)jsGeopositionLongitude, (intptr_t)0 },
-    { "altitude", DontDelete|ReadOnly, (intptr_t)jsGeopositionAltitude, (intptr_t)0 },
-    { "accuracy", DontDelete|ReadOnly, (intptr_t)jsGeopositionAccuracy, (intptr_t)0 },
-    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)jsGeopositionAltitudeAccuracy, (intptr_t)0 },
-    { "heading", DontDelete|ReadOnly, (intptr_t)jsGeopositionHeading, (intptr_t)0 },
-    { "speed", DontDelete|ReadOnly, (intptr_t)jsGeopositionSpeed, (intptr_t)0 },
+    { "coords", DontDelete|ReadOnly, (intptr_t)jsGeopositionCoords, (intptr_t)0 },
     { "timestamp", DontDelete|ReadOnly, (intptr_t)jsGeopositionTimestamp, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSGeopositionTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 255, JSGeopositionTableValues, 0 };
+    { 3, JSGeopositionTableValues, 0 };
 #else
-    { 17, 15, JSGeopositionTableValues, 0 };
+    { 4, 3, JSGeopositionTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -76,9 +72,9 @@ static const HashTable JSGeopositionPrototypeTable =
 
 const ClassInfo JSGeopositionPrototype::s_info = { "GeopositionPrototype", 0, &JSGeopositionPrototypeTable, 0 };
 
-JSObject* JSGeopositionPrototype::self(ExecState* exec)
+JSObject* JSGeopositionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSGeoposition>(exec);
+    return getDOMPrototype<JSGeoposition>(exec, globalObject);
 }
 
 bool JSGeopositionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,12 +93,11 @@ JSGeoposition::JSGeoposition(PassRefPtr<Structure> structure, PassRefPtr<Geoposi
 JSGeoposition::~JSGeoposition()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSGeoposition::createPrototype(ExecState* exec)
+JSObject* JSGeoposition::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSGeopositionPrototype(JSGeopositionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSGeopositionPrototype(JSGeopositionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSGeoposition::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,73 +105,40 @@ bool JSGeoposition::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSGeoposition, Base>(exec, &JSGeopositionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsGeopositionLatitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->latitude());
-}
-
-JSValuePtr jsGeopositionLongitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->longitude());
-}
-
-JSValuePtr jsGeopositionAltitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->altitude());
-}
-
-JSValuePtr jsGeopositionAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->accuracy());
-}
-
-JSValuePtr jsGeopositionAltitudeAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->altitudeAccuracy());
-}
-
-JSValuePtr jsGeopositionHeading(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->heading());
-}
-
-JSValuePtr jsGeopositionSpeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeopositionCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->speed());
+    return toJS(exec, WTF::getPtr(imp->coords()));
 }
 
-JSValuePtr jsGeopositionTimestamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeopositionTimestamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->timestamp());
 }
 
-JSValuePtr jsGeopositionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeopositionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeoposition::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeoposition::s_info))
         return throwError(exec, TypeError);
     JSGeoposition* castedThisObj = static_cast<JSGeoposition*>(asObject(thisValue));
     Geoposition* imp = static_cast<Geoposition*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Geoposition* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Geoposition* object)
 {
     return getDOMObjectWrapper<JSGeoposition>(exec, object);
 }
-Geoposition* toGeoposition(JSC::JSValuePtr value)
+Geoposition* toGeoposition(JSC::JSValue value)
 {
-    return value->isObject(&JSGeoposition::s_info) ? static_cast<JSGeoposition*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSGeoposition::s_info) ? static_cast<JSGeoposition*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
index a7f1ba90de..200bb6e0dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
@@ -34,12 +34,12 @@ class JSGeoposition : public DOMObject {
 public:
     JSGeoposition(PassRefPtr<JSC::Structure>, PassRefPtr<Geoposition>);
     virtual ~JSGeoposition();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,16 +50,17 @@ private:
     RefPtr<Geoposition> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Geoposition*);
-Geoposition* toGeoposition(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Geoposition*);
+Geoposition* toGeoposition(JSC::JSValue);
 
 class JSGeopositionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,17 +69,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsGeopositionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeopositionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsGeopositionLatitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionLongitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionAltitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionAltitudeAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionHeading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionSpeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionTimestamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsGeopositionCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsGeopositionTimestamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
index 8198a75555..6d2996a190 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAnchorElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAnchorElement);
 
 /* Hash table */
 
@@ -90,13 +90,13 @@ public:
     JSHTMLAnchorElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAnchorElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAnchorElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAnchorElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +126,9 @@ static const HashTable JSHTMLAnchorElementPrototypeTable =
 
 const ClassInfo JSHTMLAnchorElementPrototype::s_info = { "HTMLAnchorElementPrototype", 0, &JSHTMLAnchorElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAnchorElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAnchorElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAnchorElement>(exec);
+    return getDOMPrototype<JSHTMLAnchorElement>(exec, globalObject);
 }
 
 bool JSHTMLAnchorElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +143,9 @@ JSHTMLAnchorElement::JSHTMLAnchorElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLAnchorElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAnchorElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAnchorElementPrototype(JSHTMLAnchorElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLAnchorElementPrototype(JSHTMLAnchorElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAnchorElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,209 +153,229 @@ bool JSHTMLAnchorElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLAnchorElement, Base>(exec, &JSHTMLAnchorElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAnchorElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLAnchorElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->charset());
 }
 
-JSValuePtr jsHTMLAnchorElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->coords());
 }
 
-JSValuePtr jsHTMLAnchorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLAnchorElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hreflang());
 }
 
-JSValuePtr jsHTMLAnchorElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLAnchorElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rel());
 }
 
-JSValuePtr jsHTMLAnchorElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rev());
 }
 
-JSValuePtr jsHTMLAnchorElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->shape());
 }
 
-JSValuePtr jsHTMLAnchorElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLAnchorElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLAnchorElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-JSValuePtr jsHTMLAnchorElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsHTMLAnchorElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsHTMLAnchorElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsHTMLAnchorElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsHTMLAnchorElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsHTMLAnchorElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsHTMLAnchorElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLAnchorElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLAnchorElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLAnchorElement, Base>(exec, propertyName, value, &JSHTMLAnchorElementTable, this, slot);
 }
 
-void setJSHTMLAnchorElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementCoords(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementCoords(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setCoords(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementHreflang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementHreflang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setHreflang(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementRel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementRel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setRel(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementRev(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementRev(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setRev(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementShape(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementShape(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setShape(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLAnchorElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAnchorElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAnchorElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLAnchorElementPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLAnchorElementPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLAnchorElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLAnchorElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(asObject(thisValue));
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
index 35e0b75982..b7864c41c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
@@ -31,28 +31,29 @@ class JSHTMLAnchorElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLAnchorElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAnchorElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLAnchorElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,40 +62,40 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLAnchorElementPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLAnchorElementPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLAnchorElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
index e77aba5ab7..97421776f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAppletElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAppletElement);
 
 /* Hash table */
 
@@ -83,13 +83,13 @@ public:
     JSHTMLAppletElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAppletElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAppletElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAppletElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +118,9 @@ static const HashTable JSHTMLAppletElementPrototypeTable =
 
 const ClassInfo JSHTMLAppletElementPrototype::s_info = { "HTMLAppletElementPrototype", 0, &JSHTMLAppletElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAppletElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAppletElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAppletElement>(exec);
+    return getDOMPrototype<JSHTMLAppletElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLAppletElement::s_info = { "HTMLAppletElement", &JSHTMLElement::s_info, &JSHTMLAppletElementTable, 0 };
@@ -130,9 +130,9 @@ JSHTMLAppletElement::JSHTMLAppletElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLAppletElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAppletElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAppletElementPrototype(JSHTMLAppletElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLAppletElementPrototype(JSHTMLAppletElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAppletElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,150 +146,161 @@ bool JSHTMLAppletElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLAppletElement, Base>(exec, &JSHTMLAppletElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAppletElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLAppletElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alt());
 }
 
-JSValuePtr jsHTMLAppletElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->archive());
 }
 
-JSValuePtr jsHTMLAppletElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->code());
 }
 
-JSValuePtr jsHTMLAppletElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->codeBase());
 }
 
-JSValuePtr jsHTMLAppletElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLAppletElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hspace());
 }
 
-JSValuePtr jsHTMLAppletElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLAppletElementObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->object());
 }
 
-JSValuePtr jsHTMLAppletElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vspace());
 }
 
-JSValuePtr jsHTMLAppletElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLAppletElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLAppletElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
     lookupPut<JSHTMLAppletElement, Base>(exec, propertyName, value, &JSHTMLAppletElementTable, this, slot);
 }
 
-void setJSHTMLAppletElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementArchive(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementArchive(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setArchive(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementCode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementCode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setCode(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementCodeBase(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementCodeBase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setCodeBase(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementHspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setHspace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementObject(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementObject(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setObject(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementVspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setVspace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLAppletElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAppletElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAppletElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
index dd64eeb501..754c490d54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
@@ -32,31 +32,32 @@ class JSHTMLAppletElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLAppletElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAppletElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLAppletElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLAppletElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLAppletElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,29 +65,29 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLAppletElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
index d7d165f40a..be38c8d91e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAreaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAreaElement);
 
 /* Hash table */
 
@@ -84,13 +84,13 @@ public:
     JSHTMLAreaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAreaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAreaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAreaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -119,9 +119,9 @@ static const HashTable JSHTMLAreaElementPrototypeTable =
 
 const ClassInfo JSHTMLAreaElementPrototype::s_info = { "HTMLAreaElementPrototype", 0, &JSHTMLAreaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAreaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAreaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAreaElement>(exec);
+    return getDOMPrototype<JSHTMLAreaElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLAreaElement::s_info = { "HTMLAreaElement", &JSHTMLElement::s_info, &JSHTMLAreaElementTable, 0 };
@@ -131,9 +131,9 @@ JSHTMLAreaElement::JSHTMLAreaElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLAreaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAreaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAreaElementPrototype(JSHTMLAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLAreaElementPrototype(JSHTMLAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,142 +141,156 @@ bool JSHTMLAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLAreaElement, Base>(exec, &JSHTMLAreaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLAreaElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alt());
 }
 
-JSValuePtr jsHTMLAreaElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->coords());
 }
 
-JSValuePtr jsHTMLAreaElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLAreaElementNoHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementNoHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noHref());
 }
 
-JSValuePtr jsHTMLAreaElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->shape());
 }
 
-JSValuePtr jsHTMLAreaElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLAreaElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-JSValuePtr jsHTMLAreaElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsHTMLAreaElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsHTMLAreaElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsHTMLAreaElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsHTMLAreaElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsHTMLAreaElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLAreaElement, Base>(exec, propertyName, value, &JSHTMLAreaElementTable, this, slot);
 }
 
-void setJSHTMLAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementCoords(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementCoords(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setCoords(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementNoHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementNoHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
-    imp->setNoHref(value->toBoolean(exec));
+    imp->setNoHref(value.toBoolean(exec));
 }
 
-void setJSHTMLAreaElementShape(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementShape(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setShape(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLAreaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAreaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAreaElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
index fe37030961..9d2d8fcfd0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
@@ -31,24 +31,25 @@ class JSHTMLAreaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLAreaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAreaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLAreaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLAreaElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,28 +57,28 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementNoHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementNoHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementNoHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementNoHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
index 630170e2d7..b2577a48c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAudioElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAudioElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLAudioElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAudioElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLAudioElementPrototypeTable =
 
 const ClassInfo JSHTMLAudioElementPrototype::s_info = { "HTMLAudioElementPrototype", 0, &JSHTMLAudioElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAudioElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAudioElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAudioElement>(exec);
+    return getDOMPrototype<JSHTMLAudioElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLAudioElement::s_info = { "HTMLAudioElement", &JSHTMLMediaElement::s_info, &JSHTMLAudioElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLAudioElement::JSHTMLAudioElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLAudioElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAudioElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAudioElementPrototype(JSHTMLAudioElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec)));
+    return new (exec) JSHTMLAudioElementPrototype(JSHTMLAudioElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAudioElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,11 +128,11 @@ bool JSHTMLAudioElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLAudioElement, Base>(exec, &JSHTMLAudioElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAudioElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSHTMLAudioElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAudioElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAudioElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
index 3c1672647c..402fc67376 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
@@ -34,23 +34,24 @@ class JSHTMLAudioElement : public JSHTMLMediaElement {
     typedef JSHTMLMediaElement Base;
 public:
     JSHTMLAudioElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAudioElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLAudioElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLAudioElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,7 +59,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
index 439004c9d5..ce47923760 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBRElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBRElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLBRElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBRElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBRElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBRElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLBRElementPrototypeTable =
 
 const ClassInfo JSHTMLBRElementPrototype::s_info = { "HTMLBRElementPrototype", 0, &JSHTMLBRElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBRElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBRElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBRElement>(exec);
+    return getDOMPrototype<JSHTMLBRElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBRElement::s_info = { "HTMLBRElement", &JSHTMLElement::s_info, &JSHTMLBRElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLBRElement::JSHTMLBRElement(PassRefPtr<Structure> structure, PassRefPtr<HTM
 {
 }
 
-JSObject* JSHTMLBRElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBRElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBRElementPrototype(JSHTMLBRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBRElementPrototype(JSHTMLBRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBRElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLBRElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLBRElement, Base>(exec, &JSHTMLBRElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBRElementClear(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBRElementClear(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBRElement* imp = static_cast<HTMLBRElement*>(static_cast<JSHTMLBRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->clear());
 }
 
-JSValuePtr jsHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBRElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBRElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBRElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBRElement, Base>(exec, propertyName, value, &JSHTMLBRElementTable, this, slot);
 }
 
-void setJSHTMLBRElementClear(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBRElementClear(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBRElement* imp = static_cast<HTMLBRElement*>(static_cast<JSHTMLBRElement*>(thisObject)->impl());
     imp->setClear(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLBRElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBRElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBRElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
index 1dc4026a25..3352cb7aec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
@@ -31,24 +31,25 @@ class JSHTMLBRElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBRElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBRElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBRElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBRElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBRElementClear(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBRElementClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBRElementClear(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBRElementClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
index 1b35657ad6..9867a20160 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseElement);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSHTMLBaseElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBaseElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBaseElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBaseElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSHTMLBaseElementPrototypeTable =
 
 const ClassInfo JSHTMLBaseElementPrototype::s_info = { "HTMLBaseElementPrototype", 0, &JSHTMLBaseElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBaseElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBaseElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBaseElement>(exec);
+    return getDOMPrototype<JSHTMLBaseElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBaseElement::s_info = { "HTMLBaseElement", &JSHTMLElement::s_info, &JSHTMLBaseElementTable, 0 };
@@ -119,9 +119,9 @@ JSHTMLBaseElement::JSHTMLBaseElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLBaseElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBaseElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBaseElementPrototype(JSHTMLBaseElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBaseElementPrototype(JSHTMLBaseElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBaseElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +129,42 @@ bool JSHTMLBaseElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLBaseElement, Base>(exec, &JSHTMLBaseElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBaseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLBaseElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBaseElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBaseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBaseElement, Base>(exec, propertyName, value, &JSHTMLBaseElementTable, this, slot);
 }
 
-void setJSHTMLBaseElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBaseElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLBaseElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBaseElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBaseElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
index 8c5482e521..8fdbe06937 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
@@ -31,24 +31,25 @@ class JSHTMLBaseElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBaseElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBaseElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBaseElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBaseElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBaseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
index d942d86aba..aef713ef45 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseFontElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseFontElement);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSHTMLBaseFontElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBaseFontElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBaseFontElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBaseFontElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +108,9 @@ static const HashTable JSHTMLBaseFontElementPrototypeTable =
 
 const ClassInfo JSHTMLBaseFontElementPrototype::s_info = { "HTMLBaseFontElementPrototype", 0, &JSHTMLBaseFontElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBaseFontElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBaseFontElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBaseFontElement>(exec);
+    return getDOMPrototype<JSHTMLBaseFontElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBaseFontElement::s_info = { "HTMLBaseFontElement", &JSHTMLElement::s_info, &JSHTMLBaseFontElementTable, 0 };
@@ -120,9 +120,9 @@ JSHTMLBaseFontElement::JSHTMLBaseFontElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLBaseFontElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBaseFontElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBaseFontElementPrototype(JSHTMLBaseFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBaseFontElementPrototype(JSHTMLBaseFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBaseFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,52 +130,55 @@ bool JSHTMLBaseFontElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLBaseFontElement, Base>(exec, &JSHTMLBaseFontElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBaseFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->color());
 }
 
-JSValuePtr jsHTMLBaseFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->face());
 }
 
-JSValuePtr jsHTMLBaseFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->size());
 }
 
-JSValuePtr jsHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBaseFontElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBaseFontElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBaseFontElement, Base>(exec, propertyName, value, &JSHTMLBaseFontElementTable, this, slot);
 }
 
-void setJSHTMLBaseFontElementColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseFontElementColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
     imp->setColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBaseFontElementFace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseFontElementFace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
     imp->setFace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBaseFontElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseFontElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
-    imp->setSize(value->toInt32(exec));
+    imp->setSize(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLBaseFontElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBaseFontElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBaseFontElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
index d09fc2b36b..534bb8082b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
@@ -31,24 +31,25 @@ class JSHTMLBaseFontElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBaseFontElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBaseFontElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBaseFontElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBaseFontElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,13 +57,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBaseFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
index 7f982aacf1..590ebe7e1b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBlockquoteElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBlockquoteElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLBlockquoteElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBlockquoteElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBlockquoteElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBlockquoteElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLBlockquoteElementPrototypeTable =
 
 const ClassInfo JSHTMLBlockquoteElementPrototype::s_info = { "HTMLBlockquoteElementPrototype", 0, &JSHTMLBlockquoteElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBlockquoteElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBlockquoteElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBlockquoteElement>(exec);
+    return getDOMPrototype<JSHTMLBlockquoteElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBlockquoteElement::s_info = { "HTMLBlockquoteElement", &JSHTMLElement::s_info, &JSHTMLBlockquoteElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLBlockquoteElement::JSHTMLBlockquoteElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSHTMLBlockquoteElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBlockquoteElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBlockquoteElementPrototype(JSHTMLBlockquoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBlockquoteElementPrototype(JSHTMLBlockquoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBlockquoteElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLBlockquoteElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSHTMLBlockquoteElement, Base>(exec, &JSHTMLBlockquoteElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBlockquoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBlockquoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBlockquoteElement* imp = static_cast<HTMLBlockquoteElement*>(static_cast<JSHTMLBlockquoteElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cite());
 }
 
-JSValuePtr jsHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBlockquoteElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBlockquoteElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBlockquoteElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBlockquoteElement, Base>(exec, propertyName, value, &JSHTMLBlockquoteElementTable, this, slot);
 }
 
-void setJSHTMLBlockquoteElementCite(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBlockquoteElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBlockquoteElement* imp = static_cast<HTMLBlockquoteElement*>(static_cast<JSHTMLBlockquoteElement*>(thisObject)->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLBlockquoteElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBlockquoteElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBlockquoteElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
index 86bf06bed2..7949bddba2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
@@ -31,24 +31,25 @@ class JSHTMLBlockquoteElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBlockquoteElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBlockquoteElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBlockquoteElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBlockquoteElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBlockquoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBlockquoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBlockquoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBlockquoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
index c68d2ac6ce..27596432e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
@@ -34,11 +34,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBodyElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBodyElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLBodyElementTableValues[12] =
+static const HashTableValue JSHTMLBodyElementTableValues[8] =
 {
     { "aLink", DontDelete, (intptr_t)jsHTMLBodyElementALink, (intptr_t)setJSHTMLBodyElementALink },
     { "background", DontDelete, (intptr_t)jsHTMLBodyElementBackground, (intptr_t)setJSHTMLBodyElementBackground },
@@ -46,19 +46,15 @@ static const HashTableValue JSHTMLBodyElementTableValues[12] =
     { "link", DontDelete, (intptr_t)jsHTMLBodyElementLink, (intptr_t)setJSHTMLBodyElementLink },
     { "text", DontDelete, (intptr_t)jsHTMLBodyElementText, (intptr_t)setJSHTMLBodyElementText },
     { "vLink", DontDelete, (intptr_t)jsHTMLBodyElementVLink, (intptr_t)setJSHTMLBodyElementVLink },
-    { "scrollLeft", DontDelete, (intptr_t)jsHTMLBodyElementScrollLeft, (intptr_t)setJSHTMLBodyElementScrollLeft },
-    { "scrollTop", DontDelete, (intptr_t)jsHTMLBodyElementScrollTop, (intptr_t)setJSHTMLBodyElementScrollTop },
-    { "scrollWidth", DontDelete|ReadOnly, (intptr_t)jsHTMLBodyElementScrollWidth, (intptr_t)0 },
-    { "scrollHeight", DontDelete|ReadOnly, (intptr_t)jsHTMLBodyElementScrollHeight, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLBodyElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSHTMLBodyElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 63, JSHTMLBodyElementTableValues, 0 };
+    { 31, JSHTMLBodyElementTableValues, 0 };
 #else
-    { 33, 31, JSHTMLBodyElementTableValues, 0 };
+    { 17, 15, JSHTMLBodyElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -80,13 +76,13 @@ public:
     JSHTMLBodyElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBodyElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBodyElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBodyElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +111,9 @@ static const HashTable JSHTMLBodyElementPrototypeTable =
 
 const ClassInfo JSHTMLBodyElementPrototype::s_info = { "HTMLBodyElementPrototype", 0, &JSHTMLBodyElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBodyElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBodyElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBodyElement>(exec);
+    return getDOMPrototype<JSHTMLBodyElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBodyElement::s_info = { "HTMLBodyElement", &JSHTMLElement::s_info, &JSHTMLBodyElementTable, 0 };
@@ -127,9 +123,9 @@ JSHTMLBodyElement::JSHTMLBodyElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLBodyElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBodyElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBodyElementPrototype(JSHTMLBodyElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBodyElementPrototype(JSHTMLBodyElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBodyElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,124 +133,94 @@ bool JSHTMLBodyElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLBodyElement, Base>(exec, &JSHTMLBodyElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBodyElementALink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementALink(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->aLink());
 }
 
-JSValuePtr jsHTMLBodyElementBackground(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementBackground(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->background());
 }
 
-JSValuePtr jsHTMLBodyElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLBodyElementLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->link());
 }
 
-JSValuePtr jsHTMLBodyElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLBodyElementVLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementVLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vLink());
 }
 
-JSValuePtr jsHTMLBodyElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollLeft());
-}
-
-JSValuePtr jsHTMLBodyElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollTop());
-}
-
-JSValuePtr jsHTMLBodyElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollWidth());
-}
-
-JSValuePtr jsHTMLBodyElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollHeight());
-}
-
-JSValuePtr jsHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBodyElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBodyElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBodyElement, Base>(exec, propertyName, value, &JSHTMLBodyElementTable, this, slot);
 }
 
-void setJSHTMLBodyElementALink(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementALink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setALink(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementBackground(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementBackground(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setBackground(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementLink(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementLink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setLink(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementVLink(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementVLink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setVLink(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    imp->setScrollLeft(value->toInt32(exec));
-}
-
-void setJSHTMLBodyElementScrollTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    imp->setScrollTop(value->toInt32(exec));
-}
-
-JSValuePtr JSHTMLBodyElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBodyElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBodyElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
index 784bf79e47..b0a635d3ba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
@@ -31,24 +31,25 @@ class JSHTMLBodyElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBodyElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBodyElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBodyElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBodyElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,25 +57,19 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBodyElementALink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementALink(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementBackground(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementBackground(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementVLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementVLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLBodyElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementALink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementALink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementBackground(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementBackground(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementVLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementVLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
index eea3361ad4..22a2479fa3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLButtonElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLButtonElement);
 
 /* Hash table */
 
@@ -81,13 +81,13 @@ public:
     JSHTMLButtonElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLButtonElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLButtonElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLButtonElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +117,9 @@ static const HashTable JSHTMLButtonElementPrototypeTable =
 
 const ClassInfo JSHTMLButtonElementPrototype::s_info = { "HTMLButtonElementPrototype", 0, &JSHTMLButtonElementPrototypeTable, 0 };
 
-JSObject* JSHTMLButtonElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLButtonElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLButtonElement>(exec);
+    return getDOMPrototype<JSHTMLButtonElement>(exec, globalObject);
 }
 
 bool JSHTMLButtonElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,9 +134,9 @@ JSHTMLButtonElement::JSHTMLButtonElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLButtonElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLButtonElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLButtonElementPrototype(JSHTMLButtonElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLButtonElementPrototype(JSHTMLButtonElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLButtonElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,101 +144,110 @@ bool JSHTMLButtonElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLButtonElement, Base>(exec, &JSHTMLButtonElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLButtonElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLButtonElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLButtonElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLButtonElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLButtonElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLButtonElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLButtonElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLButtonElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLButtonElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLButtonElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLButtonElement, Base>(exec, propertyName, value, &JSHTMLButtonElementTable, this, slot);
 }
 
-void setJSHTMLButtonElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLButtonElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLButtonElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLButtonElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLButtonElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLButtonElement::getConstructor(ExecState* exec)
+JSValue JSHTMLButtonElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLButtonElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLButtonElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLButtonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLButtonElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(asObject(thisValue));
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
index 85f734171b..9849bbb979 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
@@ -31,28 +31,29 @@ class JSHTMLButtonElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLButtonElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLButtonElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLButtonElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,23 +62,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLButtonElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLButtonElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLButtonElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLButtonElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
index eee52cc835..82835edc7b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLCanvasElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLCanvasElement);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSHTMLCanvasElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLCanvasElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLCanvasElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLCanvasElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSHTMLCanvasElementPrototypeTable =
 
 const ClassInfo JSHTMLCanvasElementPrototype::s_info = { "HTMLCanvasElementPrototype", 0, &JSHTMLCanvasElementPrototypeTable, 0 };
 
-JSObject* JSHTMLCanvasElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLCanvasElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLCanvasElement>(exec);
+    return getDOMPrototype<JSHTMLCanvasElement>(exec, globalObject);
 }
 
 bool JSHTMLCanvasElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,9 +128,9 @@ JSHTMLCanvasElement::JSHTMLCanvasElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLCanvasElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLCanvasElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLCanvasElementPrototype(JSHTMLCanvasElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLCanvasElementPrototype(JSHTMLCanvasElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLCanvasElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,69 +138,73 @@ bool JSHTMLCanvasElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLCanvasElement, Base>(exec, &JSHTMLCanvasElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLCanvasElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLCanvasElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLCanvasElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLCanvasElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLCanvasElement, Base>(exec, propertyName, value, &JSHTMLCanvasElementTable, this, slot);
 }
 
-void setJSHTMLCanvasElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLCanvasElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLCanvasElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLCanvasElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(thisObject)->impl());
-    imp->setHeight(value->toInt32(exec));
+    imp->setHeight(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLCanvasElement::getConstructor(ExecState* exec)
+JSValue JSHTMLCanvasElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLCanvasElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLCanvasElementPrototypeFunctionToDataURL(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionToDataURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCanvasElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCanvasElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(asObject(thisValue));
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& type = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& type = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toDataURL(type, ec));
+    JSC::JSValue result = jsString(exec, imp->toDataURL(type, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLCanvasElementPrototypeFunctionGetContext(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionGetContext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCanvasElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCanvasElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(asObject(thisValue));
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
-    const UString& contextId = args.at(exec, 0)->toString(exec);
+    const UString& contextId = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getContext(contextId)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getContext(contextId)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
index 4c48d20d81..ad41d15267 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
@@ -31,28 +31,29 @@ class JSHTMLCanvasElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLCanvasElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLCanvasElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLCanvasElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,15 +62,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLCanvasElementPrototypeFunctionToDataURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLCanvasElementPrototypeFunctionGetContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionToDataURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionGetContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLCanvasElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLCanvasElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLCanvasElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLCanvasElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCanvasElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLCanvasElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLCanvasElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLCanvasElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index 1888e46262..3d2f98a87d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLCollection)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLCollection);
 
 /* Hash table */
 
@@ -77,13 +77,13 @@ public:
     JSHTMLCollectionConstructor(ExecState* exec)
         : DOMObject(JSHTMLCollectionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLCollectionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLCollectionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +115,9 @@ static const HashTable JSHTMLCollectionPrototypeTable =
 
 const ClassInfo JSHTMLCollectionPrototype::s_info = { "HTMLCollectionPrototype", 0, &JSHTMLCollectionPrototypeTable, 0 };
 
-JSObject* JSHTMLCollectionPrototype::self(ExecState* exec)
+JSObject* JSHTMLCollectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLCollection>(exec);
+    return getDOMPrototype<JSHTMLCollection>(exec, globalObject);
 }
 
 bool JSHTMLCollectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,18 +136,17 @@ JSHTMLCollection::JSHTMLCollection(PassRefPtr<Structure> structure, PassRefPtr<H
 JSHTMLCollection::~JSHTMLCollection()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSHTMLCollection::createPrototype(ExecState* exec)
+JSObject* JSHTMLCollection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLCollectionPrototype(JSHTMLCollectionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSHTMLCollectionPrototype(JSHTMLCollectionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSHTMLCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    JSValuePtr proto = prototype();
-    if (proto->isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
         return false;
 
     const HashEntry* entry = JSHTMLCollectionTable.entry(exec, propertyName);
@@ -177,13 +176,14 @@ bool JSHTMLCollection::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsHTMLCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLCollection* imp = static_cast<HTMLCollection*>(static_cast<JSHTMLCollection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLCollection*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -194,49 +194,52 @@ void JSHTMLCollection::getPropertyNames(ExecState* exec, PropertyNameArray& prop
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSHTMLCollection::getConstructor(ExecState* exec)
+JSValue JSHTMLCollection::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLCollectionConstructor>(exec);
 }
 
-JSValuePtr jsHTMLCollectionPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     return castedThisObj->item(exec, args);
 }
 
-JSValuePtr jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     return castedThisObj->namedItem(exec, args);
 }
 
-JSValuePtr jsHTMLCollectionPrototypeFunctionTags(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionTags(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     HTMLCollection* imp = static_cast<HTMLCollection*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->tags(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->tags(name)));
     return result;
 }
 
 
-JSValuePtr JSHTMLCollection::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<HTMLCollection*>(thisObj->impl())->item(slot.index()));
 }
-HTMLCollection* toHTMLCollection(JSC::JSValuePtr value)
+HTMLCollection* toHTMLCollection(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLCollection::s_info) ? static_cast<JSHTMLCollection*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLCollection::s_info) ? static_cast<JSHTMLCollection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
index 2ec3824977..f88b6b4cf1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
@@ -35,13 +35,13 @@ class JSHTMLCollection : public DOMObject {
 public:
     JSHTMLCollection(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLCollection>);
     virtual ~JSHTMLCollection();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,31 +49,32 @@ public:
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr item(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr namedItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue item(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue namedItem(JSC::ExecState*, const JSC::ArgList&);
     HTMLCollection* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<HTMLCollection> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLCollection*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, HTMLCollection*);
-HTMLCollection* toHTMLCollection(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, HTMLCollection*);
+HTMLCollection* toHTMLCollection(JSC::JSValue);
 
 class JSHTMLCollectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,13 +83,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLCollectionPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLCollectionPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLCollectionPrototypeFunctionTags(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionTags(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
index 0d9c9aa188..1cdc097dbc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDListElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDListElement);
 
 /* Hash table */
 
@@ -69,13 +69,13 @@ public:
     JSHTMLDListElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLDListElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDListElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDListElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +104,9 @@ static const HashTable JSHTMLDListElementPrototypeTable =
 
 const ClassInfo JSHTMLDListElementPrototype::s_info = { "HTMLDListElementPrototype", 0, &JSHTMLDListElementPrototypeTable, 0 };
 
-JSObject* JSHTMLDListElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLDListElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDListElement>(exec);
+    return getDOMPrototype<JSHTMLDListElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLDListElement::s_info = { "HTMLDListElement", &JSHTMLElement::s_info, &JSHTMLDListElementTable, 0 };
@@ -116,9 +116,9 @@ JSHTMLDListElement::JSHTMLDListElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLDListElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLDListElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDListElementPrototype(JSHTMLDListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLDListElementPrototype(JSHTMLDListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDListElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,28 +126,29 @@ bool JSHTMLDListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLDListElement, Base>(exec, &JSHTMLDListElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDListElement* imp = static_cast<HTMLDListElement*>(static_cast<JSHTMLDListElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDListElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDListElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDListElement, Base>(exec, propertyName, value, &JSHTMLDListElementTable, this, slot);
 }
 
-void setJSHTMLDListElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDListElement* imp = static_cast<HTMLDListElement*>(static_cast<JSHTMLDListElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLDListElement::getConstructor(ExecState* exec)
+JSValue JSHTMLDListElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDListElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
index 9efceb325c..a1519ebcda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
@@ -31,24 +31,25 @@ class JSHTMLDListElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLDListElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDListElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLDListElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLDListElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLDListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
index 6a69c32f95..42e0449a4e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDirectoryElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDirectoryElement);
 
 /* Hash table */
 
@@ -69,13 +69,13 @@ public:
     JSHTMLDirectoryElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLDirectoryElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDirectoryElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDirectoryElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +104,9 @@ static const HashTable JSHTMLDirectoryElementPrototypeTable =
 
 const ClassInfo JSHTMLDirectoryElementPrototype::s_info = { "HTMLDirectoryElementPrototype", 0, &JSHTMLDirectoryElementPrototypeTable, 0 };
 
-JSObject* JSHTMLDirectoryElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLDirectoryElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDirectoryElement>(exec);
+    return getDOMPrototype<JSHTMLDirectoryElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLDirectoryElement::s_info = { "HTMLDirectoryElement", &JSHTMLElement::s_info, &JSHTMLDirectoryElementTable, 0 };
@@ -116,9 +116,9 @@ JSHTMLDirectoryElement::JSHTMLDirectoryElement(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSHTMLDirectoryElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLDirectoryElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDirectoryElementPrototype(JSHTMLDirectoryElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLDirectoryElementPrototype(JSHTMLDirectoryElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDirectoryElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,28 +126,29 @@ bool JSHTMLDirectoryElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLDirectoryElement, Base>(exec, &JSHTMLDirectoryElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDirectoryElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDirectoryElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDirectoryElement* imp = static_cast<HTMLDirectoryElement*>(static_cast<JSHTMLDirectoryElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDirectoryElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDirectoryElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDirectoryElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDirectoryElement, Base>(exec, propertyName, value, &JSHTMLDirectoryElementTable, this, slot);
 }
 
-void setJSHTMLDirectoryElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDirectoryElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDirectoryElement* imp = static_cast<HTMLDirectoryElement*>(static_cast<JSHTMLDirectoryElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLDirectoryElement::getConstructor(ExecState* exec)
+JSValue JSHTMLDirectoryElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDirectoryElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
index bdbe75c87f..09242bfe44 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
@@ -31,24 +31,25 @@ class JSHTMLDirectoryElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLDirectoryElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDirectoryElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLDirectoryElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLDirectoryElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLDirectoryElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDirectoryElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDirectoryElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDirectoryElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
index 7616fc169d..e731da979b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDivElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDivElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLDivElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLDivElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDivElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDivElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLDivElementPrototypeTable =
 
 const ClassInfo JSHTMLDivElementPrototype::s_info = { "HTMLDivElementPrototype", 0, &JSHTMLDivElementPrototypeTable, 0 };
 
-JSObject* JSHTMLDivElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLDivElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDivElement>(exec);
+    return getDOMPrototype<JSHTMLDivElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLDivElement::s_info = { "HTMLDivElement", &JSHTMLElement::s_info, &JSHTMLDivElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLDivElement::JSHTMLDivElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLDivElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLDivElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDivElementPrototype(JSHTMLDivElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLDivElementPrototype(JSHTMLDivElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDivElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLDivElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLDivElement, Base>(exec, &JSHTMLDivElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDivElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDivElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDivElement* imp = static_cast<HTMLDivElement*>(static_cast<JSHTMLDivElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDivElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDivElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDivElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDivElement, Base>(exec, propertyName, value, &JSHTMLDivElementTable, this, slot);
 }
 
-void setJSHTMLDivElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDivElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDivElement* imp = static_cast<HTMLDivElement*>(static_cast<JSHTMLDivElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLDivElement::getConstructor(ExecState* exec)
+JSValue JSHTMLDivElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDivElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
index 412949d473..1f3545b9ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
@@ -31,24 +31,25 @@ class JSHTMLDivElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLDivElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDivElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLDivElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLDivElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLDivElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDivElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDivElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDivElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
index ceca27d0b8..9dfbacd257 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDocument)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDocument);
 
 /* Hash table */
 
@@ -91,13 +91,13 @@ public:
     JSHTMLDocumentConstructor(ExecState* exec)
         : DOMObject(JSHTMLDocumentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDocumentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDocumentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,9 +134,9 @@ static const HashTable JSHTMLDocumentPrototypeTable =
 
 const ClassInfo JSHTMLDocumentPrototype::s_info = { "HTMLDocumentPrototype", 0, &JSHTMLDocumentPrototypeTable, 0 };
 
-JSObject* JSHTMLDocumentPrototype::self(ExecState* exec)
+JSObject* JSHTMLDocumentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDocument>(exec);
+    return getDOMPrototype<JSHTMLDocument>(exec, globalObject);
 }
 
 bool JSHTMLDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,9 +151,9 @@ JSHTMLDocument::JSHTMLDocument(PassRefPtr<Structure> structure, PassRefPtr<HTMLD
 {
 }
 
-JSObject* JSHTMLDocument::createPrototype(ExecState* exec)
+JSObject* JSHTMLDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDocumentPrototype(JSHTMLDocumentPrototype::createStructure(JSDocumentPrototype::self(exec)));
+    return new (exec) JSHTMLDocumentPrototype(JSHTMLDocumentPrototype::createStructure(JSDocumentPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDocument::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,167 +165,183 @@ bool JSHTMLDocument::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSHTMLDocument, Base>(exec, &JSHTMLDocumentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDocumentEmbeds(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentEmbeds(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->embeds()));
 }
 
-JSValuePtr jsHTMLDocumentPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->plugins()));
 }
 
-JSValuePtr jsHTMLDocumentScripts(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentScripts(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->scripts()));
 }
 
-JSValuePtr jsHTMLDocumentAll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentAll(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->all(exec);
 }
 
-JSValuePtr jsHTMLDocumentWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLDocumentHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLDocumentDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->dir());
 }
 
-JSValuePtr jsHTMLDocumentDesignMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentDesignMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->designMode());
 }
 
-JSValuePtr jsHTMLDocumentCompatMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentCompatMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->compatMode());
 }
 
-JSValuePtr jsHTMLDocumentActiveElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentActiveElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->activeElement()));
 }
 
-JSValuePtr jsHTMLDocumentBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLDocumentFgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentFgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->fgColor());
 }
 
-JSValuePtr jsHTMLDocumentAlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentAlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alinkColor());
 }
 
-JSValuePtr jsHTMLDocumentLinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentLinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->linkColor());
 }
 
-JSValuePtr jsHTMLDocumentVlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentVlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vlinkColor());
 }
 
-JSValuePtr jsHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDocument::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDocument::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDocument, Base>(exec, propertyName, value, &JSHTMLDocumentTable, this, slot);
 }
 
-void setJSHTMLDocumentAll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentAll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLDocument*>(thisObject)->setAll(exec, value);
 }
 
-void setJSHTMLDocumentDir(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentDir(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setDir(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentDesignMode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentDesignMode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setDesignMode(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentFgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentFgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setFgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentAlinkColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentAlinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setAlinkColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentLinkColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentLinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setLinkColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentVlinkColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentVlinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setVlinkColor(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLDocument::getConstructor(ExecState* exec)
+JSValue JSHTMLDocument::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDocumentConstructor>(exec);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->open(exec, args);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -334,25 +350,28 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSObject*, JSVa
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionWrite(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWrite(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->write(exec, args);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionWriteln(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWriteln(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->writeln(exec, args);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -361,9 +380,10 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSObject*, JSVa
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -372,9 +392,10 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -383,15 +404,16 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionHasFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionHasFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasFocus());
+    JSC::JSValue result = jsBoolean(imp->hasFocus());
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
index 6fc4dc126e..3827df26cd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
@@ -31,40 +31,41 @@ class JSHTMLDocument : public JSDocument {
     typedef JSDocument Base;
 public:
     JSHTMLDocument(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDocument>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr all(JSC::ExecState*) const;
-    void setAll(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue all(JSC::ExecState*) const;
+    void setAll(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr open(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr write(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr writeln(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue write(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue writeln(JSC::ExecState*, const JSC::ArgList&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLDocument*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLDocumentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,40 +74,40 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionWrite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionWriteln(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionCaptureEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionHasFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWrite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWriteln(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionCaptureEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionHasFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLDocumentEmbeds(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentScripts(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentAll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentDesignMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentDesignMode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentCompatMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentActiveElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentFgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentFgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentAlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentAlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentLinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentLinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentVlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentVlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentEmbeds(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentScripts(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentAll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentDesignMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentDesignMode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentCompatMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentActiveElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentFgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentFgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentAlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentAlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentLinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentLinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentVlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentVlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
index 40d74ac79f..64533948d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLElement);
 
 /* Hash table */
 
@@ -88,13 +88,13 @@ public:
     JSHTMLElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,10 +109,8 @@ bool JSHTMLElementConstructor::getOwnPropertySlot(ExecState* exec, const Identif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLElementPrototypeTableValues[6] =
+static const HashTableValue JSHTMLElementPrototypeTableValues[4] =
 {
-    { "blur", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionBlur, (intptr_t)0 },
-    { "focus", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionFocus, (intptr_t)0 },
     { "insertAdjacentElement", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentElement, (intptr_t)2 },
     { "insertAdjacentHTML", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentHTML, (intptr_t)2 },
     { "insertAdjacentText", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentText, (intptr_t)2 },
@@ -121,16 +119,16 @@ static const HashTableValue JSHTMLElementPrototypeTableValues[6] =
 
 static const HashTable JSHTMLElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSHTMLElementPrototypeTableValues, 0 };
+    { 3, JSHTMLElementPrototypeTableValues, 0 };
 #else
-    { 16, 15, JSHTMLElementPrototypeTableValues, 0 };
+    { 8, 7, JSHTMLElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLElementPrototype::s_info = { "HTMLElementPrototype", 0, &JSHTMLElementPrototypeTable, 0 };
 
-JSObject* JSHTMLElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLElement>(exec);
+    return getDOMPrototype<JSHTMLElement>(exec, globalObject);
 }
 
 bool JSHTMLElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,9 +143,9 @@ JSHTMLElement::JSHTMLElement(PassRefPtr<Structure> structure, PassRefPtr<HTMLEle
 {
 }
 
-JSObject* JSHTMLElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLElementPrototype(JSHTMLElementPrototype::createStructure(JSElementPrototype::self(exec)));
+    return new (exec) JSHTMLElementPrototype(JSHTMLElementPrototype::createStructure(JSElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -155,130 +153,143 @@ bool JSHTMLElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSHTMLElement, Base>(exec, &JSHTMLElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->id());
 }
 
-JSValuePtr jsHTMLElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->title());
 }
 
-JSValuePtr jsHTMLElementLang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementLang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lang());
 }
 
-JSValuePtr jsHTMLElementDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->dir());
 }
 
-JSValuePtr jsHTMLElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->className());
 }
 
-JSValuePtr jsHTMLElementTabIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementTabIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->tabIndex());
 }
 
-JSValuePtr jsHTMLElementInnerHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementInnerHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->innerHTML());
 }
 
-JSValuePtr jsHTMLElementInnerText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementInnerText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->innerText());
 }
 
-JSValuePtr jsHTMLElementOuterHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementOuterHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->outerHTML());
 }
 
-JSValuePtr jsHTMLElementOuterText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementOuterText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->outerText());
 }
 
-JSValuePtr jsHTMLElementChildren(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementChildren(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->children()));
 }
 
-JSValuePtr jsHTMLElementContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->contentEditable());
 }
 
-JSValuePtr jsHTMLElementIsContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementIsContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->isContentEditable());
 }
 
-JSValuePtr jsHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLElement, Base>(exec, propertyName, value, &JSHTMLElementTable, this, slot);
 }
 
-void setJSHTMLElementId(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     imp->setId(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementTitle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     imp->setTitle(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementLang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementLang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     imp->setLang(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementDir(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementDir(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     imp->setDir(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementClassName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementClassName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     imp->setClassName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementTabIndex(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementTabIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
-    imp->setTabIndex(value->toInt32(exec));
+    imp->setTabIndex(value.toInt32(exec));
 }
 
-void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -286,7 +297,7 @@ void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -294,7 +305,7 @@ void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -302,7 +313,7 @@ void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -310,88 +321,69 @@ void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementContentEditable(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementContentEditable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     imp->setContentEditable(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLElement::getConstructor(ExecState* exec)
+JSValue JSHTMLElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
-        return throwError(exec, TypeError);
-    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
-    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
-
-    imp->blur();
-    return jsUndefined();
-}
-
-JSValuePtr jsHTMLElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
-        return throwError(exec, TypeError);
-    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
-    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
-
-    imp->focus();
-    return jsUndefined();
-}
-
-JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& where = args.at(exec, 0)->toString(exec);
-    Element* element = toElement(args.at(exec, 1));
+    const UString& where = args.at(0).toString(exec);
+    Element* element = toElement(args.at(1));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertAdjacentElement(where, element, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertAdjacentElement(where, element, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentHTML(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentHTML(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& where = args.at(exec, 0)->toString(exec);
-    const UString& html = args.at(exec, 1)->toString(exec);
+    const UString& where = args.at(0).toString(exec);
+    const UString& html = args.at(1).toString(exec);
 
     imp->insertAdjacentHTML(where, html, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& where = args.at(exec, 0)->toString(exec);
-    const UString& text = args.at(exec, 1)->toString(exec);
+    const UString& where = args.at(0).toString(exec);
+    const UString& text = args.at(1).toString(exec);
 
     imp->insertAdjacentText(where, text, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-HTMLElement* toHTMLElement(JSC::JSValuePtr value)
+HTMLElement* toHTMLElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLElement::s_info) ? static_cast<JSHTMLElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLElement::s_info) ? static_cast<JSHTMLElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
index 34df6fa8ae..dda203f3c8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
@@ -31,35 +31,36 @@ class JSHTMLElement : public JSElement {
     typedef JSElement Base;
 public:
     JSHTMLElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLElement* impl() const
     {
         return static_cast<HTMLElement*>(Base::impl());
     }
 };
 
-HTMLElement* toHTMLElement(JSC::JSValuePtr);
+HTMLElement* toHTMLElement(JSC::JSValue);
 
 class JSHTMLElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,38 +69,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementLang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementLang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementTabIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementTabIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementInnerHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementInnerText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementInnerText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementOuterHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementOuterHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementOuterText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementOuterText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementChildren(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLElementContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementContentEditable(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementIsContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementLang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementLang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementTabIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementTabIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementInnerHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementInnerText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementInnerText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementOuterHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementOuterHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementOuterText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementOuterText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementChildren(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementContentEditable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementIsContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
index 9a7b60622a..ec19e83180 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLEmbedElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLEmbedElement);
 
 /* Hash table */
 
@@ -82,13 +82,13 @@ public:
     JSHTMLEmbedElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLEmbedElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLEmbedElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLEmbedElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +118,9 @@ static const HashTable JSHTMLEmbedElementPrototypeTable =
 
 const ClassInfo JSHTMLEmbedElementPrototype::s_info = { "HTMLEmbedElementPrototype", 0, &JSHTMLEmbedElementPrototypeTable, 0 };
 
-JSObject* JSHTMLEmbedElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLEmbedElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLEmbedElement>(exec);
+    return getDOMPrototype<JSHTMLEmbedElement>(exec, globalObject);
 }
 
 bool JSHTMLEmbedElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,9 +135,9 @@ JSHTMLEmbedElement::JSHTMLEmbedElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLEmbedElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLEmbedElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLEmbedElementPrototype(JSHTMLEmbedElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLEmbedElementPrototype(JSHTMLEmbedElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLEmbedElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,97 +151,104 @@ bool JSHTMLEmbedElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLEmbedElement, Base>(exec, &JSHTMLEmbedElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLEmbedElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLEmbedElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLEmbedElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLEmbedElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLEmbedElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLEmbedElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLEmbedElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLEmbedElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
     lookupPut<JSHTMLEmbedElement, Base>(exec, propertyName, value, &JSHTMLEmbedElementTable, this, slot);
 }
 
-void setJSHTMLEmbedElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLEmbedElement::getConstructor(ExecState* exec)
+JSValue JSHTMLEmbedElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLEmbedElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLEmbedElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLEmbedElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(asObject(thisValue));
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
@@ -250,7 +257,7 @@ JSValuePtr jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(ExecState* exec, JS
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
index c9f2f25199..defb587d0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
@@ -32,35 +32,36 @@ class JSHTMLEmbedElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLEmbedElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLEmbedElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLEmbedElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLEmbedElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,22 +70,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLEmbedElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
index 26afc14f5a..c1acb4ebf3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFieldSetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFieldSetElement);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSHTMLFieldSetElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFieldSetElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFieldSetElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFieldSetElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSHTMLFieldSetElementPrototypeTable =
 
 const ClassInfo JSHTMLFieldSetElementPrototype::s_info = { "HTMLFieldSetElementPrototype", 0, &JSHTMLFieldSetElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFieldSetElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFieldSetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFieldSetElement>(exec);
+    return getDOMPrototype<JSHTMLFieldSetElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLFieldSetElement::s_info = { "HTMLFieldSetElement", &JSHTMLElement::s_info, &JSHTMLFieldSetElementTable, 0 };
@@ -119,9 +119,9 @@ JSHTMLFieldSetElement::JSHTMLFieldSetElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLFieldSetElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFieldSetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFieldSetElementPrototype(JSHTMLFieldSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFieldSetElementPrototype(JSHTMLFieldSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFieldSetElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,23 +129,25 @@ bool JSHTMLFieldSetElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLFieldSetElement, Base>(exec, &JSHTMLFieldSetElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFieldSetElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLFieldSetElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSHTMLFieldSetElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFieldSetElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFieldSetElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
index b885d87257..fa6c56c15b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
@@ -31,23 +31,24 @@ class JSHTMLFieldSetElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFieldSetElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFieldSetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLFieldSetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLFieldSetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLFieldSetElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFieldSetElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFieldSetElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFieldSetElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
index da127cb390..9d9a493671 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFontElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFontElement);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSHTMLFontElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFontElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFontElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFontElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +108,9 @@ static const HashTable JSHTMLFontElementPrototypeTable =
 
 const ClassInfo JSHTMLFontElementPrototype::s_info = { "HTMLFontElementPrototype", 0, &JSHTMLFontElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFontElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFontElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFontElement>(exec);
+    return getDOMPrototype<JSHTMLFontElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLFontElement::s_info = { "HTMLFontElement", &JSHTMLElement::s_info, &JSHTMLFontElementTable, 0 };
@@ -120,9 +120,9 @@ JSHTMLFontElement::JSHTMLFontElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLFontElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFontElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFontElementPrototype(JSHTMLFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFontElementPrototype(JSHTMLFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,52 +130,55 @@ bool JSHTMLFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLFontElement, Base>(exec, &JSHTMLFontElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->color());
 }
 
-JSValuePtr jsHTMLFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->face());
 }
 
-JSValuePtr jsHTMLFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->size());
 }
 
-JSValuePtr jsHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFontElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFontElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFontElement, Base>(exec, propertyName, value, &JSHTMLFontElementTable, this, slot);
 }
 
-void setJSHTMLFontElementColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFontElementColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
     imp->setColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFontElementFace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFontElementFace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
     imp->setFace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFontElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFontElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
     imp->setSize(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLFontElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFontElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFontElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
index 6c38b3bdd1..c53d90aa48 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
@@ -31,24 +31,25 @@ class JSHTMLFontElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFontElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFontElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLFontElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLFontElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,13 +57,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
index 170ea74ed6..d172404af6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFormElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFormElement);
 
 /* Hash table */
 
@@ -84,13 +84,13 @@ public:
     JSHTMLFormElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFormElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFormElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFormElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -121,9 +121,9 @@ static const HashTable JSHTMLFormElementPrototypeTable =
 
 const ClassInfo JSHTMLFormElementPrototype::s_info = { "HTMLFormElementPrototype", 0, &JSHTMLFormElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFormElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFormElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFormElement>(exec);
+    return getDOMPrototype<JSHTMLFormElement>(exec, globalObject);
 }
 
 bool JSHTMLFormElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,13 +138,19 @@ JSHTMLFormElement::JSHTMLFormElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLFormElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFormElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFormElementPrototype(JSHTMLFormElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFormElementPrototype(JSHTMLFormElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFormElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<HTMLFormElement*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
     if (canGetItemsForName(exec, static_cast<HTMLFormElement*>(impl()), propertyName)) {
         slot.setCustom(this, nameGetter);
         return true;
@@ -154,115 +160,118 @@ bool JSHTMLFormElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
         slot.setCustom(this, entry->propertyGetter());
         return true;
     }
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<HTMLFormElement*>(impl())->length()) {
-        slot.setCustomIndex(this, index, indexGetter);
-        return true;
-    }
     return getStaticValueSlot<JSHTMLFormElement, Base>(exec, &JSHTMLFormElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFormElementElements(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementElements(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->elements()));
 }
 
-JSValuePtr jsHTMLFormElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsHTMLFormElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLFormElementAcceptCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementAcceptCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->acceptCharset());
 }
 
-JSValuePtr jsHTMLFormElementAction(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementAction(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->action());
 }
 
-JSValuePtr jsHTMLFormElementEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->encoding());
 }
 
-JSValuePtr jsHTMLFormElementEnctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementEnctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->enctype());
 }
 
-JSValuePtr jsHTMLFormElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->method());
 }
 
-JSValuePtr jsHTMLFormElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFormElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFormElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFormElement, Base>(exec, propertyName, value, &JSHTMLFormElementTable, this, slot);
 }
 
-void setJSHTMLFormElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementAcceptCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementAcceptCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setAcceptCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementAction(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementAction(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setAction(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementEncoding(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementEncoding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setEncoding(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementEnctype(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementEnctype(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setEnctype(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementMethod(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementMethod(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setMethod(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
@@ -275,25 +284,24 @@ void JSHTMLFormElement::getPropertyNames(ExecState* exec, PropertyNameArray& pro
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSHTMLFormElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFormElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFormElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLFormElementPrototypeFunctionSubmit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionSubmit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLFormElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLFormElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(asObject(thisValue));
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
-
-    imp->submit();
-    return jsUndefined();
+    return castedThisObj->submit(exec, args);
 }
 
-JSValuePtr jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLFormElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLFormElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(asObject(thisValue));
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
@@ -303,7 +311,7 @@ JSValuePtr jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, JSObject*, J
 }
 
 
-JSValuePtr JSHTMLFormElement::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFormElement* thisObj = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<HTMLFormElement*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
index e15612622d..b44e6db04b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
@@ -31,33 +31,37 @@ class JSHTMLFormElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFormElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFormElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+
+    // Custom functions
+    JSC::JSValue submit(JSC::ExecState*, const JSC::ArgList&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFormElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLFormElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -66,27 +70,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLFormElementPrototypeFunctionSubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLFormElementPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionSubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLFormElementElements(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFormElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFormElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementAcceptCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementAcceptCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementAction(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementAction(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementEnctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementEnctype(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementMethod(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementElements(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementAcceptCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementAcceptCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementAction(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementAction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementEnctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementEnctype(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementMethod(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
index 8db4416bdb..bf6fb63c62 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
@@ -42,7 +42,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameElement);
 
 /* Hash table */
 
@@ -91,13 +91,13 @@ public:
     JSHTMLFrameElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFrameElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFrameElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFrameElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -127,9 +127,9 @@ static const HashTable JSHTMLFrameElementPrototypeTable =
 
 const ClassInfo JSHTMLFrameElementPrototype::s_info = { "HTMLFrameElementPrototype", 0, &JSHTMLFrameElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFrameElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFrameElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFrameElement>(exec);
+    return getDOMPrototype<JSHTMLFrameElement>(exec, globalObject);
 }
 
 bool JSHTMLFrameElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,9 +144,9 @@ JSHTMLFrameElement::JSHTMLFrameElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLFrameElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFrameElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFrameElementPrototype(JSHTMLFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFrameElementPrototype(JSHTMLFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,153 +154,166 @@ bool JSHTMLFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLFrameElement, Base>(exec, &JSHTMLFrameElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->frameBorder());
 }
 
-JSValuePtr jsHTMLFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->longDesc());
 }
 
-JSValuePtr jsHTMLFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginHeight());
 }
 
-JSValuePtr jsHTMLFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginWidth());
 }
 
-JSValuePtr jsHTMLFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLFrameElementNoResize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementNoResize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noResize());
 }
 
-JSValuePtr jsHTMLFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scrolling());
 }
 
-JSValuePtr jsHTMLFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValuePtr jsHTMLFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->contentWindow()));
 }
 
-JSValuePtr jsHTMLFrameElementLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->location());
 }
 
-JSValuePtr jsHTMLFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFrameElement, Base>(exec, propertyName, value, &JSHTMLFrameElementTable, this, slot);
 }
 
-void setJSHTMLFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setFrameBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setLongDesc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setMarginHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setMarginWidth(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementNoResize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementNoResize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setNoResize(value->toBoolean(exec));
+    imp->setNoResize(value.toBoolean(exec));
 }
 
-void setJSHTMLFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setScrolling(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLFrameElement*>(thisObject)->setSrc(exec, value);
 }
 
-void setJSHTMLFrameElementLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLFrameElement*>(thisObject)->setLocation(exec, value);
 }
 
-JSValuePtr JSHTMLFrameElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFrameElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFrameElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLFrameElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLFrameElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(asObject(thisValue));
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
@@ -309,7 +322,7 @@ JSValuePtr jsHTMLFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JS
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
index 06e272ad40..573ff5298d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
@@ -31,32 +31,33 @@ class JSHTMLFrameElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFrameElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFrameElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    void setSrc(JSC::ExecState*, JSC::JSValuePtr);
-    void setLocation(JSC::ExecState*, JSC::JSValuePtr);
+    void setSrc(JSC::ExecState*, JSC::JSValue);
+    void setLocation(JSC::ExecState*, JSC::JSValue);
 };
 
 
 class JSHTMLFrameElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -65,32 +66,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementNoResize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementNoResize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementNoResize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementNoResize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
index c2563b9cf3..e53caa6546 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameSetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameSetElement);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSHTMLFrameSetElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFrameSetElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFrameSetElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFrameSetElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +108,9 @@ static const HashTable JSHTMLFrameSetElementPrototypeTable =
 
 const ClassInfo JSHTMLFrameSetElementPrototype::s_info = { "HTMLFrameSetElementPrototype", 0, &JSHTMLFrameSetElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFrameSetElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFrameSetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFrameSetElement>(exec);
+    return getDOMPrototype<JSHTMLFrameSetElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLFrameSetElement::s_info = { "HTMLFrameSetElement", &JSHTMLElement::s_info, &JSHTMLFrameSetElementTable, 0 };
@@ -120,9 +120,9 @@ JSHTMLFrameSetElement::JSHTMLFrameSetElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLFrameSetElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFrameSetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFrameSetElementPrototype(JSHTMLFrameSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFrameSetElementPrototype(JSHTMLFrameSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFrameSetElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,40 +134,42 @@ bool JSHTMLFrameSetElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLFrameSetElement, Base>(exec, &JSHTMLFrameSetElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFrameSetElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cols());
 }
 
-JSValuePtr jsHTMLFrameSetElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rows());
 }
 
-JSValuePtr jsHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFrameSetElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFrameSetElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFrameSetElement, Base>(exec, propertyName, value, &JSHTMLFrameSetElementTable, this, slot);
 }
 
-void setJSHTMLFrameSetElementCols(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameSetElementCols(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
     imp->setCols(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameSetElementRows(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameSetElementRows(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
     imp->setRows(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLFrameSetElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFrameSetElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFrameSetElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
index dac7e54cef..ddf3e50ca8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
@@ -31,27 +31,28 @@ class JSHTMLFrameSetElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFrameSetElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFrameSetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFrameSetElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLFrameSetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLFrameSetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -59,11 +60,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLFrameSetElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameSetElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameSetElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameSetElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
index 1432abfc41..15defbc26f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHRElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHRElement);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSHTMLHRElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHRElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHRElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHRElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSHTMLHRElementPrototypeTable =
 
 const ClassInfo JSHTMLHRElementPrototype::s_info = { "HTMLHRElementPrototype", 0, &JSHTMLHRElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHRElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHRElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHRElement>(exec);
+    return getDOMPrototype<JSHTMLHRElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHRElement::s_info = { "HTMLHRElement", &JSHTMLElement::s_info, &JSHTMLHRElementTable, 0 };
@@ -121,9 +121,9 @@ JSHTMLHRElement::JSHTMLHRElement(PassRefPtr<Structure> structure, PassRefPtr<HTM
 {
 }
 
-JSObject* JSHTMLHRElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHRElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHRElementPrototype(JSHTMLHRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHRElementPrototype(JSHTMLHRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHRElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,64 +131,68 @@ bool JSHTMLHRElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLHRElement, Base>(exec, &JSHTMLHRElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHRElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLHRElementNoShade(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementNoShade(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noShade());
 }
 
-JSValuePtr jsHTMLHRElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->size());
 }
 
-JSValuePtr jsHTMLHRElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHRElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHRElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHRElement, Base>(exec, propertyName, value, &JSHTMLHRElementTable, this, slot);
 }
 
-void setJSHTMLHRElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLHRElementNoShade(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementNoShade(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
-    imp->setNoShade(value->toBoolean(exec));
+    imp->setNoShade(value.toBoolean(exec));
 }
 
-void setJSHTMLHRElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
     imp->setSize(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLHRElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHRElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHRElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHRElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
index bd8c3614f6..fb624404ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
@@ -31,24 +31,25 @@ class JSHTMLHRElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHRElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHRElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHRElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHRElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,15 +57,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHRElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementNoShade(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementNoShade(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHRElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementNoShade(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementNoShade(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
index 9c7af5c40a..859dfbe94b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLHeadElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHeadElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHeadElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHeadElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLHeadElementPrototypeTable =
 
 const ClassInfo JSHTMLHeadElementPrototype::s_info = { "HTMLHeadElementPrototype", 0, &JSHTMLHeadElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHeadElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHeadElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHeadElement>(exec);
+    return getDOMPrototype<JSHTMLHeadElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHeadElement::s_info = { "HTMLHeadElement", &JSHTMLElement::s_info, &JSHTMLHeadElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLHeadElement::JSHTMLHeadElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLHeadElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHeadElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHeadElementPrototype(JSHTMLHeadElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHeadElementPrototype(JSHTMLHeadElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHeadElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLHeadElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLHeadElement, Base>(exec, &JSHTMLHeadElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHeadElementProfile(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadElementProfile(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHeadElement* imp = static_cast<HTMLHeadElement*>(static_cast<JSHTMLHeadElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->profile());
 }
 
-JSValuePtr jsHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHeadElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHeadElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHeadElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHeadElement, Base>(exec, propertyName, value, &JSHTMLHeadElementTable, this, slot);
 }
 
-void setJSHTMLHeadElementProfile(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHeadElementProfile(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHeadElement* imp = static_cast<HTMLHeadElement*>(static_cast<JSHTMLHeadElement*>(thisObject)->impl());
     imp->setProfile(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHeadElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHeadElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHeadElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
index 8995d290e7..b63b31767f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
@@ -31,24 +31,25 @@ class JSHTMLHeadElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHeadElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHeadElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHeadElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHeadElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHeadElementProfile(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHeadElementProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadElementProfile(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHeadElementProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
index 0ac8d7afbd..28fe537af9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadingElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadingElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLHeadingElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHeadingElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHeadingElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHeadingElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLHeadingElementPrototypeTable =
 
 const ClassInfo JSHTMLHeadingElementPrototype::s_info = { "HTMLHeadingElementPrototype", 0, &JSHTMLHeadingElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHeadingElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHeadingElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHeadingElement>(exec);
+    return getDOMPrototype<JSHTMLHeadingElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHeadingElement::s_info = { "HTMLHeadingElement", &JSHTMLElement::s_info, &JSHTMLHeadingElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLHeadingElement::JSHTMLHeadingElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSHTMLHeadingElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHeadingElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHeadingElementPrototype(JSHTMLHeadingElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHeadingElementPrototype(JSHTMLHeadingElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHeadingElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLHeadingElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLHeadingElement, Base>(exec, &JSHTMLHeadingElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHeadingElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadingElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHeadingElement* imp = static_cast<HTMLHeadingElement*>(static_cast<JSHTMLHeadingElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHeadingElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHeadingElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHeadingElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHeadingElement, Base>(exec, propertyName, value, &JSHTMLHeadingElementTable, this, slot);
 }
 
-void setJSHTMLHeadingElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHeadingElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHeadingElement* imp = static_cast<HTMLHeadingElement*>(static_cast<JSHTMLHeadingElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHeadingElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHeadingElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHeadingElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
index 0120cb4828..a5fdd87c25 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
@@ -31,24 +31,25 @@ class JSHTMLHeadingElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHeadingElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHeadingElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHeadingElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHeadingElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHeadingElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHeadingElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadingElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHeadingElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
index 170640e445..18dc8ebc01 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHtmlElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHtmlElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLHtmlElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHtmlElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHtmlElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHtmlElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLHtmlElementPrototypeTable =
 
 const ClassInfo JSHTMLHtmlElementPrototype::s_info = { "HTMLHtmlElementPrototype", 0, &JSHTMLHtmlElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHtmlElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHtmlElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHtmlElement>(exec);
+    return getDOMPrototype<JSHTMLHtmlElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHtmlElement::s_info = { "HTMLHtmlElement", &JSHTMLElement::s_info, &JSHTMLHtmlElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLHtmlElement::JSHTMLHtmlElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLHtmlElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHtmlElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHtmlElementPrototype(JSHTMLHtmlElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHtmlElementPrototype(JSHTMLHtmlElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHtmlElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLHtmlElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLHtmlElement, Base>(exec, &JSHTMLHtmlElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHtmlElementVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHtmlElementVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHtmlElement* imp = static_cast<HTMLHtmlElement*>(static_cast<JSHTMLHtmlElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->version());
 }
 
-JSValuePtr jsHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHtmlElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHtmlElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHtmlElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHtmlElement, Base>(exec, propertyName, value, &JSHTMLHtmlElementTable, this, slot);
 }
 
-void setJSHTMLHtmlElementVersion(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHtmlElementVersion(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHtmlElement* imp = static_cast<HTMLHtmlElement*>(static_cast<JSHTMLHtmlElement*>(thisObject)->impl());
     imp->setVersion(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHtmlElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHtmlElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHtmlElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
index a5730377e9..b9e49c782f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
@@ -31,24 +31,25 @@ class JSHTMLHtmlElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHtmlElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHtmlElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHtmlElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHtmlElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHtmlElementVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHtmlElementVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHtmlElementVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHtmlElementVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
index b8fae772e4..e60f814c7c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
@@ -42,7 +42,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLIFrameElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLIFrameElement);
 
 /* Hash table */
 
@@ -90,13 +90,13 @@ public:
     JSHTMLIFrameElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLIFrameElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLIFrameElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLIFrameElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +126,9 @@ static const HashTable JSHTMLIFrameElementPrototypeTable =
 
 const ClassInfo JSHTMLIFrameElementPrototype::s_info = { "HTMLIFrameElementPrototype", 0, &JSHTMLIFrameElementPrototypeTable, 0 };
 
-JSObject* JSHTMLIFrameElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLIFrameElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLIFrameElement>(exec);
+    return getDOMPrototype<JSHTMLIFrameElement>(exec, globalObject);
 }
 
 bool JSHTMLIFrameElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +143,9 @@ JSHTMLIFrameElement::JSHTMLIFrameElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLIFrameElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLIFrameElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLIFrameElementPrototype(JSHTMLIFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLIFrameElementPrototype(JSHTMLIFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLIFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,154 +153,166 @@ bool JSHTMLIFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLIFrameElement, Base>(exec, &JSHTMLIFrameElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLIFrameElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLIFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->frameBorder());
 }
 
-JSValuePtr jsHTMLIFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLIFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->longDesc());
 }
 
-JSValuePtr jsHTMLIFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginHeight());
 }
 
-JSValuePtr jsHTMLIFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginWidth());
 }
 
-JSValuePtr jsHTMLIFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLIFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scrolling());
 }
 
-JSValuePtr jsHTMLIFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLIFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLIFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValuePtr jsHTMLIFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->contentWindow()));
 }
 
-JSValuePtr jsHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLIFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLIFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLIFrameElement, Base>(exec, propertyName, value, &JSHTMLIFrameElementTable, this, slot);
 }
 
-void setJSHTMLIFrameElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setFrameBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setLongDesc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setMarginHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setMarginWidth(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setScrolling(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLIFrameElement*>(thisObject)->setSrc(exec, value);
 }
 
-void setJSHTMLIFrameElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLIFrameElement::getConstructor(ExecState* exec)
+JSValue JSHTMLIFrameElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLIFrameElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLIFrameElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLIFrameElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(asObject(thisValue));
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
@@ -309,7 +321,7 @@ JSValuePtr jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, J
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
index c31fdb2811..158ae70680 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
@@ -31,31 +31,32 @@ class JSHTMLIFrameElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLIFrameElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLIFrameElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    void setSrc(JSC::ExecState*, JSC::JSValuePtr);
+    void setSrc(JSC::ExecState*, JSC::JSValue);
 };
 
 
 class JSHTMLIFrameElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,32 +65,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLIFrameElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLIFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
index 0d4af9ce10..2d985eebe5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLImageElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLImageElement);
 
 /* Hash table */
 
@@ -88,13 +88,13 @@ public:
     JSHTMLImageElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLImageElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -123,9 +123,9 @@ static const HashTable JSHTMLImageElementPrototypeTable =
 
 const ClassInfo JSHTMLImageElementPrototype::s_info = { "HTMLImageElementPrototype", 0, &JSHTMLImageElementPrototypeTable, 0 };
 
-JSObject* JSHTMLImageElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLImageElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLImageElement>(exec);
+    return getDOMPrototype<JSHTMLImageElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLImageElement::s_info = { "HTMLImageElement", &JSHTMLElement::s_info, &JSHTMLImageElementTable, 0 };
@@ -135,9 +135,9 @@ JSHTMLImageElement::JSHTMLImageElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLImageElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLImageElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLImageElementPrototype(JSHTMLImageElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLImageElementPrototype(JSHTMLImageElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,202 +145,220 @@ bool JSHTMLImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLImageElement, Base>(exec, &JSHTMLImageElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLImageElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLImageElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLImageElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alt());
 }
 
-JSValuePtr jsHTMLImageElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->border());
 }
 
-JSValuePtr jsHTMLImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLImageElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->hspace());
 }
 
-JSValuePtr jsHTMLImageElementIsMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementIsMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->isMap());
 }
 
-JSValuePtr jsHTMLImageElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->longDesc());
 }
 
-JSValuePtr jsHTMLImageElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLImageElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->useMap());
 }
 
-JSValuePtr jsHTMLImageElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->vspace());
 }
 
-JSValuePtr jsHTMLImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLImageElementComplete(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementComplete(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->complete());
 }
 
-JSValuePtr jsHTMLImageElementLowsrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementLowsrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lowsrc());
 }
 
-JSValuePtr jsHTMLImageElementNaturalHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementNaturalHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->naturalHeight());
 }
 
-JSValuePtr jsHTMLImageElementNaturalWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementNaturalWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->naturalWidth());
 }
 
-JSValuePtr jsHTMLImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsHTMLImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLImageElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLImageElement, Base>(exec, propertyName, value, &JSHTMLImageElementTable, this, slot);
 }
 
-void setJSHTMLImageElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setHeight(value->toInt32(exec));
+    imp->setHeight(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementHspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setHspace(value->toInt32(exec));
+    imp->setHspace(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementIsMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementIsMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setIsMap(value->toBoolean(exec));
+    imp->setIsMap(value.toBoolean(exec));
 }
 
-void setJSHTMLImageElementLongDesc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setLongDesc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementUseMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setUseMap(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementVspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setVspace(value->toInt32(exec));
+    imp->setVspace(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementLowsrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementLowsrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
     imp->setLowsrc(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLImageElement::getConstructor(ExecState* exec)
+JSValue JSHTMLImageElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLImageElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
index f4d8de171d..d24fda0302 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
@@ -31,24 +31,25 @@ class JSHTMLImageElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLImageElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLImageElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLImageElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLImageElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,38 +57,38 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLImageElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementIsMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementIsMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementComplete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementLowsrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementLowsrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementNaturalHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementNaturalWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementIsMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementIsMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementComplete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementLowsrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementLowsrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementNaturalHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementNaturalWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
index 2ed990d450..5b241b3782 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
@@ -39,11 +39,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLInputElementTableValues[25] =
+static const HashTableValue JSHTMLInputElementTableValues[27] =
 {
     { "defaultValue", DontDelete, (intptr_t)jsHTMLInputElementDefaultValue, (intptr_t)setJSHTMLInputElementDefaultValue },
     { "defaultChecked", DontDelete, (intptr_t)jsHTMLInputElementDefaultChecked, (intptr_t)setJSHTMLInputElementDefaultChecked },
@@ -56,7 +56,9 @@ static const HashTableValue JSHTMLInputElementTableValues[25] =
     { "disabled", DontDelete, (intptr_t)jsHTMLInputElementDisabled, (intptr_t)setJSHTMLInputElementDisabled },
     { "autofocus", DontDelete, (intptr_t)jsHTMLInputElementAutofocus, (intptr_t)setJSHTMLInputElementAutofocus },
     { "maxLength", DontDelete, (intptr_t)jsHTMLInputElementMaxLength, (intptr_t)setJSHTMLInputElementMaxLength },
+    { "multiple", DontDelete, (intptr_t)jsHTMLInputElementMultiple, (intptr_t)setJSHTMLInputElementMultiple },
     { "name", DontDelete, (intptr_t)jsHTMLInputElementName, (intptr_t)setJSHTMLInputElementName },
+    { "placeholder", DontDelete, (intptr_t)jsHTMLInputElementPlaceholder, (intptr_t)setJSHTMLInputElementPlaceholder },
     { "readOnly", DontDelete, (intptr_t)jsHTMLInputElementReadOnly, (intptr_t)setJSHTMLInputElementReadOnly },
     { "size", DontDelete, (intptr_t)jsHTMLInputElementSize, (intptr_t)setJSHTMLInputElementSize },
     { "src", DontDelete, (intptr_t)jsHTMLInputElementSrc, (intptr_t)setJSHTMLInputElementSrc },
@@ -76,7 +78,7 @@ static const HashTable JSHTMLInputElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSHTMLInputElementTableValues, 0 };
 #else
-    { 69, 63, JSHTMLInputElementTableValues, 0 };
+    { 70, 63, JSHTMLInputElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -98,13 +100,13 @@ public:
     JSHTMLInputElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLInputElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLInputElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLInputElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -136,9 +138,9 @@ static const HashTable JSHTMLInputElementPrototypeTable =
 
 const ClassInfo JSHTMLInputElementPrototype::s_info = { "HTMLInputElementPrototype", 0, &JSHTMLInputElementPrototypeTable, 0 };
 
-JSObject* JSHTMLInputElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLInputElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLInputElement>(exec);
+    return getDOMPrototype<JSHTMLInputElement>(exec, globalObject);
 }
 
 bool JSHTMLInputElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,291 +155,333 @@ JSHTMLInputElement::JSHTMLInputElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLInputElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLInputElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLInputElementPrototype(JSHTMLInputElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLInputElementPrototype(JSHTMLInputElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLInputElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
-        return true;
     return getStaticValueSlot<JSHTMLInputElement, Base>(exec, &JSHTMLInputElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLInputElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultValue());
 }
 
-JSValuePtr jsHTMLInputElementDefaultChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDefaultChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->defaultChecked());
 }
 
-JSValuePtr jsHTMLInputElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLInputElementAccept(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAccept(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accept());
 }
 
-JSValuePtr jsHTMLInputElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLInputElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLInputElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alt());
 }
 
-JSValuePtr jsHTMLInputElementChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->checked());
 }
 
-JSValuePtr jsHTMLInputElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLInputElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->maxLength());
 }
 
-JSValuePtr jsHTMLInputElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->multiple());
+}
+
+JSValue jsHTMLInputElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLInputElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementPlaceholder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->placeholder());
+}
+
+JSValue jsHTMLInputElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->readOnly());
 }
 
-JSValuePtr jsHTMLInputElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->size());
 }
 
-JSValuePtr jsHTMLInputElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLInputElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->type());
+    return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->type(exec);
 }
 
-JSValuePtr jsHTMLInputElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->useMap());
 }
 
-JSValuePtr jsHTMLInputElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLInputElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLInputElementIndeterminate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementIndeterminate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->indeterminate());
 }
 
-JSValuePtr jsHTMLInputElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->selectionStart(exec);
 }
 
-JSValuePtr jsHTMLInputElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->selectionEnd(exec);
 }
 
-JSValuePtr jsHTMLInputElementFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->files()));
 }
 
-JSValuePtr jsHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLInputElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLInputElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLInputElement, Base>(exec, propertyName, value, &JSHTMLInputElementTable, this, slot);
 }
 
-void setJSHTMLInputElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setDefaultValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementDefaultChecked(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementDefaultChecked(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setDefaultChecked(value->toBoolean(exec));
+    imp->setDefaultChecked(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementAccept(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAccept(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAccept(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementChecked(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementChecked(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setChecked(value.toBoolean(exec));
+}
+
+void setJSHTMLInputElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setChecked(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setMaxLength(value.toInt32(exec));
 }
 
-void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setMaxLength(value->toInt32(exec));
+    imp->setMultiple(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementReadOnly(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementPlaceholder(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setPlaceholder(value.toString(exec));
+}
+
+void setJSHTMLInputElementReadOnly(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setReadOnly(value->toBoolean(exec));
+    imp->setReadOnly(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setSize(value->toInt32(exec));
+    imp->setSize(value.toInt32(exec));
 }
 
-void setJSHTMLInputElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementUseMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setUseMap(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementIndeterminate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementIndeterminate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setIndeterminate(value->toBoolean(exec));
+    imp->setIndeterminate(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setSelectionStart(value->toInt32(exec));
+    static_cast<JSHTMLInputElement*>(thisObject)->setSelectionStart(exec, value);
 }
 
-void setJSHTMLInputElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setSelectionEnd(value->toInt32(exec));
+    static_cast<JSHTMLInputElement*>(thisObject)->setSelectionEnd(exec, value);
 }
 
-JSValuePtr JSHTMLInputElement::getConstructor(ExecState* exec)
+JSValue JSHTMLInputElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLInputElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLInputElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
@@ -446,9 +490,10 @@ JSValuePtr jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec, JSObject*,
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLInputElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLInputElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
@@ -457,17 +502,13 @@ JSValuePtr jsHTMLInputElementPrototypeFunctionClick(ExecState* exec, JSObject*,
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLInputElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLInputElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
-    int start = args.at(exec, 0)->toInt32(exec);
-    int end = args.at(exec, 1)->toInt32(exec);
-
-    imp->setSelectionRange(start, end);
-    return jsUndefined();
+    return castedThisObj->setSelectionRange(exec, args);
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
index 4722fe893f..ef9431c46b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
@@ -31,33 +31,39 @@ class JSHTMLInputElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLInputElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLInputElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr selectionStart(JSC::ExecState*) const;
-    JSC::JSValuePtr selectionEnd(JSC::ExecState*) const;
+    JSC::JSValue type(JSC::ExecState*) const;
+    JSC::JSValue selectionStart(JSC::ExecState*) const;
+    void setSelectionStart(JSC::ExecState*, JSC::JSValue);
+    JSC::JSValue selectionEnd(JSC::ExecState*) const;
+    void setSelectionEnd(JSC::ExecState*, JSC::JSValue);
+
+    // Custom functions
+    JSC::JSValue setSelectionRange(JSC::ExecState*, const JSC::ArgList&);
 };
 
 
 class JSHTMLInputElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -66,55 +72,59 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLInputElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLInputElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLInputElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLInputElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementDefaultChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementDefaultChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLInputElementAccept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAccept(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLInputElementIndeterminate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementIndeterminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementDefaultChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementDefaultChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementAccept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAccept(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementPlaceholder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementPlaceholder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementIndeterminate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementIndeterminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
index 2c1aec018d..f8dee4f3df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLIsIndexElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLIsIndexElement);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSHTMLIsIndexElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLIsIndexElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLIsIndexElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLIsIndexElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSHTMLIsIndexElementPrototypeTable =
 
 const ClassInfo JSHTMLIsIndexElementPrototype::s_info = { "HTMLIsIndexElementPrototype", 0, &JSHTMLIsIndexElementPrototypeTable, 0 };
 
-JSObject* JSHTMLIsIndexElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLIsIndexElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLIsIndexElement>(exec);
+    return getDOMPrototype<JSHTMLIsIndexElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLIsIndexElement::s_info = { "HTMLIsIndexElement", &JSHTMLInputElement::s_info, &JSHTMLIsIndexElementTable, 0 };
@@ -121,9 +121,9 @@ JSHTMLIsIndexElement::JSHTMLIsIndexElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSHTMLIsIndexElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLIsIndexElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLIsIndexElementPrototype(JSHTMLIsIndexElementPrototype::createStructure(JSHTMLInputElementPrototype::self(exec)));
+    return new (exec) JSHTMLIsIndexElementPrototype(JSHTMLIsIndexElementPrototype::createStructure(JSHTMLInputElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLIsIndexElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,34 +131,36 @@ bool JSHTMLIsIndexElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLIsIndexElement, Base>(exec, &JSHTMLIsIndexElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLIsIndexElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLIsIndexElementPrompt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementPrompt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->prompt());
 }
 
-JSValuePtr jsHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLIsIndexElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLIsIndexElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLIsIndexElement, Base>(exec, propertyName, value, &JSHTMLIsIndexElementTable, this, slot);
 }
 
-void setJSHTMLIsIndexElementPrompt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIsIndexElementPrompt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(static_cast<JSHTMLIsIndexElement*>(thisObject)->impl());
     imp->setPrompt(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLIsIndexElement::getConstructor(ExecState* exec)
+JSValue JSHTMLIsIndexElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLIsIndexElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
index a75c4d4656..a4a3363c27 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
@@ -31,24 +31,25 @@ class JSHTMLIsIndexElement : public JSHTMLInputElement {
     typedef JSHTMLInputElement Base;
 public:
     JSHTMLIsIndexElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLIsIndexElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLIsIndexElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLIsIndexElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLIsIndexElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLIsIndexElementPrompt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIsIndexElementPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIsIndexElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIsIndexElementPrompt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIsIndexElementPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
index f316107cef..8d3a2b834a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLIElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLIElement);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSHTMLLIElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLIElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLIElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLIElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSHTMLLIElementPrototypeTable =
 
 const ClassInfo JSHTMLLIElementPrototype::s_info = { "HTMLLIElementPrototype", 0, &JSHTMLLIElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLIElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLIElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLIElement>(exec);
+    return getDOMPrototype<JSHTMLLIElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLIElement::s_info = { "HTMLLIElement", &JSHTMLElement::s_info, &JSHTMLLIElementTable, 0 };
@@ -119,9 +119,9 @@ JSHTMLLIElement::JSHTMLLIElement(PassRefPtr<Structure> structure, PassRefPtr<HTM
 {
 }
 
-JSObject* JSHTMLLIElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLIElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLIElementPrototype(JSHTMLLIElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLIElementPrototype(JSHTMLLIElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLIElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +129,42 @@ bool JSHTMLLIElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLLIElement, Base>(exec, &JSHTMLLIElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLIElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLLIElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->value());
 }
 
-JSValuePtr jsHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLIElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLIElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLIElement, Base>(exec, propertyName, value, &JSHTMLLIElementTable, this, slot);
 }
 
-void setJSHTMLLIElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLIElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLIElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLIElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(thisObject)->impl());
-    imp->setValue(value->toInt32(exec));
+    imp->setValue(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLLIElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLIElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLIElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
index 2d592ad1ab..1c3ffcd2f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
@@ -31,24 +31,25 @@ class JSHTMLLIElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLIElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLIElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLIElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLIElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLIElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLIElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLIElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLIElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLIElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLIElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLIElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLIElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
index e646dc09bc..90a93b37d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLabelElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLabelElement);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSHTMLLabelElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLabelElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLabelElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLabelElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +110,9 @@ static const HashTable JSHTMLLabelElementPrototypeTable =
 
 const ClassInfo JSHTMLLabelElementPrototype::s_info = { "HTMLLabelElementPrototype", 0, &JSHTMLLabelElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLabelElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLabelElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLabelElement>(exec);
+    return getDOMPrototype<JSHTMLLabelElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLabelElement::s_info = { "HTMLLabelElement", &JSHTMLElement::s_info, &JSHTMLLabelElementTable, 0 };
@@ -122,9 +122,9 @@ JSHTMLLabelElement::JSHTMLLabelElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLLabelElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLabelElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLabelElementPrototype(JSHTMLLabelElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLabelElementPrototype(JSHTMLLabelElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLabelElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,46 +132,49 @@ bool JSHTMLLabelElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLLabelElement, Base>(exec, &JSHTMLLabelElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLabelElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLLabelElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLLabelElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->htmlFor());
 }
 
-JSValuePtr jsHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLabelElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLabelElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLabelElement, Base>(exec, propertyName, value, &JSHTMLLabelElementTable, this, slot);
 }
 
-void setJSHTMLLabelElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLabelElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLabelElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLabelElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(thisObject)->impl());
     imp->setHtmlFor(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLLabelElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLabelElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLabelElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
index 63e96cb931..32eb0569be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
@@ -31,24 +31,25 @@ class JSHTMLLabelElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLabelElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLabelElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLabelElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLabelElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,12 +57,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLabelElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLLabelElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLabelElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLabelElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLabelElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLabelElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLabelElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLabelElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLabelElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLabelElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
index 55d7ffee6b..73dcc8a5b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLegendElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLegendElement);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSHTMLLegendElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLegendElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLegendElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLegendElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +110,9 @@ static const HashTable JSHTMLLegendElementPrototypeTable =
 
 const ClassInfo JSHTMLLegendElementPrototype::s_info = { "HTMLLegendElementPrototype", 0, &JSHTMLLegendElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLegendElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLegendElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLegendElement>(exec);
+    return getDOMPrototype<JSHTMLLegendElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLegendElement::s_info = { "HTMLLegendElement", &JSHTMLElement::s_info, &JSHTMLLegendElementTable, 0 };
@@ -122,9 +122,9 @@ JSHTMLLegendElement::JSHTMLLegendElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLLegendElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLegendElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLegendElementPrototype(JSHTMLLegendElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLegendElementPrototype(JSHTMLLegendElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLegendElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,46 +132,49 @@ bool JSHTMLLegendElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLLegendElement, Base>(exec, &JSHTMLLegendElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLegendElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLLegendElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLLegendElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLegendElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLegendElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLegendElement, Base>(exec, propertyName, value, &JSHTMLLegendElementTable, this, slot);
 }
 
-void setJSHTMLLegendElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLegendElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLegendElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLegendElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLLegendElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLegendElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLegendElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
index 76c0f19380..9f0b2c2ca6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
@@ -31,24 +31,25 @@ class JSHTMLLegendElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLegendElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLegendElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLegendElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLegendElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,12 +57,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLegendElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLLegendElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLegendElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLegendElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLegendElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLegendElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLegendElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLegendElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLegendElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLegendElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
index a5527714ee..237769d6c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLinkElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLinkElement);
 
 /* Hash table */
 
@@ -82,13 +82,13 @@ public:
     JSHTMLLinkElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLinkElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLinkElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLinkElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +117,9 @@ static const HashTable JSHTMLLinkElementPrototypeTable =
 
 const ClassInfo JSHTMLLinkElementPrototype::s_info = { "HTMLLinkElementPrototype", 0, &JSHTMLLinkElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLinkElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLinkElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLinkElement>(exec);
+    return getDOMPrototype<JSHTMLLinkElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLinkElement::s_info = { "HTMLLinkElement", &JSHTMLElement::s_info, &JSHTMLLinkElementTable, 0 };
@@ -129,9 +129,9 @@ JSHTMLLinkElement::JSHTMLLinkElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLLinkElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLinkElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLinkElementPrototype(JSHTMLLinkElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLinkElementPrototype(JSHTMLLinkElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLinkElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,130 +139,140 @@ bool JSHTMLLinkElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLLinkElement, Base>(exec, &JSHTMLLinkElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLinkElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLLinkElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->charset());
 }
 
-JSValuePtr jsHTMLLinkElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLLinkElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hreflang());
 }
 
-JSValuePtr jsHTMLLinkElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsHTMLLinkElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rel());
 }
 
-JSValuePtr jsHTMLLinkElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rev());
 }
 
-JSValuePtr jsHTMLLinkElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLLinkElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLLinkElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sheet()));
 }
 
-JSValuePtr jsHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLinkElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLinkElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLinkElement, Base>(exec, propertyName, value, &JSHTMLLinkElementTable, this, slot);
 }
 
-void setJSHTMLLinkElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLLinkElementCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementHreflang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementHreflang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setHreflang(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setMedia(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementRel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementRel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setRel(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementRev(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementRev(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setRev(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLLinkElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLinkElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLinkElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
index 36c9954129..d1bb4de458 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
@@ -31,24 +31,25 @@ class JSHTMLLinkElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLinkElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLinkElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLinkElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLinkElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,26 +57,26 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLinkElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
index 928fbb6fea..9fa0d2f87d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMapElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMapElement);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSHTMLMapElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMapElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMapElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMapElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSHTMLMapElementPrototypeTable =
 
 const ClassInfo JSHTMLMapElementPrototype::s_info = { "HTMLMapElementPrototype", 0, &JSHTMLMapElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMapElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMapElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMapElement>(exec);
+    return getDOMPrototype<JSHTMLMapElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLMapElement::s_info = { "HTMLMapElement", &JSHTMLElement::s_info, &JSHTMLMapElementTable, 0 };
@@ -121,9 +121,9 @@ JSHTMLMapElement::JSHTMLMapElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLMapElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMapElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMapElementPrototype(JSHTMLMapElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMapElementPrototype(JSHTMLMapElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMapElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,34 +131,36 @@ bool JSHTMLMapElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLMapElement, Base>(exec, &JSHTMLMapElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMapElementAreas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementAreas(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->areas()));
 }
 
-JSValuePtr jsHTMLMapElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMapElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMapElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMapElement, Base>(exec, propertyName, value, &JSHTMLMapElementTable, this, slot);
 }
 
-void setJSHTMLMapElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMapElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(static_cast<JSHTMLMapElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLMapElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMapElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMapElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
index 0d3ec3227a..8476c3a662 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
@@ -31,24 +31,25 @@ class JSHTMLMapElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMapElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMapElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMapElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLMapElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLMapElementAreas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMapElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMapElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMapElementAreas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMapElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMapElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
index ef45746bba..faa05e0e08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMarqueeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMarqueeElement);
 
 /* Hash table */
 
@@ -69,13 +69,13 @@ public:
     JSHTMLMarqueeElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMarqueeElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMarqueeElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMarqueeElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLMarqueeElementPrototypeTable =
 
 const ClassInfo JSHTMLMarqueeElementPrototype::s_info = { "HTMLMarqueeElementPrototype", 0, &JSHTMLMarqueeElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMarqueeElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMarqueeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMarqueeElement>(exec);
+    return getDOMPrototype<JSHTMLMarqueeElement>(exec, globalObject);
 }
 
 bool JSHTMLMarqueeElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +123,9 @@ JSHTMLMarqueeElement::JSHTMLMarqueeElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSHTMLMarqueeElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMarqueeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMarqueeElementPrototype(JSHTMLMarqueeElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMarqueeElementPrototype(JSHTMLMarqueeElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMarqueeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,18 +133,19 @@ bool JSHTMLMarqueeElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLMarqueeElement, Base>(exec, &JSHTMLMarqueeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMarqueeElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSHTMLMarqueeElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMarqueeElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMarqueeElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMarqueeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMarqueeElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMarqueeElement* castedThisObj = static_cast<JSHTMLMarqueeElement*>(asObject(thisValue));
     HTMLMarqueeElement* imp = static_cast<HTMLMarqueeElement*>(castedThisObj->impl());
@@ -153,9 +154,10 @@ JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMarqueeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMarqueeElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMarqueeElement* castedThisObj = static_cast<JSHTMLMarqueeElement*>(asObject(thisValue));
     HTMLMarqueeElement* imp = static_cast<HTMLMarqueeElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
index 3882a3bb45..238b8d34ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
@@ -31,27 +31,28 @@ class JSHTMLMarqueeElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMarqueeElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMarqueeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMarqueeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,11 +61,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
index 765dea8a29..5f435f7b2a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
@@ -42,21 +42,22 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMediaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMediaElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLMediaElementTableValues[28] =
+static const HashTableValue JSHTMLMediaElementTableValues[24] =
 {
     { "error", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementError, (intptr_t)0 },
     { "src", DontDelete, (intptr_t)jsHTMLMediaElementSrc, (intptr_t)setJSHTMLMediaElementSrc },
     { "currentSrc", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCurrentSrc, (intptr_t)0 },
     { "networkState", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNetworkState, (intptr_t)0 },
-    { "bufferingRate", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementBufferingRate, (intptr_t)0 },
+    { "autobuffer", DontDelete, (intptr_t)jsHTMLMediaElementAutobuffer, (intptr_t)setJSHTMLMediaElementAutobuffer },
     { "buffered", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementBuffered, (intptr_t)0 },
     { "readyState", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementReadyState, (intptr_t)0 },
     { "seeking", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementSeeking, (intptr_t)0 },
     { "currentTime", DontDelete, (intptr_t)jsHTMLMediaElementCurrentTime, (intptr_t)setJSHTMLMediaElementCurrentTime },
+    { "startTime", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementStartTime, (intptr_t)0 },
     { "duration", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementDuration, (intptr_t)0 },
     { "paused", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementPaused, (intptr_t)0 },
     { "defaultPlaybackRate", DontDelete, (intptr_t)jsHTMLMediaElementDefaultPlaybackRate, (intptr_t)setJSHTMLMediaElementDefaultPlaybackRate },
@@ -65,12 +66,7 @@ static const HashTableValue JSHTMLMediaElementTableValues[28] =
     { "seekable", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementSeekable, (intptr_t)0 },
     { "ended", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementEnded, (intptr_t)0 },
     { "autoplay", DontDelete, (intptr_t)jsHTMLMediaElementAutoplay, (intptr_t)setJSHTMLMediaElementAutoplay },
-    { "start", DontDelete, (intptr_t)jsHTMLMediaElementStart, (intptr_t)setJSHTMLMediaElementStart },
-    { "end", DontDelete, (intptr_t)jsHTMLMediaElementEnd, (intptr_t)setJSHTMLMediaElementEnd },
-    { "loopStart", DontDelete, (intptr_t)jsHTMLMediaElementLoopStart, (intptr_t)setJSHTMLMediaElementLoopStart },
-    { "loopEnd", DontDelete, (intptr_t)jsHTMLMediaElementLoopEnd, (intptr_t)setJSHTMLMediaElementLoopEnd },
-    { "playCount", DontDelete, (intptr_t)jsHTMLMediaElementPlayCount, (intptr_t)setJSHTMLMediaElementPlayCount },
-    { "currentLoop", DontDelete, (intptr_t)jsHTMLMediaElementCurrentLoop, (intptr_t)setJSHTMLMediaElementCurrentLoop },
+    { "loop", DontDelete, (intptr_t)jsHTMLMediaElementLoop, (intptr_t)setJSHTMLMediaElementLoop },
     { "controls", DontDelete, (intptr_t)jsHTMLMediaElementControls, (intptr_t)setJSHTMLMediaElementControls },
     { "volume", DontDelete, (intptr_t)jsHTMLMediaElementVolume, (intptr_t)setJSHTMLMediaElementVolume },
     { "muted", DontDelete, (intptr_t)jsHTMLMediaElementMuted, (intptr_t)setJSHTMLMediaElementMuted },
@@ -80,24 +76,25 @@ static const HashTableValue JSHTMLMediaElementTableValues[28] =
 
 static const HashTable JSHTMLMediaElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 127, JSHTMLMediaElementTableValues, 0 };
+    { 1023, JSHTMLMediaElementTableValues, 0 };
 #else
     { 67, 63, JSHTMLMediaElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
 
-static const HashTableValue JSHTMLMediaElementConstructorTableValues[10] =
-{
-    { "EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementEMPTY, (intptr_t)0 },
-    { "LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADING, (intptr_t)0 },
-    { "LOADED_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_METADATA, (intptr_t)0 },
-    { "LOADED_FIRST_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_FIRST_FRAME, (intptr_t)0 },
-    { "LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED, (intptr_t)0 },
-    { "DATA_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementDATA_UNAVAILABLE, (intptr_t)0 },
-    { "CAN_SHOW_CURRENT_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME, (intptr_t)0 },
-    { "CAN_PLAY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY, (intptr_t)0 },
-    { "CAN_PLAY_THROUGH", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY_THROUGH, (intptr_t)0 },
+static const HashTableValue JSHTMLMediaElementConstructorTableValues[11] =
+{
+    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_EMPTY, (intptr_t)0 },
+    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_IDLE, (intptr_t)0 },
+    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADING, (intptr_t)0 },
+    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADED, (intptr_t)0 },
+    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_NO_SOURCE, (intptr_t)0 },
+    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_NOTHING, (intptr_t)0 },
+    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_METADATA, (intptr_t)0 },
+    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_CURRENT_DATA, (intptr_t)0 },
+    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_FUTURE_DATA, (intptr_t)0 },
+    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_ENOUGH_DATA, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -113,13 +110,13 @@ public:
     JSHTMLMediaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMediaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMediaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMediaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,18 +131,20 @@ bool JSHTMLMediaElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLMediaElementPrototypeTableValues[13] =
-{
-    { "EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementEMPTY, (intptr_t)0 },
-    { "LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADING, (intptr_t)0 },
-    { "LOADED_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_METADATA, (intptr_t)0 },
-    { "LOADED_FIRST_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_FIRST_FRAME, (intptr_t)0 },
-    { "LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED, (intptr_t)0 },
-    { "DATA_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementDATA_UNAVAILABLE, (intptr_t)0 },
-    { "CAN_SHOW_CURRENT_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME, (intptr_t)0 },
-    { "CAN_PLAY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY, (intptr_t)0 },
-    { "CAN_PLAY_THROUGH", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY_THROUGH, (intptr_t)0 },
+static const HashTableValue JSHTMLMediaElementPrototypeTableValues[15] =
+{
+    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_EMPTY, (intptr_t)0 },
+    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_IDLE, (intptr_t)0 },
+    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADING, (intptr_t)0 },
+    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADED, (intptr_t)0 },
+    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_NO_SOURCE, (intptr_t)0 },
+    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_NOTHING, (intptr_t)0 },
+    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_METADATA, (intptr_t)0 },
+    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_CURRENT_DATA, (intptr_t)0 },
+    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_FUTURE_DATA, (intptr_t)0 },
+    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_ENOUGH_DATA, (intptr_t)0 },
     { "load", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionLoad, (intptr_t)0 },
+    { "canPlayType", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionCanPlayType, (intptr_t)1 },
     { "play", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionPlay, (intptr_t)0 },
     { "pause", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionPause, (intptr_t)0 },
     { 0, 0, 0, 0 }
@@ -153,16 +152,16 @@ static const HashTableValue JSHTMLMediaElementPrototypeTableValues[13] =
 
 static const HashTable JSHTMLMediaElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 127, JSHTMLMediaElementPrototypeTableValues, 0 };
+    { 63, JSHTMLMediaElementPrototypeTableValues, 0 };
 #else
-    { 34, 31, JSHTMLMediaElementPrototypeTableValues, 0 };
+    { 33, 31, JSHTMLMediaElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLMediaElementPrototype::s_info = { "HTMLMediaElementPrototype", 0, &JSHTMLMediaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMediaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMediaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMediaElement>(exec);
+    return getDOMPrototype<JSHTMLMediaElement>(exec, globalObject);
 }
 
 bool JSHTMLMediaElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -177,9 +176,9 @@ JSHTMLMediaElement::JSHTMLMediaElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLMediaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMediaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMediaElementPrototype(JSHTMLMediaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMediaElementPrototype(JSHTMLMediaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMediaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -187,273 +186,242 @@ bool JSHTMLMediaElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLMediaElement, Base>(exec, &JSHTMLMediaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMediaElementError(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementError(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->error()));
 }
 
-JSValuePtr jsHTMLMediaElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLMediaElementCurrentSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementCurrentSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->currentSrc());
 }
 
-JSValuePtr jsHTMLMediaElementNetworkState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementNetworkState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->networkState());
 }
 
-JSValuePtr jsHTMLMediaElementBufferingRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementAutobuffer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->bufferingRate());
+    return jsBoolean(imp->autobuffer());
 }
 
-JSValuePtr jsHTMLMediaElementBuffered(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementBuffered(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->buffered()));
 }
 
-JSValuePtr jsHTMLMediaElementReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->readyState());
 }
 
-JSValuePtr jsHTMLMediaElementSeeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSeeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->seeking());
 }
 
-JSValuePtr jsHTMLMediaElementCurrentTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementCurrentTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->currentTime());
 }
 
-JSValuePtr jsHTMLMediaElementDuration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementStartTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->startTime());
+}
+
+JSValue jsHTMLMediaElementDuration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->duration());
 }
 
-JSValuePtr jsHTMLMediaElementPaused(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPaused(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->paused());
 }
 
-JSValuePtr jsHTMLMediaElementDefaultPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementDefaultPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->defaultPlaybackRate());
 }
 
-JSValuePtr jsHTMLMediaElementPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->playbackRate());
 }
 
-JSValuePtr jsHTMLMediaElementPlayed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPlayed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->played()));
 }
 
-JSValuePtr jsHTMLMediaElementSeekable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSeekable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->seekable()));
 }
 
-JSValuePtr jsHTMLMediaElementEnded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementEnded(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ended());
 }
 
-JSValuePtr jsHTMLMediaElementAutoplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementAutoplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autoplay());
 }
 
-JSValuePtr jsHTMLMediaElementStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->start());
-}
-
-JSValuePtr jsHTMLMediaElementEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->end());
-}
-
-JSValuePtr jsHTMLMediaElementLoopStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->loopStart());
-}
-
-JSValuePtr jsHTMLMediaElementLoopEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementLoop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->loopEnd());
+    return jsBoolean(imp->loop());
 }
 
-JSValuePtr jsHTMLMediaElementPlayCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->playCount());
-}
-
-JSValuePtr jsHTMLMediaElementCurrentLoop(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->currentLoop());
-}
-
-JSValuePtr jsHTMLMediaElementControls(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementControls(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->controls());
 }
 
-JSValuePtr jsHTMLMediaElementVolume(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementVolume(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->volume());
 }
 
-JSValuePtr jsHTMLMediaElementMuted(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementMuted(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->muted());
 }
 
-JSValuePtr jsHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMediaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMediaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMediaElement, Base>(exec, propertyName, value, &JSHTMLMediaElementTable, this, slot);
 }
 
-void setJSHTMLMediaElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setSrc(value->toString(exec));
+    imp->setSrc(value.toString(exec));
 }
 
-void setJSHTMLMediaElementCurrentTime(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementAutobuffer(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    ExceptionCode ec = 0;
-    imp->setCurrentTime(value->toFloat(exec), ec);
-    setDOMException(exec, ec);
-}
-
-void setJSHTMLMediaElementDefaultPlaybackRate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    ExceptionCode ec = 0;
-    imp->setDefaultPlaybackRate(value->toFloat(exec), ec);
-    setDOMException(exec, ec);
+    imp->setAutobuffer(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementPlaybackRate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementCurrentTime(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setPlaybackRate(value->toFloat(exec), ec);
+    imp->setCurrentTime(value.toFloat(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSHTMLMediaElementAutoplay(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setAutoplay(value->toBoolean(exec));
-}
-
-void setJSHTMLMediaElementStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setStart(value->toFloat(exec));
-}
-
-void setJSHTMLMediaElementEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setEnd(value->toFloat(exec));
-}
-
-void setJSHTMLMediaElementLoopStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementDefaultPlaybackRate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setLoopStart(value->toFloat(exec));
+    imp->setDefaultPlaybackRate(value.toFloat(exec));
 }
 
-void setJSHTMLMediaElementLoopEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementPlaybackRate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setLoopEnd(value->toFloat(exec));
+    imp->setPlaybackRate(value.toFloat(exec));
 }
 
-void setJSHTMLMediaElementPlayCount(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementAutoplay(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    ExceptionCode ec = 0;
-    imp->setPlayCount(value->toInt32(exec), ec);
-    setDOMException(exec, ec);
+    imp->setAutoplay(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementCurrentLoop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementLoop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setCurrentLoop(value->toInt32(exec));
+    imp->setLoop(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementControls(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementControls(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setControls(value->toBoolean(exec));
+    imp->setControls(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementVolume(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementVolume(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setVolume(value->toFloat(exec), ec);
+    imp->setVolume(value.toFloat(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSHTMLMediaElementMuted(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementMuted(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setMuted(value->toBoolean(exec));
+    imp->setMuted(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLMediaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMediaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMediaElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMediaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
@@ -464,79 +432,96 @@ JSValuePtr jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, JSObject*, J
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLMediaElementPrototypeFunctionPlay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionCanPlayType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMediaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
+    const UString& type = args.at(0).toString(exec);
 
-    imp->play(ec);
-    setDOMException(exec, ec);
+
+    JSC::JSValue result = jsString(exec, imp->canPlayType(type));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
+
+    imp->play();
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLMediaElementPrototypeFunctionPause(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPause(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMediaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
 
-    imp->pause(ec);
-    setDOMException(exec, ec);
+    imp->pause();
     return jsUndefined();
 }
 
 // Constant getters
 
-JSValuePtr jsHTMLMediaElementEMPTY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_EMPTY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsHTMLMediaElementLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_IDLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsHTMLMediaElementLOADED_METADATA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_LOADING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsHTMLMediaElementLOADED_FIRST_FRAME(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_LOADED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsHTMLMediaElementLOADED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsHTMLMediaElementDATA_UNAVAILABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_NOTHING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_METADATA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsHTMLMediaElementCAN_PLAY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsHTMLMediaElementCAN_PLAY_THROUGH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
+JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(4));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
index fbce2495d2..6ba7694d7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
@@ -34,28 +34,29 @@ class JSHTMLMediaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMediaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMediaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMediaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,63 +65,57 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLMediaElementPrototypeFunctionLoad(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLMediaElementPrototypeFunctionPlay(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLMediaElementPrototypeFunctionPause(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionLoad(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionCanPlayType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLMediaElementError(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementCurrentSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementNetworkState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementBufferingRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementBuffered(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementSeeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCurrentTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementDuration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementPaused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementPlayed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementSeekable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementEnded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementAutoplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementAutoplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementLoopStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementLoopStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementLoopEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementLoopEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementPlayCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementPlayCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementCurrentLoop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementCurrentLoop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementControls(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementControls(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementVolume(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementVolume(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementMuted(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementMuted(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementError(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementCurrentSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNetworkState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementAutobuffer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementAutobuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementBuffered(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementSeeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementCurrentTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementStartTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementDuration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementPaused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementPlayed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementSeekable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementEnded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementAutoplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementAutoplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementLoop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementLoop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementControls(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementControls(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementVolume(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementVolume(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementMuted(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementMuted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsHTMLMediaElementEMPTY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADED_METADATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADED_FIRST_FRAME(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementDATA_UNAVAILABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCAN_PLAY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCAN_PLAY_THROUGH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_EMPTY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_IDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_LOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_LOADED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_NOTHING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_METADATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
index 3f947dc78f..f0ef5a0549 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMenuElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMenuElement);
 
 /* Hash table */
 
@@ -69,13 +69,13 @@ public:
     JSHTMLMenuElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMenuElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMenuElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMenuElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +104,9 @@ static const HashTable JSHTMLMenuElementPrototypeTable =
 
 const ClassInfo JSHTMLMenuElementPrototype::s_info = { "HTMLMenuElementPrototype", 0, &JSHTMLMenuElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMenuElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMenuElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMenuElement>(exec);
+    return getDOMPrototype<JSHTMLMenuElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLMenuElement::s_info = { "HTMLMenuElement", &JSHTMLElement::s_info, &JSHTMLMenuElementTable, 0 };
@@ -116,9 +116,9 @@ JSHTMLMenuElement::JSHTMLMenuElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLMenuElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMenuElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMenuElementPrototype(JSHTMLMenuElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMenuElementPrototype(JSHTMLMenuElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMenuElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,28 +126,29 @@ bool JSHTMLMenuElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLMenuElement, Base>(exec, &JSHTMLMenuElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMenuElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMenuElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMenuElement* imp = static_cast<HTMLMenuElement*>(static_cast<JSHTMLMenuElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMenuElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMenuElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMenuElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMenuElement, Base>(exec, propertyName, value, &JSHTMLMenuElementTable, this, slot);
 }
 
-void setJSHTMLMenuElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMenuElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMenuElement* imp = static_cast<HTMLMenuElement*>(static_cast<JSHTMLMenuElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLMenuElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMenuElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMenuElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
index a08e739714..ca9321c191 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
@@ -31,24 +31,25 @@ class JSHTMLMenuElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMenuElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMenuElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMenuElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLMenuElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLMenuElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMenuElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMenuElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMenuElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
index def9b39d13..26c4ed50c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMetaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMetaElement);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSHTMLMetaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMetaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMetaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMetaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSHTMLMetaElementPrototypeTable =
 
 const ClassInfo JSHTMLMetaElementPrototype::s_info = { "HTMLMetaElementPrototype", 0, &JSHTMLMetaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMetaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMetaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMetaElement>(exec);
+    return getDOMPrototype<JSHTMLMetaElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLMetaElement::s_info = { "HTMLMetaElement", &JSHTMLElement::s_info, &JSHTMLMetaElementTable, 0 };
@@ -121,9 +121,9 @@ JSHTMLMetaElement::JSHTMLMetaElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLMetaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMetaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMetaElementPrototype(JSHTMLMetaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMetaElementPrototype(JSHTMLMetaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMetaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,64 +131,68 @@ bool JSHTMLMetaElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLMetaElement, Base>(exec, &JSHTMLMetaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMetaElementContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->content());
 }
 
-JSValuePtr jsHTMLMetaElementHttpEquiv(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementHttpEquiv(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->httpEquiv());
 }
 
-JSValuePtr jsHTMLMetaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLMetaElementScheme(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementScheme(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scheme());
 }
 
-JSValuePtr jsHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMetaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMetaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMetaElement, Base>(exec, propertyName, value, &JSHTMLMetaElementTable, this, slot);
 }
 
-void setJSHTMLMetaElementContent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementContent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setContent(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLMetaElementHttpEquiv(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementHttpEquiv(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setHttpEquiv(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLMetaElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLMetaElementScheme(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementScheme(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setScheme(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLMetaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMetaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMetaElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
index 0ad9bbe477..ee531c5d7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
@@ -31,24 +31,25 @@ class JSHTMLMetaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMetaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMetaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMetaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLMetaElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,15 +57,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLMetaElementContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementHttpEquiv(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementHttpEquiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementScheme(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementScheme(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMetaElementContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementHttpEquiv(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementHttpEquiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementScheme(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementScheme(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
index fe159b6e77..7eff2e384e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLModElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLModElement);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSHTMLModElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLModElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLModElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLModElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSHTMLModElementPrototypeTable =
 
 const ClassInfo JSHTMLModElementPrototype::s_info = { "HTMLModElementPrototype", 0, &JSHTMLModElementPrototypeTable, 0 };
 
-JSObject* JSHTMLModElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLModElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLModElement>(exec);
+    return getDOMPrototype<JSHTMLModElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLModElement::s_info = { "HTMLModElement", &JSHTMLElement::s_info, &JSHTMLModElementTable, 0 };
@@ -119,9 +119,9 @@ JSHTMLModElement::JSHTMLModElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLModElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLModElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLModElementPrototype(JSHTMLModElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLModElementPrototype(JSHTMLModElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLModElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +129,42 @@ bool JSHTMLModElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLModElement, Base>(exec, &JSHTMLModElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLModElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cite());
 }
 
-JSValuePtr jsHTMLModElementDateTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementDateTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->dateTime());
 }
 
-JSValuePtr jsHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLModElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLModElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLModElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLModElement, Base>(exec, propertyName, value, &JSHTMLModElementTable, this, slot);
 }
 
-void setJSHTMLModElementCite(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLModElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(thisObject)->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLModElementDateTime(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLModElementDateTime(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(thisObject)->impl());
     imp->setDateTime(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLModElement::getConstructor(ExecState* exec)
+JSValue JSHTMLModElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLModElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
index c39d1cb9b2..67b6e0236c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
@@ -31,24 +31,25 @@ class JSHTMLModElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLModElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLModElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLModElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLModElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLModElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLModElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLModElementDateTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLModElementDateTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLModElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLModElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLModElementDateTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLModElementDateTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
index b6d9cf835b..1f43d6d66a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOListElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOListElement);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSHTMLOListElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLOListElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLOListElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLOListElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +108,9 @@ static const HashTable JSHTMLOListElementPrototypeTable =
 
 const ClassInfo JSHTMLOListElementPrototype::s_info = { "HTMLOListElementPrototype", 0, &JSHTMLOListElementPrototypeTable, 0 };
 
-JSObject* JSHTMLOListElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLOListElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOListElement>(exec);
+    return getDOMPrototype<JSHTMLOListElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLOListElement::s_info = { "HTMLOListElement", &JSHTMLElement::s_info, &JSHTMLOListElementTable, 0 };
@@ -120,9 +120,9 @@ JSHTMLOListElement::JSHTMLOListElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLOListElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLOListElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOListElementPrototype(JSHTMLOListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLOListElementPrototype(JSHTMLOListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOListElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,52 +130,55 @@ bool JSHTMLOListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLOListElement, Base>(exec, &JSHTMLOListElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLOListElementStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->start());
 }
 
-JSValuePtr jsHTMLOListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLOListElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLOListElement, Base>(exec, propertyName, value, &JSHTMLOListElementTable, this, slot);
 }
 
-void setJSHTMLOListElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-void setJSHTMLOListElementStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOListElementStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
-    imp->setStart(value->toInt32(exec));
+    imp->setStart(value.toInt32(exec));
 }
 
-void setJSHTMLOListElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOListElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLOListElement::getConstructor(ExecState* exec)
+JSValue JSHTMLOListElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLOListElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
index d166da672f..e7cfac5386 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
@@ -31,24 +31,25 @@ class JSHTMLOListElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLOListElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOListElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLOListElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLOListElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,13 +57,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLOListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOListElementStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOListElementStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOListElementStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOListElementStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
index 0233e5710a..e7e412963f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLObjectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLObjectElement);
 
 /* Hash table */
 
@@ -98,13 +98,13 @@ public:
     JSHTMLObjectElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLObjectElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLObjectElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLObjectElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,9 +134,9 @@ static const HashTable JSHTMLObjectElementPrototypeTable =
 
 const ClassInfo JSHTMLObjectElementPrototype::s_info = { "HTMLObjectElementPrototype", 0, &JSHTMLObjectElementPrototypeTable, 0 };
 
-JSObject* JSHTMLObjectElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLObjectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLObjectElement>(exec);
+    return getDOMPrototype<JSHTMLObjectElement>(exec, globalObject);
 }
 
 bool JSHTMLObjectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,9 +151,9 @@ JSHTMLObjectElement::JSHTMLObjectElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLObjectElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLObjectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLObjectElementPrototype(JSHTMLObjectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLObjectElementPrototype(JSHTMLObjectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -167,229 +167,247 @@ bool JSHTMLObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLObjectElement, Base>(exec, &JSHTMLObjectElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLObjectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLObjectElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->code());
 }
 
-JSValuePtr jsHTMLObjectElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLObjectElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->archive());
 }
 
-JSValuePtr jsHTMLObjectElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->border());
 }
 
-JSValuePtr jsHTMLObjectElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->codeBase());
 }
 
-JSValuePtr jsHTMLObjectElementCodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->codeType());
 }
 
-JSValuePtr jsHTMLObjectElementData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsHTMLObjectElementDeclare(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementDeclare(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->declare());
 }
 
-JSValuePtr jsHTMLObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLObjectElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->hspace());
 }
 
-JSValuePtr jsHTMLObjectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLObjectElementStandby(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementStandby(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->standby());
 }
 
-JSValuePtr jsHTMLObjectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLObjectElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->useMap());
 }
 
-JSValuePtr jsHTMLObjectElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->vspace());
 }
 
-JSValuePtr jsHTMLObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLObjectElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValuePtr jsHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
     lookupPut<JSHTMLObjectElement, Base>(exec, propertyName, value, &JSHTMLObjectElementTable, this, slot);
 }
 
-void setJSHTMLObjectElementCode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementCode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setCode(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementArchive(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementArchive(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setArchive(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementCodeBase(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementCodeBase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setCodeBase(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementCodeType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementCodeType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setCodeType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementData(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setData(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementDeclare(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementDeclare(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setDeclare(value->toBoolean(exec));
+    imp->setDeclare(value.toBoolean(exec));
 }
 
-void setJSHTMLObjectElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementHspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setHspace(value->toInt32(exec));
+    imp->setHspace(value.toInt32(exec));
 }
 
-void setJSHTMLObjectElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementStandby(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementStandby(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setStandby(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementUseMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setUseMap(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementVspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setVspace(value->toInt32(exec));
+    imp->setVspace(value.toInt32(exec));
 }
 
-void setJSHTMLObjectElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLObjectElement::getConstructor(ExecState* exec)
+JSValue JSHTMLObjectElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLObjectElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLObjectElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLObjectElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLObjectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(asObject(thisValue));
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
@@ -398,7 +416,7 @@ JSValuePtr jsHTMLObjectElementPrototypeFunctionGetSVGDocument(ExecState* exec, J
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
index e2885ad258..50a9b2787b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
@@ -32,35 +32,36 @@ class JSHTMLObjectElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLObjectElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLObjectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLObjectElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLObjectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,44 +70,44 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLObjectElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLObjectElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLObjectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLObjectElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementCodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementCodeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementDeclare(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementDeclare(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementStandby(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementStandby(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementCodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementCodeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementDeclare(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementDeclare(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementStandby(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementStandby(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
index 7ca1fb3f04..10abc77190 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptGroupElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptGroupElement);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSHTMLOptGroupElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLOptGroupElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLOptGroupElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLOptGroupElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSHTMLOptGroupElementPrototypeTable =
 
 const ClassInfo JSHTMLOptGroupElementPrototype::s_info = { "HTMLOptGroupElementPrototype", 0, &JSHTMLOptGroupElementPrototypeTable, 0 };
 
-JSObject* JSHTMLOptGroupElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLOptGroupElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOptGroupElement>(exec);
+    return getDOMPrototype<JSHTMLOptGroupElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLOptGroupElement::s_info = { "HTMLOptGroupElement", &JSHTMLElement::s_info, &JSHTMLOptGroupElementTable, 0 };
@@ -119,9 +119,9 @@ JSHTMLOptGroupElement::JSHTMLOptGroupElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLOptGroupElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLOptGroupElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOptGroupElementPrototype(JSHTMLOptGroupElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLOptGroupElementPrototype(JSHTMLOptGroupElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOptGroupElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +129,42 @@ bool JSHTMLOptGroupElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLOptGroupElement, Base>(exec, &JSHTMLOptGroupElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOptGroupElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLOptGroupElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->label());
 }
 
-JSValuePtr jsHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLOptGroupElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOptGroupElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLOptGroupElement, Base>(exec, propertyName, value, &JSHTMLOptGroupElementTable, this, slot);
 }
 
-void setJSHTMLOptGroupElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptGroupElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLOptGroupElementLabel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptGroupElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(thisObject)->impl());
     imp->setLabel(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLOptGroupElement::getConstructor(ExecState* exec)
+JSValue JSHTMLOptGroupElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLOptGroupElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
index 23740f6a63..44cfa44165 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
@@ -31,24 +31,25 @@ class JSHTMLOptGroupElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLOptGroupElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOptGroupElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLOptGroupElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLOptGroupElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLOptGroupElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptGroupElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptGroupElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptGroupElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptGroupElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptGroupElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptGroupElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptGroupElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
index 0991d2be07..7d5bfae361 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionElement);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSHTMLOptionElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLOptionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +115,9 @@ static const HashTable JSHTMLOptionElementPrototypeTable =
 
 const ClassInfo JSHTMLOptionElementPrototype::s_info = { "HTMLOptionElementPrototype", 0, &JSHTMLOptionElementPrototypeTable, 0 };
 
-JSObject* JSHTMLOptionElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLOptionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOptionElement>(exec);
+    return getDOMPrototype<JSHTMLOptionElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLOptionElement::s_info = { "HTMLOptionElement", &JSHTMLElement::s_info, &JSHTMLOptionElementTable, 0 };
@@ -127,9 +127,9 @@ JSHTMLOptionElement::JSHTMLOptionElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLOptionElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLOptionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOptionElementPrototype(JSHTMLOptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLOptionElementPrototype(JSHTMLOptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOptionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,70 +137,78 @@ bool JSHTMLOptionElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLOptionElement, Base>(exec, &JSHTMLOptionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOptionElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLOptionElementDefaultSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementDefaultSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->defaultSelected());
 }
 
-JSValuePtr jsHTMLOptionElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLOptionElementIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->index());
 }
 
-JSValuePtr jsHTMLOptionElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLOptionElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->label());
 }
 
-JSValuePtr jsHTMLOptionElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->selected());
 }
 
-JSValuePtr jsHTMLOptionElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLOptionElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOptionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLOptionElement, Base>(exec, propertyName, value, &JSHTMLOptionElementTable, this, slot);
 }
 
-void setJSHTMLOptionElementDefaultSelected(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementDefaultSelected(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
-    imp->setDefaultSelected(value->toBoolean(exec));
+    imp->setDefaultSelected(value.toBoolean(exec));
 }
 
-void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -208,38 +216,38 @@ void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-void setJSHTMLOptionElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLOptionElementLabel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
     imp->setLabel(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLOptionElementSelected(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementSelected(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
-    imp->setSelected(value->toBoolean(exec));
+    imp->setSelected(value.toBoolean(exec));
 }
 
-void setJSHTMLOptionElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLOptionElement::getConstructor(ExecState* exec)
+JSValue JSHTMLOptionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLOptionElementConstructor>(exec);
 }
 
-HTMLOptionElement* toHTMLOptionElement(JSC::JSValuePtr value)
+HTMLOptionElement* toHTMLOptionElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLOptionElement::s_info) ? static_cast<JSHTMLOptionElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLOptionElement::s_info) ? static_cast<JSHTMLOptionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
index 3e539863b5..9472282f1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
@@ -31,29 +31,30 @@ class JSHTMLOptionElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLOptionElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOptionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLOptionElement* impl() const
     {
         return static_cast<HTMLOptionElement*>(Base::impl());
     }
 };
 
-HTMLOptionElement* toHTMLOptionElement(JSC::JSValuePtr);
+HTMLOptionElement* toHTMLOptionElement(JSC::JSValue);
 
 class JSHTMLOptionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLOptionElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -61,21 +62,21 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLOptionElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLOptionElementDefaultSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementDefaultSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLOptionElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementDefaultSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementDefaultSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
index 0d41a1670d..32292293c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionsCollection)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionsCollection);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSHTMLOptionsCollectionPrototypeTable =
 
 const ClassInfo JSHTMLOptionsCollectionPrototype::s_info = { "HTMLOptionsCollectionPrototype", 0, &JSHTMLOptionsCollectionPrototypeTable, 0 };
 
-JSObject* JSHTMLOptionsCollectionPrototype::self(ExecState* exec)
+JSObject* JSHTMLOptionsCollectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOptionsCollection>(exec);
+    return getDOMPrototype<JSHTMLOptionsCollection>(exec, globalObject);
 }
 
 bool JSHTMLOptionsCollectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -86,9 +86,9 @@ JSHTMLOptionsCollection::JSHTMLOptionsCollection(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSHTMLOptionsCollection::createPrototype(ExecState* exec)
+JSObject* JSHTMLOptionsCollection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOptionsCollectionPrototype(JSHTMLOptionsCollectionPrototype::createStructure(JSHTMLCollectionPrototype::self(exec)));
+    return new (exec) JSHTMLOptionsCollectionPrototype(JSHTMLOptionsCollectionPrototype::createStructure(JSHTMLCollectionPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOptionsCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,18 +96,19 @@ bool JSHTMLOptionsCollection::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSHTMLOptionsCollection, Base>(exec, &JSHTMLOptionsCollectionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOptionsCollectionSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionsCollectionSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(static_cast<JSHTMLOptionsCollection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectedIndex());
 }
 
-JSValuePtr jsHTMLOptionsCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionsCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOptionsCollection*>(asObject(slot.slotBase()))->length(exec);
 }
 
-void JSHTMLOptionsCollection::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOptionsCollection::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
@@ -118,42 +119,44 @@ void JSHTMLOptionsCollection::put(ExecState* exec, const Identifier& propertyNam
     lookupPut<JSHTMLOptionsCollection, Base>(exec, propertyName, value, &JSHTMLOptionsCollectionTable, this, slot);
 }
 
-void JSHTMLOptionsCollection::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSHTMLOptionsCollection::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     indexSetter(exec, propertyName, value);
     return;
 }
 
-void setJSHTMLOptionsCollectionSelectedIndex(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionsCollectionSelectedIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(static_cast<JSHTMLOptionsCollection*>(thisObject)->impl());
-    imp->setSelectedIndex(value->toInt32(exec));
+    imp->setSelectedIndex(value.toInt32(exec));
 }
 
-void setJSHTMLOptionsCollectionLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionsCollectionLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLOptionsCollection*>(thisObject)->setLength(exec, value);
 }
 
-JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLOptionsCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLOptionsCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLOptionsCollection* castedThisObj = static_cast<JSHTMLOptionsCollection*>(asObject(thisValue));
     return castedThisObj->add(exec, args);
 }
 
-JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLOptionsCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLOptionsCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLOptionsCollection* castedThisObj = static_cast<JSHTMLOptionsCollection*>(asObject(thisValue));
     return castedThisObj->remove(exec, args);
 }
 
-HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValuePtr value)
+HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLOptionsCollection::s_info) ? static_cast<JSHTMLOptionsCollection*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLOptionsCollection::s_info) ? static_cast<JSHTMLOptionsCollection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
index f1b9defd0e..d2aa15e54f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
@@ -31,42 +31,43 @@ class JSHTMLOptionsCollection : public JSHTMLCollection {
     typedef JSHTMLCollection Base;
 public:
     JSHTMLOptionsCollection(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOptionsCollection>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom attributes
-    JSC::JSValuePtr length(JSC::ExecState*) const;
-    void setLength(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue length(JSC::ExecState*) const;
+    void setLength(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr add(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr remove(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue add(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue remove(JSC::ExecState*, const JSC::ArgList&);
     HTMLOptionsCollection* impl() const
     {
         return static_cast<HTMLOptionsCollection*>(Base::impl());
     }
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
-HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValuePtr);
+HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValue);
 
 class JSHTMLOptionsCollectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,14 +76,14 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionsCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionsCollectionLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionsCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionsCollectionLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
index 3b8d8522bd..0d745de5f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLParagraphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLParagraphElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLParagraphElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLParagraphElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLParagraphElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLParagraphElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLParagraphElementPrototypeTable =
 
 const ClassInfo JSHTMLParagraphElementPrototype::s_info = { "HTMLParagraphElementPrototype", 0, &JSHTMLParagraphElementPrototypeTable, 0 };
 
-JSObject* JSHTMLParagraphElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLParagraphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLParagraphElement>(exec);
+    return getDOMPrototype<JSHTMLParagraphElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLParagraphElement::s_info = { "HTMLParagraphElement", &JSHTMLElement::s_info, &JSHTMLParagraphElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLParagraphElement::JSHTMLParagraphElement(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSHTMLParagraphElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLParagraphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLParagraphElementPrototype(JSHTMLParagraphElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLParagraphElementPrototype(JSHTMLParagraphElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLParagraphElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLParagraphElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLParagraphElement, Base>(exec, &JSHTMLParagraphElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLParagraphElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParagraphElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParagraphElement* imp = static_cast<HTMLParagraphElement*>(static_cast<JSHTMLParagraphElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLParagraphElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLParagraphElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLParagraphElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLParagraphElement, Base>(exec, propertyName, value, &JSHTMLParagraphElementTable, this, slot);
 }
 
-void setJSHTMLParagraphElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParagraphElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParagraphElement* imp = static_cast<HTMLParagraphElement*>(static_cast<JSHTMLParagraphElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLParagraphElement::getConstructor(ExecState* exec)
+JSValue JSHTMLParagraphElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLParagraphElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
index 32cb10589d..369384989d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
@@ -31,24 +31,25 @@ class JSHTMLParagraphElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLParagraphElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLParagraphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLParagraphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLParagraphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLParagraphElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParagraphElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParagraphElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParagraphElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
index a07976b84b..8f7248d5e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLParamElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLParamElement);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSHTMLParamElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLParamElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLParamElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLParamElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSHTMLParamElementPrototypeTable =
 
 const ClassInfo JSHTMLParamElementPrototype::s_info = { "HTMLParamElementPrototype", 0, &JSHTMLParamElementPrototypeTable, 0 };
 
-JSObject* JSHTMLParamElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLParamElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLParamElement>(exec);
+    return getDOMPrototype<JSHTMLParamElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLParamElement::s_info = { "HTMLParamElement", &JSHTMLElement::s_info, &JSHTMLParamElementTable, 0 };
@@ -121,9 +121,9 @@ JSHTMLParamElement::JSHTMLParamElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLParamElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLParamElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLParamElementPrototype(JSHTMLParamElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLParamElementPrototype(JSHTMLParamElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLParamElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,64 +131,68 @@ bool JSHTMLParamElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLParamElement, Base>(exec, &JSHTMLParamElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLParamElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLParamElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLParamElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLParamElementValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->valueType());
 }
 
-JSValuePtr jsHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLParamElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLParamElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLParamElement, Base>(exec, propertyName, value, &JSHTMLParamElementTable, this, slot);
 }
 
-void setJSHTMLParamElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLParamElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLParamElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLParamElementValueType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementValueType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setValueType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLParamElement::getConstructor(ExecState* exec)
+JSValue JSHTMLParamElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLParamElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
index 2444be4fbe..7e7760e557 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
@@ -31,24 +31,25 @@ class JSHTMLParamElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLParamElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLParamElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLParamElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLParamElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,15 +57,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLParamElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementValueType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParamElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementValueType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
index b557a17926..0387798a94 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLPreElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLPreElement);
 
 /* Hash table */
 
@@ -70,13 +70,13 @@ public:
     JSHTMLPreElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLPreElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLPreElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLPreElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -105,9 +105,9 @@ static const HashTable JSHTMLPreElementPrototypeTable =
 
 const ClassInfo JSHTMLPreElementPrototype::s_info = { "HTMLPreElementPrototype", 0, &JSHTMLPreElementPrototypeTable, 0 };
 
-JSObject* JSHTMLPreElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLPreElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLPreElement>(exec);
+    return getDOMPrototype<JSHTMLPreElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLPreElement::s_info = { "HTMLPreElement", &JSHTMLElement::s_info, &JSHTMLPreElementTable, 0 };
@@ -117,9 +117,9 @@ JSHTMLPreElement::JSHTMLPreElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLPreElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLPreElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLPreElementPrototype(JSHTMLPreElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLPreElementPrototype(JSHTMLPreElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLPreElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -127,40 +127,42 @@ bool JSHTMLPreElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLPreElement, Base>(exec, &JSHTMLPreElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLPreElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLPreElementWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->wrap());
 }
 
-JSValuePtr jsHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLPreElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLPreElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLPreElement, Base>(exec, propertyName, value, &JSHTMLPreElementTable, this, slot);
 }
 
-void setJSHTMLPreElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLPreElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLPreElementWrap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLPreElementWrap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(thisObject)->impl());
-    imp->setWrap(value->toBoolean(exec));
+    imp->setWrap(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLPreElement::getConstructor(ExecState* exec)
+JSValue JSHTMLPreElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLPreElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
index 3081de8faf..1938f930ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
@@ -31,24 +31,25 @@ class JSHTMLPreElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLPreElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLPreElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLPreElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLPreElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLPreElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLPreElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLPreElementWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLPreElementWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLPreElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLPreElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLPreElementWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLPreElementWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
index 517f65bf0b..4eede339d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLQuoteElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLQuoteElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLQuoteElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLQuoteElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLQuoteElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLQuoteElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLQuoteElementPrototypeTable =
 
 const ClassInfo JSHTMLQuoteElementPrototype::s_info = { "HTMLQuoteElementPrototype", 0, &JSHTMLQuoteElementPrototypeTable, 0 };
 
-JSObject* JSHTMLQuoteElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLQuoteElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLQuoteElement>(exec);
+    return getDOMPrototype<JSHTMLQuoteElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLQuoteElement::s_info = { "HTMLQuoteElement", &JSHTMLElement::s_info, &JSHTMLQuoteElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLQuoteElement::JSHTMLQuoteElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLQuoteElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLQuoteElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLQuoteElementPrototype(JSHTMLQuoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLQuoteElementPrototype(JSHTMLQuoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLQuoteElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLQuoteElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLQuoteElement, Base>(exec, &JSHTMLQuoteElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLQuoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLQuoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLQuoteElement* imp = static_cast<HTMLQuoteElement*>(static_cast<JSHTMLQuoteElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cite());
 }
 
-JSValuePtr jsHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLQuoteElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLQuoteElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLQuoteElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLQuoteElement, Base>(exec, propertyName, value, &JSHTMLQuoteElementTable, this, slot);
 }
 
-void setJSHTMLQuoteElementCite(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLQuoteElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLQuoteElement* imp = static_cast<HTMLQuoteElement*>(static_cast<JSHTMLQuoteElement*>(thisObject)->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLQuoteElement::getConstructor(ExecState* exec)
+JSValue JSHTMLQuoteElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLQuoteElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
index 08e6af1c63..a45fc2f2e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
@@ -31,24 +31,25 @@ class JSHTMLQuoteElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLQuoteElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLQuoteElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLQuoteElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLQuoteElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLQuoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLQuoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLQuoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLQuoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
index 3a205874d8..a3174e4fe9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLScriptElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLScriptElement);
 
 /* Hash table */
 
@@ -77,13 +77,13 @@ public:
     JSHTMLScriptElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLScriptElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLScriptElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLScriptElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +112,9 @@ static const HashTable JSHTMLScriptElementPrototypeTable =
 
 const ClassInfo JSHTMLScriptElementPrototype::s_info = { "HTMLScriptElementPrototype", 0, &JSHTMLScriptElementPrototypeTable, 0 };
 
-JSObject* JSHTMLScriptElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLScriptElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLScriptElement>(exec);
+    return getDOMPrototype<JSHTMLScriptElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLScriptElement::s_info = { "HTMLScriptElement", &JSHTMLElement::s_info, &JSHTMLScriptElementTable, 0 };
@@ -124,9 +124,9 @@ JSHTMLScriptElement::JSHTMLScriptElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLScriptElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLScriptElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLScriptElementPrototype(JSHTMLScriptElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLScriptElementPrototype(JSHTMLScriptElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,100 +134,107 @@ bool JSHTMLScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLScriptElement, Base>(exec, &JSHTMLScriptElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLScriptElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLScriptElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->htmlFor());
 }
 
-JSValuePtr jsHTMLScriptElementEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->event());
 }
 
-JSValuePtr jsHTMLScriptElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->charset());
 }
 
-JSValuePtr jsHTMLScriptElementDefer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementDefer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->defer());
 }
 
-JSValuePtr jsHTMLScriptElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLScriptElement, Base>(exec, propertyName, value, &JSHTMLScriptElementTable, this, slot);
 }
 
-void setJSHTMLScriptElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setHtmlFor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementEvent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementEvent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setEvent(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementDefer(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementDefer(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
-    imp->setDefer(value->toBoolean(exec));
+    imp->setDefer(value.toBoolean(exec));
 }
 
-void setJSHTMLScriptElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLScriptElement::getConstructor(ExecState* exec)
+JSValue JSHTMLScriptElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLScriptElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
index 7a7b344cfc..89b67ef33a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
@@ -31,24 +31,25 @@ class JSHTMLScriptElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLScriptElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLScriptElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLScriptElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLScriptElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,21 +57,21 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLScriptElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementDefer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementDefer(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementDefer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementDefer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
index 978165c404..aa8d776758 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLSelectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLSelectElement);
 
 /* Hash table */
 
@@ -92,13 +92,13 @@ public:
     JSHTMLSelectElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLSelectElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLSelectElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLSelectElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -131,9 +131,9 @@ static const HashTable JSHTMLSelectElementPrototypeTable =
 
 const ClassInfo JSHTMLSelectElementPrototype::s_info = { "HTMLSelectElementPrototype", 0, &JSHTMLSelectElementPrototypeTable, 0 };
 
-JSObject* JSHTMLSelectElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLSelectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLSelectElement>(exec);
+    return getDOMPrototype<JSHTMLSelectElement>(exec, globalObject);
 }
 
 bool JSHTMLSelectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,9 +148,9 @@ JSHTMLSelectElement::JSHTMLSelectElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLSelectElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLSelectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLSelectElementPrototype(JSHTMLSelectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLSelectElementPrototype(JSHTMLSelectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLSelectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -178,83 +178,95 @@ bool JSHTMLSelectElement::getOwnPropertySlot(ExecState* exec, unsigned propertyN
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsHTMLSelectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLSelectElementSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectedIndex());
 }
 
-JSValuePtr jsHTMLSelectElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLSelectElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsHTMLSelectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLSelectElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLSelectElementOptions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementOptions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->options()));
 }
 
-JSValuePtr jsHTMLSelectElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLSelectElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLSelectElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->multiple());
 }
 
-JSValuePtr jsHTMLSelectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLSelectElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->size());
 }
 
-JSValuePtr jsHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLSelectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLSelectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
@@ -265,60 +277,60 @@ void JSHTMLSelectElement::put(ExecState* exec, const Identifier& propertyName, J
     lookupPut<JSHTMLSelectElement, Base>(exec, propertyName, value, &JSHTMLSelectElementTable, this, slot);
 }
 
-void JSHTMLSelectElement::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSHTMLSelectElement::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     indexSetter(exec, propertyName, value);
     return;
 }
 
-void setJSHTMLSelectElementSelectedIndex(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementSelectedIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setSelectedIndex(value->toInt32(exec));
+    imp->setSelectedIndex(value.toInt32(exec));
 }
 
-void setJSHTMLSelectElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLSelectElementLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setLength(value->toInt32(exec), ec);
+    imp->setLength(value.toInt32(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSHTMLSelectElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLSelectElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLSelectElementMultiple(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setMultiple(value->toBoolean(exec));
+    imp->setMultiple(value.toBoolean(exec));
 }
 
-void setJSHTMLSelectElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLSelectElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setSize(value->toInt32(exec));
+    imp->setSize(value.toInt32(exec));
 }
 
 void JSHTMLSelectElement::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
@@ -328,66 +340,70 @@ void JSHTMLSelectElement::getPropertyNames(ExecState* exec, PropertyNameArray& p
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSHTMLSelectElement::getConstructor(ExecState* exec)
+JSValue JSHTMLSelectElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLSelectElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    HTMLElement* element = toHTMLElement(args.at(exec, 0));
-    HTMLElement* before = toHTMLElement(args.at(exec, 1));
+    HTMLElement* element = toHTMLElement(args.at(0));
+    HTMLElement* before = toHTMLElement(args.at(1));
 
     imp->add(element, before, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     return castedThisObj->remove(exec, args);
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
 
-JSValuePtr JSHTMLSelectElement::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLSelectElement::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLSelectElement* thisObj = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<HTMLSelectElement*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
index 21a6a4a8ba..1790360c5f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
@@ -31,36 +31,37 @@ class JSHTMLSelectElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLSelectElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLSelectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr remove(JSC::ExecState*, const JSC::ArgList&);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+    JSC::JSValue remove(JSC::ExecState*, const JSC::ArgList&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
 
 class JSHTMLSelectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,33 +70,33 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLSelectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementOptions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementOptions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
index 39ca6320f5..1a6c7fcc9c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLSourceElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLSourceElement);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSHTMLSourceElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLSourceElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLSourceElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLSourceElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSHTMLSourceElementPrototypeTable =
 
 const ClassInfo JSHTMLSourceElementPrototype::s_info = { "HTMLSourceElementPrototype", 0, &JSHTMLSourceElementPrototypeTable, 0 };
 
-JSObject* JSHTMLSourceElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLSourceElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLSourceElement>(exec);
+    return getDOMPrototype<JSHTMLSourceElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLSourceElement::s_info = { "HTMLSourceElement", &JSHTMLElement::s_info, &JSHTMLSourceElementTable, 0 };
@@ -123,9 +123,9 @@ JSHTMLSourceElement::JSHTMLSourceElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLSourceElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLSourceElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLSourceElementPrototype(JSHTMLSourceElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLSourceElementPrototype(JSHTMLSourceElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLSourceElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,52 +133,55 @@ bool JSHTMLSourceElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLSourceElement, Base>(exec, &JSHTMLSourceElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLSourceElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLSourceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLSourceElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsHTMLSourceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLSourceElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLSourceElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLSourceElement, Base>(exec, propertyName, value, &JSHTMLSourceElementTable, this, slot);
 }
 
-void setJSHTMLSourceElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSourceElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
-    imp->setSrc(value->toString(exec));
+    imp->setSrc(value.toString(exec));
 }
 
-void setJSHTMLSourceElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSourceElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
-    imp->setType(value->toString(exec));
+    imp->setType(value.toString(exec));
 }
 
-void setJSHTMLSourceElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSourceElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
-    imp->setMedia(value->toString(exec));
+    imp->setMedia(value.toString(exec));
 }
 
-JSValuePtr JSHTMLSourceElement::getConstructor(ExecState* exec)
+JSValue JSHTMLSourceElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLSourceElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
index f2538179e2..96b5168297 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
@@ -34,24 +34,25 @@ class JSHTMLSourceElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLSourceElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLSourceElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLSourceElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLSourceElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -59,13 +60,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLSourceElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSourceElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSourceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSourceElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSourceElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSourceElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSourceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSourceElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSourceElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSourceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSourceElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSourceElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSourceElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSourceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
index 5afede97c2..c96ae68d20 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLStyleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLStyleElement);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSHTMLStyleElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLStyleElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLStyleElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLStyleElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSHTMLStyleElementPrototypeTable =
 
 const ClassInfo JSHTMLStyleElementPrototype::s_info = { "HTMLStyleElementPrototype", 0, &JSHTMLStyleElementPrototypeTable, 0 };
 
-JSObject* JSHTMLStyleElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLStyleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLStyleElement>(exec);
+    return getDOMPrototype<JSHTMLStyleElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLStyleElement::s_info = { "HTMLStyleElement", &JSHTMLElement::s_info, &JSHTMLStyleElementTable, 0 };
@@ -123,9 +123,9 @@ JSHTMLStyleElement::JSHTMLStyleElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLStyleElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLStyleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLStyleElementPrototype(JSHTMLStyleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLStyleElementPrototype(JSHTMLStyleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,58 +133,62 @@ bool JSHTMLStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLStyleElement, Base>(exec, &JSHTMLStyleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLStyleElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsHTMLStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLStyleElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sheet()));
 }
 
-JSValuePtr jsHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLStyleElement, Base>(exec, propertyName, value, &JSHTMLStyleElementTable, this, slot);
 }
 
-void setJSHTMLStyleElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLStyleElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
     imp->setMedia(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLStyleElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLStyleElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLStyleElement::getConstructor(ExecState* exec)
+JSValue JSHTMLStyleElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLStyleElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
index c4e704a638..d0e9201eb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
@@ -31,24 +31,25 @@ class JSHTMLStyleElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLStyleElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLStyleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLStyleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLStyleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,14 +57,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLStyleElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLStyleElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLStyleElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLStyleElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLStyleElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
index d67a751c7f..3cc6dba655 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCaptionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCaptionElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLTableCaptionElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableCaptionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableCaptionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableCaptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLTableCaptionElementPrototypeTable =
 
 const ClassInfo JSHTMLTableCaptionElementPrototype::s_info = { "HTMLTableCaptionElementPrototype", 0, &JSHTMLTableCaptionElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableCaptionElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableCaptionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableCaptionElement>(exec);
+    return getDOMPrototype<JSHTMLTableCaptionElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTableCaptionElement::s_info = { "HTMLTableCaptionElement", &JSHTMLElement::s_info, &JSHTMLTableCaptionElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLTableCaptionElement::JSHTMLTableCaptionElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSHTMLTableCaptionElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableCaptionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableCaptionElementPrototype(JSHTMLTableCaptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableCaptionElementPrototype(JSHTMLTableCaptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableCaptionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,35 +128,36 @@ bool JSHTMLTableCaptionElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLTableCaptionElement, Base>(exec, &JSHTMLTableCaptionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableCaptionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCaptionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCaptionElement* imp = static_cast<HTMLTableCaptionElement*>(static_cast<JSHTMLTableCaptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableCaptionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableCaptionElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableCaptionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableCaptionElement, Base>(exec, propertyName, value, &JSHTMLTableCaptionElementTable, this, slot);
 }
 
-void setJSHTMLTableCaptionElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCaptionElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCaptionElement* imp = static_cast<HTMLTableCaptionElement*>(static_cast<JSHTMLTableCaptionElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableCaptionElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableCaptionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableCaptionElementConstructor>(exec);
 }
 
-HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValuePtr value)
+HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLTableCaptionElement::s_info) ? static_cast<JSHTMLTableCaptionElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLTableCaptionElement::s_info) ? static_cast<JSHTMLTableCaptionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
index a5f0ea406c..5182e8497e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
@@ -31,29 +31,30 @@ class JSHTMLTableCaptionElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableCaptionElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableCaptionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLTableCaptionElement* impl() const
     {
         return static_cast<HTMLTableCaptionElement*>(Base::impl());
     }
 };
 
-HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValuePtr);
+HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValue);
 
 class JSHTMLTableCaptionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTableCaptionElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -61,9 +62,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableCaptionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCaptionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCaptionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCaptionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
index 6db14329aa..0609f0d08e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCellElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCellElement);
 
 /* Hash table */
 
@@ -85,13 +85,13 @@ public:
     JSHTMLTableCellElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableCellElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableCellElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableCellElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +120,9 @@ static const HashTable JSHTMLTableCellElementPrototypeTable =
 
 const ClassInfo JSHTMLTableCellElementPrototype::s_info = { "HTMLTableCellElementPrototype", 0, &JSHTMLTableCellElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableCellElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableCellElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableCellElement>(exec);
+    return getDOMPrototype<JSHTMLTableCellElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTableCellElement::s_info = { "HTMLTableCellElement", &JSHTMLElement::s_info, &JSHTMLTableCellElementTable, 0 };
@@ -132,9 +132,9 @@ JSHTMLTableCellElement::JSHTMLTableCellElement(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSHTMLTableCellElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableCellElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableCellElementPrototype(JSHTMLTableCellElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableCellElementPrototype(JSHTMLTableCellElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableCellElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,190 +142,205 @@ bool JSHTMLTableCellElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLTableCellElement, Base>(exec, &JSHTMLTableCellElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableCellElementCellIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementCellIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->cellIndex());
 }
 
-JSValuePtr jsHTMLTableCellElementAbbr(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAbbr(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->abbr());
 }
 
-JSValuePtr jsHTMLTableCellElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableCellElementAxis(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAxis(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->axis());
 }
 
-JSValuePtr jsHTMLTableCellElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLTableCellElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableCellElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableCellElementColSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementColSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->colSpan());
 }
 
-JSValuePtr jsHTMLTableCellElementHeaders(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementHeaders(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->headers());
 }
 
-JSValuePtr jsHTMLTableCellElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLTableCellElementNoWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementNoWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noWrap());
 }
 
-JSValuePtr jsHTMLTableCellElementRowSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementRowSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rowSpan());
 }
 
-JSValuePtr jsHTMLTableCellElementScope(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementScope(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scope());
 }
 
-JSValuePtr jsHTMLTableCellElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableCellElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableCellElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableCellElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableCellElement, Base>(exec, propertyName, value, &JSHTMLTableCellElementTable, this, slot);
 }
 
-void setJSHTMLTableCellElementAbbr(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementAbbr(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setAbbr(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementAxis(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementAxis(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setAxis(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementColSpan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementColSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
-    imp->setColSpan(value->toInt32(exec));
+    imp->setColSpan(value.toInt32(exec));
 }
 
-void setJSHTMLTableCellElementHeaders(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementHeaders(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setHeaders(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementNoWrap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementNoWrap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
-    imp->setNoWrap(value->toBoolean(exec));
+    imp->setNoWrap(value.toBoolean(exec));
 }
 
-void setJSHTMLTableCellElementRowSpan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementRowSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
-    imp->setRowSpan(value->toInt32(exec));
+    imp->setRowSpan(value.toInt32(exec));
 }
 
-void setJSHTMLTableCellElementScope(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementScope(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setScope(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableCellElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableCellElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableCellElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
index ab786f74f0..7aa08ef006 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
@@ -31,24 +31,25 @@ class JSHTMLTableCellElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableCellElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableCellElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableCellElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTableCellElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,36 +57,36 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableCellElementCellIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableCellElementAbbr(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementAbbr(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementAxis(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementAxis(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementColSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementColSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementHeaders(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementNoWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementNoWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementRowSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementRowSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementScope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementScope(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementCellIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementAbbr(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementAbbr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementAxis(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementAxis(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementColSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementColSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementHeaders(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementNoWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementNoWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementRowSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementRowSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementScope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementScope(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
index 6712797808..9e4996c0b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableColElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableColElement);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSHTMLTableColElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableColElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableColElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableColElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSHTMLTableColElementPrototypeTable =
 
 const ClassInfo JSHTMLTableColElementPrototype::s_info = { "HTMLTableColElementPrototype", 0, &JSHTMLTableColElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableColElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableColElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableColElement>(exec);
+    return getDOMPrototype<JSHTMLTableColElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTableColElement::s_info = { "HTMLTableColElement", &JSHTMLElement::s_info, &JSHTMLTableColElementTable, 0 };
@@ -123,9 +123,9 @@ JSHTMLTableColElement::JSHTMLTableColElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLTableColElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableColElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableColElementPrototype(JSHTMLTableColElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableColElementPrototype(JSHTMLTableColElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableColElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,88 +133,94 @@ bool JSHTMLTableColElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTableColElement, Base>(exec, &JSHTMLTableColElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableColElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableColElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableColElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableColElementSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->span());
 }
 
-JSValuePtr jsHTMLTableColElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableColElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableColElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableColElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableColElement, Base>(exec, propertyName, value, &JSHTMLTableColElementTable, this, slot);
 }
 
-void setJSHTMLTableColElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementSpan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
-    imp->setSpan(value->toInt32(exec));
+    imp->setSpan(value.toInt32(exec));
 }
 
-void setJSHTMLTableColElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableColElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableColElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableColElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
index 12562cff99..a060d19bac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
@@ -31,24 +31,25 @@ class JSHTMLTableColElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableColElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableColElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableColElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTableColElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,19 +57,19 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableColElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
index c28f67d48a..13e9d57648 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
@@ -43,7 +43,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableElement);
 
 /* Hash table */
 
@@ -93,13 +93,13 @@ public:
     JSHTMLTableElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -136,9 +136,9 @@ static const HashTable JSHTMLTableElementPrototypeTable =
 
 const ClassInfo JSHTMLTableElementPrototype::s_info = { "HTMLTableElementPrototype", 0, &JSHTMLTableElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableElement>(exec);
+    return getDOMPrototype<JSHTMLTableElement>(exec, globalObject);
 }
 
 bool JSHTMLTableElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,9 +153,9 @@ JSHTMLTableElement::JSHTMLTableElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLTableElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableElementPrototype(JSHTMLTableElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableElementPrototype(JSHTMLTableElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -163,100 +163,114 @@ bool JSHTMLTableElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLTableElement, Base>(exec, &JSHTMLTableElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableElementCaption(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCaption(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->caption()));
 }
 
-JSValuePtr jsHTMLTableElementTHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->tHead()));
 }
 
-JSValuePtr jsHTMLTableElementTFoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTFoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->tFoot()));
 }
 
-JSValuePtr jsHTMLTableElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rows()));
 }
 
-JSValuePtr jsHTMLTableElementTBodies(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTBodies(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->tBodies()));
 }
 
-JSValuePtr jsHTMLTableElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLTableElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->border());
 }
 
-JSValuePtr jsHTMLTableElementCellPadding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCellPadding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cellPadding());
 }
 
-JSValuePtr jsHTMLTableElementCellSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCellSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cellSpacing());
 }
 
-JSValuePtr jsHTMLTableElementFrame(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementFrame(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->frame());
 }
 
-JSValuePtr jsHTMLTableElementRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rules());
 }
 
-JSValuePtr jsHTMLTableElementSummary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementSummary(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->summary());
 }
 
-JSValuePtr jsHTMLTableElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableElement, Base>(exec, propertyName, value, &JSHTMLTableElementTable, this, slot);
 }
 
-void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -264,7 +278,7 @@ void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValue
     setDOMException(exec, ec);
 }
 
-void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -272,7 +286,7 @@ void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -280,80 +294,82 @@ void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-void setJSHTMLTableElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementCellPadding(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementCellPadding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setCellPadding(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementCellSpacing(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementCellSpacing(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setCellSpacing(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementFrame(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementFrame(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setFrame(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementRules(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementRules(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setRules(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementSummary(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementSummary(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setSummary(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTHead(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTHead(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createTHead()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createTHead()));
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -362,21 +378,23 @@ JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState* exec, JSObj
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTFoot(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTFoot(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createTFoot()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createTFoot()));
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -385,21 +403,23 @@ JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState* exec, JSObj
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionCreateCaption(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateCaption(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createCaption()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createCaption()));
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -408,29 +428,31 @@ JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState* exec, JSO
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
     imp->deleteRow(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
index a246801146..234d812468 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
@@ -31,28 +31,29 @@ class JSHTMLTableElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,43 +62,43 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionCreateCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableElementCaption(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementTHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementTFoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableElementTBodies(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementCellPadding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementCellPadding(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementCellSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementCellSpacing(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementFrame(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementSummary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementSummary(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementCaption(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementTHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementTFoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementTBodies(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementCellPadding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementCellPadding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementCellSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementCellSpacing(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementFrame(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementSummary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementSummary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
index 541036cce5..d6f1d8f1c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableRowElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableRowElement);
 
 /* Hash table */
 
@@ -83,13 +83,13 @@ public:
     JSHTMLTableRowElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableRowElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableRowElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableRowElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +120,9 @@ static const HashTable JSHTMLTableRowElementPrototypeTable =
 
 const ClassInfo JSHTMLTableRowElementPrototype::s_info = { "HTMLTableRowElementPrototype", 0, &JSHTMLTableRowElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableRowElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableRowElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableRowElement>(exec);
+    return getDOMPrototype<JSHTMLTableRowElement>(exec, globalObject);
 }
 
 bool JSHTMLTableRowElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,9 +137,9 @@ JSHTMLTableRowElement::JSHTMLTableRowElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLTableRowElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableRowElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableRowElementPrototype(JSHTMLTableRowElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableRowElementPrototype(JSHTMLTableRowElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableRowElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,121 +147,131 @@ bool JSHTMLTableRowElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTableRowElement, Base>(exec, &JSHTMLTableRowElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableRowElementRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rowIndex());
 }
 
-JSValuePtr jsHTMLTableRowElementSectionRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementSectionRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->sectionRowIndex());
 }
 
-JSValuePtr jsHTMLTableRowElementCells(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementCells(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cells()));
 }
 
-JSValuePtr jsHTMLTableRowElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableRowElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLTableRowElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableRowElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableRowElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableRowElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableRowElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableRowElement, Base>(exec, propertyName, value, &JSHTMLTableRowElementTable, this, slot);
 }
 
-void setJSHTMLTableRowElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableRowElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableRowElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableRowElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTableRowElementPrototypeFunctionInsertCell(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionInsertCell(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableRowElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableRowElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(asObject(thisValue));
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertCell(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertCell(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLTableRowElementPrototypeFunctionDeleteCell(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionDeleteCell(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableRowElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableRowElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(asObject(thisValue));
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
     imp->deleteCell(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
index 65219c582a..e3e93bceb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
@@ -31,28 +31,29 @@ class JSHTMLTableRowElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableRowElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableRowElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableRowElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,24 +62,24 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTableRowElementPrototypeFunctionInsertCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableRowElementPrototypeFunctionDeleteCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionInsertCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionDeleteCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableRowElementRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableRowElementSectionRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableRowElementCells(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableRowElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementSectionRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementCells(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
index 97fad79488..ddb9e2eedd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableSectionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableSectionElement);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSHTMLTableSectionElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableSectionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableSectionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableSectionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +117,9 @@ static const HashTable JSHTMLTableSectionElementPrototypeTable =
 
 const ClassInfo JSHTMLTableSectionElementPrototype::s_info = { "HTMLTableSectionElementPrototype", 0, &JSHTMLTableSectionElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableSectionElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableSectionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableSectionElement>(exec);
+    return getDOMPrototype<JSHTMLTableSectionElement>(exec, globalObject);
 }
 
 bool JSHTMLTableSectionElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,9 +134,9 @@ JSHTMLTableSectionElement::JSHTMLTableSectionElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSHTMLTableSectionElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableSectionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableSectionElementPrototype(JSHTMLTableSectionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableSectionElementPrototype(JSHTMLTableSectionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableSectionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,106 +144,113 @@ bool JSHTMLTableSectionElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLTableSectionElement, Base>(exec, &JSHTMLTableSectionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableSectionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableSectionElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableSectionElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableSectionElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableSectionElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rows()));
 }
 
-JSValuePtr jsHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableSectionElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableSectionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableSectionElement, Base>(exec, propertyName, value, &JSHTMLTableSectionElementTable, this, slot);
 }
 
-void setJSHTMLTableSectionElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableSectionElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableSectionElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableSectionElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableSectionElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableSectionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableSectionElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTableSectionElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableSectionElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableSectionElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(asObject(thisValue));
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLTableSectionElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableSectionElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableSectionElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(asObject(thisValue));
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
     imp->deleteRow(index, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValuePtr value)
+HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLTableSectionElement::s_info) ? static_cast<JSHTMLTableSectionElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLTableSectionElement::s_info) ? static_cast<JSHTMLTableSectionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
index 5fef3e9151..1d3b1f8fd8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
@@ -31,33 +31,34 @@ class JSHTMLTableSectionElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableSectionElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableSectionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLTableSectionElement* impl() const
     {
         return static_cast<HTMLTableSectionElement*>(Base::impl());
     }
 };
 
-HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValuePtr);
+HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValue);
 
 class JSHTMLTableSectionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -66,20 +67,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTableSectionElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableSectionElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableSectionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
index 3bb257204f..650aaadedd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTextAreaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTextAreaElement);
 
 /* Hash table */
 
@@ -87,13 +87,13 @@ public:
     JSHTMLTextAreaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTextAreaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTextAreaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTextAreaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -124,9 +124,9 @@ static const HashTable JSHTMLTextAreaElementPrototypeTable =
 
 const ClassInfo JSHTMLTextAreaElementPrototype::s_info = { "HTMLTextAreaElementPrototype", 0, &JSHTMLTextAreaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTextAreaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTextAreaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTextAreaElement>(exec);
+    return getDOMPrototype<JSHTMLTextAreaElement>(exec, globalObject);
 }
 
 bool JSHTMLTextAreaElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,9 +141,9 @@ JSHTMLTextAreaElement::JSHTMLTextAreaElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLTextAreaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTextAreaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTextAreaElementPrototype(JSHTMLTextAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTextAreaElementPrototype(JSHTMLTextAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTextAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,173 +151,188 @@ bool JSHTMLTextAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTextAreaElement, Base>(exec, &JSHTMLTextAreaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTextAreaElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultValue());
 }
 
-JSValuePtr jsHTMLTextAreaElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLTextAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLTextAreaElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->cols());
 }
 
-JSValuePtr jsHTMLTextAreaElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLTextAreaElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLTextAreaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLTextAreaElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->readOnly());
 }
 
-JSValuePtr jsHTMLTextAreaElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rows());
 }
 
-JSValuePtr jsHTMLTextAreaElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLTextAreaElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLTextAreaElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLTextAreaElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectionStart());
 }
 
-JSValuePtr jsHTMLTextAreaElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectionEnd());
 }
 
-JSValuePtr jsHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTextAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTextAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTextAreaElement, Base>(exec, propertyName, value, &JSHTMLTextAreaElementTable, this, slot);
 }
 
-void setJSHTMLTextAreaElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setDefaultValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementCols(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementCols(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setCols(value->toInt32(exec));
+    imp->setCols(value.toInt32(exec));
 }
 
-void setJSHTMLTextAreaElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLTextAreaElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLTextAreaElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementReadOnly(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementReadOnly(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setReadOnly(value->toBoolean(exec));
+    imp->setReadOnly(value.toBoolean(exec));
 }
 
-void setJSHTMLTextAreaElementRows(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementRows(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setRows(value->toInt32(exec));
+    imp->setRows(value.toInt32(exec));
 }
 
-void setJSHTMLTextAreaElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setSelectionStart(value->toInt32(exec));
+    imp->setSelectionStart(value.toInt32(exec));
 }
 
-void setJSHTMLTextAreaElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setSelectionEnd(value->toInt32(exec));
+    imp->setSelectionEnd(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLTextAreaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTextAreaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTextAreaElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTextAreaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTextAreaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
@@ -326,14 +341,15 @@ JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTextAreaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTextAreaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
-    int start = args.at(exec, 0)->toInt32(exec);
-    int end = args.at(exec, 1)->toInt32(exec);
+    int start = args.at(0).toInt32(exec);
+    int end = args.at(1).toInt32(exec);
 
     imp->setSelectionRange(start, end);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
index d50c32201c..d248975fde 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
@@ -31,28 +31,29 @@ class JSHTMLTextAreaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTextAreaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTextAreaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTextAreaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,36 +62,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTextAreaElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTextAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTextAreaElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTextAreaElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
index b5b80aa19b..2834552839 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTitleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTitleElement);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSHTMLTitleElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTitleElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTitleElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTitleElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSHTMLTitleElementPrototypeTable =
 
 const ClassInfo JSHTMLTitleElementPrototype::s_info = { "HTMLTitleElementPrototype", 0, &JSHTMLTitleElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTitleElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTitleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTitleElement>(exec);
+    return getDOMPrototype<JSHTMLTitleElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTitleElement::s_info = { "HTMLTitleElement", &JSHTMLElement::s_info, &JSHTMLTitleElementTable, 0 };
@@ -118,9 +118,9 @@ JSHTMLTitleElement::JSHTMLTitleElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLTitleElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTitleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTitleElementPrototype(JSHTMLTitleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTitleElementPrototype(JSHTMLTitleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +128,29 @@ bool JSHTMLTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLTitleElement, Base>(exec, &JSHTMLTitleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTitleElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTitleElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTitleElement* imp = static_cast<HTMLTitleElement*>(static_cast<JSHTMLTitleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTitleElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTitleElement, Base>(exec, propertyName, value, &JSHTMLTitleElementTable, this, slot);
 }
 
-void setJSHTMLTitleElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTitleElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTitleElement* imp = static_cast<HTMLTitleElement*>(static_cast<JSHTMLTitleElement*>(thisObject)->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTitleElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTitleElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTitleElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
index 3d8f6f6fe9..79e73aecc2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
@@ -31,24 +31,25 @@ class JSHTMLTitleElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTitleElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTitleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTitleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTitleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTitleElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTitleElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTitleElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTitleElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
index dccf7e3447..d33549a46b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLUListElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLUListElement);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSHTMLUListElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLUListElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLUListElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLUListElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +107,9 @@ static const HashTable JSHTMLUListElementPrototypeTable =
 
 const ClassInfo JSHTMLUListElementPrototype::s_info = { "HTMLUListElementPrototype", 0, &JSHTMLUListElementPrototypeTable, 0 };
 
-JSObject* JSHTMLUListElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLUListElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLUListElement>(exec);
+    return getDOMPrototype<JSHTMLUListElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLUListElement::s_info = { "HTMLUListElement", &JSHTMLElement::s_info, &JSHTMLUListElementTable, 0 };
@@ -119,9 +119,9 @@ JSHTMLUListElement::JSHTMLUListElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLUListElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLUListElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLUListElementPrototype(JSHTMLUListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLUListElementPrototype(JSHTMLUListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLUListElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +129,42 @@ bool JSHTMLUListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLUListElement, Base>(exec, &JSHTMLUListElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLUListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLUListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLUListElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLUListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLUListElement, Base>(exec, propertyName, value, &JSHTMLUListElementTable, this, slot);
 }
 
-void setJSHTMLUListElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLUListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-void setJSHTMLUListElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLUListElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLUListElement::getConstructor(ExecState* exec)
+JSValue JSHTMLUListElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLUListElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
index 0511b340e7..339b5f027f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
@@ -31,24 +31,25 @@ class JSHTMLUListElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLUListElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLUListElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLUListElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLUListElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLUListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLUListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLUListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLUListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLUListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLUListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLUListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLUListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
index 9e868e5287..e345647e8a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLVideoElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLVideoElement);
 
 /* Hash table */
 
@@ -78,13 +78,13 @@ public:
     JSHTMLVideoElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLVideoElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLVideoElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLVideoElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -113,9 +113,9 @@ static const HashTable JSHTMLVideoElementPrototypeTable =
 
 const ClassInfo JSHTMLVideoElementPrototype::s_info = { "HTMLVideoElementPrototype", 0, &JSHTMLVideoElementPrototypeTable, 0 };
 
-JSObject* JSHTMLVideoElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLVideoElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLVideoElement>(exec);
+    return getDOMPrototype<JSHTMLVideoElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLVideoElement::s_info = { "HTMLVideoElement", &JSHTMLMediaElement::s_info, &JSHTMLVideoElementTable, 0 };
@@ -125,9 +125,9 @@ JSHTMLVideoElement::JSHTMLVideoElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLVideoElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLVideoElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLVideoElementPrototype(JSHTMLVideoElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec)));
+    return new (exec) JSHTMLVideoElementPrototype(JSHTMLVideoElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLVideoElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,64 +135,69 @@ bool JSHTMLVideoElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLVideoElement, Base>(exec, &JSHTMLVideoElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLVideoElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLVideoElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLVideoElementVideoWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementVideoWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->videoWidth());
 }
 
-JSValuePtr jsHTMLVideoElementVideoHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementVideoHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->videoHeight());
 }
 
-JSValuePtr jsHTMLVideoElementPoster(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementPoster(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->poster());
 }
 
-JSValuePtr jsHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLVideoElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLVideoElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLVideoElement, Base>(exec, propertyName, value, &JSHTMLVideoElementTable, this, slot);
 }
 
-void setJSHTMLVideoElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLVideoElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLVideoElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLVideoElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
-    imp->setHeight(value->toInt32(exec));
+    imp->setHeight(value.toInt32(exec));
 }
 
-void setJSHTMLVideoElementPoster(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLVideoElementPoster(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
     imp->setPoster(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLVideoElement::getConstructor(ExecState* exec)
+JSValue JSHTMLVideoElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLVideoElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
index 5dc28ef3f1..9d7577ff90 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
@@ -34,24 +34,25 @@ class JSHTMLVideoElement : public JSHTMLMediaElement {
     typedef JSHTMLMediaElement Base;
 public:
     JSHTMLVideoElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLVideoElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLVideoElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLVideoElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -59,15 +60,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLVideoElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLVideoElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLVideoElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLVideoElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLVideoElementVideoWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLVideoElementVideoHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLVideoElementPoster(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLVideoElementPoster(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLVideoElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLVideoElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLVideoElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLVideoElementVideoWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementVideoHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementPoster(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLVideoElementPoster(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
index 45b5e3a8eb..015482f29e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHistory)
+ASSERT_CLASS_FITS_IN_CELL(JSHistory);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSHistoryPrototypeTable =
 
 const ClassInfo JSHistoryPrototype::s_info = { "HistoryPrototype", 0, &JSHistoryPrototypeTable, 0 };
 
-JSObject* JSHistoryPrototype::self(ExecState* exec)
+JSObject* JSHistoryPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHistory>(exec);
+    return getDOMPrototype<JSHistory>(exec, globalObject);
 }
 
 bool JSHistoryPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,12 +91,11 @@ JSHistory::JSHistory(PassRefPtr<Structure> structure, PassRefPtr<History> impl)
 JSHistory::~JSHistory()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSHistory::createPrototype(ExecState* exec)
+JSObject* JSHistory::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHistoryPrototype(JSHistoryPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSHistoryPrototype(JSHistoryPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSHistory::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -106,13 +105,14 @@ bool JSHistory::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSHistory, Base>(exec, &JSHistoryTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHistoryLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHistoryLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     History* imp = static_cast<History*>(static_cast<JSHistory*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-void JSHistory::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHistory::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
@@ -126,9 +126,10 @@ void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNam
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHistory::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
@@ -137,9 +138,10 @@ JSValuePtr jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsHistoryPrototypeFunctionForward(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionForward(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHistory::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
@@ -148,25 +150,26 @@ JSValuePtr jsHistoryPrototypeFunctionForward(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsHistoryPrototypeFunctionGo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionGo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHistory::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
-    int distance = args.at(exec, 0)->toInt32(exec);
+    int distance = args.at(0).toInt32(exec);
 
     imp->go(distance);
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, History* object)
+JSC::JSValue toJS(JSC::ExecState* exec, History* object)
 {
     return getDOMObjectWrapper<JSHistory>(exec, object);
 }
-History* toHistory(JSC::JSValuePtr value)
+History* toHistory(JSC::JSValue value)
 {
-    return value->isObject(&JSHistory::s_info) ? static_cast<JSHistory*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHistory::s_info) ? static_cast<JSHistory*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.h b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
index 6ff263d77e..f10e463a1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
@@ -34,15 +34,15 @@ class JSHistory : public DOMObject {
 public:
     JSHistory(PassRefPtr<JSC::Structure>, PassRefPtr<History>);
     virtual ~JSHistory();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -56,16 +56,17 @@ private:
     RefPtr<History> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, History*);
-History* toHistory(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, History*);
+History* toHistory(JSC::JSValue);
 
 class JSHistoryPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,12 +75,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHistoryPrototypeFunctionBack(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHistoryPrototypeFunctionForward(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHistoryPrototypeFunctionGo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionBack(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionForward(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionGo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHistoryLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHistoryLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index a92adaadc7..17bd1fbacd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSImageData)
+ASSERT_CLASS_FITS_IN_CELL(JSImageData);
 
 /* Hash table */
 
@@ -70,13 +70,13 @@ public:
     JSImageDataConstructor(ExecState* exec)
         : DOMObject(JSImageDataConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSImageDataPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSImageDataPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -105,9 +105,9 @@ static const HashTable JSImageDataPrototypeTable =
 
 const ClassInfo JSImageDataPrototype::s_info = { "ImageDataPrototype", 0, &JSImageDataPrototypeTable, 0 };
 
-JSObject* JSImageDataPrototype::self(ExecState* exec)
+JSObject* JSImageDataPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSImageData>(exec);
+    return getDOMPrototype<JSImageData>(exec, globalObject);
 }
 
 const ClassInfo JSImageData::s_info = { "ImageData", 0, &JSImageDataTable, 0 };
@@ -121,12 +121,11 @@ JSImageData::JSImageData(PassRefPtr<Structure> structure, PassRefPtr<ImageData>
 JSImageData::~JSImageData()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSImageData::createPrototype(ExecState* exec)
+JSObject* JSImageData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSImageDataPrototype(JSImageDataPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSImageDataPrototype(JSImageDataPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSImageData::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,30 +133,32 @@ bool JSImageData::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSImageData, Base>(exec, &JSImageDataTable, this, propertyName, slot);
 }
 
-JSValuePtr jsImageDataWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ImageData* imp = static_cast<ImageData*>(static_cast<JSImageData*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsImageDataHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ImageData* imp = static_cast<ImageData*>(static_cast<JSImageData*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsImageDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSImageData*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSImageData::getConstructor(ExecState* exec)
+JSValue JSImageData::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSImageDataConstructor>(exec);
 }
 
-ImageData* toImageData(JSC::JSValuePtr value)
+ImageData* toImageData(JSC::JSValue value)
 {
-    return value->isObject(&JSImageData::s_info) ? static_cast<JSImageData*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSImageData::s_info) ? static_cast<JSImageData*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.h b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
index a9e778a6de..12a9f014a4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
@@ -34,29 +34,30 @@ class JSImageData : public DOMObject {
 public:
     JSImageData(PassRefPtr<JSC::Structure>, PassRefPtr<ImageData>);
     virtual ~JSImageData();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     ImageData* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<ImageData> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, ImageData*);
-ImageData* toImageData(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, ImageData*);
+ImageData* toImageData(JSC::JSValue);
 
 class JSImageDataPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSImageDataPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,9 +65,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsImageDataWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsImageDataHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsImageDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsImageDataWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsImageDataHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsImageDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorController.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.cpp
new file mode 100644
index 0000000000..41cafef698
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.cpp
@@ -0,0 +1,773 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "JSInspectorController.h"
+
+#include <wtf/GetPtr.h>
+
+#include "DOMWindow.h"
+#include "InspectorController.h"
+#include "JSNode.h"
+#include "KURL.h"
+#include "Node.h"
+
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSInspectorController);
+
+/* Hash table */
+
+static const HashTableValue JSInspectorControllerTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsInspectorControllerConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSInspectorControllerTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInspectorControllerTableValues, 0 };
+#else
+    { 2, 1, JSInspectorControllerTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSInspectorControllerConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSInspectorControllerConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInspectorControllerConstructorTableValues, 0 };
+#else
+    { 1, 0, JSInspectorControllerConstructorTableValues, 0 };
+#endif
+
+class JSInspectorControllerConstructor : public DOMObject {
+public:
+    JSInspectorControllerConstructor(ExecState* exec)
+        : DOMObject(JSInspectorControllerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSInspectorControllerPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSInspectorControllerConstructor::s_info = { "InspectorControllerConstructor", 0, &JSInspectorControllerConstructorTable, 0 };
+
+bool JSInspectorControllerConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInspectorControllerConstructor, DOMObject>(exec, &JSInspectorControllerConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSInspectorControllerPrototypeTableValues[48] =
+{
+    { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
+    { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
+    { "loaded", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionLoaded, (intptr_t)0 },
+    { "windowUnloading", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionWindowUnloading, (intptr_t)0 },
+    { "attach", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAttach, (intptr_t)0 },
+    { "detach", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDetach, (intptr_t)0 },
+    { "closeWindow", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionCloseWindow, (intptr_t)0 },
+    { "clearMessages", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionClearMessages, (intptr_t)0 },
+    { "toggleNodeSearch", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionToggleNodeSearch, (intptr_t)0 },
+    { "isWindowVisible", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionIsWindowVisible, (intptr_t)0 },
+    { "searchingForNode", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSearchingForNode, (intptr_t)0 },
+    { "addResourceSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAddResourceSourceToFrame, (intptr_t)2 },
+    { "addSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAddSourceToFrame, (intptr_t)3 },
+    { "getResourceDocumentNode", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionGetResourceDocumentNode, (intptr_t)1 },
+    { "search", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSearch, (intptr_t)2 },
+    { "databaseTableNames", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDatabaseTableNames, (intptr_t)1 },
+    { "setting", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetting, (intptr_t)1 },
+    { "setSetting", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetSetting, (intptr_t)2 },
+    { "inspectedWindow", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionInspectedWindow, (intptr_t)0 },
+    { "localizedStringsURL", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionLocalizedStringsURL, (intptr_t)0 },
+    { "hiddenPanels", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionHiddenPanels, (intptr_t)0 },
+    { "platform", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionPlatform, (intptr_t)0 },
+    { "moveByUnrestricted", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionMoveByUnrestricted, (intptr_t)2 },
+    { "setAttachedWindowHeight", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetAttachedWindowHeight, (intptr_t)1 },
+    { "wrapCallback", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionWrapCallback, (intptr_t)1 },
+    { "resourceTrackingEnabled", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionResourceTrackingEnabled, (intptr_t)0 },
+    { "enableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionEnableResourceTracking, (intptr_t)1 },
+    { "disableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDisableResourceTracking, (intptr_t)1 },
+    { "enableDebuggerFromFrontend", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionEnableDebuggerFromFrontend, (intptr_t)1 },
+    { "disableDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDisableDebugger, (intptr_t)1 },
+    { "pauseInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionPauseInDebugger, (intptr_t)0 },
+    { "resumeDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionResumeDebugger, (intptr_t)0 },
+    { "stepOverStatementInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStepOverStatementInDebugger, (intptr_t)0 },
+    { "stepIntoStatementInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStepIntoStatementInDebugger, (intptr_t)0 },
+    { "stepOutOfFunctionInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStepOutOfFunctionInDebugger, (intptr_t)0 },
+    { "debuggerEnabled", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDebuggerEnabled, (intptr_t)0 },
+    { "pauseOnExceptions", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionPauseOnExceptions, (intptr_t)0 },
+    { "profilerEnabled", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionProfilerEnabled, (intptr_t)0 },
+    { "startProfiling", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStartProfiling, (intptr_t)0 },
+    { "stopProfiling", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStopProfiling, (intptr_t)0 },
+    { "enableProfiler", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionEnableProfiler, (intptr_t)1 },
+    { "disableProfiler", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDisableProfiler, (intptr_t)1 },
+    { "currentCallFrame", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionCurrentCallFrame, (intptr_t)0 },
+    { "setPauseOnExceptions", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetPauseOnExceptions, (intptr_t)1 },
+    { "addBreakpoint", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAddBreakpoint, (intptr_t)2 },
+    { "removeBreakpoint", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionRemoveBreakpoint, (intptr_t)2 },
+    { "profiles", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionProfiles, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSInspectorControllerPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 2047, JSInspectorControllerPrototypeTableValues, 0 };
+#else
+    { 137, 127, JSInspectorControllerPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSInspectorControllerPrototype::s_info = { "InspectorControllerPrototype", 0, &JSInspectorControllerPrototypeTable, 0 };
+
+JSObject* JSInspectorControllerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSInspectorController>(exec, globalObject);
+}
+
+bool JSInspectorControllerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSInspectorControllerPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSInspectorController::s_info = { "InspectorController", 0, &JSInspectorControllerTable, 0 };
+
+JSInspectorController::JSInspectorController(PassRefPtr<Structure> structure, PassRefPtr<InspectorController> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSInspectorController::~JSInspectorController()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSInspectorController::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSInspectorControllerPrototype(JSInspectorControllerPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSInspectorController::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInspectorController, Base>(exec, &JSInspectorControllerTable, this, propertyName, slot);
+}
+
+JSValue jsInspectorControllerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSInspectorController*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+JSValue JSInspectorController::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSInspectorControllerConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHideDOMNodeHighlight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->hideHighlight();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHighlightDOMNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->highlightDOMNode(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLoaded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->scriptObjectReady();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWindowUnloading(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->close();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAttach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->attachWindow();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->detachWindow();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCloseWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->closeWindow();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionClearMessages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->clearConsoleMessages();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionToggleNodeSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->toggleSearchForNodeInPage();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionIsWindowVisible(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->windowVisible());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearchingForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->searchingForNodeInPage());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddResourceSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    int identifier = args.at(0).toInt32(exec);
+    Node* frame = toNode(args.at(1));
+
+    imp->addResourceSourceToFrame(identifier, frame);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    const UString& mimeType = args.at(0).toString(exec);
+    const UString& sourceValue = args.at(1).toString(exec);
+    Node* frame = toNode(args.at(2));
+
+
+    JSC::JSValue result = jsBoolean(imp->addSourceToFrame(mimeType, sourceValue, frame));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionGetResourceDocumentNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->getResourceDocumentNode(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->search(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->databaseTableNames(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->setting(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->setSetting(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionInspectedWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->inspectedWindow(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLocalizedStringsURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->localizedStringsURL());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHiddenPanels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->hiddenPanels());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPlatform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->platform());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionMoveByUnrestricted(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+
+    imp->moveWindowBy(x, y);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetAttachedWindowHeight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    unsigned height = args.at(0).toInt32(exec);
+
+    imp->setAttachedWindowHeight(height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWrapCallback(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->wrapCallback(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResourceTrackingEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->resourceTrackingEnabled());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->enableResourceTracking(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->disableResourceTracking(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableDebuggerFromFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->enableDebuggerFromFrontend(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->disableDebugger(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->pauseInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResumeDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->resumeDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOverStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stepOverStatementInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepIntoStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stepIntoStatementInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOutOfFunctionInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stepOutOfFunctionInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDebuggerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->debuggerEnabled());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->pauseOnExceptions());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfilerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->profilerEnabled());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStartProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->startUserInitiatedProfiling();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStopProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stopUserInitiatedProfiling();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->enableProfiler(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->disableProfiler(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCurrentCallFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->currentCallFrame(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool pauseOnExceptions = args.at(0).toBoolean(exec);
+
+    imp->setPauseOnExceptions(pauseOnExceptions);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    unsigned sourceID = args.at(0).toInt32(exec);
+    unsigned lineNumber = args.at(1).toInt32(exec);
+
+    imp->addBreakpoint(sourceID, lineNumber);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionRemoveBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    unsigned sourceID = args.at(0).toInt32(exec);
+    unsigned lineNumber = args.at(1).toInt32(exec);
+
+    imp->removeBreakpoint(sourceID, lineNumber);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfiles(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->profiles(exec, args);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, InspectorController* object)
+{
+    return getDOMObjectWrapper<JSInspectorController>(exec, object);
+}
+InspectorController* toInspectorController(JSC::JSValue value)
+{
+    return value.isObject(&JSInspectorController::s_info) ? static_cast<JSInspectorController*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorController.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.h
new file mode 100644
index 0000000000..3bb1480d0c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.h
@@ -0,0 +1,138 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSInspectorController_h
+#define JSInspectorController_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class InspectorController;
+
+class JSInspectorController : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSInspectorController(PassRefPtr<JSC::Structure>, PassRefPtr<InspectorController>);
+    virtual ~JSInspectorController();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+
+    // Custom functions
+    JSC::JSValue highlightDOMNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getResourceDocumentNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue search(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue databaseTableNames(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setting(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setSetting(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue inspectedWindow(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue wrapCallback(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue currentCallFrame(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue profiles(JSC::ExecState*, const JSC::ArgList&);
+    InspectorController* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<InspectorController> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, InspectorController*);
+InspectorController* toInspectorController(JSC::JSValue);
+
+class JSInspectorControllerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSInspectorControllerPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHideDOMNodeHighlight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHighlightDOMNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLoaded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWindowUnloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAttach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCloseWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionClearMessages(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionToggleNodeSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionIsWindowVisible(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearchingForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddResourceSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionGetResourceDocumentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionInspectedWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLocalizedStringsURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHiddenPanels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPlatform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionMoveByUnrestricted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetAttachedWindowHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWrapCallback(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResourceTrackingEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableDebuggerFromFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResumeDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOverStatementInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepIntoStatementInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOutOfFunctionInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDebuggerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseOnExceptions(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfilerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStartProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStopProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCurrentCallFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetPauseOnExceptions(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionRemoveBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfiles(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsInspectorControllerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
index 6b60c21f29..924753ac95 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
@@ -20,6 +20,9 @@
 
 #include "config.h"
 
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JSJavaScriptCallFrame.h"
 
 #include <wtf/GetPtr.h>
@@ -36,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSJavaScriptCallFrame)
+ASSERT_CLASS_FITS_IN_CELL(JSJavaScriptCallFrame);
 
 /* Hash table */
 
@@ -76,9 +79,9 @@ static const HashTable JSJavaScriptCallFramePrototypeTable =
 
 const ClassInfo JSJavaScriptCallFramePrototype::s_info = { "JavaScriptCallFramePrototype", 0, &JSJavaScriptCallFramePrototypeTable, 0 };
 
-JSObject* JSJavaScriptCallFramePrototype::self(ExecState* exec)
+JSObject* JSJavaScriptCallFramePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSJavaScriptCallFrame>(exec);
+    return getDOMPrototype<JSJavaScriptCallFrame>(exec, globalObject);
 }
 
 bool JSJavaScriptCallFramePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,12 +100,11 @@ JSJavaScriptCallFrame::JSJavaScriptCallFrame(PassRefPtr<Structure> structure, Pa
 JSJavaScriptCallFrame::~JSJavaScriptCallFrame()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSJavaScriptCallFrame::createPrototype(ExecState* exec)
+JSObject* JSJavaScriptCallFrame::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSJavaScriptCallFramePrototype(JSJavaScriptCallFramePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSJavaScriptCallFramePrototype(JSJavaScriptCallFramePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSJavaScriptCallFrame::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,60 +112,67 @@ bool JSJavaScriptCallFrame::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSJavaScriptCallFrame, Base>(exec, &JSJavaScriptCallFrameTable, this, propertyName, slot);
 }
 
-JSValuePtr jsJavaScriptCallFrameCaller(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameCaller(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->caller()));
 }
 
-JSValuePtr jsJavaScriptCallFrameSourceID(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameSourceID(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->sourceID());
 }
 
-JSValuePtr jsJavaScriptCallFrameLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->line());
 }
 
-JSValuePtr jsJavaScriptCallFrameScopeChain(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameScopeChain(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->scopeChain(exec);
 }
 
-JSValuePtr jsJavaScriptCallFrameThisObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameThisObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->thisObject(exec);
 }
 
-JSValuePtr jsJavaScriptCallFrameFunctionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameFunctionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->functionName());
 }
 
-JSValuePtr jsJavaScriptCallFrameType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->type(exec);
 }
 
-JSValuePtr jsJavaScriptCallFramePrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSJavaScriptCallFrame::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSJavaScriptCallFrame::s_info))
         return throwError(exec, TypeError);
     JSJavaScriptCallFrame* castedThisObj = static_cast<JSJavaScriptCallFrame*>(asObject(thisValue));
     return castedThisObj->evaluate(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JavaScriptCallFrame* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JavaScriptCallFrame* object)
 {
     return getDOMObjectWrapper<JSJavaScriptCallFrame>(exec, object);
 }
-JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValuePtr value)
+JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValue value)
 {
-    return value->isObject(&JSJavaScriptCallFrame::s_info) ? static_cast<JSJavaScriptCallFrame*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSJavaScriptCallFrame::s_info) ? static_cast<JSJavaScriptCallFrame*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
index 9f1ca084f1..12a5810a59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
@@ -21,6 +21,9 @@
 #ifndef JSJavaScriptCallFrame_h
 #define JSJavaScriptCallFrame_h
 
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,40 +37,41 @@ class JSJavaScriptCallFrame : public DOMObject {
 public:
     JSJavaScriptCallFrame(PassRefPtr<JSC::Structure>, PassRefPtr<JavaScriptCallFrame>);
     virtual ~JSJavaScriptCallFrame();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom attributes
-    JSC::JSValuePtr scopeChain(JSC::ExecState*) const;
-    JSC::JSValuePtr thisObject(JSC::ExecState*) const;
-    JSC::JSValuePtr type(JSC::ExecState*) const;
+    JSC::JSValue scopeChain(JSC::ExecState*) const;
+    JSC::JSValue thisObject(JSC::ExecState*) const;
+    JSC::JSValue type(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr evaluate(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue evaluate(JSC::ExecState*, const JSC::ArgList&);
     JavaScriptCallFrame* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JavaScriptCallFrame> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JavaScriptCallFrame*);
-JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JavaScriptCallFrame*);
+JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValue);
 
 class JSJavaScriptCallFramePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -76,17 +80,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsJavaScriptCallFramePrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsJavaScriptCallFrameCaller(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameSourceID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameScopeChain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameThisObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameFunctionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameCaller(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameSourceID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameScopeChain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameThisObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameFunctionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
index 14dea9cbc0..107023be32 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSKeyboardEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSKeyboardEvent);
 
 /* Hash table */
 
@@ -79,13 +79,13 @@ public:
     JSKeyboardEventConstructor(ExecState* exec)
         : DOMObject(JSKeyboardEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSKeyboardEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSKeyboardEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +115,9 @@ static const HashTable JSKeyboardEventPrototypeTable =
 
 const ClassInfo JSKeyboardEventPrototype::s_info = { "KeyboardEventPrototype", 0, &JSKeyboardEventPrototypeTable, 0 };
 
-JSObject* JSKeyboardEventPrototype::self(ExecState* exec)
+JSObject* JSKeyboardEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSKeyboardEvent>(exec);
+    return getDOMPrototype<JSKeyboardEvent>(exec, globalObject);
 }
 
 bool JSKeyboardEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,9 +132,9 @@ JSKeyboardEvent::JSKeyboardEvent(PassRefPtr<Structure> structure, PassRefPtr<Key
 {
 }
 
-JSObject* JSKeyboardEvent::createPrototype(ExecState* exec)
+JSObject* JSKeyboardEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSKeyboardEventPrototype(JSKeyboardEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSKeyboardEventPrototype(JSKeyboardEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSKeyboardEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,74 +142,82 @@ bool JSKeyboardEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSKeyboardEvent, Base>(exec, &JSKeyboardEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsKeyboardEventKeyIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventKeyIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->keyIdentifier());
 }
 
-JSValuePtr jsKeyboardEventKeyLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventKeyLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->keyLocation());
 }
 
-JSValuePtr jsKeyboardEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ctrlKey());
 }
 
-JSValuePtr jsKeyboardEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->shiftKey());
 }
 
-JSValuePtr jsKeyboardEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altKey());
 }
 
-JSValuePtr jsKeyboardEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->metaKey());
 }
 
-JSValuePtr jsKeyboardEventAltGraphKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventAltGraphKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altGraphKey());
 }
 
-JSValuePtr jsKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSKeyboardEvent::getConstructor(ExecState* exec)
+JSValue JSKeyboardEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSKeyboardEventConstructor>(exec);
 }
 
-JSValuePtr jsKeyboardEventPrototypeFunctionInitKeyboardEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsKeyboardEventPrototypeFunctionInitKeyboardEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSKeyboardEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSKeyboardEvent::s_info))
         return throwError(exec, TypeError);
     JSKeyboardEvent* castedThisObj = static_cast<JSKeyboardEvent*>(asObject(thisValue));
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* view = toDOMWindow(args.at(exec, 3));
-    const UString& keyIdentifier = args.at(exec, 4)->toString(exec);
-    unsigned keyLocation = args.at(exec, 5)->toInt32(exec);
-    bool ctrlKey = args.at(exec, 6)->toBoolean(exec);
-    bool altKey = args.at(exec, 7)->toBoolean(exec);
-    bool shiftKey = args.at(exec, 8)->toBoolean(exec);
-    bool metaKey = args.at(exec, 9)->toBoolean(exec);
-    bool altGraphKey = args.at(exec, 10)->toBoolean(exec);
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    DOMWindow* view = toDOMWindow(args.at(3));
+    const UString& keyIdentifier = args.at(4).toString(exec);
+    unsigned keyLocation = args.at(5).toInt32(exec);
+    bool ctrlKey = args.at(6).toBoolean(exec);
+    bool altKey = args.at(7).toBoolean(exec);
+    bool shiftKey = args.at(8).toBoolean(exec);
+    bool metaKey = args.at(9).toBoolean(exec);
+    bool altGraphKey = args.at(10).toBoolean(exec);
 
     imp->initKeyboardEvent(type, canBubble, cancelable, view, keyIdentifier, keyLocation, ctrlKey, altKey, shiftKey, metaKey, altGraphKey);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
index c2d981adb5..40e6eb1c2f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
@@ -31,27 +31,28 @@ class JSKeyboardEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSKeyboardEvent(PassRefPtr<JSC::Structure>, PassRefPtr<KeyboardEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSKeyboardEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,17 +61,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsKeyboardEventPrototypeFunctionInitKeyboardEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsKeyboardEventPrototypeFunctionInitKeyboardEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsKeyboardEventKeyIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventKeyLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventAltGraphKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventKeyIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventKeyLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventAltGraphKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
index b1bbc16f9b..2f09ac828e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSLocation)
+ASSERT_CLASS_FITS_IN_CELL(JSLocation);
 
 /* Hash table */
 
@@ -79,9 +79,9 @@ static const HashTable JSLocationPrototypeTable =
 
 const ClassInfo JSLocationPrototype::s_info = { "LocationPrototype", 0, &JSLocationPrototypeTable, 0 };
 
-JSObject* JSLocationPrototype::self(ExecState* exec)
+JSObject* JSLocationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSLocation>(exec);
+    return getDOMPrototype<JSLocation>(exec, globalObject);
 }
 
 bool JSLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -89,6 +89,13 @@ bool JSLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSLocationPrototypeTable, this, propertyName, slot);
 }
 
+void JSLocationPrototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    if (customPut(exec, propertyName, value, slot))
+        return;
+    Base::put(exec, propertyName, value, slot);
+}
+
 const ClassInfo JSLocation::s_info = { "Location", 0, &JSLocationTable, 0 };
 
 JSLocation::JSLocation(PassRefPtr<Structure> structure, PassRefPtr<Location> impl)
@@ -100,12 +107,11 @@ JSLocation::JSLocation(PassRefPtr<Structure> structure, PassRefPtr<Location> imp
 JSLocation::~JSLocation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSLocation::createPrototype(ExecState* exec)
+JSObject* JSLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSLocationPrototype(JSLocationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSLocationPrototype(JSLocationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSLocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -115,97 +121,105 @@ bool JSLocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSLocation, Base>(exec, &JSLocationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-void JSLocation::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSLocation::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
     lookupPut<JSLocation, Base>(exec, propertyName, value, &JSLocationTable, this, slot);
 }
 
-void setJSLocationHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHref(exec, value);
 }
 
-void setJSLocationProtocol(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationProtocol(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setProtocol(exec, value);
 }
 
-void setJSLocationHost(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHost(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHost(exec, value);
 }
 
-void setJSLocationHostname(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHostname(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHostname(exec, value);
 }
 
-void setJSLocationPort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationPort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setPort(exec, value);
 }
 
-void setJSLocationPathname(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationPathname(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setPathname(exec, value);
 }
 
-void setJSLocationSearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationSearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setSearch(exec, value);
 }
 
-void setJSLocationHash(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHash(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHash(exec, value);
 }
@@ -217,45 +231,49 @@ void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr jsLocationPrototypeFunctionAssign(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionAssign(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->assign(exec, args);
 }
 
-JSValuePtr jsLocationPrototypeFunctionReplace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->replace(exec, args);
 }
 
-JSValuePtr jsLocationPrototypeFunctionReload(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReload(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->reload(exec, args);
 }
 
-JSValuePtr jsLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->toString(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Location* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Location* object)
 {
     return getDOMObjectWrapper<JSLocation>(exec, object);
 }
-Location* toLocation(JSC::JSValuePtr value)
+Location* toLocation(JSC::JSValue value)
 {
-    return value->isObject(&JSLocation::s_info) ? static_cast<JSLocation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSLocation::s_info) ? static_cast<JSLocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.h b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
index a4e8e742b1..7d83575f8b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
@@ -34,15 +34,15 @@ class JSLocation : public DOMObject {
 public:
     JSLocation(PassRefPtr<JSC::Structure>, PassRefPtr<Location>);
     virtual ~JSLocation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,68 +50,73 @@ public:
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     bool customGetPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
 
     // Custom attributes
-    void setHref(JSC::ExecState*, JSC::JSValuePtr);
-    void setProtocol(JSC::ExecState*, JSC::JSValuePtr);
-    void setHost(JSC::ExecState*, JSC::JSValuePtr);
-    void setHostname(JSC::ExecState*, JSC::JSValuePtr);
-    void setPort(JSC::ExecState*, JSC::JSValuePtr);
-    void setPathname(JSC::ExecState*, JSC::JSValuePtr);
-    void setSearch(JSC::ExecState*, JSC::JSValuePtr);
-    void setHash(JSC::ExecState*, JSC::JSValuePtr);
+    void setHref(JSC::ExecState*, JSC::JSValue);
+    void setProtocol(JSC::ExecState*, JSC::JSValue);
+    void setHost(JSC::ExecState*, JSC::JSValue);
+    void setHostname(JSC::ExecState*, JSC::JSValue);
+    void setPort(JSC::ExecState*, JSC::JSValue);
+    void setPathname(JSC::ExecState*, JSC::JSValue);
+    void setSearch(JSC::ExecState*, JSC::JSValue);
+    void setHash(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr assign(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replace(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr reload(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr toString(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue assign(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replace(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue reload(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue toString(JSC::ExecState*, const JSC::ArgList&);
     Location* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Location> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Location*);
-Location* toLocation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Location*);
+Location* toLocation(JSC::JSValue);
 
 class JSLocationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
     JSLocationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
 // Functions
 
-JSC::JSValuePtr jsLocationPrototypeFunctionAssign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsLocationPrototypeFunctionReplace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsLocationPrototypeFunctionReload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionAssign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReplace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationProtocol(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHost(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHostname(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationPathname(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHash(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationProtocol(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHost(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHostname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationPathname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHash(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index 6789d9d5ab..107d706942 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMediaError)
+ASSERT_CLASS_FITS_IN_CELL(JSMediaError);
 
 /* Hash table */
 
@@ -55,19 +55,20 @@ static const HashTable JSMediaErrorTable =
 
 /* Hash table for constructor */
 
-static const HashTableValue JSMediaErrorConstructorTableValues[4] =
+static const HashTableValue JSMediaErrorConstructorTableValues[5] =
 {
     { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_ABORTED, (intptr_t)0 },
     { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_NETWORK, (intptr_t)0 },
     { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_DECODE, (intptr_t)0 },
+    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSMediaErrorConstructorTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSMediaErrorConstructorTableValues, 0 };
+    { 31, JSMediaErrorConstructorTableValues, 0 };
 #else
-    { 8, 7, JSMediaErrorConstructorTableValues, 0 };
+    { 9, 7, JSMediaErrorConstructorTableValues, 0 };
 #endif
 
 class JSMediaErrorConstructor : public DOMObject {
@@ -75,13 +76,13 @@ public:
     JSMediaErrorConstructor(ExecState* exec)
         : DOMObject(JSMediaErrorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMediaErrorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMediaErrorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -96,26 +97,27 @@ bool JSMediaErrorConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
 
 /* Hash table for prototype */
 
-static const HashTableValue JSMediaErrorPrototypeTableValues[4] =
+static const HashTableValue JSMediaErrorPrototypeTableValues[5] =
 {
     { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_ABORTED, (intptr_t)0 },
     { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_NETWORK, (intptr_t)0 },
     { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_DECODE, (intptr_t)0 },
+    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSMediaErrorPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSMediaErrorPrototypeTableValues, 0 };
+    { 31, JSMediaErrorPrototypeTableValues, 0 };
 #else
-    { 8, 7, JSMediaErrorPrototypeTableValues, 0 };
+    { 9, 7, JSMediaErrorPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSMediaErrorPrototype::s_info = { "MediaErrorPrototype", 0, &JSMediaErrorPrototypeTable, 0 };
 
-JSObject* JSMediaErrorPrototype::self(ExecState* exec)
+JSObject* JSMediaErrorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMediaError>(exec);
+    return getDOMPrototype<JSMediaError>(exec, globalObject);
 }
 
 bool JSMediaErrorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,12 +136,11 @@ JSMediaError::JSMediaError(PassRefPtr<Structure> structure, PassRefPtr<MediaErro
 JSMediaError::~JSMediaError()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMediaError::createPrototype(ExecState* exec)
+JSObject* JSMediaError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMediaErrorPrototype(JSMediaErrorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMediaErrorPrototype(JSMediaErrorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMediaError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,45 +148,51 @@ bool JSMediaError::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSMediaError, Base>(exec, &JSMediaErrorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMediaErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MediaError* imp = static_cast<MediaError*>(static_cast<JSMediaError*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMediaError*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMediaError::getConstructor(ExecState* exec)
+JSValue JSMediaError::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMediaErrorConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsMediaErrorMEDIA_ERR_ABORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_ABORTED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsMediaErrorMEDIA_ERR_NETWORK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_NETWORK(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsMediaErrorMEDIA_ERR_DECODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_DECODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MediaError* object)
+JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(4));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, MediaError* object)
 {
     return getDOMObjectWrapper<JSMediaError>(exec, object);
 }
-MediaError* toMediaError(JSC::JSValuePtr value)
+MediaError* toMediaError(JSC::JSValue value)
 {
-    return value->isObject(&JSMediaError::s_info) ? static_cast<JSMediaError*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMediaError::s_info) ? static_cast<JSMediaError*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
index f2215586c2..eab4bf705e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
@@ -37,33 +37,34 @@ class JSMediaError : public DOMObject {
 public:
     JSMediaError(PassRefPtr<JSC::Structure>, PassRefPtr<MediaError>);
     virtual ~JSMediaError();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MediaError* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MediaError> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MediaError*);
-MediaError* toMediaError(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MediaError*);
+MediaError* toMediaError(JSC::JSValue);
 
 class JSMediaErrorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,13 +73,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsMediaErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsMediaErrorMEDIA_ERR_ABORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaErrorMEDIA_ERR_NETWORK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaErrorMEDIA_ERR_DECODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_ABORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_NETWORK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_DECODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index ce48c390f2..84effe028a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMediaList)
+ASSERT_CLASS_FITS_IN_CELL(JSMediaList);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSMediaListConstructor(ExecState* exec)
         : DOMObject(JSMediaListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMediaListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMediaListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSMediaListPrototypeTable =
 
 const ClassInfo JSMediaListPrototype::s_info = { "MediaListPrototype", 0, &JSMediaListPrototypeTable, 0 };
 
-JSObject* JSMediaListPrototype::self(ExecState* exec)
+JSObject* JSMediaListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMediaList>(exec);
+    return getDOMPrototype<JSMediaList>(exec, globalObject);
 }
 
 bool JSMediaListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +132,11 @@ JSMediaList::JSMediaList(PassRefPtr<Structure> structure, PassRefPtr<MediaList>
 JSMediaList::~JSMediaList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMediaList::createPrototype(ExecState* exec)
+JSObject* JSMediaList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMediaListPrototype(JSMediaListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMediaListPrototype(JSMediaListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMediaList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,28 +164,30 @@ bool JSMediaList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Pro
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsMediaListMediaText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListMediaText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MediaList* imp = static_cast<MediaList*>(static_cast<JSMediaList*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->mediaText());
 }
 
-JSValuePtr jsMediaListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MediaList* imp = static_cast<MediaList*>(static_cast<JSMediaList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMediaList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSMediaList::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSMediaList::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSMediaList, Base>(exec, propertyName, value, &JSMediaListTable, this, slot);
 }
 
-void setJSMediaListMediaText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSMediaListMediaText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     MediaList* imp = static_cast<MediaList*>(static_cast<JSMediaList*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -201,46 +202,49 @@ void JSMediaList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyN
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSMediaList::getConstructor(ExecState* exec)
+JSValue JSMediaList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMediaListConstructor>(exec);
 }
 
-JSValuePtr jsMediaListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMediaList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->item(index));
+    JSC::JSValue result = jsStringOrNull(exec, imp->item(index));
     return result;
 }
 
-JSValuePtr jsMediaListPrototypeFunctionDeleteMedium(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionDeleteMedium(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMediaList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& oldMedium = args.at(exec, 0)->toString(exec);
+    const UString& oldMedium = args.at(0).toString(exec);
 
     imp->deleteMedium(oldMedium, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsMediaListPrototypeFunctionAppendMedium(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionAppendMedium(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMediaList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& newMedium = args.at(exec, 0)->toString(exec);
+    const UString& newMedium = args.at(0).toString(exec);
 
     imp->appendMedium(newMedium, ec);
     setDOMException(exec, ec);
@@ -248,18 +252,18 @@ JSValuePtr jsMediaListPrototypeFunctionAppendMedium(ExecState* exec, JSObject*,
 }
 
 
-JSValuePtr JSMediaList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMediaList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMediaList* thisObj = static_cast<JSMediaList*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MediaList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MediaList* object)
 {
     return getDOMObjectWrapper<JSMediaList>(exec, object);
 }
-MediaList* toMediaList(JSC::JSValuePtr value)
+MediaList* toMediaList(JSC::JSValue value)
 {
-    return value->isObject(&JSMediaList::s_info) ? static_cast<JSMediaList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMediaList::s_info) ? static_cast<JSMediaList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
index 01ce230888..800d9d4b91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
@@ -34,37 +34,38 @@ class JSMediaList : public DOMObject {
 public:
     JSMediaList(PassRefPtr<JSC::Structure>, PassRefPtr<MediaList>);
     virtual ~JSMediaList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MediaList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MediaList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MediaList*);
-MediaList* toMediaList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MediaList*);
+MediaList* toMediaList(JSC::JSValue);
 
 class JSMediaListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,15 +74,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMediaListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMediaListPrototypeFunctionDeleteMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMediaListPrototypeFunctionAppendMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionDeleteMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionAppendMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMediaListMediaText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSMediaListMediaText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsMediaListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaListMediaText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSMediaListMediaText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsMediaListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
index ac725d4dbd..47dfef6b62 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMessageChannel)
+ASSERT_CLASS_FITS_IN_CELL(JSMessageChannel);
 
 /* Hash table */
 
@@ -71,9 +71,9 @@ static const HashTable* getJSMessageChannelPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSMessageChannelPrototype::s_info = { "MessageChannelPrototype", 0, 0, getJSMessageChannelPrototypeTable };
 
-JSObject* JSMessageChannelPrototype::self(ExecState* exec)
+JSObject* JSMessageChannelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMessageChannel>(exec);
+    return getDOMPrototype<JSMessageChannel>(exec, globalObject);
 }
 
 static const HashTable* getJSMessageChannelTable(ExecState* exec)
@@ -91,12 +91,11 @@ JSMessageChannel::JSMessageChannel(PassRefPtr<Structure> structure, PassRefPtr<M
 JSMessageChannel::~JSMessageChannel()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMessageChannel::createPrototype(ExecState* exec)
+JSObject* JSMessageChannel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMessageChannelPrototype(JSMessageChannelPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMessageChannelPrototype(JSMessageChannelPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMessageChannel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,25 +103,27 @@ bool JSMessageChannel::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSMessageChannel, Base>(exec, getJSMessageChannelTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsMessageChannelPort1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageChannelPort1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageChannel* imp = static_cast<MessageChannel*>(static_cast<JSMessageChannel*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->port1()));
 }
 
-JSValuePtr jsMessageChannelPort2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageChannelPort2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageChannel* imp = static_cast<MessageChannel*>(static_cast<JSMessageChannel*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->port2()));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MessageChannel* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MessageChannel* object)
 {
     return getDOMObjectWrapper<JSMessageChannel>(exec, object);
 }
-MessageChannel* toMessageChannel(JSC::JSValuePtr value)
+MessageChannel* toMessageChannel(JSC::JSValue value)
 {
-    return value->isObject(&JSMessageChannel::s_info) ? static_cast<JSMessageChannel*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMessageChannel::s_info) ? static_cast<JSMessageChannel*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
index f4aa3b5e9d..f9a90261be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
@@ -34,12 +34,12 @@ class JSMessageChannel : public DOMObject {
 public:
     JSMessageChannel(PassRefPtr<JSC::Structure>, PassRefPtr<MessageChannel>);
     virtual ~JSMessageChannel();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -52,12 +52,13 @@ private:
     RefPtr<MessageChannel> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MessageChannel*);
-MessageChannel* toMessageChannel(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MessageChannel*);
+MessageChannel* toMessageChannel(JSC::JSValue);
 
 class JSMessageChannelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSMessageChannelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -65,8 +66,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsMessageChannelPort1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageChannelPort2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageChannelPort1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageChannelPort2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
index f0ee01640d..b49fd94d0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMessageEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSMessageEvent);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSMessageEventConstructor(ExecState* exec)
         : DOMObject(JSMessageEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMessageEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMessageEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +120,9 @@ static const HashTable* getJSMessageEventPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSMessageEventPrototype::s_info = { "MessageEventPrototype", 0, 0, getJSMessageEventPrototypeTable };
 
-JSObject* JSMessageEventPrototype::self(ExecState* exec)
+JSObject* JSMessageEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMessageEvent>(exec);
+    return getDOMPrototype<JSMessageEvent>(exec, globalObject);
 }
 
 bool JSMessageEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,9 +141,9 @@ JSMessageEvent::JSMessageEvent(PassRefPtr<Structure> structure, PassRefPtr<Messa
 {
 }
 
-JSObject* JSMessageEvent::createPrototype(ExecState* exec)
+JSObject* JSMessageEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMessageEventPrototype(JSMessageEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSMessageEventPrototype(JSMessageEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSMessageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,59 +151,65 @@ bool JSMessageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSMessageEvent, Base>(exec, getJSMessageEventTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsMessageEventOrigin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventOrigin(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->origin());
 }
 
-JSValuePtr jsMessageEventLastEventId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventLastEventId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lastEventId());
 }
 
-JSValuePtr jsMessageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->source()));
 }
 
-JSValuePtr jsMessageEventMessagePort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventMessagePort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->messagePort()));
 }
 
-JSValuePtr jsMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMessageEvent::getConstructor(ExecState* exec)
+JSValue JSMessageEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMessageEventConstructor>(exec);
 }
 
-JSValuePtr jsMessageEventPrototypeFunctionInitMessageEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessageEventPrototypeFunctionInitMessageEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessageEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessageEvent::s_info))
         return throwError(exec, TypeError);
     JSMessageEvent* castedThisObj = static_cast<JSMessageEvent*>(asObject(thisValue));
     MessageEvent* imp = static_cast<MessageEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& dataArg = args.at(exec, 3)->toString(exec);
-    const UString& originArg = args.at(exec, 4)->toString(exec);
-    const UString& lastEventIdArg = args.at(exec, 5)->toString(exec);
-    DOMWindow* sourceArg = toDOMWindow(args.at(exec, 6));
-    MessagePort* messagePort = toMessagePort(args.at(exec, 7));
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& dataArg = args.at(3).toString(exec);
+    const UString& originArg = args.at(4).toString(exec);
+    const UString& lastEventIdArg = args.at(5).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(6));
+    MessagePort* messagePort = toMessagePort(args.at(7));
 
     imp->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePort);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
index 501af7d71b..4cdefab8f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
@@ -31,27 +31,28 @@ class JSMessageEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSMessageEvent(PassRefPtr<JSC::Structure>, PassRefPtr<MessageEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSMessageEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,15 +61,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMessageEventPrototypeFunctionInitMessageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessageEventPrototypeFunctionInitMessageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMessageEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventOrigin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventLastEventId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventMessagePort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventOrigin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventLastEventId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventMessagePort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index fe6c57f6fc..5f9eb5ed97 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -41,7 +41,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMessagePort)
+ASSERT_CLASS_FITS_IN_CELL(JSMessagePort);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSMessagePortConstructor(ExecState* exec)
         : DOMObject(JSMessagePortConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMessagePortPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMessagePortPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +126,9 @@ static const HashTable* getJSMessagePortPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSMessagePortPrototype::s_info = { "MessagePortPrototype", 0, 0, getJSMessagePortPrototypeTable };
 
-JSObject* JSMessagePortPrototype::self(ExecState* exec)
+JSObject* JSMessagePortPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMessagePort>(exec);
+    return getDOMPrototype<JSMessagePort>(exec, globalObject);
 }
 
 bool JSMessagePortPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,12 +151,11 @@ JSMessagePort::JSMessagePort(PassRefPtr<Structure> structure, PassRefPtr<Message
 JSMessagePort::~JSMessagePort()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMessagePort::createPrototype(ExecState* exec)
+JSObject* JSMessagePort::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMessagePortPrototype(JSMessagePortPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMessagePortPrototype(JSMessagePortPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMessagePort::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -164,72 +163,78 @@ bool JSMessagePort::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSMessagePort, Base>(exec, getJSMessagePortTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsMessagePortActive(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortActive(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->active());
 }
 
-JSValuePtr jsMessagePortOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onmessage())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsMessagePortOnclose(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortOnclose(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onclose())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onclose()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsMessagePortConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMessagePort*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSMessagePort::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSMessagePort::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSMessagePort, Base>(exec, propertyName, value, getJSMessagePortTable(exec), this, slot);
 }
 
-void setJSMessagePortOnmessage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSMessagePortOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmessage(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSMessagePortOnclose(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSMessagePortOnclose(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnclose(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnclose(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr JSMessagePort::getConstructor(ExecState* exec)
+JSValue JSMessagePort::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMessagePortConstructor>(exec);
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     int argsCount = args.size();
     if (argsCount < 2) {
@@ -238,24 +243,26 @@ JSValuePtr jsMessagePortPrototypeFunctionPostMessage(ExecState* exec, JSObject*,
         return jsUndefined();
     }
 
-    MessagePort* messagePort = toMessagePort(args.at(exec, 1));
+    MessagePort* messagePort = toMessagePort(args.at(1));
 
     imp->postMessage(message, messagePort, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionStartConversation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStartConversation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     return castedThisObj->startConversation(exec, args);
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
@@ -264,9 +271,10 @@ JSValuePtr jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObject*, JSVal
     return jsUndefined();
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
@@ -275,44 +283,47 @@ JSValuePtr jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObject*, JSVal
     return jsUndefined();
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MessagePort* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MessagePort* object)
 {
     return getDOMObjectWrapper<JSMessagePort>(exec, object);
 }
-MessagePort* toMessagePort(JSC::JSValuePtr value)
+MessagePort* toMessagePort(JSC::JSValue value)
 {
-    return value->isObject(&JSMessagePort::s_info) ? static_cast<JSMessagePort*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMessagePort::s_info) ? static_cast<JSMessagePort*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
index 46e1591125..615d649bdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
@@ -34,41 +34,42 @@ class JSMessagePort : public DOMObject {
 public:
     JSMessagePort(PassRefPtr<JSC::Structure>, PassRefPtr<MessagePort>);
     virtual ~JSMessagePort();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr startConversation(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue startConversation(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     MessagePort* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MessagePort> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MessagePort*);
-MessagePort* toMessagePort(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MessagePort*);
+MessagePort* toMessagePort(JSC::JSValue);
 
 class JSMessagePortPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -77,21 +78,21 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMessagePortPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionStartConversation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStartConversation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMessagePortActive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessagePortOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSMessagePortOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsMessagePortOnclose(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSMessagePortOnclose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsMessagePortConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessagePortActive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessagePortOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSMessagePortOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsMessagePortOnclose(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSMessagePortOnclose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsMessagePortConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index 0d831176fd..292543db59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMimeType)
+ASSERT_CLASS_FITS_IN_CELL(JSMimeType);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSMimeTypeConstructor(ExecState* exec)
         : DOMObject(JSMimeTypeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMimeTypePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMimeTypePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSMimeTypePrototypeTable =
 
 const ClassInfo JSMimeTypePrototype::s_info = { "MimeTypePrototype", 0, &JSMimeTypePrototypeTable, 0 };
 
-JSObject* JSMimeTypePrototype::self(ExecState* exec)
+JSObject* JSMimeTypePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMimeType>(exec);
+    return getDOMPrototype<JSMimeType>(exec, globalObject);
 }
 
 const ClassInfo JSMimeType::s_info = { "MimeType", 0, &JSMimeTypeTable, 0 };
@@ -127,12 +127,11 @@ JSMimeType::JSMimeType(PassRefPtr<Structure> structure, PassRefPtr<MimeType> imp
 JSMimeType::~JSMimeType()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMimeType::createPrototype(ExecState* exec)
+JSObject* JSMimeType::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMimeTypePrototype(JSMimeTypePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMimeTypePrototype(JSMimeTypePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMimeType::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -140,46 +139,50 @@ bool JSMimeType::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSMimeType, Base>(exec, &JSMimeTypeTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMimeTypeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsMimeTypeSuffixes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeSuffixes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->suffixes());
 }
 
-JSValuePtr jsMimeTypeDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->description());
 }
 
-JSValuePtr jsMimeTypeEnabledPlugin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeEnabledPlugin(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->enabledPlugin()));
 }
 
-JSValuePtr jsMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMimeType*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMimeType::getConstructor(ExecState* exec)
+JSValue JSMimeType::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMimeTypeConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MimeType* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MimeType* object)
 {
     return getDOMObjectWrapper<JSMimeType>(exec, object);
 }
-MimeType* toMimeType(JSC::JSValuePtr value)
+MimeType* toMimeType(JSC::JSValue value)
 {
-    return value->isObject(&JSMimeType::s_info) ? static_cast<JSMimeType*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMimeType::s_info) ? static_cast<JSMimeType*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
index 6de6aa235f..79b904d42e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
@@ -34,29 +34,30 @@ class JSMimeType : public DOMObject {
 public:
     JSMimeType(PassRefPtr<JSC::Structure>, PassRefPtr<MimeType>);
     virtual ~JSMimeType();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MimeType* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MimeType> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MimeType*);
-MimeType* toMimeType(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MimeType*);
+MimeType* toMimeType(JSC::JSValue);
 
 class JSMimeTypePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSMimeTypePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,11 +65,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsMimeTypeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeSuffixes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeEnabledPlugin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeSuffixes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeEnabledPlugin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index 688f7f2644..1a5fdc819b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMimeTypeArray)
+ASSERT_CLASS_FITS_IN_CELL(JSMimeTypeArray);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSMimeTypeArrayConstructor(ExecState* exec)
         : DOMObject(JSMimeTypeArrayConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMimeTypeArrayPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMimeTypeArrayPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSMimeTypeArrayPrototypeTable =
 
 const ClassInfo JSMimeTypeArrayPrototype::s_info = { "MimeTypeArrayPrototype", 0, &JSMimeTypeArrayPrototypeTable, 0 };
 
-JSObject* JSMimeTypeArrayPrototype::self(ExecState* exec)
+JSObject* JSMimeTypeArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMimeTypeArray>(exec);
+    return getDOMPrototype<JSMimeTypeArray>(exec, globalObject);
 }
 
 bool JSMimeTypeArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +132,11 @@ JSMimeTypeArray::JSMimeTypeArray(PassRefPtr<Structure> structure, PassRefPtr<Mim
 JSMimeTypeArray::~JSMimeTypeArray()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMimeTypeArray::createPrototype(ExecState* exec)
+JSObject* JSMimeTypeArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMimeTypeArrayPrototype(JSMimeTypeArrayPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMimeTypeArrayPrototype(JSMimeTypeArrayPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMimeTypeArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -169,13 +168,14 @@ bool JSMimeTypeArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsMimeTypeArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -186,50 +186,52 @@ void JSMimeTypeArray::getPropertyNames(ExecState* exec, PropertyNameArray& prope
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSMimeTypeArray::getConstructor(ExecState* exec)
+JSValue JSMimeTypeArray::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMimeTypeArrayConstructor>(exec);
 }
 
-JSValuePtr jsMimeTypeArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMimeTypeArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMimeTypeArray::s_info))
         return throwError(exec, TypeError);
     JSMimeTypeArray* castedThisObj = static_cast<JSMimeTypeArray*>(asObject(thisValue));
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsMimeTypeArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMimeTypeArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMimeTypeArray::s_info))
         return throwError(exec, TypeError);
     JSMimeTypeArray* castedThisObj = static_cast<JSMimeTypeArray*>(asObject(thisValue));
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
 
-JSValuePtr JSMimeTypeArray::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<MimeTypeArray*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MimeTypeArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MimeTypeArray* object)
 {
     return getDOMObjectWrapper<JSMimeTypeArray>(exec, object);
 }
-MimeTypeArray* toMimeTypeArray(JSC::JSValuePtr value)
+MimeTypeArray* toMimeTypeArray(JSC::JSValue value)
 {
-    return value->isObject(&JSMimeTypeArray::s_info) ? static_cast<JSMimeTypeArray*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMimeTypeArray::s_info) ? static_cast<JSMimeTypeArray*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
index b261caf115..adc48244ff 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
@@ -34,39 +34,40 @@ class JSMimeTypeArray : public DOMObject {
 public:
     JSMimeTypeArray(PassRefPtr<JSC::Structure>, PassRefPtr<MimeTypeArray>);
     virtual ~JSMimeTypeArray();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MimeTypeArray* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MimeTypeArray> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, MimeTypeArray*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MimeTypeArray*);
-MimeTypeArray* toMimeTypeArray(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MimeTypeArray*);
+MimeTypeArray* toMimeTypeArray(JSC::JSValue);
 
 class JSMimeTypeArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,12 +76,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMimeTypeArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMimeTypeArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMimeTypeArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
index dd39497379..95001ac521 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
@@ -29,7 +29,6 @@
 #include "JSClipboard.h"
 #include "JSDOMWindow.h"
 #include "JSEventTarget.h"
-#include "JSEventTargetNode.h"
 #include "JSNode.h"
 #include "MouseEvent.h"
 #include "Node.h"
@@ -41,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMouseEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSMouseEvent);
 
 /* Hash table */
 
@@ -94,13 +93,13 @@ public:
     JSMouseEventConstructor(ExecState* exec)
         : DOMObject(JSMouseEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMouseEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMouseEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -130,9 +129,9 @@ static const HashTable JSMouseEventPrototypeTable =
 
 const ClassInfo JSMouseEventPrototype::s_info = { "MouseEventPrototype", 0, &JSMouseEventPrototypeTable, 0 };
 
-JSObject* JSMouseEventPrototype::self(ExecState* exec)
+JSObject* JSMouseEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMouseEvent>(exec);
+    return getDOMPrototype<JSMouseEvent>(exec, globalObject);
 }
 
 bool JSMouseEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,9 +146,9 @@ JSMouseEvent::JSMouseEvent(PassRefPtr<Structure> structure, PassRefPtr<MouseEven
 {
 }
 
-JSObject* JSMouseEvent::createPrototype(ExecState* exec)
+JSObject* JSMouseEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMouseEventPrototype(JSMouseEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSMouseEventPrototype(JSMouseEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSMouseEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -157,138 +156,156 @@ bool JSMouseEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSMouseEvent, Base>(exec, &JSMouseEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMouseEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenX());
 }
 
-JSValuePtr jsMouseEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenY());
 }
 
-JSValuePtr jsMouseEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientX());
 }
 
-JSValuePtr jsMouseEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientY());
 }
 
-JSValuePtr jsMouseEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ctrlKey());
 }
 
-JSValuePtr jsMouseEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->shiftKey());
 }
 
-JSValuePtr jsMouseEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altKey());
 }
 
-JSValuePtr jsMouseEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->metaKey());
 }
 
-JSValuePtr jsMouseEventButton(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventButton(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->button());
 }
 
-JSValuePtr jsMouseEventRelatedTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventRelatedTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->relatedTarget()));
 }
 
-JSValuePtr jsMouseEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetX());
 }
 
-JSValuePtr jsMouseEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetY());
 }
 
-JSValuePtr jsMouseEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsMouseEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsMouseEventFromElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventFromElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->fromElement()));
 }
 
-JSValuePtr jsMouseEventToElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventToElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->toElement()));
 }
 
-JSValuePtr jsMouseEventDataTransfer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventDataTransfer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->dataTransfer()));
 }
 
-JSValuePtr jsMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMouseEvent::getConstructor(ExecState* exec)
+JSValue JSMouseEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMouseEventConstructor>(exec);
 }
 
-JSValuePtr jsMouseEventPrototypeFunctionInitMouseEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMouseEventPrototypeFunctionInitMouseEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMouseEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMouseEvent::s_info))
         return throwError(exec, TypeError);
     JSMouseEvent* castedThisObj = static_cast<JSMouseEvent*>(asObject(thisValue));
     MouseEvent* imp = static_cast<MouseEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* view = toDOMWindow(args.at(exec, 3));
-    int detail = args.at(exec, 4)->toInt32(exec);
-    int screenX = args.at(exec, 5)->toInt32(exec);
-    int screenY = args.at(exec, 6)->toInt32(exec);
-    int clientX = args.at(exec, 7)->toInt32(exec);
-    int clientY = args.at(exec, 8)->toInt32(exec);
-    bool ctrlKey = args.at(exec, 9)->toBoolean(exec);
-    bool altKey = args.at(exec, 10)->toBoolean(exec);
-    bool shiftKey = args.at(exec, 11)->toBoolean(exec);
-    bool metaKey = args.at(exec, 12)->toBoolean(exec);
-    unsigned short button = args.at(exec, 13)->toInt32(exec);
-    EventTargetNode* relatedTarget = toEventTargetNode(args.at(exec, 14));
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    DOMWindow* view = toDOMWindow(args.at(3));
+    int detail = args.at(4).toInt32(exec);
+    int screenX = args.at(5).toInt32(exec);
+    int screenY = args.at(6).toInt32(exec);
+    int clientX = args.at(7).toInt32(exec);
+    int clientY = args.at(8).toInt32(exec);
+    bool ctrlKey = args.at(9).toBoolean(exec);
+    bool altKey = args.at(10).toBoolean(exec);
+    bool shiftKey = args.at(11).toBoolean(exec);
+    bool metaKey = args.at(12).toBoolean(exec);
+    unsigned short button = args.at(13).toInt32(exec);
+    EventTarget* relatedTarget = toEventTarget(args.at(14));
 
     imp->initMouseEvent(type, canBubble, cancelable, view, detail, screenX, screenY, clientX, clientY, ctrlKey, altKey, shiftKey, metaKey, button, relatedTarget);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
index 4109680edc..3730d934c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
@@ -31,27 +31,28 @@ class JSMouseEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSMouseEvent(PassRefPtr<JSC::Structure>, PassRefPtr<MouseEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSMouseEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,27 +61,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMouseEventPrototypeFunctionInitMouseEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMouseEventPrototypeFunctionInitMouseEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMouseEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventButton(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventRelatedTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventFromElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventToElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventDataTransfer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventButton(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventRelatedTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventFromElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventToElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventDataTransfer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
index 6e38809c95..5195e7537e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMutationEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSMutationEvent);
 
 /* Hash table */
 
@@ -81,13 +81,13 @@ public:
     JSMutationEventConstructor(ExecState* exec)
         : DOMObject(JSMutationEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMutationEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMutationEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +120,9 @@ static const HashTable JSMutationEventPrototypeTable =
 
 const ClassInfo JSMutationEventPrototype::s_info = { "MutationEventPrototype", 0, &JSMutationEventPrototypeTable, 0 };
 
-JSObject* JSMutationEventPrototype::self(ExecState* exec)
+JSObject* JSMutationEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMutationEvent>(exec);
+    return getDOMPrototype<JSMutationEvent>(exec, globalObject);
 }
 
 bool JSMutationEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,9 +137,9 @@ JSMutationEvent::JSMutationEvent(PassRefPtr<Structure> structure, PassRefPtr<Mut
 {
 }
 
-JSObject* JSMutationEvent::createPrototype(ExecState* exec)
+JSObject* JSMutationEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMutationEventPrototype(JSMutationEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSMutationEventPrototype(JSMutationEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSMutationEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,59 +147,65 @@ bool JSMutationEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSMutationEvent, Base>(exec, &JSMutationEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMutationEventRelatedNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventRelatedNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->relatedNode()));
 }
 
-JSValuePtr jsMutationEventPrevValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventPrevValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->prevValue());
 }
 
-JSValuePtr jsMutationEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->newValue());
 }
 
-JSValuePtr jsMutationEventAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->attrName());
 }
 
-JSValuePtr jsMutationEventAttrChange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventAttrChange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->attrChange());
 }
 
-JSValuePtr jsMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMutationEvent::getConstructor(ExecState* exec)
+JSValue JSMutationEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMutationEventConstructor>(exec);
 }
 
-JSValuePtr jsMutationEventPrototypeFunctionInitMutationEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMutationEventPrototypeFunctionInitMutationEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMutationEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMutationEvent::s_info))
         return throwError(exec, TypeError);
     JSMutationEvent* castedThisObj = static_cast<JSMutationEvent*>(asObject(thisValue));
     MutationEvent* imp = static_cast<MutationEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    Node* relatedNode = toNode(args.at(exec, 3));
-    const UString& prevValue = args.at(exec, 4)->toString(exec);
-    const UString& newValue = args.at(exec, 5)->toString(exec);
-    const UString& attrName = args.at(exec, 6)->toString(exec);
-    unsigned short attrChange = args.at(exec, 7)->toInt32(exec);
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    Node* relatedNode = toNode(args.at(3));
+    const UString& prevValue = args.at(4).toString(exec);
+    const UString& newValue = args.at(5).toString(exec);
+    const UString& attrName = args.at(6).toString(exec);
+    unsigned short attrChange = args.at(7).toInt32(exec);
 
     imp->initMutationEvent(type, canBubble, cancelable, relatedNode, prevValue, newValue, attrName, attrChange);
     return jsUndefined();
@@ -207,17 +213,17 @@ JSValuePtr jsMutationEventPrototypeFunctionInitMutationEvent(ExecState* exec, JS
 
 // Constant getters
 
-JSValuePtr jsMutationEventMODIFICATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventMODIFICATION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsMutationEventADDITION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventADDITION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsMutationEventREMOVAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventREMOVAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
index 15b91110a6..7948398738 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
@@ -31,27 +31,28 @@ class JSMutationEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSMutationEvent(PassRefPtr<JSC::Structure>, PassRefPtr<MutationEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSMutationEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,20 +61,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMutationEventPrototypeFunctionInitMutationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMutationEventPrototypeFunctionInitMutationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMutationEventRelatedNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventPrevValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventAttrChange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventRelatedNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventPrevValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventAttrChange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsMutationEventMODIFICATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventADDITION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventREMOVAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventMODIFICATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventADDITION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventREMOVAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index 8711522be0..c89ba55605 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodeMap)
+ASSERT_CLASS_FITS_IN_CELL(JSNamedNodeMap);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSNamedNodeMapConstructor(ExecState* exec)
         : DOMObject(JSNamedNodeMapConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNamedNodeMapPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNamedNodeMapPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +116,9 @@ static const HashTable JSNamedNodeMapPrototypeTable =
 
 const ClassInfo JSNamedNodeMapPrototype::s_info = { "NamedNodeMapPrototype", 0, &JSNamedNodeMapPrototypeTable, 0 };
 
-JSObject* JSNamedNodeMapPrototype::self(ExecState* exec)
+JSObject* JSNamedNodeMapPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNamedNodeMap>(exec);
+    return getDOMPrototype<JSNamedNodeMap>(exec, globalObject);
 }
 
 bool JSNamedNodeMapPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,18 +137,17 @@ JSNamedNodeMap::JSNamedNodeMap(PassRefPtr<Structure> structure, PassRefPtr<Named
 JSNamedNodeMap::~JSNamedNodeMap()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNamedNodeMap::createPrototype(ExecState* exec)
+JSObject* JSNamedNodeMap::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNamedNodeMapPrototype(JSNamedNodeMapPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNamedNodeMapPrototype(JSNamedNodeMapPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNamedNodeMap::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    JSValuePtr proto = prototype();
-    if (proto->isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
         return false;
 
     const HashEntry* entry = JSNamedNodeMapTable.entry(exec, propertyName);
@@ -178,13 +177,14 @@ bool JSNamedNodeMap::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsNamedNodeMapLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNamedNodeMapLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -195,125 +195,132 @@ void JSNamedNodeMap::getPropertyNames(ExecState* exec, PropertyNameArray& proper
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSNamedNodeMap::getConstructor(ExecState* exec)
+JSValue JSNamedNodeMap::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNamedNodeMapConstructor>(exec);
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getNamedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getNamedItem(name)));
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->setNamedItem(node, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->setNamedItem(node, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->removeNamedItem(name, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->removeNamedItem(name, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItemNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getNamedItemNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getNamedItemNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItemNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->setNamedItemNS(node, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->setNamedItemNS(node, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->removeNamedItemNS(namespaceURI, localName, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->removeNamedItemNS(namespaceURI, localName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
 
-JSValuePtr JSNamedNodeMap::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<NamedNodeMap*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NamedNodeMap* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NamedNodeMap* object)
 {
     return getDOMObjectWrapper<JSNamedNodeMap>(exec, object);
 }
-NamedNodeMap* toNamedNodeMap(JSC::JSValuePtr value)
+NamedNodeMap* toNamedNodeMap(JSC::JSValue value)
 {
-    return value->isObject(&JSNamedNodeMap::s_info) ? static_cast<JSNamedNodeMap*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNamedNodeMap::s_info) ? static_cast<JSNamedNodeMap*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index c58efe5272..f7c132e87f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -34,39 +34,40 @@ class JSNamedNodeMap : public DOMObject {
 public:
     JSNamedNodeMap(PassRefPtr<JSC::Structure>, PassRefPtr<NamedNodeMap>);
     virtual ~JSNamedNodeMap();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     NamedNodeMap* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NamedNodeMap> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NamedNodeMap*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NamedNodeMap*);
-NamedNodeMap* toNamedNodeMap(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NamedNodeMap*);
+NamedNodeMap* toNamedNodeMap(JSC::JSValue);
 
 class JSNamedNodeMapPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,17 +76,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNamedNodeMapLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNamedNodeMapLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
index 441510f9f3..0d343fb011 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNavigator)
+ASSERT_CLASS_FITS_IN_CELL(JSNavigator);
 
 /* Hash table */
 
@@ -85,9 +85,9 @@ static const HashTable JSNavigatorPrototypeTable =
 
 const ClassInfo JSNavigatorPrototype::s_info = { "NavigatorPrototype", 0, &JSNavigatorPrototypeTable, 0 };
 
-JSObject* JSNavigatorPrototype::self(ExecState* exec)
+JSObject* JSNavigatorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNavigator>(exec);
+    return getDOMPrototype<JSNavigator>(exec, globalObject);
 }
 
 bool JSNavigatorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -106,12 +106,11 @@ JSNavigator::JSNavigator(PassRefPtr<Structure> structure, PassRefPtr<Navigator>
 JSNavigator::~JSNavigator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNavigator::createPrototype(ExecState* exec)
+JSObject* JSNavigator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNavigatorPrototype(JSNavigatorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNavigatorPrototype(JSNavigatorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -119,108 +118,124 @@ bool JSNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSNavigator, Base>(exec, &JSNavigatorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNavigatorAppCodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppCodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appCodeName());
 }
 
-JSValuePtr jsNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appName());
 }
 
-JSValuePtr jsNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    return static_cast<JSNavigator*>(asObject(slot.slotBase()))->appVersion(exec);
+    UNUSED_PARAM(exec);
+    Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->appVersion());
 }
 
-JSValuePtr jsNavigatorLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->language());
 }
 
-JSValuePtr jsNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->userAgent());
 }
 
-JSValuePtr jsNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->platform());
 }
 
-JSValuePtr jsNavigatorPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->plugins()));
 }
 
-JSValuePtr jsNavigatorMimeTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorMimeTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->mimeTypes()));
 }
 
-JSValuePtr jsNavigatorProduct(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorProduct(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->product());
 }
 
-JSValuePtr jsNavigatorProductSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorProductSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->productSub());
 }
 
-JSValuePtr jsNavigatorVendor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorVendor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vendor());
 }
 
-JSValuePtr jsNavigatorVendorSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorVendorSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vendorSub());
 }
 
-JSValuePtr jsNavigatorCookieEnabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorCookieEnabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->cookieEnabled());
 }
 
-JSValuePtr jsNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->onLine());
 }
 
-JSValuePtr jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNavigator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNavigator::s_info))
         return throwError(exec, TypeError);
     JSNavigator* castedThisObj = static_cast<JSNavigator*>(asObject(thisValue));
     Navigator* imp = static_cast<Navigator*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->javaEnabled());
+    JSC::JSValue result = jsBoolean(imp->javaEnabled());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Navigator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Navigator* object)
 {
     return getDOMObjectWrapper<JSNavigator>(exec, object);
 }
-Navigator* toNavigator(JSC::JSValuePtr value)
+Navigator* toNavigator(JSC::JSValue value)
 {
-    return value->isObject(&JSNavigator::s_info) ? static_cast<JSNavigator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNavigator::s_info) ? static_cast<JSNavigator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
index fbbdd310dd..0a3a5df598 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
@@ -34,37 +34,35 @@ class JSNavigator : public DOMObject {
 public:
     JSNavigator(PassRefPtr<JSC::Structure>, PassRefPtr<Navigator>);
     virtual ~JSNavigator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-
-    // Custom attributes
-    JSC::JSValuePtr appVersion(JSC::ExecState*) const;
     Navigator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Navigator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Navigator*);
-Navigator* toNavigator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Navigator*);
+Navigator* toNavigator(JSC::JSValue);
 
 class JSNavigatorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,23 +71,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNavigatorPrototypeFunctionJavaEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNavigatorAppCodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorMimeTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorProduct(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorProductSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorVendor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorVendorSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorCookieEnabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorAppCodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorMimeTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorProduct(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorProductSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorVendor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorVendorSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorCookieEnabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index aa8fb00e02..6cb55ee391 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -25,16 +25,24 @@
 #include <wtf/GetPtr.h>
 
 #include "Document.h"
+#include "Element.h"
+#include "Event.h"
+#include "EventListener.h"
+#include "Frame.h"
+#include "JSDOMGlobalObject.h"
 #include "JSDocument.h"
+#include "JSElement.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
 #include "JSNamedNodeMap.h"
 #include "JSNode.h"
 #include "JSNodeList.h"
 #include "KURL.h"
 #include "NameNodeList.h"
-#include "NamedAttrMap.h"
 #include "NamedNodeMap.h"
 #include "Node.h"
 #include "NodeList.h"
+#include "RegisteredEventListener.h"
 
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
@@ -43,11 +51,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNode)
+ASSERT_CLASS_FITS_IN_CELL(JSNode);
 
 /* Hash table */
 
-static const HashTableValue JSNodeTableValues[19] =
+static const HashTableValue JSNodeTableValues[59] =
 {
     { "nodeName", DontDelete|ReadOnly, (intptr_t)jsNodeNodeName, (intptr_t)0 },
     { "nodeValue", DontDelete, (intptr_t)jsNodeNodeValue, (intptr_t)setJSNodeNodeValue },
@@ -66,6 +74,46 @@ static const HashTableValue JSNodeTableValues[19] =
     { "baseURI", DontDelete|ReadOnly, (intptr_t)jsNodeBaseURI, (intptr_t)0 },
     { "textContent", DontDelete, (intptr_t)jsNodeTextContent, (intptr_t)setJSNodeTextContent },
     { "parentElement", DontDelete|ReadOnly, (intptr_t)jsNodeParentElement, (intptr_t)0 },
+    { "onabort", DontDelete|DontEnum, (intptr_t)jsNodeOnabort, (intptr_t)setJSNodeOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)jsNodeOnblur, (intptr_t)setJSNodeOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)jsNodeOnchange, (intptr_t)setJSNodeOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)jsNodeOnclick, (intptr_t)setJSNodeOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsNodeOncontextmenu, (intptr_t)setJSNodeOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsNodeOndblclick, (intptr_t)setJSNodeOndblclick },
+    { "onerror", DontDelete|DontEnum, (intptr_t)jsNodeOnerror, (intptr_t)setJSNodeOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)jsNodeOnfocus, (intptr_t)setJSNodeOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)jsNodeOninput, (intptr_t)setJSNodeOninput },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsNodeOnkeydown, (intptr_t)setJSNodeOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsNodeOnkeypress, (intptr_t)setJSNodeOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsNodeOnkeyup, (intptr_t)setJSNodeOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)jsNodeOnload, (intptr_t)setJSNodeOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsNodeOnmousedown, (intptr_t)setJSNodeOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsNodeOnmousemove, (intptr_t)setJSNodeOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsNodeOnmouseout, (intptr_t)setJSNodeOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsNodeOnmouseover, (intptr_t)setJSNodeOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsNodeOnmouseup, (intptr_t)setJSNodeOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsNodeOnmousewheel, (intptr_t)setJSNodeOnmousewheel },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsNodeOnbeforecut, (intptr_t)setJSNodeOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)jsNodeOncut, (intptr_t)setJSNodeOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsNodeOnbeforecopy, (intptr_t)setJSNodeOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)jsNodeOncopy, (intptr_t)setJSNodeOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsNodeOnbeforepaste, (intptr_t)setJSNodeOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)jsNodeOnpaste, (intptr_t)setJSNodeOnpaste },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsNodeOndragenter, (intptr_t)setJSNodeOndragenter },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)jsNodeOndragover, (intptr_t)setJSNodeOndragover },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsNodeOndragleave, (intptr_t)setJSNodeOndragleave },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)jsNodeOndrop, (intptr_t)setJSNodeOndrop },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsNodeOndragstart, (intptr_t)setJSNodeOndragstart },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)jsNodeOndrag, (intptr_t)setJSNodeOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)jsNodeOndragend, (intptr_t)setJSNodeOndragend },
+    { "onreset", DontDelete|DontEnum, (intptr_t)jsNodeOnreset, (intptr_t)setJSNodeOnreset },
+    { "onresize", DontDelete|DontEnum, (intptr_t)jsNodeOnresize, (intptr_t)setJSNodeOnresize },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)jsNodeOnscroll, (intptr_t)setJSNodeOnscroll },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)jsNodeOnsearch, (intptr_t)setJSNodeOnsearch },
+    { "onselect", DontDelete|DontEnum, (intptr_t)jsNodeOnselect, (intptr_t)setJSNodeOnselect },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsNodeOnselectstart, (intptr_t)setJSNodeOnselectstart },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsNodeOnsubmit, (intptr_t)setJSNodeOnsubmit },
+    { "onunload", DontDelete|DontEnum, (intptr_t)jsNodeOnunload, (intptr_t)setJSNodeOnunload },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsNodeConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -74,7 +122,7 @@ static const HashTable JSNodeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 4095, JSNodeTableValues, 0 };
 #else
-    { 68, 63, JSNodeTableValues, 0 };
+    { 140, 127, JSNodeTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -114,13 +162,13 @@ public:
     JSNodeConstructor(ExecState* exec)
         : DOMObject(JSNodeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -135,7 +183,7 @@ bool JSNodeConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
 
 /* Hash table for prototype */
 
-static const HashTableValue JSNodePrototypeTableValues[34] =
+static const HashTableValue JSNodePrototypeTableValues[37] =
 {
     { "ELEMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeELEMENT_NODE, (intptr_t)0 },
     { "ATTRIBUTE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeATTRIBUTE_NODE, (intptr_t)0 },
@@ -170,6 +218,9 @@ static const HashTableValue JSNodePrototypeTableValues[34] =
     { "isDefaultNamespace", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionIsDefaultNamespace, (intptr_t)1 },
     { "lookupNamespaceURI", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionLookupNamespaceURI, (intptr_t)1 },
     { "compareDocumentPosition", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionCompareDocumentPosition, (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionAddEventListener, (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionRemoveEventListener, (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionDispatchEvent, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -182,9 +233,9 @@ static const HashTable JSNodePrototypeTable =
 
 const ClassInfo JSNodePrototype::s_info = { "NodePrototype", 0, &JSNodePrototypeTable, 0 };
 
-JSObject* JSNodePrototype::self(ExecState* exec)
+JSObject* JSNodePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNode>(exec);
+    return getDOMPrototype<JSNode>(exec, globalObject);
 }
 
 bool JSNodePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -202,127 +253,584 @@ JSNode::JSNode(PassRefPtr<Structure> structure, PassRefPtr<Node> impl)
 
 JSNode::~JSNode()
 {
+    invalidateEventListeners(m_impl->eventListeners());
     forgetDOMNode(m_impl->document(), m_impl.get());
-
 }
 
-JSObject* JSNode::createPrototype(ExecState* exec)
+JSObject* JSNode::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodePrototype(JSNodePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodePrototype(JSNodePrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsNodeNodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->nodeName());
 }
 
-JSValuePtr jsNodeNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->nodeValue());
 }
 
-JSValuePtr jsNodeNodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->nodeType());
 }
 
-JSValuePtr jsNodeParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentNode()));
 }
 
-JSValuePtr jsNodeChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->childNodes()));
 }
 
-JSValuePtr jsNodeFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->firstChild()));
 }
 
-JSValuePtr jsNodeLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastChild()));
 }
 
-JSValuePtr jsNodePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->previousSibling()));
 }
 
-JSValuePtr jsNodeNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nextSibling()));
 }
 
-JSValuePtr jsNodeAttributes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeAttributes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->attributes()));
 }
 
-JSValuePtr jsNodeOwnerDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeOwnerDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerDocument()));
 }
 
-JSValuePtr jsNodeNamespaceURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNamespaceURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->namespaceURI());
 }
 
-JSValuePtr jsNodePrefix(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodePrefix(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->prefix());
 }
 
-JSValuePtr jsNodeLocalName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeLocalName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->localName());
 }
 
-JSValuePtr jsNodeBaseURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeBaseURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->baseURI());
 }
 
-JSValuePtr jsNodeTextContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeTextContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->textContent());
 }
 
-JSValuePtr jsNodeParentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeParentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentElement()));
 }
 
-JSValuePtr jsNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onblur()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncontextmenu()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondblclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onfocus()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oninput()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeydown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeypress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeyup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousedown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousemove()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseout()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousewheel()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforecut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforecopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforepaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onpaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragenter()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragleave()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrop()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrag()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onreset()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onresize()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onscroll()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsearch()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onselect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onselectstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsubmit()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNode*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSNode::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSNode::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSNode, Base>(exec, propertyName, value, &JSNodeTable, this, slot);
 }
 
-void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -330,7 +838,7 @@ void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -338,7 +846,7 @@ void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -346,71 +854,478 @@ void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValuePtr valu
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSNode::getConstructor(ExecState* exec)
+void setJSNodeOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOninput(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOncut(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSNodeOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+}
+
+JSValue JSNode::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeConstructor>(exec);
 }
 
-JSValuePtr jsNodePrototypeFunctionInsertBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionInsertBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->insertBefore(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionReplaceChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionReplaceChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->replaceChild(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionRemoveChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->removeChild(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionAppendChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionAppendChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->appendChild(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionHasChildNodes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasChildNodes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasChildNodes());
+    JSC::JSValue result = jsBoolean(imp->hasChildNodes());
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionCloneNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionCloneNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    bool deep = args.at(exec, 0)->toBoolean(exec);
+    bool deep = args.at(0).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->cloneNode(deep)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->cloneNode(deep)));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -419,205 +1334,247 @@ JSValuePtr jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsNodePrototypeFunctionIsSupported(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSupported(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& feature = args.at(exec, 0)->toString(exec);
-    const UString& version = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& feature = args.at(0).toString(exec);
+    const UString& version = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isSupported(feature, version));
+    JSC::JSValue result = jsBoolean(imp->isSupported(feature, version));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionHasAttributes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasAttributes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasAttributes());
+    JSC::JSValue result = jsBoolean(imp->hasAttributes());
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionIsSameNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSameNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    Node* other = toNode(args.at(exec, 0));
+    Node* other = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isSameNode(other));
+    JSC::JSValue result = jsBoolean(imp->isSameNode(other));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionIsEqualNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsEqualNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    Node* other = toNode(args.at(exec, 0));
+    Node* other = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isEqualNode(other));
+    JSC::JSValue result = jsBoolean(imp->isEqualNode(other));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionLookupPrefix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupPrefix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->lookupPrefix(namespaceURI));
+    JSC::JSValue result = jsStringOrNull(exec, imp->lookupPrefix(namespaceURI));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionIsDefaultNamespace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsDefaultNamespace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isDefaultNamespace(namespaceURI));
+    JSC::JSValue result = jsBoolean(imp->isDefaultNamespace(namespaceURI));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& prefix = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& prefix = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
+    JSC::JSValue result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionCompareDocumentPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionCompareDocumentPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    Node* other = toNode(args.at(exec, 0));
+    Node* other = toNode(args.at(0));
+
+
+    JSC::JSValue result = jsNumber(exec, imp->compareDocumentPosition(other));
+    return result;
+}
 
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
+        return throwError(exec, TypeError);
+    JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
+    return castedThisObj->addEventListener(exec, args);
+}
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->compareDocumentPosition(other));
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
+        return throwError(exec, TypeError);
+    JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
+    return castedThisObj->removeEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
+        return throwError(exec, TypeError);
+    JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
+    Node* imp = static_cast<Node*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Event* event = toEvent(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(event, ec));
+    setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsNodeELEMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeELEMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsNodeATTRIBUTE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeATTRIBUTE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsNodeTEXT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeTEXT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsNodeCDATA_SECTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeCDATA_SECTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsNodeENTITY_REFERENCE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeENTITY_REFERENCE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsNodeENTITY_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeENTITY_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsNodePROCESSING_INSTRUCTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodePROCESSING_INSTRUCTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsNodeCOMMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeCOMMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsNodeDOCUMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsNodeDOCUMENT_TYPE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_TYPE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsNodeDOCUMENT_FRAGMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_FRAGMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsNodeNOTATION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeNOTATION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_DISCONNECTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x01));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_PRECEDING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_PRECEDING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x02));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_FOLLOWING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x04));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_CONTAINS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x08));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINED_BY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x10));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x20));
 }
 
-Node* toNode(JSC::JSValuePtr value)
+Node* toNode(JSC::JSValue value)
 {
-    return value->isObject(&JSNode::s_info) ? static_cast<JSNode*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNode::s_info) ? static_cast<JSNode*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.h b/src/3rdparty/webkit/WebCore/generated/JSNode.h
index 6cb1f0d94d..fd1f2d069a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.h
@@ -24,7 +24,6 @@
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include "EventTargetNode.h"
 #include <runtime/Lookup.h>
 #include <wtf/AlwaysInline.h>
 
@@ -37,26 +36,30 @@ class JSNode : public DOMObject {
 public:
     JSNode(PassRefPtr<JSC::Structure>, PassRefPtr<Node>);
     virtual ~JSNode();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr insertBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     Node* impl() const { return m_impl.get(); }
 
 private:
@@ -68,18 +71,18 @@ ALWAYS_INLINE bool JSNode::getOwnPropertySlot(JSC::ExecState* exec, const JSC::I
     return JSC::getStaticValueSlot<JSNode, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Node*);
-inline JSC::JSValuePtr toJS(JSC::ExecState* exec, EventTargetNode* node) { return toJS(exec, static_cast<Node*>(node)); }
-Node* toNode(JSC::JSValuePtr);
-JSC::JSValuePtr toJSNewlyCreated(JSC::ExecState*, Node*);
+JSC::JSValue toJS(JSC::ExecState*, Node*);
+Node* toNode(JSC::JSValue);
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, Node*);
 
 class JSNodePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -88,64 +91,147 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodePrototypeFunctionInsertBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionReplaceChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionRemoveChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionAppendChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionHasChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionCloneNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionNormalize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionHasAttributes(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsSameNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsEqualNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionLookupPrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsDefaultNamespace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionCompareDocumentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionInsertBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionReplaceChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionAppendChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionCloneNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionNormalize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasAttributes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSameNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsEqualNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupPrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsDefaultNamespace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionCompareDocumentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeNodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSNodeNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsNodeNodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeAttributes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeOwnerDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNamespaceURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodePrefix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSNodePrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsNodeLocalName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeBaseURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeTextContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSNodeTextContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsNodeParentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeNodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeAttributes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeOwnerDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNamespaceURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodePrefix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodePrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeLocalName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeBaseURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeTextContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeTextContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeParentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsNodeELEMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeATTRIBUTE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeTEXT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeCDATA_SECTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeENTITY_REFERENCE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeENTITY_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodePROCESSING_INSTRUCTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeCOMMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_TYPE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_FRAGMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNOTATION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_DISCONNECTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_PRECEDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_FOLLOWING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINED_BY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeELEMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeATTRIBUTE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeTEXT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeCDATA_SECTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeENTITY_REFERENCE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeENTITY_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodePROCESSING_INSTRUCTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeCOMMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_TYPE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_FRAGMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNOTATION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_PRECEDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index 2492f634a1..d0eb79f920 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeFilter)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeFilter);
 
 /* Hash table */
 
@@ -85,13 +85,13 @@ public:
     JSNodeFilterConstructor(ExecState* exec)
         : DOMObject(JSNodeFilterConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodeFilterPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodeFilterPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -137,9 +137,9 @@ static const HashTable JSNodeFilterPrototypeTable =
 
 const ClassInfo JSNodeFilterPrototype::s_info = { "NodeFilterPrototype", 0, &JSNodeFilterPrototypeTable, 0 };
 
-JSObject* JSNodeFilterPrototype::self(ExecState* exec)
+JSObject* JSNodeFilterPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNodeFilter>(exec);
+    return getDOMPrototype<JSNodeFilter>(exec, globalObject);
 }
 
 bool JSNodeFilterPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -158,12 +158,11 @@ JSNodeFilter::JSNodeFilter(PassRefPtr<Structure> structure, PassRefPtr<NodeFilte
 JSNodeFilter::~JSNodeFilter()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNodeFilter::createPrototype(ExecState* exec)
+JSObject* JSNodeFilter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodeFilterPrototype(JSNodeFilterPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodeFilterPrototype(JSNodeFilterPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNodeFilter::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -171,18 +170,19 @@ bool JSNodeFilter::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSNodeFilter, Base>(exec, &JSNodeFilterTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNodeFilter*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSNodeFilter::getConstructor(ExecState* exec)
+JSValue JSNodeFilter::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeFilterConstructor>(exec);
 }
 
-JSValuePtr jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeFilter::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeFilter::s_info))
         return throwError(exec, TypeError);
     JSNodeFilter* castedThisObj = static_cast<JSNodeFilter*>(asObject(thisValue));
     return castedThisObj->acceptNode(exec, args);
@@ -190,87 +190,87 @@ JSValuePtr jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, JSObject*, J
 
 // Constant getters
 
-JSValuePtr jsNodeFilterFILTER_ACCEPT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_ACCEPT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsNodeFilterFILTER_REJECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_REJECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsNodeFilterFILTER_SKIP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_SKIP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsNodeFilterSHOW_ALL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ALL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0xFFFFFFFF));
 }
 
-JSValuePtr jsNodeFilterSHOW_ELEMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ELEMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000001));
 }
 
-JSValuePtr jsNodeFilterSHOW_ATTRIBUTE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ATTRIBUTE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000002));
 }
 
-JSValuePtr jsNodeFilterSHOW_TEXT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_TEXT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000004));
 }
 
-JSValuePtr jsNodeFilterSHOW_CDATA_SECTION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_CDATA_SECTION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000008));
 }
 
-JSValuePtr jsNodeFilterSHOW_ENTITY_REFERENCE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000010));
 }
 
-JSValuePtr jsNodeFilterSHOW_ENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000020));
 }
 
-JSValuePtr jsNodeFilterSHOW_PROCESSING_INSTRUCTION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000040));
 }
 
-JSValuePtr jsNodeFilterSHOW_COMMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_COMMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000080));
 }
 
-JSValuePtr jsNodeFilterSHOW_DOCUMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000100));
 }
 
-JSValuePtr jsNodeFilterSHOW_DOCUMENT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000200));
 }
 
-JSValuePtr jsNodeFilterSHOW_DOCUMENT_FRAGMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000400));
 }
 
-JSValuePtr jsNodeFilterSHOW_NOTATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_NOTATION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000800));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NodeFilter* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NodeFilter* object)
 {
     return getDOMObjectWrapper<JSNodeFilter>(exec, object);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
index 480d78c208..0fd1b42901 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
@@ -34,38 +34,39 @@ class JSNodeFilter : public DOMObject {
 public:
     JSNodeFilter(PassRefPtr<JSC::Structure>, PassRefPtr<NodeFilter>);
     virtual ~JSNodeFilter();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr acceptNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue acceptNode(JSC::ExecState*, const JSC::ArgList&);
     NodeFilter* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NodeFilter> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NodeFilter*);
-PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NodeFilter*);
+PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValue);
 
 class JSNodeFilterPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,28 +75,28 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodeFilterPrototypeFunctionAcceptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeFilterPrototypeFunctionAcceptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsNodeFilterFILTER_ACCEPT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterFILTER_REJECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterFILTER_SKIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ALL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ELEMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ATTRIBUTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_TEXT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_CDATA_SECTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ENTITY_REFERENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_PROCESSING_INSTRUCTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_COMMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_DOCUMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_DOCUMENT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_DOCUMENT_FRAGMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_NOTATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterFILTER_ACCEPT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterFILTER_REJECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterFILTER_SKIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ALL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ELEMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ATTRIBUTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_TEXT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_CDATA_SECTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_COMMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_NOTATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index 450a4102e3..6fe8cc2f95 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeIterator)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeIterator);
 
 /* Hash table */
 
@@ -79,13 +79,13 @@ public:
     JSNodeIteratorConstructor(ExecState* exec)
         : DOMObject(JSNodeIteratorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodeIteratorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodeIteratorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +117,9 @@ static const HashTable JSNodeIteratorPrototypeTable =
 
 const ClassInfo JSNodeIteratorPrototype::s_info = { "NodeIteratorPrototype", 0, &JSNodeIteratorPrototypeTable, 0 };
 
-JSObject* JSNodeIteratorPrototype::self(ExecState* exec)
+JSObject* JSNodeIteratorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNodeIterator>(exec);
+    return getDOMPrototype<JSNodeIterator>(exec, globalObject);
 }
 
 bool JSNodeIteratorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +138,11 @@ JSNodeIterator::JSNodeIterator(PassRefPtr<Structure> structure, PassRefPtr<NodeI
 JSNodeIterator::~JSNodeIterator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNodeIterator::createPrototype(ExecState* exec)
+JSObject* JSNodeIterator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodeIteratorPrototype(JSNodeIteratorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodeIteratorPrototype(JSNodeIteratorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNodeIterator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,70 +150,79 @@ bool JSNodeIterator::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSNodeIterator, Base>(exec, &JSNodeIteratorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNodeIteratorRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->root()));
 }
 
-JSValuePtr jsNodeIteratorWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->whatToShow());
 }
 
-JSValuePtr jsNodeIteratorFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->filter()));
 }
 
-JSValuePtr jsNodeIteratorExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->expandEntityReferences());
 }
 
-JSValuePtr jsNodeIteratorReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->referenceNode()));
 }
 
-JSValuePtr jsNodeIteratorPointerBeforeReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorPointerBeforeReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->pointerBeforeReferenceNode());
 }
 
-JSValuePtr jsNodeIteratorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSNodeIterator::getConstructor(ExecState* exec)
+JSValue JSNodeIterator::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeIteratorConstructor>(exec);
 }
 
-JSValuePtr jsNodeIteratorPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeIterator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     return castedThisObj->nextNode(exec, args);
 }
 
-JSValuePtr jsNodeIteratorPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeIterator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     return castedThisObj->previousNode(exec, args);
 }
 
-JSValuePtr jsNodeIteratorPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeIterator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     NodeIterator* imp = static_cast<NodeIterator*>(castedThisObj->impl());
@@ -223,13 +231,13 @@ JSValuePtr jsNodeIteratorPrototypeFunctionDetach(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NodeIterator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NodeIterator* object)
 {
     return getDOMObjectWrapper<JSNodeIterator>(exec, object);
 }
-NodeIterator* toNodeIterator(JSC::JSValuePtr value)
+NodeIterator* toNodeIterator(JSC::JSValue value)
 {
-    return value->isObject(&JSNodeIterator::s_info) ? static_cast<JSNodeIterator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNodeIterator::s_info) ? static_cast<JSNodeIterator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
index db97842ee2..ab5e7c670a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
@@ -34,39 +34,40 @@ class JSNodeIterator : public DOMObject {
 public:
     JSNodeIterator(PassRefPtr<JSC::Structure>, PassRefPtr<NodeIterator>);
     virtual ~JSNodeIterator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr nextNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr previousNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue nextNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue previousNode(JSC::ExecState*, const JSC::ArgList&);
     NodeIterator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NodeIterator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NodeIterator*);
-NodeIterator* toNodeIterator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NodeIterator*);
+NodeIterator* toNodeIterator(JSC::JSValue);
 
 class JSNodeIteratorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,18 +76,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodeIteratorPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodeIteratorPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodeIteratorPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeIteratorRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorPointerBeforeReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorPointerBeforeReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index 7e264274ce..b7fa2c5e08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeList)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeList);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSNodeListConstructor(ExecState* exec)
         : DOMObject(JSNodeListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodeListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodeListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSNodeListPrototypeTable =
 
 const ClassInfo JSNodeListPrototype::s_info = { "NodeListPrototype", 0, &JSNodeListPrototypeTable, 0 };
 
-JSObject* JSNodeListPrototype::self(ExecState* exec)
+JSObject* JSNodeListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNodeList>(exec);
+    return getDOMPrototype<JSNodeList>(exec, globalObject);
 }
 
 bool JSNodeListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +132,11 @@ JSNodeList::JSNodeList(PassRefPtr<Structure> structure, PassRefPtr<NodeList> imp
 JSNodeList::~JSNodeList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNodeList::createPrototype(ExecState* exec)
+JSObject* JSNodeList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodeListPrototype(JSNodeListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodeListPrototype(JSNodeListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNodeList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -169,13 +168,14 @@ bool JSNodeList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsNodeListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeList* imp = static_cast<NodeList*>(static_cast<JSNodeList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNodeList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -186,41 +186,42 @@ void JSNodeList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSNodeList::getConstructor(ExecState* exec)
+JSValue JSNodeList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeListConstructor>(exec);
 }
 
-JSValuePtr jsNodeListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeList::s_info))
         return throwError(exec, TypeError);
     JSNodeList* castedThisObj = static_cast<JSNodeList*>(asObject(thisValue));
     NodeList* imp = static_cast<NodeList*>(castedThisObj->impl());
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSNodeList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<NodeList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NodeList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NodeList* object)
 {
     return getDOMObjectWrapper<JSNodeList>(exec, object);
 }
-NodeList* toNodeList(JSC::JSValuePtr value)
+NodeList* toNodeList(JSC::JSValue value)
 {
-    return value->isObject(&JSNodeList::s_info) ? static_cast<JSNodeList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNodeList::s_info) ? static_cast<JSNodeList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
index 2297c77870..2a64c59707 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
@@ -35,13 +35,13 @@ class JSNodeList : public DOMObject {
 public:
     JSNodeList(PassRefPtr<JSC::Structure>, PassRefPtr<NodeList>);
     virtual ~JSNodeList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,27 +49,28 @@ public:
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     NodeList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NodeList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NodeList*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NodeList*);
-NodeList* toNodeList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NodeList*);
+NodeList* toNodeList(JSC::JSValue);
 
 class JSNodeListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -78,11 +79,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodeListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
index 67eed7b167..5187c8fbbd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNotation)
+ASSERT_CLASS_FITS_IN_CELL(JSNotation);
 
 /* Hash table */
 
@@ -71,13 +71,13 @@ public:
     JSNotationConstructor(ExecState* exec)
         : DOMObject(JSNotationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNotationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNotationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +106,9 @@ static const HashTable JSNotationPrototypeTable =
 
 const ClassInfo JSNotationPrototype::s_info = { "NotationPrototype", 0, &JSNotationPrototypeTable, 0 };
 
-JSObject* JSNotationPrototype::self(ExecState* exec)
+JSObject* JSNotationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNotation>(exec);
+    return getDOMPrototype<JSNotation>(exec, globalObject);
 }
 
 const ClassInfo JSNotation::s_info = { "Notation", &JSNode::s_info, &JSNotationTable, 0 };
@@ -118,9 +118,9 @@ JSNotation::JSNotation(PassRefPtr<Structure> structure, PassRefPtr<Notation> imp
 {
 }
 
-JSObject* JSNotation::createPrototype(ExecState* exec)
+JSObject* JSNotation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNotationPrototype(JSNotationPrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSNotationPrototype(JSNotationPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSNotation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,23 +128,25 @@ bool JSNotation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSNotation, Base>(exec, &JSNotationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNotationPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Notation* imp = static_cast<Notation*>(static_cast<JSNotation*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->publicId());
 }
 
-JSValuePtr jsNotationSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Notation* imp = static_cast<Notation*>(static_cast<JSNotation*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->systemId());
 }
 
-JSValuePtr jsNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNotation*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSNotation::getConstructor(ExecState* exec)
+JSValue JSNotation::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNotationConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.h b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
index 698a03ad7f..00d3427893 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
@@ -31,23 +31,24 @@ class JSNotation : public JSNode {
     typedef JSNode Base;
 public:
     JSNotation(PassRefPtr<JSC::Structure>, PassRefPtr<Notation>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSNotationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSNotationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsNotationPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNotationSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNotationPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNotationSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
index fae420f2dd..0ae7a26bb9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSOverflowEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSOverflowEvent);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSOverflowEventConstructor(ExecState* exec)
         : DOMObject(JSOverflowEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSOverflowEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSOverflowEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +114,9 @@ static const HashTable JSOverflowEventPrototypeTable =
 
 const ClassInfo JSOverflowEventPrototype::s_info = { "OverflowEventPrototype", 0, &JSOverflowEventPrototypeTable, 0 };
 
-JSObject* JSOverflowEventPrototype::self(ExecState* exec)
+JSObject* JSOverflowEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSOverflowEvent>(exec);
+    return getDOMPrototype<JSOverflowEvent>(exec, globalObject);
 }
 
 bool JSOverflowEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,9 +131,9 @@ JSOverflowEvent::JSOverflowEvent(PassRefPtr<Structure> structure, PassRefPtr<Ove
 {
 }
 
-JSObject* JSOverflowEvent::createPrototype(ExecState* exec)
+JSObject* JSOverflowEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSOverflowEventPrototype(JSOverflowEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSOverflowEventPrototype(JSOverflowEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSOverflowEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,42 +141,46 @@ bool JSOverflowEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSOverflowEvent, Base>(exec, &JSOverflowEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsOverflowEventOrient(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventOrient(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->orient());
 }
 
-JSValuePtr jsOverflowEventHorizontalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventHorizontalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->horizontalOverflow());
 }
 
-JSValuePtr jsOverflowEventVerticalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventVerticalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->verticalOverflow());
 }
 
-JSValuePtr jsOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSOverflowEvent::getConstructor(ExecState* exec)
+JSValue JSOverflowEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSOverflowEventConstructor>(exec);
 }
 
-JSValuePtr jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSOverflowEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSOverflowEvent::s_info))
         return throwError(exec, TypeError);
     JSOverflowEvent* castedThisObj = static_cast<JSOverflowEvent*>(asObject(thisValue));
     OverflowEvent* imp = static_cast<OverflowEvent*>(castedThisObj->impl());
-    unsigned short orient = args.at(exec, 0)->toInt32(exec);
-    bool horizontalOverflow = args.at(exec, 1)->toBoolean(exec);
-    bool verticalOverflow = args.at(exec, 2)->toBoolean(exec);
+    unsigned short orient = args.at(0).toInt32(exec);
+    bool horizontalOverflow = args.at(1).toBoolean(exec);
+    bool verticalOverflow = args.at(2).toBoolean(exec);
 
     imp->initOverflowEvent(orient, horizontalOverflow, verticalOverflow);
     return jsUndefined();
@@ -184,17 +188,17 @@ JSValuePtr jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecState* exec, JS
 
 // Constant getters
 
-JSValuePtr jsOverflowEventHORIZONTAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventHORIZONTAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsOverflowEventVERTICAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventVERTICAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsOverflowEventBOTH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventBOTH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
index afa8ea0d8c..b018a86cbc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
@@ -31,27 +31,28 @@ class JSOverflowEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSOverflowEvent(PassRefPtr<JSC::Structure>, PassRefPtr<OverflowEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSOverflowEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,18 +61,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsOverflowEventPrototypeFunctionInitOverflowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsOverflowEventPrototypeFunctionInitOverflowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsOverflowEventOrient(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventHorizontalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventVerticalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventOrient(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventHorizontalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventVerticalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsOverflowEventHORIZONTAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventVERTICAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventBOTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventHORIZONTAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventVERTICAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventBOTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index ec3bc6ddf9..04f24fe152 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSPlugin)
+ASSERT_CLASS_FITS_IN_CELL(JSPlugin);
 
 /* Hash table */
 
@@ -79,13 +79,13 @@ public:
     JSPluginConstructor(ExecState* exec)
         : DOMObject(JSPluginConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSPluginPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSPluginPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +116,9 @@ static const HashTable JSPluginPrototypeTable =
 
 const ClassInfo JSPluginPrototype::s_info = { "PluginPrototype", 0, &JSPluginPrototypeTable, 0 };
 
-JSObject* JSPluginPrototype::self(ExecState* exec)
+JSObject* JSPluginPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSPlugin>(exec);
+    return getDOMPrototype<JSPlugin>(exec, globalObject);
 }
 
 bool JSPluginPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,12 +137,11 @@ JSPlugin::JSPlugin(PassRefPtr<Structure> structure, PassRefPtr<Plugin> impl)
 JSPlugin::~JSPlugin()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSPlugin::createPrototype(ExecState* exec)
+JSObject* JSPlugin::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSPluginPrototype(JSPluginPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSPluginPrototype(JSPluginPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSPlugin::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,31 +173,35 @@ bool JSPlugin::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Proper
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsPluginName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsPluginFilename(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginFilename(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->filename());
 }
 
-JSValuePtr jsPluginDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->description());
 }
 
-JSValuePtr jsPluginLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSPlugin*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -209,50 +212,52 @@ void JSPlugin::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSPlugin::getConstructor(ExecState* exec)
+JSValue JSPlugin::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSPluginConstructor>(exec);
 }
 
-JSValuePtr jsPluginPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPlugin::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPlugin::s_info))
         return throwError(exec, TypeError);
     JSPlugin* castedThisObj = static_cast<JSPlugin*>(asObject(thisValue));
     Plugin* imp = static_cast<Plugin*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsPluginPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPlugin::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPlugin::s_info))
         return throwError(exec, TypeError);
     JSPlugin* castedThisObj = static_cast<JSPlugin*>(asObject(thisValue));
     Plugin* imp = static_cast<Plugin*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
 
-JSValuePtr JSPlugin::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<Plugin*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Plugin* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Plugin* object)
 {
     return getDOMObjectWrapper<JSPlugin>(exec, object);
 }
-Plugin* toPlugin(JSC::JSValuePtr value)
+Plugin* toPlugin(JSC::JSValue value)
 {
-    return value->isObject(&JSPlugin::s_info) ? static_cast<JSPlugin*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSPlugin::s_info) ? static_cast<JSPlugin*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
index adf03a36f8..7ff040fd94 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
@@ -34,39 +34,40 @@ class JSPlugin : public DOMObject {
 public:
     JSPlugin(PassRefPtr<JSC::Structure>, PassRefPtr<Plugin>);
     virtual ~JSPlugin();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Plugin* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Plugin> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, Plugin*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Plugin*);
-Plugin* toPlugin(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Plugin*);
+Plugin* toPlugin(JSC::JSValue);
 
 class JSPluginPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,15 +76,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsPluginPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsPluginPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsPluginName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginFilename(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginFilename(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index 99a635c798..26b5515564 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSPluginArray)
+ASSERT_CLASS_FITS_IN_CELL(JSPluginArray);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSPluginArrayConstructor(ExecState* exec)
         : DOMObject(JSPluginArrayConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSPluginArrayPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSPluginArrayPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +112,9 @@ static const HashTable JSPluginArrayPrototypeTable =
 
 const ClassInfo JSPluginArrayPrototype::s_info = { "PluginArrayPrototype", 0, &JSPluginArrayPrototypeTable, 0 };
 
-JSObject* JSPluginArrayPrototype::self(ExecState* exec)
+JSObject* JSPluginArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSPluginArray>(exec);
+    return getDOMPrototype<JSPluginArray>(exec, globalObject);
 }
 
 bool JSPluginArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,12 +133,11 @@ JSPluginArray::JSPluginArray(PassRefPtr<Structure> structure, PassRefPtr<PluginA
 JSPluginArray::~JSPluginArray()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSPluginArray::createPrototype(ExecState* exec)
+JSObject* JSPluginArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSPluginArrayPrototype(JSPluginArrayPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSPluginArrayPrototype(JSPluginArrayPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSPluginArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -170,13 +169,14 @@ bool JSPluginArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, P
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsPluginArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     PluginArray* imp = static_cast<PluginArray*>(static_cast<JSPluginArray*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSPluginArray*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -187,62 +187,65 @@ void JSPluginArray::getPropertyNames(ExecState* exec, PropertyNameArray& propert
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSPluginArray::getConstructor(ExecState* exec)
+JSValue JSPluginArray::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSPluginArrayConstructor>(exec);
 }
 
-JSValuePtr jsPluginArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPluginArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsPluginArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPluginArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
-JSValuePtr jsPluginArrayPrototypeFunctionRefresh(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionRefresh(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPluginArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
-    bool reload = args.at(exec, 0)->toBoolean(exec);
+    bool reload = args.at(0).toBoolean(exec);
 
     imp->refresh(reload);
     return jsUndefined();
 }
 
 
-JSValuePtr JSPluginArray::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<PluginArray*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, PluginArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, PluginArray* object)
 {
     return getDOMObjectWrapper<JSPluginArray>(exec, object);
 }
-PluginArray* toPluginArray(JSC::JSValuePtr value)
+PluginArray* toPluginArray(JSC::JSValue value)
 {
-    return value->isObject(&JSPluginArray::s_info) ? static_cast<JSPluginArray*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSPluginArray::s_info) ? static_cast<JSPluginArray*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
index b66b7cd16d..56bb33e68e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
@@ -34,39 +34,40 @@ class JSPluginArray : public DOMObject {
 public:
     JSPluginArray(PassRefPtr<JSC::Structure>, PassRefPtr<PluginArray>);
     virtual ~JSPluginArray();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     PluginArray* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<PluginArray> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, PluginArray*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, PluginArray*);
-PluginArray* toPluginArray(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, PluginArray*);
+PluginArray* toPluginArray(JSC::JSValue);
 
 class JSPluginArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,13 +76,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsPluginArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsPluginArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsPluginArrayPrototypeFunctionRefresh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionRefresh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsPluginArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index 5e0374d080..7c4896fd96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSPositionError)
+ASSERT_CLASS_FITS_IN_CELL(JSPositionError);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSPositionErrorConstructor(ExecState* exec)
         : DOMObject(JSPositionErrorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSPositionErrorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSPositionErrorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +115,9 @@ static const HashTable JSPositionErrorPrototypeTable =
 
 const ClassInfo JSPositionErrorPrototype::s_info = { "PositionErrorPrototype", 0, &JSPositionErrorPrototypeTable, 0 };
 
-JSObject* JSPositionErrorPrototype::self(ExecState* exec)
+JSObject* JSPositionErrorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSPositionError>(exec);
+    return getDOMPrototype<JSPositionError>(exec, globalObject);
 }
 
 bool JSPositionErrorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,12 +136,11 @@ JSPositionError::JSPositionError(PassRefPtr<Structure> structure, PassRefPtr<Pos
 JSPositionError::~JSPositionError()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSPositionError::createPrototype(ExecState* exec)
+JSObject* JSPositionError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSPositionErrorPrototype(JSPositionErrorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSPositionErrorPrototype(JSPositionErrorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSPositionError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -149,56 +148,58 @@ bool JSPositionError::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSPositionError, Base>(exec, &JSPositionErrorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsPositionErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     PositionError* imp = static_cast<PositionError*>(static_cast<JSPositionError*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsPositionErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     PositionError* imp = static_cast<PositionError*>(static_cast<JSPositionError*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsPositionErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSPositionError*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSPositionError::getConstructor(ExecState* exec)
+JSValue JSPositionError::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSPositionErrorConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsPositionErrorUNKNOWN_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorUNKNOWN_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsPositionErrorPERMISSION_DENIED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorPERMISSION_DENIED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsPositionErrorPOSITION_UNAVAILABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorPOSITION_UNAVAILABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsPositionErrorTIMEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorTIMEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, PositionError* object)
+JSC::JSValue toJS(JSC::ExecState* exec, PositionError* object)
 {
     return getDOMObjectWrapper<JSPositionError>(exec, object);
 }
-PositionError* toPositionError(JSC::JSValuePtr value)
+PositionError* toPositionError(JSC::JSValue value)
 {
-    return value->isObject(&JSPositionError::s_info) ? static_cast<JSPositionError*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSPositionError::s_info) ? static_cast<JSPositionError*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
index d8cc4c152a..9f256f4499 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
@@ -34,33 +34,34 @@ class JSPositionError : public DOMObject {
 public:
     JSPositionError(PassRefPtr<JSC::Structure>, PassRefPtr<PositionError>);
     virtual ~JSPositionError();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     PositionError* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<PositionError> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, PositionError*);
-PositionError* toPositionError(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, PositionError*);
+PositionError* toPositionError(JSC::JSValue);
 
 class JSPositionErrorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,15 +70,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsPositionErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsPositionErrorUNKNOWN_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorPERMISSION_DENIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorPOSITION_UNAVAILABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorTIMEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorUNKNOWN_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorPERMISSION_DENIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorPOSITION_UNAVAILABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorTIMEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
index 567cf03629..56f9b61921 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSProcessingInstruction)
+ASSERT_CLASS_FITS_IN_CELL(JSProcessingInstruction);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSProcessingInstructionConstructor(ExecState* exec)
         : DOMObject(JSProcessingInstructionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSProcessingInstructionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSProcessingInstructionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSProcessingInstructionPrototypeTable =
 
 const ClassInfo JSProcessingInstructionPrototype::s_info = { "ProcessingInstructionPrototype", 0, &JSProcessingInstructionPrototypeTable, 0 };
 
-JSObject* JSProcessingInstructionPrototype::self(ExecState* exec)
+JSObject* JSProcessingInstructionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSProcessingInstruction>(exec);
+    return getDOMPrototype<JSProcessingInstruction>(exec, globalObject);
 }
 
 const ClassInfo JSProcessingInstruction::s_info = { "ProcessingInstruction", &JSNode::s_info, &JSProcessingInstructionTable, 0 };
@@ -121,9 +121,9 @@ JSProcessingInstruction::JSProcessingInstruction(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSProcessingInstruction::createPrototype(ExecState* exec)
+JSObject* JSProcessingInstruction::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSProcessingInstructionPrototype(JSProcessingInstructionPrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSProcessingInstructionPrototype(JSProcessingInstructionPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSProcessingInstruction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,34 +131,37 @@ bool JSProcessingInstruction::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSProcessingInstruction, Base>(exec, &JSProcessingInstructionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsProcessingInstructionTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->target());
 }
 
-JSValuePtr jsProcessingInstructionData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->data());
 }
 
-JSValuePtr jsProcessingInstructionSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sheet()));
 }
 
-JSValuePtr jsProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSProcessingInstruction::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSProcessingInstruction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSProcessingInstruction, Base>(exec, propertyName, value, &JSProcessingInstructionTable, this, slot);
 }
 
-void setJSProcessingInstructionData(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSProcessingInstructionData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -166,7 +169,7 @@ void setJSProcessingInstructionData(ExecState* exec, JSObject* thisObject, JSVal
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSProcessingInstruction::getConstructor(ExecState* exec)
+JSValue JSProcessingInstruction::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSProcessingInstructionConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
index 2b08ab7692..7c0ccd6f44 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
@@ -31,24 +31,25 @@ class JSProcessingInstruction : public JSNode {
     typedef JSNode Base;
 public:
     JSProcessingInstruction(PassRefPtr<JSC::Structure>, PassRefPtr<ProcessingInstruction>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSProcessingInstructionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSProcessingInstructionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsProcessingInstructionTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProcessingInstructionData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSProcessingInstructionData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsProcessingInstructionSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSProcessingInstructionData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsProcessingInstructionSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
index 88f9ad285a..92d6a68db2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSProgressEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSProgressEvent);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSProgressEventConstructor(ExecState* exec)
         : DOMObject(JSProgressEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSProgressEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSProgressEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +108,9 @@ static const HashTable JSProgressEventPrototypeTable =
 
 const ClassInfo JSProgressEventPrototype::s_info = { "ProgressEventPrototype", 0, &JSProgressEventPrototypeTable, 0 };
 
-JSObject* JSProgressEventPrototype::self(ExecState* exec)
+JSObject* JSProgressEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSProgressEvent>(exec);
+    return getDOMPrototype<JSProgressEvent>(exec, globalObject);
 }
 
 bool JSProgressEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,9 +125,9 @@ JSProgressEvent::JSProgressEvent(PassRefPtr<Structure> structure, PassRefPtr<Pro
 {
 }
 
-JSObject* JSProgressEvent::createPrototype(ExecState* exec)
+JSObject* JSProgressEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSProgressEventPrototype(JSProgressEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSProgressEventPrototype(JSProgressEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSProgressEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,45 +135,49 @@ bool JSProgressEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSProgressEvent, Base>(exec, &JSProgressEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsProgressEventLengthComputable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventLengthComputable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->lengthComputable());
 }
 
-JSValuePtr jsProgressEventLoaded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventLoaded(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->loaded());
 }
 
-JSValuePtr jsProgressEventTotal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventTotal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->total());
 }
 
-JSValuePtr jsProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSProgressEvent::getConstructor(ExecState* exec)
+JSValue JSProgressEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSProgressEventConstructor>(exec);
 }
 
-JSValuePtr jsProgressEventPrototypeFunctionInitProgressEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsProgressEventPrototypeFunctionInitProgressEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSProgressEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSProgressEvent::s_info))
         return throwError(exec, TypeError);
     JSProgressEvent* castedThisObj = static_cast<JSProgressEvent*>(asObject(thisValue));
     ProgressEvent* imp = static_cast<ProgressEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    bool lengthComputableArg = args.at(exec, 3)->toBoolean(exec);
-    unsigned loadedArg = args.at(exec, 4)->toInt32(exec);
-    unsigned totalArg = args.at(exec, 5)->toInt32(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    bool lengthComputableArg = args.at(3).toBoolean(exec);
+    unsigned loadedArg = args.at(4).toInt32(exec);
+    unsigned totalArg = args.at(5).toInt32(exec);
 
     imp->initProgressEvent(typeArg, canBubbleArg, cancelableArg, lengthComputableArg, loadedArg, totalArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
index 5eb95d540e..5f0744ace1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
@@ -31,27 +31,28 @@ class JSProgressEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSProgressEvent(PassRefPtr<JSC::Structure>, PassRefPtr<ProgressEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSProgressEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,13 +61,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsProgressEventPrototypeFunctionInitProgressEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsProgressEventPrototypeFunctionInitProgressEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsProgressEventLengthComputable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProgressEventLoaded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProgressEventTotal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventLengthComputable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventLoaded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventTotal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h
index 681e9abd44..03bb41528c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h
@@ -12,10 +12,5 @@ static const struct HashTableValue JSRGBColorTableValues[4] = {
 };
 
 extern const struct HashTable JSRGBColorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSRGBColorTableValues, 0 };
-#else
     { 8, 7, JSRGBColorTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index 7ca375724e..a8e828bd11 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRange)
+ASSERT_CLASS_FITS_IN_CELL(JSRange);
 
 /* Hash table */
 
@@ -90,13 +90,13 @@ public:
     JSRangeConstructor(ExecState* exec)
         : DOMObject(JSRangeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSRangePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSRangePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -156,9 +156,9 @@ static const HashTable JSRangePrototypeTable =
 
 const ClassInfo JSRangePrototype::s_info = { "RangePrototype", 0, &JSRangePrototypeTable, 0 };
 
-JSObject* JSRangePrototype::self(ExecState* exec)
+JSObject* JSRangePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSRange>(exec);
+    return getDOMPrototype<JSRange>(exec, globalObject);
 }
 
 bool JSRangePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -177,12 +177,11 @@ JSRange::JSRange(PassRefPtr<Structure> structure, PassRefPtr<Range> impl)
 JSRange::~JSRange()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSRange::createPrototype(ExecState* exec)
+JSObject* JSRange::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSRangePrototype(JSRangePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSRangePrototype(JSRangePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSRange::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -190,216 +189,227 @@ bool JSRange::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return getStaticValueSlot<JSRange, Base>(exec, &JSRangeTable, this, propertyName, slot);
 }
 
-JSValuePtr jsRangeStartContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeStartContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->startContainer(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->startContainer(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->startOffset(ec));
+    JSC::JSValue result = jsNumber(exec, imp->startOffset(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeEndContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeEndContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->endContainer(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->endContainer(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeEndOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeEndOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->endOffset(ec));
+    JSC::JSValue result = jsNumber(exec, imp->endOffset(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsBoolean(imp->collapsed(ec));
+    JSC::JSValue result = jsBoolean(imp->collapsed(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeCommonAncestorContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeCommonAncestorContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->commonAncestorContainer(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->commonAncestorContainer(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSRange*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSRange::getConstructor(ExecState* exec)
+JSValue JSRange::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSRangeConstructor>(exec);
 }
 
-JSValuePtr jsRangePrototypeFunctionSetStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
     imp->setStart(refNode, offset, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
     imp->setEnd(refNode, offset, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetStartBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setStartBefore(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetStartAfter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartAfter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setStartAfter(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetEndBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setEndBefore(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetEndAfter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndAfter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setEndAfter(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    bool toStart = args.at(exec, 0)->toBoolean(exec);
+    bool toStart = args.at(0).toBoolean(exec);
 
     imp->collapse(toStart, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSelectNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->selectNode(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSelectNodeContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNodeContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->selectNodeContents(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCompareBoundaryPoints(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareBoundaryPoints(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Range::CompareHow how = static_cast<Range::CompareHow>(args.at(exec, 0)->toInt32(exec));
-    Range* sourceRange = toRange(args.at(exec, 1));
+    Range::CompareHow how = static_cast<Range::CompareHow>(args.at(0).toInt32(exec));
+    Range* sourceRange = toRange(args.at(1));
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->compareBoundaryPoints(how, sourceRange, ec));
+    JSC::JSValue result = jsNumber(exec, imp->compareBoundaryPoints(how, sourceRange, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionDeleteContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionDeleteContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -410,93 +420,100 @@ JSValuePtr jsRangePrototypeFunctionDeleteContents(ExecState* exec, JSObject*, JS
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionExtractContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionExtractContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->extractContents(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->extractContents(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionCloneContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->cloneContents(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->cloneContents(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionInsertNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionInsertNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* newNode = toNode(args.at(exec, 0));
+    Node* newNode = toNode(args.at(0));
 
     imp->insertNode(newNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSurroundContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSurroundContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* newParent = toNode(args.at(exec, 0));
+    Node* newParent = toNode(args.at(0));
 
     imp->surroundContents(newParent, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCloneRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->cloneRange(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->cloneRange(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString(ec));
+    JSC::JSValue result = jsString(exec, imp->toString(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -507,132 +524,137 @@ JSValuePtr jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCreateContextualFragment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& html = args.at(exec, 0)->toString(exec);
+    const UString& html = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createContextualFragment(html, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createContextualFragment(html, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionIntersectsNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->intersectsNode(refNode, ec));
+    JSC::JSValue result = jsBoolean(imp->intersectsNode(refNode, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionCompareNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->compareNode(refNode, ec));
+    JSC::JSValue result = jsNumber(exec, imp->compareNode(refNode, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionComparePoint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionComparePoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->comparePoint(refNode, offset, ec));
+    JSC::JSValue result = jsNumber(exec, imp->comparePoint(refNode, offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionIsPointInRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isPointInRange(refNode, offset, ec));
+    JSC::JSValue result = jsBoolean(imp->isPointInRange(refNode, offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsRangeSTART_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeSTART_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsRangeSTART_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeSTART_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsRangeEND_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeEND_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsRangeEND_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeEND_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsRangeNODE_BEFORE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_BEFORE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsRangeNODE_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsRangeNODE_BEFORE_AND_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_BEFORE_AND_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsRangeNODE_INSIDE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_INSIDE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Range* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Range* object)
 {
     return getDOMObjectWrapper<JSRange>(exec, object);
 }
-Range* toRange(JSC::JSValuePtr value)
+Range* toRange(JSC::JSValue value)
 {
-    return value->isObject(&JSRange::s_info) ? static_cast<JSRange*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSRange::s_info) ? static_cast<JSRange*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.h b/src/3rdparty/webkit/WebCore/generated/JSRange.h
index bc7991257d..4d8a6f9294 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.h
@@ -34,33 +34,34 @@ class JSRange : public DOMObject {
 public:
     JSRange(PassRefPtr<JSC::Structure>, PassRefPtr<Range>);
     virtual ~JSRange();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Range* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Range> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Range*);
-Range* toRange(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Range*);
+Range* toRange(JSC::JSValue);
 
 class JSRangePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,48 +70,48 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsRangePrototypeFunctionSetStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetStartBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetStartAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetEndBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetEndAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSelectNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSelectNodeContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCompareBoundaryPoints(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionDeleteContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionExtractContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCloneContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionInsertNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSurroundContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCloneRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCreateContextualFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionIntersectsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCompareNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionComparePoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionIsPointInRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNodeContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareBoundaryPoints(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionDeleteContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionExtractContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionInsertNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSurroundContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionComparePoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsRangeStartContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEndContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEndOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeCommonAncestorContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeStartContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEndContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEndOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeCommonAncestorContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsRangeSTART_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeSTART_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEND_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEND_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_BEFORE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_BEFORE_AND_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_INSIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeSTART_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeSTART_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEND_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEND_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_BEFORE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_BEFORE_AND_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_INSIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index e796c7d8d5..faf979429d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRangeException)
+ASSERT_CLASS_FITS_IN_CELL(JSRangeException);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSRangeExceptionConstructor(ExecState* exec)
         : DOMObject(JSRangeExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSRangeExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSRangeExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +114,9 @@ static const HashTable JSRangeExceptionPrototypeTable =
 
 const ClassInfo JSRangeExceptionPrototype::s_info = { "RangeExceptionPrototype", 0, &JSRangeExceptionPrototypeTable, 0 };
 
-JSObject* JSRangeExceptionPrototype::self(ExecState* exec)
+JSObject* JSRangeExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSRangeException>(exec);
+    return getDOMPrototype<JSRangeException>(exec, globalObject);
 }
 
 bool JSRangeExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +135,11 @@ JSRangeException::JSRangeException(PassRefPtr<Structure> structure, PassRefPtr<R
 JSRangeException::~JSRangeException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSRangeException::createPrototype(ExecState* exec)
+JSObject* JSRangeException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSRangeExceptionPrototype(JSRangeExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSRangeExceptionPrototype(JSRangeExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSRangeException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,64 +147,68 @@ bool JSRangeException::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSRangeException, Base>(exec, &JSRangeExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsRangeExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(static_cast<JSRangeException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsRangeExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(static_cast<JSRangeException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsRangeExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(static_cast<JSRangeException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSRangeException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSRangeException::getConstructor(ExecState* exec)
+JSValue JSRangeException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSRangeExceptionConstructor>(exec);
 }
 
-JSValuePtr jsRangeExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangeExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRangeException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRangeException::s_info))
         return throwError(exec, TypeError);
     JSRangeException* castedThisObj = static_cast<JSRangeException*>(asObject(thisValue));
     RangeException* imp = static_cast<RangeException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsRangeExceptionINVALID_NODE_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, RangeException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, RangeException* object)
 {
     return getDOMObjectWrapper<JSRangeException>(exec, object);
 }
-RangeException* toRangeException(JSC::JSValuePtr value)
+RangeException* toRangeException(JSC::JSValue value)
 {
-    return value->isObject(&JSRangeException::s_info) ? static_cast<JSRangeException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSRangeException::s_info) ? static_cast<JSRangeException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
index fc35242dd1..5c45cd2df1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
@@ -34,33 +34,34 @@ class JSRangeException : public DOMObject {
 public:
     JSRangeException(PassRefPtr<JSC::Structure>, PassRefPtr<RangeException>);
     virtual ~JSRangeException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     RangeException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<RangeException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, RangeException*);
-RangeException* toRangeException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, RangeException*);
+RangeException* toRangeException(JSC::JSValue);
 
 class JSRangeExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,17 +70,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsRangeExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangeExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsRangeExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionINVALID_NODE_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index 655afa01a2..3fdee7cb00 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRect)
+ASSERT_CLASS_FITS_IN_CELL(JSRect);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSRectConstructor(ExecState* exec)
         : DOMObject(JSRectConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSRectPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSRectPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSRectPrototypeTable =
 
 const ClassInfo JSRectPrototype::s_info = { "RectPrototype", 0, &JSRectPrototypeTable, 0 };
 
-JSObject* JSRectPrototype::self(ExecState* exec)
+JSObject* JSRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSRect>(exec);
+    return getDOMPrototype<JSRect>(exec, globalObject);
 }
 
 const ClassInfo JSRect::s_info = { "Rect", 0, &JSRectTable, 0 };
@@ -125,12 +125,11 @@ JSRect::JSRect(PassRefPtr<Structure> structure, PassRefPtr<Rect> impl)
 JSRect::~JSRect()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSRect::createPrototype(ExecState* exec)
+JSObject* JSRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSRectPrototype(JSRectPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSRectPrototype(JSRectPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,46 +137,50 @@ bool JSRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSRect, Base>(exec, &JSRectTable, this, propertyName, slot);
 }
 
-JSValuePtr jsRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->top()));
 }
 
-JSValuePtr jsRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->right()));
 }
 
-JSValuePtr jsRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->bottom()));
 }
 
-JSValuePtr jsRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->left()));
 }
 
-JSValuePtr jsRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSRect*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSRect::getConstructor(ExecState* exec)
+JSValue JSRect::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSRectConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Rect* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Rect* object)
 {
     return getDOMObjectWrapper<JSRect>(exec, object);
 }
-Rect* toRect(JSC::JSValuePtr value)
+Rect* toRect(JSC::JSValue value)
 {
-    return value->isObject(&JSRect::s_info) ? static_cast<JSRect*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSRect::s_info) ? static_cast<JSRect*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.h b/src/3rdparty/webkit/WebCore/generated/JSRect.h
index 069ee810a4..be2396609d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.h
@@ -34,29 +34,30 @@ class JSRect : public DOMObject {
 public:
     JSRect(PassRefPtr<JSC::Structure>, PassRefPtr<Rect>);
     virtual ~JSRect();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Rect* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Rect> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Rect*);
-Rect* toRect(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Rect*);
+Rect* toRect(JSC::JSValue);
 
 class JSRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,11 +65,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
index 3614d6a722..2d6abf125e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
@@ -20,6 +20,9 @@
 
 #include "config.h"
 
+
+#if ENABLE(DATABASE)
+
 #include "JSSQLError.h"
 
 #include <wtf/GetPtr.h>
@@ -34,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLError)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLError);
 
 /* Hash table */
 
@@ -68,9 +71,9 @@ static const HashTable JSSQLErrorPrototypeTable =
 
 const ClassInfo JSSQLErrorPrototype::s_info = { "SQLErrorPrototype", 0, &JSSQLErrorPrototypeTable, 0 };
 
-JSObject* JSSQLErrorPrototype::self(ExecState* exec)
+JSObject* JSSQLErrorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLError>(exec);
+    return getDOMPrototype<JSSQLError>(exec, globalObject);
 }
 
 const ClassInfo JSSQLError::s_info = { "SQLError", 0, &JSSQLErrorTable, 0 };
@@ -84,12 +87,11 @@ JSSQLError::JSSQLError(PassRefPtr<Structure> structure, PassRefPtr<SQLError> imp
 JSSQLError::~JSSQLError()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLError::createPrototype(ExecState* exec)
+JSObject* JSSQLError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLErrorPrototype(JSSQLErrorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLErrorPrototype(JSSQLErrorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSQLError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,25 +99,29 @@ bool JSSQLError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSQLError, Base>(exec, &JSSQLErrorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSQLErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLError* imp = static_cast<SQLError*>(static_cast<JSSQLError*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsSQLErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLError* imp = static_cast<SQLError*>(static_cast<JSSQLError*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLError* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLError* object)
 {
     return getDOMObjectWrapper<JSSQLError>(exec, object);
 }
-SQLError* toSQLError(JSC::JSValuePtr value)
+SQLError* toSQLError(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLError::s_info) ? static_cast<JSSQLError*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLError::s_info) ? static_cast<JSSQLError*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
index 470a72e303..a2389c7098 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
@@ -21,6 +21,9 @@
 #ifndef JSSQLError_h
 #define JSSQLError_h
 
+
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,12 +37,12 @@ class JSSQLError : public DOMObject {
 public:
     JSSQLError(PassRefPtr<JSC::Structure>, PassRefPtr<SQLError>);
     virtual ~JSSQLError();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +53,13 @@ private:
     RefPtr<SQLError> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLError*);
-SQLError* toSQLError(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLError*);
+SQLError* toSQLError(JSC::JSValue);
 
 class JSSQLErrorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSQLErrorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,9 +67,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSQLErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSQLErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
index e2b23e8059..6aa3394c31 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
@@ -20,6 +20,9 @@
 
 #include "config.h"
 
+
+#if ENABLE(DATABASE)
+
 #include "JSSQLResultSet.h"
 
 #include <wtf/GetPtr.h>
@@ -34,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSet)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSet);
 
 /* Hash table */
 
@@ -69,9 +72,9 @@ static const HashTable JSSQLResultSetPrototypeTable =
 
 const ClassInfo JSSQLResultSetPrototype::s_info = { "SQLResultSetPrototype", 0, &JSSQLResultSetPrototypeTable, 0 };
 
-JSObject* JSSQLResultSetPrototype::self(ExecState* exec)
+JSObject* JSSQLResultSetPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLResultSet>(exec);
+    return getDOMPrototype<JSSQLResultSet>(exec, globalObject);
 }
 
 const ClassInfo JSSQLResultSet::s_info = { "SQLResultSet", 0, &JSSQLResultSetTable, 0 };
@@ -85,12 +88,11 @@ JSSQLResultSet::JSSQLResultSet(PassRefPtr<Structure> structure, PassRefPtr<SQLRe
 JSSQLResultSet::~JSSQLResultSet()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLResultSet::createPrototype(ExecState* exec)
+JSObject* JSSQLResultSet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLResultSetPrototype(JSSQLResultSetPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLResultSetPrototype(JSSQLResultSetPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSQLResultSet::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,34 +100,38 @@ bool JSSQLResultSet::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSQLResultSet, Base>(exec, &JSSQLResultSetTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSQLResultSetRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLResultSet* imp = static_cast<SQLResultSet*>(static_cast<JSSQLResultSet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rows()));
 }
 
-JSValuePtr jsSQLResultSetInsertId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetInsertId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     SQLResultSet* imp = static_cast<SQLResultSet*>(static_cast<JSSQLResultSet*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->insertId(ec));
+    JSC::JSValue result = jsNumber(exec, imp->insertId(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSQLResultSetRowsAffected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRowsAffected(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLResultSet* imp = static_cast<SQLResultSet*>(static_cast<JSSQLResultSet*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rowsAffected());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLResultSet* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLResultSet* object)
 {
     return getDOMObjectWrapper<JSSQLResultSet>(exec, object);
 }
-SQLResultSet* toSQLResultSet(JSC::JSValuePtr value)
+SQLResultSet* toSQLResultSet(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLResultSet::s_info) ? static_cast<JSSQLResultSet*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLResultSet::s_info) ? static_cast<JSSQLResultSet*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
index 0b8ac33e9c..a708847f4f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
@@ -21,6 +21,9 @@
 #ifndef JSSQLResultSet_h
 #define JSSQLResultSet_h
 
+
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,12 +37,12 @@ class JSSQLResultSet : public DOMObject {
 public:
     JSSQLResultSet(PassRefPtr<JSC::Structure>, PassRefPtr<SQLResultSet>);
     virtual ~JSSQLResultSet();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +53,13 @@ private:
     RefPtr<SQLResultSet> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLResultSet*);
-SQLResultSet* toSQLResultSet(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLResultSet*);
+SQLResultSet* toSQLResultSet(JSC::JSValue);
 
 class JSSQLResultSetPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSQLResultSetPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,10 +67,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSQLResultSetRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSQLResultSetInsertId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSQLResultSetRowsAffected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetInsertId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRowsAffected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
index da1804acd7..8f60335e26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
@@ -20,6 +20,9 @@
 
 #include "config.h"
 
+
+#if ENABLE(DATABASE)
+
 #include "JSSQLResultSetRowList.h"
 
 #include <wtf/GetPtr.h>
@@ -33,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSetRowList)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSetRowList);
 
 /* Hash table */
 
@@ -67,9 +70,9 @@ static const HashTable JSSQLResultSetRowListPrototypeTable =
 
 const ClassInfo JSSQLResultSetRowListPrototype::s_info = { "SQLResultSetRowListPrototype", 0, &JSSQLResultSetRowListPrototypeTable, 0 };
 
-JSObject* JSSQLResultSetRowListPrototype::self(ExecState* exec)
+JSObject* JSSQLResultSetRowListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLResultSetRowList>(exec);
+    return getDOMPrototype<JSSQLResultSetRowList>(exec, globalObject);
 }
 
 bool JSSQLResultSetRowListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -88,12 +91,11 @@ JSSQLResultSetRowList::JSSQLResultSetRowList(PassRefPtr<Structure> structure, Pa
 JSSQLResultSetRowList::~JSSQLResultSetRowList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLResultSetRowList::createPrototype(ExecState* exec)
+JSObject* JSSQLResultSetRowList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLResultSetRowListPrototype(JSSQLResultSetRowListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLResultSetRowListPrototype(JSSQLResultSetRowListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSQLResultSetRowList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,27 +103,31 @@ bool JSSQLResultSetRowList::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSQLResultSetRowList, Base>(exec, &JSSQLResultSetRowListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSQLResultSetRowListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRowListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLResultSetRowList* imp = static_cast<SQLResultSetRowList*>(static_cast<JSSQLResultSetRowList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsSQLResultSetRowListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSQLResultSetRowListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSQLResultSetRowList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSQLResultSetRowList::s_info))
         return throwError(exec, TypeError);
     JSSQLResultSetRowList* castedThisObj = static_cast<JSSQLResultSetRowList*>(asObject(thisValue));
     return castedThisObj->item(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLResultSetRowList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLResultSetRowList* object)
 {
     return getDOMObjectWrapper<JSSQLResultSetRowList>(exec, object);
 }
-SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValuePtr value)
+SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLResultSetRowList::s_info) ? static_cast<JSSQLResultSetRowList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLResultSetRowList::s_info) ? static_cast<JSSQLResultSetRowList*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
index d2287c4433..c5b30f70eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
@@ -21,6 +21,9 @@
 #ifndef JSSQLResultSetRowList_h
 #define JSSQLResultSetRowList_h
 
+
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,35 +37,36 @@ class JSSQLResultSetRowList : public DOMObject {
 public:
     JSSQLResultSetRowList(PassRefPtr<JSC::Structure>, PassRefPtr<SQLResultSetRowList>);
     virtual ~JSSQLResultSetRowList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr item(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue item(JSC::ExecState*, const JSC::ArgList&);
     SQLResultSetRowList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLResultSetRowList> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLResultSetRowList*);
-SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLResultSetRowList*);
+SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValue);
 
 class JSSQLResultSetRowListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -71,11 +75,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSQLResultSetRowListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSQLResultSetRowListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSQLResultSetRowListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRowListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
index 01a9a30575..d65771e3cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
@@ -20,6 +20,9 @@
 
 #include "config.h"
 
+
+#if ENABLE(DATABASE)
+
 #include "JSSQLTransaction.h"
 
 #include <wtf/GetPtr.h>
@@ -32,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLTransaction)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLTransaction);
 
 /* Hash table for prototype */
 
@@ -51,9 +54,9 @@ static const HashTable JSSQLTransactionPrototypeTable =
 
 const ClassInfo JSSQLTransactionPrototype::s_info = { "SQLTransactionPrototype", 0, &JSSQLTransactionPrototypeTable, 0 };
 
-JSObject* JSSQLTransactionPrototype::self(ExecState* exec)
+JSObject* JSSQLTransactionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLTransaction>(exec);
+    return getDOMPrototype<JSSQLTransaction>(exec, globalObject);
 }
 
 bool JSSQLTransactionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -72,29 +75,31 @@ JSSQLTransaction::JSSQLTransaction(PassRefPtr<Structure> structure, PassRefPtr<S
 JSSQLTransaction::~JSSQLTransaction()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLTransaction::createPrototype(ExecState* exec)
+JSObject* JSSQLTransaction::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLTransactionPrototype(JSSQLTransactionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLTransactionPrototype(JSSQLTransactionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsSQLTransactionPrototypeFunctionExecuteSql(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSQLTransactionPrototypeFunctionExecuteSql(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSQLTransaction::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSQLTransaction::s_info))
         return throwError(exec, TypeError);
     JSSQLTransaction* castedThisObj = static_cast<JSSQLTransaction*>(asObject(thisValue));
     return castedThisObj->executeSql(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLTransaction* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLTransaction* object)
 {
     return getDOMObjectWrapper<JSSQLTransaction>(exec, object);
 }
-SQLTransaction* toSQLTransaction(JSC::JSValuePtr value)
+SQLTransaction* toSQLTransaction(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLTransaction::s_info) ? static_cast<JSSQLTransaction*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLTransaction::s_info) ? static_cast<JSSQLTransaction*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
index baa7240096..e0190a87d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
@@ -21,6 +21,9 @@
 #ifndef JSSQLTransaction_h
 #define JSSQLTransaction_h
 
+
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,29 +37,30 @@ class JSSQLTransaction : public DOMObject {
 public:
     JSSQLTransaction(PassRefPtr<JSC::Structure>, PassRefPtr<SQLTransaction>);
     virtual ~JSSQLTransaction();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
 
     // Custom functions
-    JSC::JSValuePtr executeSql(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue executeSql(JSC::ExecState*, const JSC::ArgList&);
     SQLTransaction* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLTransaction> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLTransaction*);
-SQLTransaction* toSQLTransaction(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLTransaction*);
+SQLTransaction* toSQLTransaction(JSC::JSValue);
 
 class JSSQLTransactionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -65,8 +69,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSQLTransactionPrototypeFunctionExecuteSql(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSQLTransactionPrototypeFunctionExecuteSql(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
index ef5977d279..ee98ed0a01 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
@@ -52,7 +52,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAElement);
 
 /* Hash table */
 
@@ -103,9 +103,9 @@ static const HashTable JSSVGAElementPrototypeTable =
 
 const ClassInfo JSSVGAElementPrototype::s_info = { "SVGAElementPrototype", 0, &JSSVGAElementPrototypeTable, 0 };
 
-JSObject* JSSVGAElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAElement>(exec);
+    return getDOMPrototype<JSSVGAElement>(exec, globalObject);
 }
 
 bool JSSVGAElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -120,9 +120,9 @@ JSSVGAElement::JSSVGAElement(PassRefPtr<Structure> structure, PassRefPtr<SVGAEle
 {
 }
 
-JSObject* JSSVGAElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAElementPrototype(JSSVGAElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGAElementPrototype(JSSVGAElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGAElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,179 +130,198 @@ bool JSSVGAElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGAElement, Base>(exec, &JSSVGAElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->targetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGAElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGAElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGAElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGAElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGAElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGAElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGAElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGAElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAElement, Base>(exec, propertyName, value, &JSSVGAElementTable, this, slot);
 }
 
-void setJSSVGAElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGAElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
index b5ca1fb6c0..8b3f3da9be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
@@ -34,13 +34,13 @@ class JSSVGAElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGAElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGAElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGAElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
index 5409761824..81a4c84fda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAltGlyphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAltGlyphElement);
 
 /* Hash table */
 
@@ -73,9 +73,9 @@ static const HashTable JSSVGAltGlyphElementPrototypeTable =
 
 const ClassInfo JSSVGAltGlyphElementPrototype::s_info = { "SVGAltGlyphElementPrototype", 0, &JSSVGAltGlyphElementPrototypeTable, 0 };
 
-JSObject* JSSVGAltGlyphElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAltGlyphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAltGlyphElement>(exec);
+    return getDOMPrototype<JSSVGAltGlyphElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAltGlyphElement::s_info = { "SVGAltGlyphElement", &JSSVGTextPositioningElement::s_info, &JSSVGAltGlyphElementTable, 0 };
@@ -85,9 +85,9 @@ JSSVGAltGlyphElement::JSSVGAltGlyphElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGAltGlyphElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAltGlyphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAltGlyphElementPrototype(JSSVGAltGlyphElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGAltGlyphElementPrototype(JSSVGAltGlyphElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGAltGlyphElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,43 +95,46 @@ bool JSSVGAltGlyphElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAltGlyphElement, Base>(exec, &JSSVGAltGlyphElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAltGlyphElementGlyphRef(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementGlyphRef(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->glyphRef());
 }
 
-JSValuePtr jsSVGAltGlyphElementFormat(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementFormat(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->format());
 }
 
-JSValuePtr jsSVGAltGlyphElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGAltGlyphElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAltGlyphElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAltGlyphElement, Base>(exec, propertyName, value, &JSSVGAltGlyphElementTable, this, slot);
 }
 
-void setJSSVGAltGlyphElementGlyphRef(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAltGlyphElementGlyphRef(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setGlyphRef(value->toString(exec), ec);
+    imp->setGlyphRef(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGAltGlyphElementFormat(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAltGlyphElementFormat(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setFormat(value->toString(exec), ec);
+    imp->setFormat(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
index 79e4660f0d..849854654e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
@@ -34,13 +34,13 @@ class JSSVGAltGlyphElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGAltGlyphElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAltGlyphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGAltGlyphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAltGlyphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,11 +59,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAltGlyphElementGlyphRef(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAltGlyphElementGlyphRef(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAltGlyphElementFormat(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAltGlyphElementFormat(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAltGlyphElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAltGlyphElementGlyphRef(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAltGlyphElementGlyphRef(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAltGlyphElementFormat(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAltGlyphElementFormat(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAltGlyphElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
index 649613cdc6..190edeaaf9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAngle)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAngle);
 
 /* Hash table */
 
@@ -84,13 +84,13 @@ public:
     JSSVGAngleConstructor(ExecState* exec)
         : DOMObject(JSSVGAngleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGAnglePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGAnglePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +126,9 @@ static const HashTable JSSVGAnglePrototypeTable =
 
 const ClassInfo JSSVGAnglePrototype::s_info = { "SVGAnglePrototype", 0, &JSSVGAnglePrototypeTable, 0 };
 
-JSObject* JSSVGAnglePrototype::self(ExecState* exec)
+JSObject* JSSVGAnglePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAngle>(exec);
+    return getDOMPrototype<JSSVGAngle>(exec, globalObject);
 }
 
 bool JSSVGAnglePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,12 +148,11 @@ JSSVGAngle::JSSVGAngle(PassRefPtr<Structure> structure, PassRefPtr<SVGAngle> imp
 JSSVGAngle::~JSSVGAngle()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAngle::createPrototype(ExecState* exec)
+JSObject* JSSVGAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnglePrototype(JSSVGAnglePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnglePrototype(JSSVGAnglePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAngle::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,56 +160,60 @@ bool JSSVGAngle::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGAngle, Base>(exec, &JSSVGAngleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAngleUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->unitType());
 }
 
-JSValuePtr jsSVGAngleValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->value());
 }
 
-JSValuePtr jsSVGAngleValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->valueInSpecifiedUnits());
 }
 
-JSValuePtr jsSVGAngleValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->valueAsString());
 }
 
-JSValuePtr jsSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGAngle::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAngle::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAngle, Base>(exec, propertyName, value, &JSSVGAngleTable, this, slot);
 }
 
-void setJSSVGAngleValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAngleValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
-    imp->setValue(value->toFloat(exec));
+    imp->setValue(value.toFloat(exec));
     if (static_cast<JSSVGAngle*>(thisObject)->context())
         static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGAngleValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAngleValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
-    imp->setValueInSpecifiedUnits(value->toFloat(exec));
+    imp->setValueInSpecifiedUnits(value.toFloat(exec));
     if (static_cast<JSSVGAngle*>(thisObject)->context())
         static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGAngleValueAsString(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAngleValueAsString(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
     imp->setValueAsString(valueToStringWithNullCheck(exec, value));
@@ -218,31 +221,33 @@ void setJSSVGAngleValueAsString(ExecState* exec, JSObject* thisObject, JSValuePt
         static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSValuePtr JSSVGAngle::getConstructor(ExecState* exec)
+JSValue JSSVGAngle::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGAngleConstructor>(exec);
 }
 
-JSValuePtr jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAngle::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
     SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
-    float valueInSpecifiedUnits = args.at(exec, 1)->toFloat(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
+    float valueInSpecifiedUnits = args.at(1).toFloat(exec);
 
     imp->newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAngle::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
     SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
 
     imp->convertToSpecifiedUnits(unitType);
     return jsUndefined();
@@ -250,38 +255,38 @@ JSValuePtr jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, J
 
 // Constant getters
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAngle* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAngle* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAngle>(exec, object, context);
 }
-SVGAngle* toSVGAngle(JSC::JSValuePtr value)
+SVGAngle* toSVGAngle(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAngle::s_info) ? static_cast<JSSVGAngle*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAngle::s_info) ? static_cast<JSSVGAngle*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
index f0fad172be..0172d92e04 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
@@ -37,18 +37,18 @@ class JSSVGAngle : public DOMObject {
 public:
     JSSVGAngle(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAngle>, SVGElement* context);
     virtual ~JSSVGAngle();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGAngle* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -57,16 +57,17 @@ private:
     RefPtr<SVGAngle > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAngle*, SVGElement* context);
-SVGAngle* toSVGAngle(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAngle*, SVGElement* context);
+SVGAngle* toSVGAngle(JSC::JSValue);
 
 class JSSVGAnglePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,25 +76,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGAngleUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAngleValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAngleValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAngleValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAngleValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAngleValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAngleValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAngleValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAngleValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAngleValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAngleValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
index 9f6b3802e5..312836b76e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateColorElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateColorElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGAnimateColorElementPrototypeTable =
 
 const ClassInfo JSSVGAnimateColorElementPrototype::s_info = { "SVGAnimateColorElementPrototype", 0, &JSSVGAnimateColorElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimateColorElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimateColorElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimateColorElement>(exec);
+    return getDOMPrototype<JSSVGAnimateColorElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimateColorElement::s_info = { "SVGAnimateColorElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGAnimateColorElement::JSSVGAnimateColorElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGAnimateColorElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimateColorElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimateColorElementPrototype(JSSVGAnimateColorElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimateColorElementPrototype(JSSVGAnimateColorElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
index 8c7a3416d4..b2b654a77d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
@@ -34,7 +34,7 @@ class JSSVGAnimateColorElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGAnimateColorElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimateColorElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGAnimateColorElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimateColorElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
index b40aad2259..9b57d63790 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGAnimateElementPrototypeTable =
 
 const ClassInfo JSSVGAnimateElementPrototype::s_info = { "SVGAnimateElementPrototype", 0, &JSSVGAnimateElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimateElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimateElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimateElement>(exec);
+    return getDOMPrototype<JSSVGAnimateElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimateElement::s_info = { "SVGAnimateElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGAnimateElement::JSSVGAnimateElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGAnimateElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimateElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimateElementPrototype(JSSVGAnimateElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimateElementPrototype(JSSVGAnimateElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
index 818c72108d..0a8e472635 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
@@ -34,7 +34,7 @@ class JSSVGAnimateElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGAnimateElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimateElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGAnimateElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimateElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
index 07bd771273..cb789f2ccd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateTransformElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateTransformElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGAnimateTransformElementPrototypeTable =
 
 const ClassInfo JSSVGAnimateTransformElementPrototype::s_info = { "SVGAnimateTransformElementPrototype", 0, &JSSVGAnimateTransformElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimateTransformElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimateTransformElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimateTransformElement>(exec);
+    return getDOMPrototype<JSSVGAnimateTransformElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimateTransformElement::s_info = { "SVGAnimateTransformElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGAnimateTransformElement::JSSVGAnimateTransformElement(PassRefPtr<Structure>
 {
 }
 
-JSObject* JSSVGAnimateTransformElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimateTransformElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimateTransformElementPrototype(JSSVGAnimateTransformElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimateTransformElementPrototype(JSSVGAnimateTransformElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
index 8d3eb5285f..b719266fea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
@@ -34,7 +34,7 @@ class JSSVGAnimateTransformElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGAnimateTransformElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimateTransformElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGAnimateTransformElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimateTransformElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
index ed756e2a3f..5c62b0fda6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedAngle)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedAngle);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGAnimatedAnglePrototypeTable =
 
 const ClassInfo JSSVGAnimatedAnglePrototype::s_info = { "SVGAnimatedAnglePrototype", 0, &JSSVGAnimatedAnglePrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedAnglePrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedAnglePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedAngle>(exec);
+    return getDOMPrototype<JSSVGAnimatedAngle>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedAngle::s_info = { "SVGAnimatedAngle", 0, &JSSVGAnimatedAngleTable, 0 };
@@ -87,12 +87,11 @@ JSSVGAnimatedAngle::JSSVGAnimatedAngle(PassRefPtr<Structure> structure, PassRefP
 JSSVGAnimatedAngle::~JSSVGAnimatedAngle()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedAngle::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedAnglePrototype(JSSVGAnimatedAnglePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedAnglePrototype(JSSVGAnimatedAnglePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedAngle::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +99,27 @@ bool JSSVGAnimatedAngle::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGAnimatedAngle, Base>(exec, &JSSVGAnimatedAngleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedAngleBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedAngleBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedAngle* imp = static_cast<SVGAnimatedAngle*>(static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedAngleAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedAngleAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedAngle* imp = static_cast<SVGAnimatedAngle*>(static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedAngle* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedAngle* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedAngle>(exec, object, context);
 }
-SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValuePtr value)
+SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedAngle::s_info) ? static_cast<JSSVGAnimatedAngle*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedAngle::s_info) ? static_cast<JSSVGAnimatedAngle*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
index 39e530994f..3be190132f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
@@ -35,12 +35,12 @@ class JSSVGAnimatedAngle : public DOMObject {
 public:
     JSSVGAnimatedAngle(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedAngle>, SVGElement* context);
     virtual ~JSSVGAnimatedAngle();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedAngle > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedAngle*, SVGElement* context);
-SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedAngle*, SVGElement* context);
+SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValue);
 
 class JSSVGAnimatedAnglePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedAnglePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedAngleBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedAngleAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedAngleBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedAngleAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
index 3955417d48..33301b2917 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedBoolean)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedBoolean);
 
 /* Hash table */
 
@@ -68,9 +68,9 @@ static const HashTable JSSVGAnimatedBooleanPrototypeTable =
 
 const ClassInfo JSSVGAnimatedBooleanPrototype::s_info = { "SVGAnimatedBooleanPrototype", 0, &JSSVGAnimatedBooleanPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedBooleanPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedBooleanPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedBoolean>(exec);
+    return getDOMPrototype<JSSVGAnimatedBoolean>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedBoolean::s_info = { "SVGAnimatedBoolean", 0, &JSSVGAnimatedBooleanTable, 0 };
@@ -85,12 +85,11 @@ JSSVGAnimatedBoolean::JSSVGAnimatedBoolean(PassRefPtr<Structure> structure, Pass
 JSSVGAnimatedBoolean::~JSSVGAnimatedBoolean()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedBoolean::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedBoolean::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedBooleanPrototype(JSSVGAnimatedBooleanPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedBooleanPrototype(JSSVGAnimatedBooleanPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedBoolean::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,38 +97,40 @@ bool JSSVGAnimatedBoolean::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedBoolean, Base>(exec, &JSSVGAnimatedBooleanTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedBooleanBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedBooleanBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(static_cast<JSSVGAnimatedBoolean*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedBooleanAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedBooleanAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(static_cast<JSSVGAnimatedBoolean*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->animVal());
 }
 
-void JSSVGAnimatedBoolean::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedBoolean::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedBoolean, Base>(exec, propertyName, value, &JSSVGAnimatedBooleanTable, this, slot);
 }
 
-void setJSSVGAnimatedBooleanBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedBooleanBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(static_cast<JSSVGAnimatedBoolean*>(thisObject)->impl());
-    imp->setBaseVal(value->toBoolean(exec));
+    imp->setBaseVal(value.toBoolean(exec));
     if (static_cast<JSSVGAnimatedBoolean*>(thisObject)->context())
         static_cast<JSSVGAnimatedBoolean*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedBoolean*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedBoolean* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedBoolean* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedBoolean>(exec, object, context);
 }
-SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValuePtr value)
+SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedBoolean::s_info) ? static_cast<JSSVGAnimatedBoolean*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedBoolean::s_info) ? static_cast<JSSVGAnimatedBoolean*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
index 9b58e6cda6..ddebd8aeaa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
@@ -35,13 +35,13 @@ class JSSVGAnimatedBoolean : public DOMObject {
 public:
     JSSVGAnimatedBoolean(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedBoolean>, SVGElement* context);
     virtual ~JSSVGAnimatedBoolean();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedBoolean > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedBoolean*, SVGElement* context);
-SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedBoolean*, SVGElement* context);
+SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValue);
 
 class JSSVGAnimatedBooleanPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedBooleanPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedBooleanBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedBooleanBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedBooleanAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedBooleanBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedBooleanBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedBooleanAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
index be9ae2eea4..ae30a65e1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedEnumeration)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedEnumeration);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGAnimatedEnumerationPrototypeTable =
 
 const ClassInfo JSSVGAnimatedEnumerationPrototype::s_info = { "SVGAnimatedEnumerationPrototype", 0, &JSSVGAnimatedEnumerationPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedEnumerationPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedEnumerationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedEnumeration>(exec);
+    return getDOMPrototype<JSSVGAnimatedEnumeration>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedEnumeration::s_info = { "SVGAnimatedEnumeration", 0, &JSSVGAnimatedEnumerationTable, 0 };
@@ -86,12 +86,11 @@ JSSVGAnimatedEnumeration::JSSVGAnimatedEnumeration(PassRefPtr<Structure> structu
 JSSVGAnimatedEnumeration::~JSSVGAnimatedEnumeration()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedEnumeration::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedEnumeration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedEnumerationPrototype(JSSVGAnimatedEnumerationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedEnumerationPrototype(JSSVGAnimatedEnumerationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedEnumeration::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,38 +98,40 @@ bool JSSVGAnimatedEnumeration::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGAnimatedEnumeration, Base>(exec, &JSSVGAnimatedEnumerationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedEnumerationBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedEnumerationBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(static_cast<JSSVGAnimatedEnumeration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedEnumerationAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedEnumerationAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(static_cast<JSSVGAnimatedEnumeration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->animVal());
 }
 
-void JSSVGAnimatedEnumeration::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedEnumeration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedEnumeration, Base>(exec, propertyName, value, &JSSVGAnimatedEnumerationTable, this, slot);
 }
 
-void setJSSVGAnimatedEnumerationBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedEnumerationBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(static_cast<JSSVGAnimatedEnumeration*>(thisObject)->impl());
-    imp->setBaseVal(value->toInt32(exec));
+    imp->setBaseVal(value.toInt32(exec));
     if (static_cast<JSSVGAnimatedEnumeration*>(thisObject)->context())
         static_cast<JSSVGAnimatedEnumeration*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedEnumeration*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedEnumeration* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedEnumeration* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedEnumeration>(exec, object, context);
 }
-SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValuePtr value)
+SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedEnumeration::s_info) ? static_cast<JSSVGAnimatedEnumeration*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedEnumeration::s_info) ? static_cast<JSSVGAnimatedEnumeration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
index eaaca25ad8..e09b4f5d9c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
@@ -35,13 +35,13 @@ class JSSVGAnimatedEnumeration : public DOMObject {
 public:
     JSSVGAnimatedEnumeration(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedEnumeration>, SVGElement* context);
     virtual ~JSSVGAnimatedEnumeration();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedEnumeration > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedEnumeration*, SVGElement* context);
-SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedEnumeration*, SVGElement* context);
+SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValue);
 
 class JSSVGAnimatedEnumerationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedEnumerationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedEnumerationBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedEnumerationBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedEnumerationAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedEnumerationBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedEnumerationBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedEnumerationAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
index fad8ff05ff..ebee00bcb3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedInteger)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedInteger);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGAnimatedIntegerPrototypeTable =
 
 const ClassInfo JSSVGAnimatedIntegerPrototype::s_info = { "SVGAnimatedIntegerPrototype", 0, &JSSVGAnimatedIntegerPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedIntegerPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedIntegerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedInteger>(exec);
+    return getDOMPrototype<JSSVGAnimatedInteger>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedInteger::s_info = { "SVGAnimatedInteger", 0, &JSSVGAnimatedIntegerTable, 0 };
@@ -86,12 +86,11 @@ JSSVGAnimatedInteger::JSSVGAnimatedInteger(PassRefPtr<Structure> structure, Pass
 JSSVGAnimatedInteger::~JSSVGAnimatedInteger()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedInteger::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedInteger::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedIntegerPrototype(JSSVGAnimatedIntegerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedIntegerPrototype(JSSVGAnimatedIntegerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedInteger::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,38 +98,40 @@ bool JSSVGAnimatedInteger::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedInteger, Base>(exec, &JSSVGAnimatedIntegerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedIntegerBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedIntegerBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(static_cast<JSSVGAnimatedInteger*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedIntegerAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedIntegerAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(static_cast<JSSVGAnimatedInteger*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->animVal());
 }
 
-void JSSVGAnimatedInteger::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedInteger::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedInteger, Base>(exec, propertyName, value, &JSSVGAnimatedIntegerTable, this, slot);
 }
 
-void setJSSVGAnimatedIntegerBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedIntegerBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(static_cast<JSSVGAnimatedInteger*>(thisObject)->impl());
-    imp->setBaseVal(value->toInt32(exec));
+    imp->setBaseVal(value.toInt32(exec));
     if (static_cast<JSSVGAnimatedInteger*>(thisObject)->context())
         static_cast<JSSVGAnimatedInteger*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedInteger*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedInteger* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedInteger* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedInteger>(exec, object, context);
 }
-SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValuePtr value)
+SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedInteger::s_info) ? static_cast<JSSVGAnimatedInteger*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedInteger::s_info) ? static_cast<JSSVGAnimatedInteger*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
index f8402d6b3c..5804a92c43 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
@@ -35,13 +35,13 @@ class JSSVGAnimatedInteger : public DOMObject {
 public:
     JSSVGAnimatedInteger(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedInteger>, SVGElement* context);
     virtual ~JSSVGAnimatedInteger();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedInteger > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedInteger*, SVGElement* context);
-SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedInteger*, SVGElement* context);
+SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValue);
 
 class JSSVGAnimatedIntegerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedIntegerPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedIntegerBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedIntegerBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedIntegerAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedIntegerBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedIntegerBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedIntegerAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
index b6f95ee26c..05de831488 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLength)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLength);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGAnimatedLengthPrototypeTable =
 
 const ClassInfo JSSVGAnimatedLengthPrototype::s_info = { "SVGAnimatedLengthPrototype", 0, &JSSVGAnimatedLengthPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedLengthPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedLengthPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedLength>(exec);
+    return getDOMPrototype<JSSVGAnimatedLength>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedLength::s_info = { "SVGAnimatedLength", 0, &JSSVGAnimatedLengthTable, 0 };
@@ -86,12 +86,11 @@ JSSVGAnimatedLength::JSSVGAnimatedLength(PassRefPtr<Structure> structure, PassRe
 JSSVGAnimatedLength::~JSSVGAnimatedLength()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedLength::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedLengthPrototype(JSSVGAnimatedLengthPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedLengthPrototype(JSSVGAnimatedLengthPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedLength::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,25 +98,27 @@ bool JSSVGAnimatedLength::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedLength, Base>(exec, &JSSVGAnimatedLengthTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedLengthBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLength* imp = static_cast<SVGAnimatedLength*>(static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::baseVal, &SVGAnimatedLength::setBaseVal).get(), static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedLengthAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLength* imp = static_cast<SVGAnimatedLength*>(static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::animVal, &SVGAnimatedLength::setAnimVal).get(), static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedLength* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedLength* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedLength>(exec, object, context);
 }
-SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValuePtr value)
+SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedLength::s_info) ? static_cast<JSSVGAnimatedLength*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedLength::s_info) ? static_cast<JSSVGAnimatedLength*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
index dd9a6ec90b..5f78e4b441 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
@@ -35,12 +35,12 @@ class JSSVGAnimatedLength : public DOMObject {
 public:
     JSSVGAnimatedLength(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedLength>, SVGElement* context);
     virtual ~JSSVGAnimatedLength();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedLength > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedLength*, SVGElement* context);
-SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedLength*, SVGElement* context);
+SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValue);
 
 class JSSVGAnimatedLengthPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedLengthPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedLengthBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedLengthAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
index 31c17e7fd6..2debf2683b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLengthList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLengthList);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGAnimatedLengthListPrototypeTable =
 
 const ClassInfo JSSVGAnimatedLengthListPrototype::s_info = { "SVGAnimatedLengthListPrototype", 0, &JSSVGAnimatedLengthListPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedLengthListPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedLengthListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedLengthList>(exec);
+    return getDOMPrototype<JSSVGAnimatedLengthList>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedLengthList::s_info = { "SVGAnimatedLengthList", 0, &JSSVGAnimatedLengthListTable, 0 };
@@ -87,12 +87,11 @@ JSSVGAnimatedLengthList::JSSVGAnimatedLengthList(PassRefPtr<Structure> structure
 JSSVGAnimatedLengthList::~JSSVGAnimatedLengthList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedLengthList::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedLengthListPrototype(JSSVGAnimatedLengthListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedLengthListPrototype(JSSVGAnimatedLengthListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedLengthList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +99,27 @@ bool JSSVGAnimatedLengthList::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGAnimatedLengthList, Base>(exec, &JSSVGAnimatedLengthListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedLengthListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLengthList* imp = static_cast<SVGAnimatedLengthList*>(static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedLengthListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLengthList* imp = static_cast<SVGAnimatedLengthList*>(static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedLengthList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedLengthList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedLengthList>(exec, object, context);
 }
-SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValuePtr value)
+SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedLengthList::s_info) ? static_cast<JSSVGAnimatedLengthList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedLengthList::s_info) ? static_cast<JSSVGAnimatedLengthList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
index 227ba01cb9..68ff457d61 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
@@ -35,12 +35,12 @@ class JSSVGAnimatedLengthList : public DOMObject {
 public:
     JSSVGAnimatedLengthList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedLengthList>, SVGElement* context);
     virtual ~JSSVGAnimatedLengthList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedLengthList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedLengthList*, SVGElement* context);
-SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedLengthList*, SVGElement* context);
+SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValue);
 
 class JSSVGAnimatedLengthListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedLengthListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedLengthListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedLengthListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
index dcdf0760d8..d6baa65950 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumber)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumber);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGAnimatedNumberPrototypeTable =
 
 const ClassInfo JSSVGAnimatedNumberPrototype::s_info = { "SVGAnimatedNumberPrototype", 0, &JSSVGAnimatedNumberPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedNumberPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedNumberPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedNumber>(exec);
+    return getDOMPrototype<JSSVGAnimatedNumber>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedNumber::s_info = { "SVGAnimatedNumber", 0, &JSSVGAnimatedNumberTable, 0 };
@@ -86,12 +86,11 @@ JSSVGAnimatedNumber::JSSVGAnimatedNumber(PassRefPtr<Structure> structure, PassRe
 JSSVGAnimatedNumber::~JSSVGAnimatedNumber()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedNumber::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedNumberPrototype(JSSVGAnimatedNumberPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedNumberPrototype(JSSVGAnimatedNumberPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedNumber::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,38 +98,40 @@ bool JSSVGAnimatedNumber::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedNumber, Base>(exec, &JSSVGAnimatedNumberTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedNumberBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(static_cast<JSSVGAnimatedNumber*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedNumberAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(static_cast<JSSVGAnimatedNumber*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->animVal());
 }
 
-void JSSVGAnimatedNumber::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedNumber::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedNumber, Base>(exec, propertyName, value, &JSSVGAnimatedNumberTable, this, slot);
 }
 
-void setJSSVGAnimatedNumberBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedNumberBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(static_cast<JSSVGAnimatedNumber*>(thisObject)->impl());
-    imp->setBaseVal(value->toFloat(exec));
+    imp->setBaseVal(value.toFloat(exec));
     if (static_cast<JSSVGAnimatedNumber*>(thisObject)->context())
         static_cast<JSSVGAnimatedNumber*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedNumber*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedNumber* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedNumber* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedNumber>(exec, object, context);
 }
-SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValuePtr value)
+SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedNumber::s_info) ? static_cast<JSSVGAnimatedNumber*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedNumber::s_info) ? static_cast<JSSVGAnimatedNumber*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
index 77590fb964..8e058b85a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
@@ -35,13 +35,13 @@ class JSSVGAnimatedNumber : public DOMObject {
 public:
     JSSVGAnimatedNumber(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedNumber>, SVGElement* context);
     virtual ~JSSVGAnimatedNumber();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedNumber > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedNumber*, SVGElement* context);
-SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedNumber*, SVGElement* context);
+SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValue);
 
 class JSSVGAnimatedNumberPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedNumberPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedNumberBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedNumberBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedNumberAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedNumberBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedNumberAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
index cd39b16bbb..610ba23004 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumberList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumberList);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGAnimatedNumberListPrototypeTable =
 
 const ClassInfo JSSVGAnimatedNumberListPrototype::s_info = { "SVGAnimatedNumberListPrototype", 0, &JSSVGAnimatedNumberListPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedNumberListPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedNumberListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedNumberList>(exec);
+    return getDOMPrototype<JSSVGAnimatedNumberList>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedNumberList::s_info = { "SVGAnimatedNumberList", 0, &JSSVGAnimatedNumberListTable, 0 };
@@ -87,12 +87,11 @@ JSSVGAnimatedNumberList::JSSVGAnimatedNumberList(PassRefPtr<Structure> structure
 JSSVGAnimatedNumberList::~JSSVGAnimatedNumberList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedNumberList::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedNumberListPrototype(JSSVGAnimatedNumberListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedNumberListPrototype(JSSVGAnimatedNumberListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedNumberList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +99,27 @@ bool JSSVGAnimatedNumberList::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGAnimatedNumberList, Base>(exec, &JSSVGAnimatedNumberListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedNumberListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumberList* imp = static_cast<SVGAnimatedNumberList*>(static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedNumberListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumberList* imp = static_cast<SVGAnimatedNumberList*>(static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedNumberList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedNumberList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedNumberList>(exec, object, context);
 }
-SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValuePtr value)
+SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedNumberList::s_info) ? static_cast<JSSVGAnimatedNumberList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedNumberList::s_info) ? static_cast<JSSVGAnimatedNumberList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
index 15e78883e0..a6d997c3d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
@@ -35,12 +35,12 @@ class JSSVGAnimatedNumberList : public DOMObject {
 public:
     JSSVGAnimatedNumberList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedNumberList>, SVGElement* context);
     virtual ~JSSVGAnimatedNumberList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedNumberList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedNumberList*, SVGElement* context);
-SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedNumberList*, SVGElement* context);
+SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValue);
 
 class JSSVGAnimatedNumberListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedNumberListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedNumberListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedNumberListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
index 04b2e73b0e..5c03cce51a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedPreserveAspectRatio)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedPreserveAspectRatio);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGAnimatedPreserveAspectRatioPrototypeTable =
 
 const ClassInfo JSSVGAnimatedPreserveAspectRatioPrototype::s_info = { "SVGAnimatedPreserveAspectRatioPrototype", 0, &JSSVGAnimatedPreserveAspectRatioPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedPreserveAspectRatioPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedPreserveAspectRatioPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedPreserveAspectRatio>(exec);
+    return getDOMPrototype<JSSVGAnimatedPreserveAspectRatio>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedPreserveAspectRatio::s_info = { "SVGAnimatedPreserveAspectRatio", 0, &JSSVGAnimatedPreserveAspectRatioTable, 0 };
@@ -87,12 +87,11 @@ JSSVGAnimatedPreserveAspectRatio::JSSVGAnimatedPreserveAspectRatio(PassRefPtr<St
 JSSVGAnimatedPreserveAspectRatio::~JSSVGAnimatedPreserveAspectRatio()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedPreserveAspectRatio::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedPreserveAspectRatioPrototype(JSSVGAnimatedPreserveAspectRatioPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedPreserveAspectRatioPrototype(JSSVGAnimatedPreserveAspectRatioPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +99,27 @@ bool JSSVGAnimatedPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGAnimatedPreserveAspectRatio, Base>(exec, &JSSVGAnimatedPreserveAspectRatioTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedPreserveAspectRatioBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedPreserveAspectRatio* imp = static_cast<SVGAnimatedPreserveAspectRatio*>(static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedPreserveAspectRatioAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedPreserveAspectRatio* imp = static_cast<SVGAnimatedPreserveAspectRatio*>(static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedPreserveAspectRatio* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedPreserveAspectRatio* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedPreserveAspectRatio>(exec, object, context);
 }
-SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValuePtr value)
+SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedPreserveAspectRatio::s_info) ? static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedPreserveAspectRatio::s_info) ? static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
index 05bcb19d10..f74ae85edc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
@@ -35,12 +35,12 @@ class JSSVGAnimatedPreserveAspectRatio : public DOMObject {
 public:
     JSSVGAnimatedPreserveAspectRatio(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedPreserveAspectRatio>, SVGElement* context);
     virtual ~JSSVGAnimatedPreserveAspectRatio();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedPreserveAspectRatio > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedPreserveAspectRatio*, SVGElement* context);
-SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedPreserveAspectRatio*, SVGElement* context);
+SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValue);
 
 class JSSVGAnimatedPreserveAspectRatioPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedPreserveAspectRatioPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedPreserveAspectRatioBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedPreserveAspectRatioAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
index 59ff2d17c1..dfe079580b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedRect)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedRect);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGAnimatedRectPrototypeTable =
 
 const ClassInfo JSSVGAnimatedRectPrototype::s_info = { "SVGAnimatedRectPrototype", 0, &JSSVGAnimatedRectPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedRectPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedRect>(exec);
+    return getDOMPrototype<JSSVGAnimatedRect>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedRect::s_info = { "SVGAnimatedRect", 0, &JSSVGAnimatedRectTable, 0 };
@@ -87,12 +87,11 @@ JSSVGAnimatedRect::JSSVGAnimatedRect(PassRefPtr<Structure> structure, PassRefPtr
 JSSVGAnimatedRect::~JSSVGAnimatedRect()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedRect::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedRectPrototype(JSSVGAnimatedRectPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedRectPrototype(JSSVGAnimatedRectPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +99,27 @@ bool JSSVGAnimatedRect::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGAnimatedRect, Base>(exec, &JSSVGAnimatedRectTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedRectBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedRectBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedRect* imp = static_cast<SVGAnimatedRect*>(static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::baseVal, &SVGAnimatedRect::setBaseVal).get(), static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedRectAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedRectAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedRect* imp = static_cast<SVGAnimatedRect*>(static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::animVal, &SVGAnimatedRect::setAnimVal).get(), static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedRect* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedRect* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedRect>(exec, object, context);
 }
-SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValuePtr value)
+SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedRect::s_info) ? static_cast<JSSVGAnimatedRect*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedRect::s_info) ? static_cast<JSSVGAnimatedRect*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
index 55b9ed37c5..909f7db2ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
@@ -35,12 +35,12 @@ class JSSVGAnimatedRect : public DOMObject {
 public:
     JSSVGAnimatedRect(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedRect>, SVGElement* context);
     virtual ~JSSVGAnimatedRect();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedRect > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedRect*, SVGElement* context);
-SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedRect*, SVGElement* context);
+SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValue);
 
 class JSSVGAnimatedRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedRectBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedRectAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedRectBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedRectAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
index e35e918305..0088054861 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedString)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedString);
 
 /* Hash table */
 
@@ -71,9 +71,9 @@ static const HashTable JSSVGAnimatedStringPrototypeTable =
 
 const ClassInfo JSSVGAnimatedStringPrototype::s_info = { "SVGAnimatedStringPrototype", 0, &JSSVGAnimatedStringPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedStringPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedStringPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedString>(exec);
+    return getDOMPrototype<JSSVGAnimatedString>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedString::s_info = { "SVGAnimatedString", 0, &JSSVGAnimatedStringTable, 0 };
@@ -88,12 +88,11 @@ JSSVGAnimatedString::JSSVGAnimatedString(PassRefPtr<Structure> structure, PassRe
 JSSVGAnimatedString::~JSSVGAnimatedString()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedString::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedString::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedStringPrototype(JSSVGAnimatedStringPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedStringPrototype(JSSVGAnimatedStringPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,38 +100,40 @@ bool JSSVGAnimatedString::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedString, Base>(exec, &JSSVGAnimatedStringTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedStringBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedStringBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(static_cast<JSSVGAnimatedString*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedStringAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedStringAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(static_cast<JSSVGAnimatedString*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->animVal());
 }
 
-void JSSVGAnimatedString::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedString::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedString, Base>(exec, propertyName, value, &JSSVGAnimatedStringTable, this, slot);
 }
 
-void setJSSVGAnimatedStringBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedStringBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(static_cast<JSSVGAnimatedString*>(thisObject)->impl());
-    imp->setBaseVal(value->toString(exec));
+    imp->setBaseVal(value.toString(exec));
     if (static_cast<JSSVGAnimatedString*>(thisObject)->context())
         static_cast<JSSVGAnimatedString*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedString*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedString* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedString* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedString>(exec, object, context);
 }
-SVGAnimatedString* toSVGAnimatedString(JSC::JSValuePtr value)
+SVGAnimatedString* toSVGAnimatedString(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedString::s_info) ? static_cast<JSSVGAnimatedString*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedString::s_info) ? static_cast<JSSVGAnimatedString*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
index 71bf12d496..d95a8fe19b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
@@ -35,13 +35,13 @@ class JSSVGAnimatedString : public DOMObject {
 public:
     JSSVGAnimatedString(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedString>, SVGElement* context);
     virtual ~JSSVGAnimatedString();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedString > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedString*, SVGElement* context);
-SVGAnimatedString* toSVGAnimatedString(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedString*, SVGElement* context);
+SVGAnimatedString* toSVGAnimatedString(JSC::JSValue);
 
 class JSSVGAnimatedStringPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedStringPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedStringBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedStringBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedStringAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedStringBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedStringBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedStringAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
index bf28b97000..8c9b0ef7dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedTransformList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedTransformList);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGAnimatedTransformListPrototypeTable =
 
 const ClassInfo JSSVGAnimatedTransformListPrototype::s_info = { "SVGAnimatedTransformListPrototype", 0, &JSSVGAnimatedTransformListPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedTransformListPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedTransformListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedTransformList>(exec);
+    return getDOMPrototype<JSSVGAnimatedTransformList>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedTransformList::s_info = { "SVGAnimatedTransformList", 0, &JSSVGAnimatedTransformListTable, 0 };
@@ -87,12 +87,11 @@ JSSVGAnimatedTransformList::JSSVGAnimatedTransformList(PassRefPtr<Structure> str
 JSSVGAnimatedTransformList::~JSSVGAnimatedTransformList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedTransformList::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedTransformListPrototype(JSSVGAnimatedTransformListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedTransformListPrototype(JSSVGAnimatedTransformListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedTransformList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +99,27 @@ bool JSSVGAnimatedTransformList::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGAnimatedTransformList, Base>(exec, &JSSVGAnimatedTransformListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedTransformListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedTransformListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedTransformList* imp = static_cast<SVGAnimatedTransformList*>(static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedTransformListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedTransformListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedTransformList* imp = static_cast<SVGAnimatedTransformList*>(static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedTransformList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedTransformList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedTransformList>(exec, object, context);
 }
-SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValuePtr value)
+SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedTransformList::s_info) ? static_cast<JSSVGAnimatedTransformList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedTransformList::s_info) ? static_cast<JSSVGAnimatedTransformList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
index bd96456645..c3300afbc6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
@@ -35,12 +35,12 @@ class JSSVGAnimatedTransformList : public DOMObject {
 public:
     JSSVGAnimatedTransformList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedTransformList>, SVGElement* context);
     virtual ~JSSVGAnimatedTransformList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedTransformList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedTransformList*, SVGElement* context);
-SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedTransformList*, SVGElement* context);
+SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValue);
 
 class JSSVGAnimatedTransformListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedTransformListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedTransformListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedTransformListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedTransformListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedTransformListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
index 6f22756089..d133b038d3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
@@ -42,7 +42,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimationElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimationElement);
 
 /* Hash table */
 
@@ -87,9 +87,9 @@ static const HashTable JSSVGAnimationElementPrototypeTable =
 
 const ClassInfo JSSVGAnimationElementPrototype::s_info = { "SVGAnimationElementPrototype", 0, &JSSVGAnimationElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimationElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimationElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimationElement>(exec);
+    return getDOMPrototype<JSSVGAnimationElement>(exec, globalObject);
 }
 
 bool JSSVGAnimationElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,9 +104,9 @@ JSSVGAnimationElement::JSSVGAnimationElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGAnimationElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimationElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimationElementPrototype(JSSVGAnimationElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimationElementPrototype(JSSVGAnimationElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGAnimationElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,142 +114,155 @@ bool JSSVGAnimationElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGAnimationElement, Base>(exec, &JSSVGAnimationElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimationElementTargetElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementTargetElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->targetElement()));
 }
 
-JSValuePtr jsSVGAnimationElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGAnimationElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGAnimationElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGAnimationElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionGetStartTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetStartTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getStartTime());
+    JSC::JSValue result = jsNumber(exec, imp->getStartTime());
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getCurrentTime());
+    JSC::JSValue result = jsNumber(exec, imp->getCurrentTime());
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getSimpleDuration(ec));
+    JSC::JSValue result = jsNumber(exec, imp->getSimpleDuration(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->beginElement(ec));
+    JSC::JSValue result = jsBoolean(imp->beginElement(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElementAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElementAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float offset = args.at(exec, 0)->toFloat(exec);
+    float offset = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->beginElementAt(offset, ec));
+    JSC::JSValue result = jsBoolean(imp->beginElementAt(offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->endElement(ec));
+    JSC::JSValue result = jsBoolean(imp->endElement(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElementAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElementAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float offset = args.at(exec, 0)->toFloat(exec);
+    float offset = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->endElementAt(offset, ec));
+    JSC::JSValue result = jsBoolean(imp->endElementAt(offset, ec));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
index d2390e6807..5bed840895 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
@@ -34,12 +34,12 @@ class JSSVGAnimationElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGAnimationElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimationElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGAnimationElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,21 +63,21 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionGetStartTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetStartTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimationElementTargetElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementTargetElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
index f8d80691dd..0c2fe13996 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
@@ -53,7 +53,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGCircleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGCircleElement);
 
 /* Hash table */
 
@@ -105,9 +105,9 @@ static const HashTable JSSVGCircleElementPrototypeTable =
 
 const ClassInfo JSSVGCircleElementPrototype::s_info = { "SVGCircleElementPrototype", 0, &JSSVGCircleElementPrototypeTable, 0 };
 
-JSObject* JSSVGCircleElementPrototype::self(ExecState* exec)
+JSObject* JSSVGCircleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGCircleElement>(exec);
+    return getDOMPrototype<JSSVGCircleElement>(exec, globalObject);
 }
 
 bool JSSVGCircleElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -122,9 +122,9 @@ JSSVGCircleElement::JSSVGCircleElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGCircleElement::createPrototype(ExecState* exec)
+JSObject* JSSVGCircleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGCircleElementPrototype(JSSVGCircleElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGCircleElementPrototype(JSSVGCircleElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGCircleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,186 +132,206 @@ bool JSSVGCircleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGCircleElement, Base>(exec, &JSSVGCircleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGCircleElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGCircleElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGCircleElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGCircleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGCircleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGCircleElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGCircleElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGCircleElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGCircleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGCircleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGCircleElement, Base>(exec, propertyName, value, &JSSVGCircleElementTable, this, slot);
 }
 
-void setJSSVGCircleElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGCircleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGCircleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGCircleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
index 13e9fc0e56..a9d797d3d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
@@ -34,13 +34,13 @@ class JSSVGCircleElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGCircleElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGCircleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGCircleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,30 +64,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGCircleElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGCircleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGCircleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGCircleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGCircleElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGCircleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGCircleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGCircleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGCircleElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
index f96a8c768e..39b04edce9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
@@ -53,7 +53,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGClipPathElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGClipPathElement);
 
 /* Hash table */
 
@@ -103,9 +103,9 @@ static const HashTable JSSVGClipPathElementPrototypeTable =
 
 const ClassInfo JSSVGClipPathElementPrototype::s_info = { "SVGClipPathElementPrototype", 0, &JSSVGClipPathElementPrototypeTable, 0 };
 
-JSObject* JSSVGClipPathElementPrototype::self(ExecState* exec)
+JSObject* JSSVGClipPathElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGClipPathElement>(exec);
+    return getDOMPrototype<JSSVGClipPathElement>(exec, globalObject);
 }
 
 bool JSSVGClipPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -120,9 +120,9 @@ JSSVGClipPathElement::JSSVGClipPathElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGClipPathElement::createPrototype(ExecState* exec)
+JSObject* JSSVGClipPathElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGClipPathElementPrototype(JSSVGClipPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGClipPathElementPrototype(JSSVGClipPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGClipPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,172 +130,190 @@ bool JSSVGClipPathElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGClipPathElement, Base>(exec, &JSSVGClipPathElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGClipPathElementClipPathUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementClipPathUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->clipPathUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGClipPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGClipPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGClipPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGClipPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGClipPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGClipPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGClipPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGClipPathElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGClipPathElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGClipPathElement, Base>(exec, propertyName, value, &JSSVGClipPathElementTable, this, slot);
 }
 
-void setJSSVGClipPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGClipPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGClipPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGClipPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
index 144d8e26f3..97fe6a0cdc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
@@ -34,13 +34,13 @@ class JSSVGClipPathElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGClipPathElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGClipPathElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGClipPathElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,28 +64,28 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGClipPathElementClipPathUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGClipPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGClipPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGClipPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGClipPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementClipPathUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGClipPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGClipPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGClipPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGClipPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
index 12109d644f..bb0cc4fbe9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGColor)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGColor);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSSVGColorConstructor(ExecState* exec)
         : DOMObject(JSSVGColorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGColorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGColorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -122,9 +122,9 @@ static const HashTable JSSVGColorPrototypeTable =
 
 const ClassInfo JSSVGColorPrototype::s_info = { "SVGColorPrototype", 0, &JSSVGColorPrototypeTable, 0 };
 
-JSObject* JSSVGColorPrototype::self(ExecState* exec)
+JSObject* JSSVGColorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGColor>(exec);
+    return getDOMPrototype<JSSVGColor>(exec, globalObject);
 }
 
 bool JSSVGColorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,9 +139,9 @@ JSSVGColor::JSSVGColor(PassRefPtr<Structure> structure, PassRefPtr<SVGColor> imp
 {
 }
 
-JSObject* JSSVGColor::createPrototype(ExecState* exec)
+JSObject* JSSVGColor::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGColorPrototype(JSSVGColorPrototype::createStructure(JSCSSValuePrototype::self(exec)));
+    return new (exec) JSSVGColorPrototype(JSSVGColorPrototype::createStructure(JSCSSValuePrototype::self(exec, globalObject)));
 }
 
 bool JSSVGColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -149,66 +149,71 @@ bool JSSVGColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGColor, Base>(exec, &JSSVGColorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGColorColorType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorColorType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGColor* imp = static_cast<SVGColor*>(static_cast<JSSVGColor*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->colorType());
 }
 
-JSValuePtr jsSVGColorRgbColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorRgbColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGColor* imp = static_cast<SVGColor*>(static_cast<JSSVGColor*>(asObject(slot.slotBase()))->impl());
     return getJSRGBColor(exec, imp->rgbColor());
 }
 
-JSValuePtr jsSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGColor*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGColor::getConstructor(ExecState* exec)
+JSValue JSSVGColor::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGColorConstructor>(exec);
 }
 
-JSValuePtr jsSVGColorPrototypeFunctionSetRGBColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGColor::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rgbColor = args.at(exec, 0)->toString(exec);
+    const UString& rgbColor = args.at(0).toString(exec);
 
     imp->setRGBColor(rgbColor, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGColorPrototypeFunctionSetRGBColorICCColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColorICCColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGColor::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rgbColor = args.at(exec, 0)->toString(exec);
-    const UString& iccColor = args.at(exec, 1)->toString(exec);
+    const UString& rgbColor = args.at(0).toString(exec);
+    const UString& iccColor = args.at(1).toString(exec);
 
     imp->setRGBColorICCColor(rgbColor, iccColor, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGColor::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short colorType = args.at(exec, 0)->toInt32(exec);
-    const UString& rgbColor = args.at(exec, 1)->toString(exec);
-    const UString& iccColor = args.at(exec, 2)->toString(exec);
+    unsigned short colorType = args.at(0).toInt32(exec);
+    const UString& rgbColor = args.at(1).toString(exec);
+    const UString& iccColor = args.at(2).toString(exec);
 
     imp->setColor(colorType, rgbColor, iccColor, ec);
     setDOMException(exec, ec);
@@ -217,22 +222,22 @@ JSValuePtr jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObject*, JSVal
 
 // Constant getters
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
index c3d39a670a..da77c7d485 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
@@ -34,27 +34,28 @@ class JSSVGColor : public JSCSSValue {
     typedef JSCSSValue Base;
 public:
     JSSVGColor(PassRefPtr<JSC::Structure>, PassRefPtr<SVGColor>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGColorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,20 +64,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGColorPrototypeFunctionSetRGBColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGColorPrototypeFunctionSetRGBColorICCColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGColorPrototypeFunctionSetColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColorICCColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGColorColorType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorRgbColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorColorType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorRgbColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
index cc2f34cdeb..a9b2fb0704 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGComponentTransferFunctionElement.h"
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGComponentTransferFunctionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGComponentTransferFunctionElement);
 
 /* Hash table */
 
@@ -88,13 +88,13 @@ public:
     JSSVGComponentTransferFunctionElementConstructor(ExecState* exec)
         : DOMObject(JSSVGComponentTransferFunctionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGComponentTransferFunctionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGComponentTransferFunctionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -129,9 +129,9 @@ static const HashTable JSSVGComponentTransferFunctionElementPrototypeTable =
 
 const ClassInfo JSSVGComponentTransferFunctionElementPrototype::s_info = { "SVGComponentTransferFunctionElementPrototype", 0, &JSSVGComponentTransferFunctionElementPrototypeTable, 0 };
 
-JSObject* JSSVGComponentTransferFunctionElementPrototype::self(ExecState* exec)
+JSObject* JSSVGComponentTransferFunctionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGComponentTransferFunctionElement>(exec);
+    return getDOMPrototype<JSSVGComponentTransferFunctionElement>(exec, globalObject);
 }
 
 bool JSSVGComponentTransferFunctionElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,9 +146,9 @@ JSSVGComponentTransferFunctionElement::JSSVGComponentTransferFunctionElement(Pas
 {
 }
 
-JSObject* JSSVGComponentTransferFunctionElement::createPrototype(ExecState* exec)
+JSObject* JSSVGComponentTransferFunctionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGComponentTransferFunctionElementPrototype(JSSVGComponentTransferFunctionElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGComponentTransferFunctionElementPrototype(JSSVGComponentTransferFunctionElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGComponentTransferFunctionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -156,92 +156,99 @@ bool JSSVGComponentTransferFunctionElement::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGComponentTransferFunctionElement, Base>(exec, &JSSVGComponentTransferFunctionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementTableValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementTableValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->tableValuesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSlope(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementSlope(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->slopeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementIntercept(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementIntercept(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->interceptAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementAmplitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementAmplitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->amplitudeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->exponentAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->offsetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGComponentTransferFunctionElement::getConstructor(ExecState* exec)
+JSValue JSSVGComponentTransferFunctionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGComponentTransferFunctionElementConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
@@ -249,4 +256,4 @@ JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAM
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
index dbcb93a83c..98f427e8dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
@@ -22,7 +22,7 @@
 #define JSSVGComponentTransferFunctionElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,27 +34,28 @@ class JSSVGComponentTransferFunctionElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGComponentTransferFunctionElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGComponentTransferFunctionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGComponentTransferFunctionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,25 +64,25 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementTableValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSlope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementIntercept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementAmplitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementTableValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSlope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementIntercept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementAmplitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
index ca283f064f..8a354563a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
@@ -41,7 +41,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGCursorElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGCursorElement);
 
 /* Hash table */
 
@@ -81,9 +81,9 @@ static const HashTable JSSVGCursorElementPrototypeTable =
 
 const ClassInfo JSSVGCursorElementPrototype::s_info = { "SVGCursorElementPrototype", 0, &JSSVGCursorElementPrototypeTable, 0 };
 
-JSObject* JSSVGCursorElementPrototype::self(ExecState* exec)
+JSObject* JSSVGCursorElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGCursorElement>(exec);
+    return getDOMPrototype<JSSVGCursorElement>(exec, globalObject);
 }
 
 bool JSSVGCursorElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +98,9 @@ JSSVGCursorElement::JSSVGCursorElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGCursorElement::createPrototype(ExecState* exec)
+JSObject* JSSVGCursorElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGCursorElementPrototype(JSSVGCursorElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGCursorElementPrototype(JSSVGCursorElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGCursorElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,62 +108,70 @@ bool JSSVGCursorElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGCursorElement, Base>(exec, &JSSVGCursorElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGCursorElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGCursorElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGCursorElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGCursorElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCursorElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCursorElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCursorElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCursorElement* castedThisObj = static_cast<JSSVGCursorElement*>(asObject(thisValue));
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
index a7de88f179..ff680ba825 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
@@ -34,12 +34,12 @@ class JSSVGCursorElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGCursorElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGCursorElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGCursorElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,16 +63,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGCursorElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCursorElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGCursorElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
index 90f6c49ccc..98981c18dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDefinitionSrcElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDefinitionSrcElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGDefinitionSrcElementPrototypeTable =
 
 const ClassInfo JSSVGDefinitionSrcElementPrototype::s_info = { "SVGDefinitionSrcElementPrototype", 0, &JSSVGDefinitionSrcElementPrototypeTable, 0 };
 
-JSObject* JSSVGDefinitionSrcElementPrototype::self(ExecState* exec)
+JSObject* JSSVGDefinitionSrcElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDefinitionSrcElement>(exec);
+    return getDOMPrototype<JSSVGDefinitionSrcElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGDefinitionSrcElement::s_info = { "SVGDefinitionSrcElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGDefinitionSrcElement::JSSVGDefinitionSrcElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSSVGDefinitionSrcElement::createPrototype(ExecState* exec)
+JSObject* JSSVGDefinitionSrcElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDefinitionSrcElementPrototype(JSSVGDefinitionSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGDefinitionSrcElementPrototype(JSSVGDefinitionSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h
index 8bb0f184ef..9c898867b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h
@@ -34,7 +34,7 @@ class JSSVGDefinitionSrcElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGDefinitionSrcElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDefinitionSrcElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGDefinitionSrcElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGDefinitionSrcElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
index 7331eda315..5cdeffc38c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
@@ -52,7 +52,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDefsElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDefsElement);
 
 /* Hash table */
 
@@ -101,9 +101,9 @@ static const HashTable JSSVGDefsElementPrototypeTable =
 
 const ClassInfo JSSVGDefsElementPrototype::s_info = { "SVGDefsElementPrototype", 0, &JSSVGDefsElementPrototypeTable, 0 };
 
-JSObject* JSSVGDefsElementPrototype::self(ExecState* exec)
+JSObject* JSSVGDefsElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDefsElement>(exec);
+    return getDOMPrototype<JSSVGDefsElement>(exec, globalObject);
 }
 
 bool JSSVGDefsElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,9 +118,9 @@ JSSVGDefsElement::JSSVGDefsElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGDefsElement::createPrototype(ExecState* exec)
+JSObject* JSSVGDefsElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDefsElementPrototype(JSSVGDefsElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGDefsElementPrototype(JSSVGDefsElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGDefsElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,165 +128,182 @@ bool JSSVGDefsElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGDefsElement, Base>(exec, &JSSVGDefsElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGDefsElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGDefsElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGDefsElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGDefsElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGDefsElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGDefsElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDefsElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDefsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGDefsElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDefsElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGDefsElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGDefsElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGDefsElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGDefsElement, Base>(exec, propertyName, value, &JSSVGDefsElementTable, this, slot);
 }
 
-void setJSSVGDefsElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDefsElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGDefsElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDefsElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
index 7468939126..0b4932cc35 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
@@ -34,13 +34,13 @@ class JSSVGDefsElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGDefsElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDefsElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGDefsElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,27 +64,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGDefsElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDefsElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDefsElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDefsElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDefsElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDefsElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDefsElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDefsElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDefsElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
index a2a609a4a4..80b5adf767 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDescElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDescElement);
 
 /* Hash table */
 
@@ -81,9 +81,9 @@ static const HashTable JSSVGDescElementPrototypeTable =
 
 const ClassInfo JSSVGDescElementPrototype::s_info = { "SVGDescElementPrototype", 0, &JSSVGDescElementPrototypeTable, 0 };
 
-JSObject* JSSVGDescElementPrototype::self(ExecState* exec)
+JSObject* JSSVGDescElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDescElement>(exec);
+    return getDOMPrototype<JSSVGDescElement>(exec, globalObject);
 }
 
 bool JSSVGDescElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +98,9 @@ JSSVGDescElement::JSSVGDescElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGDescElement::createPrototype(ExecState* exec)
+JSObject* JSSVGDescElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDescElementPrototype(JSSVGDescElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGDescElementPrototype(JSSVGDescElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGDescElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,58 +108,63 @@ bool JSSVGDescElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGDescElement, Base>(exec, &JSSVGDescElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGDescElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGDescElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGDescElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDescElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGDescElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGDescElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGDescElement, Base>(exec, propertyName, value, &JSSVGDescElementTable, this, slot);
 }
 
-void setJSSVGDescElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDescElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGDescElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDescElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGDescElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDescElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDescElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDescElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDescElement* castedThisObj = static_cast<JSSVGDescElement*>(asObject(thisValue));
     SVGDescElement* imp = static_cast<SVGDescElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
index 05335ffaa6..b89076ed3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
@@ -34,13 +34,13 @@ class JSSVGDescElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGDescElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDescElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGDescElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,15 +64,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGDescElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDescElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGDescElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDescElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDescElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDescElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDescElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDescElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDescElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDescElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDescElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDescElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDescElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDescElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
index e851b72480..47de2841f6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDocument)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDocument);
 
 /* Hash table */
 
@@ -74,9 +74,9 @@ static const HashTable JSSVGDocumentPrototypeTable =
 
 const ClassInfo JSSVGDocumentPrototype::s_info = { "SVGDocumentPrototype", 0, &JSSVGDocumentPrototypeTable, 0 };
 
-JSObject* JSSVGDocumentPrototype::self(ExecState* exec)
+JSObject* JSSVGDocumentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDocument>(exec);
+    return getDOMPrototype<JSSVGDocument>(exec, globalObject);
 }
 
 bool JSSVGDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,9 +91,9 @@ JSSVGDocument::JSSVGDocument(PassRefPtr<Structure> structure, PassRefPtr<SVGDocu
 {
 }
 
-JSObject* JSSVGDocument::createPrototype(ExecState* exec)
+JSObject* JSSVGDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDocumentPrototype(JSSVGDocumentPrototype::createStructure(JSDocumentPrototype::self(exec)));
+    return new (exec) JSSVGDocumentPrototype(JSSVGDocumentPrototype::createStructure(JSDocumentPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGDocument::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,23 +101,25 @@ bool JSSVGDocument::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGDocument, Base>(exec, &JSSVGDocumentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGDocumentRootElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDocumentRootElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDocument* imp = static_cast<SVGDocument*>(static_cast<JSSVGDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rootElement()));
 }
 
-JSValuePtr jsSVGDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDocument::s_info))
         return throwError(exec, TypeError);
     JSSVGDocument* castedThisObj = static_cast<JSSVGDocument*>(asObject(thisValue));
     SVGDocument* imp = static_cast<SVGDocument*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& eventType = args.at(exec, 0)->toString(exec);
+    const UString& eventType = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
index 11b1aee96d..e9541ddf2d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
@@ -34,12 +34,12 @@ class JSSVGDocument : public JSDocument {
     typedef JSDocument Base;
 public:
     JSSVGDocument(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDocument>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGDocumentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,10 +63,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGDocumentRootElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDocumentRootElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
index 158aee5ae2..94f7c2927a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGElement);
 
 /* Hash table */
 
@@ -76,9 +76,9 @@ static const HashTable JSSVGElementPrototypeTable =
 
 const ClassInfo JSSVGElementPrototype::s_info = { "SVGElementPrototype", 0, &JSSVGElementPrototypeTable, 0 };
 
-JSObject* JSSVGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGElement>(exec);
+    return getDOMPrototype<JSSVGElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGElement::s_info = { "SVGElement", &JSElement::s_info, &JSSVGElementTable, 0 };
@@ -88,9 +88,9 @@ JSSVGElement::JSSVGElement(PassRefPtr<Structure> structure, PassRefPtr<SVGElemen
 {
 }
 
-JSObject* JSSVGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGElementPrototype(JSSVGElementPrototype::createStructure(JSElementPrototype::self(exec)));
+    return new (exec) JSSVGElementPrototype(JSSVGElementPrototype::createStructure(JSElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,36 +98,40 @@ bool JSSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSSVGElement, Base>(exec, &JSSVGElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->id());
 }
 
-JSValuePtr jsSVGElementXmlbase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementXmlbase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlbase());
 }
 
-JSValuePtr jsSVGElementOwnerSVGElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementOwnerSVGElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerSVGElement()));
 }
 
-JSValuePtr jsSVGElementViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->viewportElement()));
 }
 
-void JSSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGElement, Base>(exec, propertyName, value, &JSSVGElementTable, this, slot);
 }
 
-void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -135,7 +139,7 @@ void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -143,9 +147,9 @@ void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValuePtr va
     setDOMException(exec, ec);
 }
 
-SVGElement* toSVGElement(JSC::JSValuePtr value)
+SVGElement* toSVGElement(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGElement::s_info) ? static_cast<JSSVGElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGElement::s_info) ? static_cast<JSSVGElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
index a8b5cf36fc..a06116e439 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
@@ -34,13 +34,13 @@ class JSSVGElement : public JSElement {
     typedef JSElement Base;
 public:
     JSSVGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -51,11 +51,12 @@ public:
     }
 };
 
-SVGElement* toSVGElement(JSC::JSValuePtr);
+SVGElement* toSVGElement(JSC::JSValue);
 
 class JSSVGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,12 +64,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementXmlbase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementXmlbase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementOwnerSVGElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementXmlbase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementXmlbase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementOwnerSVGElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
index 8c903fa753..2c8ad7dc87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
@@ -49,7 +49,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstance)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstance);
 
 /* Hash table */
 
@@ -132,9 +132,9 @@ static const HashTable JSSVGElementInstancePrototypeTable =
 
 const ClassInfo JSSVGElementInstancePrototype::s_info = { "SVGElementInstancePrototype", 0, &JSSVGElementInstancePrototypeTable, 0 };
 
-JSObject* JSSVGElementInstancePrototype::self(ExecState* exec)
+JSObject* JSSVGElementInstancePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGElementInstance>(exec);
+    return getDOMPrototype<JSSVGElementInstance>(exec, globalObject);
 }
 
 bool JSSVGElementInstancePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,12 +153,11 @@ JSSVGElementInstance::JSSVGElementInstance(PassRefPtr<Structure> structure, Pass
 JSSVGElementInstance::~JSSVGElementInstance()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGElementInstance::createPrototype(ExecState* exec)
+JSObject* JSSVGElementInstance::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGElementInstancePrototype(JSSVGElementInstancePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGElementInstancePrototype(JSSVGElementInstancePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGElementInstance::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -166,857 +165,944 @@ bool JSSVGElementInstance::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGElementInstance, Base>(exec, &JSSVGElementInstanceTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGElementInstanceCorrespondingElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceCorrespondingElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->correspondingElement()));
 }
 
-JSValuePtr jsSVGElementInstanceCorrespondingUseElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceCorrespondingUseElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->correspondingUseElement()));
 }
 
-JSValuePtr jsSVGElementInstanceParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentNode()));
 }
 
-JSValuePtr jsSVGElementInstanceChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->childNodes()));
 }
 
-JSValuePtr jsSVGElementInstanceFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->firstChild()));
 }
 
-JSValuePtr jsSVGElementInstanceLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastChild()));
 }
 
-JSValuePtr jsSVGElementInstancePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstancePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->previousSibling()));
 }
 
-JSValuePtr jsSVGElementInstanceNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nextSibling()));
 }
 
-JSValuePtr jsSVGElementInstanceOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onblur())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onblur()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onchange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncontextmenu())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncontextmenu()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondblclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondblclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onfocus())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onfocus()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oninput())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oninput()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeydown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeydown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeypress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeypress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeyup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeyup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousedown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousedown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousemove())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousemove()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseout())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseout()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousewheel())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousewheel()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onbeforecut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onbeforecopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforepaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onbeforepaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onpaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onpaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragenter())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragenter()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragleave())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragleave()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrop())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondrop()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrag())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondrag()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onreset())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onreset()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onresize())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onresize()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onscroll())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onscroll()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsearch())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onsearch()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselect())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onselect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselectstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onselectstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsubmit())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onsubmit()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-void JSSVGElementInstance::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGElementInstance::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGElementInstance, Base>(exec, propertyName, value, &JSSVGElementInstanceTable, this, slot);
 }
 
-void setJSSVGElementInstanceOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnabort(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnblur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnblur(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnchange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnchange(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOncontextmenu(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncontextmenu(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndblclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndblclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnfocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnfocus(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOninput(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOninput(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOninput(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnkeydown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnkeydown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnkeypress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnkeypress(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnkeyup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnkeyup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmousedown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmousedown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmousemove(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmousemove(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmouseout(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmouseout(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmouseover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmouseover(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmouseup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmouseup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmousewheel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmousewheel(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnbeforecut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnbeforecut(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOncut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncut(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncut(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnbeforecopy(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOncopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncopy(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnbeforepaste(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnpaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnpaste(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragenter(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragenter(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragover(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragleave(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragleave(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndrop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndrop(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragstart(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndrag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndrag(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragend(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnreset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnreset(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnresize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnresize(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnscroll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnscroll(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnsearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnsearch(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnselect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnselect(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnselectstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnselectstart(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnsubmit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnsubmit(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnunload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr jsSVGElementInstancePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstance::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsSVGElementInstancePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstance::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsSVGElementInstancePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstance::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* event = toEvent(args.at(exec, 0));
+    Event* event = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(event, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(event, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGElementInstance* object)
-{
-    return getDOMObjectWrapper<JSSVGElementInstance>(exec, object);
-}
-SVGElementInstance* toSVGElementInstance(JSC::JSValuePtr value)
+SVGElementInstance* toSVGElementInstance(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGElementInstance::s_info) ? static_cast<JSSVGElementInstance*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGElementInstance::s_info) ? static_cast<JSSVGElementInstance*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
index 27beed2234..f529a3978a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
@@ -37,39 +37,42 @@ class JSSVGElementInstance : public DOMObject {
 public:
     JSSVGElementInstance(PassRefPtr<JSC::Structure>, PassRefPtr<SVGElementInstance>);
     virtual ~JSSVGElementInstance();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    virtual void mark();
+
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
 
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     SVGElementInstance* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGElementInstance> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGElementInstance*);
-SVGElementInstance* toSVGElementInstance(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGElementInstance*);
+SVGElementInstance* toSVGElementInstance(JSC::JSValue);
 
 class JSSVGElementInstancePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -78,99 +81,99 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGElementInstancePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGElementInstancePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGElementInstancePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGElementInstanceCorrespondingElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceCorrespondingUseElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstancePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGElementInstanceCorrespondingElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceCorrespondingUseElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstancePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
index f5ece18cbe..bf0d240312 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstanceList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstanceList);
 
 /* Hash table */
 
@@ -73,9 +73,9 @@ static const HashTable JSSVGElementInstanceListPrototypeTable =
 
 const ClassInfo JSSVGElementInstanceListPrototype::s_info = { "SVGElementInstanceListPrototype", 0, &JSSVGElementInstanceListPrototypeTable, 0 };
 
-JSObject* JSSVGElementInstanceListPrototype::self(ExecState* exec)
+JSObject* JSSVGElementInstanceListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGElementInstanceList>(exec);
+    return getDOMPrototype<JSSVGElementInstanceList>(exec, globalObject);
 }
 
 bool JSSVGElementInstanceListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,12 +94,11 @@ JSSVGElementInstanceList::JSSVGElementInstanceList(PassRefPtr<Structure> structu
 JSSVGElementInstanceList::~JSSVGElementInstanceList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGElementInstanceList::createPrototype(ExecState* exec)
+JSObject* JSSVGElementInstanceList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGElementInstanceListPrototype(JSSVGElementInstanceListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGElementInstanceListPrototype(JSSVGElementInstanceListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGElementInstanceList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,32 +106,34 @@ bool JSSVGElementInstanceList::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGElementInstanceList, Base>(exec, &JSSVGElementInstanceListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGElementInstanceListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstanceList* imp = static_cast<SVGElementInstanceList*>(static_cast<JSSVGElementInstanceList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsSVGElementInstanceListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstanceListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstanceList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstanceList::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstanceList* castedThisObj = static_cast<JSSVGElementInstanceList*>(asObject(thisValue));
     SVGElementInstanceList* imp = static_cast<SVGElementInstanceList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGElementInstanceList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGElementInstanceList* object)
 {
     return getDOMObjectWrapper<JSSVGElementInstanceList>(exec, object);
 }
-SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValuePtr value)
+SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGElementInstanceList::s_info) ? static_cast<JSSVGElementInstanceList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGElementInstanceList::s_info) ? static_cast<JSSVGElementInstanceList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
index c14e0d7879..3f5365c628 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
@@ -37,12 +37,12 @@ class JSSVGElementInstanceList : public DOMObject {
 public:
     JSSVGElementInstanceList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGElementInstanceList>);
     virtual ~JSSVGElementInstanceList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,16 +53,17 @@ private:
     RefPtr<SVGElementInstanceList> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGElementInstanceList*);
-SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGElementInstanceList*);
+SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValue);
 
 class JSSVGElementInstanceListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -71,10 +72,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGElementInstanceListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstanceListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGElementInstanceListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
index a388fcbedd..657983330b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
@@ -44,29 +44,6 @@
 #include "JSSVGDefsElement.h"
 #include "JSSVGDescElement.h"
 #include "JSSVGEllipseElement.h"
-#include "JSSVGFEBlendElement.h"
-#include "JSSVGFEColorMatrixElement.h"
-#include "JSSVGFEComponentTransferElement.h"
-#include "JSSVGFECompositeElement.h"
-#include "JSSVGFEDiffuseLightingElement.h"
-#include "JSSVGFEDisplacementMapElement.h"
-#include "JSSVGFEDistantLightElement.h"
-#include "JSSVGFEFloodElement.h"
-#include "JSSVGFEFuncAElement.h"
-#include "JSSVGFEFuncBElement.h"
-#include "JSSVGFEFuncGElement.h"
-#include "JSSVGFEFuncRElement.h"
-#include "JSSVGFEGaussianBlurElement.h"
-#include "JSSVGFEImageElement.h"
-#include "JSSVGFEMergeElement.h"
-#include "JSSVGFEMergeNodeElement.h"
-#include "JSSVGFEOffsetElement.h"
-#include "JSSVGFEPointLightElement.h"
-#include "JSSVGFESpecularLightingElement.h"
-#include "JSSVGFESpotLightElement.h"
-#include "JSSVGFETileElement.h"
-#include "JSSVGFETurbulenceElement.h"
-#include "JSSVGFilterElement.h"
 #include "JSSVGFontElement.h"
 #include "JSSVGFontFaceElement.h"
 #include "JSSVGFontFaceFormatElement.h"
@@ -119,29 +96,6 @@
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
-#include "SVGFEBlendElement.h"
-#include "SVGFEColorMatrixElement.h"
-#include "SVGFEComponentTransferElement.h"
-#include "SVGFECompositeElement.h"
-#include "SVGFEDiffuseLightingElement.h"
-#include "SVGFEDisplacementMapElement.h"
-#include "SVGFEDistantLightElement.h"
-#include "SVGFEFloodElement.h"
-#include "SVGFEFuncAElement.h"
-#include "SVGFEFuncBElement.h"
-#include "SVGFEFuncGElement.h"
-#include "SVGFEFuncRElement.h"
-#include "SVGFEGaussianBlurElement.h"
-#include "SVGFEImageElement.h"
-#include "SVGFEMergeElement.h"
-#include "SVGFEMergeNodeElement.h"
-#include "SVGFEOffsetElement.h"
-#include "SVGFEPointLightElement.h"
-#include "SVGFESpecularLightingElement.h"
-#include "SVGFESpotLightElement.h"
-#include "SVGFETileElement.h"
-#include "SVGFETurbulenceElement.h"
-#include "SVGFilterElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
 #include "SVGFontFaceFormatElement.h"
@@ -251,121 +205,6 @@ static JSNode* createSVGEllipseElementWrapper(ExecState* exec, PassRefPtr<SVGEle
     return CREATE_DOM_NODE_WRAPPER(exec, SVGEllipseElement, element.get());
 }
 
-static JSNode* createSVGFEBlendElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEBlendElement, element.get());
-}
-
-static JSNode* createSVGFEColorMatrixElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEColorMatrixElement, element.get());
-}
-
-static JSNode* createSVGFEComponentTransferElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEComponentTransferElement, element.get());
-}
-
-static JSNode* createSVGFECompositeElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFECompositeElement, element.get());
-}
-
-static JSNode* createSVGFEDiffuseLightingElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEDiffuseLightingElement, element.get());
-}
-
-static JSNode* createSVGFEDisplacementMapElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEDisplacementMapElement, element.get());
-}
-
-static JSNode* createSVGFEDistantLightElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEDistantLightElement, element.get());
-}
-
-static JSNode* createSVGFEFloodElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFloodElement, element.get());
-}
-
-static JSNode* createSVGFEFuncAElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncAElement, element.get());
-}
-
-static JSNode* createSVGFEFuncBElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncBElement, element.get());
-}
-
-static JSNode* createSVGFEFuncGElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncGElement, element.get());
-}
-
-static JSNode* createSVGFEFuncRElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncRElement, element.get());
-}
-
-static JSNode* createSVGFEGaussianBlurElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEGaussianBlurElement, element.get());
-}
-
-static JSNode* createSVGFEImageElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEImageElement, element.get());
-}
-
-static JSNode* createSVGFEMergeElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEMergeElement, element.get());
-}
-
-static JSNode* createSVGFEMergeNodeElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEMergeNodeElement, element.get());
-}
-
-static JSNode* createSVGFEOffsetElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEOffsetElement, element.get());
-}
-
-static JSNode* createSVGFEPointLightElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEPointLightElement, element.get());
-}
-
-static JSNode* createSVGFESpecularLightingElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFESpecularLightingElement, element.get());
-}
-
-static JSNode* createSVGFESpotLightElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFESpotLightElement, element.get());
-}
-
-static JSNode* createSVGFETileElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFETileElement, element.get());
-}
-
-static JSNode* createSVGFETurbulenceElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFETurbulenceElement, element.get());
-}
-
-static JSNode* createSVGFilterElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFilterElement, element.get());
-}
-
 static JSNode* createSVGFontElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, SVGFontElement, element.get());
@@ -563,29 +402,6 @@ JSNode* createJSSVGWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
        map.set(defsTag.localName().impl(), createSVGDefsElementWrapper);
        map.set(descTag.localName().impl(), createSVGDescElementWrapper);
        map.set(ellipseTag.localName().impl(), createSVGEllipseElementWrapper);
-       map.set(feBlendTag.localName().impl(), createSVGFEBlendElementWrapper);
-       map.set(feColorMatrixTag.localName().impl(), createSVGFEColorMatrixElementWrapper);
-       map.set(feComponentTransferTag.localName().impl(), createSVGFEComponentTransferElementWrapper);
-       map.set(feCompositeTag.localName().impl(), createSVGFECompositeElementWrapper);
-       map.set(feDiffuseLightingTag.localName().impl(), createSVGFEDiffuseLightingElementWrapper);
-       map.set(feDisplacementMapTag.localName().impl(), createSVGFEDisplacementMapElementWrapper);
-       map.set(feDistantLightTag.localName().impl(), createSVGFEDistantLightElementWrapper);
-       map.set(feFloodTag.localName().impl(), createSVGFEFloodElementWrapper);
-       map.set(feFuncATag.localName().impl(), createSVGFEFuncAElementWrapper);
-       map.set(feFuncBTag.localName().impl(), createSVGFEFuncBElementWrapper);
-       map.set(feFuncGTag.localName().impl(), createSVGFEFuncGElementWrapper);
-       map.set(feFuncRTag.localName().impl(), createSVGFEFuncRElementWrapper);
-       map.set(feGaussianBlurTag.localName().impl(), createSVGFEGaussianBlurElementWrapper);
-       map.set(feImageTag.localName().impl(), createSVGFEImageElementWrapper);
-       map.set(feMergeTag.localName().impl(), createSVGFEMergeElementWrapper);
-       map.set(feMergeNodeTag.localName().impl(), createSVGFEMergeNodeElementWrapper);
-       map.set(feOffsetTag.localName().impl(), createSVGFEOffsetElementWrapper);
-       map.set(fePointLightTag.localName().impl(), createSVGFEPointLightElementWrapper);
-       map.set(feSpecularLightingTag.localName().impl(), createSVGFESpecularLightingElementWrapper);
-       map.set(feSpotLightTag.localName().impl(), createSVGFESpotLightElementWrapper);
-       map.set(feTileTag.localName().impl(), createSVGFETileElementWrapper);
-       map.set(feTurbulenceTag.localName().impl(), createSVGFETurbulenceElementWrapper);
-       map.set(filterTag.localName().impl(), createSVGFilterElementWrapper);
        map.set(fontTag.localName().impl(), createSVGFontElementWrapper);
        map.set(font_faceTag.localName().impl(), createSVGFontFaceElementWrapper);
        map.set(font_face_formatTag.localName().impl(), createSVGFontFaceFormatElementWrapper);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
index 94fd5a38c8..435db96563 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
@@ -53,7 +53,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGEllipseElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGEllipseElement);
 
 /* Hash table */
 
@@ -106,9 +106,9 @@ static const HashTable JSSVGEllipseElementPrototypeTable =
 
 const ClassInfo JSSVGEllipseElementPrototype::s_info = { "SVGEllipseElementPrototype", 0, &JSSVGEllipseElementPrototypeTable, 0 };
 
-JSObject* JSSVGEllipseElementPrototype::self(ExecState* exec)
+JSObject* JSSVGEllipseElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGEllipseElement>(exec);
+    return getDOMPrototype<JSSVGEllipseElement>(exec, globalObject);
 }
 
 bool JSSVGEllipseElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +123,9 @@ JSSVGEllipseElement::JSSVGEllipseElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGEllipseElement::createPrototype(ExecState* exec)
+JSObject* JSSVGEllipseElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGEllipseElementPrototype(JSSVGEllipseElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGEllipseElementPrototype(JSSVGEllipseElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGEllipseElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,193 +133,214 @@ bool JSSVGEllipseElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGEllipseElement, Base>(exec, &JSSVGEllipseElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGEllipseElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->ryAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGEllipseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGEllipseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGEllipseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGEllipseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGEllipseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGEllipseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGEllipseElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGEllipseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGEllipseElement, Base>(exec, propertyName, value, &JSSVGEllipseElementTable, this, slot);
 }
 
-void setJSSVGEllipseElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGEllipseElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGEllipseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGEllipseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
index 6533def069..7dd50fa029 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
@@ -34,13 +34,13 @@ class JSSVGEllipseElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGEllipseElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGEllipseElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGEllipseElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGEllipseElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGEllipseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGEllipseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGEllipseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGEllipseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGEllipseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGEllipseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGEllipseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGEllipseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
index 5b0980f525..a3eccbd27f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGException)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGException);
 
 /* Hash table */
 
@@ -81,13 +81,13 @@ public:
     JSSVGExceptionConstructor(ExecState* exec)
         : DOMObject(JSSVGExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +120,9 @@ static const HashTable JSSVGExceptionPrototypeTable =
 
 const ClassInfo JSSVGExceptionPrototype::s_info = { "SVGExceptionPrototype", 0, &JSSVGExceptionPrototypeTable, 0 };
 
-JSObject* JSSVGExceptionPrototype::self(ExecState* exec)
+JSObject* JSSVGExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGException>(exec);
+    return getDOMPrototype<JSSVGException>(exec, globalObject);
 }
 
 bool JSSVGExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,12 +142,11 @@ JSSVGException::JSSVGException(PassRefPtr<Structure> structure, PassRefPtr<SVGEx
 JSSVGException::~JSSVGException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGException::createPrototype(ExecState* exec)
+JSObject* JSSVGException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGExceptionPrototype(JSSVGExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGExceptionPrototype(JSSVGExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -155,69 +154,73 @@ bool JSSVGException::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGException, Base>(exec, &JSSVGExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(static_cast<JSSVGException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsSVGExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(static_cast<JSSVGException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsSVGExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(static_cast<JSSVGException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGException::getConstructor(ExecState* exec)
+JSValue JSSVGException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGExceptionConstructor>(exec);
 }
 
-JSValuePtr jsSVGExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGException::s_info))
         return throwError(exec, TypeError);
     JSSVGException* castedThisObj = static_cast<JSSVGException*>(asObject(thisValue));
     SVGException* imp = static_cast<SVGException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGExceptionSVG_WRONG_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGExceptionSVG_INVALID_VALUE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGException* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGException* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGException>(exec, object, context);
 }
-SVGException* toSVGException(JSC::JSValuePtr value)
+SVGException* toSVGException(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGException::s_info) ? static_cast<JSSVGException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGException::s_info) ? static_cast<JSSVGException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
index 02dfef7f61..374d2e6ac9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
@@ -37,17 +37,17 @@ class JSSVGException : public DOMObject {
 public:
     JSSVGException(PassRefPtr<JSC::Structure>, PassRefPtr<SVGException>, SVGElement* context);
     virtual ~JSSVGException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGException* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGException > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGException*, SVGElement* context);
-SVGException* toSVGException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGException*, SVGElement* context);
+SVGException* toSVGException(JSC::JSValue);
 
 class JSSVGExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,18 +75,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGExceptionSVG_WRONG_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionSVG_INVALID_VALUE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
index 0442457cea..fd3bc91291 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEBlendElement.h"
@@ -45,7 +45,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEBlendElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEBlendElement);
 
 /* Hash table */
 
@@ -97,13 +97,13 @@ public:
     JSSVGFEBlendElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFEBlendElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFEBlendElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFEBlendElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -139,9 +139,9 @@ static const HashTable JSSVGFEBlendElementPrototypeTable =
 
 const ClassInfo JSSVGFEBlendElementPrototype::s_info = { "SVGFEBlendElementPrototype", 0, &JSSVGFEBlendElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEBlendElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEBlendElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEBlendElement>(exec);
+    return getDOMPrototype<JSSVGFEBlendElement>(exec, globalObject);
 }
 
 bool JSSVGFEBlendElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -156,9 +156,9 @@ JSSVGFEBlendElement::JSSVGFEBlendElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEBlendElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEBlendElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEBlendElementPrototype(JSSVGFEBlendElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEBlendElementPrototype(JSSVGFEBlendElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEBlendElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -166,125 +166,136 @@ bool JSSVGFEBlendElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEBlendElement, Base>(exec, &JSSVGFEBlendElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEBlendElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->modeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEBlendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFEBlendElement::getConstructor(ExecState* exec)
+JSValue JSSVGFEBlendElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFEBlendElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEBlendElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEBlendElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEBlendElement* castedThisObj = static_cast<JSSVGFEBlendElement*>(asObject(thisValue));
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
@@ -292,4 +303,4 @@ JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, const Id
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
index cf5956a301..a817f303a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEBlendElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,27 +34,28 @@ class JSSVGFEBlendElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEBlendElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEBlendElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEBlendElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEBlendElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
index 92c28c92bc..12af6e8e71 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEColorMatrixElement.h"
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEColorMatrixElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEColorMatrixElement);
 
 /* Hash table */
 
@@ -97,13 +97,13 @@ public:
     JSSVGFEColorMatrixElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFEColorMatrixElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFEColorMatrixElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFEColorMatrixElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -138,9 +138,9 @@ static const HashTable JSSVGFEColorMatrixElementPrototypeTable =
 
 const ClassInfo JSSVGFEColorMatrixElementPrototype::s_info = { "SVGFEColorMatrixElementPrototype", 0, &JSSVGFEColorMatrixElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEColorMatrixElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEColorMatrixElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEColorMatrixElement>(exec);
+    return getDOMPrototype<JSSVGFEColorMatrixElement>(exec, globalObject);
 }
 
 bool JSSVGFEColorMatrixElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -155,9 +155,9 @@ JSSVGFEColorMatrixElement::JSSVGFEColorMatrixElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSSVGFEColorMatrixElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEColorMatrixElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEColorMatrixElementPrototype(JSSVGFEColorMatrixElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEColorMatrixElementPrototype(JSSVGFEColorMatrixElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEColorMatrixElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,120 +165,131 @@ bool JSSVGFEColorMatrixElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGFEColorMatrixElement, Base>(exec, &JSSVGFEColorMatrixElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->valuesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFEColorMatrixElement::getConstructor(ExecState* exec)
+JSValue JSSVGFEColorMatrixElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFEColorMatrixElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEColorMatrixElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEColorMatrixElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEColorMatrixElement* castedThisObj = static_cast<JSSVGFEColorMatrixElement*>(asObject(thisValue));
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
@@ -286,4 +297,4 @@ JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(Exec
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
index ff20cd0c6c..29dcd58915 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEColorMatrixElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,27 +34,28 @@ class JSSVGFEColorMatrixElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEColorMatrixElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEColorMatrixElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEColorMatrixElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,30 +64,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEColorMatrixElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
index 14099ec7e1..bbb07e7234 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEComponentTransferElement.h"
@@ -43,7 +43,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEComponentTransferElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEComponentTransferElement);
 
 /* Hash table */
 
@@ -84,9 +84,9 @@ static const HashTable JSSVGFEComponentTransferElementPrototypeTable =
 
 const ClassInfo JSSVGFEComponentTransferElementPrototype::s_info = { "SVGFEComponentTransferElementPrototype", 0, &JSSVGFEComponentTransferElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEComponentTransferElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEComponentTransferElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEComponentTransferElement>(exec);
+    return getDOMPrototype<JSSVGFEComponentTransferElement>(exec, globalObject);
 }
 
 bool JSSVGFEComponentTransferElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,9 +101,9 @@ JSSVGFEComponentTransferElement::JSSVGFEComponentTransferElement(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGFEComponentTransferElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEComponentTransferElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEComponentTransferElementPrototype(JSSVGFEComponentTransferElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEComponentTransferElementPrototype(JSSVGFEComponentTransferElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEComponentTransferElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -111,75 +111,84 @@ bool JSSVGFEComponentTransferElement::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGFEComponentTransferElement, Base>(exec, &JSSVGFEComponentTransferElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEComponentTransferElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEComponentTransferElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEComponentTransferElement* castedThisObj = static_cast<JSSVGFEComponentTransferElement*>(asObject(thisValue));
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
index 1638af4237..ba98d4198f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEComponentTransferElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEComponentTransferElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEComponentTransferElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEComponentTransferElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEComponentTransferElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,20 +63,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEComponentTransferElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
index 88f42e6a76..3a05a50d08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFECompositeElement.h"
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFECompositeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFECompositeElement);
 
 /* Hash table */
 
@@ -103,13 +103,13 @@ public:
     JSSVGFECompositeElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFECompositeElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFECompositeElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFECompositeElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -146,9 +146,9 @@ static const HashTable JSSVGFECompositeElementPrototypeTable =
 
 const ClassInfo JSSVGFECompositeElementPrototype::s_info = { "SVGFECompositeElementPrototype", 0, &JSSVGFECompositeElementPrototypeTable, 0 };
 
-JSObject* JSSVGFECompositeElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFECompositeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFECompositeElement>(exec);
+    return getDOMPrototype<JSSVGFECompositeElement>(exec, globalObject);
 }
 
 bool JSSVGFECompositeElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -163,9 +163,9 @@ JSSVGFECompositeElement::JSSVGFECompositeElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFECompositeElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFECompositeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFECompositeElementPrototype(JSSVGFECompositeElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFECompositeElementPrototype(JSSVGFECompositeElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFECompositeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -173,158 +173,173 @@ bool JSSVGFECompositeElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFECompositeElement, Base>(exec, &JSSVGFECompositeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFECompositeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElement_operator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElement_operator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->_operatorAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK3(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k3Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK4(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k4Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFECompositeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFECompositeElement::getConstructor(ExecState* exec)
+JSValue JSSVGFECompositeElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFECompositeElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFECompositeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFECompositeElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFECompositeElement* castedThisObj = static_cast<JSSVGFECompositeElement*>(asObject(thisValue));
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
@@ -332,4 +347,4 @@ JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState*
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
index 8da510c0a4..5d267b7bcb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFECompositeElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,27 +34,28 @@ class JSSVGFECompositeElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFECompositeElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFECompositeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFECompositeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,36 +64,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFECompositeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElement_operator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElement_operator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
index 769ab7815d..d049fa1e13 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEDiffuseLightingElement.h"
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDiffuseLightingElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDiffuseLightingElement);
 
 /* Hash table */
 
@@ -89,9 +89,9 @@ static const HashTable JSSVGFEDiffuseLightingElementPrototypeTable =
 
 const ClassInfo JSSVGFEDiffuseLightingElementPrototype::s_info = { "SVGFEDiffuseLightingElementPrototype", 0, &JSSVGFEDiffuseLightingElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEDiffuseLightingElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEDiffuseLightingElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEDiffuseLightingElement>(exec);
+    return getDOMPrototype<JSSVGFEDiffuseLightingElement>(exec, globalObject);
 }
 
 bool JSSVGFEDiffuseLightingElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -106,9 +106,9 @@ JSSVGFEDiffuseLightingElement::JSSVGFEDiffuseLightingElement(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGFEDiffuseLightingElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEDiffuseLightingElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEDiffuseLightingElementPrototype(JSSVGFEDiffuseLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEDiffuseLightingElementPrototype(JSSVGFEDiffuseLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEDiffuseLightingElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -116,103 +116,116 @@ bool JSSVGFEDiffuseLightingElement::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGFEDiffuseLightingElement, Base>(exec, &JSSVGFEDiffuseLightingElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->surfaceScaleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementDiffuseConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->diffuseConstantAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->kernelUnitLengthXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->kernelUnitLengthYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEDiffuseLightingElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEDiffuseLightingElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEDiffuseLightingElement* castedThisObj = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(thisValue));
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
index cd89cfc761..2368f2534f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEDiffuseLightingElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEDiffuseLightingElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEDiffuseLightingElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEDiffuseLightingElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEDiffuseLightingElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,24 +63,24 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementDiffuseConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
index 671d53dab6..74b64339a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEDisplacementMapElement.h"
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDisplacementMapElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDisplacementMapElement);
 
 /* Hash table */
 
@@ -99,13 +99,13 @@ public:
     JSSVGFEDisplacementMapElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFEDisplacementMapElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFEDisplacementMapElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFEDisplacementMapElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -140,9 +140,9 @@ static const HashTable JSSVGFEDisplacementMapElementPrototypeTable =
 
 const ClassInfo JSSVGFEDisplacementMapElementPrototype::s_info = { "SVGFEDisplacementMapElementPrototype", 0, &JSSVGFEDisplacementMapElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEDisplacementMapElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEDisplacementMapElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEDisplacementMapElement>(exec);
+    return getDOMPrototype<JSSVGFEDisplacementMapElement>(exec, globalObject);
 }
 
 bool JSSVGFEDisplacementMapElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -157,9 +157,9 @@ JSSVGFEDisplacementMapElement::JSSVGFEDisplacementMapElement(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGFEDisplacementMapElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEDisplacementMapElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEDisplacementMapElementPrototype(JSSVGFEDisplacementMapElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEDisplacementMapElementPrototype(JSSVGFEDisplacementMapElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEDisplacementMapElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -167,134 +167,147 @@ bool JSSVGFEDisplacementMapElement::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGFEDisplacementMapElement, Base>(exec, &JSSVGFEDisplacementMapElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->scaleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementXChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementXChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->xChannelSelectorAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementYChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementYChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->yChannelSelectorAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFEDisplacementMapElement::getConstructor(ExecState* exec)
+JSValue JSSVGFEDisplacementMapElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFEDisplacementMapElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEDisplacementMapElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEDisplacementMapElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEDisplacementMapElement* castedThisObj = static_cast<JSSVGFEDisplacementMapElement*>(asObject(thisValue));
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_R(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_G(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_B(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
@@ -302,4 +315,4 @@ JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, const Ide
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
index 88f5f32e58..0ee127044d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEDisplacementMapElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,27 +34,28 @@ class JSSVGFEDisplacementMapElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEDisplacementMapElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEDisplacementMapElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEDisplacementMapElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,32 +64,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEDisplacementMapElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementXChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementYChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementXChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementYChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_R(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_G(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_B(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_A(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
index be849e0211..95092e46bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEDistantLightElement.h"
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDistantLightElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDistantLightElement);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGFEDistantLightElementPrototypeTable =
 
 const ClassInfo JSSVGFEDistantLightElementPrototype::s_info = { "SVGFEDistantLightElementPrototype", 0, &JSSVGFEDistantLightElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEDistantLightElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEDistantLightElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEDistantLightElement>(exec);
+    return getDOMPrototype<JSSVGFEDistantLightElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEDistantLightElement::s_info = { "SVGFEDistantLightElement", &JSSVGElement::s_info, &JSSVGFEDistantLightElementTable, 0 };
@@ -82,9 +82,9 @@ JSSVGFEDistantLightElement::JSSVGFEDistantLightElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGFEDistantLightElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEDistantLightElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEDistantLightElementPrototype(JSSVGFEDistantLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEDistantLightElementPrototype(JSSVGFEDistantLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEDistantLightElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,15 +92,17 @@ bool JSSVGFEDistantLightElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGFEDistantLightElement, Base>(exec, &JSSVGFEDistantLightElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEDistantLightElementAzimuth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDistantLightElementAzimuth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDistantLightElement* imp = static_cast<SVGFEDistantLightElement*>(static_cast<JSSVGFEDistantLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->azimuthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDistantLightElementElevation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDistantLightElementElevation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDistantLightElement* imp = static_cast<SVGFEDistantLightElement*>(static_cast<JSSVGFEDistantLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->elevationAnimated();
     return toJS(exec, obj.get(), imp);
@@ -109,4 +111,4 @@ JSValuePtr jsSVGFEDistantLightElementElevation(ExecState* exec, const Identifier
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
index 201f90528c..4e798c8681 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEDistantLightElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEDistantLightElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEDistantLightElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEDistantLightElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFEDistantLightElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEDistantLightElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFEDistantLightElementAzimuth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDistantLightElementElevation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDistantLightElementAzimuth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDistantLightElementElevation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
index 2d1a049920..52461a651e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEFloodElement.h"
@@ -38,17 +38,19 @@
 #include "SVGFEFloodElement.h"
 
 #include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFloodElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFloodElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEFloodElementTableValues[8] =
+static const HashTableValue JSSVGFEFloodElementTableValues[10] =
 {
+    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementIn1, (intptr_t)0 },
     { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementX, (intptr_t)0 },
     { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementY, (intptr_t)0 },
     { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementWidth, (intptr_t)0 },
@@ -56,6 +58,7 @@ static const HashTableValue JSSVGFEFloodElementTableValues[8] =
     { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementResult, (intptr_t)0 },
     { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementClassName, (intptr_t)0 },
     { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementStyle, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEFloodElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -63,9 +66,47 @@ static const HashTable JSSVGFEFloodElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFEFloodElementTableValues, 0 };
 #else
-    { 17, 15, JSSVGFEFloodElementTableValues, 0 };
+    { 34, 31, JSSVGFEFloodElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEFloodElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSSVGFEFloodElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFloodElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEFloodElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEFloodElementConstructor : public DOMObject {
+public:
+    JSSVGFEFloodElementConstructor(ExecState* exec)
+        : DOMObject(JSSVGFEFloodElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEFloodElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSSVGFEFloodElementConstructor::s_info = { "SVGFEFloodElementConstructor", 0, &JSSVGFEFloodElementConstructorTable, 0 };
+
+bool JSSVGFEFloodElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFloodElementConstructor, DOMObject>(exec, &JSSVGFEFloodElementConstructorTable, this, propertyName, slot);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEFloodElementPrototypeTableValues[2] =
@@ -83,9 +124,9 @@ static const HashTable JSSVGFEFloodElementPrototypeTable =
 
 const ClassInfo JSSVGFEFloodElementPrototype::s_info = { "SVGFEFloodElementPrototype", 0, &JSSVGFEFloodElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFloodElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFloodElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFloodElement>(exec);
+    return getDOMPrototype<JSSVGFEFloodElement>(exec, globalObject);
 }
 
 bool JSSVGFEFloodElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,9 +141,9 @@ JSSVGFEFloodElement::JSSVGFEFloodElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFloodElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFloodElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFloodElementPrototype(JSSVGFEFloodElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFloodElementPrototype(JSSVGFEFloodElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEFloodElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,68 +151,93 @@ bool JSSVGFEFloodElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEFloodElement, Base>(exec, &JSSVGFEFloodElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEFloodElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
+    RefPtr<SVGAnimatedString> obj = imp->in1Animated();
+    return toJS(exec, obj.get(), imp);
+}
+
+JSValue jsSVGFEFloodElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue jsSVGFEFloodElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+JSValue JSSVGFEFloodElement::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSSVGFEFloodElementConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEFloodElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEFloodElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEFloodElement* castedThisObj = static_cast<JSSVGFEFloodElement*>(asObject(thisValue));
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
index 0423a2c886..ad0a9ea55f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEFloodElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,26 +34,28 @@ class JSSVGFEFloodElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEFloodElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFloodElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEFloodElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,19 +64,21 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEFloodElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
index 90e4497789..cf954122a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEFuncAElement.h"
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncAElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncAElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFEFuncAElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncAElementPrototype::s_info = { "SVGFEFuncAElementPrototype", 0, &JSSVGFEFuncAElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncAElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncAElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncAElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncAElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncAElement::s_info = { "SVGFEFuncAElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +65,12 @@ JSSVGFEFuncAElement::JSSVGFEFuncAElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncAElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncAElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncAElementPrototype(JSSVGFEFuncAElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncAElementPrototype(JSSVGFEFuncAElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
index 6389f343a2..a072d4fd38 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEFuncAElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncAElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncAElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncAElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncAElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncAElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
index 81926d6ae3..c5a6dd7fae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEFuncBElement.h"
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncBElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncBElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFEFuncBElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncBElementPrototype::s_info = { "SVGFEFuncBElementPrototype", 0, &JSSVGFEFuncBElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncBElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncBElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncBElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncBElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncBElement::s_info = { "SVGFEFuncBElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +65,12 @@ JSSVGFEFuncBElement::JSSVGFEFuncBElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncBElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncBElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncBElementPrototype(JSSVGFEFuncBElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncBElementPrototype(JSSVGFEFuncBElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
index 165a18846d..70cbb224f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEFuncBElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncBElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncBElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncBElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncBElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncBElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
index 539e342776..b55cfea78c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEFuncGElement.h"
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncGElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFEFuncGElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncGElementPrototype::s_info = { "SVGFEFuncGElementPrototype", 0, &JSSVGFEFuncGElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncGElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncGElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncGElement::s_info = { "SVGFEFuncGElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +65,12 @@ JSSVGFEFuncGElement::JSSVGFEFuncGElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncGElementPrototype(JSSVGFEFuncGElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncGElementPrototype(JSSVGFEFuncGElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
index aafeab6ed9..77c584f386 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEFuncGElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncGElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncGElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
index 96d91884f5..c2e89941d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEFuncRElement.h"
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncRElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncRElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFEFuncRElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncRElementPrototype::s_info = { "SVGFEFuncRElementPrototype", 0, &JSSVGFEFuncRElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncRElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncRElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncRElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncRElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncRElement::s_info = { "SVGFEFuncRElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +65,12 @@ JSSVGFEFuncRElement::JSSVGFEFuncRElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncRElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncRElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncRElementPrototype(JSSVGFEFuncRElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncRElementPrototype(JSSVGFEFuncRElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
index 03e176d150..57eb1675c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEFuncRElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncRElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncRElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncRElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncRElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncRElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
index 3640b996db..edd91eddb8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEGaussianBlurElement.h"
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEGaussianBlurElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEGaussianBlurElement);
 
 /* Hash table */
 
@@ -88,9 +88,9 @@ static const HashTable JSSVGFEGaussianBlurElementPrototypeTable =
 
 const ClassInfo JSSVGFEGaussianBlurElementPrototype::s_info = { "SVGFEGaussianBlurElementPrototype", 0, &JSSVGFEGaussianBlurElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEGaussianBlurElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEGaussianBlurElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEGaussianBlurElement>(exec);
+    return getDOMPrototype<JSSVGFEGaussianBlurElement>(exec, globalObject);
 }
 
 bool JSSVGFEGaussianBlurElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -105,9 +105,9 @@ JSSVGFEGaussianBlurElement::JSSVGFEGaussianBlurElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGFEGaussianBlurElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEGaussianBlurElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEGaussianBlurElementPrototype(JSSVGFEGaussianBlurElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEGaussianBlurElementPrototype(JSSVGFEGaussianBlurElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEGaussianBlurElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -115,102 +115,114 @@ bool JSSVGFEGaussianBlurElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGFEGaussianBlurElement, Base>(exec, &JSSVGFEGaussianBlurElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementStdDeviationX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStdDeviationX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->stdDeviationXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementStdDeviationY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStdDeviationY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->stdDeviationYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEGaussianBlurElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEGaussianBlurElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEGaussianBlurElement* castedThisObj = static_cast<JSSVGFEGaussianBlurElement*>(asObject(thisValue));
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThisObj->impl());
-    float stdDeviationX = args.at(exec, 0)->toFloat(exec);
-    float stdDeviationY = args.at(exec, 1)->toFloat(exec);
+    float stdDeviationX = args.at(0).toFloat(exec);
+    float stdDeviationY = args.at(1).toFloat(exec);
 
     imp->setStdDeviation(stdDeviationX, stdDeviationY);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEGaussianBlurElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEGaussianBlurElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEGaussianBlurElement* castedThisObj = static_cast<JSSVGFEGaussianBlurElement*>(asObject(thisValue));
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
index 4452f50f2f..f62c21b9e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEGaussianBlurElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEGaussianBlurElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEGaussianBlurElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEGaussianBlurElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEGaussianBlurElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,23 +63,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEGaussianBlurElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementStdDeviationX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementStdDeviationY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
index 0aa0bdd0bc..bd20a4c25e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEImageElement.h"
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEImageElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEImageElement);
 
 /* Hash table */
 
@@ -90,9 +90,9 @@ static const HashTable JSSVGFEImageElementPrototypeTable =
 
 const ClassInfo JSSVGFEImageElementPrototype::s_info = { "SVGFEImageElementPrototype", 0, &JSSVGFEImageElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEImageElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEImageElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEImageElement>(exec);
+    return getDOMPrototype<JSSVGFEImageElement>(exec, globalObject);
 }
 
 bool JSSVGFEImageElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,9 +107,9 @@ JSSVGFEImageElement::JSSVGFEImageElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEImageElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEImageElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEImageElementPrototype(JSSVGFEImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEImageElementPrototype(JSSVGFEImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -117,111 +117,123 @@ bool JSSVGFEImageElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEImageElement, Base>(exec, &JSSVGFEImageElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGFEImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGFEImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGFEImageElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGFEImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGFEImageElement, Base>(exec, propertyName, value, &JSSVGFEImageElementTable, this, slot);
 }
 
-void setJSSVGFEImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFEImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGFEImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFEImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEImageElement* castedThisObj = static_cast<JSSVGFEImageElement*>(asObject(thisValue));
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
index 2fa8c61772..440aee8446 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEImageElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,13 +34,13 @@ class JSSVGFEImageElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEImageElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEImageElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGFEImageElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,25 +64,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFEImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFEImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFEImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFEImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFEImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFEImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFEImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFEImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
index 4a5d839d25..016f6cbc21 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEMergeElement.h"
@@ -43,7 +43,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeElement);
 
 /* Hash table */
 
@@ -83,9 +83,9 @@ static const HashTable JSSVGFEMergeElementPrototypeTable =
 
 const ClassInfo JSSVGFEMergeElementPrototype::s_info = { "SVGFEMergeElementPrototype", 0, &JSSVGFEMergeElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEMergeElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEMergeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEMergeElement>(exec);
+    return getDOMPrototype<JSSVGFEMergeElement>(exec, globalObject);
 }
 
 bool JSSVGFEMergeElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,9 +100,9 @@ JSSVGFEMergeElement::JSSVGFEMergeElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEMergeElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEMergeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEMergeElementPrototype(JSSVGFEMergeElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEMergeElementPrototype(JSSVGFEMergeElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEMergeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,68 +110,76 @@ bool JSSVGFEMergeElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEMergeElement, Base>(exec, &JSSVGFEMergeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEMergeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEMergeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEMergeElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEMergeElement* castedThisObj = static_cast<JSSVGFEMergeElement*>(asObject(thisValue));
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
index ffd28c6013..af4517ef69 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEMergeElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEMergeElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEMergeElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEMergeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEMergeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,19 +63,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEMergeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
index 6ea174225e..14aa4934c6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEMergeNodeElement.h"
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeNodeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeNodeElement);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGFEMergeNodeElementPrototypeTable =
 
 const ClassInfo JSSVGFEMergeNodeElementPrototype::s_info = { "SVGFEMergeNodeElementPrototype", 0, &JSSVGFEMergeNodeElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEMergeNodeElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEMergeNodeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEMergeNodeElement>(exec);
+    return getDOMPrototype<JSSVGFEMergeNodeElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEMergeNodeElement::s_info = { "SVGFEMergeNodeElement", &JSSVGElement::s_info, &JSSVGFEMergeNodeElementTable, 0 };
@@ -81,9 +81,9 @@ JSSVGFEMergeNodeElement::JSSVGFEMergeNodeElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFEMergeNodeElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEMergeNodeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEMergeNodeElementPrototype(JSSVGFEMergeNodeElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEMergeNodeElementPrototype(JSSVGFEMergeNodeElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEMergeNodeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,8 +91,9 @@ bool JSSVGFEMergeNodeElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFEMergeNodeElement, Base>(exec, &JSSVGFEMergeNodeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeNodeElement* imp = static_cast<SVGFEMergeNodeElement*>(static_cast<JSSVGFEMergeNodeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
@@ -101,4 +102,4 @@ JSValuePtr jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
index 6ffab92f84..069b2d0cca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEMergeNodeElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEMergeNodeElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEMergeNodeElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEMergeNodeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFEMergeNodeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEMergeNodeElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,10 +58,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFEMergeNodeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeNodeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
index 8582bcb051..3847b48ff9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEOffsetElement.h"
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEOffsetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEOffsetElement);
 
 /* Hash table */
 
@@ -87,9 +87,9 @@ static const HashTable JSSVGFEOffsetElementPrototypeTable =
 
 const ClassInfo JSSVGFEOffsetElementPrototype::s_info = { "SVGFEOffsetElementPrototype", 0, &JSSVGFEOffsetElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEOffsetElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEOffsetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEOffsetElement>(exec);
+    return getDOMPrototype<JSSVGFEOffsetElement>(exec, globalObject);
 }
 
 bool JSSVGFEOffsetElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,9 +104,9 @@ JSSVGFEOffsetElement::JSSVGFEOffsetElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGFEOffsetElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEOffsetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEOffsetElementPrototype(JSSVGFEOffsetElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEOffsetElementPrototype(JSSVGFEOffsetElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEOffsetElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,89 +114,100 @@ bool JSSVGFEOffsetElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEOffsetElement, Base>(exec, &JSSVGFEOffsetElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEOffsetElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->dxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->dyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEOffsetElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEOffsetElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEOffsetElement* castedThisObj = static_cast<JSSVGFEOffsetElement*>(asObject(thisValue));
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
index 32c7af696a..b708b6e39a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEOffsetElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEOffsetElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEOffsetElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEOffsetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEOffsetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,22 +63,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEOffsetElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
index b9945afe43..d4ee84a92d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFEPointLightElement.h"
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEPointLightElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEPointLightElement);
 
 /* Hash table */
 
@@ -71,9 +71,9 @@ static const HashTable JSSVGFEPointLightElementPrototypeTable =
 
 const ClassInfo JSSVGFEPointLightElementPrototype::s_info = { "SVGFEPointLightElementPrototype", 0, &JSSVGFEPointLightElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEPointLightElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEPointLightElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEPointLightElement>(exec);
+    return getDOMPrototype<JSSVGFEPointLightElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEPointLightElement::s_info = { "SVGFEPointLightElement", &JSSVGElement::s_info, &JSSVGFEPointLightElementTable, 0 };
@@ -83,9 +83,9 @@ JSSVGFEPointLightElement::JSSVGFEPointLightElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGFEPointLightElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEPointLightElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEPointLightElementPrototype(JSSVGFEPointLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEPointLightElementPrototype(JSSVGFEPointLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEPointLightElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -93,22 +93,25 @@ bool JSSVGFEPointLightElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGFEPointLightElement, Base>(exec, &JSSVGFEPointLightElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEPointLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEPointLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEPointLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->zAnimated();
     return toJS(exec, obj.get(), imp);
@@ -117,4 +120,4 @@ JSValuePtr jsSVGFEPointLightElementZ(ExecState* exec, const Identifier&, const P
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
index b2fd6acd5d..50d628b5a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFEPointLightElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFEPointLightElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEPointLightElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEPointLightElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFEPointLightElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEPointLightElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,12 +58,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFEPointLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEPointLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEPointLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEPointLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEPointLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEPointLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
index 65c50af974..a1962e5464 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFESpecularLightingElement.h"
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpecularLightingElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpecularLightingElement);
 
 /* Hash table */
 
@@ -88,9 +88,9 @@ static const HashTable JSSVGFESpecularLightingElementPrototypeTable =
 
 const ClassInfo JSSVGFESpecularLightingElementPrototype::s_info = { "SVGFESpecularLightingElementPrototype", 0, &JSSVGFESpecularLightingElementPrototypeTable, 0 };
 
-JSObject* JSSVGFESpecularLightingElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFESpecularLightingElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFESpecularLightingElement>(exec);
+    return getDOMPrototype<JSSVGFESpecularLightingElement>(exec, globalObject);
 }
 
 bool JSSVGFESpecularLightingElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -105,9 +105,9 @@ JSSVGFESpecularLightingElement::JSSVGFESpecularLightingElement(PassRefPtr<Struct
 {
 }
 
-JSObject* JSSVGFESpecularLightingElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFESpecularLightingElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFESpecularLightingElementPrototype(JSSVGFESpecularLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFESpecularLightingElementPrototype(JSSVGFESpecularLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFESpecularLightingElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -115,96 +115,108 @@ bool JSSVGFESpecularLightingElement::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSSVGFESpecularLightingElement, Base>(exec, &JSSVGFESpecularLightingElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->surfaceScaleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementSpecularConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSpecularConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularConstantAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularExponentAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFESpecularLightingElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFESpecularLightingElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFESpecularLightingElement* castedThisObj = static_cast<JSSVGFESpecularLightingElement*>(asObject(thisValue));
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
index fba28319ea..0ba74f552b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFESpecularLightingElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFESpecularLightingElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFESpecularLightingElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFESpecularLightingElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFESpecularLightingElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,23 +63,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFESpecularLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementSpecularConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementSpecularConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
index cf23d956a3..f8f1c77c36 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFESpotLightElement.h"
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpotLightElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpotLightElement);
 
 /* Hash table */
 
@@ -76,9 +76,9 @@ static const HashTable JSSVGFESpotLightElementPrototypeTable =
 
 const ClassInfo JSSVGFESpotLightElementPrototype::s_info = { "SVGFESpotLightElementPrototype", 0, &JSSVGFESpotLightElementPrototypeTable, 0 };
 
-JSObject* JSSVGFESpotLightElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFESpotLightElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFESpotLightElement>(exec);
+    return getDOMPrototype<JSSVGFESpotLightElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFESpotLightElement::s_info = { "SVGFESpotLightElement", &JSSVGElement::s_info, &JSSVGFESpotLightElementTable, 0 };
@@ -88,9 +88,9 @@ JSSVGFESpotLightElement::JSSVGFESpotLightElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFESpotLightElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFESpotLightElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFESpotLightElementPrototype(JSSVGFESpotLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFESpotLightElementPrototype(JSSVGFESpotLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFESpotLightElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,57 +98,65 @@ bool JSSVGFESpotLightElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFESpotLightElement, Base>(exec, &JSSVGFESpotLightElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFESpotLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->zAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementPointsAtX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementPointsAtY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementPointsAtZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtZAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularExponentAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->limitingConeAngleAnimated();
     return toJS(exec, obj.get(), imp);
@@ -157,4 +165,4 @@ JSValuePtr jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, const Ident
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
index a4fd1c79b3..77fb6d5467 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFESpotLightElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFESpotLightElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFESpotLightElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFESpotLightElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFESpotLightElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFESpotLightElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,17 +58,17 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFESpotLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementPointsAtX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementPointsAtY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementPointsAtZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementLimitingConeAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementLimitingConeAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
index 7f0c248ef9..4365666253 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFETileElement.h"
@@ -43,7 +43,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFETileElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFETileElement);
 
 /* Hash table */
 
@@ -84,9 +84,9 @@ static const HashTable JSSVGFETileElementPrototypeTable =
 
 const ClassInfo JSSVGFETileElementPrototype::s_info = { "SVGFETileElementPrototype", 0, &JSSVGFETileElementPrototypeTable, 0 };
 
-JSObject* JSSVGFETileElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFETileElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFETileElement>(exec);
+    return getDOMPrototype<JSSVGFETileElement>(exec, globalObject);
 }
 
 bool JSSVGFETileElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,9 +101,9 @@ JSSVGFETileElement::JSSVGFETileElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGFETileElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFETileElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFETileElementPrototype(JSSVGFETileElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFETileElementPrototype(JSSVGFETileElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFETileElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -111,75 +111,84 @@ bool JSSVGFETileElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGFETileElement, Base>(exec, &JSSVGFETileElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFETileElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFETileElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFETileElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFETileElement* castedThisObj = static_cast<JSSVGFETileElement*>(asObject(thisValue));
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
index 84d4e66dd9..892a14b275 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFETileElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,12 +34,12 @@ class JSSVGFETileElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFETileElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFETileElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFETileElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,20 +63,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFETileElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
index 5a29db1f55..e643b9796f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFETurbulenceElement.h"
@@ -47,7 +47,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFETurbulenceElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFETurbulenceElement);
 
 /* Hash table */
 
@@ -102,13 +102,13 @@ public:
     JSSVGFETurbulenceElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFETurbulenceElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFETurbulenceElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFETurbulenceElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -144,9 +144,9 @@ static const HashTable JSSVGFETurbulenceElementPrototypeTable =
 
 const ClassInfo JSSVGFETurbulenceElementPrototype::s_info = { "SVGFETurbulenceElementPrototype", 0, &JSSVGFETurbulenceElementPrototypeTable, 0 };
 
-JSObject* JSSVGFETurbulenceElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFETurbulenceElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFETurbulenceElement>(exec);
+    return getDOMPrototype<JSSVGFETurbulenceElement>(exec, globalObject);
 }
 
 bool JSSVGFETurbulenceElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,9 +161,9 @@ JSSVGFETurbulenceElement::JSSVGFETurbulenceElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGFETurbulenceElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFETurbulenceElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFETurbulenceElementPrototype(JSSVGFETurbulenceElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFETurbulenceElementPrototype(JSSVGFETurbulenceElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFETurbulenceElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -171,146 +171,160 @@ bool JSSVGFETurbulenceElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGFETurbulenceElement, Base>(exec, &JSSVGFETurbulenceElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFETurbulenceElementBaseFrequencyX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementBaseFrequencyX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->baseFrequencyXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementBaseFrequencyY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementBaseFrequencyY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->baseFrequencyYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementNumOctaves(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementNumOctaves(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->numOctavesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementSeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementSeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->seedAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementStitchTiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementStitchTiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->stitchTilesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFETurbulenceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFETurbulenceElement::getConstructor(ExecState* exec)
+JSValue JSSVGFETurbulenceElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFETurbulenceElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFETurbulenceElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFETurbulenceElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFETurbulenceElement* castedThisObj = static_cast<JSSVGFETurbulenceElement*>(asObject(thisValue));
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
@@ -318,4 +332,4 @@ JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, cons
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
index 6b2ff8890f..c27ba2560d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFETurbulenceElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,27 +34,28 @@ class JSSVGFETurbulenceElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFETurbulenceElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFETurbulenceElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFETurbulenceElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,34 +64,34 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFETurbulenceElementBaseFrequencyX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementBaseFrequencyY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementNumOctaves(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementStitchTiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementNumOctaves(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementStitchTiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
index 695589bfd5..eb83ad79b1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "SVGElement.h"
 #include "JSSVGFilterElement.h"
@@ -48,7 +48,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFilterElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFilterElement);
 
 /* Hash table */
 
@@ -96,9 +96,9 @@ static const HashTable JSSVGFilterElementPrototypeTable =
 
 const ClassInfo JSSVGFilterElementPrototype::s_info = { "SVGFilterElementPrototype", 0, &JSSVGFilterElementPrototypeTable, 0 };
 
-JSObject* JSSVGFilterElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFilterElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFilterElement>(exec);
+    return getDOMPrototype<JSSVGFilterElement>(exec, globalObject);
 }
 
 bool JSSVGFilterElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -113,9 +113,9 @@ JSSVGFilterElement::JSSVGFilterElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGFilterElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFilterElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFilterElementPrototype(JSSVGFilterElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFilterElementPrototype(JSSVGFilterElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFilterElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,145 +123,161 @@ bool JSSVGFilterElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGFilterElement, Base>(exec, &JSSVGFilterElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFilterElementFilterUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->filterUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementPrimitiveUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementPrimitiveUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->primitiveUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementFilterResX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterResX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->filterResXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementFilterResY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterResY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->filterResYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGFilterElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGFilterElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGFilterElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGFilterElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGFilterElement, Base>(exec, propertyName, value, &JSSVGFilterElementTable, this, slot);
 }
 
-void setJSSVGFilterElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFilterElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGFilterElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFilterElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGFilterElementPrototypeFunctionSetFilterRes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFilterElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFilterElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(asObject(thisValue));
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
-    unsigned filterResX = args.at(exec, 0)->toInt32(exec);
-    unsigned filterResY = args.at(exec, 1)->toInt32(exec);
+    unsigned filterResX = args.at(0).toInt32(exec);
+    unsigned filterResY = args.at(1).toInt32(exec);
 
     imp->setFilterRes(filterResX, filterResY);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFilterElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFilterElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(asObject(thisValue));
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
index eb9062b076..e2294148ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
@@ -22,7 +22,7 @@
 #define JSSVGFilterElement_h
 
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
 
@@ -34,13 +34,13 @@ class JSSVGFilterElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFilterElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFilterElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGFilterElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFilterElementPrototypeFunctionSetFilterRes(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFilterElementFilterUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementPrimitiveUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementFilterResX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementFilterResY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFilterElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFilterElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFilterElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFilterElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementFilterUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementPrimitiveUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementFilterResX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementFilterResY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFilterElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFilterElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFilterElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFilterElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
index 940231424e..2b2022f37a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFontElementPrototypeTable =
 
 const ClassInfo JSSVGFontElementPrototype::s_info = { "SVGFontElementPrototype", 0, &JSSVGFontElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontElement>(exec);
+    return getDOMPrototype<JSSVGFontElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontElement::s_info = { "SVGFontElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGFontElement::JSSVGFontElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGFontElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontElementPrototype(JSSVGFontElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontElementPrototype(JSSVGFontElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
index 689377f4e0..8492a8e1f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
@@ -34,7 +34,7 @@ class JSSVGFontElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
index 87a012fe1a..18a1542416 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFontFaceElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceElementPrototype::s_info = { "SVGFontFaceElementPrototype", 0, &JSSVGFontFaceElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceElement::s_info = { "SVGFontFaceElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGFontFaceElement::JSSVGFontFaceElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGFontFaceElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceElementPrototype(JSSVGFontFaceElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceElementPrototype(JSSVGFontFaceElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
index 538ea5fd8d..5977f1bab8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
@@ -34,7 +34,7 @@ class JSSVGFontFaceElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
index afac6a92db..23496625e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceFormatElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceFormatElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFontFaceFormatElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceFormatElementPrototype::s_info = { "SVGFontFaceFormatElementPrototype", 0, &JSSVGFontFaceFormatElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceFormatElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceFormatElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceFormatElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceFormatElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceFormatElement::s_info = { "SVGFontFaceFormatElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGFontFaceFormatElement::JSSVGFontFaceFormatElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGFontFaceFormatElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceFormatElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceFormatElementPrototype(JSSVGFontFaceFormatElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceFormatElementPrototype(JSSVGFontFaceFormatElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
index b1d6eb7763..3bf9acfbe6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
@@ -34,7 +34,7 @@ class JSSVGFontFaceFormatElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceFormatElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceFormatElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceFormatElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceFormatElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
index 3fe3a474b0..190c7fb57b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceNameElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceNameElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFontFaceNameElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceNameElementPrototype::s_info = { "SVGFontFaceNameElementPrototype", 0, &JSSVGFontFaceNameElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceNameElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceNameElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceNameElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceNameElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceNameElement::s_info = { "SVGFontFaceNameElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGFontFaceNameElement::JSSVGFontFaceNameElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGFontFaceNameElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceNameElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceNameElementPrototype(JSSVGFontFaceNameElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceNameElementPrototype(JSSVGFontFaceNameElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
index 6a99c74685..a4ee587626 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
@@ -34,7 +34,7 @@ class JSSVGFontFaceNameElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceNameElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceNameElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceNameElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceNameElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
index 1830d4bd0e..ddbcf97b64 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceSrcElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceSrcElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFontFaceSrcElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceSrcElementPrototype::s_info = { "SVGFontFaceSrcElementPrototype", 0, &JSSVGFontFaceSrcElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceSrcElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceSrcElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceSrcElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceSrcElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceSrcElement::s_info = { "SVGFontFaceSrcElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGFontFaceSrcElement::JSSVGFontFaceSrcElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFontFaceSrcElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceSrcElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceSrcElementPrototype(JSSVGFontFaceSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceSrcElementPrototype(JSSVGFontFaceSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
index 4e5c94e50d..cd1c129dc3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
@@ -34,7 +34,7 @@ class JSSVGFontFaceSrcElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceSrcElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceSrcElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceSrcElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceSrcElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
index 7490501a21..e055e8b8b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceUriElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceUriElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGFontFaceUriElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceUriElementPrototype::s_info = { "SVGFontFaceUriElementPrototype", 0, &JSSVGFontFaceUriElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceUriElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceUriElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceUriElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceUriElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceUriElement::s_info = { "SVGFontFaceUriElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGFontFaceUriElement::JSSVGFontFaceUriElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFontFaceUriElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceUriElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceUriElementPrototype(JSSVGFontFaceUriElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceUriElementPrototype(JSSVGFontFaceUriElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
index e402e31877..a62b102792 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
@@ -34,7 +34,7 @@ class JSSVGFontFaceUriElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceUriElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceUriElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceUriElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceUriElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
index 3e123d1922..7ce02aedec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
@@ -53,7 +53,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGForeignObjectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGForeignObjectElement);
 
 /* Hash table */
 
@@ -106,9 +106,9 @@ static const HashTable JSSVGForeignObjectElementPrototypeTable =
 
 const ClassInfo JSSVGForeignObjectElementPrototype::s_info = { "SVGForeignObjectElementPrototype", 0, &JSSVGForeignObjectElementPrototypeTable, 0 };
 
-JSObject* JSSVGForeignObjectElementPrototype::self(ExecState* exec)
+JSObject* JSSVGForeignObjectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGForeignObjectElement>(exec);
+    return getDOMPrototype<JSSVGForeignObjectElement>(exec, globalObject);
 }
 
 bool JSSVGForeignObjectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +123,9 @@ JSSVGForeignObjectElement::JSSVGForeignObjectElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSSVGForeignObjectElement::createPrototype(ExecState* exec)
+JSObject* JSSVGForeignObjectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGForeignObjectElementPrototype(JSSVGForeignObjectElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGForeignObjectElementPrototype(JSSVGForeignObjectElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGForeignObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,193 +133,214 @@ bool JSSVGForeignObjectElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGForeignObjectElement, Base>(exec, &JSSVGForeignObjectElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGForeignObjectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGForeignObjectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGForeignObjectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGForeignObjectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGForeignObjectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGForeignObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGForeignObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGForeignObjectElement, Base>(exec, propertyName, value, &JSSVGForeignObjectElementTable, this, slot);
 }
 
-void setJSSVGForeignObjectElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGForeignObjectElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGForeignObjectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGForeignObjectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
index ebae7d6fba..a8a9e90d1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
@@ -34,13 +34,13 @@ class JSSVGForeignObjectElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGForeignObjectElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGForeignObjectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGForeignObjectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGForeignObjectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGForeignObjectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGForeignObjectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGForeignObjectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGForeignObjectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGForeignObjectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGForeignObjectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGForeignObjectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGForeignObjectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
index 307765bc02..8c40d8ee83 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
@@ -52,7 +52,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGGElement);
 
 /* Hash table */
 
@@ -101,9 +101,9 @@ static const HashTable JSSVGGElementPrototypeTable =
 
 const ClassInfo JSSVGGElementPrototype::s_info = { "SVGGElementPrototype", 0, &JSSVGGElementPrototypeTable, 0 };
 
-JSObject* JSSVGGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGGElement>(exec);
+    return getDOMPrototype<JSSVGGElement>(exec, globalObject);
 }
 
 bool JSSVGGElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,9 +118,9 @@ JSSVGGElement::JSSVGGElement(PassRefPtr<Structure> structure, PassRefPtr<SVGGEle
 {
 }
 
-JSObject* JSSVGGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGGElementPrototype(JSSVGGElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGGElementPrototype(JSSVGGElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,165 +128,182 @@ bool JSSVGGElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGGElement, Base>(exec, &JSSVGGElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGGElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGGElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGGElement, Base>(exec, propertyName, value, &JSSVGGElementTable, this, slot);
 }
 
-void setJSSVGGElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGGElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
index 183cb48cbc..72d6683069 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
@@ -34,13 +34,13 @@ class JSSVGGElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,27 +64,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
index 0a33be9e04..5e59db979b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGGlyphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGGlyphElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGGlyphElementPrototypeTable =
 
 const ClassInfo JSSVGGlyphElementPrototype::s_info = { "SVGGlyphElementPrototype", 0, &JSSVGGlyphElementPrototypeTable, 0 };
 
-JSObject* JSSVGGlyphElementPrototype::self(ExecState* exec)
+JSObject* JSSVGGlyphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGGlyphElement>(exec);
+    return getDOMPrototype<JSSVGGlyphElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGGlyphElement::s_info = { "SVGGlyphElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGGlyphElement::JSSVGGlyphElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGGlyphElement::createPrototype(ExecState* exec)
+JSObject* JSSVGGlyphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGGlyphElementPrototype(JSSVGGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGGlyphElementPrototype(JSSVGGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
index 596bd2081b..2cbea69909 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
@@ -34,7 +34,7 @@ class JSSVGGlyphElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGGlyphElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGGlyphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGGlyphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGGlyphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
index 30b55ceb81..90352e7cf3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGGradientElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGGradientElement);
 
 /* Hash table */
 
@@ -93,13 +93,13 @@ public:
     JSSVGGradientElementConstructor(ExecState* exec)
         : DOMObject(JSSVGGradientElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGGradientElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGGradientElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -133,9 +133,9 @@ static const HashTable JSSVGGradientElementPrototypeTable =
 
 const ClassInfo JSSVGGradientElementPrototype::s_info = { "SVGGradientElementPrototype", 0, &JSSVGGradientElementPrototypeTable, 0 };
 
-JSObject* JSSVGGradientElementPrototype::self(ExecState* exec)
+JSObject* JSSVGGradientElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGGradientElement>(exec);
+    return getDOMPrototype<JSSVGGradientElement>(exec, globalObject);
 }
 
 bool JSSVGGradientElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -150,9 +150,9 @@ JSSVGGradientElement::JSSVGGradientElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGGradientElement::createPrototype(ExecState* exec)
+JSObject* JSSVGGradientElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGGradientElementPrototype(JSSVGGradientElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGGradientElementPrototype(JSSVGGradientElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -160,94 +160,102 @@ bool JSSVGGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGGradientElement, Base>(exec, &JSSVGGradientElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGGradientElementGradientUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementGradientUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->gradientUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementGradientTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementGradientTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->gradientTransformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementSpreadMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementSpreadMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->spreadMethodAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGGradientElement::getConstructor(ExecState* exec)
+JSValue JSSVGGradientElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGGradientElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGradientElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGradientElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGradientElement* castedThisObj = static_cast<JSSVGGradientElement*>(asObject(thisValue));
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_PAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
index 728c2576f0..e207fb701e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
@@ -34,27 +34,28 @@ class JSSVGGradientElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGGradientElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGGradientElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGGradientElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,23 +64,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGGradientElementGradientUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementGradientTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSpreadMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementGradientUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementGradientTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSpreadMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_PAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
index d555c22a6e..0a6c63f288 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGHKernElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGHKernElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGHKernElementPrototypeTable =
 
 const ClassInfo JSSVGHKernElementPrototype::s_info = { "SVGHKernElementPrototype", 0, &JSSVGHKernElementPrototypeTable, 0 };
 
-JSObject* JSSVGHKernElementPrototype::self(ExecState* exec)
+JSObject* JSSVGHKernElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGHKernElement>(exec);
+    return getDOMPrototype<JSSVGHKernElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGHKernElement::s_info = { "SVGHKernElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGHKernElement::JSSVGHKernElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGHKernElement::createPrototype(ExecState* exec)
+JSObject* JSSVGHKernElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGHKernElementPrototype(JSSVGHKernElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGHKernElementPrototype(JSSVGHKernElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
index a8bde93e0e..250aa7e95b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
@@ -34,7 +34,7 @@ class JSSVGHKernElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGHKernElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGHKernElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGHKernElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGHKernElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
index 74c2ebd21f..179cbfad20 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
@@ -54,7 +54,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGImageElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGImageElement);
 
 /* Hash table */
 
@@ -109,9 +109,9 @@ static const HashTable JSSVGImageElementPrototypeTable =
 
 const ClassInfo JSSVGImageElementPrototype::s_info = { "SVGImageElementPrototype", 0, &JSSVGImageElementPrototypeTable, 0 };
 
-JSObject* JSSVGImageElementPrototype::self(ExecState* exec)
+JSObject* JSSVGImageElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGImageElement>(exec);
+    return getDOMPrototype<JSSVGImageElement>(exec, globalObject);
 }
 
 bool JSSVGImageElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +126,9 @@ JSSVGImageElement::JSSVGImageElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGImageElement::createPrototype(ExecState* exec)
+JSObject* JSSVGImageElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGImageElementPrototype(JSSVGImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGImageElementPrototype(JSSVGImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,207 +136,230 @@ bool JSSVGImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGImageElement, Base>(exec, &JSSVGImageElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGImageElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGImageElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGImageElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGImageElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGImageElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGImageElement, Base>(exec, propertyName, value, &JSSVGImageElementTable, this, slot);
 }
 
-void setJSSVGImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
index 9600ac155d..6479f74cc8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
@@ -34,13 +34,13 @@ class JSSVGImageElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGImageElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGImageElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGImageElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,33 +64,33 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
index 2c494b094f..8bb4fd2897 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLength)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLength);
 
 /* Hash table */
 
@@ -90,13 +90,13 @@ public:
     JSSVGLengthConstructor(ExecState* exec)
         : DOMObject(JSSVGLengthConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGLengthPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGLengthPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -138,9 +138,9 @@ static const HashTable JSSVGLengthPrototypeTable =
 
 const ClassInfo JSSVGLengthPrototype::s_info = { "SVGLengthPrototype", 0, &JSSVGLengthPrototypeTable, 0 };
 
-JSObject* JSSVGLengthPrototype::self(ExecState* exec)
+JSObject* JSSVGLengthPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLength>(exec);
+    return getDOMPrototype<JSSVGLength>(exec, globalObject);
 }
 
 bool JSSVGLengthPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,12 +161,11 @@ JSSVGLength::~JSSVGLength()
 {
     JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::forgetWrapper(m_impl.get());
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGLength::createPrototype(ExecState* exec)
+JSObject* JSSVGLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLengthPrototype(JSSVGLengthPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGLengthPrototype(JSSVGLengthPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGLength::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,82 +173,87 @@ bool JSSVGLength::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGLength, Base>(exec, &JSSVGLengthTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLengthUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLength imp(*static_cast<JSSVGLength*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.unitType());
 }
 
-JSValuePtr jsSVGLengthValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGLength*>(asObject(slot.slotBase()))->value(exec);
 }
 
-JSValuePtr jsSVGLengthValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLength imp(*static_cast<JSSVGLength*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.valueInSpecifiedUnits());
 }
 
-JSValuePtr jsSVGLengthValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLength imp(*static_cast<JSSVGLength*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp.valueAsString());
 }
 
-JSValuePtr jsSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGLength*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGLength::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGLength::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGLength, Base>(exec, propertyName, value, &JSSVGLengthTable, this, slot);
 }
 
-void setJSSVGLengthValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLengthValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
-    imp.setValue(value->toFloat(exec));
+    imp.setValue(value.toFloat(exec));
         static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
 }
 
-void setJSSVGLengthValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLengthValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
-    imp.setValueInSpecifiedUnits(value->toFloat(exec));
+    imp.setValueInSpecifiedUnits(value.toFloat(exec));
         static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
 }
 
-void setJSSVGLengthValueAsString(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLengthValueAsString(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
     imp.setValueAsString(valueToStringWithNullCheck(exec, value));
         static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
 }
 
-JSValuePtr JSSVGLength::getConstructor(ExecState* exec)
+JSValue JSSVGLength::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGLengthConstructor>(exec);
 }
 
-JSValuePtr jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLength::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLength::s_info))
         return throwError(exec, TypeError);
     JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGLength>* wrapper = castedThisObj->impl();
     SVGLength imp(*wrapper);
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
-    float valueInSpecifiedUnits = args.at(exec, 1)->toFloat(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
+    float valueInSpecifiedUnits = args.at(1).toFloat(exec);
 
     imp.newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLength::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLength::s_info))
         return throwError(exec, TypeError);
     JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(asObject(thisValue));
     return castedThisObj->convertToSpecifiedUnits(exec, args);
@@ -257,68 +261,68 @@ JSValuePtr jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecState* exec,
 
 // Constant getters
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_CM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_CM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_MM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_MM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_IN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGLength>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGLength>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGLength, JSSVGPODTypeWrapper<SVGLength> >(exec, object, context);
 }
-SVGLength toSVGLength(JSC::JSValuePtr value)
+SVGLength toSVGLength(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGLength::s_info) ? (SVGLength) *static_cast<JSSVGLength*>(asObject(value))->impl() : SVGLength();
+    return value.isObject(&JSSVGLength::s_info) ? (SVGLength) *static_cast<JSSVGLength*>(asObject(value))->impl() : SVGLength();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
index 167ca56afb..bdcdcb0f82 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
@@ -37,24 +37,24 @@ class JSSVGLength : public DOMObject {
 public:
     JSSVGLength(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<SVGLength> >, SVGElement* context);
     virtual ~JSSVGLength();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr value(JSC::ExecState*) const;
+    JSC::JSValue value(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr convertToSpecifiedUnits(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue convertToSpecifiedUnits(JSC::ExecState*, const JSC::ArgList&);
     JSSVGPODTypeWrapper<SVGLength>* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -63,16 +63,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<SVGLength> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement* context);
-SVGLength toSVGLength(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement* context);
+SVGLength toSVGLength(JSC::JSValue);
 
 class JSSVGLengthPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,31 +82,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGLengthUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLengthValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLengthValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLengthValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLengthValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLengthValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLengthValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLengthValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLengthValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLengthValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLengthValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
index 6dc9a6a0f6..85d2c3232b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLengthList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLengthList);
 
 /* Hash table */
 
@@ -79,9 +79,9 @@ static const HashTable JSSVGLengthListPrototypeTable =
 
 const ClassInfo JSSVGLengthListPrototype::s_info = { "SVGLengthListPrototype", 0, &JSSVGLengthListPrototypeTable, 0 };
 
-JSObject* JSSVGLengthListPrototype::self(ExecState* exec)
+JSObject* JSSVGLengthListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLengthList>(exec);
+    return getDOMPrototype<JSSVGLengthList>(exec, globalObject);
 }
 
 bool JSSVGLengthListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,12 +101,11 @@ JSSVGLengthList::JSSVGLengthList(PassRefPtr<Structure> structure, PassRefPtr<SVG
 JSSVGLengthList::~JSSVGLengthList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGLengthList::createPrototype(ExecState* exec)
+JSObject* JSSVGLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLengthListPrototype(JSSVGLengthListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGLengthListPrototype(JSSVGLengthListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGLengthList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,15 +113,17 @@ bool JSSVGLengthList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGLengthList, Base>(exec, &JSSVGLengthListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLengthListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLengthList* imp = static_cast<SVGLengthList*>(static_cast<JSSVGLengthList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -133,105 +134,111 @@ JSValuePtr jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
+    SVGLength item = toSVGLength(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    SVGLength item = toSVGLength(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    SVGLength item = toSVGLength(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
+    SVGLength item = toSVGLength(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGLengthList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGLengthList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGLengthList>(exec, object, context);
 }
-SVGLengthList* toSVGLengthList(JSC::JSValuePtr value)
+SVGLengthList* toSVGLengthList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGLengthList::s_info) ? static_cast<JSSVGLengthList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGLengthList::s_info) ? static_cast<JSSVGLengthList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
index 0a1c4f7908..7edb82429b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
@@ -37,12 +37,12 @@ class JSSVGLengthList : public DOMObject {
 public:
     JSSVGLengthList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGLengthList>, SVGElement* context);
     virtual ~JSSVGLengthList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,16 +55,17 @@ private:
     RefPtr<SVGLengthList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGLengthList*, SVGElement* context);
-SVGLengthList* toSVGLengthList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGLengthList*, SVGElement* context);
+SVGLengthList* toSVGLengthList(JSC::JSValue);
 
 class JSSVGLengthListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,16 +74,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGLengthListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
index 1116d77bdd..d0d6dcea49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
@@ -53,7 +53,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLineElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLineElement);
 
 /* Hash table */
 
@@ -106,9 +106,9 @@ static const HashTable JSSVGLineElementPrototypeTable =
 
 const ClassInfo JSSVGLineElementPrototype::s_info = { "SVGLineElementPrototype", 0, &JSSVGLineElementPrototypeTable, 0 };
 
-JSObject* JSSVGLineElementPrototype::self(ExecState* exec)
+JSObject* JSSVGLineElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLineElement>(exec);
+    return getDOMPrototype<JSSVGLineElement>(exec, globalObject);
 }
 
 bool JSSVGLineElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +123,9 @@ JSSVGLineElement::JSSVGLineElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGLineElement::createPrototype(ExecState* exec)
+JSObject* JSSVGLineElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLineElementPrototype(JSSVGLineElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGLineElementPrototype(JSSVGLineElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGLineElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,193 +133,214 @@ bool JSSVGLineElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGLineElement, Base>(exec, &JSSVGLineElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLineElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGLineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGLineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGLineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGLineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGLineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGLineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGLineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGLineElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGLineElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGLineElement, Base>(exec, propertyName, value, &JSSVGLineElementTable, this, slot);
 }
 
-void setJSSVGLineElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLineElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGLineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
index 62df2b8889..b908d47e48 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
@@ -34,13 +34,13 @@ class JSSVGLineElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGLineElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGLineElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGLineElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGLineElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
index c471ee553c..6dc0b5f7af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLinearGradientElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLinearGradientElement);
 
 /* Hash table */
 
@@ -72,9 +72,9 @@ static const HashTable JSSVGLinearGradientElementPrototypeTable =
 
 const ClassInfo JSSVGLinearGradientElementPrototype::s_info = { "SVGLinearGradientElementPrototype", 0, &JSSVGLinearGradientElementPrototypeTable, 0 };
 
-JSObject* JSSVGLinearGradientElementPrototype::self(ExecState* exec)
+JSObject* JSSVGLinearGradientElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLinearGradientElement>(exec);
+    return getDOMPrototype<JSSVGLinearGradientElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGLinearGradientElement::s_info = { "SVGLinearGradientElement", &JSSVGGradientElement::s_info, &JSSVGLinearGradientElementTable, 0 };
@@ -84,9 +84,9 @@ JSSVGLinearGradientElement::JSSVGLinearGradientElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGLinearGradientElement::createPrototype(ExecState* exec)
+JSObject* JSSVGLinearGradientElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLinearGradientElementPrototype(JSSVGLinearGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec)));
+    return new (exec) JSSVGLinearGradientElementPrototype(JSSVGLinearGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGLinearGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,29 +94,33 @@ bool JSSVGLinearGradientElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGLinearGradientElement, Base>(exec, &JSSVGLinearGradientElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLinearGradientElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLinearGradientElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLinearGradientElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLinearGradientElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y2Animated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
index 95a0a5c0be..8e002a5696 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
@@ -34,12 +34,12 @@ class JSSVGLinearGradientElement : public JSSVGGradientElement {
     typedef JSSVGGradientElement Base;
 public:
     JSSVGLinearGradientElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGLinearGradientElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGLinearGradientElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGLinearGradientElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,10 +58,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGLinearGradientElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLinearGradientElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLinearGradientElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLinearGradientElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
index f707924387..aa44a04652 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
@@ -52,7 +52,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMarkerElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMarkerElement);
 
 /* Hash table */
 
@@ -108,13 +108,13 @@ public:
     JSSVGMarkerElementConstructor(ExecState* exec)
         : DOMObject(JSSVGMarkerElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGMarkerElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGMarkerElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -152,9 +152,9 @@ static const HashTable JSSVGMarkerElementPrototypeTable =
 
 const ClassInfo JSSVGMarkerElementPrototype::s_info = { "SVGMarkerElementPrototype", 0, &JSSVGMarkerElementPrototypeTable, 0 };
 
-JSObject* JSSVGMarkerElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMarkerElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMarkerElement>(exec);
+    return getDOMPrototype<JSSVGMarkerElement>(exec, globalObject);
 }
 
 bool JSSVGMarkerElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -169,9 +169,9 @@ JSSVGMarkerElement::JSSVGMarkerElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGMarkerElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMarkerElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMarkerElementPrototype(JSSVGMarkerElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMarkerElementPrototype(JSSVGMarkerElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGMarkerElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -179,130 +179,145 @@ bool JSSVGMarkerElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGMarkerElement, Base>(exec, &JSSVGMarkerElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGMarkerElementRefX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementRefX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->refXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementRefY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementRefY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->refYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementMarkerUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->markerUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementMarkerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->markerWidthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementMarkerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->markerHeightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementOrientType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementOrientType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->orientTypeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementOrientAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementOrientAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedAngle> obj = imp->orientAngleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGMarkerElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGMarkerElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGMarkerElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGMarkerElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGMarkerElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMarkerElement, Base>(exec, propertyName, value, &JSSVGMarkerElementTable, this, slot);
 }
 
-void setJSSVGMarkerElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMarkerElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGMarkerElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMarkerElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr JSSVGMarkerElement::getConstructor(ExecState* exec)
+JSValue JSSVGMarkerElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGMarkerElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMarkerElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
@@ -311,59 +326,61 @@ JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecState* exec, J
     return jsUndefined();
 }
 
-JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMarkerElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
-    SVGAngle* angle = toSVGAngle(args.at(exec, 0));
+    SVGAngle* angle = toSVGAngle(args.at(0));
 
     imp->setOrientToAngle(angle);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMarkerElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
index 9bdd93d8e7..e9042c8e6a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
@@ -34,28 +34,29 @@ class JSSVGMarkerElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMarkerElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMarkerElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGMarkerElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,36 +65,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGMarkerElementRefX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementRefY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementMarkerUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementMarkerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementMarkerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementOrientType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementOrientAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMarkerElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMarkerElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMarkerElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMarkerElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementRefX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementRefY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementMarkerUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementMarkerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementMarkerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementOrientType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementOrientAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMarkerElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMarkerElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMarkerElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMarkerElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
index 2ac2f2e3f5..79ad8c857d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
@@ -49,7 +49,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMaskElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMaskElement);
 
 /* Hash table */
 
@@ -97,9 +97,9 @@ static const HashTable JSSVGMaskElementPrototypeTable =
 
 const ClassInfo JSSVGMaskElementPrototype::s_info = { "SVGMaskElementPrototype", 0, &JSSVGMaskElementPrototypeTable, 0 };
 
-JSObject* JSSVGMaskElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMaskElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMaskElement>(exec);
+    return getDOMPrototype<JSSVGMaskElement>(exec, globalObject);
 }
 
 bool JSSVGMaskElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,9 +114,9 @@ JSSVGMaskElement::JSSVGMaskElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGMaskElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMaskElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMaskElementPrototype(JSSVGMaskElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMaskElementPrototype(JSSVGMaskElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGMaskElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -124,138 +124,154 @@ bool JSSVGMaskElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGMaskElement, Base>(exec, &JSSVGMaskElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGMaskElementMaskUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementMaskUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->maskUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementMaskContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementMaskContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->maskContentUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGMaskElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGMaskElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGMaskElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGMaskElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGMaskElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGMaskElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGMaskElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMaskElement, Base>(exec, propertyName, value, &JSSVGMaskElementTable, this, slot);
 }
 
-void setJSSVGMaskElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMaskElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGMaskElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMaskElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGMaskElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMaskElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMaskElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(asObject(thisValue));
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMaskElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMaskElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(asObject(thisValue));
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
index dbe6b78b29..364ba4f8c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
@@ -34,13 +34,13 @@ class JSSVGMaskElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMaskElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMaskElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGMaskElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,26 +64,26 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGMaskElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGMaskElementMaskUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementMaskContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMaskElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMaskElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMaskElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMaskElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementMaskUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementMaskContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMaskElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMaskElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMaskElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMaskElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
index 66c0b2cc04..5be4fb0eee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
@@ -28,6 +28,7 @@
 
 #include <wtf/GetPtr.h>
 
+#include "JSSVGMatrix.h"
 
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
@@ -36,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMatrix)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMatrix);
 
 /* Hash table */
 
@@ -85,9 +86,9 @@ static const HashTable JSSVGMatrixPrototypeTable =
 
 const ClassInfo JSSVGMatrixPrototype::s_info = { "SVGMatrixPrototype", 0, &JSSVGMatrixPrototypeTable, 0 };
 
-JSObject* JSSVGMatrixPrototype::self(ExecState* exec)
+JSObject* JSSVGMatrixPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMatrix>(exec);
+    return getDOMPrototype<JSSVGMatrix>(exec, globalObject);
 }
 
 bool JSSVGMatrixPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,12 +108,11 @@ JSSVGMatrix::JSSVGMatrix(PassRefPtr<Structure> structure, PassRefPtr<JSSVGPODTyp
 JSSVGMatrix::~JSSVGMatrix()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGMatrix::createPrototype(ExecState* exec)
+JSObject* JSSVGMatrix::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMatrixPrototype(JSSVGMatrixPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGMatrixPrototype(JSSVGMatrixPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -120,184 +120,255 @@ bool JSSVGMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGMatrix, Base>(exec, &JSSVGMatrixTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.a());
 }
 
-JSValuePtr jsSVGMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.b());
 }
 
-JSValuePtr jsSVGMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.c());
 }
 
-JSValuePtr jsSVGMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.d());
 }
 
-JSValuePtr jsSVGMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.e());
 }
 
-JSValuePtr jsSVGMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.f());
 }
 
-void JSSVGMatrix::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGMatrix::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMatrix, Base>(exec, propertyName, value, &JSSVGMatrixTable, this, slot);
 }
 
-void setJSSVGMatrixA(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixA(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setA(value->toNumber(exec));
+    imp.setA(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixB(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixB(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setB(value->toNumber(exec));
+    imp.setB(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixC(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixC(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setC(value->toNumber(exec));
+    imp.setC(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixD(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixD(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setD(value->toNumber(exec));
+    imp.setD(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixE(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixE(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setE(value->toNumber(exec));
+    imp.setE(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixF(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixF(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setF(value->toNumber(exec));
+    imp.setF(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->multiply(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    TransformationMatrix secondMatrix = toSVGMatrix(args.at(0));
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.multiply(secondMatrix)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     return castedThisObj->inverse(exec, args);
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->translate(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.translate(x, y)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->scale(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float scaleFactor = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scale(scaleFactor)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionScaleNonUniform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScaleNonUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->scaleNonUniform(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float scaleFactorX = args.at(0).toFloat(exec);
+    float scaleFactorY = args.at(1).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->rotate(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float angle = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotate(angle)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionRotateFromVector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotateFromVector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     return castedThisObj->rotateFromVector(exec, args);
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionFlipX(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->flipX(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipX()).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionFlipY(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->flipY(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipY()).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionSkewX(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->skewX(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float angle = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewX(angle)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionSkewY(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->skewY(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float angle = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewY(angle)).get(), castedThisObj->context());
+    return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<TransformationMatrix>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<TransformationMatrix>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGMatrix, JSSVGPODTypeWrapper<TransformationMatrix> >(exec, object, context);
 }
-TransformationMatrix toSVGMatrix(JSC::JSValuePtr value)
+TransformationMatrix toSVGMatrix(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGMatrix::s_info) ? (TransformationMatrix) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : TransformationMatrix();
+    return value.isObject(&JSSVGMatrix::s_info) ? (TransformationMatrix) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : TransformationMatrix();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
index 0d8b249387..3c9eed736e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
@@ -37,30 +37,21 @@ class JSSVGMatrix : public DOMObject {
 public:
     JSSVGMatrix(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<TransformationMatrix> >, SVGElement* context);
     virtual ~JSSVGMatrix();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr multiply(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr inverse(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr translate(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr scale(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr scaleNonUniform(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr rotate(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr rotateFromVector(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr flipX(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr flipY(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr skewX(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr skewY(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue inverse(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue rotateFromVector(JSC::ExecState*, const JSC::ArgList&);
     JSSVGPODTypeWrapper<TransformationMatrix>* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -69,16 +60,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<TransformationMatrix> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<TransformationMatrix>*, SVGElement* context);
-TransformationMatrix toSVGMatrix(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<TransformationMatrix>*, SVGElement* context);
+TransformationMatrix toSVGMatrix(JSC::JSValue);
 
 class JSSVGMatrixPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -87,31 +79,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionMultiply(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionInverse(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionScaleNonUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionRotateFromVector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionFlipX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionFlipY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionInverse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScaleNonUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotateFromVector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
index 49acd215cf..55a5747eba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMetadataElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMetadataElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGMetadataElementPrototypeTable =
 
 const ClassInfo JSSVGMetadataElementPrototype::s_info = { "SVGMetadataElementPrototype", 0, &JSSVGMetadataElementPrototypeTable, 0 };
 
-JSObject* JSSVGMetadataElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMetadataElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMetadataElement>(exec);
+    return getDOMPrototype<JSSVGMetadataElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGMetadataElement::s_info = { "SVGMetadataElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGMetadataElement::JSSVGMetadataElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGMetadataElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMetadataElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMetadataElementPrototype(JSSVGMetadataElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMetadataElementPrototype(JSSVGMetadataElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
index 5da7044155..ad32a38cb0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
@@ -34,7 +34,7 @@ class JSSVGMetadataElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMetadataElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMetadataElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGMetadataElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGMetadataElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
index 435a567a00..dea3c117d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMissingGlyphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMissingGlyphElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGMissingGlyphElementPrototypeTable =
 
 const ClassInfo JSSVGMissingGlyphElementPrototype::s_info = { "SVGMissingGlyphElementPrototype", 0, &JSSVGMissingGlyphElementPrototypeTable, 0 };
 
-JSObject* JSSVGMissingGlyphElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMissingGlyphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMissingGlyphElement>(exec);
+    return getDOMPrototype<JSSVGMissingGlyphElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGMissingGlyphElement::s_info = { "SVGMissingGlyphElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGMissingGlyphElement::JSSVGMissingGlyphElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGMissingGlyphElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMissingGlyphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMissingGlyphElementPrototype(JSSVGMissingGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMissingGlyphElementPrototype(JSSVGMissingGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
index e696b0d4ad..cb1ed2c393 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
@@ -34,7 +34,7 @@ class JSSVGMissingGlyphElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMissingGlyphElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMissingGlyphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGMissingGlyphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGMissingGlyphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
index 6a770afc5f..beed4c2535 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGNumber)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGNumber);
 
 /* Hash table */
 
@@ -68,9 +68,9 @@ static const HashTable JSSVGNumberPrototypeTable =
 
 const ClassInfo JSSVGNumberPrototype::s_info = { "SVGNumberPrototype", 0, &JSSVGNumberPrototypeTable, 0 };
 
-JSObject* JSSVGNumberPrototype::self(ExecState* exec)
+JSObject* JSSVGNumberPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGNumber>(exec);
+    return getDOMPrototype<JSSVGNumber>(exec, globalObject);
 }
 
 const ClassInfo JSSVGNumber::s_info = { "SVGNumber", 0, &JSSVGNumberTable, 0 };
@@ -85,12 +85,11 @@ JSSVGNumber::JSSVGNumber(PassRefPtr<Structure> structure, PassRefPtr<JSSVGPODTyp
 JSSVGNumber::~JSSVGNumber()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGNumber::createPrototype(ExecState* exec)
+JSObject* JSSVGNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGNumberPrototype(JSSVGNumberPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGNumberPrototype(JSSVGNumberPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGNumber::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,31 +97,32 @@ bool JSSVGNumber::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGNumber, Base>(exec, &JSSVGNumberTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     float imp(*static_cast<JSSVGNumber*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp);
 }
 
-void JSSVGNumber::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGNumber::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGNumber, Base>(exec, propertyName, value, &JSSVGNumberTable, this, slot);
 }
 
-void setJSSVGNumberValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGNumberValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     float imp(*static_cast<JSSVGNumber*>(thisObject)->impl());
-    imp = value->toFloat(exec);
+    imp = value.toFloat(exec);
         static_cast<JSSVGNumber*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGNumber*>(thisObject)->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<float>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<float>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGNumber, JSSVGPODTypeWrapper<float> >(exec, object, context);
 }
-float toSVGNumber(JSC::JSValuePtr value)
+float toSVGNumber(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGNumber::s_info) ? (float) *static_cast<JSSVGNumber*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGNumber::s_info) ? (float) *static_cast<JSSVGNumber*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
index 530c54ad5a..1dead51c02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
@@ -36,13 +36,13 @@ class JSSVGNumber : public DOMObject {
 public:
     JSSVGNumber(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<float> >, SVGElement* context);
     virtual ~JSSVGNumber();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,12 +55,13 @@ private:
     RefPtr<JSSVGPODTypeWrapper<float> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<float>*, SVGElement* context);
-float toSVGNumber(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<float>*, SVGElement* context);
+float toSVGNumber(JSC::JSValue);
 
 class JSSVGNumberPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGNumberPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -68,8 +69,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGNumberValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGNumberValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
index b5dfe53c6d..36463c3ef0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGNumberList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGNumberList);
 
 /* Hash table */
 
@@ -78,9 +78,9 @@ static const HashTable JSSVGNumberListPrototypeTable =
 
 const ClassInfo JSSVGNumberListPrototype::s_info = { "SVGNumberListPrototype", 0, &JSSVGNumberListPrototypeTable, 0 };
 
-JSObject* JSSVGNumberListPrototype::self(ExecState* exec)
+JSObject* JSSVGNumberListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGNumberList>(exec);
+    return getDOMPrototype<JSSVGNumberList>(exec, globalObject);
 }
 
 bool JSSVGNumberListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,12 +100,11 @@ JSSVGNumberList::JSSVGNumberList(PassRefPtr<Structure> structure, PassRefPtr<SVG
 JSSVGNumberList::~JSSVGNumberList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGNumberList::createPrototype(ExecState* exec)
+JSObject* JSSVGNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGNumberListPrototype(JSSVGNumberListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGNumberListPrototype(JSSVGNumberListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGNumberList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -113,15 +112,17 @@ bool JSSVGNumberList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGNumberList, Base>(exec, &JSSVGNumberListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGNumberListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGNumberListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGNumberList* imp = static_cast<SVGNumberList*>(static_cast<JSSVGNumberList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -132,105 +133,111 @@ JSValuePtr jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
+    float item = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    float item = args.at(0).toFloat(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    float item = args.at(0).toFloat(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
+    float item = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGNumberList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGNumberList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGNumberList>(exec, object, context);
 }
-SVGNumberList* toSVGNumberList(JSC::JSValuePtr value)
+SVGNumberList* toSVGNumberList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGNumberList::s_info) ? static_cast<JSSVGNumberList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGNumberList::s_info) ? static_cast<JSSVGNumberList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
index 64921bf211..584b1bf0f5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
@@ -37,12 +37,12 @@ class JSSVGNumberList : public DOMObject {
 public:
     JSSVGNumberList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGNumberList>, SVGElement* context);
     virtual ~JSSVGNumberList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,16 +55,17 @@ private:
     RefPtr<SVGNumberList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGNumberList*, SVGElement* context);
-SVGNumberList* toSVGNumberList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGNumberList*, SVGElement* context);
+SVGNumberList* toSVGNumberList(JSC::JSValue);
 
 class JSSVGNumberListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,16 +74,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGNumberListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGNumberListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
index 1baa7164cc..e2d9b35f92 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPaint)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPaint);
 
 /* Hash table */
 
@@ -87,13 +87,13 @@ public:
     JSSVGPaintConstructor(ExecState* exec)
         : DOMObject(JSSVGPaintConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGPaintPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGPaintPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,9 +134,9 @@ static const HashTable JSSVGPaintPrototypeTable =
 
 const ClassInfo JSSVGPaintPrototype::s_info = { "SVGPaintPrototype", 0, &JSSVGPaintPrototypeTable, 0 };
 
-JSObject* JSSVGPaintPrototype::self(ExecState* exec)
+JSObject* JSSVGPaintPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPaint>(exec);
+    return getDOMPrototype<JSSVGPaint>(exec, globalObject);
 }
 
 bool JSSVGPaintPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,9 +151,9 @@ JSSVGPaint::JSSVGPaint(PassRefPtr<Structure> structure, PassRefPtr<SVGPaint> imp
 {
 }
 
-JSObject* JSSVGPaint::createPrototype(ExecState* exec)
+JSObject* JSSVGPaint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPaintPrototype(JSSVGPaintPrototype::createStructure(JSSVGColorPrototype::self(exec)));
+    return new (exec) JSSVGPaintPrototype(JSSVGPaintPrototype::createStructure(JSSVGColorPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPaint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,50 +161,54 @@ bool JSSVGPaint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGPaint, Base>(exec, &JSSVGPaintTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPaintPaintType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintPaintType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPaint* imp = static_cast<SVGPaint*>(static_cast<JSSVGPaint*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->paintType());
 }
 
-JSValuePtr jsSVGPaintUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPaint* imp = static_cast<SVGPaint*>(static_cast<JSSVGPaint*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->uri());
 }
 
-JSValuePtr jsSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGPaint*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGPaint::getConstructor(ExecState* exec)
+JSValue JSSVGPaint::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGPaintConstructor>(exec);
 }
 
-JSValuePtr jsSVGPaintPrototypeFunctionSetUri(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetUri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPaint::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPaint::s_info))
         return throwError(exec, TypeError);
     JSSVGPaint* castedThisObj = static_cast<JSSVGPaint*>(asObject(thisValue));
     SVGPaint* imp = static_cast<SVGPaint*>(castedThisObj->impl());
-    const UString& uri = args.at(exec, 0)->toString(exec);
+    const UString& uri = args.at(0).toString(exec);
 
     imp->setUri(uri);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPaint::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPaint::s_info))
         return throwError(exec, TypeError);
     JSSVGPaint* castedThisObj = static_cast<JSSVGPaint*>(asObject(thisValue));
     SVGPaint* imp = static_cast<SVGPaint*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGPaint::SVGPaintType paintType = static_cast<SVGPaint::SVGPaintType>(args.at(exec, 0)->toInt32(exec));
-    const UString& uri = args.at(exec, 1)->toString(exec);
-    const UString& rgbColor = args.at(exec, 2)->toString(exec);
-    const UString& iccColor = args.at(exec, 3)->toString(exec);
+    SVGPaint::SVGPaintType paintType = static_cast<SVGPaint::SVGPaintType>(args.at(0).toInt32(exec));
+    const UString& uri = args.at(1).toString(exec);
+    const UString& rgbColor = args.at(2).toString(exec);
+    const UString& iccColor = args.at(3).toString(exec);
 
     imp->setPaint(paintType, uri, rgbColor, iccColor, ec);
     setDOMException(exec, ec);
@@ -213,52 +217,52 @@ JSValuePtr jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObject*, JSVal
 
 // Constant getters
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(101));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(102));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(103));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(104));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(105));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(106));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(107));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
index c5aba40e71..a26f5afcff 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
@@ -34,27 +34,28 @@ class JSSVGPaint : public JSSVGColor {
     typedef JSSVGColor Base;
 public:
     JSSVGPaint(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPaint>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGPaintPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,25 +64,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPaintPrototypeFunctionSetUri(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPaintPrototypeFunctionSetPaint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetUri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetPaint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPaintPaintType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintPaintType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
index 8c0ca0ea55..1cb9d65494 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
@@ -86,7 +86,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathElement);
 
 /* Hash table */
 
@@ -162,9 +162,9 @@ static const HashTable JSSVGPathElementPrototypeTable =
 
 const ClassInfo JSSVGPathElementPrototype::s_info = { "SVGPathElementPrototype", 0, &JSSVGPathElementPrototypeTable, 0 };
 
-JSObject* JSSVGPathElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPathElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathElement>(exec);
+    return getDOMPrototype<JSSVGPathElement>(exec, globalObject);
 }
 
 bool JSSVGPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -179,9 +179,9 @@ JSSVGPathElement::JSSVGPathElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGPathElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPathElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathElementPrototype(JSSVGPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPathElementPrototype(JSSVGPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -189,520 +189,564 @@ bool JSSVGPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGPathElement, Base>(exec, &JSSVGPathElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathElementPathLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementPathLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pathLengthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGPathElementPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->pathSegList()), imp);
 }
 
-JSValuePtr jsSVGPathElementNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->normalizedPathSegList()), imp);
 }
 
-JSValuePtr jsSVGPathElementAnimatedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementAnimatedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedPathSegList()), imp);
 }
 
-JSValuePtr jsSVGPathElementAnimatedNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementAnimatedNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedNormalizedPathSegList()), imp);
 }
 
-void JSSVGPathElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathElement, Base>(exec, propertyName, value, &JSSVGPathElementTable, this, slot);
 }
 
-void setJSSVGPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetTotalLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTotalLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getTotalLength());
+    JSC::JSValue result = jsNumber(exec, imp->getTotalLength());
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetPointAtLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPointAtLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float distance = args.at(exec, 0)->toFloat(exec);
+    float distance = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getPointAtLength(distance)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getPointAtLength(distance)).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetPathSegAtLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPathSegAtLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float distance = args.at(exec, 0)->toFloat(exec);
+    float distance = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getPathSegAtLength(distance));
+    JSC::JSValue result = jsNumber(exec, imp->getPathSegAtLength(distance));
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegClosePath()), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegClosePath()), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoAbs(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoAbs(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoRel(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoRel(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoAbs(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoAbs(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoRel(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoRel(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
-    float x2 = args.at(exec, 4)->toFloat(exec);
-    float y2 = args.at(exec, 5)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
+    float x2 = args.at(4).toFloat(exec);
+    float y2 = args.at(5).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicAbs(x, y, x1, y1, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicAbs(x, y, x1, y1, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
-    float x2 = args.at(exec, 4)->toFloat(exec);
-    float y2 = args.at(exec, 5)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
+    float x2 = args.at(4).toFloat(exec);
+    float y2 = args.at(5).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicRel(x, y, x1, y1, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicRel(x, y, x1, y1, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticAbs(x, y, x1, y1)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticAbs(x, y, x1, y1)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticRel(x, y, x1, y1)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticRel(x, y, x1, y1)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float r1 = args.at(exec, 2)->toFloat(exec);
-    float r2 = args.at(exec, 3)->toFloat(exec);
-    float angle = args.at(exec, 4)->toFloat(exec);
-    bool largeArcFlag = args.at(exec, 5)->toBoolean(exec);
-    bool sweepFlag = args.at(exec, 6)->toBoolean(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float r1 = args.at(2).toFloat(exec);
+    float r2 = args.at(3).toFloat(exec);
+    float angle = args.at(4).toFloat(exec);
+    bool largeArcFlag = args.at(5).toBoolean(exec);
+    bool sweepFlag = args.at(6).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcAbs(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcAbs(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float r1 = args.at(exec, 2)->toFloat(exec);
-    float r2 = args.at(exec, 3)->toFloat(exec);
-    float angle = args.at(exec, 4)->toFloat(exec);
-    bool largeArcFlag = args.at(exec, 5)->toBoolean(exec);
-    bool sweepFlag = args.at(exec, 6)->toBoolean(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float r1 = args.at(2).toFloat(exec);
+    float r2 = args.at(3).toFloat(exec);
+    float angle = args.at(4).toFloat(exec);
+    bool largeArcFlag = args.at(5).toBoolean(exec);
+    bool sweepFlag = args.at(6).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcRel(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcRel(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalAbs(x)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalAbs(x)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalRel(x)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalRel(x)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float y = args.at(exec, 0)->toFloat(exec);
+    float y = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalAbs(y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalAbs(y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float y = args.at(exec, 0)->toFloat(exec);
+    float y = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalRel(y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalRel(y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x2 = args.at(exec, 2)->toFloat(exec);
-    float y2 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x2 = args.at(2).toFloat(exec);
+    float y2 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothAbs(x, y, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothAbs(x, y, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x2 = args.at(exec, 2)->toFloat(exec);
-    float y2 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x2 = args.at(2).toFloat(exec);
+    float y2 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothRel(x, y, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothRel(x, y, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothAbs(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothAbs(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothRel(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothRel(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
index 2b625a508b..70f154f3ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
@@ -34,13 +34,13 @@ class JSSVGPathElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPathElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPathElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,54 +64,54 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetTotalLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetPointAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetPathSegAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTotalLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPointAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPathSegAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPathElementPathLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementAnimatedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementAnimatedNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementPathLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementAnimatedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementAnimatedNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
index e440877acf..1e601bdd1b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSeg)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSeg);
 
 /* Hash table */
 
@@ -96,13 +96,13 @@ public:
     JSSVGPathSegConstructor(ExecState* exec)
         : DOMObject(JSSVGPathSegConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGPathSegPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -151,9 +151,9 @@ static const HashTable JSSVGPathSegPrototypeTable =
 
 const ClassInfo JSSVGPathSegPrototype::s_info = { "SVGPathSegPrototype", 0, &JSSVGPathSegPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSeg>(exec);
+    return getDOMPrototype<JSSVGPathSeg>(exec, globalObject);
 }
 
 bool JSSVGPathSegPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -173,12 +173,11 @@ JSSVGPathSeg::JSSVGPathSeg(PassRefPtr<Structure> structure, PassRefPtr<SVGPathSe
 JSSVGPathSeg::~JSSVGPathSeg()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPathSeg::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSeg::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegPrototype(JSSVGPathSegPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPathSegPrototype(JSSVGPathSegPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPathSeg::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -186,132 +185,134 @@ bool JSSVGPathSeg::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSSVGPathSeg, Base>(exec, &JSSVGPathSegTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegPathSegType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegPathSegType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSeg* imp = static_cast<SVGPathSeg*>(static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pathSegType());
 }
 
-JSValuePtr jsSVGPathSegPathSegTypeAsLetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegPathSegTypeAsLetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSeg* imp = static_cast<SVGPathSeg*>(static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathSegTypeAsLetter());
 }
 
-JSValuePtr jsSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGPathSeg::getConstructor(ExecState* exec)
+JSValue JSSVGPathSeg::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGPathSegConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGPathSegPATHSEG_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CLOSEPATH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CLOSEPATH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_MOVETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_MOVETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_MOVETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_ARC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_ARC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_ARC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_ARC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-SVGPathSeg* toSVGPathSeg(JSC::JSValuePtr value)
+SVGPathSeg* toSVGPathSeg(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPathSeg::s_info) ? static_cast<JSSVGPathSeg*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPathSeg::s_info) ? static_cast<JSSVGPathSeg*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
index f3795a19e2..f46cfd518e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
@@ -37,17 +37,17 @@ class JSSVGPathSeg : public DOMObject {
 public:
     JSSVGPathSeg(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSeg>, SVGElement* context);
     virtual ~JSSVGPathSeg();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGPathSeg* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGPathSeg > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPathSeg*, SVGElement* context);
-SVGPathSeg* toSVGPathSeg(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPathSeg*, SVGElement* context);
+SVGPathSeg* toSVGPathSeg(JSC::JSValue);
 
 class JSSVGPathSegPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,31 +75,31 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegPathSegType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPathSegTypeAsLetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPathSegType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPathSegTypeAsLetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGPathSegPATHSEG_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CLOSEPATH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_MOVETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_MOVETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_ARC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_ARC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CLOSEPATH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_ARC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_ARC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
index 20d0adbb0d..6489794dd0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcAbs);
 
 /* Hash table */
 
@@ -75,9 +75,9 @@ static const HashTable JSSVGPathSegArcAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegArcAbsPrototype::s_info = { "SVGPathSegArcAbsPrototype", 0, &JSSVGPathSegArcAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegArcAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegArcAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegArcAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegArcAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegArcAbs::s_info = { "SVGPathSegArcAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegArcAbsTable, 0 };
@@ -87,9 +87,9 @@ JSSVGPathSegArcAbs::JSSVGPathSegArcAbs(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGPathSegArcAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegArcAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegArcAbsPrototype(JSSVGPathSegArcAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegArcAbsPrototype(JSSVGPathSegArcAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegArcAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,105 +97,112 @@ bool JSSVGPathSegArcAbs::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGPathSegArcAbs, Base>(exec, &JSSVGPathSegArcAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegArcAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegArcAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegArcAbsR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r1());
 }
 
-JSValuePtr jsSVGPathSegArcAbsR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r2());
 }
 
-JSValuePtr jsSVGPathSegArcAbsAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->angle());
 }
 
-JSValuePtr jsSVGPathSegArcAbsLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->largeArcFlag());
 }
 
-JSValuePtr jsSVGPathSegArcAbsSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->sweepFlag());
 }
 
-void JSSVGPathSegArcAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegArcAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegArcAbs, Base>(exec, propertyName, value, &JSSVGPathSegArcAbsTable, this, slot);
 }
 
-void setJSSVGPathSegArcAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsR1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsR1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setR1(value->toFloat(exec));
+    imp->setR1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsR2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsR2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setR2(value->toFloat(exec));
+    imp->setR2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsAngle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsAngle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setAngle(value->toFloat(exec));
+    imp->setAngle(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setLargeArcFlag(value->toBoolean(exec));
+    imp->setLargeArcFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsSweepFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsSweepFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setSweepFlag(value->toBoolean(exec));
+    imp->setSweepFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
index a591fbd15a..dfc2cfad6f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegArcAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegArcAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegArcAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegArcAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegArcAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,20 +59,20 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegArcAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegArcAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
index f4f0a80910..daf3bff854 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcRel);
 
 /* Hash table */
 
@@ -75,9 +75,9 @@ static const HashTable JSSVGPathSegArcRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegArcRelPrototype::s_info = { "SVGPathSegArcRelPrototype", 0, &JSSVGPathSegArcRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegArcRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegArcRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegArcRel>(exec);
+    return getDOMPrototype<JSSVGPathSegArcRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegArcRel::s_info = { "SVGPathSegArcRel", &JSSVGPathSeg::s_info, &JSSVGPathSegArcRelTable, 0 };
@@ -87,9 +87,9 @@ JSSVGPathSegArcRel::JSSVGPathSegArcRel(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGPathSegArcRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegArcRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegArcRelPrototype(JSSVGPathSegArcRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegArcRelPrototype(JSSVGPathSegArcRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegArcRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,105 +97,112 @@ bool JSSVGPathSegArcRel::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGPathSegArcRel, Base>(exec, &JSSVGPathSegArcRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegArcRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegArcRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegArcRelR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r1());
 }
 
-JSValuePtr jsSVGPathSegArcRelR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r2());
 }
 
-JSValuePtr jsSVGPathSegArcRelAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->angle());
 }
 
-JSValuePtr jsSVGPathSegArcRelLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->largeArcFlag());
 }
 
-JSValuePtr jsSVGPathSegArcRelSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->sweepFlag());
 }
 
-void JSSVGPathSegArcRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegArcRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegArcRel, Base>(exec, propertyName, value, &JSSVGPathSegArcRelTable, this, slot);
 }
 
-void setJSSVGPathSegArcRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelR1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelR1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setR1(value->toFloat(exec));
+    imp->setR1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelR2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelR2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setR2(value->toFloat(exec));
+    imp->setR2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelAngle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelAngle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setAngle(value->toFloat(exec));
+    imp->setAngle(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setLargeArcFlag(value->toBoolean(exec));
+    imp->setLargeArcFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelSweepFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelSweepFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setSweepFlag(value->toBoolean(exec));
+    imp->setSweepFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
index b395fa3aad..55993a04d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegArcRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegArcRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegArcRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegArcRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegArcRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,20 +59,20 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegArcRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegArcRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
index e44bd52d2d..7952c2d2ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegClosePath)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegClosePath);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGPathSegClosePathPrototypeTable =
 
 const ClassInfo JSSVGPathSegClosePathPrototype::s_info = { "SVGPathSegClosePathPrototype", 0, &JSSVGPathSegClosePathPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegClosePathPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegClosePathPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegClosePath>(exec);
+    return getDOMPrototype<JSSVGPathSegClosePath>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegClosePath::s_info = { "SVGPathSegClosePath", &JSSVGPathSeg::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGPathSegClosePath::JSSVGPathSegClosePath(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegClosePath::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegClosePath::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegClosePathPrototype(JSSVGPathSegClosePathPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegClosePathPrototype(JSSVGPathSegClosePathPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
index a3ceb9092e..d5827bbedc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
@@ -34,7 +34,7 @@ class JSSVGPathSegClosePath : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegClosePath(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegClosePath>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGPathSegClosePathPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegClosePathPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
index f121cd16e7..2763388ab0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicAbs);
 
 /* Hash table */
 
@@ -74,9 +74,9 @@ static const HashTable JSSVGPathSegCurvetoCubicAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicAbsPrototype::s_info = { "SVGPathSegCurvetoCubicAbsPrototype", 0, &JSSVGPathSegCurvetoCubicAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicAbs::s_info = { "SVGPathSegCurvetoCubicAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicAbsTable, 0 };
@@ -86,9 +86,9 @@ JSSVGPathSegCurvetoCubicAbs::JSSVGPathSegCurvetoCubicAbs(PassRefPtr<Structure> s
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicAbsPrototype(JSSVGPathSegCurvetoCubicAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicAbsPrototype(JSSVGPathSegCurvetoCubicAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,91 +96,97 @@ bool JSSVGPathSegCurvetoCubicAbs::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicAbs, Base>(exec, &JSSVGPathSegCurvetoCubicAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
index 2d0324d174..715a0f42f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,18 +59,18 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
index 0d917ec038..4a554665a4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicRel);
 
 /* Hash table */
 
@@ -74,9 +74,9 @@ static const HashTable JSSVGPathSegCurvetoCubicRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicRelPrototype::s_info = { "SVGPathSegCurvetoCubicRelPrototype", 0, &JSSVGPathSegCurvetoCubicRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicRel::s_info = { "SVGPathSegCurvetoCubicRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicRelTable, 0 };
@@ -86,9 +86,9 @@ JSSVGPathSegCurvetoCubicRel::JSSVGPathSegCurvetoCubicRel(PassRefPtr<Structure> s
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicRelPrototype(JSSVGPathSegCurvetoCubicRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicRelPrototype(JSSVGPathSegCurvetoCubicRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,91 +96,97 @@ bool JSSVGPathSegCurvetoCubicRel::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicRel, Base>(exec, &JSSVGPathSegCurvetoCubicRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
index 65d891fd31..7738af3aa7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,18 +59,18 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
index 6c0367fc8f..9b3bbaccbc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothAbs);
 
 /* Hash table */
 
@@ -72,9 +72,9 @@ static const HashTable JSSVGPathSegCurvetoCubicSmoothAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothAbsPrototype::s_info = { "SVGPathSegCurvetoCubicSmoothAbsPrototype", 0, &JSSVGPathSegCurvetoCubicSmoothAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothAbs::s_info = { "SVGPathSegCurvetoCubicSmoothAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicSmoothAbsTable, 0 };
@@ -84,9 +84,9 @@ JSSVGPathSegCurvetoCubicSmoothAbs::JSSVGPathSegCurvetoCubicSmoothAbs(PassRefPtr<
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicSmoothAbsPrototype(JSSVGPathSegCurvetoCubicSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicSmoothAbsPrototype(JSSVGPathSegCurvetoCubicSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicSmoothAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +94,67 @@ bool JSSVGPathSegCurvetoCubicSmoothAbs::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
index a85e616877..178a4365ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicSmoothAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicSmoothAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicSmoothAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicSmoothAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicSmoothAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
index 6f98a57057..a7f132ceef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothRel);
 
 /* Hash table */
 
@@ -72,9 +72,9 @@ static const HashTable JSSVGPathSegCurvetoCubicSmoothRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothRelPrototype::s_info = { "SVGPathSegCurvetoCubicSmoothRelPrototype", 0, &JSSVGPathSegCurvetoCubicSmoothRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothRel::s_info = { "SVGPathSegCurvetoCubicSmoothRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicSmoothRelTable, 0 };
@@ -84,9 +84,9 @@ JSSVGPathSegCurvetoCubicSmoothRel::JSSVGPathSegCurvetoCubicSmoothRel(PassRefPtr<
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicSmoothRelPrototype(JSSVGPathSegCurvetoCubicSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicSmoothRelPrototype(JSSVGPathSegCurvetoCubicSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicSmoothRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +94,67 @@ bool JSSVGPathSegCurvetoCubicSmoothRel::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
index f05dd7a658..b1d41ea5ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicSmoothRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicSmoothRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicSmoothRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicSmoothRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicSmoothRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
index c4d685f5fb..9c6915119e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticAbs);
 
 /* Hash table */
 
@@ -72,9 +72,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticAbsPrototype::s_info = { "SVGPathSegCurvetoQuadraticAbsPrototype", 0, &JSSVGPathSegCurvetoQuadraticAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticAbs::s_info = { "SVGPathSegCurvetoQuadraticAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticAbsTable, 0 };
@@ -84,9 +84,9 @@ JSSVGPathSegCurvetoQuadraticAbs::JSSVGPathSegCurvetoQuadraticAbs(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticAbsPrototype(JSSVGPathSegCurvetoQuadraticAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticAbsPrototype(JSSVGPathSegCurvetoQuadraticAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +94,67 @@ bool JSSVGPathSegCurvetoQuadraticAbs::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-void JSSVGPathSegCurvetoQuadraticAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
index b07efa5454..f128df59de 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
index 98040c3b0a..7bd921d4fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticRel);
 
 /* Hash table */
 
@@ -72,9 +72,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticRelPrototype::s_info = { "SVGPathSegCurvetoQuadraticRelPrototype", 0, &JSSVGPathSegCurvetoQuadraticRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticRel::s_info = { "SVGPathSegCurvetoQuadraticRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticRelTable, 0 };
@@ -84,9 +84,9 @@ JSSVGPathSegCurvetoQuadraticRel::JSSVGPathSegCurvetoQuadraticRel(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticRelPrototype(JSSVGPathSegCurvetoQuadraticRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticRelPrototype(JSSVGPathSegCurvetoQuadraticRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +94,67 @@ bool JSSVGPathSegCurvetoQuadraticRel::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-void JSSVGPathSegCurvetoQuadraticRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
index 17c9b33405..8ae0b14021 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
index 4a150f9857..f515b93f7b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothAbs);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::s_info = { "SVGPathSegCurvetoQuadraticSmoothAbsPrototype", 0, &JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothAbs::s_info = { "SVGPathSegCurvetoQuadraticSmoothAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, 0 };
@@ -82,9 +82,9 @@ JSSVGPathSegCurvetoQuadraticSmoothAbs::JSSVGPathSegCurvetoQuadraticSmoothAbs(Pas
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticSmoothAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +92,37 @@ bool JSSVGPathSegCurvetoQuadraticSmoothAbs::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegCurvetoQuadraticSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
index 95b5271d14..684dccef4b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticSmoothAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticSmoothAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
index d2d2fe88a8..4eb0e14931 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothRel);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::s_info = { "SVGPathSegCurvetoQuadraticSmoothRelPrototype", 0, &JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothRel::s_info = { "SVGPathSegCurvetoQuadraticSmoothRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, 0 };
@@ -82,9 +82,9 @@ JSSVGPathSegCurvetoQuadraticSmoothRel::JSSVGPathSegCurvetoQuadraticSmoothRel(Pas
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticSmoothRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +92,37 @@ bool JSSVGPathSegCurvetoQuadraticSmoothRel::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegCurvetoQuadraticSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
index b05a572a3e..6d3da03dde 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticSmoothRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticSmoothRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticSmoothRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
index cb5c8285f6..8021f72d7f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoAbs);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGPathSegLinetoAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoAbsPrototype::s_info = { "SVGPathSegLinetoAbsPrototype", 0, &JSSVGPathSegLinetoAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoAbs::s_info = { "SVGPathSegLinetoAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoAbsTable, 0 };
@@ -82,9 +82,9 @@ JSSVGPathSegLinetoAbs::JSSVGPathSegLinetoAbs(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegLinetoAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoAbsPrototype(JSSVGPathSegLinetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoAbsPrototype(JSSVGPathSegLinetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +92,37 @@ bool JSSVGPathSegLinetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegLinetoAbs, Base>(exec, &JSSVGPathSegLinetoAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegLinetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoAbsTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegLinetoAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
index 3ba97a8d24..4f83e6ae51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegLinetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
index 9146742dd9..cc868c881f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalAbs);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGPathSegLinetoHorizontalAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoHorizontalAbsPrototype::s_info = { "SVGPathSegLinetoHorizontalAbsPrototype", 0, &JSSVGPathSegLinetoHorizontalAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoHorizontalAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoHorizontalAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoHorizontalAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoHorizontalAbs::s_info = { "SVGPathSegLinetoHorizontalAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoHorizontalAbsTable, 0 };
@@ -81,9 +81,9 @@ JSSVGPathSegLinetoHorizontalAbs::JSSVGPathSegLinetoHorizontalAbs(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegLinetoHorizontalAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoHorizontalAbsPrototype(JSSVGPathSegLinetoHorizontalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoHorizontalAbsPrototype(JSSVGPathSegLinetoHorizontalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoHorizontalAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +91,22 @@ bool JSSVGPathSegLinetoHorizontalAbs::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, &JSSVGPathSegLinetoHorizontalAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoHorizontalAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoHorizontalAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoHorizontalAbs* imp = static_cast<SVGPathSegLinetoHorizontalAbs*>(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-void JSSVGPathSegLinetoHorizontalAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoHorizontalAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoHorizontalAbsTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoHorizontalAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoHorizontalAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoHorizontalAbs* imp = static_cast<SVGPathSegLinetoHorizontalAbs*>(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
index 65837175c9..733a66a208 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoHorizontalAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoHorizontalAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoHorizontalAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoHorizontalAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoHorizontalAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
index 925a07a65d..e222c2dd99 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalRel);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGPathSegLinetoHorizontalRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoHorizontalRelPrototype::s_info = { "SVGPathSegLinetoHorizontalRelPrototype", 0, &JSSVGPathSegLinetoHorizontalRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoHorizontalRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoHorizontalRel>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoHorizontalRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoHorizontalRel::s_info = { "SVGPathSegLinetoHorizontalRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoHorizontalRelTable, 0 };
@@ -81,9 +81,9 @@ JSSVGPathSegLinetoHorizontalRel::JSSVGPathSegLinetoHorizontalRel(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegLinetoHorizontalRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoHorizontalRelPrototype(JSSVGPathSegLinetoHorizontalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoHorizontalRelPrototype(JSSVGPathSegLinetoHorizontalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoHorizontalRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +91,22 @@ bool JSSVGPathSegLinetoHorizontalRel::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegLinetoHorizontalRel, Base>(exec, &JSSVGPathSegLinetoHorizontalRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoHorizontalRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoHorizontalRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoHorizontalRel* imp = static_cast<SVGPathSegLinetoHorizontalRel*>(static_cast<JSSVGPathSegLinetoHorizontalRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-void JSSVGPathSegLinetoHorizontalRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoHorizontalRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoHorizontalRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoHorizontalRelTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoHorizontalRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoHorizontalRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoHorizontalRel* imp = static_cast<SVGPathSegLinetoHorizontalRel*>(static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
index 66e5d31c18..252653e27f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoHorizontalRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoHorizontalRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoHorizontalRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoHorizontalRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoHorizontalRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
index 37efb942f2..742f362dba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoRel);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGPathSegLinetoRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoRelPrototype::s_info = { "SVGPathSegLinetoRelPrototype", 0, &JSSVGPathSegLinetoRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoRel>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoRel::s_info = { "SVGPathSegLinetoRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoRelTable, 0 };
@@ -82,9 +82,9 @@ JSSVGPathSegLinetoRel::JSSVGPathSegLinetoRel(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegLinetoRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoRelPrototype(JSSVGPathSegLinetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoRelPrototype(JSSVGPathSegLinetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +92,37 @@ bool JSSVGPathSegLinetoRel::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegLinetoRel, Base>(exec, &JSSVGPathSegLinetoRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegLinetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoRelTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegLinetoRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
index b0ec02e0a4..1604c746b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegLinetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
index aa9cba20ca..4d9cbb8e05 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalAbs);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGPathSegLinetoVerticalAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoVerticalAbsPrototype::s_info = { "SVGPathSegLinetoVerticalAbsPrototype", 0, &JSSVGPathSegLinetoVerticalAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoVerticalAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoVerticalAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoVerticalAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoVerticalAbs::s_info = { "SVGPathSegLinetoVerticalAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoVerticalAbsTable, 0 };
@@ -81,9 +81,9 @@ JSSVGPathSegLinetoVerticalAbs::JSSVGPathSegLinetoVerticalAbs(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGPathSegLinetoVerticalAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoVerticalAbsPrototype(JSSVGPathSegLinetoVerticalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoVerticalAbsPrototype(JSSVGPathSegLinetoVerticalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoVerticalAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +91,22 @@ bool JSSVGPathSegLinetoVerticalAbs::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGPathSegLinetoVerticalAbs, Base>(exec, &JSSVGPathSegLinetoVerticalAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoVerticalAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoVerticalAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoVerticalAbs* imp = static_cast<SVGPathSegLinetoVerticalAbs*>(static_cast<JSSVGPathSegLinetoVerticalAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoVerticalAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoVerticalAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoVerticalAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoVerticalAbsTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoVerticalAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoVerticalAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoVerticalAbs* imp = static_cast<SVGPathSegLinetoVerticalAbs*>(static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
index 52f48f655b..3585ae4092 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoVerticalAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoVerticalAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoVerticalAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoVerticalAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoVerticalAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
index e0b8b2b85d..c6681850d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalRel);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGPathSegLinetoVerticalRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoVerticalRelPrototype::s_info = { "SVGPathSegLinetoVerticalRelPrototype", 0, &JSSVGPathSegLinetoVerticalRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoVerticalRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoVerticalRel>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoVerticalRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoVerticalRel::s_info = { "SVGPathSegLinetoVerticalRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoVerticalRelTable, 0 };
@@ -81,9 +81,9 @@ JSSVGPathSegLinetoVerticalRel::JSSVGPathSegLinetoVerticalRel(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGPathSegLinetoVerticalRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoVerticalRelPrototype(JSSVGPathSegLinetoVerticalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoVerticalRelPrototype(JSSVGPathSegLinetoVerticalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoVerticalRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +91,22 @@ bool JSSVGPathSegLinetoVerticalRel::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGPathSegLinetoVerticalRel, Base>(exec, &JSSVGPathSegLinetoVerticalRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoVerticalRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoVerticalRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoVerticalRel* imp = static_cast<SVGPathSegLinetoVerticalRel*>(static_cast<JSSVGPathSegLinetoVerticalRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoVerticalRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoVerticalRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoVerticalRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoVerticalRelTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoVerticalRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoVerticalRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoVerticalRel* imp = static_cast<SVGPathSegLinetoVerticalRel*>(static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
index 0cdb26b9fd..4b7f295992 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoVerticalRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoVerticalRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoVerticalRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoVerticalRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoVerticalRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoVerticalRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoVerticalRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoVerticalRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoVerticalRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
index 069f6d9c7b..f7877e87a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegList);
 
 /* Hash table */
 
@@ -78,9 +78,9 @@ static const HashTable JSSVGPathSegListPrototypeTable =
 
 const ClassInfo JSSVGPathSegListPrototype::s_info = { "SVGPathSegListPrototype", 0, &JSSVGPathSegListPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegListPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegList>(exec);
+    return getDOMPrototype<JSSVGPathSegList>(exec, globalObject);
 }
 
 bool JSSVGPathSegListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,12 +100,11 @@ JSSVGPathSegList::JSSVGPathSegList(PassRefPtr<Structure> structure, PassRefPtr<S
 JSSVGPathSegList::~JSSVGPathSegList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPathSegList::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegListPrototype(JSSVGPathSegListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPathSegListPrototype(JSSVGPathSegListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPathSegList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -113,75 +112,83 @@ bool JSSVGPathSegList::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGPathSegList, Base>(exec, &JSSVGPathSegListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(static_cast<JSSVGPathSegList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGPathSegList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGPathSegList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPathSegList>(exec, object, context);
 }
-SVGPathSegList* toSVGPathSegList(JSC::JSValuePtr value)
+SVGPathSegList* toSVGPathSegList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPathSegList::s_info) ? static_cast<JSSVGPathSegList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPathSegList::s_info) ? static_cast<JSSVGPathSegList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
index 39a741e5b6..3faf15d8bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
@@ -37,25 +37,25 @@ class JSSVGPathSegList : public DOMObject {
 public:
     JSSVGPathSegList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegList>, SVGElement* context);
     virtual ~JSSVGPathSegList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
     SVGPathSegList* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -64,16 +64,17 @@ private:
     RefPtr<SVGPathSegList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPathSegList*, SVGElement* context);
-SVGPathSegList* toSVGPathSegList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPathSegList*, SVGElement* context);
+SVGPathSegList* toSVGPathSegList(JSC::JSValue);
 
 class JSSVGPathSegListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,16 +83,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
index 9673c45358..9df40008af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoAbs);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGPathSegMovetoAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegMovetoAbsPrototype::s_info = { "SVGPathSegMovetoAbsPrototype", 0, &JSSVGPathSegMovetoAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegMovetoAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegMovetoAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegMovetoAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegMovetoAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegMovetoAbs::s_info = { "SVGPathSegMovetoAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegMovetoAbsTable, 0 };
@@ -82,9 +82,9 @@ JSSVGPathSegMovetoAbs::JSSVGPathSegMovetoAbs(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegMovetoAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegMovetoAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegMovetoAbsPrototype(JSSVGPathSegMovetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegMovetoAbsPrototype(JSSVGPathSegMovetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegMovetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +92,37 @@ bool JSSVGPathSegMovetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegMovetoAbs, Base>(exec, &JSSVGPathSegMovetoAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegMovetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegMovetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegMovetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegMovetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegMovetoAbs, Base>(exec, propertyName, value, &JSSVGPathSegMovetoAbsTable, this, slot);
 }
 
-void setJSSVGPathSegMovetoAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegMovetoAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
index 1dffdfb3a2..8a112bf649 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
@@ -34,13 +34,13 @@ class JSSVGPathSegMovetoAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegMovetoAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegMovetoAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegMovetoAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegMovetoAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegMovetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegMovetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegMovetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegMovetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
index 5ef4069172..70ef82a297 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoRel);
 
 /* Hash table */
 
@@ -70,9 +70,9 @@ static const HashTable JSSVGPathSegMovetoRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegMovetoRelPrototype::s_info = { "SVGPathSegMovetoRelPrototype", 0, &JSSVGPathSegMovetoRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegMovetoRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegMovetoRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegMovetoRel>(exec);
+    return getDOMPrototype<JSSVGPathSegMovetoRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegMovetoRel::s_info = { "SVGPathSegMovetoRel", &JSSVGPathSeg::s_info, &JSSVGPathSegMovetoRelTable, 0 };
@@ -82,9 +82,9 @@ JSSVGPathSegMovetoRel::JSSVGPathSegMovetoRel(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegMovetoRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegMovetoRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegMovetoRelPrototype(JSSVGPathSegMovetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegMovetoRelPrototype(JSSVGPathSegMovetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegMovetoRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +92,37 @@ bool JSSVGPathSegMovetoRel::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegMovetoRel, Base>(exec, &JSSVGPathSegMovetoRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegMovetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegMovetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegMovetoRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegMovetoRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegMovetoRel, Base>(exec, propertyName, value, &JSSVGPathSegMovetoRelTable, this, slot);
 }
 
-void setJSSVGPathSegMovetoRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegMovetoRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
index 2027c3f8f0..2e1c91cdcf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
@@ -34,13 +34,13 @@ class JSSVGPathSegMovetoRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegMovetoRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegMovetoRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegMovetoRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegMovetoRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegMovetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegMovetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegMovetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegMovetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
index 35353d49fe..0cd9b52a4b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
@@ -52,7 +52,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPatternElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPatternElement);
 
 /* Hash table */
 
@@ -104,9 +104,9 @@ static const HashTable JSSVGPatternElementPrototypeTable =
 
 const ClassInfo JSSVGPatternElementPrototype::s_info = { "SVGPatternElementPrototype", 0, &JSSVGPatternElementPrototypeTable, 0 };
 
-JSObject* JSSVGPatternElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPatternElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPatternElement>(exec);
+    return getDOMPrototype<JSSVGPatternElement>(exec, globalObject);
 }
 
 bool JSSVGPatternElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -121,9 +121,9 @@ JSSVGPatternElement::JSSVGPatternElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGPatternElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPatternElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPatternElementPrototype(JSSVGPatternElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPatternElementPrototype(JSSVGPatternElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPatternElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,166 +131,186 @@ bool JSSVGPatternElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPatternElement, Base>(exec, &JSSVGPatternElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPatternElementPatternUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->patternUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementPatternContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->patternContentUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementPatternTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->patternTransformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPatternElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPatternElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPatternElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPatternElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPatternElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPatternElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGPatternElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPatternElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPatternElement, Base>(exec, propertyName, value, &JSSVGPatternElementTable, this, slot);
 }
 
-void setJSSVGPatternElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPatternElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPatternElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPatternElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPatternElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPatternElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPatternElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(asObject(thisValue));
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPatternElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPatternElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(asObject(thisValue));
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
index 6d11bc1c51..10efc5259d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
@@ -34,13 +34,13 @@ class JSSVGPatternElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPatternElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPatternElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPatternElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,30 +64,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPatternElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPatternElementPatternUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementPatternContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementPatternTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPatternElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPatternElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPatternElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPatternElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPatternUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPatternContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPatternTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPatternElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPatternElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPatternElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPatternElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
index 633745cb06..b587ac93c8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPoint)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPoint);
 
 /* Hash table */
 
@@ -73,9 +73,9 @@ static const HashTable JSSVGPointPrototypeTable =
 
 const ClassInfo JSSVGPointPrototype::s_info = { "SVGPointPrototype", 0, &JSSVGPointPrototypeTable, 0 };
 
-JSObject* JSSVGPointPrototype::self(ExecState* exec)
+JSObject* JSSVGPointPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPoint>(exec);
+    return getDOMPrototype<JSSVGPoint>(exec, globalObject);
 }
 
 bool JSSVGPointPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,12 +95,11 @@ JSSVGPoint::JSSVGPoint(PassRefPtr<Structure> structure, PassRefPtr<JSSVGPODTypeW
 JSSVGPoint::~JSSVGPoint()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPoint::createPrototype(ExecState* exec)
+JSObject* JSSVGPoint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPointPrototype(JSSVGPointPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPointPrototype(JSSVGPointPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPoint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,59 +107,62 @@ bool JSSVGPoint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGPoint, Base>(exec, &JSSVGPointTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatPoint imp(*static_cast<JSSVGPoint*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.x());
 }
 
-JSValuePtr jsSVGPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatPoint imp(*static_cast<JSSVGPoint*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.y());
 }
 
-void JSSVGPoint::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPoint::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPoint, Base>(exec, propertyName, value, &JSSVGPointTable, this, slot);
 }
 
-void setJSSVGPointX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPointX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatPoint imp(*static_cast<JSSVGPoint*>(thisObject)->impl());
-    imp.setX(value->toFloat(exec));
+    imp.setX(value.toFloat(exec));
         static_cast<JSSVGPoint*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGPoint*>(thisObject)->context());
 }
 
-void setJSSVGPointY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPointY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatPoint imp(*static_cast<JSSVGPoint*>(thisObject)->impl());
-    imp.setY(value->toFloat(exec));
+    imp.setY(value.toFloat(exec));
         static_cast<JSSVGPoint*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGPoint*>(thisObject)->context());
 }
 
-JSValuePtr jsSVGPointPrototypeFunctionMatrixTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPoint::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPoint::s_info))
         return throwError(exec, TypeError);
     JSSVGPoint* castedThisObj = static_cast<JSSVGPoint*>(asObject(thisValue));
     JSSVGPODTypeWrapper<FloatPoint>* wrapper = castedThisObj->impl();
     FloatPoint imp(*wrapper);
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp.matrixTransform(matrix)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp.matrixTransform(matrix)).get(), castedThisObj->context());
     wrapper->commitChange(imp, castedThisObj->context());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatPoint>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatPoint>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPoint, JSSVGPODTypeWrapper<FloatPoint> >(exec, object, context);
 }
-FloatPoint toSVGPoint(JSC::JSValuePtr value)
+FloatPoint toSVGPoint(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPoint::s_info) ? (FloatPoint) *static_cast<JSSVGPoint*>(asObject(value))->impl() : FloatPoint();
+    return value.isObject(&JSSVGPoint::s_info) ? (FloatPoint) *static_cast<JSSVGPoint*>(asObject(value))->impl() : FloatPoint();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
index fae362a5f3..0973a867e7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
@@ -37,13 +37,13 @@ class JSSVGPoint : public DOMObject {
 public:
     JSSVGPoint(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<FloatPoint> >, SVGElement* context);
     virtual ~JSSVGPoint();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -56,16 +56,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<FloatPoint> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement* context);
-FloatPoint toSVGPoint(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement* context);
+FloatPoint toSVGPoint(JSC::JSValue);
 
 class JSSVGPointPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,13 +75,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPointPrototypeFunctionMatrixTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
index 7eebc21368..4dd7afd8f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPointList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPointList);
 
 /* Hash table */
 
@@ -77,9 +77,9 @@ static const HashTable JSSVGPointListPrototypeTable =
 
 const ClassInfo JSSVGPointListPrototype::s_info = { "SVGPointListPrototype", 0, &JSSVGPointListPrototypeTable, 0 };
 
-JSObject* JSSVGPointListPrototype::self(ExecState* exec)
+JSObject* JSSVGPointListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPointList>(exec);
+    return getDOMPrototype<JSSVGPointList>(exec, globalObject);
 }
 
 bool JSSVGPointListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,12 +99,11 @@ JSSVGPointList::JSSVGPointList(PassRefPtr<Structure> structure, PassRefPtr<SVGPo
 JSSVGPointList::~JSSVGPointList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPointList::createPrototype(ExecState* exec)
+JSObject* JSSVGPointList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPointListPrototype(JSSVGPointListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPointListPrototype(JSSVGPointListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPointList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -112,75 +111,83 @@ bool JSSVGPointList::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGPointList, Base>(exec, &JSSVGPointListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPointListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPointList* imp = static_cast<SVGPointList*>(static_cast<JSSVGPointList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGPointList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGPointList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPointList>(exec, object, context);
 }
-SVGPointList* toSVGPointList(JSC::JSValuePtr value)
+SVGPointList* toSVGPointList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPointList::s_info) ? static_cast<JSSVGPointList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPointList::s_info) ? static_cast<JSSVGPointList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
index c28355a653..58bf1e1351 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
@@ -37,25 +37,25 @@ class JSSVGPointList : public DOMObject {
 public:
     JSSVGPointList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPointList>, SVGElement* context);
     virtual ~JSSVGPointList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
     SVGPointList* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -64,16 +64,17 @@ private:
     RefPtr<SVGPointList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPointList*, SVGElement* context);
-SVGPointList* toSVGPointList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPointList*, SVGElement* context);
+SVGPointList* toSVGPointList(JSC::JSValue);
 
 class JSSVGPointListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,16 +83,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPointListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPointListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
index 15ccd91902..eed0da75ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
@@ -54,7 +54,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPolygonElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPolygonElement);
 
 /* Hash table */
 
@@ -105,9 +105,9 @@ static const HashTable JSSVGPolygonElementPrototypeTable =
 
 const ClassInfo JSSVGPolygonElementPrototype::s_info = { "SVGPolygonElementPrototype", 0, &JSSVGPolygonElementPrototypeTable, 0 };
 
-JSObject* JSSVGPolygonElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPolygonElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPolygonElement>(exec);
+    return getDOMPrototype<JSSVGPolygonElement>(exec, globalObject);
 }
 
 bool JSSVGPolygonElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -122,9 +122,9 @@ JSSVGPolygonElement::JSSVGPolygonElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGPolygonElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPolygonElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPolygonElementPrototype(JSSVGPolygonElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPolygonElementPrototype(JSSVGPolygonElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPolygonElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,177 +132,196 @@ bool JSSVGPolygonElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPolygonElement, Base>(exec, &JSSVGPolygonElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPolygonElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPolygonElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPolygonElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolygonElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolygonElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPolygonElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolygonElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGPolygonElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGPolygonElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->points()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedPoints()), imp);
 }
 
-void JSSVGPolygonElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPolygonElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPolygonElement, Base>(exec, propertyName, value, &JSSVGPolygonElementTable, this, slot);
 }
 
-void setJSSVGPolygonElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolygonElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPolygonElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolygonElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
index f98722fd01..31fab27f53 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
@@ -34,13 +34,13 @@ class JSSVGPolygonElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPolygonElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPolygonElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPolygonElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPolygonElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolygonElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolygonElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolygonElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolygonElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolygonElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolygonElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolygonElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolygonElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
index 19fe95abc1..3dc8332db0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
@@ -54,7 +54,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPolylineElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPolylineElement);
 
 /* Hash table */
 
@@ -105,9 +105,9 @@ static const HashTable JSSVGPolylineElementPrototypeTable =
 
 const ClassInfo JSSVGPolylineElementPrototype::s_info = { "SVGPolylineElementPrototype", 0, &JSSVGPolylineElementPrototypeTable, 0 };
 
-JSObject* JSSVGPolylineElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPolylineElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPolylineElement>(exec);
+    return getDOMPrototype<JSSVGPolylineElement>(exec, globalObject);
 }
 
 bool JSSVGPolylineElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -122,9 +122,9 @@ JSSVGPolylineElement::JSSVGPolylineElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGPolylineElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPolylineElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPolylineElementPrototype(JSSVGPolylineElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPolylineElementPrototype(JSSVGPolylineElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPolylineElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,177 +132,196 @@ bool JSSVGPolylineElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPolylineElement, Base>(exec, &JSSVGPolylineElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPolylineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPolylineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPolylineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolylineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolylineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPolylineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolylineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGPolylineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGPolylineElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->points()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedPoints()), imp);
 }
 
-void JSSVGPolylineElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPolylineElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPolylineElement, Base>(exec, propertyName, value, &JSSVGPolylineElementTable, this, slot);
 }
 
-void setJSSVGPolylineElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolylineElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPolylineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolylineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
index 11f3cd4ddd..d20ea8bf16 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
@@ -34,13 +34,13 @@ class JSSVGPolylineElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPolylineElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPolylineElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPolylineElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPolylineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolylineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolylineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolylineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolylineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolylineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolylineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolylineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolylineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
index 4ddc1b9065..98c81798ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPreserveAspectRatio)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPreserveAspectRatio);
 
 /* Hash table */
 
@@ -88,13 +88,13 @@ public:
     JSSVGPreserveAspectRatioConstructor(ExecState* exec)
         : DOMObject(JSSVGPreserveAspectRatioConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGPreserveAspectRatioPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGPreserveAspectRatioPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -137,9 +137,9 @@ static const HashTable JSSVGPreserveAspectRatioPrototypeTable =
 
 const ClassInfo JSSVGPreserveAspectRatioPrototype::s_info = { "SVGPreserveAspectRatioPrototype", 0, &JSSVGPreserveAspectRatioPrototypeTable, 0 };
 
-JSObject* JSSVGPreserveAspectRatioPrototype::self(ExecState* exec)
+JSObject* JSSVGPreserveAspectRatioPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPreserveAspectRatio>(exec);
+    return getDOMPrototype<JSSVGPreserveAspectRatio>(exec, globalObject);
 }
 
 bool JSSVGPreserveAspectRatioPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -159,12 +159,11 @@ JSSVGPreserveAspectRatio::JSSVGPreserveAspectRatio(PassRefPtr<Structure> structu
 JSSVGPreserveAspectRatio::~JSSVGPreserveAspectRatio()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPreserveAspectRatio::createPrototype(ExecState* exec)
+JSObject* JSSVGPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPreserveAspectRatioPrototype(JSSVGPreserveAspectRatioPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPreserveAspectRatioPrototype(JSSVGPreserveAspectRatioPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -172,127 +171,129 @@ bool JSSVGPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGPreserveAspectRatio, Base>(exec, &JSSVGPreserveAspectRatioTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPreserveAspectRatioAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->align());
 }
 
-JSValuePtr jsSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->meetOrSlice());
 }
 
-JSValuePtr jsSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGPreserveAspectRatio::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPreserveAspectRatio::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPreserveAspectRatio, Base>(exec, propertyName, value, &JSSVGPreserveAspectRatioTable, this, slot);
 }
 
-void setJSSVGPreserveAspectRatioAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPreserveAspectRatioAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl());
-    imp->setAlign(value->toInt32(exec));
+    imp->setAlign(value.toInt32(exec));
     if (static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context())
         static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl());
-    imp->setMeetOrSlice(value->toInt32(exec));
+    imp->setMeetOrSlice(value.toInt32(exec));
     if (static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context())
         static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSValuePtr JSSVGPreserveAspectRatio::getConstructor(ExecState* exec)
+JSValue JSSVGPreserveAspectRatio::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGPreserveAspectRatioConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGPreserveAspectRatio* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGPreserveAspectRatio* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPreserveAspectRatio>(exec, object, context);
 }
-SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValuePtr value)
+SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPreserveAspectRatio::s_info) ? static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPreserveAspectRatio::s_info) ? static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
index c16f2cee5f..6e92b5c980 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
@@ -37,18 +37,18 @@ class JSSVGPreserveAspectRatio : public DOMObject {
 public:
     JSSVGPreserveAspectRatio(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPreserveAspectRatio>, SVGElement* context);
     virtual ~JSSVGPreserveAspectRatio();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGPreserveAspectRatio* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -57,16 +57,17 @@ private:
     RefPtr<SVGPreserveAspectRatio > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPreserveAspectRatio*, SVGElement* context);
-SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPreserveAspectRatio*, SVGElement* context);
+SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValue);
 
 class JSSVGPreserveAspectRatioPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,27 +76,27 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPreserveAspectRatioAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPreserveAspectRatioAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPreserveAspectRatioAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
index 309f66e9e3..cb7b87a01f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRadialGradientElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRadialGradientElement);
 
 /* Hash table */
 
@@ -73,9 +73,9 @@ static const HashTable JSSVGRadialGradientElementPrototypeTable =
 
 const ClassInfo JSSVGRadialGradientElementPrototype::s_info = { "SVGRadialGradientElementPrototype", 0, &JSSVGRadialGradientElementPrototypeTable, 0 };
 
-JSObject* JSSVGRadialGradientElementPrototype::self(ExecState* exec)
+JSObject* JSSVGRadialGradientElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRadialGradientElement>(exec);
+    return getDOMPrototype<JSSVGRadialGradientElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGRadialGradientElement::s_info = { "SVGRadialGradientElement", &JSSVGGradientElement::s_info, &JSSVGRadialGradientElementTable, 0 };
@@ -85,9 +85,9 @@ JSSVGRadialGradientElement::JSSVGRadialGradientElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGRadialGradientElement::createPrototype(ExecState* exec)
+JSObject* JSSVGRadialGradientElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRadialGradientElementPrototype(JSSVGRadialGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec)));
+    return new (exec) JSSVGRadialGradientElementPrototype(JSSVGRadialGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGRadialGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,36 +95,41 @@ bool JSSVGRadialGradientElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGRadialGradientElement, Base>(exec, &JSSVGRadialGradientElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRadialGradientElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementFx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementFx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->fxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementFy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementFy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->fyAnimated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
index e8f853e996..fdd7ce356e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
@@ -34,12 +34,12 @@ class JSSVGRadialGradientElement : public JSSVGGradientElement {
     typedef JSSVGGradientElement Base;
 public:
     JSSVGRadialGradientElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGRadialGradientElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGRadialGradientElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGRadialGradientElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGRadialGradientElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementFx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementFy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementFx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementFy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
index d343a68227..826dad5b98 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRect)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRect);
 
 /* Hash table */
 
@@ -71,9 +71,9 @@ static const HashTable JSSVGRectPrototypeTable =
 
 const ClassInfo JSSVGRectPrototype::s_info = { "SVGRectPrototype", 0, &JSSVGRectPrototypeTable, 0 };
 
-JSObject* JSSVGRectPrototype::self(ExecState* exec)
+JSObject* JSSVGRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRect>(exec);
+    return getDOMPrototype<JSSVGRect>(exec, globalObject);
 }
 
 const ClassInfo JSSVGRect::s_info = { "SVGRect", 0, &JSSVGRectTable, 0 };
@@ -89,12 +89,11 @@ JSSVGRect::~JSSVGRect()
 {
     JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::forgetWrapper(m_impl.get());
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGRect::createPrototype(ExecState* exec)
+JSObject* JSSVGRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRectPrototype(JSSVGRectPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGRectPrototype(JSSVGRectPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -102,70 +101,74 @@ bool JSSVGRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSSVGRect, Base>(exec, &JSSVGRectTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRectX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.x());
 }
 
-JSValuePtr jsSVGRectY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.y());
 }
 
-JSValuePtr jsSVGRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.width());
 }
 
-JSValuePtr jsSVGRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.height());
 }
 
-void JSSVGRect::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGRect::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGRect, Base>(exec, propertyName, value, &JSSVGRectTable, this, slot);
 }
 
-void setJSSVGRectX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setX(value->toFloat(exec));
+    imp.setX(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-void setJSSVGRectY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setY(value->toFloat(exec));
+    imp.setY(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-void setJSSVGRectWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setWidth(value->toFloat(exec));
+    imp.setWidth(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-void setJSSVGRectHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setHeight(value->toFloat(exec));
+    imp.setHeight(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatRect>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatRect>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGRect, JSSVGPODTypeWrapper<FloatRect> >(exec, object, context);
 }
-FloatRect toSVGRect(JSC::JSValuePtr value)
+FloatRect toSVGRect(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGRect::s_info) ? (FloatRect) *static_cast<JSSVGRect*>(asObject(value))->impl() : FloatRect();
+    return value.isObject(&JSSVGRect::s_info) ? (FloatRect) *static_cast<JSSVGRect*>(asObject(value))->impl() : FloatRect();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
index 3e85f5de4e..0eefd7ce4f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
@@ -37,13 +37,13 @@ class JSSVGRect : public DOMObject {
 public:
     JSSVGRect(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<FloatRect> >, SVGElement* context);
     virtual ~JSSVGRect();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -56,12 +56,13 @@ private:
     RefPtr<JSSVGPODTypeWrapper<FloatRect> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement* context);
-FloatRect toSVGRect(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement* context);
+FloatRect toSVGRect(JSC::JSValue);
 
 class JSSVGRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -69,14 +70,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGRectX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGRectX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
index 6fac4c5731..d04e192b96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
@@ -53,7 +53,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRectElement);
 
 /* Hash table */
 
@@ -108,9 +108,9 @@ static const HashTable JSSVGRectElementPrototypeTable =
 
 const ClassInfo JSSVGRectElementPrototype::s_info = { "SVGRectElementPrototype", 0, &JSSVGRectElementPrototypeTable, 0 };
 
-JSObject* JSSVGRectElementPrototype::self(ExecState* exec)
+JSObject* JSSVGRectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRectElement>(exec);
+    return getDOMPrototype<JSSVGRectElement>(exec, globalObject);
 }
 
 bool JSSVGRectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,9 +125,9 @@ JSSVGRectElement::JSSVGRectElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGRectElement::createPrototype(ExecState* exec)
+JSObject* JSSVGRectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRectElementPrototype(JSSVGRectElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGRectElementPrototype(JSSVGRectElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGRectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,207 +135,230 @@ bool JSSVGRectElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGRectElement, Base>(exec, &JSSVGRectElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->ryAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGRectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGRectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGRectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGRectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGRectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGRectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGRectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGRectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGRectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGRectElement, Base>(exec, propertyName, value, &JSSVGRectElementTable, this, slot);
 }
 
-void setJSSVGRectElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGRectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
index f4bb5a9bcb..619f252d4b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
@@ -34,13 +34,13 @@ class JSSVGRectElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGRectElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGRectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGRectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,33 +64,33 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGRectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
index e4f1ca4d69..d0c0223006 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRenderingIntent)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRenderingIntent);
 
 /* Hash table */
 
@@ -78,13 +78,13 @@ public:
     JSSVGRenderingIntentConstructor(ExecState* exec)
         : DOMObject(JSSVGRenderingIntentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGRenderingIntentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGRenderingIntentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -119,9 +119,9 @@ static const HashTable JSSVGRenderingIntentPrototypeTable =
 
 const ClassInfo JSSVGRenderingIntentPrototype::s_info = { "SVGRenderingIntentPrototype", 0, &JSSVGRenderingIntentPrototypeTable, 0 };
 
-JSObject* JSSVGRenderingIntentPrototype::self(ExecState* exec)
+JSObject* JSSVGRenderingIntentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRenderingIntent>(exec);
+    return getDOMPrototype<JSSVGRenderingIntent>(exec, globalObject);
 }
 
 bool JSSVGRenderingIntentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,12 +141,11 @@ JSSVGRenderingIntent::JSSVGRenderingIntent(PassRefPtr<Structure> structure, Pass
 JSSVGRenderingIntent::~JSSVGRenderingIntent()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGRenderingIntent::createPrototype(ExecState* exec)
+JSObject* JSSVGRenderingIntent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRenderingIntentPrototype(JSSVGRenderingIntentPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGRenderingIntentPrototype(JSSVGRenderingIntentPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGRenderingIntent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,54 +153,54 @@ bool JSSVGRenderingIntent::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGRenderingIntent, Base>(exec, &JSSVGRenderingIntentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGRenderingIntent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGRenderingIntent::getConstructor(ExecState* exec)
+JSValue JSSVGRenderingIntent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGRenderingIntentConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_SATURATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGRenderingIntent* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGRenderingIntent* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGRenderingIntent>(exec, object, context);
 }
-SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValuePtr value)
+SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGRenderingIntent::s_info) ? static_cast<JSSVGRenderingIntent*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGRenderingIntent::s_info) ? static_cast<JSSVGRenderingIntent*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
index 9a60929281..14b8801191 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
@@ -37,17 +37,17 @@ class JSSVGRenderingIntent : public DOMObject {
 public:
     JSSVGRenderingIntent(PassRefPtr<JSC::Structure>, PassRefPtr<SVGRenderingIntent>, SVGElement* context);
     virtual ~JSSVGRenderingIntent();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGRenderingIntent* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGRenderingIntent > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGRenderingIntent*, SVGElement* context);
-SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGRenderingIntent*, SVGElement* context);
+SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValue);
 
 class JSSVGRenderingIntentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,15 +75,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_SATURATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
index f7dc4c23f4..39070b6c32 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
@@ -67,7 +67,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSVGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSVGElement);
 
 /* Hash table */
 
@@ -157,9 +157,9 @@ static const HashTable JSSVGSVGElementPrototypeTable =
 
 const ClassInfo JSSVGSVGElementPrototype::s_info = { "SVGSVGElementPrototype", 0, &JSSVGSVGElementPrototypeTable, 0 };
 
-JSObject* JSSVGSVGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSVGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSVGElement>(exec);
+    return getDOMPrototype<JSSVGSVGElement>(exec, globalObject);
 }
 
 bool JSSVGSVGElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,9 +174,9 @@ JSSVGSVGElement::JSSVGSVGElement(PassRefPtr<Structure> structure, PassRefPtr<SVG
 {
 }
 
-JSObject* JSSVGSVGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSVGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSVGElementPrototype(JSSVGSVGElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGSVGElementPrototype(JSSVGSVGElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -184,253 +184,283 @@ bool JSSVGSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGSVGElement, Base>(exec, &JSSVGSVGElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGSVGElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementContentScriptType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementContentScriptType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->contentScriptType());
 }
 
-JSValuePtr jsSVGSVGElementContentStyleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementContentStyleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->contentStyleType());
 }
 
-JSValuePtr jsSVGSVGElementViewport(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementViewport(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->viewport()).get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementPixelUnitToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPixelUnitToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pixelUnitToMillimeterX());
 }
 
-JSValuePtr jsSVGSVGElementPixelUnitToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPixelUnitToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pixelUnitToMillimeterY());
 }
 
-JSValuePtr jsSVGSVGElementScreenPixelToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementScreenPixelToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenPixelToMillimeterX());
 }
 
-JSValuePtr jsSVGSVGElementScreenPixelToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementScreenPixelToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenPixelToMillimeterY());
 }
 
-JSValuePtr jsSVGSVGElementUseCurrentView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementUseCurrentView(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->useCurrentView());
 }
 
-JSValuePtr jsSVGSVGElementCurrentScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementCurrentScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->currentScale());
 }
 
-JSValuePtr jsSVGSVGElementCurrentTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementCurrentTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapperWithParent<FloatPoint, SVGSVGElement>::create(imp, &SVGSVGElement::currentTranslate, &SVGSVGElement::setCurrentTranslate).get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGSVGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGSVGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGSVGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGSVGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGSVGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGSVGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGSVGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGSVGElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->zoomAndPan());
 }
 
-void JSSVGSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSVGElement, Base>(exec, propertyName, value, &JSSVGSVGElementTable, this, slot);
 }
 
-void setJSSVGSVGElementContentScriptType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementContentScriptType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setContentScriptType(value->toString(exec));
+    imp->setContentScriptType(value.toString(exec));
 }
 
-void setJSSVGSVGElementContentStyleType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementContentStyleType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setContentStyleType(value->toString(exec));
+    imp->setContentStyleType(value.toString(exec));
 }
 
-void setJSSVGSVGElementUseCurrentView(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementUseCurrentView(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setUseCurrentView(value->toBoolean(exec));
+    imp->setUseCurrentView(value.toBoolean(exec));
 }
 
-void setJSSVGSVGElementCurrentScale(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementCurrentScale(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setCurrentScale(value->toFloat(exec));
+    imp->setCurrentScale(value.toFloat(exec));
 }
 
-void setJSSVGSVGElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGSVGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-void setJSSVGSVGElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setZoomAndPan(value->toInt32(exec));
+    imp->setZoomAndPan(value.toInt32(exec));
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionSuspendRedraw(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSuspendRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    unsigned maxWaitMilliseconds = args.at(exec, 0)->toInt32(exec);
+    unsigned maxWaitMilliseconds = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->suspendRedraw(maxWaitMilliseconds));
+    JSC::JSValue result = jsNumber(exec, imp->suspendRedraw(maxWaitMilliseconds));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned suspendHandleId = args.at(exec, 0)->toInt32(exec);
+    unsigned suspendHandleId = args.at(0).toInt32(exec);
 
     imp->unsuspendRedraw(suspendHandleId, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -439,9 +469,10 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecState* exec, J
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -450,9 +481,10 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exec, JSObject
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -461,9 +493,10 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -472,101 +505,109 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecState* exec, JS
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionAnimationsPaused(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionAnimationsPaused(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->animationsPaused());
+    JSC::JSValue result = jsBoolean(imp->animationsPaused());
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getCurrentTime());
+    JSC::JSValue result = jsNumber(exec, imp->getCurrentTime());
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionSetCurrentTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    float seconds = args.at(exec, 0)->toFloat(exec);
+    float seconds = args.at(0).toFloat(exec);
 
     imp->setCurrentTime(seconds);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetIntersectionList(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetIntersectionList(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    FloatRect rect = toSVGRect(args.at(exec, 0));
-    SVGElement* referenceElement = toSVGElement(args.at(exec, 1));
+    FloatRect rect = toSVGRect(args.at(0));
+    SVGElement* referenceElement = toSVGElement(args.at(1));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getIntersectionList(rect, referenceElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getIntersectionList(rect, referenceElement)));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetEnclosureList(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetEnclosureList(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    FloatRect rect = toSVGRect(args.at(exec, 0));
-    SVGElement* referenceElement = toSVGElement(args.at(exec, 1));
+    FloatRect rect = toSVGRect(args.at(0));
+    SVGElement* referenceElement = toSVGElement(args.at(1));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getEnclosureList(rect, referenceElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getEnclosureList(rect, referenceElement)));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCheckIntersection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckIntersection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    SVGElement* element = toSVGElement(args.at(exec, 0));
-    FloatRect rect = toSVGRect(args.at(exec, 1));
+    SVGElement* element = toSVGElement(args.at(0));
+    FloatRect rect = toSVGRect(args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->checkIntersection(element, rect));
+    JSC::JSValue result = jsBoolean(imp->checkIntersection(element, rect));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCheckEnclosure(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckEnclosure(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    SVGElement* element = toSVGElement(args.at(exec, 0));
-    FloatRect rect = toSVGRect(args.at(exec, 1));
+    SVGElement* element = toSVGElement(args.at(0));
+    FloatRect rect = toSVGRect(args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->checkEnclosure(element, rect));
+    JSC::JSValue result = jsBoolean(imp->checkEnclosure(element, rect));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -575,193 +616,207 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exec, JSObject
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGNumber(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGNumber(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->createSVGNumber()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->createSVGNumber()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->createSVGLength()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->createSVGLength()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGAngle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGAngle()), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGAngle()), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGPoint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGPoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->createSVGPoint()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->createSVGPoint()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->createSVGMatrix()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->createSVGMatrix()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->createSVGRect()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->createSVGRect()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransform()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransform()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
index 954c91e809..7365cdb89a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
@@ -34,13 +34,13 @@ class JSSVGSVGElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGSVGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSVGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGSVGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,75 +64,75 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionSuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionForceRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionPauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionUnpauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionAnimationsPaused(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionSetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetIntersectionList(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetEnclosureList(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCheckIntersection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCheckEnclosure(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionDeselectAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGNumber(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionForceRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionPauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnpauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionAnimationsPaused(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetIntersectionList(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetEnclosureList(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckIntersection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckEnclosure(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionDeselectAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGNumber(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGSVGElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementContentScriptType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementContentScriptType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementContentStyleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementContentStyleType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementViewport(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementPixelUnitToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementPixelUnitToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementScreenPixelToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementScreenPixelToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementUseCurrentView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementUseCurrentView(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementCurrentScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementCurrentScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementCurrentTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGSVGElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementContentScriptType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementContentScriptType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementContentStyleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementContentStyleType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementViewport(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementUseCurrentView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementUseCurrentView(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementCurrentScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementCurrentScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementCurrentTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
index 0ebf20547d..fa85a4eccd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGScriptElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGScriptElement);
 
 /* Hash table */
 
@@ -74,9 +74,9 @@ static const HashTable JSSVGScriptElementPrototypeTable =
 
 const ClassInfo JSSVGScriptElementPrototype::s_info = { "SVGScriptElementPrototype", 0, &JSSVGScriptElementPrototypeTable, 0 };
 
-JSObject* JSSVGScriptElementPrototype::self(ExecState* exec)
+JSObject* JSSVGScriptElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGScriptElement>(exec);
+    return getDOMPrototype<JSSVGScriptElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGScriptElement::s_info = { "SVGScriptElement", &JSSVGElement::s_info, &JSSVGScriptElementTable, 0 };
@@ -86,9 +86,9 @@ JSSVGScriptElement::JSSVGScriptElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGScriptElement::createPrototype(ExecState* exec)
+JSObject* JSSVGScriptElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGScriptElementPrototype(JSSVGScriptElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGScriptElementPrototype(JSSVGScriptElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,32 +96,35 @@ bool JSSVGScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGScriptElement, Base>(exec, &JSSVGScriptElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsSVGScriptElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGScriptElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGScriptElement, Base>(exec, propertyName, value, &JSSVGScriptElementTable, this, slot);
 }
 
-void setJSSVGScriptElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGScriptElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
index 9fdfc4d1b7..9bec458713 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
@@ -34,13 +34,13 @@ class JSSVGScriptElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGScriptElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGScriptElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGScriptElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGScriptElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGScriptElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGScriptElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGScriptElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGScriptElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
index 60b0259c62..781bc434c9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSetElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGSetElementPrototypeTable =
 
 const ClassInfo JSSVGSetElementPrototype::s_info = { "SVGSetElementPrototype", 0, &JSSVGSetElementPrototypeTable, 0 };
 
-JSObject* JSSVGSetElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSetElement>(exec);
+    return getDOMPrototype<JSSVGSetElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGSetElement::s_info = { "SVGSetElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGSetElement::JSSVGSetElement(PassRefPtr<Structure> structure, PassRefPtr<SVG
 {
 }
 
-JSObject* JSSVGSetElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSetElementPrototype(JSSVGSetElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGSetElementPrototype(JSSVGSetElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
index 6d80905263..cdb65674c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
@@ -34,7 +34,7 @@ class JSSVGSetElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGSetElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGSetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGSetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
index 92659da2d7..0d008283bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
@@ -43,7 +43,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGStopElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGStopElement);
 
 /* Hash table */
 
@@ -79,9 +79,9 @@ static const HashTable JSSVGStopElementPrototypeTable =
 
 const ClassInfo JSSVGStopElementPrototype::s_info = { "SVGStopElementPrototype", 0, &JSSVGStopElementPrototypeTable, 0 };
 
-JSObject* JSSVGStopElementPrototype::self(ExecState* exec)
+JSObject* JSSVGStopElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGStopElement>(exec);
+    return getDOMPrototype<JSSVGStopElement>(exec, globalObject);
 }
 
 bool JSSVGStopElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,9 +96,9 @@ JSSVGStopElement::JSSVGStopElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGStopElement::createPrototype(ExecState* exec)
+JSObject* JSSVGStopElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGStopElementPrototype(JSSVGStopElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGStopElementPrototype(JSSVGStopElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGStopElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -106,36 +106,40 @@ bool JSSVGStopElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGStopElement, Base>(exec, &JSSVGStopElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGStopElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(static_cast<JSSVGStopElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->offsetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGStopElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(static_cast<JSSVGStopElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGStopElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(static_cast<JSSVGStopElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGStopElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStopElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStopElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStopElement::s_info))
         return throwError(exec, TypeError);
     JSSVGStopElement* castedThisObj = static_cast<JSSVGStopElement*>(asObject(thisValue));
     SVGStopElement* imp = static_cast<SVGStopElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
index 525d8bcc02..881d4766ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
@@ -34,12 +34,12 @@ class JSSVGStopElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGStopElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGStopElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGStopElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,12 +63,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGStopElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStopElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGStopElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGStopElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGStopElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStopElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStopElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStopElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
index b8de1bf9b4..62a6b7be26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGStringList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGStringList);
 
 /* Hash table */
 
@@ -79,9 +79,9 @@ static const HashTable JSSVGStringListPrototypeTable =
 
 const ClassInfo JSSVGStringListPrototype::s_info = { "SVGStringListPrototype", 0, &JSSVGStringListPrototypeTable, 0 };
 
-JSObject* JSSVGStringListPrototype::self(ExecState* exec)
+JSObject* JSSVGStringListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGStringList>(exec);
+    return getDOMPrototype<JSSVGStringList>(exec, globalObject);
 }
 
 bool JSSVGStringListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,12 +101,11 @@ JSSVGStringList::JSSVGStringList(PassRefPtr<Structure> structure, PassRefPtr<SVG
 JSSVGStringList::~JSSVGStringList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGStringList::createPrototype(ExecState* exec)
+JSObject* JSSVGStringList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGStringListPrototype(JSSVGStringListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGStringListPrototype(JSSVGStringListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGStringList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,15 +113,17 @@ bool JSSVGStringList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGStringList, Base>(exec, &JSSVGStringListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGStringListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStringListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStringList* imp = static_cast<SVGStringList*>(static_cast<JSSVGStringList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -133,105 +134,111 @@ JSValuePtr jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
+    const UString& item = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->initialize(item, ec));
+    JSC::JSValue result = jsString(exec, imp->initialize(item, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getItem(index, ec));
+    JSC::JSValue result = jsString(exec, imp->getItem(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& item = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->insertItemBefore(item, index, ec));
+    JSC::JSValue result = jsString(exec, imp->insertItemBefore(item, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& item = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->replaceItem(item, index, ec));
+    JSC::JSValue result = jsString(exec, imp->replaceItem(item, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->removeItem(index, ec));
+    JSC::JSValue result = jsString(exec, imp->removeItem(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
+    const UString& item = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->appendItem(item, ec));
+    JSC::JSValue result = jsString(exec, imp->appendItem(item, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGStringList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGStringList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGStringList>(exec, object, context);
 }
-SVGStringList* toSVGStringList(JSC::JSValuePtr value)
+SVGStringList* toSVGStringList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGStringList::s_info) ? static_cast<JSSVGStringList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGStringList::s_info) ? static_cast<JSSVGStringList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
index b909d62bc6..c3765a0463 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
@@ -37,12 +37,12 @@ class JSSVGStringList : public DOMObject {
 public:
     JSSVGStringList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGStringList>, SVGElement* context);
     virtual ~JSSVGStringList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,16 +55,17 @@ private:
     RefPtr<SVGStringList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGStringList*, SVGElement* context);
-SVGStringList* toSVGStringList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGStringList*, SVGElement* context);
+SVGStringList* toSVGStringList(JSC::JSValue);
 
 class JSSVGStringListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,16 +74,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGStringListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStringListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
index e3b1210c7e..c1f88835cd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGStyleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGStyleElement);
 
 /* Hash table */
 
@@ -73,9 +73,9 @@ static const HashTable JSSVGStyleElementPrototypeTable =
 
 const ClassInfo JSSVGStyleElementPrototype::s_info = { "SVGStyleElementPrototype", 0, &JSSVGStyleElementPrototypeTable, 0 };
 
-JSObject* JSSVGStyleElementPrototype::self(ExecState* exec)
+JSObject* JSSVGStyleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGStyleElement>(exec);
+    return getDOMPrototype<JSSVGStyleElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGStyleElement::s_info = { "SVGStyleElement", &JSSVGElement::s_info, &JSSVGStyleElementTable, 0 };
@@ -85,9 +85,9 @@ JSSVGStyleElement::JSSVGStyleElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGStyleElement::createPrototype(ExecState* exec)
+JSObject* JSSVGStyleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGStyleElementPrototype(JSSVGStyleElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGStyleElementPrototype(JSSVGStyleElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,64 +95,68 @@ bool JSSVGStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGStyleElement, Base>(exec, &JSSVGStyleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGStyleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsSVGStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsSVGStyleElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->title());
 }
 
-void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGStyleElement, Base>(exec, propertyName, value, &JSSVGStyleElementTable, this, slot);
 }
 
-void setJSSVGStyleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setXmlspace(value->toString(exec), ec);
+    imp->setXmlspace(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGStyleElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setType(value->toString(exec), ec);
+    imp->setType(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setMedia(value->toString(exec), ec);
+    imp->setMedia(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGStyleElementTitle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setTitle(value->toString(exec), ec);
+    imp->setTitle(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
index 80098df881..54832a1640 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
@@ -34,13 +34,13 @@ class JSSVGStyleElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGStyleElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGStyleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGStyleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGStyleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGStyleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGStyleElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGStyleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
index 8771f722f3..baaf607ace 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
@@ -52,7 +52,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSwitchElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSwitchElement);
 
 /* Hash table */
 
@@ -101,9 +101,9 @@ static const HashTable JSSVGSwitchElementPrototypeTable =
 
 const ClassInfo JSSVGSwitchElementPrototype::s_info = { "SVGSwitchElementPrototype", 0, &JSSVGSwitchElementPrototypeTable, 0 };
 
-JSObject* JSSVGSwitchElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSwitchElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSwitchElement>(exec);
+    return getDOMPrototype<JSSVGSwitchElement>(exec, globalObject);
 }
 
 bool JSSVGSwitchElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,9 +118,9 @@ JSSVGSwitchElement::JSSVGSwitchElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGSwitchElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSwitchElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSwitchElementPrototype(JSSVGSwitchElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGSwitchElementPrototype(JSSVGSwitchElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGSwitchElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,165 +128,182 @@ bool JSSVGSwitchElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGSwitchElement, Base>(exec, &JSSVGSwitchElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGSwitchElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGSwitchElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGSwitchElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGSwitchElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGSwitchElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGSwitchElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSwitchElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSwitchElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGSwitchElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSwitchElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGSwitchElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGSwitchElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGSwitchElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSwitchElement, Base>(exec, propertyName, value, &JSSVGSwitchElementTable, this, slot);
 }
 
-void setJSSVGSwitchElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSwitchElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGSwitchElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSwitchElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
index 567f8f9257..b6672f87ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
@@ -34,13 +34,13 @@ class JSSVGSwitchElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGSwitchElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSwitchElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGSwitchElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,27 +64,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGSwitchElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSwitchElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSwitchElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSwitchElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSwitchElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSwitchElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSwitchElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSwitchElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSwitchElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
index 29a02d8136..232dff70b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
@@ -47,7 +47,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSymbolElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSymbolElement);
 
 /* Hash table */
 
@@ -87,9 +87,9 @@ static const HashTable JSSVGSymbolElementPrototypeTable =
 
 const ClassInfo JSSVGSymbolElementPrototype::s_info = { "SVGSymbolElementPrototype", 0, &JSSVGSymbolElementPrototypeTable, 0 };
 
-JSObject* JSSVGSymbolElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSymbolElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSymbolElement>(exec);
+    return getDOMPrototype<JSSVGSymbolElement>(exec, globalObject);
 }
 
 bool JSSVGSymbolElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,9 +104,9 @@ JSSVGSymbolElement::JSSVGSymbolElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGSymbolElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSymbolElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSymbolElementPrototype(JSSVGSymbolElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGSymbolElementPrototype(JSSVGSymbolElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGSymbolElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,79 +114,87 @@ bool JSSVGSymbolElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGSymbolElement, Base>(exec, &JSSVGSymbolElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGSymbolElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGSymbolElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGSymbolElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSymbolElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSymbolElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGSymbolElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSymbolElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGSymbolElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGSymbolElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSymbolElement, Base>(exec, propertyName, value, &JSSVGSymbolElementTable, this, slot);
 }
 
-void setJSSVGSymbolElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSymbolElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGSymbolElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSymbolElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSymbolElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSymbolElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSymbolElement* castedThisObj = static_cast<JSSVGSymbolElement*>(asObject(thisValue));
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
index 3664319b28..4ba3e49e3e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
@@ -34,13 +34,13 @@ class JSSVGSymbolElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGSymbolElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSymbolElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGSymbolElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,18 +64,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGSymbolElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSymbolElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSymbolElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSymbolElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSymbolElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSymbolElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSymbolElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSymbolElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSymbolElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
index cd38679f33..e924f95365 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTRefElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTRefElement);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSVGTRefElementPrototypeTable =
 
 const ClassInfo JSSVGTRefElementPrototype::s_info = { "SVGTRefElementPrototype", 0, &JSSVGTRefElementPrototypeTable, 0 };
 
-JSObject* JSSVGTRefElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTRefElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTRefElement>(exec);
+    return getDOMPrototype<JSSVGTRefElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGTRefElement::s_info = { "SVGTRefElement", &JSSVGTextPositioningElement::s_info, &JSSVGTRefElementTable, 0 };
@@ -81,9 +81,9 @@ JSSVGTRefElement::JSSVGTRefElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGTRefElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTRefElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTRefElementPrototype(JSSVGTRefElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGTRefElementPrototype(JSSVGTRefElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTRefElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,8 +91,9 @@ bool JSSVGTRefElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGTRefElement, Base>(exec, &JSSVGTRefElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTRefElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTRefElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTRefElement* imp = static_cast<SVGTRefElement*>(static_cast<JSSVGTRefElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
index f9a648061e..de846e1e2c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
@@ -34,12 +34,12 @@ class JSSVGTRefElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGTRefElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTRefElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGTRefElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGTRefElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,7 +58,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGTRefElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTRefElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
index b6519b055b..df3ecb5fe2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTSpanElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTSpanElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +53,9 @@ static const HashTable JSSVGTSpanElementPrototypeTable =
 
 const ClassInfo JSSVGTSpanElementPrototype::s_info = { "SVGTSpanElementPrototype", 0, &JSSVGTSpanElementPrototypeTable, 0 };
 
-JSObject* JSSVGTSpanElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTSpanElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTSpanElement>(exec);
+    return getDOMPrototype<JSSVGTSpanElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGTSpanElement::s_info = { "SVGTSpanElement", &JSSVGTextPositioningElement::s_info, 0, 0 };
@@ -65,9 +65,9 @@ JSSVGTSpanElement::JSSVGTSpanElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGTSpanElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTSpanElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTSpanElementPrototype(JSSVGTSpanElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGTSpanElementPrototype(JSSVGTSpanElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
index 56171322b2..ac0084a57c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
@@ -34,7 +34,7 @@ class JSSVGTSpanElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGTSpanElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTSpanElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGTSpanElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGTSpanElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
index 3150594713..e0a9011f1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
@@ -31,6 +31,7 @@
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
+#include "ExceptionCode.h"
 #include "FloatPoint.h"
 #include "JSCSSStyleDeclaration.h"
 #include "JSCSSValue.h"
@@ -53,7 +54,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextContentElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextContentElement);
 
 /* Hash table */
 
@@ -102,13 +103,13 @@ public:
     JSSVGTextContentElementConstructor(ExecState* exec)
         : DOMObject(JSSVGTextContentElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGTextContentElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGTextContentElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -151,9 +152,9 @@ static const HashTable JSSVGTextContentElementPrototypeTable =
 
 const ClassInfo JSSVGTextContentElementPrototype::s_info = { "SVGTextContentElementPrototype", 0, &JSSVGTextContentElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextContentElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextContentElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextContentElement>(exec);
+    return getDOMPrototype<JSSVGTextContentElement>(exec, globalObject);
 }
 
 bool JSSVGTextContentElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -168,9 +169,9 @@ JSSVGTextContentElement::JSSVGTextContentElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGTextContentElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextContentElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextContentElementPrototype(JSSVGTextContentElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGTextContentElementPrototype(JSSVGTextContentElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextContentElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -178,263 +179,316 @@ bool JSSVGTextContentElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGTextContentElement, Base>(exec, &JSSVGTextContentElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextContentElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->textLengthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementLengthAdjust(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementLengthAdjust(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->lengthAdjustAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGTextContentElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGTextContentElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGTextContentElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGTextContentElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGTextContentElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGTextContentElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGTextContentElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGTextContentElement, Base>(exec, propertyName, value, &JSSVGTextContentElementTable, this, slot);
 }
 
-void setJSSVGTextContentElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTextContentElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGTextContentElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTextContentElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr JSSVGTextContentElement::getConstructor(ExecState* exec)
+JSValue JSSVGTextContentElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGTextContentElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getNumberOfChars());
+    JSC::JSValue result = jsNumber(exec, imp->getNumberOfChars());
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getComputedTextLength());
+    JSC::JSValue result = jsNumber(exec, imp->getComputedTextLength());
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetSubStringLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetSubStringLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
-    unsigned length = args.at(exec, 1)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+    int length = args.at(1).toInt32(exec);
+    if (length < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getSubStringLength(offset, length, ec));
+    JSC::JSValue result = jsNumber(exec, imp->getSubStringLength(offset, length, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getStartPositionOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getStartPositionOfChar(offset, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getEndPositionOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getEndPositionOfChar(offset, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getExtentOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getExtentOfChar(offset, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getRotationOfChar(offset, ec));
+    JSC::JSValue result = jsNumber(exec, imp->getRotationOfChar(offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
-    FloatPoint point = toSVGPoint(args.at(exec, 0));
+    FloatPoint point = toSVGPoint(args.at(0));
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getCharNumAtPosition(point));
+    JSC::JSValue result = jsNumber(exec, imp->getCharNumAtPosition(point));
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionSelectSubString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionSelectSubString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
-    unsigned length = args.at(exec, 1)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+    int length = args.at(1).toInt32(exec);
+    if (length < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
     imp->selectSubString(offset, length, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGTextContentElementLENGTHADJUST_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
index 8a5b85e3d8..af1b388f1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
@@ -34,28 +34,29 @@ class JSSVGTextContentElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGTextContentElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextContentElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGTextContentElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,37 +65,37 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetSubStringLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionSelectSubString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetSubStringLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionSelectSubString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTextContentElementTextLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementLengthAdjust(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTextContentElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTextContentElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTextContentElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTextContentElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementTextLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLengthAdjust(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTextContentElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTextContentElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTextContentElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTextContentElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGTextContentElementLENGTHADJUST_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
index 50612ff2fd..acf8ecf190 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
@@ -41,7 +41,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextElement);
 
 /* Hash table */
 
@@ -80,9 +80,9 @@ static const HashTable JSSVGTextElementPrototypeTable =
 
 const ClassInfo JSSVGTextElementPrototype::s_info = { "SVGTextElementPrototype", 0, &JSSVGTextElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextElement>(exec);
+    return getDOMPrototype<JSSVGTextElement>(exec, globalObject);
 }
 
 bool JSSVGTextElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,9 +97,9 @@ JSSVGTextElement::JSSVGTextElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGTextElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextElementPrototype(JSSVGTextElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGTextElementPrototype(JSSVGTextElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,72 +107,79 @@ bool JSSVGTextElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGTextElement, Base>(exec, &JSSVGTextElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(static_cast<JSSVGTextElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(static_cast<JSSVGTextElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGTextElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(static_cast<JSSVGTextElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
index 34169ace7a..05d4d7c920 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
@@ -34,12 +34,12 @@ class JSSVGTextElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGTextElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGTextElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,15 +63,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTextElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
index 48d1eef154..a324e0e9b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPathElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPathElement);
 
 /* Hash table */
 
@@ -85,13 +85,13 @@ public:
     JSSVGTextPathElementConstructor(ExecState* exec)
         : DOMObject(JSSVGTextPathElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGTextPathElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGTextPathElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +126,9 @@ static const HashTable JSSVGTextPathElementPrototypeTable =
 
 const ClassInfo JSSVGTextPathElementPrototype::s_info = { "SVGTextPathElementPrototype", 0, &JSSVGTextPathElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextPathElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextPathElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextPathElement>(exec);
+    return getDOMPrototype<JSSVGTextPathElement>(exec, globalObject);
 }
 
 bool JSSVGTextPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +143,9 @@ JSSVGTextPathElement::JSSVGTextPathElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGTextPathElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextPathElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextPathElementPrototype(JSSVGTextPathElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec)));
+    return new (exec) JSSVGTextPathElementPrototype(JSSVGTextPathElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,71 +153,75 @@ bool JSSVGTextPathElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGTextPathElement, Base>(exec, &JSSVGTextPathElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextPathElementStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->startOffsetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->methodAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->spacingAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGTextPathElement::getConstructor(ExecState* exec)
+JSValue JSSVGTextPathElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGTextPathElementConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
index fc2dd9b785..50ad156ac6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
@@ -34,27 +34,28 @@ class JSSVGTextPathElement : public JSSVGTextContentElement {
     typedef JSSVGTextContentElement Base;
 public:
     JSSVGTextPathElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextPathElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGTextPathElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,19 +64,19 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGTextPathElementStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
index b3860461c6..b8929cf703 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPositioningElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPositioningElement);
 
 /* Hash table */
 
@@ -74,9 +74,9 @@ static const HashTable JSSVGTextPositioningElementPrototypeTable =
 
 const ClassInfo JSSVGTextPositioningElementPrototype::s_info = { "SVGTextPositioningElementPrototype", 0, &JSSVGTextPositioningElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextPositioningElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextPositioningElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextPositioningElement>(exec);
+    return getDOMPrototype<JSSVGTextPositioningElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGTextPositioningElement::s_info = { "SVGTextPositioningElement", &JSSVGTextContentElement::s_info, &JSSVGTextPositioningElementTable, 0 };
@@ -86,9 +86,9 @@ JSSVGTextPositioningElement::JSSVGTextPositioningElement(PassRefPtr<Structure> s
 {
 }
 
-JSObject* JSSVGTextPositioningElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextPositioningElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextPositioningElementPrototype(JSSVGTextPositioningElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec)));
+    return new (exec) JSSVGTextPositioningElementPrototype(JSSVGTextPositioningElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextPositioningElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,36 +96,41 @@ bool JSSVGTextPositioningElement::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGTextPositioningElement, Base>(exec, &JSSVGTextPositioningElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextPositioningElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->dxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->dyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementRotate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementRotate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->rotateAnimated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
index 4dab3a26af..e3a09d4714 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
@@ -34,12 +34,12 @@ class JSSVGTextPositioningElement : public JSSVGTextContentElement {
     typedef JSSVGTextContentElement Base;
 public:
     JSSVGTextPositioningElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextPositioningElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGTextPositioningElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGTextPositioningElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGTextPositioningElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementRotate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementRotate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
index e443a78c8f..ac43471678 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTitleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTitleElement);
 
 /* Hash table */
 
@@ -81,9 +81,9 @@ static const HashTable JSSVGTitleElementPrototypeTable =
 
 const ClassInfo JSSVGTitleElementPrototype::s_info = { "SVGTitleElementPrototype", 0, &JSSVGTitleElementPrototypeTable, 0 };
 
-JSObject* JSSVGTitleElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTitleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTitleElement>(exec);
+    return getDOMPrototype<JSSVGTitleElement>(exec, globalObject);
 }
 
 bool JSSVGTitleElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +98,9 @@ JSSVGTitleElement::JSSVGTitleElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGTitleElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTitleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTitleElementPrototype(JSSVGTitleElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGTitleElementPrototype(JSSVGTitleElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,58 +108,63 @@ bool JSSVGTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGTitleElement, Base>(exec, &JSSVGTitleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTitleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGTitleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGTitleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTitleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGTitleElement, Base>(exec, propertyName, value, &JSSVGTitleElementTable, this, slot);
 }
 
-void setJSSVGTitleElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTitleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGTitleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTitleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTitleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTitleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTitleElement* castedThisObj = static_cast<JSSVGTitleElement*>(asObject(thisValue));
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
index a4ee478fad..6f52ca4ad3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
@@ -34,13 +34,13 @@ class JSSVGTitleElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGTitleElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTitleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGTitleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,15 +64,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTitleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTitleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTitleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTitleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTitleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTitleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTitleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTitleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTitleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTitleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTitleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTitleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
index 6dbbfbe81b..b5de63eb45 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTransform)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTransform);
 
 /* Hash table */
 
@@ -84,13 +84,13 @@ public:
     JSSVGTransformConstructor(ExecState* exec)
         : DOMObject(JSSVGTransformConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGTransformPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGTransformPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -132,9 +132,9 @@ static const HashTable JSSVGTransformPrototypeTable =
 
 const ClassInfo JSSVGTransformPrototype::s_info = { "SVGTransformPrototype", 0, &JSSVGTransformPrototypeTable, 0 };
 
-JSObject* JSSVGTransformPrototype::self(ExecState* exec)
+JSObject* JSSVGTransformPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTransform>(exec);
+    return getDOMPrototype<JSSVGTransform>(exec, globalObject);
 }
 
 bool JSSVGTransformPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,12 +154,11 @@ JSSVGTransform::JSSVGTransform(PassRefPtr<Structure> structure, PassRefPtr<JSSVG
 JSSVGTransform::~JSSVGTransform()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGTransform::createPrototype(ExecState* exec)
+JSObject* JSSVGTransform::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTransformPrototype(JSSVGTransformPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGTransformPrototype(JSSVGTransformPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGTransform::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -167,115 +166,124 @@ bool JSSVGTransform::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGTransform, Base>(exec, &JSSVGTransformTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTransformType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransform imp(*static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.type());
 }
 
-JSValuePtr jsSVGTransformMatrix(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformMatrix(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransform imp(*static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapperWithPODTypeParent<TransformationMatrix, SVGTransform>::create(imp.matrix(), static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl()).get(), static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGTransformAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransform imp(*static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.angle());
 }
 
-JSValuePtr jsSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGTransform::getConstructor(ExecState* exec)
+JSValue JSSVGTransform::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGTransformConstructor>(exec);
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
     imp.setMatrix(matrix);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetTranslate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float tx = args.at(exec, 0)->toFloat(exec);
-    float ty = args.at(exec, 1)->toFloat(exec);
+    float tx = args.at(0).toFloat(exec);
+    float ty = args.at(1).toFloat(exec);
 
     imp.setTranslate(tx, ty);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetScale(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float sx = args.at(exec, 0)->toFloat(exec);
-    float sy = args.at(exec, 1)->toFloat(exec);
+    float sx = args.at(0).toFloat(exec);
+    float sy = args.at(1).toFloat(exec);
 
     imp.setScale(sx, sy);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetRotate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float angle = args.at(exec, 0)->toFloat(exec);
-    float cx = args.at(exec, 1)->toFloat(exec);
-    float cy = args.at(exec, 2)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
+    float cx = args.at(1).toFloat(exec);
+    float cy = args.at(2).toFloat(exec);
 
     imp.setRotate(angle, cx, cy);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetSkewX(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float angle = args.at(exec, 0)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
 
     imp.setSkewX(angle);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float angle = args.at(exec, 0)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
 
     imp.setSkewY(angle);
     wrapper->commitChange(imp, castedThisObj->context());
@@ -284,48 +292,48 @@ JSValuePtr jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, JSObject*, J
 
 // Constant getters
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGTransform>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGTransform>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGTransform, JSSVGPODTypeWrapper<SVGTransform> >(exec, object, context);
 }
-SVGTransform toSVGTransform(JSC::JSValuePtr value)
+SVGTransform toSVGTransform(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGTransform::s_info) ? (SVGTransform) *static_cast<JSSVGTransform*>(asObject(value))->impl() : SVGTransform();
+    return value.isObject(&JSSVGTransform::s_info) ? (SVGTransform) *static_cast<JSSVGTransform*>(asObject(value))->impl() : SVGTransform();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
index 39cdf990ab..75d7723850 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
@@ -37,17 +37,17 @@ class JSSVGTransform : public DOMObject {
 public:
     JSSVGTransform(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<SVGTransform> >, SVGElement* context);
     virtual ~JSSVGTransform();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     JSSVGPODTypeWrapper<SVGTransform>* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<SVGTransform> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement* context);
-SVGTransform toSVGTransform(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement* context);
+SVGTransform toSVGTransform(JSC::JSValue);
 
 class JSSVGTransformPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,27 +75,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTransformType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformMatrix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformMatrix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
index 37871c29de..0459516c85 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTransformList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTransformList);
 
 /* Hash table */
 
@@ -82,9 +82,9 @@ static const HashTable JSSVGTransformListPrototypeTable =
 
 const ClassInfo JSSVGTransformListPrototype::s_info = { "SVGTransformListPrototype", 0, &JSSVGTransformListPrototypeTable, 0 };
 
-JSObject* JSSVGTransformListPrototype::self(ExecState* exec)
+JSObject* JSSVGTransformListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTransformList>(exec);
+    return getDOMPrototype<JSSVGTransformList>(exec, globalObject);
 }
 
 bool JSSVGTransformListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,12 +104,11 @@ JSSVGTransformList::JSSVGTransformList(PassRefPtr<Structure> structure, PassRefP
 JSSVGTransformList::~JSSVGTransformList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGTransformList::createPrototype(ExecState* exec)
+JSObject* JSSVGTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTransformListPrototype(JSSVGTransformListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGTransformListPrototype(JSSVGTransformListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGTransformList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -117,100 +116,110 @@ bool JSSVGTransformList::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGTransformList, Base>(exec, &JSSVGTransformListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTransformListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransformList* imp = static_cast<SVGTransformList*>(static_cast<JSSVGTransformList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), castedThisObj->context());
     return result;
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionConsolidate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionConsolidate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->consolidate()).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->consolidate()).get(), castedThisObj->context());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGTransformList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGTransformList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGTransformList>(exec, object, context);
 }
-SVGTransformList* toSVGTransformList(JSC::JSValuePtr value)
+SVGTransformList* toSVGTransformList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGTransformList::s_info) ? static_cast<JSSVGTransformList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGTransformList::s_info) ? static_cast<JSSVGTransformList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
index 0cdf36957b..bfadcce698 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
@@ -37,25 +37,25 @@ class JSSVGTransformList : public DOMObject {
 public:
     JSSVGTransformList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTransformList>, SVGElement* context);
     virtual ~JSSVGTransformList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
     SVGTransformList* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -64,16 +64,17 @@ private:
     RefPtr<SVGTransformList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGTransformList*, SVGElement* context);
-SVGTransformList* toSVGTransformList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGTransformList*, SVGElement* context);
+SVGTransformList* toSVGTransformList(JSC::JSValue);
 
 class JSSVGTransformListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,18 +83,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionConsolidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionConsolidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTransformListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
index dbfab2dc32..aa0cd4ebc1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGUnitTypes)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGUnitTypes);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSSVGUnitTypesConstructor(ExecState* exec)
         : DOMObject(JSSVGUnitTypesConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGUnitTypesPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGUnitTypesPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -113,9 +113,9 @@ static const HashTable JSSVGUnitTypesPrototypeTable =
 
 const ClassInfo JSSVGUnitTypesPrototype::s_info = { "SVGUnitTypesPrototype", 0, &JSSVGUnitTypesPrototypeTable, 0 };
 
-JSObject* JSSVGUnitTypesPrototype::self(ExecState* exec)
+JSObject* JSSVGUnitTypesPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGUnitTypes>(exec);
+    return getDOMPrototype<JSSVGUnitTypes>(exec, globalObject);
 }
 
 bool JSSVGUnitTypesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +135,11 @@ JSSVGUnitTypes::JSSVGUnitTypes(PassRefPtr<Structure> structure, PassRefPtr<SVGUn
 JSSVGUnitTypes::~JSSVGUnitTypes()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGUnitTypes::createPrototype(ExecState* exec)
+JSObject* JSSVGUnitTypes::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGUnitTypesPrototype(JSSVGUnitTypesPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGUnitTypesPrototype(JSSVGUnitTypesPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGUnitTypes::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,39 +147,39 @@ bool JSSVGUnitTypes::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGUnitTypes, Base>(exec, &JSSVGUnitTypesTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGUnitTypes*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGUnitTypes::getConstructor(ExecState* exec)
+JSValue JSSVGUnitTypes::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGUnitTypesConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGUnitTypes* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGUnitTypes* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGUnitTypes>(exec, object, context);
 }
-SVGUnitTypes* toSVGUnitTypes(JSC::JSValuePtr value)
+SVGUnitTypes* toSVGUnitTypes(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGUnitTypes::s_info) ? static_cast<JSSVGUnitTypes*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGUnitTypes::s_info) ? static_cast<JSSVGUnitTypes*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
index ef22d10ba5..263784b357 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
@@ -37,17 +37,17 @@ class JSSVGUnitTypes : public DOMObject {
 public:
     JSSVGUnitTypes(PassRefPtr<JSC::Structure>, PassRefPtr<SVGUnitTypes>, SVGElement* context);
     virtual ~JSSVGUnitTypes();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGUnitTypes* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGUnitTypes > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGUnitTypes*, SVGElement* context);
-SVGUnitTypes* toSVGUnitTypes(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGUnitTypes*, SVGElement* context);
+SVGUnitTypes* toSVGUnitTypes(JSC::JSValue);
 
 class JSSVGUnitTypesPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,12 +75,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
index 8ada6d5922..042a7a7de1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
@@ -55,7 +55,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGUseElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGUseElement);
 
 /* Hash table */
 
@@ -111,9 +111,9 @@ static const HashTable JSSVGUseElementPrototypeTable =
 
 const ClassInfo JSSVGUseElementPrototype::s_info = { "SVGUseElementPrototype", 0, &JSSVGUseElementPrototypeTable, 0 };
 
-JSObject* JSSVGUseElementPrototype::self(ExecState* exec)
+JSObject* JSSVGUseElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGUseElement>(exec);
+    return getDOMPrototype<JSSVGUseElement>(exec, globalObject);
 }
 
 bool JSSVGUseElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,9 +128,9 @@ JSSVGUseElement::JSSVGUseElement(PassRefPtr<Structure> structure, PassRefPtr<SVG
 {
 }
 
-JSObject* JSSVGUseElement::createPrototype(ExecState* exec)
+JSObject* JSSVGUseElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGUseElementPrototype(JSSVGUseElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGUseElementPrototype(JSSVGUseElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGUseElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,212 +138,236 @@ bool JSSVGUseElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGUseElement, Base>(exec, &JSSVGUseElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGUseElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->instanceRoot()));
 }
 
-JSValuePtr jsSVGUseElementAnimatedInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementAnimatedInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedInstanceRoot()));
 }
 
-JSValuePtr jsSVGUseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGUseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGUseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGUseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGUseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGUseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGUseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGUseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGUseElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGUseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGUseElement, Base>(exec, propertyName, value, &JSSVGUseElementTable, this, slot);
 }
 
-void setJSSVGUseElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGUseElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGUseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGUseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
index 1b5e357cf2..6957771123 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
@@ -34,13 +34,13 @@ class JSSVGUseElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGUseElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGUseElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGUseElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,34 +64,34 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGUseElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementAnimatedInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGUseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGUseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGUseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGUseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementAnimatedInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGUseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGUseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGUseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGUseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
index d8291ba8e0..930dc7ba21 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
@@ -41,7 +41,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGViewElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGViewElement);
 
 /* Hash table */
 
@@ -81,9 +81,9 @@ static const HashTable JSSVGViewElementPrototypeTable =
 
 const ClassInfo JSSVGViewElementPrototype::s_info = { "SVGViewElementPrototype", 0, &JSSVGViewElementPrototypeTable, 0 };
 
-JSObject* JSSVGViewElementPrototype::self(ExecState* exec)
+JSObject* JSSVGViewElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGViewElement>(exec);
+    return getDOMPrototype<JSSVGViewElement>(exec, globalObject);
 }
 
 bool JSSVGViewElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +98,9 @@ JSSVGViewElement::JSSVGViewElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGViewElement::createPrototype(ExecState* exec)
+JSObject* JSSVGViewElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGViewElementPrototype(JSSVGViewElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGViewElementPrototype(JSSVGViewElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGViewElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,63 +108,68 @@ bool JSSVGViewElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGViewElement, Base>(exec, &JSSVGViewElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGViewElementViewTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementViewTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->viewTarget()), imp);
 }
 
-JSValuePtr jsSVGViewElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGViewElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGViewElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGViewElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->zoomAndPan());
 }
 
-void JSSVGViewElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGViewElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGViewElement, Base>(exec, propertyName, value, &JSSVGViewElementTable, this, slot);
 }
 
-void setJSSVGViewElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGViewElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(thisObject)->impl());
-    imp->setZoomAndPan(value->toInt32(exec));
+    imp->setZoomAndPan(value.toInt32(exec));
 }
 
 // Constant getters
 
-JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
index 0575720bd3..13ba9a8b73 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
@@ -34,13 +34,13 @@ class JSSVGViewElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGViewElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGViewElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGViewElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,17 +64,17 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGViewElementViewTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGViewElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGViewElementViewTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGViewElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
index 860b3d7174..3c74fe9b27 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGZoomEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGZoomEvent);
 
 /* Hash table */
 
@@ -75,21 +75,21 @@ static const HashTable JSSVGZoomEventPrototypeTable =
 
 const ClassInfo JSSVGZoomEventPrototype::s_info = { "SVGZoomEventPrototype", 0, &JSSVGZoomEventPrototypeTable, 0 };
 
-JSObject* JSSVGZoomEventPrototype::self(ExecState* exec)
+JSObject* JSSVGZoomEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGZoomEvent>(exec);
+    return getDOMPrototype<JSSVGZoomEvent>(exec, globalObject);
 }
 
 const ClassInfo JSSVGZoomEvent::s_info = { "SVGZoomEvent", &JSUIEvent::s_info, &JSSVGZoomEventTable, 0 };
 
-JSSVGZoomEvent::JSSVGZoomEvent(PassRefPtr<Structure> structure, PassRefPtr<SVGZoomEvent> impl, SVGElement* context)
+JSSVGZoomEvent::JSSVGZoomEvent(PassRefPtr<Structure> structure, PassRefPtr<SVGZoomEvent> impl, SVGElement*)
     : JSUIEvent(structure, impl)
 {
 }
 
-JSObject* JSSVGZoomEvent::createPrototype(ExecState* exec)
+JSObject* JSSVGZoomEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGZoomEventPrototype(JSSVGZoomEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSSVGZoomEventPrototype(JSSVGZoomEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGZoomEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,32 +97,37 @@ bool JSSVGZoomEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGZoomEvent, Base>(exec, &JSSVGZoomEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGZoomEventZoomRectScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventZoomRectScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->zoomRectScreen()).get(), 0);
 }
 
-JSValuePtr jsSVGZoomEventPreviousScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventPreviousScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->previousScale());
 }
 
-JSValuePtr jsSVGZoomEventPreviousTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventPreviousTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->previousTranslate()).get(), 0);
 }
 
-JSValuePtr jsSVGZoomEventNewScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventNewScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->newScale());
 }
 
-JSValuePtr jsSVGZoomEventNewTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventNewTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->newTranslate()).get(), 0);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
index 941281928b..f053122292 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
@@ -34,12 +34,12 @@ class JSSVGZoomEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSSVGZoomEvent(PassRefPtr<JSC::Structure>, PassRefPtr<SVGZoomEvent>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGZoomEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGZoomEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGZoomEventZoomRectScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventPreviousScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventPreviousTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventNewScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventNewTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventZoomRectScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventPreviousScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventPreviousTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventNewScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventNewTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
index 67f6aaee62..00119a484d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSScreen)
+ASSERT_CLASS_FITS_IN_CELL(JSScreen);
 
 /* Hash table */
 
@@ -72,9 +72,9 @@ static const HashTable JSScreenPrototypeTable =
 
 const ClassInfo JSScreenPrototype::s_info = { "ScreenPrototype", 0, &JSScreenPrototypeTable, 0 };
 
-JSObject* JSScreenPrototype::self(ExecState* exec)
+JSObject* JSScreenPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSScreen>(exec);
+    return getDOMPrototype<JSScreen>(exec, globalObject);
 }
 
 const ClassInfo JSScreen::s_info = { "Screen", 0, &JSScreenTable, 0 };
@@ -88,12 +88,11 @@ JSScreen::JSScreen(PassRefPtr<Structure> structure, PassRefPtr<Screen> impl)
 JSScreen::~JSScreen()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSScreen::createPrototype(ExecState* exec)
+JSObject* JSScreen::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSScreenPrototype(JSScreenPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSScreenPrototype(JSScreenPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSScreen::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,61 +100,69 @@ bool JSScreen::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSScreen, Base>(exec, &JSScreenTable, this, propertyName, slot);
 }
 
-JSValuePtr jsScreenHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsScreenWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsScreenColorDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenColorDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->colorDepth());
 }
 
-JSValuePtr jsScreenPixelDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenPixelDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pixelDepth());
 }
 
-JSValuePtr jsScreenAvailLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availLeft());
 }
 
-JSValuePtr jsScreenAvailTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availTop());
 }
 
-JSValuePtr jsScreenAvailHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availHeight());
 }
 
-JSValuePtr jsScreenAvailWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availWidth());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Screen* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Screen* object)
 {
     return getDOMObjectWrapper<JSScreen>(exec, object);
 }
-Screen* toScreen(JSC::JSValuePtr value)
+Screen* toScreen(JSC::JSValue value)
 {
-    return value->isObject(&JSScreen::s_info) ? static_cast<JSScreen*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSScreen::s_info) ? static_cast<JSScreen*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.h b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
index 60d0183578..4e7be7b777 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
@@ -34,12 +34,12 @@ class JSScreen : public DOMObject {
 public:
     JSScreen(PassRefPtr<JSC::Structure>, PassRefPtr<Screen>);
     virtual ~JSScreen();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +50,13 @@ private:
     RefPtr<Screen> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Screen*);
-Screen* toScreen(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Screen*);
+Screen* toScreen(JSC::JSValue);
 
 class JSScreenPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSScreenPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,14 +64,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsScreenHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenColorDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenPixelDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenColorDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenPixelDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
index ea245530e7..de43ae4cc2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStorage)
+ASSERT_CLASS_FITS_IN_CELL(JSStorage);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSStorageConstructor(ExecState* exec)
         : DOMObject(JSStorageConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStoragePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStoragePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +114,9 @@ static const HashTable JSStoragePrototypeTable =
 
 const ClassInfo JSStoragePrototype::s_info = { "StoragePrototype", 0, &JSStoragePrototypeTable, 0 };
 
-JSObject* JSStoragePrototype::self(ExecState* exec)
+JSObject* JSStoragePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStorage>(exec);
+    return getDOMPrototype<JSStorage>(exec, globalObject);
 }
 
 bool JSStoragePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +135,11 @@ JSStorage::JSStorage(PassRefPtr<Structure> structure, PassRefPtr<Storage> impl)
 JSStorage::~JSStorage()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSStorage::createPrototype(ExecState* exec)
+JSObject* JSStorage::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStoragePrototype(JSStoragePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSStoragePrototype(JSStoragePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSStorage::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -157,17 +156,18 @@ bool JSStorage::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSStorage, Base>(exec, &JSStorageTable, this, propertyName, slot);
 }
 
-JSValuePtr jsStorageLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Storage* imp = static_cast<Storage*>(static_cast<JSStorage*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStorage*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSStorage::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSStorage::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (customPut(exec, propertyName, value, slot))
         return;
@@ -181,69 +181,74 @@ void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNam
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSStorage::getConstructor(ExecState* exec)
+JSValue JSStorage::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStorageConstructor>(exec);
 }
 
-JSValuePtr jsStoragePrototypeFunctionKey(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionKey(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->key(index, ec));
+    JSC::JSValue result = jsString(exec, imp->key(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsStoragePrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getItem(key));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getItem(key));
     return result;
 }
 
-JSValuePtr jsStoragePrototypeFunctionSetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionSetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& key = args.at(exec, 0)->toString(exec);
-    const UString& data = args.at(exec, 1)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
+    const UString& data = args.at(1).toString(exec);
 
     imp->setItem(key, data, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsStoragePrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
     imp->removeItem(key);
     return jsUndefined();
 }
 
-JSValuePtr jsStoragePrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
@@ -252,13 +257,13 @@ JSValuePtr jsStoragePrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Storage* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Storage* object)
 {
     return getDOMObjectWrapper<JSStorage>(exec, object);
 }
-Storage* toStorage(JSC::JSValuePtr value)
+Storage* toStorage(JSC::JSValue value)
 {
-    return value->isObject(&JSStorage::s_info) ? static_cast<JSStorage*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSStorage::s_info) ? static_cast<JSStorage*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.h b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
index 4a3579ad66..64a06a2744 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
@@ -34,14 +34,14 @@ class JSStorage : public DOMObject {
 public:
     JSStorage(PassRefPtr<JSC::Structure>, PassRefPtr<Storage>);
     virtual ~JSStorage();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,26 +49,27 @@ public:
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     bool customGetPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Storage* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Storage> m_impl;
 private:
     static bool canGetItemsForName(JSC::ExecState*, Storage*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Storage*);
-Storage* toStorage(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Storage*);
+Storage* toStorage(JSC::JSValue);
 
 class JSStoragePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -77,15 +78,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsStoragePrototypeFunctionKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionSetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionSetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsStorageLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
index eda205c426..4929839ebe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
@@ -26,7 +26,9 @@
 
 #include "DOMWindow.h"
 #include "JSDOMWindow.h"
+#include "JSStorage.h"
 #include "KURL.h"
+#include "Storage.h"
 #include "StorageEvent.h"
 
 #include <runtime/Error.h>
@@ -37,17 +39,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStorageEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSStorageEvent);
 
 /* Hash table */
 
-static const HashTableValue JSStorageEventTableValues[7] =
+static const HashTableValue JSStorageEventTableValues[8] =
 {
     { "key", DontDelete|ReadOnly, (intptr_t)jsStorageEventKey, (intptr_t)0 },
     { "oldValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventOldValue, (intptr_t)0 },
     { "newValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventNewValue, (intptr_t)0 },
     { "uri", DontDelete|ReadOnly, (intptr_t)jsStorageEventUri, (intptr_t)0 },
     { "source", DontDelete|ReadOnly, (intptr_t)jsStorageEventSource, (intptr_t)0 },
+    { "storageArea", DontDelete|ReadOnly, (intptr_t)jsStorageEventStorageArea, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsStorageEventConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -78,13 +81,13 @@ public:
     JSStorageEventConstructor(ExecState* exec)
         : DOMObject(JSStorageEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStorageEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStorageEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -101,7 +104,7 @@ bool JSStorageEventConstructor::getOwnPropertySlot(ExecState* exec, const Identi
 
 static const HashTableValue JSStorageEventPrototypeTableValues[2] =
 {
-    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)8 },
+    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)9 },
     { 0, 0, 0, 0 }
 };
 
@@ -114,9 +117,9 @@ static const HashTable JSStorageEventPrototypeTable =
 
 const ClassInfo JSStorageEventPrototype::s_info = { "StorageEventPrototype", 0, &JSStorageEventPrototypeTable, 0 };
 
-JSObject* JSStorageEventPrototype::self(ExecState* exec)
+JSObject* JSStorageEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStorageEvent>(exec);
+    return getDOMPrototype<JSStorageEvent>(exec, globalObject);
 }
 
 bool JSStorageEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,9 +134,9 @@ JSStorageEvent::JSStorageEvent(PassRefPtr<Structure> structure, PassRefPtr<Stora
 {
 }
 
-JSObject* JSStorageEvent::createPrototype(ExecState* exec)
+JSObject* JSStorageEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStorageEventPrototype(JSStorageEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSStorageEventPrototype(JSStorageEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSStorageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,61 +144,75 @@ bool JSStorageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSStorageEvent, Base>(exec, &JSStorageEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsStorageEventKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->key());
 }
 
-JSValuePtr jsStorageEventOldValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventOldValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->oldValue());
 }
 
-JSValuePtr jsStorageEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->newValue());
 }
 
-JSValuePtr jsStorageEventUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->uri());
 }
 
-JSValuePtr jsStorageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->source()));
 }
 
-JSValuePtr jsStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventStorageArea(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->storageArea()));
+}
+
+JSValue jsStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSStorageEvent::getConstructor(ExecState* exec)
+JSValue JSStorageEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStorageEventConstructor>(exec);
 }
 
-JSValuePtr jsStorageEventPrototypeFunctionInitStorageEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorageEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorageEvent::s_info))
         return throwError(exec, TypeError);
     JSStorageEvent* castedThisObj = static_cast<JSStorageEvent*>(asObject(thisValue));
     StorageEvent* imp = static_cast<StorageEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& keyArg = args.at(exec, 3)->toString(exec);
-    const UString& oldValueArg = valueToStringWithNullCheck(exec, args.at(exec, 4));
-    const UString& newValueArg = valueToStringWithNullCheck(exec, args.at(exec, 5));
-    const UString& uriArg = args.at(exec, 6)->toString(exec);
-    DOMWindow* sourceArg = toDOMWindow(args.at(exec, 7));
-
-    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, sourceArg);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& keyArg = args.at(3).toString(exec);
+    const UString& oldValueArg = valueToStringWithNullCheck(exec, args.at(4));
+    const UString& newValueArg = valueToStringWithNullCheck(exec, args.at(5));
+    const UString& uriArg = args.at(6).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(7));
+    Storage* storageAreaArg = toStorage(args.at(8));
+
+    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, sourceArg, storageAreaArg);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
index 7489484308..967ab3118f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
@@ -31,27 +31,28 @@ class JSStorageEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSStorageEvent(PassRefPtr<JSC::Structure>, PassRefPtr<StorageEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSStorageEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,15 +61,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsStorageEventPrototypeFunctionInitStorageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsStorageEventKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventOldValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventOldValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventStorageArea(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
index 193eddaa78..bec95c08ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStyleSheet)
+ASSERT_CLASS_FITS_IN_CELL(JSStyleSheet);
 
 /* Hash table */
 
@@ -81,13 +81,13 @@ public:
     JSStyleSheetConstructor(ExecState* exec)
         : DOMObject(JSStyleSheetConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStyleSheetPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStyleSheetPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +116,9 @@ static const HashTable JSStyleSheetPrototypeTable =
 
 const ClassInfo JSStyleSheetPrototype::s_info = { "StyleSheetPrototype", 0, &JSStyleSheetPrototypeTable, 0 };
 
-JSObject* JSStyleSheetPrototype::self(ExecState* exec)
+JSObject* JSStyleSheetPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStyleSheet>(exec);
+    return getDOMPrototype<JSStyleSheet>(exec, globalObject);
 }
 
 const ClassInfo JSStyleSheet::s_info = { "StyleSheet", 0, &JSStyleSheetTable, 0 };
@@ -132,12 +132,11 @@ JSStyleSheet::JSStyleSheet(PassRefPtr<Structure> structure, PassRefPtr<StyleShee
 JSStyleSheet::~JSStyleSheet()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSStyleSheet::createPrototype(ExecState* exec)
+JSObject* JSStyleSheet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStyleSheetPrototype(JSStyleSheetPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSStyleSheetPrototype(JSStyleSheetPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,71 +144,78 @@ bool JSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSStyleSheet, Base>(exec, &JSStyleSheetTable, this, propertyName, slot);
 }
 
-JSValuePtr jsStyleSheetType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->type());
 }
 
-JSValuePtr jsStyleSheetDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsStyleSheetOwnerNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetOwnerNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerNode()));
 }
 
-JSValuePtr jsStyleSheetParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentStyleSheet()));
 }
 
-JSValuePtr jsStyleSheetHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->href());
 }
 
-JSValuePtr jsStyleSheetTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->title());
 }
 
-JSValuePtr jsStyleSheetMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSStyleSheet::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSStyleSheet::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSStyleSheet, Base>(exec, propertyName, value, &JSStyleSheetTable, this, slot);
 }
 
-void setJSStyleSheetDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSStyleSheetDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-JSValuePtr JSStyleSheet::getConstructor(ExecState* exec)
+JSValue JSStyleSheet::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStyleSheetConstructor>(exec);
 }
 
-StyleSheet* toStyleSheet(JSC::JSValuePtr value)
+StyleSheet* toStyleSheet(JSC::JSValue value)
 {
-    return value->isObject(&JSStyleSheet::s_info) ? static_cast<JSStyleSheet*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSStyleSheet::s_info) ? static_cast<JSStyleSheet*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
index c477eeb919..d8e751e838 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
@@ -34,32 +34,33 @@ class JSStyleSheet : public DOMObject {
 public:
     JSStyleSheet(PassRefPtr<JSC::Structure>, PassRefPtr<StyleSheet>);
     virtual ~JSStyleSheet();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     StyleSheet* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<StyleSheet> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, StyleSheet*);
-StyleSheet* toStyleSheet(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, StyleSheet*);
+StyleSheet* toStyleSheet(JSC::JSValue);
 
 class JSStyleSheetPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSStyleSheetPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,15 +68,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsStyleSheetType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSStyleSheetDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsStyleSheetOwnerNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSStyleSheetDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsStyleSheetOwnerNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
index fc4396c192..898b3bee11 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStyleSheetList)
+ASSERT_CLASS_FITS_IN_CELL(JSStyleSheetList);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSStyleSheetListConstructor(ExecState* exec)
         : DOMObject(JSStyleSheetListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStyleSheetListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStyleSheetListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +110,9 @@ static const HashTable JSStyleSheetListPrototypeTable =
 
 const ClassInfo JSStyleSheetListPrototype::s_info = { "StyleSheetListPrototype", 0, &JSStyleSheetListPrototypeTable, 0 };
 
-JSObject* JSStyleSheetListPrototype::self(ExecState* exec)
+JSObject* JSStyleSheetListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStyleSheetList>(exec);
+    return getDOMPrototype<JSStyleSheetList>(exec, globalObject);
 }
 
 bool JSStyleSheetListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,12 +131,11 @@ JSStyleSheetList::JSStyleSheetList(PassRefPtr<Structure> structure, PassRefPtr<S
 JSStyleSheetList::~JSStyleSheetList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSStyleSheetList::createPrototype(ExecState* exec)
+JSObject* JSStyleSheetList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStyleSheetListPrototype(JSStyleSheetListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSStyleSheetListPrototype(JSStyleSheetListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSStyleSheetList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -168,13 +167,14 @@ bool JSStyleSheetList::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsStyleSheetListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheetList* imp = static_cast<StyleSheetList*>(static_cast<JSStyleSheetList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStyleSheetList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -185,37 +185,38 @@ void JSStyleSheetList::getPropertyNames(ExecState* exec, PropertyNameArray& prop
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSStyleSheetList::getConstructor(ExecState* exec)
+JSValue JSStyleSheetList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStyleSheetListConstructor>(exec);
 }
 
-JSValuePtr jsStyleSheetListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStyleSheetListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStyleSheetList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStyleSheetList::s_info))
         return throwError(exec, TypeError);
     JSStyleSheetList* castedThisObj = static_cast<JSStyleSheetList*>(asObject(thisValue));
     StyleSheetList* imp = static_cast<StyleSheetList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSStyleSheetList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<StyleSheetList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, StyleSheetList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, StyleSheetList* object)
 {
     return getDOMObjectWrapper<JSStyleSheetList>(exec, object);
 }
-StyleSheetList* toStyleSheetList(JSC::JSValuePtr value)
+StyleSheetList* toStyleSheetList(JSC::JSValue value)
 {
-    return value->isObject(&JSStyleSheetList::s_info) ? static_cast<JSStyleSheetList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSStyleSheetList::s_info) ? static_cast<JSStyleSheetList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
index f9edf94300..bb06c58ffc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
@@ -34,39 +34,40 @@ class JSStyleSheetList : public DOMObject {
 public:
     JSStyleSheetList(PassRefPtr<JSC::Structure>, PassRefPtr<StyleSheetList>);
     virtual ~JSStyleSheetList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     StyleSheetList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<StyleSheetList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, StyleSheetList*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, StyleSheetList*);
-StyleSheetList* toStyleSheetList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, StyleSheetList*);
+StyleSheetList* toStyleSheetList(JSC::JSValue);
 
 class JSStyleSheetListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,11 +76,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsStyleSheetListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStyleSheetListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsStyleSheetListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.cpp b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
index 053e28066a..c6f306f0c8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSText)
+ASSERT_CLASS_FITS_IN_CELL(JSText);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSTextConstructor(ExecState* exec)
         : DOMObject(JSTextConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTextPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTextPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSTextPrototypeTable =
 
 const ClassInfo JSTextPrototype::s_info = { "TextPrototype", 0, &JSTextPrototypeTable, 0 };
 
-JSObject* JSTextPrototype::self(ExecState* exec)
+JSObject* JSTextPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSText>(exec);
+    return getDOMPrototype<JSText>(exec, globalObject);
 }
 
 bool JSTextPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,9 +128,9 @@ JSText::JSText(PassRefPtr<Structure> structure, PassRefPtr<Text> impl)
 {
 }
 
-JSObject* JSText::createPrototype(ExecState* exec)
+JSObject* JSText::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTextPrototype(JSTextPrototype::createStructure(JSCharacterDataPrototype::self(exec)));
+    return new (exec) JSTextPrototype(JSTextPrototype::createStructure(JSCharacterDataPrototype::self(exec, globalObject)));
 }
 
 bool JSText::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,51 +138,54 @@ bool JSText::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSText, Base>(exec, &JSTextTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTextWholeText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextWholeText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Text* imp = static_cast<Text*>(static_cast<JSText*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->wholeText());
 }
 
-JSValuePtr jsTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSText*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSText::getConstructor(ExecState* exec)
+JSValue JSText::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTextConstructor>(exec);
 }
 
-JSValuePtr jsTextPrototypeFunctionSplitText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTextPrototypeFunctionSplitText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSText::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSText::s_info))
         return throwError(exec, TypeError);
     JSText* castedThisObj = static_cast<JSText*>(asObject(thisValue));
     Text* imp = static_cast<Text*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->splitText(offset, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->splitText(offset, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsTextPrototypeFunctionReplaceWholeText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTextPrototypeFunctionReplaceWholeText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSText::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSText::s_info))
         return throwError(exec, TypeError);
     JSText* castedThisObj = static_cast<JSText*>(asObject(thisValue));
     Text* imp = static_cast<Text*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& content = args.at(exec, 0)->toString(exec);
+    const UString& content = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->replaceWholeText(content, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->replaceWholeText(content, ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.h b/src/3rdparty/webkit/WebCore/generated/JSText.h
index e5972440e0..e489274f78 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.h
@@ -31,27 +31,29 @@ class JSText : public JSCharacterData {
     typedef JSCharacterData Base;
 public:
     JSText(PassRefPtr<JSC::Structure>, PassRefPtr<Text>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, Text*);
 
 class JSTextPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,12 +62,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTextPrototypeFunctionSplitText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTextPrototypeFunctionReplaceWholeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTextPrototypeFunctionSplitText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTextPrototypeFunctionReplaceWholeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTextWholeText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextWholeText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
index 857faabc51..fe7fc2af48 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTextEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSTextEvent);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSTextEventConstructor(ExecState* exec)
         : DOMObject(JSTextEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTextEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTextEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSTextEventPrototypeTable =
 
 const ClassInfo JSTextEventPrototype::s_info = { "TextEventPrototype", 0, &JSTextEventPrototypeTable, 0 };
 
-JSObject* JSTextEventPrototype::self(ExecState* exec)
+JSObject* JSTextEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTextEvent>(exec);
+    return getDOMPrototype<JSTextEvent>(exec, globalObject);
 }
 
 bool JSTextEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +126,9 @@ JSTextEvent::JSTextEvent(PassRefPtr<Structure> structure, PassRefPtr<TextEvent>
 {
 }
 
-JSObject* JSTextEvent::createPrototype(ExecState* exec)
+JSObject* JSTextEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTextEventPrototype(JSTextEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSTextEventPrototype(JSTextEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSTextEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,32 +136,34 @@ bool JSTextEvent::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSTextEvent, Base>(exec, &JSTextEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTextEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TextEvent* imp = static_cast<TextEvent*>(static_cast<JSTextEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSTextEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSTextEvent::getConstructor(ExecState* exec)
+JSValue JSTextEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTextEventConstructor>(exec);
 }
 
-JSValuePtr jsTextEventPrototypeFunctionInitTextEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTextEventPrototypeFunctionInitTextEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTextEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTextEvent::s_info))
         return throwError(exec, TypeError);
     JSTextEvent* castedThisObj = static_cast<JSTextEvent*>(asObject(thisValue));
     TextEvent* imp = static_cast<TextEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* viewArg = toDOMWindow(args.at(exec, 3));
-    const UString& dataArg = args.at(exec, 4)->toString(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    DOMWindow* viewArg = toDOMWindow(args.at(3));
+    const UString& dataArg = args.at(4).toString(exec);
 
     imp->initTextEvent(typeArg, canBubbleArg, cancelableArg, viewArg, dataArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
index b4cd3b561b..08f014173c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
@@ -31,27 +31,28 @@ class JSTextEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSTextEvent(PassRefPtr<JSC::Structure>, PassRefPtr<TextEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSTextEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,11 +61,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTextEventPrototypeFunctionInitTextEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTextEventPrototypeFunctionInitTextEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTextEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
index 5b31aeb2c7..fcc384a39a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTextMetrics)
+ASSERT_CLASS_FITS_IN_CELL(JSTextMetrics);
 
 /* Hash table */
 
@@ -69,13 +69,13 @@ public:
     JSTextMetricsConstructor(ExecState* exec)
         : DOMObject(JSTextMetricsConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTextMetricsPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTextMetricsPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +104,9 @@ static const HashTable JSTextMetricsPrototypeTable =
 
 const ClassInfo JSTextMetricsPrototype::s_info = { "TextMetricsPrototype", 0, &JSTextMetricsPrototypeTable, 0 };
 
-JSObject* JSTextMetricsPrototype::self(ExecState* exec)
+JSObject* JSTextMetricsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTextMetrics>(exec);
+    return getDOMPrototype<JSTextMetrics>(exec, globalObject);
 }
 
 const ClassInfo JSTextMetrics::s_info = { "TextMetrics", 0, &JSTextMetricsTable, 0 };
@@ -120,12 +120,11 @@ JSTextMetrics::JSTextMetrics(PassRefPtr<Structure> structure, PassRefPtr<TextMet
 JSTextMetrics::~JSTextMetrics()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSTextMetrics::createPrototype(ExecState* exec)
+JSObject* JSTextMetrics::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTextMetricsPrototype(JSTextMetricsPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSTextMetricsPrototype(JSTextMetricsPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSTextMetrics::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,28 +132,29 @@ bool JSTextMetrics::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSTextMetrics, Base>(exec, &JSTextMetricsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTextMetricsWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextMetricsWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TextMetrics* imp = static_cast<TextMetrics*>(static_cast<JSTextMetrics*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSTextMetrics*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSTextMetrics::getConstructor(ExecState* exec)
+JSValue JSTextMetrics::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTextMetricsConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, TextMetrics* object)
+JSC::JSValue toJS(JSC::ExecState* exec, TextMetrics* object)
 {
     return getDOMObjectWrapper<JSTextMetrics>(exec, object);
 }
-TextMetrics* toTextMetrics(JSC::JSValuePtr value)
+TextMetrics* toTextMetrics(JSC::JSValue value)
 {
-    return value->isObject(&JSTextMetrics::s_info) ? static_cast<JSTextMetrics*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSTextMetrics::s_info) ? static_cast<JSTextMetrics*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
index 5065932033..4fb044fa7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
@@ -34,29 +34,30 @@ class JSTextMetrics : public DOMObject {
 public:
     JSTextMetrics(PassRefPtr<JSC::Structure>, PassRefPtr<TextMetrics>);
     virtual ~JSTextMetrics();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     TextMetrics* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<TextMetrics> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, TextMetrics*);
-TextMetrics* toTextMetrics(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, TextMetrics*);
+TextMetrics* toTextMetrics(JSC::JSValue);
 
 class JSTextMetricsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSTextMetricsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,8 +65,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsTextMetricsWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextMetricsWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
index 1ba0cd4246..f2ea67b078 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTimeRanges)
+ASSERT_CLASS_FITS_IN_CELL(JSTimeRanges);
 
 /* Hash table */
 
@@ -68,9 +68,9 @@ static const HashTable JSTimeRangesPrototypeTable =
 
 const ClassInfo JSTimeRangesPrototype::s_info = { "TimeRangesPrototype", 0, &JSTimeRangesPrototypeTable, 0 };
 
-JSObject* JSTimeRangesPrototype::self(ExecState* exec)
+JSObject* JSTimeRangesPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTimeRanges>(exec);
+    return getDOMPrototype<JSTimeRanges>(exec, globalObject);
 }
 
 bool JSTimeRangesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -89,12 +89,11 @@ JSTimeRanges::JSTimeRanges(PassRefPtr<Structure> structure, PassRefPtr<TimeRange
 JSTimeRanges::~JSTimeRanges()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSTimeRanges::createPrototype(ExecState* exec)
+JSObject* JSTimeRanges::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTimeRangesPrototype(JSTimeRangesPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSTimeRangesPrototype(JSTimeRangesPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSTimeRanges::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -102,49 +101,52 @@ bool JSTimeRanges::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSTimeRanges, Base>(exec, &JSTimeRangesTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTimeRangesLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTimeRangesLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TimeRanges* imp = static_cast<TimeRanges*>(static_cast<JSTimeRanges*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsTimeRangesPrototypeFunctionStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTimeRanges::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTimeRanges::s_info))
         return throwError(exec, TypeError);
     JSTimeRanges* castedThisObj = static_cast<JSTimeRanges*>(asObject(thisValue));
     TimeRanges* imp = static_cast<TimeRanges*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->start(index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->start(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsTimeRangesPrototypeFunctionEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTimeRanges::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTimeRanges::s_info))
         return throwError(exec, TypeError);
     JSTimeRanges* castedThisObj = static_cast<JSTimeRanges*>(asObject(thisValue));
     TimeRanges* imp = static_cast<TimeRanges*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->end(index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->end(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, TimeRanges* object)
+JSC::JSValue toJS(JSC::ExecState* exec, TimeRanges* object)
 {
     return getDOMObjectWrapper<JSTimeRanges>(exec, object);
 }
-TimeRanges* toTimeRanges(JSC::JSValuePtr value)
+TimeRanges* toTimeRanges(JSC::JSValue value)
 {
-    return value->isObject(&JSTimeRanges::s_info) ? static_cast<JSTimeRanges*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSTimeRanges::s_info) ? static_cast<JSTimeRanges*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
index 0032039000..41da9efed4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
@@ -34,12 +34,12 @@ class JSTimeRanges : public DOMObject {
 public:
     JSTimeRanges(PassRefPtr<JSC::Structure>, PassRefPtr<TimeRanges>);
     virtual ~JSTimeRanges();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,16 +50,17 @@ private:
     RefPtr<TimeRanges> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, TimeRanges*);
-TimeRanges* toTimeRanges(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, TimeRanges*);
+TimeRanges* toTimeRanges(JSC::JSValue);
 
 class JSTimeRangesPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,11 +69,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTimeRangesPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTimeRangesPrototypeFunctionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTimeRangesLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTimeRangesLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
index 31214a637d..209a539be2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTreeWalker)
+ASSERT_CLASS_FITS_IN_CELL(JSTreeWalker);
 
 /* Hash table */
 
@@ -78,13 +78,13 @@ public:
     JSTreeWalkerConstructor(ExecState* exec)
         : DOMObject(JSTreeWalkerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTreeWalkerPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTreeWalkerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +120,9 @@ static const HashTable JSTreeWalkerPrototypeTable =
 
 const ClassInfo JSTreeWalkerPrototype::s_info = { "TreeWalkerPrototype", 0, &JSTreeWalkerPrototypeTable, 0 };
 
-JSObject* JSTreeWalkerPrototype::self(ExecState* exec)
+JSObject* JSTreeWalkerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTreeWalker>(exec);
+    return getDOMPrototype<JSTreeWalker>(exec, globalObject);
 }
 
 bool JSTreeWalkerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,12 +141,11 @@ JSTreeWalker::JSTreeWalker(PassRefPtr<Structure> structure, PassRefPtr<TreeWalke
 JSTreeWalker::~JSTreeWalker()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSTreeWalker::createPrototype(ExecState* exec)
+JSObject* JSTreeWalker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTreeWalkerPrototype(JSTreeWalkerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSTreeWalkerPrototype(JSTreeWalkerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSTreeWalker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,46 +153,51 @@ bool JSTreeWalker::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSTreeWalker, Base>(exec, &JSTreeWalkerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTreeWalkerRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->root()));
 }
 
-JSValuePtr jsTreeWalkerWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->whatToShow());
 }
 
-JSValuePtr jsTreeWalkerFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->filter()));
 }
 
-JSValuePtr jsTreeWalkerExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->expandEntityReferences());
 }
 
-JSValuePtr jsTreeWalkerCurrentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerCurrentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->currentNode()));
 }
 
-JSValuePtr jsTreeWalkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSTreeWalker::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSTreeWalker::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSTreeWalker, Base>(exec, propertyName, value, &JSTreeWalkerTable, this, slot);
 }
 
-void setJSTreeWalkerCurrentNode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSTreeWalkerCurrentNode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -201,74 +205,81 @@ void setJSTreeWalkerCurrentNode(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSTreeWalker::getConstructor(ExecState* exec)
+JSValue JSTreeWalker::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTreeWalkerConstructor>(exec);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionParentNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionParentNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->parentNode(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionFirstChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionFirstChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->firstChild(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionLastChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionLastChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->lastChild(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionPreviousSibling(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousSibling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->previousSibling(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionNextSibling(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextSibling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->nextSibling(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->previousNode(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->nextNode(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, TreeWalker* object)
+JSC::JSValue toJS(JSC::ExecState* exec, TreeWalker* object)
 {
     return getDOMObjectWrapper<JSTreeWalker>(exec, object);
 }
-TreeWalker* toTreeWalker(JSC::JSValuePtr value)
+TreeWalker* toTreeWalker(JSC::JSValue value)
 {
-    return value->isObject(&JSTreeWalker::s_info) ? static_cast<JSTreeWalker*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSTreeWalker::s_info) ? static_cast<JSTreeWalker*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
index 537891528f..92b42bf4ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
@@ -34,45 +34,46 @@ class JSTreeWalker : public DOMObject {
 public:
     JSTreeWalker(PassRefPtr<JSC::Structure>, PassRefPtr<TreeWalker>);
     virtual ~JSTreeWalker();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr parentNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr firstChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr lastChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr previousSibling(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr nextSibling(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr previousNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr nextNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue parentNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue firstChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue lastChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue previousSibling(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue nextSibling(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue previousNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue nextNode(JSC::ExecState*, const JSC::ArgList&);
     TreeWalker* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<TreeWalker> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, TreeWalker*);
-TreeWalker* toTreeWalker(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, TreeWalker*);
+TreeWalker* toTreeWalker(JSC::JSValue);
 
 class JSTreeWalkerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,22 +82,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionParentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionFirstChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionLastChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionPreviousSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionNextSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionParentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionFirstChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionLastChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTreeWalkerRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerCurrentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSTreeWalkerCurrentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsTreeWalkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerCurrentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSTreeWalkerCurrentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTreeWalkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
index 1b959364c0..d838bd434e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSUIEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSUIEvent);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSUIEventConstructor(ExecState* exec)
         : DOMObject(JSUIEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSUIEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSUIEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +116,9 @@ static const HashTable JSUIEventPrototypeTable =
 
 const ClassInfo JSUIEventPrototype::s_info = { "UIEventPrototype", 0, &JSUIEventPrototypeTable, 0 };
 
-JSObject* JSUIEventPrototype::self(ExecState* exec)
+JSObject* JSUIEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSUIEvent>(exec);
+    return getDOMPrototype<JSUIEvent>(exec, globalObject);
 }
 
 bool JSUIEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,9 +133,9 @@ JSUIEvent::JSUIEvent(PassRefPtr<Structure> structure, PassRefPtr<UIEvent> impl)
 {
 }
 
-JSObject* JSUIEvent::createPrototype(ExecState* exec)
+JSObject* JSUIEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSUIEventPrototype(JSUIEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSUIEventPrototype(JSUIEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSUIEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,80 +143,90 @@ bool JSUIEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSUIEvent, Base>(exec, &JSUIEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsUIEventView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventView(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->view()));
 }
 
-JSValuePtr jsUIEventDetail(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventDetail(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->detail());
 }
 
-JSValuePtr jsUIEventKeyCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventKeyCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->keyCode());
 }
 
-JSValuePtr jsUIEventCharCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventCharCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->charCode());
 }
 
-JSValuePtr jsUIEventLayerX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventLayerX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->layerX());
 }
 
-JSValuePtr jsUIEventLayerY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventLayerY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->layerY());
 }
 
-JSValuePtr jsUIEventPageX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventPageX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageX());
 }
 
-JSValuePtr jsUIEventPageY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventPageY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageY());
 }
 
-JSValuePtr jsUIEventWhich(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventWhich(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->which());
 }
 
-JSValuePtr jsUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSUIEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSUIEvent::getConstructor(ExecState* exec)
+JSValue JSUIEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSUIEventConstructor>(exec);
 }
 
-JSValuePtr jsUIEventPrototypeFunctionInitUIEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsUIEventPrototypeFunctionInitUIEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSUIEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSUIEvent::s_info))
         return throwError(exec, TypeError);
     JSUIEvent* castedThisObj = static_cast<JSUIEvent*>(asObject(thisValue));
     UIEvent* imp = static_cast<UIEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* view = toDOMWindow(args.at(exec, 3));
-    int detail = args.at(exec, 4)->toInt32(exec);
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    DOMWindow* view = toDOMWindow(args.at(3));
+    int detail = args.at(4).toInt32(exec);
 
     imp->initUIEvent(type, canBubble, cancelable, view, detail);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
index b8b0e62c7a..3999438014 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
@@ -31,27 +31,28 @@ class JSUIEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSUIEvent(PassRefPtr<JSC::Structure>, PassRefPtr<UIEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSUIEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,19 +61,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsUIEventPrototypeFunctionInitUIEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsUIEventPrototypeFunctionInitUIEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsUIEventView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventDetail(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventKeyCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventCharCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventLayerX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventLayerY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventPageX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventPageY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventWhich(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventDetail(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventKeyCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventCharCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventLayerX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventLayerY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventPageX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventPageY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventWhich(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
index d11a11ad45..6b1db4bb6b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSVoidCallback)
+ASSERT_CLASS_FITS_IN_CELL(JSVoidCallback);
 
 /* Hash table for prototype */
 
@@ -51,9 +51,9 @@ static const HashTable JSVoidCallbackPrototypeTable =
 
 const ClassInfo JSVoidCallbackPrototype::s_info = { "VoidCallbackPrototype", 0, &JSVoidCallbackPrototypeTable, 0 };
 
-JSObject* JSVoidCallbackPrototype::self(ExecState* exec)
+JSObject* JSVoidCallbackPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSVoidCallback>(exec);
+    return getDOMPrototype<JSVoidCallback>(exec, globalObject);
 }
 
 bool JSVoidCallbackPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -72,17 +72,17 @@ JSVoidCallback::JSVoidCallback(PassRefPtr<Structure> structure, PassRefPtr<VoidC
 JSVoidCallback::~JSVoidCallback()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSVoidCallback::createPrototype(ExecState* exec)
+JSObject* JSVoidCallback::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSVoidCallbackPrototype(JSVoidCallbackPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSVoidCallbackPrototype(JSVoidCallbackPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsVoidCallbackPrototypeFunctionHandleEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsVoidCallbackPrototypeFunctionHandleEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSVoidCallback::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSVoidCallback::s_info))
         return throwError(exec, TypeError);
     JSVoidCallback* castedThisObj = static_cast<JSVoidCallback*>(asObject(thisValue));
     VoidCallback* imp = static_cast<VoidCallback*>(castedThisObj->impl());
@@ -91,7 +91,7 @@ JSValuePtr jsVoidCallbackPrototypeFunctionHandleEvent(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, VoidCallback* object)
+JSC::JSValue toJS(JSC::ExecState* exec, VoidCallback* object)
 {
     return getDOMObjectWrapper<JSVoidCallback>(exec, object);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
index 5da934fb19..ac05cb9d12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
@@ -34,7 +34,7 @@ class JSVoidCallback : public DOMObject {
 public:
     JSVoidCallback(PassRefPtr<JSC::Structure>, PassRefPtr<VoidCallback>);
     virtual ~JSVoidCallback();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -44,16 +44,17 @@ private:
     RefPtr<VoidCallback> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, VoidCallback*);
-VoidCallback* toVoidCallback(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, VoidCallback*);
+VoidCallback* toVoidCallback(JSC::JSValue);
 
 class JSVoidCallbackPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,7 +63,7 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsVoidCallbackPrototypeFunctionHandleEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsVoidCallbackPrototypeFunctionHandleEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
index f2356ec52d..7e0b292b90 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitAnimationEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitAnimationEvent);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSWebKitAnimationEventConstructor(ExecState* exec)
         : DOMObject(JSWebKitAnimationEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitAnimationEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitAnimationEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSWebKitAnimationEventPrototypeTable =
 
 const ClassInfo JSWebKitAnimationEventPrototype::s_info = { "WebKitAnimationEventPrototype", 0, &JSWebKitAnimationEventPrototypeTable, 0 };
 
-JSObject* JSWebKitAnimationEventPrototype::self(ExecState* exec)
+JSObject* JSWebKitAnimationEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitAnimationEvent>(exec);
+    return getDOMPrototype<JSWebKitAnimationEvent>(exec, globalObject);
 }
 
 bool JSWebKitAnimationEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +126,9 @@ JSWebKitAnimationEvent::JSWebKitAnimationEvent(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSWebKitAnimationEvent::createPrototype(ExecState* exec)
+JSObject* JSWebKitAnimationEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitAnimationEventPrototype(JSWebKitAnimationEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSWebKitAnimationEventPrototype(JSWebKitAnimationEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitAnimationEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,38 +136,41 @@ bool JSWebKitAnimationEvent::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSWebKitAnimationEvent, Base>(exec, &JSWebKitAnimationEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitAnimationEventAnimationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventAnimationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->animationName());
 }
 
-JSValuePtr jsWebKitAnimationEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->elapsedTime());
 }
 
-JSValuePtr jsWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWebKitAnimationEvent::getConstructor(ExecState* exec)
+JSValue JSWebKitAnimationEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitAnimationEventConstructor>(exec);
 }
 
-JSValuePtr jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitAnimationEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitAnimationEvent::s_info))
         return throwError(exec, TypeError);
     JSWebKitAnimationEvent* castedThisObj = static_cast<JSWebKitAnimationEvent*>(asObject(thisValue));
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& animationNameArg = args.at(exec, 3)->toString(exec);
-    double elapsedTimeArg = args.at(exec, 4)->toNumber(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& animationNameArg = args.at(3).toString(exec);
+    double elapsedTimeArg = args.at(4).toNumber(exec);
 
     imp->initWebKitAnimationEvent(typeArg, canBubbleArg, cancelableArg, animationNameArg, elapsedTimeArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
index d7a271b198..5c6862eb58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
@@ -31,27 +31,28 @@ class JSWebKitAnimationEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSWebKitAnimationEvent(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitAnimationEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitAnimationEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,12 +61,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWebKitAnimationEventAnimationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitAnimationEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitAnimationEventAnimationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitAnimationEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
index 9cccf8bf8d..6ba8f9a08c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
@@ -37,7 +37,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframeRule)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframeRule);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSWebKitCSSKeyframeRuleConstructor(ExecState* exec)
         : DOMObject(JSWebKitCSSKeyframeRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframeRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframeRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +110,9 @@ static const HashTable JSWebKitCSSKeyframeRulePrototypeTable =
 
 const ClassInfo JSWebKitCSSKeyframeRulePrototype::s_info = { "WebKitCSSKeyframeRulePrototype", 0, &JSWebKitCSSKeyframeRulePrototypeTable, 0 };
 
-JSObject* JSWebKitCSSKeyframeRulePrototype::self(ExecState* exec)
+JSObject* JSWebKitCSSKeyframeRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitCSSKeyframeRule>(exec);
+    return getDOMPrototype<JSWebKitCSSKeyframeRule>(exec, globalObject);
 }
 
 const ClassInfo JSWebKitCSSKeyframeRule::s_info = { "WebKitCSSKeyframeRule", &JSCSSRule::s_info, &JSWebKitCSSKeyframeRuleTable, 0 };
@@ -122,9 +122,9 @@ JSWebKitCSSKeyframeRule::JSWebKitCSSKeyframeRule(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSWebKitCSSKeyframeRule::createPrototype(ExecState* exec)
+JSObject* JSWebKitCSSKeyframeRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitCSSKeyframeRulePrototype(JSWebKitCSSKeyframeRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSWebKitCSSKeyframeRulePrototype(JSWebKitCSSKeyframeRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitCSSKeyframeRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,34 +132,36 @@ bool JSWebKitCSSKeyframeRule::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSWebKitCSSKeyframeRule, Base>(exec, &JSWebKitCSSKeyframeRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitCSSKeyframeRuleKeyText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleKeyText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->keyText());
 }
 
-JSValuePtr jsWebKitCSSKeyframeRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSWebKitCSSKeyframeRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSWebKitCSSKeyframeRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSWebKitCSSKeyframeRule, Base>(exec, propertyName, value, &JSWebKitCSSKeyframeRuleTable, this, slot);
 }
 
-void setJSWebKitCSSKeyframeRuleKeyText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWebKitCSSKeyframeRuleKeyText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(static_cast<JSWebKitCSSKeyframeRule*>(thisObject)->impl());
-    imp->setKeyText(value->toString(exec));
+    imp->setKeyText(value.toString(exec));
 }
 
-JSValuePtr JSWebKitCSSKeyframeRule::getConstructor(ExecState* exec)
+JSValue JSWebKitCSSKeyframeRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitCSSKeyframeRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
index 8a0d83c594..f77c22629b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
@@ -31,24 +31,25 @@ class JSWebKitCSSKeyframeRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSWebKitCSSKeyframeRule(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSKeyframeRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitCSSKeyframeRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSWebKitCSSKeyframeRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWebKitCSSKeyframeRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSKeyframeRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
index 0bfcfa9243..50ef4229b3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframesRule)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframesRule);
 
 /* Hash table */
 
@@ -77,13 +77,13 @@ public:
     JSWebKitCSSKeyframesRuleConstructor(ExecState* exec)
         : DOMObject(JSWebKitCSSKeyframesRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframesRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframesRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +115,9 @@ static const HashTable JSWebKitCSSKeyframesRulePrototypeTable =
 
 const ClassInfo JSWebKitCSSKeyframesRulePrototype::s_info = { "WebKitCSSKeyframesRulePrototype", 0, &JSWebKitCSSKeyframesRulePrototypeTable, 0 };
 
-JSObject* JSWebKitCSSKeyframesRulePrototype::self(ExecState* exec)
+JSObject* JSWebKitCSSKeyframesRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitCSSKeyframesRule>(exec);
+    return getDOMPrototype<JSWebKitCSSKeyframesRule>(exec, globalObject);
 }
 
 bool JSWebKitCSSKeyframesRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,9 +132,9 @@ JSWebKitCSSKeyframesRule::JSWebKitCSSKeyframesRule(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSWebKitCSSKeyframesRule::createPrototype(ExecState* exec)
+JSObject* JSWebKitCSSKeyframesRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitCSSKeyframesRulePrototype(JSWebKitCSSKeyframesRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSWebKitCSSKeyframesRulePrototype(JSWebKitCSSKeyframesRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitCSSKeyframesRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -162,28 +162,30 @@ bool JSWebKitCSSKeyframesRule::getOwnPropertySlot(ExecState* exec, unsigned prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsWebKitCSSKeyframesRuleName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->name());
 }
 
-JSValuePtr jsWebKitCSSKeyframesRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cssRules()));
 }
 
-JSValuePtr jsWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSWebKitCSSKeyframesRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSWebKitCSSKeyframesRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSWebKitCSSKeyframesRule, Base>(exec, propertyName, value, &JSWebKitCSSKeyframesRuleTable, this, slot);
 }
 
-void setJSWebKitCSSKeyframesRuleName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWebKitCSSKeyframesRuleName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(static_cast<JSWebKitCSSKeyframesRule*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
@@ -196,50 +198,53 @@ void JSWebKitCSSKeyframesRule::getPropertyNames(ExecState* exec, PropertyNameArr
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSWebKitCSSKeyframesRule::getConstructor(ExecState* exec)
+JSValue JSWebKitCSSKeyframesRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitCSSKeyframesRuleConstructor>(exec);
 }
 
-JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitCSSKeyframesRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
-    const UString& rule = args.at(exec, 0)->toString(exec);
+    const UString& rule = args.at(0).toString(exec);
 
     imp->insertRule(rule);
     return jsUndefined();
 }
 
-JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitCSSKeyframesRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
     imp->deleteRule(key);
     return jsUndefined();
 }
 
-JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitCSSKeyframesRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->findRule(key)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->findRule(key)));
     return result;
 }
 
 
-JSValuePtr JSWebKitCSSKeyframesRule::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSWebKitCSSKeyframesRule::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitCSSKeyframesRule* thisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<WebKitCSSKeyframesRule*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
index b689e1209d..789f0a1499 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
@@ -31,31 +31,32 @@ class JSWebKitCSSKeyframesRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSWebKitCSSKeyframesRule(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSKeyframesRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSWebKitCSSKeyframesRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,15 +65,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWebKitCSSKeyframesRuleName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWebKitCSSKeyframesRuleName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWebKitCSSKeyframesRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframesRuleName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSKeyframesRuleName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSKeyframesRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
new file mode 100644
index 0000000000..a9479de7c6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
@@ -0,0 +1,556 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "JSWebKitCSSMatrix.h"
+
+#include <wtf/GetPtr.h>
+
+#include "JSWebKitCSSMatrix.h"
+#include "KURL.h"
+#include "WebKitCSSMatrix.h"
+
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSMatrix);
+
+/* Hash table */
+
+static const HashTableValue JSWebKitCSSMatrixTableValues[23] =
+{
+    { "a", DontDelete, (intptr_t)jsWebKitCSSMatrixA, (intptr_t)setJSWebKitCSSMatrixA },
+    { "b", DontDelete, (intptr_t)jsWebKitCSSMatrixB, (intptr_t)setJSWebKitCSSMatrixB },
+    { "c", DontDelete, (intptr_t)jsWebKitCSSMatrixC, (intptr_t)setJSWebKitCSSMatrixC },
+    { "d", DontDelete, (intptr_t)jsWebKitCSSMatrixD, (intptr_t)setJSWebKitCSSMatrixD },
+    { "e", DontDelete, (intptr_t)jsWebKitCSSMatrixE, (intptr_t)setJSWebKitCSSMatrixE },
+    { "f", DontDelete, (intptr_t)jsWebKitCSSMatrixF, (intptr_t)setJSWebKitCSSMatrixF },
+    { "m11", DontDelete, (intptr_t)jsWebKitCSSMatrixM11, (intptr_t)setJSWebKitCSSMatrixM11 },
+    { "m12", DontDelete, (intptr_t)jsWebKitCSSMatrixM12, (intptr_t)setJSWebKitCSSMatrixM12 },
+    { "m13", DontDelete, (intptr_t)jsWebKitCSSMatrixM13, (intptr_t)setJSWebKitCSSMatrixM13 },
+    { "m14", DontDelete, (intptr_t)jsWebKitCSSMatrixM14, (intptr_t)setJSWebKitCSSMatrixM14 },
+    { "m21", DontDelete, (intptr_t)jsWebKitCSSMatrixM21, (intptr_t)setJSWebKitCSSMatrixM21 },
+    { "m22", DontDelete, (intptr_t)jsWebKitCSSMatrixM22, (intptr_t)setJSWebKitCSSMatrixM22 },
+    { "m23", DontDelete, (intptr_t)jsWebKitCSSMatrixM23, (intptr_t)setJSWebKitCSSMatrixM23 },
+    { "m24", DontDelete, (intptr_t)jsWebKitCSSMatrixM24, (intptr_t)setJSWebKitCSSMatrixM24 },
+    { "m31", DontDelete, (intptr_t)jsWebKitCSSMatrixM31, (intptr_t)setJSWebKitCSSMatrixM31 },
+    { "m32", DontDelete, (intptr_t)jsWebKitCSSMatrixM32, (intptr_t)setJSWebKitCSSMatrixM32 },
+    { "m33", DontDelete, (intptr_t)jsWebKitCSSMatrixM33, (intptr_t)setJSWebKitCSSMatrixM33 },
+    { "m34", DontDelete, (intptr_t)jsWebKitCSSMatrixM34, (intptr_t)setJSWebKitCSSMatrixM34 },
+    { "m41", DontDelete, (intptr_t)jsWebKitCSSMatrixM41, (intptr_t)setJSWebKitCSSMatrixM41 },
+    { "m42", DontDelete, (intptr_t)jsWebKitCSSMatrixM42, (intptr_t)setJSWebKitCSSMatrixM42 },
+    { "m43", DontDelete, (intptr_t)jsWebKitCSSMatrixM43, (intptr_t)setJSWebKitCSSMatrixM43 },
+    { "m44", DontDelete, (intptr_t)jsWebKitCSSMatrixM44, (intptr_t)setJSWebKitCSSMatrixM44 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitCSSMatrixTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 255, JSWebKitCSSMatrixTableValues, 0 };
+#else
+    { 65, 63, JSWebKitCSSMatrixTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebKitCSSMatrixPrototypeTableValues[9] =
+{
+    { "setMatrixValue", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue, (intptr_t)1 },
+    { "multiply", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionMultiply, (intptr_t)1 },
+    { "inverse", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionInverse, (intptr_t)0 },
+    { "translate", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionTranslate, (intptr_t)3 },
+    { "scale", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionScale, (intptr_t)3 },
+    { "rotate", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionRotate, (intptr_t)3 },
+    { "rotateAxisAngle", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle, (intptr_t)4 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionToString, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitCSSMatrixPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSWebKitCSSMatrixPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSWebKitCSSMatrixPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebKitCSSMatrixPrototype::s_info = { "WebKitCSSMatrixPrototype", 0, &JSWebKitCSSMatrixPrototypeTable, 0 };
+
+JSObject* JSWebKitCSSMatrixPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebKitCSSMatrix>(exec, globalObject);
+}
+
+bool JSWebKitCSSMatrixPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebKitCSSMatrixPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSWebKitCSSMatrix::s_info = { "WebKitCSSMatrix", 0, &JSWebKitCSSMatrixTable, 0 };
+
+JSWebKitCSSMatrix::JSWebKitCSSMatrix(PassRefPtr<Structure> structure, PassRefPtr<WebKitCSSMatrix> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSWebKitCSSMatrix::~JSWebKitCSSMatrix()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSWebKitCSSMatrix::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebKitCSSMatrixPrototype(JSWebKitCSSMatrixPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebKitCSSMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebKitCSSMatrix, Base>(exec, &JSWebKitCSSMatrixTable, this, propertyName, slot);
+}
+
+JSValue jsWebKitCSSMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->a());
+}
+
+JSValue jsWebKitCSSMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->b());
+}
+
+JSValue jsWebKitCSSMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->c());
+}
+
+JSValue jsWebKitCSSMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->d());
+}
+
+JSValue jsWebKitCSSMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->e());
+}
+
+JSValue jsWebKitCSSMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->f());
+}
+
+JSValue jsWebKitCSSMatrixM11(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m11());
+}
+
+JSValue jsWebKitCSSMatrixM12(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m12());
+}
+
+JSValue jsWebKitCSSMatrixM13(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m13());
+}
+
+JSValue jsWebKitCSSMatrixM14(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m14());
+}
+
+JSValue jsWebKitCSSMatrixM21(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m21());
+}
+
+JSValue jsWebKitCSSMatrixM22(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m22());
+}
+
+JSValue jsWebKitCSSMatrixM23(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m23());
+}
+
+JSValue jsWebKitCSSMatrixM24(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m24());
+}
+
+JSValue jsWebKitCSSMatrixM31(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m31());
+}
+
+JSValue jsWebKitCSSMatrixM32(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m32());
+}
+
+JSValue jsWebKitCSSMatrixM33(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m33());
+}
+
+JSValue jsWebKitCSSMatrixM34(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m34());
+}
+
+JSValue jsWebKitCSSMatrixM41(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m41());
+}
+
+JSValue jsWebKitCSSMatrixM42(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m42());
+}
+
+JSValue jsWebKitCSSMatrixM43(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m43());
+}
+
+JSValue jsWebKitCSSMatrixM44(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m44());
+}
+
+void JSWebKitCSSMatrix::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSWebKitCSSMatrix, Base>(exec, propertyName, value, &JSWebKitCSSMatrixTable, this, slot);
+}
+
+void setJSWebKitCSSMatrixA(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setA(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixB(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setB(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixC(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setC(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixD(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setD(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixE(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setE(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixF(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setF(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM11(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM11(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM12(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM12(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM13(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM13(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM14(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM14(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM21(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM21(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM22(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM22(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM23(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM23(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM24(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM24(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM31(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM31(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM32(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM32(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM33(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM33(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM34(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM34(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM41(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM41(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM42(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM42(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM43(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM43(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM44(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM44(value.toNumber(exec));
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& string = args.at(0).toString(exec);
+
+    imp->setMatrixValue(string, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    WebKitCSSMatrix* secondMatrix = toWebKitCSSMatrix(args.at(0));
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->multiply(secondMatrix)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->inverse(ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double x = args.at(0).toNumber(exec);
+    double y = args.at(1).toNumber(exec);
+    double z = args.at(2).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->translate(x, y, z)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double scaleX = args.at(0).toNumber(exec);
+    double scaleY = args.at(1).toNumber(exec);
+    double scaleZ = args.at(2).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->scale(scaleX, scaleY, scaleZ)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double rotX = args.at(0).toNumber(exec);
+    double rotY = args.at(1).toNumber(exec);
+    double rotZ = args.at(2).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->rotate(rotX, rotY, rotZ)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double x = args.at(0).toNumber(exec);
+    double y = args.at(1).toNumber(exec);
+    double z = args.at(2).toNumber(exec);
+    double angle = args.at(3).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->rotateAxisAngle(x, y, z, angle)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->toString());
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, WebKitCSSMatrix* object)
+{
+    return getDOMObjectWrapper<JSWebKitCSSMatrix>(exec, object);
+}
+WebKitCSSMatrix* toWebKitCSSMatrix(JSC::JSValue value)
+{
+    return value.isObject(&JSWebKitCSSMatrix::s_info) ? static_cast<JSWebKitCSSMatrix*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
new file mode 100644
index 0000000000..ad377126d1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
@@ -0,0 +1,130 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebKitCSSMatrix_h
+#define JSWebKitCSSMatrix_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebKitCSSMatrix;
+
+class JSWebKitCSSMatrix : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSWebKitCSSMatrix(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSMatrix>);
+    virtual ~JSWebKitCSSMatrix();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    WebKitCSSMatrix* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebKitCSSMatrix> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, WebKitCSSMatrix*);
+WebKitCSSMatrix* toWebKitCSSMatrix(JSC::JSValue);
+
+class JSWebKitCSSMatrixPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSWebKitCSSMatrixPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionMultiply(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionInverse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsWebKitCSSMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM11(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM11(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM12(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM12(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM13(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM13(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM14(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM14(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM21(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM21(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM22(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM22(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM23(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM23(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM24(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM24(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM31(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM31(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM32(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM32(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM33(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM33(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM34(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM34(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM41(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM41(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM42(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM42(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM43(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM43(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM44(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM44(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
index d0b1072d34..07ed92cb7a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSTransformValue)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSTransformValue);
 
 /* Hash table */
 
@@ -52,7 +52,7 @@ static const HashTable JSWebKitCSSTransformValueTable =
 
 /* Hash table for constructor */
 
-static const HashTableValue JSWebKitCSSTransformValueConstructorTableValues[12] =
+static const HashTableValue JSWebKitCSSTransformValueConstructorTableValues[22] =
 {
     { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE, (intptr_t)0 },
     { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEX, (intptr_t)0 },
@@ -65,6 +65,16 @@ static const HashTableValue JSWebKitCSSTransformValueConstructorTableValues[12]
     { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWX, (intptr_t)0 },
     { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWY, (intptr_t)0 },
     { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX, (intptr_t)0 },
+    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEZ, (intptr_t)0 },
+    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE3D, (intptr_t)0 },
+    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEX, (intptr_t)0 },
+    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEY, (intptr_t)0 },
+    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEZ, (intptr_t)0 },
+    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE3D, (intptr_t)0 },
+    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEZ, (intptr_t)0 },
+    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE3D, (intptr_t)0 },
+    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_PERSPECTIVE, (intptr_t)0 },
+    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX3D, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -72,7 +82,7 @@ static const HashTable JSWebKitCSSTransformValueConstructorTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSWebKitCSSTransformValueConstructorTableValues, 0 };
 #else
-    { 33, 31, JSWebKitCSSTransformValueConstructorTableValues, 0 };
+    { 68, 63, JSWebKitCSSTransformValueConstructorTableValues, 0 };
 #endif
 
 class JSWebKitCSSTransformValueConstructor : public DOMObject {
@@ -80,13 +90,13 @@ public:
     JSWebKitCSSTransformValueConstructor(ExecState* exec)
         : DOMObject(JSWebKitCSSTransformValueConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitCSSTransformValuePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitCSSTransformValuePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -101,7 +111,7 @@ bool JSWebKitCSSTransformValueConstructor::getOwnPropertySlot(ExecState* exec, c
 
 /* Hash table for prototype */
 
-static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[12] =
+static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[22] =
 {
     { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE, (intptr_t)0 },
     { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEX, (intptr_t)0 },
@@ -114,6 +124,16 @@ static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[12] =
     { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWX, (intptr_t)0 },
     { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWY, (intptr_t)0 },
     { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX, (intptr_t)0 },
+    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEZ, (intptr_t)0 },
+    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE3D, (intptr_t)0 },
+    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEX, (intptr_t)0 },
+    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEY, (intptr_t)0 },
+    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEZ, (intptr_t)0 },
+    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE3D, (intptr_t)0 },
+    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEZ, (intptr_t)0 },
+    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE3D, (intptr_t)0 },
+    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_PERSPECTIVE, (intptr_t)0 },
+    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX3D, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -121,14 +141,14 @@ static const HashTable JSWebKitCSSTransformValuePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSWebKitCSSTransformValuePrototypeTableValues, 0 };
 #else
-    { 33, 31, JSWebKitCSSTransformValuePrototypeTableValues, 0 };
+    { 68, 63, JSWebKitCSSTransformValuePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSWebKitCSSTransformValuePrototype::s_info = { "WebKitCSSTransformValuePrototype", 0, &JSWebKitCSSTransformValuePrototypeTable, 0 };
 
-JSObject* JSWebKitCSSTransformValuePrototype::self(ExecState* exec)
+JSObject* JSWebKitCSSTransformValuePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitCSSTransformValue>(exec);
+    return getDOMPrototype<JSWebKitCSSTransformValue>(exec, globalObject);
 }
 
 bool JSWebKitCSSTransformValuePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +163,9 @@ JSWebKitCSSTransformValue::JSWebKitCSSTransformValue(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSWebKitCSSTransformValue::createPrototype(ExecState* exec)
+JSObject* JSWebKitCSSTransformValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitCSSTransformValuePrototype(JSWebKitCSSTransformValuePrototype::createStructure(JSCSSValueListPrototype::self(exec)));
+    return new (exec) JSWebKitCSSTransformValuePrototype(JSWebKitCSSTransformValuePrototype::createStructure(JSCSSValueListPrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitCSSTransformValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,77 +173,128 @@ bool JSWebKitCSSTransformValue::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSWebKitCSSTransformValue, Base>(exec, &JSWebKitCSSTransformValueTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitCSSTransformValueOperationType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSTransformValueOperationType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSTransformValue* imp = static_cast<WebKitCSSTransformValue*>(static_cast<JSWebKitCSSTransformValue*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->operationType());
 }
 
-JSValuePtr jsWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitCSSTransformValue*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWebKitCSSTransformValue::getConstructor(ExecState* exec)
+JSValue JSWebKitCSSTransformValue::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitCSSTransformValueConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SCALEX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALEX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SCALEY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALEY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SKEW(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEW(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(12));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(13));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATEX(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(14));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATEY(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(15));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(16));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(17));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_SCALEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(18));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_SCALE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(19));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(20));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(21));
+}
+
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
index d5d8915062..3f636e3f29 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
@@ -31,27 +31,28 @@ class JSWebKitCSSTransformValue : public JSCSSValueList {
     typedef JSCSSValueList Base;
 public:
     JSWebKitCSSTransformValue(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSTransformValue>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitCSSTransformValuePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,21 +61,31 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWebKitCSSTransformValueOperationType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueOperationType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SCALEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SCALEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SKEW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
new file mode 100644
index 0000000000..4c433d4e6a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "JSWebKitPoint.h"
+
+#include <wtf/GetPtr.h>
+
+#include "WebKitPoint.h"
+
+#include <runtime/JSNumberCell.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitPoint);
+
+/* Hash table */
+
+static const HashTableValue JSWebKitPointTableValues[3] =
+{
+    { "x", DontDelete, (intptr_t)jsWebKitPointX, (intptr_t)setJSWebKitPointX },
+    { "y", DontDelete, (intptr_t)jsWebKitPointY, (intptr_t)setJSWebKitPointY },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitPointTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSWebKitPointTableValues, 0 };
+#else
+    { 4, 3, JSWebKitPointTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebKitPointPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitPointPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebKitPointPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebKitPointPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebKitPointPrototype::s_info = { "WebKitPointPrototype", 0, &JSWebKitPointPrototypeTable, 0 };
+
+JSObject* JSWebKitPointPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebKitPoint>(exec, globalObject);
+}
+
+const ClassInfo JSWebKitPoint::s_info = { "WebKitPoint", 0, &JSWebKitPointTable, 0 };
+
+JSWebKitPoint::JSWebKitPoint(PassRefPtr<Structure> structure, PassRefPtr<WebKitPoint> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSWebKitPoint::~JSWebKitPoint()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSWebKitPoint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebKitPointPrototype(JSWebKitPointPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebKitPoint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebKitPoint, Base>(exec, &JSWebKitPointTable, this, propertyName, slot);
+}
+
+JSValue jsWebKitPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->x());
+}
+
+JSValue jsWebKitPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->y());
+}
+
+void JSWebKitPoint::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSWebKitPoint, Base>(exec, propertyName, value, &JSWebKitPointTable, this, slot);
+}
+
+void setJSWebKitPointX(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(thisObject)->impl());
+    imp->setX(value.toFloat(exec));
+}
+
+void setJSWebKitPointY(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(thisObject)->impl());
+    imp->setY(value.toFloat(exec));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, WebKitPoint* object)
+{
+    return getDOMObjectWrapper<JSWebKitPoint>(exec, object);
+}
+WebKitPoint* toWebKitPoint(JSC::JSValue value)
+{
+    return value.isObject(&JSWebKitPoint::s_info) ? static_cast<JSWebKitPoint*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
new file mode 100644
index 0000000000..1a7c88f011
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
@@ -0,0 +1,75 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebKitPoint_h
+#define JSWebKitPoint_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebKitPoint;
+
+class JSWebKitPoint : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSWebKitPoint(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitPoint>);
+    virtual ~JSWebKitPoint();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    WebKitPoint* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebKitPoint> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, WebKitPoint*);
+WebKitPoint* toWebKitPoint(JSC::JSValue);
+
+class JSWebKitPointPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSWebKitPointPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsWebKitPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
index 2090734132..d254d28af2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitTransitionEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitTransitionEvent);
 
 /* Hash table */
 
@@ -73,13 +73,13 @@ public:
     JSWebKitTransitionEventConstructor(ExecState* exec)
         : DOMObject(JSWebKitTransitionEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitTransitionEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitTransitionEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +109,9 @@ static const HashTable JSWebKitTransitionEventPrototypeTable =
 
 const ClassInfo JSWebKitTransitionEventPrototype::s_info = { "WebKitTransitionEventPrototype", 0, &JSWebKitTransitionEventPrototypeTable, 0 };
 
-JSObject* JSWebKitTransitionEventPrototype::self(ExecState* exec)
+JSObject* JSWebKitTransitionEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitTransitionEvent>(exec);
+    return getDOMPrototype<JSWebKitTransitionEvent>(exec, globalObject);
 }
 
 bool JSWebKitTransitionEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +126,9 @@ JSWebKitTransitionEvent::JSWebKitTransitionEvent(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSWebKitTransitionEvent::createPrototype(ExecState* exec)
+JSObject* JSWebKitTransitionEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitTransitionEventPrototype(JSWebKitTransitionEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSWebKitTransitionEventPrototype(JSWebKitTransitionEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitTransitionEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,38 +136,41 @@ bool JSWebKitTransitionEvent::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSWebKitTransitionEvent, Base>(exec, &JSWebKitTransitionEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitTransitionEventPropertyName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventPropertyName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->propertyName());
 }
 
-JSValuePtr jsWebKitTransitionEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->elapsedTime());
 }
 
-JSValuePtr jsWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWebKitTransitionEvent::getConstructor(ExecState* exec)
+JSValue JSWebKitTransitionEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitTransitionEventConstructor>(exec);
 }
 
-JSValuePtr jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitTransitionEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitTransitionEvent::s_info))
         return throwError(exec, TypeError);
     JSWebKitTransitionEvent* castedThisObj = static_cast<JSWebKitTransitionEvent*>(asObject(thisValue));
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& propertyNameArg = args.at(exec, 3)->toString(exec);
-    double elapsedTimeArg = args.at(exec, 4)->toNumber(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& propertyNameArg = args.at(3).toString(exec);
+    double elapsedTimeArg = args.at(4).toNumber(exec);
 
     imp->initWebKitTransitionEvent(typeArg, canBubbleArg, cancelableArg, propertyNameArg, elapsedTimeArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
index f342d474c5..de22ec358d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
@@ -31,27 +31,28 @@ class JSWebKitTransitionEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSWebKitTransitionEvent(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitTransitionEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitTransitionEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,12 +61,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWebKitTransitionEventPropertyName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitTransitionEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitTransitionEventPropertyName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitTransitionEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
index 752cd13cc5..a0fad0bb5f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWheelEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSWheelEvent);
 
 /* Hash table */
 
@@ -83,13 +83,13 @@ public:
     JSWheelEventConstructor(ExecState* exec)
         : DOMObject(JSWheelEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWheelEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWheelEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +118,9 @@ static const HashTable JSWheelEventPrototypeTable =
 
 const ClassInfo JSWheelEventPrototype::s_info = { "WheelEventPrototype", 0, &JSWheelEventPrototypeTable, 0 };
 
-JSObject* JSWheelEventPrototype::self(ExecState* exec)
+JSObject* JSWheelEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWheelEvent>(exec);
+    return getDOMPrototype<JSWheelEvent>(exec, globalObject);
 }
 
 const ClassInfo JSWheelEvent::s_info = { "WheelEvent", &JSUIEvent::s_info, &JSWheelEventTable, 0 };
@@ -130,9 +130,9 @@ JSWheelEvent::JSWheelEvent(PassRefPtr<Structure> structure, PassRefPtr<WheelEven
 {
 }
 
-JSObject* JSWheelEvent::createPrototype(ExecState* exec)
+JSObject* JSWheelEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWheelEventPrototype(JSWheelEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSWheelEventPrototype(JSWheelEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSWheelEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -140,101 +140,116 @@ bool JSWheelEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSWheelEvent, Base>(exec, &JSWheelEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWheelEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenX());
 }
 
-JSValuePtr jsWheelEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenY());
 }
 
-JSValuePtr jsWheelEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientX());
 }
 
-JSValuePtr jsWheelEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientY());
 }
 
-JSValuePtr jsWheelEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ctrlKey());
 }
 
-JSValuePtr jsWheelEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->shiftKey());
 }
 
-JSValuePtr jsWheelEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altKey());
 }
 
-JSValuePtr jsWheelEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->metaKey());
 }
 
-JSValuePtr jsWheelEventWheelDelta(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDelta(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->wheelDelta());
 }
 
-JSValuePtr jsWheelEventWheelDeltaX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDeltaX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->wheelDeltaX());
 }
 
-JSValuePtr jsWheelEventWheelDeltaY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDeltaY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->wheelDeltaY());
 }
 
-JSValuePtr jsWheelEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetX());
 }
 
-JSValuePtr jsWheelEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetY());
 }
 
-JSValuePtr jsWheelEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsWheelEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWheelEvent::getConstructor(ExecState* exec)
+JSValue JSWheelEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWheelEventConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
index 4c2d5e8029..ae9730daab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
@@ -31,23 +31,24 @@ class JSWheelEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSWheelEvent(PassRefPtr<JSC::Structure>, PassRefPtr<WheelEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWheelEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSWheelEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,22 +56,22 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWheelEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventWheelDelta(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventWheelDeltaX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventWheelDeltaY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventWheelDelta(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventWheelDeltaX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventWheelDeltaY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
index e88aa9653d..55e80c555f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
@@ -41,7 +41,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorker)
+ASSERT_CLASS_FITS_IN_CELL(JSWorker);
 
 /* Hash table */
 
@@ -80,9 +80,9 @@ static const HashTable JSWorkerPrototypeTable =
 
 const ClassInfo JSWorkerPrototype::s_info = { "WorkerPrototype", 0, &JSWorkerPrototypeTable, 0 };
 
-JSObject* JSWorkerPrototype::self(ExecState* exec)
+JSObject* JSWorkerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWorker>(exec);
+    return getDOMPrototype<JSWorker>(exec, globalObject);
 }
 
 bool JSWorkerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,12 +101,11 @@ JSWorker::JSWorker(PassRefPtr<Structure> structure, PassRefPtr<Worker> impl)
 JSWorker::~JSWorker()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSWorker::createPrototype(ExecState* exec)
+JSObject* JSWorker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWorkerPrototype(JSWorkerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSWorkerPrototype(JSWorkerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSWorker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,64 +113,70 @@ bool JSWorker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSWorker, Base>(exec, &JSWorkerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsWorkerOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onmessage())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-void JSWorker::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSWorker::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSWorker, Base>(exec, propertyName, value, &JSWorkerTable, this, slot);
 }
 
-void setJSWorkerOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSWorkerOnmessage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmessage(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr jsWorkerPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     Worker* imp = static_cast<Worker*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     imp->postMessage(message);
     return jsUndefined();
 }
 
-JSValuePtr jsWorkerPrototypeFunctionTerminate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionTerminate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     Worker* imp = static_cast<Worker*>(castedThisObj->impl());
@@ -180,44 +185,47 @@ JSValuePtr jsWorkerPrototypeFunctionTerminate(ExecState* exec, JSObject*, JSValu
     return jsUndefined();
 }
 
-JSValuePtr jsWorkerPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     Worker* imp = static_cast<Worker*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Worker* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Worker* object)
 {
     return getDOMObjectWrapper<JSWorker>(exec, object);
 }
-Worker* toWorker(JSC::JSValuePtr value)
+Worker* toWorker(JSC::JSValue value)
 {
-    return value->isObject(&JSWorker::s_info) ? static_cast<JSWorker*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSWorker::s_info) ? static_cast<JSWorker*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.h b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
index 98e26cf02c..069e0c9327 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
@@ -37,13 +37,13 @@ class JSWorker : public DOMObject {
 public:
     JSWorker(PassRefPtr<JSC::Structure>, PassRefPtr<Worker>);
     virtual ~JSWorker();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -52,24 +52,25 @@ public:
 
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     Worker* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Worker> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Worker*);
-Worker* toWorker(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Worker*);
+Worker* toWorker(JSC::JSValue);
 
 class JSWorkerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -78,17 +79,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWorkerPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionTerminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionTerminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWorkerOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsWorkerOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
index f0702ea9d5..1e71820252 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
@@ -32,8 +32,10 @@
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "JSMessageEvent.h"
+#include "JSWorkerContext.h"
 #include "JSWorkerLocation.h"
 #include "JSWorkerNavigator.h"
+#include "JSXMLHttpRequest.h"
 #include "WorkerContext.h"
 #include "WorkerLocation.h"
 #include "WorkerNavigator.h"
@@ -44,18 +46,19 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerContext)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerContext);
 
 /* Hash table */
 
-static const HashTableValue JSWorkerContextTableValues[7] =
+static const HashTableValue JSWorkerContextTableValues[8] =
 {
     { "self", DontDelete, (intptr_t)jsWorkerContextSelf, (intptr_t)setJSWorkerContextSelf },
-    { "onmessage", DontDelete, (intptr_t)jsWorkerContextOnmessage, (intptr_t)setJSWorkerContextOnmessage },
     { "location", DontDelete, (intptr_t)jsWorkerContextLocation, (intptr_t)setJSWorkerContextLocation },
     { "navigator", DontDelete, (intptr_t)jsWorkerContextNavigator, (intptr_t)setJSWorkerContextNavigator },
+    { "onmessage", DontDelete, (intptr_t)jsWorkerContextOnmessage, (intptr_t)setJSWorkerContextOnmessage },
     { "MessageEvent", DontDelete, (intptr_t)jsWorkerContextMessageEventConstructor, (intptr_t)setJSWorkerContextMessageEventConstructor },
     { "WorkerLocation", DontDelete, (intptr_t)jsWorkerContextWorkerLocationConstructor, (intptr_t)setJSWorkerContextWorkerLocationConstructor },
+    { "XMLHttpRequest", DontDelete, (intptr_t)jsWorkerContextXMLHttpRequestConstructor, (intptr_t)setJSWorkerContextXMLHttpRequestConstructor },
     { 0, 0, 0, 0 }
 };
 
@@ -68,9 +71,15 @@ static const HashTable JSWorkerContextTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSWorkerContextPrototypeTableValues[5] =
+static const HashTableValue JSWorkerContextPrototypeTableValues[11] =
 {
+    { "close", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClose, (intptr_t)0 },
+    { "importScripts", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionImportScripts, (intptr_t)0 },
     { "postMessage", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionPostMessage, (intptr_t)1 },
+    { "setTimeout", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionSetTimeout, (intptr_t)2 },
+    { "clearTimeout", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClearTimeout, (intptr_t)1 },
+    { "setInterval", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionSetInterval, (intptr_t)2 },
+    { "clearInterval", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClearInterval, (intptr_t)1 },
     { "addEventListener", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionAddEventListener, (intptr_t)3 },
     { "removeEventListener", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionRemoveEventListener, (intptr_t)3 },
     { "dispatchEvent", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionDispatchEvent, (intptr_t)1 },
@@ -79,9 +88,9 @@ static const HashTableValue JSWorkerContextPrototypeTableValues[5] =
 
 static const HashTable JSWorkerContextPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSWorkerContextPrototypeTableValues, 0 };
+    { 1023, JSWorkerContextPrototypeTableValues, 0 };
 #else
-    { 8, 7, JSWorkerContextPrototypeTableValues, 0 };
+    { 34, 31, JSWorkerContextPrototypeTableValues, 0 };
 #endif
 
 static const HashTable* getJSWorkerContextPrototypeTable(ExecState* exec)
@@ -118,121 +127,212 @@ bool JSWorkerContext::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSWorkerContext, Base>(exec, getJSWorkerContextTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerContextSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    return static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->self(exec);
+    UNUSED_PARAM(exec);
+    WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->self()));
 }
 
-JSValuePtr jsWorkerContextOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onmessage())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
+    return toJS(exec, WTF::getPtr(imp->location()));
 }
 
-JSValuePtr jsWorkerContextLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->location()));
+    return toJS(exec, WTF::getPtr(imp->navigator()));
 }
 
-JSValuePtr jsWorkerContextNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->navigator()));
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsWorkerContextMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(slot);
     return JSMessageEvent::getConstructor(exec);
 }
 
-JSValuePtr jsWorkerContextWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(slot);
     return JSWorkerLocation::getConstructor(exec);
 }
 
-void JSWorkerContext::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+JSValue jsWorkerContextXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    lookupPut<JSWorkerContext, Base>(exec, propertyName, value, getJSWorkerContextTable(exec), this, slot);
+    return static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->xmlHttpRequest(exec);
 }
 
-void setJSWorkerContextSelf(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void JSWorkerContext::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    static_cast<JSWorkerContext*>(thisObject)->setSelf(exec, value);
+    lookupPut<JSWorkerContext, Base>(exec, propertyName, value, getJSWorkerContextTable(exec), this, slot);
 }
 
-void setJSWorkerContextOnmessage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextSelf(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSWorkerContext*>(thisObject);
-    imp->setOnmessage(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    // Shadowing a built-in object
+    static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "self"), value);
 }
 
-void setJSWorkerContextLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    // Shadowing a built-in object
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "location"), value);
 }
 
-void setJSWorkerContextNavigator(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextNavigator(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    // Shadowing a built-in object
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "navigator"), value);
 }
 
-void setJSWorkerContextMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSWorkerContext*>(thisObject);
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSWorkerContextMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     // Shadowing a built-in constructor
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "MessageEvent"), value);
 }
 
-void setJSWorkerContextWorkerLocationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextWorkerLocationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     // Shadowing a built-in constructor
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "WorkerLocation"), value);
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+void setJSWorkerContextXMLHttpRequestConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    // Shadowing a built-in constructor
+    static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
+
+    imp->close();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionImportScripts(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    return castedThisObj->importScripts(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     imp->postMessage(message);
     return jsUndefined();
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    return castedThisObj->setTimeout(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearTimeout(handle);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    return castedThisObj->setInterval(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearInterval(handle);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
index fe04c1829e..8b9f617465 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
@@ -36,11 +36,11 @@ public:
     JSWorkerContext(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,22 +49,25 @@ public:
 
 
     // Custom attributes
-    JSC::JSValuePtr self(JSC::ExecState*) const;
-    void setSelf(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue xmlHttpRequest(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue importScripts(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setTimeout(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
 };
 
 
 class JSWorkerContextPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
     void* operator new(size_t, JSC::JSGlobalData*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,24 +76,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionImportScripts(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWorkerContextSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextWorkerLocationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsWorkerContextSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextWorkerLocationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
index 6f02e02394..e69de29bb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
@@ -1,18 +0,0 @@
-// Automatically generated from ../bindings/js/JSWorkerContextBase.cpp using WebCore/../JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-namespace WebCore {
-
-using namespace JSC;
-
-static const struct HashTableValue JSWorkerContextBaseTableValues[1] = {
-   { 0, 0, 0, 0 }
-};
-
-extern const struct HashTable JSWorkerContextBaseTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSWorkerContextBaseTableValues, 0 };
-#else
-    { 1, 0, JSWorkerContextBaseTableValues, 0 };
-#endif
-
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
index 84396577ea..188f6cbe63 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerLocation)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerLocation);
 
 /* Hash table */
 
@@ -82,13 +82,13 @@ public:
     JSWorkerLocationConstructor(ExecState* exec)
         : DOMObject(JSWorkerLocationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWorkerLocationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWorkerLocationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -122,9 +122,9 @@ static const HashTable* getJSWorkerLocationPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSWorkerLocationPrototype::s_info = { "WorkerLocationPrototype", 0, 0, getJSWorkerLocationPrototypeTable };
 
-JSObject* JSWorkerLocationPrototype::self(ExecState* exec)
+JSObject* JSWorkerLocationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWorkerLocation>(exec);
+    return getDOMPrototype<JSWorkerLocation>(exec, globalObject);
 }
 
 bool JSWorkerLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,12 +147,11 @@ JSWorkerLocation::JSWorkerLocation(PassRefPtr<Structure> structure, PassRefPtr<W
 JSWorkerLocation::~JSWorkerLocation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSWorkerLocation::createPrototype(ExecState* exec)
+JSObject* JSWorkerLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWorkerLocationPrototype(JSWorkerLocationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSWorkerLocationPrototype(JSWorkerLocationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSWorkerLocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -160,82 +159,91 @@ bool JSWorkerLocation::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSWorkerLocation, Base>(exec, getJSWorkerLocationTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsWorkerLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsWorkerLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsWorkerLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsWorkerLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsWorkerLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsWorkerLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsWorkerLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-JSValuePtr jsWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWorkerLocation::getConstructor(ExecState* exec)
+JSValue JSWorkerLocation::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWorkerLocationConstructor>(exec);
 }
 
-JSValuePtr jsWorkerLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerLocation::s_info))
         return throwError(exec, TypeError);
     JSWorkerLocation* castedThisObj = static_cast<JSWorkerLocation*>(asObject(thisValue));
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, WorkerLocation* object)
+JSC::JSValue toJS(JSC::ExecState* exec, WorkerLocation* object)
 {
     return getDOMObjectWrapper<JSWorkerLocation>(exec, object);
 }
-WorkerLocation* toWorkerLocation(JSC::JSValuePtr value)
+WorkerLocation* toWorkerLocation(JSC::JSValue value)
 {
-    return value->isObject(&JSWorkerLocation::s_info) ? static_cast<JSWorkerLocation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSWorkerLocation::s_info) ? static_cast<JSWorkerLocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
index 161b8a9ee2..f2da5c8aa3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
@@ -37,33 +37,34 @@ class JSWorkerLocation : public DOMObject {
 public:
     JSWorkerLocation(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerLocation>);
     virtual ~JSWorkerLocation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     WorkerLocation* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WorkerLocation> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, WorkerLocation*);
-WorkerLocation* toWorkerLocation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, WorkerLocation*);
+WorkerLocation* toWorkerLocation(JSC::JSValue);
 
 class JSWorkerLocationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,18 +73,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWorkerLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWorkerLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
index 25a30af78b..5a819b5fb7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerNavigator)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerNavigator);
 
 /* Hash table */
 
@@ -77,9 +77,9 @@ static const HashTable* getJSWorkerNavigatorPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSWorkerNavigatorPrototype::s_info = { "WorkerNavigatorPrototype", 0, 0, getJSWorkerNavigatorPrototypeTable };
 
-JSObject* JSWorkerNavigatorPrototype::self(ExecState* exec)
+JSObject* JSWorkerNavigatorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWorkerNavigator>(exec);
+    return getDOMPrototype<JSWorkerNavigator>(exec, globalObject);
 }
 
 static const HashTable* getJSWorkerNavigatorTable(ExecState* exec)
@@ -97,12 +97,11 @@ JSWorkerNavigator::JSWorkerNavigator(PassRefPtr<Structure> structure, PassRefPtr
 JSWorkerNavigator::~JSWorkerNavigator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSWorkerNavigator::createPrototype(ExecState* exec)
+JSObject* JSWorkerNavigator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWorkerNavigatorPrototype(JSWorkerNavigatorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSWorkerNavigatorPrototype(JSWorkerNavigatorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSWorkerNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,43 +109,48 @@ bool JSWorkerNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSWorkerNavigator, Base>(exec, getJSWorkerNavigatorTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appName());
 }
 
-JSValuePtr jsWorkerNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appVersion());
 }
 
-JSValuePtr jsWorkerNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->platform());
 }
 
-JSValuePtr jsWorkerNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->userAgent());
 }
 
-JSValuePtr jsWorkerNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->onLine());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, WorkerNavigator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, WorkerNavigator* object)
 {
     return getDOMObjectWrapper<JSWorkerNavigator>(exec, object);
 }
-WorkerNavigator* toWorkerNavigator(JSC::JSValuePtr value)
+WorkerNavigator* toWorkerNavigator(JSC::JSValue value)
 {
-    return value->isObject(&JSWorkerNavigator::s_info) ? static_cast<JSWorkerNavigator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSWorkerNavigator::s_info) ? static_cast<JSWorkerNavigator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
index b2804581c3..8baacde01b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
@@ -37,12 +37,12 @@ class JSWorkerNavigator : public DOMObject {
 public:
     JSWorkerNavigator(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerNavigator>);
     virtual ~JSWorkerNavigator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<WorkerNavigator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, WorkerNavigator*);
-WorkerNavigator* toWorkerNavigator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, WorkerNavigator*);
+WorkerNavigator* toWorkerNavigator(JSC::JSValue);
 
 class JSWorkerNavigatorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSWorkerNavigatorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,11 +67,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWorkerNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
index a326915a74..a2acb0cbe8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
@@ -45,11 +45,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequest)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequest);
 
 /* Hash table */
 
-static const HashTableValue JSXMLHttpRequestTableValues[13] =
+static const HashTableValue JSXMLHttpRequestTableValues[14] =
 {
     { "onabort", DontDelete, (intptr_t)jsXMLHttpRequestOnabort, (intptr_t)setJSXMLHttpRequestOnabort },
     { "onerror", DontDelete, (intptr_t)jsXMLHttpRequestOnerror, (intptr_t)setJSXMLHttpRequestOnerror },
@@ -58,6 +58,7 @@ static const HashTableValue JSXMLHttpRequestTableValues[13] =
     { "onprogress", DontDelete, (intptr_t)jsXMLHttpRequestOnprogress, (intptr_t)setJSXMLHttpRequestOnprogress },
     { "onreadystatechange", DontDelete, (intptr_t)jsXMLHttpRequestOnreadystatechange, (intptr_t)setJSXMLHttpRequestOnreadystatechange },
     { "readyState", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestReadyState, (intptr_t)0 },
+    { "withCredentials", DontDelete, (intptr_t)jsXMLHttpRequestWithCredentials, (intptr_t)setJSXMLHttpRequestWithCredentials },
     { "upload", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestUpload, (intptr_t)0 },
     { "responseText", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestResponseText, (intptr_t)0 },
     { "responseXML", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestResponseXML, (intptr_t)0 },
@@ -70,7 +71,7 @@ static const HashTable JSXMLHttpRequestTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSXMLHttpRequestTableValues, 0 };
 #else
-    { 34, 31, JSXMLHttpRequestTableValues, 0 };
+    { 35, 31, JSXMLHttpRequestTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -102,19 +103,27 @@ static const HashTable JSXMLHttpRequestPrototypeTable =
     { 37, 31, JSXMLHttpRequestPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestPrototype::s_info = { "XMLHttpRequestPrototype", 0, &JSXMLHttpRequestPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestPrototype::s_info = { "XMLHttpRequestPrototype", 0, 0, getJSXMLHttpRequestPrototypeTable };
 
-JSObject* JSXMLHttpRequestPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequest>(exec);
+    return getDOMPrototype<JSXMLHttpRequest>(exec, globalObject);
 }
 
 bool JSXMLHttpRequestPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticPropertySlot<JSXMLHttpRequestPrototype, JSObject>(exec, &JSXMLHttpRequestPrototypeTable, this, propertyName, slot);
+    return getStaticPropertySlot<JSXMLHttpRequestPrototype, JSObject>(exec, getJSXMLHttpRequestPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSXMLHttpRequest::s_info = { "XMLHttpRequest", 0, &JSXMLHttpRequestTable, 0 };
+static const HashTable* getJSXMLHttpRequestTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestTable);
+}
+const ClassInfo JSXMLHttpRequest::s_info = { "XMLHttpRequest", 0, 0, getJSXMLHttpRequestTable };
 
 JSXMLHttpRequest::JSXMLHttpRequest(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequest> impl)
     : DOMObject(structure)
@@ -125,206 +134,239 @@ JSXMLHttpRequest::JSXMLHttpRequest(PassRefPtr<Structure> structure, PassRefPtr<X
 JSXMLHttpRequest::~JSXMLHttpRequest()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLHttpRequest::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequest::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestPrototype(JSXMLHttpRequestPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLHttpRequestPrototype(JSXMLHttpRequestPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLHttpRequest::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequest, Base>(exec, &JSXMLHttpRequestTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequest, Base>(exec, getJSXMLHttpRequestTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onloadstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onloadstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onprogress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnreadystatechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnreadystatechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onreadystatechange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onreadystatechange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->readyState());
 }
 
-JSValuePtr jsXMLHttpRequestUpload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestWithCredentials(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
+    XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->withCredentials());
+}
+
+JSValue jsXMLHttpRequestUpload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->upload()));
 }
 
-JSValuePtr jsXMLHttpRequestResponseText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestResponseText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->responseText(exec);
 }
 
-JSValuePtr jsXMLHttpRequestResponseXML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestResponseXML(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->responseXML()));
 }
 
-JSValuePtr jsXMLHttpRequestStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->status(ec));
+    JSC::JSValue result = jsNumber(exec, imp->status(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXMLHttpRequestStatusText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestStatusText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsString(exec, imp->statusText(ec));
+    JSC::JSValue result = jsString(exec, imp->statusText(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-void JSXMLHttpRequest::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSXMLHttpRequest::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    lookupPut<JSXMLHttpRequest, Base>(exec, propertyName, value, &JSXMLHttpRequestTable, this, slot);
+    lookupPut<JSXMLHttpRequest, Base>(exec, propertyName, value, getJSXMLHttpRequestTable(exec), this, slot);
 }
 
-void setJSXMLHttpRequestOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnabort(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnload(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnloadstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnloadstart(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnprogress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnprogress(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnreadystatechange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnreadystatechange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnreadystatechange(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnreadystatechange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSXMLHttpRequestWithCredentials(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
+    ExceptionCode ec = 0;
+    imp->setWithCredentials(value.toBoolean(exec), ec);
+    setDOMException(exec, ec);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->open(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionSetRequestHeader(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSetRequestHeader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->setRequestHeader(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionSend(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->send(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
@@ -333,101 +375,107 @@ JSValuePtr jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JSObject*, JS
     return jsUndefined();
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsStringOrUndefined(exec, imp->getAllResponseHeaders(ec));
+    JSC::JSValue result = jsStringOrUndefined(exec, imp->getAllResponseHeaders(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionGetResponseHeader(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetResponseHeader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->getResponseHeader(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionOverrideMimeType(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOverrideMimeType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->overrideMimeType(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXMLHttpRequestUNSENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestUNSENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsXMLHttpRequestOPENED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestOPENED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsXMLHttpRequestHEADERS_RECEIVED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestHEADERS_RECEIVED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsXMLHttpRequestLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsXMLHttpRequestDONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestDONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLHttpRequest* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLHttpRequest* object)
 {
     return getDOMObjectWrapper<JSXMLHttpRequest>(exec, object);
 }
-XMLHttpRequest* toXMLHttpRequest(JSC::JSValuePtr value)
+XMLHttpRequest* toXMLHttpRequest(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLHttpRequest::s_info) ? static_cast<JSXMLHttpRequest*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLHttpRequest::s_info) ? static_cast<JSXMLHttpRequest*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
index 29be6220cf..9529b0d4b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
@@ -34,13 +34,13 @@ class JSXMLHttpRequest : public DOMObject {
 public:
     JSXMLHttpRequest(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequest>);
     virtual ~JSXMLHttpRequest();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,32 +49,33 @@ public:
 
 
     // Custom attributes
-    JSC::JSValuePtr responseText(JSC::ExecState*) const;
+    JSC::JSValue responseText(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr open(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setRequestHeader(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr send(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getResponseHeader(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr overrideMimeType(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setRequestHeader(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue send(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getResponseHeader(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue overrideMimeType(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     XMLHttpRequest* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLHttpRequest> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLHttpRequest*);
-XMLHttpRequest* toXMLHttpRequest(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLHttpRequest*);
+XMLHttpRequest* toXMLHttpRequest(JSC::JSValue);
 
 class JSXMLHttpRequestPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -83,43 +84,45 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionSetRequestHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionSend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionAbort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionGetResponseHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionOverrideMimeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSetRequestHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAbort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetResponseHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOverrideMimeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnreadystatechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnreadystatechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestUpload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestResponseText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestResponseXML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestStatusText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnreadystatechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnreadystatechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestWithCredentials(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestWithCredentials(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUpload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestResponseText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestResponseXML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestStatusText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXMLHttpRequestUNSENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestOPENED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestHEADERS_RECEIVED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestDONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUNSENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOPENED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestHEADERS_RECEIVED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestDONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
index 8a669cdcd9..5b3a354199 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestException)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestException);
 
 /* Hash table */
 
@@ -76,13 +76,13 @@ public:
     JSXMLHttpRequestExceptionConstructor(ExecState* exec)
         : DOMObject(JSXMLHttpRequestExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,19 +112,27 @@ static const HashTable JSXMLHttpRequestExceptionPrototypeTable =
     { 8, 7, JSXMLHttpRequestExceptionPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestExceptionPrototype::s_info = { "XMLHttpRequestExceptionPrototype", 0, &JSXMLHttpRequestExceptionPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestExceptionPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestExceptionPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestExceptionPrototype::s_info = { "XMLHttpRequestExceptionPrototype", 0, 0, getJSXMLHttpRequestExceptionPrototypeTable };
 
-JSObject* JSXMLHttpRequestExceptionPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequestException>(exec);
+    return getDOMPrototype<JSXMLHttpRequestException>(exec, globalObject);
 }
 
 bool JSXMLHttpRequestExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticPropertySlot<JSXMLHttpRequestExceptionPrototype, JSObject>(exec, &JSXMLHttpRequestExceptionPrototypeTable, this, propertyName, slot);
+    return getStaticPropertySlot<JSXMLHttpRequestExceptionPrototype, JSObject>(exec, getJSXMLHttpRequestExceptionPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSXMLHttpRequestException::s_info = { "XMLHttpRequestException", 0, &JSXMLHttpRequestExceptionTable, 0 };
+static const HashTable* getJSXMLHttpRequestExceptionTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestExceptionTable);
+}
+const ClassInfo JSXMLHttpRequestException::s_info = { "XMLHttpRequestException", 0, 0, getJSXMLHttpRequestExceptionTable };
 
 JSXMLHttpRequestException::JSXMLHttpRequestException(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequestException> impl)
     : DOMObject(structure)
@@ -135,77 +143,80 @@ JSXMLHttpRequestException::JSXMLHttpRequestException(PassRefPtr<Structure> struc
 JSXMLHttpRequestException::~JSXMLHttpRequestException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLHttpRequestException::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequestException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestExceptionPrototype(JSXMLHttpRequestExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLHttpRequestExceptionPrototype(JSXMLHttpRequestExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLHttpRequestException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequestException, Base>(exec, &JSXMLHttpRequestExceptionTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequestException, Base>(exec, getJSXMLHttpRequestExceptionTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsXMLHttpRequestExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsXMLHttpRequestExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXMLHttpRequestException::getConstructor(ExecState* exec)
+JSValue JSXMLHttpRequestException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLHttpRequestExceptionConstructor>(exec);
 }
 
-JSValuePtr jsXMLHttpRequestExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestException::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestException* castedThisObj = static_cast<JSXMLHttpRequestException*>(asObject(thisValue));
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXMLHttpRequestExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(101));
 }
 
-JSValuePtr jsXMLHttpRequestExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(102));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLHttpRequestException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLHttpRequestException* object)
 {
     return getDOMObjectWrapper<JSXMLHttpRequestException>(exec, object);
 }
-XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValuePtr value)
+XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLHttpRequestException::s_info) ? static_cast<JSXMLHttpRequestException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLHttpRequestException::s_info) ? static_cast<JSXMLHttpRequestException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
index 5c4443e0aa..52f26bfeb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
@@ -34,33 +34,34 @@ class JSXMLHttpRequestException : public DOMObject {
 public:
     JSXMLHttpRequestException(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequestException>);
     virtual ~JSXMLHttpRequestException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XMLHttpRequestException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLHttpRequestException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLHttpRequestException*);
-XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLHttpRequestException*);
+XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValue);
 
 class JSXMLHttpRequestExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,17 +70,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLHttpRequestExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXMLHttpRequestExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
index 2df3a902a9..57460b9995 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestProgressEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestProgressEvent);
 
 /* Hash table */
 
@@ -70,13 +70,13 @@ public:
     JSXMLHttpRequestProgressEventConstructor(ExecState* exec)
         : DOMObject(JSXMLHttpRequestProgressEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestProgressEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestProgressEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,47 +103,57 @@ static const HashTable JSXMLHttpRequestProgressEventPrototypeTable =
     { 1, 0, JSXMLHttpRequestProgressEventPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestProgressEventPrototype::s_info = { "XMLHttpRequestProgressEventPrototype", 0, &JSXMLHttpRequestProgressEventPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestProgressEventPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestProgressEventPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestProgressEventPrototype::s_info = { "XMLHttpRequestProgressEventPrototype", 0, 0, getJSXMLHttpRequestProgressEventPrototypeTable };
 
-JSObject* JSXMLHttpRequestProgressEventPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestProgressEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequestProgressEvent>(exec);
+    return getDOMPrototype<JSXMLHttpRequestProgressEvent>(exec, globalObject);
 }
 
-const ClassInfo JSXMLHttpRequestProgressEvent::s_info = { "XMLHttpRequestProgressEvent", &JSProgressEvent::s_info, &JSXMLHttpRequestProgressEventTable, 0 };
+static const HashTable* getJSXMLHttpRequestProgressEventTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestProgressEventTable);
+}
+const ClassInfo JSXMLHttpRequestProgressEvent::s_info = { "XMLHttpRequestProgressEvent", &JSProgressEvent::s_info, 0, getJSXMLHttpRequestProgressEventTable };
 
 JSXMLHttpRequestProgressEvent::JSXMLHttpRequestProgressEvent(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequestProgressEvent> impl)
     : JSProgressEvent(structure, impl)
 {
 }
 
-JSObject* JSXMLHttpRequestProgressEvent::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequestProgressEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestProgressEventPrototype(JSXMLHttpRequestProgressEventPrototype::createStructure(JSProgressEventPrototype::self(exec)));
+    return new (exec) JSXMLHttpRequestProgressEventPrototype(JSXMLHttpRequestProgressEventPrototype::createStructure(JSProgressEventPrototype::self(exec, globalObject)));
 }
 
 bool JSXMLHttpRequestProgressEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequestProgressEvent, Base>(exec, &JSXMLHttpRequestProgressEventTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequestProgressEvent, Base>(exec, getJSXMLHttpRequestProgressEventTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestProgressEventPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestProgressEvent* imp = static_cast<XMLHttpRequestProgressEvent*>(static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->position());
 }
 
-JSValuePtr jsXMLHttpRequestProgressEventTotalSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventTotalSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestProgressEvent* imp = static_cast<XMLHttpRequestProgressEvent*>(static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->totalSize());
 }
 
-JSValuePtr jsXMLHttpRequestProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXMLHttpRequestProgressEvent::getConstructor(ExecState* exec)
+JSValue JSXMLHttpRequestProgressEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLHttpRequestProgressEventConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
index 6cd548c755..45ce6103ff 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
@@ -31,23 +31,24 @@ class JSXMLHttpRequestProgressEvent : public JSProgressEvent {
     typedef JSProgressEvent Base;
 public:
     JSXMLHttpRequestProgressEvent(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequestProgressEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSXMLHttpRequestProgressEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSXMLHttpRequestProgressEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestProgressEventPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestProgressEventTotalSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestProgressEventPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestProgressEventTotalSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
index fa98106f8d..bcf0d7cf47 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestUpload)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestUpload);
 
 /* Hash table */
 
@@ -80,13 +80,13 @@ public:
     JSXMLHttpRequestUploadConstructor(ExecState* exec)
         : DOMObject(JSXMLHttpRequestUploadConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestUploadPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestUploadPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,19 +116,27 @@ static const HashTable JSXMLHttpRequestUploadPrototypeTable =
     { 8, 7, JSXMLHttpRequestUploadPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestUploadPrototype::s_info = { "XMLHttpRequestUploadPrototype", 0, &JSXMLHttpRequestUploadPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestUploadPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestUploadPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestUploadPrototype::s_info = { "XMLHttpRequestUploadPrototype", 0, 0, getJSXMLHttpRequestUploadPrototypeTable };
 
-JSObject* JSXMLHttpRequestUploadPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestUploadPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequestUpload>(exec);
+    return getDOMPrototype<JSXMLHttpRequestUpload>(exec, globalObject);
 }
 
 bool JSXMLHttpRequestUploadPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticFunctionSlot<JSObject>(exec, &JSXMLHttpRequestUploadPrototypeTable, this, propertyName, slot);
+    return getStaticFunctionSlot<JSObject>(exec, getJSXMLHttpRequestUploadPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSXMLHttpRequestUpload::s_info = { "XMLHttpRequestUpload", 0, &JSXMLHttpRequestUploadTable, 0 };
+static const HashTable* getJSXMLHttpRequestUploadTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestUploadTable);
+}
+const ClassInfo JSXMLHttpRequestUpload::s_info = { "XMLHttpRequestUpload", 0, 0, getJSXMLHttpRequestUploadTable };
 
 JSXMLHttpRequestUpload::JSXMLHttpRequestUpload(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequestUpload> impl)
     : DOMObject(structure)
@@ -139,166 +147,178 @@ JSXMLHttpRequestUpload::JSXMLHttpRequestUpload(PassRefPtr<Structure> structure,
 JSXMLHttpRequestUpload::~JSXMLHttpRequestUpload()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLHttpRequestUpload::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequestUpload::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestUploadPrototype(JSXMLHttpRequestUploadPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLHttpRequestUploadPrototype(JSXMLHttpRequestUploadPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLHttpRequestUpload::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequestUpload, Base>(exec, &JSXMLHttpRequestUploadTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequestUpload, Base>(exec, getJSXMLHttpRequestUploadTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onloadstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onloadstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onprogress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSXMLHttpRequestUpload::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSXMLHttpRequestUpload::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    lookupPut<JSXMLHttpRequestUpload, Base>(exec, propertyName, value, &JSXMLHttpRequestUploadTable, this, slot);
+    lookupPut<JSXMLHttpRequestUpload, Base>(exec, propertyName, value, getJSXMLHttpRequestUploadTable(exec), this, slot);
 }
 
-void setJSXMLHttpRequestUploadOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnabort(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnload(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnloadstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnloadstart(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnprogress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnprogress(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr JSXMLHttpRequestUpload::getConstructor(ExecState* exec)
+JSValue JSXMLHttpRequestUpload::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLHttpRequestUploadConstructor>(exec);
 }
 
-JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestUpload::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestUpload::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestUpload::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLHttpRequestUpload* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLHttpRequestUpload* object)
 {
     return getDOMObjectWrapper<JSXMLHttpRequestUpload>(exec, object);
 }
-XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValuePtr value)
+XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLHttpRequestUpload::s_info) ? static_cast<JSXMLHttpRequestUpload*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLHttpRequestUpload::s_info) ? static_cast<JSXMLHttpRequestUpload*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
index af0f1eb462..ed0313e875 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
@@ -34,40 +34,41 @@ class JSXMLHttpRequestUpload : public DOMObject {
 public:
     JSXMLHttpRequestUpload(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequestUpload>);
     virtual ~JSXMLHttpRequestUpload();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     XMLHttpRequestUpload* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLHttpRequestUpload> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLHttpRequestUpload*);
-XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLHttpRequestUpload*);
+XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValue);
 
 class JSXMLHttpRequestUploadPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -76,22 +77,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestUploadOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
index 4b2b3e8282..bb7e1c36ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLSerializer)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLSerializer);
 
 /* Hash table */
 
@@ -72,13 +72,13 @@ public:
     JSXMLSerializerConstructor(ExecState* exec)
         : DOMObject(JSXMLSerializerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLSerializerPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLSerializerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +117,9 @@ static const HashTable JSXMLSerializerPrototypeTable =
 
 const ClassInfo JSXMLSerializerPrototype::s_info = { "XMLSerializerPrototype", 0, &JSXMLSerializerPrototypeTable, 0 };
 
-JSObject* JSXMLSerializerPrototype::self(ExecState* exec)
+JSObject* JSXMLSerializerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLSerializer>(exec);
+    return getDOMPrototype<JSXMLSerializer>(exec, globalObject);
 }
 
 bool JSXMLSerializerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +138,11 @@ JSXMLSerializer::JSXMLSerializer(PassRefPtr<Structure> structure, PassRefPtr<XML
 JSXMLSerializer::~JSXMLSerializer()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLSerializer::createPrototype(ExecState* exec)
+JSObject* JSXMLSerializer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLSerializerPrototype(JSXMLSerializerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLSerializerPrototype(JSXMLSerializerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLSerializer::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,37 +150,38 @@ bool JSXMLSerializer::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSXMLSerializer, Base>(exec, &JSXMLSerializerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLSerializer*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXMLSerializer::getConstructor(ExecState* exec)
+JSValue JSXMLSerializer::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLSerializerConstructor>(exec);
 }
 
-JSValuePtr jsXMLSerializerPrototypeFunctionSerializeToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLSerializerPrototypeFunctionSerializeToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLSerializer::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLSerializer::s_info))
         return throwError(exec, TypeError);
     JSXMLSerializer* castedThisObj = static_cast<JSXMLSerializer*>(asObject(thisValue));
     XMLSerializer* imp = static_cast<XMLSerializer*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->serializeToString(node, ec));
+    JSC::JSValue result = jsString(exec, imp->serializeToString(node, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLSerializer* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLSerializer* object)
 {
     return getDOMObjectWrapper<JSXMLSerializer>(exec, object);
 }
-XMLSerializer* toXMLSerializer(JSC::JSValuePtr value)
+XMLSerializer* toXMLSerializer(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLSerializer::s_info) ? static_cast<JSXMLSerializer*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLSerializer::s_info) ? static_cast<JSXMLSerializer*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
index c8c72a6795..c9734554e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
@@ -34,33 +34,34 @@ class JSXMLSerializer : public DOMObject {
 public:
     JSXMLSerializer(PassRefPtr<JSC::Structure>, PassRefPtr<XMLSerializer>);
     virtual ~JSXMLSerializer();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XMLSerializer* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLSerializer> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLSerializer*);
-XMLSerializer* toXMLSerializer(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLSerializer*);
+XMLSerializer* toXMLSerializer(JSC::JSValue);
 
 class JSXMLSerializerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,10 +70,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLSerializerPrototypeFunctionSerializeToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLSerializerPrototypeFunctionSerializeToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
index 7db5109cca..6ddeeeabbb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
@@ -45,7 +45,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathEvaluator)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathEvaluator);
 
 /* Hash table */
 
@@ -81,13 +81,13 @@ public:
     JSXPathEvaluatorConstructor(ExecState* exec)
         : DOMObject(JSXPathEvaluatorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathEvaluatorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathEvaluatorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -128,9 +128,9 @@ static const HashTable JSXPathEvaluatorPrototypeTable =
 
 const ClassInfo JSXPathEvaluatorPrototype::s_info = { "XPathEvaluatorPrototype", 0, &JSXPathEvaluatorPrototypeTable, 0 };
 
-JSObject* JSXPathEvaluatorPrototype::self(ExecState* exec)
+JSObject* JSXPathEvaluatorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathEvaluator>(exec);
+    return getDOMPrototype<JSXPathEvaluator>(exec, globalObject);
 }
 
 bool JSXPathEvaluatorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -149,12 +149,11 @@ JSXPathEvaluator::JSXPathEvaluator(PassRefPtr<Structure> structure, PassRefPtr<X
 JSXPathEvaluator::~JSXPathEvaluator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathEvaluator::createPrototype(ExecState* exec)
+JSObject* JSXPathEvaluator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathEvaluatorPrototype(JSXPathEvaluatorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathEvaluatorPrototype(JSXPathEvaluatorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathEvaluator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -162,84 +161,87 @@ bool JSXPathEvaluator::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSXPathEvaluator, Base>(exec, &JSXPathEvaluatorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathEvaluator*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathEvaluator::getConstructor(ExecState* exec)
+JSValue JSXPathEvaluator::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathEvaluatorConstructor>(exec);
 }
 
-JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathEvaluator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
+    const UString& expression = args.at(0).toString(exec);
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 1));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(1));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 1));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(1));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathEvaluator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
-    Node* nodeResolver = toNode(args.at(exec, 0));
+    Node* nodeResolver = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
     return result;
 }
 
-JSValuePtr jsXPathEvaluatorPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathEvaluator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
-    Node* contextNode = toNode(args.at(exec, 1));
+    const UString& expression = args.at(0).toString(exec);
+    Node* contextNode = toNode(args.at(1));
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 2));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(2));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 2));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
-    unsigned short type = args.at(exec, 3)->toInt32(exec);
-    XPathResult* inResult = toXPathResult(args.at(exec, 4));
+    unsigned short type = args.at(3).toInt32(exec);
+    XPathResult* inResult = toXPathResult(args.at(4));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathEvaluator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathEvaluator* object)
 {
     return getDOMObjectWrapper<JSXPathEvaluator>(exec, object);
 }
-XPathEvaluator* toXPathEvaluator(JSC::JSValuePtr value)
+XPathEvaluator* toXPathEvaluator(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathEvaluator::s_info) ? static_cast<JSXPathEvaluator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathEvaluator::s_info) ? static_cast<JSXPathEvaluator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
index 6f9cd7256e..3adb44075a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
@@ -37,33 +37,34 @@ class JSXPathEvaluator : public DOMObject {
 public:
     JSXPathEvaluator(PassRefPtr<JSC::Structure>, PassRefPtr<XPathEvaluator>);
     virtual ~JSXPathEvaluator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathEvaluator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathEvaluator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathEvaluator*);
-XPathEvaluator* toXPathEvaluator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathEvaluator*);
+XPathEvaluator* toXPathEvaluator(JSC::JSValue);
 
 class JSXPathEvaluatorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,12 +73,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXPathEvaluatorPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
index 8b2ab42ff0..ebcce7fbfa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathException)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathException);
 
 /* Hash table */
 
@@ -79,13 +79,13 @@ public:
     JSXPathExceptionConstructor(ExecState* exec)
         : DOMObject(JSXPathExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +117,9 @@ static const HashTable JSXPathExceptionPrototypeTable =
 
 const ClassInfo JSXPathExceptionPrototype::s_info = { "XPathExceptionPrototype", 0, &JSXPathExceptionPrototypeTable, 0 };
 
-JSObject* JSXPathExceptionPrototype::self(ExecState* exec)
+JSObject* JSXPathExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathException>(exec);
+    return getDOMPrototype<JSXPathException>(exec, globalObject);
 }
 
 bool JSXPathExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +138,11 @@ JSXPathException::JSXPathException(PassRefPtr<Structure> structure, PassRefPtr<X
 JSXPathException::~JSXPathException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathException::createPrototype(ExecState* exec)
+JSObject* JSXPathException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathExceptionPrototype(JSXPathExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathExceptionPrototype(JSXPathExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,64 +150,68 @@ bool JSXPathException::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSXPathException, Base>(exec, &JSXPathExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(static_cast<JSXPathException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsXPathExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(static_cast<JSXPathException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsXPathExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(static_cast<JSXPathException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathException::getConstructor(ExecState* exec)
+JSValue JSXPathException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathExceptionConstructor>(exec);
 }
 
-JSValuePtr jsXPathExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathException::s_info))
         return throwError(exec, TypeError);
     JSXPathException* castedThisObj = static_cast<JSXPathException*>(asObject(thisValue));
     XPathException* imp = static_cast<XPathException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXPathExceptionINVALID_EXPRESSION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(51));
 }
 
-JSValuePtr jsXPathExceptionTYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathExceptionTYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(52));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathException* object)
 {
     return getDOMObjectWrapper<JSXPathException>(exec, object);
 }
-XPathException* toXPathException(JSC::JSValuePtr value)
+XPathException* toXPathException(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathException::s_info) ? static_cast<JSXPathException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathException::s_info) ? static_cast<JSXPathException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
index 53b1874a8d..f66433c352 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
@@ -37,33 +37,34 @@ class JSXPathException : public DOMObject {
 public:
     JSXPathException(PassRefPtr<JSC::Structure>, PassRefPtr<XPathException>);
     virtual ~JSXPathException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathException*);
-XPathException* toXPathException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathException*);
+XPathException* toXPathException(JSC::JSValue);
 
 class JSXPathExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,17 +73,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXPathExceptionINVALID_EXPRESSION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionTYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionTYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
index a7a6259d75..743d22bee5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathExpression)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathExpression);
 
 /* Hash table */
 
@@ -75,13 +75,13 @@ public:
     JSXPathExpressionConstructor(ExecState* exec)
         : DOMObject(JSXPathExpressionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathExpressionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathExpressionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +111,9 @@ static const HashTable JSXPathExpressionPrototypeTable =
 
 const ClassInfo JSXPathExpressionPrototype::s_info = { "XPathExpressionPrototype", 0, &JSXPathExpressionPrototypeTable, 0 };
 
-JSObject* JSXPathExpressionPrototype::self(ExecState* exec)
+JSObject* JSXPathExpressionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathExpression>(exec);
+    return getDOMPrototype<JSXPathExpression>(exec, globalObject);
 }
 
 bool JSXPathExpressionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +132,11 @@ JSXPathExpression::JSXPathExpression(PassRefPtr<Structure> structure, PassRefPtr
 JSXPathExpression::~JSXPathExpression()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathExpression::createPrototype(ExecState* exec)
+JSObject* JSXPathExpression::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathExpressionPrototype(JSXPathExpressionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathExpressionPrototype(JSXPathExpressionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathExpression::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,39 +144,40 @@ bool JSXPathExpression::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSXPathExpression, Base>(exec, &JSXPathExpressionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathExpressionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExpressionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathExpression*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathExpression::getConstructor(ExecState* exec)
+JSValue JSXPathExpression::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathExpressionConstructor>(exec);
 }
 
-JSValuePtr jsXPathExpressionPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathExpressionPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathExpression::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathExpression::s_info))
         return throwError(exec, TypeError);
     JSXPathExpression* castedThisObj = static_cast<JSXPathExpression*>(asObject(thisValue));
     XPathExpression* imp = static_cast<XPathExpression*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* contextNode = toNode(args.at(exec, 0));
-    unsigned short type = args.at(exec, 1)->toInt32(exec);
-    XPathResult* inResult = toXPathResult(args.at(exec, 2));
+    Node* contextNode = toNode(args.at(0));
+    unsigned short type = args.at(1).toInt32(exec);
+    XPathResult* inResult = toXPathResult(args.at(2));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->evaluate(contextNode, type, inResult, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->evaluate(contextNode, type, inResult, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathExpression* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathExpression* object)
 {
     return getDOMObjectWrapper<JSXPathExpression>(exec, object);
 }
-XPathExpression* toXPathExpression(JSC::JSValuePtr value)
+XPathExpression* toXPathExpression(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathExpression::s_info) ? static_cast<JSXPathExpression*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathExpression::s_info) ? static_cast<JSXPathExpression*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
index d18b0019ef..6f48e8dbd9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
@@ -37,33 +37,34 @@ class JSXPathExpression : public DOMObject {
 public:
     JSXPathExpression(PassRefPtr<JSC::Structure>, PassRefPtr<XPathExpression>);
     virtual ~JSXPathExpression();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathExpression* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathExpression> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathExpression*);
-XPathExpression* toXPathExpression(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathExpression*);
+XPathExpression* toXPathExpression(JSC::JSValue);
 
 class JSXPathExpressionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,10 +73,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathExpressionPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathExpressionPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathExpressionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExpressionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
index a56a99882f..be0e19ef6d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
@@ -38,7 +38,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathNSResolver)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathNSResolver);
 
 /* Hash table for prototype */
 
@@ -57,9 +57,9 @@ static const HashTable JSXPathNSResolverPrototypeTable =
 
 const ClassInfo JSXPathNSResolverPrototype::s_info = { "XPathNSResolverPrototype", 0, &JSXPathNSResolverPrototypeTable, 0 };
 
-JSObject* JSXPathNSResolverPrototype::self(ExecState* exec)
+JSObject* JSXPathNSResolverPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathNSResolver>(exec);
+    return getDOMPrototype<JSXPathNSResolver>(exec, globalObject);
 }
 
 bool JSXPathNSResolverPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -78,34 +78,34 @@ JSXPathNSResolver::JSXPathNSResolver(PassRefPtr<Structure> structure, PassRefPtr
 JSXPathNSResolver::~JSXPathNSResolver()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathNSResolver::createPrototype(ExecState* exec)
+JSObject* JSXPathNSResolver::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathNSResolverPrototype(JSXPathNSResolverPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathNSResolverPrototype(JSXPathNSResolverPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathNSResolver::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathNSResolver::s_info))
         return throwError(exec, TypeError);
     JSXPathNSResolver* castedThisObj = static_cast<JSXPathNSResolver*>(asObject(thisValue));
     XPathNSResolver* imp = static_cast<XPathNSResolver*>(castedThisObj->impl());
-    const UString& prefix = args.at(exec, 0)->toString(exec);
+    const UString& prefix = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
+    JSC::JSValue result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathNSResolver* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathNSResolver* object)
 {
     return getDOMObjectWrapper<JSXPathNSResolver>(exec, object);
 }
-XPathNSResolver* toXPathNSResolver(JSC::JSValuePtr value)
+XPathNSResolver* toXPathNSResolver(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathNSResolver::s_info) ? static_cast<JSXPathNSResolver*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathNSResolver::s_info) ? static_cast<JSXPathNSResolver*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
index 0219093d47..3cc8db99b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
@@ -37,7 +37,7 @@ class JSXPathNSResolver : public DOMObject {
 public:
     JSXPathNSResolver(PassRefPtr<JSC::Structure>, PassRefPtr<XPathNSResolver>);
     virtual ~JSXPathNSResolver();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -47,16 +47,17 @@ private:
     RefPtr<XPathNSResolver> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathNSResolver*);
-XPathNSResolver* toXPathNSResolver(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathNSResolver*);
+XPathNSResolver* toXPathNSResolver(JSC::JSValue);
 
 class JSXPathNSResolverPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -65,7 +66,7 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
index 1dd7ffa540..a6263ae612 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathResult)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathResult);
 
 /* Hash table */
 
@@ -93,13 +93,13 @@ public:
     JSXPathResultConstructor(ExecState* exec)
         : DOMObject(JSXPathResultConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathResultPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathResultPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -140,9 +140,9 @@ static const HashTable JSXPathResultPrototypeTable =
 
 const ClassInfo JSXPathResultPrototype::s_info = { "XPathResultPrototype", 0, &JSXPathResultPrototypeTable, 0 };
 
-JSObject* JSXPathResultPrototype::self(ExecState* exec)
+JSObject* JSXPathResultPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathResult>(exec);
+    return getDOMPrototype<JSXPathResult>(exec, globalObject);
 }
 
 bool JSXPathResultPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,12 +161,11 @@ JSXPathResult::JSXPathResult(PassRefPtr<Structure> structure, PassRefPtr<XPathRe
 JSXPathResult::~JSXPathResult()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathResult::createPrototype(ExecState* exec)
+JSObject* JSXPathResult::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathResultPrototype(JSXPathResultPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathResultPrototype(JSXPathResultPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathResult::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,160 +173,164 @@ bool JSXPathResult::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSXPathResult, Base>(exec, &JSXPathResultTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathResultResultType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultResultType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->resultType());
 }
 
-JSValuePtr jsXPathResultNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->numberValue(ec));
+    JSC::JSValue result = jsNumber(exec, imp->numberValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultStringValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultStringValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsString(exec, imp->stringValue(ec));
+    JSC::JSValue result = jsString(exec, imp->stringValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultBooleanValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultBooleanValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsBoolean(imp->booleanValue(ec));
+    JSC::JSValue result = jsBoolean(imp->booleanValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultSingleNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultSingleNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->singleNodeValue(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->singleNodeValue(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultInvalidIteratorState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultInvalidIteratorState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->invalidIteratorState());
 }
 
-JSValuePtr jsXPathResultSnapshotLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultSnapshotLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->snapshotLength(ec));
+    JSC::JSValue result = jsNumber(exec, imp->snapshotLength(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathResult*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathResult::getConstructor(ExecState* exec)
+JSValue JSXPathResult::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathResultConstructor>(exec);
 }
 
-JSValuePtr jsXPathResultPrototypeFunctionIterateNext(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionIterateNext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathResult::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathResult::s_info))
         return throwError(exec, TypeError);
     JSXPathResult* castedThisObj = static_cast<JSXPathResult*>(asObject(thisValue));
     XPathResult* imp = static_cast<XPathResult*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->iterateNext(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->iterateNext(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultPrototypeFunctionSnapshotItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionSnapshotItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathResult::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathResult::s_info))
         return throwError(exec, TypeError);
     JSXPathResult* castedThisObj = static_cast<JSXPathResult*>(asObject(thisValue));
     XPathResult* imp = static_cast<XPathResult*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->snapshotItem(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->snapshotItem(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXPathResultANY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultANY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsXPathResultNUMBER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultNUMBER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsXPathResultSTRING_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultSTRING_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsXPathResultBOOLEAN_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultBOOLEAN_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsXPathResultORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsXPathResultANY_UNORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsXPathResultFIRST_ORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathResult* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathResult* object)
 {
     return getDOMObjectWrapper<JSXPathResult>(exec, object);
 }
-XPathResult* toXPathResult(JSC::JSValuePtr value)
+XPathResult* toXPathResult(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathResult::s_info) ? static_cast<JSXPathResult*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathResult::s_info) ? static_cast<JSXPathResult*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
index 055adc32c0..742a10d745 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
@@ -37,33 +37,34 @@ class JSXPathResult : public DOMObject {
 public:
     JSXPathResult(PassRefPtr<JSC::Structure>, PassRefPtr<XPathResult>);
     virtual ~JSXPathResult();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathResult* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathResult> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathResult*);
-XPathResult* toXPathResult(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathResult*);
+XPathResult* toXPathResult(JSC::JSValue);
 
 class JSXPathResultPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,30 +73,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathResultPrototypeFunctionIterateNext(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXPathResultPrototypeFunctionSnapshotItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionIterateNext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionSnapshotItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathResultResultType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultStringValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultBooleanValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultSingleNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultInvalidIteratorState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultSnapshotLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultResultType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultStringValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultBooleanValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultSingleNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultInvalidIteratorState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultSnapshotLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXPathResultANY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultNUMBER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultSTRING_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultBOOLEAN_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultANY_UNORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultFIRST_ORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultANY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultNUMBER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultSTRING_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultBOOLEAN_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
deleted file mode 100644
index 3ec48fb2fe..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-
-#if ENABLE(XSLT)
-
-#include "JSXSLTProcessor.h"
-
-#include <wtf/GetPtr.h>
-
-#include "Document.h"
-#include "DocumentFragment.h"
-#include "NodeFilter.h"
-#include "XSLTProcessor.h"
-
-#include <runtime/Error.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessor)
-
-/* Hash table for prototype */
-
-static const HashTableValue JSXSLTProcessorPrototypeTableValues[9] =
-{
-    { "importStylesheet", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionImportStylesheet, (intptr_t)1 },
-    { "transformToFragment", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToFragment, (intptr_t)2 },
-    { "transformToDocument", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToDocument, (intptr_t)1 },
-    { "setParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionSetParameter, (intptr_t)3 },
-    { "getParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionGetParameter, (intptr_t)2 },
-    { "removeParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionRemoveParameter, (intptr_t)2 },
-    { "clearParameters", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionClearParameters, (intptr_t)0 },
-    { "reset", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionReset, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSXSLTProcessorPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 63, JSXSLTProcessorPrototypeTableValues, 0 };
-#else
-    { 17, 15, JSXSLTProcessorPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSXSLTProcessorPrototype::s_info = { "XSLTProcessorPrototype", 0, &JSXSLTProcessorPrototypeTable, 0 };
-
-JSObject* JSXSLTProcessorPrototype::self(ExecState* exec)
-{
-    return getDOMPrototype<JSXSLTProcessor>(exec);
-}
-
-bool JSXSLTProcessorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSXSLTProcessorPrototypeTable, this, propertyName, slot);
-}
-
-const ClassInfo JSXSLTProcessor::s_info = { "XSLTProcessor", 0, 0, 0 };
-
-JSXSLTProcessor::JSXSLTProcessor(PassRefPtr<Structure> structure, PassRefPtr<XSLTProcessor> impl)
-    : DOMObject(structure)
-    , m_impl(impl)
-{
-}
-
-JSXSLTProcessor::~JSXSLTProcessor()
-{
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
-}
-
-JSObject* JSXSLTProcessor::createPrototype(ExecState* exec)
-{
-    return new (exec) JSXSLTProcessorPrototype(JSXSLTProcessorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionImportStylesheet(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->importStylesheet(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToFragment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->transformToFragment(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->transformToDocument(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionSetParameter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->setParameter(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionGetParameter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->getParameter(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionRemoveParameter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->removeParameter(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionClearParameters(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    XSLTProcessor* imp = static_cast<XSLTProcessor*>(castedThisObj->impl());
-
-    imp->clearParameters();
-    return jsUndefined();
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionReset(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    XSLTProcessor* imp = static_cast<XSLTProcessor*>(castedThisObj->impl());
-
-    imp->reset();
-    return jsUndefined();
-}
-
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XSLTProcessor* object)
-{
-    return getDOMObjectWrapper<JSXSLTProcessor>(exec, object);
-}
-XSLTProcessor* toXSLTProcessor(JSC::JSValuePtr value)
-{
-    return value->isObject(&JSXSLTProcessor::s_info) ? static_cast<JSXSLTProcessor*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(XSLT)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
deleted file mode 100644
index 3a7138815a..0000000000
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSXSLTProcessor_h
-#define JSXSLTProcessor_h
-
-
-#if ENABLE(XSLT)
-
-#include "JSDOMBinding.h"
-#include <runtime/JSGlobalObject.h>
-#include <runtime/ObjectPrototype.h>
-
-namespace WebCore {
-
-class XSLTProcessor;
-
-class JSXSLTProcessor : public DOMObject {
-    typedef DOMObject Base;
-public:
-    JSXSLTProcessor(PassRefPtr<JSC::Structure>, PassRefPtr<XSLTProcessor>);
-    virtual ~JSXSLTProcessor();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-
-    // Custom functions
-    JSC::JSValuePtr importStylesheet(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr transformToFragment(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr transformToDocument(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setParameter(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getParameter(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeParameter(JSC::ExecState*, const JSC::ArgList&);
-    XSLTProcessor* impl() const { return m_impl.get(); }
-
-private:
-    RefPtr<XSLTProcessor> m_impl;
-};
-
-JSC::JSValuePtr toJS(JSC::ExecState*, XSLTProcessor*);
-XSLTProcessor* toXSLTProcessor(JSC::JSValuePtr);
-
-class JSXSLTProcessorPrototype : public JSC::JSObject {
-public:
-    static JSC::JSObject* self(JSC::ExecState*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
-    JSXSLTProcessorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-};
-
-// Functions
-
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionImportStylesheet(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionSetParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionGetParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionRemoveParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionClearParameters(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-
-} // namespace WebCore
-
-#endif // ENABLE(XSLT)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h b/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
index 638f45a620..4c46e078db 100644
--- a/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
@@ -45,10 +45,5 @@ static const struct HashTableValue mainTableValues[37] = {
 };
 
 extern const struct HashTable mainTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 1023, mainTableValues, 0 };
-#else
     { 133, 127, mainTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h b/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
index cd8c507db9..c8359c1700 100644
--- a/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
@@ -27,10 +27,5 @@ static const struct HashTableValue mathTableValues[19] = {
 };
 
 extern const struct HashTable mathTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, mathTableValues, 0 };
-#else
     { 67, 63, mathTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
index e726f5c7fe..6879c036d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue numberTableValues[6] = {
 };
 
 extern const struct HashTable numberTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 15, numberTableValues, 0 };
-#else
     { 16, 15, numberTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
index e9dfed227e..0bdf10c329 100644
--- a/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
@@ -30,10 +30,5 @@ static const struct HashTableValue regExpConstructorTableValues[22] = {
 };
 
 extern const struct HashTable regExpConstructorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, regExpConstructorTableValues, 0 };
-#else
     { 65, 63, regExpConstructorTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
index 39230b9197..69a745d3cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue regExpTableValues[6] = {
 };
 
 extern const struct HashTable regExpTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 31, regExpTableValues, 0 };
-#else
     { 17, 15, regExpTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
index c39dcc10d3..3b5318bdf7 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
@@ -49,29 +49,6 @@
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
-#include "SVGFEBlendElement.h"
-#include "SVGFEColorMatrixElement.h"
-#include "SVGFEComponentTransferElement.h"
-#include "SVGFECompositeElement.h"
-#include "SVGFEDiffuseLightingElement.h"
-#include "SVGFEDisplacementMapElement.h"
-#include "SVGFEDistantLightElement.h"
-#include "SVGFEFloodElement.h"
-#include "SVGFEFuncAElement.h"
-#include "SVGFEFuncBElement.h"
-#include "SVGFEFuncGElement.h"
-#include "SVGFEFuncRElement.h"
-#include "SVGFEGaussianBlurElement.h"
-#include "SVGFEImageElement.h"
-#include "SVGFEMergeElement.h"
-#include "SVGFEMergeNodeElement.h"
-#include "SVGFEOffsetElement.h"
-#include "SVGFEPointLightElement.h"
-#include "SVGFESpecularLightingElement.h"
-#include "SVGFESpotLightElement.h"
-#include "SVGFETileElement.h"
-#include "SVGFETurbulenceElement.h"
-#include "SVGFilterElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
 #include "SVGFontFaceFormatElement.h"
@@ -112,388 +89,278 @@
 #include "SVGViewElement.h"
 #include <wtf/HashMap.h>
 
-using namespace WebCore;
-
-typedef PassRefPtr<SVGElement> (*ConstructorFunction)(Document*, bool createdByParser);
-typedef WTF::HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
-
-static FunctionMap* gFunctionMap = 0;
-
 namespace WebCore {
 
-#if ENABLE(SVG)
-static PassRefPtr<SVGElement> aConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAElement(SVGNames::aTag, doc);
-}
-
-static PassRefPtr<SVGElement> altGlyphConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAltGlyphElement(SVGNames::altGlyphTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateElement(SVGNames::animateTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateColorConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateColorElement(SVGNames::animateColorTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateMotionConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateMotionElement(SVGNames::animateMotionTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateTransformConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateTransformElement(SVGNames::animateTransformTag, doc);
-}
-
-static PassRefPtr<SVGElement> circleConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGCircleElement(SVGNames::circleTag, doc);
-}
-
-static PassRefPtr<SVGElement> clipPathConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGClipPathElement(SVGNames::clipPathTag, doc);
-}
-
-static PassRefPtr<SVGElement> cursorConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGCursorElement(SVGNames::cursorTag, doc);
-}
-
-static PassRefPtr<SVGElement> definition_srcConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGDefinitionSrcElement(SVGNames::definition_srcTag, doc);
-}
-
-static PassRefPtr<SVGElement> defsConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGDefsElement(SVGNames::defsTag, doc);
-}
-
-static PassRefPtr<SVGElement> descConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGDescElement(SVGNames::descTag, doc);
-}
-
-static PassRefPtr<SVGElement> ellipseConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGEllipseElement(SVGNames::ellipseTag, doc);
-}
-
-static PassRefPtr<SVGElement> feBlendConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEBlendElement(SVGNames::feBlendTag, doc);
-}
-
-static PassRefPtr<SVGElement> feColorMatrixConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEColorMatrixElement(SVGNames::feColorMatrixTag, doc);
-}
-
-static PassRefPtr<SVGElement> feComponentTransferConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEComponentTransferElement(SVGNames::feComponentTransferTag, doc);
-}
-
-static PassRefPtr<SVGElement> feCompositeConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFECompositeElement(SVGNames::feCompositeTag, doc);
-}
-
-static PassRefPtr<SVGElement> feDiffuseLightingConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEDiffuseLightingElement(SVGNames::feDiffuseLightingTag, doc);
-}
-
-static PassRefPtr<SVGElement> feDisplacementMapConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEDisplacementMapElement(SVGNames::feDisplacementMapTag, doc);
-}
-
-static PassRefPtr<SVGElement> feDistantLightConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEDistantLightElement(SVGNames::feDistantLightTag, doc);
-}
+using namespace SVGNames;
 
-static PassRefPtr<SVGElement> feFloodConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEFloodElement(SVGNames::feFloodTag, doc);
-}
+typedef PassRefPtr<SVGElement> (*ConstructorFunction)(const QualifiedName&, Document*, bool createdByParser);
+typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
 
-static PassRefPtr<SVGElement> feFuncAConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEFuncAElement(SVGNames::feFuncATag, doc);
-}
+static FunctionMap* gFunctionMap = 0;
 
-static PassRefPtr<SVGElement> feFuncBConstructor(Document* doc, bool createdByParser)
+#if ENABLE(SVG)
+static PassRefPtr<SVGElement> aConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEFuncBElement(SVGNames::feFuncBTag, doc);
+    return new SVGAElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feFuncGConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> altglyphConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEFuncGElement(SVGNames::feFuncGTag, doc);
+    return new SVGAltGlyphElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feFuncRConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animateConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEFuncRElement(SVGNames::feFuncRTag, doc);
+    return new SVGAnimateElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feGaussianBlurConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animatecolorConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEGaussianBlurElement(SVGNames::feGaussianBlurTag, doc);
+    return new SVGAnimateColorElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feImageConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animatemotionConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEImageElement(SVGNames::feImageTag, doc);
+    return new SVGAnimateMotionElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feMergeConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animatetransformConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEMergeElement(SVGNames::feMergeTag, doc);
+    return new SVGAnimateTransformElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feMergeNodeConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> circleConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEMergeNodeElement(SVGNames::feMergeNodeTag, doc);
+    return new SVGCircleElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feOffsetConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> clippathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEOffsetElement(SVGNames::feOffsetTag, doc);
+    return new SVGClipPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> fePointLightConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> cursorConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEPointLightElement(SVGNames::fePointLightTag, doc);
+    return new SVGCursorElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feSpecularLightingConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> definitionsrcConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFESpecularLightingElement(SVGNames::feSpecularLightingTag, doc);
+    return new SVGDefinitionSrcElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feSpotLightConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> defsConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFESpotLightElement(SVGNames::feSpotLightTag, doc);
+    return new SVGDefsElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feTileConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> descConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFETileElement(SVGNames::feTileTag, doc);
+    return new SVGDescElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feTurbulenceConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> ellipseConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFETurbulenceElement(SVGNames::feTurbulenceTag, doc);
+    return new SVGEllipseElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> filterConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFilterElement(SVGNames::filterTag, doc);
+    return new SVGFontElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> fontConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfaceConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontElement(SVGNames::fontTag, doc);
+    return new SVGFontFaceElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_faceConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfaceformatConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceElement(SVGNames::font_faceTag, doc);
+    return new SVGFontFaceFormatElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_formatConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfacenameConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceFormatElement(SVGNames::font_face_formatTag, doc);
+    return new SVGFontFaceNameElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_nameConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfacesrcConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceNameElement(SVGNames::font_face_nameTag, doc);
+    return new SVGFontFaceSrcElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_srcConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfaceuriConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceSrcElement(SVGNames::font_face_srcTag, doc);
+    return new SVGFontFaceUriElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_uriConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> foreignobjectConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceUriElement(SVGNames::font_face_uriTag, doc);
+    return new SVGForeignObjectElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> foreignObjectConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> gConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGForeignObjectElement(SVGNames::foreignObjectTag, doc);
+    return new SVGGElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> gConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> glyphConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGGElement(SVGNames::gTag, doc);
+    return new SVGGlyphElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> glyphConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> hkernConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGGlyphElement(SVGNames::glyphTag, doc);
+    return new SVGHKernElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> hkernConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> imageConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGHKernElement(SVGNames::hkernTag, doc);
+    return new SVGImageElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> imageConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> lineConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGImageElement(SVGNames::imageTag, doc);
+    return new SVGLineElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> lineConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> lineargradientConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGLineElement(SVGNames::lineTag, doc);
+    return new SVGLinearGradientElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> linearGradientConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> markerConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGLinearGradientElement(SVGNames::linearGradientTag, doc);
+    return new SVGMarkerElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> markerConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> maskConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMarkerElement(SVGNames::markerTag, doc);
+    return new SVGMaskElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> maskConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> metadataConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMaskElement(SVGNames::maskTag, doc);
+    return new SVGMetadataElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> metadataConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> missingglyphConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMetadataElement(SVGNames::metadataTag, doc);
+    return new SVGMissingGlyphElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> missing_glyphConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> mpathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMissingGlyphElement(SVGNames::missing_glyphTag, doc);
+    return new SVGMPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> mpathConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> pathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMPathElement(SVGNames::mpathTag, doc);
+    return new SVGPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> pathConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> patternConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPathElement(SVGNames::pathTag, doc);
+    return new SVGPatternElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> patternConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> polygonConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPatternElement(SVGNames::patternTag, doc);
+    return new SVGPolygonElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> polygonConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> polylineConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPolygonElement(SVGNames::polygonTag, doc);
+    return new SVGPolylineElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> polylineConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> radialgradientConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPolylineElement(SVGNames::polylineTag, doc);
+    return new SVGRadialGradientElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> radialGradientConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> rectConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGRadialGradientElement(SVGNames::radialGradientTag, doc);
+    return new SVGRectElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> rectConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> scriptConstructor(const QualifiedName& tagName, Document* doc, bool createdByParser)
 {
-    return new SVGRectElement(SVGNames::rectTag, doc);
+    return new SVGScriptElement(tagName, doc, createdByParser);
 }
 
-static PassRefPtr<SVGElement> scriptConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> setConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGScriptElement(SVGNames::scriptTag, doc, createdByParser);
+    return new SVGSetElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> setConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> stopConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSetElement(SVGNames::setTag, doc);
+    return new SVGStopElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> stopConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> styleConstructor(const QualifiedName& tagName, Document* doc, bool createdByParser)
 {
-    return new SVGStopElement(SVGNames::stopTag, doc);
+    return new SVGStyleElement(tagName, doc, createdByParser);
 }
 
-static PassRefPtr<SVGElement> styleConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> svgConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGStyleElement(SVGNames::styleTag, doc, createdByParser);
+    return new SVGSVGElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> svgConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> switchConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSVGElement(SVGNames::svgTag, doc);
+    return new SVGSwitchElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> switchConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> symbolConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSwitchElement(SVGNames::switchTag, doc);
+    return new SVGSymbolElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> symbolConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> textConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSymbolElement(SVGNames::symbolTag, doc);
+    return new SVGTextElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> textConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> textpathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTextElement(SVGNames::textTag, doc);
+    return new SVGTextPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> textPathConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> titleConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTextPathElement(SVGNames::textPathTag, doc);
+    return new SVGTitleElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> titleConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> trefConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTitleElement(SVGNames::titleTag, doc);
+    return new SVGTRefElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> trefConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> tspanConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTRefElement(SVGNames::trefTag, doc);
+    return new SVGTSpanElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> tspanConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> useConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTSpanElement(SVGNames::tspanTag, doc);
+    return new SVGUseElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> useConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> viewConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGUseElement(SVGNames::useTag, doc);
+    return new SVGViewElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> viewConstructor(Document* doc, bool createdByParser)
+#endif
+#if ENABLE(SVG)
+static void addTag(const QualifiedName& tag, ConstructorFunction func)
 {
-    return new SVGViewElement(SVGNames::viewTag, doc);
+    gFunctionMap->set(tag.localName().impl(), func);
 }
 
-#endif
-#if ENABLE(SVG)
 static inline void createFunctionMapIfNecessary()
 {
     if (gFunctionMap)
@@ -502,80 +369,57 @@ static inline void createFunctionMapIfNecessary()
     gFunctionMap = new FunctionMap;
     
     // Populate it with constructor functions.
-    gFunctionMap->set(SVGNames::aTag.localName().impl(), aConstructor);
-    gFunctionMap->set(SVGNames::altGlyphTag.localName().impl(), altGlyphConstructor);
-    gFunctionMap->set(SVGNames::animateTag.localName().impl(), animateConstructor);
-    gFunctionMap->set(SVGNames::animateColorTag.localName().impl(), animateColorConstructor);
-    gFunctionMap->set(SVGNames::animateMotionTag.localName().impl(), animateMotionConstructor);
-    gFunctionMap->set(SVGNames::animateTransformTag.localName().impl(), animateTransformConstructor);
-    gFunctionMap->set(SVGNames::circleTag.localName().impl(), circleConstructor);
-    gFunctionMap->set(SVGNames::clipPathTag.localName().impl(), clipPathConstructor);
-    gFunctionMap->set(SVGNames::cursorTag.localName().impl(), cursorConstructor);
-    gFunctionMap->set(SVGNames::definition_srcTag.localName().impl(), definition_srcConstructor);
-    gFunctionMap->set(SVGNames::defsTag.localName().impl(), defsConstructor);
-    gFunctionMap->set(SVGNames::descTag.localName().impl(), descConstructor);
-    gFunctionMap->set(SVGNames::ellipseTag.localName().impl(), ellipseConstructor);
-    gFunctionMap->set(SVGNames::feBlendTag.localName().impl(), feBlendConstructor);
-    gFunctionMap->set(SVGNames::feColorMatrixTag.localName().impl(), feColorMatrixConstructor);
-    gFunctionMap->set(SVGNames::feComponentTransferTag.localName().impl(), feComponentTransferConstructor);
-    gFunctionMap->set(SVGNames::feCompositeTag.localName().impl(), feCompositeConstructor);
-    gFunctionMap->set(SVGNames::feDiffuseLightingTag.localName().impl(), feDiffuseLightingConstructor);
-    gFunctionMap->set(SVGNames::feDisplacementMapTag.localName().impl(), feDisplacementMapConstructor);
-    gFunctionMap->set(SVGNames::feDistantLightTag.localName().impl(), feDistantLightConstructor);
-    gFunctionMap->set(SVGNames::feFloodTag.localName().impl(), feFloodConstructor);
-    gFunctionMap->set(SVGNames::feFuncATag.localName().impl(), feFuncAConstructor);
-    gFunctionMap->set(SVGNames::feFuncBTag.localName().impl(), feFuncBConstructor);
-    gFunctionMap->set(SVGNames::feFuncGTag.localName().impl(), feFuncGConstructor);
-    gFunctionMap->set(SVGNames::feFuncRTag.localName().impl(), feFuncRConstructor);
-    gFunctionMap->set(SVGNames::feGaussianBlurTag.localName().impl(), feGaussianBlurConstructor);
-    gFunctionMap->set(SVGNames::feImageTag.localName().impl(), feImageConstructor);
-    gFunctionMap->set(SVGNames::feMergeTag.localName().impl(), feMergeConstructor);
-    gFunctionMap->set(SVGNames::feMergeNodeTag.localName().impl(), feMergeNodeConstructor);
-    gFunctionMap->set(SVGNames::feOffsetTag.localName().impl(), feOffsetConstructor);
-    gFunctionMap->set(SVGNames::fePointLightTag.localName().impl(), fePointLightConstructor);
-    gFunctionMap->set(SVGNames::feSpecularLightingTag.localName().impl(), feSpecularLightingConstructor);
-    gFunctionMap->set(SVGNames::feSpotLightTag.localName().impl(), feSpotLightConstructor);
-    gFunctionMap->set(SVGNames::feTileTag.localName().impl(), feTileConstructor);
-    gFunctionMap->set(SVGNames::feTurbulenceTag.localName().impl(), feTurbulenceConstructor);
-    gFunctionMap->set(SVGNames::filterTag.localName().impl(), filterConstructor);
-    gFunctionMap->set(SVGNames::fontTag.localName().impl(), fontConstructor);
-    gFunctionMap->set(SVGNames::font_faceTag.localName().impl(), font_faceConstructor);
-    gFunctionMap->set(SVGNames::font_face_formatTag.localName().impl(), font_face_formatConstructor);
-    gFunctionMap->set(SVGNames::font_face_nameTag.localName().impl(), font_face_nameConstructor);
-    gFunctionMap->set(SVGNames::font_face_srcTag.localName().impl(), font_face_srcConstructor);
-    gFunctionMap->set(SVGNames::font_face_uriTag.localName().impl(), font_face_uriConstructor);
-    gFunctionMap->set(SVGNames::foreignObjectTag.localName().impl(), foreignObjectConstructor);
-    gFunctionMap->set(SVGNames::gTag.localName().impl(), gConstructor);
-    gFunctionMap->set(SVGNames::glyphTag.localName().impl(), glyphConstructor);
-    gFunctionMap->set(SVGNames::hkernTag.localName().impl(), hkernConstructor);
-    gFunctionMap->set(SVGNames::imageTag.localName().impl(), imageConstructor);
-    gFunctionMap->set(SVGNames::lineTag.localName().impl(), lineConstructor);
-    gFunctionMap->set(SVGNames::linearGradientTag.localName().impl(), linearGradientConstructor);
-    gFunctionMap->set(SVGNames::markerTag.localName().impl(), markerConstructor);
-    gFunctionMap->set(SVGNames::maskTag.localName().impl(), maskConstructor);
-    gFunctionMap->set(SVGNames::metadataTag.localName().impl(), metadataConstructor);
-    gFunctionMap->set(SVGNames::missing_glyphTag.localName().impl(), missing_glyphConstructor);
-    gFunctionMap->set(SVGNames::mpathTag.localName().impl(), mpathConstructor);
-    gFunctionMap->set(SVGNames::pathTag.localName().impl(), pathConstructor);
-    gFunctionMap->set(SVGNames::patternTag.localName().impl(), patternConstructor);
-    gFunctionMap->set(SVGNames::polygonTag.localName().impl(), polygonConstructor);
-    gFunctionMap->set(SVGNames::polylineTag.localName().impl(), polylineConstructor);
-    gFunctionMap->set(SVGNames::radialGradientTag.localName().impl(), radialGradientConstructor);
-    gFunctionMap->set(SVGNames::rectTag.localName().impl(), rectConstructor);
-    gFunctionMap->set(SVGNames::scriptTag.localName().impl(), scriptConstructor);
-    gFunctionMap->set(SVGNames::setTag.localName().impl(), setConstructor);
-    gFunctionMap->set(SVGNames::stopTag.localName().impl(), stopConstructor);
-    gFunctionMap->set(SVGNames::styleTag.localName().impl(), styleConstructor);
-    gFunctionMap->set(SVGNames::svgTag.localName().impl(), svgConstructor);
-    gFunctionMap->set(SVGNames::switchTag.localName().impl(), switchConstructor);
-    gFunctionMap->set(SVGNames::symbolTag.localName().impl(), symbolConstructor);
-    gFunctionMap->set(SVGNames::textTag.localName().impl(), textConstructor);
-    gFunctionMap->set(SVGNames::textPathTag.localName().impl(), textPathConstructor);
-    gFunctionMap->set(SVGNames::titleTag.localName().impl(), titleConstructor);
-    gFunctionMap->set(SVGNames::trefTag.localName().impl(), trefConstructor);
-    gFunctionMap->set(SVGNames::tspanTag.localName().impl(), tspanConstructor);
-    gFunctionMap->set(SVGNames::useTag.localName().impl(), useConstructor);
-    gFunctionMap->set(SVGNames::viewTag.localName().impl(), viewConstructor);
+    addTag(aTag, aConstructor);
+    addTag(altGlyphTag, altglyphConstructor);
+    addTag(animateTag, animateConstructor);
+    addTag(animateColorTag, animatecolorConstructor);
+    addTag(animateMotionTag, animatemotionConstructor);
+    addTag(animateTransformTag, animatetransformConstructor);
+    addTag(circleTag, circleConstructor);
+    addTag(clipPathTag, clippathConstructor);
+    addTag(cursorTag, cursorConstructor);
+    addTag(definition_srcTag, definitionsrcConstructor);
+    addTag(defsTag, defsConstructor);
+    addTag(descTag, descConstructor);
+    addTag(ellipseTag, ellipseConstructor);
+    addTag(fontTag, fontConstructor);
+    addTag(font_faceTag, fontfaceConstructor);
+    addTag(font_face_formatTag, fontfaceformatConstructor);
+    addTag(font_face_nameTag, fontfacenameConstructor);
+    addTag(font_face_srcTag, fontfacesrcConstructor);
+    addTag(font_face_uriTag, fontfaceuriConstructor);
+    addTag(foreignObjectTag, foreignobjectConstructor);
+    addTag(gTag, gConstructor);
+    addTag(glyphTag, glyphConstructor);
+    addTag(hkernTag, hkernConstructor);
+    addTag(imageTag, imageConstructor);
+    addTag(lineTag, lineConstructor);
+    addTag(linearGradientTag, lineargradientConstructor);
+    addTag(markerTag, markerConstructor);
+    addTag(maskTag, maskConstructor);
+    addTag(metadataTag, metadataConstructor);
+    addTag(missing_glyphTag, missingglyphConstructor);
+    addTag(mpathTag, mpathConstructor);
+    addTag(pathTag, pathConstructor);
+    addTag(patternTag, patternConstructor);
+    addTag(polygonTag, polygonConstructor);
+    addTag(polylineTag, polylineConstructor);
+    addTag(radialGradientTag, radialgradientConstructor);
+    addTag(rectTag, rectConstructor);
+    addTag(scriptTag, scriptConstructor);
+    addTag(setTag, setConstructor);
+    addTag(stopTag, stopConstructor);
+    addTag(styleTag, styleConstructor);
+    addTag(svgTag, svgConstructor);
+    addTag(switchTag, switchConstructor);
+    addTag(symbolTag, symbolConstructor);
+    addTag(textTag, textConstructor);
+    addTag(textPathTag, textpathConstructor);
+    addTag(titleTag, titleConstructor);
+    addTag(trefTag, trefConstructor);
+    addTag(tspanTag, tspanConstructor);
+    addTag(useTag, useConstructor);
+    addTag(viewTag, viewConstructor);
 }
 #endif
 
@@ -591,12 +435,10 @@ PassRefPtr<SVGElement> SVGElementFactory::createSVGElement(const QualifiedName&
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
-
     createFunctionMapIfNecessary();
     ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
     if (func)
-        return func(doc, createdByParser);
-
+        return func(qName, doc, createdByParser);
     return new SVGElement(qName, doc);
 #else
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
index 9c481464c7..edbf308089 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
+++ b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
@@ -42,13 +42,12 @@ namespace WebCore {
 namespace WebCore {
 
     class SVGElement;
-
     // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
     // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
     class SVGElementFactory {
     public:
         PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
-        static PassRefPtr<SVGElement> createSVGElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
+        static PassRefPtr<SVGElement> createSVGElement(const WebCore::QualifiedName&, WebCore::Document*, bool /*createdByParser*/ = true);
     };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
index 417d1f7637..445a59f256 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
@@ -58,29 +58,6 @@ DEFINE_GLOBAL(QualifiedName, definition_srcTag, nullAtom, "definition_src", svgN
 DEFINE_GLOBAL(QualifiedName, defsTag, nullAtom, "defs", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, descTag, nullAtom, "desc", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ellipseTag, nullAtom, "ellipse", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feBlendTag, nullAtom, "feBlend", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feColorMatrixTag, nullAtom, "feColorMatrix", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feComponentTransferTag, nullAtom, "feComponentTransfer", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feCompositeTag, nullAtom, "feComposite", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feDiffuseLightingTag, nullAtom, "feDiffuseLighting", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feDisplacementMapTag, nullAtom, "feDisplacementMap", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feDistantLightTag, nullAtom, "feDistantLight", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFloodTag, nullAtom, "feFlood", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncATag, nullAtom, "feFuncA", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncBTag, nullAtom, "feFuncB", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncGTag, nullAtom, "feFuncG", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncRTag, nullAtom, "feFuncR", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feGaussianBlurTag, nullAtom, "feGaussianBlur", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feImageTag, nullAtom, "feImage", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feMergeTag, nullAtom, "feMerge", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feMergeNodeTag, nullAtom, "feMergeNode", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feOffsetTag, nullAtom, "feOffset", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, fePointLightTag, nullAtom, "fePointLight", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feSpecularLightingTag, nullAtom, "feSpecularLighting", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feSpotLightTag, nullAtom, "feSpotLight", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feTileTag, nullAtom, "feTile", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feTurbulenceTag, nullAtom, "feTurbulence", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, filterTag, nullAtom, "filter", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, fontTag, nullAtom, "font", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, font_faceTag, nullAtom, "font_face", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, font_face_formatTag, nullAtom, "font_face_format", svgNamespaceURI);
@@ -137,29 +114,6 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&defsTag,
         (WebCore::QualifiedName*)&descTag,
         (WebCore::QualifiedName*)&ellipseTag,
-        (WebCore::QualifiedName*)&feBlendTag,
-        (WebCore::QualifiedName*)&feColorMatrixTag,
-        (WebCore::QualifiedName*)&feComponentTransferTag,
-        (WebCore::QualifiedName*)&feCompositeTag,
-        (WebCore::QualifiedName*)&feDiffuseLightingTag,
-        (WebCore::QualifiedName*)&feDisplacementMapTag,
-        (WebCore::QualifiedName*)&feDistantLightTag,
-        (WebCore::QualifiedName*)&feFloodTag,
-        (WebCore::QualifiedName*)&feFuncATag,
-        (WebCore::QualifiedName*)&feFuncBTag,
-        (WebCore::QualifiedName*)&feFuncGTag,
-        (WebCore::QualifiedName*)&feFuncRTag,
-        (WebCore::QualifiedName*)&feGaussianBlurTag,
-        (WebCore::QualifiedName*)&feImageTag,
-        (WebCore::QualifiedName*)&feMergeTag,
-        (WebCore::QualifiedName*)&feMergeNodeTag,
-        (WebCore::QualifiedName*)&feOffsetTag,
-        (WebCore::QualifiedName*)&fePointLightTag,
-        (WebCore::QualifiedName*)&feSpecularLightingTag,
-        (WebCore::QualifiedName*)&feSpotLightTag,
-        (WebCore::QualifiedName*)&feTileTag,
-        (WebCore::QualifiedName*)&feTurbulenceTag,
-        (WebCore::QualifiedName*)&filterTag,
         (WebCore::QualifiedName*)&fontTag,
         (WebCore::QualifiedName*)&font_faceTag,
         (WebCore::QualifiedName*)&font_face_formatTag,
@@ -199,7 +153,7 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&useTag,
         (WebCore::QualifiedName*)&viewTag,
     };
-    *size = 74;
+    *size = 51;
     return SVGTags;
 }
 
@@ -722,29 +676,6 @@ char definition_srcTagString[] = "definition-src";
 char defsTagString[] = "defs";
 char descTagString[] = "desc";
 char ellipseTagString[] = "ellipse";
-char feBlendTagString[] = "feBlend";
-char feColorMatrixTagString[] = "feColorMatrix";
-char feComponentTransferTagString[] = "feComponentTransfer";
-char feCompositeTagString[] = "feComposite";
-char feDiffuseLightingTagString[] = "feDiffuseLighting";
-char feDisplacementMapTagString[] = "feDisplacementMap";
-char feDistantLightTagString[] = "feDistantLight";
-char feFloodTagString[] = "feFlood";
-char feFuncATagString[] = "feFuncA";
-char feFuncBTagString[] = "feFuncB";
-char feFuncGTagString[] = "feFuncG";
-char feFuncRTagString[] = "feFuncR";
-char feGaussianBlurTagString[] = "feGaussianBlur";
-char feImageTagString[] = "feImage";
-char feMergeTagString[] = "feMerge";
-char feMergeNodeTagString[] = "feMergeNode";
-char feOffsetTagString[] = "feOffset";
-char fePointLightTagString[] = "fePointLight";
-char feSpecularLightingTagString[] = "feSpecularLighting";
-char feSpotLightTagString[] = "feSpotLight";
-char feTileTagString[] = "feTile";
-char feTurbulenceTagString[] = "feTurbulence";
-char filterTagString[] = "filter";
 char fontTagString[] = "font";
 char font_faceTagString[] = "font-face";
 char font_face_formatTagString[] = "font-face-format";
@@ -1062,29 +993,6 @@ void init()
     new ((void*)&defsTag) QualifiedName(nullAtom, defsTagString, svgNS);
     new ((void*)&descTag) QualifiedName(nullAtom, descTagString, svgNS);
     new ((void*)&ellipseTag) QualifiedName(nullAtom, ellipseTagString, svgNS);
-    new ((void*)&feBlendTag) QualifiedName(nullAtom, feBlendTagString, svgNS);
-    new ((void*)&feColorMatrixTag) QualifiedName(nullAtom, feColorMatrixTagString, svgNS);
-    new ((void*)&feComponentTransferTag) QualifiedName(nullAtom, feComponentTransferTagString, svgNS);
-    new ((void*)&feCompositeTag) QualifiedName(nullAtom, feCompositeTagString, svgNS);
-    new ((void*)&feDiffuseLightingTag) QualifiedName(nullAtom, feDiffuseLightingTagString, svgNS);
-    new ((void*)&feDisplacementMapTag) QualifiedName(nullAtom, feDisplacementMapTagString, svgNS);
-    new ((void*)&feDistantLightTag) QualifiedName(nullAtom, feDistantLightTagString, svgNS);
-    new ((void*)&feFloodTag) QualifiedName(nullAtom, feFloodTagString, svgNS);
-    new ((void*)&feFuncATag) QualifiedName(nullAtom, feFuncATagString, svgNS);
-    new ((void*)&feFuncBTag) QualifiedName(nullAtom, feFuncBTagString, svgNS);
-    new ((void*)&feFuncGTag) QualifiedName(nullAtom, feFuncGTagString, svgNS);
-    new ((void*)&feFuncRTag) QualifiedName(nullAtom, feFuncRTagString, svgNS);
-    new ((void*)&feGaussianBlurTag) QualifiedName(nullAtom, feGaussianBlurTagString, svgNS);
-    new ((void*)&feImageTag) QualifiedName(nullAtom, feImageTagString, svgNS);
-    new ((void*)&feMergeTag) QualifiedName(nullAtom, feMergeTagString, svgNS);
-    new ((void*)&feMergeNodeTag) QualifiedName(nullAtom, feMergeNodeTagString, svgNS);
-    new ((void*)&feOffsetTag) QualifiedName(nullAtom, feOffsetTagString, svgNS);
-    new ((void*)&fePointLightTag) QualifiedName(nullAtom, fePointLightTagString, svgNS);
-    new ((void*)&feSpecularLightingTag) QualifiedName(nullAtom, feSpecularLightingTagString, svgNS);
-    new ((void*)&feSpotLightTag) QualifiedName(nullAtom, feSpotLightTagString, svgNS);
-    new ((void*)&feTileTag) QualifiedName(nullAtom, feTileTagString, svgNS);
-    new ((void*)&feTurbulenceTag) QualifiedName(nullAtom, feTurbulenceTagString, svgNS);
-    new ((void*)&filterTag) QualifiedName(nullAtom, filterTagString, svgNS);
     new ((void*)&fontTag) QualifiedName(nullAtom, fontTagString, svgNS);
     new ((void*)&font_faceTag) QualifiedName(nullAtom, font_faceTagString, svgNS);
     new ((void*)&font_face_formatTag) QualifiedName(nullAtom, font_face_formatTagString, svgNS);
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.h b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
index d7121d58d7..89703ff18d 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
@@ -67,52 +67,6 @@ extern const WebCore::QualifiedName descTag;
 extern char descTagString[];
 extern const WebCore::QualifiedName ellipseTag;
 extern char ellipseTagString[];
-extern const WebCore::QualifiedName feBlendTag;
-extern char feBlendTagString[];
-extern const WebCore::QualifiedName feColorMatrixTag;
-extern char feColorMatrixTagString[];
-extern const WebCore::QualifiedName feComponentTransferTag;
-extern char feComponentTransferTagString[];
-extern const WebCore::QualifiedName feCompositeTag;
-extern char feCompositeTagString[];
-extern const WebCore::QualifiedName feDiffuseLightingTag;
-extern char feDiffuseLightingTagString[];
-extern const WebCore::QualifiedName feDisplacementMapTag;
-extern char feDisplacementMapTagString[];
-extern const WebCore::QualifiedName feDistantLightTag;
-extern char feDistantLightTagString[];
-extern const WebCore::QualifiedName feFloodTag;
-extern char feFloodTagString[];
-extern const WebCore::QualifiedName feFuncATag;
-extern char feFuncATagString[];
-extern const WebCore::QualifiedName feFuncBTag;
-extern char feFuncBTagString[];
-extern const WebCore::QualifiedName feFuncGTag;
-extern char feFuncGTagString[];
-extern const WebCore::QualifiedName feFuncRTag;
-extern char feFuncRTagString[];
-extern const WebCore::QualifiedName feGaussianBlurTag;
-extern char feGaussianBlurTagString[];
-extern const WebCore::QualifiedName feImageTag;
-extern char feImageTagString[];
-extern const WebCore::QualifiedName feMergeTag;
-extern char feMergeTagString[];
-extern const WebCore::QualifiedName feMergeNodeTag;
-extern char feMergeNodeTagString[];
-extern const WebCore::QualifiedName feOffsetTag;
-extern char feOffsetTagString[];
-extern const WebCore::QualifiedName fePointLightTag;
-extern char fePointLightTagString[];
-extern const WebCore::QualifiedName feSpecularLightingTag;
-extern char feSpecularLightingTagString[];
-extern const WebCore::QualifiedName feSpotLightTag;
-extern char feSpotLightTagString[];
-extern const WebCore::QualifiedName feTileTag;
-extern char feTileTagString[];
-extern const WebCore::QualifiedName feTurbulenceTag;
-extern char feTurbulenceTagString[];
-extern const WebCore::QualifiedName filterTag;
-extern char filterTagString[];
 extern const WebCore::QualifiedName fontTag;
 extern char fontTagString[];
 extern const WebCore::QualifiedName font_faceTag;
@@ -189,9 +143,6 @@ extern const WebCore::QualifiedName useTag;
 extern char useTagString[];
 extern const WebCore::QualifiedName viewTag;
 extern char viewTagString[];
-
-
-WebCore::QualifiedName** getSVGTags(size_t* size);
 // Attributes
 extern const WebCore::QualifiedName accent_heightAttr;
 extern char accent_heightAttrString[];
@@ -687,11 +638,11 @@ extern const WebCore::QualifiedName zAttr;
 extern char zAttrString[];
 extern const WebCore::QualifiedName zoomAndPanAttr;
 extern char zoomAndPanAttrString[];
-
-
-WebCore::QualifiedName** getSVGAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getSVGTags(size_t* size);
+WebCore::QualifiedName** getSVGAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
index b0298a664b..aa044fa33c 100644
--- a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
@@ -41,10 +41,5 @@ static const struct HashTableValue stringTableValues[33] = {
 };
 
 extern const struct HashTable stringTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, stringTableValues, 0 };
-#else
     { 71, 63, stringTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index c7711fa9da..13f2c11a46 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -1,8 +1,8 @@
 namespace WebCore {
-extern const char html4UserAgentStyleSheet[8200];
+extern const char html4UserAgentStyleSheet[8333];
 extern const char quirksUserAgentStyleSheet[359];
 extern const char svgUserAgentStyleSheet[358];
 extern const char sourceUserAgentStyleSheet[2025];
 extern const char wmlUserAgentStyleSheet[2956];
-extern const char mediaControlsUserAgentStyleSheet[1587];
+extern const char mediaControlsUserAgentStyleSheet[1977];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index aa2a51eb00..2db412d7ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -1,5 +1,5 @@
 namespace WebCore {
-extern const char html4UserAgentStyleSheet[8200] = {
+extern const char html4UserAgentStyleSheet[8333] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 51, 46, 111, 114, 103, 47, 49, 57, 57,
     57, 47, 120, 104, 116, 109, 108, 34, 59, 32, 104, 116, 109, 108, 32, 123,
@@ -255,264 +255,272 @@ extern const char html4UserAgentStyleSheet[8200] = {
     107, 105, 116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32,
     118, 101, 114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122, 101,
     58, 32, 97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
-    97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97,
-    99, 101, 104, 111, 108, 100, 101, 114, 32, 123, 32, 99, 111, 108, 111, 114,
-    58, 32, 100, 97, 114, 107, 71, 114, 97, 121, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119, 111,
-    114, 100, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 116,
-    101, 120, 116, 45, 115, 101, 99, 117, 114, 105, 116, 121, 58, 32, 100, 105,
-    115, 99, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100,
-    100, 101, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 112, 97,
-    100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
-    98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114,
-    58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101,
-    114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 105, 110,
+    97, 117, 116, 111, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50,
+    112, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101,
+    104, 111, 108, 100, 101, 114, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112,
+    108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 32, 123, 32, 99, 111, 108,
+    111, 114, 58, 32, 100, 97, 114, 107, 71, 114, 97, 121, 59, 32, 125, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115,
+    119, 111, 114, 100, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 116, 101, 120, 116, 45, 115, 101, 99, 117, 114, 105, 116, 121, 58, 32,
+    100, 105, 115, 99, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59,
+    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104,
+    105, 100, 100, 101, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 44, 32, 105, 110,
     112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93,
-    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97,
-    108, 105, 103, 110, 58, 32, 98, 97, 115, 101, 108, 105, 110, 101, 59, 32,
-    116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114,
-    116, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 117,
-    116, 111, 102, 105, 108, 108, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111,
-    117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 98, 97, 99, 107, 103,
-    114, 111, 117, 110, 100, 45, 105, 109, 97, 103, 101, 58, 110, 111, 110, 101,
-    32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111,
-    34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 109, 97, 114,
-    103, 105, 110, 58, 32, 51, 112, 120, 32, 48, 46, 53, 101, 120, 59, 32,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
     112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108,
     59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
     111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114,
     100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116,
-    111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
-    101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108,
-    101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 32,
-    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
-    97, 110, 99, 101, 58, 32, 112, 117, 115, 104, 45, 98, 117, 116, 116, 111,
-    110, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
-    112, 114, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
-    117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103,
-    110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 116, 101, 120, 116, 45,
-    97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 99,
-    117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32,
-    99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 84, 101, 120,
-    116, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120, 32,
-    54, 112, 120, 32, 51, 112, 120, 32, 54, 112, 120, 59, 32, 98, 111, 114,
-    100, 101, 114, 58, 32, 50, 112, 120, 32, 111, 117, 116, 115, 101, 116, 32,
-    66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 98, 97, 99, 107,
-    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 66, 117,
-    116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111,
-    114, 100, 101, 114, 45, 98, 111, 120, 32, 125, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 45, 104, 111, 114, 105,
-    122, 111, 110, 116, 97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58,
-    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114,
-    58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 109, 97, 114, 103, 105,
-    110, 58, 32, 50, 112, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 115, 108, 105, 100, 101, 114, 45, 116, 104,
-    117, 109, 98, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
-    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114,
-    116, 104, 117, 109, 98, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108,
-    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    98, 117, 116, 116, 111, 110, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
-    100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115,
-    117, 98, 109, 105, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
     105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101,
-    34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101,
+    34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    45, 97, 108, 105, 103, 110, 58, 32, 98, 97, 115, 101, 108, 105, 110, 101,
+    59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116,
+    97, 114, 116, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 117, 116, 111, 102, 105, 108, 108, 32, 123, 32, 98, 97, 99, 107, 103,
+    114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 98, 97, 99,
+    107, 103, 114, 111, 117, 110, 100, 45, 105, 109, 97, 103, 101, 58, 110, 111,
+    110, 101, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100,
+    105, 111, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 109,
+    97, 114, 103, 105, 110, 58, 32, 51, 112, 120, 32, 48, 46, 53, 101, 120,
+    59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105,
+    97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
+    111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98,
+    111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117,
+    116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34,
+    93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
+    105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102,
+    105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111,
+    110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 112, 117, 115, 104, 45, 98, 117, 116,
+    116, 111, 110, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101,
+    58, 32, 112, 114, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116,
+    34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101,
     98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
-    45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58,
-    100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108, 101, 99, 116,
-    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 107, 101, 121, 103, 101,
-    110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111, 112, 116, 103,
-    114, 111, 117, 112, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111,
-    112, 116, 105, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123,
-    32, 99, 111, 108, 111, 114, 58, 32, 71, 114, 97, 121, 84, 101, 120, 116,
-    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98,
-    117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109,
-    105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93,
-    58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105,
-    118, 101, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101,
-    45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32,
-    98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32,
-    98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 105, 110,
-    115, 101, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118,
-    101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93,
-    58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115,
-    97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101,
-    58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
-    117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99,
-    116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32,
-    98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 111, 117,
-    116, 115, 101, 116, 32, 125, 32, 97, 114, 101, 97, 44, 32, 112, 97, 114,
-    97, 109, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
-    110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
-    58, 32, 99, 104, 101, 99, 107, 98, 111, 120, 59, 32, 45, 119, 101, 98,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 32,
+    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108,
+    105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 116, 101, 120,
+    116, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59,
+    32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116,
+    59, 32, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 84,
+    101, 120, 116, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112,
+    120, 32, 54, 112, 120, 32, 51, 112, 120, 32, 54, 112, 120, 59, 32, 98,
+    111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 111, 117, 116, 115, 101,
+    116, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 98, 97,
+    99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32,
+    66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 45, 119, 101, 98,
     107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32,
-    98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34,
-    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 114, 97, 100, 105, 111, 59, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110,
-    103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125,
-    32, 107, 101, 121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99, 116, 32,
-    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
-    97, 110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105,
-    110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103,
-    110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101,
-    114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100,
-    105, 117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45,
-    115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103,
-    58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111, 108, 111, 114,
-    58, 32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107, 103, 114, 111,
-    117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101,
-    59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108,
-    116, 59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101,
-    93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 109, 117, 108, 116, 105, 112,
-    108, 101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101,
-    93, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 32, 123, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
-    58, 32, 108, 105, 115, 116, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116,
-    97, 114, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120,
-    32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105,
-    117, 115, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 119, 104, 105,
-    116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97,
-    108, 59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101,
-    61, 34, 48, 34, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105,
-    122, 101, 61, 34, 49, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
-    110, 117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101,
-    114, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115,
-    111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120,
-    59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112,
-    114, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112, 32, 123,
-    32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111,
-    108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110, 32, 123,
-    32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 110, 111,
-    114, 109, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32, 123,
-    32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110,
-    58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115, 116,
-    114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45, 119,
-    101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125, 32,
-    105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97, 114,
-    44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110, 116,
-    45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32, 125,
-    32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44, 32,
-    115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105,
-    108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125, 32,
-    112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110, 116,
-    101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32, 100,
-    105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102,
-    111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111,
-    115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97,
-    99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110, 58,
-    32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103, 32,
-    123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97, 114,
-    103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102, 111,
-    110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114,
-    32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100, 101,
-    108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116,
-    105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117, 103,
-    104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105, 99,
-    97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32, 102,
-    111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101,
-    114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105, 99,
-    97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114, 59,
+    98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 45, 104, 111,
+    114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 112, 97, 100, 100, 105, 110,
+    103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100,
+    101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 109, 97, 114,
+    103, 105, 110, 58, 32, 50, 112, 120, 59, 32, 125, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 108, 105, 100, 101, 114, 45,
+    116, 104, 117, 109, 98, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100,
+    101, 114, 116, 104, 117, 109, 98, 45, 104, 111, 114, 105, 122, 111, 110, 116,
+    97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 100, 105, 115, 97, 98,
+    108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108,
+    101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    114, 101, 115, 101, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
+    108, 101, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45,
+    119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111,
+    97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111,
+    110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108, 101,
+    99, 116, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 107, 101, 121,
+    103, 101, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111, 112,
+    116, 103, 114, 111, 117, 112, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44,
+    32, 111, 112, 116, 105, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100,
+    32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 71, 114, 97, 121, 84, 101,
+    120, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117,
+    98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116,
+    34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99,
+    116, 105, 118, 101, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105,
+    108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110,
+    44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 32,
+    123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32,
+    105, 110, 115, 101, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116,
+    105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116,
+    34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108,
+    101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    114, 101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100,
+    105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105,
+    118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58,
+    97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32,
+    123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32,
+    111, 117, 116, 115, 101, 116, 32, 125, 32, 97, 114, 101, 97, 44, 32, 112,
+    97, 114, 97, 109, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
+    99, 101, 58, 32, 99, 104, 101, 99, 107, 98, 111, 120, 59, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103,
+    58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105,
+    111, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
+    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 114, 97, 100, 105, 111, 59,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122,
+    105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59,
+    32, 125, 32, 107, 101, 121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99,
+    116, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
+    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108,
+    105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114,
+    100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114,
+    97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116,
+    101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105,
+    110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111, 108,
+    111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107, 103,
+    114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105,
+    116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97,
+    117, 108, 116, 59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105,
+    122, 101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 109, 117, 108, 116,
+    105, 112, 108, 101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105,
+    122, 101, 93, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 32, 123, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
+    99, 101, 58, 32, 108, 105, 115, 116, 98, 111, 120, 59, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32,
+    115, 116, 97, 114, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49,
+    112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97,
+    100, 105, 117, 115, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 119,
+    104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116,
+    105, 97, 108, 59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105,
+    122, 101, 61, 34, 48, 34, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91,
+    115, 105, 122, 101, 61, 34, 49, 34, 93, 32, 123, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
+    109, 101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110,
+    116, 101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120,
+    32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53,
+    112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58,
+    32, 112, 114, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112,
+    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
+    98, 111, 108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110,
+    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
+    110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115,
+    32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105,
+    111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32,
+    115, 116, 114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116,
+    45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32,
+    125, 32, 105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118,
+    97, 114, 44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111,
+    110, 116, 45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99,
+    32, 125, 32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100,
+    44, 32, 115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97,
+    109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32,
+    125, 32, 112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105,
+    110, 116, 101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59,
+    32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111,
+    110, 111, 115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115,
+    112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105,
+    110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105,
+    103, 32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108,
+    97, 114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32,
+    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108,
+    101, 114, 32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32,
+    100, 101, 108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114,
+    97, 116, 105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111,
+    117, 103, 104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116,
+    105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59,
     32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108,
-    108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104, 105,
-    116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97, 112,
-    32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108,
-    105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110, 103,
-    45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102, 111,
-    99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115, 44,
-    32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121, 93,
-    58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101,
-    58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58, 102,
-    111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58, 102,
-    111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102, 111,
-    99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99, 117,
-    115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115, 32,
-    123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116,
-    58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102, 111,
+    108, 101, 114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116,
+    105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101,
+    114, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109,
+    97, 108, 108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119,
+    104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114,
+    97, 112, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117,
+    116, 108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105,
+    110, 103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58,
+    102, 111, 99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117,
+    115, 44, 32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108,
+    121, 93, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105,
+    110, 101, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116,
+    58, 102, 111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97,
+    58, 102, 111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58,
+    102, 111, 99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111,
+    99, 117, 115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117,
+    115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115,
+    101, 116, 58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58,
+    102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111,
     99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99, 117,
-    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
-    105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34,
-    93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111, 99,
-    117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116,
-    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 102,
+    34, 102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101,
+    110, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102,
     111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117, 115,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
-    108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101,
-    45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 32,
-    123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111,
-    114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110,
-    101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59,
-    32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121,
-    45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 99,
-    111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 99,
-    116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110, 111, 102, 114, 97,
-    109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110,
-    111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44, 32,
-    102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
-    32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101,
-    116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114,
-    58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114, 97,
-    109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120,
-    32, 105, 110, 115, 101, 116, 32, 125
+    61, 34, 114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115,
+    101, 116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93,
+    58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99,
+    117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97,
+    100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105,
+    110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110,
+    107, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101,
+    99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108,
+    105, 110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116,
+    111, 59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123,
+    32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110, 111, 102,
+    114, 97, 109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    32, 110, 111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116,
+    44, 32, 102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101,
+    115, 101, 116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108,
+    111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102,
+    114, 97, 109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50,
+    112, 120, 32, 105, 110, 115, 101, 116, 32, 125, 32, 105, 109, 103, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 105, 109, 97, 103, 101,
+    93, 44, 32, 118, 105, 100, 101, 111, 44, 32, 105, 102, 114, 97, 109, 101,
+    44, 32, 111, 98, 106, 101, 99, 116, 44, 32, 101, 109, 98, 101, 100, 44,
+    32, 97, 112, 112, 108, 101, 116, 32, 123, 32, 111, 118, 101, 114, 102, 108,
+    111, 119, 58, 32, 104, 105, 100, 100, 101, 110, 59, 32, 125
 };
 extern const char quirksUserAgentStyleSheet[359] = {
     105, 109, 103, 91, 97, 108, 105, 103, 110, 61, 34, 108, 101, 102, 116, 34,
@@ -880,7 +888,7 @@ extern const char wmlUserAgentStyleSheet[2956] = {
     32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45,
     97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125
 };
-extern const char mediaControlsUserAgentStyleSheet[1587] = {
+extern const char mediaControlsUserAgentStyleSheet[1977] = {
     97, 117, 100, 105, 111, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 50,
     48, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
     112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
@@ -893,93 +901,117 @@ extern const char mediaControlsUserAgentStyleSheet[1587] = {
     119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 104, 101, 105,
     103, 104, 116, 58, 32, 49, 48, 48, 37, 59, 32, 45, 119, 101, 98, 107,
     105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32,
-    110, 111, 110, 101, 59, 32, 125, 32, 118, 105, 100, 101, 111, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 102, 117, 108, 108, 45, 112, 97, 103, 101, 45,
-    109, 101, 100, 105, 97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97,
-    110, 101, 108, 32, 123, 32, 98, 111, 116, 116, 111, 109, 58, 32, 45, 49,
-    54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
-    114, 111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110,
-    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
-    58, 32, 109, 101, 100, 105, 97, 45, 109, 117, 116, 101, 45, 98, 117, 116,
-    116, 111, 110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97,
-    98, 115, 111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117,
-    116, 111, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108,
-    101, 102, 116, 58, 32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49,
-    55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112,
-    120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
-    108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 44, 32,
-    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108,
-    97, 121, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
-    109, 101, 100, 105, 97, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111,
-    110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115,
-    111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111,
-    59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102,
-    116, 58, 32, 49, 54, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32,
-    49, 55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
-    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
-    111, 108, 115, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121,
-    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    110, 111, 110, 101, 59, 32, 122, 45, 105, 110, 100, 101, 120, 58, 32, 48,
+    59, 32, 125, 32, 118, 105, 100, 101, 111, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 102, 117, 108, 108, 45, 112, 97, 103, 101, 45, 109, 101, 100, 105,
+    97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32,
+    123, 32, 98, 111, 116, 116, 111, 109, 58, 32, 45, 49, 54, 112, 120, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105,
+    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101,
+    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
+    100, 105, 97, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 59,
+    32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108,
+    117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32,
+    98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58,
+    32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59,
+    32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125,
+    32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112,
+    108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98,
+    117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105,
+    97, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112,
+    111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116,
+    101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111,
+    116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 49,
+    54, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120,
+    59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32,
+    125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
     45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121, 32, 123, 32, 100,
-    105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32,
+    116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110,
+    101, 114, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97,
+    105, 110, 101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117,
+    115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111, 110, 101,
+    59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111,
+    108, 117, 116, 101, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48,
+    112, 120, 32, 49, 54, 112, 120, 32, 48, 112, 120, 32, 48, 112, 120, 59,
+    32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116,
+    111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 51, 50, 112,
+    120, 59, 32, 114, 105, 103, 104, 116, 58, 32, 51, 50, 112, 120, 59, 32,
+    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
     97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
+    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117,
+    114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108,
+    97, 121, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100,
+    105, 115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
+    111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101, 109,
+    97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32,
+    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
     101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
-    109, 101, 108, 105, 110, 101, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 108, 105, 100, 101,
-    114, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115,
-    111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111,
-    59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102,
-    116, 58, 32, 51, 50, 112, 120, 59, 32, 114, 105, 103, 104, 116, 58, 32,
-    51, 50, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
-    112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 112, 120,
-    32, 50, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
+    109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115,
+    112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
     119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45,
-    98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 44, 32,
+    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
+    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
+    109, 101, 108, 105, 110, 101, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
     45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100,
-    105, 97, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116,
+    105, 97, 45, 115, 108, 105, 100, 101, 114, 59, 32, 112, 111, 115, 105, 116,
+    105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 116,
+    111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116, 111, 109,
+    58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 48, 112, 120, 59, 32,
+    114, 105, 103, 104, 116, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110,
+    103, 58, 32, 48, 112, 120, 32, 50, 112, 120, 59, 32, 125, 32, 97, 117,
+    100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107,
+    45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105,
+    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107,
+    45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99,
+    101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101, 101, 107, 45, 98, 97,
+    99, 107, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112, 111, 115, 105, 116,
+    105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 116,
+    111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116, 111, 109,
+    58, 32, 48, 59, 32, 114, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120,
+    59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59, 32, 104,
+    101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97,
+    117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101,
+    107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110,
+    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
+    116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
+    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45,
+    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
     116, 111, 110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97,
     98, 115, 111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117,
     116, 111, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 114,
-    105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 119, 105, 100, 116,
-    104, 58, 32, 49, 55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58,
-    32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
-    110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119,
-    97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101,
-    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
-    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 102,
-    111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
-    99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101, 101, 107, 45, 102,
-    111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112,
-    111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116,
-    101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111,
-    116, 116, 111, 109, 58, 32, 48, 59, 32, 114, 105, 103, 104, 116, 58, 32,
-    48, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59, 32,
-    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
-    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117,
-    108, 108, 115, 99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 44,
-    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102,
-    117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110,
-    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101,
-    59, 32, 125
+    105, 103, 104, 116, 58, 32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32,
+    49, 55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
+    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98,
+    117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45,
+    98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 59, 32, 125
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
index 3e796c53b7..9a9cb29dbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
@@ -55,11 +55,10 @@ extern const WebCore::QualifiedName titleAttr;
 extern char titleAttrString[];
 extern const WebCore::QualifiedName typeAttr;
 extern char typeAttrString[];
-
-
-WebCore::QualifiedName** getXLinkAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getXLinkAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/XMLNames.h b/src/3rdparty/webkit/WebCore/generated/XMLNames.h
index 7f04550e6b..f135e96fea 100644
--- a/src/3rdparty/webkit/WebCore/generated/XMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/XMLNames.h
@@ -44,11 +44,10 @@ extern const WebCore::AtomicString xmlNamespaceURI;
 extern const WebCore::QualifiedName baseAttr;
 extern const WebCore::QualifiedName langAttr;
 extern const WebCore::QualifiedName spaceAttr;
-
-
-WebCore::QualifiedName** getXMLAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getXMLAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
index 1e67ca6ac2..187298081c 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton implementation for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton implementation for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,7 +28,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -47,7 +46,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.3"
+#define YYBISON_VERSION "2.4.1"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -55,69 +54,28 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
+/* Push parsers.  */
+#define YYPUSH 0
+
+/* Pull parsers.  */
+#define YYPULL 1
+
 /* Using locations.  */
 #define YYLSP_NEEDED 0
 
 /* Substitute the variable and function names.  */
-#define yyparse xpathyyparse
-#define yylex   xpathyylex
-#define yyerror xpathyyerror
-#define yylval  xpathyylval
-#define yychar  xpathyychar
-#define yydebug xpathyydebug
-#define yynerrs xpathyynerrs
-
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     MULOP = 258,
-     RELOP = 259,
-     EQOP = 260,
-     MINUS = 261,
-     PLUS = 262,
-     AND = 263,
-     OR = 264,
-     AXISNAME = 265,
-     NODETYPE = 266,
-     PI = 267,
-     FUNCTIONNAME = 268,
-     LITERAL = 269,
-     VARIABLEREFERENCE = 270,
-     NUMBER = 271,
-     DOTDOT = 272,
-     SLASHSLASH = 273,
-     NAMETEST = 274,
-     XPATH_ERROR = 275
-   };
-#endif
-/* Tokens.  */
-#define MULOP 258
-#define RELOP 259
-#define EQOP 260
-#define MINUS 261
-#define PLUS 262
-#define AND 263
-#define OR 264
-#define AXISNAME 265
-#define NODETYPE 266
-#define PI 267
-#define FUNCTIONNAME 268
-#define LITERAL 269
-#define VARIABLEREFERENCE 270
-#define NUMBER 271
-#define DOTDOT 272
-#define SLASHSLASH 273
-#define NAMETEST 274
-#define XPATH_ERROR 275
-
-
+#define yyparse         xpathyyparse
+#define yylex           xpathyylex
+#define yyerror         xpathyyerror
+#define yylval          xpathyylval
+#define yychar          xpathyychar
+#define yydebug         xpathyydebug
+#define yynerrs         xpathyynerrs
 
 
 /* Copy the first part of user declarations.  */
+
+/* Line 189 of yacc.c  */
 #line 28 "../xml/XPathGrammar.y"
 
 
@@ -144,6 +102,9 @@ using namespace XPath;
 
 
 
+/* Line 189 of yacc.c  */
+#line 107 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -162,10 +123,43 @@ using namespace XPath;
 # define YYTOKEN_TABLE 0
 #endif
 
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     MULOP = 258,
+     RELOP = 259,
+     EQOP = 260,
+     MINUS = 261,
+     PLUS = 262,
+     AND = 263,
+     OR = 264,
+     AXISNAME = 265,
+     NODETYPE = 266,
+     PI = 267,
+     FUNCTIONNAME = 268,
+     LITERAL = 269,
+     VARIABLEREFERENCE = 270,
+     NUMBER = 271,
+     DOTDOT = 272,
+     SLASHSLASH = 273,
+     NAMETEST = 274,
+     XPATH_ERROR = 275
+   };
+#endif
+
+
+
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 56 "../xml/XPathGrammar.y"
 {
+
+/* Line 214 of yacc.c  */
+#line 56 "../xml/XPathGrammar.y"
+
     Step::Axis axis;
     Step::NodeTest* nodeTest;
     NumericOp::Opcode numop;
@@ -176,28 +170,31 @@ typedef union YYSTYPE
     Vector<Expression*>* argList;
     Step* step;
     LocationPath* locationPath;
-}
-/* Line 187 of yacc.c.  */
-#line 182 "XPathGrammar.tab.c"
-	YYSTYPE;
+
+
+
+/* Line 214 of yacc.c  */
+#line 178 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
-
 /* Copy the second part of user declarations.  */
+
+/* Line 264 of yacc.c  */
 #line 69 "../xml/XPathGrammar.y"
 
 
-int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
-void xpathyyerror(const char*) { }
+static int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
+static void xpathyyerror(const char*) { }
     
 
 
-/* Line 216 of yacc.c.  */
-#line 201 "XPathGrammar.tab.c"
+/* Line 264 of yacc.c  */
+#line 198 "WebCore/tmp/../generated/XPathGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -272,14 +269,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int i)
+YYID (int yyi)
 #else
 static int
-YYID (i)
-    int i;
+YYID (yyi)
+    int yyi;
 #endif
 {
-  return i;
+  return yyi;
 }
 #endif
 
@@ -360,9 +357,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss;
-  YYSTYPE yyvs;
-  };
+  yytype_int16 yyss_alloc;
+  YYSTYPE yyvs_alloc;
+};
 
 /* The size of the maximum gap between one aligned stack and the next.  */
 # define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1)
@@ -396,12 +393,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack)					\
+# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack, Stack, yysize);				\
-	Stack = &yyptr->Stack;						\
+	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
+	Stack = &yyptr->Stack_alloc;					\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -854,17 +851,20 @@ yy_symbol_print (yyoutput, yytype, yyvaluep)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
+yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
 #else
 static void
-yy_stack_print (bottom, top)
-    yytype_int16 *bottom;
-    yytype_int16 *top;
+yy_stack_print (yybottom, yytop)
+    yytype_int16 *yybottom;
+    yytype_int16 *yytop;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; bottom <= top; ++bottom)
-    YYFPRINTF (stderr, " %d", *bottom);
+  for (; yybottom <= yytop; yybottom++)
+    {
+      int yybot = *yybottom;
+      YYFPRINTF (stderr, " %d", yybot);
+    }
   YYFPRINTF (stderr, "\n");
 }
 
@@ -898,11 +898,11 @@ yy_reduce_print (yyvsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      fprintf (stderr, "   $%d = ", yyi + 1);
+      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       		       );
-      fprintf (stderr, "\n");
+      YYFPRINTF (stderr, "\n");
     }
 }
 
@@ -1182,10 +1182,8 @@ yydestruct (yymsg, yytype, yyvaluep)
 	break;
     }
 }
-
 
 /* Prevent warnings from -Wmissing-prototypes.  */
-
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -1204,10 +1202,9 @@ int yyparse ();
 
 
 
-
-/*----------.
-| yyparse.  |
-`----------*/
+/*-------------------------.
+| yyparse or yypush_parse.  |
+`-------------------------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -1231,74 +1228,75 @@ yyparse ()
 #endif
 #endif
 {
-  /* The look-ahead symbol.  */
+/* The lookahead symbol.  */
 int yychar;
 
-/* The semantic value of the look-ahead symbol.  */
+/* The semantic value of the lookahead symbol.  */
 YYSTYPE yylval;
 
-/* Number of syntax errors so far.  */
-int yynerrs;
-
-  int yystate;
-  int yyn;
-  int yyresult;
-  /* Number of tokens to shift before error messages enabled.  */
-  int yyerrstatus;
-  /* Look-ahead token as an internal (translated) token number.  */
-  int yytoken = 0;
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
-
-  /* Three stacks and their tools:
-     `yyss': related to states,
-     `yyvs': related to semantic values,
-     `yyls': related to locations.
-
-     Refer to the stacks thru separate pointers, to allow yyoverflow
-     to reallocate them elsewhere.  */
+    /* Number of syntax errors so far.  */
+    int yynerrs;
 
-  /* The state stack.  */
-  yytype_int16 yyssa[YYINITDEPTH];
-  yytype_int16 *yyss = yyssa;
-  yytype_int16 *yyssp;
+    int yystate;
+    /* Number of tokens to shift before error messages enabled.  */
+    int yyerrstatus;
 
-  /* The semantic value stack.  */
-  YYSTYPE yyvsa[YYINITDEPTH];
-  YYSTYPE *yyvs = yyvsa;
-  YYSTYPE *yyvsp;
+    /* The stacks and their tools:
+       `yyss': related to states.
+       `yyvs': related to semantic values.
 
+       Refer to the stacks thru separate pointers, to allow yyoverflow
+       to reallocate them elsewhere.  */
 
+    /* The state stack.  */
+    yytype_int16 yyssa[YYINITDEPTH];
+    yytype_int16 *yyss;
+    yytype_int16 *yyssp;
 
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
+    /* The semantic value stack.  */
+    YYSTYPE yyvsa[YYINITDEPTH];
+    YYSTYPE *yyvs;
+    YYSTYPE *yyvsp;
 
-  YYSIZE_T yystacksize = YYINITDEPTH;
+    YYSIZE_T yystacksize;
 
+  int yyn;
+  int yyresult;
+  /* Lookahead token as an internal (translated) token number.  */
+  int yytoken;
   /* The variables used to return semantic value and location from the
      action routines.  */
   YYSTYPE yyval;
 
+#if YYERROR_VERBOSE
+  /* Buffer for error messages, and its allocated size.  */
+  char yymsgbuf[128];
+  char *yymsg = yymsgbuf;
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
+#endif
+
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
 
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
+  yytoken = 0;
+  yyss = yyssa;
+  yyvs = yyvsa;
+  yystacksize = YYINITDEPTH;
+
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY;		/* Cause a token to be read.  */
+  yychar = YYEMPTY; /* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
-
   yyssp = yyss;
   yyvsp = yyvs;
 
@@ -1328,7 +1326,6 @@ int yynerrs;
 	YYSTYPE *yyvs1 = yyvs;
 	yytype_int16 *yyss1 = yyss;
 
-
 	/* Each stack pointer address is followed by the size of the
 	   data in use in that stack, in bytes.  This used to be a
 	   conditional around just the two extra args, but that might
@@ -1336,7 +1333,6 @@ int yynerrs;
 	yyoverflow (YY_("memory exhausted"),
 		    &yyss1, yysize * sizeof (*yyssp),
 		    &yyvs1, yysize * sizeof (*yyvsp),
-
 		    &yystacksize);
 
 	yyss = yyss1;
@@ -1359,9 +1355,8 @@ int yynerrs;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss);
-	YYSTACK_RELOCATE (yyvs);
-
+	YYSTACK_RELOCATE (yyss_alloc, yyss);
+	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -1372,7 +1367,6 @@ int yynerrs;
       yyssp = yyss + yysize - 1;
       yyvsp = yyvs + yysize - 1;
 
-
       YYDPRINTF ((stderr, "Stack size increased to %lu\n",
 		  (unsigned long int) yystacksize));
 
@@ -1382,6 +1376,9 @@ int yynerrs;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
+  if (yystate == YYFINAL)
+    YYACCEPT;
+
   goto yybackup;
 
 /*-----------.
@@ -1390,16 +1387,16 @@ int yynerrs;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     look-ahead token if we need one and don't already have one.  */
+     lookahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to look-ahead token.  */
+  /* First try to decide what to do without reference to lookahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a look-ahead token if don't already have one.  */
+  /* Not known => get a lookahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -1431,20 +1428,16 @@ yybackup:
       goto yyreduce;
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the look-ahead token.  */
+  /* Shift the lookahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token unless it is eof.  */
-  if (yychar != YYEOF)
-    yychar = YYEMPTY;
+  /* Discard the shifted token.  */
+  yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -1484,6 +1477,8 @@ yyreduce:
   switch (yyn)
     {
         case 2:
+
+/* Line 1455 of yacc.c  */
 #line 118 "../xml/XPathGrammar.y"
     {
         PARSER->m_topExpr = (yyvsp[(1) - (1)].expr);
@@ -1491,6 +1486,8 @@ yyreduce:
     break;
 
   case 3:
+
+/* Line 1455 of yacc.c  */
 #line 125 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->setAbsolute(false);
@@ -1498,6 +1495,8 @@ yyreduce:
     break;
 
   case 4:
+
+/* Line 1455 of yacc.c  */
 #line 130 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->setAbsolute(true);
@@ -1505,6 +1504,8 @@ yyreduce:
     break;
 
   case 5:
+
+/* Line 1455 of yacc.c  */
 #line 137 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = new LocationPath;
@@ -1513,6 +1514,8 @@ yyreduce:
     break;
 
   case 6:
+
+/* Line 1455 of yacc.c  */
 #line 143 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = (yyvsp[(2) - (2)].locationPath);
@@ -1520,6 +1523,8 @@ yyreduce:
     break;
 
   case 7:
+
+/* Line 1455 of yacc.c  */
 #line 148 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = (yyvsp[(2) - (2)].locationPath);
@@ -1529,6 +1534,8 @@ yyreduce:
     break;
 
   case 8:
+
+/* Line 1455 of yacc.c  */
 #line 157 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = new LocationPath;
@@ -1539,6 +1546,8 @@ yyreduce:
     break;
 
   case 9:
+
+/* Line 1455 of yacc.c  */
 #line 165 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->appendStep((yyvsp[(3) - (3)].step));
@@ -1547,6 +1556,8 @@ yyreduce:
     break;
 
   case 10:
+
+/* Line 1455 of yacc.c  */
 #line 171 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->appendStep((yyvsp[(2) - (3)].step));
@@ -1557,6 +1568,8 @@ yyreduce:
     break;
 
   case 11:
+
+/* Line 1455 of yacc.c  */
 #line 181 "../xml/XPathGrammar.y"
     {
         if ((yyvsp[(2) - (2)].predList)) {
@@ -1570,6 +1583,8 @@ yyreduce:
     break;
 
   case 12:
+
+/* Line 1455 of yacc.c  */
 #line 192 "../xml/XPathGrammar.y"
     {
         String localName;
@@ -1590,6 +1605,8 @@ yyreduce:
     break;
 
   case 13:
+
+/* Line 1455 of yacc.c  */
 #line 210 "../xml/XPathGrammar.y"
     {
         if ((yyvsp[(3) - (3)].predList)) {
@@ -1603,6 +1620,8 @@ yyreduce:
     break;
 
   case 14:
+
+/* Line 1455 of yacc.c  */
 #line 221 "../xml/XPathGrammar.y"
     {
         String localName;
@@ -1623,6 +1642,8 @@ yyreduce:
     break;
 
   case 17:
+
+/* Line 1455 of yacc.c  */
 #line 245 "../xml/XPathGrammar.y"
     {
         (yyval.axis) = Step::AttributeAxis;
@@ -1630,6 +1651,8 @@ yyreduce:
     break;
 
   case 18:
+
+/* Line 1455 of yacc.c  */
 #line 252 "../xml/XPathGrammar.y"
     {
         if (*(yyvsp[(1) - (3)].str) == "node")
@@ -1645,6 +1668,8 @@ yyreduce:
     break;
 
   case 19:
+
+/* Line 1455 of yacc.c  */
 #line 265 "../xml/XPathGrammar.y"
     {
         (yyval.nodeTest) = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest);
@@ -1654,6 +1679,8 @@ yyreduce:
     break;
 
   case 20:
+
+/* Line 1455 of yacc.c  */
 #line 272 "../xml/XPathGrammar.y"
     {
         (yyval.nodeTest) = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest, (yyvsp[(3) - (4)].str)->stripWhiteSpace());
@@ -1664,6 +1691,8 @@ yyreduce:
     break;
 
   case 21:
+
+/* Line 1455 of yacc.c  */
 #line 282 "../xml/XPathGrammar.y"
     {
         (yyval.predList) = 0;
@@ -1671,6 +1700,8 @@ yyreduce:
     break;
 
   case 23:
+
+/* Line 1455 of yacc.c  */
 #line 291 "../xml/XPathGrammar.y"
     {
         (yyval.predList) = new Vector<Predicate*>;
@@ -1681,6 +1712,8 @@ yyreduce:
     break;
 
   case 24:
+
+/* Line 1455 of yacc.c  */
 #line 299 "../xml/XPathGrammar.y"
     {
         (yyval.predList)->append(new Predicate((yyvsp[(2) - (2)].expr)));
@@ -1689,6 +1722,8 @@ yyreduce:
     break;
 
   case 25:
+
+/* Line 1455 of yacc.c  */
 #line 307 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(2) - (3)].expr);
@@ -1696,6 +1731,8 @@ yyreduce:
     break;
 
   case 26:
+
+/* Line 1455 of yacc.c  */
 #line 314 "../xml/XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::DescendantOrSelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
@@ -1704,6 +1741,8 @@ yyreduce:
     break;
 
   case 27:
+
+/* Line 1455 of yacc.c  */
 #line 322 "../xml/XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::SelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
@@ -1712,6 +1751,8 @@ yyreduce:
     break;
 
   case 28:
+
+/* Line 1455 of yacc.c  */
 #line 328 "../xml/XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::ParentAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
@@ -1720,6 +1761,8 @@ yyreduce:
     break;
 
   case 29:
+
+/* Line 1455 of yacc.c  */
 #line 336 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new VariableReference(*(yyvsp[(1) - (1)].str));
@@ -1729,6 +1772,8 @@ yyreduce:
     break;
 
   case 30:
+
+/* Line 1455 of yacc.c  */
 #line 343 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(2) - (3)].expr);
@@ -1736,6 +1781,8 @@ yyreduce:
     break;
 
   case 31:
+
+/* Line 1455 of yacc.c  */
 #line 348 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new StringExpression(*(yyvsp[(1) - (1)].str));
@@ -1745,6 +1792,8 @@ yyreduce:
     break;
 
   case 32:
+
+/* Line 1455 of yacc.c  */
 #line 355 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Number((yyvsp[(1) - (1)].str)->toDouble());
@@ -1754,6 +1803,8 @@ yyreduce:
     break;
 
   case 34:
+
+/* Line 1455 of yacc.c  */
 #line 366 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = createFunction(*(yyvsp[(1) - (3)].str));
@@ -1765,6 +1816,8 @@ yyreduce:
     break;
 
   case 35:
+
+/* Line 1455 of yacc.c  */
 #line 375 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = createFunction(*(yyvsp[(1) - (4)].str), *(yyvsp[(3) - (4)].argList));
@@ -1777,6 +1830,8 @@ yyreduce:
     break;
 
   case 36:
+
+/* Line 1455 of yacc.c  */
 #line 387 "../xml/XPathGrammar.y"
     {
         (yyval.argList) = new Vector<Expression*>;
@@ -1787,6 +1842,8 @@ yyreduce:
     break;
 
   case 37:
+
+/* Line 1455 of yacc.c  */
 #line 395 "../xml/XPathGrammar.y"
     {
         (yyval.argList)->append((yyvsp[(3) - (3)].expr));
@@ -1795,6 +1852,8 @@ yyreduce:
     break;
 
   case 40:
+
+/* Line 1455 of yacc.c  */
 #line 409 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Union;
@@ -1807,6 +1866,8 @@ yyreduce:
     break;
 
   case 41:
+
+/* Line 1455 of yacc.c  */
 #line 421 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(1) - (1)].locationPath);
@@ -1814,6 +1875,8 @@ yyreduce:
     break;
 
   case 43:
+
+/* Line 1455 of yacc.c  */
 #line 428 "../xml/XPathGrammar.y"
     {
         (yyvsp[(3) - (3)].locationPath)->setAbsolute(true);
@@ -1825,6 +1888,8 @@ yyreduce:
     break;
 
   case 44:
+
+/* Line 1455 of yacc.c  */
 #line 437 "../xml/XPathGrammar.y"
     {
         (yyvsp[(3) - (3)].locationPath)->insertFirstStep((yyvsp[(2) - (3)].step));
@@ -1838,6 +1903,8 @@ yyreduce:
     break;
 
   case 46:
+
+/* Line 1455 of yacc.c  */
 #line 452 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Filter((yyvsp[(1) - (2)].expr), *(yyvsp[(2) - (2)].predList));
@@ -1848,6 +1915,8 @@ yyreduce:
     break;
 
   case 48:
+
+/* Line 1455 of yacc.c  */
 #line 464 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new LogicalOp(LogicalOp::OP_Or, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1858,6 +1927,8 @@ yyreduce:
     break;
 
   case 50:
+
+/* Line 1455 of yacc.c  */
 #line 476 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new LogicalOp(LogicalOp::OP_And, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1868,6 +1939,8 @@ yyreduce:
     break;
 
   case 52:
+
+/* Line 1455 of yacc.c  */
 #line 488 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new EqTestOp((yyvsp[(2) - (3)].eqop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1878,6 +1951,8 @@ yyreduce:
     break;
 
   case 54:
+
+/* Line 1455 of yacc.c  */
 #line 500 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new EqTestOp((yyvsp[(2) - (3)].eqop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1888,6 +1963,8 @@ yyreduce:
     break;
 
   case 56:
+
+/* Line 1455 of yacc.c  */
 #line 512 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp(NumericOp::OP_Add, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1898,6 +1975,8 @@ yyreduce:
     break;
 
   case 57:
+
+/* Line 1455 of yacc.c  */
 #line 520 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp(NumericOp::OP_Sub, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1908,6 +1987,8 @@ yyreduce:
     break;
 
   case 59:
+
+/* Line 1455 of yacc.c  */
 #line 532 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp((yyvsp[(2) - (3)].numop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1918,6 +1999,8 @@ yyreduce:
     break;
 
   case 61:
+
+/* Line 1455 of yacc.c  */
 #line 544 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Negative;
@@ -1928,8 +2011,9 @@ yyreduce:
     break;
 
 
-/* Line 1267 of yacc.c.  */
-#line 1933 "XPathGrammar.tab.c"
+
+/* Line 1455 of yacc.c  */
+#line 2017 "WebCore/tmp/../generated/XPathGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -1940,7 +2024,6 @@ yyreduce:
 
   *++yyvsp = yyval;
 
-
   /* Now `shift' the result of the reduction.  Determine what state
      that goes to, based on the state we popped back to and the rule
      number reduced by.  */
@@ -2005,7 +2088,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse look-ahead token after an
+      /* If just tried and failed to reuse lookahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -2022,7 +2105,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse look-ahead token after shifting the error
+  /* Else will try to reuse lookahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -2079,9 +2162,6 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   *++yyvsp = yylval;
 
 
@@ -2106,7 +2186,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#ifndef yyoverflow
+#if !defined(yyoverflow) || YYERROR_VERBOSE
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -2117,7 +2197,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEOF && yychar != YYEMPTY)
+  if (yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -2143,6 +2223,8 @@ yyreturn:
 }
 
 
+
+/* Line 1675 of yacc.c  */
 #line 552 "../xml/XPathGrammar.y"
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
index cabe35a777..5a974bb910 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton interface for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton interface for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -59,33 +59,16 @@
      XPATH_ERROR = 275
    };
 #endif
-/* Tokens.  */
-#define MULOP 258
-#define RELOP 259
-#define EQOP 260
-#define MINUS 261
-#define PLUS 262
-#define AND 263
-#define OR 264
-#define AXISNAME 265
-#define NODETYPE 266
-#define PI 267
-#define FUNCTIONNAME 268
-#define LITERAL 269
-#define VARIABLEREFERENCE 270
-#define NUMBER 271
-#define DOTDOT 272
-#define SLASHSLASH 273
-#define NAMETEST 274
-#define XPATH_ERROR 275
-
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 56 "../xml/XPathGrammar.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 56 "../xml/XPathGrammar.y"
+
     Step::Axis axis;
     Step::NodeTest* nodeTest;
     NumericOp::Opcode numop;
@@ -96,14 +79,17 @@ typedef union YYSTYPE
     Vector<Expression*>* argList;
     Step* step;
     LocationPath* locationPath;
-}
-/* Line 1489 of yacc.c.  */
-#line 102 "XPathGrammar.tab.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 87 "WebCore/tmp/../generated/XPathGrammar.tab.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
 
+
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardList.h b/src/3rdparty/webkit/WebCore/history/BackForwardList.h
index 6b1db3eff9..a99d387c85 100644
--- a/src/3rdparty/webkit/WebCore/history/BackForwardList.h
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardList.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,10 +41,31 @@ class Page;
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 typedef HashSet<RefPtr<HistoryItem> > HistoryItemHashSet;
 
+#if PLATFORM(CHROMIUM)
+// In the Chromium port, the back/forward list is managed externally.
+// See BackForwardListChromium.cpp
+class BackForwardListClient {
+public:
+    virtual ~BackForwardListClient() {}
+    virtual void addItem(PassRefPtr<HistoryItem>) = 0;
+    virtual void goToItem(HistoryItem*) = 0;
+    virtual HistoryItem* currentItem() = 0;
+    virtual HistoryItem* itemAtIndex(int) = 0;
+    virtual int backListCount() = 0;
+    virtual int forwardListCount() = 0;
+    virtual void close() = 0;
+};
+#endif
+
 class BackForwardList : public RefCounted<BackForwardList> {
 public: 
     static PassRefPtr<BackForwardList> create(Page* page) { return adoptRef(new BackForwardList(page)); }
     ~BackForwardList();
+
+#if PLATFORM(CHROMIUM)
+    // Must be called before any other methods. 
+    void setClient(BackForwardListClient* client) { m_client = client; }
+#endif
     
     Page* page() { return m_page; }
     
@@ -82,14 +104,18 @@ private:
     BackForwardList(Page*);
 
     Page* m_page;
+#if PLATFORM(CHROMIUM) 
+    BackForwardListClient* m_client;
+#else
     HistoryItemVector m_entries;
     HistoryItemHashSet m_entryHash;
     unsigned m_current;
+#endif
     unsigned m_capacity;
     bool m_closed;
     bool m_enabled;
-}; //class BackForwardList
+};
     
-}; //namespace WebCore
+} //namespace WebCore
 
-#endif //BACKFORWARDLIST_H
+#endif
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp b/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp
new file mode 100644
index 0000000000..34f294ca84
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "BackForwardList.h"
+
+#include "HistoryItem.h"
+#include "Logging.h"
+
+namespace WebCore {
+
+static const unsigned DefaultCapacity = 100;
+static const unsigned NoCurrentItemIndex = UINT_MAX;
+
+BackForwardList::BackForwardList(Page* page)
+    : m_page(page)
+    , m_client(0)
+    , m_capacity(DefaultCapacity)
+    , m_closed(true)
+    , m_enabled(true)
+{
+}
+
+BackForwardList::~BackForwardList()
+{
+    ASSERT(m_closed);
+}
+
+void BackForwardList::addItem(PassRefPtr<HistoryItem> prpItem)
+{
+    ASSERT(prpItem);
+    if (m_capacity == 0 || !m_enabled)
+        return;
+ 
+    m_client->addItem(prpItem);
+}
+
+void BackForwardList::goToItem(HistoryItem* item)
+{
+    m_client->goToItem(item);
+}
+
+HistoryItem* BackForwardList::backItem()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+HistoryItem* BackForwardList::forwardItem()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+HistoryItem* BackForwardList::currentItem()
+{
+    return m_client->currentItem();
+}
+
+int BackForwardList::capacity()
+{
+    return m_capacity;
+}
+
+void BackForwardList::setCapacity(int size)
+{
+    m_capacity = size;
+}
+
+bool BackForwardList::enabled()
+{
+    return m_enabled;
+}
+
+void BackForwardList::setEnabled(bool enabled)
+{
+    m_enabled = enabled;
+    if (!enabled) {
+        int capacity = m_capacity;
+        setCapacity(0);
+        setCapacity(capacity);
+    }
+}
+
+int BackForwardList::backListCount()
+{
+    return m_client->backListCount();
+}
+
+int BackForwardList::forwardListCount()
+{
+    return m_client->forwardListCount();
+}
+
+HistoryItem* BackForwardList::itemAtIndex(int index)
+{
+    return m_client->itemAtIndex(index);
+}
+
+HistoryItemVector& BackForwardList::entries()
+{
+    static HistoryItemVector noEntries;
+    return noEntries;
+}
+
+void BackForwardList::close()
+{
+    if (m_client)
+        m_client->close();
+    m_page = 0;
+    m_closed = true;
+}
+
+bool BackForwardList::closed()
+{
+    return m_closed;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
new file mode 100644
index 0000000000..9a43b9dd6b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#include "config.h"
+#include "CachedPage.h"
+
+#include "CachedFramePlatformData.h"
+#include "CString.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoaderClient.h"
+#include "FrameView.h"
+#include "Logging.h"
+#include <wtf/RefCountedLeakCounter.h>
+
+#if ENABLE(SVG)
+#include "SVGDocumentExtensions.h"
+#endif
+
+namespace WebCore {
+
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter& cachedFrameCounter()
+{
+    DEFINE_STATIC_LOCAL(WTF::RefCountedLeakCounter, counter, ("CachedFrame"));
+    return counter;
+}
+#endif
+
+CachedFrame::CachedFrame(Frame* frame)
+    : m_document(frame->document())
+    , m_documentLoader(frame->loader()->documentLoader())
+    , m_view(frame->view())
+    , m_mousePressNode(frame->eventHandler()->mousePressNode())
+    , m_url(frame->loader()->url())
+{
+#ifndef NDEBUG
+    cachedFrameCounter().increment();
+#endif
+    ASSERT(m_document);
+    ASSERT(m_documentLoader);
+    ASSERT(m_view);
+
+    // Active DOM objects must be suspended before we cached the frame script data
+    m_document->suspendActiveDOMObjects();
+    m_cachedFrameScriptData.set(new ScriptCachedFrameData(frame));
+    
+    m_document->documentWillBecomeInactive(); 
+    frame->clearTimers();
+    m_document->setInPageCache(true);
+    
+    frame->loader()->client()->savePlatformDataToCachedFrame(this);
+
+    for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        m_childFrames.append(CachedFrame::create(child));
+
+    LOG(PageCache, "Finished creating CachedFrame with url %s and documentloader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
+}
+
+CachedFrame::~CachedFrame()
+{
+#ifndef NDEBUG
+    cachedFrameCounter().decrement();
+#endif
+
+    clear();
+}
+
+void CachedFrame::restore()
+{
+    ASSERT(m_document->view() == m_view);
+    
+    Frame* frame = m_view->frame();
+    m_cachedFrameScriptData->restore(frame);
+
+#if ENABLE(SVG)
+    if (m_document->svgExtensions())
+        m_document->accessSVGExtensions()->unpauseAnimations();
+#endif
+
+    frame->animation()->resumeAnimations(m_document.get());
+    frame->eventHandler()->setMousePressNode(mousePressNode());
+    m_document->resumeActiveDOMObjects();
+
+    // It is necessary to update any platform script objects after restoring the
+    // cached page.
+    frame->script()->updatePlatformScriptObjects();
+}
+
+void CachedFrame::clear()
+{
+    if (!m_document)
+        return;
+
+    if (m_cachedFramePlatformData)
+        m_cachedFramePlatformData->clear();
+        
+    ASSERT(m_view);
+    ASSERT(m_document->frame() == m_view->frame());
+
+    if (m_document->inPageCache()) {
+        Frame::clearTimers(m_view.get(), m_document.get());
+
+        // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
+        // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
+        m_document->removeAllEventListeners();
+
+        m_document->setInPageCache(false);
+        // FIXME: We don't call willRemove here. Why is that OK?
+        m_document->detach();
+        m_view->clearFrame();
+    }
+
+    ASSERT(!m_document->inPageCache());
+
+    m_document = 0;
+    m_view = 0;
+    m_mousePressNode = 0;
+    m_url = KURL();
+
+    m_cachedFramePlatformData.clear();
+
+    m_cachedFrameScriptData.clear();
+}
+
+void CachedFrame::setCachedFramePlatformData(CachedFramePlatformData* data)
+{
+    m_cachedFramePlatformData.set(data);
+}
+
+CachedFramePlatformData* CachedFrame::cachedFramePlatformData()
+{
+    return m_cachedFramePlatformData.get();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.h b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
new file mode 100644
index 0000000000..83c3c3c60c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef CachedFrame_h
+#define CachedFrame_h
+
+#include "KURL.h"
+#include "ScriptCachedFrameData.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+    
+    class CachedFrame;
+    class CachedFramePlatformData;
+    class DOMWindow;
+    class Document;
+    class DocumentLoader;
+    class Frame;
+    class FrameView;
+    class Node;
+
+typedef Vector<RefPtr<CachedFrame> > CachedFrameVector;
+
+class CachedFrame : public RefCounted<CachedFrame> {
+public:
+    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
+    ~CachedFrame();
+
+    void restore();
+    void clear();
+
+    Document* document() const { return m_document.get(); }
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    FrameView* view() const { return m_view.get(); }
+    Node* mousePressNode() const { return m_mousePressNode.get(); }
+    const KURL& url() const { return m_url; }
+    DOMWindow* domWindow() const { return m_cachedFrameScriptData->domWindow(); }
+
+    void setCachedFramePlatformData(CachedFramePlatformData*);
+    CachedFramePlatformData* cachedFramePlatformData();
+
+private:
+    CachedFrame(Frame*);
+
+    RefPtr<Document> m_document;
+    RefPtr<DocumentLoader> m_documentLoader;
+    RefPtr<FrameView> m_view;
+    RefPtr<Node> m_mousePressNode;
+    KURL m_url;
+    OwnPtr<ScriptCachedFrameData> m_cachedFrameScriptData;
+    OwnPtr<CachedFramePlatformData> m_cachedFramePlatformData;
+    
+    CachedFrameVector m_childFrames;
+};
+
+} // namespace WebCore
+
+#endif // CachedFrame_h
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPagePlatformData.h b/src/3rdparty/webkit/WebCore/history/CachedFramePlatformData.h
index c623f2ffe8..01da8e5a67 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPagePlatformData.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedFramePlatformData.h
@@ -25,8 +25,8 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-#ifndef CachedPagePlatformData_h
-#define CachedPagePlatformData_h
+#ifndef CachedFramePlatformData_h
+#define CachedFramePlatformData_h
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ namespace WebCore {
 // goes into the Back/Forward page cache, and perform some action with that data when the page comes out.  
 // Each platform should subclass this class as neccessary
 
-class CachedPagePlatformData {
+class CachedFramePlatformData {
 public:
-    virtual ~CachedPagePlatformData() { }
+    virtual ~CachedFramePlatformData() { }
     virtual void clear() { }
 };
 
 } // namespace WebCore
 
-#endif // CachedPagePlatformData_h
+#endif // CachedFramePlatformData_h
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
index 2690f76776..8898ce2543 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
@@ -26,26 +26,13 @@
 #include "config.h"
 #include "CachedPage.h"
 
-#include "AnimationController.h"
-#include "CachedPagePlatformData.h"
-#include "Document.h"
-#include "DocumentLoader.h"
-#include "Element.h"
-#include "EventHandler.h"
 #include "FocusController.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "FrameView.h"
-#include "Logging.h"
 #include "Page.h"
-#include "PageGroup.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/RefCountedLeakCounter.h>
 
-#if ENABLE(SVG)
-#include "SVGDocumentExtensions.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -60,23 +47,12 @@ PassRefPtr<CachedPage> CachedPage::create(Page* page)
 }
 
 CachedPage::CachedPage(Page* page)
-    : m_timeStamp(0)
-    , m_document(page->mainFrame()->document())
-    , m_view(page->mainFrame()->view())
-    , m_mousePressNode(page->mainFrame()->eventHandler()->mousePressNode())
-    , m_URL(page->mainFrame()->loader()->url())
-    , m_cachedPageScriptData(page)
+    : m_timeStamp(currentTime())
+    , m_cachedMainFrame(CachedFrame::create(page->mainFrame()))
 {
 #ifndef NDEBUG
     cachedPageCounter.increment();
 #endif
-    
-    m_document->documentWillBecomeInactive(); 
-    
-    Frame* mainFrame = page->mainFrame();
-    mainFrame->clearTimers();
-
-    m_document->setInPageCache(true);
 }
 
 CachedPage::~CachedPage()
@@ -88,28 +64,11 @@ CachedPage::~CachedPage()
     clear();
 }
 
-DOMWindow* CachedPage::domWindow() const
-{
-    return m_cachedPageScriptData.domWindow();
-}
-
 void CachedPage::restore(Page* page)
 {
-    ASSERT(m_document->view() == m_view);
-
-    Frame* mainFrame = page->mainFrame();
-
-    m_cachedPageScriptData.restore(page);
-
-#if ENABLE(SVG)
-    if (m_document && m_document->svgExtensions())
-        m_document->accessSVGExtensions()->unpauseAnimations();
-#endif
-
-    mainFrame->animation()->resumeAnimations(m_document.get());
+    ASSERT(page && page->mainFrame() && page->mainFrame() == m_cachedMainFrame->view()->frame());
+    m_cachedMainFrame->restore();
 
-    mainFrame->eventHandler()->setMousePressNode(mousePressNode());
-        
     // Restore the focus appearance for the focused element.
     // FIXME: Right now we don't support pages w/ frames in the b/f cache.  This may need to be tweaked when we add support for that.
     Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
@@ -121,71 +80,7 @@ void CachedPage::restore(Page* page)
 
 void CachedPage::clear()
 {
-    if (!m_document)
-        return;
-
-    if (m_cachedPagePlatformData)
-        m_cachedPagePlatformData->clear();
-        
-    ASSERT(m_view);
-    ASSERT(m_document->frame() == m_view->frame());
-
-    if (m_document->inPageCache()) {
-        Frame::clearTimers(m_view.get(), m_document.get());
-
-        m_document->setInPageCache(false);
-        // FIXME: We don't call willRemove here. Why is that OK?
-        m_document->detach();
-        m_document->removeAllEventListenersFromAllNodes();
-
-        m_view->clearFrame();
-    }
-
-    ASSERT(!m_document->inPageCache());
-
-    m_document = 0;
-    m_view = 0;
-    m_mousePressNode = 0;
-    m_URL = KURL();
-
-    m_cachedPagePlatformData.clear();
-
-    m_cachedPageScriptData.clear();
-}
-
-void CachedPage::setDocumentLoader(PassRefPtr<DocumentLoader> loader)
-{
-    m_documentLoader = loader;
-}
-
-DocumentLoader* CachedPage::documentLoader()
-{
-    return m_documentLoader.get();
-}
-
-void CachedPage::setTimeStamp(double timeStamp)
-{
-    m_timeStamp = timeStamp;
-}
-
-void CachedPage::setTimeStampToNow()
-{
-    m_timeStamp = currentTime();
-}
-
-double CachedPage::timeStamp() const
-{
-    return m_timeStamp;
-}
-
-void CachedPage::setCachedPagePlatformData(CachedPagePlatformData* data)
-{
-    m_cachedPagePlatformData.set(data);
-}
-
-CachedPagePlatformData* CachedPage::cachedPagePlatformData()
-{
-    return m_cachedPagePlatformData.get();
+    m_cachedMainFrame.clear();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.h b/src/3rdparty/webkit/WebCore/history/CachedPage.h
index 7602e20582..430cf3a94d 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.h
@@ -26,18 +26,16 @@
 #ifndef CachedPage_h
 #define CachedPage_h
 
-#include "KURL.h"
-#include <wtf/OwnPtr.h>
-#include "ScriptCachedPageData.h"
+#include "CachedFrame.h"
 
 namespace WebCore {
     
-    class CachedPagePlatformData;
+    class CachedFramePlatformData;
     class DOMWindow;
     class Document;
     class DocumentLoader;
     class FrameView;
-    class JSDOMWindow;
+    class KURL;
     class Node;
     class Page;
 
@@ -45,37 +43,25 @@ class CachedPage : public RefCounted<CachedPage> {
 public:
     static PassRefPtr<CachedPage> create(Page*);
     ~CachedPage();
-    
-    void clear();
-
-    Document* document() const { return m_document.get(); }
-    FrameView* view() const { return m_view.get(); }
-    Node* mousePressNode() const { return m_mousePressNode.get(); }
-    const KURL& url() const { return m_URL; }
-    DOMWindow* domWindow() const;
 
     void restore(Page*);
-        
-    void setTimeStamp(double);
-    void setTimeStampToNow();
-    double timeStamp() const;
-    void setDocumentLoader(PassRefPtr<DocumentLoader>);
-    DocumentLoader* documentLoader();
+    void clear();
 
-    void setCachedPagePlatformData(CachedPagePlatformData*);
-    CachedPagePlatformData* cachedPagePlatformData();
+    Document* document() const { return m_cachedMainFrame->document(); }
+    DocumentLoader* documentLoader() const { return m_cachedMainFrame->documentLoader(); }
+    FrameView* mainFrameView() const { return m_cachedMainFrame->view(); }
+    const KURL& url() const { return m_cachedMainFrame->url(); }
+    DOMWindow* domWindow() const { return m_cachedMainFrame->domWindow(); }
+
+    double timeStamp() const { return m_timeStamp; }
+    
+    CachedFrame* cachedMainFrame() { return m_cachedMainFrame.get(); }
 
 private:
     CachedPage(Page*);
-    RefPtr<DocumentLoader> m_documentLoader;
-    double m_timeStamp;
 
-    RefPtr<Document> m_document;
-    RefPtr<FrameView> m_view;
-    RefPtr<Node> m_mousePressNode;
-    KURL m_URL;
-    ScriptCachedPageData m_cachedPageScriptData;
-    OwnPtr<CachedPagePlatformData> m_cachedPagePlatformData;
+    double m_timeStamp;
+    RefPtr<CachedFrame> m_cachedMainFrame;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
index 10efd4dd33..493a39bee6 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
@@ -44,8 +44,8 @@ void (*notifyHistoryItemChanged)() = defaultNotifyHistoryItemChanged;
 
 HistoryItem::HistoryItem()
     : m_lastVisitedTime(0)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
 {
@@ -56,8 +56,8 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, double ti
     , m_originalURLString(urlString)
     , m_title(title)
     , m_lastVisitedTime(time)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
 {    
@@ -70,11 +70,11 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, const Str
     , m_title(title)
     , m_displayTitle(alternateTitle)
     , m_lastVisitedTime(time)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
-{    
+{
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
 
@@ -85,8 +85,8 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
     , m_parent(parent)
     , m_title(title)
     , m_lastVisitedTime(0)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
 {    
@@ -95,7 +95,7 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
 
 HistoryItem::~HistoryItem()
 {
-    ASSERT(!m_isInPageCache);
+    ASSERT(!m_cachedPage);
     iconDatabase()->releaseIconForPageURL(m_urlString);
 }
 
@@ -103,27 +103,33 @@ inline HistoryItem::HistoryItem(const HistoryItem& item)
     : RefCounted<HistoryItem>()
     , m_urlString(item.m_urlString)
     , m_originalURLString(item.m_originalURLString)
+    , m_referrer(item.m_referrer)
     , m_target(item.m_target)
     , m_parent(item.m_parent)
     , m_title(item.m_title)
     , m_displayTitle(item.m_displayTitle)
     , m_lastVisitedTime(item.m_lastVisitedTime)
+    , m_lastVisitWasHTTPNonGet(item.m_lastVisitWasHTTPNonGet)
     , m_scrollPoint(item.m_scrollPoint)
     , m_lastVisitWasFailure(item.m_lastVisitWasFailure)
-    , m_isInPageCache(item.m_isInPageCache)
     , m_isTargetItem(item.m_isTargetItem)
     , m_visitCount(item.m_visitCount)
+    , m_dailyVisitCounts(item.m_dailyVisitCounts)
+    , m_weeklyVisitCounts(item.m_weeklyVisitCounts)
     , m_formContentType(item.m_formContentType)
-    , m_formReferrer(item.m_formReferrer)
-    , m_rssFeedReferrer(item.m_rssFeedReferrer)
 {
+    ASSERT(!item.m_cachedPage);
+
     if (item.m_formData)
         m_formData = item.m_formData->copy();
         
-    unsigned size = item.m_subItems.size();
-    m_subItems.reserveCapacity(size);
+    unsigned size = item.m_children.size();
+    m_children.reserveInitialCapacity(size);
     for (unsigned i = 0; i < size; ++i)
-        m_subItems.append(item.m_subItems[i]->copy());
+        m_children.uncheckedAppend(item.m_children[i]->copy());
+
+    if (item.m_redirectURLs)
+        m_redirectURLs.set(new Vector<String>(*item.m_redirectURLs));
 }
 
 PassRefPtr<HistoryItem> HistoryItem::copy() const
@@ -174,6 +180,11 @@ KURL HistoryItem::originalURL() const
     return KURL(m_originalURLString);
 }
 
+const String& HistoryItem::referrer() const
+{
+    return m_referrer;
+}
+
 const String& HistoryItem::target() const
 {
     return m_target;
@@ -214,6 +225,12 @@ void HistoryItem::setOriginalURLString(const String& urlString)
     notifyHistoryItemChanged();
 }
 
+void HistoryItem::setReferrer(const String& referrer)
+{
+    m_referrer = referrer;
+    notifyHistoryItemChanged();
+}
+
 void HistoryItem::setTitle(const String& title)
 {
     m_title = title;
@@ -231,19 +248,67 @@ void HistoryItem::setParent(const String& parent)
     m_parent = parent;
 }
 
-void HistoryItem::setLastVisitedTime(double time)
+static inline int timeToDay(double time)
+{
+    static const double secondsPerDay = 60 * 60 * 24;
+    return static_cast<int>(ceil(time / secondsPerDay));
+}
+
+void HistoryItem::padDailyCountsForNewVisit(double time)
+{
+    if (m_dailyVisitCounts.isEmpty())
+        m_dailyVisitCounts.prepend(m_visitCount);
+
+    int daysElapsed = timeToDay(time) - timeToDay(m_lastVisitedTime);
+
+    if (daysElapsed < 0)
+      daysElapsed = 0;
+
+    Vector<int> padding;
+    padding.fill(0, daysElapsed);
+    m_dailyVisitCounts.prepend(padding);
+}
+
+static const size_t daysPerWeek = 7;
+static const size_t maxDailyCounts = 2 * daysPerWeek - 1;
+static const size_t maxWeeklyCounts = 5;
+
+void HistoryItem::collapseDailyVisitsToWeekly()
 {
-    if (m_lastVisitedTime != time) {
-        m_lastVisitedTime = time;
-        m_visitCount++;
+    while (m_dailyVisitCounts.size() > maxDailyCounts) {
+        int oldestWeekTotal = 0;
+        for (size_t i = 0; i < daysPerWeek; i++)
+            oldestWeekTotal += m_dailyVisitCounts[m_dailyVisitCounts.size() - daysPerWeek + i];
+        m_dailyVisitCounts.shrink(m_dailyVisitCounts.size() - daysPerWeek);
+        m_weeklyVisitCounts.prepend(oldestWeekTotal);
     }
+
+    if (m_weeklyVisitCounts.size() > maxWeeklyCounts)
+        m_weeklyVisitCounts.shrink(maxWeeklyCounts);
 }
 
-void HistoryItem::visited(const String& title, double time)
+void HistoryItem::recordVisitAtTime(double time)
 {
-    m_title = title;
+    padDailyCountsForNewVisit(time);
+
     m_lastVisitedTime = time;
     m_visitCount++;
+
+    m_dailyVisitCounts[0]++;
+
+    collapseDailyVisitsToWeekly();
+}
+
+void HistoryItem::setLastVisitedTime(double time)
+{
+    if (m_lastVisitedTime != time)
+        recordVisitAtTime(time);
+}
+
+void HistoryItem::visited(const String& title, double time)
+{
+    m_title = title;
+    recordVisitAtTime(time);
 }
 
 int HistoryItem::visitCount() const
@@ -251,11 +316,25 @@ int HistoryItem::visitCount() const
     return m_visitCount;
 }
 
+void HistoryItem::recordInitialVisit()
+{
+    ASSERT(!m_visitCount);
+    recordVisitAtTime(m_lastVisitedTime);
+}
+
 void HistoryItem::setVisitCount(int count)
 {
     m_visitCount = count;
 }
 
+void HistoryItem::adoptVisitCounts(Vector<int>& dailyCounts, Vector<int>& weeklyCounts)
+{
+  m_dailyVisitCounts.clear();
+  m_dailyVisitCounts.swap(dailyCounts);
+  m_weeklyVisitCounts.clear();
+  m_weeklyVisitCounts.swap(weeklyCounts);
+}
+
 const IntPoint& HistoryItem::scrollPoint() const
 {
     return m_scrollPoint;
@@ -299,52 +378,61 @@ void HistoryItem::setIsTargetItem(bool flag)
 
 void HistoryItem::addChildItem(PassRefPtr<HistoryItem> child)
 {
-    m_subItems.append(child);
+    ASSERT(!childItemWithTarget(child->target()));
+    m_children.append(child);
+}
+
+void HistoryItem::setChildItem(PassRefPtr<HistoryItem> child)
+{
+    ASSERT(!child->isTargetItem());
+    unsigned size = m_children.size();
+    for (unsigned i = 0; i < size; ++i)  {
+        if (m_children[i]->target() == child->target()) {
+            child->setIsTargetItem(m_children[i]->isTargetItem());
+            m_children[i] = child;
+            return;
+        }
+    }
+    m_children.append(child);
 }
 
-HistoryItem* HistoryItem::childItemWithName(const String& name) const
+HistoryItem* HistoryItem::childItemWithTarget(const String& target) const
 {
-    unsigned size = m_subItems.size();
-    for (unsigned i = 0; i < size; ++i) 
-        if (m_subItems[i]->target() == name)
-            return m_subItems[i].get();
+    unsigned size = m_children.size();
+    for (unsigned i = 0; i < size; ++i) {
+        if (m_children[i]->target() == target)
+            return m_children[i].get();
+    }
     return 0;
 }
 
-// <rdar://problem/4895849> HistoryItem::recurseToFindTargetItem() should be replace with a non-recursive method
-HistoryItem* HistoryItem::recurseToFindTargetItem()
+// <rdar://problem/4895849> HistoryItem::findTargetItem() should be replaced with a non-recursive method.
+HistoryItem* HistoryItem::findTargetItem()
 {
     if (m_isTargetItem)
         return this;
-    if (!m_subItems.size())
-        return 0;
-    
-    HistoryItem* match;
-    unsigned size = m_subItems.size();
+    unsigned size = m_children.size();
     for (unsigned i = 0; i < size; ++i) {
-        match = m_subItems[i]->recurseToFindTargetItem();
-        if (match)
+        if (HistoryItem* match = m_children[i]->targetItem())
             return match;
     }
-    
     return 0;
 }
 
 HistoryItem* HistoryItem::targetItem()
 {
-    if (!m_subItems.size())
-        return this;
-    return recurseToFindTargetItem();
+    HistoryItem* foundItem = findTargetItem();
+    return foundItem ? foundItem : this;
 }
 
 const HistoryItemVector& HistoryItem::children() const
 {
-    return m_subItems;
+    return m_children;
 }
 
 bool HistoryItem::hasChildren() const
 {
-    return m_subItems.size();
+    return !m_children.isEmpty();
 }
 
 String HistoryItem::formContentType() const
@@ -352,33 +440,18 @@ String HistoryItem::formContentType() const
     return m_formContentType;
 }
 
-String HistoryItem::formReferrer() const
-{
-    return m_formReferrer;
-}
-
-String HistoryItem::rssFeedReferrer() const
-{
-    return m_rssFeedReferrer;
-}
-
-void HistoryItem::setRSSFeedReferrer(const String& referrer)
-{
-    m_rssFeedReferrer = referrer;
-}
-
 void HistoryItem::setFormInfoFromRequest(const ResourceRequest& request)
 {
+    m_referrer = request.httpReferrer();
+    
     if (equalIgnoringCase(request.httpMethod(), "POST")) {
         // FIXME: Eventually we have to make this smart enough to handle the case where
         // we have a stream for the body to handle the "data interspersed with files" feature.
         m_formData = request.httpBody();
         m_formContentType = request.httpContentType();
-        m_formReferrer = request.httpReferrer();
     } else {
         m_formData = 0;
         m_formContentType = String();
-        m_formReferrer = String();
     }
 }
 
@@ -395,11 +468,35 @@ bool HistoryItem::isCurrentDocument(Document* doc) const
 
 void HistoryItem::mergeAutoCompleteHints(HistoryItem* otherItem)
 {
+    // FIXME: this is broken - we should be merging the daily counts
+    // somehow.  but this is to support API that's not really used in
+    // practice so leave it broken for now.
     ASSERT(otherItem);
     if (otherItem != this)
         m_visitCount += otherItem->m_visitCount;
 }
 
+void HistoryItem::addRedirectURL(const String& url)
+{
+    if (!m_redirectURLs)
+        m_redirectURLs.set(new Vector<String>);
+
+    // Our API allows us to store all the URLs in the redirect chain, but for
+    // now we only have a use for the final URL.
+    (*m_redirectURLs).resize(1);
+    (*m_redirectURLs)[0] = url;
+}
+
+Vector<String>* HistoryItem::redirectURLs() const
+{
+    return m_redirectURLs.get();
+}
+
+void HistoryItem::setRedirectURLs(PassOwnPtr<Vector<String> > redirectURLs)
+{
+    m_redirectURLs = redirectURLs;
+}
+
 #ifndef NDEBUG
 
 int HistoryItem::showTree() const
@@ -412,12 +509,13 @@ int HistoryItem::showTreeWithIndent(unsigned indentLevel) const
     Vector<char> prefix;
     for (unsigned i = 0; i < indentLevel; ++i)
         prefix.append("  ", 2);
+    prefix.append("\0", 1);
 
     fprintf(stderr, "%s+-%s (%p)\n", prefix.data(), m_urlString.utf8().data(), this);
     
     int totalSubItems = 0;
-    for (unsigned i = 0; i < m_subItems.size(); ++i)
-        totalSubItems += m_subItems[i]->showTreeWithIndent(indentLevel + 1);
+    for (unsigned i = 0; i < m_children.size(); ++i)
+        totalSubItems += m_children[i]->showTreeWithIndent(indentLevel + 1);
     return totalSubItems + 1;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.h b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
index 7d3caa7311..c4f0b49a0d 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.h
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
@@ -28,6 +28,8 @@
 
 #include "IntPoint.h"
 #include "PlatformString.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #import <wtf/RetainPtr.h>
@@ -46,7 +48,7 @@ class FormData;
 class HistoryItem;
 class Image;
 class KURL;
-class ResourceRequest;
+struct ResourceRequest;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 
@@ -78,8 +80,7 @@ public:
     const String& urlString() const;
     const String& title() const;
     
-    void setInPageCache(bool inPageCache) { m_isInPageCache = inPageCache; }
-    bool isInPageCache() const { return m_isInPageCache; }
+    bool isInPageCache() const { return m_cachedPage; }
     
     double lastVisitedTime() const;
     
@@ -91,16 +92,16 @@ public:
     const String& parent() const;
     KURL url() const;
     KURL originalURL() const;
+    const String& referrer() const;
     const String& target() const;
     bool isTargetItem() const;
     
     FormData* formData();
     String formContentType() const;
-    String formReferrer() const;
-    String rssFeedReferrer() const;
     
     int visitCount() const;
     bool lastVisitWasFailure() const { return m_lastVisitWasFailure; }
+    bool lastVisitWasHTTPNonGet() const { return m_lastVisitWasHTTPNonGet; }
 
     void mergeAutoCompleteHints(HistoryItem* otherItem);
     
@@ -114,6 +115,7 @@ public:
     void setURL(const KURL&);
     void setURLString(const String&);
     void setOriginalURLString(const String&);
+    void setReferrer(const String&);
     void setTarget(const String&);
     void setParent(const String&);
     void setTitle(const String&);
@@ -121,14 +123,16 @@ public:
     
     void setFormInfoFromRequest(const ResourceRequest&);
 
-    void setRSSFeedReferrer(const String&);
+    void recordInitialVisit();
+
     void setVisitCount(int);
     void setLastVisitWasFailure(bool wasFailure) { m_lastVisitWasFailure = wasFailure; }
+    void setLastVisitWasHTTPNonGet(bool wasNotGet) { m_lastVisitWasHTTPNonGet = wasNotGet; }
 
     void addChildItem(PassRefPtr<HistoryItem>);
-    HistoryItem* childItemWithName(const String&) const;
+    void setChildItem(PassRefPtr<HistoryItem>);
+    HistoryItem* childItemWithTarget(const String&) const;
     HistoryItem* targetItem();
-    HistoryItem* recurseToFindTargetItem();
     const HistoryItemVector& children() const;
     bool hasChildren() const;
 
@@ -136,7 +140,11 @@ public:
     // in GlobalHistory. The WebKit api for this is to use -[WebHistory setLastVisitedTimeInterval:forItem:] instead.
     void setLastVisitedTime(double);
     void visited(const String& title, double time);
-    
+
+    void addRedirectURL(const String&);
+    Vector<String>* redirectURLs() const;
+    void setRedirectURLs(PassOwnPtr<Vector<String> >);
+
     bool isCurrentDocument(Document*) const;
     
 #if PLATFORM(MAC)
@@ -159,40 +167,51 @@ public:
     int showTreeWithIndent(unsigned indentLevel) const;
 #endif
 
+    void adoptVisitCounts(Vector<int>& dailyCounts, Vector<int>& weeklyCounts);
+    const Vector<int>& dailyVisitCounts() { return m_dailyVisitCounts; }
+    const Vector<int>& weeklyVisitCounts() { return m_weeklyVisitCounts; }
+
 private:
     HistoryItem();
     HistoryItem(const String& urlString, const String& title, double lastVisited);
     HistoryItem(const String& urlString, const String& title, const String& alternateTitle, double lastVisited);
-    HistoryItem(const KURL& url, const String& target, const String& parent, const String& title);
+    HistoryItem(const KURL& url, const String& frameName, const String& parent, const String& title);
 
     HistoryItem(const HistoryItem&);
 
+    void padDailyCountsForNewVisit(double time);
+    void collapseDailyVisitsToWeekly();
+    void recordVisitAtTime(double);
+
+    HistoryItem* findTargetItem();
+
     String m_urlString;
     String m_originalURLString;
+    String m_referrer;
     String m_target;
     String m_parent;
     String m_title;
     String m_displayTitle;
     
     double m_lastVisitedTime;
+    bool m_lastVisitWasHTTPNonGet;
 
     IntPoint m_scrollPoint;
     Vector<String> m_documentState;
     
-    HistoryItemVector m_subItems;
+    HistoryItemVector m_children;
     
     bool m_lastVisitWasFailure;
-    bool m_isInPageCache;
     bool m_isTargetItem;
     int m_visitCount;
-    
+    Vector<int> m_dailyVisitCounts;
+    Vector<int> m_weeklyVisitCounts;
+
+    OwnPtr<Vector<String> > m_redirectURLs;
+
     // info used to repost form data
     RefPtr<FormData> m_formData;
     String m_formContentType;
-    String m_formReferrer;
-    
-    // info used to support RSS feeds
-    String m_rssFeedReferrer;
 
     // PageCache controls these fields.
     HistoryItem* m_next;
diff --git a/src/3rdparty/webkit/WebCore/history/PageCache.cpp b/src/3rdparty/webkit/WebCore/history/PageCache.cpp
index dc24fd2e46..7c25701c94 100644
--- a/src/3rdparty/webkit/WebCore/history/PageCache.cpp
+++ b/src/3rdparty/webkit/WebCore/history/PageCache.cpp
@@ -32,6 +32,7 @@
 #include "HistoryItem.h"
 #include "Logging.h"
 #include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 using namespace std;
 
diff --git a/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp
new file mode 100644
index 0000000000..fd28237bde
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HistoryPropertyList.h"
+
+#include "HistoryItem.h"
+#include <wtf/StringExtras.h>
+
+namespace WebCore {
+
+static const int currentFileVersion = 1;
+
+HistoryPropertyListWriter::HistoryPropertyListWriter()
+    : m_dailyVisitCountsKey("D")
+    , m_displayTitleKey("displayTitle")
+    , m_lastVisitWasFailureKey("lastVisitWasFailure")
+    , m_lastVisitWasHTTPNonGetKey("lastVisitWasHTTPNonGet")
+    , m_lastVisitedDateKey("lastVisitedDate")
+    , m_redirectURLsKey("redirectURLs")
+    , m_titleKey("title")
+    , m_urlKey("")
+    , m_visitCountKey("visitCount")
+    , m_weeklyVisitCountsKey("W")
+    , m_buffer(0)
+{
+}
+
+UInt8* HistoryPropertyListWriter::buffer(size_t size)
+{
+    ASSERT(!m_buffer);
+    m_buffer = static_cast<UInt8*>(CFAllocatorAllocate(0, size, 0));
+    m_bufferSize = size;
+    return m_buffer;
+}
+
+RetainPtr<CFDataRef> HistoryPropertyListWriter::releaseData()
+{
+    UInt8* buffer = m_buffer;
+    if (!buffer)
+        return 0;
+    m_buffer = 0;
+    RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, buffer, m_bufferSize, 0));
+    if (!data) {
+        CFAllocatorDeallocate(0, buffer);
+        return 0;
+    }
+    return data;
+}
+
+void HistoryPropertyListWriter::writeObjects(BinaryPropertyListObjectStream& stream)
+{
+    size_t outerDictionaryStart = stream.writeDictionaryStart();
+
+    stream.writeString("WebHistoryFileVersion");
+    stream.writeString("WebHistoryDates");
+
+    stream.writeInteger(currentFileVersion);
+    size_t outerDateArrayStart = stream.writeArrayStart();
+    writeHistoryItems(stream);
+    stream.writeArrayEnd(outerDateArrayStart);
+
+    stream.writeDictionaryEnd(outerDictionaryStart);
+}
+
+void HistoryPropertyListWriter::writeHistoryItem(BinaryPropertyListObjectStream& stream, HistoryItem* item)
+{
+    size_t itemDictionaryStart = stream.writeDictionaryStart();
+
+    const String& title = item->title();
+    const String& displayTitle = item->alternateTitle();
+    double lastVisitedDate = item->lastVisitedTime();
+    int visitCount = item->visitCount();
+    Vector<String>* redirectURLs = item->redirectURLs();
+    const Vector<int>& dailyVisitCounts = item->dailyVisitCounts();
+    const Vector<int>& weeklyVisitCounts = item->weeklyVisitCounts();
+
+    // keys
+    stream.writeString(m_urlKey);
+    if (!title.isEmpty())
+        stream.writeString(m_titleKey);
+    if (!displayTitle.isEmpty())
+        stream.writeString(m_displayTitleKey);
+    if (lastVisitedDate)
+        stream.writeString(m_lastVisitedDateKey);
+    if (visitCount)
+        stream.writeString(m_visitCountKey);
+    if (item->lastVisitWasFailure())
+        stream.writeString(m_lastVisitWasFailureKey);
+    if (item->lastVisitWasHTTPNonGet())
+        stream.writeString(m_lastVisitWasHTTPNonGetKey);
+    if (redirectURLs)
+        stream.writeString(m_redirectURLsKey);
+    if (!dailyVisitCounts.isEmpty())
+        stream.writeString(m_dailyVisitCountsKey);
+    if (!weeklyVisitCounts.isEmpty())
+        stream.writeString(m_weeklyVisitCountsKey);
+
+    // values
+    stream.writeUniqueString(item->urlString());
+    if (!title.isEmpty())
+        stream.writeString(title);
+    if (!displayTitle.isEmpty())
+        stream.writeString(displayTitle);
+    if (lastVisitedDate) {
+        char buffer[32];
+        snprintf(buffer, sizeof(buffer), "%.1lf", lastVisitedDate);
+        stream.writeUniqueString(buffer);
+    }
+    if (visitCount)
+        stream.writeInteger(visitCount);
+    if (item->lastVisitWasFailure())
+        stream.writeBooleanTrue();
+    if (item->lastVisitWasHTTPNonGet()) {
+        ASSERT(item->urlString().startsWith("http:", false) || item->urlString().startsWith("https:", false));
+        stream.writeBooleanTrue();
+    }
+    if (redirectURLs) {
+        size_t redirectArrayStart = stream.writeArrayStart();
+        size_t size = redirectURLs->size();
+        ASSERT(size);
+        for (size_t i = 0; i < size; ++i)
+            stream.writeUniqueString(redirectURLs->at(i));
+        stream.writeArrayEnd(redirectArrayStart);
+    }
+    if (size_t size = dailyVisitCounts.size())
+        stream.writeIntegerArray(dailyVisitCounts.data(), size);
+    if (size_t size = weeklyVisitCounts.size())
+        stream.writeIntegerArray(weeklyVisitCounts.data(), size);
+
+    stream.writeDictionaryEnd(itemDictionaryStart);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/page/win/AccessibilityObjectWrapperWin.h b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.h
index 779443c809..fcb8c478a4 100644
--- a/src/3rdparty/webkit/WebCore/page/win/AccessibilityObjectWrapperWin.h
+++ b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,47 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#ifndef HistoryPropertyList_h
+#define HistoryPropertyList_h
 
-#ifndef AccessibilityObjectWrapperWin_h
-#define AccessibilityObjectWrapperWin_h
+#include "BinaryPropertyList.h"
+#include "PlatformString.h"
+#include <wtf/RetainPtr.h>
 
 namespace WebCore {
 
-    class AccessibilityObject;
- 
-    class AccessibilityObjectWrapper : public IUnknown {
-    public:
-        // IUnknown
-        virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject) = 0;        
-        virtual ULONG STDMETHODCALLTYPE AddRef(void) = 0;
-        virtual ULONG STDMETHODCALLTYPE Release(void) = 0;
+class HistoryItem;
 
-        virtual void detach() = 0;
-        bool attached() const { return m_object; }
-        AccessibilityObject* accessibilityObject() const { return m_object; }
+class HistoryPropertyListWriter : public BinaryPropertyListWriter {
+public:
+    RetainPtr<CFDataRef> releaseData();
 
-    protected:
-        AccessibilityObjectWrapper(AccessibilityObject* obj) : m_object(obj) { }
-        AccessibilityObjectWrapper() : m_object(0) { }
+protected:
+    HistoryPropertyListWriter();
 
-        AccessibilityObject* m_object;
-    };
+    void writeHistoryItem(BinaryPropertyListObjectStream&, HistoryItem*);
 
-} // namespace WebCore
+private:
+    virtual void writeHistoryItems(BinaryPropertyListObjectStream&) = 0;
 
-#endif // AccessibilityObjectWrapperWin_h
+    virtual void writeObjects(BinaryPropertyListObjectStream&);
+    virtual UInt8* buffer(size_t);
+
+    const String m_dailyVisitCountsKey;
+    const String m_displayTitleKey;
+    const String m_lastVisitWasFailureKey;
+    const String m_lastVisitWasHTTPNonGetKey;
+    const String m_lastVisitedDateKey;
+    const String m_redirectURLsKey;
+    const String m_titleKey;
+    const String m_urlKey;
+    const String m_visitCountKey;
+    const String m_weeklyVisitCountsKey;
+
+    UInt8* m_buffer;
+    size_t m_bufferSize;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp b/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp
index 693d8f7ad3..fd48194dca 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp
@@ -34,11 +34,13 @@ namespace WebCore {
 
 CanvasGradient::CanvasGradient(const FloatPoint& p0, const FloatPoint& p1)
     : m_gradient(Gradient::create(p0, p1))
+    , m_dashbardCompatibilityMode(false)
 {
 }
 
 CanvasGradient::CanvasGradient(const FloatPoint& p0, float r0, const FloatPoint& p1, float r1)
     : m_gradient(Gradient::create(p0, r0, p1, r1))
+    , m_dashbardCompatibilityMode(false)
 {
 }
 
@@ -51,7 +53,8 @@ void CanvasGradient::addColorStop(float value, const String& color, ExceptionCod
 
     RGBA32 rgba = 0;
     if (!CSSParser::parseColor(rgba, color)) {
-        ec = SYNTAX_ERR;
+        if (!m_dashbardCompatibilityMode)
+            ec = SYNTAX_ERR;
         return;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasGradient.h b/src/3rdparty/webkit/WebCore/html/CanvasGradient.h
index 3b81dbd080..0a776528ef 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/html/CanvasGradient.h
@@ -54,11 +54,16 @@ namespace WebCore {
 
         void getColor(float value, float* r, float* g, float* b, float* a) const { m_gradient->getColor(value, r, g, b, a); }
 
+#if ENABLE(DASHBOARD_SUPPORT)
+        void setDashboardCompatibilityMode() { m_dashbardCompatibilityMode = true; }
+#endif
+
     private:
         CanvasGradient(const FloatPoint& p0, const FloatPoint& p1);
         CanvasGradient(const FloatPoint& p0, float r0, const FloatPoint& p1, float r1);
         
         RefPtr<Gradient> m_gradient;
+        bool m_dashbardCompatibilityMode;
     };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.idl b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.cpp
index 9fae8bf63d..a377c8357e 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.idl
+++ b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,19 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module storage {
-
-    interface SQLStatementErrorCallback {
-        boolean handleEvent(in SQLTransaction transaction, in SQLError error);
-    };
+#include "config.h"
+#include "CanvasPixelArray.h"
 
+namespace WebCore {
+    
+    PassRefPtr<CanvasPixelArray> CanvasPixelArray::create(unsigned length)
+    {
+        return adoptRef(new CanvasPixelArray(length));
+    }
+    
+    CanvasPixelArray::CanvasPixelArray(unsigned length)
+        : m_data(WTF::ByteArray::create(length))
+    {
+    }
+    
 }
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h
new file mode 100644
index 0000000000..b91a642dfa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CanvasPixelArray_h
+#define CanvasPixelArray_h
+
+#include <wtf/ByteArray.h>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+    
+    class CanvasPixelArray : public RefCounted<CanvasPixelArray> {
+    public:
+        static PassRefPtr<CanvasPixelArray> create(unsigned length);
+        
+        WTF::ByteArray* data() { return m_data.get(); }
+        unsigned length() const { return m_data->length(); }
+        
+        void set(unsigned index, double value)
+        {
+            m_data->set(index, value);
+        }
+        
+        bool get(unsigned index, unsigned char& result) const
+        {
+            return m_data->get(index, result);
+        }
+
+    private:
+        CanvasPixelArray(unsigned length);
+        RefPtr<WTF::ByteArray> m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasPixelArray_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.idl b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.idl
index 9355d9ae44..c815788110 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.idl
+++ b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,14 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module storage {
-
-    interface SQLTransactionErrorCallback {
-        void handleEvent(in SQLError error);
+module html {
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
+    interface [
+        CustomHeader,
+        HasCustomIndexGetter,
+        HasCustomIndexSetter
+    ] CanvasPixelArray {
+        readonly attribute long length;
     };
-
+#endif
 }
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
index ceea77a9cf..b321b40998 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
@@ -36,6 +36,7 @@
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasStyle.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "Document.h"
@@ -49,7 +50,6 @@
 #include "ImageBuffer.h"
 #include "ImageData.h"
 #include "KURL.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
 #include "SecurityOrigin.h"
@@ -58,8 +58,9 @@
 #include "TextMetrics.h"
 #include <stdio.h>
 
-#include <runtime/ByteArray.h>
+#include <wtf/ByteArray.h>
 #include <wtf/MathExtras.h>
+#include <wtf/OwnPtr.h>
 
 using namespace std;
 
@@ -357,7 +358,7 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
         return;
 
     TransformationMatrix newTransform = state().m_transform;
-    newTransform.scale(sx, sy);
+    newTransform.scaleNonUniform(sx, sy);
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
         return;
@@ -365,7 +366,7 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
 
     state().m_transform = newTransform;
     c->scale(FloatSize(sx, sy));
-    m_path.transform(TransformationMatrix().scale(1.0/sx, 1.0/sy));
+    m_path.transform(TransformationMatrix().scaleNonUniform(1.0/sx, 1.0/sy));
 }
 
 void CanvasRenderingContext2D::rotate(float angleInRadians)
@@ -422,9 +423,7 @@ void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float
         return;
 
     TransformationMatrix transform(m11, m12, m21, m22, dx, dy);
-
-    TransformationMatrix newTransform = state().m_transform;
-    newTransform.multiply(transform);
+    TransformationMatrix newTransform = transform * state().m_transform;
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
         return;
@@ -869,7 +868,6 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     GraphicsContext* dc = drawingContext();
     if (!dc)
         return;
-    // FIXME: Do this through platform-independent GraphicsContext API.
 #if PLATFORM(CG)
     const CGFloat components[5] = { c, m, y, k, a };
     CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceCMYK();
@@ -877,6 +875,8 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     CGColorSpaceRelease(colorSpace);
     CGContextSetShadowWithColor(dc->platformContext(), adjustedShadowSize(width, -height), blur, shadowColor);
     CGColorRelease(shadowColor);
+#else
+    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a));
 #endif
 }
 
@@ -1074,6 +1074,15 @@ void CanvasRenderingContext2D::setCompositeOperation(const String& operation)
     setGlobalCompositeOperation(operation);
 }
 
+void CanvasRenderingContext2D::prepareGradientForDashboard(CanvasGradient* gradient) const
+{
+#if ENABLE(DASHBOARD_SUPPORT)
+    if (Settings* settings = m_canvas->document()->settings())
+        if (settings->usesDashboardBackwardCompatibilityMode())
+            gradient->setDashboardCompatibilityMode();
+#endif
+}
+
 PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createLinearGradient(float x0, float y0, float x1, float y1, ExceptionCode& ec)
 {
     if (!isfinite(x0) || !isfinite(y0) || !isfinite(x1) || !isfinite(y1)) {
@@ -1081,7 +1090,9 @@ PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createLinearGradient(float
         return 0;
     }
 
-    return CanvasGradient::create(FloatPoint(x0, y0), FloatPoint(x1, y1));
+    PassRefPtr<CanvasGradient> gradient = CanvasGradient::create(FloatPoint(x0, y0), FloatPoint(x1, y1));
+    prepareGradientForDashboard(gradient.get());
+    return gradient;
 }
 
 PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createRadialGradient(float x0, float y0, float r0, float x1, float y1, float r1, ExceptionCode& ec)
@@ -1091,7 +1102,9 @@ PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createRadialGradient(float
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return CanvasGradient::create(FloatPoint(x0, y0), r0, FloatPoint(x1, y1), r1);
+    PassRefPtr<CanvasGradient> gradient =  CanvasGradient::create(FloatPoint(x0, y0), r0, FloatPoint(x1, y1), r1);
+    prepareGradientForDashboard(gradient.get());
+    return gradient;
 }
 
 PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageElement* image,
@@ -1112,8 +1125,7 @@ PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageEleme
     if (!cachedImage || !image->cachedImage()->image())
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
 
-    KURL url(cachedImage->url());
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(cachedImage->url());
     bool originClean = m_canvas->document()->securityOrigin()->canAccess(origin.get());
     return CanvasPattern::create(cachedImage->image(), repeatX, repeatY, originClean);
 }
@@ -1172,9 +1184,9 @@ GraphicsContext* CanvasRenderingContext2D::drawingContext() const
 
 static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
 {
-    PassRefPtr<ImageData> data = ImageData::create(size.width(), size.height());
-    memset(data->data()->data(), 0, data->data()->length());
-    return data;
+    RefPtr<ImageData> data = ImageData::create(size.width(), size.height());
+    memset(data->data()->data()->data(), 0, data->data()->data()->length());
+    return data.get();
 }
 
 PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh) const
@@ -1291,12 +1303,6 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     state().m_font = newStyle->font();
     state().m_font.update(styleSelector->fontSelector());
     state().m_realizedFont = true;
-    
-    // Set the font in the graphics context.
-    GraphicsContext* c = drawingContext();
-    if (!c)
-        return;
-    c->setFont(state().m_font);
 }
         
 String CanvasRenderingContext2D::textAlign() const
@@ -1425,13 +1431,14 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
     }
     
+#if PLATFORM(CG)
     CanvasStyle* drawStyle = fill ? state().m_fillStyle.get() : state().m_strokeStyle.get();
     if (drawStyle->canvasGradient() || drawStyle->canvasPattern()) {
         // FIXME: The rect is not big enough for miters on stroked text.
         IntRect maskRect = enclosingIntRect(textRect);
 
-        auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
-        
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
+
         GraphicsContext* maskImageContext = maskImage->context();
 
         if (fill)
@@ -1444,8 +1451,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         maskImageContext->setTextDrawingMode(fill ? cTextFill : cTextStroke);
         maskImageContext->translate(-maskRect.x(), -maskRect.y());
         
-        maskImageContext->setFont(font);
-        maskImageContext->drawBidiText(textRun, location);
+        maskImageContext->drawBidiText(font, textRun, location);
         
         c->save();
         c->clipToImageBuffer(maskRect, maskImage.get());
@@ -1455,9 +1461,10 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
 
         return;
     }
+#endif
 
     c->setTextDrawingMode(fill ? cTextFill : cTextStroke);
-    c->drawBidiText(textRun, location);
+    c->drawBidiText(font, textRun, location);
 }
 
 const Font& CanvasRenderingContext2D::accessFont()
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
index 8d05b928a5..d74659ea1d 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
@@ -251,7 +251,8 @@ namespace WebCore {
 #if ENABLE(DASHBOARD_SUPPORT)
         void clearPathForDashboardBackwardCompatibilityMode();
 #endif
-
+        
+        void prepareGradientForDashboard(CanvasGradient* gradient) const;
         void checkOrigin(const KURL&);
 
         HTMLCanvasElement* m_canvas;
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp b/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp
index ce1674e32f..743ed4f5d5 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp
@@ -44,8 +44,6 @@
 #include <QBrush>
 #include <QPen>
 #include <QColor>
-#elif PLATFORM(CAIRO)
-#include "NotImplemented.h"
 #endif
 
 namespace WebCore {
@@ -78,12 +76,21 @@ CanvasStyle::CanvasStyle(float grayLevel, float alpha)
 }
 
 CanvasStyle::CanvasStyle(float r, float g, float b, float a)
-    : m_type(RGBA), m_alpha(a), m_red(r), m_green(g), m_blue(b)
+    : m_type(RGBA)
+    , m_alpha(a)
+    , m_red(r)
+    , m_green(g)
+    , m_blue(b)
 {
 }
 
 CanvasStyle::CanvasStyle(float c, float m, float y, float k, float a)
-    : m_type(CMYKA), m_alpha(a), m_cyan(c), m_magenta(m), m_yellow(y), m_black(k)
+    : m_type(CMYKA)
+    , m_alpha(a)
+    , m_cyan(c)
+    , m_magenta(m)
+    , m_yellow(y)
+    , m_black(k)
 {
 }
 
@@ -146,8 +153,8 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
             clr.setCmykF(m_cyan, m_magenta, m_yellow, m_black, m_alpha);
             currentPen.setColor(clr);
             context->platformContext()->setPen(currentPen);
-#elif PLATFORM(CAIRO)
-            notImplemented();
+#else
+            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
 #endif
             break;
         }
@@ -207,6 +214,8 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
             clr.setCmykF(m_cyan, m_magenta, m_yellow, m_black, m_alpha);
             currentBrush.setColor(clr);
             context->platformContext()->setBrush(currentBrush);
+#else
+            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
 #endif
             break;
         }
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp b/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp
new file mode 100644
index 0000000000..feecd9611a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "CollectionCache.h"
+
+namespace WebCore {
+
+CollectionCache::CollectionCache()
+    : version(0)
+{
+    reset();
+}
+
+inline void CollectionCache::copyCacheMap(NodeCacheMap& dest, const NodeCacheMap& src)
+{
+    ASSERT(dest.isEmpty());
+    NodeCacheMap::const_iterator end = src.end();
+    for (NodeCacheMap::const_iterator it = src.begin(); it != end; ++it)
+        dest.add(it->first, new Vector<Element*>(*it->second));
+}
+
+CollectionCache::CollectionCache(const CollectionCache& other)
+    : version(other.version)
+    , current(other.current)
+    , position(other.position)
+    , length(other.length)
+    , elementsArrayPosition(other.elementsArrayPosition)
+    , hasLength(other.hasLength)
+    , hasNameCache(other.hasNameCache)
+{
+    copyCacheMap(idCache, other.idCache);
+    copyCacheMap(nameCache, other.nameCache);
+}
+
+void CollectionCache::swap(CollectionCache& other)
+{
+    std::swap(version, other.version);
+    std::swap(current, other.current);
+    std::swap(position, other.position);
+    std::swap(length, other.length);
+    std::swap(elementsArrayPosition, other.elementsArrayPosition);
+
+    idCache.swap(other.idCache);
+    nameCache.swap(other.nameCache);
+    
+    std::swap(hasLength, other.hasLength);
+    std::swap(hasNameCache, other.hasNameCache);
+}
+
+CollectionCache::~CollectionCache()
+{
+    deleteAllValues(idCache);
+    deleteAllValues(nameCache);
+}
+
+void CollectionCache::reset()
+{
+    current = 0;
+    position = 0;
+    length = 0;
+    hasLength = false;
+    elementsArrayPosition = 0;
+    deleteAllValues(idCache);
+    idCache.clear();
+    deleteAllValues(nameCache);
+    nameCache.clear();
+    hasNameCache = false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionCache.h b/src/3rdparty/webkit/WebCore/html/CollectionCache.h
new file mode 100644
index 0000000000..7cdcdd541b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CollectionCache.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef CollectionCache_h
+#define CollectionCache_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicStringImpl;
+class Element;
+
+struct CollectionCache {
+    CollectionCache();
+    CollectionCache(const CollectionCache&);
+    CollectionCache& operator=(const CollectionCache& other)
+    {
+        CollectionCache tmp(other);    
+        swap(tmp);
+        return *this;
+    }
+    ~CollectionCache();
+
+    void reset();
+    void swap(CollectionCache&);
+
+    typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
+
+    unsigned version;
+    Element* current;
+    unsigned position;
+    unsigned length;
+    int elementsArrayPosition;
+    NodeCacheMap idCache;
+    NodeCacheMap nameCache;
+    bool hasLength;
+    bool hasNameCache;
+
+private:
+    static void copyCacheMap(NodeCacheMap&, const NodeCacheMap&);
+};
+
+} // namespace
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionType.h b/src/3rdparty/webkit/WebCore/html/CollectionType.h
new file mode 100644
index 0000000000..e5973a3a29
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CollectionType.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef CollectionType_h
+#define CollectionType_h
+
+namespace WebCore {
+
+enum CollectionType {
+    // unnamed collection types cached in the document
+
+    DocImages,    // all <img> elements in the document
+    DocApplets,   // all <object> and <applet> elements
+    DocEmbeds,    // all <embed> elements
+    DocObjects,   // all <object> elements
+    DocForms,     // all <form> elements
+    DocLinks,     // all <a> _and_ <area> elements with a value for href
+    DocAnchors,   // all <a> elements with a value for name
+    DocScripts,   // all <script> elements
+
+    DocAll,       // "all" elements (IE)
+    NodeChildren, // first-level children (IE)
+
+    // named collection types cached in the document
+
+    WindowNamedItems,
+    DocumentNamedItems,
+
+    // types not cached in the document; these are types that can't be used on a document
+
+    TableTBodies, // all <tbody> elements in this table
+    TSectionRows, // all row elements in this table section
+    TRCells,      // all cells in this row
+    SelectOptions,
+    MapAreas,
+
+    OtherCollection
+};
+
+static const CollectionType FirstUnnamedDocumentCachedType = DocImages;
+static const unsigned NumUnnamedDocumentCachedTypes = NodeChildren - DocImages + 1;
+
+static const CollectionType FirstNamedDocumentCachedType = WindowNamedItems;
+static const unsigned NumNamedDocumentCachedTypes = DocumentNamedItems - WindowNamedItems + 1;
+
+} // namespace
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
index ce08bccebd..354f9f076c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
@@ -36,9 +36,11 @@
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
-#include "RenderFlow.h"
+#include "Page.h"
+#include "RenderBox.h"
 #include "RenderImage.h"
 #include "ResourceRequest.h"
 #include "SelectionController.h"
@@ -107,12 +109,14 @@ bool HTMLAnchorElement::isKeyboardFocusable(KeyboardEvent* event) const
     if (!document()->frame()->eventHandler()->tabsToLinks(event))
         return false;
 
+    if (!renderer() || !renderer()->isBoxModelObject())
+        return false;
+    
     // Before calling absoluteRects, check for the common case where the renderer
-    // or one of the continuations is non-empty, since this is a faster check and
-    // almost always returns true.
-    for (RenderObject* r = renderer(); r; r = r->continuation())
-        if (r->width() > 0 && r->height() > 0)
-            return true;
+    // is non-empty, since this is a faster check and almost always returns true.
+    RenderBoxModelObject* box = toRenderBoxModelObject(renderer());
+    if (!box->borderBoundingBox().isEmpty())
+        return true;
 
     Vector<IntRect> rects;
     FloatPoint absPos = renderer()->localToAbsolute();
@@ -197,7 +201,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* evt)
         if (evt->target()->toNode()->hasTagName(imgTag)) {
             HTMLImageElement* img = static_cast<HTMLImageElement*>(evt->target()->toNode());
             if (img && img->isServerMap()) {
-                RenderImage* r = static_cast<RenderImage*>(img->renderer());
+                RenderImage* r = toRenderImage(img->renderer());
                 if (r && e) {
                     // FIXME: broken with transforms
                     FloatPoint absPos = r->localToAbsolute();
@@ -216,7 +220,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* evt)
         }
 
         if (!evt->defaultPrevented() && document()->frame())
-            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, true);
+            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true);
 
         evt->setDefaultHandled();
     } else if (isLink() && isContentEditable()) {
@@ -277,11 +281,17 @@ void HTMLAnchorElement::parseMappedAttribute(MappedAttribute *attr)
         bool wasLink = isLink();
         setIsLink(!attr->isNull());
         if (wasLink != isLink())
-            setChanged();
-        if (isLink() && document()->isDNSPrefetchEnabled()) {
-            String value = attr->value();
-            if (protocolIs(value, "http") || protocolIs(value, "https") || value.startsWith("//"))
-                prefetchDNS(document()->completeURL(value).host());
+            setNeedsStyleRecalc();
+        if (isLink()) {
+            String parsedURL = parseURL(attr->value());
+            if (document()->isDNSPrefetchEnabled()) {
+                if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
+                    prefetchDNS(document()->completeURL(parsedURL).host());
+            }
+            if (document()->page() && !document()->page()->javaScriptURLsAreAllowed() && protocolIsJavaScript(parsedURL)) {
+                setIsLink(false);
+                attr->setValue(nullAtom);
+            }
         }
     } else if (attr->name() == nameAttr ||
              attr->name() == titleAttr ||
@@ -428,7 +438,8 @@ void HTMLAnchorElement::setType(const AtomicString& value)
 
 String HTMLAnchorElement::hash() const
 {
-    return "#" + href().ref();
+    String ref = href().ref();
+    return ref.isEmpty() ? "" : "#" + ref;
 }
 
 String HTMLAnchorElement::host() const
@@ -461,7 +472,8 @@ String HTMLAnchorElement::protocol() const
 
 String HTMLAnchorElement::search() const
 {
-    return href().query();
+    String query = href().query();
+    return query.isEmpty() ? "" : "?" + query;
 }
 
 String HTMLAnchorElement::text() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
index f3a15ee116..c2dda3d022 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
@@ -47,11 +47,11 @@ module html {
         readonly attribute DOMString search;
         readonly attribute DOMString text;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
index 9d7ab6a6b1..13dd911727 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
@@ -27,6 +27,7 @@
 #include "Frame.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderApplet.h"
 #include "RenderInline.h"
 #include "Settings.h"
@@ -99,9 +100,12 @@ void HTMLAppletElement::removedFromDocument()
     HTMLPlugInElement::removedFromDocument();
 }
 
-bool HTMLAppletElement::rendererIsNeeded(RenderStyle*)
+bool HTMLAppletElement::rendererIsNeeded(RenderStyle* style)
 {
-    return !getAttribute(codeAttr).isNull();
+    if (getAttribute(codeAttr).isNull())
+        return false;
+
+    return HTMLPlugInElement::rendererIsNeeded(style);
 }
 
 RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style)
@@ -112,9 +116,11 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
         HashMap<String, String> args;
 
         args.set("code", getAttribute(codeAttr));
+
         const AtomicString& codeBase = getAttribute(codebaseAttr);
-        if(!codeBase.isNull())
+        if (!codeBase.isNull())
             args.set("codeBase", codeBase);
+
         const AtomicString& name = getAttribute(document()->isHTMLDocument() ? nameAttr : idAttr);
         if (!name.isNull())
             args.set("name", name);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
index 794f000bb8..95f03a720e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
@@ -35,14 +35,14 @@ module html {
                  attribute [ConvertNullToNullString] DOMString code;
                  attribute [ConvertNullToNullString] DOMString codeBase;
                  attribute [ConvertNullToNullString] DOMString height;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString hspace;
 #else
                  attribute [ConvertFromString] long hspace;
 #endif
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [ConvertNullToNullString] DOMString object;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString vspace;
 #else
                  attribute [ConvertFromString] long vspace;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
index 7a3c9e0165..2f7c1a5378 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,6 +27,8 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "Length.h"
+#include "MappedAttribute.h"
+#include "Path.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -35,8 +37,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document *doc)
-    : HTMLAnchorElement(tagName, doc)
+HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
+    : HTMLAnchorElement(tagName, document)
     , m_coords(0)
     , m_coordsLen(0)
     , m_lastSize(-1, -1)
@@ -73,11 +75,11 @@ void HTMLAreaElement::parseMappedAttribute(MappedAttribute *attr)
 bool HTMLAreaElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestResult& result)
 {
     if (m_lastSize != size) {
-        region = getRegion(size);
+        m_region.set(new Path(getRegion(size)));
         m_lastSize = size;
     }
 
-    if (!region.contains(IntPoint(x, y)))
+    if (!m_region->contains(IntPoint(x, y)))
         return false;
     
     result.setInnerNode(this);
@@ -150,32 +152,32 @@ Path HTMLAreaElement::getRegion(const IntSize& size) const
     return path;
 }
 
-String HTMLAreaElement::accessKey() const
+const AtomicString& HTMLAreaElement::accessKey() const
 {
     return getAttribute(accesskeyAttr);
 }
 
-void HTMLAreaElement::setAccessKey(const String& value)
+void HTMLAreaElement::setAccessKey(const AtomicString& value)
 {
     setAttribute(accesskeyAttr, value);
 }
 
-String HTMLAreaElement::alt() const
+const AtomicString& HTMLAreaElement::alt() const
 {
     return getAttribute(altAttr);
 }
 
-void HTMLAreaElement::setAlt(const String& value)
+void HTMLAreaElement::setAlt(const AtomicString& value)
 {
     setAttribute(altAttr, value);
 }
 
-String HTMLAreaElement::coords() const
+const AtomicString& HTMLAreaElement::coords() const
 {
     return getAttribute(coordsAttr);
 }
 
-void HTMLAreaElement::setCoords(const String& value)
+void HTMLAreaElement::setCoords(const AtomicString& value)
 {
     setAttribute(coordsAttr, value);
 }
@@ -185,7 +187,7 @@ KURL HTMLAreaElement::href() const
     return document()->completeURL(getAttribute(hrefAttr));
 }
 
-void HTMLAreaElement::setHref(const String& value)
+void HTMLAreaElement::setHref(const AtomicString& value)
 {
     setAttribute(hrefAttr, value);
 }
@@ -200,12 +202,12 @@ void HTMLAreaElement::setNoHref(bool noHref)
     setAttribute(nohrefAttr, noHref ? "" : 0);
 }
 
-String HTMLAreaElement::shape() const
+const AtomicString& HTMLAreaElement::shape() const
 {
     return getAttribute(shapeAttr);
 }
 
-void HTMLAreaElement::setShape(const String& value)
+void HTMLAreaElement::setShape(const AtomicString& value)
 {
     setAttribute(shapeAttr, value);
 }
@@ -220,7 +222,7 @@ String HTMLAreaElement::target() const
     return getAttribute(targetAttr);
 }
 
-void HTMLAreaElement::setTarget(const String& value)
+void HTMLAreaElement::setTarget(const AtomicString& value)
 {
     setAttribute(targetAttr, value);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
index 7de58326a4..19533b1d3c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,11 +25,11 @@
 
 #include "HTMLAnchorElement.h"
 #include "IntSize.h"
-#include "Path.h"
 
 namespace WebCore {
 
 class HitTestResult;
+class Path;
 
 class HTMLAreaElement : public HTMLAnchorElement {
 public:
@@ -47,33 +47,34 @@ public:
 
     virtual IntRect getRect(RenderObject*) const;
 
-    String accessKey() const;
-    void setAccessKey(const String&);
+    const AtomicString& accessKey() const;
+    void setAccessKey(const AtomicString&);
 
-    String alt() const;
-    void setAlt(const String&);
+    const AtomicString& alt() const;
+    void setAlt(const AtomicString&);
 
-    String coords() const;
-    void setCoords(const String&);
+    const AtomicString& coords() const;
+    void setCoords(const AtomicString&);
 
     KURL href() const;
-    void setHref(const String&);
+    void setHref(const AtomicString&);
 
     bool noHref() const;
     void setNoHref(bool);
 
-    String shape() const;
-    void setShape(const String&);
+    const AtomicString& shape() const;
+    void setShape(const AtomicString&);
 
     virtual bool isFocusable() const;
 
     virtual String target() const;
-    void setTarget(const String&);
+    void setTarget(const AtomicString&);
 
 private:
     enum Shape { Default, Poly, Rect, Circle, Unknown };
     Path getRegion(const IntSize&) const;
-    Path region;
+
+    OwnPtr<Path> m_region;
     Length* m_coords;
     int m_coordsLen;
     IntSize m_lastSize;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
index 39cc7198a1..d80ebeda2b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
@@ -42,7 +42,7 @@ module html {
         readonly attribute DOMString protocol;
         readonly attribute DOMString search;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index 2f6b4ea5c7..edd95116a7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -1,7 +1,7 @@
 namespace="HTML"
 namespacePrefix="xhtml"
 namespaceURI="http://www.w3.org/1999/xhtml"
-attrsNullNamespace="1"
+attrsNullNamespace
 
 abbr
 accept_charset
@@ -22,6 +22,7 @@ aria-pressed
 aria-valuemax
 aria-valuemin
 aria-valuenow
+autobuffer
 autocomplete
 autofocus
 autoplay
@@ -42,7 +43,7 @@ charset
 checked
 cellborder
 cite
-class exportString="1"
+class exportString
 classid
 clear
 code
@@ -140,6 +141,8 @@ onmouseout
 onmouseover
 onmouseup
 onmousewheel
+ononline
+onoffline
 onpaste
 onreset
 onresize
@@ -177,6 +180,7 @@ selected
 shape
 size
 span
+spellcheck
 src
 standby
 start
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp
index e98f8d1265..6f86e6a42f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp
@@ -19,11 +19,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLBRElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderBR.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
index dd4f7b391a..a2789086d9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
@@ -29,6 +29,7 @@
 #include "FrameLoader.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp
index 0d7c59b2cf..ef08822ce9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp
@@ -1,4 +1,4 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
index a94f3ab618..f09c9d7d51 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
@@ -26,7 +26,7 @@ module html {
     ] HTMLBaseFontElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString color;
         attribute [ConvertNullToNullString] DOMString face;
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         attribute [ConvertToString] DOMString size; // this changed to a long, but our existing API is a string
 #else
         attribute long size;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
index a23f9be893..9828dab0c4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
@@ -32,9 +32,12 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "EventNames.h"
+#include "Frame.h"
 #include "FrameView.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "ScriptEventListener.h"
 
 namespace WebCore {
 
@@ -131,25 +134,26 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         if (attached())
             document()->recalcStyle(Force);
     } else if (attr->name() == onloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onbeforeunloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onunloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().resizeEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onscrollAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
-    else if (attr->name() == onstorageAttr) {
-        // The HTML5 spec currently specifies that storage events are fired only at the body element of
-        // an HTMLDocument, which is why the onstorage attribute differs from the ones before it.
-        // The spec might change on this, and then so should we!
-        setInlineEventListenerForTypeAndAttribute(eventNames().storageEvent, attr);
-    } else
+        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onstorageAttr)
+        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == ononlineAttr)
+        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onofflineAttr)
+        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -240,13 +244,24 @@ void HTMLBodyElement::setVLink(const String& value)
     setAttribute(vlinkAttr, value);
 }
 
+static int adjustForZoom(int value, FrameView* frameView)
+{
+    float zoomFactor = frameView->frame()->zoomFactor();
+    if (zoomFactor == 1)
+        return value;
+    // Needed because of truncation (rather than rounding) when scaling up.
+    if (zoomFactor > 1)
+        value++;
+    return static_cast<int>(value / zoomFactor);
+}
+
 int HTMLBodyElement::scrollLeft() const
 {
     // Update the document's layout.
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->scrollX() : 0;
+    return view ? adjustForZoom(view->scrollX(), view) : 0;
 }
 
 void HTMLBodyElement::setScrollLeft(int scrollLeft)
@@ -255,7 +270,7 @@ void HTMLBodyElement::setScrollLeft(int scrollLeft)
     if (sview) {
         // Update the document's layout
         document()->updateLayoutIgnorePendingStylesheets();
-        sview->setScrollPosition(IntPoint(scrollLeft, sview->scrollY()));
+        sview->setScrollPosition(IntPoint(static_cast<int>(scrollLeft * sview->frame()->zoomFactor()), sview->scrollY()));
     }    
 }
 
@@ -265,7 +280,7 @@ int HTMLBodyElement::scrollTop() const
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->scrollY() : 0;
+    return view ? adjustForZoom(view->scrollY(), view) : 0;
 }
 
 void HTMLBodyElement::setScrollTop(int scrollTop)
@@ -274,7 +289,7 @@ void HTMLBodyElement::setScrollTop(int scrollTop)
     if (sview) {
         // Update the document's layout
         document()->updateLayoutIgnorePendingStylesheets();
-        sview->setScrollPosition(IntPoint(sview->scrollX(), scrollTop));
+        sview->setScrollPosition(IntPoint(sview->scrollX(), static_cast<int>(scrollTop * sview->frame()->zoomFactor())));
     }        
 }
 
@@ -284,7 +299,7 @@ int HTMLBodyElement::scrollHeight() const
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->contentsHeight() : 0;    
+    return view ? adjustForZoom(view->contentsHeight(), view) : 0;    
 }
 
 int HTMLBodyElement::scrollWidth() const
@@ -293,7 +308,7 @@ int HTMLBodyElement::scrollWidth() const
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->contentsWidth() : 0;    
+    return view ? adjustForZoom(view->contentsWidth(), view) : 0;    
 }
 
 void HTMLBodyElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
@@ -303,4 +318,16 @@ void HTMLBodyElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
     addSubresourceURL(urls, document()->completeURL(background()));
 }
 
+void HTMLBodyElement::didMoveToNewOwnerDocument()
+{
+    // When moving body elements between documents, we should have to reset the parent sheet for any
+    // link style declarations.  If we don't we might crash later.
+    // In practice I can't reproduce this theoretical problem.
+    // webarchive/adopt-attribute-styled-body-webarchive.html tries to make sure this crash won't surface.
+    if (m_linkDecl)
+        m_linkDecl->setParent(document()->elementSheet());
+    
+    HTMLElement::didMoveToNewOwnerDocument();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
index a72e6680ad..8e434bebaf 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
@@ -61,19 +61,22 @@ public:
     String vLink() const;
     void setVLink(const String&);
 
-    int scrollLeft() const;
-    void setScrollLeft(int scrollLeft);
+    virtual int scrollLeft() const;
+    virtual void setScrollLeft(int scrollLeft);
     
-    int scrollTop() const;
-    void setScrollTop(int scrollTop);
+    virtual int scrollTop() const;
+    virtual void setScrollTop(int scrollTop);
     
-    int scrollHeight() const;
-    int scrollWidth() const;
+    virtual int scrollHeight() const;
+    virtual int scrollWidth() const;
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
     
 protected:
     RefPtr<CSSMutableStyleDeclaration> m_linkDecl;
+
+private:
+    virtual void didMoveToNewOwnerDocument();
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
index 41d20d6d7d..c639183e77 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
@@ -31,12 +31,6 @@ module html {
         attribute [ConvertNullToNullString] DOMString link;
         attribute [ConvertNullToNullString] DOMString text;
         attribute [ConvertNullToNullString] DOMString vLink; 
-
-        // IE Extensions
-                 attribute long scrollLeft;
-                 attribute long scrollTop;
-        readonly attribute long scrollWidth;
-        readonly attribute long scrollHeight;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
index 571f30c1ea..3987859d02 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
@@ -30,7 +30,9 @@
 #include "FormDataList.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "RenderButton.h"
 #include <wtf/StdLibExtras.h>
 
@@ -55,7 +57,7 @@ RenderObject* HTMLButtonElement::createRenderer(RenderArena* arena, RenderStyle*
     return new (arena) RenderButton(this);
 }
 
-const AtomicString& HTMLButtonElement::type() const
+const AtomicString& HTMLButtonElement::formControlType() const
 {
     switch (m_type) {
         case SUBMIT: {
@@ -89,9 +91,9 @@ void HTMLButtonElement::parseMappedAttribute(MappedAttribute* attr)
         // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
         // See http://bugs.webkit.org/show_bug.cgi?id=12071
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFormControlElement::parseMappedAttribute(attr);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
index c8f51cb72b..b1d744c269 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
@@ -33,7 +33,7 @@ public:
     HTMLButtonElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
     virtual ~HTMLButtonElement();
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
         
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
index 76c32021d2..9e635e7c41 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
@@ -39,6 +39,7 @@
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
 #include "Settings.h"
@@ -71,6 +72,8 @@ HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* doc
 
 HTMLCanvasElement::~HTMLCanvasElement()
 {
+    if (m_observer)
+        m_observer->canvasDestroyed(this);
 }
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -155,8 +158,8 @@ void HTMLCanvasElement::willDraw(const FloatRect& rect)
 {
     m_imageBuffer->clearImage();
     
-    if (RenderObject* ro = renderer()) {
-        FloatRect destRect = ro->contentBox();
+    if (RenderBox* ro = renderBox()) {
+        FloatRect destRect = ro->contentBoxRect();
         FloatRect r = mapRect(rect, FloatRect(0, 0, m_size.width(), m_size.height()), destRect);
         r.intersect(destRect);
         if (m_dirtyRect.contains(r))
@@ -256,7 +259,7 @@ void HTMLCanvasElement::createImageBuffer() const
     if (!size.width() || !size.height())
         return;
 
-    m_imageBuffer.set(ImageBuffer::create(size, false).release());
+    m_imageBuffer = ImageBuffer::create(size, false);
     // The convertLogicalToDevice MaxCanvasArea check should prevent common cases
     // where ImageBuffer::create() returns NULL, however we could still be low on memory.
     if (!m_imageBuffer)
@@ -284,7 +287,7 @@ TransformationMatrix HTMLCanvasElement::baseTransform() const
     IntSize size = convertLogicalToDevice(unscaledSize);
     TransformationMatrix transform;
     if (size.width() && size.height())
-        transform.scale(size.width() / unscaledSize.width(), size.height() / unscaledSize.height());
+        transform.scaleNonUniform(size.width() / unscaledSize.width(), size.height() / unscaledSize.height());
     transform.multiply(m_imageBuffer->baseTransform());
     return transform;
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
index 12b3cb2586..bba1f2d37f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
@@ -49,8 +49,9 @@ class CanvasObserver {
 public:
     virtual ~CanvasObserver() {};
 
-    virtual void canvasChanged(HTMLCanvasElement* element, const FloatRect& changedRect) = 0;
-    virtual void canvasResized(HTMLCanvasElement* element) = 0;
+    virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect) = 0;
+    virtual void canvasResized(HTMLCanvasElement*) = 0;
+    virtual void canvasDestroyed(HTMLCanvasElement*) = 0;
 };
 
 class HTMLCanvasElement : public HTMLElement {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
index e457c15202..13fc623237 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
@@ -37,8 +37,8 @@ module html {
         DOMString toDataURL(in [ConvertUndefinedOrNullToNullString] DOMString type)
             raises(DOMException);
 
-#if !defined(LANGUAGE_OBJECTIVE_C)
-        DOMObject getContext(in DOMString contextId);
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+        [V8Custom] DOMObject getContext(in DOMString contextId);
 #endif
 
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
index 78c9c3c6c4..9dca48f58c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type)
+HTMLCollection::HTMLCollection(PassRefPtr<Node> base, CollectionType type)
     : m_idsDone(false)
     , m_base(base)
     , m_type(type)
@@ -44,7 +44,7 @@ HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type)
 {
 }
 
-HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type, CollectionInfo* info)
+HTMLCollection::HTMLCollection(PassRefPtr<Node> base, CollectionType type, CollectionCache* info)
     : m_idsDone(false)
     , m_base(base)
     , m_type(type)
@@ -53,7 +53,7 @@ HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type, CollectionInfo*
 {
 }
 
-PassRefPtr<HTMLCollection> HTMLCollection::create(PassRefPtr<Node> base, Type type)
+PassRefPtr<HTMLCollection> HTMLCollection::create(PassRefPtr<Node> base, CollectionType type)
 {
     return adoptRef(new HTMLCollection(base, type));
 }
@@ -64,74 +64,12 @@ HTMLCollection::~HTMLCollection()
         delete m_info;
 }
 
-HTMLCollection::CollectionInfo::CollectionInfo()
-    : version(0)
-{
-    reset();
-}
-
-inline void HTMLCollection::CollectionInfo::copyCacheMap(NodeCacheMap& dest, const NodeCacheMap& src)
-{
-    ASSERT(dest.isEmpty());
-    NodeCacheMap::const_iterator end = src.end();
-    for (NodeCacheMap::const_iterator it = src.begin(); it != end; ++it)
-        dest.add(it->first, new Vector<Element*>(*it->second));
-}
-
-HTMLCollection::CollectionInfo::CollectionInfo(const CollectionInfo& other)
-    : version(other.version)
-    , current(other.current)
-    , position(other.position)
-    , length(other.length)
-    , elementsArrayPosition(other.elementsArrayPosition)
-    , hasLength(other.hasLength)
-    , hasNameCache(other.hasNameCache)
-{
-    copyCacheMap(idCache, other.idCache);
-    copyCacheMap(nameCache, other.nameCache);
-}
-
-void HTMLCollection::CollectionInfo::swap(CollectionInfo& other)
-{
-    std::swap(version, other.version);
-    std::swap(current, other.current);
-    std::swap(position, other.position);
-    std::swap(length, other.length);
-    std::swap(elementsArrayPosition, other.elementsArrayPosition);
-
-    idCache.swap(other.idCache);
-    nameCache.swap(other.nameCache);
-    
-    std::swap(hasLength, other.hasLength);
-    std::swap(hasNameCache, other.hasNameCache);
-}
-
-HTMLCollection::CollectionInfo::~CollectionInfo()
-{
-    deleteAllValues(idCache);
-    deleteAllValues(nameCache);
-}
-
-void HTMLCollection::CollectionInfo::reset()
-{
-    current = 0;
-    position = 0;
-    length = 0;
-    hasLength = false;
-    elementsArrayPosition = 0;
-    deleteAllValues(idCache);
-    idCache.clear();
-    deleteAllValues(nameCache);
-    nameCache.clear();
-    hasNameCache = false;
-}
-
 void HTMLCollection::resetCollectionInfo() const
 {
     unsigned docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
 
     if (!m_info) {
-        m_info = new CollectionInfo;
+        m_info = new CollectionCache;
         m_ownsInfo = true;
         m_info->version = docversion;
         return;
@@ -164,7 +102,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
         case DocScripts:
         case DocumentNamedItems:
         case MapAreas:
-        case Other:
+        case OtherCollection:
         case SelectOptions:
         case WindowNamedItems:
             break;
@@ -245,7 +183,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
             case NodeChildren:
                 return e;
             case DocumentNamedItems:
-            case Other:
+            case OtherCollection:
             case WindowNamedItems:
                 ASSERT_NOT_REACHED();
                 break;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
index 083ec0535a..b04bcbc881 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
@@ -23,6 +23,7 @@
 #ifndef HTMLCollection_h
 #define HTMLCollection_h
 
+#include "CollectionType.h"
 #include <wtf/RefCounted.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -37,46 +38,11 @@ class Node;
 class NodeList;
 class String;
 
+struct CollectionCache;
+
 class HTMLCollection : public RefCounted<HTMLCollection> {
 public:
-    enum Type {
-        // unnamed collection types cached in the document
-
-        DocImages,    // all <img> elements in the document
-        DocApplets,   // all <object> and <applet> elements
-        DocEmbeds,    // all <embed> elements
-        DocObjects,   // all <object> elements
-        DocForms,     // all <form> elements
-        DocLinks,     // all <a> _and_ <area> elements with a value for href
-        DocAnchors,   // all <a> elements with a value for name
-        DocScripts,   // all <script> elements
-
-        DocAll,       // "all" elements (IE)
-        NodeChildren, // first-level children (IE)
-
-        // named collection types cached in the document
-
-        WindowNamedItems,
-        DocumentNamedItems,
-
-        // types not cached in the document; these are types that can't be used on a document
-
-        TableTBodies, // all <tbody> elements in this table
-        TSectionRows, // all row elements in this table section
-        TRCells,      // all cells in this row
-        SelectOptions,
-        MapAreas,
-
-        Other
-    };
-
-    static const Type FirstUnnamedDocumentCachedType = DocImages;
-    static const unsigned NumUnnamedDocumentCachedTypes = NodeChildren - DocImages + 1;
-
-    static const Type FirstNamedDocumentCachedType = WindowNamedItems;
-    static const unsigned NumNamedDocumentCachedTypes = DocumentNamedItems - WindowNamedItems + 1;
-
-    static PassRefPtr<HTMLCollection> create(PassRefPtr<Node> base, Type);
+    static PassRefPtr<HTMLCollection> create(PassRefPtr<Node> base, CollectionType);
     virtual ~HTMLCollection();
     
     unsigned length() const;
@@ -94,52 +60,18 @@ public:
     PassRefPtr<NodeList> tags(const String&);
 
     Node* base() const { return m_base.get(); }
-    Type type() const { return m_type; }
-
-    // FIXME: This class name is a bad in two ways. First, "info" is much too vague,
-    // and doesn't convey the job of this class (caching collection state).
-    // Second, since this is a member of HTMLCollection, it doesn't need "collection"
-    // in its name.
-    struct CollectionInfo {
-        CollectionInfo();
-        CollectionInfo(const CollectionInfo&);
-        CollectionInfo& operator=(const CollectionInfo& other)
-        {
-            CollectionInfo tmp(other);    
-            swap(tmp);
-            return *this;
-        }
-        ~CollectionInfo();
-
-        void reset();
-        void swap(CollectionInfo&);
-
-        typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
-
-        unsigned version;
-        Element* current;
-        unsigned position;
-        unsigned length;
-        int elementsArrayPosition;
-        NodeCacheMap idCache;
-        NodeCacheMap nameCache;
-        bool hasLength;
-        bool hasNameCache;
-
-    private:
-        static void copyCacheMap(NodeCacheMap&, const NodeCacheMap&);
-    };
+    CollectionType type() const { return m_type; }
 
 protected:
-    HTMLCollection(PassRefPtr<Node> base, Type, CollectionInfo*);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType, CollectionCache*);
 
-    CollectionInfo* info() const { return m_info; }
-    virtual void resetCollectionInfo() const;
+    CollectionCache* info() const { return m_info; }
+    void resetCollectionInfo() const;
 
     mutable bool m_idsDone; // for nextNamedItem()
 
 private:
-    HTMLCollection(PassRefPtr<Node> base, Type);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType);
 
     virtual Element* itemAfter(Element*) const;
     virtual unsigned calcLength() const;
@@ -148,9 +80,9 @@ private:
     bool checkForNameMatch(Element*, bool checkName, const AtomicString& name) const;
 
     RefPtr<Node> m_base;
-    Type m_type;
+    CollectionType m_type;
 
-    mutable CollectionInfo* m_info;
+    mutable CollectionCache* m_info;
     mutable bool m_ownsInfo;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
index 8290e1a085..1ba5ec778f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,6 +26,7 @@ module html {
         HasNameGetter,
         CustomCall,
         CustomToJS,
+        Polymorphic,
         InterfaceUUID=b0d215ff-6f9c-4d1f-86c3-f200a65a5134,
         ImplementationUUID=8e81b17f-7f74-4121-8f2f-a339a7e66447
     ] HTMLCollection {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp
index 7ffccd7da9..bd7195e82e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLDivElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
index 04716bf483..5867f0eed4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
@@ -421,5 +421,11 @@ void HTMLDocument::clear()
     // We've long had a comment saying that IE doesn't support this.
     // But I do see it in the documentation for Mozilla.
 }
-    
+
+bool HTMLDocument::isFrameSet() const
+{
+    HTMLElement* bodyElement = body();
+    return bodyElement && bodyElement->renderer() && bodyElement->hasTagName(framesetTag);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
index de84c70799..ab5da50a5f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
@@ -88,6 +88,7 @@ protected:
 
 private:
     virtual bool isHTMLDocument() const { return true; }
+    virtual bool isFrameSet() const;
     virtual Tokenizer* createTokenizer();
     virtual void determineParseMode();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
index 4345195ad2..3dd7a073f7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
@@ -37,7 +37,7 @@ module html {
 
         // Extensions
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // FIXME: This should eventually be available (if they are wanted) for all languages.
                  attribute [Custom, Deletable] HTMLCollection all;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
index 4caf336f7f..572025a5ea 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,12 +33,15 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLBRElement.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "HTMLElementFactory.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
-#include "HTMLTokenizer.h" // parseHTMLDocumentFragment
+#include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
 #include "RenderWordBreak.h"
+#include "ScriptEventListener.h"
 #include "Settings.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -65,7 +69,8 @@ String HTMLElement::nodeName() const
 {
     // FIXME: Would be nice to have an atomicstring lookup based off uppercase chars that does not have to copy
     // the string on a hit in the hash.
-    if (document()->isHTMLDocument())
+    // FIXME: We should have a way to detect XHTML elements and replace the hasPrefix() check with it.
+    if (document()->isHTMLDocument() && !tagQName().hasPrefix())
         return tagQName().localName().string().upper();
     return Element::nodeName();
 }
@@ -96,23 +101,6 @@ int HTMLElement::tagPriority() const
     return 1;
 }
 
-PassRefPtr<Node> HTMLElement::cloneNode(bool deep)
-{
-    RefPtr<HTMLElement> clone = HTMLElementFactory::createHTMLElement(tagQName(), document(), 0, false);
-    if (!clone)
-        return 0;
-
-    if (namedAttrMap)
-        clone->attributes()->setAttributes(*namedAttrMap);
-
-    clone->copyNonAttributeProperties(this);
-
-    if (deep)
-        cloneChildNodes(clone.get());
-
-    return clone.release();
-}
-
 bool HTMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == alignAttr ||
@@ -158,75 +146,75 @@ void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
     }
 // standard events
     else if (attr->name() == onclickAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().clickEvent, attr);
+        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncontextmenuAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().contextmenuEvent, attr);
+        setAttributeEventListener(eventNames().contextmenuEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondblclickAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dblclickEvent, attr);
+        setAttributeEventListener(eventNames().dblclickEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousedownAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousedownEvent, attr);
+        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousemoveAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousemoveEvent, attr);
+        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseoutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoutEvent, attr);
+        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseoverAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoverEvent, attr);
+        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseupAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseupEvent, attr);
+        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousewheelAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousewheelEvent, attr);
+        setAttributeEventListener(eventNames().mousewheelEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeydownAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keydownEvent, attr);
+        setAttributeEventListener(eventNames().keydownEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeypressAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keypressEvent, attr);
+        setAttributeEventListener(eventNames().keypressEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeyupAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keyupEvent, attr);
+        setAttributeEventListener(eventNames().keyupEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onscrollAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
+        setAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforecutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforecutEvent, attr);
+        setAttributeEventListener(eventNames().beforecutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().cutEvent, attr);
+        setAttributeEventListener(eventNames().cutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforecopyAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforecopyEvent, attr);
+        setAttributeEventListener(eventNames().beforecopyEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncopyAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().copyEvent, attr);
+        setAttributeEventListener(eventNames().copyEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforepasteAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforepasteEvent, attr);
+        setAttributeEventListener(eventNames().beforepasteEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onpasteAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().pasteEvent, attr);
+        setAttributeEventListener(eventNames().pasteEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragenterAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragenterEvent, attr);
+        setAttributeEventListener(eventNames().dragenterEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragoverAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragoverEvent, attr);
+        setAttributeEventListener(eventNames().dragoverEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragleaveAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragleaveEvent, attr);
+        setAttributeEventListener(eventNames().dragleaveEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondropAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dropEvent, attr);
+        setAttributeEventListener(eventNames().dropEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragstartEvent, attr);
+        setAttributeEventListener(eventNames().dragstartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragEvent, attr);
+        setAttributeEventListener(eventNames().dragEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragendEvent, attr);
+        setAttributeEventListener(eventNames().dragendEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onselectstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectstartEvent, attr);
+        setAttributeEventListener(eventNames().selectstartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onsubmitAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().submitEvent, attr);
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onerrorAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().errorEvent, attr);
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationStartEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationStartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationiterationAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationIterationEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationIterationEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationEndEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationEndEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkittransitionendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitTransitionEndEvent, attr);
+        setAttributeEventListener(eventNames().webkitTransitionEndEvent, createAttributeEventListener(this, attr));
     }
 }
 
@@ -401,7 +389,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
     }
 
     // FIXME: Do we need to be able to detect preserveNewline style even when there's no renderer?
-    // FIXME: Can the renderer be out of date here? Do we need to call updateRendering?
+    // FIXME: Can the renderer be out of date here? Do we need to call updateStyleIfNeeded?
     // For example, for the contents of textarea elements that are display:none?
     RenderObject* r = renderer();
     if (r && r->style()->preserveNewline()) {
@@ -618,7 +606,7 @@ bool HTMLElement::isContentEditable() const
 
     // FIXME: this is a terrible thing to do here:
     // https://bugs.webkit.org/show_bug.cgi?id=21834
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer()) {
         if (parentNode())
@@ -635,7 +623,7 @@ bool HTMLElement::isContentRichlyEditable() const
     if (document()->frame() && document()->frame()->isContentEditable())
         return true;
 
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer()) {
         if (parentNode())
@@ -649,7 +637,7 @@ bool HTMLElement::isContentRichlyEditable() const
 
 String HTMLElement::contentEditable() const 
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer())
         return "false";
@@ -784,7 +772,7 @@ void HTMLElement::setTabIndex(int value)
 
 PassRefPtr<HTMLCollection> HTMLElement::children()
 {
-    return HTMLCollection::create(this, HTMLCollection::NodeChildren);
+    return HTMLCollection::create(this, NodeChildren);
 }
 
 // DOM Section 1.1.1
@@ -829,7 +817,7 @@ bool HTMLElement::isRecognizedTagName(const QualifiedName& tagName)
 
 // The terms inline and block are used here loosely.  Don't make the mistake of assuming all inlines or all blocks
 // need to be in these two lists.
-HashSet<AtomicStringImpl*>* inlineTagList()
+static HashSet<AtomicStringImpl*>* inlineTagList()
 {
     DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, tagList, ());
     if (tagList.isEmpty()) {
@@ -888,7 +876,7 @@ HashSet<AtomicStringImpl*>* inlineTagList()
     return &tagList;
 }
 
-HashSet<AtomicStringImpl*>* blockTagList()
+static HashSet<AtomicStringImpl*>* blockTagList()
 {
     DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, tagList, ());
     if (tagList.isEmpty()) {
@@ -937,8 +925,18 @@ bool HTMLElement::inEitherTagList(const Node* newChild)
         
     if (newChild->isHTMLElement()) {
         const HTMLElement* child = static_cast<const HTMLElement*>(newChild);
-        if (inlineTagList()->contains(child->tagQName().localName().impl()))
+        if (inlineTagList()->contains(child->tagQName().localName().impl())) {
+#if PLATFORM(MAC)
+            if (child->tagQName().localName() == styleTag) {
+                // Leopard Mail doesn't expect <style> to be in the body of the document, so don't allow it in that case.
+                // See <rdar://problem/6621310>
+                Settings* settings = newChild->document() ? newChild->document()->settings() : 0;
+                if (settings && settings->needsLeopardMailQuirks())
+                    return false;
+            }
+#endif
             return true;
+        }
         if (blockTagList()->contains(child->tagQName().localName().impl()))
             return true;
         return !isRecognizedTagName(child->tagQName()); // Accept custom html tags
@@ -984,12 +982,14 @@ bool HTMLElement::checkDTD(const Node* newChild)
     
 bool HTMLElement::rendererIsNeeded(RenderStyle *style)
 {
+#if !ENABLE(XHTMLMP)
     if (hasLocalName(noscriptTag)) {
         Settings* settings = document()->settings();
         if (settings && settings->isJavaScriptEnabled())
             return false;
     }
-    return (document()->documentElement() == this) || (style->display() != NONE);
+#endif
+    return StyledElement::rendererIsNeeded(style);
 }
     
 RenderObject* HTMLElement::createRenderer(RenderArena* arena, RenderStyle* style)
@@ -1015,6 +1015,10 @@ HTMLFormElement* HTMLElement::virtualForm() const
 } // namespace WebCore
 
 #ifndef NDEBUG
+
+// For use in the debugger
+void dumpInnerHTML(WebCore::HTMLElement*);
+
 void dumpInnerHTML(WebCore::HTMLElement* element)
 {
     printf("%s\n", element->innerHTML().ascii().data());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.h b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
index 59ccde75d6..60152cd3e7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
@@ -45,8 +45,6 @@ public:
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    virtual PassRefPtr<Node> cloneNode(bool deep);
-
     PassRefPtr<HTMLCollection> children();
     
     String id() const;
@@ -85,8 +83,6 @@ public:
 
     virtual void accessKeyAction(bool sendToAnyElement);
 
-    virtual bool isGenericFormElement() const { return false; }
-
     virtual HTMLTagStatus endTagRequirement() const;
     virtual int tagPriority() const;
     virtual bool childAllowed(Node* newChild); // Error-checking during parsing that checks the DTD
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
index 8ce5542d46..ed21628c0b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
@@ -36,8 +36,6 @@ module html {
                  attribute [ConvertNullToNullString] DOMString className;
 
                  attribute long            tabIndex;
-                 void                      blur();
-                 void                      focus();
 
         // Extensions
                  attribute [ConvertNullToNullString] DOMString innerHTML
@@ -64,7 +62,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString contentEditable;
         readonly attribute boolean isContentEditable;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString titleDisplayString;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.cpp
deleted file mode 100644
index c7fee2869f..0000000000
--- a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.cpp
+++ /dev/null
@@ -1,509 +0,0 @@
-/*
- * This file is part of the HTML DOM implementation for KDE.
- *
- * Copyright (C) 2005 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "HTMLElementFactory.h"
-
-#include "HTMLAnchorElement.h"
-#include "HTMLAppletElement.h"
-#include "HTMLAreaElement.h"
-#include "HTMLAudioElement.h"
-#include "HTMLBRElement.h"
-#include "HTMLBaseElement.h"
-#include "HTMLBaseFontElement.h"
-#include "HTMLBlockquoteElement.h"
-#include "HTMLBodyElement.h"
-#include "HTMLButtonElement.h"
-#include "HTMLCanvasElement.h"
-#include "HTMLDListElement.h"
-#include "HTMLDirectoryElement.h"
-#include "HTMLDivElement.h"
-#include "HTMLDocument.h"
-#include "HTMLEmbedElement.h"
-#include "HTMLFieldSetElement.h"
-#include "HTMLFontElement.h"
-#include "HTMLFormElement.h"
-#include "HTMLFrameElement.h"
-#include "HTMLFrameSetElement.h"
-#include "HTMLHRElement.h"
-#include "HTMLHeadElement.h"
-#include "HTMLHeadingElement.h"
-#include "HTMLHtmlElement.h"
-#include "HTMLIFrameElement.h"
-#include "HTMLImageElement.h"
-#include "HTMLIsIndexElement.h"
-#include "HTMLKeygenElement.h"
-#include "HTMLLIElement.h"
-#include "HTMLLabelElement.h"
-#include "HTMLLegendElement.h"
-#include "HTMLLinkElement.h"
-#include "HTMLMapElement.h"
-#include "HTMLMarqueeElement.h"
-#include "HTMLMenuElement.h"
-#include "HTMLMetaElement.h"
-#include "HTMLModElement.h"
-#include "HTMLNames.h"
-#include "HTMLOListElement.h"
-#include "HTMLObjectElement.h"
-#include "HTMLOptGroupElement.h"
-#include "HTMLOptionElement.h"
-#include "HTMLParagraphElement.h"
-#include "HTMLParamElement.h"
-#include "HTMLPreElement.h"
-#include "HTMLQuoteElement.h"
-#include "HTMLScriptElement.h"
-#include "HTMLSelectElement.h"
-#include "HTMLSourceElement.h"
-#include "HTMLStyleElement.h"
-#include "HTMLTableCaptionElement.h"
-#include "HTMLTableCellElement.h"
-#include "HTMLTableColElement.h"
-#include "HTMLTableElement.h"
-#include "HTMLTableRowElement.h"
-#include "HTMLTableSectionElement.h"
-#include "HTMLTextAreaElement.h"
-#include "HTMLTitleElement.h"
-#include "HTMLUListElement.h"
-#include "HTMLVideoElement.h"
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-typedef PassRefPtr<HTMLElement> (*ConstructorFunc)(const QualifiedName& tagName, Document*, HTMLFormElement*, bool createdByParser);
-typedef HashMap<AtomicStringImpl*, ConstructorFunc> FunctionMap;
-static FunctionMap* gFunctionMap;
-
-static PassRefPtr<HTMLElement> htmlConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHtmlElement(htmlTag, doc);
-}
-
-static PassRefPtr<HTMLElement> headConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHeadElement(headTag, doc);
-}
-
-static PassRefPtr<HTMLElement> bodyConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBodyElement(bodyTag, doc);
-}
-
-static PassRefPtr<HTMLElement> baseConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBaseElement(baseTag, doc);
-}
-
-static PassRefPtr<HTMLElement> linkConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLLinkElement(linkTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> metaConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMetaElement(metaTag, doc);
-}
-
-static PassRefPtr<HTMLElement> styleConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLStyleElement(styleTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> titleConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTitleElement(titleTag, doc);
-}
-
-static PassRefPtr<HTMLElement> frameConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLFrameElement(frameTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> framesetConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLFrameSetElement(framesetTag, doc);
-}
-
-static PassRefPtr<HTMLElement> iframeConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLIFrameElement(iframeTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> formConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLFormElement(formTag, doc);
-}
-
-static PassRefPtr<HTMLElement> buttonConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLButtonElement(buttonTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> inputConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLInputElement(inputTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> isindexConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLIsIndexElement(isindexTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> fieldsetConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLFieldSetElement(fieldsetTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> keygenConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLKeygenElement(keygenTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> labelConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLLabelElement(labelTag, doc);
-}
-
-static PassRefPtr<HTMLElement> legendConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLLegendElement(legendTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> optgroupConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLOptGroupElement(optgroupTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> optionConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLOptionElement(optionTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> selectConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLSelectElement(selectTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> textareaConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLTextAreaElement(textareaTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> dlConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLDListElement(dlTag, doc);
-}
-
-static PassRefPtr<HTMLElement> ulConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLUListElement(ulTag, doc);
-}
-
-static PassRefPtr<HTMLElement> olConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLOListElement(olTag, doc);
-}
-
-static PassRefPtr<HTMLElement> dirConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLDirectoryElement(dirTag, doc);
-}
-
-static PassRefPtr<HTMLElement> menuConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMenuElement(menuTag, doc);
-}
-
-static PassRefPtr<HTMLElement> liConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLLIElement(liTag, doc);
-}
-
-static PassRefPtr<HTMLElement> blockquoteConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBlockquoteElement(blockquoteTag, doc);
-}
-
-static PassRefPtr<HTMLElement> divConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLDivElement(divTag, doc);
-}
-
-static PassRefPtr<HTMLElement> headingConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHeadingElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> hrConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHRElement(hrTag, doc);
-}
-
-static PassRefPtr<HTMLElement> paragraphConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLParagraphElement(pTag, doc);
-}
-
-static PassRefPtr<HTMLElement> preConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLPreElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> basefontConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBaseFontElement(basefontTag, doc);
-}
-
-static PassRefPtr<HTMLElement> fontConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLFontElement(fontTag, doc);
-}
-
-static PassRefPtr<HTMLElement> modConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLModElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> anchorConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLAnchorElement(aTag, doc);
-}
-
-static PassRefPtr<HTMLElement> imageConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLImageElement(imgTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> mapConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMapElement(mapTag, doc);
-}
-
-static PassRefPtr<HTMLElement> areaConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLAreaElement(areaTag, doc);
-}
-
-static PassRefPtr<HTMLElement> canvasConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLCanvasElement(canvasTag, doc);
-}
-
-static PassRefPtr<HTMLElement> appletConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLAppletElement(appletTag, doc);
-}
-
-static PassRefPtr<HTMLElement> embedConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLEmbedElement(embedTag, doc);
-}
-
-static PassRefPtr<HTMLElement> objectConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLObjectElement(objectTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLParamElement(paramTag, doc);
-}
-
-static PassRefPtr<HTMLElement> scriptConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLScriptElement(scriptTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> tableConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableElement(tableTag, doc);
-}
-
-static PassRefPtr<HTMLElement> tableCaptionConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableCaptionElement(captionTag, doc);
-}
-
-static PassRefPtr<HTMLElement> tableColConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableColElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> tableRowConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableRowElement(trTag, doc);
-}
-
-static PassRefPtr<HTMLElement> tableCellConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableCellElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> tableSectionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableSectionElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> brConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBRElement(brTag, doc);
-}
-
-static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLQuoteElement(qTag, doc);
-}
-
-static PassRefPtr<HTMLElement> marqueeConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMarqueeElement(marqueeTag, doc);
-}
-
-#if ENABLE(VIDEO)
-static PassRefPtr<HTMLElement> audioConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLAudioElement(audioTag, doc);
-}
-
-static PassRefPtr<HTMLElement> videoConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLVideoElement(videoTag, doc);
-}
-
-static PassRefPtr<HTMLElement> sourceConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLSourceElement(sourceTag, doc);
-}
-#endif
-
-static void addTag(const QualifiedName& tag, ConstructorFunc func)
-{
-    gFunctionMap->set(tag.localName().impl(), func);
-}
-
-static void createFunctionMap()
-{
-    // Create the table.
-    gFunctionMap = new FunctionMap;
-    
-    // Populate it with constructor functions.
-    addTag(aTag, anchorConstructor);
-    addTag(appletTag, appletConstructor);
-    addTag(areaTag, areaConstructor);
-    addTag(baseTag, baseConstructor);
-    addTag(basefontTag, basefontConstructor);
-    addTag(blockquoteTag, blockquoteConstructor);
-    addTag(bodyTag, bodyConstructor);
-    addTag(brTag, brConstructor);
-    addTag(buttonTag, buttonConstructor);
-    addTag(canvasTag, canvasConstructor);
-    addTag(captionTag, tableCaptionConstructor);
-    addTag(colTag, tableColConstructor);
-    addTag(colgroupTag, tableColConstructor);
-    addTag(delTag, modConstructor);
-    addTag(dirTag, dirConstructor);
-    addTag(divTag, divConstructor);
-    addTag(dlTag, dlConstructor);
-    addTag(embedTag, embedConstructor);
-    addTag(fieldsetTag, fieldsetConstructor);
-    addTag(fontTag, fontConstructor);
-    addTag(formTag, formConstructor);
-    addTag(frameTag, frameConstructor);
-    addTag(framesetTag, framesetConstructor);
-    addTag(h1Tag, headingConstructor);
-    addTag(h2Tag, headingConstructor);
-    addTag(h3Tag, headingConstructor);
-    addTag(h4Tag, headingConstructor);
-    addTag(h5Tag, headingConstructor);
-    addTag(h6Tag, headingConstructor);
-    addTag(headTag, headConstructor);
-    addTag(hrTag, hrConstructor);
-    addTag(htmlTag, htmlConstructor);
-    addTag(iframeTag, iframeConstructor);
-    addTag(imageTag, imageConstructor);
-    addTag(imgTag, imageConstructor);
-    addTag(inputTag, inputConstructor);
-    addTag(insTag, modConstructor);
-    addTag(isindexTag, isindexConstructor);
-    addTag(keygenTag, keygenConstructor);
-    addTag(labelTag, labelConstructor);
-    addTag(legendTag, legendConstructor);
-    addTag(liTag, liConstructor);
-    addTag(linkTag, linkConstructor);
-    addTag(listingTag, preConstructor);
-    addTag(mapTag, mapConstructor);
-    addTag(marqueeTag, marqueeConstructor);
-    addTag(menuTag, menuConstructor);
-    addTag(metaTag, metaConstructor);
-    addTag(objectTag, objectConstructor);
-    addTag(olTag, olConstructor);
-    addTag(optgroupTag, optgroupConstructor);
-    addTag(optionTag, optionConstructor);
-    addTag(pTag, paragraphConstructor);
-    addTag(paramTag, paramConstructor);
-    addTag(preTag, preConstructor);
-    addTag(qTag, quoteConstructor);
-    addTag(scriptTag, scriptConstructor);
-    addTag(selectTag, selectConstructor);
-    addTag(styleTag, styleConstructor);
-    addTag(tableTag, tableConstructor);
-    addTag(tbodyTag, tableSectionConstructor);
-    addTag(tdTag, tableCellConstructor);
-    addTag(textareaTag, textareaConstructor);
-    addTag(tfootTag, tableSectionConstructor);
-    addTag(thTag, tableCellConstructor);
-    addTag(theadTag, tableSectionConstructor);
-    addTag(titleTag, titleConstructor);
-    addTag(trTag, tableRowConstructor);
-    addTag(ulTag, ulConstructor);
-    addTag(xmpTag, preConstructor);
-#if ENABLE(VIDEO)
-    addTag(audioTag, audioConstructor);
-    addTag(sourceTag, sourceConstructor);
-    addTag(videoTag, videoConstructor);
-#endif
-}
-
-PassRefPtr<HTMLElement> HTMLElementFactory::createHTMLElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* form, bool createdByParser)
-{
-    if (!doc)
-        return 0; // Don't allow elements to ever be made without having a doc.
-
-    if (!gFunctionMap)
-        createFunctionMap();
-
-    ConstructorFunc func = gFunctionMap->get(tagName.localName().impl());
-    if (func)
-        return func(tagName, doc, form, createdByParser);
-
-    // elements with no special representation in the DOM
-    return new HTMLElement(tagName, doc);
-}
-
-}
-
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.h b/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.h
deleted file mode 100644
index 539d07080c..0000000000
--- a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * This file is part of the HTML DOM implementation for KDE.
- *
- * Copyright (C) 2005, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef HTMLElementFactory_h
-#define HTMLElementFactory_h
-
-#include <wtf/Forward.h>
-
-namespace WebCore {
-
-class AtomicString;
-class Document;
-class Element;
-class HTMLElement;
-class HTMLFormElement;
-class QualifiedName;
-
-// The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense elements.
-// In a compound document world, the generic createElement function (will end up being virtual) will be called.
-class HTMLElementFactory {
-public:
-    PassRefPtr<Element> createElement(const QualifiedName&, Document*, bool createdByParser = true);
-    static PassRefPtr<HTMLElement> createHTMLElement(const QualifiedName& tagName, Document*, HTMLFormElement* = 0, bool createdByParser = true);
-};
-
-}
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp
new file mode 100644
index 0000000000..dad548c23d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following disclaimer
+ *       in the documentation and/or other materials provided with the
+ *       distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This source file coalesces the HTML elements into a single object file to
+// reduce bloat and allow us to link release builds on 32-bit Windows.
+
+#include "HTMLAnchorElement.cpp"
+#include "HTMLAppletElement.cpp"
+#include "HTMLAreaElement.cpp"
+#include "HTMLAudioElement.cpp"
+#include "HTMLBRElement.cpp"
+#include "HTMLBaseElement.cpp"
+#include "HTMLBaseFontElement.cpp"
+#include "HTMLBlockquoteElement.cpp"
+#include "HTMLBodyElement.cpp"
+#include "HTMLButtonElement.cpp"
+#include "HTMLCanvasElement.cpp"
+#include "HTMLDListElement.cpp"
+#include "HTMLDirectoryElement.cpp"
+#include "HTMLDivElement.cpp"
+#include "HTMLElement.cpp"
+#include "HTMLEmbedElement.cpp"
+#include "HTMLFieldSetElement.cpp"
+#include "HTMLFontElement.cpp"
+#include "HTMLFormControlElement.cpp"
+#include "HTMLFormElement.cpp"
+#include "HTMLFrameElement.cpp"
+#include "HTMLFrameElementBase.cpp"
+#include "HTMLFrameOwnerElement.cpp"
+#include "HTMLFrameSetElement.cpp"
+#include "HTMLHRElement.cpp"
+#include "HTMLHeadElement.cpp"
+#include "HTMLHeadingElement.cpp"
+#include "HTMLHtmlElement.cpp"
+#include "HTMLIFrameElement.cpp"
+#include "HTMLImageElement.cpp"
+#include "HTMLInputElement.cpp"
+#include "HTMLIsIndexElement.cpp"
+#include "HTMLKeygenElement.cpp"
+#include "HTMLLIElement.cpp"
+#include "HTMLLabelElement.cpp"
+#include "HTMLLegendElement.cpp"
+#include "HTMLLinkElement.cpp"
+#include "HTMLMapElement.cpp"
+#include "HTMLMarqueeElement.cpp"
+#include "HTMLMediaElement.cpp"
+#include "HTMLMenuElement.cpp"
+#include "HTMLMetaElement.cpp"
+#include "HTMLModElement.cpp"
+#include "HTMLOListElement.cpp"
+#include "HTMLObjectElement.cpp"
+#include "HTMLOptGroupElement.cpp"
+#include "HTMLOptionElement.cpp"
+#include "HTMLParagraphElement.cpp"
+#include "HTMLParamElement.cpp"
+#include "HTMLPlugInElement.cpp"
+#include "HTMLPlugInImageElement.cpp"
+#include "HTMLPreElement.cpp"
+#include "HTMLQuoteElement.cpp"
+#include "HTMLScriptElement.cpp"
+#include "HTMLSelectElement.cpp"
+#include "HTMLSourceElement.cpp"
+#include "HTMLStyleElement.cpp"
+#include "HTMLTableCaptionElement.cpp"
+#include "HTMLTableCellElement.cpp"
+#include "HTMLTableColElement.cpp"
+#include "HTMLTableElement.cpp"
+#include "HTMLTablePartElement.cpp"
+#include "HTMLTableRowElement.cpp"
+#include "HTMLTableSectionElement.cpp"
+#include "HTMLTextAreaElement.cpp"
+#include "HTMLTitleElement.cpp"
+#include "HTMLUListElement.cpp"
+#include "HTMLVideoElement.cpp"
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
index 1af7147afc..2500dd6f6c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
@@ -31,10 +31,12 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
+#include "Settings.h"
 
 namespace WebCore {
 
@@ -137,7 +139,15 @@ bool HTMLEmbedElement::rendererIsNeeded(RenderStyle* style)
         return false;
     }
 
-    return true;
+#if ENABLE(DASHBOARD_SUPPORT)
+    // Workaround for <rdar://problem/6642221>. 
+    if (Settings* settings = frame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode())
+            return true;
+    }
+#endif
+
+    return HTMLPlugInElement::rendererIsNeeded(style);
 }
 
 RenderObject* HTMLEmbedElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -164,13 +174,13 @@ void HTMLEmbedElement::attach()
         m_imageLoader->updateFromElement();
 
         if (renderer())
-            static_cast<RenderImage*>(renderer())->setCachedImage(m_imageLoader->image());
+            toRenderImage(renderer())->setCachedImage(m_imageLoader->image());
     }
 }
 
 void HTMLEmbedElement::updateWidget()
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !isImageType())
         static_cast<RenderPartObject*>(renderer())->updateWidget(true);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
index 10c30078f5..ecf8a96eb2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
@@ -30,7 +30,7 @@ module html {
         ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
     ] HTMLEmbedElement : HTMLElement {
                  attribute [ConvertNullToNullString] DOMString align;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString height;
 #else
                  attribute [ConvertFromString] long height;
@@ -38,18 +38,20 @@ module html {
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [ConvertNullToNullString] DOMString src;
                  attribute [ConvertNullToNullString] DOMString type;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString width;
 #else
                  attribute [ConvertFromString] long width;
 #endif
 
-#if !defined(LANGUAGE_COM)
-#if ENABLE_SVG
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
index d90550d82d..eb8d4ed5c0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
@@ -53,7 +53,7 @@ bool HTMLFieldSetElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLFieldSetElement::type() const
+const AtomicString& HTMLFieldSetElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, fieldset, ("fieldset"));
     return fieldset;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
index 9a6cff1b76..e79f2c5469 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
@@ -46,7 +46,7 @@ public:
 
     virtual bool isFocusable() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
     virtual bool willValidate() const { return false; }
 };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp
index 91b6448dd0..d19032a657 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp
@@ -26,6 +26,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 using namespace WTF;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
index 03796d645a..812d98a428 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "HTMLFormCollection.h"
 
+#include "CollectionCache.h"
 #include "HTMLFormControlElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLImageElement.h"
@@ -35,15 +36,15 @@ using namespace HTMLNames;
 // Since the collections are to be "live", we have to do the
 // calculation every time if anything has changed.
 
-inline HTMLCollection::CollectionInfo* HTMLFormCollection::formCollectionInfo(HTMLFormElement* form)
+inline CollectionCache* HTMLFormCollection::formCollectionInfo(HTMLFormElement* form)
 {
     if (!form->collectionInfo)
-        form->collectionInfo = new CollectionInfo;
+        form->collectionInfo = new CollectionCache;
     return form->collectionInfo;
 }
 
 HTMLFormCollection::HTMLFormCollection(PassRefPtr<HTMLFormElement> form)
-    : HTMLCollection(form.get(), Other, formCollectionInfo(form.get()))
+    : HTMLCollection(form.get(), OtherCollection, formCollectionInfo(form.get()))
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h
index 524a59b037..a204446f23 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h
@@ -51,7 +51,7 @@ private:
     virtual void updateNameCache() const;
     virtual unsigned calcLength() const;
 
-    static CollectionInfo* formCollectionInfo(HTMLFormElement*);
+    static CollectionCache* formCollectionInfo(HTMLFormElement*);
 
     Element* getNamedItem(const QualifiedName& attrName, const AtomicString& name) const;
     Element* nextNamedItemInternal(const String& name) const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
index 28a77aafbc..36d20ac574 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
@@ -34,6 +34,8 @@
 #include "HTMLNames.h"
 #include "HTMLParser.h"
 #include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
+#include "RenderBox.h"
 #include "RenderTheme.h"
 
 namespace WebCore {
@@ -67,7 +69,7 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
         if (oldDisabled != m_disabled) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
                 theme()->stateChanged(renderer(), EnabledState);
         }
@@ -75,7 +77,7 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
         bool oldReadOnly = m_readOnly;
         m_readOnly = !attr->isNull();
         if (oldReadOnly != m_readOnly) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
                 theme()->stateChanged(renderer(), ReadOnlyState);
         }
@@ -98,8 +100,12 @@ void HTMLFormControlElement::attach()
     // Focus the element if it should honour its autofocus attribute.
     // We have to determine if the element is a TextArea/Input/Button/Select,
     // if input type hidden ignore autofocus. So if disabled or readonly.
-    if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyControl() &&
-            ((hasTagName(inputTag) && !isInputTypeHidden()) || hasTagName(selectTag) ||
+    bool isInputTypeHidden = false;
+    if (hasTagName(inputTag))
+        isInputTypeHidden = static_cast<HTMLInputElement*>(this)->isInputTypeHidden();
+
+    if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyFormControl() &&
+            ((hasTagName(inputTag) && !isInputTypeHidden) || hasTagName(selectTag) ||
               hasTagName(buttonTag) || hasTagName(textareaTag)))
          focus();
 }
@@ -146,7 +152,7 @@ void HTMLFormControlElement::removedFromTree(bool deep)
     HTMLElement::removedFromTree(deep);
 }
 
-const AtomicString& HTMLFormControlElement::name() const
+const AtomicString& HTMLFormControlElement::formControlName() const
 {
     const AtomicString& n = getAttribute(nameAttr);
     return n.isNull() ? emptyAtom : n;
@@ -157,9 +163,9 @@ void HTMLFormControlElement::setName(const AtomicString &value)
     setAttribute(nameAttr, value);
 }
 
-void HTMLFormControlElement::onChange()
+void HTMLFormControlElement::dispatchFormControlChangeEvent()
 {
-    dispatchEventForType(eventNames().changeEvent, true, false);
+    dispatchEvent(eventNames().changeEvent, true, false);
 }
 
 bool HTMLFormControlElement::disabled() const
@@ -199,7 +205,7 @@ bool HTMLFormControlElement::isFocusable() const
 {
     if (disabled() || !renderer() || 
         (renderer()->style() && renderer()->style()->visibility() != VISIBLE) || 
-        renderer()->width() == 0 || renderer()->height() == 0)
+        !renderer()->isBox() || toRenderBox(renderer())->size().isEmpty())
         return false;
     return true;
 }
@@ -233,7 +239,7 @@ bool HTMLFormControlElement::willValidate() const
     //      The control does not have a repetition template as an ancestor.
     //      The control does not have a datalist element as an ancestor.
     //      The control is not an output element.
-    return form() && name().length() && !disabled() && !isReadOnlyControl();
+    return form() && name().length() && !disabled() && !isReadOnlyFormControl();
 }
     
 bool HTMLFormControlElement::supportsFocus() const
@@ -257,7 +263,7 @@ void HTMLFormControlElement::removeFromForm()
 HTMLFormControlElementWithState::HTMLFormControlElementWithState(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElement(tagName, doc, f)
 {
-    doc->registerFormElementWithState(this);
+    document()->registerFormElementWithState(this);
 }
 
 HTMLFormControlElementWithState::~HTMLFormControlElementWithState()
@@ -284,7 +290,7 @@ void HTMLFormControlElementWithState::finishParsingChildren()
     if (doc->hasStateForNewFormElements()) {
         String state;
         if (doc->takeStateForFormElement(name().impl(), type().impl(), state))
-            restoreState(state);
+            restoreFormControlState(state);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
index bdcc085d8a..0a7bbd1cfd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
@@ -24,7 +24,6 @@
 #ifndef HTMLFormControlElement_h
 #define HTMLFormControlElement_h
 
-#include "FormControlElement.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
@@ -32,7 +31,7 @@ namespace WebCore {
 class FormDataList;
 class HTMLFormElement;
 
-class HTMLFormControlElement : public HTMLElement, public FormControlElement {
+class HTMLFormControlElement : public HTMLElement {
 public:
     HTMLFormControlElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
     virtual ~HTMLFormControlElement();
@@ -42,10 +41,8 @@ public:
 
     HTMLFormElement* form() const { return m_form; }
 
-    virtual const AtomicString& type() const = 0;
-
-    virtual bool isControl() const { return true; }
-    virtual bool isEnabled() const { return !disabled(); }
+    virtual bool isTextFormControl() const { return false; }
+    virtual bool isEnabledFormControl() const { return !disabled(); }
 
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void attach();
@@ -54,10 +51,10 @@ public:
 
     virtual void reset() {}
 
-    virtual bool valueMatchesRenderer() const { return m_valueMatchesRenderer; }
-    virtual void setValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
+    virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
+    virtual void setFormControlValueMatchesRenderer(bool b) { m_valueMatchesRenderer = b; }
 
-    void onChange();
+    virtual void dispatchFormControlChangeEvent();
 
     bool disabled() const;
     void setDisabled(bool);
@@ -68,7 +65,7 @@ public:
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const { return false; }
 
-    virtual bool isReadOnlyControl() const { return m_readOnly; }
+    virtual bool isReadOnlyFormControl() const { return m_readOnly; }
     void setReadOnly(bool);
 
     // Determines whether or not a control will be automatically focused
@@ -77,10 +74,15 @@ public:
 
     virtual void recalcStyle(StyleChange);
 
-    virtual const AtomicString& name() const;
+    virtual const AtomicString& formControlName() const;
+    virtual const AtomicString& formControlType() const = 0;
+
+    const AtomicString& type() const { return formControlType(); }
+    const AtomicString& name() const { return formControlName(); }
+
     void setName(const AtomicString& name);
 
-    virtual bool isGenericFormElement() const { return true; }
+    virtual bool isFormControlElement() const { return true; }
     virtual bool isRadioButton() const { return false; }
 
     /* Override in derived classes to get the encoded name=value pair for submitting.
@@ -117,14 +119,9 @@ public:
 
     virtual void finishParsingChildren();
 
-    virtual bool saveState(String& value) const = 0;
-
 protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
-
-private:
-    virtual void restoreState(const String& value) = 0;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
index e039081c66..64cac37fec 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -34,6 +34,7 @@
 #include "FileSystem.h"
 #include "FormData.h"
 #include "FormDataList.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
@@ -41,26 +42,34 @@
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderTextControl.h"
-#include <wtf/RandomNumber.h>
-
 #include <limits>
+#include <wtf/CurrentTime.h>
+#include <wtf/RandomNumber.h>
 
 #if PLATFORM(WX)
 #include <wx/defs.h>
 #include <wx/filename.h>
 #endif
 
-#if PLATFORM(WIN_OS)
-#include <shlwapi.h>
-#endif
+using namespace std;
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
+static int64_t generateFormDataIdentifier()
+{
+    // Initialize to the current time to reduce the likelihood of generating
+    // identifiers that overlap with those from past/future browser sessions.
+    static int64_t nextIdentifier = static_cast<int64_t>(currentTime() * 1000000.0);
+    return ++nextIdentifier;
+}
+
 HTMLFormElement::HTMLFormElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
     , m_elementAliases(0)
@@ -70,6 +79,7 @@ HTMLFormElement::HTMLFormElement(const QualifiedName& tagName, Document* doc)
     , m_doingsubmit(false)
     , m_inreset(false)
     , m_malformed(false)
+    , m_demoted(false)
 {
     ASSERT(hasTagName(formTag));
 }
@@ -98,6 +108,31 @@ void HTMLFormElement::attach()
     HTMLElement::attach();
 }
 
+bool HTMLFormElement::rendererIsNeeded(RenderStyle* style)
+{
+    if (!isDemoted())
+        return HTMLElement::rendererIsNeeded(style);
+    
+    Node* node = parentNode();
+    RenderObject* parentRenderer = node->renderer();
+    bool parentIsTableElementPart = (parentRenderer->isTable() && node->hasTagName(tableTag))
+        || (parentRenderer->isTableRow() && node->hasTagName(trTag))
+        || (parentRenderer->isTableSection() && node->hasTagName(tbodyTag))
+        || (parentRenderer->isTableCol() && node->hasTagName(colTag)) 
+        || (parentRenderer->isTableCell() && node->hasTagName(trTag));
+
+    if (!parentIsTableElementPart)
+        return true;
+
+    EDisplay display = style->display();
+    bool formIsTablePart = display == TABLE || display == INLINE_TABLE || display == TABLE_ROW_GROUP
+        || display == TABLE_HEADER_GROUP || display == TABLE_FOOTER_GROUP || display == TABLE_ROW
+        || display == TABLE_COLUMN_GROUP || display == TABLE_COLUMN || display == TABLE_CELL
+        || display == TABLE_CAPTION;
+
+    return formIsTablePart;
+}
+
 void HTMLFormElement::insertedIntoDocument()
 {
     if (document()->isHTMLDocument())
@@ -116,7 +151,7 @@ void HTMLFormElement::removedFromDocument()
 
 void HTMLFormElement::handleLocalEvents(Event* event, bool useCapture)
 {
-    EventTargetNode* targetNode = event->target()->toNode();
+    Node* targetNode = event->target()->toNode();
     if (!useCapture && targetNode && targetNode != this && (event->type() == eventNames().submitEvent || event->type() == eventNames().resetEvent)) {
         event->stopPropagation();
         return;
@@ -202,7 +237,8 @@ PassRefPtr<FormData> HTMLFormElement::createFormData(const CString& boundary)
                         if (!path.isEmpty()) {
                             if (Page* page = document()->page()) {
                                 String generatedFileName;
-                                if (shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(path, generatedFileName))
+                                shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(path, generatedFileName);
+                                if (shouldGenerateFile)
                                     fileName = generatedFileName;
                             }
                         }
@@ -240,6 +276,8 @@ PassRefPtr<FormData> HTMLFormElement::createFormData(const CString& boundary)
         m_formDataBuilder.addBoundaryToMultiPartHeader(encodedData, boundary, true);
 
     result->appendData(encodedData.data(), encodedData.size());
+
+    result->setIdentifier(generateFormDataIdentifier());
     return result;
 }
 
@@ -257,7 +295,7 @@ bool HTMLFormElement::prepareSubmit(Event* event)
     m_insubmit = true;
     m_doingsubmit = false;
 
-    if (dispatchEventForType(eventNames().submitEvent, true, true) && !m_doingsubmit)
+    if (dispatchEvent(eventNames().submitEvent, true, true) && !m_doingsubmit)
         m_doingsubmit = true;
 
     m_insubmit = false;
@@ -268,12 +306,29 @@ bool HTMLFormElement::prepareSubmit(Event* event)
     return m_doingsubmit;
 }
 
-void HTMLFormElement::submit()
+static void transferMailtoPostFormDataToURL(RefPtr<FormData>& data, KURL& url, const String& encodingType)
 {
-    submit(0, false);
+    String body = data->flattenToString();
+    data = FormData::create();
+
+    if (equalIgnoringCase(encodingType, "text/plain")) {
+        // Convention seems to be to decode, and s/&/\r\n/. Also, spaces are encoded as %20.
+        body = decodeURLEscapeSequences(body.replace('&', "\r\n").replace('+', ' ') + "\r\n");
+    }
+
+    Vector<char> bodyData;
+    bodyData.append("body=", 5);
+    FormDataBuilder::encodeStringAsFormData(bodyData, body.utf8());
+    body = String(bodyData.data(), bodyData.size()).replace('+', "%20");
+
+    String query = url.query();
+    if (!query.isEmpty())
+        query.append('&');
+    query.append(body);
+    url.setQuery(query);
 }
 
-void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
+void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockHistory, bool lockBackForwardList)
 {
     FrameView* view = document()->view();
     Frame* frame = document()->frame();
@@ -290,14 +345,14 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
     HTMLFormControlElement* firstSuccessfulSubmitButton = 0;
     bool needButtonActivation = activateSubmitButton; // do we need to activate a submit button?
     
-    frame->loader()->clearRecordedFormValues();
-    frame->loader()->setFormAboutToBeSubmitted(this);
+    Vector<pair<String, String> > formValues;
+
     for (unsigned i = 0; i < formElements.size(); ++i) {
         HTMLFormControlElement* control = formElements[i];
         if (control->hasLocalName(inputTag)) {
             HTMLInputElement* input = static_cast<HTMLInputElement*>(control);
             if (input->isTextField()) {
-                frame->loader()->recordFormValue(input->name(), input->value());
+                formValues.append(pair<String, String>(input->name(), input->value()));
                 if (input->isSearchField())
                     input->addSearchResult();
             }
@@ -310,6 +365,8 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
         }
     }
 
+    RefPtr<FormState> formState = FormState::create(this, formValues, frame);
+
     if (needButtonActivation && firstSuccessfulSubmitButton)
         firstSuccessfulSubmitButton->setActivatedSubmit(true);
     
@@ -324,25 +381,22 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
 
         if (!m_formDataBuilder.isMultiPartForm()) {
             RefPtr<FormData> data = createFormData(CString());
+
             if (isMailtoForm()) {
-                String body = data->flattenToString();
-                if (equalIgnoringCase(m_formDataBuilder.encodingType(), "text/plain")) {
-                    // Convention seems to be to decode, and s/&/\r\n/. Also, spaces are encoded as %20.
-                    body = decodeURLEscapeSequences(body.replace('&', "\r\n").replace('+', ' ') + "\r\n");
-                }
-                Vector<char> bodyData;
-                bodyData.append("body=", 5);
-                FormDataBuilder::encodeStringAsFormData(bodyData, body.utf8());
-                data = FormData::create(String(bodyData.data(), bodyData.size()).replace('+', "%20").latin1());
+                // Convert the form data into a string that we put into the URL.
+                KURL url = document()->completeURL(m_url);
+                transferMailtoPostFormDataToURL(data, url, m_formDataBuilder.encodingType());
+                m_url = url.string();
             }
-            frame->loader()->submitForm("POST", m_url, data, m_target, m_formDataBuilder.encodingType(), String(), event);
+
+            frame->loader()->submitForm("POST", m_url, data.release(), m_target, m_formDataBuilder.encodingType(), String(), lockHistory, lockBackForwardList, event, formState.release());
         } else {
             Vector<char> boundary = m_formDataBuilder.generateUniqueBoundaryString();
-            frame->loader()->submitForm("POST", m_url, createFormData(boundary.data()), m_target, m_formDataBuilder.encodingType(), boundary.data(), event);
+            frame->loader()->submitForm("POST", m_url, createFormData(boundary.data()), m_target, m_formDataBuilder.encodingType(), boundary.data(), lockHistory, lockBackForwardList, event, formState.release());
         }
     } else {
         m_formDataBuilder.setIsMultiPartForm(false);
-        frame->loader()->submitForm("GET", m_url, createFormData(CString()), m_target, String(), String(), event);
+        frame->loader()->submitForm("GET", m_url, createFormData(CString()), m_target, String(), String(), lockHistory, lockBackForwardList, event, formState.release());
     }
 
     if (needButtonActivation && firstSuccessfulSubmitButton)
@@ -361,7 +415,7 @@ void HTMLFormElement::reset()
 
     // ### DOM2 labels this event as not cancelable, however
     // common browsers( sick! ) allow it be cancelled.
-    if ( !dispatchEventForType(eventNames().resetEvent,true, true) ) {
+    if ( !dispatchEvent(eventNames().resetEvent,true, true) ) {
         m_inreset = false;
         return;
     }
@@ -395,9 +449,9 @@ void HTMLFormElement::parseMappedAttribute(MappedAttribute* attr)
         else
             document()->unregisterForDocumentActivationCallbacks(this);
     } else if (attr->name() == onsubmitAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().submitEvent, attr);
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onresetAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().resetEvent, attr);
+        setAttributeEventListener(eventNames().resetEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (inDocument() && document()->isHTMLDocument()) {
@@ -432,7 +486,7 @@ unsigned HTMLFormElement::formElementIndex(HTMLFormControlElement* e)
             if (node == e)
                 return i;
             if (node->isHTMLElement()
-                    && static_cast<HTMLElement*>(node)->isGenericFormElement()
+                    && static_cast<Element*>(node)->isFormControlElement()
                     && static_cast<HTMLFormControlElement*>(node)->form() == this)
                 ++i;
         }
@@ -574,68 +628,14 @@ void HTMLFormElement::willMoveToNewOwnerDocument()
 {
     if (!m_autocomplete)
         document()->unregisterForDocumentActivationCallbacks(this);
+    HTMLElement::willMoveToNewOwnerDocument();
 }
 
 void HTMLFormElement::didMoveToNewOwnerDocument()
 {
-    if(m_autocomplete)
+    if (!m_autocomplete)
         document()->registerForDocumentActivationCallbacks(this);
-}
-
-void HTMLFormElement::CheckedRadioButtons::addButton(HTMLFormControlElement* element)
-{
-    // We only want to add radio buttons.
-    if (!element->isRadioButton())
-        return;
-
-    // Without a name, there is no group.
-    if (element->name().isEmpty())
-        return;
-
-    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
-
-    // We only track checked buttons.
-    if (!inputElement->checked())
-        return;
-
-    if (!m_nameToCheckedRadioButtonMap)
-        m_nameToCheckedRadioButtonMap.set(new NameToInputMap);
-
-    pair<NameToInputMap::iterator, bool> result = m_nameToCheckedRadioButtonMap->add(element->name().impl(), inputElement);
-    if (result.second)
-        return;
-    
-    HTMLInputElement* oldCheckedButton = result.first->second;
-    if (oldCheckedButton == inputElement)
-        return;
-
-    result.first->second = inputElement;
-    oldCheckedButton->setChecked(false);
-}
-
-HTMLInputElement* HTMLFormElement::CheckedRadioButtons::checkedButtonForGroup(const AtomicString& name) const
-{
-    if (!m_nameToCheckedRadioButtonMap)
-        return 0;
-    
-    return m_nameToCheckedRadioButtonMap->get(name.impl());
-}
-
-void HTMLFormElement::CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
-{
-    if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
-        return;
-    
-    NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
-    if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
-        return;
-    
-    ASSERT(element->isRadioButton());
-    ASSERT(element->isChecked());
-    
-    m_nameToCheckedRadioButtonMap->remove(it);
-    if (m_nameToCheckedRadioButtonMap->isEmpty())
-        m_nameToCheckedRadioButtonMap.clear();
+    HTMLElement::didMoveToNewOwnerDocument();
 }
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
index ef220434d3..d08e16c62e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,10 +24,9 @@
 #ifndef HTMLFormElement_h
 #define HTMLFormElement_h
 
+#include "CheckedRadioButtons.h"
 #include "FormDataBuilder.h"
-#include "HTMLCollection.h" 
 #include "HTMLElement.h"
-
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -40,6 +39,8 @@ class HTMLInputElement;
 class HTMLFormCollection;
 class TextEncoding;
 
+struct CollectionCache;
+
 class HTMLFormElement : public HTMLElement { 
 public:
     HTMLFormElement(const QualifiedName&, Document*);
@@ -49,6 +50,7 @@ public:
     virtual int tagPriority() const { return 3; }
 
     virtual void attach();
+    virtual bool rendererIsNeeded(RenderStyle*);
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
  
@@ -76,14 +78,16 @@ public:
     void removeImgElement(HTMLImageElement*);
 
     bool prepareSubmit(Event*);
-    void submit();
-    void submit(Event*, bool activateSubmitButton = false);
+    void submit(Event* = 0, bool activateSubmitButton = false, bool lockHistory = false, bool lockBackForwardList = false);
     void reset();
 
     // Used to indicate a malformed state to keep from applying the bottom margin of the form.
     void setMalformed(bool malformed) { m_malformed = malformed; }
     bool isMalformed() const { return m_malformed; }
 
+    void setDemoted(bool demoted) { m_demoted = demoted; }
+    bool isDemoted() const { return m_demoted; }
+
     virtual bool isURLAttribute(Attribute*) const;
     
     void submitClick(Event*);
@@ -110,17 +114,6 @@ public:
     // FIXME: Change this to be private after getting rid of all the clients.
     Vector<HTMLFormControlElement*> formElements;
 
-    class CheckedRadioButtons {
-    public:
-        void addButton(HTMLFormControlElement*);
-        void removeButton(HTMLFormControlElement*);
-        HTMLInputElement* checkedButtonForGroup(const AtomicString& name) const;
-
-    private:
-        typedef HashMap<AtomicStringImpl*, HTMLInputElement*> NameToInputMap;
-        OwnPtr<NameToInputMap> m_nameToCheckedRadioButtonMap;
-    };
-    
     CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
     
     virtual void documentDidBecomeActive();
@@ -141,7 +134,7 @@ private:
 
     FormDataBuilder m_formDataBuilder;
     AliasMap* m_elementAliases;
-    HTMLCollection::CollectionInfo* collectionInfo;
+    CollectionCache* collectionInfo;
 
     CheckedRadioButtons m_checkedRadioButtons;
     
@@ -153,6 +146,7 @@ private:
     bool m_doingsubmit : 1;
     bool m_inreset : 1;
     bool m_malformed : 1;
+    bool m_demoted : 1;
     AtomicString m_name;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
index 39db70c957..f3aca87755 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
@@ -37,7 +37,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString       method;
                  attribute [ConvertNullToNullString] DOMString       target;
         
-        void               submit();
-        void               reset();
+        [Custom] void submit();
+        void reset();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
index 63ec265b4c..adc3ff17c4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
@@ -27,14 +27,15 @@
 #include "Frame.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderFrame.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameElementBase(tagName, doc, createdByParser)
+HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
+    : HTMLFrameElementBase(tagName, document)
     , m_frameBorder(true)
     , m_frameBorderSet(false)
 {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
index 5cd9b92dae..ab602ee92c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
@@ -33,10 +33,9 @@ class RenderObject;
 class RenderArena;
 class RenderStyle;
 
-class HTMLFrameElement : public HTMLFrameElementBase
-{
+class HTMLFrameElement : public HTMLFrameElementBase {
 public:
-    HTMLFrameElement(const QualifiedName&, Document*, bool createdByParser);
+    HTMLFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
index bc512ff46a..106e57e6a2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
@@ -38,15 +38,17 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
                  attribute [ConvertNullToNullString, CustomSetter] DOMString       location;
         readonly attribute long            width;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
index a692d08931..1e09595452 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
@@ -34,7 +34,9 @@
 #include "FrameView.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KURL.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderFrame.h"
 #include "Settings.h"
@@ -43,8 +45,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameOwnerElement(tagName, doc, createdByParser)
+HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Document* document)
+    : HTMLFrameOwnerElement(tagName, document)
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
@@ -140,10 +142,10 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
         if (contentFrame())
             contentFrame()->setInViewSourceMode(viewSourceMode());
     } else if (attr->name() == onloadAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforeunloadAttr) {
         // FIXME: should <frame> elements have beforeunload handlers?
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
 }
@@ -311,7 +313,7 @@ int HTMLFrameElementBase::width() const
         return 0;
     
     document()->updateLayoutIgnorePendingStylesheets();
-    return renderer()->width();
+    return toRenderBox(renderer())->width();
 }
 
 int HTMLFrameElementBase::height() const
@@ -320,7 +322,7 @@ int HTMLFrameElementBase::height() const
         return 0;
     
     document()->updateLayoutIgnorePendingStylesheets();
-    return renderer()->height();
+    return toRenderBox(renderer())->height();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
index 923cd2f8dd..4a2445141c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
@@ -82,7 +82,7 @@ public:
     bool viewSourceMode() const { return m_viewSource; }
 
 protected:
-    HTMLFrameElementBase(const QualifiedName&, Document*, bool createdByParser);
+    HTMLFrameElementBase(const QualifiedName&, Document*);
 
     bool isURLAllowed(const AtomicString&) const;
     void setNameAndOpenURL();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
index 2e16e33a18..a98a3dfedb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -32,10 +32,9 @@
 
 namespace WebCore {
 
-HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document, bool createdByParser)
+HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , m_contentFrame(0)
-    , m_createdByParser(createdByParser)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
index e887be0371..3f50a0265e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
@@ -35,7 +35,7 @@ class SVGDocument;
 
 class HTMLFrameOwnerElement : public HTMLElement {
 protected:
-    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*, bool createdByParser);
+    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
 
 public:
     virtual ~HTMLFrameOwnerElement();
@@ -49,8 +49,6 @@ public:
     virtual bool isFrameOwnerElement() const { return true; }
     virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
     
-    bool createdByParser() const { return m_createdByParser; }
-
     virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
 
 #if ENABLE(SVG)
@@ -60,7 +58,6 @@ public:
 private:
     friend class Frame;
     Frame* m_contentFrame;
-    bool m_createdByParser;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
index dacd32be21..61f9f71874 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
@@ -29,8 +29,9 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "Length.h"
-#include "Length.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "RenderFrameSet.h"
 #include "Text.h"
@@ -88,13 +89,13 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         if (!attr->isNull()) {
             if (m_rows) delete [] m_rows;
             m_rows = newLengthArray(attr->value().string(), m_totalRows);
-            setChanged();
+            setNeedsStyleRecalc();
         }
     } else if (attr->name() == colsAttr) {
         if (!attr->isNull()) {
             delete [] m_cols;
             m_cols = newLengthArray(attr->value().string(), m_totalCols);
-            setChanged();
+            setNeedsStyleRecalc();
         }
     } else if (attr->name() == frameborderAttr) {
         if (!attr->isNull()) {
@@ -125,11 +126,11 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
             m_borderColorSet = true;
         }
     } else if (attr->name() == onloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     } else if (attr->name() == onbeforeunloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     } else if (attr->name() == onunloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
     } else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -186,9 +187,9 @@ void HTMLFrameSetElement::defaultEventHandler(Event* evt)
 
 void HTMLFrameSetElement::recalcStyle(StyleChange ch)
 {
-    if (changed() && renderer()) {
+    if (needsStyleRecalc() && renderer()) {
         renderer()->setNeedsLayout(true);
-        setChanged(NoStyleChange);
+        setNeedsStyleRecalc(NoStyleChange);
     }
     HTMLElement::recalcStyle(ch);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp
index 8be23fdd35..d6cc58e283 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLHRElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
index 4ed2400768..d4867a45ea 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
@@ -53,10 +53,8 @@ void HTMLHtmlElement::setVersion(const String &value)
 
 bool HTMLHtmlElement::checkDTD(const Node* newChild)
 {
-    // FIXME: Why is <script> allowed here?
     return newChild->hasTagName(headTag) || newChild->hasTagName(bodyTag) ||
-           newChild->hasTagName(framesetTag) || newChild->hasTagName(noframesTag) ||
-           newChild->hasTagName(scriptTag);
+           newChild->hasTagName(framesetTag) || newChild->hasTagName(noframesTag);
 }
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
index 9ba3b137f6..a190bca2d7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
@@ -28,14 +28,15 @@
 #include "Frame.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderPartObject.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameElementBase(tagName, doc, createdByParser)
+HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
+    : HTMLFrameElementBase(tagName, document)
 {
     ASSERT(hasTagName(iframeTag));
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
index 3407a6d827..362b991c98 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
@@ -30,7 +30,7 @@ namespace WebCore {
 
 class HTMLIFrameElement : public HTMLFrameElementBase {
 public:
-    HTMLIFrameElement(const QualifiedName&, Document*, bool createdByParser);
+    HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual int tagPriority() const { return 1; }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
index c6a8599478..b5684caa27 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
@@ -40,15 +40,17 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index be89858123..c4bf5dc1dd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -30,7 +30,9 @@
 #include "HTMLDocument.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
+#include "ScriptEventListener.h"
 
 using namespace std;
 
@@ -80,7 +82,7 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
     const QualifiedName& attrName = attr->name();
     if (attrName == altAttr) {
         if (renderer() && renderer()->isImage())
-            static_cast<RenderImage*>(renderer())->updateAltText();
+            toRenderImage(renderer())->updateAltText();
     } else if (attrName == srcAttr)
         m_imageLoader.updateFromElementIgnoringPreviousError();
     else if (attrName == widthAttr)
@@ -113,9 +115,9 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attrName == ismapAttr)
         ismap = true;
     else if (attrName == onabortAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().abortEvent, attr);
+        setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attrName == compositeAttr) {
         if (!parseCompositeOperator(attr->value(), m_compositeOperator))
             m_compositeOperator = CompositeSourceOver;
@@ -166,7 +168,7 @@ void HTMLImageElement::attach()
     HTMLElement::attach();
 
     if (renderer() && renderer()->isImage()) {
-        RenderImage* imageObj = static_cast<RenderImage*>(renderer());
+        RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
         imageObj->setCachedImage(m_imageLoader.image());
@@ -226,7 +228,7 @@ int HTMLImageElement::width(bool ignorePendingStylesheets) const
     else
         document()->updateLayout();
 
-    return renderer() ? renderer()->contentWidth() : 0;
+    return renderBox() ? renderBox()->contentWidth() : 0;
 }
 
 int HTMLImageElement::height(bool ignorePendingStylesheets) const
@@ -250,7 +252,7 @@ int HTMLImageElement::height(bool ignorePendingStylesheets) const
     else
         document()->updateLayout();
 
-    return renderer() ? renderer()->contentHeight() : 0;
+    return renderBox() ? renderBox()->contentHeight() : 0;
 }
 
 int HTMLImageElement::naturalWidth() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
index fe64e6f00c..d7da088e34 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
@@ -46,7 +46,7 @@ module html {
         readonly attribute long x;
         readonly attribute long y;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute DOMString altDisplayString;
         readonly attribute URL absoluteImageURL;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp
index 22e3abcd47..ea53d7e30f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp
@@ -42,10 +42,10 @@ HTMLImageLoader::~HTMLImageLoader()
 
 void HTMLImageLoader::dispatchLoadEvent()
 {
-    if (!haveFiredLoadEvent() && image()) {
-        setHaveFiredLoadEvent(true);
-        element()->dispatchEventForType(image()->errorOccurred() ? eventNames().errorEvent : eventNames().loadEvent, false, false);
-    }
+    bool errorOccurred = image()->errorOccurred();
+    if (!errorOccurred && image()->httpStatusCodeErrorOccurred())
+        errorOccurred = element()->hasTagName(HTMLNames::objectTag); // An <object> considers a 404 to be an error and should fire onerror.
+    element()->dispatchEvent(errorOccurred ? eventNames().errorEvent : eventNames().loadEvent, false, false);
 }
 
 String HTMLImageLoader::sourceURI(const AtomicString& attr) const
@@ -53,12 +53,14 @@ String HTMLImageLoader::sourceURI(const AtomicString& attr) const
     return parseURL(attr);
 }
 
-void HTMLImageLoader::notifyFinished(CachedResource* image)
-{
+void HTMLImageLoader::notifyFinished(CachedResource*)
+{    
+    CachedImage* cachedImage = image();
+
     Element* elem = element();
-    ImageLoader::notifyFinished(image);
+    ImageLoader::notifyFinished(cachedImage);
 
-    if (image->errorOccurred() && elem->hasTagName(HTMLNames::objectTag))
+    if ((cachedImage->errorOccurred() || cachedImage->httpStatusCodeErrorOccurred()) && elem->hasTagName(HTMLNames::objectTag))
         static_cast<HTMLObjectElement*>(elem)->renderFallbackContent();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index dae0be52e7..dbc818bba0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -26,9 +26,8 @@
 #include "config.h"
 #include "HTMLInputElement.h"
 
-#include "BeforeTextInsertedEvent.h"
-#include "ChromeClient.h"
 #include "CSSPropertyNames.h"
+#include "ChromeClient.h"
 #include "Document.h"
 #include "Editor.h"
 #include "Event.h"
@@ -42,8 +41,10 @@
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderButton.h"
@@ -53,10 +54,7 @@
 #include "RenderText.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
-#include "SelectionController.h"
-#include "TextBreakIterator.h"
 #include "TextEvent.h"
-#include "TextIterator.h"
 #include <wtf/StdLibExtras.h>
 
 using namespace std;
@@ -67,79 +65,23 @@ using namespace HTMLNames;
 
 const int maxSavedResults = 256;
 
-// FIXME: According to HTML4, the length attribute's value can be arbitrarily
-// large. However, due to http://bugs.webkit.org/show_bugs.cgi?id=14536 things
-// get rather sluggish when a text field has a larger number of characters than
-// this, even when just clicking in the text field.
-static const int cMaxLen = 524288;
-
-static int numGraphemeClusters(StringImpl* s)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-    int num = 0;
-    while (textBreakNext(it) != TextBreakDone)
-        ++num;
-    return num;
-}
-
-static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-    for (int i = 0; i < numGraphemeClusters; ++i)
-        if (textBreakNext(it) == TextBreakDone)
-            return s->length();
-    return textBreakCurrent(it);
-}
-
-static inline void notifyFormStateChanged(const HTMLInputElement* element)
-{
-    Frame* frame = element->document()->frame();
-    if (!frame)
-        return;
-    frame->page()->chrome()->client()->formStateDidChange(element);
-}
-
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElementWithState(tagName, doc, f)
+    , m_xPos(0)
+    , m_yPos(0)
+    , m_maxResults(-1)
+    , m_type(TEXT)
+    , m_checked(false)
+    , m_defaultChecked(false)
+    , m_useDefaultChecked(true)
+    , m_indeterminate(false)
+    , m_haveType(false)
+    , m_activeSubmit(false)
+    , m_autocomplete(Uninitialized)
+    , m_autofilled(false)
+    , m_inited(false)
 {
     ASSERT(hasTagName(inputTag) || hasTagName(isindexTag));
-    init();
-}
-
-void HTMLInputElement::init()
-{
-    m_type = TEXT;
-    m_maxLen = cMaxLen;
-    m_size = 20;
-    m_checked = false;
-    m_defaultChecked = false;
-    m_useDefaultChecked = true;
-    m_indeterminate = false;
-
-    m_haveType = false;
-    m_activeSubmit = false;
-    m_autocomplete = Uninitialized;
-    m_inited = false;
-    m_autofilled = false;
-    m_placeholderShouldBeVisible = false;
-    
-    xPos = 0;
-    yPos = 0;
-    
-    cachedSelStart = -1;
-    cachedSelEnd = -1;
-
-    m_maxResults = -1;
 }
 
 HTMLInputElement::~HTMLInputElement()
@@ -154,9 +96,9 @@ HTMLInputElement::~HTMLInputElement()
     removeFromForm();
 }
 
-const AtomicString& HTMLInputElement::name() const
+const AtomicString& HTMLInputElement::formControlName() const
 {
-    return m_name.isNull() ? emptyAtom : m_name;
+    return m_data.name();
 }
 
 bool HTMLInputElement::autoComplete() const
@@ -172,8 +114,7 @@ bool HTMLInputElement::autoComplete() const
     return true;
 }
 
-
-static inline HTMLFormElement::CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
+static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
         return form->checkedRadioButtons();
@@ -192,9 +133,6 @@ bool HTMLInputElement::isKeyboardFocusable(KeyboardEvent* event) const
         return false;
 
     if (inputType() == RADIO) {
-        // Unnamed radio buttons are never focusable (matches WinIE).
-        if (name().isEmpty())
-            return false;
 
         // Never allow keyboard tabbing to leave you in the same radio group.  Always
         // skip any other elements in the group.
@@ -222,23 +160,15 @@ bool HTMLInputElement::isMouseFocusable() const
 
 void HTMLInputElement::updateFocusAppearance(bool restorePreviousSelection)
 {        
-    if (isTextField()) {
-        if (!restorePreviousSelection || cachedSelStart == -1)
-            select();
-        else
-            // Restore the cached selection.
-            setSelectionRange(cachedSelStart, cachedSelEnd); 
-        
-        if (document() && document()->frame())
-            document()->frame()->revealSelection();
-    } else
+    if (isTextField())
+        InputElement::updateFocusAppearance(m_data, this, this, restorePreviousSelection);
+    else
         HTMLFormControlElementWithState::updateFocusAppearance(restorePreviousSelection);
 }
 
 void HTMLInputElement::aboutToUnload()
 {
-    if (isTextField() && focused() && document()->frame())
-        document()->frame()->textFieldDidEndEditing(this);
+    InputElement::aboutToUnload(this, this);
 }
 
 bool HTMLInputElement::shouldUseInputMethod() const
@@ -248,23 +178,17 @@ bool HTMLInputElement::shouldUseInputMethod() const
 
 void HTMLInputElement::dispatchFocusEvent()
 {
-    if (isTextField()) {
-        setAutofilled(false);
-        updatePlaceholderVisibility();
-        if (inputType() == PASSWORD && document()->frame())
-            document()->setUseSecureKeyboardEntryWhenActive(true);
-    }
+    InputElement::dispatchFocusEvent(m_data, this, this);
+
+    if (isTextField())
+        m_autofilled = false;
+
     HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
 void HTMLInputElement::dispatchBlurEvent()
 {
-    if (isTextField() && document()->frame()) {
-        updatePlaceholderVisibility();
-        if (inputType() == PASSWORD)
-            document()->setUseSecureKeyboardEntryWhenActive(false);
-        document()->frame()->textFieldDidEndEditing(this);
-    }
+    InputElement::dispatchBlurEvent(m_data, this, this);
     HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
@@ -305,6 +229,14 @@ void HTMLInputElement::setInputType(const String& t)
         newType = SEARCH;
     else if (equalIgnoringCase(t, "range"))
         newType = RANGE;
+    else if (equalIgnoringCase(t, "email"))
+        newType = EMAIL;
+    else if (equalIgnoringCase(t, "number"))
+        newType = NUMBER;
+    else if (equalIgnoringCase(t, "tel"))
+        newType = TELEPHONE;
+    else if (equalIgnoringCase(t, "url"))
+        newType = URL;
     else
         newType = TEXT;
 
@@ -334,14 +266,14 @@ void HTMLInputElement::setInputType(const String& t)
             bool isPasswordField = inputType() == PASSWORD;
             bool willRespectHeightAndWidth = respectHeightAndWidthAttrs();
 
-            if (didStoreValue && !willStoreValue && !m_value.isNull()) {
-                setAttribute(valueAttr, m_value);
-                m_value = String();
+            if (didStoreValue && !willStoreValue && !m_data.value().isNull()) {
+                setAttribute(valueAttr, m_data.value());
+                m_data.setValue(String());
             }
             if (!didStoreValue && willStoreValue)
-                m_value = constrainValue(getAttribute(valueAttr));
+                m_data.setValue(constrainValue(getAttribute(valueAttr)));
             else
-                recheckValue();
+                InputElement::updateValueIfNeeded(m_data, this);
 
             if (wasPasswordField && !isPasswordField)
                 unregisterForActivationCallbackIfNeeded();
@@ -350,6 +282,7 @@ void HTMLInputElement::setInputType(const String& t)
 
             if (didRespectHeightAndWidth != willRespectHeightAndWidth) {
                 NamedMappedAttrMap* map = mappedAttributes();
+                ASSERT(map);
                 if (Attribute* height = map->getAttributeItem(heightAttr))
                     attributeChanged(height, false);
                 if (Attribute* width = map->getAttributeItem(widthAttr))
@@ -367,7 +300,7 @@ void HTMLInputElement::setInputType(const String& t)
             checkedRadioButtons(this).addButton(this);
         }
 
-        notifyFormStateChanged(this);
+        InputElement::notifyFormStateChanged(this);
     }
     m_haveType = true;
 
@@ -375,7 +308,7 @@ void HTMLInputElement::setInputType(const String& t)
         m_imageLoader.clear();
 }
 
-const AtomicString& HTMLInputElement::type() const
+const AtomicString& HTMLInputElement::formControlType() const
 {
     // needs to be lowercase according to DOM spec
     switch (inputType()) {
@@ -387,6 +320,10 @@ const AtomicString& HTMLInputElement::type() const
             DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
             return checkbox;
         }
+        case EMAIL: {
+            DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
+            return email;
+        }
         case FILE: {
             DEFINE_STATIC_LOCAL(const AtomicString, file, ("file"));
             return file;
@@ -401,6 +338,10 @@ const AtomicString& HTMLInputElement::type() const
         }
         case ISINDEX:
             return emptyAtom;
+        case NUMBER: {
+            DEFINE_STATIC_LOCAL(const AtomicString, number, ("number"));
+            return number;
+        }
         case PASSWORD: {
             DEFINE_STATIC_LOCAL(const AtomicString, password, ("password"));
             return password;
@@ -425,30 +366,42 @@ const AtomicString& HTMLInputElement::type() const
             DEFINE_STATIC_LOCAL(const AtomicString, submit, ("submit"));
             return submit;
         }
+        case TELEPHONE: {
+            DEFINE_STATIC_LOCAL(const AtomicString, telephone, ("tel"));
+            return telephone;
+        }
         case TEXT: {
             DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
             return text;
         }
+        case URL: {
+            DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
+            return url;
+        }
     }
     return emptyAtom;
 }
 
-bool HTMLInputElement::saveState(String& result) const
+bool HTMLInputElement::saveFormControlState(String& result) const
 {
     if (!autoComplete())
         return false;
 
     switch (inputType()) {
         case BUTTON:
+        case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             result = value();
             return true;
         case CHECKBOX:
@@ -462,20 +415,24 @@ bool HTMLInputElement::saveState(String& result) const
     return false;
 }
 
-void HTMLInputElement::restoreState(const String& state)
+void HTMLInputElement::restoreFormControlState(const String& state)
 {
     ASSERT(inputType() != PASSWORD); // should never save/restore password fields
     switch (inputType()) {
         case BUTTON:
+        case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             setValue(state);
             break;
         case CHECKBOX:
@@ -503,22 +460,22 @@ int HTMLInputElement::selectionStart() const
 {
     if (!isTextField())
         return 0;
-    if (document()->focusedNode() != this && cachedSelStart != -1)
-        return cachedSelStart;
+    if (document()->focusedNode() != this && m_data.cachedSelectionStart() != -1)
+        return m_data.cachedSelectionStart();
     if (!renderer())
         return 0;
-    return static_cast<RenderTextControl*>(renderer())->selectionStart();
+    return toRenderTextControl(renderer())->selectionStart();
 }
 
 int HTMLInputElement::selectionEnd() const
 {
     if (!isTextField())
         return 0;
-    if (document()->focusedNode() != this && cachedSelEnd != -1)
-        return cachedSelEnd;
+    if (document()->focusedNode() != this && m_data.cachedSelectionEnd() != -1)
+        return m_data.cachedSelectionEnd();
     if (!renderer())
         return 0;
-    return static_cast<RenderTextControl*>(renderer())->selectionEnd();
+    return toRenderTextControl(renderer())->selectionEnd();
 }
 
 void HTMLInputElement::setSelectionStart(int start)
@@ -527,7 +484,7 @@ void HTMLInputElement::setSelectionStart(int start)
         return;
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionStart(start);
+    toRenderTextControl(renderer())->setSelectionStart(start);
 }
 
 void HTMLInputElement::setSelectionEnd(int end)
@@ -536,7 +493,7 @@ void HTMLInputElement::setSelectionEnd(int end)
         return;
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionEnd(end);
+    toRenderTextControl(renderer())->setSelectionEnd(end);
 }
 
 void HTMLInputElement::select()
@@ -545,16 +502,12 @@ void HTMLInputElement::select()
         return;
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->select();
+    toRenderTextControl(renderer())->select();
 }
 
 void HTMLInputElement::setSelectionRange(int start, int end)
 {
-    if (!isTextField())
-        return;
-    if (!renderer())
-        return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionRange(start, end);
+    InputElement::updateSelectionRange(this, this, start, end);
 }
 
 void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
@@ -575,10 +528,14 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
         case HIDDEN:
             // a no-op for this type
             break;
+        case EMAIL:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             // should never restore previous selection here
             focus(false);
             break;
@@ -609,7 +566,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
 {
     if (attr->name() == nameAttr) {
         checkedRadioButtons(this).removeButton(this);
-        m_name = attr->value();
+        m_data.setName(attr->value());
         checkedRadioButtons(this).addButton(this);
     } else if (attr->name() == autocompleteAttr) {
         if (equalIgnoringCase(attr->value(), "off")) {
@@ -627,30 +584,22 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         setInputType(attr->value());
     } else if (attr->name() == valueAttr) {
         // We only need to setChanged if the form is looking at the default value right now.
-        if (m_value.isNull())
-            setChanged();
-        setValueMatchesRenderer(false);
+        if (m_data.value().isNull())
+            setNeedsStyleRecalc();
+        setFormControlValueMatchesRenderer(false);
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
             setChecked(m_defaultChecked);
             m_useDefaultChecked = true;
         }
-    } else if (attr->name() == maxlengthAttr) {
-        int oldMaxLen = m_maxLen;
-        m_maxLen = !attr->isNull() ? attr->value().toInt() : cMaxLen;
-        if (m_maxLen <= 0 || m_maxLen > cMaxLen)
-            m_maxLen = cMaxLen;
-        if (oldMaxLen != m_maxLen)
-            recheckValue();
-        setChanged();
-    } else if (attr->name() == sizeAttr) {
-        m_size = !attr->isNull() ? attr->value().toInt() : 20;
-        if (renderer())
-            renderer()->setNeedsLayoutAndPrefWidthsRecalc();
-    } else if (attr->name() == altAttr) {
+    } else if (attr->name() == maxlengthAttr)
+        InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
+    else if (attr->name() == sizeAttr)
+        InputElement::parseSizeAttribute(m_data, this, attr);
+    else if (attr->name() == altAttr) {
         if (renderer() && inputType() == IMAGE)
-            static_cast<RenderImage*>(renderer())->updateAltText();
+            toRenderImage(renderer())->updateAltText();
     } else if (attr->name() == srcAttr) {
         if (renderer() && inputType() == IMAGE) {
             if (!m_imageLoader)
@@ -676,20 +625,20 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         if (respectHeightAndWidthAttrs())
             addCSSLength(attr, CSSPropertyHeight, attr->value());
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onselectAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectEvent, attr);
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onchangeAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oninputAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().inputEvent, attr);
+        setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
     }
     // Search field and slider attributes all just cause updateFromElement to be called through style
     // recalcing.
     else if (attr->name() == onsearchAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().searchEvent, attr);
+        setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
         m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
@@ -699,17 +648,17 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             detach();
             attach();
         }
-        setChanged();
+        setNeedsStyleRecalc();
     } else if (attr->name() == placeholderAttr) {
         if (isTextField())
-            updatePlaceholderVisibility(true);
+            updatePlaceholderVisibility();
     } else if (attr->name() == autosaveAttr ||
-               attr->name() == incrementalAttr ||
-               attr->name() == minAttr ||
-               attr->name() == maxAttr ||
-               attr->name() == multipleAttr ||
-               attr->name() == precisionAttr)
-        setChanged();
+             attr->name() == incrementalAttr ||
+             attr->name() == minAttr ||
+             attr->name() == maxAttr ||
+             attr->name() == multipleAttr ||
+             attr->name() == precisionAttr)
+        setNeedsStyleRecalc();
     else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -719,16 +668,20 @@ bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
     switch (inputType()) {
         case BUTTON:
         case CHECKBOX:
+        case EMAIL:
         case FILE:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RADIO:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return HTMLFormControlElementWithState::rendererIsNeeded(style);
         case HIDDEN:
             return false;
@@ -755,10 +708,14 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
             return new (arena) RenderImage(this);
         case RANGE:
             return new (arena) RenderSlider(this);
+        case EMAIL:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return new (arena) RenderTextControlSingleLine(this);
     }
     ASSERT(false);
@@ -780,7 +737,7 @@ void HTMLInputElement::attach()
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
         if (renderer()) {
-            RenderImage* imageObj = static_cast<RenderImage*>(renderer());
+            RenderImage* imageObj = toRenderImage(renderer());
             imageObj->setCachedImage(m_imageLoader->image()); 
             
             // If we have no image at all because we have no src attribute, set
@@ -794,7 +751,7 @@ void HTMLInputElement::attach()
 void HTMLInputElement::detach()
 {
     HTMLFormControlElementWithState::detach();
-    setValueMatchesRenderer(false);
+    setFormControlValueMatchesRenderer(false);
 }
 
 String HTMLInputElement::altText() const
@@ -837,12 +794,16 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
         return false;
 
     switch (inputType()) {
+        case EMAIL:
         case HIDDEN:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             // always successful
             encoding.appendData(name(), value());
             return true;
@@ -862,8 +823,8 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
 
         case IMAGE:
             if (m_activeSubmit) {
-                encoding.appendData(name().isEmpty() ? "x" : (name() + ".x"), xPos);
-                encoding.appendData(name().isEmpty() ? "y" : (name() + ".y"), yPos);
+                encoding.appendData(name().isEmpty() ? "x" : (name() + ".x"), m_xPos);
+                encoding.appendData(name().isEmpty() ? "y" : (name() + ".y"), m_yPos);
                 if (!name().isEmpty() && !value().isEmpty())
                     encoding.appendData(name(), value());
                 return true;
@@ -917,7 +878,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
 
     m_useDefaultChecked = false;
     m_checked = nowChecked;
-    setChanged();
+    setNeedsStyleRecalc();
 
     checkedRadioButtons(this).addButton(this);
     
@@ -930,7 +891,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // because it says only to fire change events at "lose focus" time, which is
     // definitely wrong in practice for these types of elements.
     if (sendChangeEvent && inDocument() && (inputType() != RADIO || nowChecked))
-        onChange();
+        dispatchFormControlChangeEvent();
 }
 
 void HTMLInputElement::setIndeterminate(bool _indeterminate)
@@ -941,20 +902,25 @@ void HTMLInputElement::setIndeterminate(bool _indeterminate)
 
     m_indeterminate = _indeterminate;
 
-    setChanged();
+    setNeedsStyleRecalc();
 
     if (renderer() && renderer()->style()->hasAppearance())
         theme()->stateChanged(renderer(), CheckedState);
 }
 
-void HTMLInputElement::copyNonAttributeProperties(const Element *source)
+int HTMLInputElement::size() const
+{
+    return m_data.size();
+}
+
+void HTMLInputElement::copyNonAttributeProperties(const Element* source)
 {
-    const HTMLInputElement *sourceElem = static_cast<const HTMLInputElement *>(source);
+    const HTMLInputElement* sourceElement = static_cast<const HTMLInputElement*>(source);
+
+    m_data.setValue(sourceElement->m_data.value());
+    m_checked = sourceElement->m_checked;
+    m_indeterminate = sourceElement->m_indeterminate;
 
-    m_value = sourceElem->m_value;
-    m_checked = sourceElem->m_checked;
-    m_indeterminate = sourceElem->m_indeterminate;
-    
     HTMLFormControlElementWithState::copyNonAttributeProperties(source);
 }
 
@@ -968,7 +934,7 @@ String HTMLInputElement::value() const
         return String();
     }
 
-    String value = m_value;
+    String value = m_data.value();
     if (value.isNull()) {
         value = constrainValue(getAttribute(valueAttr));
 
@@ -987,15 +953,19 @@ String HTMLInputElement::valueWithDefault() const
         switch (inputType()) {
             case BUTTON:
             case CHECKBOX:
+            case EMAIL:
             case FILE:
             case HIDDEN:
             case IMAGE:
             case ISINDEX:
+            case NUMBER:
             case PASSWORD:
             case RADIO:
             case RANGE:
             case SEARCH:
+            case TELEPHONE:
             case TEXT:
+            case URL:
                 break;
             case RESET:
                 v = resetButtonDefaultLabel();
@@ -1016,61 +986,54 @@ void HTMLInputElement::setValue(const String& value)
     if (inputType() == FILE && !value.isEmpty())
         return;
 
-    if (isTextField())
-        updatePlaceholderVisibility();
-    
-    setValueMatchesRenderer(false);
+    setFormControlValueMatchesRenderer(false);
     if (storesValueSeparateFromAttribute()) {
         if (inputType() == FILE)
             m_fileList->clear();
         else {
-            m_value = constrainValue(value);
-            if (isTextField() && inDocument())
-                document()->updateRendering();
+            m_data.setValue(constrainValue(value));
+            if (isTextField()) {
+                InputElement::updatePlaceholderVisibility(m_data, this, this);
+                if (inDocument())
+                    document()->updateStyleIfNeeded();
+            }
         }
         if (renderer())
             renderer()->updateFromElement();
-        setChanged();
+        setNeedsStyleRecalc();
     } else
         setAttribute(valueAttr, constrainValue(value));
     
     if (isTextField()) {
-        unsigned max = m_value.length();
+        unsigned max = m_data.value().length();
         if (document()->focusedNode() == this)
-            setSelectionRange(max, max);
-        else {
-            cachedSelStart = max;
-            cachedSelEnd = max;
-        }
+            InputElement::updateSelectionRange(this, this, max, max);
+        else
+            cacheSelection(max, max);
     }
-    notifyFormStateChanged(this);
+    InputElement::notifyFormStateChanged(this);
 }
 
-void HTMLInputElement::setValueFromRenderer(const String& value)
+String HTMLInputElement::placeholder() const
 {
-    // Renderer and our event handler are responsible for constraining values.
-    ASSERT(value == constrainValue(value) || constrainValue(value).isEmpty());
-
-    // File upload controls will always use setFileListFromRenderer.
-    ASSERT (inputType() != FILE);
-
-    if (isTextField())
-        updatePlaceholderVisibility();
-    
-    // Workaround for bug where trailing \n is included in the result of textContent.
-    // The assert macro above may also be simplified to:  value == constrainValue(value)
-    // http://bugs.webkit.org/show_bug.cgi?id=9661
-    if (value == "\n")
-        m_value = "";
-    else
-        m_value = value;
+    return getAttribute(placeholderAttr).string();
+}
 
-    setValueMatchesRenderer();
+void HTMLInputElement::setPlaceholder(const String& value)
+{
+    setAttribute(placeholderAttr, value);
+}
 
-    // Fire the "input" DOM event.
-    dispatchEventForType(eventNames().inputEvent, true, false);
+bool HTMLInputElement::searchEventsShouldBeDispatched() const
+{
+    return hasAttribute(incrementalAttr);
+}
 
-    notifyFormStateChanged(this);
+void HTMLInputElement::setValueFromRenderer(const String& value)
+{
+    // File upload controls will always use setFileListFromRenderer.
+    ASSERT(inputType() != FILE);
+    InputElement::setValueFromRenderer(m_data, this, this, value);
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1080,8 +1043,8 @@ void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
     for (int i = 0; i < size; i++)
         m_fileList->append(File::create(paths[i]));
 
-    setValueMatchesRenderer();
-    notifyFormStateChanged(this);
+    setFormControlValueMatchesRenderer(true);
+    InputElement::notifyFormStateChanged(this);
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1095,12 +1058,16 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case RESET:
         case SUBMIT:
             return false;
+        case EMAIL:
         case FILE:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return true;
     }
     return false;
@@ -1126,11 +1093,6 @@ void* HTMLInputElement::preDispatchEventHandler(Event *evt)
             }
         } else {
             // For radio buttons, store the current selected radio object.
-            if (name().isEmpty() || checked())
-                return 0; // Match WinIE and don't allow unnamed radio buttons to be checked.
-                          // Checked buttons just stay checked.
-                          // FIXME: Need to learn to work without a form.
-
             // We really want radio groups to end up in sane states, i.e., to have something checked.
             // Therefore if nothing is currently selected, we won't allow this action to be "undone", since
             // we want some object in the radio group to actually get selected.
@@ -1166,8 +1128,7 @@ void HTMLInputElement::postDispatchEventHandler(Event *evt, void* data)
                 // Make sure it is still a radio button and only do the restoration if it still
                 // belongs to our group.
 
-                // Match WinIE and don't allow unnamed radio buttons to be checked.
-                if (input->form() == form() && input->inputType() == RADIO && !name().isEmpty() && input->name() == name()) {
+                if (input->form() == form() && input->inputType() == RADIO && input->name() == name()) {
                     // Ok, the old radio button is still in our form and in our group and is still a 
                     // radio button, so it's safe to restore selection to it.
                     input->setChecked(true);
@@ -1183,6 +1144,9 @@ void HTMLInputElement::postDispatchEventHandler(Event *evt, void* data)
 
 void HTMLInputElement::defaultEventHandler(Event* evt)
 {
+    // FIXME: It would be better to refactor this for the different types of input element.
+    // Having them all in one giant function makes this hard to read, and almost all the handling is type-specific.
+
     bool clickDefaultFormButton = false;
 
     if (isTextField() && evt->type() == eventNames().textInputEvent && evt->isTextEvent() && static_cast<TextEvent*>(evt)->data() == "\n")
@@ -1194,30 +1158,40 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         // FIXME: We could just call offsetX() and offsetY() on the event,
         // but that's currently broken, so for now do the computation here.
         if (me->isSimulated() || !renderer()) {
-            xPos = 0;
-            yPos = 0;
+            m_xPos = 0;
+            m_yPos = 0;
         } else {
             // FIXME: This doesn't work correctly with transforms.
+            // FIXME: pageX/pageY need adjusting for pageZoomFactor(). Use actualPageLocation()?
             IntPoint absOffset = roundedIntPoint(renderer()->localToAbsolute());
-            xPos = me->pageX() - absOffset.x();
-            yPos = me->pageY() - absOffset.y();
+            m_xPos = me->pageX() - absOffset.x();
+            m_yPos = me->pageY() - absOffset.y();
         }
     }
 
-    if (isTextField() && evt->type() == eventNames().keydownEvent && evt->isKeyboardEvent() && focused() && document()->frame()
-                && document()->frame()->doTextFieldCommandFromEvent(this, static_cast<KeyboardEvent*>(evt))) {
+    if (isTextField()
+            && evt->type() == eventNames().keydownEvent
+            && evt->isKeyboardEvent()
+            && focused()
+            && document()->frame()
+            && document()->frame()->doTextFieldCommandFromEvent(this, static_cast<KeyboardEvent*>(evt))) {
         evt->setDefaultHandled();
         return;
     }
 
-    if (inputType() == RADIO && evt->isMouseEvent()
-            && evt->type() == eventNames().clickEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
+    if (inputType() == RADIO
+            && evt->isMouseEvent()
+            && evt->type() == eventNames().clickEvent
+            && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
         evt->setDefaultHandled();
         return;
     }
     
-    // Let the key handling done in EventTargetNode take precedence over the event handling here for editable text fields
-    if (!clickDefaultFormButton) {
+    // Call the base event handler before any of our own event handling for almost all events in text fields.
+    // Makes editing keyboard handling take precedence over the keydown and keypress handling in this function.
+    bool callBaseClassEarly = isTextField() && !clickDefaultFormButton
+        && (evt->type() == eventNames().keydownEvent || evt->type() == eventNames().keypressEvent);
+    if (callBaseClassEarly) {
         HTMLFormControlElementWithState::defaultEventHandler(evt);
         if (evt->defaultHandled())
             return;
@@ -1235,13 +1209,13 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                 form()->reset();
             else {
                 m_activeSubmit = true;
-                // FIXME: Would be cleaner to get xPos and yPos out of the underlying mouse
+                // FIXME: Would be cleaner to get m_xPos and m_yPos out of the underlying mouse
                 // event (if any) here instead of relying on the variables set above when
                 // processing the click event. Even better, appendFormData could pass the
-                // event in, and then we could get rid of xPos and yPos altogether!
+                // event in, and then we could get rid of m_xPos and m_yPos altogether!
                 if (!form()->prepareSubmit(evt)) {
-                    xPos = 0;
-                    yPos = 0;
+                    m_xPos = 0;
+                    m_yPos = 0;
                 }
                 m_activeSubmit = false;
             }
@@ -1259,12 +1233,16 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         if (charCode == '\r') {
             switch (inputType()) {
                 case CHECKBOX:
+                case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
+                case TELEPHONE:
                 case TEXT:
+                case URL:
                     // Simulate mouse click on the default form button for enter for these types of elements.
                     clickDefaultFormButton = true;
                     break;
@@ -1316,7 +1294,8 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                 case SUBMIT:
                 case RADIO:
                     setActive(true, true);
-                    // No setDefaultHandled() - IE dispatches a keypress in this case.
+                    // No setDefaultHandled(), because IE dispatches a keypress in this case
+                    // and the caller will only dispatch a keypress if we don't call setDefaultHandled.
                     return;
                 default:
                     break;
@@ -1344,9 +1323,8 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                     if (elt->form() != form())
                         break;
                     if (n->hasTagName(inputTag)) {
-                        // Match WinIE and don't allow unnamed radio buttons to be checked.
                         HTMLInputElement* inputElt = static_cast<HTMLInputElement*>(n);
-                        if (inputElt->inputType() == RADIO && !name().isEmpty() && inputElt->name() == name() && inputElt->isFocusable()) {
+                        if (inputElt->inputType() == RADIO && inputElt->name() == name() && inputElt->isFocusable()) {
                             inputElt->setChecked(true);
                             document()->setFocusedNode(inputElt);
                             inputElt->dispatchSimulatedClick(evt, false, false);
@@ -1382,12 +1360,16 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                     if (!checked())
                         clickElement = true;
                     break;
+                case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
+                case TELEPHONE:
                 case TEXT:
+                case URL:
                     break;
             }
         }
@@ -1407,12 +1389,12 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         }
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && r->isTextField() && r->isEdited()) {
-            onChange();
+        if (r && r->isTextField() && toRenderTextControl(r)->isEdited()) {
+            dispatchFormControlChangeEvent();
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
-            if (r)
-                r->setEdited(false);
+            if (r && r->isTextField())
+                toRenderTextControl(r)->setEdited(false);
         }
         // Form may never have been present, or may have been destroyed by the change event.
         if (form())
@@ -1421,36 +1403,17 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         return;
     }
 
-    if (evt->isBeforeTextInsertedEvent()) {
-        // Make sure that the text to be inserted will not violate the maxLength.
-        int oldLen = numGraphemeClusters(value().impl());
-        ASSERT(oldLen <= maxLength());
-        int selectionLen = numGraphemeClusters(plainText(document()->frame()->selection()->selection().toRange().get()).impl());
-        ASSERT(oldLen >= selectionLen);
-        int maxNewLen = maxLength() - (oldLen - selectionLen);
-
-        // Truncate the inserted text to avoid violating the maxLength and other constraints.
-        BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(evt);
-        textEvent->setText(constrainValue(textEvent->text(), maxNewLen));
-    }
+    if (evt->isBeforeTextInsertedEvent())
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
 
     if (isTextField() && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         static_cast<RenderTextControlSingleLine*>(renderer())->forwardEvent(evt);
 
-    if (inputType() == RANGE && renderer()) {
-        RenderSlider* slider = static_cast<RenderSlider*>(renderer());
-        if (evt->isMouseEvent() && evt->type() == eventNames().mousedownEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-            MouseEvent* mEvt = static_cast<MouseEvent*>(evt);
-            if (!slider->mouseEventIsInThumb(mEvt)) {
-                IntPoint eventOffset(mEvt->offsetX(), mEvt->offsetY());
-                if (mEvt->target() != this) // Does this ever happen now? Was added for <video> controls
-                    eventOffset = roundedIntPoint(renderer()->absoluteToLocal(FloatPoint(mEvt->pageX(), mEvt->pageY()), false, true));
-                slider->setValueForPosition(slider->positionForOffset(eventOffset));
-            }
-        }
-        if (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent())
-            slider->forwardEvent(evt);
-    }
+    if (inputType() == RANGE && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent()))
+        static_cast<RenderSlider*>(renderer())->forwardEvent(evt);
+
+    if (!callBaseClassEarly && !evt->defaultHandled())
+        HTMLFormControlElementWithState::defaultEventHandler(evt);
 }
 
 bool HTMLInputElement::isURLAttribute(Attribute *attr) const
@@ -1478,6 +1441,11 @@ void HTMLInputElement::setDefaultChecked(bool defaultChecked)
     setAttribute(checkedAttr, defaultChecked ? "" : 0);
 }
 
+void HTMLInputElement::setDefaultName(const AtomicString& name)
+{
+    m_data.setName(name);
+}
+
 String HTMLInputElement::accept() const
 {
     return getAttribute(acceptAttr);
@@ -1518,11 +1486,26 @@ void HTMLInputElement::setAlt(const String &value)
     setAttribute(altAttr, value);
 }
 
+int HTMLInputElement::maxLength() const
+{
+    return m_data.maxLength();
+}
+
 void HTMLInputElement::setMaxLength(int _maxLength)
 {
     setAttribute(maxlengthAttr, String::number(_maxLength));
 }
 
+bool HTMLInputElement::multiple() const
+{
+    return !getAttribute(multipleAttr).isNull();
+}
+
+void HTMLInputElement::setMultiple(bool multiple)
+{
+    setAttribute(multipleAttr, multiple ? "" : 0);
+}
+    
 void HTMLInputElement::setSize(unsigned _size)
 {
     setAttribute(sizeAttr, String::number(_size));
@@ -1554,7 +1537,7 @@ void HTMLInputElement::setAutofilled(bool b)
         return;
         
     m_autofilled = b;
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 FileList* HTMLInputElement::files()
@@ -1566,15 +1549,7 @@ FileList* HTMLInputElement::files()
 
 String HTMLInputElement::constrainValue(const String& proposedValue) const
 {
-    return constrainValue(proposedValue, m_maxLen);
-}
-
-void HTMLInputElement::recheckValue()
-{
-    String oldValue = value();
-    String newValue = constrainValue(oldValue);
-    if (newValue != oldValue)
-        setValue(newValue);
+    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
 }
 
 bool HTMLInputElement::needsActivationCallback()
@@ -1594,40 +1569,10 @@ void HTMLInputElement::unregisterForActivationCallbackIfNeeded()
         document()->unregisterForDocumentActivationCallbacks(this);
 }
 
-void HTMLInputElement::updatePlaceholderVisibility(bool placeholderValueChanged)
-{
-    ASSERT(isTextField());
-
-    bool oldPlaceholderShouldBeVisible = m_placeholderShouldBeVisible;
-
-    m_placeholderShouldBeVisible = value().isEmpty() 
-        && document()->focusedNode() != this
-        && !getAttribute(placeholderAttr).isEmpty();
-
-    if ((oldPlaceholderShouldBeVisible != m_placeholderShouldBeVisible || placeholderValueChanged) && renderer())
-        static_cast<RenderTextControlSingleLine*>(renderer())->updatePlaceholderVisibility();
-}
-
-String HTMLInputElement::constrainValue(const String& proposedValue, int maxLen) const
+void HTMLInputElement::cacheSelection(int start, int end)
 {
-    String string = proposedValue;
-    if (isTextField()) {
-        string.replace("\r\n", " ");
-        string.replace('\r', ' ');
-        string.replace('\n', ' ');
-        StringImpl* s = string.impl();
-        int newLen = numCharactersInGraphemeClusters(s, maxLen);
-        for (int i = 0; i < newLen; ++i) {
-            const UChar current = (*s)[i];
-            if (current < ' ' && current != '\t') {
-                newLen = i;
-                break;
-            }
-        }
-        if (newLen < static_cast<int>(string.length()))
-            return string.substring(0, newLen);
-    }
-    return string;
+    m_data.setCachedSelectionStart(start);
+    m_data.setCachedSelectionEnd(end);
 }
 
 void HTMLInputElement::addSearchResult()
@@ -1642,14 +1587,14 @@ void HTMLInputElement::onSearch()
     ASSERT(isSearchField());
     if (renderer())
         static_cast<RenderTextControlSingleLine*>(renderer())->stopSearchEventTimer();
-    dispatchEventForType(eventNames().searchEvent, true, false);
+    dispatchEvent(eventNames().searchEvent, true, false);
 }
 
-Selection HTMLInputElement::selection() const
+VisibleSelection HTMLInputElement::selection() const
 {
-   if (!renderer() || !isTextField() || cachedSelStart == -1 || cachedSelEnd == -1)
-        return Selection();
-   return static_cast<RenderTextControl*>(renderer())->selection(cachedSelStart, cachedSelEnd);
+   if (!renderer() || !isTextField() || m_data.cachedSelectionStart() == -1 || m_data.cachedSelectionEnd() == -1)
+        return VisibleSelection();
+   return toRenderTextControl(renderer())->selection(m_data.cachedSelectionStart(), m_data.cachedSelectionEnd());
 }
 
 void HTMLInputElement::documentDidBecomeActive()
@@ -1689,4 +1634,10 @@ bool HTMLInputElement::willValidate() const
     return HTMLFormControlElementWithState::willValidate() && inputType() != HIDDEN &&
            inputType() != BUTTON && inputType() != RESET;
 }
+
+bool HTMLInputElement::placeholderShouldBeVisible() const
+{
+    return m_data.placeholderShouldBeVisible();
+}
+
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 8636e4b6ce..be2b4f4f10 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -25,6 +25,7 @@
 #define HTMLInputElement_h
 
 #include "HTMLFormControlElement.h"
+#include "InputElement.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -32,9 +33,9 @@ namespace WebCore {
 class FileList;
 class HTMLImageLoader;
 class KURL;
-class Selection;
+class VisibleSelection;
 
-class HTMLInputElement : public HTMLFormControlElementWithState {
+class HTMLInputElement : public HTMLFormControlElementWithState, public InputElement {
 public:
     enum InputType {
         TEXT,
@@ -49,7 +50,11 @@ public:
         IMAGE,
         BUTTON,
         SEARCH,
-        RANGE
+        RANGE,
+        EMAIL,
+        NUMBER,
+        TELEPHONE,
+        URL
     };
     
     enum AutoCompleteSetting {
@@ -73,22 +78,22 @@ public:
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
 
-    virtual const AtomicString& name() const;
-
+    virtual const AtomicString& formControlName() const;
+ 
     bool autoComplete() const;
 
     // isChecked is used by the rendering tree/CSS while checked() is used by JS to determine checked state
     virtual bool isChecked() const { return checked() && (inputType() == CHECKBOX || inputType() == RADIO); }
     virtual bool isIndeterminate() const { return indeterminate(); }
     
-    bool readOnly() const { return isReadOnlyControl(); }
+    bool readOnly() const { return isReadOnlyFormControl(); }
 
-    virtual bool isTextControl() const { return isTextField(); }
+    virtual bool isTextFormControl() const { return isTextField(); }
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX; }
-    bool isSearchField() const { return m_type == SEARCH; }
+    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL; }
+    virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
 
@@ -96,21 +101,25 @@ public:
     void setChecked(bool, bool sendChangeEvent = false);
     bool indeterminate() const { return m_indeterminate; }
     void setIndeterminate(bool);
-    int maxLength() const { return m_maxLen; }
-    int size() const { return m_size; }
-    virtual const AtomicString& type() const;
+    virtual int size() const;
+    virtual const AtomicString& formControlType() const;
     void setType(const String&);
 
-    String value() const;
-    void setValue(const String&);
+    virtual String value() const;
+    virtual void setValue(const String&);
+
+    virtual String placeholder() const;
+    virtual void setPlaceholder(const String&);
+
+    virtual bool searchEventsShouldBeDispatched() const;
 
     String valueWithDefault() const;
 
-    void setValueFromRenderer(const String&);
+    virtual void setValueFromRenderer(const String&);
     void setFileListFromRenderer(const Vector<String>&);
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
 
     virtual bool canStartSelection() const;
     
@@ -119,7 +128,7 @@ public:
     int selectionEnd() const;
     void setSelectionStart(int);
     void setSelectionEnd(int);
-    void select();
+    virtual void select();
     void setSelectionRange(int start, int end);
 
     virtual void accessKeyAction(bool sendToAnyElement);
@@ -163,6 +172,8 @@ public:
     bool defaultChecked() const;
     void setDefaultChecked(bool);
 
+    void setDefaultName(const AtomicString&);
+
     String accept() const;
     void setAccept(const String&);
 
@@ -180,23 +191,27 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
+    int maxLength() const;
     void setMaxLength(int);
 
+    bool multiple() const;
+    void setMultiple(bool);
+
     String useMap() const;
     void setUseMap(const String&);
 
     virtual bool isAutofilled() const { return m_autofilled; }
-    void setAutofilled(bool b = true);
+    void setAutofilled(bool value = true);
 
     FileList* files();
 
-    void cacheSelection(int s, int e) { cachedSelStart = s; cachedSelEnd = e; };
+    virtual void cacheSelection(int start, int end);
     void addSearchResult();
     void onSearch();
-    
-    Selection selection() const;
 
-    String constrainValue(const String& proposedValue) const;
+    VisibleSelection selection() const;
+
+    virtual String constrainValue(const String& proposedValue) const;
 
     virtual void documentDidBecomeActive();
 
@@ -204,40 +219,31 @@ public:
     
     virtual bool willValidate() const;
 
-    bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
+    virtual bool placeholderShouldBeVisible() const;
     
 protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
-    
-    AtomicString m_name;
+
+    void updatePlaceholderVisibility()
+    {
+        InputElement::updatePlaceholderVisibility(m_data, this, this, true);
+    }
 
 private:
-    void init();
     bool storesValueSeparateFromAttribute() const;
-    String constrainValue(const String& proposedValue, int maxLen) const;
-    void recheckValue();
-    
+
     bool needsActivationCallback();
     void registerForActivationCallbackIfNeeded();
     void unregisterForActivationCallbackIfNeeded();
 
-    void updatePlaceholderVisibility(bool placeholderValueChanged = false);
-    
-    String m_value;
-    String m_originalValue;
-    int xPos;
-    int yPos;
-    int m_maxLen;
-    int m_size;
-
+    InputElementData m_data;
+    int m_xPos;
+    int m_yPos;
     short m_maxResults;
-
     OwnPtr<HTMLImageLoader> m_imageLoader;
-
     RefPtr<FileList> m_fileList;
-
-    unsigned m_type : 4; // InputType 
+    unsigned m_type : 5; // InputType 
     bool m_checked : 1;
     bool m_defaultChecked : 1;
     bool m_useDefaultChecked : 1;
@@ -247,10 +253,6 @@ private:
     unsigned m_autocomplete : 2; // AutoCompleteSetting
     bool m_autofilled : 1;
     bool m_inited : 1;
-    bool m_placeholderShouldBeVisible : 1;
-    
-    int cachedSelStart;
-    int cachedSelEnd;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
index a9b6d2cb44..5536733646 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
@@ -21,7 +21,6 @@
 module html {
 
     interface [
-        CustomGetOwnPropertySlot,
         GenerateConstructor,
         InterfaceUUID=8f388ea3-1c31-4cca-8edd-449d14e222e1,
         ImplementationUUID=aeb56b87-a90e-4d9d-a4d5-7eec3687c338
@@ -37,16 +36,18 @@ module html {
                  attribute boolean         disabled;
                  attribute boolean         autofocus;
                  attribute long            maxLength;
+                 attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
+                 attribute DOMString       placeholder;
                  attribute boolean         readOnly;
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
                  attribute [ConvertToString] DOMString size; // DOM level 2 changed this to a long, but our existing API is a string
 #else
                  // FIXME: the spec says this should be a long, not an unsigned long
                  attribute unsigned long   size; // Changed string -> long as part of DOM level 2
 #endif
                  attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString type; // readonly dropped as part of DOM level 2
+                 attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
         readonly attribute boolean         willValidate;
@@ -58,9 +59,9 @@ module html {
 
         // WinIE & FireFox extension:
 
-                 attribute [CustomGetter] long selectionStart;
-                 attribute [CustomGetter] long selectionEnd;
-        void               setSelectionRange(in long start, in long end);
+                 attribute [Custom] long selectionStart;
+                 attribute [Custom] long selectionEnd;
+        [Custom] void setSelectionRange(in long start, in long end);
 
 #if defined(LANGUAGE_OBJECTIVE_C)
         // Objective-C extension:
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
index ee66ca8838..bcfa6237f5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
@@ -24,7 +24,9 @@
 
 #include "config.h"
 #include "HTMLIsIndexElement.h"
+
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
@@ -34,13 +36,15 @@ HTMLIsIndexElement::HTMLIsIndexElement(const QualifiedName& tagName, Document *d
     : HTMLInputElement(tagName, doc, f)
 {
     ASSERT(hasTagName(isindexTag));
-    m_name = "isindex";
+    setDefaultName(isindexTag.localName());
 }
 
 void HTMLIsIndexElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == promptAttr)
         setValue(attr->value());
+    else if (attr->name() == placeholderAttr)
+        updatePlaceholderVisibility();
     else
         // don't call HTMLInputElement::parseMappedAttribute here, as it would
         // accept attributes this element does not support
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
index 563ad3c563..b1b6238786 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
@@ -29,6 +29,7 @@
 #include "FormDataList.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
+#include "MappedAttribute.h"
 #include "SSLKeyGenerator.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
@@ -54,7 +55,7 @@ HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Document* doc
     }
 }
 
-const AtomicString& HTMLKeygenElement::type() const
+const AtomicString& HTMLKeygenElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, keygen, ("keygen"));
     return keygen;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h
index 799763570a..b2a0c26ffc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h
@@ -33,7 +33,7 @@ public:
     HTMLKeygenElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual int tagPriority() const { return 0; }
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual bool isEnumeratable() const { return false; }
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool appendFormData(FormDataList&, bool);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
index 2d5518ed14..044b93c978 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
@@ -26,6 +26,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderListItem.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
index a6c4b89e3d..06b3b2fd2e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
@@ -59,7 +59,7 @@ HTMLElement* HTMLLabelElement::correspondingControl()
         while ((node = node->traverseNextNode(this))) {
             if (node->isHTMLElement()) {
                 HTMLElement* element = static_cast<HTMLElement*>(node);
-                if (element->isGenericFormElement())
+                if (element->isFormControlElement())
                     return element;
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
index e3f48fbce5..d6e08c7086 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
@@ -26,7 +26,6 @@
 #include "HTMLLegendElement.h"
 
 #include "HTMLNames.h"
-#include "RenderLegend.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -48,15 +47,7 @@ bool HTMLLegendElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-RenderObject* HTMLLegendElement::createRenderer(RenderArena* arena, RenderStyle* style)
-{
-    if (style->contentData())
-        return RenderObject::createObject(this, style);
-    
-    return new (arena) RenderLegend(this);
-}
-
-const AtomicString& HTMLLegendElement::type() const
+const AtomicString& HTMLLegendElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, legend, ("legend"));
     return legend;
@@ -97,7 +88,7 @@ Element *HTMLLegendElement::formElement()
     while ((node = node->traverseNextNode(fieldset))) {
         if (node->isHTMLElement()) {
             HTMLElement *element = static_cast<HTMLElement *>(node);
-            if (!element->hasLocalName(legendTag) && element->isGenericFormElement())
+            if (!element->hasLocalName(legendTag) && element->isFormControlElement())
                 return element;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
index b2ee51af3a..713d73c8e3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
@@ -34,8 +34,7 @@ public:
     virtual ~HTMLLegendElement();
 
     virtual bool isFocusable() const;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendToAnyElement);
 
     /**
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
index 192226d0f9..76a9703846 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
@@ -2,7 +2,8 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,6 +34,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
@@ -114,7 +116,7 @@ void HTMLLinkElement::parseMappedAttribute(MappedAttribute *attr)
         tokenizeRelAttribute(attr->value(), m_isStyleSheet, m_alternate, m_isIcon, m_isDNSPrefetch);
         process();
     } else if (attr->name() == hrefAttr) {
-        m_url = document()->completeURL(parseURL(attr->value())).string();
+        m_url = document()->completeURL(parseURL(attr->value()));
         process();
     } else if (attr->name() == typeAttr) {
         m_type = attr->value();
@@ -173,46 +175,37 @@ void HTMLLinkElement::process()
 
     // IE extension: location of small icon for locationbar / bookmarks
     // We'll record this URL per document, even if we later only use it in top level frames
-    if (m_isIcon && !m_url.isEmpty())
-        document()->setIconURL(m_url, type);
+    if (m_isIcon && m_url.isValid() && !m_url.isEmpty())
+        document()->setIconURL(m_url.string(), type);
 
-    if (m_isDNSPrefetch && !m_url.isEmpty())
-        prefetchDNS(KURL(m_url).host());
+    if (m_isDNSPrefetch && m_url.isValid() && !m_url.isEmpty())
+        prefetchDNS(m_url.host());
 
     // Stylesheet
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
-    if (m_disabledState != 2 && m_isStyleSheet && document()->frame()) {
-        // no need to load style sheets which aren't for the screen output
-        // ### there may be in some situations e.g. for an editor or script to manipulate
+    if (m_disabledState != 2 && m_isStyleSheet && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
-        MediaQueryEvaluator allEval(true);
-        MediaQueryEvaluator screenEval("screen", true);
-        MediaQueryEvaluator printEval("print", true);
-        RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(m_media);
-        if (allEval.eval(media.get()) || screenEval.eval(media.get()) || printEval.eval(media.get())) {
-
-            // Add ourselves as a pending sheet, but only if we aren't an alternate 
-            // stylesheet.  Alternate stylesheets don't hold up render tree construction.
-            if (!isAlternate())
-                document()->addPendingSheet();
+        // Add ourselves as a pending sheet, but only if we aren't an alternate 
+        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
+        if (!isAlternate())
+            document()->addPendingSheet();
+
+        String charset = getAttribute(charsetAttr);
+        if (charset.isEmpty() && document()->frame())
+            charset = document()->frame()->loader()->encoding();
 
-            String chset = getAttribute(charsetAttr);
-            if (chset.isEmpty() && document()->frame())
-                chset = document()->frame()->loader()->encoding();
-            
-            if (m_cachedSheet) {
-                if (m_loading)
-                    document()->removePendingSheet();
-                m_cachedSheet->removeClient(this);
-            }
-            m_loading = true;
-            m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, chset);
-            if (m_cachedSheet)
-                m_cachedSheet->addClient(this);
-            else if (!isAlternate()) { // request may have been denied if stylesheet is local and document is remote.
-                m_loading = false;
+        if (m_cachedSheet) {
+            if (m_loading)
                 document()->removePendingSheet();
-            }
+            m_cachedSheet->removeClient(this);
+        }
+        m_loading = true;
+        m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, charset);
+        if (m_cachedSheet)
+            m_cachedSheet->addClient(this);
+        else if (!isAlternate()) { // The request may have been denied if stylesheet is local and document is remote.
+            m_loading = false;
+            document()->removePendingSheet();
         }
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
@@ -384,11 +377,10 @@ void HTMLLinkElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLElement::addSubresourceAttributeURLs(urls);
 
-    if (m_isIcon) {
-        addSubresourceURL(urls, href());
+    // Favicons are handled by a special case in LegacyWebArchive::create()
+    if (m_isIcon)
         return;
-    }
-    
+
     if (!m_isStyleSheet)
         return;
     
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
index b41fc9ed16..aacac92996 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
@@ -102,7 +102,7 @@ public:
 protected:
     CachedResourceHandle<CachedCSSStyleSheet> m_cachedSheet;
     RefPtr<CSSStyleSheet> m_sheet;
-    String m_url;
+    KURL m_url;
     String m_type;
     String m_media;
     int m_disabledState; // 0=unset(default), 1=enabled via script, 2=disabled
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
index 532ac31363..98de809e6f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
@@ -35,12 +35,12 @@ module html {
         attribute  [ConvertNullToNullString] DOMString            target;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet   sheet;
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
index d7109c94e6..90204e0477 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
@@ -18,6 +18,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLMapElement.h"
 
@@ -25,8 +26,9 @@
 #include "HTMLAreaElement.h"
 #include "HTMLCollection.h"
 #include "HTMLNames.h"
-#include "IntSize.h"
 #include "HitTestResult.h"
+#include "IntSize.h"
+#include "MappedAttribute.h"
 
 using namespace std;
 
@@ -96,7 +98,7 @@ void HTMLMapElement::parseMappedAttribute(MappedAttribute* attr)
 
 PassRefPtr<HTMLCollection> HTMLMapElement::areas()
 {
-    return HTMLCollection::create(this, HTMLCollection::MapAreas);
+    return HTMLCollection::create(this, MapAreas);
 }
 
 String HTMLMapElement::name() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
index d2d69e4a6d..d62eaab9d9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLMarqueeElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderLayer.h"
 #include "RenderMarquee.h"
 
@@ -37,6 +39,7 @@ const int defaultMinimumDelay = 60;
 
 HTMLMarqueeElement::HTMLMarqueeElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
+    , ActiveDOMObject(doc, this)
     , m_minimumDelay(defaultMinimumDelay)
 {
     ASSERT(hasTagName(marqueeTag));
@@ -109,14 +112,31 @@ void HTMLMarqueeElement::parseMappedAttribute(MappedAttribute *attr)
 
 void HTMLMarqueeElement::start()
 {
-    if (renderer() && renderer()->hasLayer() && renderer()->layer()->marquee())
-        renderer()->layer()->marquee()->start();
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->start();
 }
 
 void HTMLMarqueeElement::stop()
 {
-    if (renderer() && renderer()->hasLayer() && renderer()->layer()->marquee())
-        renderer()->layer()->marquee()->stop();
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->stop();
+}
+
+bool HTMLMarqueeElement::canSuspend() const
+{
+    return true;
+}
+
+void HTMLMarqueeElement::suspend()
+{
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->suspend();
+}
+    
+void HTMLMarqueeElement::resume()
+{
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->updateMarqueePosition();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
index acd639b7e9..2423fc60b3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
@@ -23,11 +23,12 @@
 #ifndef HTMLMarqueeElement_h
 #define HTMLMarqueeElement_h
 
+#include "ActiveDOMObject.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
 
-class HTMLMarqueeElement : public HTMLElement {
+class HTMLMarqueeElement : public HTMLElement, private ActiveDOMObject {
 public:
     HTMLMarqueeElement(const QualifiedName&, Document*);
     
@@ -45,6 +46,11 @@ public:
     void stop();
     
 private:
+    // ActiveDOMObject
+    virtual bool canSuspend() const;
+    virtual void suspend();
+    virtual void resume();
+
     int m_minimumDelay;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index df38f014fd..6ad0653d1d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,25 +31,37 @@
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "ContentType.h"
+#include "DocLoader.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
 #include "HTMLVideoElement.h"
-#include <limits>
+#include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
+#include "MediaDocument.h"
 #include "MediaError.h"
 #include "MediaList.h"
-#include "MediaQueryEvaluator.h"
-#include "MIMETypeRegistry.h"
 #include "MediaPlayer.h"
+#include "MediaQueryEvaluator.h"
 #include "Page.h"
+#include "ProgressEvent.h"
 #include "RenderVideo.h"
-#include "SystemTime.h"
 #include "TimeRanges.h"
+#include <limits>
+#include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "RenderPartObject.h"
+#include "Widget.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -61,27 +73,39 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_loadTimer(this, &HTMLMediaElement::loadTimerFired)
     , m_asyncEventTimer(this, &HTMLMediaElement::asyncEventTimerFired)
     , m_progressEventTimer(this, &HTMLMediaElement::progressEventTimerFired)
+    , m_playbackProgressTimer(this, &HTMLMediaElement::playbackProgressTimerFired)
+    , m_playedTimeRanges()
+    , m_playbackRate(1.0f)
     , m_defaultPlaybackRate(1.0f)
-    , m_networkState(EMPTY)
-    , m_readyState(DATA_UNAVAILABLE)
-    , m_begun(false)
-    , m_loadedFirstFrame(false)
-    , m_autoplaying(true)
-    , m_currentLoop(0)
+    , m_networkState(NETWORK_EMPTY)
+    , m_readyState(HAVE_NOTHING)
     , m_volume(1.0f)
+    , m_lastSeekTime(0)
+    , m_previousProgress(0)
+    , m_previousProgressTime(numeric_limits<double>::max())
+    , m_lastTimeUpdateEventWallTime(0)
+    , m_lastTimeUpdateEventMovieTime(numeric_limits<float>::max())
+    , m_loadState(WaitingForSource)
+    , m_currentSourceNode(0)
+    , m_player(0)
+    , m_restrictions(NoRestrictions)
+    , m_playing(false)
+    , m_processingMediaPlayerCallback(0)
+    , m_processingLoad(false)
+    , m_delayingTheLoadEvent(false)
+    , m_haveFiredLoadedData(false)
+    , m_inActiveDocument(true)
+    , m_autoplaying(true)
     , m_muted(false)
     , m_paused(true)
     , m_seeking(false)
-    , m_currentTimeDuringSeek(0)
-    , m_previousProgress(0)
-    , m_previousProgressTime(numeric_limits<double>::max())
     , m_sentStalledEvent(false)
-    , m_bufferingRate(0)
-    , m_loadNestingLevel(0)
-    , m_terminateLoadBelowNestingLevel(0)
+    , m_sentEndEvent(false)
     , m_pausedInternal(false)
-    , m_inActiveDocument(true)
-    , m_player(0)
+    , m_sendProgressEvents(true)
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    , m_needWidgetUpdate(false)
+#endif
 {
     document()->registerForDocumentActivationCallbacks(this);
     document()->registerForMediaVolumeCallbacks(this);
@@ -104,11 +128,12 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
 
     const QualifiedName& attrName = attr->name();
     if (attrName == srcAttr) {
-        // 3.14.9.2.
-        // change to src attribute triggers load()
-        if (inDocument() && m_networkState == EMPTY)
+        // don't have a src or any <source> children, trigger load
+        if (inDocument() && m_loadState == WaitingForSource)
             scheduleLoad();
-    } if (attrName == controlsAttr) {
+    } 
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    else if (attrName == controlsAttr) {
         if (!isVideo() && attached() && (controls() != (renderer() != 0))) {
             detach();
             attach();
@@ -116,16 +141,39 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
         if (renderer())
             renderer()->updateFromElement();
     }
+#endif
 }
-    
+
+void HTMLMediaElement::parseMappedAttribute(MappedAttribute *attr)
+{
+    if (attr->name() == autobufferAttr) {
+        if (m_player)
+            m_player->setAutobuffer(!attr->isNull());
+    } else
+        HTMLElement::parseMappedAttribute(attr);
+}
+
 bool HTMLMediaElement::rendererIsNeeded(RenderStyle* style)
 {
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    UNUSED_PARAM(style);
+    Frame* frame = document()->frame();
+    if (!frame)
+        return false;
+
+    return true;
+#else
     return controls() ? HTMLElement::rendererIsNeeded(style) : false;
+#endif
 }
 
 RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    return new (arena) RenderPartObject(this);
+#else
     return new (arena) RenderMedia(this);
+#endif
 }
  
 void HTMLMediaElement::insertedIntoDocument()
@@ -137,10 +185,8 @@ void HTMLMediaElement::insertedIntoDocument()
 
 void HTMLMediaElement::removedFromDocument()
 {
-    // FIXME: pause() may invoke load() which seem like a strange thing to do as a side effect
-    // of removing an element. This might need to be fixed in the spec.
-    ExceptionCode ec;
-    pause(ec);
+    if (m_networkState > NETWORK_EMPTY)
+        pause();
     HTMLElement::removedFromDocument();
 }
 
@@ -148,6 +194,10 @@ void HTMLMediaElement::attach()
 {
     ASSERT(!attached());
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    m_needWidgetUpdate = true;
+#endif
+
     HTMLElement::attach();
 
     if (renderer())
@@ -167,39 +217,56 @@ void HTMLMediaElement::scheduleLoad()
     m_loadTimer.startOneShot(0);
 }
 
-void HTMLMediaElement::initAndDispatchProgressEvent(const AtomicString& eventName)
+void HTMLMediaElement::scheduleProgressEvent(const AtomicString& eventName)
 {
+    if (!m_sendProgressEvents)
+        return;
+
+    // FIXME: don't schedule timeupdate or progress events unless there are registered listeners
+
     bool totalKnown = m_player && m_player->totalBytesKnown();
     unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
     unsigned total = m_player ? m_player->totalBytes() : 0;
-    dispatchProgressEvent(eventName, totalKnown, loaded, total);
+
+    RefPtr<ProgressEvent> evt = ProgressEvent::create(eventName, totalKnown, loaded, total);
+    enqueueEvent(evt);
+
     if (renderer())
         renderer()->updateFromElement();
 }
 
-void HTMLMediaElement::dispatchEventAsync(const AtomicString& eventName)
+void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 {
-    m_asyncEventsToDispatch.append(eventName);
-    if (!m_asyncEventTimer.isActive())                            
-        m_asyncEventTimer.startOneShot(0);
+    enqueueEvent(Event::create(eventName, false, true));
 }
 
-void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
+void HTMLMediaElement::enqueueEvent(RefPtr<Event> event)
 {
-    ExceptionCode ec;
-    load(ec);
+    m_pendingEvents.append(event);
+    if (!m_asyncEventTimer.isActive())
+        m_asyncEventTimer.startOneShot(0);
 }
 
 void HTMLMediaElement::asyncEventTimerFired(Timer<HTMLMediaElement>*)
 {
-    Vector<AtomicString> asyncEventsToDispatch;
-    m_asyncEventsToDispatch.swap(asyncEventsToDispatch);
-    unsigned count = asyncEventsToDispatch.size();
-    for (unsigned n = 0; n < count; ++n)
-        dispatchEventForType(asyncEventsToDispatch[n], false, true);
+    Vector<RefPtr<Event> > pendingEvents;
+    ExceptionCode ec = 0;
+
+    m_pendingEvents.swap(pendingEvents);
+    unsigned count = pendingEvents.size();
+    for (unsigned ndx = 0; ndx < count; ++ndx) 
+        dispatchEvent(pendingEvents[ndx].release(), ec);
 }
 
-String serializeTimeOffset(float time)
+void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
+{
+    if (m_loadState == LoadingFromSourceElement)
+        loadNextSourceChild();
+    else
+        loadInternal();
+}
+
+static String serializeTimeOffset(float time)
 {
     String timeString = String::number(time);
     // FIXME serialize time offset values properly (format not specified yet)
@@ -207,7 +274,7 @@ String serializeTimeOffset(float time)
     return timeString;
 }
 
-float parseTimeOffset(const String& timeString, bool* ok = 0)
+static float parseTimeOffset(const String& timeString, bool* ok = 0)
 {
     const UChar* characters = timeString.characters();
     unsigned length = timeString.length();
@@ -260,252 +327,456 @@ HTMLMediaElement::NetworkState HTMLMediaElement::networkState() const
     return m_networkState;
 }
 
-float HTMLMediaElement::bufferingRate()
+String HTMLMediaElement::canPlayType(const String& mimeType) const
 {
-    if (!m_player)
-        return 0;
-    return m_bufferingRate;
-    //return m_player->dataRate();
+    MediaPlayer::SupportsType support = MediaPlayer::supportsType(ContentType(mimeType));
+    String canPlay;
+
+    // 4.8.10.3
+    switch (support)
+    {
+        case MediaPlayer::IsNotSupported:
+            canPlay = "no";
+            break;
+        case MediaPlayer::MayBeSupported:
+            canPlay = "maybe";
+            break;
+        case MediaPlayer::IsSupported:
+            canPlay = "probably";
+            break;
+    }
+    
+    return canPlay;
 }
 
 void HTMLMediaElement::load(ExceptionCode& ec)
 {
-    String mediaSrc;
-    
-    // 3.14.9.4. Loading the media resource
-    // 1
-    // if an event generated during load() ends up re-entering load(), terminate previous instances
-    m_loadNestingLevel++;
-    m_terminateLoadBelowNestingLevel = m_loadNestingLevel;
-    
-    m_progressEventTimer.stop();
-    m_sentStalledEvent = false;
-    m_bufferingRate = 0;
+    if (m_restrictions & RequireUserGestureForLoadRestriction && !processingUserGesture())
+        ec = INVALID_STATE_ERR;
+    else
+        loadInternal();
+}
+
+void HTMLMediaElement::loadInternal()
+{
+    // 1 - If the load() method for this element is already being invoked, then abort these steps.
+    if (m_processingLoad)
+        return;
+    m_processingLoad = true;
     
+    stopPeriodicTimers();
     m_loadTimer.stop();
+    m_sentStalledEvent = false;
+    m_haveFiredLoadedData = false;
+
+    // 2 - Abort any already-running instance of the resource selection algorithm for this element.
+    m_currentSourceNode = 0;
+
+    // 3 - If there are any tasks from the media element's media element event task source in 
+    // one of the task queues, then remove those tasks.
+    cancelPendingEventsAndCallbacks();
     
-    // 2
-    if (m_begun) {
-        m_begun = false;
+    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set the 
+    // error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED, 
+    // and fire a progress event called abort at the media element.
+    if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-        initAndDispatchProgressEvent(eventNames().abortEvent);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            goto end;
+        
+        // fire synchronous 'abort'
+        bool totalKnown = m_player && m_player->totalBytesKnown();
+        unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
+        unsigned total = m_player ? m_player->totalBytes() : 0;
+        dispatchProgressEvent(eventNames().abortEvent, totalKnown, loaded, total);
     }
     
-    // 3
+    // 5 
     m_error = 0;
-    m_loadedFirstFrame = false;
     m_autoplaying = true;
+    m_playedTimeRanges = TimeRanges::create();
+    m_lastSeekTime = 0;
+
+    // 6
+    setPlaybackRate(defaultPlaybackRate());
     
-    // 4
-    setPlaybackRate(defaultPlaybackRate(), ec);
-    
-    // 5
-    if (networkState() != EMPTY) {
-        m_networkState = EMPTY;
-        m_readyState = DATA_UNAVAILABLE;
+    // 7
+    if (m_networkState != NETWORK_EMPTY) {
+        m_networkState = NETWORK_EMPTY;
+        m_readyState = HAVE_NOTHING;
         m_paused = true;
         m_seeking = false;
         if (m_player) {
             m_player->pause();
+            m_playing = false;
             m_player->seek(0);
         }
-        m_currentLoop = 0;
-        dispatchEventForType(eventNames().emptiedEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            goto end;
+        dispatchEvent(eventNames().emptiedEvent, false, true);
     }
     
-    // 6
-    mediaSrc = pickMedia();
-    if (mediaSrc.isEmpty()) {
-        ec = INVALID_STATE_ERR;
-        goto end;
+    selectMediaResource();
+    m_processingLoad = false;
+}
+
+void HTMLMediaElement::selectMediaResource()
+{
+    // 1 - If the media element has neither a src attribute nor any source element children, run these substeps
+    String mediaSrc = getAttribute(srcAttr);
+    if (!mediaSrc && !havePotentialSourceChild()) {
+        m_loadState = WaitingForSource;
+
+        // 1 -  Set the networkState to NETWORK_NO_SOURCE
+        m_networkState = NETWORK_NO_SOURCE;
+        
+        // 2 - While the media element has neither a src attribute nor any source element children, 
+        // wait. (This steps might wait forever.)
+
+        m_delayingTheLoadEvent = false;
+        return;
     }
-    
-    // 7
-    m_networkState = LOADING;
-    
-    // 8
-    m_currentSrc = mediaSrc;
-    
-    // 9
-    m_begun = true;        
-    dispatchProgressEvent(eventNames().loadstartEvent, false, 0, 0);
-    if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-        goto end;
-    
-    // 10, 11, 12, 13
+
+    // 2
+    m_delayingTheLoadEvent = true;
+
+    // 3
+    m_networkState = NETWORK_LOADING;
+
+    // 4
+    scheduleProgressEvent(eventNames().loadstartEvent);
+
+    // 5 - If the media element has a src attribute, then run these substeps
+    ContentType contentType("");
+    if (!mediaSrc.isEmpty()) {
+        KURL mediaURL = document()->completeURL(mediaSrc);
+        if (isSafeToLoadURL(mediaURL, Complain)) {
+            m_loadState = LoadingFromSrcAttr;
+            loadResource(mediaURL, contentType);
+        } else 
+            noneSupported();
+
+        return;
+    }
+
+    // Otherwise, the source elements will be used
+    m_currentSourceNode = 0;
+    loadNextSourceChild();
+}
+
+void HTMLMediaElement::loadNextSourceChild()
+{
+    ContentType contentType("");
+    KURL mediaURL = selectNextSourceChild(&contentType, Complain);
+    if (!mediaURL.isValid()) {
+        // It seems wrong to fail silently when we give up because no suitable <source>
+        // element can be found and set the error attribute if the element's 'src' attribute
+        // fails, but that is what the spec says.
+        return;
+    }
+
+    m_loadState = LoadingFromSourceElement;
+    loadResource(mediaURL, contentType);
+}
+
+void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
+{
+    ASSERT(isSafeToLoadURL(url, Complain));
+
+    // The resource fetch algorithm 
+    m_networkState = NETWORK_LOADING;
+
+    m_currentSrc = url;
+
+    if (m_sendProgressEvents) 
+        startProgressEventTimer();
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     m_player.clear();
     m_player.set(new MediaPlayer(this));
+#else
+    if (!m_player)
+        m_player.set(new MediaPlayer(this));
+#endif
+
     updateVolume();
-    m_player->load(m_currentSrc);
-    if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-        goto end;
+
+    m_player->load(m_currentSrc, contentType);
     
     if (renderer())
         renderer()->updateFromElement();
+}
+
+bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction actionIfInvalid)
+{
+    Frame* frame = document()->frame();
+    FrameLoader* loader = frame ? frame->loader() : 0;
+
+    // don't allow remote to local urls
+    if (!loader || !loader->canLoad(url, String(), document())) {
+        if (actionIfInvalid == Complain)
+            FrameLoader::reportLocalLoadFailed(frame, url.string());
+        return false;
+    }
     
-    // 14
-    m_previousProgressTime = WebCore::currentTime();
+    return true;
+}
+
+void HTMLMediaElement::startProgressEventTimer()
+{
+    if (m_progressEventTimer.isActive())
+        return;
+
+    m_previousProgressTime = WTF::currentTime();
     m_previousProgress = 0;
-    if (m_begun)
-        // 350ms is not magic, it is in the spec!
-        m_progressEventTimer.startRepeating(0.350);
-end:
-    ASSERT(m_loadNestingLevel);
-    m_loadNestingLevel--;
+    // 350ms is not magic, it is in the spec!
+    m_progressEventTimer.startRepeating(0.350);
+}
+
+void HTMLMediaElement::noneSupported()
+{
+    stopPeriodicTimers();
+    m_loadState = WaitingForSource;
+    m_currentSourceNode = 0;
+
+    // 3 - Reaching this step indicates that either the URL failed to resolve, or the media 
+    // resource failed to load. Set the error attribute to a new MediaError object whose 
+    // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
+    m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
+
+    // 4- Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    m_networkState = NETWORK_NO_SOURCE;
+
+    // 5 - Queue a task to fire a progress event called error at the media element.
+    scheduleProgressEvent(eventNames().errorEvent); 
+
+    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    m_delayingTheLoadEvent = false;
+
+    // Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
+    
+    if (isVideo())
+        static_cast<HTMLVideoElement*>(this)->updatePosterImage();
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
+{
+    // 1 - The user agent should cancel the fetching process.
+    stopPeriodicTimers();
+    m_loadState = WaitingForSource;
+
+    // 2 - Set the error attribute to a new MediaError object whose code attribute is 
+    // set to MEDIA_ERR_NETWORK/MEDIA_ERR_DECODE.
+    m_error = err;
+
+    // 3 - Queue a task to fire a progress event called error at the media element.
+    scheduleProgressEvent(eventNames().errorEvent); 
+
+    // 3 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a 
+    // task to fire a simple event called emptied at the element.
+    m_networkState = NETWORK_EMPTY;
+    scheduleEvent(eventNames().emptiedEvent);
+
+    // 4 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    m_delayingTheLoadEvent = false;
+
+    // 5 - Abort the overall resource selection algorithm.
+    m_currentSourceNode = 0;
+
+}
+
+void HTMLMediaElement::cancelPendingEventsAndCallbacks()
+{
+    m_pendingEvents.clear();
+
+    for (Node* node = firstChild(); node; node = node->nextSibling()) {
+        if (node->hasTagName(sourceTag))
+            static_cast<HTMLSourceElement*>(node)->cancelPendingErrorEvent();
+    }
 }
 
 void HTMLMediaElement::mediaPlayerNetworkStateChanged(MediaPlayer*)
 {
-    if (!m_begun || m_networkState == EMPTY)
+    beginProcessingMediaPlayerCallback();
+    setNetworkState(m_player->networkState());
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
+{
+    if (state == MediaPlayer::Empty) {
+        // just update the cached state and leave, we can't do anything 
+        m_networkState = NETWORK_EMPTY;
         return;
-    
-    m_terminateLoadBelowNestingLevel = m_loadNestingLevel;
+    }
 
-    MediaPlayer::NetworkState state = m_player->networkState();
-    
-    // 3.14.9.4. Loading the media resource
-    // 14
-    if (state == MediaPlayer::LoadFailed) {
-        //delete m_player;
-        //m_player = 0;
-        // FIXME better error handling
-        m_error = MediaError::create(MediaError::MEDIA_ERR_NETWORK);
-        m_begun = false;
-        m_progressEventTimer.stop();
-        m_bufferingRate = 0;
-        
-        initAndDispatchProgressEvent(eventNames().errorEvent); 
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
+    if (state == MediaPlayer::FormatError || state == MediaPlayer::NetworkError || state == MediaPlayer::DecodeError) {
+        stopPeriodicTimers();
+
+        // If we failed while trying to load a <source> element, the movie was never parsed, and there are more
+        // <source> children, schedule the next one
+        if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement) {
+            m_currentSourceNode->scheduleErrorEvent();
+            if (havePotentialSourceChild())
+                scheduleLoad();
             return;
-        
-        m_networkState = EMPTY;
-        
+        }
+
+        if (state == MediaPlayer::NetworkError)
+            mediaEngineError(MediaError::create(MediaError::MEDIA_ERR_NETWORK));
+        else if (state == MediaPlayer::DecodeError)
+            mediaEngineError(MediaError::create(MediaError::MEDIA_ERR_DECODE));
+        else if (state == MediaPlayer::FormatError && m_loadState == LoadingFromSrcAttr)
+            noneSupported();
+
         if (isVideo())
             static_cast<HTMLVideoElement*>(this)->updatePosterImage();
 
-        dispatchEventForType(eventNames().emptiedEvent, false, true);
         return;
     }
-    
-    if (state >= MediaPlayer::Loading && m_networkState < LOADING)
-        m_networkState = LOADING;
-    
-    if (state >= MediaPlayer::LoadedMetaData && m_networkState < LOADED_METADATA) {
-        m_player->seek(effectiveStart());
-        m_networkState = LOADED_METADATA;
-        
-        dispatchEventForType(eventNames().durationchangeEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-        
-        dispatchEventForType(eventNames().loadedmetadataEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-    }
-    
-    if (state >= MediaPlayer::LoadedFirstFrame && m_networkState < LOADED_FIRST_FRAME) {
-        m_networkState = LOADED_FIRST_FRAME;
-        
-        setReadyState(CAN_SHOW_CURRENT_FRAME);
-        
-        if (isVideo())
-            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
-        
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-        
-        m_loadedFirstFrame = true;
-        if (renderer()) {
-            ASSERT(!renderer()->isImage());
-            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+
+    if (state == MediaPlayer::Idle) {
+        ASSERT(static_cast<ReadyState>(m_player->readyState()) < HAVE_ENOUGH_DATA);
+        if (m_networkState > NETWORK_IDLE) {
+            stopPeriodicTimers();
+            scheduleProgressEvent(eventNames().suspendEvent);
         }
-        
-        dispatchEventForType(eventNames().loadedfirstframeEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-        
-        dispatchEventForType(eventNames().canshowcurrentframeEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
+        m_networkState = NETWORK_IDLE;
     }
-    
-    // 15
-    if (state == MediaPlayer::Loaded && m_networkState < LOADED) {
-        m_begun = false;
-        m_networkState = LOADED;
-        m_progressEventTimer.stop();
-        m_bufferingRate = 0;
-        initAndDispatchProgressEvent(eventNames().loadEvent); 
+
+    if (state == MediaPlayer::Loading) {
+        if (m_networkState < NETWORK_LOADING || m_networkState == NETWORK_NO_SOURCE)
+            startProgressEventTimer();
+        m_networkState = NETWORK_LOADING;
+    }
+
+    if (state == MediaPlayer::Loaded) {
+        NetworkState oldState = m_networkState;
+
+        m_networkState = NETWORK_LOADED;
+        if (oldState < NETWORK_LOADED || oldState == NETWORK_NO_SOURCE) {
+            m_progressEventTimer.stop();
+
+            // Check to see if readyState changes need to be dealt with before sending the 
+            // 'load' event so we report 'canplaythrough' first. This is necessary because a
+            //  media engine reports readyState and networkState changes separately
+            MediaPlayer::ReadyState currentState = m_player->readyState();
+            if (static_cast<ReadyState>(currentState) != m_readyState)
+                setReadyState(currentState);
+
+             scheduleProgressEvent(eventNames().loadEvent); 
+        }
     }
 }
 
 void HTMLMediaElement::mediaPlayerReadyStateChanged(MediaPlayer*)
 {
-    MediaPlayer::ReadyState state = m_player->readyState();
-    setReadyState((ReadyState)state);
+    beginProcessingMediaPlayerCallback();
+
+    setReadyState(m_player->readyState());
+
+    endProcessingMediaPlayerCallback();
 }
 
-void HTMLMediaElement::setReadyState(ReadyState state)
+void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 {
-    // 3.14.9.6. The ready states
-    if (m_readyState == state)
+    // Set "wasPotentiallyPlaying" BEFORE updating m_readyState, potentiallyPlaying() uses it
+    bool wasPotentiallyPlaying = potentiallyPlaying();
+
+    ReadyState oldState = m_readyState;
+    m_readyState = static_cast<ReadyState>(state);
+
+    if (m_readyState == oldState)
         return;
     
-    bool wasActivelyPlaying = activelyPlaying();
-    m_readyState = state;
-    
-    if (state >= CAN_PLAY)
+    if (m_readyState >= HAVE_CURRENT_DATA)
         m_seeking = false;
     
-    if (networkState() == EMPTY)
+    if (m_networkState == NETWORK_EMPTY)
         return;
-    
-    if (state == DATA_UNAVAILABLE) {
-        dispatchEventForType(eventNames().dataunavailableEvent, false, true);
-        if (wasActivelyPlaying) {
-            dispatchEventForType(eventNames().timeupdateEvent, false, true);
-            dispatchEventForType(eventNames().waitingEvent, false, true);
-        }
-    } else if (state == CAN_SHOW_CURRENT_FRAME) {
-        if (m_loadedFirstFrame)
-            dispatchEventForType(eventNames().canshowcurrentframeEvent, false, true);
-        if (wasActivelyPlaying) {
-            dispatchEventForType(eventNames().timeupdateEvent, false, true);
-            dispatchEventForType(eventNames().waitingEvent, false, true);
+
+    if (m_seeking && m_readyState < HAVE_CURRENT_DATA) {
+        // 4.8.10.10, step 9
+        scheduleEvent(eventNames().seekingEvent);
+        m_seeking = false;
+    }
+
+    if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
+        // 4.8.10.9
+        scheduleTimeupdateEvent(false);
+        scheduleEvent(eventNames().waitingEvent);
+    }
+
+    if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
+        scheduleEvent(eventNames().durationchangeEvent);
+        scheduleEvent(eventNames().loadedmetadataEvent);
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        if (renderer() && !renderer()->isImage()) {
+            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
         }
-    } else if (state == CAN_PLAY) {
-        dispatchEventForType(eventNames().canplayEvent, false, true);
-    } else if (state == CAN_PLAY_THROUGH) {
-        dispatchEventForType(eventNames().canplaythroughEvent, false, true);
+#endif        
+        m_delayingTheLoadEvent = false;
+        m_player->seek(0);
+    }
+
+    // 4.8.10.7 says loadeddata is sent only when the new state *is* HAVE_CURRENT_DATA: "If the
+    // previous ready state was HAVE_METADATA and the new ready state is HAVE_CURRENT_DATA", 
+    // but the event table at the end of the spec says it is sent when: "readyState newly 
+    // increased to HAVE_CURRENT_DATA  or greater for the first time"
+    // We go with the later because it seems useful to count on getting this event
+    if (m_readyState >= HAVE_CURRENT_DATA && oldState < HAVE_CURRENT_DATA && !m_haveFiredLoadedData) {
+        m_haveFiredLoadedData = true;
+        scheduleEvent(eventNames().loadeddataEvent);
+    }
+
+    bool isPotentiallyPlaying = potentiallyPlaying();
+    if (m_readyState == HAVE_FUTURE_DATA && oldState <= HAVE_CURRENT_DATA) {
+        scheduleEvent(eventNames().canplayEvent);
+        if (isPotentiallyPlaying)
+            scheduleEvent(eventNames().playingEvent);
+
+        if (isVideo())
+            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
+    }
+
+    if (m_readyState == HAVE_ENOUGH_DATA && oldState < HAVE_ENOUGH_DATA) {
+        if (oldState <= HAVE_CURRENT_DATA)
+            scheduleEvent(eventNames().canplayEvent);
+
+        scheduleEvent(eventNames().canplaythroughEvent);
+
+        if (isPotentiallyPlaying && oldState <= HAVE_CURRENT_DATA)
+            scheduleEvent(eventNames().playingEvent);
+
         if (m_autoplaying && m_paused && autoplay()) {
             m_paused = false;
-            dispatchEventForType(eventNames().playEvent, false, true);
+            scheduleEvent(eventNames().playEvent);
+            scheduleEvent(eventNames().playingEvent);
         }
+
+        if (isVideo())
+            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
     }
+
     updatePlayState();
 }
 
 void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
 {
     ASSERT(m_player);
+    if (m_networkState == NETWORK_EMPTY || m_networkState >= NETWORK_LOADED)
+        return;
+
     unsigned progress = m_player->bytesLoaded();
-    double time = WebCore::currentTime();
+    double time = WTF::currentTime();
     double timedelta = time - m_previousProgressTime;
-    if (timedelta)
-        m_bufferingRate = (float)(0.8 * m_bufferingRate + 0.2 * ((float)(progress - m_previousProgress)) / timedelta);
-    
+
     if (progress == m_previousProgress) {
         if (timedelta > 3.0 && !m_sentStalledEvent) {
-            m_bufferingRate = 0;
-            initAndDispatchProgressEvent(eventNames().stalledEvent);
+            scheduleProgressEvent(eventNames().stalledEvent);
             m_sentStalledEvent = true;
         }
     } else {
-        initAndDispatchProgressEvent(eventNames().progressEvent);
+        scheduleProgressEvent(eventNames().progressEvent);
         m_previousProgress = progress;
         m_previousProgressTime = time;
         m_sentStalledEvent = false;
@@ -514,52 +785,49 @@ void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
 
 void HTMLMediaElement::seek(float time, ExceptionCode& ec)
 {
-    // 3.14.9.8. Seeking
+    // 4.8.10.10. Seeking
     // 1
-    if (networkState() < LOADED_METADATA) {
+    if (m_readyState == HAVE_NOTHING || !m_player) {
         ec = INVALID_STATE_ERR;
         return;
     }
-    
+
     // 2
-    float minTime;
-    if (currentLoop() == 0)
-        minTime = effectiveStart();
-    else
-        minTime = effectiveLoopStart();
- 
+    time = min(time, duration());
+
     // 3
-    float maxTime = currentLoop() == playCount() - 1 ? effectiveEnd() : effectiveLoopEnd();
-    
+    time = max(time, 0.0f);
+
     // 4
-    time = min(time, maxTime);
-    
-    // 5
-    time = max(time, minTime);
-    
-    // 6
     RefPtr<TimeRanges> seekableRanges = seekable();
     if (!seekableRanges->contain(time)) {
         ec = INDEX_SIZE_ERR;
         return;
     }
     
-    // 7
-    m_currentTimeDuringSeek = time;
+    // avoid generating events when the time won't actually change
+    float now = currentTime();
+    if (time == now)
+        return;
+
+    // 5
+    if (m_playing) {
+        if (m_lastSeekTime < now)
+            m_playedTimeRanges->add(m_lastSeekTime, now);
+    }
+    m_lastSeekTime = time;
 
-    // 8
+    // 6 - set the seeking flag, it will be cleared when the engine tells is the time has actually changed
     m_seeking = true;
-    
-    // 9
-    dispatchEventForType(eventNames().timeupdateEvent, false, true);
-    
+
+    // 7
+    scheduleTimeupdateEvent(false);
+
+    // 8 - this is covered, if necessary, when the engine signals a readystate change
+
     // 10
-    // As soon as the user agent has established whether or not the media data for the new playback position is available, 
-    // and, if it is, decoded enough data to play back that position, the seeking DOM attribute must be set to false.
-    if (m_player) {
-        m_player->setEndTime(maxTime);
-        m_player->seek(time);
-    }
+    m_player->seek(time);
+    m_sentEndEvent = false;
 }
 
 HTMLMediaElement::ReadyState HTMLMediaElement::readyState() const
@@ -578,7 +846,7 @@ float HTMLMediaElement::currentTime() const
     if (!m_player)
         return 0;
     if (m_seeking)
-        return m_currentTimeDuringSeek;
+        return m_lastSeekTime;
     return m_player->currentTime();
 }
 
@@ -587,9 +855,19 @@ void HTMLMediaElement::setCurrentTime(float time, ExceptionCode& ec)
     seek(time, ec);
 }
 
+float HTMLMediaElement::startTime() const
+{
+    if (!m_player)
+        return 0;
+    return m_player->startTime();
+}
+
 float HTMLMediaElement::duration() const
 {
-    return m_player ? m_player->duration() : 0;
+    if (m_readyState >= HAVE_METADATA)
+        return m_player->duration();
+
+    return numeric_limits<float>::quiet_NaN();
 }
 
 bool HTMLMediaElement::paused() const
@@ -602,15 +880,11 @@ float HTMLMediaElement::defaultPlaybackRate() const
     return m_defaultPlaybackRate;
 }
 
-void HTMLMediaElement::setDefaultPlaybackRate(float rate, ExceptionCode& ec)
+void HTMLMediaElement::setDefaultPlaybackRate(float rate)
 {
-    if (rate == 0.0f) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
     if (m_defaultPlaybackRate != rate) {
         m_defaultPlaybackRate = rate;
-        dispatchEventAsync(eventNames().ratechangeEvent);
+        scheduleEvent(eventNames().ratechangeEvent);
     }
 }
 
@@ -619,16 +893,14 @@ float HTMLMediaElement::playbackRate() const
     return m_player ? m_player->rate() : 0;
 }
 
-void HTMLMediaElement::setPlaybackRate(float rate, ExceptionCode& ec)
+void HTMLMediaElement::setPlaybackRate(float rate)
 {
-    if (rate == 0.0f) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
+    if (m_playbackRate != rate) {
+        m_playbackRate = rate;
+        scheduleEvent(eventNames().ratechangeEvent);
     }
-    if (m_player && m_player->rate() != rate) {
+    if (m_player && potentiallyPlaying() && m_player->rate() != rate)
         m_player->setRate(rate);
-        dispatchEventAsync(eventNames().ratechangeEvent);
-    }
 }
 
 bool HTMLMediaElement::ended() const
@@ -646,126 +918,95 @@ void HTMLMediaElement::setAutoplay(bool b)
     setBooleanAttribute(autoplayAttr, b);
 }
 
-void HTMLMediaElement::play(ExceptionCode& ec)
+bool HTMLMediaElement::autobuffer() const
 {
-    // 3.14.9.7. Playing the media resource
-    if (!m_player || networkState() == EMPTY) {
-        ec = 0;
-        load(ec);
-        if (ec)
-            return;
-    }
-    ExceptionCode unused;
-    if (endedPlayback()) {
-        m_currentLoop = 0;
-        seek(effectiveStart(), unused);
-    }
-    setPlaybackRate(defaultPlaybackRate(), unused);
-    
-    if (m_paused) {
-        m_paused = false;
-        dispatchEventAsync(eventNames().playEvent);
-    }
-
-    m_autoplaying = false;
-    
-    updatePlayState();
+    return hasAttribute(autobufferAttr);
 }
 
-void HTMLMediaElement::pause(ExceptionCode& ec)
+void HTMLMediaElement::setAutobuffer(bool b)
 {
-    // 3.14.9.7. Playing the media resource
-    if (!m_player || networkState() == EMPTY) {
-        ec = 0;
-        load(ec);
-        if (ec)
-            return;
-    }
-
-    if (!m_paused) {
-        m_paused = true;
-        dispatchEventAsync(eventNames().timeupdateEvent);
-        dispatchEventAsync(eventNames().pauseEvent);
-    }
-
-    m_autoplaying = false;
-    
-    updatePlayState();
+    setBooleanAttribute(autobufferAttr, b);
 }
 
-unsigned HTMLMediaElement::playCount() const
+void HTMLMediaElement::play()
 {
-    bool ok;
-    unsigned count = getAttribute(playcountAttr).string().toUInt(&ok);
-    return (count > 0 && ok) ? count : 1; 
+    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !processingUserGesture())
+        return;
+
+    playInternal();
 }
 
-void HTMLMediaElement::setPlayCount(unsigned count, ExceptionCode& ec)
+void HTMLMediaElement::playInternal()
 {
-    if (!count) {
-        ec = INDEX_SIZE_ERR;
-        return;
+    // 4.8.10.9. Playing the media resource
+    if (!m_player || m_networkState == NETWORK_EMPTY)
+        scheduleLoad();
+
+    if (endedPlayback()) {
+        ExceptionCode unused;
+        seek(0, unused);
     }
-    setAttribute(playcountAttr, String::number(count));
-    checkIfSeekNeeded();
-}
+    
+    setPlaybackRate(defaultPlaybackRate());
+    
+    if (m_paused) {
+        m_paused = false;
+        scheduleEvent(eventNames().playEvent);
 
-float HTMLMediaElement::start() const 
-{ 
-    return getTimeOffsetAttribute(startAttr, 0); 
-}
+        if (m_readyState <= HAVE_CURRENT_DATA)
+            scheduleEvent(eventNames().waitingEvent);
+        else if (m_readyState >= HAVE_FUTURE_DATA)
+            scheduleEvent(eventNames().playingEvent);
+    }
+    m_autoplaying = false;
 
-void HTMLMediaElement::setStart(float time) 
-{ 
-    setTimeOffsetAttribute(startAttr, time); 
-    checkIfSeekNeeded();
+    updatePlayState();
 }
 
-float HTMLMediaElement::end() const 
-{ 
-    return getTimeOffsetAttribute(endAttr, std::numeric_limits<float>::infinity()); 
-}
+void HTMLMediaElement::pause()
+{
+    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !processingUserGesture())
+        return;
 
-void HTMLMediaElement::setEnd(float time) 
-{ 
-    setTimeOffsetAttribute(endAttr, time); 
-    checkIfSeekNeeded();
+    pauseInternal();
 }
 
-float HTMLMediaElement::loopStart() const 
-{ 
-    return getTimeOffsetAttribute(loopstartAttr, start()); 
-}
 
-void HTMLMediaElement::setLoopStart(float time) 
+void HTMLMediaElement::pauseInternal()
 {
-    setTimeOffsetAttribute(loopstartAttr, time); 
-    checkIfSeekNeeded();
-}
+    // 4.8.10.9. Playing the media resource
+    if (!m_player || m_networkState == NETWORK_EMPTY)
+        scheduleLoad();
 
-float HTMLMediaElement::loopEnd() const 
-{ 
-    return getTimeOffsetAttribute(loopendAttr, end()); 
-}
+    m_autoplaying = false;
+    
+    if (!m_paused) {
+        m_paused = true;
+        scheduleTimeupdateEvent(false);
+        scheduleEvent(eventNames().pauseEvent);
+    }
 
-void HTMLMediaElement::setLoopEnd(float time) 
-{ 
-    setTimeOffsetAttribute(loopendAttr, time); 
-    checkIfSeekNeeded();
+    updatePlayState();
 }
 
-unsigned HTMLMediaElement::currentLoop() const
+bool HTMLMediaElement::loop() const
 {
-    return m_currentLoop;
+    return hasAttribute(loopAttr);
 }
 
-void HTMLMediaElement::setCurrentLoop(unsigned currentLoop)
+void HTMLMediaElement::setLoop(bool b)
 {
-    m_currentLoop = currentLoop;
+    setBooleanAttribute(loopAttr, b);
 }
 
 bool HTMLMediaElement::controls() const
 {
+    Frame* frame = document()->frame();
+
+    // always show controls when scripting is disabled
+    if (frame && !frame->script()->isEnabled())
+        return true;
+
     return hasAttribute(controlsAttr);
 }
 
@@ -789,7 +1030,7 @@ void HTMLMediaElement::setVolume(float vol, ExceptionCode& ec)
     if (m_volume != vol) {
         m_volume = vol;
         updateVolume();
-        dispatchEventAsync(eventNames().volumechangeEvent);
+        scheduleEvent(eventNames().volumechangeEvent);
     }
 }
 
@@ -803,110 +1044,245 @@ void HTMLMediaElement::setMuted(bool muted)
     if (m_muted != muted) {
         m_muted = muted;
         updateVolume();
-        dispatchEventAsync(eventNames().volumechangeEvent);
+        scheduleEvent(eventNames().volumechangeEvent);
     }
 }
 
-bool HTMLMediaElement::canPlay() const
+void HTMLMediaElement::togglePlayState()
 {
-    return paused() || ended() || networkState() < LOADED_METADATA;
+    // We can safely call the internal play/pause methods, which don't check restrictions, because
+    // this method is only called from the built-in media controller
+    if (canPlay())
+        playInternal();
+    else 
+        pauseInternal();
 }
 
-String HTMLMediaElement::pickMedia()
+void HTMLMediaElement::beginScrubbing()
 {
-    // 3.14.9.2. Location of the media resource
-    String mediaSrc = getAttribute(srcAttr);
-    if (mediaSrc.isEmpty()) {
-        for (Node* n = firstChild(); n; n = n->nextSibling()) {
-            if (n->hasTagName(sourceTag)) {
-                HTMLSourceElement* source = static_cast<HTMLSourceElement*>(n);
-                if (!source->hasAttribute(srcAttr))
-                    continue; 
-                if (source->hasAttribute(mediaAttr)) {
-                    MediaQueryEvaluator screenEval("screen", document()->frame(), renderer() ? renderer()->style() : 0);
-                    RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(source->media());
-                    if (!screenEval.eval(media.get()))
-                        continue;
-                }
-                if (source->hasAttribute(typeAttr)) {
-                    String type = source->type().stripWhiteSpace();
-
-                    // "type" can have parameters after a semi-colon, strip them before checking with the type registry
-                    int semi = type.find(';');
-                    if (semi != -1)
-                        type = type.left(semi).stripWhiteSpace();
-
-                    if (!MIMETypeRegistry::isSupportedMediaMIMEType(type))
-                        continue;
-                }
-                mediaSrc = source->src().string();
-                break;
-            }
+    if (!paused()) {
+        if (ended()) {
+            // Because a media element stays in non-paused state when it reaches end, playback resumes 
+            // when the slider is dragged from the end to another position unless we pause first. Do 
+            // a "hard pause" so an event is generated, since we want to stay paused after scrubbing finishes.
+            pause();
+        } else {
+            // Not at the end but we still want to pause playback so the media engine doesn't try to
+            // continue playing during scrubbing. Pause without generating an event as we will 
+            // unpause after scrubbing finishes.
+            setPausedInternal(true);
         }
     }
-    if (!mediaSrc.isEmpty())
-        mediaSrc = document()->completeURL(mediaSrc).string();
-    return mediaSrc;
 }
 
-void HTMLMediaElement::checkIfSeekNeeded()
+void HTMLMediaElement::endScrubbing()
 {
-    // 3.14.9.5. Offsets into the media resource
-    // 1
-    if (playCount() <= m_currentLoop)
-        m_currentLoop = playCount() - 1;
-    
-    // 2
-    if (networkState() <= LOADING)
+    if (m_pausedInternal)
+        setPausedInternal(false);
+}
+
+// The spec says to fire periodic timeupdate events (those sent while playing) every
+// "15 to 250ms", we choose the slowest frequency
+static const double maxTimeupdateEventFrequency = 0.25;
+
+void HTMLMediaElement::startPlaybackProgressTimer()
+{
+    if (m_playbackProgressTimer.isActive())
         return;
+
+    m_previousProgressTime = WTF::currentTime();
+    m_previousProgress = 0;
+    m_playbackProgressTimer.startRepeating(maxTimeupdateEventFrequency);
+}
+
+void HTMLMediaElement::playbackProgressTimerFired(Timer<HTMLMediaElement>*)
+{
+    ASSERT(m_player);
+    if (!m_playbackRate)
+        return;
+
+    scheduleTimeupdateEvent(true);
     
-    // 3
-    ExceptionCode ec;
-    float time = currentTime();
-    if (!m_currentLoop && time < effectiveStart())
-        seek(effectiveStart(), ec);
+    // FIXME: deal with cue ranges here
+}
 
-    // 4
-    if (m_currentLoop && time < effectiveLoopStart())
-        seek(effectiveLoopStart(), ec);
-        
-    // 5
-    if (m_currentLoop < playCount() - 1 && time > effectiveLoopEnd()) {
-        seek(effectiveLoopStart(), ec);
-        m_currentLoop++;
+void HTMLMediaElement::scheduleTimeupdateEvent(bool periodicEvent)
+{
+    double now = WTF::currentTime();
+    double timedelta = now - m_lastTimeUpdateEventWallTime;
+
+    // throttle the periodic events
+    if (periodicEvent && timedelta < maxTimeupdateEventFrequency)
+        return;
+
+    // Some media engines make multiple "time changed" callbacks at the same time, but we only want one
+    // event at a given time so filter here
+    float movieTime = m_player ? m_player->currentTime() : 0;
+    if (movieTime != m_lastTimeUpdateEventMovieTime) {
+        scheduleEvent(eventNames().timeupdateEvent);
+        m_lastTimeUpdateEventWallTime = now;
+        m_lastTimeUpdateEventMovieTime = movieTime;
     }
-    
-    // 6
-    if (m_currentLoop == playCount() - 1 && time > effectiveEnd())
-        seek(effectiveEnd(), ec);
+}
 
-    updatePlayState();
+bool HTMLMediaElement::canPlay() const
+{
+    return paused() || ended() || m_readyState < HAVE_METADATA;
+}
+
+bool HTMLMediaElement::havePotentialSourceChild()
+{
+    // Stash the current <source> node so we can restore it after checking
+    // to see there is another potential
+    HTMLSourceElement* currentSourceNode = m_currentSourceNode;
+    KURL nextURL = selectNextSourceChild(0, DoNothing);
+    m_currentSourceNode = currentSourceNode;
+
+    return nextURL.isValid();
+}
+
+KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSourceAction actionIfInvalid)
+{
+    KURL mediaURL;
+    Node* node;
+    bool lookingForPreviousNode = m_currentSourceNode;
+    bool canUse = false;
+
+    for (node = firstChild(); !canUse && node; node = node->nextSibling()) {
+        if (!node->hasTagName(sourceTag))
+            continue;
+
+        if (lookingForPreviousNode) {
+            if (m_currentSourceNode == static_cast<HTMLSourceElement*>(node))
+                lookingForPreviousNode = false;
+            continue;
+        }
+
+        HTMLSourceElement* source = static_cast<HTMLSourceElement*>(node);
+        if (!source->hasAttribute(srcAttr))
+            goto check_again; 
+
+        if (source->hasAttribute(mediaAttr)) {
+            MediaQueryEvaluator screenEval("screen", document()->frame(), renderer() ? renderer()->style() : 0);
+            RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(source->media());
+            if (!screenEval.eval(media.get())) 
+                goto check_again;
+        }
+
+        if (source->hasAttribute(typeAttr)) {
+            if (!MediaPlayer::supportsType(ContentType(source->type())))
+                goto check_again;
+        }
+
+        // Is it safe to load this url?
+        mediaURL = source->src();
+        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid))
+            goto check_again;
+
+        // Making it this far means the <source> looks reasonable
+        canUse = true;
+        if (contentType)
+            *contentType = ContentType(source->type());
+
+check_again:
+        if (!canUse && actionIfInvalid == Complain)
+            source->scheduleErrorEvent();
+        m_currentSourceNode = static_cast<HTMLSourceElement*>(node);
+    }
+
+    if (!canUse)
+        m_currentSourceNode = 0;
+    return canUse ? mediaURL : KURL();
 }
 
 void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
-    if (readyState() >= CAN_PLAY)
+    beginProcessingMediaPlayerCallback();
+
+    if (m_readyState >= HAVE_CURRENT_DATA && m_seeking) {
+        scheduleEvent(eventNames().seekedEvent);
         m_seeking = false;
-    
-    if (m_currentLoop < playCount() - 1 && currentTime() >= effectiveLoopEnd()) {
-        ExceptionCode ec;
-        seek(effectiveLoopStart(), ec);
-        m_currentLoop++;
-        dispatchEventForType(eventNames().timeupdateEvent, false, true);
     }
     
-    if (m_currentLoop == playCount() - 1 && currentTime() >= effectiveEnd()) {
-        dispatchEventForType(eventNames().timeupdateEvent, false, true);
-        dispatchEventForType(eventNames().endedEvent, false, true);
+    float now = currentTime();
+    float dur = duration();
+    if (!isnan(dur) && dur && now >= dur) {
+        if (loop()) {
+            ExceptionCode ignoredException;
+            m_sentEndEvent = false;
+            seek(0, ignoredException);
+        } else {
+            if (!m_sentEndEvent) {
+                m_sentEndEvent = true;
+                scheduleTimeupdateEvent(false);
+                scheduleEvent(eventNames().endedEvent);
+            }
+        }
     }
+    else
+        m_sentEndEvent = false;
 
     updatePlayState();
+    endProcessingMediaPlayerCallback();
 }
 
 void HTMLMediaElement::mediaPlayerRepaint(MediaPlayer*)
 {
+    beginProcessingMediaPlayerCallback();
     if (renderer())
         renderer()->repaint();
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerVolumeChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+    updateVolume();
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerDurationChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+    scheduleEvent(eventNames().durationchangeEvent);
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    if (renderer()) {
+        renderer()->updateFromElement();
+        if (!renderer()->isImage())
+            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+    }
+#endif        
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerRateChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+    // Stash the rate in case the one we tried to set isn't what the engine is
+    // using (eg. it can't handle the rate we set)
+    m_playbackRate = m_player->rate();
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerSizeChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    if (renderer() && !renderer()->isImage())
+        static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+#endif        
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerSawUnsupportedTracks(MediaPlayer*)
+{
+    // The MediaPlayer came across content it cannot completely handle.
+    // This is normally acceptable except when we are in a standalone
+    // MediaDocument. If so, tell the document what has happened.
+    if (ownerDocument()->isMediaDocument()) {
+        MediaDocument* mediaDocument = static_cast<MediaDocument*>(ownerDocument());
+        mediaDocument->mediaElementSawUnsupportedTracks();
+    }
 }
 
 PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
@@ -919,8 +1295,16 @@ PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 
 PassRefPtr<TimeRanges> HTMLMediaElement::played() const
 {
-    // FIXME track played
-    return TimeRanges::create();
+    if (!m_playedTimeRanges) {
+        // We are not yet loaded
+        return TimeRanges::create();
+    }
+    if (m_playing) {
+        float time = currentTime();
+        if (m_lastSeekTime < time)
+            m_playedTimeRanges->add(m_lastSeekTime, time);
+    }
+    return m_playedTimeRanges->copy();
 }
 
 PassRefPtr<TimeRanges> HTMLMediaElement::seekable() const
@@ -931,53 +1315,49 @@ PassRefPtr<TimeRanges> HTMLMediaElement::seekable() const
     return TimeRanges::create(0, m_player->maxTimeSeekable());
 }
 
-float HTMLMediaElement::effectiveStart() const
-{
-    if (!m_player)
-        return 0;
-    return min(start(), m_player->duration());
-}
-
-float HTMLMediaElement::effectiveEnd() const
+bool HTMLMediaElement::potentiallyPlaying() const
 {
-    if (!m_player)
-        return 0;
-    return min(max(end(), max(start(), loopStart())), m_player->duration());
+    return !paused() && m_readyState >= HAVE_FUTURE_DATA && !endedPlayback() && !stoppedDueToErrors() && !pausedForUserInteraction();
 }
 
-float HTMLMediaElement::effectiveLoopStart() const
+bool HTMLMediaElement::endedPlayback() const
 {
-    if (!m_player)
-        return 0;
-    return min(loopStart(), m_player->duration());
+    if (!m_player || m_readyState < HAVE_METADATA)
+        return false;
+    
+    float dur = duration();
+    return !isnan(dur) && currentTime() >= dur && !loop();
 }
 
-float HTMLMediaElement::effectiveLoopEnd() const
+bool HTMLMediaElement::stoppedDueToErrors() const
 {
-    if (!m_player)
-        return 0;
-    return min(max(start(), max(loopStart(), loopEnd())), m_player->duration());
+    if (m_readyState >= HAVE_METADATA && m_error) {
+        RefPtr<TimeRanges> seekableRanges = seekable();
+        if (!seekableRanges->contain(currentTime()))
+            return true;
+    }
+    
+    return false;
 }
 
-bool HTMLMediaElement::activelyPlaying() const
+bool HTMLMediaElement::pausedForUserInteraction() const
 {
-    return !paused() && readyState() >= CAN_PLAY && !endedPlayback(); // && !stoppedDueToErrors() && !pausedForUserInteraction();
+//    return !paused() && m_readyState >= HAVE_FUTURE_DATA && [UA requires a decitions from the user]
+    return false;
 }
 
-bool HTMLMediaElement::endedPlayback() const
-{
-    return networkState() >= LOADED_METADATA && currentTime() >= effectiveEnd() && currentLoop() == playCount() - 1;
-}
-    
 void HTMLMediaElement::updateVolume()
 {
     if (!m_player)
         return;
 
-    Page* page = document()->page();
-    float volumeMultiplier = page ? page->mediaVolume() : 1;
-
-    m_player->setVolume(m_muted ? 0 : m_volume * volumeMultiplier);
+    // Avoid recursion when the player reports volume changes.
+    if (!processingMediaPlayerCallback()) {
+        Page* page = document()->page();
+        float volumeMultiplier = page ? page->mediaVolume() : 1;
+    
+        m_player->setVolume(m_muted ? 0 : m_volume * volumeMultiplier);
+    }
     
     if (renderer())
         renderer()->updateFromElement();
@@ -987,20 +1367,31 @@ void HTMLMediaElement::updatePlayState()
 {
     if (!m_player)
         return;
-    
+
     if (m_pausedInternal) {
         if (!m_player->paused())
             m_player->pause();
+        m_playbackProgressTimer.stop();
         return;
     }
     
-    m_player->setEndTime(currentLoop() == playCount() - 1 ? effectiveEnd() : effectiveLoopEnd());
-
-    bool shouldBePlaying = activelyPlaying() && currentTime() < effectiveEnd();
-    if (shouldBePlaying && m_player->paused())
+    bool shouldBePlaying = potentiallyPlaying();
+    bool playerPaused = m_player->paused();
+    if (shouldBePlaying && playerPaused) {
+        // Set rate before calling play in case the rate was set before the media engine wasn't setup.
+        // The media engine should just stash the rate since it isn't already playing.
+        m_player->setRate(m_playbackRate);
         m_player->play();
-    else if (!shouldBePlaying && !m_player->paused())
+        startPlaybackProgressTimer();
+        m_playing = true;
+    } else if (!shouldBePlaying && !playerPaused) {
         m_player->pause();
+        m_playbackProgressTimer.stop();
+        m_playing = false;
+        float time = currentTime();
+        if (m_lastSeekTime < time)
+            m_playedTimeRanges->add(m_lastSeekTime, time);
+    }
     
     if (renderer())
         renderer()->updateFromElement();
@@ -1012,25 +1403,50 @@ void HTMLMediaElement::setPausedInternal(bool b)
     updatePlayState();
 }
 
-void HTMLMediaElement::documentWillBecomeInactive()
+void HTMLMediaElement::stopPeriodicTimers()
 {
-    // 3.14.9.4. Loading the media resource
-    // 14
-    if (m_begun) {
-        // For simplicity cancel the incomplete load by deleting the player
+    m_progressEventTimer.stop();
+    m_playbackProgressTimer.stop();
+}
+
+void HTMLMediaElement::userCancelledLoad()
+{
+    if (m_networkState != NETWORK_EMPTY) {
+
+        // If the media data fetching process is aborted by the user:
+
+        // 1 - The user agent should cancel the fetching process.
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
         m_player.clear();
-        m_progressEventTimer.stop();
+#endif
+        stopPeriodicTimers();
 
+        // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-        m_begun = false;
-        initAndDispatchProgressEvent(eventNames().abortEvent);
-        if (m_networkState >= LOADING) {
-            m_networkState = EMPTY;
-            m_readyState = DATA_UNAVAILABLE;
-            dispatchEventForType(eventNames().emptiedEvent, false, true);
+
+        // 3 - Queue a task to fire a progress event called abort at the media element.
+        scheduleProgressEvent(eventNames().abortEvent);
+
+        // 4 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the 
+        // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a 
+        // simple event called emptied at the element. Otherwise, set set the element's networkState 
+        // attribute to the NETWORK_IDLE value.
+        if (m_networkState >= NETWORK_LOADING) {
+            m_networkState = NETWORK_EMPTY;
+            m_readyState = HAVE_NOTHING;
+            scheduleEvent(eventNames().emptiedEvent);
         }
+
+        // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+        m_delayingTheLoadEvent = false;
     }
+}
+
+void HTMLMediaElement::documentWillBecomeInactive()
+{
     m_inActiveDocument = false;
+    userCancelledLoad();
+
     // Stop the playback without generating events
     setPausedInternal(true);
 
@@ -1045,6 +1461,8 @@ void HTMLMediaElement::documentDidBecomeActive()
 
     if (m_error && m_error->code() == MediaError::MEDIA_ERR_ABORTED) {
         // Restart the load if it was aborted in the middle by moving the document to the page cache.
+        // m_error is only left at MEDIA_ERR_ABORTED when the document becomes inactive (it is set to
+        //  MEDIA_ERR_ABORTED while the abortEvent is being sent, but cleared immediately afterwards).
         // This behavior is not specified but it seems like a sensible thing to do.
         ExceptionCode ec;
         load(ec);
@@ -1061,13 +1479,75 @@ void HTMLMediaElement::mediaVolumeDidChange()
 
 void HTMLMediaElement::defaultEventHandler(Event* event)
 {
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    RenderObject* r = renderer();
+    if (!r || !r->isWidget())
+        return;
+
+    Widget* widget = static_cast<RenderWidget*>(r)->widget();
+    if (widget)
+        widget->handleEvent(event);
+#else
     if (renderer() && renderer()->isMedia())
         static_cast<RenderMedia*>(renderer())->forwardEvent(event);
     if (event->defaultHandled())
         return;
     HTMLElement::defaultEventHandler(event);
+#endif
+}
+
+bool HTMLMediaElement::processingUserGesture() const
+{
+    Frame* frame = document()->frame();
+    FrameLoader* loader = frame ? frame->loader() : 0;
+
+    // return 'true' for safety if we don't know the answer 
+    return loader ? loader->userGestureHint() : true;
 }
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+void HTMLMediaElement::deliverNotification(MediaPlayerProxyNotificationType notification)
+{
+    if (notification == MediaPlayerNotificationPlayPauseButtonPressed) {
+        ExceptionCode ec;
+        togglePlayState(ec);
+        return;
+    }
+
+    if (m_player)
+        m_player->deliverNotification(notification);
+}
+
+void HTMLMediaElement::setMediaPlayerProxy(WebMediaPlayerProxy* proxy)
+{
+    if (m_player)
+        m_player->setMediaPlayerProxy(proxy);
+}
+
+String HTMLMediaElement::initialURL()
+{
+    KURL initialSrc = document()->completeURL(getAttribute(srcAttr));
+    
+    if (!initialSrc.isValid())
+        initialSrc = selectNextSourceChild(0, DoNothing).string();
+
+    m_currentSrc = initialSrc.string();
+
+    return initialSrc;
+}
+
+void HTMLMediaElement::finishParsingChildren()
+{
+    HTMLElement::finishParsingChildren();
+    if (!m_player)
+        m_player.set(new MediaPlayer(this));
+    
+    document()->updateStyleIfNeeded();
+    if (m_needWidgetUpdate && renderer())
+        static_cast<RenderPartObject*>(renderer())->updateWidget(true);
+}
+#endif
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index 6dd562cbe7..65c542b31e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,13 +31,18 @@
 #include "HTMLElement.h"
 #include "MediaPlayer.h"
 #include "Timer.h"
-#include "VoidCallback.h"
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "MediaPlayerProxy.h"
+#endif
 
 namespace WebCore {
 
+class Event;
+class HTMLSourceElement;
 class MediaError;
-class TimeRanges;
 class KURL;
+class TimeRanges;
     
 class HTMLMediaElement : public HTMLElement, public MediaPlayerClient {
 public:
@@ -47,6 +52,7 @@ public:
     bool checkDTD(const Node* newChild);
     
     void attributeChanged(Attribute*, bool preserveDecls);
+    void parseMappedAttribute(MappedAttribute *);
 
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -58,6 +64,7 @@ public:
     MediaPlayer* player() const { return m_player.get(); }
     
     virtual bool isVideo() const { return false; }
+    virtual bool hasVideo() const { return false; }
     
     void scheduleLoad();
     
@@ -76,49 +83,41 @@ public:
     KURL src() const;
     void setSrc(const String&);
     String currentSrc() const;
-    
-    enum NetworkState { EMPTY, LOADING, LOADED_METADATA, LOADED_FIRST_FRAME, LOADED };
+
+    enum NetworkState { NETWORK_EMPTY, NETWORK_IDLE, NETWORK_LOADING, NETWORK_LOADED, NETWORK_NO_SOURCE };
     NetworkState networkState() const;
-    float bufferingRate();
+    bool autobuffer() const;    
+    void setAutobuffer(bool);
+
     PassRefPtr<TimeRanges> buffered() const;
     void load(ExceptionCode&);
+    String canPlayType(const String& mimeType) const;
 
 // ready state
-    enum ReadyState { DATA_UNAVAILABLE, CAN_SHOW_CURRENT_FRAME, CAN_PLAY, CAN_PLAY_THROUGH };
+    enum ReadyState { HAVE_NOTHING, HAVE_METADATA, HAVE_CURRENT_DATA, HAVE_FUTURE_DATA, HAVE_ENOUGH_DATA };
     ReadyState readyState() const;
     bool seeking() const;
 
 // playback state
     float currentTime() const;
     void setCurrentTime(float, ExceptionCode&);
+    float startTime() const;
     float duration() const;
     bool paused() const;
     float defaultPlaybackRate() const;
-    void setDefaultPlaybackRate(float, ExceptionCode&);
+    void setDefaultPlaybackRate(float);
     float playbackRate() const;
-    void setPlaybackRate(float, ExceptionCode&);
+    void setPlaybackRate(float);
     PassRefPtr<TimeRanges> played() const;
     PassRefPtr<TimeRanges> seekable() const;
     bool ended() const;
     bool autoplay() const;    
     void setAutoplay(bool b);
-    void play(ExceptionCode&);
-    void pause(ExceptionCode&);
-    
-// looping
-    float start() const;
-    void setStart(float time);
-    float end() const;
-    void setEnd(float time);
-    float loopStart() const;
-    void setLoopStart(float time);
-    float loopEnd() const;
-    void setLoopEnd(float time);
-    unsigned playCount() const;
-    void setPlayCount(unsigned, ExceptionCode&);
-    unsigned currentLoop() const;
-    void setCurrentLoop(unsigned);
-
+    bool loop() const;    
+    void setLoop(bool b);
+    void play();
+    void pause();
+    
 // controls
     bool controls() const;
     void setControls(bool);
@@ -126,9 +125,20 @@ public:
     void setVolume(float, ExceptionCode&);
     bool muted() const;
     void setMuted(bool);
+    void togglePlayState();
+    void beginScrubbing();
+    void endScrubbing();
 
     bool canPlay() const;
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+    void deliverNotification(MediaPlayerProxyNotificationType notification);
+    void setMediaPlayerProxy(WebMediaPlayerProxy* proxy);
+    String initialURL();
+    virtual void finishParsingChildren();
+#endif
+
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
     void setTimeOffsetAttribute(const QualifiedName&, float value);
@@ -137,73 +147,144 @@ protected:
     virtual void documentDidBecomeActive();
     virtual void mediaVolumeDidChange();
     
-    void initAndDispatchProgressEvent(const AtomicString& eventName);
-    void dispatchEventAsync(const AtomicString& eventName);
-    
-    void setReadyState(ReadyState);
+    void setReadyState(MediaPlayer::ReadyState);
+    void setNetworkState(MediaPlayer::NetworkState);
     
 private: // MediaPlayerObserver
     virtual void mediaPlayerNetworkStateChanged(MediaPlayer*);
     virtual void mediaPlayerReadyStateChanged(MediaPlayer*);
     virtual void mediaPlayerTimeChanged(MediaPlayer*);
     virtual void mediaPlayerRepaint(MediaPlayer*);
+    virtual void mediaPlayerVolumeChanged(MediaPlayer*);
+    virtual void mediaPlayerDurationChanged(MediaPlayer*);
+    virtual void mediaPlayerRateChanged(MediaPlayer*);
+    virtual void mediaPlayerSizeChanged(MediaPlayer*);
+    virtual void mediaPlayerSawUnsupportedTracks(MediaPlayer*);
 
 private:
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void asyncEventTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
-    void seek(float time, ExceptionCode& ec);
+    void playbackProgressTimerFired(Timer<HTMLMediaElement>*);
+    void startPlaybackProgressTimer();
+    void startProgressEventTimer();
+    void stopPeriodicTimers();
+
+    void seek(float time, ExceptionCode&);
     void checkIfSeekNeeded();
     
-    String pickMedia();
+    void scheduleTimeupdateEvent(bool periodicEvent);
+    void scheduleProgressEvent(const AtomicString& eventName);
+    void scheduleEvent(const AtomicString& eventName);
+    void enqueueEvent(RefPtr<Event> event);
+    
+    // loading
+    void selectMediaResource();
+    void loadResource(const KURL&, ContentType&);
+    void loadNextSourceChild();
+    void userCancelledLoad();
+    bool havePotentialSourceChild();
+    void noneSupported();
+    void mediaEngineError(PassRefPtr<MediaError> err);
+    void cancelPendingEventsAndCallbacks();
+
+    enum InvalidSourceAction { DoNothing, Complain };
+    bool isSafeToLoadURL(const KURL&, InvalidSourceAction);
+    KURL selectNextSourceChild(ContentType*, InvalidSourceAction);
+
+    // These "internal" functions do not check user gesture restrictions.
+    void loadInternal();
+    void playInternal();
+    void pauseInternal();
+    
+    bool processingUserGesture() const;
+    bool processingMediaPlayerCallback() const { return m_processingMediaPlayerCallback > 0; }
+    void beginProcessingMediaPlayerCallback() { ++m_processingMediaPlayerCallback; }
+    void endProcessingMediaPlayerCallback() { ASSERT(m_processingMediaPlayerCallback); --m_processingMediaPlayerCallback; }
+
     void updateVolume();
     void updatePlayState();
-    float effectiveStart() const;
-    float effectiveEnd() const;
-    float effectiveLoopStart() const;
-    float effectiveLoopEnd() const;
-    bool activelyPlaying() const;
+    bool potentiallyPlaying() const;
     bool endedPlayback() const;
-    
+    bool stoppedDueToErrors() const;
+    bool pausedForUserInteraction() const;
+
+    // Restrictions to change default behaviors. This is a effectively a compile time choice at the moment
+    //  because there are no accessor methods.
+    enum BehaviorRestrictions 
+    { 
+        NoRestrictions = 0,
+        RequireUserGestureForLoadRestriction = 1 << 0,
+        RequireUserGestureForRateChangeRestriction = 1 << 1,
+    };
+
 protected:
     Timer<HTMLMediaElement> m_loadTimer;
     Timer<HTMLMediaElement> m_asyncEventTimer;
     Timer<HTMLMediaElement> m_progressEventTimer;
-    Vector<AtomicString> m_asyncEventsToDispatch;
+    Timer<HTMLMediaElement> m_playbackProgressTimer;
+    Vector<RefPtr<Event> > m_pendingEvents;
+    RefPtr<TimeRanges> m_playedTimeRanges;
     
+    float m_playbackRate;
     float m_defaultPlaybackRate;
     NetworkState m_networkState;
     ReadyState m_readyState;
     String m_currentSrc;
     
     RefPtr<MediaError> m_error;
-    
-    bool m_begun;
-    bool m_loadedFirstFrame;
-    bool m_autoplaying;
-    
-    unsigned m_currentLoop;
+
     float m_volume;
-    bool m_muted;
-    
-    bool m_paused;
-    bool m_seeking;
-    
-    float m_currentTimeDuringSeek;
+    float m_lastSeekTime;
     
     unsigned m_previousProgress;
     double m_previousProgressTime;
-    bool m_sentStalledEvent;
-    
-    float m_bufferingRate;
+
+    // the last time a timeupdate event was sent (wall clock)
+    double m_lastTimeUpdateEventWallTime;
+
+    // the last time a timeupdate event was sent in movie time
+    float m_lastTimeUpdateEventMovieTime;
     
-    unsigned m_loadNestingLevel;
-    unsigned m_terminateLoadBelowNestingLevel;
+    // loading state
+    enum LoadState { WaitingForSource, LoadingFromSrcAttr, LoadingFromSourceElement };
+    LoadState m_loadState;
+    HTMLSourceElement *m_currentSourceNode;
     
-    bool m_pausedInternal;
-    bool m_inActiveDocument;
-
     OwnPtr<MediaPlayer> m_player;
+
+    BehaviorRestrictions m_restrictions;
+
+    bool m_playing;
+
+    // counter incremented while processing a callback from the media player, so we can avoid
+    //  calling the media engine recursively
+    int m_processingMediaPlayerCallback;
+
+    bool m_processingLoad : 1;
+    bool m_delayingTheLoadEvent : 1;
+    bool m_haveFiredLoadedData : 1;
+    bool m_inActiveDocument : 1;
+    bool m_autoplaying : 1;
+    bool m_muted : 1;
+    bool m_paused : 1;
+    bool m_seeking : 1;
+
+    // data has not been loaded since sending a "stalled" event
+    bool m_sentStalledEvent : 1;
+
+    // time has not changed since sending an "ended" event
+    bool m_sentEndEvent : 1;
+
+    bool m_pausedInternal : 1;
+
+    // Not all media engines provide enough information about a file to be able to
+    // support progress events so setting m_sendProgressEvents disables them 
+    bool m_sendProgressEvents : 1;
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    bool m_needWidgetUpdate : 1;
+#endif
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
index 1e3eb90a59..008e059dbc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
@@ -33,51 +33,43 @@ interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElemen
     attribute DOMString src;
     readonly attribute DOMString currentSrc;
     
-    const unsigned short EMPTY = 0;
-    const unsigned short LOADING = 1;
-    const unsigned short LOADED_METADATA = 2;
-    const unsigned short LOADED_FIRST_FRAME = 3;
-    const unsigned short LOADED = 4;
+    const unsigned short NETWORK_EMPTY = 0;
+    const unsigned short NETWORK_IDLE = 1;
+    const unsigned short NETWORK_LOADING = 2;
+    const unsigned short NETWORK_LOADED = 3;
+    const unsigned short NETWORK_NO_SOURCE = 4;
     readonly attribute unsigned short networkState;
-    readonly attribute float bufferingRate;
+    attribute boolean autobuffer;
+
     readonly attribute TimeRanges buffered;
     void load() 
         raises (DOMException);
+    DOMString canPlayType(in DOMString type);
 
     // ready state
-    const unsigned short DATA_UNAVAILABLE = 0;
-    const unsigned short CAN_SHOW_CURRENT_FRAME = 1;
-    const unsigned short CAN_PLAY = 2;
-    const unsigned short CAN_PLAY_THROUGH = 3;
+    const unsigned short HAVE_NOTHING = 0;
+    const unsigned short HAVE_METADATA = 1;
+    const unsigned short HAVE_CURRENT_DATA = 2;
+    const unsigned short HAVE_FUTURE_DATA = 3;
+    const unsigned short HAVE_ENOUGH_DATA = 4;
     readonly attribute unsigned short readyState;
     readonly attribute boolean seeking;
 
     // playback state
     attribute float currentTime
         setter raises (DOMException);
+    readonly attribute float startTime;
     readonly attribute float duration;
     readonly attribute boolean paused;
-    attribute float defaultPlaybackRate 
-        setter raises (DOMException);
-    attribute float playbackRate 
-        setter raises (DOMException);
+    attribute float defaultPlaybackRate;
+    attribute float playbackRate;
     readonly attribute TimeRanges played;
     readonly attribute TimeRanges seekable;
     readonly attribute boolean ended;
     attribute boolean autoplay;
-    void play() 
-        raises (DOMException);
-    void pause() 
-        raises (DOMException);
-
-    // looping
-    attribute float start;
-    attribute float end;
-    attribute float loopStart;
-    attribute float loopEnd;
-    attribute unsigned long playCount
-        setter raises (DOMException);
-    attribute unsigned long currentLoop;
+    attribute boolean loop;
+    void play();
+    void pause();
 
     // controls
     attribute boolean controls;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp
index c2fb199a59..cf667ca411 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp
@@ -19,11 +19,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLMetaElement.h"
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
index fdebe78707..d5657dab6e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
@@ -32,7 +32,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLNameCollection::HTMLNameCollection(PassRefPtr<Document> document, Type type, const String& name)
+HTMLNameCollection::HTMLNameCollection(PassRefPtr<Document> document, CollectionType type, const String& name)
     : HTMLCollection(document.get(), type, document->nameCollectionInfo(type, name))
     , m_name(name)
 {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h
index 9add926c2c..3e990d7fa7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h
@@ -32,13 +32,13 @@ class Document;
 
 class HTMLNameCollection : public HTMLCollection {
 public:
-    static PassRefPtr<HTMLNameCollection> create(PassRefPtr<Document> document, Type type, const String& name)
+    static PassRefPtr<HTMLNameCollection> create(PassRefPtr<Document> document, CollectionType type, const String& name)
     {
         return adoptRef(new HTMLNameCollection(document, type, name));
     }
     
 private:
-    HTMLNameCollection(PassRefPtr<Document>, Type, const String& name);
+    HTMLNameCollection(PassRefPtr<Document>, CollectionType, const String& name);
 
     virtual Element* itemAfter(Element*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.cpp
new file mode 100644
index 0000000000..3bbfbe66d7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+
+#include "CSSStyleSelector.h"
+#include "HTMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLNoScriptElement::HTMLNoScriptElement(const QualifiedName& tagName, Document* doc)
+    : HTMLElement(tagName, doc)
+{
+    ASSERT(hasTagName(noscriptTag));
+}
+
+HTMLNoScriptElement::~HTMLNoScriptElement()
+{
+}
+
+bool HTMLNoScriptElement::checkDTD(const Node* newChild)
+{
+    return newChild->isTextNode() || inBlockTagList(newChild); 
+}
+
+void HTMLNoScriptElement::attach()
+{
+    HTMLElement::attach();
+
+    // If no need to process <noscript>, we hide it by setting display:none temporarily
+    if (!document()->shouldProcessNoscriptElement()) {
+        if (renderer() && renderer()->style())
+            renderer()->style()->setDisplay(NONE);
+        setNeedsStyleRecalc();
+    }
+}
+
+void HTMLNoScriptElement::recalcStyle(StyleChange change)
+{
+    if (!document()->shouldProcessNoscriptElement() || !renderer() || !renderer()->style())
+        return;
+
+    // If <noscript> needs processing, we make it visiable here, including its visible children
+    RefPtr<RenderStyle> style = renderer()->style();
+    if (style->display() == NONE) {
+        style->setDisplay(INLINE);
+
+        // Create renderers for its children
+        if (hasChildNodes()) {
+            for (Node* n = firstChild(); n; n = n->traverseNextNode(this))
+                if (!n->renderer())
+                    n->createRendererIfNeeded();
+        }
+    }
+}
+
+bool HTMLNoScriptElement::childShouldCreateRenderer(Node* child) const
+{
+    return document()->shouldProcessNoscriptElement();
+}
+
+}
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.h b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.h
index 649f132520..2cc5a3c396 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.h
@@ -1,10 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,20 +18,29 @@
  *
  */
 
-#ifndef RenderLegend_h
-#define RenderLegend_h
+#ifndef HTMLNoScriptElement_h
+#define HTMLNoScriptElement_h
 
-#include "RenderBlock.h"
+#if ENABLE(XHTMLMP)
+#include "HTMLElement.h"
 
 namespace WebCore {
 
-    class RenderLegend : public RenderBlock {
-    public:
-        RenderLegend(Node*);
+class HTMLNoScriptElement : public HTMLElement {
+public:
+    HTMLNoScriptElement(const QualifiedName&, Document*);
+
+private:
+    virtual ~HTMLNoScriptElement();
 
-        virtual const char* renderName() const { return "RenderLegend"; }
-    };
+    virtual bool checkDTD(const Node*);
+    virtual void attach();
+    virtual void recalcStyle(StyleChange);
+    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool rendererIsNeeded(RenderStyle*) {  return true; }
+};
 
-} // namespace WebCore
+} //namespace
 
-#endif // RenderLegend_h
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
index c1e0d7c7e1..63fd4377a9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
@@ -18,12 +18,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLOListElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderListItem.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
index 6f85d18d92..6be41c9e7e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
@@ -32,14 +32,15 @@
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "Text.h"
 
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -94,7 +95,7 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
         if (renderer())
           m_needWidgetUpdate = true;
     } else if (attr->name() == onloadAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
@@ -119,14 +120,15 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
 
 bool HTMLObjectElement::rendererIsNeeded(RenderStyle* style)
 {
-    if (m_useFallbackContent || isImageType())
-        return HTMLPlugInElement::rendererIsNeeded(style);
-
     Frame* frame = document()->frame();
     if (!frame)
         return false;
     
-    return true;
+    // Temporary Workaround for Gears plugin - see bug 24215 for details and bug 24346 to track removal.
+    // Gears expects the plugin to be instantiated even if display:none is set
+    // for the object element.
+    bool isGearsPlugin = equalIgnoringCase(getAttribute(typeAttr), "application/x-googlegears");
+    return isGearsPlugin || HTMLPlugInElement::rendererIsNeeded(style);
 }
 
 RenderObject *HTMLObjectElement::createRenderer(RenderArena* arena, RenderStyle* style)
@@ -156,13 +158,13 @@ void HTMLObjectElement::attach()
             return;
 
         if (renderer())
-            static_cast<RenderImage*>(renderer())->setCachedImage(m_imageLoader->image());
+            toRenderImage(renderer())->setCachedImage(m_imageLoader->image());
     }
 }
 
 void HTMLObjectElement::updateWidget()
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !m_useFallbackContent && !isImageType())
         static_cast<RenderPartObject*>(renderer())->updateWidget(true);
 }
@@ -173,7 +175,7 @@ void HTMLObjectElement::finishParsingChildren()
     if (!m_useFallbackContent) {
         m_needWidgetUpdate = true;
         if (inDocument())
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
@@ -221,7 +223,7 @@ void HTMLObjectElement::childrenChanged(bool changedByParser, Node* beforeChange
     updateDocNamedItem();
     if (inDocument() && !m_useFallbackContent) {
         m_needWidgetUpdate = true;
-        setChanged();
+        setNeedsStyleRecalc();
     }
     HTMLPlugInElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
index c22523897b..5d4562c94b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
@@ -50,14 +50,16 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
-#if ENABLE_SVG
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL             absoluteImageURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
index 2025f638d7..af81b078cf 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
@@ -49,7 +49,7 @@ bool HTMLOptGroupElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLOptGroupElement::type() const
+const AtomicString& HTMLOptGroupElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
     return optgroup;
@@ -58,40 +58,30 @@ const AtomicString& HTMLOptGroupElement::type() const
 bool HTMLOptGroupElement::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
     bool result = HTMLFormControlElement::insertBefore(newChild, refChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
     bool result = HTMLFormControlElement::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::removeChild(Node* oldChild, ExceptionCode& ec)
 {
     bool result = HTMLFormControlElement::removeChild(oldChild, ec);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
     bool result = HTMLFormControlElement::appendChild(newChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::removeChildren()
 {
     bool result = HTMLFormControlElement::removeChildren();
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
@@ -157,9 +147,8 @@ RenderStyle* HTMLOptGroupElement::nonRendererRenderStyle() const
 
 String HTMLOptGroupElement::groupLabelText() const
 {
-    String itemText = getAttribute(labelAttr);
+    String itemText = document()->displayStringModifiedByEncoding(getAttribute(labelAttr));
     
-    itemText.replace('\\', document()->backslashAsCurrencySymbol());
     // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
     itemText = itemText.stripWhiteSpace();
     // We want to collapse our whitespace too.  This will match other browsers.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
index 55311dcabe..13e92ca1c1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
@@ -25,17 +25,18 @@
 #define HTMLOptGroupElement_h
 
 #include "HTMLFormControlElement.h"
+#include "OptionGroupElement.h"
 
 namespace WebCore {
     
 class HTMLSelectElement;
 
-class HTMLOptGroupElement : public HTMLFormControlElement {
+class HTMLOptGroupElement : public HTMLFormControlElement, public OptionGroupElement {
 public:
     HTMLOptGroupElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual bool checkDTD(const Node*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual bool isFocusable() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
@@ -53,7 +54,7 @@ public:
     String label() const;
     void setLabel(const String&);
     
-    String groupLabelText() const;
+    virtual String groupLabelText() const;
     HTMLSelectElement* ownerSelectElement() const;
     virtual void accessKeyAction(bool sendToAnyElement);
     
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
index 999f4d3751..1d446f727f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
@@ -30,9 +30,10 @@
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "MappedAttribute.h"
+#include "NodeRenderStyle.h"
 #include "RenderMenuList.h"
 #include "Text.h"
-#include "NodeRenderStyle.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
@@ -42,7 +43,6 @@ using namespace HTMLNames;
 
 HTMLOptionElement::HTMLOptionElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElement(tagName, doc, f)
-    , m_selected(false)
     , m_style(0)
 {
     ASSERT(hasTagName(optionTag));
@@ -71,7 +71,7 @@ bool HTMLOptionElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLOptionElement::type() const
+const AtomicString& HTMLOptionElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, option, ("option"));
     return option;
@@ -79,32 +79,7 @@ const AtomicString& HTMLOptionElement::type() const
 
 String HTMLOptionElement::text() const
 {
-    String text;
-
-    // WinIE does not use the label attribute, so as a quirk, we ignore it.
-    if (!document()->inCompatMode())
-        text = getAttribute(labelAttr);
-
-    if (text.isEmpty()) {
-        const Node* n = firstChild();
-        while (n) {
-            if (n->nodeType() == TEXT_NODE || n->nodeType() == CDATA_SECTION_NODE)
-                text += n->nodeValue();
-            // skip script content
-            if (n->isElementNode() && n->hasTagName(HTMLNames::scriptTag))
-                n = n->traverseNextSibling(this);
-            else
-                n = n->traverseNextNode(this);
-        }
-    }
-
-    text.replace('\\', document()->backslashAsCurrencySymbol());
-    // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
-    text = text.stripWhiteSpace();
-    // We want to collapse our whitespace too.  This will match other browsers.
-    text = text.simplifyWhiteSpace();
-
-    return text;
+    return OptionElement::collectOptionText(m_data, this);
 }
 
 void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
@@ -129,40 +104,24 @@ void HTMLOptionElement::accessKeyAction(bool)
 
 int HTMLOptionElement::index() const
 {
-    // Let's do this dynamically. Might be a bit slow, but we're sure
-    // we won't forget to update a member variable in some cases...
-    HTMLSelectElement* select = ownerSelectElement();
-    if (select) {
-        const Vector<HTMLElement*>& items = select->listItems();
-        int l = items.size();
-        int optionIndex = 0;
-        for(int i = 0; i < l; i++) {
-            if (items[i]->hasLocalName(optionTag)) {
-                if (static_cast<HTMLOptionElement*>(items[i]) == this)
-                    return optionIndex;
-                optionIndex++;
-            }
-        }
-    }
-    return 0;
+    return OptionElement::optionIndex(ownerSelectElement(), this);
 }
 
 void HTMLOptionElement::parseMappedAttribute(MappedAttribute *attr)
 {
     if (attr->name() == selectedAttr)
-        m_selected = (!attr->isNull());
+        m_data.setSelected(!attr->isNull());
     else if (attr->name() == valueAttr)
-        m_value = attr->value();
+        m_data.setValue(attr->value());
+    else if (attr->name() == labelAttr)
+        m_data.setLabel(attr->value());
     else
         HTMLFormControlElement::parseMappedAttribute(attr);
 }
 
 String HTMLOptionElement::value() const
 {
-    if ( !m_value.isNull() )
-        return m_value;
-    // Use the text if the value wasn't set.
-    return text().stripWhiteSpace();
+    return OptionElement::collectOptionValue(m_data, this);
 }
 
 void HTMLOptionElement::setValue(const String& value)
@@ -170,21 +129,25 @@ void HTMLOptionElement::setValue(const String& value)
     setAttribute(valueAttr, value);
 }
 
+bool HTMLOptionElement::selected() const
+{
+    return m_data.selected();
+}
+
 void HTMLOptionElement::setSelected(bool selected)
 {
-    if (m_selected == selected)
+    if (m_data.selected() == selected)
         return;
+
+    OptionElement::setSelectedState(m_data, this, selected);
+
     if (HTMLSelectElement* select = ownerSelectElement())
         select->setSelectedIndex(selected ? index() : -1, false);
-    m_selected = selected;
 }
 
 void HTMLOptionElement::setSelectedState(bool selected)
 {
-    if (m_selected == selected)
-        return;
-    m_selected = selected;
-    setChanged();
+    OptionElement::setSelectedState(m_data, this, selected);
 }
 
 void HTMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -219,7 +182,7 @@ void HTMLOptionElement::setDefaultSelected(bool b)
 
 String HTMLOptionElement::label() const
 {
-    return getAttribute(labelAttr);
+    return m_data.label();
 }
 
 void HTMLOptionElement::setLabel(const String& value)
@@ -237,12 +200,9 @@ RenderStyle* HTMLOptionElement::nonRendererRenderStyle() const
     return m_style.get(); 
 }
 
-String HTMLOptionElement::optionText()
+String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 {
-    if (parentNode() && parentNode()->hasTagName(optgroupTag))
-        return "    " + text();
-        
-    return text();
+    return OptionElement::collectOptionTextRespectingGroupLabel(m_data, this);
 }
 
 bool HTMLOptionElement::disabled() const
@@ -250,13 +210,16 @@ bool HTMLOptionElement::disabled() const
     return HTMLFormControlElement::disabled() || (parentNode() && static_cast<HTMLFormControlElement*>(parentNode())->disabled()); 
 }
 
-void HTMLOptionElement::insertedIntoDocument()
+void HTMLOptionElement::insertedIntoTree(bool deep)
 {
-    HTMLSelectElement* select;
-    if (selected() && (select = ownerSelectElement()))
+    if (HTMLSelectElement* select = ownerSelectElement()) {
+        select->setRecalcListItems();
+        if (selected())
+            select->setSelectedIndex(index(), false);
         select->scrollToSelection();
+    }
     
-    HTMLFormControlElement::insertedIntoDocument();
+    HTMLFormControlElement::insertedIntoTree(deep);
 }
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
index 4b8238c5ad..f13a802f0a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
@@ -24,6 +24,7 @@
 #define HTMLOptionElement_h
 
 #include "HTMLFormControlElement.h"
+#include "OptionElement.h"
 
 namespace WebCore {
 
@@ -31,7 +32,7 @@ class HTMLSelectElement;
 class HTMLFormElement;
 class MappedAttribute;
 
-class HTMLOptionElement : public HTMLFormControlElement {
+class HTMLOptionElement : public HTMLFormControlElement, public OptionElement {
     friend class HTMLSelectElement;
     friend class RenderMenuList;
 
@@ -47,20 +48,20 @@ public:
     virtual void detach();
     virtual void setRenderStyle(PassRefPtr<RenderStyle>);
     
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
-    String text() const;
+    virtual String text() const;
     void setText(const String&, ExceptionCode&);
 
     int index() const;
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    String value() const;
+    virtual String value() const;
     void setValue(const String&);
 
-    bool selected() const { return m_selected; }
+    virtual bool selected() const;
     void setSelected(bool);
-    void setSelectedState(bool);
+    virtual void setSelectedState(bool);
 
     HTMLSelectElement* ownerSelectElement() const;
 
@@ -71,19 +72,18 @@ public:
 
     String label() const;
     void setLabel(const String&);
-    
-    String optionText();
-    
+
+    virtual String textIndentedToRespectGroupLabel() const;
+
     virtual bool disabled() const;
     
-    virtual void insertedIntoDocument();
+    virtual void insertedIntoTree(bool);
     virtual void accessKeyAction(bool);
     
 private:
     virtual RenderStyle* nonRendererRenderStyle() const;
-    
-    String m_value;
-    bool m_selected;
+
+    OptionElementData m_data;
     RefPtr<RenderStyle> m_style;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
index 34fa999989..612d4599a2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
@@ -28,7 +28,7 @@ module html {
     ] HTMLOptionElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
                  attribute  boolean              defaultSelected;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute  [ConvertNullToNullString] DOMString            text
                      setter raises(DOMException);
 #else
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
index 226f3d702d..5f85fcbf2b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
@@ -36,7 +36,7 @@ module html {
              raises (DOMException);
         [Custom] void remove(in unsigned long index);
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         Node item(in unsigned long index);
         Node namedItem(in DOMString name);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp
index 44eaecc0ad..a8deb10e23 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp
@@ -19,6 +19,7 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLParagraphElement.h"
 
@@ -26,6 +27,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
index 6e1197b59b..d5fc6e70f3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
index 0403dad6d8..dab58b3219 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
@@ -3,7 +3,8 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1999,2001 Lars Knoll (knoll@kde.org)
               (C) 2000,2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,6 +28,7 @@
 #include "CharacterNames.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
 #include "DOMWindow.h"
@@ -45,15 +47,17 @@
 #include "HTMLIsIndexElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserQuirks.h"
 #include "HTMLTableCellElement.h"
 #include "HTMLTableRowElement.h"
 #include "HTMLTableSectionElement.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
+#include "Page.h"
 #include "Settings.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
-    
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -61,6 +65,13 @@ using namespace HTMLNames;
 static const unsigned cMaxRedundantTagDepth = 20;
 static const unsigned cResidualStyleMaxDepth = 200;
 
+static const int minBlockLevelTagPriority = 3;
+
+// A cap on the number of tags with priority minBlockLevelTagPriority or higher
+// allowed in m_blockStack. The cap is enforced by adding such new elements as
+// siblings instead of children once it is reached.
+static const size_t cMaxBlockDepth = 4096;
+
 struct HTMLStackElem : Noncopyable {
     HTMLStackElem(const AtomicString& t, int lvl, Node* n, bool r, HTMLStackElem* nx)
         : tagName(t)
@@ -113,36 +124,38 @@ struct HTMLStackElem : Noncopyable {
  */
 
 HTMLParser::HTMLParser(HTMLDocument* doc, bool reportErrors)
-    : document(doc)
-    , current(doc)
-    , didRefCurrent(false)
-    , blockStack(0)
+    : m_document(doc)
+    , m_current(doc)
+    , m_didRefCurrent(false)
+    , m_blockStack(0)
+    , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
-    , head(0)
-    , inBody(false)
-    , haveContent(false)
-    , haveFrameSet(false)
+    , m_inBody(false)
+    , m_haveContent(false)
+    , m_haveFrameSet(false)
     , m_isParsingFragment(false)
     , m_reportErrors(reportErrors)
     , m_handlingResidualStyleAcrossBlocks(false)
-    , inStrayTableContent(0)
+    , m_inStrayTableContent(0)
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
 }
 
 HTMLParser::HTMLParser(DocumentFragment* frag)
-    : document(frag->document())
-    , current(frag)
-    , didRefCurrent(true)
-    , blockStack(0)
+    : m_document(frag->document())
+    , m_current(frag)
+    , m_didRefCurrent(true)
+    , m_blockStack(0)
+    , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
-    , head(0)
-    , inBody(true)
-    , haveContent(false)
-    , haveFrameSet(false)
+    , m_inBody(true)
+    , m_haveContent(false)
+    , m_haveFrameSet(false)
     , m_isParsingFragment(true)
     , m_reportErrors(false)
     , m_handlingResidualStyleAcrossBlocks(false)
-    , inStrayTableContent(0)
+    , m_inStrayTableContent(0)
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
     if (frag)
         frag->ref();
@@ -151,40 +164,43 @@ HTMLParser::HTMLParser(DocumentFragment* frag)
 HTMLParser::~HTMLParser()
 {
     freeBlock();
-    if (didRefCurrent) 
-        current->deref(); 
+    if (m_didRefCurrent)
+        m_current->deref();
 }
 
 void HTMLParser::reset()
 {
     ASSERT(!m_isParsingFragment);
 
-    setCurrent(document);
+    setCurrent(m_document);
 
     freeBlock();
 
-    inBody = false;
-    haveFrameSet = false;
-    haveContent = false;
-    inStrayTableContent = 0;
+    m_inBody = false;
+    m_haveFrameSet = false;
+    m_haveContent = false;
+    m_inStrayTableContent = 0;
 
     m_currentFormElement = 0;
     m_currentMapElement = 0;
-    head = 0;
+    m_head = 0;
     m_isindexElement = 0;
 
     m_skipModeTag = nullAtom;
+    
+    if (m_parserQuirks)
+        m_parserQuirks->reset();
 }
 
 void HTMLParser::setCurrent(Node* newCurrent) 
 {
-    bool didRefNewCurrent = newCurrent && newCurrent != document;
+    bool didRefNewCurrent = newCurrent && newCurrent != m_document;
     if (didRefNewCurrent) 
         newCurrent->ref(); 
-    if (didRefCurrent) 
-        current->deref(); 
-    current = newCurrent;
-    didRefCurrent = didRefNewCurrent;
+    if (m_didRefCurrent) 
+        m_current->deref();
+    m_current = newCurrent;
+    m_didRefCurrent = didRefNewCurrent;
 }
 
 PassRefPtr<Node> HTMLParser::parseToken(Token* t)
@@ -193,7 +209,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         if (!t->beginTag && t->tagName == m_skipModeTag)
             // Found the end tag for the current skip mode, so we're done skipping.
             m_skipModeTag = nullAtom;
-        else if (current->localName() == t->tagName)
+        else if (m_current->localName() == t->tagName)
             // Do not skip </iframe>.
             // FIXME: What does that comment mean? How can it be right to parse a token without clearing m_skipModeTag?
             ;
@@ -202,7 +218,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
     }
 
     // Apparently some sites use </br> instead of <br>. Be compatible with IE and Firefox and treat this like <br>.
-    if (t->isCloseTag(brTag) && document->inCompatMode()) {
+    if (t->isCloseTag(brTag) && m_document->inCompatMode()) {
         reportError(MalformedBRError);
         t->beginTag = true;
     }
@@ -214,17 +230,17 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 
     // Ignore spaces, if we're not inside a paragraph or other inline code.
     // Do not alter the text if it is part of a scriptTag.
-    if (t->tagName == textAtom && t->text && current->localName() != scriptTag) {
-        if (inBody && !skipMode() && current->localName() != styleTag &&
-            current->localName() != titleTag && !t->text->containsOnlyWhitespace())
-            haveContent = true;
+    if (t->tagName == textAtom && t->text && m_current->localName() != scriptTag) {
+        if (m_inBody && !skipMode() && m_current->localName() != styleTag &&
+            m_current->localName() != titleTag && !t->text->containsOnlyWhitespace())
+            m_haveContent = true;
         
         RefPtr<Node> n;
         String text = t->text.get();
         unsigned charsLeft = text.length();
         while (charsLeft) {
             // split large blocks of text to nodes of manageable size
-            n = Text::createWithLengthLimit(document, text, charsLeft);
+            n = Text::createWithLengthLimit(m_document, text, charsLeft);
             if (!insertNode(n.get(), t->selfClosingTag))
                 return 0;
         }
@@ -269,8 +285,8 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         if (m_currentFormElement == n)
             m_currentFormElement = 0;
 
-        if (head == n)
-            head = 0;
+        if (m_head == n)
+            m_head = 0;
 
         return 0;
     }
@@ -280,25 +296,25 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 void HTMLParser::parseDoctypeToken(DoctypeToken* t)
 {
     // Ignore any doctype after the first.  Ignore doctypes in fragments.
-    if (document->doctype() || m_isParsingFragment || current != document)
+    if (m_document->doctype() || m_isParsingFragment || m_current != m_document)
         return;
         
     // Make a new doctype node and set it as our doctype.
-    document->addChild(DocumentType::create(document, String::adopt(t->m_name), String::adopt(t->m_publicID), String::adopt(t->m_systemID)));
+    m_document->addChild(DocumentType::create(m_document, String::adopt(t->m_name), String::adopt(t->m_publicID), String::adopt(t->m_systemID)));
 }
 
-static bool isTableSection(Node* n)
+static bool isTableSection(const Node* n)
 {
     return n->hasTagName(tbodyTag) || n->hasTagName(tfootTag) || n->hasTagName(theadTag);
 }
 
-static bool isTablePart(Node* n)
+static bool isTablePart(const Node* n)
 {
     return n->hasTagName(trTag) || n->hasTagName(tdTag) || n->hasTagName(thTag) ||
            isTableSection(n);
 }
 
-static bool isTableRelated(Node* n)
+static bool isTableRelated(const Node* n)
 {
     return n->hasTagName(tableTag) || isTablePart(n);
 }
@@ -317,33 +333,43 @@ bool HTMLParser::insertNode(Node* n, bool flat)
     
     // <table> is never allowed inside stray table content.  Always pop out of the stray table content
     // and close up the first table, and then start the second table as a sibling.
-    if (inStrayTableContent && localName == tableTag)
+    if (m_inStrayTableContent && localName == tableTag)
         popBlock(tableTag);
-    
+
+    if (tagPriority >= minBlockLevelTagPriority) {
+        while (m_blocksInStack >= cMaxBlockDepth)
+            popBlock(m_blockStack->tagName);
+    }
+
+    if (m_parserQuirks && !m_parserQuirks->shouldInsertNode(m_current, n))
+        return false;
+
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
-    Node* newNode = current->addChild(n);
+    Node* newNode = m_current->addChild(n);
     if (!newNode)
         return handleError(n, flat, localName, tagPriority); // Try to handle the error.
 
     // don't push elements without end tags (e.g., <img>) on the stack
-    bool parentAttached = current->attached();
+    bool parentAttached = m_current->attached();
     if (tagPriority > 0 && !flat) {
-        if (newNode == current) {
+        if (newNode == m_current) {
             // This case should only be hit when a demoted <form> is placed inside a table.
             ASSERT(localName == formTag);
-            reportError(FormInsideTablePartError, &current->localName());
+            reportError(FormInsideTablePartError, &m_current->localName());
+            HTMLFormElement* form = static_cast<HTMLFormElement*>(n);
+            form->setDemoted(true);
         } else {
             // The pushBlock function transfers ownership of current to the block stack
-            // so we're guaranteed that didRefCurrent is false. The code below is an
+            // so we're guaranteed that m_didRefCurrent is false. The code below is an
             // optimized version of setCurrent that takes advantage of that fact and also
             // assumes that newNode is neither 0 nor a pointer to the document.
             pushBlock(localName, tagPriority);
             newNode->beginParsingChildren();
-            ASSERT(!didRefCurrent);
+            ASSERT(!m_didRefCurrent);
             newNode->ref(); 
-            current = newNode;
-            didRefCurrent = true;
+            m_current = newNode;
+            m_didRefCurrent = true;
         }
         if (parentAttached && !n->attached() && !m_isParsingFragment)
             n->attach();
@@ -353,6 +379,9 @@ bool HTMLParser::insertNode(Node* n, bool flat)
         n->finishParsingChildren();
     }
 
+    if (localName == htmlTag && m_document->frame())
+        m_document->frame()->loader()->dispatchDocumentElementAvailable();
+
     return true;
 }
 
@@ -366,28 +395,28 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
     if (n->isHTMLElement()) {
         HTMLElement* h = static_cast<HTMLElement*>(n);
         if (h->hasLocalName(trTag) || h->hasLocalName(thTag) || h->hasLocalName(tdTag)) {
-            if (inStrayTableContent && !isTableRelated(current)) {
-                reportError(MisplacedTablePartError, &localName, &current->localName());
+            if (m_inStrayTableContent && !isTableRelated(m_current)) {
+                reportError(MisplacedTablePartError, &localName, &m_current->localName());
                 // pop out to the nearest enclosing table-related tag.
-                while (blockStack && !isTableRelated(current))
+                while (m_blockStack && !isTableRelated(m_current))
                     popOneBlock();
                 return insertNode(n);
             }
         } else if (h->hasLocalName(headTag)) {
-            if (!current->isDocumentNode() && !current->hasTagName(htmlTag)) {
+            if (!m_current->isDocumentNode() && !m_current->hasTagName(htmlTag)) {
                 reportError(MisplacedHeadError);
                 return false;
             }
         } else if (h->hasLocalName(metaTag) || h->hasLocalName(linkTag) || h->hasLocalName(baseTag)) {
             bool createdHead = false;
-            if (!head) {
+            if (!m_head) {
                 createHead();
                 createdHead = true;
             }
-            if (head) {
+            if (m_head) {
                 if (!createdHead)
-                    reportError(MisplacedHeadContentError, &localName, &current->localName());
-                if (head->addChild(n)) {
+                    reportError(MisplacedHeadContentError, &localName, &m_current->localName());
+                if (m_head->addChild(n)) {
                     if (!n->attached() && !m_isParsingFragment)
                         n->attach();
                     return true;
@@ -395,14 +424,14 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                     return false;
             }
         } else if (h->hasLocalName(htmlTag)) {
-            if (!current->isDocumentNode() ) {
-                if (document->documentElement() && document->documentElement()->hasTagName(htmlTag)) {
+            if (!m_current->isDocumentNode() ) {
+                if (m_document->documentElement() && m_document->documentElement()->hasTagName(htmlTag)) {
                     reportError(RedundantHTMLBodyError, &localName);
                     // we have another <HTML> element.... apply attributes to existing one
                     // make sure we don't overwrite already existing attributes
-                    NamedAttrMap* map = static_cast<Element*>(n)->attributes(true);
-                    Element* existingHTML = static_cast<Element*>(document->documentElement());
-                    NamedAttrMap* bmap = existingHTML->attributes(false);
+                    NamedNodeMap* map = static_cast<Element*>(n)->attributes(true);
+                    Element* existingHTML = static_cast<Element*>(m_document->documentElement());
+                    NamedNodeMap* bmap = existingHTML->attributes(false);
                     for (unsigned l = 0; map && l < map->length(); ++l) {
                         Attribute* it = map->attributeItem(l);
                         if (!bmap->getAttributeItem(it->name()))
@@ -411,21 +440,21 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 }
                 return false;
             }
-        } else if (h->hasLocalName(titleTag) || h->hasLocalName(styleTag)) {
+        } else if (h->hasLocalName(titleTag) || h->hasLocalName(styleTag) || h->hasLocalName(scriptTag)) {
             bool createdHead = false;
-            if (!head) {
+            if (!m_head) {
                 createHead();
                 createdHead = true;
             }
-            if (head) {
-                Node* newNode = head->addChild(n);
+            if (m_head) {
+                Node* newNode = m_head->addChild(n);
                 if (!newNode) {
                     setSkipMode(h->tagQName());
                     return false;
                 }
                 
                 if (!createdHead)
-                    reportError(MisplacedHeadContentError, &localName, &current->localName());
+                    reportError(MisplacedHeadContentError, &localName, &m_current->localName());
                 
                 pushBlock(localName, tagPriority);
                 newNode->beginParsingChildren();
@@ -434,19 +463,19 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                     n->attach();
                 return true;
             }
-            if (inBody) {
+            if (m_inBody) {
                 setSkipMode(h->tagQName());
                 return false;
             }
         } else if (h->hasLocalName(bodyTag)) {
-            if (inBody && document->body()) {
+            if (m_inBody && m_document->body()) {
                 // we have another <BODY> element.... apply attributes to existing one
                 // make sure we don't overwrite already existing attributes
                 // some sites use <body bgcolor=rightcolor>...<body bgcolor=wrongcolor>
                 reportError(RedundantHTMLBodyError, &localName);
-                NamedAttrMap* map = static_cast<Element*>(n)->attributes(true);
-                Element* existingBody = document->body();
-                NamedAttrMap* bmap = existingBody->attributes(false);
+                NamedNodeMap* map = static_cast<Element*>(n)->attributes(true);
+                Element* existingBody = m_document->body();
+                NamedNodeMap* bmap = existingBody->attributes(false);
                 for (unsigned l = 0; map && l < map->length(); ++l) {
                     Attribute* it = map->attributeItem(l);
                     if (!bmap->getAttributeItem(it->name()))
@@ -454,11 +483,11 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 }
                 return false;
             }
-            else if (!current->isDocumentNode())
+            else if (!m_current->isDocumentNode())
                 return false;
         } else if (h->hasLocalName(areaTag)) {
             if (m_currentMapElement) {
-                reportError(MisplacedAreaError, &current->localName());
+                reportError(MisplacedAreaError, &m_current->localName());
                 m_currentMapElement->addChild(n);
                 if (!n->attached() && !m_isParsingFragment)
                     n->attach();
@@ -467,18 +496,18 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
             }
             return false;
         } else if (h->hasLocalName(colgroupTag) || h->hasLocalName(captionTag)) {
-            if (isTableRelated(current)) {
-                while (blockStack && isTablePart(current))
+            if (isTableRelated(m_current)) {
+                while (m_blockStack && isTablePart(m_current))
                     popOneBlock();
                 return insertNode(n);
             }
         }
-    } else if (n->isCommentNode() && !head)
+    } else if (n->isCommentNode() && !m_head)
         return false;
 
     // 2. Next we examine our currently active element to do some further error handling.
-    if (current->isHTMLElement()) {
-        HTMLElement* h = static_cast<HTMLElement*>(current);
+    if (m_current->isHTMLElement()) {
+        HTMLElement* h = static_cast<HTMLElement*>(m_current);
         const AtomicString& currentTagName = h->localName();
         if (h->hasLocalName(htmlTag)) {
             HTMLElement* elt = n->isHTMLElement() ? static_cast<HTMLElement*>(n) : 0;
@@ -487,10 +516,9 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 elt->hasLocalName(objectTag) || elt->hasLocalName(embedTag) ||
                 elt->hasLocalName(titleTag) || elt->hasLocalName(isindexTag) ||
                 elt->hasLocalName(baseTag))) {
-                if (!head) {
-                    head = new HTMLHeadElement(headTag, document);
-                    e = head;
-                    insertNode(e);
+                if (!m_head) {
+                    m_head = new HTMLHeadElement(headTag, m_document);
+                    insertNode(m_head.get());
                     handled = true;
                 }
             } else {
@@ -499,8 +527,14 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                     if (t->containsOnlyWhitespace())
                         return false;
                 }
-                if (!haveFrameSet) {
-                    e = new HTMLBodyElement(bodyTag, document);
+                if (!m_haveFrameSet) {
+                    // Ensure that head exists.
+                    // But not for older versions of Mail, where the implicit <head> isn't expected - <rdar://problem/6863795>
+                    if (shouldCreateImplicitHead(m_document))
+                        createHead();
+
+                    popBlock(headTag);
+                    e = new HTMLBodyElement(bodyTag, m_document);
                     startBody();
                     insertNode(e);
                     handled = true;
@@ -512,9 +546,10 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 return false;
             else {
                 // This means the body starts here...
-                if (!haveFrameSet) {
+                if (!m_haveFrameSet) {
+                    ASSERT(currentTagName == headTag);
                     popBlock(currentTagName);
-                    e = new HTMLBodyElement(bodyTag, document);
+                    e = new HTMLBodyElement(bodyTag, m_document);
                     startBody();
                     insertNode(e);
                     handled = true;
@@ -542,7 +577,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 handled = true;      // ...and start a new one
             } else {
                 ExceptionCode ec = 0;
-                Node* node = current;
+                Node* node = m_current;
                 Node* parent = node->parentNode();
                 // A script may have removed the current node's parent from the DOM
                 // http://bugs.webkit.org/show_bug.cgi?id=7137
@@ -574,24 +609,24 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                             pushBlock(localName, tagPriority);
                             n->beginParsingChildren();
                             setCurrent(n);
-                            inStrayTableContent++;
-                            blockStack->strayTableContent = true;
+                            m_inStrayTableContent++;
+                            m_blockStack->strayTableContent = true;
                         }
                         return true;
                     }
                 }
 
                 if (!ec) {
-                    if (current->hasTagName(trTag)) {
+                    if (m_current->hasTagName(trTag)) {
                         reportError(TablePartRequiredError, &localName, &tdTag.localName());
-                        e = new HTMLTableCellElement(tdTag, document);
-                    } else if (current->hasTagName(tableTag)) {
+                        e = new HTMLTableCellElement(tdTag, m_document);
+                    } else if (m_current->hasTagName(tableTag)) {
                         // Don't report an error in this case, since making a <tbody> happens all the time when you have <table><tr>,
                         // and it isn't really a parse error per se.
-                        e = new HTMLTableSectionElement(tbodyTag, document); 
+                        e = new HTMLTableSectionElement(tbodyTag, m_document);
                     } else {
                         reportError(TablePartRequiredError, &localName, &trTag.localName());
-                        e = new HTMLTableRowElement(trTag, document);
+                        e = new HTMLTableRowElement(trTag, m_document);
                     }
 
                     insertNode(e);
@@ -625,20 +660,20 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
             popBlock(currentTagName);
             handled = true;
         } else if (!h->hasLocalName(bodyTag)) {
-            if (isInline(current)) {
+            if (isInline(m_current)) {
                 popInlineBlocks();
                 handled = true;
             }
         }
-    } else if (current->isDocumentNode()) {
+    } else if (m_current->isDocumentNode()) {
         if (n->isTextNode()) {
             Text* t = static_cast<Text*>(n);
             if (t->containsOnlyWhitespace())
                 return false;
         }
 
-        if (!document->documentElement()) {
-            e = new HTMLHtmlElement(htmlTag, document);
+        if (!m_document->documentElement()) {
+            e = new HTMLHtmlElement(htmlTag, m_document);
             insertNode(e);
             handled = true;
         }
@@ -646,7 +681,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
 
     // 3. If we couldn't handle the error, just return false and attempt to error-correct again.
     if (!handled) {
-        reportError(IgnoredContentError, &localName, &current->localName());
+        reportError(IgnoredContentError, &localName, &m_current->localName());
         return false;
     }
     return insertNode(n);
@@ -657,21 +692,21 @@ typedef HashMap<AtomicStringImpl*, CreateErrorCheckFunc> FunctionMap;
 
 bool HTMLParser::textCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Text(document, t->text.get());
+    result = new Text(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::commentCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Comment(document, t->text.get());
+    result = new Comment(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::headCreateErrorCheck(Token*, RefPtr<Node>& result)
 {
-    if (!head || current->localName() == htmlTag) {
-        head = new HTMLHeadElement(headTag, document);
-        result = head;
+    if (!m_head || m_current->localName() == htmlTag) {
+        m_head = new HTMLHeadElement(headTag, m_document);
+        result = m_head;
     } else
         reportError(MisplacedHeadError);
     return false;
@@ -680,8 +715,14 @@ bool HTMLParser::headCreateErrorCheck(Token*, RefPtr<Node>& result)
 bool HTMLParser::bodyCreateErrorCheck(Token*, RefPtr<Node>&)
 {
     // body no longer allowed if we have a frameset
-    if (haveFrameSet)
+    if (m_haveFrameSet)
         return false;
+    
+    // Ensure that head exists (unless parsing a fragment).
+    // But not for older versions of Mail, where the implicit <head> isn't expected - <rdar://problem/6863795>
+    if (!m_isParsingFragment && shouldCreateImplicitHead(m_document))
+        createHead();
+    
     popBlock(headTag);
     startBody();
     return true;
@@ -690,19 +731,19 @@ bool HTMLParser::bodyCreateErrorCheck(Token*, RefPtr<Node>&)
 bool HTMLParser::framesetCreateErrorCheck(Token*, RefPtr<Node>&)
 {
     popBlock(headTag);
-    if (inBody && !haveFrameSet && !haveContent) {
+    if (m_inBody && !m_haveFrameSet && !m_haveContent) {
         popBlock(bodyTag);
         // ### actually for IE document.body returns the now hidden "body" element
         // we can't implement that behaviour now because it could cause too many
         // regressions and the headaches are not worth the work as long as there is
         // no site actually relying on that detail (Dirk)
-        if (document->body())
-            document->body()->setAttribute(styleAttr, "display:none");
-        inBody = false;
+        if (m_document->body())
+            m_document->body()->setAttribute(styleAttr, "display:none");
+        m_inBody = false;
     }
-    if ((haveContent || haveFrameSet) && current->localName() == htmlTag)
+    if ((m_haveContent || m_haveFrameSet) && m_current->localName() == htmlTag)
         return false;
-    haveFrameSet = true;
+    m_haveFrameSet = true;
     startBody();
     return true;
 }
@@ -712,7 +753,7 @@ bool HTMLParser::formCreateErrorCheck(Token* t, RefPtr<Node>& result)
     // Only create a new form if we're not already inside one.
     // This is consistent with other browsers' behavior.
     if (!m_currentFormElement) {
-        m_currentFormElement = new HTMLFormElement(formTag, document);
+        m_currentFormElement = new HTMLFormElement(formTag, m_document);
         result = m_currentFormElement;
         pCloserCreateErrorCheck(t, result);
     }
@@ -722,7 +763,7 @@ bool HTMLParser::formCreateErrorCheck(Token* t, RefPtr<Node>& result)
 bool HTMLParser::isindexCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
     RefPtr<Node> n = handleIsindex(t);
-    if (!inBody)
+    if (!m_inBody)
         m_isindexElement = n.release();
     else {
         t->selfClosingTag = true;
@@ -800,7 +841,7 @@ bool HTMLParser::noframesCreateErrorCheck(Token*, RefPtr<Node>&)
 bool HTMLParser::noscriptCreateErrorCheck(Token*, RefPtr<Node>&)
 {
     if (!m_isParsingFragment) {
-        Settings* settings = document->settings();
+        Settings* settings = m_document->settings();
         if (settings && settings->isJavaScriptEnabled())
             setSkipMode(noscriptTag);
     }
@@ -816,7 +857,7 @@ bool HTMLParser::pCloserCreateErrorCheck(Token*, RefPtr<Node>&)
 
 bool HTMLParser::pCloserStrictCreateErrorCheck(Token*, RefPtr<Node>&)
 {
-    if (document->inCompatMode())
+    if (m_document->inCompatMode())
         return true;
     if (hasPElementInScope())
         popBlock(pTag);
@@ -825,7 +866,7 @@ bool HTMLParser::pCloserStrictCreateErrorCheck(Token*, RefPtr<Node>&)
 
 bool HTMLParser::mapCreateErrorCheck(Token*, RefPtr<Node>& result)
 {
-    m_currentMapElement = new HTMLMapElement(mapTag, document);
+    m_currentMapElement = new HTMLMapElement(mapTag, m_document);
     result = m_currentMapElement;
     return false;
 }
@@ -869,7 +910,9 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(nobrTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(noembedTag.localName().impl(), &HTMLParser::noembedCreateErrorCheck);
         gFunctionMap.set(noframesTag.localName().impl(), &HTMLParser::noframesCreateErrorCheck);
+#if !ENABLE(XHTMLMP)
         gFunctionMap.set(noscriptTag.localName().impl(), &HTMLParser::noscriptCreateErrorCheck);
+#endif
         gFunctionMap.set(olTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(pTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(plaintextTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
@@ -896,7 +939,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
     if (CreateErrorCheckFunc errorCheckFunc = gFunctionMap.get(t->tagName.impl()))
         proceed = (this->*errorCheckFunc)(t, result);
     if (proceed)
-        result = HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, t->tagName, xhtmlNamespaceURI), document, m_currentFormElement.get());
+        result = HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, t->tagName, xhtmlNamespaceURI), m_document, m_currentFormElement.get());
     return result.release();
 }
 
@@ -906,7 +949,7 @@ bool HTMLParser::allowNestedRedundantTag(const AtomicString& tagName)
     // about 1500 tags, all from a bunch of <b>s.  We will only allow at most 20
     // nested tags of the same type before just ignoring them all together.
     unsigned i = 0;
-    for (HTMLStackElem* curr = blockStack;
+    for (HTMLStackElem* curr = m_blockStack;
          i < cMaxRedundantTagDepth && curr && curr->tagName == tagName;
          curr = curr->next, i++) { }
     return i != cMaxRedundantTagDepth;
@@ -929,9 +972,9 @@ void HTMLParser::processCloseTag(Token* t)
     else if (t->tagName == pTag)
         checkForCloseTagErrors = false;
         
-    HTMLStackElem* oldElem = blockStack;
+    HTMLStackElem* oldElem = m_blockStack;
     popBlock(t->tagName, checkForCloseTagErrors);
-    if (oldElem == blockStack && t->tagName == pTag) {
+    if (oldElem == m_blockStack && t->tagName == pTag) {
         // We encountered a stray </p>.  Amazingly Gecko, WinIE, and MacIE all treat
         // this as a valid break, i.e., <p></p>.  So go ahead and make the empty
         // paragraph.
@@ -975,11 +1018,13 @@ bool HTMLParser::isInline(Node* node) const
             e->hasLocalName(noframesTag) || e->hasLocalName(nolayerTag) ||
             e->hasLocalName(noembedTag))
             return true;
+#if !ENABLE(XHTMLMP)
         if (e->hasLocalName(noscriptTag) && !m_isParsingFragment) {
-            Settings* settings = document->settings();
+            Settings* settings = m_document->settings();
             if (settings && settings->isJavaScriptEnabled())
                 return true;
         }
+#endif
     }
     
     return false;
@@ -1047,7 +1092,7 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
         // Find the outermost element that crosses over to a higher level. If there exists another higher-level
         // element, we will do another pass, until we have corrected the innermost one.
         ExceptionCode ec = 0;
-        HTMLStackElem* curr = blockStack;
+        HTMLStackElem* curr = m_blockStack;
         HTMLStackElem* prev = 0;
         HTMLStackElem* prevMaxElem = 0;
         maxElem = 0;
@@ -1071,7 +1116,7 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
             return;
 
         Node* residualElem = prev->node;
-        Node* blockElem = prevMaxElem ? prevMaxElem->node : current;
+        Node* blockElem = prevMaxElem ? prevMaxElem->node : m_current;
         Node* parentElem = elem->node;
 
         // Check to see if the reparenting that is going to occur is allowed according to the DOM.
@@ -1220,13 +1265,13 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
     // <table><b><i><form></b></form></i></table>
     // Then this check will be too simplistic.  Right now the <i><form> chain will end up inside the <tbody>, which is pretty crazy.
     if (strayTableContent)
-        inStrayTableContent--;
+        m_inStrayTableContent--;
 
     // Step 7: Reopen intermediate inlines, e.g., <b><p><i>Foo</b>Goo</p>.
     // In the above example, Goo should stay italic.
     // We cap the number of tags we're willing to reopen based off cResidualStyleMaxDepth.
     
-    HTMLStackElem* curr = blockStack;
+    HTMLStackElem* curr = m_blockStack;
     HTMLStackElem* residualStyleStack = 0;
     unsigned stackDepth = 1;
     unsigned redundantStyleCount = 0;
@@ -1254,7 +1299,7 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
         } else
             popOneBlock();
 
-        curr = blockStack;
+        curr = m_blockStack;
     }
 
     reopenResidualStyleTags(residualStyleStack, 0); // Stray table content can't be an issue here, since some element above will always become the root of new stray table content.
@@ -1276,7 +1321,7 @@ void HTMLParser::reopenResidualStyleTags(HTMLStackElem* elem, Node* malformedTab
         if (malformedTableParent)
             malformedTableParent->insertBefore(newNode, malformedTableParent->lastChild(), ec);
         else
-            current->appendChild(newNode, ec);
+            m_current->appendChild(newNode, ec);
         // FIXME: Is it really OK to ignore the exceptions here?
 
         // Now push a new stack element for this node we just created.
@@ -1285,9 +1330,9 @@ void HTMLParser::reopenResidualStyleTags(HTMLStackElem* elem, Node* malformedTab
 
         // Set our strayTableContent boolean if needed, so that the reopened tag also knows
         // that it is inside a malformed table.
-        blockStack->strayTableContent = malformedTableParent != 0;
-        if (blockStack->strayTableContent)
-            inStrayTableContent++;
+        m_blockStack->strayTableContent = malformedTableParent != 0;
+        if (m_blockStack->strayTableContent)
+            m_inStrayTableContent++;
 
         // Clear our malformed table parent variable.
         malformedTableParent = 0;
@@ -1305,8 +1350,10 @@ void HTMLParser::reopenResidualStyleTags(HTMLStackElem* elem, Node* malformedTab
 
 void HTMLParser::pushBlock(const AtomicString& tagName, int level)
 {
-    blockStack = new HTMLStackElem(tagName, level, current, didRefCurrent, blockStack);
-    didRefCurrent = false;
+    m_blockStack = new HTMLStackElem(tagName, level, m_current, m_didRefCurrent, m_blockStack);
+    if (level >= minBlockLevelTagPriority)
+        m_blocksInStack++;
+    m_didRefCurrent = false;
     if (tagName == pTag)
         m_hasPElementInScope = InScope;
     else if (isScopingTag(tagName))
@@ -1315,8 +1362,11 @@ void HTMLParser::pushBlock(const AtomicString& tagName, int level)
 
 void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
 {
-    HTMLStackElem* elem = blockStack;
-    
+    HTMLStackElem* elem = m_blockStack;
+
+    if (m_parserQuirks && elem && !m_parserQuirks->shouldPopBlock(elem->tagName, tagName))
+        return;
+
     int maxLevel = 0;
 
     while (elem && (elem->tagName != tagName)) {
@@ -1343,12 +1393,12 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
     HTMLStackElem* residualStyleStack = 0;
     Node* malformedTableParent = 0;
     
-    elem = blockStack;
+    elem = m_blockStack;
     unsigned stackDepth = 1;
     unsigned redundantStyleCount = 0;
     while (elem) {
         if (elem->tagName == tagName) {
-            int strayTable = inStrayTableContent;
+            int strayTable = m_inStrayTableContent;
             popOneBlock();
             elem = 0;
 
@@ -1356,8 +1406,8 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
             // explicit <tbody> or <tr>.
             // If we end up needing to reopen residual style tags, the root of the reopened chain
             // must also know that it is the root of malformed content inside a <tbody>/<tr>.
-            if (strayTable && (inStrayTableContent < strayTable) && residualStyleStack) {
-                Node* curr = current;
+            if (strayTable && (m_inStrayTableContent < strayTable) && residualStyleStack) {
+                Node* curr = m_current;
                 while (curr && !curr->hasTagName(tableTag))
                     curr = curr->parentNode();
                 malformedTableParent = curr ? curr->parentNode() : 0;
@@ -1392,7 +1442,7 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
                     popOneBlock();
             } else
                 popOneBlock();
-            elem = blockStack;
+            elem = m_blockStack;
         }
     }
 
@@ -1401,19 +1451,23 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
 
 inline HTMLStackElem* HTMLParser::popOneBlockCommon()
 {
-    HTMLStackElem* elem = blockStack;
+    HTMLStackElem* elem = m_blockStack;
 
     // Form elements restore their state during the parsing process.
     // Also, a few elements (<applet>, <object>) need to know when all child elements (<param>s) are available.
-    if (current && elem->node != current)
-        current->finishParsingChildren();
+    if (m_current && elem->node != m_current)
+        m_current->finishParsingChildren();
 
-    blockStack = elem->next;
-    current = elem->node;
-    didRefCurrent = elem->didRefNode;
+    if (m_blockStack->level >= minBlockLevelTagPriority) {
+        ASSERT(m_blocksInStack > 0);
+        m_blocksInStack--;
+    }
+    m_blockStack = elem->next;
+    m_current = elem->node;
+    m_didRefCurrent = elem->didRefNode;
 
     if (elem->strayTableContent)
-        inStrayTableContent--;
+        m_inStrayTableContent--;
 
     if (elem->tagName == pTag)
         m_hasPElementInScope = NotInScope;
@@ -1426,8 +1480,8 @@ inline HTMLStackElem* HTMLParser::popOneBlockCommon()
 void HTMLParser::popOneBlock()
 {
     // Store the current node before popOneBlockCommon overwrites it.
-    Node* lastCurrent = current;
-    bool didRefLastCurrent = didRefCurrent;
+    Node* lastCurrent = m_current;
+    bool didRefLastCurrent = m_didRefCurrent;
 
     delete popOneBlockCommon();
 
@@ -1441,8 +1495,8 @@ void HTMLParser::moveOneBlockToStack(HTMLStackElem*& head)
     // See the two callers for details.
 
     // Store the current node before popOneBlockCommon overwrites it.
-    Node* lastCurrent = current;
-    bool didRefLastCurrent = didRefCurrent;
+    Node* lastCurrent = m_current;
+    bool didRefLastCurrent = m_didRefCurrent;
 
     // Pop the block, but don't deref the current node as popOneBlock does because
     // we'll be using the pointer in the new stack element.
@@ -1450,7 +1504,7 @@ void HTMLParser::moveOneBlockToStack(HTMLStackElem*& head)
 
     // Transfer the current node into the stack element.
     // No need to deref the old elem->node because popOneBlockCommon transferred
-    // it into the current/didRefCurrent fields.
+    // it into the m_current/m_didRefCurrent fields.
     elem->node = lastCurrent;
     elem->didRefNode = didRefLastCurrent;
     elem->next = head;
@@ -1460,7 +1514,7 @@ void HTMLParser::moveOneBlockToStack(HTMLStackElem*& head)
 void HTMLParser::checkIfHasPElementInScope()
 {
     m_hasPElementInScope = NotInScope;
-    HTMLStackElem* elem = blockStack;
+    HTMLStackElem* elem = m_blockStack;
     while (elem) {
         const AtomicString& tagName = elem->tagName;
         if (tagName == pTag) {
@@ -1474,42 +1528,48 @@ void HTMLParser::checkIfHasPElementInScope()
 
 void HTMLParser::popInlineBlocks()
 {
-    while (blockStack && isInline(current))
+    while (m_blockStack && isInline(m_current))
         popOneBlock();
 }
 
 void HTMLParser::freeBlock()
 {
-    while (blockStack)
+    while (m_blockStack)
         popOneBlock();
+    ASSERT(!m_blocksInStack);
 }
 
 void HTMLParser::createHead()
 {
-    if (head || !document->documentElement())
+    if (m_head)
         return;
 
-    head = new HTMLHeadElement(headTag, document);
-    HTMLElement* body = document->body();
+    if (!m_document->documentElement()) {
+        insertNode(new HTMLHtmlElement(htmlTag, m_document));
+        ASSERT(m_document->documentElement());
+    }
+
+    m_head = new HTMLHeadElement(headTag, m_document);
+    HTMLElement* body = m_document->body();
     ExceptionCode ec = 0;
-    document->documentElement()->insertBefore(head, body, ec);
+    m_document->documentElement()->insertBefore(m_head.get(), body, ec);
     if (ec)
-        head = 0;
+        m_head = 0;
         
     // If the body does not exist yet, then the <head> should be pushed as the current block.
-    if (head && !body) {
-        pushBlock(head->localName(), head->tagPriority());
-        setCurrent(head);
+    if (m_head && !body) {
+        pushBlock(m_head->localName(), m_head->tagPriority());
+        setCurrent(m_head.get());
     }
 }
 
 PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
 {
-    RefPtr<Node> n = new HTMLDivElement(divTag, document);
+    RefPtr<Node> n = new HTMLDivElement(divTag, m_document);
 
     NamedMappedAttrMap* attrs = t->attrs.get();
 
-    RefPtr<HTMLIsIndexElement> isIndex = new HTMLIsIndexElement(isindexTag, document, m_currentFormElement.get());
+    RefPtr<HTMLIsIndexElement> isIndex = new HTMLIsIndexElement(isindexTag, m_document, m_currentFormElement.get());
     isIndex->setAttributeMap(attrs);
     isIndex->setAttribute(typeAttr, "khtml_isindex");
 
@@ -1520,20 +1580,20 @@ PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
         t->attrs = 0;
     }
 
-    n->addChild(new HTMLHRElement(hrTag, document));
-    n->addChild(new Text(document, text));
+    n->addChild(new HTMLHRElement(hrTag, m_document));
+    n->addChild(new Text(m_document, text));
     n->addChild(isIndex.release());
-    n->addChild(new HTMLHRElement(hrTag, document));
+    n->addChild(new HTMLHRElement(hrTag, m_document));
 
     return n.release();
 }
 
 void HTMLParser::startBody()
 {
-    if (inBody)
+    if (m_inBody)
         return;
 
-    inBody = true;
+    m_inBody = true;
 
     if (m_isindexElement) {
         insertNode(m_isindexElement.get(), true /* don't descend into this node */);
@@ -1544,8 +1604,8 @@ void HTMLParser::startBody()
 void HTMLParser::finished()
 {
     // In the case of a completely empty document, here's the place to create the HTML element.
-    if (current && current->isDocumentNode() && !document->documentElement())
-        insertNode(new HTMLHtmlElement(htmlTag, document));
+    if (m_current && m_current->isDocumentNode() && !m_document->documentElement())
+        insertNode(new HTMLHtmlElement(htmlTag, m_document));
 
     // This ensures that "current" is not left pointing to a node when the document is destroyed.
     freeBlock();
@@ -1553,16 +1613,16 @@ void HTMLParser::finished()
 
     // Warning, this may delete the tokenizer and parser, so don't try to do anything else after this.
     if (!m_isParsingFragment)
-        document->finishedParsing();
+        m_document->finishedParsing();
 }
 
 void HTMLParser::reportErrorToConsole(HTMLParserErrorCode errorCode, const AtomicString* tagName1, const AtomicString* tagName2, bool closeTags)
 {    
-    Frame* frame = document->frame();
+    Frame* frame = m_document->frame();
     if (!frame)
         return;
     
-    HTMLTokenizer* htmlTokenizer = static_cast<HTMLTokenizer*>(document->tokenizer());
+    HTMLTokenizer* htmlTokenizer = static_cast<HTMLTokenizer*>(m_document->tokenizer());
     int lineNumber = htmlTokenizer->lineNumber() + 1;
 
     AtomicString tag1;
@@ -1597,7 +1657,25 @@ void HTMLParser::reportErrorToConsole(HTMLParserErrorCode errorCode, const Atomi
 
     frame->domWindow()->console()->addMessage(HTMLMessageSource,
         isWarning(errorCode) ? WarningMessageLevel : ErrorMessageLevel,
-        message, lineNumber, document->url().string());
+        message, lineNumber, m_document->url().string());
+}
+
+#ifdef BUILDING_ON_LEOPARD
+bool shouldCreateImplicitHead(Document* document)
+{
+    ASSERT(document);
+    
+    Settings* settings = document->page() ? document->page()->settings() : 0;
+    return settings ? !settings->needsLeopardMailQuirks() : true;
+}
+#elif defined(BUILDING_ON_TIGER)
+bool shouldCreateImplicitHead(Document* document)
+{
+    ASSERT(document);
+    
+    Settings* settings = document->page() ? document->page()->settings() : 0;
+    return settings ? !settings->needsTigerMailQuirks() : true;
 }
+#endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.h b/src/3rdparty/webkit/WebCore/html/HTMLParser.h
index 866835f0d7..19f553e035 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.h
@@ -3,7 +3,7 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1998 Waldo Bastian (bastian@kde.org)
               (C) 1999 Lars Knoll (knoll@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,6 +26,7 @@
 
 #include "QualifiedName.h"
 #include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 #include "HTMLParserErrorCodes.h"
 
@@ -38,6 +39,7 @@ class HTMLDocument;
 class HTMLFormElement;
 class HTMLHeadElement;
 class HTMLMapElement;
+class HTMLParserQuirks;
 class Node;
 
 struct HTMLStackElem;
@@ -150,35 +152,48 @@ private:
 
     void reportErrorToConsole(HTMLParserErrorCode, const AtomicString* tagName1, const AtomicString* tagName2, bool closeTags);
     
-    Document* document;
+    Document* m_document;
 
     // The currently active element (the one new elements will be added to). Can be a document fragment, a document or an element.
-    Node* current;
+    Node* m_current;
     // We can't ref a document, but we don't want to constantly check if a node is a document just to decide whether to deref.
-    bool didRefCurrent;
+    bool m_didRefCurrent;
 
-    HTMLStackElem* blockStack;
+    HTMLStackElem* m_blockStack;
+
+    // The number of tags with priority minBlockLevelTagPriority or higher
+    // currently in m_blockStack. The parser enforces a cap on this value by
+    // adding such new elements as siblings instead of children once it is reached.
+    size_t m_blocksInStack;
 
     enum ElementInScopeState { NotInScope, InScope, Unknown }; 
     ElementInScopeState m_hasPElementInScope;
 
     RefPtr<HTMLFormElement> m_currentFormElement; // currently active form
     RefPtr<HTMLMapElement> m_currentMapElement; // current map
-    HTMLHeadElement* head; // head element; needed for HTML which defines <base> after </head>
+    RefPtr<HTMLHeadElement> m_head; // head element; needed for HTML which defines <base> after </head>
     RefPtr<Node> m_isindexElement; // a possible <isindex> element in the head
 
-    bool inBody;
-    bool haveContent;
-    bool haveFrameSet;
+    bool m_inBody;
+    bool m_haveContent;
+    bool m_haveFrameSet;
 
     AtomicString m_skipModeTag; // tells the parser to discard all tags until it reaches the one specified
 
     bool m_isParsingFragment;
     bool m_reportErrors;
     bool m_handlingResidualStyleAcrossBlocks;
-    int inStrayTableContent;
+    int m_inStrayTableContent;
+
+    OwnPtr<HTMLParserQuirks> m_parserQuirks;
 };
 
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_TIGER)
+bool shouldCreateImplicitHead(Document*);
+#else
+inline bool shouldCreateImplicitHead(Document*) { return true; }
+#endif
+
 }
     
 #endif // HTMLParser_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParserQuirks.h b/src/3rdparty/webkit/WebCore/html/HTMLParserQuirks.h
new file mode 100644
index 0000000000..b5972a6f07
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParserQuirks.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLParserQuirks_h
+#define HTMLParserQuirks_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class AtomicString;
+class Node;
+
+class HTMLParserQuirks : Noncopyable {
+public:
+    HTMLParserQuirks() { }
+    virtual ~HTMLParserQuirks() { }
+
+    virtual void reset() = 0;
+
+    virtual bool shouldInsertNode(Node* parent, Node* newNode) = 0;
+    virtual bool shouldPopBlock(const AtomicString& tagNameOnStack, const AtomicString& tagNameToPop) = 0;
+};
+
+} // namespace WebCore
+
+#endif // HTMLParserQuirks_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
index 4344b3d3f6..d950d9d47d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
@@ -21,6 +21,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLPlugInElement.h"
 
@@ -30,6 +31,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
@@ -46,7 +48,7 @@ using namespace HTMLNames;
 
 HTMLPlugInElement::HTMLPlugInElement(const QualifiedName& tagName, Document* doc)
     // FIXME: Always passing false as createdByParser is odd (see bug22851).
-    : HTMLFrameOwnerElement(tagName, doc, false)
+    : HTMLFrameOwnerElement(tagName, doc)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_NPObject(0)
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
index 23ecaaa55f..f340ae39a0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
@@ -21,12 +21,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLPreElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp
index 19164e2727..e548215563 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp
@@ -22,6 +22,7 @@
 #include "config.h"
 #include "HTMLQuoteElement.h"
 
+#include "Document.h"
 #include "HTMLNames.h"
 
 namespace WebCore {
@@ -34,6 +35,13 @@ HTMLQuoteElement::HTMLQuoteElement(const QualifiedName& tagName, Document* doc)
     ASSERT(hasTagName(qTag));
 }
 
+void HTMLQuoteElement::insertedIntoDocument()
+{
+    document()->setUsesBeforeAfterRules(true);
+
+    HTMLElement::insertedIntoDocument();
+}
+
 String HTMLQuoteElement::cite() const
 {
     return getAttribute(citeAttr);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h
index 1e35431996..623c28f036 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h
@@ -36,6 +36,8 @@ public:
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual int tagPriority() const { return 1; }
 
+    virtual void insertedIntoDocument();
+
     String cite() const;
     void setCite(const String&);
 };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
index 4744b3400b..86cc3a2f2a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
@@ -26,6 +26,8 @@
 #include "Document.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "ScriptEventListener.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -67,7 +69,7 @@ void HTMLScriptElement::parseMappedAttribute(MappedAttribute* attr)
     if (attrName == srcAttr)
         handleSourceAttribute(m_data, attr->value());
     else if (attrName == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -209,18 +211,23 @@ String HTMLScriptElement::languageAttributeValue() const
 {
     return getAttribute(languageAttr).string();
 }
+
+String HTMLScriptElement::forAttributeValue() const
+{
+    return getAttribute(forAttr).string();
+}
  
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
     m_data.setHaveFiredLoadEvent(true);
 
-    dispatchEventForType(eventNames().loadEvent, false, false);
+    dispatchEvent(eventNames().loadEvent, false, false);
 }
 
 void HTMLScriptElement::dispatchErrorEvent()
 {
-    dispatchEventForType(eventNames().errorEvent, true, false);
+    dispatchEvent(eventNames().errorEvent, true, false);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
index 8839131ed9..4d18beb467 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
@@ -35,7 +35,7 @@ public:
     HTMLScriptElement(const QualifiedName&, Document*, bool createdByParser);
     ~HTMLScriptElement();
 
-    bool shouldExecuteAsJavaScript() const;
+    virtual bool shouldExecuteAsJavaScript() const;
     virtual String scriptContent() const;
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
@@ -75,11 +75,14 @@ public:
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
+    bool haveFiredLoadEvent() const { return m_data.haveFiredLoadEvent(); }
+
 protected:
     virtual String sourceAttributeValue() const;
     virtual String charsetAttributeValue() const;
     virtual String typeAttributeValue() const;
     virtual String languageAttributeValue() const;
+    virtual String forAttributeValue() const;
 
     virtual void dispatchLoadEvent();
     virtual void dispatchErrorEvent();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
index f347698180..95038e6244 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -21,64 +21,31 @@
  * Boston, MA 02110-1301, USA.
  *
  */
- 
+
 #include "config.h"
 #include "HTMLSelectElement.h"
 
 #include "AXObjectCache.h"
-#include "CSSPropertyNames.h"
-#include "CSSStyleSelector.h"
-#include "CharacterNames.h"
-#include "ChromeClient.h"
-#include "Document.h"
-#include "Event.h"
-#include "EventHandler.h"
 #include "EventNames.h"
-#include "FormDataList.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "FrameLoaderClient.h"
-#include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
 #include "HTMLOptionsCollection.h"
-#include "KeyboardEvent.h"
-#include "MouseEvent.h"
-#include "Page.h"
+#include "MappedAttribute.h"
 #include "RenderListBox.h"
 #include "RenderMenuList.h"
-#include <math.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/Vector.h>
-
-#if PLATFORM(MAC)
-#define ARROW_KEYS_POP_MENU 1
-#else
-#define ARROW_KEYS_POP_MENU 0
-#endif
+#include "ScriptEventListener.h"
 
 using namespace std;
-using namespace WTF;
-using namespace Unicode;
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-static const DOMTimeStamp typeAheadTimeout = 1000;
+// Upper limit agreed upon with representatives of Opera and Mozilla.
+static const unsigned maxSelectItems = 10000;
 
-HTMLSelectElement::HTMLSelectElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLFormControlElementWithState(tagName, doc, f)
-    , m_minwidth(0)
-    , m_size(0)
-    , m_multiple(false)
-    , m_recalcListItems(false)
-    , m_lastOnChangeIndex(-1)
-    , m_activeSelectionAnchorIndex(-1)
-    , m_activeSelectionEndIndex(-1)
-    , m_activeSelectionState(false)
-    , m_repeatingChar(0)
-    , m_lastCharTime(0)
+HTMLSelectElement::HTMLSelectElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+    : HTMLFormControlElementWithState(tagName, document, form)
 {
     ASSERT(hasTagName(selectTag) || hasTagName(keygenTag));
 }
@@ -90,120 +57,52 @@ bool HTMLSelectElement::checkDTD(const Node* newChild)
            newChild->hasTagName(scriptTag);
 }
 
-void HTMLSelectElement::recalcStyle( StyleChange ch )
+void HTMLSelectElement::recalcStyle(StyleChange change)
 {
-    if (hasChangedChild() && renderer()) {
-        if (usesMenuList())
-            static_cast<RenderMenuList*>(renderer())->setOptionsChanged(true);
-        else
-            static_cast<RenderListBox*>(renderer())->setOptionsChanged(true);
-    } else if (m_recalcListItems)
-        recalcListItems();
-
-    HTMLFormControlElementWithState::recalcStyle(ch);
+    SelectElement::recalcStyle(m_data, this);
+    HTMLFormControlElementWithState::recalcStyle(change);
 }
 
-const AtomicString& HTMLSelectElement::type() const
+const AtomicString& HTMLSelectElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, selectMultiple, ("select-multiple"));
     DEFINE_STATIC_LOCAL(const AtomicString, selectOne, ("select-one"));
-    return m_multiple ? selectMultiple : selectOne;
+    return m_data.multiple() ? selectMultiple : selectOne;
 }
 
 int HTMLSelectElement::selectedIndex() const
 {
-    // return the number of the first option selected
-    unsigned index = 0;
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned int i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            if (static_cast<HTMLOptionElement*>(items[i])->selected())
-                return index;
-            index++;
-        }
-    }
-    return -1;
-}
-
-int HTMLSelectElement::lastSelectedListIndex() const
-{
-    // return the number of the last option selected
-    unsigned index = 0;
-    bool found = false;
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned int i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            if (static_cast<HTMLOptionElement*>(items[i])->selected()) {
-                index = i;
-                found = true;
-            }
-        }
-    }
-    return found ? (int) index : -1;
+    return SelectElement::selectedIndex(m_data, this);
 }
 
 void HTMLSelectElement::deselectItems(HTMLOptionElement* excludeElement)
 {
-    const Vector<HTMLElement*>& items = listItems();
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag) && (items[i] != excludeElement)) {
-            HTMLOptionElement* element = static_cast<HTMLOptionElement*>(items[i]);
-            element->setSelectedState(false);
-        }
-    }
+    SelectElement::deselectItems(m_data, this, excludeElement);
 }
 
 void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect, bool fireOnChange)
 {
-    const Vector<HTMLElement*>& items = listItems();
-    int listIndex = optionToListIndex(optionIndex);
-    HTMLOptionElement* element = 0;
-
-    if (!multiple())
-        deselect = true;
-
-    if (listIndex >= 0) {
-        if (m_activeSelectionAnchorIndex < 0 || deselect)
-            setActiveSelectionAnchorIndex(listIndex);
-        if (m_activeSelectionEndIndex < 0 || deselect)
-            setActiveSelectionEndIndex(listIndex);
-        element = static_cast<HTMLOptionElement*>(items[listIndex]);
-        element->setSelectedState(true);
-    }
-
-    if (deselect)
-        deselectItems(element);
-
-    scrollToSelection();
-
-    // This only gets called with fireOnChange for menu lists. 
-    if (fireOnChange && usesMenuList())
-        menuListOnChange();
-
-    Frame* frame = document()->frame();
-    if (frame)
-        frame->page()->chrome()->client()->formStateDidChange(this);
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChange);
 }
 
 int HTMLSelectElement::activeSelectionStartListIndex() const
 {
-    if (m_activeSelectionAnchorIndex >= 0)
-        return m_activeSelectionAnchorIndex;
+    if (m_data.activeSelectionAnchorIndex() >= 0)
+        return m_data.activeSelectionAnchorIndex();
     return optionToListIndex(selectedIndex());
 }
 
 int HTMLSelectElement::activeSelectionEndListIndex() const
 {
-    if (m_activeSelectionEndIndex >= 0)
-        return m_activeSelectionEndIndex;
-    return lastSelectedListIndex();
+    if (m_data.activeSelectionEndIndex() >= 0)
+        return m_data.activeSelectionEndIndex();
+    return SelectElement::lastSelectedListIndex(m_data, this);
 }
 
 unsigned HTMLSelectElement::length() const
 {
     unsigned len = 0;
-    const Vector<HTMLElement*>& items = listItems();
+    const Vector<Element*>& items = listItems();
     for (unsigned i = 0; i < items.size(); ++i) {
         if (items[i]->hasLocalName(optionTag))
             ++len;
@@ -218,37 +117,29 @@ void HTMLSelectElement::add(HTMLElement *element, HTMLElement *before, Exception
     if (!element || !(element->hasLocalName(optionTag) || element->hasLocalName(hrTag)))
         return;
 
-    ec = 0;
     insertBefore(element, before, ec);
-    if (!ec)
-        setRecalcListItems();
 }
 
 void HTMLSelectElement::remove(int index)
 {
-    ExceptionCode ec = 0;
     int listIndex = optionToListIndex(index);
+    if (listIndex < 0)
+        return;
 
-    const Vector<HTMLElement*>& items = listItems();
-    if (listIndex < 0 || index >= int(items.size()))
-        return; // ### what should we do ? remove the last item?
-
-    Element *item = items[listIndex];
+    Element* item = listItems()[listIndex];
     ASSERT(item->parentNode());
+    ExceptionCode ec;
     item->parentNode()->removeChild(item, ec);
-    if (!ec)
-        setRecalcListItems();
 }
 
 String HTMLSelectElement::value()
 {
-    unsigned i;
-    const Vector<HTMLElement*>& items = listItems();
-    for (i = 0; i < items.size(); i++) {
+    const Vector<Element*>& items = listItems();
+    for (unsigned i = 0; i < items.size(); i++) {
         if (items[i]->hasLocalName(optionTag) && static_cast<HTMLOptionElement*>(items[i])->selected())
             return static_cast<HTMLOptionElement*>(items[i])->value();
     }
-    return String("");
+    return "";
 }
 
 void HTMLSelectElement::setValue(const String &value)
@@ -257,9 +148,9 @@ void HTMLSelectElement::setValue(const String &value)
         return;
     // find the option with value() matching the given parameter
     // and make it the current selection.
-    const Vector<HTMLElement*>& items = listItems();
+    const Vector<Element*>& items = listItems();
     unsigned optionIndex = 0;
-    for (unsigned i = 0; i < items.size(); i++)
+    for (unsigned i = 0; i < items.size(); i++) {
         if (items[i]->hasLocalName(optionTag)) {
             if (static_cast<HTMLOptionElement*>(items[i])->value() == value) {
                 setSelectedIndex(optionIndex, true);
@@ -267,80 +158,24 @@ void HTMLSelectElement::setValue(const String &value)
             }
             optionIndex++;
         }
-}
-
-bool HTMLSelectElement::saveState(String& value) const
-{
-    const Vector<HTMLElement*>& items = listItems();
-    int l = items.size();
-    Vector<char, 1024> characters(l);
-    for (int i = 0; i < l; ++i) {
-        HTMLElement* e = items[i];
-        bool selected = e->hasLocalName(optionTag) && static_cast<HTMLOptionElement*>(e)->selected();
-        characters[i] = selected ? 'X' : '.';
     }
-    value = String(characters.data(), l);
-    return true;
 }
 
-void HTMLSelectElement::restoreState(const String& state)
+bool HTMLSelectElement::saveFormControlState(String& value) const
 {
-    recalcListItems();
-    
-    const Vector<HTMLElement*>& items = listItems();
-    int l = items.size();
-    for (int i = 0; i < l; i++)
-        if (items[i]->hasLocalName(optionTag))
-            static_cast<HTMLOptionElement*>(items[i])->setSelectedState(state[i] == 'X');
-            
-    setChanged();
-}
-
-bool HTMLSelectElement::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
-{
-    bool result = HTMLFormControlElementWithState::insertBefore(newChild, refChild, ec, shouldLazyAttach);
-    if (result)
-        setRecalcListItems();
-    return result;
+    return SelectElement::saveFormControlState(m_data, this, value);
 }
 
-bool HTMLSelectElement::replaceChild(PassRefPtr<Node> newChild, Node *oldChild, ExceptionCode& ec, bool shouldLazyAttach)
+void HTMLSelectElement::restoreFormControlState(const String& state)
 {
-    bool result = HTMLFormControlElementWithState::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
-    if (result)
-        setRecalcListItems();
-    return result;
+    SelectElement::restoreFormControlState(m_data, this, state);
 }
 
-bool HTMLSelectElement::removeChild(Node* oldChild, ExceptionCode& ec)
+void HTMLSelectElement::parseMappedAttribute(MappedAttribute* attr) 
 {
-    bool result = HTMLFormControlElementWithState::removeChild(oldChild, ec);
-    if (result)
-        setRecalcListItems();
-    return result;
-}
-
-bool HTMLSelectElement::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
-{
-    bool result = HTMLFormControlElementWithState::appendChild(newChild, ec, shouldLazyAttach);
-    if (result)
-        setRecalcListItems();
-    return result;
-}
-
-bool HTMLSelectElement::removeChildren()
-{
-    bool result = HTMLFormControlElementWithState::removeChildren();
-    if (result)
-        setRecalcListItems();
-    return result;
-}
-
-void HTMLSelectElement::parseMappedAttribute(MappedAttribute *attr)
-{
-    bool oldUsesMenuList = usesMenuList();
+    bool oldUsesMenuList = m_data.usesMenuList();
     if (attr->name() == sizeAttr) {
-        int oldSize = m_size;
+        int oldSize = m_data.size();
         // Set the attribute value to a number.
         // This is important since the style rules for this attribute can determine the appearance property.
         int size = attr->value().toInt();
@@ -348,31 +183,25 @@ void HTMLSelectElement::parseMappedAttribute(MappedAttribute *attr)
         if (attrSize != attr->value())
             attr->setValue(attrSize);
 
-        m_size = max(size, 1);
-        if ((oldUsesMenuList != usesMenuList() || !oldUsesMenuList && m_size != oldSize) && attached()) {
+        m_data.setSize(max(size, 1));
+        if ((oldUsesMenuList != m_data.usesMenuList() || (!oldUsesMenuList && m_data.size() != oldSize)) && attached()) {
             detach();
             attach();
             setRecalcListItems();
         }
-    } else if (attr->name() == widthAttr) {
-        m_minwidth = max(attr->value().toInt(), 0);
-    } else if (attr->name() == multipleAttr) {
-        m_multiple = (!attr->isNull());
-        if (oldUsesMenuList != usesMenuList() && attached()) {
-            detach();
-            attach();
-        }
-    } else if (attr->name() == accesskeyAttr) {
+    } else if (attr->name() == multipleAttr)
+        SelectElement::parseMultipleAttribute(m_data, this, attr);
+    else if (attr->name() == accesskeyAttr) {
         // FIXME: ignore for the moment
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=12072
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onchangeAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -393,95 +222,34 @@ bool HTMLSelectElement::isMouseFocusable() const
 
 bool HTMLSelectElement::canSelectAll() const
 {
-    return !usesMenuList(); 
+    return !m_data.usesMenuList(); 
 }
 
 void HTMLSelectElement::selectAll()
 {
-    ASSERT(!usesMenuList());
-    if (!renderer() || !multiple())
-        return;
-    
-    // Save the selection so it can be compared to the new selectAll selection when we call onChange
-    saveLastSelection();
-    
-    m_activeSelectionState = true;
-    setActiveSelectionAnchorIndex(nextSelectableListIndex(-1));
-    setActiveSelectionEndIndex(previousSelectableListIndex(-1));
-    
-    updateListBoxSelection(false);
-    listBoxOnChange();
+    SelectElement::selectAll(m_data, this);
 }
 
 RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    if (usesMenuList())
+    if (m_data.usesMenuList())
         return new (arena) RenderMenuList(this);
     return new (arena) RenderListBox(this);
 }
 
 bool HTMLSelectElement::appendFormData(FormDataList& list, bool)
 {
-    bool successful = false;
-    const Vector<HTMLElement*>& items = listItems();
-
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[i]);
-            if (option->selected()) {
-                list.appendData(name(), option->value());
-                successful = true;
-            }
-        }
-    }
-
-    // ### this case should not happen. make sure that we select the first option
-    // in any case. otherwise we have no consistency with the DOM interface. FIXME!
-    // we return the first one if it was a combobox select
-    if (!successful && !m_multiple && m_size <= 1 && items.size() &&
-        (items[0]->hasLocalName(optionTag))) {
-        HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[0]);
-        if (option->value().isNull())
-            list.appendData(name(), option->text().stripWhiteSpace());
-        else
-            list.appendData(name(), option->value());
-        successful = true;
-    }
-
-    return successful;
+    return SelectElement::appendFormData(m_data, this, list);
 }
 
 int HTMLSelectElement::optionToListIndex(int optionIndex) const
 {
-    const Vector<HTMLElement*>& items = listItems();
-    int listSize = (int)items.size();
-    if (optionIndex < 0 || optionIndex >= listSize)
-        return -1;
-
-    int optionIndex2 = -1;
-    for (int listIndex = 0; listIndex < listSize; listIndex++) {
-        if (items[listIndex]->hasLocalName(optionTag)) {
-            optionIndex2++;
-            if (optionIndex2 == optionIndex)
-                return listIndex;
-        }
-    }
-    return -1;
+    return SelectElement::optionToListIndex(m_data, this, optionIndex);
 }
 
 int HTMLSelectElement::listToOptionIndex(int listIndex) const
 {
-    const Vector<HTMLElement*>& items = listItems();
-    if (listIndex < 0 || listIndex >= int(items.size()) ||
-        !items[listIndex]->hasLocalName(optionTag))
-        return -1;
-
-    int optionIndex = 0; // actual index of option not counting OPTGROUP entries that may be in list
-    for (int i = 0; i < listIndex; i++)
-        if (items[i]->hasLocalName(optionTag))
-            optionIndex++;
-    return optionIndex;
+    return SelectElement::listToOptionIndex(m_data, this, listIndex);
 }
 
 PassRefPtr<HTMLOptionsCollection> HTMLSelectElement::options()
@@ -491,37 +259,7 @@ PassRefPtr<HTMLOptionsCollection> HTMLSelectElement::options()
 
 void HTMLSelectElement::recalcListItems(bool updateSelectedStates) const
 {
-    m_listItems.clear();
-    HTMLOptionElement* foundSelected = 0;
-    for (Node* current = firstChild(); current; current = current->traverseNextSibling(this)) {
-        if (current->hasTagName(optgroupTag) && current->firstChild()) {
-            // FIXME: It doesn't make sense to add an optgroup to the list items,
-            // when it has children, but not to add it if it happens to have,
-            // children (say some comment nodes or text nodes), yet that's what
-            // this code does!
-            m_listItems.append(static_cast<HTMLElement*>(current));
-            current = current->firstChild();
-            // FIXME: It doesn't make sense to handle an <optgroup> inside another <optgroup>
-            // if it's not the first child, but not handle it if it happens to be the first
-            // child, yet that's what this code does!
-        }
-
-        if (current->hasTagName(optionTag)) {
-            m_listItems.append(static_cast<HTMLElement*>(current));
-            if (updateSelectedStates) {
-                if (!foundSelected && (usesMenuList() || (!m_multiple && static_cast<HTMLOptionElement*>(current)->selected()))) {
-                    foundSelected = static_cast<HTMLOptionElement*>(current);
-                    foundSelected->setSelectedState(true);
-                } else if (foundSelected && !m_multiple && static_cast<HTMLOptionElement*>(current)->selected()) {
-                    foundSelected->setSelectedState(false);
-                    foundSelected = static_cast<HTMLOptionElement*>(current);
-                }
-            }
-        }
-        if (current->hasTagName(hrTag))
-            m_listItems.append(static_cast<HTMLElement*>(current));
-    }
-    m_recalcListItems = false;
+    SelectElement::recalcListItems(const_cast<SelectElementData&>(m_data), this, updateSelectedStates);
 }
 
 void HTMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -535,482 +273,65 @@ void HTMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange
 
 void HTMLSelectElement::setRecalcListItems()
 {
-    m_recalcListItems = true;
-    if (renderer()) {
-        if (usesMenuList())
-            static_cast<RenderMenuList*>(renderer())->setOptionsChanged(true);
-        else
-            static_cast<RenderListBox*>(renderer())->setOptionsChanged(true);
-    }
+    SelectElement::setRecalcListItems(m_data, this);
+
     if (!inDocument())
         m_collectionInfo.reset();
-    setChanged();
 }
 
 void HTMLSelectElement::reset()
 {
-    bool optionSelected = false;
-    HTMLOptionElement* firstOption = 0;
-    const Vector<HTMLElement*>& items = listItems();
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[i]);
-            if (!option->getAttribute(selectedAttr).isNull()) {
-                option->setSelectedState(true);
-                optionSelected = true;
-            } else
-                option->setSelectedState(false);
-            if (!firstOption)
-                firstOption = option;
-        }
-    }
-    if (!optionSelected && firstOption && usesMenuList())
-        firstOption->setSelectedState(true);
-    
-    setChanged();
+    SelectElement::reset(m_data, this);
 }
 
 void HTMLSelectElement::dispatchFocusEvent()
 {
-    if (usesMenuList())
-        // Save the selection so it can be compared to the new selection when we call onChange during dispatchBlurEvent.
-        saveLastSelection();
+    SelectElement::dispatchFocusEvent(m_data, this);
     HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
 void HTMLSelectElement::dispatchBlurEvent()
 {
-    // We only need to fire onChange here for menu lists, because we fire onChange for list boxes whenever the selection change is actually made.
-    // This matches other browsers' behavior.
-    if (usesMenuList())
-        menuListOnChange();
+    SelectElement::dispatchBlurEvent(m_data, this);
     HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
-void HTMLSelectElement::defaultEventHandler(Event* evt)
+void HTMLSelectElement::defaultEventHandler(Event* event)
 {
-    if (!renderer())
+    SelectElement::defaultEventHandler(m_data, this, event, form());
+    if (event->defaultHandled())
         return;
-    
-    if (usesMenuList())
-        menuListDefaultEventHandler(evt);
-    else 
-        listBoxDefaultEventHandler(evt);
-    
-    if (evt->defaultHandled())
-        return;
-
-    if (evt->type() == eventNames().keypressEvent && evt->isKeyboardEvent()) {
-        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(evt);
-    
-        if (!keyboardEvent->ctrlKey() && !keyboardEvent->altKey() && !keyboardEvent->metaKey() &&
-            isPrintableChar(keyboardEvent->charCode())) {
-            typeAheadFind(keyboardEvent);
-            evt->setDefaultHandled();
-            return;
-        }
-    }
-
-    HTMLFormControlElementWithState::defaultEventHandler(evt);
+    HTMLFormControlElementWithState::defaultEventHandler(event);
 }
 
-void HTMLSelectElement::menuListDefaultEventHandler(Event* evt)
-{
-    RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer());
-
-    if (evt->type() == eventNames().keydownEvent) {
-        if (!renderer() || !evt->isKeyboardEvent())
-            return;
-        String keyIdentifier = static_cast<KeyboardEvent*>(evt)->keyIdentifier();
-        bool handled = false;
-#if ARROW_KEYS_POP_MENU
-        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
-            focus();
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            menuList->showPopup();
-            handled = true;
-        }
-#else
-        int listIndex = optionToListIndex(selectedIndex());
-        if (keyIdentifier == "Down" || keyIdentifier == "Right") {
-            int size = listItems().size();
-            for (listIndex += 1;
-                 listIndex >= 0 && listIndex < size && (listItems()[listIndex]->disabled() || !listItems()[listIndex]->hasTagName(optionTag));
-                 ++listIndex) { }
-            
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(listToOptionIndex(listIndex));
-            handled = true;
-        } else if (keyIdentifier == "Up" || keyIdentifier == "Left") {
-            int size = listItems().size();
-            for (listIndex -= 1;
-                 listIndex >= 0 && listIndex < size && (listItems()[listIndex]->disabled() || !listItems()[listIndex]->hasTagName(optionTag));
-                 --listIndex) { }
-            
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(listToOptionIndex(listIndex));
-            handled = true;
-        }
-#endif
-        if (handled)
-            evt->setDefaultHandled();
-    }
-
-    // Use key press event here since sending simulated mouse events
-    // on key down blocks the proper sending of the key press event.
-    if (evt->type() == eventNames().keypressEvent) {
-        if (!renderer() || !evt->isKeyboardEvent())
-            return;
-        int keyCode = static_cast<KeyboardEvent*>(evt)->keyCode();
-        bool handled = false;
-#if ARROW_KEYS_POP_MENU
-        if (keyCode == ' ') {
-            focus();
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            menuList->showPopup();
-            handled = true;
-        }
-        if (keyCode == '\r') {
-            menuListOnChange();
-            if (form())
-                form()->submitClick(evt);
-            handled = true;
-        }
-#else
-        int listIndex = optionToListIndex(selectedIndex());
-        if (keyCode == '\r') {
-            // listIndex should already be selected, but this will fire the onchange handler.
-            setSelectedIndex(listToOptionIndex(listIndex), true, true);
-            handled = true;
-        }
-#endif
-        if (handled)
-            evt->setDefaultHandled();
-    }
-
-    if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        focus();
-        if (menuList->popupIsVisible())
-            menuList->hidePopup();
-        else {
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            menuList->showPopup();
-        }
-        evt->setDefaultHandled();
-    }
-}
-
-void HTMLSelectElement::listBoxDefaultEventHandler(Event* evt)
+void HTMLSelectElement::setActiveSelectionAnchorIndex(int index)
 {
-    if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        focus();
-        
-        MouseEvent* mEvt = static_cast<MouseEvent*>(evt);
-        int listIndex = static_cast<RenderListBox*>(renderer())->listIndexAtOffset(mEvt->offsetX(), mEvt->offsetY());
-        if (listIndex >= 0) {
-            // Save the selection so it can be compared to the new selection when we call onChange during mouseup, or after autoscroll finishes.
-            saveLastSelection();
-
-            m_activeSelectionState = true;
-            
-            bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC)
-            multiSelectKeyPressed = mEvt->metaKey();
-#else
-            multiSelectKeyPressed = mEvt->ctrlKey();
-#endif
-
-            bool shiftSelect = multiple() && mEvt->shiftKey();
-            bool multiSelect = multiple() && multiSelectKeyPressed && !mEvt->shiftKey();
-            
-            HTMLElement* clickedElement = listItems()[listIndex];            
-            HTMLOptionElement* option = 0;
-            if (clickedElement->hasLocalName(optionTag)) {
-                option = static_cast<HTMLOptionElement*>(clickedElement);
-                
-                // Keep track of whether an active selection (like during drag selection), should select or deselect
-                if (option->selected() && multiSelectKeyPressed)
-                    m_activeSelectionState = false;
-
-                if (!m_activeSelectionState)
-                    option->setSelectedState(false);
-            }
-            
-            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
-            // If no option was clicked, then this will deselect all items in the list.
-            if (!shiftSelect && !multiSelect)
-                deselectItems(option);
-
-            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
-            if (m_activeSelectionAnchorIndex < 0 && !multiSelect)
-                setActiveSelectionAnchorIndex(selectedIndex());
-
-            // Set the selection state of the clicked option
-            if (option && !option->disabled())
-                option->setSelectedState(true);
-            
-            // If there was no selectedIndex() for the previous initialization, or
-            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
-            if (listIndex >= 0 && (m_activeSelectionAnchorIndex < 0 || !shiftSelect))
-                setActiveSelectionAnchorIndex(listIndex);
-            
-            setActiveSelectionEndIndex(listIndex);
-            updateListBoxSelection(!multiSelect);
-
-            if (Frame* frame = document()->frame())
-                frame->eventHandler()->setMouseDownMayStartAutoscroll();
-
-            evt->setDefaultHandled();
-        }
-    } else if (evt->type() == eventNames().mouseupEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton && document()->frame()->eventHandler()->autoscrollRenderer() != renderer())
-        // This makes sure we fire onChange for a single click.  For drag selection, onChange will fire when the autoscroll timer stops.
-        listBoxOnChange();
-    else if (evt->type() == eventNames().keydownEvent) {
-        if (!evt->isKeyboardEvent())
-            return;
-        String keyIdentifier = static_cast<KeyboardEvent*>(evt)->keyIdentifier();
-
-        int endIndex = 0;        
-        if (m_activeSelectionEndIndex < 0) {
-            // Initialize the end index
-            if (keyIdentifier == "Down")
-                endIndex = nextSelectableListIndex(lastSelectedListIndex());
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(optionToListIndex(selectedIndex()));
-        } else {
-            // Set the end index based on the current end index
-            if (keyIdentifier == "Down")
-                endIndex = nextSelectableListIndex(m_activeSelectionEndIndex);
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(m_activeSelectionEndIndex);    
-        }
-        
-        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
-            // Save the selection so it can be compared to the new selection when we call onChange immediately after making the new selection.
-            saveLastSelection();
-
-            ASSERT(endIndex >= 0 && (unsigned)endIndex < listItems().size()); 
-            setActiveSelectionEndIndex(endIndex);
-            
-            // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
-            bool deselectOthers = !multiple() || !static_cast<KeyboardEvent*>(evt)->shiftKey();
-            if (m_activeSelectionAnchorIndex < 0 || deselectOthers) {
-                m_activeSelectionState = true;
-                if (deselectOthers)
-                    deselectItems();
-                setActiveSelectionAnchorIndex(m_activeSelectionEndIndex);
-            }
-
-            static_cast<RenderListBox*>(renderer())->scrollToRevealElementAtListIndex(endIndex);
-            updateListBoxSelection(deselectOthers);
-            listBoxOnChange();
-            evt->setDefaultHandled();
-        }
-    } else if (evt->type() == eventNames().keypressEvent) {
-        if (!evt->isKeyboardEvent())
-            return;
-        int keyCode = static_cast<KeyboardEvent*>(evt)->keyCode();
-
-        if (keyCode == '\r') {
-            if (form())
-                form()->submitClick(evt);
-            evt->setDefaultHandled();
-            return;
-        }
-    }
+    SelectElement::setActiveSelectionAnchorIndex(m_data, this, index);
 }
 
-void HTMLSelectElement::setActiveSelectionAnchorIndex(int index)
+void HTMLSelectElement::setActiveSelectionEndIndex(int index)
 {
-    m_activeSelectionAnchorIndex = index;
-    
-    // Cache the selection state so we can restore the old selection as the new selection pivots around this anchor index
-    const Vector<HTMLElement*>& items = listItems();
-    m_cachedStateForActiveSelection.clear();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            m_cachedStateForActiveSelection.append(option->selected());
-        } else
-            m_cachedStateForActiveSelection.append(false);
-    }
+    SelectElement::setActiveSelectionEndIndex(m_data, index);
 }
 
 void HTMLSelectElement::updateListBoxSelection(bool deselectOtherOptions)
 {
-    ASSERT(renderer() && renderer()->isListBox());
-    
-    unsigned start;
-    unsigned end;
-    ASSERT(m_activeSelectionAnchorIndex >= 0);
-    start = min(m_activeSelectionAnchorIndex, m_activeSelectionEndIndex);
-    end = max(m_activeSelectionAnchorIndex, m_activeSelectionEndIndex);
-
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            if (!option->disabled()) {
-                if (i >= start && i <= end)
-                    option->setSelectedState(m_activeSelectionState);
-                else if (deselectOtherOptions || i >= m_cachedStateForActiveSelection.size())
-                    option->setSelectedState(false);
-                else
-                    option->setSelectedState(m_cachedStateForActiveSelection[i]);
-            }
-        }
-    }
-
-    scrollToSelection();
+    SelectElement::updateListBoxSelection(m_data, this, deselectOtherOptions);
 }
 
 void HTMLSelectElement::menuListOnChange()
 {
-    ASSERT(usesMenuList());
-    int selected = selectedIndex();
-    if (m_lastOnChangeIndex != selected) {
-        m_lastOnChangeIndex = selected;
-        onChange();
-    }
+    SelectElement::menuListOnChange(m_data, this);
 }
 
 void HTMLSelectElement::listBoxOnChange()
 {
-    ASSERT(!usesMenuList());
-
-    const Vector<HTMLElement*>& items = listItems();
-    
-    // If the cached selection list is empty, or the size has changed, then fire onChange, and return early.
-    if (m_lastOnChangeSelection.isEmpty() || m_lastOnChangeSelection.size() != items.size()) {
-        onChange();
-        return;
-    }
-    
-    // Update m_lastOnChangeSelection and fire onChange
-    bool fireOnChange = false;
-    for (unsigned i = 0; i < items.size(); i++) {
-        bool selected = false;
-        if (items[i]->hasLocalName(optionTag))
-            selected = static_cast<HTMLOptionElement*>(items[i])->selected();
-        if (selected != m_lastOnChangeSelection[i])      
-            fireOnChange = true;
-        m_lastOnChangeSelection[i] = selected;
-    }
-    if (fireOnChange)
-        onChange();
+    SelectElement::listBoxOnChange(m_data, this);
 }
 
 void HTMLSelectElement::saveLastSelection()
 {
-    const Vector<HTMLElement*>& items = listItems();
-
-    if (usesMenuList()) {
-        m_lastOnChangeIndex = selectedIndex();
-        return;
-    }
-    
-    m_lastOnChangeSelection.clear();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            m_lastOnChangeSelection.append(option->selected());
-        } else
-            m_lastOnChangeSelection.append(false);
-    }
-}
-
-static String stripLeadingWhiteSpace(const String& string)
-{
-    int length = string.length();
-    int i;
-    for (i = 0; i < length; ++i)
-        if (string[i] != noBreakSpace &&
-            (string[i] <= 0x7F ? !isASCIISpace(string[i]) : (direction(string[i]) != WhiteSpaceNeutral)))
-            break;
-
-    return string.substring(i, length - i);
-}
-
-void HTMLSelectElement::typeAheadFind(KeyboardEvent* event)
-{
-    if (event->timeStamp() < m_lastCharTime)
-        return;
-
-    DOMTimeStamp delta = event->timeStamp() - m_lastCharTime;
-
-    m_lastCharTime = event->timeStamp();
-
-    UChar c = event->charCode();
-
-    String prefix;
-    int searchStartOffset = 1;
-    if (delta > typeAheadTimeout) {
-        m_typedString = prefix = String(&c, 1);
-        m_repeatingChar = c;
-    } else {
-        m_typedString.append(c);
-
-        if (c == m_repeatingChar)
-            // The user is likely trying to cycle through all the items starting with this character, so just search on the character
-            prefix = String(&c, 1);
-        else {
-            m_repeatingChar = 0;
-            prefix = m_typedString;
-            searchStartOffset = 0;
-        }
-    }
-
-    const Vector<HTMLElement*>& items = listItems();
-    int itemCount = items.size();
-    if (itemCount < 1)
-        return;
-
-    int selected = selectedIndex();
-    int index = (optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
-    ASSERT(index >= 0);
-    for (int i = 0; i < itemCount; i++, index = (index + 1) % itemCount) {
-        if (!items[index]->hasTagName(optionTag) || items[index]->disabled())
-            continue;
-
-        if (stripLeadingWhiteSpace(static_cast<HTMLOptionElement*>(items[index])->optionText()).startsWith(prefix, false)) {
-            setSelectedIndex(listToOptionIndex(index));
-            if(!usesMenuList())
-                listBoxOnChange();
-            setChanged();
-            return;
-        }
-    }
-}
-
-int HTMLSelectElement::nextSelectableListIndex(int startIndex)
-{
-    const Vector<HTMLElement*>& items = listItems();
-    int index = startIndex + 1;
-    while (index >= 0 && (unsigned)index < items.size() && (!items[index]->hasLocalName(optionTag) || items[index]->disabled()))
-        index++;
-    if ((unsigned) index == items.size())
-        return startIndex;
-    return index;
-}
-
-int HTMLSelectElement::previousSelectableListIndex(int startIndex)
-{
-    const Vector<HTMLElement*>& items = listItems();
-    if (startIndex == -1)
-        startIndex = items.size();
-    int index = startIndex - 1;
-    while (index >= 0 && (unsigned)index < items.size() && (!items[index]->hasLocalName(optionTag) || items[index]->disabled()))
-        index--;
-    if (index == -1)
-        return startIndex;
-    return index;
+    SelectElement::saveLastSelection(m_data, this);
 }
 
 void HTMLSelectElement::accessKeyAction(bool sendToAnyElement)
@@ -1020,23 +341,8 @@ void HTMLSelectElement::accessKeyAction(bool sendToAnyElement)
 }
 
 void HTMLSelectElement::accessKeySetSelectedIndex(int index)
-{    
-    // first bring into focus the list box
-    if (!focused())
-        accessKeyAction(false);
-    
-    // if this index is already selected, unselect. otherwise update the selected index
-    Node* listNode = item(index);
-    if (listNode && listNode->hasTagName(optionTag)) {
-        HTMLOptionElement* listElement = static_cast<HTMLOptionElement*>(listNode);
-        if (listElement->selected())
-            listElement->setSelectedState(false);
-        else
-            setSelectedIndex(index, false, true);
-    }
-    
-    listBoxOnChange();
-    scrollToSelection();
+{
+    SelectElement::accessKeySetSelectedIndex(m_data, this, index);
 }
     
 void HTMLSelectElement::setMultiple(bool multiple)
@@ -1062,8 +368,8 @@ Node* HTMLSelectElement::item(unsigned index)
 void HTMLSelectElement::setOption(unsigned index, HTMLOptionElement* option, ExceptionCode& ec)
 {
     ec = 0;
-    if (index > INT_MAX)
-        index = INT_MAX;
+    if (index > maxSelectItems - 1)
+        index = maxSelectItems - 1;
     int diff = index  - length();
     HTMLElement* before = 0;
     // out of array bounds ? first insert empty dummies
@@ -1078,47 +384,48 @@ void HTMLSelectElement::setOption(unsigned index, HTMLOptionElement* option, Exc
     if (!ec) {
         add(option, before, ec);
         if (diff >= 0 && option->selected())
-            setSelectedIndex(index, !m_multiple);
+            setSelectedIndex(index, !m_data.multiple());
     }
 }
 
 void HTMLSelectElement::setLength(unsigned newLen, ExceptionCode& ec)
 {
     ec = 0;
-    if (newLen > INT_MAX)
-        newLen = INT_MAX;
+    if (newLen > maxSelectItems)
+        newLen = maxSelectItems;
     int diff = length() - newLen;
 
     if (diff < 0) { // add dummy elements
         do {
-            RefPtr<Element> option = document()->createElement("option", ec);
-            if (!option)
-                break;
+            RefPtr<Element> option = document()->createElement(optionTag, false);
+            ASSERT(option);
             add(static_cast<HTMLElement*>(option.get()), 0, ec);
             if (ec)
                 break;
         } while (++diff);
+    } else {
+        const Vector<Element*>& items = listItems();
+
+        size_t optionIndex = 0;
+        for (size_t listIndex = 0; listIndex < items.size(); listIndex++) {
+            if (items[listIndex]->hasLocalName(optionTag) && optionIndex++ >= newLen) {
+                Element *item = items[listIndex];
+                ASSERT(item->parentNode());
+                item->parentNode()->removeChild(item, ec);
+            }
+        }
     }
-    else // remove elements
-        while (diff-- > 0)
-            remove(newLen);
 }
 
 void HTMLSelectElement::scrollToSelection()
 {
-    if (renderer() && !usesMenuList())
-        static_cast<RenderListBox*>(renderer())->selectionChanged();
+    SelectElement::scrollToSelection(m_data, this);
 }
 
-#ifndef NDEBUG
-
-void HTMLSelectElement::checkListItems() const
+void HTMLSelectElement::insertedIntoTree(bool deep)
 {
-    Vector<HTMLElement*> items = m_listItems;
-    recalcListItems(false);
-    ASSERT(items == m_listItems);
+    SelectElement::insertedIntoTree(m_data, this);
+    HTMLFormControlElementWithState::insertedIntoTree(deep);
 }
 
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
index 0185ed8019..b00d68f797 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,10 +24,9 @@
 #ifndef HTMLSelectElement_h
 #define HTMLSelectElement_h
 
-#include "Event.h"
-#include "HTMLCollection.h"
+#include "CollectionCache.h"
 #include "HTMLFormControlElement.h"
-#include <wtf/Vector.h>
+#include "SelectElement.h"
 
 namespace WebCore {
 
@@ -35,82 +34,32 @@ class HTMLOptionElement;
 class HTMLOptionsCollection;
 class KeyboardEvent;
 
-class HTMLSelectElement : public HTMLFormControlElementWithState {
+class HTMLSelectElement : public HTMLFormControlElementWithState, public SelectElement {
 public:
     HTMLSelectElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
-    virtual int tagPriority() const { return 6; }
-    virtual bool checkDTD(const Node* newChild);
-
-    virtual const AtomicString& type() const;
-    
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isMouseFocusable() const;
-    virtual bool canSelectAll() const;
-    virtual void selectAll();
-
-    virtual void recalcStyle(StyleChange);
-
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
-    
-    virtual bool canStartSelection() const { return false; }
-
-    int selectedIndex() const;
-    void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
-    int lastSelectedListIndex() const;
-
-    virtual bool isEnumeratable() const { return true; }
+    virtual int selectedIndex() const;
+    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
 
     unsigned length() const;
 
-    int minWidth() const { return m_minwidth; }
-
-    int size() const { return m_size; }
-
-    bool multiple() const { return m_multiple; }
+    virtual int size() const { return m_data.size(); }
+    virtual bool multiple() const { return m_data.multiple(); }
 
     void add(HTMLElement* element, HTMLElement* before, ExceptionCode&);
     void remove(int index);
 
     String value();
     void setValue(const String&);
-    
-    PassRefPtr<HTMLOptionsCollection> options();
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    PassRefPtr<HTMLOptionsCollection> options();
 
-    virtual bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChild(Node* child, ExceptionCode&);
-    virtual bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChildren();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
-    virtual bool appendFormData(FormDataList&, bool);
-
-    // get the actual listbox index of the optionIndexth option
-    int optionToListIndex(int optionIndex) const;
-    // reverse of optionToListIndex - get optionIndex from listboxIndex
-    int listToOptionIndex(int listIndex) const;
-
     void setRecalcListItems();
 
-    const Vector<HTMLElement*>& listItems() const
-    {
-        if (m_recalcListItems)
-            recalcListItems();
-        else
-            checkListItems();
-        return m_listItems;
-    }
-    virtual void reset();
+    virtual const Vector<Element*>& listItems() const { return m_data.listItems(this); }
 
-    virtual void defaultEventHandler(Event*);
     virtual void accessKeyAction(bool sendToAnyElement);
     void accessKeySetSelectedIndex(int);
 
@@ -124,60 +73,65 @@ public:
     Node* namedItem(const AtomicString& name);
     Node* item(unsigned index);
 
-    HTMLCollection::CollectionInfo* collectionInfo() { return &m_collectionInfo; }
-    
-    void setActiveSelectionAnchorIndex(int index);
-    void setActiveSelectionEndIndex(int index) { m_activeSelectionEndIndex = index; }
-    void updateListBoxSelection(bool deselectOtherOptions);
-    void listBoxOnChange();
-    void menuListOnChange();
-    
-    int activeSelectionStartListIndex() const;
-    int activeSelectionEndListIndex() const;
-    
+    CollectionCache* collectionInfo() { return &m_collectionInfo; }
+
     void scrollToSelection();
 
 private:
+    virtual int tagPriority() const { return 6; }
+    virtual bool checkDTD(const Node* newChild);
+
+    virtual const AtomicString& formControlType() const;
+    
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isMouseFocusable() const;
+    virtual bool canSelectAll() const;
+    virtual void selectAll();
+
+    virtual void recalcStyle(StyleChange);
+
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+    
+    virtual bool canStartSelection() const { return false; }
+
+    virtual bool isEnumeratable() const { return true; }
+
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
+    virtual bool appendFormData(FormDataList&, bool);
+
+    virtual int optionToListIndex(int optionIndex) const;
+    virtual int listToOptionIndex(int listIndex) const;
+
+    virtual void reset();
+
+    virtual void defaultEventHandler(Event*);
+
+    virtual void setActiveSelectionAnchorIndex(int index);
+    virtual void setActiveSelectionEndIndex(int index);
+    virtual void updateListBoxSelection(bool deselectOtherOptions);
+    virtual void listBoxOnChange();
+    virtual void menuListOnChange();
+    
+    virtual int activeSelectionStartListIndex() const;
+    virtual int activeSelectionEndListIndex() const;
+    
     void recalcListItems(bool updateSelectedStates = true) const;
-    void checkListItems() const;
 
     void deselectItems(HTMLOptionElement* excludeElement = 0);
-    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
-    int nextSelectableListIndex(int startIndex);
-    int previousSelectableListIndex(int startIndex);
-    void menuListDefaultEventHandler(Event*);
-    void listBoxDefaultEventHandler(Event*);
     void typeAheadFind(KeyboardEvent*);
     void saveLastSelection();
 
-    mutable Vector<HTMLElement*> m_listItems;
-    Vector<bool> m_cachedStateForActiveSelection;
-    Vector<bool> m_lastOnChangeSelection;
-    int m_minwidth;
-    int m_size;
-    bool m_multiple;
-    mutable bool m_recalcListItems;
-    mutable int m_lastOnChangeIndex;
-
-    int m_activeSelectionAnchorIndex;
-    int m_activeSelectionEndIndex;
-    bool m_activeSelectionState;
-
-    // Instance variables for type-ahead find
-    UChar m_repeatingChar;
-    DOMTimeStamp m_lastCharTime;
-    String m_typedString;
-
-    HTMLCollection::CollectionInfo m_collectionInfo;
-};
-
-#ifdef NDEBUG
-
-inline void HTMLSelectElement::checkListItems() const
-{
-}
+    virtual void insertedIntoTree(bool);
 
-#endif
+    SelectElementData m_data;
+    CollectionCache m_collectionInfo;
+};
 
 } // namespace
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
index d3e85a8376..fb08bb1954 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
@@ -33,7 +33,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString       value;
         
         // Modified in DOM Level 2:
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute long            length;
 #else
                  attribute unsigned long   length
@@ -56,7 +56,7 @@ module html {
                                in HTMLElement before)
             raises(DOMException);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // In JS, we support both options index and options object parameters - this cannot be autogenerated now.
         [Custom] void      remove(/* 1 */);
 #else
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp
index c8f814f2c9..2f09997b9c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLSourceElement.h"
 
+#include "EventNames.h"
 #include "HTMLDocument.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
@@ -40,6 +41,7 @@ using namespace HTMLNames;
 
 HTMLSourceElement::HTMLSourceElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
+    , m_errorEventTimer(this, &HTMLSourceElement::errorEventTimerFired)
 {
     ASSERT(hasTagName(sourceTag));
 }
@@ -53,7 +55,7 @@ void HTMLSourceElement::insertedIntoDocument()
     HTMLElement::insertedIntoDocument();
     if (parentNode() && (parentNode()->hasTagName(audioTag) ||  parentNode()->hasTagName(videoTag))) {
         HTMLMediaElement* media = static_cast<HTMLMediaElement*>(parentNode());
-        if (media->networkState() == HTMLMediaElement::EMPTY)
+        if (media->networkState() == HTMLMediaElement::NETWORK_EMPTY)
             media->scheduleLoad();
     }
 }
@@ -88,5 +90,23 @@ void HTMLSourceElement::setType(const String& type)
     setAttribute(typeAttr, type);
 }
 
+void HTMLSourceElement::scheduleErrorEvent()
+{
+    if (m_errorEventTimer.isActive())
+        return;
+
+    m_errorEventTimer.startOneShot(0);
+}
+
+void HTMLSourceElement::cancelPendingErrorEvent()
+{
+    m_errorEventTimer.stop();
+}
+
+void HTMLSourceElement::errorEventTimerFired(Timer<HTMLSourceElement>*)
+{
+    dispatchEvent(eventNames().errorEvent, false, true);
+}
+
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h
index 9027b88612..50d6687044 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h
@@ -29,6 +29,7 @@
 #if ENABLE(VIDEO)
 
 #include "HTMLElement.h"
+#include "Timer.h"
 #include <limits>
 
 namespace WebCore {
@@ -51,6 +52,14 @@ public:
     void setSrc(const String&);    
     void setMedia(const String&);
     void setType(const String&);
+    
+    void scheduleErrorEvent();
+    void cancelPendingErrorEvent();
+
+private:
+    void errorEventTimerFired(Timer<HTMLSourceElement>*);
+
+    Timer<HTMLSourceElement> m_errorEventTimer;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
index bed1cdc9ad..f6b592466e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
@@ -20,11 +20,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLStyleElement.h"
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
index e6238b7997..a1b86f8edf 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
@@ -29,7 +29,7 @@ module html {
         attribute  [ConvertNullToNullString] DOMString            media;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet sheet;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp
index 35cf8a1cd2..2c947277ef 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp
@@ -21,11 +21,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableCaptionElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
index 01af2ad066..878549d525 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
@@ -23,6 +23,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableCellElement.h"
 
@@ -30,6 +31,7 @@
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "HTMLTableElement.h"
+#include "MappedAttribute.h"
 #include "RenderTableCell.h"
 
 using std::max;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
index 11f6df6018..ae18ab1a03 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
@@ -23,13 +23,15 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableColElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
-#include "RenderTableCol.h"
 #include "HTMLTableElement.h"
+#include "MappedAttribute.h"
+#include "RenderTableCol.h"
 #include "Text.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp
index bb2c2ee9f7..e37c171f8d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp
@@ -31,9 +31,10 @@
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLTableCaptionElement.h"
-#include "HTMLTableRowsCollection.h"
 #include "HTMLTableRowElement.h"
+#include "HTMLTableRowsCollection.h"
 #include "HTMLTableSectionElement.h"
+#include "MappedAttribute.h"
 #include "RenderTable.h"
 #include "Text.h"
 
@@ -310,7 +311,7 @@ static bool setTableCellsChanged(Node* n)
     }
 
     if (cellChanged)
-       n->setChanged();
+       n->setNeedsStyleRecalc();
 
     return cellChanged;
 }
@@ -455,7 +456,7 @@ void HTMLTableElement::parseMappedAttribute(MappedAttribute* attr)
         for (Node* child = firstChild(); child; child = child->nextSibling())
             cellChanged |= setTableCellsChanged(child);
         if (cellChanged)
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
@@ -655,7 +656,7 @@ PassRefPtr<HTMLCollection> HTMLTableElement::rows()
 
 PassRefPtr<HTMLCollection> HTMLTableElement::tBodies()
 {
-    return HTMLCollection::create(this, HTMLCollection::TableTBodies);
+    return HTMLCollection::create(this, TableTBodies);
 }
 
 String HTMLTableElement::align() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
index 6341197acb..19babf6fc0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
@@ -23,6 +23,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTablePartElement.h"
 
@@ -31,6 +32,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp
index 98d928a251..94be02e2df 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp
@@ -168,7 +168,7 @@ void HTMLTableRowElement::deleteCell(int index, ExceptionCode& ec)
 
 PassRefPtr<HTMLCollection> HTMLTableRowElement::cells()
 {
-    return HTMLCollection::create(this, HTMLCollection::TRCells);
+    return HTMLCollection::create(this, TRCells);
 }
 
 void HTMLTableRowElement::setCells(HTMLCollection *, ExceptionCode& ec)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp
index 7047576491..b38c271904 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp
@@ -149,7 +149,7 @@ HTMLTableRowElement* HTMLTableRowsCollection::lastRow(HTMLTableElement* table)
 }
 
 HTMLTableRowsCollection::HTMLTableRowsCollection(PassRefPtr<HTMLTableElement> table)
-    : HTMLCollection(table, Other, 0)
+    : HTMLCollection(table, OtherCollection, 0)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp
index 900976c57c..e91a96a3e9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp
@@ -167,7 +167,7 @@ void HTMLTableSectionElement::setVAlign(const String &value)
 
 PassRefPtr<HTMLCollection> HTMLTableSectionElement::rows()
 {
-    return HTMLCollection::create(this, HTMLCollection::TSectionRows);
+    return HTMLCollection::create(this, TSectionRows);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
index d4797b459a..14119ef5c7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
@@ -8,7 +8,7 @@ acronym interfaceName=HTMLElement
 address interfaceName=HTMLElement
 applet
 area
-audio wrapperOnlyIfMediaIsAvailable=1,conditional=VIDEO
+audio wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 b interfaceName=HTMLElement
 base
 basefont interfaceName=HTMLBaseFontElement
@@ -17,7 +17,7 @@ big interfaceName=HTMLElement
 blockquote
 body
 br interfaceName=HTMLBRElement
-button
+button constructorNeedsFormElement
 canvas
 caption interfaceName=HTMLTableCaptionElement
 center interfaceName=HTMLElement
@@ -34,10 +34,10 @@ dl interfaceName=HTMLDListElement
 dt interfaceName=HTMLElement
 em interfaceName=HTMLElement
 embed
-fieldset interfaceName=HTMLFieldSetElement
+fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement
 font
 form
-frame constructorNeedsCreatedByParser=1
+frame
 frameset interfaceName=HTMLFrameSetElement
 head
 h1 interfaceName=HTMLHeadingElement
@@ -49,19 +49,19 @@ h6 interfaceName=HTMLHeadingElement
 hr interfaceName=HTMLHRElement
 html
 i interfaceName=HTMLElement
-iframe interfaceName=HTMLIFrameElement, constructorNeedsCreatedByParser=1
-image
-img interfaceName=HTMLImageElement
-input
+iframe interfaceName=HTMLIFrameElement
+image mapToTagName=img
+img interfaceName=HTMLImageElement, constructorNeedsFormElement
+input constructorNeedsFormElement
 ins interfaceName=HTMLModElement
-isindex interfaceName=HTMLIsIndexElement
+isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement
 kbd interfaceName=HTMLElement
-keygen JSInterfaceName=HTMLSelectElement
+keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement
 label
 layer interfaceName=HTMLElement
-legend
+legend constructorNeedsFormElement
 li interfaceName=HTMLLIElement
-link constructorNeedsCreatedByParser=1
+link constructorNeedsCreatedByParser
 listing interfaceName=HTMLPreElement
 map
 marquee
@@ -71,11 +71,15 @@ nobr interfaceName=HTMLElement
 noembed interfaceName=HTMLElement
 noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
+#if ENABLE_XHTMLMP
+noscript interfaceName=HTMLNoScriptElement
+#else
 noscript interfaceName=HTMLElement
-object
+#endif
+object constructorNeedsCreatedByParser
 ol interfaceName=HTMLOListElement
-optgroup interfaceName=HTMLOptGroupElement
-option
+optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
+option constructorNeedsFormElement
 p interfaceName=HTMLParagraphElement
 param
 plaintext interfaceName=HTMLElement
@@ -83,20 +87,20 @@ pre
 q interfaceName=HTMLQuoteElement
 s interfaceName=HTMLElement
 samp interfaceName=HTMLElement
-script constructorNeedsCreatedByParser=1
-select
+script constructorNeedsCreatedByParser
+select constructorNeedsFormElement
 small interfaceName=HTMLElement
-source wrapperOnlyIfMediaIsAvailable=1,conditional=VIDEO
+source wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 span interfaceName=HTMLElement
 strike interfaceName=HTMLElement
 strong interfaceName=HTMLElement
-style constructorNeedsCreatedByParser=1
+style constructorNeedsCreatedByParser
 sub interfaceName=HTMLElement
 sup interfaceName=HTMLElement
 table
 tbody interfaceName=HTMLTableSectionElement
 td interfaceName=HTMLTableCellElement
-textarea interfaceName=HTMLTextAreaElement
+textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement
 tfoot interfaceName=HTMLTableSectionElement
 th interfaceName=HTMLTableCellElement
 thead interfaceName=HTMLTableSectionElement
@@ -106,6 +110,6 @@ tt interfaceName=HTMLElement
 u interfaceName=HTMLElement
 ul interfaceName=HTMLUListElement
 var interfaceName=HTMLElement
-video wrapperOnlyIfMediaIsAvailable=1,conditional=VIDEO
+video wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 wbr interfaceName=HTMLElement
 xmp interfaceName=HTMLPreElement
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
index 2d4d7a950b..e19ac0af89 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
@@ -34,11 +34,13 @@
 #include "FormDataList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderStyle.h"
 #include "RenderTextControlMultiLine.h"
-#include "Selection.h"
+#include "ScriptEventListener.h"
 #include "Text.h"
+#include "VisibleSelection.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -65,23 +67,23 @@ HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document*
     , m_cachedSelectionEnd(-1)
 {
     ASSERT(hasTagName(textareaTag));
-    setValueMatchesRenderer();
+    setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
 }
 
-const AtomicString& HTMLTextAreaElement::type() const
+const AtomicString& HTMLTextAreaElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, textarea, ("textarea"));
     return textarea;
 }
 
-bool HTMLTextAreaElement::saveState(String& result) const
+bool HTMLTextAreaElement::saveFormControlState(String& result) const
 {
     result = value();
     return true;
 }
 
-void HTMLTextAreaElement::restoreState(const String& state)
+void HTMLTextAreaElement::restoreFormControlState(const String& state)
 {
     setDefaultValue(state);
 }
@@ -92,7 +94,7 @@ int HTMLTextAreaElement::selectionStart()
         return 0;
     if (document()->focusedNode() != this && m_cachedSelectionStart >= 0)
         return m_cachedSelectionStart;
-    return static_cast<RenderTextControl*>(renderer())->selectionStart();
+    return toRenderTextControl(renderer())->selectionStart();
 }
 
 int HTMLTextAreaElement::selectionEnd()
@@ -101,35 +103,35 @@ int HTMLTextAreaElement::selectionEnd()
         return 0;
     if (document()->focusedNode() != this && m_cachedSelectionEnd >= 0)
         return m_cachedSelectionEnd;
-    return static_cast<RenderTextControl*>(renderer())->selectionEnd();
+    return toRenderTextControl(renderer())->selectionEnd();
 }
 
 void HTMLTextAreaElement::setSelectionStart(int start)
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionStart(start);
+    toRenderTextControl(renderer())->setSelectionStart(start);
 }
 
 void HTMLTextAreaElement::setSelectionEnd(int end)
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionEnd(end);
+    toRenderTextControl(renderer())->setSelectionEnd(end);
 }
 
 void HTMLTextAreaElement::select()
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->select();
+    toRenderTextControl(renderer())->select();
 }
 
 void HTMLTextAreaElement::setSelectionRange(int start, int end)
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionRange(start, end);
+    toRenderTextControl(renderer())->setSelectionRange(start, end);
 }
 
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -179,13 +181,13 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
     } else if (attr->name() == onfocusAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onblurAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onselectAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectEvent, attr);
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onchangeAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -202,7 +204,7 @@ bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
 
     // FIXME: It's not acceptable to ignore the HardWrap setting when there is no renderer.
     // While we have no evidence this has ever been a practical problem, it would be best to fix it some day.
-    RenderTextControl* control = static_cast<RenderTextControl*>(renderer());
+    RenderTextControl* control = toRenderTextControl(renderer());
     const String& text = (m_wrap == HardWrap && control) ? control->textWithHardLineBreaks() : value();
     encoding.appendData(name(), text);
     return true;
@@ -229,10 +231,17 @@ void HTMLTextAreaElement::updateFocusAppearance(bool restorePreviousSelection)
     ASSERT(renderer());
     
     if (!restorePreviousSelection || m_cachedSelectionStart < 0) {
+#if ENABLE(ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL)
+        // Devices with trackballs or d-pads may focus on a textarea in route
+        // to another focusable node. By selecting all text, the next movement
+        // can more readily be interpreted as moving to the next node.
+        select();
+#else
         // If this is the first focus, set a caret at the beginning of the text.  
         // This matches some browsers' behavior; see bug 11746 Comment #15.
         // http://bugs.webkit.org/show_bug.cgi?id=11746#c15
         setSelectionRange(0, 0);
+#endif
     } else {
         // Restore the cached selection.  This matches other browsers' behavior.
         setSelectionRange(m_cachedSelectionStart, m_cachedSelectionEnd);
@@ -257,12 +266,12 @@ void HTMLTextAreaElement::rendererWillBeDestroyed()
 
 void HTMLTextAreaElement::updateValue() const
 {
-    if (valueMatchesRenderer())
+    if (formControlValueMatchesRenderer())
         return;
 
     ASSERT(renderer());
-    m_value = static_cast<RenderTextControl*>(renderer())->text();
-    const_cast<HTMLTextAreaElement*>(this)->setValueMatchesRenderer();
+    m_value = toRenderTextControl(renderer())->text();
+    const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
 }
 
@@ -286,9 +295,9 @@ void HTMLTextAreaElement::setValue(const String& value)
         return;
 
     m_value = normalizedValue;
-    setValueMatchesRenderer();
+    setFormControlValueMatchesRenderer(true);
     if (inDocument())
-        document()->updateRendering();
+        document()->updateStyleIfNeeded();
     if (renderer())
         renderer()->updateFromElement();
 
@@ -298,7 +307,7 @@ void HTMLTextAreaElement::setValue(const String& value)
         setSelectionRange(endOfString, endOfString);
     }
 
-    setChanged();
+    setNeedsStyleRecalc();
     notifyFormStateChanged(this);
 }
 
@@ -374,11 +383,11 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
-Selection HTMLTextAreaElement::selection() const
+VisibleSelection HTMLTextAreaElement::selection() const
 {
     if (!renderer() || m_cachedSelectionStart < 0 || m_cachedSelectionEnd < 0)
-        return Selection();
-    return static_cast<RenderTextControl*>(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
+        return VisibleSelection();
+    return toRenderTextControl(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
 }
 
 bool HTMLTextAreaElement::shouldUseInputMethod() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
index f02ad65d68..e22b5d5241 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
@@ -28,7 +28,7 @@
 
 namespace WebCore {
 
-class Selection;
+class VisibleSelection;
 
 class HTMLTextAreaElement : public HTMLFormControlElementWithState {
 public:
@@ -43,14 +43,14 @@ public:
 
     virtual bool isEnumeratable() const { return true; }
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
 
-    bool readOnly() const { return isReadOnlyControl(); }
+    bool readOnly() const { return isReadOnlyFormControl(); }
 
-    virtual bool isTextControl() const { return true; }
+    virtual bool isTextFormControl() const { return true; }
 
     int selectionStart();
     int selectionEnd();
@@ -87,7 +87,7 @@ public:
     void setRows(int);
     
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
-    Selection selection() const;
+    VisibleSelection selection() const;
 
     virtual bool shouldUseInputMethod() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index 6de9951221..341eecc282 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -5,8 +5,9 @@
               (C) 1999 Lars Knoll (knoll@kde.org)
               (C) 1999 Antti Koivisto (koivisto@kde.org)
               (C) 2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
     Copyright (C) 2005, 2006 Alexey Proskuryakov (ap@nypop.com)
+    Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -41,13 +42,14 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "PreloadScanner.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
-#include "SystemTime.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/CurrentTime.h>
 
 #include "HTMLEntityNames.c"
 
@@ -133,14 +135,14 @@ static inline bool tagMatch(const char* s1, const UChar* s2, unsigned length)
     return true;
 }
 
-inline void Token::addAttribute(Document* doc, AtomicString& attrName, const AtomicString& attributeValue, bool viewSourceMode)
+inline void Token::addAttribute(AtomicString& attrName, const AtomicString& attributeValue, bool viewSourceMode)
 {
     if (!attrName.isEmpty()) {
         ASSERT(!attrName.contains('/'));
         RefPtr<MappedAttribute> a = MappedAttribute::create(attrName, attributeValue);
         if (!attrs) {
             attrs = NamedMappedAttrMap::create();
-            attrs->reserveCapacity(10);
+            attrs->reserveInitialCapacity(10);
         }
         attrs->insertAttribute(a.release(), viewSourceMode);
     }
@@ -445,16 +447,11 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
             m_scriptTagSrcAttrValue = String();
         } else {
             // Parse m_scriptCode containing <script> info
-#if USE(LOW_BANDWIDTH_DISPLAY)
-            if (m_doc->inLowBandwidthDisplay()) {
-                // ideal solution is only skipping internal JavaScript if there is external JavaScript.
-                // but internal JavaScript can use document.write() to create an external JavaScript,
-                // so we have to skip internal JavaScript all the time.
-                m_doc->frame()->loader()->needToSwitchOutLowBandwidthDisplay();
-                doScriptExec = false;
-            } else
-#endif
             doScriptExec = m_scriptNode->shouldExecuteAsJavaScript();
+#if ENABLE(XHTMLMP)
+            if (!doScriptExec)
+                m_doc->setShouldProcessNoscriptElement(true);
+#endif
             m_scriptNode = 0;
         }
     }
@@ -1309,7 +1306,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                             m_currentToken.addViewSourceChar(curchar);
                         src.advancePastNonNewline();
                     } else {
-                        m_currentToken.addAttribute(m_doc, m_attrName, emptyAtom, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, emptyAtom, inViewSourceMode());
                         m_dest = m_buffer;
                         state.setTagState(SearchAttribute);
                         lastIsSlash = false;
@@ -1363,7 +1360,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                         AtomicString attributeValue(m_buffer + 1, m_dest - m_buffer - 1);
                         if (!attributeValue.contains('/'))
                             m_attrName = attributeValue; // Just make the name/value match. (FIXME: Is this some WinIE quirk?)
-                        m_currentToken.addAttribute(m_doc, m_attrName, attributeValue, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, attributeValue, inViewSourceMode());
                         if (inViewSourceMode())
                             m_currentToken.addViewSourceChar('x');
                         state.setTagState(SearchAttribute);
@@ -1389,7 +1386,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                                 m_currentToken.addViewSourceChar('x');
                         } else if (inViewSourceMode())
                             m_currentToken.addViewSourceChar('v');
-                        m_currentToken.addAttribute(m_doc, m_attrName, attributeValue, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, attributeValue, inViewSourceMode());
                         m_dest = m_buffer;
                         state.setTagState(SearchAttribute);
                         tquote = NoQuote;
@@ -1419,7 +1416,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                     // '/' does not delimit in IE!
                     if (isASCIISpace(curchar) || curchar == '>') {
                         AtomicString attributeValue(m_buffer + 1, m_dest - m_buffer - 1);
-                        m_currentToken.addAttribute(m_doc, m_attrName, attributeValue, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, attributeValue, inViewSourceMode());
                         if (inViewSourceMode())
                             m_currentToken.addViewSourceChar('v');
                         m_dest = m_buffer;
@@ -1588,13 +1585,13 @@ inline bool HTMLTokenizer::continueProcessing(int& processedCount, double startT
     return true;
 }
 
-bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
+void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 {
     if (!m_buffer)
-        return false;
+        return;
     
     if (m_parserStopped)
-        return false;
+        return;
 
     SegmentedString source(str);
     if (m_executingScript)
@@ -1611,7 +1608,7 @@ bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
                 m_preloadScanner->write(source);
 #endif
         }
-        return false;
+        return;
     }
     
 #if PRELOAD_SCANNER_ENABLED
@@ -1626,7 +1623,7 @@ bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     // Once a timer is set, it has control of when the tokenizer continues.
     if (m_timer.isActive())
-        return false;
+        return;
 
     bool wasInWrite = m_inWrite;
     m_inWrite = true;
@@ -1764,11 +1761,8 @@ bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     m_state = state;
 
-    if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive()) {
+    if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive())
         end(); // this actually causes us to be deleted
-        return true;
-    }
-    return false;
 }
 
 void HTMLTokenizer::stopParsing()
@@ -1872,7 +1866,7 @@ PassRefPtr<Node> HTMLTokenizer::processToken()
     ScriptController* scriptController = (!m_fragment && m_doc->frame()) ? m_doc->frame()->script() : 0;
     if (scriptController && scriptController->isEnabled())
         // FIXME: Why isn't this m_currentScriptTagStartLineNumber?  I suspect this is wrong.
-        scriptController->setEventHandlerLineno(m_currentTagStartLineNumber + 1); // Script line numbers are 1 based.
+        scriptController->setEventHandlerLineNumber(m_currentTagStartLineNumber + 1); // Script line numbers are 1 based.
     if (m_dest > m_buffer) {
         m_currentToken.text = StringImpl::createStrippingNullCharacters(m_buffer, m_dest - m_buffer);
         if (m_currentToken.tagName != commentAtom)
@@ -1880,7 +1874,7 @@ PassRefPtr<Node> HTMLTokenizer::processToken()
     } else if (m_currentToken.tagName == nullAtom) {
         m_currentToken.reset();
         if (scriptController)
-            scriptController->setEventHandlerLineno(m_lineNumber + 1); // Script line numbers are 1 based.
+            scriptController->setEventHandlerLineNumber(m_lineNumber + 1); // Script line numbers are 1 based.
         return 0;
     }
 
@@ -1899,7 +1893,7 @@ PassRefPtr<Node> HTMLTokenizer::processToken()
     }
     m_currentToken.reset();
     if (scriptController)
-        scriptController->setEventHandlerLineno(0);
+        scriptController->setEventHandlerLineNumber(0);
 
     return n.release();
 }
@@ -1921,7 +1915,16 @@ HTMLTokenizer::~HTMLTokenizer()
 
 void HTMLTokenizer::enlargeBuffer(int len)
 {
-    int newSize = max(m_bufferSize * 2, m_bufferSize + len);
+    // Resize policy: Always at least double the size of the buffer each time.
+    int delta = max(len, m_bufferSize);
+
+    // Check for overflow.
+    // For now, handle overflow the same way we handle fastRealloc failure, with CRASH.
+    static const int maxSize = INT_MAX / sizeof(UChar);
+    if (delta > maxSize - m_bufferSize)
+        CRASH();
+
+    int newSize = m_bufferSize + delta;
     int oldOffset = m_dest - m_buffer;
     m_buffer = static_cast<UChar*>(fastRealloc(m_buffer, newSize * sizeof(UChar)));
     m_dest = m_buffer + oldOffset;
@@ -1930,7 +1933,16 @@ void HTMLTokenizer::enlargeBuffer(int len)
 
 void HTMLTokenizer::enlargeScriptBuffer(int len)
 {
-    int newSize = max(m_scriptCodeCapacity * 2, m_scriptCodeCapacity + len);
+    // Resize policy: Always at least double the size of the buffer each time.
+    int delta = max(len, m_scriptCodeCapacity);
+
+    // Check for overflow.
+    // For now, handle overflow the same way we handle fastRealloc failure, with CRASH.
+    static const int maxSize = INT_MAX / sizeof(UChar);
+    if (delta > maxSize - m_scriptCodeCapacity)
+        CRASH();
+
+    int newSize = m_scriptCodeCapacity + delta;
     m_scriptCode = static_cast<UChar*>(fastRealloc(m_scriptCode, newSize * sizeof(UChar)));
     m_scriptCodeCapacity = newSize;
 }
@@ -1980,11 +1992,15 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
 #endif
 
         if (errorOccurred)
-            EventTargetNodeCast(n.get())->dispatchEventForType(eventNames().errorEvent, true, false);
+            n->dispatchEvent(eventNames().errorEvent, true, false);
         else {
             if (static_cast<HTMLScriptElement*>(n.get())->shouldExecuteAsJavaScript())
                 m_state = scriptExecution(sourceCode, m_state);
-            EventTargetNodeCast(n.get())->dispatchEventForType(eventNames().loadEvent, false, false);
+#if ENABLE(XHTMLMP)
+            else
+                m_doc->setShouldProcessNoscriptElement(true);
+#endif
+            n->dispatchEvent(eventNames().loadEvent, false, false);
         }
 
         // The state of m_pendingScripts.isEmpty() can change inside the scriptExecution()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
index 8615791553..28969740d0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
@@ -3,7 +3,7 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1998 Waldo Bastian (bastian@kde.org)
               (C) 2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -63,7 +63,7 @@ struct Token {
     { }
     ~Token() { }
 
-    void addAttribute(Document*, AtomicString& attrName, const AtomicString& v, bool viewSourceMode);
+    void addAttribute(AtomicString& attrName, const AtomicString& v, bool viewSourceMode);
 
     bool isOpenTag(const QualifiedName& fullName) const { return beginTag && fullName.localName() == tagName; }
     bool isCloseTag(const QualifiedName& fullName) const { return !beginTag && fullName.localName() == tagName; }
@@ -138,7 +138,7 @@ public:
     HTMLTokenizer(DocumentFragment*);
     virtual ~HTMLTokenizer();
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     virtual void setForceSynchronous(bool force);
     virtual bool isWaitingForScripts() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp
index c1a7644718..f36cb572e8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp
@@ -18,11 +18,13 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLUListElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
index a67db712e4..d465b73d16 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
@@ -33,6 +33,7 @@
 #include "Document.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderVideo.h"
 
@@ -52,27 +53,30 @@ bool HTMLVideoElement::rendererIsNeeded(RenderStyle* style)
     return HTMLElement::rendererIsNeeded(style); 
 }
 
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 RenderObject* HTMLVideoElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     if (m_shouldShowPosterImage)
         return new (arena) RenderImage(this);
     return new (arena) RenderVideo(this);
 }
+#endif
 
 void HTMLVideoElement::attach()
 {
     HTMLMediaElement::attach();
-    
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     if (m_shouldShowPosterImage) {
         if (!m_imageLoader)
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
         if (renderer() && renderer()->isImage()) {
-            RenderImage* imageRenderer = static_cast<RenderImage*>(renderer());
+            RenderImage* imageRenderer = toRenderImage(renderer());
             imageRenderer->setCachedImage(m_imageLoader->image()); 
         }
     }
-
+#endif
 }
 
 void HTMLVideoElement::detach()
@@ -91,9 +95,14 @@ void HTMLVideoElement::parseMappedAttribute(MappedAttribute* attr)
     if (attrName == posterAttr) {
         updatePosterImage();
         if (m_shouldShowPosterImage) {
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
             if (!m_imageLoader)
                 m_imageLoader.set(new HTMLImageLoader(this));
             m_imageLoader->updateFromElementIgnoringPreviousError();
+#else
+            if (m_player)
+                m_player->setPoster(poster());
+#endif
         }
     } else if (attrName == widthAttr)
         addCSSLength(attr, CSSPropertyWidth, attr->value());
@@ -163,12 +172,18 @@ const QualifiedName& HTMLVideoElement::imageSourceAttributeName() const
 
 void HTMLVideoElement::updatePosterImage()
 {
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool oldShouldShowPosterImage = m_shouldShowPosterImage;
-    m_shouldShowPosterImage = !poster().isEmpty() && m_networkState < LOADED_FIRST_FRAME;
+#endif
+
+    m_shouldShowPosterImage = !poster().isEmpty() && readyState() < HAVE_CURRENT_DATA;
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     if (attached() && oldShouldShowPosterImage != m_shouldShowPosterImage) {
         detach();
         attach();
     }
+#endif
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
index 8779c85d1e..d35f3f8bec 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
@@ -42,11 +42,14 @@ public:
     
     virtual int tagPriority() const { return 5; }
     virtual bool rendererIsNeeded(RenderStyle*);
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+#endif
     virtual void attach();
     virtual void detach();
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
+    virtual bool hasVideo() const { return player() && player()->hasVideo(); }
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
index 752df5eff1..d4d6df744b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
@@ -26,18 +26,19 @@
 #include "HTMLViewSourceDocument.h"
 
 #include "DOMImplementation.h"
-#include "HTMLTokenizer.h"
-#include "HTMLHtmlElement.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLDivElement.h"
-#include "HTMLTableElement.h"
+#include "HTMLHtmlElement.h"
+#include "HTMLNames.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "HTMLTableRowElement.h"
 #include "HTMLTableSectionElement.h"
+#include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
 #include "Text.h"
 #include "TextDocument.h"
-#include "HTMLNames.h"
 
 namespace WebCore {
 
@@ -50,6 +51,7 @@ HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeT
     , m_tbody(0)
     , m_td(0)
 {
+    setUsesBeforeAfterRules(true);
 }
 
 Tokenizer* HTMLViewSourceDocument::createTokenizer()
@@ -72,7 +74,7 @@ void HTMLViewSourceDocument::createContainingTable()
     // document.
     RefPtr<Element> div = new HTMLDivElement(divTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"));
     div->setAttributeMap(attrs.release());
     body->addChild(div);
     div->attach();
@@ -149,6 +151,17 @@ void HTMLViewSourceDocument::addViewSourceToken(Token* token)
                                 m_current = static_cast<Element*>(m_current->parent());
                         } else {
                             const String& value = attr->value().string();
+
+                            // Compare ignoring case since HTMLTokenizer doesn't
+                            // lower names when passing in tokens to
+                            // HTMLViewSourceDocument.
+                            if (equalIgnoringCase(token->tagName, "base") && equalIgnoringCase(attr->name().localName(), "href")) {
+                                // Catch the href attribute in the base element.
+                                // It will be used for rendering anchors created
+                                // by addLink() below.
+                                setBaseElementURL(KURL(url(), value));
+                            }
+
                             // FIXME: XML could use namespace prefixes and confuse us.
                             if (equalIgnoringCase(attr->name().localName(), "src") || equalIgnoringCase(attr->name().localName(), "href"))
                                 m_current = addLink(value, equalIgnoringCase(token->tagName, "a"));
@@ -194,7 +207,7 @@ Element* HTMLViewSourceDocument::addSpanWithClassName(const String& className)
 
     Element* span = new HTMLElement(spanTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, className), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, className));
     span->setAttributeMap(attrs.release());
     m_current->addChild(span);
     span->attach();
@@ -211,7 +224,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     // Create a cell that will hold the line number (it is generated in the stylesheet using counters).
     Element* td = new HTMLTableCellElement(tdTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, "webkit-line-number"), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-number"));
     td->setAttributeMap(attrs.release());
     trow->addChild(td);
     td->attach();
@@ -219,7 +232,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     // Create a second cell for the line contents
     td = new HTMLTableCellElement(tdTag, this);
     attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, "webkit-line-content"), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-content"));
     td->setAttributeMap(attrs.release());
     trow->addChild(td);
     td->attach();
@@ -282,9 +295,9 @@ Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
         classValue = "webkit-html-attribute-value webkit-html-external-link";
     else
         classValue = "webkit-html-attribute-value webkit-html-resource-link";
-    attrs->insertAttribute(MappedAttribute::create(classAttr, classValue), true);
-    attrs->insertAttribute(MappedAttribute::create(targetAttr, "_blank"), true);
-    attrs->insertAttribute(MappedAttribute::create(hrefAttr, url), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, classValue));
+    attrs->addAttribute(MappedAttribute::create(targetAttr, "_blank"));
+    attrs->addAttribute(MappedAttribute::create(hrefAttr, url));
     anchor->setAttributeMap(attrs.release());
     m_current->addChild(anchor);
     anchor->attach();
diff --git a/src/3rdparty/webkit/WebCore/html/ImageData.cpp b/src/3rdparty/webkit/WebCore/html/ImageData.cpp
index f06228ff20..104ffb5530 100644
--- a/src/3rdparty/webkit/WebCore/html/ImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/html/ImageData.cpp
@@ -39,7 +39,7 @@ PassRefPtr<ImageData> ImageData::create(unsigned width, unsigned height)
 ImageData::ImageData(unsigned width, unsigned height)
     : m_width(width)
     , m_height(height)
-    , m_data(JSC::ByteArray::create(width * height * 4))
+    , m_data(CanvasPixelArray::create(width * height * 4))
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/ImageData.h b/src/3rdparty/webkit/WebCore/html/ImageData.h
index ad63e1956b..fe79f66dfb 100644
--- a/src/3rdparty/webkit/WebCore/html/ImageData.h
+++ b/src/3rdparty/webkit/WebCore/html/ImageData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,7 @@
 #ifndef ImageData_h
 #define ImageData_h
 
-#include <runtime/ByteArray.h>
+#include "CanvasPixelArray.h"
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
@@ -41,13 +41,13 @@ namespace WebCore {
 
         unsigned width() const { return m_width; }
         unsigned height() const { return m_height; }
-        JSC::ByteArray* data() const { return m_data.get(); }
+        CanvasPixelArray* data() const { return m_data.get(); }
 
     private:
         ImageData(unsigned width, unsigned height);
         unsigned m_width;
         unsigned m_height;
-        RefPtr<JSC::ByteArray> m_data;
+        RefPtr<CanvasPixelArray> m_data;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/ImageData.idl b/src/3rdparty/webkit/WebCore/html/ImageData.idl
index 69c92ad0bb..7f37b5219d 100644
--- a/src/3rdparty/webkit/WebCore/html/ImageData.idl
+++ b/src/3rdparty/webkit/WebCore/html/ImageData.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,9 @@ module html {
     ] ImageData {
         readonly attribute long width;
         readonly attribute long height;
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
+        readonly attribute CanvasPixelArray data;
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/MediaError.h b/src/3rdparty/webkit/WebCore/html/MediaError.h
index fbf375fb8e..5e77d9ed0d 100644
--- a/src/3rdparty/webkit/WebCore/html/MediaError.h
+++ b/src/3rdparty/webkit/WebCore/html/MediaError.h
@@ -34,7 +34,7 @@ namespace WebCore {
 
 class MediaError : public RefCounted<MediaError> {
 public:
-    enum Code { MEDIA_ERR_ABORTED = 1, MEDIA_ERR_NETWORK, MEDIA_ERR_DECODE };
+    enum Code { MEDIA_ERR_ABORTED = 1, MEDIA_ERR_NETWORK, MEDIA_ERR_DECODE, MEDIA_ERR_SRC_NOT_SUPPORTED };
 
     static PassRefPtr<MediaError> create(Code code) { return adoptRef(new MediaError(code)); }
 
diff --git a/src/3rdparty/webkit/WebCore/html/MediaError.idl b/src/3rdparty/webkit/WebCore/html/MediaError.idl
index 5b4f0a2a50..4dcea7d020 100644
--- a/src/3rdparty/webkit/WebCore/html/MediaError.idl
+++ b/src/3rdparty/webkit/WebCore/html/MediaError.idl
@@ -28,6 +28,7 @@ module html {
           const unsigned short MEDIA_ERR_ABORTED = 1;
           const unsigned short MEDIA_ERR_NETWORK = 2;
           const unsigned short MEDIA_ERR_DECODE = 3;
+          const unsigned short MEDIA_ERR_SRC_NOT_SUPPORTED = 4;
           readonly attribute unsigned short code;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp b/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp
index f029711847..1c1d28a1b5 100644
--- a/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp
+++ b/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,10 +41,11 @@
 #include "FrameLoader.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/unicode/Unicode.h>
 
-#if COMPILER(GCC)
+// Use __GNUC__ instead of PLATFORM(GCC) to stay consistent with the gperf generated c file
+#ifdef __GNUC__
 // The main tokenizer includes this too so we are getting two copies of the data. However, this way the code gets inlined.
 #include "HTMLEntityNames.c"
 #else
@@ -128,9 +130,13 @@ bool PreloadScanner::scanningBody() const
     
 void PreloadScanner::write(const SegmentedString& source)
 {
+#if PRELOAD_DEBUG
     double startTime = currentTime();
+#endif
     tokenize(source);
+#if PRELOAD_DEBUG
     m_timeUsed += currentTime() - startTime;
+#endif
 }
     
 static inline bool isWhitespace(UChar c)
@@ -220,8 +226,8 @@ unsigned PreloadScanner::consumeEntity(SegmentedString& source, bool& notEnoughC
             else if (cc >= 'A' && cc <= 'F')
                 result = 10 + cc - 'A';
             else {
-                source.push(seenChars[1]);
                 source.push('#');
+                source.push(seenChars[1]);
                 return 0;
             }
             entityState = Hex;
@@ -275,8 +281,8 @@ unsigned PreloadScanner::consumeEntity(SegmentedString& source, bool& notEnoughC
             if (seenChars.size() == 2)
                 source.push(seenChars[0]);
             else if (seenChars.size() == 3) {
-                source.push(seenChars[1]);
                 source.push(seenChars[0]);
+                source.push(seenChars[1]);
             } else
                 source.prepend(SegmentedString(String(seenChars.data(), seenChars.size() - 1)));
             return 0;
diff --git a/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp b/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp
index ad81ac8832..e5b070dec3 100644
--- a/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp
+++ b/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,17 @@ TimeRanges::TimeRanges(float start, float end)
     add(start, end);
 }
 
+PassRefPtr<TimeRanges> TimeRanges::copy()
+{
+    RefPtr<TimeRanges> newSession = TimeRanges::create();
+    
+    unsigned size = m_ranges.size();
+    for (unsigned i = 0; i < size; i++)
+        newSession->add(m_ranges[i].m_start, m_ranges[i].m_end);
+    
+    return newSession.release();
+}
+
 float TimeRanges::start(unsigned index, ExceptionCode& ec) const 
 { 
     if (index >= length()) {
@@ -53,9 +64,46 @@ float TimeRanges::end(unsigned index, ExceptionCode& ec) const
 }
 
 void TimeRanges::add(float start, float end) 
-{ 
-    m_ranges.append(Range(start, end));
-    // FIXME normalize
+{
+    ASSERT(start <= end);
+    unsigned int overlappingArcIndex;
+    Range addedRange(start, end);
+
+    // For each present range check if we need to:
+    // - merge with the added range, in case we are overlapping or contiguous
+    // - Need to insert in place, we we are completely, not overlapping and not contiguous
+    // in between two ranges.
+    //
+    // TODO: Given that we assume that ranges are correctly ordered, this could be optimized.
+
+    for (overlappingArcIndex = 0; overlappingArcIndex < m_ranges.size(); overlappingArcIndex++) {
+        if (addedRange.isOverlappingRange(m_ranges[overlappingArcIndex])
+         || addedRange.isContiguousWithRange(m_ranges[overlappingArcIndex])) {
+            // We need to merge the addedRange and that range.
+            addedRange = addedRange.unionWithOverlappingOrContiguousRange(m_ranges[overlappingArcIndex]);
+            m_ranges.remove(overlappingArcIndex);
+            overlappingArcIndex--;
+        } else {
+            // Check the case for which there is no more to do
+            if (!overlappingArcIndex) {
+                if (addedRange.isBeforeRange(m_ranges[0])) {
+                    // First index, and we are completely before that range (and not contiguous, nor overlapping).
+                    // We just need to be inserted here.
+                    break;
+                }
+            } else {
+                if (m_ranges[overlappingArcIndex - 1].isBeforeRange(addedRange)
+                 && addedRange.isBeforeRange(m_ranges[overlappingArcIndex])) {
+                    // We are exactly after the current previous range, and before the current range, while
+                    // not overlapping with none of them. Insert here.
+                    break;
+                }
+            }
+        }
+    }
+
+    // Now that we are sure we don't overlap with any range, just add it.
+    m_ranges.insert(overlappingArcIndex, addedRange);
 }
 
 bool TimeRanges::contain(float time) const
diff --git a/src/3rdparty/webkit/WebCore/html/TimeRanges.h b/src/3rdparty/webkit/WebCore/html/TimeRanges.h
index eb54f6b788..37820dcf3e 100644
--- a/src/3rdparty/webkit/WebCore/html/TimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/html/TimeRanges.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,8 @@
 #define TimeRanges_h
 
 #include "ExceptionCode.h"
+
+#include <algorithm>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -44,6 +46,8 @@ public:
         return adoptRef(new TimeRanges(start, end));
     }
 
+    PassRefPtr<TimeRanges> copy();
+
     unsigned length() const { return m_ranges.size(); }
     float start(unsigned index, ExceptionCode&) const;
     float end(unsigned index, ExceptionCode&) const;
@@ -55,7 +59,9 @@ public:
 private:
     TimeRanges() { }
     TimeRanges(float start, float end);
-    
+    TimeRanges(const TimeRanges&);
+
+    // We consider all the Ranges to be semi-bounded as follow: [start, end[
     struct Range {
         Range() { }
         Range(float start, float end) {
@@ -64,6 +70,36 @@ private:
         }
         float m_start;
         float m_end;
+
+        inline bool isPointInRange(float point) const
+        {
+            return m_start <= point && point < m_end;
+        }
+        
+        inline bool isOverlappingRange(const Range& range) const
+        {
+            return isPointInRange(range.m_start) || isPointInRange(range.m_end) || range.isPointInRange(m_start);
+        }
+
+        inline bool isContiguousWithRange(const Range& range) const
+        {
+            return range.m_start == m_end || range.m_end == m_start;
+        }
+        
+        inline Range unionWithOverlappingOrContiguousRange(const Range& range) const
+        {
+            Range ret;
+
+            ret.m_start = std::min(m_start, range.m_start);
+            ret.m_end = std::max(m_end, range.m_end);
+
+            return ret;
+        }
+
+        inline bool isBeforeRange(const Range& range) const
+        {
+            return range.m_start >= m_end;
+        }
     };
     
     Vector<Range> m_ranges;
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
new file mode 100644
index 0000000000..62a9ab75d7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ConsoleMessage.h"
+
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
+#include "ScriptCallStack.h"
+#include "ScriptObjectQuarantine.h"
+
+namespace WebCore {
+
+ConsoleMessage::ConsoleMessage(MessageSource s, MessageLevel l, const String& m, unsigned li, const String& u, unsigned g)
+    : m_source(s)
+    , m_level(l)
+    , m_message(m)
+    , m_line(li)
+    , m_url(u)
+    , m_groupLevel(g)
+    , m_repeatCount(1)
+{
+}
+
+ConsoleMessage::ConsoleMessage(MessageSource s, MessageLevel l, ScriptCallStack* callStack, unsigned g, bool storeTrace)
+    : m_source(s)
+    , m_level(l)
+    , m_wrappedArguments(callStack->at(0).argumentCount())
+    , m_frames(storeTrace ? callStack->size() : 0)
+    , m_groupLevel(g)
+    , m_repeatCount(1)
+{
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    m_line = lastCaller.lineNumber();
+    m_url = lastCaller.sourceURL().string();
+
+    // FIXME: For now, just store function names as strings.
+    // As ScriptCallStack start storing line number and source URL for all
+    // frames, refactor to use that, as well.
+    if (storeTrace) {
+        for (unsigned i = 0; i < callStack->size(); ++i)
+            m_frames[i] = callStack->at(i).functionName();
+    }
+
+    for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
+        m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+}
+
+void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
+{
+    JSONObject jsonObj = frontend->newJSONObject();
+    jsonObj.set("source", static_cast<int>(m_source));
+    jsonObj.set("level", static_cast<int>(m_level));
+    jsonObj.set("line", static_cast<int>(m_line));
+    jsonObj.set("url", m_url);
+    jsonObj.set("groupLevel", static_cast<int>(m_groupLevel));
+    jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
+    frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
+}
+
+bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
+{
+    if (msg->m_wrappedArguments.size() != m_wrappedArguments.size())
+        return false;
+    if (!state && msg->m_wrappedArguments.size())
+        return false;
+
+    ASSERT_ARG(state, state || msg->m_wrappedArguments.isEmpty());
+
+    for (size_t i = 0; i < msg->m_wrappedArguments.size(); ++i) {
+        if (!m_wrappedArguments[i].isEqual(state, msg->m_wrappedArguments[i]))
+            return false;
+    }
+
+    size_t frameCount = msg->m_frames.size();
+    if (frameCount != m_frames.size())
+        return false;
+
+    for (size_t i = 0; i < frameCount; ++i) {
+        if (m_frames[i] != msg->m_frames[i])
+            return false;
+    }
+
+    return msg->m_source == m_source
+        && msg->m_level == m_level
+        && msg->m_message == m_message
+        && msg->m_line == m_line
+        && msg->m_url == m_url
+        && msg->m_groupLevel == m_groupLevel;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
new file mode 100644
index 0000000000..15e6e7ebec
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ConsoleMessage_h
+#define ConsoleMessage_h
+
+#include "Console.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+    class InspectorFrontend;
+    class ScriptCallStack;
+    class ScriptString;
+
+    class ConsoleMessage {
+    public:
+        ConsoleMessage(MessageSource, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
+        ConsoleMessage(MessageSource, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
+
+        void addToConsole(InspectorFrontend* frontend);
+        void incrementCount() { ++m_repeatCount; };
+        bool isEqual(ScriptState*, ConsoleMessage* msg) const;
+
+    private:
+        MessageSource m_source;
+        MessageLevel m_level;
+        String m_message;
+        Vector<ScriptValue> m_wrappedArguments;
+        Vector<ScriptString> m_frames;
+        unsigned m_line;
+        String m_url;
+        unsigned m_groupLevel;
+        unsigned m_repeatCount;
+    };
+
+} // namespace WebCore
+
+#endif // ConsoleMessage_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
index fcbf79d74b..25085367f1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
@@ -44,6 +44,8 @@ public:
 
     virtual String localizedStringsURL() = 0;
 
+    virtual String hiddenPanels() = 0;
+
     virtual void showWindow() = 0;
     virtual void closeWindow() = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index 9d429641f8..170c4e3748 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -33,478 +33,74 @@
 #include "CString.h"
 #include "CachedResource.h"
 #include "Console.h"
-#include "DOMWindow.h"
-#include "DocLoader.h"
+#include "ConsoleMessage.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
 #include "FloatConversion.h"
+#include "FloatQuad.h"
 #include "FloatRect.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
-#include "HitTestResult.h"
 #include "HTMLFrameOwnerElement.h"
+#include "HitTestResult.h"
 #include "InspectorClient.h"
-#include "JSDOMWindow.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSInspectorCallbackWrapper.h"
-#include "JSNode.h"
-#include "JSRange.h"
+#include "InspectorFrontend.h"
+#include "InspectorDatabaseResource.h"
+#include "InspectorDOMStorageResource.h"
+#include "InspectorResource.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
 #include "Range.h"
+#include "RenderInline.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
-#include "Settings.h"
 #include "ScriptCallStack.h"
+#include "ScriptObject.h"
+#include "ScriptString.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
 #include "SharedBuffer.h"
-#include "SystemTime.h"
 #include "TextEncoding.h"
 #include "TextIterator.h"
-#include "ScriptController.h"
-#include <JavaScriptCore/APICast.h>
-#include <JavaScriptCore/JSRetainPtr.h>
-#include <JavaScriptCore/JSStringRef.h>
-#include <JavaScriptCore/OpaqueJSString.h>
-#include <runtime/JSLock.h>
-#include <runtime/UString.h>
-#include <runtime/CollectorHeapIterator.h>
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/RefCounted.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DATABASE)
 #include "Database.h"
-#include "JSDatabase.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#include "StorageArea.h"
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
 #include "JavaScriptDebugServer.h"
 #include "JSJavaScriptCallFrame.h"
-#endif
+
+#include <profiler/Profile.h>
+#include <profiler/Profiler.h>
+#include <runtime/JSLock.h>
+#include <runtime/UString.h>
 
 using namespace JSC;
+#endif
 using namespace std;
 
 namespace WebCore {
 
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
+static const char* const resourceTrackingEnabledSettingName = "resourceTrackingEnabled";
+static const char* const debuggerEnabledSettingName = "debuggerEnabled";
+static const char* const profilerEnabledSettingName = "profilerEnabled";
 
-static JSRetainPtr<JSStringRef> jsStringRef(const char* str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithUTF8CString(str));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const SourceCode& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithCharacters(str.data(), str.length()));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const String& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithCharacters(str.characters(), str.length()));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const UString& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(str).releaseRef());
-}
-
-static String toString(JSContextRef context, JSValueRef value, JSValueRef* exception)
-{
-    ASSERT_ARG(value, value);
-    if (!value)
-        return String();
-    JSRetainPtr<JSStringRef> scriptString(Adopt, JSValueToStringCopy(context, value, exception));
-    if (exception && *exception)
-        return String();
-    return String(JSStringGetCharactersPtr(scriptString.get()), JSStringGetLength(scriptString.get()));
-}
-
-#define HANDLE_EXCEPTION(context, exception) handleException((context), (exception), __LINE__)
-
-JSValueRef InspectorController::callSimpleFunction(JSContextRef context, JSObjectRef thisObject, const char* functionName) const
-{
-    JSValueRef exception = 0;
-    return callFunction(context, thisObject, functionName, 0, 0, exception);
-}
-
-JSValueRef InspectorController::callFunction(JSContextRef context, JSObjectRef thisObject, const char* functionName, size_t argumentCount, const JSValueRef arguments[], JSValueRef& exception) const
-{
-    ASSERT_ARG(context, context);
-    ASSERT_ARG(thisObject, thisObject);
-
-    if (exception)
-        return JSValueMakeUndefined(context);
-
-    JSValueRef functionProperty = JSObjectGetProperty(context, thisObject, jsStringRef(functionName).get(), &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    JSObjectRef function = JSValueToObject(context, functionProperty, &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    JSValueRef result = JSObjectCallAsFunction(context, function, thisObject, argumentCount, arguments, &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    return result;
-}
-
-// ConsoleMessage Struct
-
-struct ConsoleMessage {
-    ConsoleMessage(MessageSource s, MessageLevel l, const String& m, unsigned li, const String& u, unsigned g)
-        : source(s)
-        , level(l)
-        , message(m)
-        , line(li)
-        , url(u)
-        , groupLevel(g)
-        , repeatCount(1)
-    {
-    }
-
-    ConsoleMessage(MessageSource s, MessageLevel l, ScriptCallStack* callStack, unsigned g, bool storeTrace = false)
-        : source(s)
-        , level(l)
-        , wrappedArguments(callStack->at(0).argumentCount())
-        , frames(storeTrace ? callStack->size() : 0)
-        , groupLevel(g)
-        , repeatCount(1)
-    {
-        const ScriptCallFrame& lastCaller = callStack->at(0);
-        line = lastCaller.lineNumber();
-        url = lastCaller.sourceURL().string();
-
-        // FIXME: For now, just store function names as strings.
-        // As ScriptCallStack start storing line number and source URL for all
-        // frames, refactor to use that, as well.
-        if (storeTrace) {
-            unsigned stackSize = callStack->size();
-            for (unsigned i = 0; i < stackSize; ++i)
-                frames[i] = callStack->at(i).functionName();
-        }
-
-        JSLock lock(false);
-
-        for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
-            wrappedArguments[i] = JSInspectedObjectWrapper::wrap(callStack->state(), lastCaller.argumentAt(i).jsValue());
-    }
-    
-    bool isEqual(ExecState* exec, ConsoleMessage* msg) const
-    {
-        if (msg->wrappedArguments.size() != this->wrappedArguments.size() ||
-           (!exec && msg->wrappedArguments.size()))
-            return false;
-
-        for (size_t i = 0; i < msg->wrappedArguments.size(); ++i) {
-            ASSERT_ARG(exec, exec);
-            if (!JSValueIsEqual(toRef(exec), toRef(msg->wrappedArguments[i].get()), toRef(this->wrappedArguments[i].get()), 0))
-                return false;
-        }
-
-        size_t frameCount = msg->frames.size();
-        if (frameCount != this->frames.size())
-            return false;
-        
-        for (size_t i = 0; i < frameCount; ++i) {
-            const ScriptString& myFrameFunctionName = this->frames[i];
-            if (myFrameFunctionName != msg->frames[i])
-                return false;
-        }
-    
-        return msg->source == this->source
-            && msg->level == this->level
-            && msg->message == this->message
-            && msg->line == this->line
-            && msg->url == this->url
-            && msg->groupLevel == this->groupLevel;
-    }
-
-    MessageSource source;
-    MessageLevel level;
-    String message;
-    Vector<ProtectedJSValuePtr> wrappedArguments;
-    Vector<ScriptString> frames;
-    unsigned line;
-    String url;
-    unsigned groupLevel;
-    unsigned repeatCount;
-};
-
-// XMLHttpRequestResource Class
-
-struct XMLHttpRequestResource {
-    XMLHttpRequestResource(const JSC::UString& sourceString)
-    {
-        JSC::JSLock lock(false);
-        this->sourceString = sourceString.rep();
-    }
-
-    ~XMLHttpRequestResource()
-    {
-        JSC::JSLock lock(false);
-        sourceString.clear();
-    }
-
-    RefPtr<JSC::UString::Rep> sourceString;
-};
-
-// InspectorResource Struct
-
-struct InspectorResource : public RefCounted<InspectorResource> {
-    // Keep these in sync with WebInspector.Resource.Type
-    enum Type {
-        Doc,
-        Stylesheet,
-        Image,
-        Font,
-        Script,
-        XHR,
-        Media,
-        Other
-    };
-
-    static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* documentLoader, Frame* frame)
-    {
-        return adoptRef(new InspectorResource(identifier, documentLoader, frame));
-    }
-    
-    ~InspectorResource()
-    {
-        setScriptObject(0, 0);
-    }
-
-    Type type() const
-    {
-        if (xmlHttpRequestResource)
-            return XHR;
-
-        if (requestURL == loader->requestURL())
-            return Doc;
-
-        if (loader->frameLoader() && requestURL == loader->frameLoader()->iconURL())
-            return Image;
-
-        CachedResource* cachedResource = frame->document()->docLoader()->cachedResource(requestURL.string());
-        if (!cachedResource)
-            return Other;
-
-        switch (cachedResource->type()) {
-            case CachedResource::ImageResource:
-                return Image;
-            case CachedResource::FontResource:
-                return Font;
-            case CachedResource::CSSStyleSheet:
-#if ENABLE(XSLT)
-            case CachedResource::XSLStyleSheet:
-#endif
-                return Stylesheet;
-            case CachedResource::Script:
-                return Script;
-            default:
-                return Other;
-        }
-    }
-
-    void setScriptObject(JSContextRef context, JSObjectRef newScriptObject)
-    {
-        if (scriptContext && scriptObject)
-            JSValueUnprotect(scriptContext, scriptObject);
-
-        scriptObject = newScriptObject;
-        scriptContext = context;
-
-        ASSERT((context && newScriptObject) || (!context && !newScriptObject));
-        if (context && newScriptObject)
-            JSValueProtect(context, newScriptObject);
-    }
-
-    void setXMLHttpRequestProperties(const JSC::UString& data)
-    {
-        xmlHttpRequestResource.set(new XMLHttpRequestResource(data));
-    }
-    
-    String sourceString() const
-     {
-         if (xmlHttpRequestResource)
-            return JSC::UString(xmlHttpRequestResource->sourceString);
-
-        RefPtr<SharedBuffer> buffer;
-        String textEncodingName;
-
-        if (requestURL == loader->requestURL()) {
-            buffer = loader->mainResourceData();
-            textEncodingName = frame->document()->inputEncoding();
-        } else {
-            CachedResource* cachedResource = frame->document()->docLoader()->cachedResource(requestURL.string());
-            if (!cachedResource)
-                return String();
-
-            if (cachedResource->isPurgeable()) {
-                // If the resource is purgeable then make it unpurgeable to get
-                // get its data. This might fail, in which case we return an
-                // empty String.
-                // FIXME: should we do something else in the case of a purged
-                // resource that informs the user why there is no data in the
-                // inspector?
-                if (!cachedResource->makePurgeable(false))
-                    return String();
-            }
-
-            buffer = cachedResource->data();
-            textEncodingName = cachedResource->encoding();
-        }
-
-        if (!buffer)
-            return String();
-
-        TextEncoding encoding(textEncodingName);
-        if (!encoding.isValid())
-            encoding = WindowsLatin1Encoding();
-        return encoding.decode(buffer->data(), buffer->size());
-     }
-
-    long long identifier;
-    RefPtr<DocumentLoader> loader;
-    RefPtr<Frame> frame;
-    OwnPtr<XMLHttpRequestResource> xmlHttpRequestResource;
-    KURL requestURL;
-    HTTPHeaderMap requestHeaderFields;
-    HTTPHeaderMap responseHeaderFields;
-    String mimeType;
-    String suggestedFilename;
-    JSContextRef scriptContext;
-    JSObjectRef scriptObject;
-    long long expectedContentLength;
-    bool cached;
-    bool finished;
-    bool failed;
-    int length;
-    int responseStatusCode;
-    double startTime;
-    double responseReceivedTime;
-    double endTime;
-
-protected:
-    InspectorResource(long long identifier, DocumentLoader* documentLoader, Frame* frame)
-        : identifier(identifier)
-        , loader(documentLoader)
-        , frame(frame)
-        , xmlHttpRequestResource(0)
-        , scriptContext(0)
-        , scriptObject(0)
-        , expectedContentLength(0)
-        , cached(false)
-        , finished(false)
-        , failed(false)
-        , length(0)
-        , responseStatusCode(0)
-        , startTime(-1.0)
-        , responseReceivedTime(-1.0)
-        , endTime(-1.0)
-    {
-    }
-};
-
-// InspectorDatabaseResource Struct
-
-#if ENABLE(DATABASE)
-struct InspectorDatabaseResource : public RefCounted<InspectorDatabaseResource> {
-    static PassRefPtr<InspectorDatabaseResource> create(Database* database, const String& domain, const String& name, const String& version)
-    {
-        return adoptRef(new InspectorDatabaseResource(database, domain, name, version));
-    }
-
-    void setScriptObject(JSContextRef context, JSObjectRef newScriptObject)
-    {
-        if (scriptContext && scriptObject)
-            JSValueUnprotect(scriptContext, scriptObject);
-
-        scriptObject = newScriptObject;
-        scriptContext = context;
-
-        ASSERT((context && newScriptObject) || (!context && !newScriptObject));
-        if (context && newScriptObject)
-            JSValueProtect(context, newScriptObject);
-    }
-
-    RefPtr<Database> database;
-    String domain;
-    String name;
-    String version;
-    JSContextRef scriptContext;
-    JSObjectRef scriptObject;
-    
-private:
-    InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
-        : database(database)
-        , domain(domain)
-        , name(name)
-        , version(version)
-        , scriptContext(0)
-        , scriptObject(0)
-    {
-    }
-};
-#endif
-
-// JavaScript Callbacks
-
-#define SIMPLE_INSPECTOR_CALLBACK(jsFunction, inspectorControllerMethod) \
-static JSValueRef jsFunction(JSContextRef ctx, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef*) \
-{ \
-    if (InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject))) \
-        controller->inspectorControllerMethod(); \
-    return JSValueMakeUndefined(ctx); \
-}
-
-SIMPLE_INSPECTOR_CALLBACK(hideDOMNodeHighlight, hideHighlight);
-SIMPLE_INSPECTOR_CALLBACK(loaded, scriptObjectReady);
-SIMPLE_INSPECTOR_CALLBACK(unloading, close);
-SIMPLE_INSPECTOR_CALLBACK(attach, attachWindow);
-SIMPLE_INSPECTOR_CALLBACK(detach, detachWindow);
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-SIMPLE_INSPECTOR_CALLBACK(enableDebugger, enableDebugger);
-SIMPLE_INSPECTOR_CALLBACK(disableDebugger, disableDebugger);
-SIMPLE_INSPECTOR_CALLBACK(pauseInDebugger, pauseInDebugger);
-SIMPLE_INSPECTOR_CALLBACK(resumeDebugger, resumeDebugger);
-SIMPLE_INSPECTOR_CALLBACK(stepOverStatementInDebugger, stepOverStatementInDebugger);
-SIMPLE_INSPECTOR_CALLBACK(stepIntoStatementInDebugger, stepIntoStatementInDebugger);
-SIMPLE_INSPECTOR_CALLBACK(stepOutOfFunctionInDebugger, stepOutOfFunctionInDebugger);
-#endif
-SIMPLE_INSPECTOR_CALLBACK(closeWindow, closeWindow);
-SIMPLE_INSPECTOR_CALLBACK(clearMessages, clearConsoleMessages);
-SIMPLE_INSPECTOR_CALLBACK(startProfiling, startUserInitiatedProfilingSoon);
-SIMPLE_INSPECTOR_CALLBACK(stopProfiling, stopUserInitiatedProfiling);
-SIMPLE_INSPECTOR_CALLBACK(enableProfiler, enableProfiler);
-SIMPLE_INSPECTOR_CALLBACK(disableProfiler, disableProfiler);
-SIMPLE_INSPECTOR_CALLBACK(toggleNodeSearch, toggleSearchForNodeInPage);
-
-#define BOOL_INSPECTOR_CALLBACK(jsFunction, inspectorControllerMethod) \
-static JSValueRef jsFunction(JSContextRef ctx, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef*) \
-{ \
-    if (InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject))) \
-        return JSValueMakeBoolean(ctx, controller->inspectorControllerMethod()); \
-    return JSValueMakeUndefined(ctx); \
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-BOOL_INSPECTOR_CALLBACK(debuggerEnabled, debuggerEnabled);
-BOOL_INSPECTOR_CALLBACK(pauseOnExceptions, pauseOnExceptions);
-#endif
-BOOL_INSPECTOR_CALLBACK(profilerEnabled, profilerEnabled);
-BOOL_INSPECTOR_CALLBACK(isWindowVisible, windowVisible);
-BOOL_INSPECTOR_CALLBACK(searchingForNode, searchingForNodeInPage);
-
-static bool addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
+bool InspectorController::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
 {
     ASSERT_ARG(frameNode, frameNode);
 
@@ -540,362 +136,7 @@ static bool addSourceToFrame(const String& mimeType, const String& source, Node*
     return true;
 }
 
-static JSValueRef addResourceSourceToFrame(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    JSValueRef undefined = JSValueMakeUndefined(ctx);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (argumentCount < 2 || !controller)
-        return undefined;
-
-    JSValueRef identifierValue = arguments[0];
-    if (!JSValueIsNumber(ctx, identifierValue))
-        return undefined;
-
-    long long identifier = static_cast<long long>(JSValueToNumber(ctx, identifierValue, exception));
-    if (exception && *exception)
-        return undefined;
-
-    RefPtr<InspectorResource> resource = controller->resources().get(identifier);
-    ASSERT(resource);
-    if (!resource)
-        return undefined;
-
-    String sourceString = resource->sourceString();
-    if (sourceString.isEmpty())
-        return undefined;
-
-    bool successfullyAddedSource = addSourceToFrame(resource->mimeType, sourceString, toNode(toJS(arguments[1])));
-    return JSValueMakeBoolean(ctx, successfullyAddedSource);
-}
-
-static JSValueRef addSourceToFrame(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    JSValueRef undefined = JSValueMakeUndefined(ctx);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (argumentCount < 3 || !controller)
-        return undefined;
-
-    JSValueRef mimeTypeValue = arguments[0];
-    if (!JSValueIsString(ctx, mimeTypeValue))
-        return undefined;
-
-    JSValueRef sourceValue = arguments[1];
-    if (!JSValueIsString(ctx, sourceValue))
-        return undefined;
-
-    String mimeType = toString(ctx, mimeTypeValue, exception);
-    if (mimeType.isEmpty())
-        return undefined;
-
-    String source = toString(ctx, sourceValue, exception);
-    if (source.isEmpty())
-        return undefined;
-
-    bool successfullyAddedSource = addSourceToFrame(mimeType, source, toNode(toJS(arguments[2])));
-    return JSValueMakeBoolean(ctx, successfullyAddedSource);
-}
-
-static JSValueRef getResourceDocumentNode(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    JSValueRef undefined = JSValueMakeUndefined(ctx);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!argumentCount || argumentCount > 1 || !controller)
-        return undefined;
-
-    JSValueRef identifierValue = arguments[0];
-    if (!JSValueIsNumber(ctx, identifierValue))
-        return undefined;
-
-    long long identifier = static_cast<long long>(JSValueToNumber(ctx, identifierValue, exception));
-    if (exception && *exception)
-        return undefined;
-
-    RefPtr<InspectorResource> resource = controller->resources().get(identifier);
-    ASSERT(resource);
-    if (!resource)
-        return undefined;
-
-    Frame* frame = resource->frame.get();
-
-    Document* document = frame->document();
-    if (!document)
-        return undefined;
-
-    if (document->isPluginDocument() || document->isImageDocument() || document->isMediaDocument())
-        return undefined;
-
-    ExecState* exec = toJSDOMWindowShell(resource->frame.get())->window()->globalExec();
-
-    JSC::JSLock lock(false);
-    JSValueRef documentValue = toRef(JSInspectedObjectWrapper::wrap(exec, toJS(exec, document)));
-    return documentValue;
-}
-
-static JSValueRef highlightDOMNode(JSContextRef context, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
-{
-    JSValueRef undefined = JSValueMakeUndefined(context);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (argumentCount < 1 || !controller)
-        return undefined;
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(toJS(arguments[0]));
-    if (!wrapper)
-        return undefined;
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return undefined;
-
-    controller->highlight(node);
-
-    return undefined;
-}
-
-static JSValueRef search(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2 || !JSValueIsString(ctx, arguments[1]))
-        return JSValueMakeUndefined(ctx);
-
-    Node* node = toNode(toJS(arguments[0]));
-    if (!node)
-        return JSValueMakeUndefined(ctx);
-
-    String target = toString(ctx, arguments[1], exception);
-
-    JSObjectRef global = JSContextGetGlobalObject(ctx);
-
-    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, jsStringRef("Array").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, jsStringRef("push").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        JSC::JSLock lock(false);
-        JSValueRef arg0 = toRef(toJS(toJS(ctx), resultRange.get()));
-        JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
-        if (exception && *exception)
-            return JSValueMakeUndefined(ctx);
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return result;
-}
-
-#if ENABLE(DATABASE)
-static JSValueRef databaseTableNames(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(toJS(arguments[0]));
-    if (!wrapper)
-        return JSValueMakeUndefined(ctx);
-
-    Database* database = toDatabase(wrapper->unwrappedObject());
-    if (!database)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef global = JSContextGetGlobalObject(ctx);
-
-    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, jsStringRef("Array").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, jsStringRef("push").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    Vector<String> tableNames = database->tableNames();
-    unsigned length = tableNames.size();
-    for (unsigned i = 0; i < length; ++i) {
-        String tableName = tableNames[i];
-        JSValueRef tableNameValue = JSValueMakeString(ctx, jsStringRef(tableName).get());
-
-        JSValueRef pushArguments[] = { tableNameValue };
-        JSObjectCallAsFunction(ctx, pushFunction, result, 1, pushArguments, exception);
-        if (exception && *exception)
-            return JSValueMakeUndefined(ctx);
-    }
-
-    return result;
-}
-#endif
-
-static JSValueRef inspectedWindow(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments[]*/, JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(controller->inspectedPage()->mainFrame());
-    JSLock lock(false);
-    return toRef(JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow));
-}
-
-static JSValueRef setting(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef keyValue = arguments[0];
-    if (!JSValueIsString(ctx, keyValue))
-        return JSValueMakeUndefined(ctx);
-
-    const InspectorController::Setting& setting = controller->setting(toString(ctx, keyValue, exception));
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return JSValueMakeUndefined(ctx);
-        case InspectorController::Setting::StringType:
-            return JSValueMakeString(ctx, jsStringRef(setting.string()).get());
-        case InspectorController::Setting::DoubleType:
-            return JSValueMakeNumber(ctx, setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return JSValueMakeNumber(ctx, setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return JSValueMakeBoolean(ctx, setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            Vector<JSValueRef> stringValues;
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringValues.append(JSValueMakeString(ctx, jsStringRef(strings[i]).get()));
-
-            JSObjectRef stringsArray = JSObjectMakeArray(ctx, stringValues.size(), stringValues.data(), exception);
-            if (exception && *exception)
-                return JSValueMakeUndefined(ctx);
-            return stringsArray;
-        }
-    }
-}
-
-static JSValueRef setSetting(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef keyValue = arguments[0];
-    if (!JSValueIsString(ctx, keyValue))
-        return JSValueMakeUndefined(ctx);
-
-    InspectorController::Setting setting;
-
-    JSValueRef value = arguments[1];
-    switch (JSValueGetType(ctx, value)) {
-        default:
-        case kJSTypeUndefined:
-        case kJSTypeNull:
-            // Do nothing. The setting is already NoType.
-            ASSERT(setting.type() == InspectorController::Setting::NoType);
-            break;
-        case kJSTypeString:
-            setting.set(toString(ctx, value, exception));
-            break;
-        case kJSTypeNumber:
-            setting.set(JSValueToNumber(ctx, value, exception));
-            break;
-        case kJSTypeBoolean:
-            setting.set(JSValueToBoolean(ctx, value));
-            break;
-        case kJSTypeObject: {
-            JSObjectRef object = JSValueToObject(ctx, value, 0);
-            JSValueRef lengthValue = JSObjectGetProperty(ctx, object, jsStringRef("length").get(), exception);
-            if (exception && *exception)
-                return JSValueMakeUndefined(ctx);
-
-            Vector<String> strings;
-            const unsigned length = static_cast<unsigned>(JSValueToNumber(ctx, lengthValue, 0));
-            for (unsigned i = 0; i < length; ++i) {
-                JSValueRef itemValue = JSObjectGetPropertyAtIndex(ctx, object, i, exception);
-                if (exception && *exception)
-                    return JSValueMakeUndefined(ctx);
-                strings.append(toString(ctx, itemValue, exception));
-                if (exception && *exception)
-                    return JSValueMakeUndefined(ctx);
-            }
-
-            setting.set(strings);
-            break;
-        }
-    }
-
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->setSetting(toString(ctx, keyValue, exception), setting);
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef localizedStrings(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments[]*/, JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    String url = controller->localizedStringsURL();
-    if (url.isNull())
-        return JSValueMakeNull(ctx);
-
-    return JSValueMakeString(ctx, jsStringRef(url).get());
-}
-
-static JSValueRef platform(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef /*thisObject*/, size_t /*argumentCount*/, const JSValueRef[] /*arguments[]*/, JSValueRef* /*exception*/)
+const String& InspectorController::platform() const
 {
 #if PLATFORM(MAC)
 #ifdef BUILDING_ON_TIGER
@@ -915,184 +156,9 @@ static JSValueRef platform(JSContextRef ctx, JSObjectRef /*function*/, JSObjectR
     DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
 #endif
 
-    JSValueRef platformValue = JSValueMakeString(ctx, jsStringRef(platform).get());
-
-    return platformValue;
+    return platform;
 }
 
-static JSValueRef moveByUnrestricted(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2)
-        return JSValueMakeUndefined(ctx);
-
-    double x = JSValueToNumber(ctx, arguments[0], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    double y = JSValueToNumber(ctx, arguments[1], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->moveWindowBy(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y));
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef setAttachedWindowHeight(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    unsigned height = static_cast<unsigned>(JSValueToNumber(ctx, arguments[0], exception));
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->setAttachedWindowHeight(height);
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef wrapCallback(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    JSLock lock(false);
-    return toRef(JSInspectorCallbackWrapper::wrap(toJS(ctx), toJS(arguments[0])));
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-static JSValueRef currentCallFrame(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JavaScriptCallFrame* callFrame = controller->currentCallFrame();
-    if (!callFrame || !callFrame->isValid())
-        return JSValueMakeNull(ctx);
-
-    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
-
-    JSLock lock(false);
-    return toRef(JSInspectedObjectWrapper::wrap(globalExec, toJS(toJS(ctx), callFrame)));
-}
-
-static JSValueRef setPauseOnExceptions(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    controller->setPauseOnExceptions(JSValueToBoolean(ctx, arguments[0]));
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef addBreakpoint(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2)
-        return JSValueMakeUndefined(ctx);
-
-    double sourceID = JSValueToNumber(ctx, arguments[0], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    double lineNumber = JSValueToNumber(ctx, arguments[1], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->addBreakpoint(static_cast<int>(sourceID), static_cast<unsigned>(lineNumber));
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef removeBreakpoint(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2)
-        return JSValueMakeUndefined(ctx);
-
-    double sourceID = JSValueToNumber(ctx, arguments[0], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    double lineNumber = JSValueToNumber(ctx, arguments[1], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->removeBreakpoint(static_cast<int>(sourceID), static_cast<unsigned>(lineNumber));
-
-    return JSValueMakeUndefined(ctx);
-}
-#endif
-
-static JSValueRef profiles(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSLock lock(false);
-
-    const Vector<RefPtr<Profile> >& profiles = controller->profiles();
-
-    JSObjectRef global = JSContextGetGlobalObject(ctx);
-
-    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, jsStringRef("Array").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, jsStringRef("push").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    for (size_t i = 0; i < profiles.size(); ++i) {
-        JSValueRef arg0 = toRef(toJS(toJS(ctx), profiles[i].get()));
-        JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
-        if (exception && *exception)
-            return JSValueMakeUndefined(ctx);
-    }
-
-    return result;
-}
-
-// InspectorController Class
-
 static unsigned s_inspectorControllerCount;
 static HashMap<String, InspectorController::Setting*>* s_settingCache;
 
@@ -1100,24 +166,24 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     : m_inspectedPage(page)
     , m_client(client)
     , m_page(0)
-    , m_scriptObject(0)
-    , m_controllerScriptObject(0)
-    , m_scriptContext(0)
+    , m_scriptState(0)
     , m_windowVisible(false)
+    , m_showAfterVisible(ElementsPanel)
+    , m_nextIdentifier(-2)
+    , m_groupLevel(0)
+    , m_searchingForNode(false)
+    , m_previousMessage(0)
+    , m_resourceTrackingEnabled(false)
+    , m_resourceTrackingSettingsLoaded(false)
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
     , m_attachDebuggerWhenShown(false)
-#endif
     , m_profilerEnabled(false)
     , m_recordingUserInitiatedProfile(false)
-    , m_showAfterVisible(ElementsPanel)
-    , m_nextIdentifier(-2)
-    , m_groupLevel(0)
-    , m_searchingForNode(false)
     , m_currentUserInitiatedProfileNumber(-1)
     , m_nextUserInitiatedProfileNumber(1)
-    , m_previousMessage(0)
     , m_startProfiling(this, &InspectorController::startUserInitiatedProfiling)
+#endif
 {
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
@@ -1126,26 +192,11 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
 
 InspectorController::~InspectorController()
 {
-    m_client->inspectorDestroyed();
-
-    if (m_scriptContext) {
-        JSValueRef exception = 0;
-
-        JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-        JSValueRef controllerProperty = JSObjectGetProperty(m_scriptContext, global, jsStringRef("InspectorController").get(), &exception);
-        if (!HANDLE_EXCEPTION(m_scriptContext, exception)) {
-            if (JSObjectRef controller = JSValueToObject(m_scriptContext, controllerProperty, &exception)) {
-                if (!HANDLE_EXCEPTION(m_scriptContext, exception))
-                    JSObjectSetPrivate(controller, 0);
-            }
-        }
-    }
-
-    if (m_page)
-        m_page->setParentInspectorController(0);
-
-    // m_inspectedPage should have been cleared in inspectedPageDestroyed().
+    // These should have been cleared in inspectedPageDestroyed().
+    ASSERT(!m_client);
+    ASSERT(!m_scriptState);
     ASSERT(!m_inspectedPage);
+    ASSERT(!m_page || (m_page && !m_page->parentInspectorController()));
 
     deleteAllValues(m_frameResources);
     deleteAllValues(m_consoleMessages);
@@ -1164,8 +215,19 @@ void InspectorController::inspectedPageDestroyed()
 {
     close();
 
+    if (m_scriptState)
+        ScriptGlobalObject::remove(m_scriptState, "InspectorController");
+
+    if (m_page) {
+        m_page->setParentInspectorController(0);
+        m_page = 0;
+    }
+
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
+
+    m_client->inspectorDestroyed();
+    m_client = 0;
 }
 
 bool InspectorController::enabled() const
@@ -1224,6 +286,13 @@ String InspectorController::localizedStringsURL()
     return m_client->localizedStringsURL();
 }
 
+String InspectorController::hiddenPanels()
+{
+    if (!enabled())
+        return String();
+    return m_client->hiddenPanels();
+}
+
 // Trying to inspect something in a frame with JavaScript disabled would later lead to
 // crashes trying to create JavaScript wrappers. Some day we could fix this issue, but
 // for now prevent crashes here by never targeting a node in such a frame.
@@ -1246,7 +315,7 @@ void InspectorController::inspect(Node* node)
         node = node->parentNode();
     m_nodeToFocus = node;
 
-    if (!m_scriptObject) {
+    if (!m_frontend) {
         m_showAfterVisible = ElementsPanel;
         return;
     }
@@ -1260,27 +329,11 @@ void InspectorController::focusNode()
     if (!enabled())
         return;
 
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
+    ASSERT(m_frontend);
     ASSERT(m_nodeToFocus);
 
-    Frame* frame = m_nodeToFocus->document()->frame();
-    if (!frame)
-        return;
-
-    ExecState* exec = toJSDOMWindow(frame)->globalExec();
-
-    JSValueRef arg0;
-
-    {
-        JSC::JSLock lock(false);
-        arg0 = toRef(JSInspectedObjectWrapper::wrap(exec, toJS(exec, m_nodeToFocus.get())));
-    }
-
+    m_frontend->updateFocusedNode(m_nodeToFocus.get());
     m_nodeToFocus = 0;
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "updateFocusedNode", 1, &arg0, exception);
 }
 
 void InspectorController::highlight(Node* node)
@@ -1296,6 +349,7 @@ void InspectorController::hideHighlight()
 {
     if (!enabled())
         return;
+    m_highlightedNode = 0;
     m_client->hideHighlight();
 }
 
@@ -1311,7 +365,7 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
 
     m_windowVisible = visible;
 
-    if (!m_scriptContext || !m_scriptObject)
+    if (!m_frontend)
         return;
 
     if (m_windowVisible) {
@@ -1327,7 +381,13 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
             showPanel(m_showAfterVisible);
     } else {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+        // If the window is being closed with the debugger enabled,
+        // remember this state to re-enable debugger on the next window
+        // opening.
+        bool debuggerWasEnabled = m_debuggerEnabled;
         disableDebugger();
+        if (debuggerWasEnabled)
+            m_attachDebuggerWhenShown = true;
 #endif
         resetScriptObjects();
     }
@@ -1351,13 +411,13 @@ void InspectorController::addMessageToConsole(MessageSource source, MessageLevel
     addConsoleMessage(0, new ConsoleMessage(source, level, message, lineNumber, sourceID, m_groupLevel));
 }
 
-void InspectorController::addConsoleMessage(ExecState* exec, ConsoleMessage* consoleMessage)
+void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMessage* consoleMessage)
 {
     ASSERT(enabled());
     ASSERT_ARG(consoleMessage, consoleMessage);
 
-    if (m_previousMessage && m_previousMessage->isEqual(exec, consoleMessage)) {
-        ++m_previousMessage->repeatCount;
+    if (m_previousMessage && m_previousMessage->isEqual(scriptState, consoleMessage)) {
+        m_previousMessage->incrementCount();
         delete consoleMessage;
     } else {
         m_previousMessage = consoleMessage;
@@ -1365,7 +425,7 @@ void InspectorController::addConsoleMessage(ExecState* exec, ConsoleMessage* con
     }
 
     if (windowVisible())
-        addScriptConsoleMessage(m_previousMessage);
+        m_previousMessage->addToConsole(m_frontend.get());
 }
 
 void InspectorController::clearConsoleMessages()
@@ -1376,18 +436,8 @@ void InspectorController::clearConsoleMessages()
     m_groupLevel = 0;
 }
 
-void InspectorController::toggleRecordButton(bool isProfiling)
-{
-    if (!m_scriptContext)
-        return;
-
-    JSValueRef exception = 0;
-    JSValueRef isProvingValue = JSValueMakeBoolean(m_scriptContext, isProfiling);
-    callFunction(m_scriptContext, m_scriptObject, "setRecordingProfile", 1, &isProvingValue, exception);
-}
-
 void InspectorController::startGroup(MessageSource source, ScriptCallStack* callStack)
-{    
+{
     ++m_groupLevel;
 
     addConsoleMessage(callStack->state(), new ConsoleMessage(source, StartGroupMessageLevel, callStack, m_groupLevel));
@@ -1403,32 +453,6 @@ void InspectorController::endGroup(MessageSource source, unsigned lineNumber, co
     addConsoleMessage(0, new ConsoleMessage(source, EndGroupMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
 }
 
-void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
-{
-    if (!enabled())
-        return;
-
-    RefPtr<Profile> profile = prpProfile;
-    m_profiles.append(profile);
-
-    if (windowVisible())
-        addScriptProfile(profile.get());
-
-    addProfileMessageToConsole(profile, lineNumber, sourceURL);
-}
-
-void InspectorController::addProfileMessageToConsole(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
-{
-    RefPtr<Profile> profile = prpProfile;
-
-    UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(profile->title());
-    message += "/";
-    message += UString::from(profile->uid());
-    message += "\" finished.";
-    addMessageToConsole(JSMessageSource, LogMessageLevel, message, lineNumber, sourceURL);
-}
-
 void InspectorController::attachWindow()
 {
     if (!enabled())
@@ -1445,13 +469,10 @@ void InspectorController::detachWindow()
 
 void InspectorController::setAttachedWindow(bool attached)
 {
-    if (!enabled() || !m_scriptContext || !m_scriptObject)
+    if (!enabled() || !m_frontend)
         return;
 
-    JSValueRef attachedValue = JSValueMakeBoolean(m_scriptContext, attached);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "setAttachedWindow", 1, &attachedValue, exception);
+    m_frontend->setAttachedWindow(attached);
 }
 
 void InspectorController::setAttachedWindowHeight(unsigned height)
@@ -1471,6 +492,19 @@ void InspectorController::toggleSearchForNodeInPage()
         hideHighlight();
 }
 
+void InspectorController::addResourceSourceToFrame(long identifier, Node* frame)
+{
+    if (!enabled() || !m_frontend)
+        return;
+
+    RefPtr<InspectorResource> resource = resources().get(identifier);
+    if (resource) {
+        String sourceString = resource->sourceString();
+        if (!sourceString.isEmpty())
+            addSourceToFrame(resource->mimeType(), sourceString, frame);
+    }
+}
+
 void InspectorController::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
 {
     if (!enabled() || !m_searchingForNode)
@@ -1497,21 +531,10 @@ void InspectorController::handleMousePressOnNode(Node* node)
 
 void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
 {
-    if (!enabled() || !m_scriptContext || !m_scriptObject)
+    if (!enabled() || !m_frontend)
         return;
 
-    JSDOMWindow* win = toJSDOMWindow(frame);
-    ExecState* exec = win->globalExec();
-
-    JSValueRef arg0;
-
-    {
-        JSC::JSLock lock(false);
-        arg0 = toRef(JSInspectedObjectWrapper::wrap(exec, win));
-    }
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "inspectedWindowCleared", 1, &arg0, exception);
+    m_frontend->inspectedWindowScriptObjectCleared(frame);
 }
 
 void InspectorController::windowScriptObjectAvailable()
@@ -1519,122 +542,51 @@ void InspectorController::windowScriptObjectAvailable()
     if (!m_page || !enabled())
         return;
 
-    m_scriptContext = toRef(m_page->mainFrame()->script()->globalObject()->globalExec());
-
-    JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-    ASSERT(global);
-
-    static JSStaticFunction staticFunctions[] = {
-        // SIMPLE_INSPECTOR_CALLBACK
-        { "hideDOMNodeHighlight", WebCore::hideDOMNodeHighlight, kJSPropertyAttributeNone },
-        { "loaded", WebCore::loaded, kJSPropertyAttributeNone },
-        { "windowUnloading", WebCore::unloading, kJSPropertyAttributeNone },
-        { "attach", WebCore::attach, kJSPropertyAttributeNone },
-        { "detach", WebCore::detach, kJSPropertyAttributeNone },
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        { "enableDebugger", WebCore::enableDebugger, kJSPropertyAttributeNone },
-        { "disableDebugger", WebCore::disableDebugger, kJSPropertyAttributeNone },
-        { "pauseInDebugger", WebCore::pauseInDebugger, kJSPropertyAttributeNone },
-        { "resumeDebugger", WebCore::resumeDebugger, kJSPropertyAttributeNone },
-        { "stepOverStatementInDebugger", WebCore::stepOverStatementInDebugger, kJSPropertyAttributeNone },
-        { "stepIntoStatementInDebugger", WebCore::stepIntoStatementInDebugger, kJSPropertyAttributeNone },
-        { "stepOutOfFunctionInDebugger", WebCore::stepOutOfFunctionInDebugger, kJSPropertyAttributeNone },
-#endif
-        { "closeWindow", WebCore::closeWindow, kJSPropertyAttributeNone },
-        { "clearMessages", WebCore::clearMessages, kJSPropertyAttributeNone },
-        { "startProfiling", WebCore::startProfiling, kJSPropertyAttributeNone },
-        { "stopProfiling", WebCore::stopProfiling, kJSPropertyAttributeNone },
-        { "enableProfiler", WebCore::enableProfiler, kJSPropertyAttributeNone },
-        { "disableProfiler", WebCore::disableProfiler, kJSPropertyAttributeNone },
-        { "toggleNodeSearch", WebCore::toggleNodeSearch, kJSPropertyAttributeNone },
-
-        // BOOL_INSPECTOR_CALLBACK
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        { "debuggerEnabled", WebCore::debuggerEnabled, kJSPropertyAttributeNone },
-        { "pauseOnExceptions", WebCore::pauseOnExceptions, kJSPropertyAttributeNone },
-#endif
-        { "profilerEnabled", WebCore::profilerEnabled, kJSPropertyAttributeNone },
-        { "isWindowVisible", WebCore::isWindowVisible, kJSPropertyAttributeNone },
-        { "searchingForNode", WebCore::searchingForNode, kJSPropertyAttributeNone },
-
-        // Custom callbacks
-        { "addResourceSourceToFrame", WebCore::addResourceSourceToFrame, kJSPropertyAttributeNone },
-        { "addSourceToFrame", WebCore::addSourceToFrame, kJSPropertyAttributeNone },
-        { "getResourceDocumentNode", WebCore::getResourceDocumentNode, kJSPropertyAttributeNone },
-        { "highlightDOMNode", WebCore::highlightDOMNode, kJSPropertyAttributeNone },
-        { "search", WebCore::search, kJSPropertyAttributeNone },
-#if ENABLE(DATABASE)
-        { "databaseTableNames", WebCore::databaseTableNames, kJSPropertyAttributeNone },
-#endif
-        { "setting", WebCore::setting, kJSPropertyAttributeNone },
-        { "setSetting", WebCore::setSetting, kJSPropertyAttributeNone },
-        { "inspectedWindow", WebCore::inspectedWindow, kJSPropertyAttributeNone },
-        { "localizedStringsURL", WebCore::localizedStrings, kJSPropertyAttributeNone },
-        { "platform", WebCore::platform, kJSPropertyAttributeNone },
-        { "moveByUnrestricted", WebCore::moveByUnrestricted, kJSPropertyAttributeNone },
-        { "setAttachedWindowHeight", WebCore::setAttachedWindowHeight, kJSPropertyAttributeNone },
-        { "wrapCallback", WebCore::wrapCallback, kJSPropertyAttributeNone },
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        { "currentCallFrame", WebCore::currentCallFrame, kJSPropertyAttributeNone },
-        { "setPauseOnExceptions", WebCore::setPauseOnExceptions, kJSPropertyAttributeNone },
-        { "addBreakpoint", WebCore::addBreakpoint, kJSPropertyAttributeNone },
-        { "removeBreakpoint", WebCore::removeBreakpoint, kJSPropertyAttributeNone },
-#endif
-        { "profiles", WebCore::profiles, kJSPropertyAttributeNone },
-        { 0, 0, 0 }
-    };
+    // Grant the inspector the ability to script the inspected page.
+    m_page->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
 
-    JSClassDefinition inspectorControllerDefinition = {
-        0, kJSClassAttributeNone, "InspectorController", 0, 0, staticFunctions,
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
-    };
-
-    JSClassRef controllerClass = JSClassCreate(&inspectorControllerDefinition);
-    ASSERT(controllerClass);
-
-    m_controllerScriptObject = JSObjectMake(m_scriptContext, controllerClass, reinterpret_cast<void*>(this));
-    ASSERT(m_controllerScriptObject);
-
-    JSObjectSetProperty(m_scriptContext, global, jsStringRef("InspectorController").get(), m_controllerScriptObject, kJSPropertyAttributeNone, 0);
+    m_scriptState = scriptStateFromPage(m_page);
+    ScriptGlobalObject::set(m_scriptState, "InspectorController", this);
 }
 
 void InspectorController::scriptObjectReady()
 {
-    ASSERT(m_scriptContext);
-    if (!m_scriptContext)
-        return;
-
-    JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-    ASSERT(global);
-
-    JSValueRef exception = 0;
-
-    JSValueRef inspectorValue = JSObjectGetProperty(m_scriptContext, global, jsStringRef("WebInspector").get(), &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
+    ASSERT(m_scriptState);
+    if (!m_scriptState)
         return;
 
-    ASSERT(inspectorValue);
-    if (!inspectorValue)
+    ScriptObject webInspectorObj;
+    if (!ScriptGlobalObject::get(m_scriptState, "WebInspector", webInspectorObj))
         return;
+    setFrontendProxyObject(m_scriptState, webInspectorObj);
 
-    m_scriptObject = JSValueToObject(m_scriptContext, inspectorValue, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    ASSERT(m_scriptObject);
-
-    JSValueProtect(m_scriptContext, m_scriptObject);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    Setting debuggerEnabled = setting(debuggerEnabledSettingName);
+    if (debuggerEnabled.type() == Setting::BooleanType && debuggerEnabled.booleanValue())
+        enableDebugger();
+    Setting profilerEnabled = setting(profilerEnabledSettingName);
+    if (profilerEnabled.type() == Setting::BooleanType && profilerEnabled.booleanValue())
+        enableProfiler();
+#endif
 
     // Make sure our window is visible now that the page loaded
     showWindow();
 }
 
+void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj)
+{
+    m_frontend.set(new InspectorFrontend(scriptState, webInspectorObj));
+}
+
 void InspectorController::show()
 {
     if (!enabled())
         return;
-
+    
     if (!m_page) {
+        if (m_frontend)
+            return;  // We are using custom frontend - no need to create page.
+
         m_page = m_client->createPage();
         if (!m_page)
             return;
@@ -1654,7 +606,7 @@ void InspectorController::showPanel(SpecialPanels panel)
 
     show();
 
-    if (!m_scriptObject) {
+    if (!m_frontend) {
         m_showAfterVisible = panel;
         return;
     }
@@ -1662,33 +614,7 @@ void InspectorController::showPanel(SpecialPanels panel)
     if (panel == CurrentPanel)
         return;
 
-    const char* showFunctionName;
-    switch (panel) {
-        case ConsolePanel:
-            showFunctionName = "showConsole";
-            break;
-        case DatabasesPanel:
-            showFunctionName = "showDatabasesPanel";
-            break;
-        case ElementsPanel:
-            showFunctionName = "showElementsPanel";
-            break;
-        case ProfilesPanel:
-            showFunctionName = "showProfilesPanel";
-            break;
-        case ResourcesPanel:
-            showFunctionName = "showResourcesPanel";
-            break;
-        case ScriptsPanel:
-            showFunctionName = "showScriptsPanel";
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            showFunctionName = 0;
-    }
-
-    if (showFunctionName)
-        callSimpleFunction(m_scriptContext, m_scriptObject, showFunctionName);
+    m_frontend->showPanel(panel);
 }
 
 void InspectorController::close()
@@ -1696,17 +622,14 @@ void InspectorController::close()
     if (!enabled())
         return;
 
-    stopUserInitiatedProfiling();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    stopUserInitiatedProfiling();
     disableDebugger();
 #endif
     closeWindow();
 
-    if (m_scriptContext && m_scriptObject)
-        JSValueUnprotect(m_scriptContext, m_scriptObject);
-
-    m_scriptObject = 0;
-    m_scriptContext = 0;
+    m_frontend.set(0);
+    m_scriptState = 0;
 }
 
 void InspectorController::showWindow()
@@ -1720,557 +643,55 @@ void InspectorController::closeWindow()
     m_client->closeWindow();
 }
 
-void InspectorController::startUserInitiatedProfilingSoon()
-{
-    m_startProfiling.startOneShot(0);
-}
-
-void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>*)
-{
-    if (!enabled())
-        return;
-
-    if (!profilerEnabled()) {
-        enableProfiler(true);
-        JavaScriptDebugServer::shared().recompileAllJSFunctions();
-    }
-
-    m_recordingUserInitiatedProfile = true;
-    m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
-
-    UString title = UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
-
-    ExecState* exec = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
-    Profiler::profiler()->startProfiling(exec, title);
-
-    toggleRecordButton(true);
-}
-
-void InspectorController::stopUserInitiatedProfiling()
-{
-    if (!enabled())
-        return;
-
-    m_recordingUserInitiatedProfile = false;
-
-    UString title =  UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
-
-    ExecState* exec = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
-    RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(exec, title);
-    if (profile)
-        addProfile(profile, 0, UString());
-
-    toggleRecordButton(false);
-}
-
-void InspectorController::enableProfiler(bool skipRecompile)
-{
-    if (m_profilerEnabled)
-        return;
-
-    m_profilerEnabled = true;
-
-    if (!skipRecompile)
-        JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
-
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "profilerWasEnabled");
-}
-
-void InspectorController::disableProfiler()
-{
-    if (!m_profilerEnabled)
-        return;
-
-    m_profilerEnabled = false;
-
-    JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
-
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "profilerWasDisabled");
-}
-
-static void addHeaders(JSContextRef context, JSObjectRef object, const HTTPHeaderMap& headers, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-    ASSERT_ARG(object, object);
-
-    HTTPHeaderMap::const_iterator end = headers.end();
-    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it) {
-        JSValueRef value = JSValueMakeString(context, jsStringRef(it->second).get());
-        JSObjectSetProperty(context, object, jsStringRef((it->first).string()).get(), value, kJSPropertyAttributeNone, exception);
-        if (exception && *exception)
-            return;
-    }
-}
-
-static JSObjectRef scriptObjectForRequest(JSContextRef context, const InspectorResource* resource, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-
-    JSObjectRef object = JSObjectMake(context, 0, 0);
-    addHeaders(context, object, resource->requestHeaderFields, exception);
-
-    return object;
-}
-
-static JSObjectRef scriptObjectForResponse(JSContextRef context, const InspectorResource* resource, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-
-    JSObjectRef object = JSObjectMake(context, 0, 0);
-    addHeaders(context, object, resource->responseHeaderFields, exception);
-
-    return object;
-}
-
-JSObjectRef InspectorController::addScriptResource(InspectorResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return 0;
-
-    if (!resource->scriptObject) {
-        JSValueRef exception = 0;
-
-        JSValueRef resourceProperty = JSObjectGetProperty(m_scriptContext, m_scriptObject, jsStringRef("Resource").get(), &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSObjectRef resourceConstructor = JSValueToObject(m_scriptContext, resourceProperty, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.string()).get());
-        JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.host()).get());
-        JSValueRef pathValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.path()).get());
-        JSValueRef lastPathComponentValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.lastPathComponent()).get());
-
-        JSValueRef identifier = JSValueMakeNumber(m_scriptContext, resource->identifier);
-        JSValueRef mainResource = JSValueMakeBoolean(m_scriptContext, m_mainResource == resource);
-        JSValueRef cached = JSValueMakeBoolean(m_scriptContext, resource->cached);
-
-        JSObjectRef scriptObject = scriptObjectForRequest(m_scriptContext, resource, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSValueRef arguments[] = { scriptObject, urlValue, domainValue, pathValue, lastPathComponentValue, identifier, mainResource, cached };
-        JSObjectRef result = JSObjectCallAsConstructor(m_scriptContext, resourceConstructor, 8, arguments, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        ASSERT(result);
-
-        resource->setScriptObject(m_scriptContext, result);
-    }
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "addResource", 1, &resource->scriptObject, exception);
-
-    if (exception)
-        return 0;
-
-    return resource->scriptObject;
-}
-
-JSObjectRef InspectorController::addAndUpdateScriptResource(InspectorResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    JSObjectRef scriptResource = addScriptResource(resource);
-    if (!scriptResource)
-        return 0;
-
-    updateScriptResourceResponse(resource);
-    updateScriptResource(resource, resource->length);
-    updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-    updateScriptResource(resource, resource->finished, resource->failed);
-    return scriptResource;
-}
-
-void InspectorController::removeScriptResource(InspectorResource* resource)
-{
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return;
-
-    ASSERT(resource);
-    ASSERT(resource->scriptObject);
-    if (!resource || !resource->scriptObject)
-        return;
-
-    JSObjectRef scriptObject = resource->scriptObject;
-    resource->setScriptObject(0, 0);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "removeResource", 1, &scriptObject, exception);
-}
-
-static void updateResourceRequest(InspectorResource* resource, const ResourceRequest& request)
-{
-    resource->requestHeaderFields = request.httpHeaderFields();
-    resource->requestURL = request.url();
-}
-
-static void updateResourceResponse(InspectorResource* resource, const ResourceResponse& response)
-{
-    resource->expectedContentLength = response.expectedContentLength();
-    resource->mimeType = response.mimeType();
-    resource->responseHeaderFields = response.httpHeaderFields();
-    resource->responseStatusCode = response.httpStatusCode();
-    resource->suggestedFilename = response.suggestedFilename();
-}
-
-void InspectorController::updateScriptResourceRequest(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.string()).get());
-    JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.host()).get());
-    JSValueRef pathValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.path()).get());
-    JSValueRef lastPathComponentValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.lastPathComponent()).get());
-
-    JSValueRef mainResourceValue = JSValueMakeBoolean(m_scriptContext, m_mainResource == resource);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("url").get(), urlValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("domain").get(), domainValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("path").get(), pathValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("lastPathComponent").get(), lastPathComponentValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef scriptObject = scriptObjectForRequest(m_scriptContext, resource, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("requestHeaders").get(), scriptObject, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("mainResource").get(), mainResourceValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResourceResponse(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef mimeTypeValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->mimeType).get());
-
-    JSValueRef suggestedFilenameValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->suggestedFilename).get());
-
-    JSValueRef expectedContentLengthValue = JSValueMakeNumber(m_scriptContext, static_cast<double>(resource->expectedContentLength));
-    JSValueRef statusCodeValue = JSValueMakeNumber(m_scriptContext, resource->responseStatusCode);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("mimeType").get(), mimeTypeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("suggestedFilename").get(), suggestedFilenameValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("expectedContentLength").get(), expectedContentLengthValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("statusCode").get(), statusCodeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef scriptObject = scriptObjectForResponse(m_scriptContext, resource, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("responseHeaders").get(), scriptObject, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    updateScriptResourceType(resource);
-}
-
-void InspectorController::updateScriptResourceType(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef exception = 0;
-
-    JSValueRef typeValue = JSValueMakeNumber(m_scriptContext, resource->type());
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("type").get(), typeValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, int length)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef lengthValue = JSValueMakeNumber(m_scriptContext, length);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("contentLength").get(), lengthValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, bool finished, bool failed)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef failedValue = JSValueMakeBoolean(m_scriptContext, failed);
-    JSValueRef finishedValue = JSValueMakeBoolean(m_scriptContext, finished);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("failed").get(), failedValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("finished").get(), finishedValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, double startTime, double responseReceivedTime, double endTime)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef startTimeValue = JSValueMakeNumber(m_scriptContext, startTime);
-    JSValueRef responseReceivedTimeValue = JSValueMakeNumber(m_scriptContext, responseReceivedTime);
-    JSValueRef endTimeValue = JSValueMakeNumber(m_scriptContext, endTime);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("startTime").get(), startTimeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("responseReceivedTime").get(), responseReceivedTimeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("endTime").get(), endTimeValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
 void InspectorController::populateScriptObjects()
 {
-    ASSERT(m_scriptContext);
-    if (!m_scriptContext)
+    ASSERT(m_frontend);
+    if (!m_frontend)
         return;
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
-        addAndUpdateScriptResource(it->second.get());
+        it->second->createScriptObject(m_frontend.get());
 
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
-        addScriptConsoleMessage(m_consoleMessages[i]);
+        m_consoleMessages[i]->addToConsole(m_frontend.get());
 
 #if ENABLE(DATABASE)
     DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
     for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        addDatabaseScriptResource((*it).get());
+        (*it)->bind(m_frontend.get());
 #endif
-
-    callSimpleFunction(m_scriptContext, m_scriptObject, "populateInterface");
-}
-
-#if ENABLE(DATABASE)
-JSObjectRef InspectorController::addDatabaseScriptResource(InspectorDatabaseResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    if (resource->scriptObject)
-        return resource->scriptObject;
-
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return 0;
-
-    Frame* frame = resource->database->document()->frame();
-    if (!frame)
-        return 0;
-
-    JSValueRef exception = 0;
-
-    JSValueRef databaseProperty = JSObjectGetProperty(m_scriptContext, m_scriptObject, jsStringRef("Database").get(), &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return 0;
-
-    JSObjectRef databaseConstructor = JSValueToObject(m_scriptContext, databaseProperty, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return 0;
-
-    ExecState* exec = toJSDOMWindow(frame)->globalExec();
-
-    JSValueRef database;
-
-    {
-        JSC::JSLock lock(false);
-        database = toRef(JSInspectedObjectWrapper::wrap(exec, toJS(exec, resource->database.get())));
-    }
-
-    JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->domain).get());
-    JSValueRef nameValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->name).get());
-    JSValueRef versionValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->version).get());
-
-    JSValueRef arguments[] = { database, domainValue, nameValue, versionValue };
-    JSObjectRef result = JSObjectCallAsConstructor(m_scriptContext, databaseConstructor, 4, arguments, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return 0;
-
-    ASSERT(result);
-
-    callFunction(m_scriptContext, m_scriptObject, "addDatabase", 1, &result, exception);
-
-    if (exception)
-        return 0;
-
-    resource->setScriptObject(m_scriptContext, result);
-
-    return result;
-}
-
-void InspectorController::removeDatabaseScriptResource(InspectorDatabaseResource* resource)
-{
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return;
-
-    ASSERT(resource);
-    ASSERT(resource->scriptObject);
-    if (!resource || !resource->scriptObject)
-        return;
-
-    JSObjectRef scriptObject = resource->scriptObject;
-    resource->setScriptObject(0, 0);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "removeDatabase", 1, &scriptObject, exception);
-}
+#if ENABLE(DOM_STORAGE)
+    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        (*it)->bind(m_frontend.get());
 #endif
 
-void InspectorController::addScriptConsoleMessage(const ConsoleMessage* message)
-{
-    ASSERT_ARG(message, message);
-
-    JSValueRef exception = 0;
-
-    JSValueRef messageConstructorProperty = JSObjectGetProperty(m_scriptContext, m_scriptObject, jsStringRef("ConsoleMessage").get(), &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef messageConstructor = JSValueToObject(m_scriptContext, messageConstructorProperty, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSValueRef sourceValue = JSValueMakeNumber(m_scriptContext, message->source);
-    JSValueRef levelValue = JSValueMakeNumber(m_scriptContext, message->level);
-    JSValueRef lineValue = JSValueMakeNumber(m_scriptContext, message->line);
-    JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(message->url).get());
-    JSValueRef groupLevelValue = JSValueMakeNumber(m_scriptContext, message->groupLevel);
-    JSValueRef repeatCountValue = JSValueMakeNumber(m_scriptContext, message->repeatCount);
-
-    static const unsigned maximumMessageArguments = 256;
-    JSValueRef arguments[maximumMessageArguments];
-    unsigned argumentCount = 0;
-    arguments[argumentCount++] = sourceValue;
-    arguments[argumentCount++] = levelValue;
-    arguments[argumentCount++] = lineValue;
-    arguments[argumentCount++] = urlValue;
-    arguments[argumentCount++] = groupLevelValue;
-    arguments[argumentCount++] = repeatCountValue;
-
-    if (!message->frames.isEmpty()) {
-        unsigned remainingSpaceInArguments = maximumMessageArguments - argumentCount;
-        unsigned argumentsToAdd = min(remainingSpaceInArguments, static_cast<unsigned>(message->frames.size()));
-        for (unsigned i = 0; i < argumentsToAdd; ++i)
-            arguments[argumentCount++] = JSValueMakeString(m_scriptContext, jsStringRef(message->frames[i]).get());
-    } else if (!message->wrappedArguments.isEmpty()) {
-        unsigned remainingSpaceInArguments = maximumMessageArguments - argumentCount;
-        unsigned argumentsToAdd = min(remainingSpaceInArguments, static_cast<unsigned>(message->wrappedArguments.size()));
-        for (unsigned i = 0; i < argumentsToAdd; ++i)
-            arguments[argumentCount++] = toRef(message->wrappedArguments[i]);
-    } else {
-        JSValueRef messageValue = JSValueMakeString(m_scriptContext, jsStringRef(message->message).get());
-        arguments[argumentCount++] = messageValue;
-    }
-
-    JSObjectRef messageObject = JSObjectCallAsConstructor(m_scriptContext, messageConstructor, argumentCount, arguments, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    callFunction(m_scriptContext, m_scriptObject, "addMessageToConsole", 1, &messageObject, exception);
-}
-
-void InspectorController::addScriptProfile(Profile* profile)
-{
-    JSLock lock(false);
-    JSValueRef exception = 0;
-    JSValueRef profileObject = toRef(toJS(toJS(m_scriptContext), profile));
-    callFunction(m_scriptContext, m_scriptObject, "addProfile", 1, &profileObject, exception);
+    m_frontend->populateInterface();
 }
 
 void InspectorController::resetScriptObjects()
 {
-    if (!m_scriptContext || !m_scriptObject)
+    if (!m_frontend)
         return;
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
-        InspectorResource* resource = it->second.get();
-        resource->setScriptObject(0, 0);
-    }
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+        it->second->releaseScriptObject(m_frontend.get(), false);
 
 #if ENABLE(DATABASE)
     DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it) {
-        InspectorDatabaseResource* resource = (*it).get();
-        resource->setScriptObject(0, 0);
-    }
+    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        (*it)->unbind();
+#endif
+#if ENABLE(DOM_STORAGE)
+    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        (*it)->unbind();
 #endif
 
-    callSimpleFunction(m_scriptContext, m_scriptObject, "reset");
+    m_frontend->reset();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -2284,10 +705,10 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
         if (resource == m_mainResource)
             continue;
 
-        if (!loaderToKeep || resource->loader != loaderToKeep) {
+        if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (windowVisible() && resource->scriptObject)
-                removeScriptResource(resource);
+            if (windowVisible())
+                resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
 }
@@ -2306,21 +727,25 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
 
         m_times.clear();
         m_counts.clear();
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         m_profiles.clear();
-
+#endif
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
+#if ENABLE(DOM_STORAGE)
+        m_domStorageResources.clear();
+#endif
 
         if (windowVisible()) {
             resetScriptObjects();
 
             if (!loader->isLoadingFromCachedPage()) {
-                ASSERT(m_mainResource && m_mainResource->loader == loader);
+                ASSERT(m_mainResource && m_mainResource->isSameLoader(loader));
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
                 // list of resources for the page they are navigating away from.
-                addAndUpdateScriptResource(m_mainResource.get());
+                m_mainResource->createScriptObject(m_frontend.get());
             } else {
                 // Pages loaded from the page cache are committed before
                 // m_mainResource is the right resource for this load, so we
@@ -2346,33 +771,33 @@ void InspectorController::frameDetachedFromParent(Frame* frame)
 
 void InspectorController::addResource(InspectorResource* resource)
 {
-    m_resources.set(resource->identifier, resource);
-    m_knownResources.add(resource->requestURL.string());
+    m_resources.set(resource->identifier(), resource);
+    m_knownResources.add(resource->requestURL());
 
-    Frame* frame = resource->frame.get();
+    Frame* frame = resource->frame();
     ResourcesMap* resourceMap = m_frameResources.get(frame);
     if (resourceMap)
-        resourceMap->set(resource->identifier, resource);
+        resourceMap->set(resource->identifier(), resource);
     else {
         resourceMap = new ResourcesMap;
-        resourceMap->set(resource->identifier, resource);
+        resourceMap->set(resource->identifier(), resource);
         m_frameResources.set(frame, resourceMap);
     }
 }
 
 void InspectorController::removeResource(InspectorResource* resource)
 {
-    m_resources.remove(resource->identifier);
-    m_knownResources.remove(resource->requestURL.string());
+    m_resources.remove(resource->identifier());
+    m_knownResources.remove(resource->requestURL());
 
-    Frame* frame = resource->frame.get();
+    Frame* frame = resource->frame();
     ResourcesMap* resourceMap = m_frameResources.get(frame);
     if (!resourceMap) {
         ASSERT_NOT_REACHED();
         return;
     }
 
-    resourceMap->remove(resource->identifier);
+    resourceMap->remove(resource->identifier());
     if (resourceMap->isEmpty()) {
         m_frameResources.remove(frame);
         delete resourceMap;
@@ -2388,115 +813,105 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     if (m_knownResources.contains(cachedResource->url()))
         return;
 
-    RefPtr<InspectorResource> resource = InspectorResource::create(m_nextIdentifier--, loader, loader->frame());
-    resource->finished = true;
-
-    resource->requestURL = KURL(cachedResource->url());
-    updateResourceResponse(resource.get(), cachedResource->response());
-
-    resource->length = cachedResource->encodedSize();
-    resource->cached = true;
-    resource->startTime = currentTime();
-    resource->responseReceivedTime = resource->startTime;
-    resource->endTime = resource->startTime;
-
     ASSERT(m_inspectedPage);
+    bool isMainResource = loader->frame() == m_inspectedPage->mainFrame() && cachedResource->url() == loader->requestURL();
+    ensureResourceTrackingSettingsLoaded();
+    if (!isMainResource && !m_resourceTrackingEnabled)
+        return;
+    
+    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
 
-    if (loader->frame() == m_inspectedPage->mainFrame() && cachedResource->url() == loader->requestURL())
+    if (isMainResource) {
         m_mainResource = resource;
+        resource->markMainResource();
+    }
 
     addResource(resource.get());
 
     if (windowVisible())
-        addAndUpdateScriptResource(resource.get());
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::identifierForInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     if (!enabled())
         return;
+    ASSERT(m_inspectedPage);
 
-    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader, loader->frame());
+    bool isMainResource = m_inspectedPage->mainFrame() && request.url() == loader->requestURL();
+    ensureResourceTrackingSettingsLoaded();
+    if (!isMainResource && !m_resourceTrackingEnabled)
+        return;
 
-    updateResourceRequest(resource.get(), request);
+    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader);
 
-    ASSERT(m_inspectedPage);
+    resource->updateRequest(request);
 
-    if (loader->frame() == m_inspectedPage->mainFrame() && request.url() == loader->requestURL())
+    if (isMainResource) {
         m_mainResource = resource;
+        resource->markMainResource();
+    }
 
     addResource(resource.get());
 
     if (windowVisible() && loader->isLoadingFromCachedPage() && resource == m_mainResource)
-        addAndUpdateScriptResource(resource.get());
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    resource->startTime = currentTime();
+    resource->startTiming();
 
     if (!redirectResponse.isNull()) {
-        updateResourceRequest(resource, request);
-        updateResourceResponse(resource, redirectResponse);
+        resource->updateRequest(request);
+        resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && windowVisible()) {
-        if (!resource->scriptObject)
-            addScriptResource(resource);
-        else
-            updateScriptResourceRequest(resource);
-
-        updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-
-        if (!redirectResponse.isNull())
-            updateScriptResourceResponse(resource);
-    }
+    if (resource != m_mainResource && windowVisible())
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse& response)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    updateResourceResponse(resource, response);
-
-    resource->responseReceivedTime = currentTime();
+    resource->updateResponse(response);
+    resource->markResponseReceivedTime();
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResourceResponse(resource);
-        updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    resource->length += lengthReceived;
+    resource->addLength(lengthReceived);
 
-    if (windowVisible() && resource->scriptObject)
-        updateScriptResource(resource, resource->length);
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identifier)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     RefPtr<InspectorResource> resource = m_resources.get(identifier);
@@ -2505,20 +920,17 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     removeResource(resource.get());
 
-    resource->finished = true;
-    resource->endTime = currentTime();
+    resource->endTiming();
 
     addResource(resource.get());
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResource(resource.get(), resource->startTime, resource->responseReceivedTime, resource->endTime);
-        updateScriptResource(resource.get(), resource->finished);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     RefPtr<InspectorResource> resource = m_resources.get(identifier);
@@ -2527,33 +939,88 @@ void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifi
 
     removeResource(resource.get());
 
-    resource->finished = true;
-    resource->failed = true;
-    resource->endTime = currentTime();
+    resource->markFailed();
+    resource->endTiming();
 
     addResource(resource.get());
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResource(resource.get(), resource->startTime, resource->responseReceivedTime, resource->endTime);
-        updateScriptResource(resource.get(), resource->finished, resource->failed);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const JSC::UString& sourceString)
+void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    resource->setXMLHttpRequestProperties(sourceString);
+    resource->setXMLHttpResponseText(sourceString);
 
-    if (windowVisible() && resource->scriptObject)
-        updateScriptResourceType(resource);
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
+void InspectorController::scriptImported(unsigned long identifier, const String& sourceString)
+{
+    if (!enabled() || !m_resourceTrackingEnabled)
+        return;
+    
+    InspectorResource* resource = m_resources.get(identifier).get();
+    if (!resource)
+        return;
+    
+    // FIXME: imported script and XHR response are currently viewed as the same
+    // thing by the Inspector. They should be made into distinct types.
+    resource->setXMLHttpResponseText(ScriptString(sourceString));
+    
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
+}
+
+void InspectorController::enableResourceTracking(bool always) {
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(resourceTrackingEnabledSettingName, Setting(true));
+
+    if (m_resourceTrackingEnabled)
+        return;
+
+    ASSERT(m_inspectedPage);
+    m_resourceTrackingEnabled = true;
+    if (m_frontend)
+        m_frontend->resourceTrackingWasEnabled();
+
+    m_inspectedPage->mainFrame()->loader()->reload();
+}
+
+void InspectorController::disableResourceTracking(bool always) {
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(resourceTrackingEnabledSettingName, Setting(false));
+
+    ASSERT(m_inspectedPage);
+    m_resourceTrackingEnabled = false;
+    if (m_frontend)
+        m_frontend->resourceTrackingWasDisabled();
+}
+
+void InspectorController::ensureResourceTrackingSettingsLoaded()
+{
+    if (m_resourceTrackingSettingsLoaded)
+        return;
+    m_resourceTrackingSettingsLoaded = true;
+
+    Setting resourceTracking = setting(resourceTrackingEnabledSettingName);
+    if (resourceTracking.type() == Setting::BooleanType && resourceTracking.booleanValue())
+        m_resourceTrackingEnabled = true;
+}
 
 #if ENABLE(DATABASE)
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
@@ -2566,7 +1033,27 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
     m_databaseResources.add(resource);
 
     if (windowVisible())
-        addDatabaseScriptResource(resource.get());
+        resource->bind(m_frontend.get());
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
+{
+    if (!enabled())
+        return;
+
+    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        if ((*it)->isSameHostAndType(frame, isLocalStorage))
+            return;
+
+    RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
+    RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
+
+    m_domStorageResources.add(resource);
+    if (windowVisible())
+        resource->bind(m_frontend.get());
 }
 #endif
 
@@ -2581,32 +1068,166 @@ void InspectorController::moveWindowBy(float x, float y) const
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorController::enableDebugger()
+void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
 {
     if (!enabled())
         return;
 
-    if (!m_scriptContext || !m_scriptObject) {
-        m_attachDebuggerWhenShown = true;
+    RefPtr<Profile> profile = prpProfile;
+    m_profiles.append(profile);
+
+    if (windowVisible())
+        addScriptProfile(profile.get());
+
+    addProfileMessageToConsole(profile, lineNumber, sourceURL);
+}
+
+void InspectorController::addProfileMessageToConsole(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
+{
+    RefPtr<Profile> profile = prpProfile;
+
+    UString message = "Profile \"webkit-profile://";
+    message += encodeWithURLEscapeSequences(profile->title());
+    message += "/";
+    message += UString::from(profile->uid());
+    message += "\" finished.";
+    addMessageToConsole(JSMessageSource, LogMessageLevel, message, lineNumber, sourceURL);
+}
+
+void InspectorController::addScriptProfile(Profile* profile)
+{
+    if (!m_frontend)
         return;
+
+    JSLock lock(false);
+    m_frontend->addProfile(toJS(m_scriptState, profile));
+}
+
+void InspectorController::startUserInitiatedProfilingSoon()
+{
+    m_startProfiling.startOneShot(0);
+}
+
+void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>*)
+{
+    if (!enabled())
+        return;
+
+    if (!profilerEnabled()) {
+        enableProfiler(false, true);
+        JavaScriptDebugServer::shared().recompileAllJSFunctions();
     }
 
+    m_recordingUserInitiatedProfile = true;
+    m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
+
+    UString title = UserInitiatedProfileName;
+    title += ".";
+    title += UString::from(m_currentUserInitiatedProfileNumber);
+
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    Profiler::profiler()->startProfiling(scriptState, title);
+
+    toggleRecordButton(true);
+}
+
+void InspectorController::stopUserInitiatedProfiling()
+{
+    if (!enabled())
+        return;
+
+    m_recordingUserInitiatedProfile = false;
+
+    UString title =  UserInitiatedProfileName;
+    title += ".";
+    title += UString::from(m_currentUserInitiatedProfileNumber);
+
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
+    if (profile)
+        addProfile(profile, 0, UString());
+
+    toggleRecordButton(false);
+}
+
+void InspectorController::toggleRecordButton(bool isProfiling)
+{
+    if (!m_frontend)
+        return;
+    m_frontend->setRecordingProfile(isProfiling);
+}
+
+void InspectorController::enableProfiler(bool always, bool skipRecompile)
+{
+    if (always)
+        setSetting(profilerEnabledSettingName, Setting(true));
+
+    if (m_profilerEnabled)
+        return;
+
+    m_profilerEnabled = true;
+
+    if (!skipRecompile)
+        JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+
+    if (m_frontend)
+        m_frontend->profilerWasEnabled();
+}
+
+void InspectorController::disableProfiler(bool always)
+{
+    if (always)
+        setSetting(profilerEnabledSettingName, Setting(false));
+
+    if (!m_profilerEnabled)
+        return;
+
+    m_profilerEnabled = false;
+
+    JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+
+    if (m_frontend)
+        m_frontend->profilerWasDisabled();
+}
+
+void InspectorController::enableDebuggerFromFrontend(bool always)
+{
+    if (always)
+        setSetting(debuggerEnabledSettingName, Setting(true));
+
     ASSERT(m_inspectedPage);
 
     JavaScriptDebugServer::shared().addListener(this, m_inspectedPage);
     JavaScriptDebugServer::shared().clearBreakpoints();
 
     m_debuggerEnabled = true;
-    m_attachDebuggerWhenShown = false;
+    m_frontend->debuggerWasEnabled();
+}
 
-    callSimpleFunction(m_scriptContext, m_scriptObject, "debuggerWasEnabled");
+void InspectorController::enableDebugger()
+{
+    if (!enabled())
+        return;
+
+    if (m_debuggerEnabled)
+        return;
+
+    if (!m_scriptState || !m_frontend) {
+        m_attachDebuggerWhenShown = true;
+    } else {
+        m_frontend->attachDebuggerWhenShown();
+        m_attachDebuggerWhenShown = false;
+    }
 }
 
-void InspectorController::disableDebugger()
+void InspectorController::disableDebugger(bool always)
 {
     if (!enabled())
         return;
 
+    if (always)
+        setSetting(debuggerEnabledSettingName, Setting(false));
+
     ASSERT(m_inspectedPage);
 
     JavaScriptDebugServer::shared().removeListener(this, m_inspectedPage);
@@ -2614,8 +1235,8 @@ void InspectorController::disableDebugger()
     m_debuggerEnabled = false;
     m_attachDebuggerWhenShown = false;
 
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "debuggerWasDisabled");
+    if (m_frontend)
+        m_frontend->debuggerWasDisabled();
 }
 
 JavaScriptCallFrame* InspectorController::currentCallFrame() const
@@ -2677,28 +1298,48 @@ void InspectorController::removeBreakpoint(intptr_t sourceID, unsigned lineNumbe
 {
     JavaScriptDebugServer::shared().removeBreakpoint(sourceID, lineNumber);
 }
-#endif
 
-static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
+// JavaScriptDebugListener functions
+
+void InspectorController::didParseSource(ExecState*, const SourceCode& source)
 {
-    static const int outlineThickness = 2;
-    static const Color outlineColor(62, 86, 180, 228);
+    m_frontend->parsedScriptSource(source);
+}
 
+void InspectorController::failedToParseSource(ExecState*, const SourceCode& source, int errorLine, const UString& errorMessage)
+{
+    m_frontend->failedToParseScriptSource(source, errorLine, errorMessage);
+}
+
+void InspectorController::didPause()
+{
+    m_frontend->pausedScript();
+}
+
+void InspectorController::didContinue()
+{
+    m_frontend->resumedScript();
+}
+
+#endif
+
+static Path quadToPath(const FloatQuad& quad)
+{
     Path quadPath;
     quadPath.moveTo(quad.p1());
     quadPath.addLineTo(quad.p2());
     quadPath.addLineTo(quad.p3());
     quadPath.addLineTo(quad.p4());
     quadPath.closeSubpath();
-    
-    // Clear the quad
-    {
-        context.save();
-        context.setCompositeOperation(CompositeClear);
-        context.addPath(quadPath);
-        context.fillPath();
-        context.restore();
-    }
+    return quadPath;
+}
+
+static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
+{
+    static const int outlineThickness = 2;
+    static const Color outlineColor(62, 86, 180, 228);
+
+    Path quadPath = quadToPath(quad);
 
     // Clip out the quad, then draw with a 2px stroke to get a pixel
     // of outline (because inflating a quad is hard)
@@ -2721,29 +1362,40 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
     context.fillPath();
 }
 
-static void drawHighlightForBoxes(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
+static void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
+{
+    context.save();
+    Path clipQuadPath = quadToPath(clipQuad);
+    context.clipOut(clipQuadPath);
+    drawOutlinedQuad(context, quad, fillColor);
+    context.restore();
+}
+
+static void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
 {
     static const Color contentBoxColor(125, 173, 217, 128);
     static const Color paddingBoxColor(125, 173, 217, 160);
     static const Color borderBoxColor(125, 173, 217, 192);
     static const Color marginBoxColor(125, 173, 217, 228);
 
-    if (!lineBoxQuads.isEmpty()) {
-        for (size_t i = 0; i < lineBoxQuads.size(); ++i)
-            drawOutlinedQuad(context, lineBoxQuads[i], contentBoxColor);
-        return;
-    }
-
     if (marginQuad != borderQuad)
-        drawOutlinedQuad(context, marginQuad, marginBoxColor);
+        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
     if (borderQuad != paddingQuad)
-        drawOutlinedQuad(context, borderQuad, borderBoxColor);
+        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
     if (paddingQuad != contentQuad)
-        drawOutlinedQuad(context, paddingQuad, paddingBoxColor);
+        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
 
     drawOutlinedQuad(context, contentQuad, contentBoxColor);
 }
 
+static void drawHighlightForLineBoxes(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
+{
+    static const Color lineBoxColor(125, 173, 217, 128);
+
+    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
+        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
+}
+
 static inline void convertFromFrameToMainFrame(Frame* frame, IntRect& rect)
 {
     rect = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(rect));
@@ -2765,66 +1417,52 @@ void InspectorController::drawNodeHighlight(GraphicsContext& context) const
     if (!renderer || !containingFrame)
         return;
 
-    IntRect contentBox = renderer->contentBox();
-
-    // FIXME: Should we add methods to RenderObject to obtain these rects?
-    IntRect paddingBox(contentBox.x() - renderer->paddingLeft(), contentBox.y() - renderer->paddingTop(),
-                       contentBox.width() + renderer->paddingLeft() + renderer->paddingRight(), contentBox.height() + renderer->paddingTop() + renderer->paddingBottom());
-    IntRect borderBox(paddingBox.x() - renderer->borderLeft(), paddingBox.y() - renderer->borderTop(),
-                      paddingBox.width() + renderer->borderLeft() + renderer->borderRight(), paddingBox.height() + renderer->borderTop() + renderer->borderBottom());
-    IntRect marginBox(borderBox.x() - renderer->marginLeft(), borderBox.y() - renderer->marginTop(),
-                      borderBox.width() + renderer->marginLeft() + renderer->marginRight(), borderBox.height() + renderer->marginTop() + renderer->marginBottom());
-
-
     IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
-
-    FloatQuad absContentQuad = renderer->localToAbsoluteQuad(FloatRect(contentBox));
-    FloatQuad absPaddingQuad = renderer->localToAbsoluteQuad(FloatRect(paddingBox));
-    FloatQuad absBorderQuad = renderer->localToAbsoluteQuad(FloatRect(borderBox));
-    FloatQuad absMarginQuad = renderer->localToAbsoluteQuad(FloatRect(marginBox));
-
-    absContentQuad.move(mainFrameOffset);
-    absPaddingQuad.move(mainFrameOffset);
-    absBorderQuad.move(mainFrameOffset);
-    absMarginQuad.move(mainFrameOffset);
-
     IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
     boundingBox.move(mainFrameOffset);
 
-    Vector<FloatQuad> lineBoxQuads;
-    if (renderer->isInline() || (renderer->isText() && !m_highlightedNode->isSVGElement())) {
-        // FIXME: We should show margins/padding/border for inlines.
-        renderer->collectAbsoluteLineBoxQuads(lineBoxQuads);
-    }
-
-    for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
-        lineBoxQuads[i] += mainFrameOffset;
-
-    if (lineBoxQuads.isEmpty() && contentBox.isEmpty()) {
-        // If we have no line boxes and our content box is empty, we'll just draw our bounding box.
-        // This can happen, e.g., with an <a> enclosing an <img style="float:right">.
-        // FIXME: Can we make this better/more accurate? The <a> in the above case has no
-        // width/height but the highlight makes it appear to be the size of the <img>.
-        lineBoxQuads.append(FloatRect(boundingBox));
-    }
-
     ASSERT(m_inspectedPage);
 
     FrameView* view = m_inspectedPage->mainFrame()->view();
     FloatRect overlayRect = view->visibleContentRect();
-
-    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect))) {
-        Element* element;
-        if (m_highlightedNode->isElementNode())
-            element = static_cast<Element*>(m_highlightedNode.get());
-        else
-            element = static_cast<Element*>(m_highlightedNode->parent());
+    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
         overlayRect = view->visibleContentRect();
-    }
-
     context.translate(-overlayRect.x(), -overlayRect.y());
 
-    drawHighlightForBoxes(context, lineBoxQuads, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
+    if (renderer->isBox()) {
+        RenderBox* renderBox = toRenderBox(renderer);
+
+        IntRect contentBox = renderBox->contentBoxRect();
+
+        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
+                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
+        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
+                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
+        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
+                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
+
+        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
+        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
+        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
+        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
+
+        absContentQuad.move(mainFrameOffset);
+        absPaddingQuad.move(mainFrameOffset);
+        absBorderQuad.move(mainFrameOffset);
+        absMarginQuad.move(mainFrameOffset);
+
+        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
+    } else if (renderer->isRenderInline()) {
+        RenderInline* renderInline = toRenderInline(renderer);
+
+        // FIXME: We should show margins/padding/border for inlines.
+        Vector<FloatQuad> lineBoxQuads;
+        renderInline->absoluteQuads(lineBoxQuads);
+        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
+            lineBoxQuads[i] += mainFrameOffset;
+
+        drawHighlightForLineBoxes(context, lineBoxQuads);
+    }
 }
 
 void InspectorController::count(const String& title, unsigned lineNumber, const String& sourceID)
@@ -2863,66 +1501,4 @@ bool InspectorController::stopTiming(const String& title, double& elapsed)
     return true;
 }
 
-bool InspectorController::handleException(JSContextRef context, JSValueRef exception, unsigned lineNumber) const
-{
-    if (!exception)
-        return false;
-
-    if (!m_page)
-        return true;
-
-    String message = toString(context, exception, 0);
-    String file(__FILE__);
-
-    if (JSObjectRef exceptionObject = JSValueToObject(context, exception, 0)) {
-        JSValueRef lineValue = JSObjectGetProperty(context, exceptionObject, jsStringRef("line").get(), NULL);
-        if (lineValue)
-            lineNumber = static_cast<unsigned>(JSValueToNumber(context, lineValue, 0));
-
-        JSValueRef fileValue = JSObjectGetProperty(context, exceptionObject, jsStringRef("sourceURL").get(), NULL);
-        if (fileValue)
-            file = toString(context, fileValue, 0);
-    }
-
-    m_page->mainFrame()->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, lineNumber, file);
-    return true;
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-// JavaScriptDebugListener functions
-
-void InspectorController::didParseSource(ExecState*, const SourceCode& source)
-{
-    JSValueRef sourceIDValue = JSValueMakeNumber(m_scriptContext, source.provider()->asID());
-    JSValueRef sourceURLValue = JSValueMakeString(m_scriptContext, jsStringRef(source.provider()->url()).get());
-    JSValueRef sourceValue = JSValueMakeString(m_scriptContext, jsStringRef(source).get());
-    JSValueRef firstLineValue = JSValueMakeNumber(m_scriptContext, source.firstLine());
-
-    JSValueRef exception = 0;
-    JSValueRef arguments[] = { sourceIDValue, sourceURLValue, sourceValue, firstLineValue };
-    callFunction(m_scriptContext, m_scriptObject, "parsedScriptSource", 4, arguments, exception);
-}
-
-void InspectorController::failedToParseSource(ExecState*, const SourceCode& source, int errorLine, const UString& errorMessage)
-{
-    JSValueRef sourceURLValue = JSValueMakeString(m_scriptContext, jsStringRef(source.provider()->url()).get());
-    JSValueRef sourceValue = JSValueMakeString(m_scriptContext, jsStringRef(source.data()).get());
-    JSValueRef firstLineValue = JSValueMakeNumber(m_scriptContext, source.firstLine());
-    JSValueRef errorLineValue = JSValueMakeNumber(m_scriptContext, errorLine);
-    JSValueRef errorMessageValue = JSValueMakeString(m_scriptContext, jsStringRef(errorMessage).get());
-
-    JSValueRef exception = 0;
-    JSValueRef arguments[] = { sourceURLValue, sourceValue, firstLineValue, errorLineValue, errorMessageValue };
-    callFunction(m_scriptContext, m_scriptObject, "failedToParseScriptSource", 5, arguments, exception);
-}
-
-void InspectorController::didPause()
-{
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "pausedScript", 0, 0, exception);
-}
-
-#endif
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index e52bee9810..e3aa6435a7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -31,22 +31,23 @@
 
 #include "Console.h"
 #include "PlatformString.h"
+#include "ScriptState.h"
 #include "StringHash.h"
 #include "Timer.h"
-#include <JavaScriptCore/JSContextRef.h>
+
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptDebugListener.h"
-#endif
-
 
 namespace JSC {
     class Profile;
     class UString;
 }
+#endif
 
 namespace WebCore {
 
@@ -56,28 +57,34 @@ class DocumentLoader;
 class GraphicsContext;
 class HitTestResult;
 class InspectorClient;
+class InspectorFrontend;
 class JavaScriptCallFrame;
+class StorageArea;
 class Node;
 class Page;
-class ResourceRequest;
+struct ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
+class ScriptObject;
+class ScriptString;
 class SharedBuffer;
 
-struct ConsoleMessage;
-struct InspectorDatabaseResource;
-struct InspectorResource;
+class ConsoleMessage;
+class InspectorDatabaseResource;
+class InspectorDOMStorageResource;
+class InspectorResource;
 
-class InspectorController
+class InspectorController : public RefCounted<InspectorController>
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-                          : JavaScriptDebugListener
+                          , JavaScriptDebugListener
 #endif
                                                     {
 public:
     typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
     typedef HashSet<RefPtr<InspectorDatabaseResource> > DatabaseResourcesSet;
+    typedef HashSet<RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesSet;
 
     typedef enum {
         CurrentPanel,
@@ -99,6 +106,12 @@ public:
         {
         }
 
+        explicit Setting(bool value)
+            : m_type(BooleanType)
+        {
+            m_simpleContent.m_boolean = value;
+        }
+
         Type type() const { return m_type; }
 
         String string() const { ASSERT(m_type == StringType); return m_string; }
@@ -126,7 +139,11 @@ public:
         } m_simpleContent;
     };
 
-    InspectorController(Page*, InspectorClient*);
+    static PassRefPtr<InspectorController> create(Page* page, InspectorClient* inspectorClient)
+    {
+        return adoptRef(new InspectorController(page, inspectorClient));
+    }
+
     ~InspectorController();
 
     void inspectedPageDestroyed();
@@ -140,6 +157,7 @@ public:
     void setSetting(const String& key, const Setting&);
 
     String localizedStringsURL();
+    String hiddenPanels();
 
     void inspect(Node*);
     void highlight(Node*);
@@ -149,27 +167,14 @@ public:
     void showPanel(SpecialPanels);
     void close();
 
-    bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
-    void startUserInitiatedProfilingSoon();
-    void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
-    void stopUserInitiatedProfiling();
-
-    void enableProfiler(bool skipRecompile = false);
-    void disableProfiler();
-    bool profilerEnabled() const { return enabled() && m_profilerEnabled; }
-
     bool windowVisible();
     void setWindowVisible(bool visible = true, bool attached = false);
 
+    void addResourceSourceToFrame(long identifier, Node* frame);
+    bool addSourceToFrame(const String& mimeType, const String& source, Node*);
     void addMessageToConsole(MessageSource, MessageLevel, ScriptCallStack*);
     void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
     void clearConsoleMessages();
-    void toggleRecordButton(bool);
-
-    void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addProfileMessageToConsole(PassRefPtr<JSC::Profile> prpProfile, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addScriptProfile(JSC::Profile* profile);
-    const ProfilesArray& profiles() const { return m_profiles; }
 
     void attachWindow();
     void detachWindow();
@@ -182,13 +187,11 @@ public:
     void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
     void handleMousePressOnNode(Node*);
 
-    JSContextRef scriptContext() const { return m_scriptContext; };
-    void setScriptContext(JSContextRef context) { m_scriptContext = context; };
-
     void inspectedWindowScriptObjectCleared(Frame*);
     void windowScriptObjectAvailable();
 
     void scriptObjectReady();
+    void setFrontendProxyObject(ScriptState* state, ScriptObject object);
 
     void populateScriptObjects();
     void resetScriptObjects();
@@ -204,20 +207,58 @@ public:
     void didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived);
     void didFinishLoading(DocumentLoader*, unsigned long identifier);
     void didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&);
-    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const JSC::UString& sourceString);
+    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+    void scriptImported(unsigned long identifier, const String& sourceString);
+
+    void enableResourceTracking(bool always = false);
+    void disableResourceTracking(bool always = false);
+    bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
+    void ensureResourceTrackingSettingsLoaded();
 
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
 #endif
+#if ENABLE(DOM_STORAGE)
+    void didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame);
+#endif
 
     const ResourcesMap& resources() const { return m_resources; }
 
     void moveWindowBy(float x, float y) const;
     void closeWindow();
 
+    void drawNodeHighlight(GraphicsContext&) const;
+
+    void count(const String& title, unsigned lineNumber, const String& sourceID);
+
+    void startTiming(const String& title);
+    bool stopTiming(const String& title, double& elapsed);
+
+    void startGroup(MessageSource source, ScriptCallStack* callFrame);
+    void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
+
+    const String& platform() const;
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addProfileMessageToConsole(PassRefPtr<JSC::Profile> prpProfile, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addScriptProfile(JSC::Profile* profile);
+    const ProfilesArray& profiles() const { return m_profiles; }
+
+    bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
+
+    void startUserInitiatedProfilingSoon();
+    void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
+    void stopUserInitiatedProfiling();
+    void toggleRecordButton(bool);
+
+    void enableProfiler(bool always = false, bool skipRecompile = false);
+    void disableProfiler(bool always = false);
+    bool profilerEnabled() const { return enabled() && m_profilerEnabled; }
+
+    void enableDebuggerFromFrontend(bool always);
     void enableDebugger();
-    void disableDebugger();
+    void disableDebugger(bool always = false);
     bool debuggerEnabled() const { return m_debuggerEnabled; }
 
     JavaScriptCallFrame* currentCallFrame() const;
@@ -234,61 +275,32 @@ public:
     void stepOverStatementInDebugger();
     void stepIntoStatementInDebugger();
     void stepOutOfFunctionInDebugger();
-#endif
-
-    void drawNodeHighlight(GraphicsContext&) const;
-    
-    void count(const String& title, unsigned lineNumber, const String& sourceID);
-
-    void startTiming(const String& title);
-    bool stopTiming(const String& title, double& elapsed);
 
-    void startGroup(MessageSource source, ScriptCallStack* callFrame);
-    void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
+    virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode&);
+    virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
+    virtual void didPause();
+    virtual void didContinue();
+#endif
 
 private:
+    InspectorController(Page*, InspectorClient*);
+
     void focusNode();
 
-    void addConsoleMessage(JSC::ExecState*, ConsoleMessage*);
-    void addScriptConsoleMessage(const ConsoleMessage*);
+    void addConsoleMessage(ScriptState*, ConsoleMessage*);
 
     void addResource(InspectorResource*);
     void removeResource(InspectorResource*);
 
-    JSObjectRef addScriptResource(InspectorResource*);
-    void removeScriptResource(InspectorResource*);
-
-    JSObjectRef addAndUpdateScriptResource(InspectorResource*);
-    void updateScriptResourceRequest(InspectorResource*);
-    void updateScriptResourceResponse(InspectorResource*);
-    void updateScriptResourceType(InspectorResource*);
-    void updateScriptResource(InspectorResource*, int length);
-    void updateScriptResource(InspectorResource*, bool finished, bool failed = false);
-    void updateScriptResource(InspectorResource*, double startTime, double responseReceivedTime, double endTime);
-
     void pruneResources(ResourcesMap*, DocumentLoader* loaderToKeep = 0);
     void removeAllResources(ResourcesMap* map) { pruneResources(map); }
 
-#if ENABLE(DATABASE)
-    JSObjectRef addDatabaseScriptResource(InspectorDatabaseResource*);
-    void removeDatabaseScriptResource(InspectorDatabaseResource*);
-#endif
-
-    JSValueRef callSimpleFunction(JSContextRef, JSObjectRef thisObject, const char* functionName) const;
-    JSValueRef callFunction(JSContextRef, JSObjectRef thisObject, const char* functionName, size_t argumentCount, const JSValueRef arguments[], JSValueRef& exception) const;
-
-    bool handleException(JSContextRef, JSValueRef exception, unsigned lineNumber) const;
-
     void showWindow();
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode&);
-    virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
-    virtual void didPause();
-#endif
 
     Page* m_inspectedPage;
     InspectorClient* m_client;
+    OwnPtr<InspectorFrontend> m_frontend;
     Page* m_page;
     RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResource> m_mainResource;
@@ -296,31 +308,34 @@ private:
     HashSet<String> m_knownResources;
     FrameResourcesMap m_frameResources;
     Vector<ConsoleMessage*> m_consoleMessages;
-    ProfilesArray m_profiles;
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
     DatabaseResourcesSet m_databaseResources;
 #endif
-    JSObjectRef m_scriptObject;
-    JSObjectRef m_controllerScriptObject;
-    JSContextRef m_scriptContext;
-    bool m_windowVisible;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    bool m_debuggerEnabled;
-    bool m_attachDebuggerWhenShown;
+#if ENABLE(DOM_STORAGE)
+    DOMStorageResourcesSet m_domStorageResources;
 #endif
-    bool m_profilerEnabled;
-    bool m_recordingUserInitiatedProfile;
+    ScriptState* m_scriptState;
+    bool m_windowVisible;
     SpecialPanels m_showAfterVisible;
     long long m_nextIdentifier;
     RefPtr<Node> m_highlightedNode;
     unsigned m_groupLevel;
     bool m_searchingForNode;
+    ConsoleMessage* m_previousMessage;
+    bool m_resourceTrackingEnabled;
+    bool m_resourceTrackingSettingsLoaded;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    bool m_debuggerEnabled;
+    bool m_attachDebuggerWhenShown;
+    bool m_profilerEnabled;
+    bool m_recordingUserInitiatedProfile;
     int m_currentUserInitiatedProfileNumber;
     unsigned m_nextUserInitiatedProfileNumber;
-    ConsoleMessage* m_previousMessage;
     Timer<InspectorController> m_startProfiling;
+    ProfilesArray m_profiles;
+#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorController.idl
new file mode 100644
index 0000000000..920786a1ae
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.idl
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        GenerateConstructor
+    ] InspectorController {
+        [ImplementationFunction=hideHighlight] void hideDOMNodeHighlight();
+        [Custom] void highlightDOMNode(in Node node);
+        [ImplementationFunction=scriptObjectReady] void loaded();
+        [ImplementationFunction=close] void windowUnloading();
+        [ImplementationFunction=attachWindow] void attach();
+        [ImplementationFunction=detachWindow] void detach();
+
+        void closeWindow();
+        [ImplementationFunction=clearConsoleMessages] void clearMessages();
+        [ImplementationFunction=toggleSearchForNodeInPage] void toggleNodeSearch();
+
+        [ImplementationFunction=windowVisible] boolean isWindowVisible();
+        [ImplementationFunction=searchingForNodeInPage] boolean searchingForNode();
+
+        void addResourceSourceToFrame(in long identifier, in Node frame);
+        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
+        [Custom] Node getResourceDocumentNode(in long long identifier);
+        [Custom] void search(in Node node, in DOMString query);
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] DOMObject databaseTableNames(in Database database);
+#endif
+        [Custom] DOMObject setting(in DOMString key);
+        [Custom] void setSetting(in DOMString key, in DOMObject  value);
+        [Custom] DOMWindow inspectedWindow();
+        DOMString localizedStringsURL();
+        DOMString hiddenPanels();
+        DOMString platform();
+        [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
+        void setAttachedWindowHeight(in unsigned long height);
+        [Custom] DOMObject wrapCallback(in DOMObject callback);
+        boolean resourceTrackingEnabled();
+        void enableResourceTracking(in boolean always);
+        void disableResourceTracking(in boolean always);
+
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        void enableDebuggerFromFrontend(in boolean always);
+        void disableDebugger(in boolean always);
+        void pauseInDebugger();
+        void resumeDebugger();
+        void stepOverStatementInDebugger();
+        void stepIntoStatementInDebugger();
+        void stepOutOfFunctionInDebugger();
+        boolean debuggerEnabled();
+        boolean pauseOnExceptions();
+        boolean profilerEnabled();
+        [ImplementationFunction=startUserInitiatedProfiling] void startProfiling();
+        [ImplementationFunction=stopUserInitiatedProfiling] void stopProfiling();
+        void enableProfiler(in boolean always);
+        void disableProfiler(in boolean always);
+        [Custom] DOMObject currentCallFrame();
+        void setPauseOnExceptions(in boolean pauseOnExceptions);
+        void addBreakpoint(in unsigned long sourceID, in unsigned long lineNumber);
+        void removeBreakpoint(in unsigned long sourceID, in unsigned long lineNumber);
+
+        [Custom] Array profiles();
+#endif
+     };
+ }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
new file mode 100644
index 0000000000..1f3522e53f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DOM_STORAGE)
+
+#include "InspectorDOMStorageResource.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
+#include "ScriptObjectQuarantine.h"
+#include "Storage.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+InspectorDOMStorageResource::InspectorDOMStorageResource(Storage* domStorage, bool isLocalStorage, Frame* frame)
+    : m_domStorage(domStorage)
+    , m_isLocalStorage(isLocalStorage)
+    , m_frame(frame)
+    , m_scriptObjectCreated(false)
+{
+}
+
+bool InspectorDOMStorageResource::isSameHostAndType(Frame* frame, bool isLocalStorage) const
+{
+    return equalIgnoringCase(m_frame->document()->securityOrigin()->host(), frame->document()->securityOrigin()->host()) && m_isLocalStorage == isLocalStorage;
+}
+
+void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
+{
+    if (m_scriptObjectCreated)
+        return;
+
+    JSONObject jsonObject = frontend->newJSONObject();
+    ScriptObject domStorage;
+    if (!getQuarantinedScriptObject(m_frame.get(), m_domStorage.get(), domStorage))
+        return;
+    jsonObject.set("domStorage", domStorage);
+    jsonObject.set("host", m_frame->document()->securityOrigin()->host());
+    jsonObject.set("isLocalStorage", m_isLocalStorage);
+    if (frontend->addDOMStorage(jsonObject))
+        m_scriptObjectCreated = true;
+}
+
+void InspectorDOMStorageResource::unbind()
+{
+    m_scriptObjectCreated = false;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.h
new file mode 100644
index 0000000000..3e05897eda
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorDOMStorageResource_h
+#define InspectorDOMStorageResource_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class Storage;
+    class Frame;
+    class InspectorFrontend;
+
+    class InspectorDOMStorageResource : public RefCounted<InspectorDOMStorageResource> {
+    public:
+        static PassRefPtr<InspectorDOMStorageResource> create(Storage* domStorage, bool isLocalStorage, Frame* frame)
+        {
+            return adoptRef(new InspectorDOMStorageResource(domStorage, isLocalStorage, frame));
+        }
+
+        void bind(InspectorFrontend* frontend);
+        void unbind();
+
+        bool isSameHostAndType(Frame*, bool isLocalStorage) const;
+
+    private:
+
+        InspectorDOMStorageResource(Storage*, bool isLocalStorage, Frame*);
+
+        RefPtr<Storage> m_domStorage;
+        bool m_isLocalStorage;
+        RefPtr<Frame> m_frame;
+        bool m_scriptObjectCreated;
+
+    };
+
+} // namespace WebCore
+
+#endif
+
+#endif // InspectorDOMStorageResource_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
new file mode 100644
index 0000000000..b61344cadf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATABASE)
+#include "InspectorDatabaseResource.h"
+
+#include "Database.h"
+#include "Document.h"
+#include "Frame.h"
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
+#include "ScriptObjectQuarantine.h"
+
+
+namespace WebCore {
+
+InspectorDatabaseResource::InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
+    : m_database(database)
+    , m_domain(domain)
+    , m_name(name)
+    , m_version(version)
+    , m_scriptObjectCreated(false)
+{
+}
+
+void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
+{
+    if (m_scriptObjectCreated)
+        return;
+
+    JSONObject jsonObject = frontend->newJSONObject();
+    ScriptObject database;
+    if (!getQuarantinedScriptObject(m_database.get(), database))
+        return;
+    jsonObject.set("database", database);
+    jsonObject.set("domain", m_domain);
+    jsonObject.set("name", m_name);
+    jsonObject.set("version", m_version);
+    if (frontend->addDatabase(jsonObject))
+        m_scriptObjectCreated = true;
+}
+
+void InspectorDatabaseResource::unbind()
+{
+    m_scriptObjectCreated = false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
new file mode 100644
index 0000000000..38f9fa1f99
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorDatabaseResource_h
+#define InspectorDatabaseResource_h
+
+#if ENABLE(DATABASE)
+
+#include "Database.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+    class InspectorFrontend;
+    
+    class InspectorDatabaseResource : public RefCounted<InspectorDatabaseResource> {
+    public:
+        static PassRefPtr<InspectorDatabaseResource> create(Database* database, const String& domain, const String& name, const String& version)
+        {
+            return adoptRef(new InspectorDatabaseResource(database, domain, name, version));
+        }
+
+        void bind(InspectorFrontend* frontend);
+        void unbind();
+
+    private:
+        InspectorDatabaseResource(Database*, const String& domain, const String& name, const String& version);
+        
+        RefPtr<Database> m_database;
+        String m_domain;
+        String m_name;
+        String m_version;
+        bool m_scriptObjectCreated;
+
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
+
+#endif // InspectorDatabaseResource_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
new file mode 100644
index 0000000000..aacbb90053
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontend.h"
+
+#include "ConsoleMessage.h"
+#include "Frame.h"
+#include "InspectorController.h"  // TODO(pfeldman): Extract SpecialPanels to remove include.
+#include "JSONObject.h"
+#include "Node.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+#include "ScriptObjectQuarantine.h"
+#include "ScriptState.h"
+#include "ScriptString.h"
+#include <wtf/OwnPtr.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include <parser/SourceCode.h>
+#include <runtime/JSValue.h>
+#include <runtime/UString.h>
+#endif
+
+namespace WebCore {
+
+InspectorFrontend::InspectorFrontend(ScriptState* scriptState, ScriptObject webInspector)
+    : m_scriptState(scriptState)
+    , m_webInspector(webInspector)
+{
+}
+
+InspectorFrontend::~InspectorFrontend() 
+{
+    m_webInspector = ScriptObject();
+}
+
+JSONObject InspectorFrontend::newJSONObject() {
+    return JSONObject::createNew(m_scriptState);
+}
+
+void InspectorFrontend::addMessageToConsole(const JSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
+    function->appendArgument(messageObj.scriptObject());
+    if (!frames.isEmpty()) {
+        for (unsigned i = 0; i < frames.size(); ++i)
+            function->appendArgument(frames[i]);
+    } else if (!wrappedArguments.isEmpty()) {
+        for (unsigned i = 0; i < wrappedArguments.size(); ++i)
+            function->appendArgument(wrappedArguments[i]);
+    } else
+        function->appendArgument(message);
+    function->call();
+}
+
+bool InspectorFrontend::addResource(long long identifier, const JSONObject& resourceObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
+    function->appendArgument(identifier);
+    function->appendArgument(resourceObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+bool InspectorFrontend::updateResource(long long identifier, const JSONObject& resourceObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateResource"));
+    function->appendArgument(identifier);
+    function->appendArgument(resourceObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::removeResource(long long identifier)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("removeResource"));
+    function->appendArgument(identifier);
+    function->call();
+}
+
+void InspectorFrontend::updateFocusedNode(Node* node)
+{
+    ScriptObject quarantinedNode;
+    if (!getQuarantinedScriptObject(node, quarantinedNode))
+        return;
+
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
+    function->appendArgument(quarantinedNode);
+    function->call();
+}
+
+void InspectorFrontend::setAttachedWindow(bool attached)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setAttachedWindow"));
+    function->appendArgument(attached);
+    function->call();
+}
+
+void InspectorFrontend::inspectedWindowScriptObjectCleared(Frame* frame)
+{
+    ScriptObject domWindow;
+    if (!getQuarantinedScriptObject(frame->domWindow(), domWindow))
+        return;
+
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("inspectedWindowCleared"));
+    function->appendArgument(domWindow);
+    function->call();
+}
+
+void InspectorFrontend::showPanel(int panel)
+{
+    const char* showFunctionName;
+    switch (panel) {
+        case InspectorController::ConsolePanel:
+            showFunctionName = "showConsole";
+            break;
+        case InspectorController::DatabasesPanel:
+            showFunctionName = "showDatabasesPanel";
+            break;
+        case InspectorController::ElementsPanel:
+            showFunctionName = "showElementsPanel";
+            break;
+        case InspectorController::ProfilesPanel:
+            showFunctionName = "showProfilesPanel";
+            break;
+        case InspectorController::ResourcesPanel:
+            showFunctionName = "showResourcesPanel";
+            break;
+        case InspectorController::ScriptsPanel:
+            showFunctionName = "showScriptsPanel";
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            showFunctionName = 0;
+    }
+
+    if (showFunctionName)
+        callSimpleFunction(showFunctionName);
+}
+
+void InspectorFrontend::populateInterface()
+{
+    callSimpleFunction("populateInterface");
+}
+
+void InspectorFrontend::reset()
+{
+    callSimpleFunction("reset");
+}
+
+void InspectorFrontend::resourceTrackingWasEnabled()
+{
+    callSimpleFunction("resourceTrackingWasEnabled");
+}
+
+void InspectorFrontend::resourceTrackingWasDisabled()
+{
+    callSimpleFunction("resourceTrackingWasDisabled");
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+void InspectorFrontend::attachDebuggerWhenShown()
+{
+    callSimpleFunction("attachDebuggerWhenShown");
+}
+
+void InspectorFrontend::debuggerWasEnabled()
+{
+    callSimpleFunction("debuggerWasEnabled");
+}
+
+void InspectorFrontend::debuggerWasDisabled()
+{
+    callSimpleFunction("debuggerWasDisabled");
+}
+
+void InspectorFrontend::profilerWasEnabled()
+{
+    callSimpleFunction("profilerWasEnabled");
+}
+
+void InspectorFrontend::profilerWasDisabled()
+{
+    callSimpleFunction("profilerWasDisabled");
+}
+
+void InspectorFrontend::parsedScriptSource(const JSC::SourceCode& source)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("parsedScriptSource"));
+    function->appendArgument(static_cast<long long>(source.provider()->asID()));
+    function->appendArgument(source.provider()->url());
+    function->appendArgument(JSC::UString(source.data(), source.length()));
+    function->appendArgument(source.firstLine());
+    function->call();
+}
+
+void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("failedToParseScriptSource"));
+    function->appendArgument(source.provider()->url());
+    function->appendArgument(JSC::UString(source.data(), source.length()));
+    function->appendArgument(source.firstLine());
+    function->appendArgument(errorLine);
+    function->appendArgument(errorMessage);
+    function->call();
+}
+
+void InspectorFrontend::addProfile(const JSC::JSValue& profile)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfile"));
+    function->appendArgument(profile);
+    function->call();
+}
+
+void InspectorFrontend::setRecordingProfile(bool isProfiling)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setRecordingProfile"));
+    function->appendArgument(isProfiling);
+    function->call();
+}
+
+void InspectorFrontend::pausedScript()
+{
+    callSimpleFunction("pausedScript");
+}
+
+void InspectorFrontend::resumedScript()
+{
+    callSimpleFunction("resumedScript");
+}
+#endif
+
+#if ENABLE(DATABASE)
+bool InspectorFrontend::addDatabase(const JSONObject& dbObject)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
+    function->appendArgument(dbObject.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool InspectorFrontend::addDOMStorage(const JSONObject& domStorageObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
+    function->appendArgument(domStorageObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+#endif
+
+PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
+{
+    ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
+    function->appendArgument(functionName);
+    return function;
+}
+
+void InspectorFrontend::callSimpleFunction(const String& functionName)
+{
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch");
+    function.appendArgument(functionName);
+    function.call();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
new file mode 100644
index 0000000000..d596b3fb9b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontend_h
+#define InspectorFrontend_h
+
+#include "JSONObject.h"
+#include "ScriptState.h"
+#include <wtf/PassOwnPtr.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+namespace JSC {
+    class JSValue;
+    class SourceCode;
+    class UString;
+}
+#endif
+
+namespace WebCore {
+    class ConsoleMessage;
+    class InspectorResource;
+    class Node;
+    class ScriptFunctionCall;
+    class ScriptString;
+
+    class InspectorFrontend {
+    public:
+        InspectorFrontend(ScriptState*, ScriptObject webInspector);
+        ~InspectorFrontend();
+        JSONObject newJSONObject();
+
+        void addMessageToConsole(const JSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        
+        bool addResource(long long identifier, const JSONObject& resourceObj);
+        bool updateResource(long long identifier, const JSONObject& resourceObj);
+        void removeResource(long long identifier);
+
+        void updateFocusedNode(Node* node);
+        void setAttachedWindow(bool attached);
+        void inspectedWindowScriptObjectCleared(Frame* frame);
+        void showPanel(int panel);
+        void populateInterface();
+        void reset();
+
+        void resourceTrackingWasEnabled();
+        void resourceTrackingWasDisabled();
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        void attachDebuggerWhenShown();
+        void debuggerWasEnabled();
+        void debuggerWasDisabled();
+        void profilerWasEnabled();
+        void profilerWasDisabled();
+        void parsedScriptSource(const JSC::SourceCode&);
+        void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
+        void addProfile(const JSC::JSValue& profile);
+        void setRecordingProfile(bool isProfiling);
+        void pausedScript();
+        void resumedScript();
+#endif
+
+#if ENABLE(DATABASE)
+        bool addDatabase(const JSONObject& dbObj);
+#endif
+        
+#if ENABLE(DOM_STORAGE)
+        bool addDOMStorage(const JSONObject& domStorageObj);
+#endif
+
+    private:
+        PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
+        void callSimpleFunction(const String& functionName);
+        ScriptState* m_scriptState;
+        ScriptObject m_webInspector;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(InspectorFrontend_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
new file mode 100644
index 0000000000..6184119e53
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
@@ -0,0 +1,325 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorResource.h"
+
+#include "CachedResource.h"
+#include "DocLoader.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "TextEncoding.h"
+
+namespace WebCore {
+
+InspectorResource::InspectorResource(long long identifier, DocumentLoader* loader)
+    : m_identifier(identifier)
+    , m_loader(loader)
+    , m_frame(loader->frame())
+    , m_scriptObjectCreated(false)
+    , m_expectedContentLength(0)
+    , m_cached(false)
+    , m_finished(false)
+    , m_failed(false)
+    , m_length(0)
+    , m_responseStatusCode(0)
+    , m_startTime(-1.0)
+    , m_responseReceivedTime(-1.0)
+    , m_endTime(-1.0)
+    , m_isMainResource(false)
+{
+}
+
+InspectorResource::~InspectorResource()
+{
+}
+
+PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
+{
+    PassRefPtr<InspectorResource> resource = create(identifier, loader);
+
+    resource->m_finished = true;
+
+    resource->m_requestURL = KURL(cachedResource->url());
+    resource->updateResponse(cachedResource->response());
+
+    resource->m_length = cachedResource->encodedSize();
+    resource->m_cached = true;
+    resource->m_startTime = currentTime();
+    resource->m_responseReceivedTime = resource->m_startTime;
+    resource->m_endTime = resource->m_startTime;
+
+    resource->m_changes.setAll();
+
+    return resource;
+}
+
+void InspectorResource::updateRequest(const ResourceRequest& request)
+{
+    m_requestHeaderFields = request.httpHeaderFields();
+    m_requestURL = request.url();
+
+    m_changes.set(RequestChange);
+}
+
+void InspectorResource::updateResponse(const ResourceResponse& response)
+{
+    m_expectedContentLength = response.expectedContentLength();
+    m_mimeType = response.mimeType();
+    m_responseHeaderFields = response.httpHeaderFields();
+    m_responseStatusCode = response.httpStatusCode();
+    m_suggestedFilename = response.suggestedFilename();
+
+    m_changes.set(ResponseChange);
+    m_changes.set(TypeChange);
+}
+
+static void populateHeadersObject(JSONObject* object, const HTTPHeaderMap& headers)
+{
+    HTTPHeaderMap::const_iterator end = headers.end();
+    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it) {
+        object->set(it->first.string(), it->second);
+    }
+}
+
+void InspectorResource::createScriptObject(InspectorFrontend* frontend)
+{
+    if (!m_scriptObjectCreated) {
+        JSONObject jsonObject = frontend->newJSONObject();
+        JSONObject requestHeaders = frontend->newJSONObject();
+        populateHeadersObject(&requestHeaders, m_requestHeaderFields);
+        jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("requestURL", requestURL());
+        jsonObject.set("host", m_requestURL.host());
+        jsonObject.set("path", m_requestURL.path());
+        jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
+        jsonObject.set("isMainResource", m_isMainResource);
+        jsonObject.set("cached", m_cached);
+        if (!frontend->addResource(m_identifier, jsonObject))
+            return;
+
+        m_scriptObjectCreated = true;
+        m_changes.clear(RequestChange);
+    }
+    updateScriptObject(frontend);
+}
+
+void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
+{
+    if (!m_scriptObjectCreated)
+        return;
+
+    if (m_changes.hasChange(NoChange))
+        return;
+
+    JSONObject jsonObject = frontend->newJSONObject();
+    if (m_changes.hasChange(RequestChange)) {
+        jsonObject.set("url", requestURL());
+        jsonObject.set("domain", m_requestURL.host());
+        jsonObject.set("path", m_requestURL.path());
+        jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
+        JSONObject requestHeaders = frontend->newJSONObject();
+        populateHeadersObject(&requestHeaders, m_requestHeaderFields);
+        jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("mainResource", m_isMainResource);
+        jsonObject.set("didRequestChange", true);
+    }
+
+    if (m_changes.hasChange(ResponseChange)) {
+        jsonObject.set("mimeType", m_mimeType);
+        jsonObject.set("suggestedFilename", m_suggestedFilename);
+        jsonObject.set("expectedContentLength", m_expectedContentLength);
+        jsonObject.set("statusCode", m_responseStatusCode);
+        jsonObject.set("suggestedFilename", m_suggestedFilename);
+        JSONObject responseHeaders = frontend->newJSONObject();
+        populateHeadersObject(&responseHeaders, m_responseHeaderFields);
+        jsonObject.set("responseHeaders", responseHeaders);
+        jsonObject.set("didResponseChange", true);
+    }
+
+    if (m_changes.hasChange(TypeChange)) {
+        jsonObject.set("type", static_cast<int>(type()));
+        jsonObject.set("didTypeChange", true);
+    }
+    
+    if (m_changes.hasChange(LengthChange)) {
+        jsonObject.set("contentLength", m_length);
+        jsonObject.set("didLengthChange", true);
+    }
+
+    if (m_changes.hasChange(CompletionChange)) {
+        jsonObject.set("failed", m_failed);
+        jsonObject.set("finished", m_finished);
+        jsonObject.set("didCompletionChange", true);
+    }
+
+    if (m_changes.hasChange(TimingChange)) {
+        if (m_startTime > 0)
+            jsonObject.set("startTime", m_startTime);
+        if (m_responseReceivedTime > 0)
+            jsonObject.set("responseReceivedTime", m_responseReceivedTime);
+        if (m_endTime > 0)
+            jsonObject.set("endTime", m_endTime);
+        jsonObject.set("didTimingChange", true);
+    }
+    if (!frontend->updateResource(m_identifier, jsonObject))
+        return;
+    m_changes.clearAll();
+}
+
+void InspectorResource::releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource)
+{
+    if (!m_scriptObjectCreated)
+        return;
+
+    m_scriptObjectCreated = false;
+    m_changes.setAll();
+
+    if (!callRemoveResource)
+        return;
+
+    frontend->removeResource(m_identifier);
+}
+
+InspectorResource::Type InspectorResource::type() const
+{
+    if (!m_xmlHttpResponseText.isNull())
+        return XHR;
+
+    if (m_requestURL == m_loader->requestURL())
+        return Doc;
+
+    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
+        return Image;
+
+    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    if (!cachedResource)
+        return Other;
+
+    switch (cachedResource->type()) {
+        case CachedResource::ImageResource:
+            return Image;
+        case CachedResource::FontResource:
+            return Font;
+        case CachedResource::CSSStyleSheet:
+#if ENABLE(XSLT)
+        case CachedResource::XSLStyleSheet:
+#endif
+            return Stylesheet;
+        case CachedResource::Script:
+            return Script;
+        default:
+            return Other;
+    }
+}
+
+void InspectorResource::setXMLHttpResponseText(const ScriptString& data)
+{
+    m_xmlHttpResponseText = data;
+    m_changes.set(TypeChange);
+}
+
+String InspectorResource::sourceString() const
+{
+    if (!m_xmlHttpResponseText.isNull())
+        return String(m_xmlHttpResponseText);
+
+    RefPtr<SharedBuffer> buffer;
+    String textEncodingName;
+
+    if (m_requestURL == m_loader->requestURL()) {
+        buffer = m_loader->mainResourceData();
+        textEncodingName = m_frame->document()->inputEncoding();
+    } else {
+        CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+        if (!cachedResource)
+            return String();
+
+        if (cachedResource->isPurgeable()) {
+            // If the resource is purgeable then make it unpurgeable to get
+            // get its data. This might fail, in which case we return an
+            // empty String.
+            // FIXME: should we do something else in the case of a purged
+            // resource that informs the user why there is no data in the
+            // inspector?
+            if (!cachedResource->makePurgeable(false))
+                return String();
+        }
+
+        buffer = cachedResource->data();
+        textEncodingName = cachedResource->encoding();
+    }
+
+    if (!buffer)
+        return String();
+
+    TextEncoding encoding(textEncodingName);
+    if (!encoding.isValid())
+        encoding = WindowsLatin1Encoding();
+    return encoding.decode(buffer->data(), buffer->size());
+}
+
+void InspectorResource::startTiming()
+{
+    m_startTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::markResponseReceivedTime()
+{
+    m_responseReceivedTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::endTiming()
+{
+    m_endTime = currentTime();
+    m_finished = true;
+    m_changes.set(TimingChange);
+    m_changes.set(CompletionChange);
+}
+
+void InspectorResource::markFailed()
+{
+    m_failed = true;
+    m_changes.set(CompletionChange);
+}
+
+void InspectorResource::addLength(int lengthReceived)
+{
+    m_length += lengthReceived;
+    m_changes.set(LengthChange);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
new file mode 100644
index 0000000000..8380a8f5c1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorResource_h
+#define InspectorResource_h
+
+#include "HTTPHeaderMap.h"
+#include "KURL.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+#include "ScriptString.h"
+
+#include <wtf/CurrentTime.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class CachedResource;
+    class DocumentLoader;
+    class InspectorFrontend;
+    class Frame;
+    class ResourceResponse;
+
+    struct ResourceRequest;
+
+    class InspectorResource : public RefCounted<InspectorResource> {
+    public:
+
+        // Keep these in sync with WebInspector.Resource.Type
+        enum Type {
+            Doc,
+            Stylesheet,
+            Image,
+            Font,
+            Script,
+            XHR,
+            Media,
+            Other
+        };
+
+        static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* loader)
+        {
+            return adoptRef(new InspectorResource(identifier, loader));
+        }
+
+        static PassRefPtr<InspectorResource> createCached(long long identifier, DocumentLoader*, const CachedResource*);
+
+        ~InspectorResource();
+
+        void createScriptObject(InspectorFrontend* frontend);
+        void updateScriptObject(InspectorFrontend* frontend);
+        void releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource);
+
+        void updateRequest(const ResourceRequest&);
+        void updateResponse(const ResourceResponse&);
+
+        void setXMLHttpResponseText(const ScriptString& data);
+
+        String sourceString() const;
+        bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
+        void markMainResource() { m_isMainResource = true; }
+        long long identifier() const { return m_identifier; }
+        String requestURL() const { return m_requestURL.string(); }
+        Frame* frame() const { return m_frame.get(); }
+        const String& mimeType() const { return m_mimeType; }
+        void startTiming();
+        void markResponseReceivedTime();
+        void endTiming();
+
+        void markFailed();
+        void addLength(int lengthReceived);
+
+    private:
+        enum ChangeType {
+            NoChange = 0,
+            RequestChange = 1,
+            ResponseChange = 2,
+            TypeChange = 4,
+            LengthChange = 8,
+            CompletionChange = 16,
+            TimingChange = 32
+        };
+
+        class Changes {
+        public:
+            Changes() : m_change(NoChange) {}
+
+            inline bool hasChange(ChangeType change) { return (m_change & change) || !(m_change + change); }
+            inline void set(ChangeType change)
+            {
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));            
+            }
+            inline void clear(ChangeType change)
+            {
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) & ~static_cast<unsigned>(change));
+            }
+
+            inline void setAll() { m_change = static_cast<ChangeType>(63); }
+            inline void clearAll() { m_change = NoChange; }
+
+        private:
+            ChangeType m_change;
+        };
+
+        InspectorResource(long long identifier, DocumentLoader*);
+        Type type() const;
+
+        long long m_identifier;
+        RefPtr<DocumentLoader> m_loader;
+        RefPtr<Frame> m_frame;
+        KURL m_requestURL;
+        HTTPHeaderMap m_requestHeaderFields;
+        HTTPHeaderMap m_responseHeaderFields;
+        String m_mimeType;
+        String m_suggestedFilename;
+        bool m_scriptObjectCreated;
+        long long m_expectedContentLength;
+        bool m_cached;
+        bool m_finished;
+        bool m_failed;
+        int m_length;
+        int m_responseStatusCode;
+        double m_startTime;
+        double m_responseReceivedTime;
+        double m_endTime;
+        ScriptString m_xmlHttpResponseText;
+        Changes m_changes;
+        bool m_isMainResource;
+    };
+
+} // namespace WebCore
+
+#endif // InspectorResource_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JSONObject.cpp b/src/3rdparty/webkit/WebCore/inspector/JSONObject.cpp
new file mode 100644
index 0000000000..b13ddee622
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/JSONObject.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSONObject.h"
+
+#include "PlatformString.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+namespace WebCore {
+
+JSONObject::JSONObject(ScriptState* scriptState)
+    : m_scriptState(scriptState)
+{
+    m_scriptObject = ScriptObject::createNew(scriptState);
+}
+
+bool JSONObject::set(const String& name, const String& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, const ScriptObject& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, const JSONObject& value)
+{
+    return set(name, value.scriptObject());
+}
+
+bool JSONObject::set(const char* name, const String& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, double value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, long long value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, int value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, bool value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+ScriptObject JSONObject::scriptObject() const
+{
+    return m_scriptObject;
+}
+
+JSONObject JSONObject::createNew(ScriptState* scriptState)
+{
+    return JSONObject(scriptState);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/JSONObject.h b/src/3rdparty/webkit/WebCore/inspector/JSONObject.h
new file mode 100644
index 0000000000..39e64f0588
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/JSONObject.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef JSONObject_h
+#define JSONObject_h
+
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+namespace WebCore {
+    class String;
+
+    class JSONObject {
+    public:
+        bool set(const String& name, const String&);
+        bool set(const char* name, const JSONObject&);
+        bool set(const char* name, const ScriptObject&);
+        bool set(const char* name, const String&);
+        bool set(const char* name, double);
+        bool set(const char* name, long long);
+        bool set(const char* name, int);
+        bool set(const char* name, bool);
+        ScriptObject scriptObject() const;
+
+        static JSONObject createNew(ScriptState* scriptState);
+    private:
+        JSONObject(ScriptState* scriptState);
+        ScriptState* m_scriptState;
+        ScriptObject m_scriptObject;
+    };
+}
+
+#endif // JSONObject_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
index 49628923df..6e8fce92ed 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptCallFrame.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "PlatformString.h"
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/JSGlobalObject.h>
@@ -37,7 +39,7 @@
 using namespace JSC;
 
 namespace WebCore {
-
+    
 JavaScriptCallFrame::JavaScriptCallFrame(const DebuggerCallFrame& debuggerCallFrame, PassRefPtr<JavaScriptCallFrame> caller, intptr_t sourceID, int line)
     : m_debuggerCallFrame(debuggerCallFrame)
     , m_caller(caller)
@@ -65,10 +67,10 @@ String JavaScriptCallFrame::functionName() const
     ASSERT(m_isValid);
     if (!m_isValid)
         return String();
-    const UString* functionName = m_debuggerCallFrame.functionName();
-    if (!functionName)
+    UString functionName = m_debuggerCallFrame.calculatedFunctionName();
+    if (functionName.isEmpty())
         return String();
-    return *functionName;
+    return functionName;
 }
 
 DebuggerCallFrame::Type JavaScriptCallFrame::type() const
@@ -88,7 +90,7 @@ JSObject* JavaScriptCallFrame::thisObject() const
 }
 
 // Evaluate some JavaScript code in the scope of this frame.
-JSValuePtr JavaScriptCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
+JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception) const
 {
     ASSERT(m_isValid);
     if (!m_isValid)
@@ -99,3 +101,5 @@ JSValuePtr JavaScriptCallFrame::evaluate(const UString& script, JSValuePtr& exce
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
index 6b55bb9ef0..9f193d8733 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptCallFrame_h
 #define JavaScriptCallFrame_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <interpreter/CallFrame.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -61,18 +63,20 @@ namespace WebCore {
         const JSC::ScopeChainNode* scopeChain() const;
 
         JSC::JSObject* thisObject() const;
-        JSC::JSValuePtr evaluate(const JSC::UString& script, JSC::JSValuePtr& exception) const;
+        JSC::JSValue evaluate(const JSC::UString& script, JSC::JSValue& exception) const;
         
     private:
         JavaScriptCallFrame(const JSC::DebuggerCallFrame&, PassRefPtr<JavaScriptCallFrame> caller, intptr_t sourceID, int line);
 
         JSC::DebuggerCallFrame m_debuggerCallFrame;
         RefPtr<JavaScriptCallFrame> m_caller;
-        int m_sourceID;
+        intptr_t m_sourceID;
         int m_line;
         bool m_isValid;
     };
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptCallFrame_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
index 96e4c6e66e..2f247f01b1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
@@ -25,7 +25,7 @@
 
 module inspector {
 
-    interface JavaScriptCallFrame {
+    interface [Conditional=JAVASCRIPT_DEBUGGER] JavaScriptCallFrame {
         [Custom] void evaluate(in DOMString script);
 
         readonly attribute JavaScriptCallFrame caller;
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h
index f1cd77ff38..912a7516a1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h
@@ -29,6 +29,8 @@
 #ifndef JavaScriptDebugListener_h
 #define JavaScriptDebugListener_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 namespace JSC {
     class ExecState;
     class SourceCode;
@@ -47,8 +49,11 @@ namespace WebCore {
         virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode& source) = 0;
         virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage) = 0;
         virtual void didPause() = 0;
+        virtual void didContinue() = 0;
     };
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptDebugListener_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
index 680e57e725..bb6358c87d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JavaScriptDebugServer.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "DOMWindow.h"
 #include "EventLoop.h"
 #include "Frame.h"
@@ -363,19 +365,25 @@ void JavaScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
 
     frame->script()->setPaused(paused);
 
-    if (Document* document = frame->document()) {
-        if (paused)
-            document->suspendActiveDOMObjects();
-        else
-            document->resumeActiveDOMObjects();
-    }
+    Document* document = frame->document();
+    if (paused)
+        document->suspendActiveDOMObjects();
+    else
+        document->resumeActiveDOMObjects();
 
     setJavaScriptPaused(frame->view(), paused);
 }
 
+#if PLATFORM(MAC)
+
+void JavaScriptDebugServer::setJavaScriptPaused(FrameView*, bool)
+{
+}
+
+#else
+
 void JavaScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
 {
-#if !PLATFORM(MAC)
     if (!view)
         return;
 
@@ -389,9 +397,10 @@ void JavaScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
             continue;
         static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
     }
-#endif
 }
 
+#endif
+
 void JavaScriptDebugServer::pauseIfNeeded(Page* page)
 {
     if (m_paused)
@@ -424,6 +433,8 @@ void JavaScriptDebugServer::pauseIfNeeded(Page* page)
     setJavaScriptPaused(page->group(), false);
 
     m_paused = false;
+
+    dispatchFunctionToListeners(&JavaScriptDebugListener::didContinue, page);
 }
 
 void JavaScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
@@ -542,8 +553,11 @@ void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>
     Vector<ProtectedPtr<JSFunction> > functions;
     Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
     for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
-        if ((*it)->isObject(&JSFunction::info))
-            functions.append(static_cast<JSFunction*>(*it));
+        if ((*it)->isObject(&JSFunction::info)) {
+            JSFunction* function = static_cast<JSFunction*>(*it);
+            if (!function->isHostFunction())
+                functions.append(function);
+        }
     }
 
     typedef HashMap<RefPtr<FunctionBodyNode>, RefPtr<FunctionBodyNode> > FunctionBodyMap;
@@ -573,7 +587,7 @@ void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>
         result.first->second = newBody;
         function->setBody(newBody.release());
 
-        if (hasListeners())
+        if (hasListeners() && function->scope().globalObject()->debugger() == this)
             sourceProviders.add(sourceCode.provider(), exec);
     }
 
@@ -613,3 +627,5 @@ void JavaScriptDebugServer::didRemoveLastListener()
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
index 12c1099a21..4ec3e33243 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
@@ -29,6 +29,8 @@
 #ifndef JavaScriptDebugServer_h
 #define JavaScriptDebugServer_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "Timer.h"
 #include <debugger/Debugger.h>
 #include <wtf/HashMap.h>
@@ -127,4 +129,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptDebugServer_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp
index b0be7a0b3d..3a65fb8b27 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptProfile.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JavaScriptProfileNode.h"
 #include <profiler/Profile.h>
 #include <JavaScriptCore/APICast.h>
@@ -68,26 +70,9 @@ static JSValueRef getHeadCallback(JSContextRef ctx, JSObjectRef thisObject, JSSt
     if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
         return JSValueMakeUndefined(ctx);
 
+    ExecState* exec = toJS(ctx);
     Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->head()));
-}
-
-static JSValueRef getHeavyProfileCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->heavyProfile()));
-}
-
-static JSValueRef getTreeProfileCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->treeProfile()));
+    return toRef(exec, toJS(exec, profile->head()));
 }
 
 static JSValueRef getUniqueIdCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
@@ -146,94 +131,6 @@ static JSValueRef restoreAll(JSContextRef ctx, JSObjectRef /*function*/, JSObjec
     return JSValueMakeUndefined(ctx);
 }
 
-static JSValueRef sortTotalTimeDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortTotalTimeDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortTotalTimeAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortTotalTimeAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortSelfTimeDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortSelfTimeDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortSelfTimeAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortSelfTimeAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortCallsDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortCallsDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortCallsAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortCallsAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortFunctionNameDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortFunctionNameDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortFunctionNameAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortFunctionNameAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
 static void finalize(JSObjectRef object)
 {
     Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(object));
@@ -246,8 +143,6 @@ JSClassRef ProfileClass()
     static JSStaticValue staticValues[] = {
         { "title", getTitleCallback, 0, kJSPropertyAttributeNone },
         { "head", getHeadCallback, 0, kJSPropertyAttributeNone },
-        { "heavyProfile", getHeavyProfileCallback, 0, kJSPropertyAttributeNone },
-        { "treeProfile", getTreeProfileCallback, 0, kJSPropertyAttributeNone },
         { "uid", getUniqueIdCallback, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
     };
@@ -256,14 +151,6 @@ JSClassRef ProfileClass()
         { "focus", focus, kJSPropertyAttributeNone },
         { "exclude", exclude, kJSPropertyAttributeNone },
         { "restoreAll", restoreAll, kJSPropertyAttributeNone },
-        { "sortTotalTimeDescending", sortTotalTimeDescending, kJSPropertyAttributeNone },
-        { "sortTotalTimeAscending", sortTotalTimeAscending, kJSPropertyAttributeNone },
-        { "sortSelfTimeDescending", sortSelfTimeDescending, kJSPropertyAttributeNone },
-        { "sortSelfTimeAscending", sortSelfTimeAscending, kJSPropertyAttributeNone },
-        { "sortCallsDescending", sortCallsDescending, kJSPropertyAttributeNone },
-        { "sortCallsAscending", sortCallsAscending, kJSPropertyAttributeNone },
-        { "sortFunctionNameDescending", sortFunctionNameDescending, kJSPropertyAttributeNone },
-        { "sortFunctionNameAscending", sortFunctionNameAscending, kJSPropertyAttributeNone },
         { 0, 0, 0 }
     };
 
@@ -276,7 +163,7 @@ JSClassRef ProfileClass()
     return profileClass;
 }
 
-JSValuePtr toJS(ExecState* exec, Profile* profile)
+JSValue toJS(ExecState* exec, Profile* profile)
 {
     if (!profile)
         return jsNull();
@@ -292,3 +179,5 @@ JSValuePtr toJS(ExecState* exec, Profile* profile)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h
index 4076165c5c..28fd3e4f5c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptProfile_h
 #define JavaScriptProfile_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <runtime/JSValue.h>
 
 namespace JSC {
@@ -35,8 +37,10 @@ namespace JSC {
 
 namespace WebCore {
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::Profile*);
+    JSC::JSValue toJS(JSC::ExecState*, JSC::Profile*);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
index 8d00783d8b..5b5c340b01 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptProfileNode.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JSDOMBinding.h"
 #include <profiler/ProfileNode.h>
 #include <JavaScriptCore/APICast.h>
@@ -46,7 +48,7 @@ namespace WebCore {
 typedef HashMap<ProfileNode*, JSObject*> ProfileNodeMap;
 
 static ProfileNodeMap& profileNodeCache()
-{ 
+{
     DEFINE_STATIC_LOCAL(ProfileNodeMap, staticProfileNodes, ());
     return staticProfileNodes;
 }
@@ -162,7 +164,7 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
         return JSValueMakeUndefined(ctx);
 
     JSRetainPtr<JSStringRef> pushString(Adopt, JSStringCreateWithUTF8CString("push"));
-    
+
     JSValueRef pushProperty = JSObjectGetProperty(ctx, result, pushString.get(), exception);
     if (exception && *exception)
         return JSValueMakeUndefined(ctx);
@@ -171,8 +173,9 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
     if (exception && *exception)
         return JSValueMakeUndefined(ctx);
 
+    ExecState* exec = toJS(ctx);
     for (Vector<RefPtr<ProfileNode> >::const_iterator it = children.begin(); it != children.end(); ++it) {
-        JSValueRef arg0 = toRef(toJS(toJS(ctx), (*it).get() ));
+        JSValueRef arg0 = toRef(exec, toJS(exec, (*it).get() ));
         JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
         if (exception && *exception)
             return JSValueMakeUndefined(ctx);
@@ -181,6 +184,30 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
     return result;
 }
 
+static JSValueRef getParent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    ExecState* exec = toJS(ctx);
+    return toRef(exec, toJS(exec, profileNode->parent()));
+}
+
+static JSValueRef getHead(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    ExecState* exec = toJS(ctx);
+    return toRef(exec, toJS(exec, profileNode->head()));
+}
+
 static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(false);
@@ -192,6 +219,17 @@ static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringR
     return JSValueMakeBoolean(ctx, profileNode->visible());
 }
 
+static JSValueRef getCallUID(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->callIdentifier().hash());
+}
+
 static void finalize(JSObjectRef object)
 {
     ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(object));
@@ -211,7 +249,10 @@ JSClassRef ProfileNodeClass()
         { "selfPercent", getSelfPercent, 0, kJSPropertyAttributeNone },
         { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
         { "children", getChildren, 0, kJSPropertyAttributeNone },
+        { "parent", getParent, 0, kJSPropertyAttributeNone },
+        { "head", getHead, 0, kJSClassAttributeNone },
         { "visible", getVisible, 0, kJSPropertyAttributeNone },
+        { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
     };
 
@@ -224,7 +265,7 @@ JSClassRef ProfileNodeClass()
     return profileNodeClass;
 }
 
-JSValuePtr toJS(ExecState* exec, ProfileNode* profileNode)
+JSValue toJS(ExecState* exec, ProfileNode* profileNode)
 {
     if (!profileNode)
         return jsNull();
@@ -241,3 +282,5 @@ JSValuePtr toJS(ExecState* exec, ProfileNode* profileNode)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h
index 286aac6458..ad72b71139 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptProfileNode_h
 #define JavaScriptProfileNode_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <runtime/JSValue.h>
 #include <JavaScriptCore/JSBase.h>
 
@@ -37,8 +39,10 @@ namespace JSC {
 namespace WebCore {
 
     JSClassRef ProfileNodeClass();
-    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::ProfileNode*);
+    JSC::JSValue toJS(JSC::ExecState*, JSC::ProfileNode*);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
new file mode 100644
index 0000000000..89b4ddc7d5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -0,0 +1,252 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Bottom Up Profiling shows the entire callstack backwards:
+// The root node is a representation of each individual function called, and each child of that node represents
+// a reverse-callstack showing how many of those calls came from it. So, unlike top-down, the statistics in
+// each child still represent the root node. We have to be particularly careful of recursion with this mode
+// because a root node can represent itself AND an ancestor.
+
+WebInspector.BottomUpProfileDataGridTree = function(/*ProfileView*/ aProfileView, /*ProfileNode*/ aProfileNode)
+{
+    WebInspector.ProfileDataGridTree.call(this, aProfileView, aProfileNode);
+
+    // Iterate each node in pre-order.
+    var profileNodeUIDs = 0;
+    var profileNodeGroups = [[], [aProfileNode]];
+    var visitedProfileNodesForCallUID = {};
+
+    this._remainingNodeInfos = [];
+
+    for (var profileNodeGroupIndex = 0; profileNodeGroupIndex < profileNodeGroups.length; ++profileNodeGroupIndex) {
+        var parentProfileNodes = profileNodeGroups[profileNodeGroupIndex];
+        var profileNodes = profileNodeGroups[++profileNodeGroupIndex];
+        var count = profileNodes.length;
+
+        for (var index = 0; index < count; ++index) {
+            var profileNode = profileNodes[index];
+
+            if (!profileNode.UID)
+                profileNode.UID = ++profileNodeUIDs;
+
+            if (profileNode.head && profileNode !== profileNode.head) {
+                // The total time of this ancestor is accounted for if we're in any form of recursive cycle.
+                var visitedNodes = visitedProfileNodesForCallUID[profileNode.callUID];
+                var totalTimeAccountedFor = false;
+
+                if (!visitedNodes) {
+                    visitedNodes = {}
+                    visitedProfileNodesForCallUID[profileNode.callUID] = visitedNodes;
+                } else {
+                    // The total time for this node has already been accounted for iff one of it's parents has already been visited.
+                    // We can do this check in this style because we are traversing the tree in pre-order.
+                    var parentCount = parentProfileNodes.length;
+                    for (var parentIndex = 0; parentIndex < parentCount; ++parentIndex) {
+                        if (visitedNodes[parentProfileNodes[parentIndex].UID]) {
+                            totalTimeAccountedFor = true;
+                            break;
+                        }
+                    }
+                }
+
+                visitedNodes[profileNode.UID] = true;
+
+                this._remainingNodeInfos.push({ ancestor:profileNode, focusNode:profileNode, totalTimeAccountedFor:totalTimeAccountedFor });
+            }
+
+            var children = profileNode.children;
+            if (children.length) {
+                profileNodeGroups.push(parentProfileNodes.concat([profileNode]))
+                profileNodeGroups.push(children);
+            }
+        }
+    }
+
+    // Populate the top level nodes.
+    WebInspector.BottomUpProfileDataGridNode.prototype._populate.call(this);
+
+    return this;
+}
+
+WebInspector.BottomUpProfileDataGridTree.prototype = {
+    // When focusing, we keep the entire callstack up to this ancestor.
+    focus: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        if (!profileDataGridNode)
+            return;
+
+        this._save();
+
+        var currentNode = profileDataGridNode;
+        var focusNode = profileDataGridNode;
+
+        while (currentNode.parent && (currentNode instanceof WebInspector.ProfileDataGridNode)) {
+            currentNode._takePropertiesFromProfileDataGridNode(profileDataGridNode);
+
+            focusNode = currentNode;
+            currentNode = currentNode.parent;
+
+            if (currentNode instanceof WebInspector.ProfileDataGridNode)
+                currentNode._keepOnlyChild(focusNode);
+        }
+
+        this.children = [focusNode];
+        this.totalTime = profileDataGridNode.totalTime;
+    },
+
+    exclude: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        if (!profileDataGridNode)
+            return;
+
+        this._save();
+
+        var excludedCallUID = profileDataGridNode.callUID;
+        var excludedTopLevelChild = this.childrenByCallUID[excludedCallUID];
+
+        // If we have a top level node that is excluded, get rid of it completely (not keeping children),
+        // since bottom up data relies entirely on the root node.
+        if (excludedTopLevelChild)
+            this.children.remove(excludedTopLevelChild);
+
+        var children = this.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            children[index]._exclude(excludedCallUID);
+
+        if (this.lastComparator)
+            this.sort(this.lastComparator, true);
+    }
+}
+
+WebInspector.BottomUpProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
+
+WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
+{
+    // In bottom up mode, our parents are our children since we display an inverted tree.
+    // However, we don't want to show the very top parent since it is redundant.
+    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingNodeInfos = [];
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype = {
+    _takePropertiesFromProfileDataGridNode: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        this._save();
+
+        this.selfTime = profileDataGridNode.selfTime;
+        this.totalTime = profileDataGridNode.totalTime;
+        this.numberOfCalls = profileDataGridNode.numberOfCalls;
+    },
+
+    // When focusing, we keep just the members of the callstack.
+    _keepOnlyChild: function(/*ProfileDataGridNode*/ child)
+    {
+        this._save();
+
+        this.removeChildren();
+        this.appendChild(child);
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingNodeInfos)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    },
+
+    _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
+    {
+        this.selfTime -= child.selfTime;
+
+        WebInspector.ProfileDataGridNode.prototype._merge.call(this, child, shouldAbsorb);
+    },
+
+    _populate: function(event)
+    {
+        var remainingNodeInfos = this._remainingNodeInfos;
+        var count = remainingNodeInfos.length;
+
+        for (var index = 0; index < count; ++index) {
+            var nodeInfo = remainingNodeInfos[index];
+            var ancestor = nodeInfo.ancestor;
+            var focusNode = nodeInfo.focusNode;
+            var child = this.findChild(ancestor);
+
+            // If we already have this child, then merge the data together.
+            if (child) {
+                var totalTimeAccountedFor = nodeInfo.totalTimeAccountedFor;
+
+                child.selfTime += focusNode.selfTime;
+                child.numberOfCalls += focusNode.numberOfCalls;
+
+                if (!totalTimeAccountedFor)
+                    child.totalTime += focusNode.totalTime;
+            } else {
+                // If not, add it as a true ancestor.
+                // In heavy mode, we take our visual identity from ancestor node...
+                var child = new WebInspector.BottomUpProfileDataGridNode(this.profileView, ancestor, this.tree);
+
+                if (ancestor !== focusNode) {
+                    // but the actual statistics from the "root" node (bottom of the callstack).
+                    child.selfTime = focusNode.selfTime;
+                    child.totalTime = focusNode.totalTime;
+                    child.numberOfCalls = focusNode.numberOfCalls;
+                }
+
+                this.appendChild(child);
+            }
+
+            var parent = ancestor.parent;
+            if (parent && parent.parent) {
+                nodeInfo.ancestor = parent;
+                child._remainingNodeInfos.push(nodeInfo);
+            }
+        }
+
+        delete this._remainingNodeInfos;
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+    }
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js
index 31e466c7b1..65cc7d03b9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js
@@ -141,7 +141,7 @@ WebInspector.Console.prototype = {
 
     addMessage: function(msg)
     {
-        if (msg instanceof WebInspector.ConsoleMessage) {
+        if (msg instanceof WebInspector.ConsoleMessage && !(msg instanceof WebInspector.ConsoleCommandResult)) {
             msg.totalRepeatCount = msg.repeatCount;
             msg.repeatDelta = msg.repeatCount;
 
@@ -446,6 +446,9 @@ WebInspector.Console.prototype = {
         if (!str.length)
             return;
 
+        var commandMessage = new WebInspector.ConsoleCommand(str);
+        this.addMessage(commandMessage);
+
         var result;
         var exception = false;
         try {
@@ -459,31 +462,12 @@ WebInspector.Console.prototype = {
         this.prompt.historyOffset = 0;
         this.prompt.text = "";
 
-        var level = exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log;
-        this.addMessage(new WebInspector.ConsoleCommand(str, result, this._format(result), level));
+        this.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
     },
 
-    _mouseOverNode: function(event)
+    _format: function(output, forceObjectFormat)
     {
-        var anchorElement = event.target.enclosingNodeOrSelfWithNodeName("a");
-        WebInspector.hoveredDOMNode = (anchorElement ? anchorElement.representedNode : null);
-    },
-
-    _mouseOutOfNode: function(event)
-    {
-        var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        var anchorElement = nodeUnderMouse.enclosingNodeOrSelfWithNodeName("a");
-        if (!anchorElement || !anchorElement.representedNode)
-            WebInspector.hoveredDOMNode = null;
-    },
-
-    _format: function(output, inline)
-    {
-        var type = Object.type(output, InspectorController.inspectedWindow());
-        if (type === "object") {
-            if (output instanceof InspectorController.inspectedWindow().Node)
-                type = "node";
-        }
+        var type = (forceObjectFormat ? "object" : Object.type(output, InspectorController.inspectedWindow()));
 
         // We don't perform any special formatting on these types, so we just
         // pass them through the simple _formatvalue function.
@@ -497,7 +481,9 @@ WebInspector.Console.prototype = {
         };
 
         var formatter;
-        if (type in undecoratedTypes)
+        if (forceObjectFormat)
+            formatter = "_formatobject";
+        else if (type in undecoratedTypes)
             formatter = "_formatvalue";
         else {
             formatter = "_format" + type;
@@ -509,77 +495,74 @@ WebInspector.Console.prototype = {
 
         var span = document.createElement("span");
         span.addStyleClass("console-formatted-" + type);
-        this[formatter](output, span, inline);
+        this[formatter](output, span);
         return span;
     },
 
-    _formatvalue: function(val, elem, inline)
+    _formatvalue: function(val, elem)
     {
         elem.appendChild(document.createTextNode(val));
     },
 
-    _formatstring: function(str, elem, inline)
+    _formatstring: function(str, elem)
     {
         elem.appendChild(document.createTextNode("\"" + str + "\""));
     },
 
-    _formatregexp: function(re, elem, inline)
+    _formatregexp: function(re, elem)
     {
         var formatted = String(re).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
         elem.appendChild(document.createTextNode(formatted));
     },
 
-    _formatarray: function(arr, elem, inline)
+    _formatarray: function(arr, elem)
     {
         elem.appendChild(document.createTextNode("["));
         for (var i = 0; i < arr.length; ++i) {
-            elem.appendChild(this._format(arr[i], true));
+            elem.appendChild(this._format(arr[i]));
             if (i < arr.length - 1)
                 elem.appendChild(document.createTextNode(", "));
         }
         elem.appendChild(document.createTextNode("]"));
     },
 
-    _formatnode: function(node, elem, inline)
+    _formatnode: function(node, elem)
     {
-        var anchor = document.createElement("a");
-        anchor.className = "inspectible-node";
-        anchor.innerHTML = nodeTitleInfo.call(node).title;
-        anchor.representedNode = node;
-        anchor.addEventListener("mouseover", this._mouseOverNode.bind(this), false);
-        anchor.addEventListener("mouseout", this._mouseOutOfNode.bind(this), false);
-
-        if (inline)
-            elem.appendChild(anchor);
-        else
-            elem.appendChild(new WebInspector.ObjectPropertiesSection(node, anchor, null, null, true).element);
+        var treeOutline = new WebInspector.ElementsTreeOutline();
+        treeOutline.rootDOMNode = node;
+        treeOutline.element.addStyleClass("outline-disclosure");
+        if (!treeOutline.children[0].hasChildren)
+            treeOutline.element.addStyleClass("single-node");
+        elem.appendChild(treeOutline.element);
     },
 
-    _formatobject: function(obj, elem, inline)
+    _formatobject: function(obj, elem)
     {
-        if (inline)
-            elem.appendChild(document.createTextNode(Object.describe(obj)));
-        else
-            elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, null, null, null, true).element);
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, null, null, null, true).element);
     },
 
-    _formaterror: function(obj, elem, inline)
+    _formaterror: function(obj, elem)
     {
-        elem.appendChild(document.createTextNode(obj.name + ": " + obj.message + " "));
+        var messageElement = document.createElement("span");
+        messageElement.className = "error-message";
+        messageElement.textContent = obj.name + ": " + obj.message;
+        elem.appendChild(messageElement);
 
         if (obj.sourceURL) {
             var urlElement = document.createElement("a");
-            urlElement.className = "console-message-url webkit-html-resource-link";
+            urlElement.className = "webkit-html-resource-link";
             urlElement.href = obj.sourceURL;
             urlElement.lineNumber = obj.line;
             urlElement.preferredPanel = "scripts";
 
             if (obj.line > 0)
-                urlElement.textContent = WebInspector.UIString("%s (line %d)", obj.sourceURL, obj.line);
+                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL) + ":" + obj.line;
             else
-                urlElement.textContent = obj.sourceURL;
+                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL);
 
+            elem.appendChild(document.createTextNode(" ("));
             elem.appendChild(urlElement);
+            elem.appendChild(document.createTextNode(")"));
         }
     },
 }
@@ -594,41 +577,36 @@ WebInspector.ConsoleMessage = function(source, level, line, url, groupLevel, rep
     this.url = url;
     this.groupLevel = groupLevel;
     this.repeatCount = repeatCount;
-
-    switch (this.level) {
-        case WebInspector.ConsoleMessage.MessageLevel.Object:
-            var propertiesSection = new WebInspector.ObjectPropertiesSection(arguments[6], null, null, null, true);
-            propertiesSection.element.addStyleClass("console-message");
-            this.propertiesSection = propertiesSection;
-            break;
-        case WebInspector.ConsoleMessage.MessageLevel.Node:
-            var node = arguments[6];
-            if (!(node instanceof InspectorController.inspectedWindow().Node))
-                return;
-            this.elementsTreeOutline = new WebInspector.ElementsTreeOutline();
-            this.elementsTreeOutline.rootDOMNode = node;
-            break;
-        case WebInspector.ConsoleMessage.MessageLevel.Trace:
-            var span = document.createElement("span");
-            span.addStyleClass("console-formatted-trace");
-            var stack = Array.prototype.slice.call(arguments, 6);
-            var funcNames = stack.map(function(f) {
-                return f || WebInspector.UIString("(anonymous function)");
-            });
-            span.appendChild(document.createTextNode(funcNames.join("\n")));
-            this.formattedMessage = span;
-            break;
-        default:
-            // The formatedMessage property is used for the rich and interactive console.
-            this.formattedMessage = this._format(Array.prototype.slice.call(arguments, 6));
-
-            // This is used for inline message bubbles in SourceFrames, or other plain-text representations.
-            this.message = this.formattedMessage.textContent;
-            break;
-    }
+    if (arguments.length > 6)
+        this.setMessageBody(Array.prototype.slice.call(arguments, 6));
 }
 
 WebInspector.ConsoleMessage.prototype = {
+    setMessageBody: function(args)
+    {
+        switch (this.level) {
+            case WebInspector.ConsoleMessage.MessageLevel.Trace:
+                var span = document.createElement("span");
+                span.addStyleClass("console-formatted-trace");
+                var stack = Array.prototype.slice.call(args);
+                var funcNames = stack.map(function(f) {
+                    return f || WebInspector.UIString("(anonymous function)");
+                });
+                span.appendChild(document.createTextNode(funcNames.join("\n")));
+                this.formattedMessage = span;
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.Object:
+                this.formattedMessage = this._format(["%O", args[0]]);
+                break;
+            default:
+                this.formattedMessage = this._format(args);
+                break;
+        }
+
+        // This is used for inline message bubbles in SourceFrames, or other plain-text representations.
+        this.message = this.formattedMessage.textContent;
+    },
+
     isErrorOrWarning: function()
     {
         return (this.level === WebInspector.ConsoleMessage.MessageLevel.Warning || this.level === WebInspector.ConsoleMessage.MessageLevel.Error);
@@ -643,6 +621,11 @@ WebInspector.ConsoleMessage.prototype = {
 
         function formatForConsole(obj)
         {
+            return WebInspector.console._format(obj);
+        }
+
+        function formatAsObjectForConsole(obj)
+        {
             return WebInspector.console._format(obj, true);
         }
 
@@ -655,6 +638,8 @@ WebInspector.ConsoleMessage.prototype = {
             formatters.o = formatForConsole;
             // Firebug allows both %i and %d for formatting integers.
             formatters.i = formatters.d;
+            // Support %O to force object formating, instead of the type-based %o formatting.
+            formatters.O = formatAsObjectForConsole;
 
             function append(a, b)
             {
@@ -675,10 +660,9 @@ WebInspector.ConsoleMessage.prototype = {
         for (var i = 0; i < parameters.length; ++i) {
             if (typeof parameters[i] === "string")
                 formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i]));
-            else if (parameters.length === 1)
-                formattedResult.appendChild(WebInspector.console._format(parameters[0]));
             else
                 formattedResult.appendChild(formatForConsole(parameters[i]));
+
             if (i < parameters.length - 1)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
@@ -758,7 +742,7 @@ WebInspector.ConsoleMessage.prototype = {
                 urlElement.preferredPanel = "scripts";
 
             if (this.line > 0)
-                urlElement.textContent = WebInspector.UIString("%s (line %d)", WebInspector.displayNameForURL(this.url), this.line);
+                urlElement.textContent = WebInspector.displayNameForURL(this.url) + ":" + this.line;
             else
                 urlElement.textContent = WebInspector.displayNameForURL(this.url);
 
@@ -814,14 +798,20 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Object:
                 levelString = "Object";
                 break;
-            case WebInspector.ConsoleMessage.MessageLevel.GroupTitle:
-                levelString = "GroupTitle";
+            case WebInspector.ConsoleMessage.MessageLevel.Trace:
+                levelString = "Trace";
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.StartGroup:
+                levelString = "Start Group";
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.EndGroup:
+                levelString = "End Group";
                 break;
         }
 
         return sourceString + " " + levelString + ": " + this.formattedMessage.textContent + "\n" + this.url + " line " + this.line;
     },
-    
+
     isEqual: function(msg, disreguardGroup)
     {
         if (!msg)
@@ -853,17 +843,14 @@ WebInspector.ConsoleMessage.MessageLevel = {
     Warning: 2,
     Error: 3,
     Object: 4,
-    Node: 5,
-    Trace: 6,
-    StartGroup: 7,
-    EndGroup: 8
+    Trace: 5,
+    StartGroup: 6,
+    EndGroup: 7
 }
 
-WebInspector.ConsoleCommand = function(command, result, formattedResultElement, level)
+WebInspector.ConsoleCommand = function(command)
 {
     this.command = command;
-    this.formattedResultElement = formattedResultElement;
-    this.level = level;
 }
 
 WebInspector.ConsoleCommand.prototype = {
@@ -878,30 +865,33 @@ WebInspector.ConsoleCommand.prototype = {
         commandTextElement.textContent = this.command;
         element.appendChild(commandTextElement);
 
-        var resultElement = document.createElement("div");
-        resultElement.className = "console-message";
-        element.appendChild(resultElement);
+        return element;
+    }
+}
 
-        switch (this.level) {
-            case WebInspector.ConsoleMessage.MessageLevel.Log:
-                resultElement.addStyleClass("console-log-level");
-                break;
-            case WebInspector.ConsoleMessage.MessageLevel.Warning:
-                resultElement.addStyleClass("console-warning-level");
-                break;
-            case WebInspector.ConsoleMessage.MessageLevel.Error:
-                resultElement.addStyleClass("console-error-level");
-        }
+WebInspector.ConsoleCommandResult = function(result, exception, originatingCommand)
+{
+    var level = (exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log);
+    var message = (exception ? String(result) : result);
+    var line = (exception ? result.line : -1);
+    var url = (exception ? result.sourceURL : null);
+
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, level, line, url, null, 1, message);
 
-        var resultTextElement = document.createElement("span");
-        resultTextElement.className = "console-message-text";
-        resultTextElement.appendChild(this.formattedResultElement);
-        resultElement.appendChild(resultTextElement);
+    this.originatingCommand = originatingCommand;
+}
 
+WebInspector.ConsoleCommandResult.prototype = {
+    toMessageElement: function()
+    {
+        var element = WebInspector.ConsoleMessage.prototype.toMessageElement.call(this);
+        element.addStyleClass("console-user-command-result");
         return element;
     }
 }
 
+WebInspector.ConsoleCommandResult.prototype.__proto__ = WebInspector.ConsoleMessage.prototype;
+
 WebInspector.ConsoleGroup = function(parentGroup, level)
 {
     this.parentGroup = parentGroup;
@@ -928,8 +918,11 @@ WebInspector.ConsoleGroup.prototype = {
             element.addEventListener("click", this._titleClicked.bind(this), true);
         } else
             this.messagesElement.appendChild(element);
+
+        if (element.previousSibling && msg.originatingCommand && element.previousSibling.command === msg.originatingCommand)
+            element.previousSibling.addStyleClass("console-adjacent-user-command-result");
     },
-    
+
     _titleClicked: function(event)
     {
         var groupTitleElement = event.target.enclosingNodeOrSelfWithClass("console-group-title-level");
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js
new file mode 100644
index 0000000000..5207b69e6a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2008 Nokia Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMStorage = function(domStorage, domain, isLocalStorage)
+{
+    this.domStorage = domStorage;
+    this.domain = domain;
+    this.isLocalStorage = isLocalStorage;
+}
+
+WebInspector.DOMStorage.prototype = {
+    get domStorage()
+    {
+        return this._domStorage;
+    },
+
+    set domStorage(x)
+    {
+        if (this._domStorage === x)
+            return;
+        this._domStorage = x;
+    },
+
+    get domain()
+    {
+        return this._domain;
+    },
+
+    set domain(x)
+    {
+        if (this._domain === x)
+            return;
+        this._domain = x;
+    },
+    
+    get isLocalStorage()
+    {
+        return this._isLocalStorage;
+    },
+    
+    set isLocalStorage(x)
+    {
+        if (this._isLocalStorage === x)
+            return;
+        this._isLocalStorage = x;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
new file mode 100644
index 0000000000..9946415e6d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2009 Nokia Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *        notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *        notice, this list of conditions and the following disclaimer in the
+ *        documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.         IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMStorageDataGrid = function(columns)
+{
+    WebInspector.DataGrid.call(this, columns);
+    this.dataTableBody.addEventListener("dblclick", this._ondblclick.bind(this), false);
+}
+
+WebInspector.DOMStorageDataGrid.prototype = {
+    _ondblclick: function(event)
+    {
+        if (this._editing)
+            return;
+        if (this._editingNode)
+            return;
+        this._startEditing(event);
+    },
+    
+    _startEditing: function(event)
+    {
+        var element = event.target.enclosingNodeOrSelfWithNodeName("td");
+        if (!element)
+            return;
+        this._editingNode = this.dataGridNodeFromEvent(event);
+        if (!this._editingNode)
+            return;
+        this._editing = true;
+            
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+    
+    _editingCommitted: function(element, newText)
+    {
+        if (element.hasStyleClass("0-column"))
+            columnIdentifier = 0;
+        else
+            columnIdentifier = 1;
+        textBeforeEditing = this._editingNode.data[columnIdentifier];
+        if (textBeforeEditing == newText) {
+            this._editingCancelled(element);
+            return;
+        }
+        
+        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
+        if (domStorage) {
+            if (columnIdentifier == 0) {
+                if (domStorage.getItem(newText) != null) {
+                    element.textContent = this._editingNode.data[0];
+                    this._editingCancelled(element);
+                    return;
+                }
+                domStorage.removeItem(this._editingNode.data[0]);
+                domStorage.setItem(newText, this._editingNode.data[1]);
+                this._editingNode.data[0] = newText;            
+            } else {
+                domStorage.setItem(this._editingNode.data[0], newText);
+                this._editingNode.data[1] = newText;
+            }
+        }
+        
+        this._editingCancelled(element);
+    },
+    
+    _editingCancelled: function(element, context)
+    {
+        delete this._editing;
+        this._editingNode = null;
+    },
+    
+    deleteSelectedRow: function()
+    {
+        var node = this.selectedNode;
+        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
+        if (node && domStorage)
+            domStorage.removeItem(node.data[0]);
+    }
+}
+
+WebInspector.DOMStorageDataGrid.prototype.__proto__ = WebInspector.DataGrid.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
new file mode 100644
index 0000000000..912573efcf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2008 Nokia Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMStorageItemsView = function(domStorage)
+{
+    WebInspector.View.call(this);
+
+    this.domStorage = domStorage;
+
+    this.element.addStyleClass("storage-view");
+    this.element.addStyleClass("table");
+
+    this.deleteButton = document.createElement("button");
+    this.deleteButton.title = WebInspector.UIString("Delete");
+    this.deleteButton.className = "delete-storage-status-bar-item status-bar-item hidden";
+    this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+    this.refreshButton = document.createElement("button");
+    this.refreshButton.title = WebInspector.UIString("Refresh");
+    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+}
+
+WebInspector.DOMStorageItemsView.prototype = {
+    get statusBarItems()
+    {
+        return [this.refreshButton, this.deleteButton];
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+        this.update();
+    },
+
+    hide: function()
+    {
+        WebInspector.View.prototype.hide.call(this);
+        this.deleteButton.addStyleClass("hidden");
+    },
+
+    update: function()
+    {
+        this.element.removeChildren();
+        var hasDOMStorage = this.domStorage;
+        if (hasDOMStorage)
+            hasDOMStorage = this.domStorage.domStorage;
+
+        if (hasDOMStorage) {
+            var dataGrid = WebInspector.panels.databases.dataGridForDOMStorage(this.domStorage.domStorage);
+            if (!dataGrid)
+                hasDOMStorage = 0;
+            else {
+                this._dataGrid = dataGrid;
+                this.element.appendChild(dataGrid.element);
+                this.deleteButton.removeStyleClass("hidden");
+            }
+        }
+
+        if (!hasDOMStorage) {
+            var emptyMsgElement = document.createElement("div");
+            emptyMsgElement.className = "storage-table-empty";
+            if (this.domStorage)
+            emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
+            this.element.appendChild(emptyMsgElement);
+            this._dataGrid = null;
+            this.deleteButton.addStyleClass("hidden");
+        }
+    },
+
+    _deleteButtonClicked: function(event)
+    {
+        if (this._dataGrid) {
+            this._dataGrid.deleteSelectedRow();
+            
+            this.show();
+        }
+    },
+
+    _refreshButtonClicked: function(event)
+    {
+        this.update();
+    }
+}
+
+WebInspector.DOMStorageItemsView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
index 6f103ed6cc..2fcb08cd99 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
@@ -169,32 +169,19 @@ WebInspector.DataGrid.prototype = {
     insertChild: function(child, index)
     {
         if (!child)
-            throw("Node can't be undefined or null.");
+            throw("insertChild: Node can't be undefined or null.");
         if (child.parent === this)
-            throw("Node is already a child of this node.");
+            throw("insertChild: Node is already a child of this node.");
 
         if (child.parent)
             child.parent.removeChild(child);
 
-        var previousChild = (index > 0 ? this.children[index - 1] : null);
-        if (previousChild) {
-            previousChild.nextSibling = child;
-            child.previousSibling = previousChild;
-        } else
-            child.previousSibling = null;
-
-        var nextChild = this.children[index];
-        if (nextChild) {
-            nextChild.previousSibling = child;
-            child.nextSibling = nextChild;
-        } else
-            child.nextSibling = null;
-
         this.children.splice(index, 0, child);
         this.hasChildren = true;
 
         child.parent = this;
         child.dataGrid = this.dataGrid;
+        child._recalculateSiblings(index);
 
         delete child._depth;
         delete child._revealed;
@@ -216,9 +203,9 @@ WebInspector.DataGrid.prototype = {
     removeChild: function(child)
     {
         if (!child)
-            throw("Node can't be undefined or null.");
+            throw("removeChild: Node can't be undefined or null.");
         if (child.parent !== this)
-            throw("Node is not a child of this node.");
+            throw("removeChild: Node is not a child of this node.");
 
         child.deselect();
 
@@ -233,6 +220,9 @@ WebInspector.DataGrid.prototype = {
         child.parent = null;
         child.nextSibling = null;
         child.previousSibling = null;
+
+        if (this.children.length <= 0)
+            this.hasChildren = false;
     },
 
     removeChildren: function()
@@ -249,6 +239,7 @@ WebInspector.DataGrid.prototype = {
         }
 
         this.children = [];
+        this.hasChildren = false;
     },
 
     removeChildrenRecursive: function()
@@ -405,7 +396,7 @@ WebInspector.DataGrid.prototype = {
         var gridNode = this.dataGridNodeFromEvent(event);
         if (!gridNode || !gridNode.selectable)
             return;
-    
+
         if (gridNode.isEventWithinDisclosureTriangle(event))
             return;
 
@@ -519,6 +510,34 @@ WebInspector.DataGridNode.prototype = {
         return true;
     },
 
+    set hasChildren(x)
+    {
+        if (this._hasChildren === x)
+            return;
+
+        this._hasChildren = x;
+
+        if (!this._element)
+            return;
+
+        if (this._hasChildren)
+        {
+            this._element.addStyleClass("parent");
+            if (this.expanded)
+                this._element.addStyleClass("expanded");
+        }
+        else
+        {
+            this._element.removeStyleClass("parent");
+            this._element.removeStyleClass("expanded");
+        }
+    },
+
+    get hasChildren()
+    {
+        return this._hasChildren;
+    },
+
     set revealed(x)
     {
         if (this._revealed === x)
@@ -624,6 +643,28 @@ WebInspector.DataGridNode.prototype = {
     removeChildren: WebInspector.DataGrid.prototype.removeChildren,
     removeChildrenRecursive: WebInspector.DataGrid.prototype.removeChildrenRecursive,
 
+    _recalculateSiblings: function(myIndex)
+    {
+        if (!this.parent)
+            return;
+
+        var previousChild = (myIndex > 0 ? this.parent.children[myIndex - 1] : null);
+
+        if (previousChild) {
+            previousChild.nextSibling = this;
+            this.previousSibling = previousChild;
+        } else
+            this.previousSibling = null;
+
+        var nextChild = this.parent.children[myIndex + 1];
+
+        if (nextChild) {
+            nextChild.previousSibling = this;
+            this.nextSibling = nextChild;
+        } else
+            this.nextSibling = null;
+    },
+
     collapse: function()
     {
         if (this._element)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
index 6a91625d3e..122707f24d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -29,7 +29,7 @@ WebInspector.DatabaseQueryView = function(database)
 
     this.database = database;
 
-    this.element.addStyleClass("database-view");
+    this.element.addStyleClass("storage-view");
     this.element.addStyleClass("query");
     this.element.tabIndex = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
index 2e722409bf..bbca9d0046 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
@@ -30,8 +30,13 @@ WebInspector.DatabaseTableView = function(database, tableName)
     this.database = database;
     this.tableName = tableName;
 
-    this.element.addStyleClass("database-view");
+    this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
+
+    this.refreshButton = document.createElement("button");
+    this.refreshButton.title = WebInspector.UIString("Refresh");
+    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
 WebInspector.DatabaseTableView.prototype = {
@@ -41,6 +46,11 @@ WebInspector.DatabaseTableView.prototype = {
         this.update();
     },
 
+    get statusBarItems()
+    {
+        return [this.refreshButton];
+    },
+
     update: function()
     {
         function queryTransaction(tx)
@@ -58,7 +68,7 @@ WebInspector.DatabaseTableView.prototype = {
         var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
         if (!dataGrid) {
             var emptyMsgElement = document.createElement("div");
-            emptyMsgElement.className = "database-table-empty";
+            emptyMsgElement.className = "storage-table-empty";
             emptyMsgElement.textContent = WebInspector.UIString("The “%s”\ntable is empty.", this.tableName);
             this.element.appendChild(emptyMsgElement);
             return;
@@ -72,11 +82,15 @@ WebInspector.DatabaseTableView.prototype = {
         this.element.removeChildren();
 
         var errorMsgElement = document.createElement("div");
-        errorMsgElement.className = "database-table-error";
+        errorMsgElement.className = "storage-table-error";
         errorMsgElement.textContent = WebInspector.UIString("An error occurred trying to\nread the “%s” table.", this.tableName);
         this.element.appendChild(errorMsgElement);
     },
 
+    _refreshButtonClicked: function(event)
+    {
+        this.update();
+    }
 }
 
 WebInspector.DatabaseTableView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js
index df5bbb322a..4644b3b22e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js
@@ -46,9 +46,24 @@ WebInspector.DatabasesPanel = function(database)
 
     this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
 
-    this.databaseViews = document.createElement("div");
-    this.databaseViews.id = "database-views";
-    this.element.appendChild(this.databaseViews);
+    this.databasesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("DATABASES"), {}, true);
+    this.sidebarTree.appendChild(this.databasesListTreeElement);
+    this.databasesListTreeElement.expand();
+
+    this.localStorageListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("LOCAL STORAGE"), {}, true);
+    this.sidebarTree.appendChild(this.localStorageListTreeElement);
+    this.localStorageListTreeElement.expand();
+
+    this.sessionStorageListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("SESSION STORAGE"), {}, true);
+    this.sidebarTree.appendChild(this.sessionStorageListTreeElement);
+    this.sessionStorageListTreeElement.expand();
+
+    this.storageViews = document.createElement("div");
+    this.storageViews.id = "storage-views";
+    this.element.appendChild(this.storageViews);
+
+    this.storageViewStatusBarItemsContainer = document.createElement("div");
+    this.storageViewStatusBarItemsContainer.id = "storage-view-status-bar-items";
 
     this.reset();
 }
@@ -61,6 +76,11 @@ WebInspector.DatabasesPanel.prototype = {
         return WebInspector.UIString("Databases");
     },
 
+    get statusBarItems()
+    {
+        return [this.storageViewStatusBarItemsContainer];
+    },
+
     show: function()
     {
         WebInspector.Panel.prototype.show.call(this);
@@ -81,8 +101,23 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._databases = [];
 
-        this.sidebarTree.removeChildren();
-        this.databaseViews.removeChildren();
+        if (this._domStorage) {
+            var domStorageLength = this._domStorage.length;
+            for (var i = 0; i < domStorageLength; ++i) {
+                var domStorage = this._domStorage[i];
+
+                delete domStorage._domStorageView;
+            }
+        }
+
+        this._domStorage = [];
+
+        this.databasesListTreeElement.removeChildren();
+        this.localStorageListTreeElement.removeChildren();
+        this.sessionStorageListTreeElement.removeChildren();
+        this.storageViews.removeChildren();
+        
+        this.storageViewStatusBarItemsContainer.removeChildren();
     },
 
     handleKeyEvent: function(event)
@@ -96,8 +131,18 @@ WebInspector.DatabasesPanel.prototype = {
 
         var databaseTreeElement = new WebInspector.DatabaseSidebarTreeElement(database);
         database._databasesTreeElement = databaseTreeElement;
+        this.databasesListTreeElement.appendChild(databaseTreeElement);
+    },
 
-        this.sidebarTree.appendChild(databaseTreeElement);
+    addDOMStorage: function(domStorage)
+    {
+        this._domStorage.push(domStorage);
+        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage);
+        domStorage._domStorageTreeElement = domStorageTreeElement;
+        if (domStorage.isLocalStorage)
+            this.localStorageListTreeElement.appendChild(domStorageTreeElement);
+        else
+            this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
     showDatabase: function(database, tableName)
@@ -105,8 +150,8 @@ WebInspector.DatabasesPanel.prototype = {
         if (!database)
             return;
 
-        if (this.visibleDatabaseView)
-            this.visibleDatabaseView.hide();
+        if (this.visibleView)
+            this.visibleView.hide();
 
         var view;
         if (tableName) {
@@ -125,16 +170,46 @@ WebInspector.DatabasesPanel.prototype = {
             }
         }
 
-        view.show(this.databaseViews);
+        view.show(this.storageViews);
+
+        this.visibleView = view;
 
-        this.visibleDatabaseView = view;
+        this.storageViewStatusBarItemsContainer.removeChildren();
+        var statusBarItems = view.statusBarItems;
+        for (var i = 0; i < statusBarItems.length; ++i)
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+    },
+
+    showDOMStorage: function(domStorage)
+    {
+        if (!domStorage)
+            return;
+
+        if (this.visibleView)
+            this.visibleView.hide();
+
+        var view;
+        view = domStorage._domStorageView;
+        if (!view) {
+            view = new WebInspector.DOMStorageItemsView(domStorage);
+            domStorage._domStorageView = view;
+        }
+
+        view.show(this.storageViews);
+
+        this.visibleView = view;
+
+        this.storageViewStatusBarItemsContainer.removeChildren();
+        var statusBarItems = view.statusBarItems;
+        for (var i = 0; i < statusBarItems.length; ++i)
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
     closeVisibleView: function()
     {
-        if (this.visibleDatabaseView)
-            this.visibleDatabaseView.hide();
-        delete this.visibleDatabaseView;
+        if (this.visibleView)
+            this.visibleView.hide();
+        delete this.visibleView;
     },
 
     updateDatabaseTables: function(database)
@@ -155,7 +230,7 @@ WebInspector.DatabasesPanel.prototype = {
 
         for (var tableName in database._tableViews) {
             if (!(tableName in tableNamesHash)) {
-                if (this.visibleDatabaseView === database._tableViews[tableName])
+                if (this.visibleView === database._tableViews[tableName])
                     this.closeVisibleView();
                 delete database._tableViews[tableName];
             }
@@ -241,6 +316,60 @@ WebInspector.DatabasesPanel.prototype = {
         return dataGrid;
     },
 
+    dataGridForDOMStorage: function(domStorage)
+    {
+        if (!domStorage.length)
+            return null;
+
+        var columns = {};
+        columns[0] = {};
+        columns[1] = {};
+        columns[0].title = WebInspector.UIString("Key");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[0].title.length;
+
+        var nodes = [];
+        
+        var length = domStorage.length;
+        for (index = 0; index < domStorage.length; index++) {
+            var data = {};
+       
+            var key = String(domStorage.key(index));
+            data[0] = key;
+            if (key.length > columns[0].width)
+                columns[0].width = key.length;
+        
+            var value = String(domStorage.getItem(key));
+            data[1] = value;
+            if (value.length > columns[1].width)
+                columns[1].width = value.length;
+            var node = new WebInspector.DataGridNode(data, false);
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = columns[0].width + columns[1].width;
+        width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        const minimumPrecent = 10;
+        if (width < minimumPrecent)
+            width = minimumPrecent;
+        if (width > 100 - minimumPrecent)
+            width = 100 - minimumPrecent;
+        columns[0].width = width;
+        columns[1].width = 100 - width;
+        columns[0].width += "%";
+        columns[1].width += "%";
+
+        var dataGrid = new WebInspector.DOMStorageDataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+        return dataGrid;
+    },
+
     _startSidebarDragging: function(event)
     {
         WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
@@ -277,7 +406,8 @@ WebInspector.DatabasesPanel.prototype = {
         this._currentSidebarWidth = width;
 
         this.sidebarElement.style.width = width + "px";
-        this.databaseViews.style.left = width + "px";
+        this.storageViews.style.left = width + "px";
+        this.storageViewStatusBarItemsContainer.style.left = width + "px";
         this.sidebarResizeElement.style.left = (width - 3) + "px";
     }
 }
@@ -355,3 +485,42 @@ WebInspector.SidebarDatabaseTableTreeElement.prototype = {
 }
 
 WebInspector.SidebarDatabaseTableTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
+{
+
+    this.domStorage = domStorage;
+
+    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item", domStorage, "", null, false);
+
+    this.refreshTitles();
+}
+
+WebInspector.DOMStorageSidebarTreeElement.prototype = {
+    onselect: function()
+    {
+        WebInspector.panels.databases.showDOMStorage(this.domStorage);
+    },
+
+    get mainTitle()
+    {
+        return this.domStorage.domain;
+    },
+
+    set mainTitle(x)
+    {
+        // Do nothing.
+    },
+
+    get subtitle()
+    {
+        return ""; //this.database.displayDomain;
+    },
+
+    set subtitle(x)
+    {
+        // Do nothing.
+    }
+}
+
+WebInspector.DOMStorageSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
index 16e31b8c8a..2da2f104b7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -487,7 +487,7 @@ WebInspector.ElementsTreeElement.prototype = {
             return;
 
         if (this.treeOutline.panel) {
-            this.treeOutline.rootDOMNode = this.parent.representedObject;
+            this.treeOutline.rootDOMNode = this.representedObject.parentNode;
             this.treeOutline.focusedDOMNode = this.representedObject;
         }
 
@@ -571,7 +571,7 @@ WebInspector.ElementsTreeElement.prototype = {
         parseContainerElement.innerHTML = "<span " + newText + "></span>";
         var parseElement = parseContainerElement.firstChild;
         if (!parseElement || !parseElement.hasAttributes()) {
-            editingCancelled(element, context);
+            this._editingCancelled(element, context);
             return;
         }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png
new file mode 100644
index 0000000000..028550c2ef
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/radioDot.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/radioDot.png
new file mode 100644
index 0000000000..609878ff7b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/radioDot.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/userInputResultIcon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/userInputResultIcon.png
new file mode 100644
index 0000000000..794a5ca476
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/userInputResultIcon.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
index 6ec565ba13..fab6d769a3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
@@ -44,6 +44,23 @@ WebInspector.PanelEnablerView = function(identifier, headingText, disclaimerText
     this.headerElement.textContent = headingText;
     this.choicesForm.appendChild(this.headerElement);
 
+    var self = this;
+    function enableOption(text, checked) {
+        var label = document.createElement("label");
+        var option = document.createElement("input");
+        option.type = "radio";
+        option.name = "enable-option";
+        if (checked)
+            option.checked = true;
+        label.appendChild(option);
+        label.appendChild(document.createTextNode(text));
+        self.choicesForm.appendChild(label);
+        return option;
+    };
+
+    this.enabledForSession = enableOption(WebInspector.UIString("Only enable for this session"), true);
+    this.enabledAlways = enableOption(WebInspector.UIString("Always enable"));
+
     this.disclaimerElement = document.createElement("div");
     this.disclaimerElement.className = "panel-enabler-disclaimer";
     this.disclaimerElement.textContent = disclaimerText;
@@ -70,6 +87,10 @@ WebInspector.PanelEnablerView.prototype = {
 
         if (this.element.offsetWidth < (this.choicesForm.offsetWidth + this.imageElement.offsetWidth))
             this.imageElement.addStyleClass("hidden");
+    },
+
+    get alwaysEnabled() {
+        return this.enabledAlways.checked;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
new file mode 100644
index 0000000000..84d992372b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -0,0 +1,398 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ProfileDataGridNode = function(profileView, profileNode, owningTree, hasChildren)
+{
+    this.profileView = profileView;
+    this.profileNode = profileNode;
+
+    WebInspector.DataGridNode.call(this, null, hasChildren);
+
+    this.addEventListener("populate", this._populate, this);
+
+    this.tree = owningTree;
+
+    this.childrenByCallUID = {};
+    this.lastComparator = null;
+
+    this.callUID = profileNode.callUID;
+    this.selfTime = profileNode.selfTime;
+    this.totalTime = profileNode.totalTime;
+    this.functionName = profileNode.functionName;
+    this.numberOfCalls = profileNode.numberOfCalls;
+    this.url = profileNode.url;
+}
+
+WebInspector.ProfileDataGridNode.prototype = {
+    get data()
+    {
+        function formatMilliseconds(time)
+        {
+            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
+        }
+
+        var data = {};
+
+        data["function"] = this.functionName;
+        data["calls"] = this.numberOfCalls;
+
+        if (this.profileView.showSelfTimeAsPercent)
+            data["self"] = WebInspector.UIString("%.2f%%", this.selfPercent);
+        else
+            data["self"] = formatMilliseconds(this.selfTime);
+
+        if (this.profileView.showTotalTimeAsPercent)
+            data["total"] = WebInspector.UIString("%.2f%%", this.totalPercent);
+        else
+            data["total"] = formatMilliseconds(this.totalTime);
+
+        if (this.profileView.showAverageTimeAsPercent)
+            data["average"] = WebInspector.UIString("%.2f%%", this.averagePercent);
+        else
+            data["average"] = formatMilliseconds(this.averageTime);
+
+        return data;
+    },
+
+    createCell: function(columnIdentifier)
+    {
+        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+
+        if (columnIdentifier === "self" && this._searchMatchedSelfColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "total" && this._searchMatchedTotalColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "average" && this._searchMatchedAverageColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "calls" && this._searchMatchedCallsColumn)
+            cell.addStyleClass("highlight");
+
+        if (columnIdentifier !== "function")
+            return cell;
+
+        if (this.profileNode._searchMatchedFunctionColumn)
+            cell.addStyleClass("highlight");
+
+        if (this.profileNode.url) {
+            var fileName = WebInspector.displayNameForURL(this.profileNode.url);
+
+            var urlElement = document.createElement("a");
+            urlElement.className = "profile-node-file webkit-html-resource-link";
+            urlElement.href = this.profileNode.url;
+            urlElement.lineNumber = this.profileNode.lineNumber;
+
+            if (this.profileNode.lineNumber > 0)
+                urlElement.textContent = fileName + ":" + this.profileNode.lineNumber;
+            else
+                urlElement.textContent = fileName;
+
+            cell.insertBefore(urlElement, cell.firstChild);
+        }
+
+        return cell;
+    },
+
+    select: function(supressSelectedEvent)
+    {
+        WebInspector.DataGridNode.prototype.select.call(this, supressSelectedEvent);
+        this.profileView._dataGridNodeSelected(this);
+    },
+
+    deselect: function(supressDeselectedEvent)
+    {
+        WebInspector.DataGridNode.prototype.deselect.call(this, supressDeselectedEvent);
+        this.profileView._dataGridNodeDeselected(this);
+    },
+
+    expand: function()
+    {
+        if (!this.parent) {
+            var currentComparator = this.parent.lastComparator;
+
+            if (!currentComparator || (currentComparator === this.lastComparator))
+                return;
+
+            this.sort(currentComparator);
+        }
+
+        WebInspector.DataGridNode.prototype.expand.call(this);
+    },
+
+    sort: function(/*Function*/ comparator, /*Boolean*/ force)
+    {
+        var gridNodeGroups = [[this]];
+
+        for (var gridNodeGroupIndex = 0; gridNodeGroupIndex < gridNodeGroups.length; ++gridNodeGroupIndex) {
+            var gridNodes = gridNodeGroups[gridNodeGroupIndex];
+            var count = gridNodes.length;
+
+            for (var index = 0; index < count; ++index) {
+                var gridNode = gridNodes[index];
+
+                // If the grid node is collapsed, then don't sort children (save operation for later).
+                // If the grid node has the same sorting as previously, then there is no point in sorting it again.
+                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator)
+                    continue;
+
+                gridNode.lastComparator = comparator;
+
+                var children = gridNode.children;
+                var childCount = children.length;
+
+                if (childCount) {
+                    children.sort(comparator);
+
+                    for (var childIndex = 0; childIndex < childCount; ++childIndex)
+                        children[childIndex]._recalculateSiblings(childIndex);
+
+                    gridNodeGroups.push(children);
+                }
+            }
+        }
+    },
+
+    insertChild: function(/*ProfileDataGridNode*/ profileDataGridNode, index)
+    {
+        WebInspector.DataGridNode.prototype.insertChild.call(this, profileDataGridNode, index);
+
+        this.childrenByCallUID[profileDataGridNode.callUID] = profileDataGridNode;
+    },
+
+    removeChild: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        WebInspector.DataGridNode.prototype.removeChild.call(this, profileDataGridNode);
+
+        delete this.childrenByCallUID[profileDataGridNode.callUID];
+    },
+
+    removeChildren: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        WebInspector.DataGridNode.prototype.removeChildren.call(this);
+
+        this.childrenByCallUID = {};
+    },
+
+    findChild: function(/*Node*/ node)
+    {
+        if (!node)
+            return null;
+        return this.childrenByCallUID[node.callUID];
+    },
+
+    get averageTime()
+    {
+        return this.selfTime / Math.max(1, this.numberOfCalls);
+    },
+
+    get averagePercent()
+    {
+        return this.averageTime / this.tree.totalTime * 100.0;
+    },
+
+    get selfPercent()
+    {
+        return this.selfTime / this.tree.totalTime * 100.0;
+    },
+
+    get totalPercent()
+    {
+        return this.totalTime / this.tree.totalTime * 100.0;
+    },
+
+    // When focusing and collapsing we modify lots of nodes in the tree.
+    // This allows us to restore them all to their original state when we revert.
+    _save: function()
+    {
+        if (this._savedChildren)
+            return;
+
+        this._savedSelfTime = this.selfTime;
+        this._savedTotalTime = this.totalTime;
+        this._savedNumberOfCalls = this.numberOfCalls;
+
+        this._savedChildren = this.children.slice();
+    },
+
+    // When focusing and collapsing we modify lots of nodes in the tree.
+    // This allows us to restore them all to their original state when we revert.
+    _restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.selfTime = this._savedSelfTime;
+        this.totalTime = this._savedTotalTime;
+        this.numberOfCalls = this._savedNumberOfCalls;
+
+        this.removeChildren();
+
+        var children = this._savedChildren;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            children[index]._restore();
+            this.appendChild(children[index]);
+        }
+    },
+
+    _merge: function(child, shouldAbsorb)
+    {
+        this.selfTime += child.selfTime;
+
+        if (!shouldAbsorb) {
+            this.totalTime += child.totalTime;
+            this.numberOfCalls += child.numberOfCalls;
+        }
+
+        var children = this.children.slice();
+
+        this.removeChildren();
+
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            if (!shouldAbsorb || children[index] !== child)
+                this.appendChild(children[index]);
+        }
+
+        children = child.children.slice();
+        count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            var orphanedChild = children[index],
+                existingChild = this.childrenByCallUID[orphanedChild.callUID];
+
+            if (existingChild)
+                existingChild._merge(orphanedChild, false);
+            else
+                this.appendChild(orphanedChild);
+        }
+    }
+}
+
+WebInspector.ProfileDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
+
+WebInspector.ProfileDataGridTree = function(profileView, profileNode)
+{
+    this.tree = this;
+    this.children = [];
+
+    this.profileView = profileView;
+
+    this.totalTime = profileNode.totalTime;
+    this.lastComparator = null;
+
+    this.childrenByCallUID = {};
+}
+
+WebInspector.ProfileDataGridTree.prototype = {
+    get expanded()
+    {
+        return true;
+    },
+
+    appendChild: function(child)
+    {
+        this.insertChild(child, this.children.length);
+    },
+
+    insertChild: function(child, index)
+    {
+        this.children.splice(index, 0, child);
+        this.childrenByCallUID[child.callUID] = child;
+    },
+
+    removeChildren: function()
+    {
+        this.children = [];
+        this.childrenByCallUID = {};
+    },
+
+    findChild: WebInspector.ProfileDataGridNode.prototype.findChild,
+    sort: WebInspector.ProfileDataGridNode.prototype.sort,
+
+    _save: function()
+    {
+        if (this._savedChildren)
+            return;
+
+        this._savedTotalTime = this.totalTime;
+        this._savedChildren = this.children.slice();
+    },
+
+    restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.children = this._savedChildren;
+        this.totalTime = this._savedTotalTime;
+
+        var children = this.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            children[index]._restore();
+
+        this._savedChildren = null;
+    }
+}
+
+WebInspector.ProfileDataGridTree.propertyComparators = [{}, {}];
+
+WebInspector.ProfileDataGridTree.propertyComparator = function(/*String*/ property, /*Boolean*/ isAscending)
+{
+    var comparator = this.propertyComparators[(isAscending ? 1 : 0)][property];
+
+    if (!comparator) {
+        if (isAscending) {
+            comparator = function(lhs, rhs)
+            {
+                if (lhs[property] < rhs[property])
+                    return -1;
+
+                if (lhs[property] > rhs[property])
+                    return 1;
+
+                return 0;
+            }
+        } else {
+            comparator = function(lhs, rhs)
+            {
+                if (lhs[property] > rhs[property])
+                    return -1;
+
+                if (lhs[property] < rhs[property])
+                    return 1;
+
+                return 0;
+            }
+        }
+
+        this.propertyComparators[(isAscending ? 1 : 0)][property] = comparator;
+    }
+
+    return comparator;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index 92e9726f27..d00733c483 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -31,9 +31,11 @@ WebInspector.ProfileView = function(profile)
 
     this.showSelfTimeAsPercent = true;
     this.showTotalTimeAsPercent = true;
+    this.showAverageTimeAsPercent = true;
 
     var columns = { "self": { title: WebInspector.UIString("Self"), width: "72px", sort: "descending", sortable: true },
                     "total": { title: WebInspector.UIString("Total"), width: "72px", sortable: true },
+                    "average": { title: WebInspector.UIString("Average"), width: "72px", sortable: true },
                     "calls": { title: WebInspector.UIString("Calls"), width: "54px", sortable: true },
                     "function": { title: WebInspector.UIString("Function"), disclosure: true, sortable: true } };
 
@@ -75,16 +77,14 @@ WebInspector.ProfileView = function(profile)
     this.resetButton.className = "reset-profile-status-bar-item status-bar-item hidden";
     this.resetButton.addEventListener("click", this._resetClicked.bind(this), false);
 
-    // Default to the heavy profile.
-    profile = profile.heavyProfile;
+    this.profile = profile;
 
-    // By default the profile isn't sorted, so sort based on our default sort
-    // column and direction added to the DataGrid columns above.
-    profile.sortSelfTimeDescending();
+    this.profileDataGridTree = this.bottomUpProfileDataGridTree;
+    this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
 
-    this._updatePercentButton();
+    this.refresh();
 
-    this.profile = profile;
+    this._updatePercentButton();
 }
 
 WebInspector.ProfileView.prototype = {
@@ -101,9 +101,53 @@ WebInspector.ProfileView.prototype = {
     set profile(profile)
     {
         this._profile = profile;
+    },
+
+    get bottomUpProfileDataGridTree()
+    {
+        if (!this._bottomUpProfileDataGridTree)
+            this._bottomUpProfileDataGridTree = new WebInspector.BottomUpProfileDataGridTree(this, this.profile.head);
+        return this._bottomUpProfileDataGridTree;
+    },
+
+    get topDownProfileDataGridTree()
+    {
+        if (!this._topDownProfileDataGridTree)
+            this._topDownProfileDataGridTree = new WebInspector.TopDownProfileDataGridTree(this, this.profile.head);
+        return this._topDownProfileDataGridTree;
+    },
+
+    get currentTree()
+    {
+        return this._currentTree;
+    },
+
+    set currentTree(tree)
+    {
+        this._currentTree = tree;
         this.refresh();
     },
 
+    get topDownTree()
+    {
+        if (!this._topDownTree) {
+            this._topDownTree = WebInspector.TopDownTreeFactory.create(this.profile.head);
+            this._sortProfile(this._topDownTree);
+        }
+
+        return this._topDownTree;
+    },
+
+    get bottomUpTree()
+    {
+        if (!this._bottomUpTree) {
+            this._bottomUpTree = WebInspector.BottomUpTreeFactory.create(this.profile.head);
+            this._sortProfile(this._bottomUpTree);
+        }
+
+        return this._bottomUpTree;
+    },
+
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
@@ -116,20 +160,18 @@ WebInspector.ProfileView.prototype = {
 
         this.dataGrid.removeChildren();
 
-        var children = this.profile.head.children;
-        var childrenLength = children.length;
-        for (var i = 0; i < childrenLength; ++i)
-            if (children[i].visible)
-                this.dataGrid.appendChild(new WebInspector.ProfileDataGridNode(this, children[i]));
+        var children = this.profileDataGridTree.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            this.dataGrid.appendChild(children[index]);
 
         if (selectedProfileNode && selectedProfileNode._dataGridNode)
             selectedProfileNode._dataGridNode.selected = true;
     },
 
-    refreshShowAsPercents: function()
+    refreshVisibleData: function()
     {
-        this._updatePercentButton();
-
         var child = this.dataGrid.children[0];
         while (child) {
             child.refresh();
@@ -137,6 +179,12 @@ WebInspector.ProfileView.prototype = {
         }
     },
 
+    refreshShowAsPercents: function()
+    {
+        this._updatePercentButton();
+        this.refreshVisibleData();
+    },
+
     searchCanceled: function()
     {
         if (this._searchResults) {
@@ -191,71 +239,90 @@ WebInspector.ProfileView.prototype = {
         if (!isNaN(queryNumber) && !(greaterThan || lessThan))
             equalTo = true;
 
-        function matchesQuery(profileNode)
+        function matchesQuery(/*ProfileDataGridNode*/ profileDataGridNode)
         {
-            delete profileNode._searchMatchedSelfColumn;
-            delete profileNode._searchMatchedTotalColumn;
-            delete profileNode._searchMatchedCallsColumn;
-            delete profileNode._searchMatchedFunctionColumn;
+            delete profileDataGridNode._searchMatchedSelfColumn;
+            delete profileDataGridNode._searchMatchedTotalColumn;
+            delete profileDataGridNode._searchMatchedAverageColumn;
+            delete profileDataGridNode._searchMatchedCallsColumn;
+            delete profileDataGridNode._searchMatchedFunctionColumn;
 
             if (percentUnits) {
                 if (lessThan) {
-                    if (profileNode.selfPercent < queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent < queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent < queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent < queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 } else if (greaterThan) {
-                    if (profileNode.selfPercent > queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent > queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent > queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent > queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
 
                 if (equalTo) {
-                    if (profileNode.selfPercent == queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent == queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent == queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent == queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
             } else if (millisecondsUnits || secondsUnits) {
                 if (lessThan) {
-                    if (profileNode.selfTime < queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime < queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 } else if (greaterThan) {
-                    if (profileNode.selfTime > queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime > queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
 
                 if (equalTo) {
-                    if (profileNode.selfTime == queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime == queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
             } else {
-                if (equalTo && profileNode.numberOfCalls == queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
-                if (greaterThan && profileNode.numberOfCalls > queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
-                if (lessThan && profileNode.numberOfCalls < queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
+                if (equalTo && profileDataGridNode.numberOfCalls == queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
+                if (greaterThan && profileDataGridNode.numberOfCalls > queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
+                if (lessThan && profileDataGridNode.numberOfCalls < queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
             }
 
-            if (profileNode.functionName.hasSubstring(query, true) || profileNode.url.hasSubstring(query, true))
-                profileNode._searchMatchedFunctionColumn = true;
-
-            var matched = (profileNode._searchMatchedSelfColumn || profileNode._searchMatchedTotalColumn || profileNode._searchMatchedCallsColumn || profileNode._searchMatchedFunctionColumn);
-            if (matched && profileNode._dataGridNode)
-                profileNode._dataGridNode.refresh();
+            if (profileDataGridNode.functionName.hasSubstring(query, true) || profileDataGridNode.url.hasSubstring(query, true))
+                profileDataGridNode._searchMatchedFunctionColumn = true;
+
+            if (profileDataGridNode._searchMatchedSelfColumn ||
+                profileDataGridNode._searchMatchedTotalColumn ||
+                profileDataGridNode._searchMatchedAverageColumn ||
+                profileDataGridNode._searchMatchedCallsColumn ||
+                profileDataGridNode._searchMatchedFunctionColumn);
+            {
+                profileDataGridNode.refresh();
+                return true;
+            }
 
-            return matched;
+            return false;
         }
 
-        var current = this.profile.head;
+        var current = this.dataGrid;
         var ancestors = [];
         var nextIndexes = [];
         var startIndex = 0;
@@ -380,12 +447,12 @@ WebInspector.ProfileView.prototype = {
             return;
 
         if (event.target.selectedIndex == 1 && this.view == "Heavy") {
-            this._sortProfile(this.profile.treeProfile);
-            this.profile = this.profile.treeProfile;
+            this.profileDataGridTree = this.topDownProfileDataGridTree;
+            this._sortProfile();
             this.view = "Tree";
         } else if (event.target.selectedIndex == 0 && this.view == "Tree") {
-            this._sortProfile(this.profile.heavyProfile);
-            this.profile = this.profile.heavyProfile;
+            this.profileDataGridTree = this.bottomUpProfileDataGridTree;
+            this._sortProfile();
             this.view = "Heavy";
         }
 
@@ -401,15 +468,16 @@ WebInspector.ProfileView.prototype = {
 
     _percentClicked: function(event)
     {
-        var currentState = this.showSelfTimeAsPercent && this.showTotalTimeAsPercent;
+        var currentState = this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent;
         this.showSelfTimeAsPercent = !currentState;
         this.showTotalTimeAsPercent = !currentState;
+        this.showAverageTimeAsPercent = !currentState;
         this.refreshShowAsPercents();
     },
 
     _updatePercentButton: function()
     {
-        if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent) {
+        if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent) {
             this.percentButton.title = WebInspector.UIString("Show absolute total and self times.");
             this.percentButton.addStyleClass("toggled-on");
         } else {
@@ -420,28 +488,36 @@ WebInspector.ProfileView.prototype = {
 
     _focusClicked: function(event)
     {
-        if (!this.dataGrid.selectedNode || !this.dataGrid.selectedNode.profileNode)
+        if (!this.dataGrid.selectedNode)
             return;
+
         this.resetButton.removeStyleClass("hidden");
-        this.profile.focus(this.dataGrid.selectedNode.profileNode);
+        this.profileDataGridTree.focus(this.dataGrid.selectedNode);
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _excludeClicked: function(event)
     {
-        if (!this.dataGrid.selectedNode || !this.dataGrid.selectedNode.profileNode)
+        var selectedNode = this.dataGrid.selectedNode
+
+        if (!selectedNode)
             return;
+
+        selectedNode.deselect();
+
         this.resetButton.removeStyleClass("hidden");
-        this.profile.exclude(this.dataGrid.selectedNode.profileNode);
-        this.dataGrid.selectedNode.deselect();
+        this.profileDataGridTree.exclude(selectedNode);
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _resetClicked: function(event)
     {
         this.resetButton.addStyleClass("hidden");
-        this.profile.restoreAll();
+        this.profileDataGridTree.restore();
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _dataGridNodeSelected: function(node)
@@ -461,37 +537,21 @@ WebInspector.ProfileView.prototype = {
         this._sortProfile(this.profile);
     },
 
-    _sortProfile: function(profile)
+    _sortProfile: function()
     {
-        if (!profile)
-            return;
-
-        var sortOrder = this.dataGrid.sortOrder;
+        var sortAscending = this.dataGrid.sortOrder === "ascending";
         var sortColumnIdentifier = this.dataGrid.sortColumnIdentifier;
+        var sortProperty = {
+                "average": "averageTime",
+                "self": "selfTime",
+                "total": "totalTime",
+                "calls": "numberOfCalls",
+                "function": "functionName"
+            }[sortColumnIdentifier];
 
-        var sortingFunctionName = "sort";
-
-        if (sortColumnIdentifier === "self")
-            sortingFunctionName += "SelfTime";
-        else if (sortColumnIdentifier === "total")
-            sortingFunctionName += "TotalTime";
-        else if (sortColumnIdentifier === "calls")
-            sortingFunctionName += "Calls";
-        else if (sortColumnIdentifier === "function")
-            sortingFunctionName += "FunctionName";
-
-        if (sortOrder === "ascending")
-            sortingFunctionName += "Ascending";
-        else
-            sortingFunctionName += "Descending";
-
-        if (!(sortingFunctionName in this.profile))
-            return;
-
-        profile[sortingFunctionName]();
+        this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator(sortProperty, sortAscending));
 
-        if (profile === this.profile)
-            this.refresh();
+        this.refresh();
     },
 
     _mouseDownInDataGrid: function(event)
@@ -500,13 +560,15 @@ WebInspector.ProfileView.prototype = {
             return;
 
         var cell = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!cell || (!cell.hasStyleClass("total-column") && !cell.hasStyleClass("self-column")))
+        if (!cell || (!cell.hasStyleClass("total-column") && !cell.hasStyleClass("self-column") && !cell.hasStyleClass("average-column")))
             return;
 
         if (cell.hasStyleClass("total-column"))
             this.showTotalTimeAsPercent = !this.showTotalTimeAsPercent;
         else if (cell.hasStyleClass("self-column"))
             this.showSelfTimeAsPercent = !this.showSelfTimeAsPercent;
+        else if (cell.hasStyleClass("average-column"))
+            this.showAverageTimeAsPercent = !this.showAverageTimeAsPercent;
 
         this.refreshShowAsPercents();
 
@@ -516,127 +578,3 @@ WebInspector.ProfileView.prototype = {
 }
 
 WebInspector.ProfileView.prototype.__proto__ = WebInspector.View.prototype;
-
-WebInspector.ProfileDataGridNode = function(profileView, profileNode)
-{
-    this.profileView = profileView;
-
-    this.profileNode = profileNode;
-    profileNode._dataGridNode = this;
-
-    // Find the first child that is visible. Since we don't want to claim
-    // we have children if all the children are invisible.
-    var hasChildren = false;
-    var children = this.profileNode.children;
-    var childrenLength = children.length;
-    for (var i = 0; i < childrenLength; ++i) {
-        if (children[i].visible) {
-            hasChildren = true;
-            break;
-        }
-    }
-
-    WebInspector.DataGridNode.call(this, null, hasChildren);
-
-    this.addEventListener("populate", this._populate, this);
-
-    this.expanded = profileNode._expanded;
-}
-
-WebInspector.ProfileDataGridNode.prototype = {
-    get data()
-    {
-        function formatMilliseconds(time)
-        {
-            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
-        }
-
-        var data = {};
-        data["function"] = this.profileNode.functionName;
-        data["calls"] = this.profileNode.numberOfCalls;
-
-        if (this.profileView.showSelfTimeAsPercent)
-            data["self"] = WebInspector.UIString("%.2f%%", this.profileNode.selfPercent);
-        else
-            data["self"] = formatMilliseconds(this.profileNode.selfTime);
-
-        if (this.profileView.showTotalTimeAsPercent)
-            data["total"] = WebInspector.UIString("%.2f%%", this.profileNode.totalPercent);
-        else
-            data["total"] = formatMilliseconds(this.profileNode.totalTime);
-
-        return data;
-    },
-
-    createCell: function(columnIdentifier)
-    {
-        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
-
-        if (columnIdentifier === "self" && this.profileNode._searchMatchedSelfColumn)
-            cell.addStyleClass("highlight");
-        else if (columnIdentifier === "total" && this.profileNode._searchMatchedTotalColumn)
-            cell.addStyleClass("highlight");
-        else if (columnIdentifier === "calls" && this.profileNode._searchMatchedCallsColumn)
-            cell.addStyleClass("highlight");
-
-        if (columnIdentifier !== "function")
-            return cell;
-
-        if (this.profileNode._searchMatchedFunctionColumn)
-            cell.addStyleClass("highlight");
-
-        if (this.profileNode.url) {
-            var fileName = WebInspector.displayNameForURL(this.profileNode.url);
-
-            var urlElement = document.createElement("a");
-            urlElement.className = "profile-node-file webkit-html-resource-link";
-            urlElement.href = this.profileNode.url;
-            urlElement.lineNumber = this.profileNode.lineNumber;
-
-            if (this.profileNode.lineNumber > 0)
-                urlElement.textContent = fileName + ":" + this.profileNode.lineNumber;
-            else
-                urlElement.textContent = fileName;
-
-            cell.insertBefore(urlElement, cell.firstChild);
-        }
-
-        return cell;
-    },
-
-    select: function(supressSelectedEvent)
-    {
-        WebInspector.DataGridNode.prototype.select.call(this, supressSelectedEvent);
-        this.profileView._dataGridNodeSelected(this);
-    },
-
-    deselect: function(supressDeselectedEvent)
-    {
-        WebInspector.DataGridNode.prototype.deselect.call(this, supressDeselectedEvent);
-        this.profileView._dataGridNodeDeselected(this);
-    },
-
-    expand: function()
-    {
-        WebInspector.DataGridNode.prototype.expand.call(this);
-        this.profileNode._expanded = true;
-    },
-
-    collapse: function()
-    {
-        WebInspector.DataGridNode.prototype.collapse.call(this);
-        this.profileNode._expanded = false;
-    },
-
-    _populate: function(event)
-    {
-        var children = this.profileNode.children;
-        var childrenLength = children.length;
-        for (var i = 0; i < childrenLength; ++i)
-            if (children[i].visible)
-                this.appendChild(new WebInspector.ProfileDataGridNode(this.profileView, children[i]));
-        this.removeEventListener("populate", this._populate, this);
-    }
-}
-
-WebInspector.ProfileDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
index ea3b85c5e5..aafc3063cc 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
@@ -218,7 +218,7 @@ WebInspector.ProfilesPanel.prototype = {
         view.show(this.profileViews);
 
         profile._profilesTreeElement.select(true);
-        profile._profilesTreeElement.reveal()
+        profile._profilesTreeElement.reveal();
 
         this.visibleView = view;
 
@@ -231,8 +231,7 @@ WebInspector.ProfilesPanel.prototype = {
 
     showView: function(view)
     {
-        // Always use the treeProfile, since the heavy profile might be showing.
-        this.showProfile(view.profile.treeProfile);
+        this.showProfile(view.profile);
     },
 
     profileViewForProfile: function(profile)
@@ -295,8 +294,7 @@ WebInspector.ProfilesPanel.prototype = {
 
     searchMatchFound: function(view, matches)
     {
-        // Always use the treeProfile, since the heavy profile might be showing.
-        view.profile.treeProfile._profilesTreeElement.searchMatches = matches;
+        view.profile._profilesTreeElement.searchMatches = matches;
     },
 
     searchCanceled: function(startingNewSearch)
@@ -356,15 +354,15 @@ WebInspector.ProfilesPanel.prototype = {
     {
         if (InspectorController.profilerEnabled())
             return;
-        this._toggleProfiling();
+        this._toggleProfiling(this.panelEnablerView.alwaysEnabled);
     },
 
-    _toggleProfiling: function()
+    _toggleProfiling: function(optionalAlways)
     {
         if (InspectorController.profilerEnabled())
-            InspectorController.disableProfiler();
+            InspectorController.disableProfiler(true);
         else
-            InspectorController.enableProfiler();
+            InspectorController.enableProfiler(!!optionalAlways);
     },
 
     _populateProfiles: function()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index e02baf35cd..04d998e24f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -126,6 +126,19 @@ WebInspector.ResourcesPanel = function()
 
     this.resourcesTreeElement.expand();
 
+    var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use the this panel.");
+    var panelEnablerDisclaimer = WebInspector.UIString("Enabling resource tracking will reload the page and make page loading slower.");
+    var panelEnablerButton = WebInspector.UIString("Enable resource tracking");
+
+    this.panelEnablerView = new WebInspector.PanelEnablerView("resources", panelEnablerHeading, panelEnablerDisclaimer, panelEnablerButton);
+    this.panelEnablerView.addEventListener("enable clicked", this._enableResourceTracking, this);
+
+    this.element.appendChild(this.panelEnablerView.element);
+
+    this.enableToggleButton = document.createElement("button");
+    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
+
     this.largerResourcesButton = document.createElement("button");
     this.largerResourcesButton.id = "resources-larger-resources-status-bar-item";
     this.largerResourcesButton.className = "status-bar-item toggled-on";
@@ -151,7 +164,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.largerResourcesButton, this.sortingSelectElement];
+        return [this.enableToggleButton, this.largerResourcesButton, this.sortingSelectElement];
     },
 
     show: function()
@@ -358,6 +371,16 @@ WebInspector.ResourcesPanel.prototype = {
         this._updateSummaryGraph();
     },
 
+    resourceTrackingWasEnabled: function()
+    {
+        this.reset();
+    },
+
+    resourceTrackingWasDisabled: function()
+    {
+        this.reset();
+    },
+
     reset: function()
     {
         this.closeVisibleResource();
@@ -394,6 +417,20 @@ WebInspector.ResourcesPanel.prototype = {
         this._updateGraphDividersIfNeeded(true);
 
         this._drawSummaryGraph(); // draws an empty graph
+
+        if (InspectorController.resourceTrackingEnabled()) {
+            this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
+            this.enableToggleButton.addStyleClass("toggled-on");
+            this.largerResourcesButton.removeStyleClass("hidden");
+            this.sortingSelectElement.removeStyleClass("hidden");
+            this.panelEnablerView.visible = false;
+        } else {
+            this.enableToggleButton.title = WebInspector.UIString("Resource tracking disabled. Click to enable.");
+            this.enableToggleButton.removeStyleClass("toggled-on");
+            this.largerResourcesButton.addStyleClass("hidden");
+            this.sortingSelectElement.addStyleClass("hidden");
+            this.panelEnablerView.visible = true;
+        }
     },
 
     addResource: function(resource)
@@ -1085,6 +1122,26 @@ WebInspector.ResourcesPanel.prototype = {
         var visibleView = this.visibleView;
         if (visibleView && "resize" in visibleView)
             visibleView.resize();
+    },
+
+    _enableResourceTracking: function()
+    {
+        if (InspectorController.resourceTrackingEnabled())
+            return;
+        this._toggleResourceTracking(this.panelEnablerView.alwaysEnabled);
+    },
+
+    _toggleResourceTracking: function(optionalAlways)
+    {
+        if (InspectorController.resourceTrackingEnabled()) {
+            this.largerResourcesButton.visible = false;
+            this.sortingSelectElement.visible = false;
+            InspectorController.disableResourceTracking(true);
+        } else {
+            this.largerResourcesButton.visible = true;
+            this.sortingSelectElement.visible = true;
+            InspectorController.enableResourceTracking(!!optionalAlways);
+        }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
index 38a6a96efb..7af9292c30 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
@@ -205,6 +205,10 @@ WebInspector.ScriptsPanel.prototype = {
                 continue;
             view.visible = false;
         }
+        if (this._attachDebuggerWhenShown) {
+            InspectorController.enableDebuggerFromFrontend(false);
+            delete this._attachDebuggerWhenShown;
+        }
     },
 
     get searchableViews()
@@ -359,6 +363,24 @@ WebInspector.ScriptsPanel.prototype = {
         window.focus();
     },
 
+    debuggerResumed: function()
+    {
+        this._paused = false;
+        this._waitingToPause = false;
+        this._stepping = false;
+
+        this._clearInterface();
+    },
+
+    attachDebuggerWhenShown: function()
+    {
+        if (this.element.parentElement) {
+            InspectorController.enableDebuggerFromFrontend(false);
+        } else {
+            this._attachDebuggerWhenShown = true;
+        }
+    },
+
     debuggerWasEnabled: function()
     {
         this.reset();
@@ -569,11 +591,33 @@ WebInspector.ScriptsPanel.prototype = {
 
         var select = this.filesSelectElement;
 
-        // FIXME: Append in some meaningful order.
         var option = document.createElement("option");
         option.representedObject = (script.resource || script);
         option.text = (script.sourceURL ? WebInspector.displayNameForURL(script.sourceURL) : WebInspector.UIString("(program)"));
-        select.appendChild(option);
+
+        function optionCompare(a, b)
+        {
+            var aTitle = a.text.toLowerCase();
+            var bTitle = b.text.toLowerCase();
+            if (aTitle < bTitle)
+                return -1;
+            else if (aTitle > bTitle)
+                return 1;
+
+            var aSourceID = a.representedObject.sourceID;
+            var bSourceID = b.representedObject.sourceID;
+            if (aSourceID < bSourceID)
+                return -1;
+            else if (aSourceID > bSourceID)
+                return 1;
+            return 0;
+        }
+
+        var insertionIndex = insertionIndexForObjectInListSortedByFunction(option, select.childNodes, optionCompare);
+        if (insertionIndex < 0)
+            select.appendChild(option);
+        else
+            select.insertBefore(option, select.childNodes.item(insertionIndex));
 
         script.filesSelectOption = option;
 
@@ -740,19 +784,19 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.debuggerEnabled())
             return;
-        this._toggleDebugging();
+        this._toggleDebugging(this.panelEnablerView.alwaysEnabled);
     },
 
-    _toggleDebugging: function()
+    _toggleDebugging: function(optionalAlways)
     {
         this._paused = false;
         this._waitingToPause = false;
         this._stepping = false;
 
         if (InspectorController.debuggerEnabled())
-            InspectorController.disableDebugger();
+            InspectorController.disableDebugger(true);
         else
-            InspectorController.enableDebugger();
+            InspectorController.enableDebuggerFromFrontend(!!optionalAlways);
     },
 
     _togglePauseOnExceptions: function()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
index 8d6d6d3464..18d9073d07 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
@@ -110,6 +110,11 @@ WebInspector.SourceFrame.prototype = {
 
     revealLine: function(lineNumber)
     {
+        if (!this._isContentLoaded()) {
+            this._lineNumberToReveal = lineNumber;
+            return;
+        }
+    
         var row = this.sourceRow(lineNumber);
         if (row)
             row.scrollIntoViewIfNeeded(true);
@@ -172,6 +177,11 @@ WebInspector.SourceFrame.prototype = {
 
     highlightLine: function(lineNumber)
     {
+        if (!this._isContentLoaded()) {
+            this._lineNumberToHighlight = lineNumber;
+            return;
+        }
+
         var sourceRow = this.sourceRow(lineNumber);
         if (!sourceRow)
             return;
@@ -225,15 +235,36 @@ WebInspector.SourceFrame.prototype = {
 
         this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
         this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
+        this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
         this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeName = Node.prototype.enclosingNodeOrSelfWithNodeName;
+        this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = Node.prototype.enclosingNodeOrSelfWithNodeNameInArray;
 
         this._addExistingMessagesToSource();
         this._addExistingBreakpointsToSource();
         this._updateExecutionLine();
+        if (this._executionLine)
+            this.revealLine(this._executionLine);
 
         if (this.autoSizesToFitContentHeight)
             this.sizeToFitContentHeight();
+            
+        if (this._lineNumberToReveal) {
+            this.revealLine(this._lineNumberToReveal);
+            delete this._lineNumberToReveal;
+        }
+    
+        if (this._lineNumberToHighlight) {
+            this.highlightLine(this._lineNumberToHighlight);
+            delete this._lineNumberToHighlight;
+        }
+        
+        this.dispatchEventToListeners("content loaded");
+    },
+    
+    _isContentLoaded: function() {
+        var doc = this.element.contentDocument;
+        return doc && doc.getElementsByTagName("table")[0];
     },
 
     _windowResized: function(event)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
index 309027e2b2..7510c8cad9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
@@ -95,10 +95,15 @@ WebInspector.SourceView.prototype = {
 
         this.attach();
 
-        if (!InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element))
-            return;
-
         delete this._frameNeedsSetup;
+        this.sourceFrame.addEventListener("content loaded", this._contentLoaded, this);
+        InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
+    },
+    
+    _contentLoaded: function()
+    {
+        delete this._frameNeedsSetup;
+        this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
 
         if (this.resource.type === WebInspector.Resource.Type.Script) {
             this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
@@ -274,7 +279,7 @@ WebInspector.SourceView.prototype = {
         if (!foundRange)
             return;
 
-        var selection = window.getSelection();
+        var selection = this.sourceFrame.element.contentWindow.getSelection();
         selection.removeAllRanges();
         selection.addRange(foundRange);
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
index f0a9afbf8d..c30444ba08 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -586,8 +586,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
         this.listItemElement.appendChild(document.createTextNode(";"));
 
         if (value) {
-            // FIXME: this dosen't catch keyword based colors like black and white
-            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})/g);
+            // FIXME: this only covers W3C and CSS 16 valid color names
+            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})|aqua|black|blue|fuchsia|gray|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow/g);
             if (colors) {
                 var colorsLength = colors.length;
                 for (var i = 0; i < colorsLength; ++i) {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
new file mode 100644
index 0000000000..b9d8b94b87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TopDownProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*TopDownProfileDataGridTree*/ owningTree)
+{
+    var hasChildren = (profileNode.children && profileNode.children.length);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingChildren = profileNode.children;
+}
+
+WebInspector.TopDownProfileDataGridNode.prototype = {
+    _populate: function(event)
+    {
+        var children = this._remainingChildren;
+        var childrenLength = children.length;
+
+        for (var i = 0; i < childrenLength; ++i)
+            this.appendChild(new WebInspector.TopDownProfileDataGridNode(this.profileView, children[i], this.tree));
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+
+        this._remainingChildren = null;
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingChildren)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    }
+}
+
+WebInspector.TopDownProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
+
+WebInspector.TopDownProfileDataGridTree = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode)
+{
+    WebInspector.ProfileDataGridTree.call(this, profileView, profileNode);
+
+    this._remainingChildren = profileNode.children;
+
+    WebInspector.TopDownProfileDataGridNode.prototype._populate.call(this);
+}
+
+WebInspector.TopDownProfileDataGridTree.prototype = {
+    focus: function(/*ProfileDataGridNode*/ profileDataGrideNode)
+    {
+        if (!profileDataGrideNode)
+            return;
+
+        this._save();
+
+        this.children = [profileDataGrideNode];
+        this.totalTime = profileDataGrideNode.totalTime;
+    },
+
+    exclude: function(/*ProfileDataGridNode*/ profileDataGrideNode)
+    {
+        if (!profileDataGrideNode)
+            return;
+
+        this._save();
+
+        var excludedCallUID = profileDataGrideNode.callUID;
+
+        WebInspector.TopDownProfileDataGridNode.prototype._exclude.call(this, excludedCallUID);
+
+        if (this.lastComparator)
+            this.sort(this.lastComparator, true);
+    },
+
+    _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge
+}
+
+WebInspector.TopDownProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index 52a85789e5..76a925b169 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -1,6 +1,7 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource prefix="/webkit/inspector">
     <file>inspector.html</file>
+    <file>BottomUpProfileDataGridTree.js</file>
     <file>Breakpoint.js</file>
     <file>BreakpointsSidebarPane.js</file>
     <file>CallStackSidebarPane.js</file>
@@ -10,6 +11,9 @@
     <file>DatabasesPanel.js</file>
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
+    <file>DOMStorage.js</file>
+    <file>DOMStorageDataGrid.js</file>
+    <file>DOMStorageItemsView.js</file>
     <file>ElementsPanel.js</file>
     <file>ElementsTreeOutline.js</file>
     <file>FontView.js</file>
@@ -21,6 +25,7 @@
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
+    <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
     <file>ProfileView.js</file>
     <file>PropertiesSection.js</file>
@@ -39,6 +44,7 @@
     <file>SourceView.js</file>
     <file>StylesSidebarPane.js</file>
     <file>TextPrompt.js</file>
+    <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
     <file>View.js</file>
@@ -66,6 +72,7 @@
     <file>Images/disclosureTriangleSmallRightDownWhite.png</file>
     <file>Images/disclosureTriangleSmallRightWhite.png</file>
     <file>Images/dockButtons.png</file>
+    <file>Images/domStorage.png</file>
     <file>Images/elementsIcon.png</file>
     <file>Images/enableButtons.png</file>
     <file>Images/errorIcon.png</file>
@@ -92,6 +99,7 @@
     <file>Images/profilesIcon.png</file>
     <file>Images/profileSmallIcon.png</file>
     <file>Images/profilesSilhouette.png</file>
+    <file>Images/radioDot.png</file>
     <file>Images/recordButtons.png</file>
     <file>Images/reloadButtons.png</file>
     <file>Images/resourceCSSIcon.png</file>
@@ -151,6 +159,7 @@
     <file>Images/treeUpTriangleWhite.png</file>
     <file>Images/userInputIcon.png</file>
     <file>Images/userInputPreviousIcon.png</file>
+    <file>Images/userInputResultIcon.png</file>
     <file>Images/warningIcon.png</file>
     <file>Images/warningMediumIcon.png</file>
     <file>Images/warningsErrors.png</file>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index 7e3c224335..26537815bc 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -439,6 +439,7 @@ body.console-visible #console {
 
 #console-messages {
     position: absolute;
+    z-index: 0;
     top: 0;
     left: 0;
     right: 0;
@@ -463,6 +464,10 @@ body.console-visible #console {
     background-image: url(Images/userInputIcon.png);
 }
 
+.console-user-command-result.console-log-level::before {
+    background-image: url(Images/userInputResultIcon.png);
+}
+
 .console-message, .console-user-command {
     position: relative;
     border-bottom: 1px solid rgb(240, 240, 240);
@@ -470,6 +475,14 @@ body.console-visible #console {
     min-height: 16px;
 }
 
+.console-adjacent-user-command-result {
+    border-bottom: none;
+}
+
+.console-adjacent-user-command-result + .console-user-command-result.console-log-level::before {
+    background-image: none;
+}
+
 .console-message::before, .console-user-command::before, #console-prompt::before, .console-group-title-level::before {
     position: absolute;
     display: block;
@@ -561,35 +574,34 @@ body.console-visible #console {
     color: rgb(0, 128, 255);
 }
 
-.console-message-url {
-    color: rgb(33%, 33%, 33%) !important;
+#console-messages a {
+    color: rgb(33%, 33%, 33%);
     cursor: pointer;
-    float: right;
 }
 
-.console-message-url:hover {
+#console-messages a:hover {
     color: rgb(15%, 15%, 15%);
 }
 
-.console-message-url:hover::after {
-    opacity: 1;
+.console-message-url {
+    float: right;
 }
 
 .console-group-messages .section {
-    margin: 0;
+    margin: 0 0 0 12px !important;
 }
 
 .console-group-messages .section .header {
     padding: 0 8px 0 0;
     background-image: none;
     border: none;
-    min-height: 16px;
+    min-height: 0;
 }
 
 .console-group-messages .section .header::before {
     position: absolute;
     top: 1px;
-    left: 12px;
+    left: 1px;
     width: 8px;
     height: 8px;
     content: url(Images/treeRightTriangleBlack.png);
@@ -601,6 +613,21 @@ body.console-visible #console {
 
 .console-group-messages .section .header .title {
     color: black;
+    font-weight: normal;
+}
+
+.console-group-messages .section .properties li .info {
+    padding-top: 0;
+    padding-bottom: 0;
+    color: rgb(60%, 60%, 60%);
+}
+
+.console-group-messages .outline-disclosure {
+    padding-left: 0;
+}
+
+.console-group-messages .outline-disclosure > ol {
+    padding: 0 0 0 12px !important;
 }
 
 .console-group-messages .outline-disclosure, .console-group-messages .outline-disclosure ol {
@@ -608,33 +635,39 @@ body.console-visible #console {
     line-height: 1em;
 }
 
-.console-group-messages .outline-disclosure li {
-    padding-top: 2px;
-    padding-bottom: 2px;
+.console-group-messages .outline-disclosure.single-node li {
+    padding-left: 2px;
 }
 
 .console-group-messages .outline-disclosure li .selection {
-    z-index: 0;
-    margin-top: -1px;
+    margin-left: -6px;
+    margin-right: -6px;
+}
+
+.console-formatted-object, .console-formatted-node {
+    position: relative;
+    display: inline-block;
+    vertical-align: top;
 }
 
 .console-formatted-object .section, .console-formatted-node .section {
     position: static;
 }
 
+.console-formatted-object .properties, .console-formatted-node .properties {
+    padding-left: 0 !important;
+}
+
+.error-message {
+    color: red;
+}
+
 .auto-complete-text {
     color: rgb(128, 128, 128);
     -webkit-user-select: none;
     -webkit-user-modify: read-only;
 }
 
-.inspectible-node:hover {
-    background-color: rgba(56, 121, 217, 0.1);
-    -webkit-border-radius: 5px;
-    padding: 0 5px 1px;
-    margin: 0 -5px -1px;
-}
-
 .panel {
     display: none;
     overflow: hidden;
@@ -1532,7 +1565,11 @@ body.inactive .sidebar {
     content: url(Images/databaseTable.png);
 }
 
-#database-views {
+.domstorage-sidebar-tree-item .icon {
+    content: url(Images/domStorage.png);
+}
+
+#storage-views {
     position: absolute;
     top: 0;
     right: 0;
@@ -1540,7 +1577,7 @@ body.inactive .sidebar {
     bottom: 0;
 }
 
-.database-view {
+.storage-view {
     display: none;
     overflow: hidden;
     position: absolute;
@@ -1550,20 +1587,20 @@ body.inactive .sidebar {
     bottom: 0;
 }
 
-.database-view.visible {
+.storage-view.visible {
     display: block;
 }
 
-.database-view.table {
+.storage-view.table {
     overflow: hidden;
 }
 
-.database-view.table .data-grid {
+.storage-view.table .data-grid {
     border: none;
     height: 100%;
 }
 
-.database-view.table .database-table-empty, .database-view.table .database-table-error {
+.storage-view.table .storage-table-empty, .storage-view.table .storage-table-error {
     position: absolute;
     top: 0;
     bottom: 25%;
@@ -1581,7 +1618,7 @@ body.inactive .sidebar {
     white-space: pre-wrap;
 }
 
-.database-view.table .database-table-error {
+.storage-view.table .storage-table-error {
     color: rgb(66%, 33%, 33%);
 }
 
@@ -1773,7 +1810,7 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     text-indent: 10px;
 }
 
-.database-view.query {
+.storage-view.query {
     font-size: 10px;
     font-family: Monaco, Lucida Console, monospace;
     padding: 2px 0;
@@ -1882,6 +1919,7 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     font-size: 10px;
     color: rgb(110, 116, 128);
     margin-bottom: 12px;
+    margin-left: 20px;
 }
 
 .panel-enabler-disclaimer:empty {
@@ -1917,10 +1955,8 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     position: relative;
     display: block;
     text-align: left;
-    margin-left: 50px;
-    margin-bottom: 6px;
-    line-height: 18px;
     word-break: break-word;
+    margin: 0 0 5px 20px;
 }
 
 .panel-enabler-view button {
@@ -1949,6 +1985,30 @@ body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled {
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(250, 250, 250)), to(rgb(235, 235, 235)));
 }
 
+.panel-enabler-view input {
+    height: 17px;
+    width: 17px;
+    border: 1px solid rgb(165, 165, 165);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+    -webkit-border-radius: 8px;
+    -webkit-appearance: none;
+    vertical-align: middle;
+    margin: 0 5px 5px 0;
+}
+
+.panel-enabler-view input:active {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
+}
+
+.panel-enabler-view input:checked {
+    background: url(Images/radioDot.png) center no-repeat,
+                -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+}
+
+.panel-enabler-view.resources img {
+    content: url(Images/scriptsSilhouette.png);
+}
+
 .panel-enabler-view.scripts img {
     content: url(Images/scriptsSilhouette.png);
 }
@@ -2498,6 +2558,10 @@ button.enable-toggle-status-bar-item.toggled-on:active {
     padding-left: 37px;
 }
 
+.sidebar-tree > .children > .children > .sidebar-tree-item {
+    padding-left: 37px;
+}
+
 .sidebar-tree.hide-disclosure-buttons > .children {
     display: none;
 }
@@ -2889,6 +2953,14 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     height: 100%;
 }
 
+.profile-view .data-grid th.average-column {
+    text-align: center;
+}
+
+.profile-view .data-grid td.average-column {
+    text-align: right;
+}
+
 .profile-view .data-grid th.self-column {
     text-align: center;
 }
@@ -2994,3 +3066,39 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
 .reset-profile-status-bar-item:active {
     background-position: 32px 0;
 }
+
+.delete-storage-status-bar-item {
+    background-image: url(Images/excludeButtons.png) !important;
+}
+
+.delete-storage-status-bar-item:active {
+    background-position: 32px 0;
+}
+
+#storage-view-status-bar-items {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 200px;
+    overflow: hidden;
+    border-left: 1px solid rgb(184, 184, 184);
+    margin-left: -1px;
+}
+
+.refresh-storage-status-bar-item {
+    background-image: url(Images/reloadButtons.png) !important;
+}
+
+.refresh-storage-status-bar-item:active {
+    background-position: 32px 0;
+}
+
+#storage-view-status-bar-items {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 200px;
+    overflow: hidden;
+    border-left: 1px solid rgb(184, 184, 184);
+    margin-left: -1px;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
index cb38886e7e..184bb4566d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
@@ -41,7 +41,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="Database.js"></script>
+    <script type="text/javascript" src="DOMStorage.js"></script>
+    <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
+    <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
@@ -70,6 +73,9 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DatabaseTableView.js"></script>
     <script type="text/javascript" src="DatabaseQueryView.js"></script>
     <script type="text/javascript" src="ScriptView.js"></script>
+    <script type="text/javascript" src="ProfileDataGridTree.js"></script>
+    <script type="text/javascript" src="BottomUpProfileDataGridTree.js"></script>
+    <script type="text/javascript" src="TopDownProfileDataGridTree.js"></script>
     <script type="text/javascript" src="ProfileView.js"></script>
 </head>
 <body class="detached">
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
index 07ae7dbc5f..9d5bac05ad 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
@@ -41,7 +41,7 @@ var Preferences = {
 }
 
 var WebInspector = {
-    resources: [],
+    resources: {},
     resourceURLMap: {},
     missingLocalizedStrings: {},
 
@@ -279,13 +279,19 @@ WebInspector.loaded = function()
     document.body.addStyleClass("platform-" + platform);
 
     this.console = new WebInspector.Console();
-    this.panels = {
-        elements: new WebInspector.ElementsPanel(),
-        resources: new WebInspector.ResourcesPanel(),
-        scripts: new WebInspector.ScriptsPanel(),
-        profiles: new WebInspector.ProfilesPanel(),
-        databases: new WebInspector.DatabasesPanel()
-    };
+
+    this.panels = {};
+    var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
+    if (hiddenPanels.indexOf("elements") === -1)
+        this.panels.elements = new WebInspector.ElementsPanel();
+    if (hiddenPanels.indexOf("resources") === -1)
+        this.panels.resources = new WebInspector.ResourcesPanel();
+    if (hiddenPanels.indexOf("scripts") === -1)
+        this.panels.scripts = new WebInspector.ScriptsPanel();
+    if (hiddenPanels.indexOf("profiles") === -1)
+        this.panels.profiles = new WebInspector.ProfilesPanel();
+    if (hiddenPanels.indexOf("databases") === -1)
+        this.panels.databases = new WebInspector.DatabasesPanel();
 
     var toolbarElement = document.getElementById("toolbar");
     var previousToolbarItem = toolbarElement.children[0];
@@ -383,6 +389,12 @@ var windowLoaded = function()
 
 window.addEventListener("load", windowLoaded, false);
 
+WebInspector.dispatch = function() {
+    var methodName = arguments[0];
+    var parameters = Array.prototype.slice.call(arguments, 1);
+    WebInspector[methodName].apply(this, parameters);
+}
+
 WebInspector.windowUnload = function(event)
 {
     InspectorController.windowUnloading();
@@ -765,9 +777,18 @@ WebInspector.showDatabasesPanel = function()
     this.currentPanel = this.panels.databases;
 }
 
-WebInspector.addResource = function(resource)
+WebInspector.addResource = function(identifier, payload)
 {
-    this.resources.push(resource);
+    var resource = new WebInspector.Resource(
+        payload.requestHeaders,
+        payload.requestURL,
+        payload.host,
+        payload.path,
+        payload.lastPathComponent,
+        identifier,
+        payload.isMainResource,
+        payload.cached);
+    this.resources[identifier] = resource;
     this.resourceURLMap[resource.url] = resource;
 
     if (resource.mainResource) {
@@ -779,22 +800,101 @@ WebInspector.addResource = function(resource)
         this.panels.resources.addResource(resource);
 }
 
-WebInspector.removeResource = function(resource)
+WebInspector.updateResource = function(identifier, payload)
+{
+    var resource = this.resources[identifier];
+    if (!resource)
+        return;
+
+    if (payload.didRequestChange) {
+        resource.url = payload.url;
+        resource.domain = payload.domain;
+        resource.path = payload.path;
+        resource.lastPathComponent = payload.lastPathComponent;
+        resource.requestHeaders = payload.requestHeaders;
+        resource.mainResource = payload.mainResource;
+    }
+
+    if (payload.didResponseChange) {
+        resource.mimeType = payload.mimeType;
+        resource.suggestedFilename = payload.suggestedFilename;
+        resource.expectedContentLength = payload.expectedContentLength;
+        resource.statusCode = payload.statusCode;
+        resource.suggestedFilename = payload.suggestedFilename;
+        resource.responseHeaders = payload.responseHeaders;
+    }
+
+    if (payload.didTypeChange) {
+        resource.type = payload.type;
+    }
+    
+    if (payload.didLengthChange) {
+        resource.contentLength = payload.contentLength;
+    }
+
+    if (payload.didCompletionChange) {
+        resource.failed = payload.failed;
+        resource.finished = payload.finished;
+    }
+
+    if (payload.didTimingChange) {
+        if (payload.startTime)
+            resource.startTime = payload.startTime;
+        if (payload.responseReceivedTime)
+            resource.responseReceivedTime = payload.responseReceivedTime;
+        if (payload.endTime)
+            resource.endTime = payload.endTime;
+    }
+}
+
+WebInspector.removeResource = function(identifier)
 {
+    var resource = this.resources[identifier];
+    if (!resource)
+        return;
+
     resource.category.removeResource(resource);
     delete this.resourceURLMap[resource.url];
-
-    this.resources.remove(resource, true);
+    delete this.resources[identifier];
 
     if (this.panels.resources)
         this.panels.resources.removeResource(resource);
 }
 
-WebInspector.addDatabase = function(database)
+WebInspector.addDatabase = function(payload)
 {
+    var database = new WebInspector.Database(
+        payload.database,
+        payload.domain,
+        payload.name,
+        payload.version);
     this.panels.databases.addDatabase(database);
 }
 
+WebInspector.addDOMStorage = function(payload)
+{
+    var domStorage = new WebInspector.DOMStorage(
+        payload.domStorage,
+        payload.host,
+        payload.isLocalStorage);
+    this.panels.databases.addDOMStorage(domStorage);
+}
+
+WebInspector.resourceTrackingWasEnabled = function()
+{
+    this.panels.resources.resourceTrackingWasEnabled();
+}
+
+WebInspector.resourceTrackingWasDisabled = function()
+{
+    this.panels.resources.resourceTrackingWasDisabled();
+}
+
+WebInspector.attachDebuggerWhenShown = function()
+{
+    this.panels.scripts.attachDebuggerWhenShown();
+}
+
 WebInspector.debuggerWasEnabled = function()
 {
     this.panels.scripts.debuggerWasEnabled();
@@ -830,6 +930,11 @@ WebInspector.pausedScript = function()
     this.panels.scripts.debuggerPaused();
 }
 
+WebInspector.resumedScript = function()
+{
+    this.panels.scripts.debuggerResumed();
+}
+
 WebInspector.populateInterface = function()
 {
     for (var panelName in this.panels) {
@@ -850,7 +955,7 @@ WebInspector.reset = function()
     for (var category in this.resourceCategories)
         this.resourceCategories[category].removeAllResources();
 
-    this.resources = [];
+    this.resources = {};
     this.resourceURLMap = {};
     this.hoveredDOMNode = null;
 
@@ -870,9 +975,17 @@ WebInspector.resourceURLChanged = function(resource, oldURL)
     this.resourceURLMap[resource.url] = resource;
 }
 
-WebInspector.addMessageToConsole = function(msg)
+WebInspector.addMessageToConsole = function(payload)
 {
-    this.console.addMessage(msg);
+    var consoleMessage = new WebInspector.ConsoleMessage(
+        payload.source,
+        payload.level,
+        payload.line,
+        payload.url,
+        payload.groupLevel,
+        payload.repeatCount);
+    consoleMessage.setMessageBody(Array.prototype.slice.call(arguments, 1));
+    this.console.addMessage(consoleMessage);
 }
 
 WebInspector.addProfile = function(profile)
@@ -1247,6 +1360,7 @@ WebInspector.MIMETypes = {
     "image/png":                   {2: true},
     "image/gif":                   {2: true},
     "image/bmp":                   {2: true},
+    "image/vnd.microsoft.icon":    {2: true},
     "image/x-icon":                {2: true},
     "image/x-xbitmap":             {2: true},
     "font/ttf":                    {3: true},
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
index 8f8650422a..8fb50e202e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
@@ -37,6 +37,8 @@ Object.type = function(obj, win)
 
     win = win || window;
 
+    if (obj instanceof win.Node)
+        return "node";
     if (obj instanceof win.String)
         return "string";
     if (obj instanceof win.Array)
@@ -70,6 +72,7 @@ Object.describe = function(obj, abbreviated)
 
     switch (type1) {
     case "object":
+    case "node":
         return type2;
     case "array":
         return "[" + obj.toString() + "]";
@@ -937,6 +940,41 @@ Array.prototype.remove = function(value, onlyFirst)
     }
 }
 
+function insertionIndexForObjectInListSortedByFunction(anObject, aList, aFunction)
+{
+    // indexOf returns (-lowerBound - 1). Taking (-result - 1) works out to lowerBound.
+    return (-indexOfObjectInListSortedByFunction(anObject, aList, aFunction) - 1);
+}
+
+function indexOfObjectInListSortedByFunction(anObject, aList, aFunction)
+{
+    var first = 0;
+    var last = aList.length - 1;
+    var floor = Math.floor;
+    var mid, c;
+
+    while (first <= last) {
+        mid = floor((first + last) / 2);
+        c = aFunction(anObject, aList[mid]);
+
+        if (c > 0)
+            first = mid + 1;
+        else if (c < 0)
+            last = mid - 1;
+        else {
+            // Return the first occurance of an item in the list.
+            while (mid > 0 && aFunction(anObject, aList[mid - 1]) === 0)
+                mid--;
+            first = mid;
+            break;
+        }
+    }
+
+    // By returning 1 less than the negative lower search bound, we can reuse this function
+    // for both indexOf and insertionIndexFor, with some simple arithmetic.
+    return (-first - 1);
+}
+
 String.sprintf = function(format)
 {
     return String.vsprintf(format, Array.prototype.slice.call(arguments, 1));
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.cpp b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
index 1db6ce6fdc..250ea0de93 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
@@ -34,8 +34,8 @@
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
-#include "SystemTime.h"
 #include <stdio.h>
+#include <wtf/CurrentTime.h>
 
 using namespace std;
 
@@ -141,13 +141,6 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
     if (resource->type() != type)
         return 0;
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // addLowBandwidthDisplayRequest() returns true if requesting CSS or JS during low bandwidth display.
-    // Here, return 0 to not block parsing or layout.
-    if (docLoader->frame() && docLoader->frame()->loader()->addLowBandwidthDisplayRequest(resource))
-        return 0;
-#endif
-
     if (!disabled()) {
         // This will move the resource to the front of its LRU list and increase its access count.
         resourceAccessed(resource);
@@ -188,6 +181,7 @@ CachedCSSStyleSheet* Cache::requestUserCSSStyleSheet(DocLoader* docLoader, const
 void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
 {
     ASSERT(resource);
+    ASSERT(resource->inCache());
     ASSERT(!disabled());
     if (resource->resourceToRevalidate())
         return;
@@ -217,7 +211,7 @@ void Cache::revalidationSucceeded(CachedResource* revalidatingResource, const Re
     ASSERT(!m_resources.get(resource->url()));
     m_resources.set(resource->url(), resource);
     resource->setInCache(true);
-    resource->setExpirationDate(response.expirationDate());
+    resource->updateResponseAfterRevalidation(response);
     insertInLRUList(resource);
     int delta = resource->size();
     if (resource->decodedSize() && resource->hasClients())
@@ -274,7 +268,7 @@ void Cache::pruneLiveResources()
     unsigned targetSize = static_cast<unsigned>(capacity * cTargetPrunePercentage); // Cut by a percentage to avoid immediately pruning again.
     double currentTime = FrameView::currentPaintTimeStamp();
     if (!currentTime) // In case prune is called directly, outside of a Frame paint.
-        currentTime = WebCore::currentTime();
+        currentTime = WTF::currentTime();
     
     // Destroy any decoded data in live objects that we can.
     // Start from the tail, since this is the least recently accessed of the objects.
@@ -397,15 +391,6 @@ void Cache::evict(CachedResource* resource)
     // The resource may have already been removed by someone other than our caller,
     // who needed a fresh copy for a reload. See <http://bugs.webkit.org/show_bug.cgi?id=12479#c6>.
     if (resource->inCache()) {
-        if (!resource->isCacheValidator()) {
-            // Notify all doc loaders that might be observing this object still that it has been
-            // extracted from the set of resources.
-            // No need to do this for cache validator resources, they are replaced automatically by using CachedResourceHandles.
-            HashSet<DocLoader*>::iterator end = m_docLoaders.end();
-            for (HashSet<DocLoader*>::iterator itr = m_docLoaders.begin(); itr != end; ++itr)
-                (*itr)->removeCachedResource(resource);
-        }
-        
         // Remove from the resource map.
         m_resources.remove(resource->url());
         resource->setInCache(false);
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
index 10d566ea45..11d12137d9 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
@@ -29,6 +29,7 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "HTTPParsers.h"
 #include "TextResourceDecoder.h"
 #include "loader.h"
 #include <wtf/Vector.h>
@@ -114,15 +115,6 @@ void CachedCSSStyleSheet::checkNotify()
     CachedResourceClientWalker w(m_clients);
     while (CachedResourceClient *c = w.next())
         c->setCSSStyleSheet(m_response.url().string(), m_decoder->encoding().name(), this);
-
-#if USE(LOW_BANDWIDTH_DISPLAY)        
-    // if checkNotify() is called from error(), client's setCSSStyleSheet(...)
-    // can't find "this" from url, so they can't do clean up if needed.
-    // call notifyFinished() to make sure they have a chance.
-    CachedResourceClientWalker n(m_clients);
-    while (CachedResourceClient* s = n.next())
-        s->notifyFinished(this);
-#endif        
 }
 
 void CachedCSSStyleSheet::error()
@@ -140,8 +132,14 @@ bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType) const
     if (!enforceMIMEType)
         return true;
 
-    // This check exactly matches Firefox.
-    String mimeType = response().mimeType();
+    // This check exactly matches Firefox.  Note that we grab the Content-Type
+    // header directly because we want to see what the value is BEFORE content
+    // sniffing.  Firefox does this by setting a "type hint" on the channel.
+    // This implementation should be observationally equivalent.
+    //
+    // This code defaults to allowing the stylesheet for non-HTTP protocols so
+    // folks can use standards mode for local HTML documents.
+    String mimeType = extractMIMETypeFromMediaType(response().httpHeaderField("Content-Type"));
     return mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
 }
  
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
index 5fd9a22bb5..ef2f5a90ee 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
@@ -31,7 +31,7 @@
 #include "CachedResourceClientWalker.h"
 #include "DOMImplementation.h"
 #include "FontPlatformData.h"
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
 #include "FontCustomPlatformData.h"
 #endif
 #include "TextResourceDecoder.h"
@@ -60,7 +60,7 @@ CachedFont::CachedFont(const String &url)
 
 CachedFont::~CachedFont()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
     delete m_fontData;
 #endif
 }
@@ -100,7 +100,7 @@ void CachedFont::beginLoadIfNeeded(DocLoader* dl)
 
 bool CachedFont::ensureCustomFontData()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
 #if ENABLE(SVG_FONTS)
     ASSERT(!m_isSVGFont);
 #endif
@@ -119,7 +119,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
     if (m_externalSVGDocument)
         return FontPlatformData(size, bold, italic);
 #endif
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
     ASSERT(m_fontData);
     return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, renderingMode);
 #else
@@ -137,6 +137,7 @@ bool CachedFont::ensureSVGFontData()
 
         RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("application/xml");
         m_externalSVGDocument->write(decoder->decode(m_data->data(), m_data->size()));
+        m_externalSVGDocument->write(decoder->flush());
         if (decoder->sawError()) {
             m_externalSVGDocument.clear();
             return 0;
@@ -174,7 +175,7 @@ SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
 
 void CachedFont::allClientsRemoved()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
     if (m_fontData) {
         delete m_fontData;
         m_fontData = 0;
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.h b/src/3rdparty/webkit/WebCore/loader/CachedFont.h
index fd19cdb6ee..e4414c638c 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.h
@@ -39,10 +39,11 @@ namespace WebCore {
 
 class DocLoader;
 class Cache;
-class FontCustomPlatformData;
 class FontPlatformData;
 class SVGFontElement;
 
+struct FontCustomPlatformData;
+
 class CachedFont : public CachedResource {
 public:
     CachedFont(const String& url);
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
index 98aee9e3f6..74f9b013c5 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
@@ -33,7 +33,7 @@
 #include "FrameView.h"
 #include "Request.h"
 #include "Settings.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
@@ -53,6 +53,7 @@ CachedImage::CachedImage(const String& url)
     : CachedResource(url, ImageResource)
     , m_image(0)
     , m_decodedDataDeletionTimer(this, &CachedImage::decodedDataDeletionTimerFired)
+    , m_httpStatusCodeErrorOccurred(false)
 {
     m_status = Unknown;
 }
@@ -61,6 +62,7 @@ CachedImage::CachedImage(Image* image)
     : CachedResource(String(), ImageResource)
     , m_image(image)
     , m_decodedDataDeletionTimer(this, &CachedImage::decodedDataDeletionTimerFired)
+    , m_httpStatusCodeErrorOccurred(false)
 {
     m_status = Cached;
     m_loading = false;
@@ -96,7 +98,7 @@ void CachedImage::addClient(CachedResourceClient* c)
         m_image->setData(m_data, true);
     }
 
-    if (m_image && !m_image->rect().isEmpty())
+    if (m_image && !m_image->isNull())
         c->imageChanged(this);
 
     if (!m_loading)
@@ -305,6 +307,7 @@ void CachedImage::error()
 {
     clear();
     m_errorOccurred = true;
+    m_data.clear();
     notifyObservers();
     m_loading = false;
     checkNotify();
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.h b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
index 9c3442fb18..22a3774332 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
@@ -67,7 +67,10 @@ public:
 
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
     virtual void error();
-
+    
+    virtual void httpStatusCodeError() { m_httpStatusCodeErrorOccurred = true; }
+    bool httpStatusCodeErrorOccurred() const { return m_httpStatusCodeErrorOccurred; }
+    
     virtual bool schedule() const { return true; }
 
     void checkNotify();
@@ -96,6 +99,7 @@ private:
 
     RefPtr<Image> m_image;
     Timer<CachedImage> m_decodedDataDeletionTimer;
+    bool m_httpStatusCodeErrorOccurred;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
index c1e71911b4..dceeec0a30 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
@@ -32,7 +32,8 @@
 #include "KURL.h"
 #include "PurgeableBuffer.h"
 #include "Request.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/Vector.h>
 
@@ -46,6 +47,7 @@ static RefCountedLeakCounter cachedResourceLeakCounter("CachedResource");
 
 CachedResource::CachedResource(const String& url, Type type)
     : m_url(url)
+    , m_responseTimestamp(currentTime())
     , m_lastDecodedAccessTime(0)
     , m_sendResourceLoadCallbacks(true)
     , m_preloadCount(0)
@@ -57,7 +59,6 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_handleCount(0)
     , m_resourceToRevalidate(0)
     , m_isBeingRevalidated(false)
-    , m_expirationDate(0)
 {
 #ifndef NDEBUG
     cachedResourceLeakCounter.increment();
@@ -116,16 +117,50 @@ void CachedResource::finish()
 
 bool CachedResource::isExpired() const
 {
-    if (!m_expirationDate)
+    if (m_response.isNull())
         return false;
-    time_t now = time(0);
-    return difftime(now, m_expirationDate) >= 0;
+
+    return currentAge() > freshnessLifetime();
+}
+    
+double CachedResource::currentAge() const
+{
+    // RFC2616 13.2.3
+    // No compensation for latency as that is not terribly important in practice
+    double dateValue = m_response.date();
+    double apparentAge = isfinite(dateValue) ? max(0., m_responseTimestamp - dateValue) : 0;
+    double ageValue = m_response.age();
+    double correctedReceivedAge = isfinite(ageValue) ? max(apparentAge, ageValue) : apparentAge;
+    double residentTime = currentTime() - m_responseTimestamp;
+    return correctedReceivedAge + residentTime;
+}
+    
+double CachedResource::freshnessLifetime() const
+{
+    // Cache non-http resources liberally
+    if (!m_response.url().protocolInHTTPFamily())
+        return std::numeric_limits<double>::max();
+
+    // RFC2616 13.2.4
+    double maxAgeValue = m_response.cacheControlMaxAge();
+    if (isfinite(maxAgeValue))
+        return maxAgeValue;
+    double expiresValue = m_response.expires();
+    double dateValue = m_response.date();
+    double creationTime = isfinite(dateValue) ? dateValue : m_responseTimestamp;
+    if (isfinite(expiresValue))
+        return expiresValue - creationTime;
+    double lastModifiedValue = m_response.lastModified();
+    if (isfinite(lastModifiedValue))
+        return (creationTime - lastModifiedValue) * 0.1;
+    // If no cache headers are present, the specification leaves the decision to the UA. Other browsers seem to opt for 0.
+    return 0;
 }
 
 void CachedResource::setResponse(const ResourceResponse& response)
 {
     m_response = response;
-    m_expirationDate = response.expirationDate();
+    m_responseTimestamp = currentTime();
 }
 
 void CachedResource::setRequest(Request* request)
@@ -259,7 +294,6 @@ void CachedResource::setResourceToRevalidate(CachedResource* resource)
 void CachedResource::clearResourceToRevalidate() 
 { 
     ASSERT(m_resourceToRevalidate);
-    ASSERT(m_resourceToRevalidate->m_isBeingRevalidated);
     m_resourceToRevalidate->m_isBeingRevalidated = false;
     m_resourceToRevalidate->deleteIfPossible();
     m_handlesToRevalidate.clear();
@@ -270,6 +304,7 @@ void CachedResource::clearResourceToRevalidate()
 void CachedResource::switchClientsToRevalidatedResource()
 {
     ASSERT(m_resourceToRevalidate);
+    ASSERT(m_resourceToRevalidate->inCache());
     ASSERT(!inCache());
 
     HashSet<CachedResourceHandleBase*>::iterator end = m_handlesToRevalidate.end();
@@ -300,6 +335,23 @@ void CachedResource::switchClientsToRevalidatedResource()
         m_resourceToRevalidate->addClient(clientsToMove[n]);
 }
     
+void CachedResource::updateResponseAfterRevalidation(const ResourceResponse& validatingResponse)
+{
+    m_responseTimestamp = currentTime();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, contentHeaderPrefix, ("content-"));
+    // RFC2616 10.3.5
+    // Update cached headers from the 304 response
+    const HTTPHeaderMap& newHeaders = validatingResponse.httpHeaderFields();
+    HTTPHeaderMap::const_iterator end = newHeaders.end();
+    for (HTTPHeaderMap::const_iterator it = newHeaders.begin(); it != end; ++it) {
+        // Don't allow 304 response to update content headers, these can't change but some servers send wrong values.
+        if (it->first.startsWith(contentHeaderPrefix, false))
+            continue;
+        m_response.setHTTPHeaderField(it->first, it->second);
+    }
+}
+    
 bool CachedResource::canUseCacheValidator() const
 {
     return !m_loading && (!m_response.httpHeaderField("Last-Modified").isEmpty() || !m_response.httpHeaderField("ETag").isEmpty());
@@ -310,9 +362,9 @@ bool CachedResource::mustRevalidate(CachePolicy cachePolicy) const
     if (m_loading)
         return false;
 
-    // FIXME: Also look at max-age, min-fresh, max-stale in Cache-Control
     if (cachePolicy == CachePolicyCache)
         return m_response.cacheControlContainsNoCache() || (isExpired() && m_response.cacheControlContainsMustRevalidate());
+
     return isExpired() || m_response.cacheControlContainsNoCache();
 }
 
@@ -379,18 +431,10 @@ bool CachedResource::wasPurged() const
 
 unsigned CachedResource::overheadSize() const
 {
-   
-    // FIXME: Find some programmatic lighweight way to calculate response size, and size of the different CachedResource classes.  
-    // This is a rough estimate of resource overhead based on stats collected from the stress test.
-    return sizeof(CachedResource) + 3648;
-    
-    /*  sizeof(CachedResource) + 
-        192 +                        // average size of m_url.
-        384 +                        // average size of m_clients hash map.
-        1280 * 2 +                   // average size of ResourceResponse.  Doubled to account for the WebCore copy and the CF copy. 
-                                     // Mostly due to the size of the hash maps, the Header Map strings and the URL.
-        256 * 2                      // Overhead from ResourceRequest, doubled to account for WebCore copy and CF copy. 
-                                     // Mostly due to the URL and Header Map.
+    return sizeof(CachedResource) + m_response.memoryUsage() + 576;
+    /*
+        576 = 192 +                   // average size of m_url
+              384;                    // average size of m_clients hash map
     */
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.h b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
index 63c250bbd4..16cce26f1a 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
@@ -82,6 +82,7 @@ public:
     virtual String encoding() const { return String(); }
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived) = 0;
     virtual void error() = 0;
+    virtual void httpStatusCodeError() { error(); } // Images keep loading in spite of HTTP errors (for legacy compat with <img>, etc.).
 
     const String &url() const { return m_url; }
     Type type() const { return m_type; }
@@ -126,7 +127,8 @@ public:
     // Called by the cache if the object has been removed from the cache
     // while still being referenced. This means the object should delete itself
     // if the number of clients observing it ever drops to 0.
-    void setInCache(bool b) { m_inCache = b; }
+    // The resource can be brought back to cache after successful revalidation.
+    void setInCache(bool b) { m_inCache = b; if (b) m_isBeingRevalidated = false; }
     bool inCache() const { return m_inCache; }
     
     void setInLiveDecodedResourcesList(bool b) { m_inLiveDecodedResourcesList = b; }
@@ -162,7 +164,7 @@ public:
     void decreasePreloadCount() { ASSERT(m_preloadCount); --m_preloadCount; }
     
     void registerHandle(CachedResourceHandleBase* h) { ++m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.add(h); }
-    void unregisterHandle(CachedResourceHandleBase* h) { --m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.remove(h); if (!m_handleCount) deleteIfPossible(); }
+    void unregisterHandle(CachedResourceHandleBase* h) { ASSERT(m_handleCount > 0); --m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.remove(h); if (!m_handleCount) deleteIfPossible(); }
     
     bool canUseCacheValidator() const;
     bool mustRevalidate(CachePolicy) const;
@@ -172,12 +174,16 @@ public:
     bool isPurgeable() const;
     bool wasPurged() const;
     
+    // This is used by the archive machinery to get at a purged resource without
+    // triggering a load. We should make it protected again if we can find a
+    // better way to handle the archive case.
+    bool makePurgeable(bool purgeable);
+
 protected:
     void setEncodedSize(unsigned);
     void setDecodedSize(unsigned);
     void didAccessDecodedData(double timeStamp);
 
-    bool makePurgeable(bool purgeable);
     bool isSafeToMakePurgeable() const;
     
     HashCountedSet<CachedResourceClient*> m_clients;
@@ -187,6 +193,8 @@ protected:
     Request* m_request;
 
     ResourceResponse m_response;
+    double m_responseTimestamp;
+
     RefPtr<SharedBuffer> m_data;
     OwnPtr<PurgeableBuffer> m_purgeableData;
 
@@ -200,7 +208,10 @@ private:
     void setResourceToRevalidate(CachedResource*);
     void switchClientsToRevalidatedResource();
     void clearResourceToRevalidate();
-    void setExpirationDate(time_t expirationDate) { m_expirationDate = expirationDate; }
+    void updateResponseAfterRevalidation(const ResourceResponse& validatingResponse);
+
+    double currentAge() const;
+    double freshnessLifetime() const;
 
     unsigned m_encodedSize;
     unsigned m_decodedSize;
@@ -217,7 +228,6 @@ private:
 protected:
     bool m_inCache;
     bool m_loading;
-    bool m_expireDateChanged;
 #ifndef NDEBUG
     bool m_deleted;
     unsigned m_lruIndex;
@@ -241,8 +251,6 @@ private:
     bool m_isBeingRevalidated;
     // These handles will need to be updated to point to the m_resourceToRevalidate in case we get 304 response.
     HashSet<CachedResourceHandleBase*> m_handlesToRevalidate;
-    
-    time_t m_expirationDate;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
index 411521b67e..ebf0898799 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
@@ -29,21 +29,20 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "TextResourceDecoder.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 CachedScript::CachedScript(const String& url, const String& charset)
     : CachedResource(url, Script)
-    , m_encoding(charset)
+    , m_decoder(TextResourceDecoder::create("application/javascript", charset))
     , m_decodedDataDeletionTimer(this, &CachedScript::decodedDataDeletionTimerFired)
 {
     // It's javascript we want.
     // But some websites think their scripts are <some wrong mimetype here>
     // and refuse to serve them if we only accept application/x-javascript.
     setAccept("*/*");
-    if (!m_encoding.isValid())
-        m_encoding = Latin1Encoding();
 }
 
 CachedScript::~CachedScript()
@@ -64,14 +63,12 @@ void CachedScript::allClientsRemoved()
 
 void CachedScript::setEncoding(const String& chs)
 {
-    TextEncoding encoding(chs);
-    if (encoding.isValid())
-        m_encoding = encoding;
+    m_decoder->setEncoding(chs, TextResourceDecoder::EncodingFromHTTPHeader);
 }
 
 String CachedScript::encoding() const
 {
-    return m_encoding.name();
+    return m_decoder->encoding().name();
 }
 
 const String& CachedScript::script()
@@ -79,7 +76,8 @@ const String& CachedScript::script()
     ASSERT(!isPurgeable());
 
     if (!m_script && m_data) {
-        m_script = m_encoding.decode(m_data->data(), encodedSize());
+        m_script = m_decoder->decode(m_data->data(), encodedSize());
+        m_script += m_decoder->flush();
         setDecodedSize(m_script.length() * sizeof(UChar));
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedScript.h b/src/3rdparty/webkit/WebCore/loader/CachedScript.h
index 1715e0631a..e1c3ee04d9 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedScript.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedScript.h
@@ -27,12 +27,12 @@
 #define CachedScript_h
 
 #include "CachedResource.h"
-#include "TextEncoding.h"
 #include "Timer.h"
 
 namespace WebCore {
 
     class DocLoader;
+    class TextResourceDecoder;
 
     class CachedScript : public CachedResource {
     public:
@@ -59,7 +59,7 @@ namespace WebCore {
         void decodedDataDeletionTimerFired(Timer<CachedScript>*);
 
         String m_script;
-        TextEncoding m_encoding;
+        RefPtr<TextResourceDecoder> m_decoder;
         Timer<CachedScript> m_decodedDataDeletionTimer;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp
new file mode 100644
index 0000000000..f0f8b6afc8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "CrossOriginAccessControl.h"
+
+#include "AtomicString.h"
+#include "HTTPParsers.h"
+#include "ResourceResponse.h"
+#include "SecurityOrigin.h"
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+bool isOnAccessControlSimpleRequestMethodWhitelist(const String& method)
+{
+    return method == "GET" || method == "HEAD" || method == "POST";
+}
+
+bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name, const String& value)
+{
+    if (equalIgnoringCase(name, "accept") || equalIgnoringCase(name, "accept-language") || equalIgnoringCase(name, "content-language"))
+        return true;
+
+    // Preflight is required for MIME types that can not be sent via form submission.
+    if (equalIgnoringCase(name, "content-type")) {
+        String mimeType = extractMIMETypeFromMediaType(value);
+        return equalIgnoringCase(mimeType, "application/x-www-form-urlencoded")
+            || equalIgnoringCase(mimeType, "multipart/form-data")
+            || equalIgnoringCase(mimeType, "text/plain");
+    }
+
+    return false;
+}
+
+bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap& headerMap)
+{
+    if (!isOnAccessControlSimpleRequestMethodWhitelist(method))
+        return false;
+
+    HTTPHeaderMap::const_iterator end = headerMap.end();
+    for (HTTPHeaderMap::const_iterator it = headerMap.begin(); it != end; ++it) {
+        if (!isOnAccessControlSimpleRequestHeaderWhitelist(it->first, it->second))
+            return false;
+    }
+
+    return true;
+}
+
+typedef HashSet<String, CaseFoldingHash> HTTPHeaderSet;
+static HTTPHeaderSet* createAllowedCrossOriginResponseHeadersSet()
+{
+    HTTPHeaderSet* headerSet = new HashSet<String, CaseFoldingHash>;
+    
+    headerSet->add("cache-control");
+    headerSet->add("content-language");
+    headerSet->add("content-type");
+    headerSet->add("expires");
+    headerSet->add("last-modified");
+    headerSet->add("pragma");
+
+    return headerSet;
+}
+
+bool isOnAccessControlResponseHeaderWhitelist(const String& name)
+{
+    AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeaders = createAllowedCrossOriginResponseHeadersSet());
+
+    return allowedCrossOriginResponseHeaders->contains(name);
+}
+
+bool passesAccessControlCheck(const ResourceResponse& response, bool includeCredentials, SecurityOrigin* securityOrigin)
+{
+    // A wildcard Access-Control-Allow-Origin can not be used if credentials are to be sent,
+    // even with Access-Control-Allow-Credentials set to true.
+    const String& accessControlOriginString = response.httpHeaderField("Access-Control-Allow-Origin");
+    if (accessControlOriginString == "*" && !includeCredentials)
+        return true;
+
+    RefPtr<SecurityOrigin> accessControlOrigin = SecurityOrigin::createFromString(accessControlOriginString);
+    if (!accessControlOrigin->isSameSchemeHostPort(securityOrigin))
+        return false;
+
+    if (includeCredentials) {
+        const String& accessControlCredentialsString = response.httpHeaderField("Access-Control-Allow-Credentials");
+        if (accessControlCredentialsString != "true")
+            return false;
+    }
+
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.h b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.h
new file mode 100644
index 0000000000..267646f129
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+namespace WebCore {
+
+    class HTTPHeaderMap;
+    class ResourceResponse;
+    class SecurityOrigin;
+    class String;
+
+    bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap&);
+    bool isOnAccessControlSimpleRequestMethodWhitelist(const String&);
+    bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name, const String& value);
+    bool isOnAccessControlResponseHeaderWhitelist(const String&);
+
+    bool passesAccessControlCheck(const ResourceResponse&, bool includeCredentials, SecurityOrigin*);
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp
new file mode 100644
index 0000000000..4bd05b2351
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "CrossOriginPreflightResultCache.h"
+
+#include "CrossOriginAccessControl.h"
+#include "ResourceResponse.h"
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+// These values are at the discretion of the user agent.
+static const unsigned defaultPreflightCacheTimeoutSeconds = 5;
+static const unsigned maxPreflightCacheTimeoutSeconds = 600; // Should be short enough to minimize the risk of using a poisoned cache after switching to a secure network.
+
+static bool parseAccessControlMaxAge(const String& string, unsigned& expiryDelta)
+{
+    // FIXME: this will not do the correct thing for a number starting with a '+'
+    bool ok = false;
+    expiryDelta = string.toUIntStrict(&ok);
+    return ok;
+}
+
+template<class HashType>
+static void addToAccessControlAllowList(const String& string, unsigned start, unsigned end, HashSet<String, HashType>& set)
+{
+    StringImpl* stringImpl = string.impl();
+    if (!stringImpl)
+        return;
+
+    // Skip white space from start.
+    while (start <= end && isSpaceOrNewline((*stringImpl)[start]))
+        ++start;
+
+    // only white space
+    if (start > end) 
+        return;
+
+    // Skip white space from end.
+    while (end && isSpaceOrNewline((*stringImpl)[end]))
+        --end;
+
+    // substringCopy() is called on the strings because the cache is accessed on multiple threads.
+    set.add(string.substringCopy(start, end - start + 1));
+}
+
+template<class HashType>
+static bool parseAccessControlAllowList(const String& string, HashSet<String, HashType>& set)
+{
+    int start = 0;
+    int end;
+    while ((end = string.find(',', start)) != -1) {
+        if (start == end)
+            return false;
+
+        addToAccessControlAllowList(string, start, end - 1, set);
+        start = end + 1;
+    }
+    if (start != static_cast<int>(string.length()))
+        addToAccessControlAllowList(string, start, string.length() - 1, set);
+
+    return true;
+}
+
+bool CrossOriginPreflightResultCacheItem::parse(const ResourceResponse& response)
+{
+    m_methods.clear();
+    if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Methods"), m_methods))
+        return false;
+
+    m_headers.clear();
+    if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Headers"), m_headers))
+        return false;
+
+    unsigned expiryDelta;
+    if (parseAccessControlMaxAge(response.httpHeaderField("Access-Control-Max-Age"), expiryDelta)) {
+        if (expiryDelta > maxPreflightCacheTimeoutSeconds)
+            expiryDelta = maxPreflightCacheTimeoutSeconds;
+    } else
+        expiryDelta = defaultPreflightCacheTimeoutSeconds;
+
+    m_absoluteExpiryTime = currentTime() + expiryDelta;
+    return true;
+}
+
+bool CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod(const String& method) const
+{
+    return m_methods.contains(method) || isOnAccessControlSimpleRequestMethodWhitelist(method);
+}
+
+bool CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders(const HTTPHeaderMap& requestHeaders) const
+{
+    HTTPHeaderMap::const_iterator end = requestHeaders.end();
+    for (HTTPHeaderMap::const_iterator it = requestHeaders.begin(); it != end; ++it) {
+        if (!m_headers.contains(it->first) && !isOnAccessControlSimpleRequestHeaderWhitelist(it->first, it->second))
+            return false;
+    }
+    return true;
+}
+
+bool CrossOriginPreflightResultCacheItem::allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const
+{
+    if (m_absoluteExpiryTime < currentTime())
+        return false;
+    if (includeCredentials && !m_credentials)
+        return false;
+    if (!allowsCrossOriginMethod(method))
+        return false;
+    if (!allowsCrossOriginHeaders(requestHeaders))
+        return false;
+    return true;
+}
+
+CrossOriginPreflightResultCache& CrossOriginPreflightResultCache::shared()
+{
+    AtomicallyInitializedStatic(CrossOriginPreflightResultCache&, cache = *new CrossOriginPreflightResultCache);
+    return cache;
+}
+
+void CrossOriginPreflightResultCache::appendEntry(const String& origin, const KURL& url, CrossOriginPreflightResultCacheItem* preflightResult)
+{
+    MutexLocker lock(m_mutex);
+    // Note that the entry may already be present in the HashMap if another thread is accessing the same location.
+    m_preflightHashMap.set(std::make_pair(origin.copy(), url.copy()), preflightResult);
+}
+
+bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, const KURL& url, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders)
+{
+    MutexLocker lock(m_mutex);
+    CrossOriginPreflightResultHashMap::iterator cacheIt = m_preflightHashMap.find(std::make_pair(origin, url));
+    if (cacheIt == m_preflightHashMap.end())
+        return false;
+
+    if (cacheIt->second->allowsRequest(includeCredentials, method, requestHeaders))
+        return true;
+
+    delete cacheIt->second;
+    m_preflightHashMap.remove(cacheIt);
+    return false;
+}
+
+void CrossOriginPreflightResultCache::empty()
+{
+    MutexLocker lock(m_mutex);
+    deleteAllValues(m_preflightHashMap);
+    m_preflightHashMap.clear();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
new file mode 100644
index 0000000000..39c3cd1eb4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "KURLHash.h"
+#include "StringHash.h"
+
+namespace WebCore {
+
+    class HTTPHeaderMap;
+    class ResourceResponse;
+
+    class CrossOriginPreflightResultCacheItem : Noncopyable {
+    public:
+        CrossOriginPreflightResultCacheItem(bool credentials)
+            : m_absoluteExpiryTime(0)
+            , m_credentials(credentials)
+        {
+        }
+
+        bool parse(const ResourceResponse&);
+        bool allowsCrossOriginMethod(const String&) const;
+        bool allowsCrossOriginHeaders(const HTTPHeaderMap&) const;
+        bool allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const;
+
+    private:
+        typedef HashSet<String, CaseFoldingHash> HeadersSet;
+
+        // FIXME: A better solution to holding onto the absolute expiration time might be
+        // to start a timer for the expiration delta that removes this from the cache when
+        // it fires.
+        double m_absoluteExpiryTime;
+        bool m_credentials;
+        HashSet<String> m_methods;
+        HeadersSet m_headers;
+    };
+
+    class CrossOriginPreflightResultCache : Noncopyable {
+    public:
+        static CrossOriginPreflightResultCache& shared();
+
+        void appendEntry(const String& origin, const KURL&, CrossOriginPreflightResultCacheItem*);
+        bool canSkipPreflight(const String& origin, const KURL&, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders);
+
+        void empty();
+
+    private:
+        CrossOriginPreflightResultCache() { }
+
+        typedef HashMap<std::pair<String, KURL>, CrossOriginPreflightResultCacheItem*> CrossOriginPreflightResultHashMap;
+
+        CrossOriginPreflightResultHashMap m_preflightHashMap;
+        Mutex m_mutex;
+    };
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
index 27c15527d7..c0e3f6f2d3 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
@@ -3,6 +3,7 @@
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -36,6 +37,7 @@
 #include "CString.h"
 #include "Document.h"
 #include "DOMWindow.h"
+#include "HTMLElement.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "loader.h"
@@ -64,6 +66,9 @@ DocLoader::~DocLoader()
     for (DocumentResourceMap::iterator it = m_documentResources.begin(); it != end; ++it)
         it->second->setDocLoader(0);
     m_cache->removeDocLoader(this);
+
+    // Make sure no requests still point to this DocLoader
+    ASSERT(m_requestCount == 0);
 }
 
 Frame* DocLoader::frame() const
@@ -191,7 +196,7 @@ CachedResource* DocLoader::requestResource(CachedResource::Type type, const Stri
 {
     KURL fullURL = m_doc->completeURL(url);
 
-    if (!canRequest(type, fullURL))
+    if (!fullURL.isValid() || !canRequest(type, fullURL))
         return 0;
 
     if (cache()->disabled()) {
@@ -266,11 +271,16 @@ void DocLoader::setAutoLoadImages(bool enable)
 
 CachePolicy DocLoader::cachePolicy() const
 {
-    return frame() ? frame()->loader()->cachePolicy() : CachePolicyVerify;
+    return frame() ? frame()->loader()->subresourceCachePolicy() : CachePolicyVerify;
 }
 
 void DocLoader::removeCachedResource(CachedResource* resource) const
 {
+#ifndef NDEBUG
+    DocumentResourceMap::iterator it = m_documentResources.find(resource->url());
+    if (it != m_documentResources.end())
+        ASSERT(it->second.get() == resource);
+#endif
     m_documentResources.remove(resource->url());
 }
 
@@ -339,7 +349,9 @@ void DocLoader::checkForPendingPreloads()
         return;
     for (unsigned i = 0; i < count; ++i) {
         PendingPreload& preload = m_pendingPreloads[i];
-        requestPreload(preload.m_type, preload.m_url, preload.m_charset);
+        // Don't request preload if the resource already loaded normally (this will result in double load if the page is being reloaded with cached results ignored).
+        if (!cachedResource(m_doc->completeURL(preload.m_url)))
+            requestPreload(preload.m_type, preload.m_url, preload.m_charset);
     }
     m_pendingPreloads.clear();
 }
@@ -377,6 +389,11 @@ void DocLoader::clearPreloads()
     m_preloads.clear();
 }
 
+void DocLoader::clearPendingPreloads()
+{
+    m_pendingPreloads.clear();
+}
+
 #if PRELOAD_DEBUG
 void DocLoader::printPreloadStats()
 {
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.h b/src/3rdparty/webkit/WebCore/loader/DocLoader.h
index 17edcc5274..13a57bdf33 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.h
@@ -2,6 +2,7 @@
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller <mueller@kde.org>
     Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+    Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -91,15 +92,12 @@ public:
     
     void setAllowStaleResources(bool allowStaleResources) { m_allowStaleResources = allowStaleResources; }
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    void replaceDocument(Document* doc) { m_doc = doc; }
-#endif
-
     void incrementRequestCount();
     void decrementRequestCount();
     int requestCount();
     
     void clearPreloads();
+    void clearPendingPreloads();
     void preload(CachedResource::Type, const String& url, const String& charset, bool referencedFromBody);
     void checkForPendingPreloads();
     void printPreloadStats();
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
index 88c54f6333..e4cbe4c5dc 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
@@ -95,9 +95,6 @@ static inline String canonicalizedTitle(const String& title, Frame* frame)
                 continue;
             buffer[builderIndex++] = ' ';
             previousCharWasWS = true;
-        } else if (c == '\\') {
-            buffer[builderIndex++] = frame->backslashAsCurrencySymbol();
-            previousCharWasWS = false;
         } else {
             buffer[builderIndex++] = c;
             previousCharWasWS = false;
@@ -115,6 +112,10 @@ static inline String canonicalizedTitle(const String& title, Frame* frame)
         return "";
 
     buffer.shrink(builderIndex + 1);
+    
+    // Replace the backslashes with currency symbols if the encoding requires it.
+    frame->document()->displayBufferModifiedByEncoding(buffer.characters(), buffer.length());
+
     return String::adopt(buffer);
 }
 
@@ -150,6 +151,7 @@ DocumentLoader::DocumentLoader(const ResourceRequest& req, const SubstituteData&
     , m_loadingFromCachedPage(false)
     , m_stopRecordingResponses(false)
     , m_substituteResourceDeliveryTimer(this, &DocumentLoader::substituteResourceDeliveryTimerFired)
+    , m_didCreateGlobalHistoryEntry(false)
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     , m_candidateApplicationCacheGroup(0)
 #endif
@@ -169,9 +171,9 @@ DocumentLoader::~DocumentLoader()
     
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     if (m_applicationCache)
-        m_applicationCache->group()->documentLoaderDestroyed(this);
+        m_applicationCache->group()->disassociateDocumentLoader(this);
     else if (m_candidateApplicationCacheGroup)
-        m_candidateApplicationCacheGroup->documentLoaderDestroyed(this);
+        m_candidateApplicationCacheGroup->disassociateDocumentLoader(this);
 #endif
 }
 
@@ -253,10 +255,14 @@ void DocumentLoader::clearErrors()
 
 void DocumentLoader::mainReceivedError(const ResourceError& error, bool isComplete)
 {
+    ASSERT(!error.isNull());
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     ApplicationCacheGroup* group = m_candidateApplicationCacheGroup;
-    if (!group && m_applicationCache && !mainResourceApplicationCache())
+    if (!group && m_applicationCache) {
+        ASSERT(!mainResourceApplicationCache()); // If the main resource were loaded from a cache, it wouldn't fail.
         group = m_applicationCache->group();
+    }
     
     if (group)
         group->failedLoadingMainResource(this);
@@ -273,7 +279,7 @@ void DocumentLoader::mainReceivedError(const ResourceError& error, bool isComple
 // one document at a time, but one document may have many related resources. 
 // stopLoading will stop all loads initiated by the data source, 
 // but not loads initiated by child frames' data sources -- that's the WebFrame's job.
-void DocumentLoader::stopLoading()
+void DocumentLoader::stopLoading(DatabasePolicy databasePolicy)
 {
     // In some rare cases, calling FrameLoader::stopLoading could set m_loading to false.
     // (This can happen when there's a single XMLHttpRequest currently loading and stopLoading causes it
@@ -285,8 +291,8 @@ void DocumentLoader::stopLoading()
         // still  parsing. Failure to do so can cause a world leak.
         Document* doc = m_frame->document();
         
-        if (loading || (doc && doc->parsing()))
-            m_frame->loader()->stopLoading(false);
+        if (loading || doc->parsing())
+            m_frame->loader()->stopLoading(false, databasePolicy);
     }
 
     // Always cancel multipart loaders
@@ -399,6 +405,10 @@ void DocumentLoader::setupForReplaceByMIMEType(const String& newMIMEType)
 
 void DocumentLoader::updateLoading()
 {
+    if (!m_frame) {
+        setLoading(false);
+        return;
+    }
     ASSERT(this == frameLoader()->activeDocumentLoader());
     setLoading(frameLoader()->isLoading());
 }
@@ -461,13 +471,12 @@ bool DocumentLoader::isLoadingInAPISense() const
             return true;
         if (!m_subresourceLoaders.isEmpty())
             return true;
-        if (Document* doc = m_frame->document()) {
-            if (doc->docLoader()->requestCount())
+        Document* doc = m_frame->document();
+        if (doc->docLoader()->requestCount())
+            return true;
+        if (Tokenizer* tok = doc->tokenizer())
+            if (tok->processingData())
                 return true;
-            if (Tokenizer* tok = doc->tokenizer())
-                if (tok->processingData())
-                    return true;
-        }
     }
     return frameLoader()->subframeIsLoading();
 }
@@ -544,15 +553,20 @@ PassRefPtr<ArchiveResource> DocumentLoader::subresource(const KURL& url) const
     if (!isCommitted())
         return 0;
     
-    Document* doc = m_frame->document();
-    if (!doc)
+    CachedResource* resource = m_frame->document()->docLoader()->cachedResource(url);
+    if (!resource || !resource->isLoaded())
         return archiveResourceForURL(url);
-        
-    CachedResource* resource = doc->docLoader()->cachedResource(url);
-    if (!resource || resource->preloadResult() == CachedResource::PreloadReferenced)
-        return archiveResourceForURL(url);
-        
-    return ArchiveResource::create(resource->data(), url, resource->response());
+
+    // FIXME: This has the side effect of making the resource non-purgeable.
+    // It would be better if it didn't have this permanent effect.
+    if (!resource->makePurgeable(false))
+        return 0;
+
+    RefPtr<SharedBuffer> data = resource->data();
+    if (!data)
+        return 0;
+
+    return ArchiveResource::create(data.release(), url, resource->response());
 }
 
 void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subresources) const
@@ -561,8 +575,6 @@ void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subre
         return;
 
     Document* document = m_frame->document();
-    if (!document)
-        return;
 
     const DocLoader::DocumentResourceMap& allResources = document->docLoader()->allCachedResources();
     DocLoader::DocumentResourceMap::const_iterator end = allResources.end();
@@ -864,7 +876,7 @@ ApplicationCache* DocumentLoader::mainResourceApplicationCache() const
 bool DocumentLoader::shouldLoadResourceFromApplicationCache(const ResourceRequest& request, ApplicationCacheResource*& resource)
 {
     ApplicationCache* cache = applicationCache();
-    if (!cache)
+    if (!cache || !cache->isComplete())
         return false;
 
     // If the resource is not a HTTP/HTTPS GET, then abort
@@ -892,6 +904,8 @@ bool DocumentLoader::getApplicationCacheFallbackResource(const ResourceRequest&
         if (!cache)
             return false;
     }
+    if (!cache->isComplete())
+        return false;
     
     // If the resource is not a HTTP/HTTPS GET, then abort
     if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
index 691a7e2356..d4ac427891 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
@@ -93,7 +93,7 @@ namespace WebCore {
         
         void replaceRequestURLForAnchorScroll(const KURL&);
         bool isStopping() const { return m_isStopping; }
-        void stopLoading();
+        void stopLoading(DatabasePolicy = DatabasePolicyStop);
         void setCommitted(bool committed) { m_committed = committed; }
         bool isCommitted() const { return m_committed; }
         bool isLoading() const { return m_loading; }
@@ -156,6 +156,21 @@ namespace WebCore {
 
         KURL urlForHistory() const;
         bool urlForHistoryReflectsFailure() const;
+
+        // These accessors accomodate WebCore's somewhat fickle custom of creating history
+        // items for redirects, but only sometimes. For "source" and "destination",
+        // these accessors return the URL that would have been used if a history
+        // item were created. This allows WebKit to link history items reflecting
+        // redirects into a chain from start to finish.
+        String clientRedirectSourceForHistory() const { return m_clientRedirectSourceForHistory; } // null if no client redirect occurred.
+        String clientRedirectDestinationForHistory() const { return urlForHistory(); }
+        void setClientRedirectSourceForHistory(const String& clientedirectSourceForHistory) { m_clientRedirectSourceForHistory = clientedirectSourceForHistory; }
+        
+        String serverRedirectSourceForHistory() const { return urlForHistory() == url() ? String() : urlForHistory(); } // null if no server redirect occurred.
+        String serverRedirectDestinationForHistory() const { return url(); }
+
+        bool didCreateGlobalHistoryEntry() const { return m_didCreateGlobalHistoryEntry; }
+        void setDidCreateGlobalHistoryEntry(bool didCreateGlobalHistoryEntry) { m_didCreateGlobalHistoryEntry = didCreateGlobalHistoryEntry; }
         
         void loadFromCachedPage(PassRefPtr<CachedPage>);
         void setLoadingFromCachedPage(bool loading) { m_loadingFromCachedPage = loading; }
@@ -287,6 +302,9 @@ namespace WebCore {
 
         HashSet<String> m_resourcesClientKnowsAbout;
         Vector<String> m_resourcesLoadedFromMemoryCacheForClientNotification;
+        
+        String m_clientRedirectSourceForHistory;
+        bool m_didCreateGlobalHistoryEntry;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)  
         // The application cache that the document loader is associated with (if any).
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
new file mode 100644
index 0000000000..643c06755d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DocumentThreadableLoader.h"
+
+#include "AuthenticationChallenge.h"
+#include "Document.h"
+#include "DocumentThreadableLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "ResourceRequest.h"
+#include "SecurityOrigin.h"
+#include "SubresourceLoader.h"
+#include "ThreadableLoaderClient.h"
+
+namespace WebCore {
+
+void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+{
+    bool sameOriginRequest = document->securityOrigin()->canRequest(request.url());
+
+    Vector<char> data;
+    ResourceError error;
+    ResourceResponse response;
+    unsigned long identifier = std::numeric_limits<unsigned long>::max();
+    if (document->frame())
+        identifier = document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
+
+    // No exception for file:/// resources, see <rdar://problem/4962298>.
+    // Also, if we have an HTTP response, then it wasn't a network error in fact.
+    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
+        client.didFail(error);
+        return;
+    }
+
+    // FIXME: This check along with the one in willSendRequest is specific to xhr and
+    // should be made more generic.
+    if (sameOriginRequest && !document->securityOrigin()->canRequest(response.url())) {
+        client.didFailRedirectCheck();
+        return;
+    }
+
+    client.didReceiveResponse(response);
+
+    const char* bytes = static_cast<const char*>(data.data());
+    int len = static_cast<int>(data.size());
+    client.didReceiveData(bytes, len);
+
+    client.didFinishLoading(identifier);
+}
+
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+{
+    ASSERT(document);
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials));
+    if (!loader->m_loader)
+        loader = 0;
+    return loader.release();
+}
+
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+    : m_client(client)
+    , m_document(document)
+    , m_allowStoredCredentials(storedCredentials == AllowStoredCredentials)
+    , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
+{
+    ASSERT(document);
+    ASSERT(client);
+    m_loader = SubresourceLoader::create(document->frame(), this, request, false, callbacksSetting == SendLoadCallbacks, contentSniff == SniffContent);
+}
+
+DocumentThreadableLoader::~DocumentThreadableLoader()
+{
+    if (m_loader)
+        m_loader->clearClient();
+}
+
+void DocumentThreadableLoader::cancel()
+{
+    if (!m_loader)
+        return;
+
+    m_loader->cancel();
+    m_loader->clearClient();
+    m_loader = 0;
+    m_client = 0;
+}
+
+void DocumentThreadableLoader::willSendRequest(SubresourceLoader* loader, ResourceRequest& request, const ResourceResponse&)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
+    if (!m_document->securityOrigin()->canRequest(request.url())) {
+        RefPtr<DocumentThreadableLoader> protect(this);
+        m_client->didFailRedirectCheck();
+        request = ResourceRequest();
+    }
+}
+
+void DocumentThreadableLoader::didSendData(SubresourceLoader* loader, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didSendData(bytesSent, totalBytesToBeSent);
+}
+
+void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader* loader, const ResourceResponse& response)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didReceiveResponse(response);
+}
+
+void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int lengthReceived)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didReceiveData(data, lengthReceived);
+}
+
+void DocumentThreadableLoader::didFinishLoading(SubresourceLoader* loader)
+{
+    ASSERT(loader == m_loader);
+    ASSERT(m_client);
+    m_client->didFinishLoading(loader->identifier());
+}
+
+void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const ResourceError& error)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didFail(error);
+}
+
+bool DocumentThreadableLoader::getShouldUseCredentialStorage(SubresourceLoader* loader, bool& shouldUseCredentialStorage)
+{
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    if (!m_allowStoredCredentials) {
+        shouldUseCredentialStorage = false;
+        return true;
+    }
+
+    return false; // Only FrameLoaderClient can ultimately permit credential use.
+}
+
+void DocumentThreadableLoader::didReceiveAuthenticationChallenge(SubresourceLoader* loader, const AuthenticationChallenge&)
+{
+    ASSERT(loader == m_loader);
+    // Users are not prompted for credentials for cross-origin requests.
+    if (!m_sameOriginRequest) {
+        RefPtr<DocumentThreadableLoader> protect(this);
+        m_client->didFail(loader->blockedError());
+        cancel();
+    }
+}
+
+void DocumentThreadableLoader::receivedCancellation(SubresourceLoader* loader, const AuthenticationChallenge& challenge)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+    m_client->didReceiveAuthenticationCancellation(challenge.failureResponse());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
new file mode 100644
index 0000000000..c612f72067
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DocumentThreadableLoader_h
+#define DocumentThreadableLoader_h
+
+#include "SubresourceLoaderClient.h"
+#include "ThreadableLoader.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+    class Document;
+    struct ResourceRequest;
+    class ThreadableLoaderClient;
+
+    class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
+    public:
+        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+        virtual ~DocumentThreadableLoader();
+
+        virtual void cancel();
+
+        using RefCounted<DocumentThreadableLoader>::ref;
+        using RefCounted<DocumentThreadableLoader>::deref;
+
+    protected:
+        virtual void refThreadableLoader() { ref(); }
+        virtual void derefThreadableLoader() { deref(); }
+
+    private:
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+        virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
+        virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
+
+        virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&);
+        virtual void didReceiveData(SubresourceLoader*, const char*, int lengthReceived);
+        virtual void didFinishLoading(SubresourceLoader*);
+        virtual void didFail(SubresourceLoader*, const ResourceError&);
+
+        virtual bool getShouldUseCredentialStorage(SubresourceLoader*, bool& shouldUseCredentialStorage);
+        virtual void didReceiveAuthenticationChallenge(SubresourceLoader*, const AuthenticationChallenge&);
+        virtual void receivedCancellation(SubresourceLoader*, const AuthenticationChallenge&);
+
+        RefPtr<SubresourceLoader> m_loader;
+        ThreadableLoaderClient* m_client;
+        Document* m_document;
+        bool m_allowStoredCredentials;
+        bool m_sameOriginRequest;
+    };
+
+} // namespace WebCore
+
+#endif // DocumentThreadableLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 5562d130b0..107b8bede8 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,12 +29,14 @@
 
 #include "ChromeClient.h"
 #include "ContextMenuClient.h"
-#include "DragClient.h"
+#include "Console.h"
 #include "DocumentLoader.h"
+#include "DragClient.h"
 #include "EditCommand.h"
 #include "EditorClient.h"
-#include "FocusDirection.h"
 #include "FloatRect.h"
+#include "FocusDirection.h"
+#include "FormState.h"
 #include "FrameLoaderClient.h"
 #include "InspectorClient.h"
 #include "ResourceError.h"
@@ -92,7 +95,7 @@ public:
 
     virtual void setResizable(bool) { }
 
-    virtual void addMessageToConsole(const String&, unsigned, const String&) { }
+    virtual void addMessageToConsole(MessageSource, MessageLevel, const String&, unsigned, const String&) { }
 
     virtual bool canRunBeforeUnloadConfirmPanel() { return false; }
     virtual bool runBeforeUnloadConfirmPanel(const String&, Frame*) { return true; }
@@ -118,7 +121,7 @@ public:
     virtual IntPoint screenToWindow(const IntPoint& p) const { return p; }
     virtual IntRect windowToScreen(const IntRect& r) const { return r; }
     virtual PlatformWidget platformWindow() const { return 0; }
-    virtual void contentsSizeChanged(Frame*, const IntSize& s) const { }
+    virtual void contentsSizeChanged(Frame*, const IntSize&) const { }
 
     virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned) { }
 
@@ -126,11 +129,21 @@ public:
 
     virtual void print(Frame*) { }
 
+#if ENABLE(DATABASE)
     virtual void exceededDatabaseQuota(Frame*, const String&) { }
+#endif
 
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
 
     virtual void formStateDidChange(const Node*) { }
+
+    virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
+
+    virtual bool setCursor(PlatformCursorHandle) { return false; }
+
+    virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
+
+    virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) {}
 };
 
 class EmptyFrameLoaderClient : public FrameLoaderClient {
@@ -161,6 +174,7 @@ public:
     virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long) { }
     virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long, const ResourceError&) { }
     virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int) { return false; }
+    virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long, const ScriptString&) { }
 
     virtual void dispatchDidHandleOnloadEvents() { }
     virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() { }
@@ -211,14 +225,14 @@ public:
     virtual void committedLoad(DocumentLoader*, const char*, int) { }
     virtual void finishedLoading(DocumentLoader*) { }
 
-    virtual ResourceError cancelledError(const ResourceRequest&) { return ResourceError(); }
-    virtual ResourceError blockedError(const ResourceRequest&) { return ResourceError(); }
-    virtual ResourceError cannotShowURLError(const ResourceRequest&) { return ResourceError(); }
-    virtual ResourceError interruptForPolicyChangeError(const ResourceRequest&) { return ResourceError(); }
+    virtual ResourceError cancelledError(const ResourceRequest&) { ResourceError error("", 0, "", ""); error.setIsCancellation(true); return error; }
+    virtual ResourceError blockedError(const ResourceRequest&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError cannotShowURLError(const ResourceRequest&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError interruptForPolicyChangeError(const ResourceRequest&) { return ResourceError("", 0, "", ""); }
 
-    virtual ResourceError cannotShowMIMETypeError(const ResourceResponse&) { return ResourceError(); }
-    virtual ResourceError fileDoesNotExistError(const ResourceResponse&) { return ResourceError(); }
-    virtual ResourceError pluginWillHandleLoadError(const ResourceResponse&) { return ResourceError(); }
+    virtual ResourceError cannotShowMIMETypeError(const ResourceResponse&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError fileDoesNotExistError(const ResourceResponse&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError pluginWillHandleLoadError(const ResourceResponse&) { return ResourceError("", 0, "", ""); }
 
     virtual bool shouldFallBack(const ResourceError&) { return false; }
 
@@ -239,24 +253,26 @@ public:
 
     virtual String userAgent(const KURL&) { return ""; }
 
-    virtual void savePlatformDataToCachedPage(CachedPage*) { }
-    virtual void transitionToCommittedFromCachedPage(CachedPage*) { }
+    virtual void savePlatformDataToCachedFrame(CachedFrame*) { }
+    virtual void transitionToCommittedFromCachedFrame(CachedFrame*) { }
     virtual void transitionToCommittedForNewPage() { }    
 
     virtual void updateGlobalHistory() { }
+    virtual void updateGlobalHistoryRedirectLinks() { }
     virtual bool shouldGoToHistoryItem(HistoryItem*) const { return false; }
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
 
     virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int) { return 0; }
-    virtual Widget* createPlugin(const IntSize&, Element*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
-    virtual Widget* createJavaAppletWidget(const IntSize&, Element*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
+    virtual Widget* createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
+    virtual Widget* createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
 
     virtual ObjectContentType objectContentType(const KURL&, const String&) { return ObjectContentType(); }
     virtual String overrideMediaType() const { return String(); }
 
     virtual void redirectDataToPlugin(Widget*) { }
     virtual void windowObjectCleared() { }
+    virtual void documentElementAvailable() { }
     virtual void didPerformFirstNavigation() const { }
 
     virtual void registerForIconNotification(bool) { }
@@ -264,6 +280,9 @@ public:
 #if PLATFORM(MAC)
     virtual NSCachedURLResponse* willCacheResponse(DocumentLoader*, unsigned long, NSCachedURLResponse* response) const { return response; }
 #endif
+#if USE(CFNETWORK)
+    virtual bool shouldCacheResponse(DocumentLoader*, unsigned long, const ResourceResponse&, const unsigned char*, unsigned long long) { return true; }
+#endif
 
 };
 
@@ -335,10 +354,32 @@ public:
     virtual NSArray* pasteboardTypesForSelection(Frame*) { return 0; }
 #endif
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void uppercaseWord() { }
+    virtual void lowercaseWord() { }
+    virtual void capitalizeWord() { }
+    virtual void showSubstitutionsPanel(bool) { }
+    virtual bool substitutionsPanelIsShowing() { return false; }
+    virtual void toggleSmartInsertDelete() { }
+    virtual bool isAutomaticQuoteSubstitutionEnabled() { return false; }
+    virtual void toggleAutomaticQuoteSubstitution() { }
+    virtual bool isAutomaticLinkDetectionEnabled() { return false; }
+    virtual void toggleAutomaticLinkDetection() { }
+    virtual bool isAutomaticDashSubstitutionEnabled() { return false; }
+    virtual void toggleAutomaticDashSubstitution() { }
+    virtual bool isAutomaticTextReplacementEnabled() { return false; }
+    virtual void toggleAutomaticTextReplacement() { }
+    virtual bool isAutomaticSpellingCorrectionEnabled() { return false; }
+    virtual void toggleAutomaticSpellingCorrection() { }
+#endif
     virtual void ignoreWordInSpellDocument(const String&) { }
     virtual void learnWord(const String&) { }
     virtual void checkSpellingOfString(const UChar*, int, int*, int*) { }
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String&) { return String(); }
     virtual void checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*) { }
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void checkTextOfParagraph(const UChar*, int, uint64_t, Vector<TextCheckingResult>&) { };
+#endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail&) { }
     virtual void updateSpellingUIWithMisspelledWord(const String&) { }
     virtual void showSpellingUI(bool) { }
@@ -391,6 +432,8 @@ public:
 
     virtual String localizedStringsURL() { return String(); }
 
+    virtual String hiddenPanels() { return String(); }
+
     virtual void showWindow() { }
     virtual void closeWindow() { }
 
@@ -411,3 +454,4 @@ public:
 }
 
 #endif // EmptyClients_h
+
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
index 08ef896e3d..ace4cfe426 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
@@ -57,7 +57,7 @@ class FTPDirectoryTokenizer : public HTMLTokenizer {
 public:
     FTPDirectoryTokenizer(HTMLDocument*);
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     
     virtual bool isWaitingForScripts() const { return false; }
@@ -117,7 +117,7 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     RefPtr<Element> rowElement = m_tableElement->insertRow(-1, ec);
     rowElement->setAttribute("class", "ftpDirectoryEntryRow", ec);
    
-    RefPtr<Element> element = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    RefPtr<Element> element = m_doc->createElement(tdTag, false);
     element->appendChild(new Text(m_doc, String(&noBreakSpace, 1)), ec);
     if (isDirectory)
         element->setAttribute("class", "ftpDirectoryIcon ftpDirectoryTypeDirectory", ec);
@@ -129,12 +129,12 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     element->setAttribute("class", "ftpDirectoryFileName", ec);
     rowElement->appendChild(element, ec);
     
-    element = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    element = m_doc->createElement(tdTag, false);
     element->appendChild(new Text(m_doc, date), ec);
     element->setAttribute("class", "ftpDirectoryFileDate", ec);
     rowElement->appendChild(element, ec);
     
-    element = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    element = m_doc->createElement(tdTag, false);
     element->appendChild(new Text(m_doc, size), ec);
     element->setAttribute("class", "ftpDirectoryFileSize", ec);
     rowElement->appendChild(element, ec);
@@ -150,11 +150,11 @@ PassRefPtr<Element> FTPDirectoryTokenizer::createTDForFilename(const String& fil
     else
         fullURL.append("/" + filename);
 
-    RefPtr<Element> anchorElement = m_doc->createElementNS(xhtmlNamespaceURI, "a", ec);
+    RefPtr<Element> anchorElement = m_doc->createElement(aTag, false);
     anchorElement->setAttribute("href", fullURL, ec);
     anchorElement->appendChild(new Text(m_doc, filename), ec);
     
-    RefPtr<Element> tdElement = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    RefPtr<Element> tdElement = m_doc->createElement(tdTag, false);
     tdElement->appendChild(anchorElement, ec);
     
     return tdElement.release();
@@ -235,7 +235,11 @@ static struct tm *localTimeQt(const time_t *const timep, struct tm *result)
 
 #define localtime_r(x, y) localTimeQt(x, y)
 #elif PLATFORM(WIN_OS) && !defined(localtime_r)
+#if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define localtime_r(x, y) localtime_s((y), (x))
+#else /* !_MSC_VER */ 
+#define localtime_r(x,y) (localtime(x)?(*(y)=*localtime(x),(y)):0)
+#endif
 #endif
 
 static String processFileDateString(const FTPTime& fileTime)
@@ -276,7 +280,7 @@ static String processFileDateString(const FTPTime& fileTime)
                 return "Yesterday" + timeOfDay;
         }
         
-        if (now.tm_mday == 1 && (now.tm_mon == fileTime.tm_mon + 1 || now.tm_mon == 0 && fileTime.tm_mon == 11) &&
+        if (now.tm_mday == 1 && (now.tm_mon == fileTime.tm_mon + 1 || (now.tm_mon == 0 && fileTime.tm_mon == 11)) &&
             wasLastDayOfMonth(fileTime.tm_year, fileTime.tm_mon, fileTime.tm_mday))
                 return "Yesterday" + timeOfDay;
     }
@@ -303,8 +307,9 @@ static String processFileDateString(const FTPTime& fileTime)
 void FTPDirectoryTokenizer::parseAndAppendOneLine(const String& inputLine)
 {
     ListResult result;
+    CString latin1Input = inputLine.latin1();
 
-    FTPEntryType typeResult = parseOneFTPLine(inputLine.latin1().data(), m_listState, result);
+    FTPEntryType typeResult = parseOneFTPLine(latin1Input.data(), m_listState, result);
     
     // FTPMiscEntry is a comment or usage statistic which we don't care about, and junk is invalid data - bail in these 2 cases
     if (typeResult == FTPMiscEntry || typeResult == FTPJunkEntry)
@@ -364,9 +369,9 @@ bool FTPDirectoryTokenizer::loadDocumentTemplate()
         return true;
 
     // Otherwise create one manually
-    ExceptionCode ec;        
-    tableElement = m_doc->createElementNS(xhtmlNamespaceURI, "table", ec);
+    tableElement = m_doc->createElement(tableTag, false);
     m_tableElement = static_cast<HTMLTableElement*>(tableElement.get());
+    ExceptionCode ec;        
     m_tableElement->setAttribute("id", "ftpDirectoryTable", ec);
 
     // If we didn't find the table element, lets try to append our own to the body
@@ -386,20 +391,20 @@ void FTPDirectoryTokenizer::createBasicDocument()
 
     // FIXME: Make this "basic document" more acceptable
 
-    ExceptionCode ec;
     
-    RefPtr<Element> bodyElement = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+    RefPtr<Element> bodyElement = m_doc->createElement(bodyTag, false);
                             
+    ExceptionCode ec;
     m_doc->appendChild(bodyElement, ec);
     
-    RefPtr<Element> tableElement = m_doc->createElementNS(xhtmlNamespaceURI, "table", ec);
+    RefPtr<Element> tableElement = m_doc->createElement(tableTag, false);
     m_tableElement = static_cast<HTMLTableElement*>(tableElement.get());
     m_tableElement->setAttribute("id", "ftpDirectoryTable", ec);
 
     bodyElement->appendChild(m_tableElement, ec);
 }
 
-bool FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
+void FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
 {    
     // Make sure we have the table element to append to by loading the template set in the pref, or
     // creating a very basic document with the appropriate table
@@ -439,7 +444,7 @@ bool FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     
     if (!foundNewLine) {
         m_dest = m_buffer;
-        return false;
+        return;
     }
 
     UChar* start = m_buffer;
@@ -460,8 +465,6 @@ bool FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     // Copy the partial line we have left to the carryover buffer
     if (cursor - start > 1)
         m_carryOver.append(String(start, cursor - start - 1));
-    
-    return false;
 }
 
 void FTPDirectoryTokenizer::finish()
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
index 8c76e9796b..6573fb6538 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
@@ -50,7 +50,11 @@ static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 
 #define gmtime_r(x, y) gmtimeQt(x, y)
 #elif PLATFORM(WIN_OS) && !defined(gmtime_r)
+#if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define gmtime_r(x, y) gmtime_s((y), (x))
+#else /* !_MSC_VER */ 
+#define gmtime_r(x,y) (gmtime(x)?(*(y)=*gmtime(x),(y)):0)
+#endif
 #endif
 
 FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& result)
diff --git a/src/3rdparty/webkit/WebCore/loader/FormState.cpp b/src/3rdparty/webkit/WebCore/loader/FormState.cpp
index c55b8aca14..bd37086879 100644
--- a/src/3rdparty/webkit/WebCore/loader/FormState.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FormState.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,16 +34,16 @@
 
 namespace WebCore {
 
-PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame)
+inline FormState::FormState(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
+    : m_form(form)
+    , m_sourceFrame(sourceFrame)
 {
-    return adoptRef(new FormState(form, values, sourceFrame));
+    m_textFieldValues.swap(textFieldValuesToAdopt);
 }
 
-FormState::FormState(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame)
-    : m_form(form)
-    , m_values(values)
-    , m_sourceFrame(sourceFrame)
+PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
 {
+    return adoptRef(new FormState(form, textFieldValuesToAdopt, sourceFrame));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FormState.h b/src/3rdparty/webkit/WebCore/loader/FormState.h
index 5370e8aa9a..03317b1118 100644
--- a/src/3rdparty/webkit/WebCore/loader/FormState.h
+++ b/src/3rdparty/webkit/WebCore/loader/FormState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,28 +29,28 @@
 #ifndef FormState_h
 #define FormState_h
 
-#include <wtf/RefCounted.h>
-#include "StringHash.h"
-#include <wtf/HashMap.h>
+#include "PlatformString.h"
 
 namespace WebCore {
 
     class Frame;
     class HTMLFormElement;
 
+    typedef Vector<std::pair<String, String> > StringPairVector;
+
     class FormState : public RefCounted<FormState> {
     public:
-        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame);
+        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
 
         HTMLFormElement* form() const { return m_form.get(); }
-        const HashMap<String, String>& values() const { return m_values; }
+        const StringPairVector& textFieldValues() const { return m_textFieldValues; }
         Frame* sourceFrame() const { return m_sourceFrame.get(); }
 
     private:
-        FormState(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame);
+        FormState(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
 
         RefPtr<HTMLFormElement> m_form;
-        HashMap<String, String> m_values;
+        StringPairVector m_textFieldValues;
         RefPtr<Frame> m_sourceFrame;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index e36cb5647d..7a9ef32017 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,10 +52,10 @@
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoaderClient.h"
-#include "FramePrivate.h"
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "HTMLAnchorElement.h"
+#include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameElement.h"
 #include "HTMLNames.h"
@@ -81,15 +81,16 @@
 #include "ResourceRequest.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
+#include "ScriptString.h"
 #include "ScriptValue.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "Settings.h"
-#include "SystemTime.h"
 #include "TextResourceDecoder.h"
 #include "WindowFeatures.h"
 #include "XMLHttpRequest.h"
 #include "XMLTokenizer.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -114,68 +115,79 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-const unsigned int cMaxPendingSourceLengthInLowBandwidthDisplay = 128 * 1024;
-#endif
+typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
 
-typedef HashSet<String, CaseFoldingHash> LocalSchemesMap;
+static URLSchemesMap& localSchemes()
+{
+    DEFINE_STATIC_LOCAL(URLSchemesMap, localSchemes, ());
 
-struct FormSubmission {
-    const char* action;
-    String url;
-    RefPtr<FormData> data;
-    String target;
-    String contentType;
-    String boundary;
-    RefPtr<Event> event;
-
-    FormSubmission(const char* a, const String& u, PassRefPtr<FormData> d, const String& t,
-            const String& ct, const String& b, PassRefPtr<Event> e)
-        : action(a)
-        , url(u)
-        , data(d)
-        , target(t)
-        , contentType(ct)
-        , boundary(b)
-        , event(e)
-    {
+    if (localSchemes.isEmpty()) {
+        localSchemes.add("file");
+#if PLATFORM(MAC)
+        localSchemes.add("applewebdata");
+#endif
+#if PLATFORM(QT)
+        localSchemes.add("qrc");
+#endif
     }
-};
 
-struct ScheduledRedirection {
-    enum Type { redirection, locationChange, historyNavigation, locationChangeDuringLoad };
-    Type type;
-    double delay;
-    String url;
-    String referrer;
-    int historySteps;
-    bool lockHistory;
-    bool wasUserGesture;
-    bool wasRefresh;
+    return localSchemes;
+}
+
+static URLSchemesMap& noAccessSchemes()
+{
+    DEFINE_STATIC_LOCAL(URLSchemesMap, noAccessSchemes, ());
 
-    ScheduledRedirection(double redirectDelay, const String& redirectURL, bool redirectLockHistory, bool userGesture, bool refresh)
+    if (noAccessSchemes.isEmpty())
+        noAccessSchemes.add("data");
+
+    return noAccessSchemes;
+}
+
+struct ScheduledRedirection {
+    enum Type { redirection, locationChange, historyNavigation, formSubmission };
+
+    const Type type;
+    const double delay;
+    const String url;
+    const String referrer;
+    const FrameLoadRequest frameRequest;
+    const RefPtr<Event> event;
+    const RefPtr<FormState> formState;
+    const int historySteps;
+    const bool lockHistory;
+    const bool lockBackForwardList;
+    const bool wasUserGesture;
+    const bool wasRefresh;
+    const bool wasDuringLoad;
+
+    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
         : type(redirection)
-        , delay(redirectDelay)
-        , url(redirectURL)
+        , delay(delay)
+        , url(url)
         , historySteps(0)
-        , lockHistory(redirectLockHistory)
-        , wasUserGesture(userGesture)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
         , wasRefresh(refresh)
+        , wasDuringLoad(false)
     {
+        ASSERT(!url.isEmpty());
     }
 
-    ScheduledRedirection(Type locationChangeType,
-            const String& locationChangeURL, const String& locationChangeReferrer,
-            bool locationChangeLockHistory, bool locationChangeWasUserGesture, bool refresh)
-        : type(locationChangeType)
+    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
+        : type(locationChange)
         , delay(0)
-        , url(locationChangeURL)
-        , referrer(locationChangeReferrer)
+        , url(url)
+        , referrer(referrer)
         , historySteps(0)
-        , lockHistory(locationChangeLockHistory)
-        , wasUserGesture(locationChangeWasUserGesture)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
         , wasRefresh(refresh)
+        , wasDuringLoad(duringLoad)
     {
+        ASSERT(!url.isEmpty());
     }
 
     explicit ScheduledRedirection(int historyNavigationSteps)
@@ -183,12 +195,38 @@ struct ScheduledRedirection {
         , delay(0)
         , historySteps(historyNavigationSteps)
         , lockHistory(false)
+        , lockBackForwardList(false)
         , wasUserGesture(false)
         , wasRefresh(false)
+        , wasDuringLoad(false)
     {
     }
-};
 
+    ScheduledRedirection(const FrameLoadRequest& frameRequest,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
+            bool duringLoad)
+        : type(formSubmission)
+        , delay(0)
+        , frameRequest(frameRequest)
+        , event(event)
+        , formState(formState)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(duringLoad)
+    {
+        ASSERT(!frameRequest.isEmpty());
+        ASSERT(this->formState);
+    }
+};
+ 
+#if ENABLE(XHTMLMP)
+static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+#else
+static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+#endif
 static double storedTimeOfLastCompletedLoad;
 static FrameLoader::LocalLoadPolicy localLoadPolicy = FrameLoader::AllowLocalLoadsForLocalOnly;
 
@@ -197,10 +235,9 @@ bool isBackForwardLoadType(FrameLoadType type)
     switch (type) {
         case FrameLoadTypeStandard:
         case FrameLoadTypeReload:
-        case FrameLoadTypeReloadAllowingStaleData:
         case FrameLoadTypeReloadFromOrigin:
         case FrameLoadTypeSame:
-        case FrameLoadTypeRedirectWithLockedHistory:
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
         case FrameLoadTypeReplace:
             return false;
         case FrameLoadTypeBack:
@@ -220,6 +257,11 @@ static int numRequests(Document* document)
     return document->docLoader()->requestCount();
 }
 
+static inline bool canReferToParentFrameEncoding(const Frame* frame, const Frame* parentFrame) 
+{
+    return parentFrame && parentFrame->document()->securityOrigin()->canAccess(frame->document()->securityOrigin());
+}
+
 FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     : m_frame(frame)
     , m_client(client)
@@ -233,11 +275,11 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_quickRedirectComing(false)
     , m_sentRedirectNotification(false)
     , m_inStopAllLoaders(false)
-    , m_navigationDuringLoad(false)
     , m_isExecutingJavaScriptFormAction(false)
     , m_isRunningScript(false)
     , m_didCallImplicitClose(false)
     , m_wasUnloadEventEmitted(false)
+    , m_unloadEventBeingDispatched(false)
     , m_isComplete(false)
     , m_isLoadingMainResource(false)
     , m_cancellingWithLoadInProgress(false)
@@ -257,11 +299,6 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    , m_useLowBandwidthDisplay(true)
-    , m_finishedParsingDuringLowBandwidthDisplay(false)
-    , m_needToSwitchOutLowBandwidthDisplay(false)
-#endif 
 #if ENABLE(WML)
     , m_forceReloadWmlDeck(false)
 #endif
@@ -284,7 +321,7 @@ void FrameLoader::init()
     // this somewhat odd set of steps is needed to give the frame an initial empty document
     m_isDisplayingInitialEmptyDocument = false;
     m_creatingInitialEmptyDocument = true;
-    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(String("")), SubstituteData()).get());
+    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL("")), SubstituteData()).get());
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     setState(FrameStateProvisional);
     m_provisionalDocumentLoader->setResponse(ResourceResponse(KURL(), "text/html", 0, String(), String()));
@@ -314,7 +351,7 @@ Frame* FrameLoader::createWindow(FrameLoader* frameLoaderForFrameLookup, const F
         Frame* frame = frameLoaderForFrameLookup->frame()->tree()->find(request.frameName());
         if (frame && shouldAllowNavigation(frame)) {
             if (!request.resourceRequest().url().isEmpty())
-                frame->loader()->loadFrameRequestWithFormAndValues(request, false, 0, 0, HashMap<String, String>());
+                frame->loader()->loadFrameRequest(request, false, false, 0, 0);
             if (Page* page = frame->page())
                 page->chrome()->focus();
             created = false;
@@ -372,13 +409,7 @@ bool FrameLoader::canHandleRequest(const ResourceRequest& request)
     return m_client->canHandleRequest(request);
 }
 
-void FrameLoader::changeLocation(const String& url, const String& referrer, bool lockHistory, bool userGesture, bool refresh)
-{
-    changeLocation(completeURL(url), referrer, lockHistory, userGesture, refresh);
-}
-
-
-void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool lockHistory, bool userGesture, bool refresh)
+void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool userGesture, bool refresh)
 {
     RefPtr<Frame> protect(m_frame);
 
@@ -387,55 +418,41 @@ void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool l
     if (executeIfJavaScriptURL(request.url(), userGesture))
         return;
 
-    urlSelected(request, "_self", 0, lockHistory, userGesture);
+    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture);
 }
 
-void FrameLoader::urlSelected(const FrameLoadRequest& request, Event* event, bool lockHistory)
-{
-    FrameLoadRequest copy = request;
-    if (copy.resourceRequest().httpReferrer().isEmpty())
-        copy.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
-    addHTTPOriginIfNeeded(copy.resourceRequest(), outgoingOrigin());
-
-    loadFrameRequestWithFormAndValues(copy, lockHistory, event, 0, HashMap<String, String>());
-}
-    
-void FrameLoader::urlSelected(const ResourceRequest& request, const String& _target, Event* triggeringEvent, bool lockHistory, bool userGesture)
+void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture)
 {
     if (executeIfJavaScriptURL(request.url(), userGesture, false))
         return;
 
-    String target = _target;
-    if (target.isEmpty() && m_frame->document())
+    String target = passedTarget;
+    if (target.isEmpty())
         target = m_frame->document()->baseTarget();
 
     FrameLoadRequest frameRequest(request, target);
 
-    urlSelected(frameRequest, triggeringEvent, lockHistory);
+    if (frameRequest.resourceRequest().httpReferrer().isEmpty())
+        frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
+    addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
+
+    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0);
 }
 
 bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName)
 {
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // don't create sub-frame during low bandwidth display
-    if (frame()->document()->inLowBandwidthDisplay()) {
-        m_needToSwitchOutLowBandwidthDisplay = true;
-        return false;
-    }
-#endif
-
     // Support for <frame src="javascript:string">
     KURL scriptURL;
     KURL url;
-    if (protocolIs(urlString, "javascript")) {
-        scriptURL = KURL(urlString);
+    if (protocolIsJavaScript(urlString)) {
+        scriptURL = completeURL(urlString); // completeURL() encodes the URL.
         url = blankURL();
     } else
         url = completeURL(urlString);
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, userGestureHint());
+        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, userGestureHint());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -466,8 +483,7 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     }
 
     bool hideReferrer = shouldHideReferrer(url, referrer);
-    RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer,
-                                         allowsScrolling, marginWidth, marginHeight);
+    RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer, allowsScrolling, marginWidth, marginHeight);
 
     if (!frame)  {
         checkCallImplicitClose();
@@ -497,71 +513,69 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     return frame.get();
 }
 
-void FrameLoader::submitFormAgain()
-{
-    if (m_isRunningScript)
-        return;
-    OwnPtr<FormSubmission> form(m_deferredFormSubmission.release());
-    if (form)
-        submitForm(form->action, form->url, form->data, form->target,
-            form->contentType, form->boundary, form->event.get());
-}
-
 void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<FormData> formData,
-    const String& target, const String& contentType, const String& boundary, Event* event)
+    const String& target, const String& contentType, const String& boundary,
+    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
 {
+    ASSERT(action);
+    ASSERT(strcmp(action, "GET") == 0 || strcmp(action, "POST") == 0);
     ASSERT(formData);
+    ASSERT(formState);
+    ASSERT(formState->sourceFrame() == m_frame);
     
     if (!m_frame->page())
         return;
     
     KURL u = completeURL(url.isNull() ? "" : url);
-    // FIXME: Do we really need to special-case an empty URL?
-    // Would it be better to just go on with the form submisson and let the I/O fail?
     if (u.isEmpty())
         return;
 
-    if (u.protocolIs("javascript")) {
+    if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
         executeIfJavaScriptURL(u, false, false);
         m_isExecutingJavaScriptFormAction = false;
         return;
     }
 
-    if (m_isRunningScript) {
-        if (m_deferredFormSubmission)
-            return;
-        m_deferredFormSubmission.set(new FormSubmission(action, url, formData, target,
-            contentType, boundary, event));
+    FrameLoadRequest frameRequest;
+
+    String targetOrBaseTarget = target.isEmpty() ? m_frame->document()->baseTarget() : target;
+    Frame* targetFrame = findFrameForNavigation(targetOrBaseTarget);
+    if (!targetFrame) {
+        targetFrame = m_frame;
+        frameRequest.setFrameName(targetOrBaseTarget);
+    }
+    if (!targetFrame->page())
         return;
+
+    // FIXME: We'd like to remove this altogether and fix the multiple form submission issue another way.
+
+    // We do not want to submit more than one form from the same page, nor do we want to submit a single
+    // form more than once. This flag prevents these from happening; not sure how other browsers prevent this.
+    // The flag is reset in each time we start handle a new mouse or key down event, and
+    // also in setView since this part may get reused for a page from the back/forward cache.
+    // The form multi-submit logic here is only needed when we are submitting a form that affects this frame.
+
+    // FIXME: Frame targeting is only one of the ways the submission could end up doing something other
+    // than replacing this frame's content, so this check is flawed. On the other hand, the check is hardly
+    // needed any more now that we reset m_submittedFormURL on each mouse or key down event.
+
+    if (m_frame->tree()->isDescendantOf(targetFrame)) {
+        if (m_submittedFormURL == u)
+            return;
+        m_submittedFormURL = u;
     }
 
     formData->generateFiles(m_frame->page()->chrome()->client());
     
-    FrameLoadRequest frameRequest;
-
     if (!m_outgoingReferrer.isEmpty())
         frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
 
-    frameRequest.setFrameName(target.isEmpty() ? m_frame->document()->baseTarget() : target);
-
-    // Handle mailto: forms
-    bool isMailtoForm = equalIgnoringCase(u.protocol(), "mailto");
-    if (isMailtoForm && strcmp(action, "GET") != 0) {
-        // Append body= for POST mailto, replace the whole query string for GET one.
-        String body = formData->flattenToString();
-        String query = u.query();
-        if (!query.isEmpty())
-            query.append('&');
-        u.setQuery(query + body);
-    }
-
-    if (strcmp(action, "GET") == 0) {
+    if (strcmp(action, "GET") == 0)
         u.setQuery(formData->flattenToString());
-    } else {
-        if (!isMailtoForm)
-            frameRequest.resourceRequest().setHTTPBody(formData.get());
+    else {
         frameRequest.resourceRequest().setHTTPMethod("POST");
+        frameRequest.resourceRequest().setHTTPBody(formData);
 
         // construct some user headers if necessary
         if (contentType.isNull() || contentType == "application/x-www-form-urlencoded")
@@ -573,10 +587,23 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    submitForm(frameRequest, event);
+    // Navigation of a subframe during loading of the main frame does not create a new back/forward item.
+    // Strangely, we only implement this rule for form submission; time will tell if we need it for other types of navigation.
+    // The definition of "during load" is any time before the load event has been handled.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    if (Page* targetPage = targetFrame->page()) {
+        Frame* mainFrame = targetPage->mainFrame();
+        if (mainFrame != targetFrame) {
+            Document* document = mainFrame->document();
+            if (!mainFrame->loader()->isComplete() || document && document->processingLoadEvent())
+                lockBackForwardList = true;
+        }
+    }
+
+    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, lockBackForwardList, event, formState);
 }
 
-void FrameLoader::stopLoading(bool sendUnload)
+void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
 {
     if (m_frame->document() && m_frame->document()->tokenizer())
         m_frame->document()->tokenizer()->stopParsing();
@@ -587,18 +614,19 @@ void FrameLoader::stopLoading(bool sendUnload)
                 Node* currentFocusedNode = m_frame->document()->focusedNode();
                 if (currentFocusedNode)
                     currentFocusedNode->aboutToUnload();
-                m_frame->document()->dispatchWindowEvent(eventNames().unloadEvent, false, false);
+                m_unloadEventBeingDispatched = true;
+                if (m_frame->domWindow())
+                    m_frame->domWindow()->dispatchUnloadEvent();
+                m_unloadEventBeingDispatched = false;
                 if (m_frame->document())
-                    m_frame->document()->updateRendering();
+                    m_frame->document()->updateStyleIfNeeded();
                 m_wasUnloadEventEmitted = true;
-                if (m_frame->eventHandler()->pendingFrameUnloadEventCount())
-                    m_frame->eventHandler()->clearPendingFrameUnloadEventCount();
-                if (m_frame->eventHandler()->pendingFrameBeforeUnloadEventCount())
-                    m_frame->eventHandler()->clearPendingFrameBeforeUnloadEventCount();
             }
         }
+
+        // Dispatching the unload event could have made m_frame->document() null.
         if (m_frame->document() && !m_frame->document()->inPageCache())
-            m_frame->document()->removeAllEventListenersFromAllNodes();
+            m_frame->document()->removeAllEventListeners();
     }
 
     m_isComplete = true; // to avoid calling completed() in finishedParsing() (David)
@@ -617,7 +645,8 @@ void FrameLoader::stopLoading(bool sendUnload)
             cache()->loader()->cancelRequests(docLoader);
 
 #if ENABLE(DATABASE)
-        doc->stopDatabases();
+        if (databasePolicy == DatabasePolicyStop)
+            doc->stopDatabases();
 #endif
     }
 
@@ -626,14 +655,6 @@ void FrameLoader::stopLoading(bool sendUnload)
         child->loader()->stopLoading(sendUnload);
 
     cancelRedirection();
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    if (m_frame->document() && m_frame->document()->inLowBandwidthDisplay()) {
-        // Since loading is forced to stop, reset the state without really switching.
-        m_needToSwitchOutLowBandwidthDisplay = false;
-        switchOutLowBandwidthDisplayIfReady();
-    }
-#endif  
 }
 
 void FrameLoader::stop()
@@ -642,16 +663,10 @@ void FrameLoader::stop()
     // The frame's last ref may be removed and it will be deleted by checkCompleted().
     RefPtr<Frame> protector(m_frame);
     
-    if (m_frame->document()) {
-        if (m_frame->document()->tokenizer())
-            m_frame->document()->tokenizer()->stopParsing();
-        m_frame->document()->finishParsing();
-    } else
-        // WebKit partially uses WebCore when loading non-HTML docs.  In these cases doc==nil, but
-        // WebCore is enough involved that we need to checkCompleted() in order for m_bComplete to
-        // become true. An example is when a subframe is a pure text doc, and that subframe is the
-        // last one to complete.
-        checkCompleted();
+    if (m_frame->document()->tokenizer())
+        m_frame->document()->tokenizer()->stopParsing();
+    m_frame->document()->finishParsing();
+
     if (m_iconLoader)
         m_iconLoader->stopLoading();
 }
@@ -680,11 +695,11 @@ KURL FrameLoader::iconURL()
         return KURL();
 
     // If we have an iconURL from a Link element, return that
-    if (m_frame->document() && !m_frame->document()->iconURL().isEmpty())
+    if (!m_frame->document()->iconURL().isEmpty())
         return KURL(m_frame->document()->iconURL());
 
     // Don't return a favicon iconURL unless we're http or https
-    if (!m_URL.protocolIs("http") && !m_URL.protocolIs("https"))
+    if (!m_URL.protocolInHTTPFamily())
         return KURL();
 
     KURL url;
@@ -698,10 +713,11 @@ KURL FrameLoader::iconURL()
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_scheduledRedirection && m_scheduledRedirection->type == ScheduledRedirection::locationChangeDuringLoad)
+    if (m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
+    }
 
     cancelRedirection();
     m_frame->editor()->clearLastEditCommand();
@@ -711,11 +727,15 @@ bool FrameLoader::didOpenURL(const KURL& url)
     m_isLoadingMainResource = true;
     m_didCallImplicitClose = false;
 
-    m_frame->setJSStatusBarText(String());
-    m_frame->setJSDefaultStatusBarText(String());
-
+    // If we are still in the process of initializing an empty document then
+    // its frame is not in a consistent state for rendering, so avoid setJSStatusBarText
+    // since it may cause clients to attempt to render the frame.
+    if (!m_creatingInitialEmptyDocument) {
+        m_frame->setJSStatusBarText(String());
+        m_frame->setJSDefaultStatusBarText(String());
+    }
     m_URL = url;
-    if ((m_URL.protocolIs("http") || m_URL.protocolIs("https")) && !m_URL.host().isEmpty() && m_URL.path().isEmpty())
+    if (m_URL.protocolInHTTPFamily() && !m_URL.host().isEmpty() && m_URL.path().isEmpty())
         m_URL.setPath("/");
     m_workingURL = m_URL;
 
@@ -743,9 +763,12 @@ void FrameLoader::didExplicitOpen()
 
 bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
 {
-    if (!url.protocolIs("javascript"))
+    if (!protocolIsJavaScript(url))
         return false;
 
+    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
+        return true;
+
     String script = decodeURLEscapeSequences(url.string().substring(strlen("javascript:")));
     ScriptValue result = executeScript(script, userGesture);
 
@@ -754,13 +777,13 @@ bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool
         return true;
 
     SecurityOrigin* currentSecurityOrigin = 0;
-    if (m_frame->document())
-        currentSecurityOrigin = m_frame->document()->securityOrigin();
+    currentSecurityOrigin = m_frame->document()->securityOrigin();
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
     //        http://bugs.webkit.org/show_bug.cgi?id=16782
     if (replaceDocument) {
+        stopAllLoaders();
         begin(m_URL, true, currentSecurityOrigin);
         write(scriptResult);
         end();
@@ -786,8 +809,7 @@ ScriptValue FrameLoader::executeScript(const ScriptSourceCode& sourceCode)
 
     if (!wasRunningScript) {
         m_isRunningScript = false;
-        submitFormAgain();
-        Document::updateDocumentsRendering();
+        Document::updateStyleForAllDocuments();
     }
 
     return result;
@@ -812,7 +834,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
         return;
     m_needsClear = false;
     
-    if (m_frame->document() && !m_frame->document()->inPageCache()) {
+    if (!m_frame->document()->inPageCache()) {
         m_frame->document()->cancelParsing();
         m_frame->document()->stopActiveDOMObjects();
         if (m_frame->document()->attached()) {
@@ -866,10 +888,12 @@ void FrameLoader::receivedFirstData()
     dispatchDidCommitLoad();
     dispatchWindowObjectAvailable();
     
-    String ptitle = m_documentLoader->title();
-    // If we have a title let the WebView know about it.
-    if (!ptitle.isNull())
-        m_client->dispatchDidReceiveTitle(ptitle);
+    if (m_documentLoader) {
+        String ptitle = m_documentLoader->title();
+        // If we have a title let the WebView know about it.
+        if (!ptitle.isNull())
+            m_client->dispatchDidReceiveTitle(ptitle);
+    }
 
     m_workingURL = KURL();
 
@@ -909,12 +933,18 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     // might destroy the document that owns it.
     RefPtr<SecurityOrigin> forcedSecurityOrigin = origin;
 
-    bool resetScripting = !(m_isDisplayingInitialEmptyDocument && m_frame->document() && m_frame->document()->securityOrigin()->isSecureTransitionTo(url));
+    RefPtr<Document> document;
+
+    // Create a new document before clearing the frame, because it may need to inherit an aliased security context.
+    if (!m_isDisplayingInitialEmptyDocument && m_client->shouldUsePluginDocument(m_responseMIMEType))
+        document = PluginDocument::create(m_frame);
+    else
+        document = DOMImplementation::createDocument(m_responseMIMEType, m_frame, m_frame->inViewSourceMode());
+
+    bool resetScripting = !(m_isDisplayingInitialEmptyDocument && m_frame->document()->securityOrigin()->isSecureTransitionTo(url));
     clear(resetScripting, resetScripting);
     if (resetScripting)
         m_frame->script()->updatePlatformScriptObjects();
-    if (dispatch)
-        dispatchWindowObjectAvailable();
 
     m_needsClear = true;
     m_isComplete = false;
@@ -929,14 +959,11 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_outgoingReferrer = ref.string();
     m_URL = url;
 
-    RefPtr<Document> document;
-    
-    if (!m_isDisplayingInitialEmptyDocument && m_client->shouldUsePluginDocument(m_responseMIMEType))
-        document = PluginDocument::create(m_frame);
-    else
-        document = DOMImplementation::createDocument(m_responseMIMEType, m_frame, m_frame->inViewSourceMode());
     m_frame->setDocument(document);
 
+    if (dispatch)
+        dispatchWindowObjectAvailable();
+
     document->setURL(m_URL);
     if (m_decoder)
         document->setDecoder(m_decoder.get());
@@ -946,7 +973,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
-    updatePolicyBaseURL();
+    updateFirstPartyForCookies();
 
     Settings* settings = document->settings();
     document->docLoader()->setAutoLoadImages(settings && settings->loadsImagesAutomatically());
@@ -969,18 +996,6 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
 
     if (m_frame->view())
         m_frame->view()->setContentsSize(IntSize());
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // Low bandwidth display is a first pass display without external resources
-    // used to give an instant visual feedback. We currently only enable it for
-    // HTML documents in the top frame.
-    if (document->isHTMLDocument() && !m_frame->tree()->parent() && m_useLowBandwidthDisplay) {
-        m_pendingSourceInLowBandwidthDisplay = String();
-        m_finishedParsingDuringLowBandwidthDisplay = false;
-        m_needToSwitchOutLowBandwidthDisplay = false;
-        document->setLowBandwidthDisplay(true);
-    }
-#endif
 }
 
 void FrameLoader::write(const char* str, int len, bool flush)
@@ -999,12 +1014,28 @@ void FrameLoader::write(const char* str, int len, bool flush)
     }
     
     if (!m_decoder) {
-        Settings* settings = m_frame->settings();
-        m_decoder = TextResourceDecoder::create(m_responseMIMEType, settings ? settings->defaultTextEncodingName() : String());
-        if (m_encoding.isEmpty()) {
+        if (Settings* settings = m_frame->settings()) {
+            m_decoder = TextResourceDecoder::create(m_responseMIMEType,
+                settings->defaultTextEncodingName(),
+                settings->usesEncodingDetector());
             Frame* parentFrame = m_frame->tree()->parent();
-            if (parentFrame && parentFrame->document()->securityOrigin()->canAccess(m_frame->document()->securityOrigin()))
-                m_decoder->setEncoding(parentFrame->document()->inputEncoding(), TextResourceDecoder::DefaultEncoding);
+            // Set the hint encoding to the parent frame encoding only if
+            // the parent and the current frames share the security origin.
+            // We impose this condition because somebody can make a child frame 
+            // containing a carefully crafted html/javascript in one encoding
+            // that can be mistaken for hintEncoding (or related encoding) by
+            // an auto detector. When interpreted in the latter, it could be
+            // an attack vector.
+            // FIXME: This might be too cautious for non-7bit-encodings and
+            // we may consider relaxing this later after testing.
+            if (canReferToParentFrameEncoding(m_frame, parentFrame))
+                m_decoder->setHintEncoding(parentFrame->document()->decoder());
+        } else
+            m_decoder = TextResourceDecoder::create(m_responseMIMEType, String());
+        Frame* parentFrame = m_frame->tree()->parent();
+        if (m_encoding.isEmpty()) {
+            if (canReferToParentFrameEncoding(m_frame, parentFrame))
+                m_decoder->setEncoding(parentFrame->document()->inputEncoding(), TextResourceDecoder::EncodingFromParentFrame);
         } else {
             m_decoder->setEncoding(m_encoding,
                 m_encodingWasChosenByUser ? TextResourceDecoder::UserChosenEncoding : TextResourceDecoder::EncodingFromHTTPHeader);
@@ -1018,11 +1049,6 @@ void FrameLoader::write(const char* str, int len, bool flush)
     if (decoded.isEmpty())
         return;
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    if (m_frame->document()->inLowBandwidthDisplay())
-        m_pendingSourceInLowBandwidthDisplay.append(decoded);   
-#endif
-
     if (!m_receivedData) {
         m_receivedData = true;
         if (m_decoder->encoding().usesVisualOrdering())
@@ -1058,7 +1084,7 @@ void FrameLoader::end()
 
 void FrameLoader::endIfNotLoadingMainResource()
 {
-    if (m_isLoadingMainResource || !m_frame->page())
+    if (m_isLoadingMainResource || !m_frame->page() || !m_frame->document())
         return;
 
     // http://bugs.webkit.org/show_bug.cgi?id=10854
@@ -1067,21 +1093,8 @@ void FrameLoader::endIfNotLoadingMainResource()
     RefPtr<Frame> protector(m_frame);
 
     // make sure nothing's left in there
-    if (m_frame->document()) {
-        write(0, 0, true);
-        m_frame->document()->finishParsing();
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        if (m_frame->document()->inLowBandwidthDisplay()) {
-            m_finishedParsingDuringLowBandwidthDisplay = true;
-            switchOutLowBandwidthDisplayIfReady();
-        }
-#endif            
-    } else
-        // WebKit partially uses WebCore when loading non-HTML docs.  In these cases doc==nil, but
-        // WebCore is enough involved that we need to checkCompleted() in order for m_bComplete to
-        // become true.  An example is when a subframe is a pure text doc, and that subframe is the
-        // last one to complete.
-        checkCompleted();
+    write(0, 0, true);
+    m_frame->document()->finishParsing();
 }
 
 void FrameLoader::iconLoadDecisionAvailable()
@@ -1165,23 +1178,6 @@ bool FrameLoader::allowSubstituteDataAccessToLocal()
     return localLoadPolicy != FrameLoader::AllowLocalLoadsForLocalOnly;
 }
 
-static LocalSchemesMap& localSchemes()
-{
-    DEFINE_STATIC_LOCAL(LocalSchemesMap, localSchemes, ());
-
-    if (localSchemes.isEmpty()) {
-        localSchemes.add("file");
-#if PLATFORM(MAC)
-        localSchemes.add("applewebdata");
-#endif
-#if PLATFORM(QT)
-        localSchemes.add("qrc");
-#endif
-    }
-
-    return localSchemes;
-}
-
 void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 {
     ASSERT(iconDatabase());
@@ -1193,14 +1189,11 @@ void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 void FrameLoader::restoreDocumentState()
 {
     Document* doc = m_frame->document();
-    if (!doc)
-        return;
         
     HistoryItem* itemToRestore = 0;
     
     switch (loadType()) {
         case FrameLoadTypeReload:
-        case FrameLoadTypeReloadAllowingStaleData:
         case FrameLoadTypeReloadFromOrigin:
         case FrameLoadTypeSame:
         case FrameLoadTypeReplace:
@@ -1208,14 +1201,15 @@ void FrameLoader::restoreDocumentState()
         case FrameLoadTypeBack:
         case FrameLoadTypeForward:
         case FrameLoadTypeIndexedBackForward:
-        case FrameLoadTypeRedirectWithLockedHistory:
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
         case FrameLoadTypeStandard:
             itemToRestore = m_currentHistoryItem.get(); 
     }
     
     if (!itemToRestore)
         return;
-        
+
+    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
     doc->setStateForNewFormElements(itemToRestore->documentState());
 }
 
@@ -1225,7 +1219,7 @@ void FrameLoader::gotoAnchor()
     // OTOH If CSS target was set previously, we want to set it to 0, recalc
     // and possibly repaint because :target pseudo class may have been
     // set (see bug 11321).
-    if (!m_URL.hasRef() && !(m_frame->document() && m_frame->document()->getCSSTarget()))
+    if (!m_URL.hasRef() && !m_frame->document()->cssTarget())
         return;
 
     String ref = m_URL.ref();
@@ -1263,12 +1257,14 @@ void FrameLoader::finishedParsing()
 
 void FrameLoader::loadDone()
 {
-    if (m_frame->document())
-        checkCompleted();
+    checkCompleted();
 }
 
 void FrameLoader::checkCompleted()
 {
+    if (m_frame->view())
+        m_frame->view()->checkStopDelayingDeferredRepaints();
+
     // Any frame that hasn't completed yet?
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         if (!child->loader()->m_isComplete)
@@ -1279,19 +1275,12 @@ void FrameLoader::checkCompleted()
         return;
 
     // Are we still parsing?
-    if (m_frame->document() && m_frame->document()->parsing())
+    if (m_frame->document()->parsing())
         return;
 
     // Still waiting for images/scripts?
-    if (m_frame->document())
-        if (numRequests(m_frame->document()))
-            return;
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // as switch will be called, don't complete yet
-    if (m_frame->document() && m_frame->document()->inLowBandwidthDisplay() && m_needToSwitchOutLowBandwidthDisplay)
+    if (numRequests(m_frame->document()))
         return;
-#endif
 
     // OK, completed.
     m_isComplete = true;
@@ -1335,7 +1324,7 @@ void FrameLoader::scheduleCheckLoadComplete()
 
 void FrameLoader::checkCallImplicitClose()
 {
-    if (m_didCallImplicitClose || !m_frame->document() || m_frame->document()->parsing())
+    if (m_didCallImplicitClose || m_frame->document()->parsing())
         return;
 
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
@@ -1344,8 +1333,7 @@ void FrameLoader::checkCallImplicitClose()
 
     m_didCallImplicitClose = true;
     m_wasUnloadEventEmitted = false;
-    if (m_frame->document())
-        m_frame->document()->implicitClose();
+    m_frame->document()->implicitClose();
 }
 
 KURL FrameLoader::baseURL() const
@@ -1354,12 +1342,6 @@ KURL FrameLoader::baseURL() const
     return m_frame->document()->baseURL();
 }
 
-String FrameLoader::baseTarget() const
-{
-    ASSERT(m_frame->document());
-    return m_frame->document()->baseTarget();
-}
-
 KURL FrameLoader::completeURL(const String& url)
 {
     ASSERT(m_frame->document());
@@ -1374,21 +1356,27 @@ void FrameLoader::scheduleHTTPRedirection(double delay, const String& url)
     if (!m_frame->page())
         return;
 
+    if (url.isEmpty())
+        return;
+
     // We want a new history item if the refresh timeout is > 1 second.
     if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
-        scheduleRedirection(new ScheduledRedirection(delay, url, delay <= 1, false, false));
+        scheduleRedirection(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
 }
 
-void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool wasUserGesture)
+void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
 {
     if (!m_frame->page())
         return;
 
+    if (url.isEmpty())
+        return;
+
     // If the URL we're going to navigate to is the same as the current one, except for the
     // fragment part, we don't need to schedule the location change.
     KURL parsedURL(url);
     if (parsedURL.hasRef() && equalIgnoringRef(m_URL, parsedURL)) {
-        changeLocation(url, referrer, lockHistory, wasUserGesture);
+        changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
         return;
     }
 
@@ -1396,18 +1384,23 @@ void FrameLoader::scheduleLocationChange(const String& url, const String& referr
     // This may happen when a frame changes the location of another frame.
     bool duringLoad = !m_committedFirstRealDocumentLoad;
 
-    // If a redirect was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (duringLoad) {
-        if (m_provisionalDocumentLoader)
-            m_provisionalDocumentLoader->stopLoading();
-        stopLoading(true);   
-    }
+    scheduleRedirection(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
+}
+
+void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
+    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{
+    ASSERT(m_frame->page());
+    ASSERT(!frameRequest.isEmpty());
 
-    ScheduledRedirection::Type type = duringLoad
-        ? ScheduledRedirection::locationChangeDuringLoad : ScheduledRedirection::locationChange;
-    scheduleRedirection(new ScheduledRedirection(type, url, referrer, lockHistory, wasUserGesture, false));
+    // FIXME: Do we need special handling for form submissions where the URL is the same
+    // as the current one except for the fragment part? See scheduleLocationChange above.
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !m_committedFirstRealDocumentLoad;
+
+    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, lockBackForwardList, event, formState, duringLoad));
 }
 
 void FrameLoader::scheduleRefresh(bool wasUserGesture)
@@ -1415,19 +1408,10 @@ void FrameLoader::scheduleRefresh(bool wasUserGesture)
     if (!m_frame->page())
         return;
 
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame requests a refresh of another frame.
-    bool duringLoad = !m_frame->document();
-    
-    // If a refresh was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (duringLoad)
-        stopLoading(true);   
+    if (m_URL.isEmpty())
+        return;
 
-    ScheduledRedirection::Type type = duringLoad
-        ? ScheduledRedirection::locationChangeDuringLoad : ScheduledRedirection::locationChange;
-    scheduleRedirection(new ScheduledRedirection(type, m_URL.string(), m_outgoingReferrer, true, wasUserGesture, true));
+    scheduleRedirection(new ScheduledRedirection(m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true, false));
 }
 
 bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
@@ -1437,7 +1421,7 @@ bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
             return false;
         case ScheduledRedirection::historyNavigation:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
+        case ScheduledRedirection::formSubmission:
             return true;
     }
     ASSERT_NOT_REACHED();
@@ -1455,18 +1439,6 @@ void FrameLoader::scheduleHistoryNavigation(int steps)
         return;
     }
 
-    // If the steps to navigate is not zero (which needs to force a reload), and if we think the navigation is going to be a fragment load
-    // (when the URL we're going to navigate to is the same as the current one, except for the fragment part - but not exactly the same because that's a reload),
-    // then we don't need to schedule the navigation.
-    if (steps != 0) {
-        KURL destination = historyURL(steps);
-        // FIXME: This doesn't seem like a reliable way to tell whether or not the load will be a fragment load.
-        if (equalIgnoringRef(m_URL, destination) && m_URL != destination) {
-            goBackOrForward(steps);
-            return;
-        }
-    }
-    
     scheduleRedirection(new ScheduledRedirection(steps));
 }
 
@@ -1509,62 +1481,55 @@ void FrameLoader::redirectionTimerFired(Timer<FrameLoader>*)
     switch (redirection->type) {
         case ScheduledRedirection::redirection:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
-            changeLocation(redirection->url, redirection->referrer,
-                redirection->lockHistory, redirection->wasUserGesture, redirection->wasRefresh);
+            changeLocation(KURL(redirection->url), redirection->referrer,
+                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
             return;
         case ScheduledRedirection::historyNavigation:
             if (redirection->historySteps == 0) {
                 // Special case for go(0) from a frame -> reload only the frame
-                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->wasUserGesture);
+                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
                 return;
             }
             // go(i!=0) from a frame navigates into the history of the frame only,
             // in both IE and NS (but not in Mozilla). We can't easily do that.
             goBackOrForward(redirection->historySteps);
             return;
+        case ScheduledRedirection::formSubmission:
+            // The submitForm function will find a target frame before using the redirection timer.
+            // Now that the timer has fired, we need to repeat the security check which normally is done when
+            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
+            // without leaving a time window. If we fail the check just silently drop the form submission.
+            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
+                return;
+            loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
+                redirection->event, redirection->formState);
+            return;
     }
 
     ASSERT_NOT_REACHED();
 }
 
-/*
-    In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
-    The item that was the target of the user's navigation is designated as the "targetItem".  
-    When this method is called with doClip=YES we're able to create the whole tree except for the target's children, 
-    which will be loaded in the future.  That part of the tree will be filled out as the child loads are committed.
-*/
 void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer, Frame* childFrame)
 {
     ASSERT(childFrame);
+
     HistoryItem* parentItem = currentHistoryItem();
     FrameLoadType loadType = this->loadType();
-    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedHistory;
+    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
 
     KURL workingURL = url;
     
-    // If we're moving in the backforward list, we might want to replace the content
+    // If we're moving in the back/forward list, we might want to replace the content
     // of this child frame with whatever was there at that point.
-    // Reload will maintain the frame contents, LoadSame will not.
-    if (parentItem && parentItem->children().size() &&
-        (isBackForwardLoadType(loadType) || loadType == FrameLoadTypeReloadAllowingStaleData))
-    {
-        HistoryItem* childItem = parentItem->childItemWithName(childFrame->tree()->name());
+    if (parentItem && parentItem->children().size() && isBackForwardLoadType(loadType)) {
+        HistoryItem* childItem = parentItem->childItemWithTarget(childFrame->tree()->name());
         if (childItem) {
             // Use the original URL to ensure we get all the side-effects, such as
             // onLoad handlers, of any redirects that happened. An example of where
             // this is needed is Radar 3213556.
             workingURL = KURL(childItem->originalURLString());
-            // These behaviors implied by these loadTypes should apply to the child frames
             childLoadType = loadType;
-
-            if (isBackForwardLoadType(loadType)) {
-                // For back/forward, remember this item so we can traverse any child items as child frames load
-                childFrame->loader()->setProvisionalHistoryItem(childItem);
-            } else {
-                // For reload, just reinstall the current item, since a new child frame was created but we won't be creating a new BF item
-                childFrame->loader()->setCurrentHistoryItem(childItem);
-            }
+            childFrame->loader()->m_provisionalHistoryItem = childItem;
         }
     }
 
@@ -1573,7 +1538,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
     if (subframeArchive)
         childFrame->loader()->loadArchive(subframeArchive.release());
     else
-        childFrame->loader()->loadURL(workingURL, referer, String(), childLoadType, 0, 0);
+        childFrame->loader()->loadURL(workingURL, referer, String(), false, childLoadType, 0, 0);
 }
 
 void FrameLoader::loadArchive(PassRefPtr<Archive> prpArchive)
@@ -1651,12 +1616,10 @@ bool FrameLoader::gotoAnchor(const String& name)
 
     // We need to update the layout before scrolling, otherwise we could
     // really mess things up if an anchor scroll comes at a bad moment.
-    if (m_frame->document()) {
-        m_frame->document()->updateRendering();
-        // Only do a layout if changes have occurred that make it necessary.
-        if (m_frame->view() && m_frame->contentRenderer() && m_frame->contentRenderer()->needsLayout())
-            m_frame->view()->layout();
-    }
+    m_frame->document()->updateStyleIfNeeded();
+    // Only do a layout if changes have occurred that make it necessary.
+    if (m_frame->view() && m_frame->contentRenderer() && m_frame->contentRenderer()->needsLayout())
+        m_frame->view()->layout();
   
     // Scroll nested layers and frames to reveal the anchor.
     // Align to the top and to the closest side (this matches other browsers).
@@ -1668,8 +1631,11 @@ bool FrameLoader::gotoAnchor(const String& name)
         renderer = anchorNode->renderer();
         rect = anchorNode->getRect();
     }
-    if (renderer)
-        renderer->enclosingLayer()->scrollRectToVisible(rect, true, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignTopAlways);
+    if (renderer) {
+        renderer->enclosingLayer()->scrollRectToVisible(rect, true, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
+        if (m_frame->view())
+            m_frame->view()->setLockedToAnchor(true);
+    }
 
     return true;
 }
@@ -1680,14 +1646,6 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // don't care object during low bandwidth display
-    if (frame()->document()->inLowBandwidthDisplay()) {
-        m_needToSwitchOutLowBandwidthDisplay = true;
-        return false;
-    }
-#endif
-
     KURL completedURL;
     if (!url.isEmpty())
         completedURL = completeURL(url);
@@ -1731,24 +1689,39 @@ bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool
     return objectType == ObjectContentNone || objectType == ObjectContentNetscapePlugin || objectType == ObjectContentOtherPlugin;
 }
 
+static HTMLPlugInElement* toPlugInElement(Node* node)
+{
+    if (!node)
+        return 0;
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    ASSERT(node->hasTagName(objectTag) || node->hasTagName(embedTag) 
+        || node->hasTagName(videoTag) || node->hasTagName(audioTag)
+        || node->hasTagName(appletTag));
+#else
+    ASSERT(node->hasTagName(objectTag) || node->hasTagName(embedTag) 
+        || node->hasTagName(appletTag));
+#endif
+
+    return static_cast<HTMLPlugInElement*>(node);
+}
+    
 bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String& mimeType, 
     const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
 {
     Widget* widget = 0;
 
     if (renderer && !useFallback) {
-        Element* pluginElement = 0;
-        if (renderer->node() && renderer->node()->isElementNode())
-            pluginElement = static_cast<Element*>(renderer->node());
+        HTMLPlugInElement* element = toPlugInElement(renderer->node());
 
         if (!canLoad(url, String(), frame()->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return false;
         }
 
-        widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()), 
-                                        pluginElement, url, paramNames, paramValues, mimeType,
-                                        m_frame->document()->isPluginDocument());
+        widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()),
+                                        element, url, paramNames, paramValues, mimeType,
+                                        m_frame->document()->isPluginDocument() && !m_containsPlugIns);
         if (widget) {
             renderer->setWidget(widget);
             m_containsPlugIns = true;
@@ -1758,22 +1731,6 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     return widget != 0;
 }
 
-void FrameLoader::clearRecordedFormValues()
-{
-    m_formAboutToBeSubmitted = 0;
-    m_formValuesAboutToBeSubmitted.clear();
-}
-
-void FrameLoader::setFormAboutToBeSubmitted(PassRefPtr<HTMLFormElement> element)
-{
-    m_formAboutToBeSubmitted = element;
-}
-
-void FrameLoader::recordFormValue(const String& name, const String& value)
-{
-    m_formValuesAboutToBeSubmitted.set(name, value);
-}
-
 void FrameLoader::parentCompleted()
 {
     if (m_scheduledRedirection && !m_redirectionTimer.isActive())
@@ -1787,10 +1744,7 @@ String FrameLoader::outgoingReferrer() const
 
 String FrameLoader::outgoingOrigin() const
 {
-    if (m_frame->document())
-        return m_frame->document()->securityOrigin()->toString();
-
-    return SecurityOrigin::createEmpty()->toString();
+    return m_frame->document()->securityOrigin()->toString();
 }
 
 Frame* FrameLoader::opener()
@@ -1831,17 +1785,7 @@ void FrameLoader::handleFallbackContent()
 }
 
 void FrameLoader::provisionalLoadStarted()
-{
-    Page* page = m_frame->page();
-    
-    // this is used to update the current history item
-    // in the event of a navigation aytime during loading
-    m_navigationDuringLoad = false;
-    if (page) {
-        Document *document = page->mainFrame()->document();
-        m_navigationDuringLoad = !page->mainFrame()->loader()->isComplete() || (document && document->processingLoadEvent());
-    }
-    
+{    
     m_firstLayoutDone = false;
     cancelRedirection(true);
     m_client->provisionalLoadStarted();
@@ -1849,20 +1793,10 @@ void FrameLoader::provisionalLoadStarted()
 
 bool FrameLoader::userGestureHint()
 {
-    Frame* rootFrame = m_frame;
-    while (rootFrame->tree()->parent())
-        rootFrame = rootFrame->tree()->parent();
-
-    if (rootFrame->script()->isEnabled())
-        return rootFrame->script()->processingUserGesture();
-
-    return true; // If JavaScript is disabled, a user gesture must have initiated the navigation
-}
-
-void FrameLoader::didNotOpenURL(const KURL& url)
-{
-    if (m_submittedFormURL == url)
-        m_submittedFormURL = KURL();
+    Frame* frame = m_frame->tree()->top();
+    if (!frame->script()->isEnabled())
+        return true; // If JavaScript is disabled, a user gesture must have initiated the navigation.
+    return frame->script()->processingUserGesture(); // FIXME: Use pageIsProcessingUserGesture.
 }
 
 void FrameLoader::resetMultipleFormSubmissionProtection()
@@ -1886,70 +1820,212 @@ void FrameLoader::addData(const char* bytes, int length)
     write(bytes, length);
 }
 
-bool FrameLoader::canCachePage()
-{    
-    // Cache the page, if possible.
-    // Don't write to the cache if in the middle of a redirect, since we will want to
-    // store the final page we end up on.
-    // No point writing to the cache on a reload or loadSame, since we will just write
-    // over it again when we leave that page.
-    // FIXME: <rdar://problem/4886592> - We should work out the complexities of caching pages with frames as they
-    // are the most interesting pages on the web, and often those that would benefit the most from caching!
-    FrameLoadType loadType = this->loadType();
-
+bool FrameLoader::canCachePageContainingThisFrame()
+{
     return m_documentLoader
         && m_documentLoader->mainDocumentError().isNull()
         && !m_frame->tree()->childCount()
-        && !m_frame->tree()->parent()
-        // FIXME: If we ever change this so that pages with plug-ins will be cached,
-        // we need to make sure that we don't cache pages that have outstanding NPObjects
+        // FIXME: If we ever change this so that frames with plug-ins will be cached,
+        // we need to make sure that we don't cache frames that have outstanding NPObjects
         // (objects created by the plug-in). Since there is no way to pause/resume a Netscape plug-in,
         // they would need to be destroyed and then recreated, and there is no way that we can recreate
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
-        && m_frame->document()
-        && !m_frame->document()->hasWindowEventListener(eventNames().unloadEvent)
+        && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
         && !m_frame->document()->usingGeolocation()
-        && m_frame->page()
-        && m_frame->page()->backForwardList()->enabled()
-        && m_frame->page()->backForwardList()->capacity() > 0
-        && m_frame->page()->settings()->usesPageCache()
         && m_currentHistoryItem
-        && !isQuickRedirectComing()
-        && loadType != FrameLoadTypeReload 
-        && loadType != FrameLoadTypeReloadAllowingStaleData
-        && loadType != FrameLoadTypeReloadFromOrigin
-        && loadType != FrameLoadTypeSame
+        && !m_quickRedirectComing
         && !m_documentLoader->isLoadingInAPISense()
         && !m_documentLoader->isStopping()
         && m_frame->document()->canSuspendActiveDOMObjects()
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        // FIXME: We should investigating caching pages that have an associated
+        // FIXME: We should investigating caching frames that have an associated
         // application cache. <rdar://problem/5917899> tracks that work.
         && !m_documentLoader->applicationCache()
         && !m_documentLoader->candidateApplicationCacheGroup()
 #endif
+        && m_client->canCachePage()
         ;
 }
 
-void FrameLoader::updatePolicyBaseURL()
+bool FrameLoader::canCachePage()
 {
-    if (m_frame->tree()->parent() && m_frame->tree()->parent()->document())
-        setPolicyBaseURL(m_frame->tree()->parent()->document()->policyBaseURL());
+#ifndef NDEBUG
+    logCanCachePageDecision();
+#endif
+    
+    // Cache the page, if possible.
+    // Don't write to the cache if in the middle of a redirect, since we will want to
+    // store the final page we end up on.
+    // No point writing to the cache on a reload or loadSame, since we will just write
+    // over it again when we leave that page.
+    // FIXME: <rdar://problem/4886592> - We should work out the complexities of caching pages with frames as they
+    // are the most interesting pages on the web, and often those that would benefit the most from caching!
+    FrameLoadType loadType = this->loadType();
+    
+    return !m_frame->tree()->parent()
+        && canCachePageContainingThisFrame()
+        && m_frame->page()
+        && m_frame->page()->backForwardList()->enabled()
+        && m_frame->page()->backForwardList()->capacity() > 0
+        && m_frame->page()->settings()->usesPageCache()
+        && loadType != FrameLoadTypeReload 
+        && loadType != FrameLoadTypeReloadFromOrigin
+        && loadType != FrameLoadTypeSame
+        ;
+}
+
+#ifndef NDEBUG
+static String& pageCacheLogPrefix(int indentLevel)
+{
+    static int previousIndent = -1;
+    DEFINE_STATIC_LOCAL(String, prefix, ());
+    
+    if (indentLevel != previousIndent) {    
+        previousIndent = indentLevel;
+        prefix.truncate(0);
+        for (int i = 0; i < previousIndent; ++i)
+            prefix += "    ";
+    }
+    
+    return prefix;
+}
+
+static void pageCacheLog(const String& prefix, const String& message)
+{
+    LOG(PageCache, "%s%s", prefix.utf8().data(), message.utf8().data());
+}
+
+#define PCLOG(...) pageCacheLog(pageCacheLogPrefix(indentLevel), String::format(__VA_ARGS__))
+
+void FrameLoader::logCanCachePageDecision()
+{
+    // Only bother logging for main frames that have actually loaded and have content.
+    if (m_creatingInitialEmptyDocument)
+        return;
+    KURL currentURL = m_documentLoader ? m_documentLoader->url() : KURL();
+    if (currentURL.isEmpty())
+        return;
+
+    int indentLevel = 0;
+    PCLOG("--------\n Determining if page can be cached:");
+
+    bool cannotCache = !logCanCacheFrameDecision(1);
+        
+    FrameLoadType loadType = this->loadType();
+    do {
+        if (m_frame->tree()->parent())
+            { PCLOG("   -Frame has a parent frame"); cannotCache = true; }
+        if (!m_frame->page()) {
+            PCLOG("   -There is no Page object");
+            cannotCache = true;
+            break;
+        }
+        if (!m_frame->page()->backForwardList()->enabled())
+            { PCLOG("   -The back/forward list is disabled"); cannotCache = true; }
+        if (!(m_frame->page()->backForwardList()->capacity() > 0))
+            { PCLOG("   -The back/forward list has a 0 capacity"); cannotCache = true; }
+        if (!m_frame->page()->settings()->usesPageCache())
+            { PCLOG("   -Page settings says b/f cache disabled"); cannotCache = true; }
+        if (loadType == FrameLoadTypeReload)
+            { PCLOG("   -Load type is: Reload"); cannotCache = true; }
+        if (loadType == FrameLoadTypeReloadFromOrigin)
+            { PCLOG("   -Load type is: Reload from origin"); cannotCache = true; }
+        if (loadType == FrameLoadTypeSame)
+            { PCLOG("   -Load type is: Same"); cannotCache = true; }
+    } while (false);
+    
+    PCLOG(cannotCache ? " Page CANNOT be cached\n--------" : " Page CAN be cached\n--------");
+}
+
+bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
+{
+    // Only bother logging for frames that have actually loaded and have content.
+    if (m_creatingInitialEmptyDocument)
+        return false;
+    KURL currentURL = m_documentLoader ? m_documentLoader->url() : KURL();
+    if (currentURL.isEmpty())
+        return false;
+
+    PCLOG("+---");
+    KURL newURL = m_provisionalDocumentLoader ? m_provisionalDocumentLoader->url() : KURL();
+    if (!newURL.isEmpty())
+        PCLOG(" Determining if frame can be cached navigating from (%s) to (%s):", currentURL.string().utf8().data(), newURL.string().utf8().data());
     else
-        setPolicyBaseURL(m_URL);
+        PCLOG(" Determining if subframe with URL (%s) can be cached:", currentURL.string().utf8().data());
+        
+    bool cannotCache = false;
+
+    do {
+        if (!m_documentLoader) {
+            PCLOG("   -There is no DocumentLoader object");
+            cannotCache = true;
+            break;
+        }
+        if (!m_documentLoader->mainDocumentError().isNull())
+            { PCLOG("   -Main document has an error"); cannotCache = true; }
+        if (m_frame->tree()->childCount())
+            { PCLOG("   -Frame has child frames"); cannotCache = true; }
+        if (m_containsPlugIns)
+            { PCLOG("   -Frame contains plugins"); cannotCache = true; }
+        if (m_URL.protocolIs("https"))
+            { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
+        if (m_frame->domWindow() && m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
+            { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
+#if ENABLE(DATABASE)
+        if (m_frame->document()->hasOpenDatabases())
+            { PCLOG("   -Frame has open database handles"); cannotCache = true; }
+#endif
+        if (m_frame->document()->usingGeolocation())
+            { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
+        if (!m_currentHistoryItem)
+            { PCLOG("   -No current history item"); cannotCache = true; }
+        if (m_quickRedirectComing)
+            { PCLOG("   -Quick redirect is coming"); cannotCache = true; }
+        if (m_documentLoader->isLoadingInAPISense())
+            { PCLOG("   -DocumentLoader is still loading in API sense"); cannotCache = true; }
+        if (m_documentLoader->isStopping())
+            { PCLOG("   -DocumentLoader is in the middle of stopping"); cannotCache = true; }
+        if (!m_frame->document()->canSuspendActiveDOMObjects())
+            { PCLOG("   -The document cannot suspect its active DOM Objects"); cannotCache = true; }
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        if (m_documentLoader->applicationCache())
+            { PCLOG("   -The DocumentLoader has an active application cache"); cannotCache = true; }
+        if (m_documentLoader->candidateApplicationCacheGroup())
+            { PCLOG("   -The DocumentLoader has a candidateApplicationCacheGroup"); cannotCache = true; }
+#endif
+        if (!m_client->canCachePage())
+            { PCLOG("   -The client says this frame cannot be cached"); cannotCache = true; }
+    } while (false);
+
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        if (!child->loader()->logCanCacheFrameDecision(indentLevel + 1))
+            cannotCache = true;
+    
+    PCLOG(cannotCache ? " Frame CANNOT be cached" : " Frame CAN be cached");
+    PCLOG("+---");
+
+    return !cannotCache;
+}
+#endif
+
+void FrameLoader::updateFirstPartyForCookies()
+{
+    if (m_frame->tree()->parent())
+        setFirstPartyForCookies(m_frame->tree()->parent()->document()->firstPartyForCookies());
+    else
+        setFirstPartyForCookies(m_URL);
 }
 
-void FrameLoader::setPolicyBaseURL(const KURL& url)
+void FrameLoader::setFirstPartyForCookies(const KURL& url)
 {
-    if (m_frame->document())
-        m_frame->document()->setPolicyBaseURL(url);
+    m_frame->document()->setFirstPartyForCookies(url);
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->setPolicyBaseURL(url);
+        child->loader()->setFirstPartyForCookies(url);
 }
 
 // This does the same kind of work that didOpenURL does, except it relies on the fact
@@ -1979,6 +2055,15 @@ void FrameLoader::scheduleRedirection(ScheduledRedirection* redirection)
 {
     ASSERT(m_frame->page());
 
+    // If a redirect was scheduled during a load, then stop the current load.
+    // Otherwise when the current load transitions from a provisional to a 
+    // committed state, pending redirects may be cancelled. 
+    if (redirection->wasDuringLoad) {
+        if (m_provisionalDocumentLoader)
+            m_provisionalDocumentLoader->stopLoading();
+        stopLoading(true);   
+    }
+
     stopRedirectionTimer();
     m_scheduledRedirection.set(redirection);
     if (!m_isComplete && redirection->type != ScheduledRedirection::redirection)
@@ -1996,14 +2081,17 @@ void FrameLoader::startRedirectionTimer()
     m_redirectionTimer.startOneShot(m_scheduledRedirection->delay);
 
     switch (m_scheduledRedirection->type) {
-        case ScheduledRedirection::redirection:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
+        case ScheduledRedirection::redirection:
             clientRedirected(KURL(m_scheduledRedirection->url),
                 m_scheduledRedirection->delay,
                 currentTime() + m_redirectionTimer.nextFireInterval(),
-                m_scheduledRedirection->lockHistory,
-                m_isExecutingJavaScriptFormAction);
+                m_scheduledRedirection->lockBackForwardList);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // FIXME: It would make sense to report form submissions as client redirects too.
+            // But we didn't do that in the past when form submission used a separate delay
+            // mechanism, so doing it will be a behavior change.
             return;
         case ScheduledRedirection::historyNavigation:
             // Don't report history navigations.
@@ -2021,11 +2109,15 @@ void FrameLoader::stopRedirectionTimer()
 
     if (m_scheduledRedirection) {
         switch (m_scheduledRedirection->type) {
-            case ScheduledRedirection::redirection:
             case ScheduledRedirection::locationChange:
-            case ScheduledRedirection::locationChangeDuringLoad:
+            case ScheduledRedirection::redirection:
                 clientRedirectCancelledOrFinished(m_cancellingWithLoadInProgress);
                 return;
+            case ScheduledRedirection::formSubmission:
+                // FIXME: It would make sense to report form submissions as client redirects too.
+                // But we didn't do that in the past when form submission used a separate delay
+                // mechanism, so doing it will be a behavior change.
+                return;
             case ScheduledRedirection::historyNavigation:
                 // Don't report history navigations.
                 return;
@@ -2041,7 +2133,8 @@ void FrameLoader::completed()
         child->loader()->parentCompleted();
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
-    submitFormAgain();
+    if (m_frame->view())
+        m_frame->view()->setLockedToAnchor(false);
 }
 
 void FrameLoader::started()
@@ -2075,13 +2168,24 @@ void FrameLoader::setupForReplaceByMIMEType(const String& newMIMEType)
     activeDocumentLoader()->setupForReplaceByMIMEType(newMIMEType);
 }
 
-void FrameLoader::loadFrameRequestWithFormAndValues(const FrameLoadRequest& request, bool lockHistory, Event* event,
-    HTMLFormElement* submitForm, const HashMap<String, String>& formValues)
+// This is a hack to allow keep navigation to http/https feeds working. To remove this
+// we need to introduce new API akin to registerURLSchemeAsLocal, that registers a
+// protocols navigation policy.
+static bool isFeedWithNestedProtocolInHTTPFamily(const KURL& url)
 {
-    RefPtr<FormState> formState;
-    if (submitForm)
-        formState = FormState::create(submitForm, formValues, m_frame);
-    
+    const String& urlString = url.string();
+    if (!urlString.startsWith("feed", false))
+        return false;
+
+    return urlString.startsWith("feed://", false) 
+        || urlString.startsWith("feed:http:", false) || urlString.startsWith("feed:https:", false)
+        || urlString.startsWith("feeds:http:", false) || urlString.startsWith("feeds:https:", false)
+        || urlString.startsWith("feedsearch:http:", false) || urlString.startsWith("feedsearch:https:", false);
+}
+
+void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList,
+    PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{    
     KURL url = request.resourceRequest().url();
 
     String referrer;
@@ -2092,7 +2196,7 @@ void FrameLoader::loadFrameRequestWithFormAndValues(const FrameLoadRequest& requ
         referrer = m_outgoingReferrer;
 
     ASSERT(frame()->document());
-    if (url.protocolIs("file")) {
+    if (shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
         if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
@@ -2102,29 +2206,31 @@ void FrameLoader::loadFrameRequestWithFormAndValues(const FrameLoadRequest& requ
     if (shouldHideReferrer(url, referrer))
         referrer = String();
     
-    Frame* targetFrame = findFrameForNavigation(request.frameName());
-
-    if (request.resourceRequest().httpMethod() != "POST") {
-        FrameLoadType loadType;
-        if (request.resourceRequest().cachePolicy() == ReloadIgnoringCacheData)
-            loadType = FrameLoadTypeReload;
-        else if (lockHistory)
-            loadType = FrameLoadTypeRedirectWithLockedHistory;
-        else
-            loadType = FrameLoadTypeStandard;    
-    
-        loadURL(request.resourceRequest().url(), referrer, request.frameName(), loadType, 
-                event, formState.release());
-    } else
-        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), event, formState.release());
+    FrameLoadType loadType;
+    if (request.resourceRequest().cachePolicy() == ReloadIgnoringCacheData)
+        loadType = FrameLoadTypeReload;
+    else if (lockBackForwardList)
+        loadType = FrameLoadTypeRedirectWithLockedBackForwardList;
+    else
+        loadType = FrameLoadTypeStandard;
 
-    if (targetFrame && targetFrame != m_frame)
+    if (request.resourceRequest().httpMethod() == "POST")
+        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
+    else
+        loadURL(request.resourceRequest().url(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
+
+    // FIXME: It's possible this targetFrame will not be the same frame that was targeted by the actual
+    // load if frame names have changed.
+    Frame* sourceFrame = formState ? formState->sourceFrame() : m_frame;
+    Frame* targetFrame = sourceFrame->loader()->findFrameForNavigation(request.frameName());
+    if (targetFrame && targetFrame != sourceFrame) {
         if (Page* page = targetFrame->page())
             page->chrome()->focus();
+    }
 }
 
-void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const String& frameName, FrameLoadType newLoadType,
-    Event* event, PassRefPtr<FormState> prpFormState)
+void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType newLoadType,
+    PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState)
 {
     RefPtr<FormState> formState = prpFormState;
     bool isFormSubmission = formState;
@@ -2141,13 +2247,17 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
 
     ASSERT(newLoadType != FrameLoadTypeSame);
 
+    // The search for a target frame is done earlier in the case of form submission.
+    Frame* targetFrame = isFormSubmission ? 0 : findFrameForNavigation(frameName);
+    if (targetFrame && targetFrame != m_frame) {
+        targetFrame->loader()->loadURL(newURL, referrer, String(), lockHistory, newLoadType, event, formState.release());
+        return;
+    }
+
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
-    if (!frameName.isEmpty()) {
-        if (Frame* targetFrame = findFrameForNavigation(frameName))
-            targetFrame->loader()->loadURL(newURL, referrer, String(), newLoadType, event, formState);
-        else
-            checkNewWindowPolicy(action, request, formState, frameName);
+    if (!targetFrame && !frameName.isEmpty()) {
+        checkNewWindowPolicy(action, request, formState.release(), frameName);
         return;
     }
 
@@ -2161,12 +2271,12 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     if (shouldScrollToAnchor(isFormSubmission, newLoadType, newURL)) {
         oldDocumentLoader->setTriggeringAction(action);
         stopPolicyCheck();
-        checkNavigationPolicy(request, oldDocumentLoader.get(), formState,
+        checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         // must grab this now, since this load may stop the previous load and clear this flag
         bool isRedirect = m_quickRedirectComing;
-        loadWithNavigationAction(request, action, newLoadType, formState);
+        loadWithNavigationAction(request, action, lockHistory, newLoadType, formState.release());
         if (isRedirect) {
             m_quickRedirectComing = false;
             if (m_provisionalDocumentLoader)
@@ -2179,40 +2289,45 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     }
 }
 
-void FrameLoader::load(const ResourceRequest& request)
+void FrameLoader::load(const ResourceRequest& request, bool lockHistory)
 {
-    load(request, SubstituteData());
+    load(request, SubstituteData(), lockHistory);
 }
 
-void FrameLoader::load(const ResourceRequest& request, const SubstituteData& substituteData)
+void FrameLoader::load(const ResourceRequest& request, const SubstituteData& substituteData, bool lockHistory)
 {
     if (m_inStopAllLoaders)
         return;
         
     // FIXME: is this the right place to reset loadType? Perhaps this should be done after loading is finished or aborted.
     m_loadType = FrameLoadTypeStandard;
-    load(m_client->createDocumentLoader(request, substituteData).get());
+    RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, substituteData);
+    if (lockHistory && m_documentLoader)
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
+    load(loader.get());
 }
 
-void FrameLoader::load(const ResourceRequest& request, const String& frameName)
+void FrameLoader::load(const ResourceRequest& request, const String& frameName, bool lockHistory)
 {
     if (frameName.isEmpty()) {
-        load(request);
+        load(request, lockHistory);
         return;
     }
 
     Frame* frame = findFrameForNavigation(frameName);
     if (frame) {
-        frame->loader()->load(request);
+        frame->loader()->load(request, lockHistory);
         return;
     }
 
     checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), request, 0, frameName);
 }
 
-void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, FrameLoadType type, PassRefPtr<FormState> formState)
+void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, bool lockHistory, FrameLoadType type, PassRefPtr<FormState> formState)
 {
     RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, SubstituteData());
+    if (lockHistory && m_documentLoader)
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
 
     loader->setTriggeringAction(action);
     if (m_documentLoader)
@@ -2280,6 +2395,8 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
 
         stopPolicyCheck();
         setPolicyDocumentLoader(loader);
+        if (loader->triggeringAction().isEmpty())
+            loader->setTriggeringAction(NavigationAction(newURL, m_policyLoadType, isFormSubmission));
 
         checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
@@ -2288,18 +2405,22 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
 
 bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Document* doc)
 {
-    // We can always load any URL that isn't considered local (e.g. http URLs)
+    return canLoad(url, referrer, doc ? doc->securityOrigin() : 0);
+}
+
+bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
+{
+    // We can always load any URL that isn't considered local (e.g. http URLs).
     if (!shouldTreatURLAsLocal(url.string()))
         return true;
 
     // If we were provided a document, we let its local file policy dictate the result,
     // otherwise we allow local loads only if the supplied referrer is also local.
-    if (doc)
-        return doc->securityOrigin()->canLoadLocalResources();
-    else if (!referrer.isEmpty())
+    if (securityOrigin)
+        return securityOrigin->canLoadLocalResources();
+    if (!referrer.isEmpty())
         return shouldTreatURLAsLocal(referrer);
-    else
-        return false;
+    return false;
 }
 
 void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
@@ -2407,7 +2528,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     return compareDocumentLoader && unreachableURL == compareDocumentLoader->request().url();
 }
 
-void FrameLoader::reloadAllowingStaleData(const String& encoding)
+void FrameLoader::reloadWithOverrideEncoding(const String& encoding)
 {
     if (!m_documentLoader)
         return;
@@ -2424,7 +2545,7 @@ void FrameLoader::reloadAllowingStaleData(const String& encoding)
 
     loader->setOverrideEncoding(encoding);
 
-    loadWithDocumentLoader(loader.get(), FrameLoadTypeReloadAllowingStaleData, 0);
+    loadWithDocumentLoader(loader.get(), FrameLoadTypeReload, 0);
 }
 
 void FrameLoader::reload(bool endToEndReload)
@@ -2537,8 +2658,11 @@ void FrameLoader::stopLoadingSubframes()
         child->loader()->stopAllLoaders();
 }
 
-void FrameLoader::stopAllLoaders()
+void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 {
+    if (m_unloadEventBeingDispatched)
+        return;
+
     // If this method is called from within this method, infinite recursion can occur (3442218). Avoid this.
     if (m_inStopAllLoaders)
         return;
@@ -2549,9 +2673,9 @@ void FrameLoader::stopAllLoaders()
 
     stopLoadingSubframes();
     if (m_provisionalDocumentLoader)
-        m_provisionalDocumentLoader->stopLoading();
+        m_provisionalDocumentLoader->stopLoading(databasePolicy);
     if (m_documentLoader)
-        m_documentLoader->stopLoading();
+        m_documentLoader->stopLoading(databasePolicy);
 
     setProvisionalDocumentLoader(0);
     
@@ -2607,11 +2731,6 @@ void FrameLoader::setDocumentLoader(DocumentLoader* loader)
     m_documentLoader = loader;
 }
 
-DocumentLoader* FrameLoader::documentLoader() const
-{
-    return m_documentLoader.get();
-}
-
 void FrameLoader::setPolicyDocumentLoader(DocumentLoader* loader)
 {
     if (m_policyDocumentLoader == loader)
@@ -2628,16 +2747,6 @@ void FrameLoader::setPolicyDocumentLoader(DocumentLoader* loader)
     m_policyDocumentLoader = loader;
 }
 
-DocumentLoader* FrameLoader::policyDocumentLoader() const
-{
-    return m_policyDocumentLoader.get();
-}
-   
-DocumentLoader* FrameLoader::provisionalDocumentLoader() const
-{
-    return m_provisionalDocumentLoader.get();
-}
-
 void FrameLoader::setProvisionalDocumentLoader(DocumentLoader* loader)
 {
     ASSERT(!loader || !m_provisionalDocumentLoader);
@@ -2649,11 +2758,6 @@ void FrameLoader::setProvisionalDocumentLoader(DocumentLoader* loader)
     m_provisionalDocumentLoader = loader;
 }
 
-FrameState FrameLoader::state() const
-{
-    return m_state;
-}
-
 double FrameLoader::timeOfLastCompletedLoad()
 {
     return storedTimeOfLastCompletedLoad;
@@ -2690,14 +2794,12 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
 {
     RefPtr<CachedPage> cachedPage = prpCachedPage;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
-    
+
+    LOG(Loading, "WebCoreLoading %s: About to commit provisional load from previous URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
+
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
-    if (canCachePage() && m_client->canCachePage() && !m_currentHistoryItem->isInPageCache()) {
-        if (Document* document = m_frame->document())
-            document->suspendActiveDOMObjects();
-        cachePageForHistoryItem(m_currentHistoryItem.get());
-    }
+    cachePageForHistoryItem(m_currentHistoryItem.get());
     
     if (m_loadType != FrameLoadTypeReplace)
         closeOldDataSources();
@@ -2728,7 +2830,40 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
 
         didOpenURL(url);
     }
-    opened();
+
+    LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
+
+    if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
+        updateHistoryForClientRedirect();
+
+    if (m_documentLoader->isLoadingFromCachedPage()) {
+        m_frame->document()->documentDidBecomeActive();
+        
+        // Force a layout to update view size and thereby update scrollbars.
+        m_client->forceLayout();
+
+        const ResponseVector& responses = m_documentLoader->responses();
+        size_t count = responses.size();
+        for (size_t i = 0; i < count; i++) {
+            const ResourceResponse& response = responses[i];
+            // FIXME: If the WebKit client changes or cancels the request, this is not respected.
+            ResourceError error;
+            unsigned long identifier;
+            ResourceRequest request(response.url());
+            requestFromDelegate(request, identifier, error);
+            // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
+            // However, with today's computers and networking speeds, this won't happen in practice.
+            // Could be an issue with a giant local file.
+            sendRemainingDelegateMessages(identifier, response, static_cast<int>(response.expectedContentLength()), error);
+        }
+        
+        pageCache()->remove(m_currentHistoryItem.get());
+
+        m_documentLoader->setPrimaryLoadComplete(true);
+
+        // FIXME: Why only this frame and not parent frames?
+        checkLoadCompleteForThisFrame();
+    }
 }
 
 void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
@@ -2778,7 +2913,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
                         DocumentLoader* cachedDocumentLoader = cachedPage->documentLoader();
                         ASSERT(cachedDocumentLoader);
                         cachedDocumentLoader->setFrame(m_frame);
-                        m_client->transitionToCommittedFromCachedPage(cachedPage.get());
+                        m_client->transitionToCommittedFromCachedFrame(cachedPage->cachedMainFrame());
                         
                     } else
                         m_client->transitionToCommittedForNewPage();
@@ -2793,11 +2928,6 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             m_client->transitionToCommittedForNewPage();
             break;
 
-        // FIXME - just get rid of this case, and merge FrameLoadTypeReloadAllowingStaleData with the above case
-        case FrameLoadTypeReloadAllowingStaleData:
-            m_client->transitionToCommittedForNewPage();
-            break;
-
         case FrameLoadTypeStandard:
             updateHistoryForStandardLoad();
 #ifndef BUILDING_ON_TIGER
@@ -2809,8 +2939,8 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             m_client->transitionToCommittedForNewPage();
             break;
 
-        case FrameLoadTypeRedirectWithLockedHistory:
-            updateHistoryForRedirectWithLockedHistory();
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
+            updateHistoryForRedirectWithLockedBackForwardList();
             m_client->transitionToCommittedForNewPage();
             break;
 
@@ -2827,9 +2957,9 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
 
     if (m_creatingInitialEmptyDocument)
         return;
-
-    m_committedFirstRealDocumentLoad = true;
     
+    m_committedFirstRealDocumentLoad = true;
+
     // For non-cached HTML pages, these methods are called in FrameLoader::begin.
     if (cachedPage || !m_client->hasHTMLView()) {
         dispatchDidCommitLoad(); 
@@ -2853,7 +2983,7 @@ void FrameLoader::clientRedirectCancelledOrFinished(bool cancelWithLoadInProgres
     m_sentRedirectNotification = false;
 }
 
-void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireDate, bool lockHistory, bool isJavaScriptFormAction)
+void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireDate, bool lockBackForwardList)
 {
     m_client->dispatchWillPerformClientRedirect(url, seconds, fireDate);
     
@@ -2861,10 +2991,11 @@ void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireD
     // the next provisional load, we can send a corresponding -webView:didCancelClientRedirectForFrame:
     m_sentRedirectNotification = true;
     
-    // If a "quick" redirect comes in an, we set a special mode so we treat the next
-    // load as part of the same navigation. If we don't have a document loader, we have
+    // If a "quick" redirect comes in, we set a special mode so we treat the next
+    // load as part of the original navigation. If we don't have a document loader, we have
     // no "original" load on which to base a redirect, so we treat the redirect as a normal load.
-    m_quickRedirectComing = lockHistory && m_documentLoader && !isJavaScriptFormAction;
+    // Loads triggered by JavaScript form submissions never count as quick redirects.
+    m_quickRedirectComing = lockBackForwardList && m_documentLoader && !m_isExecutingJavaScriptFormAction;
 }
 
 #if ENABLE(WML)
@@ -2906,6 +3037,7 @@ void FrameLoader::closeOldDataSources()
 
 void FrameLoader::open(CachedPage& cachedPage)
 {
+    ASSERT(!m_frame->tree()->parent());
     ASSERT(m_frame->page());
     ASSERT(m_frame->page()->mainFrame() == m_frame);
 
@@ -2913,11 +3045,6 @@ void FrameLoader::open(CachedPage& cachedPage)
 
     // We still have to close the previous part page.
     closeURL();
-
-    m_isComplete = false;
-    
-    // Don't re-emit the load event.
-    m_didCallImplicitClose = true;
     
     // Delete old status bar messages (if it _was_ activated on last URL).
     if (m_frame->script()->isEnabled()) {
@@ -2925,9 +3052,21 @@ void FrameLoader::open(CachedPage& cachedPage)
         m_frame->setJSDefaultStatusBarText(String());
     }
 
-    KURL url = cachedPage.url();
+    open(*cachedPage.cachedMainFrame());
 
-    if ((url.protocolIs("http") || url.protocolIs("https")) && !url.host().isEmpty() && url.path().isEmpty())
+    checkCompleted();
+}
+
+void FrameLoader::open(CachedFrame& cachedFrame)
+{
+    m_isComplete = false;
+    
+    // Don't re-emit the load event.
+    m_didCallImplicitClose = true;
+
+    KURL url = cachedFrame.url();
+
+    if (url.protocolInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
         url.setPath("/");
     
     m_URL = url;
@@ -2937,7 +3076,7 @@ void FrameLoader::open(CachedPage& cachedPage)
 
     clear();
 
-    Document* document = cachedPage.document();
+    Document* document = cachedFrame.document();
     ASSERT(document);
     document->setInPageCache(false);
 
@@ -2946,28 +3085,24 @@ void FrameLoader::open(CachedPage& cachedPage)
     m_didCallImplicitClose = false;
     m_outgoingReferrer = url.string();
 
-    FrameView* view = cachedPage.view();
+    FrameView* view = cachedFrame.view();
+    
+    // When navigating to a CachedFrame its FrameView should never be null.  If it is we'll crash in creative ways downstream.
+    ASSERT(view);
     if (view)
         view->setWasScrolledByUser(false);
     m_frame->setView(view);
     
     m_frame->setDocument(document);
-    m_frame->setDOMWindow(cachedPage.domWindow());
+    m_frame->setDOMWindow(cachedFrame.domWindow());
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
     m_decoder = document->decoder();
 
-    updatePolicyBaseURL();
-
-    cachedPage.restore(m_frame->page());
-    document->resumeActiveDOMObjects();
+    updateFirstPartyForCookies();
 
-    // It is necessary to update any platform script objects after restoring the
-    // cached page.
-    m_frame->script()->updatePlatformScriptObjects();
-
-    checkCompleted();
+    cachedFrame.restore();
 }
 
 bool FrameLoader::isStopping() const
@@ -3060,7 +3195,17 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     
     ArchiveResource* mainResource = archive->mainResource();
     loader->setParsedArchiveData(mainResource->data());
-    continueLoadWithData(mainResource->data(), mainResource->mimeType(), mainResource->textEncoding(), mainResource->url());
+
+    m_responseMIMEType = mainResource->mimeType();
+    didOpenURL(mainResource->url());
+
+    String userChosenEncoding = documentLoader()->overrideEncoding();
+    bool encodingIsUserChosen = !userChosenEncoding.isNull();
+    setEncoding(encodingIsUserChosen ? userChosenEncoding : mainResource->textEncoding(), encodingIsUserChosen);
+
+    ASSERT(m_frame->document());
+
+    addData(mainResource->data()->data(), mainResource->data()->size());
 }
 
 bool FrameLoader::isReplacing() const
@@ -3103,20 +3248,28 @@ FrameLoadType FrameLoader::loadType() const
     return m_loadType;
 }
     
-CachePolicy FrameLoader::cachePolicy() const
+CachePolicy FrameLoader::subresourceCachePolicy() const
 {
     if (m_isComplete)
         return CachePolicyVerify;
-    
+
     if (m_loadType == FrameLoadTypeReloadFromOrigin)
         return CachePolicyReload;
-    
+
     if (Frame* parentFrame = m_frame->tree()->parent()) {
-        CachePolicy parentCachePolicy = parentFrame->loader()->cachePolicy();
+        CachePolicy parentCachePolicy = parentFrame->loader()->subresourceCachePolicy();
         if (parentCachePolicy != CachePolicyVerify)
             return parentCachePolicy;
     }
 
+    // FIXME: POST documents are always Reloads, but their subresources should still be Revalidate.
+    // If we bring the CachePolicy.h and ResourceRequest cache policy enums in sync with each other and
+    // remember "Revalidate" in ResourceRequests, we can remove this "POST" check and return either "Reload" 
+    // or "Revalidate" if the DocumentLoader was requested with either.
+    const ResourceRequest& request(documentLoader()->request());
+    if (request.cachePolicy() == ReloadIgnoringCacheData && !equalIgnoringCase(request.httpMethod(), "post"))
+        return CachePolicyRevalidate;
+
     if (m_loadType == FrameLoadTypeReload)
         return CachePolicyRevalidate;
 
@@ -3156,7 +3309,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                     item = m_currentHistoryItem;
                 
             bool shouldReset = true;
-            if (!pdl->isLoadingInAPISense()) {
+            if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
                 m_delegateIsHandlingProvisionalLoadError = true;
                 m_client->dispatchDidFailProvisionalLoad(error);
                 m_delegateIsHandlingProvisionalLoadError = false;
@@ -3188,7 +3341,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
         
         case FrameStateCommittedPage: {
             DocumentLoader* dl = m_documentLoader.get();            
-            if (!dl || dl->isLoadingInAPISense())
+            if (!dl || (dl->isLoadingInAPISense() && !dl->isStopping()))
                 return;
 
             markLoadComplete();
@@ -3222,9 +3375,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
         }
         
         case FrameStateComplete:
-            // Even if already complete, we might have set a previous item on a frame that
-            // didn't do any data loading on the past transaction. Make sure to clear these out.
-            m_client->frameLoadCompleted();
+            frameLoadCompleted();
             return;
     }
 
@@ -3285,8 +3436,14 @@ void FrameLoader::didFirstVisuallyNonEmptyLayout()
 
 void FrameLoader::frameLoadCompleted()
 {
+    // Note: Can be called multiple times.
+
     m_client->frameLoadCompleted();
 
+    // Even if already complete, we might have set a previous item on a frame that
+    // didn't do any data loading on the past transaction. Make sure to clear these out.
+    m_previousHistoryItem = 0;
+
     // After a canceled provisional load, firstLayoutDone is false.
     // Reset it to true if we're displaying a page.
     if (m_documentLoader)
@@ -3298,11 +3455,6 @@ bool FrameLoader::firstLayoutDone() const
     return m_firstLayoutDone;
 }
 
-bool FrameLoader::isQuickRedirectComing() const
-{
-    return m_quickRedirectComing;
-}
-
 void FrameLoader::detachChildren()
 {
     // FIXME: Is it really necessary to do this in reverse order?
@@ -3313,6 +3465,18 @@ void FrameLoader::detachChildren()
     }
 }
 
+void FrameLoader::closeAndRemoveChild(Frame* child)
+{
+    child->tree()->detachFromParent();
+
+    child->setView(0);
+    if (child->ownerElement())
+        child->page()->decrementFrameCount();
+    child->pageDestroyed();
+
+    m_frame->tree()->removeChild(child);
+}
+
 void FrameLoader::recursiveCheckLoadComplete()
 {
     Vector<RefPtr<Frame>, 10> frames;
@@ -3349,36 +3513,6 @@ int FrameLoader::numPendingOrLoadingRequests(bool recurse) const
     return count;
 }
 
-FrameLoaderClient* FrameLoader::client() const
-{
-    return m_client;
-}
-
-void FrameLoader::submitForm(const FrameLoadRequest& request, Event* event)
-{
-    // FIXME: We'd like to remove this altogether and fix the multiple form submission issue another way.
-    // We do not want to submit more than one form from the same page,
-    // nor do we want to submit a single form more than once.
-    // This flag prevents these from happening; not sure how other browsers prevent this.
-    // The flag is reset in each time we start handle a new mouse or key down event, and
-    // also in setView since this part may get reused for a page from the back/forward cache.
-    // The form multi-submit logic here is only needed when we are submitting a form that affects this frame.
-    // FIXME: Frame targeting is only one of the ways the submission could end up doing something other
-    // than replacing this frame's content, so this check is flawed. On the other hand, the check is hardly
-    // needed any more now that we reset m_submittedFormURL on each mouse or key down event.
-    Frame* target = m_frame->tree()->find(request.frameName());
-    if (m_frame->tree()->isDescendantOf(target)) {
-        if (m_submittedFormURL == request.resourceRequest().url())
-            return;
-        m_submittedFormURL = request.resourceRequest().url();
-    }
-
-    // FIXME: We should probably call userGestureHint() to tell whether this form submission was the result of a user gesture.
-    loadFrameRequestWithFormAndValues(request, false, event, m_formAboutToBeSubmitted.get(), m_formValuesAboutToBeSubmitted);
-
-    clearRecordedFormValues();
-}
-
 String FrameLoader::userAgent(const KURL& url) const
 {
     return m_client->userAgent(url);
@@ -3386,9 +3520,6 @@ String FrameLoader::userAgent(const KURL& url) const
 
 void FrameLoader::tokenizerProcessedData()
 {
-//    ASSERT(m_frame->page());
-//    ASSERT(m_frame->document());
-
     checkCompleted();
 }
 
@@ -3400,8 +3531,7 @@ void FrameLoader::handledOnloadEvents()
 void FrameLoader::frameDetached()
 {
     stopAllLoaders();
-    if (Document* document = m_frame->document())
-        document->stopActiveDOMObjects();
+    m_frame->document()->stopActiveDOMObjects();
     detachFromParent();
 }
 
@@ -3421,7 +3551,7 @@ void FrameLoader::detachFromParent()
     setDocumentLoader(0);
     m_client->detachedFromParent3();
     if (Frame* parent = m_frame->tree()->parent()) {
-        parent->tree()->removeChild(m_frame);
+        parent->loader()->closeAndRemoveChild(m_frame);
         parent->loader()->scheduleCheckCompleted();
     } else {
         m_frame->setView(0);
@@ -3441,6 +3571,19 @@ void FrameLoader::addExtraFieldsToMainResourceRequest(ResourceRequest& request)
 
 void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadType loadType, bool mainResource, bool cookiePolicyURLFromRequest)
 {
+    // Don't set the cookie policy URL if it's already been set.
+    // But make sure to set it on all requests, as it has significance beyond the cookie policy for all protocols (<rdar://problem/6616664>).
+    if (request.firstPartyForCookies().isEmpty()) {
+        if (mainResource && (isLoadingMainFrame() || cookiePolicyURLFromRequest))
+            request.setFirstPartyForCookies(request.url());
+        else if (Document* document = m_frame->document())
+            request.setFirstPartyForCookies(document->firstPartyForCookies());
+    }
+
+    // The remaining modifications are only necessary for HTTP and HTTPS.
+    if (!request.url().isEmpty() && !request.url().protocolInHTTPFamily())
+        return;
+
     applyUserAgent(request);
     
     if (loadType == FrameLoadTypeReload) {
@@ -3452,16 +3595,8 @@ void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadTyp
         request.setHTTPHeaderField("Pragma", "no-cache");
     }
     
-    // Don't set the cookie policy URL if it's already been set.
-    if (request.mainDocumentURL().isEmpty()) {
-        if (mainResource && (isLoadingMainFrame() || cookiePolicyURLFromRequest))
-            request.setMainDocumentURL(request.url());
-        else if (Page* page = m_frame->page())
-            request.setMainDocumentURL(page->mainFrame()->loader()->url());
-    }
-    
     if (mainResource)
-        request.setHTTPAccept("application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5");
+        request.setHTTPAccept(defaultAcceptHeader);
 
     // Make sure we send the Origin header.
     addHTTPOriginIfNeeded(request, String());
@@ -3505,8 +3640,7 @@ void FrameLoader::committedLoad(DocumentLoader* loader, const char* data, int le
     m_client->committedLoad(loader, data, length);
 }
 
-void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName,
-    Event* event, PassRefPtr<FormState> prpFormState)
+void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType loadType, PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState)
 {
     RefPtr<FormState> formState = prpFormState;
 
@@ -3533,29 +3667,22 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
     workingResourceRequest.setHTTPMethod("POST");
     workingResourceRequest.setHTTPBody(formData);
     workingResourceRequest.setHTTPContentType(contentType);
-    addExtraFieldsToRequest(workingResourceRequest, FrameLoadTypeStandard, true, true);
+    addExtraFieldsToRequest(workingResourceRequest, loadType, true, true);
 
-    NavigationAction action(url, FrameLoadTypeStandard, true, event);
+    NavigationAction action(url, loadType, true, event);
 
     if (!frameName.isEmpty()) {
-        if (Frame* targetFrame = findFrameForNavigation(frameName))
-            targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, FrameLoadTypeStandard, formState.release());
+        // The search for a target frame is done earlier in the case of form submission.
+        if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName))
+            targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
         else
             checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName);
     } else
-        loadWithNavigationAction(workingResourceRequest, action, FrameLoadTypeStandard, formState.release());    
+        loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
 }
 
-void FrameLoader::loadEmptyDocumentSynchronously()
+unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
-    ResourceRequest request(KURL(""));
-    load(request);
-}
-
-unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data)
-{
-    // Since this is a subresource, we can load any URL (we ignore the return value).
-    // But we still want to know whether we should hide the referrer or not, so we call the canLoad method.
     String referrer = m_outgoingReferrer;
     if (shouldHideReferrer(request.url(), referrer))
         referrer = String();
@@ -3573,7 +3700,7 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
     addHTTPOriginIfNeeded(initialRequest, outgoingOrigin());
 
     if (Page* page = m_frame->page())
-        initialRequest.setMainDocumentURL(page->mainFrame()->loader()->documentLoader()->request().url());
+        initialRequest.setFirstPartyForCookies(page->mainFrame()->loader()->documentLoader()->request().url());
     initialRequest.setHTTPUserAgent(client()->userAgent(request.url()));
 
     unsigned long identifier = 0;    
@@ -3593,7 +3720,7 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
                 error = cannotShowURLError(newRequest);
         } else {
 #endif
-            ResourceHandle::loadResourceSynchronously(newRequest, error, response, data, m_frame);
+            ResourceHandle::loadResourceSynchronously(newRequest, storedCredentials, error, response, data, m_frame);
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
             // If normal loading results in a redirect to a resource with another origin (indicative of a captive portal), or a 4xx or 5xx status code or equivalent,
@@ -3651,6 +3778,11 @@ void FrameLoader::didFailToLoad(ResourceLoader* loader, const ResourceError& err
         m_client->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
 }
 
+void FrameLoader::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
+{
+    m_client->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+}
+
 const ResourceRequest& FrameLoader::originalRequest() const
 {
     return activeDocumentLoader()->originalRequestCopy();
@@ -3672,8 +3804,8 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
     }
     
     if (m_state == FrameStateProvisional && m_provisionalDocumentLoader) {
-        KURL failedURL = m_provisionalDocumentLoader->originalRequestCopy().url();
-        didNotOpenURL(failedURL);
+        if (m_submittedFormURL == m_provisionalDocumentLoader->originalRequestCopy().url())
+            m_submittedFormURL = KURL();
             
         // We might have made a page cache item, but now we're bailing out due to an error before we ever
         // transitioned to the new page (before WebFrameState == commit).  The goal here is to restore any state
@@ -3702,10 +3834,7 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    // FIXME:
-    // some functions check m_quickRedirectComing, and others check for
-    // FrameLoadTypeRedirectWithLockedHistory.  
-    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedHistory;
+    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
@@ -3758,42 +3887,7 @@ bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType load
         && !shouldReload(this->url(), url)
         // We don't want to just scroll if a link from within a
         // frameset is trying to reload the frameset into _top.
-        && !m_frame->isFrameSet();
-}
-
-void FrameLoader::opened()
-{
-    if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
-        updateHistoryForClientRedirect();
-
-    if (m_documentLoader->isLoadingFromCachedPage()) {
-        m_frame->document()->documentDidBecomeActive();
-        
-        // Force a layout to update view size and thereby update scrollbars.
-        m_client->forceLayout();
-
-        const ResponseVector& responses = m_documentLoader->responses();
-        size_t count = responses.size();
-        for (size_t i = 0; i < count; i++) {
-            const ResourceResponse& response = responses[i];
-            // FIXME: If the WebKit client changes or cancels the request, this is not respected.
-            ResourceError error;
-            unsigned long identifier;
-            ResourceRequest request(response.url());
-            requestFromDelegate(request, identifier, error);
-            // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
-            // However, with today's computers and networking speeds, this won't happen in practice.
-            // Could be an issue with a giant local file.
-            sendRemainingDelegateMessages(identifier, response, static_cast<int>(response.expectedContentLength()), error);
-        }
-        
-        pageCache()->remove(m_currentHistoryItem.get());
-
-        m_documentLoader->setPrimaryLoadComplete(true);
-
-        // FIXME: Why only this frame and not parent frames?
-        checkLoadCompleteForThisFrame();
-    }
+        && !m_frame->document()->isFrameSet();
 }
 
 void FrameLoader::checkNewWindowPolicy(const NavigationAction& action, const ResourceRequest& request,
@@ -3944,7 +4038,14 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     // might detach the current FrameLoader, in which case we should bail on this newly defunct load. 
     if (!m_frame->page())
         return;
-        
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (Page* page = m_frame->page()) {
+        if (page->mainFrame() == m_frame)
+            page->inspectorController()->resumeDebugger();
+    }
+#endif
+
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     m_loadType = type;
     setState(FrameStateProvisional);
@@ -3985,7 +4086,7 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
     mainFrame->loader()->setOpenedByDOM();
     mainFrame->loader()->m_client->dispatchShow();
     mainFrame->loader()->setOpener(frame.get());
-    mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), FrameLoadTypeStandard, formState);
+    mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), false, FrameLoadTypeStandard, formState);
 }
 
 void FrameLoader::sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
@@ -4059,6 +4160,24 @@ void FrameLoader::applyUserAgent(ResourceRequest& request)
     request.setHTTPUserAgent(userAgent);
 }
 
+bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, const KURL& url)
+{
+    Frame* topFrame = m_frame->tree()->top();
+    if (m_frame == topFrame)
+        return false;
+
+    if (equalIgnoringCase(content, "deny"))
+        return true;
+
+    if (equalIgnoringCase(content, "sameorigin")) {
+        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
+        if (!origin->isSameSchemeHostPort(topFrame->document()->securityOrigin()))
+            return true;
+    }
+
+    return false;
+}
+
 bool FrameLoader::canGoBackOrForward(int distance) const
 {
     if (Page* page = m_frame->page()) {
@@ -4079,28 +4198,6 @@ int FrameLoader::getHistoryLength()
     return 0;
 }
 
-KURL FrameLoader::historyURL(int distance)
-{
-    if (Page* page = m_frame->page()) {
-        BackForwardList* list = page->backForwardList();
-        HistoryItem* item = list->itemAtIndex(distance);
-        if (!item) {
-            if (distance > 0) {
-                int forwardListCount = list->forwardListCount();
-                if (forwardListCount > 0)
-                    item = list->itemAtIndex(forwardListCount);
-            } else {
-                int backListCount = list->backListCount();
-                if (backListCount > 0)
-                    item = list->itemAtIndex(-backListCount);
-            }
-        }
-        if (item)
-            return item->url();
-    }
-    return KURL();
-}
-
 void FrameLoader::addHistoryItemForFragmentScroll()
 {
     addBackForwardItemClippedAtTarget(false);
@@ -4117,12 +4214,11 @@ bool FrameLoader::loadProvisionalItemFromCachedPage()
 
 void FrameLoader::cachePageForHistoryItem(HistoryItem* item)
 {
+    if (!canCachePage() || item->isInPageCache())
+        return;
+
     if (Page* page = m_frame->page()) {
         RefPtr<CachedPage> cachedPage = CachedPage::create(page);
-        cachedPage->setTimeStampToNow();
-        cachedPage->setDocumentLoader(documentLoader());
-        m_client->savePlatformDataToCachedPage(cachedPage.get());
-
         pageCache()->add(item, cachedPage.release());
     }
 }
@@ -4193,6 +4289,11 @@ PassRefPtr<HistoryItem> FrameLoader::createHistoryItem(bool useOriginal)
 
 void FrameLoader::addBackForwardItemClippedAtTarget(bool doClip)
 {
+    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
+    // The item that was the target of the user's navigation is designated as the "targetItem".  
+    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
+    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
+
     Page* page = m_frame->page();
     if (!page)
         return;
@@ -4242,9 +4343,9 @@ PassRefPtr<HistoryItem> FrameLoader::createHistoryItemTree(Frame* targetFrame, b
 Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
 {
     Frame* frame = m_frame->tree()->find(name);
-    if (shouldAllowNavigation(frame))
-        return frame;  
-    return 0;
+    if (!shouldAllowNavigation(frame))
+        return 0;  
+    return frame;
 }
 
 void FrameLoader::saveScrollPositionAndViewStateToItem(HistoryItem* item)
@@ -4334,7 +4435,7 @@ void FrameLoader::saveDocumentState()
     Document* document = m_frame->document();
     ASSERT(document);
     
-    if (document && item->isCurrentDocument(document)) {
+    if (item->isCurrentDocument(document)) {
         LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
         item->setDocumentState(document->formElementsState());
     }
@@ -4357,13 +4458,16 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     // Note if we have child frames we do a real reload, since the child frames might not
     // match our current frame structure, or they might not have the right content.  We could
     // check for all that as an additional optimization.
-    // We also do not do anchor-style navigation if we're posting a form.
-    
+    // We also do not do anchor-style navigation if we're posting a form or navigating from
+    // a page that was resulted from a form post.
+    bool shouldScroll = !formData && !(m_currentHistoryItem && m_currentHistoryItem->formData()) && urlsMatchItem(item);
+
 #if ENABLE(WML)
-    if (!formData && urlsMatchItem(item) && !m_frame->document()->isWMLDocument()) {
-#else
-    if (!formData && urlsMatchItem(item)) {
+    if (m_frame->document()->isWMLDocument())
+        shouldScroll = false;
 #endif
+
+    if (shouldScroll) {
         // Must do this maintenance here, since we don't go through a real page reload
         saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
 
@@ -4417,6 +4521,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
             bool addedExtraFields = false;
             ResourceRequest request(itemURL);
 
+            if (!item->referrer().isNull())
+                request.setHTTPReferrer(item->referrer());
+            
             // If this was a repost that failed the page cache, we might try to repost the form.
             NavigationAction action;
             if (formData) {
@@ -4424,10 +4531,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                 formData->generateFiles(m_frame->page()->chrome()->client());
 
                 request.setHTTPMethod("POST");
-                request.setHTTPReferrer(item->formReferrer());
                 request.setHTTPBody(formData);
                 request.setHTTPContentType(item->formContentType());
-                RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->formReferrer());
+                RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
                 addHTTPOriginIfNeeded(request, securityOrigin->toString());
         
                 // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
@@ -4462,12 +4568,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                             request.setCachePolicy(ReturnCacheDataElseLoad);
                         break;
                     case FrameLoadTypeStandard:
-                    case FrameLoadTypeRedirectWithLockedHistory:
-                        // no-op: leave as protocol default
-                        // FIXME:  I wonder if we ever hit this case
+                    case FrameLoadTypeRedirectWithLockedBackForwardList:
                         break;
                     case FrameLoadTypeSame:
-                    case FrameLoadTypeReloadAllowingStaleData:
                     default:
                         ASSERT_NOT_REACHED();
                 }
@@ -4478,7 +4581,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
             if (!addedExtraFields)
                 addExtraFieldsToRequest(request, m_loadType, true, formData);
 
-            loadWithNavigationAction(request, action, loadType, 0);
+            loadWithNavigationAction(request, action, false, loadType, 0);
         }
     }
 }
@@ -4575,10 +4678,10 @@ void FrameLoader::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, Fr
         
         int size = childItems.size();
         for (int i = 0; i < size; ++i) {
-            String childName = childItems[i]->target();
-            HistoryItem* fromChildItem = fromItem->childItemWithName(childName);
+            String childFrameName = childItems[i]->target();
+            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
             ASSERT(fromChildItem || fromItem->isTargetItem());
-            Frame* childFrame = m_frame->tree()->child(childName);
+            Frame* childFrame = m_frame->tree()->child(childFrameName);
             ASSERT(childFrame);
             childFrame->loader()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
         }
@@ -4596,9 +4699,10 @@ bool FrameLoader::childFramesMatchItem(HistoryItem* item) const
         return false;
     
     unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i)
+    for (unsigned i = 0; i < size; ++i) {
         if (!m_frame->tree()->child(childItems[i]->target()))
             return false;
+    }
     
     // Found matches for all item targets
     return true;
@@ -4618,21 +4722,15 @@ void FrameLoader::updateHistoryForStandardLoad()
     bool needPrivacy = !settings || settings->privateBrowsingEnabled();
     const KURL& historyURL = documentLoader()->urlForHistory();
 
-    // If the navigation occured during load and this is a subframe, update the current
-    // back/forward item rather than adding a new one and don't add the new URL to global
-    // history at all. But do add it to visited links. <rdar://problem/5333496>
-    bool frameNavigationDuringLoad = false;
-    if (m_navigationDuringLoad) {
-        HTMLFrameOwnerElement* owner = m_frame->ownerElement();
-        frameNavigationDuringLoad = owner && !owner->createdByParser();
-        m_navigationDuringLoad = false;
-    }
-
-    if (!frameNavigationDuringLoad && !documentLoader()->isClientRedirect()) {
+    if (!documentLoader()->isClientRedirect()) {
         if (!historyURL.isEmpty()) {
             addBackForwardItemClippedAtTarget(true);
-            if (!needPrivacy)
+            if (!needPrivacy) {
                 m_client->updateGlobalHistory();
+                m_documentLoader->setDidCreateGlobalHistoryEntry(true);
+                if (m_documentLoader->unreachableURL().isEmpty())
+                    m_client->updateGlobalHistoryRedirectLinks();
+            }
             if (Page* page = m_frame->page())
                 page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
         }
@@ -4644,6 +4742,9 @@ void FrameLoader::updateHistoryForStandardLoad()
     if (!historyURL.isEmpty() && !needPrivacy) {
         if (Page* page = m_frame->page())
             page->group().addVisitedLink(historyURL);
+
+        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
+            m_client->updateGlobalHistoryRedirectLinks();
     }
 }
 
@@ -4701,11 +4802,11 @@ void FrameLoader::updateHistoryForReload()
     }
 }
 
-void FrameLoader::updateHistoryForRedirectWithLockedHistory()
+void FrameLoader::updateHistoryForRedirectWithLockedBackForwardList()
 {
 #if !LOG_DISABLED
     if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for internal load in frame %s", documentLoader()->title().utf8().data());
+        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", documentLoader()->title().utf8().data());
 #endif
     
     Settings* settings = m_frame->settings();
@@ -4714,10 +4815,14 @@ void FrameLoader::updateHistoryForRedirectWithLockedHistory()
 
     if (documentLoader()->isClientRedirect()) {
         if (!m_currentHistoryItem && !m_frame->tree()->parent()) {
-            addBackForwardItemClippedAtTarget(true);
             if (!historyURL.isEmpty()) {
-                if (!needPrivacy)
+                addBackForwardItemClippedAtTarget(true);
+                if (!needPrivacy) {
                     m_client->updateGlobalHistory();
+                    m_documentLoader->setDidCreateGlobalHistoryEntry(true);
+                    if (m_documentLoader->unreachableURL().isEmpty())
+                        m_client->updateGlobalHistoryRedirectLinks();
+                }
                 if (Page* page = m_frame->page())
                     page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
             }
@@ -4729,12 +4834,15 @@ void FrameLoader::updateHistoryForRedirectWithLockedHistory()
     } else {
         Frame* parentFrame = m_frame->tree()->parent();
         if (parentFrame && parentFrame->loader()->m_currentHistoryItem)
-            parentFrame->loader()->m_currentHistoryItem->addChildItem(createHistoryItem(true));
+            parentFrame->loader()->m_currentHistoryItem->setChildItem(createHistoryItem(true));
     }
 
     if (!historyURL.isEmpty() && !needPrivacy) {
         if (Page* page = m_frame->page())
             page->group().addVisitedLink(historyURL);
+
+        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
+            m_client->updateGlobalHistoryRedirectLinks();
     }
 }
 
@@ -4784,38 +4892,16 @@ void FrameLoader::saveDocumentAndScrollState()
     }
 }
 
-// FIXME: These 6 setter/getters are here for a dwindling number of users in WebKit, WebFrame
-// being the primary one.  After they're no longer needed there, they can be removed!
 HistoryItem* FrameLoader::currentHistoryItem()
 {
     return m_currentHistoryItem.get();
 }
 
-HistoryItem* FrameLoader::previousHistoryItem()
-{
-    return m_previousHistoryItem.get();
-}
-
-HistoryItem* FrameLoader::provisionalHistoryItem()
-{
-    return m_provisionalHistoryItem.get();
-}
-
 void FrameLoader::setCurrentHistoryItem(PassRefPtr<HistoryItem> item)
 {
     m_currentHistoryItem = item;
 }
 
-void FrameLoader::setPreviousHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_previousHistoryItem = item;
-}
-
-void FrameLoader::setProvisionalHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_provisionalHistoryItem = item;
-}
-
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
 {
     m_client->setMainDocumentError(loader, error);
@@ -4982,6 +5068,11 @@ String FrameLoader::referrer() const
     return documentLoader()->request().httpReferrer();
 }
 
+void FrameLoader::dispatchDocumentElementAvailable()
+{
+    m_client->documentElementAvailable();
+}
+
 void FrameLoader::dispatchWindowObjectAvailable()
 {
     if (!m_frame->script()->isEnabled() || !m_frame->script()->haveWindowShell())
@@ -4997,27 +5088,39 @@ void FrameLoader::dispatchWindowObjectAvailable()
     }
 }
 
-Widget* FrameLoader::createJavaAppletWidget(const IntSize& size, Element* element, const HashMap<String, String>& args)
+Widget* FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
 {
     String baseURLString;
+    String codeBaseURLString;
     Vector<String> paramNames;
     Vector<String> paramValues;
     HashMap<String, String>::const_iterator end = args.end();
     for (HashMap<String, String>::const_iterator it = args.begin(); it != end; ++it) {
         if (equalIgnoringCase(it->first, "baseurl"))
             baseURLString = it->second;
+        else if (equalIgnoringCase(it->first, "codebase"))
+            codeBaseURLString = it->second;
         paramNames.append(it->first);
         paramValues.append(it->second);
     }
-    
+
+    if (!codeBaseURLString.isEmpty()) {
+        KURL codeBaseURL = completeURL(codeBaseURLString);
+        if (!canLoad(codeBaseURL, String(), element->document())) {
+            FrameLoader::reportLocalLoadFailed(m_frame, codeBaseURL.string());
+            return 0;
+        }
+    }
+
     if (baseURLString.isEmpty())
         baseURLString = m_frame->document()->baseURL().string();
     KURL baseURL = completeURL(baseURLString);
 
     Widget* widget = m_client->createJavaAppletWidget(size, element, baseURL, paramNames, paramValues);
-    if (widget)
-        m_containsPlugIns = true;
-    
+    if (!widget)
+        return 0;
+
+    m_containsPlugIns = true;
     return widget;
 }
 
@@ -5037,24 +5140,6 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
     }
 }
 
-void FrameLoader::continueLoadWithData(SharedBuffer* buffer, const String& mimeType, const String& textEncoding, const KURL& url)
-{
-    m_responseMIMEType = mimeType;
-    didOpenURL(url);
-
-    String encoding;
-    if (m_frame)
-        encoding = documentLoader()->overrideEncoding();
-    bool userChosen = !encoding.isNull();
-    if (encoding.isNull())
-        encoding = textEncoding;
-    setEncoding(encoding, userChosen);
-
-    ASSERT(m_frame->document());
-
-    addData(buffer->data(), buffer->size());
-}
-
 void FrameLoader::registerURLSchemeAsLocal(const String& scheme)
 {
     localSchemes().add(scheme);
@@ -5080,7 +5165,7 @@ bool FrameLoader::shouldTreatURLAsLocal(const String& url)
     return localSchemes().contains(scheme);
 }
 
-bool FrameLoader::shouldTreatSchemeAsLocal(const String& scheme)
+bool FrameLoader::shouldTreatURLSchemeAsLocal(const String& scheme)
 {
     // This avoids an allocation of another String and the HashSet contains()
     // call for the file: and http: schemes.
@@ -5098,6 +5183,16 @@ bool FrameLoader::shouldTreatSchemeAsLocal(const String& scheme)
     return localSchemes().contains(scheme);
 }
 
+void FrameLoader::registerURLSchemeAsNoAccess(const String& scheme)
+{
+    noAccessSchemes().add(scheme);
+}
+
+bool FrameLoader::shouldTreatURLSchemeAsNoAccess(const String& scheme)
+{
+    return noAccessSchemes().contains(scheme);
+}
+
 void FrameLoader::dispatchDidCommitLoad()
 {
     if (m_creatingInitialEmptyDocument)
@@ -5129,7 +5224,7 @@ void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long
     m_client->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
 
     // If the URL changed, then we want to put that new URL in the "did tell client" set too.
-    if (oldRequestURL != request.url().string().impl())
+    if (!request.isNull() && oldRequestURL != request.url().string().impl())
         m_documentLoader->didTellClientAboutLoad(request.url());
 
     if (Page* page = m_frame->page())
@@ -5187,124 +5282,9 @@ void FrameLoader::tellClientAboutPastMemoryCacheLoads()
     }
 }
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-
-bool FrameLoader::addLowBandwidthDisplayRequest(CachedResource* cache)
-{
-    if (m_frame->document()->inLowBandwidthDisplay() == false)
-        return false;
-        
-    // if cache is loaded, don't add to the list, where notifyFinished() is expected. 
-    if (cache->isLoaded())
-        return false;
-                
-    switch (cache->type()) {
-        case CachedResource::CSSStyleSheet:
-        case CachedResource::Script:
-            m_needToSwitchOutLowBandwidthDisplay = true;
-            m_externalRequestsInLowBandwidthDisplay.add(cache);
-            cache->addClient(this);
-            return true;
-        case CachedResource::ImageResource:
-        case CachedResource::FontResource:
-#if ENABLE(XSLT)
-        case CachedResource::XSLStyleSheet:
-#endif
-#if ENABLE(XBL)
-        case CachedResource::XBLStyleSheet:
-#endif
-            return false;
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-void FrameLoader::removeAllLowBandwidthDisplayRequests()
-{
-    HashSet<CachedResource*>::iterator end = m_externalRequestsInLowBandwidthDisplay.end();
-    for (HashSet<CachedResource*>::iterator it = m_externalRequestsInLowBandwidthDisplay.begin(); it != end; ++it)
-        (*it)->removeClient(this);
-    m_externalRequestsInLowBandwidthDisplay.clear();
-}
-    
-void FrameLoader::notifyFinished(CachedResource* script)
-{
-    HashSet<CachedResource*>::iterator it = m_externalRequestsInLowBandwidthDisplay.find(script);
-    if (it != m_externalRequestsInLowBandwidthDisplay.end()) {
-        (*it)->removeClient(this);
-        m_externalRequestsInLowBandwidthDisplay.remove(it);
-        switchOutLowBandwidthDisplayIfReady();        
-    }
-}
-
-void FrameLoader::switchOutLowBandwidthDisplayIfReady()
+bool FrameLoaderClient::hasHTMLView() const
 {
-    RefPtr<Document> oldDoc = m_frame->document();
-    if (oldDoc->inLowBandwidthDisplay()) {
-        if (!m_needToSwitchOutLowBandwidthDisplay) {
-            // no need to switch, just reset state
-            oldDoc->setLowBandwidthDisplay(false);
-            removeAllLowBandwidthDisplayRequests();        
-            m_pendingSourceInLowBandwidthDisplay = String();
-            m_finishedParsingDuringLowBandwidthDisplay = false;
-            return;
-        } else if (m_externalRequestsInLowBandwidthDisplay.isEmpty() || 
-            m_pendingSourceInLowBandwidthDisplay.length() > cMaxPendingSourceLengthInLowBandwidthDisplay) {
-            // clear the flag first
-            oldDoc->setLowBandwidthDisplay(false);
-            
-            // similar to clear(), should be refactored to share more code
-            oldDoc->cancelParsing();
-            oldDoc->detach();
-            if (m_frame->script()->isEnabled())
-                m_frame->script()->clearWindowShell();
-            if (m_frame->view())
-                m_frame->view()->clear();
-            
-            // similar to begin(), should be refactored to share more code
-            RefPtr<Document> newDoc = DOMImplementation::createDocument(m_responseMIMEType, m_frame, m_frame->inViewSourceMode());
-            m_frame->setDocument(newDoc);
-            newDoc->setURL(m_URL);
-            if (m_decoder)
-                newDoc->setDecoder(m_decoder.get());
-            restoreDocumentState();
-            dispatchWindowObjectAvailable();         
-            newDoc->implicitOpen();
-
-            // swap DocLoader ownership
-            DocLoader* docLoader = newDoc->docLoader();
-            newDoc->setDocLoader(oldDoc->docLoader());
-            newDoc->docLoader()->replaceDocument(newDoc.get());
-            docLoader->replaceDocument(oldDoc.get());
-            oldDoc->setDocLoader(docLoader);
-            
-            // drop the old doc            
-            oldDoc = 0;
-
-            // write decoded data to the new doc, similar to write()
-            if (m_pendingSourceInLowBandwidthDisplay.length()) {
-                if (m_decoder->encoding().usesVisualOrdering())
-                    newDoc->setVisuallyOrdered();                    
-                newDoc->recalcStyle(Node::Force);                
-                newDoc->tokenizer()->write(m_pendingSourceInLowBandwidthDisplay, true);
-            
-                if (m_finishedParsingDuringLowBandwidthDisplay)
-                    newDoc->finishParsing();
-            }
-
-            // update rendering
-            newDoc->updateRendering();
-                        
-            // reset states
-            removeAllLowBandwidthDisplayRequests();        
-            m_pendingSourceInLowBandwidthDisplay = String();
-            m_finishedParsingDuringLowBandwidthDisplay = false;
-            m_needToSwitchOutLowBandwidthDisplay = false;
-        }
-    }
+    return true;
 }
 
-#endif
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index dd55552d04..a0c1c2984d 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -31,29 +31,27 @@
 #define FrameLoader_h
 
 #include "CachePolicy.h"
-#include "FormState.h"
 #include "FrameLoaderTypes.h"
 #include "ResourceRequest.h"
+#include "ThreadableLoader.h"
 #include "Timer.h"
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-#include "CachedResourceClient.h"
-#endif
-
 namespace WebCore {
 
     class Archive;
     class AuthenticationChallenge;
+    class CachedFrame;
     class CachedPage;
     class CachedResource;
     class Document;
     class DocumentLoader;
-    class Element;
     class Event;
     class FormData;
+    class FormState;
     class Frame;
     class FrameLoaderClient;
     class HistoryItem;
+    class HTMLAppletElement;
     class HTMLFormElement;
     class HTMLFrameOwnerElement;
     class IconLoader;
@@ -64,6 +62,7 @@ namespace WebCore {
     class ResourceLoader;
     class ResourceResponse;
     class ScriptSourceCode;
+    class ScriptString;
     class ScriptValue;
     class SecurityOrigin;
     class SharedBuffer;
@@ -71,7 +70,6 @@ namespace WebCore {
     class TextResourceDecoder;
     class Widget;
 
-    struct FormSubmission;
     struct FrameLoadRequest;
     struct ScheduledRedirection;
     struct WindowFeatures;
@@ -113,11 +111,7 @@ namespace WebCore {
         void* m_argument;
     };
 
-    class FrameLoader : Noncopyable
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        , private CachedResourceClient
-#endif
-    {
+    class FrameLoader : Noncopyable {
     public:
         FrameLoader(Frame*, FrameLoaderClient*);
         ~FrameLoader();
@@ -126,50 +120,42 @@ namespace WebCore {
 
         Frame* frame() const { return m_frame; }
 
-        // FIXME: This is not cool, people. We should aim to consolidate these variety of loading related methods into a smaller set,
-        // and try to reuse more of the same logic by extracting common code paths.
+        // FIXME: This is not cool, people. There are too many different functions that all start loads.
+        // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
+        // the logic by extracting common code paths.
+
         void prepareForLoadStart();
         void setupForReplace();
         void setupForReplaceByMIMEType(const String& newMIMEType);
 
-        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>);         // Calls continueLoadAfterNavigationPolicy
-        void load(DocumentLoader*);                                                                 // Calls loadWithDocumentLoader   
-
-        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,              // Calls loadWithDocumentLoader()
-            FrameLoadType, PassRefPtr<FormState>);
-
-        void loadPostRequest(const ResourceRequest& inRequest, const String& referrer,              // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction
-            const String& frameName, Event* event, PassRefPtr<FormState> prpFormState);
-
-        void loadURL(const KURL& newURL, const String& referrer, const String& frameName,           // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction or else dispatches to navigation policy delegate    
-            FrameLoadType, Event* event, PassRefPtr<FormState> prpFormState);                                                         
         void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
 
-        void loadFrameRequestWithFormAndValues(const FrameLoadRequest&, bool lockHistory,           // Called by submitForm, calls loadPostRequest()
-            Event*, HTMLFormElement*, const HashMap<String, String>& formValues);
+        void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
+            PassRefPtr<Event>, PassRefPtr<FormState>);
 
-        void load(const ResourceRequest&);                                                          // Called by WebFrame, calls (ResourceRequest, SubstituteData)
-        void load(const ResourceRequest&, const SubstituteData&);                                   // Called both by WebFrame and internally, calls (DocumentLoader*)
-        void load(const ResourceRequest&, const String& frameName);                                 // Called by WebPluginController
+        void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
+        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
+        void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
         
-        void loadArchive(PassRefPtr<Archive> archive);
+        void loadArchive(PassRefPtr<Archive>);
 
-        // Returns true for any non-local URL. If Document parameter is supplied, its local load policy dictates,
+        // Returns true for any non-local URL. If document parameter is supplied, its local load policy dictates,
         // otherwise if referrer is non-empty and represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, const Document* theDocument = 0);
+        static bool canLoad(const KURL&, const String& referrer, const Document*);
+        static bool canLoad(const KURL&, const String& referrer, const SecurityOrigin* = 0);
         static void reportLocalLoadFailed(Frame*, const String& url);
 
-        static bool shouldHideReferrer(const KURL& url, const String& referrer);
+        static bool shouldHideReferrer(const KURL&, const String& referrer);
 
         // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
         Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
-        unsigned long loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data);
+        unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
 
         bool canHandleRequest(const ResourceRequest&);
 
         // Also not cool.
-        void stopAllLoaders();
+        void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
         void stopForUserCancel(bool deferCheckLoadComplete = false);
 
         bool isLoadingMainResource() const { return m_isLoadingMainResource; }
@@ -180,13 +166,12 @@ namespace WebCore {
         String referrer() const;
         String outgoingReferrer() const;
         String outgoingOrigin() const;
-        void loadEmptyDocumentSynchronously();
 
         DocumentLoader* activeDocumentLoader() const;
-        DocumentLoader* documentLoader() const;
-        DocumentLoader* policyDocumentLoader() const;
-        DocumentLoader* provisionalDocumentLoader() const;
-        FrameState state() const;
+        DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+        DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
+        DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
+        FrameState state() const { return m_state; }
         static double timeOfLastCompletedLoad();
 
         bool shouldUseCredentialStorage(ResourceLoader*);
@@ -199,6 +184,7 @@ namespace WebCore {
         void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
         void didFinishLoad(ResourceLoader*);
         void didFailToLoad(ResourceLoader*, const ResourceError&);
+        void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         const ResourceRequest& originalRequest() const;
         const ResourceRequest& initialRequest() const;
         void receivedMainResourceError(const ResourceError&, bool isComplete);
@@ -223,14 +209,12 @@ namespace WebCore {
         bool representationExistsForURLScheme(const String& URLScheme);
         String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        void notifyIconChanged();
-
         void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction function, void* argument);
         void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
         void cancelContentPolicyCheck();
 
         void reload(bool endToEndReload = false);
-        void reloadAllowingStaleData(const String& overrideEncoding);
+        void reloadWithOverrideEncoding(const String& overrideEncoding);
 
         void didReceiveServerRedirectForProvisionalLoadForFrame();
         void finishedLoadingDocument(DocumentLoader*);
@@ -245,55 +229,42 @@ namespace WebCore {
         void didChangeTitle(DocumentLoader*);
 
         FrameLoadType loadType() const;
-        CachePolicy cachePolicy() const;
+        CachePolicy subresourceCachePolicy() const;
 
         void didFirstLayout();
         bool firstLayoutDone() const;
 
         void didFirstVisuallyNonEmptyLayout();
 
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockHistory, bool isJavaScriptFormAction);
-        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 #if ENABLE(WML)
         void setForceReloadWmlDeck(bool);
 #endif
 
-        bool isQuickRedirectComing() const;
-
-        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
-        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
         void loadedResourceFromMemoryCache(const CachedResource*);
         void tellClientAboutPastMemoryCacheLoads();
 
-        void recursiveCheckLoadComplete();
         void checkLoadComplete();
         void detachFromParent();
-        void detachChildren();
 
         void addExtraFieldsToSubresourceRequest(ResourceRequest&);
         void addExtraFieldsToMainResourceRequest(ResourceRequest&);
         
         static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
 
-        FrameLoaderClient* client() const;
+        FrameLoaderClient* client() const { return m_client; }
 
         void setDefersLoading(bool);
 
-        void changeLocation(const String& url, const String& referrer, bool lockHistory = true, bool userGesture = false, bool refresh = false);
-        void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool userGesture = false, bool refresh = false);
-        void urlSelected(const ResourceRequest&, const String& target, Event*, bool lockHistory, bool userGesture);
-        void urlSelected(const FrameLoadRequest&, Event*, bool lockHistory);
-      
+        void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
+        void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture);
         bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
-        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-        void submitForm(const char* action, const String& url, PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary, Event*);
-        void submitFormAgain();
-        void submitForm(const FrameLoadRequest&, Event*);
+        void submitForm(const char* action, const String& url,
+            PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event>, PassRefPtr<FormState>);
 
         void stop();
-        void stopLoading(bool sendUnload);
+        void stopLoading(bool sendUnload, DatabasePolicy = DatabasePolicyStop);
         bool closeURL();
 
         void didExplicitOpen();
@@ -302,24 +273,21 @@ namespace WebCore {
         void commitIconURLToIconDatabase(const KURL&);
 
         KURL baseURL() const;
-        String baseTarget() const;
-        KURL dataURLBaseFromRequest(const ResourceRequest& request) const;
 
         bool isScheduledLocationChangePending() const { return m_scheduledRedirection && isLocationChange(*m_scheduledRedirection); }
         void scheduleHTTPRedirection(double delay, const String& url);
-        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool userGesture = false);
+        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
         void scheduleRefresh(bool userGesture = false);
         void scheduleHistoryNavigation(int steps);
 
         bool canGoBackOrForward(int distance) const;
         void goBackOrForward(int distance);
         int getHistoryLength();
-        KURL historyURL(int distance);
 
         void begin();
         void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
-        void write(const char* str, int len = -1, bool flush = false);
+        void write(const char* string, int length = -1, bool flush = false);
         void write(const String&);
         void end();
         void endIfNotLoadingMainResource();
@@ -327,24 +295,20 @@ namespace WebCore {
         void setEncoding(const String& encoding, bool userChosen);
         String encoding() const;
 
-        // Returns true if url is a JavaScript URL.
-        bool executeIfJavaScriptURL(const KURL& url, bool userGesture = false, bool replaceDocument = true);
-
         ScriptValue executeScript(const ScriptSourceCode&);
         ScriptValue executeScript(const String& script, bool forceUserGesture = false);
 
         void gotoAnchor();
-        bool gotoAnchor(const String& name); // returns true if the anchor was found
-        void scrollToAnchor(const KURL&);
 
         void tokenizerProcessedData();
 
         void handledOnloadEvents();
         String userAgent(const KURL&) const;
 
-        Widget* createJavaAppletWidget(const IntSize&, Element*, const HashMap<String, String>& args);
+        Widget* createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
         void dispatchWindowObjectAvailable();
+        void dispatchDocumentElementAvailable();
         void restoreDocumentState();
 
         Frame* opener();
@@ -352,26 +316,18 @@ namespace WebCore {
         bool openedByDOM() const;
         void setOpenedByDOM();
 
-        void provisionalLoadStarted();
-
         bool userGestureHint();
 
         void resetMultipleFormSubmissionProtection();
-        void didNotOpenURL(const KURL&);
 
         void addData(const char* bytes, int length);
 
-        bool canCachePage();
-
         void checkCallImplicitClose();
-        bool didOpenURL(const KURL&);
 
         void frameDetached();
 
         const KURL& url() const { return m_URL; }
 
-        void updateBaseURLForEmptyDocument();
-
         void setResponseMIMEType(const String&);
         const String& responseMIMEType() const;
 
@@ -380,12 +336,6 @@ namespace WebCore {
         void loadDone();
         void finishedParsing();
         void checkCompleted();
-        void scheduleCheckCompleted();
-        void scheduleCheckLoadComplete();
-
-        void clearRecordedFormValues();
-        void setFormAboutToBeSubmitted(PassRefPtr<HTMLFormElement> element);
-        void recordFormValue(const String& name, const String& value);
 
         bool isComplete() const;
 
@@ -394,53 +344,33 @@ namespace WebCore {
 
         KURL completeURL(const String& url);
 
-        KURL originalRequestURL() const;
-
         void cancelAndClear();
 
         void setTitle(const String&);
-        
-        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
         void commitProvisionalLoad(PassRefPtr<CachedPage>);
 
         void goToItem(HistoryItem*, FrameLoadType);
         void saveDocumentAndScrollState();
-        void saveScrollPositionAndViewStateToItem(HistoryItem*);
 
-        // FIXME: These accessors are here for a dwindling number of users in WebKit, WebFrame
-        // being the primary one.  After they're no longer needed there, they can be removed!
         HistoryItem* currentHistoryItem();
-        HistoryItem* previousHistoryItem();
-        HistoryItem* provisionalHistoryItem();
         void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
-        void setPreviousHistoryItem(PassRefPtr<HistoryItem>);
-        void setProvisionalHistoryItem(PassRefPtr<HistoryItem>);
-
-        void continueLoadWithData(SharedBuffer*, const String& mimeType, const String& textEncoding, const KURL&); 
 
         enum LocalLoadPolicy {
-          AllowLocalLoadsForAll,  // No restriction on local loads.
-          AllowLocalLoadsForLocalAndSubstituteData,
-          AllowLocalLoadsForLocalOnly,
+            AllowLocalLoadsForAll,  // No restriction on local loads.
+            AllowLocalLoadsForLocalAndSubstituteData,
+            AllowLocalLoadsForLocalOnly,
         };
         static void setLocalLoadPolicy(LocalLoadPolicy);
         static bool restrictAccessToLocal();
         static bool allowSubstituteDataAccessToLocal();
 
-        static void registerURLSchemeAsLocal(const String& scheme);
+        static void registerURLSchemeAsLocal(const String&);
         static bool shouldTreatURLAsLocal(const String&);
-        static bool shouldTreatSchemeAsLocal(const String&);
-
-#if USE(LOW_BANDWIDTH_DISPLAY)    
-        bool addLowBandwidthDisplayRequest(CachedResource*);
-        void needToSwitchOutLowBandwidthDisplay() { m_needToSwitchOutLowBandwidthDisplay = true; }
+        static bool shouldTreatURLSchemeAsLocal(const String&);
 
-        // Client can control whether to use low bandwidth display on a per frame basis.
-        // However, this should only be used for the top frame, not sub-frame.
-        void setUseLowBandwidthDisplay(bool lowBandwidth) { m_useLowBandwidthDisplay = lowBandwidth; }
-        bool useLowBandwidthDisplay() const { return m_useLowBandwidthDisplay; }
-#endif
+        static void registerURLSchemeAsNoAccess(const String&);
+        static bool shouldTreatURLSchemeAsNoAccess(const String&);
 
         bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
 
@@ -453,10 +383,18 @@ namespace WebCore {
 
         void applyUserAgent(ResourceRequest& request);
 
+        bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
+
     private:
         PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
         PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
 
+        bool canCachePageContainingThisFrame();
+#ifndef NDEBUG
+        void logCanCachePageDecision();
+        bool logCanCacheFrameDecision(int indentLevel);
+#endif
+
         void addBackForwardItemClippedAtTarget(bool doClip);
         void restoreScrollPositionAndViewState();
         void saveDocumentState();
@@ -469,7 +407,7 @@ namespace WebCore {
         void updateHistoryForBackForwardNavigation();
         void updateHistoryForReload();
         void updateHistoryForStandardLoad();
-        void updateHistoryForRedirectWithLockedHistory();
+        void updateHistoryForRedirectWithLockedBackForwardList();
         void updateHistoryForClientRedirect();
         void updateHistoryForCommit();
         void updateHistoryForAnchorScroll();
@@ -494,8 +432,8 @@ namespace WebCore {
 
         void receivedFirstData();
 
-        void updatePolicyBaseURL();
-        void setPolicyBaseURL(const KURL&);
+        void updateFirstPartyForCookies();
+        void setFirstPartyForCookies(const KURL&);
         
         void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
 
@@ -511,10 +449,8 @@ namespace WebCore {
 
         void setLoadType(FrameLoadType);
 
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>,
-                                   NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, 
-                                  PassRefPtr<FormState>, const String& frameName);
+        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
 
         void continueAfterNavigationPolicy(PolicyAction);
         void continueAfterNewWindowPolicy(PolicyAction);
@@ -527,13 +463,11 @@ namespace WebCore {
         void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
         static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
         void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
-        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType loadType, const KURL& url);
+        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
         void addHistoryItemForFragmentScroll();
 
         void stopPolicyCheck();
 
-        void closeDocument();
-        
         void checkLoadCompleteForThisFrame();
 
         void setDocumentLoader(DocumentLoader*);
@@ -544,7 +478,8 @@ namespace WebCore {
 
         void closeOldDataSources();
         void open(CachedPage&);
-        void opened();
+        void open(CachedFrame&);
+
         void updateHistoryAfterClientRedirect();
 
         void clear(bool clearWindowProperties = true, bool clearScriptObjects = true);
@@ -556,14 +491,6 @@ namespace WebCore {
         void startRedirectionTimer();
         void stopRedirectionTimer();
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        // implementation of CachedResourceClient        
-        virtual void notifyFinished(CachedResource*);
-
-        void removeAllLowBandwidthDisplayRequests();    
-        void switchOutLowBandwidthDisplayIfReady();        
-#endif
-
         void dispatchDidCommitLoad();
         void dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
         void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
@@ -572,6 +499,53 @@ namespace WebCore {
         void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
 
         static bool isLocationChange(const ScheduledRedirection&);
+        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList, PassRefPtr<Event>, PassRefPtr<FormState>);
+
+        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
+        void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
+
+        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
+            bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
+
+        void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
+            const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
+        void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
+            bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
+
+        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
+
+        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
+
+        void recursiveCheckLoadComplete();
+
+        void detachChildren();
+        void closeAndRemoveChild(Frame*);
+
+        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
+
+        // Returns true if argument is a JavaScript URL.
+        bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+
+        bool gotoAnchor(const String& name); // returns true if the anchor was found
+        void scrollToAnchor(const KURL&);
+
+        void provisionalLoadStarted();
+
+        bool canCachePage();
+
+        bool didOpenURL(const KURL&);
+
+        void scheduleCheckCompleted();
+        void scheduleCheckLoadComplete();
+
+        KURL originalRequestURL() const;
+
+        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
+
+        void saveScrollPositionAndViewStateToItem(HistoryItem*);
 
         Frame* m_frame;
         FrameLoaderClient* m_client;
@@ -601,12 +575,9 @@ namespace WebCore {
         bool m_quickRedirectComing;
         bool m_sentRedirectNotification;
         bool m_inStopAllLoaders;
-        bool m_navigationDuringLoad;
 
         String m_outgoingReferrer;
 
-        OwnPtr<FormSubmission> m_deferredFormSubmission;
-
         bool m_isExecutingJavaScriptFormAction;
         bool m_isRunningScript;
 
@@ -614,6 +585,7 @@ namespace WebCore {
 
         bool m_didCallImplicitClose;
         bool m_wasUnloadEventEmitted;
+        bool m_unloadEventBeingDispatched;
         bool m_isComplete;
         bool m_isLoadingMainResource;
 
@@ -636,8 +608,6 @@ namespace WebCore {
 
         bool m_containsPlugIns;
 
-        RefPtr<HTMLFormElement> m_formAboutToBeSubmitted;
-        HashMap<String, String> m_formValuesAboutToBeSubmitted;
         KURL m_submittedFormURL;
     
         Timer<FrameLoader> m_redirectionTimer;
@@ -663,26 +633,11 @@ namespace WebCore {
         bool m_didDispatchDidCommitLoad;
 #endif
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        // whether to use low bandwidth dislay, set by client
-        bool m_useLowBandwidthDisplay;
-
-        // whether to call finishParsing() in switchOutLowBandwidthDisplayIfReady() 
-        bool m_finishedParsingDuringLowBandwidthDisplay;
-
-        // whether to call switchOutLowBandwidthDisplayIfReady;
-        // true if there is external css, javascript, or subframe/plugin
-        bool m_needToSwitchOutLowBandwidthDisplay;
-        
-        String m_pendingSourceInLowBandwidthDisplay;        
-        HashSet<CachedResource*> m_externalRequestsInLowBandwidthDisplay;
-#endif
-
 #if ENABLE(WML)
         bool m_forceReloadWmlDeck;
 #endif
     };
 
-}
+} // namespace WebCore
 
-#endif
+#endif // FrameLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.cpp
deleted file mode 100644
index 9610fd16ee..0000000000
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Holger Hans Peter Freyther
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "FrameLoaderClient.h"
-
-#include "Color.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "HTMLFrameOwnerElement.h"
-#include "Page.h"
-#include "RenderPart.h"
-
-namespace WebCore {
-
-FrameLoaderClient::~FrameLoaderClient()
-{}
-
-void FrameLoaderClient::transitionToCommittedForNewPage(Frame* frame,
-                                                        const IntSize& viewportSize,
-                                                        const Color& backgroundColor, bool transparent,
-                                                        const IntSize& fixedLayoutSize, bool useFixedLayout,
-                                                        ScrollbarMode horizontalScrollbarMode, ScrollbarMode verticalScrollbarMode)
-{
-    ASSERT(frame);
-
-    Page* page = frame->page();
-    ASSERT(page);
-
-    bool isMainFrame = frame == page->mainFrame();
-
-    if (isMainFrame && frame->view())
-        frame->view()->setParentVisible(false);
-
-    frame->setView(0);
-
-    FrameView* frameView;
-    if (isMainFrame) {
-        frameView = new FrameView(frame, viewportSize);
-        frameView->setFixedLayoutSize(fixedLayoutSize);
-        frameView->setUseFixedLayout(useFixedLayout);
-    } else
-        frameView = new FrameView(frame);
-
-    frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode);
-    frameView->updateDefaultScrollbarState();
-
-    frame->setView(frameView);
-    // FrameViews are created with a ref count of 1. Release this ref since we've assigned it to frame.
-    frameView->deref();
-
-    if (backgroundColor.isValid())
-        frameView->updateBackgroundRecursively(backgroundColor, transparent);
-
-    if (isMainFrame)
-        frameView->setParentVisible(true);
-
-    if (frame->ownerRenderer())
-        frame->ownerRenderer()->setWidget(frameView);
-
-    if (HTMLFrameOwnerElement* owner = frame->ownerElement())
-        frame->view()->setCanHaveScrollbars(owner->scrollingMode() != ScrollbarAlwaysOff);
-}
-
-}
-
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index 44ab4a4a2d..b862002551 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,7 +45,7 @@ class NSView;
 namespace WebCore {
 
     class AuthenticationChallenge;
-    class CachedPage;
+    class CachedFrame;
     class Color;
     class DocumentLoader;
     class Element;
@@ -53,31 +53,38 @@ namespace WebCore {
     class Frame;
     class FrameLoader;
     class HistoryItem;
+    class HTMLAppletElement;
     class HTMLFrameOwnerElement;
+    class HTMLPlugInElement;
     class IntSize;
     class KURL;
     class NavigationAction;
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
+    struct ResourceRequest;
     class ResourceResponse;
+    class ScriptString;
     class SharedBuffer;
     class SubstituteData;
     class String;
     class Widget;
 
-    class ResourceRequest;
-
     typedef void (FrameLoader::*FramePolicyFunction)(PolicyAction);
 
     class FrameLoaderClient {
     public:
-        virtual ~FrameLoaderClient();
+        // An inline function cannot be the first non-abstract virtual function declared
+        // in the class as it results in the vtable being generated as a weak symbol.
+        // This hurts performance (in Mac OS X at least, when loadig frameworks), so we
+        // don't want to do it in WebKit.
+        virtual bool hasHTMLView() const;
+
+        virtual ~FrameLoaderClient() { }
+
         virtual void frameLoaderDestroyed() = 0;
-        
-        virtual bool hasWebView() const = 0; // mainly for assertions
 
-        virtual bool hasHTMLView() const { return true; }
+        virtual bool hasWebView() const = 0; // mainly for assertions
 
         virtual void makeRepresentation(DocumentLoader*) = 0;
         virtual void forceLayout() = 0;
@@ -99,6 +106,7 @@ namespace WebCore {
         virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier) = 0;
         virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&) = 0;
         virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length) = 0;
+        virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString&) = 0;
 
         virtual void dispatchDidHandleOnloadEvents() = 0;
         virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() = 0;
@@ -151,6 +159,8 @@ namespace WebCore {
         virtual void finishedLoading(DocumentLoader*) = 0;
         
         virtual void updateGlobalHistory() = 0;
+        virtual void updateGlobalHistoryRedirectLinks() = 0;
+
         virtual bool shouldGoToHistoryItem(HistoryItem*) const = 0;
 
         virtual ResourceError cancelledError(const ResourceRequest&) = 0;
@@ -181,8 +191,8 @@ namespace WebCore {
 
         virtual String userAgent(const KURL&) = 0;
         
-        virtual void savePlatformDataToCachedPage(CachedPage*) = 0;
-        virtual void transitionToCommittedFromCachedPage(CachedPage*) = 0;
+        virtual void savePlatformDataToCachedFrame(CachedFrame*) = 0;
+        virtual void transitionToCommittedFromCachedFrame(CachedFrame*) = 0;
         virtual void transitionToCommittedForNewPage() = 0;
 
         virtual bool canCachePage() const = 0;
@@ -190,15 +200,16 @@ namespace WebCore {
 
         virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight) = 0;
-        virtual Widget* createPlugin(const IntSize&, Element*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually) = 0;
+        virtual Widget* createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually) = 0;
         virtual void redirectDataToPlugin(Widget* pluginWidget) = 0;
         
-        virtual Widget* createJavaAppletWidget(const IntSize&, Element*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues) = 0;
+        virtual Widget* createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues) = 0;
 
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
         virtual String overrideMediaType() const = 0;
 
         virtual void windowObjectCleared() = 0;
+        virtual void documentElementAvailable() = 0;
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
         
         virtual void registerForIconNotification(bool listen = true) = 0;
@@ -209,12 +220,11 @@ namespace WebCore {
 #endif
         virtual NSCachedURLResponse* willCacheResponse(DocumentLoader*, unsigned long identifier, NSCachedURLResponse*) const = 0;
 #endif
+#if USE(CFNETWORK)
+        virtual bool shouldCacheResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&, const unsigned char* data, unsigned long long length) = 0;
+#endif
 
-        virtual bool shouldUsePluginDocument(const String& mimeType) const { return false; }
-
-    protected:
-        static void transitionToCommittedForNewPage(Frame*, const IntSize&, const Color&, bool, const IntSize &, bool,
-                                                    ScrollbarMode = ScrollbarAuto, ScrollbarMode = ScrollbarAuto);
+        virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
index b661f9f050..c264b470aa 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
@@ -51,9 +51,8 @@ namespace WebCore {
         FrameLoadTypeForward,
         FrameLoadTypeIndexedBackForward, // a multi-item hop in the backforward list
         FrameLoadTypeReload,
-        FrameLoadTypeReloadAllowingStaleData,
         FrameLoadTypeSame,               // user loads same URL again (but not reload button)
-        FrameLoadTypeRedirectWithLockedHistory,
+        FrameLoadTypeRedirectWithLockedBackForwardList, // FIXME: Merge "lockBackForwardList", "lockHistory", "quickRedirect" and "clientRedirect" into a single concept of redirect.
         FrameLoadTypeReplace,
         FrameLoadTypeReloadFromOrigin
     };
@@ -67,6 +66,11 @@ namespace WebCore {
         NavigationTypeOther
     };
 
+    enum DatabasePolicy {
+        DatabasePolicyStop,    // The database thread should be stopped and database connections closed.
+        DatabasePolicyContinue
+    };
+
     enum ObjectContentType {
         ObjectContentNone,
         ObjectContentImage,
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
index 8f58179cc7..08f2e9afd3 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "ImageDocument.h"
 
+#include "CSSStyleDeclaration.h"
 #include "CachedImage.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -37,6 +38,7 @@
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "SegmentedString.h"
 #include "Settings.h"
@@ -63,7 +65,7 @@ class ImageTokenizer : public Tokenizer {
 public:
     ImageTokenizer(ImageDocument* doc) : m_doc(doc) {}
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     virtual bool isWaitingForScripts() const;
     
@@ -91,10 +93,10 @@ private:
 
 // --------
 
-bool ImageTokenizer::write(const SegmentedString&, bool)
+void ImageTokenizer::write(const SegmentedString&, bool)
 {
-    ASSERT_NOT_REACHED();
-    return false;
+    // <https://bugs.webkit.org/show_bug.cgi?id=25397>: JS code can always call document.write, we need to handle it.
+    notImplemented();
 }
 
 bool ImageTokenizer::writeRawData(const char*, int)
@@ -125,9 +127,9 @@ void ImageTokenizer::finish()
 
         IntSize size = cachedImage->imageSize(m_doc->frame()->pageZoomFactor());
         if (size.width()) {
-            // Compute the title, we use the filename of the resource, falling
-            // back on the hostname if there is no path.
-            String fileName = m_doc->url().lastPathComponent();
+            // Compute the title, we use the decoded filename of the resource, falling
+            // back on the (decoded) hostname if there is no path.
+            String fileName = decodeURLEscapeSequences(m_doc->url().lastPathComponent());
             if (fileName.isEmpty())
                 fileName = m_doc->url().host();
             m_doc->setTitle(imageTitle(fileName, size));
@@ -166,10 +168,10 @@ void ImageDocument::createDocumentStructure()
 {
     ExceptionCode ec;
     
-    RefPtr<Element> rootElement = createElementNS(xhtmlNamespaceURI, "html", ec);
+    RefPtr<Element> rootElement = Document::createElement(htmlTag, false);
     appendChild(rootElement, ec);
     
-    RefPtr<Element> body = createElementNS(xhtmlNamespaceURI, "body", ec);
+    RefPtr<Element> body = Document::createElement(bodyTag, false);
     body->setAttribute(styleAttr, "margin: 0px;");
     
     rootElement->appendChild(body, ec);
@@ -185,7 +187,8 @@ void ImageDocument::createDocumentStructure()
     if (shouldShrinkToFit()) {
         // Add event listeners
         RefPtr<EventListener> listener = ImageEventListener::create(this);
-        addWindowEventListener("resize", listener, false);
+        if (DOMWindow* domWindow = this->domWindow())
+            domWindow->addEventListener("resize", listener, false);
         imageElement->addEventListener("click", listener.release(), false);
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
index 43e08c092a..b183a662f7 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,8 +31,33 @@
 
 namespace WebCore {
 
-ImageLoader::ImageLoader(Element* elt)
-    : m_element(elt)
+class ImageLoadEventSender {
+public:
+    ImageLoadEventSender();
+
+    void dispatchLoadEventSoon(ImageLoader*);
+    void cancelLoadEvent(ImageLoader*);
+
+    void dispatchPendingLoadEvents();
+
+private:
+    ~ImageLoadEventSender();
+
+    void timerFired(Timer<ImageLoadEventSender>*);
+
+    Timer<ImageLoadEventSender> m_timer;
+    Vector<ImageLoader*> m_dispatchSoonList;
+    Vector<ImageLoader*> m_dispatchingList;
+};
+
+static ImageLoadEventSender& loadEventSender()
+{
+    DEFINE_STATIC_LOCAL(ImageLoadEventSender, sender, ());
+    return sender;
+}
+
+ImageLoader::ImageLoader(Element* element)
+    : m_element(element)
     , m_image(0)
     , m_firedLoad(true)
     , m_imageComplete(true)
@@ -44,7 +69,7 @@ ImageLoader::~ImageLoader()
 {
     if (m_image)
         m_image->removeClient(this);
-    m_element->document()->removeImage(this);
+    loadEventSender().cancelLoadEvent(this);
 }
 
 void ImageLoader::setImage(CachedImage* newImage)
@@ -61,11 +86,11 @@ void ImageLoader::setImage(CachedImage* newImage)
             oldImage->removeClient(this);
     }
 
-    if (RenderObject* renderer = element()->renderer()) {
+    if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
 
-        static_cast<RenderImage*>(renderer)->resetAnimation();
+        toRenderImage(renderer)->resetAnimation();
     }
 }
 
@@ -80,12 +105,11 @@ void ImageLoader::updateFromElement()
 {
     // If we're not making renderers for the page, then don't load images.  We don't want to slow
     // down the raw HTML parsing case by loading images we don't intend to display.
-    Element* elem = element();
-    Document* doc = elem->document();
-    if (!doc->renderer())
+    Document* document = m_element->document();
+    if (!document->renderer())
         return;
 
-    AtomicString attr = elem->getAttribute(elem->imageSourceAttributeName());
+    AtomicString attr = m_element->getAttribute(m_element->imageSourceAttributeName());
 
     if (attr == m_failedLoadURL)
         return;
@@ -95,15 +119,15 @@ void ImageLoader::updateFromElement()
     // a quirk that preserves old behavior that Dashboard widgets
     // need (<rdar://problem/5994621>).
     CachedImage* newImage = 0;
-    if (!(attr.isNull() || attr.isEmpty() && doc->baseURI().isLocalFile())) {
+    if (!(attr.isNull() || (attr.isEmpty() && document->baseURI().isLocalFile()))) {
         if (m_loadManually) {
-            doc->docLoader()->setAutoLoadImages(false);
+            document->docLoader()->setAutoLoadImages(false);
             newImage = new CachedImage(sourceURI(attr));
             newImage->setLoading(true);
-            newImage->setDocLoader(doc->docLoader());
-            doc->docLoader()->m_documentResources.set(newImage->url(), newImage);
+            newImage->setDocLoader(document->docLoader());
+            document->docLoader()->m_documentResources.set(newImage->url(), newImage);
         } else
-            newImage = doc->docLoader()->requestImage(sourceURI(attr));
+            newImage = document->docLoader()->requestImage(sourceURI(attr));
 
         // If we do not have an image here, it means that a cross-site
         // violation occurred.
@@ -119,11 +143,11 @@ void ImageLoader::updateFromElement()
             oldImage->removeClient(this);
     }
 
-    if (RenderObject* renderer = elem->renderer()) {
+    if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
 
-        static_cast<RenderImage*>(renderer)->resetAnimation();
+        toRenderImage(renderer)->resetAnimation();
     }
 }
 
@@ -139,15 +163,85 @@ void ImageLoader::notifyFinished(CachedResource*)
     ASSERT(m_failedLoadURL.isEmpty());
     m_imageComplete = true;
 
-    Element* elem = element();
-    elem->document()->dispatchImageLoadEventSoon(this);
+    loadEventSender().dispatchLoadEventSoon(this);
 
-    if (RenderObject* renderer = elem->renderer()) {
+    if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
 
-        static_cast<RenderImage*>(renderer)->setCachedImage(m_image.get());
+        toRenderImage(renderer)->setCachedImage(m_image.get());
     }
 }
 
+void ImageLoader::dispatchPendingLoadEvent()
+{
+    if (m_firedLoad)
+        return;
+    if (!m_image)
+        return;
+    if (!m_element->document()->attached())
+        return;
+    m_firedLoad = true;
+    dispatchLoadEvent();
+}
+
+void ImageLoader::dispatchPendingLoadEvents()
+{
+    loadEventSender().dispatchPendingLoadEvents();
+}
+
+ImageLoadEventSender::ImageLoadEventSender()
+    : m_timer(this, &ImageLoadEventSender::timerFired)
+{
+}
+
+void ImageLoadEventSender::dispatchLoadEventSoon(ImageLoader* loader)
+{
+    m_dispatchSoonList.append(loader);
+    if (!m_timer.isActive())
+        m_timer.startOneShot(0);
+}
+
+void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
+{
+    // Remove instances of this loader from both lists.
+    // Use loops because we allow multiple instances to get into the lists.
+    size_t size = m_dispatchSoonList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchSoonList[i] == loader)
+            m_dispatchSoonList[i] = 0;
+    }
+    size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchingList[i] == loader)
+            m_dispatchingList[i] = 0;
+    }
+    if (m_dispatchSoonList.isEmpty())
+        m_timer.stop();
+}
+
+void ImageLoadEventSender::dispatchPendingLoadEvents()
+{
+    // Need to avoid re-entering this function; if new dispatches are
+    // scheduled before the parent finishes processing the list, they
+    // will set a timer and eventually be processed.
+    if (!m_dispatchingList.isEmpty())
+        return;
+
+    m_timer.stop();
+
+    m_dispatchingList.swap(m_dispatchSoonList);
+    size_t size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (ImageLoader* loader = m_dispatchingList[i])
+            loader->dispatchPendingLoadEvent();
+    }
+    m_dispatchingList.clear();
+}
+
+void ImageLoadEventSender::timerFired(Timer<ImageLoadEventSender>*)
+{
+    dispatchPendingLoadEvents();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
index fc3a58ac51..3496f75c75 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004 Apple Computer, Inc.
+ * Copyright (C) 2004, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,22 +30,21 @@
 namespace WebCore {
 
 class Element;
+class ImageLoadEventSender;
 
 class ImageLoader : public CachedResourceClient {
 public:
     ImageLoader(Element*);
     virtual ~ImageLoader();
 
+    // This function should be called when the element is attached to a document; starts
+    // loading if a load hasn't already been started.
     void updateFromElement();
 
-    // This method should be called after the 'src' attribute
-    // is set (even when it is not modified) to force the update
-    // and match Firefox and Opera.
+    // This function should be called whenever the 'src' attribute is set, even if its value
+    // doesn't change; starts new load unconditionally (matches Firefox and Opera behavior).
     void updateFromElementIgnoringPreviousError();
 
-    virtual void dispatchLoadEvent() = 0;
-    virtual String sourceURI(const AtomicString&) const = 0;
-
     Element* element() const { return m_element; }
     bool imageComplete() const { return m_imageComplete; }
 
@@ -54,16 +53,22 @@ public:
 
     void setLoadManually(bool loadManually) { m_loadManually = loadManually; }
 
-    // CachedResourceClient API
-    virtual void notifyFinished(CachedResource*);
-
     bool haveFiredLoadEvent() const { return m_firedLoad; }
+
+    static void dispatchPendingLoadEvents();
+
 protected:
-    void setLoadingImage(CachedImage*);
-    
-    void setHaveFiredLoadEvent(bool firedLoad) { m_firedLoad = firedLoad; }
+    virtual void notifyFinished(CachedResource*);
 
 private:
+    virtual void dispatchLoadEvent() = 0;
+    virtual String sourceURI(const AtomicString&) const = 0;
+
+    friend class ImageLoadEventSender;
+    void dispatchPendingLoadEvent();
+
+    void setLoadingImage(CachedImage*);
+
     Element* m_element;
     CachedResourceHandle<CachedImage> m_image;
     AtomicString m_failedLoadURL;
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
index 325809b7ba..39e5b90195 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,12 +30,8 @@
 #include "config.h"
 #include "MainResourceLoader.h"
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "ApplicationCache.h"
-#include "ApplicationCacheGroup.h"
-#include "ApplicationCacheResource.h"
-#endif
 #include "DocumentLoader.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -45,6 +41,12 @@
 #include "ResourceHandle.h"
 #include "Settings.h"
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "ApplicationCache.h"
+#include "ApplicationCacheGroup.h"
+#include "ApplicationCacheResource.h"
+#endif
+
 // FIXME: More that is in common with SubresourceLoader should move up into ResourceLoader.
 
 namespace WebCore {
@@ -161,7 +163,7 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // Update cookie policy base URL as URL changes, except for subframes, which use the
     // URL of the main frame which doesn't change when we redirect.
     if (frameLoader()->isLoadingMainFrame())
-        newRequest.setMainDocumentURL(newRequest.url());
+        newRequest.setFirstPartyForCookies(newRequest.url());
     
     // If we're fielding a redirect in response to a POST, force a load from origin, since
     // this is a common site technique to return to a page viewing some data that the POST
@@ -179,14 +181,19 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // listener. But there's no way to do that in practice. So instead we cancel later if the
     // listener tells us to. In practice that means the navigation policy needs to be decided
     // synchronously for these redirect cases.
-
-    ref(); // balanced by deref in continueAfterNavigationPolicy
-    frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+    if (!redirectResponse.isNull()) {
+        ref(); // balanced by deref in continueAfterNavigationPolicy
+        frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+    }
 }
 
 static bool shouldLoadAsEmptyDocument(const KURL& url)
 {
-    return url.isEmpty() || equalIgnoringCase(String(url.protocol()), "about");
+#if PLATFORM(TORCHMOBILE)
+    return url.isEmpty() || (url.protocolIs("about") && equalIgnoringRef(url, blankURL()));
+#else 
+    return url.isEmpty() || url.protocolIs("about");
+#endif
 }
 
 void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy, const ResourceResponse& r)
@@ -248,7 +255,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
     if (!reachedTerminalState())
         ResourceLoader::didReceiveResponse(r);
 
-    if (frameLoader() && !frameLoader()->isStopping())
+    if (frameLoader() && !frameLoader()->isStopping()) {
         if (m_substituteData.isValid()) {
             if (m_substituteData.content()->size())
                 didReceiveData(m_substituteData.content()->data(), m_substituteData.content()->size(), m_substituteData.content()->size(), true);
@@ -256,6 +263,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
                 didFinishLoading();
         } else if (shouldLoadAsEmptyDocument(url) || frameLoader()->representationExistsForURLScheme(url.protocol()))
             didFinishLoading();
+    }
 }
 
 void MainResourceLoader::callContinueAfterContentPolicy(void* argument, PolicyAction policy)
@@ -286,6 +294,15 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     }
 #endif
 
+    HTTPHeaderMap::const_iterator it = r.httpHeaderFields().find(AtomicString("x-frame-options"));
+    if (it != r.httpHeaderFields().end()) {
+        String content = it->second;
+        if (m_frame->loader()->shouldInterruptLoadForXFrameOptions(content, r.url())) {
+            cancel();
+            return;
+        }
+    }
+
     // There is a bug in CFNetwork where callbacks can be dispatched even when loads are deferred.
     // See <rdar://problem/6304600> for more details.
 #if !PLATFORM(CF)
@@ -319,6 +336,17 @@ void MainResourceLoader::didReceiveData(const char* data, int length, long long
     ASSERT(data);
     ASSERT(length != 0);
 
+    ASSERT(!m_response.isNull());
+
+#if USE(CFNETWORK) || (PLATFORM(MAC) && !defined(BUILDING_ON_TIGER))
+    // Workaround for <rdar://problem/6060782>
+    if (m_response.isNull()) {
+        m_response = ResourceResponse(KURL(), "text/html", 0, String(), String());
+        if (DocumentLoader* documentLoader = frameLoader()->activeDocumentLoader())
+            documentLoader->setResponse(m_response);
+    }
+#endif
+
     // There is a bug in CFNetwork where callbacks can be dispatched even when loads are deferred.
     // See <rdar://problem/6304600> for more details.
 #if !PLATFORM(CF)
@@ -396,7 +424,7 @@ void MainResourceLoader::handleEmptyLoad(const KURL& url, bool forURLScheme)
     didReceiveResponse(response);
 }
 
-void MainResourceLoader::handleDataLoadNow(Timer<MainResourceLoader>*)
+void MainResourceLoader::handleDataLoadNow(MainResourceLoaderTimer*)
 {
     RefPtr<MainResourceLoader> protect(this);
 
@@ -408,12 +436,22 @@ void MainResourceLoader::handleDataLoadNow(Timer<MainResourceLoader>*)
     didReceiveResponse(response);
 }
 
+void MainResourceLoader::startDataLoadTimer()
+{
+    m_dataLoadTimer.startOneShot(0);
+
+#if HAVE(RUNLOOP_TIMER)
+    if (SchedulePairHashSet* scheduledPairs = m_frame->page()->scheduledRunLoopPairs())
+        m_dataLoadTimer.schedule(*scheduledPairs);
+#endif
+}
+
 void MainResourceLoader::handleDataLoadSoon(ResourceRequest& r)
 {
     m_initialRequest = r;
     
     if (m_documentLoader->deferMainResourceDataLoad())
-        m_dataLoadTimer.startOneShot(0);
+        startDataLoadTimer();
     else
         handleDataLoadNow(0);
 }
@@ -497,17 +535,16 @@ bool MainResourceLoader::load(const ResourceRequest& r, const SubstituteData& su
 void MainResourceLoader::setDefersLoading(bool defers)
 {
     ResourceLoader::setDefersLoading(defers);
-    
+
     if (defers) {
         if (m_dataLoadTimer.isActive())
             m_dataLoadTimer.stop();
     } else {
         if (m_initialRequest.isNull())
             return;
-        
-        if (m_substituteData.isValid() &&
-            m_documentLoader->deferMainResourceDataLoad())
-                m_dataLoadTimer.startOneShot(0);
+
+        if (m_substituteData.isValid() && m_documentLoader->deferMainResourceDataLoad())
+            startDataLoadTimer();
         else {
             ResourceRequest r(m_initialRequest);
             m_initialRequest = ResourceRequest();
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
index 6c69c1f79d..d9ce2f9b21 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
@@ -29,16 +29,21 @@
 #include "FrameLoaderTypes.h"
 #include "ResourceLoader.h"
 #include "SubstituteData.h"
-#include "Timer.h"
 #include <wtf/Forward.h>
 
+#if HAVE(RUNLOOP_TIMER)
+#include "RunLoopTimer.h"
+#else
+#include "Timer.h"
+#endif
+
 namespace WebCore {
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     class ApplicationCache;
 #endif
     class FormState;
-    class ResourceRequest;
+    struct ResourceRequest;
 
     class MainResourceLoader : public ResourceLoader {
     public:
@@ -56,7 +61,13 @@ namespace WebCore {
         virtual void didFinishLoading();
         virtual void didFail(const ResourceError&);
 
-        void handleDataLoadNow(Timer<MainResourceLoader>*);
+#if HAVE(RUNLOOP_TIMER)
+        typedef RunLoopTimer<MainResourceLoader> MainResourceLoaderTimer;
+#else
+        typedef Timer<MainResourceLoader> MainResourceLoaderTimer;
+#endif
+
+        void handleDataLoadNow(MainResourceLoaderTimer*);
 
         bool isLoadingMultipartContent() const { return m_loadingMultipartContent; }
 
@@ -74,6 +85,7 @@ namespace WebCore {
         void handleEmptyLoad(const KURL&, bool forURLScheme);
         void handleDataLoadSoon(ResourceRequest& r);
 
+        void startDataLoadTimer();
         void handleDataLoad(ResourceRequest&);
 
         void receivedError(const ResourceError&);
@@ -90,7 +102,8 @@ namespace WebCore {
 
         ResourceRequest m_initialRequest;
         SubstituteData m_substituteData;
-        Timer<MainResourceLoader> m_dataLoadTimer;
+
+        MainResourceLoaderTimer m_dataLoadTimer;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         // The application cache that the main resource was loaded from (if any).
diff --git a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
index 8ed5b45b59..0b1fd594ef 100644
--- a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
@@ -38,7 +38,9 @@
 #include "HTMLEmbedElement.h"
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
+#include "KeyboardEvent.h"
 #include "MainResourceLoader.h"
+#include "NodeList.h"
 #include "Page.h"
 #include "SegmentedString.h"
 #include "Settings.h"
@@ -54,7 +56,7 @@ public:
     MediaTokenizer(Document* doc) : m_doc(doc), m_mediaElement(0) {}
         
 private:
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void stopParsing();
     virtual void finish();
     virtual bool isWaitingForScripts() const;
@@ -68,24 +70,23 @@ private:
     HTMLMediaElement* m_mediaElement;
 };
 
-bool MediaTokenizer::write(const SegmentedString&, bool)
+void MediaTokenizer::write(const SegmentedString&, bool)
 {
     ASSERT_NOT_REACHED();
-    return false;
 }
     
 void MediaTokenizer::createDocumentStructure()
 {
     ExceptionCode ec;
-    RefPtr<Element> rootElement = m_doc->createElementNS(xhtmlNamespaceURI, "html", ec);
+    RefPtr<Element> rootElement = m_doc->createElement(htmlTag, false);
     m_doc->appendChild(rootElement, ec);
         
-    RefPtr<Element> body = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+    RefPtr<Element> body = m_doc->createElement(bodyTag, false);
     body->setAttribute(styleAttr, "background-color: rgb(38,38,38);");
 
     rootElement->appendChild(body, ec);
         
-    RefPtr<Element> mediaElement = m_doc->createElementNS(xhtmlNamespaceURI, "video", ec);
+    RefPtr<Element> mediaElement = m_doc->createElement(videoTag, false);
         
     m_mediaElement = static_cast<HTMLVideoElement*>(mediaElement.get());
     m_mediaElement->setAttribute(controlsAttr, "");
@@ -134,10 +135,16 @@ bool MediaTokenizer::isWaitingForScripts() const
     
 MediaDocument::MediaDocument(Frame* frame)
     : HTMLDocument(frame)
+    , m_replaceMediaElementTimer(this, &MediaDocument::replaceMediaElementTimerFired)
 {
     setParseMode(Compat);
 }
 
+MediaDocument::~MediaDocument()
+{
+    ASSERT(!m_replaceMediaElementTimer.isActive());
+}
+
 Tokenizer* MediaDocument::createTokenizer()
 {
     return new MediaTokenizer(this);
@@ -147,23 +154,85 @@ void MediaDocument::defaultEventHandler(Event* event)
 {
     // Match the default Quicktime plugin behavior to allow 
     // clicking and double-clicking to pause and play the media.
-    EventTargetNode* targetNode = event->target()->toNode();
+    Node* targetNode = event->target()->toNode();
     if (targetNode && targetNode->hasTagName(videoTag)) {
         HTMLVideoElement* video = static_cast<HTMLVideoElement*>(targetNode);
-        ExceptionCode ec;
         if (event->type() == eventNames().clickEvent) {
             if (!video->canPlay()) {
-                video->pause(ec);
+                video->pause();
                 event->setDefaultHandled();
             }
         } else if (event->type() == eventNames().dblclickEvent) {
             if (video->canPlay()) {
-                video->play(ec);
+                video->play();
+                event->setDefaultHandled();
+            }
+        }
+    }
+
+    if (event->type() == eventNames().keydownEvent && event->isKeyboardEvent()) {
+        HTMLVideoElement* video = 0;
+        if (targetNode) {
+            if (targetNode->hasTagName(videoTag))
+                video = static_cast<HTMLVideoElement*>(targetNode);
+            else {
+                RefPtr<NodeList> nodeList = targetNode->getElementsByTagName("video");
+                if (nodeList.get()->length() > 0)
+                    video = static_cast<HTMLVideoElement*>(nodeList.get()->item(0));
+            }
+        }
+        if (video) {
+            KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+            if (keyboardEvent->keyIdentifier() == "U+0020") { // space
+                if (video->paused()) {
+                    if (video->canPlay())
+                        video->play();
+                } else
+                    video->pause();
                 event->setDefaultHandled();
             }
         }
     }
 }
 
+void MediaDocument::mediaElementSawUnsupportedTracks()
+{
+    // The HTMLMediaElement was told it has something that the underlying 
+    // MediaPlayer cannot handle so we should switch from <video> to <embed> 
+    // and let the plugin handle this. Don't do it immediately as this 
+    // function may be called directly from a media engine callback, and 
+    // replaceChild will destroy the element, media player, and media engine.
+    m_replaceMediaElementTimer.startOneShot(0);
+}
+
+void MediaDocument::replaceMediaElementTimerFired(Timer<MediaDocument>*)
+{
+    HTMLElement* htmlBody = body();
+    if (!htmlBody)
+        return;
+
+    // Set body margin width and height to 0 as that is what a PluginDocument uses.
+    htmlBody->setAttribute(marginwidthAttr, "0");
+    htmlBody->setAttribute(marginheightAttr, "0");
+
+    RefPtr<NodeList> nodeList = htmlBody->getElementsByTagName("video");
+
+    if (nodeList.get()->length() > 0) {
+        HTMLVideoElement* videoElement = static_cast<HTMLVideoElement*>(nodeList.get()->item(0));
+
+        RefPtr<Element> element = Document::createElement(embedTag, false);
+        HTMLEmbedElement* embedElement = static_cast<HTMLEmbedElement*>(element.get());
+
+        embedElement->setAttribute(widthAttr, "100%");
+        embedElement->setAttribute(heightAttr, "100%");
+        embedElement->setAttribute(nameAttr, "plugin");
+        embedElement->setSrc(url().string());
+        embedElement->setType(frame()->loader()->responseMIMEType());
+
+        ExceptionCode ec;
+        videoElement->parent()->replaceChild(embedElement, videoElement, ec);
+    }
+}
+
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/MediaDocument.h b/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
index e5167e4e7d..ac286f0af6 100644
--- a/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
@@ -41,11 +41,17 @@ public:
 
     virtual void defaultEventHandler(Event*);
 
+    void mediaElementSawUnsupportedTracks();
+
 private:
     MediaDocument(Frame*);
+    virtual ~MediaDocument();
+    Timer<MediaDocument> m_replaceMediaElementTimer;
 
     virtual bool isMediaDocument() const { return true; }        
     virtual Tokenizer* createTokenizer();
+
+    void replaceMediaElementTimerFired(Timer<MediaDocument>*);
 };
     
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp b/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp
index e12ed07e3e..9d0e81b4f2 100644
--- a/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp
@@ -119,6 +119,11 @@ void NetscapePlugInStreamLoader::didCancel(const ResourceError& error)
 
     m_client->didFail(this, error);
 
+    // If calling didFail spins the run loop the stream loader can reach the terminal state.
+    // If that's the case we just return early.
+    if (reachedTerminalState())
+        return;
+    
     // We need to remove the stream loader after the call to didFail, since didFail can 
     // spawn a new run loop and if the loader has been removed it won't be deferred when
     // the document loader is asked to defer loading.
diff --git a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
index 42c801ca94..373126faca 100644
--- a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
@@ -49,7 +49,7 @@ public:
     PluginTokenizer(Document* doc) : m_doc(doc), m_embedElement(0) {}
         
 private:
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void stopParsing();
     virtual void finish();
     virtual bool isWaitingForScripts() const;
@@ -63,26 +63,25 @@ private:
     HTMLEmbedElement* m_embedElement;
 };
     
-bool PluginTokenizer::write(const SegmentedString&, bool)
+void PluginTokenizer::write(const SegmentedString&, bool)
 {
     ASSERT_NOT_REACHED();
-    return false;
 }
     
 void PluginTokenizer::createDocumentStructure()
 {
     ExceptionCode ec;
-    RefPtr<Element> rootElement = m_doc->createElementNS(xhtmlNamespaceURI, "html", ec);
+    RefPtr<Element> rootElement = m_doc->createElement(htmlTag, false);
     m_doc->appendChild(rootElement, ec);
-        
-    RefPtr<Element> body = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+
+    RefPtr<Element> body = m_doc->createElement(bodyTag, false);
     body->setAttribute(marginwidthAttr, "0");
     body->setAttribute(marginheightAttr, "0");
     body->setAttribute(bgcolorAttr, "rgb(38,38,38)");
 
     rootElement->appendChild(body, ec);
         
-    RefPtr<Element> embedElement = m_doc->createElementNS(xhtmlNamespaceURI, "embed", ec);
+    RefPtr<Element> embedElement = m_doc->createElement(embedTag, false);
         
     m_embedElement = static_cast<HTMLEmbedElement*>(embedElement.get());
     m_embedElement->setAttribute(widthAttr, "100%");
diff --git a/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp b/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
index 56aa976d82..e682b9b867 100644
--- a/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
@@ -26,11 +26,12 @@
 #include "config.h"
 #include "ProgressTracker.h"
 
+#include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "ResourceResponse.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 using std::min;
 
@@ -196,8 +197,11 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
     else
         percentOfRemainingBytes = 1.0;
     
-    // Treat the first layout as the half-way point.
-    double maxProgressValue = m_originatingProgressFrame->loader()->firstLayoutDone() ? finalProgressValue : .5;
+    // For documents that use WebCore's layout system, treat first layout as the half-way point.
+    // FIXME: The hasHTMLView function is a sort of roundabout way of asking "do you use WebCore's layout system".
+    bool useClampedMaxProgress = m_originatingProgressFrame->loader()->client()->hasHTMLView()
+        && !m_originatingProgressFrame->loader()->firstLayoutDone();
+    double maxProgressValue = useClampedMaxProgress ? 0.5 : finalProgressValue;
     increment = (maxProgressValue - m_progressValue) * percentOfRemainingBytes;
     m_progressValue += increment;
     m_progressValue = min(m_progressValue, maxProgressValue);
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
index 3bac2a7556..e2fc7ba3ed 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
@@ -64,9 +64,6 @@ ResourceLoader::ResourceLoader(Frame* frame, bool sendResourceLoadCallbacks, boo
     , m_shouldContentSniff(shouldContentSniff)
     , m_shouldBufferData(true)
     , m_defersLoading(frame->page()->defersLoading())
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    , m_wasLoadedFromApplicationCache(false)
-#endif
 {
 }
 
@@ -122,10 +119,8 @@ bool ResourceLoader::load(const ResourceRequest& r)
         return true;
     
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (m_documentLoader->scheduleApplicationCacheLoad(this, clientRequest, r.url())) {
-        m_wasLoadedFromApplicationCache = true;
+    if (m_documentLoader->scheduleApplicationCacheLoad(this, clientRequest, r.url()))
         return true;
-    }
 #endif
 
     if (m_defersLoading) {
@@ -200,7 +195,6 @@ bool ResourceLoader::scheduleLoadFallbackResourceFromApplicationCache(Applicatio
 {
     if (documentLoader()->scheduleLoadFallbackResourceFromApplicationCache(this, m_request, cache)) {
         handle()->cancel();
-        m_wasLoadedFromApplicationCache = true;
         return true;
     }
     return false;
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
index 83e56f5c0c..d3e7b80163 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
@@ -106,6 +106,9 @@ namespace WebCore {
 #if PLATFORM(MAC)
         virtual NSCachedURLResponse* willCacheResponse(ResourceHandle*, NSCachedURLResponse*);
 #endif
+#if USE(CFNETWORK)
+        virtual bool shouldCacheResponse(ResourceHandle*, CFCachedURLResponseRef);
+#endif
 
         ResourceHandle* handle() const { return m_handle.get(); }
         bool sendResourceLoadCallbacks() const { return m_sendResourceLoadCallbacks; }
@@ -146,9 +149,6 @@ namespace WebCore {
         bool m_shouldContentSniff;
         bool m_shouldBufferData;
         bool m_defersLoading;
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        bool m_wasLoadedFromApplicationCache;
-#endif
         ResourceRequest m_deferredRequest;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
index 4a339ef8aa..047cc6d00b 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
@@ -66,7 +66,7 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
         return 0;
 
     FrameLoader* fl = frame->loader();
-    if (!skipCanLoadCheck && fl->state() == FrameStateProvisional)
+    if (!skipCanLoadCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
         return 0;
 
     ResourceRequest newRequest = request;
@@ -222,6 +222,13 @@ void SubresourceLoader::didCancel(const ResourceError& error)
     
     if (cancelled())
         return;
+    
+    // The only way the subresource loader can reach the terminal state here is if the run loop spins when calling
+    // m_client->didFail. This should in theory not happen which is why the assert is here. 
+    ASSERT(!reachedTerminalState());
+    if (reachedTerminalState())
+        return;
+    
     m_documentLoader->removeSubresourceLoader(this);
     ResourceLoader::didCancel(error);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
index 1a94c73b71..0fce930412 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
@@ -33,7 +33,7 @@
  
 namespace WebCore {
 
-    class ResourceRequest;
+    struct ResourceRequest;
     class SubresourceLoaderClient;
     
     class SubresourceLoader : public ResourceLoader {
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
index 4e14deac2a..acf8e6afea 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
 class AuthenticationChallenge;
 class ResourceError;
-class ResourceRequest;
+struct ResourceRequest;
 class ResourceResponse;
 class SubresourceLoader;
     
@@ -46,7 +46,7 @@ public:
     virtual void didSendData(SubresourceLoader*, unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
 
     virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&) { }
-    virtual void didReceiveData(SubresourceLoader*, const char*, int) { }
+    virtual void didReceiveData(SubresourceLoader*, const char*, int /*lengthReceived*/) { }
     virtual void didFinishLoading(SubresourceLoader*) { }
     virtual void didFail(SubresourceLoader*, const ResourceError&) { }
     
diff --git a/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp b/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp
index bd2c446053..0d86c1b5dd 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp
@@ -41,9 +41,10 @@ using namespace HTMLNames;
 class TextTokenizer : public Tokenizer {
 public:
     TextTokenizer(Document*);
+    virtual ~TextTokenizer();
     TextTokenizer(HTMLViewSourceDocument*);
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     virtual bool isWaitingForScripts() const;
     
@@ -91,9 +92,15 @@ TextTokenizer::TextTokenizer(HTMLViewSourceDocument* doc)
     m_size = 254;
     m_buffer = static_cast<UChar*>(fastMalloc(sizeof(UChar) * m_size));
     m_dest = m_buffer;
-}    
+}
+
+TextTokenizer::~TextTokenizer()
+{
+    // finish() should have been called to prevent any leaks
+    ASSERT(!m_buffer);
+}
 
-bool TextTokenizer::write(const SegmentedString& s, bool)
+void TextTokenizer::write(const SegmentedString& s, bool)
 {
     ExceptionCode ec;
 
@@ -125,13 +132,13 @@ bool TextTokenizer::write(const SegmentedString& s, bool)
     }
 
     if (!m_preElement && !inViewSourceMode()) {
-        RefPtr<Element> rootElement = m_doc->createElementNS(xhtmlNamespaceURI, "html", ec);
+        RefPtr<Element> rootElement = m_doc->createElement(htmlTag, false);
         m_doc->appendChild(rootElement, ec);
 
-        RefPtr<Element> body = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+        RefPtr<Element> body = m_doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
 
-        RefPtr<Element> preElement = m_doc->createElementNS(xhtmlNamespaceURI, "pre", ec);
+        RefPtr<Element> preElement = m_doc->createElement(preTag, false);
         preElement->setAttribute("style", "word-wrap: break-word; white-space: pre-wrap;", ec);
 
         body->appendChild(preElement, ec);
@@ -142,7 +149,7 @@ bool TextTokenizer::write(const SegmentedString& s, bool)
     String string = String(m_buffer, m_dest - m_buffer);
     if (inViewSourceMode()) {
         static_cast<HTMLViewSourceDocument*>(m_doc)->addViewSourceText(string);
-        return false;
+        return;
     }
 
     unsigned charsLeft = string.length();
@@ -151,15 +158,15 @@ bool TextTokenizer::write(const SegmentedString& s, bool)
         RefPtr<Text> text = Text::createWithLengthLimit(m_doc, string, charsLeft);
         m_preElement->appendChild(text, ec);
     }
-
-    return false;
 }
 
 void TextTokenizer::finish()
 {
     m_preElement = 0;
     fastFree(m_buffer);
-        
+    m_buffer = 0;
+    m_dest = 0;
+
     m_doc->finishedParsing();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
index f37d8f71b2..ee81326343 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 1999 Lars Knoll (knoll@mpi-hd.mpg.de)
-    Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
     Copyright (C) 2005, 2006, 2007 Alexey Proskuryakov (ap@nypop.com)
 
     This library is free software; you can redistribute it and/or
@@ -26,6 +26,9 @@
 #include "DOMImplementation.h"
 #include "HTMLNames.h"
 #include "TextCodec.h"
+#include "TextEncoding.h"
+#include "TextEncodingDetector.h"
+#include "TextEncodingRegistry.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/StringExtras.h>
 
@@ -320,14 +323,17 @@ const TextEncoding& TextResourceDecoder::defaultEncoding(ContentType contentType
     return specifiedDefaultEncoding;
 }
 
-TextResourceDecoder::TextResourceDecoder(const String& mimeType, const TextEncoding& specifiedDefaultEncoding)
+TextResourceDecoder::TextResourceDecoder(const String& mimeType, const TextEncoding& specifiedDefaultEncoding, bool usesEncodingDetector)
     : m_contentType(determineContentType(mimeType))
-    , m_decoder(defaultEncoding(m_contentType, specifiedDefaultEncoding))
+    , m_encoding(defaultEncoding(m_contentType, specifiedDefaultEncoding))
     , m_source(DefaultEncoding)
+    , m_hintEncoding(0)
     , m_checkedForBOM(false)
     , m_checkedForCSSCharset(false)
     , m_checkedForHeadCharset(false)
+    , m_useLenientXMLDecoding(false)
     , m_sawError(false)
+    , m_usesEncodingDetector(usesEncodingDetector)
 {
 }
 
@@ -344,12 +350,13 @@ void TextResourceDecoder::setEncoding(const TextEncoding& encoding, EncodingSour
     // When encoding comes from meta tag (i.e. it cannot be XML files sent via XHR),
     // treat x-user-defined as windows-1252 (bug 18270)
     if (source == EncodingFromMetaTag && strcasecmp(encoding.name(), "x-user-defined") == 0)
-        m_decoder.reset("windows-1252"); 
+        m_encoding = "windows-1252";
     else if (source == EncodingFromMetaTag || source == EncodingFromXMLHeader || source == EncodingFromCSSCharset)        
-        m_decoder.reset(encoding.closestByteBasedEquivalent());
+        m_encoding = encoding.closestByteBasedEquivalent();
     else
-        m_decoder.reset(encoding);
+        m_encoding = encoding;
 
+    m_codec.clear();
     m_source = source;
 }
 
@@ -401,51 +408,54 @@ static inline bool skipWhitespace(const char*& pos, const char* dataEnd)
     return pos != dataEnd;
 }
 
-void TextResourceDecoder::checkForBOM(const char* data, size_t len)
+size_t TextResourceDecoder::checkForBOM(const char* data, size_t len)
 {
     // Check for UTF-16/32 or UTF-8 BOM mark at the beginning, which is a sure sign of a Unicode encoding.
+    // We let it override even a user-chosen encoding.
+    ASSERT(!m_checkedForBOM);
 
-    if (m_source == UserChosenEncoding) {
-        // FIXME: Maybe a BOM should override even a user-chosen encoding.
-        m_checkedForBOM = true;
-        return;
-    }
+    size_t lengthOfBOM = 0;
 
-    // Check if we have enough data.
     size_t bufferLength = m_buffer.size();
-    if (bufferLength + len < 4)
-        return;
-
-    m_checkedForBOM = true;
 
-    // Extract the first four bytes.
-    // Handle the case where some of bytes are already in the buffer.
-    // The last byte is always guaranteed to not be in the buffer.
-    const unsigned char* udata = reinterpret_cast<const unsigned char*>(data);
-    unsigned char c1 = bufferLength >= 1 ? m_buffer[0] : *udata++;
-    unsigned char c2 = bufferLength >= 2 ? m_buffer[1] : *udata++;
-    unsigned char c3 = bufferLength >= 3 ? m_buffer[2] : *udata++;
-    ASSERT(bufferLength < 4);
-    unsigned char c4 = *udata;
+    size_t buf1Len = bufferLength;
+    size_t buf2Len = len;
+    const unsigned char* buf1 = reinterpret_cast<const unsigned char*>(m_buffer.data());
+    const unsigned char* buf2 = reinterpret_cast<const unsigned char*>(data);
+    unsigned char c1 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
+    unsigned char c2 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
+    unsigned char c3 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
+    unsigned char c4 = buf2Len ? (--buf2Len, *buf2++) : 0;
 
     // Check for the BOM.
     if (c1 == 0xFF && c2 == 0xFE) {
-        if (c3 !=0 || c4 != 0)
+        if (c3 != 0 || c4 != 0) {
             setEncoding(UTF16LittleEndianEncoding(), AutoDetectedEncoding);
-        else 
+            lengthOfBOM = 2;
+        } else {
             setEncoding(UTF32LittleEndianEncoding(), AutoDetectedEncoding);
-    }
-    else if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF)
+            lengthOfBOM = 4;
+        }
+    } else if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF) {
         setEncoding(UTF8Encoding(), AutoDetectedEncoding);
-    else if (c1 == 0xFE && c2 == 0xFF)
+        lengthOfBOM = 3;
+    } else if (c1 == 0xFE && c2 == 0xFF) {
         setEncoding(UTF16BigEndianEncoding(), AutoDetectedEncoding);
-    else if (c1 == 0 && c2 == 0 && c3 == 0xFE && c4 == 0xFF)
+        lengthOfBOM = 2;
+    } else if (c1 == 0 && c2 == 0 && c3 == 0xFE && c4 == 0xFF) {
         setEncoding(UTF32BigEndianEncoding(), AutoDetectedEncoding);
+        lengthOfBOM = 4;
+    }
+
+    if (lengthOfBOM || bufferLength + len >= 4)
+        m_checkedForBOM = true;
+
+    return lengthOfBOM;
 }
 
 bool TextResourceDecoder::checkForCSSCharset(const char* data, size_t len, bool& movedDataToBuffer)
 {
-    if (m_source != DefaultEncoding) {
+    if (m_source != DefaultEncoding && m_source != EncodingFromParentFrame) {
         m_checkedForCSSCharset = true;
         return true;
     }
@@ -526,7 +536,7 @@ const int bytesToCheckUnconditionally = 1024; // That many input bytes will be c
 
 bool TextResourceDecoder::checkForHeadCharset(const char* data, size_t len, bool& movedDataToBuffer)
 {
-    if (m_source != DefaultEncoding) {
+    if (m_source != DefaultEncoding && m_source != EncodingFromParentFrame) {
         m_checkedForHeadCharset = true;
         return true;
     }
@@ -636,7 +646,7 @@ bool TextResourceDecoder::checkForHeadCharset(const char* data, size_t len, bool
                     ptr++;
                     continue;
                 }
-                if (c >= 'a' && c <= 'z' || c >= '0' && c <= '9')
+                if ((c >= 'a' && c <= 'z') || (c >= '0' && c <= '9'))
                     ;
                 else if (c >= 'A' && c <= 'Z')
                     c += 'a' - 'A';
@@ -695,8 +705,8 @@ bool TextResourceDecoder::checkForHeadCharset(const char* data, size_t len, bool
                         break;
                     if (str[pos++] != '=')
                         continue;
-                    while (pos < length &&
-                            (str[pos] <= ' ') || str[pos] == '=' || str[pos] == '"' || str[pos] == '\'')
+                    while ((pos < length) &&
+                            (str[pos] <= ' ' || str[pos] == '=' || str[pos] == '"' || str[pos] == '\''))
                         pos++;
 
                     // end ?
@@ -753,10 +763,28 @@ void TextResourceDecoder::detectJapaneseEncoding(const char* data, size_t len)
     }
 }
 
+// We use the encoding detector in two cases:
+//   1. Encoding detector is turned ON and no other encoding source is
+//      available (that is, it's DefaultEncoding).
+//   2. Encoding detector is turned ON and the encoding is set to
+//      the encoding of the parent frame, which is also auto-detected.
+//   Note that condition #2 is NOT satisfied unless parent-child frame
+//   relationship is compliant to the same-origin policy. If they're from
+//   different domains, |m_source| would not be set to EncodingFromParentFrame
+//   in the first place. 
+bool TextResourceDecoder::shouldAutoDetect() const
+{
+    // Just checking m_hintEncoding suffices here because it's only set
+    // in setHintEncoding when the source is AutoDetectedEncoding.
+    return m_usesEncodingDetector
+        && (m_source == DefaultEncoding || (m_source == EncodingFromParentFrame && m_hintEncoding)); 
+}
+
 String TextResourceDecoder::decode(const char* data, size_t len)
 {
+    size_t lengthOfBOM = 0;
     if (!m_checkedForBOM)
-        checkForBOM(data, len);
+        lengthOfBOM = checkForBOM(data, len);
 
     bool movedDataToBuffer = false;
 
@@ -768,15 +796,32 @@ String TextResourceDecoder::decode(const char* data, size_t len)
         if (!checkForHeadCharset(data, len, movedDataToBuffer))
             return "";
 
-    // Do the auto-detect if our default encoding is one of the Japanese ones.
-    // FIXME: It seems wrong to change our encoding downstream after we have already done some decoding.
-    if (m_source != UserChosenEncoding && m_source != AutoDetectedEncoding && encoding().isJapanese())
+    // FIXME: It seems wrong to change our encoding downstream after
+    // we have already done some decoding. However, it's not possible
+    // to avoid in a sense in two cases below because triggering conditions
+    // for both cases depend on the information that won't be available
+    // until we do partial read. 
+    // The first case had better be removed altogether (see bug 21990)
+    // or at least be made to be invoked only when the encoding detection
+    // is turned on. 
+    // Do the auto-detect 1) using Japanese detector if our default encoding is
+    // one of the Japanese detector or 2) using detectTextEncoding if encoding
+    // detection is turned on.
+    if (m_source != UserChosenEncoding && m_source != AutoDetectedEncoding && m_encoding.isJapanese())
         detectJapaneseEncoding(data, len);
+    else if (shouldAutoDetect()) {
+        TextEncoding detectedEncoding;
+        if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
+            setEncoding(detectedEncoding, AutoDetectedEncoding);
+    }
+
+    ASSERT(m_encoding.isValid());
 
-    ASSERT(encoding().isValid());
+    if (!m_codec)
+        m_codec.set(newTextCodec(m_encoding).release());
 
     if (m_buffer.isEmpty())
-        return m_decoder.decode(data, len, false, m_contentType == XML, m_sawError);
+        return m_codec->decode(data + lengthOfBOM, len - lengthOfBOM, false, m_contentType == XML, m_sawError);
 
     if (!movedDataToBuffer) {
         size_t oldSize = m_buffer.size();
@@ -784,16 +829,31 @@ String TextResourceDecoder::decode(const char* data, size_t len)
         memcpy(m_buffer.data() + oldSize, data, len);
     }
 
-    String result = m_decoder.decode(m_buffer.data(), m_buffer.size(), false, m_contentType == XML, m_sawError);
+    String result = m_codec->decode(m_buffer.data() + lengthOfBOM, m_buffer.size() - lengthOfBOM, false, m_contentType == XML && !m_useLenientXMLDecoding, m_sawError);
     m_buffer.clear();
     return result;
 }
 
 String TextResourceDecoder::flush()
 {
-    String result = m_decoder.decode(m_buffer.data(), m_buffer.size(), true, m_contentType == XML, m_sawError);
+   // If we can not identify the encoding even after a document is completely
+   // loaded, we need to detect the encoding if other conditions for
+   // autodetection is satisfied.
+    if (m_buffer.size() && shouldAutoDetect()
+        && ((!m_checkedForHeadCharset && (m_contentType == HTML || m_contentType == XML)) || (!m_checkedForCSSCharset && (m_contentType == CSS)))) {
+         TextEncoding detectedEncoding;
+         if (detectTextEncoding(m_buffer.data(), m_buffer.size(),
+                                m_hintEncoding, &detectedEncoding))
+             setEncoding(detectedEncoding, AutoDetectedEncoding);
+    }
+
+    if (!m_codec)
+        m_codec.set(newTextCodec(m_encoding).release());
+
+    String result = m_codec->decode(m_buffer.data(), m_buffer.size(), true, m_contentType == XML && !m_useLenientXMLDecoding, m_sawError);
     m_buffer.clear();
-    m_decoder.reset(m_decoder.encoding());
+    m_codec.clear();
+    m_checkedForBOM = false; // Skip BOM again when re-decoding.
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h
index 8bbe85e3c4..fb755c9664 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h
+++ b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h
@@ -23,7 +23,7 @@
 #ifndef TextResourceDecoder_h
 #define TextResourceDecoder_h
 
-#include "TextDecoder.h"
+#include "TextEncoding.h"
 
 namespace WebCore {
 
@@ -36,43 +36,59 @@ public:
         EncodingFromMetaTag,
         EncodingFromCSSCharset,
         EncodingFromHTTPHeader,
-        UserChosenEncoding
+        UserChosenEncoding,
+        EncodingFromParentFrame
     };
 
-    static PassRefPtr<TextResourceDecoder> create(const String& mimeType, const TextEncoding& defaultEncoding = TextEncoding())
+    static PassRefPtr<TextResourceDecoder> create(const String& mimeType, const TextEncoding& defaultEncoding = TextEncoding(), bool usesEncodingDetector = false)
     {
-        return adoptRef(new TextResourceDecoder(mimeType, defaultEncoding));
+        return adoptRef(new TextResourceDecoder(mimeType, defaultEncoding, usesEncodingDetector));
     }
     ~TextResourceDecoder();
 
     void setEncoding(const TextEncoding&, EncodingSource);
-    const TextEncoding& encoding() const { return m_decoder.encoding(); }
+    const TextEncoding& encoding() const { return m_encoding; }
 
     String decode(const char* data, size_t length);
     String flush();
-    
+
+    void setHintEncoding(const TextResourceDecoder* hintDecoder)
+    {
+        // hintEncoding is for use with autodetection, which should be 
+        // only invoked when hintEncoding comes from auto-detection.
+        if (hintDecoder && hintDecoder->m_source == AutoDetectedEncoding)
+            m_hintEncoding = hintDecoder->encoding().name();
+    }
+   
+    void useLenientXMLDecoding() { m_useLenientXMLDecoding = true; }
     bool sawError() const { return m_sawError; }
 
 private:
-    TextResourceDecoder(const String& mimeType, const TextEncoding& defaultEncoding);
+    TextResourceDecoder(const String& mimeType, const TextEncoding& defaultEncoding,
+                        bool usesEncodingDetector);
 
-    enum ContentType { PlainText, HTML, XML, CSS }; // PlainText is equivalent to directly using TextDecoder.
+    enum ContentType { PlainText, HTML, XML, CSS }; // PlainText only checks for BOM.
     static ContentType determineContentType(const String& mimeType);
     static const TextEncoding& defaultEncoding(ContentType, const TextEncoding& defaultEncoding);
 
-    void checkForBOM(const char*, size_t);
+    size_t checkForBOM(const char*, size_t);
     bool checkForCSSCharset(const char*, size_t, bool& movedDataToBuffer);
     bool checkForHeadCharset(const char*, size_t, bool& movedDataToBuffer);
     void detectJapaneseEncoding(const char*, size_t);
+    bool shouldAutoDetect() const;
 
     ContentType m_contentType;
-    TextDecoder m_decoder;
+    TextEncoding m_encoding;
+    OwnPtr<TextCodec> m_codec;
     EncodingSource m_source;
+    const char* m_hintEncoding;
     Vector<char> m_buffer;
     bool m_checkedForBOM;
     bool m_checkedForCSSCharset;
     bool m_checkedForHeadCharset;
+    bool m_useLenientXMLDecoding; // Don't stop on XML decoding errors.
     bool m_sawError;
+    bool m_usesEncodingDetector;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
new file mode 100644
index 0000000000..3927624216
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ThreadableLoader.h"
+
+#include "ScriptExecutionContext.h"
+#include "Document.h"
+#include "DocumentThreadableLoader.h"
+#include "WorkerContext.h"
+#include "WorkerRunLoop.h"
+#include "WorkerThreadableLoader.h"
+
+namespace WebCore {
+
+PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials) 
+{
+    ASSERT(client);
+    ASSERT(context);
+
+#if ENABLE(WORKERS)
+    if (context->isWorkerContext())
+        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials);
+#endif // ENABLE(WORKERS)
+
+    ASSERT(context->isDocument());
+    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials);
+}
+
+void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+{
+    ASSERT(context);
+
+#if ENABLE(WORKERS)
+    if (context->isWorkerContext()) {
+        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials);
+        return;
+    }
+#endif // ENABLE(WORKERS)
+
+    ASSERT(context->isDocument());
+    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, storedCredentials);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
new file mode 100644
index 0000000000..b0cff7dd1c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableLoader_h
+#define ThreadableLoader_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class ResourceError;
+    struct ResourceRequest;
+    class ResourceResponse;
+    class ScriptExecutionContext;
+    class ThreadableLoaderClient;
+
+    enum LoadCallbacks {
+        SendLoadCallbacks,
+        DoNotSendLoadCallbacks
+    };
+
+    enum ContentSniff {
+        SniffContent,
+        DoNotSniffContent
+    };
+
+    enum StoredCredentials {
+        AllowStoredCredentials,
+        DoNotAllowStoredCredentials
+    };
+
+    // Useful for doing loader operations from any thread (not threadsafe, 
+    // just able to run on threads other than the main thread).
+    class ThreadableLoader : Noncopyable {
+    public:
+        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
+        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+
+        virtual void cancel() = 0;
+        void ref() { refThreadableLoader(); }
+        void deref() { derefThreadableLoader(); }
+
+    protected:
+        virtual ~ThreadableLoader() { }
+        virtual void refThreadableLoader() = 0;
+        virtual void derefThreadableLoader() = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ThreadableLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h
new file mode 100644
index 0000000000..93a8e869df
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableLoaderClient_h
+#define ThreadableLoaderClient_h
+
+namespace WebCore {
+
+    class ResourceError;
+    class ResourceResponse;
+
+    class ThreadableLoaderClient {
+    public:
+        virtual void didSendData(unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
+
+        virtual void didReceiveResponse(const ResourceResponse&) { }
+        virtual void didReceiveData(const char*, int /*lengthReceived*/) { }
+        virtual void didFinishLoading(unsigned long /*identifier*/) { }
+        virtual void didFail(const ResourceError&) { }
+        virtual void didFailRedirectCheck() { }
+
+        virtual void didReceiveAuthenticationCancellation(const ResourceResponse&) { }
+
+    protected:
+        virtual ~ThreadableLoaderClient() { }
+    };
+
+} // namespace WebCore
+
+#endif // ThreadableLoaderClient_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClientWrapper.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClientWrapper.h
new file mode 100644
index 0000000000..d3c1a9feea
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClientWrapper.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableLoaderClientWrapper_h
+#define ThreadableLoaderClientWrapper_h
+
+#include "ThreadableLoaderClient.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class ThreadableLoaderClientWrapper : public ThreadSafeShared<ThreadableLoaderClientWrapper> {
+    public:
+        static PassRefPtr<ThreadableLoaderClientWrapper> create(ThreadableLoaderClient* client)
+        {
+            return adoptRef(new ThreadableLoaderClientWrapper(client));
+        }
+
+        void clearClient()
+        {
+            m_done = true;
+            m_client = 0;
+        }
+
+        bool done() const
+        {
+            return m_done;
+        }
+
+        void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+        {
+            if (m_client)
+                m_client->didSendData(bytesSent, totalBytesToBeSent);
+        }
+
+        void didReceiveResponse(const ResourceResponse& response)
+        {
+            if (m_client)
+                m_client->didReceiveResponse(response);
+        }
+
+        void didReceiveData(const char* data, int lengthReceived)
+        {
+            if (m_client)
+                m_client->didReceiveData(data, lengthReceived);
+        }
+
+        void didFinishLoading(unsigned long identifier)
+        {
+            m_done = true;
+            if (m_client)
+                m_client->didFinishLoading(identifier);
+        }
+
+        void didFail(const ResourceError& error)
+        {
+            m_done = true;
+            if (m_client)
+                m_client->didFail(error);
+        }
+
+        void didFailRedirectCheck()
+        {
+            m_done = true;
+            if (m_client)
+                m_client->didFailRedirectCheck();
+        }
+
+        void didReceiveAuthenticationCancellation(const ResourceResponse& response)
+        {
+            if (m_client)
+                m_client->didReceiveResponse(response);
+        }
+
+    protected:
+        ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
+            : m_client(client)
+            , m_done(false)
+        {
+        }
+
+        ThreadableLoaderClient* m_client;
+        bool m_done;
+    };
+
+} // namespace WebCore
+
+#endif // ThreadableLoaderClientWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
new file mode 100644
index 0000000000..beaf061d04
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
@@ -0,0 +1,261 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "WorkerThreadableLoader.h"
+
+#include "GenericWorkerTask.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "ThreadableLoader.h"
+#include "WorkerContext.h"
+#include "WorkerMessagingProxy.h"
+#include "WorkerThread.h"
+#include <memory>
+#include <wtf/OwnPtr.h>
+#include <wtf/Threading.h>
+#include <wtf/Vector.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMode";
+
+// FIXME: The assumption that we can upcast worker object proxy to WorkerMessagingProxy will not be true in multi-process implementation.
+WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting,
+                                               ContentSniff contentSniff, StoredCredentials storedCredentials)
+    : m_workerContext(workerContext)
+    , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, *(static_cast<WorkerMessagingProxy*>(m_workerContext->thread()->workerObjectProxy())), taskMode, request, callbacksSetting,
+                                      contentSniff, storedCredentials)))
+{
+}
+
+WorkerThreadableLoader::~WorkerThreadableLoader()
+{
+    m_bridge.destroy();
+}
+
+void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+{
+    WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
+
+    // Create a unique mode just for this synchronous resource load.
+    String mode = loadResourceSynchronouslyMode;
+    mode.append(String::number(runLoop.createUniqueId()));
+
+    ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
+    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials);
+
+    MessageQueueWaitResult result = MessageQueueMessageReceived;
+    while (!loader->done() && result != MessageQueueTerminated)
+        result = runLoop.runInMode(workerContext, mode);
+
+    if (!loader->done() && result == MessageQueueTerminated)
+        loader->cancel();
+}
+
+void WorkerThreadableLoader::cancel()
+{
+    m_bridge.cancel();
+}
+
+WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerMessagingProxy& messagingProxy, const String& taskMode,
+                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+    : m_workerClientWrapper(workerClientWrapper)
+    , m_messagingProxy(messagingProxy)
+    , m_taskMode(taskMode.copy())
+{
+    ASSERT(m_workerClientWrapper.get());
+    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials));
+}
+
+WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
+{
+}
+
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+{
+    // FIXME: This assert fails for nested workers.  Removing the assert would allow it to work,
+    // but then there would be one WorkerThreadableLoader in every intermediate worker simply
+    // chaining the requests, which is not very good. Instead, the postTaskToWorkerObject should be a
+    // postTaskToDocumentContext.
+    ASSERT(isMainThread());
+    ASSERT(context->isDocument());
+
+    if (thisPtr->m_messagingProxy.askedToTerminate())
+        return;
+
+    // FIXME: the created loader has no knowledge of the origin of the worker doing the load request.
+    // Basically every setting done in SubresourceLoader::create (including the contents of addExtraFieldsToRequest)
+    // needs to be examined for how it should take into account a different originator.
+    OwnPtr<ResourceRequest> request(ResourceRequest::adopt(requestData));
+    // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
+    // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
+    // a failure.
+    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials);
+    ASSERT(thisPtr->m_mainThreadLoader);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::mainThreadDestroy(ScriptExecutionContext* context, MainThreadBridge* thisPtr)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+    delete thisPtr;
+}
+
+void WorkerThreadableLoader::MainThreadBridge::destroy()
+{
+    // Ensure that no more client callbacks are done in the worker context's thread.
+    clearClientWrapper();
+
+    // "delete this" and m_mainThreadLoader::deref() on the worker object's thread.
+    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadDestroy, this));
+}
+
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCancel(ScriptExecutionContext* context, MainThreadBridge* thisPtr)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+
+    if (!thisPtr->m_mainThreadLoader)
+        return;
+    thisPtr->m_mainThreadLoader->cancel();
+    thisPtr->m_mainThreadLoader = 0;
+}
+
+void WorkerThreadableLoader::MainThreadBridge::cancel()
+{
+    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
+    ThreadableLoaderClientWrapper* clientWrapper = static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get());
+    if (!clientWrapper->done()) {
+        // If the client hasn't reached a termination state, then transition it by sending a cancellation error.
+        // Note: no more client callbacks will be done after this method -- the clearClientWrapper() call ensures that.
+        ResourceError error(String(), 0, String(), String());
+        error.setIsCancellation(true);
+        clientWrapper->didFail(error);
+    }
+    clearClientWrapper();
+}
+
+void WorkerThreadableLoader::MainThreadBridge::clearClientWrapper()
+{
+    static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get())->clearClient();
+}
+
+static void workerContextDidSendData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didSendData(bytesSent, totalBytesToBeSent);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSendData, m_workerClientWrapper, bytesSent, totalBytesToBeSent), m_taskMode);
+}
+
+static void workerContextDidReceiveResponse(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    OwnPtr<ResourceResponse> response(ResourceResponse::adopt(responseData));
+    workerClientWrapper->didReceiveResponse(*response);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didReceiveResponse(const ResourceResponse& response)
+{
+    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveResponse, m_workerClientWrapper, response), m_taskMode);
+}
+
+static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<Vector<char> > vectorData)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didReceiveData(vectorData->data(), vectorData->size());
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didReceiveData(const char* data, int lengthReceived)
+{
+    auto_ptr<Vector<char> > vector(new Vector<char>(lengthReceived)); // needs to be an auto_ptr for usage with createCallbackTask.
+    memcpy(vector->data(), data, lengthReceived);
+    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector), m_taskMode);
+}
+
+static void workerContextDidFinishLoading(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long identifier)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didFinishLoading(identifier);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didFinishLoading(unsigned long identifier)
+{
+    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFinishLoading, m_workerClientWrapper, identifier), m_taskMode);
+}
+
+static void workerContextDidFail(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, const ResourceError& error)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didFail(error);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didFail(const ResourceError& error)
+{
+    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFail, m_workerClientWrapper, error), m_taskMode);
+}
+
+static void workerContextDidFailRedirectCheck(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didFailRedirectCheck();
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck()
+{
+    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFailRedirectCheck, m_workerClientWrapper), m_taskMode);
+}
+
+static void workerContextDidReceiveAuthenticationCancellation(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    OwnPtr<ResourceResponse> response(ResourceResponse::adopt(responseData));
+    workerClientWrapper->didReceiveAuthenticationCancellation(*response);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation(const ResourceResponse& response)
+{
+    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveAuthenticationCancellation, m_workerClientWrapper, response), m_taskMode);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
new file mode 100644
index 0000000000..9817fea148
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerThreadableLoader_h
+#define WorkerThreadableLoader_h
+
+#if ENABLE(WORKERS)
+
+#include "PlatformString.h"
+#include "ThreadableLoader.h"
+#include "ThreadableLoaderClient.h"
+#include "ThreadableLoaderClientWrapper.h"
+
+#include <memory>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class ResourceError;
+    struct ResourceRequest;
+    class WorkerContext;
+    class WorkerMessagingProxy;
+    struct CrossThreadResourceResponseData;
+    struct CrossThreadResourceRequestData;
+
+    class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public ThreadableLoader {
+    public:
+        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
+        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+        {
+            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials));
+        }
+
+        ~WorkerThreadableLoader();
+
+        virtual void cancel();
+
+        bool done() const { return m_workerClientWrapper->done(); }
+
+        using RefCounted<WorkerThreadableLoader>::ref;
+        using RefCounted<WorkerThreadableLoader>::deref;
+
+    protected:
+        virtual void refThreadableLoader() { ref(); }
+        virtual void derefThreadableLoader() { deref(); }
+
+    private:
+        // Creates a loader on the main thread and bridges communication between
+        // the main thread and the worker context's thread where WorkerThreadableLoader runs.
+        //
+        // Regarding the bridge and lifetimes of items used in callbacks, there are a few cases:
+        //
+        // all cases. All tasks posted from the worker context's thread are ok because
+        //    the last task posted always is "mainThreadDestroy", so MainThreadBridge is
+        //    around for all tasks that use it on the mian thread.
+        //
+        // case 1. worker.terminate is called.
+        //    In this case, no more tasks are posted from the worker object's thread to the worker
+        //    context's thread -- WorkerMessagingProxy enforces this.
+        //
+        // case 2. xhr gets aborted and the worker context continues running.
+        //    The ThreadableLoaderClientWrapper has the underlying client cleared, so no more calls
+        //    go through it.  All tasks posted from the worker object's thread to the worker context's
+        //    thread do "ThreadableLoaderClientWrapper::ref" (automatically inside of the cross thread copy
+        //    done in createCallbackTask), so the ThreadableLoaderClientWrapper instance is there until all
+        //    tasks are executed.
+        class MainThreadBridge : ThreadableLoaderClient {
+        public:
+            // All executed on the worker context's thread.
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerMessagingProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+            void cancel();
+            void destroy();
+
+        private:
+            // Executed on the worker context's thread.
+            void clearClientWrapper();
+
+            // All executed on the main thread.
+            static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
+            ~MainThreadBridge();
+
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials);
+            static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
+            virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
+            virtual void didReceiveResponse(const ResourceResponse&);
+            virtual void didReceiveData(const char*, int lengthReceived);
+            virtual void didFinishLoading(unsigned long identifier);
+            virtual void didFail(const ResourceError&);
+            virtual void didFailRedirectCheck();
+            virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
+
+            // Only to be used on the main thread.
+            RefPtr<ThreadableLoader> m_mainThreadLoader;
+
+            // ThreadableLoaderClientWrapper is to be used on the worker context thread.
+            // The ref counting is done on either thread.
+            RefPtr<ThreadSafeShared<ThreadableLoaderClientWrapper> > m_workerClientWrapper;
+
+            // May be used on either thread.
+            WorkerMessagingProxy& m_messagingProxy;
+
+            // For use on the main thread.
+            String m_taskMode;
+        };
+
+        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+
+        RefPtr<WorkerContext> m_workerContext;
+        RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
+        MainThreadBridge& m_bridge;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // WorkerThreadableLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
index d7387995ba..42f5b6a5e3 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
@@ -51,10 +51,15 @@ ApplicationCache::~ApplicationCache()
     
 void ApplicationCache::setGroup(ApplicationCacheGroup* group)
 {
-    ASSERT(!m_group);
+    ASSERT(!m_group || group == m_group);
     m_group = group;
 }
 
+bool ApplicationCache::isComplete() const
+{
+    return !m_group->cacheIsBeingUpdated(this);
+}
+
 void ApplicationCache::setManifestResource(PassRefPtr<ApplicationCacheResource> manifest)
 {
     ASSERT(manifest);
@@ -76,6 +81,7 @@ void ApplicationCache::addResource(PassRefPtr<ApplicationCacheResource> resource
     
     if (m_storageID) {
         ASSERT(!resource->storageID());
+        ASSERT(resource->type() & (ApplicationCacheResource::Dynamic | ApplicationCacheResource::Master));
         
         // Add the resource to the storage.
         cacheStorage().store(resource.get(), this);
@@ -105,7 +111,7 @@ ApplicationCacheResource* ApplicationCache::resourceForURL(const String& url)
 
 bool ApplicationCache::requestIsHTTPOrHTTPSGet(const ResourceRequest& request)
 {
-    if (!request.url().protocolIs("http") && !request.url().protocolIs("https"))
+    if (!request.url().protocolInHTTPFamily())
         return false;
     
     if (!equalIgnoringCase(request.httpMethod(), "GET"))
@@ -140,13 +146,13 @@ bool ApplicationCache::addDynamicEntry(const String& url)
     if (!equalIgnoringCase(m_group->manifestURL().protocol(), KURL(url).protocol()))
         return false;
 
-    // FIXME: Implement
+    // FIXME: Implement (be sure to respect private browsing state).
     return true;
 }
     
 void ApplicationCache::removeDynamicEntry(const String&)
 {
-    // FIXME: Implement
+    // FIXME: Implement (be sure to respect private browsing state).
 }
 
 void ApplicationCache::setOnlineWhitelist(const Vector<KURL>& onlineWhitelist)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
index 9bfa16aa08..afdab275c3 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
@@ -41,7 +41,8 @@ class ApplicationCacheGroup;
 class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
-class ResourceRequest;
+
+struct ResourceRequest;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
@@ -58,7 +59,9 @@ public:
     
     void setGroup(ApplicationCacheGroup*);
     ApplicationCacheGroup* group() const { return m_group; }
-    
+
+    bool isComplete() const;
+
     ApplicationCacheResource* resourceForRequest(const ResourceRequest&);
     ApplicationCacheResource* resourceForURL(const String& url);
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index b53787feb7..48d3942ad6 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,10 +46,12 @@ namespace WebCore {
 
 ApplicationCacheGroup::ApplicationCacheGroup(const KURL& manifestURL, bool isCopy)
     : m_manifestURL(manifestURL)
-    , m_status(Idle)
-    , m_savedNewestCachePointer(0)
+    , m_updateStatus(Idle)
+    , m_downloadingPendingMasterResourceLoadersCount(0)
     , m_frame(0)
     , m_storageID(0)
+    , m_isObsolete(false)
+    , m_completionType(None)
     , m_isCopy(isCopy)
 {
 }
@@ -62,7 +64,7 @@ ApplicationCacheGroup::~ApplicationCacheGroup()
         ASSERT(m_caches.contains(m_newestCache.get()));
         ASSERT(!m_cacheBeingUpdated);
         ASSERT(m_associatedDocumentLoaders.isEmpty());
-        ASSERT(m_cacheCandidates.isEmpty());
+        ASSERT(m_pendingMasterResourceLoaders.isEmpty());
         ASSERT(m_newestCache->group() == this);
         
         return;
@@ -83,6 +85,7 @@ ApplicationCache* ApplicationCacheGroup::cacheForMainRequest(const ResourceReque
 
     if (ApplicationCacheGroup* group = cacheStorage().cacheGroupForURL(request.url())) {
         ASSERT(group->newestCache());
+        ASSERT(!group->isObsolete());
         
         return group->newestCache();
     }
@@ -97,7 +100,8 @@ ApplicationCache* ApplicationCacheGroup::fallbackCacheForMainRequest(const Resou
 
     if (ApplicationCacheGroup* group = cacheStorage().fallbackCacheGroupForURL(request.url())) {
         ASSERT(group->newestCache());
-        
+        ASSERT(!group->isObsolete());
+
         return group->newestCache();
     }
     
@@ -124,7 +128,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& manifestURL)
     if (mainResourceCache) {
         if (manifestURL == mainResourceCache->group()->m_manifestURL) {
             mainResourceCache->group()->associateDocumentLoaderWithCache(documentLoader, mainResourceCache);
-            mainResourceCache->group()->update(frame);
+            mainResourceCache->group()->update(frame, ApplicationCacheUpdateWithBrowsingContext);
         } else {
             // The main resource was loaded from cache, so the cache must have an entry for it. Mark it as foreign.
             ApplicationCacheResource* resource = mainResourceCache->resourceForURL(documentLoader->url());
@@ -145,53 +149,28 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& manifestURL)
     // The resource was loaded from the network, check if it is a HTTP/HTTPS GET.    
     const ResourceRequest& request = frame->loader()->activeDocumentLoader()->request();
 
-    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request)) {
-        selectCacheWithoutManifestURL(frame);
+    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
         return;
-    }
 
     // Check that the resource URL has the same scheme/host/port as the manifest URL.
-    if (!protocolHostAndPortAreEqual(manifestURL, request.url())) {
-        selectCacheWithoutManifestURL(frame);
+    if (!protocolHostAndPortAreEqual(manifestURL, request.url()))
+        return;
+
+    // Don't change anything on disk if private browsing is enabled.
+    if (!frame->settings() || frame->settings()->privateBrowsingEnabled()) {
+        postListenerTask(&DOMApplicationCache::callCheckingListener, documentLoader);
+        postListenerTask(&DOMApplicationCache::callErrorListener, documentLoader);
         return;
     }
-            
+
     ApplicationCacheGroup* group = cacheStorage().findOrCreateCacheGroup(manifestURL);
-            
-    if (ApplicationCache* cache = group->newestCache()) {
-        ASSERT(cache->manifestResource());
-                
-        group->associateDocumentLoaderWithCache(frame->loader()->documentLoader(), cache);
-              
-        if (!frame->loader()->documentLoader()->isLoadingMainResource())
-            group->finishedLoadingMainResource(frame->loader()->documentLoader());
-
-        group->update(frame);
-    } else {
-        bool isUpdating = group->m_cacheBeingUpdated;
-                
-        if (!isUpdating)
-            group->m_cacheBeingUpdated = ApplicationCache::create();
-        documentLoader->setCandidateApplicationCacheGroup(group);
-        group->m_cacheCandidates.add(documentLoader);
-
-        const KURL& url = frame->loader()->documentLoader()->originalURL();
-                
-        unsigned type = 0;
-
-        // If the resource has already been downloaded, remove it so that it will be replaced with the implicit resource
-        if (isUpdating)
-            type = group->m_cacheBeingUpdated->removeResource(url);
-               
-        // Add the main resource URL as an implicit entry.
-        group->addEntry(url, type | ApplicationCacheResource::Implicit);
 
-        if (!frame->loader()->documentLoader()->isLoadingMainResource())
-            group->finishedLoadingMainResource(frame->loader()->documentLoader());
-                
-        if (!isUpdating)
-            group->update(frame);                
-    }               
+    documentLoader->setCandidateApplicationCacheGroup(group);
+    group->m_pendingMasterResourceLoaders.add(documentLoader);
+    group->m_downloadingPendingMasterResourceLoadersCount++;
+
+    ASSERT(!group->m_cacheBeingUpdated || group->m_updateStatus != Idle);
+    group->update(frame, ApplicationCacheUpdateWithBrowsingContext);
 }
 
 void ApplicationCacheGroup::selectCacheWithoutManifestURL(Frame* frame)
@@ -206,43 +185,101 @@ void ApplicationCacheGroup::selectCacheWithoutManifestURL(Frame* frame)
 
     if (mainResourceCache) {
         mainResourceCache->group()->associateDocumentLoaderWithCache(documentLoader, mainResourceCache);
-        mainResourceCache->group()->update(frame);
+        mainResourceCache->group()->update(frame, ApplicationCacheUpdateWithBrowsingContext);
     }
 }
 
 void ApplicationCacheGroup::finishedLoadingMainResource(DocumentLoader* loader)
 {
-    const KURL& url = loader->originalURL();
-    
-    if (ApplicationCache* cache = loader->applicationCache()) {
-        RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, loader->response(), ApplicationCacheResource::Implicit, loader->mainResourceData());
-        cache->addResource(resource.release());
-        
-        if (!m_cacheBeingUpdated)
-            return;
-    }
-    
-    ASSERT(m_pendingEntries.contains(url));
- 
-    EntryMap::iterator it = m_pendingEntries.find(url);
-    ASSERT(it->second & ApplicationCacheResource::Implicit);
+    ASSERT(m_pendingMasterResourceLoaders.contains(loader));
+    ASSERT(m_completionType == None || m_pendingEntries.isEmpty());
+    const KURL& url = loader->url();
 
-    RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, loader->response(), it->second, loader->mainResourceData());
+    switch (m_completionType) {
+    case None:
+        // The main resource finished loading before the manifest was ready. It will be handled via dispatchMainResources() later.
+        return;
+    case NoUpdate:
+        ASSERT(!m_cacheBeingUpdated);
+        associateDocumentLoaderWithCache(loader, m_newestCache.get());
+
+        if (ApplicationCacheResource* resource = m_newestCache->resourceForURL(url)) {
+            if (!(resource->type() & ApplicationCacheResource::Master)) {
+                resource->addType(ApplicationCacheResource::Master);
+                ASSERT(!resource->storageID());
+            }
+        } else
+            m_newestCache->addResource(ApplicationCacheResource::create(url, loader->response(), ApplicationCacheResource::Master, loader->mainResourceData()));
+
+        break;
+    case Failure:
+        // Cache update has been a failure, so there is no reason to keep the document associated with the incomplete cache
+        // (its main resource was not cached yet, so it is likely that the application changed significantly server-side).
+        ASSERT(!m_cacheBeingUpdated); // Already cleared out by stopLoading().
+        loader->setApplicationCache(0); // Will unset candidate, too.
+        m_associatedDocumentLoaders.remove(loader);
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        break;
+    case Completed:
+        ASSERT(m_associatedDocumentLoaders.contains(loader));
+
+        if (ApplicationCacheResource* resource = m_cacheBeingUpdated->resourceForURL(url)) {
+            if (!(resource->type() & ApplicationCacheResource::Master)) {
+                resource->addType(ApplicationCacheResource::Master);
+                ASSERT(!resource->storageID());
+            }
+        } else
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, loader->response(), ApplicationCacheResource::Master, loader->mainResourceData()));
+        // The "cached" event will be posted to all associated documents once update is complete.
+        break;
+    }
 
-    ASSERT(m_cacheBeingUpdated);
-    m_cacheBeingUpdated->addResource(resource.release());
-    
-    m_pendingEntries.remove(it);
-    
+    m_downloadingPendingMasterResourceLoadersCount--;
     checkIfLoadIsComplete();
 }
 
 void ApplicationCacheGroup::failedLoadingMainResource(DocumentLoader* loader)
 {
-    ASSERT(m_cacheCandidates.contains(loader) || m_associatedDocumentLoaders.contains(loader));
+    ASSERT(m_pendingMasterResourceLoaders.contains(loader));
+    ASSERT(m_completionType == None || m_pendingEntries.isEmpty());
 
-    // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-    cacheUpdateFailed();
+    switch (m_completionType) {
+    case None:
+        // The main resource finished loading before the manifest was ready. It will be handled via dispatchMainResources() later.
+        return;
+    case NoUpdate:
+        ASSERT(!m_cacheBeingUpdated);
+
+        // The manifest didn't change, and we have a relevant cache - but the main resource download failed mid-way, so it cannot be stored to the cache,
+        // and the loader does not get associated to it. If there are other main resources being downloaded for this cache group, they may still succeed.
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+
+        break;
+    case Failure:
+        // Cache update failed, too.
+        ASSERT(!m_cacheBeingUpdated); // Already cleared out by stopLoading().
+        ASSERT(!loader->applicationCache() || loader->applicationCache() == m_cacheBeingUpdated);
+
+        loader->setApplicationCache(0); // Will unset candidate, too.
+        m_associatedDocumentLoaders.remove(loader);
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        break;
+    case Completed:
+        // The cache manifest didn't list this main resource, and all cache entries were already updated successfully - but the main resource failed to load,
+        // so it cannot be stored to the cache. If there are other main resources being downloaded for this cache group, they may still succeed.
+        ASSERT(m_associatedDocumentLoaders.contains(loader));
+        ASSERT(loader->applicationCache() == m_cacheBeingUpdated);
+        ASSERT(!loader->candidateApplicationCacheGroup());
+        m_associatedDocumentLoaders.remove(loader);
+        loader->setApplicationCache(0);
+
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+
+        break;
+    }
+
+    m_downloadingPendingMasterResourceLoadersCount--;
+    checkIfLoadIsComplete();
 }
 
 void ApplicationCacheGroup::stopLoading()
@@ -265,95 +302,129 @@ void ApplicationCacheGroup::stopLoading()
     }    
     
     m_cacheBeingUpdated = 0;
+    m_pendingEntries.clear();
 }    
 
-void ApplicationCacheGroup::documentLoaderDestroyed(DocumentLoader* loader)
+void ApplicationCacheGroup::disassociateDocumentLoader(DocumentLoader* loader)
 {
     HashSet<DocumentLoader*>::iterator it = m_associatedDocumentLoaders.find(loader);
-    
-    if (it != m_associatedDocumentLoaders.end()) {
-        ASSERT(!m_cacheCandidates.contains(loader));
-    
+    if (it != m_associatedDocumentLoaders.end())
         m_associatedDocumentLoaders.remove(it);
-    } else {
-        ASSERT(m_cacheCandidates.contains(loader));
-        m_cacheCandidates.remove(loader);
-    }
-    
-    if (!m_associatedDocumentLoaders.isEmpty() || !m_cacheCandidates.isEmpty())
+
+    m_pendingMasterResourceLoaders.remove(loader);
+
+    loader->setApplicationCache(0); // Will set candidate to 0, too.
+
+    if (!m_associatedDocumentLoaders.isEmpty() || !m_pendingMasterResourceLoaders.isEmpty())
         return;
-    
-    // We should only have the newest cache remaining, or there is an initial cache attempt in progress.
-    ASSERT(m_caches.size() == 1 || m_cacheBeingUpdated);
-        
-    // If a cache update is in progress, stop it.
-    if (m_caches.size() == 1) {
-        ASSERT(m_caches.contains(m_newestCache.get()));
-        
-        // Release our reference to the newest cache.
-        m_savedNewestCachePointer = m_newestCache.get();
-        
-        // This could cause us to be deleted.
-        m_newestCache = 0;
-        
+
+    if (m_caches.isEmpty()) {
+        // There is an initial cache attempt in progress.
+        ASSERT(!m_newestCache);
+        // Delete ourselves, causing the cache attempt to be stopped.
+        delete this;
         return;
     }
-    
-    // There is an initial cache attempt in progress
-    ASSERT(m_cacheBeingUpdated);
-    ASSERT(m_caches.size() == 0);
-    
-    // Delete ourselves, causing the cache attempt to be stopped.
-    delete this;
-}    
+
+    ASSERT(m_caches.contains(m_newestCache.get()));
+
+    // Release our reference to the newest cache. This could cause us to be deleted.
+    // Any ongoing updates will be stopped from destructor.
+    m_newestCache.release();
+}
 
 void ApplicationCacheGroup::cacheDestroyed(ApplicationCache* cache)
 {
-    ASSERT(m_caches.contains(cache));
+    if (!m_caches.contains(cache))
+        return;
     
     m_caches.remove(cache);
-    
-    if (cache != m_savedNewestCachePointer)
-        cacheStorage().remove(cache);
 
-    if (m_caches.isEmpty())
+    if (m_caches.isEmpty()) {
+        ASSERT(m_associatedDocumentLoaders.isEmpty());
+        ASSERT(m_pendingMasterResourceLoaders.isEmpty());
         delete this;
+    }
 }
 
 void ApplicationCacheGroup::setNewestCache(PassRefPtr<ApplicationCache> newestCache)
-{ 
-    ASSERT(!m_newestCache);
-    ASSERT(!m_caches.contains(newestCache.get()));
-    ASSERT(!newestCache->group());
-           
-    m_newestCache = newestCache; 
+{
+    m_newestCache = newestCache;
+
     m_caches.add(m_newestCache.get());
     m_newestCache->setGroup(this);
 }
 
-void ApplicationCacheGroup::update(Frame* frame)
+void ApplicationCacheGroup::makeObsolete()
+{
+    if (isObsolete())
+        return;
+
+    m_isObsolete = true;
+    cacheStorage().cacheGroupMadeObsolete(this);
+    ASSERT(!m_storageID);
+}
+
+void ApplicationCacheGroup::update(Frame* frame, ApplicationCacheUpdateOption updateOption)
 {
-    if (m_status == Checking || m_status == Downloading) 
+    if (m_updateStatus == Checking || m_updateStatus == Downloading) {
+        if (updateOption == ApplicationCacheUpdateWithBrowsingContext) {
+            postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+            if (m_updateStatus == Downloading)
+                postListenerTask(&DOMApplicationCache::callDownloadingListener, frame->loader()->documentLoader());
+        }
         return;
+    }
+
+    // Don't change anything on disk if private browsing is enabled.
+    if (!frame->settings() || frame->settings()->privateBrowsingEnabled()) {
+        ASSERT(m_pendingMasterResourceLoaders.isEmpty());
+        ASSERT(m_pendingEntries.isEmpty());
+        ASSERT(!m_cacheBeingUpdated);
+        postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+        postListenerTask(&DOMApplicationCache::callNoUpdateListener, frame->loader()->documentLoader());
+        return;
+    }
 
     ASSERT(!m_frame);
     m_frame = frame;
 
-    m_status = Checking;
+    m_updateStatus = Checking;
 
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callCheckingListener);
+    postListenerTask(&DOMApplicationCache::callCheckingListener, m_associatedDocumentLoaders);
+    if (!m_newestCache) {
+        ASSERT(updateOption == ApplicationCacheUpdateWithBrowsingContext);
+        postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+    }
     
     ASSERT(!m_manifestHandle);
     ASSERT(!m_manifestResource);
-    
+    ASSERT(m_completionType == None);
+
     // FIXME: Handle defer loading
-    
-    ResourceRequest request(m_manifestURL);
+    m_manifestHandle = createResourceHandle(m_manifestURL, m_newestCache ? m_newestCache->manifestResource() : 0);
+}
+
+PassRefPtr<ResourceHandle> ApplicationCacheGroup::createResourceHandle(const KURL& url, ApplicationCacheResource* newestCachedResource)
+{
+    ResourceRequest request(url);
     m_frame->loader()->applyUserAgent(request);
+    request.setHTTPHeaderField("Cache-Control", "max-age=0");
+
+    if (newestCachedResource) {
+        const String& lastModified = newestCachedResource->response().httpHeaderField("Last-Modified");
+        const String& eTag = newestCachedResource->response().httpHeaderField("ETag");
+        if (!lastModified.isEmpty() || !eTag.isEmpty()) {
+            if (!lastModified.isEmpty())
+                request.setHTTPHeaderField("If-Modified-Since", lastModified);
+            if (!eTag.isEmpty())
+                request.setHTTPHeaderField("If-None-Match", eTag);
+        }
+    }
     
-    m_manifestHandle = ResourceHandle::create(request, this, m_frame, false, true, false);
+    return ResourceHandle::create(request, this, m_frame, false, true, false);
 }
- 
+
 void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
 {
     if (handle == m_manifestHandle) {
@@ -362,14 +433,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     }
     
     ASSERT(handle == m_currentHandle);
-    
-    int statusCode = response.httpStatusCode() / 100;
-    if (statusCode == 4 || statusCode == 5) {
-        // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-        cacheUpdateFailed();
-        return;
-    }
-    
+
     const KURL& url = handle->request().url();
     
     ASSERT(!m_currentResource);
@@ -377,9 +441,48 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     
     unsigned type = m_pendingEntries.get(url);
     
-    // If this is an initial cache attempt, we should not get implicit resources delivered here.
+    // If this is an initial cache attempt, we should not get master resources delivered here.
     if (!m_newestCache)
-        ASSERT(!(type & ApplicationCacheResource::Implicit));
+        ASSERT(!(type & ApplicationCacheResource::Master));
+
+    if (m_newestCache && response.httpStatusCode() == 304) { // Not modified.
+        ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(handle->request().url());
+        if (newestCachedResource) {
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_currentHandle->cancel();
+            m_currentHandle = 0;
+            // Load the next resource, if any.
+            startLoadingEntry();
+            return;
+        }
+        // The server could return 304 for an unconditional request - in this case, we handle the response as a normal error.
+    }
+
+    if (response.httpStatusCode() / 100 != 2 || response.url() != m_currentHandle->request().url()) {
+        if ((type & ApplicationCacheResource::Explicit) || (type & ApplicationCacheResource::Fallback)) {
+            // Note that cacheUpdateFailed() can cause the cache group to be deleted.
+            cacheUpdateFailed();
+        } else if (response.httpStatusCode() == 404 || response.httpStatusCode() == 410) {
+            // Skip this resource. It is dropped from the cache.
+            m_currentHandle->cancel();
+            m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
+            // Load the next resource, if any.
+            startLoadingEntry();
+        } else {
+            // Copy the resource and its metadata from the newest application cache in cache group whose completeness flag is complete, and act
+            // as if that was the fetched resource, ignoring the resource obtained from the network.
+            ASSERT(m_newestCache);
+            ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(handle->request().url());
+            ASSERT(newestCachedResource);
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_currentHandle->cancel();
+            m_currentHandle = 0;
+            // Load the next resource, if any.
+            startLoadingEntry();
+        }
+        return;
+    }
     
     m_currentResource = ApplicationCacheResource::create(url, response, type);
 }
@@ -414,105 +517,121 @@ void ApplicationCacheGroup::didFinishLoading(ResourceHandle* handle)
     m_cacheBeingUpdated->addResource(m_currentResource.release());
     m_currentHandle = 0;
     
-    // Load the next file.
-    if (!m_pendingEntries.isEmpty()) {
-        startLoadingEntry();
-        return;
-    }
-    
-    checkIfLoadIsComplete();
+    // Load the next resource, if any.
+    startLoadingEntry();
 }
 
 void ApplicationCacheGroup::didFail(ResourceHandle* handle, const ResourceError&)
 {
     if (handle == m_manifestHandle) {
-        didFailToLoadManifest();
+        cacheUpdateFailed();
         return;
     }
-    
-    // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-    cacheUpdateFailed();
+
+    unsigned type = m_currentResource ? m_currentResource->type() : m_pendingEntries.get(handle->request().url());
+    const KURL& url = handle->request().url();
+
+    ASSERT(!m_currentResource || !m_pendingEntries.contains(url));
+    m_currentResource = 0;
+    m_pendingEntries.remove(url);
+
+    if ((type & ApplicationCacheResource::Explicit) || (type & ApplicationCacheResource::Fallback)) {
+        // Note that cacheUpdateFailed() can cause the cache group to be deleted.
+        cacheUpdateFailed();
+    } else {
+        // Copy the resource and its metadata from the newest application cache in cache group whose completeness flag is complete, and act
+        // as if that was the fetched resource, ignoring the resource obtained from the network.
+        ASSERT(m_newestCache);
+        ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(url);
+        ASSERT(newestCachedResource);
+        m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+        // Load the next resource, if any.
+        startLoadingEntry();
+    }
 }
 
 void ApplicationCacheGroup::didReceiveManifestResponse(const ResourceResponse& response)
 {
-    int statusCode = response.httpStatusCode() / 100;
+    ASSERT(!m_manifestResource);
+    ASSERT(m_manifestHandle);
 
-    if (statusCode == 4 || statusCode == 5 || 
-        !equalIgnoringCase(response.mimeType(), "text/cache-manifest")) {
-        didFailToLoadManifest();
+    if (response.httpStatusCode() == 404 || response.httpStatusCode() == 410) {
+        manifestNotFound();
         return;
     }
-    
-    ASSERT(!m_manifestResource);
-    ASSERT(m_manifestHandle);
+
+    if (response.httpStatusCode() == 304)
+        return;
+
+    if (response.httpStatusCode() / 100 != 2 || response.url() != m_manifestHandle->request().url() || !equalIgnoringCase(response.mimeType(), "text/cache-manifest")) {
+        cacheUpdateFailed();
+        return;
+    }
+
     m_manifestResource = ApplicationCacheResource::create(m_manifestHandle->request().url(), response, 
                                                           ApplicationCacheResource::Manifest);
 }
 
 void ApplicationCacheGroup::didReceiveManifestData(const char* data, int length)
 {
-    ASSERT(m_manifestResource);
-    m_manifestResource->data()->append(data, length);
+    if (m_manifestResource)
+        m_manifestResource->data()->append(data, length);
 }
 
 void ApplicationCacheGroup::didFinishLoadingManifest()
 {
-    if (!m_manifestResource) {
-        didFailToLoadManifest();
+    bool isUpgradeAttempt = m_newestCache;
+
+    if (!isUpgradeAttempt && !m_manifestResource) {
+        // The server returned 304 Not Modified even though we didn't send a conditional request.
+        cacheUpdateFailed();
         return;
     }
 
-    bool isUpgradeAttempt = m_newestCache;
-    
     m_manifestHandle = 0;
 
-    // Check if the manifest is byte-for-byte identical.
+    // Check if the manifest was not modified.
     if (isUpgradeAttempt) {
         ApplicationCacheResource* newestManifest = m_newestCache->manifestResource();
         ASSERT(newestManifest);
     
-        if (newestManifest->data()->size() == m_manifestResource->data()->size() &&
-            !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size())) {
-            
-            callListenersOnAssociatedDocuments(&DOMApplicationCache::callNoUpdateListener);
-         
-            m_status = Idle;
-            m_frame = 0;
+        if (!m_manifestResource || // The resource will be null if HTTP response was 304 Not Modified.
+            newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size())) {
+
+            m_completionType = NoUpdate;
             m_manifestResource = 0;
+            deliverDelayedMainResources();
+
             return;
         }
     }
     
     Manifest manifest;
     if (!parseManifest(m_manifestURL, m_manifestResource->data()->data(), m_manifestResource->data()->size(), manifest)) {
-        didFailToLoadManifest();
+        cacheUpdateFailed();
         return;
     }
-        
+
+    ASSERT(!m_cacheBeingUpdated);
+    m_cacheBeingUpdated = ApplicationCache::create();
+    m_cacheBeingUpdated->setGroup(this);
+
+    HashSet<DocumentLoader*>::const_iterator masterEnd = m_pendingMasterResourceLoaders.end();
+    for (HashSet<DocumentLoader*>::const_iterator iter = m_pendingMasterResourceLoaders.begin(); iter != masterEnd; ++iter)
+        associateDocumentLoaderWithCache(*iter, m_cacheBeingUpdated.get());
+
     // We have the manifest, now download the resources.
-    m_status = Downloading;
+    m_updateStatus = Downloading;
     
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callDownloadingListener);
+    postListenerTask(&DOMApplicationCache::callDownloadingListener, m_associatedDocumentLoaders);
+
+    ASSERT(m_pendingEntries.isEmpty());
 
-#ifndef NDEBUG
-    // We should only have implicit entries.
-    {
-        EntryMap::const_iterator end = m_pendingEntries.end();
-        for (EntryMap::const_iterator it = m_pendingEntries.begin(); it != end; ++it)
-            ASSERT(it->second & ApplicationCacheResource::Implicit);
-    }
-#endif
-    
     if (isUpgradeAttempt) {
-        ASSERT(!m_cacheBeingUpdated);
-        
-        m_cacheBeingUpdated = ApplicationCache::create();
-        
         ApplicationCache::ResourceMap::const_iterator end = m_newestCache->end();
         for (ApplicationCache::ResourceMap::const_iterator it = m_newestCache->begin(); it != end; ++it) {
             unsigned type = it->second->type();
-            if (type & (ApplicationCacheResource::Implicit | ApplicationCacheResource::Dynamic))
+            if (type & (ApplicationCacheResource::Master | ApplicationCacheResource::Dynamic))
                 addEntry(it->first, type);
         }
     }
@@ -534,81 +653,125 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
 void ApplicationCacheGroup::cacheUpdateFailed()
 {
     stopLoading();
-        
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callErrorListener);
+    m_manifestResource = 0;
 
-    m_pendingEntries.clear();
+    // Wait for master resource loads to finish.
+    m_completionType = Failure;
+    deliverDelayedMainResources();
+}
+    
+void ApplicationCacheGroup::manifestNotFound()
+{
+    makeObsolete();
+
+    postListenerTask(&DOMApplicationCache::callObsoleteListener, m_associatedDocumentLoaders);
+    postListenerTask(&DOMApplicationCache::callErrorListener, m_pendingMasterResourceLoaders);
+
+    stopLoading();
+
+    ASSERT(m_pendingEntries.isEmpty());
     m_manifestResource = 0;
 
-    while (!m_cacheCandidates.isEmpty()) {
-        HashSet<DocumentLoader*>::iterator it = m_cacheCandidates.begin();
+    while (!m_pendingMasterResourceLoaders.isEmpty()) {
+        HashSet<DocumentLoader*>::iterator it = m_pendingMasterResourceLoaders.begin();
         
         ASSERT((*it)->candidateApplicationCacheGroup() == this);
+        ASSERT(!(*it)->applicationCache());
         (*it)->setCandidateApplicationCacheGroup(0);
-        m_cacheCandidates.remove(it);
+        m_pendingMasterResourceLoaders.remove(it);
     }
-    
-    m_status = Idle;    
+
+    m_downloadingPendingMasterResourceLoadersCount = 0;
+    m_updateStatus = Idle;    
     m_frame = 0;
     
-    // If there are no associated caches, delete ourselves
-    if (m_associatedDocumentLoaders.isEmpty())
+    if (m_caches.isEmpty()) {
+        ASSERT(m_associatedDocumentLoaders.isEmpty());
+        ASSERT(!m_cacheBeingUpdated);
         delete this;
-}
-    
-    
-void ApplicationCacheGroup::didFailToLoadManifest()
-{
-    // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-    cacheUpdateFailed();
+    }
 }
 
 void ApplicationCacheGroup::checkIfLoadIsComplete()
 {
-    ASSERT(m_cacheBeingUpdated);
-    
-    if (m_manifestHandle)
-        return;
-    
-    if (!m_pendingEntries.isEmpty())
+    if (m_manifestHandle || !m_pendingEntries.isEmpty() || m_downloadingPendingMasterResourceLoadersCount)
         return;
     
-    // We're done    
+    // We're done, all resources have finished downloading (successfully or not).
+
     bool isUpgradeAttempt = m_newestCache;
-    
-    m_cacheBeingUpdated->setManifestResource(m_manifestResource.release());
-    
-    Vector<RefPtr<DocumentLoader> > documentLoaders;
 
-    if (isUpgradeAttempt) {
-        ASSERT(m_cacheCandidates.isEmpty());
-        
-        copyToVector(m_associatedDocumentLoaders, documentLoaders);
-    } else {
-        while (!m_cacheCandidates.isEmpty()) {
-            HashSet<DocumentLoader*>::iterator it = m_cacheCandidates.begin();
-            
-            DocumentLoader* loader = *it;
-            ASSERT(!loader->applicationCache());
-            ASSERT(loader->candidateApplicationCacheGroup() == this);
-            
-            associateDocumentLoaderWithCache(loader, m_cacheBeingUpdated.get());
-    
-            documentLoaders.append(loader);
-
-            m_cacheCandidates.remove(it);
+    switch (m_completionType) {
+    case None:
+        ASSERT_NOT_REACHED();
+        return;
+    case NoUpdate:
+        ASSERT(isUpgradeAttempt);
+        ASSERT(!m_cacheBeingUpdated);
+
+        // The storage could have been manually emptied by the user.
+        if (!m_storageID)
+            cacheStorage().storeNewestCache(this);
+
+        postListenerTask(&DOMApplicationCache::callNoUpdateListener, m_associatedDocumentLoaders);
+        break;
+    case Failure:
+        ASSERT(!m_cacheBeingUpdated);
+        postListenerTask(&DOMApplicationCache::callErrorListener, m_associatedDocumentLoaders);
+        if (m_caches.isEmpty()) {
+            ASSERT(m_associatedDocumentLoaders.isEmpty());
+            delete this;
+            return;
         }
+        break;
+    case Completed: {
+        // FIXME: Fetch the resource from manifest URL again, and check whether it is identical to the one used for update (in case the application was upgraded server-side in the meanwhile). (<rdar://problem/6467625>)
+
+        ASSERT(m_cacheBeingUpdated);
+        m_cacheBeingUpdated->setManifestResource(m_manifestResource.release());
+
+        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? 0 : m_newestCache;
+
+        setNewestCache(m_cacheBeingUpdated.release());
+        if (cacheStorage().storeNewestCache(this)) {
+            // New cache stored, now remove the old cache.
+            if (oldNewestCache)
+                cacheStorage().remove(oldNewestCache.get());
+            // Fire the success events.
+            postListenerTask(isUpgradeAttempt ? &DOMApplicationCache::callUpdateReadyListener : &DOMApplicationCache::callCachedListener, m_associatedDocumentLoaders);
+        } else {
+            // Run the "cache failure steps"
+            // Fire the error events to all pending master entries, as well any other cache hosts
+            // currently associated with a cache in this group.
+            postListenerTask(&DOMApplicationCache::callErrorListener, m_associatedDocumentLoaders);
+            // Disassociate the pending master entries from the failed new cache. Note that
+            // all other loaders in the m_associatedDocumentLoaders are still associated with
+            // some other cache in this group. They are not associated with the failed new cache.
+
+            // Need to copy loaders, because the cache group may be destroyed at the end of iteration.
+            Vector<DocumentLoader*> loaders;
+            copyToVector(m_pendingMasterResourceLoaders, loaders);
+            size_t count = loaders.size();
+            for (size_t i = 0; i != count; ++i)
+                disassociateDocumentLoader(loaders[i]); // This can delete this group.
+
+            // Reinstate the oldNewestCache, if there was one.
+            if (oldNewestCache) {
+                // This will discard the failed new cache.
+                setNewestCache(oldNewestCache.release());
+            } else {
+                // We must have been deleted by the last call to disassociateDocumentLoader().
+                return;
+            }
+        }
+        break;
+    }
     }
-    
-    setNewestCache(m_cacheBeingUpdated.release());
-        
-    // Store the cache 
-    cacheStorage().storeNewestCache(this);
-    
-    callListeners(isUpgradeAttempt ? &DOMApplicationCache::callUpdateReadyListener : &DOMApplicationCache::callCachedListener, 
-                  documentLoaders);
 
-    m_status = Idle;
+    // Empty cache group's list of pending master entries.
+    m_pendingMasterResourceLoaders.clear();
+    m_completionType = None;
+    m_updateStatus = Idle;
     m_frame = 0;
 }
 
@@ -617,52 +780,58 @@ void ApplicationCacheGroup::startLoadingEntry()
     ASSERT(m_cacheBeingUpdated);
 
     if (m_pendingEntries.isEmpty()) {
-        checkIfLoadIsComplete();
+        m_completionType = Completed;
+        deliverDelayedMainResources();
         return;
     }
     
     EntryMap::const_iterator it = m_pendingEntries.begin();
 
-    // If this is an initial cache attempt, we do not want to fetch any implicit entries,
-    // since those are fed to us by the normal loader machinery.
-    if (!m_newestCache) {
-        // Get the first URL in the entry table that is not implicit
-        EntryMap::const_iterator end = m_pendingEntries.end();
-    
-        while (it->second & ApplicationCacheResource::Implicit) {
-            ++it;
+    postListenerTask(&DOMApplicationCache::callProgressListener, m_associatedDocumentLoaders);
 
-            if (it == end)
-                return;
-        }
-    }
-    
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callProgressListener);
-
-    // FIXME: If this is an upgrade attempt, the newest cache should be used as an HTTP cache.
-    
     ASSERT(!m_currentHandle);
     
-    ResourceRequest request(it->first);
-    m_frame->loader()->applyUserAgent(request);
+    m_currentHandle = createResourceHandle(KURL(it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
+}
 
-    m_currentHandle = ResourceHandle::create(request, this, m_frame, false, true, false);
+void ApplicationCacheGroup::deliverDelayedMainResources()
+{
+    // Need to copy loaders, because the cache group may be destroyed at the end of iteration.
+    Vector<DocumentLoader*> loaders;
+    copyToVector(m_pendingMasterResourceLoaders, loaders);
+    size_t count = loaders.size();
+    for (size_t i = 0; i != count; ++i) {
+        DocumentLoader* loader = loaders[i];
+        if (loader->isLoadingMainResource())
+            continue;
+
+        const ResourceError& error = loader->mainDocumentError();
+        if (error.isNull())
+            finishedLoadingMainResource(loader);
+        else
+            failedLoadingMainResource(loader);
+    }
+    if (!count)
+        checkIfLoadIsComplete();
 }
 
 void ApplicationCacheGroup::addEntry(const String& url, unsigned type)
 {
     ASSERT(m_cacheBeingUpdated);
     
-    // Don't add the URL if we already have an implicit resource in the cache
+    // Don't add the URL if we already have an master resource in the cache
+    // (i.e., the main resource finished loading before the manifest).
     if (ApplicationCacheResource* resource = m_cacheBeingUpdated->resourceForURL(url)) {
-        ASSERT(resource->type() & ApplicationCacheResource::Implicit);
+        ASSERT(resource->type() & ApplicationCacheResource::Master);
+        ASSERT(!m_frame->loader()->documentLoader()->isLoadingMainResource());
     
         resource->addType(type);
         return;
     }
 
     // Don't add the URL if it's the same as the manifest URL.
-    if (m_manifestResource && m_manifestResource->url() == url) {
+    ASSERT(m_manifestResource);
+    if (m_manifestResource->url() == url) {
         m_manifestResource->addType(type);
         return;
     }
@@ -675,33 +844,60 @@ void ApplicationCacheGroup::addEntry(const String& url, unsigned type)
 
 void ApplicationCacheGroup::associateDocumentLoaderWithCache(DocumentLoader* loader, ApplicationCache* cache)
 {
+    // If teardown started already, revive the group.
+    if (!m_newestCache && !m_cacheBeingUpdated)
+        m_newestCache = cache;
+
+    ASSERT(!m_isObsolete);
+
     loader->setApplicationCache(cache);
-    
+
     ASSERT(!m_associatedDocumentLoaders.contains(loader));
     m_associatedDocumentLoaders.add(loader);
 }
  
-void ApplicationCacheGroup::callListenersOnAssociatedDocuments(ListenerFunction listenerFunction)
-{
-    Vector<RefPtr<DocumentLoader> > loaders;
-    copyToVector(m_associatedDocumentLoaders, loaders);
+class CallCacheListenerTask : public ScriptExecutionContext::Task {
+    typedef void (DOMApplicationCache::*ListenerFunction)();
+public:
+    static PassRefPtr<CallCacheListenerTask> create(ListenerFunction listenerFunction)
+    {
+        return adoptRef(new CallCacheListenerTask(listenerFunction));
+    }
+
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        ASSERT(context->isDocument());
+        if (DOMWindow* window = static_cast<Document*>(context)->domWindow()) {
+            if (DOMApplicationCache* domCache = window->optionalApplicationCache())
+                (domCache->*m_listenerFunction)();
+        }
+    }
 
-    callListeners(listenerFunction, loaders);
+private:
+    CallCacheListenerTask(ListenerFunction listenerFunction)
+        : m_listenerFunction(listenerFunction)
+    {
+    }
+
+    ListenerFunction m_listenerFunction;
+};
+
+void ApplicationCacheGroup::postListenerTask(ListenerFunction listenerFunction, const HashSet<DocumentLoader*>& loaderSet)
+{
+    HashSet<DocumentLoader*>::const_iterator loaderSetEnd = loaderSet.end();
+    for (HashSet<DocumentLoader*>::const_iterator iter = loaderSet.begin(); iter != loaderSetEnd; ++iter)
+        postListenerTask(listenerFunction, *iter);
 }
-    
-void ApplicationCacheGroup::callListeners(ListenerFunction listenerFunction, const Vector<RefPtr<DocumentLoader> >& loaders)
+
+void ApplicationCacheGroup::postListenerTask(ListenerFunction listenerFunction, DocumentLoader* loader)
 {
-    for (unsigned i = 0; i < loaders.size(); i++) {
-        Frame* frame = loaders[i]->frame();
-        if (!frame)
-            continue;
-        
-        ASSERT(frame->loader()->documentLoader() == loaders[i]);
-        DOMWindow* window = frame->domWindow();
-        
-        if (DOMApplicationCache* domCache = window->optionalApplicationCache())
-            (domCache->*listenerFunction)();
-    }    
+    Frame* frame = loader->frame();
+    if (!frame)
+        return;
+    
+    ASSERT(frame->loader()->documentLoader() == loader);
+
+    frame->document()->postTask(CallCacheListenerTask::create(listenerFunction));
 }
 
 void ApplicationCacheGroup::clearStorageID()
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
index 8928e7547a..063fb3b781 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,12 +47,17 @@ class Document;
 class DocumentLoader;
 class Frame;
 
+enum ApplicationCacheUpdateOption {
+    ApplicationCacheUpdateWithBrowsingContext,
+    ApplicationCacheUpdateWithoutBrowsingContext
+};
+
 class ApplicationCacheGroup : Noncopyable, ResourceHandleClient {
 public:
     ApplicationCacheGroup(const KURL& manifestURL, bool isCopy = false);    
     ~ApplicationCacheGroup();
     
-    enum Status { Idle, Checking, Downloading };
+    enum UpdateStatus { Idle, Checking, Downloading };
 
     static ApplicationCache* cacheForMainRequest(const ResourceRequest&, DocumentLoader*);
     static ApplicationCache* fallbackCacheForMainRequest(const ResourceRequest&, DocumentLoader*);
@@ -61,30 +66,38 @@ public:
     static void selectCacheWithoutManifestURL(Frame*);
     
     const KURL& manifestURL() const { return m_manifestURL; }
-    Status status() const { return m_status; }
-    
+    UpdateStatus updateStatus() const { return m_updateStatus; }
+
     void setStorageID(unsigned storageID) { m_storageID = storageID; }
     unsigned storageID() const { return m_storageID; }
     void clearStorageID();
     
-    void update(Frame*);
+    void update(Frame*, ApplicationCacheUpdateOption); // FIXME: Frame should not bee needed when updating witout browsing context.
     void cacheDestroyed(ApplicationCache*);
-        
+
+    bool cacheIsBeingUpdated(const ApplicationCache* cache) const { return cache == m_cacheBeingUpdated; }
+
     ApplicationCache* newestCache() const { return m_newestCache.get(); }
-    ApplicationCache* savedNewestCachePointer() const { return m_savedNewestCachePointer; }
-    
+    void setNewestCache(PassRefPtr<ApplicationCache>);
+
+    void makeObsolete();
+    bool isObsolete() const { return m_isObsolete; }
+
     void finishedLoadingMainResource(DocumentLoader*);
     void failedLoadingMainResource(DocumentLoader*);
-    void documentLoaderDestroyed(DocumentLoader*);
 
-    void setNewestCache(PassRefPtr<ApplicationCache> newestCache);
+    void disassociateDocumentLoader(DocumentLoader*);
 
     bool isCopy() const { return m_isCopy; }
+
 private:
     typedef void (DOMApplicationCache::*ListenerFunction)();
-    void callListenersOnAssociatedDocuments(ListenerFunction);
-    void callListeners(ListenerFunction, const Vector<RefPtr<DocumentLoader> >& loaders);
-    
+    static void postListenerTask(ListenerFunction, const HashSet<DocumentLoader*>&);
+    static void postListenerTask(ListenerFunction, const Vector<RefPtr<DocumentLoader> >& loaders);
+    static void postListenerTask(ListenerFunction, DocumentLoader*);
+
+    PassRefPtr<ResourceHandle> createResourceHandle(const KURL&, ApplicationCacheResource* newestCachedResource);
+
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
     virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
     virtual void didFinishLoading(ResourceHandle*);
@@ -93,11 +106,12 @@ private:
     void didReceiveManifestResponse(const ResourceResponse&);
     void didReceiveManifestData(const char*, int);
     void didFinishLoadingManifest();
-    void didFailToLoadManifest();
     
     void startLoadingEntry();
+    void deliverDelayedMainResources();
     void checkIfLoadIsComplete();
     void cacheUpdateFailed();
+    void manifestNotFound();
     
     void addEntry(const String&, unsigned type);
     
@@ -106,37 +120,47 @@ private:
     void stopLoading();
     
     KURL m_manifestURL;
-    Status m_status;
+    UpdateStatus m_updateStatus;
     
-    // This is the newest cache in the group.
+    // This is the newest complete cache in the group.
     RefPtr<ApplicationCache> m_newestCache;
     
-    // During tear-down we save the pointer to the newest cache to prevent reference cycles.
-    ApplicationCache* m_savedNewestCachePointer;
-    
-    // The caches in this cache group.
+    // All complete caches in this cache group.
     HashSet<ApplicationCache*> m_caches;
     
     // The cache being updated (if any). Note that cache updating does not immediately create a new
-    // ApplicationCache object, so this may be null even when status is not Idle.
+    // ApplicationCache object, so this may be null even when update status is not Idle.
     RefPtr<ApplicationCache> m_cacheBeingUpdated;
 
-    // When a cache group does not yet have a complete cache, this contains the document loaders
-    // that should be associated with the cache once it has been downloaded.
-    HashSet<DocumentLoader*> m_cacheCandidates;
+    // List of pending master entries, used during the update process to ensure that new master entries are cached.
+    HashSet<DocumentLoader*> m_pendingMasterResourceLoaders;
+    // How many of the above pending master entries have not yet finished downloading.
+    int m_downloadingPendingMasterResourceLoadersCount;
     
     // These are all the document loaders that are associated with a cache in this group.
     HashSet<DocumentLoader*> m_associatedDocumentLoaders;
-    
+
     // The URLs and types of pending cache entries.
     typedef HashMap<String, unsigned> EntryMap;
     EntryMap m_pendingEntries;
 
-    // Frame used for fetching resources when updating
+    // Frame used for fetching resources when updating.
+    // FIXME: An update started by a particular frame should not stop if it is destroyed, but there are other frames associated with the same cache group.
     Frame* m_frame;
   
+    // An obsolete cache group is never stored, but the opposite is not true - storing may fail for multiple reasons, such as exceeding disk quota.
     unsigned m_storageID;
-  
+    bool m_isObsolete;
+
+    // During update, this is used to handle asynchronously arriving results.
+    enum CompletionType {
+        None,
+        NoUpdate,
+        Failure,
+        Completed
+    };
+    CompletionType m_completionType;
+
     // Whether this cache group is a copy that's only used for transferring the cache to another file.
     bool m_isCopy;
     
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
index d78cf7f4c5..7c1241b50d 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
@@ -47,8 +47,8 @@ void ApplicationCacheResource::addType(unsigned type)
 #ifndef NDEBUG
 void ApplicationCacheResource::dumpType(unsigned type)
 {
-    if (type & Implicit)
-        printf("implicit ");
+    if (type & Master)
+        printf("master ");
     if (type & Manifest)
         printf("manifest ");
     if (type & Explicit)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
index 96f5a0e9a0..28d8280cf0 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
@@ -35,7 +35,7 @@ namespace WebCore {
 class ApplicationCacheResource : public SubstituteResource {
 public:
     enum Type {
-        Implicit = 1 << 0,
+        Master = 1 << 0,
         Manifest = 1 << 1,
         Explicit = 1 << 2,
         Foreign = 1 << 3,
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 97a6d5a1c6..1c59581d50 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -43,6 +43,44 @@ using namespace std;
 
 namespace WebCore {
 
+class ResourceStorageIDJournal {
+public:  
+    ~ResourceStorageIDJournal()
+    {
+        size_t size = m_records.size();
+        for (size_t i = 0; i < size; ++i)
+            m_records[i].restore();
+    }
+
+    void add(ApplicationCacheResource* resource, unsigned storageID)
+    {
+        m_records.append(Record(resource, storageID));
+    }
+
+    void commit()
+    {
+        m_records.clear();
+    }
+
+private:
+    class Record {
+    public:
+        Record() : m_resource(0), m_storageID(0) { }
+        Record(ApplicationCacheResource* resource, unsigned storageID) : m_resource(resource), m_storageID(storageID) { }
+
+        void restore()
+        {
+            m_resource->setStorageID(m_storageID);
+        }
+
+    private:
+        ApplicationCacheResource* m_resource;
+        unsigned m_storageID;
+    };
+
+    Vector<Record> m_records;
+};
+
 static unsigned urlHostHash(const KURL& url)
 {
     unsigned hostStart = url.hostStart();
@@ -147,7 +185,9 @@ ApplicationCacheGroup* ApplicationCacheStorage::cacheGroupForURL(const KURL& url
     CacheGroupMap::const_iterator end = m_cachesInMemory.end();
     for (CacheGroupMap::const_iterator it = m_cachesInMemory.begin(); it != end; ++it) {
         ApplicationCacheGroup* group = it->second;
-        
+
+        ASSERT(!group->isObsolete());
+
         if (!protocolHostAndPortAreEqual(url, group->manifestURL()))
             continue;
         
@@ -213,6 +253,8 @@ ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const K
     for (CacheGroupMap::const_iterator it = m_cachesInMemory.begin(); it != end; ++it) {
         ApplicationCacheGroup* group = it->second;
         
+        ASSERT(!group->isObsolete());
+
         if (ApplicationCache* cache = group->newestCache()) {
             KURL fallbackURL;
             if (!cache->urlMatchesFallbackNamespace(url, &fallbackURL))
@@ -271,15 +313,33 @@ ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const K
 
 void ApplicationCacheStorage::cacheGroupDestroyed(ApplicationCacheGroup* group)
 {
+    if (group->isObsolete()) {
+        ASSERT(!group->storageID());
+        ASSERT(m_cachesInMemory.get(group->manifestURL()) != group);
+        return;
+    }
+
     ASSERT(m_cachesInMemory.get(group->manifestURL()) == group);
 
     m_cachesInMemory.remove(group->manifestURL());
     
-    // If the cache is half-created, we don't want it in the saved set.
-    if (!group->savedNewestCachePointer())
+    // If the cache group is half-created, we don't want it in the saved set (as it is not stored in database).
+    if (!group->storageID())
         m_cacheHostSet.remove(urlHostHash(group->manifestURL()));
 }
 
+void ApplicationCacheStorage::cacheGroupMadeObsolete(ApplicationCacheGroup* group)
+{
+    ASSERT(m_cachesInMemory.get(group->manifestURL()) == group);
+    ASSERT(m_cacheHostSet.contains(urlHostHash(group->manifestURL())));
+
+    if (ApplicationCache* newestCache = group->newestCache())
+        remove(newestCache);
+
+    m_cachesInMemory.remove(group->manifestURL());
+    m_cacheHostSet.remove(urlHostHash(group->manifestURL()));
+}
+
 void ApplicationCacheStorage::setCacheDirectory(const String& cacheDirectory)
 {
     ASSERT(m_cacheDirectory.isNull());
@@ -321,8 +381,8 @@ void ApplicationCacheStorage::verifySchemaVersion()
     setDatabaseVersion.begin();
 
     char userVersionSQL[32];
-    int numBytes = snprintf(userVersionSQL, sizeof(userVersionSQL), "PRAGMA user_version=%d", schemaVersion);
-    ASSERT_UNUSED(numBytes, static_cast<int>(sizeof(userVersionSQL)) >= numBytes);
+    int unusedNumBytes = snprintf(userVersionSQL, sizeof(userVersionSQL), "PRAGMA user_version=%d", schemaVersion);
+    ASSERT_UNUSED(unusedNumBytes, static_cast<int>(sizeof(userVersionSQL)) >= unusedNumBytes);
 
     SQLiteStatement statement(m_database, userVersionSQL);
     if (statement.prepare() != SQLResultOk)
@@ -372,7 +432,13 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       "  DELETE FROM CacheWhitelistURLs WHERE cache = OLD.id;"
                       "  DELETE FROM FallbackURLs WHERE cache = OLD.id;"
                       " END");
-    
+
+    // When a cache entry is deleted, its resource should also be deleted.
+    executeSQLCommand("CREATE TRIGGER IF NOT EXISTS CacheEntryDeleted AFTER DELETE ON CacheEntries"
+                      " FOR EACH ROW BEGIN"
+                      "  DELETE FROM CacheResources WHERE id = OLD.resource;"
+                      " END");
+
     // When a cache resource is deleted, its data blob should also be deleted.
     executeSQLCommand("CREATE TRIGGER IF NOT EXISTS CacheResourceDeleted AFTER DELETE ON CacheResources"
                       " FOR EACH ROW BEGIN"
@@ -408,10 +474,11 @@ bool ApplicationCacheStorage::store(ApplicationCacheGroup* group)
     return true;
 }    
 
-bool ApplicationCacheStorage::store(ApplicationCache* cache)
+bool ApplicationCacheStorage::store(ApplicationCache* cache, ResourceStorageIDJournal* storageIDJournal)
 {
     ASSERT(cache->storageID() == 0);
     ASSERT(cache->group()->storageID() != 0);
+    ASSERT(storageIDJournal);
     
     SQLiteStatement statement(m_database, "INSERT INTO Caches (cacheGroup) VALUES (?)");
     if (statement.prepare() != SQLResultOk)
@@ -428,8 +495,13 @@ bool ApplicationCacheStorage::store(ApplicationCache* cache)
     {
         ApplicationCache::ResourceMap::const_iterator end = cache->end();
         for (ApplicationCache::ResourceMap::const_iterator it = cache->begin(); it != end; ++it) {
+            unsigned oldStorageID = it->second->storageID();
             if (!store(it->second.get(), cacheStorageID))
                 return false;
+
+            // Storing the resource succeeded. Log its old storageID in case
+            // it needs to be restored later.
+            storageIDJournal->add(it->second.get(), oldStorageID);
         }
     }
     
@@ -587,10 +659,16 @@ bool ApplicationCacheStorage::storeNewestCache(ApplicationCacheGroup* group)
     }
     
     ASSERT(group->newestCache());
+    ASSERT(!group->isObsolete());
     ASSERT(!group->newestCache()->storageID());
     
+    // Log the storageID changes to the in-memory resource objects. The journal
+    // object will roll them back automatically in case a database operation
+    // fails and this method returns early.
+    ResourceStorageIDJournal storageIDJournal;
+
     // Store the newest cache
-    if (!store(group->newestCache()))
+    if (!store(group->newestCache(), &storageIDJournal))
         return false;
     
     // Update the newest cache in the group.
@@ -605,6 +683,7 @@ bool ApplicationCacheStorage::storeNewestCache(ApplicationCacheGroup* group)
     if (!executeStatement(statement))
         return false;
     
+    storageIDJournal.commit();
     storeCacheTransaction.commit();
     return true;
 }
@@ -724,12 +803,30 @@ void ApplicationCacheStorage::remove(ApplicationCache* cache)
     if (!m_database.isOpen())
         return;
 
+    ASSERT(cache->group());
+    ASSERT(cache->group()->storageID());
+
+    // All associated data will be deleted by database triggers.
     SQLiteStatement statement(m_database, "DELETE FROM Caches WHERE id=?");
     if (statement.prepare() != SQLResultOk)
         return;
     
     statement.bindInt64(1, cache->storageID());
     executeStatement(statement);
+
+    cache->clearStorageID();
+
+    if (cache->group()->newestCache() == cache) {
+        // Currently, there are no triggers on the cache group, which is why the cache had to be removed separately above.
+        SQLiteStatement groupStatement(m_database, "DELETE FROM CacheGroups WHERE id=?");
+        if (groupStatement.prepare() != SQLResultOk)
+            return;
+        
+        groupStatement.bindInt64(1, cache->group()->storageID());
+        executeStatement(groupStatement);
+
+        cache->group()->clearStorageID();
+    }
 }    
 
 void ApplicationCacheStorage::empty()
@@ -742,7 +839,6 @@ void ApplicationCacheStorage::empty()
     // Clear cache groups, caches and cache resources.
     executeSQLCommand("DELETE FROM CacheGroups");
     executeSQLCommand("DELETE FROM Caches");
-    executeSQLCommand("DELETE FROM CacheResources");
     
     // Clear the storage IDs for the caches in memory.
     // The caches will still work, but cached resources will not be saved to disk 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
index cf64dd44be..b13b5966a9 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -40,6 +40,7 @@ class ApplicationCache;
 class ApplicationCacheGroup;
 class ApplicationCacheResource;
 class KURL;
+class ResourceStorageIDJournal;
     
 class ApplicationCacheStorage {
 public:
@@ -51,11 +52,13 @@ public:
 
     ApplicationCacheGroup* findOrCreateCacheGroup(const KURL& manifestURL);
     void cacheGroupDestroyed(ApplicationCacheGroup*);
+    void cacheGroupMadeObsolete(ApplicationCacheGroup*);
         
-    bool storeNewestCache(ApplicationCacheGroup*);
+    bool storeNewestCache(ApplicationCacheGroup*); // Updates the cache group, but doesn't remove old cache.
     void store(ApplicationCacheResource*, ApplicationCache*);
     bool storeUpdatedType(ApplicationCacheResource*, ApplicationCache*);
 
+    // Removes the group if the cache to be removed is the newest one (so, storeNewestCache() needs to be called beforehand when updating).
     void remove(ApplicationCache*);
     
     void empty();
@@ -67,7 +70,7 @@ private:
     ApplicationCacheGroup* loadCacheGroup(const KURL& manifestURL);
     
     bool store(ApplicationCacheGroup*);
-    bool store(ApplicationCache*);
+    bool store(ApplicationCache*, ResourceStorageIDJournal*);
     bool store(ApplicationCacheResource*, unsigned cacheStorageID);
 
     void loadManifestHostHashes();
@@ -84,11 +87,11 @@ private:
     SQLiteDatabase m_database;
 
     // In order to quickly determine if a given resource exists in an application cache,
-    // we keep a hash set of the hosts of the manifest URLs of all cache groups.
+    // we keep a hash set of the hosts of the manifest URLs of all non-obsolete cache groups.
     HashCountedSet<unsigned, AlreadyHashed> m_cacheHostSet;
     
     typedef HashMap<String, ApplicationCacheGroup*> CacheGroupMap;
-    CacheGroupMap m_cachesInMemory;
+    CacheGroupMap m_cachesInMemory; // Excludes obsolete cache groups.
 };
  
 ApplicationCacheStorage& cacheStorage();
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
index a07442b277..90d293051a 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -65,22 +65,22 @@ unsigned short DOMApplicationCache::status() const
     ApplicationCache* cache = associatedCache();    
     if (!cache)
         return UNCACHED;
-    
-    switch (cache->group()->status()) {
+
+    switch (cache->group()->updateStatus()) {
         case ApplicationCacheGroup::Checking:
             return CHECKING;
         case ApplicationCacheGroup::Downloading:
             return DOWNLOADING;
         case ApplicationCacheGroup::Idle: {
+            if (cache->group()->isObsolete())
+                return OBSOLETE;
             if (cache != cache->group()->newestCache())
                 return UPDATEREADY;
-            
             return IDLE;
         }
-        default:
-            ASSERT_NOT_REACHED();
     }
-    
+
+    ASSERT_NOT_REACHED();
     return 0;
 }
 
@@ -92,7 +92,7 @@ void DOMApplicationCache::update(ExceptionCode& ec)
         return;
     }
     
-    cache->group()->update(m_frame);
+    cache->group()->update(m_frame, ApplicationCacheUpdateWithoutBrowsingContext);
 }
 
 bool DOMApplicationCache::swapCache()
@@ -103,8 +103,14 @@ bool DOMApplicationCache::swapCache()
     ApplicationCache* cache = m_frame->loader()->documentLoader()->applicationCache();
     if (!cache)
         return false;
-    
-    // Check if we already have the newest cache
+
+    // If the group of application caches to which cache belongs has the lifecycle status obsolete, unassociate document from cache.
+    if (cache->group()->isObsolete()) {
+        cache->group()->disassociateDocumentLoader(m_frame->loader()->documentLoader());
+        return true;
+    }
+
+    // If there is no newer cache, raise an INVALID_STATE_ERR exception.
     ApplicationCache* newestCache = cache->group()->newestCache();
     if (cache == newestCache)
         return false;
@@ -126,7 +132,7 @@ PassRefPtr<DOMStringList> DOMApplicationCache::items()
     Vector<String> result;
     if (ApplicationCache* cache = associatedCache()) {
         unsigned numEntries = cache->numDynamicEntries();
-        result.reserveCapacity(numEntries);
+        result.reserveInitialCapacity(numEntries);
         for (unsigned i = 0; i < numEntries; ++i)
             result.append(cache->dynamicEntry(i));
     }
@@ -287,6 +293,11 @@ void DOMApplicationCache::callCachedListener()
     callListener(eventNames().cachedEvent, m_onCachedListener.get());
 }
 
+void DOMApplicationCache::callObsoleteListener()
+{
+    callListener(eventNames().obsoleteEvent, m_onObsoleteListener.get());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
index 9371cd79fc..b76542d44f 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -56,6 +56,7 @@ public:
         CHECKING = 2,
         DOWNLOADING = 3,
         UPDATEREADY = 4,
+        OBSOLETE = 5
     };
 
     unsigned short status() const;
@@ -100,6 +101,9 @@ public:
     void setOncached(PassRefPtr<EventListener> eventListener) { m_onCachedListener = eventListener; }
     EventListener* oncached() const { return m_onCachedListener.get(); }
 
+    void setOnobsolete(PassRefPtr<EventListener> eventListener) { m_onObsoleteListener = eventListener; }
+    EventListener* onobsolete() const { return m_onObsoleteListener.get(); }
+
     virtual ScriptExecutionContext* scriptExecutionContext() const;
     DOMApplicationCache* toDOMApplicationCache() { return this; }
 
@@ -110,6 +114,7 @@ public:
     void callProgressListener();
     void callUpdateReadyListener();
     void callCachedListener();
+    void callObsoleteListener();
     
 private:
     DOMApplicationCache(Frame*);
@@ -128,6 +133,7 @@ private:
     RefPtr<EventListener> m_onProgressListener;
     RefPtr<EventListener> m_onUpdateReadyListener;
     RefPtr<EventListener> m_onCachedListener;
+    RefPtr<EventListener> m_onObsoleteListener;
     
     EventListenersMap m_eventListeners;
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
index f38cd74b47..1156c9c2f7 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,13 +35,15 @@ module offline {
         const unsigned short CHECKING = 2;
         const unsigned short DOWNLOADING = 3;
         const unsigned short UPDATEREADY = 4;
+        const unsigned short OBSOLETE = 5;
         readonly attribute unsigned short status;
 
         void update()
             raises(DOMException);
         void swapCache()
             raises(DOMException);
-    
+
+#if defined(ENABLE_APPLICATION_CACHE_DYNAMIC_ENTRIES) && ENABLE_APPLICATION_CACHE_DYNAMIC_ENTRIES
         // dynamic entries
         readonly attribute DOMStringList items;
         [Custom] boolean hasItem(in DOMString url)
@@ -50,6 +52,7 @@ module offline {
             raises(DOMException);
         [Custom] void remove(in DOMString uri)
             raises(DOMException);
+#endif
 
         // events
         attribute EventListener onchecking;
@@ -59,6 +62,7 @@ module offline {
         attribute EventListener onprogress;
         attribute EventListener onupdateready;
         attribute EventListener oncached;
+        attribute EventListener onobsolete;
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type, 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
index f1b60fcb57..4169313fc0 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
@@ -30,7 +30,7 @@
 
 #include "CharacterNames.h"
 #include "KURL.h"
-#include "TextEncoding.h"
+#include "TextResourceDecoder.h"
 
 using namespace std;
 
@@ -45,36 +45,27 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
     ASSERT(manifest.fallbackURLs.isEmpty());
     
     Mode mode = Explicit;
-    String s = UTF8Encoding().decode(data, length);
-    
-    if (s.isEmpty())
-        return false;
-    
-    // Replace nulls with U+FFFD REPLACEMENT CHARACTER
-    s.replace(0, replacementCharacter);
+
+    RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("text/cache-manifest", "UTF-8");
+    String s = decoder->decode(data, length);
+    s += decoder->flush();
     
-    // Look for the magic signature
-    if (!s.startsWith("CACHE MANIFEST")) {
-        // The magic signature was not found.
+    // Look for the magic signature: "^\xFEFF?CACHE MANIFEST[ \t]?" (the BOM is removed by TextResourceDecoder).
+    // Example: "CACHE MANIFEST #comment" is a valid signature.
+    // Example: "CACHE MANIFEST;V2" is not.
+    if (!s.startsWith("CACHE MANIFEST"))
         return false;
-    }
     
     const UChar* end = s.characters() + s.length();    
     const UChar* p = s.characters() + 14; // "CACHE MANIFEST" is 14 characters.
-    
-    while (p < end) {
-        // Skip whitespace
-        if (*p == ' ' || *p == '\t') {
-            p++;
-        } else
-            break;
-    }
-    
-    if (p < end && *p != '\n' && *p != '\r') {
-        // The magic signature was invalid
+
+    if (p < end && *p != ' ' && *p != '\t' && *p != '\n' && *p != '\r')
         return false;
-    }
-    
+
+    // Skip to the end of the line.
+    while (p < end && *p != '\r' && *p != '\n')
+        p++;
+
     while (1) {
         // Skip whitespace
         while (p < end && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'))
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index 81e2b78bbe..d1269cc446 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,6 +38,8 @@
 #include "FrameTree.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
+#include "IconDatabase.h"
+#include "Image.h"
 #include "KURLHash.h"
 #include "Logging.h"
 #include "markup.h"
@@ -61,15 +63,16 @@ static const CFStringRef LegacyWebArchiveResourceTextEncodingNameKey = CFSTR("We
 static const CFStringRef LegacyWebArchiveResourceResponseKey = CFSTR("WebResourceResponse");
 static const CFStringRef LegacyWebArchiveResourceResponseVersionKey = CFSTR("WebResourceResponseVersion");
 
-static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(ArchiveResource* resource, bool mainResource)
+RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(ArchiveResource* resource, MainResourceStatus isMainResource)
 {
     if (!resource) {
-        // The property list representation of a null/empty WebResource has the following 3 objects stored as nil
+        // The property list representation of a null/empty WebResource has the following 3 objects stored as nil.
+        // FIXME: 0 is not serializable. Presumably we need to use kCFNull here instead for compatibility.
+        // FIXME: But why do we need to support a resource of 0? Who relies on that?
         RetainPtr<CFMutableDictionaryRef> propertyList(AdoptCF, CFDictionaryCreateMutable(0, 3, 0, 0));
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceDataKey, 0);
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceURLKey, 0);
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceMIMETypeKey, 0);
-
         return propertyList;
     }
     
@@ -95,7 +98,7 @@ static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(A
 
     // FrameName should be left out if empty for subresources, but always included for main resources
     const String& frameName(resource->frameName());
-    if (!frameName.isEmpty() || mainResource) {
+    if (!frameName.isEmpty() || isMainResource) {
         RetainPtr<CFStringRef> cfFrameName(AdoptCF, frameName.createCFString());
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceFrameNameKey, cfFrameName.get());
     }
@@ -114,8 +117,8 @@ static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(A
     }
 
     // Don't include the resource response for the main resource
-    if (!mainResource) {
-        RetainPtr<CFDataRef> resourceResponseData = propertyListDataFromResourceResponse(resource->response());
+    if (!isMainResource) {
+        RetainPtr<CFDataRef> resourceResponseData = createPropertyListRepresentation(resource->response());
         if (resourceResponseData)
             CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceResponseKey, resourceResponseData.get());    
     }
@@ -123,19 +126,20 @@ static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(A
     return propertyList;
 }
 
-static RetainPtr<CFDictionaryRef> createPropertyListRep(Archive* archive)
+RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(Archive* archive)
 {
     RetainPtr<CFMutableDictionaryRef> propertyList(AdoptCF, CFDictionaryCreateMutable(0, 3, 0, &kCFTypeDictionaryValueCallBacks));
     
-    RetainPtr<CFDictionaryRef> mainResourceDict = createPropertyListRepresentationFromResource(archive->mainResource(), true);
+    RetainPtr<CFDictionaryRef> mainResourceDict = createPropertyListRepresentation(archive->mainResource(), MainResource);
+    ASSERT(mainResourceDict);
     if (!mainResourceDict)
         return 0;
     CFDictionarySetValue(propertyList.get(), LegacyWebArchiveMainResourceKey, mainResourceDict.get());
-        
+
     RetainPtr<CFMutableArrayRef> subresourcesArray(AdoptCF, CFArrayCreateMutable(0, archive->subresources().size(), &kCFTypeArrayCallBacks));
     const Vector<RefPtr<ArchiveResource> >& subresources(archive->subresources());
     for (unsigned i = 0; i < subresources.size(); ++i) {
-        RetainPtr<CFDictionaryRef> subresource = createPropertyListRepresentationFromResource(subresources[i].get(), false);
+        RetainPtr<CFDictionaryRef> subresource = createPropertyListRepresentation(subresources[i].get(), Subresource);
         if (subresource)
             CFArrayAppendValue(subresourcesArray.get(), subresource.get());
         else
@@ -147,7 +151,7 @@ static RetainPtr<CFDictionaryRef> createPropertyListRep(Archive* archive)
     RetainPtr<CFMutableArrayRef> subframesArray(AdoptCF, CFArrayCreateMutable(0, archive->subframeArchives().size(), &kCFTypeArrayCallBacks));
     const Vector<RefPtr<Archive> >& subframeArchives(archive->subframeArchives());
     for (unsigned i = 0; i < subframeArchives.size(); ++i) {
-        RetainPtr<CFDictionaryRef> subframeArchive = createPropertyListRep(subframeArchives[i].get());
+        RetainPtr<CFDictionaryRef> subframeArchive = createPropertyListRepresentation(subframeArchives[i].get());
         if (subframeArchive)
             CFArrayAppendValue(subframesArray.get(), subframeArchive.get());
         else
@@ -159,22 +163,23 @@ static RetainPtr<CFDictionaryRef> createPropertyListRep(Archive* archive)
     return propertyList;
 }
 
-static ResourceResponse createResourceResponseFromPropertyListData(CFDataRef data, CFStringRef responseDataType)
+ResourceResponse LegacyWebArchive::createResourceResponseFromPropertyListData(CFDataRef data, CFStringRef responseDataType)
 {
     ASSERT(data);
     if (!data)
         return ResourceResponse();
     
-    // If the ResourceResponseVersion (passed in as responseDataType) exists at all, this is a "new" webarchive that we can parse well in a cross platform manner
-    // If it doesn't exist, we will assume this is an "old" Cocoa-based WebArchive, and parse the ResourceResponse as such
+    // If the ResourceResponseVersion (passed in as responseDataType) exists at all, this is a "new" web archive that we
+    // can parse well in a cross platform manner If it doesn't exist, we will assume this is an "old" web archive with,
+    // NSURLResponse objects in it and parse the ResourceResponse as such.
     if (!responseDataType)
         return createResourceResponseFromMacArchivedData(data);
         
-    // FIXME: Parse the "new" format that the above comment references here
+    // FIXME: Parse the "new" format that the above comment references here. This format doesn't exist yet.
     return ResourceResponse();
 }
 
-static PassRefPtr<ArchiveResource> createResource(CFDictionaryRef dictionary)
+PassRefPtr<ArchiveResource> LegacyWebArchive::createResource(CFDictionaryRef dictionary)
 {
     ASSERT(dictionary);
     if (!dictionary)
@@ -236,17 +241,6 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create()
     return adoptRef(new LegacyWebArchive);
 }
 
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(SharedBuffer* data)
-{
-    LOG(Archives, "LegacyWebArchive - Creating from raw data");
-    
-    RefPtr<LegacyWebArchive> archive = create();
-    if (!archive->init(data))
-        return 0;
-        
-    return archive.release();
-}
-
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(PassRefPtr<ArchiveResource> mainResource, Vector<PassRefPtr<ArchiveResource> >& subresources, Vector<PassRefPtr<LegacyWebArchive> >& subframeArchives)
 {
     ASSERT(mainResource);
@@ -265,19 +259,19 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(PassRefPtr<ArchiveResource
     return archive.release();
 }
 
-LegacyWebArchive::LegacyWebArchive()
-{
-}
-
-bool LegacyWebArchive::init(SharedBuffer* data)
+PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(SharedBuffer* data)
 {
+    LOG(Archives, "LegacyWebArchive - Creating from raw data");
+    
+    RefPtr<LegacyWebArchive> archive = create();
+        
     ASSERT(data);
     if (!data)
-        return false;
+        return 0;
         
     RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
     if (!cfData)
-        return false;
+        return 0;
         
     CFStringRef errorString = 0;
     
@@ -289,15 +283,18 @@ bool LegacyWebArchive::init(SharedBuffer* data)
 #endif
         if (errorString)
             CFRelease(errorString);
-        return false;
+        return 0;
     }
     
     if (CFGetTypeID(plist.get()) != CFDictionaryGetTypeID()) {
         LOG(Archives, "LegacyWebArchive - Archive property list is not the expected CFDictionary, aborting invalid WebArchive");
-        return false;
+        return 0;
     }
     
-    return extract(plist.get());
+    if (!archive->extract(plist.get()))
+        return 0;
+
+    return archive.release();
 }
 
 bool LegacyWebArchive::extract(CFDictionaryRef dictionary)
@@ -370,38 +367,47 @@ bool LegacyWebArchive::extract(CFDictionaryRef dictionary)
 
 RetainPtr<CFDataRef> LegacyWebArchive::rawDataRepresentation()
 {
-    RetainPtr<CFDictionaryRef> propertyList = createPropertyListRep(this);
+    RetainPtr<CFDictionaryRef> propertyList = createPropertyListRepresentation(this);
+    ASSERT(propertyList);
     if (!propertyList) {
         LOG(Archives, "LegacyWebArchive - Failed to create property list for archive, returning no data");
         return 0;
     }
-    
-    // FIXME: On Mac, WebArchives have been written out as Binary Property Lists until this change.
-    // Unless we jump through CFWriteStream hoops, they'll now be textual XML data.  Is this okay?
-    RetainPtr<CFDataRef> plistData(AdoptCF, CFPropertyListCreateXMLData(0, propertyList.get()));
+
+    RetainPtr<CFWriteStreamRef> stream(AdoptCF, CFWriteStreamCreateWithAllocatedBuffers(0, 0));
+
+    CFWriteStreamOpen(stream.get());
+    CFPropertyListWriteToStream(propertyList.get(), stream.get(), kCFPropertyListBinaryFormat_v1_0, 0);
+
+    RetainPtr<CFDataRef> plistData(AdoptCF, static_cast<CFDataRef>(CFWriteStreamCopyProperty(stream.get(), kCFStreamPropertyDataWritten)));
+    ASSERT(plistData);
+
+    CFWriteStreamClose(stream.get());
+
     if (!plistData) {
         LOG(Archives, "LegacyWebArchive - Failed to convert property list into raw data, returning no data");
         return 0;
     }
-    
+
     return plistData;
 }
 
 #if !PLATFORM(MAC)
-// FIXME: Is it possible to parse in a Cocoa-style resource response manually, 
-// without NSKeyed(Un)Archiver, manipulating plists directly?
-// If so, the code that does it will go here.  
-// In the meantime, Mac will continue to NSKeyed(Un)Archive the response as it always has
-ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef responseData)
+
+ResourceResponse LegacyWebArchive::createResourceResponseFromMacArchivedData(CFDataRef responseData)
 {
+    // FIXME: If is is possible to parse in a serialized NSURLResponse manually, without using
+    // NSKeyedUnarchiver, manipulating plists directly, then we want to do that here.
+    // Until then, this can be done on Mac only.
     return ResourceResponse();
 }
 
-RetainPtr<CFDataRef> propertyListDataFromResourceResponse(const ResourceResponse& response)
+RetainPtr<CFDataRef> LegacyWebArchive::createPropertyListRepresentation(const ResourceResponse& response)
 {
-    // FIXME: Write out the "new" format described in ::createResourceResponseFromPropertyListData() up above
+    // FIXME: Write out the "new" format described in createResourceResponseFromPropertyListData once we invent it.
     return 0;
 }
+
 #endif
 
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Node* node)
@@ -445,7 +451,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Frame* frame)
     Vector<PassRefPtr<ArchiveResource> > subresources;
     documentLoader->getSubresources(subresources);
 
-    return LegacyWebArchive::create(documentLoader->mainResource(), subresources, subframeArchives);
+    return create(documentLoader->mainResource(), subresources, subframeArchives);
 }
 
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Range* range)
@@ -473,7 +479,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Range* range)
     return create(markupString, frame, nodeList);
 }
 
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString, Frame* frame, Vector<Node*>& nodes)
+PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString, Frame* frame, const Vector<Node*>& nodes)
 {
     ASSERT(frame);
     
@@ -490,19 +496,14 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
     Vector<PassRefPtr<LegacyWebArchive> > subframeArchives;
     Vector<PassRefPtr<ArchiveResource> > subresources;
     HashSet<KURL> uniqueSubresources;
-    
-    Vector<Node*>::iterator it = nodes.begin();
-    Vector<Node*>::iterator end = nodes.end();
-    
-    for (; it != end; ++it) {
+
+    size_t nodesSize = nodes.size();    
+    for (size_t i = 0; i < nodesSize; ++i) {
+        Node* node = nodes[i];
         Frame* childFrame;
-        if (((*it)->hasTagName(HTMLNames::frameTag) || (*it)->hasTagName(HTMLNames::iframeTag) || (*it)->hasTagName(HTMLNames::objectTag)) &&
-             (childFrame = static_cast<HTMLFrameOwnerElement*>(*it)->contentFrame())) {
-            RefPtr<LegacyWebArchive> subframeArchive;
-            if (Document* document = childFrame->document())
-                subframeArchive = LegacyWebArchive::create(document);
-            else
-                subframeArchive = create(childFrame);
+        if ((node->hasTagName(HTMLNames::frameTag) || node->hasTagName(HTMLNames::iframeTag) || node->hasTagName(HTMLNames::objectTag)) &&
+             (childFrame = static_cast<HTMLFrameOwnerElement*>(node)->contentFrame())) {
+            RefPtr<LegacyWebArchive> subframeArchive = create(childFrame->document());
             
             if (subframeArchive)
                 subframeArchives.append(subframeArchive);
@@ -510,7 +511,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
                 LOG_ERROR("Unabled to archive subframe %s", childFrame->tree()->name().string().utf8().data());
         } else {
             ListHashSet<KURL> subresourceURLs;
-            (*it)->getSubresourceURLs(subresourceURLs);
+            node->getSubresourceURLs(subresourceURLs);
             
             DocumentLoader* documentLoader = frame->loader()->documentLoader();
             ListHashSet<KURL>::iterator iterEnd = subresourceURLs.end();
@@ -541,7 +542,18 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
             }
         }
     }
-    
+
+    // Add favicon if one exists for this page, if we are archiving the entire page.
+    if (nodesSize && nodes[0]->isDocumentNode() && iconDatabase() && iconDatabase()->isEnabled()) {
+        const String& iconURL = iconDatabase()->iconURLForPageURL(responseURL);
+        if (!iconURL.isEmpty() && iconDatabase()->iconDataKnownForIconURL(iconURL)) {
+            if (Image* iconImage = iconDatabase()->iconForPageURL(responseURL, IntSize(16, 16))) {
+                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(iconURL), "image/x-icon", "", ""))
+                    subresources.append(resource.release());
+            }
+        }
+    }
+
     return create(mainResource, subresources, subframeArchives);
 }
 
@@ -550,13 +562,13 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::createFromSelection(Frame* frame)
     if (!frame)
         return 0;
     
-    RefPtr<Range> selectionRange = frame->selection()->toRange();
+    RefPtr<Range> selectionRange = frame->selection()->toNormalizedRange();
     Vector<Node*> nodeList;
     String markupString = frame->documentTypeString() + createMarkup(selectionRange.get(), &nodeList, AnnotateForInterchange);
     
     RefPtr<LegacyWebArchive> archive = create(markupString, frame, nodeList);
     
-    if (!frame->isFrameSet()) 
+    if (!frame->document() || !frame->document()->isFrameSet())
         return archive.release();
         
     // Wrap the frameset document in an iframe so it can be pasted into
@@ -570,7 +582,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::createFromSelection(Frame* frame)
     Vector<PassRefPtr<LegacyWebArchive> > subframeArchives;
     subframeArchives.append(archive);
     
-    archive = LegacyWebArchive::create(iframeResource.release(), subresources, subframeArchives);
+    archive = create(iframeResource.release(), subresources, subframeArchives);
     
     return archive.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
index 70faba5784..8c8f2e4ff6 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
+++ b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,8 +31,6 @@
 
 #include "Archive.h"
 
-#include <wtf/PassRefPtr.h>
-
 namespace WebCore {
 
 class Frame;
@@ -40,28 +38,33 @@ class Node;
 class Range;
 
 class LegacyWebArchive : public Archive {
-public:    
+public:
     static PassRefPtr<LegacyWebArchive> create();
     static PassRefPtr<LegacyWebArchive> create(SharedBuffer*);
     static PassRefPtr<LegacyWebArchive> create(PassRefPtr<ArchiveResource> mainResource, Vector<PassRefPtr<ArchiveResource> >& subresources, Vector<PassRefPtr<LegacyWebArchive> >& subframeArchives);
     static PassRefPtr<LegacyWebArchive> create(Node*);
     static PassRefPtr<LegacyWebArchive> create(Frame*);
-    static PassRefPtr<LegacyWebArchive> createFromSelection(Frame* frame);
+    static PassRefPtr<LegacyWebArchive> createFromSelection(Frame*);
     static PassRefPtr<LegacyWebArchive> create(Range*);
-    static PassRefPtr<LegacyWebArchive> create(const String& markupString, Frame*, Vector<Node*>& nodes);
 
     RetainPtr<CFDataRef> rawDataRepresentation();
 
 private:
-    LegacyWebArchive();
-    bool init(SharedBuffer*);
+    LegacyWebArchive() { }
+
+    enum MainResourceStatus { Subresource, MainResource };
+
+    static PassRefPtr<LegacyWebArchive> create(const String& markupString, Frame*, const Vector<Node*>& nodes);
+    static PassRefPtr<ArchiveResource> createResource(CFDictionaryRef);
+    static ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef);
+    static ResourceResponse createResourceResponseFromPropertyListData(CFDataRef, CFStringRef responseDataType);
+    static RetainPtr<CFDataRef> createPropertyListRepresentation(const ResourceResponse&);
+    static RetainPtr<CFDictionaryRef> createPropertyListRepresentation(Archive*);
+    static RetainPtr<CFDictionaryRef> createPropertyListRepresentation(ArchiveResource*, MainResourceStatus);
+
     bool extract(CFDictionaryRef);
-    
 };
 
-ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef);
-RetainPtr<CFDataRef> propertyListDataFromResourceResponse(const ResourceResponse&);
-
 }
 
 #endif // Archive
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
index b853a1595f..c474bbad50 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
+++ b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,9 +33,9 @@ namespace WebCore {
 
 static const NSString *LegacyWebArchiveResourceResponseKey = @"WebResourceResponse";
 
-// FIXME: Is it possible to parse in a Cocoa-style resource response manually, 
-// without NSKeyed(Un)Archiver, manipulating plists directly?
-ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef responseData)
+// FIXME: If is is possible to parse in a serialized NSURLResponse manually, without using
+// NSKeyedUnarchiver, manipulating plists directly, we would prefer to do that instead.
+ResourceResponse LegacyWebArchive::createResourceResponseFromMacArchivedData(CFDataRef responseData)
 {    
     ASSERT(responseData);
     if (!responseData)
@@ -56,19 +56,21 @@ ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef responseDat
     return ResourceResponse(response);
 }
 
-RetainPtr<CFDataRef> propertyListDataFromResourceResponse(const ResourceResponse& response)
+RetainPtr<CFDataRef> LegacyWebArchive::createPropertyListRepresentation(const ResourceResponse& response)
 {    
     NSURLResponse *nsResponse = response.nsURLResponse();
+    ASSERT(nsResponse);
     if (!nsResponse)
         return 0;
-        
-    NSMutableData *responseData = (NSMutableData *)CFDataCreateMutable(0, 0);
-    NSKeyedArchiver *archiver = [[NSKeyedArchiver alloc] initForWritingWithMutableData:responseData];
+
+    CFMutableDataRef responseData = CFDataCreateMutable(0, 0);
+
+    NSKeyedArchiver *archiver = [[NSKeyedArchiver alloc] initForWritingWithMutableData:(NSMutableData *)responseData];
     [archiver encodeObject:nsResponse forKey:LegacyWebArchiveResourceResponseKey];
     [archiver finishEncoding];
     [archiver release];
     
-    return RetainPtr<CFDataRef>(AdoptCF, (CFDataRef)responseData);
+    return RetainPtr<CFDataRef>(AdoptCF, responseData);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp b/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp
new file mode 100644
index 0000000000..83642c613a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ResourceLoader.h"
+
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+
+namespace WebCore {
+
+bool ResourceLoader::shouldCacheResponse(ResourceHandle*, CFCachedURLResponseRef cachedResponse)
+{
+    if (!m_sendResourceLoadCallbacks)
+        return 0;
+
+    CFURLResponseRef response = CFCachedURLResponseGetWrappedResponse(cachedResponse);
+    CFDataRef data = CFCachedURLResponseGetReceiverData(cachedResponse);
+    return frameLoader()->client()->shouldCacheResponse(documentLoader(), identifier(), response, CFDataGetBytePtr(data), CFDataGetLength(data));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
index d033b24b4b..3ded4f386b 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,35 +28,20 @@
 #include "IconDatabase.h"
 
 #include "AutodrainedPool.h"
-#include "CString.h"
 #include "DocumentLoader.h"
 #include "FileSystem.h"
 #include "IconDatabaseClient.h"
 #include "IconRecord.h"
-#include "Image.h"
 #include "IntSize.h"
-#include "KURL.h"
 #include "Logging.h"
-#include "PageURLRecord.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
-#include "SystemTime.h"
+#include "SuddenTermination.h"
 #include <runtime/InitializeThreading.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 
-#if PLATFORM(WIN_OS)
-#include <windows.h>
-#include <winbase.h>
-#include <shlobj.h>
-#else
-#include <sys/stat.h>
-#endif
-
-#if PLATFORM(DARWIN)
-#include <pthread.h>
-#endif
-
 // For methods that are meant to support API from the main thread - should not be called internally
 #define ASSERT_NOT_SYNC_THREAD() ASSERT(!m_syncThreadRunning || !IS_ICON_SYNC_THREAD())
 
@@ -64,7 +49,7 @@
 #define IS_ICON_SYNC_THREAD() (m_syncThread == currentThread())
 #define ASSERT_ICON_SYNC_THREAD() ASSERT(IS_ICON_SYNC_THREAD())
 
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(GTK)
 #define CAN_THEME_URL_ICON
 #endif
 
@@ -77,12 +62,12 @@ static int databaseCleanupCounter = 0;
 // Currently, a mismatched schema causes the DB to be wiped and reset.  This isn't 
 // so bad during development but in the future, we would need to write a conversion
 // function to advance older released schemas to "current"
-const int currentDatabaseVersion = 6;
+static const int currentDatabaseVersion = 6;
 
 // Icons expire once every 4 days
-const int iconExpirationTime = 60*60*24*4; 
+static const int iconExpirationTime = 60*60*24*4; 
 
-const int updateTimerDelay = 5; 
+static const int updateTimerDelay = 5; 
 
 static bool checkIntegrityOnOpen = false;
 
@@ -149,7 +134,8 @@ bool IconDatabase::open(const String& databasePath)
     // Lock here as well as first thing in the thread so the thread doesn't actually commence until the createThread() call 
     // completes and m_syncThreadRunning is properly set
     m_syncLock.lock();
-    m_syncThread = createThread(IconDatabase::iconDatabaseSyncThreadStart, this, "WebCore::IconDatabase");
+    m_syncThread = createThread(IconDatabase::iconDatabaseSyncThreadStart, this, "WebCore: IconDatabase");
+    m_syncThreadRunning = m_syncThread;
     m_syncLock.unlock();
     if (!m_syncThread)
         return false;
@@ -174,6 +160,9 @@ void IconDatabase::close()
     m_syncThreadRunning = false;    
     m_threadTerminationRequested = false;
     m_removeIconsRequested = false;
+
+    m_syncDB.close();
+    ASSERT(!isOpen());
 }
 
 void IconDatabase::removeAllIcons()
@@ -765,8 +754,8 @@ size_t IconDatabase::iconRecordCountWithData()
 }
 
 IconDatabase::IconDatabase()
-    : m_syncThreadRunning(false)
-    , m_defaultIconRecord(0)
+    : m_syncTimer(this, &IconDatabase::syncTimerFired)
+    , m_syncThreadRunning(false)
     , m_isEnabled(false)
     , m_privateBrowsingEnabled(false)
     , m_threadTerminationRequested(false)
@@ -777,9 +766,7 @@ IconDatabase::IconDatabase()
     , m_imported(false)
     , m_isImportedSet(false)
 {
-#if PLATFORM(DARWIN)
-    ASSERT(pthread_main_np());
-#endif
+    ASSERT(isMainThread());
 }
 
 IconDatabase::~IconDatabase()
@@ -812,6 +799,12 @@ void IconDatabase::notifyPendingLoadDecisions()
 
 void IconDatabase::wakeSyncThread()
 {
+    // The following is balanced by the call to enableSuddenTermination in the
+    // syncThreadMainLoop function.
+    // FIXME: It would be better to only disable sudden termination if we have
+    // something to write, not just if we have something to read.
+    disableSuddenTermination();
+
     MutexLocker locker(m_syncLock);
     m_syncCondition.signal();
 }
@@ -819,16 +812,24 @@ void IconDatabase::wakeSyncThread()
 void IconDatabase::scheduleOrDeferSyncTimer()
 {
     ASSERT_NOT_SYNC_THREAD();
-    if (!m_syncTimer)
-        m_syncTimer.set(new Timer<IconDatabase>(this, &IconDatabase::syncTimerFired));
 
-    m_syncTimer->startOneShot(updateTimerDelay);
+    if (!m_syncTimer.isActive()) {
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
+
+    m_syncTimer.startOneShot(updateTimerDelay);
 }
 
 void IconDatabase::syncTimerFired(Timer<IconDatabase>*)
 {
     ASSERT_NOT_SYNC_THREAD();
     wakeSyncThread();
+
+    // The following is balanced by the call to disableSuddenTermination in the
+    // scheduleOrDeferSyncTimer function.
+    enableSuddenTermination();
 }
 
 // ******************
@@ -1325,7 +1326,8 @@ void IconDatabase::performURLImport()
 void* IconDatabase::syncThreadMainLoop()
 {
     ASSERT_ICON_SYNC_THREAD();
-    static bool prunedUnretainedIcons = false;
+
+    bool shouldReenableSuddenTermination = false;
 
     m_syncLock.lock();
 
@@ -1364,6 +1366,7 @@ void* IconDatabase::syncThreadMainLoop()
             // or if private browsing is enabled
             // We also don't want to prune if the m_databaseCleanupCounter count is non-zero - that means someone
             // has asked to delay pruning
+            static bool prunedUnretainedIcons = false;
             if (didWrite && !m_privateBrowsingEnabled && !prunedUnretainedIcons && !databaseCleanupCounter) {
 #ifndef NDEBUG
                 double time = currentTime();
@@ -1396,13 +1399,32 @@ void* IconDatabase::syncThreadMainLoop()
         // We handle those at the top of this main loop so continue to jump back up there
         if (shouldStopThreadActivity())
             continue;
-            
-        m_syncCondition.wait(m_syncLock); 
+
+        if (shouldReenableSuddenTermination) {
+            // The following is balanced by the call to disableSuddenTermination in the
+            // wakeSyncThread function. Any time we wait on the condition, we also have
+            // to enableSuddenTermation, after doing the next batch of work.
+            enableSuddenTermination();
+        }
+
+        m_syncCondition.wait(m_syncLock);
+
+        shouldReenableSuddenTermination = true;
     }
+
     m_syncLock.unlock();
     
     // Thread is terminating at this point
-    return cleanupSyncThread();
+    cleanupSyncThread();
+
+    if (shouldReenableSuddenTermination) {
+        // The following is balanced by the call to disableSuddenTermination in the
+        // wakeSyncThread function. Any time we wait on the condition, we also have
+        // to enableSuddenTermation, after doing the next batch of work.
+        enableSuddenTermination();
+    }
+
+    return 0;
 }
 
 bool IconDatabase::readFromDatabase()
@@ -1689,23 +1711,23 @@ void IconDatabase::removeAllIconsOnThread()
 }
 
 void IconDatabase::deleteAllPreparedStatements()
-{        
+{
     ASSERT_ICON_SYNC_THREAD();
     
-    m_setIconIDForPageURLStatement.set(0);
-    m_removePageURLStatement.set(0);
-    m_getIconIDForIconURLStatement.set(0);
-    m_getImageDataForIconURLStatement.set(0);
-    m_addIconToIconInfoStatement.set(0);
-    m_addIconToIconDataStatement.set(0);
-    m_getImageDataStatement.set(0);
-    m_deletePageURLsForIconURLStatement.set(0);
-    m_deleteIconFromIconInfoStatement.set(0);
-    m_deleteIconFromIconDataStatement.set(0);
-    m_updateIconInfoStatement.set(0);
-    m_updateIconDataStatement.set(0);
-    m_setIconInfoStatement.set(0);
-    m_setIconDataStatement.set(0);
+    m_setIconIDForPageURLStatement.clear();
+    m_removePageURLStatement.clear();
+    m_getIconIDForIconURLStatement.clear();
+    m_getImageDataForIconURLStatement.clear();
+    m_addIconToIconInfoStatement.clear();
+    m_addIconToIconDataStatement.clear();
+    m_getImageDataStatement.clear();
+    m_deletePageURLsForIconURLStatement.clear();
+    m_deleteIconFromIconInfoStatement.clear();
+    m_deleteIconFromIconDataStatement.clear();
+    m_updateIconInfoStatement.clear();
+    m_updateIconDataStatement.clear();
+    m_setIconInfoStatement.clear();
+    m_setIconDataStatement.clear();
 }
 
 void* IconDatabase::cleanupSyncThread()
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h
index 4303ae1201..40f641a298 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,17 +27,15 @@
 #ifndef IconDatabase_h
 #define IconDatabase_h
 
-#if ENABLE(ICONDATABASE)
-#include "SQLiteDatabase.h"
-#endif
-
 #include "StringHash.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+
 #if ENABLE(ICONDATABASE)
+#include "SQLiteDatabase.h"
 #include <wtf/Threading.h>
 #endif
 
@@ -116,9 +114,9 @@ private:
 
     void wakeSyncThread();
     void scheduleOrDeferSyncTimer();
-    OwnPtr<Timer<IconDatabase> > m_syncTimer;
     void syncTimerFired(Timer<IconDatabase>*);
     
+    Timer<IconDatabase> m_syncTimer;
     ThreadIdentifier m_syncThread;
     bool m_syncThreadRunning;
     
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
index c76a2c4933..a7fb88d677 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
@@ -25,7 +25,10 @@
 
 #include "config.h"
 #include "IconDatabase.h"
+
+#include "PlatformString.h"
 #include "SharedBuffer.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -47,8 +50,8 @@ const int updateTimerDelay = 5;
 
 String IconDatabase::defaultDatabaseFilename()
 {
-    static String defaultDatabaseFilename = "Icons.db";
-    return defaultDatabaseFilename;
+    DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
+    return defaultDatabaseFilename.copy();
 }
 
 IconDatabase* iconDatabase()
@@ -62,7 +65,7 @@ IconDatabase::IconDatabase()
 {
 }
 
-bool IconDatabase::open(const String& databasePath)
+bool IconDatabase::open(const String& /*databasePath*/)
 {
     return false;
 }
@@ -85,7 +88,7 @@ void IconDatabase::removeAllIcons()
 {
 }
 
-void IconDatabase::setPrivateBrowsingEnabled(bool flag)
+void IconDatabase::setPrivateBrowsingEnabled(bool /*flag*/)
 {
 }
 
@@ -99,7 +102,7 @@ void IconDatabase::readIconForPageURLFromDisk(const String&)
 
 }
 
-Image* IconDatabase::iconForPageURL(const String& pageURL, const IntSize& size)
+Image* IconDatabase::iconForPageURL(const String& /*pageURL*/, const IntSize& size)
 {
     return defaultIcon(size);
 }
@@ -115,33 +118,33 @@ bool IconDatabase::iconDataKnownForIconURL(const String&)
     return false;
 }
 
-String IconDatabase::iconURLForPageURL(const String& pageURL)
+String IconDatabase::iconURLForPageURL(const String& /*pageURL*/)
 {
     return String();
 }
 
-Image* IconDatabase::defaultIcon(const IntSize& size)
+Image* IconDatabase::defaultIcon(const IntSize& /*size*/)
 {
     return 0;
 }
 
-void IconDatabase::retainIconForPageURL(const String& pageURL)
+void IconDatabase::retainIconForPageURL(const String& /*pageURL*/)
 {
 }
 
-void IconDatabase::releaseIconForPageURL(const String& pageURL)
+void IconDatabase::releaseIconForPageURL(const String& /*pageURL*/)
 {
 }
 
-void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String& iconURL)
+void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> /*data*/, const String& /*iconURL*/)
 {
 }
 
-void IconDatabase::setIconURLForPageURL(const String& iconURL, const String& pageURL)
+void IconDatabase::setIconURLForPageURL(const String& /*iconURL*/, const String& /*pageURL*/)
 {
 }
 
-void IconDatabase::setEnabled(bool enabled)
+void IconDatabase::setEnabled(bool /*enabled*/)
 {
 }
 
@@ -167,6 +170,26 @@ void IconDatabase::allowDatabaseCleanup()
 {
 }
 
+size_t IconDatabase::pageURLMappingCount()
+{
+    return 0;
+}
+
+size_t IconDatabase::retainedPageURLCount()
+{
+    return 0;
+}
+
+size_t IconDatabase::iconRecordCount()
+{
+    return 0;
+}
+
+size_t IconDatabase::iconRecordCountWithData()
+{
+    return 0;
+}
+
 void IconDatabase::setClient(IconDatabaseClient*)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
index efa7e1442b..d1aa2f3634 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
@@ -26,16 +26,12 @@
 #include "config.h"
 #include "IconFetcher.h"
 
-#include "Document.h"
 #include "Frame.h"
 #include "HTMLHeadElement.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
-#include "MIMETypeRegistry.h"
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
-#include "SharedBuffer.h"
-#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
@@ -105,8 +101,6 @@ static void parseIconLink(HTMLLinkElement* link, Vector<IconLinkEntry>& entries)
 PassRefPtr<IconFetcher> IconFetcher::create(Frame* frame, IconFetcherClient* client)
 {
     Document* document = frame->document();
-    if (!document)
-        return 0;
     
     HTMLHeadElement* head = document->head();
     if (!head)
@@ -164,7 +158,7 @@ void IconFetcher::cancel()
     if (m_handle)
         m_handle->cancel();
 }
-    
+
 PassRefPtr<SharedBuffer> IconFetcher::createIcon()
 {
     ASSERT(!m_entries.isEmpty());
@@ -172,8 +166,7 @@ PassRefPtr<SharedBuffer> IconFetcher::createIcon()
     // For now, just return the data of the first entry.
     return m_entries.first().buffer();
 }
-    
-    
+
 void IconFetcher::loadEntry()
 {
     ASSERT(m_currentEntry < m_entries.size());
@@ -191,7 +184,7 @@ void IconFetcher::loadFailed()
     
 void IconFetcher::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     int statusCode = response.httpStatusCode() / 100;
     if (statusCode == 4 || statusCode == 5) {
@@ -200,16 +193,16 @@ void IconFetcher::didReceiveResponse(ResourceHandle* handle, const ResourceRespo
     }    
 }
     
-void IconFetcher::didReceiveData(ResourceHandle* handle, const char* data, int length, int lengthReceived)
+void IconFetcher::didReceiveData(ResourceHandle* handle, const char* data, int length, int)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     m_entries[m_currentEntry].buffer()->append(data, length);
 }
 
 void IconFetcher::didFinishLoading(ResourceHandle* handle)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     if (m_currentEntry == m_entries.size() - 1) {
         // We finished loading, create the icon
@@ -227,10 +220,9 @@ void IconFetcher::didFinishLoading(ResourceHandle* handle)
     
 void IconFetcher::didFail(ResourceHandle* handle, const ResourceError&)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     loadFailed();
 }
 
-    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
index 933a6abfa0..5dd000e190 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
@@ -35,7 +35,9 @@
 #include "ResourceHandle.h"
 #include "ResourceResponse.h"
 #include "ResourceRequest.h"
+#include "SharedBuffer.h"
 #include "SubresourceLoader.h"
+#include <wtf/UnusedParam.h>
 
 using namespace std;
 
@@ -61,14 +63,6 @@ void IconLoader::startLoading()
     if (m_resourceLoader)
         return;
 
-    // FIXME: http://bugs.webkit.org/show_bug.cgi?id=10902
-    // Once ResourceHandle will load without a DocLoader, we can remove this check.
-    // A frame may be documentless - one example is a frame containing only a PDF.
-    if (!m_frame->document()) {
-        LOG(IconDatabase, "Documentless-frame - icon won't be loaded");
-        return;
-    }
-
     // Set flag so we can detect the case where the load completes before
     // SubresourceLoader::create returns.
     m_loadIsInProgress = true;
@@ -101,9 +95,13 @@ void IconLoader::didReceiveResponse(SubresourceLoader* resourceLoader, const Res
     }
 }
 
-void IconLoader::didReceiveData(SubresourceLoader* loader, const char*, int size)
+void IconLoader::didReceiveData(SubresourceLoader* unusedLoader, const char*, int unusedSize)
 {
-    LOG(IconDatabase, "IconLoader::didReceiveData() - Loader %p, number of bytes %i", loader, size);
+#if LOG_DISABLED
+    UNUSED_PARAM(unusedLoader);
+    UNUSED_PARAM(unusedSize);
+#endif
+    LOG(IconDatabase, "IconLoader::didReceiveData() - Loader %p, number of bytes %i", unusedLoader, unusedSize);
 }
 
 void IconLoader::didFail(SubresourceLoader* resourceLoader, const ResourceError&)
@@ -153,9 +151,12 @@ void IconLoader::finishLoading(const KURL& iconURL, PassRefPtr<SharedBuffer> dat
     // <rdar://problem/5463392> tracks that enhancement
     
     if (!iconURL.isEmpty() && m_loadIsInProgress) {
-        iconDatabase()->setIconDataForIconURL(data, iconURL.string());
         LOG(IconDatabase, "IconLoader::finishLoading() - Committing iconURL %s to database", iconURL.string().ascii().data());
         m_frame->loader()->commitIconURLToIconDatabase(iconURL);
+        // Setting the icon data only after committing to the database ensures that the data is
+        // kept in memory (so it does not have to be read from the database asynchronously), since
+        // there is a page URL referencing it.
+        iconDatabase()->setIconDataForIconURL(data, iconURL.string());
         m_frame->loader()->client()->dispatchDidReceiveIcon();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp
index 599aad326c..ffea318ff8 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp
@@ -34,7 +34,6 @@
 #include "Logging.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
-#include "SystemTime.h"
 
 #include <limits.h>
 
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.cpp b/src/3rdparty/webkit/WebCore/loader/loader.cpp
index 26b8ad1ce5..ad87b1d524 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/loader.cpp
@@ -48,20 +48,20 @@ namespace WebCore {
 
 #if REQUEST_MANAGEMENT_ENABLED
 // Match the parallel connection count used by the networking layer
-// FIXME should not hardcode something like this
-static const unsigned maxRequestsInFlightPerHost = 4;
+static unsigned maxRequestsInFlightPerHost;
 // Having a limit might still help getting more important resources first
 static const unsigned maxRequestsInFlightForNonHTTPProtocols = 20;
 #else
 static const unsigned maxRequestsInFlightPerHost = 10000;
 static const unsigned maxRequestsInFlightForNonHTTPProtocols = 10000;
 #endif
-    
-    
+
 Loader::Loader()
     : m_nonHTTPProtocolHost(AtomicString(), maxRequestsInFlightForNonHTTPProtocols)
     , m_requestTimer(this, &Loader::requestTimerFired)
+    , m_isSuspendingPendingRequests(false)
 {
+    maxRequestsInFlightPerHost = initializeMaximumHTTPConnectionCountPerHost();
 }
 
 Loader::~Loader()
@@ -101,8 +101,7 @@ void Loader::load(DocLoader* docLoader, CachedResource* resource, bool increment
 
     Host* host;
     KURL url(resource->url());
-    bool isHTTP = url.protocolIs("http") || url.protocolIs("https");
-    if (isHTTP) {
+    if (url.protocolInHTTPFamily()) {
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
         if (!host) {
@@ -117,7 +116,7 @@ void Loader::load(DocLoader* docLoader, CachedResource* resource, bool increment
     host->addRequest(request, priority);
     docLoader->incrementRequestCount();
 
-    if (priority > Low || !isHTTP || !hadRequests) {
+    if (priority > Low || !url.protocolInHTTPFamily() || !hadRequests) {
         // Try to request important resources immediately
         host->servePendingRequests(priority);
     } else {
@@ -139,6 +138,9 @@ void Loader::requestTimerFired(Timer<Loader>*)
 
 void Loader::servePendingRequests(Priority minimumPriority)
 {
+    if (m_isSuspendingPendingRequests)
+        return;
+
     m_requestTimer.stop();
     
     m_nonHTTPProtocolHost.servePendingRequests(minimumPriority);
@@ -156,9 +158,25 @@ void Loader::servePendingRequests(Priority minimumPriority)
         }
     }
 }
-    
+
+void Loader::suspendPendingRequests()
+{
+    ASSERT(!m_isSuspendingPendingRequests);
+    m_isSuspendingPendingRequests = true;
+}
+
+void Loader::resumePendingRequests()
+{
+    ASSERT(m_isSuspendingPendingRequests);
+    m_isSuspendingPendingRequests = false;
+    if (!m_hosts.isEmpty() || m_nonHTTPProtocolHost.hasRequests())
+        scheduleServePendingRequests();
+}
+
 void Loader::cancelRequests(DocLoader* docLoader)
 {
+    docLoader->clearPendingPreloads();
+
     if (m_nonHTTPProtocolHost.hasRequests())
         m_nonHTTPProtocolHost.cancelRequests(docLoader);
     
@@ -172,12 +190,9 @@ void Loader::cancelRequests(DocLoader* docLoader)
 
     scheduleServePendingRequests();
     
-    if (docLoader->loadInProgress())
-        ASSERT(docLoader->requestCount() == 1);
-    else
-        ASSERT(docLoader->requestCount() == 0);
+    ASSERT(docLoader->requestCount() == (docLoader->loadInProgress() ? 1 : 0));
 }
-    
+
 Loader::Host::Host(const AtomicString& name, unsigned maxRequestsInFlight)
     : m_name(name)
     , m_maxRequestsInFlight(maxRequestsInFlight)
@@ -210,6 +225,9 @@ bool Loader::Host::hasRequests() const
 
 void Loader::Host::servePendingRequests(Loader::Priority minimumPriority)
 {
+    if (cache()->loader()->isSuspendingPendingRequests())
+        return;
+
     bool serveMore = true;
     for (int priority = High; priority >= minimumPriority && serveMore; --priority)
         servePendingRequests(m_requestsPending[priority], serveMore);
@@ -236,11 +254,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         if (!request->cachedResource()->accept().isEmpty())
             resourceRequest.setHTTPAccept(request->cachedResource()->accept());
         
-        KURL referrer = docLoader->doc()->url();
-        if ((referrer.protocolIs("http") || referrer.protocolIs("https")) && referrer.path().isEmpty())
-            referrer.setPath("/");
-        resourceRequest.setHTTPReferrer(referrer.string());
-        FrameLoader::addHTTPOriginIfNeeded(resourceRequest, docLoader->doc()->securityOrigin()->toString());
+         // Do not set the referrer or HTTP origin here. That's handled by SubresourceLoader::create.
         
         if (resourceIsCacheValidator) {
             CachedResource* resourceToRevalidate = request->cachedResource()->resourceToRevalidate();
@@ -260,7 +274,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         }
 
         RefPtr<SubresourceLoader> loader = SubresourceLoader::create(docLoader->doc()->frame(),
-                                                                     this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
+            this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
         if (loader) {
             m_requestsLoading.add(loader.release(), request);
             request->cachedResource()->setRequestedFromNetworkingLayer();
@@ -288,6 +302,9 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     Request* request = i->second;
     m_requestsLoading.remove(i);
     DocLoader* docLoader = request->docLoader();
+    // Prevent the document from being destroyed before we are done with
+    // the docLoader that it will delete when the document gets deleted.
+    DocPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
@@ -333,6 +350,9 @@ void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
     Request* request = i->second;
     m_requestsLoading.remove(i);
     DocLoader* docLoader = request->docLoader();
+    // Prevent the document from being destroyed before we are done with
+    // the docLoader that it will delete when the document gets deleted.
+    DocPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
@@ -433,8 +453,9 @@ void Loader::Host::didReceiveData(SubresourceLoader* loader, const char* data, i
     ProcessingResource processingResource(this);
     
     if (resource->response().httpStatusCode() / 100 == 4) {
-        // Treat a 4xx response like a network error.
-        resource->error();
+        // Treat a 4xx response like a network error for all resources but images (which will ignore the error and continue to load for 
+        // legacy compatibility).
+        resource->httpStatusCodeError();
         return;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.h b/src/3rdparty/webkit/WebCore/loader/loader.h
index 19c3fda7dc..888da110e2 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.h
+++ b/src/3rdparty/webkit/WebCore/loader/loader.h
@@ -49,6 +49,10 @@ namespace WebCore {
         enum Priority { Low, Medium, High };
         void servePendingRequests(Priority minimumPriority = Low);
 
+        bool isSuspendingPendingRequests() { return m_isSuspendingPendingRequests; }
+        void suspendPendingRequests();
+        void resumePendingRequests();
+
     private:
         Priority determinePriority(const CachedResource*) const;
         void scheduleServePendingRequests();
@@ -108,6 +112,8 @@ namespace WebCore {
         Host m_nonHTTPProtocolHost;
         
         Timer<Loader> m_requestTimer;
+
+        bool m_isSuspendingPendingRequests;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/make-generated-sources.sh b/src/3rdparty/webkit/WebCore/make-generated-sources.sh
index 9ccfff1c87..88173d5326 100755
--- a/src/3rdparty/webkit/WebCore/make-generated-sources.sh
+++ b/src/3rdparty/webkit/WebCore/make-generated-sources.sh
@@ -5,4 +5,4 @@ export WebCore=$PWD
 export CREATE_HASH_TABLE="$SRCROOT/../JavaScriptCore/create_hash_table"
 
 mkdir -p DerivedSources/WebCore &&
-make -C DerivedSources/WebCore -f ../../DerivedSources.make
+make -C DerivedSources/WebCore -f ../../DerivedSources.make $@
diff --git a/src/3rdparty/webkit/WebCore/page/BarInfo.cpp b/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
index 153aee0919..f6a12106bf 100644
--- a/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
@@ -41,11 +41,21 @@ BarInfo::BarInfo(Frame* frame, Type type)
 {
 }
 
+Frame* BarInfo::frame() const
+{
+    return m_frame;
+}
+
 void BarInfo::disconnectFrame()
 {
     m_frame = 0;
 }
 
+BarInfo::Type BarInfo::type() const
+{
+    return m_type;
+}
+
 bool BarInfo::visible() const
 {
     if (!m_frame)
diff --git a/src/3rdparty/webkit/WebCore/page/BarInfo.h b/src/3rdparty/webkit/WebCore/page/BarInfo.h
index 4cbbcfcc5b..376b8fc6db 100644
--- a/src/3rdparty/webkit/WebCore/page/BarInfo.h
+++ b/src/3rdparty/webkit/WebCore/page/BarInfo.h
@@ -42,8 +42,11 @@ namespace WebCore {
 
         static PassRefPtr<BarInfo> create(Frame* frame, Type type) { return adoptRef(new BarInfo(frame, type)); }
 
+        Frame* frame() const;
         void disconnectFrame();
 
+        Type type() const;
+
         bool visible() const;
 
     private:
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.cpp b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
index 1f6e198611..86de82ee89 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -28,13 +28,14 @@
 #include "FloatRect.h"
 #include "Frame.h"
 #include "FrameTree.h"
+#include "Geolocation.h"
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InspectorController.h"
 #include "Page.h"
-#include "PageGroup.h"
+#include "PageGroupLoadDeferrer.h"
 #include "ResourceHandle.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
@@ -53,14 +54,6 @@ namespace WebCore {
 using namespace HTMLNames;
 using namespace std;
 
-class PageGroupLoadDeferrer : Noncopyable {
-public:
-    PageGroupLoadDeferrer(Page*, bool deferSelf);
-    ~PageGroupLoadDeferrer();
-private:
-    Vector<RefPtr<Frame>, 16> m_deferredFrames;
-};
-
 Chrome::Chrome(Page* page, ChromeClient* client)
     : m_page(page)
     , m_client(client)
@@ -151,13 +144,14 @@ void Chrome::takeFocus(FocusDirection direction) const
 Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features) const
 {
     Page* newPage = m_client->createWindow(frame, request, features);
+
 #if ENABLE(DOM_STORAGE)
-    
     if (newPage) {
         if (SessionStorage* oldSessionStorage = m_page->sessionStorage(false))
-                newPage->setSessionStorage(oldSessionStorage->copy(newPage));
+            newPage->setSessionStorage(oldSessionStorage->copy(newPage));
     }
 #endif
+
     return newPage;
 }
 
@@ -259,10 +253,7 @@ void Chrome::runJavaScriptAlert(Frame* frame, const String& message)
     PageGroupLoadDeferrer deferrer(m_page, true);
 
     ASSERT(frame);
-    String text = message;
-    text.replace('\\', frame->backslashAsCurrencySymbol());
-
-    m_client->runJavaScriptAlert(frame, text);
+    m_client->runJavaScriptAlert(frame, frame->displayStringModifiedByEncoding(message));
 }
 
 bool Chrome::runJavaScriptConfirm(Frame* frame, const String& message)
@@ -272,10 +263,7 @@ bool Chrome::runJavaScriptConfirm(Frame* frame, const String& message)
     PageGroupLoadDeferrer deferrer(m_page, true);
 
     ASSERT(frame);
-    String text = message;
-    text.replace('\\', frame->backslashAsCurrencySymbol());
-    
-    return m_client->runJavaScriptConfirm(frame, text);
+    return m_client->runJavaScriptConfirm(frame, frame->displayStringModifiedByEncoding(message));
 }
 
 bool Chrome::runJavaScriptPrompt(Frame* frame, const String& prompt, const String& defaultValue, String& result)
@@ -285,15 +273,10 @@ bool Chrome::runJavaScriptPrompt(Frame* frame, const String& prompt, const Strin
     PageGroupLoadDeferrer deferrer(m_page, true);
 
     ASSERT(frame);
-    String promptText = prompt;
-    promptText.replace('\\', frame->backslashAsCurrencySymbol());
-    String defaultValueText = defaultValue;
-    defaultValueText.replace('\\', frame->backslashAsCurrencySymbol());
-    
-    bool ok = m_client->runJavaScriptPrompt(frame, promptText, defaultValueText, result);
+    bool ok = m_client->runJavaScriptPrompt(frame, frame->displayStringModifiedByEncoding(prompt), frame->displayStringModifiedByEncoding(defaultValue), result);
     
     if (ok)
-        result.replace(frame->backslashAsCurrencySymbol(), '\\');
+        result = frame->displayStringModifiedByEncoding(result);
     
     return ok;
 }
@@ -301,10 +284,7 @@ bool Chrome::runJavaScriptPrompt(Frame* frame, const String& prompt, const Strin
 void Chrome::setStatusbarText(Frame* frame, const String& status)
 {
     ASSERT(frame);
-    String text = status;
-    text.replace('\\', frame->backslashAsCurrencySymbol());
-    
-    m_client->setStatusbarText(text);
+    m_client->setStatusbarText(frame->displayStringModifiedByEncoding(status));
 }
 
 bool Chrome::shouldInterruptJavaScript()
@@ -391,20 +371,26 @@ void Chrome::print(Frame* frame)
     m_client->print(frame);
 }
 
-void Chrome::disableSuddenTermination()
+void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
-    m_client->disableSuddenTermination();
-}
+    // Defer loads in case the client method runs a new event loop that would 
+    // otherwise cause the load to continue while we're in the middle of executing JavaScript.
+    PageGroupLoadDeferrer deferrer(m_page, true);
 
-void Chrome::enableSuddenTermination()
-{
-    m_client->enableSuddenTermination();
+    ASSERT(frame);
+    m_client->requestGeolocationPermissionForFrame(frame, geolocation);
 }
 
 void Chrome::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileChooser)
 {
     m_client->runOpenPanel(frame, fileChooser);
 }
+
+bool Chrome::setCursor(PlatformCursorHandle cursor)
+{
+    return m_client->setCursor(cursor);
+}
+
 // --------
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -437,14 +423,6 @@ String ChromeClient::generateReplacementFile(const String&)
     return String(); 
 }
 
-void ChromeClient::disableSuddenTermination()
-{
-}
-
-void ChromeClient::enableSuddenTermination()
-{
-}
-
 bool ChromeClient::paintCustomScrollbar(GraphicsContext*, const FloatRect&, ScrollbarControlSize, 
                                         ScrollbarControlState, ScrollbarPart, bool,
                                         float, float, ScrollbarControlPartMask)
@@ -457,49 +435,5 @@ bool ChromeClient::paintCustomScrollCorner(GraphicsContext*, const FloatRect&)
     return false;
 }
 
-// --------
-
-PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
-{
-    const HashSet<Page*>& pages = page->group().pages();
-
-    HashSet<Page*>::const_iterator end = pages.end();
-    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-        Page* otherPage = *it;
-        if ((deferSelf || otherPage != page)) {
-            if (!otherPage->defersLoading())
-                m_deferredFrames.append(otherPage->mainFrame());
-
-#if !PLATFORM(MAC)
-            for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (Document* document = frame->document())
-                    document->suspendActiveDOMObjects();
-            }
-#endif
-        }
-    }
-
-    size_t count = m_deferredFrames.size();
-    for (size_t i = 0; i < count; ++i)
-        if (Page* page = m_deferredFrames[i]->page())
-            page->setDefersLoading(true);
-}
-
-PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
-{
-    for (size_t i = 0; i < m_deferredFrames.size(); ++i) {
-        if (Page* page = m_deferredFrames[i]->page()) {
-            page->setDefersLoading(false);
-
-#if !PLATFORM(MAC)
-            for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (Document* document = frame->document())
-                    document->resumeActiveDOMObjects();
-            }
-#endif
-        }
-    }
-}
-
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.h b/src/3rdparty/webkit/WebCore/page/Chrome.h
index 47b912d28c..c26e450c0f 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.h
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,6 +20,7 @@
 #ifndef Chrome_h
 #define Chrome_h
 
+#include "Cursor.h"
 #include "FileChooser.h"
 #include "FocusDirection.h"
 #include "HostWindow.h"
@@ -38,6 +39,7 @@ namespace WebCore {
     class ContextMenu;
     class FloatRect;
     class Frame;
+    class Geolocation;
     class HitTestResult;
     class IntRect;
     class Page;
@@ -116,11 +118,12 @@ namespace WebCore {
 
         void print(Frame*);
 
-        void enableSuddenTermination();
-        void disableSuddenTermination();
+        void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
 
         void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
 
+        bool setCursor(PlatformCursorHandle);
+
 #if PLATFORM(MAC)
         void focusNSView(NSView*);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index 5d90b2f54c..e155754c97 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple, Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,11 +20,15 @@
 #ifndef ChromeClient_h
 #define ChromeClient_h
 
-#include "GraphicsContext.h"
+#include "Console.h"
+#include "Cursor.h"
 #include "FocusDirection.h"
-#include "ScrollTypes.h"
+#include "GraphicsContext.h"
+#include "HTMLParserQuirks.h"
 #include "HostWindow.h"
+#include "ScrollTypes.h"
 #include <wtf/Forward.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
@@ -42,16 +46,22 @@ namespace WebCore {
     class FileChooser;
     class FloatRect;
     class Frame;
+    class Geolocation;
+    class HTMLParserQuirks;
     class HitTestResult;
     class IntRect;
     class Node;
     class Page;
     class String;
     class Widget;
-    
+
     struct FrameLoadRequest;
     struct WindowFeatures;
 
+#if USE(ACCELERATED_COMPOSITING)
+    class GraphicsLayer;
+#endif
+
     class ChromeClient {
     public:
         virtual void chromeDestroyed() = 0;
@@ -93,7 +103,7 @@ namespace WebCore {
 
         virtual void setResizable(bool) = 0;
         
-        virtual void addMessageToConsole(const String& message, unsigned int lineNumber, const String& sourceID) = 0;
+        virtual void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID) = 0;
 
         virtual bool canRunBeforeUnloadConfirmPanel() = 0;
         virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame* frame) = 0;
@@ -116,7 +126,7 @@ namespace WebCore {
         virtual IntRect windowToScreen(const IntRect&) const = 0;
         virtual PlatformWidget platformWindow() const = 0;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const = 0;
-        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {} // Platforms other than Mac can implement this if it ever becomes necessary for them to do so.
+        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
         // End methods used by HostWindow.
 
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) = 0;
@@ -125,7 +135,9 @@ namespace WebCore {
 
         virtual void print(Frame*) = 0;
 
+#if ENABLE(DATABASE)
         virtual void exceededDatabaseQuota(Frame*, const String& databaseName) = 0;
+#endif
 
 #if ENABLE(DASHBOARD_SUPPORT)
         virtual void dashboardRegionsChanged();
@@ -139,21 +151,37 @@ namespace WebCore {
             
         virtual bool shouldReplaceWithGeneratedFileForUpload(const String& path, String& generatedFilename);
         virtual String generateReplacementFile(const String& path);
-        
-        virtual void enableSuddenTermination();
-        virtual void disableSuddenTermination();
 
         virtual bool paintCustomScrollbar(GraphicsContext*, const FloatRect&, ScrollbarControlSize, 
                                           ScrollbarControlState, ScrollbarPart pressedPart, bool vertical,
                                           float value, float proportion, ScrollbarControlPartMask);
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
+        // This is an asynchronous call. The ChromeClient can display UI asking the user for permission
+        // to use Geolococation. The ChromeClient must call Geolocation::setShouldClearCache() appropriately.
+        virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) = 0;
+            
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) = 0;
 
+        virtual bool setCursor(PlatformCursorHandle) = 0;
+
         // Notification that the given form element has changed. This function
         // will be called frequently, so handling should be very fast.
         virtual void formStateDidChange(const Node*) = 0;
 
+        virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() = 0;
+
+#if USE(ACCELERATED_COMPOSITING)
+        // Pass 0 as the GraphicsLayer to detatch the root layer.
+        virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) = 0;
+        // Sets a flag to specify that the next time content is drawn to the window,
+        // the changes appear on the screen in synchrony with updates to GraphicsLayers.
+        virtual void setNeedsOneShotDrawingSynchronization() = 0;
+        // Sets a flag to specify that the view needs to be updated, so we need
+        // to do an eager layout before the drawing.
+        virtual void scheduleViewUpdate() = 0;
+#endif
+
 #if PLATFORM(MAC)
         virtual KeyboardUIMode keyboardUIMode() { return KeyboardAccessDefault; }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index 8755f0eef3..99a0fc8fea 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -39,7 +39,7 @@
 #include "PageGroup.h"
 #include "PlatformString.h"
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 #include <profiler/Profiler.h>
 #endif
 
@@ -53,6 +53,11 @@ Console::Console(Frame* frame)
 {
 }
 
+Frame* Console::frame() const
+{
+    return m_frame;
+}
+
 void Console::disconnectFrame()
 {
     m_frame = 0;
@@ -68,7 +73,7 @@ static void printSourceURLAndLine(const String& sourceURL, unsigned lineNumber)
     }
 }
 
-static bool getFirstArgumentAsString(const ScriptCallFrame& callFrame, String& result, bool checkForNullOrUndefined = false)
+static bool getFirstArgumentAsString(ScriptState* scriptState, const ScriptCallFrame& callFrame, String& result, bool checkForNullOrUndefined = false)
 {
     if (!callFrame.argumentCount())
         return false;
@@ -77,7 +82,8 @@ static bool getFirstArgumentAsString(const ScriptCallFrame& callFrame, String& r
     if (checkForNullOrUndefined && (value.isNull() || value.isUndefined()))
         return false;
 
-    return value.getString(result);
+    result = value.toString(scriptState);
+    return true;
 }
 
 static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel level)
@@ -99,12 +105,13 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
         case CSSMessageSource:
             sourceString = "CSS";
             break;
-        default:
-            ASSERT_NOT_REACHED();
-            // Fall thru.
         case OtherMessageSource:
             sourceString = "OTHER";
             break;
+        default:
+            ASSERT_NOT_REACHED();
+            sourceString = "UNKNOWN";
+            break;
     }
 
     const char* levelString;
@@ -112,9 +119,6 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
         case TipMessageLevel:
             levelString = "TIP";
             break;
-        default:
-            ASSERT_NOT_REACHED();
-            // Fall thru.
         case LogMessageLevel:
             levelString = "LOG";
             break;
@@ -124,6 +128,22 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
         case ErrorMessageLevel:
             levelString = "ERROR";
             break;
+        case ObjectMessageLevel:
+            levelString = "OBJECT";
+            break;
+        case TraceMessageLevel:
+            levelString = "TRACE";
+            break;
+        case StartGroupMessageLevel:
+            levelString = "START GROUP";
+            break;
+        case EndGroupMessageLevel:
+            levelString = "END GROUP";
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            levelString = "UNKNOWN";
+            break;
     }
 
     printf("%s %s:", sourceString, levelString);
@@ -136,7 +156,7 @@ void Console::addMessage(MessageSource source, MessageLevel level, const String&
         return;
 
     if (source == JSMessageSource || source == WMLMessageSource)
-        page->chrome()->client()->addMessageToConsole(message, lineNumber, sourceURL);
+        page->chrome()->client()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
 
     page->inspectorController()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
 
@@ -160,8 +180,8 @@ void Console::addMessage(MessageLevel level, ScriptCallStack* callStack, bool ac
         return;
 
     String message;
-    if (getFirstArgumentAsString(lastCaller, message))
-        page->chrome()->client()->addMessageToConsole(message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
+    if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
+        page->chrome()->client()->addMessageToConsole(JSMessageSource, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
     page->inspectorController()->addMessageToConsole(JSMessageSource, level, callStack);
 
@@ -207,7 +227,8 @@ void Console::dir(ScriptCallStack* callStack)
 
 void Console::dirxml(ScriptCallStack* callStack)
 {
-    addMessage(NodeMessageLevel, callStack);
+    // The standard behavior of our console.log will print the DOM tree for nodes.
+    log(callStack);
 }
 
 void Console::trace(ScriptCallStack* callStack)
@@ -243,12 +264,12 @@ void Console::count(ScriptCallStack* callStack)
     // Follow Firebug's behavior of counting with null and undefined title in
     // the same bucket as no argument
     String title;
-    getFirstArgumentAsString(lastCaller, title);
+    getFirstArgumentAsString(callStack->state(), lastCaller, title);
 
     page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL().string());
 }
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 
 void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
 {
@@ -256,13 +277,15 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
-    if (title.isNull())
-        return;
-
     // FIXME: log a console message when profiling is disabled.
     if (!page->inspectorController()->profilerEnabled())
         return;
 
+    if (title.isNull()) {   // no title so give it the next user initiated profile title.
+        page->inspectorController()->startUserInitiatedProfiling(0);
+        return;
+    }
+
     JSC::Profiler::profiler()->startProfiling(callStack->state(), title);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.h b/src/3rdparty/webkit/WebCore/page/Console.h
index 7301fc905a..79396ea923 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.h
+++ b/src/3rdparty/webkit/WebCore/page/Console.h
@@ -31,7 +31,7 @@
 
 #include "PlatformString.h"
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 #include <profiler/Profile.h>
 #endif
 
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
 #endif
 
@@ -64,8 +64,8 @@ namespace WebCore {
         LogMessageLevel,
         WarningMessageLevel,
         ErrorMessageLevel,
+        // FIXME: the remaining levels should become a new MessageType enum.
         ObjectMessageLevel,
-        NodeMessageLevel,
         TraceMessageLevel,
         StartGroupMessageLevel,
         EndGroupMessageLevel
@@ -75,6 +75,7 @@ namespace WebCore {
     public:
         static PassRefPtr<Console> create(Frame* frame) { return adoptRef(new Console(frame)); }
 
+        Frame* frame() const;
         void disconnectFrame();
 
         void addMessage(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
@@ -89,7 +90,7 @@ namespace WebCore {
         void trace(ScriptCallStack*);
         void assertCondition(bool condition, ScriptCallStack*);
         void count(ScriptCallStack*);
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         void profile(const JSC::UString&, ScriptCallStack*);
         void profileEnd(const JSC::UString&, ScriptCallStack*);
 #endif
@@ -101,7 +102,7 @@ namespace WebCore {
         static bool shouldPrintExceptions();
         static void setShouldPrintExceptions(bool);
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         const ProfilesArray& profiles() const { return m_profiles; }
 #endif
 
@@ -112,7 +113,7 @@ namespace WebCore {
         Console(Frame*);
 
         Frame* m_frame;
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         ProfilesArray m_profiles;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/page/Console.idl b/src/3rdparty/webkit/WebCore/page/Console.idl
index fb7688d046..4803508bc2 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.idl
+++ b/src/3rdparty/webkit/WebCore/page/Console.idl
@@ -30,7 +30,7 @@ module window {
 
     interface Console {
 
-#if !defined(V8_BINDING)
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         readonly attribute [CustomGetter] Array profiles;
 #endif
     
@@ -45,7 +45,7 @@ module window {
         [CustomArgumentHandling, ImplementationFunction=assertCondition] void assert(in boolean condition);
         [CustomArgumentHandling] void count();
 
-#if !defined(V8_BINDING)
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         [CustomArgumentHandling] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
         [CustomArgumentHandling] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
index 5e9f8b5bf5..58e6519e6b 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
@@ -37,11 +37,13 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoadRequest.h"
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
+#include "HTMLFormElement.h"
 #include "InspectorController.h"
 #include "MouseEvent.h"
 #include "Node.h"
@@ -83,15 +85,10 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
     if (!event->isMouseEvent())
         return;
     MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
-    IntPoint point = IntPoint(mouseEvent->pageX(), mouseEvent->pageY());
-    HitTestResult result(point);
+    HitTestResult result(mouseEvent->absoluteLocation());
 
-    if (Frame* frame = event->target()->toNode()->document()->frame()) {
-        float zoomFactor = frame->pageZoomFactor();
-        point.setX(static_cast<int>(point.x() * zoomFactor));
-        point.setY(static_cast<int>(point.y() * zoomFactor));
-        result = frame->eventHandler()->hitTestResultAtPoint(point, false);
-    }
+    if (Frame* frame = event->target()->toNode()->document()->frame())
+        result = frame->eventHandler()->hitTestResultAtPoint(mouseEvent->absoluteLocation(), false);
 
     if (!result.innerNonSharedNode())
         return;
@@ -193,14 +190,14 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
 #endif
         case ContextMenuItemTagSpellingGuess:
             ASSERT(frame->selectedText().length());
-            if (frame->editor()->shouldInsertText(item->title(), frame->selection()->toRange().get(),
+            if (frame->editor()->shouldInsertText(item->title(), frame->selection()->toNormalizedRange().get(),
                 EditorInsertActionPasted)) {
                 Document* document = frame->document();
                 RefPtr<ReplaceSelectionCommand> command =
                     ReplaceSelectionCommand::create(document, createFragmentFromMarkup(document, item->title(), ""),
                                                                                    true, false, true);
                 applyCommand(command);
-                frame->revealSelection(RenderLayer::gAlignToEdgeIfNeeded);
+                frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
             }
             break;
         case ContextMenuItemTagIgnoreSpelling:
@@ -217,10 +214,10 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
             m_client->lookUpInDictionary(frame);
             break;
         case ContextMenuItemTagOpenLink:
-            if (Frame* targetFrame = result.targetFrame())
-                targetFrame->loader()->loadFrameRequestWithFormAndValues(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), 
-                    frame->loader()->outgoingReferrer())), false, 0, 0, HashMap<String, String>());
-            else
+            if (Frame* targetFrame = result.targetFrame()) {
+                targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), 
+                    frame->loader()->outgoingReferrer())), false, false, 0, 0);
+            } else
                 openNewWindow(result.absoluteLinkURL(), frame);
             break;
         case ContextMenuItemTagBold:
@@ -238,7 +235,7 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
             break;
         case ContextMenuItemTagStartSpeaking: {
             ExceptionCode ec;
-            RefPtr<Range> selectedRange = frame->selection()->toRange();
+            RefPtr<Range> selectedRange = frame->selection()->toNormalizedRange();
             if (!selectedRange || selectedRange->collapsed(ec)) {
                 Document* document = result.innerNonSharedNode()->document();
                 selectedRange = document->createRange();
@@ -298,6 +295,41 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
             frame->editor()->showColorPanel();
             break;
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+        case ContextMenuItemTagMakeUpperCase:
+            frame->editor()->uppercaseWord();
+            break;
+        case ContextMenuItemTagMakeLowerCase:
+            frame->editor()->lowercaseWord();
+            break;
+        case ContextMenuItemTagCapitalize:
+            frame->editor()->capitalizeWord();
+            break;
+        case ContextMenuItemTagShowSubstitutions:
+            frame->editor()->showSubstitutionsPanel();
+            break;
+        case ContextMenuItemTagSmartCopyPaste:
+            frame->editor()->toggleSmartInsertDelete();
+            break;
+        case ContextMenuItemTagSmartQuotes:
+            frame->editor()->toggleAutomaticQuoteSubstitution();
+            break;
+        case ContextMenuItemTagSmartDashes:
+            frame->editor()->toggleAutomaticDashSubstitution();
+            break;
+        case ContextMenuItemTagSmartLinks:
+            frame->editor()->toggleAutomaticLinkDetection();
+            break;
+        case ContextMenuItemTagTextReplacement:
+            frame->editor()->toggleAutomaticTextReplacement();
+            break;
+        case ContextMenuItemTagCorrectSpellingAutomatically:
+            frame->editor()->toggleAutomaticSpellingCorrection();
+            break;
+        case ContextMenuItemTagChangeBack:
+            frame->editor()->changeBackToReplacedString(result.replacedString());
+            break;
+#endif
         case ContextMenuItemTagInspectElement:
             if (Page* page = frame->page())
                 page->inspectorController()->inspect(result.innerNonSharedNode());
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.cpp b/src/3rdparty/webkit/WebCore/page/Coordinates.cpp
new file mode 100644
index 0000000000..637a8c2efd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Coordinates.h"
+
+namespace WebCore {
+
+String Coordinates::toString() const
+{
+    return String::format("coordinate(%.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg)",
+                          m_latitude, m_longitude, m_altitude, m_accuracy, 
+                          m_altitudeAccuracy, m_heading, m_speed);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.h b/src/3rdparty/webkit/WebCore/page/Coordinates.h
new file mode 100644
index 0000000000..acb5dd0329
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Coordinates_h
+#define Coordinates_h
+
+#include "Event.h"
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+typedef int ExceptionCode;
+
+class Coordinates : public RefCounted<Coordinates> {
+public:
+    static PassRefPtr<Coordinates> create(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed) { return adoptRef(new Coordinates(latitude, longitude, providesAltitude, altitude, accuracy, providesAltitudeAccuracy, altitudeAccuracy, providesHeading, heading, providesSpeed, speed)); }
+    
+    double latitude() const { return m_latitude; }
+    double longitude() const { return m_longitude; }
+    double altitude() const { return m_altitude; }
+    double accuracy() const { return m_accuracy; }
+    double altitudeAccuracy() const { return m_altitudeAccuracy; }
+    double heading() const { return m_heading; }
+    double speed() const { return m_speed; }
+
+    bool canProvideAltitude() const { return m_canProvideAltitude; }
+    bool canProvideAltitudeAccuracy() const { return m_canProvideAltitudeAccuracy; }
+    bool canProvideHeading() const { return m_canProvideHeading; }
+    bool canProvideSpeed() const { return m_canProvideSpeed; }
+    
+    String toString() const;
+
+private:
+    Coordinates(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed)
+        : m_latitude(latitude)
+        , m_longitude(longitude)
+        , m_altitude(altitude)
+        , m_accuracy(accuracy)
+        , m_altitudeAccuracy(altitudeAccuracy)
+        , m_heading(heading)
+        , m_speed(speed)
+        , m_canProvideAltitude(providesAltitude)
+        , m_canProvideAltitudeAccuracy(providesAltitudeAccuracy)
+        , m_canProvideHeading(providesHeading)
+        , m_canProvideSpeed(providesSpeed)
+    {
+    }
+
+    double m_latitude;
+    double m_longitude;
+    double m_altitude;
+    double m_accuracy;
+    double m_altitudeAccuracy;
+    double m_heading;
+    double m_speed;
+    
+    bool m_canProvideAltitude;
+    bool m_canProvideAltitudeAccuracy;
+    bool m_canProvideHeading;
+    bool m_canProvideSpeed;
+};
+    
+} // namespace WebCore
+
+#endif // Coordinates_h
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.idl b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
new file mode 100644
index 0000000000..f6c82b5317
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module core {
+
+    interface Coordinates {
+        readonly attribute double latitude;
+        readonly attribute double longitude;
+        readonly attribute [Custom] double altitude;
+        readonly attribute double accuracy;
+        readonly attribute [Custom] double altitudeAccuracy;
+        readonly attribute [Custom] double heading;
+        readonly attribute [Custom] double speed;
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [DontEnum] DOMString toString();
+#endif
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
index 5dab325f3d..3b54f02b8a 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
@@ -56,76 +56,89 @@ void DOMSelection::disconnectFrame()
     m_frame = 0;
 }
 
-Node* DOMSelection::anchorNode() const
+const VisibleSelection& DOMSelection::visibleSelection() const
 {
-    if (!m_frame)
-        return 0;
+    ASSERT(m_frame);
+    return m_frame->selection()->selection();
+}
 
-    const Selection& selection = m_frame->selection()->selection();
+static Position anchorPosition(const VisibleSelection& selection)
+{
     Position anchor = selection.isBaseFirst() ? selection.start() : selection.end();
-    anchor = rangeCompliantEquivalent(anchor);
-    return anchor.node();
+    return rangeCompliantEquivalent(anchor);
 }
 
-Node* DOMSelection::baseNode() const
+static Position focusPosition(const VisibleSelection& selection)
+{
+    Position focus = selection.isBaseFirst() ? selection.end() : selection.start();
+    return rangeCompliantEquivalent(focus);
+}
+
+static Position basePosition(const VisibleSelection& selection)
+{
+    return rangeCompliantEquivalent(selection.base());
+}
+
+static Position extentPosition(const VisibleSelection& selection)
+{
+    return rangeCompliantEquivalent(selection.extent());
+}
+
+Node* DOMSelection::anchorNode() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().base()).node();
+    return anchorPosition(visibleSelection()).node();
 }
 
 int DOMSelection::anchorOffset() const
 {
     if (!m_frame)
         return 0;
-
-    const Selection& selection = m_frame->selection()->selection();
-    Position anchor = selection.isBaseFirst() ? selection.start() : selection.end();
-    anchor = rangeCompliantEquivalent(anchor);
-    return anchor.offset();
+    return anchorPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
-int DOMSelection::baseOffset() const
+Node* DOMSelection::focusNode() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().base()).offset();
+    return focusPosition(visibleSelection()).node();
 }
 
-Node* DOMSelection::focusNode() const
+int DOMSelection::focusOffset() const
 {
     if (!m_frame)
         return 0;
-
-    const Selection& selection = m_frame->selection()->selection();
-    Position focus = selection.isBaseFirst() ? selection.end() : selection.start();
-    focus = rangeCompliantEquivalent(focus);
-    return focus.node();
+    return focusPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
-Node* DOMSelection::extentNode() const
+Node* DOMSelection::baseNode() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().extent()).node();
+    return basePosition(visibleSelection()).node();
 }
 
-int DOMSelection::focusOffset() const
+int DOMSelection::baseOffset() const
 {
     if (!m_frame)
         return 0;
+    return basePosition(visibleSelection()).deprecatedEditingOffset();
+}
 
-    const Selection& selection = m_frame->selection()->selection();
-    Position focus = selection.isBaseFirst() ? selection.end() : selection.start();
-    focus = rangeCompliantEquivalent(focus);
-    return focus.offset();
+
+Node* DOMSelection::extentNode() const
+{
+    if (!m_frame)
+        return 0;
+    return extentPosition(visibleSelection()).node();
 }
 
 int DOMSelection::extentOffset() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().extent()).offset();
+    return extentPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
 bool DOMSelection::isCollapsed() const
@@ -142,6 +155,9 @@ String DOMSelection::type() const
 
     SelectionController* selection = m_frame->selection();
 
+    // This is a WebKit DOM extension, incompatible with an IE extension
+    // IE has this same attribute, but returns "none", "text" and "control"
+    // http://msdn.microsoft.com/en-us/library/ms534692(VS.85).aspx
     if (selection->isNone())
         return "None";
     if (selection->isCaret())
@@ -173,7 +189,7 @@ void DOMSelection::collapseToEnd()
     if (!m_frame)
         return;
 
-    const Selection& selection = m_frame->selection()->selection();
+    const VisibleSelection& selection = m_frame->selection()->selection();
     m_frame->selection()->moveTo(VisiblePosition(selection.end(), DOWNSTREAM));
 }
 
@@ -182,7 +198,7 @@ void DOMSelection::collapseToStart()
     if (!m_frame)
         return;
 
-    const Selection& selection = m_frame->selection()->selection();
+    const VisibleSelection& selection = m_frame->selection()->selection();
     m_frame->selection()->moveTo(VisiblePosition(selection.start(), DOWNSTREAM));
 }
 
@@ -298,8 +314,11 @@ PassRefPtr<Range> DOMSelection::getRangeAt(int index, ExceptionCode& ec)
         return 0;
     }
 
-    const Selection& selection = m_frame->selection()->selection();
-    return selection.toRange();
+    // If you're hitting this, you've added broken multi-range selection support
+    ASSERT(rangeCount() == 1);
+
+    const VisibleSelection& selection = m_frame->selection()->selection();
+    return selection.firstRange();
 }
 
 void DOMSelection::removeAllRanges()
@@ -319,31 +338,31 @@ void DOMSelection::addRange(Range* r)
     SelectionController* selection = m_frame->selection();
     
     if (selection->isNone()) {
-        selection->setSelection(Selection(r));
+        selection->setSelection(VisibleSelection(r));
         return;
     }
 
-    RefPtr<Range> range = selection->selection().toRange();
+    RefPtr<Range> range = selection->selection().toNormalizedRange();
     ExceptionCode ec = 0;
     if (r->compareBoundaryPoints(Range::START_TO_START, range.get(), ec) == -1) {
         // We don't support discontiguous selection. We don't do anything if r and range don't intersect.
         if (r->compareBoundaryPoints(Range::START_TO_END, range.get(), ec) > -1) {
             if (r->compareBoundaryPoints(Range::END_TO_END, range.get(), ec) == -1)
                 // The original range and r intersect.
-                selection->setSelection(Selection(r->startPosition(), range->endPosition(), DOWNSTREAM));
+                selection->setSelection(VisibleSelection(r->startPosition(), range->endPosition(), DOWNSTREAM));
             else
                 // r contains the original range.
-                selection->setSelection(Selection(r));
+                selection->setSelection(VisibleSelection(r));
         }
     } else {
         // We don't support discontiguous selection. We don't do anything if r and range don't intersect.
         if (r->compareBoundaryPoints(Range::END_TO_START, range.get(), ec) < 1) {
             if (r->compareBoundaryPoints(Range::END_TO_END, range.get(), ec) == -1)
                 // The original range contains r.
-                selection->setSelection(Selection(range.get()));
+                selection->setSelection(VisibleSelection(range.get()));
             else
                 // The original range and r intersect.
-                selection->setSelection(Selection(range->startPosition(), r->endPosition(), DOWNSTREAM));
+                selection->setSelection(VisibleSelection(range->startPosition(), r->endPosition(), DOWNSTREAM));
         }
     }
 }
@@ -361,7 +380,7 @@ void DOMSelection::deleteFromDocument()
     if (isCollapsed())
         selection->modify(SelectionController::EXTEND, SelectionController::BACKWARD, CharacterGranularity);
 
-    RefPtr<Range> selectedRange = selection->selection().toRange();
+    RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
     ExceptionCode ec = 0;
     selectedRange->deleteContents(ec);
@@ -383,7 +402,7 @@ bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
 
     Node* parentNode = n->parentNode();
     unsigned nodeIndex = n->nodeIndex();
-    RefPtr<Range> selectedRange = selection->selection().toRange();
+    RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
     if (!parentNode)
         return false;
@@ -418,7 +437,7 @@ String DOMSelection::toString()
     if (!m_frame)
         return String();
 
-    return plainText(m_frame->selection()->selection().toRange().get());
+    return plainText(m_frame->selection()->selection().toNormalizedRange().get());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.h b/src/3rdparty/webkit/WebCore/page/DOMSelection.h
index fd8d1fc52d..6a914d6a6d 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.h
@@ -40,6 +40,7 @@ namespace WebCore {
     class Range;
     class Node;
     class String;
+    class VisibleSelection;
 
     typedef int ExceptionCode;
 
@@ -88,12 +89,13 @@ namespace WebCore {
 
         // Microsoft Selection Object API
         void empty();
-        //void clear();
-        //TextRange *createRange();
 
     private:
         DOMSelection(Frame*);
-        
+
+        // Convenience method for accessors, does not NULL check m_frame.
+        const VisibleSelection& visibleSelection() const;
+
         Frame* m_frame;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.idl b/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
index 85d23bfebe..be6c2b4f0f 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,43 +29,58 @@
 
 module window {
 
+    // This is based off of Mozilla's Selection interface
+    // https://developer.mozilla.org/En/DOM/Selection
     interface DOMSelection {
         readonly attribute Node anchorNode;
         readonly attribute long anchorOffset;
         readonly attribute Node focusNode;
         readonly attribute long focusOffset;
-        readonly attribute Node baseNode;
-        readonly attribute long baseOffset;
-        readonly attribute Node extentNode;
-        readonly attribute long extentOffset;
+
         readonly attribute boolean isCollapsed;
-        readonly attribute DOMString type;
         readonly attribute long rangeCount;
 
         void collapse(in Node node, in long index)
             raises(DOMException);
         void collapseToEnd();
         void collapseToStart();
+
         void deleteFromDocument();
         boolean containsNode(in Node node, in boolean allowPartial);
         void selectAllChildren(in Node node)
             raises(DOMException);
-        void empty();
-        void setBaseAndExtent(in Node baseNode, in long baseOffset, in Node extentNode, in long extentOffset)
-            raises(DOMException);
-        void setPosition(in Node node, in long offset)
-            raises(DOMException);
-        void modify(in DOMString alter, in DOMString direction, in DOMString granularity);
+
         void extend(in Node node, in long offset)
             raises(DOMException);
+
         Range getRangeAt(in long index)
             raises(DOMException);
         void removeAllRanges();
         void addRange(in Range range);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
+
+        // WebKit extensions
+        readonly attribute Node baseNode;
+        readonly attribute long baseOffset;
+        readonly attribute Node extentNode;
+        readonly attribute long extentOffset;
+
+        // WebKit's "type" accessor returns "None", "Range" and "Caret"
+        // IE's type accessor returns "none", "text" and "control"
+        readonly attribute DOMString type;
+
+        void modify(in DOMString alter, in DOMString direction, in DOMString granularity);
+        void setBaseAndExtent(in Node baseNode, in long baseOffset, in Node extentNode, in long extentOffset)
+            raises(DOMException);
+        void setPosition(in Node node, in long offset)
+            raises(DOMException);
+
+        // IE extentions
+        // http://msdn.microsoft.com/en-us/library/ms535869(VS.85).aspx
+        void empty();
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.cpp b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
index 911da718e7..1cc77304c9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 #include "DOMTimer.h"
 
-#include "Document.h"
 #include "ScheduledAction.h"
 #include "ScriptExecutionContext.h"
 #include <wtf/HashSet.h>
@@ -39,7 +38,7 @@ namespace WebCore {
 
 static const int maxTimerNestingLevel = 5;
 static const double oneMillisecond = 0.001;
-static const double minTimerInterval = 0.010; // 10 milliseconds
+double DOMTimer::s_minTimerInterval = 0.010; // 10 milliseconds
 
 static int timerNestingLevel = 0;
 
@@ -58,18 +57,15 @@ DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int
     
     m_nestingLevel = timerNestingLevel + 1;
 
-    // FIXME: Move the timeout map and API to ScriptExecutionContext to be able
-    // to create timeouts from Workers.
-    ASSERT(scriptExecutionContext() && scriptExecutionContext()->isDocument());
-    static_cast<Document*>(scriptExecutionContext())->addTimeout(m_timeoutId, this);
+    scriptExecutionContext()->addTimeout(m_timeoutId, this);
 
     double intervalMilliseconds = max(oneMillisecond, timeout * oneMillisecond);
 
     // Use a minimum interval of 10 ms to match other browsers, but only once we've
     // nested enough to notice that we're repeating.
     // Faster timers might be "better", but they're incompatible.
-    if (intervalMilliseconds < minTimerInterval && m_nestingLevel >= maxTimerNestingLevel)
-        intervalMilliseconds = minTimerInterval;
+    if (intervalMilliseconds < s_minTimerInterval && m_nestingLevel >= maxTimerNestingLevel)
+        intervalMilliseconds = s_minTimerInterval;
     if (singleShot)
         startOneShot(intervalMilliseconds);
     else
@@ -79,8 +75,7 @@ DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int
 DOMTimer::~DOMTimer()
 {
     if (scriptExecutionContext()) {
-        ASSERT(scriptExecutionContext()->isDocument());
-        static_cast<Document*>(scriptExecutionContext())->removeTimeout(m_timeoutId);
+        scriptExecutionContext()->removeTimeout(m_timeoutId);
     }
 }
     
@@ -100,8 +95,7 @@ void DOMTimer::removeById(ScriptExecutionContext* context, int timeoutId)
     // respectively
     if (timeoutId <= 0)
         return;
-    ASSERT(context && context->isDocument());
-    delete static_cast<Document*>(context)->findTimeout(timeoutId);
+    delete context->findTimeout(timeoutId);
 }
 
 void DOMTimer::fired()
@@ -111,10 +105,10 @@ void DOMTimer::fired()
 
     // Simple case for non-one-shot timers.
     if (isActive()) {
-        if (repeatInterval() && repeatInterval() < minTimerInterval) {
+        if (repeatInterval() && repeatInterval() < s_minTimerInterval) {
             m_nestingLevel++;
             if (m_nestingLevel >= maxTimerNestingLevel)
-                augmentRepeatInterval(minTimerInterval - repeatInterval());
+                augmentRepeatInterval(s_minTimerInterval - repeatInterval());
         }
         
         // No access to member variables after this point, it can delete the timer.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.h b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
index 200b9b131d..f6343fcce0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
@@ -51,6 +51,12 @@ public:
     virtual void suspend();
     virtual void resume();
 
+    // The lowest allowable timer setting (in seconds, 0.001 == 1 ms).
+    // Default is 10ms.
+    // Chromium uses a non-default timeout.
+    static double minTimerInterval() { return s_minTimerInterval; }
+    static void setMinTimerInterval(double value) { s_minTimerInterval = value; }
+
 private:
     DOMTimer(ScriptExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
     virtual void fired();
@@ -60,6 +66,7 @@ private:
     OwnPtr<ScheduledAction> m_action;
     double m_nextFireInterval;
     double m_repeatInterval;
+    static double s_minTimerInterval;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index dd14fb92bd..bc1192d9a6 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -27,6 +27,7 @@
 #include "DOMWindow.h"
 
 #include "BarInfo.h"
+#include "BeforeUnloadEvent.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSRuleList.h"
 #include "CSSStyleSelector.h"
@@ -34,8 +35,10 @@
 #include "Chrome.h"
 #include "Console.h"
 #include "DOMSelection.h"
+#include "DOMTimer.h"
 #include "Document.h"
 #include "Element.h"
+#include "EventException.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
@@ -46,6 +49,7 @@
 #include "FrameView.h"
 #include "HTMLFrameOwnerElement.h"
 #include "History.h"
+#include "InspectorController.h"
 #include "Location.h"
 #include "MessageEvent.h"
 #include "Navigator.h"
@@ -56,6 +60,8 @@
 #include "Screen.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "SuddenTermination.h"
+#include "WebKitPoint.h"
 #include <algorithm>
 #include <wtf/MathExtras.h>
 
@@ -102,6 +108,152 @@ private:
     RefPtr<SecurityOrigin> m_targetOrigin;
 };
 
+typedef HashMap<DOMWindow*, RegisteredEventListenerVector*> DOMWindowRegisteredEventListenerMap;
+
+static DOMWindowRegisteredEventListenerMap& pendingUnloadEventListenerMap()
+{
+    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
+    return eventListenerMap;
+}
+
+static DOMWindowRegisteredEventListenerMap& pendingBeforeUnloadEventListenerMap()
+{
+    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
+    return eventListenerMap;
+}
+
+static bool allowsPendingBeforeUnloadListeners(DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+    Frame* frame = window->frame();
+    Page* page = frame->page();
+    return page && frame == page->mainFrame();
+}
+
+static void addPendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+{
+    ASSERT_ARG(window, window);
+    ASSERT_ARG(listener, listener);
+
+    if (map.isEmpty())
+        disableSuddenTermination();
+
+    pair<DOMWindowRegisteredEventListenerMap::iterator, bool> result = map.add(window, 0);
+    if (result.second)
+        result.first->second = new RegisteredEventListenerVector;
+    result.first->second->append(listener);
+}
+
+static void removePendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+{
+    ASSERT_ARG(window, window);
+    ASSERT_ARG(listener, listener);
+
+    DOMWindowRegisteredEventListenerMap::iterator it = map.find(window);
+    ASSERT(it != map.end());
+
+    RegisteredEventListenerVector* listeners = it->second;
+    size_t index = listeners->find(listener);
+    ASSERT(index != WTF::notFound);
+    listeners->remove(index);
+
+    if (!listeners->isEmpty())
+        return;
+
+    map.remove(it);
+    delete listeners;
+
+    if (map.isEmpty())
+        enableSuddenTermination();
+}
+
+static void removePendingEventListeners(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+
+    RegisteredEventListenerVector* listeners = map.take(window);
+    if (!listeners)
+        return;
+
+    delete listeners;
+
+    if (map.isEmpty())
+        enableSuddenTermination();
+}
+
+bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
+{
+    DOMWindowRegisteredEventListenerMap& map = pendingBeforeUnloadEventListenerMap();
+    if (map.isEmpty())
+        return true;
+
+    static bool alreadyDispatched = false;
+    ASSERT(!alreadyDispatched);
+    if (alreadyDispatched)
+        return true;
+
+    Vector<RefPtr<DOMWindow> > windows;
+    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
+    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+        windows.append(it->first);
+
+    size_t size = windows.size();
+    for (size_t i = 0; i < size; ++i) {
+        DOMWindow* window = windows[i].get();
+        RegisteredEventListenerVector* listeners = map.get(window);
+        if (!listeners)
+            continue;
+
+        RegisteredEventListenerVector listenersCopy = *listeners;
+        Frame* frame = window->frame();
+        if (!frame->shouldClose(&listenersCopy))
+            return false;
+    }
+
+    enableSuddenTermination();
+
+    alreadyDispatched = true;
+
+    return true;
+}
+
+unsigned DOMWindow::pendingUnloadEventListeners() const
+{
+    RegisteredEventListenerVector* listeners = pendingUnloadEventListenerMap().get(const_cast<DOMWindow*>(this));
+    return listeners ? listeners->size() : 0;
+}
+
+void DOMWindow::dispatchAllPendingUnloadEvents()
+{
+    DOMWindowRegisteredEventListenerMap& map = pendingUnloadEventListenerMap();
+    if (map.isEmpty())
+        return;
+
+    static bool alreadyDispatched = false;
+    ASSERT(!alreadyDispatched);
+    if (alreadyDispatched)
+        return;
+
+    Vector<RefPtr<DOMWindow> > windows;
+    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
+    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+        windows.append(it->first);
+
+    size_t size = windows.size();
+    for (size_t i = 0; i < size; ++i) {
+        DOMWindow* window = windows[i].get();
+        RegisteredEventListenerVector* listeners = map.get(window);
+        if (!listeners)
+            continue;
+        RegisteredEventListenerVector listenersCopy = *listeners;
+        window->dispatchUnloadEvent(&listenersCopy);
+    }
+
+    enableSuddenTermination();
+
+    alreadyDispatched = true;
+}
+
 // This function:
 // 1) Validates the pending changes are not changing to NaN
 // 2) Constrains the window rect to no smaller than 100 in each dimension and no
@@ -142,6 +294,62 @@ void DOMWindow::adjustWindowRect(const FloatRect& screen, FloatRect& window, con
     window.setY(max(screen.y(), min(window.y(), screen.bottom() - window.height())));
 }
 
+void DOMWindow::parseModalDialogFeatures(const String& featuresArg, HashMap<String, String>& map)
+{
+    Vector<String> features;
+    featuresArg.split(';', features);
+    Vector<String>::const_iterator end = features.end();
+    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
+        String s = *it;
+        int pos = s.find('=');
+        int colonPos = s.find(':');
+        if (pos >= 0 && colonPos >= 0)
+            continue; // ignore any strings that have both = and :
+        if (pos < 0)
+            pos = colonPos;
+        if (pos < 0) {
+            // null string for value means key without value
+            map.set(s.stripWhiteSpace().lower(), String());
+        } else {
+            String key = s.left(pos).stripWhiteSpace().lower();
+            String val = s.substring(pos + 1).stripWhiteSpace().lower();
+            int spacePos = val.find(' ');
+            if (spacePos != -1)
+                val = val.left(spacePos);
+            map.set(key, val);
+        }
+    }
+}
+
+bool DOMWindow::allowPopUp(Frame* activeFrame)
+{
+    ASSERT(activeFrame);
+    if (activeFrame->script()->processingUserGesture())
+        return true;
+    Settings* settings = activeFrame->settings();
+    return settings && settings->javaScriptCanOpenWindowsAutomatically();
+}
+
+bool DOMWindow::canShowModalDialog(const Frame* frame)
+{
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return page->chrome()->canRunModal();
+}
+
+bool DOMWindow::canShowModalDialogNow(const Frame* frame)
+{
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return page->chrome()->canRunModalNow();
+}
+
 DOMWindow::DOMWindow(Frame* frame)
     : m_frame(frame)
 {
@@ -151,6 +359,14 @@ DOMWindow::~DOMWindow()
 {
     if (m_frame)
         m_frame->clearFormerDOMWindow(this);
+
+    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
+    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+}
+
+ScriptExecutionContext* DOMWindow::scriptExecutionContext() const
+{
+    return document();
 }
 
 void DOMWindow::disconnectFrame()
@@ -323,10 +539,10 @@ Storage* DOMWindow::sessionStorage() const
         return 0;
 
     Document* document = m_frame->document();
-    if (!document)
-        return 0;
 
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
+    page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
+
     m_sessionStorage = Storage::create(m_frame, storageArea.release());
     return m_sessionStorage.get();
 }
@@ -349,9 +565,11 @@ Storage* DOMWindow::localStorage() const
         return 0;
 
     LocalStorage* localStorage = page->group().localStorage();
-    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(m_frame, document->securityOrigin()) : 0; 
-    if (storageArea)
+    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
+    if (storageArea) {
+        page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
         m_localStorage = Storage::create(m_frame, storageArea.release());
+    }
 
     return m_localStorage.get();
 }
@@ -366,7 +584,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
     // to generate the SYNTAX_ERR exception correctly.
     RefPtr<SecurityOrigin> target;
     if (targetOrigin != "*") {
-        target = SecurityOrigin::create(KURL(targetOrigin));
+        target = SecurityOrigin::createFromString(targetOrigin);
         if (target->isEmpty()) {
             ec = SYNTAX_ERR;
             return;
@@ -413,7 +631,8 @@ void DOMWindow::postMessageTimerFired(PostMessageTimer* t)
     if (messagePort)
         messagePort->attachToContext(document());
 
-    document()->dispatchWindowEvent(timer->event());
+    ExceptionCode ec = 0;
+    dispatchEvent(timer->event(), ec);
 }
 
 DOMSelection* DOMWindow::getSelection()
@@ -452,7 +671,20 @@ void DOMWindow::close()
     if (!m_frame)
         return;
 
-    if (m_frame->loader()->openedByDOM() || m_frame->loader()->getHistoryLength() <= 1)
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    if (m_frame != page->mainFrame())
+        return;
+
+    Settings* settings = m_frame->settings();
+    bool allowScriptsToCloseWindows =
+        settings && settings->allowScriptsToCloseWindows();
+
+    if (m_frame->loader()->openedByDOM()
+        || m_frame->loader()->getHistoryLength() <= 1
+        || allowScriptsToCloseWindows)
         m_frame->scheduleClose();
 }
 
@@ -483,10 +715,7 @@ void DOMWindow::alert(const String& message)
     if (!m_frame)
         return;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -500,10 +729,7 @@ bool DOMWindow::confirm(const String& message)
     if (!m_frame)
         return false;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -517,10 +743,7 @@ String DOMWindow::prompt(const String& message, const String& defaultValue)
     if (!m_frame)
         return String();
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -628,10 +851,7 @@ int DOMWindow::scrollX() const
     if (!view)
         return 0;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     return static_cast<int>(view->scrollX() / m_frame->pageZoomFactor());
 }
@@ -645,10 +865,7 @@ int DOMWindow::scrollY() const
     if (!view)
         return 0;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     return static_cast<int>(view->scrollY() / m_frame->pageZoomFactor());
 }
@@ -760,9 +977,15 @@ DOMWindow* DOMWindow::top() const
 
 Document* DOMWindow::document() const
 {
+    // FIXME: This function shouldn't need a frame to work.
     if (!m_frame)
         return 0;
 
+    // The m_frame pointer is not zeroed out when the window is put into b/f cache, so it can hold an unrelated document/window pair.
+    // FIXME: We should always zero out the frame pointer on navigation to avoid accidentally accessing the new frame content.
+    if (m_frame->domWindow() != this)
+        return 0;
+
     ASSERT(m_frame->document());
     return m_frame->document();
 }
@@ -782,15 +1005,32 @@ PassRefPtr<CSSRuleList> DOMWindow::getMatchedCSSRules(Element* elt, const String
         return 0;
 
     Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (!doc)
-        return 0;
 
     if (!pseudoElt.isEmpty())
         return doc->styleSelector()->pseudoStyleRulesForElement(elt, pseudoElt, authorOnly);
     return doc->styleSelector()->styleRulesForElement(elt, authorOnly);
 }
 
+PassRefPtr<WebKitPoint> DOMWindow::webkitConvertPointFromNodeToPage(Node* node, const WebKitPoint* p) const
+{
+    if (!node || !p)
+        return 0;
+        
+    FloatPoint pagePoint(p->x(), p->y());
+    pagePoint = node->convertToPage(pagePoint);
+    return WebKitPoint::create(pagePoint.x(), pagePoint.y());
+}
+
+PassRefPtr<WebKitPoint> DOMWindow::webkitConvertPointFromPageToNode(Node* node, const WebKitPoint* p) const
+{
+    if (!node || !p)
+        return 0;
+        
+    FloatPoint nodePoint(p->x(), p->y());
+    nodePoint = node->convertFromPage(nodePoint);
+    return WebKitPoint::create(nodePoint.x(), nodePoint.y());
+}
+
 double DOMWindow::devicePixelRatio() const
 {
     if (!m_frame)
@@ -810,9 +1050,6 @@ PassRefPtr<Database> DOMWindow::openDatabase(const String& name, const String& v
         return 0;
 
     Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (!doc)
-        return 0;
 
     Settings* settings = m_frame->settings();
     if (!settings || !settings->databasesEnabled())
@@ -827,10 +1064,7 @@ void DOMWindow::scrollBy(int x, int y) const
     if (!m_frame)
         return;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     FrameView* view = m_frame->view();
     if (!view)
@@ -844,10 +1078,7 @@ void DOMWindow::scrollTo(int x, int y) const
     if (!m_frame)
         return;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     FrameView* view = m_frame->view();
     if (!view)
@@ -938,310 +1169,832 @@ void DOMWindow::resizeTo(float width, float height) const
     page->chrome()->setWindowRect(fr);
 }
 
-inline void DOMWindow::setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> eventListener)
+int DOMWindow::setTimeout(ScheduledAction* action, int timeout)
 {
-    Document* document = this->document();
-    if (!document)
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, true);
+}
+
+void DOMWindow::clearTimeout(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+int DOMWindow::setInterval(ScheduledAction* action, int timeout)
+{
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, false);
+}
+
+void DOMWindow::clearInterval(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+void DOMWindow::handleEvent(Event* event, bool useCapture, RegisteredEventListenerVector* alternateListeners)
+{
+    RegisteredEventListenerVector& listeners = (alternateListeners ? *alternateListeners : m_eventListeners);
+    if (listeners.isEmpty())
         return;
-    document->setWindowInlineEventListenerForType(eventType, eventListener);
+
+    // If any HTML event listeners are registered on the window, dispatch them here.
+    RegisteredEventListenerVector listenersCopy = listeners;
+    size_t size = listenersCopy.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listenersCopy[i];
+        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
+            r.listener()->handleEvent(event, true);
+    }
 }
 
-inline EventListener* DOMWindow::inlineEventListenerForType(const AtomicString& eventType) const
+void DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    Document* document = this->document();
-    if (!document)
-        return 0;
-    return document->windowInlineEventListenerForType(eventType);
+    // Remove existing identical listener set with identical arguments.
+    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
+    removeEventListener(eventType, listener.get(), useCapture);
+    if (Document* document = this->document())
+        document->addListenerTypeIfNeeded(eventType);
+
+    RefPtr<RegisteredEventListener> registeredListener = RegisteredEventListener::create(eventType, listener, useCapture);
+    m_eventListeners.append(registeredListener);
+
+    if (eventType == eventNames().unloadEvent)
+        addPendingEventListener(pendingUnloadEventListenerMap(), this, registeredListener.get());
+    else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+        addPendingEventListener(pendingBeforeUnloadEventListenerMap(), this, registeredListener.get());
+}
+
+void DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
+            if (eventType == eventNames().unloadEvent)
+                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
+            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
+            r.setRemoved(true);
+            m_eventListeners.remove(i);
+            return;
+        }
+    }
+}
+
+bool DOMWindow::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Event> event = e;
+    if (!event || event->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return true;
+    }
+
+    RefPtr<DOMWindow> protect(this);
+
+    event->setTarget(this);
+    event->setCurrentTarget(this);
+
+    handleEvent(event.get(), true);
+    handleEvent(event.get(), false);
+
+    return !event->defaultPrevented();
+}
+
+void DOMWindow::dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    dispatchEvent(Event::create(eventType, canBubble, cancelable), ec);
+}
+
+// This function accommodates the Firefox quirk of dispatching the load, unload and
+// beforeunload events on the window, but setting event.target to be the Document. 
+inline void DOMWindow::dispatchEventWithDocumentAsTarget(PassRefPtr<Event> e, RegisteredEventListenerVector* alternateEventListeners)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Event> event = e;
+    RefPtr<DOMWindow> protect(this);
+    RefPtr<Document> document = this->document();
+
+    event->setTarget(document);
+    event->setCurrentTarget(this);
+
+    handleEvent(event.get(), true, alternateEventListeners);
+    handleEvent(event.get(), false, alternateEventListeners);
+}
+
+void DOMWindow::dispatchLoadEvent()
+{
+    dispatchEventWithDocumentAsTarget(Event::create(eventNames().loadEvent, false, false));
+
+    // For load events, send a separate load event to the enclosing frame only.
+    // This is a DOM extension and is independent of bubbling/capturing rules of
+    // the DOM.
+    Element* ownerElement = document()->ownerElement();
+    if (ownerElement) {
+        RefPtr<Event> ownerEvent = Event::create(eventNames().loadEvent, false, false);
+        ownerEvent->setTarget(ownerElement);
+        ownerElement->dispatchGenericEvent(ownerEvent.release());
+    }
+}
+
+void DOMWindow::dispatchUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
+{
+    dispatchEventWithDocumentAsTarget(Event::create(eventNames().unloadEvent, false, false), alternateEventListeners);
+}
+
+PassRefPtr<BeforeUnloadEvent> DOMWindow::dispatchBeforeUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
+{
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
+    dispatchEventWithDocumentAsTarget(beforeUnloadEvent.get(), alternateEventListeners);
+    return beforeUnloadEvent.release();
+}
+
+void DOMWindow::removeAllEventListeners()
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i)
+        m_eventListeners[i]->setRemoved(true);
+    m_eventListeners.clear();
+
+    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
+    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+}
+
+bool DOMWindow::hasEventListener(const AtomicString& eventType)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_eventListeners[i]->eventType() == eventType)
+            return true;
+    }
+    return false;
+}
+
+void DOMWindow::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (listener)
+        addEventListener(eventType, listener, false);
+}
+
+void DOMWindow::clearAttributeEventListener(const AtomicString& eventType)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute()) {
+            if (eventType == eventNames().unloadEvent)
+                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
+            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
+            r.setRemoved(true);
+            m_eventListeners.remove(i);
+            return;
+        }
+    }
+}
+
+EventListener* DOMWindow::getAttributeEventListener(const AtomicString& eventType) const
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute())
+            return r.listener();
+    }
+    return 0;
 }
 
 EventListener* DOMWindow::onabort() const
 {
-    return inlineEventListenerForType(eventNames().abortEvent);
+    return getAttributeEventListener(eventNames().abortEvent);
 }
 
 void DOMWindow::setOnabort(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().abortEvent, eventListener);
+    setAttributeEventListener(eventNames().abortEvent, eventListener);
 }
 
 EventListener* DOMWindow::onblur() const
 {
-    return inlineEventListenerForType(eventNames().blurEvent);
+    return getAttributeEventListener(eventNames().blurEvent);
 }
 
 void DOMWindow::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().blurEvent, eventListener);
+    setAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* DOMWindow::onchange() const
 {
-    return inlineEventListenerForType(eventNames().changeEvent);
+    return getAttributeEventListener(eventNames().changeEvent);
 }
 
 void DOMWindow::setOnchange(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().changeEvent, eventListener);
+    setAttributeEventListener(eventNames().changeEvent, eventListener);
 }
 
 EventListener* DOMWindow::onclick() const
 {
-    return inlineEventListenerForType(eventNames().clickEvent);
+    return getAttributeEventListener(eventNames().clickEvent);
 }
 
 void DOMWindow::setOnclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().clickEvent, eventListener);
+    setAttributeEventListener(eventNames().clickEvent, eventListener);
 }
 
 EventListener* DOMWindow::ondblclick() const
 {
-    return inlineEventListenerForType(eventNames().dblclickEvent);
+    return getAttributeEventListener(eventNames().dblclickEvent);
 }
 
 void DOMWindow::setOndblclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
+    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondrag() const
+{
+    return getAttributeEventListener(eventNames().dragEvent);
+}
+
+void DOMWindow::setOndrag(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragend() const
+{
+    return getAttributeEventListener(eventNames().dragendEvent);
+}
+
+void DOMWindow::setOndragend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragendEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragenter() const
+{
+    return getAttributeEventListener(eventNames().dragenterEvent);
+}
+
+void DOMWindow::setOndragenter(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragleave() const
+{
+    return getAttributeEventListener(eventNames().dragleaveEvent);
+}
+
+void DOMWindow::setOndragleave(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragover() const
+{
+    return getAttributeEventListener(eventNames().dragoverEvent);
+}
+
+void DOMWindow::setOndragover(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragstart() const
+{
+    return getAttributeEventListener(eventNames().dragstartEvent);
+}
+
+void DOMWindow::setOndragstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondrop() const
+{
+    return getAttributeEventListener(eventNames().dropEvent);
+}
+
+void DOMWindow::setOndrop(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dropEvent, eventListener);
 }
 
 EventListener* DOMWindow::onerror() const
 {
-    return inlineEventListenerForType(eventNames().errorEvent);
+    return getAttributeEventListener(eventNames().errorEvent);
 }
 
 void DOMWindow::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().errorEvent, eventListener);
+    setAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* DOMWindow::onfocus() const
 {
-    return inlineEventListenerForType(eventNames().focusEvent);
+    return getAttributeEventListener(eventNames().focusEvent);
 }
 
 void DOMWindow::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().focusEvent, eventListener);
+    setAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeydown() const
 {
-    return inlineEventListenerForType(eventNames().keydownEvent);
+    return getAttributeEventListener(eventNames().keydownEvent);
 }
 
 void DOMWindow::setOnkeydown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
+    setAttributeEventListener(eventNames().keydownEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeypress() const
 {
-    return inlineEventListenerForType(eventNames().keypressEvent);
+    return getAttributeEventListener(eventNames().keypressEvent);
 }
 
 void DOMWindow::setOnkeypress(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
+    setAttributeEventListener(eventNames().keypressEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeyup() const
 {
-    return inlineEventListenerForType(eventNames().keyupEvent);
+    return getAttributeEventListener(eventNames().keyupEvent);
 }
 
 void DOMWindow::setOnkeyup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
+    setAttributeEventListener(eventNames().keyupEvent, eventListener);
 }
 
 EventListener* DOMWindow::onload() const
 {
-    return inlineEventListenerForType(eventNames().loadEvent);
+    return getAttributeEventListener(eventNames().loadEvent);
 }
 
 void DOMWindow::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().loadEvent, eventListener);
+    setAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousedown() const
 {
-    return inlineEventListenerForType(eventNames().mousedownEvent);
+    return getAttributeEventListener(eventNames().mousedownEvent);
 }
 
 void DOMWindow::setOnmousedown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
+    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousemove() const
 {
-    return inlineEventListenerForType(eventNames().mousemoveEvent);
+    return getAttributeEventListener(eventNames().mousemoveEvent);
 }
 
 void DOMWindow::setOnmousemove(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
+    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseout() const
 {
-    return inlineEventListenerForType(eventNames().mouseoutEvent);
+    return getAttributeEventListener(eventNames().mouseoutEvent);
 }
 
 void DOMWindow::setOnmouseout(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseover() const
 {
-    return inlineEventListenerForType(eventNames().mouseoverEvent);
+    return getAttributeEventListener(eventNames().mouseoverEvent);
 }
 
 void DOMWindow::setOnmouseover(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseup() const
 {
-    return inlineEventListenerForType(eventNames().mouseupEvent);
+    return getAttributeEventListener(eventNames().mouseupEvent);
 }
 
 void DOMWindow::setOnmouseup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousewheel() const
 {
-    return inlineEventListenerForType(eventNames().mousewheelEvent);
+    return getAttributeEventListener(eventNames().mousewheelEvent);
 }
 
 void DOMWindow::setOnmousewheel(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
+    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
+}
+
+EventListener* DOMWindow::onoffline() const
+{
+    return getAttributeEventListener(eventNames().offlineEvent);
+}
+
+void DOMWindow::setOnoffline(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().offlineEvent, eventListener);
+}
+
+EventListener* DOMWindow::ononline() const
+{
+    return getAttributeEventListener(eventNames().onlineEvent);
+}
+
+void DOMWindow::setOnonline(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
 EventListener* DOMWindow::onreset() const
 {
-    return inlineEventListenerForType(eventNames().resetEvent);
+    return getAttributeEventListener(eventNames().resetEvent);
 }
 
 void DOMWindow::setOnreset(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resetEvent, eventListener);
+    setAttributeEventListener(eventNames().resetEvent, eventListener);
 }
 
 EventListener* DOMWindow::onresize() const
 {
-    return inlineEventListenerForType(eventNames().resizeEvent);
+    return getAttributeEventListener(eventNames().resizeEvent);
 }
 
 void DOMWindow::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
+    setAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* DOMWindow::onscroll() const
 {
-    return inlineEventListenerForType(eventNames().scrollEvent);
+    return getAttributeEventListener(eventNames().scrollEvent);
 }
 
 void DOMWindow::setOnscroll(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
+    setAttributeEventListener(eventNames().scrollEvent, eventListener);
 }
 
 EventListener* DOMWindow::onsearch() const
 {
-    return inlineEventListenerForType(eventNames().searchEvent);
+    return getAttributeEventListener(eventNames().searchEvent);
 }
 
 void DOMWindow::setOnsearch(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().searchEvent, eventListener);
+    setAttributeEventListener(eventNames().searchEvent, eventListener);
 }
 
 EventListener* DOMWindow::onselect() const
 {
-    return inlineEventListenerForType(eventNames().selectEvent);
+    return getAttributeEventListener(eventNames().selectEvent);
 }
 
 void DOMWindow::setOnselect(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().selectEvent, eventListener);
+    setAttributeEventListener(eventNames().selectEvent, eventListener);
+}
+
+EventListener* DOMWindow::onstorage() const
+{
+    return getAttributeEventListener(eventNames().storageEvent);
+}
+
+void DOMWindow::setOnstorage(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().storageEvent, eventListener);
 }
 
 EventListener* DOMWindow::onsubmit() const
 {
-    return inlineEventListenerForType(eventNames().submitEvent);
+    return getAttributeEventListener(eventNames().submitEvent);
 }
 
 void DOMWindow::setOnsubmit(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().submitEvent, eventListener);
+    setAttributeEventListener(eventNames().submitEvent, eventListener);
 }
 
 EventListener* DOMWindow::onunload() const
 {
-    return inlineEventListenerForType(eventNames().unloadEvent);
+    return getAttributeEventListener(eventNames().unloadEvent);
 }
 
 void DOMWindow::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
+    setAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onbeforeunload() const
 {
-    return inlineEventListenerForType(eventNames().beforeunloadEvent);
+    return getAttributeEventListener(eventNames().beforeunloadEvent);
 }
 
 void DOMWindow::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().beforeunloadEvent, eventListener);
+    setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationstart() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationStartEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationStartEvent);
 }
 
 void DOMWindow::setOnwebkitanimationstart(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationStartEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationStartEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationiteration() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationIterationEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationIterationEvent);
 }
 
 void DOMWindow::setOnwebkitanimationiteration(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationIterationEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationIterationEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationend() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationEndEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationEndEvent);
 }
 
 void DOMWindow::setOnwebkitanimationend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationEndEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationEndEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkittransitionend() const
 {
-    return inlineEventListenerForType(eventNames().webkitTransitionEndEvent);
+    return getAttributeEventListener(eventNames().webkitTransitionEndEvent);
 }
 
 void DOMWindow::setOnwebkittransitionend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitTransitionEndEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitTransitionEndEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncanplay() const
+{
+    return getAttributeEventListener(eventNames().canplayEvent);
+}
+
+void DOMWindow::setOncanplay(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().canplayEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncanplaythrough() const
+{
+    return getAttributeEventListener(eventNames().canplaythroughEvent);
+}
+
+void DOMWindow::setOncanplaythrough(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().canplaythroughEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondurationchange() const
+{
+    return getAttributeEventListener(eventNames().durationchangeEvent);
+}
+
+void DOMWindow::setOndurationchange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().durationchangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onemptied() const
+{
+    return getAttributeEventListener(eventNames().emptiedEvent);
+}
+
+void DOMWindow::setOnemptied(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().emptiedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onended() const
+{
+    return getAttributeEventListener(eventNames().endedEvent);
+}
+
+void DOMWindow::setOnended(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().endedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadeddata() const
+{
+    return getAttributeEventListener(eventNames().loadeddataEvent);
+}
+
+void DOMWindow::setOnloadeddata(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadeddataEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadedmetadata() const
+{
+    return getAttributeEventListener(eventNames().loadedmetadataEvent);
+}
+
+void DOMWindow::setOnloadedmetadata(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadedmetadataEvent, eventListener);
+}
+
+EventListener* DOMWindow::onpause() const
+{
+    return getAttributeEventListener(eventNames().pauseEvent);
+}
+
+void DOMWindow::setOnpause(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().pauseEvent, eventListener);
+}
+
+EventListener* DOMWindow::onplay() const
+{
+    return getAttributeEventListener(eventNames().playEvent);
+}
+
+void DOMWindow::setOnplay(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().playEvent, eventListener);
+}
+
+EventListener* DOMWindow::onplaying() const
+{
+    return getAttributeEventListener(eventNames().playingEvent);
+}
+
+void DOMWindow::setOnplaying(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().playingEvent, eventListener);
+}
+
+EventListener* DOMWindow::onratechange() const
+{
+    return getAttributeEventListener(eventNames().ratechangeEvent);
+}
+
+void DOMWindow::setOnratechange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().ratechangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onseeked() const
+{
+    return getAttributeEventListener(eventNames().seekedEvent);
+}
+
+void DOMWindow::setOnseeked(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().seekedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onseeking() const
+{
+    return getAttributeEventListener(eventNames().seekingEvent);
+}
+
+void DOMWindow::setOnseeking(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().seekingEvent, eventListener);
+}
+
+EventListener* DOMWindow::ontimeupdate() const
+{
+    return getAttributeEventListener(eventNames().timeupdateEvent);
+}
+
+void DOMWindow::setOntimeupdate(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().timeupdateEvent, eventListener);
+}
+
+EventListener* DOMWindow::onvolumechange() const
+{
+    return getAttributeEventListener(eventNames().volumechangeEvent);
+}
+
+void DOMWindow::setOnvolumechange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().volumechangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onwaiting() const
+{
+    return getAttributeEventListener(eventNames().waitingEvent);
+}
+
+void DOMWindow::setOnwaiting(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().waitingEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadstart() const
+{
+    return getAttributeEventListener(eventNames().loadstartEvent);
+}
+
+void DOMWindow::setOnloadstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadstartEvent, eventListener);
+}
+
+EventListener* DOMWindow::onprogress() const
+{
+    return getAttributeEventListener(eventNames().progressEvent);
+}
+
+void DOMWindow::setOnprogress(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().progressEvent, eventListener);
+}
+
+EventListener* DOMWindow::onstalled() const
+{
+    return getAttributeEventListener(eventNames().stalledEvent);
+}
+
+void DOMWindow::setOnstalled(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().stalledEvent, eventListener);
+}
+
+EventListener* DOMWindow::onsuspend() const
+{
+    return getAttributeEventListener(eventNames().suspendEvent);
+}
+
+void DOMWindow::setOnsuspend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().suspendEvent, eventListener);
+}
+
+EventListener* DOMWindow::oninput() const
+{
+    return getAttributeEventListener(eventNames().inputEvent);
+}
+
+void DOMWindow::setOninput(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().inputEvent, eventListener);
+}
+
+EventListener* DOMWindow::onmessage() const
+{
+    return getAttributeEventListener(eventNames().messageEvent);
+}
+
+void DOMWindow::setOnmessage(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().messageEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncontextmenu() const
+{
+    return getAttributeEventListener(eventNames().contextmenuEvent);
+}
+
+void DOMWindow::setOncontextmenu(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
+}
+
+void DOMWindow::captureEvents()
+{
+    // Not implemented.
+}
+
+void DOMWindow::releaseEvents()
+{
+    // Not implemented.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index e7fab18b59..6862cdc35f 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +26,10 @@
 #ifndef DOMWindow_h
 #define DOMWindow_h
 
+#include "EventTarget.h"
 #include "KURL.h"
 #include "PlatformString.h"
+#include "RegisteredEventListener.h"
 #include "SecurityOrigin.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -36,6 +38,7 @@
 namespace WebCore {
 
     class BarInfo;
+    class BeforeUnloadEvent;
     class CSSRuleList;
     class CSSStyleDeclaration;
     class Console;
@@ -43,6 +46,7 @@ namespace WebCore {
     class Database;
     class Document;
     class Element;
+    class Event;
     class EventListener;
     class FloatRect;
     class Frame;
@@ -50,8 +54,11 @@ namespace WebCore {
     class Location;
     class MessagePort;
     class Navigator;
+    class Node;
     class PostMessageTimer;
+    class ScheduledAction;
     class Screen;
+    class WebKitPoint;
 
 #if ENABLE(DOM_STORAGE)
     class SessionStorage;
@@ -64,12 +71,15 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    class DOMWindow : public RefCounted<DOMWindow> {
+    class DOMWindow : public RefCounted<DOMWindow>, public EventTarget {
     public:
         static PassRefPtr<DOMWindow> create(Frame* frame) { return adoptRef(new DOMWindow(frame)); }
         virtual ~DOMWindow();
 
-        Frame* frame() { return m_frame; }
+        virtual DOMWindow* toDOMWindow() { return this; }
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        Frame* frame() const { return m_frame; }
         void disconnectFrame();
 
         void clear();
@@ -80,7 +90,17 @@ namespace WebCore {
         void setURL(const KURL& url) { m_url = url; }
         KURL url() const { return m_url; }
 
+        unsigned pendingUnloadEventListeners() const;
+
+        static bool dispatchAllPendingBeforeUnloadEvents();
+        static void dispatchAllPendingUnloadEvents();
+
         static void adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges);
+        static void parseModalDialogFeatures(const String& featuresArg, HashMap<String, String>& map);
+
+        static bool allowPopUp(Frame* activeFrame);
+        static bool canShowModalDialog(const Frame*);
+        static bool canShowModalDialogNow(const Frame*);
 
         // DOM Level 0
         Screen* screen() const;
@@ -160,6 +180,9 @@ namespace WebCore {
         PassRefPtr<CSSRuleList> getMatchedCSSRules(Element*, const String& pseudoElt, bool authorOnly = true) const;
         double devicePixelRatio() const;
 
+        PassRefPtr<WebKitPoint> webkitConvertPointFromPageToNode(Node* node, const WebKitPoint* p) const;
+        PassRefPtr<WebKitPoint> webkitConvertPointFromNodeToPage(Node* node, const WebKitPoint* p) const;        
+
 #if ENABLE(DATABASE)
         // HTML 5 client-side database
         PassRefPtr<Database> openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, ExceptionCode&);
@@ -190,6 +213,34 @@ namespace WebCore {
         void resizeBy(float x, float y) const;
         void resizeTo(float width, float height) const;
 
+        // Timers
+        int setTimeout(ScheduledAction*, int timeout);
+        void clearTimeout(int timeoutId);
+        int setInterval(ScheduledAction*, int timeout);
+        void clearInterval(int timeoutId);
+
+        // Events
+        // EventTarget API
+        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+
+        void handleEvent(Event*, bool useCapture, RegisteredEventListenerVector* = 0);
+
+        void dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+        void dispatchLoadEvent();
+        void dispatchUnloadEvent(RegisteredEventListenerVector* = 0);
+        PassRefPtr<BeforeUnloadEvent> dispatchBeforeUnloadEvent(RegisteredEventListenerVector* = 0);
+
+        // Used for legacy "onEvent" property APIs.
+        void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+        void clearAttributeEventListener(const AtomicString& eventType);
+        EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+
+        const RegisteredEventListenerVector& eventListeners() const { return m_eventListeners; }
+        bool hasEventListener(const AtomicString& eventType);
+        void removeAllEventListeners();
+
         EventListener* onabort() const;
         void setOnabort(PassRefPtr<EventListener>);
         EventListener* onblur() const;
@@ -200,6 +251,20 @@ namespace WebCore {
         void setOnclick(PassRefPtr<EventListener>);
         EventListener* ondblclick() const;
         void setOndblclick(PassRefPtr<EventListener>);
+        EventListener* ondrag() const;
+        void setOndrag(PassRefPtr<EventListener>);
+        EventListener* ondragend() const;
+        void setOndragend(PassRefPtr<EventListener>);
+        EventListener* ondragenter() const;
+        void setOndragenter(PassRefPtr<EventListener>);
+        EventListener* ondragleave() const;
+        void setOndragleave(PassRefPtr<EventListener>);
+        EventListener* ondragover() const;
+        void setOndragover(PassRefPtr<EventListener>);
+        EventListener* ondragstart() const;
+        void setOndragstart(PassRefPtr<EventListener>);
+        EventListener* ondrop() const;
+        void setOndrop(PassRefPtr<EventListener>);
         EventListener* onerror() const;
         void setOnerror(PassRefPtr<EventListener>);
         EventListener* onfocus() const;
@@ -224,6 +289,10 @@ namespace WebCore {
         void setOnmouseup(PassRefPtr<EventListener>);
         EventListener* onmousewheel() const;
         void setOnmousewheel(PassRefPtr<EventListener>);
+        EventListener* onoffline() const;
+        void setOnoffline(PassRefPtr<EventListener>);
+        EventListener* ononline() const;
+        void setOnonline(PassRefPtr<EventListener>);
         EventListener* onreset() const;
         void setOnreset(PassRefPtr<EventListener>);
         EventListener* onresize() const;
@@ -234,6 +303,8 @@ namespace WebCore {
         void setOnsearch(PassRefPtr<EventListener>);
         EventListener* onselect() const;
         void setOnselect(PassRefPtr<EventListener>);
+        EventListener* onstorage() const;
+        void setOnstorage(PassRefPtr<EventListener>);
         EventListener* onsubmit() const;
         void setOnsubmit(PassRefPtr<EventListener>);
         EventListener* onunload() const;
@@ -248,6 +319,55 @@ namespace WebCore {
         void setOnwebkitanimationend(PassRefPtr<EventListener>);
         EventListener* onwebkittransitionend() const;
         void setOnwebkittransitionend(PassRefPtr<EventListener>);
+        EventListener* oncanplay() const;
+        void setOncanplay(PassRefPtr<EventListener>);
+        EventListener* oncanplaythrough() const;
+        void setOncanplaythrough(PassRefPtr<EventListener>);
+        EventListener* ondurationchange() const;
+        void setOndurationchange(PassRefPtr<EventListener>);
+        EventListener* onemptied() const;
+        void setOnemptied(PassRefPtr<EventListener>);
+        EventListener* onended() const;
+        void setOnended(PassRefPtr<EventListener>);
+        EventListener* onloadeddata() const;
+        void setOnloadeddata(PassRefPtr<EventListener>);
+        EventListener* onloadedmetadata() const;
+        void setOnloadedmetadata(PassRefPtr<EventListener>);
+        EventListener* onpause() const;
+        void setOnpause(PassRefPtr<EventListener>);
+        EventListener* onplay() const;
+        void setOnplay(PassRefPtr<EventListener>);
+        EventListener* onplaying() const;
+        void setOnplaying(PassRefPtr<EventListener>);
+        EventListener* onratechange() const;
+        void setOnratechange(PassRefPtr<EventListener>);
+        EventListener* onseeked() const;
+        void setOnseeked(PassRefPtr<EventListener>);
+        EventListener* onseeking() const;
+        void setOnseeking(PassRefPtr<EventListener>);
+        EventListener* ontimeupdate() const;
+        void setOntimeupdate(PassRefPtr<EventListener>);
+        EventListener* onvolumechange() const;
+        void setOnvolumechange(PassRefPtr<EventListener>);
+        EventListener* onwaiting() const;
+        void setOnwaiting(PassRefPtr<EventListener>);
+        EventListener* onloadstart() const;
+        void setOnloadstart(PassRefPtr<EventListener>);
+        EventListener* onprogress() const;
+        void setOnprogress(PassRefPtr<EventListener>);
+        EventListener* onstalled() const;
+        void setOnstalled(PassRefPtr<EventListener>);
+        EventListener* onsuspend() const;
+        void setOnsuspend(PassRefPtr<EventListener>);
+        EventListener* oninput() const;
+        void setOninput(PassRefPtr<EventListener>);
+        EventListener* onmessage() const;
+        void setOnmessage(PassRefPtr<EventListener>);
+        EventListener* oncontextmenu() const;
+        void setOncontextmenu(PassRefPtr<EventListener>);
+
+        void captureEvents();
+        void releaseEvents();
 
         // These methods are used for GC marking. See JSDOMWindow::mark() in
         // JSDOMWindowCustom.cpp.
@@ -271,11 +391,16 @@ namespace WebCore {
         DOMApplicationCache* optionalApplicationCache() const { return m_applicationCache.get(); }
 #endif
 
+        using RefCounted<DOMWindow>::ref;
+        using RefCounted<DOMWindow>::deref;
+
     private:
         DOMWindow(Frame*);
 
-        void setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-        EventListener* inlineEventListenerForType(const AtomicString& eventType) const;
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+
+        void dispatchEventWithDocumentAsTarget(PassRefPtr<Event>, RegisteredEventListenerVector* = 0);
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
@@ -300,8 +425,10 @@ namespace WebCore {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 #endif
+
+        RegisteredEventListenerVector m_eventListeners;
     };
 
 } // namespace WebCore
 
-#endif
+#endif // DOMWindow_h
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index 504b705f01..67ce3802a6 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,7 +44,7 @@ module window {
     ] DOMWindow {
         // DOM Level 0
         readonly attribute Screen screen;
-        readonly attribute [DoNotCheckDomainSecurity] History history;
+        readonly attribute [DoNotCheckDomainSecurity, JSCCustomGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -53,7 +53,11 @@ module window {
         attribute [Replaceable] BarInfo toolbar;
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
-        attribute [DoNotCheckDomainSecurity, CustomSetter] Location location;
+        attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing] Location location;
+
+        attribute [Replaceable, CustomGetter] Event event;
+
+        readonly attribute [Custom] Crypto crypto;
 
         DOMSelection getSelection();
 
@@ -66,6 +70,14 @@ module window {
         void print();
         void stop();
 
+        [Custom] DOMWindow open(in DOMString url,
+                                in DOMString name,
+                                in [Optional] DOMString options);
+
+        [Custom] DOMObject showModalDialog(in DOMString url, 
+                                           in [Optional] DOMObject dialogArgs,
+                                           in [Optional] DOMString featureArgs);
+
         void alert(in DOMString message);
         boolean confirm(in DOMString message);
         [ConvertNullStringTo=Null] DOMString prompt(in DOMString message,
@@ -110,19 +122,19 @@ module window {
 
         attribute DOMString status;
         attribute DOMString defaultStatus;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // This attribute is an alias of defaultStatus and is necessary for legacy uses.
         attribute DOMString defaultstatus;
 #endif
 
         // Self referential attributes
         attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow self;
-        readonly attribute [DoNotCheckDomainSecurity] DOMWindow window;
+        readonly attribute [DoNotCheckDomainSecurity, V8DisallowShadowing] DOMWindow window;
         attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow frames;
 
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow opener;
+        attribute [Replaceable, DoNotCheckDomainSecurityOnGet, V8CustomSetter] DOMWindow opener;
         attribute [Replaceable, DoNotCheckDomainSecurity] DOMWindow parent;
-        attribute [Replaceable, DoNotCheckDomainSecurity] DOMWindow top;
+        attribute [Replaceable, DoNotCheckDomainSecurity, V8DisallowShadowing, V8ReadOnly] DOMWindow top;
 
         // DOM Level 2 AbstractView Interface
         readonly attribute Document document;
@@ -136,15 +148,18 @@ module window {
                                        in DOMString pseudoElement,
                                        in [Optional] boolean authorOnly);
         attribute [Replaceable] double devicePixelRatio;
+        
+        WebKitPoint webkitConvertPointFromPageToNode(in Node node, in WebKitPoint p);
+        WebKitPoint webkitConvertPointFromNodeToPage(in Node node, in WebKitPoint p);
 
-#if ENABLE_OFFLINE_WEB_APPLICATIONS
+#if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
         readonly attribute DOMApplicationCache applicationCache;
 #endif    
-#if ENABLE_DATABASE
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
             raises(DOMException);
 #endif
-#if ENABLE_DOM_STORAGE
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         readonly attribute Storage sessionStorage;
         readonly attribute Storage localStorage;
 #endif
@@ -157,12 +172,13 @@ module window {
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setTimeout(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        [Custom] void clearTimeout(in long handle);
-
+        void clearTimeout(in long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setInterval(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        [Custom] void clearInterval(in long handle);
+        void clearInterval(in long handle);
 
         // Base64
         [Custom] DOMString atob(in DOMString string)
@@ -171,46 +187,99 @@ module window {
             raises(DOMException);
 
         // Events
-        attribute [ProtectedListener] EventListener onabort;
-        attribute [ProtectedListener] EventListener onblur;
-        attribute [ProtectedListener] EventListener onchange;
-        attribute [ProtectedListener] EventListener onclick;
-        attribute [ProtectedListener] EventListener ondblclick;
-        attribute [ProtectedListener] EventListener onerror;
-        attribute [ProtectedListener] EventListener onfocus;
-        attribute [ProtectedListener] EventListener onkeydown;
-        attribute [ProtectedListener] EventListener onkeypress;
-        attribute [ProtectedListener] EventListener onkeyup;
-        attribute [ProtectedListener] EventListener onload;
-        attribute [ProtectedListener] EventListener onmousedown;
-        attribute [ProtectedListener] EventListener onmousemove;
-        attribute [ProtectedListener] EventListener onmouseout;
-        attribute [ProtectedListener] EventListener onmouseover;
-        attribute [ProtectedListener] EventListener onmouseup;
-        attribute [ProtectedListener] EventListener onmousewheel;
-        attribute [ProtectedListener] EventListener onreset;
-        attribute [ProtectedListener] EventListener onresize;
-        attribute [ProtectedListener] EventListener onscroll;
-        attribute [ProtectedListener] EventListener onsearch;
-        attribute [ProtectedListener] EventListener onselect;
-        attribute [ProtectedListener] EventListener onsubmit;
-        attribute [ProtectedListener] EventListener onunload;
-        attribute [ProtectedListener] EventListener onbeforeunload;
-        attribute [ProtectedListener] EventListener onwebkitanimationstart;
-        attribute [ProtectedListener] EventListener onwebkitanimationiteration;
-        attribute [ProtectedListener] EventListener onwebkitanimationend;
-        attribute [ProtectedListener] EventListener onwebkittransitionend;
+        attribute EventListener onabort;
+        attribute EventListener onbeforeunload;
+        attribute EventListener onblur;
+        attribute EventListener oncanplay;
+        attribute EventListener oncanplaythrough;
+        attribute EventListener onchange;
+        attribute EventListener onclick;
+        attribute EventListener oncontextmenu;
+        attribute EventListener ondblclick;
+        attribute EventListener ondrag;
+        attribute EventListener ondragend;
+        attribute EventListener ondragenter;
+        attribute EventListener ondragleave;
+        attribute EventListener ondragover;
+        attribute EventListener ondragstart;
+        attribute EventListener ondrop;
+        attribute EventListener ondurationchange;
+        attribute EventListener onemptied;
+        attribute EventListener onended;
+        attribute EventListener onerror;
+        attribute EventListener onfocus;
+        attribute EventListener oninput;
+        attribute EventListener onkeydown;
+        attribute EventListener onkeypress;
+        attribute EventListener onkeyup;
+        attribute EventListener onload;
+        attribute EventListener onloadeddata;
+        attribute EventListener onloadedmetadata;
+        attribute EventListener onloadstart;
+        attribute EventListener onmessage;
+        attribute EventListener onmousedown;
+        attribute EventListener onmousemove;
+        attribute EventListener onmouseout;
+        attribute EventListener onmouseover;
+        attribute EventListener onmouseup;
+        attribute EventListener onmousewheel;
+        attribute EventListener onoffline;
+        attribute EventListener ononline;
+        attribute EventListener onpause;
+        attribute EventListener onplay;
+        attribute EventListener onplaying;
+        attribute EventListener onprogress;
+        attribute EventListener onratechange;
+        attribute EventListener onresize;
+        attribute EventListener onscroll;
+        attribute EventListener onseeked;
+        attribute EventListener onseeking;
+        attribute EventListener onselect;
+        attribute EventListener onstalled;
+        attribute EventListener onstorage;
+        attribute EventListener onsubmit;
+        attribute EventListener onsuspend;
+        attribute EventListener ontimeupdate;
+        attribute EventListener onunload;
+        attribute EventListener onvolumechange;
+        attribute EventListener onwaiting;
+
+        // Not implemented yet.
+        // attribute EventListener onafterprint;
+        // attribute EventListener onbeforeprint;
+        // attribute EventListener ondataunavailable;
+        // attribute EventListener onformchange;
+        // attribute EventListener onforminput;
+        // attribute EventListener onhashchange;
+        // attribute EventListener oninvalid;
+        // attribute EventListener onpopstate;
+        // attribute EventListener onreadystatechange;
+        // attribute EventListener onredo;
+        // attribute EventListener onshow;
+        // attribute EventListener onundo;
+
+        // Webkit extensions
+        attribute EventListener onreset;
+        attribute EventListener onsearch;
+        attribute EventListener onwebkitanimationend;
+        attribute EventListener onwebkitanimationiteration;
+        attribute EventListener onwebkitanimationstart;
+        attribute EventListener onwebkittransitionend;
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                      in EventListener listener, 
+        [Custom] void addEventListener(in DOMString type,
+                                      in EventListener listener,
                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
-                                          in EventListener listener, 
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
                                           in boolean useCapture);
-        // FIXME: Implement dispatchEvent
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+        [V8Custom=DOMWindowNOP] void captureEvents(/*in long eventFlags*/);
+        [V8Custom=DOMWindowNOP] void releaseEvents(/*in long eventFlags*/);
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Global constructors
         attribute StyleSheetConstructor StyleSheet;
         attribute CSSStyleSheetConstructor CSSStyleSheet;
@@ -330,6 +399,9 @@ module window {
 
         attribute HTMLCollectionConstructor HTMLCollection;
 
+        attribute [CustomGetter] HTMLImageElementConstructor Image; // Usable with new operator
+        attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
+
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
         attribute TextMetricsConstructor TextMetrics;
 
@@ -350,9 +422,9 @@ module window {
         attribute WebKitCSSKeyframeRuleConstructor WebKitCSSKeyframeRule;
         attribute WebKitCSSKeyframesRuleConstructor WebKitCSSKeyframesRule;
 
-#if ENABLE_CHANNEL_MESSAGING
-        attribute MessagePortConstructor MessagePort;
-#endif
+        attribute [JSCCustomGetter] WebKitCSSMatrixConstructor WebKitCSSMatrix; // Usable with the new operator
+
+        attribute [JSCCustomGetter] WebKitPointConstructor WebKitPoint; // Usable with new the operator
 
         attribute ClipboardConstructor Clipboard;
 
@@ -370,32 +442,50 @@ module window {
         attribute DOMParserConstructor DOMParser;
         attribute XMLSerializerConstructor XMLSerializer;
 
+        attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
         attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
         attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
 
+#if defined(ENABLE_XSLT) && ENABLE_XSLT
+        attribute [JSCCustomGetter] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
+#endif
+
+#if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
+        attribute MessagePortConstructor MessagePort;
+        attribute [JSCCustomGetter] MessageChannelConstructor MessageChannel; // Usable with the new operator
+#endif
+
+#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
+        attribute [JSCCustomGetter] WorkerConstructor Worker; // Usable with the new operator
+#endif
+
         attribute PluginConstructor Plugin;
         attribute PluginArrayConstructor PluginArray;
 
         attribute MimeTypeConstructor MimeType;
         attribute MimeTypeArrayConstructor MimeTypeArray;
 
-#if ENABLE_DOM_STORAGE
+        attribute ClientRectConstructor ClientRect;
+        attribute ClientRectListConstructor ClientRectList;
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         attribute StorageConstructor Storage;
         attribute StorageEventConstructor StorageEvent;
 #endif
 
+        attribute [CustomGetter,Conditional=VIDEO] HTMLAudioElementConstructor Audio; // Usable with the new operator
         attribute [Conditional=VIDEO] HTMLAudioElementConstructor HTMLAudioElement;
         attribute [Conditional=VIDEO] HTMLMediaElementConstructor HTMLMediaElement;
         attribute [Conditional=VIDEO] HTMLVideoElementConstructor HTMLVideoElement;
         attribute [Conditional=VIDEO] MediaErrorConstructor MediaError;
 
-#if ENABLE_XPATH
+#if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
         attribute XPathResultConstructor XPathResult;
         attribute XPathExceptionConstructor XPathException;
 #endif
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
         attribute SVGAngleConstructor SVGAngle;
         attribute SVGColorConstructor SVGColor;
 //      attribute SVGCSSRuleConstructor SVGCSSRule;
@@ -412,9 +502,8 @@ module window {
         attribute SVGTransformConstructor SVGTransform;
         attribute SVGUnitTypesConstructor SVGUnitTypes;
 //      attribute SVGZoomAndPanConstructor SVGZoomAndPan;
-#endif
 
-#if ENABLE_SVG_FILTERS
+#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
         attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
         attribute SVGFEBlendElementConstructor SVGFEBlendElement;
         attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
@@ -424,8 +513,14 @@ module window {
 //      attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
         attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
 #endif
+#endif
 
 #endif // defined(LANGUAGE_JAVASCRIPT)
+
+#if defined(V8_BINDING) && V8_BINDING
+        // window.toString() requires special handling in V8
+        [V8DoNotCheckSignature, DoNotCheckDomainSecurity, Custom, DontEnum] DOMString toString();
+#endif // defined(V8_BINDING)
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index 8490f2df43..e1b5ea7625 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,10 +57,10 @@
 #include "ResourceRequest.h"
 #include "SelectionController.h"
 #include "Settings.h"
-#include "SystemTime.h"
 #include "Text.h"
 #include "htmlediting.h"
 #include "markup.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -76,13 +76,13 @@ static PlatformMouseEvent createMouseEvent(DragData* dragData)
 DragController::DragController(Page* page, DragClient* client)
     : m_page(page)
     , m_client(client)
-    , m_document(0)
+    , m_documentUnderMouse(0)
     , m_dragInitiator(0)
     , m_dragDestinationAction(DragDestinationActionNone)
     , m_dragSourceAction(DragSourceActionNone)
     , m_didInitiateDrag(false)
     , m_isHandlingDrag(false)
-    , m_dragOperation(DragOperationNone)
+    , m_sourceDragOperation(DragOperationNone)
 {
 }
     
@@ -107,9 +107,9 @@ static PassRefPtr<DocumentFragment> documentFragmentFromDragData(DragData* dragD
             String title;
             String url = dragData->asURL(&title);
             if (!url.isEmpty()) {
-                ExceptionCode ec;
-                RefPtr<HTMLAnchorElement> anchor = static_cast<HTMLAnchorElement*>(document->createElement("a", ec).get());
+                RefPtr<HTMLAnchorElement> anchor = new HTMLAnchorElement(document);
                 anchor->setHref(url);
+                ExceptionCode ec;
                 RefPtr<Node> anchorText = document->createTextNode(title);
                 anchor->appendChild(anchorText, ec);
                 RefPtr<DocumentFragment> fragment = document->createDocumentFragment();
@@ -126,13 +126,12 @@ static PassRefPtr<DocumentFragment> documentFragmentFromDragData(DragData* dragD
     return 0;
 }
 
-bool DragController::dragIsMove(SelectionController* selection, DragData* dragData) 
+bool DragController::dragIsMove(SelectionController* selection)
 {
-    return m_document == m_dragInitiator
-        && selection->isContentEditable()
-        && !isCopyKeyDown();
+    return m_documentUnderMouse == m_dragInitiator && selection->isContentEditable() && !isCopyKeyDown();
 }
 
+// FIXME: This method is poorly named.  We're just clearing the selection from the document this drag is exiting.
 void DragController::cancelDrag()
 {
     m_page->dragCaretController()->clear();
@@ -156,16 +155,15 @@ void DragController::dragExited(DragData* dragData)
     Frame* mainFrame = m_page->mainFrame();
     
     if (RefPtr<FrameView> v = mainFrame->view()) {
-        ClipboardAccessPolicy policy = mainFrame->loader()->baseURL().isLocalFile() ? ClipboardReadable : ClipboardTypesReadable;
+        ClipboardAccessPolicy policy = (!m_documentUnderMouse || m_documentUnderMouse->securityOrigin()->isLocal()) ? ClipboardReadable : ClipboardTypesReadable;
         RefPtr<Clipboard> clipboard = dragData->createClipboard(policy);
         clipboard->setSourceOperation(dragData->draggingSourceOperationMask());
         mainFrame->eventHandler()->cancelDragAndDrop(createMouseEvent(dragData), clipboard.get());
         clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
     }
-
-    cancelDrag();
-    m_document = 0;
+    mouseMovedIntoDocument(0);
 }
+
     
 DragOperation DragController::dragUpdated(DragData* dragData) 
 {
@@ -175,7 +173,7 @@ DragOperation DragController::dragUpdated(DragData* dragData)
 bool DragController::performDrag(DragData* dragData)
 {   
     ASSERT(dragData);
-    m_document = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
+    m_documentUnderMouse = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
     if (m_isHandlingDrag) {
         ASSERT(m_dragDestinationAction & DragDestinationActionDHTML);
         m_client->willPerformDragDestinationAction(DragDestinationActionDHTML, dragData);
@@ -187,45 +185,48 @@ bool DragController::performDrag(DragData* dragData)
             mainFrame->eventHandler()->performDragAndDrop(createMouseEvent(dragData), clipboard.get());
             clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
         }
-        m_document = 0;
+        m_documentUnderMouse = 0;
         return true;
     } 
     
-    if ((m_dragDestinationAction & DragDestinationActionEdit) && concludeDrag(dragData, m_dragDestinationAction)) {
-        m_document = 0;
+    if ((m_dragDestinationAction & DragDestinationActionEdit) && concludeEditDrag(dragData)) {
+        m_documentUnderMouse = 0;
         return true;
     }
     
-    m_document = 0;
+    m_documentUnderMouse = 0;
 
     if (operationForLoad(dragData) == DragOperationNone)
         return false;
 
     m_client->willPerformDragDestinationAction(DragDestinationActionLoad, dragData);
-    m_page->mainFrame()->loader()->load(ResourceRequest(dragData->asURL()));
+    m_page->mainFrame()->loader()->load(ResourceRequest(dragData->asURL()), false);
     return true;
 }
-    
+
+void DragController::mouseMovedIntoDocument(Document* newDocument)
+{
+    if (m_documentUnderMouse == newDocument)
+        return;
+
+    // If we were over another document clear the selection
+    if (m_documentUnderMouse)
+        cancelDrag();
+    m_documentUnderMouse = newDocument;
+}
+
 DragOperation DragController::dragEnteredOrUpdated(DragData* dragData)
 {
     ASSERT(dragData);
-    IntPoint windowPoint = dragData->clientPosition();
-    
-    Document* newDraggingDoc = 0;
-    if (Frame* frame = m_page->mainFrame())
-        newDraggingDoc = frame->documentAtPoint(windowPoint);
-    if (m_document != newDraggingDoc) {
-        if (m_document)
-            cancelDrag();
-        m_document = newDraggingDoc;
-    }
-    
+    ASSERT(m_page->mainFrame()); // It is not possible in Mac WebKit to have a Page without a mainFrame()
+    mouseMovedIntoDocument(m_page->mainFrame()->documentAtPoint(dragData->clientPosition()));
+
     m_dragDestinationAction = m_client->actionMaskForDrag(dragData);
     
     DragOperation operation = DragOperationNone;
     
     if (m_dragDestinationAction == DragDestinationActionNone)
-        cancelDrag();
+        cancelDrag(); // FIXME: Why not call mouseMovedIntoDocument(0)?
     else {
         operation = tryDocumentDrag(dragData, m_dragDestinationAction);
         if (operation == DragOperationNone && (m_dragDestinationAction & DragDestinationActionLoad))
@@ -259,7 +260,7 @@ DragOperation DragController::tryDocumentDrag(DragData* dragData, DragDestinatio
 {
     ASSERT(dragData);
     
-    if (!m_document)
+    if (!m_documentUnderMouse)
         return DragOperationNone;
     
     DragOperation operation = DragOperationNone;
@@ -267,7 +268,7 @@ DragOperation DragController::tryDocumentDrag(DragData* dragData, DragDestinatio
         operation = tryDHTMLDrag(dragData);
     m_isHandlingDrag = operation != DragOperationNone; 
 
-    RefPtr<FrameView> frameView = m_document->view();
+    RefPtr<FrameView> frameView = m_documentUnderMouse->view();
     if (!frameView)
         return operation;
     
@@ -277,18 +278,15 @@ DragOperation DragController::tryDocumentDrag(DragData* dragData, DragDestinatio
         
         IntPoint dragPos = dragData->clientPosition();
         IntPoint point = frameView->windowToContents(dragPos);
-        Element* element = m_document->elementFromPoint(point.x(), point.y());
+        Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
         ASSERT(element);
-        Frame* innerFrame = element->document()->frame();
-        ASSERT(innerFrame);
         if (!asFileInput(element)) {
-            Selection dragCaret;
-            if (Frame* frame = m_document->frame())
-                dragCaret = frame->visiblePositionForPoint(point);
+            VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
         }
-        
-        return dragIsMove(innerFrame->selection(), dragData) ? DragOperationMove : DragOperationCopy;
+
+        Frame* innerFrame = element->document()->frame();
+        return dragIsMove(innerFrame->selection()) ? DragOperationMove : DragOperationCopy;
     } 
     
     m_page->dragCaretController()->clear();
@@ -304,35 +302,33 @@ DragSourceAction DragController::delegateDragSourceAction(const IntPoint& window
 DragOperation DragController::operationForLoad(DragData* dragData)
 {
     ASSERT(dragData);
-    Document* doc = 0;
-    doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
+    Document* doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
     if (doc && (m_didInitiateDrag || doc->isPluginDocument() || (doc->frame() && doc->frame()->editor()->clientIsEditable())))
         return DragOperationNone;
     return dragOperation(dragData);
 }
 
-static bool setSelectionToDragCaret(Frame* frame, Selection& dragCaret, RefPtr<Range>& range, const IntPoint& point)
+static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, RefPtr<Range>& range, const IntPoint& point)
 {
     frame->selection()->setSelection(dragCaret);
     if (frame->selection()->isNone()) {
         dragCaret = frame->visiblePositionForPoint(point);
         frame->selection()->setSelection(dragCaret);
-        range = dragCaret.toRange();
+        range = dragCaret.toNormalizedRange();
     }
     return !frame->selection()->isNone() && frame->selection()->isContentEditable();
 }
 
-bool DragController::concludeDrag(DragData* dragData, DragDestinationAction actionMask)
+bool DragController::concludeEditDrag(DragData* dragData)
 {
     ASSERT(dragData);
     ASSERT(!m_isHandlingDrag);
-    ASSERT(actionMask & DragDestinationActionEdit);
     
-    if (!m_document)
+    if (!m_documentUnderMouse)
         return false;
     
-    IntPoint point = m_document->view()->windowToContents(dragData->clientPosition());
-    Element* element =  m_document->elementFromPoint(point.x(), point.y());
+    IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
+    Element* element =  m_documentUnderMouse->elementFromPoint(point.x(), point.y());
     ASSERT(element);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);    
@@ -343,8 +339,8 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
             return false;
         if (!innerFrame)
             return false;
-        RefPtr<Range> innerRange = innerFrame->selection()->toRange();
-        RefPtr<CSSStyleDeclaration> style = m_document->createCSSStyleDeclaration();
+        RefPtr<Range> innerRange = innerFrame->selection()->toNormalizedRange();
+        RefPtr<CSSStyleDeclaration> style = m_documentUnderMouse->createCSSStyleDeclaration();
         ExceptionCode ec;
         style->setProperty("color", color.name(), ec);
         if (!innerFrame->editor()->shouldApplyStyle(style.get(), innerRange.get()))
@@ -360,8 +356,7 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
     }
     
     if (HTMLInputElement* fileInput = asFileInput(element)) {
-        
-        if (!fileInput->isEnabled())
+        if (!fileInput->isEnabledFormControl())
             return false;
         
         if (!dragData->containsFiles())
@@ -384,9 +379,9 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         return true;
     }
 
-    Selection dragCaret(m_page->dragCaretController()->selection());
+    VisibleSelection dragCaret(m_page->dragCaretController()->selection());
     m_page->dragCaretController()->clear();
-    RefPtr<Range> range = dragCaret.toRange();
+    RefPtr<Range> range = dragCaret.toNormalizedRange();
     
     // For range to be null a WebKit client must have done something bad while
     // manually controlling drag behaviour
@@ -394,7 +389,7 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         return false;
     DocLoader* loader = range->ownerDocument()->docLoader();
     loader->setAllowStaleResources(true);
-    if (dragIsMove(innerFrame->selection(), dragData) || dragCaret.isContentRichlyEditable()) { 
+    if (dragIsMove(innerFrame->selection()) || dragCaret.isContentRichlyEditable()) { 
         bool chosePlainText = false;
         RefPtr<DocumentFragment> fragment = documentFragmentFromDragData(dragData, range, true, chosePlainText);
         if (!fragment || !innerFrame->editor()->shouldInsertFragment(fragment, range, EditorInsertActionDropped)) {
@@ -403,14 +398,14 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         }
         
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
-        if (dragIsMove(innerFrame->selection(), dragData)) {
+        if (dragIsMove(innerFrame->selection())) {
             bool smartMove = innerFrame->selectionGranularity() == WordGranularity 
                           && innerFrame->editor()->smartInsertDeleteEnabled() 
                           && dragData->canSmartReplace();
             applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartMove));
         } else {
             if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-                applyCommand(ReplaceSelectionCommand::create(m_document, fragment, true, dragData->canSmartReplace(), chosePlainText)); 
+                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText)); 
         }    
     } else {
         String text = dragData->asPlainText();
@@ -421,7 +416,7 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
         if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-            applyCommand(ReplaceSelectionCommand::create(m_document, createFragmentFromText(range.get(), text), true, false, true)); 
+            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true)); 
     }
     loader->setAllowStaleResources(false);
 
@@ -452,7 +447,7 @@ bool DragController::canProcessDrag(DragData* dragData)
     if (!result.innerNonSharedNode()->isContentEditable())
         return false;
         
-    if (m_didInitiateDrag && m_document == m_dragInitiator && result.isSelected())
+    if (m_didInitiateDrag && m_documentUnderMouse == m_dragInitiator && result.isSelected())
         return false;
 
     return true;
@@ -461,20 +456,20 @@ bool DragController::canProcessDrag(DragData* dragData)
 DragOperation DragController::tryDHTMLDrag(DragData* dragData)
 {   
     ASSERT(dragData);
-    ASSERT(m_document);
+    ASSERT(m_documentUnderMouse);
     DragOperation op = DragOperationNone;
-    RefPtr<Frame> frame = m_page->mainFrame();
-    RefPtr<FrameView> viewProtector = frame->view();
+    RefPtr<Frame> mainFrame = m_page->mainFrame();
+    RefPtr<FrameView> viewProtector = mainFrame->view();
     if (!viewProtector)
         return DragOperationNone;
     
-    ClipboardAccessPolicy policy = frame->loader()->baseURL().isLocalFile() ? ClipboardReadable : ClipboardTypesReadable;
+    ClipboardAccessPolicy policy = m_documentUnderMouse->securityOrigin()->isLocal() ? ClipboardReadable : ClipboardTypesReadable;
     RefPtr<Clipboard> clipboard = dragData->createClipboard(policy);
     DragOperation srcOp = dragData->draggingSourceOperationMask();
     clipboard->setSourceOperation(srcOp);
     
     PlatformMouseEvent event = createMouseEvent(dragData);
-    if (frame->eventHandler()->updateDragAndDrop(event, clipboard.get())) {
+    if (mainFrame->eventHandler()->updateDragAndDrop(event, clipboard.get())) {
         // *op unchanged if no source op was set
         if (!clipboard->destinationOperation(op)) {
             // The element accepted but they didn't pick an operation, so we pick one for them
@@ -534,7 +529,7 @@ static CachedImage* getCachedImage(Element* element)
     RenderObject* renderer = element->renderer();
     if (!renderer || !renderer->isImage()) 
         return 0;
-    RenderImage* image = static_cast<RenderImage*>(renderer);
+    RenderImage* image = toRenderImage(renderer);
     return image->cachedImage();
 }
     
@@ -545,7 +540,7 @@ static Image* getImage(Element* element)
     if (!renderer || !renderer->isImage()) 
         return 0;
     
-    RenderImage* image = static_cast<RenderImage*>(renderer);
+    RenderImage* image = toRenderImage(renderer);
     if (image->cachedImage() && !image->cachedImage()->errorOccurred())
         return image->cachedImage()->image();
     return 0;
@@ -557,7 +552,7 @@ static void prepareClipboardForImageDrag(Frame* src, Clipboard* clipboard, Eleme
     ExceptionCode ec = 0;
     range->selectNode(node, ec);
     ASSERT(ec == 0);
-    src->selection()->setSelection(Selection(range.get(), DOWNSTREAM));           
+    src->selection()->setSelection(VisibleSelection(range.get(), DOWNSTREAM));           
     clipboard->declareAndWriteDragImage(node, !linkURL.isEmpty() ? linkURL : imageURL, label, src);
 }
     
@@ -609,7 +604,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
     IntPoint mouseDraggedPoint = src->view()->windowToContents(dragEvent.pos());
     
     m_draggingImageURL = KURL();
-    m_dragOperation = srcOp;
+    m_sourceDragOperation = srcOp;
     
     DragImageRef dragImage = 0;
     IntPoint dragLoc(0, 0);
@@ -664,7 +659,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
             Position pos = src->selection()->base();
             Node* node = enclosingAnchorElement(pos);
             if (node)
-                src->selection()->setSelection(Selection::selectionFromContentsOfNode(node));
+                src->selection()->setSelection(VisibleSelection::selectionFromContentsOfNode(node));
         }
 
         m_client->willPerformDragSourceAction(DragSourceActionLink, dragOrigin, clipboard);
@@ -676,7 +671,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
         } 
         doSystemDrag(dragImage, dragLoc, mouseDraggedPoint, clipboard, src, true);
     } else if (isSelected && (m_dragSourceAction & DragSourceActionSelection)) {
-        RefPtr<Range> selectionRange = src->selection()->toRange();
+        RefPtr<Range> selectionRange = src->selection()->toNormalizedRange();
         ASSERT(selectionRange);
         if (!clipboard->hasData()) 
             clipboard->writeRange(selectionRange.get(), src);
@@ -701,7 +696,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
         deleteDragImage(dragImage);
     return startedDrag;
 }
-    
+
 void DragController::doImageDrag(Element* element, const IntPoint& dragOrigin, const IntRect& rect, Clipboard* clipboard, Frame* frame, IntPoint& dragImageOffset)
 {
     IntPoint mouseDownPoint = dragOrigin;
@@ -759,23 +754,16 @@ void DragController::doSystemDrag(DragImageRef image, const IntPoint& dragLoc, c
 // Manual drag caret manipulation
 void DragController::placeDragCaret(const IntPoint& windowPoint)
 {
-    Frame* mainFrame = m_page->mainFrame();    
-    Document* newDraggingDoc = mainFrame->documentAtPoint(windowPoint);
-    if (m_document != newDraggingDoc) {
-        if (m_document)
-            cancelDrag();
-        m_document = newDraggingDoc;
-    }
-    if (!m_document)
+    mouseMovedIntoDocument(m_page->mainFrame()->documentAtPoint(windowPoint));
+    if (!m_documentUnderMouse)
         return;
-    Frame* frame = m_document->frame();
-    ASSERT(frame);
+    Frame* frame = m_documentUnderMouse->frame();
     FrameView* frameView = frame->view();
     if (!frameView)
         return;
     IntPoint framePoint = frameView->windowToContents(windowPoint);
-    Selection dragCaret(frame->visiblePositionForPoint(framePoint));  
+    VisibleSelection dragCaret(frame->visiblePositionForPoint(framePoint));  
     m_page->dragCaretController()->setSelection(dragCaret);
 }
     
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.h b/src/3rdparty/webkit/WebCore/page/DragController.h
index 0c2504e44d..6fe1f7f8f2 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.h
+++ b/src/3rdparty/webkit/WebCore/page/DragController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,6 @@
 #include "DragActions.h"
 #include "DragImage.h"
 #include "IntPoint.h"
-#include "IntRect.h"
 #include "KURL.h"
 
 namespace WebCore {
@@ -41,6 +40,7 @@ namespace WebCore {
     class Element;
     class Frame;
     class Image;
+    class IntRect;
     class Node;
     class Page;
     class PlatformMouseEvent;
@@ -58,14 +58,13 @@ namespace WebCore {
         DragOperation dragUpdated(DragData*);
         bool performDrag(DragData*);
         
-        //FIXME: It should be possible to remove a number of these accessors once all
-        //drag logic is in WebCore
+        // FIXME: It should be possible to remove a number of these accessors once all
+        // drag logic is in WebCore.
         void setDidInitiateDrag(bool initiated) { m_didInitiateDrag = initiated; } 
         bool didInitiateDrag() const { return m_didInitiateDrag; }
         void setIsHandlingDrag(bool handling) { m_isHandlingDrag = handling; }
         bool isHandlingDrag() const { return m_isHandlingDrag; }
-        void setDragOperation(DragOperation dragOp) { m_dragOperation = dragOp; }
-        DragOperation dragOperation() const { return m_dragOperation; }       
+        DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
         void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
         void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
@@ -73,8 +72,8 @@ namespace WebCore {
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
         const IntPoint& dragOffset() const { return m_dragOffset; }
         DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
-        
-        Document* document() const { return m_document; }
+
+        Document* documentUnderMouse() const { return m_documentUnderMouse; }
         DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
         DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
         
@@ -91,40 +90,40 @@ namespace WebCore {
         static const int DragIconRightInset;
         static const int DragIconBottomInset;        
         static const float DragImageAlpha;
+
     private:
         bool canProcessDrag(DragData*);
-        bool concludeDrag(DragData*, DragDestinationAction);
+        bool concludeEditDrag(DragData*);
         DragOperation dragEnteredOrUpdated(DragData*);
         DragOperation operationForLoad(DragData*);
         DragOperation tryDocumentDrag(DragData*, DragDestinationAction);
         DragOperation tryDHTMLDrag(DragData*);
         DragOperation dragOperation(DragData*);
         void cancelDrag();
-        bool dragIsMove(SelectionController*, DragData*);
+        bool dragIsMove(SelectionController*);
         bool isCopyKeyDown();
 
+        void mouseMovedIntoDocument(Document*);
+
         IntRect selectionDraggingRect(Frame*);
         bool doDrag(Frame* src, Clipboard* clipboard, DragImageRef dragImage, const KURL& linkURL, const KURL& imageURL, Node* node, IntPoint& dragLoc, IntPoint& dragImageOffset);
         void doImageDrag(Element*, const IntPoint&, const IntRect&, Clipboard*, Frame*, IntPoint&);
         void doSystemDrag(DragImageRef, const IntPoint&, const IntPoint&, Clipboard*, Frame*, bool forLink);
         void cleanupAfterSystemDrag();
+
         Page* m_page;
         DragClient* m_client;
         
-        //The Document the mouse was last dragged over
-        Document* m_document;
-        
-        //The Document (if any) that initiated the drag
-        Document* m_dragInitiator;
+        Document* m_documentUnderMouse; // The document the mouse was last dragged over.
+        Document* m_dragInitiator; // The Document (if any) that initiated the drag.
         
         DragDestinationAction m_dragDestinationAction;
         DragSourceAction m_dragSourceAction;
         bool m_didInitiateDrag;
         bool m_isHandlingDrag;
-        DragOperation m_dragOperation;
+        DragOperation m_sourceDragOperation; // Set in startDrag when a drag starts from a mouse down within WebKit
         IntPoint m_dragOffset;
         KURL m_draggingImageURL;
-        
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/EditorClient.h b/src/3rdparty/webkit/WebCore/page/EditorClient.h
index 56d043565a..cdf0bd8322 100644
--- a/src/3rdparty/webkit/WebCore/page/EditorClient.h
+++ b/src/3rdparty/webkit/WebCore/page/EditorClient.h
@@ -50,7 +50,7 @@ class HTMLElement;
 class KeyboardEvent;
 class Node;
 class Range;
-class Selection;
+class VisibleSelection;
 class String;
 class VisiblePosition;
 
@@ -61,6 +61,24 @@ struct GrammarDetail {
     String userDescription;
 };
 
+enum TextCheckingType {
+    TextCheckingTypeSpelling    = 1 << 1,
+    TextCheckingTypeGrammar     = 1 << 2,
+    TextCheckingTypeLink        = 1 << 5,
+    TextCheckingTypeQuote       = 1 << 6,
+    TextCheckingTypeDash        = 1 << 7,
+    TextCheckingTypeReplacement = 1 << 8,
+    TextCheckingTypeCorrection  = 1 << 9
+};
+
+struct TextCheckingResult {
+    TextCheckingType type;
+    int location;
+    int length;
+    Vector<GrammarDetail> details;
+    String replacement;
+};
+ 
 class EditorClient {
 public:
     virtual ~EditorClient() {  }
@@ -126,10 +144,33 @@ public:
 #endif
 #endif
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void uppercaseWord() = 0;
+    virtual void lowercaseWord() = 0;
+    virtual void capitalizeWord() = 0;
+    virtual void showSubstitutionsPanel(bool show) = 0;
+    virtual bool substitutionsPanelIsShowing() = 0;
+    virtual void toggleSmartInsertDelete() = 0;
+    virtual bool isAutomaticQuoteSubstitutionEnabled() = 0;
+    virtual void toggleAutomaticQuoteSubstitution() = 0;
+    virtual bool isAutomaticLinkDetectionEnabled() = 0;
+    virtual void toggleAutomaticLinkDetection() = 0;
+    virtual bool isAutomaticDashSubstitutionEnabled() = 0;
+    virtual void toggleAutomaticDashSubstitution() = 0;
+    virtual bool isAutomaticTextReplacementEnabled() = 0;
+    virtual void toggleAutomaticTextReplacement() = 0;
+    virtual bool isAutomaticSpellingCorrectionEnabled() = 0;
+    virtual void toggleAutomaticSpellingCorrection() = 0;
+#endif
+
     virtual void ignoreWordInSpellDocument(const String&) = 0;
     virtual void learnWord(const String&) = 0;
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength) = 0;
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord) = 0;
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength) = 0;
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results) = 0;
+#endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail& detail) = 0;
     virtual void updateSpellingUIWithMisspelledWord(const String&) = 0;
     virtual void showSpellingUI(bool show) = 0;
@@ -141,3 +182,4 @@ public:
 }
 
 #endif // EditorClient_h
+
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index cc0e358b53..f020e7ab7a 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -42,12 +42,12 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
-#include "HitTestRequest.h"
-#include "HitTestResult.h"
-#include "HTMLFrameSetElement.h"
 #include "HTMLFrameElementBase.h"
+#include "HTMLFrameSetElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HitTestRequest.h"
+#include "HitTestResult.h"
 #include "Image.h"
 #include "InspectorController.h"
 #include "KeyboardEvent.h"
@@ -57,12 +57,14 @@
 #include "PlatformKeyboardEvent.h"
 #include "PlatformWheelEvent.h"
 #include "RenderFrameSet.h"
-#include "RenderWidget.h"
+#include "RenderTextControlSingleLine.h"
 #include "RenderView.h"
+#include "RenderWidget.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "TextEvent.h"
+#include "htmlediting.h" // for comparePositions()
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(SVG)
@@ -102,21 +104,38 @@ static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDir
 {
     if (!delta)
         return;
+        
+    // Find the nearest enclosing box.
+    RenderBox* enclosingBox = node->renderer()->enclosingBox();
+
     if (e.granularity() == ScrollByPageWheelEvent) {
-        if (node->renderer()->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1))
+        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1))
             e.accept();
         return;
     } 
     float pixelsToScroll = delta > 0 ? delta : -delta;
-    if (e.granularity() == ScrollByLineWheelEvent)
-        pixelsToScroll *= cMouseWheelPixelsPerLineStep;
-    if (node->renderer()->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll))
+    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll))
         e.accept();
 }
 
+#if !PLATFORM(MAC)
+
+inline bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
+{
+    return false;
+}
+
+inline bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
+{
+    return false;
+}
+
+#endif
+
 EventHandler::EventHandler(Frame* frame)
     : m_frame(frame)
     , m_mousePressed(false)
+    , m_capturesDragging(false)
     , m_mouseDownMayStartSelect(false)
     , m_mouseDownMayStartDrag(false)
     , m_mouseDownWasSingleClickInSelection(false)
@@ -135,8 +154,6 @@ EventHandler::EventHandler(Frame* frame)
     , m_capturingMouseEventsNode(0)
     , m_clickCount(0)
     , m_mouseDownTimestamp(0)
-    , m_pendingFrameUnloadEventCount(0)
-    , m_pendingFrameBeforeUnloadEventCount(0)
 #if PLATFORM(MAC)
     , m_mouseDownView(nil)
     , m_sendingEventToSubview(false)
@@ -174,18 +191,19 @@ void EventHandler::clear()
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
     m_mousePressed = false;
+    m_capturesDragging = false;
     m_capturingMouseEventsNode = 0;
 }
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
 {
     Node* innerNode = result.targetNode();
-    Selection newSelection;
+    VisibleSelection newSelection;
 
     if (innerNode && innerNode->renderer() && m_mouseDownMayStartSelect) {
         VisiblePosition pos(innerNode->renderer()->positionForPoint(result.localPoint()));
         if (pos.isNotNull()) {
-            newSelection = Selection(pos);
+            newSelection = VisibleSelection(pos);
             newSelection.expandUsingGranularity(WordGranularity);
         }
     
@@ -209,11 +227,11 @@ void EventHandler::selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHit
     Node* innerNode = result.targetNode();
 
     if (innerNode && innerNode->renderer() && m_mouseDownMayStartSelect) {
-        Selection newSelection;
+        VisibleSelection newSelection;
         Element* URLElement = result.hitTestResult().URLElement();
         VisiblePosition pos(innerNode->renderer()->positionForPoint(result.localPoint()));
         if (pos.isNotNull() && pos.deepEquivalent().node()->isDescendantOf(URLElement))
-            newSelection = Selection::selectionFromContentsOfNode(URLElement);
+            newSelection = VisibleSelection::selectionFromContentsOfNode(URLElement);
     
         if (newSelection.isRange()) {
             m_frame->setSelectionGranularity(WordGranularity);
@@ -252,10 +270,10 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))
         return false;
 
-    Selection newSelection;
+    VisibleSelection newSelection;
     VisiblePosition pos(innerNode->renderer()->positionForPoint(event.localPoint()));
     if (pos.isNotNull()) {
-        newSelection = Selection(pos);
+        newSelection = VisibleSelection(pos);
         newSelection.expandUsingGranularity(ParagraphGranularity);
     }
     if (newSelection.isRange()) {
@@ -271,9 +289,6 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
 
 bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestResults& event)
 {
-    if (event.event().button() != LeftButton)
-        return false;
-    
     Node* innerNode = event.targetNode();
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))
         return false;
@@ -283,10 +298,12 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
 
     // Don't restart the selection when the mouse is pressed on an
     // existing selection so we can allow for text dragging.
-    IntPoint vPoint = m_frame->view()->windowToContents(event.event().pos());
-    if (!extendSelection && m_frame->selection()->contains(vPoint)) {
-        m_mouseDownWasSingleClickInSelection = true;
-        return false;
+    if (FrameView* view = m_frame->view()) {
+        IntPoint vPoint = view->windowToContents(event.event().pos());
+        if (!extendSelection && m_frame->selection()->contains(vPoint)) {
+            m_mouseDownWasSingleClickInSelection = true;
+            return false;
+        }
     }
 
     VisiblePosition visiblePos(innerNode->renderer()->positionForPoint(event.localPoint()));
@@ -294,7 +311,7 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
         visiblePos = VisiblePosition(innerNode, 0, DOWNSTREAM);
     Position pos = visiblePos.deepEquivalent();
     
-    Selection newSelection = m_frame->selection()->selection();
+    VisibleSelection newSelection = m_frame->selection()->selection();
     if (extendSelection && newSelection.isCaretOrRange()) {
         m_frame->selection()->setLastChangeWasHorizontalExtension(false);
         
@@ -302,17 +319,16 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
         // was created right-to-left
         Position start = newSelection.start();
         Position end = newSelection.end();
-        short before = Range::compareBoundaryPoints(pos.node(), pos.offset(), start.node(), start.offset());
-        if (before <= 0)
-            newSelection = Selection(pos, end);
+        if (comparePositions(pos, start) <= 0)
+            newSelection = VisibleSelection(pos, end);
         else
-            newSelection = Selection(start, pos);
+            newSelection = VisibleSelection(start, pos);
 
         if (m_frame->selectionGranularity() != CharacterGranularity)
             newSelection.expandUsingGranularity(m_frame->selectionGranularity());
         m_beganSelectingText = true;
     } else {
-        newSelection = Selection(visiblePos);
+        newSelection = VisibleSelection(visiblePos);
         m_frame->setSelectionGranularity(CharacterGranularity);
     }
     
@@ -363,21 +379,19 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     m_dragStartPos = event.event().pos();
 
     bool swallowEvent = false;
-    if (event.event().button() == LeftButton || event.event().button() == MiddleButton) {
-        m_frame->selection()->setCaretBlinkingSuspended(true);
-        m_mousePressed = true;
-        m_beganSelectingText = false;
-
-        if (event.event().clickCount() == 2)
-            swallowEvent = handleMousePressEventDoubleClick(event);
-        else if (event.event().clickCount() >= 3)
-            swallowEvent = handleMousePressEventTripleClick(event);
-        else
-            swallowEvent = handleMousePressEventSingleClick(event);
-    }
+    m_frame->selection()->setCaretBlinkingSuspended(true);
+    m_mousePressed = true;
+    m_beganSelectingText = false;
+
+    if (event.event().clickCount() == 2)
+        swallowEvent = handleMousePressEventDoubleClick(event);
+    else if (event.event().clickCount() >= 3)
+        swallowEvent = handleMousePressEventTripleClick(event);
+    else
+        swallowEvent = handleMousePressEventSingleClick(event);
     
-   m_mouseDownMayStartAutoscroll = m_mouseDownMayStartSelect || 
-        (m_mousePressNode && m_mousePressNode->renderer() && m_mousePressNode->renderer()->canBeProgramaticallyScrolled(true));
+    m_mouseDownMayStartAutoscroll = m_mouseDownMayStartSelect || 
+        (m_mousePressNode && m_mousePressNode->renderBox() && m_mousePressNode->renderBox()->canBeProgramaticallyScrolled(true));
 
    return swallowEvent;
 }
@@ -404,7 +418,7 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         // If the selection is contained in a layer that can scroll, that layer should handle the autoscroll
         // Otherwise, let the bridge handle it so the view can scroll itself.
         RenderObject* renderer = targetNode->renderer();
-        while (renderer && !renderer->canBeProgramaticallyScrolled(false)) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -429,8 +443,10 @@ bool EventHandler::eventMayStartDrag(const PlatformMouseEvent& event) const
     // that its logic needs to stay in sync with handleMouseMoveEvent() and the way we setMouseDownMayStartDrag
     // in handleMousePressEvent
     
-    if (!m_frame->contentRenderer() || !m_frame->contentRenderer()->hasLayer()
-        || event.button() != LeftButton || event.clickCount() != 1)
+    if (!m_frame->contentRenderer() || !m_frame->contentRenderer()->hasLayer())
+        return false;
+
+    if (event.button() != LeftButton || event.clickCount() != 1)
         return false;
     
     bool DHTMLFlag;
@@ -438,9 +454,13 @@ bool EventHandler::eventMayStartDrag(const PlatformMouseEvent& event) const
     allowDHTMLDrag(DHTMLFlag, UAFlag);
     if (!DHTMLFlag && !UAFlag)
         return false;
-    
-    HitTestRequest request(true, false);
-    HitTestResult result(m_frame->view()->windowToContents(event.pos()));
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    HitTestResult result(view->windowToContents(event.pos()));
     m_frame->contentRenderer()->layer()->hitTest(request, result);
     bool srcIsDHTML;
     return result.innerNode() && result.innerNode()->renderer()->draggableNode(DHTMLFlag, UAFlag, result.point().x(), result.point().y(), srcIsDHTML);
@@ -451,15 +471,18 @@ void EventHandler::updateSelectionForMouseDrag()
     FrameView* view = m_frame->view();
     if (!view)
         return;
-    RenderObject* renderer = m_frame->contentRenderer();
+    RenderView* renderer = m_frame->contentRenderer();
     if (!renderer)
         return;
     RenderLayer* layer = renderer->layer();
     if (!layer)
         return;
 
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active |
+                           HitTestRequest::MouseMove);
     HitTestResult result(view->windowToContents(m_currentMousePosition));
-    layer->hitTest(HitTestRequest(true, true, true), result);
+    layer->hitTest(request, result);
     updateSelectionForMouseDrag(result.innerNode(), result.localPoint());
 }
 
@@ -486,7 +509,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
 
     // Restart the selection if this is the first mouse move. This work is usually
     // done in handleMousePressEvent, but not if the mouse press was on an existing selection.
-    Selection newSelection = m_frame->selection()->selection();
+    VisibleSelection newSelection = m_frame->selection()->selection();
 
 #if ENABLE(SVG)
     // Special case to limit selection to the containing block for SVG text.
@@ -500,7 +523,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
 
     if (!m_beganSelectingText) {
         m_beganSelectingText = true;
-        newSelection = Selection(targetPosition);
+        newSelection = VisibleSelection(targetPosition);
     }
 
     newSelection.setExtent(targetPosition);
@@ -538,6 +561,7 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     // the mouse is pressed again.
     m_frame->selection()->setCaretBlinkingSuspended(false);
     m_mousePressed = false;
+    m_capturesDragging = false;
     m_mouseDownMayStartDrag = false;
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
@@ -545,17 +569,20 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
   
     bool handled = false;
 
-    // Clear the selection if the mouse didn't move after the last mouse press.
-    // We do this so when clicking on the selection, the selection goes away.
-    // However, if we are editing, place the caret.
+    // Clear the selection if the mouse didn't move after the last mouse
+    // press and it's not a context menu click.  We do this so when clicking
+    // on the selection, the selection goes away.  However, if we are
+    // editing, place the caret.
     if (m_mouseDownWasSingleClickInSelection && !m_beganSelectingText
             && m_dragStartPos == event.event().pos()
-            && m_frame->selection()->isRange()) {
-        Selection newSelection;
+            && m_frame->selection()->isRange()
+            && event.event().button() != RightButton) {
+        VisibleSelection newSelection;
         Node *node = event.targetNode();
-        if (node && node->isContentEditable() && node->renderer()) {
+        bool caretBrowsing = m_frame->settings()->caretBrowsingEnabled();
+        if (node && (caretBrowsing || node->isContentEditable()) && node->renderer()) {
             VisiblePosition pos = node->renderer()->positionForPoint(event.localPoint());
-            newSelection = Selection(pos);
+            newSelection = VisibleSelection(pos);
         }
         if (m_frame->shouldChangeSelection(newSelection))
             m_frame->selection()->setSelection(newSelection);
@@ -581,10 +608,14 @@ void EventHandler::handleAutoscroll(RenderObject* renderer)
 #if ENABLE(PAN_SCROLLING)
     if (m_panScrollInProgress) {
         m_panScrollStartPos = currentMousePosition();
-        m_frame->view()->addPanScrollIcon(m_panScrollStartPos);
-        // If we're not in the top frame we notify it that we are using the panScroll
-        if (m_frame != m_frame->page()->mainFrame())
-            m_frame->page()->mainFrame()->eventHandler()->setPanScrollInProgress(true);
+        if (FrameView* view = m_frame->view())
+            view->addPanScrollIcon(m_panScrollStartPos);
+        // If we're not in the top frame we notify it that we doing a panScroll.
+        if (Page* page = m_frame->page()) {
+            Frame* mainFrame = page->mainFrame();
+            if (m_frame != mainFrame)
+                mainFrame->eventHandler()->setPanScrollInProgress(true);
+        }
     }
 #endif
 
@@ -594,7 +625,7 @@ void EventHandler::handleAutoscroll(RenderObject* renderer)
 void EventHandler::autoscrollTimerFired(Timer<EventHandler>*)
 {
     RenderObject* r = autoscrollRenderer();
-    if (!r) {
+    if (!r || !r->isBox()) {
         stopAutoscrollTimer();
         return;
     }
@@ -604,22 +635,30 @@ void EventHandler::autoscrollTimerFired(Timer<EventHandler>*)
             stopAutoscrollTimer();
             return;
         }
-        r->autoscroll();
+        toRenderBox(r)->autoscroll();
     } else {
         // we verify that the main frame hasn't received the order to stop the panScroll
-        if (!m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress()) {
-            stopAutoscrollTimer();
-            return;
+        if (Page* page = m_frame->page()) {
+            if (!page->mainFrame()->eventHandler()->panScrollInProgress()) {
+                stopAutoscrollTimer();
+                return;
+            }
         }
 #if ENABLE(PAN_SCROLLING)
         setPanScrollCursor();
-        r->panScroll(m_panScrollStartPos);
+        toRenderBox(r)->panScroll(m_panScrollStartPos);
 #endif
     }
 }
 
+#if ENABLE(PAN_SCROLLING)
+
 void EventHandler::setPanScrollCursor()
 {
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
     // At the original click location we draw a 4 arrowed icon. Over this icon there won't be any scroll
     // So we don't want to change the cursor over this area
     const int noScrollRadius = 9;
@@ -630,26 +669,28 @@ void EventHandler::setPanScrollCursor()
          
     if (north) {
         if (east)
-            m_frame->view()->setCursor(northEastPanningCursor());
+            view->setCursor(northEastPanningCursor());
         else if (west)
-            m_frame->view()->setCursor(northWestPanningCursor());
+            view->setCursor(northWestPanningCursor());
         else
-            m_frame->view()->setCursor(northPanningCursor());
+            view->setCursor(northPanningCursor());
     } else if (south) {
         if (east)
-            m_frame->view()->setCursor(southEastPanningCursor());
+            view->setCursor(southEastPanningCursor());
         else if (west)
-            m_frame->view()->setCursor(southWestPanningCursor());
+            view->setCursor(southWestPanningCursor());
         else
-            m_frame->view()->setCursor(southPanningCursor());
+            view->setCursor(southPanningCursor());
     } else if (east)
-        m_frame->view()->setCursor(eastPanningCursor());
+        view->setCursor(eastPanningCursor());
     else if (west)
-        m_frame->view()->setCursor(westPanningCursor());
+        view->setCursor(westPanningCursor());
     else
-        m_frame->view()->setCursor(middlePanningCursor());
+        view->setCursor(middlePanningCursor());
 }
 
+#endif  // ENABLE(PAN_SCROLLING)
+
 RenderObject* EventHandler::autoscrollRenderer() const
 {
     return m_autoscrollRenderer;
@@ -665,7 +706,7 @@ void EventHandler::updateAutoscrollRenderer()
     if (Node* nodeAtPoint = hitTest.innerNode())
         m_autoscrollRenderer = nodeAtPoint->renderer();
 
-    while (m_autoscrollRenderer && !m_autoscrollRenderer->canBeProgramaticallyScrolled(false))
+    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeProgramaticallyScrolled(false)))
         m_autoscrollRenderer = m_autoscrollRenderer->parent();
 }
 
@@ -676,50 +717,68 @@ void EventHandler::setAutoscrollRenderer(RenderObject* renderer)
 
 void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
 {
-    if (!m_frame || !m_frame->document()) {
-        flagDHTML = false;
-        flagUA = false;
+    flagDHTML = false;
+    flagUA = false;
+
+    if (!m_frame)
         return;
-    }
-    
-    unsigned mask = m_frame->page()->dragController()->delegateDragSourceAction(m_frame->view()->contentsToWindow(m_mouseDownPos));
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
+    unsigned mask = page->dragController()->delegateDragSourceAction(view->contentsToWindow(m_mouseDownPos));
     flagDHTML = (mask & DragSourceActionDHTML) != DragSourceActionNone;
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
     
-HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent)
+HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping)
 {
     HitTestResult result(point);
     if (!m_frame->contentRenderer())
         return result;
-    m_frame->contentRenderer()->layer()->hitTest(HitTestRequest(true, true), result);
+    int hitType = HitTestRequest::ReadOnly | HitTestRequest::Active;
+    if (ignoreClipping)
+        hitType |= HitTestRequest::IgnoreClipping;
+    m_frame->contentRenderer()->layer()->hitTest(HitTestRequest(hitType), result);
 
     while (true) {
         Node* n = result.innerNode();
         if (!result.isOverWidget() || !n || !n->renderer() || !n->renderer()->isWidget())
             break;
-        Widget* widget = static_cast<RenderWidget*>(n->renderer())->widget();
+        RenderWidget* renderWidget = static_cast<RenderWidget*>(n->renderer());
+        Widget* widget = renderWidget->widget();
         if (!widget || !widget->isFrameView())
             break;
         Frame* frame = static_cast<HTMLFrameElementBase*>(n)->contentFrame();
         if (!frame || !frame->contentRenderer())
             break;
         FrameView* view = static_cast<FrameView*>(widget);
-        IntPoint widgetPoint(result.localPoint().x() + view->scrollX() - n->renderer()->borderLeft() - n->renderer()->paddingLeft(), 
-            result.localPoint().y() + view->scrollY() - n->renderer()->borderTop() - n->renderer()->paddingTop());
+        IntPoint widgetPoint(result.localPoint().x() + view->scrollX() - renderWidget->borderLeft() - renderWidget->paddingLeft(), 
+            result.localPoint().y() + view->scrollY() - renderWidget->borderTop() - renderWidget->paddingTop());
         HitTestResult widgetHitTestResult(widgetPoint);
-        frame->contentRenderer()->layer()->hitTest(HitTestRequest(true, true), widgetHitTestResult);
+        frame->contentRenderer()->layer()->hitTest(HitTestRequest(hitType), widgetHitTestResult);
         result = widgetHitTestResult;
     }
     
     // If our HitTestResult is not visible, then we started hit testing too far down the frame chain. 
     // Another hit test at the main frame level should get us the correct visible result.
     Frame* resultFrame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : 0;
-    Frame* mainFrame = m_frame->page()->mainFrame();
-    if (m_frame != mainFrame && resultFrame && resultFrame != mainFrame && !resultFrame->editor()->insideVisibleArea(result.point())) {
-        IntPoint windowPoint = resultFrame->view()->contentsToWindow(result.point());
-        IntPoint mainFramePoint = mainFrame->view()->windowToContents(windowPoint);
-        result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent);
+    if (Page* page = m_frame->page()) {
+        Frame* mainFrame = page->mainFrame();
+        if (m_frame != mainFrame && resultFrame && resultFrame != mainFrame && !resultFrame->editor()->insideVisibleArea(result.point())) {
+            FrameView* resultView = resultFrame->view();
+            FrameView* mainView = mainFrame->view();
+            if (resultView && mainView) {
+                IntPoint windowPoint = resultView->contentsToWindow(result.point());
+                IntPoint mainFramePoint = mainView->windowToContents(windowPoint);
+                result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent, ignoreClipping);
+            }
+        }
     }
 
     if (!allowShadowContent)
@@ -746,11 +805,13 @@ void EventHandler::stopAutoscrollTimer(bool rendererIsBeingDestroyed)
 
     if (autoscrollRenderer()) {
         if (!rendererIsBeingDestroyed && (m_autoscrollInProgress || m_panScrollInProgress))
-            autoscrollRenderer()->stopAutoscroll();
+            toRenderBox(autoscrollRenderer())->stopAutoscroll();
 #if ENABLE(PAN_SCROLLING)
         if (m_panScrollInProgress) {
-            m_frame->view()->removePanScrollIcon();
-            m_frame->view()->setCursor(pointerCursor());
+            if (FrameView* view = m_frame->view()) {
+                view->removePanScrollIcon();
+                view->setCursor(pointerCursor());
+            }
         }
 #endif
 
@@ -760,9 +821,14 @@ void EventHandler::stopAutoscrollTimer(bool rendererIsBeingDestroyed)
     m_autoscrollTimer.stop();
 
     m_panScrollInProgress = false;
-    // If we're not in the top frame we notify it that we are not using the panScroll anymore
-    if (m_frame->page() && m_frame != m_frame->page()->mainFrame())
-            m_frame->page()->mainFrame()->eventHandler()->setPanScrollInProgress(false);
+
+    // If we're not in the top frame we notify it that we are not doing a panScroll any more.
+    if (Page* page = m_frame->page()) {
+        Frame* mainFrame = page->mainFrame();
+        if (m_frame != mainFrame)
+            mainFrame->eventHandler()->setPanScrollInProgress(false);
+    }
+
     m_autoscrollInProgress = false;
 }
 
@@ -778,17 +844,14 @@ void EventHandler::setMousePressNode(PassRefPtr<Node> node)
 
 bool EventHandler::scrollOverflow(ScrollDirection direction, ScrollGranularity granularity)
 {
-    if (!m_frame->document())
-        return false;
-    
     Node* node = m_frame->document()->focusedNode();
     if (!node)
         node = m_mousePressNode.get();
     
     if (node) {
-        RenderObject *r = node->renderer();
+        RenderObject* r = node->renderer();
         if (r && !r->isListBox())
-            return r->scroll(direction, granularity);
+            return r->enclosingBox()->scroll(direction, granularity);
     }
 
     return false;
@@ -905,10 +968,13 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
             
             if ((event.isOverLink() || isSubmitImage(node)) && (!editable || editableLinkEnabled))
                 return handCursor();
-            RenderLayer* layer = renderer ? renderer->enclosingLayer() : 0;
             bool inResizer = false;
-            if (m_frame->view() && layer && layer->isPointInResizeControl(m_frame->view()->windowToContents(event.event().pos())))
-                inResizer = true;
+            if (renderer) {
+                if (RenderLayer* layer = renderer->enclosingLayer()) {
+                    if (FrameView* view = m_frame->view())
+                        inResizer = layer->isPointInResizeControl(view->windowToContents(event.event().pos()));
+                }
+            }
             if ((editable || (renderer && renderer->isText() && node->canStartSelection())) && !inResizer && !scrollbar)
                 return iBeamCursor();
             return pointerCursor();
@@ -986,24 +1052,39 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
     }
     return pointerCursor();
 }
+    
+static IntPoint documentPointForWindowPoint(Frame* frame, const IntPoint& windowPoint)
+{
+    FrameView* view = frame->view();
+    // FIXME: Is it really OK to use the wrong coordinates here when view is 0?
+    // Historically the code would just crash; this is clearly no worse than that.
+    return view ? view->windowToContents(windowPoint) : windowPoint;
+}
 
 bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 {
-    if (!m_frame->document())
-        return false;
-
     RefPtr<FrameView> protector(m_frame->view());
 
     m_mousePressed = true;
+    m_capturesDragging = true;
     m_currentMousePosition = mouseEvent.pos();
     m_mouseDownTimestamp = mouseEvent.timestamp();
     m_mouseDownMayStartDrag = false;
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
-    m_mouseDownPos = m_frame->view()->windowToContents(mouseEvent.pos());
+    if (FrameView* view = m_frame->view())
+        m_mouseDownPos = view->windowToContents(mouseEvent.pos());
+    else {
+        invalidateClick();
+        return false;
+    }
     m_mouseDownWasInSubframe = false;
 
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(false, true), mouseEvent);
+    HitTestRequest request(HitTestRequest::Active);
+    // Save the document point we generate in case the window coordinate is invalidated by what happens 
+    // when we dispatch the event.
+    IntPoint documentPoint = documentPointForWindowPoint(m_frame, mouseEvent.pos());
+    MouseEventWithHitTestResults mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
 
     if (!mev.targetNode()) {
         invalidateClick();
@@ -1012,34 +1093,38 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_mousePressNode = mev.targetNode();
 
-    InspectorController* inspector = m_frame->page()->inspectorController();
-    if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
-        inspector->handleMousePressOnNode(m_mousePressNode.get());
-        invalidateClick();
-        return true;
+    if (Page* page = m_frame->page()) {
+        InspectorController* inspector = page->inspectorController();
+        if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
+            inspector->handleMousePressOnNode(m_mousePressNode.get());
+            invalidateClick();
+            return true;
+        }
     }
 
     Frame* subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
         // Start capturing future events for this frame.  We only do this if we didn't clear
         // the m_mousePressed flag, which may happen if an AppKit widget entered a modal event loop.
-        if (m_mousePressed)
+        m_capturesDragging = subframe->eventHandler()->capturesDragging();
+        if (m_mousePressed && m_capturesDragging)
             m_capturingMouseEventsNode = mev.targetNode();
         invalidateClick();
         return true;
     }
 
 #if ENABLE(PAN_SCROLLING)
-    if (m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
+    Page* page = m_frame->page();
+    if (page && page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
         stopAutoscrollTimer();
         invalidateClick();
         return true;
     }
-    
+
     if (mouseEvent.button() == MiddleButton && !mev.isOverLink()) {
         RenderObject* renderer = mev.targetNode()->renderer();
 
-        while (renderer && !renderer->canBeProgramaticallyScrolled(false)) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -1057,25 +1142,28 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_clickCount = mouseEvent.clickCount();
     m_clickNode = mev.targetNode();
-    
-    RenderLayer* layer = m_clickNode->renderer() ? m_clickNode->renderer()->enclosingLayer() : 0;
-    IntPoint p = m_frame->view()->windowToContents(mouseEvent.pos());
-    if (layer && layer->isPointInResizeControl(p)) {
-        layer->setInResizeMode(true);
-        m_resizeLayer = layer;
-        m_offsetFromResizeCorner = layer->offsetFromResizeCorner(p);
-        invalidateClick();
-        return true;
+
+    if (FrameView* view = m_frame->view()) {
+        RenderLayer* layer = m_clickNode->renderer() ? m_clickNode->renderer()->enclosingLayer() : 0;
+        IntPoint p = view->windowToContents(mouseEvent.pos());
+        if (layer && layer->isPointInResizeControl(p)) {
+            layer->setInResizeMode(true);
+            m_resizeLayer = layer;
+            m_offsetFromResizeCorner = layer->offsetFromResizeCorner(p);
+            invalidateClick();
+            return true;
+        }
     }
 
     bool swallowEvent = dispatchMouseEvent(eventNames().mousedownEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    m_capturesDragging = !swallowEvent;
 
     // If the hit testing originally determined the event was in a scrollbar, refetch the MouseEventWithHitTestResults
     // in case the scrollbar widget was destroyed when the mouse event was handled.
     if (mev.scrollbar()) {
         const bool wasLastScrollBar = mev.scrollbar() == m_lastScrollbarUnderMouse.get();
-        mev = prepareMouseEvent(HitTestRequest(true, true), mouseEvent);
-
+        HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+        mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
         if (wasLastScrollBar && mev.scrollbar() != m_lastScrollbarUnderMouse.get())
             m_lastScrollbarUnderMouse = 0;
     }
@@ -1089,10 +1177,13 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         // If a mouse event handler changes the input element type to one that has a widget associated,
         // we'd like to EventHandler::handleMousePressEvent to pass the event to the widget and thus the
         // event target node can't still be the shadow node.
-        if (mev.targetNode()->isShadowNode() && mev.targetNode()->shadowParentNode()->hasTagName(inputTag))
-            mev = prepareMouseEvent(HitTestRequest(true, true), mouseEvent);
+        if (mev.targetNode()->isShadowNode() && mev.targetNode()->shadowParentNode()->hasTagName(inputTag)) {
+            HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+            mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
+        }
 
-        Scrollbar* scrollbar = m_frame->view()->scrollbarUnderMouse(mouseEvent);
+        FrameView* view = m_frame->view();
+        Scrollbar* scrollbar = view ? view->scrollbarUnderMouse(mouseEvent) : 0;
         if (!scrollbar)
             scrollbar = mev.scrollbar();
         if (scrollbar && passMousePressEventToScrollbar(mev, scrollbar))
@@ -1107,16 +1198,14 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 // This method only exists for platforms that don't know how to deliver 
 bool EventHandler::handleMouseDoubleClickEvent(const PlatformMouseEvent& mouseEvent)
 {
-    if (!m_frame->document())
-        return false;
-
     RefPtr<FrameView> protector(m_frame->view());
 
     // We get this instead of a second mouse-up 
     m_mousePressed = false;
     m_currentMousePosition = mouseEvent.pos();
 
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(false, true), mouseEvent);
+    HitTestRequest request(HitTestRequest::Active);
+    MouseEventWithHitTestResults mev = prepareMouseEvent(request, mouseEvent);
     Frame* subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
         m_capturingMouseEventsNode = 0;
@@ -1165,7 +1254,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     // but also assert so that we can try to figure this out in debug
     // builds, if it happens.
     ASSERT(m_frame);
-    if (!m_frame || !m_frame->document())
+    if (!m_frame)
         return false;
 
     RefPtr<FrameView> protector(m_frame->view());
@@ -1192,7 +1281,12 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     // if we are allowed to select.
     // This means that :hover and :active freeze in the state they were in when the mouse
     // was pressed, rather than updating for nodes the mouse moves over as you hold the mouse down.
-    HitTestRequest request(m_mousePressed && m_mouseDownMayStartSelect, m_mousePressed, true);
+    int hitType = HitTestRequest::MouseMove;
+    if (m_mousePressed && m_mouseDownMayStartSelect)
+        hitType |= HitTestRequest::ReadOnly;
+    if (m_mousePressed)
+        hitType |= HitTestRequest::Active;
+    HitTestRequest request(hitType);
     MouseEventWithHitTestResults mev = prepareMouseEvent(request, mouseEvent);
     if (hoveredNode)
         *hoveredNode = mev.hitTestResult();
@@ -1202,8 +1296,8 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     if (m_resizeLayer && m_resizeLayer->inResizeMode())
         m_resizeLayer->resize(mouseEvent, m_offsetFromResizeCorner);
     else {
-        if (m_frame->view())
-            scrollbar = m_frame->view()->scrollbarUnderMouse(mouseEvent);
+        if (FrameView* view = m_frame->view())
+            scrollbar = view->scrollbarUnderMouse(mouseEvent);
 
         if (!scrollbar)
             scrollbar = mev.scrollbar();
@@ -1234,8 +1328,12 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     } else {
         if (scrollbar && !m_mousePressed)
             scrollbar->mouseMoved(scrollbar->transformEvent(mouseEvent)); // Handle hover effects on platforms that support visual feedback on scrollbar hovering.
-        if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() && m_frame->view())
-            m_frame->view()->setCursor(selectCursor(mev, scrollbar));
+        if (Page* page = m_frame->page()) {
+            if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !page->mainFrame()->eventHandler()->panScrollInProgress()) {
+                if (FrameView* view = m_frame->view())
+                    view->setCursor(selectCursor(mev, scrollbar));
+            }
+        }
     }
     
     m_lastMouseMoveEventSubframe = newSubframe;
@@ -1258,9 +1356,6 @@ void EventHandler::invalidateClick()
 
 bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 {
-    if (!m_frame->document())
-        return false;
-
     RefPtr<FrameView> protector(m_frame->view());
 
     m_mousePressed = false;
@@ -1282,7 +1377,8 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
         return m_lastScrollbarUnderMouse->mouseUp();
     }
 
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(false, false, false, true), mouseEvent);
+    HitTestRequest request(HitTestRequest::MouseUp);
+    MouseEventWithHitTestResults mev = prepareMouseEvent(request, mouseEvent);
     Frame* subframe = m_capturingMouseEventsNode.get() ? subframeForTargetNode(m_capturingMouseEventsNode.get()) : subframeForHitTestResult(mev);
     if (subframe && passMouseReleaseEventToSubframe(mev, subframe)) {
         m_capturingMouseEventsNode = 0;
@@ -1312,16 +1408,23 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 
 bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTarget, const PlatformMouseEvent& event, Clipboard* clipboard)
 {
-    IntPoint contentsPos = m_frame->view()->windowToContents(event.pos());
-    
+    FrameView* view = m_frame->view();
+
+    // FIXME: We might want to dispatch a dragleave even if the view is gone.
+    if (!view)
+        return false;
+
+    view->resetDeferredRepaintDelay();
+    IntPoint contentsPos = view->windowToContents(event.pos());
+
     RefPtr<MouseEvent> me = MouseEvent::create(eventType,
         true, true, m_frame->document()->defaultView(),
         0, event.globalX(), event.globalY(), contentsPos.x(), contentsPos.y(),
         event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
         0, 0, clipboard);
 
-    ExceptionCode ec = 0;
-    EventTargetNodeCast(dragTarget)->dispatchEvent(me.get(), ec);
+    ExceptionCode ec;
+    dragTarget->dispatchEvent(me.get(), ec);
     return me->defaultPrevented();
 }
 
@@ -1329,13 +1432,11 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 {
     bool accept = false;
 
-    if (!m_frame->document())
-        return false;
-
     if (!m_frame->view())
         return false;
-    
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(true, false), event);
+
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    MouseEventWithHitTestResults mev = prepareMouseEvent(request, event);
 
     // Drag events should never go to text nodes (following IE, and proper mouseover/out dispatch)
     Node* newTarget = mev.targetNode();
@@ -1348,12 +1449,13 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // FIXME: this ordering was explicitly chosen to match WinIE. However,
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
-        if (newTarget)
+        if (newTarget) {
             if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
                 accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
-        
+        }
+
         if (m_dragTarget) {
             Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
                             ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
@@ -1363,11 +1465,12 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
                 dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
         }
     } else {
-        if (newTarget)
+        if (newTarget) {
             if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
                 accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+        }
     }
     m_dragTarget = newTarget;
 
@@ -1421,8 +1524,7 @@ MouseEventWithHitTestResults EventHandler::prepareMouseEvent(const HitTestReques
     ASSERT(m_frame);
     ASSERT(m_frame->document());
     
-    IntPoint documentPoint = m_frame->view()->windowToContents(mev.pos());
-    return m_frame->document()->prepareMouseEvent(request, documentPoint, mev);
+    return m_frame->document()->prepareMouseEvent(request, documentPointForWindowPoint(m_frame, mev.pos()), mev);
 }
 
 #if ENABLE(SVG)
@@ -1507,10 +1609,10 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
         if (m_lastNodeUnderMouse != m_nodeUnderMouse) {
             // send mouseout event to the old node
             if (m_lastNodeUnderMouse)
-                EventTargetNodeCast(m_lastNodeUnderMouse.get())->dispatchMouseEvent(mouseEvent, eventNames().mouseoutEvent, 0, m_nodeUnderMouse.get());
+                m_lastNodeUnderMouse->dispatchMouseEvent(mouseEvent, eventNames().mouseoutEvent, 0, m_nodeUnderMouse.get());
             // send mouseover event to the new node
             if (m_nodeUnderMouse)
-                EventTargetNodeCast(m_nodeUnderMouse.get())->dispatchMouseEvent(mouseEvent, eventNames().mouseoverEvent, 0, m_lastNodeUnderMouse.get());
+                m_nodeUnderMouse->dispatchMouseEvent(mouseEvent, eventNames().mouseoverEvent, 0, m_lastNodeUnderMouse.get());
         }
         m_lastNodeUnderMouse = m_nodeUnderMouse;
 #if ENABLE(SVG)
@@ -1521,12 +1623,15 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
 
 bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targetNode, bool /*cancelable*/, int clickCount, const PlatformMouseEvent& mouseEvent, bool setUnder)
 {
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
+
     updateMouseEventTargetNode(targetNode, mouseEvent, setUnder);
 
     bool swallowEvent = false;
 
     if (m_nodeUnderMouse)
-        swallowEvent = EventTargetNodeCast(m_nodeUnderMouse.get())->dispatchMouseEvent(mouseEvent, eventType, clickCount);
+        swallowEvent = m_nodeUnderMouse->dispatchMouseEvent(mouseEvent, eventType, clickCount);
     
     if (!swallowEvent && eventType == eventNames().mousedownEvent) {
         // Blur current focus node when a link/button is clicked; this
@@ -1538,7 +1643,7 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
         // Walk up the render tree to search for a node to focus.
         // Walking up the DOM tree wouldn't work for shadow trees, like those behind the engine-based text fields.
         while (renderer) {
-            node = renderer->element();
+            node = renderer->node();
             if (node && node->isFocusable()) {
                 // To fix <rdar://problem/4895428> Can't drag selected ToDo, we don't focus a 
                 // node on mouse down if it's selected and inside a focused node. It will be 
@@ -1547,7 +1652,7 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
                 ExceptionCode ec = 0;
                 Node* n = node->isShadowNode() ? node->shadowParentNode() : node;
                 if (m_frame->selection()->isRange() && 
-                    m_frame->selection()->toRange()->compareNode(n, ec) == Range::NODE_INSIDE &&
+                    m_frame->selection()->toNormalizedRange()->compareNode(n, ec) == Range::NODE_INSIDE &&
                     n->isDescendantOf(m_frame->document()->focusedNode()))
                     return false;
                     
@@ -1556,14 +1661,17 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
             
             renderer = renderer->parent();
         }
+
         // If focus shift is blocked, we eat the event.  Note we should never clear swallowEvent
         // if the page already set it (e.g., by canceling default behavior).
-        if (node && node->isMouseFocusable()) {
-            if (!m_frame->page()->focusController()->setFocusedNode(node, m_frame))
-                swallowEvent = true;
-        } else if (!node || !node->focused()) {
-            if (!m_frame->page()->focusController()->setFocusedNode(0, m_frame))
-                swallowEvent = true;
+        if (Page* page = m_frame->page()) {
+            if (node && node->isMouseFocusable()) {
+                if (!page->focusController()->setFocusedNode(node, m_frame))
+                    swallowEvent = true;
+            } else if (!node || !node->focused()) {
+                if (!page->focusController()->setFocusedNode(0, m_frame))
+                    swallowEvent = true;
+            }
         }
     }
 
@@ -1573,18 +1681,21 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
 bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
 {
     Document* doc = m_frame->document();
-    if (!doc)
-        return false;
 
     RenderObject* docRenderer = doc->renderer();
     if (!docRenderer)
         return false;
+    
+    RefPtr<FrameView> protector(m_frame->view());
 
-    IntPoint vPoint = m_frame->view()->windowToContents(e.pos());
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+    IntPoint vPoint = view->windowToContents(e.pos());
 
-    HitTestRequest request(true, false);
+    HitTestRequest request(HitTestRequest::ReadOnly);
     HitTestResult result(vPoint);
-    doc->renderer()->layer()->hitTest(request, result);
+    doc->renderView()->layer()->hitTest(request, result);
     Node* node = result.innerNode();
     
     if (node) {
@@ -1601,11 +1712,16 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         }
 
         node = node->shadowAncestorNode();
-        EventTargetNodeCast(node)->dispatchWheelEvent(e);
+        node->dispatchWheelEvent(e);
         if (e.isAccepted())
             return true;
-            
-        if (node->renderer()) {
+        
+        // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
+        // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
+        while (node && !node->renderer())
+            node = node->parent();
+        
+        if (node && node->renderer()) {
             // Just break up into two scrolls if we need to.  Diagonal movement on 
             // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
             scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node);
@@ -1613,9 +1729,14 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         }
     }
 
-    if (!e.isAccepted())
-        m_frame->view()->wheelEvent(e);
-    
+    if (e.isAccepted())
+        return true;
+
+    view = m_frame->view();
+    if (!view)
+        return false;
+
+    view->wheelEvent(e);
     return e.isAccepted();
 }
 
@@ -1623,20 +1744,23 @@ bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
 {
     Document* doc = m_frame->document();
     FrameView* v = m_frame->view();
-    if (!doc || !v)
+    if (!v)
         return false;
     
     bool swallowEvent;
     IntPoint viewportPos = v->windowToContents(event.pos());
-    MouseEventWithHitTestResults mev = doc->prepareMouseEvent(HitTestRequest(false, true), viewportPos, event);
+    HitTestRequest request(HitTestRequest::Active);
+    MouseEventWithHitTestResults mev = doc->prepareMouseEvent(request, viewportPos, event);
 
-    // Context menu events shouldn't select text in GTK+ applications.
-#if !PLATFORM(GTK)
+    // Context menu events shouldn't select text in GTK+ applications or in Chromium.
+    // FIXME: This should probably be configurable by embedders. Consider making it a WebPreferences setting.
+    // See: https://bugs.webkit.org/show_bug.cgi?id=15279
+#if !PLATFORM(GTK) && !PLATFORM(CHROMIUM)
     if (!m_frame->selection()->contains(viewportPos) && 
         // FIXME: In the editable case, word selection sometimes selects content that isn't underneath the mouse.
         // If the selection is non-editable, we do word selection to make it easier to use the contextual menu items
         // available for text selections.  But only if we're above text.
-        (m_frame->selection()->isContentEditable() || mev.targetNode() && mev.targetNode()->isTextNode())) {
+        (m_frame->selection()->isContentEditable() || (mev.targetNode() && mev.targetNode()->isTextNode()))) {
         m_mouseDownMayStartSelect = true; // context menu events are always allowed to perform a selection
         selectClosestWordOrLinkFromMouseEvent(mev);
     }
@@ -1663,10 +1787,11 @@ bool EventHandler::canMouseDownStartSelect(Node* node)
     if (!node->canStartSelection())
         return false;
             
-    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent())    
-        if (Node* node = curr->element())
-            return EventTargetNodeCast(node)->dispatchEventForType(eventNames().selectstartEvent, true, true);
-    
+    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
+        if (Node* node = curr->node())
+            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+    }
+
     return true;
 }
 
@@ -1675,10 +1800,11 @@ bool EventHandler::canMouseDragExtendSelect(Node* node)
     if (!node || !node->renderer())
         return true;
             
-    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent())    
-        if (Node* node = curr->element())
-            return EventTargetNodeCast(node)->dispatchEventForType(eventNames().selectstartEvent, true, true);
-    
+    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
+        if (Node* node = curr->node())
+            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+    }
+
     return true;
 }
 
@@ -1700,27 +1826,26 @@ void EventHandler::hoverTimerFired(Timer<EventHandler>*)
     ASSERT(m_frame);
     ASSERT(m_frame->document());
 
-    if (RenderObject* renderer = m_frame->contentRenderer()) {
-        HitTestResult result(m_frame->view()->windowToContents(m_currentMousePosition));
-        renderer->layer()->hitTest(HitTestRequest(false, false, true), result);
-        m_frame->document()->updateRendering();
+    if (RenderView* renderer = m_frame->contentRenderer()) {
+        if (FrameView* view = m_frame->view()) {
+            HitTestRequest request(HitTestRequest::MouseMove);
+            HitTestResult result(view->windowToContents(m_currentMousePosition));
+            renderer->layer()->hitTest(request, result);
+            m_frame->document()->updateStyleIfNeeded();
+        }
     }
 }
 
-static EventTargetNode* eventTargetNodeForDocument(Document* doc)
+static Node* eventTargetNodeForDocument(Document* doc)
 {
     if (!doc)
         return 0;
     Node* node = doc->focusedNode();
-    if (!node) {
-        if (doc->isHTMLDocument())
-            node = doc->body();
-        else
-            node = doc->documentElement();
-        if (!node)
-            return 0;
-    }
-    return EventTargetNodeCast(node);
+    if (!node && doc->isHTMLDocument())
+        node = doc->body();
+    if (!node)
+        node = doc->documentElement();
+    return node;
 }
 
 bool EventHandler::handleAccessKey(const PlatformKeyboardEvent& evt)
@@ -1750,23 +1875,29 @@ bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
 bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 {
 #if ENABLE(PAN_SCROLLING)
-    if (m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
-        String escKeyId = "U+001B";
-        // If a key is pressed while the autoscroll/panScroll is in progress then we want to stop
-        if (initialKeyEvent.keyIdentifier() == escKeyId && initialKeyEvent.type() == PlatformKeyboardEvent::KeyUp) 
-            stopAutoscrollTimer();
+    if (Page* page = m_frame->page()) {
+        if (page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
+            static const char* const escapeKeyIdentifier = "U+001B";
 
-        // If we were in autoscroll/panscroll mode, we swallow the key event
-        return true;
+            // If a key is pressed while the autoscroll/panScroll is in progress then we want to stop
+            if (initialKeyEvent.keyIdentifier() == escapeKeyIdentifier && initialKeyEvent.type() == PlatformKeyboardEvent::KeyUp) 
+                stopAutoscrollTimer();
+
+            // If we were in autoscroll/panscroll mode, we swallow the key event
+            return true;
+        }
     }
 #endif
 
     // Check for cases where we are too early for events -- possible unmatched key up
     // from pressing return in the location bar.
-    RefPtr<EventTargetNode> node = eventTargetNodeForDocument(m_frame->document());
+    RefPtr<Node> node = eventTargetNodeForDocument(m_frame->document());
     if (!node)
         return false;
 
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
+
     // FIXME: what is this doing here, in keyboard event handler?
     m_frame->loader()->resetMultipleFormSubmissionProtection();
 
@@ -1852,21 +1983,22 @@ void EventHandler::handleKeyboardSelectionMovement(KeyboardEvent* event)
     String key = event->keyIdentifier();           
     bool isShifted = event->getModifierState("Shift");
     bool isOptioned = event->getModifierState("Alt");
+    bool isCommanded = event->getModifierState("Meta");
     
     if (key == "Up") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::BACKWARD, LineGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::BACKWARD, (isCommanded) ? DocumentBoundary : LineGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Down") { 
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::FORWARD, LineGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::FORWARD, (isCommanded) ? DocumentBoundary : LineGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Left") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::LEFT, (isOptioned) ? WordGranularity : CharacterGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::LEFT, (isCommanded) ? LineBoundary : (isOptioned) ? WordGranularity : CharacterGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Right") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::RIGHT, (isOptioned) ? WordGranularity : CharacterGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::RIGHT, (isCommanded) ? LineBoundary : (isOptioned) ? WordGranularity : CharacterGranularity, true);
         event->setDefaultHandled();
     }    
 }
@@ -1877,11 +2009,8 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
         m_frame->editor()->handleKeyboardEvent(event);
         if (event->defaultHandled())
             return;
-        const String& keyIdentifier = event->keyIdentifier();
-        if (keyIdentifier == "U+0009")
+        if (event->keyIdentifier() == "U+0009")
             defaultTabEventHandler(event);
-        else if (keyIdentifier == "U+0020")
-            defaultSpaceEventHandler(event);
 
        // provides KB navigation and selection for enhanced accessibility users
        if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
@@ -1904,7 +2033,10 @@ bool EventHandler::dragHysteresisExceeded(const FloatPoint& floatDragViewportLoc
     
 bool EventHandler::dragHysteresisExceeded(const IntPoint& dragViewportLocation) const
 {
-    IntPoint dragLocation = m_frame->view()->windowToContents(dragViewportLocation);
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+    IntPoint dragLocation = view->windowToContents(dragViewportLocation);
     IntSize delta = dragLocation - m_mouseDownPos;
     
     int threshold = GeneralDragHysteresis;
@@ -1926,10 +2058,10 @@ void EventHandler::freeClipboard()
 
 bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
 {
-    ASSERT(node);
-    if (node->hasChildNodes() || !m_frame->view())
+    if (!node || node->hasChildNodes() || !m_frame->view())
         return false;
-    return m_frame->page() && m_frame->page()->dragController()->mayStartDragAtEventLocation(m_frame, point);
+    Page* page = m_frame->page();
+    return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
 }
     
 void EventHandler::dragSourceMovedTo(const PlatformMouseEvent& event)
@@ -1980,7 +2112,7 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
 
     if (m_mouseDownMayStartDrag && !dragState().m_dragSrc) {
         // try to find an element that wants to be dragged
-        HitTestRequest request(true, false);
+        HitTestRequest request(HitTestRequest::ReadOnly);
         HitTestResult result(m_mouseDownPos);
         m_frame->contentRenderer()->layer()->hitTest(request, result);
         Node* node = result.innerNode();
@@ -2018,7 +2150,8 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
         return !mouseDownMayStartSelect() && !m_mouseDownMayStartAutoscroll;
     
     // We are starting a text/image/url drag, so the cursor should be an arrow
-    m_frame->view()->setCursor(pointerCursor());
+    if (FrameView* view = m_frame->view())
+        view->setCursor(pointerCursor());
     
     if (!dragHysteresisExceeded(event.event().pos())) 
         return true;
@@ -2068,7 +2201,8 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
     }
     
     if (m_mouseDownMayStartDrag) {
-        DragController* dragController = m_frame->page() ? m_frame->page()->dragController() : 0;
+        Page* page = m_frame->page();
+        DragController* dragController = page ? page->dragController() : 0;
         bool startedDrag = dragController && dragController->startDrag(m_frame, dragState().m_dragClipboard.get(), srcOp, event.event(), m_mouseDownPos, dragState().m_dragSrcIsDHTML);
         if (!startedDrag && dragState().m_dragSrcMayBeDHTML) {
             // Drag was canned at the last minute - we owe m_dragSrc a DRAGEND event
@@ -2104,6 +2238,9 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
         target = eventTargetNodeForDocument(m_frame->document());
     if (!target)
         return false;
+    
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
 
     RefPtr<TextEvent> event = TextEvent::create(m_frame->domWindow(), text);
     event->setUnderlyingEvent(underlyingEvent);
@@ -2205,64 +2342,27 @@ void EventHandler::defaultTabEventHandler(KeyboardEvent* event)
 
 void EventHandler::capsLockStateMayHaveChanged()
 {
-    if (Document* d = m_frame->document())
-        if (Node* node = d->focusedNode())
-            if (RenderObject* r = node->renderer())
-                r->capsLockStateMayHaveChanged();
-}
-
-unsigned EventHandler::pendingFrameUnloadEventCount()
-{
-    return m_pendingFrameUnloadEventCount;
-}
-
-void EventHandler::addPendingFrameUnloadEventCount() 
-{
-    m_pendingFrameUnloadEventCount += 1;
-    m_frame->page()->changePendingUnloadEventCount(1);
-    return; 
-}
-    
-void EventHandler::removePendingFrameUnloadEventCount() 
-{
-    ASSERT( (-1 + (int)m_pendingFrameUnloadEventCount) >= 0 );
-    m_pendingFrameUnloadEventCount -= 1;
-    m_frame->page()->changePendingUnloadEventCount(-1);
-    return; 
-}
-    
-void EventHandler::clearPendingFrameUnloadEventCount() 
-{
-    m_frame->page()->changePendingUnloadEventCount(-((int)m_pendingFrameUnloadEventCount));
-    m_pendingFrameUnloadEventCount = 0;
-    return; 
+    Document* d = m_frame->document();
+    if (Node* node = d->focusedNode()) {
+        if (RenderObject* r = node->renderer()) {
+            if (r->isTextField())
+                static_cast<RenderTextControlSingleLine*>(r)->capsLockStateMayHaveChanged();
+        }
+    }
 }
 
-unsigned EventHandler::pendingFrameBeforeUnloadEventCount()
+void EventHandler::sendResizeEvent()
 {
-    return m_pendingFrameBeforeUnloadEventCount;
+    m_frame->document()->dispatchWindowEvent(eventNames().resizeEvent, false, false);
 }
 
-void EventHandler::addPendingFrameBeforeUnloadEventCount() 
-{
-    m_pendingFrameBeforeUnloadEventCount += 1;
-    m_frame->page()->changePendingBeforeUnloadEventCount(1);
-    return; 
-}
-    
-void EventHandler::removePendingFrameBeforeUnloadEventCount() 
+void EventHandler::sendScrollEvent()
 {
-    ASSERT( (-1 + (int)m_pendingFrameBeforeUnloadEventCount) >= 0 );
-    m_pendingFrameBeforeUnloadEventCount -= 1;
-    m_frame->page()->changePendingBeforeUnloadEventCount(-1);
-    return; 
-}
-
-    void EventHandler::clearPendingFrameBeforeUnloadEventCount() 
-{
-    m_frame->page()->changePendingBeforeUnloadEventCount(-((int)m_pendingFrameBeforeUnloadEventCount));
-    m_pendingFrameBeforeUnloadEventCount = 0;
-    return; 
+    FrameView* v = m_frame->view();
+    if (!v)
+        return;
+    v->setWasScrolledByUser(true);
+    m_frame->document()->dispatchEvent(eventNames().scrollEvent, true, false);
 }
 
 bool EventHandler::passMousePressEventToScrollbar(MouseEventWithHitTestResults& mev, Scrollbar* scrollbar)
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 5d51cb6f23..06ed9560d4 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,33 +27,25 @@
 #define EventHandler_h
 
 #include "DragActions.h"
-#include "FocusDirection.h"
 #include "PlatformMouseEvent.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(MAC)
-#include "WebCoreKeyboardUIMode.h"
-#ifndef __OBJC__
-class NSEvent;
+#if PLATFORM(MAC) && !defined(__OBJC__)
 class NSView;
 #endif
-#endif
 
 namespace WebCore {
 
 class AtomicString;
 class Clipboard;
 class Cursor;
-class EventTargetNode;
 class Event;
 class FloatPoint;
-class FloatRect;
 class Frame;
+class HitTestRequest;
 class HitTestResult;
 class HTMLFrameSetElement;
 class KeyboardEvent;
@@ -68,11 +60,8 @@ class Scrollbar;
 class String;
 class SVGElementInstance;
 class TextEvent;
-class VisiblePosition;
 class Widget;
     
-struct HitTestRequest;
-
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
 extern const int TextDragHysteresis;
@@ -97,7 +86,7 @@ public:
     RenderObject* autoscrollRenderer() const;
     void updateAutoscrollRenderer();
 
-    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent);
+    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false);
 
     bool mousePressed() const { return m_mousePressed; }
     void setMousePressed(bool pressed) { m_mousePressed = pressed; }
@@ -158,30 +147,27 @@ public:
 
     void capsLockStateMayHaveChanged();
     
-    unsigned pendingFrameUnloadEventCount();
-    void addPendingFrameUnloadEventCount();
-    void removePendingFrameUnloadEventCount();
-    void clearPendingFrameUnloadEventCount();
-    unsigned pendingFrameBeforeUnloadEventCount();
-    void addPendingFrameBeforeUnloadEventCount();
-    void removePendingFrameBeforeUnloadEventCount();
-    void clearPendingFrameBeforeUnloadEventCount();
+    void sendResizeEvent();
+    void sendScrollEvent();
     
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && defined(__OBJC__)
     PassRefPtr<KeyboardEvent> currentKeyboardEvent() const;
 
-    void mouseDown(NSEvent*);
-    void mouseDragged(NSEvent*);
-    void mouseUp(NSEvent*);
-    void mouseMoved(NSEvent*);
-    bool keyEvent(NSEvent*);
-    bool wheelEvent(NSEvent*);
+    void mouseDown(NSEvent *);
+    void mouseDragged(NSEvent *);
+    void mouseUp(NSEvent *);
+    void mouseMoved(NSEvent *);
+    bool keyEvent(NSEvent *);
+    bool wheelEvent(NSEvent *);
+
+    bool sendContextMenuEvent(NSEvent *);
+    bool eventMayStartDrag(NSEvent *);
 
-    void sendFakeEventsAfterWidgetTracking(NSEvent* initiatingEvent);
+    void sendFakeEventsAfterWidgetTracking(NSEvent *initiatingEvent);
 
     void setActivationEventNumber(int num) { m_activationEventNumber = num; }
 
-    NSEvent *currentNSEvent();
+    static NSEvent *currentNSEvent();
 #endif
 
 private:
@@ -201,8 +187,8 @@ private:
     PassRefPtr<Clipboard> createDraggingClipboard() const;
     
     bool eventActivatedView(const PlatformMouseEvent&) const;
-    void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& event);
-    void selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults& event);
+    void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults&);
+    void selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults&);
 
     bool handleMouseDoubleClickEvent(const PlatformMouseEvent&);
 
@@ -216,7 +202,9 @@ private:
     void handleKeyboardSelectionMovement(KeyboardEvent*);
     
     Cursor selectCursor(const MouseEventWithHitTestResults&, Scrollbar*);
+#if ENABLE(PAN_SCROLLING)
     void setPanScrollCursor();
+#endif
 
     void hoverTimerFired(Timer<EventHandler>*);
 
@@ -272,22 +260,25 @@ private:
 
     // The following are called at the beginning of handleMouseUp and handleDrag.  
     // If they return true it indicates that they have consumed the event.
-#if PLATFORM(MAC)
     bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&);
     bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&);
-    NSView *mouseDownViewIfStillGood();
-#else
-    bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&) { return false; }
-    bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&) { return false; }
-#endif
 
     bool invertSenseOfTabsToLinks(KeyboardEvent*) const;
 
     void updateSelectionForMouseDrag(Node* targetNode, const IntPoint& localPoint);
 
+    bool capturesDragging() const { return m_capturesDragging; }
+
+#if PLATFORM(MAC) && defined(__OBJC__)
+    NSView *mouseDownViewIfStillGood();
+
+    PlatformMouseEvent currentPlatformMouseEvent() const;
+#endif
+
     Frame* m_frame;
 
     bool m_mousePressed;
+    bool m_capturesDragging;
     RefPtr<Node> m_mousePressNode;
 
     bool m_mouseDownMayStartSelect;
@@ -307,6 +298,7 @@ private:
     bool m_autoscrollInProgress;
     bool m_mouseDownMayStartAutoscroll;
     bool m_mouseDownWasInSubframe;
+
 #if ENABLE(SVG)
     bool m_svgPan;
     RefPtr<SVGElementInstance> m_instanceUnderMouse;
@@ -335,16 +327,12 @@ private:
     IntPoint m_mouseDownPos; // in our view's coords
     double m_mouseDownTimestamp;
     PlatformMouseEvent m_mouseDown;
-    
-    unsigned m_pendingFrameUnloadEventCount;
-    unsigned m_pendingFrameBeforeUnloadEventCount;
 
 #if PLATFORM(MAC)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
     int m_activationEventNumber;
 #endif
-
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.cpp b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
index 9b3036236c..8dad84650d 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +35,7 @@
 #include "Element.h"
 #include "Event.h"
 #include "EventHandler.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "FrameTree.h"
@@ -45,6 +47,7 @@
 #include "RenderObject.h"
 #include "RenderWidget.h"
 #include "SelectionController.h"
+#include "Settings.h"
 #include "Widget.h"
 #include <wtf/Platform.h>
 
@@ -63,13 +66,17 @@ void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
     if (m_focusedFrame == frame)
         return;
 
-    if (m_focusedFrame && m_focusedFrame->view())
+    if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(false);
+        m_focusedFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
+    }
 
     m_focusedFrame = frame;
 
-    if (m_focusedFrame && m_focusedFrame->view())
+    if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(true);
+        m_focusedFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
+    }
 }
 
 Frame* FocusController::focusedOrMainFrame()
@@ -90,8 +97,6 @@ static Node* deepFocusableNode(FocusDirection direction, Node* node, KeyboardEve
             break;
 
         Document* document = owner->contentFrame()->document();
-        if (!document)
-            break;
 
         node = (direction == FocusDirectionForward)
             ? document->nextFocusableNode(0, event)
@@ -115,12 +120,17 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     Frame* frame = focusedOrMainFrame();
     ASSERT(frame);
     Document* document = frame->document();
-    if (!document)
-        return false;
+
+    Node* currentNode = document->focusedNode();
+    // FIXME: Not quite correct when it comes to focus transitions leaving/entering the WebView itself
+    bool caretBrowsing = focusedOrMainFrame()->settings()->caretBrowsingEnabled();
+
+    if (caretBrowsing && !currentNode)
+        currentNode = frame->selection()->start().node();
 
     Node* node = (direction == FocusDirectionForward)
-        ? document->nextFocusableNode(document->focusedNode(), event)
-        : document->previousFocusableNode(document->focusedNode(), event);
+        ? document->nextFocusableNode(currentNode, event)
+        : document->previousFocusableNode(currentNode, event);
             
     // If there's no focusable node to advance to, move up the frame tree until we find one.
     while (!node && frame) {
@@ -129,8 +139,6 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
             break;
 
         Document* parentDocument = parentFrame->document();
-        if (!parentDocument)
-            break;
 
         HTMLFrameOwnerElement* owner = frame->ownerElement();
         if (!owner)
@@ -155,10 +163,10 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
         }
 
         // Chrome doesn't want focus, so we should wrap focus.
-        if (Document* d = m_page->mainFrame()->document())
-            node = (direction == FocusDirectionForward)
-                ? d->nextFocusableNode(0, event)
-                : d->previousFocusableNode(0, event);
+        Document* d = m_page->mainFrame()->document();
+        node = (direction == FocusDirectionForward)
+            ? d->nextFocusableNode(0, event)
+            : d->previousFocusableNode(0, event);
 
         node = deepFocusableNode(direction, node, event);
 
@@ -201,6 +209,12 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     if (newDocument)
         setFocusedFrame(newDocument->frame());
 
+    if (caretBrowsing) {
+        VisibleSelection newSelection(Position(node, 0), Position(node, 0), DOWNSTREAM);
+        if (frame->shouldChangeSelection(newSelection))
+            frame->selection()->setSelection(newSelection);
+    }
+
     static_cast<Element*>(node)->focus(false);
     return true;
 }
@@ -229,7 +243,11 @@ static void clearSelectionIfNeeded(Frame* oldFocusedFrame, Frame* newFocusedFram
     SelectionController* s = oldFocusedFrame->selection();
     if (s->isNone())
         return;
-    
+
+    bool caretBrowsing = oldFocusedFrame->settings()->caretBrowsingEnabled();
+    if (caretBrowsing)
+        return;
+
     Node* selectionStartNode = s->selection().start().node();
     if (selectionStartNode == newFocusedNode || selectionStartNode->isDescendantOf(newFocusedNode) || selectionStartNode->shadowAncestorNode() == newFocusedNode)
         return;
@@ -254,7 +272,8 @@ bool FocusController::setFocusedNode(Node* node, PassRefPtr<Frame> newFocusedFra
     Node* oldFocusedNode = oldDocument ? oldDocument->focusedNode() : 0;
     if (oldFocusedNode == node)
         return true;
-        
+
+    // FIXME: Might want to disable this check for caretBrowsing
     if (oldFocusedNode && oldFocusedNode->rootEditableElement() == oldFocusedNode && !relinquishesEditingFocus(oldFocusedNode))
         return false;
         
@@ -266,9 +285,9 @@ bool FocusController::setFocusedNode(Node* node, PassRefPtr<Frame> newFocusedFra
         m_page->editorClient()->setInputMethodState(false);
         return true;
     }
-    
-    RefPtr<Document> newDocument = node ? node->document() : 0;
-    
+
+    RefPtr<Document> newDocument = node->document();
+
     if (newDocument && newDocument->focusedNode() == node) {
         m_page->editorClient()->setInputMethodState(node->shouldUseInputMethod());
         return true;
@@ -302,6 +321,9 @@ void FocusController::setActive(bool active)
     }
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
+    
+    if (m_focusedFrame)
+        m_focusedFrame->document()->dispatchWindowEvent(active ? eventNames().focusEvent : eventNames().blurEvent, false, false);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index a4c0b57812..328f321c81 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -5,7 +5,7 @@
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
@@ -28,11 +28,11 @@
 
 #include "config.h"
 #include "Frame.h"
-#include "FramePrivate.h"
 
 #include "ApplyStyleCommand.h"
 #include "BeforeUnloadEvent.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CachedCSSStyleSheet.h"
@@ -43,7 +43,9 @@
 #include "EditorClient.h"
 #include "EventNames.h"
 #include "FocusController.h"
+#include "FloatQuad.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLDocument.h"
@@ -53,7 +55,6 @@
 #include "HTMLNames.h"
 #include "HTMLTableCellElement.h"
 #include "HitTestResult.h"
-#include "JSDOMWindowShell.h"
 #include "Logging.h"
 #include "markup.h"
 #include "MediaFeatureNames.h"
@@ -67,17 +68,21 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
-#include "SystemTime.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
 #include "XMLNames.h"
 #include "ScriptController.h"
+#include "htmlediting.h"
 #include "npruntime_impl.h"
-#include "runtime_root.h"
 #include "visible_units.h"
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
 
+#if USE(JSC)
+#include "JSDOMWindowShell.h"
+#include "runtime_root.h"
+#endif
+
 #if FRAME_LOADS_USER_STYLESHEET
 #include "UserStyleSheetLoader.h"
 #endif
@@ -111,8 +116,32 @@ static inline Frame* parentFromOwnerElement(HTMLFrameOwnerElement* ownerElement)
 }
 
 Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient* frameLoaderClient) 
-    : d(new FramePrivate(page, parentFromOwnerElement(ownerElement), this, ownerElement, frameLoaderClient))
+    : m_page(page)
+    , m_treeNode(this, parentFromOwnerElement(ownerElement))
+    , m_loader(this, frameLoaderClient)
+    , m_ownerElement(ownerElement)
+    , m_script(this)
+    , m_selectionGranularity(CharacterGranularity)
+    , m_selectionController(this)
+    , m_caretBlinkTimer(this, &Frame::caretBlinkTimerFired)
+    , m_editor(this)
+    , m_eventHandler(this)
+    , m_animationController(this)
+    , m_lifeSupportTimer(this, &Frame::lifeSupportTimerFired)
+    , m_caretVisible(false)
+    , m_caretPaint(true)
+    , m_highlightTextMatches(false)
+    , m_inViewSourceMode(false)
+    , m_needsReapplyStyles(false)
+    , m_isDisconnected(false)
+    , m_excludeFromTextSearch(false)
+#if FRAME_LOADS_USER_STYLESHEET
+    , m_userStyleSheetLoader(0)
+#endif
 {
+    Frame* parent = parentFromOwnerElement(ownerElement);
+    m_zoomFactor = parent ? parent->m_zoomFactor : 1.0f;
+
     AtomicString::init();
     HTMLNames::init();
     QualifiedName::init();
@@ -146,73 +175,66 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
 Frame::~Frame()
 {
     setView(0);
-    loader()->clearRecordedFormValues();
     loader()->cancelAndClear();
     
     // FIXME: We should not be doing all this work inside the destructor
 
-    ASSERT(!d->m_lifeSupportTimer.isActive());
+    ASSERT(!m_lifeSupportTimer.isActive());
 
 #ifndef NDEBUG
     frameCounter.decrement();
 #endif
 
-    if (d->m_script.haveWindowShell())
-        d->m_script.windowShell()->disconnectFrame();
-
     disconnectOwnerElement();
     
-    if (d->m_domWindow)
-        d->m_domWindow->disconnectFrame();
+    if (m_domWindow)
+        m_domWindow->disconnectFrame();
 
-    HashSet<DOMWindow*>::iterator end = d->m_liveFormerWindows.end();
-    for (HashSet<DOMWindow*>::iterator it = d->m_liveFormerWindows.begin(); it != end; ++it)
+    HashSet<DOMWindow*>::iterator end = m_liveFormerWindows.end();
+    for (HashSet<DOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
         (*it)->disconnectFrame();
             
-    if (d->m_view) {
-        d->m_view->hide();
-        d->m_view->clearFrame();
+    if (m_view) {
+        m_view->hide();
+        m_view->clearFrame();
     }
 
-    ASSERT(!d->m_lifeSupportTimer.isActive());
+    ASSERT(!m_lifeSupportTimer.isActive());
 
 #if FRAME_LOADS_USER_STYLESHEET
-    delete d->m_userStyleSheetLoader;
+    delete m_userStyleSheetLoader;
 #endif
-
-    delete d;
-    d = 0;
 }
 
 void Frame::init()
 {
-    d->m_loader.init();
+    m_loader.init();
 }
 
 FrameLoader* Frame::loader() const
 {
-    return &d->m_loader;
+    return &m_loader;
 }
 
 FrameView* Frame::view() const
 {
-    return d->m_view.get();
+    return m_view.get();
 }
 
-void Frame::setView(FrameView* view)
+void Frame::setView(PassRefPtr<FrameView> view)
 {
     // Detach the document now, so any onUnload handlers get run - if
     // we wait until the view is destroyed, then things won't be
     // hooked up enough for some JavaScript calls to work.
-    if (!view && d->m_doc && d->m_doc->attached() && !d->m_doc->inPageCache()) {
+    if (!view && m_doc && m_doc->attached() && !m_doc->inPageCache()) {
         // FIXME: We don't call willRemove here. Why is that OK?
-        d->m_doc->detach();
-        if (d->m_view)
-            d->m_view->unscheduleRelayout();
+        m_doc->detach();
+        if (m_view)
+            m_view->unscheduleRelayout();
     }
     eventHandler()->clear();
 
-    d->m_view = view;
+    m_view = view;
 
     // Only one form submission is allowed per view of a part.
     // Since this part may be getting reused as a result of being
@@ -222,40 +244,40 @@ void Frame::setView(FrameView* view)
 
 ScriptController* Frame::script()
 {
-    return &d->m_script;
+    return &m_script;
 }
 
 Document* Frame::document() const
 {
-    return d->m_doc.get();
+    return m_doc.get();
 }
 
 void Frame::setDocument(PassRefPtr<Document> newDoc)
 {
-    if (d->m_doc && d->m_doc->attached() && !d->m_doc->inPageCache()) {
+    if (m_doc && m_doc->attached() && !m_doc->inPageCache()) {
         // FIXME: We don't call willRemove here. Why is that OK?
-        d->m_doc->detach();
+        m_doc->detach();
     }
 
-    d->m_doc = newDoc;
-    if (d->m_doc && selection()->isFocusedAndActive())
-        setUseSecureKeyboardEntry(d->m_doc->useSecureKeyboardEntryWhenActive());
+    m_doc = newDoc;
+    if (m_doc && selection()->isFocusedAndActive())
+        setUseSecureKeyboardEntry(m_doc->useSecureKeyboardEntryWhenActive());
         
-    if (d->m_doc && !d->m_doc->attached())
-        d->m_doc->attach();
+    if (m_doc && !m_doc->attached())
+        m_doc->attach();
 
     // Update the cached 'document' property, which is now stale.
-    d->m_script.updateDocument();
+    m_script.updateDocument();
 }
 
 Settings* Frame::settings() const
 {
-    return d->m_page ? d->m_page->settings() : 0;
+    return m_page ? m_page->settings() : 0;
 }
 
 String Frame::selectedText() const
 {
-    return plainText(selection()->toRange().get());
+    return plainText(selection()->toNormalizedRange().get());
 }
 
 IntRect Frame::firstRectForRange(Range* range) const
@@ -300,33 +322,33 @@ IntRect Frame::firstRectForRange(Range* range) const
 
 SelectionController* Frame::selection() const
 {
-    return &d->m_selectionController;
+    return &m_selectionController;
 }
 
 Editor* Frame::editor() const
 {
-    return &d->m_editor;
+    return &m_editor;
 }
 
 TextGranularity Frame::selectionGranularity() const
 {
-    return d->m_selectionGranularity;
+    return m_selectionGranularity;
 }
 
-void Frame::setSelectionGranularity(TextGranularity granularity) const
+void Frame::setSelectionGranularity(TextGranularity granularity)
 {
-    d->m_selectionGranularity = granularity;
+    m_selectionGranularity = granularity;
 }
 
 SelectionController* Frame::dragCaretController() const
 {
-    return d->m_page->dragCaretController();
+    return m_page->dragCaretController();
 }
 
 
 AnimationController* Frame::animation() const
 {
-    return &d->m_animationController;
+    return &m_animationController;
 }
 
 static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
@@ -334,7 +356,7 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
     // REVIEW- version of this call in FrameMac.mm caches based on the NSArray ptrs being
     // the same across calls.  We can't do that.
 
-    DEFINE_STATIC_LOCAL(RegularExpression, wordRegExp, ("\\w"));
+    DEFINE_STATIC_LOCAL(RegularExpression, wordRegExp, ("\\w", TextCaseSensitive));
     String pattern("(");
     unsigned int numLabels = labels.size();
     unsigned int i;
@@ -344,8 +366,8 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
         bool startsWithWordChar = false;
         bool endsWithWordChar = false;
         if (label.length() != 0) {
-            startsWithWordChar = wordRegExp.search(label.substring(0, 1)) >= 0;
-            endsWithWordChar = wordRegExp.search(label.substring(label.length() - 1, 1)) >= 0;
+            startsWithWordChar = wordRegExp.match(label.substring(0, 1)) >= 0;
+            endsWithWordChar = wordRegExp.match(label.substring(label.length() - 1, 1)) >= 0;
         }
         
         if (i != 0)
@@ -362,7 +384,7 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
         }
     }
     pattern.append(")");
-    return new RegularExpression(pattern, false);
+    return new RegularExpression(pattern, TextCaseInsensitive);
 }
 
 String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellElement* cell)
@@ -374,7 +396,7 @@ String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellE
 
         if (cellAboveRenderer) {
             HTMLTableCellElement* aboveCell =
-                static_cast<HTMLTableCellElement*>(cellAboveRenderer->element());
+                static_cast<HTMLTableCellElement*>(cellAboveRenderer->node());
 
             if (aboveCell) {
                 // search within the above cell we found for a match
@@ -414,8 +436,7 @@ String Frame::searchForLabelsBeforeElement(const Vector<String>& labels, Element
          n = n->traversePreviousNode())
     {
         if (n->hasTagName(formTag)
-            || (n->isHTMLElement()
-                && static_cast<HTMLElement*>(n)->isGenericFormElement()))
+            || (n->isHTMLElement() && static_cast<Element*>(n)->isFormControlElement()))
         {
             // We hit another form element or the start of the form - bail out
             break;
@@ -454,7 +475,7 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
         return String();
 
     // Make numbers and _'s in field names behave like word boundaries, e.g., "address2"
-    replace(name, RegularExpression("\\d"), " ");
+    replace(name, RegularExpression("\\d", TextCaseSensitive), " ");
     name.replace('_', ' ');
     
     OwnPtr<RegularExpression> regExp(createRegExpForLabels(labels));
@@ -465,7 +486,7 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
     int bestLength = -1;
     int start = 0;
     do {
-        pos = regExp->search(name, start);
+        pos = regExp->match(name, start);
         if (pos != -1) {
             length = regExp->matchedLength();
             if (length >= bestLength) {
@@ -481,19 +502,19 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
     return String();
 }
 
-const Selection& Frame::mark() const
+const VisibleSelection& Frame::mark() const
 {
-    return d->m_mark;
+    return m_mark;
 }
 
-void Frame::setMark(const Selection& s)
+void Frame::setMark(const VisibleSelection& s)
 {
     ASSERT(!s.base().node() || s.base().node()->document() == document());
     ASSERT(!s.extent().node() || s.extent().node()->document() == document());
     ASSERT(!s.start().node() || s.start().node()->document() == document());
     ASSERT(!s.end().node() || s.end().node()->document() == document());
 
-    d->m_mark = s;
+    m_mark = s;
 }
 
 void Frame::notifyRendererOfSelectionChange(bool userTriggered)
@@ -503,8 +524,8 @@ void Frame::notifyRendererOfSelectionChange(bool userTriggered)
         renderer = selection()->rootEditableElement()->shadowAncestorNode()->renderer();
 
     // If the current selection is in a textfield or textarea, notify the renderer that the selection has changed
-    if (renderer && (renderer->isTextArea() || renderer->isTextField()))
-        static_cast<RenderTextControl*>(renderer)->selectionChanged(userTriggered);
+    if (renderer && renderer->isTextControl())
+        toRenderTextControl(renderer)->selectionChanged(userTriggered);
 }
 
 void Frame::invalidateSelection()
@@ -515,18 +536,18 @@ void Frame::invalidateSelection()
 
 void Frame::setCaretVisible(bool flag)
 {
-    if (d->m_caretVisible == flag)
+    if (m_caretVisible == flag)
         return;
     clearCaretRectIfNeeded();
-    d->m_caretVisible = flag;
+    m_caretVisible = flag;
     selectionLayoutChanged();
 }
 
 void Frame::clearCaretRectIfNeeded()
 {
 #if ENABLE(TEXT_CARET)
-    if (d->m_caretPaint) {
-        d->m_caretPaint = false;
+    if (m_caretPaint) {
+        m_caretPaint = false;
         selection()->invalidateCaretRect();
     }
 #endif
@@ -547,9 +568,18 @@ static bool isFrameElement(const Node *n)
 
 void Frame::setFocusedNodeIfNeeded()
 {
-    if (!document() || selection()->isNone() || !selection()->isFocusedAndActive())
+    if (selection()->isNone() || !selection()->isFocused())
         return;
 
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+    if (caretBrowsing) {
+        Node* anchor = enclosingAnchorElement(selection()->base());
+        if (anchor) {
+            page()->focusController()->setFocusedNode(anchor, this);
+            return;
+        }
+    }
+
     Node* target = selection()->rootEditableElement();
     if (target) {
         RenderObject* renderer = target->renderer();
@@ -566,10 +596,13 @@ void Frame::setFocusedNodeIfNeeded()
             }
             renderer = renderer->parent();
             if (renderer)
-                target = renderer->element();
+                target = renderer->node();
         }
         document()->setFocusedNode(0);
     }
+
+    if (caretBrowsing)
+        page()->focusController()->setFocusedNode(0, this);
 }
 
 void Frame::selectionLayoutChanged()
@@ -577,22 +610,23 @@ void Frame::selectionLayoutChanged()
     bool caretRectChanged = selection()->recomputeCaretRect();
 
 #if ENABLE(TEXT_CARET)
-    bool shouldBlink = d->m_caretVisible
-        && selection()->isCaret() && selection()->isContentEditable();
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+    bool shouldBlink = m_caretVisible
+        && selection()->isCaret() && (selection()->isContentEditable() || caretBrowsing);
 
     // If the caret moved, stop the blink timer so we can restart with a
     // black caret in the new location.
     if (caretRectChanged || !shouldBlink)
-        d->m_caretBlinkTimer.stop();
+        m_caretBlinkTimer.stop();
 
     // Start blinking with a black caret. Be sure not to restart if we're
     // already blinking in the right location.
-    if (shouldBlink && !d->m_caretBlinkTimer.isActive()) {
+    if (shouldBlink && !m_caretBlinkTimer.isActive()) {
         if (double blinkInterval = theme()->caretBlinkInterval())
-            d->m_caretBlinkTimer.startRepeating(blinkInterval);
+            m_caretBlinkTimer.startRepeating(blinkInterval);
 
-        if (!d->m_caretPaint) {
-            d->m_caretPaint = true;
+        if (!m_caretPaint) {
+            m_caretPaint = true;
             selection()->invalidateCaretRect();
         }
     }
@@ -605,7 +639,7 @@ void Frame::selectionLayoutChanged()
     if (!view)
         return;
 
-    Selection selection = this->selection()->selection();
+    VisibleSelection selection = this->selection()->selection();
         
     if (!selection.isRange())
         view->clearSelection();
@@ -626,7 +660,7 @@ void Frame::selectionLayoutChanged()
         if (startPos.isNotNull() && endPos.isNotNull() && selection.visibleStart() != selection.visibleEnd()) {
             RenderObject *startRenderer = startPos.node()->renderer();
             RenderObject *endRenderer = endPos.node()->renderer();
-            view->setSelection(startRenderer, startPos.offset(), endRenderer, endPos.offset());
+            view->setSelection(startRenderer, startPos.deprecatedEditingOffset(), endRenderer, endPos.deprecatedEditingOffset());
         }
     }
 }
@@ -634,12 +668,12 @@ void Frame::selectionLayoutChanged()
 void Frame::caretBlinkTimerFired(Timer<Frame>*)
 {
 #if ENABLE(TEXT_CARET)
-    ASSERT(d->m_caretVisible);
+    ASSERT(m_caretVisible);
     ASSERT(selection()->isCaret());
-    bool caretPaint = d->m_caretPaint;
+    bool caretPaint = m_caretPaint;
     if (selection()->isCaretBlinkingSuspended() && caretPaint)
         return;
-    d->m_caretPaint = !caretPaint;
+    m_caretPaint = !caretPaint;
     selection()->invalidateCaretRect();
 #endif
 }
@@ -647,7 +681,7 @@ void Frame::caretBlinkTimerFired(Timer<Frame>*)
 void Frame::paintCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect) const
 {
 #if ENABLE(TEXT_CARET)
-    if (d->m_caretPaint && d->m_caretVisible)
+    if (m_caretPaint && m_caretVisible)
         selection()->paintCaret(p, tx, ty, clipRect);
 #endif
 }
@@ -655,7 +689,7 @@ void Frame::paintCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRe
 void Frame::paintDragCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect) const
 {
 #if ENABLE(TEXT_CARET)
-    SelectionController* dragCaretController = d->m_page->dragCaretController();
+    SelectionController* dragCaretController = m_page->dragCaretController();
     ASSERT(dragCaretController->selection().isCaret());
     if (dragCaretController->selection().start().node()->document()->frame() == this)
         dragCaretController->paintCaret(p, tx, ty, clipRect);
@@ -664,20 +698,20 @@ void Frame::paintDragCaret(GraphicsContext* p, int tx, int ty, const IntRect& cl
 
 float Frame::zoomFactor() const
 {
-    return d->m_zoomFactor;
+    return m_zoomFactor;
 }
 
 bool Frame::isZoomFactorTextOnly() const
 {
-    return d->m_page->settings()->zoomsTextOnly();
+    return m_page->settings()->zoomsTextOnly();
 }
 
 bool Frame::shouldApplyTextZoom() const
 {
-    if (d->m_zoomFactor == 1.0f || !isZoomFactorTextOnly())
+    if (m_zoomFactor == 1.0f || !isZoomFactorTextOnly())
         return false;
 #if ENABLE(SVG)
-    if (d->m_doc && d->m_doc->isSVGDocument())
+    if (m_doc->isSVGDocument())
         return false;
 #endif
     return true;
@@ -685,10 +719,10 @@ bool Frame::shouldApplyTextZoom() const
 
 bool Frame::shouldApplyPageZoom() const
 {
-    if (d->m_zoomFactor == 1.0f || isZoomFactorTextOnly())
+    if (m_zoomFactor == 1.0f || isZoomFactorTextOnly())
         return false;
 #if ENABLE(SVG)
-    if (d->m_doc && d->m_doc->isSVGDocument())
+    if (m_doc->isSVGDocument())
         return false;
 #endif
     return true;
@@ -696,45 +730,41 @@ bool Frame::shouldApplyPageZoom() const
 
 void Frame::setZoomFactor(float percent, bool isTextOnly)
 {  
-    if (d->m_zoomFactor == percent && isZoomFactorTextOnly())
+    if (m_zoomFactor == percent && isZoomFactorTextOnly() == isTextOnly)
         return;
 
 #if ENABLE(SVG)
     // SVG doesn't care if the zoom factor is text only.  It will always apply a 
     // zoom to the whole SVG.
-    if (d->m_doc && d->m_doc->isSVGDocument()) {
-        if (!static_cast<SVGDocument*>(d->m_doc.get())->zoomAndPanEnabled())
+    if (m_doc->isSVGDocument()) {
+        if (!static_cast<SVGDocument*>(m_doc.get())->zoomAndPanEnabled())
             return;
-        d->m_zoomFactor = percent;
-        d->m_page->settings()->setZoomsTextOnly(true); // We do this to avoid doing any scaling of CSS pixels, since the SVG has its own notion of zoom.
-        if (d->m_doc->renderer())
-            d->m_doc->renderer()->repaint();
+        m_zoomFactor = percent;
+        m_page->settings()->setZoomsTextOnly(true); // We do this to avoid doing any scaling of CSS pixels, since the SVG has its own notion of zoom.
+        if (m_doc->renderer())
+            m_doc->renderer()->repaint();
         return;
     }
 #endif
 
-    d->m_zoomFactor = percent;
-    d->m_page->settings()->setZoomsTextOnly(isTextOnly);
+    m_zoomFactor = percent;
+    m_page->settings()->setZoomsTextOnly(isTextOnly);
 
-    if (d->m_doc)
-        d->m_doc->recalcStyle(Node::Force);
+    m_doc->recalcStyle(Node::Force);
 
     for (Frame* child = tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->setZoomFactor(d->m_zoomFactor, isTextOnly);
+        child->setZoomFactor(m_zoomFactor, isTextOnly);
 
-    if (d->m_doc && d->m_doc->renderer() && d->m_doc->renderer()->needsLayout() && view()->didFirstLayout())
+    if (m_doc->renderer() && m_doc->renderer()->needsLayout() && view()->didFirstLayout())
         view()->layout();
 }
 
 void Frame::setPrinting(bool printing, float minPageWidth, float maxPageWidth, bool adjustViewSize)
 {
-    if (!d->m_doc)
-        return;
-
-    d->m_doc->setPrinting(printing);
+    m_doc->setPrinting(printing);
     view()->setMediaType(printing ? "print" : "screen");
-    d->m_doc->updateStyleSelector();
-    forceLayoutWithPageWidthRange(minPageWidth, maxPageWidth, adjustViewSize);
+    m_doc->updateStyleSelector();
+    view()->forceLayoutWithPageWidthRange(minPageWidth, maxPageWidth, adjustViewSize);
 
     for (Frame* child = tree()->firstChild(); child; child = child->tree()->nextSibling())
         child->setPrinting(printing, minPageWidth, maxPageWidth, adjustViewSize);
@@ -742,34 +772,42 @@ void Frame::setPrinting(bool printing, float minPageWidth, float maxPageWidth, b
 
 void Frame::setJSStatusBarText(const String& text)
 {
-    d->m_kjsStatusBarText = text;
-    if (d->m_page)
-        d->m_page->chrome()->setStatusbarText(this, d->m_kjsStatusBarText);
+    ASSERT(m_doc); // Client calls shouldn't be made when the frame is in inconsistent state.
+    m_kjsStatusBarText = text;
+    if (m_page)
+        m_page->chrome()->setStatusbarText(this, m_kjsStatusBarText);
 }
 
 void Frame::setJSDefaultStatusBarText(const String& text)
 {
-    d->m_kjsDefaultStatusBarText = text;
-    if (d->m_page)
-        d->m_page->chrome()->setStatusbarText(this, d->m_kjsDefaultStatusBarText);
+    ASSERT(m_doc); // Client calls shouldn't be made when the frame is in inconsistent state.
+    m_kjsDefaultStatusBarText = text;
+    if (m_page)
+        m_page->chrome()->setStatusbarText(this, m_kjsDefaultStatusBarText);
 }
 
 String Frame::jsStatusBarText() const
 {
-    return d->m_kjsStatusBarText;
+    return m_kjsStatusBarText;
 }
 
 String Frame::jsDefaultStatusBarText() const
 {
-   return d->m_kjsDefaultStatusBarText;
+   return m_kjsDefaultStatusBarText;
 }
 
 void Frame::setNeedsReapplyStyles()
 {
-    if (d->m_needsReapplyStyles)
+    // When the frame is not showing web content, it doesn't make sense to apply styles.
+    // If we tried, we'd end up doing things with the document, but the document, if one
+    // exists, is not currently shown and should be in the page cache.
+    if (!m_loader.client()->hasHTMLView())
         return;
 
-    d->m_needsReapplyStyles = true;
+    if (m_needsReapplyStyles)
+        return;
+
+    m_needsReapplyStyles = true;
 
     // FrameView's "layout" timer includes reapplyStyles, so despite its
     // name, it's what we want to call here.
@@ -779,21 +817,19 @@ void Frame::setNeedsReapplyStyles()
 
 bool Frame::needsReapplyStyles() const
 {
-    return d->m_needsReapplyStyles;
+    return m_needsReapplyStyles;
 }
 
 void Frame::reapplyStyles()
 {
-    d->m_needsReapplyStyles = false;
+    m_needsReapplyStyles = false;
 
-    // FIXME: This call doesn't really make sense in a method called
-    // "reapplyStyles". We should probably eventually move it into its own
-    // method.
-    if (d->m_doc)
-        d->m_doc->docLoader()->setAutoLoadImages(d->m_page && d->m_page->settings()->loadsImagesAutomatically());
+    // FIXME: This call doesn't really make sense in a function called reapplyStyles.
+    // We should probably eventually move it into its own function.
+    m_doc->docLoader()->setAutoLoadImages(m_page && m_page->settings()->loadsImagesAutomatically());
         
 #if FRAME_LOADS_USER_STYLESHEET
-    const KURL userStyleSheetLocation = d->m_page ? d->m_page->settings()->userStyleSheetLocation() : KURL();
+    const KURL userStyleSheetLocation = m_page ? m_page->settings()->userStyleSheetLocation() : KURL();
     if (!userStyleSheetLocation.isEmpty())
         setUserStyleSheetLocation(userStyleSheetLocation);
     else
@@ -804,33 +840,30 @@ void Frame::reapplyStyles()
     // The document automatically does this as required when you set the style sheet.
     // But we had problems when this code was removed. Details are in
     // <http://bugs.webkit.org/show_bug.cgi?id=8079>.
-    if (d->m_doc)
-        d->m_doc->updateStyleSelector();
+    m_doc->updateStyleSelector();
 }
 
-bool Frame::shouldChangeSelection(const Selection& newSelection) const
+bool Frame::shouldChangeSelection(const VisibleSelection& newSelection) const
 {
     return shouldChangeSelection(selection()->selection(), newSelection, newSelection.affinity(), false);
 }
 
-bool Frame::shouldChangeSelection(const Selection& oldSelection, const Selection& newSelection, EAffinity affinity, bool stillSelecting) const
+bool Frame::shouldChangeSelection(const VisibleSelection& oldSelection, const VisibleSelection& newSelection, EAffinity affinity, bool stillSelecting) const
 {
-    return editor()->client()->shouldChangeSelectedRange(oldSelection.toRange().get(), newSelection.toRange().get(),
+    return editor()->client()->shouldChangeSelectedRange(oldSelection.toNormalizedRange().get(), newSelection.toNormalizedRange().get(),
                                                          affinity, stillSelecting);
 }
 
-bool Frame::shouldDeleteSelection(const Selection& selection) const
+bool Frame::shouldDeleteSelection(const VisibleSelection& selection) const
 {
-    return editor()->client()->shouldDeleteRange(selection.toRange().get());
+    return editor()->client()->shouldDeleteRange(selection.toNormalizedRange().get());
 }
 
 bool Frame::isContentEditable() const 
 {
-    if (d->m_editor.clientIsEditable())
+    if (m_editor.clientIsEditable())
         return true;
-    if (!d->m_doc)
-        return false;
-    return d->m_doc->inDesignMode();
+    return m_doc->inDesignMode();
 }
 
 #if !PLATFORM(MAC)
@@ -844,22 +877,22 @@ void Frame::setUseSecureKeyboardEntry(bool)
 void Frame::updateSecureKeyboardEntryIfActive()
 {
     if (selection()->isFocusedAndActive())
-        setUseSecureKeyboardEntry(d->m_doc->useSecureKeyboardEntryWhenActive());
+        setUseSecureKeyboardEntry(m_doc->useSecureKeyboardEntryWhenActive());
 }
 
 CSSMutableStyleDeclaration *Frame::typingStyle() const
 {
-    return d->m_typingStyle.get();
+    return m_typingStyle.get();
 }
 
 void Frame::setTypingStyle(CSSMutableStyleDeclaration *style)
 {
-    d->m_typingStyle = style;
+    m_typingStyle = style;
 }
 
 void Frame::clearTypingStyle()
 {
-    d->m_typingStyle = 0;
+    m_typingStyle = 0;
 }
 
 void Frame::computeAndSetTypingStyle(CSSStyleDeclaration *style, EditAction editingAction)
@@ -898,11 +931,11 @@ void Frame::computeAndSetTypingStyle(CSSStyleDeclaration *style, EditAction edit
     // Handle block styles, substracting these from the typing style.
     RefPtr<CSSMutableStyleDeclaration> blockStyle = mutableStyle->copyBlockProperties();
     blockStyle->diff(mutableStyle.get());
-    if (document() && blockStyle->length() > 0)
+    if (blockStyle->length() > 0)
         applyCommand(ApplyStyleCommand::create(document(), blockStyle.get(), editingAction));
     
     // Set the remaining style as the typing style.
-    d->m_typingStyle = mutableStyle.release();
+    m_typingStyle = mutableStyle.release();
 }
 
 String Frame::selectionStartStylePropertyValue(int stylePropertyID) const
@@ -927,13 +960,10 @@ PassRefPtr<CSSComputedStyleDeclaration> Frame::selectionComputedStyle(Node*& nod
 {
     nodeToRemove = 0;
 
-    if (!document())
-        return 0;
-
     if (selection()->isNone())
         return 0;
 
-    RefPtr<Range> range(selection()->toRange());
+    RefPtr<Range> range(selection()->toNormalizedRange());
     Position pos = range->editingStartPosition();
 
     Element *elem = pos.element();
@@ -943,11 +973,10 @@ PassRefPtr<CSSComputedStyleDeclaration> Frame::selectionComputedStyle(Node*& nod
     RefPtr<Element> styleElement = elem;
     ExceptionCode ec = 0;
 
-    if (d->m_typingStyle) {
-        styleElement = document()->createElementNS(xhtmlNamespaceURI, "span", ec);
-        ASSERT(ec == 0);
+    if (m_typingStyle) {
+        styleElement = document()->createElement(spanTag, false);
 
-        styleElement->setAttribute(styleAttr, d->m_typingStyle->cssText().impl(), ec);
+        styleElement->setAttribute(styleAttr, m_typingStyle->cssText().impl(), ec);
         ASSERT(ec == 0);
         
         styleElement->appendChild(document()->createEditingTextNode(""), ec);
@@ -1013,10 +1042,7 @@ void Frame::textDidChangeInTextArea(Element* e)
 
 void Frame::applyEditingStyleToBodyElement() const
 {
-    if (!d->m_doc)
-        return;
-        
-    RefPtr<NodeList> list = d->m_doc->getElementsByTagName("body");
+    RefPtr<NodeList> list = m_doc->getElementsByTagName("body");
     unsigned len = list->length();
     for (unsigned i = 0; i < len; i++) {
         applyEditingStyleToElement(static_cast<Element*>(list->item(i)));    
@@ -1025,10 +1051,7 @@ void Frame::applyEditingStyleToBodyElement() const
 
 void Frame::removeEditingStyleFromBodyElement() const
 {
-    if (!d->m_doc)
-        return;
-        
-    RefPtr<NodeList> list = d->m_doc->getElementsByTagName("body");
+    RefPtr<NodeList> list = m_doc->getElementsByTagName("body");
     unsigned len = list->length();
     for (unsigned i = 0; i < len; i++) {
         removeEditingStyleFromElement(static_cast<Element*>(list->item(i)));    
@@ -1066,13 +1089,13 @@ static HashSet<Frame*>& keepAliveSet()
 
 void Frame::keepAlive()
 {
-    if (d->m_lifeSupportTimer.isActive())
+    if (m_lifeSupportTimer.isActive())
         return;
 #ifndef NDEBUG
     keepAliveSet().add(this);
 #endif
     ref();
-    d->m_lifeSupportTimer.startOneShot(0);
+    m_lifeSupportTimer.startOneShot(0);
 }
 
 #ifndef NDEBUG
@@ -1081,7 +1104,7 @@ void Frame::cancelAllKeepAlive()
     HashSet<Frame*>::iterator end = keepAliveSet().end();
     for (HashSet<Frame*>::iterator it = keepAliveSet().begin(); it != end; ++it) {
         Frame* frame = *it;
-        frame->d->m_lifeSupportTimer.stop();
+        frame->m_lifeSupportTimer.stop();
         frame->deref();
     }
     keepAliveSet().clear();
@@ -1098,11 +1121,11 @@ void Frame::lifeSupportTimerFired(Timer<Frame>*)
 
 void Frame::clearDOMWindow()
 {
-    if (d->m_domWindow) {
-        d->m_liveFormerWindows.add(d->m_domWindow.get());
-        d->m_domWindow->clear();
+    if (m_domWindow) {
+        m_liveFormerWindows.add(m_domWindow.get());
+        m_domWindow->clear();
     }
-    d->m_domWindow = 0;
+    m_domWindow = 0;
 }
 
 RenderView* Frame::contentRenderer() const
@@ -1114,17 +1137,17 @@ RenderView* Frame::contentRenderer() const
     if (!object)
         return 0;
     ASSERT(object->isRenderView());
-    return static_cast<RenderView*>(object);
+    return toRenderView(object);
 }
 
 HTMLFrameOwnerElement* Frame::ownerElement() const
 {
-    return d->m_ownerElement;
+    return m_ownerElement;
 }
 
 RenderPart* Frame::ownerRenderer() const
 {
-    HTMLFrameOwnerElement* ownerElement = d->m_ownerElement;
+    HTMLFrameOwnerElement* ownerElement = m_ownerElement;
     if (!ownerElement)
         return 0;
     RenderObject* object = ownerElement->renderer();
@@ -1132,7 +1155,7 @@ RenderPart* Frame::ownerRenderer() const
         return 0;
     // FIXME: If <object> is ever fixed to disassociate itself from frames
     // that it has started but canceled, then this can turn into an ASSERT
-    // since d->m_ownerElement would be 0 when the load is canceled.
+    // since m_ownerElement would be 0 when the load is canceled.
     // https://bugs.webkit.org/show_bug.cgi?id=18585
     if (!object->isRenderPart())
         return 0;
@@ -1141,29 +1164,29 @@ RenderPart* Frame::ownerRenderer() const
 
 bool Frame::isDisconnected() const
 {
-    return d->m_isDisconnected;
+    return m_isDisconnected;
 }
 
 void Frame::setIsDisconnected(bool isDisconnected)
 {
-    d->m_isDisconnected = isDisconnected;
+    m_isDisconnected = isDisconnected;
 }
 
 bool Frame::excludeFromTextSearch() const
 {
-    return d->m_excludeFromTextSearch;
+    return m_excludeFromTextSearch;
 }
 
 void Frame::setExcludeFromTextSearch(bool exclude)
 {
-    d->m_excludeFromTextSearch = exclude;
+    m_excludeFromTextSearch = exclude;
 }
 
 // returns FloatRect because going through IntRect would truncate any floats
 FloatRect Frame::selectionBounds(bool clipToVisibleContent) const
 {
     RenderView* root = contentRenderer();
-    FrameView* view = d->m_view.get();
+    FrameView* view = m_view.get();
     if (!root || !view)
         return IntRect();
     
@@ -1177,13 +1200,13 @@ void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleConte
     if (!root)
         return;
 
-    RefPtr<Range> selectedRange = selection()->toRange();
+    RefPtr<Range> selectedRange = selection()->toNormalizedRange();
 
     Vector<IntRect> intRects;
-    selectedRange->addLineBoxRects(intRects, true);
+    selectedRange->textRects(intRects, true);
 
     unsigned size = intRects.size();
-    FloatRect visibleContentRect = d->m_view->visibleContentRect();
+    FloatRect visibleContentRect = m_view->visibleContentRect();
     for (unsigned i = 0; i < size; ++i)
         if (clipToVisibleContent)
             rects.append(intersection(intRects[i], visibleContentRect));
@@ -1192,15 +1215,6 @@ void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleConte
 }
 
 
-bool Frame::isFrameSet() const
-{
-    Document* document = d->m_doc.get();
-    if (!document || !document->isHTMLDocument())
-        return false;
-    Node *body = static_cast<HTMLDocument*>(document)->body();
-    return body && body->renderer() && body->hasTagName(framesetTag);
-}
-
 // Scans logically forward from "start", including any child frames
 static HTMLFormElement *scanForForm(Node *start)
 {
@@ -1208,7 +1222,7 @@ static HTMLFormElement *scanForForm(Node *start)
     for (n = start; n; n = n->traverseNextNode()) {
         if (n->hasTagName(formTag))
             return static_cast<HTMLFormElement*>(n);
-        else if (n->isHTMLElement() && static_cast<HTMLElement*>(n)->isGenericFormElement())
+        else if (n->isHTMLElement() && static_cast<Element*>(n)->isFormControlElement())
             return static_cast<HTMLFormControlElement*>(n)->form();
         else if (n->hasTagName(frameTag) || n->hasTagName(iframeTag)) {
             Node *childDoc = static_cast<HTMLFrameElementBase*>(n)->contentDocument();
@@ -1223,7 +1237,7 @@ static HTMLFormElement *scanForForm(Node *start)
 HTMLFormElement *Frame::currentForm() const
 {
     // start looking either at the active (first responder) node, or where the selection is
-    Node *start = d->m_doc ? d->m_doc->focusedNode() : 0;
+    Node *start = m_doc ? m_doc->focusedNode() : 0;
     if (!start)
         start = selection()->start().node();
     
@@ -1232,8 +1246,7 @@ HTMLFormElement *Frame::currentForm() const
     for (n = start; n; n = n->parentNode()) {
         if (n->hasTagName(formTag))
             return static_cast<HTMLFormElement*>(n);
-        else if (n->isHTMLElement()
-                   && static_cast<HTMLElement*>(n)->isGenericFormElement())
+        else if (n->isHTMLElement() && static_cast<Element*>(n)->isFormControlElement())
             return static_cast<HTMLFormControlElement*>(n)->form();
     }
     
@@ -1241,66 +1254,32 @@ HTMLFormElement *Frame::currentForm() const
     return start ? scanForForm(start) : 0;
 }
 
-// FIXME: should this go in SelectionController?
-void Frame::revealSelection(const RenderLayer::ScrollAlignment& alignment) const
+void Frame::revealSelection(const ScrollAlignment& alignment, bool revealExtent)
 {
     IntRect rect;
-    
-    switch (selection()->state()) {
-        case Selection::NONE:
+
+    switch (selection()->selectionType()) {
+        case VisibleSelection::NoSelection:
             return;
-            
-        case Selection::CARET:
+        case VisibleSelection::CaretSelection:
             rect = selection()->absoluteCaretBounds();
             break;
-            
-        case Selection::RANGE:
-            rect = enclosingIntRect(selectionBounds(false));
+        case VisibleSelection::RangeSelection:
+            rect = revealExtent ? VisiblePosition(selection()->extent()).absoluteCaretBounds() : enclosingIntRect(selectionBounds(false));
             break;
     }
 
     Position start = selection()->start();
-
     ASSERT(start.node());
     if (start.node() && start.node()->renderer()) {
         // FIXME: This code only handles scrolling the startContainer's layer, but
         // the selection rect could intersect more than just that. 
         // See <rdar://problem/4799899>.
-        if (RenderLayer *layer = start.node()->renderer()->enclosingLayer())
+        if (RenderLayer* layer = start.node()->renderer()->enclosingLayer())
             layer->scrollRectToVisible(rect, false, alignment, alignment);
     }
 }
 
-void Frame::revealCaret(const RenderLayer::ScrollAlignment& alignment) const
-{
-    if (selection()->isNone())
-        return;
-
-    Position extent = selection()->extent();
-    if (extent.node() && extent.node()->renderer()) {
-        IntRect extentRect = VisiblePosition(extent).absoluteCaretBounds();
-        RenderLayer* layer = extent.node()->renderer()->enclosingLayer();
-        if (layer)
-            layer->scrollRectToVisible(extentRect, false, alignment, alignment);
-    }
-}
-
-void Frame::adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float /*bottomLimit*/)
-{
-    RenderView* root = contentRenderer();
-    if (root) {
-        // Use a context with painting disabled.
-        GraphicsContext context((PlatformGraphicsContext*)0);
-        root->setTruncatedAt((int)floorf(oldBottom));
-        IntRect dirtyRect(0, (int)floorf(oldTop), root->docWidth(), (int)ceilf(oldBottom - oldTop));
-        root->layer()->paint(&context, dirtyRect);
-        *newBottom = root->bestTruncatedAt();
-        if (*newBottom == 0)
-            *newBottom = oldBottom;
-    } else
-        *newBottom = oldBottom;
-}
-
 Frame* Frame::frameForWidget(const Widget* widget)
 {
     ASSERT_ARG(widget, widget);
@@ -1315,74 +1294,11 @@ Frame* Frame::frameForWidget(const Widget* widget)
     return static_cast<const FrameView*>(widget)->frame();
 }
 
-void Frame::forceLayout(bool allowSubtree)
-{
-    FrameView *v = d->m_view.get();
-    if (v) {
-        v->layout(allowSubtree);
-        // We cannot unschedule a pending relayout, since the force can be called with
-        // a tiny rectangle from a drawRect update.  By unscheduling we in effect
-        // "validate" and stop the necessary full repaint from occurring.  Basically any basic
-        // append/remove DHTML is broken by this call.  For now, I have removed the optimization
-        // until we have a better invalidation stategy. -dwh
-        //v->unscheduleRelayout();
-    }
-}
-
-void Frame::forceLayoutWithPageWidthRange(float minPageWidth, float maxPageWidth, bool adjustViewSize)
-{
-    // Dumping externalRepresentation(m_frame->renderer()).ascii() is a good trick to see
-    // the state of things before and after the layout
-    RenderView *root = static_cast<RenderView*>(document()->renderer());
-    if (root) {
-        // This magic is basically copied from khtmlview::print
-        int pageW = (int)ceilf(minPageWidth);
-        root->setWidth(pageW);
-        root->setNeedsLayoutAndPrefWidthsRecalc();
-        forceLayout();
-        
-        // If we don't fit in the minimum page width, we'll lay out again. If we don't fit in the
-        // maximum page width, we will lay out to the maximum page width and clip extra content.
-        // FIXME: We are assuming a shrink-to-fit printing implementation.  A cropping
-        // implementation should not do this!
-        int rightmostPos = root->rightmostPosition();
-        if (rightmostPos > minPageWidth) {
-            pageW = min(rightmostPos, (int)ceilf(maxPageWidth));
-            root->setWidth(pageW);
-            root->setNeedsLayoutAndPrefWidthsRecalc();
-            forceLayout();
-        }
-    }
-
-    if (adjustViewSize && view())
-        view()->adjustViewSize();
-}
-
-void Frame::sendResizeEvent()
-{
-    if (Document* doc = document())
-        doc->dispatchWindowEvent(eventNames().resizeEvent, false, false);
-}
-
-void Frame::sendScrollEvent()
-{
-    FrameView* v = d->m_view.get();
-    if (!v)
-        return;
-    v->setWasScrolledByUser(true);
-    Document* doc = document();
-    if (!doc)
-        return;
-    doc->dispatchEventForType(eventNames().scrollEvent, true, false);
-}
-
 void Frame::clearTimers(FrameView *view, Document *document)
 {
     if (view) {
         view->unscheduleRelayout();
         if (view->frame()) {
-            if (document && document->renderer() && document->renderer()->hasLayer())
-                document->renderer()->layer()->suspendMarquees();
             view->frame()->animation()->suspendAnimations(document);
             view->frame()->eventHandler()->stopAutoscrollTimer();
         }
@@ -1391,15 +1307,13 @@ void Frame::clearTimers(FrameView *view, Document *document)
 
 void Frame::clearTimers()
 {
-    clearTimers(d->m_view.get(), document());
+    clearTimers(m_view.get(), document());
 }
 
 RenderStyle *Frame::styleForSelectionStart(Node *&nodeToRemove) const
 {
     nodeToRemove = 0;
     
-    if (!document())
-        return 0;
     if (selection()->isNone())
         return 0;
     
@@ -1410,14 +1324,13 @@ RenderStyle *Frame::styleForSelectionStart(Node *&nodeToRemove) const
     if (!node)
         return 0;
     
-    if (!d->m_typingStyle)
+    if (!m_typingStyle)
         return node->renderer()->style();
     
-    ExceptionCode ec = 0;
-    RefPtr<Element> styleElement = document()->createElementNS(xhtmlNamespaceURI, "span", ec);
-    ASSERT(ec == 0);
+    RefPtr<Element> styleElement = document()->createElement(spanTag, false);
     
-    String styleText = d->m_typingStyle->cssText() + " display: inline";
+    ExceptionCode ec = 0;
+    String styleText = m_typingStyle->cssText() + " display: inline";
     styleElement->setAttribute(styleAttr, styleText.impl(), ec);
     ASSERT(ec == 0);
     
@@ -1436,42 +1349,31 @@ void Frame::setSelectionFromNone()
     // Put a caret inside the body if the entire frame is editable (either the 
     // entire WebView is editable or designMode is on for this document).
     Document *doc = document();
-    if (!doc || !selection()->isNone() || !isContentEditable())
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+    if (!selection()->isNone() || !(isContentEditable() || caretBrowsing))
         return;
         
     Node* node = doc->documentElement();
     while (node && !node->hasTagName(bodyTag))
         node = node->traverseNextNode();
     if (node)
-        selection()->setSelection(Selection(Position(node, 0), DOWNSTREAM));
+        selection()->setSelection(VisibleSelection(Position(node, 0), DOWNSTREAM));
 }
 
 bool Frame::inViewSourceMode() const
 {
-    return d->m_inViewSourceMode;
-}
-
-void Frame::setInViewSourceMode(bool mode) const
-{
-    d->m_inViewSourceMode = mode;
+    return m_inViewSourceMode;
 }
 
-UChar Frame::backslashAsCurrencySymbol() const
+void Frame::setInViewSourceMode(bool mode)
 {
-    Document *doc = document();
-    if (!doc)
-        return '\\';
-    TextResourceDecoder *decoder = doc->decoder();
-    if (!decoder)
-        return '\\';
-
-    return decoder->encoding().backslashAsCurrencySymbol();
+    m_inViewSourceMode = mode;
 }
 
 // Searches from the beginning of the document if nothing is selected.
 bool Frame::findString(const String& target, bool forward, bool caseFlag, bool wrapFlag, bool startInSelection)
 {
-    if (target.isEmpty() || !document())
+    if (target.isEmpty())
         return false;
     
     if (excludeFromTextSearch())
@@ -1480,7 +1382,7 @@ bool Frame::findString(const String& target, bool forward, bool caseFlag, bool w
     // Start from an edge of the selection, if there's a selection that's not in shadow content. Which edge
     // is used depends on whether we're searching forward or backward, and whether startInSelection is set.
     RefPtr<Range> searchRange(rangeOfContents(document()));
-    Selection selection = this->selection()->selection();
+    VisibleSelection selection = this->selection()->selection();
 
     if (forward)
         setStart(searchRange.get(), startInSelection ? selection.visibleStart() : selection.visibleEnd());
@@ -1500,7 +1402,7 @@ bool Frame::findString(const String& target, bool forward, bool caseFlag, bool w
     // If we started in the selection and the found range exactly matches the existing selection, find again.
     // Build a selection with the found range to remove collapsed whitespace.
     // Compare ranges instead of selection objects to ignore the way that the current selection was made.
-    if (startInSelection && *Selection(resultRange.get()).toRange() == *selection.toRange()) {
+    if (startInSelection && *VisibleSelection(resultRange.get()).toNormalizedRange() == *selection.toNormalizedRange()) {
         searchRange = rangeOfContents(document());
         if (forward)
             setStart(searchRange.get(), selection.visibleEnd());
@@ -1550,14 +1452,14 @@ bool Frame::findString(const String& target, bool forward, bool caseFlag, bool w
     if (resultRange->collapsed(exception))
         return false;
 
-    this->selection()->setSelection(Selection(resultRange.get(), DOWNSTREAM));
+    this->selection()->setSelection(VisibleSelection(resultRange.get(), DOWNSTREAM));
     revealSelection();
     return true;
 }
 
 unsigned Frame::markAllMatchesForText(const String& target, bool caseFlag, unsigned limit)
 {
-    if (target.isEmpty() || !document())
+    if (target.isEmpty())
         return 0;
     
     RefPtr<Range> searchRange(rangeOfContents(document()));
@@ -1600,13 +1502,13 @@ unsigned Frame::markAllMatchesForText(const String& target, bool caseFlag, unsig
     // Do a "fake" paint in order to execute the code that computes the rendered rect for 
     // each text match.
     Document* doc = document();
-    if (doc && d->m_view && contentRenderer()) {
+    if (m_view && contentRenderer()) {
         doc->updateLayout(); // Ensure layout is up to date.
-        IntRect visibleRect = d->m_view->visibleContentRect();
+        IntRect visibleRect = m_view->visibleContentRect();
         if (!visibleRect.isEmpty()) {
             GraphicsContext context((PlatformGraphicsContext*)0);
             context.setPaintingDisabled(true);
-            d->m_view->paintContents(&context, visibleRect);
+            m_view->paintContents(&context, visibleRect);
         }
     }
     
@@ -1615,53 +1517,53 @@ unsigned Frame::markAllMatchesForText(const String& target, bool caseFlag, unsig
 
 bool Frame::markedTextMatchesAreHighlighted() const
 {
-    return d->m_highlightTextMatches;
+    return m_highlightTextMatches;
 }
 
 void Frame::setMarkedTextMatchesAreHighlighted(bool flag)
 {
-    if (flag == d->m_highlightTextMatches || !document())
+    if (flag == m_highlightTextMatches)
         return;
     
-    d->m_highlightTextMatches = flag;
+    m_highlightTextMatches = flag;
     document()->repaintMarkers(DocumentMarker::TextMatch);
 }
 
 FrameTree* Frame::tree() const
 {
-    return &d->m_treeNode;
+    return &m_treeNode;
 }
 
 void Frame::setDOMWindow(DOMWindow* domWindow)
 {
-    if (d->m_domWindow) {
-        d->m_liveFormerWindows.add(d->m_domWindow.get());
-        d->m_domWindow->clear();
+    if (m_domWindow) {
+        m_liveFormerWindows.add(m_domWindow.get());
+        m_domWindow->clear();
     }
-    d->m_domWindow = domWindow;
+    m_domWindow = domWindow;
 }
 
 DOMWindow* Frame::domWindow() const
 {
-    if (!d->m_domWindow)
-        d->m_domWindow = DOMWindow::create(const_cast<Frame*>(this));
+    if (!m_domWindow)
+        m_domWindow = DOMWindow::create(const_cast<Frame*>(this));
 
-    return d->m_domWindow.get();
+    return m_domWindow.get();
 }
 
 void Frame::clearFormerDOMWindow(DOMWindow* window)
 {
-    d->m_liveFormerWindows.remove(window);    
+    m_liveFormerWindows.remove(window);    
 }
 
 Page* Frame::page() const
 {
-    return d->m_page;
+    return m_page;
 }
 
 EventHandler* Frame::eventHandler() const
 {
-    return &d->m_eventHandler;
+    return &m_eventHandler;
 }
 
 void Frame::pageDestroyed()
@@ -1675,35 +1577,28 @@ void Frame::pageDestroyed()
         page()->focusController()->setFocusedFrame(0);
 
     script()->clearWindowShell();
-
-    // This will stop any JS timers
-    if (script()->haveWindowShell())
-        script()->windowShell()->disconnectFrame();
-
     script()->clearScriptObjects();
     script()->updatePlatformScriptObjects();
 
-    d->m_page = 0;
+    m_page = 0;
 }
 
 void Frame::disconnectOwnerElement()
 {
-    if (d->m_ownerElement) {
+    if (m_ownerElement) {
         if (Document* doc = document())
             doc->clearAXObjectCache();
-        d->m_ownerElement->m_contentFrame = 0;
-        if (d->m_page)
-            d->m_page->decrementFrameCount();
+        m_ownerElement->m_contentFrame = 0;
+        if (m_page)
+            m_page->decrementFrameCount();
     }
-    d->m_ownerElement = 0;
+    m_ownerElement = 0;
 }
 
 String Frame::documentTypeString() const
 {
-    if (Document* doc = document()) {
-        if (DocumentType* doctype = doc->doctype())
-            return createMarkup(doctype);
-    }
+    if (DocumentType* doctype = document()->doctype())
+        return createMarkup(doctype);
 
     return String();
 }
@@ -1730,31 +1625,28 @@ void Frame::unfocusWindow()
         page()->chrome()->unfocus();
 }
 
-bool Frame::shouldClose()
+bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
 {
     Chrome* chrome = page() ? page()->chrome() : 0;
     if (!chrome || !chrome->canRunBeforeUnloadConfirmPanel())
         return true;
 
-    RefPtr<Document> doc = document();
-    if (!doc)
+    if (!m_domWindow)
         return true;
+
+    RefPtr<Document> doc = document();
     HTMLElement* body = doc->body();
     if (!body)
         return true;
 
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
-    beforeUnloadEvent->setTarget(doc);
-    doc->handleWindowEvent(beforeUnloadEvent.get(), false);
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = m_domWindow->dispatchBeforeUnloadEvent(alternateEventListeners);
 
-    if (!beforeUnloadEvent->defaultPrevented() && doc)
+    if (!beforeUnloadEvent->defaultPrevented())
         doc->defaultEventHandler(beforeUnloadEvent.get());
     if (beforeUnloadEvent->result().isNull())
         return true;
 
-    String text = beforeUnloadEvent->result();
-    text.replace('\\', backslashAsCurrencySymbol());
-
+    String text = doc->displayStringModifiedByEncoding(beforeUnloadEvent->result());
     return chrome->runBeforeUnloadConfirmPanel(text, this);
 }
 
@@ -1768,52 +1660,51 @@ void Frame::scheduleClose()
         chrome->closeWindowSoon();
 }
 
-void Frame::respondToChangedSelection(const Selection& oldSelection, bool closeTyping)
+void Frame::respondToChangedSelection(const VisibleSelection& oldSelection, bool closeTyping)
 {
-    if (document()) {
-        bool isContinuousSpellCheckingEnabled = editor()->isContinuousSpellCheckingEnabled();
-        bool isContinuousGrammarCheckingEnabled = isContinuousSpellCheckingEnabled && editor()->isGrammarCheckingEnabled();
-        if (isContinuousSpellCheckingEnabled) {
-            Selection newAdjacentWords;
-            Selection newSelectedSentence;
-            if (selection()->selection().isContentEditable()) {
-                VisiblePosition newStart(selection()->selection().visibleStart());
-                newAdjacentWords = Selection(startOfWord(newStart, LeftWordIfOnBoundary), endOfWord(newStart, RightWordIfOnBoundary));
-                if (isContinuousGrammarCheckingEnabled)
-                    newSelectedSentence = Selection(startOfSentence(newStart), endOfSentence(newStart));
-            }
+    bool isContinuousSpellCheckingEnabled = editor()->isContinuousSpellCheckingEnabled();
+    bool isContinuousGrammarCheckingEnabled = isContinuousSpellCheckingEnabled && editor()->isGrammarCheckingEnabled();
+    if (isContinuousSpellCheckingEnabled) {
+        VisibleSelection newAdjacentWords;
+        VisibleSelection newSelectedSentence;
+        bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+        if (selection()->selection().isContentEditable() || caretBrowsing) {
+            VisiblePosition newStart(selection()->selection().visibleStart());
+            newAdjacentWords = VisibleSelection(startOfWord(newStart, LeftWordIfOnBoundary), endOfWord(newStart, RightWordIfOnBoundary));
+            if (isContinuousGrammarCheckingEnabled)
+                newSelectedSentence = VisibleSelection(startOfSentence(newStart), endOfSentence(newStart));
+        }
 
-            // When typing we check spelling elsewhere, so don't redo it here.
-            // If this is a change in selection resulting from a delete operation,
-            // oldSelection may no longer be in the document.
-            if (closeTyping && oldSelection.isContentEditable() && oldSelection.start().node() && oldSelection.start().node()->inDocument()) {
-                VisiblePosition oldStart(oldSelection.visibleStart());
-                Selection oldAdjacentWords = Selection(startOfWord(oldStart, LeftWordIfOnBoundary), endOfWord(oldStart, RightWordIfOnBoundary));   
-                if (oldAdjacentWords != newAdjacentWords) {
-                    editor()->markMisspellings(oldAdjacentWords);
-                    if (isContinuousGrammarCheckingEnabled) {
-                        Selection oldSelectedSentence = Selection(startOfSentence(oldStart), endOfSentence(oldStart));   
-                        if (oldSelectedSentence != newSelectedSentence)
-                            editor()->markBadGrammar(oldSelectedSentence);
-                    }
+        // When typing we check spelling elsewhere, so don't redo it here.
+        // If this is a change in selection resulting from a delete operation,
+        // oldSelection may no longer be in the document.
+        if (closeTyping && oldSelection.isContentEditable() && oldSelection.start().node() && oldSelection.start().node()->inDocument()) {
+            VisiblePosition oldStart(oldSelection.visibleStart());
+            VisibleSelection oldAdjacentWords = VisibleSelection(startOfWord(oldStart, LeftWordIfOnBoundary), endOfWord(oldStart, RightWordIfOnBoundary));   
+            if (oldAdjacentWords != newAdjacentWords) {
+                if (isContinuousGrammarCheckingEnabled) {
+                    VisibleSelection oldSelectedSentence = VisibleSelection(startOfSentence(oldStart), endOfSentence(oldStart));
+                    editor()->markMisspellingsAndBadGrammar(oldAdjacentWords, oldSelectedSentence != newSelectedSentence, oldSelectedSentence);
+                } else {
+                    editor()->markMisspellingsAndBadGrammar(oldAdjacentWords, false, oldAdjacentWords);
                 }
             }
-
-            // This only erases markers that are in the first unit (word or sentence) of the selection.
-            // Perhaps peculiar, but it matches AppKit.
-            if (RefPtr<Range> wordRange = newAdjacentWords.toRange())
-                document()->removeMarkers(wordRange.get(), DocumentMarker::Spelling);
-            if (RefPtr<Range> sentenceRange = newSelectedSentence.toRange())
-                document()->removeMarkers(sentenceRange.get(), DocumentMarker::Grammar);
         }
 
-        // When continuous spell checking is off, existing markers disappear after the selection changes.
-        if (!isContinuousSpellCheckingEnabled)
-            document()->removeMarkers(DocumentMarker::Spelling);
-        if (!isContinuousGrammarCheckingEnabled)
-            document()->removeMarkers(DocumentMarker::Grammar);
+        // This only erases markers that are in the first unit (word or sentence) of the selection.
+        // Perhaps peculiar, but it matches AppKit.
+        if (RefPtr<Range> wordRange = newAdjacentWords.toNormalizedRange())
+            document()->removeMarkers(wordRange.get(), DocumentMarker::Spelling);
+        if (RefPtr<Range> sentenceRange = newSelectedSentence.toNormalizedRange())
+            document()->removeMarkers(sentenceRange.get(), DocumentMarker::Grammar);
     }
 
+    // When continuous spell checking is off, existing markers disappear after the selection changes.
+    if (!isContinuousSpellCheckingEnabled)
+        document()->removeMarkers(DocumentMarker::Spelling);
+    if (!isContinuousGrammarCheckingEnabled)
+        document()->removeMarkers(DocumentMarker::Grammar);
+
     editor()->respondToChangedSelection(oldSelection);
 }
 
@@ -1826,7 +1717,7 @@ VisiblePosition Frame::visiblePositionForPoint(const IntPoint& framePoint)
     RenderObject* renderer = node->renderer();
     if (!renderer)
         return VisiblePosition();
-    VisiblePosition visiblePos = renderer->positionForCoordinates(result.localPoint().x(), result.localPoint().y());
+    VisiblePosition visiblePos = renderer->positionForPoint(result.localPoint());
     if (visiblePos.isNull())
         visiblePos = VisiblePosition(Position(node, 0));
     return visiblePos;
@@ -1844,37 +1735,46 @@ Document* Frame::documentAtPoint(const IntPoint& point)
         result = eventHandler()->hitTestResultAtPoint(pt, false);
     return result.innerNode() ? result.innerNode()->document() : 0;
 }
-    
-FramePrivate::FramePrivate(Page* page, Frame* parent, Frame* thisFrame, HTMLFrameOwnerElement* ownerElement,
-                           FrameLoaderClient* frameLoaderClient)
-    : m_page(page)
-    , m_treeNode(thisFrame, parent)
-    , m_loader(thisFrame, frameLoaderClient)
-    , m_ownerElement(ownerElement)
-    , m_script(thisFrame)
-    , m_zoomFactor(parent ? parent->d->m_zoomFactor : 1.0f)
-    , m_selectionGranularity(CharacterGranularity)
-    , m_selectionController(thisFrame)
-    , m_caretBlinkTimer(thisFrame, &Frame::caretBlinkTimerFired)
-    , m_editor(thisFrame)
-    , m_eventHandler(thisFrame)
-    , m_animationController(thisFrame)
-    , m_lifeSupportTimer(thisFrame, &Frame::lifeSupportTimerFired)
-    , m_caretVisible(false)
-    , m_caretPaint(true)
-    , m_highlightTextMatches(false)
-    , m_inViewSourceMode(false)
-    , m_needsReapplyStyles(false)
-    , m_isDisconnected(false)
-    , m_excludeFromTextSearch(false)
-#if FRAME_LOADS_USER_STYLESHEET
-    , m_userStyleSheetLoader(0)
-#endif
-{
-}
 
-FramePrivate::~FramePrivate()
+void Frame::createView(const IntSize& viewportSize,
+                       const Color& backgroundColor, bool transparent,
+                       const IntSize& fixedLayoutSize, bool useFixedLayout,
+                       ScrollbarMode horizontalScrollbarMode, ScrollbarMode verticalScrollbarMode)
 {
+    ASSERT(this);
+    ASSERT(m_page);
+
+    bool isMainFrame = this == m_page->mainFrame();
+
+    if (isMainFrame && view())
+        view()->setParentVisible(false);
+
+    setView(0);
+
+    RefPtr<FrameView> frameView;
+    if (isMainFrame) {
+        frameView = FrameView::create(this, viewportSize);
+        frameView->setFixedLayoutSize(fixedLayoutSize);
+        frameView->setUseFixedLayout(useFixedLayout);
+    } else
+        frameView = FrameView::create(this);
+
+    frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode);
+    frameView->updateDefaultScrollbarState();
+
+    setView(frameView);
+
+    if (backgroundColor.isValid())
+        frameView->updateBackgroundRecursively(backgroundColor, transparent);
+
+    if (isMainFrame)
+        frameView->setParentVisible(true);
+
+    if (ownerRenderer())
+        ownerRenderer()->setWidget(frameView.get());
+
+    if (HTMLFrameOwnerElement* owner = ownerElement())
+        view()->setCanHaveScrollbars(owner->scrollingMode() != ScrollbarAlwaysOff);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.h b/src/3rdparty/webkit/WebCore/page/Frame.h
index 874d90d927..0a44a6d155 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.h
+++ b/src/3rdparty/webkit/WebCore/page/Frame.h
@@ -5,7 +5,7 @@
  *                     2000-2001 Simon Hausmann <hausmann@kde.org>
  *                     2000-2001 Dirk Mueller <mueller@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  *
@@ -28,11 +28,24 @@
 #ifndef Frame_h
 #define Frame_h
 
+#include "AnimationController.h"
+#include "Document.h"
 #include "DragImage.h"
 #include "EditAction.h"
-#include "RenderLayer.h"
+#include "Editor.h"
+#include "EventHandler.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "Range.h"
+#include "ScrollBehavior.h"
+#include "ScriptController.h"
+#include "SelectionController.h"
 #include "TextGranularity.h"
 
+#if PLATFORM(WIN)
+#include "FrameWin.h"
+#endif
+
 #if PLATFORM(MAC)
 #ifndef __OBJC__
 class NSArray;
@@ -49,21 +62,27 @@ typedef struct HBITMAP__* HBITMAP;
 
 namespace WebCore {
 
+class CSSMutableStyleDeclaration;
 class Editor;
 class EventHandler;
 class FrameLoader;
 class FrameLoaderClient;
-class FramePrivate;
 class FrameTree;
+class FrameView;
 class HTMLFrameOwnerElement;
 class HTMLTableCellElement;
-class ScriptController;
 class RegularExpression;
 class RenderPart;
-class Selection;
+class ScriptController;
 class SelectionController;
+class Settings;
+class VisibleSelection;
 class Widget;
 
+#if FRAME_LOADS_USER_STYLESHEET
+    class UserStyleSheetLoader;
+#endif
+
 template <typename T> class Timer;
 
 class Frame : public RefCounted<Frame> {
@@ -72,7 +91,7 @@ public:
     {
         return adoptRef(new Frame(page, ownerElement, client));
     }
-    void setView(FrameView*);
+    void setView(PassRefPtr<FrameView>);
     ~Frame();
     
     void init();
@@ -106,12 +125,12 @@ public:
     bool excludeFromTextSearch() const;
     void setExcludeFromTextSearch(bool);
 
-    friend class FramePrivate;
+    void createView(const IntSize&, const Color&, bool, const IntSize &, bool,
+                    ScrollbarMode = ScrollbarAuto, ScrollbarMode = ScrollbarAuto);
+
 
 private:
     Frame(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
-
-    FramePrivate* d;
     
 // === undecided, would like to consider moving to another class
 
@@ -128,7 +147,7 @@ public:
     void setPrinting(bool printing, float minPageWidth, float maxPageWidth, bool adjustViewSize);
 
     bool inViewSourceMode() const;
-    void setInViewSourceMode(bool = true) const;
+    void setInViewSourceMode(bool = true);
 
     void keepAlive(); // Used to keep the frame alive when running a script that might destroy it.
 #ifndef NDEBUG
@@ -140,9 +159,6 @@ public:
     void clearTimers();
     static void clearTimers(FrameView*, Document*);
 
-    // Convenience, to avoid repeating the code to dig down to get this.
-    UChar backslashAsCurrencySymbol() const;
-
     void setNeedsReapplyStyles();
     bool needsReapplyStyles() const;
     void reapplyStyles();
@@ -153,28 +169,17 @@ public:
     // should move onto ScriptController
     void clearDOMWindow();
 
+    String displayStringModifiedByEncoding(const String& str) const 
+    {
+        return document() ? document()->displayStringModifiedByEncoding(str) : str;
+    }
+
 private:
     void lifeSupportTimerFired(Timer<Frame>*);
 
-// === to be moved into Document
-
-public:
-    bool isFrameSet() const;
-
-// === to be moved into EventHandler
-
-public:
-    void sendResizeEvent();
-    void sendScrollEvent();
-
 // === to be moved into FrameView
 
 public: 
-    void forceLayout(bool allowSubtree = false);
-    void forceLayoutWithPageWidthRange(float minPageWidth, float maxPageWidth, bool adjustViewSize);
-
-    void adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float bottomLimit);
-
     void setZoomFactor(float scale, bool isTextOnly);
     float zoomFactor() const;
     bool isZoomFactorTextOnly() const;
@@ -188,7 +193,7 @@ public:
 public:
     void focusWindow();
     void unfocusWindow();
-    bool shouldClose();
+    bool shouldClose(RegisteredEventListenerVector* alternateEventListeners = 0);
     void scheduleClose();
 
     void setJSStatusBarText(const String&);
@@ -202,8 +207,8 @@ public:
     String selectedText() const;  
     bool findString(const String&, bool forward, bool caseFlag, bool wrapFlag, bool startInSelection);
 
-    const Selection& mark() const; // Mark, to be used as emacs uses it.
-    void setMark(const Selection&);
+    const VisibleSelection& mark() const; // Mark, to be used as emacs uses it.
+    void setMark(const VisibleSelection&);
 
     void computeAndSetTypingStyle(CSSStyleDeclaration* , EditAction = EditActionUnspecified);
     String selectionStartStylePropertyValue(int stylePropertyID) const;
@@ -214,8 +219,8 @@ public:
 
     IntRect firstRectForRange(Range*) const;
     
-    void respondToChangedSelection(const Selection& oldSelection, bool closeTyping);
-    bool shouldChangeSelection(const Selection& oldSelection, const Selection& newSelection, EAffinity, bool stillSelecting) const;
+    void respondToChangedSelection(const VisibleSelection& oldSelection, bool closeTyping);
+    bool shouldChangeSelection(const VisibleSelection& oldSelection, const VisibleSelection& newSelection, EAffinity, bool stillSelecting) const;
 
     RenderStyle* styleForSelectionStart(Node*& nodeToRemove) const;
 
@@ -238,10 +243,10 @@ public:
 
 public:
     TextGranularity selectionGranularity() const;
-    void setSelectionGranularity(TextGranularity) const;
+    void setSelectionGranularity(TextGranularity);
 
-    bool shouldChangeSelection(const Selection&) const;
-    bool shouldDeleteSelection(const Selection&) const;
+    bool shouldChangeSelection(const VisibleSelection&) const;
+    bool shouldDeleteSelection(const VisibleSelection&) const;
     void clearCaretRectIfNeeded();
     void setFocusedNodeIfNeeded();
     void selectionLayoutChanged();
@@ -266,8 +271,7 @@ public:
 
     HTMLFormElement* currentForm() const;
 
-    void revealSelection(const RenderLayer::ScrollAlignment& = RenderLayer::gAlignCenterIfNeeded) const;
-    void revealCaret(const RenderLayer::ScrollAlignment& = RenderLayer::gAlignCenterIfNeeded) const;
+    void revealSelection(const ScrollAlignment& = ScrollAlignment::alignCenterIfNeeded, bool revealExtent = false);
     void setSelectionFromNone();
 
     void setUseSecureKeyboardEntry(bool);
@@ -321,6 +325,51 @@ public:
 
 #endif
 
+private:
+    Page* m_page;
+    mutable FrameTree m_treeNode;
+    mutable FrameLoader m_loader;
+
+    mutable RefPtr<DOMWindow> m_domWindow;
+    HashSet<DOMWindow*> m_liveFormerWindows;
+
+    HTMLFrameOwnerElement* m_ownerElement;
+    RefPtr<FrameView> m_view;
+    RefPtr<Document> m_doc;
+
+    ScriptController m_script;
+
+    String m_kjsStatusBarText;
+    String m_kjsDefaultStatusBarText;
+
+    float m_zoomFactor;
+
+    TextGranularity m_selectionGranularity;
+
+    mutable SelectionController m_selectionController;
+    mutable VisibleSelection m_mark;
+    Timer<Frame> m_caretBlinkTimer;
+    mutable Editor m_editor;
+    mutable EventHandler m_eventHandler;
+    mutable AnimationController m_animationController;
+
+    RefPtr<CSSMutableStyleDeclaration> m_typingStyle;
+
+    Timer<Frame> m_lifeSupportTimer;
+
+    bool m_caretVisible;
+    bool m_caretPaint;
+    
+    bool m_highlightTextMatches;
+    bool m_inViewSourceMode;
+    bool m_needsReapplyStyles;
+    bool m_isDisconnected;
+    bool m_excludeFromTextSearch;
+
+#if FRAME_LOADS_USER_STYLESHEET
+    UserStyleSheetLoader* m_userStyleSheetLoader;
+#endif
+
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/FrameLoadRequest.h b/src/3rdparty/webkit/WebCore/page/FrameLoadRequest.h
index 99f415f95b..b84a1ec389 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameLoadRequest.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameLoadRequest.h
@@ -33,20 +33,17 @@ namespace WebCore {
     struct FrameLoadRequest {
     public:
         FrameLoadRequest()
-            : m_lockHistory(false)
         {
         }
 
         FrameLoadRequest(const ResourceRequest& resourceRequest)
             : m_resourceRequest(resourceRequest)
-            , m_lockHistory(false)
         {
         }
 
         FrameLoadRequest(const ResourceRequest& resourceRequest, const String& frameName)
             : m_resourceRequest(resourceRequest)
             , m_frameName(frameName)
-            , m_lockHistory(false)
         {
         }
 
@@ -58,13 +55,9 @@ namespace WebCore {
         const String& frameName() const { return m_frameName; }
         void setFrameName(const String& frameName) { m_frameName = frameName; }
 
-        bool lockHistory() const { return m_lockHistory; }
-        void setLockHistory(bool lock) { m_lockHistory = lock; }
-
     private:
         ResourceRequest m_resourceRequest;
         String m_frameName;
-        bool m_lockHistory;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/FramePrivate.h b/src/3rdparty/webkit/WebCore/page/FramePrivate.h
deleted file mode 100644
index 2f7c59a3a1..0000000000
--- a/src/3rdparty/webkit/WebCore/page/FramePrivate.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/* Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
- *                     1999-2001 Lars Knoll <knoll@kde.org>
- *                     1999-2001 Antti Koivisto <koivisto@kde.org>
- *                     2000-2001 Simon Hausmann <hausmann@kde.org>
- *                     2000-2001 Dirk Mueller <mueller@kde.org>
- *                     2000 Stefan Schimanski <1Stein@gmx.de>
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef FramePrivate_h
-#define FramePrivate_h
-
-#include "AnimationController.h"
-#include "Editor.h"
-#include "EventHandler.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "Range.h"
-#include "SelectionController.h"
-#include "StringHash.h"
-#include "ScriptController.h"
-
-#if PLATFORM(WIN)
-#include "FrameWin.h"
-#endif
-
-namespace WebCore {
-
-#if FRAME_LOADS_USER_STYLESHEET
-    class UserStyleSheetLoader;
-#endif
-    
-    class FramePrivate {
-    public:
-        FramePrivate(Page*, Frame* parent, Frame* thisFrame, HTMLFrameOwnerElement*, FrameLoaderClient*);
-        ~FramePrivate();
-
-        Page* m_page;
-        FrameTree m_treeNode;
-        FrameLoader m_loader;
-        RefPtr<DOMWindow> m_domWindow;
-        HashSet<DOMWindow*> m_liveFormerWindows;
-
-        HTMLFrameOwnerElement* m_ownerElement;
-        RefPtr<FrameView> m_view;
-        RefPtr<Document> m_doc;
-
-        ScriptController m_script;
-
-        String m_kjsStatusBarText;
-        String m_kjsDefaultStatusBarText;
-
-        float m_zoomFactor;
-
-        TextGranularity m_selectionGranularity;
-
-        SelectionController m_selectionController;
-        Selection m_mark;
-        Timer<Frame> m_caretBlinkTimer;
-        Editor m_editor;
-        EventHandler m_eventHandler;
-        AnimationController m_animationController;
-
-        RefPtr<CSSMutableStyleDeclaration> m_typingStyle;
-
-        Timer<Frame> m_lifeSupportTimer;
-
-        bool m_caretVisible;
-        bool m_caretPaint;
-        
-        bool m_highlightTextMatches;
-        bool m_inViewSourceMode;
-        bool m_needsReapplyStyles;
-        bool m_isDisconnected;
-        bool m_excludeFromTextSearch;
-
-#if FRAME_LOADS_USER_STYLESHEET
-        UserStyleSheetLoader* m_userStyleSheetLoader;
-#endif
-    };
-}
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/page/FrameTree.cpp b/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
index c9b4172779..24f125d998 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
@@ -21,6 +21,7 @@
 #include "FrameTree.h"
 
 #include "Frame.h"
+#include "FrameView.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include <stdarg.h>
@@ -82,10 +83,6 @@ void FrameTree::appendChild(PassRefPtr<Frame> child)
 void FrameTree::removeChild(Frame* child)
 {
     child->tree()->m_parent = 0;
-    child->setView(0);
-    if (child->ownerElement())
-        child->page()->decrementFrameCount();
-    child->pageDestroyed();
 
     // Slightly tricky way to prevent deleting the child until we are done with it, w/o
     // extra refs. These swaps leave the child in a circular list by itself. Clearing its
diff --git a/src/3rdparty/webkit/WebCore/page/FrameTree.h b/src/3rdparty/webkit/WebCore/page/FrameTree.h
index 0952dcd69b..d4c8c43c0d 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameTree.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameTree.h
@@ -21,10 +21,11 @@
 #define FrameTree_h
 
 #include "AtomicString.h"
-#include "Frame.h"
 
 namespace WebCore {
 
+    class Frame;
+
     class FrameTree : Noncopyable {
     public:
         FrameTree(Frame* thisFrame, Frame* parentFrame) 
@@ -55,6 +56,7 @@ namespace WebCore {
         Frame* traversePreviousWithWrap(bool) const;
         
         void appendChild(PassRefPtr<Frame>);
+        void detachFromParent() { m_parent = 0; }
         void removeChild(Frame*);
 
         Frame* child(unsigned index) const;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 4d765acf17..f6501be007 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -29,6 +29,7 @@
 #include "AXObjectCache.h"
 #include "CSSStyleSelector.h"
 #include "ChromeClient.h"
+#include "DocLoader.h"
 #include "EventHandler.h"
 #include "FloatRect.h"
 #include "FocusController.h"
@@ -49,7 +50,11 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerCompositor.h"
+#endif
 
 namespace WebCore {
 
@@ -57,160 +62,129 @@ using namespace HTMLNames;
 
 double FrameView::sCurrentPaintTimeStamp = 0.0;
 
-struct ScheduledEvent {
-    RefPtr<Event> m_event;
-    RefPtr<EventTargetNode> m_eventTarget;
-};
-
-class FrameViewPrivate {
-public:
-    FrameViewPrivate(FrameView* view)
-        : m_slowRepaintObjectCount(0)
-        , m_layoutTimer(view, &FrameView::layoutTimerFired)
-        , m_layoutRoot(0)
-        , m_postLayoutTasksTimer(view, &FrameView::postLayoutTimerFired)
-        , m_mediaType("screen")
-        , m_enqueueEvents(0)
-        , m_overflowStatusDirty(true)
-        , m_viewportRenderer(0)
-        , m_wasScrolledByUser(false)
-        , m_inProgrammaticScroll(false)
-        , m_shouldUpdateWhileOffscreen(true)
-    {
-        m_isTransparent = false;
-        m_baseBackgroundColor = Color::white;
-        m_vmode = m_hmode = ScrollbarAuto;
-        m_needToInitScrollbars = true;
-        reset();
-    }
-    void reset()
-    {
-        m_useSlowRepaints = false;
-        m_borderX = 30;
-        m_borderY = 30;
-        m_layoutTimer.stop();
-        m_layoutRoot = 0;
-        m_delayedLayout = false;
-        m_doFullRepaint = true;
-        m_layoutSchedulingEnabled = true;
-        m_midLayout = false;
-        m_layoutCount = 0;
-        m_nestedLayoutCount = 0;
-        m_postLayoutTasksTimer.stop();
-        m_firstLayout = true;
-        m_firstLayoutCallbackPending = false;
-        m_wasScrolledByUser = false;
-        m_lastLayoutSize = IntSize();
-        m_lastZoomFactor = 1.0f;
-        m_deferringRepaints = 0;
-        m_repaintCount = 0;
-        m_repaintRect = IntRect();
-        m_repaintRects.clear();
-        m_paintRestriction = PaintRestrictionNone;
-        m_isPainting = false;
-        m_isVisuallyNonEmpty = false;
-        m_firstVisuallyNonEmptyLayoutCallbackPending = true;
-    }
-
-    bool m_doFullRepaint;
-    
-    ScrollbarMode m_vmode;
-    ScrollbarMode m_hmode;
-    bool m_useSlowRepaints;
-    unsigned m_slowRepaintObjectCount;
-
-    int m_borderX, m_borderY;
-
-    Timer<FrameView> m_layoutTimer;
-    bool m_delayedLayout;
-    RenderObject* m_layoutRoot;
-    
-    bool m_layoutSchedulingEnabled;
-    bool m_midLayout;
-    int m_layoutCount;
-    unsigned m_nestedLayoutCount;
-    Timer<FrameView> m_postLayoutTasksTimer;
-    bool m_firstLayoutCallbackPending;
-
-    bool m_firstLayout;
-    bool m_needToInitScrollbars;
-    bool m_isTransparent;
-    Color m_baseBackgroundColor;
-    IntSize m_lastLayoutSize;
-    float m_lastZoomFactor;
-
-    String m_mediaType;
-    
-    unsigned m_enqueueEvents;
-    Vector<ScheduledEvent*> m_scheduledEvents;
-    
-    bool m_overflowStatusDirty;
-    bool m_horizontalOverflow;
-    bool m_verticalOverflow;    
-    RenderObject* m_viewportRenderer;
-
-    bool m_wasScrolledByUser;
-    bool m_inProgrammaticScroll;
-    
-    unsigned m_deferringRepaints;
-    unsigned m_repaintCount;
-    IntRect m_repaintRect;
-    Vector<IntRect> m_repaintRects;
-
-    bool m_shouldUpdateWhileOffscreen;
+#if ENABLE(REPAINT_THROTTLING)
+// Normal delay
+static const double deferredRepaintDelay = 0.025;
+// Negative value would mean that first few repaints happen without a delay
+static const double initialDeferredRepaintDelayDuringLoading = 0;
+// The delay grows on each repaint to this maximum value
+static const double maxDeferredRepaintDelayDuringLoading = 2.5;
+// On each repaint the delay increses by this amount
+static const double deferredRepaintDelayIncrementDuringLoading = 0.5;
+#else
+// FIXME: Repaint throttling could be good to have on all platform.
+// The balance between CPU use and repaint frequency will need some tuning for desktop.
+// More hooks may be needed to reset the delay on things like GIF and CSS animations.
+static const double deferredRepaintDelay = 0;
+static const double initialDeferredRepaintDelayDuringLoading = 0;
+static const double maxDeferredRepaintDelayDuringLoading = 0;
+static const double deferredRepaintDelayIncrementDuringLoading = 0;
+#endif
 
-    RefPtr<Node> m_nodeToDraw;
-    PaintRestriction m_paintRestriction;
-    bool m_isPainting;
+// The maximum number of updateWidgets iterations that should be done before returning.
+static const unsigned maxUpdateWidgetsIterations = 2;
 
-    bool m_isVisuallyNonEmpty;
-    bool m_firstVisuallyNonEmptyLayoutCallbackPending;
+struct ScheduledEvent {
+    RefPtr<Event> m_event;
+    RefPtr<Node> m_eventTarget;
 };
 
 FrameView::FrameView(Frame* frame)
-    : m_refCount(1)
-    , m_frame(frame)
-    , d(new FrameViewPrivate(this))
+    : m_frame(frame)
+    , m_vmode(ScrollbarAuto)
+    , m_hmode(ScrollbarAuto)
+    , m_slowRepaintObjectCount(0)
+    , m_layoutTimer(this, &FrameView::layoutTimerFired)
+    , m_layoutRoot(0)
+    , m_postLayoutTasksTimer(this, &FrameView::postLayoutTimerFired)
+    , m_needToInitScrollbars(true)
+    , m_isTransparent(false)
+    , m_baseBackgroundColor(Color::white)
+    , m_mediaType("screen")
+    , m_enqueueEvents(0)
+    , m_overflowStatusDirty(true)
+    , m_viewportRenderer(0)
+    , m_wasScrolledByUser(false)
+    , m_inProgrammaticScroll(false)
+    , m_deferredRepaintTimer(this, &FrameView::deferredRepaintTimerFired)
+    , m_shouldUpdateWhileOffscreen(true)
+    , m_deferSetNeedsLayouts(0)
+    , m_setNeedsLayoutWasDeferred(false)
+    , m_lockedToAnchor(false)
 {
     init();
-    show();
 }
 
-FrameView::FrameView(Frame* frame, const IntSize& initialSize)
-    : m_refCount(1)
-    , m_frame(frame)
-    , d(new FrameViewPrivate(this))
+PassRefPtr<FrameView> FrameView::create(Frame* frame)
 {
-    init();
-    Widget::setFrameRect(IntRect(x(), y(), initialSize.width(), initialSize.height()));
-    show();
+    RefPtr<FrameView> view = adoptRef(new FrameView(frame));
+    view->show();
+    return view.release();
+}
+
+PassRefPtr<FrameView> FrameView::create(Frame* frame, const IntSize& initialSize)
+{
+    RefPtr<FrameView> view = adoptRef(new FrameView(frame));
+    view->Widget::setFrameRect(IntRect(view->pos(), initialSize));
+    view->show();
+    return view.release();
 }
 
 FrameView::~FrameView()
 {
-    if (d->m_postLayoutTasksTimer.isActive()) {
-        d->m_postLayoutTasksTimer.stop();
-        d->m_scheduledEvents.clear();
-        d->m_enqueueEvents = 0;
+    if (m_postLayoutTasksTimer.isActive()) {
+        m_postLayoutTasksTimer.stop();
+        m_scheduledEvents.clear();
+        m_enqueueEvents = 0;
     }
 
     resetScrollbars();
     setHasHorizontalScrollbar(false); // Remove native scrollbars now before we lose the connection to the HostWindow.
     setHasVerticalScrollbar(false);
     
-    ASSERT(m_refCount == 0);
-    ASSERT(d->m_scheduledEvents.isEmpty());
-    ASSERT(!d->m_enqueueEvents);
+    ASSERT(m_scheduledEvents.isEmpty());
+    ASSERT(!m_enqueueEvents);
 
     if (m_frame) {
-        ASSERT(m_frame->view() != this || !m_frame->document() || !m_frame->contentRenderer());
+        ASSERT(m_frame->view() != this || !m_frame->contentRenderer());
         RenderPart* renderer = m_frame->ownerRenderer();
         if (renderer && renderer->widget() == this)
             renderer->setWidget(0);
     }
+}
 
-    delete d;
-    d = 0;
+void FrameView::reset()
+{
+    m_useSlowRepaints = false;
+    m_isOverlapped = false;
+    m_contentIsOpaque = false;
+    m_borderX = 30;
+    m_borderY = 30;
+    m_layoutTimer.stop();
+    m_layoutRoot = 0;
+    m_delayedLayout = false;
+    m_doFullRepaint = true;
+    m_layoutSchedulingEnabled = true;
+    m_midLayout = false;
+    m_layoutCount = 0;
+    m_nestedLayoutCount = 0;
+    m_postLayoutTasksTimer.stop();
+    m_firstLayout = true;
+    m_firstLayoutCallbackPending = false;
+    m_wasScrolledByUser = false;
+    m_lastLayoutSize = IntSize();
+    m_lastZoomFactor = 1.0f;
+    m_deferringRepaints = 0;
+    m_repaintCount = 0;
+    m_repaintRects.clear();
+    m_deferredRepaintDelay = initialDeferredRepaintDelayDuringLoading;
+    m_deferredRepaintTimer.stop();
+    m_lastPaintTime = 0;
+    m_paintRestriction = PaintRestrictionNone;
+    m_isPainting = false;
+    m_isVisuallyNonEmpty = false;
+    m_firstVisuallyNonEmptyLayoutCallbackPending = true;
+    m_lockedToAnchor = false;
 }
 
 bool FrameView::isFrameView() const 
@@ -226,14 +200,16 @@ void FrameView::clearFrame()
 void FrameView::resetScrollbars()
 {
     // Reset the document's scrollbars back to our defaults before we yield the floor.
-    d->m_firstLayout = true;
+    m_firstLayout = true;
     setScrollbarsSuppressed(true);
-    setScrollbarModes(d->m_hmode, d->m_vmode);
+    setScrollbarModes(m_hmode, m_vmode);
     setScrollbarsSuppressed(false);
 }
 
 void FrameView::init()
 {
+    reset();
+
     m_margins = IntSize(-1, -1); // undefined
     m_size = IntSize();
 
@@ -256,33 +232,34 @@ void FrameView::clear()
 {
     setCanBlitOnScroll(true);
     
-    d->reset();
+    reset();
 
-    if (m_frame)
+    if (m_frame) {
         if (RenderPart* renderer = m_frame->ownerRenderer())
             renderer->viewCleared();
+    }
 
     setScrollbarsSuppressed(true);
 }
 
 bool FrameView::didFirstLayout() const
 {
-    return !d->m_firstLayout;
+    return !m_firstLayout;
 }
 
 void FrameView::initScrollbars()
 {
-    if (!d->m_needToInitScrollbars)
+    if (!m_needToInitScrollbars)
         return;
-    d->m_needToInitScrollbars = false;
+    m_needToInitScrollbars = false;
     updateDefaultScrollbarState();
 }
 
 void FrameView::updateDefaultScrollbarState()
 {
-    d->m_hmode = horizontalScrollbarMode();
-    d->m_vmode = verticalScrollbarMode();
-    setScrollbarModes(d->m_hmode, d->m_vmode);
+    m_hmode = horizontalScrollbarMode();
+    m_vmode = verticalScrollbarMode();
+    setScrollbarModes(m_hmode, m_vmode);
 }
 
 void FrameView::invalidateRect(const IntRect& rect)
@@ -321,29 +298,27 @@ void FrameView::setMarginHeight(int h)
 void FrameView::setCanHaveScrollbars(bool canScroll)
 {
     ScrollView::setCanHaveScrollbars(canScroll);
-    scrollbarModes(d->m_hmode, d->m_vmode);
+    scrollbarModes(m_hmode, m_vmode);
 }
 
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     // FIXME: We need to update the scrollbar dynamically as documents change (or as doc elements and bodies get discovered that have custom styles).
     Document* doc = m_frame->document();
-    if (!doc)
-        return ScrollView::createScrollbar(orientation);
 
     // Try the <body> element first as a scrollbar source.
-    Element* body = doc->body();
-    if (body && body->renderer() && body->renderer()->style()->hasPseudoStyle(RenderStyle::SCROLLBAR))
-        return RenderScrollbar::createCustomScrollbar(this, orientation, body->renderer());
+    Element* body = doc ? doc->body() : 0;
+    if (body && body->renderer() && body->renderer()->style()->hasPseudoStyle(SCROLLBAR))
+        return RenderScrollbar::createCustomScrollbar(this, orientation, body->renderBox());
     
     // If the <body> didn't have a custom style, then the root element might.
-    Element* docElement = doc->documentElement();
-    if (docElement && docElement->renderer() && docElement->renderer()->style()->hasPseudoStyle(RenderStyle::SCROLLBAR))
-        return RenderScrollbar::createCustomScrollbar(this, orientation, docElement->renderer());
+    Element* docElement = doc ? doc->documentElement() : 0;
+    if (docElement && docElement->renderer() && docElement->renderer()->style()->hasPseudoStyle(SCROLLBAR))
+        return RenderScrollbar::createCustomScrollbar(this, orientation, docElement->renderBox());
         
     // If we have an owning iframe/frame element, then it can set the custom scrollbar also.
     RenderPart* frameRenderer = m_frame->ownerRenderer();
-    if (frameRenderer && frameRenderer->style()->hasPseudoStyle(RenderStyle::SCROLLBAR))
+    if (frameRenderer && frameRenderer->style()->hasPseudoStyle(SCROLLBAR))
         return RenderScrollbar::createCustomScrollbar(this, orientation, frameRenderer);
     
     // Nobody set a custom style, so we just use a native scrollbar.
@@ -352,6 +327,8 @@ PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientatio
 
 void FrameView::setContentsSize(const IntSize& size)
 {
+    m_deferSetNeedsLayouts++;
+
     ScrollView::setContentsSize(size);
 
     Page* page = frame() ? frame()->page() : 0;
@@ -359,6 +336,11 @@ void FrameView::setContentsSize(const IntSize& size)
         return;
 
     page->chrome()->contentsSizeChanged(frame(), size); //notify only
+    
+    m_deferSetNeedsLayouts--;
+    
+    if (!m_deferSetNeedsLayouts)
+        m_setNeedsLayoutWasDeferred = false; // FIXME: Find a way to make the deferred layout actually happen.
 }
 
 void FrameView::adjustViewSize()
@@ -406,31 +388,57 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
             ;
     }
 
-    d->m_viewportRenderer = o;
+    m_viewportRenderer = o;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void FrameView::updateCompositingLayers(CompositingUpdate updateType)
+{
+    RenderView* view = m_frame->contentRenderer();
+    if (!view || !view->usesCompositing())
+        return;
+
+    if (updateType == ForcedCompositingUpdate)
+        view->compositor()->setCompositingLayersNeedUpdate();
+    
+    view->compositor()->updateCompositingLayers();
 }
 
-int FrameView::layoutCount() const
+void FrameView::setNeedsOneShotDrawingSynchronization()
 {
-    return d->m_layoutCount;
+    Page* page = frame() ? frame()->page() : 0;
+    if (page)
+        page->chrome()->client()->setNeedsOneShotDrawingSynchronization();
 }
+#endif // USE(ACCELERATED_COMPOSITING)
 
-bool FrameView::needsFullRepaint() const
+void FrameView::didMoveOnscreen()
 {
-    return d->m_doFullRepaint;
+    RenderView* view = m_frame->contentRenderer();
+    if (view)
+        view->didMoveOnscreen();
+}
+
+void FrameView::willMoveOffscreen()
+{
+    RenderView* view = m_frame->contentRenderer();
+    if (view)
+        view->willMoveOffscreen();
 }
 
 RenderObject* FrameView::layoutRoot(bool onlyDuringLayout) const
 {
-    return onlyDuringLayout && layoutPending() ? 0 : d->m_layoutRoot;
+    return onlyDuringLayout && layoutPending() ? 0 : m_layoutRoot;
 }
 
 void FrameView::layout(bool allowSubtree)
 {
-    if (d->m_midLayout)
+    if (m_midLayout)
         return;
 
-    d->m_layoutTimer.stop();
-    d->m_delayedLayout = false;
+    m_layoutTimer.stop();
+    m_delayedLayout = false;
+    m_setNeedsLayoutWasDeferred = false;
 
     // Protect the view from being deleted during layout (in recalcStyle)
     RefPtr<FrameView> protector(this);
@@ -447,9 +455,9 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
-    if (!allowSubtree && d->m_layoutRoot) {
-        d->m_layoutRoot->markContainingBlocksForLayout(false);
-        d->m_layoutRoot = 0;
+    if (!allowSubtree && m_layoutRoot) {
+        m_layoutRoot->markContainingBlocksForLayout(false);
+        m_layoutRoot = 0;
     }
 
     ASSERT(m_frame->view() == this);
@@ -460,18 +468,13 @@ void FrameView::layout(bool allowSubtree)
         return;
 
     Document* document = m_frame->document();
-    if (!document) {
-        // FIXME: Should we set m_size.height here too?
-        m_size.setWidth(layoutWidth());
-        return;
-    }
 
-    d->m_layoutSchedulingEnabled = false;
+    m_layoutSchedulingEnabled = false;
 
-    if (!d->m_nestedLayoutCount && d->m_postLayoutTasksTimer.isActive()) {
+    if (!m_nestedLayoutCount && m_postLayoutTasksTimer.isActive()) {
         // This is a new top-level layout. If there are any remaining tasks from the previous
         // layout, finish them now.
-        d->m_postLayoutTasksTimer.stop();
+        m_postLayoutTasksTimer.stop();
         performPostLayoutTasks();
     }
 
@@ -484,27 +487,27 @@ void FrameView::layout(bool allowSubtree)
     // the layout beats any sort of style recalc update that needs to occur.
     if (m_frame->needsReapplyStyles())
         m_frame->reapplyStyles();
-    else if (document->hasChangedChild())
+    else if (document->childNeedsStyleRecalc())
         document->recalcStyle();
     
-    bool subtree = d->m_layoutRoot;
+    bool subtree = m_layoutRoot;
 
     // If there is only one ref to this view left, then its going to be destroyed as soon as we exit, 
     // so there's no point to continuing to layout
     if (protector->hasOneRef())
         return;
 
-    RenderObject* root = subtree ? d->m_layoutRoot : document->renderer();
+    RenderObject* root = subtree ? m_layoutRoot : document->renderer();
     if (!root) {
         // FIXME: Do we need to set m_size here?
-        d->m_layoutSchedulingEnabled = true;
+        m_layoutSchedulingEnabled = true;
         return;
     }
 
-    d->m_nestedLayoutCount++;
+    m_nestedLayoutCount++;
 
-    ScrollbarMode hMode = d->m_hmode;
-    ScrollbarMode vMode = d->m_vmode;
+    ScrollbarMode hMode = m_hmode;
+    ScrollbarMode vMode = m_vmode;
 
     if (!subtree) {
         RenderObject* rootRenderer = document->documentElement() ? document->documentElement()->renderer() : 0;
@@ -515,8 +518,8 @@ void FrameView::layout(bool allowSubtree)
                 vMode = ScrollbarAlwaysOff;
                 hMode = ScrollbarAlwaysOff;
             } else if (body->hasTagName(bodyTag)) {
-                if (!d->m_firstLayout && m_size.height() != layoutHeight()
-                        && static_cast<RenderBox*>(body->renderer())->stretchesToViewHeight())
+                if (!m_firstLayout && m_size.height() != layoutHeight()
+                        && toRenderBox(body->renderer())->stretchesToViewHeight())
                     body->renderer()->setChildNeedsLayout(true);
                 // It's sufficient to just check the X overflow,
                 // since it's illegal to have visible in only one direction.
@@ -526,25 +529,25 @@ void FrameView::layout(bool allowSubtree)
         } else if (rootRenderer)
             applyOverflowToViewport(rootRenderer, hMode, vMode);
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
-        if (d->m_firstLayout && !document->ownerElement())
+        if (m_firstLayout && !document->ownerElement())
             printf("Elapsed time before first layout: %d\n", document->elapsedTime());
 #endif
     }
 
-    d->m_doFullRepaint = !subtree && (d->m_firstLayout || static_cast<RenderView*>(root)->printing());
+    m_doFullRepaint = !subtree && (m_firstLayout || toRenderView(root)->printing());
 
     if (!subtree) {
         // Now set our scrollbar state for the layout.
         ScrollbarMode currentHMode = horizontalScrollbarMode();
         ScrollbarMode currentVMode = verticalScrollbarMode();
 
-        if (d->m_firstLayout || (hMode != currentHMode || vMode != currentVMode)) {
+        if (m_firstLayout || (hMode != currentHMode || vMode != currentVMode)) {
             setScrollbarsSuppressed(true);
-            if (d->m_firstLayout) {
-                d->m_firstLayout = false;
-                d->m_firstLayoutCallbackPending = true;
-                d->m_lastLayoutSize = IntSize(width(), height());
-                d->m_lastZoomFactor = root->style()->zoom();
+            if (m_firstLayout) {
+                m_firstLayout = false;
+                m_firstLayoutCallbackPending = true;
+                m_lastLayoutSize = IntSize(width(), height());
+                m_lastZoomFactor = root->style()->zoom();
 
                 // Set the initial vMode to AlwaysOn if we're auto.
                 if (vMode == ScrollbarAuto)
@@ -562,7 +565,7 @@ void FrameView::layout(bool allowSubtree)
         m_size = IntSize(layoutWidth(), layoutHeight());
 
         if (oldSize != m_size)
-            d->m_doFullRepaint = true;
+            m_doFullRepaint = true;
     }
 
     RenderLayer* layer = root->enclosingLayer();
@@ -572,33 +575,37 @@ void FrameView::layout(bool allowSubtree)
     if (subtree)
         root->view()->pushLayoutState(root);
         
-    d->m_midLayout = true;
+    m_midLayout = true;
     beginDeferredRepaints();
     root->layout();
     endDeferredRepaints();
-    d->m_midLayout = false;
+    m_midLayout = false;
 
     if (subtree)
         root->view()->popLayoutState();
-    d->m_layoutRoot = 0;
+    m_layoutRoot = 0;
 
     m_frame->invalidateSelection();
    
-    d->m_layoutSchedulingEnabled = true;
+    m_layoutSchedulingEnabled = true;
 
-    if (!subtree && !static_cast<RenderView*>(root)->printing())
+    if (!subtree && !toRenderView(root)->printing())
         adjustViewSize();
 
     // Now update the positions of all layers.
     beginDeferredRepaints();
-    layer->updateLayerPositions(d->m_doFullRepaint);
+    layer->updateLayerPositions(m_doFullRepaint);
     endDeferredRepaints();
+
+#if USE(ACCELERATED_COMPOSITING)
+    updateCompositingLayers();
+#endif
     
-    d->m_layoutCount++;
+    m_layoutCount++;
 
 #if PLATFORM(MAC)
     if (AXObjectCache::accessibilityEnabled())
-        root->document()->axObjectCache()->postNotificationToElement(root, "AXLayoutComplete");
+        root->document()->axObjectCache()->postNotification(root, "AXLayoutComplete", true);
 #endif
 #if ENABLE(DASHBOARD_SUPPORT)
     updateDashboardRegions();
@@ -612,24 +619,27 @@ void FrameView::layout(bool allowSubtree)
         updateOverflowStatus(layoutWidth() < contentsWidth(),
                              layoutHeight() < contentsHeight());
 
-    if (!d->m_postLayoutTasksTimer.isActive()) {
+    if (!m_postLayoutTasksTimer.isActive()) {
         // Calls resumeScheduledEvents()
         performPostLayoutTasks();
 
-        if (needsLayout()) {
+        if (!m_postLayoutTasksTimer.isActive() && needsLayout()) {
             // Post-layout widget updates or an event handler made us need layout again.
             // Lay out again, but this time defer widget updates and event dispatch until after
             // we return.
-            d->m_postLayoutTasksTimer.startOneShot(0);
+            m_postLayoutTasksTimer.startOneShot(0);
             pauseScheduledEvents();
             layout();
         }
     } else {
         resumeScheduledEvents();
-        ASSERT(d->m_enqueueEvents);
+        ASSERT(m_enqueueEvents);
     }
 
-    d->m_nestedLayoutCount--;
+    if (lockedToAnchor())
+        m_frame->loader()->gotoAnchor();
+
+    m_nestedLayoutCount--;
 }
 
 void FrameView::addWidgetToUpdate(RenderPartObject* object)
@@ -650,7 +660,7 @@ void FrameView::removeWidgetToUpdate(RenderPartObject* object)
 
 void FrameView::setMediaType(const String& mediaType)
 {
-    d->m_mediaType = mediaType;
+    m_mediaType = mediaType;
 }
 
 String FrameView::mediaType() const
@@ -659,33 +669,51 @@ String FrameView::mediaType() const
     String overrideType = m_frame->loader()->client()->overrideMediaType();
     if (!overrideType.isNull())
         return overrideType;
-    return d->m_mediaType;
+    return m_mediaType;
 }
 
 bool FrameView::useSlowRepaints() const
 {
-    return d->m_useSlowRepaints || d->m_slowRepaintObjectCount > 0;
+    return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || m_isOverlapped || !m_contentIsOpaque;
 }
 
 void FrameView::setUseSlowRepaints()
 {
-    d->m_useSlowRepaints = true;
+    m_useSlowRepaints = true;
     setCanBlitOnScroll(false);
 }
 
 void FrameView::addSlowRepaintObject()
 {
-    if (!d->m_slowRepaintObjectCount)
+    if (!m_slowRepaintObjectCount)
         setCanBlitOnScroll(false);
-    d->m_slowRepaintObjectCount++;
+    m_slowRepaintObjectCount++;
 }
 
 void FrameView::removeSlowRepaintObject()
 {
-    ASSERT(d->m_slowRepaintObjectCount > 0);
-    d->m_slowRepaintObjectCount--;
-    if (!d->m_slowRepaintObjectCount)
-        setCanBlitOnScroll(!d->m_useSlowRepaints);
+    ASSERT(m_slowRepaintObjectCount > 0);
+    m_slowRepaintObjectCount--;
+    if (!m_slowRepaintObjectCount)
+        setCanBlitOnScroll(!useSlowRepaints());
+}
+
+void FrameView::setIsOverlapped(bool isOverlapped)
+{
+    if (isOverlapped == m_isOverlapped)
+        return;
+
+    m_isOverlapped = isOverlapped;
+    setCanBlitOnScroll(!useSlowRepaints());
+}
+
+void FrameView::setContentIsOpaque(bool contentIsOpaque)
+{
+    if (contentIsOpaque == m_contentIsOpaque)
+        return;
+
+    m_contentIsOpaque = contentIsOpaque;
+    setCanBlitOnScroll(!useSlowRepaints());
 }
 
 void FrameView::restoreScrollbar()
@@ -695,18 +723,20 @@ void FrameView::restoreScrollbar()
 
 void FrameView::scrollRectIntoViewRecursively(const IntRect& r)
 {
-    bool wasInProgrammaticScroll = d->m_inProgrammaticScroll;
-    d->m_inProgrammaticScroll = true;
+    bool wasInProgrammaticScroll = m_inProgrammaticScroll;
+    m_inProgrammaticScroll = true;
+    setLockedToAnchor(false);
     ScrollView::scrollRectIntoViewRecursively(r);
-    d->m_inProgrammaticScroll = wasInProgrammaticScroll;
+    m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
 
 void FrameView::setScrollPosition(const IntPoint& scrollPoint)
 {
-    bool wasInProgrammaticScroll = d->m_inProgrammaticScroll;
-    d->m_inProgrammaticScroll = true;
+    bool wasInProgrammaticScroll = m_inProgrammaticScroll;
+    m_inProgrammaticScroll = true;
+    setLockedToAnchor(false);
     ScrollView::setScrollPosition(scrollPoint);
-    d->m_inProgrammaticScroll = wasInProgrammaticScroll;
+    m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
 
 HostWindow* FrameView::hostWindow() const
@@ -723,17 +753,27 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
 {
     ASSERT(!m_frame->document()->ownerElement());
 
-    if (d->m_deferringRepaints && !immediate) {
+    double delay = adjustedDeferredRepaintDelay();
+    if ((m_deferringRepaints || m_deferredRepaintTimer.isActive() || delay) && !immediate) {
         IntRect visibleContent = visibleContentRect();
         visibleContent.intersect(r);
-        if (!visibleContent.isEmpty()) {
-            d->m_repaintCount++;
-            d->m_repaintRect.unite(r);
-            if (d->m_repaintCount == cRepaintRectUnionThreshold)
-                d->m_repaintRects.clear();
-            else if (d->m_repaintCount < cRepaintRectUnionThreshold)
-                d->m_repaintRects.append(r);
+        if (visibleContent.isEmpty())
+            return;
+        if (m_repaintCount == cRepaintRectUnionThreshold) {
+            IntRect unionedRect;
+            for (unsigned i = 0; i < cRepaintRectUnionThreshold; ++i)
+                unionedRect.unite(m_repaintRects[i]);
+            m_repaintRects.clear();
+            m_repaintRects.append(unionedRect);
         }
+        if (m_repaintCount < cRepaintRectUnionThreshold)
+            m_repaintRects.append(r);
+        else
+            m_repaintRects[0].unite(r);
+        m_repaintCount++;
+    
+        if (!m_deferringRepaints && !m_deferredRepaintTimer.isActive())
+             m_deferredRepaintTimer.startOneShot(delay);
         return;
     }
     
@@ -749,10 +789,7 @@ void FrameView::beginDeferredRepaints()
     if (page->mainFrame() != m_frame)
         return page->mainFrame()->view()->beginDeferredRepaints();
 
-    d->m_deferringRepaints++;
-    d->m_repaintCount = 0;
-    d->m_repaintRect = IntRect();
-    d->m_repaintRects.clear();
+    m_deferringRepaints++;
 }
 
 
@@ -762,23 +799,94 @@ void FrameView::endDeferredRepaints()
     if (page->mainFrame() != m_frame)
         return page->mainFrame()->view()->endDeferredRepaints();
 
-    ASSERT(d->m_deferringRepaints > 0);
-    if (--d->m_deferringRepaints == 0) {
-        if (d->m_repaintCount >= cRepaintRectUnionThreshold)
-            repaintContentRectangle(d->m_repaintRect, false);
-        else {
-            unsigned size = d->m_repaintRects.size();
-            for (unsigned i = 0; i < size; i++)
-                repaintContentRectangle(d->m_repaintRects[i], false);
-            d->m_repaintRects.clear();
-        }
+    ASSERT(m_deferringRepaints > 0);
+
+    if (--m_deferringRepaints)
+        return;
+    
+    if (m_deferredRepaintTimer.isActive())
+        return;
+
+    if (double delay = adjustedDeferredRepaintDelay()) {
+        m_deferredRepaintTimer.startOneShot(delay);
+        return;
     }
+    
+    doDeferredRepaints();
+}
+
+void FrameView::checkStopDelayingDeferredRepaints()
+{
+    if (!m_deferredRepaintTimer.isActive())
+        return;
+
+    Document* document = m_frame->document();
+    if (document && (document->parsing() || document->docLoader()->requestCount()))
+        return;
+    
+    m_deferredRepaintTimer.stop();
+
+    doDeferredRepaints();
+}
+    
+void FrameView::doDeferredRepaints()
+{
+    ASSERT(!m_deferringRepaints);
+    if (isOffscreen() && !shouldUpdateWhileOffscreen()) {
+        m_repaintRects.clear();
+        m_repaintCount = 0;
+        return;
+    }
+    unsigned size = m_repaintRects.size();
+    for (unsigned i = 0; i < size; i++)
+        ScrollView::repaintContentRectangle(m_repaintRects[i], false);
+    m_repaintRects.clear();
+    m_repaintCount = 0;
+    
+    updateDeferredRepaintDelay();
+}
+
+void FrameView::updateDeferredRepaintDelay()
+{
+    Document* document = m_frame->document();
+    if (!document || (!document->parsing() && !document->docLoader()->requestCount())) {
+        m_deferredRepaintDelay = deferredRepaintDelay;
+        return;
+    }
+    if (m_deferredRepaintDelay < maxDeferredRepaintDelayDuringLoading) {
+        m_deferredRepaintDelay += deferredRepaintDelayIncrementDuringLoading;
+        if (m_deferredRepaintDelay > maxDeferredRepaintDelayDuringLoading)
+            m_deferredRepaintDelay = maxDeferredRepaintDelayDuringLoading;
+    }
+}
+
+void FrameView::resetDeferredRepaintDelay()
+{
+    m_deferredRepaintDelay = 0;
+    if (m_deferredRepaintTimer.isActive()) {
+        m_deferredRepaintTimer.stop();
+        if (!m_deferringRepaints)
+            doDeferredRepaints();
+    }
+}
+
+double FrameView::adjustedDeferredRepaintDelay() const
+{
+    if (!m_deferredRepaintDelay)
+        return 0;
+    double timeSinceLastPaint = currentTime() - m_lastPaintTime;
+    return max(0., m_deferredRepaintDelay - timeSinceLastPaint);
 }
+    
+void FrameView::deferredRepaintTimerFired(Timer<FrameView>*)
+{
+    doDeferredRepaints();
+}    
 
 void FrameView::layoutTimerFired(Timer<FrameView>*)
 {
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
-    if (m_frame->document() && !m_frame->document()->ownerElement())
+    if (!m_frame->document()->ownerElement())
         printf("Layout timer fired at %d\n", m_frame->document()->elapsedTime());
 #endif
     layout();
@@ -786,34 +894,34 @@ void FrameView::layoutTimerFired(Timer<FrameView>*)
 
 void FrameView::scheduleRelayout()
 {
-    ASSERT(!m_frame->document() || !m_frame->document()->inPageCache());
+    ASSERT(!m_frame->document()->inPageCache());
     ASSERT(m_frame->view() == this);
 
-    if (d->m_layoutRoot) {
-        d->m_layoutRoot->markContainingBlocksForLayout(false);
-        d->m_layoutRoot = 0;
+    if (m_layoutRoot) {
+        m_layoutRoot->markContainingBlocksForLayout(false);
+        m_layoutRoot = 0;
     }
-    if (!d->m_layoutSchedulingEnabled)
+    if (!m_layoutSchedulingEnabled)
         return;
     if (!needsLayout())
         return;
-    if (!m_frame->document() || !m_frame->document()->shouldScheduleLayout())
+    if (!m_frame->document()->shouldScheduleLayout())
         return;
 
     int delay = m_frame->document()->minimumLayoutDelay();
-    if (d->m_layoutTimer.isActive() && d->m_delayedLayout && !delay)
+    if (m_layoutTimer.isActive() && m_delayedLayout && !delay)
         unscheduleRelayout();
-    if (d->m_layoutTimer.isActive())
+    if (m_layoutTimer.isActive())
         return;
 
-    d->m_delayedLayout = delay != 0;
+    m_delayedLayout = delay != 0;
 
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!m_frame->document()->ownerElement())
         printf("Scheduling layout for %d\n", delay);
 #endif
 
-    d->m_layoutTimer.startOneShot(delay * 0.001);
+    m_layoutTimer.startOneShot(delay * 0.001);
 }
 
 static bool isObjectAncestorContainerOf(RenderObject* ancestor, RenderObject* descendant)
@@ -829,7 +937,7 @@ void FrameView::scheduleRelayoutOfSubtree(RenderObject* relayoutRoot)
 {
     ASSERT(m_frame->view() == this);
 
-    if (!d->m_layoutSchedulingEnabled || (m_frame->contentRenderer()
+    if (!m_layoutSchedulingEnabled || (m_frame->contentRenderer()
             && m_frame->contentRenderer()->needsLayout())) {
         if (relayoutRoot)
             relayoutRoot->markContainingBlocksForLayout(false);
@@ -837,33 +945,33 @@ void FrameView::scheduleRelayoutOfSubtree(RenderObject* relayoutRoot)
     }
 
     if (layoutPending()) {
-        if (d->m_layoutRoot != relayoutRoot) {
-            if (isObjectAncestorContainerOf(d->m_layoutRoot, relayoutRoot)) {
+        if (m_layoutRoot != relayoutRoot) {
+            if (isObjectAncestorContainerOf(m_layoutRoot, relayoutRoot)) {
                 // Keep the current root
-                relayoutRoot->markContainingBlocksForLayout(false, d->m_layoutRoot);
-            } else if (d->m_layoutRoot && isObjectAncestorContainerOf(relayoutRoot, d->m_layoutRoot)) {
+                relayoutRoot->markContainingBlocksForLayout(false, m_layoutRoot);
+            } else if (m_layoutRoot && isObjectAncestorContainerOf(relayoutRoot, m_layoutRoot)) {
                 // Re-root at relayoutRoot
-                d->m_layoutRoot->markContainingBlocksForLayout(false, relayoutRoot);
-                d->m_layoutRoot = relayoutRoot;
+                m_layoutRoot->markContainingBlocksForLayout(false, relayoutRoot);
+                m_layoutRoot = relayoutRoot;
             } else {
                 // Just do a full relayout
-                if (d->m_layoutRoot)
-                    d->m_layoutRoot->markContainingBlocksForLayout(false);
-                d->m_layoutRoot = 0;
+                if (m_layoutRoot)
+                    m_layoutRoot->markContainingBlocksForLayout(false);
+                m_layoutRoot = 0;
                 relayoutRoot->markContainingBlocksForLayout(false);
             }
         }
     } else {
         int delay = m_frame->document()->minimumLayoutDelay();
-        d->m_layoutRoot = relayoutRoot;
-        d->m_delayedLayout = delay != 0;
-        d->m_layoutTimer.startOneShot(delay * 0.001);
+        m_layoutRoot = relayoutRoot;
+        m_delayedLayout = delay != 0;
+        m_layoutTimer.startOneShot(delay * 0.001);
     }
 }
 
 bool FrameView::layoutPending() const
 {
-    return d->m_layoutTimer.isActive();
+    return m_layoutTimer.isActive();
 }
 
 bool FrameView::needsLayout() const
@@ -877,13 +985,18 @@ bool FrameView::needsLayout() const
     Document* document = m_frame->document();
     return layoutPending()
         || (root && root->needsLayout())
-        || d->m_layoutRoot
-        || (document && document->hasChangedChild()) // can occur when using WebKit ObjC interface
-        || m_frame->needsReapplyStyles();
+        || m_layoutRoot
+        || (document && document->childNeedsStyleRecalc()) // can occur when using WebKit ObjC interface
+        || m_frame->needsReapplyStyles()
+        || (m_deferSetNeedsLayouts && m_setNeedsLayoutWasDeferred);
 }
 
 void FrameView::setNeedsLayout()
 {
+    if (m_deferSetNeedsLayouts) {
+        m_setNeedsLayoutWasDeferred = true;
+        return;
+    }
     RenderView* root = m_frame->contentRenderer();
     if (root)
         root->setNeedsLayout(true);
@@ -891,38 +1004,38 @@ void FrameView::setNeedsLayout()
 
 void FrameView::unscheduleRelayout()
 {
-    if (!d->m_layoutTimer.isActive())
+    if (!m_layoutTimer.isActive())
         return;
 
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
-    if (m_frame->document() && !m_frame->document()->ownerElement())
+    if (!m_frame->document()->ownerElement())
         printf("Layout timer unscheduled at %d\n", m_frame->document()->elapsedTime());
 #endif
     
-    d->m_layoutTimer.stop();
-    d->m_delayedLayout = false;
+    m_layoutTimer.stop();
+    m_delayedLayout = false;
 }
 
 bool FrameView::isTransparent() const
 {
-    return d->m_isTransparent;
+    return m_isTransparent;
 }
 
 void FrameView::setTransparent(bool isTransparent)
 {
-    d->m_isTransparent = isTransparent;
+    m_isTransparent = isTransparent;
 }
 
 Color FrameView::baseBackgroundColor() const
 {
-    return d->m_baseBackgroundColor;
+    return m_baseBackgroundColor;
 }
 
 void FrameView::setBaseBackgroundColor(Color bc)
 {
     if (!bc.isValid())
         bc = Color::white;
-    d->m_baseBackgroundColor = bc;
+    m_baseBackgroundColor = bc;
 }
 
 void FrameView::updateBackgroundRecursively(const Color& backgroundColor, bool transparent)
@@ -939,17 +1052,17 @@ void FrameView::updateBackgroundRecursively(const Color& backgroundColor, bool t
 
 bool FrameView::shouldUpdateWhileOffscreen() const
 {
-    return d->m_shouldUpdateWhileOffscreen;
+    return m_shouldUpdateWhileOffscreen;
 }
 
 void FrameView::setShouldUpdateWhileOffscreen(bool shouldUpdateWhileOffscreen)
 {
-    d->m_shouldUpdateWhileOffscreen = shouldUpdateWhileOffscreen;
+    m_shouldUpdateWhileOffscreen = shouldUpdateWhileOffscreen;
 }
 
-void FrameView::scheduleEvent(PassRefPtr<Event> event, PassRefPtr<EventTargetNode> eventTarget)
+void FrameView::scheduleEvent(PassRefPtr<Event> event, PassRefPtr<Node> eventTarget)
 {
-    if (!d->m_enqueueEvents) {
+    if (!m_enqueueEvents) {
         ExceptionCode ec = 0;
         eventTarget->dispatchEvent(event, ec);
         return;
@@ -958,64 +1071,77 @@ void FrameView::scheduleEvent(PassRefPtr<Event> event, PassRefPtr<EventTargetNod
     ScheduledEvent* scheduledEvent = new ScheduledEvent;
     scheduledEvent->m_event = event;
     scheduledEvent->m_eventTarget = eventTarget;
-    d->m_scheduledEvents.append(scheduledEvent);
+    m_scheduledEvents.append(scheduledEvent);
 }
 
 void FrameView::pauseScheduledEvents()
 {
-    ASSERT(d->m_scheduledEvents.isEmpty() || d->m_enqueueEvents);
-    d->m_enqueueEvents++;
+    ASSERT(m_scheduledEvents.isEmpty() || m_enqueueEvents);
+    m_enqueueEvents++;
 }
 
 void FrameView::resumeScheduledEvents()
 {
-    d->m_enqueueEvents--;
-    if (!d->m_enqueueEvents)
+    m_enqueueEvents--;
+    if (!m_enqueueEvents)
         dispatchScheduledEvents();
-    ASSERT(d->m_scheduledEvents.isEmpty() || d->m_enqueueEvents);
+    ASSERT(m_scheduledEvents.isEmpty() || m_enqueueEvents);
 }
 
+bool FrameView::updateWidgets()
+{
+    if (m_nestedLayoutCount > 1 || !m_widgetUpdateSet || m_widgetUpdateSet->isEmpty())
+        return true;
+    
+    Vector<RenderPartObject*> objectVector;
+    copyToVector(*m_widgetUpdateSet, objectVector);
+    size_t size = objectVector.size();
+    for (size_t i = 0; i < size; ++i) {
+        RenderPartObject* object = objectVector[i];
+        object->updateWidget(false);
+        
+        // updateWidget() can destroy the RenderPartObject, so we need to make sure it's
+        // alive by checking if it's still in m_widgetUpdateSet.
+        if (m_widgetUpdateSet->contains(object)) {
+            object->updateWidgetPosition();
+            m_widgetUpdateSet->remove(object);
+        }
+    }
+    
+    return m_widgetUpdateSet->isEmpty();
+}
+    
 void FrameView::performPostLayoutTasks()
 {
-    if (d->m_firstLayoutCallbackPending) {
-        d->m_firstLayoutCallbackPending = false;
+    if (m_firstLayoutCallbackPending) {
+        m_firstLayoutCallbackPending = false;
         m_frame->loader()->didFirstLayout();
     }
 
-    if (d->m_isVisuallyNonEmpty && d->m_firstVisuallyNonEmptyLayoutCallbackPending) {
-        d->m_firstVisuallyNonEmptyLayoutCallbackPending = false;
+    if (m_isVisuallyNonEmpty && m_firstVisuallyNonEmptyLayoutCallbackPending) {
+        m_firstVisuallyNonEmptyLayoutCallbackPending = false;
         m_frame->loader()->didFirstVisuallyNonEmptyLayout();
     }
 
     RenderView* root = m_frame->contentRenderer();
 
     root->updateWidgetPositions();
-    if (m_widgetUpdateSet && d->m_nestedLayoutCount <= 1) {
-        Vector<RenderPartObject*> objectVector;
-        copyToVector(*m_widgetUpdateSet, objectVector);
-        size_t size = objectVector.size();
-        for (size_t i = 0; i < size; ++i) {
-            RenderPartObject* object = objectVector[i];
-            object->updateWidget(false);
-
-            // updateWidget() can destroy the RenderPartObject, so we need to make sure it's
-            // alive by checking if it's still in m_widgetUpdateSet.
-            if (m_widgetUpdateSet->contains(object))
-                object->updateWidgetPosition();
-        }
-        m_widgetUpdateSet->clear();
+    
+    for (unsigned i = 0; i < maxUpdateWidgetsIterations; i++) {
+        if (updateWidgets())
+            break;
     }
-
+    
     resumeScheduledEvents();
 
     if (!root->printing()) {
         IntSize currentSize = IntSize(width(), height());
         float currentZoomFactor = root->style()->zoom();
-        bool resized = !d->m_firstLayout && (currentSize != d->m_lastLayoutSize || currentZoomFactor != d->m_lastZoomFactor);
-        d->m_lastLayoutSize = currentSize;
-        d->m_lastZoomFactor = currentZoomFactor;
+        bool resized = !m_firstLayout && (currentSize != m_lastLayoutSize || currentZoomFactor != m_lastZoomFactor);
+        m_lastLayoutSize = currentSize;
+        m_lastZoomFactor = currentZoomFactor;
         if (resized)
-            m_frame->sendResizeEvent();
+            m_frame->eventHandler()->sendResizeEvent();
     }
 }
 
@@ -1026,37 +1152,37 @@ void FrameView::postLayoutTimerFired(Timer<FrameView>*)
 
 void FrameView::updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow)
 {
-    if (!d->m_viewportRenderer)
+    if (!m_viewportRenderer)
         return;
     
-    if (d->m_overflowStatusDirty) {
-        d->m_horizontalOverflow = horizontalOverflow;
-        d->m_verticalOverflow = verticalOverflow;
-        d->m_overflowStatusDirty = false;
+    if (m_overflowStatusDirty) {
+        m_horizontalOverflow = horizontalOverflow;
+        m_verticalOverflow = verticalOverflow;
+        m_overflowStatusDirty = false;
         return;
     }
     
-    bool horizontalOverflowChanged = (d->m_horizontalOverflow != horizontalOverflow);
-    bool verticalOverflowChanged = (d->m_verticalOverflow != verticalOverflow);
+    bool horizontalOverflowChanged = (m_horizontalOverflow != horizontalOverflow);
+    bool verticalOverflowChanged = (m_verticalOverflow != verticalOverflow);
     
     if (horizontalOverflowChanged || verticalOverflowChanged) {
-        d->m_horizontalOverflow = horizontalOverflow;
-        d->m_verticalOverflow = verticalOverflow;
+        m_horizontalOverflow = horizontalOverflow;
+        m_verticalOverflow = verticalOverflow;
         
         scheduleEvent(OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow,
             verticalOverflowChanged, verticalOverflow),
-            EventTargetNodeCast(d->m_viewportRenderer->element()));
+            m_viewportRenderer->node());
     }
     
 }
 
 void FrameView::dispatchScheduledEvents()
 {
-    if (d->m_scheduledEvents.isEmpty())
+    if (m_scheduledEvents.isEmpty())
         return;
 
-    Vector<ScheduledEvent*> scheduledEventsCopy = d->m_scheduledEvents;
-    d->m_scheduledEvents.clear();
+    Vector<ScheduledEvent*> scheduledEventsCopy = m_scheduledEvents;
+    m_scheduledEvents.clear();
     
     Vector<ScheduledEvent*>::iterator end = scheduledEventsCopy.end();
     for (Vector<ScheduledEvent*>::iterator it = scheduledEventsCopy.begin(); it != end; ++it) {
@@ -1078,7 +1204,7 @@ IntRect FrameView::windowClipRect(bool clipToContents) const
 
     // Set our clip rect to be our contents.
     IntRect clipRect = contentsToWindow(visibleContentRect(!clipToContents));
-    if (!m_frame || !m_frame->document() || !m_frame->document()->ownerElement())
+    if (!m_frame || !m_frame->document()->ownerElement())
         return clipRect;
 
     // Take our owner element and get the clip rect from the enclosing layer.
@@ -1120,7 +1246,7 @@ void FrameView::valueChanged(Scrollbar* bar)
     IntSize offset = scrollOffset();
     ScrollView::valueChanged(bar);
     if (offset != scrollOffset())
-        frame()->sendScrollEvent();
+        frame()->eventHandler()->sendScrollEvent();
 }
 
 void FrameView::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
@@ -1151,7 +1277,7 @@ void FrameView::updateDashboardRegions()
     if (!document->hasDashboardRegions())
         return;
     Vector<DashboardRegionValue> newRegions;
-    document->renderer()->collectDashboardRegions(newRegions);
+    document->renderBox()->collectDashboardRegions(newRegions);
     if (newRegions == document->dashboardRegions())
         return;
     document->setDashboardRegions(newRegions);
@@ -1188,14 +1314,15 @@ void FrameView::updateControlTints()
 
 bool FrameView::wasScrolledByUser() const
 {
-    return d->m_wasScrolledByUser;
+    return m_wasScrolledByUser;
 }
 
 void FrameView::setWasScrolledByUser(bool wasScrolledByUser)
 {
-    if (d->m_inProgrammaticScroll)
+    if (m_inProgrammaticScroll)
         return;
-    d->m_wasScrolledByUser = wasScrolledByUser;
+    setLockedToAnchor(false);
+    m_wasScrolledByUser = wasScrolledByUser;
 }
 
 void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
@@ -1204,20 +1331,18 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         return;
     
     Document* document = frame()->document();
-    if (!document)
-        return;
 
 #ifndef NDEBUG
     bool fillWithRed;
-    if (document || document->printing())
+    if (document->printing())
         fillWithRed = false; // Printing, don't fill with red (can't remember why).
     else if (document->ownerElement())
         fillWithRed = false; // Subframe, don't fill with red.
     else if (isTransparent())
         fillWithRed = false; // Transparent, don't fill with red.
-    else if (d->m_paintRestriction == PaintRestrictionSelectionOnly || d->m_paintRestriction == PaintRestrictionSelectionOnlyBlackText)
+    else if (m_paintRestriction == PaintRestrictionSelectionOnly || m_paintRestriction == PaintRestrictionSelectionOnlyBlackText)
         fillWithRed = false; // Selections are transparent, don't fill with red.
-    else if (d->m_nodeToDraw)
+    else if (m_nodeToDraw)
         fillWithRed = false; // Element images are transparent, don't fill with red.
     else
         fillWithRed = true;
@@ -1237,17 +1362,21 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     }
 
     ASSERT(!needsLayout());
-    ASSERT(!d->m_isPainting);
+    if (needsLayout())
+        return;
+
+    ASSERT(!m_isPainting);
         
-    d->m_isPainting = true;
+    m_isPainting = true;
         
     // m_nodeToDraw is used to draw only one element (and its descendants)
-    RenderObject* eltRenderer = d->m_nodeToDraw ? d->m_nodeToDraw->renderer() : 0;
-    if (d->m_paintRestriction == PaintRestrictionNone)
+    RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw->renderer() : 0;
+    if (m_paintRestriction == PaintRestrictionNone)
         document->invalidateRenderedRectsForMarkersInRect(rect);
-    contentRenderer->layer()->paint(p, rect, d->m_paintRestriction, eltRenderer);
-        
-    d->m_isPainting = false;
+    contentRenderer->layer()->paint(p, rect, m_paintRestriction, eltRenderer);
+    
+    m_isPainting = false;
+    m_lastPaintTime = currentTime();
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // Regions may have changed as a result of the visibility/z-index of element changing.
@@ -1261,17 +1390,17 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 
 void FrameView::setPaintRestriction(PaintRestriction pr)
 {
-    d->m_paintRestriction = pr;
+    m_paintRestriction = pr;
 }
     
 bool FrameView::isPainting() const
 {
-    return d->m_isPainting;
+    return m_isPainting;
 }
 
 void FrameView::setNodeToDraw(Node* node)
 {
-    d->m_nodeToDraw = node;
+    m_nodeToDraw = node;
 }
 
 void FrameView::layoutIfNeededRecursive()
@@ -1293,11 +1422,69 @@ void FrameView::layoutIfNeededRecursive()
     for (HashSet<Widget*>::const_iterator current = viewChildren->begin(); current != end; ++current)
         if ((*current)->isFrameView())
             static_cast<FrameView*>(*current)->layoutIfNeededRecursive();
+
+    // layoutIfNeededRecursive is called when we need to make sure layout is up-to-date before
+    // painting, so we need to flush out any deferred repaints too.
+    if (m_deferredRepaintTimer.isActive()) {
+        m_deferredRepaintTimer.stop();
+        doDeferredRepaints();
+    }
 }
 
-void FrameView::setIsVisuallyNonEmpty()
+void FrameView::forceLayout(bool allowSubtree)
+{
+    layout(allowSubtree);
+    // We cannot unschedule a pending relayout, since the force can be called with
+    // a tiny rectangle from a drawRect update.  By unscheduling we in effect
+    // "validate" and stop the necessary full repaint from occurring.  Basically any basic
+    // append/remove DHTML is broken by this call.  For now, I have removed the optimization
+    // until we have a better invalidation stategy. -dwh
+    //unscheduleRelayout();
+}
+
+void FrameView::forceLayoutWithPageWidthRange(float minPageWidth, float maxPageWidth, bool _adjustViewSize)
+{
+    // Dumping externalRepresentation(m_frame->renderer()).ascii() is a good trick to see
+    // the state of things before and after the layout
+    RenderView *root = toRenderView(m_frame->document()->renderer());
+    if (root) {
+        // This magic is basically copied from khtmlview::print
+        int pageW = (int)ceilf(minPageWidth);
+        root->setWidth(pageW);
+        root->setNeedsLayoutAndPrefWidthsRecalc();
+        forceLayout();
+
+        // If we don't fit in the minimum page width, we'll lay out again. If we don't fit in the
+        // maximum page width, we will lay out to the maximum page width and clip extra content.
+        // FIXME: We are assuming a shrink-to-fit printing implementation.  A cropping
+        // implementation should not do this!
+        int rightmostPos = root->rightmostPosition();
+        if (rightmostPos > minPageWidth) {
+            pageW = std::min(rightmostPos, (int)ceilf(maxPageWidth));
+            root->setWidth(pageW);
+            root->setNeedsLayoutAndPrefWidthsRecalc();
+            forceLayout();
+        }
+    }
+
+    if (_adjustViewSize)
+        adjustViewSize();
+}
+
+void FrameView::adjustPageHeight(float *newBottom, float oldTop, float oldBottom, float /*bottomLimit*/)
 {
-    d->m_isVisuallyNonEmpty = true;
+    RenderView* root = m_frame->contentRenderer();
+    if (root) {
+        // Use a context with painting disabled.
+        GraphicsContext context((PlatformGraphicsContext*)0);
+        root->setTruncatedAt((int)floorf(oldBottom));
+        IntRect dirtyRect(0, (int)floorf(oldTop), root->overflowWidth(), (int)ceilf(oldBottom - oldTop));
+        root->layer()->paint(&context, dirtyRect);
+        *newBottom = root->bestTruncatedAt();
+        if (*newBottom == 0)
+            *newBottom = oldBottom;
+    } else
+        *newBottom = oldBottom;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.h b/src/3rdparty/webkit/WebCore/page/FrameView.h
index 03de174f0a..16eadc500e 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.h
@@ -4,7 +4,7 @@
              (C) 1998, 1999 Torben Weis (weis@kde.org)
              (C) 1999 Lars Knoll (knoll@kde.org)
              (C) 1999 Antti Koivisto (koivisto@kde.org)
-   Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+   Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Library General Public
@@ -35,25 +35,25 @@ namespace WebCore {
 
 class Color;
 class Event;
-class EventTargetNode;
 class Frame;
 class FrameViewPrivate;
 class IntRect;
-class PlatformMouseEvent;
 class Node;
+class PlatformMouseEvent;
 class RenderLayer;
 class RenderObject;
 class RenderPartObject;
+class ScheduledEvent;
 class String;
 
 template <typename T> class Timer;
 
-class FrameView : public ScrollView {
+class FrameView : public ScrollView, public RefCounted<FrameView> {
 public:
     friend class RenderView;
 
-    FrameView(Frame*);
-    FrameView(Frame*, const IntSize& initialSize);
+    static PassRefPtr<FrameView> create(Frame*);
+    static PassRefPtr<FrameView> create(Frame*, const IntSize& initialSize);
 
     virtual ~FrameView();
 
@@ -64,10 +64,6 @@ public:
     Frame* frame() const { return m_frame.get(); }
     void clearFrame();
 
-    void ref() { ++m_refCount; }
-    void deref() { if (!--m_refCount) delete this; }
-    bool hasOneRef() { return m_refCount == 1; }
-
     int marginWidth() const { return m_margins.width(); } // -1 means default
     int marginHeight() const { return m_margins.height(); } // -1 means default
     void setMarginWidth(int);
@@ -88,13 +84,25 @@ public:
     bool layoutPending() const;
 
     RenderObject* layoutRoot(bool onlyDuringLayout = false) const;
-    int layoutCount() const;
+    int layoutCount() const { return m_layoutCount; }
 
     // These two helper functions just pass through to the RenderView.
     bool needsLayout() const;
     void setNeedsLayout();
 
-    bool needsFullRepaint() const;
+    bool needsFullRepaint() const { return m_doFullRepaint; }
+
+#if USE(ACCELERATED_COMPOSITING)
+    enum CompositingUpdate { NormalCompositingUpdate, ForcedCompositingUpdate };
+    void updateCompositingLayers(CompositingUpdate updateType = NormalCompositingUpdate);
+
+    // Called when changes to the GraphicsLayer hierarchy have to be synchronized with
+    // content rendered via the normal painting path.
+    void setNeedsOneShotDrawingSynchronization();
+#endif
+
+    void didMoveOnscreen();
+    void willMoveOffscreen();
 
     void resetScrollbars();
 
@@ -131,12 +139,16 @@ public:
     void setMediaType(const String&);
 
     void setUseSlowRepaints();
+    void setIsOverlapped(bool);
+    void setContentIsOpaque(bool);
 
     void addSlowRepaintObject();
     void removeSlowRepaintObject();
 
     void beginDeferredRepaints();
     void endDeferredRepaints();
+    void checkStopDelayingDeferredRepaints();
+    void resetDeferredRepaintDelay();
 
 #if ENABLE(DASHBOARD_SUPPORT)
     void updateDashboardRegions();
@@ -145,7 +157,7 @@ public:
 
     void restoreScrollbar();
 
-    void scheduleEvent(PassRefPtr<Event>, PassRefPtr<EventTargetNode>);
+    void scheduleEvent(PassRefPtr<Event>, PassRefPtr<Node>);
     void pauseScheduledEvents();
     void resumeScheduledEvents();
     void postLayoutTimerFired(Timer<FrameView>*);
@@ -165,13 +177,26 @@ public:
     
     void layoutIfNeededRecursive();
 
-    void setIsVisuallyNonEmpty();
+    void setIsVisuallyNonEmpty() { m_isVisuallyNonEmpty = true; }
+
+    void forceLayout(bool allowSubtree = false);
+    void forceLayoutWithPageWidthRange(float minPageWidth, float maxPageWidth, bool adjustViewSize);
+
+    void adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float bottomLimit);
+
+    bool lockedToAnchor() { return m_lockedToAnchor; }
+    void setLockedToAnchor(bool lockedToAnchor) { m_lockedToAnchor = lockedToAnchor; }
+
 
 private:
+    FrameView(Frame*);
+
+    void reset();
     void init();
 
     virtual bool isFrameView() const;
 
+    friend class RenderWidget;
     bool useSlowRepaints() const;
 
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
@@ -183,18 +208,90 @@ private:
 
     virtual void repaintContentRectangle(const IntRect&, bool immediate);
     virtual void contentsResized() { setNeedsLayout(); }
-    virtual void visibleContentsResized() { layout(); }
-
+    virtual void visibleContentsResized()
+    {
+        if (needsLayout())
+            layout();
+    }
+
+    void deferredRepaintTimerFired(Timer<FrameView>*);
+    void doDeferredRepaints();
+    void updateDeferredRepaintDelay();
+    double adjustedDeferredRepaintDelay() const;
+
+    bool updateWidgets();
+    
     static double sCurrentPaintTimeStamp; // used for detecting decoded resource thrash in the cache
 
-    unsigned m_refCount;
     IntSize m_size;
     IntSize m_margins;
     OwnPtr<HashSet<RenderPartObject*> > m_widgetUpdateSet;
     RefPtr<Frame> m_frame;
-    FrameViewPrivate* d;
+
+    bool m_doFullRepaint;
+    
+    ScrollbarMode m_vmode;
+    ScrollbarMode m_hmode;
+    bool m_useSlowRepaints;
+    bool m_isOverlapped;
+    bool m_contentIsOpaque;
+    unsigned m_slowRepaintObjectCount;
+
+    int m_borderX, m_borderY;
+
+    Timer<FrameView> m_layoutTimer;
+    bool m_delayedLayout;
+    RenderObject* m_layoutRoot;
+    
+    bool m_layoutSchedulingEnabled;
+    bool m_midLayout;
+    int m_layoutCount;
+    unsigned m_nestedLayoutCount;
+    Timer<FrameView> m_postLayoutTasksTimer;
+    bool m_firstLayoutCallbackPending;
+
+    bool m_firstLayout;
+    bool m_needToInitScrollbars;
+    bool m_isTransparent;
+    Color m_baseBackgroundColor;
+    IntSize m_lastLayoutSize;
+    float m_lastZoomFactor;
+
+    String m_mediaType;
+    
+    unsigned m_enqueueEvents;
+    Vector<ScheduledEvent*> m_scheduledEvents;
+    
+    bool m_overflowStatusDirty;
+    bool m_horizontalOverflow;
+    bool m_verticalOverflow;    
+    RenderObject* m_viewportRenderer;
+
+    bool m_wasScrolledByUser;
+    bool m_inProgrammaticScroll;
+    
+    unsigned m_deferringRepaints;
+    unsigned m_repaintCount;
+    Vector<IntRect> m_repaintRects;
+    Timer<FrameView> m_deferredRepaintTimer;
+    double m_deferredRepaintDelay;
+    double m_lastPaintTime;
+
+    bool m_shouldUpdateWhileOffscreen;
+
+    unsigned m_deferSetNeedsLayouts;
+    bool m_setNeedsLayoutWasDeferred;
+
+    RefPtr<Node> m_nodeToDraw;
+    PaintRestriction m_paintRestriction;
+    bool m_isPainting;
+
+    bool m_isVisuallyNonEmpty;
+    bool m_firstVisuallyNonEmptyLayoutCallbackPending;
+
+    bool m_lockedToAnchor;
 };
 
-}
+} // namespace WebCore
 
-#endif
+#endif // FrameView_h
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
index f82e95d8c1..8abe8a6137 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,19 +26,26 @@
 #include "config.h"
 #include "Geolocation.h"
 
+#include "Chrome.h"
 #include "Document.h"
 #include "Frame.h"
+#include "Page.h"
 #include "PositionError.h"
 
 namespace WebCore {
 
-Geolocation::GeoNotifier::GeoNotifier(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PositionOptions* options)
+Geolocation::GeoNotifier::GeoNotifier(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
     : m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
+    , m_options(options)
     , m_timer(this, &Geolocation::GeoNotifier::timerFired)
 {
-    if (m_errorCallback && options)
-        m_timer.startOneShot(options->timeout() / 1000.0);
+}
+
+void Geolocation::GeoNotifier::startTimer()
+{
+    if (m_errorCallback && m_options)
+        m_timer.startOneShot(m_options->timeout() / 1000.0);
 }
 
 void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
@@ -54,7 +61,11 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 Geolocation::Geolocation(Frame* frame)
     : m_frame(frame)
     , m_service(GeolocationService::create(this))
+    , m_allowGeolocation(Unknown)
+    , m_shouldClearCache(false)
 {
+    if (!m_frame)
+        return;
     ASSERT(m_frame->document());
     m_frame->document()->setUsingGeolocation(true);
 }
@@ -62,16 +73,14 @@ Geolocation::Geolocation(Frame* frame)
 void Geolocation::disconnectFrame()
 {
     m_service->stopUpdating();
-    if (m_frame->document())
-        m_frame->document()->setUsingGeolocation(false);
     m_frame = 0;
 }
 
-void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PositionOptions* options)
+void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = GeoNotifier::create(successCallback, errorCallback, options);
 
-    if (!m_service->startUpdating(options)) {
+    if (!m_service->startUpdating(notifier->m_options.get())) {
         if (notifier->m_errorCallback) {
             RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
             notifier->m_errorCallback->handleEvent(error.get());
@@ -82,11 +91,11 @@ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallbac
     m_oneShots.add(notifier);
 }
 
-int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PositionOptions* options)
+int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = GeoNotifier::create(successCallback, errorCallback, options);
 
-    if (!m_service->startUpdating(options)) {
+    if (!m_service->startUpdating(notifier->m_options.get())) {
         if (notifier->m_errorCallback) {
             RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
             notifier->m_errorCallback->handleEvent(error.get());
@@ -121,6 +130,19 @@ void Geolocation::resume()
         m_service->resume();
 }
 
+void Geolocation::setIsAllowed(bool allowed)
+{
+    m_allowGeolocation = allowed ? Yes : No;
+    
+    if (isAllowed()) {
+        startTimers();
+        geolocationServicePositionChanged(m_service.get());
+    } else {
+        WTF::RefPtr<WebCore::PositionError> error = WebCore::PositionError::create(PositionError::PERMISSION_DENIED, "User disallowed GeoLocation");
+        handleError(error.get());
+    }
+}
+
 void Geolocation::sendErrorToOneShots(PositionError* error)
 {
     Vector<RefPtr<GeoNotifier> > copy;
@@ -189,6 +211,37 @@ void Geolocation::sendPositionToWatchers(Geoposition* position)
     }
 }
 
+void Geolocation::startTimer(Vector<RefPtr<GeoNotifier> >& notifiers)
+{
+    Vector<RefPtr<GeoNotifier> >::const_iterator end = notifiers.end();
+    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = notifiers.begin(); it != end; ++it) {
+        RefPtr<GeoNotifier> notifier = *it;
+        notifier->startTimer();
+    }
+}
+
+void Geolocation::startTimersForOneShots()
+{
+    Vector<RefPtr<GeoNotifier> > copy;
+    copyToVector(m_oneShots, copy);
+    
+    startTimer(copy);
+}
+
+void Geolocation::startTimersForWatchers()
+{
+    Vector<RefPtr<GeoNotifier> > copy;
+    copyValuesToVector(m_watchers, copy);
+    
+    startTimer(copy);
+}
+
+void Geolocation::startTimers()
+{
+    startTimersForOneShots();
+    startTimersForWatchers();
+}
+
 void Geolocation::handleError(PositionError* error)
 {
     ASSERT(error);
@@ -199,10 +252,32 @@ void Geolocation::handleError(PositionError* error)
     m_oneShots.clear();
 }
 
+void Geolocation::requestPermission()
+{
+    if (m_allowGeolocation > Unknown)
+        return;
+
+    if (!m_frame)
+        return;
+    
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    
+    // Ask the chrome: it maintains the geolocation challenge policy itself.
+    page->chrome()->requestGeolocationPermissionForFrame(m_frame, this);
+    
+    m_allowGeolocation = InProgress;
+}
+
 void Geolocation::geolocationServicePositionChanged(GeolocationService* service)
 {
     ASSERT(service->lastPosition());
     
+    requestPermission();
+    if (!isAllowed())
+        return;
+    
     sendPositionToOneShots(service->lastPosition());
     sendPositionToWatchers(service->lastPosition());
         
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.h b/src/3rdparty/webkit/WebCore/page/Geolocation.h
index 572cbd886d..ae24bdd84f 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.h
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,6 +38,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -54,30 +55,38 @@ public:
     
     Geoposition* lastPosition() const { return m_service->lastPosition(); }
 
-    void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PositionOptions*);
-    int watchPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PositionOptions*);
+    void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+    int watchPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     void clearWatch(int watchId);
 
     void suspend();
     void resume();
+    
+    void setIsAllowed(bool);
+    bool isAllowed() const { return m_allowGeolocation == Yes; }
+    
+    void setShouldClearCache(bool shouldClearCache) { m_shouldClearCache = shouldClearCache; }
+    bool shouldClearCache() const { return m_shouldClearCache; }
 
 private:
     Geolocation(Frame*);
 
     class GeoNotifier : public RefCounted<GeoNotifier> {
     public:
-        static PassRefPtr<GeoNotifier> create(PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PositionOptions* options) { return adoptRef(new GeoNotifier(positionCallback, positionErrorCallback, options)); }
+        static PassRefPtr<GeoNotifier> create(PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(positionCallback, positionErrorCallback, options)); }
         
+        void startTimer();
         void timerFired(Timer<GeoNotifier>*);
         
         RefPtr<PositionCallback> m_successCallback;
         RefPtr<PositionErrorCallback> m_errorCallback;
+        RefPtr<PositionOptions> m_options;
         Timer<GeoNotifier> m_timer;
 
     private:
-        GeoNotifier(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PositionOptions*);
+        GeoNotifier(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     };
-    
+
     bool hasListeners() const { return !m_oneShots.isEmpty() || !m_watchers.isEmpty(); }
 
     void sendErrorToOneShots(PositionError*);
@@ -85,11 +94,19 @@ private:
     void sendPositionToOneShots(Geoposition*);
     void sendPositionToWatchers(Geoposition*);
     
-    void handleError(PositionError*);
+    static void startTimer(Vector<RefPtr<GeoNotifier> >&);
+    void startTimersForOneShots();
+    void startTimersForWatchers();
+    void startTimers();
     
+    void handleError(PositionError*);
+
+    void requestPermission();
+
+    // GeolocationServiceClient
     virtual void geolocationServicePositionChanged(GeolocationService*);
     virtual void geolocationServiceErrorOccurred(GeolocationService*);
-            
+
     typedef HashSet<RefPtr<GeoNotifier> > GeoNotifierSet;
     typedef HashMap<int, RefPtr<GeoNotifier> > GeoNotifierMap;
     
@@ -97,6 +114,14 @@ private:
     GeoNotifierMap m_watchers;
     Frame* m_frame;
     OwnPtr<GeolocationService> m_service;
+
+    enum {
+        Unknown,
+        InProgress,
+        Yes,
+        No
+    } m_allowGeolocation;
+    bool m_shouldClearCache;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.cpp b/src/3rdparty/webkit/WebCore/page/Geoposition.cpp
index 1792a1fd47..8f7a5c80d1 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Geoposition.cpp
@@ -30,9 +30,7 @@ namespace WebCore {
 
 String Geoposition::toString() const
 {
-    return String::format("position(%.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.lld)",
-                          m_latitude, m_longitude, m_altitude, m_accuracy, 
-                          m_altitudeAccuracy, m_heading, m_speed, m_timestamp);
+    return "position(" + m_coordinates->toString() + String::format(", %.lld)", m_timestamp);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.h b/src/3rdparty/webkit/WebCore/page/Geoposition.h
index 9ce50e5cf9..505e8b31ec 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.h
+++ b/src/3rdparty/webkit/WebCore/page/Geoposition.h
@@ -26,6 +26,7 @@
 #ifndef Geoposition_h
 #define Geoposition_h
 
+#include "Coordinates.h"
 #include "Event.h"
 #include "PlatformString.h"
 #include <wtf/RefCounted.h>
@@ -36,39 +37,21 @@ typedef int ExceptionCode;
 
 class Geoposition : public RefCounted<Geoposition> {
 public:
-    static PassRefPtr<Geoposition> create(double latitude, double longitude, double altitude, double accuracy, double altitudeAccuracy, double heading, double speed, DOMTimeStamp timestamp) { return adoptRef(new Geoposition(latitude, longitude, altitude, accuracy, altitudeAccuracy, heading, speed, timestamp)); }
+    static PassRefPtr<Geoposition> create(PassRefPtr<Coordinates> coordinates, DOMTimeStamp timestamp) { return adoptRef(new Geoposition(coordinates, timestamp)); }
     
-    double latitude() const { return m_latitude; }
-    double longitude() const { return m_longitude; }
-    double altitude() const { return m_altitude; }
-    double accuracy() const { return m_accuracy; }
-    double altitudeAccuracy() const { return m_altitudeAccuracy; }
-    double heading() const { return m_heading; }
-    double speed() const { return m_speed; }
     DOMTimeStamp timestamp() const { return m_timestamp; }
-
+    Coordinates* coords() const { return m_coordinates.get(); }
+    
     String toString() const;
 
 private:
-    Geoposition(double latitude, double longitude, double altitude, double accuracy, double altitudeAccuracy, double heading, double speed, DOMTimeStamp timestamp)
-        : m_latitude(latitude)
-        , m_longitude(longitude)
-        , m_altitude(altitude)
-        , m_accuracy(accuracy)
-        , m_altitudeAccuracy(altitudeAccuracy)
-        , m_heading(heading)
-        , m_speed(speed)
+    Geoposition(PassRefPtr<Coordinates> coordinates, DOMTimeStamp timestamp)
+        : m_coordinates(coordinates)
         , m_timestamp(timestamp)
     {
     }
 
-    double m_latitude;
-    double m_longitude;
-    double m_altitude;
-    double m_accuracy;
-    double m_altitudeAccuracy;
-    double m_heading;
-    double m_speed;
+    RefPtr<Coordinates> m_coordinates;
     DOMTimeStamp m_timestamp;
 };
     
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.idl b/src/3rdparty/webkit/WebCore/page/Geoposition.idl
index 554bb3064d..de508fe979 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.idl
+++ b/src/3rdparty/webkit/WebCore/page/Geoposition.idl
@@ -26,16 +26,10 @@
 module core {
 
     interface Geoposition {
-        readonly attribute double latitude;
-        readonly attribute double longitude;
-        readonly attribute double altitude;
-        readonly attribute double accuracy;
-        readonly attribute double altitudeAccuracy;
-        readonly attribute double heading;
-        readonly attribute double speed;
+        readonly attribute Coordinates coords;
         readonly attribute DOMTimeStamp timestamp;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/page/History.idl b/src/3rdparty/webkit/WebCore/page/History.idl
index e86cf927d8..fa308fb8b4 100644
--- a/src/3rdparty/webkit/WebCore/page/History.idl
+++ b/src/3rdparty/webkit/WebCore/page/History.idl
@@ -26,6 +26,9 @@
 module window {
 
     interface [
+#if defined(V8_BINDING) && V8_BINDING
+        CheckDomainSecurity,
+#endif
         CustomGetOwnPropertySlot,
         CustomPutFunction,
         CustomDeleteProperty,
@@ -33,9 +36,9 @@ module window {
     ] History {
         readonly attribute unsigned long length;
 
-        void back();
-        void forward();
-        void go(in long distance);
+        [DoNotCheckDomainSecurity] void back();
+        [DoNotCheckDomainSecurity] void forward();
+        [DoNotCheckDomainSecurity] void go(in long distance);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/Location.cpp b/src/3rdparty/webkit/WebCore/page/Location.cpp
index 454aa78eae..c8780eb0ee 100644
--- a/src/3rdparty/webkit/WebCore/page/Location.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Location.cpp
@@ -49,7 +49,12 @@ void Location::disconnectFrame()
 inline const KURL& Location::url() const
 {
     ASSERT(m_frame);
-    return m_frame->loader()->url();
+
+    const KURL& url = m_frame->loader()->url();
+    if (!url.isValid())
+        return blankURL();  // Use "about:blank" while the page is still loading (before we have a frame).
+
+    return url;
 }
 
 String Location::href() const
@@ -111,7 +116,8 @@ String Location::search() const
     if (!m_frame)
         return String();
 
-    return url().query();
+    const KURL& url = this->url();
+    return url.query().isEmpty() ? "" : "?" + url.query();
 }
 
 String Location::hash() const
@@ -120,7 +126,7 @@ String Location::hash() const
         return String();
 
     const KURL& url = this->url();
-    return url.ref().isNull() ? "" : "#" + url.ref();
+    return url.ref().isEmpty() ? "" : "#" + url.ref();
 }
 
 String Location::toString() const
diff --git a/src/3rdparty/webkit/WebCore/page/Location.idl b/src/3rdparty/webkit/WebCore/page/Location.idl
index 91822ab5a9..e7fa31a205 100644
--- a/src/3rdparty/webkit/WebCore/page/Location.idl
+++ b/src/3rdparty/webkit/WebCore/page/Location.idl
@@ -29,16 +29,22 @@
 module window {
 
     interface [
+#if defined(V8_BINDING) && V8_BINDING
+        CheckDomainSecurity,
+#endif
         CustomGetOwnPropertySlot,
         CustomPutFunction,
         CustomDeleteProperty,
-        CustomGetPropertyNames
+        CustomGetPropertyNames,
+        CustomDefineGetter,
+        CustomPrototypePutFunction,
+        CustomPrototypeDefineGetter
     ] Location {
-                 attribute [CustomSetter] DOMString href;
+                 attribute [DoNotCheckDomainSecurityOnSet, CustomSetter, V8DisallowShadowing] DOMString href;
 
-        [Custom] void assign(in DOMString url);
-        [Custom] void replace(in DOMString url);
-        [Custom] void reload();
+        [Custom, V8OnInstance] void assign(in DOMString url);
+        [Custom, V8OnInstance] void replace(in DOMString url);
+        [Custom, V8OnInstance] void reload();
 
         // URI decomposition attributes
                  attribute [CustomSetter] DOMString protocol;
@@ -49,8 +55,11 @@ module window {
                  attribute [CustomSetter] DOMString search;
                  attribute [CustomSetter] DOMString hash;
 
-#if defined(LANGUAGE_JAVASCRIPT)
-        [DontEnum, Custom] DOMString toString();
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [DontEnum, Custom, V8OnInstance, V8ReadOnly] DOMString toString();
+#endif
+#if defined(V8_BINDING) && V8_BINDING
+        [DontEnum, Custom, V8OnInstance, V8ReadOnly] DOMObject valueOf();
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.cpp b/src/3rdparty/webkit/WebCore/page/Navigator.cpp
index 429ec007a8..3603b86dea 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.cpp
@@ -75,7 +75,7 @@ static bool shouldHideFourDot(Frame* frame)
     const String* sourceURL = frame->script()->sourceURL();
     if (!sourceURL)
         return false;
-    if (!(sourceURL->endsWith("/dqm_script.js") || sourceURL->endsWith("/dqm_loader.js")))
+    if (!(sourceURL->endsWith("/dqm_script.js") || sourceURL->endsWith("/dqm_loader.js") || sourceURL->endsWith("/tdqm_loader.js")))
         return false;
     Settings* settings = frame->settings();
     if (!settings)
@@ -102,7 +102,13 @@ String Navigator::userAgent() const
 {
     if (!m_frame)
         return String();
-    return m_frame->loader()->userAgent(m_frame->document() ? m_frame->document()->url() : KURL());
+        
+    // If the frame is already detached, FrameLoader::userAgent may malfunction, because it calls a client method
+    // that uses frame's WebView (at least, in Mac WebKit).
+    if (!m_frame->page())
+        return String();
+        
+    return m_frame->loader()->userAgent(m_frame->document()->url());
 }
 
 PluginArray* Navigator::plugins() const
@@ -121,6 +127,9 @@ MimeTypeArray* Navigator::mimeTypes() const
 
 bool Navigator::cookieEnabled() const
 {
+    if (!m_frame)
+        return false;
+        
     if (m_frame->page() && !m_frame->page()->cookieEnabled())
         return false;
 
@@ -129,8 +138,9 @@ bool Navigator::cookieEnabled() const
 
 bool Navigator::javaEnabled() const
 {
-    if (!m_frame)
+    if (!m_frame || !m_frame->settings())
         return false;
+
     return m_frame->settings()->isJavaEnabled();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.idl b/src/3rdparty/webkit/WebCore/page/Navigator.idl
index 905159cf43..8048ff3bcb 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.idl
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.idl
@@ -24,7 +24,7 @@ module window {
     ] Navigator {
         readonly attribute DOMString appCodeName;
         readonly attribute DOMString appName;
-        readonly attribute [CustomGetter] DOMString appVersion;
+        readonly attribute DOMString appVersion;
         readonly attribute DOMString language;
         readonly attribute DOMString userAgent;
         readonly attribute DOMString platform;
@@ -38,7 +38,8 @@ module window {
         boolean javaEnabled();
         
         readonly attribute boolean onLine;
-#if ENABLE_GEOLOCATION
+
+#if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
         readonly attribute Geolocation geolocation;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp b/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp
index 27c9fdd968..5138b0fb5d 100644
--- a/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/NavigatorBase.cpp
@@ -31,9 +31,9 @@
 #include "PlatformString.h"
 
 #ifndef WEBCORE_NAVIGATOR_PLATFORM
-#if PLATFORM(MAC) && PLATFORM(PPC)
+#if PLATFORM(MAC) && (PLATFORM(PPC) || PLATFORM(PPC64))
 #define WEBCORE_NAVIGATOR_PLATFORM "MacPPC"
-#elif PLATFORM(MAC) && PLATFORM(X86)
+#elif PLATFORM(MAC) && (PLATFORM(X86) || PLATFORM(X86_64))
 #define WEBCORE_NAVIGATOR_PLATFORM "MacIntel"
 #elif PLATFORM(WIN_OS)
 #define WEBCORE_NAVIGATOR_PLATFORM "Win32"
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index 460183a0d6..70b4459cf1 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -21,14 +21,14 @@
 #include "config.h"
 #include "Page.h"
 
+#include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
 #include "ContextMenuClient.h"
 #include "ContextMenuController.h"
-#include "CSSStyleSelector.h"
-#include "EditorClient.h"
 #include "DOMWindow.h"
 #include "DragController.h"
+#include "EditorClient.h"
 #include "EventNames.h"
 #include "FileSystem.h"
 #include "FocusController.h"
@@ -36,21 +36,22 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLElement.h"
 #include "HistoryItem.h"
 #include "InspectorController.h"
 #include "Logging.h"
-#include "NetworkStateNotifier.h"
 #include "Navigator.h"
+#include "NetworkStateNotifier.h"
 #include "PageGroup.h"
 #include "PluginData.h"
 #include "ProgressTracker.h"
 #include "RenderWidget.h"
+#include "ScriptController.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "StringHash.h"
 #include "TextResourceDecoder.h"
 #include "Widget.h"
-#include "ScriptController.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
@@ -89,20 +90,8 @@ static void networkStateChanged()
     }
 
     AtomicString eventName = networkStateNotifier().onLine() ? eventNames().onlineEvent : eventNames().offlineEvent;
-    
-    for (unsigned i = 0; i < frames.size(); i++) {
-        Document* document = frames[i]->document();
-        
-        if (!document)
-            continue;
-
-        // If the document does not have a body the event should be dispatched to the document
-        EventTargetNode* eventTarget = document->body();
-        if (!eventTarget)
-            eventTarget = document;
-        
-        eventTarget->dispatchEventForType(eventName, false, false);
-    }
+    for (unsigned i = 0; i < frames.size(); i++)
+        frames[i]->document()->dispatchWindowEvent(eventName, false, false);
 }
 
 Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient)
@@ -111,7 +100,7 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_dragController(new DragController(this, dragClient))
     , m_focusController(new FocusController(this))
     , m_contextMenuController(new ContextMenuController(this, contextMenuClient))
-    , m_inspectorController(new InspectorController(this, inspectorClient))
+    , m_inspectorController(InspectorController::create(this, inspectorClient))
     , m_settings(new Settings(this))
     , m_progress(new ProgressTracker)
     , m_backForwardList(BackForwardList::create(this))
@@ -123,13 +112,12 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_cookieEnabled(true)
     , m_areMemoryCacheClientCallsEnabled(true)
     , m_mediaVolume(1)
+    , m_javaScriptURLsAreAllowed(true)
     , m_parentInspectorController(0)
     , m_didLoadUserStyleSheet(false)
     , m_userStyleSheetModificationTime(0)
     , m_group(0)
     , m_debugger(0)
-    , m_pendingUnloadEventCount(0)
-    , m_pendingBeforeUnloadEventCount(0)
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
 {
@@ -157,11 +145,9 @@ Page::~Page()
     setGroupName(String());
     allPages->remove(this);
     
-    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-        if (frame->document())
-            frame->document()->documentWillBecomeInactive();
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
         frame->pageDestroyed();
-    }
+
     m_editorClient->pageDestroyed();
     if (m_parentInspectorController)
         m_parentInspectorController->pageDestroyed();
@@ -215,7 +201,19 @@ bool Page::goForward()
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
     // Abort any current load if we're going to a history item
-    m_mainFrame->loader()->stopAllLoaders();
+
+    // Define what to do with any open database connections. By default we stop them and terminate the database thread.
+    DatabasePolicy databasePolicy = DatabasePolicyStop;
+
+#if ENABLE(DATABASE)
+    // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
+    const KURL& currentURL = m_mainFrame->loader()->url();
+    const KURL& newURL = item->url();
+
+    if (newURL.hasRef() && equalIgnoringRef(currentURL, newURL))
+        databasePolicy = DatabasePolicyContinue;
+#endif
+    m_mainFrame->loader()->stopAllLoaders(databasePolicy);
     m_mainFrame->loader()->goToItem(item, type);
 }
 
@@ -233,7 +231,7 @@ void Page::setGroupName(const String& name)
     }
 
     if (name.isEmpty())
-        m_group = 0;
+        m_group = m_singlePageGroup.get();
     else {
         m_singlePageGroup.clear();
         m_group = PageGroup::pageGroup(name);
@@ -358,13 +356,12 @@ void Page::unmarkAllTextMatches()
 
     Frame* frame = mainFrame();
     do {
-        if (Document* document = frame->document())
-            document->removeMarkers(DocumentMarker::TextMatch);
+        frame->document()->removeMarkers(DocumentMarker::TextMatch);
         frame = incrementFrame(frame, true, false);
     } while (frame);
 }
 
-const Selection& Page::selection() const
+const VisibleSelection& Page::selection() const
 {
     return focusController()->focusedOrMainFrame()->selection()->selection();
 }
@@ -404,8 +401,23 @@ void Page::setMediaVolume(float volume)
 
     m_mediaVolume = volume;
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-        if (frame->document())
-            frame->document()->mediaVolumeDidChange();
+        frame->document()->mediaVolumeDidChange();
+    }
+}
+
+void Page::didMoveOnscreen()
+{
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (frame->view())
+            frame->view()->didMoveOnscreen();
+    }
+}
+
+void Page::willMoveOffscreen()
+{
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (frame->view())
+            frame->view()->willMoveOffscreen();
     }
 }
 
@@ -461,7 +473,9 @@ const String& Page::userStyleSheet() const
     if (!data)
         return m_userStyleSheet;
 
-    m_userStyleSheet = TextResourceDecoder::create("text/css")->decode(data->data(), data->size());
+    RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("text/css");
+    m_userStyleSheet = decoder->decode(data->data(), data->size());
+    m_userStyleSheet += decoder->flush();
 
     return m_userStyleSheet;
 }
@@ -548,46 +562,6 @@ void Page::setSessionStorage(PassRefPtr<SessionStorage> newStorage)
     m_sessionStorage = newStorage;
 }
 #endif
-    
-unsigned Page::pendingUnloadEventCount()
-{
-    return m_pendingUnloadEventCount;
-}
-    
-void Page::changePendingUnloadEventCount(int delta) 
-{
-    if (!delta)
-        return;
-    ASSERT( (delta + (int)m_pendingUnloadEventCount) >= 0 );
-    
-    if (m_pendingUnloadEventCount == 0)
-        m_chrome->disableSuddenTermination();
-    else if ((m_pendingUnloadEventCount + delta) == 0)
-        m_chrome->enableSuddenTermination();
-    
-    m_pendingUnloadEventCount += delta;
-    return; 
-}
-    
-unsigned Page::pendingBeforeUnloadEventCount()
-{
-    return m_pendingBeforeUnloadEventCount;
-}
-    
-void Page::changePendingBeforeUnloadEventCount(int delta) 
-{
-    if (!delta)
-        return;
-    ASSERT( (delta + (int)m_pendingBeforeUnloadEventCount) >= 0 );
-    
-    if (m_pendingBeforeUnloadEventCount == 0)
-        m_chrome->disableSuddenTermination();
-    else if ((m_pendingBeforeUnloadEventCount + delta) == 0)
-        m_chrome->enableSuddenTermination();
-    
-    m_pendingBeforeUnloadEventCount += delta;
-    return; 
-}
 
 #if ENABLE(WML)
 WMLPageState* Page::wmlPageState()
@@ -629,4 +603,14 @@ void Page::setMemoryCacheClientCallsEnabled(bool enabled)
         frame->loader()->tellClientAboutPastMemoryCacheLoads();
 }
 
+void Page::setJavaScriptURLsAreAllowed(bool areAllowed)
+{
+    m_javaScriptURLsAreAllowed = areAllowed;
+}
+
+bool Page::javaScriptURLsAreAllowed() const
+{
+    return m_javaScriptURLsAreAllowed;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index de2b3f629a..eedd24ce9d 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -60,7 +60,7 @@ namespace WebCore {
     class PageGroup;
     class PluginData;
     class ProgressTracker;
-    class Selection;
+    class VisibleSelection;
     class SelectionController;
 #if ENABLE(DOM_STORAGE)
     class SessionStorage;
@@ -70,7 +70,6 @@ namespace WebCore {
     class WMLPageState;
 #endif
 
-    enum TextCaseSensitivity { TextCaseSensitive, TextCaseInsensitive };
     enum FindDirection { FindDirectionForward, FindDirectionBackward };
 
     class Page : Noncopyable {
@@ -138,7 +137,7 @@ namespace WebCore {
         OwnPtr<SchedulePairHashSet> m_scheduledRunLoopPairs;
 #endif
 
-        const Selection& selection() const;
+        const VisibleSelection& selection() const;
 
         void setDefersLoading(bool);
         bool defersLoading() const { return m_defersLoading; }
@@ -154,13 +153,12 @@ namespace WebCore {
         float mediaVolume() const { return m_mediaVolume; }
         void setMediaVolume(float volume);
 
+        // Notifications when the Page starts and stops being presented via a native window.
+        void didMoveOnscreen();
+        void willMoveOffscreen();
+
         void userStyleSheetLocationChanged();
         const String& userStyleSheet() const;
-        
-        void changePendingUnloadEventCount(int delta);
-        unsigned pendingUnloadEventCount();
-        void changePendingBeforeUnloadEventCount(int delta);
-        unsigned pendingBeforeUnloadEventCount();
 
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
@@ -197,6 +195,9 @@ namespace WebCore {
         void setMemoryCacheClientCallsEnabled(bool);
         bool areMemoryCacheClientCallsEnabled() const { return m_areMemoryCacheClientCallsEnabled; }
 
+        void setJavaScriptURLsAreAllowed(bool);
+        bool javaScriptURLsAreAllowed() const;
+
     private:
         void initGroup();
 
@@ -205,7 +206,7 @@ namespace WebCore {
         OwnPtr<DragController> m_dragController;
         OwnPtr<FocusController> m_focusController;
         OwnPtr<ContextMenuController> m_contextMenuController;
-        OwnPtr<InspectorController> m_inspectorController;
+        RefPtr<InspectorController> m_inspectorController;
         OwnPtr<Settings> m_settings;
         OwnPtr<ProgressTracker> m_progress;
         
@@ -228,7 +229,9 @@ namespace WebCore {
         bool m_cookieEnabled;
         bool m_areMemoryCacheClientCallsEnabled;
         float m_mediaVolume;
-    
+
+        bool m_javaScriptURLsAreAllowed;
+
         InspectorController* m_parentInspectorController;
 
         String m_userStyleSheetPath;
@@ -240,9 +243,6 @@ namespace WebCore {
         PageGroup* m_group;
 
         JSC::Debugger* m_debugger;
-        
-        unsigned m_pendingUnloadEventCount;
-        unsigned m_pendingBeforeUnloadEventCount;
 
         double m_customHTMLTokenizerTimeDelay;
         int m_customHTMLTokenizerChunkSize;
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.cpp b/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.cpp
new file mode 100644
index 0000000000..f274de3e88
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PageGroupLoadDeferrer.h"
+
+#include "Frame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include <wtf/HashSet.h>
+
+namespace WebCore {
+
+using namespace std;
+
+PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
+{
+    const HashSet<Page*>& pages = page->group().pages();
+
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+        Page* otherPage = *it;
+        if ((deferSelf || otherPage != page)) {
+            if (!otherPage->defersLoading())
+                m_deferredFrames.append(otherPage->mainFrame());
+
+#if !PLATFORM(MAC)
+            for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                frame->document()->suspendActiveDOMObjects();
+#endif
+        }
+    }
+
+    size_t count = m_deferredFrames.size();
+    for (size_t i = 0; i < count; ++i)
+        if (Page* page = m_deferredFrames[i]->page())
+            page->setDefersLoading(true);
+}
+
+PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
+{
+    for (size_t i = 0; i < m_deferredFrames.size(); ++i) {
+        if (Page* page = m_deferredFrames[i]->page()) {
+            page->setDefersLoading(false);
+
+#if !PLATFORM(MAC)
+            for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                frame->document()->resumeActiveDOMObjects();
+#endif
+        }
+    }
+}
+
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/ListMarkerBox.h b/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.h
index 47ae2569ae..1bdb45c8e7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/ListMarkerBox.h
+++ b/src/3rdparty/webkit/WebCore/page/PageGroupLoadDeferrer.h
@@ -1,9 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,23 +15,27 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
 
-#ifndef ListMarkerBox_h
-#define ListMarkerBox_h
+#ifndef PageGroupLoadDeferrer_h
+#define PageGroupLoadDeferrer_h
 
-#include "InlineBox.h"
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-class ListMarkerBox : public InlineBox {
-public:
-    ListMarkerBox(RenderObject*);
+    class Frame;
+    class Page;
 
-    virtual bool isText() const;
-};
+    class PageGroupLoadDeferrer : Noncopyable {
+    public:
+        PageGroupLoadDeferrer(Page*, bool deferSelf);
+        ~PageGroupLoadDeferrer();
 
-} // namespace WebCore
+    private:
+        Vector<RefPtr<Frame>, 16> m_deferredFrames;
+    };
+}
 
-#endif // ListMarkerBox_h
+#endif // PageGroupLoadDeferrer_h
diff --git a/src/3rdparty/webkit/WebCore/page/PositionOptions.h b/src/3rdparty/webkit/WebCore/page/PositionOptions.h
index dc9c167892..10845d38c0 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionOptions.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionOptions.h
@@ -33,22 +33,26 @@ namespace WebCore {
     
 class PositionOptions : public RefCounted<PositionOptions> {
 public:
-    static PassRefPtr<PositionOptions> create(bool highAccuracy, unsigned timeout) { return adoptRef(new PositionOptions(highAccuracy, timeout)); }
+    static PassRefPtr<PositionOptions> create(bool highAccuracy, unsigned timeout, unsigned maximumAge) { return adoptRef(new PositionOptions(highAccuracy, timeout, maximumAge)); }
 
     bool enableHighAccuracy() const { return m_highAccuracy; }
     void setEnableHighAccuracy(bool enable) { m_highAccuracy = enable; }
     unsigned timeout() const { return m_timeout; }
     void setTimeout(unsigned t) { m_timeout = t; }
+    unsigned maximumAge() const { return m_maximumAge; }
+    void setMaximumAge(unsigned a) { m_maximumAge = a; }
     
 private:
-    PositionOptions(bool highAccuracy, unsigned timeout)
+    PositionOptions(bool highAccuracy, unsigned timeout, unsigned maximumAge)
         : m_highAccuracy(highAccuracy)
         , m_timeout(timeout)
+        , m_maximumAge(maximumAge)
     {
     }
     
     bool m_highAccuracy;
     unsigned m_timeout;
+    unsigned m_maximumAge;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
index 79672a3329..2202559fb2 100644
--- a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
@@ -67,7 +67,7 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
     float ratio = printRect.height() / printRect.width();
 
-    float pageWidth  = (float)root->docWidth();
+    float pageWidth  = (float)root->overflowWidth();
     float pageHeight = pageWidth * ratio;
     outPageHeight = pageHeight;   // this is the height of the page adjusted by margins
     pageHeight -= headerHeight + footerHeight;
@@ -85,7 +85,7 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
     float printedPagesHeight = 0.0;
     do {
         float proposedBottom = std::min(docHeight, printedPagesHeight + pageHeight);
-        m_frame->adjustPageHeight(&proposedBottom, printedPagesHeight, proposedBottom, printedPagesHeight);
+        m_frame->view()->adjustPageHeight(&proposedBottom, printedPagesHeight, proposedBottom, printedPagesHeight);
         currPageHeight = max(1.0f, proposedBottom - printedPagesHeight);
 
         m_pageRects.append(IntRect(0, (int)printedPagesHeight, (int)currPageWidth, (int)currPageHeight));
diff --git a/src/3rdparty/webkit/WebCore/page/Screen.cpp b/src/3rdparty/webkit/WebCore/page/Screen.cpp
index 396a6f4d45..d2bb60f235 100644
--- a/src/3rdparty/webkit/WebCore/page/Screen.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Screen.cpp
@@ -43,6 +43,11 @@ Screen::Screen(Frame* frame)
 {
 }
 
+Frame* Screen::frame() const
+{
+    return m_frame;
+}
+
 void Screen::disconnectFrame()
 {
     m_frame = 0;
diff --git a/src/3rdparty/webkit/WebCore/page/Screen.h b/src/3rdparty/webkit/WebCore/page/Screen.h
index 288b1ac212..2c84abd4d4 100644
--- a/src/3rdparty/webkit/WebCore/page/Screen.h
+++ b/src/3rdparty/webkit/WebCore/page/Screen.h
@@ -40,6 +40,8 @@ namespace WebCore {
     class Screen : public RefCounted<Screen> {
     public:
         static PassRefPtr<Screen> create(Frame *frame) { return adoptRef(new Screen(frame)); }
+
+        Frame* frame() const;
         void disconnectFrame();
 
         unsigned height() const;
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
index 792c3bbe0e..187ec31318 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
@@ -58,14 +58,15 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
     , m_host(url.host().isNull() ? "" : url.host().lower())
     , m_port(url.port())
     , m_noAccess(false)
+    , m_universalAccess(false)
     , m_domainWasSetInDOM(false)
 {
     // These protocols do not create security origins; the owner frame provides the origin
     if (m_protocol == "about" || m_protocol == "javascript")
         m_protocol = "";
 
-    // data: URLs are not allowed access to anything other than themselves.
-    if (m_protocol == "data")
+    // Some URLs are not allowed access to anything other than themselves.
+    if (FrameLoader::shouldTreatURLSchemeAsNoAccess(m_protocol))
         m_noAccess = true;
 
     // document.domain starts as m_host, but can be set by the DOM.
@@ -84,6 +85,7 @@ SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
     , m_domain(other->m_domain.copy())
     , m_port(other->m_port)
     , m_noAccess(other->m_noAccess)
+    , m_universalAccess(other->m_universalAccess)
     , m_domainWasSetInDOM(other->m_domainWasSetInDOM)
     , m_canLoadLocalResources(other->m_canLoadLocalResources)
 {
@@ -96,6 +98,8 @@ bool SecurityOrigin::isEmpty() const
 
 PassRefPtr<SecurityOrigin> SecurityOrigin::create(const KURL& url)
 {
+    if (!url.isValid())
+        return adoptRef(new SecurityOrigin(KURL()));
     return adoptRef(new SecurityOrigin(url));
 }
 
@@ -117,7 +121,7 @@ void SecurityOrigin::setDomainFromDOM(const String& newDomain)
 
 bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
 {  
-    if (isLocal())
+    if (m_universalAccess)
         return true;
 
     if (m_noAccess || other->m_noAccess)
@@ -158,7 +162,7 @@ bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
 
 bool SecurityOrigin::canRequest(const KURL& url) const
 {
-    if (isLocal())
+    if (m_universalAccess)
         return true;
 
     if (m_noAccess)
@@ -182,9 +186,14 @@ void SecurityOrigin::grantLoadLocalResources()
     m_canLoadLocalResources = true;
 }
 
+void SecurityOrigin::grantUniversalAccess()
+{
+    m_universalAccess = true;
+}
+
 bool SecurityOrigin::isLocal() const
 {
-    return FrameLoader::shouldTreatSchemeAsLocal(m_protocol);
+    return FrameLoader::shouldTreatURLSchemeAsLocal(m_protocol);
 }
 
 bool SecurityOrigin::isSecureTransitionTo(const KURL& url) const
@@ -209,7 +218,7 @@ String SecurityOrigin::toString() const
         return String("file://");
 
     Vector<UChar> result;
-    result.reserveCapacity(m_protocol.length() + m_host.length() + 10);
+    result.reserveInitialCapacity(m_protocol.length() + m_host.length() + 10);
     append(result, m_protocol);
     append(result, "://");
     append(result, m_host);
@@ -224,7 +233,7 @@ String SecurityOrigin::toString() const
 
 PassRefPtr<SecurityOrigin> SecurityOrigin::createFromString(const String& originString)
 {
-    return SecurityOrigin::create(KURL(originString));
+    return SecurityOrigin::create(KURL(KURL(), originString));
 }
 
 static const char SeparatorCharacter = '_';
@@ -237,12 +246,13 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createFromDatabaseIdentifier(const St
         return create(KURL());
         
     // Make sure there's a second separator
-    int separator2 = databaseIdentifier.find(SeparatorCharacter, separator1 + 1);
+    int separator2 = databaseIdentifier.reverseFind(SeparatorCharacter);
     if (separator2 == -1)
         return create(KURL());
         
-    // Make sure there's not a third separator
-    if (databaseIdentifier.reverseFind(SeparatorCharacter) != separator2)
+    // Ensure there were at least 2 seperator characters. Some hostnames on intranets have
+    // underscores in them, so we'll assume that any additional underscores are part of the host.
+    if (separator1 != separator2)
         return create(KURL());
         
     // Make sure the port section is a valid port number or doesn't exist
@@ -257,7 +267,7 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createFromDatabaseIdentifier(const St
     // Split out the 3 sections of data
     String protocol = databaseIdentifier.substring(0, separator1);
     String host = databaseIdentifier.substring(separator1 + 1, separator2 - separator1 - 1);
-    return create(KURL(protocol + "://" + host + ":" + String::number(port)));
+    return create(KURL(KURL(), protocol + "://" + host + ":" + String::number(port)));
 }
 
 String SecurityOrigin::databaseIdentifier() const 
@@ -268,6 +278,9 @@ String SecurityOrigin::databaseIdentifier() const
 
 bool SecurityOrigin::equal(const SecurityOrigin* other) const 
 {
+    if (other == this)
+        return true;
+    
     if (!isSameSchemeHostPort(other))
         return false;
 
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
index 1f2624eda1..96f85df657 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
@@ -90,6 +90,11 @@ namespace WebCore {
         //       with older versions of WebKit.
         void grantLoadLocalResources();
 
+        // Explicitly grant the ability to access very other SecurityOrigin.
+        //
+        // WARNING: This is an extremely powerful ability.  Use with caution!
+        void grantUniversalAccess();
+
         bool isSecureTransitionTo(const KURL&) const;
 
         // The local SecurityOrigin is the most privileged SecurityOrigin.
@@ -132,6 +137,7 @@ namespace WebCore {
         String m_domain;
         unsigned short m_port;
         bool m_noAccess;
+        bool m_universalAccess;
         bool m_domainWasSetInDOM;
         bool m_canLoadLocalResources;
     };
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index 9e4b7b5012..91ec0b3546 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,6 +33,8 @@
 #include "PageCache.h"
 #include <limits>
 
+using namespace std;
+
 namespace WebCore {
 
 static void setNeedsReapplyStylesInAllFrames(Page* page)
@@ -53,13 +55,17 @@ Settings::Settings(Page* page)
     , m_minimumLogicalFontSize(0)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
+    , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
+    , m_caretBrowsingEnabled(false)
     , m_arePluginsEnabled(false)
     , m_databasesEnabled(false)
     , m_localStorageEnabled(false)
     , m_isJavaScriptEnabled(false)
+    , m_isWebSecurityEnabled(true)
+    , m_allowUniversalAccessFromFileURLs(true)
     , m_javaScriptCanOpenWindowsAutomatically(false)
     , m_shouldPrintBackgrounds(false)
     , m_textAreasAreResizable(false)
@@ -68,6 +74,8 @@ Settings::Settings(Page* page)
 #endif
     , m_needsAdobeFrameReloadingQuirk(false)
     , m_needsKeyboardEventDisambiguationQuirks(false)
+    , m_needsLeopardMailQuirks(false)
+    , m_needsTigerMailQuirks(false)
     , m_isDOMPasteAllowed(false)
     , m_shrinksStandaloneImagesToFit(true)
     , m_usesPageCache(false)
@@ -80,11 +88,21 @@ Settings::Settings(Page* page)
     , m_webArchiveDebugModeEnabled(false)
     , m_inApplicationChromeMode(false)
     , m_offlineWebApplicationCacheEnabled(false)
-    , m_rangeMutationDisabledForOldAppleMail(false)
     , m_shouldPaintCustomScrollbars(false)
     , m_zoomsTextOnly(false)
     , m_enforceCSSMIMETypeInStrictMode(true)
-    , m_maximumDecodedImageSize(std::numeric_limits<size_t>::max())
+    , m_usesEncodingDetector(false)
+    , m_allowScriptsToCloseWindows(false)
+    , m_editingBehavior(
+#if PLATFORM(MAC)
+        EditingMacBehavior
+#else
+        EditingWindowsBehavior
+#endif
+        )
+    // FIXME: This should really be disabled by default as it makes platforms that don't support the feature download files
+    // they can't use by. Leaving enabled for now to not change existing behavior.
+    , m_downloadableBinaryFontsEnabled(true)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -191,6 +209,16 @@ void Settings::setJavaScriptEnabled(bool isJavaScriptEnabled)
     m_isJavaScriptEnabled = isJavaScriptEnabled;
 }
 
+void Settings::setWebSecurityEnabled(bool isWebSecurityEnabled)
+{
+    m_isWebSecurityEnabled = isWebSecurityEnabled;
+}
+
+void Settings::setAllowUniversalAccessFromFileURLs(bool allowUniversalAccessFromFileURLs)
+{
+    m_allowUniversalAccessFromFileURLs = allowUniversalAccessFromFileURLs;
+}
+
 void Settings::setJavaEnabled(bool isJavaEnabled)
 {
     m_isJavaEnabled = isJavaEnabled;
@@ -283,6 +311,16 @@ void Settings::setNeedsKeyboardEventDisambiguationQuirks(bool needsQuirks)
     m_needsKeyboardEventDisambiguationQuirks = needsQuirks;
 }
 
+void Settings::setNeedsLeopardMailQuirks(bool needsQuirks)
+{
+    m_needsLeopardMailQuirks = needsQuirks;
+}
+
+void Settings::setNeedsTigerMailQuirks(bool needsQuirks)
+{
+    m_needsTigerMailQuirks = needsQuirks;
+}
+    
 void Settings::setDOMPasteAllowed(bool DOMPasteAllowed)
 {
     m_isDOMPasteAllowed = DOMPasteAllowed;
@@ -364,11 +402,6 @@ void Settings::setLocalStorageDatabasePath(const String& path)
     m_localStorageDatabasePath = path;
 }
 
-void Settings::disableRangeMutationForOldAppleMail(bool disable)
-{
-    m_rangeMutationDisabledForOldAppleMail = disable;
-}
-
 void Settings::setApplicationChromeMode(bool mode)
 {
     m_inApplicationChromeMode = mode;
@@ -405,4 +438,24 @@ void Settings::setShouldPaintNativeControls(bool shouldPaintNativeControls)
 }
 #endif
 
+void Settings::setUsesEncodingDetector(bool usesEncodingDetector)
+{
+    m_usesEncodingDetector = usesEncodingDetector;
+}
+
+void Settings::setAllowScriptsToCloseWindows(bool allowScriptsToCloseWindows)
+{
+    m_allowScriptsToCloseWindows = allowScriptsToCloseWindows;
+}
+
+void Settings::setCaretBrowsingEnabled(bool caretBrowsingEnabled)
+{
+    m_caretBrowsingEnabled = caretBrowsingEnabled;
+}
+
+void Settings::setDownloadableBinaryFontsEnabled(bool downloadableBinaryFontsEnabled)
+{
+    m_downloadableBinaryFontsEnabled = downloadableBinaryFontsEnabled;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index d46a3c6fa6..62cf7f6f3a 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,7 +28,7 @@
 #define Settings_h
 
 #include "AtomicString.h"
-#include "FontDescription.h"
+#include "FontRenderingMode.h"
 #include "KURL.h"
 
 namespace WebCore {
@@ -36,7 +36,7 @@ namespace WebCore {
     class Page;
 
     enum EditableLinkBehavior {
-        EditableLinkDefaultBehavior = 0,
+        EditableLinkDefaultBehavior,
         EditableLinkAlwaysLive,
         EditableLinkOnlyLiveWithShiftKey,
         EditableLinkLiveWhenNotFocused,
@@ -49,6 +49,21 @@ namespace WebCore {
         TextDirectionSubmenuAlwaysIncluded
     };
 
+    // There are multiple editing details that are different on Windows than Macintosh.
+    // We use a single switch for all of them. Some examples:
+    //
+    //    1) Clicking below the last line of an editable area puts the caret at the end
+    //       of the last line on Mac, but in the middle of the last line on Windows.
+    //    2) Pushing the down arrow key on the last line puts the caret at the end of the
+    //       last line on Mac, but does nothing on Windows. A similar case exists on the
+    //       top line.
+    //
+    // This setting is intended to control these sorts of behaviors. There are some other
+    // behaviors with individual function calls on EditorClient (smart copy and paste and
+    // selecting the space after a double click) that could be combined with this if
+    // if possible in the future.
+    enum EditingBehavior { EditingMacBehavior, EditingWindowsBehavior };
+
     class Settings {
     public:
         Settings(Page*);
@@ -89,8 +104,14 @@ namespace WebCore {
         void setJavaScriptEnabled(bool);
         bool isJavaScriptEnabled() const { return m_isJavaScriptEnabled; }
 
+        void setWebSecurityEnabled(bool);
+        bool isWebSecurityEnabled() const { return m_isWebSecurityEnabled; }
+
+        void setAllowUniversalAccessFromFileURLs(bool);
+        bool allowUniversalAccessFromFileURLs() const { return m_allowUniversalAccessFromFileURLs; }
+
         void setJavaScriptCanOpenWindowsAutomatically(bool);
-        bool JavaScriptCanOpenWindowsAutomatically() const { return m_javaScriptCanOpenWindowsAutomatically; }
+        bool javaScriptCanOpenWindowsAutomatically() const { return m_javaScriptCanOpenWindowsAutomatically; }
 
         void setJavaEnabled(bool);
         bool isJavaEnabled() const { return m_isJavaEnabled; }
@@ -106,9 +127,15 @@ namespace WebCore {
 
         void setPrivateBrowsingEnabled(bool);
         bool privateBrowsingEnabled() const { return m_privateBrowsingEnabled; }
-        
+
+        void setCaretBrowsingEnabled(bool);
+        bool caretBrowsingEnabled() const { return m_caretBrowsingEnabled; }
+
         void setDefaultTextEncodingName(const String&);
         const String& defaultTextEncodingName() const { return m_defaultTextEncodingName; }
+        
+        void setUsesEncodingDetector(bool);
+        bool usesEncodingDetector() const { return m_usesEncodingDetector; }
 
         void setUserStyleSheetLocation(const KURL&);
         const KURL& userStyleSheetLocation() const { return m_userStyleSheetLocation; }
@@ -136,6 +163,12 @@ namespace WebCore {
         void setNeedsKeyboardEventDisambiguationQuirks(bool);
         bool needsKeyboardEventDisambiguationQuirks() const { return m_needsKeyboardEventDisambiguationQuirks; }
 
+        void setNeedsLeopardMailQuirks(bool);
+        bool needsLeopardMailQuirks() const { return m_needsLeopardMailQuirks; }
+
+        void setNeedsTigerMailQuirks(bool);
+        bool needsTigerMailQuirks() const { return m_needsTigerMailQuirks; }
+
         void setDOMPasteAllowed(bool);
         bool isDOMPasteAllowed() const { return m_isDOMPasteAllowed; }
         
@@ -172,9 +205,6 @@ namespace WebCore {
         void setLocalStorageDatabasePath(const String&);
         const String& localStorageDatabasePath() const { return m_localStorageDatabasePath; }
         
-        void disableRangeMutationForOldAppleMail(bool);
-        bool rangeMutationDisabledForOldAppleMail() const { return m_rangeMutationDisabledForOldAppleMail; }
-
         void setApplicationChromeMode(bool);
         bool inApplicationChromeMode() const { return m_inApplicationChromeMode; }
 
@@ -199,6 +229,15 @@ namespace WebCore {
         static bool shouldPaintNativeControls() { return gShouldPaintNativeControls; }
 #endif
 
+        void setAllowScriptsToCloseWindows(bool);
+        bool allowScriptsToCloseWindows() const { return m_allowScriptsToCloseWindows; }
+
+        void setEditingBehavior(EditingBehavior behavior) { m_editingBehavior = behavior; }
+        EditingBehavior editingBehavior() const { return static_cast<EditingBehavior>(m_editingBehavior); }
+        
+        void setDownloadableBinaryFontsEnabled(bool);
+        bool downloadableBinaryFontsEnabled() const { return m_downloadableBinaryFontsEnabled; }
+
     private:
         Page* m_page;
         
@@ -218,13 +257,17 @@ namespace WebCore {
         int m_minimumLogicalFontSize;
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
+        size_t m_maximumDecodedImageSize;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
+        bool m_caretBrowsingEnabled : 1;
         bool m_arePluginsEnabled : 1;
         bool m_databasesEnabled : 1;
         bool m_localStorageEnabled : 1;
         bool m_isJavaScriptEnabled : 1;
+        bool m_isWebSecurityEnabled : 1;
+        bool m_allowUniversalAccessFromFileURLs: 1;
         bool m_javaScriptCanOpenWindowsAutomatically : 1;
         bool m_shouldPrintBackgrounds : 1;
         bool m_textAreasAreResizable : 1;
@@ -233,6 +276,8 @@ namespace WebCore {
 #endif
         bool m_needsAdobeFrameReloadingQuirk : 1;
         bool m_needsKeyboardEventDisambiguationQuirks : 1;
+        bool m_needsLeopardMailQuirks : 1;
+        bool m_needsTigerMailQuirks : 1;
         bool m_isDOMPasteAllowed : 1;
         bool m_shrinksStandaloneImagesToFit : 1;
         bool m_usesPageCache: 1;
@@ -245,11 +290,13 @@ namespace WebCore {
         bool m_webArchiveDebugModeEnabled : 1;
         bool m_inApplicationChromeMode : 1;
         bool m_offlineWebApplicationCacheEnabled : 1;
-        bool m_rangeMutationDisabledForOldAppleMail : 1;
         bool m_shouldPaintCustomScrollbars : 1;
         bool m_zoomsTextOnly : 1;
         bool m_enforceCSSMIMETypeInStrictMode : 1;
-        size_t m_maximumDecodedImageSize;
+        bool m_usesEncodingDetector : 1;
+        bool m_allowScriptsToCloseWindows : 1;
+        unsigned m_editingBehavior : 1;
+        bool m_downloadableBinaryFontsEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/src/3rdparty/webkit/WebCore/page/WebKitPoint.h b/src/3rdparty/webkit/WebCore/page/WebKitPoint.h
new file mode 100644
index 0000000000..501b17f261
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/WebKitPoint.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebKitPoint_h
+#define WebKitPoint_h
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class WebKitPoint : public RefCounted<WebKitPoint> {
+    public:
+
+        static PassRefPtr<WebKitPoint> create()
+        {
+            return adoptRef(new WebKitPoint());
+        }
+        static PassRefPtr<WebKitPoint> create(float x, float y)
+        {
+            return adoptRef(new WebKitPoint(x, y));
+        }
+
+        float x() const { return m_x; }
+        float y() const { return m_y; }
+        
+        void setX(float x) { m_x = x; }
+        void setY(float y) { m_y = y; }
+
+    private:
+        WebKitPoint(float x=0, float y=0)
+            : m_x(x)
+            , m_y(y)
+        {
+        }
+
+        float m_x, m_y;
+    };
+
+} // namespace WebCore
+
+#endif // WebKitPoint_h
diff --git a/src/3rdparty/webkit/WebCore/page/WebKitPoint.idl b/src/3rdparty/webkit/WebCore/page/WebKitPoint.idl
new file mode 100644
index 0000000000..1eefbc3a97
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/WebKitPoint.idl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module window {
+
+    interface WebKitPoint {
+        attribute float x;
+        attribute float y;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp
new file mode 100644
index 0000000000..94c1cbb51e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DragController.h"
+
+#include "DragData.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+bool DragController::isCopyKeyDown()
+{
+    return false;
+}
+    
+DragOperation DragController::dragOperation(DragData* dragData)
+{
+    // FIXME: This logic is incomplete
+    notImplemented();
+    if (dragData->containsURL())
+        return DragOperationCopy;
+
+   return DragOperationNone;
+} 
+
+const float DragController::DragImageAlpha = 1.0f;
+static IntSize dummy;
+const IntSize& DragController::maxDragImageSize() { return dummy; }
+const int DragController::DragIconRightInset = 0;
+const int DragController::DragIconBottomInset = 0;
+const int DragController::LinkDragBorderInset = 0;
+const int DragController::MaxOriginalImageArea = 0;
+
+}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
new file mode 100644
index 0000000000..24644296ca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+#define LOG_TAG "WebCore"
+
+#include "config.h"
+#include "EventHandler.h"
+
+#include "FocusController.h"
+#include "Frame.h"
+#include "KeyboardEvent.h"
+#include "MouseEventWithHitTestResults.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformWheelEvent.h"
+#include "RenderWidget.h"
+
+namespace WebCore {
+
+unsigned EventHandler::s_accessKeyModifiers = PlatformKeyboardEvent::AltKey;
+
+bool EventHandler::tabsToAllControls(KeyboardEvent* ) const
+{
+    return true;
+}
+
+void EventHandler::focusDocumentView()
+{
+    if (Page* page = m_frame->page())
+        page->focusController()->setFocusedFrame(m_frame);
+}
+
+bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
+{
+    // Figure out which view to send the event to.
+    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
+    if (!target || !target->isWidget())
+        return false;
+    
+    return passMouseDownEventToWidget(static_cast<RenderWidget*>(target)->widget());
+}
+
+bool EventHandler::passWidgetMouseDownEventToWidget(RenderWidget* renderWidget)
+{
+    return passMouseDownEventToWidget(renderWidget->widget());
+}
+
+// This function is used to route the mouse down event to the native widgets, it seems like a
+// work around for the Mac platform which does not support double clicks, but browsers do.
+bool EventHandler::passMouseDownEventToWidget(Widget* )
+{
+    // return false so the normal propogation handles the event
+    return false;
+}
+
+bool EventHandler::eventActivatedView(const PlatformMouseEvent& ) const
+{
+    notImplemented();
+    return false;
+}
+
+// This function is called for mouse events by FrameView::handleMousePressEvent().
+// It is used to ensure that events are sync'ed correctly between frames. For example
+// if the user presses down in one frame and up in another frame, this function will
+// returns true, and pass the event to the correct frame.
+bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& , Frame* , HitTestResult* )
+{
+    notImplemented();
+    return false;
+}
+
+// This is called to route wheel events to child widgets when they are RenderWidget
+// as the parent usually gets wheel event. Don't have a mouse with a wheel to confirm
+// the operation of this function.
+bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& , Widget* )
+{
+    notImplemented();
+    return false;
+}
+
+bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
+{
+    return passSubframeEventToSubframe(mev, subframe);
+}
+
+bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, 
+    Frame* subframe, HitTestResult* )
+{
+    return passSubframeEventToSubframe(mev, subframe);
+}
+
+bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
+{
+    return passSubframeEventToSubframe(mev, subframe);
+}
+
+class Clipboard : public RefCounted<Clipboard> {
+};
+
+PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
+{
+    return PassRefPtr<Clipboard>(0);
+}
+
+const double EventHandler::TextDragDelay = 0.0;
+
+}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
new file mode 100644
index 0000000000..978bc253bd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2007, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorController.h"
+
+#include "Frame.h"
+#include "Node.h"
+#include "Profile.h"
+
+// This stub file was created to avoid building and linking in all the
+// Inspector codebase. If you would like to enable the Inspector, do the
+// following steps:
+// 1. Replace this file in WebCore/Android.mk with the common
+//    implementation, ie page/InsepctorController.cpp
+// 2. Add the JS API files to JavaScriptCore/Android.mk:
+// ?  API/JSBase.cpp \
+//      API/JSCallbackConstructor.cpp \
+//      API/JSCallbackFunction.cpp \
+//      API/JSCallbackObject.cpp \
+//      API/JSClassRef.cpp \
+//      API/JSContextRef.cpp \
+//      API/JSObjectRef.cpp \
+//      API/JSStringRef.cpp \
+//      API/JSValueRef.cpp
+// 3. Add the following LOCAL_C_INCLUDES to JavaScriptCore/Android.mk:
+// ?$(LOCAL_PATH)/API \
+//      $(LOCAL_PATH)/ForwardingHeaders \
+//      $(LOCAL_PATH)/../../WebKit \
+// 4. Rebuild WebKit
+//
+// Note, for a functional Inspector, you must implement InspectorClientAndroid.
+
+namespace WebCore {
+
+struct InspectorResource : public RefCounted<InspectorResource> {
+};
+
+struct InspectorDatabaseResource : public RefCounted<InspectorDatabaseResource> {
+};
+
+InspectorController::InspectorController(Page*, InspectorClient*)
+    : m_startProfiling(this, 0)
+{
+}
+
+InspectorController::~InspectorController() {}
+
+void InspectorController::windowScriptObjectAvailable() {}
+void InspectorController::didCommitLoad(DocumentLoader*) {}
+void InspectorController::identifierForInitialRequest(unsigned long, DocumentLoader*, ResourceRequest const&) {}
+void InspectorController::willSendRequest(DocumentLoader*, unsigned long, ResourceRequest&, ResourceResponse const&) {}
+void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long, ResourceResponse const&) {}
+void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long, int) {}
+void InspectorController::didFinishLoading(DocumentLoader*, unsigned long) {}
+void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader*, ResourceRequest const&, ResourceResponse const&, int) {}
+void InspectorController::frameDetachedFromParent(Frame*) {}
+
+void InspectorController::addMessageToConsole(MessageSource, MessageLevel, JSC::ExecState*, JSC::ArgList const&, unsigned int, String const&) {}
+void InspectorController::addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID) {}
+#if ENABLE(DATABASE)
+void InspectorController::didOpenDatabase(Database*, String const&, String const&, String const&) {}
+#endif
+bool InspectorController::enabled() const { return false; }
+void InspectorController::inspect(Node*) {}
+bool InspectorController::windowVisible() { return false; }
+void InspectorController::addProfile(PassRefPtr<JSC::Profile>, unsigned int, const JSC::UString&) {}
+void InspectorController::inspectedPageDestroyed() {}
+void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, JSC::UString& sourceString) {}
+
+void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame) {}
+void InspectorController::startGroup(MessageSource source, JSC::ExecState* exec, const JSC::ArgList& arguments, unsigned lineNumber, const String& sourceURL) {}
+void InspectorController::endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL) {}
+void InspectorController::startTiming(const JSC::UString& title) {}
+bool InspectorController::stopTiming(const JSC::UString& title, double& elapsed) { return false; }
+void InspectorController::count(const JSC::UString& title, unsigned lineNumber, const String& sourceID) {}
+
+void InspectorController::mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) {}
+void InspectorController::handleMousePressOnNode(Node*) {}
+void InspectorController::failedToParseSource(JSC::ExecState* exec, const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage) {}    
+void InspectorController::didParseSource(JSC::ExecState* exec, const JSC::SourceCode& source) {}
+void InspectorController::didPause() {}
+
+}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
index 60bc77481b..7b8a189d02 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
@@ -29,7 +29,9 @@
 #include "config.h"
 #include "AnimationBase.h"
 
-#include "AnimationController.h"
+#include "AnimationControllerPrivate.h"
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
 #include "CString.h"
 #include "CompositeAnimation.h"
@@ -41,11 +43,15 @@
 #include "ImplicitAnimation.h"
 #include "KeyframeAnimation.h"
 #include "MatrixTransformOperation.h"
-#include "RenderObject.h"
+#include "Matrix3DTransformOperation.h"
+#include "RenderBox.h"
 #include "RenderStyle.h"
-#include "SystemTime.h"
 #include "UnitBezier.h"
 
+#include <algorithm>
+
+using namespace std;
+
 namespace WebCore {
 
 // The epsilon value we pass to UnitBezier::solve given that the animation is going to run over |dur| seconds. The longer the
@@ -79,7 +85,11 @@ static inline float blendFunc(const AnimationBase*, float from, float to, double
 }
 
 static inline Color blendFunc(const AnimationBase* anim, const Color& from, const Color& to, double progress)
-{  
+{
+    // We need to preserve the state of the valid flag at the end of the animation
+    if (progress == 1 && !to.isValid())
+        return Color();
+
     return Color(blendFunc(anim, from.red(), to.red(), progress),
                  blendFunc(anim, from.green(), to.green(), progress),
                  blendFunc(anim, from.blue(), to.blue(), progress),
@@ -91,6 +101,12 @@ static inline Length blendFunc(const AnimationBase*, const Length& from, const L
     return to.blend(from, progress);
 }
 
+static inline LengthSize blendFunc(const AnimationBase* anim, const LengthSize& from, const LengthSize& to, double progress)
+{  
+    return LengthSize(blendFunc(anim, from.width(), to.width(), progress),
+                      blendFunc(anim, from.height(), to.height(), progress));
+}
+
 static inline IntSize blendFunc(const AnimationBase* anim, const IntSize& from, const IntSize& to, double progress)
 {  
     return IntSize(blendFunc(anim, from.width(), to.width(), progress),
@@ -129,7 +145,7 @@ static inline TransformOperations blendFunc(const AnimationBase* anim, const Tra
         }
     } else {
         // Convert the TransformOperations into matrices
-        IntSize size = anim->renderer()->borderBox().size();
+        IntSize size = anim->renderer()->isBox() ? toRenderBox(anim->renderer())->borderBoxRect().size() : IntSize();
         TransformationMatrix fromT;
         TransformationMatrix toT;
         from.apply(size, fromT);
@@ -138,7 +154,7 @@ static inline TransformOperations blendFunc(const AnimationBase* anim, const Tra
         toT.blend(fromT, progress);
         
         // Append the result
-        result.operations().append(MatrixTransformOperation::create(toT.a(), toT.b(), toT.c(), toT.d(), toT.e(), toT.f()));
+        result.operations().append(Matrix3DTransformOperation::create(toT));
     }
     return result;
 }
@@ -155,6 +171,11 @@ static inline EVisibility blendFunc(const AnimationBase* anim, EVisibility from,
     return result > 0. ? VISIBLE : (to != VISIBLE ? to : from);
 }
 
+class PropertyWrapperBase;
+
+static void addShorthandProperties();
+static PropertyWrapperBase* wrapperForProperty(int propertyID);
+
 class PropertyWrapperBase {
 public:
     PropertyWrapperBase(int prop)
@@ -163,11 +184,17 @@ public:
     }
 
     virtual ~PropertyWrapperBase() { }
+    
+    virtual bool isShorthandWrapper() const { return false; }
     virtual bool equals(const RenderStyle* a, const RenderStyle* b) const = 0;
     virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const = 0;
 
     int property() const { return m_prop; }
 
+#if USE(ACCELERATED_COMPOSITING)
+    virtual bool animationIsAccelerated() const { return false; }
+#endif
+
 private:
     int m_prop;
 };
@@ -185,7 +212,7 @@ public:
     {
        // If the style pointers are the same, don't bother doing the test.
        // If either is null, return false. If both are null, return true.
-       if (!a && !b || a == b)
+       if ((!a && !b) || a == b)
            return true;
        if (!a || !b)
             return false;
@@ -214,6 +241,41 @@ protected:
     void (RenderStyle::*m_setter)(T);
 };
 
+#if USE(ACCELERATED_COMPOSITING)
+class PropertyWrapperAcceleratedOpacity : public PropertyWrapper<float> {
+public:
+    PropertyWrapperAcceleratedOpacity()
+        : PropertyWrapper<float>(CSSPropertyOpacity, &RenderStyle::opacity, &RenderStyle::setOpacity)
+    {
+    }
+
+    virtual bool animationIsAccelerated() const { return true; }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        float fromOpacity = a->opacity();
+        
+        // This makes sure we put the object being animated into a RenderLayer during the animation
+        dst->setOpacity(blendFunc(anim, (fromOpacity == 1) ? 0.999999f : fromOpacity, b->opacity(), progress));
+    }
+};
+
+class PropertyWrapperAcceleratedTransform : public PropertyWrapper<const TransformOperations&> {
+public:
+    PropertyWrapperAcceleratedTransform()
+        : PropertyWrapper<const TransformOperations&>(CSSPropertyWebkitTransform, &RenderStyle::transform, &RenderStyle::setTransform)
+    {
+    }
+    
+    virtual bool animationIsAccelerated() const { return true; }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        dst->setTransform(blendFunc(anim, a->transform(), b->transform(), progress));
+    }
+};
+#endif // USE(ACCELERATED_COMPOSITING)
+
 class PropertyWrapperShadow : public PropertyWrapperGetter<ShadowData*> {
 public:
     PropertyWrapperShadow(int prop, ShadowData* (RenderStyle::*getter)() const, void (RenderStyle::*setter)(ShadowData*, bool))
@@ -227,7 +289,7 @@ public:
         ShadowData* shadowA = (a->*m_getter)();
         ShadowData* shadowB = (b->*m_getter)();
 
-        if (!shadowA && shadowB || shadowA && !shadowB)
+        if ((!shadowA && shadowB) || (shadowA && !shadowB))
             return false;
         if (shadowA && shadowB && (*shadowA != *shadowB))
             return false;
@@ -289,9 +351,48 @@ private:
     void (RenderStyle::*m_setter)(const Color&);
 };
 
+class ShorthandPropertyWrapper : public PropertyWrapperBase {
+public:
+    ShorthandPropertyWrapper(int property, const CSSPropertyLonghand& longhand)
+        : PropertyWrapperBase(property)
+    {
+        for (unsigned i = 0; i < longhand.length(); ++i) {
+            PropertyWrapperBase* wrapper = wrapperForProperty(longhand.properties()[i]);
+            if (wrapper)
+                m_propertyWrappers.append(wrapper);
+        }
+    }
+
+    virtual bool isShorthandWrapper() const { return true; }
+
+    virtual bool equals(const RenderStyle* a, const RenderStyle* b) const
+    {
+        Vector<PropertyWrapperBase*>::const_iterator end = m_propertyWrappers.end();
+        for (Vector<PropertyWrapperBase*>::const_iterator it = m_propertyWrappers.begin(); it != end; ++it) {
+            if (!(*it)->equals(a, b))
+                return false;
+        }
+        return true;
+    }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        Vector<PropertyWrapperBase*>::const_iterator end = m_propertyWrappers.end();
+        for (Vector<PropertyWrapperBase*>::const_iterator it = m_propertyWrappers.begin(); it != end; ++it)
+            (*it)->blend(anim, dst, a, b, progress);
+    }
+
+private:
+    Vector<PropertyWrapperBase*> m_propertyWrappers;
+};
+
+
 static Vector<PropertyWrapperBase*>* gPropertyWrappers = 0;
 static int gPropertyWrapperMap[numCSSProperties];
 
+static const int cInvalidPropertyWrapperIndex = -1;
+
+
 static void ensurePropertyMap()
 {
     // FIXME: This data is never destroyed. Maybe we should ref count it and toss it when the last AnimationController is destroyed?
@@ -317,9 +418,17 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyPaddingRight, &RenderStyle::paddingRight, &RenderStyle::setPaddingRight));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyPaddingTop, &RenderStyle::paddingTop, &RenderStyle::setPaddingTop));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyPaddingBottom, &RenderStyle::paddingBottom, &RenderStyle::setPaddingBottom));
-        gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyOpacity, &RenderStyle::opacity, &RenderStyle::setOpacity));
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyColor, &RenderStyle::color, &RenderStyle::setColor));
+
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyBackgroundColor, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundXPosition, &RenderStyle::setBackgroundXPosition));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundYPosition, &RenderStyle::setBackgroundYPosition));
+        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitBackgroundSize, &RenderStyle::backgroundSize, &RenderStyle::setBackgroundSize));
+
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskXPosition, &RenderStyle::setMaskXPosition));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskYPosition, &RenderStyle::setMaskYPosition));
+        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitMaskSize, &RenderStyle::maskSize, &RenderStyle::setMaskSize));
+
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyFontSize, &RenderStyle::fontSize, &RenderStyle::setBlendedFontSize));
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyWebkitColumnRuleWidth, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth));
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyWebkitColumnGap, &RenderStyle::columnGap, &RenderStyle::setColumnGap));
@@ -333,15 +442,27 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyOutlineWidth, &RenderStyle::outlineWidth, &RenderStyle::setOutlineWidth));
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyLetterSpacing, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing));
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyWordSpacing, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing));
-        gPropertyWrappers->append(new PropertyWrapper<const TransformOperations&>(CSSPropertyWebkitTransform, &RenderStyle::transform, &RenderStyle::setTransform));
+        gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyWebkitPerspective, &RenderStyle::perspective, &RenderStyle::setPerspective));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitPerspectiveOriginX, &RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitPerspectiveOriginY, &RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitTransformOriginX, &RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitTransformOriginY, &RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY));
+        gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyWebkitTransformOriginZ, &RenderStyle::transformOriginZ, &RenderStyle::setTransformOriginZ));
         gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderTopLeftRadius, &RenderStyle::borderTopLeftRadius, &RenderStyle::setBorderTopLeftRadius));
         gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderTopRightRadius, &RenderStyle::borderTopRightRadius, &RenderStyle::setBorderTopRightRadius));
         gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderBottomLeftRadius, &RenderStyle::borderBottomLeftRadius, &RenderStyle::setBorderBottomLeftRadius));
         gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderBottomRightRadius, &RenderStyle::borderBottomRightRadius, &RenderStyle::setBorderBottomRightRadius));
         gPropertyWrappers->append(new PropertyWrapper<EVisibility>(CSSPropertyVisibility, &RenderStyle::visibility, &RenderStyle::setVisibility));
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyZoom, &RenderStyle::zoom, &RenderStyle::setZoom));
+        
+#if USE(ACCELERATED_COMPOSITING)
+        gPropertyWrappers->append(new PropertyWrapperAcceleratedOpacity());
+        gPropertyWrappers->append(new PropertyWrapperAcceleratedTransform());
+#else
+        gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyOpacity, &RenderStyle::opacity, &RenderStyle::setOpacity));
+        gPropertyWrappers->append(new PropertyWrapper<const TransformOperations&>(CSSPropertyWebkitTransform, &RenderStyle::transform, &RenderStyle::setTransform));
+#endif
+
         gPropertyWrappers->append(new PropertyWrapperMaybeInvalidColor(CSSPropertyWebkitColumnRuleColor, &RenderStyle::columnRuleColor, &RenderStyle::setColumnRuleColor));
         gPropertyWrappers->append(new PropertyWrapperMaybeInvalidColor(CSSPropertyWebkitTextStrokeColor, &RenderStyle::textStrokeColor, &RenderStyle::setTextStrokeColor));
         gPropertyWrappers->append(new PropertyWrapperMaybeInvalidColor(CSSPropertyWebkitTextFillColor, &RenderStyle::textFillColor, &RenderStyle::setTextFillColor));
@@ -361,30 +482,107 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyStrokeOpacity, &RenderStyle::strokeOpacity, &RenderStyle::setStrokeOpacity));
 #endif
 
+        // TODO:
+        // 
+        //  CSSPropertyMinWidth, CSSPropertyMaxWidth, CSSPropertyMinHeight, CSSPropertyMaxHeight
+        //  CSSPropertyTextIndent
+        //  CSSPropertyVerticalAlign
+        // 
+        // Compound properties that have components that should be animatable:
+        // 
+        //  CSSPropertyWebkitColumns
+        //  CSSPropertyWebkitBoxReflect
+
         // Make sure unused slots have a value
-        for (unsigned int i = 0; i < (unsigned int) numCSSProperties; ++i)
-            gPropertyWrapperMap[i] = CSSPropertyInvalid;
+        for (unsigned int i = 0; i < static_cast<unsigned int>(numCSSProperties); ++i)
+            gPropertyWrapperMap[i] = cInvalidPropertyWrapperIndex;
 
+        // First we put the non-shorthand property wrappers into the map, so the shorthand-building
+        // code can find them.
         size_t n = gPropertyWrappers->size();
         for (unsigned int i = 0; i < n; ++i) {
             ASSERT((*gPropertyWrappers)[i]->property() - firstCSSProperty < numCSSProperties);
             gPropertyWrapperMap[(*gPropertyWrappers)[i]->property() - firstCSSProperty] = i;
         }
+        
+        // Now add the shorthand wrappers.
+        addShorthandProperties();
+    }
+}
+
+static void addPropertyWrapper(int propertyID, PropertyWrapperBase* wrapper)
+{
+    int propIndex = propertyID - firstCSSProperty;
+
+    ASSERT(gPropertyWrapperMap[propIndex] == cInvalidPropertyWrapperIndex);
+
+    unsigned wrapperIndex = gPropertyWrappers->size();
+    gPropertyWrappers->append(wrapper);
+    gPropertyWrapperMap[propIndex] = wrapperIndex;
+}
+
+static void addShorthandProperties()
+{
+    static const int animatableShorthandProperties[] = {
+        CSSPropertyBackground,      // for background-color, background-position
+        CSSPropertyBackgroundPosition,
+        CSSPropertyWebkitMask,      // for mask-position
+        CSSPropertyWebkitMaskPosition,
+        CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft,
+        CSSPropertyBorderColor, 
+        CSSPropertyBorderWidth,
+        CSSPropertyBorder,
+        CSSPropertyBorderSpacing,
+        CSSPropertyMargin,
+        CSSPropertyOutline,
+        CSSPropertyPadding,
+        CSSPropertyWebkitTextStroke,
+        CSSPropertyWebkitColumnRule,
+        CSSPropertyWebkitBorderRadius,
+        CSSPropertyWebkitTransformOrigin
+    };
+
+    for (unsigned i = 0; i < sizeof(animatableShorthandProperties) / sizeof(animatableShorthandProperties[0]); ++i) {
+        int propertyID = animatableShorthandProperties[i];
+        CSSPropertyLonghand longhand = longhandForProperty(propertyID);
+        if (longhand.length() > 0)
+            addPropertyWrapper(propertyID, new ShorthandPropertyWrapper(propertyID, longhand));
+    }
+
+    // 'font' is not in the shorthand map.
+    static const int animatableFontProperties[] = {
+        CSSPropertyFontSize,
+        CSSPropertyFontWeight
+    };
+
+    CSSPropertyLonghand fontLonghand(animatableFontProperties, sizeof(animatableFontProperties) / sizeof(animatableFontProperties[0]));
+    addPropertyWrapper(CSSPropertyFont, new ShorthandPropertyWrapper(CSSPropertyFont, fontLonghand));
+}
+
+static PropertyWrapperBase* wrapperForProperty(int propertyID)
+{
+    int propIndex = propertyID - firstCSSProperty;
+    if (propIndex >= 0 && propIndex < numCSSProperties) {
+        int wrapperIndex = gPropertyWrapperMap[propIndex];
+        if (wrapperIndex >= 0)
+            return (*gPropertyWrappers)[wrapperIndex];
     }
+    return 0;
 }
 
 AnimationBase::AnimationBase(const Animation* transition, RenderObject* renderer, CompositeAnimation* compAnim)
     : m_animState(AnimationStateNew)
     , m_isAnimating(false)
-    , m_waitedForResponse(false)
     , m_startTime(0)
     , m_pauseTime(-1)
     , m_requestedStartTime(0)
     , m_object(renderer)
     , m_animation(const_cast<Animation*>(transition))
     , m_compAnim(compAnim)
+    , m_fallbackAnimating(false)
     , m_transformFunctionListValid(false)
     , m_nextIterationDuration(-1)
+    , m_next(0)
 {
     // Compute the total duration
     m_totalDuration = -1;
@@ -394,8 +592,8 @@ AnimationBase::AnimationBase(const Animation* transition, RenderObject* renderer
 
 AnimationBase::~AnimationBase()
 {
-    if (m_animState == AnimationStateStartWaitStyleAvailable)
-        m_compAnim->setWaitingForStyleAvailable(false);
+    m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+    m_compAnim->animationController()->removeFromStartTimeResponseWaitList(this);
 }
 
 bool AnimationBase::propertiesEqual(int prop, const RenderStyle* a, const RenderStyle* b)
@@ -404,27 +602,28 @@ bool AnimationBase::propertiesEqual(int prop, const RenderStyle* a, const Render
     if (prop == cAnimateAll) {
         size_t n = gPropertyWrappers->size();
         for (unsigned int i = 0; i < n; ++i) {
-            if (!(*gPropertyWrappers)[i]->equals(a, b))
+            PropertyWrapperBase* wrapper = (*gPropertyWrappers)[i];
+            // No point comparing shorthand wrappers for 'all'.
+            if (!wrapper->isShorthandWrapper() && !wrapper->equals(a, b))
                 return false;
         }
     } else {
-        int propIndex = prop - firstCSSProperty;
-
-        if (propIndex >= 0 && propIndex < numCSSProperties) {
-            int i = gPropertyWrapperMap[propIndex];
-            return i >= 0 ? (*gPropertyWrappers)[i]->equals(a, b) : true;
-        }
+        PropertyWrapperBase* wrapper = wrapperForProperty(prop);
+        if (wrapper)
+            return wrapper->equals(a, b);
     }
     return true;
 }
 
-int AnimationBase::getPropertyAtIndex(int i)
+int AnimationBase::getPropertyAtIndex(int i, bool& isShorthand)
 {
     ensurePropertyMap();
     if (i < 0 || i >= static_cast<int>(gPropertyWrappers->size()))
         return CSSPropertyInvalid;
 
-    return (*gPropertyWrappers)[i]->property();
+    PropertyWrapperBase* wrapper = (*gPropertyWrappers)[i];
+    isShorthand = wrapper->isShorthandWrapper();
+    return wrapper->property();
 }
 
 int AnimationBase::getNumProperties()
@@ -437,41 +636,35 @@ int AnimationBase::getNumProperties()
 bool AnimationBase::blendProperties(const AnimationBase* anim, int prop, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress)
 {
     ASSERT(prop != cAnimateAll);
-    // FIXME: Why can this happen?
-    
-    ensurePropertyMap();
-    if (prop == cAnimateAll) {
-        bool needsTimer = false;
-
-        size_t n = gPropertyWrappers->size();
-        for (unsigned int i = 0; i < n; ++i) {
-            PropertyWrapperBase* wrapper = (*gPropertyWrappers)[i];
-            if (!wrapper->equals(a, b)) {
-                wrapper->blend(anim, dst, a, b, progress);
-                needsTimer = true;
-            }
-        }
-        return needsTimer;
-    }
 
-    int propIndex = prop - firstCSSProperty;
-    if (propIndex >= 0 && propIndex < numCSSProperties) {
-        int i = gPropertyWrapperMap[propIndex];
-        if (i >= 0) {
-            PropertyWrapperBase* wrapper = (*gPropertyWrappers)[i];
-            wrapper->blend(anim, dst, a, b, progress);
-            return true;
-        }
+    ensurePropertyMap();
+    PropertyWrapperBase* wrapper = wrapperForProperty(prop);
+    if (wrapper) {
+        wrapper->blend(anim, dst, a, b, progress);
+#if USE(ACCELERATED_COMPOSITING)
+        return !wrapper->animationIsAccelerated() || anim->isFallbackAnimating();
+#else
+        return true;
+#endif
     }
 
     return false;
 }
 
-void AnimationBase::setChanged(Node* node)
+#if USE(ACCELERATED_COMPOSITING)
+bool AnimationBase::animationOfPropertyIsAccelerated(int prop)
+{
+    ensurePropertyMap();
+    PropertyWrapperBase* wrapper = wrapperForProperty(prop);
+    return wrapper ? wrapper->animationIsAccelerated() : false;
+}
+#endif
+
+void AnimationBase::setNeedsStyleRecalc(Node* node)
 {
     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
     if (node)
-        node->setChanged(AnimationStyleChange);
+        node->setNeedsStyleRecalc(AnimationStyleChange);
 }
 
 double AnimationBase::duration() const
@@ -494,20 +687,19 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
     // If we get AnimationStateInputRestartAnimation then we force a new animation, regardless of state.
     if (input == AnimationStateInputMakeNew) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->setWaitingForStyleAvailable(false);
+            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
         m_requestedStartTime = 0;
         m_nextIterationDuration = -1;
-        m_waitedForResponse = false;
         endAnimation(false);
         return;
     }
 
     if (input == AnimationStateInputRestartAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->setWaitingForStyleAvailable(false);
+            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
@@ -522,7 +714,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
 
     if (input == AnimationStateInputEndAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->setWaitingForStyleAvailable(false);
+            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
         m_animState = AnimationStateDone;
         endAnimation(true);
         return;
@@ -547,11 +739,10 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
     }
 
     // Execute state machine
-    switch(m_animState) {
+    switch (m_animState) {
         case AnimationStateNew:
             ASSERT(input == AnimationStateInputStartAnimation || input == AnimationStateInputPlayStateRunnning || input == AnimationStateInputPlayStatePaused);
             if (input == AnimationStateInputStartAnimation || input == AnimationStateInputPlayStateRunnning) {
-                m_waitedForResponse = false;
                 m_requestedStartTime = beginAnimationUpdateTime();
                 m_animState = AnimationStateStartWaitTimer;
             }
@@ -563,11 +754,11 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 ASSERT(param >= 0);
                 // Start timer has fired, tell the animation to start and wait for it to respond with start time
                 m_animState = AnimationStateStartWaitStyleAvailable;
-                m_compAnim->setWaitingForStyleAvailable(true);
+                m_compAnim->animationController()->addToStyleAvailableWaitList(this);
 
                 // Trigger a render so we can start the animation
-                setChanged(m_object->element());
-                m_object->animation()->startUpdateRenderingDispatcher();
+                if (m_object)
+                    m_compAnim->animationController()->addNodeChangeToDispatch(m_object->node());
             } else {
                 ASSERT(!paused());
                 // We're waiting for the start timer to fire and we got a pause. Cancel the timer, pause and wait
@@ -578,8 +769,6 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
         case AnimationStateStartWaitStyleAvailable:
             ASSERT(input == AnimationStateInputStyleAvailable || input == AnimationStateInputPlayStatePaused);
 
-            m_compAnim->setWaitingForStyleAvailable(false);
-
             // Start timer has fired, tell the animation to start and wait for it to respond with start time
             m_animState = AnimationStateStartWaitResponse;
 
@@ -589,12 +778,18 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             onAnimationStart(0); // The elapsedTime is always 0 here
 
             // Start the animation
-            if (overridden() || !startAnimation(0)) {
-                // We're not going to get a startTime callback, so fire the start time here
+            if (overridden()) {
+                // We won't try to start accelerated animations if we are overridden and
+                // just move on to the next state.
                 m_animState = AnimationStateStartWaitResponse;
+                m_fallbackAnimating = true;
                 updateStateMachine(AnimationStateInputStartTimeSet, beginAnimationUpdateTime());
-            } else
-                m_waitedForResponse = true;
+            }
+            else {
+                bool started = startAnimation(0);
+                m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
+                m_fallbackAnimating = !started;
+            }
             break;
         case AnimationStateStartWaitResponse:
             ASSERT(input == AnimationStateInputStartTimeSet || input == AnimationStateInputPlayStatePaused);
@@ -608,11 +803,9 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 // Decide whether to go into looping or ending state
                 goIntoEndingOrLoopingState();
 
-                // Trigger a render so we can start the animation
-                if (m_object) {
-                    setChanged(m_object->element());
-                    m_compAnim->animationController()->startUpdateRenderingDispatcher();
-                }
+                // Dispatch updateStyleIfNeeded so we can start the animation
+                if (m_object)
+                    m_compAnim->animationController()->addNodeChangeToDispatch(m_object->node());
             } else {
                 // We are pausing while waiting for a start response. Cancel the animation and wait. When 
                 // we unpause, we will act as though the start timer just fired
@@ -652,8 +845,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                     resumeOverriddenAnimations();
 
                     // Fire off another style change so we can set the final value
-                    setChanged(m_object->element());
-                    m_object->animation()->startUpdateRenderingDispatcher();
+                    m_compAnim->animationController()->addNodeChangeToDispatch(m_object->node());
                 }
             } else {
                 // We are pausing while running. Cancel the animation and wait
@@ -680,8 +872,19 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             // AnimationStatePausedWaitResponse, we don't yet have a valid startTime, so we send 0 to startAnimation.
             // When the AnimationStateInputStartTimeSet comes in and we were in AnimationStatePausedRun, we will notice
             // that we have already set the startTime and will ignore it.
-            ASSERT(input == AnimationStateInputPlayStateRunnning);
+            ASSERT(input == AnimationStateInputPlayStateRunnning || input == AnimationStateInputStartTimeSet);
             ASSERT(paused());
+            
+            // If we are paused, but we get the callback that notifies us that an accelerated animation started,
+            // then we ignore the start time and just move into the paused-run state.
+            if (m_animState == AnimationStatePausedWaitResponse && input == AnimationStateInputStartTimeSet) {
+                m_animState = AnimationStatePausedRun;
+                ASSERT(m_startTime == 0);
+                m_startTime = param;
+                m_pauseTime += m_startTime;
+                break;
+            }
+            
             // Update the times
             if (m_animState == AnimationStatePausedRun)
                 m_startTime += beginAnimationUpdateTime() - m_pauseTime;
@@ -693,11 +896,16 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             m_animState = AnimationStateStartWaitResponse;
 
             // Start the animation
-            if (overridden() || !startAnimation(m_startTime)) {
-                // We're not going to get a startTime callback, so fire the start time here
+            if (overridden()) {
+                // We won't try to start accelerated animations if we are overridden and
+                // just move on to the next state.
                 updateStateMachine(AnimationStateInputStartTimeSet, beginAnimationUpdateTime());
-            } else
-                m_waitedForResponse = true;
+                m_fallbackAnimating = true;
+            } else {
+                bool started = startAnimation(m_startTime);
+                m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
+                m_fallbackAnimating = !started;
+            }
             break;
         case AnimationStateDone:
             // We're done. Stay in this state until we are deleted
@@ -726,14 +934,16 @@ void AnimationBase::fireAnimationEventsIfNeeded()
     }
     
     double elapsedDuration = beginAnimationUpdateTime() - m_startTime;
-    ASSERT(elapsedDuration >= 0);
+    // FIXME: we need to ensure that elapsedDuration is never < 0. If it is, this suggests that
+    // we had a recalcStyle() outside of beginAnimationUpdate()/endAnimationUpdate().
+    // Also check in getTimeToNextEvent().
+    elapsedDuration = max(elapsedDuration, 0.0);
     
     // Check for end timeout
     if (m_totalDuration >= 0 && elapsedDuration >= m_totalDuration) {
         // Fire an end event
         updateStateMachine(AnimationStateInputEndTimerFired, m_totalDuration);
-    }
-    else {
+    } else {
         // Check for iteration timeout
         if (m_nextIterationDuration < 0) {
             // Hasn't been set yet, set it
@@ -759,18 +969,20 @@ void AnimationBase::updatePlayState(bool run)
         updateStateMachine(run ? AnimationStateInputPlayStateRunnning : AnimationStateInputPlayStatePaused, -1);
 }
 
-double AnimationBase::willNeedService() const
+double AnimationBase::timeToNextService()
 {
     // Returns the time at which next service is required. -1 means no service is required. 0 means 
     // service is required now, and > 0 means service is required that many seconds in the future.
     if (paused() || isNew())
         return -1;
-        
+    
     if (m_animState == AnimationStateStartWaitTimer) {
         double timeFromNow = m_animation->delay() - (beginAnimationUpdateTime() - m_requestedStartTime);
-        return (float) ((timeFromNow > 0) ? timeFromNow : 0);
+        return max(timeFromNow, 0.0);
     }
     
+    fireAnimationEventsIfNeeded();
+        
     // In all other cases, we need service right away.
     return 0;
 }
@@ -780,9 +992,7 @@ double AnimationBase::progress(double scale, double offset, const TimingFunction
     if (preActive())
         return 0;
 
-    double elapsedTime = running() && !paused() ? (beginAnimationUpdateTime() - m_startTime) : (m_pauseTime - m_startTime);
-    if (running() && elapsedTime < 0)
-        return 0;
+    double elapsedTime = getElapsedTime();
 
     double dur = m_animation->duration();
     if (m_animation->iterationCount() > 0)
@@ -819,31 +1029,40 @@ double AnimationBase::progress(double scale, double offset, const TimingFunction
     return result;
 }
 
-void AnimationBase::goIntoEndingOrLoopingState()
+void AnimationBase::getTimeToNextEvent(double& time, bool& isLooping) const
 {
     // Decide when the end or loop event needs to fire
     double totalDuration = -1;
     if (m_animation->iterationCount() > 0)
         totalDuration = m_animation->duration() * m_animation->iterationCount();
 
-    const double elapsedDuration = beginAnimationUpdateTime() - m_startTime;
-    ASSERT(elapsedDuration >= 0);
+    const double elapsedDuration = max(beginAnimationUpdateTime() - m_startTime, 0.0);
     double durationLeft = 0;
-    double nextIterationTime = totalDuration;
+    double nextIterationTime = m_totalDuration;
 
-    if (totalDuration < 0 || elapsedDuration < totalDuration) {
+    if (m_totalDuration < 0 || elapsedDuration < m_totalDuration) {
         durationLeft = m_animation->duration() - fmod(elapsedDuration, m_animation->duration());
         nextIterationTime = elapsedDuration + durationLeft;
     }
-
-    if (totalDuration < 0 || nextIterationTime < totalDuration) {
+    
+    if (m_totalDuration < 0 || nextIterationTime < m_totalDuration) {
         // We are not at the end yet
         ASSERT(nextIterationTime > 0);
-        m_animState = AnimationStateLooping;
+        isLooping = true;
     } else {
         // We are at the end
-        m_animState = AnimationStateEnding;
+        isLooping = false;
     }
+    
+    time = durationLeft;
+}
+
+void AnimationBase::goIntoEndingOrLoopingState()
+{
+    double t;
+    bool isLooping;
+    getTimeToNextEvent(t, isLooping);
+    m_animState = isLooping ? AnimationStateLooping : AnimationStateEnding;
 }
   
 void AnimationBase::pauseAtTime(double t)
@@ -857,4 +1076,15 @@ double AnimationBase::beginAnimationUpdateTime() const
     return m_compAnim->animationController()->beginAnimationUpdateTime();
 }
 
+double AnimationBase::getElapsedTime() const
+{
+    if (paused())    
+        return m_pauseTime - m_startTime;
+    if (m_startTime <= 0)
+        return 0;
+    if (postActive())
+        return 1;
+    return beginAnimationUpdateTime() - m_startTime;
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
index 3a5cb8515c..8f55a8ebda 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
@@ -45,7 +45,7 @@ class RenderStyle;
 class TimingFunction;
 
 class AnimationBase : public RefCounted<AnimationBase> {
-    friend class CompositeAnimationPrivate;
+    friend class CompositeAnimation;
 
 public:
     AnimationBase(const Animation* transition, RenderObject* renderer, CompositeAnimation* compAnim);
@@ -54,7 +54,6 @@ public:
     RenderObject* renderer() const { return m_object; }
     void clearRenderer() { m_object = 0; }
     
-    double startTime() const { return m_startTime; }
     double duration() const;
 
     // Animations and Transitions go through the states below. When entering the STARTED state
@@ -95,7 +94,10 @@ public:
     void updateStateMachine(AnimStateInput, double param);
 
     // Animation has actually started, at passed time
-    void onAnimationStartResponse(double startTime);
+    void onAnimationStartResponse(double startTime)
+    {
+        updateStateMachine(AnimationBase::AnimationStateInputStartTimeSet, startTime);
+    }
 
     // Called to change to or from paused state
     void updatePlayState(bool running);
@@ -118,12 +120,12 @@ public:
     // "animating" means that something is running that requires a timer to keep firing
     // (e.g. a software animation)
     void setAnimating(bool inAnimating = true) { m_isAnimating = inAnimating; }
-    double willNeedService() const;
+    virtual double timeToNextService();
 
     double progress(double scale, double offset, const TimingFunction*) const;
 
-    virtual void animate(CompositeAnimation*, RenderObject*, const RenderStyle* /*currentStyle*/, 
-        const RenderStyle* /*targetStyle*/, RefPtr<RenderStyle>& /*animatedStyle*/) { }
+    virtual void animate(CompositeAnimation*, RenderObject*, const RenderStyle* /*currentStyle*/, RenderStyle* /*targetStyle*/, RefPtr<RenderStyle>& /*animatedStyle*/) = 0;
+    virtual void getAnimatedStyle(RefPtr<RenderStyle>& /*animatedStyle*/) = 0;
 
     virtual bool shouldFireEvents() const { return false; }
 
@@ -143,6 +145,9 @@ public:
     virtual bool affectsProperty(int /*property*/) const { return false; }
     bool isAnimatingProperty(int property, bool isRunningNow) const
     {
+        if (m_fallbackAnimating)
+            return false;
+            
         if (isRunningNow)
             return (!waitingToStart() && !postActive()) && affectsProperty(property);
 
@@ -155,6 +160,21 @@ public:
     
     double beginAnimationUpdateTime() const;
     
+    double getElapsedTime() const;
+    
+    AnimationBase* next() const { return m_next; }
+    void setNext(AnimationBase* animation) { m_next = animation; }
+    
+    void styleAvailable() 
+    {
+        ASSERT(waitingForStyleAvailable());
+        updateStateMachine(AnimationBase::AnimationStateInputStyleAvailable, -1);
+    }
+
+#if USE(ACCELERATED_COMPOSITING)
+    static bool animationOfPropertyIsAccelerated(int prop);
+#endif
+
 protected:
     virtual void overrideAnimations() { }
     virtual void resumeOverriddenAnimations() { }
@@ -170,19 +190,22 @@ protected:
 
     void goIntoEndingOrLoopingState();
 
+    bool isFallbackAnimating() const { return m_fallbackAnimating; }
+
     static bool propertiesEqual(int prop, const RenderStyle* a, const RenderStyle* b);
-    static int getPropertyAtIndex(int);
+    static int getPropertyAtIndex(int, bool& isShorthand);
     static int getNumProperties();
 
     // Return true if we need to start software animation timers
     static bool blendProperties(const AnimationBase* anim, int prop, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress);
+
+    static void setNeedsStyleRecalc(Node*);
     
-    static void setChanged(Node*);
+    void getTimeToNextEvent(double& time, bool& isLooping) const;
 
     AnimState m_animState;
 
     bool m_isAnimating;       // transition/animation requires continual timer firing
-    bool m_waitedForResponse;
     double m_startTime;
     double m_pauseTime;
     double m_requestedStartTime;
@@ -190,8 +213,11 @@ protected:
 
     RefPtr<Animation> m_animation;
     CompositeAnimation* m_compAnim;
+    bool m_fallbackAnimating;       // true when animating an accelerated property but have to fall back to software
     bool m_transformFunctionListValid;
     double m_totalDuration, m_nextIterationDuration;
+    
+    AnimationBase* m_next;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
index 3b6cfcc600..58a1f5b723 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,81 +28,32 @@
 
 #include "config.h"
 #include "AnimationController.h"
-#include "CompositeAnimation.h"
+
+#include "AnimationBase.h"
+#include "AnimationControllerPrivate.h"
 #include "CSSParser.h"
+#include "CompositeAnimation.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "SystemTime.h"
-#include "Timer.h"
+#include "RenderView.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
 static const double cAnimationTimerDelay = 0.025;
 static const double cBeginAnimationUpdateTimeNotSet = -1;
 
-class AnimationControllerPrivate {
-public:
-    AnimationControllerPrivate(Frame*);
-    ~AnimationControllerPrivate();
-
-    PassRefPtr<CompositeAnimation> accessCompositeAnimation(RenderObject*);
-    bool clear(RenderObject*);
-
-    void animationTimerFired(Timer<AnimationControllerPrivate>*);
-    void updateAnimationTimer(bool callSetChanged = false);
-
-    void updateRenderingDispatcherFired(Timer<AnimationControllerPrivate>*);
-    void startUpdateRenderingDispatcher();
-    void addEventToDispatch(PassRefPtr<Element> element, const AtomicString& eventType, const String& name, double elapsedTime);
-
-    bool hasAnimations() const { return !m_compositeAnimations.isEmpty(); }
-
-    void suspendAnimations(Document*);
-    void resumeAnimations(Document*);
-
-    void styleAvailable();
-
-    bool isAnimatingPropertyOnRenderer(RenderObject*, int property, bool isRunningNow) const;
-
-    bool pauseAnimationAtTime(RenderObject*, const String& name, double t);
-    bool pauseTransitionAtTime(RenderObject*, const String& property, double t);
-    unsigned numberOfActiveAnimations() const;
-
-    double beginAnimationUpdateTime()
-    {
-        if (m_beginAnimationUpdateTime == cBeginAnimationUpdateTimeNotSet)
-            m_beginAnimationUpdateTime = currentTime();
-        return m_beginAnimationUpdateTime;
-    }
-    
-    void setBeginAnimationUpdateTime(double t) { m_beginAnimationUpdateTime = t; }
-    
-private:
-    typedef HashMap<RenderObject*, RefPtr<CompositeAnimation> > RenderObjectAnimationMap;
-
-    RenderObjectAnimationMap m_compositeAnimations;
-    Timer<AnimationControllerPrivate> m_animationTimer;
-    Timer<AnimationControllerPrivate> m_updateRenderingDispatcher;
-    Frame* m_frame;
-    
-    class EventToDispatch {
-    public:
-        RefPtr<Element> element;
-        AtomicString eventType;
-        String name;
-        double elapsedTime;
-    };
-    
-    Vector<EventToDispatch> m_eventsToDispatch;
-    
-    double m_beginAnimationUpdateTime;
-};
-
 AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     : m_animationTimer(this, &AnimationControllerPrivate::animationTimerFired)
-    , m_updateRenderingDispatcher(this, &AnimationControllerPrivate::updateRenderingDispatcherFired)
+    , m_updateStyleIfNeededDispatcher(this, &AnimationControllerPrivate::updateStyleIfNeededDispatcherFired)
     , m_frame(frame)
     , m_beginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet)
+    , m_styleAvailableWaiters(0)
+    , m_lastStyleAvailableWaiter(0)
+    , m_responseWaiters(0)
+    , m_lastResponseWaiter(0)
+    , m_waitingForAResponse(false)
 {
 }
 
@@ -114,7 +65,7 @@ PassRefPtr<CompositeAnimation> AnimationControllerPrivate::accessCompositeAnimat
 {
     RefPtr<CompositeAnimation> animation = m_compositeAnimations.get(renderer);
     if (!animation) {
-        animation = CompositeAnimation::create(m_frame->animation());
+        animation = CompositeAnimation::create(this);
         m_compositeAnimations.set(renderer, animation);
     }
     return animation;
@@ -123,7 +74,7 @@ PassRefPtr<CompositeAnimation> AnimationControllerPrivate::accessCompositeAnimat
 bool AnimationControllerPrivate::clear(RenderObject* renderer)
 {
     // Return false if we didn't do anything OR we are suspended (so we don't try to
-    // do a setChanged() when suspended).
+    // do a setNeedsStyleRecalc() when suspended).
     PassRefPtr<CompositeAnimation> animation = m_compositeAnimations.take(renderer);
     if (!animation)
         return false;
@@ -131,23 +82,6 @@ bool AnimationControllerPrivate::clear(RenderObject* renderer)
     return animation->isSuspended();
 }
 
-void AnimationControllerPrivate::styleAvailable()
-{
-    // styleAvailable() can call event handlers which would ultimately delete a CompositeAnimation
-    // from the m_compositeAnimations table. So we can't iterate it directly. We will instead build
-    // a list of CompositeAnimations which need the styleAvailable() call iterate over that.
-    Vector<RefPtr<CompositeAnimation> > list;
-    
-    RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
-    for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it)
-        if (it->second->isWaitingForStyleAvailable())
-            list.append(it->second);
-    
-    Vector<RefPtr<CompositeAnimation> >::const_iterator listEnd = list.end();
-    for (Vector<RefPtr<CompositeAnimation> >::const_iterator it = list.begin(); it != listEnd; ++it)
-        (*it)->styleAvailable();
-}
-
 void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = false*/)
 {
     double needsService = -1;
@@ -155,16 +89,16 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
 
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
     for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
-        RefPtr<CompositeAnimation> compAnim = it->second;
-        if (!compAnim->isSuspended()) {
-            double t = compAnim->willNeedService();
+        CompositeAnimation* compAnim = it->second.get();
+        if (!compAnim->isSuspended() && compAnim->hasAnimations()) {
+            double t = compAnim->timeToNextService();
             if (t != -1 && (t < needsService || needsService == -1))
                 needsService = t;
             if (needsService == 0) {
                 if (callSetChanged) {
-                    Node* node = it->first->element();
+                    Node* node = it->first->node();
                     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-                    node->setChanged(AnimationStyleChange);
+                    node->setNeedsStyleRecalc(AnimationStyleChange);
                     calledSetChanged = true;
                 }
                 else
@@ -174,7 +108,7 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
     }
     
     if (calledSetChanged)
-        m_frame->document()->updateRendering();
+        m_frame->document()->updateStyleIfNeeded();
     
     // If we want service immediately, we start a repeating timer to reduce the overhead of starting
     if (needsService == 0) {
@@ -196,11 +130,11 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
     m_animationTimer.startOneShot(needsService);
 }
 
-void AnimationControllerPrivate::updateRenderingDispatcherFired(Timer<AnimationControllerPrivate>*)
+void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<AnimationControllerPrivate>*)
 {
     // fire all the events
-    Vector<EventToDispatch>::const_iterator end = m_eventsToDispatch.end();
-    for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != end; ++it) {
+    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
+    for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
         if (it->eventType == eventNames().webkitTransitionEndEvent)
             it->element->dispatchWebKitTransitionEvent(it->eventType,it->name, it->elapsedTime);
         else
@@ -209,14 +143,35 @@ void AnimationControllerPrivate::updateRenderingDispatcherFired(Timer<AnimationC
     
     m_eventsToDispatch.clear();
     
-    if (m_frame && m_frame->document())
-        m_frame->document()->updateRendering();
+    // call setChanged on all the elements
+    Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
+    for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
+        (*it)->setNeedsStyleRecalc(AnimationStyleChange);
+    
+    m_nodeChangesToDispatch.clear();
+    
+    if (m_frame)
+        m_frame->document()->updateStyleIfNeeded();
+
+    // We can now safely remove any animations or transitions that are finished.
+    // We can't remove them any earlier because we might get a false restart of
+    // a transition. This can happen because we have not yet set the final property
+    // value until we call the rendering dispatcher. So this can make the current
+    // style slightly different from the desired final style (because our last 
+    // animation step was, say 0.9999 or something). And we need to remove them
+    // here because if there are no more animations running we'll never get back
+    // into the animation code to clean them up.
+    RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
+    for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
+        CompositeAnimation* compAnim = it->second.get();
+        compAnim->cleanupFinishedAnimations(); // will not modify m_compositeAnimations, so OK to call while iterating
+    }
 }
 
-void AnimationControllerPrivate::startUpdateRenderingDispatcher()
+void AnimationControllerPrivate::startUpdateStyleIfNeededDispatcher()
 {
-    if (!m_updateRenderingDispatcher.isActive())
-        m_updateRenderingDispatcher.startOneShot(0);
+    if (!m_updateStyleIfNeededDispatcher.isActive())
+        m_updateStyleIfNeededDispatcher.startOneShot(0);
 }
 
 void AnimationControllerPrivate::addEventToDispatch(PassRefPtr<Element> element, const AtomicString& eventType, const String& name, double elapsedTime)
@@ -228,21 +183,31 @@ void AnimationControllerPrivate::addEventToDispatch(PassRefPtr<Element> element,
     event.name = name;
     event.elapsedTime = elapsedTime;
     
-    startUpdateRenderingDispatcher();
+    startUpdateStyleIfNeededDispatcher();
+}
+
+void AnimationControllerPrivate::addNodeChangeToDispatch(PassRefPtr<Node> node)
+{
+    ASSERT(!node || (node->document() && !node->document()->inPageCache()));
+    if (!node)
+        return;
+
+    m_nodeChangesToDispatch.append(node);
+    startUpdateStyleIfNeededDispatcher();
 }
 
 void AnimationControllerPrivate::animationTimerFired(Timer<AnimationControllerPrivate>*)
 {
     // Make sure animationUpdateTime is updated, so that it is current even if no
-    // styleChange has happened (e.g. hardware animations)
+    // styleChange has happened (e.g. accelerated animations)
     setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
 
     // When the timer fires, all we do is call setChanged on all DOM nodes with running animations and then do an immediate
-    // updateRendering.  It will then call back to us with new information.
+    // updateStyleIfNeeded.  It will then call back to us with new information.
     updateAnimationTimer(true);
 }
 
-bool AnimationControllerPrivate::isAnimatingPropertyOnRenderer(RenderObject* renderer, int property, bool isRunningNow) const
+bool AnimationControllerPrivate::isAnimatingPropertyOnRenderer(RenderObject* renderer, CSSPropertyID property, bool isRunningNow) const
 {
     RefPtr<CompositeAnimation> animation = m_compositeAnimations.get(renderer);
     if (!animation)
@@ -253,12 +218,15 @@ bool AnimationControllerPrivate::isAnimatingPropertyOnRenderer(RenderObject* ren
 
 void AnimationControllerPrivate::suspendAnimations(Document* document)
 {
+    setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
+    
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
     for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
         RenderObject* renderer = it->first;
-        RefPtr<CompositeAnimation> compAnim = it->second;
-        if (renderer->document() == document)
+        if (renderer->document() == document) {
+            CompositeAnimation* compAnim = it->second.get();
             compAnim->suspendAnimations();
+        }
     }
     
     updateAnimationTimer();
@@ -266,12 +234,15 @@ void AnimationControllerPrivate::suspendAnimations(Document* document)
 
 void AnimationControllerPrivate::resumeAnimations(Document* document)
 {
+    setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
+    
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
     for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
         RenderObject* renderer = it->first;
-        RefPtr<CompositeAnimation> compAnim = it->second;
-        if (renderer->document() == document)
+        if (renderer->document() == document) {
+            CompositeAnimation* compAnim = it->second.get();
             compAnim->resumeAnimations();
+        }
     }
     
     updateAnimationTimer();
@@ -287,7 +258,8 @@ bool AnimationControllerPrivate::pauseAnimationAtTime(RenderObject* renderer, co
         return false;
 
     if (compAnim->pauseAnimationAtTime(name, t)) {
-        renderer->node()->setChanged(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        startUpdateStyleIfNeededDispatcher();
         return true;
     }
 
@@ -304,13 +276,40 @@ bool AnimationControllerPrivate::pauseTransitionAtTime(RenderObject* renderer, c
         return false;
 
     if (compAnim->pauseTransitionAtTime(cssPropertyID(property), t)) {
-        renderer->node()->setChanged(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        startUpdateStyleIfNeededDispatcher();
         return true;
     }
 
     return false;
 }
 
+double AnimationControllerPrivate::beginAnimationUpdateTime()
+{
+    if (m_beginAnimationUpdateTime == cBeginAnimationUpdateTimeNotSet)
+        m_beginAnimationUpdateTime = currentTime();
+    return m_beginAnimationUpdateTime;
+}
+
+PassRefPtr<RenderStyle> AnimationControllerPrivate::getAnimatedStyleForRenderer(RenderObject* renderer)
+{
+    if (!renderer)
+        return 0;
+
+    RefPtr<CompositeAnimation> rendererAnimations = m_compositeAnimations.get(renderer);
+    if (!rendererAnimations)
+        return renderer->style();
+    
+    // Make sure animationUpdateTime is updated, so that it is current even if no
+    // styleChange has happened (e.g. accelerated animations).
+    setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
+    RefPtr<RenderStyle> animatingStyle = rendererAnimations->getAnimatedStyle();
+    if (!animatingStyle)
+        animatingStyle = renderer->style();
+    
+    return animatingStyle.release();
+}
+
 unsigned AnimationControllerPrivate::numberOfActiveAnimations() const
 {
     unsigned count = 0;
@@ -324,9 +323,119 @@ unsigned AnimationControllerPrivate::numberOfActiveAnimations() const
     return count;
 }
 
+void AnimationControllerPrivate::addToStyleAvailableWaitList(AnimationBase* animation)
+{
+    ASSERT(!animation->next());
+    
+    if (m_styleAvailableWaiters)
+        m_lastStyleAvailableWaiter->setNext(animation);
+    else
+        m_styleAvailableWaiters = animation;
+        
+    m_lastStyleAvailableWaiter = animation;
+    animation->setNext(0);
+}
+
+void AnimationControllerPrivate::removeFromStyleAvailableWaitList(AnimationBase* animationToRemove)
+{
+    AnimationBase* prevAnimation = 0;
+    for (AnimationBase* animation = m_styleAvailableWaiters; animation; animation = animation->next()) {
+        if (animation == animationToRemove) {
+            if (prevAnimation)
+                prevAnimation->setNext(animation->next());
+            else
+                m_styleAvailableWaiters = animation->next();
+            
+            if (m_lastStyleAvailableWaiter == animation)
+                m_lastStyleAvailableWaiter = prevAnimation;
+                
+            animationToRemove->setNext(0);
+        }
+    }
+}
+
+void AnimationControllerPrivate::styleAvailable()
+{
+    // Go through list of waiters and send them on their way
+    for (AnimationBase* animation = m_styleAvailableWaiters; animation; ) {
+        AnimationBase* nextAnimation = animation->next();
+        animation->setNext(0);
+        animation->styleAvailable();
+        animation = nextAnimation;
+    }
+    
+    m_styleAvailableWaiters = 0;
+    m_lastStyleAvailableWaiter = 0;
+}
+
+void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* animation, bool willGetResponse)
+{
+    // If willGetResponse is true, it means this animation is actually waiting for a response
+    // (which will come in as a call to notifyAnimationStarted()).
+    // In that case we don't need to add it to this list. We just set a waitingForAResponse flag 
+    // which says we are waiting for the response. If willGetResponse is false, this animation 
+    // is not waiting for a response for itself, but rather for a notifyXXXStarted() call for 
+    // another animation to which it will sync.
+    //
+    // When endAnimationUpdate() is called we check to see if the waitingForAResponse flag is
+    // true. If so, we just return and will do our work when the first notifyXXXStarted() call
+    // comes in. If it is false, we will not be getting a notifyXXXStarted() call, so we will
+    // do our work right away. In both cases we call the onAnimationStartResponse() method
+    // on each animation. In the first case we send in the time we got from notifyXXXStarted().
+    // In the second case, we just pass in the beginAnimationUpdateTime().
+    //
+    // This will synchronize all software and accelerated animations started in the same 
+    // updateStyleIfNeeded cycle.
+    //
+    ASSERT(!animation->next());
+    
+    if (willGetResponse)
+        m_waitingForAResponse = true;
+    
+    if (m_responseWaiters)
+        m_lastResponseWaiter->setNext(animation);
+    else
+        m_responseWaiters = animation;
+        
+    m_lastResponseWaiter = animation;
+    animation->setNext(0);
+}
+
+void AnimationControllerPrivate::removeFromStartTimeResponseWaitList(AnimationBase* animationToRemove)
+{
+    AnimationBase* prevAnimation = 0;
+    for (AnimationBase* animation = m_responseWaiters; animation; animation = animation->next()) {
+        if (animation == animationToRemove) {
+            if (prevAnimation)
+                prevAnimation->setNext(animation->next());
+            else
+                m_responseWaiters = animation->next();
+            
+            if (m_lastResponseWaiter == animation)
+                m_lastResponseWaiter = prevAnimation;
+                
+            animationToRemove->setNext(0);
+        }
+        prevAnimation = animation;
+    }
+}
+
+void AnimationControllerPrivate::startTimeResponse(double t)
+{
+    // Go through list of waiters and send them on their way
+    for (AnimationBase* animation = m_responseWaiters; animation; ) {
+        AnimationBase* nextAnimation = animation->next();
+        animation->setNext(0);
+        animation->onAnimationStartResponse(t);
+        animation = nextAnimation;
+    }
+    
+    m_responseWaiters = 0;
+    m_lastResponseWaiter = 0;
+}
+
 AnimationController::AnimationController(Frame* frame)
     : m_data(new AnimationControllerPrivate(frame))
-    , m_numStyleAvailableWaiters(0)
 {
 }
 
@@ -341,9 +450,9 @@ void AnimationController::cancelAnimations(RenderObject* renderer)
         return;
 
     if (m_data->clear(renderer)) {
-        Node* node = renderer->element();
+        Node* node = renderer->node();
         ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-        node->setChanged(AnimationStyleChange);
+        node->setNeedsStyleRecalc(AnimationStyleChange);
     }
 }
 
@@ -358,11 +467,15 @@ PassRefPtr<RenderStyle> AnimationController::updateAnimations(RenderObject* rend
     if ((!oldStyle || (!oldStyle->animations() && !oldStyle->transitions())) && (!newStyle->animations() && !newStyle->transitions()))
         return newStyle;
 
+    // Don't run transitions when printing.
+    if (renderer->view()->printing())
+        return newStyle;
+
     // Fetch our current set of implicit animations from a hashtable.  We then compare them
     // against the animations in the style and make sure we're in sync.  If destination values
     // have changed, we reset the animation.  We then do a blend to get new values and we return
     // a new style.
-    ASSERT(renderer->element()); // FIXME: We do not animate generated content yet.
+    ASSERT(renderer->node()); // FIXME: We do not animate generated content yet.
 
     RefPtr<CompositeAnimation> rendererAnimations = m_data->accessCompositeAnimation(renderer);
     RefPtr<RenderStyle> blendedStyle = rendererAnimations->animate(renderer, oldStyle, newStyle);
@@ -379,16 +492,14 @@ PassRefPtr<RenderStyle> AnimationController::updateAnimations(RenderObject* rend
     return blendedStyle.release();
 }
 
-void AnimationController::setAnimationStartTime(RenderObject* renderer, double t)
+PassRefPtr<RenderStyle> AnimationController::getAnimatedStyleForRenderer(RenderObject* renderer)
 {
-    RefPtr<CompositeAnimation> rendererAnimations = m_data->accessCompositeAnimation(renderer);
-    rendererAnimations->setAnimationStartTime(t);
+    return m_data->getAnimatedStyleForRenderer(renderer);
 }
 
-void AnimationController::setTransitionStartTime(RenderObject* renderer, int property, double t)
+void AnimationController::notifyAnimationStarted(RenderObject*, double startTime)
 {
-    RefPtr<CompositeAnimation> rendererAnimations = m_data->accessCompositeAnimation(renderer);
-    rendererAnimations->setTransitionStartTime(property, t);
+    m_data->receivedStartTimeResponse(startTime);
 }
 
 bool AnimationController::pauseAnimationAtTime(RenderObject* renderer, const String& name, double t)
@@ -406,7 +517,7 @@ bool AnimationController::pauseTransitionAtTime(RenderObject* renderer, const St
     return m_data->pauseTransitionAtTime(renderer, property, t);
 }
 
-bool AnimationController::isAnimatingPropertyOnRenderer(RenderObject* renderer, int property, bool isRunningNow) const
+bool AnimationController::isAnimatingPropertyOnRenderer(RenderObject* renderer, CSSPropertyID property, bool isRunningNow) const
 {
     return m_data->isAnimatingPropertyOnRenderer(renderer, property, isRunningNow);
 }
@@ -421,29 +532,6 @@ void AnimationController::resumeAnimations(Document* document)
     m_data->resumeAnimations(document);
 }
 
-void AnimationController::startUpdateRenderingDispatcher()
-{
-    m_data->startUpdateRenderingDispatcher();
-}
-
-void AnimationController::addEventToDispatch(PassRefPtr<Element> element, const AtomicString& eventType, const String& name, double elapsedTime)
-{
-    m_data->addEventToDispatch(element, eventType, name, elapsedTime);
-}
-
-void AnimationController::styleAvailable()
-{
-    if (!m_numStyleAvailableWaiters)
-        return;
-
-    m_data->styleAvailable();
-}
-
-double AnimationController::beginAnimationUpdateTime()
-{
-    return m_data->beginAnimationUpdateTime();
-}
-
 void AnimationController::beginAnimationUpdate()
 {
     m_data->setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
@@ -451,6 +539,17 @@ void AnimationController::beginAnimationUpdate()
 
 void AnimationController::endAnimationUpdate()
 {
+    m_data->endAnimationUpdate();
+}
+
+bool AnimationController::supportsAcceleratedAnimationOfProperty(CSSPropertyID property)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    return AnimationBase::animationOfPropertyIsAccelerated(property);
+#else
+    UNUSED_PARAM(property);
+    return false;
+#endif
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.h
index 45d0c7dfa5..db82618b45 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.h
@@ -29,10 +29,12 @@
 #ifndef AnimationController_h
 #define AnimationController_h
 
+#include "CSSPropertyNames.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
+class AnimationBase;
 class AnimationControllerPrivate;
 class AtomicString;
 class Document;
@@ -50,40 +52,27 @@ public:
 
     void cancelAnimations(RenderObject*);
     PassRefPtr<RenderStyle> updateAnimations(RenderObject*, RenderStyle* newStyle);
+    PassRefPtr<RenderStyle> getAnimatedStyleForRenderer(RenderObject*);
 
-    void setAnimationStartTime(RenderObject*, double t);
-    void setTransitionStartTime(RenderObject*, int property, double t);
+    // This is called when an accelerated animation or transition has actually started to animate.
+    void notifyAnimationStarted(RenderObject*, double startTime);
 
     bool pauseAnimationAtTime(RenderObject*, const String& name, double t); // To be used only for testing
     bool pauseTransitionAtTime(RenderObject*, const String& property, double t); // To be used only for testing
     unsigned numberOfActiveAnimations() const; // To be used only for testing
     
-    bool isAnimatingPropertyOnRenderer(RenderObject*, int property, bool isRunningNow) const;
+    bool isAnimatingPropertyOnRenderer(RenderObject*, CSSPropertyID, bool isRunningNow = true) const;
 
     void suspendAnimations(Document*);
     void resumeAnimations(Document*);
 
-    void startUpdateRenderingDispatcher();
-    void addEventToDispatch(PassRefPtr<Element>, const AtomicString& eventType, const String& name, double elapsedTime);
-
-    void styleAvailable();
-
-    void setWaitingForStyleAvailable(bool waiting)
-    {
-        if (waiting)
-            m_numStyleAvailableWaiters++;
-        else
-            m_numStyleAvailableWaiters--;
-    }
-    
-    double beginAnimationUpdateTime();
-    
     void beginAnimationUpdate();
     void endAnimationUpdate();
+    
+    static bool supportsAcceleratedAnimationOfProperty(CSSPropertyID);
 
 private:
     AnimationControllerPrivate* m_data;
-    unsigned m_numStyleAvailableWaiters;    
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
new file mode 100644
index 0000000000..359b9b52fb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AnimationControllerPrivate_h
+#define AnimationControllerPrivate_h
+
+#include "AtomicString.h"
+#include "CSSPropertyNames.h"
+#include "PlatformString.h"
+#include "Timer.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AnimationBase;
+class CompositeAnimation;
+class Document;
+class Element;
+class Frame;
+class Node;
+class RenderObject;
+class RenderStyle;
+
+class AnimationControllerPrivate {
+public:
+    AnimationControllerPrivate(Frame*);
+    ~AnimationControllerPrivate();
+
+    PassRefPtr<CompositeAnimation> accessCompositeAnimation(RenderObject*);
+    bool clear(RenderObject*);
+
+    void animationTimerFired(Timer<AnimationControllerPrivate>*);
+    void updateAnimationTimer(bool callSetChanged = false);
+
+    void updateStyleIfNeededDispatcherFired(Timer<AnimationControllerPrivate>*);
+    void startUpdateStyleIfNeededDispatcher();
+    void addEventToDispatch(PassRefPtr<Element> element, const AtomicString& eventType, const String& name, double elapsedTime);
+    void addNodeChangeToDispatch(PassRefPtr<Node>);
+
+    bool hasAnimations() const { return !m_compositeAnimations.isEmpty(); }
+
+    void suspendAnimations(Document*);
+    void resumeAnimations(Document*);
+
+    bool isAnimatingPropertyOnRenderer(RenderObject*, CSSPropertyID, bool isRunningNow) const;
+
+    bool pauseAnimationAtTime(RenderObject*, const String& name, double t);
+    bool pauseTransitionAtTime(RenderObject*, const String& property, double t);
+    unsigned numberOfActiveAnimations() const;
+
+    PassRefPtr<RenderStyle> getAnimatedStyleForRenderer(RenderObject* renderer);
+
+    double beginAnimationUpdateTime();
+    void setBeginAnimationUpdateTime(double t) { m_beginAnimationUpdateTime = t; }
+    void endAnimationUpdate()
+    {
+        styleAvailable();
+        if (!m_waitingForAResponse)
+            startTimeResponse(beginAnimationUpdateTime());
+    }
+    
+    void receivedStartTimeResponse(double t)
+    {
+        m_waitingForAResponse = false;
+        startTimeResponse(t);
+    }
+    
+    void addToStyleAvailableWaitList(AnimationBase*);
+    void removeFromStyleAvailableWaitList(AnimationBase*);    
+    
+    void addToStartTimeResponseWaitList(AnimationBase*, bool willGetResponse);
+    void removeFromStartTimeResponseWaitList(AnimationBase*);    
+    void startTimeResponse(double t);
+    
+private:
+    void styleAvailable();
+
+    typedef HashMap<RenderObject*, RefPtr<CompositeAnimation> > RenderObjectAnimationMap;
+
+    RenderObjectAnimationMap m_compositeAnimations;
+    Timer<AnimationControllerPrivate> m_animationTimer;
+    Timer<AnimationControllerPrivate> m_updateStyleIfNeededDispatcher;
+    Frame* m_frame;
+    
+    class EventToDispatch {
+    public:
+        RefPtr<Element> element;
+        AtomicString eventType;
+        String name;
+        double elapsedTime;
+    };
+    
+    Vector<EventToDispatch> m_eventsToDispatch;
+    Vector<RefPtr<Node> > m_nodeChangesToDispatch;
+    
+    double m_beginAnimationUpdateTime;
+    AnimationBase* m_styleAvailableWaiters;
+    AnimationBase* m_lastStyleAvailableWaiter;
+    
+    AnimationBase* m_responseWaiters;
+    AnimationBase* m_lastResponseWaiter;
+    bool m_waitingForAResponse;
+};
+
+} // namespace WebCore
+
+#endif // AnimationControllerPrivate_h
diff --git a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
index 57cb774ab5..d60455acf9 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
@@ -29,7 +29,7 @@
 #include "config.h"
 #include "CompositeAnimation.h"
 
-#include "AnimationController.h"
+#include "AnimationControllerPrivate.h"
 #include "CSSPropertyNames.h"
 #include "ImplicitAnimation.h"
 #include "KeyframeAnimation.h"
@@ -38,96 +38,37 @@
 
 namespace WebCore {
 
-class CompositeAnimationPrivate {
-public:
-    CompositeAnimationPrivate(AnimationController* animationController, CompositeAnimation* compositeAnimation)
-        : m_isSuspended(false)
-        , m_animationController(animationController)
-        , m_compositeAnimation(compositeAnimation)
-        , m_numStyleAvailableWaiters(0)
-    {
-    }
-    
-    ~CompositeAnimationPrivate();
-
-    void clearRenderer();
-
-    PassRefPtr<RenderStyle> animate(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-
-    AnimationController* animationController()  { return m_animationController; }
-
-    void setAnimating(bool);
-    double willNeedService() const;
-    
-    PassRefPtr<KeyframeAnimation> getAnimationForProperty(int property);
-
-    void cleanupFinishedAnimations(RenderObject*);
-
-    void setAnimationStartTime(double t);
-    void setTransitionStartTime(int property, double t);
-
-    void suspendAnimations();
-    void resumeAnimations();
-    bool isSuspended() const { return m_isSuspended; }
-
-    void overrideImplicitAnimations(int property);
-    void resumeOverriddenImplicitAnimations(int property);
-
-    void styleAvailable();
-
-    bool isAnimatingProperty(int property, bool isRunningNow) const;
-
-    void setWaitingForStyleAvailable(bool);
-    bool isWaitingForStyleAvailable() const     { return m_numStyleAvailableWaiters > 0; }
-
-    bool pauseAnimationAtTime(const AtomicString& name, double t);
-    bool pauseTransitionAtTime(int property, double t);
-    unsigned numberOfActiveAnimations() const;
-
-protected:
-    void updateTransitions(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-    void updateKeyframeAnimations(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-
-private:
-    typedef HashMap<int, RefPtr<ImplicitAnimation> > CSSPropertyTransitionsMap;
-    typedef HashMap<AtomicStringImpl*, RefPtr<KeyframeAnimation> >  AnimationNameMap;
-
-    CSSPropertyTransitionsMap m_transitions;
-    AnimationNameMap m_keyframeAnimations;
-    bool m_isSuspended;
-    AnimationController* m_animationController;
-    CompositeAnimation* m_compositeAnimation;
-    unsigned m_numStyleAvailableWaiters;
-};
-
-CompositeAnimationPrivate::~CompositeAnimationPrivate()
+CompositeAnimation::~CompositeAnimation()
 {
     // Toss the refs to all animations
     m_transitions.clear();
     m_keyframeAnimations.clear();
 }
 
-void CompositeAnimationPrivate::clearRenderer()
+void CompositeAnimation::clearRenderer()
 {
-    // Clear the renderers from all running animations, in case we are in the middle of
-    // an animation callback (see https://bugs.webkit.org/show_bug.cgi?id=22052)
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* transition = it->second.get();
-        transition->clearRenderer();
+    if (!m_transitions.isEmpty()) {
+        // Clear the renderers from all running animations, in case we are in the middle of
+        // an animation callback (see https://bugs.webkit.org/show_bug.cgi?id=22052)
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* transition = it->second.get();
+            transition->clearRenderer();
+        }
     }
-
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        KeyframeAnimation* anim = it->second.get();
-        anim->clearRenderer();
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            KeyframeAnimation* anim = it->second.get();
+            anim->clearRenderer();
+        }
     }
-    
-
 }
-    
-void CompositeAnimationPrivate::updateTransitions(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
+
+void CompositeAnimation::updateTransitions(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
 {
+    RefPtr<RenderStyle> modifiedCurrentStyle;
+    
     // If currentStyle is null, we don't do transitions
     if (!currentStyle || !targetStyle->transitions())
         return;
@@ -148,12 +89,15 @@ void CompositeAnimationPrivate::updateTransitions(RenderObject* renderer, Render
         // through the loop.
         for (int propertyIndex = 0; propertyIndex < AnimationBase::getNumProperties(); ++propertyIndex) {
             if (all) {
-                // Get the next property
-                prop = AnimationBase::getPropertyAtIndex(propertyIndex);
+                // Get the next property which is not a shorthand.
+                bool isShorthand;
+                prop = AnimationBase::getPropertyAtIndex(propertyIndex, isShorthand);
+                if (isShorthand)
+                    continue;
             }
 
             // ImplicitAnimations are always hashed by actual properties, never cAnimateAll
-            ASSERT(prop > firstCSSProperty && prop < (firstCSSProperty + numCSSProperties));
+            ASSERT(prop >= firstCSSProperty && prop < (firstCSSProperty + numCSSProperties));
 
             // If there is a running animation for this property, the transition is overridden
             // and we have to use the unanimatedStyle from the animation. We do the test
@@ -166,14 +110,26 @@ void CompositeAnimationPrivate::updateTransitions(RenderObject* renderer, Render
             bool equal = true;
 
             if (implAnim) {
-               // This implAnim might not be an already running transition. It might be
-               // newly added to the list in a previous iteration. This would happen if
-               // you have both an explicit transition-property and 'all' in the same
-               // list. In this case, the latter one overrides the earlier one, so we
-               // behave as though this is a running animation being replaced.
-                if (!isActiveTransition)
-                    m_transitions.remove(prop);
-                else if (!implAnim->isTargetPropertyEqual(prop, targetStyle)) {
+                // This might be a transition that is just finishing. That would be the case
+                // if it were postActive. But we still need to check for equality because
+                // it could be just finishing AND changing to a new goal state.
+                //
+                // This implAnim might also not be an already running transition. It might be
+                // newly added to the list in a previous iteration. This would happen if
+                // you have both an explicit transition-property and 'all' in the same
+                // list. In this case, the latter one overrides the earlier one, so we
+                // behave as though this is a running animation being replaced.
+                if (!implAnim->isTargetPropertyEqual(prop, targetStyle)) {
+#if USE(ACCELERATED_COMPOSITING)
+                    // For accelerated animations we need to return a new RenderStyle with the _current_ value
+                    // of the property, so that restarted transitions use the correct starting point.
+                    if (AnimationBase::animationOfPropertyIsAccelerated(prop) && !implAnim->isFallbackAnimating()) {
+                        if (!modifiedCurrentStyle)
+                            modifiedCurrentStyle = RenderStyle::clone(currentStyle);
+
+                        implAnim->blendPropertyValueInStyle(prop, modifiedCurrentStyle.get());
+                    }
+#endif
                     m_transitions.remove(prop);
                     equal = false;
                 }
@@ -182,9 +138,13 @@ void CompositeAnimationPrivate::updateTransitions(RenderObject* renderer, Render
                 equal = !isActiveTransition || AnimationBase::propertiesEqual(prop, fromStyle, targetStyle);
             }
 
-            if (!equal) {
+            // We can be in this loop with an inactive transition (!isActiveTransition). We need
+            // to do that to check to see if we are canceling a transition. But we don't want to
+            // start one of the inactive transitions. So short circuit that here. (See
+            // <https://bugs.webkit.org/show_bug.cgi?id=24787>
+            if (!equal && isActiveTransition) {
                 // Add the new transition
-                m_transitions.set(prop, ImplicitAnimation::create(const_cast<Animation*>(anim), prop, renderer, m_compositeAnimation, fromStyle));
+                m_transitions.set(prop, ImplicitAnimation::create(const_cast<Animation*>(anim), prop, renderer, this, modifiedCurrentStyle ? modifiedCurrentStyle.get() : fromStyle));
             }
             
             // We only need one pass for the single prop case
@@ -194,7 +154,7 @@ void CompositeAnimationPrivate::updateTransitions(RenderObject* renderer, Render
     }
 }
 
-void CompositeAnimationPrivate::updateKeyframeAnimations(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
+void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
 {
     // Nothing to do if we don't have any animations, and didn't have any before
     if (m_keyframeAnimations.isEmpty() && !targetStyle->hasAnimations())
@@ -208,6 +168,9 @@ void CompositeAnimationPrivate::updateKeyframeAnimations(RenderObject* renderer,
     AnimationNameMap::const_iterator kfend = m_keyframeAnimations.end();
     for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != kfend; ++it)
         it->second->setIndex(-1);
+        
+    // Toss the animation order map
+    m_keyframeAnimationOrderMap.clear();
     
     // Now mark any still active animations as active and add any new animations
     if (targetStyle->animations()) {
@@ -232,9 +195,13 @@ void CompositeAnimationPrivate::updateKeyframeAnimations(RenderObject* renderer,
                 keyframeAnim->setAnimation(anim);
                 keyframeAnim->setIndex(i);
             } else if ((anim->duration() || anim->delay()) && anim->iterationCount()) {
-                keyframeAnim = KeyframeAnimation::create(const_cast<Animation*>(anim), renderer, i, m_compositeAnimation, currentStyle ? currentStyle : targetStyle);
+                keyframeAnim = KeyframeAnimation::create(const_cast<Animation*>(anim), renderer, i, this, currentStyle ? currentStyle : targetStyle);
                 m_keyframeAnimations.set(keyframeAnim->name().impl(), keyframeAnim);
             }
+            
+            // Add this to the animation order map
+            if (keyframeAnim)
+                m_keyframeAnimationOrderMap.append(keyframeAnim->name().impl());
         }
     }
 
@@ -252,7 +219,7 @@ void CompositeAnimationPrivate::updateKeyframeAnimations(RenderObject* renderer,
         m_keyframeAnimations.remove(animsToBeRemoved[j]);
 }
 
-PassRefPtr<RenderStyle> CompositeAnimationPrivate::animate(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
+PassRefPtr<RenderStyle> CompositeAnimation::animate(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
 {
     RefPtr<RenderStyle> resultStyle;
 
@@ -265,279 +232,256 @@ PassRefPtr<RenderStyle> CompositeAnimationPrivate::animate(RenderObject* rendere
     if (currentStyle) {
         // Now that we have transition objects ready, let them know about the new goal state.  We want them
         // to fill in a RenderStyle*& only if needed.
-        CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
-        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
-            if (ImplicitAnimation* anim = it->second.get())
-                anim->animate(m_compositeAnimation, renderer, currentStyle, targetStyle, resultStyle);
+        if (!m_transitions.isEmpty()) {
+            CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
+            for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
+                if (ImplicitAnimation* anim = it->second.get())
+                    anim->animate(this, renderer, currentStyle, targetStyle, resultStyle);
+            }
         }
     }
 
     // Now that we have animation objects ready, let them know about the new goal state.  We want them
     // to fill in a RenderStyle*& only if needed.
-    if (targetStyle->hasAnimations()) {
-        for (size_t i = 0; i < targetStyle->animations()->size(); ++i) {
-            const Animation* anim = targetStyle->animations()->animation(i);
-
-            if (anim->isValidAnimation()) {
-                AtomicString animationName(anim->name());
-                RefPtr<KeyframeAnimation> keyframeAnim = m_keyframeAnimations.get(animationName.impl());
-                if (keyframeAnim)
-                    keyframeAnim->animate(m_compositeAnimation, renderer, currentStyle, targetStyle, resultStyle);
-            }
-        }
+    for (Vector<AtomicStringImpl*>::const_iterator it = m_keyframeAnimationOrderMap.begin(); it != m_keyframeAnimationOrderMap.end(); ++it) {
+        RefPtr<KeyframeAnimation> keyframeAnim = m_keyframeAnimations.get(*it);
+        if (keyframeAnim)
+            keyframeAnim->animate(this, renderer, currentStyle, targetStyle, resultStyle);
     }
 
-    cleanupFinishedAnimations(renderer);
+    cleanupFinishedAnimations();
 
     return resultStyle ? resultStyle.release() : targetStyle;
 }
 
-// "animating" means that something is running that requires the timer to keep firing
-void CompositeAnimationPrivate::setAnimating(bool animating)
+PassRefPtr<RenderStyle> CompositeAnimation::getAnimatedStyle() const
 {
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* transition = it->second.get();
-        transition->setAnimating(animating);
+    RefPtr<RenderStyle> resultStyle;
+    CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
+    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
+        if (ImplicitAnimation* implicitAnimation = it->second.get())
+            implicitAnimation->getAnimatedStyle(resultStyle);
+    }
+
+    for (Vector<AtomicStringImpl*>::const_iterator it = m_keyframeAnimationOrderMap.begin(); it != m_keyframeAnimationOrderMap.end(); ++it) {
+        RefPtr<KeyframeAnimation> keyframeAnimation = m_keyframeAnimations.get(*it);
+        if (keyframeAnimation)
+            keyframeAnimation->getAnimatedStyle(resultStyle);
     }
+    
+    return resultStyle;
+}
 
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        KeyframeAnimation* anim = it->second.get();
-        anim->setAnimating(animating);
+// "animating" means that something is running that requires the timer to keep firing
+void CompositeAnimation::setAnimating(bool animating)
+{
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* transition = it->second.get();
+            transition->setAnimating(animating);
+        }
+    }
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            KeyframeAnimation* anim = it->second.get();
+            anim->setAnimating(animating);
+        }
     }
 }
 
-double CompositeAnimationPrivate::willNeedService() const
+double CompositeAnimation::timeToNextService() const
 {
     // Returns the time at which next service is required. -1 means no service is required. 0 means 
     // service is required now, and > 0 means service is required that many seconds in the future.
     double minT = -1;
     
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* transition = it->second.get();
-        double t = transition ? transition->willNeedService() : -1;
-        if (t < minT || minT == -1)
-            minT = t;
-        if (minT == 0)
-            return 0;
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* transition = it->second.get();
+            double t = transition ? transition->timeToNextService() : -1;
+            if (t < minT || minT == -1)
+                minT = t;
+            if (minT == 0)
+                return 0;
+        }
     }
-
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        KeyframeAnimation* animation = it->second.get();
-        double t = animation ? animation->willNeedService() : -1;
-        if (t < minT || minT == -1)
-            minT = t;
-        if (minT == 0)
-            return 0;
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            KeyframeAnimation* animation = it->second.get();
+            double t = animation ? animation->timeToNextService() : -1;
+            if (t < minT || minT == -1)
+                minT = t;
+            if (minT == 0)
+                return 0;
+        }
     }
 
     return minT;
 }
 
-PassRefPtr<KeyframeAnimation> CompositeAnimationPrivate::getAnimationForProperty(int property)
+PassRefPtr<KeyframeAnimation> CompositeAnimation::getAnimationForProperty(int property) const
 {
     RefPtr<KeyframeAnimation> retval;
     
     // We want to send back the last animation with the property if there are multiples.
     // So we need to iterate through all animations
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        RefPtr<KeyframeAnimation> anim = it->second;
-        if (anim->hasAnimationForProperty(property))
-            retval = anim;
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            RefPtr<KeyframeAnimation> anim = it->second;
+            if (anim->hasAnimationForProperty(property))
+                retval = anim;
+        }
     }
     
     return retval;
 }
 
-void CompositeAnimationPrivate::cleanupFinishedAnimations(RenderObject*)
+void CompositeAnimation::cleanupFinishedAnimations()
 {
     if (isSuspended())
         return;
 
     // Make a list of transitions to be deleted
     Vector<int> finishedTransitions;
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
 
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (!anim)
-            continue;
-        if (anim->postActive())
-            finishedTransitions.append(anim->animatingProperty());
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* anim = it->second.get();
+            if (!anim)
+                continue;
+            if (anim->postActive())
+                finishedTransitions.append(anim->animatingProperty());
+        }
+        
+        // Delete them
+        size_t finishedTransitionCount = finishedTransitions.size();
+        for (size_t i = 0; i < finishedTransitionCount; ++i)
+            m_transitions.remove(finishedTransitions[i]);
     }
 
-    // Delete them
-    size_t finishedTransitionCount = finishedTransitions.size();
-    for (size_t i = 0; i < finishedTransitionCount; ++i)
-        m_transitions.remove(finishedTransitions[i]);
-
     // Make a list of animations to be deleted
     Vector<AtomicStringImpl*> finishedAnimations;
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
 
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        KeyframeAnimation* anim = it->second.get();
-        if (!anim)
-            continue;
-        if (anim->postActive())
-            finishedAnimations.append(anim->name().impl());
-    }
-
-    // Delete them
-    size_t finishedAnimationCount = finishedAnimations.size();
-    for (size_t i = 0; i < finishedAnimationCount; ++i)
-        m_keyframeAnimations.remove(finishedAnimations[i]);
-}
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            KeyframeAnimation* anim = it->second.get();
+            if (!anim)
+                continue;
+            if (anim->postActive())
+                finishedAnimations.append(anim->name().impl());
+        }
 
-void CompositeAnimationPrivate::setAnimationStartTime(double t)
-{
-    // Set start time on all animations waiting for it
-    AnimationNameMap::const_iterator end = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != end; ++it) {
-        KeyframeAnimation* anim = it->second.get();
-        if (anim && anim->waitingForStartTime())
-            anim->updateStateMachine(AnimationBase::AnimationStateInputStartTimeSet, t);
+        // Delete them
+        size_t finishedAnimationCount = finishedAnimations.size();
+        for (size_t i = 0; i < finishedAnimationCount; ++i)
+            m_keyframeAnimations.remove(finishedAnimations[i]);
     }
 }
 
-void CompositeAnimationPrivate::setTransitionStartTime(int property, double t)
-{
-    // Set the start time for given property transition
-    CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim && anim->waitingForStartTime() && anim->animatingProperty() == property)
-            anim->updateStateMachine(AnimationBase::AnimationStateInputStartTimeSet, t);
-    }
-}
-
-void CompositeAnimationPrivate::suspendAnimations()
+void CompositeAnimation::suspendAnimations()
 {
     if (m_isSuspended)
         return;
 
     m_isSuspended = true;
 
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        if (KeyframeAnimation* anim = it->second.get())
-            anim->updatePlayState(false);
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            if (KeyframeAnimation* anim = it->second.get())
+                anim->updatePlayState(false);
+        }
     }
-
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim && anim->hasStyle())
-            anim->updatePlayState(false);
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* anim = it->second.get();
+            if (anim && anim->hasStyle())
+                anim->updatePlayState(false);
+        }
     }
 }
 
-void CompositeAnimationPrivate::resumeAnimations()
+void CompositeAnimation::resumeAnimations()
 {
     if (!m_isSuspended)
         return;
 
     m_isSuspended = false;
 
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        KeyframeAnimation* anim = it->second.get();
-        if (anim && anim->playStatePlaying())
-            anim->updatePlayState(true);
-    }
-
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim && anim->hasStyle())
-            anim->updatePlayState(true);
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            KeyframeAnimation* anim = it->second.get();
+            if (anim && anim->playStatePlaying())
+                anim->updatePlayState(true);
+        }
     }
-}
 
-void CompositeAnimationPrivate::overrideImplicitAnimations(int property)
-{
-    CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim && anim->animatingProperty() == property)
-            anim->setOverridden(true);
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* anim = it->second.get();
+            if (anim && anim->hasStyle())
+                anim->updatePlayState(true);
+        }
     }
 }
 
-void CompositeAnimationPrivate::resumeOverriddenImplicitAnimations(int property)
+void CompositeAnimation::overrideImplicitAnimations(int property)
 {
     CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim && anim->animatingProperty() == property)
-            anim->setOverridden(false);
+    if (!m_transitions.isEmpty()) {
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
+            ImplicitAnimation* anim = it->second.get();
+            if (anim && anim->animatingProperty() == property)
+                anim->setOverridden(true);
+        }
     }
 }
 
-static inline bool compareAnimationIndices(RefPtr<KeyframeAnimation> a, const RefPtr<KeyframeAnimation> b)
-{
-    return a->index() < b->index();
-}
-
-void CompositeAnimationPrivate::styleAvailable()
+void CompositeAnimation::resumeOverriddenImplicitAnimations(int property)
 {
-    if (m_numStyleAvailableWaiters == 0)
-        return;
-
-    // We have to go through animations in the order in which they appear in
-    // the style, because order matters for additivity.
-    Vector<RefPtr<KeyframeAnimation> > animations(m_keyframeAnimations.size());
-    copyValuesToVector(m_keyframeAnimations, animations);
-
-    if (animations.size() > 1)
-        std::stable_sort(animations.begin(), animations.end(), compareAnimationIndices);
-
-    for (size_t i = 0; i < animations.size(); ++i) {
-        KeyframeAnimation* anim = animations[i].get();
-        if (anim && anim->waitingForStyleAvailable())
-            anim->updateStateMachine(AnimationBase::AnimationStateInputStyleAvailable, -1);
-    }
-
-    CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim && anim->waitingForStyleAvailable())
-            anim->updateStateMachine(AnimationBase::AnimationStateInputStyleAvailable, -1);
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
+            ImplicitAnimation* anim = it->second.get();
+            if (anim && anim->animatingProperty() == property)
+                anim->setOverridden(false);
+        }
     }
 }
 
-bool CompositeAnimationPrivate::isAnimatingProperty(int property, bool isRunningNow) const
+bool CompositeAnimation::isAnimatingProperty(int property, bool isRunningNow) const
 {
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        KeyframeAnimation* anim = it->second.get();
-        if (anim && anim->isAnimatingProperty(property, isRunningNow))
-            return true;
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            KeyframeAnimation* anim = it->second.get();
+            if (anim && anim->isAnimatingProperty(property, isRunningNow))
+                return true;
+        }
     }
 
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim && anim->isAnimatingProperty(property, isRunningNow))
-            return true;
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* anim = it->second.get();
+            if (anim && anim->isAnimatingProperty(property, isRunningNow))
+                return true;
+        }
     }
     return false;
 }
 
-void CompositeAnimationPrivate::setWaitingForStyleAvailable(bool waiting)
-{
-    if (waiting)
-        m_numStyleAvailableWaiters++;
-    else
-        m_numStyleAvailableWaiters--;
-    m_animationController->setWaitingForStyleAvailable(waiting);
-}
-
-bool CompositeAnimationPrivate::pauseAnimationAtTime(const AtomicString& name, double t)
+bool CompositeAnimation::pauseAnimationAtTime(const AtomicString& name, double t)
 {
     if (!name)
         return false;
@@ -555,7 +499,7 @@ bool CompositeAnimationPrivate::pauseAnimationAtTime(const AtomicString& name, d
     return false;
 }
 
-bool CompositeAnimationPrivate::pauseTransitionAtTime(int property, double t)
+bool CompositeAnimation::pauseTransitionAtTime(int property, double t)
 {
     if ((property < firstCSSProperty) || (property >= firstCSSProperty + numCSSProperties))
         return false;
@@ -572,135 +516,29 @@ bool CompositeAnimationPrivate::pauseTransitionAtTime(int property, double t)
     return false;
 }
 
-unsigned CompositeAnimationPrivate::numberOfActiveAnimations() const
+unsigned CompositeAnimation::numberOfActiveAnimations() const
 {
     unsigned count = 0;
     
-    AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-        KeyframeAnimation* anim = it->second.get();
-        if (anim->running())
-            ++count;
+    if (!m_keyframeAnimations.isEmpty()) {
+        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
+            KeyframeAnimation* anim = it->second.get();
+            if (anim->running())
+                ++count;
+        }
     }
 
-    CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-    for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-        ImplicitAnimation* anim = it->second.get();
-        if (anim->running())
-            ++count;
+    if (!m_transitions.isEmpty()) {
+        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
+        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
+            ImplicitAnimation* anim = it->second.get();
+            if (anim->running())
+                ++count;
+        }
     }
     
     return count;
 }
 
-CompositeAnimation::CompositeAnimation(AnimationController* animationController)
-    : m_data(new CompositeAnimationPrivate(animationController, this))
-{
-}
-
-CompositeAnimation::~CompositeAnimation()
-{
-    delete m_data;
-}
-
-AnimationController* CompositeAnimation::animationController()
-{
-    return m_data->animationController(); 
-}
-
-void CompositeAnimation::clearRenderer()
-{
-    m_data->clearRenderer();
-}
-
-PassRefPtr<RenderStyle> CompositeAnimation::animate(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
-{
-    return m_data->animate(renderer, currentStyle, targetStyle);
-}
-
-double CompositeAnimation::willNeedService() const
-{
-    return m_data->willNeedService();
-}
-
-void CompositeAnimation::setWaitingForStyleAvailable(bool b)
-{
-    m_data->setWaitingForStyleAvailable(b);
-}
-
-bool CompositeAnimation::isWaitingForStyleAvailable() const
-{
-    return m_data->isWaitingForStyleAvailable();
-}
-
-void CompositeAnimation::suspendAnimations()
-{
-    m_data->suspendAnimations();
-}
-
-void CompositeAnimation::resumeAnimations()
-{
-    m_data->resumeAnimations();
-}
-
-bool CompositeAnimation::isSuspended() const
-{
-    return m_data->isSuspended();
-}
-
-void CompositeAnimation::styleAvailable()
-{
-    m_data->styleAvailable();
-}
-
-void CompositeAnimation::setAnimating(bool b)
-{
-    m_data->setAnimating(b);
-}
-
-bool CompositeAnimation::isAnimatingProperty(int property, bool isRunningNow) const
-{
-    return m_data->isAnimatingProperty(property, isRunningNow);
-}
-
-PassRefPtr<KeyframeAnimation> CompositeAnimation::getAnimationForProperty(int property)
-{
-    return m_data->getAnimationForProperty(property);
-}
-
-void CompositeAnimation::setAnimationStartTime(double t)
-{
-    m_data->setAnimationStartTime(t);
-}
-
-void CompositeAnimation::setTransitionStartTime(int property, double t)
-{
-    m_data->setTransitionStartTime(property, t);
-}
-
-void CompositeAnimation::overrideImplicitAnimations(int property)
-{
-    m_data->overrideImplicitAnimations(property);
-}
-
-void CompositeAnimation::resumeOverriddenImplicitAnimations(int property)
-{
-    m_data->resumeOverriddenImplicitAnimations(property);
-}
-
-bool CompositeAnimation::pauseAnimationAtTime(const AtomicString& name, double t)
-{
-    return m_data->pauseAnimationAtTime(name, t);
-}
-
-bool CompositeAnimation::pauseTransitionAtTime(int property, double t)
-{
-    return m_data->pauseTransitionAtTime(property, t);
-}
-
-unsigned CompositeAnimation::numberOfActiveAnimations() const
-{
-    return m_data->numberOfActiveAnimations();
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h
index d51718fd74..739cfdcc65 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h
@@ -31,14 +31,15 @@
 
 #include "AtomicString.h"
 
+#include "ImplicitAnimation.h"
+#include "KeyframeAnimation.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-class CompositeAnimationPrivate;
+class AnimationControllerPrivate;
 class AnimationController;
-class KeyframeAnimation;
 class RenderObject;
 class RenderStyle;
 
@@ -46,7 +47,7 @@ class RenderStyle;
 // on a single RenderObject, such as a number of properties transitioning at once.
 class CompositeAnimation : public RefCounted<CompositeAnimation> {
 public:
-    static PassRefPtr<CompositeAnimation> create(AnimationController* animationController)
+    static PassRefPtr<CompositeAnimation> create(AnimationControllerPrivate* animationController)
     {
         return adoptRef(new CompositeAnimation(animationController));
     };
@@ -56,26 +57,24 @@ public:
     void clearRenderer();
 
     PassRefPtr<RenderStyle> animate(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-    double willNeedService() const;
-    
-    AnimationController* animationController();
+    PassRefPtr<RenderStyle> getAnimatedStyle() const;
 
-    void setWaitingForStyleAvailable(bool);
-    bool isWaitingForStyleAvailable() const;
+    double timeToNextService() const;
+    
+    AnimationControllerPrivate* animationController() const { return m_animationController; }
 
     void suspendAnimations();
     void resumeAnimations();
-    bool isSuspended() const;
+    bool isSuspended() const { return m_isSuspended; }
+    
+    bool hasAnimations() const  { return !m_transitions.isEmpty() || !m_keyframeAnimations.isEmpty(); }
 
-    void styleAvailable();
     void setAnimating(bool);
     bool isAnimatingProperty(int property, bool isRunningNow) const;
     
-    PassRefPtr<KeyframeAnimation> getAnimationForProperty(int property);
+    PassRefPtr<KeyframeAnimation> getAnimationForProperty(int property) const;
 
-
-    void setAnimationStartTime(double t);
-    void setTransitionStartTime(int property, double t);
+    void cleanupFinishedAnimations();
 
     void overrideImplicitAnimations(int property);
     void resumeOverriddenImplicitAnimations(int property);
@@ -85,9 +84,25 @@ public:
     unsigned numberOfActiveAnimations() const;
 
 private:
-    CompositeAnimation(AnimationController* animationController);
+    CompositeAnimation(AnimationControllerPrivate* animationController)
+        : m_animationController(animationController)
+        , m_numStyleAvailableWaiters(0)
+        , m_isSuspended(false)
+    {
+    }
+
+    void updateTransitions(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
+    void updateKeyframeAnimations(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
     
-    CompositeAnimationPrivate* m_data;
+    typedef HashMap<int, RefPtr<ImplicitAnimation> > CSSPropertyTransitionsMap;
+    typedef HashMap<AtomicStringImpl*, RefPtr<KeyframeAnimation> >  AnimationNameMap;
+
+    AnimationControllerPrivate* m_animationController;
+    CSSPropertyTransitionsMap m_transitions;
+    AnimationNameMap m_keyframeAnimations;
+    Vector<AtomicStringImpl*> m_keyframeAnimationOrderMap;
+    unsigned m_numStyleAvailableWaiters;
+    bool m_isSuspended;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
index f984909b86..e93fee4d54 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
@@ -28,13 +28,15 @@
 
 #include "config.h"
 
-#include "AnimationController.h"
+#include "AnimationControllerPrivate.h"
 #include "CompositeAnimation.h"
 #include "CSSPropertyNames.h"
 #include "EventNames.h"
 #include "ImplicitAnimation.h"
 #include "KeyframeAnimation.h"
-#include "RenderObject.h"
+#include "RenderLayer.h"
+#include "RenderLayerBacking.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -50,17 +52,17 @@ ImplicitAnimation::ImplicitAnimation(const Animation* transition, int animatingP
 
 ImplicitAnimation::~ImplicitAnimation()
 {
-    // Do the cleanup here instead of in the base class so the specialized methods get called
+    // // Make sure to tell the renderer that we are ending. This will make sure any accelerated animations are removed.
     if (!postActive())
-        updateStateMachine(AnimationStateInputEndAnimation, -1);
+        endAnimation(true);
 }
 
-bool ImplicitAnimation::shouldSendEventForListener(Document::ListenerType inListenerType)
+bool ImplicitAnimation::shouldSendEventForListener(Document::ListenerType inListenerType) const
 {
     return m_object->document()->hasListenerType(inListenerType);
 }
 
-void ImplicitAnimation::animate(CompositeAnimation*, RenderObject*, RenderStyle*, RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle)
+void ImplicitAnimation::animate(CompositeAnimation*, RenderObject*, const RenderStyle*, RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle)
 {
     // If we get this far and the animation is done, it means we are cleaning up a just finished animation.
     // So just return. Everything is already all cleaned up.
@@ -76,13 +78,58 @@ void ImplicitAnimation::animate(CompositeAnimation*, RenderObject*, RenderStyle*
     if (!animatedStyle)
         animatedStyle = RenderStyle::clone(targetStyle);
 
-    if (blendProperties(this, m_animatingProperty, animatedStyle.get(), m_fromStyle.get(), m_toStyle.get(), progress(1, 0, 0)))
+    bool needsAnim = blendProperties(this, m_animatingProperty, animatedStyle.get(), m_fromStyle.get(), m_toStyle.get(), progress(1, 0, 0));
+    // FIXME: we also need to detect cases where we have to software animate for other reasons,
+    // such as a child using inheriting the transform. https://bugs.webkit.org/show_bug.cgi?id=23902
+    if (needsAnim)
         setAnimating();
+    else {
+#if USE(ACCELERATED_COMPOSITING)
+        // If we are running an accelerated animation, set a flag in the style which causes the style
+        // to compare as different to any other style. This ensures that changes to the property
+        // that is animating are correctly detected during the animation (e.g. when a transition
+        // gets interrupted).
+        animatedStyle->setIsRunningAcceleratedAnimation();
+#endif
+    }
 
     // Fire the start timeout if needed
     fireAnimationEventsIfNeeded();
 }
 
+void ImplicitAnimation::getAnimatedStyle(RefPtr<RenderStyle>& animatedStyle)
+{
+    if (!animatedStyle)
+        animatedStyle = RenderStyle::clone(m_toStyle.get());
+
+    blendProperties(this, m_animatingProperty, animatedStyle.get(), m_fromStyle.get(), m_toStyle.get(), progress(1, 0, 0));
+}
+
+bool ImplicitAnimation::startAnimation(double beginTime)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_object && m_object->hasLayer()) {
+        RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
+        if (layer->isComposited())
+            return layer->backing()->startTransition(beginTime, m_animatingProperty, m_fromStyle.get(), m_toStyle.get());
+    }
+#else
+    UNUSED_PARAM(beginTime);
+#endif
+    return false;
+}
+
+void ImplicitAnimation::endAnimation(bool /*reset*/)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_object && m_object->hasLayer()) {
+        RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
+        if (layer->isComposited())
+            layer->backing()->transitionFinished(m_animatingProperty);
+    }
+#endif
+}
+
 void ImplicitAnimation::onAnimationEnd(double elapsedTime)
 {
     // If we have a keyframe animation on this property, this transition is being overridden. The keyframe
@@ -120,11 +167,11 @@ bool ImplicitAnimation::sendTransitionEvent(const AtomicString& eventType, doubl
                 return false;
 
             // Schedule event handling
-            m_object->animation()->addEventToDispatch(element, eventType, propertyName, elapsedTime);
+            m_compAnim->animationController()->addEventToDispatch(element, eventType, propertyName, elapsedTime);
 
             // Restore the original (unanimated) style
             if (eventType == eventNames().webkitTransitionEndEvent && element->renderer())
-                setChanged(element.get());
+                setNeedsStyleRecalc(element.get());
 
             return true; // Did dispatch an event
         }
@@ -137,7 +184,6 @@ void ImplicitAnimation::reset(RenderStyle* to)
 {
     ASSERT(to);
     ASSERT(m_fromStyle);
-    
 
     m_toStyle = to;
 
@@ -170,6 +216,12 @@ bool ImplicitAnimation::isTargetPropertyEqual(int prop, const RenderStyle* targe
 
 void ImplicitAnimation::blendPropertyValueInStyle(int prop, RenderStyle* currentStyle)
 {
+    // We should never add a transition with a 0 duration and delay. But if we ever did
+    // it would have a null toStyle. So just in case, let's check that here. (See
+    // <https://bugs.webkit.org/show_bug.cgi?id=24787>
+    if (!m_toStyle)
+        return;
+        
     blendProperties(this, prop, currentStyle, m_fromStyle.get(), m_toStyle.get(), progress(1, 0, 0));
 }
 
@@ -209,4 +261,21 @@ void ImplicitAnimation::validateTransformFunctionList()
     m_transformFunctionListValid = true;
 }
 
+double ImplicitAnimation::timeToNextService()
+{
+    double t = AnimationBase::timeToNextService();
+#if USE(ACCELERATED_COMPOSITING)
+    if (t != 0 || preActive())
+        return t;
+        
+    // A return value of 0 means we need service. But if this is an accelerated animation we 
+    // only need service at the end of the transition.
+    if (animationOfPropertyIsAccelerated(m_animatingProperty) && !isFallbackAnimating()) {
+        bool isLooping;
+        getTimeToNextEvent(t, isLooping);
+    }
+#endif
+    return t;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h
index cf98bbae16..33fe4e40ec 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.h
@@ -47,8 +47,11 @@ public:
     int animatingProperty() const { return m_animatingProperty; }
 
     virtual void onAnimationEnd(double elapsedTime);
+    virtual bool startAnimation(double beginTime);
+    virtual void endAnimation(bool reset);
 
-    virtual void animate(CompositeAnimation*, RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle);
+    virtual void animate(CompositeAnimation*, RenderObject*, const RenderStyle* currentStyle, RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle);
+    virtual void getAnimatedStyle(RefPtr<RenderStyle>& animatedStyle);
     virtual void reset(RenderStyle* to);
 
     void setOverridden(bool);
@@ -62,8 +65,10 @@ public:
 
     void blendPropertyValueInStyle(int, RenderStyle* currentStyle);
 
+    virtual double timeToNextService();
+
 protected:
-    bool shouldSendEventForListener(Document::ListenerType);    
+    bool shouldSendEventForListener(Document::ListenerType) const;    
     bool sendTransitionEvent(const AtomicString&, double elapsedTime);
 
     void validateTransformFunctionList();
diff --git a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
index aae37a7a21..3f84de1623 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
@@ -29,13 +29,14 @@
 #include "config.h"
 #include "KeyframeAnimation.h"
 
-#include "AnimationController.h"
+#include "AnimationControllerPrivate.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "CompositeAnimation.h"
 #include "EventNames.h"
-#include "RenderObject.h"
-#include "SystemTime.h"
+#include "RenderLayer.h"
+#include "RenderLayerBacking.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -46,8 +47,8 @@ KeyframeAnimation::KeyframeAnimation(const Animation* animation, RenderObject* r
     , m_unanimatedStyle(unanimatedStyle)
 {
     // Get the keyframe RenderStyles
-    if (m_object && m_object->element() && m_object->element()->isElementNode())
-        m_object->document()->styleSelector()->keyframeStylesForAnimation(static_cast<Element*>(m_object->element()), unanimatedStyle, m_keyframes);
+    if (m_object && m_object->node() && m_object->node()->isElementNode())
+        m_object->document()->styleSelector()->keyframeStylesForAnimation(static_cast<Element*>(m_object->node()), unanimatedStyle, m_keyframes);
 
     // Update the m_transformFunctionListValid flag based on whether the function lists in the keyframes match.
     validateTransformFunctionList();
@@ -55,12 +56,50 @@ KeyframeAnimation::KeyframeAnimation(const Animation* animation, RenderObject* r
 
 KeyframeAnimation::~KeyframeAnimation()
 {
-    // Do the cleanup here instead of in the base class so the specialized methods get called
+    // Make sure to tell the renderer that we are ending. This will make sure any accelerated animations are removed.
     if (!postActive())
-        updateStateMachine(AnimationStateInputEndAnimation, -1);
+        endAnimation(true);
+}
+
+void KeyframeAnimation::getKeyframeAnimationInterval(const RenderStyle*& fromStyle, const RenderStyle*& toStyle, double& prog) const
+{
+    // Find the first key
+    double elapsedTime = getElapsedTime();
+
+    double t = m_animation->duration() ? (elapsedTime / m_animation->duration()) : 1;
+    int i = static_cast<int>(t);
+    t -= i;
+    if (m_animation->direction() && (i & 1))
+        t = 1 - t;
+
+    double scale = 1;
+    double offset = 0;
+    Vector<KeyframeValue>::const_iterator endKeyframes = m_keyframes.endKeyframes();
+    for (Vector<KeyframeValue>::const_iterator it = m_keyframes.beginKeyframes(); it != endKeyframes; ++it) {
+        if (t < it->key()) {
+            // The first key should always be 0, so we should never succeed on the first key
+            if (!fromStyle)
+                break;
+            scale = 1.0 / (it->key() - offset);
+            toStyle = it->style();
+            break;
+        }
+
+        offset = it->key();
+        fromStyle = it->style();
+    }
+
+    if (!fromStyle || !toStyle)
+        return;
+
+    const TimingFunction* timingFunction = 0;
+    if (fromStyle->animations() && fromStyle->animations()->size() > 0)
+        timingFunction = &(fromStyle->animations()->animation(0)->timingFunction());
+
+    prog = progress(scale, offset, timingFunction);
 }
 
-void KeyframeAnimation::animate(CompositeAnimation*, RenderObject*, const RenderStyle*, const RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle)
+void KeyframeAnimation::animate(CompositeAnimation*, RenderObject*, const RenderStyle*, RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle)
 {
     // Fire the start timeout if needed
     fireAnimationEventsIfNeeded();
@@ -85,36 +124,12 @@ void KeyframeAnimation::animate(CompositeAnimation*, RenderObject*, const Render
 
     // FIXME: we need to be more efficient about determining which keyframes we are animating between.
     // We should cache the last pair or something.
-
-    // Find the first key
-    double elapsedTime = (m_startTime > 0 || m_pauseTime > 0) ? ((!paused() ? beginAnimationUpdateTime() : m_pauseTime) - m_startTime) : 0;
-    if (elapsedTime < 0)
-        elapsedTime = 0;
-
-    double t = m_animation->duration() ? (elapsedTime / m_animation->duration()) : 1;
-    int i = static_cast<int>(t);
-    t -= i;
-    if (m_animation->direction() && (i & 1))
-        t = 1 - t;
-
+    
+    // Get the from/to styles and progress between
     const RenderStyle* fromStyle = 0;
     const RenderStyle* toStyle = 0;
-    double scale = 1;
-    double offset = 0;
-    Vector<KeyframeValue>::const_iterator endKeyframes = m_keyframes.endKeyframes();
-    for (Vector<KeyframeValue>::const_iterator it = m_keyframes.beginKeyframes(); it != endKeyframes; ++it) {
-        if (t < it->key()) {
-            // The first key should always be 0, so we should never succeed on the first key
-            if (!fromStyle)
-                break;
-            scale = 1.0 / (it->key() - offset);
-            toStyle = it->style();
-            break;
-        }
-
-        offset = it->key();
-        fromStyle = it->style();
-    }
+    double progress;
+    getKeyframeAnimationInterval(fromStyle, toStyle, progress);
 
     // If either style is 0 we have an invalid case, just stop the animation.
     if (!fromStyle || !toStyle) {
@@ -127,19 +142,42 @@ void KeyframeAnimation::animate(CompositeAnimation*, RenderObject*, const Render
     if (!animatedStyle)
         animatedStyle = RenderStyle::clone(targetStyle);
 
-    const TimingFunction* timingFunction = 0;
-    if (fromStyle->animations() && fromStyle->animations()->size() > 0)
-        timingFunction = &(fromStyle->animations()->animation(0)->timingFunction());
-
-    double prog = progress(scale, offset, timingFunction);
-
     HashSet<int>::const_iterator endProperties = m_keyframes.endProperties();
     for (HashSet<int>::const_iterator it = m_keyframes.beginProperties(); it != endProperties; ++it) {
-        if (blendProperties(this, *it, animatedStyle.get(), fromStyle, toStyle, prog))
+        bool needsAnim = blendProperties(this, *it, animatedStyle.get(), fromStyle, toStyle, progress);
+        if (needsAnim)
             setAnimating();
+        else {
+#if USE(ACCELERATED_COMPOSITING)
+            // If we are running an accelerated animation, set a flag in the style
+            // to indicate it. This can be used to make sure we get an updated
+            // style for hit testing, etc.
+            animatedStyle->setIsRunningAcceleratedAnimation();
+#endif
+        }
     }
 }
 
+void KeyframeAnimation::getAnimatedStyle(RefPtr<RenderStyle>& animatedStyle)
+{
+    // Get the from/to styles and progress between
+    const RenderStyle* fromStyle = 0;
+    const RenderStyle* toStyle = 0;
+    double progress;
+    getKeyframeAnimationInterval(fromStyle, toStyle, progress);
+
+    // If either style is 0 we have an invalid case
+    if (!fromStyle || !toStyle)
+        return;
+
+    if (!animatedStyle)
+        animatedStyle = RenderStyle::clone(m_object->style());
+
+    HashSet<int>::const_iterator endProperties = m_keyframes.endProperties();
+    for (HashSet<int>::const_iterator it = m_keyframes.beginProperties(); it != endProperties; ++it)
+        blendProperties(this, *it, animatedStyle.get(), fromStyle, toStyle, progress);
+}
+
 bool KeyframeAnimation::hasAnimationForProperty(int property) const
 {
     HashSet<int>::const_iterator end = m_keyframes.endProperties();
@@ -151,14 +189,39 @@ bool KeyframeAnimation::hasAnimationForProperty(int property) const
     return false;
 }
 
-void KeyframeAnimation::endAnimation(bool)
+bool KeyframeAnimation::startAnimation(double beginTime)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_object && m_object->hasLayer()) {
+        RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
+        if (layer->isComposited())
+            return layer->backing()->startAnimation(beginTime, m_animation.get(), m_keyframes);
+    }
+#else
+    UNUSED_PARAM(beginTime);
+#endif
+    return false;
+}
+
+void KeyframeAnimation::endAnimation(bool reset)
 {
-    // Restore the original (unanimated) style
-    if (m_object)
-        setChanged(m_object->element());
+    if (m_object) {
+#if USE(ACCELERATED_COMPOSITING)
+        if (m_object->hasLayer()) {
+            RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
+            if (layer->isComposited())
+                layer->backing()->animationFinished(m_keyframes.animationName(), 0, reset);
+        }
+#else
+        UNUSED_PARAM(reset);
+#endif
+        // Restore the original (unanimated) style
+        if (!paused())
+            setNeedsStyleRecalc(m_object->node());
+    }
 }
 
-bool KeyframeAnimation::shouldSendEventForListener(Document::ListenerType listenerType)
+bool KeyframeAnimation::shouldSendEventForListener(Document::ListenerType listenerType) const
 {
     return m_object->document()->hasListenerType(listenerType);
 }
@@ -204,11 +267,11 @@ bool KeyframeAnimation::sendAnimationEvent(const AtomicString& eventType, double
             return false;
 
         // Schedule event handling
-        m_object->animation()->addEventToDispatch(element, eventType, m_keyframes.animationName(), elapsedTime);
+        m_compAnim->animationController()->addEventToDispatch(element, eventType, m_keyframes.animationName(), elapsedTime);
 
         // Restore the original (unanimated) style
         if (eventType == eventNames().webkitAnimationEndEvent && element->renderer())
-            setChanged(element.get());
+            setNeedsStyleRecalc(element.get());
 
         return true; // Did dispatch an event
     }
@@ -290,4 +353,31 @@ void KeyframeAnimation::validateTransformFunctionList()
     m_transformFunctionListValid = true;
 }
 
+double KeyframeAnimation::timeToNextService()
+{
+    double t = AnimationBase::timeToNextService();
+#if USE(ACCELERATED_COMPOSITING)
+    if (t != 0 || preActive())
+        return t;
+        
+    // A return value of 0 means we need service. But if we only have accelerated animations we 
+    // only need service at the end of the transition
+    HashSet<int>::const_iterator endProperties = m_keyframes.endProperties();
+    bool acceleratedPropertiesOnly = true;
+    
+    for (HashSet<int>::const_iterator it = m_keyframes.beginProperties(); it != endProperties; ++it) {
+        if (!animationOfPropertyIsAccelerated(*it) || isFallbackAnimating()) {
+            acceleratedPropertiesOnly = false;
+            break;
+        }
+    }
+
+    if (acceleratedPropertiesOnly) {
+        bool isLooping;
+        getTimeToNextEvent(t, isLooping);
+    }
+#endif
+    return t;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h
index 5c3176c243..4905fc3209 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.h
@@ -44,8 +44,9 @@ public:
     {
         return adoptRef(new KeyframeAnimation(animation, renderer, index, compositeAnimation, unanimatedStyle));
     };
-    
-    virtual void animate(CompositeAnimation*, RenderObject*, const RenderStyle* currentStyle, const RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle);
+
+    virtual void animate(CompositeAnimation*, RenderObject*, const RenderStyle* currentStyle, RenderStyle* targetStyle, RefPtr<RenderStyle>& animatedStyle);
+    virtual void getAnimatedStyle(RefPtr<RenderStyle>& animatedStyle);
 
     const AtomicString& name() const { return m_keyframes.animationName(); }
     int index() const { return m_index; }
@@ -56,16 +57,19 @@ public:
     void setUnanimatedStyle(PassRefPtr<RenderStyle> style) { m_unanimatedStyle = style; }
     RenderStyle* unanimatedStyle() const { return m_unanimatedStyle.get(); }
 
+    virtual double timeToNextService();
+
 protected:
     virtual void onAnimationStart(double elapsedTime);
     virtual void onAnimationIteration(double elapsedTime);
     virtual void onAnimationEnd(double elapsedTime);
+    virtual bool startAnimation(double beginTime);
     virtual void endAnimation(bool reset);
 
     virtual void overrideAnimations();
     virtual void resumeOverriddenAnimations();
 
-    bool shouldSendEventForListener(Document::ListenerType inListenerType);    
+    bool shouldSendEventForListener(Document::ListenerType inListenerType) const;
     bool sendAnimationEvent(const AtomicString&, double elapsedTime);
 
     virtual bool affectsProperty(int) const;
@@ -76,6 +80,9 @@ private:
     KeyframeAnimation(const Animation* animation, RenderObject*, int index, CompositeAnimation*, RenderStyle* unanimatedStyle);
     virtual ~KeyframeAnimation();
     
+    // Get the styles surrounding the current animation time and the progress between them
+    void getKeyframeAnimationInterval(const RenderStyle*& fromStyle, const RenderStyle*& toStyle, double& progress) const;
+
     // The keyframes that we are blending.
     KeyframeList m_keyframes;
 
diff --git a/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp b/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp
index 1bbbff50c1..388bf66741 100644
--- a/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp
+++ b/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp
@@ -23,7 +23,7 @@
 
 #include "config.h"
 #include "Frame.h"
-#include "FramePrivate.h"
+
 #include "UserStyleSheetLoader.h"
 
 namespace WebCore {
@@ -35,18 +35,18 @@ DragImageRef Frame::dragImageForSelection()
 
 void Frame::setUserStyleSheetLocation(const KURL& url)
 {
-    delete d->m_userStyleSheetLoader;
-    d->m_userStyleSheetLoader = 0;
-    if (d->m_doc && d->m_doc->docLoader())
-        d->m_userStyleSheetLoader = new UserStyleSheetLoader(d->m_doc, url.string());
+    delete m_userStyleSheetLoader;
+    m_userStyleSheetLoader = 0;
+    if (m_doc && m_doc->docLoader())
+        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
 }
 
 void Frame::setUserStyleSheet(const String& styleSheet)
 {
-    delete d->m_userStyleSheetLoader;
-    d->m_userStyleSheetLoader = 0;
-    if (d->m_doc)
-        d->m_doc->setUserStyleSheet(styleSheet);
+    delete m_userStyleSheetLoader;
+    m_userStyleSheetLoader = 0;
+    if (m_doc)
+        m_doc->setUserStyleSheet(styleSheet);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp b/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp
index da2d8b2e07..8b0408de89 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameCGWin.cpp
@@ -28,7 +28,6 @@
 
 #include <windows.h>
 
-#include "FramePrivate.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "Settings.h"
@@ -101,9 +100,9 @@ HBITMAP Frame::nodeImage(Node* node) const
 
     document()->updateLayout();
 
-    d->m_view->setNodeToDraw(node); // invoke special sub-tree drawing mode
+    m_view->setNodeToDraw(node); // invoke special sub-tree drawing mode
     HBITMAP result = imageFromRect(this, paintingRect);
-    d->m_view->setNodeToDraw(0);
+    m_view->setNodeToDraw(0);
 
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp b/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
index 895d129af5..0c1c5b11e4 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
@@ -30,7 +30,6 @@
 #include "TransformationMatrix.h"
 #include "FloatRect.h"
 #include "Document.h"
-#include "FramePrivate.h"
 #include "RenderView.h"
 #include "Settings.h"
 
@@ -62,7 +61,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->docWidth());
+    float pageWidth  = static_cast<float>(root->overflowWidth());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
@@ -82,7 +81,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     float printedPagesHeight = 0.0f;
     do {
         float proposedBottom = min(docHeight, printedPagesHeight + pageHeight);
-        frame->adjustPageHeight(&proposedBottom, printedPagesHeight, proposedBottom, printedPagesHeight);
+        frame->view()->adjustPageHeight(&proposedBottom, printedPagesHeight, proposedBottom, printedPagesHeight);
         currPageHeight = max(1.0f, proposedBottom - printedPagesHeight);
        
         pages.append(IntRect(0, printedPagesHeight, currPageWidth, currPageHeight));
diff --git a/src/3rdparty/webkit/WebCore/platform/Arena.cpp b/src/3rdparty/webkit/WebCore/platform/Arena.cpp
index 697e73f0b6..372a565374 100644
--- a/src/3rdparty/webkit/WebCore/platform/Arena.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Arena.cpp
@@ -195,16 +195,6 @@ void* ArenaAllocate(ArenaPool *pool, unsigned int nb)
     }
 } /* --- end ArenaAllocate() --- */
 
-void* ArenaGrow(ArenaPool *pool, void *p, unsigned int size, unsigned int incr)
-{
-    void *newp;
- 
-    ARENA_ALLOCATE(newp, pool, size + incr);
-    if (newp)
-        memcpy(newp, p, size);
-    return newp;
-}
-
 /*
  * Free tail arenas linked after head, which may not be the true list head.
  * Reset pool->current to point to head in case it pointed at a tail arena.
@@ -255,19 +245,6 @@ static void FreeArenaList(ArenaPool *pool, Arena *head, bool reallyFree)
     pool->current = head;
 }
 
-void ArenaRelease(ArenaPool *pool, char *mark)
-{
-    Arena *a;
-
-    for (a = pool->first.next; a; a = a->next) {
-        if (UPTRDIFF(mark, a->base) < UPTRDIFF(a->avail, a->base)) {
-            a->avail = (uword)ARENA_ALIGN(pool, mark);
-            FreeArenaList(pool, a, false);
-            return;
-        }
-    }
-}
-
 void FreeArenaPool(ArenaPool *pool)
 {
     FreeArenaList(pool, &pool->first, false);
diff --git a/src/3rdparty/webkit/WebCore/platform/ContentType.cpp b/src/3rdparty/webkit/WebCore/platform/ContentType.cpp
new file mode 100644
index 0000000000..3dce7b537d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/ContentType.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ContentType.h"
+
+namespace WebCore {
+
+ContentType::ContentType(const String& contentType)
+    : m_type(contentType)
+{
+}
+
+String ContentType::parameter(const String& parameterName) const
+{
+    String parameterValue;
+    String strippedType = m_type.stripWhiteSpace();
+
+    // a MIME type can have one or more "param=value" after a semi-colon, and separated from each other by semi-colons
+    int semi = strippedType.find(';');
+    if (semi != -1) {
+        int start = strippedType.find(parameterName, semi + 1, false);
+        if (start != -1) {
+            start = strippedType.find('=', start + 6);
+            if (start != -1) {
+                int end = strippedType.find(';', start + 6);
+                if (end == -1)
+                    end = strippedType.length();
+                parameterValue = strippedType.substring(start + 1, end - (start + 1)).stripWhiteSpace();
+            }
+        }
+    }
+
+    return parameterValue;
+}
+
+String ContentType::type() const
+{
+    String strippedType = m_type.stripWhiteSpace();
+
+    // "type" can have parameters after a semi-colon, strip them
+    int semi = strippedType.find(';');
+    if (semi != -1)
+        strippedType = strippedType.left(semi).stripWhiteSpace();
+
+    return strippedType;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreTextRenderer.h b/src/3rdparty/webkit/WebCore/platform/ContentType.h
index 3e774348f7..bf8fc4c20c 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreTextRenderer.h
+++ b/src/3rdparty/webkit/WebCore/platform/ContentType.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,21 +21,27 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifdef __cplusplus
-extern "C" {
-#endif
+#ifndef ContentType_h
+#define ContentType_h
 
-extern void WebCoreDrawTextAtPoint(const UniChar*, unsigned length, NSPoint, NSFont*, NSColor*);
-extern float WebCoreTextFloatWidth(const UniChar*, unsigned length, NSFont*);
-extern void WebCoreSetShouldUseFontSmoothing(bool);
-extern bool WebCoreShouldUseFontSmoothing();
-extern void WebCoreSetAlwaysUsesComplexTextCodePath(bool);
-extern bool WebCoreAlwaysUsesComplexTextCodePath();
-extern NSFont* WebCoreFindFont(NSString* familyName, NSFontTraitMask, int weight, int size);
+#include "PlatformString.h"
 
-#ifdef __cplusplus
-}
-#endif
+namespace WebCore {
+
+    class ContentType {
+    public:
+        ContentType(const String& type);
+
+        String parameter (const String& parameterName) const;
+        String type() const;
+        const String& raw() const { return m_type; }
+    private:
+        String m_type;
+    };
+
+} // namespace WebCore
+
+#endif // ContentType_h
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
index f086b63143..362e334c16 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
@@ -112,11 +112,21 @@ static void createAndAppendSpellingAndGrammarSubMenu(const HitTestResult& result
         contextMenuItemTagCheckSpellingWhileTyping());
     ContextMenuItem grammarWithSpelling(CheckableActionType, ContextMenuItemTagCheckGrammarWithSpelling, 
         contextMenuItemTagCheckGrammarWithSpelling());
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    ContextMenuItem correctSpelling(CheckableActionType, ContextMenuItemTagCorrectSpellingAutomatically, 
+        contextMenuItemTagCorrectSpellingAutomatically());
+#endif
 
     spellingAndGrammarMenu.appendItem(showSpellingPanel);
     spellingAndGrammarMenu.appendItem(checkSpelling);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    spellingAndGrammarMenu.appendItem(*separatorItem());
+#endif
     spellingAndGrammarMenu.appendItem(checkAsYouType);
     spellingAndGrammarMenu.appendItem(grammarWithSpelling);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    spellingAndGrammarMenu.appendItem(correctSpelling);
+#endif
 
     spellingAndGrammarMenuItem.setSubMenu(&spellingAndGrammarMenu);
 }
@@ -189,10 +199,49 @@ static void createAndAppendTextDirectionSubMenu(const HitTestResult& result, Con
 }
 #endif
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+static void createAndAppendSubstitutionsSubMenu(const HitTestResult& result, ContextMenuItem& substitutionsMenuItem)
+{
+    ContextMenu substitutionsMenu(result);
+
+    ContextMenuItem showSubstitutions(ActionType, ContextMenuItemTagShowSubstitutions, contextMenuItemTagShowSubstitutions(true));
+    ContextMenuItem smartCopyPaste(CheckableActionType, ContextMenuItemTagSmartCopyPaste, contextMenuItemTagSmartCopyPaste());
+    ContextMenuItem smartQuotes(CheckableActionType, ContextMenuItemTagSmartQuotes, contextMenuItemTagSmartQuotes());
+    ContextMenuItem smartDashes(CheckableActionType, ContextMenuItemTagSmartDashes, contextMenuItemTagSmartDashes());
+    ContextMenuItem smartLinks(CheckableActionType, ContextMenuItemTagSmartLinks, contextMenuItemTagSmartLinks());
+    ContextMenuItem textReplacement(CheckableActionType, ContextMenuItemTagTextReplacement, contextMenuItemTagTextReplacement());
+
+    substitutionsMenu.appendItem(showSubstitutions);
+    substitutionsMenu.appendItem(*separatorItem());
+    substitutionsMenu.appendItem(smartCopyPaste);
+    substitutionsMenu.appendItem(smartQuotes);
+    substitutionsMenu.appendItem(smartDashes);
+    substitutionsMenu.appendItem(smartLinks);
+    substitutionsMenu.appendItem(textReplacement);
+
+    substitutionsMenuItem.setSubMenu(&substitutionsMenu);
+}
+
+static void createAndAppendTransformationsSubMenu(const HitTestResult& result, ContextMenuItem& transformationsMenuItem)
+{
+    ContextMenu transformationsMenu(result);
+
+    ContextMenuItem makeUpperCase(ActionType, ContextMenuItemTagMakeUpperCase, contextMenuItemTagMakeUpperCase());
+    ContextMenuItem makeLowerCase(ActionType, ContextMenuItemTagMakeLowerCase, contextMenuItemTagMakeLowerCase());
+    ContextMenuItem capitalize(ActionType, ContextMenuItemTagCapitalize, contextMenuItemTagCapitalize());
+
+    transformationsMenu.appendItem(makeUpperCase);
+    transformationsMenu.appendItem(makeLowerCase);
+    transformationsMenu.appendItem(capitalize);
+
+    transformationsMenuItem.setSubMenu(&transformationsMenu);
+}
+#endif
+
 static bool selectionContainsPossibleWord(Frame* frame)
 {
     // Current algorithm: look for a character that's not just a separator.
-    for (TextIterator it(frame->selection()->toRange().get()); !it.atEnd(); it.advance()) {
+    for (TextIterator it(frame->selection()->toNormalizedRange().get()); !it.atEnd(); it.advance()) {
         int length = it.length();
         const UChar* characters = it.characters();
         for (int i = 0; i < length; ++i)
@@ -252,7 +301,7 @@ void ContextMenu::populate()
     if (!node)
         return;
 #if PLATFORM(GTK)
-    if (!result.isContentEditable() && node->isControl())
+    if (!result.isContentEditable() && (node->isElementNode() && static_cast<Element*>(node)->isFormControlElement()))
         return;
 #endif
     Frame* frame = node->document()->frame();
@@ -328,12 +377,10 @@ void ContextMenu::populate()
         if (!inPasswordField) {
             // Consider adding spelling-related or grammar-related context menu items (never both, since a single selected range
             // is never considered a misspelling and bad grammar at the same time)
-            bool misspelling = frame->editor()->isSelectionMisspelled();
-            bool badGrammar = !misspelling && (frame->editor()->isGrammarCheckingEnabled() && frame->editor()->isSelectionUngrammatical());
-            
+            bool misspelling;
+            bool badGrammar;
+            Vector<String> guesses = frame->editor()->guessesForMisspelledOrUngrammaticalSelection(misspelling, badGrammar);
             if (misspelling || badGrammar) {
-                Vector<String> guesses = misspelling ? frame->editor()->guessesForMisspelledSelection()
-                    : frame->editor()->guessesForUngrammaticalSelection();
                 size_t size = guesses.size();
                 if (size == 0) {
                     // If there's bad grammar but no suggestions (e.g., repeated word), just leave off the suggestions
@@ -359,6 +406,16 @@ void ContextMenu::populate()
                 } else
                     appendItem(IgnoreGrammarItem);
                 appendItem(*separatorItem());
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            } else {
+                // If the string was autocorrected, generate a contextual menu item allowing it to be changed back.
+                String replacedString = result.replacedString();
+                if (!replacedString.isEmpty()) {
+                    ContextMenuItem item(ActionType, ContextMenuItemTagChangeBack, contextMenuItemTagChangeBack(replacedString));
+                    appendItem(item);
+                    appendItem(*separatorItem());
+                }
+#endif
             }
         }
 
@@ -409,6 +466,16 @@ void ContextMenu::populate()
             createAndAppendSpellingSubMenu(m_hitTestResult, SpellingMenuItem);
             appendItem(SpellingMenuItem);
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            ContextMenuItem substitutionsMenuItem(SubmenuType, ContextMenuItemTagSubstitutionsMenu, 
+                contextMenuItemTagSubstitutionsMenu());
+            createAndAppendSubstitutionsSubMenu(m_hitTestResult, substitutionsMenuItem);
+            appendItem(substitutionsMenuItem);
+            ContextMenuItem transformationsMenuItem(SubmenuType, ContextMenuItemTagTransformationsMenu, 
+                contextMenuItemTagTransformationsMenu());
+            createAndAppendTransformationsSubMenu(m_hitTestResult, transformationsMenuItem);
+            appendItem(transformationsMenuItem);
+#endif
             ContextMenuItem  FontMenuItem(SubmenuType, ContextMenuItemTagFontMenu, 
                 contextMenuItemTagFontMenu());
             createAndAppendFontSubMenu(m_hitTestResult, FontMenuItem);
@@ -427,7 +494,7 @@ void ContextMenu::populate()
             if (Page* page = frame->page()) {
                 if (Settings* settings = page->settings()) {
                     bool includeTextDirectionSubmenu = settings->textDirectionSubmenuInclusionBehavior() == TextDirectionSubmenuAlwaysIncluded
-                        || settings->textDirectionSubmenuInclusionBehavior() == TextDirectionSubmenuAutomaticallyIncluded && frame->editor()->hasBidiSelection();
+                        || (settings->textDirectionSubmenuInclusionBehavior() == TextDirectionSubmenuAutomaticallyIncluded && frame->editor()->hasBidiSelection());
                     if (includeTextDirectionSubmenu) {
                         ContextMenuItem TextDirectionMenuItem(SubmenuType, ContextMenuItemTagTextDirectionMenu, 
                             contextMenuItemTagTextDirectionMenu());
@@ -586,6 +653,56 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagCheckSpellingWhileTyping:
             shouldCheck = frame->editor()->isContinuousSpellCheckingEnabled();
             break;
+#if PLATFORM(MAC)
+        case ContextMenuItemTagSubstitutionsMenu:
+        case ContextMenuItemTagTransformationsMenu:
+            break;
+        case ContextMenuItemTagShowSubstitutions:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            if (frame->editor()->substitutionsPanelIsShowing())
+                item.setTitle(contextMenuItemTagShowSubstitutions(false));
+            else
+                item.setTitle(contextMenuItemTagShowSubstitutions(true));
+            shouldEnable = frame->editor()->canEdit();
+#endif
+            break;
+        case ContextMenuItemTagMakeUpperCase:
+        case ContextMenuItemTagMakeLowerCase:
+        case ContextMenuItemTagCapitalize:
+        case ContextMenuItemTagChangeBack:
+            shouldEnable = frame->editor()->canEdit();
+            break;
+        case ContextMenuItemTagCorrectSpellingAutomatically:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticSpellingCorrectionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartCopyPaste:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->smartInsertDeleteEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartQuotes:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticQuoteSubstitutionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartDashes:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticDashSubstitutionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartLinks:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticLinkDetectionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagTextReplacement:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticTextReplacementEnabled();
+#endif
+            break;
+#endif
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
             shouldEnable = frame->loader()->canGoBackOrForward(-1);
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.h b/src/3rdparty/webkit/WebCore/platform/ContextMenu.h
index 9418ff59d8..75899ba39b 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.h
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.h
@@ -39,7 +39,6 @@
 #endif
 
 namespace WebCore {
-class MenuEventProxy;
 
     class ContextMenuController;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h b/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
index 2d22b8dac5..291258d813 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
@@ -124,6 +124,21 @@ namespace WebCore {
         ContextMenuItemTagTextDirectionDefault,
         ContextMenuItemTagTextDirectionLeftToRight,
         ContextMenuItemTagTextDirectionRightToLeft,
+#if PLATFORM(MAC)
+        ContextMenuItemTagCorrectSpellingAutomatically,
+        ContextMenuItemTagSubstitutionsMenu,
+        ContextMenuItemTagShowSubstitutions,
+        ContextMenuItemTagSmartCopyPaste,
+        ContextMenuItemTagSmartQuotes,
+        ContextMenuItemTagSmartDashes,
+        ContextMenuItemTagSmartLinks,
+        ContextMenuItemTagTextReplacement,
+        ContextMenuItemTagTransformationsMenu,
+        ContextMenuItemTagMakeUpperCase,
+        ContextMenuItemTagMakeLowerCase,
+        ContextMenuItemTagCapitalize,
+        ContextMenuItemTagChangeBack,
+#endif
         ContextMenuItemBaseApplicationTag = 10000
     };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/CookieJar.h b/src/3rdparty/webkit/WebCore/platform/CookieJar.h
index 178ee79e52..6159386459 100644
--- a/src/3rdparty/webkit/WebCore/platform/CookieJar.h
+++ b/src/3rdparty/webkit/WebCore/platform/CookieJar.h
@@ -33,7 +33,7 @@ namespace WebCore {
     class Document;
 
     String cookies(const Document*, const KURL&);
-    void setCookies(Document*, const KURL&, const KURL& policyBaseURL, const String&);
+    void setCookies(Document*, const KURL&, const String&);
     bool cookiesEnabled(const Document*);
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
new file mode 100644
index 0000000000..9ca626fefe
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CrossThreadCopier.h"
+
+#include "PlatformString.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+
+namespace WebCore {
+
+CrossThreadCopierBase<false, String>::Type CrossThreadCopierBase<false, String>::copy(const String& str)
+{
+    return str.copy();
+}
+
+CrossThreadCopierBase<false, ResourceError>::Type CrossThreadCopierBase<false, ResourceError>::copy(const ResourceError& error)
+{
+    return error.copy();
+}
+
+CrossThreadCopierBase<false, ResourceRequest>::Type CrossThreadCopierBase<false, ResourceRequest>::copy(const ResourceRequest& request)
+{
+    return request.copyData();
+}
+
+CrossThreadCopierBase<false, ResourceResponse>::Type CrossThreadCopierBase<false, ResourceResponse>::copy(const ResourceResponse& response)
+{
+    return response.copyData();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
new file mode 100644
index 0000000000..e7b4c0ef95
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CrossThreadCopier_h
+#define CrossThreadCopier_h
+
+#include <memory>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
+#include <wtf/TypeTraits.h>
+
+namespace WebCore {
+
+    class ResourceError;
+    struct ResourceRequest;
+    class ResourceResponse;
+    class String;
+    struct CrossThreadResourceResponseData;
+    struct CrossThreadResourceRequestData;
+
+    template<typename T> struct CrossThreadCopierPassThrough {
+        typedef T Type;
+        static Type copy(const T& parameter)
+        {
+            return parameter;
+        }
+    };
+
+    template<bool isConvertibleToInteger, typename T> struct CrossThreadCopierBase;
+
+    // Integers get passed through without any changes.
+    template<typename T> struct CrossThreadCopierBase<true, T> : public CrossThreadCopierPassThrough<T> {
+    };
+
+    // Pointers get passed through without any significant changes.
+    template<typename T> struct CrossThreadCopierBase<false, T*> : public CrossThreadCopierPassThrough<T*> {
+    };
+
+    // Custom copy methods.
+    template<typename T> struct CrossThreadCopierBase<false, RefPtr<ThreadSafeShared<T> > > {
+        typedef PassRefPtr<T> Type;
+        static Type copy(const RefPtr<ThreadSafeShared<T> >& refPtr)
+        {
+            return PassRefPtr<T>(static_cast<T*>(refPtr.get()));
+        }
+    };
+
+    template<typename T> struct CrossThreadCopierBase<false, std::auto_ptr<T> > {
+        typedef std::auto_ptr<T> Type;
+        static Type copy(const std::auto_ptr<T>& autoPtr)
+        {
+            return std::auto_ptr<T>(*const_cast<std::auto_ptr<T>*>(&autoPtr));
+        }
+    };
+
+    template<> struct CrossThreadCopierBase<false, String> {
+        typedef String Type;
+        static Type copy(const String&);
+    };
+
+    template<> struct CrossThreadCopierBase<false, ResourceError> {
+        typedef ResourceError Type;
+        static Type copy(const ResourceError&);
+    };
+
+    template<> struct CrossThreadCopierBase<false, ResourceRequest> {
+        typedef std::auto_ptr<CrossThreadResourceRequestData> Type;
+        static Type copy(const ResourceRequest&);
+    };
+
+    template<> struct CrossThreadCopierBase<false, ResourceResponse> {
+        typedef std::auto_ptr<CrossThreadResourceResponseData> Type;
+        static Type copy(const ResourceResponse&);
+    };
+
+    template<typename T> struct CrossThreadCopier : public CrossThreadCopierBase<WTF::IsConvertibleToInteger<T>::value, T> {
+    };
+
+} // namespace WebCore
+
+#endif // CrossThreadCopier_h
diff --git a/src/3rdparty/webkit/WebCore/platform/Cursor.h b/src/3rdparty/webkit/WebCore/platform/Cursor.h
index 3ab694c086..ea75191c20 100644
--- a/src/3rdparty/webkit/WebCore/platform/Cursor.h
+++ b/src/3rdparty/webkit/WebCore/platform/Cursor.h
@@ -70,18 +70,25 @@ namespace WebCore {
         HCURSOR m_nativeCursor;
     };
     typedef RefPtr<SharedCursor> PlatformCursor;
+    typedef HCURSOR PlatformCursorHandle;
 #elif PLATFORM(MAC)
     typedef NSCursor* PlatformCursor;
+    typedef NSCursor* PlatformCursorHandle;
 #elif PLATFORM(GTK)
     typedef GdkCursor* PlatformCursor;
+    typedef GdkCursor* PlatformCursorHandle;
 #elif PLATFORM(QT) && !defined(QT_NO_CURSOR)
     typedef QCursor PlatformCursor;
+    typedef QCursor* PlatformCursorHandle;
 #elif PLATFORM(WX)
     typedef wxCursor* PlatformCursor;
+    typedef wxCursor* PlatformCursorHandle;
 #elif PLATFORM(CHROMIUM)
     // See PlatformCursor.h
+    typedef void* PlatformCursorHandle;
 #else
     typedef void* PlatformCursor;
+    typedef void* PlatformCursorHandle;
 #endif
 
     class Cursor {
diff --git a/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp b/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp
index b3badc221d..6d6112ebd8 100644
--- a/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/DeprecatedPtrListImpl.cpp
@@ -143,7 +143,7 @@ bool DeprecatedPtrListImpl::insert(unsigned n, const void *item)
         return false;
     }
 
-    DeprecatedListNode *node = new DeprecatedListNode((void *)item);
+    DeprecatedListNode *node = new DeprecatedListNode(const_cast<void*>(item));
 
     if (n == 0) {
         // inserting at head
diff --git a/src/3rdparty/webkit/WebCore/platform/FileSystem.h b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
index 66dbc20d09..16afe8ff82 100644
--- a/src/3rdparty/webkit/WebCore/platform/FileSystem.h
+++ b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
@@ -39,11 +39,10 @@
 #if defined(Q_OS_WIN32)
 #include <windows.h>
 #endif
-#endif
-
-#if PLATFORM(DARWIN)
+#if defined(Q_WS_MAC)
 #include <CoreFoundation/CFBundle.h>
 #endif
+#endif
 
 #include <time.h>
 
@@ -97,9 +96,6 @@ const PlatformFileHandle invalidPlatformFileHandle = 0;
 #if defined(Q_WS_MAC)
 typedef CFBundleRef PlatformModule;
 typedef unsigned PlatformModuleVersion;
-#elif defined(Q_WS_X11) || defined(Q_WS_QWS) || defined(Q_WS_S60)
-typedef QLibrary* PlatformModule;
-typedef unsigned PlatformModuleVersion;
 #elif defined(Q_OS_WIN)
 typedef HMODULE PlatformModule;
 struct PlatformModuleVersion {
@@ -119,6 +115,9 @@ struct PlatformModuleVersion {
     }
 
 };
+#else
+typedef QLibrary* PlatformModule;
+typedef unsigned PlatformModuleVersion;
 #endif
 
 #else
diff --git a/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp b/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
index dfd5a5cdc6..9b362c8ccb 100644
--- a/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
@@ -26,9 +26,7 @@
 #include "config.h"
 #include "GeolocationService.h"
 
-#include "Geoposition.h"
-#include "PositionError.h"
-#include "PositionOptions.h"
+#include <wtf/Assertions.h>
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/platform/GeolocationService.h b/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
index 90d52eb502..74a6eade47 100644
--- a/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
+++ b/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
@@ -38,21 +38,21 @@ class PositionOptions;
 class GeolocationServiceClient {
 public:
     virtual ~GeolocationServiceClient() { }
-    virtual void geolocationServicePositionChanged(GeolocationService*) { }
-    virtual void geolocationServiceErrorOccurred(GeolocationService*) { }
+    virtual void geolocationServicePositionChanged(GeolocationService*) = 0;
+    virtual void geolocationServiceErrorOccurred(GeolocationService*) = 0;
 };
 
 class GeolocationService : public Noncopyable {
 public:
     static GeolocationService* create(GeolocationServiceClient*);
-    virtual ~GeolocationService() {}
+    virtual ~GeolocationService() { }
     
     virtual bool startUpdating(PositionOptions*) { return false; }
-    virtual void stopUpdating() {}
+    virtual void stopUpdating() { }
     
     virtual void suspend() { }
     virtual void resume() { }
-    
+
     virtual Geoposition* lastPosition() const { return 0; }
     virtual PositionError* lastError() const { return 0; }
 
@@ -65,7 +65,7 @@ protected:
 private:
     GeolocationServiceClient* m_geolocationServiceClient;
 };
-    
+
 } // namespace WebCore
 
 #endif // GeolocationService_h
diff --git a/src/3rdparty/webkit/WebCore/platform/HostWindow.h b/src/3rdparty/webkit/WebCore/platform/HostWindow.h
index 7007ac5d06..3e982e1166 100644
--- a/src/3rdparty/webkit/WebCore/platform/HostWindow.h
+++ b/src/3rdparty/webkit/WebCore/platform/HostWindow.h
@@ -27,18 +27,13 @@
 #define HostWindow_h
 
 #include <wtf/Noncopyable.h>
-#include "IntRect.h"
 #include "Widget.h"
 
 namespace WebCore {
 
-class IntPoint;
-class IntRect;
-
 class HostWindow : Noncopyable {
 public:
-    HostWindow() {}
-    virtual ~HostWindow() {}
+    virtual ~HostWindow() { }
 
     // The repaint method asks the host window to repaint a rect in the window's coordinate space.  The
     // contentChanged boolean indicates whether or not the Web page content actually changed (or if a repaint
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.cpp b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
index c07e0f8b38..4b750467c1 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
@@ -243,6 +243,14 @@ static void copyASCII(const UChar* src, int length, char* dest)
         dest[i] = static_cast<char>(src[i]);
 }
 
+static void appendASCII(const String& base, const char* rel, size_t len, CharBuffer& buffer)
+{
+    buffer.resize(base.length() + len + 1);
+    copyASCII(base.characters(), base.length(), buffer.data());
+    memcpy(buffer.data() + base.length(), rel, len);
+    buffer[buffer.size() - 1] = '\0';
+}
+
 // FIXME: Move to PlatformString.h eventually.
 // Returns the index of the first index in string |s| of any of the characters
 // in |toFind|. |toFind| should be a null-terminated string, all characters up
@@ -259,6 +267,20 @@ static int findFirstOf(const UChar* s, int sLen, int startPos, const char* toFin
     return -1;
 }
 
+#ifndef NDEBUG
+static void checkEncodedString(const String& url)
+{
+    for (unsigned i = 0; i < url.length(); ++i)
+        ASSERT(!(url[i] & ~0x7F));
+
+    ASSERT(!url.length() || isSchemeFirstChar(url[0]));
+}
+#else
+static inline void checkEncodedString(const String&)
+{
+}
+#endif
+
 inline bool KURL::protocolIs(const String& string, const char* protocol)
 {
     return WebCore::protocolIs(string, protocol);
@@ -267,6 +289,7 @@ inline bool KURL::protocolIs(const String& string, const char* protocol)
 void KURL::invalidate()
 {
     m_isValid = false;
+    m_protocolInHTTPFamily = false;
     m_schemeEnd = 0;
     m_userStart = 0;
     m_userEnd = 0;
@@ -281,39 +304,14 @@ void KURL::invalidate()
 
 KURL::KURL(const char* url)
 {
-    if (!url || url[0] != '/') {
-        parse(url, 0);
-        return;
-    }
-
-    size_t urlLength = strlen(url) + 1;
-    CharBuffer buffer(urlLength + 5); // 5 for "file:".
-    buffer[0] = 'f';
-    buffer[1] = 'i';
-    buffer[2] = 'l';
-    buffer[3] = 'e';
-    buffer[4] = ':';
-    memcpy(&buffer[5], url, urlLength);
-    parse(buffer.data(), 0);
+    parse(url, 0);
+    ASSERT(url == m_string);
 }
 
 KURL::KURL(const String& url)
 {
-    if (url[0] != '/') {
-        parse(url);
-        return;
-    }
-
-    CharBuffer buffer(url.length() + 6); // 5 for "file:", 1 for terminator.
-    buffer[0] = 'f';
-    buffer[1] = 'i';
-    buffer[2] = 'l';
-    buffer[3] = 'e';
-    buffer[4] = ':';
-    copyASCII(url.characters(), url.length(), &buffer[5]);
-    buffer[url.length() + 5] = '\0'; // Need null terminator.
-
-    parse(buffer.data(), 0);
+    parse(url);
+    ASSERT(url == m_string);
 }
 
 KURL::KURL(const KURL& base, const String& relative)
@@ -343,7 +341,7 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
     // For compatibility with Win IE, treat backslashes as if they were slashes,
     // as long as we're not dealing with javascript: or data: URLs.
     String rel = relative;
-    if (rel.contains('\\') && !(protocolIs(rel, "javascript") || protocolIs(rel, "data")))
+    if (rel.contains('\\') && !(protocolIsJavaScript(rel) || protocolIs(rel, "data")))
         rel = substituteBackslashes(rel);
 
     String* originalString = &rel;
@@ -399,15 +397,18 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
         }
     }
 
+    CharBuffer parseBuffer;
+
     if (absolute) {
         parse(str, originalString);
     } else {
         // If the base is empty or opaque (e.g. data: or javascript:), then the URL is invalid
         // unless the relative URL is a single fragment.
         if (!base.isHierarchical()) {
-            if (str[0] == '#')
-                parse(base.m_string.left(base.m_queryEnd) + (allASCII ? String(str) : String::fromUTF8(str)));
-            else {
+            if (str[0] == '#') {
+                appendASCII(base.m_string.left(base.m_queryEnd), str, len, parseBuffer);
+                parse(parseBuffer.data(), 0);
+            } else {
                 m_string = relative;
                 invalidate();
             }
@@ -420,22 +421,28 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
             // reference to the same document
             *this = base;
             break;
-        case '#':
+        case '#': {
             // must be fragment-only reference
-            parse(base.m_string.left(base.m_queryEnd) + (allASCII ? String(str) : String::fromUTF8(str)));
+            appendASCII(base.m_string.left(base.m_queryEnd), str, len, parseBuffer);
+            parse(parseBuffer.data(), 0);
             break;
-        case '?':
+        }
+        case '?': {
             // query-only reference, special case needed for non-URL results
-            parse(base.m_string.left(base.m_pathEnd) + (allASCII ? String(str) : String::fromUTF8(str)));
+            appendASCII(base.m_string.left(base.m_pathEnd), str, len, parseBuffer);
+            parse(parseBuffer.data(), 0);
             break;
+        }
         case '/':
             // must be net-path or absolute-path reference
             if (str[1] == '/') {
                 // net-path
-                parse(base.m_string.left(base.m_schemeEnd + 1) + (allASCII ? String(str) : String::fromUTF8(str)));
+                appendASCII(base.m_string.left(base.m_schemeEnd + 1), str, len, parseBuffer);
+                parse(parseBuffer.data(), 0);
             } else {
                 // abs-path
-                parse(base.m_string.left(base.m_portEnd) + (allASCII ? String(str) : String::fromUTF8(str)));
+                appendASCII(base.m_string.left(base.m_portEnd), str, len, parseBuffer);
+                parse(parseBuffer.data(), 0);
             }
             break;
         default:
@@ -443,16 +450,15 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
                 // must be relative-path reference
 
                 // Base part plus relative part plus one possible slash added in between plus terminating \0 byte.
-                CharBuffer buffer(base.m_pathEnd + 1 + len + 1);
+                parseBuffer.resize(base.m_pathEnd + 1 + len + 1);
 
-                char* bufferPos = buffer.data();
+                char* bufferPos = parseBuffer.data();
 
                 // first copy everything before the path from the base
                 unsigned baseLength = base.m_string.length();
                 const UChar* baseCharacters = base.m_string.characters();
                 CharBuffer baseStringBuffer(baseLength);
-                for (unsigned i = 0; i < baseLength; ++i)
-                    baseStringBuffer[i] = static_cast<char>(baseCharacters[i]);
+                copyASCII(baseCharacters, baseLength, baseStringBuffer.data());
                 const char* baseString = baseStringBuffer.data();
                 const char* baseStringStart = baseString;
                 const char* pathStart = baseStringStart + base.m_portEnd;
@@ -511,9 +517,9 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
                 // of the relative reference; this will also add a null terminator
                 strcpy(bufferPos, relStringPos);
 
-                parse(buffer.data(), 0);
+                parse(parseBuffer.data(), 0);
 
-                ASSERT(strlen(buffer.data()) + 1 <= buffer.size());
+                ASSERT(strlen(parseBuffer.data()) + 1 <= parseBuffer.size());
                 break;
             }
         }
@@ -597,23 +603,42 @@ bool KURL::hasRef() const
     return m_fragmentEnd != m_queryEnd;
 }
 
-static inline void assertProtocolIsGood(const char* protocol)
+String KURL::baseAsString() const
+{
+    return m_string.left(m_pathAfterLastSlash);
+}
+
+#ifdef NDEBUG
+
+static inline void assertProtocolIsGood(const char*)
+{
+}
+
+#else
+
+static void assertProtocolIsGood(const char* protocol)
 {
-#ifndef NDEBUG
     const char* p = protocol;
     while (*p) {
         ASSERT(*p > ' ' && *p < 0x7F && !(*p >= 'A' && *p <= 'Z'));
         ++p;
     }
-#endif
 }
 
+#endif
+
 bool KURL::protocolIs(const char* protocol) const
 {
-    // Do the comparison without making a new string object.
     assertProtocolIsGood(protocol);
+
+    // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
+    // The free function protocolIsJavaScript() should be used instead. 
+    ASSERT(strcmp(protocol, "javascript") != 0);
+
     if (!m_isValid)
         return false;
+
+    // Do the comparison without making a new string object.
     for (int i = 0; i < m_schemeEnd; ++i) {
         if (!protocol[i] || toASCIILower(m_string[i]) != protocol[i])
             return false;
@@ -623,7 +648,10 @@ bool KURL::protocolIs(const char* protocol) const
 
 String KURL::query() const
 {
-    return m_string.substring(m_pathEnd, m_queryEnd - m_pathEnd); 
+    if (m_queryEnd == m_pathEnd)
+        return String();
+
+    return m_string.substring(m_pathEnd + 1, m_queryEnd - (m_pathEnd + 1)); 
 }
 
 String KURL::path() const
@@ -633,6 +661,9 @@ String KURL::path() const
 
 void KURL::setProtocol(const String& s)
 {
+    // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations,
+    // and to avoid changing more than just the protocol.
+
     if (!m_isValid) {
         parse(s + ":" + m_string);
         return;
@@ -646,6 +677,9 @@ void KURL::setHost(const String& s)
     if (!m_isValid)
         return;
 
+    // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations,
+    // and to avoid changing more than just the host.
+
     bool slashSlashNeeded = m_userStart == m_schemeEnd + 1;
 
     parse(m_string.left(hostStart()) + (slashSlashNeeded ? "//" : "") + s + m_string.substring(m_hostEnd));
@@ -656,10 +690,13 @@ void KURL::setPort(unsigned short i)
     if (!m_isValid)
         return;
 
-    bool colonNeeded = m_portEnd == m_hostEnd;
-    int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
+    if (i) {
+        bool colonNeeded = m_portEnd == m_hostEnd;
+        int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
 
-    parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
+        parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
+    } else
+        parse(m_string.left(m_hostEnd) + m_string.substring(m_portEnd));
 }
 
 void KURL::setHostAndPort(const String& hostAndPort)
@@ -667,6 +704,9 @@ void KURL::setHostAndPort(const String& hostAndPort)
     if (!m_isValid)
         return;
 
+    // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations,
+    // and to avoid changing more than just host and port.
+
     bool slashSlashNeeded = m_userStart == m_schemeEnd + 1;
 
     parse(m_string.left(hostStart()) + (slashSlashNeeded ? "//" : "") + hostAndPort + m_string.substring(m_portEnd));
@@ -677,6 +717,8 @@ void KURL::setUser(const String& user)
     if (!m_isValid)
         return;
 
+    // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations,
+    // and to avoid changing more than just the user login.
     String u;
     int end = m_userEnd;
     if (!user.isEmpty()) {
@@ -699,6 +741,8 @@ void KURL::setPass(const String& password)
     if (!m_isValid)
         return;
 
+    // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations,
+    // and to avoid changing more than just the user password.
     String p;
     int end = m_passwordEnd;
     if (!password.isEmpty()) {
@@ -720,6 +764,8 @@ void KURL::setRef(const String& s)
 {
     if (!m_isValid)
         return;
+
+    // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations.
     parse(m_string.left(m_queryEnd) + (s.isNull() ? "" : "#" + s));
 }
 
@@ -735,6 +781,9 @@ void KURL::setQuery(const String& query)
     if (!m_isValid)
         return;
 
+    // FIXME: '#' and non-ASCII characters must be encoded and escaped.
+    // Usually, the query is encoded using document encoding, not UTF-8, but we don't have
+    // access to the document in this function.
     if ((query.isEmpty() || query[0] != '?') && !query.isNull())
         parse(m_string.left(m_pathEnd) + "?" + query + m_string.substring(m_queryEnd));
     else
@@ -747,6 +796,8 @@ void KURL::setPath(const String& s)
     if (!m_isValid)
         return;
 
+    // FIXME: encodeWithURLEscapeSequences does not correctly escape '#' and '?', so fragment and query parts
+    // may be inadvertently affected.
     parse(m_string.left(m_portEnd) + encodeWithURLEscapeSequences(s) + m_string.substring(m_pathEnd));
 }
 
@@ -784,7 +835,11 @@ String KURL::prettyURL() const
     }
 
     append(result, path());
-    append(result, query());
+
+    if (m_pathEnd != m_queryEnd) {
+        result.append('?');
+        append(result, query());
+    }
 
     if (m_fragmentEnd != m_queryEnd) {
         result.append('#');
@@ -958,8 +1013,11 @@ static inline bool matchLetter(char c, char lowercaseLetter)
 
 void KURL::parse(const String& string)
 {
-    CharBuffer buffer;
-    encodeRelativeString(string, UTF8Encoding(), buffer);
+    checkEncodedString(string);
+
+    CharBuffer buffer(string.length() + 1);
+    copyASCII(string.characters(), string.length(), buffer.data());
+    buffer[string.length()] = '\0';
     parse(buffer.data(), &string);
 }
 
@@ -1006,7 +1064,7 @@ void KURL::parse(const char* url, const String* originalString)
         && matchLetter(url[2], 'l')
         && matchLetter(url[3], 'e');
 
-    bool isHTTPorHTTPS = matchLetter(url[0], 'h')
+    m_protocolInHTTPFamily = matchLetter(url[0], 'h')
         && matchLetter(url[1], 't')
         && matchLetter(url[2], 't')
         && matchLetter(url[3], 'p')
@@ -1088,7 +1146,7 @@ void KURL::parse(const char* url, const String* originalString)
             return;
         }
 
-        if (userStart == portEnd && !isHTTPorHTTPS && !isFile) {
+        if (userStart == portEnd && !m_protocolInHTTPFamily && !isFile) {
             // No authority found, which means that this is not a net_path, but rather an abs_path whose first two
             // path segments are empty. For file, http and https only, an empty authority is allowed.
             userStart -= 2;
@@ -1212,7 +1270,7 @@ void KURL::parse(const char* url, const String* originalString)
 
     // For canonicalization, ensure we have a '/' for no path.
     // Only do this for http and https.
-    if (isHTTPorHTTPS && pathEnd - pathStart == 0)
+    if (m_protocolInHTTPFamily && pathEnd - pathStart == 0)
         *p++ = '/';
 
     // add path, escaping bad characters
@@ -1250,7 +1308,7 @@ void KURL::parse(const char* url, const String* originalString)
 
     // If we didn't end up actually changing the original string and
     // it was already in a String, reuse it to avoid extra allocation.
-    if (originalString && strncmp(buffer.data(), url, m_fragmentEnd) == 0)
+    if (originalString && originalString->length() == static_cast<unsigned>(m_fragmentEnd) && strncmp(buffer.data(), url, m_fragmentEnd) == 0)
         m_string = *originalString;
     else
         m_string = String(buffer.data(), m_fragmentEnd);
@@ -1495,7 +1553,7 @@ static void encodeRelativeString(const String& rel, const TextEncoding& encoding
     TextEncoding pathEncoding(UTF8Encoding()); // Path is always encoded as UTF-8; other parts may depend on the scheme.
 
     int pathEnd = -1;
-    if (encoding != pathEncoding && encoding.isValid() && !protocolIs(rel, "mailto") && !protocolIs(rel, "data") && !protocolIs(rel, "javascript")) {
+    if (encoding != pathEncoding && encoding.isValid() && !protocolIs(rel, "mailto") && !protocolIs(rel, "data") && !protocolIsJavaScript(rel)) {
         // Find the first instance of either # or ?, keep pathEnd at -1 otherwise.
         pathEnd = findFirstOf(s.data(), s.size(), 0, "#?");
     }
@@ -1561,6 +1619,11 @@ bool protocolIs(const String& url, const char* protocol)
     }
 }
 
+bool protocolIsJavaScript(const String& url)
+{
+    return protocolIs(url, "javascript");
+}
+
 String mimeTypeFromDataURL(const String& url)
 {
     ASSERT(protocolIs(url, "data"));
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.h b/src/3rdparty/webkit/WebCore/platform/KURL.h
index 5378e059fd..e419d166f8 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.h
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.h
@@ -47,7 +47,7 @@ QT_END_NAMESPACE
 #endif
 
 #if USE(GOOGLEURL)
-#include "GoogleURLPrivate.h"
+#include "KURLGooglePrivate.h"
 #endif
 
 namespace WebCore {
@@ -66,19 +66,8 @@ public:
     KURL() { invalidate(); }
 
     // The argument is an absolute URL string. The string is assumed to be
-    // already encoded.
-    // FIXME: This constructor has a special case for strings that start with
-    // "/", prepending "file://" to such strings; it would be good to get
-    // rid of that special case.
+    // an already encoded (ASCII-only) valid absolute URL.
     explicit KURL(const char*);
-
-    // The argument is an absolute URL string. The string is assumed to be
-    // already encoded.
-    // FIXME: For characters with codes other than 0000-00FF will be chopped
-    // off, so this call is currently not safe to use with arbitrary strings.
-    // FIXME: This constructor has a special case for strings that start with
-    // "/", prepending "file://" to such strings; it would be good to get
-    // rid of that special case.
     explicit KURL(const String&);
 
     // Resolves the relative URL with the given base URL. If provided, the
@@ -95,7 +84,7 @@ public:
     // For conversions for other structures that have already parsed and
     // canonicalized the URL. The input must be exactly what KURL would have
     // done with the same input.
-    KURL(const char* canonicalSpec, int canonicalSpecLen,
+    KURL(const CString& canonicalSpec,
          const url_parse::Parsed& parsed, bool isValid);
 #endif
 
@@ -130,16 +119,19 @@ public:
     String pass() const;
     String path() const;
     String lastPathComponent() const;
-    String query() const; // Includes the "?".
-    String ref() const; // Does *not* include the "#".
+    String query() const;
+    String ref() const;
     bool hasRef() const;
 
+    String baseAsString() const;
+
     String prettyURL() const;
     String fileSystemPath() const;
 
     // Returns true if the current URL's protocol is the same as the null-
     // terminated ASCII argument. The argument must be lower-case.
     bool protocolIs(const char*) const;
+    bool protocolInHTTPFamily() const;
     bool isLocalFile() const;
 
     void setProtocol(const String&);
@@ -214,10 +206,10 @@ private:
     bool isHierarchical() const;
     static bool protocolIs(const String&, const char*);
 #if USE(GOOGLEURL)
-    friend class GoogleURLPrivate;
+    friend class KURLGooglePrivate;
     void parse(const char* url, const String* originalString);  // KURLMac calls this.
     void copyToBuffer(Vector<char, 512>& buffer) const;  // KURLCFNet uses this.
-    GoogleURLPrivate m_url;
+    KURLGooglePrivate m_url;
 #else  // !USE(GOOGLEURL)
     void init(const KURL&, const String&, const TextEncoding&);
     void copyToBuffer(Vector<char, 512>& buffer) const;
@@ -229,7 +221,9 @@ private:
     void parse(const char* url, const String* originalString);
 
     String m_string;
-    bool m_isValid;
+    bool m_isValid : 1;
+    bool m_protocolInHTTPFamily : 1;
+
     int m_schemeEnd;
     int m_userStart;
     int m_userEnd;
@@ -257,8 +251,11 @@ const KURL& blankURL();
 
 // Functions to do URL operations on strings.
 // These are operations that aren't faster on a parsed URL.
+// These are also different from the KURL functions in that they don't require the string to be a valid and parsable URL.
+// This is especially important because valid javascript URLs are not necessarily considered valid by KURL.
 
 bool protocolIs(const String& url, const char* protocol);
+bool protocolIsJavaScript(const String& url);
 
 String mimeTypeFromDataURL(const String& url);
 
@@ -322,6 +319,11 @@ inline bool KURL::isValid() const
     return m_isValid;
 }
 
+inline bool KURL::protocolInHTTPFamily() const
+{
+    return m_protocolInHTTPFamily;
+}
+
 inline unsigned KURL::hostStart() const
 {
     return (m_passwordEnd == m_userStart) ? m_passwordEnd : m_passwordEnd + 1;
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
new file mode 100644
index 0000000000..d8b87e55ff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
@@ -0,0 +1,962 @@
+/*
+ * Copyright (C) 2004, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(GOOGLEURL)
+#include "KURL.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+#include "CString.h"
+#include "NotImplemented.h"
+#include "TextEncoding.h"
+#include <wtf/Vector.h>
+
+#include <googleurl/src/url_canon_internal.h>
+#include <googleurl/src/url_util.h>
+
+using WTF::isASCIILower;
+using WTF::toASCIILower;
+
+namespace WebCore {
+
+// Wraps WebCore's text encoding in a character set converter for the
+// canonicalizer.
+class KURLCharsetConverter : public url_canon::CharsetConverter {
+public:
+    // The encoding parameter may be NULL, but in this case the object must not
+    // be called.
+    KURLCharsetConverter(const TextEncoding* encoding)
+        : m_encoding(encoding)
+    {
+    }
+
+    virtual void ConvertFromUTF16(const url_parse::UTF16Char* input, int inputLength,
+                                  url_canon::CanonOutput* output)
+    {
+        CString encoded = m_encoding->encode(input, inputLength, URLEncodedEntitiesForUnencodables);
+        output->Append(encoded.data(), static_cast<int>(encoded.length()));
+    }
+
+private:
+    const TextEncoding* m_encoding;
+};
+
+// Note that this function must be named differently than the one in KURL.cpp
+// since our unit tests evilly include both files, and their local definition
+// will be ambiguous.
+static inline void assertProtocolIsGood(const char* protocol)
+{
+#ifndef NDEBUG
+    const char* p = protocol;
+    while (*p) {
+        ASSERT(*p > ' ' && *p < 0x7F && !(*p >= 'A' && *p <= 'Z'));
+        ++p;
+    }
+#endif
+}
+
+// Returns the characters for the given string, or a pointer to a static empty
+// string if the input string is NULL. This will always ensure we have a non-
+// NULL character pointer since ReplaceComponents has special meaning for NULL.
+static inline const url_parse::UTF16Char* CharactersOrEmpty(const String& str)
+{
+    static const url_parse::UTF16Char zero = 0;
+    return str.characters() ?
+           reinterpret_cast<const url_parse::UTF16Char*>(str.characters()) :
+           &zero;
+}
+
+static inline bool isUnicodeEncoding(const TextEncoding* encoding)
+{
+    return encoding->encodingForFormSubmission() == UTF8Encoding();
+}
+
+static bool lowerCaseEqualsASCII(const char* begin, const char* end, const char* str)
+{
+    while (begin != end && *str) {
+        ASSERT(isASCIILower(*str));
+        if (toASCIILower(*begin++) != *str++)
+            return false;
+    }
+
+    // Both strings are equal (ignoring case) if and only if all of the characters were equal,
+    // and the end of both has been reached.
+    return begin == end && !*str;
+}
+
+
+// KURLGooglePrivate -----------------------------------------------------------
+
+KURLGooglePrivate::KURLGooglePrivate()
+    : m_isValid(false)
+    , m_protocolInHTTPFamily(false)
+    , m_utf8IsASCII(true)
+    , m_stringIsValid(false)
+{
+}
+
+KURLGooglePrivate::KURLGooglePrivate(const url_parse::Parsed& parsed, bool isValid)
+    : m_isValid(isValid)
+    , m_protocolInHTTPFamily(false)
+    , m_parsed(parsed)
+    , m_utf8IsASCII(true)
+    , m_stringIsValid(false)
+{
+}
+
+// Setters for the data. Using the ASCII version when you know the
+// data is ASCII will be slightly more efficient. The UTF-8 version
+// will always be correct if the caller is unsure.
+void KURLGooglePrivate::setUtf8(const CString& str)
+{
+    const char* data = str.data();
+    unsigned dataLength = str.length();
+
+    // The m_utf8IsASCII must always be correct since the DeprecatedString
+    // getter must create it with the proper constructor. This test can be
+    // removed when DeprecatedString is gone, but it still might be a
+    // performance win.
+    m_utf8IsASCII = true;
+    for (unsigned i = 0; i < dataLength; i++) {
+        if (static_cast<unsigned char>(data[i]) >= 0x80) {
+            m_utf8IsASCII = false;
+            break;
+        }
+    }
+
+    m_utf8 = str;
+    m_stringIsValid = false;
+    initProtocolInHTTPFamily();
+}
+
+void KURLGooglePrivate::setAscii(const CString& str)
+{
+    m_utf8 = str;
+    m_utf8IsASCII = true;
+    m_stringIsValid = false;
+    initProtocolInHTTPFamily();
+}
+
+void KURLGooglePrivate::init(const KURL& base,
+                             const String& relative,
+                             const TextEncoding* queryEncoding)
+{
+    init(base, relative.characters(), relative.length(), queryEncoding);
+}
+
+// Note: code mostly duplicated below.
+void KURLGooglePrivate::init(const KURL& base, const char* rel, int relLength,
+                             const TextEncoding* queryEncoding)
+{
+    // As a performance optimization, we do not use the charset converter if
+    // encoding is UTF-8 or other Unicode encodings. Note that this is
+    // per HTML5 2.5.3 (resolving URL). The URL canonicalizer will be
+    // more efficient with no charset converter object because it
+    // can do UTF-8 internally with no extra copies.
+
+    // We feel free to make the charset converter object every time since it's
+    // just a wrapper around a reference.
+    KURLCharsetConverter charsetConverterObject(queryEncoding);
+    KURLCharsetConverter* charsetConverter =
+        (!queryEncoding || isUnicodeEncoding(queryEncoding)) ? 0 :
+        &charsetConverterObject;
+
+    url_canon::RawCanonOutputT<char> output;
+    const CString& baseStr = base.m_url.utf8String();
+    m_isValid = url_util::ResolveRelative(baseStr.data(), baseStr.length(),
+                                          base.m_url.m_parsed, rel, relLength,
+                                          charsetConverter,
+                                          &output, &m_parsed);
+
+    // See FIXME in KURLGooglePrivate in the header. If canonicalization has not
+    // changed the string, we can avoid an extra allocation by using assignment.
+    //
+    // When KURL encounters an error such that the URL is invalid and empty
+    // (for example, resolving a relative URL on a non-hierarchical base), it
+    // will produce an isNull URL, and calling setUtf8 will produce an empty
+    // non-null URL. This is unlikely to affect anything, but we preserve this
+    // just in case.
+    if (m_isValid || output.length()) {
+        // Without ref, the whole url is guaranteed to be ASCII-only.
+        if (m_parsed.ref.is_nonempty())
+            setUtf8(CString(output.data(), output.length()));
+        else
+            setAscii(CString(output.data(), output.length()));
+    } else {
+        // WebCore expects resolved URLs to be empty rather than NULL.
+        setUtf8(CString("", 0));
+    }
+}
+
+// Note: code mostly duplicated above. See FIXMEs and comments there.
+void KURLGooglePrivate::init(const KURL& base, const UChar* rel, int relLength,
+                             const TextEncoding* queryEncoding)
+{
+    KURLCharsetConverter charsetConverterObject(queryEncoding);
+    KURLCharsetConverter* charsetConverter =
+        (!queryEncoding || isUnicodeEncoding(queryEncoding)) ? 0 :
+        &charsetConverterObject;
+
+    url_canon::RawCanonOutputT<char> output;
+    const CString& baseStr = base.m_url.utf8String();
+    m_isValid = url_util::ResolveRelative(baseStr.data(), baseStr.length(),
+                                          base.m_url.m_parsed, rel, relLength,
+                                          charsetConverter,
+                                          &output, &m_parsed);
+
+
+    if (m_isValid || output.length()) {
+        if (m_parsed.ref.is_nonempty())
+            setUtf8(CString(output.data(), output.length()));
+        else
+            setAscii(CString(output.data(), output.length()));
+    } else
+        setUtf8(CString("", 0));
+}
+
+void KURLGooglePrivate::initProtocolInHTTPFamily()
+{
+    if (!m_isValid) {
+        m_protocolInHTTPFamily = false;
+        return;
+    }
+
+    const char* scheme = m_utf8.data() + m_parsed.scheme.begin;
+    if (m_parsed.scheme.len == 4)
+        m_protocolInHTTPFamily = lowerCaseEqualsASCII(scheme, scheme + 4, "http");
+    else if (m_parsed.scheme.len == 5)
+        m_protocolInHTTPFamily = lowerCaseEqualsASCII(scheme, scheme + 5, "https");
+    else
+        m_protocolInHTTPFamily = false;
+}
+
+void KURLGooglePrivate::copyTo(KURLGooglePrivate* dest) const
+{
+    dest->m_isValid = m_isValid;
+    dest->m_protocolInHTTPFamily = m_protocolInHTTPFamily;
+    dest->m_parsed = m_parsed;
+
+    // Don't copy the 16-bit string since that will be regenerated as needed.
+    dest->m_utf8 = CString(m_utf8.data(), m_utf8.length());
+    dest->m_utf8IsASCII = m_utf8IsASCII;
+    dest->m_stringIsValid = false;
+}
+
+String KURLGooglePrivate::componentString(const url_parse::Component& comp) const
+{
+    if (!m_isValid || comp.len <= 0) {
+        // KURL returns a NULL string if the URL is itself a NULL string, and an
+        // empty string for other nonexistant entities.
+        if (utf8String().isNull())
+            return String();
+        return String("", 0);
+    }
+    // begin and len are in terms of bytes which do not match
+    // if string() is UTF-16 and input contains non-ASCII characters.
+    // However, the only part in urlString that can contain non-ASCII
+    // characters is 'ref' at the end of the string. In that case,
+    // begin will always match the actual value and len (in terms of
+    // byte) will be longer than what's needed by 'mid'. However, mid
+    // truncates len to avoid go past the end of a string so that we can
+    // get away withtout doing anything here.
+    return string().substring(comp.begin, comp.len);
+}
+
+void KURLGooglePrivate::replaceComponents(const Replacements& replacements)
+{
+    url_canon::RawCanonOutputT<char> output;
+    url_parse::Parsed newParsed;
+
+    m_isValid = url_util::ReplaceComponents(utf8String().data(),
+                                            utf8String().length(), m_parsed, replacements, 0, &output, &newParsed);
+
+    m_parsed = newParsed;
+    if (m_parsed.ref.is_nonempty())
+        setUtf8(CString(output.data(), output.length()));
+    else
+        setAscii(CString(output.data(), output.length()));
+}
+
+const String& KURLGooglePrivate::string() const
+{
+    if (!m_stringIsValid) {
+        // Must special case the NULL case, since constructing the
+        // string like we do below will generate an empty rather than
+        // a NULL string.
+        if (m_utf8.isNull())
+            m_string = String();
+        else if (m_utf8IsASCII)
+            m_string = String(m_utf8.data(), m_utf8.length());
+        else
+            m_string = String::fromUTF8(m_utf8.data(), m_utf8.length());
+        m_stringIsValid = true;
+    }
+    return m_string;
+}
+
+// KURL ------------------------------------------------------------------------
+
+// Creates with NULL-terminated string input representing an absolute URL.
+// WebCore generally calls this only with hardcoded strings, so the input is
+// ASCII. We treat is as UTF-8 just in case.
+KURL::KURL(const char *url)
+{
+    // FIXME The Mac code checks for beginning with a slash and converting to a
+    // file: URL. We will want to add this as well once we can compile on a
+    // system like that.
+    m_url.init(KURL(), url, strlen(url), 0);
+
+    // The one-argument constructors should never generate a NULL string.
+    // This is a funny quirk of KURL.cpp (probably a bug) which we preserve.
+    if (m_url.utf8String().isNull())
+        m_url.setAscii(CString("", 0));
+}
+
+// Initializes with a string representing an absolute URL. No encoding
+// information is specified. This generally happens when a KURL is converted
+// to a string and then converted back. In this case, the URL is already
+// canonical and in proper escaped form so needs no encoding. We treat it was
+// UTF-8 just in case.
+KURL::KURL(const String& url)
+{
+    if (!url.isNull())
+        m_url.init(KURL(), url, 0);
+    else {
+        // WebCore expects us to preserve the nullness of strings when this
+        // constructor is used. In all other cases, it expects a non-null
+        // empty string, which is what init() will create.
+        m_url.m_isValid = false;
+        m_url.m_protocolInHTTPFamily = false;
+    }
+}
+
+// Constructs a new URL given a base URL and a possibly relative input URL.
+// This assumes UTF-8 encoding.
+KURL::KURL(const KURL& base, const String& relative)
+{
+    m_url.init(base, relative, 0);
+}
+
+// Constructs a new URL given a base URL and a possibly relative input URL.
+// Any query portion of the relative URL will be encoded in the given encoding.
+KURL::KURL(const KURL& base,
+           const String& relative,
+           const TextEncoding& encoding)
+{
+    m_url.init(base, relative, &encoding.encodingForFormSubmission());
+}
+
+KURL::KURL(const CString& canonicalSpec,
+           const url_parse::Parsed& parsed, bool isValid)
+    : m_url(parsed, isValid)
+{
+    // We know the reference fragment is the only part that can be UTF-8, so
+    // we know it's ASCII when there is no ref.
+    if (parsed.ref.is_nonempty())
+        m_url.setUtf8(canonicalSpec);
+    else
+        m_url.setAscii(canonicalSpec);
+}
+
+#if PLATFORM(CF)
+KURL::KURL(CFURLRef)
+{
+    notImplemented();
+    invalidate();
+}
+
+CFURLRef KURL::createCFURL() const
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
+KURL KURL::copy() const
+{
+    KURL result = *this;
+    m_url.copyTo(&result.m_url);
+    return result;
+}
+
+bool KURL::isNull() const
+{
+    return m_url.utf8String().isNull();
+}
+
+bool KURL::isEmpty() const
+{
+    return !m_url.utf8String().length();
+}
+
+bool KURL::isValid() const
+{
+    return m_url.m_isValid;
+}
+
+bool KURL::protocolInHTTPFamily() const
+{
+    return m_url.m_protocolInHTTPFamily;
+}
+
+bool KURL::hasPath() const
+{
+    // Note that http://www.google.com/" has a path, the path is "/". This can
+    // return false only for invalid or nonstandard URLs.
+    return m_url.m_parsed.path.len >= 0;
+}
+
+// We handle "parameters" separated by a semicolon, while KURL.cpp does not,
+// which can lead to different results in some cases.
+String KURL::lastPathComponent() const
+{
+    // When the output ends in a slash, WebCore has different expectations than
+    // the GoogleURL library. For "/foo/bar/" the library will return the empty
+    // string, but WebCore wants "bar".
+    url_parse::Component path = m_url.m_parsed.path;
+    if (path.len > 0 && m_url.utf8String().data()[path.end() - 1] == '/')
+        path.len--;
+
+    url_parse::Component file;
+    url_parse::ExtractFileName(m_url.utf8String().data(), path, &file);
+
+    // Bug: https://bugs.webkit.org/show_bug.cgi?id=21015 this function returns
+    // a null string when the path is empty, which we duplicate here.
+    if (!file.is_nonempty())
+        return String();
+    return m_url.componentString(file);
+}
+
+String KURL::protocol() const
+{
+    return m_url.componentString(m_url.m_parsed.scheme);
+}
+
+String KURL::host() const
+{
+    // Note: KURL.cpp unescapes here.
+    return m_url.componentString(m_url.m_parsed.host);
+}
+
+// Returns 0 when there is no port or it is invalid.
+//
+// We treat URL's with out-of-range port numbers as invalid URLs, and they will
+// be rejected by the canonicalizer. KURL.cpp will allow them in parsing, but
+// return 0 from this port() function, so we mirror that behavior here.
+unsigned short KURL::port() const
+{
+    if (!m_url.m_isValid || m_url.m_parsed.port.len <= 0)
+        return 0;
+    int port = url_parse::ParsePort(m_url.utf8String().data(), m_url.m_parsed.port);
+    if (port == url_parse::PORT_UNSPECIFIED)
+        return 0;
+    return static_cast<unsigned short>(port);
+}
+
+// Returns the empty string if there is no password.
+String KURL::pass() const
+{
+    // Bug: https://bugs.webkit.org/show_bug.cgi?id=21015 this function returns
+    // a null string when the password is empty, which we duplicate here.
+    if (!m_url.m_parsed.password.is_nonempty())
+        return String();
+
+    // Note: KURL.cpp unescapes here.
+    return m_url.componentString(m_url.m_parsed.password);
+}
+
+// Returns the empty string if there is no username.
+String KURL::user() const
+{
+    // Note: KURL.cpp unescapes here.
+    return m_url.componentString(m_url.m_parsed.username);
+}
+
+String KURL::ref() const
+{
+    // Empty but present refs ("foo.com/bar#") should result in the empty
+    // string, which m_url.componentString will produce. Nonexistant refs should be
+    // the NULL string.
+    if (!m_url.m_parsed.ref.is_valid())
+        return String();
+
+    // Note: KURL.cpp unescapes here.
+    return m_url.componentString(m_url.m_parsed.ref);
+}
+
+bool KURL::hasRef() const
+{
+    // Note: KURL.cpp unescapes here.
+    // FIXME determine if KURL.cpp agrees about an empty ref
+    return m_url.m_parsed.ref.len >= 0;
+}
+
+String KURL::baseAsString() const
+{
+    // FIXME: There is probably a more efficient way to do this?
+    return string().left(pathAfterLastSlash());
+}
+
+String KURL::query() const
+{
+    if (m_url.m_parsed.query.len >= 0)
+        return m_url.componentString(m_url.m_parsed.query);
+
+    // Bug: https://bugs.webkit.org/show_bug.cgi?id=21015 this function returns
+    // an empty string when the query is empty rather than a null (not sure
+    // which is right).
+    return String("", 0);
+}
+
+String KURL::path() const
+{
+    // Note: KURL.cpp unescapes here.
+    return m_url.componentString(m_url.m_parsed.path);
+}
+
+void KURL::setProtocol(const String& protocol)
+{
+    KURLGooglePrivate::Replacements replacements;
+    replacements.SetScheme(CharactersOrEmpty(protocol),
+                           url_parse::Component(0, protocol.length()));
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::setHost(const String& host)
+{
+    KURLGooglePrivate::Replacements replacements;
+    replacements.SetHost(CharactersOrEmpty(host),
+                         url_parse::Component(0, host.length()));
+    m_url.replaceComponents(replacements);
+}
+
+// This function is used only in the JSC build.
+void KURL::setHostAndPort(const String& s)
+{
+    String newhost = s.left(s.find(":"));
+    String newport = s.substring(s.find(":") + 1);
+
+    KURLGooglePrivate::Replacements replacements;
+    // Host can't be removed, so we always set.
+    replacements.SetHost(CharactersOrEmpty(newhost),
+                         url_parse::Component(0, newhost.length()));
+
+    if (newport.isEmpty())  // Port may be removed, so we support clearing.
+        replacements.ClearPort();
+    else
+        replacements.SetPort(CharactersOrEmpty(newport), url_parse::Component(0, newport.length()));
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::setPort(unsigned short i)
+{
+    KURLGooglePrivate::Replacements replacements;
+    String portStr;
+    if (i) {
+        portStr = String::number(static_cast<int>(i));
+        replacements.SetPort(
+            reinterpret_cast<const url_parse::UTF16Char*>(portStr.characters()),
+            url_parse::Component(0, portStr.length()));
+
+    } else {
+        // Clear any existing port when it is set to 0.
+        replacements.ClearPort();
+    }
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::setUser(const String& user)
+{
+    // This function is commonly called to clear the username, which we
+    // normally don't have, so we optimize this case.
+    if (user.isEmpty() && !m_url.m_parsed.username.is_valid())
+        return;
+
+    // The canonicalizer will clear any usernames that are empty, so we
+    // don't have to explicitly call ClearUsername() here.
+    KURLGooglePrivate::Replacements replacements;
+    replacements.SetUsername(CharactersOrEmpty(user),
+                             url_parse::Component(0, user.length()));
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::setPass(const String& pass)
+{
+    // This function is commonly called to clear the password, which we
+    // normally don't have, so we optimize this case.
+    if (pass.isEmpty() && !m_url.m_parsed.password.is_valid())
+        return;
+
+    // The canonicalizer will clear any passwords that are empty, so we
+    // don't have to explicitly call ClearUsername() here.
+    KURLGooglePrivate::Replacements replacements;
+    replacements.SetPassword(CharactersOrEmpty(pass),
+                             url_parse::Component(0, pass.length()));
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::setRef(const String& ref)
+{
+    // This function is commonly called to clear the ref, which we
+    // normally don't have, so we optimize this case.
+    if (ref.isNull() && !m_url.m_parsed.ref.is_valid())
+        return;
+
+    KURLGooglePrivate::Replacements replacements;
+    if (ref.isNull())
+        replacements.ClearRef();
+    else
+        replacements.SetRef(CharactersOrEmpty(ref), url_parse::Component(0, ref.length()));
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::removeRef()
+{
+    KURLGooglePrivate::Replacements replacements;
+    replacements.ClearRef();
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::setQuery(const String& query)
+{
+    KURLGooglePrivate::Replacements replacements;
+    if (query.isNull()) {
+        // KURL.cpp sets to NULL to clear any query.
+        replacements.ClearQuery();
+    } else if (query.length() > 0 && query[0] == '?') {
+        // WebCore expects the query string to begin with a question mark, but
+        // GoogleURL doesn't. So we trim off the question mark when setting.
+        replacements.SetQuery(CharactersOrEmpty(query),
+                              url_parse::Component(1, query.length() - 1));
+    } else {
+        // When set with the empty string or something that doesn't begin with
+        // a question mark, KURL.cpp will add a question mark for you. The only
+        // way this isn't compatible is if you call this function with an empty
+        // string. KURL.cpp will leave a '?' with nothing following it in the
+        // URL, whereas we'll clear it.
+        // FIXME We should eliminate this difference.
+        replacements.SetQuery(CharactersOrEmpty(query),
+                              url_parse::Component(0, query.length()));
+    }
+    m_url.replaceComponents(replacements);
+}
+
+void KURL::setPath(const String& path)
+{
+    // Empty paths will be canonicalized to "/", so we don't have to worry
+    // about calling ClearPath().
+    KURLGooglePrivate::Replacements replacements;
+    replacements.SetPath(CharactersOrEmpty(path),
+                         url_parse::Component(0, path.length()));
+    m_url.replaceComponents(replacements);
+}
+
+// On Mac, this just seems to return the same URL, but with "/foo/bar" for
+// file: URLs instead of file:///foo/bar. We don't bother with any of this,
+// at least for now.
+String KURL::prettyURL() const
+{
+    if (!m_url.m_isValid)
+        return String();
+    return m_url.string();
+}
+
+bool protocolIsJavaScript(const String& url)
+{
+    return protocolIs(url, "javascript");
+}
+
+// We copied the KURL version here on Sept 12, 2008 while doing a WebKit
+// merge.
+// 
+// FIXME Somehow share this with KURL? Like we'd theoretically merge with
+// decodeURLEscapeSequences below?
+String mimeTypeFromDataURL(const String& url)
+{
+    ASSERT(protocolIs(url, "data"));
+    int index = url.find(';');
+    if (index == -1)
+        index = url.find(',');
+    if (index != -1) {
+        int len = index - 5;
+        if (len > 0)
+            return url.substring(5, len);
+        return "text/plain"; // Data URLs with no MIME type are considered text/plain.
+    }
+    return "";
+}
+
+String decodeURLEscapeSequences(const String& str)
+{
+    return decodeURLEscapeSequences(str, UTF8Encoding());
+}
+
+// In KURL.cpp's implementation, this is called by every component getter.
+// It will unescape every character, including NULL. This is scary, and may
+// cause security holes. We never call this function for components, and
+// just return the ASCII versions instead.
+//
+// However, this static function is called directly in some cases. It appears
+// that this only happens for javascript: URLs, so this is essentially the
+// JavaScript URL decoder. It assumes UTF-8 encoding.
+//
+// IE doesn't unescape %00, forcing you to use \x00 in JS strings, so we do
+// the same. This also eliminates NULL-related problems should a consumer
+// incorrectly call this function for non-JavaScript.
+//
+// FIXME These should be merged to the KURL.cpp implementation.
+String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
+{
+    // FIXME We can probably use KURL.cpp's version of this function
+    // without modification. However, I'm concerned about
+    // https://bugs.webkit.org/show_bug.cgi?id=20559 so am keeping this old
+    // custom code for now. Using their version will also fix the bug that
+    // we ignore the encoding.
+    //
+    // FIXME b/1350291: This does not get called very often. We just convert
+    // first to 8-bit UTF-8, then unescape, then back to 16-bit. This kind of
+    // sucks, and we don't use the encoding properly, which will make some
+    // obscure anchor navigations fail.
+    CString cstr = str.utf8();
+
+    const char* input = cstr.data();
+    int inputLength = cstr.length();
+    url_canon::RawCanonOutputT<char> unescaped;
+    for (int i = 0; i < inputLength; i++) {
+        if (input[i] == '%') {
+            unsigned char ch;
+            if (url_canon::DecodeEscaped(input, &i, inputLength, &ch)) {
+                if (!ch) {
+                    // Never unescape NULLs.
+                    unescaped.push_back('%');
+                    unescaped.push_back('0');
+                    unescaped.push_back('0');
+                } else
+                    unescaped.push_back(ch);
+            } else {
+                // Invalid escape sequence, copy the percent literal.
+                unescaped.push_back('%');
+            }
+        } else {
+            // Regular non-escaped 8-bit character.
+            unescaped.push_back(input[i]);
+        }
+    }
+
+    // Convert that 8-bit to UTF-16. It's not clear IE does this at all to
+    // JavaScript URLs, but Firefox and Safari do.
+    url_canon::RawCanonOutputT<url_parse::UTF16Char> utf16;
+    for (int i = 0; i < unescaped.length(); i++) {
+        unsigned char uch = static_cast<unsigned char>(unescaped.at(i));
+        if (uch < 0x80) {
+            // Non-UTF-8, just append directly
+            utf16.push_back(uch);
+        } else {
+            // next_ch will point to the last character of the decoded
+            // character.
+            int nextCharacter = i;
+            unsigned codePoint;
+            if (url_canon::ReadUTFChar(unescaped.data(), &nextCharacter,
+                                       unescaped.length(), &codePoint)) {
+                // Valid UTF-8 character, convert to UTF-16.
+                url_canon::AppendUTF16Value(codePoint, &utf16);
+                i = nextCharacter;
+            } else {
+                // KURL.cpp strips any sequences that are not valid UTF-8. This
+                // sounds scary. Instead, we just keep those invalid code
+                // points and promote to UTF-16. We copy all characters from
+                // the current position to the end of the identified sqeuqnce.
+                while (i < nextCharacter) {
+                    utf16.push_back(static_cast<unsigned char>(unescaped.at(i)));
+                    i++;
+                }
+                utf16.push_back(static_cast<unsigned char>(unescaped.at(i)));
+            }
+        }
+    }
+
+    return String(reinterpret_cast<UChar*>(utf16.data()), utf16.length());
+}
+
+bool KURL::protocolIs(const char* protocol) const
+{
+    assertProtocolIsGood(protocol);
+
+    // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
+    // The free function protocolIsJavaScript() should be used instead.
+    // FIXME: Chromium code needs to be fixed for this assert to be enabled. ASSERT(strcmp(protocol, "javascript"));
+
+    if (m_url.m_parsed.scheme.len <= 0)
+        return !protocol;
+    return lowerCaseEqualsASCII(
+        m_url.utf8String().data() + m_url.m_parsed.scheme.begin,
+        m_url.utf8String().data() + m_url.m_parsed.scheme.end(),
+        protocol);
+}
+
+bool KURL::isLocalFile() const
+{
+    return protocolIs("file");
+}
+
+// This is called to escape a URL string. It is only used externally when
+// constructing mailto: links to set the query section. Since our query setter
+// will automatically do the correct escaping, this function does not have to
+// do any work.
+//
+// There is a possibility that a future called may use this function in other
+// ways, and may expect to get a valid URL string. The dangerous thing we want
+// to protect against here is accidentally getting NULLs in a string that is
+// not supposed to have NULLs. Therefore, we escape NULLs here to prevent this.
+String encodeWithURLEscapeSequences(const String& notEncodedString)
+{
+    CString utf8 = UTF8Encoding().encode(
+        reinterpret_cast<const UChar*>(notEncodedString.characters()),
+        notEncodedString.length(),
+        URLEncodedEntitiesForUnencodables);
+    const char* input = utf8.data();
+    int inputLength = utf8.length();
+
+    Vector<char, 2048> buffer;
+    for (int i = 0; i < inputLength; i++) {
+        if (!input[i])
+            buffer.append("%00", 3);
+        else
+            buffer.append(input[i]);
+    }
+    return String(buffer.data(), buffer.size());
+}
+
+bool KURL::isHierarchical() const
+{
+    if (!m_url.m_parsed.scheme.is_nonempty())
+        return false;
+    return url_util::IsStandard(
+        &m_url.utf8String().data()[m_url.m_parsed.scheme.begin],
+        m_url.utf8String().length(),
+        m_url.m_parsed.scheme);
+}
+
+#ifndef NDEBUG
+void KURL::print() const
+{
+    printf("%s\n", m_url.utf8String().data());
+}
+#endif
+
+void KURL::invalidate()
+{
+    // This is only called from the constructor so resetting the (automatically
+    // initialized) string and parsed structure would be a waste of time.
+    m_url.m_isValid = false;
+    m_url.m_protocolInHTTPFamily = false;
+}
+
+// Equal up to reference fragments, if any.
+bool equalIgnoringRef(const KURL& a, const KURL& b)
+{
+    // Compute the length of each URL without its ref. Note that the reference
+    // begin (if it exists) points to the character *after* the '#', so we need
+    // to subtract one.
+    int aLength = a.m_url.utf8String().length();
+    if (a.m_url.m_parsed.ref.len >= 0)
+        aLength = a.m_url.m_parsed.ref.begin - 1;
+
+    int bLength = b.m_url.utf8String().length();
+    if (b.m_url.m_parsed.ref.len >= 0)
+        bLength = b.m_url.m_parsed.ref.begin - 1;
+
+    return aLength == bLength
+        && !strncmp(a.m_url.utf8String().data(), b.m_url.utf8String().data(), aLength);
+}
+
+unsigned KURL::hostStart() const
+{
+    return m_url.m_parsed.CountCharactersBefore(url_parse::Parsed::HOST, false);
+}
+
+unsigned KURL::hostEnd() const
+{
+    return m_url.m_parsed.CountCharactersBefore(url_parse::Parsed::PORT, true);
+}
+
+unsigned KURL::pathStart() const
+{
+    return m_url.m_parsed.CountCharactersBefore(url_parse::Parsed::PATH, false);
+}
+
+unsigned KURL::pathEnd() const
+{
+    return m_url.m_parsed.CountCharactersBefore(url_parse::Parsed::QUERY, true);
+}
+
+unsigned KURL::pathAfterLastSlash() const
+{
+    // When there's no path, ask for what would be the beginning of it.
+    if (!m_url.m_parsed.path.is_valid())
+        return m_url.m_parsed.CountCharactersBefore(url_parse::Parsed::PATH, false);
+
+    url_parse::Component filename;
+    url_parse::ExtractFileName(m_url.utf8String().data(), m_url.m_parsed.path,
+                               &filename);
+    return filename.begin;
+}
+
+const KURL& blankURL()
+{
+    static KURL staticBlankURL("about:blank");
+    return staticBlankURL;
+}
+
+bool protocolIs(const String& url, const char* protocol)
+{
+    // Do the comparison without making a new string object.
+    assertProtocolIsGood(protocol);
+    for (int i = 0; ; ++i) {
+        if (!protocol[i])
+            return url[i] == ':';
+        if (toASCIILower(url[i]) != protocol[i])
+            return false;
+    }
+}
+
+inline bool KURL::protocolIs(const String& string, const char* protocol)
+{
+    return WebCore::protocolIs(string, protocol);
+}
+
+} // namespace WebCore
+
+#endif // USE(GOOGLEURL)
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLGooglePrivate.h b/src/3rdparty/webkit/WebCore/platform/KURLGooglePrivate.h
new file mode 100644
index 0000000000..a70cce5bc9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/KURLGooglePrivate.h
@@ -0,0 +1,115 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef KURLGooglePrivate_h
+#define KURLGooglePrivate_h
+
+#include "CString.h"
+
+#include <googleurl/src/url_parse.h>
+#include <googleurl/src/url_canon.h>
+
+namespace WebCore {
+
+    class KURL;
+    class TextEncoding;
+
+    // Wraps the internals related to using Google-URL as the bnackend for KURL.
+    // This maintains the state and has auxiliary functions so that we don't need
+    // to uglify KURL.h while allowing Google-URL to be evaluated.
+    class KURLGooglePrivate {
+    public:
+        KURLGooglePrivate();
+        KURLGooglePrivate(const url_parse::Parsed&, bool isValid);
+
+        // Initializes the object. This will call through to one of the backend
+        // initializers below depending on whether the string's internal
+        // representation is 8 or 16 bit.
+        void init(const KURL& base, const String& relative,
+                  const TextEncoding* queryEncoding);
+
+        // Backend initializers. The query encoding parameters are optional and can
+        // be NULL (this implies UTF-8). These initializers require that the object
+        // has just been created and the strings are NULL. Do not call on an
+        // already-constructed object.
+        void init(const KURL& base, const char* rel, int relLength,
+                  const TextEncoding* queryEncoding);
+        void init(const KURL& base, const UChar* rel, int relLength,
+                  const TextEncoding* queryEncoding);
+
+        // Does a deep copy to the given output object.
+        void copyTo(KURLGooglePrivate* dest) const;
+
+        // Returns the substring of the input identified by the given component.
+        String componentString(const url_parse::Component&) const;
+
+        // Replaces the given components, modifying the current URL. The current
+        // URL must be valid.
+        typedef url_canon::Replacements<url_parse::UTF16Char> Replacements;
+        void replaceComponents(const Replacements&);
+
+        // Setters for the data. Using the ASCII version when you know the
+        // data is ASCII will be slightly more efficient. The UTF-8 version
+        // will always be correct if the caller is unsure.
+        void setUtf8(const CString&);
+        void setAscii(const CString&);
+
+        // TODO(brettw) we can support an additional optimization.  Make this
+        // buffer support both optinal Strings and UTF-8 data. This way, we can use
+        // the optimization from the original KURL which uses = with the original
+        // string when canonicalization did not change it. This allows the strings
+        // to share a buffer internally, and saves a malloc.
+
+        // Getters for the data.
+        const CString& utf8String() const { return m_utf8; }
+        const String& string() const;
+
+        bool m_isValid;
+        bool m_protocolInHTTPFamily;
+        url_parse::Parsed m_parsed; // Indexes into the UTF-8 version of the string.
+
+    private:
+        void initProtocolInHTTPFamily();
+
+        CString m_utf8;
+
+        // Set to true when the caller set us using the ASCII setter. We can
+        // be more efficient when we know there is no UTF-8 to worry about.
+        // This flag is currently always correct, but should be changed to be a
+        // hint (see setUtf8).
+        bool m_utf8IsASCII;
+
+        mutable bool m_stringIsValid;
+        mutable String m_string;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/KeyboardCodes.h b/src/3rdparty/webkit/WebCore/platform/KeyboardCodes.h
index 61bc9fe2cd..c2c3b546fa 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/KeyboardCodes.h
+++ b/src/3rdparty/webkit/WebCore/platform/KeyboardCodes.h
@@ -30,6 +30,17 @@
 
 #include <wtf/Platform.h>
 
+// FIXME: We should get rid of these Chromium-related ifdefs.
+#if PLATFORM(CHROMIUM)
+
+#if PLATFORM(WIN_OS)
+#include "KeyboardCodesWin.h"
+#else
+#include "KeyboardCodesPosix.h"
+#endif
+
+#else
+
 namespace WebCore {
 
 #if !PLATFORM(WIN_OS)
@@ -558,4 +569,6 @@ const int VK_UNKNOWN = 0;
 
 }
 
+#endif // PLATFORM(CHROMIUM)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h b/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
index 085c6e1edc..b6ec878474 100644
--- a/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
+++ b/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
@@ -88,6 +88,19 @@ namespace WebCore {
     String contextMenuItemTagSpeechMenu();
     String contextMenuItemTagStartSpeaking();
     String contextMenuItemTagStopSpeaking();
+    String contextMenuItemTagCorrectSpellingAutomatically();
+    String contextMenuItemTagSubstitutionsMenu();
+    String contextMenuItemTagShowSubstitutions(bool show);
+    String contextMenuItemTagSmartCopyPaste();
+    String contextMenuItemTagSmartQuotes();
+    String contextMenuItemTagSmartDashes();
+    String contextMenuItemTagSmartLinks();
+    String contextMenuItemTagTextReplacement();
+    String contextMenuItemTagTransformationsMenu();
+    String contextMenuItemTagMakeUpperCase();
+    String contextMenuItemTagMakeLowerCase();
+    String contextMenuItemTagCapitalize();
+    String contextMenuItemTagChangeBack(const String& replacedString);
 #endif
     String contextMenuItemTagInspectElement();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/Logging.cpp b/src/3rdparty/webkit/WebCore/platform/Logging.cpp
index a1aa3d67c0..9c3f324f58 100644
--- a/src/3rdparty/webkit/WebCore/platform/Logging.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Logging.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "Logging.h"
+#include "PlatformString.h"
 
 namespace WebCore {
 
@@ -59,4 +60,33 @@ WTFLogChannel LogMedia =             { 0x01000000, "WebCoreLogLevel", WTFLogChan
 WTFLogChannel LogPlugin =            { 0x02000000, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogArchives =          { 0x04000000, "WebCoreLogLevel", WTFLogChannelOff };
 
+WTFLogChannel* getChannelFromName(const String& channelName)
+{
+    if (!(channelName.length() >= 2))
+        return 0;
+
+    if (channelName == String("BackForward")) return &LogBackForward;
+    if (channelName == String("Editing")) return &LogEditing;
+    if (channelName == String("Events")) return &LogEvents;
+    if (channelName == String("Frames")) return &LogFrames;
+    if (channelName == String("FTP")) return &LogFTP;
+    if (channelName == String("History")) return &LogHistory;
+    if (channelName == String("IconDatabase")) return &LogIconDatabase;
+    if (channelName == String("Loading")) return &LogLoading;
+    if (channelName == String("Media")) return &LogMedia;
+    if (channelName == String("Network")) return &LogNetwork;
+    if (channelName == String("NotYetImplemented")) return &LogNotYetImplemented;
+    if (channelName == String("PageCache")) return &LogPageCache;
+    if (channelName == String("PlatformLeaks")) return &LogPlatformLeaks;
+    if (channelName == String("Plugin")) return &LogPlugin;
+    if (channelName == String("PopupBlocking")) return &LogPopupBlocking;
+    if (channelName == String("SpellingAndGrammar")) return &LogSpellingAndGrammar;
+    if (channelName == String("SQLDatabase")) return &LogSQLDatabase;
+    if (channelName == String("StorageAPI")) return &LogStorageAPI;
+    if (channelName == String("TextConversion")) return &LogTextConversion;
+    if (channelName == String("Threading")) return &LogThreading;
+
+    return 0;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/Logging.h b/src/3rdparty/webkit/WebCore/platform/Logging.h
index 844ac3a578..c1461e7da4 100644
--- a/src/3rdparty/webkit/WebCore/platform/Logging.h
+++ b/src/3rdparty/webkit/WebCore/platform/Logging.h
@@ -34,6 +34,8 @@
 
 namespace WebCore {
 
+    class String;
+
     extern WTFLogChannel LogNotYetImplemented;
     extern WTFLogChannel LogFrames;
     extern WTFLogChannel LogLoading;
@@ -57,6 +59,7 @@ namespace WebCore {
     extern WTFLogChannel LogArchives;
 
     void InitializeLoggingChannelsIfNecessary();
+    WTFLogChannel* getChannelFromName(const String& channelName);
 }
 
 #endif // Logging_h
diff --git a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
index 8f987357fe..923dd8cda4 100644
--- a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc.  All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2006, 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,6 +32,7 @@
 #include "StringHash.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/StdLibExtras.h>
 
 #if PLATFORM(CG)
 #include "ImageSourceCG.h"
@@ -51,6 +52,7 @@ static HashSet<String>* supportedImageMIMETypesForEncoding;
 static HashSet<String>* supportedJavaScriptMIMETypes;
 static HashSet<String>* supportedNonImageMIMETypes;
 static HashSet<String>* supportedMediaMIMETypes;
+static HashMap<String, String, CaseFoldingHash>* mediaMIMETypeForExtensionMap;
 
 static void initializeSupportedImageMIMETypes()
 {
@@ -71,7 +73,9 @@ static void initializeSupportedImageMIMETypes()
     supportedImageResourceMIMETypes->add("image/bmp");
 
     // Favicons don't have a MIME type in the registry either.
+    supportedImageMIMETypes->add("image/vnd.microsoft.icon");
     supportedImageMIMETypes->add("image/x-icon");
+    supportedImageResourceMIMETypes->add("image/vnd.microsoft.icon");
     supportedImageResourceMIMETypes->add("image/x-icon");
 
     //  We only get one MIME type per UTI, hence our need to add these manually
@@ -100,6 +104,9 @@ static void initializeSupportedImageMIMETypes()
         supportedImageMIMETypes->add(mimeType);
         supportedImageResourceMIMETypes->add(mimeType);
     }
+
+    supportedImageMIMETypes->remove("application/octet-stream");
+    supportedImageResourceMIMETypes->remove("application/octet-stream");
 #else
     // assume that all implementations at least support the following standard
     // image types:
@@ -108,6 +115,7 @@ static void initializeSupportedImageMIMETypes()
         "image/png",
         "image/gif",
         "image/bmp",
+        "image/vnd.microsoft.icon",    // ico
         "image/x-icon",    // ico
         "image/x-xbitmap"  // xbm
     };
@@ -145,6 +153,8 @@ static void initializeSupportedImageMIMETypesForEncoding()
         String mimeType = MIMETypeRegistry::getMIMETypeForExtension(formats.at(i).constData());
         supportedImageMIMETypesForEncoding->add(mimeType);
     }
+
+    supportedImageMIMETypesForEncoding->remove("application/octet-stream");
 #elif PLATFORM(CAIRO)
     supportedImageMIMETypesForEncoding->add("image/png");
 #endif
@@ -190,6 +200,9 @@ static void initializeSupportedNonImageMimeTypes()
         "text/",
         "application/xml",
         "application/xhtml+xml",
+#if ENABLE(XHTMLMP)
+        "application/vnd.wap.xhtml+xml",
+#endif
         "application/rss+xml",
         "application/atom+xml",
 #if ENABLE(SVG)
@@ -206,6 +219,103 @@ static void initializeSupportedNonImageMimeTypes()
     ArchiveFactory::registerKnownArchiveMIMETypes();
 }
 
+static void initializeMediaTypeMaps()
+{
+    struct TypeExtensionPair {
+        const char* type;
+        const char* extension;
+    };
+
+    // A table of common media MIME types and file extenstions used when a platform's
+    // specific MIME type lookup doens't have a match for a media file extension. While some
+    // file extensions are claimed by multiple MIME types, this table only includes one 
+    // for each because it is currently only used by getMediaMIMETypeForExtension. If we
+    // ever add a MIME type -> file extension mapping, the alternate MIME types will need
+    // to be added.
+    static const TypeExtensionPair pairs[] = {
+    
+        // Ogg
+        { "application/ogg", "ogg" },
+        { "application/ogg", "ogx" },
+        { "audio/ogg", "oga" },
+        { "video/ogg", "ogv" },
+
+        // Annodex
+        { "application/annodex", "anx" },
+        { "audio/annodex", "axa" },
+        { "video/annodex", "axv" },
+        { "audio/speex", "spx" },
+
+        // MPEG
+        { "audio/mpeg", "m1a" },
+        { "audio/mpeg", "m2a" },
+        { "audio/mpeg", "m1s" },
+        { "audio/mpeg", "mpa" },
+        { "video/mpeg", "mpg" },
+        { "video/mpeg", "m15" },
+        { "video/mpeg", "m1s" },
+        { "video/mpeg", "m1v" },
+        { "video/mpeg", "m75" },
+        { "video/mpeg", "mpa" },
+        { "video/mpeg", "mpeg" },
+        { "video/mpeg", "mpm" },
+        { "video/mpeg", "mpv" },
+
+        // MPEG playlist
+        { "audio/x-mpegurl", "m3url" },
+        { "application/x-mpegurl", "m3u8" },
+
+        // MPEG-4
+        { "video/x-m4v", "m4v" },
+        { "audio/x-m4a", "m4a" },
+        { "audio/x-m4b", "m4b" },
+        { "audio/x-m4p", "m4p" },
+ 
+        // MP3
+        { "audio/mp3", "mp3" },
+
+        // MPEG-2
+        { "video/x-mpeg2", "mp2" },
+        { "video/mpeg2", "vob" },
+        { "video/mpeg2", "mod" },
+        { "video/m2ts", "m2ts" },
+        { "video/x-m2ts", "m2t" },
+        { "video/x-m2ts", "ts" },
+
+        // 3GP/3GP2
+        { "audio/3gpp", "3gpp" }, 
+        { "audio/3gpp2", "3g2" }, 
+        { "application/x-mpeg", "amc" },
+
+        // AAC
+        { "audio/aac", "aac" },
+        { "audio/aac", "adts" },
+        { "audio/x-aac", "m4r" },
+
+        // CoreAudio File
+        { "audio/x-caf", "caf" },
+        { "audio/x-gsm", "gsm" }
+    };
+
+    mediaMIMETypeForExtensionMap = new HashMap<String, String, CaseFoldingHash>;
+    const unsigned numPairs = sizeof(pairs) / sizeof(pairs[0]);
+    for (unsigned ndx = 0; ndx < numPairs; ++ndx)
+        mediaMIMETypeForExtensionMap->set(pairs[ndx].extension, pairs[ndx].type);
+}
+
+String MIMETypeRegistry::getMediaMIMETypeForExtension(const String& ext)
+{
+    // Check with system specific implementation first.
+    String mimeType = getMIMETypeForExtension(ext);
+    if (!mimeType.isEmpty())
+        return mimeType;
+
+    // No match, look in the static mapping.
+    if (!mediaMIMETypeForExtensionMap)
+        initializeMediaTypeMaps();
+    return mediaMIMETypeForExtensionMap->get(ext);
+}
+
 static void initializeSupportedMediaMIMETypes()
 {
     supportedMediaMIMETypes = new HashSet<String>;
@@ -339,4 +449,10 @@ HashSet<String>& MIMETypeRegistry::getSupportedMediaMIMETypes()
     return *supportedMediaMIMETypes;
 }
 
+const String& defaultMIMEType()
+{
+    DEFINE_STATIC_LOCAL(const String, defaultMIMEType, ("application/octet-stream"));
+    return defaultMIMEType;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.h b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.h
index be741a47de..8801ac11d0 100644
--- a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.h
+++ b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.h
@@ -38,6 +38,8 @@ public:
     static String getMIMETypeForExtension(const String& ext);
     static Vector<String> getExtensionsForMIMEType(const String& type);
     static String getPreferredExtensionForMIMEType(const String& type);
+    static String getMediaMIMETypeForExtension(const String& ext);
+
     static String getMIMETypeForPath(const String& path);
 
     // Check to see if a mime type is suitable for being loaded inline as an
@@ -72,6 +74,8 @@ public:
     static HashSet<String>& getSupportedMediaMIMETypes();
 };
 
+const String& defaultMIMEType();
+
 } // namespace WebCore
 
 #endif // MIMETypeRegistry_h
diff --git a/src/3rdparty/webkit/WebCore/platform/NotImplemented.h b/src/3rdparty/webkit/WebCore/platform/NotImplemented.h
index 19e999fc9f..47748e7bde 100644
--- a/src/3rdparty/webkit/WebCore/platform/NotImplemented.h
+++ b/src/3rdparty/webkit/WebCore/platform/NotImplemented.h
@@ -45,7 +45,7 @@
 #define notImplemented() do { \
         static bool havePrinted = false; \
         if (!havePrinted && !supressNotImplementedWarning()) { \
-            WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &LogNotYetImplemented, "UNIMPLEMENTED: "); \
+            WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &::WebCore::LogNotYetImplemented, "UNIMPLEMENTED: "); \
             havePrinted = true; \
         } \
     } while (0)
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
index 1b92153d99..2543d406cf 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,26 +27,6 @@
 #define PlatformMouseEvent_h
 
 #include "IntPoint.h"
-#include <wtf/Platform.h>
-
-#if PLATFORM(MAC)
-#ifdef __OBJC__
-@class NSEvent;
-@class NSScreen;
-@class NSWindow;
-#else
-class NSEvent;
-class NSScreen;
-class NSWindow;
-#endif
-#endif
-
-#if PLATFORM(WIN)
-typedef struct HWND__* HWND;
-typedef unsigned UINT;
-typedef unsigned WPARAM;
-typedef long LPARAM;
-#endif
 
 #if PLATFORM(GTK)
 typedef struct _GdkEventButton GdkEventButton;
@@ -59,6 +39,13 @@ class QInputEvent;
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(WIN)
+typedef struct HWND__* HWND;
+typedef unsigned UINT;
+typedef unsigned WPARAM;
+typedef long LPARAM;
+#endif
+
 #if PLATFORM(WX)
 class wxMouseEvent;
 #endif
@@ -84,9 +71,11 @@ namespace WebCore {
         {
         }
 
-        PlatformMouseEvent(const IntPoint& pos, const IntPoint& globalPos, MouseButton button, MouseEventType eventType,
+        PlatformMouseEvent(const IntPoint& position, const IntPoint& globalPosition, MouseButton button, MouseEventType eventType,
                            int clickCount, bool shift, bool ctrl, bool alt, bool meta, double timestamp)
-            : m_position(pos), m_globalPosition(globalPos), m_button(button)
+            : m_position(position)
+            , m_globalPosition(globalPosition)
+            , m_button(button)
             , m_eventType(eventType)
             , m_clickCount(clickCount)
             , m_shiftKey(shift)
@@ -112,30 +101,32 @@ namespace WebCore {
         bool metaKey() const { return m_metaKey; }
         unsigned modifierFlags() const { return m_modifierFlags; }
         
-        //time in seconds
+        // Time in seconds.
         double timestamp() const { return m_timestamp; }
 
-#if PLATFORM(MAC)
-        PlatformMouseEvent(NSEvent*);
-        int eventNumber() const { return m_eventNumber; }
-#endif
-#if PLATFORM(WIN)
-        PlatformMouseEvent(HWND, UINT, WPARAM, LPARAM, bool activatedWebView = false);
-        void setClickCount(int count) { m_clickCount = count; }
-        bool activatedWebView() const { return m_activatedWebView; }
-#endif
 #if PLATFORM(GTK) 
         PlatformMouseEvent(GdkEventButton*);
         PlatformMouseEvent(GdkEventMotion*);
 #endif
+
+#if PLATFORM(MAC) && defined(__OBJC__)
+        PlatformMouseEvent(NSEvent *, NSView *windowView);
+        int eventNumber() const { return m_eventNumber; }
+#endif
+
 #if PLATFORM(QT)
         PlatformMouseEvent(QInputEvent*, int clickCount);
 #endif
 
-#if PLATFORM(WX)
-        PlatformMouseEvent(const wxMouseEvent&, const wxPoint& globalPoint);
+#if PLATFORM(WIN)
+        PlatformMouseEvent(HWND, UINT, WPARAM, LPARAM, bool activatedWebView = false);
+        void setClickCount(int count) { m_clickCount = count; }
+        bool activatedWebView() const { return m_activatedWebView; }
 #endif
 
+#if PLATFORM(WX)
+        PlatformMouseEvent(const wxMouseEvent&, const wxPoint& globalPoint, int clickCount);
+#endif
 
     protected:
         IntPoint m_position;
@@ -149,18 +140,20 @@ namespace WebCore {
         bool m_metaKey;
         double m_timestamp; // unit: seconds
         unsigned m_modifierFlags;
+
 #if PLATFORM(MAC)
         int m_eventNumber;
 #endif
+
 #if PLATFORM(WIN)
         bool m_activatedWebView;
 #endif
     };
 
-#if PLATFORM(MAC)
-    IntPoint globalPoint(const NSPoint& windowPoint, NSWindow *window);
-    IntPoint pointForEvent(NSEvent *event);
-    IntPoint globalPointForEvent(NSEvent *event);
+#if PLATFORM(MAC) && defined(__OBJC__)
+    IntPoint globalPoint(const NSPoint& windowPoint, NSWindow *);
+    IntPoint pointForEvent(NSEvent *, NSView *windowView);
+    IntPoint globalPointForEvent(NSEvent *);
 #endif
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
index fc954edb8f..037c4b7a14 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,20 +28,6 @@
 
 #include "IntPoint.h"
 
-#if PLATFORM(MAC)
-#ifdef __OBJC__
-@class NSEvent;
-#else
-class NSEvent;
-#endif
-#endif
-
-#if PLATFORM(WIN)
-typedef struct HWND__* HWND;
-typedef unsigned WPARAM;
-typedef long LPARAM;
-#endif
-
 #if PLATFORM(GTK)
 typedef struct _GdkEventScroll GdkEventScroll;
 #endif
@@ -52,6 +38,12 @@ class QWheelEvent;
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(WIN)
+typedef struct HWND__* HWND;
+typedef unsigned WPARAM;
+typedef long LPARAM;
+#endif
+
 #if PLATFORM(WX)
 class wxMouseEvent;
 class wxPoint;
@@ -59,23 +51,13 @@ class wxPoint;
 
 namespace WebCore {
 
-    // Wheel events come in three flavors:
-    // The ScrollByPixelWheelEvent is a fine-grained event that specifies the precise number of pixels to scroll.  It is sent by MacBook touchpads on OS X.
-    // For ScrollByPixelWheelEvents, the delta values contain the precise number of pixels to scroll.
-    // The ScrollByLineWheelEvent (the normal wheel event) sends a delta that can be corrected by a line multiplier to determine how many lines to scroll.
-    //      If the platform has configurable line sensitivity (Windows), then the number of lines to scroll is used in order to behave like the platform.
-    //      If the platform does not have configurable line sensitivity, then WebCore's default behavior is used (which scrolls 3 * the wheel line delta).
-    // For ScrollByLineWheelEvents, the delta values represent the number of lines to scroll.
-    // The ScrollByPageWheelEvent indicates that the wheel event should scroll an entire page instead.  In this case WebCore's built in paging behavior is used to page
+    // Wheel events come in two flavors:
+    // The ScrollByPixelWheelEvent is a fine-grained event that specifies the precise number of pixels to scroll.  It is sent directly by MacBook touchpads on OS X,
+    // and synthesized in other cases where platforms generate line-by-line scrolling events.
+    // The ScrollByPageWheelEvent indicates that the wheel event should scroll an entire page.  In this case WebCore's built in paging behavior is used to page
     // up and down (you get the same behavior as if the user was clicking in a scrollbar track to page up or page down).  Page scrolling only works in the vertical direction.
-    enum PlatformWheelEventGranularity { ScrollByLineWheelEvent, ScrollByPageWheelEvent, ScrollByPixelWheelEvent };
+    enum PlatformWheelEventGranularity { ScrollByPageWheelEvent, ScrollByPixelWheelEvent };
     
-    // WebCore uses a line multiple of ~3 (40px per line step) when doing arrowing with a scrollbar or line stepping via the arrow keys.  The delta for wheeling is expressed
-    // as a # of actual lines (40 / 3 = 1 wheel line).  We use the horizontalLineMultiplier and verticalLineMultiplier methods to incorporate the line multiplier into the deltas.  On
-    // platforms that do not support wheel sensitivity, we use this hardcoded constant value of 3 to ensure that wheeling by default matches the WebCore multiplier you
-    // get when doing other kinds of line stepping.
-    const int cLineMultiplier = 3;
-
     class PlatformWheelEvent {
     public:
         const IntPoint& pos() const { return m_position; } // PlatformWindow coordinates.
@@ -84,6 +66,9 @@ namespace WebCore {
         float deltaX() const { return m_deltaX; }
         float deltaY() const { return m_deltaY; }
 
+        float wheelTicksX() const { return m_wheelTicksX; }
+        float wheelTicksY() const { return m_wheelTicksY; }
+
         PlatformWheelEventGranularity granularity() const { return m_granularity; }
 
         bool isAccepted() const { return m_isAccepted; }
@@ -100,35 +85,33 @@ namespace WebCore {
         void accept() { m_isAccepted = true; }
         void ignore() { m_isAccepted = false; }
 
-#if PLATFORM(MAC)
-        PlatformWheelEvent(NSEvent*);
-#endif
-#if PLATFORM(WIN)
-        PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isHorizontal);
-#endif
 #if PLATFORM(GTK)
         PlatformWheelEvent(GdkEventScroll*);
 #endif
+
+#if PLATFORM(MAC) && defined(__OBJC__)
+        PlatformWheelEvent(NSEvent *, NSView *windowView);
+#endif
+
 #if PLATFORM(QT)
         PlatformWheelEvent(QWheelEvent*);
 #endif
+
+#if PLATFORM(WIN)
+        PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isMouseHWheel);
+#endif
+
 #if PLATFORM(WX)
         PlatformWheelEvent(const wxMouseEvent&, const wxPoint&);
 #endif
 
     protected:
-#if !PLATFORM(WIN)
-        int horizontalLineMultiplier() const { return cLineMultiplier; }
-        int verticalLineMultiplier() const { return cLineMultiplier; }
-#else
-        int horizontalLineMultiplier() const;
-        int verticalLineMultiplier() const;
-#endif
-
         IntPoint m_position;
         IntPoint m_globalPosition;
         float m_deltaX;
         float m_deltaY;
+        float m_wheelTicksX;
+        float m_wheelTicksY;
         PlatformWheelEventGranularity m_granularity;
         bool m_isAccepted;
         bool m_shiftKey;
diff --git a/src/3rdparty/webkit/WebCore/platform/PopupMenuStyle.h b/src/3rdparty/webkit/WebCore/platform/PopupMenuStyle.h
index 89a7a74ac2..5325ff3732 100644
--- a/src/3rdparty/webkit/WebCore/platform/PopupMenuStyle.h
+++ b/src/3rdparty/webkit/WebCore/platform/PopupMenuStyle.h
@@ -28,16 +28,20 @@
 
 #include "Color.h"
 #include "Font.h"
+#include "Length.h"
+#include "TextDirection.h"
 
 namespace WebCore {
 
 class PopupMenuStyle {
 public:
-    PopupMenuStyle(const Color& foreground, const Color& background, const Font& font, bool visible)
+    PopupMenuStyle(const Color& foreground, const Color& background, const Font& font, bool visible, Length textIndent, TextDirection textDirection)
         : m_foregroundColor(foreground)
         , m_backgroundColor(background)
         , m_font(font)
         , m_visible(visible)
+        , m_textIndent(textIndent)
+        , m_textDirection(textDirection)
     {
     }
     
@@ -45,12 +49,16 @@ public:
     const Color& backgroundColor() const { return m_backgroundColor; }
     const Font& font() const { return m_font; }
     bool isVisible() const { return m_visible; }
+    Length textIndent() const { return m_textIndent; }
+    TextDirection textDirection() const { return m_textDirection; }
 
 private:
     Color m_foregroundColor;
     Color m_backgroundColor;
     Font m_font;
     bool m_visible;
+    Length m_textIndent;
+    TextDirection m_textDirection;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/RunLoopTimer.h b/src/3rdparty/webkit/WebCore/platform/RunLoopTimer.h
new file mode 100644
index 0000000000..96eb8d82f9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/RunLoopTimer.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RunLoopTimer_h
+#define RunLoopTimer_h
+
+#include "SchedulePair.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+// Time intervals are all in seconds.
+
+class RunLoopTimerBase : Noncopyable {
+public:
+    virtual ~RunLoopTimerBase();
+
+    void schedule(const SchedulePair*);
+    void schedule(const SchedulePairHashSet&);
+
+    void start(double nextFireInterval, double repeatInterval);
+
+    void startRepeating(double repeatInterval) { start(repeatInterval, repeatInterval); }
+    void startOneShot(double interval) { start(interval, 0); }
+
+    void stop();
+    bool isActive() const;
+
+    virtual void fired() = 0;
+
+private:
+#if PLATFORM(CF)
+    RetainPtr<CFRunLoopTimerRef> m_timer;
+#endif
+};
+
+template <typename TimerFiredClass> class RunLoopTimer : public RunLoopTimerBase {
+public:
+    typedef void (TimerFiredClass::*TimerFiredFunction)(RunLoopTimer*);
+
+    RunLoopTimer(TimerFiredClass* o, TimerFiredFunction f)
+        : m_object(o), m_function(f) { }
+
+    virtual void fired() { (m_object->*m_function)(this); }
+
+private:
+    TimerFiredClass* m_object;
+    TimerFiredFunction m_function;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
index 926ce16d08..9f0da3acf2 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
@@ -46,12 +46,11 @@ ScrollView::ScrollView()
     , m_scrollbarsAvoidingResizer(0)
     , m_scrollbarsSuppressed(false)
     , m_inUpdateScrollbars(false)
+    , m_updateScrollbarsPass(0)
     , m_drawPanScrollIcon(false)
     , m_useFixedLayout(false)
 {
     platformInit();
-    if (platformWidget())
-        platformSetCanBlitOnScroll(true);
 }
 
 ScrollView::~ScrollView()
@@ -79,7 +78,7 @@ void ScrollView::removeChild(Widget* child)
 
 void ScrollView::setHasHorizontalScrollbar(bool hasBar)
 {
-    if (hasBar && !m_horizontalScrollbar && !platformHasHorizontalAdjustment()) {
+    if (hasBar && !m_horizontalScrollbar) {
         m_horizontalScrollbar = createScrollbar(HorizontalScrollbar);
         addChild(m_horizontalScrollbar.get());
     } else if (!hasBar && m_horizontalScrollbar) {
@@ -90,7 +89,7 @@ void ScrollView::setHasHorizontalScrollbar(bool hasBar)
 
 void ScrollView::setHasVerticalScrollbar(bool hasBar)
 {
-    if (hasBar && !m_verticalScrollbar && !platformHasVerticalAdjustment()) {
+    if (hasBar && !m_verticalScrollbar) {
         m_verticalScrollbar = createScrollbar(VerticalScrollbar);
         addChild(m_verticalScrollbar.get());
     } else if (!hasBar && m_verticalScrollbar) {
@@ -99,10 +98,12 @@ void ScrollView::setHasVerticalScrollbar(bool hasBar)
     }
 }
 
+#if !PLATFORM(GTK)
 PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientation)
 {
     return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
 }
+#endif
 
 void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode)
 {
@@ -239,9 +240,9 @@ void ScrollView::valueChanged(Scrollbar* scrollbar)
     // Figure out if we really moved.
     IntSize newOffset = m_scrollOffset;
     if (scrollbar) {
-        if (scrollbar == m_horizontalScrollbar)
+        if (scrollbar->orientation() == HorizontalScrollbar)
             newOffset.setWidth(scrollbar->value());
-        else if (scrollbar == m_verticalScrollbar)
+        else if (scrollbar->orientation() == VerticalScrollbar)
             newOffset.setHeight(scrollbar->value());
     }
 
@@ -315,62 +316,99 @@ bool ScrollView::scroll(ScrollDirection direction, ScrollGranularity granularity
     return false;
 }
 
+static const unsigned cMaxUpdateScrollbarsPass = 2;
+
 void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 {
-    // Don't allow re-entrancy into this function.
     if (m_inUpdateScrollbars || prohibitsScrolling() || platformWidget())
         return;
 
-    m_inUpdateScrollbars = true;
-
-    bool hasVerticalScrollbar = m_verticalScrollbar;
     bool hasHorizontalScrollbar = m_horizontalScrollbar;
-    bool oldHasVertical = hasVerticalScrollbar;
-    bool oldHasHorizontal = hasHorizontalScrollbar;
+    bool hasVerticalScrollbar = m_verticalScrollbar;
+    
+    bool newHasHorizontalScrollbar = hasHorizontalScrollbar;
+    bool newHasVerticalScrollbar = hasVerticalScrollbar;
+   
     ScrollbarMode hScroll = m_horizontalScrollbarMode;
     ScrollbarMode vScroll = m_verticalScrollbarMode;
 
-    const int scrollbarThickness = ScrollbarTheme::nativeTheme()->scrollbarThickness();
+    if (hScroll != ScrollbarAuto)
+        newHasHorizontalScrollbar = (hScroll == ScrollbarAlwaysOn);
+    if (vScroll != ScrollbarAuto)
+        newHasVerticalScrollbar = (vScroll == ScrollbarAlwaysOn);
 
-    for (int pass = 0; pass < 2; pass++) {
-        bool scrollsVertically;
-        bool scrollsHorizontally;
+    if (m_scrollbarsSuppressed || (hScroll != ScrollbarAuto && vScroll != ScrollbarAuto)) {
+        if (hasHorizontalScrollbar != newHasHorizontalScrollbar)
+            setHasHorizontalScrollbar(newHasHorizontalScrollbar);
+        if (hasVerticalScrollbar != newHasVerticalScrollbar)
+            setHasVerticalScrollbar(newHasVerticalScrollbar);
+    } else {
+        // If we came in here with the view already needing a layout, then go ahead and do that
+        // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
+        // This layout will not re-enter updateScrollers and does not count towards our max layout pass total.
+        m_inUpdateScrollbars = true;
+        visibleContentsResized();
+        m_inUpdateScrollbars = false;
+
+        bool sendContentResizedNotification = false;
+        
+        IntSize docSize = contentsSize();
+        IntSize frameSize = frameRect().size();
 
-        if (!m_scrollbarsSuppressed && (hScroll == ScrollbarAuto || vScroll == ScrollbarAuto)) {
-            // Do a layout if pending before checking if scrollbars are needed.
-            if (hasVerticalScrollbar != oldHasVertical || hasHorizontalScrollbar != oldHasHorizontal)
-                visibleContentsResized();
+        if (hScroll == ScrollbarAuto) {
+            newHasHorizontalScrollbar = docSize.width() > visibleWidth();
+            if (newHasHorizontalScrollbar && !m_updateScrollbarsPass && docSize.width() <= frameSize.width() && docSize.height() <= frameSize.height())
+                newHasHorizontalScrollbar = false;
+        }
+        if (vScroll == ScrollbarAuto) {
+            newHasVerticalScrollbar = docSize.height() > visibleHeight();
+            if (newHasVerticalScrollbar && !m_updateScrollbarsPass && docSize.width() <= frameSize.width() && docSize.height() <= frameSize.height())
+                newHasVerticalScrollbar = false;
+        }
 
-            scrollsVertically = (vScroll == ScrollbarAlwaysOn) || (vScroll == ScrollbarAuto && contentsHeight() > height());
-            if (scrollsVertically)
-                scrollsHorizontally = (hScroll == ScrollbarAlwaysOn) || (hScroll == ScrollbarAuto && contentsWidth() + scrollbarThickness > width());
-            else {
-                scrollsHorizontally = (hScroll == ScrollbarAlwaysOn) || (hScroll == ScrollbarAuto && contentsWidth() > width());
-                if (scrollsHorizontally)
-                    scrollsVertically = (vScroll == ScrollbarAlwaysOn) || (vScroll == ScrollbarAuto && contentsHeight() + scrollbarThickness > height());
-            }
-        } else {
-            scrollsHorizontally = (hScroll == ScrollbarAuto) ? hasHorizontalScrollbar : (hScroll == ScrollbarAlwaysOn);
-            scrollsVertically = (vScroll == ScrollbarAuto) ? hasVerticalScrollbar : (vScroll == ScrollbarAlwaysOn);
+        // If we ever turn one scrollbar off, always turn the other one off too.  Never ever
+        // try to both gain/lose a scrollbar in the same pass.
+        if (!newHasHorizontalScrollbar && hasHorizontalScrollbar && vScroll != ScrollbarAlwaysOn)
+            newHasVerticalScrollbar = false;
+        if (!newHasVerticalScrollbar && hasVerticalScrollbar && hScroll != ScrollbarAlwaysOn)
+            newHasHorizontalScrollbar = false;
+
+        if (hasHorizontalScrollbar != newHasHorizontalScrollbar) {
+            setHasHorizontalScrollbar(newHasHorizontalScrollbar);
+            sendContentResizedNotification = true;
         }
-        
-        if (hasVerticalScrollbar != scrollsVertically) {
-            setHasVerticalScrollbar(scrollsVertically);
-            hasVerticalScrollbar = scrollsVertically;
+
+        if (hasVerticalScrollbar != newHasVerticalScrollbar) {
+            setHasVerticalScrollbar(newHasVerticalScrollbar);
+            sendContentResizedNotification = true;
         }
 
-        if (hasHorizontalScrollbar != scrollsHorizontally) {
-            setHasHorizontalScrollbar(scrollsHorizontally);
-            hasHorizontalScrollbar = scrollsHorizontally;
+        if (sendContentResizedNotification && m_updateScrollbarsPass < cMaxUpdateScrollbarsPass) {
+            m_updateScrollbarsPass++;
+            contentsResized();
+            visibleContentsResized();
+            IntSize newDocSize = contentsSize();
+            if (newDocSize == docSize) {
+                // The layout with the new scroll state had no impact on
+                // the document's overall size, so updateScrollbars didn't get called.
+                // Recur manually.
+                updateScrollbars(desiredOffset);
+            }
+            m_updateScrollbarsPass--;
         }
     }
     
-    // Set up the range (and page step/line step).
+    // Set up the range (and page step/line step), but only do this if we're not in a nested call (to avoid
+    // doing it multiple times).
+    if (m_updateScrollbarsPass)
+        return;
+
+    m_inUpdateScrollbars = true;
     IntSize maxScrollPosition(contentsWidth() - visibleWidth(), contentsHeight() - visibleHeight());
     IntSize scroll = desiredOffset.shrunkTo(maxScrollPosition);
     scroll.clampNegativeToZero();
  
-    if (!platformHandleHorizontalAdjustment(scroll) && m_horizontalScrollbar) {
+    if (m_horizontalScrollbar) {
         int clientWidth = visibleWidth();
         m_horizontalScrollbar->setEnabled(contentsWidth() > clientWidth);
         int pageStep = (clientWidth - cAmountToKeepWhenPaging);
@@ -394,7 +432,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
             m_horizontalScrollbar->setSuppressInvalidation(false); 
     } 
 
-    if (!platformHandleVerticalAdjustment(scroll) && m_verticalScrollbar) {
+    if (m_verticalScrollbar) {
         int clientHeight = visibleHeight();
         m_verticalScrollbar->setEnabled(contentsHeight() > clientHeight);
         int pageStep = (clientHeight - cAmountToKeepWhenPaging);
@@ -418,7 +456,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
             m_verticalScrollbar->setSuppressInvalidation(false);
     }
 
-    if (oldHasVertical != (m_verticalScrollbar != 0) || oldHasHorizontal != (m_horizontalScrollbar != 0))
+    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0))
         frameRectsChanged();
 
     // See if our offset has changed in a situation where we might not have scrollbars.
@@ -438,6 +476,9 @@ const int panIconSizeLength = 20;
 
 void ScrollView::scrollContents(const IntSize& scrollDelta)
 {
+    if (!hostWindow())
+        return;
+
     // Since scrolling is double buffered, we will be blitting the scroll view's intersection
     // with the clip rect every time to keep it smooth.
     IntRect clipRect = windowClipRect();
@@ -453,7 +494,7 @@ void ScrollView::scrollContents(const IntSize& scrollDelta)
         IntPoint panIconDirtySquareLocation = IntPoint(m_panScrollIconPoint.x() - (panIconDirtySquareSizeLength / 2), m_panScrollIconPoint.y() - (panIconDirtySquareSizeLength / 2));
         IntRect panScrollIconDirtyRect = IntRect(panIconDirtySquareLocation , IntSize(panIconDirtySquareSizeLength, panIconDirtySquareSizeLength));
         panScrollIconDirtyRect.intersect(clipRect);
-        hostWindow()->repaint(panScrollIconDirtyRect, true, true);
+        hostWindow()->repaint(panScrollIconDirtyRect, true);
     }
 
     if (canBlitOnScroll() && !rootPreventsBlitting()) { // The main frame can just blit the WebView window
@@ -461,7 +502,7 @@ void ScrollView::scrollContents(const IntSize& scrollDelta)
        hostWindow()->scroll(-scrollDelta, scrollViewRect, clipRect);
     } else { 
        // We need to go ahead and repaint the entire backing store.  Do it now before moving the
-       // plugins.
+       // windowed plugins.
        hostWindow()->repaint(updateRect, true, false, true); // Invalidate the backing store and repaint it synchronously
     }
 
@@ -528,8 +569,8 @@ void ScrollView::adjustScrollbarsAvoidingResizerCount(int overlapDelta)
         // If we went from n to 0 or from 0 to n and we're the outermost view,
         // we need to invalidate the windowResizerRect(), since it will now need to paint
         // differently.
-        if (oldCount > 0 && m_scrollbarsAvoidingResizer == 0 ||
-            oldCount == 0 && m_scrollbarsAvoidingResizer > 0)
+        if ((oldCount > 0 && m_scrollbarsAvoidingResizer == 0) ||
+            (oldCount == 0 && m_scrollbarsAvoidingResizer > 0))
             invalidateRect(windowResizerRect());
     }
 }
@@ -542,8 +583,16 @@ void ScrollView::setParent(ScrollView* parentView)
     if (m_scrollbarsAvoidingResizer && parent())
         parent()->adjustScrollbarsAvoidingResizerCount(-m_scrollbarsAvoidingResizer);
 
+#if PLATFORM(QT)
+    if (m_widgetsPreventingBlitting && parent())
+        parent()->adjustWidgetsPreventingBlittingCount(-m_widgetsPreventingBlitting);
+
+    if (m_widgetsPreventingBlitting && parentView)
+        parentView->adjustWidgetsPreventingBlittingCount(m_widgetsPreventingBlitting);
+#endif
+
     Widget::setParent(parentView);
-    
+
     if (m_scrollbarsAvoidingResizer && parent())
         parent()->adjustScrollbarsAvoidingResizerCount(m_scrollbarsAvoidingResizer);
 }
@@ -600,8 +649,13 @@ Scrollbar* ScrollView::scrollbarUnderMouse(const PlatformMouseEvent& mouseEvent)
 void ScrollView::wheelEvent(PlatformWheelEvent& e)
 {
     // We don't allow mouse wheeling to happen in a ScrollView that has had its scrollbars explicitly disabled.
-    if (!canHaveScrollbars() || platformWidget())
+#if PLATFORM(WX)
+    if (!canHaveScrollbars()) {
+#else
+    if (!canHaveScrollbars() || platformWidget()) {
+#endif
         return;
+    }
 
     // Determine how much we want to scroll.  If we can move at all, we will accept the event.
     IntSize maxScrollDelta = maximumScrollPosition() - scrollPosition();
@@ -612,10 +666,7 @@ void ScrollView::wheelEvent(PlatformWheelEvent& e)
         e.accept();
         float deltaX = e.deltaX();
         float deltaY = e.deltaY();
-        if (e.granularity() == ScrollByLineWheelEvent) {
-            deltaX *= cMouseWheelPixelsPerLineStep;
-            deltaY *= cMouseWheelPixelsPerLineStep;
-        } else if (e.granularity() == ScrollByPageWheelEvent) {
+        if (e.granularity() == ScrollByPageWheelEvent) {
             ASSERT(deltaX == 0);
             bool negative = deltaY < 0;
             deltaY = max(0, visibleHeight() - cAmountToKeepWhenPaging);
@@ -814,6 +865,7 @@ void ScrollView::removePanScrollIcon()
 }
 
 #if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT)
+
 void ScrollView::platformInit()
 {
 }
@@ -821,9 +873,11 @@ void ScrollView::platformInit()
 void ScrollView::platformDestroy()
 {
 }
+
 #endif
 
 #if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(MAC)
+
 void ScrollView::platformAddChild(Widget*)
 {
 }
@@ -831,21 +885,27 @@ void ScrollView::platformAddChild(Widget*)
 void ScrollView::platformRemoveChild(Widget*)
 {
 }
+
 #endif
 
 #if !PLATFORM(MAC)
+
 void ScrollView::platformSetScrollbarsSuppressed(bool repaintOnUnsuppress)
 {
 }
+
 #endif
 
 #if !PLATFORM(MAC) && !PLATFORM(WX)
+
 void ScrollView::platformSetScrollbarModes()
 {
 }
 
 void ScrollView::platformScrollbarModes(ScrollbarMode& horizontal, ScrollbarMode& vertical) const
 {
+    horizontal = ScrollbarAuto;
+    vertical = ScrollbarAuto;
 }
 
 void ScrollView::platformSetCanBlitOnScroll(bool)
@@ -898,28 +958,6 @@ bool ScrollView::platformIsOffscreen() const
 {
     return false;
 }
-#endif
-
-#if !PLATFORM(GTK)
-bool ScrollView::platformHandleHorizontalAdjustment(const IntSize&)
-{
-    return false;
-}
-
-bool ScrollView::platformHandleVerticalAdjustment(const IntSize&)
-{
-    return false;
-}
-
-bool ScrollView::platformHasHorizontalAdjustment() const
-{
-    return false;
-}
-
-bool ScrollView::platformHasVerticalAdjustment() const
-{
-    return false;
-}
 
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.h b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
index f588508e81..4d5bed1fe2 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,9 +47,6 @@ typedef struct _GtkAdjustment GtkAdjustment;
 class wxScrollWinEvent;
 #endif
 
-// DANGER WILL ROBINSON! THIS FILE IS UNDERGOING HEAVY REFACTORING.
-// Everything is changing!
-// Port authors should wait until this refactoring is complete before attempting to implement this interface.
 namespace WebCore {
 
 class HostWindow;
@@ -125,7 +123,7 @@ public:
     
     // Methods for getting/setting the size of the document contained inside the ScrollView (as an IntSize or as individual width and height
     // values).
-    IntSize contentsSize() const;
+    IntSize contentsSize() const; // Always at least as big as the visibleWidth()/visibleHeight().
     int contentsWidth() const { return contentsSize().width(); }
     int contentsHeight() const { return contentsSize().height(); }
     virtual void setContentsSize(const IntSize&);
@@ -254,6 +252,7 @@ private:
     bool m_scrollbarsSuppressed;
 
     bool m_inUpdateScrollbars;
+    unsigned m_updateScrollbarsPass;
 
     IntPoint m_panScrollIconPoint;
     bool m_drawPanScrollIcon;
@@ -283,10 +282,6 @@ private:
     void platformSetScrollbarsSuppressed(bool repaintOnUnsuppress);
     void platformRepaintContentRectangle(const IntRect&, bool now);
     bool platformIsOffscreen() const;
-    bool platformHandleHorizontalAdjustment(const IntSize&);
-    bool platformHandleVerticalAdjustment(const IntSize&);
-    bool platformHasHorizontalAdjustment() const;
-    bool platformHasVerticalAdjustment() const;
 
 #if PLATFORM(MAC) && defined __OBJC__
 public:
@@ -297,9 +292,11 @@ private:
 #endif
 
 #if PLATFORM(QT)
+public:
+    void adjustWidgetsPreventingBlittingCount(int delta);
 private:
-    bool rootPreventsBlitting() const { return root()->m_widgetsThatPreventBlitting > 0; }
-    unsigned m_widgetsThatPreventBlitting;
+    bool rootPreventsBlitting() const { return root()->m_widgetsPreventingBlitting > 0; }
+    unsigned m_widgetsPreventingBlitting;
 #else
     bool rootPreventsBlitting() const { return false; }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp b/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
index 13bb0c989a..babf3d4660 100644
--- a/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
@@ -57,6 +57,7 @@ Scrollbar::Scrollbar(ScrollbarClient* client, ScrollbarOrientation orientation,
     , m_visibleSize(0)
     , m_totalSize(0)
     , m_currentPos(0)
+    , m_dragOrigin(0)
     , m_lineStep(0)
     , m_pageStep(0)
     , m_pixelStep(1)
@@ -92,13 +93,7 @@ bool Scrollbar::setValue(int v)
     v = max(min(v, m_totalSize - m_visibleSize), 0);
     if (value() == v)
         return false; // Our value stayed the same.
-    m_currentPos = v;
-
-    updateThumbPosition();
-
-    if (client())
-        client()->valueChanged(this);
-    
+    setCurrentPos(v);
     return true;
 }
 
@@ -139,20 +134,7 @@ bool Scrollbar::scroll(ScrollDirection direction, ScrollGranularity granularity,
         
     float newPos = m_currentPos + step * multiplier;
     float maxPos = m_totalSize - m_visibleSize;
-    newPos = max(min(newPos, maxPos), 0.0f);
-
-    if (newPos == m_currentPos)
-        return false;
-    
-    int oldValue = value();
-    m_currentPos = newPos;
-    updateThumbPosition();
-    
-    if (value() != oldValue && client())
-        client()->valueChanged(this);
-    
-    // return true even if the integer value did not change so that scroll event gets eaten
-    return true;
+    return setCurrentPos(max(min(newPos, maxPos), 0.0f));
 }
 
 void Scrollbar::updateThumbPosition()
@@ -269,15 +251,30 @@ void Scrollbar::moveThumb(int pos)
     int thumbLen = theme()->thumbLength(this);
     int trackLen = theme()->trackLength(this);
     int maxPos = trackLen - thumbLen;
-    int delta = pos - pressedPos();
+    int delta = pos - m_pressedPos;
     if (delta > 0)
         delta = min(maxPos - thumbPos, delta);
     else if (delta < 0)
         delta = max(-thumbPos, delta);
-    if (delta) {
-        setValue(static_cast<int>(static_cast<float>(thumbPos + delta) * maximum() / (trackLen - thumbLen)));
-        setPressedPos(pressedPos() + theme()->thumbPosition(this) - thumbPos);
-    }
+    if (delta)
+        setCurrentPos(static_cast<float>(thumbPos + delta) * maximum() / (trackLen - thumbLen));
+}
+
+bool Scrollbar::setCurrentPos(float pos)
+{
+    if (pos == m_currentPos)
+        return false;
+
+    int oldValue = value();
+    int oldThumbPos = theme()->thumbPosition(this);
+    m_currentPos = pos;
+    updateThumbPosition();
+    if (m_pressedPart == ThumbPart)
+        setPressedPos(m_pressedPos + theme()->thumbPosition(this) - oldThumbPos);
+
+    if (value() != oldValue && client())
+        client()->valueChanged(this);
+    return true;
 }
 
 void Scrollbar::setHoveredPart(ScrollbarPart part)
@@ -287,7 +284,7 @@ void Scrollbar::setHoveredPart(ScrollbarPart part)
 
     if ((m_hoveredPart == NoPart || part == NoPart) && theme()->invalidateOnMouseEnterExit())
         invalidate();  // Just invalidate the whole scrollbar, since the buttons at either end change anyway.
-    else if (m_pressedPart == NoPart) {
+    else if (m_pressedPart == NoPart) {  // When there's a pressed part, we don't draw a hovered state, so there's no reason to invalidate.
         theme()->invalidatePart(this, part);
         theme()->invalidatePart(this, m_hoveredPart);
     }
@@ -301,14 +298,20 @@ void Scrollbar::setPressedPart(ScrollbarPart part)
     m_pressedPart = part;
     if (m_pressedPart != NoPart)
         theme()->invalidatePart(this, m_pressedPart);
+    else if (m_hoveredPart != NoPart)  // When we no longer have a pressed part, we can start drawing a hovered state on the hovered part.
+        theme()->invalidatePart(this, m_hoveredPart);
 }
 
 bool Scrollbar::mouseMoved(const PlatformMouseEvent& evt)
 {
     if (m_pressedPart == ThumbPart) {
-        moveThumb(m_orientation == HorizontalScrollbar ? 
-                  convertFromContainingWindow(evt.pos()).x() :
-                  convertFromContainingWindow(evt.pos()).y());
+        if (theme()->shouldSnapBackToDragOrigin(this, evt))
+            setCurrentPos(m_dragOrigin);
+        else {
+            moveThumb(m_orientation == HorizontalScrollbar ? 
+                      convertFromContainingWindow(evt.pos()).x() :
+                      convertFromContainingWindow(evt.pos()).y());
+        }
         return true;
     }
 
@@ -364,9 +367,10 @@ bool Scrollbar::mouseDown(const PlatformMouseEvent& evt)
     setPressedPart(theme()->hitTest(this, evt));
     int pressedPos = (orientation() == HorizontalScrollbar ? convertFromContainingWindow(evt.pos()).x() : convertFromContainingWindow(evt.pos()).y());
     
-    if ((pressedPart() == BackTrackPart || pressedPart() == ForwardTrackPart) && theme()->shouldCenterOnThumb(this, evt)) {
+    if ((m_pressedPart == BackTrackPart || m_pressedPart == ForwardTrackPart) && theme()->shouldCenterOnThumb(this, evt)) {
         setHoveredPart(ThumbPart);
         setPressedPart(ThumbPart);
+        m_dragOrigin = m_currentPos;
         int thumbLen = theme()->thumbLength(this);
         int desiredPos = pressedPos;
         // Set the pressed position to the middle of the thumb so that when we do the move, the delta
@@ -374,7 +378,8 @@ bool Scrollbar::mouseDown(const PlatformMouseEvent& evt)
         m_pressedPos = theme()->trackPosition(this) + theme()->thumbPosition(this) + thumbLen / 2;
         moveThumb(desiredPos);
         return true;
-    }
+    } else if (m_pressedPart == ThumbPart)
+        m_dragOrigin = m_currentPos;
     
     m_pressedPos = pressedPos;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/Scrollbar.h b/src/3rdparty/webkit/WebCore/platform/Scrollbar.h
index 9238a77666..19d95d73c5 100644
--- a/src/3rdparty/webkit/WebCore/platform/Scrollbar.h
+++ b/src/3rdparty/webkit/WebCore/platform/Scrollbar.h
@@ -42,8 +42,7 @@ class ScrollbarTheme;
 class PlatformMouseEvent;
 
 // These match the numbers we use over in WebKit (WebFrameView.m).
-const int cScrollbarPixelsPerLineStep =  40;
-const float cMouseWheelPixelsPerLineStep = 40.0f / 3.0f;
+const int cScrollbarPixelsPerLineStep = 40;
 const int cAmountToKeepWhenPaging = 40;
 
 class Scrollbar : public Widget, public RefCounted<Scrollbar> {
@@ -126,6 +125,9 @@ public:
 
     virtual void styleChanged() { }
 
+private:
+    virtual bool isScrollbar() const { return true; }
+
 protected:
     virtual void updateThumbPosition();
     virtual void updateThumbProportion();
@@ -138,6 +140,7 @@ protected:
     ScrollGranularity pressedPartScrollGranularity();
     
     void moveThumb(int pos);
+    bool setCurrentPos(float pos);
 
     ScrollbarClient* m_client;
     ScrollbarOrientation m_orientation;
@@ -147,6 +150,7 @@ protected:
     int m_visibleSize;
     int m_totalSize;
     float m_currentPos;
+    float m_dragOrigin;
     int m_lineStep;
     int m_pageStep;
     float m_pixelStep;
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h b/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h
index e2aebc6231..9327dc6620 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollbarTheme.h
@@ -76,6 +76,7 @@ public:
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white); }
 
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
+    virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
     virtual int thumbPosition(Scrollbar*) { return 0; } // The position of the thumb relative to the track.
     virtual int thumbLength(Scrollbar*) { return 0; } // The length of the thumb along the axis of the scrollbar.
     virtual int trackPosition(Scrollbar*) { return 0; } // The position of the track relative to the scrollbar.
diff --git a/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h b/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h
index 307bcd25c7..3404a0c5ae 100644
--- a/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/SharedBuffer.h
@@ -26,8 +26,9 @@
 #define SharedBuffer_h
 
 #include "PlatformString.h"
-#include <wtf/RefCounted.h>
 #include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(CF)
@@ -69,6 +70,7 @@ public:
 #endif
 #if PLATFORM(CF)
     CFDataRef createCFData();
+    static PassRefPtr<SharedBuffer> wrapCFData(CFDataRef);
 #endif
 
     const char* data() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/SharedTimer.h b/src/3rdparty/webkit/WebCore/platform/SharedTimer.h
index 4cc90a2263..a005add87f 100644
--- a/src/3rdparty/webkit/WebCore/platform/SharedTimer.h
+++ b/src/3rdparty/webkit/WebCore/platform/SharedTimer.h
@@ -28,17 +28,46 @@
 
 namespace WebCore {
 
-    // Single timer, shared to implement all the timers managed by the Timer class.
+    // Each thread has its own single instance of shared timer, which implements this interface.
+    // This instance is shared by all timers in the thread.
     // Not intended to be used directly; use the Timer class instead.
+    class SharedTimer {
+    public:
+        virtual ~SharedTimer() {}
+        virtual void setFiredFunction(void (*)()) = 0;
 
-    void setSharedTimerFiredFunction(void (*)());
+        // The fire time is relative to the classic POSIX epoch of January 1, 1970,
+        // as the result of currentTime() is.
+        virtual void setFireTime(double) = 0;
+        virtual void stop() = 0;
+    };
 
-    // The fire time is relative to the classic POSIX epoch of January 1, 1970,
-    // as the result of currentTime() is.
 
-    void setSharedTimerFireTime(double fireTime);
+    // Implemented by port (since it provides the run loop for the main thread).
+    // FIXME: make ports implement MainThreadSharedTimer directly instead.
+    void setSharedTimerFiredFunction(void (*)());
+    void setSharedTimerFireTime(double);
     void stopSharedTimer();
 
-}
+    // Implementation of SharedTimer for the main thread.
+    class MainThreadSharedTimer : public SharedTimer {
+    public:
+        virtual void setFiredFunction(void (*function)())
+        {
+            setSharedTimerFiredFunction(function);
+        }
+        
+        virtual void setFireTime(double fireTime)
+        {
+            setSharedTimerFireTime(fireTime);
+        }
+        
+        virtual void stop()
+        {
+            stopSharedTimer();
+        }
+    };
+
+} // namespace WebCore
 
-#endif
+#endif // SharedTimer_h
diff --git a/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
new file mode 100644
index 0000000000..7171102461
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SuddenTermination_h
+#define SuddenTermination_h
+
+#include <wtf/Platform.h>
+
+namespace WebCore {
+
+    void disableSuddenTermination();
+    void enableSuddenTermination();
+
+#if (!PLATFORM(MAC) || defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)) && !PLATFORM(CHROMIUM)
+    inline void disableSuddenTermination() { }
+    inline void enableSuddenTermination() { }
+#endif
+
+} // namespace WebCore
+
+#endif // SuddenTermination_h
diff --git a/src/3rdparty/webkit/WebCore/platform/SystemTime.h b/src/3rdparty/webkit/WebCore/platform/SystemTime.h
index 2b1eed00c7..361d4465b0 100644
--- a/src/3rdparty/webkit/WebCore/platform/SystemTime.h
+++ b/src/3rdparty/webkit/WebCore/platform/SystemTime.h
@@ -28,10 +28,6 @@
 
 namespace WebCore {
 
-    // Return the current system time in seconds, using the classic POSIX epoch of January 1, 1970.
-    // Like time(0) from <time.h>, except with a wider range of values and higher precision.
-    double currentTime();
-
     // Return the number of seconds since a user event has been generated
     float userIdleTime();
     
diff --git a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
index 8d73ea3ff9..ae85a63880 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
@@ -46,8 +46,9 @@ typedef unsigned ControlStates;
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
     ButtonBevelPart, DefaultButtonPart, ListboxPart, ListItemPart, 
-    MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart,
-    MediaSeekBackButtonPart, MediaSeekForwardButtonPart, MediaSliderPart, MediaSliderThumbPart,
+    MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
+    MediaSeekForwardButtonPart, MediaSliderPart, MediaSliderThumbPart, MediaTimelineContainerPart,
+    MediaCurrentTimePart, MediaTimeRemainingPart, 
     MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart,
     SliderHorizontalPart, SliderVerticalPart, SliderThumbHorizontalPart,
     SliderThumbVerticalPart, CaretPart, SearchFieldPart, SearchFieldDecorationPart,
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadCheck.h b/src/3rdparty/webkit/WebCore/platform/ThreadCheck.h
index d1ff4a449c..07eb463b05 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThreadCheck.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadCheck.h
@@ -33,12 +33,18 @@ namespace WebCore {
         LogOnThreadViolation,
         RaiseExceptionOnThreadViolation
     };
-    void setDefaultThreadViolationBehavior(ThreadViolationBehavior);
-    void reportThreadViolation(const char* function);
+    enum ThreadViolationRound {
+        ThreadViolationRoundOne = 0,
+        ThreadViolationRoundTwo,
+        MaximumThreadViolationRound
+    };
+    void setDefaultThreadViolationBehavior(ThreadViolationBehavior, ThreadViolationRound);
+    void reportThreadViolation(const char* function, ThreadViolationRound);
 }
 
-extern "C" void WebCoreReportThreadViolation(const char* function);
+extern "C" void WebCoreReportThreadViolation(const char* function, WebCore::ThreadViolationRound);
 
-#define WebCoreThreadViolationCheck() ::WebCore::reportThreadViolation(WTF_PRETTY_FUNCTION)
+#define WebCoreThreadViolationCheckRoundOne() ::WebCore::reportThreadViolation(WTF_PRETTY_FUNCTION, WebCore::ThreadViolationRoundOne)
+#define WebCoreThreadViolationCheckRoundTwo() ::WebCore::reportThreadViolation(WTF_PRETTY_FUNCTION, WebCore::ThreadViolationRoundTwo)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp
index 9bf0bf2570..a43e9bd564 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.cpp
@@ -29,9 +29,10 @@
 
 #include "EventNames.h"
 #include "StringImpl.h"
+#include "ThreadTimers.h"
 #include <wtf/UnusedParam.h>
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
 #include "TextCodecICU.h"
 #endif
 
@@ -70,7 +71,11 @@ ThreadGlobalData::ThreadGlobalData()
     : m_emptyString(new StringImpl)
     , m_atomicStringTable(new HashSet<StringImpl*>)
     , m_eventNames(new EventNames)
-#if USE(ICU_UNICODE)
+    , m_threadTimers(new ThreadTimers)
+#ifndef NDEBUG
+    , m_isMainThread(isMainThread())
+#endif
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     , m_cachedConverterICU(new ICUConverterWrapper)
 #endif
 #if PLATFORM(MAC)
@@ -84,14 +89,20 @@ ThreadGlobalData::~ThreadGlobalData()
 #if PLATFORM(MAC)
     delete m_cachedConverterTEC;
 #endif
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     delete m_cachedConverterICU;
 #endif
 
     delete m_eventNames;
     delete m_atomicStringTable;
+    delete m_threadTimers;
+
+    // Using member variable m_isMainThread instead of calling WTF::isMainThread() directly
+    // to avoid issues described in https://bugs.webkit.org/show_bug.cgi?id=25973.
+    // In short, some pthread-based platforms and ports can not use WTF::CurrentThread() and WTF::isMainThread()
+    // in destructors of thread-specific data.
+    ASSERT(m_isMainThread || m_emptyString->hasOneRef()); // We intentionally don't clean up static data on application quit, so there will be many strings remaining on the main thread.
 
-    ASSERT(isMainThread() || m_emptyString->hasOneRef()); // We intentionally don't clean up static data on application quit, so there will be many strings remaining on the main thread.
     delete m_emptyString;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h
index 17637aa1a3..e0aa092081 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadGlobalData.h
@@ -36,6 +36,7 @@ namespace WebCore {
     class EventNames;
     struct ICUConverterWrapper;
     struct TECConverterWrapper;
+    class ThreadTimers;
 
     class ThreadGlobalData : Noncopyable {
     public:
@@ -45,8 +46,9 @@ namespace WebCore {
         EventNames& eventNames() { return *m_eventNames; }
         StringImpl* emptyString() { return m_emptyString; }
         HashSet<StringImpl*>& atomicStringTable() { return *m_atomicStringTable; }
+        ThreadTimers& threadTimers() { return *m_threadTimers; }
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
         ICUConverterWrapper& cachedConverterICU() { return *m_cachedConverterICU; }
 #endif
 
@@ -58,8 +60,13 @@ namespace WebCore {
         StringImpl* m_emptyString;
         HashSet<StringImpl*>* m_atomicStringTable;
         EventNames* m_eventNames;
+        ThreadTimers* m_threadTimers;
 
-#if USE(ICU_UNICODE)
+#ifndef NDEBUG
+        bool m_isMainThread;
+#endif
+
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
         ICUConverterWrapper* m_cachedConverterICU;
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadTimers.cpp b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.cpp
new file mode 100644
index 0000000000..71a06b0293
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ThreadTimers.h"
+
+#include "SharedTimer.h"
+#include "ThreadGlobalData.h"
+#include "Timer.h"
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+// Timers are created, started and fired on the same thread, and each thread has its own ThreadTimers
+// copy to keep the heap and a set of currently firing timers.
+
+static MainThreadSharedTimer* mainThreadSharedTimer()
+{
+    static MainThreadSharedTimer* timer = new MainThreadSharedTimer;
+    return timer;
+}
+
+ThreadTimers::ThreadTimers()
+    : m_sharedTimer(0)
+    , m_firingTimers(false)
+{
+    if (isMainThread())
+        setSharedTimer(mainThreadSharedTimer());
+}
+
+// A worker thread may initialize SharedTimer after some timers are created.
+// Also, SharedTimer can be replaced with 0 before all timers are destroyed.
+void ThreadTimers::setSharedTimer(SharedTimer* sharedTimer)
+{
+    if (m_sharedTimer) {
+        m_sharedTimer->setFiredFunction(0);
+        m_sharedTimer->stop();
+    }
+    
+    m_sharedTimer = sharedTimer;
+    
+    if (sharedTimer) {
+        m_sharedTimer->setFiredFunction(ThreadTimers::sharedTimerFired);
+        updateSharedTimer();
+    }
+}
+
+void ThreadTimers::updateSharedTimer()
+{
+    if (!m_sharedTimer)
+        return;
+        
+    if (m_firingTimers || m_timerHeap.isEmpty())
+        m_sharedTimer->stop();
+    else
+        m_sharedTimer->setFireTime(m_timerHeap.first()->m_nextFireTime);
+}
+
+
+void ThreadTimers::collectFiringTimers(double fireTime, Vector<TimerBase*>& firingTimers)
+{
+    while (!m_timerHeap.isEmpty() && m_timerHeap.first()->m_nextFireTime <= fireTime) {
+        TimerBase* timer = m_timerHeap.first();
+        firingTimers.append(timer);
+        m_timersReadyToFire.add(timer);
+        timer->m_nextFireTime = 0;
+        timer->heapDeleteMin();
+    }
+}
+
+void ThreadTimers::fireTimers(double fireTime, const Vector<TimerBase*>& firingTimers)
+{
+    size_t size = firingTimers.size();
+    for (size_t i = 0; i != size; ++i) {
+        TimerBase* timer = firingTimers[i];
+
+        // If not in the set, this timer has been deleted or re-scheduled in another timer's fired function.
+        // So either we don't want to fire it at all or we will fire it next time the shared timer goes off.
+        // It might even have been deleted; that's OK because we won't do anything else with the pointer.
+        if (!m_timersReadyToFire.contains(timer))
+            continue;
+
+        // Setting the next fire time has a side effect of removing the timer from the firing timers set.
+        double interval = timer->repeatInterval();
+        timer->setNextFireTime(interval ? fireTime + interval : 0);
+
+        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
+        timer->fired();
+
+        // Catch the case where the timer asked timers to fire in a nested event loop.
+        if (!m_firingTimers)
+            break;
+    }
+}
+
+void ThreadTimers::sharedTimerFired()
+{
+    // Redirect to non-static method.
+    threadGlobalData().threadTimers().sharedTimerFiredInternal();
+}
+
+void ThreadTimers::sharedTimerFiredInternal()
+{
+    // Do a re-entrancy check.
+    if (m_firingTimers)
+        return;
+    m_firingTimers = true;
+
+    double fireTime = currentTime();
+    Vector<TimerBase*> firingTimers;
+
+    // m_timersReadyToFire will initially contain the same set as firingTimers, but
+    // as timers fire some mat become re-scheduled or deleted. They get removed from
+    // m_timersReadyToFire so we can avoid firing them.
+    ASSERT(m_timersReadyToFire.isEmpty());
+
+    collectFiringTimers(fireTime, firingTimers);
+    fireTimers(fireTime, firingTimers);
+
+    m_timersReadyToFire.clear();
+    m_firingTimers = false;
+
+    updateSharedTimer();
+}
+
+void ThreadTimers::fireTimersInNestedEventLoop()
+{
+    // Reset the reentrancy guard so the timers can fire again.
+    m_firingTimers = false;
+    m_timersReadyToFire.clear();
+    updateSharedTimer();
+}
+
+} // namespace WebCore
+
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadTimers.h b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.h
new file mode 100644
index 0000000000..366c32073e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ThreadTimer_h
+#define ThreadTimer_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class SharedTimer;
+    class TimerBase;
+
+    // A collection of timers per thread. Kept in ThreadGlobalData.
+    class ThreadTimers : Noncopyable {
+    public:
+        ThreadTimers();
+
+        // On a thread different then main, we should set the thread's instance of the SharedTimer.
+        void setSharedTimer(SharedTimer*);
+
+        Vector<TimerBase*>& timerHeap() { return m_timerHeap; }
+        HashSet<const TimerBase*>& timersReadyToFire() { return m_timersReadyToFire; }
+
+        void updateSharedTimer();
+        void fireTimersInNestedEventLoop();
+
+    private:
+        static void sharedTimerFired();
+
+        void fireTimers(double fireTime, const Vector<TimerBase*>&);
+        void collectFiringTimers(double fireTime, Vector<TimerBase*>&);
+        void sharedTimerFiredInternal();
+        void fireTimersInNestedEventLoopInternal();
+
+        Vector<TimerBase*> m_timerHeap;
+        HashSet<const TimerBase*> m_timersReadyToFire; // Temporarily holds a pointer to a stack object. No ownership.
+        SharedTimer* m_sharedTimer; // External object, can be a run loop on a worker thread. Normally set/reset by worker thread.
+        bool m_firingTimers; // Reentrancy guard.
+    };
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/Timer.cpp b/src/3rdparty/webkit/WebCore/platform/Timer.cpp
index 94e2af8eec..bd29fd8b74 100644
--- a/src/3rdparty/webkit/WebCore/platform/Timer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Timer.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +28,12 @@
 #include "Timer.h"
 
 #include "SharedTimer.h"
-#include "SystemTime.h"
+#include "ThreadGlobalData.h"
+#include "ThreadTimers.h"
 #include <limits.h>
 #include <limits>
 #include <math.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 
@@ -44,29 +47,38 @@ namespace WebCore {
 //
 // When a timer's "next fire time" changes, we need to move it around in the priority queue.
 
-// ----------------
-
-static bool deferringTimers;
-static Vector<TimerBase*>* timerHeap;
-static HashSet<const TimerBase*>* timersReadyToFire;
+// Simple accessors to thread-specific data.
+static Vector<TimerBase*>& timerHeap()
+{
+    return threadGlobalData().threadTimers().timerHeap();
+}
 
-// ----------------
+static HashSet<const TimerBase*>& timersReadyToFire()
+{
+    return threadGlobalData().threadTimers().timersReadyToFire();
+}
 
 // Class to represent elements in the heap when calling the standard library heap algorithms.
 // Maintains the m_heapIndex value in the timers themselves, which allows us to do efficient
 // modification of the heap.
 class TimerHeapElement {
 public:
-    explicit TimerHeapElement(int i) : m_index(i), m_timer((*timerHeap)[m_index]) { checkConsistency(); }
+    explicit TimerHeapElement(int i)
+        : m_index(i)
+        , m_timer(timerHeap()[m_index])
+    { 
+        checkConsistency(); 
+    }
 
     TimerHeapElement(const TimerHeapElement&);
     TimerHeapElement& operator=(const TimerHeapElement&);
 
     TimerBase* timer() const { return m_timer; }
 
-    void checkConsistency() const {
+    void checkConsistency() const
+    {
         ASSERT(m_index >= 0);
-        ASSERT(m_index < (timerHeap ? static_cast<int>(timerHeap->size()) : 0));
+        ASSERT(m_index < static_cast<int>(timerHeap().size()));
     }
 
 private:
@@ -87,7 +99,7 @@ inline TimerHeapElement& TimerHeapElement::operator=(const TimerHeapElement& o)
     m_timer = t;
     if (m_index != -1) {
         checkConsistency();
-        (*timerHeap)[m_index] = t;
+        timerHeap()[m_index] = t;
         t->m_heapIndex = m_index;
     }
     return *this;
@@ -131,9 +143,10 @@ public:
 
     int index() const { return m_index; }
 
-    void checkConsistency(int offset = 0) const {
-        ASSERT(m_index + offset >= 0);
-        ASSERT(m_index + offset <= (timerHeap ? static_cast<int>(timerHeap->size()) : 0));
+    void checkConsistency(int offset = 0) const
+    {
+        ASSERT_UNUSED(offset, m_index + offset >= 0);
+        ASSERT_UNUSED(offset, m_index + offset <= static_cast<int>(timerHeap().size()));
     }
 
 private:
@@ -152,38 +165,34 @@ inline int operator-(TimerHeapIterator a, TimerHeapIterator b) { return a.index(
 
 // ----------------
 
-void updateSharedTimer()
-{
-    if (timersReadyToFire || deferringTimers || !timerHeap || timerHeap->isEmpty())
-        stopSharedTimer();
-    else
-        setSharedTimerFireTime(timerHeap->first()->m_nextFireTime);
-}
-
-// ----------------
-
 TimerBase::TimerBase()
-    : m_nextFireTime(0), m_repeatInterval(0), m_heapIndex(-1)
+    : m_nextFireTime(0)
+    , m_repeatInterval(0)
+    , m_heapIndex(-1)
+#ifndef NDEBUG
+    , m_thread(currentThread())
+#endif
 {
-    // We only need to do this once, but probably not worth trying to optimize it.
-    setSharedTimerFiredFunction(sharedTimerFired);
 }
 
 TimerBase::~TimerBase()
 {
     stop();
-
     ASSERT(!inHeap());
 }
 
 void TimerBase::start(double nextFireInterval, double repeatInterval)
 {
+    ASSERT(m_thread == currentThread());
+
     m_repeatInterval = repeatInterval;
     setNextFireTime(currentTime() + nextFireInterval);
 }
 
 void TimerBase::stop()
 {
+    ASSERT(m_thread == currentThread());
+
     m_repeatInterval = 0;
     setNextFireTime(0);
 
@@ -194,7 +203,9 @@ void TimerBase::stop()
 
 bool TimerBase::isActive() const
 {
-    return m_nextFireTime || (timersReadyToFire && timersReadyToFire->contains(this));
+    ASSERT(m_thread == currentThread());
+
+    return m_nextFireTime || timersReadyToFire().contains(this);
 }
 
 double TimerBase::nextFireInterval() const
@@ -208,11 +219,10 @@ double TimerBase::nextFireInterval() const
 
 inline void TimerBase::checkHeapIndex() const
 {
-    ASSERT(timerHeap);
-    ASSERT(!timerHeap->isEmpty());
+    ASSERT(!timerHeap().isEmpty());
     ASSERT(m_heapIndex >= 0);
-    ASSERT(m_heapIndex < static_cast<int>(timerHeap->size()));
-    ASSERT((*timerHeap)[m_heapIndex] == this);
+    ASSERT(m_heapIndex < static_cast<int>(timerHeap().size()));
+    ASSERT(timerHeap()[m_heapIndex] == this);
 }
 
 inline void TimerBase::checkConsistency() const
@@ -235,15 +245,15 @@ inline void TimerBase::heapDelete()
 {
     ASSERT(m_nextFireTime == 0);
     heapPop();
-    timerHeap->removeLast();
+    timerHeap().removeLast();
     m_heapIndex = -1;
 }
 
-inline void TimerBase::heapDeleteMin()
+void TimerBase::heapDeleteMin()
 {
     ASSERT(m_nextFireTime == 0);
     heapPopMin();
-    timerHeap->removeLast();
+    timerHeap().removeLast();
     m_heapIndex = -1;
 }
 
@@ -257,10 +267,8 @@ inline void TimerBase::heapIncreaseKey()
 inline void TimerBase::heapInsert()
 {
     ASSERT(!inHeap());
-    if (!timerHeap)
-        timerHeap = new Vector<TimerBase*>;
-    timerHeap->append(this);
-    m_heapIndex = timerHeap->size() - 1;
+    timerHeap().append(this);
+    m_heapIndex = timerHeap().size() - 1;
     heapDecreaseKey();
 }
 
@@ -276,19 +284,20 @@ inline void TimerBase::heapPop()
 
 void TimerBase::heapPopMin()
 {
-    ASSERT(this == timerHeap->first());
+    ASSERT(this == timerHeap().first());
     checkHeapIndex();
-    pop_heap(TimerHeapIterator(0), TimerHeapIterator(timerHeap->size()));
+    pop_heap(TimerHeapIterator(0), TimerHeapIterator(timerHeap().size()));
     checkHeapIndex();
-    ASSERT(this == timerHeap->last());
+    ASSERT(this == timerHeap().last());
 }
 
 void TimerBase::setNextFireTime(double newTime)
 {
+    ASSERT(m_thread == currentThread());
+
     // Keep heap valid while changing the next-fire time.
 
-    if (timersReadyToFire)
-        timersReadyToFire->remove(this);
+    timersReadyToFire().remove(this);
 
     double oldTime = m_nextFireTime;
     if (oldTime != newTime) {
@@ -310,87 +319,17 @@ void TimerBase::setNextFireTime(double newTime)
         bool isFirstTimerInHeap = m_heapIndex == 0;
 
         if (wasFirstTimerInHeap || isFirstTimerInHeap)
-            updateSharedTimer();
+            threadGlobalData().threadTimers().updateSharedTimer();
     }
 
     checkConsistency();
 }
 
-void TimerBase::collectFiringTimers(double fireTime, Vector<TimerBase*>& firingTimers)
-{
-    while (!timerHeap->isEmpty() && timerHeap->first()->m_nextFireTime <= fireTime) {
-        TimerBase* timer = timerHeap->first();
-        firingTimers.append(timer);
-        timersReadyToFire->add(timer);
-        timer->m_nextFireTime = 0;
-        timer->heapDeleteMin();
-    }
-}
-
-void TimerBase::fireTimers(double fireTime, const Vector<TimerBase*>& firingTimers)
-{
-    int size = firingTimers.size();
-    for (int i = 0; i != size; ++i) {
-        TimerBase* timer = firingTimers[i];
-
-        // If not in the set, this timer has been deleted or re-scheduled in another timer's fired function.
-        // So either we don't want to fire it at all or we will fire it next time the shared timer goes off.
-        // It might even have been deleted; that's OK because we won't do anything else with the pointer.
-        if (!timersReadyToFire->contains(timer))
-            continue;
-
-        // Setting the next fire time has a side effect of removing the timer from the firing timers set.
-        double interval = timer->repeatInterval();
-        timer->setNextFireTime(interval ? fireTime + interval : 0);
-
-        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
-        timer->fired();
-
-        // Catch the case where the timer asked timers to fire in a nested event loop.
-        if (!timersReadyToFire)
-            break;
-    }
-}
-
-void TimerBase::sharedTimerFired()
-{
-    // Do a re-entrancy check.
-    if (timersReadyToFire)
-        return;
-
-    double fireTime = currentTime();
-    Vector<TimerBase*> firingTimers;
-    HashSet<const TimerBase*> firingTimersSet;
-
-    timersReadyToFire = &firingTimersSet;
-
-    collectFiringTimers(fireTime, firingTimers);
-    fireTimers(fireTime, firingTimers);
-
-    timersReadyToFire = 0;
-
-    updateSharedTimer();
-}
-
 void TimerBase::fireTimersInNestedEventLoop()
 {
-    timersReadyToFire = 0;
-    updateSharedTimer();
-}
-
-// ----------------
-
-bool isDeferringTimers()
-{
-    return deferringTimers;
+    // Redirect to ThreadTimers.
+    threadGlobalData().threadTimers().fireTimersInNestedEventLoop();
 }
 
-void setDeferringTimers(bool shouldDefer)
-{
-    if (shouldDefer == deferringTimers)
-        return;
-    deferringTimers = shouldDefer;
-    updateSharedTimer();
-}
+} // namespace WebCore
 
-}
diff --git a/src/3rdparty/webkit/WebCore/platform/Timer.h b/src/3rdparty/webkit/WebCore/platform/Timer.h
index ba98ec5fb9..87235155bf 100644
--- a/src/3rdparty/webkit/WebCore/platform/Timer.h
+++ b/src/3rdparty/webkit/WebCore/platform/Timer.h
@@ -27,7 +27,7 @@
 #define Timer_h
 
 #include <wtf/Noncopyable.h>
-#include <wtf/Vector.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -73,18 +73,17 @@ private:
     void heapPop();
     void heapPopMin();
 
-    static void collectFiringTimers(double fireTime, Vector<TimerBase*>&);
-    static void fireTimers(double fireTime, const Vector<TimerBase*>&);
-    static void sharedTimerFired();
-
     double m_nextFireTime; // 0 if inactive
     double m_repeatInterval; // 0 if not repeating
     int m_heapIndex; // -1 if not in heap
     unsigned m_heapInsertionOrder; // Used to keep order among equal-fire-time timers
 
-    friend void updateSharedTimer();
-    friend void setDeferringTimers(bool);
+#ifndef NDEBUG
+    ThreadIdentifier m_thread;
+#endif
+
     friend class TimerHeapElement;
+    friend class ThreadTimers;
     friend bool operator<(const TimerHeapElement&, const TimerHeapElement&);
 };
 
@@ -102,11 +101,6 @@ private:
     TimerFiredFunction m_function;
 };
 
-// Set to true to prevent any timers from firing.
-// When set back to false, timers that were deferred will fire.
-bool isDeferringTimers();
-void setDeferringTimers(bool);
-
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/Widget.h b/src/3rdparty/webkit/WebCore/platform/Widget.h
index 2f22069a17..b6c0054144 100644
--- a/src/3rdparty/webkit/WebCore/platform/Widget.h
+++ b/src/3rdparty/webkit/WebCore/platform/Widget.h
@@ -137,7 +137,6 @@ public:
     virtual void setFocus();
 
     void setCursor(const Cursor&);
-    Cursor cursor();
 
     virtual void show();
     virtual void hide();
@@ -151,6 +150,7 @@ public:
 
     virtual bool isFrameView() const { return false; }
     virtual bool isPluginView() const { return false; }
+    virtual bool isScrollbar() const { return false; }
 
     void removeFromParent();
     virtual void setParent(ScrollView* view);
@@ -193,7 +193,7 @@ private:
     
     IntRect m_frame; // Not used when a native widget exists.
 
-#if PLATFORM(MAC) || PLATFORM(GTK)
+#if PLATFORM(MAC)
     WidgetPrivate* m_data;
 #endif
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.cpp b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.cpp
new file mode 100644
index 0000000000..0322e0194b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ClipboardAndroid.h"
+
+#include "CachedImage.h"
+#include "Element.h"
+#include "Frame.h"
+#include "Range.h"
+
+namespace WebCore {
+
+ClipboardAndroid::ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging)
+    : Clipboard(policy, isForDragging)
+{
+}
+
+ClipboardAndroid::~ClipboardAndroid()
+{
+}
+
+void ClipboardAndroid::clearData(const String&)
+{
+    ASSERT(isForDragging());
+}
+
+void ClipboardAndroid::clearAllData()
+{
+    ASSERT(isForDragging());
+}
+
+String ClipboardAndroid::getData(const String&, bool& success) const
+{     
+    success = false;
+    return "";
+}
+
+bool ClipboardAndroid::setData(const String&, const String&)
+{
+    ASSERT(isForDragging());
+    return false;
+}
+
+// extensions beyond IE's API
+HashSet<String> ClipboardAndroid::types() const
+{ 
+    return HashSet<String>();
+}
+
+void ClipboardAndroid::setDragImage(CachedImage*, const IntPoint&)
+{
+}
+
+void ClipboardAndroid::setDragImageElement(Node*, const IntPoint&)
+{
+}
+
+DragImageRef ClipboardAndroid::createDragImage(IntPoint&) const
+{
+    return 0;
+}
+
+void ClipboardAndroid::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*)
+{
+}
+
+void ClipboardAndroid::writeURL(const KURL&, const String&, Frame*)
+{
+}
+
+void ClipboardAndroid::writeRange(Range* selectedRange, Frame*)
+{
+    ASSERT(selectedRange);
+}
+
+bool ClipboardAndroid::hasData()
+{
+    return false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextDecoder.h b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h
index 171cb5998e..7761704af0 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextDecoder.h
+++ b/src/3rdparty/webkit/WebCore/platform/android/ClipboardAndroid.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright 2009, The Android Open Source Project
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,42 +24,41 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef TextDecoder_h
-#define TextDecoder_h
+#ifndef ClipboardAndroid_h
+#define ClipboardAndroid_h
 
-#include "PlatformString.h"
-#include "TextCodec.h"
-#include "TextEncoding.h"
-#include <wtf/OwnPtr.h>
+#include "Clipboard.h"
+
+#include "CachedResourceClient.h"
 
 namespace WebCore {
 
-    class TextCodec;
+    class CachedImage;
 
-    class TextDecoder {
+    class ClipboardAndroid : public Clipboard, public CachedResourceClient {
     public:
-        TextDecoder(const TextEncoding&);
-        void reset(const TextEncoding&);
-        const TextEncoding& encoding() const { return m_encoding; };
-
-        String decode(const char* data, size_t length, bool flush, bool stopOnError, bool& sawError)
-        {
-            if (!m_checkedForBOM)
-                return checkForBOM(data, length, flush, stopOnError, sawError);
-            return m_codec->decode(data, length, flush, stopOnError, sawError);
-        }
-
-    private:
-        String checkForBOM(const char*, size_t length, bool flush, bool stopOnError, bool& sawError);
-
-        TextEncoding m_encoding;
-        OwnPtr<TextCodec> m_codec;
+        ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging);
+        ~ClipboardAndroid();
+    
+        void clearData(const String&);
+        void clearAllData();
+        String getData(const String&, bool& success) const;
+        bool setData(const String&, const String&);
+    
+        // extensions beyond IE's API
+        HashSet<String> types() const;
+    
+        void setDragImage(CachedImage*, const IntPoint&);
+        void setDragImageElement(Node*, const IntPoint&);
+        
+        virtual DragImageRef createDragImage(IntPoint&) const;
+        virtual void declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*);
+        virtual void writeURL(const KURL&, const String&, Frame*);
+        virtual void writeRange(Range*, Frame*);
 
-        bool m_checkedForBOM;
-        unsigned char m_numBufferedBytes;
-        unsigned char m_bufferedBytes[3];
+        virtual bool hasData();
     };
 
 } // namespace WebCore
 
-#endif // TextDecoder_h
+#endif // ClipboardAndroid_h
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp b/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp
index 5df4480800..05761f8d39 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/animation/Animation.cpp
@@ -25,13 +25,13 @@
 namespace WebCore {
 
 Animation::Animation()
-    : m_delay(initialAnimationDelay())
-    , m_direction(initialAnimationDirection())
-    , m_duration(initialAnimationDuration())
-    , m_iterationCount(initialAnimationIterationCount())
-    , m_name(initialAnimationName())
+    : m_name(initialAnimationName())
     , m_property(initialAnimationProperty())
+    , m_iterationCount(initialAnimationIterationCount())
+    , m_delay(initialAnimationDelay())
+    , m_duration(initialAnimationDuration())
     , m_timingFunction(initialAnimationTimingFunction())
+    , m_direction(initialAnimationDirection())
     , m_playState(initialAnimationPlayState())
     , m_delaySet(false)
     , m_directionSet(false)
@@ -47,13 +47,13 @@ Animation::Animation()
 
 Animation::Animation(const Animation& o)
     : RefCounted<Animation>()
-    , m_delay(o.m_delay)
-    , m_direction(o.m_direction)
-    , m_duration(o.m_duration)
-    , m_iterationCount(o.m_iterationCount)
     , m_name(o.m_name)
     , m_property(o.m_property)
+    , m_iterationCount(o.m_iterationCount)
+    , m_delay(o.m_delay)
+    , m_duration(o.m_duration)
     , m_timingFunction(o.m_timingFunction)
+    , m_direction(o.m_direction)
     , m_playState(o.m_playState)
     , m_delaySet(o.m_delaySet)
     , m_directionSet(o.m_directionSet)
@@ -69,14 +69,14 @@ Animation::Animation(const Animation& o)
 
 Animation& Animation::operator=(const Animation& o)
 {
-    m_delay = o.m_delay;
-    m_direction = o.m_direction;
-    m_duration = o.m_duration;
-    m_iterationCount = o.m_iterationCount;
     m_name = o.m_name;
-    m_playState = o.m_playState;
     m_property = o.m_property;
+    m_iterationCount = o.m_iterationCount;
+    m_delay = o.m_delay;
+    m_duration = o.m_duration;
     m_timingFunction = o.m_timingFunction;
+    m_direction = o.m_direction;
+    m_playState = o.m_playState;
 
     m_delaySet = o.m_delaySet;
     m_directionSet = o.m_directionSet;
@@ -86,7 +86,6 @@ Animation& Animation::operator=(const Animation& o)
     m_playStateSet = o.m_playStateSet;
     m_propertySet = o.m_propertySet;
     m_timingFunctionSet = o.m_timingFunctionSet;
-
     m_isNone = o.m_isNone;
 
     return *this;
@@ -101,13 +100,13 @@ bool Animation::animationsMatch(const Animation* o, bool matchPlayStates) const
     if (!o)
         return false;
     
-    bool result = m_delay == o->m_delay &&
-                  m_direction == o->m_direction &&
-                  m_duration == o->m_duration &&
-                  m_iterationCount == o->m_iterationCount &&
-                  m_name == o->m_name &&
+    bool result = m_name == o->m_name &&
                   m_property == o->m_property && 
+                  m_iterationCount == o->m_iterationCount &&
+                  m_delay == o->m_delay &&
+                  m_duration == o->m_duration &&
                   m_timingFunction == o->m_timingFunction &&
+                  m_direction == o->m_direction &&
                   m_delaySet == o->m_delaySet &&
                   m_directionSet == o->m_directionSet &&
                   m_durationSet == o->m_durationSet &&
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/Animation.h b/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
index 294acdffd1..9e1e8e1c2b 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
+++ b/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
@@ -35,6 +35,12 @@ namespace WebCore {
 const int cAnimateNone = 0;
 const int cAnimateAll = -2;
 
+// These were in RenderStyle, but have been moved here as
+// animation-play-state is in the process of being removed.
+
+const unsigned AnimPlayStatePlaying = 0;
+const unsigned AnimPlayStatePaused = 1;
+
 class Animation : public RefCounted<Animation> {
 public:
     ~Animation();
@@ -77,8 +83,13 @@ public:
     void clearTimingFunction() { m_timingFunctionSet = false; }
 
     double delay() const { return m_delay; }
-    bool direction() const { return m_direction; }
+
+    enum AnimationDirection { AnimationDirectionNormal, AnimationDirectionAlternate };
+    AnimationDirection direction() const { return m_direction; }
+
     double duration() const { return m_duration; }
+
+    enum { IterationCountInfinite = -1 };
     int iterationCount() const { return m_iterationCount; }
     const String& name() const { return m_name; }
     unsigned playState() const { return m_playState; }
@@ -86,7 +97,7 @@ public:
     const TimingFunction& timingFunction() const { return m_timingFunction; }
 
     void setDelay(double c) { m_delay = c; m_delaySet = true; }
-    void setDirection(bool d) { m_direction = d; m_directionSet = true; }
+    void setDirection(AnimationDirection d) { m_direction = d; m_directionSet = true; }
     void setDuration(double d) { ASSERT(d >= 0); m_duration = d; m_durationSet = true; }
     void setIterationCount(int c) { m_iterationCount = c; m_iterationCountSet = true; }
     void setName(const String& n) { m_name = n; m_nameSet = true; }
@@ -109,13 +120,13 @@ private:
     Animation();
     Animation(const Animation& o);
     
-    double m_delay;
-    bool m_direction;
-    double m_duration;
-    int m_iterationCount;
     String m_name;
     int m_property;
+    int m_iterationCount;
+    double m_delay;
+    double m_duration;
     TimingFunction m_timingFunction;
+    AnimationDirection m_direction : 1;
 
     unsigned m_playState     : 2;
 
@@ -132,7 +143,7 @@ private:
 
 public:
     static float initialAnimationDelay() { return 0; }
-    static bool initialAnimationDirection() { return false; }
+    static AnimationDirection initialAnimationDirection() { return AnimationDirectionNormal; }
     static double initialAnimationDuration() { return 0; }
     static int initialAnimationIterationCount() { return 1; }
     static String initialAnimationName() { return String("none"); }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
index 779787e17c..8933d7b496 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
@@ -30,11 +30,11 @@
 #include "FloatRect.h"
 #include "ImageObserver.h"
 #include "IntRect.h"
+#include "MIMETypeRegistry.h"
 #include "PlatformString.h"
-#include "SystemTime.h"
 #include "Timer.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
-#include "MIMETypeRegistry.h"
 
 namespace WebCore {
 
@@ -53,6 +53,7 @@ BitmapImage::BitmapImage(ImageObserver* observer)
     , m_repetitionsComplete(0)
     , m_desiredFrameStartTime(0)
     , m_isSolidColor(false)
+    , m_checkedForSolidColor(false)
     , m_animationFinished(false)
     , m_allDataReceived(false)
     , m_haveSize(false)
@@ -75,8 +76,13 @@ void BitmapImage::destroyDecodedData(bool destroyAll)
 {
     int framesCleared = 0;
     const size_t clearBeforeFrame = destroyAll ? m_frames.size() : m_currentFrame;
-    for (size_t i = 0; i < clearBeforeFrame; ++i)
-        framesCleared += clearFrame(i);
+    for (size_t i = 0; i < clearBeforeFrame; ++i) {
+        // The underlying frame isn't actually changing (we're just trying to
+        // save the memory for the framebuffer data), so we don't need to clear
+        // the metadata.
+        if (m_frames[i].clear(false))
+          ++framesCleared;
+    }
 
     destroyMetadataAndNotify(framesCleared);
 
@@ -89,7 +95,7 @@ void BitmapImage::destroyDecodedDataIfNecessary(bool destroyAll)
     // Animated images >5MB are considered large enough that we'll only hang on
     // to one frame at a time.
     static const unsigned cLargeAnimationCutoff = 5242880;
-    if (frameCount() * frameBytes(m_size) > cLargeAnimationCutoff)
+    if (m_frames.size() * frameBytes(m_size) > cLargeAnimationCutoff)
         destroyDecodedData(destroyAll);
 }
 
@@ -104,15 +110,6 @@ void BitmapImage::destroyMetadataAndNotify(int framesCleared)
         imageObserver()->decodedSizeChanged(this, deltaBytes);
 }
 
-int BitmapImage::clearFrame(size_t frame)
-{
-    if (!m_frames[frame].m_frame)
-        return 0;
-
-    m_frames[frame].clear();
-    return 1;
-}
-
 void BitmapImage::cacheFrame(size_t index)
 {
     size_t numFrames = frameCount();
@@ -160,7 +157,9 @@ IntSize BitmapImage::currentFrameSize() const
 
 bool BitmapImage::dataChanged(bool allDataReceived)
 {
-    destroyMetadataAndNotify(m_frames.isEmpty() ? 0 : clearFrame(m_frames.size() - 1));
+    // Because we're modifying the current frame, clear its (now possibly
+    // inaccurate) metadata as well.
+    destroyMetadataAndNotify((!m_frames.isEmpty() && m_frames[m_frames.size() - 1].clear(true)) ? 1 : 0);
     
     // Feed all the data we've seen so far to the image decoder.
     m_allDataReceived = allDataReceived;
@@ -287,7 +286,7 @@ void BitmapImage::startAnimation(bool catchUpIfNecessary)
 
     // Don't advance the animation to an incomplete frame.
     size_t nextFrame = (m_currentFrame + 1) % frameCount();
-    if (!frameIsCompleteAtIndex(nextFrame))
+    if (!m_allDataReceived && !frameIsCompleteAtIndex(nextFrame))
         return;
 
     // Don't advance past the last frame if we haven't decoded the whole image
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
index 95dadd8378..8b770a1734 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
@@ -75,10 +75,12 @@ struct FrameData : Noncopyable {
 
     ~FrameData()
     { 
-        clear();
+        clear(true);
     }
 
-    void clear();
+    // Clear the cached image data on the frame, and (optionally) the metadata.
+    // Returns whether there was cached image data to clear.
+    bool clear(bool clearMetadata);
 
     NativeImagePtr m_frame;
     bool m_haveMetadata;
@@ -138,6 +140,10 @@ public:
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
 
+#if PLATFORM(GTK)
+    virtual GdkPixbuf* getGdkPixbuf();
+#endif
+
     virtual NativeImagePtr nativeImageForCurrentFrame() { return frameAtIndex(currentFrame()); }
 
 protected:
@@ -185,10 +191,6 @@ protected:
     // decreased by |framesCleared| times the size (in bytes) of a frame.
     void destroyMetadataAndNotify(int framesCleared);
 
-    // If frame |frame| is cached, clears the cache handle.  Returns the number
-    // of frames actually cleared.
-    int clearFrame(size_t frame);
-
     // Whether or not size is available yet.    
     bool isSizeAvailable();
 
@@ -210,9 +212,18 @@ protected:
     void invalidatePlatformData();
     
     // Checks to see if the image is a 1x1 solid color.  We optimize these images and just do a fill rect instead.
+    // This check should happen regardless whether m_checkedForSolidColor is already set, as the frame may have
+    // changed.
     void checkForSolidColor();
     
-    virtual bool mayFillWithSolidColor() const { return m_isSolidColor && m_currentFrame == 0; }
+    virtual bool mayFillWithSolidColor()
+    {
+        if (!m_checkedForSolidColor && frameCount() > 0) {
+            checkForSolidColor();
+            ASSERT(m_checkedForSolidColor);
+        }
+        return m_isSolidColor && m_currentFrame == 0;
+    }
     virtual Color solidColor() const { return m_solidColor; }
     
     ImageSource m_source;
@@ -234,6 +245,7 @@ protected:
 
     Color m_solidColor;  // If we're a 1x1 solid color, this is the color to use to fill.
     bool m_isSolidColor;  // Whether or not we are a 1x1 solid image.
+    bool m_checkedForSolidColor; // Whether we've checked the frame for solid color.
 
     bool m_animationFinished;  // Whether or not we've completed the entire animation.
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Color.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Color.cpp
index 2f38b113d0..e85ac0053d 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Color.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Color.cpp
@@ -60,7 +60,7 @@ RGBA32 makeRGBA(int r, int g, int b, int a)
     return max(0, min(a, 255)) << 24 | max(0, min(r, 255)) << 16 | max(0, min(g, 255)) << 8 | max(0, min(b, 255));
 }
 
-int colorFloatToRGBAByte(float f)
+static int colorFloatToRGBAByte(float f)
 {
     // We use lroundf and 255 instead of nextafterf(256, 0) to match CG's rounding
     return max(0, min(static_cast<int>(lroundf(255.0f * f)), 255));
@@ -116,6 +116,15 @@ RGBA32 makeRGBAFromHSLA(double hue, double saturation, double lightness, double
                     static_cast<int>(alpha * scaleFactor));
 }
 
+RGBA32 makeRGBAFromCMYKA(float c, float m, float y, float k, float a)
+{
+    double colors = 1 - k;
+    int r = static_cast<int>(nextafter(256, 0) * (colors * (1 - c)));
+    int g = static_cast<int>(nextafter(256, 0) * (colors * (1 - m)));
+    int b = static_cast<int>(nextafter(256, 0) * (colors * (1 - y)));
+    return makeRGBA(r, g, b, static_cast<float>(nextafter(256, 0) * a));
+}
+
 // originally moved here from the CSS parser
 bool Color::parseHexColor(const String& name, RGBA32& rgb)
 {
@@ -312,4 +321,34 @@ void Color::getRGBA(double& r, double& g, double& b, double& a) const
     a = alpha() / 255.0;
 }
 
+Color colorFromPremultipliedARGB(unsigned pixelColor)
+{
+    RGBA32 rgba;
+
+    if (unsigned alpha = (pixelColor & 0xFF000000) >> 24) {
+        rgba = makeRGBA(((pixelColor & 0x00FF0000) >> 16) * 255 / alpha,
+                        ((pixelColor & 0x0000FF00) >> 8) * 255 / alpha,
+                         (pixelColor & 0x000000FF) * 255 / alpha,
+                          alpha);
+    } else
+        rgba = pixelColor;
+
+    return Color(rgba);
+}
+
+unsigned premultipliedARGBFromColor(const Color& color)
+{
+    unsigned pixelColor;
+
+    if (unsigned alpha = color.alpha()) {
+        pixelColor = alpha << 24 |
+             ((color.red() * alpha  + 254) / 255) << 16 | 
+             ((color.green() * alpha  + 254) / 255) << 8 | 
+             ((color.blue() * alpha  + 254) / 255);
+    } else
+         pixelColor = color.rgb();
+
+    return pixelColor;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Color.h b/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
index d08fce085e..04bf4c4df0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
@@ -60,6 +60,7 @@ RGBA32 makeRGBA(int r, int g, int b, int a);
 RGBA32 colorWithOverrideAlpha(RGBA32 color, float overrideAlpha);
 RGBA32 makeRGBA32FromFloats(float r, float g, float b, float a);
 RGBA32 makeRGBAFromHSLA(double h, double s, double l, double a);
+RGBA32 makeRGBAFromCMYKA(float c, float m, float y, float k, float a);
 
 int differenceSquared(const Color&, const Color&);
 
@@ -71,6 +72,8 @@ public:
     Color(int r, int g, int b, int a) : m_color(makeRGBA(r, g, b, a)), m_valid(true) { }
     // Color is currently limited to 32bit RGBA, perhaps some day we'll support better colors
     Color(float r, float g, float b, float a) : m_color(makeRGBA32FromFloats(r, g, b, a)), m_valid(true) { }
+    // Creates a new color from the specific CMYK and alpha values.
+    Color(float c, float m, float y, float k, float a) : m_color(makeRGBAFromCMYKA(c, m, y, k, a)), m_valid(true) { }
     explicit Color(const String&);
     explicit Color(const char*);
     
@@ -142,9 +145,11 @@ inline bool operator!=(const Color& a, const Color& b)
 }
 
 Color focusRingColor();
+Color colorFromPremultipliedARGB(unsigned);
+unsigned premultipliedARGBFromColor(const Color&);
 
 #if PLATFORM(CG)
-CGColorRef cgColor(const Color&);
+CGColorRef createCGColor(const Color&);
 #endif
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp
index 564ea865af..7765ba9dd6 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.cpp
@@ -40,7 +40,7 @@ FloatPoint::FloatPoint(const IntPoint& p) : m_x(p.x()), m_y(p.y())
 FloatPoint FloatPoint::matrixTransform(const TransformationMatrix& transform) const
 {
     double newX, newY;
-    transform.map(static_cast<double>(m_x), static_cast<double>(m_y), &newX, &newY);
+    transform.map(static_cast<double>(m_x), static_cast<double>(m_y), newX, newY);
     return narrowPrecision(newX, newY);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.cpp
index e3ba422641..8c21ef3e52 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.cpp
@@ -21,7 +21,6 @@
 
 #include "config.h"
 
-#if ENABLE(SVG)
 #include <math.h>
 #include "FloatPoint.h"
 #include "FloatPoint3D.h"
@@ -62,4 +61,3 @@ void FloatPoint3D::normalize()
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h
index 184e91471e..2e71ddd736 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h
@@ -22,8 +22,6 @@
 #ifndef FloatPoint3D_h
 #define FloatPoint3D_h
 
-#if ENABLE(SVG)
-
 namespace WebCore {
 
 class FloatPoint;
@@ -53,6 +51,4 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG)
-
 #endif // FloatPoint3D_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp
index a32d8ab5a4..427230df4f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.cpp
@@ -46,6 +46,34 @@ static inline float max4(float a, float b, float c, float d)
     return max(max(a, b), max(c, d));
 }
 
+inline float dot(const FloatSize& a, const FloatSize& b)
+{
+    return a.width() * b.width() + a.height() * b.height();
+}
+
+inline bool isPointInTriangle(const FloatPoint& p, const FloatPoint& t1, const FloatPoint& t2, const FloatPoint& t3)
+{
+    // Compute vectors        
+    FloatSize v0 = t3 - t1;
+    FloatSize v1 = t2 - t1;
+    FloatSize v2 = p - t1;
+    
+    // Compute dot products
+    float dot00 = dot(v0, v0);
+    float dot01 = dot(v0, v1);
+    float dot02 = dot(v0, v2);
+    float dot11 = dot(v1, v1);
+    float dot12 = dot(v1, v2);
+
+    // Compute barycentric coordinates
+    float invDenom = 1.0f / (dot00 * dot11 - dot01 * dot01);
+    float u = (dot11 * dot02 - dot01 * dot12) * invDenom;
+    float v = (dot00 * dot12 - dot01 * dot02) * invDenom;
+
+    // Check if point is in triangle
+    return (u >= 0) && (v >= 0) && (u + v <= 1);
+}
+
 FloatRect FloatQuad::boundingBox() const
 {
     float left   = min4(m_p1.x(), m_p2.x(), m_p3.x(), m_p4.x());
@@ -57,4 +85,15 @@ FloatRect FloatQuad::boundingBox() const
     return FloatRect(left, top, right - left, bottom - top);
 }
 
+bool FloatQuad::containsPoint(const FloatPoint& p) const
+{
+    return isPointInTriangle(p, m_p1, m_p2, m_p3) || isPointInTriangle(p, m_p1, m_p3, m_p4);
+} 
+
+// Note that we only handle convex quads here.
+bool FloatQuad::containsQuad(const FloatQuad& other) const
+{
+    return containsPoint(other.p1()) && containsPoint(other.p2()) && containsPoint(other.p3()) && containsPoint(other.p4());
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h
index e05b27d71a..5982967716 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatQuad.h
@@ -74,6 +74,14 @@ public:
     // "slanted" empty quads.
     bool isEmpty() const { return boundingBox().isEmpty(); }
 
+    // Tests whether the given point is inside, or on an edge or corner of this quad.
+    bool containsPoint(const FloatPoint&) const;
+
+    // Tests whether the four corners of other are inside, or coincident with the sides of this quad.
+    // Note that this only works for convex quads, but that includes all quads that originate
+    // from transformed rects.
+    bool containsQuad(const FloatQuad&) const;
+
     FloatRect boundingBox() const;
     IntRect enclosingBoundingBox() const
     {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp
index 842a3a8f94..85fe882230 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Font.cpp
@@ -26,11 +26,13 @@
 
 #include "CharacterNames.h"
 #include "FloatRect.h"
+#include "FontCache.h"
 #include "FontFallbackList.h"
 #include "IntPoint.h"
 #include "GlyphBuffer.h"
 #include "WidthIterator.h"
 #include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
 
 using namespace WTF;
 using namespace Unicode;
@@ -168,46 +170,6 @@ void Font::update(PassRefPtr<FontSelector> fontSelector) const
     m_pages.clear();
 }
 
-int Font::width(const TextRun& run) const
-{
-    return lroundf(floatWidth(run));
-}
-
-int Font::ascent() const
-{
-    return primaryFont()->ascent();
-}
-
-int Font::descent() const
-{
-    return primaryFont()->descent();
-}
-
-int Font::lineSpacing() const
-{
-    return primaryFont()->lineSpacing();
-}
-
-int Font::lineGap() const
-{
-    return primaryFont()->lineGap();
-}
-
-float Font::xHeight() const
-{
-    return primaryFont()->xHeight();
-}
-
-unsigned Font::unitsPerEm() const
-{
-    return primaryFont()->unitsPerEm();
-}
-
-int Font::spaceWidth() const
-{
-    return (int)ceilf(primaryFont()->m_adjustedSpaceWidth + m_letterSpacing);
-}
-
 bool Font::isFixedPitch() const
 {
     ASSERT(m_fontList);
@@ -237,7 +199,7 @@ void Font::drawText(GraphicsContext* context, const TextRun& run, const FloatPoi
     return drawComplexText(context, run, point, from, to);
 }
 
-float Font::floatWidth(const TextRun& run) const
+float Font::floatWidth(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
 #if ENABLE(SVG_FONTS)
     if (primaryFont()->isSVGFont())
@@ -245,16 +207,22 @@ float Font::floatWidth(const TextRun& run) const
 #endif
 
 #if USE(FONT_FAST_PATH)
-    if (canUseGlyphCache(run))
-        return floatWidthForSimpleText(run, 0);
+    if (canUseGlyphCache(run)) {
+        // If the complex text implementation cannot return fallback fonts, avoid
+        // returning them for simple text as well.
+        static bool returnFallbackFonts = canReturnFallbackFontsForComplexText();
+        return floatWidthForSimpleText(run, 0, returnFallbackFonts ? fallbackFonts : 0);
+    }
 #endif
 
-    return floatWidthForComplexText(run);
+    return floatWidthForComplexText(run, fallbackFonts);
 }
 
 float Font::floatWidth(const TextRun& run, int extraCharsAvailable, int& charsConsumed, String& glyphName) const
 {
-#if ENABLE(SVG_FONTS)
+#if !ENABLE(SVG_FONTS)
+    UNUSED_PARAM(extraCharsAvailable);
+#else
     if (primaryFont()->isSVGFont())
         return floatWidthUsingSVGFont(run, extraCharsAvailable, charsConsumed, glyphName);
 #endif
@@ -314,4 +282,17 @@ FontSelector* Font::fontSelector() const
     return m_fontList ? m_fontList->fontSelector() : 0;
 }
 
+static bool shouldUseFontSmoothing = true;
+
+void Font::setShouldUseSmoothing(bool shouldUseSmoothing)
+{
+    ASSERT(isMainThread());
+    shouldUseFontSmoothing = shouldUseSmoothing;
+}
+
+bool Font::shouldUseSmoothing()
+{
+    return shouldUseFontSmoothing;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Font.h b/src/3rdparty/webkit/WebCore/platform/graphics/Font.h
index 384ddd35ba..8d85d8b348 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Font.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Font.h
@@ -27,7 +27,9 @@
 
 #include "TextRun.h"
 #include "FontDescription.h"
+#include "SimpleFontData.h"
 #include <wtf/HashMap.h>
+#include <wtf/MathExtras.h>
 
 #if PLATFORM(QT)
 #include <QFont>
@@ -45,7 +47,6 @@ class GlyphBuffer;
 class GlyphPageTreeNode;
 class GraphicsContext;
 class IntPoint;
-class SimpleFontData;
 class SVGFontElement;
 
 struct GlyphData;
@@ -77,8 +78,8 @@ public:
 
     void drawText(GraphicsContext*, const TextRun&, const FloatPoint&, int from = 0, int to = -1) const;
 
-    int width(const TextRun&) const;
-    float floatWidth(const TextRun&) const;
+    int width(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts = 0) const { return lroundf(floatWidth(run, fallbackFonts)); }
+    float floatWidth(const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
     float floatWidth(const TextRun& run, int extraCharsAvailable, int& charsConsumed, String& glyphName) const;
 
     int offsetForPosition(const TextRun&, int position, bool includePartialGlyphs) const;
@@ -104,24 +105,26 @@ public:
     bool isPlatformFont() const { return m_isPlatformFont; }
 
     // Metrics that we query the FontFallbackList for.
-    int ascent() const;
-    int descent() const;
+    int ascent() const { return primaryFont()->ascent(); }
+    int descent() const { return primaryFont()->descent(); }
     int height() const { return ascent() + descent(); }
-    int lineSpacing() const;
-    int lineGap() const;
-    float xHeight() const;
-    unsigned unitsPerEm() const;
-    int spaceWidth() const;
+    int lineSpacing() const { return primaryFont()->lineSpacing(); }
+    int lineGap() const { return primaryFont()->lineGap(); }
+    float xHeight() const { return primaryFont()->xHeight(); }
+    unsigned unitsPerEm() const { return primaryFont()->unitsPerEm(); }
+    int spaceWidth() const { return (int)ceilf(primaryFont()->adjustedSpaceWidth() + m_letterSpacing); }
     int tabWidth() const { return 8 * spaceWidth(); }
 
-    const SimpleFontData* primaryFont() const {
+    const SimpleFontData* primaryFont() const
+    {
+        ASSERT(isMainThread());
         if (!m_cachedPrimaryFont)
             cachePrimaryFont();
         return m_cachedPrimaryFont;
     }
 
     const FontData* fontDataAt(unsigned) const;
-    const GlyphData& glyphDataForCharacter(UChar32, bool mirror, bool forceSmallCaps = false) const;
+    GlyphData glyphDataForCharacter(UChar32, bool mirror, bool forceSmallCaps = false) const;
     // Used for complex text, and does not utilize the glyph map cache.
     const FontData* fontDataForCharacters(const UChar*, int length) const;
 
@@ -129,6 +132,9 @@ public:
     QFont font() const;
 #endif
 
+    static void setShouldUseSmoothing(bool);
+    static bool shouldUseSmoothing();
+
 private:
 #if ENABLE(SVG_FONTS)
     void drawTextUsingSVGFont(GraphicsContext*, const TextRun&, const FloatPoint&, int from, int to) const;
@@ -143,13 +149,15 @@ private:
     void drawSimpleText(GraphicsContext*, const TextRun&, const FloatPoint&, int from, int to) const;
     void drawGlyphs(GraphicsContext*, const SimpleFontData*, const GlyphBuffer&, int from, int to, const FloatPoint&) const;
     void drawGlyphBuffer(GraphicsContext*, const GlyphBuffer&, const TextRun&, const FloatPoint&) const;
-    float floatWidthForSimpleText(const TextRun&, GlyphBuffer*) const;
+    float floatWidthForSimpleText(const TextRun&, GlyphBuffer*, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
     int offsetForPositionForSimpleText(const TextRun&, int position, bool includePartialGlyphs) const;
     FloatRect selectionRectForSimpleText(const TextRun&, const IntPoint&, int h, int from, int to) const;
+
+    static bool canReturnFallbackFontsForComplexText();
 #endif
 
     void drawComplexText(GraphicsContext*, const TextRun&, const FloatPoint&, int from, int to) const;
-    float floatWidthForComplexText(const TextRun&) const;
+    float floatWidthForComplexText(const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
     int offsetForPositionForComplexText(const TextRun&, int position, bool includePartialGlyphs) const;
     FloatRect selectionRectForComplexText(const TextRun&, const IntPoint&, int h, int from, int to) const;
     void cachePrimaryFont() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp
index 69d543188b..d9b4b28624 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.cpp
@@ -43,6 +43,16 @@ using namespace WTF;
 
 namespace WebCore {
 
+FontCache* fontCache()
+{
+    DEFINE_STATIC_LOCAL(FontCache, globalFontCache, ());
+    return &globalFontCache;
+}
+
+FontCache::FontCache()
+{
+}
+
 struct FontPlatformDataCacheKey {
     FontPlatformDataCacheKey(const AtomicString& family = AtomicString(), unsigned size = 0, unsigned weight = 0, bool italic = false,
                              bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode)
@@ -129,8 +139,13 @@ static const AtomicString& alternateFamilyName(const AtomicString& familyName)
     DEFINE_STATIC_LOCAL(AtomicString, courierNew, ("Courier New"));
     if (equalIgnoringCase(familyName, courier))
         return courierNew;
+#if !PLATFORM(WIN_OS)
+    // On Windows, Courier New (truetype font) is always present and
+    // Courier is a bitmap font. So, we don't want to map Courier New to
+    // Courier.
     if (equalIgnoringCase(familyName, courierNew))
         return courier;
+#endif
 
     // Alias Times and Times New Roman.
     DEFINE_STATIC_LOCAL(AtomicString, times, ("Times"));
@@ -148,6 +163,21 @@ static const AtomicString& alternateFamilyName(const AtomicString& familyName)
     if (equalIgnoringCase(familyName, helvetica))
         return arial;
 
+#if PLATFORM(WIN_OS)
+    // On Windows, bitmap fonts are blocked altogether so that we have to 
+    // alias MS Sans Serif (bitmap font) -> Microsoft Sans Serif (truetype font)
+    DEFINE_STATIC_LOCAL(AtomicString, msSans, ("MS Sans Serif"));
+    DEFINE_STATIC_LOCAL(AtomicString, microsoftSans, ("Microsoft Sans Serif"));
+    if (equalIgnoringCase(familyName, msSans))
+        return microsoftSans;
+
+    // Alias MS Serif (bitmap) -> Times New Roman (truetype font). There's no 
+    // 'Microsoft Sans Serif-equivalent' for Serif. 
+    static AtomicString msSerif("MS Serif");
+    if (equalIgnoringCase(familyName, msSerif))
+        return timesNewRoman;
+#endif
+
     return emptyAtom;
 }
 
@@ -206,7 +236,7 @@ struct FontDataCacheKeyTraits : WTF::GenericHashTraits<FontPlatformData> {
     static const bool needsDestruction = true;
     static const FontPlatformData& emptyValue()
     {
-        DEFINE_STATIC_LOCAL(FontPlatformData, key, ());
+        DEFINE_STATIC_LOCAL(FontPlatformData, key, (0.f, false, false));
         return key;
     }
     static void constructDeletedValue(FontPlatformData& slot)
@@ -277,12 +307,13 @@ void FontCache::purgeInactiveFontData(int count)
 
     isPurging = true;
 
+    Vector<const SimpleFontData*, 20> fontDataToDelete;
     ListHashSet<const SimpleFontData*>::iterator end = gInactiveFontData->end();
     ListHashSet<const SimpleFontData*>::iterator it = gInactiveFontData->begin();
     for (int i = 0; i < count && it != end; ++it, ++i) {
         const SimpleFontData* fontData = *it.get();
         gFontDataCache->remove(fontData->platformData());
-        delete fontData;
+        fontDataToDelete.append(fontData);
     }
 
     if (it == end) {
@@ -293,8 +324,12 @@ void FontCache::purgeInactiveFontData(int count)
             gInactiveFontData->remove(gInactiveFontData->begin());
     }
 
+    size_t fontDataToDeleteCount = fontDataToDelete.size();
+    for (size_t i = 0; i < fontDataToDeleteCount; ++i)
+        delete fontDataToDelete[i];
+
     Vector<FontPlatformDataCacheKey> keysToRemove;
-    keysToRemove.reserveCapacity(gFontPlatformDataCache->size());
+    keysToRemove.reserveInitialCapacity(gFontPlatformDataCache->size());
     FontPlatformDataCache::iterator platformDataEnd = gFontPlatformDataCache->end();
     for (FontPlatformDataCache::iterator platformData = gFontPlatformDataCache->begin(); platformData != platformDataEnd; ++platformData) {
         if (platformData->second && !gFontDataCache->contains(*platformData->second))
@@ -414,7 +449,7 @@ void FontCache::invalidate()
 
     Vector<RefPtr<FontSelector> > clients;
     size_t numClients = gClients->size();
-    clients.reserveCapacity(numClients);
+    clients.reserveInitialCapacity(numClients);
     HashSet<FontSelector*>::iterator end = gClients->end();
     for (HashSet<FontSelector*>::iterator it = gClients->begin(); it != end; ++it)
         clients.append(*it);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
index 816fe640dc..3c0f2d9167 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
@@ -51,45 +51,52 @@ class SimpleFontData;
 
 class FontCache {
 public:
-    static const FontData* getFontData(const Font&, int& familyIndex, FontSelector*);
-    static void releaseFontData(const SimpleFontData*);
+    friend FontCache* fontCache();
+
+    const FontData* getFontData(const Font&, int& familyIndex, FontSelector*);
+    void releaseFontData(const SimpleFontData*);
     
     // This method is implemented by the platform.
     // FIXME: Font data returned by this method never go inactive because callers don't track and release them.
-    static const SimpleFontData* getFontDataForCharacters(const Font&, const UChar* characters, int length);
+    const SimpleFontData* getFontDataForCharacters(const Font&, const UChar* characters, int length);
     
     // Also implemented by the platform.
-    static void platformInit();
+    void platformInit();
 
 #if PLATFORM(WIN)
-    static IMLangFontLink2* getFontLinkInterface();
+    IMLangFontLink2* getFontLinkInterface();
 #endif
 
-    static void getTraitsInFamily(const AtomicString&, Vector<unsigned>&);
+    void getTraitsInFamily(const AtomicString&, Vector<unsigned>&);
 
-    static FontPlatformData* getCachedFontPlatformData(const FontDescription&, const AtomicString& family, bool checkingAlternateName = false);
-    static SimpleFontData* getCachedFontData(const FontPlatformData*);
-    static FontPlatformData* getLastResortFallbackFont(const FontDescription&);
+    FontPlatformData* getCachedFontPlatformData(const FontDescription&, const AtomicString& family, bool checkingAlternateName = false);
+    SimpleFontData* getCachedFontData(const FontPlatformData*);
+    FontPlatformData* getLastResortFallbackFont(const FontDescription&);
 
-    static void addClient(FontSelector*);
-    static void removeClient(FontSelector*);
+    void addClient(FontSelector*);
+    void removeClient(FontSelector*);
 
-    static unsigned generation();
-    static void invalidate();
+    unsigned generation();
+    void invalidate();
 
-    static size_t fontDataCount();
-    static size_t inactiveFontDataCount();
-    static void purgeInactiveFontData(int count = INT_MAX);
+    size_t fontDataCount();
+    size_t inactiveFontDataCount();
+    void purgeInactiveFontData(int count = INT_MAX);
 
 private:
+    FontCache();
+    ~FontCache();
+
     // These methods are implemented by each platform.
-    static FontPlatformData* getSimilarFontPlatformData(const Font&);
-    static FontPlatformData* createFontPlatformData(const FontDescription&, const AtomicString& family);
+    FontPlatformData* getSimilarFontPlatformData(const Font&);
+    FontPlatformData* createFontPlatformData(const FontDescription&, const AtomicString& family);
 
     friend class SimpleFontData;
     friend class FontFallbackList;
 };
 
+// Get the global fontCache.
+FontCache* fontCache();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
index d13e86ab16..c893b8a117 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
@@ -81,7 +81,7 @@ public:
     GenericFamilyType genericFamily() const { return static_cast<GenericFamilyType>(m_genericFamily); }
     bool usePrinterFont() const { return m_usePrinterFont; }
     FontRenderingMode renderingMode() const { return static_cast<FontRenderingMode>(m_renderingMode); }
-    int keywordSize() const { return m_keywordSize; }
+    unsigned keywordSize() const { return m_keywordSize; }
 
     FontTraitsMask traitsMask() const;
 
@@ -95,7 +95,7 @@ public:
     void setGenericFamily(GenericFamilyType genericFamily) { m_genericFamily = genericFamily; }
     void setUsePrinterFont(bool p) { m_usePrinterFont = p; }
     void setRenderingMode(FontRenderingMode mode) { m_renderingMode = mode; }
-    void setKeywordSize(int s) { m_keywordSize = s; }
+    void setKeywordSize(unsigned s) { m_keywordSize = s; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -114,7 +114,7 @@ private:
 
     unsigned m_renderingMode : 1;  // Used to switch between CG and GDI text on Windows.
 
-    int m_keywordSize : 4; // We cache whether or not a font is currently represented by a CSS keyword (e.g., medium).  If so,
+    unsigned m_keywordSize : 4; // We cache whether or not a font is currently represented by a CSS keyword (e.g., medium).  If so,
                            // then we can accurately translate across different generic families to adjust for different preference settings
                            // (e.g., 13px monospace vs. 16px everything else).  Sizes are 1-8 (like the HTML size values for <font>).
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.cpp
index ef59c2f6fb..decacc5679 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.cpp
@@ -36,11 +36,11 @@
 namespace WebCore {
 
 FontFallbackList::FontFallbackList()
-    : m_familyIndex(0)
+    : m_fontSelector(0)
+    , m_familyIndex(0)
     , m_pitch(UnknownPitch)
     , m_loadingCustomFonts(false)
-    , m_fontSelector(0)
-    , m_generation(FontCache::generation())
+    , m_generation(fontCache()->generation())
 {
 }
 
@@ -52,7 +52,7 @@ void FontFallbackList::invalidate(PassRefPtr<FontSelector> fontSelector)
     m_pitch = UnknownPitch;
     m_loadingCustomFonts = false;
     m_fontSelector = fontSelector;
-    m_generation = FontCache::generation();
+    m_generation = fontCache()->generation();
 }
 
 void FontFallbackList::releaseFontData()
@@ -61,7 +61,7 @@ void FontFallbackList::releaseFontData()
     for (unsigned i = 0; i < numFonts; ++i) {
         if (!m_fontList[i].second) {
             ASSERT(!m_fontList[i].first->isSegmented());
-            FontCache::releaseFontData(static_cast<const SimpleFontData*>(m_fontList[i].first));
+            fontCache()->releaseFontData(static_cast<const SimpleFontData*>(m_fontList[i].first));
         }
     }
 }
@@ -96,8 +96,8 @@ const FontData* FontFallbackList::fontDataAt(const Font* font, unsigned realized
     // We are obtaining this font for the first time.  We keep track of the families we've looked at before
     // in |m_familyIndex|, so that we never scan the same spot in the list twice.  getFontData will adjust our
     // |m_familyIndex| as it scans for the right font to make.
-    ASSERT(FontCache::generation() == m_generation);
-    const FontData* result = FontCache::getFontData(*font, m_familyIndex, m_fontSelector.get());
+    ASSERT(fontCache()->generation() == m_generation);
+    const FontData* result = fontCache()->getFontData(*font, m_familyIndex, m_fontSelector.get());
     if (result) {
         m_fontList.append(pair<const FontData*, bool>(result, result->isCustomFont()));
         if (result->isLoading())
@@ -116,8 +116,8 @@ const FontData* FontFallbackList::fontDataForCharacters(const Font* font, const
         fontData = fontDataAt(font, ++realizedFontIndex);
     
     if (!fontData) {
-        ASSERT(FontCache::generation() == m_generation);
-        fontData = FontCache::getFontDataForCharacters(*font, characters, length);
+        ASSERT(fontCache()->generation() == m_generation);
+        fontData = fontCache()->getFontDataForCharacters(*font, characters, length);
     }
 
     return fontData;
@@ -126,8 +126,8 @@ const FontData* FontFallbackList::fontDataForCharacters(const Font* font, const
 void FontFallbackList::setPlatformFont(const FontPlatformData& platformData)
 {
     m_familyIndex = cAllFamiliesScanned;
-    ASSERT(FontCache::generation() == m_generation);
-    const FontData* fontData = FontCache::getCachedFontData(&platformData);
+    ASSERT(fontCache()->generation() == m_generation);
+    const FontData* fontData = fontCache()->getCachedFontData(&platformData);
     m_fontList.append(pair<const FontData*, bool>(fontData, fontData->isCustomFont()));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.h
index a23b32c59f..07938aea19 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontFallbackList.h
@@ -66,10 +66,10 @@ private:
     void releaseFontData();
 
     mutable Vector<pair<const FontData*, bool>, 1> m_fontList;
+    RefPtr<FontSelector> m_fontSelector;
     mutable int m_familyIndex;
     mutable Pitch m_pitch;
     mutable bool m_loadingCustomFonts;
-    RefPtr<FontSelector> m_fontSelector;
     unsigned m_generation;
 
     friend class Font;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
index bb69ac381e..deac1b60b7 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
@@ -39,11 +39,13 @@ using namespace Unicode;
 
 namespace WebCore {
 
-const GlyphData& Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCaps) const
+GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCaps) const
 {
+    ASSERT(isMainThread());
+
     bool useSmallCapsFont = forceSmallCaps;
     if (m_fontDescription.smallCaps()) {
-        UChar32 upperC = Unicode::toUpper(c);
+        UChar32 upperC = toUpper(c);
         if (upperC != c) {
             c = upperC;
             useSmallCapsFont = true;
@@ -70,7 +72,7 @@ const GlyphData& Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceS
         while (true) {
             page = node->page();
             if (page) {
-                const GlyphData& data = page->glyphDataForCharacter(c);
+                GlyphData data = page->glyphDataForCharacter(c);
                 if (data.fontData)
                     return data;
                 if (node->isSystemFallback())
@@ -88,7 +90,7 @@ const GlyphData& Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceS
         while (true) {
             page = node->page();
             if (page) {
-                const GlyphData& data = page->glyphDataForCharacter(c);
+                GlyphData data = page->glyphDataForCharacter(c);
                 if (data.fontData) {
                     // The smallCapsFontData function should not normally return 0.
                     // But if it does, we will just render the capital letter big.
@@ -99,7 +101,7 @@ const GlyphData& Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceS
                     GlyphPageTreeNode* smallCapsNode = GlyphPageTreeNode::getRootChild(smallCapsFontData, pageNumber);
                     const GlyphPage* smallCapsPage = smallCapsNode->page();
                     if (smallCapsPage) {
-                        const GlyphData& data = smallCapsPage->glyphDataForCharacter(c);
+                        GlyphData data = smallCapsPage->glyphDataForCharacter(c);
                         if (data.fontData)
                             return data;
                     }
@@ -144,13 +146,13 @@ const GlyphData& Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceS
         codeUnits[1] = U16_TRAIL(c);
         codeUnitsLength = 2;
     }
-    const SimpleFontData* characterFontData = FontCache::getFontDataForCharacters(*this, codeUnits, codeUnitsLength);
+    const SimpleFontData* characterFontData = fontCache()->getFontDataForCharacters(*this, codeUnits, codeUnitsLength);
     if (useSmallCapsFont && characterFontData)
         characterFontData = characterFontData->smallCapsFontData(m_fontDescription);
     if (characterFontData) {
         // Got the fallback glyph and font.
         GlyphPage* fallbackPage = GlyphPageTreeNode::getRootChild(characterFontData, pageNumber)->page();
-        const GlyphData& data = fallbackPage && fallbackPage->glyphDataForCharacter(c).fontData ? fallbackPage->glyphDataForCharacter(c) : characterFontData->missingGlyphData();
+        GlyphData data = fallbackPage && fallbackPage->fontDataForCharacter(c) ? fallbackPage->glyphDataForCharacter(c) : characterFontData->missingGlyphData();
         // Cache it so we don't have to do system fallback again next time.
         if (!useSmallCapsFont)
             page->setGlyphDataForCharacter(c, data.glyph, data.fontData);
@@ -159,7 +161,7 @@ const GlyphData& Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceS
 
     // Even system fallback can fail; use the missing glyph in that case.
     // FIXME: It would be nicer to use the missing glyph from the last resort font instead.
-    const GlyphData& data = primaryFont()->missingGlyphData();
+    GlyphData data = primaryFont()->missingGlyphData();
     if (!useSmallCapsFont)
         page->setGlyphDataForCharacter(c, data.glyph, data.fontData);
     return data;
@@ -296,9 +298,9 @@ void Font::drawGlyphBuffer(GraphicsContext* context, const GlyphBuffer& glyphBuf
     drawGlyphs(context, fontData, glyphBuffer, lastFrom, nextGlyph - lastFrom, startPoint);
 }
 
-float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer) const
+float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
-    WidthIterator it(this, run);
+    WidthIterator it(this, run, fallbackFonts);
     it.advance(run.length(), glyphBuffer);
     return it.m_runWidthSoFar;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
index 15e27d7329..c40a40ae15 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
@@ -51,7 +51,7 @@ void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcR
                                  const FloatPoint& phase, CompositeOperator compositeOp, const FloatRect& destRect)
 {
     // Create a BitmapImage and call drawPattern on it.
-    auto_ptr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, false);
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, false);
     ASSERT(imageBuffer.get());
     
     // Fill with the gradient.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
index 18957d5ea7..dcda419bd8 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,14 +30,16 @@
 #define GlyphBuffer_h
 
 #include "FloatSize.h"
+#include <wtf/UnusedParam.h>
+#include <wtf/Vector.h>
 
 #if PLATFORM(CG)
 #include <ApplicationServices/ApplicationServices.h>
-#elif PLATFORM(CAIRO)
-#include <cairo.h>
 #endif
 
-#include <wtf/Vector.h>
+#if PLATFORM(CAIRO) || (PLATFORM(WX) && defined(__WXGTK__))
+#include <cairo.h>
+#endif
 
 namespace WebCore {
 
@@ -125,6 +127,7 @@ public:
 #if PLATFORM(WIN)
         return m_offsets[index];
 #else
+        UNUSED_PARAM(index);
         return FloatSize();
 #endif
     }
@@ -132,6 +135,7 @@ public:
     void add(Glyph glyph, const SimpleFontData* font, float width, const FloatSize* offset = 0)
     {
         m_fontData.append(font);
+
 #if PLATFORM(CAIRO)
         cairo_glyph_t cairoGlyph;
         cairoGlyph.index = glyph;
@@ -152,6 +156,8 @@ public:
             m_offsets.append(*offset);
         else
             m_offsets.append(FloatSize());
+#else
+        UNUSED_PARAM(offset);
 #endif
     }
     
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index 6b9d23dfc9..a34a1921ef 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -218,9 +218,10 @@ void GlyphPageTreeNode::initializePage(const FontData* fontData, unsigned pageNu
                         }
                         haveGlyphs |= pageToFill->fill(from, to - from, buffer + from * (start < 0x10000 ? 1 : 2), (to - from) * (start < 0x10000 ? 1 : 2), range.fontData());
                         if (scratchPage) {
+                            ASSERT(to <=  static_cast<int>(GlyphPage::size));
                             for (int j = from; j < to; j++) {
-                                if (!m_page->m_glyphs[j].glyph && pageToFill->m_glyphs[j].glyph)
-                                    m_page->m_glyphs[j] = pageToFill->m_glyphs[j];
+                                if (!m_page->glyphAt(j) && pageToFill->glyphAt(j))
+                                    m_page->setGlyphDataForIndex(j, pageToFill->glyphDataForIndex(j));
                             }
                         }
                     }
@@ -264,15 +265,13 @@ void GlyphPageTreeNode::initializePage(const FontData* fontData, unsigned pageNu
                 // has added anything.
                 bool newGlyphs = false;
                 for (unsigned i = 0; i < GlyphPage::size; i++) {
-                    if (parentPage->m_glyphs[i].glyph)
-                        m_page->m_glyphs[i] = parentPage->m_glyphs[i];
-                    else  if (fallbackPage->m_glyphs[i].glyph) {
-                        m_page->m_glyphs[i] = fallbackPage->m_glyphs[i];
+                    if (parentPage->glyphAt(i))
+                        m_page->setGlyphDataForIndex(i, parentPage->glyphDataForIndex(i));
+                    else  if (fallbackPage->glyphAt(i)) {
+                        m_page->setGlyphDataForIndex(i, fallbackPage->glyphDataForIndex(i));
                         newGlyphs = true;
-                    } else {
-                        const GlyphData data = { 0, 0 };
-                        m_page->m_glyphs[i] = data;
-                    }
+                    } else
+                        m_page->setGlyphDataForIndex(i, 0, 0);
                 }
 
                 if (!newGlyphs)
@@ -287,12 +286,9 @@ void GlyphPageTreeNode::initializePage(const FontData* fontData, unsigned pageNu
         // ever finds it needs a glyph out of the system fallback page, it will
         // ask the system for the best font to use and fill that glyph in for us.
         if (parentPage)
-            memcpy(m_page->m_glyphs, parentPage->m_glyphs, GlyphPage::size * sizeof(m_page->m_glyphs[0]));
-        else {
-            const GlyphData data = { 0, 0 };
-            for (unsigned i = 0; i < GlyphPage::size; i++)
-                m_page->m_glyphs[i] = data;
-        }
+            m_page->copyFrom(*parentPage);
+        else
+            m_page->clear();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.h b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.h
index 240b492caa..80e87aa66b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.h
@@ -29,6 +29,7 @@
 #ifndef GlyphPageTreeNode_h
 #define GlyphPageTreeNode_h
 
+#include <string.h>
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -45,6 +46,11 @@ typedef unsigned short Glyph;
 // Holds the glyph index and the corresponding SimpleFontData information for a given
 // character.
 struct GlyphData {
+    GlyphData(Glyph g = 0, const SimpleFontData* f = 0)
+        : glyph(g)
+        , fontData(f)
+    {
+    }
     Glyph glyph;
     const SimpleFontData* fontData;
 };
@@ -54,30 +60,69 @@ struct GlyphData {
 // starting from 0 and incrementing for each 256 glyphs.
 //
 // One page may actually include glyphs from other fonts if the characters are
-// missing in the parimary font. It is owned by exactly one GlyphPageTreeNode,
+// missing in the primary font. It is owned by exactly one GlyphPageTreeNode,
 // although multiple nodes may reference it as their "page" if they are supposed
 // to be overriding the parent's node, but provide no additional information.
-struct GlyphPage : public RefCounted<GlyphPage> {
+class GlyphPage : public RefCounted<GlyphPage> {
+public:
     static PassRefPtr<GlyphPage> create(GlyphPageTreeNode* owner)
     {
         return adoptRef(new GlyphPage(owner));
     }
 
     static const size_t size = 256; // Covers Latin-1 in a single page.
-    GlyphData m_glyphs[size];
-    GlyphPageTreeNode* m_owner;
 
-    const GlyphData& glyphDataForCharacter(UChar32 c) const { return m_glyphs[c % size]; }
+    unsigned indexForCharacter(UChar32 c) const { return c % size; }
+    GlyphData glyphDataForCharacter(UChar32 c) const
+    {
+        unsigned index = indexForCharacter(c);
+        return GlyphData(m_glyphs[index], m_glyphFontData[index]);
+    }
+
+    GlyphData glyphDataForIndex(unsigned index) const
+    {
+        ASSERT(index < size);
+        return GlyphData(m_glyphs[index], m_glyphFontData[index]);
+    }
+
+    Glyph glyphAt(unsigned index) const
+    {
+        ASSERT(index < size);
+        return m_glyphs[index];
+    }
+
+    const SimpleFontData* fontDataForCharacter(UChar32 c) const
+    {
+        return m_glyphFontData[indexForCharacter(c)];
+    }
+
     void setGlyphDataForCharacter(UChar32 c, Glyph g, const SimpleFontData* f)
     {
-        setGlyphDataForIndex(c % size, g, f);
+        setGlyphDataForIndex(indexForCharacter(c), g, f);
     }
     void setGlyphDataForIndex(unsigned index, Glyph g, const SimpleFontData* f)
     {
         ASSERT(index < size);
-        m_glyphs[index].glyph = g;
-        m_glyphs[index].fontData = f;
+        m_glyphs[index] = g;
+        m_glyphFontData[index] = f;
+    }
+    void setGlyphDataForIndex(unsigned index, const GlyphData& glyphData)
+    {
+        setGlyphDataForIndex(index, glyphData.glyph, glyphData.fontData);
+    }
+    
+    void copyFrom(const GlyphPage& other)
+    {
+        memcpy(m_glyphs, other.m_glyphs, sizeof(m_glyphs));
+        memcpy(m_glyphFontData, other.m_glyphFontData, sizeof(m_glyphFontData));
+    }
+
+    void clear()
+    {
+        memset(m_glyphs, 0, sizeof(m_glyphs));
+        memset(m_glyphFontData, 0, sizeof(m_glyphFontData));
     }
+    
     GlyphPageTreeNode* owner() const { return m_owner; }
 
     // Implemented by the platform.
@@ -88,6 +133,12 @@ private:
         : m_owner(owner)
     {
     }
+
+    // Separate arrays, rather than array of GlyphData, to save space.
+    Glyph m_glyphs[size];
+    const SimpleFontData* m_glyphFontData[size];
+
+    GlyphPageTreeNode* m_owner;
 };
 
 // The glyph page tree is a data structure that maps (FontData, glyph page number)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.cpp
index 6e8d68d1f7..43cab65c32 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,43 +29,22 @@
 #include "config.h"
 #include "GlyphWidthMap.h"
 
-namespace WebCore
-{
-
-float GlyphWidthMap::widthForGlyph(Glyph g)
-{
-    unsigned pageNumber = (g / GlyphWidthPage::size);
-    GlyphWidthPage* page = locatePage(pageNumber);
-    if (page)
-        return page->widthForGlyph(g);
-    return cGlyphWidthUnknown;
-}
-
-void GlyphWidthMap::setWidthForGlyph(Glyph glyph, float width)
-{
-    unsigned pageNumber = (glyph / GlyphWidthPage::size);
-    GlyphWidthPage* page = locatePage(pageNumber);
-    if (page)
-        page->setWidthForGlyph(glyph, width);
-}
+namespace WebCore {
 
-inline GlyphWidthMap::GlyphWidthPage* GlyphWidthMap::locatePage(unsigned pageNumber)
+GlyphWidthMap::GlyphWidthPage* GlyphWidthMap::locatePageSlowCase(unsigned pageNumber)
 {
     GlyphWidthPage* page;
     if (pageNumber == 0) {
-        if (m_filledPrimaryPage)
-            return &m_primaryPage;
+        ASSERT(!m_filledPrimaryPage);
         page = &m_primaryPage;
         m_filledPrimaryPage = true;
     } else {
         if (m_pages) {
-            GlyphWidthPage* result = m_pages->get(pageNumber);
-            if (result)
-                return result;
-        }
+            if ((page = m_pages->get(pageNumber)))
+                return page;
+        } else
+            m_pages.set(new HashMap<int, GlyphWidthPage*>);
         page = new GlyphWidthPage;
-        if (!m_pages)
-            m_pages = new HashMap<int, GlyphWidthPage*>;
         m_pages->set(pageNumber, page);
     }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.h b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.h
index 16337697e4..e194ecf3bf 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphWidthMap.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,9 +29,9 @@
 #ifndef GlyphWidthMap_h
 #define GlyphWidthMap_h
 
-#include <wtf/unicode/Unicode.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
@@ -41,34 +41,49 @@ const float cGlyphWidthUnknown = -1;
 
 class GlyphWidthMap : Noncopyable {
 public:
-    GlyphWidthMap() : m_filledPrimaryPage(false), m_pages(0) {}
-    ~GlyphWidthMap() { if (m_pages) { deleteAllValues(*m_pages); delete m_pages; } }
+    GlyphWidthMap() : m_filledPrimaryPage(false) { }
+    ~GlyphWidthMap() { if (m_pages) { deleteAllValues(*m_pages); } }
+
+    float widthForGlyph(Glyph glyph)
+    {
+        return locatePage(glyph / GlyphWidthPage::size)->widthForGlyph(glyph);
+    }
 
-    float widthForGlyph(Glyph);
-    void setWidthForGlyph(Glyph, float);
+    void setWidthForGlyph(Glyph glyph, float width)
+    {
+        locatePage(glyph / GlyphWidthPage::size)->setWidthForGlyph(glyph, width);
+    }
 
 private:
     struct GlyphWidthPage {
         static const size_t size = 256; // Usually covers Latin-1 in a single page.
         float m_widths[size];
 
-        float widthForGlyph(Glyph g) const { return m_widths[g % size]; }
-        void setWidthForGlyph(Glyph g, float w)
+        float widthForGlyph(Glyph glyph) const { return m_widths[glyph % size]; }
+        void setWidthForGlyph(Glyph glyph, float width)
         {
-            setWidthForIndex(g % size, w);
+            setWidthForIndex(glyph % size, width);
         }
-        void setWidthForIndex(unsigned index, float w)
+        void setWidthForIndex(unsigned index, float width)
         {
-            m_widths[index] = w;
+            m_widths[index] = width;
         }
     };
     
-    GlyphWidthPage* locatePage(unsigned page);
+    GlyphWidthPage* locatePage(unsigned pageNumber)
+    {
+        if (!pageNumber && m_filledPrimaryPage)
+            return &m_primaryPage;
+        return locatePageSlowCase(pageNumber);
+    }
+
+    GlyphWidthPage* locatePageSlowCase(unsigned pageNumber);
     
     bool m_filledPrimaryPage;
     GlyphWidthPage m_primaryPage; // We optimize for the page that contains glyph indices 0-255.
-    HashMap<int, GlyphWidthPage*>* m_pages;
+    OwnPtr<HashMap<int, GlyphWidthPage*> > m_pages;
 };
 
 }
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp
index 2e6a5d28e8..51c7162741 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.cpp
@@ -39,6 +39,7 @@ Gradient::Gradient(const FloatPoint& p0, const FloatPoint& p1)
     , m_r1(0)
     , m_stopsSorted(false)
     , m_lastStop(0)
+    , m_spreadMethod(SpreadMethodPad)
 {
     platformInit();
 }
@@ -51,6 +52,7 @@ Gradient::Gradient(const FloatPoint& p0, float r0, const FloatPoint& p1, float r
     , m_r1(r1)
     , m_stopsSorted(false)
     , m_lastStop(0)
+    , m_spreadMethod(SpreadMethodPad)
 {
     platformInit();
 }
@@ -146,4 +148,11 @@ int Gradient::findStop(float value) const
     return m_lastStop;
 }
 
+void Gradient::setSpreadMethod(GradientSpreadMethod spreadMethod)
+{
+    // FIXME: Should it become necessary, allow calls to this method after m_gradient has been set.
+    ASSERT(m_gradient == 0);
+    m_spreadMethod = spreadMethod;
+}
+
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
index e55923c1b6..efcf0408fe 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
@@ -29,6 +29,8 @@
 
 #include "FloatPoint.h"
 #include "Generator.h"
+#include "GraphicsTypes.h"
+#include "TransformationMatrix.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 
@@ -86,6 +88,12 @@ namespace WebCore {
 
         void setStopsSorted(bool s) { m_stopsSorted = s; }
 
+        void setSpreadMethod(GradientSpreadMethod);
+        GradientSpreadMethod spreadMethod() { return m_spreadMethod; }
+        void setGradientSpaceTransform(const TransformationMatrix& gradientSpaceTransformation) { m_gradientSpaceTransformation = gradientSpaceTransformation; }
+        // Qt and CG transform the gradient at draw time
+        TransformationMatrix gradientSpaceTransform() { return m_gradientSpaceTransformation; }
+
         virtual void fill(GraphicsContext*, const FloatRect&);
 
     private:
@@ -105,6 +113,8 @@ namespace WebCore {
         mutable Vector<ColorStop> m_stops;
         mutable bool m_stopsSorted;
         mutable int m_lastStop;
+        GradientSpreadMethod m_spreadMethod;
+        TransformationMatrix m_gradientSpaceTransformation;
 
         PlatformGradient m_gradient;
     };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
index 41ccdcf244..4dae3d276e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
@@ -30,7 +30,6 @@
 #include "Generator.h"
 #include "GraphicsContextPrivate.h"
 #include "Font.h"
-#include "NotImplemented.h"
 
 using namespace std;
 
@@ -109,17 +108,6 @@ void GraphicsContext::restore()
     restorePlatformState();
 }
 
-const Font& GraphicsContext::font() const
-{
-    return m_common->state.font;
-}
-
-void GraphicsContext::setFont(const Font& aFont)
-{
-    m_common->state.font = aFont;
-    setPlatformFont(aFont);
-}
-
 void GraphicsContext::setStrokeThickness(float thickness)
 {
     m_common->state.strokeThickness = thickness;
@@ -139,6 +127,11 @@ void GraphicsContext::setStrokeColor(const Color& color)
     setPlatformStrokeColor(color);
 }
 
+ColorSpace GraphicsContext::strokeColorSpace() const
+{
+    return m_common->state.strokeColorSpace;
+}
+
 void GraphicsContext::setShadow(const IntSize& size, int blur, const Color& color)
 {
     m_common->state.shadowSize = size;
@@ -189,16 +182,6 @@ void GraphicsContext::setFillRule(WindRule fillRule)
     m_common->state.fillRule = fillRule;
 }
 
-GradientSpreadMethod GraphicsContext::spreadMethod() const
-{
-    return m_common->state.spreadMethod;
-}
-
-void GraphicsContext::setSpreadMethod(GradientSpreadMethod spreadMethod)
-{
-    m_common->state.spreadMethod = spreadMethod;
-}
-
 void GraphicsContext::setFillColor(const Color& color)
 {
     m_common->state.fillColorSpace = SolidColorSpace;
@@ -211,6 +194,17 @@ Color GraphicsContext::fillColor() const
     return m_common->state.fillColor;
 }
 
+void GraphicsContext::setShouldAntialias(bool b)
+{
+    m_common->state.shouldAntialias = b;
+    setPlatformShouldAntialias(b);
+}
+
+bool GraphicsContext::shouldAntialias() const
+{
+    return m_common->state.shouldAntialias;
+}
+
 void GraphicsContext::setStrokePattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
@@ -255,6 +249,31 @@ void GraphicsContext::setFillGradient(PassRefPtr<Gradient> gradient)
     m_common->state.fillGradient = gradient;
 }
 
+Gradient* GraphicsContext::fillGradient() const
+{
+    return m_common->state.fillGradient.get();
+}
+
+ColorSpace GraphicsContext::fillColorSpace() const
+{
+    return m_common->state.fillColorSpace;
+}
+
+Gradient* GraphicsContext::strokeGradient() const
+{
+    return m_common->state.strokeGradient.get();
+}
+
+Pattern* GraphicsContext::fillPattern() const
+{
+    return m_common->state.fillPattern.get();
+}
+
+Pattern* GraphicsContext::strokePattern() const
+{
+    return m_common->state.strokePattern.get();
+}
+
 void GraphicsContext::setShadowsIgnoreTransforms(bool ignoreTransforms)
 {
     m_common->state.shadowsIgnoreTransforms = ignoreTransforms;
@@ -301,15 +320,15 @@ void GraphicsContext::drawImage(Image* image, const IntRect& dest, const IntRect
     drawImage(image, FloatRect(dest), srcRect, op, useLowQualityScale);
 }
 
-void GraphicsContext::drawText(const TextRun& run, const IntPoint& point, int from, int to)
+void GraphicsContext::drawText(const Font& font, const TextRun& run, const IntPoint& point, int from, int to)
 {
     if (paintingDisabled())
         return;
     
-    font().drawText(this, run, point, from, to);
+    font.drawText(this, run, point, from, to);
 }
 
-void GraphicsContext::drawBidiText(const TextRun& run, const FloatPoint& point)
+void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const FloatPoint& point)
 {
     if (paintingDisabled())
         return;
@@ -317,7 +336,7 @@ void GraphicsContext::drawBidiText(const TextRun& run, const FloatPoint& point)
     BidiResolver<TextRunIterator, BidiCharacterRun> bidiResolver;
     WTF::Unicode::Direction paragraphDirection = run.ltr() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
 
-    bidiResolver.setStatus(BidiStatus(paragraphDirection, paragraphDirection, paragraphDirection, new BidiContext(run.ltr() ? 0 : 1, paragraphDirection, run.directionalOverride())));
+    bidiResolver.setStatus(BidiStatus(paragraphDirection, paragraphDirection, paragraphDirection, BidiContext::create(run.ltr() ? 0 : 1, paragraphDirection, run.directionalOverride())));
 
     bidiResolver.setPosition(TextRunIterator(&run, 0));
     bidiResolver.createBidiRunsForLine(TextRunIterator(&run, run.length()));
@@ -334,23 +353,23 @@ void GraphicsContext::drawBidiText(const TextRun& run, const FloatPoint& point)
         subrun.setRTL(bidiRun->level() % 2);
         subrun.setDirectionalOverride(bidiRun->dirOverride(false));
 
-        font().drawText(this, subrun, currPoint);
+        font.drawText(this, subrun, currPoint);
 
         bidiRun = bidiRun->next();
         // FIXME: Have Font::drawText return the width of what it drew so that we don't have to re-measure here.
         if (bidiRun)
-            currPoint.move(font().floatWidth(subrun), 0.f);
+            currPoint.move(font.floatWidth(subrun), 0.f);
     }
 
     bidiResolver.deleteRuns();
 }
 
-void GraphicsContext::drawHighlightForText(const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, int from, int to)
+void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, int from, int to)
 {
     if (paintingDisabled())
         return;
 
-    fillRect(font().selectionRectForText(run, point, h, from, to), backgroundColor);
+    fillRect(font.selectionRectForText(run, point, h, from, to), backgroundColor);
 }
 
 void GraphicsContext::initFocusRing(int width, int offset)
@@ -503,10 +522,4 @@ void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle&)
 }
 #endif
 
-#if !PLATFORM(QT)
-void GraphicsContext::setPlatformFont(const Font&)
-{
-}
-#endif
-
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
index 331aec2f02..01e2fe6347 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
@@ -117,6 +117,18 @@ namespace WebCore {
         DashedStroke
     };
 
+// FIXME: This is a place-holder until we decide to add
+// real color space support to WebCore.  At that time, ColorSpace will be a
+// class and instances will be held  off of Colors.   There will be
+// special singleton Gradient and Pattern color spaces to mark when
+// a fill or stroke is using a gradient or pattern instead of a solid color.
+// https://bugs.webkit.org/show_bug.cgi?id=20558
+    enum ColorSpace {
+        SolidColorSpace,
+        PatternColorSpace,
+        GradientColorSpace
+    };
+
     enum InterpolationQuality {
         InterpolationDefault,
         InterpolationNone,
@@ -125,23 +137,12 @@ namespace WebCore {
         InterpolationHigh
     };
 
-    // FIXME: Currently these constants have to match the values used in the SVG
-    // DOM API. That's a mistake. We need to make cut that dependency.
-    enum GradientSpreadMethod {
-        SpreadMethodPad = 1,
-        SpreadMethodReflect = 2,
-        SpreadMethodRepeat = 3
-    };
-
     class GraphicsContext : Noncopyable {
     public:
         GraphicsContext(PlatformGraphicsContext*);
         ~GraphicsContext();
        
         PlatformGraphicsContext* platformContext() const;
-
-        const Font& font() const;
-        void setFont(const Font&);
         
         float strokeThickness() const;
         void setStrokeThickness(float);
@@ -149,23 +150,45 @@ namespace WebCore {
         void setStrokeStyle(const StrokeStyle& style);
         Color strokeColor() const;
         void setStrokeColor(const Color&);
+
+        ColorSpace strokeColorSpace() const;
+
         void setStrokePattern(PassRefPtr<Pattern>);
+        Pattern* strokePattern() const;
+
         void setStrokeGradient(PassRefPtr<Gradient>);
+        Gradient* strokeGradient() const;
 
         WindRule fillRule() const;
         void setFillRule(WindRule);
-        GradientSpreadMethod spreadMethod() const;
-        void setSpreadMethod(GradientSpreadMethod);
         Color fillColor() const;
         void setFillColor(const Color&);
+
         void setFillPattern(PassRefPtr<Pattern>);
+        Pattern* fillPattern() const;
+
         void setFillGradient(PassRefPtr<Gradient>);
+        Gradient* fillGradient() const;
+
+        ColorSpace fillColorSpace() const;
+
         void setShadowsIgnoreTransforms(bool);
 
+        void setShouldAntialias(bool);
+        bool shouldAntialias() const;
+
+#if PLATFORM(CG)
+        void applyStrokePattern();
+        void applyFillPattern();
+#endif
+
         void save();
         void restore();
 
         // These draw methods will do both stroking and filling.
+        // FIXME: ...except drawRect(), which fills properly but always strokes
+        // using a 1-pixel stroke inset from the rect borders (of the correct
+        // stroke color).
         void drawRect(const IntRect&);
         void drawLine(const IntPoint&, const IntPoint&);
         void drawEllipse(const IntRect&);
@@ -215,9 +238,9 @@ namespace WebCore {
         int textDrawingMode();
         void setTextDrawingMode(int);
 
-        void drawText(const TextRun&, const IntPoint&, int from = 0, int to = -1);
-        void drawBidiText(const TextRun&, const FloatPoint&);
-        void drawHighlightForText(const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
+        void drawText(const Font&, const TextRun&, const IntPoint&, int from = 0, int to = -1);
+        void drawBidiText(const Font&, const TextRun&, const FloatPoint&);
+        void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
 
         FloatRect roundToDevicePixels(const FloatRect&);
         
@@ -271,14 +294,23 @@ namespace WebCore {
         void concatCTM(const TransformationMatrix&);
         TransformationMatrix getCTM() const;
 
-        void setUseAntialiasing(bool = true);
-
 #if PLATFORM(WIN)
         GraphicsContext(HDC, bool hasAlpha = false); // FIXME: To be removed.
         bool inTransparencyLayer() const;
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true); // The passed in rect is used to create a bitmap for compositing inside transparency layers.
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);    // The passed in HDC should be the one handed back by getWindowsContext.
 
+        // When set to true, child windows should be rendered into this context
+        // rather than allowing them just to render to the screen. Defaults to
+        // false.
+        // FIXME: This is a layering violation. GraphicsContext shouldn't know
+        // what a "window" is. It would be much more appropriate for this flag
+        // to be passed as a parameter alongside the GraphicsContext, but doing
+        // that would require lots of changes in cross-platform code that we
+        // aren't sure we want to make.
+        void setShouldIncludeChildWindows(bool);
+        bool shouldIncludeChildWindows() const;
+
         class WindowsBitmap : public Noncopyable {
         public:
             WindowsBitmap(HDC, IntSize);
@@ -307,6 +339,7 @@ namespace WebCore {
 #if PLATFORM(QT) && defined(Q_WS_WIN)
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
+        bool shouldIncludeChildWindows() const { return false; }
 #endif
 
 #if PLATFORM(QT)
@@ -334,6 +367,8 @@ namespace WebCore {
 
         void setPlatformFillColor(const Color&);
 
+        void setPlatformShouldAntialias(bool b);
+
         void setPlatformShadow(const IntSize&, int blur, const Color&);
         void clearPlatformShadow();
 
@@ -351,3 +386,4 @@ namespace WebCore {
 } // namespace WebCore
 
 #endif // GraphicsContext_h
+
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h
index ab94258f01..98baab1228 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContextPrivate.h
@@ -27,25 +27,12 @@
 #define GraphicsContextPrivate_h
 
 #include "TransformationMatrix.h"
-#include "Font.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
 #include "Pattern.h"
 
 namespace WebCore {
 
-// FIXME: This is a place-holder until we decide to add
-// real color space support to WebCore.  At that time, ColorSpace will be a
-// class and instances will be held  off of Colors.   There will be
-// special singleton Gradient and Pattern color spaces to mark when
-// a fill or stroke is using a gradient or pattern instead of a solid color.
-// https://bugs.webkit.org/show_bug.cgi?id=20558
-    enum ColorSpace {
-        SolidColorSpace,
-        PatternColorSpace,
-        GradientColorSpace
-    };
-
     struct GraphicsContextState {
         GraphicsContextState()
             : textDrawingMode(cTextFill)
@@ -59,13 +46,13 @@ namespace WebCore {
             , fillRule(RULE_NONZERO)
             , fillColorSpace(SolidColorSpace)
             , fillColor(Color::black)
+            , shouldAntialias(true)
             , paintingDisabled(false)
             , shadowBlur(0)
             , shadowsIgnoreTransforms(false)
         {
         }
 
-        Font font;
         int textDrawingMode;
         
         StrokeStyle strokeStyle;
@@ -81,12 +68,13 @@ namespace WebCore {
         RefPtr<Pattern> strokePattern;
         
         WindRule fillRule;
-        GradientSpreadMethod spreadMethod;
         ColorSpace fillColorSpace;
         Color fillColor;
         RefPtr<Gradient> fillGradient;
         RefPtr<Pattern> fillPattern;
 
+        bool shouldAntialias;
+
         bool paintingDisabled;
         
         IntSize shadowSize;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
new file mode 100644
index 0000000000..0c442a2f06
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -0,0 +1,545 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayer.h"
+
+#include "FloatPoint.h"
+#include "RotateTransformOperation.h"
+#include "TextStream.h"
+
+namespace WebCore {
+
+void GraphicsLayer::FloatValue::set(float key, float value, const TimingFunction* timingFunction)
+{
+    m_key = key;
+    m_value = value;
+    if (timingFunction != m_timingFunction) {
+        if (timingFunction)
+            m_timingFunction.set(new TimingFunction(*timingFunction));
+        else
+            m_timingFunction.clear();
+    }
+}
+
+void GraphicsLayer::TransformValue::set(float key, const TransformOperations* value, const TimingFunction* timingFunction)
+{
+    m_key = key;
+    if (value != m_value) {
+        if (value)
+            m_value.set(new TransformOperations(*value));
+        else
+            m_value.clear();
+    }
+    if (timingFunction != m_timingFunction) {
+        if (timingFunction)
+            m_timingFunction.set(new TimingFunction(*timingFunction));
+        else
+            m_timingFunction.clear();
+    }
+}
+
+void GraphicsLayer::FloatValueList::insert(float key, float value, const TimingFunction* timingFunction)
+{
+    for (size_t i = 0; i < m_values.size(); ++i) {
+        FloatValue& curFloatValue = m_values[i];
+        if (curFloatValue.key() == key) {
+            curFloatValue.set(key, value, timingFunction);
+            return;
+        }
+        if (curFloatValue.key() > key) {
+            // insert before
+            m_values.insert(i, FloatValue(key, value, timingFunction));
+            return;
+        }
+    }
+    
+    // append
+    m_values.append(FloatValue(key, value, timingFunction));
+}
+
+void GraphicsLayer::TransformValueList::insert(float key, const TransformOperations* value, const TimingFunction* timingFunction)
+{
+    for (size_t i = 0; i < m_values.size(); ++i) {
+        TransformValue& curTransValue = m_values[i];
+        if (curTransValue.key() == key) {
+            curTransValue.set(key, value, timingFunction);
+            return;
+        }
+        if (curTransValue.key() > key) {
+            // insert before
+            m_values.insert(i, TransformValue(key, value, timingFunction));
+            return;
+        }
+    }
+    
+    // append
+    m_values.append(TransformValue(key, value, timingFunction));
+}
+
+// An "invalid" list is one whose functions don't match, and therefore has to be animated as a Matrix
+// The hasBigRotation flag will always return false if isValid is false. Otherwise hasBigRotation is 
+// true if the rotation between any two keyframes is >= 180 degrees.
+void GraphicsLayer::TransformValueList::makeFunctionList(FunctionList& list, bool& isValid, bool& hasBigRotation) const
+{
+    list.clear();
+    isValid = false;
+    hasBigRotation = false;
+    
+    if (m_values.size() < 2)
+        return;
+    
+    // empty transforms match anything, so find the first non-empty entry as the reference
+    size_t firstIndex = 0;
+    for ( ; firstIndex < m_values.size(); ++firstIndex) {
+        if (m_values[firstIndex].value()->operations().size() > 0)
+            break;
+    }
+    
+    if (firstIndex >= m_values.size())
+        return;
+        
+    const TransformOperations* firstVal = m_values[firstIndex].value();
+    
+    // see if the keyframes are valid
+    for (size_t i = firstIndex + 1; i < m_values.size(); ++i) {
+        const TransformOperations* val = m_values[i].value();
+        
+        // a null transform matches anything
+        if (val->operations().isEmpty())
+            continue;
+            
+        if (firstVal->operations().size() != val->operations().size())
+            return;
+            
+        for (size_t j = 0; j < firstVal->operations().size(); ++j) {
+            if (!firstVal->operations().at(j)->isSameType(*val->operations().at(j)))
+                return;
+        }
+    }
+
+    // keyframes are valid, fill in the list
+    isValid = true;
+    
+    double lastRotAngle = 0.0;
+    double maxRotAngle = -1.0;
+        
+    list.resize(firstVal->operations().size());
+    for (size_t j = 0; j < firstVal->operations().size(); ++j) {
+        TransformOperation::OperationType type = firstVal->operations().at(j)->getOperationType();
+        list[j] = type;
+        
+        // if this is a rotation entry, we need to see if any angle differences are >= 180 deg
+        if (type == TransformOperation::ROTATE_X ||
+            type == TransformOperation::ROTATE_Y ||
+            type == TransformOperation::ROTATE_Z ||
+            type == TransformOperation::ROTATE_3D) {
+            lastRotAngle = static_cast<RotateTransformOperation*>(firstVal->operations().at(j).get())->angle();
+            
+            if (maxRotAngle < 0)
+                maxRotAngle = fabs(lastRotAngle);
+            
+            for (size_t i = firstIndex + 1; i < m_values.size(); ++i) {
+                const TransformOperations* val = m_values[i].value();
+                double rotAngle = val->operations().isEmpty() ? 0 : (static_cast<RotateTransformOperation*>(val->operations().at(j).get())->angle());
+                double diffAngle = fabs(rotAngle - lastRotAngle);
+                if (diffAngle > maxRotAngle)
+                    maxRotAngle = diffAngle;
+                lastRotAngle = rotAngle;
+            }
+        }
+    }
+    
+    hasBigRotation = maxRotAngle >= 180.0;
+}
+
+GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
+    : m_client(client)
+    , m_anchorPoint(0.5f, 0.5f, 0)
+    , m_opacity(1)
+#ifndef NDEBUG
+    , m_zPosition(0)
+#endif
+    , m_backgroundColorSet(false)
+    , m_contentsOpaque(false)
+    , m_preserves3D(false)
+    , m_backfaceVisibility(true)
+    , m_usingTiledLayer(false)
+    , m_masksToBounds(false)
+    , m_drawsContent(false)
+    , m_paintingPhase(GraphicsLayerPaintAllMask)
+    , m_parent(0)
+#ifndef NDEBUG
+    , m_repaintCount(0)
+#endif
+{
+}
+
+GraphicsLayer::~GraphicsLayer()
+{
+    removeAllAnimations();    
+
+    removeAllChildren();
+    removeFromParent();
+}
+
+void GraphicsLayer::addChild(GraphicsLayer* childLayer)
+{
+    ASSERT(childLayer != this);
+    
+    if (childLayer->parent())
+        childLayer->removeFromParent();
+
+    childLayer->setParent(this);
+    m_children.append(childLayer);
+}
+
+void GraphicsLayer::addChildAtIndex(GraphicsLayer* childLayer, int index)
+{
+    ASSERT(childLayer != this);
+
+    if (childLayer->parent())
+        childLayer->removeFromParent();
+
+    childLayer->setParent(this);
+    m_children.insert(index, childLayer);
+}
+
+void GraphicsLayer::addChildBelow(GraphicsLayer* childLayer, GraphicsLayer* sibling)
+{
+    ASSERT(childLayer != this);
+    childLayer->removeFromParent();
+
+    bool found = false;
+    for (unsigned i = 0; i < m_children.size(); i++) {
+        if (sibling == m_children[i]) {
+            m_children.insert(i, childLayer);
+            found = true;
+            break;
+        }
+    }
+
+    childLayer->setParent(this);
+
+    if (!found)
+        m_children.append(childLayer);
+}
+
+void GraphicsLayer::addChildAbove(GraphicsLayer* childLayer, GraphicsLayer* sibling)
+{
+    childLayer->removeFromParent();
+    ASSERT(childLayer != this);
+
+    bool found = false;
+    for (unsigned i = 0; i < m_children.size(); i++) {
+        if (sibling == m_children[i]) {
+            m_children.insert(i+1, childLayer);
+            found = true;
+            break;
+        }
+    }
+
+    childLayer->setParent(this);
+
+    if (!found)
+        m_children.append(childLayer);
+}
+
+bool GraphicsLayer::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    ASSERT(!newChild->parent());
+    bool found = false;
+    for (unsigned i = 0; i < m_children.size(); i++) {
+        if (oldChild == m_children[i]) {
+            m_children[i] = newChild;
+            found = true;
+            break;
+        }
+    }
+    if (found) {
+        oldChild->setParent(0);
+
+        newChild->removeFromParent();
+        newChild->setParent(this);
+        return true;
+    }
+    return false;
+}
+
+void GraphicsLayer::removeAllChildren()
+{
+    while (m_children.size()) {
+        GraphicsLayer* curLayer = m_children[0];
+        ASSERT(curLayer->parent());
+        curLayer->removeFromParent();
+    }
+}
+
+void GraphicsLayer::removeFromParent()
+{
+    if (m_parent) {
+        unsigned i;
+        for (i = 0; i < m_parent->m_children.size(); i++) {
+            if (this == m_parent->m_children[i]) {
+                m_parent->m_children.remove(i);
+                break;
+            }
+        }
+
+        setParent(0);
+    }
+}
+
+void GraphicsLayer::setBackgroundColor(const Color& inColor, const Animation*, double /*beginTime*/)
+{
+    m_backgroundColor = inColor;
+    m_backgroundColorSet = true;
+}
+
+void GraphicsLayer::clearBackgroundColor()
+{
+    m_backgroundColor = Color();
+    m_backgroundColorSet = false;
+}
+
+bool GraphicsLayer::setOpacity(float opacity, const Animation*, double)
+{
+    m_opacity = opacity;
+    return false;       // not animating
+}
+
+void GraphicsLayer::paintGraphicsLayerContents(GraphicsContext& context, const IntRect& clip)
+{
+    m_client->paintContents(this, context, m_paintingPhase, clip);
+}
+
+String GraphicsLayer::propertyIdToString(AnimatedPropertyID property)
+{
+    switch (property) {
+        case AnimatedPropertyWebkitTransform:
+            return "transform";
+        case AnimatedPropertyOpacity:
+            return "opacity";
+        case AnimatedPropertyBackgroundColor:
+            return "backgroundColor";
+        case AnimatedPropertyInvalid:
+            ASSERT_NOT_REACHED();
+    }
+    ASSERT_NOT_REACHED();
+    return "";
+}
+
+int GraphicsLayer::findAnimationEntry(AnimatedPropertyID property, short index) const
+{
+    for (size_t i = 0; i < m_animations.size(); ++i) {
+        if (m_animations[i].matches(property, index))
+            return static_cast<int>(i);
+    }
+    return -1;
+}
+
+void GraphicsLayer::addAnimationEntry(AnimatedPropertyID property, short index, bool isTransition, const Animation* transition)
+{
+    int i = findAnimationEntry(property, index);
+    
+    if (i >= 0)
+        m_animations[i].reset(transition, isTransition);
+    else
+        m_animations.append(AnimationEntry(transition, property, index, isTransition));
+}
+
+void GraphicsLayer::removeAllAnimations()
+{
+    size_t size = m_animations.size();
+    for (size_t i = 0; i < size; ++i)
+        removeAnimation(0, true);
+}
+
+void GraphicsLayer::removeAllAnimationsForProperty(AnimatedPropertyID property)
+{
+    for (short j = 0; ; ++j) {
+        int i = findAnimationEntry(property, j);
+        if (i < 0)
+            break;
+        removeAnimation(i, false);
+    }
+}
+
+void GraphicsLayer::removeFinishedAnimations(const String& name, int /*index*/, bool reset)
+{
+    size_t size = m_animations.size();
+    for (size_t i = 0; i < size; ) {
+        AnimationEntry& anim = m_animations[i];
+        if (!anim.isTransition() && anim.animation()->name() == name) {
+            removeAnimation(i, reset);
+            --size;
+        } else
+            ++i;
+    }
+}
+
+void GraphicsLayer::removeFinishedTransitions(AnimatedPropertyID property)
+{
+    size_t size = m_animations.size();
+    for (size_t i = 0; i < size; ) {
+        AnimationEntry& anim = m_animations[i];
+        if (anim.isTransition() && property == anim.property()) {
+            removeAnimation(i, false);
+            --size;
+        } else
+            ++i;
+    }
+}
+
+void GraphicsLayer::suspendAnimations()
+{
+}
+
+void GraphicsLayer::resumeAnimations()
+{
+}
+
+#ifndef NDEBUG
+void GraphicsLayer::updateDebugIndicators()
+{
+    if (GraphicsLayer::showDebugBorders()) {
+        if (drawsContent()) {
+            if (m_usingTiledLayer)
+                setDebugBorder(Color(0, 255, 0, 204), 2.0f);    // tiled layer: green
+            else
+                setDebugBorder(Color(255, 0, 0, 204), 2.0f);    // normal layer: red
+        } else if (masksToBounds()) {
+            setDebugBorder(Color(128, 255, 255, 178), 2.0f);    // masking layer: pale blue
+            if (GraphicsLayer::showDebugBorders())
+                setDebugBackgroundColor(Color(128, 255, 255, 52));
+        } else
+            setDebugBorder(Color(255, 255, 0, 204), 2.0f);      // container: yellow
+    }
+}
+
+void GraphicsLayer::setZPosition(float position)
+{
+    m_zPosition = position;
+}
+#endif
+
+static void writeIndent(TextStream& ts, int indent)
+{
+    for (int i = 0; i != indent; ++i)
+        ts << "  ";
+}
+
+void GraphicsLayer::dumpLayer(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    ts << "(" << "GraphicsLayer" << " " << static_cast<void*>(const_cast<GraphicsLayer*>(this));
+    ts << " \"" << m_name << "\"\n";
+    dumpProperties(ts, indent);
+    writeIndent(ts, indent);
+    ts << ")\n";
+}
+
+void GraphicsLayer::dumpProperties(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent + 1);
+    ts << "(position " << m_position.x() << " " << m_position.y() << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(anchor " << m_anchorPoint.x() << " " << m_anchorPoint.y() << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(bounds " << m_size.width() << " " << m_size.height() << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(opacity " << m_opacity << ")\n";
+    
+    writeIndent(ts, indent + 1);
+    ts << "(usingTiledLayer " << m_usingTiledLayer << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(m_preserves3D " << m_preserves3D << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(drawsContent " << m_drawsContent << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(m_backfaceVisibility " << (m_backfaceVisibility ? "visible" : "hidden") << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(client ";
+    if (m_client)
+        ts << static_cast<void*>(m_client);
+    else
+        ts << "none";
+    ts << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(backgroundColor ";
+    if (!m_backgroundColorSet)
+        ts << "none";
+    else
+        ts << m_backgroundColor.name();
+    ts << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(transform ";
+    if (m_transform.isIdentity())
+        ts << "identity";
+    else {
+        ts << "[" << m_transform.m11() << " " << m_transform.m12() << " " << m_transform.m13() << " " << m_transform.m14() << "] ";
+        ts << "[" << m_transform.m21() << " " << m_transform.m22() << " " << m_transform.m23() << " " << m_transform.m24() << "] ";
+        ts << "[" << m_transform.m31() << " " << m_transform.m32() << " " << m_transform.m33() << " " << m_transform.m34() << "] ";
+        ts << "[" << m_transform.m41() << " " << m_transform.m42() << " " << m_transform.m43() << " " << m_transform.m44() << "]";
+    }
+    ts << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(childrenTransform ";
+    if (m_childrenTransform.isIdentity())
+        ts << "identity";
+    else {
+        ts << "[" << m_childrenTransform.m11() << " " << m_childrenTransform.m12() << " " << m_childrenTransform.m13() << " " << m_childrenTransform.m14() << "] ";
+        ts << "[" << m_childrenTransform.m21() << " " << m_childrenTransform.m22() << " " << m_childrenTransform.m23() << " " << m_childrenTransform.m24() << "] ";
+        ts << "[" << m_childrenTransform.m31() << " " << m_childrenTransform.m32() << " " << m_childrenTransform.m33() << " " << m_childrenTransform.m34() << "] ";
+        ts << "[" << m_childrenTransform.m41() << " " << m_childrenTransform.m42() << " " << m_childrenTransform.m43() << " " << m_childrenTransform.m44() << "]";
+    }
+    ts << ")\n";
+
+    writeIndent(ts, indent + 1);
+    ts << "(children " << m_children.size() << "\n";
+    
+    unsigned i;
+    for (i = 0; i < m_children.size(); i++)
+        m_children[i]->dumpLayer(ts, indent+2);
+    writeIndent(ts, indent + 1);
+    ts << ")\n";
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
new file mode 100644
index 0000000000..ae51951058
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
@@ -0,0 +1,409 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsLayer_h
+#define GraphicsLayer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Animation.h"
+#include "Color.h"
+#include "FloatPoint.h"
+#include "FloatPoint3D.h"
+#include "FloatSize.h"
+#include "GraphicsLayerClient.h"
+#include "TransformationMatrix.h"
+#include "TransformOperations.h"
+#include <wtf/OwnPtr.h>
+
+#if PLATFORM(MAC)
+#ifdef __OBJC__
+@class WebLayer;
+@class CALayer;
+typedef WebLayer PlatformLayer;
+typedef CALayer* NativeLayer;
+#else
+typedef void* PlatformLayer;
+typedef void* NativeLayer;
+#endif
+#else
+typedef void* PlatformLayer;
+typedef void* NativeLayer;
+#endif
+
+namespace WebCore {
+
+class FloatPoint3D;
+class GraphicsContext;
+class Image;
+class TextStream;
+class TimingFunction;
+
+// GraphicsLayer is an abstraction for a rendering surface with backing store,
+// which may have associated transformation and animations.
+
+class GraphicsLayer {
+public:
+    // Used to store one float value of a keyframe animation.
+    class FloatValue {
+    public:
+        FloatValue(float key, float value, const TimingFunction* timingFunction = 0)
+            : m_key(key), m_value(value), m_timingFunction(0)
+        {
+            if (timingFunction)
+                m_timingFunction.set(new TimingFunction(*timingFunction));
+        }
+
+        FloatValue(const FloatValue& other)
+            : m_key(other.key()), m_value(other.value()), m_timingFunction(0)
+        {
+            if (other.timingFunction())
+                m_timingFunction.set(new TimingFunction(*other.timingFunction()));
+        }
+
+        const FloatValue& operator=(const FloatValue& other)
+        {
+            if (&other != this)
+                set(other.key(), other.value(), other.timingFunction());
+            return *this;
+        }
+
+        void set(float key, float value, const TimingFunction*);
+        
+        float key() const { return m_key; }
+        float value() const { return m_value; }
+        const TimingFunction* timingFunction() const { return m_timingFunction.get(); }
+
+    private:
+        float m_key;
+        float m_value;
+        OwnPtr<TimingFunction> m_timingFunction;
+    };
+    
+    
+    class FloatValueList {
+    public:
+        void insert(float key, float value, const TimingFunction* timingFunction);
+
+        size_t size() const { return m_values.size(); }
+        const FloatValue& at(size_t i) const { return m_values.at(i); }
+        const Vector<FloatValue>& values() const { return m_values; }
+
+    private:
+        Vector<FloatValue> m_values;
+    };
+
+    // Used to store one transform in a keyframe list.
+    class TransformValue {
+    public:
+        TransformValue(float key = NAN, const TransformOperations* value = 0, const TimingFunction* timingFunction = 0)
+            : m_key(key)
+        {
+            if (value)
+                m_value.set(new TransformOperations(*value));
+            if (timingFunction)
+                m_timingFunction.set(new TimingFunction(*timingFunction));
+        }
+
+        TransformValue(const TransformValue& other)
+            : m_key(other.key())
+        {
+            if (other.value())
+                m_value.set(new TransformOperations(*other.value()));
+            if (other.timingFunction())
+                m_timingFunction.set(new TimingFunction(*other.timingFunction()));
+        }
+
+        const TransformValue& operator=(const TransformValue& other)
+        {
+            if (&other != this)
+                set(other.key(), other.value(), other.timingFunction());
+            return *this;
+        }
+
+        void set(float key, const TransformOperations* value, const TimingFunction* timingFunction);
+
+        float key() const { return m_key; }
+        const TransformOperations* value() const { return m_value.get(); }
+        const TimingFunction* timingFunction() const { return m_timingFunction.get(); }
+        
+    private:
+        float m_key;
+        OwnPtr<TransformOperations> m_value;
+        OwnPtr<TimingFunction> m_timingFunction;
+    };
+    
+    // Used to store a series of transforms in a keyframe list.
+    class TransformValueList {
+    public:
+        typedef Vector<TransformOperation::OperationType> FunctionList;
+
+        size_t size() const { return m_values.size(); }
+        const TransformValue& at(size_t i) const { return m_values.at(i); }
+        const Vector<TransformValue>& values() const { return m_values; }
+        
+        void insert(float key, const TransformOperations* value, const TimingFunction* timingFunction);
+        
+        // return a list of the required functions. List is empty if keyframes are not valid
+        // If return value is true, functions contain rotations of >= 180 degrees
+        void makeFunctionList(FunctionList& list, bool& isValid, bool& hasBigRotation) const;
+    private:
+        Vector<TransformValue> m_values;
+    };
+
+    static GraphicsLayer* createGraphicsLayer(GraphicsLayerClient*);
+    
+    virtual ~GraphicsLayer();
+
+    GraphicsLayerClient* client() const { return m_client; }
+
+    // Layer name. Only used to identify layers in debug output
+    const String& name() const { return m_name; }
+    virtual void setName(const String& name) { m_name = name; }
+
+    // For hosting this GraphicsLayer in a native layer hierarchy.
+    virtual NativeLayer nativeLayer() const { return 0; }
+
+    GraphicsLayer* parent() const { return m_parent; };
+    void setParent(GraphicsLayer* layer) { m_parent = layer; } // Internal use only.
+    
+    const Vector<GraphicsLayer*>& children() const { return m_children; }
+
+    // Add child layers. If the child is already parented, it will be removed from its old parent.
+    virtual void addChild(GraphicsLayer*);
+    virtual void addChildAtIndex(GraphicsLayer*, int index);
+    virtual void addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling);
+    virtual void addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling);
+    virtual bool replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild);
+
+    void removeAllChildren();
+    virtual void removeFromParent();
+
+    // Offset is origin of the renderer minus origin of the graphics layer (so either zero or negative).
+    IntSize offsetFromRenderer() const { return m_offsetFromRenderer; }
+    void setOffsetFromRenderer(const IntSize& offset) { m_offsetFromRenderer = offset; }
+
+    // The position of the layer (the location of its top-left corner in its parent)
+    const FloatPoint& position() const { return m_position; }
+    virtual void setPosition(const FloatPoint& p) { m_position = p; }
+    
+    // Anchor point: (0, 0) is top left, (1, 1) is bottom right. The anchor point
+    // affects the origin of the transforms.
+    const FloatPoint3D& anchorPoint() const { return m_anchorPoint; }
+    virtual void setAnchorPoint(const FloatPoint3D& p) { m_anchorPoint = p; }
+
+    // The bounds of the layer
+    const FloatSize& size() const { return m_size; }
+    virtual void setSize(const FloatSize& size) { m_size = size; }
+
+    const TransformationMatrix& transform() const { return m_transform; }
+    virtual void setTransform(const TransformationMatrix& t) { m_transform = t; }
+
+    const TransformationMatrix& childrenTransform() const { return m_childrenTransform; }
+    virtual void setChildrenTransform(const TransformationMatrix& t) { m_childrenTransform = t; }
+
+    bool preserves3D() const { return m_preserves3D; }
+    virtual void setPreserves3D(bool b) { m_preserves3D = b; }
+    
+    bool masksToBounds() const { return m_masksToBounds; }
+    virtual void setMasksToBounds(bool b) { m_masksToBounds = b; }
+    
+    bool drawsContent() const { return m_drawsContent; }
+    virtual void setDrawsContent(bool b) { m_drawsContent = b; }
+
+    // The color used to paint the layer backgrounds
+    const Color& backgroundColor() const { return m_backgroundColor; }
+    virtual void setBackgroundColor(const Color&, const Animation* = 0, double beginTime = 0);
+    virtual void clearBackgroundColor();
+    bool backgroundColorSet() const { return m_backgroundColorSet; }
+
+    // opaque means that we know the layer contents have no alpha
+    bool contentsOpaque() const { return m_contentsOpaque; }
+    virtual void setContentsOpaque(bool b) { m_contentsOpaque = b; }
+
+    bool backfaceVisibility() const { return m_backfaceVisibility; }
+    virtual void setBackfaceVisibility(bool b) { m_backfaceVisibility = b; }
+
+    float opacity() const { return m_opacity; }
+    // return true if we started an animation
+    virtual bool setOpacity(float o, const Animation* = 0, double beginTime = 0);
+
+    // Some GraphicsLayers paint only the foreground or the background content
+    GraphicsLayerPaintingPhase drawingPhase() const { return m_paintingPhase; }
+    void setDrawingPhase(GraphicsLayerPaintingPhase phase) { m_paintingPhase = phase; }
+
+    virtual void setNeedsDisplay() = 0;
+    // mark the given rect (in layer coords) as needing dispay. Never goes deep.
+    virtual void setNeedsDisplayInRect(const FloatRect&) = 0;
+
+    virtual bool animateTransform(const TransformValueList&, const IntSize&, const Animation*, double beginTime, bool isTransition) = 0;
+    virtual bool animateFloat(AnimatedPropertyID, const FloatValueList&, const Animation*, double beginTime) = 0;
+    
+    void removeFinishedAnimations(const String& name, int index, bool reset);
+    void removeFinishedTransitions(AnimatedPropertyID);
+    void removeAllAnimations();
+
+    virtual void suspendAnimations();
+    virtual void resumeAnimations();
+    
+    // Layer contents
+    virtual void setContentsToImage(Image*) { }
+    virtual void setContentsToVideo(PlatformLayer*) { }
+    virtual void setContentsBackgroundColor(const Color&) { }
+    virtual void clearContents() { }
+    
+    virtual void updateContentsRect() { }
+
+    // Callback from the underlying graphics system to draw layer contents.
+    void paintGraphicsLayerContents(GraphicsContext&, const IntRect& clip);
+    
+    virtual PlatformLayer* platformLayer() const { return 0; }
+    
+    void dumpLayer(TextStream&, int indent = 0) const;
+
+#ifndef NDEBUG
+    int repaintCount() const { return m_repaintCount; }
+    int incrementRepaintCount() { return ++m_repaintCount; }
+#endif
+
+    // Report whether the underlying compositing system uses a top-down
+    // or a bottom-up coordinate system.
+    enum CompositingCoordinatesOrientation { CompositingCoordinatesTopDown, CompositingCoordinatesBottomUp };
+    static CompositingCoordinatesOrientation compositingCoordinatesOrientation();
+
+#ifndef NDEBUG
+    static bool showDebugBorders();
+    static bool showRepaintCounter();
+    
+    void updateDebugIndicators();
+    
+    virtual void setDebugBackgroundColor(const Color&) { }
+    virtual void setDebugBorder(const Color&, float /*borderWidth*/) { }
+    // z-position is the z-equivalent of position(). It's only used for debugging purposes.
+    virtual float zPosition() const { return m_zPosition; }
+    virtual void setZPosition(float);
+#endif
+
+    static String propertyIdToString(AnimatedPropertyID);
+    
+protected:
+    GraphicsLayer(GraphicsLayerClient*);
+
+    void dumpProperties(TextStream&, int indent) const;
+
+    // returns -1 if not found
+    int findAnimationEntry(AnimatedPropertyID, short index) const;
+    void addAnimationEntry(AnimatedPropertyID, short index, bool isTransition, const Animation*);
+
+    virtual void removeAnimation(int /*index*/, bool /*reset*/) {}
+    void removeAllAnimationsForProperty(AnimatedPropertyID);
+
+    GraphicsLayerClient* m_client;
+    String m_name;
+    
+    // Offset from the owning renderer
+    IntSize m_offsetFromRenderer;
+    
+    // Position is relative to the parent GraphicsLayer
+    FloatPoint m_position;
+    FloatPoint3D m_anchorPoint;
+    FloatSize m_size;
+    TransformationMatrix m_transform;
+    TransformationMatrix m_childrenTransform;
+
+    Color m_backgroundColor;
+    float m_opacity;
+#ifndef NDEBUG
+    float m_zPosition;
+#endif
+
+    bool m_backgroundColorSet : 1;
+    bool m_contentsOpaque : 1;
+    bool m_preserves3D: 1;
+    bool m_backfaceVisibility : 1;
+    bool m_usingTiledLayer : 1;
+    bool m_masksToBounds : 1;
+    bool m_drawsContent : 1;
+
+    GraphicsLayerPaintingPhase m_paintingPhase;
+
+    Vector<GraphicsLayer*> m_children;
+    GraphicsLayer* m_parent;
+    
+    // AnimationEntry represents an animation of a property on this layer.
+    // For transform only, there may be more than one, in which case 'index'
+    // is an index into the list of transforms. 
+    class AnimationEntry {
+    public:
+        AnimationEntry(const Animation* animation, AnimatedPropertyID property, short index, bool isTransition)
+            : m_animation(const_cast<Animation*>(animation))
+            , m_property(property)
+            , m_index(index)
+            , m_isCurrent(true)
+            , m_isTransition(isTransition)
+        {
+        }
+        
+        const Animation* animation() const { return m_animation.get(); }
+        AnimatedPropertyID property() const { return m_property; }
+        int index() const { return m_index; }
+        bool isCurrent() const { return m_isCurrent; }
+        void setIsCurrent(bool b = true) { m_isCurrent = b; }
+        bool isTransition() const { return m_isTransition; }
+
+        bool matches(AnimatedPropertyID property, short index) const
+        {
+            return m_property == property && m_index == index;
+        }
+        
+        void reset(const Animation* animation, bool isTransition)
+        {
+            m_animation = const_cast<Animation*>(animation);
+            m_isTransition = isTransition;
+            m_isCurrent = true;
+        }
+    
+    private:
+        RefPtr<Animation> m_animation;
+        AnimatedPropertyID m_property : 14;
+        short m_index : 16;
+        bool m_isCurrent : 1;
+        bool m_isTransition : 1;
+    };
+    
+    Vector<AnimationEntry> m_animations;      // running animations/transitions
+    
+#ifndef NDEBUG
+    int m_repaintCount;
+#endif
+};
+
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // GraphicsLayer_h
+
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
new file mode 100644
index 0000000000..46382f2cf2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsLayerClient_h
+#define GraphicsLayerClient_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+namespace WebCore {
+
+class GraphicsContext;
+class GraphicsLayer;
+class IntPoint;
+class IntRect;
+class FloatPoint;
+
+enum GraphicsLayerPaintingPhase {
+    GraphicsLayerPaintBackgroundMask = (1 << 0),
+    GraphicsLayerPaintForegroundMask = (1 << 1),
+    GraphicsLayerPaintAllMask = (GraphicsLayerPaintBackgroundMask | GraphicsLayerPaintForegroundMask)
+};
+
+enum AnimatedPropertyID {
+    AnimatedPropertyInvalid,
+    AnimatedPropertyWebkitTransform,
+    AnimatedPropertyOpacity,
+    AnimatedPropertyBackgroundColor
+};
+
+class GraphicsLayerClient {
+public:
+    virtual ~GraphicsLayerClient() {}
+
+    // Callbacks for when hardware-accelerated transitions and animation started
+    virtual void notifyAnimationStarted(const GraphicsLayer*, double time) = 0;
+    
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) = 0;
+
+    // Return a rect for the "contents" of the graphics layer, i.e. video or image content, in GraphicsLayer coordinates.
+    virtual IntRect contentsBox(const GraphicsLayer*) = 0;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // GraphicsLayerClient_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsTypes.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsTypes.h
index cdf5e31e4c..769207aaca 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsTypes.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsTypes.h
@@ -50,6 +50,14 @@ namespace WebCore {
         CompositePlusLighter
     };
 
+    // FIXME: Currently these constants have to match the values used in the SVG
+    // DOM API. That's a mistake. We need to make cut that dependency.
+    enum GradientSpreadMethod {
+        SpreadMethodPad = 1,
+        SpreadMethodReflect = 2,
+        SpreadMethodRepeat = 3
+    };
+
     enum LineCap { ButtCap, RoundCap, SquareCap };
 
     enum LineJoin { MiterJoin, RoundJoin, BevelJoin };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp
index 49933425aa..08d96b450b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Image.cpp
@@ -62,11 +62,6 @@ bool Image::supportsType(const String& type)
     return MIMETypeRegistry::isSupportedImageResourceMIMEType(type); 
 } 
 
-bool Image::isNull() const
-{
-    return size().isEmpty();
-}
-
 bool Image::setData(PassRefPtr<SharedBuffer> data, bool allDataReceived)
 {
     m_data = data;
@@ -80,21 +75,6 @@ bool Image::setData(PassRefPtr<SharedBuffer> data, bool allDataReceived)
     return dataChanged(allDataReceived);
 }
 
-IntRect Image::rect() const
-{
-    return IntRect(IntPoint(), size());
-}
-
-int Image::width() const
-{
-    return size().width();
-}
-
-int Image::height() const
-{
-    return size().height();
-}
-
 void Image::fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, CompositeOperator op)
 {
     if (color.alpha() <= 0)
@@ -139,7 +119,7 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const Fl
 
     FloatSize scale(scaledTileSize.width() / intrinsicTileSize.width(),
                     scaledTileSize.height() / intrinsicTileSize.height());
-    TransformationMatrix patternTransform = TransformationMatrix().scale(scale.width(), scale.height());
+    TransformationMatrix patternTransform = TransformationMatrix().scaleNonUniform(scale.width(), scale.height());
 
     FloatRect oneTileRect;
     oneTileRect.setX(destRect.x() + fmodf(fmodf(-srcPoint.x(), scaledTileSize.width()) - scaledTileSize.width(), scaledTileSize.width()));
@@ -178,7 +158,7 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const Flo
         vRule = RepeatTile;
 
     FloatSize scale = calculatePatternScale(dstRect, srcRect, hRule, vRule);
-    TransformationMatrix patternTransform = TransformationMatrix().scale(scale.width(), scale.height());
+    TransformationMatrix patternTransform = TransformationMatrix().scaleNonUniform(scale.width(), scale.height());
 
     // We want to construct the phase such that the pattern is centered (when stretch is not
     // set for a particular rule).
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Image.h b/src/3rdparty/webkit/WebCore/platform/graphics/Image.h
index d648effb1f..bb61043cfd 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Image.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Image.h
@@ -30,6 +30,7 @@
 #include "Color.h"
 #include "GraphicsTypes.h"
 #include "ImageSource.h"
+#include "IntRect.h"
 #include <wtf/RefPtr.h>
 #include <wtf/PassRefPtr.h>
 #include "SharedBuffer.h"
@@ -60,6 +61,10 @@ class NativeImageSkia;
 #include <QPixmap>
 #endif
 
+#if PLATFORM(GTK)
+typedef struct _GdkPixbuf GdkPixbuf;
+#endif
+
 namespace WebCore {
 
 class TransformationMatrix;
@@ -67,8 +72,6 @@ class FloatPoint;
 class FloatRect;
 class FloatSize;
 class GraphicsContext;
-class IntRect;
-class IntSize;
 class SharedBuffer;
 class String;
 
@@ -92,7 +95,7 @@ public:
     virtual bool hasSingleSecurityOrigin() const { return false; }
 
     static Image* nullImage();
-    bool isNull() const;
+    bool isNull() const { return size().isEmpty(); }
 
     // These are only used for SVGImage right now
     virtual void setContainerSize(const IntSize&) { }
@@ -101,9 +104,9 @@ public:
     virtual bool hasRelativeHeight() const { return false; }
 
     virtual IntSize size() const = 0;
-    IntRect rect() const;
-    int width() const;
-    int height() const;
+    IntRect rect() const { return IntRect(IntPoint(), size()); }
+    int width() const { return size().width(); }
+    int height() const { return size().height(); }
 
     bool setData(PassRefPtr<SharedBuffer> data, bool allDataReceived);
     virtual bool dataChanged(bool /*allDataReceived*/) { return false; }
@@ -115,9 +118,9 @@ public:
 
     SharedBuffer* data() { return m_data.get(); }
 
-    // It may look unusual that there is no start animation call as public API.  This is because
-    // we start and stop animating lazily.  Animation begins whenever someone draws the image.  It will
-    // automatically pause once all observers no longer want to render the image anywhere.
+    // Animation begins whenever someone draws the image, so startAnimation() is not normally called.
+    // It will automatically pause once all observers no longer want to render the image anywhere.
+    virtual void startAnimation(bool /*catchUpIfNecessary*/ = true) { }
     virtual void stopAnimation() {}
     virtual void resetAnimation() {}
     
@@ -143,6 +146,10 @@ public:
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE) { return false; }
 #endif
 
+#if PLATFORM(GTK)
+    virtual GdkPixbuf* getGdkPixbuf() { return 0; }
+#endif
+
 protected:
     Image(ImageObserver* = 0);
 
@@ -156,11 +163,9 @@ protected:
     void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, CompositeOperator);
 
     // Supporting tiled drawing
-    virtual bool mayFillWithSolidColor() const { return false; }
+    virtual bool mayFillWithSolidColor() { return false; }
     virtual Color solidColor() const { return Color(); }
     
-    virtual void startAnimation(bool /*catchUpIfNecessary*/ = true) { }
-    
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
                              const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
 #if PLATFORM(CG)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
index 14f7461a1a..573e274a54 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,8 +32,8 @@
 #include "IntSize.h"
 #include "ImageBufferData.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
-#include <memory>
 
 namespace WebCore {
 
@@ -46,13 +46,13 @@ namespace WebCore {
     class ImageBuffer : Noncopyable {
     public:
         // Will return a null pointer on allocation failure.
-        static std::auto_ptr<ImageBuffer> create(const IntSize& size, bool grayScale)
+        static PassOwnPtr<ImageBuffer> create(const IntSize& size, bool grayScale)
         {
             bool success = false;
-            std::auto_ptr<ImageBuffer> buf(new ImageBuffer(size, grayScale, success));
+            OwnPtr<ImageBuffer> buf(new ImageBuffer(size, grayScale, success));
             if (success)
-                return buf;
-            return std::auto_ptr<ImageBuffer>();
+                return buf.release();
+            return 0;
         }
 
         ~ImageBuffer();
@@ -80,7 +80,7 @@ namespace WebCore {
         OwnPtr<GraphicsContext> m_context;
         mutable RefPtr<Image> m_image;
 
-        // This constructor will place its succes into the given out-variable
+        // This constructor will place its success into the given out-variable
         // so that create() knows when it should return failure.
         ImageBuffer(const IntSize&, bool grayScale, bool& success);
     };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
index 46e2ce45d4..e9f066e5ef 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
@@ -31,6 +31,7 @@
 
 #if PLATFORM(WX)
 class wxBitmap;
+class wxGraphicsBitmap;
 #elif PLATFORM(CG)
 typedef struct CGImageSource* CGImageSourceRef;
 typedef struct CGImage* CGImageRef;
@@ -57,7 +58,11 @@ class String;
 class ImageDecoder;
 typedef ImageDecoder* NativeImageSourcePtr;
 typedef const Vector<char>* NativeBytePtr;
+#if USE(WXGC)
+typedef wxGraphicsBitmap* NativeImagePtr;
+#else
 typedef wxBitmap* NativeImagePtr;
+#endif
 #elif PLATFORM(CG)
 typedef CGImageSourceRef NativeImageSourcePtr;
 typedef CGImageRef NativeImagePtr;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
index cb24b4e3d6..6bfdc5a1b0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
@@ -70,6 +70,7 @@ class IntPoint {
 public:
     IntPoint() : m_x(0), m_y(0) { }
     IntPoint(int x, int y) : m_x(x), m_y(y) { }
+    explicit IntPoint(const IntSize& size) : m_x(size.width()), m_y(size.height()) { }
 
     int x() const { return m_x; }
     int y() const { return m_y; }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
index 4d36545429..cac0bd19b3 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
@@ -73,6 +73,12 @@ public:
         m_height += height;
     }
     
+    void scale(float scale)
+    {
+        m_width = static_cast<int>(static_cast<float>(m_width) * scale);
+        m_height = static_cast<int>(static_cast<float>(m_height) * scale);
+    }
+    
     IntSize expandedTo(const IntSize& other) const
     {
         return IntSize(m_width > other.m_width ? m_width : other.m_width,
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
index 21e31fc794..b580474dbd 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,7 +27,9 @@
 
 #if ENABLE(VIDEO)
 #include "MediaPlayer.h"
+#include "MediaPlayerPrivate.h"
 
+#include "ContentType.h"
 #include "IntRect.h"
 #include "MIMETypeRegistry.h"
 #include "FrameView.h"
@@ -47,27 +49,207 @@
 #endif
 
 namespace WebCore {
+
+// a null player to make MediaPlayer logic simpler
+
+class NullMediaPlayerPrivate : public MediaPlayerPrivateInterface {
+public:
+    NullMediaPlayerPrivate(MediaPlayer*) { }
+
+    virtual void load(const String&) { }
+    virtual void cancelLoad() { }
+    
+    virtual void play() { }
+    virtual void pause() { }    
+
+    virtual IntSize naturalSize() const { return IntSize(0, 0); }
+
+    virtual bool hasVideo() const { return false; }
+
+    virtual void setVisible(bool) { }
+
+    virtual float duration() const { return 0; }
+
+    virtual float currentTime() const { return 0; }
+    virtual void seek(float) { }
+    virtual bool seeking() const { return false; }
+
+    virtual void setEndTime(float) { }
+
+    virtual void setRate(float) { }
+    virtual bool paused() const { return false; }
+
+    virtual void setVolume(float) { }
+
+    virtual MediaPlayer::NetworkState networkState() const { return MediaPlayer::Empty; }
+    virtual MediaPlayer::ReadyState readyState() const { return MediaPlayer::HaveNothing; }
+
+    virtual float maxTimeSeekable() const { return 0; }
+    virtual float maxTimeBuffered() const { return 0; }
+
+    virtual int dataRate() const { return 0; }
+
+    virtual bool totalBytesKnown() const { return false; }
+    virtual unsigned totalBytes() const { return 0; }
+    virtual unsigned bytesLoaded() const { return 0; }
+
+    virtual void setSize(const IntSize&) { }
+
+    virtual void paint(GraphicsContext*, const IntRect&) { }
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    virtual void setPoster(const String& /*url*/) { }
+    virtual void deliverNotification(MediaPlayerProxyNotificationType) { }
+    virtual void setMediaPlayerProxy(WebMediaPlayerProxy*) { }
+#endif
+};
+
+static MediaPlayerPrivateInterface* createNullMediaPlayer(MediaPlayer* player) 
+{ 
+    return new NullMediaPlayerPrivate(player); 
+}
+
+
+// engine support
+
+struct MediaPlayerFactory {
+    MediaPlayerFactory(CreateMediaEnginePlayer constructor, MediaEngineSupportedTypes getSupportedTypes, MediaEngineSupportsType supportsTypeAndCodecs) 
+        : constructor(constructor)
+        , getSupportedTypes(getSupportedTypes)
+        , supportsTypeAndCodecs(supportsTypeAndCodecs)  
+    { 
+    }
+
+    CreateMediaEnginePlayer constructor;
+    MediaEngineSupportedTypes getSupportedTypes;
+    MediaEngineSupportsType supportsTypeAndCodecs;
+};
+
+static void addMediaEngine(CreateMediaEnginePlayer, MediaEngineSupportedTypes, MediaEngineSupportsType);
+static MediaPlayerFactory* chooseBestEngineForTypeAndCodecs(const String& type, const String& codecs);
+
+static Vector<MediaPlayerFactory*>& installedMediaEngines() 
+{
+    DEFINE_STATIC_LOCAL(Vector<MediaPlayerFactory*>, installedEngines, ());
+    static bool enginesQueried = false;
+
+    if (!enginesQueried) {
+        enginesQueried = true;
+        MediaPlayerPrivate::registerMediaEngine(addMediaEngine);
+
+        // register additional engines here
+    }
     
-    MediaPlayer::MediaPlayer(MediaPlayerClient* client)
+    return installedEngines;
+}
+
+static void addMediaEngine(CreateMediaEnginePlayer constructor, MediaEngineSupportedTypes getSupportedTypes, MediaEngineSupportsType supportsType)
+{
+    ASSERT(constructor);
+    ASSERT(getSupportedTypes);
+    ASSERT(supportsType);
+    installedMediaEngines().append(new MediaPlayerFactory(constructor, getSupportedTypes, supportsType));
+}
+
+static MediaPlayerFactory* chooseBestEngineForTypeAndCodecs(const String& type, const String& codecs)
+{
+    Vector<MediaPlayerFactory*>& engines = installedMediaEngines();
+
+    if (engines.isEmpty())
+        return 0;
+
+    MediaPlayerFactory* engine = 0;
+    MediaPlayer::SupportsType supported = MediaPlayer::IsNotSupported;
+
+    unsigned count = engines.size();
+    for (unsigned ndx = 0; ndx < count; ndx++) {
+        MediaPlayer::SupportsType engineSupport = engines[ndx]->supportsTypeAndCodecs(type, codecs);
+        if (engineSupport > supported) {
+            supported = engineSupport;
+            engine = engines[ndx];
+        }
+    }
+
+    return engine;
+}
+
+// media player
+
+MediaPlayer::MediaPlayer(MediaPlayerClient* client)
     : m_mediaPlayerClient(client)
-    , m_private(new MediaPlayerPrivate(this))
+    , m_private(createNullMediaPlayer(this))
+    , m_currentMediaEngine(0)
     , m_frameView(0)
     , m_visible(false)
     , m_rate(1.0f)
     , m_volume(1.0f)
+    , m_autobuffer(false)
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    , m_playerProxy(0)
+#endif
 {
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    Vector<MediaPlayerFactory*>& engines = installedMediaEngines();
+    if (!engines.isEmpty()) {
+        m_currentMediaEngine = engines[0];
+        m_private.clear();
+        m_private.set(engines[0]->constructor(this));
+    }
+#endif
 }
 
 MediaPlayer::~MediaPlayer()
 {
-    delete m_private;
 }
 
-void MediaPlayer::load(const String& url)
+void MediaPlayer::load(const String& url, const ContentType& contentType)
 {
-    m_private->load(url);
+    String type = contentType.type();
+    String codecs = contentType.parameter("codecs");
+
+    // if we don't know the MIME type, see if the extension can help
+    if (type.isEmpty() || type == "application/octet-stream" || type == "text/plain") {
+        int pos = url.reverseFind('.');
+        if (pos >= 0) {
+            String extension = url.substring(pos + 1);
+            String mediaType = MIMETypeRegistry::getMediaMIMETypeForExtension(extension);
+            if (!mediaType.isEmpty())
+                type = mediaType;
+        }
+    }
+
+    MediaPlayerFactory* engine = 0;
+    if (!type.isEmpty())
+        engine = chooseBestEngineForTypeAndCodecs(type, codecs);
+
+    // if we didn't find an engine that claims the MIME type, just use the first engine
+    if (!engine)
+        engine = installedMediaEngines()[0];
+    
+    // don't delete and recreate the player unless it comes from a different engine
+    if (engine && m_currentMediaEngine != engine) {
+        m_currentMediaEngine = engine;
+        m_private.clear();
+        m_private.set(engine->constructor(this));
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        m_private->setMediaPlayerProxy(m_playerProxy);
+#endif
+
+    }
+
+    if (m_private)
+        m_private->load(url);
+    else
+        m_private.set(createNullMediaPlayer(this));
 }    
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+void MediaPlayer::setPoster(const String& url)
+{
+    m_private->setPoster(url);
+}    
+#endif
+
 void MediaPlayer::cancelLoad()
 {
     m_private->cancelLoad();
@@ -88,9 +270,14 @@ float MediaPlayer::duration() const
     return m_private->duration();
 }
 
+float MediaPlayer::startTime() const
+{
+    return m_private->startTime();
+}
+
 float MediaPlayer::currentTime() const
 {
-    return m_private->currentTime();  
+    return m_private->currentTime();
 }
 
 void MediaPlayer::seek(float time)
@@ -193,10 +380,10 @@ unsigned MediaPlayer::totalBytes()
     return m_private->totalBytes();
 }
 
-void MediaPlayer::setRect(const IntRect& r) 
+void MediaPlayer::setSize(const IntSize& size)
 { 
-    m_rect = r;
-    m_private->setRect(r);
+    m_size = size;
+    m_private->setSize(size);
 }
 
 bool MediaPlayer::visible() const
@@ -210,34 +397,65 @@ void MediaPlayer::setVisible(bool b)
     m_private->setVisible(b);
 }
 
+bool MediaPlayer::autobuffer() const
+{
+    return m_autobuffer;
+}
+
+void MediaPlayer::setAutobuffer(bool b)
+{
+    if (m_autobuffer != b) {
+        m_autobuffer = b;
+        m_private->setAutobuffer(b);
+    }
+}
+
 void MediaPlayer::paint(GraphicsContext* p, const IntRect& r)
 {
     m_private->paint(p, r);
 }
 
-bool MediaPlayer::supportsType(const String& type)
+MediaPlayer::SupportsType MediaPlayer::supportsType(ContentType contentType)
 {
-    HashSet<String> types;
-    getSupportedTypes(types);
-    return MIMETypeRegistry::isSupportedMediaMIMEType(type) && types.contains(type);
+    String type = contentType.type();
+    String codecs = contentType.parameter("codecs");
+    MediaPlayerFactory* engine = chooseBestEngineForTypeAndCodecs(type, codecs);
+
+    if (!engine)
+        return IsNotSupported;
+
+    return engine->supportsTypeAndCodecs(type, codecs);
 }
 
 void MediaPlayer::getSupportedTypes(HashSet<String>& types)
 {
-    MediaPlayerPrivate::getSupportedTypes(types);
+    Vector<MediaPlayerFactory*>& engines = installedMediaEngines();
+    if (engines.isEmpty())
+        return;
+
+    unsigned count = engines.size();
+    for (unsigned ndx = 0; ndx < count; ndx++)
+        engines[ndx]->getSupportedTypes(types);
 } 
-    
+
 bool MediaPlayer::isAvailable()
 {
-    static bool availabityKnown = false;
-    static bool isAvailable;
-    if (!availabityKnown) {
-        isAvailable = MediaPlayerPrivate::isAvailable();
-        availabityKnown = true;
-    }
-    return isAvailable;
+    return !installedMediaEngines().isEmpty();
 } 
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+void MediaPlayer::deliverNotification(MediaPlayerProxyNotificationType notification)
+{
+    m_private->deliverNotification(notification);
+}
+
+void MediaPlayer::setMediaPlayerProxy(WebMediaPlayerProxy* proxy)
+{
+    m_playerProxy = proxy;
+    m_private->setMediaPlayerProxy(proxy);
+}
+#endif
+
 void MediaPlayer::networkStateChanged()
 {
     if (m_mediaPlayerClient)
@@ -262,11 +480,29 @@ void MediaPlayer::timeChanged()
         m_mediaPlayerClient->mediaPlayerTimeChanged(this);
 }
 
+void MediaPlayer::sizeChanged()
+{
+    if (m_mediaPlayerClient)
+        m_mediaPlayerClient->mediaPlayerSizeChanged(this);
+}
+
 void MediaPlayer::repaint()
 {
     if (m_mediaPlayerClient)
         m_mediaPlayerClient->mediaPlayerRepaint(this);
 }
 
+void MediaPlayer::durationChanged()
+{
+    if (m_mediaPlayerClient)
+        m_mediaPlayerClient->mediaPlayerDurationChanged(this);
+}
+
+void MediaPlayer::rateChanged()
+{
+    if (m_mediaPlayerClient)
+        m_mediaPlayerClient->mediaPlayerRateChanged(this);
+}
+
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
index 203f29900b..9b2f685172 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
@@ -28,52 +28,83 @@
 
 #if ENABLE(VIDEO)
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "MediaPlayerProxy.h"
+#endif
+
 #include "IntRect.h"
 #include "StringHash.h"
 #include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
+class ContentType;
 class FrameView;
 class GraphicsContext;
+class IntRect;
 class IntSize;
 class MediaPlayer;
-class MediaPlayerPrivate;
+class MediaPlayerPrivateInterface;
 class String;
 
 class MediaPlayerClient {
 public:
     virtual ~MediaPlayerClient() { }
+
+    // the network state has changed
     virtual void mediaPlayerNetworkStateChanged(MediaPlayer*) { }
+
+    // the ready state has changed
     virtual void mediaPlayerReadyStateChanged(MediaPlayer*) { }
+
+    // the volume or muted state has changed
     virtual void mediaPlayerVolumeChanged(MediaPlayer*) { }
+
+    // time has jumped, eg. not as a result of normal playback
     virtual void mediaPlayerTimeChanged(MediaPlayer*) { }
+    
+    // a new frame of video is available
     virtual void mediaPlayerRepaint(MediaPlayer*) { }
+
+    // the media file duration has changed, or is now known
+    virtual void mediaPlayerDurationChanged(MediaPlayer*) { }
+    
+    // the playback rate has changed
+    virtual void mediaPlayerRateChanged(MediaPlayer*) { }
+
+    // the movie size has changed
+    virtual void mediaPlayerSizeChanged(MediaPlayer*) { }
+
+    // The MediaPlayer has found potentially problematic media content.
+    // This is used internally to trigger swapping from a <video>
+    // element to an <embed> in standalone documents
+    virtual void mediaPlayerSawUnsupportedTracks(MediaPlayer*) { }
 };
 
 class MediaPlayer : Noncopyable {
 public:
     MediaPlayer(MediaPlayerClient*);
     virtual ~MediaPlayer();
-    
-    static bool isAvailable();
-    static bool supportsType(const String&);
+
+    // media engine support
+    enum SupportsType { IsNotSupported, IsSupported, MayBeSupported };
+    static MediaPlayer::SupportsType supportsType(ContentType contentType);
     static void getSupportedTypes(HashSet<String>&);
-    
+    static bool isAvailable();
+
     IntSize naturalSize();
     bool hasVideo();
     
     void setFrameView(FrameView* frameView) { m_frameView = frameView; }
+    FrameView* frameView() { return m_frameView; }
     bool inMediaDocument();
     
-    // FIXME: it would be better to just have a getter and setter for size.
-    // This is currently an absolute rect, which is not appropriate for
-    // content with transforms
-    IntRect rect() const { return m_rect; }
-    void setRect(const IntRect& r);
+    IntSize size() const { return m_size; }
+    void setSize(const IntSize& size);
     
-    void load(const String& url);
+    void load(const String& url, const ContentType& contentType);
     void cancelLoad();
     
     bool visible() const;
@@ -88,6 +119,8 @@ public:
     float duration() const;
     float currentTime() const;
     void seek(float time);
+
+    float startTime() const;
     
     void setEndTime(float time);
     
@@ -96,7 +129,7 @@ public:
     
     float maxTimeBuffered();
     float maxTimeSeekable();
-    
+
     unsigned bytesLoaded();
     bool totalBytesKnown();
     unsigned totalBytes();
@@ -105,36 +138,62 @@ public:
     void setVolume(float);
     
     int dataRate() const;
-    
+
+    bool autobuffer() const;    
+    void setAutobuffer(bool);
+
     void paint(GraphicsContext*, const IntRect&);
     
-    enum NetworkState { Empty, LoadFailed, Loading, LoadedMetaData, LoadedFirstFrame, Loaded };
+    enum NetworkState { Empty, Idle, Loading, Loaded, FormatError, NetworkError, DecodeError };
     NetworkState networkState();
 
-    enum ReadyState  { DataUnavailable, CanShowCurrentFrame, CanPlay, CanPlayThrough };
+    enum ReadyState  { HaveNothing, HaveMetadata, HaveCurrentData, HaveFutureData, HaveEnoughData };
     ReadyState readyState();
     
     void networkStateChanged();
     void readyStateChanged();
     void volumeChanged();
     void timeChanged();
+    void sizeChanged();
+    void rateChanged();
+    void durationChanged();
 
     void repaint();
-    
+
+    MediaPlayerClient* mediaPlayerClient() const { return m_mediaPlayerClient; }
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    void setPoster(const String& url);
+    void deliverNotification(MediaPlayerProxyNotificationType notification);
+    void setMediaPlayerProxy(WebMediaPlayerProxy* proxy);
+#endif
+
 private:
-        
-    friend class MediaPlayerPrivate;
-    
+    static void initializeMediaEngines();
+
     MediaPlayerClient* m_mediaPlayerClient;
-    MediaPlayerPrivate* m_private;
+    OwnPtr<MediaPlayerPrivateInterface*> m_private;
+    void* m_currentMediaEngine;
     FrameView* m_frameView;
-    IntRect m_rect;
+    IntSize m_size;
     bool m_visible;
     float m_rate;
     float m_volume;
+    bool m_autobuffer;
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    WebMediaPlayerProxy* m_playerProxy;    // not owned or used, passed to m_private
+#endif
 };
 
+typedef MediaPlayerPrivateInterface* (*CreateMediaEnginePlayer)(MediaPlayer*);
+typedef void (*MediaEngineSupportedTypes)(HashSet<String>& types);
+typedef MediaPlayer::SupportsType (*MediaEngineSupportsType)(const String& type, const String& codecs);
+
+typedef void (*MediaEngineRegistrar)(CreateMediaEnginePlayer, MediaEngineSupportedTypes, MediaEngineSupportsType); 
+
+
 }
 
-#endif
+#endif // ENABLE(VIDEO)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
new file mode 100644
index 0000000000..e17259ce50
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivate_h
+#define MediaPlayerPrivate_h
+
+#if ENABLE(VIDEO)
+
+#include "MediaPlayer.h"
+
+namespace WebCore {
+
+class IntRect;
+class IntSize;
+class String;
+
+class MediaPlayerPrivateInterface {
+public:
+    virtual ~MediaPlayerPrivateInterface() { }
+
+    virtual void load(const String& url) = 0;
+    virtual void cancelLoad() = 0;
+    
+    virtual void play() = 0;
+    virtual void pause() = 0;    
+
+    virtual IntSize naturalSize() const = 0;
+
+    virtual bool hasVideo() const = 0;
+
+    virtual void setVisible(bool) = 0;
+
+    virtual float duration() const = 0;
+
+    virtual float currentTime() const = 0;
+    virtual void seek(float time) = 0;
+    virtual bool seeking() const = 0;
+
+    virtual float startTime() const { return 0; }
+
+    virtual void setEndTime(float) = 0;
+
+    virtual void setRate(float) = 0;
+    virtual bool paused() const = 0;
+
+    virtual void setVolume(float) = 0;
+
+    virtual MediaPlayer::NetworkState networkState() const = 0;
+    virtual MediaPlayer::ReadyState readyState() const = 0;
+
+    virtual float maxTimeSeekable() const = 0;
+    virtual float maxTimeBuffered() const = 0;
+
+    virtual int dataRate() const = 0;
+
+    virtual bool totalBytesKnown() const { return totalBytes() > 0; }
+    virtual unsigned totalBytes() const = 0;
+    virtual unsigned bytesLoaded() const = 0;
+
+    virtual void setSize(const IntSize&) = 0;
+
+    virtual void paint(GraphicsContext*, const IntRect&) = 0 ;
+
+    virtual void setAutobuffer(bool) { };
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    virtual void setPoster(const String& url) = 0;
+    virtual void deliverNotification(MediaPlayerProxyNotificationType) = 0;
+    virtual void setMediaPlayerProxy(WebMediaPlayerProxy*) = 0;
+#endif
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp
index f3450bec99..e30703cf5c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Path.cpp
@@ -35,7 +35,7 @@
 #include <math.h>
 #include <wtf/MathExtras.h>
 
-const float QUARTER = 0.552f; // approximation of control point positions on a bezier
+static const float QUARTER = 0.552f; // approximation of control point positions on a bezier
                               // to simulate a quarter of a circle.
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Path.h b/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
index 6922cb0a1e..9e2163bb30 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
- *                     2006 Rob Buis <buis@kde.org>
+ * Copyright (C) 2003, 2006, 2009 Apple Inc. All rights reserved.
+ *               2006 Rob Buis <buis@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,8 @@
 #ifndef Path_h
 #define Path_h
 
+#include <algorithm>
+
 #if PLATFORM(CG)
 typedef struct CGPath PlatformPath;
 #elif PLATFORM(QT)
@@ -52,13 +54,13 @@ typedef void PlatformPath;
 
 namespace WebCore {
 
-    class TransformationMatrix;
     class FloatPoint;
-    class FloatSize;
     class FloatRect;
+    class FloatSize;
     class GraphicsContext;
     class String;
     class StrokeStyleApplier;
+    class TransformationMatrix;
 
     enum WindRule {
         RULE_NONZERO = 0,
@@ -78,7 +80,7 @@ namespace WebCore {
         FloatPoint* points;
     };
 
-    typedef void (*PathApplierFunction) (void* info, const PathElement*);
+    typedef void (*PathApplierFunction)(void* info, const PathElement*);
 
     class Path {
     public:
@@ -88,9 +90,12 @@ namespace WebCore {
         Path(const Path&);
         Path& operator=(const Path&);
 
+        void swap(Path& other) { std::swap(m_path, other.m_path); }
+
         bool contains(const FloatPoint&, WindRule rule = RULE_NONZERO) const;
+        bool strokeContains(StrokeStyleApplier*, const FloatPoint&) const;
         FloatRect boundingRect() const;
-        FloatRect strokeBoundingRect(StrokeStyleApplier* applier = 0);
+        FloatRect strokeBoundingRect(StrokeStyleApplier* = 0);
         
         float length();
         FloatPoint pointAtLength(float length, bool& ok);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
index b9184373aa..d4aa3b9aec 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
@@ -30,6 +30,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include "TransformationMatrix.h"
 
 #if PLATFORM(CG)
 typedef struct CGPattern* CGPatternRef;
@@ -67,7 +68,9 @@ namespace WebCore {
 
         Image* tileImage() const { return m_tileImage.get(); }
 
-        PlatformPatternPtr createPlatformPattern(const TransformationMatrix& patternTransform) const;
+        // Pattern space is an abstract space that maps to the default user space by the transformation 'userSpaceTransformation' 
+        PlatformPatternPtr createPlatformPattern(const TransformationMatrix& userSpaceTransformation) const;
+        void setPatternSpaceTransform(const TransformationMatrix& patternSpaceTransformation) { m_patternSpaceTransformation = patternSpaceTransformation; }
 
     private:
         Pattern(Image*, bool repeatX, bool repeatY);
@@ -75,6 +78,7 @@ namespace WebCore {
         RefPtr<Image> m_tileImage;
         bool m_repeatX;
         bool m_repeatY;
+        TransformationMatrix m_patternSpaceTransformation;
     };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.cpp
index ceefe4f25a..1731d16a74 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,16 +45,27 @@ const SimpleFontData* SegmentedFontData::fontDataForCharacter(UChar32 c) const
     return m_ranges[0].fontData();
 }
 
-bool SegmentedFontData::containsCharacters(const UChar* characters, int length) const
+bool SegmentedFontData::containsCharacter(UChar32 c) const
 {
     Vector<FontDataRange>::const_iterator end = m_ranges.end();
     for (Vector<FontDataRange>::const_iterator it = m_ranges.begin(); it != end; ++it) {
-        if (it->from() <= characters[0] && it->to() >= characters[0])
+        if (c >= it->from() && c <= it->to())
             return true;
     }
     return false;
 }
 
+bool SegmentedFontData::containsCharacters(const UChar* characters, int length) const
+{
+    UChar32 c;
+    for (int i = 0; i < length; ) {
+        U16_NEXT(characters, i, length, c)
+        if (!containsCharacter(c))
+            return false;
+    }
+    return true;
+}
+
 bool SegmentedFontData::isCustomFont() const
 {
     // All segmented fonts are custom fonts.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.h b/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.h
index 1adec1579c..0a78321783 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SegmentedFontData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -55,6 +55,11 @@ class SegmentedFontData : public FontData {
 public:
     virtual ~SegmentedFontData();
 
+    void appendRange(const FontDataRange& range) { m_ranges.append(range); }
+    unsigned numRanges() const { return m_ranges.size(); }
+    const FontDataRange& rangeAt(unsigned i) const { return m_ranges[i]; }
+
+private:
     virtual const SimpleFontData* fontDataForCharacter(UChar32) const;
     virtual bool containsCharacters(const UChar*, int length) const;
 
@@ -62,11 +67,8 @@ public:
     virtual bool isLoading() const;
     virtual bool isSegmented() const;
 
-    void appendRange(const FontDataRange& range) { m_ranges.append(range); }
-    unsigned numRanges() const { return m_ranges.size(); }
-    const FontDataRange& rangeAt(unsigned i) const { return m_ranges[i]; }
+    bool containsCharacter(UChar32) const;
 
-private:
     Vector<FontDataRange, 1> m_ranges;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp
index 74e1af92c7..bab7d993d9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp
@@ -32,18 +32,24 @@
 
 #include "Font.h"
 #include "FontCache.h"
+
 #if ENABLE(SVG_FONTS)
 #include "SVGFontData.h"
+#include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
+#include "SVGGlyphElement.h"
 #endif
 
 #include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
+
+using namespace std;
 
 namespace WebCore {
 
 SimpleFontData::SimpleFontData(const FontPlatformData& f, bool customFont, bool loading, SVGFontData* svgFontData)
     : m_unitsPerEm(defaultUnitsPerEm)
-    , m_font(f)
+    , m_platformData(f)
     , m_treatAsFixedPitch(false)
 #if ENABLE(SVG_FONTS)
     , m_svgFontData(svgFontData)
@@ -52,24 +58,40 @@ SimpleFontData::SimpleFontData(const FontPlatformData& f, bool customFont, bool
     , m_isLoading(loading)
     , m_smallCapsFontData(0)
 {
-#if ENABLE(SVG_FONTS)
+#if !ENABLE(SVG_FONTS)
+    UNUSED_PARAM(svgFontData);
+#else
     if (SVGFontFaceElement* svgFontFaceElement = svgFontData ? svgFontData->svgFontFaceElement() : 0) {
-       m_unitsPerEm = svgFontFaceElement->unitsPerEm();
+        m_unitsPerEm = svgFontFaceElement->unitsPerEm();
 
-       double scale = f.size();
-       if (m_unitsPerEm)
-           scale /= m_unitsPerEm;
+        double scale = f.size();
+        if (m_unitsPerEm)
+            scale /= m_unitsPerEm;
 
         m_ascent = static_cast<int>(svgFontFaceElement->ascent() * scale);
         m_descent = static_cast<int>(svgFontFaceElement->descent() * scale);
         m_xHeight = static_cast<int>(svgFontFaceElement->xHeight() * scale);
         m_lineGap = 0.1f * f.size();
         m_lineSpacing = m_ascent + m_descent + m_lineGap;
-    
+
+        SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
+
+        Vector<SVGGlyphIdentifier> spaceGlyphs;
+        associatedFontElement->getGlyphIdentifiersForString(String(" ", 1), spaceGlyphs);
+        m_spaceWidth = spaceGlyphs.isEmpty() ? m_xHeight : static_cast<float>(spaceGlyphs.first().horizontalAdvanceX * scale);
+
+        Vector<SVGGlyphIdentifier> numeralZeroGlyphs;
+        associatedFontElement->getGlyphIdentifiersForString(String("0", 1), numeralZeroGlyphs);
+        m_avgCharWidth = numeralZeroGlyphs.isEmpty() ? m_spaceWidth : static_cast<float>(numeralZeroGlyphs.first().horizontalAdvanceX * scale);
+
+        Vector<SVGGlyphIdentifier> letterWGlyphs;
+        associatedFontElement->getGlyphIdentifiersForString(String("W", 1), letterWGlyphs);
+        m_maxCharWidth = letterWGlyphs.isEmpty() ? m_ascent : static_cast<float>(letterWGlyphs.first().horizontalAdvanceX * scale);
+
+        // FIXME: is there a way we can get the space glyph from the SVGGlyphIdentifier above?
         m_spaceGlyph = 0;
-        m_spaceWidth = 0;
-        m_adjustedSpaceWidth = 0;
         determinePitch();
+        m_adjustedSpaceWidth = roundf(m_spaceWidth);
         m_missingGlyphData.fontData = this;
         m_missingGlyphData.glyph = 0;
         return;
@@ -78,9 +100,31 @@ SimpleFontData::SimpleFontData(const FontPlatformData& f, bool customFont, bool
 
     platformInit();
     platformGlyphInit();
+    platformCharWidthInit();
 }
 
 #if !PLATFORM(QT)
+// Estimates of avgCharWidth and maxCharWidth for platforms that don't support accessing these values from the font.
+void SimpleFontData::initCharWidths()
+{
+    GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
+
+    // Treat the width of a '0' as the avgCharWidth.
+    if (m_avgCharWidth <= 0.f && glyphPageZero) {
+        static const UChar32 digitZeroChar = '0';
+        Glyph digitZeroGlyph = glyphPageZero->glyphDataForCharacter(digitZeroChar).glyph;
+        if (digitZeroGlyph)
+            m_avgCharWidth = widthForGlyph(digitZeroGlyph);
+    }
+
+    // If we can't retrieve the width of a '0', fall back to the x height.
+    if (m_avgCharWidth <= 0.f)
+        m_avgCharWidth = m_xHeight;
+
+    if (m_maxCharWidth <= 0.f)
+        m_maxCharWidth = max<float>(m_avgCharWidth, m_ascent);
+}
+
 void SimpleFontData::platformGlyphInit()
 {
     GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
@@ -124,31 +168,17 @@ void SimpleFontData::platformGlyphInit()
 
 SimpleFontData::~SimpleFontData()
 {
-    if (!isCustomFont()) {
-        if (m_smallCapsFontData)
-            FontCache::releaseFontData(m_smallCapsFontData);
-        GlyphPageTreeNode::pruneTreeFontData(this);
-    }
-
 #if ENABLE(SVG_FONTS)
     if (!m_svgFontData || !m_svgFontData->svgFontFaceElement())
 #endif
         platformDestroy();
-}
 
-#if !PLATFORM(QT)
-float SimpleFontData::widthForGlyph(Glyph glyph) const
-{
-    float width = m_glyphToWidthMap.widthForGlyph(glyph);
-    if (width != cGlyphWidthUnknown)
-        return width;
-    
-    width = platformWidthForGlyph(glyph);
-    m_glyphToWidthMap.setWidthForGlyph(glyph, width);
-    
-    return width;
+    if (!isCustomFont()) {
+        if (m_smallCapsFontData)
+            fontCache()->releaseFontData(m_smallCapsFontData);
+        GlyphPageTreeNode::pruneTreeFontData(this);
+    }
 }
-#endif
 
 const SimpleFontData* SimpleFontData::fontDataForCharacter(UChar32) const
 {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
index e572e306d7..aab6429484 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
@@ -61,7 +61,7 @@ public:
     virtual ~SimpleFontData();
 
 public:
-    const FontPlatformData& platformData() const { return m_font; }
+    const FontPlatformData& platformData() const { return m_platformData; }
     SimpleFontData* smallCapsFontData(const FontDescription& fontDescription) const;
 
     // vertical metrics
@@ -69,12 +69,23 @@ public:
     int descent() const { return m_descent; }
     int lineSpacing() const { return m_lineSpacing; }
     int lineGap() const { return m_lineGap; }
+    float maxCharWidth() const { return m_maxCharWidth; }
+    float avgCharWidth() const { return m_avgCharWidth; }
     float xHeight() const { return m_xHeight; }
     unsigned unitsPerEm() const { return m_unitsPerEm; }
 
     float widthForGlyph(Glyph) const;
     float platformWidthForGlyph(Glyph) const;
 
+    float spaceWidth() const { return m_spaceWidth; }
+    float adjustedSpaceWidth() const { return m_adjustedSpaceWidth; }
+
+#if PLATFORM(CG) || PLATFORM(CAIRO)
+    float syntheticBoldOffset() const { return m_syntheticBoldOffset; }
+#endif
+
+    Glyph spaceGlyph() const { return m_spaceGlyph; }
+
     virtual const SimpleFontData* fontDataForCharacter(UChar32) const;
     virtual bool containsCharacters(const UChar*, int length) const;
 
@@ -95,7 +106,7 @@ public:
     const GlyphData& missingGlyphData() const { return m_missingGlyphData; }
 
 #if PLATFORM(MAC)
-    NSFont* getNSFont() const { return m_font.font(); }
+    NSFont* getNSFont() const { return m_platformData.font(); }
 #endif
 
 #if USE(CORE_TEXT)
@@ -114,7 +125,7 @@ public:
 #endif
 
 #if PLATFORM(QT)
-    QFont getQtFont() const { return m_font.font(); }
+    QFont getQtFont() const { return m_platformData.font(); }
 #endif
 
 #if PLATFORM(WIN)
@@ -131,14 +142,17 @@ public:
 #endif
 
 #if PLATFORM(WX)
-    wxFont getWxFont() const { return m_font.font(); }
+    wxFont* getWxFont() const { return m_platformData.font(); }
 #endif
 
 private:
     void platformInit();
     void platformGlyphInit();
+    void platformCharWidthInit();
     void platformDestroy();
     
+    void initCharWidths();
+
     void commonInit();
 
 #if PLATFORM(WIN)
@@ -147,15 +161,16 @@ private:
     float widthForGDIGlyph(Glyph glyph) const;
 #endif
 
-public:
     int m_ascent;
     int m_descent;
     int m_lineSpacing;
     int m_lineGap;
+    float m_maxCharWidth;
+    float m_avgCharWidth;
     float m_xHeight;
     unsigned m_unitsPerEm;
 
-    FontPlatformData m_font;
+    FontPlatformData m_platformData;
 
     mutable GlyphWidthMap m_glyphToWidthMap;
 
@@ -176,22 +191,26 @@ public:
 
     mutable SimpleFontData* m_smallCapsFontData;
 
-#if PLATFORM(CG) || PLATFORM(WIN)
+#if PLATFORM(CG) || PLATFORM(CAIRO)
     float m_syntheticBoldOffset;
 #endif
 
-#if PLATFORM(MAC)
 #ifdef BUILDING_ON_TIGER
+public:
     void* m_styleGroup;
-#endif
+
+private:
 #endif
 
 #if USE(ATSUI)
+public:
     mutable ATSUStyle m_ATSUStyle;
     mutable bool m_ATSUStyleInitialized;
     mutable bool m_ATSUMirrors;
     mutable bool m_checkedShapesArabic;
     mutable bool m_shapesArabic;
+
+private:
 #endif
 
 #if USE(CORE_TEXT)
@@ -205,6 +224,21 @@ public:
     mutable SCRIPT_FONTPROPERTIES* m_scriptFontProperties;
 #endif
 };
+    
+    
+#if !PLATFORM(QT)
+ALWAYS_INLINE float SimpleFontData::widthForGlyph(Glyph glyph) const
+{
+    float width = m_glyphToWidthMap.widthForGlyph(glyph);
+    if (width != cGlyphWidthUnknown)
+        return width;
+    
+    width = platformWidthForGlyph(glyph);
+    m_glyphToWidthMap.setWidthForGlyph(glyph, width);
+    
+    return width;
+}
+#endif
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.cpp
index 3235aef611..9157310646 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.cpp
@@ -39,13 +39,14 @@ namespace WebCore {
 // According to http://www.unicode.org/Public/UNIDATA/UCD.html#Canonical_Combining_Class_Values
 static const uint8_t hiraganaKatakanaVoicingMarksCombiningClass = 8;
 
-WidthIterator::WidthIterator(const Font* font, const TextRun& run)
+WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts)
     : m_font(font)
     , m_run(run)
     , m_end(run.length())
     , m_currentCharacter(0)
     , m_runWidthSoFar(0)
     , m_finalRoundingWidth(0)
+    , m_fallbackFonts(fallbackFonts)
 {
     // If the padding is non-zero, count the number of spaces in the run
     // and divide that by the padding for per space addition.
@@ -78,7 +79,10 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
 
     float runWidthSoFar = m_runWidthSoFar;
     float lastRoundingWidth = m_finalRoundingWidth;
-    
+
+    const SimpleFontData* primaryFont = m_font->primaryFont();
+    const SimpleFontData* lastFontData = primaryFont;
+
     while (currentCharacter < offset) {
         UChar32 c = *cp;
         unsigned clusterLength = 1;
@@ -126,8 +130,23 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
             // First, we round spaces to an adjusted width in all fonts.
             // Second, in fixed-pitch fonts we ensure that all characters that
             // match the width of the space character have the same width as the space character.
-            if (width == fontData->m_spaceWidth && (fontData->m_treatAsFixedPitch || glyph == fontData->m_spaceGlyph) && m_run.applyWordRounding())
-                width = fontData->m_adjustedSpaceWidth;
+            if (width == fontData->spaceWidth() && (fontData->pitch() == FixedPitch || glyph == fontData->spaceGlyph()) && m_run.applyWordRounding())
+                width = fontData->adjustedSpaceWidth();
+        }
+
+        if (fontData != lastFontData && width) {
+            lastFontData = fontData;
+            if (m_fallbackFonts && fontData != primaryFont) {
+                // FIXME: This does a little extra work that could be avoided if
+                // glyphDataForCharacter() returned whether it chose to use a small caps font.
+                if (!m_font->isSmallCaps() || c == toUpper(c))
+                    m_fallbackFonts->add(fontData);
+                else {
+                    const GlyphData& uppercaseGlyphData = m_font->glyphDataForCharacter(toUpper(c), rtl);
+                    if (uppercaseGlyphData.fontData != primaryFont)
+                        m_fallbackFonts->add(uppercaseGlyphData.fontData);
+                }
+            }
         }
 
         if (hasExtraSpacing) {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.h b/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.h
index 5706d1e213..7ca4198edc 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/WidthIterator.h
@@ -22,16 +22,18 @@
 #ifndef WidthIterator_h
 #define WidthIterator_h
 
+#include <wtf/HashSet.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
 class Font;
 class GlyphBuffer;
+class SimpleFontData;
 class TextRun;
 
 struct WidthIterator {
-    WidthIterator(const Font*, const TextRun&);
+    WidthIterator(const Font*, const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0);
 
     void advance(int to, GlyphBuffer* = 0);
     bool advanceOneCharacter(float& width, GlyphBuffer* = 0);
@@ -49,6 +51,7 @@ struct WidthIterator {
 
 private:
     UChar32 normalizeVoicingMarks(int currentCharacter);
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
index 72103673b2..86b702f4e0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEBlend.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEBlend::FEBlend(FilterEffect* in, FilterEffect* in2, BlendModeType mode)
@@ -59,7 +61,7 @@ void FEBlend::setBlendMode(BlendModeType mode)
     m_mode = mode;
 }
 
-void FEBlend::apply()
+void FEBlend::apply(Filter*)
 {
 }
 
@@ -69,4 +71,4 @@ void FEBlend::dump()
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h
index b2835e81f4..dec04ac557 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h
@@ -22,9 +22,11 @@
 #ifndef SVGFEBlend_h
 #define SVGFEBlend_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
     enum BlendModeType {
@@ -46,8 +48,8 @@ namespace WebCore {
         BlendModeType blendMode() const;
         void setBlendMode(BlendModeType);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEBlend(FilterEffect*, FilterEffect*, BlendModeType);
@@ -59,6 +61,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEBlend_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index f78310607d..8704e645f9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEColorMatrix.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEColorMatrix::FEColorMatrix(FilterEffect* in, ColorMatrixType type, const Vector<float>& values)
@@ -59,7 +61,7 @@ void FEColorMatrix::setValues(const Vector<float> &values)
     m_values = values;
 }
 
-void FEColorMatrix::apply()
+void FEColorMatrix::apply(Filter*)
 {
 }
 
@@ -69,4 +71,4 @@ void FEColorMatrix::dump()
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.h
index d8193ed24a..eeb3557f74 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.h
@@ -22,8 +22,10 @@
 #ifndef SVGFEColorMatrix_h
 #define SVGFEColorMatrix_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
+
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -46,8 +48,8 @@ namespace WebCore {
         const Vector<float>& values() const;
         void setValues(const Vector<float>&);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEColorMatrix(FilterEffect*, ColorMatrixType, const Vector<float>&);
@@ -59,6 +61,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEColorMatrix_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 708ea3eab0..54ac1232ec 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEComponentTransfer.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEComponentTransfer::FEComponentTransfer(FilterEffect* in, const ComponentTransferFunction& redFunc, 
@@ -83,7 +85,7 @@ void FEComponentTransfer::setAlphaFunction(const ComponentTransferFunction& func
     m_alphaFunc = func;
 }
 
-void FEComponentTransfer::apply()
+void FEComponentTransfer::apply(Filter*)
 {
 }
 
@@ -93,4 +95,4 @@ void FEComponentTransfer::dump()
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h
index 20d70c0816..cc1d1f8746 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.h
@@ -22,10 +22,11 @@
 #ifndef SVGFEComponentTransfer_h
 #define SVGFEComponentTransfer_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
-#include "SVGFEDisplacementMap.h"
 
+#include "SVGFEDisplacementMap.h"
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -78,8 +79,8 @@ namespace WebCore {
         ComponentTransferFunction alphaFunction() const;
         void setAlphaFunction(const ComponentTransferFunction&);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEComponentTransfer(FilterEffect*,const ComponentTransferFunction&, const ComponentTransferFunction&,
@@ -94,6 +95,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEComponentTransfer_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
index 0b5ce94bb4..070635877e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEComposite.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEComposite::FEComposite(FilterEffect* in, FilterEffect* in2, const CompositeOperationType& type,
@@ -95,7 +97,7 @@ void FEComposite::setK4(float k4)
     m_k4 = k4;
 }
 
-void FEComposite::apply()
+void FEComposite::apply(Filter*)
 {
 }
 
@@ -105,4 +107,4 @@ void FEComposite::dump()
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.h
index d2053954d2..b623cce5af 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.h
@@ -22,9 +22,11 @@
 #ifndef SVGFEComposite_h
 #define SVGFEComposite_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
+
 #include "PlatformString.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -58,8 +60,8 @@ namespace WebCore {
         float k4() const;
         void setK4(float);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEComposite(FilterEffect*, FilterEffect*, const CompositeOperationType&,
@@ -76,6 +78,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEComposite_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/Filter.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/Filter.h
new file mode 100644
index 0000000000..84909daca3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/Filter.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef Filter_h
+#define Filter_h
+
+#if ENABLE(FILTERS)
+#include "Image.h"
+#include "StringHash.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class FilterEffect;
+
+    class Filter : public RefCounted<Filter> {
+    public:
+        virtual ~Filter() { }
+
+        void setSourceImage(PassRefPtr<Image> image) { m_image = image; }
+        Image* sourceImage() { return m_image.get(); }
+
+        virtual void calculateEffectSubRegion(FilterEffect*) = 0;
+
+    private:
+        RefPtr<Image> m_image;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
+
+#endif // Filter_h
diff --git a/src/3rdparty/webkit/WebCore/svg/FilterEffect.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
index 24c187cdb5..cd7499258d 100644
--- a/src/3rdparty/webkit/WebCore/svg/FilterEffect.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -19,12 +19,16 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
 namespace WebCore {
 
 FilterEffect::FilterEffect()
+    : m_xBBoxMode(false)
+    , m_yBBoxMode(false)
+    , m_widthBBoxMode(false)
+    , m_heightBBoxMode(false)
 {
 }
 
@@ -39,4 +43,4 @@ TextStream& FilterEffect::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
new file mode 100644
index 0000000000..e2a058d122
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
@@ -0,0 +1,81 @@
+/*
+    Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
+                  2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef FilterEffect_h
+#define FilterEffect_h
+
+#if ENABLE(FILTERS)
+#include "Filter.h"
+#include "FloatRect.h"
+#include "ImageBuffer.h"
+#include "TextStream.h"
+
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class FilterEffect : public RefCounted<FilterEffect> {
+    public:
+        virtual ~FilterEffect();
+
+        bool xBoundingBoxMode() const { return m_xBBoxMode; }
+        void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
+
+        bool yBoundingBoxMode() const { return m_yBBoxMode; }
+        void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
+
+        bool widthBoundingBoxMode() const { return m_widthBBoxMode; }
+        void setWidthBoundingBoxMode(bool bboxMode) { m_widthBBoxMode = bboxMode; }
+
+        bool heightBoundingBoxMode() const { return m_heightBBoxMode; }
+        void setHeightBoundingBoxMode(bool bboxMode) { m_heightBBoxMode = bboxMode; }
+
+        FloatRect subRegion() const { return m_subRegion; }
+        void setSubRegion(const FloatRect& subRegion) { m_subRegion = subRegion; }
+
+        // The result is bounded by the size of the filter primitive to save resources
+        ImageBuffer* resultImage() { return m_effectBuffer.get(); }
+        void setEffectBuffer(ImageBuffer* effectBuffer) { m_effectBuffer.set(effectBuffer); }
+
+        virtual void apply(Filter*) = 0;
+        virtual void dump() = 0;
+
+        virtual TextStream& externalRepresentation(TextStream&) const;
+    protected:
+        FilterEffect();
+
+    private:
+
+        bool m_xBBoxMode : 1;
+        bool m_yBBoxMode : 1;
+        bool m_widthBBoxMode : 1;
+        bool m_heightBBoxMode : 1;
+
+        FloatRect m_subRegion;
+
+        mutable OwnPtr<ImageBuffer> m_effectBuffer;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
+
+#endif // FilterEffect_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
new file mode 100644
index 0000000000..646a57b51b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "SourceAlpha.h"
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include "Filter.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+PassRefPtr<SourceAlpha> SourceAlpha::create()
+{
+    return adoptRef(new SourceAlpha);
+}
+
+const AtomicString& SourceAlpha::effectName()
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, s_effectName, ("SourceAlpha"));
+    return s_effectName;
+}
+
+void SourceAlpha::apply(Filter*)
+{
+}
+
+void SourceAlpha::dump()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGResourceMaskerQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
index 2b89bacd79..21497aae0e 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGResourceMaskerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
@@ -1,7 +1,5 @@
 /*
-    Copyright (C) 2006 Nikolas Zimmermann <wildfox@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -19,20 +17,31 @@
     Boston, MA 02110-1301, USA.
 */
 
-#include "config.h"
+#ifndef SourceAlpha_h
+#define SourceAlpha_h
+
+#if ENABLE(FILTERS)
+#include "FilterEffect.h"
 
-#if ENABLE(SVG)
-#include "SVGResourceMasker.h"
+#include "PlatformString.h"
+#include "Filter.h"
 
 namespace WebCore {
 
-void SVGResourceMasker::applyMask(GraphicsContext*, const FloatRect&)
-{
-    // FIXME: implement me :-)
-}
+    class SourceAlpha : public FilterEffect {
+    public:        
+        static PassRefPtr<SourceAlpha> create();
+
+        static const AtomicString& effectName();
 
-} // namespace WebCore
+        void apply(Filter*);
+        void dump();
+    
+    private:
+        SourceAlpha() { }
+    };
+} //namespace WebCore
 
-#endif
+#endif // ENABLE(FILTERS)
 
-// vim:ts=4:noet
+#endif // SourceAlpha_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.cpp
new file mode 100644
index 0000000000..39d4810ddf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.cpp
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "SourceGraphic.h"
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include "Filter.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+PassRefPtr<SourceGraphic> SourceGraphic::create()
+{
+    return adoptRef(new SourceGraphic);
+}
+
+const AtomicString& SourceGraphic::effectName()
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, s_effectName, ("SourceGraphic"));
+    return s_effectName;
+}
+
+void SourceGraphic::apply(Filter*)
+{
+}
+
+void SourceGraphic::dump()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/Filter.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.h
index f3a110e717..363fb974ac 100644
--- a/src/3rdparty/webkit/WebCore/svg/Filter.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceGraphic.h
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
-    
+                  2009 Dirk Schulze <krit@webkit.org>
+
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -12,35 +13,36 @@
     Library General Public License for more details.
 
     You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
+    aint with this library; see the file COPYING.LIB.  If not, write to
     the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef Filter_h
-#define Filter_h
-
-#include "config.h"
+#ifndef SourceGraphic_h
+#define SourceGrahpic_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
+#include "PlatformString.h"
+#include "Filter.h"
 
 namespace WebCore {
 
-    class Filter : public RefCounted<Filter> {
-    public:    
-        static PassRefPtr<Filter> create(FilterEffect*);
-        
-    private:
-        Filter(FilterEffect* effect);
+    class SourceGraphic : public FilterEffect {
+    public:        
+        static PassRefPtr<SourceGraphic> create();
+
+        static const AtomicString& effectName();
+
+        void apply(Filter*);
+        void dump();
     
-        RefPtr<FilterEffect> m_effect;
+    private:
+        SourceGraphic() { }
     };
-    
 } //namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#endif
+#endif // ENABLE(FILTERS)
+
+#endif // SourceGraphic_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
new file mode 100644
index 0000000000..895887f617
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -0,0 +1,408 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "OpenTypeUtilities.h"
+
+#include "SharedBuffer.h"
+
+namespace WebCore {
+
+struct BigEndianUShort { 
+    operator unsigned short() const { return (v & 0x00ff) << 8 | v >> 8; }
+    BigEndianUShort(unsigned short u) : v((u & 0x00ff) << 8 | u >> 8) { }
+    unsigned short v;
+};
+
+struct BigEndianULong { 
+    operator unsigned() const { return (v & 0xff) << 24 | (v & 0xff00) << 8 | (v & 0xff0000) >> 8 | v >> 24; }
+    BigEndianULong(unsigned u) : v((u & 0xff) << 24 | (u & 0xff00) << 8 | (u & 0xff0000) >> 8 | u >> 24) { }
+    unsigned v;
+};
+
+#pragma pack(1)
+
+struct EOTPrefix {
+    unsigned eotSize;
+    unsigned fontDataSize;
+    unsigned version;
+    unsigned flags;
+    uint8_t fontPANOSE[10];
+    uint8_t charset;
+    uint8_t italic;
+    unsigned weight;
+    unsigned short fsType;
+    unsigned short magicNumber;
+    unsigned unicodeRange[4];
+    unsigned codePageRange[2];
+    unsigned checkSumAdjustment;
+    unsigned reserved[4];
+    unsigned short padding1;
+};
+
+struct TableDirectoryEntry {
+    BigEndianULong tag;
+    BigEndianULong checkSum;
+    BigEndianULong offset;
+    BigEndianULong length;
+};
+
+#if !PLATFORM(CG)
+// Fixed type is not defined on non-CG platforms. |version| in sfntHeader
+// and headTable and |fontRevision| in headTable are of Fixed, but they're
+// not actually refered to anywhere. Therefore, we just have to match
+// the size (4 bytes). For the definition of Fixed type, see
+// http://developer.apple.com/documentation/mac/Legacy/GXEnvironment/GXEnvironment-356.html#HEADING356-6.
+typedef int32_t Fixed;
+#endif
+
+struct sfntHeader {
+    Fixed version;
+    BigEndianUShort numTables;
+    BigEndianUShort searchRange;
+    BigEndianUShort entrySelector;
+    BigEndianUShort rangeShift;
+    TableDirectoryEntry tables[1];
+};
+
+struct OS2Table {
+    BigEndianUShort version;
+    BigEndianUShort avgCharWidth;
+    BigEndianUShort weightClass;
+    BigEndianUShort widthClass;
+    BigEndianUShort fsType;
+    BigEndianUShort subscriptXSize;
+    BigEndianUShort subscriptYSize;
+    BigEndianUShort subscriptXOffset;
+    BigEndianUShort subscriptYOffset;
+    BigEndianUShort superscriptXSize;
+    BigEndianUShort superscriptYSize;
+    BigEndianUShort superscriptXOffset;
+    BigEndianUShort superscriptYOffset;
+    BigEndianUShort strikeoutSize;
+    BigEndianUShort strikeoutPosition;
+    BigEndianUShort familyClass;
+    uint8_t panose[10];
+    BigEndianULong unicodeRange[4];
+    uint8_t vendID[4];
+    BigEndianUShort fsSelection;
+    BigEndianUShort firstCharIndex;
+    BigEndianUShort lastCharIndex;
+    BigEndianUShort typoAscender;
+    BigEndianUShort typoDescender;
+    BigEndianUShort typoLineGap;
+    BigEndianUShort winAscent;
+    BigEndianUShort winDescent;
+    BigEndianULong codePageRange[2];
+    BigEndianUShort xHeight;
+    BigEndianUShort capHeight;
+    BigEndianUShort defaultChar;
+    BigEndianUShort breakChar;
+    BigEndianUShort maxContext;
+};
+
+struct headTable {
+    Fixed version;
+    Fixed fontRevision;
+    BigEndianULong checkSumAdjustment;
+    BigEndianULong magicNumber;
+    BigEndianUShort flags;
+    BigEndianUShort unitsPerEm;
+    long long created;
+    long long modified;
+    BigEndianUShort xMin;
+    BigEndianUShort xMax;
+    BigEndianUShort yMin;
+    BigEndianUShort yMax;
+    BigEndianUShort macStyle;
+    BigEndianUShort lowestRectPPEM;
+    BigEndianUShort fontDirectionHint;
+    BigEndianUShort indexToLocFormat;
+    BigEndianUShort glyphDataFormat;
+};
+
+struct nameRecord {
+    BigEndianUShort platformID;
+    BigEndianUShort encodingID;
+    BigEndianUShort languageID;
+    BigEndianUShort nameID;
+    BigEndianUShort length;
+    BigEndianUShort offset;
+};
+
+struct nameTable {
+    BigEndianUShort format;
+    BigEndianUShort count;
+    BigEndianUShort stringOffset;
+    nameRecord nameRecords[1];
+};
+
+#pragma pack()
+
+EOTHeader::EOTHeader()
+{
+    m_buffer.resize(sizeof(EOTPrefix));
+}
+
+void EOTHeader::updateEOTSize(size_t fontDataSize)
+{
+    prefix()->eotSize = m_buffer.size() + fontDataSize;
+}
+
+void EOTHeader::appendBigEndianString(const BigEndianUShort* string, unsigned short length)
+{
+    size_t oldSize = m_buffer.size();
+    m_buffer.resize(oldSize + length + 2 * sizeof(unsigned short));
+    UChar* dst = reinterpret_cast<UChar*>(m_buffer.data() + oldSize);
+    unsigned i = 0;
+    dst[i++] = length;
+    unsigned numCharacters = length / 2;
+    for (unsigned j = 0; j < numCharacters; j++)
+        dst[i++] = string[j];
+    dst[i] = 0;
+}
+
+void EOTHeader::appendPaddingShort()
+{
+    unsigned short padding = 0;
+    m_buffer.append(reinterpret_cast<uint8_t*>(&padding), sizeof(padding));
+}
+
+bool getEOTHeader(SharedBuffer* fontData, EOTHeader& eotHeader, size_t& overlayDst, size_t& overlaySrc, size_t& overlayLength)
+{
+    overlayDst = 0;
+    overlaySrc = 0;
+    overlayLength = 0;
+
+    size_t dataLength = fontData->size();
+    const char* data = fontData->data();
+
+    EOTPrefix* prefix = eotHeader.prefix();
+
+    prefix->fontDataSize = dataLength;
+    prefix->version = 0x00020001;
+    prefix->flags = 0;
+
+    if (dataLength < offsetof(sfntHeader, tables))
+        return false;
+
+    const sfntHeader* sfnt = reinterpret_cast<const sfntHeader*>(data);
+
+    if (dataLength < offsetof(sfntHeader, tables) + sfnt->numTables * sizeof(TableDirectoryEntry))
+        return false;
+
+    bool haveOS2 = false;
+    bool haveHead = false;
+    bool haveName = false;
+
+    const BigEndianUShort* familyName = 0;
+    unsigned short familyNameLength = 0;
+    const BigEndianUShort* subfamilyName = 0;
+    unsigned short subfamilyNameLength = 0;
+    const BigEndianUShort* fullName = 0;
+    unsigned short fullNameLength = 0;
+    const BigEndianUShort* versionString = 0;
+    unsigned short versionStringLength = 0;
+
+    for (unsigned i = 0; i < sfnt->numTables; i++) {
+        unsigned tableOffset = sfnt->tables[i].offset;
+        unsigned tableLength = sfnt->tables[i].length;
+
+        if (dataLength < tableOffset || dataLength < tableLength || dataLength < tableOffset + tableLength)
+            return false;
+
+        unsigned tableTag = sfnt->tables[i].tag;
+        switch (tableTag) {
+            case 'OS/2':
+                {
+                    if (dataLength < tableOffset + sizeof(OS2Table))
+                        return false;
+
+                    haveOS2 = true;
+                    const OS2Table* OS2 = reinterpret_cast<const OS2Table*>(data + tableOffset);
+                    for (unsigned j = 0; j < 10; j++)
+                        prefix->fontPANOSE[j] = OS2->panose[j];
+                    prefix->italic = OS2->fsSelection & 0x01;
+                    prefix->weight = OS2->weightClass;
+                    // FIXME: Should use OS2->fsType, but some TrueType fonts set it to an over-restrictive value.
+                    // Since ATS does not enforce this on Mac OS X, we do not enforce it either.
+                    prefix->fsType = 0;            
+                    for (unsigned j = 0; j < 4; j++)
+                        prefix->unicodeRange[j] = OS2->unicodeRange[j];
+                    for (unsigned j = 0; j < 2; j++)
+                        prefix->codePageRange[j] = OS2->codePageRange[j];
+                    break;
+                }
+            case 'head':
+                {
+                    if (dataLength < tableOffset + sizeof(headTable))
+                        return false;
+
+                    haveHead = true;
+                    const headTable* head = reinterpret_cast<const headTable*>(data + tableOffset);
+                    prefix->checkSumAdjustment = head->checkSumAdjustment;
+                    break;
+                }
+            case 'name':
+                {
+                    if (dataLength < tableOffset + offsetof(nameTable, nameRecords))
+                        return false;
+
+                    haveName = true;
+                    const nameTable* name = reinterpret_cast<const nameTable*>(data + tableOffset);
+                    for (int j = 0; j < name->count; j++) {
+                        if (dataLength < tableOffset + offsetof(nameTable, nameRecords) + (j + 1) * sizeof(nameRecord))
+                            return false;
+                        if (name->nameRecords[j].platformID == 3 && name->nameRecords[j].encodingID == 1 && name->nameRecords[j].languageID == 0x0409) {
+                            if (dataLength < tableOffset + name->stringOffset + name->nameRecords[j].offset + name->nameRecords[j].length)
+                                return false;
+
+                            unsigned short nameLength = name->nameRecords[j].length;
+                            const BigEndianUShort* nameString = reinterpret_cast<const BigEndianUShort*>(data + tableOffset + name->stringOffset + name->nameRecords[j].offset);
+                            
+                            switch (name->nameRecords[j].nameID) {
+                                case 1:
+                                    familyNameLength = nameLength;
+                                    familyName = nameString;
+                                    break;
+                                case 2:
+                                    subfamilyNameLength = nameLength;
+                                    subfamilyName = nameString;
+                                    break;
+                                case 4:
+                                    fullNameLength = nameLength;
+                                    fullName = nameString;
+                                    break;
+                                case 5:
+                                    versionStringLength = nameLength;
+                                    versionString = nameString;
+                                    break;
+                                default:
+                                    break;
+                            }
+                        }
+                    }
+                    break;
+                }
+            default:
+                break;
+        }
+        if (haveOS2 && haveHead && haveName)
+            break;
+    }
+
+    prefix->charset = DEFAULT_CHARSET;
+    prefix->magicNumber = 0x504c;
+    prefix->reserved[0] = 0;
+    prefix->reserved[1] = 0;
+    prefix->reserved[2] = 0;
+    prefix->reserved[3] = 0;
+    prefix->padding1 = 0;
+
+    eotHeader.appendBigEndianString(familyName, familyNameLength);
+    eotHeader.appendBigEndianString(subfamilyName, subfamilyNameLength);
+    eotHeader.appendBigEndianString(versionString, versionStringLength);
+
+    // If possible, ensure that the family name is a prefix of the full name.
+    if (fullNameLength >= familyNameLength && memcmp(familyName, fullName, familyNameLength)) {
+        overlaySrc = reinterpret_cast<const char*>(fullName) - data;
+        overlayDst = reinterpret_cast<const char*>(familyName) - data;
+        overlayLength = familyNameLength;
+    }
+    eotHeader.appendBigEndianString(fullName, fullNameLength);
+
+    eotHeader.appendPaddingShort();
+    eotHeader.updateEOTSize(fontData->size());
+
+    return true;
+}
+
+HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
+{
+    size_t originalDataSize = fontData->size();
+    const sfntHeader* sfnt = reinterpret_cast<const sfntHeader*>(fontData->data());
+
+    unsigned t;
+    for (t = 0; t < sfnt->numTables; ++t) {
+        if (sfnt->tables[t].tag == 'name')
+            break;
+    }
+    if (t == sfnt->numTables)
+        return 0;
+
+    const int nameRecordCount = 5;
+
+    // Rounded up to a multiple of 4 to simplify the checksum calculation.
+    size_t nameTableSize = ((offsetof(nameTable, nameRecords) + nameRecordCount * sizeof(nameRecord) + fontName.length() * sizeof(UChar)) & ~3) + 4;
+
+    Vector<char> rewrittenFontData(fontData->size() + nameTableSize);
+    char* data = rewrittenFontData.data();
+    memcpy(data, fontData->data(), originalDataSize);
+
+    // Make the table directory entry point to the new 'name' table.
+    sfntHeader* rewrittenSfnt = reinterpret_cast<sfntHeader*>(data);
+    rewrittenSfnt->tables[t].length = nameTableSize;
+    rewrittenSfnt->tables[t].offset = originalDataSize;
+
+    // Write the new 'name' table after the original font data.
+    nameTable* name = reinterpret_cast<nameTable*>(data + originalDataSize);
+    name->format = 0;
+    name->count = nameRecordCount;
+    name->stringOffset = offsetof(nameTable, nameRecords) + nameRecordCount * sizeof(nameRecord);
+    for (unsigned i = 0; i < nameRecordCount; ++i) {
+        name->nameRecords[i].platformID = 3;
+        name->nameRecords[i].encodingID = 1;
+        name->nameRecords[i].languageID = 0x0409;
+        name->nameRecords[i].offset = 0;
+        name->nameRecords[i].length = fontName.length() * sizeof(UChar);
+    }
+
+    // The required 'name' record types: Family, Style, Unique, Full and PostScript.
+    name->nameRecords[0].nameID = 1;
+    name->nameRecords[1].nameID = 2;
+    name->nameRecords[2].nameID = 3;
+    name->nameRecords[3].nameID = 4;
+    name->nameRecords[4].nameID = 6;
+
+    for (unsigned i = 0; i < fontName.length(); ++i)
+        reinterpret_cast<BigEndianUShort*>(data + originalDataSize + name->stringOffset)[i] = fontName[i];
+
+    // Update the table checksum in the directory entry.
+    rewrittenSfnt->tables[t].checkSum = 0;
+    for (unsigned i = 0; i * sizeof(BigEndianULong) < nameTableSize; ++i)
+        rewrittenSfnt->tables[t].checkSum = rewrittenSfnt->tables[t].checkSum + reinterpret_cast<BigEndianULong*>(name)[i];
+
+    DWORD numFonts = 0;
+    HANDLE fontHandle = AddFontMemResourceEx(data, originalDataSize + nameTableSize, 0, &numFonts);
+
+    if (fontHandle && numFonts != 1) {
+        RemoveFontMemResourceEx(fontHandle);
+        return 0;
+    }
+
+    return fontHandle;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
new file mode 100644
index 0000000000..13dad6f484
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef OpenTypeUtilities_h
+#define OpenTypeUtilities_h
+
+#include "PlatformString.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+struct BigEndianUShort;
+struct EOTPrefix;
+class SharedBuffer;
+
+struct EOTHeader {
+    EOTHeader();
+
+    size_t size() const { return m_buffer.size(); }
+    const uint8_t* data() const { return m_buffer.data(); }
+
+    EOTPrefix* prefix() { return reinterpret_cast<EOTPrefix*>(m_buffer.data()); }
+    void updateEOTSize(size_t);
+    void appendBigEndianString(const BigEndianUShort*, unsigned short length);
+    void appendPaddingShort();
+
+private:
+    Vector<uint8_t, 512> m_buffer;
+};
+
+bool getEOTHeader(SharedBuffer* fontData, EOTHeader& eotHeader, size_t& overlayDst, size_t& overlaySrc, size_t& overlayLength);
+HANDLE renameAndActivateFont(SharedBuffer*, const String&);
+
+} // namespace WebCore
+
+#endif // OpenTypeUtilities_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 5d1f1472d0..668912ece0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -27,11 +27,22 @@
 #include "FontPlatformData.h"
 #include "Font.h"
 #include "StringHash.h"
+#include <wtf/StdLibExtras.h>
 
 #include <QHash>
 
 namespace WebCore {
 
+FontCache* fontCache()
+{
+    DEFINE_STATIC_LOCAL(FontCache, globalFontCache, ());
+    return &globalFontCache;
+}
+
+FontCache::FontCache()
+{
+}
+
 void FontCache::getTraitsInFamily(const AtomicString& familyName, Vector<unsigned>& traitsMasks)
 {
 }
@@ -85,4 +96,12 @@ void FontCache::removeClient(FontSelector*)
 {
 }
 
+void FontCache::invalidate()
+{
+    if (!gFontPlatformDataCache)
+        return;
+
+    gFontPlatformDataCache->clear();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
index ea51fe823b..f0dd3ea4a8 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
@@ -61,12 +61,14 @@ FontPlatformData::FontPlatformData(const QFont& font, bool bold)
 {
 }
 
+#if ENABLE(SVG_FONTS)
 FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
     : m_size(size)
     , m_bold(bold)
     , m_oblique(oblique)
 {
 }
+#endif
 
 FontPlatformData::FontPlatformData()
     : m_size(0.0f)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
index 4e78083e81..5a4b7b2541 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2008 Holger Hans Peter Freyther
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,11 +25,18 @@
 #include "FontFallbackList.h"
 #include "FontSelector.h"
 
+#include "Gradient.h"
 #include "GraphicsContext.h"
-#include <QTextLayout>
-#include <QPainter>
-#include <QFontMetrics>
+#include "Pattern.h"
+#include "TransformationMatrix.h"
+
+#include <QBrush>
 #include <QFontInfo>
+#include <QFontMetrics>
+#include <QPainter>
+#include <QPainterPath>
+#include <QPen>
+#include <QTextLayout>
 #include <qalgorithms.h>
 #include <qdebug.h>
 
@@ -79,8 +87,30 @@ void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const Float
         to = run.length();
 
     QPainter *p = ctx->platformContext();
-    Color color = ctx->fillColor();
-    p->setPen(QColor(color));
+
+    if (ctx->textDrawingMode() & cTextFill) {
+        if (ctx->fillGradient()) {
+            QBrush brush(*ctx->fillGradient()->platformGradient());
+            brush.setTransform(ctx->fillGradient()->gradientSpaceTransform());
+            p->setPen(QPen(brush, 0));
+        } else if (ctx->fillPattern()) {
+            TransformationMatrix affine;
+            p->setPen(QPen(QBrush(ctx->fillPattern()->createPlatformPattern(affine)), 0));
+        } else
+            p->setPen(QColor(ctx->fillColor()));
+    }
+
+    if (ctx->textDrawingMode() & cTextStroke) {
+        if (ctx->strokeGradient()) {
+            QBrush brush(*ctx->strokeGradient()->platformGradient());
+            brush.setTransform(ctx->strokeGradient()->gradientSpaceTransform());
+            p->setPen(QPen(brush, ctx->strokeThickness()));
+        } else if (ctx->strokePattern()) {
+            TransformationMatrix affine;
+            p->setPen(QPen(QBrush(ctx->strokePattern()->createPlatformPattern(affine)), ctx->strokeThickness()));
+        } else
+            p->setPen(QPen(QColor(ctx->strokeColor()), ctx->strokeThickness()));
+    }
 
     const QString string = fixSpacing(qstring(run));
 
@@ -144,10 +174,16 @@ void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const Float
         p->drawText(pt, string, flags, run.padding());
         p->restore();
     }
-    p->drawText(pt, string, flags, run.padding());
+    if (ctx->textDrawingMode() & cTextStroke) {
+        QPainterPath path;
+        path.addText(pt, font(), string);
+        p->strokePath(path, p->pen());
+    }
+    if (ctx->textDrawingMode() & cTextFill)
+        p->drawText(pt, string, flags, run.padding());
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>*) const
 {
     if (!run.length())
         return 0;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp
index ca06069bb0..1e71f5860b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp
@@ -67,6 +67,18 @@ QGradient* Gradient::platformGradient()
         ++stopIterator;
     }
 
+    switch(m_spreadMethod) {
+    case SpreadMethodPad:
+        m_gradient->setSpread(QGradient::PadSpread);
+        break;
+    case SpreadMethodReflect:
+        m_gradient->setSpread(QGradient::ReflectSpread);
+        break;
+    case SpreadMethodRepeat:
+        m_gradient->setSpread(QGradient::RepeatSpread);
+        break;
+    }
+
     return m_gradient;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 490b54b2aa..ed7ac47d42 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -51,6 +51,7 @@
 #include "Pen.h"
 #include "NotImplemented.h"
 
+#include <QBrush>
 #include <QDebug>
 #include <QGradient>
 #include <QPainter>
@@ -152,22 +153,6 @@ static Qt::PenStyle toQPenStyle(StrokeStyle style)
     return Qt::NoPen;
 }
 
-static inline QGradient applySpreadMethod(QGradient gradient, GradientSpreadMethod spreadMethod)
-{
-    switch (spreadMethod) {
-        case SpreadMethodPad:
-            gradient.setSpread(QGradient::PadSpread);
-           break;
-        case SpreadMethodReflect:
-            gradient.setSpread(QGradient::ReflectSpread);
-            break;
-        case SpreadMethodRepeat:
-            gradient.setSpread(QGradient::RepeatSpread);
-            break;
-    }
-    return gradient;
-}
-
 static inline Qt::FillRule toQtFillRule(WindRule rule)
 {
     switch(rule) {
@@ -294,7 +279,11 @@ PlatformGraphicsContext* GraphicsContext::platformContext() const
 
 TransformationMatrix GraphicsContext::getCTM() const
 {
-    return platformContext()->combinedMatrix();
+    QTransform matrix(platformContext()->combinedTransform());
+    return TransformationMatrix(matrix.m11(), matrix.m12(), 0, matrix.m13(), 
+                                matrix.m21(), matrix.m22(), 0, matrix.m23(),
+                                           0,            0, 1,            0,
+                                matrix.m31(), matrix.m32(), 0, matrix.m33());
 }
 
 void GraphicsContext::savePlatformState()
@@ -307,7 +296,7 @@ void GraphicsContext::restorePlatformState()
     m_data->p()->restore();
 
     if (!m_data->currentPath.isEmpty() && m_common->state.pathTransform.isInvertible()) {
-        QMatrix matrix = m_common->state.pathTransform;
+        QTransform matrix = m_common->state.pathTransform;
         m_data->currentPath = m_data->currentPath * matrix;
     }
 }
@@ -516,11 +505,11 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
         if (isVerticalLine) {
-            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), color);
-            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), color);
+            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), QColor(color));
+            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), QColor(color));
         } else {
-            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), color);
-            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), color);
+            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), QColor(color));
+            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), QColor(color));
         }
 
         // Example: 80 pixels with a width of 30 pixels.
@@ -586,7 +575,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     QPainter *p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
-    p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
+    p->setRenderHint(QPainter::Antialiasing, true);
 
     p->drawArc(rect, startAngle * 16, angleSpan * 16);
 
@@ -642,9 +631,9 @@ void GraphicsContext::fillPath()
         break;
     }
     case GradientColorSpace:
-        QGradient* gradient = m_common->state.fillGradient->platformGradient();
-        *gradient = applySpreadMethod(*gradient, spreadMethod());  
-        p->fillPath(path, QBrush(*gradient));
+        QBrush brush(*m_common->state.fillGradient->platformGradient());
+        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+        p->fillPath(path, brush);
         break;
     }
     m_data->currentPath = QPainterPath();
@@ -673,9 +662,9 @@ void GraphicsContext::strokePath()
         break;
     }
     case GradientColorSpace: {
-        QGradient* gradient = m_common->state.strokeGradient->platformGradient();
-        *gradient = applySpreadMethod(*gradient, spreadMethod()); 
-        pen.setBrush(QBrush(*gradient));
+        QBrush brush(*m_common->state.strokeGradient->platformGradient());
+        brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
+        pen.setBrush(brush);
         p->setPen(pen);
         p->strokePath(path, pen);
         break;
@@ -702,7 +691,9 @@ void GraphicsContext::fillRect(const FloatRect& rect)
         break;
     }
     case GradientColorSpace:
-        p->fillRect(rect, QBrush(*(m_common->state.fillGradient.get()->platformGradient())));
+        QBrush brush(*m_common->state.fillGradient->platformGradient());
+        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+        p->fillRect(rect, brush);
         break;
     }
     m_data->currentPath = QPainterPath();
@@ -1026,7 +1017,7 @@ void GraphicsContext::translate(float x, float y)
     m_data->p()->translate(x, y);
 
     if (!m_data->currentPath.isEmpty()) {
-        QMatrix matrix;
+        QTransform matrix;
         m_data->currentPath = m_data->currentPath * matrix.translate(-x, -y);
         m_common->state.pathTransform.translate(x, y);
     }
@@ -1048,7 +1039,7 @@ void GraphicsContext::rotate(float radians)
     m_data->p()->rotate(180/M_PI*radians);
 
     if (!m_data->currentPath.isEmpty()) {
-        QMatrix matrix;
+        QTransform matrix;
         m_data->currentPath = m_data->currentPath * matrix.rotate(-180/M_PI*radians);
         m_common->state.pathTransform.rotate(radians);
     }
@@ -1062,9 +1053,9 @@ void GraphicsContext::scale(const FloatSize& s)
     m_data->p()->scale(s.width(), s.height());
 
     if (!m_data->currentPath.isEmpty()) {
-        QMatrix matrix;
+        QTransform matrix;
         m_data->currentPath = m_data->currentPath * matrix.scale(1 / s.width(), 1 / s.height());
-        m_common->state.pathTransform.scale(s.width(), s.height());
+        m_common->state.pathTransform.scaleNonUniform(s.width(), s.height());
     }
 }
 
@@ -1120,7 +1111,13 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect,
                            rect.width() - (thickness * 2), rect.height() - (thickness * 2)));
 
     path.setFillRule(Qt::OddEvenFill);
-    m_data->p()->setClipPath(path, Qt::IntersectClip);
+
+    QPainter *p = m_data->p();
+
+    const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
+    p->setRenderHint(QPainter::Antialiasing, true);
+    p->setClipPath(path, Qt::IntersectClip);
+    p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
 void GraphicsContext::concatCTM(const TransformationMatrix& transform)
@@ -1128,12 +1125,12 @@ void GraphicsContext::concatCTM(const TransformationMatrix& transform)
     if (paintingDisabled())
         return;
 
-    m_data->p()->setMatrix(transform, true);
+    m_data->p()->setWorldTransform(transform, true);
 
     // Transformations to the context shouldn't transform the currentPath. 
     // We have to undo every change made to the context from the currentPath to avoid wrong drawings.
     if (!m_data->currentPath.isEmpty() && transform.isInvertible()) {
-        QMatrix matrix = transform.inverse();
+        QTransform matrix = transform.inverse();
         m_data->currentPath = m_data->currentPath * matrix;
         m_common->state.pathTransform.multiply(transform);
     }
@@ -1144,13 +1141,6 @@ void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
     notImplemented();
 }
 
-void GraphicsContext::setPlatformFont(const Font& aFont)
-{
-    if (paintingDisabled())
-        return;
-    m_data->p()->setFont(aFont.font());
-}
-
 void GraphicsContext::setPlatformStrokeColor(const Color& color)
 {
     if (paintingDisabled())
@@ -1188,7 +1178,7 @@ void GraphicsContext::setPlatformFillColor(const Color& color)
     m_data->p()->setBrush(QBrush(color));
 }
 
-void GraphicsContext::setUseAntialiasing(bool enable)
+void GraphicsContext::setPlatformShouldAntialias(bool enable)
 {
     if (paintingDisabled())
         return;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp
index b04668ce41..c9f3ced7eb 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/IconQt.cpp
@@ -24,7 +24,6 @@
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "IntRect.h"
-#include "NotImplemented.h"
 
 #include <qpainter.h>
 #include <qpixmap.h>
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 333269e2d0..506a8eaf80 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -101,7 +101,7 @@ Image* ImageBuffer::image() const
 PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
 {
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
-    unsigned char* data = result->data()->data();
+    unsigned char* data = result->data()->data()->data();
 
     if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
         memset(data, 0, result->data()->length());
@@ -184,9 +184,8 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
         m_data.m_painter->end();
 
     QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
-    ASSERT(!image.isNull());
 
-    unsigned char* srcRows = source->data()->data() + originy * srcBytesPerRow + originx * 4;
+    unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
     for (int y = 0; y < numRows; ++y) {
         quint32* scanLine = reinterpret_cast<quint32*>(image.scanLine(y + desty));
         for (int x = 0; x < numColumns; x++) {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
index e266c07fc7..a2e96f3403 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
  * Copyright (C) 2006 Simon Hausmann <hausmann@kde.org>
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  *
  * All rights reserved.
  *
@@ -30,12 +31,12 @@
 #include "config.h"
 #include "Image.h"
 
+#include "ImageObserver.h"
 #include "BitmapImage.h"
 #include "FloatRect.h"
 #include "PlatformString.h"
 #include "GraphicsContext.h"
 #include "TransformationMatrix.h"
-#include "NotImplemented.h"
 #include "StillImageQt.h"
 #include "qwebsettings.h"
 
@@ -69,14 +70,16 @@ static QPixmap loadResourcePixmap(const char *name)
 
 namespace WebCore {
 
-void FrameData::clear()
+bool FrameData::clear(bool clearMetadata)
 {
+    if (clearMetadata)
+        m_haveMetadata = false;
+
     if (m_frame) {
         m_frame = 0;
-        // NOTE: We purposefully don't reset metadata here, so that even if we
-        // throw away previously-decoded data, animation loops can still access
-        // properties like frame durations without re-decoding.
+        return true;
     }
+    return false;
 }
 
 
@@ -105,7 +108,7 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     }
 
     QBrush b(pixmap);
-    b.setMatrix(patternTransform);
+    b.setTransform(patternTransform);
     ctxt->save();
     ctxt->setCompositeOperation(op);
     QPainter* p = ctxt->platformContext();
@@ -114,6 +117,9 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     p->setBrushOrigin(phase);
     p->fillRect(destRect, b);
     ctxt->restore();
+
+    if (imageObserver())
+        imageObserver()->didDraw(this);
 }
 
 void BitmapImage::initPlatformData()
@@ -156,12 +162,25 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
     painter->drawPixmap(dst, *image, src);
 
     ctxt->restore();
+
+    if (imageObserver())
+        imageObserver()->didDraw(this);
 }
 
 void BitmapImage::checkForSolidColor()
 {
-    // FIXME: It's easy to implement this optimization. Just need to check the RGBA32 buffer to see if it is 1x1.
     m_isSolidColor = false;
+    m_checkedForSolidColor = true;
+
+    if (frameCount() > 1)
+        return;
+
+    QPixmap* framePixmap = frameAtIndex(0);
+    if (!framePixmap || framePixmap->width() != 1 || framePixmap->height() != 1)
+        return;
+
+    m_isSolidColor = true;
+    m_solidColor = QColor::fromRgba(framePixmap->toImage().pixel(0, 0));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
index d62acc39ae..621728e72e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
@@ -29,7 +29,6 @@
 #include "config.h"
 #include "ImageSource.h"
 #include "ImageDecoderQt.h"
-#include "NotImplemented.h"
 #include "SharedBuffer.h"
 
 #include <QBuffer>
@@ -163,7 +162,7 @@ void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer*
     delete m_decoder;
     m_decoder = 0;
     if (data)
-      setData(data, allDataReceived);
+        setData(data, allDataReceived);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index b1a48fb6b5..c80d73be2f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -76,7 +77,7 @@ namespace WebCore {
 MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     : m_player(player)
     , m_networkState(MediaPlayer::Empty)
-    , m_readyState(MediaPlayer::DataUnavailable)
+    , m_readyState(MediaPlayer::HaveNothing)
     , m_mediaObject(new MediaObject())
     , m_videoWidget(new VideoWidget(0))
     , m_audioOutput(new AudioOutput())
@@ -110,6 +111,18 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     connect(m_mediaObject, SIGNAL(totalTimeChanged(qint64)), this, SLOT(totalTimeChanged(qint64)));
 }
 
+MediaPlayerPrivateInterface* MediaPlayerPrivate::create(MediaPlayer* player) 
+{ 
+    return new MediaPlayerPrivate(player);
+}
+
+void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    if (isAvailable())
+        registrar(create, getSupportedTypes, supportsType);
+}
+
+
 MediaPlayerPrivate::~MediaPlayerPrivate()
 {
     LOG(Media, "MediaPlayerPrivatePhonon::dtor deleting videowidget");
@@ -131,6 +144,13 @@ void MediaPlayerPrivate::getSupportedTypes(HashSet<String>&)
     notImplemented();
 }
 
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+{
+    // FIXME: do the real thing
+    notImplemented();
+    return MediaPlayer::IsNotSupported;
+}
+
 bool MediaPlayerPrivate::hasVideo() const
 {
     bool hasVideo = m_mediaObject->hasVideo();
@@ -138,7 +158,7 @@ bool MediaPlayerPrivate::hasVideo() const
     return hasVideo;
 }
 
-void MediaPlayerPrivate::load(String url)
+void MediaPlayerPrivate::load(const String& url)
 {
     LOG(Media, "MediaPlayerPrivatePhonon::load(\"%s\")", url.utf8().data());
 
@@ -149,8 +169,8 @@ void MediaPlayerPrivate::load(String url)
     }
 
     // And we don't have any data yet
-    if (m_readyState != MediaPlayer::DataUnavailable) {
-        m_readyState = MediaPlayer::DataUnavailable;
+    if (m_readyState != MediaPlayer::HaveNothing) {
+        m_readyState = MediaPlayer::HaveNothing;
         m_player->readyStateChanged();
     }
 
@@ -205,7 +225,7 @@ bool MediaPlayerPrivate::seeking() const
 
 float MediaPlayerPrivate::duration() const
 {
-    if (m_networkState < MediaPlayer::LoadedMetaData)
+    if (m_readyState < MediaPlayer::HaveMetadata)
         return 0.0f;
 
     float duration = m_mediaObject->totalTime() / 1000.0f;
@@ -309,18 +329,19 @@ void MediaPlayerPrivate::updateStates()
     Phonon::State phononState = m_mediaObject->state();
 
     if (phononState == Phonon::StoppedState) {
-        if (oldNetworkState < MediaPlayer::LoadedMetaData) {
-            m_networkState = MediaPlayer::LoadedMetaData;
-            m_readyState = MediaPlayer::DataUnavailable;
+        if (m_readyState < MediaPlayer::HaveMetadata) {
+            m_networkState = MediaPlayer::Loading; // FIXME: should this be MediaPlayer::Idle?
+            m_readyState = MediaPlayer::HaveMetadata;
             m_mediaObject->pause();
         }
     } else if (phononState == Phonon::PausedState) {
         m_networkState = MediaPlayer::Loaded;
-        m_readyState = MediaPlayer::CanPlayThrough;
+        m_readyState = MediaPlayer::HaveEnoughData;
     } else if (phononState == Phonon::ErrorState) {
          if (!m_mediaObject || m_mediaObject->errorType() == Phonon::FatalError) {
-             m_networkState = MediaPlayer::LoadFailed;
-             m_readyState = MediaPlayer::DataUnavailable;
+             // FIXME: is it possile to differentiate between different types of errors
+             m_networkState = MediaPlayer::NetworkError;
+             m_readyState = MediaPlayer::HaveNothing;
              cancelLoad();
          } else {
              m_mediaObject->pause();
@@ -328,7 +349,7 @@ void MediaPlayerPrivate::updateStates()
     }
 
     if (seeking())
-        m_readyState = MediaPlayer::DataUnavailable;
+        m_readyState = MediaPlayer::HaveNothing;
 
     if (m_networkState != oldNetworkState) {
         const QMetaObject* metaObj = this->metaObject();
@@ -357,19 +378,18 @@ void MediaPlayerPrivate::setVisible(bool visible)
     m_videoWidget->setVisible(m_isVisible);
 }
 
-void MediaPlayerPrivate::setRect(const IntRect& newRect)
+void MediaPlayerPrivate::setSize(const IntSize& newSize)
 {
     if (!m_videoWidget)
         return;
 
-    LOG(Media, "MediaPlayerPrivatePhonon::setRect(%d,%d %dx%d)",
-                newRect.x(), newRect.y(),
-                newRect.width(), newRect.height());
+    LOG(Media, "MediaPlayerPrivatePhonon::setSize(%d,%d)",
+                newSize.width(), newSize.height());
 
     QRect currentRect = m_videoWidget->rect();
 
-    if (newRect.width() != currentRect.width() || newRect.height() != currentRect.height())
-        m_videoWidget->resize(newRect.width(), newRect.height());
+    if (newSize.width() != currentRect.width() || newSize.height() != currentRect.height())
+        m_videoWidget->resize(newSize.width(), newSize.height());
 }
 
 IntSize MediaPlayerPrivate::naturalSize() const
@@ -380,7 +400,7 @@ IntSize MediaPlayerPrivate::naturalSize() const
         return IntSize();
     }
 
-    if (m_networkState < MediaPlayer::LoadedMetaData) {
+    if (m_readyState < MediaPlayer::HaveMetadata) {
         LOG(Media, "MediaPlayerPrivatePhonon::naturalSize() -> %dx%d",
                            0, 0);
         return IntSize();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
index 1b20a84e11..9572d61518 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -20,8 +21,7 @@
 #ifndef MediaPlayerPrivatePhonon_h
 #define MediaPlayerPrivatePhonon_h
 
-#include "MediaPlayer.h"
-#include <wtf/Noncopyable.h>
+#include "MediaPlayerPrivate.h"
 
 #include <QObject>
 #include <phononnamespace.h>
@@ -40,31 +40,33 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
-    class MediaPlayerPrivate : public QObject, Noncopyable {
+    class MediaPlayerPrivate : public QObject, public MediaPlayerPrivateInterface {
 
         Q_OBJECT
 
     public:
-        MediaPlayerPrivate(MediaPlayer*);
+        static void registerMediaEngine(MediaEngineRegistrar);
         ~MediaPlayerPrivate();
 
         // These enums are used for debugging
         Q_ENUMS(ReadyState NetworkState PhononState)
 
         enum ReadyState {
-            DataUnavailable,
-            CanShowCurrentFrame,
-            CanPlay,
-            CanPlayThrough
+            HaveNothing, 
+            HaveMetadata, 
+            HaveCurrentData, 
+            HaveFutureData, 
+            HaveEnoughData
         };
 
         enum NetworkState {
-            Empty,
-            LoadFailed,
-            Loading,
-            LoadedMetaData,
-            LoadedFirstFrame,
-            Loaded
+            Empty, 
+            Idle, 
+            Loading, 
+            Loaded, 
+            FormatError, 
+            NetworkError, 
+            DecodeError
         };
 
         enum PhononState {
@@ -79,7 +81,7 @@ namespace WebCore {
         IntSize naturalSize() const;
         bool hasVideo() const;
 
-        void load(String url);
+        void load(const String &url);
         void cancelLoad();
 
         void play();
@@ -109,11 +111,9 @@ namespace WebCore {
         unsigned totalBytes() const;
 
         void setVisible(bool);
-        void setRect(const IntRect&);
+        void setSize(const IntSize&);
 
         void paint(GraphicsContext*, const IntRect&);
-        static void getSupportedTypes(HashSet<String>&);
-        static bool isAvailable()   { return true; }
 
     protected:
         bool eventFilter(QObject*, QEvent*);
@@ -130,6 +130,13 @@ namespace WebCore {
         void totalTimeChanged(qint64);
 
     private:
+        MediaPlayerPrivate(MediaPlayer*);
+        static MediaPlayerPrivateInterface* create(MediaPlayer* player);
+
+        static void getSupportedTypes(HashSet<String>&);
+        static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+        static bool isAvailable() { return true; }
+
         void updateStates();
 
         MediaPlayer* m_player;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
index bff9edb7ff..756903118a 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
@@ -37,8 +37,9 @@
 #include "PlatformString.h"
 #include "StrokeStyleApplier.h"
 #include <QPainterPath>
-#include <QMatrix>
+#include <QTransform>
 #include <QString>
+#include <wtf/OwnPtr.h>
 
 #define _USE_MATH_DEFINES
 #include <math.h>
@@ -85,9 +86,31 @@ bool Path::contains(const FloatPoint& point, WindRule rule) const
     return contains;
 }
 
+bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point) const
+{
+    ASSERT(applier);
+
+    // FIXME: We should try to use a 'shared Context' instead of creating a new ImageBuffer
+    // on each call.
+    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
+    GraphicsContext* gc = scratchImage->context();
+    QPainterPathStroker stroke;
+    applier->strokeStyle(gc);
+
+    QPen pen = gc->pen();
+    stroke.setWidth(pen.widthF());
+    stroke.setCapStyle(pen.capStyle());
+    stroke.setJoinStyle(pen.joinStyle());
+    stroke.setMiterLimit(pen.miterLimit());
+    stroke.setDashPattern(pen.dashPattern());
+    stroke.setDashOffset(pen.dashOffset());
+
+    return (stroke.createStroke(*platformPath())).contains(point);
+}
+
 void Path::translate(const FloatSize& size)
 {
-    QMatrix matrix;
+    QTransform matrix;
     matrix.translate(size.width(), size.height());
     *m_path = (*m_path) * matrix;
 }
@@ -101,7 +124,7 @@ FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
 {
     // FIXME: We should try to use a 'shared Context' instead of creating a new ImageBuffer
     // on each call.
-    std::auto_ptr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
+    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
     GraphicsContext* gc = scratchImage->context();
     QPainterPathStroker stroke;
     if (applier) {
@@ -286,10 +309,10 @@ String Path::debugString() const
 
         switch (cur.type) {
             case QPainterPath::MoveToElement:
-                ret += QString::fromLatin1("M %1 %2").arg(cur.x).arg(cur.y);
+                ret += QString(QLatin1String("M %1 %2")).arg(cur.x).arg(cur.y);
                 break;
             case QPainterPath::LineToElement:
-                ret += QString::fromLatin1("L %1 %2").arg(cur.x).arg(cur.y);
+                ret += QString(QLatin1String("L %1 %2")).arg(cur.x).arg(cur.y);
                 break;
             case QPainterPath::CurveToElement:
             {
@@ -299,7 +322,7 @@ String Path::debugString() const
                 Q_ASSERT(c1.type == QPainterPath::CurveToDataElement);
                 Q_ASSERT(c2.type == QPainterPath::CurveToDataElement);
 
-                ret += QString::fromLatin1("C %1 %2 %3 %4 %5 %6").arg(cur.x).arg(cur.y).arg(c1.x).arg(c1.y).arg(c2.x).arg(c2.y);
+                ret += QString(QLatin1String("C %1 %2 %3 %4 %5 %6")).arg(cur.x).arg(cur.y).arg(c1.x).arg(c1.y).arg(c2.x).arg(c2.y);
 
                 i += 2;
                 break;
@@ -358,7 +381,7 @@ void Path::apply(void* info, PathApplierFunction function) const
 void Path::transform(const TransformationMatrix& transform)
 {
     if (m_path) {
-        QMatrix mat = transform;
+        QTransform mat = transform;
         QPainterPath temp = mat.map(*m_path);
         delete m_path;
         m_path = new QPainterPath(temp);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp
index 5b76841b7a..b261613069 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PatternQt.cpp
@@ -31,14 +31,15 @@
 
 namespace WebCore {
 
-QBrush Pattern::createPlatformPattern(const TransformationMatrix& transform) const
+QBrush Pattern::createPlatformPattern(const TransformationMatrix&) const
 {
     QPixmap* pixmap = tileImage()->nativeImageForCurrentFrame();
     if (!pixmap)
         return QBrush();
 
+    // Qt merges patter space and user space itself
     QBrush brush(*pixmap);
-    brush.setMatrix(transform);
+    brush.setTransform(m_patternSpaceTransformation);
 
     return brush;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index 6cf4e553b2..f823f84214 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -30,7 +30,7 @@ namespace WebCore {
 
 void SimpleFontData::determinePitch()
 {
-    m_treatAsFixedPitch = m_font.font().fixedPitch();
+    m_treatAsFixedPitch = m_platformData.font().fixedPitch();
 }
 
 bool SimpleFontData::containsCharacters(const UChar*, int length) const
@@ -40,7 +40,7 @@ bool SimpleFontData::containsCharacters(const UChar*, int length) const
 
 void SimpleFontData::platformInit()
 {
-    QFontMetrics fm(m_font.font());
+    QFontMetrics fm(m_platformData.font());
 
     m_ascent = fm.ascent();
     m_descent = fm.descent();
@@ -59,6 +59,13 @@ void SimpleFontData::platformGlyphInit()
     m_missingGlyphData.glyph = 0;
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    QFontMetrics fm(m_platformData.font());
+    m_avgCharWidth = fm.averageCharWidth();
+    m_maxCharWidth = fm.maxWidth();
+}
+
 void SimpleFontData::platformDestroy()
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
index 47abd170ed..15f0cc5394 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
@@ -31,170 +31,9 @@
 
 namespace WebCore {
 
-TransformationMatrix::TransformationMatrix()
-    : m_transform()
-{
-}
-
-TransformationMatrix::TransformationMatrix(double a, double b, double c, double d, double tx, double ty)
-    : m_transform(a, b, c, d, tx, ty)
-{
-}
-
-TransformationMatrix::TransformationMatrix(const PlatformTransformationMatrix& matrix)
-    : m_transform(matrix)
-{
-}
-
-void TransformationMatrix::setMatrix(double a, double b, double c, double d, double tx, double ty)
-{
-    m_transform.setMatrix(a, b, c, d, tx, ty);
-}
-
-void TransformationMatrix::map(double x, double y, double* x2, double* y2) const
-{
-    qreal tx2, ty2;
-    m_transform.map(qreal(x), qreal(y), &tx2, &ty2);
-    *x2 = tx2;
-    *y2 = ty2;
-}
-
-IntRect TransformationMatrix::mapRect(const IntRect& rect) const
-{
-    return m_transform.mapRect(rect);
-}
-
-FloatRect TransformationMatrix::mapRect(const FloatRect& rect) const
-{
-    return m_transform.mapRect(rect);
-}
-
-bool TransformationMatrix::isIdentity() const
-{
-    return m_transform.isIdentity();
-}
-
-double TransformationMatrix::a() const
-{
-    return m_transform.m11();
-}
-
-void TransformationMatrix::setA(double a)
-{
-    m_transform.setMatrix(a, b(), c(), d(), e(), f());
-}
-
-double TransformationMatrix::b() const
-{
-    return m_transform.m12();
-}
-
-void TransformationMatrix::setB(double b)
-{
-    m_transform.setMatrix(a(), b, c(), d(), e(), f());
-}
-
-double TransformationMatrix::c() const
-{
-    return m_transform.m21();
-}
-
-void TransformationMatrix::setC(double c)
-{
-    m_transform.setMatrix(a(), b(), c, d(), e(), f());
-}
-
-double TransformationMatrix::d() const
-{
-    return m_transform.m22();
-}
-
-void TransformationMatrix::setD(double d)
-{
-    m_transform.setMatrix(a(), b(), c(), d, e(), f());
-}
-
-double TransformationMatrix::e() const
-{
-    return m_transform.dx();
-}
-
-void TransformationMatrix::setE(double e)
-{
-    m_transform.setMatrix(a(), b(), c(), d(), e, f());
-}
-
-double TransformationMatrix::f() const
-{
-    return m_transform.dy();
-}
-
-void TransformationMatrix::setF(double f)
-{
-    m_transform.setMatrix(a(), b(), c(), d(), e(), f);
-}
-
-void TransformationMatrix::reset()
-{
-    m_transform.reset();
-}
-
-TransformationMatrix& TransformationMatrix::scale(double sx, double sy)
-{
-    m_transform.scale(sx, sy);
-    return *this;
-}
-
-TransformationMatrix& TransformationMatrix::rotate(double d)
-{
-    m_transform.rotate(d);
-    return *this;
-}
-
-TransformationMatrix& TransformationMatrix::translate(double tx, double ty)
-{
-    m_transform.translate(tx, ty);
-    return *this;
-}
-
-TransformationMatrix& TransformationMatrix::shear(double sx, double sy)
-{
-    m_transform.shear(sx, sy);
-    return *this;
-}
-
-double TransformationMatrix::det() const
-{
-    return m_transform.det();
-}
-
-TransformationMatrix TransformationMatrix::inverse() const
-{
-    if(!isInvertible())
-        return TransformationMatrix();
-
-    return m_transform.inverted();
-}
-
-TransformationMatrix::operator QMatrix() const
-{
-    return m_transform;
-}
-
-bool TransformationMatrix::operator==(const TransformationMatrix& other) const
-{
-    return m_transform == other.m_transform;
-}
-
-TransformationMatrix& TransformationMatrix::operator*=(const TransformationMatrix& other)
-{
-    m_transform *= other.m_transform;
-    return *this;
-}
-
-TransformationMatrix TransformationMatrix::operator*(const TransformationMatrix& other)
-{
-    return m_transform * other.m_transform;
+TransformationMatrix::operator QTransform() const
+{          
+    return QTransform(m11(), m12(), m14(), m21(), m22(), m24(), m41(), m42(), m44());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp
new file mode 100644
index 0000000000..ab3413bb2d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Matrix3DTransformOperation.h"
+
+#include <algorithm>
+
+using namespace std;
+
+namespace WebCore {
+
+PassRefPtr<TransformOperation> Matrix3DTransformOperation::blend(const TransformOperation* from, double progress, bool blendToIdentity)
+{
+    if (from && !from->isSameType(*this))
+        return this;
+
+    // Convert the TransformOperations into matrices
+    IntSize size;
+    TransformationMatrix fromT;
+    TransformationMatrix toT;
+    if (from)
+        from->apply(fromT, size);
+
+    apply(toT, size);
+
+    if (blendToIdentity)
+        swap(fromT, toT);
+
+    toT.blend(fromT, progress);
+    return Matrix3DTransformOperation::create(toT);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
new file mode 100644
index 0000000000..7430dbc3c7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Matrix3DTransformOperation_h
+#define Matrix3DTransformOperation_h
+
+#include "TransformOperation.h"
+
+namespace WebCore {
+
+class Matrix3DTransformOperation : public TransformOperation {
+public:
+    static PassRefPtr<Matrix3DTransformOperation> create(const TransformationMatrix& matrix)
+    {
+        return adoptRef(new Matrix3DTransformOperation(matrix));
+    }
+
+private:    
+    virtual bool isIdentity() const { return m_matrix.isIdentity(); }
+
+    virtual OperationType getOperationType() const { return MATRIX_3D; }
+    virtual bool isSameType(const TransformOperation& o) const { return o.getOperationType() == MATRIX_3D; }
+
+    virtual bool operator==(const TransformOperation& o) const
+    {
+        if (!isSameType(o))
+            return false;
+        const Matrix3DTransformOperation* m = static_cast<const Matrix3DTransformOperation*>(&o);
+        return m_matrix == m->m_matrix;
+    }
+
+    virtual bool apply(TransformationMatrix& transform, const IntSize&) const
+    {
+        transform.multLeft(TransformationMatrix(m_matrix));
+        return false;
+    }
+
+    virtual PassRefPtr<TransformOperation> blend(const TransformOperation* from, double progress, bool blendToIdentity = false);
+    
+    Matrix3DTransformOperation(const TransformationMatrix& mat)
+    {
+        m_matrix = mat;
+    }
+
+    TransformationMatrix m_matrix;
+};
+
+} // namespace WebCore
+
+#endif // Matrix3DTransformOperation_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp
index 153d96d7f0..4934fa65b2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp
@@ -24,6 +24,8 @@
 
 #include <algorithm>
 
+using namespace std;
+
 namespace WebCore {
 
 PassRefPtr<TransformOperation> MatrixTransformOperation::blend(const TransformOperation* from, double progress, bool blendToIdentity)
@@ -41,7 +43,7 @@ PassRefPtr<TransformOperation> MatrixTransformOperation::blend(const TransformOp
     }
     
     if (blendToIdentity)
-        std::swap(fromT, toT);
+        swap(fromT, toT);
 
     toT.blend(fromT, progress);
     return MatrixTransformOperation::create(toT.a(), toT.b(), toT.c(), toT.d(), toT.e(), toT.f());
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
index d272229f20..ee47a115c0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
@@ -26,6 +26,7 @@
 #define MatrixTransformOperation_h
 
 #include "TransformOperation.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
@@ -36,8 +37,14 @@ public:
         return adoptRef(new MatrixTransformOperation(a, b, c, d, e, f));
     }
 
+    static PassRefPtr<MatrixTransformOperation> create(const TransformationMatrix& t)
+    {
+        return adoptRef(new MatrixTransformOperation(t));
+    }
+
 private:
     virtual bool isIdentity() const { return m_a == 1 && m_b == 0 && m_c == 0 && m_d == 1 && m_e == 0 && m_f == 0; }
+
     virtual OperationType getOperationType() const { return MATRIX; }
     virtual bool isSameType(const TransformOperation& o) const { return o.getOperationType() == MATRIX; }
 
@@ -53,7 +60,7 @@ private:
     virtual bool apply(TransformationMatrix& transform, const IntSize&) const
     {
         TransformationMatrix matrix(m_a, m_b, m_c, m_d, m_e, m_f);
-        transform = matrix * transform;
+        transform.multLeft(TransformationMatrix(matrix));
         return false;
     }
 
@@ -68,6 +75,16 @@ private:
         , m_f(f)
     {
     }
+
+    MatrixTransformOperation(const TransformationMatrix& t)
+        : m_a(t.a())
+        , m_b(t.b())
+        , m_c(t.c())
+        , m_d(t.d())
+        , m_e(t.e())
+        , m_f(t.f())
+    {
+    }
     
     double m_a;
     double m_b;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp
new file mode 100644
index 0000000000..9fd03a1282
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PerspectiveTransformOperation.h"
+
+#include <algorithm>
+
+using namespace std;
+
+namespace WebCore {
+
+PassRefPtr<TransformOperation> PerspectiveTransformOperation::blend(const TransformOperation* from, double progress, bool blendToIdentity)
+{
+    if (from && !from->isSameType(*this))
+        return this;
+    
+    if (blendToIdentity)
+        return PerspectiveTransformOperation::create(m_p + (1. - m_p) * progress);
+    
+    const PerspectiveTransformOperation* fromOp = static_cast<const PerspectiveTransformOperation*>(from);
+    double fromP = fromOp ? fromOp->m_p : 0;
+    double toP = m_p;
+
+    TransformationMatrix fromT;
+    TransformationMatrix toT;
+    fromT.applyPerspective(fromP);
+    toT.applyPerspective(toP);
+    toT.blend(fromT, progress);
+    TransformationMatrix::DecomposedType decomp;
+    toT.decompose(decomp);
+    
+    return PerspectiveTransformOperation::create(decomp.perspectiveZ ? -1.0 / decomp.perspectiveZ : 0.0);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
new file mode 100644
index 0000000000..a665f3ed92
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PerspectiveTransformOperation_h
+#define PerspectiveTransformOperation_h
+
+#include "TransformOperation.h"
+
+namespace WebCore {
+
+class PerspectiveTransformOperation : public TransformOperation {
+public:
+    static PassRefPtr<PerspectiveTransformOperation> create(double p)
+    {
+        return adoptRef(new PerspectiveTransformOperation(p));
+    }
+    
+private:
+    virtual bool isIdentity() const { return m_p == 0; }
+    virtual OperationType getOperationType() const { return PERSPECTIVE; }
+    virtual bool isSameType(const TransformOperation& o) const { return o.getOperationType() == PERSPECTIVE; }
+
+    virtual bool operator==(const TransformOperation& o) const
+    {
+        if (!isSameType(o))
+            return false;
+        const PerspectiveTransformOperation* p = static_cast<const PerspectiveTransformOperation*>(&o);
+        return m_p == p->m_p;
+    }
+
+    virtual bool apply(TransformationMatrix& transform, const IntSize&) const
+    {
+        transform.applyPerspective(m_p);
+        return false;
+    }
+
+    virtual PassRefPtr<TransformOperation> blend(const TransformOperation* from, double progress, bool blendToIdentity = false);
+
+    PerspectiveTransformOperation(double p)
+        : m_p(p)
+    {
+    }
+
+    double m_p;
+};
+
+} // namespace WebCore
+
+#endif // PerspectiveTransformOperation_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp
index 4887ceee88..919d174f9c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp
@@ -22,6 +22,11 @@
 #include "config.h"
 #include "RotateTransformOperation.h"
 
+#include <algorithm>
+#include <wtf/MathExtras.h>
+
+using namespace std;
+
 namespace WebCore {
 
 PassRefPtr<TransformOperation> RotateTransformOperation::blend(const TransformOperation* from, double progress, bool blendToIdentity)
@@ -30,11 +35,61 @@ PassRefPtr<TransformOperation> RotateTransformOperation::blend(const TransformOp
         return this;
     
     if (blendToIdentity)
-        return RotateTransformOperation::create(m_angle - m_angle * progress, m_type);
+        return RotateTransformOperation::create(m_x, m_y, m_z, m_angle - m_angle * progress, m_type);
     
     const RotateTransformOperation* fromOp = static_cast<const RotateTransformOperation*>(from);
-    double fromAngle = fromOp ? fromOp->m_angle : 0;
-    return RotateTransformOperation::create(fromAngle + (m_angle - fromAngle) * progress, m_type);
+    
+    // Optimize for single axis rotation
+    if (!fromOp || (fromOp->m_x == 0 && fromOp->m_y == 0 && fromOp->m_z == 1) || 
+                   (fromOp->m_x == 0 && fromOp->m_y == 1 && fromOp->m_z == 0) || 
+                   (fromOp->m_x == 1 && fromOp->m_y == 0 && fromOp->m_z == 0)) {
+        double fromAngle = fromOp ? fromOp->m_angle : 0;
+        return RotateTransformOperation::create(fromOp ? fromOp->m_x : m_x, 
+                                                fromOp ? fromOp->m_y : m_y, 
+                                                fromOp ? fromOp->m_z : m_z, 
+                                                fromAngle + (m_angle - fromAngle) * progress, m_type);
+    }
+
+    const RotateTransformOperation* toOp = this;
+
+    // Create the 2 rotation matrices
+    TransformationMatrix fromT;
+    TransformationMatrix toT;
+    fromT.rotate3d((float)(fromOp ? fromOp->m_x : 0),
+                   (float)(fromOp ? fromOp->m_y : 0),
+                   (float)(fromOp ? fromOp->m_z : 1),
+                   (float)(fromOp ? fromOp->m_angle : 0));
+
+    toT.rotate3d((float)(toOp ? toOp->m_x : 0),
+                 (float)(toOp ? toOp->m_y : 0),
+                 (float)(toOp ? toOp->m_z : 1),
+                 (float)(toOp ? toOp->m_angle : 0));
+    
+    // Blend them
+    toT.blend(fromT, progress);
+    
+    // Extract the result as a quaternion
+    TransformationMatrix::DecomposedType decomp;
+    toT.decompose(decomp);
+    
+    // Convert that to Axis/Angle form
+    double x = -decomp.quaternionX;
+    double y = -decomp.quaternionY;
+    double z = -decomp.quaternionZ;
+    double length = sqrt(x * x + y * y + z * z);
+    double angle = 0;
+    
+    if (length > 0.00001) {
+        x /= length;
+        y /= length;
+        z /= length;
+        angle = rad2deg(acos(decomp.quaternionW) * 2);
+    } else {
+        x = 0;
+        y = 0;
+        z = 1;
+    }
+    return RotateTransformOperation::create(x, y, z, angle, ROTATE_3D);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.h
index adc6c4c481..699ea43616 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/RotateTransformOperation.h
@@ -33,10 +33,19 @@ class RotateTransformOperation : public TransformOperation {
 public:
     static PassRefPtr<RotateTransformOperation> create(double angle, OperationType type)
     {
-        return adoptRef(new RotateTransformOperation(angle, type));
+        return adoptRef(new RotateTransformOperation(0, 0, 1, angle, type));
     }
 
+    static PassRefPtr<RotateTransformOperation> create(double x, double y, double z, double angle, OperationType type)
+    {
+        return adoptRef(new RotateTransformOperation(x, y, z, angle, type));
+    }
+
+    double angle() const { return m_angle; }
+
+private:
     virtual bool isIdentity() const { return m_angle == 0; }
+
     virtual OperationType getOperationType() const { return m_type; }
     virtual bool isSameType(const TransformOperation& o) const { return o.getOperationType() == m_type; }
 
@@ -45,26 +54,30 @@ public:
         if (!isSameType(o))
             return false;
         const RotateTransformOperation* r = static_cast<const RotateTransformOperation*>(&o);
-        return m_angle == r->m_angle;
+        return m_x == r->m_x && m_y == r->m_y && m_z == r->m_z && m_angle == r->m_angle;
     }
 
     virtual bool apply(TransformationMatrix& transform, const IntSize& /*borderBoxSize*/) const
     {
-        transform.rotate(m_angle);
+        transform.rotate3d(m_x, m_y, m_z, m_angle);
         return false;
     }
 
     virtual PassRefPtr<TransformOperation> blend(const TransformOperation* from, double progress, bool blendToIdentity = false);
 
-    double angle() const { return m_angle; }
-
-private:
-    RotateTransformOperation(double angle, OperationType type)
-        : m_angle(angle)
+    RotateTransformOperation(double x, double y, double z, double angle, OperationType type)
+        : m_x(x)
+        , m_y(y)
+        , m_z(z)
+        , m_angle(angle)
         , m_type(type)
     {
+        ASSERT(type == ROTATE_X || type == ROTATE_Y || type == ROTATE_Z || type == ROTATE_3D);
     }
 
+    double m_x;
+    double m_y;
+    double m_z;
     double m_angle;
     OperationType m_type;
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp
index 49a8fd8f8c..45d119cbc7 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp
@@ -30,12 +30,17 @@ PassRefPtr<TransformOperation> ScaleTransformOperation::blend(const TransformOpe
         return this;
     
     if (blendToIdentity)
-        return ScaleTransformOperation::create(m_x + (1. - m_x) * progress, m_y + (1. - m_y) * progress, m_type);
+        return ScaleTransformOperation::create(m_x + (1. - m_x) * progress,
+                                               m_y + (1. - m_y) * progress,
+                                               m_z + (1. - m_z) * progress, m_type);
     
     const ScaleTransformOperation* fromOp = static_cast<const ScaleTransformOperation*>(from);
     double fromX = fromOp ? fromOp->m_x : 1.;
     double fromY = fromOp ? fromOp->m_y : 1.;
-    return ScaleTransformOperation::create(fromX + (m_x - fromX) * progress, fromY + (m_y - fromY) * progress, m_type);
+    double fromZ = fromOp ? fromOp->m_z : 1.;
+    return ScaleTransformOperation::create(fromX + (m_x - fromX) * progress,
+                                           fromY + (m_y - fromY) * progress,
+                                           fromZ + (m_z - fromZ) * progress, m_type);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.h
index 289f8a13ad..a87bb3b676 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/ScaleTransformOperation.h
@@ -33,11 +33,21 @@ class ScaleTransformOperation : public TransformOperation {
 public:
     static PassRefPtr<ScaleTransformOperation> create(double sx, double sy, OperationType type)
     {
-        return adoptRef(new ScaleTransformOperation(sx, sy, type));
+        return adoptRef(new ScaleTransformOperation(sx, sy, 1, type));
     }
 
+    static PassRefPtr<ScaleTransformOperation> create(double sx, double sy, double sz, OperationType type)
+    {
+        return adoptRef(new ScaleTransformOperation(sx, sy, sz, type));
+    }
+
+    double x() const { return m_x; }
+    double y() const { return m_y; }
+    double z() const { return m_z; }
+
 private:
-    virtual bool isIdentity() const { return m_x == 1 &&  m_y == 1; }
+    virtual bool isIdentity() const { return m_x == 1 &&  m_y == 1 &&  m_z == 1; }
+
     virtual OperationType getOperationType() const { return m_type; }
     virtual bool isSameType(const TransformOperation& o) const { return o.getOperationType() == m_type; }
 
@@ -46,26 +56,29 @@ private:
         if (!isSameType(o))
             return false;
         const ScaleTransformOperation* s = static_cast<const ScaleTransformOperation*>(&o);
-        return m_x == s->m_x && m_y == s->m_y;
+        return m_x == s->m_x && m_y == s->m_y && m_z == s->m_z;
     }
 
     virtual bool apply(TransformationMatrix& transform, const IntSize&) const
     {
-        transform.scale(m_x, m_y);
+        transform.scale3d(m_x, m_y, m_z);
         return false;
     }
 
     virtual PassRefPtr<TransformOperation> blend(const TransformOperation* from, double progress, bool blendToIdentity = false);
 
-    ScaleTransformOperation(double sx, double sy, OperationType type)
+    ScaleTransformOperation(double sx, double sy, double sz, OperationType type)
         : m_x(sx)
         , m_y(sy)
+        , m_z(sz)
         , m_type(type)
     {
+        ASSERT(type == SCALE_X || type == SCALE_Y || type == SCALE_Z || type == SCALE || type == SCALE_3D);
     }
         
     double m_x;
     double m_y;
+    double m_z;
     OperationType m_type;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperation.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperation.h
index 65a0defe85..c610c4bbe6 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperation.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperation.h
@@ -39,9 +39,16 @@ public:
     enum OperationType {
         SCALE_X, SCALE_Y, SCALE, 
         TRANSLATE_X, TRANSLATE_Y, TRANSLATE, 
-        ROTATE, 
+        ROTATE,
+        ROTATE_Z = ROTATE,
         SKEW_X, SKEW_Y, SKEW, 
-        MATRIX, IDENTITY, NONE
+        MATRIX,
+        SCALE_Z, SCALE_3D,
+        TRANSLATE_Z, TRANSLATE_3D,
+        ROTATE_X, ROTATE_Y, ROTATE_3D,
+        MATRIX_3D,
+        PERSPECTIVE,
+        IDENTITY, NONE
     };
 
     virtual ~TransformOperation() { }
@@ -51,12 +58,27 @@ public:
 
     virtual bool isIdentity() const = 0;
 
+    // Return true if the borderBoxSize was used in the computation, false otherwise.
     virtual bool apply(TransformationMatrix&, const IntSize& borderBoxSize) const = 0;
 
     virtual PassRefPtr<TransformOperation> blend(const TransformOperation* from, double progress, bool blendToIdentity = false) = 0;
 
     virtual OperationType getOperationType() const = 0;
     virtual bool isSameType(const TransformOperation&) const { return false; }
+    
+    bool is3DOperation() const
+    {
+        OperationType opType = getOperationType();
+        return opType == SCALE_Z ||
+               opType == SCALE_3D ||
+               opType == TRANSLATE_Z ||
+               opType == TRANSLATE_3D ||
+               opType == ROTATE_X ||
+               opType == ROTATE_Y ||
+               opType == ROTATE_3D ||
+               opType == MATRIX_3D ||
+               opType == PERSPECTIVE;
+    }
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
index f929417b39..11605e8546 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
@@ -47,6 +47,16 @@ public:
             m_operations[i]->apply(t, sz);
     }
     
+    // Return true if any of the operation types are 3D operation types (even if the
+    // values describe affine transforms)
+    bool has3DOperation() const
+    {
+        for (unsigned i = 0; i < m_operations.size(); ++i)
+            if (m_operations[i]->is3DOperation())
+                return true;
+        return false;
+    }
+    
     Vector<RefPtr<TransformOperation> >& operations() { return m_operations; }
     const Vector<RefPtr<TransformOperation> >& operations() const { return m_operations; }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index b48d57294c..a358aaf9dc 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -26,84 +26,477 @@
 #include "config.h"
 #include "TransformationMatrix.h"
 
+#include "FloatPoint3D.h"
 #include "FloatRect.h"
 #include "FloatQuad.h"
 #include "IntRect.h"
 
+#include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
 
-static void affineTransformDecompose(const TransformationMatrix& matrix, double sr[9])
+//
+// Supporting Math Functions
+//
+// This is a set of function from various places (attributed inline) to do things like
+// inversion and decomposition of a 4x4 matrix. They are used throughout the code
+//
+
+//
+// Adapted from Matrix Inversion by Richard Carling, Graphics Gems <http://tog.acm.org/GraphicsGems/index.html>.
+
+// EULA: The Graphics Gems code is copyright-protected. In other words, you cannot claim the text of the code 
+// as your own and resell it. Using the code is permitted in any program, product, or library, non-commercial 
+// or commercial. Giving credit is not required, though is a nice gesture. The code comes as-is, and if there 
+// are any flaws or problems with any Gems code, nobody involved with Gems - authors, editors, publishers, or 
+// webmasters - are to be held responsible. Basically, don't be a jerk, and remember that anything free comes 
+// with no guarantee.
+
+typedef double Vector4[4];
+typedef double Vector3[3];
+
+const double SMALL_NUMBER = 1.e-8;
+
+// inverse(original_matrix, inverse_matrix)
+// 
+// calculate the inverse of a 4x4 matrix
+// 
+// -1     
+// A  = ___1__ adjoint A
+//       det A
+
+//  double = determinant2x2(double a, double b, double c, double d)
+//  
+//  calculate the determinant of a 2x2 matrix.
+
+static double determinant2x2(double a, double b, double c, double d)
 {
-    TransformationMatrix m(matrix);
+    return a * d - b * c;
+}
 
-    // Compute scaling factors
-    double sx = sqrt(m.a() * m.a() + m.b() * m.b());
-    double sy = sqrt(m.c() * m.c() + m.d() * m.d());
+//  double = determinant3x3(a1, a2, a3, b1, b2, b3, c1, c2, c3)
+//  
+//  Calculate the determinant of a 3x3 matrix
+//  in the form
+// 
+//      | a1,  b1,  c1 |
+//      | a2,  b2,  c2 |
+//      | a3,  b3,  c3 |
 
-    /* Compute cross product of transformed unit vectors. If negative,
-        one axis was flipped. */
+static double determinant3x3(double a1, double a2, double a3, double b1, double b2, double b3, double c1, double c2, double c3)
+{
+    return a1 * determinant2x2(b2, b3, c2, c3)
+         - b1 * determinant2x2(a2, a3, c2, c3)
+         + c1 * determinant2x2(a2, a3, b2, b3);
+}
 
-    if (m.a() * m.d() - m.c() * m.b() < 0.0) {
-        // Flip axis with minimum unit vector dot product
+//  double = determinant4x4(matrix)
+//  
+//  calculate the determinant of a 4x4 matrix.
 
-        if (m.a() < m.d())
-            sx = -sx;
-        else
-            sy = -sy;
-    }
+static double determinant4x4(const TransformationMatrix::Matrix4& m)
+{
+    // Assign to individual variable names to aid selecting
+    // correct elements
+
+    double a1 = m[0][0];
+    double b1 = m[0][1]; 
+    double c1 = m[0][2];
+    double d1 = m[0][3];
+
+    double a2 = m[1][0];
+    double b2 = m[1][1]; 
+    double c2 = m[1][2];
+    double d2 = m[1][3];
+
+    double a3 = m[2][0]; 
+    double b3 = m[2][1];
+    double c3 = m[2][2];
+    double d3 = m[2][3];
+
+    double a4 = m[3][0];
+    double b4 = m[3][1]; 
+    double c4 = m[3][2];
+    double d4 = m[3][3];
+
+    return a1 * determinant3x3(b2, b3, b4, c2, c3, c4, d2, d3, d4)
+         - b1 * determinant3x3(a2, a3, a4, c2, c3, c4, d2, d3, d4)
+         + c1 * determinant3x3(a2, a3, a4, b2, b3, b4, d2, d3, d4)
+         - d1 * determinant3x3(a2, a3, a4, b2, b3, b4, c2, c3, c4);
+}
+
+// adjoint( original_matrix, inverse_matrix )
+//
+//   calculate the adjoint of a 4x4 matrix
+//
+//    Let  a   denote the minor determinant of matrix A obtained by
+//         ij
+//
+//    deleting the ith row and jth column from A.
+// 
+//                  i+j
+//   Let  b   = (-1)    a
+//        ij            ji
+// 
+//  The matrix B = (b  ) is the adjoint of A
+//                   ij
+
+static void adjoint(const TransformationMatrix::Matrix4& matrix, TransformationMatrix::Matrix4& result)
+{
+    // Assign to individual variable names to aid
+    // selecting correct values
+    double a1 = matrix[0][0];
+    double b1 = matrix[0][1]; 
+    double c1 = matrix[0][2];
+    double d1 = matrix[0][3];
 
-    // Remove scale from matrix
+    double a2 = matrix[1][0];
+    double b2 = matrix[1][1]; 
+    double c2 = matrix[1][2];
+    double d2 = matrix[1][3];
 
-    m.scale(1.0 / sx, 1.0 / sy);
+    double a3 = matrix[2][0];
+    double b3 = matrix[2][1];
+    double c3 = matrix[2][2];
+    double d3 = matrix[2][3];
 
-    // Compute rotation
+    double a4 = matrix[3][0];
+    double b4 = matrix[3][1]; 
+    double c4 = matrix[3][2];
+    double d4 = matrix[3][3];
 
-    double angle = atan2(m.b(), m.a());
+    // Row column labeling reversed since we transpose rows & columns
+    result[0][0]  =   determinant3x3(b2, b3, b4, c2, c3, c4, d2, d3, d4);
+    result[1][0]  = - determinant3x3(a2, a3, a4, c2, c3, c4, d2, d3, d4);
+    result[2][0]  =   determinant3x3(a2, a3, a4, b2, b3, b4, d2, d3, d4);
+    result[3][0]  = - determinant3x3(a2, a3, a4, b2, b3, b4, c2, c3, c4);
+        
+    result[0][1]  = - determinant3x3(b1, b3, b4, c1, c3, c4, d1, d3, d4);
+    result[1][1]  =   determinant3x3(a1, a3, a4, c1, c3, c4, d1, d3, d4);
+    result[2][1]  = - determinant3x3(a1, a3, a4, b1, b3, b4, d1, d3, d4);
+    result[3][1]  =   determinant3x3(a1, a3, a4, b1, b3, b4, c1, c3, c4);
+        
+    result[0][2]  =   determinant3x3(b1, b2, b4, c1, c2, c4, d1, d2, d4);
+    result[1][2]  = - determinant3x3(a1, a2, a4, c1, c2, c4, d1, d2, d4);
+    result[2][2]  =   determinant3x3(a1, a2, a4, b1, b2, b4, d1, d2, d4);
+    result[3][2]  = - determinant3x3(a1, a2, a4, b1, b2, b4, c1, c2, c4);
+        
+    result[0][3]  = - determinant3x3(b1, b2, b3, c1, c2, c3, d1, d2, d3);
+    result[1][3]  =   determinant3x3(a1, a2, a3, c1, c2, c3, d1, d2, d3);
+    result[2][3]  = - determinant3x3(a1, a2, a3, b1, b2, b3, d1, d2, d3);
+    result[3][3]  =   determinant3x3(a1, a2, a3, b1, b2, b3, c1, c2, c3);
+}
+
+// Returns false if the matrix is not invertible
+static bool inverse(const TransformationMatrix::Matrix4& matrix, TransformationMatrix::Matrix4& result)
+{
+    // Calculate the adjoint matrix
+    adjoint(matrix, result);
 
-    // Remove rotation from matrix
+    // Calculate the 4x4 determinant
+    // If the determinant is zero, 
+    // then the inverse matrix is not unique.
+    double det = determinant4x4(matrix);
 
-    m.rotate(rad2deg(-angle));
+    if (fabs(det) < SMALL_NUMBER)
+        return false;
 
-    // Return results
+    // Scale the adjoint matrix to get the inverse
 
-    sr[0] = sx; sr[1] = sy; sr[2] = angle;
-    sr[3] = m.a(); sr[4] = m.b();
-    sr[5] = m.c(); sr[6] = m.d();
-    sr[7] = m.e(); sr[8] = m.f();
+    for (int i = 0; i < 4; i++)
+        for (int j = 0; j < 4; j++)
+            result[i][j] = result[i][j] / det;
+
+    return true;
 }
 
-static void affineTransformCompose(TransformationMatrix& m, const double sr[9])
+// End of code adapted from Matrix Inversion by Richard Carling
+
+// Perform a decomposition on the passed matrix, return false if unsuccessful
+// From Graphics Gems: unmatrix.c
+
+// Transpose rotation portion of matrix a, return b
+static void transposeMatrix4(const TransformationMatrix::Matrix4& a, TransformationMatrix::Matrix4& b)
 {
-    m.setA(sr[3]);
-    m.setB(sr[4]);
-    m.setC(sr[5]);
-    m.setD(sr[6]);
-    m.setE(sr[7]);
-    m.setF(sr[8]);
-    m.rotate(rad2deg(sr[2]));
-    m.scale(sr[0], sr[1]);
+    for (int i = 0; i < 4; i++)
+        for (int j = 0; j < 4; j++)
+            b[i][j] = a[j][i];
 }
 
-bool TransformationMatrix::isInvertible() const
+// Multiply a homogeneous point by a matrix and return the transformed point
+static void v4MulPointByMatrix(const Vector4 p, const TransformationMatrix::Matrix4& m, Vector4 result)
 {
-    return det() != 0.0;
+    result[0] = (p[0] * m[0][0]) + (p[1] * m[1][0]) +
+                (p[2] * m[2][0]) + (p[3] * m[3][0]);
+    result[1] = (p[0] * m[0][1]) + (p[1] * m[1][1]) +
+                (p[2] * m[2][1]) + (p[3] * m[3][1]);
+    result[2] = (p[0] * m[0][2]) + (p[1] * m[1][2]) +
+                (p[2] * m[2][2]) + (p[3] * m[3][2]);
+    result[3] = (p[0] * m[0][3]) + (p[1] * m[1][3]) +
+                (p[2] * m[2][3]) + (p[3] * m[3][3]);
 }
 
-TransformationMatrix& TransformationMatrix::multiply(const TransformationMatrix& other)
+static double v3Length(Vector3 a)
 {
-    return (*this) *= other;
+    return sqrt((a[0] * a[0]) + (a[1] * a[1]) + (a[2] * a[2]));
 }
 
-TransformationMatrix& TransformationMatrix::scale(double s)
+static void v3Scale(Vector3 v, double desiredLength) 
 {
-    return scale(s, s);
+    double len = v3Length(v);
+    if (len != 0) {
+        double l = desiredLength / len;
+        v[0] *= l;
+        v[1] *= l;
+        v[2] *= l;
+    }
 }
 
-TransformationMatrix& TransformationMatrix::scaleNonUniform(double sx, double sy)
+static double v3Dot(const Vector3 a, const Vector3 b) 
+{
+    return (a[0] * b[0]) + (a[1] * b[1]) + (a[2] * b[2]);
+}
+
+// Make a linear combination of two vectors and return the result.
+// result = (a * ascl) + (b * bscl)
+static void v3Combine(const Vector3 a, const Vector3 b, Vector3 result, double ascl, double bscl)
+{
+    result[0] = (ascl * a[0]) + (bscl * b[0]);
+    result[1] = (ascl * a[1]) + (bscl * b[1]);
+    result[2] = (ascl * a[2]) + (bscl * b[2]);
+}
+
+// Return the cross product result = a cross b */
+static void v3Cross(const Vector3 a, const Vector3 b, Vector3 result)
+{
+    result[0] = (a[1] * b[2]) - (a[2] * b[1]);
+    result[1] = (a[2] * b[0]) - (a[0] * b[2]);
+    result[2] = (a[0] * b[1]) - (a[1] * b[0]);
+}
+
+static bool decompose(const TransformationMatrix::Matrix4& mat, TransformationMatrix::DecomposedType& result)
+{
+    TransformationMatrix::Matrix4 localMatrix;
+    memcpy(localMatrix, mat, sizeof(TransformationMatrix::Matrix4));
+
+    // Normalize the matrix.
+    if (localMatrix[3][3] == 0)
+        return false;
+
+    int i, j;
+    for (i = 0; i < 4; i++)
+        for (j = 0; j < 4; j++)
+            localMatrix[i][j] /= localMatrix[3][3];
+
+    // perspectiveMatrix is used to solve for perspective, but it also provides
+    // an easy way to test for singularity of the upper 3x3 component.
+    TransformationMatrix::Matrix4 perspectiveMatrix;
+    memcpy(perspectiveMatrix, localMatrix, sizeof(TransformationMatrix::Matrix4));
+    for (i = 0; i < 3; i++)
+        perspectiveMatrix[i][3] = 0;
+    perspectiveMatrix[3][3] = 1;
+
+    if (determinant4x4(perspectiveMatrix) == 0)
+        return false;
+
+    // First, isolate perspective.  This is the messiest.
+    if (localMatrix[0][3] != 0 || localMatrix[1][3] != 0 || localMatrix[2][3] != 0) {
+        // rightHandSide is the right hand side of the equation.
+        Vector4 rightHandSide;
+        rightHandSide[0] = localMatrix[0][3];
+        rightHandSide[1] = localMatrix[1][3];
+        rightHandSide[2] = localMatrix[2][3];
+        rightHandSide[3] = localMatrix[3][3];
+
+        // Solve the equation by inverting perspectiveMatrix and multiplying
+        // rightHandSide by the inverse.  (This is the easiest way, not
+        // necessarily the best.)
+        TransformationMatrix::Matrix4 inversePerspectiveMatrix, transposedInversePerspectiveMatrix;
+        inverse(perspectiveMatrix, inversePerspectiveMatrix);
+        transposeMatrix4(inversePerspectiveMatrix, transposedInversePerspectiveMatrix);
+
+        Vector4 perspectivePoint;
+        v4MulPointByMatrix(rightHandSide, transposedInversePerspectiveMatrix, perspectivePoint);
+ 
+        result.perspectiveX = perspectivePoint[0];
+        result.perspectiveY = perspectivePoint[1];
+        result.perspectiveZ = perspectivePoint[2];
+        result.perspectiveW = perspectivePoint[3];
+        
+        // Clear the perspective partition
+        localMatrix[0][3] = localMatrix[1][3] = localMatrix[2][3] = 0;
+        localMatrix[3][3] = 1;
+    } else {
+        // No perspective.
+        result.perspectiveX = result.perspectiveY = result.perspectiveZ = 0;
+        result.perspectiveW = 1;
+    }
+    
+    // Next take care of translation (easy).
+    result.translateX = localMatrix[3][0];
+    localMatrix[3][0] = 0;
+    result.translateY = localMatrix[3][1];
+    localMatrix[3][1] = 0;
+    result.translateZ = localMatrix[3][2];
+    localMatrix[3][2] = 0;
+
+    // Vector4 type and functions need to be added to the common set.
+    Vector3 row[3], pdum3;
+
+    // Now get scale and shear.
+    for (i = 0; i < 3; i++) {
+        row[i][0] = localMatrix[i][0];
+        row[i][1] = localMatrix[i][1];
+        row[i][2] = localMatrix[i][2];
+    }
+
+    // Compute X scale factor and normalize first row.
+    result.scaleX = v3Length(row[0]);
+    v3Scale(row[0], 1.0);
+
+    // Compute XY shear factor and make 2nd row orthogonal to 1st.
+    result.skewXY = v3Dot(row[0], row[1]);
+    v3Combine(row[1], row[0], row[1], 1.0, -result.skewXY);
+
+    // Now, compute Y scale and normalize 2nd row.
+    result.scaleY = v3Length(row[1]);
+    v3Scale(row[1], 1.0);
+    result.skewXY /= result.scaleY;
+
+    // Compute XZ and YZ shears, orthogonalize 3rd row.
+    result.skewXZ = v3Dot(row[0], row[2]);
+    v3Combine(row[2], row[0], row[2], 1.0, -result.skewXZ);
+    result.skewYZ = v3Dot(row[1], row[2]);
+    v3Combine(row[2], row[1], row[2], 1.0, -result.skewYZ);
+
+    // Next, get Z scale and normalize 3rd row.
+    result.scaleZ = v3Length(row[2]);
+    v3Scale(row[2], 1.0);
+    result.skewXZ /= result.scaleZ;
+    result.skewYZ /= result.scaleZ;
+ 
+    // At this point, the matrix (in rows[]) is orthonormal.
+    // Check for a coordinate system flip.  If the determinant
+    // is -1, then negate the matrix and the scaling factors.
+    v3Cross(row[1], row[2], pdum3);
+    if (v3Dot(row[0], pdum3) < 0) {
+        for (i = 0; i < 3; i++) {
+            result.scaleX *= -1;
+            row[i][0] *= -1;
+            row[i][1] *= -1;
+            row[i][2] *= -1;
+        }
+    }
+ 
+    // Now, get the rotations out, as described in the gem.
+    
+    // FIXME - Add the ability to return either quaternions (which are
+    // easier to recompose with) or Euler angles (rx, ry, rz), which
+    // are easier for authors to deal with. The latter will only be useful
+    // when we fix https://bugs.webkit.org/show_bug.cgi?id=23799, so I
+    // will leave the Euler angle code here for now.
+
+    // ret.rotateY = asin(-row[0][2]);
+    // if (cos(ret.rotateY) != 0) {
+    //     ret.rotateX = atan2(row[1][2], row[2][2]);
+    //     ret.rotateZ = atan2(row[0][1], row[0][0]);
+    // } else {
+    //     ret.rotateX = atan2(-row[2][0], row[1][1]);
+    //     ret.rotateZ = 0;
+    // }
+    
+    double s, t, x, y, z, w;
+
+    t = row[0][0] + row[1][1] + row[2][2] + 1.0;
+
+    if (t > 1e-4) {
+        s = 0.5 / sqrt(t);
+        w = 0.25 / s;
+        x = (row[2][1] - row[1][2]) * s;
+        y = (row[0][2] - row[2][0]) * s;
+        z = (row[1][0] - row[0][1]) * s;
+    } else if (row[0][0] > row[1][1] && row[0][0] > row[2][2]) { 
+        s = sqrt (1.0 + row[0][0] - row[1][1] - row[2][2]) * 2.0; // S=4*qx 
+        x = 0.25 * s;
+        y = (row[0][1] + row[1][0]) / s; 
+        z = (row[0][2] + row[2][0]) / s; 
+        w = (row[2][1] - row[1][2]) / s;
+    } else if (row[1][1] > row[2][2]) { 
+        s = sqrt (1.0 + row[1][1] - row[0][0] - row[2][2]) * 2.0; // S=4*qy
+        x = (row[0][1] + row[1][0]) / s; 
+        y = 0.25 * s;
+        z = (row[1][2] + row[2][1]) / s; 
+        w = (row[0][2] - row[2][0]) / s;
+    } else { 
+        s = sqrt(1.0 + row[2][2] - row[0][0] - row[1][1]) * 2.0; // S=4*qz
+        x = (row[0][2] + row[2][0]) / s;
+        y = (row[1][2] + row[2][1]) / s; 
+        z = 0.25 * s;
+        w = (row[1][0] - row[0][1]) / s;
+    }
+
+    result.quaternionX = x;
+    result.quaternionY = y;
+    result.quaternionZ = z;
+    result.quaternionW = w;
+    
+    return true;
+}
+
+// Perform a spherical linear interpolation between the two
+// passed quaternions with 0 <= t <= 1
+static void slerp(double qa[4], const double qb[4], double t)
 {
-    return scale(sx, sy);
+    double ax, ay, az, aw;
+    double bx, by, bz, bw;
+    double cx, cy, cz, cw;
+    double angle;
+    double th, invth, scale, invscale;
+
+    ax = qa[0]; ay = qa[1]; az = qa[2]; aw = qa[3];
+    bx = qb[0]; by = qb[1]; bz = qb[2]; bw = qb[3];
+
+    angle = ax * bx + ay * by + az * bz + aw * bw;
+
+    if (angle < 0.0) {
+        ax = -ax; ay = -ay;
+        az = -az; aw = -aw;
+        angle = -angle;
+    }
+
+    if (angle + 1.0 > .05) {
+        if (1.0 - angle >= .05) {
+            th = acos (angle);
+            invth = 1.0 / sin (th);
+            scale = sin (th * (1.0 - t)) * invth;
+            invscale = sin (th * t) * invth;
+        } else {
+            scale = 1.0 - t;
+            invscale = t;
+        }
+    } else {
+        bx = -ay;
+        by = ax;
+        bz = -aw;
+        bw = az;
+        scale = sin(piDouble * (.5 - t));
+        invscale = sin (piDouble * t);
+    }
+
+    cx = ax * scale + bx * invscale;
+    cy = ay * scale + by * invscale;
+    cz = az * scale + bz * invscale;
+    cw = aw * scale + bw * invscale;
+
+    qa[0] = cx; qa[1] = cy; qa[2] = cz; qa[3] = cw;
+}
+
+// End of Supporting Math Functions
+
+TransformationMatrix& TransformationMatrix::scale(double s)
+{
+    return scaleNonUniform(s, s);
 }
 
 TransformationMatrix& TransformationMatrix::rotateFromVector(double x, double y)
@@ -113,93 +506,594 @@ TransformationMatrix& TransformationMatrix::rotateFromVector(double x, double y)
 
 TransformationMatrix& TransformationMatrix::flipX()
 {
-    return scale(-1.0f, 1.0f);
+    return scaleNonUniform(-1.0f, 1.0f);
 }
 
 TransformationMatrix& TransformationMatrix::flipY()
 {
-    return scale(1.0f, -1.0f);
+    return scaleNonUniform(1.0f, -1.0f);
+}
+
+FloatPoint TransformationMatrix::projectPoint(const FloatPoint& p) const
+{
+    // This is basically raytracing. We have a point in the destination
+    // plane with z=0, and we cast a ray parallel to the z-axis from that
+    // point to find the z-position at which it intersects the z=0 plane
+    // with the transform applied. Once we have that point we apply the
+    // inverse transform to find the corresponding point in the source
+    // space.
+    // 
+    // Given a plane with normal Pn, and a ray starting at point R0 and
+    // with direction defined by the vector Rd, we can find the
+    // intersection point as a distance d from R0 in units of Rd by:
+    // 
+    // d = -dot (Pn', R0) / dot (Pn', Rd)
+    
+    double x = p.x();
+    double y = p.y();
+    double z = -(m13() * x + m23() * y + m43()) / m33();
+
+    double outX = x * m11() + y * m21() + z * m31() + m41();
+    double outY = x * m12() + y * m22() + z * m32() + m42();
+
+    double w = x * m14() + y * m24() + z * m34() + m44();
+    if (w != 1 && w != 0) {
+        outX /= w;
+        outY /= w;
+    }
+
+    return FloatPoint(static_cast<float>(outX), static_cast<float>(outY));
+}
+
+FloatQuad TransformationMatrix::projectQuad(const FloatQuad& q) const
+{
+    FloatQuad projectedQuad;
+    projectedQuad.setP1(projectPoint(q.p1()));
+    projectedQuad.setP2(projectPoint(q.p2()));
+    projectedQuad.setP3(projectPoint(q.p3()));
+    projectedQuad.setP4(projectPoint(q.p4()));
+    return projectedQuad;
 }
 
-TransformationMatrix& TransformationMatrix::skew(double angleX, double angleY)
+FloatPoint TransformationMatrix::mapPoint(const FloatPoint& p) const
 {
-    return shear(tan(deg2rad(angleX)), tan(deg2rad(angleY)));
+    if (isIdentityOrTranslation())
+        return FloatPoint(p.x() + static_cast<float>(m_matrix[3][0]), p.y() + static_cast<float>(m_matrix[3][1]));
+
+    double x, y;
+    multVecMatrix(p.x(), p.y(), x, y);
+    return FloatPoint(static_cast<float>(x), static_cast<float>(y));
 }
 
-TransformationMatrix& TransformationMatrix::skewX(double angle)
+FloatPoint3D TransformationMatrix::mapPoint(const FloatPoint3D& p) const
 {
-    return shear(tan(deg2rad(angle)), 0.0f);
+    if (isIdentityOrTranslation())
+        return FloatPoint3D(p.x() + static_cast<float>(m_matrix[3][0]),
+                            p.y() + static_cast<float>(m_matrix[3][1]),
+                            p.z() + static_cast<float>(m_matrix[3][2]));
+
+    double x, y, z;
+    multVecMatrix(p.x(), p.y(), p.z(), x, y, z);
+    return FloatPoint3D(static_cast<float>(x), static_cast<float>(y), static_cast<float>(z));
 }
 
-TransformationMatrix& TransformationMatrix::skewY(double angle)
+IntRect TransformationMatrix::mapRect(const IntRect &rect) const
 {
-    return shear(0.0f, tan(deg2rad(angle)));
+    return enclosingIntRect(mapRect(FloatRect(rect)));
 }
 
-TransformationMatrix makeMapBetweenRects(const FloatRect& source, const FloatRect& dest)
+FloatRect TransformationMatrix::mapRect(const FloatRect& r) const
 {
-    TransformationMatrix transform;
-    transform.translate(dest.x() - source.x(), dest.y() - source.y());
-    transform.scale(dest.width() / source.width(), dest.height() / source.height());
-    return transform;
+    if (isIdentityOrTranslation()) {
+        FloatRect mappedRect(r);
+        mappedRect.move(static_cast<float>(m_matrix[3][0]), static_cast<float>(m_matrix[3][1]));
+        return mappedRect;
+    }
+
+    FloatQuad resultQuad = mapQuad(FloatQuad(r));
+    return resultQuad.boundingBox();
 }
 
-IntPoint TransformationMatrix::mapPoint(const IntPoint& point) const
+FloatQuad TransformationMatrix::mapQuad(const FloatQuad& q) const
 {
-    double x2, y2;
-    map(point.x(), point.y(), &x2, &y2);
+    if (isIdentityOrTranslation()) {
+        FloatQuad mappedQuad(q);
+        mappedQuad.move(static_cast<float>(m_matrix[3][0]), static_cast<float>(m_matrix[3][1]));
+        return mappedQuad;
+    }
 
-    // Round the point.
-    return IntPoint(lround(x2), lround(y2));
+    FloatQuad result;
+    result.setP1(mapPoint(q.p1()));
+    result.setP2(mapPoint(q.p2()));
+    result.setP3(mapPoint(q.p3()));
+    result.setP4(mapPoint(q.p4()));
+    return result;
 }
 
-FloatPoint TransformationMatrix::mapPoint(const FloatPoint& point) const
+TransformationMatrix& TransformationMatrix::scaleNonUniform(double sx, double sy)
 {
-    double x2, y2;
-    map(point.x(), point.y(), &x2, &y2);
+    TransformationMatrix mat;
+    mat.m_matrix[0][0] = sx;
+    mat.m_matrix[1][1] = sy;
 
-    return FloatPoint(static_cast<float>(x2), static_cast<float>(y2));
+    multLeft(mat);
+    return *this;
 }
 
-FloatQuad TransformationMatrix::mapQuad(const FloatQuad& quad) const
+TransformationMatrix& TransformationMatrix::scale3d(double sx, double sy, double sz)
 {
-    // FIXME: avoid 4 seperate library calls. Point mapping really needs
-    // to be platform-independent code.
-    return FloatQuad(mapPoint(quad.p1()),
-                     mapPoint(quad.p2()),
-                     mapPoint(quad.p3()),
-                     mapPoint(quad.p4()));
+    TransformationMatrix mat;
+    mat.m_matrix[0][0] = sx;
+    mat.m_matrix[1][1] = sy;
+    mat.m_matrix[2][2] = sz;
+
+    multLeft(mat);
+    return *this;
 }
 
-void TransformationMatrix::blend(const TransformationMatrix& from, double progress)
+TransformationMatrix& TransformationMatrix::rotate3d(double x, double y, double z, double angle)
+{
+    // angles are in degrees. Switch to radians
+    angle = deg2rad(angle);
+    
+    angle /= 2.0f;
+    double sinA = sin(angle);
+    double cosA = cos(angle);
+    double sinA2 = sinA * sinA;
+    
+    // normalize
+    double length = sqrt(x * x + y * y + z * z);
+    if (length == 0) {
+        // bad vector, just use something reasonable
+        x = 0;
+        y = 0;
+        z = 1;
+    } else if (length != 1) {
+        x /= length;
+        y /= length;
+        z /= length;
+    }
+    
+    TransformationMatrix mat;
+
+    // optimize case where axis is along major axis
+    if (x == 1.0f && y == 0.0f && z == 0.0f) {
+        mat.m_matrix[0][0] = 1.0f;
+        mat.m_matrix[0][1] = 0.0f;
+        mat.m_matrix[0][2] = 0.0f;
+        mat.m_matrix[1][0] = 0.0f;
+        mat.m_matrix[1][1] = 1.0f - 2.0f * sinA2;
+        mat.m_matrix[1][2] = 2.0f * sinA * cosA;
+        mat.m_matrix[2][0] = 0.0f;
+        mat.m_matrix[2][1] = -2.0f * sinA * cosA;
+        mat.m_matrix[2][2] = 1.0f - 2.0f * sinA2;
+        mat.m_matrix[0][3] = mat.m_matrix[1][3] = mat.m_matrix[2][3] = 0.0f;
+        mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
+        mat.m_matrix[3][3] = 1.0f;
+    } else if (x == 0.0f && y == 1.0f && z == 0.0f) {
+        mat.m_matrix[0][0] = 1.0f - 2.0f * sinA2;
+        mat.m_matrix[0][1] = 0.0f;
+        mat.m_matrix[0][2] = -2.0f * sinA * cosA;
+        mat.m_matrix[1][0] = 0.0f;
+        mat.m_matrix[1][1] = 1.0f;
+        mat.m_matrix[1][2] = 0.0f;
+        mat.m_matrix[2][0] = 2.0f * sinA * cosA;
+        mat.m_matrix[2][1] = 0.0f;
+        mat.m_matrix[2][2] = 1.0f - 2.0f * sinA2;
+        mat.m_matrix[0][3] = mat.m_matrix[1][3] = mat.m_matrix[2][3] = 0.0f;
+        mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
+        mat.m_matrix[3][3] = 1.0f;
+    } else if (x == 0.0f && y == 0.0f && z == 1.0f) {
+        mat.m_matrix[0][0] = 1.0f - 2.0f * sinA2;
+        mat.m_matrix[0][1] = 2.0f * sinA * cosA;
+        mat.m_matrix[0][2] = 0.0f;
+        mat.m_matrix[1][0] = -2.0f * sinA * cosA;
+        mat.m_matrix[1][1] = 1.0f - 2.0f * sinA2;
+        mat.m_matrix[1][2] = 0.0f;
+        mat.m_matrix[2][0] = 0.0f;
+        mat.m_matrix[2][1] = 0.0f;
+        mat.m_matrix[2][2] = 1.0f;
+        mat.m_matrix[0][3] = mat.m_matrix[1][3] = mat.m_matrix[2][3] = 0.0f;
+        mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
+        mat.m_matrix[3][3] = 1.0f;
+    } else {
+        double x2 = x*x;
+        double y2 = y*y;
+        double z2 = z*z;
+    
+        mat.m_matrix[0][0] = 1.0f - 2.0f * (y2 + z2) * sinA2;
+        mat.m_matrix[0][1] = 2.0f * (x * y * sinA2 + z * sinA * cosA);
+        mat.m_matrix[0][2] = 2.0f * (x * z * sinA2 - y * sinA * cosA);
+        mat.m_matrix[1][0] = 2.0f * (y * x * sinA2 - z * sinA * cosA);
+        mat.m_matrix[1][1] = 1.0f - 2.0f * (z2 + x2) * sinA2;
+        mat.m_matrix[1][2] = 2.0f * (y * z * sinA2 + x * sinA * cosA);
+        mat.m_matrix[2][0] = 2.0f * (z * x * sinA2 + y * sinA * cosA);
+        mat.m_matrix[2][1] = 2.0f * (z * y * sinA2 - x * sinA * cosA);
+        mat.m_matrix[2][2] = 1.0f - 2.0f * (x2 + y2) * sinA2;
+        mat.m_matrix[0][3] = mat.m_matrix[1][3] = mat.m_matrix[2][3] = 0.0f;
+        mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
+        mat.m_matrix[3][3] = 1.0f;
+    }
+    multLeft(mat);
+    return *this;
+}
+
+TransformationMatrix& TransformationMatrix::rotate3d(double rx, double ry, double rz)
+{
+    // angles are in degrees. Switch to radians
+    rx = deg2rad(rx);
+    ry = deg2rad(ry);
+    rz = deg2rad(rz);
+    
+    TransformationMatrix mat;
+    
+    rz /= 2.0f;
+    double sinA = sin(rz);
+    double cosA = cos(rz);
+    double sinA2 = sinA * sinA;
+    
+    mat.m_matrix[0][0] = 1.0f - 2.0f * sinA2;
+    mat.m_matrix[0][1] = 2.0f * sinA * cosA;
+    mat.m_matrix[0][2] = 0.0f;
+    mat.m_matrix[1][0] = -2.0f * sinA * cosA;
+    mat.m_matrix[1][1] = 1.0f - 2.0f * sinA2;
+    mat.m_matrix[1][2] = 0.0f;
+    mat.m_matrix[2][0] = 0.0f;
+    mat.m_matrix[2][1] = 0.0f;
+    mat.m_matrix[2][2] = 1.0f;
+    mat.m_matrix[0][3] = mat.m_matrix[1][3] = mat.m_matrix[2][3] = 0.0f;
+    mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
+    mat.m_matrix[3][3] = 1.0f;
+    
+    TransformationMatrix rmat(mat);
+    
+    ry /= 2.0f;
+    sinA = sin(ry);
+    cosA = cos(ry);
+    sinA2 = sinA * sinA;
+    
+    mat.m_matrix[0][0] = 1.0f - 2.0f * sinA2;
+    mat.m_matrix[0][1] = 0.0f;
+    mat.m_matrix[0][2] = -2.0f * sinA * cosA;
+    mat.m_matrix[1][0] = 0.0f;
+    mat.m_matrix[1][1] = 1.0f;
+    mat.m_matrix[1][2] = 0.0f;
+    mat.m_matrix[2][0] = 2.0f * sinA * cosA;
+    mat.m_matrix[2][1] = 0.0f;
+    mat.m_matrix[2][2] = 1.0f - 2.0f * sinA2;
+    mat.m_matrix[0][3] = mat.m_matrix[1][3] = mat.m_matrix[2][3] = 0.0f;
+    mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
+    mat.m_matrix[3][3] = 1.0f;
+    
+    rmat.multLeft(mat);
+
+    rx /= 2.0f;
+    sinA = sin(rx);
+    cosA = cos(rx);
+    sinA2 = sinA * sinA;
+    
+    mat.m_matrix[0][0] = 1.0f;
+    mat.m_matrix[0][1] = 0.0f;
+    mat.m_matrix[0][2] = 0.0f;
+    mat.m_matrix[1][0] = 0.0f;
+    mat.m_matrix[1][1] = 1.0f - 2.0f * sinA2;
+    mat.m_matrix[1][2] = 2.0f * sinA * cosA;
+    mat.m_matrix[2][0] = 0.0f;
+    mat.m_matrix[2][1] = -2.0f * sinA * cosA;
+    mat.m_matrix[2][2] = 1.0f - 2.0f * sinA2;
+    mat.m_matrix[0][3] = mat.m_matrix[1][3] = mat.m_matrix[2][3] = 0.0f;
+    mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
+    mat.m_matrix[3][3] = 1.0f;
+    
+    rmat.multLeft(mat);
+
+    multLeft(rmat);
+    return *this;
+}
+
+TransformationMatrix& TransformationMatrix::translate(double tx, double ty)
+{
+    m_matrix[3][0] += tx * m_matrix[0][0] + ty * m_matrix[1][0];
+    m_matrix[3][1] += tx * m_matrix[0][1] + ty * m_matrix[1][1];
+    m_matrix[3][2] += tx * m_matrix[0][2] + ty * m_matrix[1][2];
+    m_matrix[3][3] += tx * m_matrix[0][3] + ty * m_matrix[1][3];
+    return *this;
+}
+
+TransformationMatrix& TransformationMatrix::translate3d(double tx, double ty, double tz)
+{
+    m_matrix[3][0] += tx * m_matrix[0][0] + ty * m_matrix[1][0] + tz * m_matrix[2][0];
+    m_matrix[3][1] += tx * m_matrix[0][1] + ty * m_matrix[1][1] + tz * m_matrix[2][1];
+    m_matrix[3][2] += tx * m_matrix[0][2] + ty * m_matrix[1][2] + tz * m_matrix[2][2];
+    m_matrix[3][3] += tx * m_matrix[0][3] + ty * m_matrix[1][3] + tz * m_matrix[2][3];
+    return *this;
+}
+
+TransformationMatrix& TransformationMatrix::translateRight(double tx, double ty)
+{
+    if (tx != 0) {
+        m_matrix[0][0] +=  m_matrix[0][3] * tx;
+        m_matrix[1][0] +=  m_matrix[1][3] * tx;
+        m_matrix[2][0] +=  m_matrix[2][3] * tx;
+        m_matrix[3][0] +=  m_matrix[3][3] * tx;
+    }
+
+    if (ty != 0) {
+        m_matrix[0][1] +=  m_matrix[0][3] * ty;
+        m_matrix[1][1] +=  m_matrix[1][3] * ty;
+        m_matrix[2][1] +=  m_matrix[2][3] * ty;
+        m_matrix[3][1] +=  m_matrix[3][3] * ty;
+    }
+
+    return *this;
+}
+
+TransformationMatrix& TransformationMatrix::translateRight3d(double tx, double ty, double tz)
+{
+    translateRight(tx, ty);
+    if (tz != 0) {
+        m_matrix[0][2] +=  m_matrix[0][3] * tz;
+        m_matrix[1][2] +=  m_matrix[1][3] * tz;
+        m_matrix[2][2] +=  m_matrix[2][3] * tz;
+        m_matrix[3][2] +=  m_matrix[3][3] * tz;
+    }
+
+    return *this;
+}
+
+TransformationMatrix& TransformationMatrix::skew(double sx, double sy)
+{
+    // angles are in degrees. Switch to radians
+    sx = deg2rad(sx);
+    sy = deg2rad(sy);
+    
+    TransformationMatrix mat;
+    mat.m_matrix[0][1] = tan(sy); // note that the y shear goes in the first row
+    mat.m_matrix[1][0] = tan(sx); // and the x shear in the second row
+
+    multLeft(mat);
+    return *this;
+}
+
+TransformationMatrix& TransformationMatrix::applyPerspective(double p)
 {
-    double srA[9], srB[9];
+    TransformationMatrix mat;
+    if (p != 0)
+        mat.m_matrix[2][3] = -1/p;
 
-    affineTransformDecompose(from, srA);
-    affineTransformDecompose(*this, srB);
+    multLeft(mat);
+    return *this;
+}
+
+//
+// *this = mat * *this
+//
+TransformationMatrix& TransformationMatrix::multLeft(const TransformationMatrix& mat)
+{
+    Matrix4 tmp;
+    
+    tmp[0][0] = (mat.m_matrix[0][0] * m_matrix[0][0] + mat.m_matrix[0][1] * m_matrix[1][0]
+               + mat.m_matrix[0][2] * m_matrix[2][0] + mat.m_matrix[0][3] * m_matrix[3][0]);
+    tmp[0][1] = (mat.m_matrix[0][0] * m_matrix[0][1] + mat.m_matrix[0][1] * m_matrix[1][1]
+               + mat.m_matrix[0][2] * m_matrix[2][1] + mat.m_matrix[0][3] * m_matrix[3][1]);
+    tmp[0][2] = (mat.m_matrix[0][0] * m_matrix[0][2] + mat.m_matrix[0][1] * m_matrix[1][2]
+               + mat.m_matrix[0][2] * m_matrix[2][2] + mat.m_matrix[0][3] * m_matrix[3][2]);
+    tmp[0][3] = (mat.m_matrix[0][0] * m_matrix[0][3] + mat.m_matrix[0][1] * m_matrix[1][3]
+               + mat.m_matrix[0][2] * m_matrix[2][3] + mat.m_matrix[0][3] * m_matrix[3][3]);
 
-    // If x-axis of one is flipped, and y-axis of the other, convert to an unflipped rotation.
-    if ((srA[0] < 0.0 && srB[1] < 0.0) || (srA[1] < 0.0 &&  srB[0] < 0.0)) {
-        srA[0] = -srA[0];
-        srA[1] = -srA[1];
-        srA[2] += srA[2] < 0 ? piDouble : -piDouble;
+    tmp[1][0] = (mat.m_matrix[1][0] * m_matrix[0][0] + mat.m_matrix[1][1] * m_matrix[1][0]
+               + mat.m_matrix[1][2] * m_matrix[2][0] + mat.m_matrix[1][3] * m_matrix[3][0]);
+    tmp[1][1] = (mat.m_matrix[1][0] * m_matrix[0][1] + mat.m_matrix[1][1] * m_matrix[1][1]
+               + mat.m_matrix[1][2] * m_matrix[2][1] + mat.m_matrix[1][3] * m_matrix[3][1]);
+    tmp[1][2] = (mat.m_matrix[1][0] * m_matrix[0][2] + mat.m_matrix[1][1] * m_matrix[1][2]
+               + mat.m_matrix[1][2] * m_matrix[2][2] + mat.m_matrix[1][3] * m_matrix[3][2]);
+    tmp[1][3] = (mat.m_matrix[1][0] * m_matrix[0][3] + mat.m_matrix[1][1] * m_matrix[1][3]
+               + mat.m_matrix[1][2] * m_matrix[2][3] + mat.m_matrix[1][3] * m_matrix[3][3]);
+
+    tmp[2][0] = (mat.m_matrix[2][0] * m_matrix[0][0] + mat.m_matrix[2][1] * m_matrix[1][0]
+               + mat.m_matrix[2][2] * m_matrix[2][0] + mat.m_matrix[2][3] * m_matrix[3][0]);
+    tmp[2][1] = (mat.m_matrix[2][0] * m_matrix[0][1] + mat.m_matrix[2][1] * m_matrix[1][1]
+               + mat.m_matrix[2][2] * m_matrix[2][1] + mat.m_matrix[2][3] * m_matrix[3][1]);
+    tmp[2][2] = (mat.m_matrix[2][0] * m_matrix[0][2] + mat.m_matrix[2][1] * m_matrix[1][2]
+               + mat.m_matrix[2][2] * m_matrix[2][2] + mat.m_matrix[2][3] * m_matrix[3][2]);
+    tmp[2][3] = (mat.m_matrix[2][0] * m_matrix[0][3] + mat.m_matrix[2][1] * m_matrix[1][3]
+               + mat.m_matrix[2][2] * m_matrix[2][3] + mat.m_matrix[2][3] * m_matrix[3][3]);
+
+    tmp[3][0] = (mat.m_matrix[3][0] * m_matrix[0][0] + mat.m_matrix[3][1] * m_matrix[1][0]
+               + mat.m_matrix[3][2] * m_matrix[2][0] + mat.m_matrix[3][3] * m_matrix[3][0]);
+    tmp[3][1] = (mat.m_matrix[3][0] * m_matrix[0][1] + mat.m_matrix[3][1] * m_matrix[1][1]
+               + mat.m_matrix[3][2] * m_matrix[2][1] + mat.m_matrix[3][3] * m_matrix[3][1]);
+    tmp[3][2] = (mat.m_matrix[3][0] * m_matrix[0][2] + mat.m_matrix[3][1] * m_matrix[1][2]
+               + mat.m_matrix[3][2] * m_matrix[2][2] + mat.m_matrix[3][3] * m_matrix[3][2]);
+    tmp[3][3] = (mat.m_matrix[3][0] * m_matrix[0][3] + mat.m_matrix[3][1] * m_matrix[1][3]
+               + mat.m_matrix[3][2] * m_matrix[2][3] + mat.m_matrix[3][3] * m_matrix[3][3]);
+    
+    setMatrix(tmp);
+    return *this;
+}
+
+void TransformationMatrix::multVecMatrix(double x, double y, double& resultX, double& resultY) const
+{
+    resultX = m_matrix[3][0] + x * m_matrix[0][0] + y * m_matrix[1][0];
+    resultY = m_matrix[3][1] + x * m_matrix[0][1] + y * m_matrix[1][1];
+    double w = m_matrix[3][3] + x * m_matrix[0][3] + y * m_matrix[1][3];
+    if (w != 1 && w != 0) {
+        resultX /= w;
+        resultY /= w;
     }
+}
+
+void TransformationMatrix::multVecMatrix(double x, double y, double z, double& resultX, double& resultY, double& resultZ) const
+{
+    resultX = m_matrix[3][0] + x * m_matrix[0][0] + y * m_matrix[1][0] + z * m_matrix[2][0];
+    resultY = m_matrix[3][1] + x * m_matrix[0][1] + y * m_matrix[1][1] + z * m_matrix[2][1];
+    resultZ = m_matrix[3][2] + x * m_matrix[0][2] + y * m_matrix[1][2] + z * m_matrix[2][2];
+    double w = m_matrix[3][3] + x * m_matrix[0][3] + y * m_matrix[1][3] + z * m_matrix[2][3];
+    if (w != 1 && w != 0) {
+        resultX /= w;
+        resultY /= w;
+        resultZ /= w;
+    }
+}
+
+bool TransformationMatrix::isInvertible() const
+{
+    if (isIdentityOrTranslation())
+        return true;
+
+    double det = WebCore::determinant4x4(m_matrix);
+
+    if (fabs(det) < SMALL_NUMBER)
+        return false;
 
-    // Don't rotate the long way around.
-    srA[2] = fmod(srA[2], 2.0 * piDouble);
-    srB[2] = fmod(srB[2], 2.0 * piDouble);
+    return true;
+}
 
-    if (fabs(srA[2] - srB[2]) > piDouble) {
-        if (srA[2] > srB[2])
-            srA[2] -= piDouble * 2.0;
-        else
-            srB[2] -= piDouble * 2.0;
+TransformationMatrix TransformationMatrix::inverse() const 
+{
+    if (isIdentityOrTranslation()) {
+        // identity matrix
+        if (m_matrix[3][0] == 0 && m_matrix[3][1] == 0 && m_matrix[3][2] == 0)
+            return TransformationMatrix();
+        
+        // translation
+        return TransformationMatrix(1, 0, 0, 0,
+                                    0, 1, 0, 0,
+                                    0, 0, 1, 0,
+                                    -m_matrix[3][0], -m_matrix[3][1], -m_matrix[3][2], 1);
     }
+    
+    TransformationMatrix invMat;
+    bool inverted = WebCore::inverse(m_matrix, invMat.m_matrix);
+    if (!inverted)
+        return TransformationMatrix();
+    
+    return invMat;
+}
+
+void TransformationMatrix::makeAffine()
+{
+    m_matrix[0][2] = 0;
+    m_matrix[0][3] = 0;
+    
+    m_matrix[1][2] = 0;
+    m_matrix[1][3] = 0;
+    
+    m_matrix[2][0] = 0;
+    m_matrix[2][1] = 0;
+    m_matrix[2][2] = 1;
+    m_matrix[2][3] = 0;
+    
+    m_matrix[3][2] = 0;
+    m_matrix[3][3] = 1;
+}
 
-    for (int i = 0; i < 9; i++)
-        srA[i] = srA[i] + progress * (srB[i] - srA[i]);
+static inline void blendFloat(double& from, double to, double progress)
+{
+    if (from != to)
+        from = from + (to - from) * progress;
+}
+
+void TransformationMatrix::blend(const TransformationMatrix& from, double progress)
+{
+    if (from.isIdentity() && isIdentity())
+        return;
+        
+    // decompose
+    DecomposedType fromDecomp;
+    DecomposedType toDecomp;
+    from.decompose(fromDecomp);
+    decompose(toDecomp);
 
-    affineTransformCompose(*this, srA);
+    // interpolate
+    blendFloat(fromDecomp.scaleX, toDecomp.scaleX, progress);
+    blendFloat(fromDecomp.scaleY, toDecomp.scaleY, progress);
+    blendFloat(fromDecomp.scaleZ, toDecomp.scaleZ, progress);
+    blendFloat(fromDecomp.skewXY, toDecomp.skewXY, progress);
+    blendFloat(fromDecomp.skewXZ, toDecomp.skewXZ, progress);
+    blendFloat(fromDecomp.skewYZ, toDecomp.skewYZ, progress);
+    blendFloat(fromDecomp.translateX, toDecomp.translateX, progress);
+    blendFloat(fromDecomp.translateY, toDecomp.translateY, progress);
+    blendFloat(fromDecomp.translateZ, toDecomp.translateZ, progress);
+    blendFloat(fromDecomp.perspectiveX, toDecomp.perspectiveX, progress);
+    blendFloat(fromDecomp.perspectiveY, toDecomp.perspectiveY, progress);
+    blendFloat(fromDecomp.perspectiveZ, toDecomp.perspectiveZ, progress);
+    blendFloat(fromDecomp.perspectiveW, toDecomp.perspectiveW, progress);
+    
+    slerp(&fromDecomp.quaternionX, &toDecomp.quaternionX, progress);
+        
+    // recompose
+    recompose(fromDecomp);
+}
+
+bool TransformationMatrix::decompose(DecomposedType& decomp) const
+{
+    if (isIdentity()) {
+        memset(&decomp, 0, sizeof(decomp));
+        decomp.perspectiveW = 1;
+        decomp.scaleX = 1;
+        decomp.scaleY = 1;
+        decomp.scaleZ = 1;
+    }
+    
+    if (!WebCore::decompose(m_matrix, decomp))
+        return false;
+    return true;
+}
+
+void TransformationMatrix::recompose(const DecomposedType& decomp)
+{
+    makeIdentity();
+    
+    // first apply perspective
+    m_matrix[0][3] = (float) decomp.perspectiveX;
+    m_matrix[1][3] = (float) decomp.perspectiveY;
+    m_matrix[2][3] = (float) decomp.perspectiveZ;
+    m_matrix[3][3] = (float) decomp.perspectiveW;
+    
+    // now translate
+    translate3d((float) decomp.translateX, (float) decomp.translateY, (float) decomp.translateZ);
+    
+    // apply rotation
+    double xx = decomp.quaternionX * decomp.quaternionX;
+    double xy = decomp.quaternionX * decomp.quaternionY;
+    double xz = decomp.quaternionX * decomp.quaternionZ;
+    double xw = decomp.quaternionX * decomp.quaternionW;
+    double yy = decomp.quaternionY * decomp.quaternionY;
+    double yz = decomp.quaternionY * decomp.quaternionZ;
+    double yw = decomp.quaternionY * decomp.quaternionW;
+    double zz = decomp.quaternionZ * decomp.quaternionZ;
+    double zw = decomp.quaternionZ * decomp.quaternionW;
+    
+    // Construct a composite rotation matrix from the quaternion values
+    TransformationMatrix rotationMatrix(1 - 2 * (yy + zz), 2 * (xy - zw), 2 * (xz + yw), 0, 
+                           2 * (xy + zw), 1 - 2 * (xx + zz), 2 * (yz - xw), 0,
+                           2 * (xz - yw), 2 * (yz + xw), 1 - 2 * (xx + yy), 0,
+                           0, 0, 0, 1);
+    
+    multLeft(rotationMatrix);
+    
+    // now apply skew
+    if (decomp.skewYZ) {
+        TransformationMatrix tmp;
+        tmp.setM32((float) decomp.skewYZ);
+        multLeft(tmp);
+    }
+    
+    if (decomp.skewXZ) {
+        TransformationMatrix tmp;
+        tmp.setM31((float) decomp.skewXZ);
+        multLeft(tmp);
+    }
+    
+    if (decomp.skewXY) {
+        TransformationMatrix tmp;
+        tmp.setM21((float) decomp.skewXY);
+        multLeft(tmp);
+    }
+    
+    // finally, apply scale
+    scale3d((float) decomp.scaleX, (float) decomp.scaleY, (float) decomp.scaleZ);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
index e09bf8538e..12d69e2922 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -26,114 +26,306 @@
 #ifndef TransformationMatrix_h
 #define TransformationMatrix_h
 
+#include "FloatPoint.h"
+#include "IntPoint.h"
+#include <string.h> //for memcpy
+
 #if PLATFORM(CG)
 #include <CoreGraphics/CGAffineTransform.h>
-typedef CGAffineTransform PlatformTransformationMatrix;
-#elif PLATFORM(QT)
-#include <QMatrix>
-typedef QMatrix PlatformTransformationMatrix;
 #elif PLATFORM(CAIRO)
 #include <cairo.h>
-typedef cairo_matrix_t PlatformTransformationMatrix;
+#elif PLATFORM(QT)
+#include <QTransform>
 #elif PLATFORM(SKIA)
-#include "SkMatrix.h"
-typedef SkMatrix PlatformTransformationMatrix;
+#include <SkMatrix.h>
 #elif PLATFORM(WX) && USE(WXGC)
-#include <wx/defs.h>
 #include <wx/graphics.h>
-typedef wxGraphicsMatrix PlatformTransformationMatrix;
 #endif
 
 namespace WebCore {
 
-class IntPoint;
 class IntRect;
-class FloatPoint;
+class FloatPoint3D;
 class FloatRect;
 class FloatQuad;
 
 class TransformationMatrix {
 public:
-    TransformationMatrix();
-    TransformationMatrix(double a, double b, double c, double d, double e, double f);
-#if !PLATFORM(WX) || USE(WXGC)
-    TransformationMatrix(const PlatformTransformationMatrix&);
-#endif
+    typedef double Matrix4[4][4];
+
+    TransformationMatrix() { makeIdentity(); }
+    TransformationMatrix(const TransformationMatrix& t) { *this = t; }
+    TransformationMatrix(double a, double b, double c, double d, double e, double f) { setMatrix(a, b, c, d, e, f); }
+    TransformationMatrix(double m11, double m12, double m13, double m14,
+                         double m21, double m22, double m23, double m24,
+                         double m31, double m32, double m33, double m34,
+                         double m41, double m42, double m43, double m44)
+    {
+        setMatrix(m11, m12, m13, m14, m21, m22, m23, m24, m31, m32, m33, m34, m41, m42, m43, m44);
+    }
+
+    void setMatrix(double a, double b, double c, double d, double e, double f)
+    {
+        m_matrix[0][0] = a; m_matrix[0][1] = b; m_matrix[0][2] = 0; m_matrix[0][3] = 0; 
+        m_matrix[1][0] = c; m_matrix[1][1] = d; m_matrix[1][2] = 0; m_matrix[1][3] = 0; 
+        m_matrix[2][0] = 0; m_matrix[2][1] = 0; m_matrix[2][2] = 1; m_matrix[2][3] = 0; 
+        m_matrix[3][0] = e; m_matrix[3][1] = f; m_matrix[3][2] = 0; m_matrix[3][3] = 1;
+    }
+    
+    void setMatrix(double m11, double m12, double m13, double m14,
+                   double m21, double m22, double m23, double m24,
+                   double m31, double m32, double m33, double m34,
+                   double m41, double m42, double m43, double m44)
+    {
+        m_matrix[0][0] = m11; m_matrix[0][1] = m12; m_matrix[0][2] = m13; m_matrix[0][3] = m14; 
+        m_matrix[1][0] = m21; m_matrix[1][1] = m22; m_matrix[1][2] = m23; m_matrix[1][3] = m24; 
+        m_matrix[2][0] = m31; m_matrix[2][1] = m32; m_matrix[2][2] = m33; m_matrix[2][3] = m34; 
+        m_matrix[3][0] = m41; m_matrix[3][1] = m42; m_matrix[3][2] = m43; m_matrix[3][3] = m44;
+    }
+    
+    TransformationMatrix& operator =(const TransformationMatrix &t)
+    {
+        setMatrix(t.m_matrix);
+        return *this;
+    }
+
+    TransformationMatrix& makeIdentity()
+    {
+        setMatrix(1, 0, 0, 0,  0, 1, 0, 0,  0, 0, 1, 0,  0, 0, 0, 1);
+        return *this;
+    }
 
-    void setMatrix(double a, double b, double c, double d, double e, double f);
-    void map(double x, double y, double *x2, double *y2) const;
+    bool isIdentity() const
+    {
+        return m_matrix[0][0] == 1 && m_matrix[0][1] == 0 && m_matrix[0][2] == 0 && m_matrix[0][3] == 0 &&
+               m_matrix[1][0] == 0 && m_matrix[1][1] == 1 && m_matrix[1][2] == 0 && m_matrix[1][3] == 0 &&
+               m_matrix[2][0] == 0 && m_matrix[2][1] == 0 && m_matrix[2][2] == 1 && m_matrix[2][3] == 0 &&
+               m_matrix[3][0] == 0 && m_matrix[3][1] == 0 && m_matrix[3][2] == 0 && m_matrix[3][3] == 1;
+    }
 
-    // Rounds the mapped point to the nearest integer value.
-    IntPoint mapPoint(const IntPoint&) const;
+    // This form preserves the double math from input to output
+    void map(double x, double y, double& x2, double& y2) const { multVecMatrix(x, y, x2, y2); }
 
+    // Map a 3D point through the transform, returning a 3D point.
+    FloatPoint3D mapPoint(const FloatPoint3D&) const;
+
+    // Map a 2D point through the transform, returning a 2D point.
+    // Note that this ignores the z component, effectively projecting the point into the z=0 plane.
     FloatPoint mapPoint(const FloatPoint&) const;
 
+    // Like the version above, except that it rounds the mapped point to the nearest integer value.
+    IntPoint mapPoint(const IntPoint& p) const
+    {
+        return roundedIntPoint(mapPoint(FloatPoint(p)));
+    }
+
+    // If the matrix has 3D components, the z component of the result is
+    // dropped, effectively projecting the rect into the z=0 plane
+    FloatRect mapRect(const FloatRect&) const;
+
     // Rounds the resulting mapped rectangle out. This is helpful for bounding
     // box computations but may not be what is wanted in other contexts.
     IntRect mapRect(const IntRect&) const;
 
-    FloatRect mapRect(const FloatRect&) const;
-
+    // If the matrix has 3D components, the z component of the result is
+    // dropped, effectively projecting the quad into the z=0 plane
     FloatQuad mapQuad(const FloatQuad&) const;
 
-    bool isIdentity() const;
+    // Map a point on the z=0 plane into a point on
+    // the plane with with the transform applied, by extending
+    // a ray perpendicular to the source plane and computing
+    // the local x,y position of the point where that ray intersects
+    // with the destination plane.
+    FloatPoint projectPoint(const FloatPoint&) const;
+    // Projects the four corners of the quad
+    FloatQuad projectQuad(const FloatQuad&) const;
 
-    double a() const;
-    void setA(double a);
+    double m11() const { return m_matrix[0][0]; }
+    void setM11(double f) { m_matrix[0][0] = f; }
+    double m12() const { return m_matrix[0][1]; }
+    void setM12(double f) { m_matrix[0][1] = f; }
+    double m13() const { return m_matrix[0][2]; }
+    void setM13(double f) { m_matrix[0][2] = f; }
+    double m14() const { return m_matrix[0][3]; }
+    void setM14(double f) { m_matrix[0][3] = f; }
+    double m21() const { return m_matrix[1][0]; }
+    void setM21(double f) { m_matrix[1][0] = f; }
+    double m22() const { return m_matrix[1][1]; }
+    void setM22(double f) { m_matrix[1][1] = f; }
+    double m23() const { return m_matrix[1][2]; }
+    void setM23(double f) { m_matrix[1][2] = f; }
+    double m24() const { return m_matrix[1][3]; }
+    void setM24(double f) { m_matrix[1][3] = f; }
+    double m31() const { return m_matrix[2][0]; }
+    void setM31(double f) { m_matrix[2][0] = f; }
+    double m32() const { return m_matrix[2][1]; }
+    void setM32(double f) { m_matrix[2][1] = f; }
+    double m33() const { return m_matrix[2][2]; }
+    void setM33(double f) { m_matrix[2][2] = f; }
+    double m34() const { return m_matrix[2][3]; }
+    void setM34(double f) { m_matrix[2][3] = f; }
+    double m41() const { return m_matrix[3][0]; }
+    void setM41(double f) { m_matrix[3][0] = f; }
+    double m42() const { return m_matrix[3][1]; }
+    void setM42(double f) { m_matrix[3][1] = f; }
+    double m43() const { return m_matrix[3][2]; }
+    void setM43(double f) { m_matrix[3][2] = f; }
+    double m44() const { return m_matrix[3][3]; }
+    void setM44(double f) { m_matrix[3][3] = f; }
+    
+    double a() const { return m_matrix[0][0]; }
+    void setA(double a) { m_matrix[0][0] = a; }
 
-    double b() const;
-    void setB(double b);
+    double b() const { return m_matrix[0][1]; }
+    void setB(double b) { m_matrix[0][1] = b; }
 
-    double c() const;
-    void setC(double c);
+    double c() const { return m_matrix[1][0]; }
+    void setC(double c) { m_matrix[1][0] = c; }
 
-    double d() const;
-    void setD(double d);
+    double d() const { return m_matrix[1][1]; }
+    void setD(double d) { m_matrix[1][1] = d; }
 
-    double e() const;
-    void setE(double e);
+    double e() const { return m_matrix[3][0]; }
+    void setE(double e) { m_matrix[3][0] = e; }
 
-    double f() const;
-    void setF(double f);
+    double f() const { return m_matrix[3][1]; }
+    void setF(double f) { m_matrix[3][1] = f; }
 
-    void reset();
+    // this = this * mat
+    TransformationMatrix& multiply(const TransformationMatrix& t) { return *this *= t; }
 
-    TransformationMatrix& multiply(const TransformationMatrix&);
+    // this = mat * this
+    TransformationMatrix& multLeft(const TransformationMatrix& mat);
+    
     TransformationMatrix& scale(double);
-    TransformationMatrix& scale(double sx, double sy);
     TransformationMatrix& scaleNonUniform(double sx, double sy);
-    TransformationMatrix& rotate(double d);
+    TransformationMatrix& scale3d(double sx, double sy, double sz);
+    
+    TransformationMatrix& rotate(double d) { return rotate3d(0, 0, d); }
     TransformationMatrix& rotateFromVector(double x, double y);
+    TransformationMatrix& rotate3d(double rx, double ry, double rz);
+    
+    // The vector (x,y,z) is normalized if it's not already. A vector of
+    // (0,0,0) uses a vector of (0,0,1).
+    TransformationMatrix& rotate3d(double x, double y, double z, double angle);
+    
     TransformationMatrix& translate(double tx, double ty);
-    TransformationMatrix& shear(double sx, double sy);
+    TransformationMatrix& translate3d(double tx, double ty, double tz);
+
+    // translation added with a post-multiply
+    TransformationMatrix& translateRight(double tx, double ty);
+    TransformationMatrix& translateRight3d(double tx, double ty, double tz);
+    
     TransformationMatrix& flipX();
     TransformationMatrix& flipY();
     TransformationMatrix& skew(double angleX, double angleY);
-    TransformationMatrix& skewX(double angle);
-    TransformationMatrix& skewY(double angle);
+    TransformationMatrix& skewX(double angle) { return skew(angle, 0); }
+    TransformationMatrix& skewY(double angle) { return skew(0, angle); }
+
+    TransformationMatrix& applyPerspective(double p);
+    bool hasPerspective() const { return m_matrix[2][3] != 0.0f; }
 
-    double det() const;
     bool isInvertible() const;
+
+    // This method returns the identity matrix if it is not invertible.
+    // Use isInvertible() before calling this if you need to know.
     TransformationMatrix inverse() const;
 
+    // decompose the matrix into its component parts
+    typedef struct {
+        double scaleX, scaleY, scaleZ;
+        double skewXY, skewXZ, skewYZ;
+        double quaternionX, quaternionY, quaternionZ, quaternionW;
+        double translateX, translateY, translateZ;
+        double perspectiveX, perspectiveY, perspectiveZ, perspectiveW;
+    } DecomposedType;
+    
+    bool decompose(DecomposedType& decomp) const;
+    void recompose(const DecomposedType& decomp);
+    
     void blend(const TransformationMatrix& from, double progress);
 
-#if !PLATFORM(WX) || USE(WXGC)
-    operator PlatformTransformationMatrix() const;
-#endif
+    bool isAffine() const
+    {
+        return (m13() == 0 && m14() == 0 && m23() == 0 && m24() == 0 && 
+                m31() == 0 && m32() == 0 && m33() == 1 && m34() == 0 && m43() == 0 && m44() == 1);
+    }
+
+    // Throw away the non-affine parts of the matrix (lossy!)
+    void makeAffine();
+
+    bool operator==(const TransformationMatrix& m2) const
+    {
+        return (m_matrix[0][0] == m2.m_matrix[0][0] &&
+                m_matrix[0][1] == m2.m_matrix[0][1] &&
+                m_matrix[0][2] == m2.m_matrix[0][2] &&
+                m_matrix[0][3] == m2.m_matrix[0][3] &&
+                m_matrix[1][0] == m2.m_matrix[1][0] &&
+                m_matrix[1][1] == m2.m_matrix[1][1] &&
+                m_matrix[1][2] == m2.m_matrix[1][2] &&
+                m_matrix[1][3] == m2.m_matrix[1][3] &&
+                m_matrix[2][0] == m2.m_matrix[2][0] &&
+                m_matrix[2][1] == m2.m_matrix[2][1] &&
+                m_matrix[2][2] == m2.m_matrix[2][2] &&
+                m_matrix[2][3] == m2.m_matrix[2][3] &&
+                m_matrix[3][0] == m2.m_matrix[3][0] &&
+                m_matrix[3][1] == m2.m_matrix[3][1] &&
+                m_matrix[3][2] == m2.m_matrix[3][2] &&
+                m_matrix[3][3] == m2.m_matrix[3][3]);
+    }
 
-    bool operator==(const TransformationMatrix&) const;
     bool operator!=(const TransformationMatrix& other) const { return !(*this == other); }
-    TransformationMatrix& operator*=(const TransformationMatrix&);
-    TransformationMatrix operator*(const TransformationMatrix&);
+    
+    // *this = *this * t (i.e., a multRight)
+    TransformationMatrix& operator*=(const TransformationMatrix& t)
+    {
+        *this = *this * t;
+        return *this;
+    }
+    
+    // result = *this * t (i.e., a multRight)
+    TransformationMatrix operator*(const TransformationMatrix& t)
+    {
+        TransformationMatrix result = t;
+        result.multLeft(*this);
+        return result;
+    }
 
-private:
-#if !PLATFORM(WX) || USE(WXGC)
-    PlatformTransformationMatrix m_transform;
+#if PLATFORM(CG)
+    operator CGAffineTransform() const;
+#elif PLATFORM(CAIRO)
+    operator cairo_matrix_t() const;
+#elif PLATFORM(QT)
+    operator QTransform() const;
+#elif PLATFORM(SKIA)
+    operator SkMatrix() const;
+#elif PLATFORM(WX) && USE(WXGC)
+    operator wxGraphicsMatrix() const;
 #endif
-};
 
-TransformationMatrix makeMapBetweenRects(const FloatRect& source, const FloatRect& dest);
+private:
+    // multiply passed 2D point by matrix (assume z=0)
+    void multVecMatrix(double x, double y, double& dstX, double& dstY) const;
+    
+    // multiply passed 3D point by matrix
+    void multVecMatrix(double x, double y, double z, double& dstX, double& dstY, double& dstZ) const;
+    
+    void setMatrix(const Matrix4 m)
+    {
+        if (m && m != m_matrix)
+            memcpy(m_matrix, m, sizeof(Matrix4));
+    }
+    
+    bool isIdentityOrTranslation() const
+    {
+        return m_matrix[0][0] == 1 && m_matrix[0][1] == 0 && m_matrix[0][2] == 0 && m_matrix[0][3] == 0 &&
+               m_matrix[1][0] == 0 && m_matrix[1][1] == 1 && m_matrix[1][2] == 0 && m_matrix[1][3] == 0 &&
+               m_matrix[2][0] == 0 && m_matrix[2][1] == 0 && m_matrix[2][2] == 1 && m_matrix[2][3] == 0 &&
+               m_matrix[3][3] == 1;
+    }
+    
+    Matrix4 m_matrix;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
index 47471c4937..a8ad131ffd 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
@@ -30,12 +30,15 @@ PassRefPtr<TransformOperation> TranslateTransformOperation::blend(const Transfor
         return this;
     
     if (blendToIdentity)
-        return TranslateTransformOperation::create(Length(m_x.type()).blend(m_x, progress), Length(m_y.type()).blend(m_y, progress), m_type);
+        return TranslateTransformOperation::create(Length(m_x.type()).blend(m_x, progress), 
+                                                   Length(m_y.type()).blend(m_y, progress), 
+                                                   Length(m_z.type()).blend(m_z, progress), m_type);
 
     const TranslateTransformOperation* fromOp = static_cast<const TranslateTransformOperation*>(from);
     Length fromX = fromOp ? fromOp->m_x : Length(m_x.type());
     Length fromY = fromOp ? fromOp->m_y : Length(m_y.type());
-    return TranslateTransformOperation::create(m_x.blend(fromX, progress), m_y.blend(fromY, progress), m_type);
+    Length fromZ = fromOp ? fromOp->m_z : Length(m_z.type());
+    return TranslateTransformOperation::create(m_x.blend(fromX, progress), m_y.blend(fromY, progress), m_z.blend(fromZ, progress), m_type);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.h
index 61ccbcccbd..a66cc3d2f2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TranslateTransformOperation.h
@@ -34,10 +34,21 @@ class TranslateTransformOperation : public TransformOperation {
 public:
     static PassRefPtr<TranslateTransformOperation> create(const Length& tx, const Length& ty, OperationType type)
     {
-        return adoptRef(new TranslateTransformOperation(tx, ty, type));
+        return adoptRef(new TranslateTransformOperation(tx, ty, Length(0, Fixed), type));
     }
 
-    virtual bool isIdentity() const { return m_x.calcFloatValue(1) == 0 && m_y.calcFloatValue(1) == 0; }
+    static PassRefPtr<TranslateTransformOperation> create(const Length& tx, const Length& ty, const Length& tz, OperationType type)
+    {
+        return adoptRef(new TranslateTransformOperation(tx, ty, tz, type));
+    }
+
+    double x(const IntSize& borderBoxSize) const { return m_x.calcFloatValue(borderBoxSize.width()); }
+    double y(const IntSize& borderBoxSize) const { return m_y.calcFloatValue(borderBoxSize.height()); }
+    double z(const IntSize&) const { return m_z.calcFloatValue(1); }
+
+private:
+    virtual bool isIdentity() const { return m_x.calcFloatValue(1) == 0 && m_y.calcFloatValue(1) == 0 && m_z.calcFloatValue(1) == 0; }
+
     virtual OperationType getOperationType() const { return m_type; }
     virtual bool isSameType(const TransformOperation& o) const { return o.getOperationType() == m_type; }
 
@@ -46,27 +57,29 @@ public:
         if (!isSameType(o))
             return false;
         const TranslateTransformOperation* t = static_cast<const TranslateTransformOperation*>(&o);
-        return m_x == t->m_x && m_y == t->m_y;
+        return m_x == t->m_x && m_y == t->m_y && m_z == t->m_z;
     }
 
     virtual bool apply(TransformationMatrix& transform, const IntSize& borderBoxSize) const
     {
-        transform.translate(m_x.calcFloatValue(borderBoxSize.width()), m_y.calcFloatValue(borderBoxSize.height()));
+        transform.translate3d(x(borderBoxSize), y(borderBoxSize), z(borderBoxSize));
         return m_x.type() == Percent || m_y.type() == Percent;
     }
 
     virtual PassRefPtr<TransformOperation> blend(const TransformOperation* from, double progress, bool blendToIdentity = false);
 
-private:
-    TranslateTransformOperation(const Length& tx, const Length& ty, OperationType type)
+    TranslateTransformOperation(const Length& tx, const Length& ty, const Length& tz, OperationType type)
         : m_x(tx)
         , m_y(ty)
+        , m_z(tz)
         , m_type(type)
     {
+        ASSERT(type == TRANSLATE_X || type == TRANSLATE_Y || type == TRANSLATE_Z || type == TRANSLATE || type == TRANSLATE_3D);
     }
 
     Length m_x;
     Length m_y;
+    Length m_z;
     OperationType m_type;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
index e21ddcf832..ca27b378a0 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef IMAGE_DECODER_H_
-#define IMAGE_DECODER_H_
+#ifndef ImageDecoder_h
+#define ImageDecoder_h
 
 #include "IntRect.h"
 #include "ImageSource.h"
@@ -34,137 +34,145 @@
 
 namespace WebCore {
 
-typedef Vector<unsigned> RGBA32Array;
-
-// The RGBA32Buffer object represents the decoded image data in RGBA32 format.  This buffer is what all
-// decoders write a single frame into.  Frames are then instantiated for drawing by being handed this buffer.
-class RGBA32Buffer
-{
-public:
-    enum FrameStatus { FrameEmpty, FramePartial, FrameComplete };
-    enum FrameDisposalMethod {
-        // If you change the numeric values of these, make sure you audit all
-        // users, as some users may cast raw values to/from these constants.
-        DisposeNotSpecified = 0,       // Leave frame in framebuffer
-        DisposeKeep = 1,               // Leave frame in framebuffer
-        DisposeOverwriteBgcolor = 2,   // Clear frame to transparent
-        DisposeOverwritePrevious = 3,  // Clear frame to previous framebuffer contents
-    };
+    typedef Vector<unsigned> RGBA32Array;
+
+    // The RGBA32Buffer object represents the decoded image data in RGBA32 format.  This buffer is what all
+    // decoders write a single frame into.  Frames are then instantiated for drawing by being handed this buffer.
+    class RGBA32Buffer {
+    public:
+        enum FrameStatus { FrameEmpty, FramePartial, FrameComplete };
+
+        enum FrameDisposalMethod {
+            // If you change the numeric values of these, make sure you audit all
+            // users, as some users may cast raw values to/from these constants.
+            DisposeNotSpecified,       // Leave frame in framebuffer
+            DisposeKeep,               // Leave frame in framebuffer
+            DisposeOverwriteBgcolor,   // Clear frame to transparent
+            DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
+        };
+
+        RGBA32Buffer()
+            : m_height(0)
+            , m_status(FrameEmpty)
+            , m_duration(0)
+            , m_disposalMethod(DisposeNotSpecified)
+            , m_hasAlpha(false)
+        {
+        } 
+
+        void clear() {
+          m_bytes.clear();
+          m_status = FrameEmpty;
+          // NOTE: Do not reset other members here; clearFrameBufferCache() calls
+          // this to free the bitmap data, but other functions like
+          // initFrameBuffer() and frameComplete() may still need to read other
+          // metadata out of this frame later.
+        }
 
-    RGBA32Buffer() : m_height(0), m_status(FrameEmpty), m_duration(0),
-                     m_disposalMethod(DisposeNotSpecified), m_hasAlpha(false)
-    {} 
-
-    void clear() {
-      m_bytes.clear();
-      m_rect = IntRect();
-      m_height = 0;
-      m_status = FrameEmpty;
-      m_duration = 0;
-      m_disposalMethod = DisposeNotSpecified;
-      m_hasAlpha = false;
-    }
-
-    const RGBA32Array& bytes() const { return m_bytes; }
-    RGBA32Array& bytes() { return m_bytes; }
-    const IntRect& rect() const { return m_rect; }
-    unsigned height() const { return m_height; }
-    FrameStatus status() const { return m_status; }
-    unsigned duration() const { return m_duration; }
-    FrameDisposalMethod disposalMethod() const { return m_disposalMethod; }
-    bool hasAlpha() const { return m_hasAlpha; }
-
-    void setRect(const IntRect& r) { m_rect = r; }
-    void ensureHeight(unsigned rowIndex) { if (rowIndex > m_height) m_height = rowIndex; }
-    void setStatus(FrameStatus s) { m_status = s; }
-    void setDuration(unsigned duration) { m_duration = duration; }
-    void setDisposalMethod(FrameDisposalMethod method) { m_disposalMethod = method; }
-    void setHasAlpha(bool alpha) { m_hasAlpha = alpha; }
-
-    static void setRGBA(unsigned& pos, unsigned r, unsigned g, unsigned b, unsigned a)
-    {
-        // We store this data pre-multiplied.
-        if (a == 0)
-            pos = 0;
-        else {
-            if (a < 255) {
-                float alphaPercent = a / 255.0f;
-                r = static_cast<unsigned>(r * alphaPercent);
-                g = static_cast<unsigned>(g * alphaPercent);
-                b = static_cast<unsigned>(b * alphaPercent);
+        const RGBA32Array& bytes() const { return m_bytes; }
+        RGBA32Array& bytes() { return m_bytes; }
+        const IntRect& rect() const { return m_rect; }
+        unsigned height() const { return m_height; }
+        FrameStatus status() const { return m_status; }
+        unsigned duration() const { return m_duration; }
+        FrameDisposalMethod disposalMethod() const { return m_disposalMethod; }
+        bool hasAlpha() const { return m_hasAlpha; }
+
+        void setRect(const IntRect& r) { m_rect = r; }
+        void ensureHeight(unsigned rowIndex) { if (rowIndex > m_height) m_height = rowIndex; }
+        void setStatus(FrameStatus s) { m_status = s; }
+        void setDuration(unsigned duration) { m_duration = duration; }
+        void setDisposalMethod(FrameDisposalMethod method) { m_disposalMethod = method; }
+        void setHasAlpha(bool alpha) { m_hasAlpha = alpha; }
+
+        static void setRGBA(unsigned& pos, unsigned r, unsigned g, unsigned b, unsigned a)
+        {
+            // We store this data pre-multiplied.
+            if (a == 0)
+                pos = 0;
+            else {
+                if (a < 255) {
+                    float alphaPercent = a / 255.0f;
+                    r = static_cast<unsigned>(r * alphaPercent);
+                    g = static_cast<unsigned>(g * alphaPercent);
+                    b = static_cast<unsigned>(b * alphaPercent);
+                }
+                pos = (a << 24 | r << 16 | g << 8 | b);
             }
-            pos = (a << 24 | r << 16 | g << 8 | b);
         }
-    }
-
-private:
-    RGBA32Array m_bytes;
-    IntRect m_rect;    // The rect of the original specified frame within the overall buffer.
-                       // This will always just be the entire buffer except for GIF frames
-                       // whose original rect was smaller than the overall image size.
-    unsigned m_height; // The height (the number of rows we've fully decoded).
-    FrameStatus m_status; // Whether or not this frame is completely finished decoding.
-    unsigned m_duration; // The animation delay.
-    FrameDisposalMethod m_disposalMethod; // What to do with this frame's data when initializing the next frame.
-    bool m_hasAlpha; // Whether or not any of the pixels in the buffer have transparency.
-};
-
-// The ImageDecoder class represents a base class for specific image format decoders
-// (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode into RGBA32 format
-// and the base class manages the RGBA32 frame cache.
-class ImageDecoder
-{
-public:
-    ImageDecoder() :m_sizeAvailable(false), m_failed(false) {}
-    virtual ~ImageDecoder() {}
-
-    // The the filename extension usually associated with an undecoded image of this type.
-    virtual String filenameExtension() const = 0;
-
-    // All specific decoder plugins must do something with the data they are given.
-    virtual void setData(SharedBuffer* data, bool allDataReceived) { m_data = data; }
-
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const = 0;
-
-    // Requests the size.
-    virtual IntSize size() const { return m_size; }
-
-    // The total number of frames for the image.  Classes that support multiple frames
-    // will scan the image data for the answer if they need to (without necessarily
-    // decoding all of the individual frames).
-    virtual int frameCount() { return 1; }
-
-    // The number of repetitions to perform for an animation loop.
-    virtual int repetitionCount() const { return cAnimationNone; }
-
-    // Called to obtain the RGBA32Buffer full of decoded data for rendering.  The
-    // decoder plugin will decode as much of the frame as it can before handing
-    // back the buffer.
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index) = 0;
-
-    // Whether or not the underlying image format even supports alpha transparency.
-    virtual bool supportsAlpha() const { return true; }
-
-    bool failed() const { return m_failed; }
-    void setFailed() { m_failed = true; }
-
-    // Wipe out frames in the frame buffer cache before |clearBeforeFrame|,
-    // assuming this can be done without breaking decoding.  Different decoders
-    // place different restrictions on what frames are safe to destroy, so this
-    // is left to them to implement.
-    // For convenience's sake, we provide a default (empty) implementation,
-    // since in practice only GIFs will ever use this.
-    virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
-
-protected:
-    RefPtr<SharedBuffer> m_data; // The encoded data.
-    Vector<RGBA32Buffer> m_frameBufferCache;
-    bool m_sizeAvailable;
-    mutable bool m_failed;
-    IntSize m_size;
-};
-
-}
+
+    private:
+        RGBA32Array m_bytes;
+        IntRect m_rect;    // The rect of the original specified frame within the overall buffer.
+                           // This will always just be the entire buffer except for GIF frames
+                           // whose original rect was smaller than the overall image size.
+        unsigned m_height; // The height (the number of rows we've fully decoded).
+        FrameStatus m_status; // Whether or not this frame is completely finished decoding.
+        unsigned m_duration; // The animation delay.
+        FrameDisposalMethod m_disposalMethod; // What to do with this frame's data when initializing the next frame.
+        bool m_hasAlpha; // Whether or not any of the pixels in the buffer have transparency.
+    };
+
+    // The ImageDecoder class represents a base class for specific image format decoders
+    // (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode into RGBA32 format
+    // and the base class manages the RGBA32 frame cache.
+    class ImageDecoder {
+    public:
+        ImageDecoder()
+            : m_sizeAvailable(false)
+            , m_failed(false)
+        {
+        }
+        
+        virtual ~ImageDecoder() {}
+
+        // The the filename extension usually associated with an undecoded image of this type.
+        virtual String filenameExtension() const = 0;
+
+        // All specific decoder plugins must do something with the data they are given.
+        virtual void setData(SharedBuffer* data, bool allDataReceived) { m_data = data; }
+
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const = 0;
+
+        // Requests the size.
+        virtual IntSize size() const { return m_size; }
+
+        // The total number of frames for the image.  Classes that support multiple frames
+        // will scan the image data for the answer if they need to (without necessarily
+        // decoding all of the individual frames).
+        virtual int frameCount() { return 1; }
+
+        // The number of repetitions to perform for an animation loop.
+        virtual int repetitionCount() const { return cAnimationNone; }
+
+        // Called to obtain the RGBA32Buffer full of decoded data for rendering.  The
+        // decoder plugin will decode as much of the frame as it can before handing
+        // back the buffer.
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index) = 0;
+
+        // Whether or not the underlying image format even supports alpha transparency.
+        virtual bool supportsAlpha() const { return true; }
+
+        bool failed() const { return m_failed; }
+        void setFailed() { m_failed = true; }
+
+        // Wipe out frames in the frame buffer cache before |clearBeforeFrame|,
+        // assuming this can be done without breaking decoding.  Different decoders
+        // place different restrictions on what frames are safe to destroy, so this
+        // is left to them to implement.
+        // For convenience's sake, we provide a default (empty) implementation,
+        // since in practice only GIFs will ever use this.
+        virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
+
+    protected:
+        RefPtr<SharedBuffer> m_data; // The encoded data.
+        Vector<RGBA32Buffer> m_frameBufferCache;
+        bool m_sizeAvailable;
+        mutable bool m_failed;
+        IntSize m_size;
+    };
+
+} // namespace WebCore
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
index 8117b2b3e9..d1b66a7c6c 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
@@ -36,8 +36,13 @@
 #import "Page.h"
 #import "Pasteboard.h"
 #import "RenderImage.h"
+#import "SecurityOrigin.h"
 #import "WebCoreSystemInterface.h"
 
+#ifdef BUILDING_ON_TIGER
+typedef unsigned NSUInteger;
+#endif
+
 namespace WebCore {
 
 ClipboardMac::ClipboardMac(bool forDragging, NSPasteboard *pasteboard, ClipboardAccessPolicy policy, Frame *frame)
@@ -120,9 +125,8 @@ void ClipboardMac::clearData(const String& type)
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
     NSString *cocoaType = cocoaTypeFromMIMEType(type);
-    if (cocoaType) {
+    if (cocoaType)
         [m_pasteboard.get() setString:@"" forType:cocoaType];
-    }
 }
 
 void ClipboardMac::clearAllData()
@@ -135,57 +139,71 @@ void ClipboardMac::clearAllData()
     [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
 }
 
+static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL)
+{
+    NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
+
+    // FIXME: Why does this code need to guard against bad values on the pasteboard?
+    ASSERT(!fileList || [fileList isKindOfClass:[NSArray class]]);
+    if (!fileList || ![fileList isKindOfClass:[NSArray class]] || ![fileList count])
+        return nil;
+
+    NSUInteger count = onlyFirstURL ? 1 : [fileList count];
+    NSMutableArray *urls = [NSMutableArray array];
+    for (NSUInteger i = 0; i < count; i++) {
+        NSString *string = [fileList objectAtIndex:i];
+
+        ASSERT([string isKindOfClass:[NSString class]]);  // Added to understand why this if code is here
+        if (![string isKindOfClass:[NSString class]])
+            return nil; // Non-string object in the list, bail out!  FIXME: When can this happen?
+
+        NSURL *url = [NSURL fileURLWithPath:string];
+        [urls addObject:[url absoluteString]];
+    }
+    return urls;
+}
+
+static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL)
+{
+    // NOTE: We must always check [availableTypes containsObject:] before accessing pasteboard data
+    // or CoreFoundation will printf when there is not data of the corresponding type.
+    NSArray *availableTypes = [pasteboard types];
+
+    // Try NSFilenamesPboardType because it contains a list
+    if ([availableTypes containsObject:NSFilenamesPboardType]) {
+        if (NSArray* absoluteURLs = absoluteURLsFromPasteboardFilenames(pasteboard, onlyFirstURL))
+            return absoluteURLs;
+    }
+
+    // Fallback to NSURLPboardType (which is a single URL)
+    if ([availableTypes containsObject:NSURLPboardType]) {
+        if (NSURL *url = [NSURL URLFromPasteboard:pasteboard])
+            return [NSArray arrayWithObject:[url absoluteString]];
+    }
+
+    // No file paths on the pasteboard, return nil
+    return nil;
+}
+
 String ClipboardMac::getData(const String& type, bool& success) const
 {
     success = false;
     if (policy() != ClipboardReadable)
         return String();
-    
+
     NSString *cocoaType = cocoaTypeFromMIMEType(type);
     NSString *cocoaValue = nil;
-    NSArray *availableTypes = [m_pasteboard.get() types];
-
-    // Fetch the data in different ways for the different Cocoa types
 
+    // Grab the value off the pasteboard corresponding to the cocoaType
     if ([cocoaType isEqualToString:NSURLPboardType]) {
-        // When both URL and filenames are present, filenames is superior since it can contain a list.
-        // must check this or we get a printf from CF when there's no data of this type
-        if ([availableTypes containsObject:NSFilenamesPboardType]) {
-            NSArray *fileList = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-            if (fileList && [fileList isKindOfClass:[NSArray class]]) {
-                unsigned count = [fileList count];
-                if (count > 0) {
-                    if (type != "text/uri-list")
-                        count = 1;
-                    NSMutableString *urls = [NSMutableString string];
-                    unsigned i;
-                    for (i = 0; i < count; i++) {
-                        if (i > 0) {
-                            [urls appendString:@"\n"];
-                        }
-                        NSString *string = [fileList objectAtIndex:i];
-                        if (![string isKindOfClass:[NSString class]])
-                            break;
-                        NSURL *url = [NSURL fileURLWithPath:string];
-                        [urls appendString:[url absoluteString]];
-                    }
-                    if (i == count)
-                        cocoaValue = urls;
-                }
-            }
-        }
-        if (!cocoaValue) {
-            // must check this or we get a printf from CF when there's no data of this type
-            if ([availableTypes containsObject:NSURLPboardType]) {
-                NSURL *url = [NSURL URLFromPasteboard:m_pasteboard.get()];
-                if (url) {
-                    cocoaValue = [url absoluteString];
-                }
-            }
-        }
-    } else if (cocoaType) {        
+        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromMIMEType(), "URL" only wants the first URL
+        bool onlyFirstURL = (type == "URL");
+        NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get(), onlyFirstURL);
+        cocoaValue = [absoluteURLs componentsJoinedByString:@"\n"];
+    } else if ([cocoaType isEqualToString:NSStringPboardType]) {
+        cocoaValue = [[m_pasteboard.get() stringForType:cocoaType] precomposedStringWithCanonicalMapping];
+    } else if (cocoaType)
         cocoaValue = [m_pasteboard.get() stringForType:cocoaType];
-    }
 
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
@@ -211,7 +229,7 @@ bool ClipboardMac::setData(const String &type, const String &data)
         NSURL *url = [[NSURL alloc] initWithString:cocoaData];
         [url writeToPasteboard:m_pasteboard.get()];
 
-        if ([url isFileURL]) {
+        if ([url isFileURL] && m_frame->document()->securityOrigin()->canLoadLocalResources()) {
             [m_pasteboard.get() addTypes:[NSArray arrayWithObject:NSFilenamesPboardType] owner:nil];
             NSArray *fileList = [NSArray arrayWithObject:[url path]];
             [m_pasteboard.get() setPropertyList:fileList forType:NSFilenamesPboardType];
@@ -243,18 +261,15 @@ HashSet<String> ClipboardMac::types() const
         return HashSet<String>();
 
     HashSet<String> result;
-    if (types) {
-        unsigned count = [types count];
-        unsigned i;
-        for (i = 0; i < count; i++) {
-            NSString *pbType = [types objectAtIndex:i];
-            if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
-                continue;   // skip this ancient type that gets auto-supplied by some system conversion
-
-            String str = MIMETypeFromCocoaType(pbType);
-            if (!result.contains(str))
-                result.add(str);
-        }
+    NSUInteger count = [types count];
+    for (NSUInteger i = 0; i < count; i++) {
+        NSString *pbType = [types objectAtIndex:i];
+        if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
+            continue;   // skip this ancient type that gets auto-supplied by some system conversion
+
+        String str = MIMETypeFromCocoaType(pbType);
+        if (!result.contains(str))
+            result.add(str);
     }
     return result;
 }
@@ -323,7 +338,7 @@ void ClipboardMac::declareAndWriteDragImage(Element* element, const KURL& url, c
 {
     ASSERT(frame);
     if (Page* page = frame->page())
-        page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), [DOMElement _wrapElement:element], url, title, frame);
+        page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), kit(element), url, title, frame);
 }
     
 DragImageRef ClipboardMac::createDragImage(IntPoint& loc) const
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm b/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
index 94b7d77189..d8df601908 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
@@ -27,6 +27,7 @@
 #import "CookieJar.h"
 
 #import "BlockExceptions.h"
+#import "Document.h"
 #import "KURL.h"
 #import <wtf/RetainPtr.h>
 
@@ -84,7 +85,7 @@ String cookies(const Document*, const KURL& url)
     return String();
 }
 
-void setCookies(Document*, const KURL& url, const KURL& policyBaseURL, const String& cookieStr)
+void setCookies(Document* document, const KURL& url, const String& cookieStr)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
@@ -99,7 +100,7 @@ void setCookies(Document*, const KURL& url, const KURL& policyBaseURL, const Str
 
     NSURL *cookieURL = url;    
     NSArray *cookies = [NSHTTPCookie cookiesWithResponseHeaderFields:[NSDictionary dictionaryWithObject:cookieString forKey:@"Set-Cookie"] forURL:cookieURL];
-    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookies:filterCookies(cookies).get() forURL:cookieURL mainDocumentURL:policyBaseURL];
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookies:filterCookies(cookies).get() forURL:cookieURL mainDocumentURL:document->firstPartyForCookies()];
 
     END_BLOCK_OBJC_EXCEPTIONS;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm
index 5cf2e14c02..a7b751c0f9 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm
@@ -124,7 +124,7 @@ String DragData::asURL(String* title) const
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
 {
-    return [m_pasteboardHelper->fragmentFromPasteboard([m_platformDragData draggingPasteboard]) _documentFragment];
+    return core(m_pasteboardHelper->fragmentFromPasteboard([m_platformDragData draggingPasteboard]));
 }
     
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm
index a20a153064..842e6d405d 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,30 +22,29 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
+
 #import "config.h"
 #import "DragImage.h"
 
 #import "CachedImage.h"
 #import "Image.h"
 #import "KURL.h"
-#import "PlatformString.h"
 #import "ResourceResponse.h"
 
 namespace WebCore {
 
-
-
-IntSize dragImageSize(DragImageRef image)
+IntSize dragImageSize(RetainPtr<NSImage> image)
 {
     return (IntSize)[image.get() size];
 }
 
-void deleteDragImage(DragImageRef image)
+void deleteDragImage(RetainPtr<NSImage>)
 {
-    //DragImageRef is a RetainPtr, so we don't need to explicitly delete it
+    // Since this is a RetainPtr, there's nothing additional we need to do to
+    // delete it. It will be released when it falls out of scope.
 }
 
-DragImageRef scaleDragImage(DragImageRef image, FloatSize scale)
+RetainPtr<NSImage> scaleDragImage(RetainPtr<NSImage> image, FloatSize scale)
 {
     NSSize originalSize = [image.get() size];
     NSSize newSize = NSMakeSize((originalSize.width * scale.width()), (originalSize.height * scale.height()));
@@ -56,7 +55,7 @@ DragImageRef scaleDragImage(DragImageRef image, FloatSize scale)
     return image;
 }
     
-DragImageRef dissolveDragImageToFraction(DragImageRef image, float delta)
+RetainPtr<NSImage> dissolveDragImageToFraction(RetainPtr<NSImage> image, float delta)
 {
     RetainPtr<NSImage> dissolvedImage(AdoptNS, [[NSImage alloc] initWithSize:[image.get() size]]);
     
@@ -76,14 +75,14 @@ DragImageRef dissolveDragImageToFraction(DragImageRef image, float delta)
     return image;
 }
         
-DragImageRef createDragImageFromImage(Image* image)
+RetainPtr<NSImage> createDragImageFromImage(Image* image)
 {
-    DragImageRef dragImage(AdoptNS, [image->getNSImage() copy]);
+    RetainPtr<NSImage> dragImage(AdoptNS, [image->getNSImage() copy]);
     [dragImage.get() setSize:(NSSize)(image->size())];
     return dragImage;
 }
     
-DragImageRef createDragImageIconForCachedImage(CachedImage* image)
+RetainPtr<NSImage> createDragImageIconForCachedImage(CachedImage* image)
 {
     const String& filename = image->response().suggestedFilename();
     NSString *extension = nil;
@@ -91,12 +90,12 @@ DragImageRef createDragImageIconForCachedImage(CachedImage* image)
     
     if (dotIndex > 0 && dotIndex < (int)(filename.length() - 1)) // require that a . exists after the first character and before the last
         extension = filename.substring(dotIndex + 1);
-    else
-        //It might be worth doing a further look up to pull the extension from the mimetype
+    else {
+        // It might be worth doing a further lookup to pull the extension from the MIME type.
         extension = @"";
+    }
     
-    return DragImageRef([[NSWorkspace sharedWorkspace] iconForFileType:extension]);
-     
+    return [[NSWorkspace sharedWorkspace] iconForFileType:extension];
 }
     
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/FoundationExtras.h b/src/3rdparty/webkit/WebCore/platform/mac/FoundationExtras.h
index 51a7df0f4a..85ce8d78d7 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/FoundationExtras.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/FoundationExtras.h
@@ -23,6 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#import <CoreFoundation/CFBase.h>
+#import <Foundation/NSObject.h>
+
 // nil-checked CFRetain/CFRelease covers for Objective-C ids
 
 // Use CFRetain, CFRelease, HardRetain, or HardRelease instead of
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.h b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.h
new file mode 100644
index 0000000000..d0342e7a68
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GeolocationServiceMac_h
+#define GeolocationServiceMac_h
+
+#if ENABLE(GEOLOCATION)
+
+#include "GeolocationService.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/RetainPtr.h>
+
+#ifdef __OBJC__
+@class CLLocationManager;
+@class WebCoreCoreLocationObserver;
+#else
+class CLLocationManager;
+class WebCoreCoreLocationObserver;
+#endif
+
+namespace WebCore {
+
+class GeolocationServiceMac : public GeolocationService {
+public:
+    GeolocationServiceMac(GeolocationServiceClient*);
+    virtual ~GeolocationServiceMac();
+    
+    virtual bool startUpdating(PositionOptions*);
+    virtual void stopUpdating();
+
+    virtual void suspend();
+    virtual void resume();
+
+    virtual Geoposition* lastPosition() const { return m_lastPosition.get(); }
+    virtual PositionError* lastError() const { return m_lastError.get(); }
+
+    void positionChanged(PassRefPtr<Geoposition>);
+    void errorOccurred(PassRefPtr<PositionError>);
+
+private:
+    RetainPtr<CLLocationManager> m_locationManager;
+    RetainPtr<WebCoreCoreLocationObserver> m_objcObserver;
+    
+    RefPtr<Geoposition> m_lastPosition;
+    RefPtr<PositionError> m_lastError;
+};
+    
+} // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
+
+#endif // GeolocationServiceMac_h
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
new file mode 100644
index 0000000000..01eca4a62e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+
+#if ENABLE(GEOLOCATION)
+
+#import "GeolocationServiceMac.h"
+
+#import "Geoposition.h"
+#import "PositionError.h"
+#import "PositionOptions.h"
+#import "SoftLinking.h"
+#import <CoreLocation/CoreLocation.h>
+#import <objc/objc-runtime.h>
+#import <wtf/RefPtr.h>
+#import <wtf/UnusedParam.h>
+
+SOFT_LINK_FRAMEWORK(CoreLocation)
+
+SOFT_LINK_CLASS(CoreLocation, CLLocationManager)
+SOFT_LINK_CLASS(CoreLocation, CLLocation)
+
+SOFT_LINK_CONSTANT(CoreLocation, kCLLocationAccuracyBest, double)
+SOFT_LINK_CONSTANT(CoreLocation, kCLLocationAccuracyHundredMeters, double)
+
+#define kCLLocationAccuracyBest getkCLLocationAccuracyBest()
+#define kCLLocationAccuracyHundredMeters getkCLLocationAccuracyHundredMeters()
+
+using namespace WebCore;
+
+@interface WebCoreCoreLocationObserver : NSObject<CLLocationManagerDelegate>
+{
+    GeolocationServiceMac* m_callback;
+}
+
+- (id)initWithCallback:(GeolocationServiceMac*)callback;
+
+- (void)locationManager:(CLLocationManager *)manager didUpdateToLocation:(CLLocation *)newLocation fromLocation:(CLLocation *)oldLocation;
+- (void)locationManager:(CLLocationManager *)manager didFailWithError:(NSError *)error;
+
+@end
+
+namespace WebCore {
+
+GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
+{
+    return new GeolocationServiceMac(client);
+}
+
+GeolocationServiceMac::GeolocationServiceMac(GeolocationServiceClient* client)
+    : GeolocationService(client)
+    , m_objcObserver(AdoptNS, [[WebCoreCoreLocationObserver alloc] initWithCallback:this])
+{
+}
+
+GeolocationServiceMac::~GeolocationServiceMac()
+{
+    [m_locationManager.get() stopUpdatingLocation];
+    m_locationManager.get().delegate = nil;
+}
+
+bool GeolocationServiceMac::startUpdating(PositionOptions* options)
+{
+    #define CLLocationManager getCLLocationManagerClass()
+    if (!m_locationManager.get()) {
+        m_locationManager.adoptNS([[CLLocationManager alloc] init]);
+        m_locationManager.get().delegate = m_objcObserver.get();
+    }
+
+    if (!m_locationManager.get().locationServicesEnabled)
+        return false;
+
+    if (options) {
+        // CLLocationAccuracy values suggested by Ron Huang.
+        CLLocationAccuracy accuracy = options->enableHighAccuracy() ? kCLLocationAccuracyBest : kCLLocationAccuracyHundredMeters;
+        m_locationManager.get().desiredAccuracy = accuracy;
+    }
+    
+    // This can safely be called multiple times.
+    [m_locationManager.get() startUpdatingLocation];
+    
+    return true;
+    #undef CLLocationManager
+}
+
+void GeolocationServiceMac::stopUpdating()
+{
+    [m_locationManager.get() stopUpdatingLocation];
+}
+
+void GeolocationServiceMac::suspend()
+{
+    [m_locationManager.get() stopUpdatingLocation];
+}
+
+void GeolocationServiceMac::resume()
+{
+    [m_locationManager.get() startUpdatingLocation];
+}
+
+void GeolocationServiceMac::positionChanged(PassRefPtr<Geoposition> position)
+{
+    m_lastPosition = position;
+    GeolocationService::positionChanged();
+}
+    
+void GeolocationServiceMac::errorOccurred(PassRefPtr<PositionError> error)
+{
+    m_lastError = error;
+    GeolocationService::errorOccurred();
+}
+
+} // namespace WebCore
+
+@implementation WebCoreCoreLocationObserver
+
+- (id)initWithCallback:(GeolocationServiceMac *)callback
+{
+    self = [super init];
+    if (self)
+        m_callback = callback;
+    return self;
+}
+
+- (void)locationManager:(CLLocationManager *)manager didUpdateToLocation:(CLLocation *)newLocation fromLocation:(CLLocation *)oldLocation
+{
+    ASSERT(m_callback);
+    ASSERT(newLocation);
+    UNUSED_PARAM(manager);
+    UNUSED_PARAM(oldLocation);
+
+    // Normalize
+    bool canProvideAltitude = true;
+    bool canProvideAltitudeAccuracy = true;
+    double altitude = newLocation.altitude;
+    double altitudeAccuracy = newLocation.verticalAccuracy;
+    if (altitudeAccuracy < 0.0) {
+        canProvideAltitude = false;
+        canProvideAltitudeAccuracy = false;
+    }
+    
+    bool canProvideSpeed = true;
+    double speed = newLocation.speed;
+    if (speed < 0.0)
+        canProvideSpeed = false;
+
+    bool canProvideHeading = true;
+    double heading = newLocation.course;
+    if (heading < 0.0)
+        canProvideHeading = false;
+    
+    WTF::RefPtr<WebCore::Coordinates> newCoordinates = WebCore::Coordinates::create(
+                            newLocation.coordinate.latitude,
+                            newLocation.coordinate.longitude,
+                            canProvideAltitude,
+                            altitude,
+                            newLocation.horizontalAccuracy,
+                            canProvideAltitudeAccuracy,
+                            altitudeAccuracy,
+                            canProvideHeading,
+                            heading,
+                            canProvideSpeed,
+                            speed);
+    WTF::RefPtr<WebCore::Geoposition> newPosition = WebCore::Geoposition::create(
+                             newCoordinates.release(),
+                             [newLocation.timestamp timeIntervalSince1970] * 1000.0); // seconds -> milliseconds
+    
+    m_callback->positionChanged(newPosition.release());
+}
+
+- (void)locationManager:(CLLocationManager *)manager didFailWithError:(NSError *)error
+{
+    ASSERT(m_callback);
+    ASSERT(error);
+ 
+    UNUSED_PARAM(manager);
+
+    PositionError::ErrorCode code;
+    switch ([error code]) {
+        case kCLErrorDenied:
+            code = PositionError::PERMISSION_DENIED;
+            break;
+        case kCLErrorLocationUnknown:
+            code = PositionError::POSITION_UNAVAILABLE;
+            break;
+        default:
+            code = PositionError::POSITION_UNAVAILABLE;
+            break;
+    }
+
+    m_callback->errorOccurred(PositionError::create(code, [error localizedDescription]));
+}
+
+@end
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/LocalCurrentGraphicsContext.h b/src/3rdparty/webkit/WebCore/platform/mac/LocalCurrentGraphicsContext.h
index 856cf52d4b..1c5cae7f43 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/LocalCurrentGraphicsContext.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/LocalCurrentGraphicsContext.h
@@ -19,7 +19,11 @@
 
 #include <wtf/Noncopyable.h>
 
+#ifdef __OBJC__
+@class NSGraphicsContext;
+#else
 class NSGraphicsContext;
+#endif
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
index d4657589f6..ebb6d937ae 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -433,6 +433,110 @@ String contextMenuItemTagRightToLeft()
     return String();
 }
 
+String contextMenuItemTagCorrectSpellingAutomatically()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagCorrectSpellingAutomatically];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSubstitutionsMenu()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSubstitutionsMenu];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagShowSubstitutions(bool show)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagShowSubstitutions:show];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartCopyPaste()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartCopyPaste];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartQuotes()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartQuotes];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartDashes()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartDashes];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartLinks()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartLinks];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagTextReplacement()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagTextReplacement];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagTransformationsMenu()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagTransformationsMenu];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagMakeUpperCase()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagMakeUpperCase];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagMakeLowerCase()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagMakeLowerCase];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagCapitalize()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagCapitalize];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagChangeBack(const String& replacedString)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagChangeBack:replacedString];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return replacedString;
+}
+    
 String contextMenuItemTagInspectElement()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
index e4bfe32e62..c0e43b3cfd 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
@@ -46,6 +46,7 @@
 
 #import <wtf/StdLibExtras.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/UnusedParam.h>
 
 @interface NSAttributedString (AppKitSecretsIKnowAbout)
 - (id)_initWithDOMRange:(DOMRange *)domRange;
@@ -138,12 +139,13 @@ void Pasteboard::writeSelection(NSPasteboard* pasteboard, Range* selectedRange,
         Pasteboard::generalPasteboard(); //Initialises pasteboard types
     ASSERT(selectedRange);
     
-    NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:[DOMRange _wrapRange:selectedRange]] autorelease];
+    NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
 #ifdef BUILDING_ON_TIGER
     // 4930197: Mail overrides [WebHTMLView pasteboardTypesForSelection] in order to add another type to the pasteboard
     // after WebKit does.  On Tiger we must call this function so that Mail code will be executed, meaning that 
     // we can't call WebCore::Pasteboard's method for setting types. 
-    
+    UNUSED_PARAM(canSmartCopyOrDelete);
+
     NSArray *types = frame->editor()->client()->pasteboardTypesForSelection(frame);
     // Don't write RTFD to the pasteboard when the copied attributed string has no attachments.
     NSMutableArray *mutableTypes = nil;
@@ -182,8 +184,7 @@ void Pasteboard::writeSelection(NSPasteboard* pasteboard, Range* selectedRange,
     if ([types containsObject:NSStringPboardType]) {
         // Map &nbsp; to a plain old space because this is better for source code, other browsers do it,
         // and because HTML forces you to do this any time you want two spaces in a row.
-        String text = selectedRange->text();
-        text.replace('\\', frame->backslashAsCurrencySymbol());
+        String text = frame->displayStringModifiedByEncoding(selectedRange->text());
         NSMutableString *s = [[[(NSString*)text copy] autorelease] mutableCopy];
         
         NSString *NonBreakingSpaceString = [NSString stringWithCharacters:&noBreakSpace length:1];
@@ -277,7 +278,7 @@ void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
     ASSERT(cocoaURL);
 
     ASSERT(node->renderer() && node->renderer()->isImage());
-    RenderImage* renderer = static_cast<RenderImage*>(node->renderer());
+    RenderImage* renderer = toRenderImage(node->renderer());
     CachedImage* cachedImage = static_cast<CachedImage*>(renderer->cachedImage());
     ASSERT(cachedImage);
     
@@ -309,7 +310,7 @@ String Pasteboard::plainText(Frame* frame)
     NSArray *types = [m_pasteboard.get() types];
     
     if ([types containsObject:NSStringPboardType])
-        return [m_pasteboard.get() stringForType:NSStringPboardType];
+        return [[m_pasteboard.get() stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping];
     
     NSAttributedString *attributedString = nil;
     NSString *string;
@@ -319,13 +320,13 @@ String Pasteboard::plainText(Frame* frame)
     if (attributedString == nil && [types containsObject:NSRTFPboardType])
         attributedString = [[NSAttributedString alloc] initWithRTF:[m_pasteboard.get() dataForType:NSRTFPboardType] documentAttributes:NULL];
     if (attributedString != nil) {
-        string = [[attributedString string] copy];
+        string = [[attributedString string] precomposedStringWithCanonicalMapping];
         [attributedString release];
-        return [string autorelease];
+        return string;
     }
     
     if ([types containsObject:NSFilenamesPboardType]) {
-        string = [[m_pasteboard.get() propertyListForType:NSFilenamesPboardType] componentsJoinedByString:@"\n"];
+        string = [[[m_pasteboard.get() propertyListForType:NSFilenamesPboardType] componentsJoinedByString:@"\n"] precomposedStringWithCanonicalMapping];
         if (string != nil)
             return string;
     }
@@ -337,7 +338,7 @@ String Pasteboard::plainText(Frame* frame)
         // helper code that should either be done in a separate patch or figured out in another way.
         string = frame->editor()->client()->userVisibleString(url);
         if ([string length] > 0)
-            return string;
+            return [string precomposedStringWithCanonicalMapping];
     }
 
     
@@ -367,7 +368,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     
     if (allowPlainText && [types containsObject:NSStringPboardType]) {
         chosePlainText = true;
-        RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), [m_pasteboard.get() stringForType:NSStringPboardType]);
+        RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), [[m_pasteboard.get() stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping]);
         if (fragment)
             return fragment.release();
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm
index af7415d038..74f694e46c 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PlatformMouseEventMac.mm
@@ -68,12 +68,12 @@ static int clickCountForEvent(NSEvent *event)
     }
 }
 
-IntPoint globalPoint(const NSPoint& windowPoint, NSWindow* window)
+IntPoint globalPoint(const NSPoint& windowPoint, NSWindow *window)
 {
     return IntPoint(flipScreenPoint([window convertBaseToScreen:windowPoint], screenForWindow(window)));
 }
 
-IntPoint pointForEvent(NSEvent *event)
+IntPoint pointForEvent(NSEvent *event, NSView *windowView)
 {
     switch ([event type]) {
         case NSLeftMouseDown:
@@ -86,11 +86,14 @@ IntPoint pointForEvent(NSEvent *event)
         case NSOtherMouseUp:
         case NSOtherMouseDragged:
         case NSMouseMoved:
-        case NSScrollWheel:
-            // Note: This has its origin at the bottom left of the window.
-            // The Y coordinate gets flipped by ScrollView::viewportToContents.
-            // We should probably change both this and that to not use "bottom left origin" coordinates at all.
-            return IntPoint([event locationInWindow]);
+        case NSScrollWheel: {
+            // Note: This will have its origin at the bottom left of the window unless windowView is flipped.
+            // In those cases, the Y coordinate gets flipped by Widget::convertFromContainingWindow.
+            NSPoint location = [event locationInWindow];
+            if (windowView)
+                location = [windowView convertPoint:location fromView:nil];
+            return IntPoint(location);
+        }
         default:
             return IntPoint();
     }
@@ -116,25 +119,6 @@ IntPoint globalPointForEvent(NSEvent *event)
     }
 }
 
-int eventNumberForEvent(NSEvent *event)
-{
-    switch ([event type]) {
-        case NSLeftMouseDown:
-        case NSLeftMouseUp:
-        case NSLeftMouseDragged:
-        case NSRightMouseDown:
-        case NSRightMouseUp:
-        case NSRightMouseDragged:
-        case NSOtherMouseDown:
-        case NSOtherMouseUp:
-        case NSOtherMouseDragged:
-        case NSMouseMoved:
-            return [event eventNumber];
-        default:
-            return 0;
-    }
-}
-    
 static MouseEventType mouseEventForNSEvent(NSEvent* event) 
 {
     switch ([event type]) {
@@ -158,8 +142,8 @@ static MouseEventType mouseEventForNSEvent(NSEvent* event)
     }
 }
 
-PlatformMouseEvent::PlatformMouseEvent(NSEvent* event)
-    : m_position(pointForEvent(event))
+PlatformMouseEvent::PlatformMouseEvent(NSEvent* event, NSView *windowView)
+    : m_position(pointForEvent(event, windowView))
     , m_globalPosition(globalPointForEvent(event))
     , m_button(mouseButtonForEvent(event))
     , m_eventType(mouseEventForNSEvent(event))
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PlatformScreenMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PlatformScreenMac.mm
index 8f12df0131..5dbfcf4219 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PlatformScreenMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PlatformScreenMac.mm
@@ -45,11 +45,7 @@ int screenDepthPerComponent(Widget*)
 
 bool screenIsMonochrome(Widget*)
 {
-    NSString *colorSpace = NSColorSpaceFromDepth([[NSScreen deepestScreen] depth]);
-    return colorSpace == NSCalibratedWhiteColorSpace
-        || colorSpace == NSCalibratedBlackColorSpace
-        || colorSpace == NSDeviceWhiteColorSpace
-        || colorSpace == NSDeviceBlackColorSpace;
+    return false;
 }
 
 // These functions scale between screen and page coordinates because JavaScript/DOM operations 
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.idl b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.h
index cee726f02d..44eedfad54 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.idl
+++ b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.h
@@ -1,18 +1,15 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer. 
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     documentation and/or other materials provided with the distribution. 
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,10 +23,14 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module storage {
+#ifndef RuntimeApplicationChecks_h
+#define RuntimeApplicationChecks_h
 
-    interface SQLTransactionCallback {
-        void handleEvent(in SQLTransaction transaction);
-    };
+namespace WebCore {
 
-}
+bool applicationIsAppleMail();
+bool applicationIsSafari();
+
+} // namespace WebCore
+
+#endif // RuntimeApplicationChecks_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.idl b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.mm
index 783e8c4f61..16701853fe 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.idl
+++ b/src/3rdparty/webkit/WebCore/platform/mac/RuntimeApplicationChecks.mm
@@ -1,18 +1,15 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer. 
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     documentation and/or other materials provided with the distribution. 
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,10 +23,22 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module storage {
+#import "config.h"
+#import "RuntimeApplicationChecks.h"
 
-    interface SQLStatementCallback {
-        void handleEvent(in SQLTransaction transaction, in SQLResultSet resultSet);
-    };
 
+namespace WebCore {
+
+bool applicationIsAppleMail()
+{
+    static const bool isAppleMail = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.apple.mail"];
+    return isAppleMail;
+}
+
+bool applicationIsSafari()
+{
+    static const bool isSafari = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.apple.Safari"];
+    return isSafari;
 }
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
index b39b8bc981..759a6e1e6e 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -26,17 +26,12 @@
 #include "config.h"
 #include "ScrollbarThemeMac.h"
 
-#include "GraphicsContext.h"
 #include "ImageBuffer.h"
-#include "IntRect.h"
-#include "Page.h"
 #include "PlatformMouseEvent.h"
-#include "Scrollbar.h"
-#include "ScrollbarClient.h"
-#include "Settings.h"
-#include <wtf/StdLibExtras.h>
-
+#include "ScrollView.h"
 #include <Carbon/Carbon.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
 
 // FIXME: There are repainting problems due to Aqua scroll bar buttons' visual overflow.
 
@@ -58,8 +53,10 @@ static HashSet<Scrollbar*>* gScrollbars;
 
 @implementation ScrollbarPrefsObserver
 
-+ (void)appearancePrefsChanged:(NSNotification*)theNotification
++ (void)appearancePrefsChanged:(NSNotification*)unusedNotification
 {
+    UNUSED_PARAM(unusedNotification);
+
     static_cast<ScrollbarThemeMac*>(ScrollbarTheme::nativeTheme())->preferencesChanged();
     if (!gScrollbars)
         return;
@@ -70,8 +67,10 @@ static HashSet<Scrollbar*>* gScrollbars;
     }
 }
 
-+ (void)behaviorPrefsChanged:(NSNotification*)theNotification
++ (void)behaviorPrefsChanged:(NSNotification*)unusedNotification
 {
+    UNUSED_PARAM(unusedNotification);
+
     static_cast<ScrollbarThemeMac*>(ScrollbarTheme::nativeTheme())->preferencesChanged();
 }
 
@@ -367,9 +366,12 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
     trackInfo.attributes = 0;
     if (scrollbar->orientation() == HorizontalScrollbar)
         trackInfo.attributes |= kThemeTrackHorizontal;
-    trackInfo.enableState = scrollbar->client()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+
     if (!scrollbar->enabled())
         trackInfo.enableState = kThemeTrackDisabled;
+    else
+        trackInfo.enableState = scrollbar->client()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+
     if (hasThumb(scrollbar))
         trackInfo.attributes |= kThemeTrackShowThumb;
     else if (!hasButtons(scrollbar))
@@ -389,8 +391,8 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
         bufferRect.intersect(damageRect);
         bufferRect.move(-scrollbar->frameRect().x(), -scrollbar->frameRect().y());
         
-        auto_ptr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size(), false);
-        if (!imageBuffer.get())
+        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size(), false);
+        if (!imageBuffer)
             return true;
         
         HIThemeDrawTrack(&trackInfo, 0, imageBuffer->context()->platformContext(), kHIThemeOrientationNormal);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/SharedBufferMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/SharedBufferMac.mm
index f1d95173cb..c4e7528ad3 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/SharedBufferMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/SharedBufferMac.mm
@@ -39,7 +39,7 @@ using namespace WebCore;
 
 @interface WebCoreSharedBufferData : NSData
 {
-    SharedBuffer* sharedBuffer;
+    RefPtr<SharedBuffer> sharedBuffer;
 }
 
 - (id)initWithSharedBuffer:(SharedBuffer*)buffer;
@@ -59,16 +59,12 @@ using namespace WebCore;
 {
     if (WebCoreObjCScheduleDeallocateOnMainThread([WebCoreSharedBufferData class], self))
         return;
-
-    sharedBuffer->deref();
     
     [super dealloc];
 }
 
 - (void)finalize
 {
-    sharedBuffer->deref();
-    
     [super finalize];
 }
 
@@ -76,10 +72,8 @@ using namespace WebCore;
 {
     self = [super init];
     
-    if (self) {
+    if (self)
         sharedBuffer = buffer;
-        sharedBuffer->ref();
-    }
     
     return self;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/SharedTimerMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/SharedTimerMac.mm
index 991f527b2f..b9eaaeff99 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/SharedTimerMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/SharedTimerMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +26,8 @@
 #import "config.h"
 #import "SharedTimer.h"
 
-#include <Foundation/Foundation.h>
-#include <wtf/Assertions.h>
+#import <wtf/Assertions.h>
+#import <wtf/UnusedParam.h>
 
 @class WebCorePowerNotifier;
 
@@ -58,8 +58,10 @@ static void timerFired(CFRunLoopTimerRef, void*);
     return self;
 }
 
-- (void)didWake:(NSNotification *)notification
+- (void)didWake:(NSNotification *)unusedNotification
 {
+    UNUSED_PARAM(unusedNotification);
+
     if (WebCore::sharedTimer) {
         WebCore::stopSharedTimer();
         WebCore::timerFired(0, 0);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/SuddenTermination.mm b/src/3rdparty/webkit/WebCore/platform/mac/SuddenTermination.mm
new file mode 100644
index 0000000000..513d01be8d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/mac/SuddenTermination.mm
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "SuddenTermination.h"
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+namespace WebCore {
+
+void disableSuddenTermination()
+{
+    [[NSProcessInfo processInfo] disableSuddenTermination];
+}
+
+void enableSuddenTermination()
+{
+    [[NSProcessInfo processInfo] enableSuddenTermination];
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/SystemTimeMac.cpp b/src/3rdparty/webkit/WebCore/platform/mac/SystemTimeMac.cpp
index dd5e500d0f..1b2aae0e91 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/SystemTimeMac.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/mac/SystemTimeMac.cpp
@@ -31,11 +31,6 @@
 
 namespace WebCore {
 
-double currentTime()
-{
-    return CFAbsoluteTimeGetCurrent() + kCFAbsoluteTimeIntervalSince1970;
-}
-
 float userIdleTime()
 {
     return static_cast<float>(CGEventSourceSecondsSinceLastEventType(kCGEventSourceStateCombinedSessionState, kCGAnyInputEventType));
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ThreadCheck.mm b/src/3rdparty/webkit/WebCore/platform/mac/ThreadCheck.mm
index b8625983f3..ddee05c6bf 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ThreadCheck.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ThreadCheck.mm
@@ -32,56 +32,74 @@
 
 namespace WebCore {
 
-static ThreadViolationBehavior defaultThreadViolationBehavior = RaiseExceptionOnThreadViolation;
-
 static bool didReadThreadViolationBehaviorFromUserDefaults = false;
-static bool threadViolationBehaviorIsDefault;
-static ThreadViolationBehavior threadViolationBehavior;
+static bool threadViolationBehaviorIsDefault = true;
+static ThreadViolationBehavior threadViolationBehavior[MaximumThreadViolationRound] = { RaiseExceptionOnThreadViolation, RaiseExceptionOnThreadViolation };
 
 static void readThreadViolationBehaviorFromUserDefaults()
 {
+    didReadThreadViolationBehaviorFromUserDefaults = true;
+
+    ThreadViolationBehavior newBehavior = LogOnFirstThreadViolation;
     NSString *threadCheckLevel = [[NSUserDefaults standardUserDefaults] stringForKey:@"WebCoreThreadCheck"];
+    if (!threadCheckLevel)
+        return;
+
     if ([threadCheckLevel isEqualToString:@"None"])
-        threadViolationBehavior = NoThreadCheck;
+        newBehavior = NoThreadCheck;
     else if ([threadCheckLevel isEqualToString:@"Exception"])
-        threadViolationBehavior = RaiseExceptionOnThreadViolation;
+        newBehavior = RaiseExceptionOnThreadViolation;
     else if ([threadCheckLevel isEqualToString:@"Log"])
-        threadViolationBehavior = LogOnThreadViolation;
+        newBehavior = LogOnThreadViolation;
     else if ([threadCheckLevel isEqualToString:@"LogOnce"])
-        threadViolationBehavior = LogOnFirstThreadViolation;
-    else {
-        threadViolationBehavior = defaultThreadViolationBehavior;
-        threadViolationBehaviorIsDefault = true;
-    }
-    didReadThreadViolationBehaviorFromUserDefaults = true;
+        newBehavior = LogOnFirstThreadViolation;
+    else
+        ASSERT_NOT_REACHED();
+
+    threadViolationBehaviorIsDefault = false;
+
+    for (unsigned i = 0; i < MaximumThreadViolationRound; ++i)
+        threadViolationBehavior[i] = newBehavior;
 }
 
-void setDefaultThreadViolationBehavior(ThreadViolationBehavior behavior)
+void setDefaultThreadViolationBehavior(ThreadViolationBehavior behavior, ThreadViolationRound round)
 {
-    defaultThreadViolationBehavior = behavior;
+    ASSERT(round < MaximumThreadViolationRound);
+    if (round >= MaximumThreadViolationRound)
+        return;
+    if (!didReadThreadViolationBehaviorFromUserDefaults)
+        readThreadViolationBehaviorFromUserDefaults();
     if (threadViolationBehaviorIsDefault)
-        threadViolationBehavior = behavior;
+        threadViolationBehavior[round] = behavior;
 }
 
-void reportThreadViolation(const char* function)
+void reportThreadViolation(const char* function, ThreadViolationRound round)
 {
+    ASSERT(round < MaximumThreadViolationRound);
+    if (round >= MaximumThreadViolationRound)
+        return;
     if (!didReadThreadViolationBehaviorFromUserDefaults)
-        readThreadViolationBehaviorFromUserDefaults();    
-    if (threadViolationBehavior == NoThreadCheck)
+        readThreadViolationBehaviorFromUserDefaults();
+    if (threadViolationBehavior[round] == NoThreadCheck)
         return;
     if (pthread_main_np())
         return;
-    WebCoreReportThreadViolation(function);
+    WebCoreReportThreadViolation(function, round);
 }
 
 } // namespace WebCore
 
 // Split out the actual reporting of the thread violation to make it easier to set a breakpoint
-void WebCoreReportThreadViolation(const char* function)
+void WebCoreReportThreadViolation(const char* function, WebCore::ThreadViolationRound round)
 {
     using namespace WebCore;
+
+    ASSERT(round < MaximumThreadViolationRound);
+    if (round >= MaximumThreadViolationRound)
+        return;
+
     DEFINE_STATIC_LOCAL(HashSet<String>, loggedFunctions, ());
-    switch (threadViolationBehavior) {
+    switch (threadViolationBehavior[round]) {
         case NoThreadCheck:
             break;
         case LogOnFirstThreadViolation:
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreKeyGenerator.m b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreKeyGenerator.m
index c1004a70d6..a1e780cb21 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreKeyGenerator.m
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreKeyGenerator.m
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@
 #import "WebCoreKeyGenerator.h"
 
 #import <wtf/Assertions.h>
+#import <wtf/UnusedParam.h>
 
 static WebCoreKeyGenerator *sharedGenerator;
 
@@ -50,8 +51,12 @@ static WebCoreKeyGenerator *sharedGenerator;
     return nil;
 }
 
-- (NSString *)signedPublicKeyAndChallengeStringWithStrengthIndex:(unsigned)index challenge:(NSString *)challenge pageURL:(NSURL *)pageURL
+- (NSString *)signedPublicKeyAndChallengeStringWithStrengthIndex:(unsigned)unusedIndex challenge:(NSString *)unusedChallenge pageURL:(NSURL *)unusedPageURL
 {
+    UNUSED_PARAM(unusedIndex);
+    UNUSED_PARAM(unusedChallenge);
+    UNUSED_PARAM(unusedPageURL);
+
     return nil;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm
index 4735fd7e18..cb8d5048db 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreObjCExtras.mm
@@ -34,6 +34,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
+#include <wtf/UnusedParam.h>
 
 void WebCoreObjCFinalizeOnMainThread(Class cls)
 {
@@ -41,6 +42,8 @@ void WebCoreObjCFinalizeOnMainThread(Class cls)
     // WebCoreObjCScheduleDeallocateOnMainThread will crash.
 #if !defined(BUILDING_ON_TIGER) && !defined(DONT_FINALIZE_ON_MAIN_THREAD)
     objc_finalizeOnMainThread(cls);
+#else
+    UNUSED_PARAM(cls);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h
index 126533c529..cbe4aeae85 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -40,12 +40,21 @@ typedef struct _NSRect NSRect;
 #endif
 
 #ifdef __OBJC__
+@class NSArray;
 @class NSButtonCell;
 @class NSData;
+@class NSDate;
 @class NSEvent;
 @class NSFont;
+@class NSImage;
+@class NSMenu;
 @class NSMutableURLRequest;
+@class NSString;
+@class NSTextFieldCell;
+@class NSURLConnection;
 @class NSURLRequest;
+@class NSURLResponse;
+@class NSView;
 @class QTMovie;
 @class QTMovieView;
 #else
@@ -95,8 +104,8 @@ extern void (*wkDrawFocusRing)(CGContextRef, CGColorRef, int radius);
 extern NSFont* (*wkGetFontInLanguageForRange)(NSFont*, NSString*, NSRange);
 extern NSFont* (*wkGetFontInLanguageForCharacter)(NSFont*, UniChar);
 extern BOOL (*wkGetGlyphTransformedAdvances)(CGFontRef, NSFont*, CGAffineTransform*, ATSGlyphRef*, CGSize* advance);
-extern void (*wkDrawMediaSliderTrack)(CGContextRef context, CGRect rect, float timeLoaded, float currentTime, float duration);
-extern void (*wkDrawMediaUIPart)(int part, CGContextRef context, CGRect rect, BOOL active);
+extern void (*wkDrawMediaSliderTrack)(int themeStyle, CGContextRef context, CGRect rect, float timeLoaded, float currentTime, float duration);
+extern void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect rect, BOOL active);
 extern NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
 extern NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 extern NSString* (*wkGetMIMETypeForExtension)(NSString*);
@@ -105,11 +114,14 @@ extern double (*wkGetNSURLResponseCalculatedExpiration)(NSURLResponse *response)
 extern NSDate *(*wkGetNSURLResponseLastModifiedDate)(NSURLResponse *response);
 extern BOOL (*wkGetNSURLResponseMustRevalidate)(NSURLResponse *response);
 extern void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, BOOL* continuous);
-extern BOOL (*wkHitTestMediaUIPart)(int part, CGRect bounds, CGPoint point);
-extern void (*wkMeasureMediaUIPart)(int part, CGRect *bounds, CGSize *naturalSize);
+extern BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
+extern void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 extern void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
+extern unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 extern int (*wkQTMovieDataRate)(QTMovie*);
 extern float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
+extern NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
+extern float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 extern void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 extern void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 extern void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -121,6 +133,7 @@ extern void (*wkSetUpFontCache)();
 extern void (*wkSignalCFReadStreamEnd)(CFReadStreamRef stream);
 extern void (*wkSignalCFReadStreamError)(CFReadStreamRef stream, CFStreamError *error);
 extern void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
+extern unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
 
 #ifndef BUILDING_ON_TIGER
 extern void (*wkGetGlyphsForCharacters)(CGFontRef, const UniChar[], CGGlyph[], size_t);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm
index d7ca824645..05d1da6940 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -25,6 +25,7 @@
 
 #import "config.h"
 #import "WebCoreSystemInterface.h"
+#import <Foundation/Foundation.h>
 
 void (*wkAdvanceDefaultButtonPulseAnimation)(NSButtonCell *);
 BOOL (*wkCGContextGetShouldSmoothFonts)(CGContextRef);
@@ -38,11 +39,10 @@ void (*wkDrawFocusRing)(CGContextRef, CGColorRef, int radius);
 NSFont* (*wkGetFontInLanguageForRange)(NSFont*, NSString*, NSRange);
 NSFont* (*wkGetFontInLanguageForCharacter)(NSFont*, UniChar);
 BOOL (*wkGetGlyphTransformedAdvances)(CGFontRef, NSFont*, CGAffineTransform*, ATSGlyphRef*, CGSize* advance);
-void (*wkDrawMediaSliderTrack)(CGContextRef context, CGRect rect, float timeLoaded, float currentTime, float duration);
-BOOL (*wkUseSharedMediaUI)();
-BOOL (*wkHitTestMediaUIPart)(int part, CGRect bounds, CGPoint point);
-void (*wkDrawMediaUIPart)(int part, CGContextRef context, CGRect rect, BOOL active);
-void (*wkMeasureMediaUIPart)(int part, CGRect *bounds, CGSize *naturalSize);
+void (*wkDrawMediaSliderTrack)(int themeStyle, CGContextRef context, CGRect rect, float timeLoaded, float currentTime, float duration);
+BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
+void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect rect, BOOL active);
+void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
 NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 NSString* (*wkGetMIMETypeForExtension)(NSString*);
@@ -51,8 +51,11 @@ NSDate *(*wkGetNSURLResponseLastModifiedDate)(NSURLResponse *response);
 BOOL (*wkGetNSURLResponseMustRevalidate)(NSURLResponse *response);
 void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, BOOL* continuous);
 void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
+unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 int (*wkQTMovieDataRate)(QTMovie*);
 float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
+NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
+float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -74,6 +77,7 @@ CFReadStreamRef (*wkCreateCustomCFReadStream)(void *(*formCreate)(CFReadStreamRe
 void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 id (*wkCreateNSURLConnectionDelegateProxy)(void);
+unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
 
 #ifndef BUILDING_ON_TIGER
 void (*wkGetGlyphsForCharacters)(CGFontRef, const UniChar[], CGGlyph[], size_t);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreTextRenderer.mm b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreTextRenderer.mm
deleted file mode 100644
index 0cd596752f..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreTextRenderer.mm
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#import "config.h"
-#import "WebCoreTextRenderer.h"
-
-#import "Font.h"
-#import "SimpleFontData.h"
-#import "GraphicsContext.h"
-#import "IntPoint.h"
-#import "WebFontCache.h"
-
-using namespace WebCore;
-
-void WebCoreDrawTextAtPoint(const UniChar* buffer, unsigned length, NSPoint point, NSFont* font, NSColor* textColor)
-{
-    NSGraphicsContext *nsContext = [NSGraphicsContext currentContext];
-    CGContextRef cgContext = (CGContextRef)[nsContext graphicsPort];
-    GraphicsContext graphicsContext(cgContext);    
-    // Safari doesn't flip the NSGraphicsContext before calling WebKit, yet WebCore requires a flipped graphics context.
-    BOOL flipped = [nsContext isFlipped];
-    if (!flipped)
-        CGContextScaleCTM(cgContext, 1.0f, -1.0f);
-    
-    FontPlatformData f(font);
-    Font renderer(f, ![[NSGraphicsContext currentContext] isDrawingToScreen]);
-    TextRun run(buffer, length);
-    run.disableRoundingHacks();
-    CGFloat red, green, blue, alpha;
-    [[textColor colorUsingColorSpaceName:NSDeviceRGBColorSpace] getRed:&red green:&green blue:&blue alpha:&alpha];
-    graphicsContext.setFillColor(makeRGBA((int)(red * 255), (int)(green * 255), (int)(blue * 255), (int)(alpha * 255)));
-    renderer.drawText(&graphicsContext, run, FloatPoint(point.x, (flipped ? point.y : (-1.0f * point.y))));
-    if (!flipped)
-        CGContextScaleCTM(cgContext, 1.0f, -1.0f);
-}
-
-float WebCoreTextFloatWidth(const UniChar* buffer, unsigned length , NSFont* font)
-{
-    FontPlatformData f(font);
-    Font renderer(f, ![[NSGraphicsContext currentContext] isDrawingToScreen]);
-    TextRun run(buffer, length);
-    run.disableRoundingHacks();
-    return renderer.floatWidth(run);
-}
-
-static bool gShouldUseFontSmoothing = true;
-
-void WebCoreSetShouldUseFontSmoothing(bool smooth)
-{
-    gShouldUseFontSmoothing = smooth;
-}
-
-bool WebCoreShouldUseFontSmoothing()
-{
-    return gShouldUseFontSmoothing;
-}
-
-void WebCoreSetAlwaysUsesComplexTextCodePath(bool complex)
-{
-    Font::setCodePath(complex ? Font::Complex : Font::Auto);
-}
-
-bool WebCoreAlwaysUsesComplexTextCodePath()
-{
-    return Font::codePath() == Font::Complex;
-}
-
-NSFont* WebCoreFindFont(NSString* familyName, NSFontTraitMask traits, int weight, int size)
-{
-    return [WebFontCache fontWithFamily:familyName traits:traits weight:weight size:size];
-}
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.h b/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.h
index b31a6845d9..380f271e2a 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.h
@@ -24,11 +24,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include <wtf/Vector.h>
+#import <AppKit/NSFontManager.h>
+#import <wtf/Vector.h>
 
 // This interface exists so that third party products (like Silk) can patch in to an Obj-C method to manipulate WebKit's font caching/substitution.
 @interface WebFontCache : NSObject
 + (NSFont *)fontWithFamily:(NSString *)desiredFamily traits:(NSFontTraitMask)desiredTraits weight:(int)desiredWeight size:(float)size;
 + (void)getTraits:(Vector<unsigned>&)traitsMasks inFamily:(NSString *)desiredFamily;
 
+// This older version of the interface is relied upon by some clients. WebCore doesn't use it.
++ (NSFont *)fontWithFamily:(NSString *)desiredFamily traits:(NSFontTraitMask)desiredTraits size:(float)size;
 @end
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.mm b/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.mm
index 84f60b5731..22e6291069 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebFontCache.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,10 +28,13 @@
  */
 
 #import "config.h"
-#import "FontTraitsMask.h"
 #import "WebFontCache.h"
 
+#import "FontTraitsMask.h"
+#import <AppKit/AppKit.h>
+#import <Foundation/Foundation.h>
 #import <math.h>
+#import <wtf/UnusedParam.h>
 
 using namespace WebCore;
 
@@ -51,7 +54,7 @@ typedef int NSInteger;
     | NSSmallCapsFontMask \
 )
 
-static BOOL acceptableChoice(NSFontTraitMask desiredTraits, int desiredWeight, NSFontTraitMask candidateTraits, int candidateWeight)
+static BOOL acceptableChoice(NSFontTraitMask desiredTraits, NSFontTraitMask candidateTraits)
 {
     desiredTraits &= ~SYNTHESIZED_FONT_TRAITS;
     return (candidateTraits & desiredTraits) == desiredTraits;
@@ -61,7 +64,7 @@ static BOOL betterChoice(NSFontTraitMask desiredTraits, int desiredWeight,
     NSFontTraitMask chosenTraits, int chosenWeight,
     NSFontTraitMask candidateTraits, int candidateWeight)
 {
-    if (!acceptableChoice(desiredTraits, desiredWeight, candidateTraits, candidateWeight))
+    if (!acceptableChoice(desiredTraits, candidateTraits))
         return NO;
 
     // A list of the traits we care about.
@@ -104,8 +107,13 @@ static BOOL betterChoice(NSFontTraitMask desiredTraits, int desiredWeight,
 // Workaround for <rdar://problem/5781372>.
 static inline void fixUpWeight(NSInteger& weight, NSString *fontName)
 {
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    UNUSED_PARAM(weight);
+    UNUSED_PARAM(fontName);
+#else
     if (weight == 3 && [fontName rangeOfString:@"ultralight" options:NSCaseInsensitiveSearch | NSBackwardsSearch | NSLiteralSearch].location != NSNotFound)
         weight = 2;
+#endif
 }
 
 static inline FontTraitsMask toTraitsMask(NSFontTraitMask appKitTraits, NSInteger appKitWeight)
@@ -230,7 +238,7 @@ static inline FontTraitsMask toTraitsMask(NSFontTraitMask appKitTraits, NSIntege
 
         BOOL newWinner;
         if (!choseFont)
-            newWinner = acceptableChoice(desiredTraits, desiredWeight, fontTraits, fontWeight);
+            newWinner = acceptableChoice(desiredTraits, fontTraits);
         else
             newWinner = betterChoice(desiredTraits, desiredWeight, chosenTraits, chosenWeight, fontTraits, fontWeight);
 
@@ -298,4 +306,10 @@ static inline FontTraitsMask toTraitsMask(NSFontTraitMask appKitTraits, NSIntege
     return [self internalFontWithFamily:desiredFamily traits:desiredTraits weight:desiredWeight size:size];
 }
 
++ (NSFont *)fontWithFamily:(NSString *)desiredFamily traits:(NSFontTraitMask)desiredTraits size:(float)size
+{
+    int desiredWeight = (desiredTraits & NSBoldFontMask) ? 9 : 5;
+    return [self fontWithFamily:desiredFamily traits:desiredTraits weight:desiredWeight size:size];
+}
+
 @end
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm
index 7b60494031..f380e3e03d 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WheelEventMac.mm
@@ -27,13 +27,15 @@
 #import "PlatformWheelEvent.h"
 
 #import "PlatformMouseEvent.h"
+#import "Scrollbar.h"
 #import "WebCoreSystemInterface.h"
 
 namespace WebCore {
 
-PlatformWheelEvent::PlatformWheelEvent(NSEvent* event)
-    : m_position(pointForEvent(event))
+PlatformWheelEvent::PlatformWheelEvent(NSEvent* event, NSView *windowView)
+    : m_position(pointForEvent(event, windowView))
     , m_globalPosition(globalPointForEvent(event))
+    , m_granularity(ScrollByPixelWheelEvent)
     , m_isAccepted(false)
     , m_shiftKey([event modifierFlags] & NSShiftKeyMask)
     , m_ctrlKey([event modifierFlags] & NSControlKeyMask)
@@ -42,10 +44,14 @@ PlatformWheelEvent::PlatformWheelEvent(NSEvent* event)
 {
     BOOL continuous;
     wkGetWheelEventDeltas(event, &m_deltaX, &m_deltaY, &continuous);
-    m_granularity = continuous ? ScrollByPixelWheelEvent : ScrollByLineWheelEvent;
-    if (m_granularity == ScrollByLineWheelEvent) {
-        m_deltaX *= horizontalLineMultiplier();
-        m_deltaY *= verticalLineMultiplier();
+    if (continuous) {
+        m_wheelTicksX = m_deltaX / static_cast<float>(cScrollbarPixelsPerLineStep);
+        m_wheelTicksY = m_deltaY / static_cast<float>(cScrollbarPixelsPerLineStep);
+    } else {
+        m_wheelTicksX = m_deltaX;
+        m_wheelTicksY = m_deltaY;
+        m_deltaX *= static_cast<float>(cScrollbarPixelsPerLineStep);
+        m_deltaY *= static_cast<float>(cScrollbarPixelsPerLineStep);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm
index 3fe8e0d8fe..1aaf4b2212 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WidgetMac.mm
@@ -26,6 +26,10 @@
 #import "config.h"
 #import "Widget.h"
 
+#ifdef BUILDING_ON_TIGER
+#import "AutodrainedPool.h"
+#endif
+
 #import "BlockExceptions.h"
 #import "Cursor.h"
 #import "Document.h"
@@ -38,7 +42,6 @@
 #import "ScrollView.h"
 #import "WebCoreFrameView.h"
 #import "WebCoreView.h"
-
 #import <wtf/RetainPtr.h>
 
 @interface NSWindow (WebWindowDetails)
@@ -218,8 +221,13 @@ void Widget::paint(GraphicsContext* p, const IntRect& r)
         CGContextScaleCTM(cgContext, 1, -1);
 
         BEGIN_BLOCK_OBJC_EXCEPTIONS;
-        NSGraphicsContext *nsContext = [NSGraphicsContext graphicsContextWithGraphicsPort:cgContext flipped:YES];
-        [view displayRectIgnoringOpacity:[view convertRect:r fromView:[view superview]] inContext:nsContext];
+        {
+#ifdef BUILDING_ON_TIGER
+            AutodrainedPool pool;
+#endif
+            NSGraphicsContext *nsContext = [NSGraphicsContext graphicsContextWithGraphicsPort:cgContext flipped:YES];
+            [view displayRectIgnoringOpacity:[view convertRect:r fromView:[view superview]] inContext:nsContext];
+        }
         END_BLOCK_OBJC_EXCEPTIONS;
 
         CGContextRestoreGState(cgContext);
@@ -252,10 +260,10 @@ void Widget::removeFromSuperview()
     }
 }
 
-void Widget::beforeMouseDown(NSView *view, Widget* widget)
+void Widget::beforeMouseDown(NSView *unusedView, Widget* widget)
 {
     if (widget) {
-        ASSERT(view == widget->getOuterView());
+        ASSERT_UNUSED(unusedView, unusedView == widget->getOuterView());
         ASSERT(!widget->m_data->mustStayInWindow);
         widget->m_data->mustStayInWindow = true;
     }
@@ -277,7 +285,9 @@ void Widget::afterMouseDown(NSView *view, Widget* widget)
 
 IntPoint Widget::convertFromContainingWindow(const IntPoint& point) const
 {
-    if (!platformWidget() && parent()) {
+    if (!platformWidget()) {
+        if (!parent())
+            return point;
         IntPoint result = parent()->convertFromContainingWindow(point);
         result.move(parent()->scrollX() - x(), parent()->scrollY() - y());
         return result;
@@ -292,7 +302,9 @@ IntPoint Widget::convertFromContainingWindow(const IntPoint& point) const
 
 IntRect Widget::convertFromContainingWindow(const IntRect& rect) const
 {
-    if (!platformWidget() && parent()) {
+    if (!platformWidget()) {
+        if (!parent())
+            return rect;
         IntRect result = parent()->convertFromContainingWindow(rect);
         result.move(parent()->scrollX() - x(), parent()->scrollY() - y());
         return result;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp b/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp
index 0d318560ac..af3b7f0782 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/FormData.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,7 +29,8 @@
 namespace WebCore {
 
 inline FormData::FormData()
-    : m_hasGeneratedFiles(false)
+    : m_identifier(0)
+    , m_hasGeneratedFiles(false)
     , m_alwaysStream(false)
 {
 }
@@ -36,6 +38,7 @@ inline FormData::FormData()
 inline FormData::FormData(const FormData& data)
     : RefCounted<FormData>()
     , m_elements(data.m_elements)
+    , m_identifier(data.m_identifier)
     , m_hasGeneratedFiles(false)
     , m_alwaysStream(false)
 {
@@ -90,6 +93,28 @@ PassRefPtr<FormData> FormData::copy() const
     return adoptRef(new FormData(*this));
 }
 
+PassRefPtr<FormData> FormData::deepCopy() const
+{
+    RefPtr<FormData> formData(create());
+
+    formData->m_alwaysStream = m_alwaysStream;
+
+    size_t n = m_elements.size();
+    formData->m_elements.reserveInitialCapacity(n);
+    for (size_t i = 0; i < n; ++i) {
+        const FormDataElement& e = m_elements[i];
+        switch (e.m_type) {
+        case FormDataElement::data:
+            formData->m_elements.append(FormDataElement(e.m_data));
+            break;
+        case FormDataElement::encodedFile:
+            formData->m_elements.append(FormDataElement(e.m_filename, e.m_shouldGenerateFile));
+            break;
+        }
+    }
+    return formData.release();
+}
+
 void FormData::appendData(const void* data, size_t size)
 {
     if (m_elements.isEmpty() || m_elements.last().m_type != FormDataElement::data)
diff --git a/src/3rdparty/webkit/WebCore/platform/network/FormData.h b/src/3rdparty/webkit/WebCore/platform/network/FormData.h
index cb91fab327..7278f2eee5 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/FormData.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/FormData.h
@@ -68,6 +68,7 @@ public:
     static PassRefPtr<FormData> create(const CString&);
     static PassRefPtr<FormData> create(const Vector<char>&);
     PassRefPtr<FormData> copy() const;
+    PassRefPtr<FormData> deepCopy() const;
     ~FormData();
     
     void appendData(const void* data, size_t);
@@ -85,11 +86,17 @@ public:
     bool alwaysStream() const { return m_alwaysStream; }
     void setAlwaysStream(bool alwaysStream) { m_alwaysStream = alwaysStream; }
 
+    // Identifies a particular form submission instance.  A value of 0 is used
+    // to indicate an unspecified identifier.
+    void setIdentifier(int64_t identifier) { m_identifier = identifier; }
+    int64_t identifier() const { return m_identifier; }
+
 private:
     FormData();
     FormData(const FormData&);
-     
+
     Vector<FormDataElement> m_elements;
+    int64_t m_identifier;
     bool m_hasGeneratedFiles;
     bool m_alwaysStream;
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
new file mode 100644
index 0000000000..ff470a0235
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HTTPHeaderMap.h"
+
+#include <memory>
+#include <utility>
+
+using namespace std;
+
+namespace WebCore {
+
+auto_ptr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
+{
+    auto_ptr<CrossThreadHTTPHeaderMapData> data(new CrossThreadHTTPHeaderMapData());
+    data->reserveInitialCapacity(size());
+
+    HTTPHeaderMap::const_iterator end_it = end();
+    for (HTTPHeaderMap::const_iterator it = begin(); it != end_it; ++it) {
+        data->append(make_pair(it->first.string().copy(), it->second.copy()));
+    }
+    return data;
+}
+
+void HTTPHeaderMap::adopt(auto_ptr<CrossThreadHTTPHeaderMapData> data)
+{
+    clear();
+    size_t dataSize = data->size();
+    for (size_t index = 0; index < dataSize; ++index) {
+        pair<String, String>& header = (*data)[index];
+        set(header.first, header.second);
+    }
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h
index 37ba39ab8e..6da1b90ad0 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,11 +30,22 @@
 #include "AtomicString.h"
 #include "AtomicStringHash.h"
 #include "StringHash.h"
+#include <memory>
+#include <utility>
 #include <wtf/HashMap.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-    typedef HashMap<AtomicString, String, CaseFoldingHash> HTTPHeaderMap;
+    typedef Vector<std::pair<String, String> > CrossThreadHTTPHeaderMapData;
+
+    class HTTPHeaderMap : public HashMap<AtomicString, String, CaseFoldingHash> {
+    public:
+        // Gets a copy of the data suitable for passing to another thread.
+        std::auto_ptr<CrossThreadHTTPHeaderMapData> copyData() const;
+
+        void adopt(std::auto_ptr<CrossThreadHTTPHeaderMapData>);
+    };
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
index 0858fc98e1..ad65dfefa2 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,12 +40,13 @@ static inline bool skipWhiteSpace(const String& str, int& pos, bool fromHttpEqui
 {
     int len = str.length();
 
-    if (fromHttpEquivMeta)
+    if (fromHttpEquivMeta) {
         while (pos != len && str[pos] <= ' ')
             ++pos;
-    else
+    } else {
         while (pos != len && (str[pos] == '\t' || str[pos] == ' '))
             ++pos;
+    }
 
     return pos != len;
 }
@@ -131,18 +133,37 @@ String filenameFromHTTPContentDisposition(const String& value)
 
 String extractMIMETypeFromMediaType(const String& mediaType)
 {
-    String mimeType;
+    Vector<UChar, 64> mimeType;
     unsigned length = mediaType.length();
-    for (unsigned offset = 0; offset < length; offset++) {
-        UChar c = mediaType[offset];
+    mimeType.reserveCapacity(length);
+    for (unsigned i = 0; i < length; i++) {
+        UChar c = mediaType[i];
+
         if (c == ';')
             break;
-        else if (isSpaceOrNewline(c)) // FIXME: This seems wrong, " " is an invalid MIME type character according to RFC 2045.  bug 8644
+
+        // While RFC 2616 does not allow it, other browsers allow multiple values in the HTTP media
+        // type header field, Content-Type. In such cases, the media type string passed here may contain
+        // the multiple values separated by commas. For now, this code ignores text after the first comma,
+        // which prevents it from simply failing to parse such types altogether. Later for better
+        // compatibility we could consider using the first or last valid MIME type instead.
+        // See https://bugs.webkit.org/show_bug.cgi?id=25352 for more discussion.
+        if (c == ',')
+            break;
+
+        // FIXME: The following is not correct. RFC 2616 allows linear white space before and
+        // after the MIME type, but not within the MIME type itself. And linear white space
+        // includes only a few specific ASCII characters; a small subset of isSpaceOrNewline.
+        // See https://bugs.webkit.org/show_bug.cgi?id=8644 for a bug tracking part of this.
+        if (isSpaceOrNewline(c))
             continue;
-        // FIXME: This is a very slow way to build a string, given WebCore::String's implementation.
-        mimeType += String(&c, 1);
+
+        mimeType.append(c);
     }
-    return mimeType;
+
+    if (mimeType.size() == length)
+        return mediaType;
+    return String(mimeType.data(), mimeType.size());
 }
 
 String extractCharsetFromMediaType(const String& mediaType)
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
index 1ea35b0dc0..370650f6ad 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,6 +29,20 @@
 
 namespace WebCore {
 
+ResourceError ResourceErrorBase::copy() const
+{
+    lazyInit();
+
+    ResourceError errorCopy;
+    errorCopy.m_domain = m_domain.copy();
+    errorCopy.m_errorCode = m_errorCode;
+    errorCopy.m_failingURL = m_failingURL.copy();
+    errorCopy.m_localizedDescription = m_localizedDescription.copy();
+    errorCopy.m_isNull = m_isNull;
+    errorCopy.m_isCancellation = m_isCancellation;
+    return errorCopy;
+}
+
 void ResourceErrorBase::lazyInit() const
 {
     const_cast<ResourceError*>(static_cast<const ResourceError*>(this))->platformLazyInit();
@@ -59,4 +74,4 @@ bool ResourceErrorBase::compare(const ResourceError& a, const ResourceError& b)
     return platformCompare(a, b);
 }
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.h
index 4631324502..237db9ebf8 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.h
@@ -34,6 +34,9 @@ class ResourceError;
 
 class ResourceErrorBase {
 public:
+    // Makes a deep copy. Useful for when you need to use a ResourceError on another thread.
+    ResourceError copy() const;
+
     bool isNull() const { return m_isNull; }
 
     const String& domain() const { lazyInit(); return m_domain; }
@@ -44,7 +47,7 @@ public:
     void setIsCancellation(bool isCancellation) { m_isCancellation = isCancellation; }
     bool isCancellation() const { return m_isCancellation; }
 
-    static bool compare(const ResourceError& a, const ResourceError& b);
+    static bool compare(const ResourceError&, const ResourceError&);
 
 protected:
     ResourceErrorBase()
@@ -85,4 +88,4 @@ inline bool operator!=(const ResourceError& a, const ResourceError& b) { return
 
 } // namespace WebCore
 
-#endif // ResourceErrorBase_h_
+#endif // ResourceErrorBase_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp
index 149411e90d..5a40b21a0d 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.cpp
@@ -34,6 +34,8 @@
 
 namespace WebCore {
 
+static bool shouldForceContentSniffing;
+
 static bool portAllowed(const ResourceRequest&);
 
 ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading,
@@ -45,6 +47,9 @@ ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleCli
 PassRefPtr<ResourceHandle> ResourceHandle::create(const ResourceRequest& request, ResourceHandleClient* client,
     Frame* frame, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle)
 {
+    if (shouldContentSniff)
+        shouldContentSniff = shouldContentSniffURL(request.url());
+
     RefPtr<ResourceHandle> newHandle(adoptRef(new ResourceHandle(request, client, defersLoading, shouldContentSniff, mightDownloadFromHandle)));
 
     if (!request.url().isValid()) {
@@ -178,6 +183,7 @@ static bool portAllowed(const ResourceRequest& request)
         993,  // IMAP+SSL
         995,  // POP3+SSL
         2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
         4045, // lockd
         6000, // X11
     };
@@ -199,4 +205,24 @@ static bool portAllowed(const ResourceRequest& request)
     return false;
 }
   
+bool ResourceHandle::shouldContentSniff() const
+{
+    return d->m_shouldContentSniff;
+}
+
+bool ResourceHandle::shouldContentSniffURL(const KURL& url)
+{
+#if PLATFORM(MAC)
+    if (shouldForceContentSniffing)
+        return true;
+#endif
+    // We shouldn't content sniff file URLs as their MIME type should be established via their extension.
+    return !url.protocolIs("file");
+}
+
+void ResourceHandle::forceContentSniffing()
+{
+    shouldForceContentSniffing = true;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
index c93af21747..f0e1e944f5 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
@@ -28,8 +28,13 @@
 
 #include "AuthenticationChallenge.h"
 #include "HTTPHeaderMap.h"
+#include "ThreadableLoader.h"
 #include <wtf/OwnPtr.h>
 
+#if USE(SOUP)
+typedef struct _SoupSession SoupSession;
+#endif
+
 #if PLATFORM(CF)
 typedef const struct __CFData * CFDataRef;
 #endif
@@ -79,7 +84,7 @@ class KURL;
 class ResourceError;
 class ResourceHandleClient;
 class ResourceHandleInternal;
-class ResourceRequest;
+struct ResourceRequest;
 class ResourceResponse;
 class SchedulePair;
 class SharedBuffer;
@@ -99,7 +104,7 @@ public:
     // FIXME: should not need the Frame
     static PassRefPtr<ResourceHandle> create(const ResourceRequest&, ResourceHandleClient*, Frame*, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle = false);
 
-    static void loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data, Frame* frame);
+    static void loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data, Frame* frame);
     static bool willLoadFromCache(ResourceRequest&);
 #if PLATFORM(MAC)
     static bool didSendBodyDataDelegateExists();
@@ -108,6 +113,7 @@ public:
     ~ResourceHandle();
 
 #if PLATFORM(MAC) || USE(CFNETWORK)
+    void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
     bool shouldUseCredentialStorage();
 #endif
 #if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
@@ -144,6 +150,11 @@ public:
     PassRefPtr<SharedBuffer> bufferedData();
     static bool supportsBufferedData();
 
+    bool shouldContentSniff() const;
+    static bool shouldContentSniffURL(const KURL&);
+
+    static void forceContentSniffing();
+
 #if USE(WININET)
     void setHasReceivedResponse(bool = true);
     bool hasReceivedResponse() const;
@@ -159,6 +170,10 @@ public:
     ResourceHandleInternal* getInternal() { return d.get(); }
 #endif
 
+#if USE(SOUP)
+    static SoupSession* defaultSession();
+#endif
+
     // Used to work around the fact that you don't get any more NSURLConnection callbacks until you return from the one you're in.
     static bool loadsBlocked();    
     
@@ -179,7 +194,7 @@ private:
 #if USE(SOUP)
     bool startData(String urlString);
     bool startHttp(String urlString);
-    bool startGio(String urlString);
+    bool startGio(KURL url);
 #endif
 
     void scheduleFailure(FailureType);
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
index 3668d8883f..c99be54d65 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
@@ -32,6 +32,7 @@
 
 #if USE(CFNETWORK)
 #include <ConditionalMacros.h>
+#include <CFNetwork/CFURLCachePriv.h>
 #include <CFNetwork/CFURLResponsePriv.h>
 #endif
 
@@ -49,7 +50,7 @@ namespace WebCore {
     class KURL;
     class ResourceHandle;
     class ResourceError;
-    class ResourceRequest;
+    struct ResourceRequest;
     class ResourceResponse;
 
     enum CacheStoragePolicy {
@@ -78,14 +79,15 @@ namespace WebCore {
         virtual bool shouldUseCredentialStorage(ResourceHandle*) { return false; }
         virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge&) { }
         virtual void didCancelAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge&) { }
-        virtual void receivedCredential(ResourceHandle*, const AuthenticationChallenge&, const Credential&) { }
-        virtual void receivedRequestToContinueWithoutCredential(ResourceHandle*, const AuthenticationChallenge&) { }
         virtual void receivedCancellation(ResourceHandle*, const AuthenticationChallenge&) { }
 
 #if PLATFORM(MAC)        
         virtual NSCachedURLResponse* willCacheResponse(ResourceHandle*, NSCachedURLResponse* response) { return response; }
         virtual void willStopBufferingData(ResourceHandle*, const char*, int) { } 
 #endif
+#if USE(CFNETWORK)
+        virtual bool shouldCacheResponse(ResourceHandle*, CFCachedURLResponseRef response) { return true; }
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
index 66aa4c16c9..8b0f476d5e 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
@@ -47,6 +47,7 @@
 
 #if USE(SOUP)
 #include <libsoup/soup.h>
+class Frame;
 #endif
 
 #if PLATFORM(QT)
@@ -110,13 +111,15 @@ namespace WebCore {
 #if USE(SOUP)
             , m_msg(0)
             , m_cancelled(false)
+            , m_reportedHeaders(false)
             , m_gfile(0)
-            , m_input_stream(0)
+            , m_inputStream(0)
             , m_cancellable(0)
             , m_buffer(0)
-            , m_bufsize(0)
+            , m_bufferSize(0)
             , m_total(0)
             , m_idleHandler(0)
+            , m_frame(0)
 #endif
 #if PLATFORM(QT)
             , m_job(0)
@@ -124,12 +127,17 @@ namespace WebCore {
 #endif
 #if PLATFORM(MAC)
             , m_startWhenScheduled(false)
+            , m_needsSiteSpecificQuirks(false)
             , m_currentMacChallenge(nil)
 #elif USE(CFNETWORK)
             , m_currentCFChallenge(0)
 #endif
             , m_failureTimer(loader, &ResourceHandle::fireFailure)
         {
+            const KURL& url = m_request.url();
+            m_user = url.user();
+            m_pass = url.pass();
+            m_request.removeCredentials();
         }
         
         ~ResourceHandleInternal();
@@ -138,6 +146,10 @@ namespace WebCore {
         ResourceHandleClient* m_client;
         
         ResourceRequest m_request;
+
+        // Suggested credentials for the current redirection step.
+        String m_user;
+        String m_pass;
         
         int status;
 
@@ -151,6 +163,7 @@ namespace WebCore {
         RetainPtr<WebCoreResourceHandleAsDelegate> m_delegate;
         RetainPtr<id> m_proxy;
         bool m_startWhenScheduled;
+        bool m_needsSiteSpecificQuirks;
 #endif
 #if USE(WININET)
         HANDLE m_fileHandle;
@@ -181,12 +194,14 @@ namespace WebCore {
         SoupMessage* m_msg;
         ResourceResponse m_response;
         bool m_cancelled;
+        bool m_reportedHeaders;
         GFile* m_gfile;
-        GInputStream* m_input_stream;
+        GInputStream* m_inputStream;
         GCancellable* m_cancellable;
         char* m_buffer;
-        gsize m_bufsize, m_total;
+        gsize m_bufferSize, m_total;
         guint m_idleHandler;
+        Frame* m_frame;
 #endif
 #if PLATFORM(QT)
 #if QT_VERSION < 0x040400
@@ -196,6 +211,8 @@ namespace WebCore {
 #endif
         QWebFrame* m_frame;
 #endif
+
+        // FIXME: The platform challenge is almost identical to the one stored in m_currentWebChallenge, but it has a different sender. We only need to store a sender reference here.
 #if PLATFORM(MAC)
         NSURLAuthenticationChallenge *m_currentMacChallenge;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
index 3984d8e9d1..bfa3dc623d 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +27,8 @@
 #include "ResourceRequestBase.h"
 #include "ResourceRequest.h"
 
+using namespace std;
+
 namespace WebCore {
 
 inline const ResourceRequest& ResourceRequestBase::asResourceRequest() const
@@ -33,6 +36,57 @@ inline const ResourceRequest& ResourceRequestBase::asResourceRequest() const
     return *static_cast<const ResourceRequest*>(this);
 }
 
+auto_ptr<ResourceRequest> ResourceRequestBase::adopt(auto_ptr<CrossThreadResourceRequestData> data)
+{
+    auto_ptr<ResourceRequest> request(new ResourceRequest());
+    request->setURL(data->m_url);
+    request->setCachePolicy(data->m_cachePolicy);
+    request->setTimeoutInterval(data->m_timeoutInterval);
+    request->setFirstPartyForCookies(data->m_firstPartyForCookies);
+    request->setHTTPMethod(data->m_httpMethod);
+
+    request->updateResourceRequest();
+    request->m_httpHeaderFields.adopt(auto_ptr<CrossThreadHTTPHeaderMapData>(data->m_httpHeaders.release()));
+
+    size_t encodingCount = data->m_responseContentDispositionEncodingFallbackArray.size();
+    if (encodingCount > 0) {
+        String encoding1 = data->m_responseContentDispositionEncodingFallbackArray[0];
+        String encoding2;
+        String encoding3;
+        if (encodingCount > 1) {
+            encoding2 = data->m_responseContentDispositionEncodingFallbackArray[1];
+            if (encodingCount > 2)
+                encoding3 = data->m_responseContentDispositionEncodingFallbackArray[2];
+        }
+        ASSERT(encodingCount <= 3);
+        request->setResponseContentDispositionEncodingFallbackArray(encoding1, encoding2, encoding3);
+    }
+    request->setHTTPBody(data->m_httpBody);
+    request->setAllowHTTPCookies(data->m_allowHTTPCookies);
+    return request;
+}
+
+auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
+{
+    auto_ptr<CrossThreadResourceRequestData> data(new CrossThreadResourceRequestData());
+    data->m_url = url().copy();
+    data->m_cachePolicy = cachePolicy();
+    data->m_timeoutInterval = timeoutInterval();
+    data->m_firstPartyForCookies = firstPartyForCookies().copy();
+    data->m_httpMethod = httpMethod().copy();
+    data->m_httpHeaders.adopt(httpHeaderFields().copyData());
+
+    data->m_responseContentDispositionEncodingFallbackArray.reserveInitialCapacity(m_responseContentDispositionEncodingFallbackArray.size());
+    size_t encodingArraySize = m_responseContentDispositionEncodingFallbackArray.size();
+    for (size_t index = 0; index < encodingArraySize; ++index) {
+        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].copy());
+    }
+    if (m_httpBody)
+        data->m_httpBody = m_httpBody->deepCopy();
+    data->m_allowHTTPCookies = m_allowHTTPCookies;
+    return data;
+}
+
 bool ResourceRequestBase::isEmpty() const
 {
     updateResourceRequest(); 
@@ -63,6 +117,16 @@ void ResourceRequestBase::setURL(const KURL& url)
     m_platformRequestUpdated = false;
 }
 
+void ResourceRequestBase::removeCredentials()
+{
+    updateResourceRequest(); 
+
+    m_url.setUser(String());
+    m_url.setPass(String());
+
+    m_platformRequestUpdated = false;
+}
+
 ResourceRequestCachePolicy ResourceRequestBase::cachePolicy() const
 {
     updateResourceRequest(); 
@@ -76,7 +140,8 @@ void ResourceRequestBase::setCachePolicy(ResourceRequestCachePolicy cachePolicy)
     
     m_cachePolicy = cachePolicy;
     
-    m_platformRequestUpdated = false;
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 double ResourceRequestBase::timeoutInterval() const
@@ -92,21 +157,22 @@ void ResourceRequestBase::setTimeoutInterval(double timeoutInterval)
     
     m_timeoutInterval = timeoutInterval; 
     
-    m_platformRequestUpdated = false;
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
-const KURL& ResourceRequestBase::mainDocumentURL() const
+const KURL& ResourceRequestBase::firstPartyForCookies() const
 {
     updateResourceRequest(); 
     
-    return m_mainDocumentURL; 
+    return m_firstPartyForCookies;
 }
 
-void ResourceRequestBase::setMainDocumentURL(const KURL& mainDocumentURL)
+void ResourceRequestBase::setFirstPartyForCookies(const KURL& firstPartyForCookies)
 { 
     updateResourceRequest(); 
     
-    m_mainDocumentURL = mainDocumentURL; 
+    m_firstPartyForCookies = firstPartyForCookies;
     
     m_platformRequestUpdated = false;
 }
@@ -124,7 +190,8 @@ void ResourceRequestBase::setHTTPMethod(const String& httpMethod)
 
     m_httpMethod = httpMethod;
     
-    m_platformRequestUpdated = false;
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 const HTTPHeaderMap& ResourceRequestBase::httpHeaderFields() const
@@ -147,7 +214,8 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
     
     m_httpHeaderFields.set(name, value); 
     
-    m_platformRequestUpdated = false;
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(const String& encoding1, const String& encoding2, const String& encoding3)
@@ -162,7 +230,8 @@ void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(con
     if (!encoding3.isNull())
         m_responseContentDispositionEncodingFallbackArray.append(encoding3);
     
-    m_platformRequestUpdated = false;
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 FormData* ResourceRequestBase::httpBody() const 
@@ -178,7 +247,8 @@ void ResourceRequestBase::setHTTPBody(PassRefPtr<FormData> httpBody)
     
     m_httpBody = httpBody; 
     
-    m_platformRequestUpdated = false;
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 } 
 
 bool ResourceRequestBase::allowHTTPCookies() const 
@@ -194,7 +264,8 @@ void ResourceRequestBase::setAllowHTTPCookies(bool allowHTTPCookies)
     
     m_allowHTTPCookies = allowHTTPCookies; 
     
-    m_platformRequestUpdated = false;
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 void ResourceRequestBase::addHTTPHeaderField(const AtomicString& name, const String& value) 
@@ -223,7 +294,7 @@ bool equalIgnoringHeaderFields(const ResourceRequestBase& a, const ResourceReque
     if (a.timeoutInterval() != b.timeoutInterval())
         return false;
     
-    if (a.mainDocumentURL() != b.mainDocumentURL())
+    if (a.firstPartyForCookies() != b.firstPartyForCookies())
         return false;
     
     if (a.httpMethod() != b.httpMethod())
@@ -284,4 +355,13 @@ void ResourceRequestBase::updateResourceRequest() const
     m_resourceRequestUpdated = true;
 }
 
+#if !PLATFORM(MAC) && !USE(CFNETWORK)
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+    // This is used by the loader to control the number of issued parallel load requests. 
+    // Four seems to be a common default in HTTP frameworks.
+    return 4;
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
index 1cbf21e61b..2d87d6e361 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,9 @@
 #include "KURL.h"
 #include "HTTPHeaderMap.h"
 
+#include <memory>
+#include <wtf/OwnPtr.h>
+
 namespace WebCore {
 
     enum ResourceRequestCachePolicy {
@@ -42,25 +46,33 @@ namespace WebCore {
 
     const int unspecifiedTimeoutInterval = INT_MAX;
 
-    class ResourceRequest;
+    struct ResourceRequest;
+    struct CrossThreadResourceRequestData;
 
     // Do not use this type directly.  Use ResourceRequest instead.
     class ResourceRequestBase {
     public:
+        static std::auto_ptr<ResourceRequest> adopt(std::auto_ptr<CrossThreadResourceRequestData>);
+
+        // Gets a copy of the data suitable for passing to another thread.
+        std::auto_ptr<CrossThreadResourceRequestData> copyData() const;
+
         bool isNull() const;
         bool isEmpty() const;
 
         const KURL& url() const;
         void setURL(const KURL& url);
 
+        void removeCredentials();
+
         ResourceRequestCachePolicy cachePolicy() const;
         void setCachePolicy(ResourceRequestCachePolicy cachePolicy);
         
         double timeoutInterval() const;
         void setTimeoutInterval(double timeoutInterval);
         
-        const KURL& mainDocumentURL() const;
-        void setMainDocumentURL(const KURL& mainDocumentURL);
+        const KURL& firstPartyForCookies() const;
+        void setFirstPartyForCookies(const KURL& firstPartyForCookies);
         
         const String& httpMethod() const;
         void setHTTPMethod(const String& httpMethod);
@@ -97,12 +109,18 @@ namespace WebCore {
         void setAllowHTTPCookies(bool allowHTTPCookies);
 
         bool isConditional() const;
-        
+
+        // Whether the associated ResourceHandleClient needs to be notified of
+        // upload progress made for that resource.
+        bool reportUploadProgress() const { return m_reportUploadProgress; }
+        void setReportUploadProgress(bool reportUploadProgress) { m_reportUploadProgress = reportUploadProgress; }
+
     protected:
         // Used when ResourceRequest is initialized from a platform representation of the request
         ResourceRequestBase()
             : m_resourceRequestUpdated(false)
             , m_platformRequestUpdated(true)
+            , m_reportUploadProgress(false)
         {
         }
 
@@ -114,6 +132,7 @@ namespace WebCore {
             , m_allowHTTPCookies(true)
             , m_resourceRequestUpdated(true)
             , m_platformRequestUpdated(false)
+            , m_reportUploadProgress(false)
         {
         }
 
@@ -124,7 +143,7 @@ namespace WebCore {
 
         ResourceRequestCachePolicy m_cachePolicy;
         double m_timeoutInterval;
-        KURL m_mainDocumentURL;
+        KURL m_firstPartyForCookies;
         String m_httpMethod;
         HTTPHeaderMap m_httpHeaderFields;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
@@ -132,6 +151,7 @@ namespace WebCore {
         bool m_allowHTTPCookies;
         mutable bool m_resourceRequestUpdated;
         mutable bool m_platformRequestUpdated;
+        bool m_reportUploadProgress;
 
     private:
         const ResourceRequest& asResourceRequest() const;
@@ -142,6 +162,22 @@ namespace WebCore {
     bool operator==(const ResourceRequestBase&, const ResourceRequestBase&);
     inline bool operator!=(ResourceRequestBase& a, const ResourceRequestBase& b) { return !(a == b); }
 
+    struct CrossThreadResourceRequestData {
+        KURL m_url;
+
+        ResourceRequestCachePolicy m_cachePolicy;
+        double m_timeoutInterval;
+        KURL m_firstPartyForCookies;
+
+        String m_httpMethod;
+        OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
+        Vector<String> m_responseContentDispositionEncodingFallbackArray;
+        RefPtr<FormData> m_httpBody;
+        bool m_allowHTTPCookies;
+    };
+    
+    unsigned initializeMaximumHTTPConnectionCountPerHost();
+
 } // namespace WebCore
 
 #endif // ResourceRequestBase_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
index fb7f5c7978..3f8917f29b 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,11 +28,78 @@
 #include "ResourceResponseBase.h"
 
 #include "ResourceResponse.h"
+#include <runtime/DateMath.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
 
 namespace WebCore {
 
 static void parseCacheHeader(const String& header, Vector<pair<String, String> >& result);
-static void parseCacheControlDirectiveValues(const String& directives, Vector<String>& result);
+
+ResourceResponseBase::ResourceResponseBase()  
+    : m_expectedContentLength(0)
+    , m_httpStatusCode(0)
+    , m_isNull(true)
+    , m_haveParsedCacheControlHeader(false)
+    , m_haveParsedAgeHeader(false)
+    , m_haveParsedDateHeader(false)
+    , m_haveParsedExpiresHeader(false)
+    , m_haveParsedLastModifiedHeader(false)
+{
+}
+
+ResourceResponseBase::ResourceResponseBase(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
+    : m_url(url)
+    , m_mimeType(mimeType)
+    , m_expectedContentLength(expectedLength)
+    , m_textEncodingName(textEncodingName)
+    , m_suggestedFilename(filename)
+    , m_httpStatusCode(0)
+    , m_isNull(false)
+    , m_haveParsedCacheControlHeader(false)
+    , m_haveParsedAgeHeader(false)
+    , m_haveParsedDateHeader(false)
+    , m_haveParsedExpiresHeader(false)
+    , m_haveParsedLastModifiedHeader(false)
+{
+}
+
+auto_ptr<ResourceResponse> ResourceResponseBase::adopt(auto_ptr<CrossThreadResourceResponseData> data)
+{
+    auto_ptr<ResourceResponse> response(new ResourceResponse());
+    response->setURL(data->m_url);
+    response->setMimeType(data->m_mimeType);
+    response->setExpectedContentLength(data->m_expectedContentLength);
+    response->setTextEncodingName(data->m_textEncodingName);
+    response->setSuggestedFilename(data->m_suggestedFilename);
+
+    response->setHTTPStatusCode(data->m_httpStatusCode);
+    response->setHTTPStatusText(data->m_httpStatusText);
+
+    response->lazyInit();
+    response->m_httpHeaderFields.adopt(std::auto_ptr<CrossThreadHTTPHeaderMapData>(data->m_httpHeaders.release()));
+    response->setLastModifiedDate(data->m_lastModifiedDate);
+
+    return response;
+}
+
+auto_ptr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
+{
+    auto_ptr<CrossThreadResourceResponseData> data(new CrossThreadResourceResponseData());
+    data->m_url = url().copy();
+    data->m_mimeType = mimeType().copy();
+    data->m_expectedContentLength = expectedContentLength();
+    data->m_textEncodingName = textEncodingName().copy();
+    data->m_suggestedFilename = suggestedFilename().copy();
+    data->m_httpStatusCode = httpStatusCode();
+    data->m_httpStatusText = httpStatusText().copy();
+    data->m_httpHeaders.adopt(httpHeaderFields().copyData());
+    data->m_lastModifiedDate = lastModifiedDate();
+    return data;
+}
 
 bool ResourceResponseBase::isHTTP() const
 {
@@ -49,7 +117,7 @@ const KURL& ResourceResponseBase::url() const
     return m_url; 
 }
 
-void ResourceResponseBase::setUrl(const KURL& url)
+void ResourceResponseBase::setURL(const KURL& url)
 {
     lazyInit();
     m_isNull = false;
@@ -156,9 +224,24 @@ String ResourceResponseBase::httpHeaderField(const AtomicString& name) const
 void ResourceResponseBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     lazyInit();
+    
+    DEFINE_STATIC_LOCAL(const AtomicString, ageHeader, ("age"));
+    DEFINE_STATIC_LOCAL(const AtomicString, cacheControlHeader, ("cache-control"));
+    DEFINE_STATIC_LOCAL(const AtomicString, dateHeader, ("date"));
+    DEFINE_STATIC_LOCAL(const AtomicString, expiresHeader, ("expires"));
+    DEFINE_STATIC_LOCAL(const AtomicString, lastModifiedHeader, ("last-modified"));
+    DEFINE_STATIC_LOCAL(const AtomicString, pragmaHeader, ("pragma"));
+    if (equalIgnoringCase(name, ageHeader))
+        m_haveParsedAgeHeader = false;
+    else if (equalIgnoringCase(name, cacheControlHeader) || equalIgnoringCase(name, pragmaHeader))
+        m_haveParsedCacheControlHeader = false;
+    else if (equalIgnoringCase(name, dateHeader))
+        m_haveParsedDateHeader = false;
+    else if (equalIgnoringCase(name, expiresHeader))
+        m_haveParsedExpiresHeader = false;
+    else if (equalIgnoringCase(name, lastModifiedHeader))
+        m_haveParsedLastModifiedHeader = false;
 
-    if (equalIgnoringCase(name, "cache-control"))
-        m_haveParsedCacheControl = false;
     m_httpHeaderFields.set(name, value);
 }
 
@@ -171,66 +254,156 @@ const HTTPHeaderMap& ResourceResponseBase::httpHeaderFields() const
 
 void ResourceResponseBase::parseCacheControlDirectives() const
 {
-    ASSERT(!m_haveParsedCacheControl);
+    ASSERT(!m_haveParsedCacheControlHeader);
 
     lazyInit();
 
-    m_haveParsedCacheControl = true;
+    m_haveParsedCacheControlHeader = true;
+
     m_cacheControlContainsMustRevalidate = false;
     m_cacheControlContainsNoCache = false;
-
-    String cacheControlValue = httpHeaderField("cache-control");
-    if (cacheControlValue.isEmpty())
-        return;
-
-    // FIXME: It would probably be much more efficient to parse this without creating all these data structures.
-
-    Vector<pair<String, String> > directives;
-    parseCacheHeader(cacheControlValue, directives);
-
-    size_t directivesSize = directives.size();
-    for (size_t i = 0; i < directivesSize; ++i) {
-        Vector<String> directiveValues;
-        if ((equalIgnoringCase(directives[i].first, "private") || equalIgnoringCase(directives[i].first, "no-cache")) && !directives[i].second.isEmpty())
-            parseCacheControlDirectiveValues(directives[i].second, directiveValues);
-        else
-            directiveValues.append(directives[i].second);
-        for (size_t i = 0; i < directiveValues.size(); ++i) {
-            if (equalIgnoringCase(directiveValues[i], "no-cache"))
+    m_cacheControlMaxAge = numeric_limits<double>::quiet_NaN();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, cacheControlString, ("cache-control"));
+    DEFINE_STATIC_LOCAL(const AtomicString, noCacheDirective, ("no-cache"));
+    DEFINE_STATIC_LOCAL(const AtomicString, mustRevalidateDirective, ("must-revalidate"));
+    DEFINE_STATIC_LOCAL(const AtomicString, maxAgeDirective, ("max-age"));
+
+    String cacheControlValue = m_httpHeaderFields.get(cacheControlString);
+    if (!cacheControlValue.isEmpty()) {
+        Vector<pair<String, String> > directives;
+        parseCacheHeader(cacheControlValue, directives);
+
+        size_t directivesSize = directives.size();
+        for (size_t i = 0; i < directivesSize; ++i) {
+            // RFC2616 14.9.1: A no-cache directive with a value is only meaningful for proxy caches.
+            // It should be ignored by a browser level cache.
+            if (equalIgnoringCase(directives[i].first, noCacheDirective) && directives[i].second.isEmpty())
                 m_cacheControlContainsNoCache = true;
-            else if (equalIgnoringCase(directiveValues[i], "must-revalidate"))
+            else if (equalIgnoringCase(directives[i].first, mustRevalidateDirective))
                 m_cacheControlContainsMustRevalidate = true;
+            else if (equalIgnoringCase(directives[i].first, maxAgeDirective)) {
+                bool ok;
+                double maxAge = directives[i].second.toDouble(&ok);
+                if (ok)
+                    m_cacheControlMaxAge = maxAge;
+            }
         }
     }
+        
+    if (!m_cacheControlContainsNoCache) {
+        // Handle Pragma: no-cache
+        // This is deprecated and equivalent to Cache-control: no-cache
+        // Don't bother tokenizing the value, it is not important
+        DEFINE_STATIC_LOCAL(const AtomicString, pragmaHeader, ("pragma"));
+        String pragmaValue = m_httpHeaderFields.get(pragmaHeader);
+        m_cacheControlContainsNoCache = pragmaValue.lower().contains(noCacheDirective);
+    }
+}
+    
+bool ResourceResponseBase::cacheControlContainsNoCache() const
+{
+    if (!m_haveParsedCacheControlHeader)
+        parseCacheControlDirectives();
+    return m_cacheControlContainsNoCache;
 }
 
-bool ResourceResponseBase::isAttachment() const
+bool ResourceResponseBase::cacheControlContainsMustRevalidate() const
 {
-    lazyInit();
+    if (!m_haveParsedCacheControlHeader)
+        parseCacheControlDirectives();
+    return m_cacheControlContainsMustRevalidate;
+}
 
-    String value = m_httpHeaderFields.get("Content-Disposition");
-    int loc = value.find(';');
-    if (loc != -1)
-        value = value.left(loc);
-    value = value.stripWhiteSpace();
-    return equalIgnoringCase(value, "attachment");
+double ResourceResponseBase::cacheControlMaxAge() const
+{
+    if (!m_haveParsedCacheControlHeader)
+        parseCacheControlDirectives();
+    return m_cacheControlMaxAge;
 }
 
-void ResourceResponseBase::setExpirationDate(time_t expirationDate)
+static double parseDateValueInHeader(const HTTPHeaderMap& headers, const AtomicString& headerName)
+{
+    String headerValue = headers.get(headerName);
+    if (headerValue.isEmpty())
+        return std::numeric_limits<double>::quiet_NaN(); 
+    // This handles all date formats required by RFC2616:
+    // Sun, 06 Nov 1994 08:49:37 GMT  ; RFC 822, updated by RFC 1123
+    // Sunday, 06-Nov-94 08:49:37 GMT ; RFC 850, obsoleted by RFC 1036
+    // Sun Nov  6 08:49:37 1994       ; ANSI C's asctime() format
+    double dateInMilliseconds = JSC::parseDate(headerValue);
+    if (!isfinite(dateInMilliseconds))
+        return std::numeric_limits<double>::quiet_NaN();
+    return dateInMilliseconds / 1000;
+}
+
+double ResourceResponseBase::date() const
 {
     lazyInit();
 
-    m_expirationDate = expirationDate;
+    if (!m_haveParsedDateHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("date"));
+        m_date = parseDateValueInHeader(m_httpHeaderFields, headerName);
+        m_haveParsedDateHeader = true;
+    }
+    return m_date;
+}
+
+double ResourceResponseBase::age() const
+{
+    lazyInit();
+    
+    if (!m_haveParsedAgeHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("age"));
+        String headerValue = m_httpHeaderFields.get(headerName);
+        bool ok;
+        m_age = headerValue.toDouble(&ok);
+        if (!ok)
+            m_age = std::numeric_limits<double>::quiet_NaN();
+        m_haveParsedAgeHeader = true;
+    }
+    return m_age;
 }
 
-time_t ResourceResponseBase::expirationDate() const
+double ResourceResponseBase::expires() const
 {
     lazyInit();
 
-    return m_expirationDate; 
+    if (!m_haveParsedExpiresHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("expires"));
+        m_expires = parseDateValueInHeader(m_httpHeaderFields, headerName);
+        m_haveParsedExpiresHeader = true;
+    }
+    return m_expires;
 }
 
-void ResourceResponseBase::setLastModifiedDate(time_t lastModifiedDate) 
+double ResourceResponseBase::lastModified() const
+{
+    lazyInit();
+    
+    if (!m_haveParsedLastModifiedHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("last-modified"));
+        m_lastModified = parseDateValueInHeader(m_httpHeaderFields, headerName);
+        m_haveParsedLastModifiedHeader = true;
+    }
+    return m_lastModified;
+}
+
+bool ResourceResponseBase::isAttachment() const
+{
+    lazyInit();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("content-disposition"));
+    String value = m_httpHeaderFields.get(headerName);
+    int loc = value.find(';');
+    if (loc != -1)
+        value = value.left(loc);
+    value = value.stripWhiteSpace();
+    DEFINE_STATIC_LOCAL(const AtomicString, attachmentString, ("attachment"));
+    return equalIgnoringCase(value, attachmentString);
+}
+  
+void ResourceResponseBase::setLastModifiedDate(time_t lastModifiedDate)
 {
     lazyInit();
 
@@ -269,8 +442,6 @@ bool ResourceResponseBase::compare(const ResourceResponse& a, const ResourceResp
         return false;
     if (a.httpHeaderFields() != b.httpHeaderFields())
         return false;
-    if (a.expirationDate() != b.expirationDate())
-        return false;
     return ResourceResponse::platformCompare(a, b);
 }
 
@@ -369,12 +540,4 @@ static void parseCacheHeader(const String& header, Vector<pair<String, String> >
     }
 }
 
-static void parseCacheControlDirectiveValues(const String& directives, Vector<String>& result)
-{
-    directives.split(',', false, result);
-    unsigned max = result.size();
-    for (unsigned i = 0; i < max; ++i)
-        result[i] = result[i].stripWhiteSpace();
-}
-
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
index 20df8af3bd..71389084ea 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,18 +30,26 @@
 #include "HTTPHeaderMap.h"
 #include "KURL.h"
 
+#include <memory>
+
 namespace WebCore {
 
 class ResourceResponse;
+struct CrossThreadResourceResponseData;
 
 // Do not use this class directly, use the class ResponseResponse instead
 class ResourceResponseBase {
 public:
+    static std::auto_ptr<ResourceResponse> adopt(std::auto_ptr<CrossThreadResourceResponseData>);
+
+    // Gets a copy of the data suitable for passing to another thread.
+    std::auto_ptr<CrossThreadResourceResponseData> copyData() const;
+
     bool isNull() const { return m_isNull; }
     bool isHTTP() const;
 
     const KURL& url() const;
-    void setUrl(const KURL& url);
+    void setURL(const KURL& url);
 
     const String& mimeType() const;
     void setMimeType(const String& mimeType);
@@ -68,52 +77,34 @@ public:
     bool isMultipart() const { return mimeType() == "multipart/x-mixed-replace"; }
 
     bool isAttachment() const;
-
-    void setExpirationDate(time_t);
-    time_t expirationDate() const;
-
+    
+    // FIXME: These are used by PluginStream on some platforms. Calculations may differ from just returning plain Last-odified header.
+    // Leaving it for now but this should go away in favor of generic solution.
     void setLastModifiedDate(time_t);
-    time_t lastModifiedDate() const;
-
-    bool cacheControlContainsNoCache() const
-    {
-        if (!m_haveParsedCacheControl)
-            parseCacheControlDirectives();
-        return m_cacheControlContainsMustRevalidate;
-    }
-    bool cacheControlContainsMustRevalidate() const
+    time_t lastModifiedDate() const; 
+
+    // These functions return parsed values of the corresponding response headers.
+    // NaN means that the header was not present or had invalid value.
+    bool cacheControlContainsNoCache() const;
+    bool cacheControlContainsMustRevalidate() const;
+    double cacheControlMaxAge() const;
+    double date() const;
+    double age() const;
+    double expires() const;
+    double lastModified() const;
+
+    // The ResourceResponse subclass may "shadow" this method to provide platform-specific memory usage information
+    unsigned memoryUsage() const
     {
-        if (!m_haveParsedCacheControl)
-            parseCacheControlDirectives();
-        return m_cacheControlContainsMustRevalidate;
+        // average size, mostly due to URL and Header Map strings
+        return 1280;
     }
 
     static bool compare(const ResourceResponse& a, const ResourceResponse& b);
 
 protected:
-    ResourceResponseBase()  
-        : m_expectedContentLength(0)
-        , m_httpStatusCode(0)
-        , m_expirationDate(0)
-        , m_lastModifiedDate(0)
-        , m_isNull(true)
-        , m_haveParsedCacheControl(false)
-    {
-    }
-
-    ResourceResponseBase(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
-        : m_url(url)
-        , m_mimeType(mimeType)
-        , m_expectedContentLength(expectedLength)
-        , m_textEncodingName(textEncodingName)
-        , m_suggestedFilename(filename)
-        , m_httpStatusCode(0)
-        , m_expirationDate(0)
-        , m_lastModifiedDate(0)
-        , m_isNull(false)
-        , m_haveParsedCacheControl(false)
-    {
-    }
+    ResourceResponseBase();
+    ResourceResponseBase(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename);
 
     void lazyInit() const;
 
@@ -131,21 +122,44 @@ protected:
     int m_httpStatusCode;
     String m_httpStatusText;
     HTTPHeaderMap m_httpHeaderFields;
-    time_t m_expirationDate;
     time_t m_lastModifiedDate;
-    bool m_isNull : 1;
 
+    bool m_isNull : 1;
+    
 private:
     void parseCacheControlDirectives() const;
 
-    mutable bool m_haveParsedCacheControl : 1;
-    mutable bool m_cacheControlContainsMustRevalidate : 1;
+    mutable bool m_haveParsedCacheControlHeader : 1;
+    mutable bool m_haveParsedAgeHeader : 1;
+    mutable bool m_haveParsedDateHeader : 1;
+    mutable bool m_haveParsedExpiresHeader : 1;
+    mutable bool m_haveParsedLastModifiedHeader : 1;
+
     mutable bool m_cacheControlContainsNoCache : 1;
+    mutable bool m_cacheControlContainsMustRevalidate : 1;
+    mutable double m_cacheControlMaxAge;
+
+    mutable double m_age;
+    mutable double m_date;
+    mutable double m_expires;
+    mutable double m_lastModified;
 };
 
 inline bool operator==(const ResourceResponse& a, const ResourceResponse& b) { return ResourceResponseBase::compare(a, b); }
 inline bool operator!=(const ResourceResponse& a, const ResourceResponse& b) { return !(a == b); }
 
+struct CrossThreadResourceResponseData {
+    KURL m_url;
+    String m_mimeType;
+    long long m_expectedContentLength;
+    String m_textEncodingName;
+    String m_suggestedFilename;
+    int m_httpStatusCode;
+    String m_httpStatusText;
+    OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
+    time_t m_lastModifiedDate;
+};
+
 } // namespace WebCore
 
 #endif // ResourceResponseBase_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/chromium/ResourceResponse.h b/src/3rdparty/webkit/WebCore/platform/network/chromium/ResourceResponse.h
deleted file mode 100644
index d0184026cf..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/network/chromium/ResourceResponse.h
+++ /dev/null
@@ -1,83 +0,0 @@
- /*
-  * Copyright (C) 2008 Google Inc.  All rights reserved.
-  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-  * are met:
-  * 1. Redistributions of source code must retain the above copyright
-  *    notice, this list of conditions and the following disclaimer.
-  * 2. Redistributions in binary form must reproduce the above copyright
-  *    notice, this list of conditions and the following disclaimer in the
-  *    documentation and/or other materials provided with the distribution.
-  *
-  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
-  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
-  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-  */
-
-#ifndef ResourceResponse_h
-#define ResourceResponse_h
-
-#include "CString.h"
-#include "ResourceResponseBase.h"
-
-#include "NotImplemented.h"
-
-namespace WebCore {
-
-class ResourceResponse : public ResourceResponseBase {
-public:
-    ResourceResponse()
-        : ResourceResponseBase(),
-          m_isContentFiltered(false)
-    {
-    }
-
-    ResourceResponse(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
-        : ResourceResponseBase(url, mimeType, expectedLength, textEncodingName, filename),
-          m_isContentFiltered(false)
-    {
-    }
-
-    const CString& getSecurityInfo() const { return m_securityInfo; }
-    void setSecurityInfo(const CString& securityInfo)
-    {
-        m_securityInfo = securityInfo;
-    }
-
-    bool isContentFiltered() const { return m_isContentFiltered; }
-    void setIsContentFiltered(bool isContentFiltered)
-    {
-        m_isContentFiltered = isContentFiltered;
-    }
-
-private:
-    friend class ResourceResponseBase;
-
-    // An opaque value that contains some information regarding the security of
-    // the connection for this request, such as SSL connection info (empty
-    // string if not over HTTPS).
-    CString m_securityInfo;
-
-    void doUpdateResourceResponse()
-    {
-        notImplemented();
-    }
-
-    // Whether the contents for this response has been altered/blocked (usually
-    // for security reasons.
-    bool m_isContentFiltered;
-};
-
-} // namespace WebCore
-
-#endif // ResourceResponse_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 3e9b239980..06b60bf3bd 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -136,7 +136,6 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
     , m_redirected(false)
     , m_responseSent(false)
     , m_loadMode(loadMode)
-    , m_startTime(0)
     , m_shouldStart(true)
     , m_shouldFinish(false)
     , m_shouldSendResponse(false)
@@ -292,7 +291,7 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     }
 
     if (isLocalFileReply)
-        response.setExpirationDate(m_startTime);
+        response.setHTTPHeaderField(QString::fromAscii("Cache-Control"), QString::fromAscii("no-cache"));
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
@@ -355,8 +354,6 @@ void QNetworkReplyHandler::start()
         && (!url.toLocalFile().isEmpty() || url.scheme() == QLatin1String("data")))
         m_method = QNetworkAccessManager::GetOperation;
 
-    m_startTime = QDateTime::currentDateTime().toTime_t();
-
     switch (m_method) {
         case QNetworkAccessManager::GetOperation:
             m_reply = manager->get(m_request);
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 98be28d839..3de6d882e7 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -72,7 +72,6 @@ private:
     LoadMode m_loadMode;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
-    uint   m_startTime;
 
     // defer state holding
     bool m_shouldStart;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
index 7af5895486..c5816a4ecd 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -171,7 +171,7 @@ PassRefPtr<SharedBuffer> ResourceHandle::bufferedData()
     return 0;
 }
 
-void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame* frame)
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials /*storedCredentials*/, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame* frame)
 {
     WebCoreSynchronousLoader syncLoader;
     ResourceHandle handle(request, &syncLoader, true, false, true);
diff --git a/src/3rdparty/webkit/WebCore/platform/posix/FileSystemPOSIX.cpp b/src/3rdparty/webkit/WebCore/platform/posix/FileSystemPOSIX.cpp
index d32cecad49..da124a82cf 100644
--- a/src/3rdparty/webkit/WebCore/platform/posix/FileSystemPOSIX.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/posix/FileSystemPOSIX.cpp
@@ -30,7 +30,6 @@
 #include "FileSystem.h"
 
 #include "CString.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <sys/stat.h>
@@ -158,11 +157,10 @@ String directoryName(const String& path)
     return dirname(fsRep.mutableData());
 }
 
-Vector<String> listDirectory(const String& path, const String& filter)
-{
-    Vector<String> entries;
-    notImplemented();
-    return entries;
-}
+// OK to not implement listDirectory at the moment, because it's only used for plug-ins, and
+// all platforms that use the shared plug-in implementation have implementations. We'd need
+// to implement it if we wanted to use PluginDatabase.cpp on the Mac. Better to not implement
+// at all and get a link error in case this arises, rather than having a stub here, because
+// with a stub you learn about the problem at runtime instead of link time.
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ContextMenuQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ContextMenuQt.cpp
index 3e093b185c..063a46b4f2 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ContextMenuQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ContextMenuQt.cpp
@@ -26,7 +26,6 @@
 
 #include "config.h"
 #include "ContextMenu.h"
-#include "MenuEventProxy.h"
 
 #include <wtf/Assertions.h>
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
index 4077407667..40d9309196 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
@@ -28,11 +28,11 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
 
 #if QT_VERSION >= 0x040400
-#include "Document.h"
 #include "qwebpage.h"
 #include "qwebframe.h"
 #include "FrameLoaderClientQt.h"
@@ -61,10 +61,10 @@ static QNetworkCookieJar *cookieJar(const Document *document)
 }
 #endif
 
-void setCookies(Document* document, const KURL& url, const KURL& policyURL, const String& value)
+void setCookies(Document* document, const KURL& url, const String& value)
 {
     QUrl u(url);
-    QUrl p(policyURL);
+    QUrl p(document->firstPartyForCookies());
 #if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
index 218f7be418..bc5cce12f8 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
@@ -30,7 +30,6 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "markup.h"
-#include "NotImplemented.h"
 
 #include <QList>
 #include <QMimeData>
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp
index 6dbe46406b..a17f3ab5a9 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp
@@ -33,7 +33,6 @@
 #include "FileSystem.h"
 
 #include "CString.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <QDateTime>
@@ -124,7 +123,7 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
         return String(temp->fileName()).utf8();
     }
     handle = invalidPlatformFileHandle;
-    return 0;
+    return CString();
 }
 
 void closeFile(PlatformFileHandle& handle)
@@ -143,32 +142,24 @@ int writeToFile(PlatformFileHandle handle, const char* data, int length)
     return 0;
 }
 
-#if defined(Q_WS_X11) || defined(Q_WS_QWS)
 bool unloadModule(PlatformModule module)
 {
+#if defined(Q_WS_MAC)
+    CFRelease(module);
+    return true;
+
+#elif defined(Q_OS_WIN)
+    return ::FreeLibrary(module);
+
+#else
     if (module->unload()) {
         delete module;
         return true;
     }
-
+                        
     return false;
-}
-#endif
-
-#if defined(Q_WS_MAC)
-bool unloadModule(PlatformModule module)
-{
-    CFRelease(module);
-    return true;
-}
 #endif
-
-#if defined(Q_OS_WIN)
-bool unloadModule(PlatformModule module)
-{
-    return ::FreeLibrary(module);
 }
-#endif
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp
index cdc4f4859e..0763fe0e9c 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/KURLQt.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "KURL.h"
 #include "CString.h"
+#include "TextEncoding.h"
 
 #include "NotImplemented.h"
 #include "qurl.h"
@@ -36,7 +37,7 @@ static inline char toHex(char c)
 
 KURL::KURL(const QUrl& url)
 {
-    *this = KURL(url.toEncoded().constData());
+    *this = KURL(KURL(), url.toEncoded().constData(), UTF8Encoding());
 }
 
 KURL::operator QUrl() const
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
index cb805f985e..a6c7513ec8 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
@@ -30,7 +30,6 @@
 
 #include "IntSize.h"
 #include "LocalizedStrings.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <QCoreApplication>
@@ -245,12 +244,12 @@ String contextMenuItemTagDefaultDirection()
 
 String contextMenuItemTagLeftToRight()
 {
-    return QCoreApplication::translate("QWebPage", "LTR", "Left to Right context menu item");
+    return QCoreApplication::translate("QWebPage", "Left to Right", "Left to Right context menu item");
 }
 
 String contextMenuItemTagRightToLeft()
 {
-    return QCoreApplication::translate("QWebPage", "RTL", "Right to Left context menu item");
+    return QCoreApplication::translate("QWebPage", "Right to Left", "Right to Left context menu item");
 }
 
 String contextMenuItemTagInspectElement()
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/MenuEventProxy.h b/src/3rdparty/webkit/WebCore/platform/qt/MenuEventProxy.h
deleted file mode 100644
index 658d1ee093..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/qt/MenuEventProxy.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-
-#ifndef MENUEVENTPROXY_H
-#define MENUEVENTPROXY_H
-
-#include "Platform.h"
-#include <qobject.h>
-#include <qmap.h>
-#include "ContextMenu.h"
-#include "ContextMenuItem.h"
-#include "ContextMenuController.h"
-
-namespace WebCore {
-class MenuEventProxy : public QObject {
-    Q_OBJECT
-    public:
-        MenuEventProxy(WebCore::ContextMenu *m) : m_m(m) {}
-        ~MenuEventProxy() {}
-
-        void map(QAction* action, unsigned actionTag) { _map[action] = actionTag; }
-
-    public slots:
-        void trigger(QAction *action) {
-            WebCore::ContextMenuItem item(WebCore::ActionType, static_cast<WebCore::ContextMenuAction>(_map[action]), WebCore::String()); 
-            m_m->controller()->contextMenuItemSelected(&item);
-        }
-
-    private:
-        WebCore::ContextMenu *m_m;
-        QMap<QAction*, unsigned> _map;
-};
-
-}
-
-#endif
-// vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp
index afc7452b52..ba7a4ad80b 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp
@@ -28,7 +28,7 @@
 #include "config.h"
 #include "PlatformMouseEvent.h"
 
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 #include <QMouseEvent>
 
@@ -36,7 +36,7 @@ namespace WebCore {
 
 PlatformMouseEvent::PlatformMouseEvent(QInputEvent* event, int clickCount)
 {
-    m_timestamp = WebCore::currentTime();
+    m_timestamp = WTF::currentTime();
 
     QMouseEvent *me = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
index 76728fa49c..a7d6643420 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
@@ -30,7 +30,6 @@
 #include "FrameView.h"
 #include "HostWindow.h"
 #include "PopupMenuClient.h"
-#include "NotImplemented.h"
 #include "QWebPopup.h"
 
 #include <QAction>
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp b/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
index 4d57c9b0b0..f437c27ad2 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
@@ -82,4 +82,6 @@ void QWebPopup::activeChanged(int index)
     m_client->valueChanged(index);
 }
 
-}
+} // namespace WebCore
+
+#include "moc_QWebPopup.cpp"
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
index 02d17ed9d9..b16cbc439c 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
@@ -57,6 +57,7 @@
 #include "GraphicsContext.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "RenderBox.h"
 
 namespace WebCore {
 
@@ -161,9 +162,12 @@ bool RenderThemeQt::supportsFocusRing(const RenderStyle* style) const
 
 int RenderThemeQt::baselinePosition(const RenderObject* o) const
 {
+    if (!o->isBox())
+        return 0;
+
     if (o->style()->appearance() == CheckboxPart ||
         o->style()->appearance() == RadioPart)
-        return o->marginTop() + o->height() - 2; // Same as in old khtml
+        return toRenderBox(o)->marginTop() + toRenderBox(o)->height() - 2; // Same as in old khtml
     return RenderTheme::baselinePosition(o);
 }
 
@@ -808,7 +812,7 @@ private:
 
 HTMLMediaElement* RenderThemeQt::getMediaElementFromRenderObject(RenderObject* o) const
 {
-    Node* node = o->element();
+    Node* node = o->node();
     Node* mediaNode = node ? node->shadowAncestorNode() : 0;
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return 0;
@@ -827,7 +831,7 @@ void RenderThemeQt::paintMediaBackground(QPainter* painter, const IntRect& r) co
 QColor RenderThemeQt::getMediaControlForegroundColor(RenderObject* o) const
 {
     QColor fgColor = platformActiveSelectionBackgroundColor();
-    if (o && o->element()->active())
+    if (o && o->node()->active())
         fgColor = fgColor.lighter();
     return fgColor;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ScrollViewQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ScrollViewQt.cpp
index 76d9f0111f..48885d320f 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ScrollViewQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ScrollViewQt.cpp
@@ -36,27 +36,33 @@ namespace WebCore {
 
 void ScrollView::platformInit()
 {
-    m_widgetsThatPreventBlitting = 0;
+    m_widgetsPreventingBlitting = 0;
 }
 
 void ScrollView::platformDestroy()
 {
 }
 
-void ScrollView::platformAddChild(Widget* child)
+// Windowed plugins are using native windows and are thus preventing
+// us from doing any kind of scrolling optimization.
+
+void ScrollView::adjustWidgetsPreventingBlittingCount(int delta)
 {
-    root()->m_widgetsThatPreventBlitting++;
+    m_widgetsPreventingBlitting += delta;
     if (parent())
-        parent()->platformAddChild(child);
+        parent()->adjustWidgetsPreventingBlittingCount(delta);
+}
+
+void ScrollView::platformAddChild(Widget* child)
+{
+    adjustWidgetsPreventingBlittingCount(1);
 }
 
 void ScrollView::platformRemoveChild(Widget* child)
 {
-    ASSERT(root()->m_widgetsThatPreventBlitting);
-    root()->m_widgetsThatPreventBlitting--;
     child->hide();
+    adjustWidgetsPreventingBlittingCount(-1);
 }
 
 }
-
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/SharedTimerQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/SharedTimerQt.cpp
index 204cf2dea4..e9bcaee8b2 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/SharedTimerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/SharedTimerQt.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 #include <QBasicTimer>
 #include <QCoreApplication>
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
index ff0b27d44e..f76eb43dd5 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
@@ -74,39 +74,6 @@
 
 using namespace WebCore;
 
-#if (!defined(Q_WS_X11) && !defined(Q_WS_WIN) && !defined(Q_WS_MAC32)) || defined(Q_OS_WINCE)
-
-bool PluginPackage::fetchInfo() { notImplemented(); return false; }
-unsigned PluginPackage::hash() const { notImplemented(); return 0; }
-bool PluginPackage::equal(const PluginPackage&, const PluginPackage&) { notImplemented(); return false; }
-int PluginPackage::compareFileVersion(const PlatformModuleVersion&) const { notImplemented(); return -1; }
-
-void PluginView::setNPWindowRect(const IntRect&) { notImplemented(); }
-const char* PluginView::userAgent() { notImplemented(); return 0; }
-#if ENABLE(NETSCAPE_PLUGIN_API)
-const char* PluginView::userAgentStatic() { notImplemented(); return 0; }
-#endif
-void PluginView::invalidateRect(NPRect*) { notImplemented(); }
-void PluginView::invalidateRect(const IntRect&) { notImplemented(); }
-void PluginView::invalidateRegion(NPRegion) { notImplemented(); }
-void PluginView::forceRedraw() { notImplemented(); }
-void PluginView::setFocus() { Widget::setFocus(); }
-void PluginView::show() { Widget::show(); }
-void PluginView::hide() { Widget::hide(); }
-void PluginView::paint(GraphicsContext*, const IntRect&) { notImplemented(); }
-void PluginView::setParent(ScrollView* view) { Widget::setParent(view); }
-void PluginView::setParentVisible(bool) { notImplemented(); }
-void PluginView::updatePluginWidget() { notImplemented(); }
-void PluginView::handleKeyboardEvent(KeyboardEvent*) { notImplemented(); }
-void PluginView::handleMouseEvent(MouseEvent*) { notImplemented(); }
-NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*) { notImplemented(); return NPERR_GENERIC_ERROR; }
-NPError PluginView::getValue(NPNVariable, void*) { notImplemented(); return NPERR_GENERIC_ERROR; }
-#if ENABLE(NETSCAPE_PLUGIN_API)
-NPError PluginView::getValueStatic(NPNVariable, void*) { return NPERR_GENERIC_ERROR; }
-#endif
-PluginView::~PluginView() {}
-#endif
-
 #if defined(Q_OS_WINCE)
 Vector<String> PluginDatabase::defaultPluginDirectories() { notImplemented(); return Vector<String>(); }
 void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const { notImplemented(); }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
index b25ae7ac81..9534f20000 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
@@ -37,11 +37,7 @@ PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
 #else
     : m_position(e->pos())
     , m_globalPosition(e->globalPos())
-#ifdef QT_MAC_USE_COCOA
     , m_granularity(ScrollByPixelWheelEvent)
-#else
-    , m_granularity(ScrollByLineWheelEvent)
-#endif
     , m_isAccepted(false)
     , m_shiftKey(e->modifiers() & Qt::ShiftModifier)
     , m_ctrlKey(e->modifiers() & Qt::ControlModifier)
@@ -55,15 +51,14 @@ PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
         m_deltaX = 0;
         m_deltaY = (e->delta() / 120);
     }
+    m_wheelTicksX = m_deltaX;
+    m_wheelTicksY = m_deltaY;
 
-    m_deltaX *= QApplication::wheelScrollLines();
     // use the same single scroll step as QTextEdit (in
     // QTextEditPrivate::init [h,v]bar->setSingleStep )
-    // and divide by the default WebKit scroll step to
-    // get the Qt mouse wheel scroll behavior
     static const float cDefaultQtScrollStep = 20.f;
-    m_deltaY *= QApplication::wheelScrollLines() *
-                (cDefaultQtScrollStep / cMouseWheelPixelsPerLineStep);
+    m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+    m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
 }
 #endif // QT_NO_WHEELEVENT
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
index 5f9abfd9a4..409439e5b0 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
@@ -101,7 +101,7 @@ static inline bool equal(StringImpl* string, const UChar* characters, unsigned l
     if (string->length() != length)
         return false;
 
-#if PLATFORM(ARM)
+#if PLATFORM(ARM) || PLATFORM(SH4)
     const UChar* stringCharacters = string->characters();
     for (unsigned i = 0; i != length; ++i) {
         if (*stringCharacters++ != *characters++)
@@ -206,7 +206,7 @@ PassRefPtr<StringImpl> AtomicString::add(const UChar* s)
 
 PassRefPtr<StringImpl> AtomicString::add(StringImpl* r)
 {
-    if (!r || r->m_inTable)
+    if (!r || r->inTable())
         return r;
 
     if (r->length() == 0)
@@ -214,7 +214,7 @@ PassRefPtr<StringImpl> AtomicString::add(StringImpl* r)
     
     StringImpl* result = *stringTable().add(r).first;
     if (result == r)
-        r->m_inTable = true;
+        r->setInTable();
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
index f4efab9ec0..3307a2d325 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
@@ -67,17 +67,21 @@ public:
     UChar operator[](unsigned int i) const { return m_string[i]; }
     
     bool contains(UChar c) const { return m_string.contains(c); }
-    bool contains(const AtomicString& s, bool caseSensitive = true) const
-        { return m_string.contains(s.string(), caseSensitive); }
+    bool contains(const char* s, bool caseSensitive = true) const
+        { return m_string.contains(s, caseSensitive); }
+    bool contains(const String& s, bool caseSensitive = true) const
+        { return m_string.contains(s, caseSensitive); }
 
     int find(UChar c, int start = 0) const { return m_string.find(c, start); }
-    int find(const AtomicString& s, int start = 0, bool caseSentitive = true) const
-        { return m_string.find(s.string(), start, caseSentitive); }
+    int find(const char* s, int start = 0, bool caseSentitive = true) const
+        { return m_string.find(s, start, caseSentitive); }
+    int find(const String& s, int start = 0, bool caseSentitive = true) const
+        { return m_string.find(s, start, caseSentitive); }
     
-    bool startsWith(const AtomicString& s, bool caseSensitive = true) const
-        { return m_string.startsWith(s.string(), caseSensitive); }
-    bool endsWith(const AtomicString& s, bool caseSensitive = true) const
-        { return m_string.endsWith(s.string(), caseSensitive); }
+    bool startsWith(const String& s, bool caseSensitive = true) const
+        { return m_string.startsWith(s, caseSensitive); }
+    bool endsWith(const String& s, bool caseSensitive = true) const
+        { return m_string.endsWith(s, caseSensitive); }
     
     int toInt(bool* ok = 0) const { return m_string.toInt(ok); }
     double toDouble(bool* ok = 0) const { return m_string.toDouble(ok); }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp b/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp
index 920fa89e13..be1916431a 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/Base64.cpp
@@ -97,8 +97,8 @@ void base64Encode(const Vector<char>& in, Vector<char>& out, bool insertLFs)
                 count += 4;
             }
             out[didx++] = base64EncMap[(data[sidx] >> 2) & 077];
-            out[didx++] = base64EncMap[(data[sidx + 1] >> 4) & 017 | (data[sidx] << 4) & 077];
-            out[didx++] = base64EncMap[(data[sidx + 2] >> 6) & 003 | (data[sidx + 1] << 2) & 077];
+            out[didx++] = base64EncMap[((data[sidx + 1] >> 4) & 017) | ((data[sidx] << 4) & 077)];
+            out[didx++] = base64EncMap[((data[sidx + 2] >> 6) & 003) | ((data[sidx + 1] << 2) & 077)];
             out[didx++] = base64EncMap[data[sidx + 2] & 077];
             sidx += 3;
         }
@@ -110,7 +110,7 @@ void base64Encode(const Vector<char>& in, Vector<char>& out, bool insertLFs)
 
         out[didx++] = base64EncMap[(data[sidx] >> 2) & 077];
         if (sidx < len - 1) {
-            out[didx++] = base64EncMap[(data[sidx + 1] >> 4) & 017 | (data[sidx] << 4) & 077];
+            out[didx++] = base64EncMap[((data[sidx + 1] >> 4) & 017) | ((data[sidx] << 4) & 077)];
             out[didx++] = base64EncMap[(data[sidx + 1] << 2) & 077];
         } else
             out[didx++] = base64EncMap[(data[sidx] << 4) & 077];
diff --git a/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp b/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp
index ef3c225b0e..546571e347 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/BidiContext.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2004, 2006, 2007 Apple Inc.  All right reserved.
+ * Copyright (C) 2003, 2004, 2006, 2007, 2009 Apple Inc. All right reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,8 +22,37 @@
 #include "config.h"
 #include "BidiContext.h"
 
+#include <wtf/StdLibExtras.h>
+
 namespace WebCore {
 
+using namespace WTF::Unicode;
+
+PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiContext* parent)
+{
+    ASSERT(direction == level % 2 ? RightToLeft : LeftToRight);
+
+    if (parent)
+        return adoptRef(new BidiContext(level, direction, override, parent));
+
+    ASSERT(level <= 1);
+    if (!level) {
+        DEFINE_STATIC_LOCAL(BidiContext, ltrContext, (0, LeftToRight, false, 0));
+        if (!override)
+            return &ltrContext;
+
+        DEFINE_STATIC_LOCAL(BidiContext, ltrOverrideContext, (0, LeftToRight, true, 0));
+        return &ltrOverrideContext;
+    }
+
+    DEFINE_STATIC_LOCAL(BidiContext, rtlContext, (1, RightToLeft, false, 0));
+    if (!override)
+        return &rtlContext;
+
+    DEFINE_STATIC_LOCAL(BidiContext, rtlOverrideContext, (1, RightToLeft, true, 0));
+    return &rtlOverrideContext;
+}
+
 bool operator==(const BidiContext& c1, const BidiContext& c2)
 {
     if (&c1 == &c2)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/BidiContext.h b/src/3rdparty/webkit/WebCore/platform/text/BidiContext.h
index 89123c8e85..87916050aa 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/BidiContext.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/BidiContext.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2004, 2006, 2007 Apple Inc.  All right reserved.
+ * Copyright (C) 2003, 2004, 2006, 2007, 2009 Apple Inc. All right reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,31 +23,17 @@
 #define BidiContext_h
 
 #include <wtf/Assertions.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
 // Used to keep track of explicit embeddings.
-class BidiContext {
+class BidiContext : public RefCounted<BidiContext> {
 public:
-    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override = false, BidiContext* parent = 0)
-        : m_level(level)
-        , m_direction(direction)
-        , m_override(override)
-        , m_parent(parent)
-        , m_refCount(0)
-    {
-        ASSERT(direction == WTF::Unicode::LeftToRight || direction == WTF::Unicode::RightToLeft);
-    }
-
-    void ref() const { m_refCount++; }
-    void deref() const
-    {
-        m_refCount--;
-        if (m_refCount <= 0)
-            delete this;
-    }
+    static PassRefPtr<BidiContext> create(unsigned char level, WTF::Unicode::Direction direction, bool override = false, BidiContext* parent = 0);
 
     BidiContext* parent() const { return m_parent.get(); }
     unsigned char level() const { return m_level; }
@@ -55,11 +41,18 @@ public:
     bool override() const { return m_override; }
 
 private:
+    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override, BidiContext* parent)
+        : m_level(level)
+        , m_direction(direction)
+        , m_override(override)
+        , m_parent(parent)
+    {
+    }
+
     unsigned char m_level;
     unsigned m_direction : 5; // Direction
     bool m_override : 1;
     RefPtr<BidiContext> m_parent;
-    mutable int m_refCount;
 };
 
 bool operator==(const BidiContext&, const BidiContext&);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h b/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h
index ffd3d51865..b6c2e88430 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h
@@ -254,7 +254,16 @@ template <class Iterator, class Run>
 void BidiResolver<Iterator, Run>::appendRun()
 {
     if (!emptyRun && !eor.atEnd()) {
-        addRun(new Run(sor.offset(), eor.offset() + 1, context(), m_direction));
+        unsigned startOffset = sor.offset();
+        unsigned endOffset = eor.offset();
+
+        if (!endOfLine.atEnd() && endOffset >= endOfLine.offset()) {
+            reachedEndOfLine = true;
+            endOffset = endOfLine.offset();
+        }
+
+        if (endOffset >= startOffset)
+            addRun(new Run(startOffset, endOffset + 1, context(), m_direction));
 
         eor.increment();
         sor = eor;
@@ -352,8 +361,8 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
                 m_direction = LeftToRight;
             }
         } else if (m_status.eor == ArabicNumber
-            || m_status.eor == EuropeanNumber && (m_status.lastStrong != LeftToRight || from == RightToLeft)
-            || m_status.eor != EuropeanNumber && m_status.lastStrong == LeftToRight && from == RightToLeft) {
+            || (m_status.eor == EuropeanNumber && (m_status.lastStrong != LeftToRight || from == RightToLeft))
+            || (m_status.eor != EuropeanNumber && m_status.lastStrong == LeftToRight && from == RightToLeft)) {
             appendRun();
             m_direction = RightToLeft;
         }
@@ -393,7 +402,7 @@ void BidiResolver<Iterator, Run>::commitExplicitEmbedding()
                 level &= ~1;
             }
             if (level < 61)
-                toContext = new BidiContext(level, direction, override, toContext.get());
+                toContext = BidiContext::create(level, direction, override, toContext.get());
         }
     }
 
@@ -722,8 +731,8 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo
                 case WhiteSpaceNeutral:
                 case OtherNeutral:
                     if (m_status.eor == ArabicNumber
-                        || m_status.eor == EuropeanNumber && (m_status.lastStrong == RightToLeft || context()->dir() == RightToLeft)
-                        || m_status.eor != EuropeanNumber && m_status.lastStrong == LeftToRight && context()->dir() == RightToLeft) {
+                        || (m_status.eor == EuropeanNumber && (m_status.lastStrong == RightToLeft || context()->dir() == RightToLeft))
+                        || (m_status.eor != EuropeanNumber && m_status.lastStrong == LeftToRight && context()->dir() == RightToLeft)) {
                         // Terminate the run before the neutrals.
                         appendRun();
                         // Begin an R run for the neutrals.
diff --git a/src/3rdparty/webkit/WebCore/platform/text/CString.cpp b/src/3rdparty/webkit/WebCore/platform/text/CString.cpp
index 8e68628740..90990f89f7 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/CString.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/CString.cpp
@@ -47,8 +47,8 @@ void CString::init(const char* str, unsigned length)
         return;
     
     m_buffer = CStringBuffer::create(length + 1);
-    memcpy(m_buffer->data(), str, length); 
-    m_buffer->data()[length] = '\0';
+    memcpy(m_buffer->mutableData(), str, length); 
+    m_buffer->mutableData()[length] = '\0';
 }
 
 const char* CString::data() const
@@ -61,7 +61,7 @@ char* CString::mutableData()
     copyBufferIfNeeded();
     if (!m_buffer)
         return 0;
-    return m_buffer->data();
+    return m_buffer->mutableData();
 }
     
 unsigned CString::length() const
@@ -73,7 +73,7 @@ CString CString::newUninitialized(size_t length, char*& characterBuffer)
 {
     CString result;
     result.m_buffer = CStringBuffer::create(length + 1);
-    char* bytes = result.m_buffer->data();
+    char* bytes = result.m_buffer->mutableData();
     bytes[length] = '\0';
     characterBuffer = bytes;
     return result;
@@ -87,7 +87,7 @@ void CString::copyBufferIfNeeded()
     int len = m_buffer->length();
     RefPtr<CStringBuffer> m_temp = m_buffer;
     m_buffer = CStringBuffer::create(len);
-    memcpy(m_buffer->data(), m_temp->data(), len);
+    memcpy(m_buffer->mutableData(), m_temp->data(), len);
 }
 
 bool operator==(const CString& a, const CString& b)
@@ -99,17 +99,4 @@ bool operator==(const CString& a, const CString& b)
     return !strncmp(a.data(), b.data(), min(a.length(), b.length()));
 }
 
-PassRefPtr<SharedBuffer> CString::releaseBuffer()
-{
-    if (!m_buffer)
-        return 0;
-
-    copyBufferIfNeeded();
-        
-    RefPtr<SharedBuffer> result = m_buffer->releaseBuffer();
-    m_buffer = 0;
-    return result.release();
-}
-
-
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/CString.h b/src/3rdparty/webkit/WebCore/platform/text/CString.h
index 09f112fa64..f084ddf37d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/CString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/CString.h
@@ -36,15 +36,15 @@ namespace WebCore {
 
     class CStringBuffer : public RefCounted<CStringBuffer> {
     public:
-        static PassRefPtr<CStringBuffer> create(unsigned length) { return adoptRef(new CStringBuffer(length)); }
-
-        char* data() { return m_vector.data(); }
-        size_t length() const { return m_vector.size(); }
+        const char* data() { return m_vector.data(); }
+        size_t length() { return m_vector.size(); }
         
-        PassRefPtr<SharedBuffer> releaseBuffer() { return SharedBuffer::adoptVector(m_vector); }
-
     private:
+        friend class CString;
+
+        static PassRefPtr<CStringBuffer> create(unsigned length) { return adoptRef(new CStringBuffer(length)); }
         CStringBuffer(unsigned length) : m_vector(length) { }
+        char* mutableData() { return m_vector.data(); }
 
         Vector<char> m_vector;
     };
@@ -56,6 +56,7 @@ namespace WebCore {
         CString() { }
         CString(const char*);
         CString(const char*, unsigned length);
+        CString(CStringBuffer* buffer) : m_buffer(buffer) { }
         static CString newUninitialized(size_t length, char*& characterBuffer);
 
         const char* data() const;
@@ -63,8 +64,8 @@ namespace WebCore {
         unsigned length() const;
 
         bool isNull() const { return !m_buffer; }
-        
-        PassRefPtr<SharedBuffer> releaseBuffer();
+
+        CStringBuffer* buffer() const { return m_buffer.get(); }
 
     private:
         void copyBufferIfNeeded();
diff --git a/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h b/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h
index f589a6c389..5b1a33780a 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/CharacterNames.h
@@ -37,6 +37,7 @@ namespace WebCore {
 
     const UChar blackSquare = 0x25A0;
     const UChar bullet = 0x2022;
+    const UChar hebrewPunctuationGershayim = 0x05F4;
     const UChar horizontalEllipsis = 0x2026;
     const UChar ideographicSpace = 0x3000;
     const UChar ideographicComma = 0x3001;
@@ -49,6 +50,7 @@ namespace WebCore {
     const UChar objectReplacementCharacter = 0xFFFC;
     const UChar popDirectionalFormatting = 0x202C;
     const UChar replacementCharacter = 0xFFFD;
+    const UChar rightSingleQuotationMark = 0x2019;
     const UChar rightToLeftMark = 0x200F;
     const UChar rightToLeftEmbed = 0x202B;
     const UChar rightToLeftOverride = 0x202E;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
index 2baa191258..1cc60b27c6 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
@@ -27,15 +27,18 @@
 
 #include "StringImpl.h"
 
-#include <wtf/PassRefPtr.h>
+#ifdef __OBJC__
+#include <objc/objc.h>
+#endif
 
 #if USE(JSC)
 #include <runtime/Identifier.h>
 #else
-// runtime/Identifier.h includes HashMap.h and HashSet.h. We explicitly include 
-// them in the case of non-JSC builds to keep things consistent.
+// runtime/Identifier.h brings in a variety of wtf headers.  We explicitly
+// include them in the case of non-JSC builds to keep things consistent.
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
 #endif
 
 #if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
@@ -147,6 +150,8 @@ public:
     // Return the string with case folded for case insensitive comparison.
     String foldCase() const;
 
+    static String number(short);
+    static String number(unsigned short);
     static String number(int);
     static String number(unsigned);
     static String number(long);
@@ -157,6 +162,11 @@ public:
     
     static String format(const char *, ...) WTF_ATTRIBUTE_PRINTF(1, 2);
 
+    // Returns an uninitialized string. The characters needs to be written
+    // into the buffer returned in data before the returned string is used.
+    // Failure to do this will have unpredictable results.
+    static String createUninitialized(unsigned length, UChar*& data) { return StringImpl::createUninitialized(length, data); }
+
     void split(const String& separator, Vector<String>& result) const;
     void split(const String& separator, bool allowEmptyEntries, Vector<String>& result) const;
     void split(UChar separator, Vector<String>& result) const;
@@ -226,6 +236,9 @@ public:
     static String fromUTF8(const char*, size_t);
     static String fromUTF8(const char*);
 
+    // Tries to convert the passed in string to UTF-8, but will fall back to Latin-1 if the string is not valid UTF-8.
+    static String fromUTF8WithLatin1Fallback(const char*, size_t);
+    
     // Determines the writing direction using the Unicode Bidi Algorithm rules P2 and P3.
     WTF::Unicode::Direction defaultWritingDirection() const { return m_impl ? m_impl->defaultWritingDirection() : WTF::Unicode::LeftToRight; }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp
index f0c6539d08..6329b3b318 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,85 +27,58 @@
 #include "config.h"
 #include "RegularExpression.h"
 
-#include "PlatformString.h"
 #include "Logging.h"
-#include <wtf/RefCounted.h>
 #include <pcre/pcre.h>
 
 namespace WebCore {
 
-const size_t maxSubstrings = 10;
-const size_t maxOffsets = 3 * maxSubstrings;
-
 class RegularExpression::Private : public RefCounted<Private> {
 public:
-    static PassRefPtr<Private> create() { return adoptRef(new Private); }
-    static PassRefPtr<Private> create(const String& pattern, bool caseSensitive) { return adoptRef(new Private(pattern, caseSensitive)); }
-
+    static PassRefPtr<Private> create(const String& pattern, TextCaseSensitivity);
     ~Private();
 
-    void compile(bool caseSensitive);
+    JSRegExp* regexp() const { return m_regexp; }
+    int lastMatchLength;    
 
-    String pattern;
-    JSRegExp* regex;
-
-    String lastMatchString;
-    int lastMatchOffsets[maxOffsets];
-    int lastMatchCount;
-    int lastMatchPos;
-    int lastMatchLength;
-    
 private:
-    Private();
-    Private(const String& pattern, bool caseSensitive);
-};
-
-RegularExpression::Private::Private()
-    : pattern("")
-{
-    compile(true);
-}
+    Private(const String& pattern, TextCaseSensitivity);
+    static JSRegExp* compile(const String& pattern, TextCaseSensitivity);
 
-RegularExpression::Private::Private(const String& p, bool caseSensitive)
-    : pattern(p)
-    , lastMatchPos(-1)
-    , lastMatchLength(-1)
-{
-    compile(caseSensitive);
-}
+    JSRegExp* m_regexp;
+};
 
-void RegularExpression::Private::compile(bool caseSensitive)
+inline JSRegExp* RegularExpression::Private::compile(const String& pattern, TextCaseSensitivity caseSensitivity)
 {
     const char* errorMessage;
-    regex = jsRegExpCompile(pattern.characters(), pattern.length(),
-        caseSensitive ? JSRegExpDoNotIgnoreCase : JSRegExpIgnoreCase, JSRegExpSingleLine,
+    JSRegExp* regexp = jsRegExpCompile(pattern.characters(), pattern.length(),
+        caseSensitivity == TextCaseSensitive ? JSRegExpDoNotIgnoreCase : JSRegExpIgnoreCase, JSRegExpSingleLine,
         0, &errorMessage);
-    if (!regex)
+    if (!regexp)
         LOG_ERROR("RegularExpression: pcre_compile failed with '%s'", errorMessage);
+    return regexp;
 }
 
-RegularExpression::Private::~Private()
+inline RegularExpression::Private::Private(const String& pattern, TextCaseSensitivity caseSensitivity)
+    : lastMatchLength(-1)
+    , m_regexp(compile(pattern, caseSensitivity))
 {
-    jsRegExpFree(regex);
 }
 
-
-RegularExpression::RegularExpression()
-    : d(Private::create())
+inline PassRefPtr<RegularExpression::Private> RegularExpression::Private::create(const String& pattern, TextCaseSensitivity caseSensitivity)
 {
+    return adoptRef(new Private(pattern, caseSensitivity));
 }
 
-RegularExpression::RegularExpression(const String& pattern, bool caseSensitive)
-    : d(Private::create(pattern, caseSensitive))
+RegularExpression::Private::~Private()
 {
+    jsRegExpFree(m_regexp);
 }
 
-RegularExpression::RegularExpression(const char* pattern)
-    : d(Private::create(pattern, true))
+RegularExpression::RegularExpression(const String& pattern, TextCaseSensitivity caseSensitivity)
+    : d(Private::create(pattern, caseSensitivity))
 {
 }
 
-
 RegularExpression::RegularExpression(const RegularExpression& re)
     : d(re.d)
 {
@@ -117,52 +90,41 @@ RegularExpression::~RegularExpression()
 
 RegularExpression& RegularExpression::operator=(const RegularExpression& re)
 {
-    RegularExpression tmp(re);
-    tmp.d.swap(d);
+    d = re.d;
     return *this;
 }
 
-String RegularExpression::pattern() const
-{
-    return d->pattern;
-}
-
 int RegularExpression::match(const String& str, int startFrom, int* matchLength) const
 {
+    if (!d->regexp())
+        return -1;
+
     if (str.isNull())
         return -1;
 
-    d->lastMatchString = str;
     // First 2 offsets are start and end offsets; 3rd entry is used internally by pcre
-    d->lastMatchCount = jsRegExpExecute(d->regex, d->lastMatchString.characters(),
-        d->lastMatchString.length(), startFrom, d->lastMatchOffsets, maxOffsets);
-    if (d->lastMatchCount < 0) {
-        if (d->lastMatchCount != JSRegExpErrorNoMatch)
-            LOG_ERROR("RegularExpression: pcre_exec() failed with result %d", d->lastMatchCount);
-        d->lastMatchPos = -1;
+    static const size_t maxOffsets = 3;
+    int offsets[maxOffsets];
+    int result = jsRegExpExecute(d->regexp(), str.characters(), str.length(), startFrom, offsets, maxOffsets);
+    if (result < 0) {
+        if (result != JSRegExpErrorNoMatch)
+            LOG_ERROR("RegularExpression: pcre_exec() failed with result %d", result);
         d->lastMatchLength = -1;
-        d->lastMatchString = String();
         return -1;
     }
-    
+
     // 1 means 1 match; 0 means more than one match. First match is recorded in offsets.
-    d->lastMatchPos = d->lastMatchOffsets[0];
-    d->lastMatchLength = d->lastMatchOffsets[1] - d->lastMatchOffsets[0];
+    d->lastMatchLength = offsets[1] - offsets[0];
     if (matchLength)
         *matchLength = d->lastMatchLength;
-    return d->lastMatchPos;
-}
-
-int RegularExpression::search(const String& str, int startFrom) const
-{
-    if (startFrom < 0)
-        startFrom = str.length() - startFrom;
-    return match(str, startFrom, 0);
+    return offsets[0];
 }
 
 int RegularExpression::searchRev(const String& str) const
 {
-    // FIXME: Total hack for now. Search forward, return the last, greedy match
+    // FIXME: This could be faster if it actually searched backwards.
+    // Instead, it just searches forwards, multiple times until it finds the last match.
+
     int start = 0;
     int pos;
     int lastPos = -1;
@@ -179,17 +141,10 @@ int RegularExpression::searchRev(const String& str) const
             start = pos + 1;
         }
     } while (pos != -1);
-    d->lastMatchPos = lastPos;
     d->lastMatchLength = lastMatchLength;
     return lastPos;
 }
 
-int RegularExpression::pos(int n)
-{
-    ASSERT(n == 0);
-    return d->lastMatchPos;
-}
-
 int RegularExpression::matchedLength() const
 {
     return d->lastMatchLength;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h
index 5d1991e93c..3254067ba9 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,29 +26,21 @@
 #ifndef RegularExpression_h
 #define RegularExpression_h
 
-#include <wtf/RefPtr.h>
+#include "PlatformString.h"
 
 namespace WebCore {
 
-class String;
-
 class RegularExpression {
 public:
-    RegularExpression();
-    RegularExpression(const String&, bool caseSensitive = false);
-    RegularExpression(const char*);
+    RegularExpression(const String&, TextCaseSensitivity);
     ~RegularExpression();
 
     RegularExpression(const RegularExpression&);
     RegularExpression& operator=(const RegularExpression&);
 
-    String pattern() const;
     int match(const String&, int startFrom = 0, int* matchLength = 0) const;
-
-    int search(const String&, int startFrom = 0) const;
     int searchRev(const String&) const;
 
-    int pos(int n = 0);
     int matchedLength() const;
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/platform/text/String.cpp b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
index e40c3c6361..cd87e2cc32 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/String.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
@@ -85,10 +85,12 @@ void String::append(const String& str)
     // call to fastMalloc every single time.
     if (str.m_impl) {
         if (m_impl) {
-            StringBuffer buffer(m_impl->length() + str.length());
-            memcpy(buffer.characters(), m_impl->characters(), m_impl->length() * sizeof(UChar));
-            memcpy(buffer.characters() + m_impl->length(), str.characters(), str.length() * sizeof(UChar));
-            m_impl = StringImpl::adopt(buffer);
+            UChar* data;
+            RefPtr<StringImpl> newImpl =
+                StringImpl::createUninitialized(m_impl->length() + str.length(), data);
+            memcpy(data, m_impl->characters(), m_impl->length() * sizeof(UChar));
+            memcpy(data + m_impl->length(), str.characters(), str.length() * sizeof(UChar));
+            m_impl = newImpl.release();
         } else
             m_impl = str.m_impl;
     }
@@ -101,10 +103,12 @@ void String::append(char c)
     // one String is pointing at this StringImpl, but even then it's going to require a
     // call to fastMalloc every single time.
     if (m_impl) {
-        StringBuffer buffer(m_impl->length() + 1);
-        memcpy(buffer.characters(), m_impl->characters(), m_impl->length() * sizeof(UChar));
-        buffer[m_impl->length()] = c;
-        m_impl = StringImpl::adopt(buffer);
+        UChar* data;
+        RefPtr<StringImpl> newImpl =
+            StringImpl::createUninitialized(m_impl->length() + 1, data);
+        memcpy(data, m_impl->characters(), m_impl->length() * sizeof(UChar));
+        data[m_impl->length()] = c;
+        m_impl = newImpl.release();
     } else
         m_impl = StringImpl::create(&c, 1);
 }
@@ -116,10 +120,12 @@ void String::append(UChar c)
     // one String is pointing at this StringImpl, but even then it's going to require a
     // call to fastMalloc every single time.
     if (m_impl) {
-        StringBuffer buffer(m_impl->length() + 1);
-        memcpy(buffer.characters(), m_impl->characters(), m_impl->length() * sizeof(UChar));
-        buffer[m_impl->length()] = c;
-        m_impl = StringImpl::adopt(buffer);
+        UChar* data;
+        RefPtr<StringImpl> newImpl =
+            StringImpl::createUninitialized(m_impl->length() + 1, data);
+        memcpy(data, m_impl->characters(), m_impl->length() * sizeof(UChar));
+        data[m_impl->length()] = c;
+        m_impl = newImpl.release();
     } else
         m_impl = StringImpl::create(&c, 1);
 }
@@ -170,10 +176,12 @@ void String::append(const UChar* charactersToAppend, unsigned lengthToAppend)
         return;
 
     ASSERT(charactersToAppend);
-    StringBuffer buffer(length() + lengthToAppend);
-    memcpy(buffer.characters(), characters(), length() * sizeof(UChar));
-    memcpy(buffer.characters() + length(), charactersToAppend, lengthToAppend * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    UChar* data;
+    RefPtr<StringImpl> newImpl =
+        StringImpl::createUninitialized(length() + lengthToAppend, data);
+    memcpy(data, characters(), length() * sizeof(UChar));
+    memcpy(data + length(), charactersToAppend, lengthToAppend * sizeof(UChar));
+    m_impl = newImpl.release();
 }
 
 void String::insert(const UChar* charactersToInsert, unsigned lengthToInsert, unsigned position)
@@ -189,11 +197,13 @@ void String::insert(const UChar* charactersToInsert, unsigned lengthToInsert, un
         return;
 
     ASSERT(charactersToInsert);
-    StringBuffer buffer(length() + lengthToInsert);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
-    memcpy(buffer.characters() + position, charactersToInsert, lengthToInsert * sizeof(UChar));
-    memcpy(buffer.characters() + position + lengthToInsert, characters() + position, (length() - position) * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    UChar* data;
+    RefPtr<StringImpl> newImpl =
+      StringImpl::createUninitialized(length() + lengthToInsert, data);
+    memcpy(data, characters(), position * sizeof(UChar));
+    memcpy(data + position, charactersToInsert, lengthToInsert * sizeof(UChar));
+    memcpy(data + position + lengthToInsert, characters() + position, (length() - position) * sizeof(UChar));
+    m_impl = newImpl.release();
 }
 
 UChar String::operator[](unsigned i) const
@@ -221,9 +231,10 @@ void String::truncate(unsigned position)
 {
     if (position >= length())
         return;
-    StringBuffer buffer(position);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    UChar* data;
+    RefPtr<StringImpl> newImpl = StringImpl::createUninitialized(position, data);
+    memcpy(data, characters(), position * sizeof(UChar));
+    m_impl = newImpl.release();
 }
 
 void String::remove(unsigned position, int lengthToRemove)
@@ -234,11 +245,13 @@ void String::remove(unsigned position, int lengthToRemove)
         return;
     if (static_cast<unsigned>(lengthToRemove) > length() - position)
         lengthToRemove = length() - position;
-    StringBuffer buffer(length() - lengthToRemove);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
-    memcpy(buffer.characters() + position, characters() + position + lengthToRemove,
+    UChar* data;
+    RefPtr<StringImpl> newImpl =
+        StringImpl::createUninitialized(length() - lengthToRemove, data);
+    memcpy(data, characters(), position * sizeof(UChar));
+    memcpy(data + position, characters() + position + lengthToRemove,
         (length() - lengthToRemove - position) * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    m_impl = newImpl.release();
 }
 
 String String::substring(unsigned pos, unsigned len) const
@@ -378,6 +391,16 @@ String String::format(const char *format, ...)
 #endif
 }
 
+String String::number(short n)
+{
+    return String::format("%hd", n);
+}
+
+String String::number(unsigned short n)
+{
+    return String::format("%hu", n);
+}
+
 String String::number(int n)
 {
     return String::format("%d", n);
@@ -613,26 +636,35 @@ String String::fromUTF8(const char* string)
     return UTF8Encoding().decode(string, strlen(string));
 }
 
+String String::fromUTF8WithLatin1Fallback(const char* string, size_t size)
+{
+    String result = fromUTF8(string, size);
+    if (!result)
+        result = String(string, size);
+    
+    return result;
+}
+
 #if USE(JSC)
 String::String(const Identifier& str)
 {
     if (str.isNull())
         return;
-    m_impl = StringImpl::create(str.data(), str.size());
+    m_impl = StringImpl::create(str.ustring());
 }
 
 String::String(const UString& str)
 {
     if (str.isNull())
         return;
-    m_impl = StringImpl::create(str.data(), str.size());
+    m_impl = StringImpl::create(str);
 }
 
 String::operator UString() const
 {
     if (!m_impl)
         return UString();
-    return UString(m_impl->characters(), m_impl->length());
+    return m_impl->ustring();
 }
 #endif
 
@@ -837,7 +869,9 @@ PassRefPtr<SharedBuffer> utf8Buffer(const String& string)
 } // namespace WebCore
 
 #ifndef NDEBUG
-// For debugging only -- leaks memory
+// For use in the debugger - leaks memory
+WebCore::String* string(const char*);
+
 WebCore::String* string(const char* s)
 {
     return new WebCore::String(s);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp b/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp
index 0e9555c2a1..c21e36662a 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringBuilder.cpp
@@ -79,9 +79,10 @@ String StringBuilder::toString() const
     if (count == 1)
         return m_strings[0];
 
-    StringBuffer buffer(m_totalLength);
+    UChar* buffer;
+    String result = String::createUninitialized(m_totalLength, buffer);
 
-    UChar* p = buffer.characters();
+    UChar* p = buffer;
     for (unsigned i = 0; i < count; ++i) {
         StringImpl* string = m_strings[i].impl();
         unsigned length = string->length(); 
@@ -89,9 +90,9 @@ String StringBuilder::toString() const
         p += length;
     }
 
-    ASSERT(p == m_totalLength + buffer.characters());
+    ASSERT(p == m_totalLength + buffer);
 
-    return String::adopt(buffer);
+    return result;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
index 0556f8e3e8..8bc4dde12a 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller ( mueller@kde.org )
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
@@ -44,6 +44,8 @@ using namespace Unicode;
 
 namespace WebCore {
 
+static const unsigned minLengthToShare = 20;
+
 static inline UChar* newUCharVector(unsigned n)
 {
     return static_cast<UChar*>(fastMalloc(sizeof(UChar) * n));
@@ -54,13 +56,33 @@ static inline void deleteUCharVector(const UChar* p)
     fastFree(const_cast<UChar*>(p));
 }
 
+// Some of the factory methods create buffers using fastMalloc.
+// We must ensure that ll allocations of StringImpl are allocated using
+// fastMalloc so that we don't have mis-matched frees. We accomplish 
+// this by overriding the new and delete operators.
+void* StringImpl::operator new(size_t size, void* address)
+{
+    if (address)
+        return address;  // Allocating using an internal buffer
+    return fastMalloc(size);
+}
+
+void* StringImpl::operator new(size_t size)
+{
+    return fastMalloc(size);
+}
+
+void StringImpl::operator delete(void* address)
+{
+    fastFree(address);
+}
+
 // This constructor is used only to create the empty string.
 StringImpl::StringImpl()
     : m_length(0)
     , m_data(0)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
+    , m_bufferIsInternal(false)
 {
     // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
     // with impunity. The empty string is special because it is never entered into
@@ -74,8 +96,7 @@ StringImpl::StringImpl()
 inline StringImpl::StringImpl(const UChar* characters, unsigned length)
     : m_length(length)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
+    , m_bufferIsInternal(false)
 {
     UChar* data = newUCharVector(length);
     memcpy(data, characters, length * sizeof(UChar));
@@ -85,9 +106,9 @@ inline StringImpl::StringImpl(const UChar* characters, unsigned length)
 inline StringImpl::StringImpl(const StringImpl& str, WithTerminatingNullCharacter)
     : m_length(str.m_length)
     , m_hash(str.m_hash)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(true)
+    , m_bufferIsInternal(false)
 {
+    m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
     UChar* data = newUCharVector(str.m_length + 1);
     memcpy(data, str.m_data, str.m_length * sizeof(UChar));
     data[str.m_length] = 0;
@@ -97,8 +118,7 @@ inline StringImpl::StringImpl(const StringImpl& str, WithTerminatingNullCharacte
 inline StringImpl::StringImpl(const char* characters, unsigned length)
     : m_length(length)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
+    , m_bufferIsInternal(false)
 {
     ASSERT(characters);
     ASSERT(length);
@@ -115,8 +135,7 @@ inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
     : m_length(length)
     , m_data(characters)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
+    , m_bufferIsInternal(false)
 {
     ASSERT(characters);
     ASSERT(length);
@@ -126,13 +145,13 @@ inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
 StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
     : m_length(length)
     , m_hash(hash)
-    , m_inTable(true)
-    , m_hasTerminatingNullCharacter(false)
+    , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
     ASSERT(length);
 
+    setInTable();
     UChar* data = newUCharVector(length);
     memcpy(data, characters, length * sizeof(UChar));
     m_data = data;
@@ -142,13 +161,13 @@ StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
 StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
     : m_length(length)
     , m_hash(hash)
-    , m_inTable(true)
-    , m_hasTerminatingNullCharacter(false)
+    , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
     ASSERT(length);
 
+    setInTable();
     UChar* data = newUCharVector(length);
     for (unsigned i = 0; i != length; ++i) {
         unsigned char c = characters[i];
@@ -159,9 +178,15 @@ StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
 
 StringImpl::~StringImpl()
 {
-    if (m_inTable)
+    if (inTable())
         AtomicString::remove(this);
-    deleteUCharVector(m_data);
+    if (!m_bufferIsInternal) {
+        SharedUChar* sharedBuffer = m_sharedBufferAndFlags.get();
+        if (sharedBuffer)
+            sharedBuffer->deref();
+        else
+            deleteUCharVector(m_data);
+    }
 }
 
 StringImpl* StringImpl::empty()
@@ -235,7 +260,8 @@ bool StringImpl::isLower()
 
 PassRefPtr<StringImpl> StringImpl::lower()
 {
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
 
     // Do a faster loop for the case where all the characters are ASCII.
@@ -246,23 +272,24 @@ PassRefPtr<StringImpl> StringImpl::lower()
         data[i] = toASCIILower(c);
     }
     if (!(ored & ~0x7F))
-        return adopt(data);
+        return newImpl;
 
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
-    int32_t realLength = Unicode::toLower(data.characters(), length, m_data, m_length, &error);
+    int32_t realLength = Unicode::toLower(data, length, m_data, m_length, &error);
     if (!error && realLength == length)
-        return adopt(data);
-    data.resize(realLength);
-    Unicode::toLower(data.characters(), realLength, m_data, m_length, &error);
+        return newImpl;
+    newImpl = createUninitialized(realLength, data);
+    Unicode::toLower(data, realLength, m_data, m_length, &error);
     if (error)
         return this;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::upper()
 {
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
 
     // Do a faster loop for the case where all the characters are ASCII.
@@ -273,32 +300,34 @@ PassRefPtr<StringImpl> StringImpl::upper()
         data[i] = toASCIIUpper(c);
     }
     if (!(ored & ~0x7F))
-        return adopt(data);
+        return newImpl;
 
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
-    int32_t realLength = Unicode::toUpper(data.characters(), length, m_data, m_length, &error);
+    int32_t realLength = Unicode::toUpper(data, length, m_data, m_length, &error);
     if (!error && realLength == length)
-        return adopt(data);
-    data.resize(realLength);
-    Unicode::toUpper(data.characters(), realLength, m_data, m_length, &error);
+        return newImpl;
+    newImpl = createUninitialized(realLength, data);
+    Unicode::toUpper(data, realLength, m_data, m_length, &error);
     if (error)
         return this;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::secure(UChar aChar)
 {
-    int length = m_length;
-    StringBuffer data(length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
+    int32_t length = m_length;
     for (int i = 0; i < length; ++i)
         data[i] = aChar;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::foldCase()
 {
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
 
     // Do a faster loop for the case where all the characters are ASCII.
@@ -309,18 +338,18 @@ PassRefPtr<StringImpl> StringImpl::foldCase()
         data[i] = toASCIILower(c);
     }
     if (!(ored & ~0x7F))
-        return adopt(data);
+        return newImpl;
 
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
-    int32_t realLength = Unicode::foldCase(data.characters(), length, m_data, m_length, &error);
+    int32_t realLength = Unicode::foldCase(data, length, m_data, m_length, &error);
     if (!error && realLength == length)
-        return adopt(data);
-    data.resize(realLength);
-    Unicode::foldCase(data.characters(), realLength, m_data, m_length, &error);
+        return newImpl;
+    newImpl = createUninitialized(realLength, data);
+    Unicode::foldCase(data, realLength, m_data, m_length, &error);
     if (error)
         return this;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::stripWhiteSpace()
@@ -698,14 +727,16 @@ PassRefPtr<StringImpl> StringImpl::replace(UChar oldC, UChar newC)
     if (i == m_length)
         return this;
 
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
+
     for (i = 0; i != m_length; ++i) {
         UChar ch = m_data[i];
         if (ch == oldC)
             ch = newC;
         data[i] = ch;
     }
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::replace(unsigned position, unsigned lengthToReplace, StringImpl* str)
@@ -715,13 +746,15 @@ PassRefPtr<StringImpl> StringImpl::replace(unsigned position, unsigned lengthToR
     unsigned lengthToInsert = str ? str->length() : 0;
     if (!lengthToReplace && !lengthToInsert)
         return this;
-    StringBuffer buffer(length() - lengthToReplace + lengthToInsert);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl =
+        createUninitialized(length() - lengthToReplace + lengthToInsert, data);
+    memcpy(data, characters(), position * sizeof(UChar));
     if (str)
-        memcpy(buffer.characters() + position, str->characters(), lengthToInsert * sizeof(UChar));
-    memcpy(buffer.characters() + position + lengthToInsert, characters() + position + lengthToReplace,
+        memcpy(data + position, str->characters(), lengthToInsert * sizeof(UChar));
+    memcpy(data + position + lengthToInsert, characters() + position + lengthToReplace,
         (length() - position - lengthToReplace) * sizeof(UChar));
-    return adopt(buffer);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacement)
@@ -743,8 +776,10 @@ PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacemen
     if (!matchCount)
         return this;
     
-    StringBuffer data(m_length - matchCount + (matchCount * repStrLength));
-    
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl =
+        createUninitialized(m_length - matchCount + (matchCount * repStrLength), data);
+
     // Construct the new data
     int srcSegmentEnd;
     int srcSegmentLength;
@@ -753,19 +788,19 @@ PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacemen
     
     while ((srcSegmentEnd = find(pattern, srcSegmentStart)) >= 0) {
         srcSegmentLength = srcSegmentEnd - srcSegmentStart;
-        memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+        memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
         dstOffset += srcSegmentLength;
-        memcpy(data.characters() + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
+        memcpy(data + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
         dstOffset += repStrLength;
         srcSegmentStart = srcSegmentEnd + 1;
     }
 
     srcSegmentLength = m_length - srcSegmentStart;
-    memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+    memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
 
-    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(data.length()));
+    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(newImpl->length()));
 
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::replace(StringImpl* pattern, StringImpl* replacement)
@@ -791,7 +826,9 @@ PassRefPtr<StringImpl> StringImpl::replace(StringImpl* pattern, StringImpl* repl
     if (!matchCount)
         return this;
     
-    StringBuffer data(m_length + matchCount * (repStrLength - patternLength));
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl =
+        createUninitialized(m_length + matchCount * (repStrLength - patternLength), data);
     
     // Construct the new data
     int srcSegmentEnd;
@@ -801,19 +838,19 @@ PassRefPtr<StringImpl> StringImpl::replace(StringImpl* pattern, StringImpl* repl
     
     while ((srcSegmentEnd = find(pattern, srcSegmentStart)) >= 0) {
         srcSegmentLength = srcSegmentEnd - srcSegmentStart;
-        memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+        memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
         dstOffset += srcSegmentLength;
-        memcpy(data.characters() + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
+        memcpy(data + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
         dstOffset += repStrLength;
         srcSegmentStart = srcSegmentEnd + patternLength;
     }
 
     srcSegmentLength = m_length - srcSegmentStart;
-    memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+    memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
 
-    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(data.length()));
+    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(newImpl->length()));
 
-    return adopt(data);
+    return newImpl;
 }
 
 bool equal(StringImpl* a, StringImpl* b)
@@ -907,26 +944,8 @@ WTF::Unicode::Direction StringImpl::defaultWritingDirection()
 }
 
 // This is a hot function because it's used when parsing HTML.
-PassRefPtr<StringImpl> StringImpl::createStrippingNullCharacters(const UChar* characters, unsigned length)
+PassRefPtr<StringImpl> StringImpl::createStrippingNullCharactersSlowCase(const UChar* characters, unsigned length)
 {
-    ASSERT(characters);
-    ASSERT(length);
-
-    // Optimize for the case where there are no Null characters by quickly
-    // searching for nulls, and then using StringImpl::create, which will
-    // memcpy the whole buffer.  This is faster than assigning character by
-    // character during the loop. 
-
-    // Fast case.
-    int foundNull = 0;
-    for (unsigned i = 0; !foundNull && i < length; i++) {
-        int c = characters[i]; // more efficient than using UChar here (at least on Intel Mac OS)
-        foundNull |= !c;
-    }
-    if (!foundNull)
-        return StringImpl::create(characters, length);
-    
-    // Slow case.
     StringBuffer strippedCopy(length);
     unsigned strippedLength = 0;
     for (unsigned i = 0; i < length; i++) {
@@ -954,30 +973,79 @@ PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
     return adoptRef(new StringImpl(vector.releaseBuffer(), size, AdoptBuffer()));
 }
 
+PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
+{
+    if (!length) {
+        data = 0;
+        return empty();
+    }
+
+    // Allocate a single buffer large enough to contain the StringImpl
+    // struct as well as the data which it contains. This removes one 
+    // heap allocation from this call.
+    size_t size = sizeof(StringImpl) + length * sizeof(UChar);
+    char* buffer = static_cast<char*>(fastMalloc(size));
+    data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
+    StringImpl* string = new (buffer) StringImpl(data, length, AdoptBuffer());
+    string->m_bufferIsInternal = true;
+    return adoptRef(string);
+}
+
 PassRefPtr<StringImpl> StringImpl::create(const UChar* characters, unsigned length)
 {
     if (!characters || !length)
         return empty();
-    return adoptRef(new StringImpl(characters, length));
+
+    UChar* data;
+    PassRefPtr<StringImpl> string = createUninitialized(length, data);
+    memcpy(data, characters, length * sizeof(UChar));
+    return string;
 }
 
 PassRefPtr<StringImpl> StringImpl::create(const char* characters, unsigned length)
 {
     if (!characters || !length)
         return empty();
-    return adoptRef(new StringImpl(characters, length));
+
+    UChar* data;
+    PassRefPtr<StringImpl> string = createUninitialized(length, data);
+    for (unsigned i = 0; i != length; ++i) {
+        unsigned char c = characters[i];
+        data[i] = c;
+    }
+    return string;
 }
 
 PassRefPtr<StringImpl> StringImpl::create(const char* string)
 {
     if (!string)
         return empty();
-    unsigned length = strlen(string);
-    if (!length)
-        return empty();
-    return adoptRef(new StringImpl(string, length));
+    return create(string, strlen(string));
+}
+
+#if USE(JSC)
+PassRefPtr<StringImpl> StringImpl::create(const JSC::UString& str)
+{
+    SharedUChar* sharedBuffer = const_cast<JSC::UString*>(&str)->rep()->baseString()->sharedBuffer();
+    if (sharedBuffer) {
+        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(str.data()), str.size(), AdoptBuffer()));
+        sharedBuffer->ref();
+        impl->m_sharedBufferAndFlags.set(sharedBuffer);
+        return impl;
+    }
+    return StringImpl::create(str.data(), str.size());
 }
 
+JSC::UString StringImpl::ustring()
+{
+    SharedUChar* sharedBuffer = StringImpl::sharedBuffer();
+    if (sharedBuffer)
+        return JSC::UString::Rep::create(const_cast<UChar*>(m_data), m_length, sharedBuffer);
+
+    return JSC::UString(m_data, m_length);
+}
+#endif
+
 PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const StringImpl& string)
 {
     return adoptRef(new StringImpl(string, WithTerminatingNullCharacter()));
@@ -985,7 +1053,18 @@ PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const Stri
 
 PassRefPtr<StringImpl> StringImpl::copy()
 {
-    return adoptRef(new StringImpl(m_data, m_length));
+    return create(m_data, m_length);
 }
 
+StringImpl::SharedUChar* StringImpl::sharedBuffer()
+{
+    if (m_length < minLengthToShare || m_bufferIsInternal)
+        return 0;
+
+    if (!m_sharedBufferAndFlags.get())
+        m_sharedBufferAndFlags.set(SharedUChar::create(new OwnFastMallocPtr<UChar>(const_cast<UChar*>(m_data))).releaseRef());
+    return m_sharedBufferAndFlags.get();
+}
+
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
index 9da136fdee..f59180054b 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,11 +25,18 @@
 
 #include <limits.h>
 #include <wtf/ASCIICType.h>
-#include <wtf/Forward.h>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/PtrAndFlags.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
+#if USE(JSC)
+#include <runtime/UString.h>
+#endif
+
 #if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
 typedef const struct __CFString * CFStringRef;
 #endif
@@ -47,6 +55,8 @@ struct HashAndCharactersTranslator;
 struct StringHash;
 struct UCharBufferTranslator;
 
+enum TextCaseSensitivity { TextCaseSensitive, TextCaseInsensitive };
+
 typedef bool (*CharacterMatchFunctionPtr)(UChar);
 
 class StringImpl : public RefCounted<StringImpl> {
@@ -70,23 +80,34 @@ private:
     StringImpl(const UChar*, unsigned length, unsigned hash);
     StringImpl(const char*, unsigned length, unsigned hash);
 
+    typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
+
 public:
     ~StringImpl();
 
     static PassRefPtr<StringImpl> create(const UChar*, unsigned length);
     static PassRefPtr<StringImpl> create(const char*, unsigned length);
     static PassRefPtr<StringImpl> create(const char*);
+    static PassRefPtr<StringImpl> createUninitialized(unsigned length, UChar*& data);
 
     static PassRefPtr<StringImpl> createWithTerminatingNullCharacter(const StringImpl&);
 
     static PassRefPtr<StringImpl> createStrippingNullCharacters(const UChar*, unsigned length);
     static PassRefPtr<StringImpl> adopt(StringBuffer&);
     static PassRefPtr<StringImpl> adopt(Vector<UChar>&);
+#if USE(JSC)
+    static PassRefPtr<StringImpl> create(const JSC::UString&);
+    JSC::UString ustring();
+#endif
 
+    SharedUChar* sharedBuffer();
     const UChar* characters() { return m_data; }
     unsigned length() { return m_length; }
 
-    bool hasTerminatingNullCharacter() { return m_hasTerminatingNullCharacter; }
+    bool hasTerminatingNullCharacter() const { return m_sharedBufferAndFlags.isFlagSet(HasTerminatingNullCharacter); }
+
+    bool inTable() const { return m_sharedBufferAndFlags.isFlagSet(InTable); }
+    void setInTable() { return m_sharedBufferAndFlags.setFlag(InTable); }
 
     unsigned hash() { if (m_hash == 0) m_hash = computeHash(m_data, m_length); return m_hash; }
     unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
@@ -164,12 +185,30 @@ public:
     operator NSString*();
 #endif
 
+    void operator delete(void*);
+
 private:
+    // Allocation from a custom buffer is only allowed internally to avoid
+    // mismatched allocators. Callers should use create().
+    void* operator new(size_t size);
+    void* operator new(size_t size, void* address);
+
+    static PassRefPtr<StringImpl> createStrippingNullCharactersSlowCase(const UChar*, unsigned length);
+
+    enum StringImplFlags {
+        HasTerminatingNullCharacter,
+        InTable,
+    };
+
     unsigned m_length;
     const UChar* m_data;
     mutable unsigned m_hash;
-    bool m_inTable;
-    bool m_hasTerminatingNullCharacter;
+    PtrAndFlags<SharedUChar, StringImplFlags> m_sharedBufferAndFlags;
+
+    // In some cases, we allocate the StringImpl struct and its data
+    // within a single heap buffer. In this case, the m_data pointer
+    // is an "internal buffer", and does not need to be deallocated.
+    bool m_bufferIsInternal;
 };
 
 bool equal(StringImpl*, StringImpl*);
@@ -272,6 +311,29 @@ static inline bool isSpaceOrNewline(UChar c)
     return c <= 0x7F ? WTF::isASCIISpace(c) : WTF::Unicode::direction(c) == WTF::Unicode::WhiteSpaceNeutral;
 }
 
+// This is a hot function because it's used when parsing HTML.
+inline PassRefPtr<StringImpl> StringImpl::createStrippingNullCharacters(const UChar* characters, unsigned length)
+{
+    ASSERT(characters);
+    ASSERT(length);
+
+    // Optimize for the case where there are no Null characters by quickly
+    // searching for nulls, and then using StringImpl::create, which will
+    // memcpy the whole buffer.  This is faster than assigning character by
+    // character during the loop. 
+
+    // Fast case.
+    int foundNull = 0;
+    for (unsigned i = 0; !foundNull && i < length; i++) {
+        int c = characters[i]; // more efficient than using UChar here (at least on Intel Mac OS)
+        foundNull |= !c;
+    }
+    if (!foundNull)
+        return StringImpl::create(characters, length);
+
+    return StringImpl::createStrippingNullCharactersSlowCase(characters, length);
+}
+
 }
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextBoundaries.h b/src/3rdparty/webkit/WebCore/platform/text/TextBoundaries.h
index 118dd1ac1a..7eb9cab581 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextBoundaries.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextBoundaries.h
@@ -30,6 +30,11 @@
 
 namespace WebCore {
 
+    inline bool requiresContextForWordBoundary(UChar32 ch)
+    {
+        return WTF::Unicode::hasLineBreakingPropertyComplexContext(ch);
+    }
+
     void findWordBoundary(const UChar*, int len, int position, int* start, int* end);
     int findNextWordFromIndex(const UChar*, int len, int position, bool forward);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextBoundariesICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextBoundariesICU.cpp
index d226048c72..b1e8ee2fe2 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextBoundariesICU.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextBoundariesICU.cpp
@@ -27,6 +27,7 @@
 #include "TextBoundaries.h"
 
 #include <unicode/ubrk.h>
+#include <unicode/uchar.h>
 
 #include "StringImpl.h"
 #include "TextBreakIterator.h"
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h
index 64717a49f4..7b3b963ff1 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIterator.h
@@ -29,7 +29,19 @@ namespace WebCore {
     class TextBreakIterator;
 
     // Note: The returned iterator is good only until you get another iterator.
+
+    // Iterates over "extended grapheme clusters", as defined in UAX #29.
+    // Note that platform implementations may be less sophisticated - e.g. ICU prior to
+    // version 4.0 only supports "legacy grapheme clusters".
+    // Use this for general text processing, e.g. string truncation.
     TextBreakIterator* characterBreakIterator(const UChar*, int length);
+
+    // This is similar to character break iterator in most cases, but is subject to
+    // platform UI conventions. One notable example where this can be different
+    // from character break iterator is Thai prepend characters, see bug 24342.
+    // Use this for insertion point and selection manipulations.
+    TextBreakIterator* cursorMovementIterator(const UChar*, int length);
+
     TextBreakIterator* wordBreakIterator(const UChar*, int length);
     TextBreakIterator* lineBreakIterator(const UChar*, int length);
     TextBreakIterator* sentenceBreakIterator(const UChar*, int length);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp
index 9941f58fd6..c4fc1b0ee7 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextBreakIteratorICU.cpp
@@ -22,6 +22,7 @@
 #include "config.h"
 #include "TextBreakIterator.h"
 
+#include "PlatformString.h"
 #include "TextBreakIteratorInternalICU.h"
 
 #include <unicode/ubrk.h>
@@ -114,4 +115,119 @@ bool isTextBreak(TextBreakIterator* bi, int pos)
     return ubrk_isBoundary(bi, pos);
 }
 
+#ifndef BUILDING_ON_TIGER
+static TextBreakIterator* setUpIteratorWithRules(bool& createdIterator, TextBreakIterator*& iterator,
+    const char* breakRules, const UChar* string, int length)
+{
+    if (!string)
+        return 0;
+
+    if (!createdIterator) {
+        UParseError parseStatus;
+        UErrorCode openStatus = U_ZERO_ERROR;
+        String rules(breakRules);
+        iterator = static_cast<TextBreakIterator*>(ubrk_openRules(rules.characters(), rules.length(), 0, 0, &parseStatus, &openStatus));
+        createdIterator = true;
+        ASSERT_WITH_MESSAGE(U_SUCCESS(openStatus), "ICU could not open a break iterator: %s (%d)", u_errorName(openStatus), openStatus);
+    }
+    if (!iterator)
+        return 0;
+
+    UErrorCode setTextStatus = U_ZERO_ERROR;
+    ubrk_setText(iterator, string, length, &setTextStatus);
+    if (U_FAILURE(setTextStatus))
+        return 0;
+
+    return iterator;
+}
+#endif // BUILDING_ON_TIGER
+
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+#ifdef BUILDING_ON_TIGER
+    // ICU 3.2 cannot compile the below rules.
+    return characterBreakIterator(string, length);
+#else
+    // This rule set is based on character-break iterator rules of ICU 4.0
+    // <http://source.icu-project.org/repos/icu/icu/tags/release-4-0/source/data/brkitr/char.txt>.
+    // The major differences from the original ones are listed below:
+    // * Replaced '[\p{Grapheme_Cluster_Break = SpacingMark}]' with '[\p{General_Category = Spacing Mark} - $Extend]' for ICU 3.8 or earlier;
+    // * Removed rules that prevent a cursor from moving after prepend characters (Bug 24342);
+    // * Added rules that prevent a cursor from moving after virama signs of Indic languages except Tamil (Bug 15790), and;
+    // * Added rules that prevent a cursor from moving before Japanese half-width katakara voiced marks.
+    static const char* kRules =
+        "$CR      = [\\p{Grapheme_Cluster_Break = CR}];"
+        "$LF      = [\\p{Grapheme_Cluster_Break = LF}];"
+        "$Control = [\\p{Grapheme_Cluster_Break = Control}];"
+        "$VoiceMarks = [\\uFF9E\\uFF9F];"  // Japanese half-width katakana voiced marks
+        "$Extend  = [\\p{Grapheme_Cluster_Break = Extend} $VoiceMarks];"
+        "$SpacingMark = [[\\p{General_Category = Spacing Mark}] - $Extend];"
+        "$L       = [\\p{Grapheme_Cluster_Break = L}];"
+        "$V       = [\\p{Grapheme_Cluster_Break = V}];"
+        "$T       = [\\p{Grapheme_Cluster_Break = T}];"
+        "$LV      = [\\p{Grapheme_Cluster_Break = LV}];"
+        "$LVT     = [\\p{Grapheme_Cluster_Break = LVT}];"
+        "$Hin0    = [\\u0905-\\u0939];"    // Devanagari Letter A,...,Ha
+        "$HinV    = \\u094D;"              // Devanagari Sign Virama
+        "$Hin1    = [\\u0915-\\u0939];"    // Devanagari Letter Ka,...,Ha
+        "$Ben0    = [\\u0985-\\u09B9];"    // Bengali Letter A,...,Ha
+        "$BenV    = \\u09CD;"              // Bengali Sign Virama
+        "$Ben1    = [\\u0995-\\u09B9];"    // Bengali Letter Ka,...,Ha
+        "$Pan0    = [\\u0A05-\\u0A39];"    // Gurmukhi Letter A,...,Ha
+        "$PanV    = \\u0A4D;"              // Gurmukhi Sign Virama
+        "$Pan1    = [\\u0A15-\\u0A39];"    // Gurmukhi Letter Ka,...,Ha
+        "$Guj0    = [\\u0A85-\\u0AB9];"    // Gujarati Letter A,...,Ha
+        "$GujV    = \\u0ACD;"              // Gujarati Sign Virama
+        "$Guj1    = [\\u0A95-\\u0AB9];"    // Gujarati Letter Ka,...,Ha
+        "$Ori0    = [\\u0B05-\\u0B39];"    // Oriya Letter A,...,Ha
+        "$OriV    = \\u0B4D;"              // Oriya Sign Virama
+        "$Ori1    = [\\u0B15-\\u0B39];"    // Oriya Letter Ka,...,Ha
+        "$Tel0    = [\\u0C05-\\u0C39];"    // Telugu Letter A,...,Ha
+        "$TelV    = \\u0C4D;"              // Telugu Sign Virama
+        "$Tel1    = [\\u0C14-\\u0C39];"    // Telugu Letter Ka,...,Ha
+        "$Kan0    = [\\u0C85-\\u0CB9];"    // Kannada Letter A,...,Ha
+        "$KanV    = \\u0CCD;"              // Kannada Sign Virama
+        "$Kan1    = [\\u0C95-\\u0CB9];"    // Kannada Letter A,...,Ha
+        "$Mal0    = [\\u0D05-\\u0D39];"    // Malayalam Letter A,...,Ha
+        "$MalV    = \\u0D4D;"              // Malayalam Sign Virama
+        "$Mal1    = [\\u0D15-\\u0D39];"    // Malayalam Letter A,...,Ha
+        "!!chain;"
+        "!!forward;"
+        "$CR $LF;"
+        "$L ($L | $V | $LV | $LVT);"
+        "($LV | $V) ($V | $T);"
+        "($LVT | $T) $T;"
+        "[^$Control $CR $LF] $Extend;"
+        "[^$Control $CR $LF] $SpacingMark;"
+        "$Hin0 $HinV $Hin1;"               // Devanagari Virama (forward)
+        "$Ben0 $BenV $Ben1;"               // Bengali Virama (forward)
+        "$Pan0 $PanV $Pan1;"               // Gurmukhi Virama (forward)
+        "$Guj0 $GujV $Guj1;"               // Gujarati Virama (forward)
+        "$Ori0 $OriV $Ori1;"               // Oriya Virama (forward)
+        "$Tel0 $TelV $Tel1;"               // Telugu Virama (forward)
+        "$Kan0 $KanV $Kan1;"               // Kannada Virama (forward)
+        "$Mal0 $MalV $Mal1;"               // Malayalam Virama (forward)
+        "!!reverse;"
+        "$LF $CR;"
+        "($L | $V | $LV | $LVT) $L;"
+        "($V | $T) ($LV | $V);"
+        "$T ($LVT | $T);"
+        "$Extend      [^$Control $CR $LF];"
+        "$SpacingMark [^$Control $CR $LF];"
+        "$Hin1 $HinV $Hin0;"               // Devanagari Virama (backward)
+        "$Ben1 $BenV $Ben0;"               // Bengali Virama (backward)
+        "$Pan1 $PanV $Pan0;"               // Gurmukhi Virama (backward)
+        "$Guj1 $GujV $Guj0;"               // Gujarati Virama (backward)
+        "$Ori1 $OriV $Ori0;"               // Gujarati Virama (backward)
+        "$Tel1 $TelV $Tel0;"               // Telugu Virama (backward)
+        "$Kan1 $KanV $Kan0;"               // Kannada Virama (backward)
+        "$Mal1 $MalV $Mal0;"               // Malayalam Virama (backward)
+        "!!safe_reverse;"
+        "!!safe_forward;";
+    static bool createdCursorMovementIterator = false;
+    static TextBreakIterator* staticCursorMovementIterator;
+    return setUpIteratorWithRules(createdCursorMovementIterator, staticCursorMovementIterator, kRules, string, length);
+#endif // BUILDING_ON_TIGER
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h b/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h
index 0a56262d71..df42582947 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h
@@ -29,6 +29,7 @@
 
 #include <memory>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
@@ -76,7 +77,7 @@ namespace WebCore {
 
     typedef void (*EncodingNameRegistrar)(const char* alias, const char* name);
 
-    typedef std::auto_ptr<TextCodec> (*NewTextCodecFunction)(const TextEncoding&, const void* additionalData);
+    typedef PassOwnPtr<TextCodec> (*NewTextCodecFunction)(const TextEncoding&, const void* additionalData);
     typedef void (*TextCodecRegistrar)(const char* name, NewTextCodecFunction, const void* additionalData);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp
index 79ac23ec79..7ebce2c5b8 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.cpp
@@ -34,10 +34,10 @@
 #include <unicode/ucnv.h>
 #include <unicode/ucnv_cb.h>
 #include <wtf/Assertions.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 
-using std::auto_ptr;
 using std::min;
 
 namespace WebCore {
@@ -55,9 +55,9 @@ static UConverter*& cachedConverterICU()
     return threadGlobalData().cachedConverterICU().converter;
 }
 
-static auto_ptr<TextCodec> newTextCodecICU(const TextEncoding& encoding, const void*)
+static PassOwnPtr<TextCodec> newTextCodecICU(const TextEncoding& encoding, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecICU(encoding));
+    return new TextCodecICU(encoding);
 }
 
 void TextCodecICU::registerBaseEncodingNames(EncodingNameRegistrar registrar)
@@ -330,7 +330,7 @@ String TextCodecICU::decode(const char* bytes, size_t length, bool flush, bool s
 
     // <http://bugs.webkit.org/show_bug.cgi?id=17014>
     // Simplified Chinese pages use the code A3A0 to mean "full-width space", but ICU decodes it as U+E5E5.
-    if (m_encoding == "GBK" || m_encoding == "gb18030")
+    if (strcmp(m_encoding.name(), "GBK") == 0 || strcasecmp(m_encoding.name(), "gb18030") == 0)
         resultString.replace(0xE5E5, ideographicSpace);
 
     return resultString;
@@ -428,7 +428,7 @@ CString TextCodecICU::encode(const UChar* characters, size_t length, Unencodable
     // until then, we change the backslash into a yen sign.
     // Encoding will change the yen sign back into a backslash.
     String copy(characters, length);
-    copy.replace('\\', m_encoding.backslashAsCurrencySymbol());
+    copy = m_encoding.displayString(copy.impl());
 
     const UChar* source = copy.characters();
     const UChar* sourceLimit = source + copy.length();
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.h b/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.h
index f07758f49a..bf517f7bed 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodecICU.h
@@ -30,6 +30,8 @@
 #include "TextCodec.h"
 #include "TextEncoding.h"
 
+#include <unicode/utypes.h>
+
 typedef struct UConverter UConverter;
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp
index 50f9f97060..cfdc5b9b4e 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodecLatin1.cpp
@@ -30,8 +30,7 @@
 #include "PlatformString.h"
 #include "StringBuffer.h"
 #include <stdio.h>
-
-using std::auto_ptr;
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -104,9 +103,9 @@ void TextCodecLatin1::registerEncodingNames(EncodingNameRegistrar registrar)
     registrar("x-ansi", "US-ASCII");
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderWindowsLatin1(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderWindowsLatin1(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecLatin1);
+    return new TextCodecLatin1;
 }
 
 void TextCodecLatin1::registerCodecs(TextCodecRegistrar registrar)
@@ -120,7 +119,8 @@ void TextCodecLatin1::registerCodecs(TextCodecRegistrar registrar)
 
 String TextCodecLatin1::decode(const char* bytes, size_t length, bool, bool, bool&)
 {
-    StringBuffer characters(length);
+    UChar* characters;
+    String result = String::createUninitialized(length, characters);
 
     // Convert the string a fast way and simultaneously do an efficient check to see if it's all ASCII.
     unsigned char ored = 0;
@@ -131,7 +131,7 @@ String TextCodecLatin1::decode(const char* bytes, size_t length, bool, bool, boo
     }
 
     if (!(ored & 0x80))
-        return String::adopt(characters);
+        return result;
 
     // Convert the slightly slower way when there are non-ASCII characters.
     for (size_t i = 0; i < length; ++i) {
@@ -139,7 +139,7 @@ String TextCodecLatin1::decode(const char* bytes, size_t length, bool, bool, boo
         characters[i] = table[c];
     }
 
-    return String::adopt(characters);
+    return result;
 }
 
 static CString encodeComplexWindowsLatin1(const UChar* characters, size_t length, UnencodableHandling handling)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodecUTF16.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextCodecUTF16.cpp
index a4d0d28da8..db770003ca 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodecUTF16.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodecUTF16.cpp
@@ -29,8 +29,7 @@
 #include "CString.h"
 #include "PlatformString.h"
 #include "StringBuffer.h"
-
-using std::auto_ptr;
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -49,14 +48,14 @@ void TextCodecUTF16::registerEncodingNames(EncodingNameRegistrar registrar)
     registrar("unicodeFFFE", "UTF-16BE");
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderUTF16LE(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderUTF16LE(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecUTF16(true));
+    return new TextCodecUTF16(true);
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderUTF16BE(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderUTF16BE(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecUTF16(false));
+    return new TextCodecUTF16(false);
 }
 
 void TextCodecUTF16::registerCodecs(TextCodecRegistrar registrar)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodecUserDefined.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextCodecUserDefined.cpp
index 2dae0f31a9..b7c88964f5 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodecUserDefined.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodecUserDefined.cpp
@@ -30,8 +30,7 @@
 #include "PlatformString.h"
 #include "StringBuffer.h"
 #include <stdio.h>
-
-using std::auto_ptr;
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,9 +39,9 @@ void TextCodecUserDefined::registerEncodingNames(EncodingNameRegistrar registrar
     registrar("x-user-defined", "x-user-defined");
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderUserDefined(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderUserDefined(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecUserDefined);
+    return new TextCodecUserDefined;
 }
 
 void TextCodecUserDefined::registerCodecs(TextCodecRegistrar registrar)
@@ -52,14 +51,15 @@ void TextCodecUserDefined::registerCodecs(TextCodecRegistrar registrar)
 
 String TextCodecUserDefined::decode(const char* bytes, size_t length, bool, bool, bool&)
 {
-    StringBuffer buffer(length);
+    UChar* buffer;
+    String result = String::createUninitialized(length, buffer);
 
     for (size_t i = 0; i < length; ++i) {
         signed char c = bytes[i];
         buffer[i] = c & 0xF7FF;
     }
 
-    return String::adopt(buffer);
+    return result;
 }
 
 static CString encodeComplexUserDefined(const UChar* characters, size_t length, UnencodableHandling handling)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextDecoder.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextDecoder.cpp
deleted file mode 100644
index e39a6b7d29..0000000000
--- a/src/3rdparty/webkit/WebCore/platform/text/TextDecoder.cpp
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "TextDecoder.h"
-
-#include "TextEncodingRegistry.h"
-
-// FIXME: Would be nice to also handle BOM for UTF-7 and UTF-32.
-
-namespace WebCore {
-
-TextDecoder::TextDecoder(const TextEncoding& encoding)
-    : m_encoding(encoding)
-    , m_checkedForBOM(false)
-    , m_numBufferedBytes(0)
-{
-}
-
-void TextDecoder::reset(const TextEncoding& encoding)
-{
-    m_encoding = encoding;
-    m_codec.clear();
-    m_checkedForBOM = false;
-    m_numBufferedBytes = 0;
-}
-
-String TextDecoder::checkForBOM(const char* data, size_t length, bool flush, bool stopOnError, bool& sawError)
-{
-    ASSERT(!m_checkedForBOM);
-
-    // Check to see if we found a BOM.
-    size_t numBufferedBytes = m_numBufferedBytes;
-    size_t buf1Len = numBufferedBytes;
-    size_t buf2Len = length;
-    const unsigned char* buf1 = m_bufferedBytes;
-    const unsigned char* buf2 = reinterpret_cast<const unsigned char*>(data);
-    unsigned char c1 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
-    unsigned char c2 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
-    unsigned char c3 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
-    unsigned char c4 = buf2Len ? (--buf2Len, *buf2++) : 0;
-
-    const TextEncoding* encodingConsideringBOM = &m_encoding;
-    bool foundBOM = true;
-    size_t lengthOfBOM = 0;
-    if (c1 == 0xFF && c2 == 0xFE) {
-        if (c3 != 0 || c4 != 0)  {
-            encodingConsideringBOM = &UTF16LittleEndianEncoding();
-            lengthOfBOM = 2;
-        } else if (numBufferedBytes + length > sizeof(m_bufferedBytes)) {
-            encodingConsideringBOM = &UTF32LittleEndianEncoding();
-            lengthOfBOM = 4;
-        } else
-            foundBOM = false;
-    } else if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF) {
-        encodingConsideringBOM = &UTF8Encoding();
-        lengthOfBOM = 3;
-    } else if (c1 == 0xFE && c2 == 0xFF) {
-        encodingConsideringBOM = &UTF16BigEndianEncoding();
-        lengthOfBOM = 2;
-    } else if (c1 == 0 && c2 == 0 && c3 == 0xFE && c4 == 0xFF) {
-        encodingConsideringBOM = &UTF32BigEndianEncoding();
-        lengthOfBOM = 4;
-    } else
-        foundBOM = false;
-
-    if (!foundBOM && numBufferedBytes + length <= sizeof(m_bufferedBytes) && !flush) {
-        // Continue to look for the BOM.
-        memcpy(&m_bufferedBytes[numBufferedBytes], data, length);
-        m_numBufferedBytes += length;
-        return "";
-    }
-
-    // Done checking for BOM.
-    m_codec.set(newTextCodec(*encodingConsideringBOM).release());
-    if (!m_codec)
-        return String();
-    m_checkedForBOM = true;
-
-    // Skip the BOM.
-    if (foundBOM) {
-        ASSERT(numBufferedBytes < lengthOfBOM);
-        size_t numUnbufferedBOMBytes = lengthOfBOM - numBufferedBytes;
-        ASSERT(numUnbufferedBOMBytes <= length);
-
-        data += numUnbufferedBOMBytes;
-        length -= numUnbufferedBOMBytes;
-        numBufferedBytes = 0;
-        m_numBufferedBytes = 0;
-    }
-
-    // Handle case where we have some buffered bytes to deal with.
-    if (numBufferedBytes) {
-        char bufferedBytes[sizeof(m_bufferedBytes)];
-        memcpy(bufferedBytes, m_bufferedBytes, numBufferedBytes);
-        m_numBufferedBytes = 0;
-
-        String bufferedResult = m_codec->decode(bufferedBytes, numBufferedBytes, false, stopOnError, sawError);
-        if (stopOnError && sawError)
-            return bufferedResult;
-        return bufferedResult + m_codec->decode(data, length, flush, stopOnError, sawError);
-    }
-
-    return m_codec->decode(data, length, flush, stopOnError, sawError);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
index 9d6ff7dea5..5fa927be27 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,9 +30,8 @@
 #include "CString.h"
 #include "PlatformString.h"
 #include "TextCodec.h"
-#include "TextDecoder.h"
 #include "TextEncodingRegistry.h"
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
 #include <unicode/unorm.h>
 #elif USE(QT4_UNICODE)
 #include <QString>
@@ -58,11 +57,13 @@ static const TextEncoding& UTF7Encoding()
 
 TextEncoding::TextEncoding(const char* name)
     : m_name(atomicCanonicalTextEncodingName(name))
+    , m_backslashAsCurrencySymbol(backslashAsCurrencySymbol())
 {
 }
 
 TextEncoding::TextEncoding(const String& name)
     : m_name(atomicCanonicalTextEncodingName(name.characters(), name.length()))
+    , m_backslashAsCurrencySymbol(backslashAsCurrencySymbol())
 {
 }
 
@@ -71,7 +72,7 @@ String TextEncoding::decode(const char* data, size_t length, bool stopOnError, b
     if (!m_name)
         return String();
 
-    return TextDecoder(*this).decode(data, length, true, stopOnError, sawError);
+    return newTextCodec(*this)->decode(data, length, true, stopOnError, sawError);
 }
 
 CString TextEncoding::encode(const UChar* characters, size_t length, UnencodableHandling handling) const
@@ -82,7 +83,7 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     if (!length)
         return "";
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     // FIXME: What's the right place to do normalization?
     // It's a little strange to do it inside the encode function.
     // Perhaps normalization should be an explicit step done before calling encode.
@@ -115,6 +116,24 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
 #endif
 }
 
+const char* TextEncoding::domName() const
+{
+    if (noExtendedTextEncodingNameUsed())
+        return m_name;
+
+    // We treat EUC-KR as windows-949 (its superset), but need to expose 
+    // the name 'EUC-KR' because the name 'windows-949' is not recognized by
+    // most Korean web servers even though they do use the encoding
+    // 'windows-949' with the name 'EUC-KR'. 
+    // FIXME: This is not thread-safe. At the moment, this function is
+    // only accessed in a single thread, but eventually has to be made
+    // thread-safe along with usesVisualOrdering().
+    static const char* const a = atomicCanonicalTextEncodingName("windows-949");
+    if (m_name == a)
+        return "EUC-KR";
+    return m_name;
+}
+
 bool TextEncoding::usesVisualOrdering() const
 {
     if (noExtendedTextEncodingNameUsed())
@@ -163,10 +182,23 @@ UChar TextEncoding::backslashAsCurrencySymbol() const
 
 bool TextEncoding::isNonByteBasedEncoding() const
 {
+    if (noExtendedTextEncodingNameUsed()) {
+        return *this == UTF16LittleEndianEncoding()
+            || *this == UTF16BigEndianEncoding();
+    }
+
     return *this == UTF16LittleEndianEncoding()
-           || *this == UTF16BigEndianEncoding()
-           || *this == UTF32BigEndianEncoding()
-           || *this == UTF32LittleEndianEncoding();
+        || *this == UTF16BigEndianEncoding()
+        || *this == UTF32BigEndianEncoding()
+        || *this == UTF32LittleEndianEncoding();
+}
+
+bool TextEncoding::isUTF7Encoding() const
+{
+    if (noExtendedTextEncodingNameUsed())
+        return false;
+
+    return *this == UTF7Encoding();
 }
 
 const TextEncoding& TextEncoding::closestByteBasedEquivalent() const
@@ -183,7 +215,7 @@ const TextEncoding& TextEncoding::closestByteBasedEquivalent() const
 // but it's fraught with problems and we'd rather steer clear of it.
 const TextEncoding& TextEncoding::encodingForFormSubmission() const
 {
-    if (isNonByteBasedEncoding() || *this == UTF7Encoding())
+    if (isNonByteBasedEncoding() || isUTF7Encoding())
         return UTF8Encoding();
     return *this;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.h b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.h
index 3fd6ce03b0..a99bfc85b4 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,9 +42,26 @@ namespace WebCore {
 
         bool isValid() const { return m_name; }
         const char* name() const { return m_name; }
+        const char* domName() const; // name exposed via DOM
         bool usesVisualOrdering() const;
         bool isJapanese() const;
-        UChar backslashAsCurrencySymbol() const;
+        
+        PassRefPtr<StringImpl> displayString(PassRefPtr<StringImpl> str) const
+        {
+            if (m_backslashAsCurrencySymbol == '\\' || !str)
+                return str;
+            return str->replace('\\', m_backslashAsCurrencySymbol);
+        }
+        void displayBuffer(UChar* characters, unsigned len) const
+        {
+            if (m_backslashAsCurrencySymbol == '\\')
+                return;
+            for (unsigned i = 0; i < len; ++i) {
+                if (characters[i] == '\\')
+                    characters[i] = m_backslashAsCurrencySymbol;
+            }
+        }
+
         const TextEncoding& closestByteBasedEquivalent() const;
         const TextEncoding& encodingForFormSubmission() const;
 
@@ -57,8 +74,12 @@ namespace WebCore {
         CString encode(const UChar*, size_t length, UnencodableHandling) const;
 
     private:
-        const char* m_name;
+        UChar backslashAsCurrencySymbol() const;
         bool isNonByteBasedEncoding() const;
+        bool isUTF7Encoding() const;
+
+        const char* m_name;
+        UChar m_backslashAsCurrencySymbol;
     };
 
     inline bool operator==(const TextEncoding& a, const TextEncoding& b) { return a.name() == b.name(); }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetector.h b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetector.h
new file mode 100644
index 0000000000..9f16ab0707
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetector.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TextEncodingDetector_h
+#define TextEncodingDetector_h
+
+namespace WebCore {
+
+    class TextEncoding;
+
+    // Given a sequence of bytes in |data| of length |len| and an optional
+    // hintEncodingName, detect the most likely character encoding. 
+    // The way hintEncodingName is used is up to an implementation.
+    // Currently, the only caller sets it to the parent frame encoding.
+    bool detectTextEncoding(const char* data, size_t len,
+                            const char* hintEncodingName,
+                            TextEncoding* detectedEncoding);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorICU.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorICU.cpp
new file mode 100644
index 0000000000..fcb2aa9160
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorICU.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TextEncodingDetector.h"
+
+#include "TextEncoding.h"
+#include <wtf/UnusedParam.h>
+
+#ifndef BUILDING_ON_TIGER
+#include "unicode/ucnv.h"
+#include "unicode/ucsdet.h"
+#endif
+
+namespace WebCore {
+
+bool detectTextEncoding(const char* data, size_t len,
+                        const char* hintEncodingName,
+                        TextEncoding* detectedEncoding)
+{
+    *detectedEncoding = TextEncoding();
+#ifdef BUILDING_ON_TIGER
+    // Tiger came with ICU 3.2 and does not have the encoding detector.
+    UNUSED_PARAM(data);
+    UNUSED_PARAM(len);
+    UNUSED_PARAM(hintEncodingName);
+    return false;
+#else
+    int matchesCount = 0; 
+    UErrorCode status = U_ZERO_ERROR;
+    UCharsetDetector* detector = ucsdet_open(&status);
+    if (U_FAILURE(status))
+        return false;
+    ucsdet_enableInputFilter(detector, true);
+    ucsdet_setText(detector, data, static_cast<int32_t>(len), &status); 
+    if (U_FAILURE(status))
+        return false;
+
+    // FIXME: A few things we can do other than improving
+    // the ICU detector itself. 
+    // 1. Use ucsdet_detectAll and pick the most likely one given
+    // "the context" (parent-encoding, referrer encoding, etc).
+    // 2. 'Emulate' Firefox/IE's non-Universal detectors (e.g.
+    // Chinese, Japanese, Russian, Korean and Hebrew) by picking the 
+    // encoding with a highest confidence among the detetctor-specific
+    // limited set of candidate encodings.
+    // Below is a partial implementation of the first part of what's outlined
+    // above.
+    const UCharsetMatch** matches = ucsdet_detectAll(detector, &matchesCount, &status);
+    if (U_FAILURE(status)) {
+        ucsdet_close(detector);
+        return false;
+    }
+
+    const char* encoding = 0;
+    if (hintEncodingName) {
+        TextEncoding hintEncoding(hintEncodingName);
+        // 10 is the minimum confidence value consistent with the codepoint
+        // allocation in a given encoding. The size of a chunk passed to
+        // us varies even for the same html file (apparently depending on 
+        // the network load). When we're given a rather short chunk, we 
+        // don't have a sufficiently reliable signal other than the fact that
+        // the chunk is consistent with a set of encodings. So, instead of
+        // setting an arbitrary threshold, we have to scan all the encodings
+        // consistent with the data.  
+        const int32_t kThresold = 10;
+        for (int i = 0; i < matchesCount; ++i) {
+            int32_t confidence = ucsdet_getConfidence(matches[i], &status);
+            if (U_FAILURE(status)) {
+                status = U_ZERO_ERROR;
+                continue;
+            }
+            if (confidence < kThresold)
+                break;
+            const char* matchEncoding = ucsdet_getName(matches[i], &status);
+            if (U_FAILURE(status)) {
+                status = U_ZERO_ERROR;
+                continue;
+            }
+            if (TextEncoding(matchEncoding) == hintEncoding) {
+                encoding = hintEncodingName;
+                break;
+            }
+        }
+    }
+    // If no match is found so far, just pick the top match. 
+    // This can happen, say, when a parent frame in EUC-JP refers to
+    // a child frame in Shift_JIS and both frames do NOT specify the encoding
+    // making us resort to auto-detection (when it IS turned on).
+    if (!encoding && matchesCount > 0)
+        encoding = ucsdet_getName(matches[0], &status);
+    if (U_SUCCESS(status)) {
+        *detectedEncoding = TextEncoding(encoding);
+        ucsdet_close(detector);
+        return true;
+    }    
+    ucsdet_close(detector);
+    return false;
+#endif
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorNone.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorNone.cpp
new file mode 100644
index 0000000000..3b62bc5b05
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingDetectorNone.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TextEncodingDetector.h"
+
+#include "TextEncoding.h"
+
+namespace WebCore {
+
+bool detectTextEncoding(const char*, size_t, const char*, TextEncoding* detectedEncoding)
+{
+    *detectedEncoding = TextEncoding();
+    return false;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
index 2d89fac8c0..3c9d65fa91 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -38,7 +38,7 @@
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
 #include "TextCodecICU.h"
 #endif
 #if PLATFORM(MAC)
@@ -185,7 +185,7 @@ static void buildBaseTextCodecMaps()
     TextCodecUserDefined::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUserDefined::registerCodecs(addToTextCodecMap);
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     TextCodecICU::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
@@ -193,7 +193,7 @@ static void buildBaseTextCodecMaps()
 
 static void extendTextCodecMaps()
 {
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     TextCodecICU::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerExtendedCodecs(addToTextCodecMap);
 #endif
@@ -209,7 +209,7 @@ static void extendTextCodecMaps()
 #endif
 }
 
-std::auto_ptr<TextCodec> newTextCodec(const TextEncoding& encoding)
+PassOwnPtr<TextCodec> newTextCodec(const TextEncoding& encoding)
 {
     MutexLocker lock(encodingRegistryMutex());
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.h b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.h
index 5ca2039c76..e6950cfdbc 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.h
@@ -27,6 +27,7 @@
 #define TextEncodingRegistry_h
 
 #include <memory>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
@@ -34,12 +35,9 @@ namespace WebCore {
     class TextCodec;
     class TextEncoding;
 
-    // Only TextEncoding and TextDecoder should use this function directly.
-    // - Use TextDecoder::decode to decode, since it handles BOMs.
-    // - Use TextEncoding::decode to decode if you have all the data at once.
-    //   It's implemented by calling TextDecoder::decode so works just as well.
-    // - Use TextEncoding::encode to encode, since it takes care of normalization.
-    std::auto_ptr<TextCodec> newTextCodec(const TextEncoding&);
+    // Use TextResourceDecoder::decode to decode resources, since it handles BOMs.
+    // Use TextEncoding::encode to encode, since it takes care of normalization.
+    PassOwnPtr<TextCodec> newTextCodec(const TextEncoding&);
 
     // Only TextEncoding should use this function directly.
     const char* atomicCanonicalTextEncodingName(const char* alias);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp
index 5b7a0c776a..eb4bae7b68 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextStream.cpp
@@ -33,6 +33,11 @@ namespace WebCore {
 
 static const size_t printBufferSize = 100; // large enough for any integer or floating point value in string format, including trailing null character
 
+TextStream& TextStream::operator<<(bool b)
+{
+    return *this << (b ? "1" : "0");
+}
+
 TextStream& TextStream::operator<<(int i)
 {
     char buffer[printBufferSize];
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextStream.h b/src/3rdparty/webkit/WebCore/platform/text/TextStream.h
index 6fb3f4bce0..71034f3b9d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextStream.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextStream.h
@@ -35,6 +35,7 @@ class String;
 
 class TextStream {
 public:
+    TextStream& operator<<(bool);
     TextStream& operator<<(int);
     TextStream& operator<<(unsigned);
     TextStream& operator<<(long);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp b/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp
index ff595a5011..8a2ae79158 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/cf/StringImplCF.cpp
@@ -1,5 +1,5 @@
-/**
- * Copyright (C) 2006 Apple Computer, Inc.
+/*
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,14 +24,139 @@
 #if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
 
 #include <CoreFoundation/CoreFoundation.h>
+#include <wtf/MainThread.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER)
+#include <objc/objc-auto.h>
+#endif
 
 namespace WebCore {
 
+namespace StringWrapperCFAllocator {
+
+    static StringImpl* currentString;
+
+    static const void* retain(const void* info)
+    {
+        return info;
+    }
+
+    static void release(const void*)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    static CFStringRef copyDescription(const void*)
+    {
+        return CFSTR("WebCore::String-based allocator");
+    }
+
+    static void* allocate(CFIndex size, CFOptionFlags, void*)
+    {
+        StringImpl* underlyingString = 0;
+        if (isMainThread()) {
+            underlyingString = currentString;
+            if (underlyingString) {
+                currentString = 0;
+                underlyingString->ref(); // Balanced by call to deref in deallocate below.
+            }
+        }
+        StringImpl** header = static_cast<StringImpl**>(fastMalloc(sizeof(StringImpl*) + size));
+        *header = underlyingString;
+        return header + 1;
+    }
+
+    static void* reallocate(void* pointer, CFIndex newSize, CFOptionFlags, void*)
+    {
+        size_t newAllocationSize = sizeof(StringImpl*) + newSize;
+        StringImpl** header = static_cast<StringImpl**>(pointer) - 1;
+        ASSERT(!*header);
+        header = static_cast<StringImpl**>(fastRealloc(header, newAllocationSize));
+        return header + 1;
+    }
+
+    static void deallocateOnMainThread(void* headerPointer)
+    {
+        StringImpl** header = static_cast<StringImpl**>(headerPointer);
+        StringImpl* underlyingString = *header;
+        ASSERT(underlyingString);
+        underlyingString->deref(); // Balanced by call to ref in allocate above.
+        fastFree(header);
+    }
+
+    static void deallocate(void* pointer, void*)
+    {
+        StringImpl** header = static_cast<StringImpl**>(pointer) - 1;
+        StringImpl* underlyingString = *header;
+        if (!underlyingString)
+            fastFree(header);
+        else {
+            if (!isMainThread())
+                callOnMainThread(deallocateOnMainThread, header);
+            else {
+                underlyingString->deref(); // Balanced by call to ref in allocate above.
+                fastFree(header);
+            }
+        }
+    }
+
+    static CFIndex preferredSize(CFIndex size, CFOptionFlags, void*)
+    {
+        // FIXME: If FastMalloc provided a "good size" callback, we'd want to use it here.
+        // Note that this optimization would help performance for strings created with the
+        // allocator that are mutable, and those typically are only created by callers who
+        // make a new string using the old string's allocator, such as some of the call
+        // sites in CFURL.
+        return size;
+    }
+
+    static CFAllocatorRef create()
+    {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER)
+        // Since garbage collection isn't compatible with custom allocators, don't use this at all when garbage collection is active.
+        if (objc_collectingEnabled())
+            return 0;
+#endif
+        CFAllocatorContext context = { 0, 0, retain, release, copyDescription, allocate, reallocate, deallocate, preferredSize };
+        return CFAllocatorCreate(0, &context);
+    }
+
+    static CFAllocatorRef allocator()
+    {
+        static CFAllocatorRef allocator = create();
+        return allocator;
+    }
+
+}
+
 CFStringRef StringImpl::createCFString()
 {
-    return CFStringCreateWithCharacters(NULL, reinterpret_cast<const UniChar*>(m_data), m_length);
+    CFAllocatorRef allocator = (m_length && isMainThread()) ? StringWrapperCFAllocator::allocator() : 0;
+    if (!allocator)
+        return CFStringCreateWithCharacters(0, reinterpret_cast<const UniChar*>(m_data), m_length);
+
+    // Put pointer to the StringImpl in a global so the allocator can store it with the CFString.
+    ASSERT(!StringWrapperCFAllocator::currentString);
+    StringWrapperCFAllocator::currentString = this;
+
+    CFStringRef string = CFStringCreateWithCharactersNoCopy(allocator, reinterpret_cast<const UniChar*>(m_data), m_length, kCFAllocatorNull);
+
+    // The allocator cleared the global when it read it, but also clear it here just in case.
+    ASSERT(!StringWrapperCFAllocator::currentString);
+    StringWrapperCFAllocator::currentString = 0;
+
+    return string;
 }
 
+// On StringImpl creation we could check if the allocator is the StringWrapperCFAllocator.
+// If it is, then we could find the original StringImpl and just return that. But to
+// do that we'd have to compute the offset from CFStringRef to the allocated block;
+// the CFStringRef is *not* at the start of an allocated block. Testing shows 1000x
+// more calls to createCFString than calls to the create functions with the appropriate
+// allocator, so it's probably not urgent optimize that case.
+
 }
 
 #endif // PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
diff --git a/src/3rdparty/webkit/WebCore/platform/text/mac/ShapeArabic.c b/src/3rdparty/webkit/WebCore/platform/text/mac/ShapeArabic.c
index 6dbc0087fa..dd61ce5968 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/mac/ShapeArabic.c
+++ b/src/3rdparty/webkit/WebCore/platform/text/mac/ShapeArabic.c
@@ -36,6 +36,8 @@
 
 #include "ShapeArabic.h"
 
+#include <stdbool.h>
+#include <string.h>
 #include <unicode/utypes.h>
 #include <unicode/uchar.h>
 #include <unicode/ustring.h>
@@ -347,8 +349,7 @@ isTashkeelChar(UChar ch) {
  */
 static int32_t
 shapeUnicode(UChar *dest, int32_t sourceLength,
-             int32_t destSize,uint32_t options,
-             UErrorCode *pErrorCode,
+             int32_t destSize,
              int tashkeelFlag) {
 
     int32_t          i, iend;
@@ -528,11 +529,11 @@ int32_t shapeArabic(const UChar *source, int32_t sourceLength, UChar *dest, int3
         switch(options&U_SHAPE_LETTERS_MASK) {
         case U_SHAPE_LETTERS_SHAPE :
             /* Call the shaping function with tashkeel flag == 1 */
-            destLength = shapeUnicode(dest,sourceLength,destCapacity,options,pErrorCode,1);
+            destLength = shapeUnicode(dest,sourceLength,destCapacity,1);
             break;
         case U_SHAPE_LETTERS_SHAPE_TASHKEEL_ISOLATED :
             /* Call the shaping function with tashkeel flag == 0 */
-            destLength = shapeUnicode(dest,sourceLength,destCapacity,options,pErrorCode,0);
+            destLength = shapeUnicode(dest,sourceLength,destCapacity,0);
             break;
         case U_SHAPE_LETTERS_UNSHAPE :
             ASSERT_NOT_REACHED();
diff --git a/src/3rdparty/webkit/WebCore/platform/text/mac/StringImplMac.mm b/src/3rdparty/webkit/WebCore/platform/text/mac/StringImplMac.mm
index 3e0731c65a..d14c6d8f14 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/mac/StringImplMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/text/mac/StringImplMac.mm
@@ -1,5 +1,5 @@
-/**
- * Copyright (C) 2006 Apple Computer, Inc.
+/*
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,13 +21,13 @@
 #include "config.h"
 #include "StringImpl.h"
 
-#include <Foundation/Foundation.h>
+#include "FoundationExtras.h"
 
 namespace WebCore {
 
 StringImpl::operator NSString *()
 {
-    return [NSString stringWithCharacters:m_data length:m_length];
+    return HardAutorelease(createCFString());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/mac/StringMac.mm b/src/3rdparty/webkit/WebCore/platform/text/mac/StringMac.mm
index 77942eae48..758ae1dbb2 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/mac/StringMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/text/mac/StringMac.mm
@@ -20,6 +20,7 @@
 
 #include "config.h"
 #include "PlatformString.h"
+#include <CoreFoundation/CFString.h>
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/mac/TextBoundaries.mm b/src/3rdparty/webkit/WebCore/platform/text/mac/TextBoundaries.mm
index ff1dfd20dc..bd7ddf8a0f 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/mac/TextBoundaries.mm
+++ b/src/3rdparty/webkit/WebCore/platform/text/mac/TextBoundaries.mm
@@ -26,6 +26,8 @@
 #import "config.h"
 #import "TextBoundaries.h"
 
+using namespace WTF::Unicode;
+
 namespace WebCore {
 
 void findWordBoundary(const UChar* chars, int len, int position, int* start, int* end)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp b/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
index 3baf21f2f2..93b9da2751 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -33,9 +33,9 @@
 #include "PlatformString.h"
 #include "ThreadGlobalData.h"
 #include <wtf/Assertions.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
-using std::auto_ptr;
 using std::min;
 
 namespace WebCore {
@@ -64,9 +64,9 @@ void TextCodecMac::registerEncodingNames(EncodingNameRegistrar registrar)
     }
 }
 
-static auto_ptr<TextCodec> newTextCodecMac(const TextEncoding&, const void* additionalData)
+static PassOwnPtr<TextCodec> newTextCodecMac(const TextEncoding&, const void* additionalData)
 {
-    return auto_ptr<TextCodec>(new TextCodecMac(*static_cast<const TECTextEncodingID*>(additionalData)));
+    return new TextCodecMac(*static_cast<const TECTextEncodingID*>(additionalData));
 }
 
 void TextCodecMac::registerCodecs(TextCodecRegistrar registrar)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index 88b9680865..06e8f37416 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -20,6 +20,7 @@
  *
  */
 
+#include "config.h"
 #include "TextBreakIterator.h"
 
 #if QT_VERSION >= 0x040400
@@ -63,6 +64,11 @@ namespace WebCore {
         return static_cast<TextBreakIterator*>(iterator);
     }
 
+    TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+    {
+        return characterBreakIterator(string, length);
+    }
+
     TextBreakIterator* lineBreakIterator(const UChar* string, int length)
     {
         static QTextBoundaryFinder *iterator = 0;
@@ -250,6 +256,11 @@ TextBreakIterator* characterBreakIterator(const UChar* string, int length)
     return iterator;
 }
 
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+    return characterBreakIterator(string, length);
+}
+
 TextBreakIterator* lineBreakIterator(const UChar*, int)
 {
     // not yet implemented
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
index 0f385dd4b8..c6c02cfd3d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -63,9 +63,9 @@ void TextCodecQt::registerEncodingNames(EncodingNameRegistrar registrar)
     }
 }
 
-static std::auto_ptr<TextCodec> newTextCodecQt(const TextEncoding& encoding, const void*)
+static PassOwnPtr<TextCodec> newTextCodecQt(const TextEncoding& encoding, const void*)
 {
-    return std::auto_ptr<TextCodec>(new TextCodecQt(encoding));
+    return new TextCodecQt(encoding);
 }
 
 void TextCodecQt::registerCodecs(TextCodecRegistrar registrar)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp b/src/3rdparty/webkit/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp
index 14cf13038e..ce436df235 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp
@@ -25,7 +25,11 @@ namespace WebCore {
 
 const char* currentTextBreakLocaleID()
 {
-    return "en_us";
+    // Using en_US_POSIX now so word selection in address field works as expected as before (double-clicking
+    // in a URL selects a word delimited by periods rather than selecting the entire URL).
+    // However, this is not entirely correct - we should honor the system locale in the normal case.
+    // FIXME: <rdar://problem/6786703> Should use system locale for text breaking
+    return "en_US_POSIX";
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp b/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp
index 7f51217252..88ea145427 100644
--- a/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/win/SystemTimeWin.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "SystemTime.h"
 
-#include <DateMath.h>
 #include <windows.h>
 
 #if COMPILER(MINGW) || (PLATFORM(QT) && COMPILER(MSVC))
@@ -36,14 +35,6 @@
 
 namespace WebCore {
 
-double currentTime()
-{
-    // Call through to our high-resolution JSC time code, since calls like GetSystemTimeAsFileTime and ftime are only accurate within 15ms.
-    // This resolution can be improved with timeBeginPeriod/timeEndPeriod on Vista, but these calls don't
-    // improve the resolution of date/time getters (GetSystemTimeAsFileTime, ftime, etc.) on XP.
-    return JSC::getCurrentUTCTimeWithMicroseconds() * 0.001;
-}
-
 float userIdleTime()
 {
 #if !PLATFORM(WIN_CE)
diff --git a/src/3rdparty/webkit/WebCore/page/win/AccessibilityObjectWin.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
index 0a386c7a61..28e39673e0 100644
--- a/src/3rdparty/webkit/WebCore/page/win/AccessibilityObjectWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008 Kevin Ollivier <kevino@theolliviers.com> All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,21 +20,25 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+
 #include "config.h"
-#include "AccessibilityObject.h"
+#include "PluginData.h"
 
-#if HAVE(ACCESSIBILITY)
+#include "NotImplemented.h"
 
 namespace WebCore {
 
-bool AccessibilityObject::accessibilityIgnoreAttachment() const
+void PluginData::initPlugins()
 {
-    return false;
+    notImplemented();
 }
 
-} // namespace WebCore
+void PluginData::refresh()
+{
+    notImplemented();
+}
 
-#endif // HAVE(ACCESSIBILITY)
+};
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
index 1c684b93df..8adba98363 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd.  All rights reserved.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -91,7 +92,8 @@ int PluginPackage::compare(const PluginPackage& compareTo) const
     if (diff)
         return diff;
 
-    if (diff = compareFileVersion(compareTo.version()))
+    diff = compareFileVersion(compareTo.version());
+    if (diff)
         return diff;
 
     return strcmp(parentDirectory().utf8().data(), compareTo.parentDirectory().utf8().data());
@@ -237,4 +239,86 @@ void PluginPackage::determineModuleVersionFromDescription()
 }
 #endif
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
+void PluginPackage::initializeBrowserFuncs()
+{
+    memset(&m_browserFuncs, 0, sizeof(m_browserFuncs));
+    m_browserFuncs.size = sizeof (m_browserFuncs);
+    m_browserFuncs.version = NP_VERSION_MINOR;
+
+    m_browserFuncs.geturl = NPN_GetURL;
+    m_browserFuncs.posturl = NPN_PostURL;
+    m_browserFuncs.requestread = NPN_RequestRead;
+    m_browserFuncs.newstream = NPN_NewStream;
+    m_browserFuncs.write = NPN_Write;
+    m_browserFuncs.destroystream = NPN_DestroyStream;
+    m_browserFuncs.status = NPN_Status;
+    m_browserFuncs.uagent = NPN_UserAgent;
+    m_browserFuncs.memalloc = NPN_MemAlloc;
+    m_browserFuncs.memfree = NPN_MemFree;
+    m_browserFuncs.memflush = NPN_MemFlush;
+    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
+    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
+    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
+    m_browserFuncs.getvalue = NPN_GetValue;
+    m_browserFuncs.setvalue = NPN_SetValue;
+    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
+    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
+    m_browserFuncs.forceredraw = NPN_ForceRedraw;
+    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
+    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
+    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
+    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
+    m_browserFuncs.pluginthreadasynccall = NPN_PluginThreadAsyncCall;
+
+    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
+    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
+    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
+    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
+    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
+    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
+    m_browserFuncs.intfromidentifier = _NPN_IntFromIdentifier;
+    m_browserFuncs.createobject = _NPN_CreateObject;
+    m_browserFuncs.retainobject = _NPN_RetainObject;
+    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
+    m_browserFuncs.invoke = _NPN_Invoke;
+    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
+    m_browserFuncs.evaluate = _NPN_Evaluate;
+    m_browserFuncs.getproperty = _NPN_GetProperty;
+    m_browserFuncs.setproperty = _NPN_SetProperty;
+    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
+    m_browserFuncs.hasproperty = _NPN_HasProperty;
+    m_browserFuncs.hasmethod = _NPN_HasMethod;
+    m_browserFuncs.setexception = _NPN_SetException;
+    m_browserFuncs.enumerate = _NPN_Enumerate;
+    m_browserFuncs.construct = _NPN_Construct;
+}
+#endif
+
+#if ENABLE(PLUGIN_PACKAGE_SIMPLE_HASH)
+unsigned PluginPackage::hash() const
+{
+    unsigned hashCodes[] = {
+        m_path.impl()->hash(),
+        m_lastModified
+    };
+
+    return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
+}
+
+bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
+{
+    return a.m_description == b.m_description;
+}
+
+int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
+{
+    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
+    // the passed version
+    if (m_moduleVersion != compareVersion)
+        return m_moduleVersion > compareVersion ? 1 : -1;
+    return 0;
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
index 707eb25dbf..02d0dfce54 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
@@ -75,6 +75,7 @@ namespace WebCore {
         void determineQuirks(const String& mimeType);
 
         void determineModuleVersionFromDescription();
+        void initializeBrowserFuncs();
 
         bool m_isLoaded;
         int m_loadCount;
diff --git a/src/3rdparty/webkit/WebCore/page/win/AXObjectCacheWin.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
index da30ac592c..487450a35a 100644
--- a/src/3rdparty/webkit/WebCore/page/win/AXObjectCacheWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008 Kevin Ollivier <kevino@theolliviers.com> All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,42 +20,58 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
-#include "AXObjectCache.h"
+#include "PluginPackage.h"
 
-#include "AccessibilityObject.h"
+#include "CString.h"
+#include "MIMETypeRegistry.h"
+#include "NotImplemented.h"
+#include "npruntime_impl.h"
+#include "PluginDatabase.h"
+#include "PluginDebug.h"
 
 namespace WebCore {
 
-void AXObjectCache::detachWrapper(AccessibilityObject* obj)
+void PluginPackage::determineQuirks(const String&)
 {
-    // On Windows, AccessibilityObjects are created when get_accChildCount is
-    // called, but they are not wrapped until get_accChild is called, so this
-    // object may not have a wrapper.
-    if (AccessibilityObjectWrapper* wrapper = obj->wrapper())
-        wrapper->detach();
+    notImplemented();
 }
 
-void AXObjectCache::attachWrapper(AccessibilityObject*)
+bool PluginPackage::fetchInfo()
 {
-    // On Windows, AccessibilityObjects are wrapped when the accessibility
-    // software requests them via get_accChild.
+    notImplemented();
+    return false;
 }
 
-void AXObjectCache::postNotification(RenderObject*, const String&)
+bool PluginPackage::load()
 {
+    notImplemented();
+    return false;
+}
+
+#if !ENABLE(PLUGIN_PACKAGE_SIMPLE_HASH)
+unsigned PluginPackage::hash() const
+{ 
+    notImplemented();
+
+    return 0;
 }
 
-void AXObjectCache::postNotificationToElement(RenderObject*, const String&)
+bool PluginPackage::equal(const PluginPackage&, const PluginPackage&)
 {
+    notImplemented();
+    return false;
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+int PluginPackage::compareFileVersion(const PlatformModuleVersion&) const
 {
+    notImplemented();
+    return 0;
 }
 
-} // namespace WebCore
+#endif
+
+}
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
index 2cf2accdd2..d2d5d3c0a7 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
@@ -130,20 +130,20 @@ void PluginStream::startStream()
 
     // Some plugins (Flash) expect that javascript URLs are passed back decoded as this is the
     // format used when requesting the URL.
-    if (responseURL.protocolIs("javascript"))
+    if (protocolIsJavaScript(responseURL))
         m_stream.url = strdup(decodeURLEscapeSequences(responseURL.string()).utf8().data());
     else
         m_stream.url = strdup(responseURL.string().utf8().data());
-    
+
     CString mimeTypeStr = m_resourceResponse.mimeType().utf8();
-    
+
     long long expectedContentLength = m_resourceResponse.expectedContentLength();
 
     if (m_resourceResponse.isHTTP()) {
         Vector<UChar> stringBuilder;
         String separator(": ");
 
-        String statusLine = String::format("HTTP %lu OK\n", m_resourceResponse.httpStatusCode());
+        String statusLine = String::format("HTTP %d OK\n", m_resourceResponse.httpStatusCode());
 
         stringBuilder.append(statusLine.characters(), statusLine.length());
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
index 61d31577ff..2c5adc5e0b 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
@@ -57,6 +57,7 @@
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
 #include "PluginPackage.h"
+#include "RenderBox.h"
 #include "RenderObject.h"
 #include "c_instance.h"
 #include "npruntime_impl.h"
@@ -71,7 +72,6 @@ using JSC::ExecState;
 using JSC::JSLock;
 using JSC::JSObject;
 using JSC::JSValue;
-using JSC::JSValuePtr;
 using JSC::UString;
 
 using std::min;
@@ -86,7 +86,7 @@ static int s_callingPlugin;
 
 static String scriptStringIfJavaScriptURL(const KURL& url)
 {
-    if (!url.protocolIs("javascript"))
+    if (!protocolIsJavaScript(url))
         return String();
 
     // This returns an unescaped string
@@ -205,14 +205,14 @@ static char* createUTF8String(const String& str)
     return result;
 }
 
-static bool getString(ScriptController* proxy, JSValuePtr result, String& string)
+static bool getString(ScriptController* proxy, JSValue result, String& string)
 {
-    if (!proxy || !result || result->isUndefined())
+    if (!proxy || !result || result.isUndefined())
         return false;
     JSLock lock(false);
 
     ExecState* exec = proxy->globalObject()->globalExec();
-    UString ustring = result->toString(exec);
+    UString ustring = result.toString(exec);
     exec->clearException();
 
     string = ustring;
@@ -239,7 +239,7 @@ void PluginView::performRequest(PluginRequest* request)
             m_streams.add(stream);
             stream->start();
         } else {
-            m_parentFrame->loader()->load(request->frameLoadRequest().resourceRequest(), targetFrameName);
+            m_parentFrame->loader()->load(request->frameLoadRequest().resourceRequest(), targetFrameName, false);
       
             // FIXME: <rdar://problem/4807469> This should be sent when the document has finished loading
             if (request->sendNotification()) {
@@ -260,7 +260,7 @@ void PluginView::performRequest(PluginRequest* request)
     
     // Executing a script can cause the plugin view to be destroyed, so we keep a reference to the parent frame.
     RefPtr<Frame> parentFrame = m_parentFrame;
-    JSValuePtr result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
+    JSValue result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
 
     if (targetFrameName.isNull()) {
         String resultString;
@@ -397,12 +397,12 @@ int32 PluginView::write(NPStream* stream, int32 len, void* buffer)
 
 NPError PluginView::destroyStream(NPStream* stream, NPReason reason)
 {
-    PluginStream* browserStream = static_cast<PluginStream*>(stream->ndata);
-
     if (!stream || PluginStream::ownerForStream(stream) != m_instance)
         return NPERR_INVALID_INSTANCE_ERROR;
 
+    PluginStream* browserStream = static_cast<PluginStream*>(stream->ndata);
     browserStream->cancelAndDestroyStream(reason);
+
     return NPERR_NO_ERROR;
 }
 
@@ -563,6 +563,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_pluginWndProc(0)
     , m_lastMessage(0)
     , m_isCallingPluginWndProc(false)
+    , m_wmPrintHDC(0)
 #endif
 #if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
     , m_window(0)
@@ -593,6 +594,14 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     resize(size);
 }
 
+void PluginView::focusPluginElement()
+{
+    // Focus the plugin
+    if (Page* page = m_parentFrame->page())
+        page->focusController()->setFocusedFrame(m_parentFrame);
+    m_parentFrame->document()->setFocusedNode(m_element);
+}
+
 void PluginView::didReceiveResponse(const ResourceResponse& response)
 {
     if (m_status != PluginStatusLoadedSuccessfully)
@@ -904,9 +913,9 @@ void PluginView::invalidateWindowlessPluginRect(const IntRect& rect)
     if (!isVisible())
         return;
     
-    RenderObject* renderer = m_element->renderer();
-    if (!renderer)
+    if (!m_element->renderer())
         return;
+    RenderBox* renderer = toRenderBox(m_element->renderer());
     
     IntRect dirtyRect = rect;
     dirtyRect.move(renderer->borderLeft() + renderer->paddingLeft(), renderer->borderTop() + renderer->paddingTop());
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.h b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
index 44f2146c33..41d986be70 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
@@ -173,6 +173,10 @@ namespace WebCore {
 
         virtual bool isPluginView() const { return true; }
 
+        Frame* parentFrame() const { return m_parentFrame; }
+
+        void focusPluginElement();
+
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
         static LRESULT CALLBACK PluginViewWndProc(HWND, UINT, WPARAM, LPARAM);
         LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
@@ -202,7 +206,13 @@ namespace WebCore {
         void setCallingPlugin(bool) const;
 
         void invalidateWindowlessPluginRect(const IntRect&);
-        
+
+#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+        void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&) const;
+        static HDC WINAPI hookedBeginPaint(HWND, PAINTSTRUCT*);
+        static BOOL WINAPI hookedEndPaint(HWND, const PAINTSTRUCT*);
+#endif
+
         Frame* m_parentFrame;
         RefPtr<PluginPackage> m_plugin;
         Element* m_element;
@@ -238,7 +248,7 @@ namespace WebCore {
 
         CString m_mimeType;
         CString m_userAgent;
-        
+
         NPP m_instance;
         NPP_t m_instanceStruct;
         NPWindow m_npWindow;
@@ -261,6 +271,7 @@ namespace WebCore {
         WNDPROC m_pluginWndProc;
         unsigned m_lastMessage;
         bool m_isCallingPluginWndProc;
+        HDC m_wmPrintHDC;
 #endif
 
 #if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
@@ -277,7 +288,9 @@ public:
 
 private:
 
-#if defined(XP_MACOSX)
+#if PLATFORM(GTK) || defined(Q_WS_X11)
+        void setNPWindowIfNeeded();
+#elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
         OwnPtr<Timer<PluginView> > m_nullEventTimer;
 
@@ -286,6 +299,10 @@ private:
         Point globalMousePosForPlugin() const;
 #endif
 
+#if defined(Q_WS_X11)
+        bool m_hasPendingGeometryChange;
+#endif
+
         IntRect m_clipRect; // The clip rect to apply to a windowed plug-in
         IntRect m_windowRect; // Our window rect.
 
@@ -299,4 +316,4 @@ private:
 
 } // namespace WebCore
 
-#endif 
+#endif
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
new file mode 100644
index 0000000000..a3b6a178b0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2008 Kevin Ollivier <kevino@theolliviers.com> All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PluginView.h"
+
+#include "NotImplemented.h"
+#include "PluginPackage.h"
+
+using namespace WTF;
+
+namespace WebCore {
+
+void PluginView::setFocus()
+{
+    notImplemented();
+}
+
+void PluginView::show()
+{
+    notImplemented();
+}
+
+void PluginView::hide()
+{
+    notImplemented();
+}
+
+void PluginView::paint(GraphicsContext*, const IntRect&)
+{
+    notImplemented();
+}
+
+void PluginView::handleKeyboardEvent(KeyboardEvent*)
+{
+    notImplemented();
+}
+
+void PluginView::handleMouseEvent(MouseEvent*)
+{
+    notImplemented();
+}
+
+void PluginView::setParent(ScrollView*)
+{
+    notImplemented();
+}
+
+void PluginView::setNPWindowRect(const IntRect&)
+{
+    notImplemented();
+}
+
+void PluginView::stop()
+{
+    notImplemented();
+}
+
+const char* PluginView::userAgent()
+{
+    notImplemented();
+    return 0;
+}
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+const char* PluginView::userAgentStatic()
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
+NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*)
+{
+    notImplemented();
+
+    return 0;
+}
+
+NPError PluginView::getValue(NPNVariable, void*)
+{
+    notImplemented();
+    return 0;
+}
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
+void PluginView::invalidateRect(NPRect*)
+{
+    notImplemented();
+}
+
+void PluginView::invalidateRect(const IntRect&)
+{
+    notImplemented();
+}
+
+void PluginView::invalidateRegion(NPRegion)
+{
+    notImplemented();
+}
+
+void PluginView::forceRedraw()
+{
+    notImplemented();
+}
+
+PluginView::~PluginView()
+{
+    notImplemented();
+}
+
+void PluginView::init()
+{
+    notImplemented();
+}
+
+void PluginView::setParentVisible(bool)
+{
+    notImplemented();
+}
+
+void PluginView::updatePluginWidget()
+{
+    notImplemented();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
index 0af94b03df..18be90e7d0 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -33,7 +33,6 @@
 #include <wtf/RetainPtr.h>
 #include "CString.h"
 #include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
 #include "npruntime_impl.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
@@ -285,51 +284,7 @@ bool PluginPackage::load()
     memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
     m_pluginFuncs.size = sizeof(m_pluginFuncs);
 
-    m_browserFuncs.size = sizeof(m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
-    m_browserFuncs.geturl = NPN_GetURL;
-    m_browserFuncs.posturl = NPN_PostURL;
-    m_browserFuncs.requestread = NPN_RequestRead;
-    m_browserFuncs.newstream = NPN_NewStream;
-    m_browserFuncs.write = NPN_Write;
-    m_browserFuncs.destroystream = NPN_DestroyStream;
-    m_browserFuncs.status = NPN_Status;
-    m_browserFuncs.uagent = NPN_UserAgent;
-    m_browserFuncs.memalloc = NPN_MemAlloc;
-    m_browserFuncs.memfree = NPN_MemFree;
-    m_browserFuncs.memflush = NPN_MemFlush;
-    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
-    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
-    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
-    m_browserFuncs.getvalue = NPN_GetValue;
-    m_browserFuncs.setvalue = NPN_SetValue;
-    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
-    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
-    m_browserFuncs.forceredraw = NPN_ForceRedraw;
-    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
-    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
-    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
-    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
-
-    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
-    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
-    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
-    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
-    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
-    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
-    m_browserFuncs.createobject = _NPN_CreateObject;
-    m_browserFuncs.retainobject = _NPN_RetainObject;
-    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
-    m_browserFuncs.invoke = _NPN_Invoke;
-    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
-    m_browserFuncs.evaluate = _NPN_Evaluate;
-    m_browserFuncs.getproperty = _NPN_GetProperty;
-    m_browserFuncs.setproperty = _NPN_SetProperty;
-    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
-    m_browserFuncs.hasproperty = _NPN_HasMethod;
-    m_browserFuncs.hasmethod = _NPN_HasProperty;
-    m_browserFuncs.setexception = _NPN_SetException;
-    m_browserFuncs.enumerate = _NPN_Enumerate;
+    initializeBrowserFuncs();
 
     npErr = NP_Initialize(&m_browserFuncs);
     LOG_NPERROR(npErr);
@@ -349,30 +304,10 @@ abort:
     return false;
 }
 
-unsigned PluginPackage::hash() const
-{
-    unsigned hashCodes[2] = {
-        m_path.impl()->hash(),
-        m_lastModified
-    };
-
-    return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), 2 * sizeof(unsigned) / sizeof(UChar));
-}
-
-bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
-{
-    return a.m_description == b.m_description;
-}
+} // namespace WebCore
 
-int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
-{
-    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
-    // the passed version
-    if (m_moduleVersion != compareVersion)
-        return m_moduleVersion > compareVersion ? 1 : -1;
-    return 0;
-}
+#else
 
-} // namespace WebCore
+#include "../PluginPackageNone.cpp"
 
 #endif // !__LP64__
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
index 3229922550..5691c9c0b0 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
@@ -76,7 +76,11 @@ using JSC::UString;
 #include <QWidget>
 #include <QKeyEvent>
 QT_BEGIN_NAMESPACE
-extern Q_GUI_EXPORT OSWindowRef qt_mac_window_for(const QWidget *w);
+#if QT_VERSION < 0x040500
+extern Q_GUI_EXPORT WindowPtr qt_mac_window_for(const QWidget* w);
+#else
+extern Q_GUI_EXPORT OSWindowRef qt_mac_window_for(const QWidget* w);
+#endif
 QT_END_NAMESPACE
 #endif
 
@@ -692,4 +696,8 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
 
 } // namespace WebCore
 
+#else
+
+#include "../PluginViewNone.cpp"
+
 #endif // !__LP64__
diff --git a/src/3rdparty/webkit/WebCore/plugins/npfunctions.h b/src/3rdparty/webkit/WebCore/plugins/npfunctions.h
index 509430f72f..e28bf5eec9 100644
--- a/src/3rdparty/webkit/WebCore/plugins/npfunctions.h
+++ b/src/3rdparty/webkit/WebCore/plugins/npfunctions.h
@@ -63,9 +63,14 @@ typedef void* (*NPN_GetJavaPeerProcPtr)(NPP instance);
 typedef void  (*NPN_PushPopupsEnabledStateProcPtr)(NPP instance, NPBool enabled);
 typedef void  (*NPN_PopPopupsEnabledStateProcPtr)(NPP instance);
 typedef void (*NPN_PluginThreadAsyncCallProcPtr)(NPP npp, void (*func)(void *), void *userData);
+typedef NPError (*NPN_GetValueForURLProcPtr)(NPP npp, NPNURLVariable variable, const char* url, char** value, uint32* len);
+typedef NPError (*NPN_SetValueForURLProcPtr)(NPP npp, NPNURLVariable variable, const char* url, const char* value, uint32 len);
+typedef NPError (*NPN_GetAuthenticationInfoProcPtr)(NPP npp, const char* protocol, const char* host, int32 port, const char* scheme, const char *realm, char** username, uint32* ulen, char** password, uint32* plen);
+
 typedef uint32 (*NPN_ScheduleTimerProcPtr)(NPP npp, uint32 interval, NPBool repeat, void (*timerFunc)(NPP npp, uint32 timerID));
 typedef void (*NPN_UnscheduleTimerProcPtr)(NPP npp, uint32 timerID);
 typedef NPError (*NPN_PopUpContextMenuProcPtr)(NPP instance, NPMenu* menu);
+typedef NPBool (*NPN_ConvertPointProcPtr)(NPP npp, double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
 
 typedef void (*NPN_ReleaseVariantValueProcPtr) (NPVariant *variant);
 
@@ -158,9 +163,13 @@ typedef struct _NPNetscapeFuncs {
     NPN_EnumerateProcPtr enumerate;
     NPN_PluginThreadAsyncCallProcPtr pluginthreadasynccall;
     NPN_ConstructProcPtr construct;
+    NPN_GetValueForURLProcPtr getvalueforurl;
+    NPN_SetValueForURLProcPtr setvalueforurl;
+    NPN_GetAuthenticationInfoProcPtr getauthenticationinfo;
     NPN_ScheduleTimerProcPtr scheduletimer;
     NPN_UnscheduleTimerProcPtr unscheduletimer;
     NPN_PopUpContextMenuProcPtr popupcontextmenu;
+    NPN_ConvertPointProcPtr convertpoint;
 } NPNetscapeFuncs;
 
 typedef struct _NPPluginFuncs {
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
new file mode 100644
index 0000000000..59ab5bc064
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
@@ -0,0 +1,149 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "PluginContainerQt.h"
+
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformWheelEvent.h"
+#include "PluginView.h"
+#include <QApplication>
+#include <QX11Info>
+
+using namespace WebCore;
+
+PluginClientWrapper::PluginClientWrapper(QWidget* parent, WId client)
+    : QWidget(0, Qt::Popup)
+{
+    // create a QWidget that adopts the plugin window id, do not give it
+    // a parent so that we don't end up handling events supposed to be
+    // handled by the QX11EmbedContainer.
+
+    // without the parent this will be considered a toplevel widget,
+    // and thus make Qt not quit the event loop after the last window
+    // has been closed. In order to work around this, we set the window
+    // type to Qt::Popup.
+
+    create(client, false, true);
+    m_parent = parent;
+}
+
+PluginClientWrapper::~PluginClientWrapper()
+{
+    destroy(false, false);
+}
+
+bool PluginClientWrapper::x11Event(XEvent* event)
+{
+    // modify the event window id and insert it into the Qt event system.
+    event->xany.window = m_parent->parentWidget()->winId();
+    static_cast<QApplication*>(QApplication::instance())->x11ProcessEvent(event);
+    return true;
+}
+
+PluginContainerQt::PluginContainerQt(PluginView* view, QWidget* parent)
+    : QX11EmbedContainer(parent)
+    , m_pluginView(view)
+    , m_clientWrapper(0)
+{
+    connect(this, SIGNAL(clientClosed()), this, SLOT(on_clientClosed()));
+    connect(this, SIGNAL(clientIsEmbedded()), this, SLOT(on_clientIsEmbedded()));
+}
+
+PluginContainerQt::~PluginContainerQt()
+{
+    delete m_clientWrapper;
+}
+
+void PluginContainerQt::on_clientClosed()
+{
+    delete m_clientWrapper;
+    m_clientWrapper = 0;
+}
+
+void PluginContainerQt::on_clientIsEmbedded()
+{
+    delete m_clientWrapper;
+    m_clientWrapper = 0;
+
+    // Only create a QWidget wrapper for the plugin in the case it isn't in the
+    // Qt window mapper, and thus receiving events from the Qt event system.
+    // This way the PluginClientWrapper receives the scroll events and passes
+    // them to the parent. NOTICE: Native Qt based plugins running in process,
+    // will already be in the window mapper, and thus creating a wrapper, stops
+    // them from getting events from Qt, as they are redirected to the wrapper.
+    if (!QWidget::find(clientWinId()))
+        m_clientWrapper = new PluginClientWrapper(this, clientWinId());
+}
+
+void PluginContainerQt::redirectWheelEventsToParent(bool enable)
+{
+    // steal wheel events from the plugin as we want to handle it. When doing this
+    // all button 4, 5, 6, and 7, ButtonPress and ButtonRelease events are passed
+    // to the x11Event handler of the PluginClientWrapper, which then changes the
+    // window id of the event to the parent of PluginContainer and puts the event
+    // back into the Qt event loop, so that we will actually scroll the parent
+    // frame.
+    for (int buttonNo = 4; buttonNo < 8; buttonNo++) {
+        if (enable)
+            XGrabButton(x11Info().display(), buttonNo, AnyModifier, clientWinId(),
+                false, ButtonPressMask, GrabModeAsync, GrabModeAsync, 0L, 0L);
+        else
+            XUngrabButton(x11Info().display(), buttonNo, AnyModifier, clientWinId());
+    }
+}
+
+bool PluginContainerQt::x11Event(XEvent* event)
+{
+    switch (event->type) {
+    case EnterNotify:
+        // if the plugin window doesn't have focus we do not want to send wheel
+        // events to it, but to the parent frame, so let's redirect here.
+        redirectWheelEventsToParent(!hasFocus());
+        break;
+    case LeaveNotify:
+        // it is always safe to ungrab wheel events when the mouse leaves the
+        // plugin window.
+        redirectWheelEventsToParent(false);
+        break;
+    }
+
+    return QX11EmbedContainer::x11Event(event);
+}
+
+void PluginContainerQt::focusInEvent(QFocusEvent* event)
+{
+    // we got focus, stop redirecting the wheel events
+    redirectWheelEventsToParent(false);
+
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(true);
+
+    m_pluginView->focusPluginElement();
+}
+
+void PluginContainerQt::focusOutEvent(QFocusEvent*)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(false);
+}
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.h b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.h
new file mode 100644
index 0000000000..624654c588
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.h
@@ -0,0 +1,63 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef PluginContainerQt_H
+#define PluginContainerQt_H
+
+#include <QX11EmbedContainer>
+
+namespace WebCore {
+
+    class PluginView;
+
+    class PluginContainerQt : public QX11EmbedContainer
+    {
+        Q_OBJECT
+    public:
+        PluginContainerQt(PluginView*, QWidget* parent);
+        ~PluginContainerQt();
+
+        void redirectWheelEventsToParent(bool enable = true);
+
+    protected:
+        virtual bool x11Event(XEvent*);
+        virtual void focusInEvent(QFocusEvent*);
+        virtual void focusOutEvent(QFocusEvent*);
+
+    public slots:
+        void on_clientClosed();
+        void on_clientIsEmbedded();
+
+    private:
+        PluginView* m_pluginView;
+        QWidget* m_clientWrapper;
+    };
+
+    class PluginClientWrapper : public QWidget
+    {
+    public:
+        PluginClientWrapper(QWidget* parent, WId client);
+        ~PluginClientWrapper();
+        bool x11Event(XEvent*);
+
+    private:
+        QWidget* m_parent;
+    };
+}
+
+#endif // PluginContainerQt_H
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
index 13f53941dd..d9e3765055 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -29,7 +29,6 @@
 
 #include "CString.h"
 #include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
 #include "npruntime_impl.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
@@ -110,52 +109,7 @@ bool PluginPackage::load()
     memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
     m_pluginFuncs.size = sizeof(m_pluginFuncs);
 
-    m_browserFuncs.size = sizeof (m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
-    m_browserFuncs.geturl = NPN_GetURL;
-    m_browserFuncs.posturl = NPN_PostURL;
-    m_browserFuncs.requestread = NPN_RequestRead;
-    m_browserFuncs.newstream = NPN_NewStream;
-    m_browserFuncs.write = NPN_Write;
-    m_browserFuncs.destroystream = NPN_DestroyStream;
-    m_browserFuncs.status = NPN_Status;
-    m_browserFuncs.uagent = NPN_UserAgent;
-    m_browserFuncs.memalloc = NPN_MemAlloc;
-    m_browserFuncs.memfree = NPN_MemFree;
-    m_browserFuncs.memflush = NPN_MemFlush;
-    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
-    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
-    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
-    m_browserFuncs.getvalue = NPN_GetValue;
-    m_browserFuncs.setvalue = NPN_SetValue;
-    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
-    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
-    m_browserFuncs.forceredraw = NPN_ForceRedraw;
-    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
-    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
-    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
-    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
-
-    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
-    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
-    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
-    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
-    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
-    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
-    m_browserFuncs.createobject = _NPN_CreateObject;
-    m_browserFuncs.retainobject = _NPN_RetainObject;
-    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
-    m_browserFuncs.invoke = _NPN_Invoke;
-    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
-    m_browserFuncs.evaluate = _NPN_Evaluate;
-    m_browserFuncs.getproperty = _NPN_GetProperty;
-    m_browserFuncs.setproperty = _NPN_SetProperty;
-    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
-    m_browserFuncs.hasproperty = _NPN_HasProperty;
-    m_browserFuncs.hasmethod = _NPN_HasMethod;
-    m_browserFuncs.setexception = _NPN_SetException;
-    m_browserFuncs.enumerate = _NPN_Enumerate;
-    m_browserFuncs.construct = _NPN_Construct;
+    initializeBrowserFuncs();
 
 #if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
@@ -173,28 +127,4 @@ abort:
     return false;
 }
 
-unsigned PluginPackage::hash() const
-{ 
-    unsigned hashCodes[2] = {
-        m_path.impl()->hash(),
-        m_lastModified
-    };
-
-    return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), 2 * sizeof(unsigned) / sizeof(UChar));
-}
-
-bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
-{
-    return a.m_description == b.m_description;
-}
-
-int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
-{
-    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
-    // the passed version
-    if (m_moduleVersion != compareVersion)
-        return m_moduleVersion > compareVersion ? 1 : -1;
-    return 0;
-}
-
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
index e856f92d46..25d61f9891 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
@@ -27,40 +27,38 @@
 #include "config.h"
 #include "PluginView.h"
 
-#include <QWidget>
-#include <QX11EmbedContainer>
-#include <QX11Info>
-
-#include "NotImplemented.h"
-#include "PluginDebug.h"
-#include "PluginPackage.h"
-#include "npruntime_impl.h"
-#include "runtime.h"
-#include "runtime_root.h"
-#include <runtime/JSLock.h>
-#include <runtime/JSValue.h>
-#include "JSDOMBinding.h"
-#include "ScriptController.h"
-
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
-#include "FrameLoader.h"
+#include "Frame.h"
 #include "FrameLoadRequest.h"
+#include "FrameLoader.h"
 #include "FrameTree.h"
-#include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
-#include "Image.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "Image.h"
+#include "JSDOMBinding.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
+#include "PluginContainerQt.h"
+#include "PluginDebug.h"
+#include "PluginPackage.h"
 #include "PluginMainThreadScheduler.h"
 #include "RenderLayer.h"
+#include "ScriptController.h"
 #include "Settings.h"
+#include "npruntime_impl.h"
+#include "runtime.h"
+#include "runtime_root.h"
+#include <QWidget>
+#include <QX11Info>
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -78,7 +76,7 @@ using namespace HTMLNames;
 
 void PluginView::updatePluginWidget()
 {
-    if (!parent() || !m_isWindowed)
+    if (!parent() || !m_isWindowed || !platformPluginWidget())
         return;
 
     ASSERT(parent()->isFrameView());
@@ -91,11 +89,19 @@ void PluginView::updatePluginWidget()
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
 
-    if (platformPluginWidget()) {
-        platformPluginWidget()->move(m_windowRect.x(), m_windowRect.y());
-        platformPluginWidget()->resize(m_windowRect.width(), m_windowRect.height());
-        platformPluginWidget()->setMask(QRegion(m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height()));
-    }
+    if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
+        return;
+
+    // do not call setNPWindowIfNeeded immediately, will be called on paint()
+    m_hasPendingGeometryChange = true;
+
+    // in order to move/resize the plugin window at the same time as the
+    // rest of frame during e.g. scrolling, we set the window geometry
+    // in the paint() function, but as paint() isn't called when the
+    // plugin window is outside the frame which can be caused by a
+    // scroll, we need to move/resize immediately.
+    if (!m_windowRect.intersects(frameView->frameRect()))
+        setNPWindowIfNeeded();
 }
 
 void PluginView::setFocus()
@@ -137,10 +143,11 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         return;
     }
 
-    if (m_isWindowed || context->paintingDisabled())
+    if (context->paintingDisabled())
         return;
 
-    notImplemented();
+    if (m_isWindowed && platformPluginWidget())
+        setNPWindowIfNeeded();
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
@@ -159,46 +166,54 @@ void PluginView::setParent(ScrollView* parent)
 
     if (parent)
         init();
-    else {
-        if (!platformPluginWidget())
-            return;
-    }
 }
 
-void PluginView::setNPWindowRect(const IntRect& rect)
+void PluginView::setNPWindowRect(const IntRect&)
 {
-    if (!m_isStarted || !parent())
-        return;
-
-    IntPoint p = static_cast<FrameView*>(parent())->contentsToWindow(rect.location());
-    m_npWindow.x = p.x();
-    m_npWindow.y = p.y();
+    // Ignored as we don't want to move immediately.
+}
 
-    m_npWindow.width = rect.width();
-    m_npWindow.height = rect.height();
+void PluginView::setNPWindowIfNeeded()
+{
+    if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
+        return;
 
-    m_npWindow.clipRect.left = 0;
-    m_npWindow.clipRect.top = 0;
-    m_npWindow.clipRect.right = rect.width();
-    m_npWindow.clipRect.bottom = rect.height();
+    // On Unix, only call plugin if it's full-page or windowed
+    if (m_mode != NP_FULL && m_mode != NP_EMBED)
+        return;
 
-    if (m_npWindow.x < 0 || m_npWindow.y < 0 ||
-        m_npWindow.width <= 0 || m_npWindow.height <= 0)
+    if (!m_hasPendingGeometryChange)
         return;
+    m_hasPendingGeometryChange = false;
+
+    ASSERT(platformPluginWidget());
+    platformPluginWidget()->setGeometry(m_windowRect);
+    // if setMask is set with an empty QRegion, no clipping will
+    // be performed, so in that case we hide the plugin view
+    platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+    platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+    // FLASH WORKAROUND: Only set initially. Multiple calls to
+    // setNPWindow() cause the plugin to crash.
+    if (m_npWindow.width == -1 || m_npWindow.height == -1) {
+        m_npWindow.width = m_windowRect.width();
+        m_npWindow.height = m_windowRect.height();
+    }
 
-    if (m_plugin->pluginFuncs()->setwindow) {
-        PluginView::setCurrentPluginView(this);
-        JSC::JSLock::DropAllLocks dropAllLocks(false);
-        setCallingPlugin(true);
-        m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
-        setCallingPlugin(false);
-        PluginView::setCurrentPluginView(0);
+    m_npWindow.x = m_windowRect.x();
+    m_npWindow.y = m_windowRect.y();
 
-        if (!m_isWindowed)
-            return;
+    m_npWindow.clipRect.left = m_clipRect.x();
+    m_npWindow.clipRect.top = m_clipRect.y();
+    m_npWindow.clipRect.right = m_clipRect.width();
+    m_npWindow.clipRect.bottom = m_clipRect.height();
 
-        ASSERT(platformPluginWidget());
-    }
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(false);
+    setCallingPlugin(true);
+    m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
 }
 
 void PluginView::setParentVisible(bool visible)
@@ -288,7 +303,7 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
 
     //FIXME - read the file data into buffer
     FILE* fileHandle = fopen((filename.utf8()).data(), "r");
-    
+
     if (fileHandle == 0)
         return NPERR_FILE_NOT_FOUND;
 
@@ -332,7 +347,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
             *(void **)value = platformPluginWidget()->x11Info().display();
         else
             *(void **)value = m_parentFrame->view()->hostWindow()->platformWindow()->x11Info().display();
-        return NPERR_NO_ERROR;                
+        return NPERR_NO_ERROR;
 
     case NPNVxtAppContext:
         return NPERR_GENERIC_ERROR;
@@ -350,7 +365,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
         void** v = (void**)value;
         *v = windowScriptObject;
-            
+
         return NPERR_NO_ERROR;
     }
 
@@ -397,10 +412,10 @@ void PluginView::invalidateRect(const IntRect& rect)
         platformWidget()->update(rect);
         return;
     }
-    
+
     invalidateWindowlessPluginRect(rect);
 }
-    
+
 void PluginView::invalidateRect(NPRect* rect)
 {
     notImplemented();
@@ -439,6 +454,8 @@ void PluginView::init()
         return;
     m_haveInitialized = true;
 
+    m_hasPendingGeometryChange = false;
+
     if (!m_plugin) {
         ASSERT(m_status == PluginStatusCanNotFindPlugin);
         return;
@@ -465,7 +482,7 @@ void PluginView::init()
     }
 
     if (m_needsXEmbed) {
-        setPlatformWidget(new QX11EmbedContainer(m_parentFrame->view()->hostWindow()->platformWindow()));
+        setPlatformWidget(new PluginContainerQt(this, m_parentFrame->view()->hostWindow()->platformWindow()));
     } else {
         notImplemented();
         m_status = PluginStatusCanNotLoadPlugin;
@@ -485,9 +502,13 @@ void PluginView::init()
 
     m_npWindow.type = NPWindowTypeWindow;
     m_npWindow.window = (void*)platformPluginWidget()->winId();
+    m_npWindow.width = -1;
+    m_npWindow.height = -1;
 
-    if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall)))
-        setNPWindowRect(frameRect());
+    if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))) {
+        updatePluginWidget();
+        setNPWindowIfNeeded();
+    }
 
     m_status = PluginStatusLoadedSuccessfully;
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
index fe9b544831..b52553ec9a 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
@@ -68,6 +68,11 @@ int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersio
 
 bool PluginPackage::isPluginBlacklisted()
 {
+    if (name() == "Citrix ICA Client") {
+        // The Citrix ICA Client plug-in requires a Mozilla-based browser; see <rdar://6418681>.
+        return true;
+    }
+
     if (name() == "Silverlight Plug-In") {
         // workaround for <rdar://5557379> Crash in Silverlight when opening microsoft.com.
         // the latest 1.0 version of Silverlight does not reproduce this crash, so allow it
@@ -114,7 +119,7 @@ void PluginPackage::determineQuirks(const String& mimeType)
         m_quirks.add(PluginQuirkHasModalMessageLoop);
     }
 
-    if (name() == "VLC Multimedia Plugin") {
+    if (name() == "VLC Multimedia Plugin" || name() == "VLC Multimedia Plug-in") {
         // VLC hangs on NPP_Destroy if we call NPP_SetWindow with a null window handle
         m_quirks.add(PluginQuirkDontSetNullWindowHandleOnDestroy);
 
@@ -276,56 +281,7 @@ bool PluginPackage::load()
     if (npErr != NPERR_NO_ERROR)
         goto abort;
 
-    memset(&m_browserFuncs, 0, sizeof(m_browserFuncs));
-    m_browserFuncs.size = sizeof (m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
-
-    m_browserFuncs.geturl = NPN_GetURL;
-    m_browserFuncs.posturl = NPN_PostURL;
-    m_browserFuncs.requestread = NPN_RequestRead;
-    m_browserFuncs.newstream = NPN_NewStream;
-    m_browserFuncs.write = NPN_Write;
-    m_browserFuncs.destroystream = NPN_DestroyStream;
-    m_browserFuncs.status = NPN_Status;
-    m_browserFuncs.uagent = NPN_UserAgent;
-    m_browserFuncs.memalloc = NPN_MemAlloc;
-    m_browserFuncs.memfree = NPN_MemFree;
-    m_browserFuncs.memflush = NPN_MemFlush;
-    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
-    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
-    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
-    m_browserFuncs.getvalue = NPN_GetValue;
-    m_browserFuncs.setvalue = NPN_SetValue;
-    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
-    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
-    m_browserFuncs.forceredraw = NPN_ForceRedraw;
-    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
-    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
-    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
-    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
-    m_browserFuncs.pluginthreadasynccall = NPN_PluginThreadAsyncCall;
-
-    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
-    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
-    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
-    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
-    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
-    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
-    m_browserFuncs.intfromidentifier = _NPN_IntFromIdentifier;
-    m_browserFuncs.createobject = _NPN_CreateObject;
-    m_browserFuncs.retainobject = _NPN_RetainObject;
-    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
-    m_browserFuncs.invoke = _NPN_Invoke;
-    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
-    m_browserFuncs.evaluate = _NPN_Evaluate;
-    m_browserFuncs.getproperty = _NPN_GetProperty;
-    m_browserFuncs.setproperty = _NPN_SetProperty;
-    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
-    m_browserFuncs.hasproperty = _NPN_HasProperty;
-    m_browserFuncs.hasmethod = _NPN_HasMethod;
-    m_browserFuncs.setexception = _NPN_SetException;
-    m_browserFuncs.enumerate = _NPN_Enumerate;
-    m_browserFuncs.construct = _NPN_Construct;
+    initializeBrowserFuncs();
 
     npErr = NP_Initialize(&m_browserFuncs);
     LOG_NPERROR(npErr);
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index 722262bb0f..67c34ebd5a 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -45,7 +45,6 @@
 #include "KeyboardEvent.h"
 #include "MIMETypeRegistry.h"
 #include "MouseEvent.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "FocusController.h"
 #include "PlatformMouseEvent.h"
@@ -99,6 +98,92 @@ const LPCWSTR kWebPluginViewProperty = L"WebPluginViewProperty";
 
 static const char* MozillaUserAgent = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0";
 
+// The code used to hook BeginPaint/EndPaint originally came from
+// <http://www.fengyuan.com/article/wmprint.html>.
+// Copyright (C) 2000 by Feng Yuan (www.fengyuan.com).
+
+static unsigned beginPaintSysCall;
+static BYTE* beginPaint;
+
+static unsigned endPaintSysCall;
+static BYTE* endPaint;
+
+HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
+{
+    PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
+    if (pluginView && pluginView->m_wmPrintHDC) {
+        // We're secretly handling WM_PRINTCLIENT, so set up the PAINTSTRUCT so
+        // that the plugin will paint into the HDC we provide.
+        memset(lpPaint, 0, sizeof(PAINTSTRUCT));
+        lpPaint->hdc = pluginView->m_wmPrintHDC;
+        GetClientRect(hWnd, &lpPaint->rcPaint);
+        return pluginView->m_wmPrintHDC;
+    }
+
+    // Call through to the original BeginPaint.
+    __asm   mov     eax, beginPaintSysCall
+    __asm   push    lpPaint
+    __asm   push    hWnd
+    __asm   call    beginPaint
+}
+
+BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
+{
+    PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
+    if (pluginView && pluginView->m_wmPrintHDC) {
+        // We're secretly handling WM_PRINTCLIENT, so we don't have to do any
+        // cleanup.
+        return TRUE;
+    }
+
+    // Call through to the original EndPaint.
+    __asm   mov     eax, endPaintSysCall
+    __asm   push    lpPaint
+    __asm   push    hWnd
+    __asm   call    endPaint
+}
+
+static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE*& pProc, const void* pNewProc)
+{
+    // See <http://www.fengyuan.com/article/wmprint.html> for an explanation of
+    // how this function works.
+
+    HINSTANCE hMod = GetModuleHandleA(module);
+
+    pProc = reinterpret_cast<BYTE*>(GetProcAddress(hMod, proc));
+
+    if (pProc[0] != 0xB8)
+        return;
+
+    // FIXME: Should we be reading the bytes one-by-one instead of doing an
+    // unaligned read?
+    sysCallID = *reinterpret_cast<unsigned*>(pProc + 1);
+
+    DWORD flOldProtect;
+    if (!VirtualProtect(pProc, 5, PAGE_EXECUTE_READWRITE, &flOldProtect))
+        return;
+
+    pProc[0] = 0xE9;
+    *reinterpret_cast<unsigned*>(pProc + 1) = reinterpret_cast<intptr_t>(pNewProc) - reinterpret_cast<intptr_t>(pProc + 5);
+
+    pProc += 5;
+}
+
+static void setUpOffscreenPaintingHooks(HDC (WINAPI*hookedBeginPaint)(HWND, PAINTSTRUCT*), BOOL (WINAPI*hookedEndPaint)(HWND, const PAINTSTRUCT*))
+{
+    static bool haveHooked = false;
+    if (haveHooked)
+        return;
+    haveHooked = true;
+
+    // Most (all?) windowed plugins don't seem to respond to WM_PRINTCLIENT, so
+    // we hook into BeginPaint/EndPaint to allow their normal WM_PAINT handling
+    // to draw into a given HDC. Note that this hooking affects the entire
+    // process.
+    hook("user32.dll", "BeginPaint", beginPaintSysCall, beginPaint, hookedBeginPaint);
+    hook("user32.dll", "EndPaint", endPaintSysCall, endPaint, hookedEndPaint);
+}
+
 static bool registerPluginView()
 {
     static bool haveRegisteredWindowClass = false;
@@ -201,9 +286,19 @@ PluginView::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
         m_popPopupsStateTimer.startOneShot(0);
     }
 
+    if (message == WM_PRINTCLIENT) {
+        // Most (all?) windowed plugins don't respond to WM_PRINTCLIENT, so we
+        // change the message to WM_PAINT and rely on our hooked versions of
+        // BeginPaint/EndPaint to make the plugin draw into the given HDC.
+        message = WM_PAINT;
+        m_wmPrintHDC = reinterpret_cast<HDC>(wParam);
+    }
+
     // Call the plug-in's window proc.
     LRESULT result = ::CallWindowProc(m_pluginWndProc, hWnd, message, wParam, lParam);
 
+    m_wmPrintHDC = 0;
+
     m_isCallingPluginWndProc = false;
 
     return result;
@@ -305,6 +400,34 @@ bool PluginView::dispatchNPEvent(NPEvent& npEvent)
     return result;
 }
 
+void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const IntRect& rect) const
+{
+    ASSERT(m_isWindowed);
+    ASSERT(context->shouldIncludeChildWindows());
+
+    ASSERT(parent()->isFrameView());
+    IntPoint locationInWindow = static_cast<FrameView*>(parent())->contentsToWindow(frameRect().location());
+
+    HDC hdc = context->getWindowsContext(frameRect(), false);
+
+    XFORM originalTransform;
+    GetWorldTransform(hdc, &originalTransform);
+
+    // The plugin expects the DC to be in client coordinates, so we translate
+    // the DC to make that so.
+    XFORM transform = originalTransform;
+    transform.eDx = locationInWindow.x();
+    transform.eDy = locationInWindow.y();
+
+    SetWorldTransform(hdc, &transform);
+
+    SendMessage(platformPluginWidget(), WM_PRINTCLIENT, reinterpret_cast<WPARAM>(hdc), PRF_CLIENT | PRF_CHILDREN | PRF_OWNED);
+
+    SetWorldTransform(hdc, &originalTransform);
+
+    context->releaseWindowsContext(hdc, frameRect(), false);
+}
+
 void PluginView::paint(GraphicsContext* context, const IntRect& rect)
 {
     if (!m_isStarted) {
@@ -313,8 +436,14 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         return;
     }
 
-    if (m_isWindowed || context->paintingDisabled())
+    if (context->paintingDisabled())
+        return;
+
+    if (m_isWindowed) {
+        if (context->shouldIncludeChildWindows())
+            paintWindowedPluginIntoContext(context, rect);
         return;
+    }
 
     ASSERT(parent()->isFrameView());
     IntRect rectInWindow = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
@@ -422,10 +551,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
             }
     }
     else if (event->type() == eventNames().mousedownEvent) {
-        // Focus the plugin
-        if (Page* page = m_parentFrame->page())
-            page->focusController()->setFocusedFrame(m_parentFrame);
-        m_parentFrame->document()->setFocusedNode(m_element);
+        focusPluginElement();
         switch (event->button()) {
             case 0:
                 npEvent.event = WM_LBUTTONDOWN;
@@ -452,8 +578,6 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     } else
         return;
 
-    HCURSOR currentCursor = ::GetCursor();
-
     JSC::JSLock::DropAllLocks dropAllLocks(false);
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
@@ -461,7 +585,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
 #if !PLATFORM(QT)
     // Currently, Widget::setCursor is always called after this function in EventHandler.cpp
     // and since we don't want that we set ignoreNextSetCursor to true here to prevent that.
-    ignoreNextSetCursor = true;     
+    ignoreNextSetCursor = true;
     lastSetCursor = ::GetCursor();
 #endif
 }
@@ -802,6 +926,7 @@ void PluginView::init()
 
     if (m_isWindowed) {
         registerPluginView();
+        setUpOffscreenPaintingHooks(hookedBeginPaint, hookedEndPaint);
 
         DWORD flags = WS_CHILD;
         if (isSelfVisible())
diff --git a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp
index 0bd1d1a64b..db9a101fde 100644
--- a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.cpp
@@ -31,10 +31,7 @@ namespace WebCore {
 void EllipsisBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
     GraphicsContext* context = paintInfo.context;
-    RenderStyle* style = m_object->style(m_firstLine);
-    if (style->font() != context->font())
-        context->setFont(style->font());
-
+    RenderStyle* style = m_renderer->style(m_firstLine);
     Color textColor = style->color();
     if (textColor != context->fillColor())
         context->setFillColor(textColor);
@@ -46,15 +43,15 @@ void EllipsisBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     }
 
     const String& str = m_str;
-    context->drawText(TextRun(str.characters(), str.length(), false, 0, 0, false, style->visuallyOrdered()), IntPoint(m_x + tx, m_y + ty + m_baseline));
+    context->drawText(style->font(), TextRun(str.characters(), str.length(), false, 0, 0, false, style->visuallyOrdered()), IntPoint(m_x + tx, m_y + ty + style->font().ascent()));
 
     if (setShadow)
         context->clearShadow();
 
     if (m_markupBox) {
         // Paint the markup box
-        tx += m_x + m_width - m_markupBox->xPos();
-        ty += m_y + m_baseline - (m_markupBox->yPos() + m_markupBox->baseline());
+        tx += m_x + m_width - m_markupBox->x();
+        ty += m_y + style->font().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->font().ascent());
         m_markupBox->paint(paintInfo, tx, ty);
     }
 }
@@ -66,16 +63,17 @@ bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
 
     // Hit test the markup box.
     if (m_markupBox) {
-        int mtx = tx + m_width - m_markupBox->xPos();
-        int mty = ty + m_baseline - (m_markupBox->yPos() + m_markupBox->baseline());
+        RenderStyle* style = m_renderer->style(m_firstLine);
+        int mtx = tx + m_width - m_markupBox->x();
+        int mty = ty + style->font().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->font().ascent());
         if (m_markupBox->nodeAtPoint(request, result, x, y, mtx, mty)) {
-            object()->updateHitTestResult(result, IntPoint(x - mtx, y - mty));
+            renderer()->updateHitTestResult(result, IntPoint(x - mtx, y - mty));
             return true;
         }
     }
 
     if (visibleToHitTesting() && IntRect(tx, ty, m_width, m_height).contains(x, y)) {
-        object()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
+        renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
         return true;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h
index dbb30cd8a8..9dbd27f994 100644
--- a/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/EllipsisBox.h
@@ -26,15 +26,15 @@
 
 namespace WebCore {
 
+class HitTestRequest;
 class HitTestResult;
 
-struct HitTestRequest;
-
 class EllipsisBox : public InlineBox {
 public:
     EllipsisBox(RenderObject* obj, const AtomicString& ellipsisStr, InlineFlowBox* parent,
-                int width, int y, int height, int baseline, bool firstLine, InlineBox* markupBox)
-        : InlineBox(obj, 0, y, width, height, baseline, firstLine, true, false, false, 0, 0, parent)
+                int width, int height, int y, bool firstLine, InlineBox* markupBox)
+        : InlineBox(obj, 0, y, width, firstLine, true, false, false, 0, 0, parent)
+        , m_height(height)
         , m_str(ellipsisStr)
         , m_markupBox(markupBox)
     {
@@ -44,6 +44,9 @@ public:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
 
 private:
+    virtual int height() const { return m_height; }
+
+    int m_height;
     AtomicString m_str;
     InlineBox* m_markupBox;
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
index d7c129358c..f995fbf34d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
@@ -85,16 +85,15 @@ int FixedTableLayout::calcWidthArray(int)
 
     // iterate over all <col> elements
     RenderObject* child = m_table->firstChild();
-    int cCol = 0;
     int nEffCols = m_table->numEffCols();
     m_width.resize(nEffCols);
     m_width.fill(Length(Auto));
 
+    int currentEffectiveColumn = 0;
     Length grpWidth;
     while (child) {
         if (child->isTableCol()) {
-            RenderTableCol *col = static_cast<RenderTableCol *>(child);
-            int span = col->span();
+            RenderTableCol* col = static_cast<RenderTableCol*>(child);
             if (col->firstChild())
                 grpWidth = col->style()->width();
             else {
@@ -104,30 +103,35 @@ int FixedTableLayout::calcWidthArray(int)
                 int effWidth = 0;
                 if (w.isFixed() && w.value() > 0)
                     effWidth = w.value();
-                
-                int usedSpan = 0;
-                int i = 0;
-                while (usedSpan < span) {
-                    if(cCol + i >= nEffCols) {
-                        m_table->appendColumn(span - usedSpan);
+
+                int span = col->span();
+                while (span) {
+                    int spanInCurrentEffectiveColumn;
+                    if (currentEffectiveColumn >= nEffCols) {
+                        m_table->appendColumn(span);
                         nEffCols++;
-                        m_width.resize(nEffCols);
-                        m_width[nEffCols-1] = Length();
+                        m_width.append(Length());
+                        spanInCurrentEffectiveColumn = span;
+                    } else {
+                        if (span < m_table->spanOfEffCol(currentEffectiveColumn)) {
+                            m_table->splitColumn(currentEffectiveColumn, span);
+                            nEffCols++;
+                            m_width.append(Length());
+                        }
+                        spanInCurrentEffectiveColumn = m_table->spanOfEffCol(currentEffectiveColumn);
                     }
-                    int eSpan = m_table->spanOfEffCol(cCol+i);
                     if ((w.isFixed() || w.isPercent()) && w.isPositive()) {
-                        m_width[cCol + i].setRawValue(w.type(), w.rawValue() * eSpan);
-                        usedWidth += effWidth * eSpan;
+                        m_width[currentEffectiveColumn].setRawValue(w.type(), w.rawValue() * spanInCurrentEffectiveColumn);
+                        usedWidth += effWidth * spanInCurrentEffectiveColumn;
                     }
-                    usedSpan += eSpan;
-                    i++;
+                    span -= spanInCurrentEffectiveColumn;
+                    currentEffectiveColumn++;
                 }
-                cCol += i;
             }
         } else
             break;
 
-        RenderObject *next = child->firstChild();
+        RenderObject* next = child->firstChild();
         if (!next)
             next = child->nextSibling();
         if (!next && child->parent()->isTableCol()) {
@@ -146,7 +150,7 @@ int FixedTableLayout::calcWidthArray(int)
     if (section && !section->numRows())
         section = m_table->sectionBelow(section, true);
     if (section) {
-        cCol = 0;
+        int cCol = 0;
         RenderObject* firstRow = section->firstChild();
         child = firstRow->firstChild();
         while (child) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h b/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h
index 11dca4ba3c..46dd7b8af1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestRequest.h
@@ -2,6 +2,7 @@
  * This file is part of the HTML rendering engine for KDE.
  *
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,24 +20,35 @@
  * Boston, MA 02110-1301, USA.
  *
 */
+
 #ifndef HitTestRequest_h
 #define HitTestRequest_h
 
 namespace WebCore {
 
-struct HitTestRequest {
-    HitTestRequest(bool r, bool a, bool m = false, bool u = false)
-        : readonly(r)
-        , active(a)
-        , mouseMove(m)
-        , mouseUp(u)
-    { 
+class HitTestRequest {
+public:
+    enum RequestType {
+        ReadOnly = 0x1,
+        Active = 0x2,
+        MouseMove = 0x4,
+        MouseUp = 0x8,
+        IgnoreClipping = 0x10
+    };
+
+    HitTestRequest(int requestType)
+        : m_requestType(requestType)
+    {
     }
 
-    bool readonly;
-    bool active;
-    bool mouseMove;
-    bool mouseUp;
+    bool readOnly() const { return m_requestType & ReadOnly; }
+    bool active() const { return m_requestType & Active; }
+    bool mouseMove() const { return m_requestType & MouseMove; }
+    bool mouseUp() const { return m_requestType & MouseUp; }
+    bool ignoreClipping() const { return m_requestType & IgnoreClipping; }
+
+private:
+    int m_requestType;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
index 5a041ed898..f2ed7dbe60 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
@@ -159,6 +159,20 @@ String HitTestResult::spellingToolTip() const
     return marker->description;
 }
 
+String HitTestResult::replacedString() const
+{
+    // Return the replaced string associated with this point, if any. This marker is created when a string is autocorrected, 
+    // and is used for generating a contextual menu item that allows it to easily be changed back if desired.
+    if (!m_innerNonSharedNode)
+        return String();
+    
+    DocumentMarker* marker = m_innerNonSharedNode->document()->markerContainingPoint(m_point, DocumentMarker::Replacement);
+    if (!marker)
+        return String();
+    
+    return marker->description;
+}    
+    
 String HitTestResult::title() const
 {
     // Find the title in the nearest enclosing DOM node.
@@ -177,9 +191,7 @@ String displayString(const String& string, const Node* node)
 {
     if (!node)
         return string;
-    String copy(string);
-    copy.replace('\\', node->document()->backslashAsCurrencySymbol());
-    return copy;
+    return node->document()->displayStringModifiedByEncoding(string);
 }
 
 String HitTestResult::altDisplayString() const
@@ -226,7 +238,7 @@ IntRect HitTestResult::imageRect() const
 {
     if (!image())
         return IntRect();
-    return m_innerNonSharedNode->renderer()->absoluteContentBox();
+    return m_innerNonSharedNode->renderBox()->absoluteContentBox();
 }
 
 KURL HitTestResult::absoluteImageURL() const
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
index 5ed9b34fd2..4f0383fd63 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.h
@@ -65,6 +65,7 @@ public:
     IntRect boundingBox() const;
     bool isSelected() const;
     String spellingToolTip() const;
+    String replacedString() const;
     String title() const;
     String altDisplayString() const;
     String titleDisplayString() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp
index f5d0de5f49..2d956a8fe1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp
@@ -23,6 +23,7 @@
 #include "HitTestResult.h"
 #include "InlineFlowBox.h"
 #include "RenderArena.h"
+#include "RenderBox.h"
 #include "RootInlineBox.h"
 
 using namespace std;
@@ -79,19 +80,47 @@ void InlineBox::operator delete(void* ptr, size_t sz)
 #ifndef NDEBUG
 void InlineBox::showTreeForThis() const
 {
-    if (m_object)
-        m_object->showTreeForThis();
+    if (m_renderer)
+        m_renderer->showTreeForThis();
 }
 #endif
 
+int InlineBox::height() const
+{
+#if ENABLE(SVG)
+    if (isSVG())
+        return svgBoxHeight();
+#endif
+
+    if (renderer()->isText())
+        return m_isText ? renderer()->style(m_firstLine)->font().height() : 0;
+    if (renderer()->isBox() && parent())
+        return toRenderBox(m_renderer)->height();
+
+    ASSERT(isInlineFlowBox());
+    const InlineFlowBox* flowBox = static_cast<const InlineFlowBox*>(this);
+    RenderBoxModelObject* flowObject = boxModelObject();
+    const Font& font = renderer()->style(m_firstLine)->font();
+    int result = font.height();
+    bool strictMode = renderer()->document()->inStrictMode();
+    if (parent())
+        result += flowObject->borderTop() + flowObject->paddingTop() + flowObject->borderBottom() + flowObject->paddingBottom();
+    if (strictMode || flowBox->hasTextChildren() || flowObject->hasHorizontalBordersOrPadding())
+        return result;
+    int bottom = root()->bottomOverflow();
+    if (y() + result > bottom)
+        result = bottom - y();
+    return result;
+}
+
 int InlineBox::caretMinOffset() const 
 { 
-    return m_object->caretMinOffset(); 
+    return m_renderer->caretMinOffset(); 
 }
 
 int InlineBox::caretMaxOffset() const 
 { 
-    return m_object->caretMaxOffset(); 
+    return m_renderer->caretMaxOffset(); 
 }
 
 unsigned InlineBox::caretMaxRenderedOffset() const 
@@ -108,34 +137,38 @@ void InlineBox::dirtyLineBoxes()
 
 void InlineBox::deleteLine(RenderArena* arena)
 {
-    if (!m_extracted)
-        m_object->setInlineBoxWrapper(0);
+    if (!m_extracted && m_renderer->isBox())
+        toRenderBox(m_renderer)->setInlineBoxWrapper(0);
     destroy(arena);
 }
 
 void InlineBox::extractLine()
 {
     m_extracted = true;
-    m_object->setInlineBoxWrapper(0);
+    if (m_renderer->isBox())
+        toRenderBox(m_renderer)->setInlineBoxWrapper(0);
 }
 
 void InlineBox::attachLine()
 {
     m_extracted = false;
-    m_object->setInlineBoxWrapper(this);
+    if (m_renderer->isBox())
+        toRenderBox(m_renderer)->setInlineBoxWrapper(this);
 }
 
 void InlineBox::adjustPosition(int dx, int dy)
 {
     m_x += dx;
     m_y += dy;
-    if (m_object->isReplaced() || m_object->isBR())
-        m_object->setPos(m_object->xPos() + dx, m_object->yPos() + dy);
+    if (m_renderer->isReplaced()) {
+        RenderBox* box = toRenderBox(m_renderer);
+        box->move(dx, dy);
+    }
 }
 
 void InlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!object()->shouldPaintWithinRoot(paintInfo) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
+    if (!renderer()->shouldPaintWithinRoot(paintInfo) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
         return;
 
     // Paint all phases of replaced elements atomically, as though the replaced element established its
@@ -144,16 +177,16 @@ void InlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     bool preservePhase = paintInfo.phase == PaintPhaseSelection || paintInfo.phase == PaintPhaseTextClip;
     RenderObject::PaintInfo info(paintInfo);
     info.phase = preservePhase ? paintInfo.phase : PaintPhaseBlockBackground;
-    object()->paint(info, tx, ty);
+    renderer()->paint(info, tx, ty);
     if (!preservePhase) {
         info.phase = PaintPhaseChildBlockBackgrounds;
-        object()->paint(info, tx, ty);
+        renderer()->paint(info, tx, ty);
         info.phase = PaintPhaseFloat;
-        object()->paint(info, tx, ty);
+        renderer()->paint(info, tx, ty);
         info.phase = PaintPhaseForeground;
-        object()->paint(info, tx, ty);
+        renderer()->paint(info, tx, ty);
         info.phase = PaintPhaseOutline;
-        object()->paint(info, tx, ty);
+        renderer()->paint(info, tx, ty);
     }
 }
 
@@ -162,7 +195,15 @@ bool InlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result
     // Hit test all phases of replaced elements atomically, as though the replaced element established its
     // own stacking context.  (See Appendix E.2, section 6.4 on inline block/table elements in the CSS2.1
     // specification.)
-    return object()->hitTest(request, result, IntPoint(x, y), tx, ty);
+    return renderer()->hitTest(request, result, IntPoint(x, y), tx, ty);
+}
+
+const RootInlineBox* InlineBox::root() const
+{ 
+    if (m_parent)
+        return m_parent->root(); 
+    ASSERT(isRootInlineBox());
+    return static_cast<const RootInlineBox*>(this);
 }
 
 RootInlineBox* InlineBox::root()
@@ -225,13 +266,13 @@ InlineBox* InlineBox::prevLeafChild()
 
 RenderObject::SelectionState InlineBox::selectionState()
 {
-    return object()->selectionState();
+    return renderer()->selectionState();
 }
 
 bool InlineBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth)
 {
     // Non-replaced elements can always accommodate an ellipsis.
-    if (!m_object || !m_object->isReplaced())
+    if (!m_renderer || !m_renderer->isReplaced())
         return true;
     
     IntRect boxRect(m_x, 0, m_width, 10);
@@ -239,7 +280,7 @@ bool InlineBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidt
     return !(boxRect.intersects(ellipsisRect));
 }
 
-int InlineBox::placeEllipsisBox(bool, int, int, bool&)
+int InlineBox::placeEllipsisBox(bool, int, int, int, bool&)
 {
     // Use -1 to mean "we didn't set the position."
     return -1;
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineBox.h
index 41ad72a0cc..95852783ed 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineBox.h
@@ -21,43 +21,41 @@
 #ifndef InlineBox_h
 #define InlineBox_h
 
-#include "RenderObject.h" // needed for RenderObject::PaintInfo
+#include "RenderBoxModelObject.h"
 #include "TextDirection.h"
 
 namespace WebCore {
 
+class HitTestRequest;
 class HitTestResult;
 class RootInlineBox;
 
-struct HitTestRequest;
 
 // InlineBox represents a rectangle that occurs on a line.  It corresponds to
 // some RenderObject (i.e., it represents a portion of that RenderObject).
 class InlineBox {
 public:
     InlineBox(RenderObject* obj)
-        : m_object(obj)
+        : m_next(0)
+        , m_prev(0)
+        , m_parent(0)
+        , m_renderer(obj)
         , m_x(0)
         , m_y(0)
         , m_width(0)
-        , m_height(0)
-        , m_baseline(0)
-        , m_next(0)
-        , m_prev(0)
-        , m_parent(0)
         , m_firstLine(false)
         , m_constructed(false)
         , m_bidiEmbeddingLevel(0)
         , m_dirty(false)
         , m_extracted(false)
-        , m_includeLeftEdge(false)
-        , m_includeRightEdge(false)
-        , m_hasTextChildren(true)
+#if ENABLE(SVG)
+        , m_isSVG(false)
+#endif
         , m_endsWithBreak(false)
         , m_hasSelectedChildren(false)
         , m_hasEllipsisBox(false)
         , m_dirOverride(false)
-        , m_treatAsText(true)
+        , m_isText(false)
         , m_determinedIfNextOnLineExists(false)
         , m_determinedIfPrevOnLineExists(false)
         , m_nextOnLineExists(false)
@@ -69,30 +67,28 @@ public:
     {
     }
 
-    InlineBox(RenderObject* obj, int x, int y, int width, int height, int baseline, bool firstLine, bool constructed,
+    InlineBox(RenderObject* obj, int x, int y, int width, bool firstLine, bool constructed,
               bool dirty, bool extracted, InlineBox* next, InlineBox* prev, InlineFlowBox* parent)
-        : m_object(obj)
+        : m_next(next)
+        , m_prev(prev)
+        , m_parent(parent)
+        , m_renderer(obj)
         , m_x(x)
         , m_y(y)
         , m_width(width)
-        , m_height(height)
-        , m_baseline(baseline)
-        , m_next(next)
-        , m_prev(prev)
-        , m_parent(parent)
         , m_firstLine(firstLine)
         , m_constructed(constructed)
         , m_bidiEmbeddingLevel(0)
         , m_dirty(dirty)
         , m_extracted(extracted)
-        , m_includeLeftEdge(false)
-        , m_includeRightEdge(false)
-        , m_hasTextChildren(true)
+#if ENABLE(SVG)
+        , m_isSVG(false)
+#endif
         , m_endsWithBreak(false)
         , m_hasSelectedChildren(false)   
         , m_hasEllipsisBox(false)
         , m_dirOverride(false)
-        , m_treatAsText(true)
+        , m_isText(false)
         , m_determinedIfNextOnLineExists(false)
         , m_determinedIfPrevOnLineExists(false)
         , m_nextOnLineExists(false)
@@ -134,14 +130,16 @@ public:
     void showTreeForThis() const;
 #endif
     virtual bool isInlineBox() { return false; }
-    virtual bool isInlineFlowBox() { return false; }
-    virtual bool isContainer() { return false; }
+    virtual bool isInlineFlowBox() const { return false; }
     virtual bool isInlineTextBox() { return false; }
-    virtual bool isRootInlineBox() { return false; }
+    virtual bool isRootInlineBox() const { return false; }
 #if ENABLE(SVG) 
     virtual bool isSVGRootInlineBox() { return false; }
+    bool isSVG() const { return m_isSVG; }
+    void setIsSVG(bool b) { m_isSVG = b; }
 #endif
-    virtual bool isText() const { return false; }
+    bool isText() const { return m_isText; }
+    void setIsText(bool b) { m_isText = b; }
 
     bool isConstructed() { return m_constructed; }
     virtual void setConstructed()
@@ -178,7 +176,7 @@ public:
     InlineBox* nextLeafChild();
     InlineBox* prevLeafChild();
         
-    RenderObject* object() const { return m_object; }
+    RenderObject* renderer() const { return m_renderer; }
 
     InlineFlowBox* parent() const
     {
@@ -187,29 +185,26 @@ public:
     }
     void setParent(InlineFlowBox* par) { m_parent = par; }
 
+    const RootInlineBox* root() const;
     RootInlineBox* root();
-    
+
     void setWidth(int w) { m_width = w; }
     int width() const { return m_width; }
 
-    void setXPos(int x) { m_x = x; }
-    int xPos() const { return m_x; }
-
-    void setYPos(int y) { m_y = y; }
-    int yPos() const { return m_y; }
+    // x() is the left side of the box in the parent's coordinate system.
+    void setX(int x) { m_x = x; }
+    int x() const { return m_x; }
 
-    void setHeight(int h) { m_height = h; }
-    int height() const { return m_height; }
-    
-    void setBaseline(int b) { m_baseline = b; }
-    int baseline() const { return m_baseline; }
+    // y() is the top of the box in the parent's coordinate system.
+    void setY(int y) { m_y = y; }
+    int y() const { return m_y; }
 
-    bool hasTextChildren() const { return m_hasTextChildren; }
+    int height() const;
 
-    virtual int topOverflow() { return yPos(); }
-    virtual int bottomOverflow() { return yPos() + height(); }
-    virtual int leftOverflow() { return xPos(); }
-    virtual int rightOverflow() { return xPos() + width(); }
+    virtual int topOverflow() const { return y(); }
+    virtual int bottomOverflow() const { return y() + height(); }
+    virtual int leftOverflow() const { return x(); }
+    virtual int rightOverflow() const { return x() + width(); }
 
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
@@ -231,28 +226,40 @@ public:
     virtual RenderObject::SelectionState selectionState();
 
     virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth);
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool&);
+    // visibleLeftEdge, visibleRightEdge are in the parent's coordinate system.
+    virtual int placeEllipsisBox(bool ltr, int visibleLeftEdge, int visibleRightEdge, int ellipsisWidth, bool&);
 
     void setHasBadParent();
 
     int toAdd() const { return m_toAdd; }
     
-    bool visibleToHitTesting() const { return object()->style()->visibility() == VISIBLE && object()->style()->pointerEvents() != PE_NONE; }
+    bool visibleToHitTesting() const { return renderer()->style()->visibility() == VISIBLE && renderer()->style()->pointerEvents() != PE_NONE; }
     
-public:
-    RenderObject* m_object;
+    // Use with caution! The type is not checked!
+    RenderBoxModelObject* boxModelObject() const
+    { 
+        if (!m_renderer->isText())
+            return static_cast<RenderBoxModelObject*>(m_renderer);
+        return 0;
+    }
 
-    int m_x;
-    int m_y;
-    int m_width;
-    int m_height;
-    int m_baseline;
+protected:
+#if ENABLE(SVG)
+    virtual int svgBoxHeight() const { return 0; }
+#endif
 
 private:
     InlineBox* m_next; // The next element on the same line as us.
     InlineBox* m_prev; // The previous element on the same line as us.
 
     InlineFlowBox* m_parent; // The box that contains us.
+
+public:
+    RenderObject* m_renderer;
+
+    int m_x;
+    int m_y;
+    int m_width;
     
     // Some of these bits are actually for subclasses and moved here to compact the structures.
 
@@ -266,10 +273,9 @@ protected:
     bool m_dirty : 1;
     bool m_extracted : 1;
 
-    // for InlineFlowBox
-    bool m_includeLeftEdge : 1;
-    bool m_includeRightEdge : 1;
-    bool m_hasTextChildren : 1;
+#if ENABLE(SVG)
+    bool m_isSVG : 1;
+#endif
 
     // for RootInlineBox
     bool m_endsWithBreak : 1;  // Whether the line ends with a <br>.
@@ -279,13 +285,13 @@ protected:
     // for InlineTextBox
 public:
     bool m_dirOverride : 1;
-    bool m_treatAsText : 1; // Whether or not to treat a <br> as text for the purposes of line height.
+    bool m_isText : 1; // Whether or not this object represents text with a non-zero height. Includes non-image list markers, text boxes.
 protected:
     mutable bool m_determinedIfNextOnLineExists : 1;
     mutable bool m_determinedIfPrevOnLineExists : 1;
     mutable bool m_nextOnLineExists : 1;
     mutable bool m_prevOnLineExists : 1;
-    int m_toAdd : 13; // for justified text
+    int m_toAdd : 12; // for justified text
 
 #ifndef NDEBUG
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
index b4d240eb12..0432a4cd01 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
@@ -28,7 +28,7 @@
 #include "HitTestResult.h"
 #include "RootInlineBox.h"
 #include "RenderBlock.h"
-#include "RenderFlow.h"
+#include "RenderInline.h"
 #include "RenderListMarker.h"
 #include "RenderTableCell.h"
 #include "RootInlineBox.h"
@@ -51,47 +51,6 @@ InlineFlowBox::~InlineFlowBox()
 
 #endif
 
-RenderFlow* InlineFlowBox::flowObject()
-{
-    return static_cast<RenderFlow*>(m_object);
-}
-
-int InlineFlowBox::marginLeft()
-{
-    if (!includeLeftEdge())
-        return 0;
-    
-    Length margin = object()->style()->marginLeft();
-    if (margin.isAuto())
-        return 0;
-    if (margin.isFixed())
-        return margin.value();
-    return object()->marginLeft();
-}
-
-int InlineFlowBox::marginRight()
-{
-    if (!includeRightEdge())
-        return 0;
-    
-    Length margin = object()->style()->marginRight();
-    if (margin.isAuto())
-        return 0;
-    if (margin.isFixed())
-        return margin.value();
-    return object()->marginRight();
-}
-
-int InlineFlowBox::marginBorderPaddingLeft()
-{
-    return marginLeft() + borderLeft() + paddingLeft();
-}
-
-int InlineFlowBox::marginBorderPaddingRight()
-{
-    return marginRight() + borderRight() + paddingRight();
-}
-
 int InlineFlowBox::getFlowSpacingWidth()
 {
     int totWidth = marginBorderPaddingLeft() + marginBorderPaddingRight();
@@ -121,7 +80,7 @@ void InlineFlowBox::addToLine(InlineBox* child)
     child->setFirstLineStyleBit(m_firstLine);
     if (child->isText())
         m_hasTextChildren = true;
-    if (child->object()->selectionState() != RenderObject::SelectionNone)
+    if (child->renderer()->selectionState() != RenderObject::SelectionNone)
         root()->setHasSelectedChildren(true);
 
     checkConsistency();
@@ -168,26 +127,41 @@ void InlineFlowBox::deleteLine(RenderArena* arena)
     m_lastChild = 0;
 #endif
 
-    static_cast<RenderFlow*>(m_object)->removeLineBox(this);
+    removeLineBoxFromRenderObject();
     destroy(arena);
 }
 
+void InlineFlowBox::removeLineBoxFromRenderObject()
+{
+    toRenderInline(renderer())->lineBoxes()->removeLineBox(this);
+}
+
 void InlineFlowBox::extractLine()
 {
     if (!m_extracted)
-        static_cast<RenderFlow*>(m_object)->extractLineBox(this);
+        extractLineBoxFromRenderObject();
     for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
         child->extractLine();
 }
 
+void InlineFlowBox::extractLineBoxFromRenderObject()
+{
+    toRenderInline(renderer())->lineBoxes()->extractLineBox(this);
+}
+
 void InlineFlowBox::attachLine()
 {
     if (m_extracted)
-        static_cast<RenderFlow*>(m_object)->attachLineBox(this);
+        attachLineBoxToRenderObject();
     for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
         child->attachLine();
 }
 
+void InlineFlowBox::attachLineBoxToRenderObject()
+{
+    toRenderInline(renderer())->lineBoxes()->attachLineBox(this);
+}
+
 void InlineFlowBox::adjustPosition(int dx, int dy)
 {
     InlineRunBox::adjustPosition(dx, dy);
@@ -195,18 +169,23 @@ void InlineFlowBox::adjustPosition(int dx, int dy)
         child->adjustPosition(dx, dy);
 }
 
+RenderLineBoxList* InlineFlowBox::rendererLineBoxes() const
+{
+    return toRenderInline(renderer())->lineBoxes();
+}
+
 bool InlineFlowBox::onEndChain(RenderObject* endObject)
 {
     if (!endObject)
         return false;
     
-    if (endObject == object())
+    if (endObject == renderer())
         return true;
 
     RenderObject* curr = endObject;
     RenderObject* parent = curr->parent();
     while (parent && !parent->isRenderBlock()) {
-        if (parent->lastChild() != curr || parent == object())
+        if (parent->lastChild() != curr || parent == renderer())
             return false;
             
         curr = parent;
@@ -223,19 +202,17 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     bool includeLeftEdge = false;
     bool includeRightEdge = false;
 
-    RenderFlow* flow = static_cast<RenderFlow*>(object());
-    
-    if (!flow->firstChild())
-        includeLeftEdge = includeRightEdge = true; // Empty inlines never split across lines.
-    else if (parent()) { // The root inline box never has borders/margins/padding.
-        bool ltr = flow->style()->direction() == LTR;
-        
+    // The root inline box never has borders/margins/padding.
+    if (parent()) {
+        bool ltr = renderer()->style()->direction() == LTR;
+
         // Check to see if all initial lines are unconstructed.  If so, then
-        // we know the inline began on this line.
-        if (!flow->firstLineBox()->isConstructed()) {
-            if (ltr && flow->firstLineBox() == this)
+        // we know the inline began on this line (unless we are a continuation).
+        RenderLineBoxList* lineBoxList = rendererLineBoxes();
+        if (!lineBoxList->firstLineBox()->isConstructed() && !renderer()->isInlineContinuation()) {
+            if (ltr && lineBoxList->firstLineBox() == this)
                 includeLeftEdge = true;
-            else if (!ltr && flow->lastLineBox() == this)
+            else if (!ltr && lineBoxList->lastLineBox() == this)
                 includeRightEdge = true;
         }
     
@@ -246,14 +223,15 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
         // reverse for rtl), then the inline has closed.
         // (3) The line may end on the inline.  If we are the last child (climbing up
         // the end object's chain), then we just closed as well.
-        if (!flow->lastLineBox()->isConstructed()) {
+        if (!lineBoxList->lastLineBox()->isConstructed()) {
+            RenderInline* inlineFlow = toRenderInline(renderer());
             if (ltr) {
                 if (!nextLineBox() &&
-                    ((lastLine && !object()->continuation()) || nextOnLineExists() || onEndChain(endObject)))
+                    ((lastLine && !inlineFlow->continuation()) || nextOnLineExists() || onEndChain(endObject)))
                     includeRightEdge = true;
             } else {
                 if ((!prevLineBox() || prevLineBox()->isConstructed()) &&
-                    ((lastLine && !object()->continuation()) || prevOnLineExists() || onEndChain(endObject)))
+                    ((lastLine && !inlineFlow->continuation()) || prevOnLineExists() || onEndChain(endObject)))
                     includeLeftEdge = true;
             }
         }
@@ -270,32 +248,32 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     }
 }
 
-int InlineFlowBox::placeBoxesHorizontally(int x, int& leftPosition, int& rightPosition, bool& needsWordSpacing)
+int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& rightPosition, bool& needsWordSpacing)
 {
     // Set our x position.
-    setXPos(x);
+    setX(xPos);
 
     int boxShadowLeft = 0;
     int boxShadowRight = 0;
-    for (ShadowData* boxShadow = object()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
+    for (ShadowData* boxShadow = renderer()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
         boxShadowLeft = min(boxShadow->x - boxShadow->blur, boxShadowLeft);
         boxShadowRight = max(boxShadow->x + boxShadow->blur, boxShadowRight);
     }
-    leftPosition = min(x + boxShadowLeft, leftPosition);
+    leftPosition = min(xPos + boxShadowLeft, leftPosition);
 
-    int startX = x;
-    x += borderLeft() + paddingLeft();
+    int startX = xPos;
+    xPos += borderLeft() + paddingLeft();
     
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->object()->isText()) {
+        if (curr->renderer()->isText()) {
             InlineTextBox* text = static_cast<InlineTextBox*>(curr);
-            RenderText* rt = static_cast<RenderText*>(text->object());
+            RenderText* rt = toRenderText(text->renderer());
             if (rt->textLength()) {
                 if (needsWordSpacing && isSpaceOrNewline(rt->characters()[text->start()]))
-                    x += rt->style(m_firstLine)->font().wordSpacing();
+                    xPos += rt->style(m_firstLine)->font().wordSpacing();
                 needsWordSpacing = !isSpaceOrNewline(rt->characters()[text->end()]);
             }
-            text->setXPos(x);
+            text->setX(xPos);
             
             int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
             
@@ -313,49 +291,44 @@ int InlineFlowBox::placeBoxesHorizontally(int x, int& leftPosition, int& rightPo
                 visualOverflowRight = max(visualOverflowRight, shadow->x + shadow->blur + rightGlyphOverflow);
             }
             
-            leftPosition = min(x + visualOverflowLeft, leftPosition);
-            rightPosition = max(x + text->width() + visualOverflowRight, rightPosition);
-            m_maxHorizontalVisualOverflow = max(max(visualOverflowRight, -visualOverflowLeft), m_maxHorizontalVisualOverflow);
-            x += text->width();
+            leftPosition = min(xPos + visualOverflowLeft, leftPosition);
+            rightPosition = max(xPos + text->width() + visualOverflowRight, rightPosition);
+            m_maxHorizontalVisualOverflow = max(max(visualOverflowRight, -visualOverflowLeft), (int)m_maxHorizontalVisualOverflow);
+            xPos += text->width();
         } else {
-            if (curr->object()->isPositioned()) {
-                if (curr->object()->parent()->style()->direction() == LTR)
-                    curr->setXPos(x);
+            if (curr->renderer()->isPositioned()) {
+                if (curr->renderer()->parent()->style()->direction() == LTR)
+                    curr->setX(xPos);
                 else
                     // Our offset that we cache needs to be from the edge of the right border box and
                     // not the left border box.  We have to subtract |x| from the width of the block
                     // (which can be obtained from the root line box).
-                    curr->setXPos(root()->object()->width()-x);
+                    curr->setX(root()->block()->width() - xPos);
                 continue; // The positioned object has no effect on the width.
             }
-            if (curr->object()->isInlineFlow()) {
+            if (curr->renderer()->isRenderInline()) {
                 InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
-                if (curr->object()->isCompact()) {
-                    int ignoredX = x;
-                    flow->placeBoxesHorizontally(ignoredX, leftPosition, rightPosition, needsWordSpacing);
-                } else {
-                    x += flow->marginLeft();
-                    x = flow->placeBoxesHorizontally(x, leftPosition, rightPosition, needsWordSpacing);
-                    x += flow->marginRight();
-                }
-            } else if (!curr->object()->isCompact() && (!curr->object()->isListMarker() || static_cast<RenderListMarker*>(curr->object())->isInside())) {
-                x += curr->object()->marginLeft();
-                curr->setXPos(x);
-                leftPosition = min(x + curr->object()->overflowLeft(false), leftPosition);
-                rightPosition = max(x + curr->object()->overflowWidth(false), rightPosition);
-                x += curr->width() + curr->object()->marginRight();
+                xPos += flow->marginLeft();
+                xPos = flow->placeBoxesHorizontally(xPos, leftPosition, rightPosition, needsWordSpacing);
+                xPos += flow->marginRight();
+            } else if (!curr->renderer()->isListMarker() || static_cast<RenderListMarker*>(curr->renderer())->isInside()) {
+                xPos += curr->boxModelObject()->marginLeft();
+                curr->setX(xPos);
+                leftPosition = min(xPos + toRenderBox(curr->renderer())->overflowLeft(false), leftPosition);
+                rightPosition = max(xPos + toRenderBox(curr->renderer())->overflowWidth(false), rightPosition);
+                xPos += curr->width() + curr->boxModelObject()->marginRight();
             }
         }
     }
 
-    x += borderRight() + paddingRight();
-    setWidth(x - startX);
-    rightPosition = max(xPos() + width() + boxShadowRight, rightPosition);
+    xPos += borderRight() + paddingRight();
+    setWidth(xPos - startX);
+    rightPosition = max(x() + width() + boxShadowRight, rightPosition);
 
-    return x;
+    return xPos;
 }
 
-void InlineFlowBox::verticallyAlignBoxes(int& heightOfBlock)
+int InlineFlowBox::verticallyAlignBoxes(int heightOfBlock)
 {
     int maxPositionTop = 0;
     int maxPositionBottom = 0;
@@ -364,8 +337,8 @@ void InlineFlowBox::verticallyAlignBoxes(int& heightOfBlock)
 
     // Figure out if we're in strict mode.  Note that we can't simply use !style()->htmlHacks(),
     // because that would match almost strict mode as well.
-    RenderObject* curr = object();
-    while (curr && !curr->element())
+    RenderObject* curr = renderer();
+    while (curr && !curr->node())
         curr = curr->container();
     bool strictMode = (curr && curr->document()->inStrictMode());
     
@@ -383,12 +356,10 @@ void InlineFlowBox::verticallyAlignBoxes(int& heightOfBlock)
 
     setVerticalOverflowPositions(topPosition, bottomPosition);
     setVerticalSelectionPositions(selectionTop, selectionBottom);
-
-    // Shrink boxes with no text children in quirks and almost strict mode.
-    if (!strictMode)
-        shrinkBoxesWithNoTextChildren(topPosition, bottomPosition);
     
     heightOfBlock += maxHeight;
+    
+    return heightOfBlock;
 }
 
 void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
@@ -397,16 +368,17 @@ void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         // The computed lineheight needs to be extended for the
         // positioned elements
-        if (curr->object()->isPositioned())
+        if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
-        if (curr->yPos() == PositionTop || curr->yPos() == PositionBottom) {
-            if (curr->yPos() == PositionTop) {
-                if (maxAscent + maxDescent < curr->height())
-                    maxDescent = curr->height() - maxAscent;
+        if (curr->y() == PositionTop || curr->y() == PositionBottom) {
+            int lineHeight = curr->renderer()->lineHeight(m_firstLine);
+            if (curr->y() == PositionTop) {
+                if (maxAscent + maxDescent < lineHeight)
+                    maxDescent = lineHeight - maxAscent;
             }
             else {
-                if (maxAscent + maxDescent < curr->height())
-                    maxAscent = curr->height() - maxDescent;
+                if (maxAscent + maxDescent < lineHeight)
+                    maxAscent = lineHeight - maxDescent;
             }
 
             if (maxAscent + maxDescent >= max(maxPositionTop, maxPositionBottom))
@@ -418,47 +390,86 @@ void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
     }
 }
 
+static int verticalPositionForBox(InlineBox* curr, bool firstLine)
+{
+    if (curr->renderer()->isText())
+        return curr->parent()->y();
+    if (curr->renderer()->isBox())
+        return toRenderBox(curr->renderer())->verticalPosition(firstLine);
+    return toRenderInline(curr->renderer())->verticalPositionFromCache(firstLine);
+}
+
 void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
                                              int& maxAscent, int& maxDescent, bool strictMode)
 {
     if (isRootInlineBox()) {
         // Examine our root box.
-        setHeight(object()->lineHeight(m_firstLine, true));
-        bool isTableCell = object()->isTableCell();
-        if (isTableCell) {
-            RenderTableCell* tableCell = static_cast<RenderTableCell*>(object());
-            setBaseline(tableCell->RenderBlock::baselinePosition(m_firstLine, true));
-        }
-        else
-            setBaseline(object()->baselinePosition(m_firstLine, true));
+        int lineHeight = renderer()->lineHeight(m_firstLine, true);
+        int baseline = renderer()->baselinePosition(m_firstLine, true);
         if (hasTextChildren() || strictMode) {
-            int ascent = baseline();
-            int descent = height() - ascent;
+            int ascent = baseline;
+            int descent = lineHeight - ascent;
             if (maxAscent < ascent)
                 maxAscent = ascent;
             if (maxDescent < descent)
                 maxDescent = descent;
         }
     }
-    
+
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->object()->isPositioned())
+        if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
-        curr->setHeight(curr->object()->lineHeight(m_firstLine));
-        curr->setBaseline(curr->object()->baselinePosition(m_firstLine));
-        curr->setYPos(curr->object()->verticalPositionHint(m_firstLine));
-        if (curr->yPos() == PositionTop) {
-            if (maxPositionTop < curr->height())
-                maxPositionTop = curr->height();
-        }
-        else if (curr->yPos() == PositionBottom) {
-            if (maxPositionBottom < curr->height())
-                maxPositionBottom = curr->height();
+        bool isInlineFlow = curr->isInlineFlowBox();
+
+        int lineHeight;
+        int baseline;
+        Vector<const SimpleFontData*> usedFonts;
+        if (curr->isInlineTextBox())
+            static_cast<InlineTextBox*>(curr)->takeFallbackFonts(usedFonts);
+
+        if (!usedFonts.isEmpty()) {
+            usedFonts.append(curr->renderer()->style(m_firstLine)->font().primaryFont());
+            Length parentLineHeight = curr->renderer()->parent()->style()->lineHeight();
+            if (parentLineHeight.isNegative()) {
+                int baselineToBottom = 0;
+                baseline = 0;
+                for (size_t i = 0; i < usedFonts.size(); ++i) {
+                    int halfLeading = (usedFonts[i]->lineSpacing() - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
+                    baseline = max(baseline, halfLeading + usedFonts[i]->ascent());
+                    baselineToBottom = max(baselineToBottom, usedFonts[i]->lineSpacing() - usedFonts[i]->ascent() - usedFonts[i]->descent() - halfLeading);
+                }
+                lineHeight = baseline + baselineToBottom;
+            } else if (parentLineHeight.isPercent()) {
+                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize());
+                baseline = 0;
+                for (size_t i = 0; i < usedFonts.size(); ++i) {
+                    int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
+                    baseline = max(baseline, halfLeading + usedFonts[i]->ascent());
+                }
+            } else {
+                lineHeight = parentLineHeight.value();
+                baseline = 0;
+                for (size_t i = 0; i < usedFonts.size(); ++i) {
+                    int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
+                    baseline = max(baseline, halfLeading + usedFonts[i]->ascent());
+                }
+            }
+        } else {
+            lineHeight = curr->renderer()->lineHeight(m_firstLine);
+            baseline = curr->renderer()->baselinePosition(m_firstLine);
         }
-        else if (curr->hasTextChildren() || curr->object()->hasHorizontalBordersOrPadding() || strictMode) {
-            int ascent = curr->baseline() - curr->yPos();
-            int descent = curr->height() - ascent;
+
+        curr->setY(verticalPositionForBox(curr, m_firstLine));
+        if (curr->y() == PositionTop) {
+            if (maxPositionTop < lineHeight)
+                maxPositionTop = lineHeight;
+        } else if (curr->y() == PositionBottom) {
+            if (maxPositionBottom < lineHeight)
+                maxPositionBottom = lineHeight;
+        } else if ((!isInlineFlow || static_cast<InlineFlowBox*>(curr)->hasTextChildren()) || curr->boxModelObject()->hasHorizontalBordersOrPadding() || strictMode) {
+            int ascent = baseline - curr->y();
+            int descent = lineHeight - ascent;
             if (maxAscent < ascent)
                 maxAscent = ascent;
             if (maxDescent < descent)
@@ -470,135 +481,112 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
     }
 }
 
-void InlineFlowBox::placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode,
+void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent, bool strictMode,
                                          int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom)
 {
     if (isRootInlineBox())
-        setYPos(y + maxAscent - baseline());// Place our root box.
+        setY(yPos + max(0, maxAscent - renderer()->baselinePosition(m_firstLine, true))); // Place our root box.
     
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->object()->isPositioned())
+        if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
         // Adjust boxes to use their real box y/height and not the logical height (as dictated by
         // line-height).
-        if (curr->isInlineFlowBox())
-            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(y, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
+        bool isInlineFlow = curr->isInlineFlowBox();
+        if (isInlineFlow)
+            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(yPos, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
 
         bool childAffectsTopBottomPos = true;
-        if (curr->yPos() == PositionTop)
-            curr->setYPos(y);
-        else if (curr->yPos() == PositionBottom)
-            curr->setYPos(y + maxHeight - curr->height());
+        if (curr->y() == PositionTop)
+            curr->setY(yPos);
+        else if (curr->y() == PositionBottom)
+            curr->setY(yPos + maxHeight - curr->renderer()->lineHeight(m_firstLine));
         else {
-            if (!curr->hasTextChildren() && !curr->object()->hasHorizontalBordersOrPadding() && !strictMode)
+            if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasHorizontalBordersOrPadding() && !strictMode)
                 childAffectsTopBottomPos = false;
-            curr->setYPos(curr->yPos() + y + maxAscent - curr->baseline());
+            int posAdjust = maxAscent - curr->renderer()->baselinePosition(m_firstLine);
+            if (!childAffectsTopBottomPos)
+                posAdjust = max(0, posAdjust);
+            curr->setY(curr->y() + yPos + posAdjust);
         }
         
-        int newY = curr->yPos();
-        int newHeight = curr->height();
-        int newBaseline = curr->baseline();
+        // FIXME: By only considering overflow as part of the root line box, we can't get an accurate picture regarding what the line
+        // actually needs to paint.  A line box that is part of a self-painting layer technically shouldn't contribute to the overflow
+        // of the line, but in order to not do this and paint accurately, we have to track the overflow somewhere else (either by storing overflow
+        // in each InlineFlowBox up the chain or in the layer itself).  Relative positioned objects on a line will cause scrollbars
+        // to appear when they shouldn't until we fix this issue.
+        int newY = curr->y();
         int overflowTop = 0;
         int overflowBottom = 0;
         if (curr->isText() || curr->isInlineFlowBox()) {
-            const Font& font = curr->object()->style(m_firstLine)->font();
-            newBaseline = font.ascent();
-            newY += curr->baseline() - newBaseline;
-            newHeight = newBaseline + font.descent();
-            for (ShadowData* shadow = curr->object()->style()->textShadow(); shadow; shadow = shadow->next) {
+            const Font& font = curr->renderer()->style(m_firstLine)->font();
+            newY += curr->renderer()->baselinePosition(m_firstLine) - font.ascent();
+            for (ShadowData* shadow = curr->renderer()->style()->textShadow(); shadow; shadow = shadow->next) {
                 overflowTop = min(overflowTop, shadow->y - shadow->blur);
                 overflowBottom = max(overflowBottom, shadow->y + shadow->blur);
             }
 
-            for (ShadowData* boxShadow = curr->object()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
+            for (ShadowData* boxShadow = curr->renderer()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
                 overflowTop = min(overflowTop, boxShadow->y - boxShadow->blur);
                 overflowBottom = max(overflowBottom, boxShadow->y + boxShadow->blur);
             }
 
-            for (ShadowData* textShadow = curr->object()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
+            for (ShadowData* textShadow = curr->renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
                 overflowTop = min(overflowTop, textShadow->y - textShadow->blur);
                 overflowBottom = max(overflowBottom, textShadow->y + textShadow->blur);
             }
 
-            if (curr->object()->hasReflection()) {
-                overflowTop = min(overflowTop, curr->object()->reflectionBox().y());
-                overflowBottom = max(overflowBottom, curr->object()->reflectionBox().bottom());
+            if (curr->renderer()->hasReflection()) {
+                RenderBox* box = toRenderBox(curr->renderer());
+                overflowTop = min(overflowTop, box->reflectionBox().y());
+                overflowBottom = max(overflowBottom, box->reflectionBox().bottom());
             }
 
-            if (curr->isInlineFlowBox()) {
-                newHeight += curr->object()->borderTop() + curr->object()->paddingTop() +
-                            curr->object()->borderBottom() + curr->object()->paddingBottom();
-                newY -= curr->object()->borderTop() + curr->object()->paddingTop();
-                newBaseline += curr->object()->borderTop() + curr->object()->paddingTop();
-            }
-        } else if (!curr->object()->isBR()) {
-            newY += curr->object()->marginTop();
-            newHeight = curr->height() - (curr->object()->marginTop() + curr->object()->marginBottom());
-            overflowTop = curr->object()->overflowTop(false);
-            overflowBottom = curr->object()->overflowHeight(false) - newHeight;
+            if (curr->isInlineFlowBox())
+                newY -= curr->boxModelObject()->borderTop() + curr->boxModelObject()->paddingTop();
+        } else if (!curr->renderer()->isBR()) {
+            RenderBox* box = toRenderBox(curr->renderer());
+            newY += box->marginTop();
+            overflowTop = box->overflowTop(false);
+            overflowBottom = box->overflowHeight(false) - box->height();
         }
 
-        curr->setYPos(newY);
-        curr->setHeight(newHeight);
-        curr->setBaseline(newBaseline);
+        curr->setY(newY);
 
         if (childAffectsTopBottomPos) {
+            int boxHeight = curr->height();
             selectionTop = min(selectionTop, newY);
-            selectionBottom = max(selectionBottom, newY + newHeight);
+            selectionBottom = max(selectionBottom, newY + boxHeight);
             topPosition = min(topPosition, newY + overflowTop);
-            bottomPosition = max(bottomPosition, newY + newHeight + overflowBottom);
+            bottomPosition = max(bottomPosition, newY + boxHeight + overflowBottom);
         }
     }
 
     if (isRootInlineBox()) {
-        const Font& font = object()->style(m_firstLine)->font();
-        setHeight(font.ascent() + font.descent());
-        setYPos(yPos() + baseline() - font.ascent());
-        setBaseline(font.ascent());
+        const Font& font = renderer()->style(m_firstLine)->font();
+        setY(y() + renderer()->baselinePosition(m_firstLine, true) - font.ascent());
         if (hasTextChildren() || strictMode) {
-            selectionTop = min(selectionTop, yPos());
-            selectionBottom = max(selectionBottom, yPos() + height());
+            selectionTop = min(selectionTop, y());
+            selectionBottom = max(selectionBottom, y() + height());
         }
     }
 }
 
-void InlineFlowBox::shrinkBoxesWithNoTextChildren(int topPos, int bottomPos)
-{
-    // First shrink our kids.
-    for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->object()->isPositioned())
-            continue; // Positioned placeholders don't affect calculations.
-        
-        if (curr->isInlineFlowBox())
-            static_cast<InlineFlowBox*>(curr)->shrinkBoxesWithNoTextChildren(topPos, bottomPos);
-    }
-
-    // See if we have text children. If not, then we need to shrink ourselves to fit on the line.
-    if (!hasTextChildren() && !object()->hasHorizontalBordersOrPadding()) {
-        if (yPos() < topPos)
-            setYPos(topPos);
-        if (yPos() + height() > bottomPos)
-            setHeight(bottomPos - yPos());
-        if (baseline() > height())
-            setBaseline(height());
-    }
-}
-
 bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
 {
     // Check children first.
     for (InlineBox* curr = lastChild(); curr; curr = curr->prevOnLine()) {
-        if (!curr->object()->hasLayer() && curr->nodeAtPoint(request, result, x, y, tx, ty)) {
-            object()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
+        if ((curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer()) && curr->nodeAtPoint(request, result, x, y, tx, ty)) {
+            renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
             return true;
         }
     }
 
     // Now check ourselves.
-    IntRect rect(tx + m_x, ty + m_y, m_width, m_height);
+    IntRect rect(tx + m_x, ty + m_y, m_width, height());
     if (visibleToHitTesting() && rect.contains(x, y)) {
-        object()->updateHitTestResult(result, IntPoint(x - tx, y - ty)); // Don't add in m_x or m_y here, we want coords in the containing block's space.
+        renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty)); // Don't add in m_x or m_y here, we want coords in the containing block's space.
         return true;
     }
     
@@ -607,15 +595,15 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 
 void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    int xPos = tx + m_x - object()->maximalOutlineSize(paintInfo.phase);
-    int w = width() + 2 * object()->maximalOutlineSize(paintInfo.phase);
+    int xPos = tx + m_x - renderer()->maximalOutlineSize(paintInfo.phase);
+    int w = width() + 2 * renderer()->maximalOutlineSize(paintInfo.phase);
     int shadowLeft = 0;
     int shadowRight = 0;
-    for (ShadowData* boxShadow = object()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
+    for (ShadowData* boxShadow = renderer()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
         shadowLeft = min(boxShadow->x - boxShadow->blur, shadowLeft);
         shadowRight = max(boxShadow->x + boxShadow->blur, shadowRight);
     }
-    for (ShadowData* textShadow = object()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
+    for (ShadowData* textShadow = renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
         shadowLeft = min(textShadow->x - textShadow->blur, shadowLeft);
         shadowRight = max(textShadow->x + textShadow->blur, shadowRight);
     }
@@ -627,14 +615,15 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         if (paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) {
             // Add ourselves to the paint info struct's list of inlines that need to paint their
             // outlines.
-            if (object()->style()->visibility() == VISIBLE && object()->hasOutline() && !isRootInlineBox()) {
-                if ((object()->continuation() || object()->isInlineContinuation()) && !object()->hasLayer()) {
+            if (renderer()->style()->visibility() == VISIBLE && renderer()->hasOutline() && !isRootInlineBox()) {
+                RenderInline* inlineFlow = toRenderInline(renderer());
+                if ((inlineFlow->continuation() || inlineFlow->isInlineContinuation()) && !boxModelObject()->hasSelfPaintingLayer()) {
                     // Add ourselves to the containing block of the entire continuation so that it can
                     // paint us atomically.
-                    RenderBlock* block = object()->containingBlock()->containingBlock();
-                    block->addContinuationWithOutline(static_cast<RenderFlow*>(object()->element()->renderer()));
-                } else if (!object()->isInlineContinuation())
-                    paintInfo.outlineObjects->add(flowObject());
+                    RenderBlock* block = renderer()->containingBlock()->containingBlock();
+                    block->addContinuationWithOutline(toRenderInline(renderer()->node()->renderer()));
+                } else if (!inlineFlow->isInlineContinuation())
+                    paintInfo.outlineObjects->add(inlineFlow);
             }
         } else if (paintInfo.phase == PaintPhaseMask) {
             paintMask(paintInfo, tx, ty);
@@ -654,12 +643,12 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     PaintPhase paintPhase = paintInfo.phase == PaintPhaseChildOutlines ? PaintPhaseOutline : paintInfo.phase;
     RenderObject::PaintInfo childInfo(paintInfo);
     childInfo.phase = paintPhase;
-    childInfo.paintingRoot = object()->paintingRootForChildren(paintInfo);
+    childInfo.paintingRoot = renderer()->paintingRootForChildren(paintInfo);
     
     // 3. Paint our children.
     if (paintPhase != PaintPhaseSelfOutline) {
         for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-            if (!curr->object()->hasLayer())
+            if (curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer())
                 curr->paint(childInfo, tx, ty);
         }
     }
@@ -682,9 +671,9 @@ void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, con
                                    int my, int mh, int tx, int ty, int w, int h, CompositeOperator op)
 {
     StyleImage* img = fillLayer->image();
-    bool hasFillImage = img && img->canRender(object()->style()->effectiveZoom());
-    if ((!hasFillImage && !object()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent())
-        object()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, tx, ty, w, h, this, op);
+    bool hasFillImage = img && img->canRender(renderer()->style()->effectiveZoom());
+    if ((!hasFillImage && !renderer()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent())
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, tx, ty, w, h, this, op);
     else {
         // We have a fill image that spans multiple lines.
         // We need to adjust _tx and _ty by the width of all previous lines.
@@ -703,7 +692,7 @@ void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, con
             totalWidth += curr->width();
         paintInfo.context->save();
         paintInfo.context->clip(IntRect(tx, ty, width(), height()));
-        object()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, startX, ty, totalWidth, h, this, op);
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, startX, ty, totalWidth, h, this, op);
         paintInfo.context->restore();
     }
 }
@@ -711,17 +700,17 @@ void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, con
 void InlineFlowBox::paintBoxShadow(GraphicsContext* context, RenderStyle* s, int tx, int ty, int w, int h)
 {
     if ((!prevLineBox() && !nextLineBox()) || !parent())
-        object()->paintBoxShadow(context, tx, ty, w, h, s);
+        boxModelObject()->paintBoxShadow(context, tx, ty, w, h, s);
     else {
         // FIXME: We can do better here in the multi-line case. We want to push a clip so that the shadow doesn't
         // protrude incorrectly at the edges, and we want to possibly include shadows cast from the previous/following lines
-        object()->paintBoxShadow(context, tx, ty, w, h, s, includeLeftEdge(), includeRightEdge());
+        boxModelObject()->paintBoxShadow(context, tx, ty, w, h, s, includeLeftEdge(), includeRightEdge());
     }
 }
 
 void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!object()->shouldPaintWithinRoot(paintInfo) || object()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
+    if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
         return;
 
     // Move x/y to our coordinates.
@@ -742,8 +731,8 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
     
     // You can use p::first-line to specify a background. If so, the root line boxes for
     // a line may actually have to paint a background.
-    RenderStyle* styleToUse = object()->style(m_firstLine);
-    if ((!parent() && m_firstLine && styleToUse != object()->style()) || (parent() && object()->hasBoxDecorations())) {
+    RenderStyle* styleToUse = renderer()->style(m_firstLine);
+    if ((!parent() && m_firstLine && styleToUse != renderer()->style()) || (parent() && renderer()->hasBoxDecorations())) {
         // Shadow comes first and is behind the background and border.
         if (styleToUse->boxShadow())
             paintBoxShadow(context, styleToUse, tx, ty, w, h);
@@ -753,8 +742,8 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
 
         // :first-line cannot be used to put borders on a line. Always paint borders with our
         // non-first-line style.
-        if (parent() && object()->style()->hasBorder()) {
-            StyleImage* borderImage = object()->style()->borderImage().image();
+        if (parent() && renderer()->style()->hasBorder()) {
+            StyleImage* borderImage = renderer()->style()->borderImage().image();
             bool hasBorderImage = borderImage && borderImage->canRender(styleToUse->effectiveZoom());
             if (hasBorderImage && !borderImage->isLoaded())
                 return; // Don't paint anything while we wait for the image to load.
@@ -762,7 +751,7 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
             // The simple case is where we either have no border image or we are the only box for this object.  In those
             // cases only a single call to draw is required.
             if (!hasBorderImage || (!prevLineBox() && !nextLineBox()))
-                object()->paintBorder(context, tx, ty, w, h, object()->style(), includeLeftEdge(), includeRightEdge());
+                boxModelObject()->paintBorder(context, tx, ty, w, h, renderer()->style(), includeLeftEdge(), includeRightEdge());
             else {
                 // We have a border image that spans multiple lines.
                 // We need to adjust _tx and _ty by the width of all previous lines.
@@ -780,8 +769,8 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
                 for (InlineRunBox* curr = this; curr; curr = curr->nextLineBox())
                     totalWidth += curr->width();
                 context->save();
-                context->clip(IntRect(tx, ty, width(), height()));
-                object()->paintBorder(context, startX, ty, totalWidth, h, object()->style());
+                context->clip(IntRect(tx, ty, w, h));
+                boxModelObject()->paintBorder(context, startX, ty, totalWidth, h, renderer()->style());
                 context->restore();
             }
         }
@@ -790,7 +779,7 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
 
 void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!object()->shouldPaintWithinRoot(paintInfo) || object()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
+    if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
         return;
 
     // Move x/y to our coordinates.
@@ -810,9 +799,9 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
-    const NinePieceImage& maskNinePieceImage = object()->style()->maskBoxImage();
-    StyleImage* maskBoxImage = object()->style()->maskBoxImage().image();
-    if ((maskBoxImage && object()->style()->maskLayers()->hasImage()) || object()->style()->maskLayers()->next())
+    const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
+    StyleImage* maskBoxImage = renderer()->style()->maskBoxImage().image();
+    if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
         pushTransparencyLayer = true;
     
     CompositeOperator compositeOp = CompositeDestinationIn;
@@ -822,16 +811,16 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
         compositeOp = CompositeSourceOver;
     }
 
-    paintFillLayers(paintInfo, Color(), object()->style()->maskLayers(), my, mh, tx, ty, w, h, compositeOp);
+    paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), my, mh, tx, ty, w, h, compositeOp);
     
-    bool hasBoxImage = maskBoxImage && maskBoxImage->canRender(object()->style()->effectiveZoom());
+    bool hasBoxImage = maskBoxImage && maskBoxImage->canRender(renderer()->style()->effectiveZoom());
     if (!hasBoxImage || !maskBoxImage->isLoaded())
         return; // Don't paint anything while we wait for the image to load.
 
     // The simple case is where we are the only box for this object.  In those
     // cases only a single call to draw is required.
     if (!prevLineBox() && !nextLineBox()) {
-        object()->paintNinePieceImage(paintInfo.context, tx, ty, w, h, object()->style(), maskNinePieceImage, compositeOp);
+        boxModelObject()->paintNinePieceImage(paintInfo.context, tx, ty, w, h, renderer()->style(), maskNinePieceImage, compositeOp);
     } else {
         // We have a mask image that spans multiple lines.
         // We need to adjust _tx and _ty by the width of all previous lines.
@@ -843,8 +832,8 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
         for (InlineRunBox* curr = this; curr; curr = curr->nextLineBox())
             totalWidth += curr->width();
         paintInfo.context->save();
-        paintInfo.context->clip(IntRect(tx, ty, width(), height()));
-        object()->paintNinePieceImage(paintInfo.context, startX, ty, totalWidth, h, object()->style(), maskNinePieceImage, compositeOp);
+        paintInfo.context->clip(IntRect(tx, ty, w, h));
+        boxModelObject()->paintNinePieceImage(paintInfo.context, startX, ty, totalWidth, h, renderer()->style(), maskNinePieceImage, compositeOp);
         paintInfo.context->restore();
     }
     
@@ -855,12 +844,12 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
 static bool shouldDrawTextDecoration(RenderObject* obj)
 {
     for (RenderObject* curr = obj->firstChild(); curr; curr = curr->nextSibling()) {
-        if (curr->isInlineFlow())
+        if (curr->isRenderInline())
             return true;
         if (curr->isText() && !curr->isBR()) {
             if (!curr->style()->collapseWhiteSpace())
                 return true;
-            Node* currElement = curr->element();
+            Node* currElement = curr->node();
             if (!currElement)
                 return true;
             if (!currElement->isTextNode())
@@ -876,8 +865,8 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
 {
     // Paint text decorations like underlines/overlines. We only do this if we aren't in quirks mode (i.e., in
     // almost-strict mode or strict mode).
-    if (object()->style()->htmlHacks() || !object()->shouldPaintWithinRoot(paintInfo) ||
-        object()->style()->visibility() != VISIBLE)
+    if (renderer()->style()->htmlHacks() || !renderer()->shouldPaintWithinRoot(paintInfo) ||
+        renderer()->style()->visibility() != VISIBLE)
         return;
     
     // We don't want underlines or other decorations when we're trying to draw nothing but the selection as white text.
@@ -887,27 +876,46 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
     GraphicsContext* context = paintInfo.context;
     tx += m_x;
     ty += m_y;
-    RenderStyle* styleToUse = object()->style(m_firstLine);
+    RenderStyle* styleToUse = renderer()->style(m_firstLine);
     int deco = parent() ? styleToUse->textDecoration() : styleToUse->textDecorationsInEffect();
     if (deco != TDNONE && 
         ((!paintedChildren && ((deco & UNDERLINE) || (deco & OVERLINE))) || (paintedChildren && (deco & LINE_THROUGH))) &&
-        shouldDrawTextDecoration(object())) {
+        shouldDrawTextDecoration(renderer())) {
         int x = m_x + borderLeft() + paddingLeft();
         int w = m_width - (borderLeft() + paddingLeft() + borderRight() + paddingRight());
         RootInlineBox* rootLine = root();
         if (rootLine->ellipsisBox()) {
-            int ellipsisX = rootLine->ellipsisBox()->xPos();
+            int ellipsisX = m_x + rootLine->ellipsisBox()->x();
             int ellipsisWidth = rootLine->ellipsisBox()->width();
-            
-            // FIXME: Will need to work with RTL
+            bool ltr = renderer()->style()->direction() == LTR;
             if (rootLine == this) {
-                if (x + w >= ellipsisX + ellipsisWidth)
-                    w -= (x + w - ellipsisX - ellipsisWidth);
+                // Trim w and x so that the underline isn't drawn underneath the ellipsis.
+                // ltr: is our right edge farther right than the right edge of the ellipsis.
+                // rtl: is the left edge of our box farther left than the left edge of the ellipsis.
+                bool ltrTruncation = ltr && (x + w >= ellipsisX + ellipsisWidth);
+                bool rtlTruncation = !ltr && (x <= ellipsisX + ellipsisWidth);
+                if (ltrTruncation)
+                    w -= (x + w) - (ellipsisX + ellipsisWidth);
+                else if (rtlTruncation) {
+                    int dx = m_x - ((ellipsisX - m_x) + ellipsisWidth);
+                    tx -= dx;
+                    w += dx;
+                }
             } else {
-                if (x >= ellipsisX)
+                bool ltrPastEllipsis = ltr && x >= ellipsisX;
+                bool rtlPastEllipsis = !ltr && (x + w) <= (ellipsisX + ellipsisWidth);
+                if (ltrPastEllipsis || rtlPastEllipsis)
                     return;
-                if (x + w >= ellipsisX)
+
+                bool ltrTruncation = ltr && x + w >= ellipsisX;
+                bool rtlTruncation = !ltr && x <= ellipsisX;
+                if (ltrTruncation)
                     w -= (x + w - ellipsisX);
+                else if (rtlTruncation) {
+                    int dx = m_x - ((ellipsisX - m_x) + ellipsisWidth);
+                    tx -= dx;
+                    w += dx;
+                }
             }
         }
 
@@ -917,9 +925,9 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
         Color underline, overline, linethrough;
         underline = overline = linethrough = styleToUse->color();
         if (!parent())
-            object()->getTextDecorationColors(deco, underline, overline, linethrough);
+            renderer()->getTextDecorationColors(deco, underline, overline, linethrough);
 
-        bool isPrinting = object()->document()->printing();
+        bool isPrinting = renderer()->document()->printing();
         context->setStrokeThickness(1.0f); // FIXME: We should improve this rule and not always just assume 1.
 
         bool paintUnderline = deco & UNDERLINE && !paintedChildren;
@@ -928,13 +936,17 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
 
         bool linesAreOpaque = !isPrinting && (!paintUnderline || underline.alpha() == 255) && (!paintOverline || overline.alpha() == 255) && (!paintLineThrough || linethrough.alpha() == 255);
 
+        int baselinePos = renderer()->style(m_firstLine)->font().ascent();
+        if (!isRootInlineBox())
+            baselinePos += borderTop() + paddingTop();
+
         bool setClip = false;
         int extraOffset = 0;
         ShadowData* shadow = styleToUse->textShadow();
         if (!linesAreOpaque && shadow && shadow->next) {
-            IntRect clipRect(tx, ty, w, m_baseline + 2);
+            IntRect clipRect(tx, ty, w, baselinePos + 2);
             for (ShadowData* s = shadow; s; s = s->next) {
-                IntRect shadowRect(tx, ty, w, m_baseline + 2);
+                IntRect shadowRect(tx, ty, w, baselinePos + 2);
                 shadowRect.inflate(s->blur);
                 shadowRect.move(s->x, s->y);
                 clipRect.unite(shadowRect);
@@ -942,7 +954,7 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
             }
             context->save();
             context->clip(clipRect);
-            extraOffset += m_baseline + 2;
+            extraOffset += baselinePos + 2;
             ty += extraOffset;
             setClip = true;
         }
@@ -962,16 +974,19 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
 
             if (paintUnderline) {
                 context->setStrokeColor(underline);
+                context->setStrokeStyle(SolidStroke);
                 // Leave one pixel of white between the baseline and the underline.
-                context->drawLineForText(IntPoint(tx, ty + m_baseline + 1), w, isPrinting);
+                context->drawLineForText(IntPoint(tx, ty + baselinePos + 1), w, isPrinting);
             }
             if (paintOverline) {
                 context->setStrokeColor(overline);
+                context->setStrokeStyle(SolidStroke);
                 context->drawLineForText(IntPoint(tx, ty), w, isPrinting);
             }
             if (paintLineThrough) {
                 context->setStrokeColor(linethrough);
-                context->drawLineForText(IntPoint(tx, ty + 2 * m_baseline / 3), w, isPrinting);
+                context->setStrokeStyle(SolidStroke);
+                context->drawLineForText(IntPoint(tx, ty + 2 * baselinePos / 3), w, isPrinting);
             }
         } while (shadow);
 
@@ -1026,13 +1041,32 @@ bool InlineFlowBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsis
     return true;
 }
 
-int InlineFlowBox::placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox)
+int InlineFlowBox::placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool& foundBox)
 {
     int result = -1;
-    for (InlineBox *box = firstChild(); box; box = box->nextOnLine()) {
-        int currResult = box->placeEllipsisBox(ltr, blockEdge, ellipsisWidth, foundBox);
+    // We iterate over all children, the foundBox variable tells us when we've found the
+    // box containing the ellipsis.  All boxes after that one in the flow are hidden.
+    // If our flow is ltr then iterate over the boxes from left to right, otherwise iterate
+    // from right to left. Varying the order allows us to correctly hide the boxes following the ellipsis.
+    InlineBox *box = ltr ? firstChild() : lastChild();
+
+    // NOTE: these will cross after foundBox = true.
+    int visibleLeftEdge = blockLeftEdge;
+    int visibleRightEdge = blockRightEdge;
+
+    while(box) {
+        int currResult = box->placeEllipsisBox(ltr, visibleLeftEdge, visibleRightEdge, ellipsisWidth, foundBox);
         if (currResult != -1 && result == -1)
             result = currResult;
+
+        if (ltr) {
+            visibleLeftEdge += box->width();
+            box = box->nextOnLine();
+        }
+        else {
+            visibleRightEdge -= box->width();
+            box = box->prevOnLine();
+        }
     }
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
index 30dad38914..2462eba6e4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
@@ -25,9 +25,9 @@
 
 namespace WebCore {
 
+class HitTestRequest;
 class HitTestResult;
-
-struct HitTestRequest;
+class RenderLineBoxList;
 
 class InlineFlowBox : public InlineRunBox {
 public:
@@ -36,6 +36,9 @@ public:
         , m_firstChild(0)
         , m_lastChild(0)
         , m_maxHorizontalVisualOverflow(0)
+        , m_includeLeftEdge(false)
+        , m_includeRightEdge(false)
+        , m_hasTextChildren(true)
 #ifndef NDEBUG
         , m_hasBadChildList(false)
 #endif
@@ -52,10 +55,6 @@ public:
     virtual ~InlineFlowBox();
 #endif
 
-    RenderFlow* flowObject();
-
-    virtual bool isInlineFlowBox() { return true; }
-
     InlineFlowBox* prevFlowBox() const { return static_cast<InlineFlowBox*>(m_prevLine); }
     InlineFlowBox* nextFlowBox() const { return static_cast<InlineFlowBox*>(m_nextLine); }
 
@@ -80,6 +79,10 @@ public:
     virtual void attachLine();
     virtual void adjustPosition(int dx, int dy);
 
+    virtual void extractLineBoxFromRenderObject();
+    virtual void attachLineBoxToRenderObject();
+    virtual void removeLineBoxFromRenderObject();
+
     virtual void clearTruncation();
 
     virtual void paintBoxDecorations(RenderObject::PaintInfo&, int tx, int ty);
@@ -93,17 +96,23 @@ public:
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
 
-    int marginBorderPaddingLeft();
-    int marginBorderPaddingRight();
-    int marginLeft();
-    int marginRight();
-    int borderLeft() { if (includeLeftEdge()) return object()->borderLeft(); return 0; }
-    int borderRight() { if (includeRightEdge()) return object()->borderRight(); return 0; }
-    int paddingLeft() { if (includeLeftEdge()) return object()->paddingLeft(); return 0; }
-    int paddingRight() { if (includeRightEdge()) return object()->paddingRight(); return 0; }
-
-    bool includeLeftEdge() { return m_includeLeftEdge; }
-    bool includeRightEdge() { return m_includeRightEdge; }
+    virtual RenderLineBoxList* rendererLineBoxes() const;
+
+    int marginBorderPaddingLeft() const { return marginLeft() + borderLeft() + paddingLeft(); }
+    int marginBorderPaddingRight() const { return marginRight() + borderRight() + paddingRight(); }
+    int marginLeft() const { if (includeLeftEdge()) return boxModelObject()->marginLeft(); return 0; }
+    int marginRight() const { if (includeRightEdge()) return boxModelObject()->marginRight(); return 0; }
+    int borderLeft() const { if (includeLeftEdge()) return renderer()->style()->borderLeftWidth(); return 0; }
+    int borderRight() const { if (includeRightEdge()) return renderer()->style()->borderRightWidth(); return 0; }
+    int borderTop() const { return renderer()->style()->borderTopWidth(); }
+    int borderBottom() const { return renderer()->style()->borderBottomWidth(); }
+    int paddingLeft() const { if (includeLeftEdge()) return boxModelObject()->paddingLeft(); return 0; }
+    int paddingRight() const { if (includeRightEdge()) return boxModelObject()->paddingRight(); return 0; }
+    int paddingTop() const { return boxModelObject()->paddingTop(); }
+    int paddingBottom() const { return boxModelObject()->paddingBottom(); }
+
+    bool includeLeftEdge() const { return m_includeLeftEdge; }
+    bool includeRightEdge() const { return m_includeRightEdge; }
     void setEdges(bool includeLeft, bool includeRight)
     {
         m_includeLeftEdge = includeLeft;
@@ -115,33 +124,40 @@ public:
     int getFlowSpacingWidth();
     bool onEndChain(RenderObject* endObject);
     virtual int placeBoxesHorizontally(int x, int& leftPosition, int& rightPosition, bool& needsWordSpacing);
-    virtual void verticallyAlignBoxes(int& heightOfBlock);
+    virtual int verticallyAlignBoxes(int heightOfBlock);
     void computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool strictMode);
     void adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                    int maxPositionTop, int maxPositionBottom);
     void placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode,
                               int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom);
-    void shrinkBoxesWithNoTextChildren(int topPosition, int bottomPosition);
     
     virtual void setVerticalOverflowPositions(int /*top*/, int /*bottom*/) { }
     virtual void setVerticalSelectionPositions(int /*top*/, int /*bottom*/) { }
-    int maxHorizontalVisualOverflow() const { return m_maxHorizontalVisualOverflow; }
+    short maxHorizontalVisualOverflow() const { return m_maxHorizontalVisualOverflow; }
 
     void removeChild(InlineBox* child);
 
     virtual RenderObject::SelectionState selectionState();
 
     virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth);
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool&);
+    virtual int placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool&);
+
+    bool hasTextChildren() const { return m_hasTextChildren; }
 
     void checkConsistency() const;
     void setHasBadChildList();
 
 private:
+    virtual bool isInlineFlowBox() const { return true; }
+
     InlineBox* m_firstChild;
     InlineBox* m_lastChild;
-    int m_maxHorizontalVisualOverflow;
+    short m_maxHorizontalVisualOverflow;
+    
+    bool m_includeLeftEdge : 1;
+    bool m_includeRightEdge : 1;
+    bool m_hasTextChildren : 1;
 
 #ifndef NDEBUG
     bool m_hasBadChildList;
@@ -165,7 +181,7 @@ inline void InlineFlowBox::setHasBadChildList()
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
-void showTree(const WebCore::InlineBox*);
+void showTree(const WebCore::InlineFlowBox*);
 #endif
 
 #endif // InlineFlowBox_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
index a5857e078f..418be15b7b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
@@ -60,10 +60,10 @@ bool InlineTextBox::isSelected(int startPos, int endPos) const
 
 RenderObject::SelectionState InlineTextBox::selectionState()
 {
-    RenderObject::SelectionState state = object()->selectionState();
+    RenderObject::SelectionState state = renderer()->selectionState();
     if (state == RenderObject::SelectionStart || state == RenderObject::SelectionEnd || state == RenderObject::SelectionBoth) {
         int startPos, endPos;
-        object()->selectionStartEnd(startPos, endPos);
+        renderer()->selectionStartEnd(startPos, endPos);
         // The position after a hard line break is considered to be past its end.
         int lastSelectable = start() + len() - (isLineBreak() ? 1 : 0);
 
@@ -92,7 +92,7 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
     if (sPos >= ePos)
         return IntRect();
 
-    RenderText* textObj = textObject();
+    RenderText* textObj = textRenderer();
     int selTop = selectionTop();
     int selHeight = selectionHeight();
     const Font& f = textObj->style(m_firstLine)->font();
@@ -108,7 +108,7 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
 
 void InlineTextBox::deleteLine(RenderArena* arena)
 {
-    static_cast<RenderText*>(m_object)->removeTextBox(this);
+    toRenderText(renderer())->removeTextBox(this);
     destroy(arena);
 }
 
@@ -117,7 +117,7 @@ void InlineTextBox::extractLine()
     if (m_extracted)
         return;
 
-    static_cast<RenderText*>(m_object)->extractTextBox(this);
+    toRenderText(renderer())->extractTextBox(this);
 }
 
 void InlineTextBox::attachLine()
@@ -125,48 +125,70 @@ void InlineTextBox::attachLine()
     if (!m_extracted)
         return;
     
-    static_cast<RenderText*>(m_object)->attachTextBox(this);
+    toRenderText(renderer())->attachTextBox(this);
 }
 
-int InlineTextBox::placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox)
+int InlineTextBox::placeEllipsisBox(bool flowIsLTR, int visibleLeftEdge, int visibleRightEdge, int ellipsisWidth, bool& foundBox)
 {
     if (foundBox) {
         m_truncation = cFullTruncation;
         return -1;
     }
 
-    int ellipsisX = ltr ? blockEdge - ellipsisWidth : blockEdge + ellipsisWidth;
+    // For LTR this is the left edge of the box, for RTL, the right edge in parent coordinates.
+    int ellipsisX = flowIsLTR ? visibleRightEdge - ellipsisWidth : visibleLeftEdge + ellipsisWidth;
     
-    // For LTR, if the left edge of the ellipsis is to the left of our text run, then we are the run that will get truncated.
-    if (ltr) {
-        if (ellipsisX <= m_x) {
-            // Too far.  Just set full truncation, but return -1 and let the ellipsis just be placed at the edge of the box.
+    // Criteria for full truncation:
+    // LTR: the left edge of the ellipsis is to the left of our text run.
+    // RTL: the right edge of the ellipsis is to the right of our text run.
+    bool ltrFullTruncation = flowIsLTR && ellipsisX <= m_x;
+    bool rtlFullTruncation = !flowIsLTR && ellipsisX >= (m_x + m_width);
+    if (ltrFullTruncation || rtlFullTruncation) {
+        // Too far.  Just set full truncation, but return -1 and let the ellipsis just be placed at the edge of the box.
+        m_truncation = cFullTruncation;
+        foundBox = true;
+        return -1;
+    }
+
+    bool ltrEllipsisWithinBox = flowIsLTR && (ellipsisX < m_x + m_width);
+    bool rtlEllipsisWithinBox = !flowIsLTR && (ellipsisX > m_x);
+    if (ltrEllipsisWithinBox || rtlEllipsisWithinBox) {
+        foundBox = true;
+
+        // The inline box may have different directionality than it's parent.  Since truncation
+        // behavior depends both on both the parent and the inline block's directionality, we
+        // must keep track of these separately.
+        bool ltr = direction() == LTR;
+        if (ltr != flowIsLTR) {
+          // Width in pixels of the visible portion of the box, excluding the ellipsis.
+          int visibleBoxWidth = visibleRightEdge - visibleLeftEdge  - ellipsisWidth;
+          ellipsisX = ltr ? m_x + visibleBoxWidth : m_x + m_width - visibleBoxWidth;
+        }
+
+        int offset = offsetForPosition(ellipsisX, false);
+        if (offset == 0) {
+            // No characters should be rendered.  Set ourselves to full truncation and place the ellipsis at the min of our start
+            // and the ellipsis edge.
             m_truncation = cFullTruncation;
-            foundBox = true;
-            return -1;
+            return min(ellipsisX, m_x);
         }
 
-        if (ellipsisX < m_x + m_width) {
-            if (direction() == RTL)
-                return -1; // FIXME: Support LTR truncation when the last run is RTL someday.
+        // Set the truncation index on the text run.
+        m_truncation = offset;
 
-            foundBox = true;
+        // If we got here that means that we were only partially truncated and we need to return the pixel offset at which
+        // to place the ellipsis.
+        int widthOfVisibleText = toRenderText(renderer())->width(m_start, offset, textPos(), m_firstLine);
 
-            int offset = offsetForPosition(ellipsisX, false);
-            if (offset == 0) {
-                // No characters should be rendered.  Set ourselves to full truncation and place the ellipsis at the min of our start
-                // and the ellipsis edge.
-                m_truncation = cFullTruncation;
-                return min(ellipsisX, m_x);
-            }
-            
-            // Set the truncation index on the text run.  The ellipsis needs to be placed just after the last visible character.
-            m_truncation = offset;
-            return m_x + static_cast<RenderText*>(m_object)->width(m_start, offset, textPos(), m_firstLine);
-        }
-    }
-    else {
-        // FIXME: Support RTL truncation someday, including both modes (when the leftmost run on the line is either RTL or LTR)
+        // The ellipsis needs to be placed just after the last visible character.
+        // Where "after" is defined by the flow directionality, not the inline
+        // box directionality.
+        // e.g. In the case of an LTR inline box truncated in an RTL flow then we can
+        // have a situation such as |Hello| -> |...He|
+        if (flowIsLTR)
+            return m_x + widthOfVisibleText;
+        else
+            return (m_x + m_width) - widthOfVisibleText - ellipsisWidth;
     }
     return -1;
 }
@@ -216,7 +238,7 @@ void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, con
 
 bool InlineTextBox::isLineBreak() const
 {
-    return object()->isBR() || (object()->style()->preserveNewline() && len() == 1 && (*textObject()->text())[start()] == '\n');
+    return renderer()->isBR() || (renderer()->style()->preserveNewline() && len() == 1 && (*textRenderer()->text())[start()] == '\n');
 }
 
 bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, int x, int y, int tx, int ty)
@@ -224,15 +246,15 @@ bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, in
     if (isLineBreak())
         return false;
 
-    IntRect rect(tx + m_x, ty + m_y, m_width, m_height);
+    IntRect rect(tx + m_x, ty + m_y, m_width, height());
     if (m_truncation != cFullTruncation && visibleToHitTesting() && rect.contains(x, y)) {
-        object()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
+        renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
         return true;
     }
     return false;
 }
 
-static void paintTextWithShadows(GraphicsContext* context, const TextRun& textRun, int startOffset, int endOffset, const IntPoint& textOrigin, int x, int y, int w, int h, ShadowData* shadow, bool stroked)
+static void paintTextWithShadows(GraphicsContext* context, const Font& font, const TextRun& textRun, int startOffset, int endOffset, const IntPoint& textOrigin, int x, int y, int w, int h, ShadowData* shadow, bool stroked)
 {
     do {
         IntSize extraOffset;
@@ -256,12 +278,12 @@ static void paintTextWithShadows(GraphicsContext* context, const TextRun& textRu
         }
 
         if (startOffset <= endOffset)
-            context->drawText(textRun, textOrigin + extraOffset, startOffset, endOffset);
+            context->drawText(font, textRun, textOrigin + extraOffset, startOffset, endOffset);
         else {
             if (endOffset > 0)
-                context->drawText(textRun, textOrigin + extraOffset,  0, endOffset);
+                context->drawText(font, textRun, textOrigin + extraOffset,  0, endOffset);
             if (startOffset < textRun.length())
-                context->drawText(textRun, textOrigin + extraOffset, startOffset);
+                context->drawText(font, textRun, textOrigin + extraOffset, startOffset);
         }
 
         if (!shadow)
@@ -278,10 +300,10 @@ static void paintTextWithShadows(GraphicsContext* context, const TextRun& textRu
 
 void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    if (isLineBreak() || !object()->shouldPaintWithinRoot(paintInfo) || object()->style()->visibility() != VISIBLE ||
+    if (isLineBreak() || !renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE ||
         m_truncation == cFullTruncation || paintInfo.phase == PaintPhaseOutline)
         return;
-    
+
     ASSERT(paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines);
 
     int xPos = tx + m_x - parent()->maxHorizontalVisualOverflow();
@@ -289,7 +311,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     if (xPos >= paintInfo.rect.right() || xPos + w <= paintInfo.rect.x())
         return;
 
-    bool isPrinting = textObject()->document()->printing();
+    bool isPrinting = textRenderer()->document()->printing();
     
     // Determine whether or not we're selected.
     bool haveSelection = !isPrinting && paintInfo.phase != PaintPhaseTextClip && selectionState() != RenderObject::SelectionNone;
@@ -297,18 +319,34 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         // When only painting the selection, don't bother to paint if there is none.
         return;
 
+    if (m_truncation != cNoTruncation) {
+        TextDirection flowDirection = renderer()->containingBlock()->style()->direction();
+        if (flowDirection != direction()) {
+            // Make the visible fragment of text hug the edge closest to the rest of the run by moving the origin
+            // at which we start drawing text.
+            // e.g. In the case of LTR text truncated in an RTL Context, the correct behavior is:
+            // |Hello|CBA| -> |...He|CBA|
+            // In order to draw the fragment "He" aligned to the right edge of it's box, we need to start drawing
+            // farther to the right.
+            // NOTE: WebKit's behavior differs from that of IE which appears to just overlay the ellipsis on top of the
+            // truncated string i.e.  |Hello|CBA| -> |...lo|CBA|
+            int widthOfVisibleText = toRenderText(renderer())->width(m_start, m_truncation, textPos(), m_firstLine);
+            int widthOfHiddenText = m_width - widthOfVisibleText;
+            // FIXME: The hit testing logic also needs to take this translation int account.
+            tx += direction() == LTR ? widthOfHiddenText : -widthOfHiddenText;
+        }
+    }
+
     GraphicsContext* context = paintInfo.context;
 
     // Determine whether or not we have composition underlines to draw.
-    bool containsComposition = object()->document()->frame()->editor()->compositionNode() == object()->node();
-    bool useCustomUnderlines = containsComposition && object()->document()->frame()->editor()->compositionUsesCustomUnderlines();
+    bool containsComposition = renderer()->node() && renderer()->document()->frame()->editor()->compositionNode() == renderer()->node();
+    bool useCustomUnderlines = containsComposition && renderer()->document()->frame()->editor()->compositionUsesCustomUnderlines();
 
     // Set our font.
-    RenderStyle* styleToUse = object()->style(m_firstLine);
+    RenderStyle* styleToUse = renderer()->style(m_firstLine);
     int d = styleToUse->textDecorationsInEffect();
-    const Font* font = &styleToUse->font();
-    if (*font != context->font())
-        context->setFont(*font);
+    const Font& font = styleToUse->font();
 
     // 1. Paint backgrounds behind text if needed. Examples of such backgrounds include selection
     // and composition underlines.
@@ -321,8 +359,8 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 
         if (containsComposition && !useCustomUnderlines)
             paintCompositionBackground(context, tx, ty, styleToUse, font,
-                object()->document()->frame()->editor()->compositionStart(),
-                object()->document()->frame()->editor()->compositionEnd());
+                renderer()->document()->frame()->editor()->compositionStart(),
+                renderer()->document()->frame()->editor()->compositionEnd());
 
         paintDocumentMarkers(context, tx, ty, styleToUse, font, true);
 
@@ -369,14 +407,14 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     ShadowData* selectionShadow = textShadow;
     if (haveSelection) {
         // Check foreground color first.
-        Color foreground = paintInfo.forceBlackText ? Color::black : object()->selectionForegroundColor();
+        Color foreground = paintInfo.forceBlackText ? Color::black : renderer()->selectionForegroundColor();
         if (foreground.isValid() && foreground != selectionFillColor) {
             if (!paintSelectedTextOnly)
                 paintSelectedTextSeparately = true;
             selectionFillColor = foreground;
         }
 
-        if (RenderStyle* pseudoStyle = object()->getCachedPseudoStyle(RenderStyle::SELECTION)) {
+        if (RenderStyle* pseudoStyle = renderer()->getCachedPseudoStyle(SELECTION)) {
             ShadowData* shadow = paintInfo.forceBlackText ? 0 : pseudoStyle->textShadow();
             if (shadow != selectionShadow) {
                 if (!paintSelectedTextOnly)
@@ -402,8 +440,9 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         }
     }
 
-    IntPoint textOrigin(m_x + tx, m_y + ty + m_baseline);
-    TextRun textRun(textObject()->text()->characters() + m_start, m_len, textObject()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || styleToUse->visuallyOrdered());
+    int baseline = renderer()->style(m_firstLine)->font().ascent();
+    IntPoint textOrigin(m_x + tx, m_y + ty + baseline);
+    TextRun textRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || styleToUse->visuallyOrdered());
 
     int sPos = 0;
     int ePos = 0;
@@ -419,9 +458,9 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth);
         if (!paintSelectedTextSeparately || ePos <= sPos) {
             // FIXME: Truncate right-to-left text correctly.
-            paintTextWithShadows(context, textRun, 0, m_truncation == cNoTruncation ? m_len : m_truncation, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
+            paintTextWithShadows(context, font, textRun, 0, m_truncation == cNoTruncation ? m_len : m_truncation, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
         } else
-            paintTextWithShadows(context, textRun, ePos, sPos, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
+            paintTextWithShadows(context, font, textRun, ePos, sPos, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
 
         if (textStrokeWidth > 0)
             context->restore();
@@ -433,7 +472,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
             context->save();
 
         updateGraphicsContext(context, selectionFillColor, selectionStrokeColor, selectionStrokeWidth);
-        paintTextWithShadows(context, textRun, sPos, ePos, textOrigin, m_x + tx, m_y + ty, width(), height(), selectionShadow, selectionStrokeWidth > 0);
+        paintTextWithShadows(context, font, textRun, sPos, ePos, textOrigin, m_x + tx, m_y + ty, width(), height(), selectionShadow, selectionStrokeWidth > 0);
 
         if (selectionStrokeWidth > 0)
             context->restore();
@@ -449,7 +488,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         paintDocumentMarkers(context, tx, ty, styleToUse, font, false);
 
         if (useCustomUnderlines) {
-            const Vector<CompositionUnderline>& underlines = object()->document()->frame()->editor()->customCompositionUnderlines();
+            const Vector<CompositionUnderline>& underlines = renderer()->document()->frame()->editor()->customCompositionUnderlines();
             size_t numUnderlines = underlines.size();
 
             for (size_t index = 0; index < numUnderlines; ++index) {
@@ -478,14 +517,14 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 void InlineTextBox::selectionStartEnd(int& sPos, int& ePos)
 {
     int startPos, endPos;
-    if (object()->selectionState() == RenderObject::SelectionInside) {
+    if (renderer()->selectionState() == RenderObject::SelectionInside) {
         startPos = 0;
-        endPos = textObject()->textLength();
+        endPos = textRenderer()->textLength();
     } else {
-        textObject()->selectionStartEnd(startPos, endPos);
-        if (object()->selectionState() == RenderObject::SelectionStart)
-            endPos = textObject()->textLength();
-        else if (object()->selectionState() == RenderObject::SelectionEnd)
+        textRenderer()->selectionStartEnd(startPos, endPos);
+        if (renderer()->selectionState() == RenderObject::SelectionStart)
+            endPos = textRenderer()->textLength();
+        else if (renderer()->selectionState() == RenderObject::SelectionEnd)
             startPos = 0;
     }
 
@@ -493,7 +532,7 @@ void InlineTextBox::selectionStartEnd(int& sPos, int& ePos)
     ePos = min(endPos - m_start, (int)m_len);
 }
 
-void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, RenderStyle* style, const Font*)
+void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, RenderStyle* style, const Font& font)
 {
     // See if we have a selection to paint at all.
     int sPos, ePos;
@@ -502,7 +541,7 @@ void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, Ren
         return;
 
     Color textColor = style->color();
-    Color c = object()->selectionBackgroundColor();
+    Color c = renderer()->selectionBackgroundColor();
     if (!c.isValid() || c.alpha() == 0)
         return;
 
@@ -516,12 +555,13 @@ void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, Ren
     int y = selectionTop();
     int h = selectionHeight();
     context->clip(IntRect(m_x + tx, y + ty, m_width, h));
-    context->drawHighlightForText(TextRun(textObject()->text()->characters() + m_start, m_len, textObject()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                            IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, 
+                                  direction() == RTL, m_dirOverride || style->visuallyOrdered()),
+                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
     context->restore();
 }
 
-void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx, int ty, RenderStyle* style, const Font*, int startPos, int endPos)
+void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx, int ty, RenderStyle* style, const Font& font, int startPos, int endPos)
 {
     int offset = m_start;
     int sPos = max(startPos - offset, 0);
@@ -538,8 +578,9 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx,
 
     int y = selectionTop();
     int h = selectionHeight();
-    context->drawHighlightForText(TextRun(textObject()->text()->characters() + m_start, m_len, textObject()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                            IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd,
+                                  direction() == RTL, m_dirOverride || style->visuallyOrdered()),
+                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
     context->restore();
 }
 
@@ -547,7 +588,7 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx,
 
 void InlineTextBox::paintCustomHighlight(int tx, int ty, const AtomicString& type)
 {
-    Frame* frame = object()->document()->frame();
+    Frame* frame = renderer()->document()->frame();
     if (!frame)
         return;
     Page* page = frame->page();
@@ -555,10 +596,10 @@ void InlineTextBox::paintCustomHighlight(int tx, int ty, const AtomicString& typ
         return;
 
     RootInlineBox* r = root();
-    FloatRect rootRect(tx + r->xPos(), ty + selectionTop(), r->width(), selectionHeight());
-    FloatRect textRect(tx + xPos(), rootRect.y(), width(), rootRect.height());
+    FloatRect rootRect(tx + r->x(), ty + selectionTop(), r->width(), selectionHeight());
+    FloatRect textRect(tx + x(), rootRect.y(), width(), rootRect.height());
 
-    page->chrome()->client()->paintCustomHighlight(object()->node(), type, textRect, rootRect, true, false);
+    page->chrome()->client()->paintCustomHighlight(renderer()->node(), type, textRect, rootRect, true, false);
 }
 
 #endif
@@ -570,27 +611,33 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
 
     if (m_truncation == cFullTruncation)
         return;
-    
-    int width = (m_truncation == cNoTruncation) ? m_width
-        : static_cast<RenderText*>(m_object)->width(m_start, m_truncation, textPos(), m_firstLine);
+
+    int width = m_width;
+    if (m_truncation != cNoTruncation) {
+        width = toRenderText(renderer())->width(m_start, m_truncation, textPos(), m_firstLine);
+        if (direction() == RTL)
+            tx += (m_width - width);
+    }
     
     // Get the text decoration colors.
     Color underline, overline, linethrough;
-    object()->getTextDecorationColors(deco, underline, overline, linethrough, true);
+    renderer()->getTextDecorationColors(deco, underline, overline, linethrough, true);
     
     // Use a special function for underlines to get the positioning exactly right.
-    bool isPrinting = textObject()->document()->printing();
+    bool isPrinting = textRenderer()->document()->printing();
     context->setStrokeThickness(1.0f); // FIXME: We should improve this rule and not always just assume 1.
 
     bool linesAreOpaque = !isPrinting && (!(deco & UNDERLINE) || underline.alpha() == 255) && (!(deco & OVERLINE) || overline.alpha() == 255) && (!(deco & LINE_THROUGH) || linethrough.alpha() == 255);
 
+    int baseline = renderer()->style(m_firstLine)->font().ascent();
+
     bool setClip = false;
     int extraOffset = 0;
     if (!linesAreOpaque && shadow && shadow->next) {
         context->save();
-        IntRect clipRect(tx, ty, width, m_baseline + 2);
+        IntRect clipRect(tx, ty, width, baseline + 2);
         for (ShadowData* s = shadow; s; s = s->next) {
-            IntRect shadowRect(tx, ty, width, m_baseline + 2);
+            IntRect shadowRect(tx, ty, width, baseline + 2);
             shadowRect.inflate(s->blur);
             shadowRect.move(s->x, s->y);
             clipRect.unite(shadowRect);
@@ -598,12 +645,13 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         }
         context->save();
         context->clip(clipRect);
-        extraOffset += m_baseline + 2;
+        extraOffset += baseline + 2;
         ty += extraOffset;
         setClip = true;
     }
 
     bool setShadow = false;
+    
     do {
         if (shadow) {
             if (!shadow->next) {
@@ -618,16 +666,19 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
 
         if (deco & UNDERLINE) {
             context->setStrokeColor(underline);
+            context->setStrokeStyle(SolidStroke);
             // Leave one pixel of white between the baseline and the underline.
-            context->drawLineForText(IntPoint(tx, ty + m_baseline + 1), width, isPrinting);
+            context->drawLineForText(IntPoint(tx, ty + baseline + 1), width, isPrinting);
         }
         if (deco & OVERLINE) {
             context->setStrokeColor(overline);
+            context->setStrokeStyle(SolidStroke);
             context->drawLineForText(IntPoint(tx, ty), width, isPrinting);
         }
         if (deco & LINE_THROUGH) {
             context->setStrokeColor(linethrough);
-            context->drawLineForText(IntPoint(tx, ty + 2 * m_baseline / 3), width, isPrinting);
+            context->setStrokeStyle(SolidStroke);
+            context->drawLineForText(IntPoint(tx, ty + 2 * baseline / 3), width, isPrinting);
         }
     } while (shadow);
 
@@ -637,10 +688,10 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         context->clearShadow();
 }
 
-void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font* f, bool grammar)
+void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font, bool grammar)
 {
     // Never print spelling/grammar markers (5327887)
-    if (textObject()->document()->printing())
+    if (textRenderer()->document()->printing())
         return;
 
     if (m_truncation == cFullTruncation)
@@ -667,17 +718,17 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
 
         // Calculate start & width
         IntPoint startPoint(tx + m_x, ty + selectionTop());
-        TextRun run(textObject()->text()->characters() + m_start, m_len, textObject()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
+        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
         int h = selectionHeight();
         
-        IntRect markerRect = enclosingIntRect(f->selectionRectForText(run, startPoint, h, startPosition, endPosition));
+        IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, startPosition, endPosition));
         start = markerRect.x() - startPoint.x();
         width = markerRect.width();
         
         // Store rendered rects for bad grammar markers, so we can hit-test against it elsewhere in order to
         // display a toolTip. We don't do this for misspelling markers.
         if (grammar)
-            object()->document()->setRenderedRectForMarker(object()->node(), marker, markerRect);
+            renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
     }
     
     // IMPORTANT: The misspelling underline is not considered when calculating the text bounds, so we have to
@@ -687,19 +738,20 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
     // So, we generally place the underline at the bottom of the text, but in larger fonts that's not so good so
     // we pin to two pixels under the baseline.
     int lineThickness = cMisspellingLineThickness;
-    int descent = m_height - m_baseline;
+    int baseline = renderer()->style(m_firstLine)->font().ascent();
+    int descent = height() - baseline;
     int underlineOffset;
     if (descent <= (2 + lineThickness)) {
-        // place the underline at the very bottom of the text in small/medium fonts
-        underlineOffset = m_height - lineThickness;
+        // Place the underline at the very bottom of the text in small/medium fonts.
+        underlineOffset = height() - lineThickness;
     } else {
-        // in larger fonts, tho, place the underline up near the baseline to prevent big gap
-        underlineOffset = m_baseline + 2;
+        // In larger fonts, though, place the underline up near the baseline to prevent a big gap.
+        underlineOffset = baseline + 2;
     }
     pt->drawLineForMisspellingOrBadGrammar(IntPoint(tx + m_x + start, ty + m_y + underlineOffset), width, grammar);
 }
 
-void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font* f)
+void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
 {
    // Use same y positioning and height as for selection, so that when the selection and this highlight are on
    // the same word there are no pieces sticking out.
@@ -708,27 +760,48 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, Do
     
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
-    TextRun run(textObject()->text()->characters() + m_start, m_len, textObject()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
     IntPoint startPoint = IntPoint(m_x + tx, y + ty);
     
     // Always compute and store the rect associated with this marker
-    IntRect markerRect = enclosingIntRect(f->selectionRectForText(run, startPoint, h, sPos, ePos));
-    object()->document()->setRenderedRectForMarker(object()->node(), marker, markerRect);
+    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
      
     // Optionally highlight the text
-    if (object()->document()->frame()->markedTextMatchesAreHighlighted()) {
-        Color color = theme()->platformTextSearchHighlightColor();
+    if (renderer()->document()->frame()->markedTextMatchesAreHighlighted()) {
+        Color color = marker.activeMatch ?
+            theme()->platformActiveTextSearchHighlightColor() :
+            theme()->platformInactiveTextSearchHighlightColor();
         pt->save();
         updateGraphicsContext(pt, color, color, 0);  // Don't draw text at all!
         pt->clip(IntRect(tx + m_x, ty + y, m_width, h));
-        pt->drawHighlightForText(run, startPoint, h, color, sPos, ePos);
+        pt->drawHighlightForText(font, run, startPoint, h, color, sPos, ePos);
         pt->restore();
     }
 }
 
-void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, RenderStyle* style, const Font* f, bool background)
+void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+{
+    // Replacement markers are not actually drawn, but their rects need to be computed for hit testing.
+    int y = selectionTop();
+    int h = selectionHeight();
+    
+    int sPos = max(marker.startOffset - m_start, (unsigned)0);
+    int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
+    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
+    
+    // Compute and store the rect associated with this marker.
+    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
+}
+    
+void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, RenderStyle* style, const Font& font, bool background)
 {
-    Vector<DocumentMarker> markers = object()->document()->markersForNode(object()->node());
+    if (!renderer()->node())
+        return;
+
+    Vector<DocumentMarker> markers = renderer()->document()->markersForNode(renderer()->node());
     Vector<DocumentMarker>::iterator markerIt = markers.begin();
 
     // Give any document markers that touch this run a chance to draw before the text has been drawn.
@@ -740,6 +813,7 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, Re
         switch (marker.type) {
             case DocumentMarker::Grammar:
             case DocumentMarker::Spelling:
+            case DocumentMarker::Replacement:
                 if (background)
                     continue;
                 break;
@@ -765,13 +839,16 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, Re
         // marker intersects this run.  Paint it.
         switch (marker.type) {
             case DocumentMarker::Spelling:
-                paintSpellingOrGrammarMarker(pt, tx, ty, marker, style, f, false);
+                paintSpellingOrGrammarMarker(pt, tx, ty, marker, style, font, false);
                 break;
             case DocumentMarker::Grammar:
-                paintSpellingOrGrammarMarker(pt, tx, ty, marker, style, f, true);
+                paintSpellingOrGrammarMarker(pt, tx, ty, marker, style, font, true);
                 break;
             case DocumentMarker::TextMatch:
-                paintTextMatchMarker(pt, tx, ty, marker, style, f);
+                paintTextMatchMarker(pt, tx, ty, marker, style, font);
+                break;
+            case DocumentMarker::Replacement:
+                computeRectForReplacementMarker(tx, ty, marker, style, font);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -797,7 +874,7 @@ void InlineTextBox::paintCompositionUnderline(GraphicsContext* ctx, int tx, int
     if (paintStart <= underline.startOffset) {
         paintStart = underline.startOffset;
         useWholeWidth = false;
-        start = static_cast<RenderText*>(m_object)->width(m_start, paintStart - m_start, textPos(), m_firstLine);
+        start = toRenderText(renderer())->width(m_start, paintStart - m_start, textPos(), m_firstLine);
     }
     if (paintEnd != underline.endOffset) {      // end points at the last char, not past it
         paintEnd = min(paintEnd, (unsigned)underline.endOffset);
@@ -808,14 +885,15 @@ void InlineTextBox::paintCompositionUnderline(GraphicsContext* ctx, int tx, int
         useWholeWidth = false;
     }
     if (!useWholeWidth) {
-        width = static_cast<RenderText*>(m_object)->width(paintStart, paintEnd - paintStart, textPos() + start, m_firstLine);
+        width = toRenderText(renderer())->width(paintStart, paintEnd - paintStart, textPos() + start, m_firstLine);
     }
 
     // Thick marked text underlines are 2px thick as long as there is room for the 2px line under the baseline.
     // All other marked text underlines are 1px thick.
     // If there's not enough space the underline will touch or overlap characters.
     int lineThickness = 1;
-    if (underline.thick && m_height - m_baseline >= 2)
+    int baseline = renderer()->style(m_firstLine)->font().ascent();
+    if (underline.thick && height() - baseline >= 2)
         lineThickness = 2;
 
     // We need to have some space between underlines of subsequent clauses, because some input methods do not use different underline styles for those.
@@ -825,7 +903,7 @@ void InlineTextBox::paintCompositionUnderline(GraphicsContext* ctx, int tx, int
 
     ctx->setStrokeColor(underline.color);
     ctx->setStrokeThickness(lineThickness);
-    ctx->drawLineForText(IntPoint(tx + start, ty + m_height - lineThickness), width, textObject()->document()->printing());
+    ctx->drawLineForText(IntPoint(tx + start, ty + height() - lineThickness), width, textRenderer()->document()->printing());
 }
 
 int InlineTextBox::caretMinOffset() const
@@ -845,12 +923,12 @@ unsigned InlineTextBox::caretMaxRenderedOffset() const
 
 int InlineTextBox::textPos() const
 {
-    if (xPos() == 0)
+    if (x() == 0)
         return 0;
         
-    RenderBlock *blockElement = object()->containingBlock();
-    return direction() == RTL ? xPos() - blockElement->borderRight() - blockElement->paddingRight()
-                      : xPos() - blockElement->borderLeft() - blockElement->paddingLeft();
+    RenderBlock *blockElement = renderer()->containingBlock();
+    return direction() == RTL ? x() - blockElement->borderRight() - blockElement->paddingRight()
+                      : x() - blockElement->borderLeft() - blockElement->paddingLeft();
 }
 
 int InlineTextBox::offsetForPosition(int _x, bool includePartialGlyphs) const
@@ -858,10 +936,10 @@ int InlineTextBox::offsetForPosition(int _x, bool includePartialGlyphs) const
     if (isLineBreak())
         return 0;
 
-    RenderText* text = static_cast<RenderText*>(m_object);
+    RenderText* text = toRenderText(renderer());
     RenderStyle *style = text->style(m_firstLine);
     const Font* f = &style->font();
-    return f->offsetForPosition(TextRun(textObject()->text()->characters() + m_start, m_len, textObject()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
+    return f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
                                 _x - m_x, includePartialGlyphs);
 }
 
@@ -873,12 +951,12 @@ int InlineTextBox::positionForOffset(int offset) const
     if (isLineBreak())
         return m_x;
 
-    RenderText* text = static_cast<RenderText*>(m_object);
+    RenderText* text = toRenderText(renderer());
     const Font& f = text->style(m_firstLine)->font();
     int from = direction() == RTL ? offset - m_start : 0;
     int to = direction() == RTL ? m_len : offset - m_start;
     // FIXME: Do we need to add rightBearing here?
-    return enclosingIntRect(f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textObject()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride),
+    return enclosingIntRect(f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride),
                                                    IntPoint(m_x, 0), 0, from, to)).right();
 }
 
@@ -906,4 +984,30 @@ bool InlineTextBox::containsCaretOffset(int offset) const
     return true;
 }
 
+typedef HashMap<InlineTextBox*, Vector<const SimpleFontData*> > FallbackFontsMap;
+static FallbackFontsMap* gFallbackFontsMap;
+
+void InlineTextBox::setFallbackFonts(const HashSet<const SimpleFontData*>& fallbackFonts)
+{
+    if (!gFallbackFontsMap)
+        gFallbackFontsMap = new FallbackFontsMap;
+
+    FallbackFontsMap::iterator it = gFallbackFontsMap->set(this, Vector<const SimpleFontData*>()).first;
+    ASSERT(it->second.isEmpty());
+    copyToVector(fallbackFonts, it->second);
+}
+
+void InlineTextBox::takeFallbackFonts(Vector<const SimpleFontData*>& fallbackFonts)
+{
+    if (!gFallbackFontsMap)
+        return;
+
+    FallbackFontsMap::iterator it = gFallbackFontsMap->find(this);
+    if (it == gFallbackFontsMap->end())
+        return;
+
+    fallbackFonts.swap(it->second);
+    gFallbackFontsMap->remove(it);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h
index d8a250b7f6..3bbb4537ad 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,22 +23,16 @@
 #ifndef InlineTextBox_h
 #define InlineTextBox_h
 
-#include "DocumentMarker.h"
 #include "InlineRunBox.h"
-#include "RenderText.h"
+#include "RenderText.h" // so textRenderer() can be inline
 
 namespace WebCore {
 
+struct CompositionUnderline;
+
 const unsigned short cNoTruncation = USHRT_MAX;
 const unsigned short cFullTruncation = USHRT_MAX - 1;
 
-class String;
-class StringImpl;
-class HitTestResult;
-class Position;
-
-struct CompositionUnderline;
-
 // Helper functions shared by InlineTextBox / SVGRootInlineBox
 void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness);
 Color correctedTextColor(Color textColor, Color backgroundColor);
@@ -67,46 +59,61 @@ public:
 
     void offsetRun(int d) { m_start += d; }
 
+    void setFallbackFonts(const HashSet<const SimpleFontData*>&);
+    void takeFallbackFonts(Vector<const SimpleFontData*>&);
+
+private:
     virtual int selectionTop();
     virtual int selectionHeight();
 
+public:
     virtual IntRect selectionRect(int absx, int absy, int startPos, int endPos);
     bool isSelected(int startPos, int endPos) const;
     void selectionStartEnd(int& sPos, int& ePos);
 
+private:
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
 
-    RenderText* textObject() const;
+public:
+    RenderText* textRenderer() const;
 
+private:
     virtual void deleteLine(RenderArena*);
     virtual void extractLine();
     virtual void attachLine();
 
+public:
     virtual RenderObject::SelectionState selectionState();
 
+private:
     virtual void clearTruncation() { m_truncation = cNoTruncation; }
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox);
+    virtual int placeEllipsisBox(bool flowIsLTR, int visibleLeftEdge, int visibleRightEdge, int ellipsisWidth, bool& foundBox);
 
+public:
     virtual bool isLineBreak() const;
 
     void setSpaceAdd(int add) { m_width -= m_toAdd; m_toAdd = add; m_width += m_toAdd; }
-    int spaceAdd() { return m_toAdd; }
 
+private:
     virtual bool isInlineTextBox() { return true; }    
-    virtual bool isText() const { return m_treatAsText; }
-    void setIsText(bool b) { m_treatAsText = b; }
 
+public:
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
+
+private:
     virtual unsigned caretMaxRenderedOffset() const;
 
     int textPos() const;
+
+public:
     virtual int offsetForPosition(int x, bool includePartialGlyphs = true) const;
     virtual int positionForOffset(int offset) const;
 
     bool containsCaretOffset(int offset) const; // false for offset after line break
 
+private:
     int m_start;
     unsigned short m_len;
 
@@ -114,24 +121,24 @@ public:
                       // denote no truncation (the whole run paints) and full truncation (nothing paints at all).
 
 protected:
-    void paintCompositionBackground(GraphicsContext*, int tx, int ty, RenderStyle*, const Font*, int startPos, int endPos);
-    void paintDocumentMarkers(GraphicsContext*, int tx, int ty, RenderStyle*, const Font*, bool background);
+    void paintCompositionBackground(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&, int startPos, int endPos);
+    void paintDocumentMarkers(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&, bool background);
     void paintCompositionUnderline(GraphicsContext*, int tx, int ty, const CompositionUnderline&);
 #if PLATFORM(MAC)
     void paintCustomHighlight(int tx, int ty, const AtomicString& type);
 #endif
 
 private:
-    void paintDecoration(GraphicsContext*, int tx, int ty, int decoration, ShadowData* shadow);
-    void paintSelection(GraphicsContext*, int tx, int ty, RenderStyle*, const Font*);
-    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font*, bool grammar);
-    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font*);
-    friend class RenderText;
+    void paintDecoration(GraphicsContext*, int tx, int ty, int decoration, ShadowData*);
+    void paintSelection(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&);
+    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&, bool grammar);
+    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
+    void computeRectForReplacementMarker(int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
 };
 
-inline RenderText* InlineTextBox::textObject() const
+inline RenderText* InlineTextBox::textRenderer() const
 {
-    return static_cast<RenderText*>(m_object);
+    return toRenderText(renderer());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp b/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp
index 20d0b99048..883f74d563 100644
--- a/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/LayoutState.cpp
@@ -27,16 +27,19 @@
 #include "LayoutState.h"
 
 #include "RenderArena.h"
+#include "RenderInline.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
 
 namespace WebCore {
 
 LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize& offset)
+    : m_next(prev)
+#ifndef NDEBUG
+    , m_renderer(renderer)
+#endif
 {
-    ASSERT(prev);
-
-    m_next = prev;
+    ASSERT(m_next);
 
     bool fixed = renderer->isPositioned() && renderer->style()->position() == FixedPosition;
     if (fixed) {
@@ -50,8 +53,10 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize&
         if (renderer->hasLayer())
             m_offset += renderer->layer()->relativePositionOffset();
     } else if (renderer->isPositioned() && !fixed) {
-        if (RenderObject* container = renderer->container())
-            m_offset += renderer->offsetForPositionedInContainer(container);
+        if (RenderObject* container = renderer->container()) {
+            if (container->isRelPositioned() && container->isRenderInline())
+                m_offset += toRenderInline(container)->relativePositionedInlineOffset(renderer);
+        }
     }
 
     m_clipped = !fixed && prev->m_clipped;
@@ -72,16 +77,22 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize&
         layer->subtractScrolledContentOffset(x, y);
         m_offset = IntSize(x, y);
     }
+
+    m_layoutDelta = m_next->m_layoutDelta;
+
     // FIXME: <http://bugs.webkit.org/show_bug.cgi?id=13443> Apply control clip if present.
 }
 
 LayoutState::LayoutState(RenderObject* root)
     : m_clipped(false)
+    , m_next(0)
+#ifndef NDEBUG
+    , m_renderer(root)
+#endif
 {
     RenderObject* container = root->container();
-    FloatPoint absContentPoint = container->localToAbsoluteForContent(FloatPoint(), false, true);
+    FloatPoint absContentPoint = container->localToAbsolute(FloatPoint(), false, true);
     m_offset = IntSize(absContentPoint.x(), absContentPoint.y());
-    m_next = 0;
 }
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/rendering/LayoutState.h b/src/3rdparty/webkit/WebCore/rendering/LayoutState.h
index 551c74a007..afa295206b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/LayoutState.h
+++ b/src/3rdparty/webkit/WebCore/rendering/LayoutState.h
@@ -41,6 +41,9 @@ public:
     LayoutState()
         : m_clipped(false)
         , m_next(0)
+#ifndef NDEBUG
+        , m_renderer(0)
+#endif
     {
     }
 
@@ -62,8 +65,14 @@ private:
 public:
     bool m_clipped;
     IntRect m_clipRect;
-    IntSize m_offset;
+    IntSize m_offset;       // x/y offset from container.
+    IntSize m_layoutDelta;  // Transient offset from the final position of the object
+                            // used to ensure that repaints happen in the correct place.
+                            // This is a total delta accumulated from the root.
     LayoutState* m_next;
+#ifndef NDEBUG
+    RenderObject* m_renderer;
+#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index 48ea3ab6d9..5cd93635da 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,12 +32,12 @@
 
 #include "MediaControlElements.h"
 
-#include "Event.h"
 #include "EventNames.h"
-#include "EventHandler.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "MouseEvent.h"
+#include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
 
@@ -59,21 +59,73 @@ MediaControlShadowRootElement::MediaControlShadowRootElement(Document* doc, HTML
     rootStyle->setDisplay(BLOCK);
     rootStyle->setPosition(RelativePosition);
     RenderMediaControlShadowRoot* renderer = new (mediaElement->renderer()->renderArena()) RenderMediaControlShadowRoot(this);
-    renderer->setParent(mediaElement->renderer());
     renderer->setStyle(rootStyle.release());
     setRenderer(renderer);
     setAttached();
     setInDocument(true);
 }
 
+void MediaControlShadowRootElement::updateStyle()
+{
+    if (renderer()) {
+        RenderStyle* timelineContainerStyle = m_mediaElement->renderer()->getCachedPseudoStyle(MEDIA_CONTROLS_TIMELINE_CONTAINER);
+        renderer()->setStyle(timelineContainerStyle);
+    }
+}
+
 // ----------------------------
 
-MediaControlInputElement::MediaControlInputElement(Document* doc, RenderStyle::PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement) 
+MediaTextDisplayElement::MediaTextDisplayElement(Document* doc, PseudoId pseudo, HTMLMediaElement* mediaElement) 
+    : HTMLDivElement(divTag, doc)
+    , m_mediaElement(mediaElement)
+    , m_pseudoStyleId(pseudo)
+{
+    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+    RenderObject* renderer = createRenderer(m_mediaElement->renderer()->renderArena(), style);
+    if (renderer) {
+        setRenderer(renderer);
+        renderer->setStyle(style);
+    }
+    setAttached();
+    setInDocument(true);
+}
+
+void MediaTextDisplayElement::attachToParent(Element* parent)
+{
+    parent->addChild(this);
+    if (renderer())
+        parent->renderer()->addChild(renderer());
+}
+
+void MediaTextDisplayElement::update()
+{
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void MediaTextDisplayElement::updateStyle()
+{
+    if (renderer() && m_mediaElement->renderer()) {
+        RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+        renderer()->setStyle(style);
+    }
+}
+
+MediaTimeDisplayElement::MediaTimeDisplayElement(Document* doc, HTMLMediaElement* element, bool currentTime)
+    : MediaTextDisplayElement(doc, currentTime ? MEDIA_CONTROLS_CURRENT_TIME_DISPLAY : MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, element)
+{
+}
+
+// ----------------------------
+
+MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement, MediaControlElementType displayType) 
     : HTMLInputElement(inputTag, doc)
     , m_mediaElement(mediaElement)
+    , m_pseudoStyleId(pseudo)
+    , m_displayType(displayType)
 {
     setInputType(type);
-    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(pseudo);
+    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
     RenderObject* renderer = createRenderer(m_mediaElement->renderer()->renderArena(), style);
     if (renderer) {
         setRenderer(renderer);
@@ -91,10 +143,19 @@ void MediaControlInputElement::attachToParent(Element* parent)
 
 void MediaControlInputElement::update()
 {
+    updateDisplayType();
     if (renderer())
         renderer()->updateFromElement();
 }
 
+void MediaControlInputElement::updateStyle()
+{
+    if (renderer() && m_mediaElement->renderer()) {
+        RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+        renderer()->setStyle(style);
+    }
+}
+
 bool MediaControlInputElement::hitTest(const IntPoint& absPoint)
 {
     if (renderer() && renderer()->style()->hasAppearance())
@@ -103,10 +164,20 @@ bool MediaControlInputElement::hitTest(const IntPoint& absPoint)
     return false;
 }
 
+void MediaControlInputElement::setDisplayType(MediaControlElementType displayType)
+{
+    if (displayType == m_displayType)
+        return;
+
+    m_displayType = displayType;
+    if (RenderObject* o = renderer())
+        o->repaint();
+}
+
 // ----------------------------
 
 MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, RenderStyle::MEDIA_CONTROLS_MUTE_BUTTON, "button", element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_MUTE_BUTTON, "button", element, element->muted() ? MediaUnMuteButton : MediaMuteButton)
 {
 }
 
@@ -119,30 +190,37 @@ void MediaControlMuteButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
+void MediaControlMuteButtonElement::updateDisplayType()
+{
+    setDisplayType(m_mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton);
+}
+
 // ----------------------------
 
 MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, RenderStyle::MEDIA_CONTROLS_PLAY_BUTTON, "button", element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_PLAY_BUTTON, "button", element, element->canPlay() ? MediaPlayButton : MediaPauseButton)
 {
 }
 
 void MediaControlPlayButtonElement::defaultEventHandler(Event* event)
 {
     if (event->type() == eventNames().clickEvent) {
-        ExceptionCode ec;
-        if (m_mediaElement->canPlay())
-            m_mediaElement->play(ec);
-        else 
-            m_mediaElement->pause(ec);
+        m_mediaElement->togglePlayState();
         event->setDefaultHandled();
     }
     HTMLInputElement::defaultEventHandler(event);
 }
 
+void MediaControlPlayButtonElement::updateDisplayType()
+{
+    setDisplayType(m_mediaElement->canPlay() ? MediaPlayButton : MediaPauseButton);
+}
+
 // ----------------------------
 
 MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* doc, HTMLMediaElement* element, bool forward)
-    : MediaControlInputElement(doc, forward ? RenderStyle::MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : RenderStyle::MEDIA_CONTROLS_SEEK_BACK_BUTTON, "button", element)
+    : MediaControlInputElement(doc, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+                               "button", element, forward ? MediaSeekForwardButton : MediaSeekBackButton)
     , m_forward(forward)
     , m_seeking(false)
     , m_capturing(false)
@@ -157,8 +235,7 @@ void MediaControlSeekButtonElement::defaultEventHandler(Event* event)
             m_capturing = true;
             frame->eventHandler()->setCapturingMouseEventsNode(this);
         }
-        ExceptionCode ec;
-        m_mediaElement->pause(ec);
+        m_mediaElement->pause();
         m_seekTimer.startRepeating(cSeekRepeatDelay);
         event->setDefaultHandled();
     } else if (event->type() == eventNames().mouseupEvent) {
@@ -191,37 +268,34 @@ void MediaControlSeekButtonElement::seekTimerFired(Timer<MediaControlSeekButtonE
 
 // ----------------------------
 
-MediaControlTimelineElement::MediaControlTimelineElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, RenderStyle::MEDIA_CONTROLS_TIMELINE, "range", element)
+MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element, MediaTimelineContainer)
 { 
-    setAttribute(precisionAttr, "float");
 }
 
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
 {
-    RenderSlider* slider = static_cast<RenderSlider*>(renderer());
-    bool oldInDragMode = slider && slider->inDragMode();
-    float oldTime = narrowPrecisionToFloat(value().toDouble());
-    bool oldEnded = m_mediaElement->ended();
+    if (event->type() == eventNames().mousedownEvent)
+        m_mediaElement->beginScrubbing();
 
     HTMLInputElement::defaultEventHandler(event);
 
+     if (event->type() == eventNames().mouseoverEvent || event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mousemoveEvent ) {
+        return;
+    }
+
     float time = narrowPrecisionToFloat(value().toDouble());
-    if (oldTime != time || event->type() == eventNames().inputEvent) {
+    if (time != m_mediaElement->currentTime()) {
         ExceptionCode ec;
         m_mediaElement->setCurrentTime(time, ec);
     }
-    // Media element stays in non-paused state when it reaches end. If the slider is now dragged
-    // to some other position the playback resumes which does not match usual media player UIs.
-    // Get the expected behavior by pausing explicitly in this case.
-    if (oldEnded && !m_mediaElement->ended() && !m_mediaElement->paused()) {
-        ExceptionCode ec;
-        m_mediaElement->pause(ec);
-    }
-    // Pause playback during drag, but do it without using DOM API which would generate events 
-    bool inDragMode = slider && slider->inDragMode();
-    if (inDragMode != oldInDragMode)
-        m_mediaElement->setPausedInternal(inDragMode);
+
+    RenderSlider* slider = static_cast<RenderSlider*>(renderer());
+    if (slider && slider->inDragMode())
+        static_cast<RenderMedia*>(m_mediaElement->renderer())->updateTimeDisplay();
+
+    if (event->type() == eventNames().mouseupEvent)
+        m_mediaElement->endScrubbing();
 }
 
 void MediaControlTimelineElement::update(bool updateDuration) 
@@ -236,7 +310,7 @@ void MediaControlTimelineElement::update(bool updateDuration)
 // ----------------------------
 
 MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, RenderStyle::MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element, MediaFullscreenButton)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index 4741534d2b..d52d4bc352 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -43,7 +43,7 @@ namespace WebCore {
 class Event;
 class Frame;
 
-enum MediaControlElements {
+enum MediaControlElementType {
     MediaFullscreenButton, MediaMuteButton, MediaPlayButton,
     MediaSeekBackButton, MediaSeekForwardButton, MediaSlider, MediaSliderThumb,
     MediaUnMuteButton, MediaPauseButton, MediaTimelineContainer, MediaCurrentTimeDisplay, 
@@ -56,21 +56,51 @@ public:
     
     virtual bool isShadowNode() const { return true; }
     virtual Node* shadowParentNode() { return m_mediaElement; }
+
+    void updateStyle();
     
 private:
     HTMLMediaElement* m_mediaElement;    
 };
 
+ // ----------------------------
+ 
+class MediaTextDisplayElement : public HTMLDivElement
+{
+public:
+    MediaTextDisplayElement(Document*, PseudoId, HTMLMediaElement*);
+    void attachToParent(Element*);
+    void update();
+    void updateStyle();
+protected:
+    HTMLMediaElement* m_mediaElement;   
+    PseudoId m_pseudoStyleId;
+};
+
+// ----------------------------
+
+class MediaTimeDisplayElement : public MediaTextDisplayElement {
+public:
+    MediaTimeDisplayElement(Document*, HTMLMediaElement*, bool currentTime);
+};
+
 // ----------------------------
 
 class MediaControlInputElement : public HTMLInputElement {
 public:
-    MediaControlInputElement(Document*, RenderStyle::PseudoId, const String& type, HTMLMediaElement*);
+    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*, MediaControlElementType);
     void attachToParent(Element*);
     void update();
+    void updateStyle();
     bool hitTest(const IntPoint& absPoint);
+
 protected:
+    virtual void updateDisplayType() { }
+    void setDisplayType(MediaControlElementType);
+
     HTMLMediaElement* m_mediaElement;   
+    PseudoId m_pseudoStyleId;
+    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
 };
 
 // ----------------------------
@@ -79,6 +109,7 @@ class MediaControlMuteButtonElement : public MediaControlInputElement {
 public:
     MediaControlMuteButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
 };
 
 // ----------------------------
@@ -87,6 +118,7 @@ class MediaControlPlayButtonElement : public MediaControlInputElement {
 public:
     MediaControlPlayButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
 };
 
 // ----------------------------
diff --git a/src/3rdparty/webkit/WebCore/page/chromium/AccessibilityObjectChromium.cpp b/src/3rdparty/webkit/WebCore/rendering/OverlapTestRequestClient.h
index e309ac8ed8..71400ab61f 100644
--- a/src/3rdparty/webkit/WebCore/page/chromium/AccessibilityObjectChromium.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/OverlapTestRequestClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,15 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-
-#include "config.h"
-#include "AccessibilityObject.h"
+#ifndef OverlapTestRequestClient_h
+#define OverlapTestRequestClient_h
 
 namespace WebCore {
-
-bool AccessibilityObject::accessibilityIgnoreAttachment() const
-{
-    return false;
-}
+    
+class OverlapTestRequestClient {
+public:
+    virtual ~OverlapTestRequestClient() { }
+    virtual void setOverlapTestResult(bool) = 0;
+};
 
 } // namespace WebCore
+
+#endif // OverlapTestRequestClient_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h b/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h
index e2dae3b4bd..3d8939a76a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h
+++ b/src/3rdparty/webkit/WebCore/rendering/PointerEventsHitRules.h
@@ -22,7 +22,7 @@
 #ifndef PointerEventsHitRules_h
 #define PointerEventsHitRules_h
 
-#include "RenderStyle.h"
+#include "RenderStyleConstants.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderApplet.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderApplet.cpp
index 7483943062..a989d6fb8b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderApplet.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderApplet.cpp
@@ -1,8 +1,6 @@
-/**
- * This file is part of the HTML widget for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,13 +22,10 @@
 #include "config.h"
 #include "RenderApplet.h"
 
-#include "Document.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "HTMLAppletElement.h"
 #include "HTMLNames.h"
 #include "HTMLParamElement.h"
-#include "Widget.h"
 
 namespace WebCore {
 
@@ -43,33 +38,29 @@ RenderApplet::RenderApplet(HTMLAppletElement* applet, const HashMap<String, Stri
     setInline(true);
 }
 
-RenderApplet::~RenderApplet()
-{
-}
-
 IntSize RenderApplet::intrinsicSize() const
 {
     // FIXME: This doesn't make sense. We can't just start returning
     // a different size once we've created the widget and expect
     // layout and sizing to be correct. We should remove this and
     // pass the appropriate intrinsic size in the constructor.
-    return m_widget ? IntSize(50, 50) : IntSize(150, 150);
+    return widget() ? IntSize(50, 50) : IntSize(150, 150);
 }
 
 void RenderApplet::createWidgetIfNecessary()
 {
     HTMLAppletElement* element = static_cast<HTMLAppletElement*>(node());
-    if (m_widget || !element->isFinishedParsingChildren())
+    if (widget() || !element->isFinishedParsingChildren())
         return;
 
     // FIXME: Java applets can't be resized (this is a bug in Apple's Java implementation).
     // In order to work around this problem and have a correct size from the start, we will
     // use fixed widths/heights from the style system when we can, since the widget might
     // not have an accurate m_width/m_height.
-    int width = style()->width().isFixed() ? style()->width().value() : 
-        m_width - borderLeft() - borderRight() - paddingLeft() - paddingRight();
-    int height = style()->height().isFixed() ? style()->height().value() :
-        m_height - borderTop() - borderBottom() - paddingTop() - paddingBottom();
+    int contentWidth = style()->width().isFixed() ? style()->width().value() : 
+        width() - borderLeft() - borderRight() - paddingLeft() - paddingRight();
+    int contentHeight = style()->height().isFixed() ? style()->height().value() :
+        height() - borderTop() - borderBottom() - paddingTop() - paddingBottom();
     for (Node* child = element->firstChild(); child; child = child->nextSibling()) {
         if (child->hasTagName(paramTag)) {
             HTMLParamElement* p = static_cast<HTMLParamElement*>(child);
@@ -80,7 +71,7 @@ void RenderApplet::createWidgetIfNecessary()
 
     Frame* frame = document()->frame();
     ASSERT(frame);
-    setWidget(frame->loader()->createJavaAppletWidget(IntSize(width, height), element, m_args));
+    setWidget(frame->loader()->createJavaAppletWidget(IntSize(contentWidth, contentHeight), element, m_args));
 }
 
 void RenderApplet::layout()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h b/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h
index 6746c22481..b481d87b6f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,8 +32,10 @@ namespace WebCore {
     class RenderApplet : public RenderWidget {
     public:
         RenderApplet(HTMLAppletElement*, const HashMap<String, String>& args);
-        virtual ~RenderApplet();
 
+        void createWidgetIfNecessary();
+
+    private:
         virtual const char* renderName() const { return "RenderApplet"; }
 
         virtual bool isApplet() const { return true; }
@@ -41,9 +43,6 @@ namespace WebCore {
         virtual void layout();
         virtual IntSize intrinsicSize() const;
 
-        void createWidgetIfNecessary();
-
-    private:
         HashMap<String, String> m_args;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp
index 69d08a5edf..b7bfe4d8be 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderArena.cpp
@@ -76,7 +76,7 @@ void* RenderArena::allocate(size_t size)
     // Use standard malloc so that memory debugging tools work.
     ASSERT(this);
     void* block = ::malloc(sizeof(RenderArenaDebugHeader) + size);
-    RenderArenaDebugHeader* header = (RenderArenaDebugHeader*)block;
+    RenderArenaDebugHeader* header = static_cast<RenderArenaDebugHeader*>(block);
     header->arena = this;
     header->size = size;
     header->signature = signature;
@@ -112,7 +112,7 @@ void RenderArena::free(size_t size, void* ptr)
 {
 #ifndef NDEBUG
     // Use standard free so that memory debugging tools work.
-    RenderArenaDebugHeader* header = (RenderArenaDebugHeader*)ptr - 1;
+    RenderArenaDebugHeader* header = static_cast<RenderArenaDebugHeader*>(ptr) - 1;
     ASSERT(header->signature == signature);
     ASSERT(header->size == size);
     ASSERT(header->arena == this);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
index 2532c5bd6d..f40709912d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
@@ -40,15 +40,6 @@ RenderBR::~RenderBR()
 {
 }
 
-InlineBox* RenderBR::createInlineBox(bool makePlaceholder, bool isRootLineBox, bool isOnlyRun)
-{
-    // We only treat a box as text for a <br> if we are on a line by ourself or in strict mode
-    // (Note the use of strict mode.  In "almost strict" mode, we don't treat the box for <br> as text.)
-    InlineTextBox* box = static_cast<InlineTextBox*>(RenderText::createInlineBox(makePlaceholder, isRootLineBox, isOnlyRun));
-    box->setIsText(isOnlyRun || document()->inStrictMode());
-    return box;
-}
-
 int RenderBR::baselinePosition(bool firstLine, bool isRootLineBox) const
 {
     if (firstTextBox() && !firstTextBox()->isText())
@@ -82,7 +73,7 @@ int RenderBR::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
     return m_lineHeight;
 }
 
-void RenderBR::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderBR::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderText::styleDidChange(diff, oldStyle);
     m_lineHeight = -1;
@@ -103,9 +94,9 @@ unsigned RenderBR::caretMaxRenderedOffset() const
     return 1;
 }
 
-VisiblePosition RenderBR::positionForCoordinates(int /*x*/, int /*y*/)
+VisiblePosition RenderBR::positionForPoint(const IntPoint&)
 {
-    return VisiblePosition(element(), 0, DOWNSTREAM);
+    return createVisiblePosition(0, DOWNSTREAM);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBR.h b/src/3rdparty/webkit/WebCore/rendering/RenderBR.h
index b65bb587bb..7eae8ea407 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBR.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBR.h
@@ -40,7 +40,7 @@ public:
 
     virtual const char* renderName() const { return "RenderBR"; }
  
-    virtual IntRect selectionRect(bool) { return IntRect(); }
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* /*repaintContainer*/, bool /*clipToVisibleContent*/) { return IntRect(); }
 
     virtual unsigned width(unsigned /*from*/, unsigned /*len*/, const Font&, int /*xpos*/) const { return 0; }
     virtual unsigned width(unsigned /*from*/, unsigned /*len*/, int /*xpos*/, bool /*firstLine = false*/) const { return 0; }
@@ -49,18 +49,16 @@ public:
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
 
     // overrides
-    virtual InlineBox* createInlineBox(bool, bool, bool isOnlyRun = false);
-
     virtual bool isBR() const { return true; }
 
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
     virtual unsigned caretMaxRenderedOffset() const;
 
-    virtual VisiblePosition positionForCoordinates(int x, int y);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
 
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
     mutable int m_lineHeight;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
index 0aa58daf93..89cf112df5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
@@ -25,13 +25,16 @@
 
 #include "Document.h"
 #include "Element.h"
+#include "FloatQuad.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
 #include "RenderImage.h"
+#include "RenderInline.h"
 #include "RenderMarquee.h"
 #include "RenderReplica.h"
 #include "RenderTableCell.h"
@@ -39,6 +42,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "SelectionController.h"
+#include "Settings.h"
 #include <wtf/StdLibExtras.h>
 
 using namespace std;
@@ -49,10 +53,16 @@ namespace WebCore {
 
 // Number of pixels to allow as a fudge factor when clicking above or below a line.
 // clicking up to verticalLineClickFudgeFactor pixels above a line will correspond to the closest point on the line.   
-const int verticalLineClickFudgeFactor= 3;
+static const int verticalLineClickFudgeFactor = 3;
 
 using namespace HTMLNames;
 
+static void moveChild(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* from, RenderObjectChildList* fromChildList, RenderObject* child)
+{
+    ASSERT(from == child->parent());
+    toChildList->appendChildNode(to, fromChildList->removeChildNode(from, child, false), false);
+}
+
 struct ColumnInfo {
     ColumnInfo()
         : m_desiredColumnWidth(0)
@@ -72,7 +82,7 @@ static PercentHeightDescendantsMap* gPercentHeightDescendantsMap = 0;
 typedef WTF::HashMap<const RenderBox*, HashSet<RenderBlock*>*> PercentHeightContainerMap;
 static PercentHeightContainerMap* gPercentHeightContainerMap = 0;
     
-typedef WTF::HashMap<RenderBlock*, RenderFlowSequencedSet*> ContinuationOutlineTableMap;
+typedef WTF::HashMap<RenderBlock*, ListHashSet<RenderInline*>*> ContinuationOutlineTableMap;
 
 // Our MarginInfo state used when laying out block children.
 RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int top, int bottom)
@@ -109,15 +119,18 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int top, int bottom)
 // -------------------------------------------------------------------------------------------------------
 
 RenderBlock::RenderBlock(Node* node)
-      : RenderFlow(node)
+      : RenderBox(node)
       , m_floatingObjects(0)
       , m_positionedObjects(0)
+      , m_inlineContinuation(0)
       , m_maxMargin(0)
       , m_overflowHeight(0)
       , m_overflowWidth(0)
       , m_overflowLeft(0)
       , m_overflowTop(0)
+      , m_lineHeight(-1)
 {
+    setChildrenInline(true);
 }
 
 RenderBlock::~RenderBlock()
@@ -126,7 +139,7 @@ RenderBlock::~RenderBlock()
     delete m_positionedObjects;
     delete m_maxMargin;
     
-    if (m_hasColumns)
+    if (hasColumns())
         delete gColumnInfoMap->take(this);
 
     if (gPercentHeightDescendantsMap) {
@@ -149,15 +162,76 @@ RenderBlock::~RenderBlock()
     }
 }
 
-void RenderBlock::styleWillChange(RenderStyle::Diff diff, const RenderStyle* newStyle)
+void RenderBlock::destroy()
+{
+    // Detach our continuation first.
+    if (m_inlineContinuation)
+        m_inlineContinuation->destroy();
+    m_inlineContinuation = 0;
+    
+    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
+    // properly dirty line boxes that they are removed from.  Effects that do :before/:after only on hover could crash otherwise.
+    children()->destroyLeftoverChildren();
+
+    if (!documentBeingDestroyed()) {
+        if (firstLineBox()) {
+            // We can't wait for RenderBox::destroy to clear the selection,
+            // because by then we will have nuked the line boxes.
+            // FIXME: The SelectionController should be responsible for this when it
+            // is notified of DOM mutations.
+            if (isSelectionBorder())
+                view()->clearSelection();
+
+            // If we are an anonymous block, then our line boxes might have children
+            // that will outlast this block. In the non-anonymous block case those
+            // children will be destroyed by the time we return from this function.
+            if (isAnonymousBlock()) {
+                for (InlineFlowBox* box = firstLineBox(); box; box = box->nextFlowBox()) {
+                    while (InlineBox* childBox = box->firstChild())
+                        childBox->remove();
+                }
+            }
+        } else if (isInline() && parent())
+            parent()->dirtyLinesFromChangedChild(this);
+    }
+
+    m_lineBoxes.deleteLineBoxes(renderArena());
+
+    RenderBox::destroy();
+}
+
+void RenderBlock::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     setReplaced(newStyle->isDisplayReplacedType());
-    RenderFlow::styleWillChange(diff, newStyle);
+    
+    if (style() && parent() && diff == StyleDifferenceLayout && style()->position() != newStyle->position()) {
+        if (newStyle->position() == StaticPosition)
+            // Clear our positioned objects list. Our absolutely positioned descendants will be
+            // inserted into our containing block's positioned objects list during layout.
+            removePositionedObjects(0);
+        else if (style()->position() == StaticPosition) {
+            // Remove our absolutely positioned descendants from their current containing block.
+            // They will be inserted into our positioned objects list during layout.
+            RenderObject* cb = parent();
+            while (cb && (cb->style()->position() == StaticPosition || (cb->isInline() && !cb->isReplaced())) && !cb->isRenderView()) {
+                if (cb->style()->position() == RelativePosition && cb->isInline() && !cb->isReplaced()) {
+                    cb = cb->containingBlock();
+                    break;
+                }
+                cb = cb->parent();
+            }
+            
+            if (cb->isRenderBlock())
+                toRenderBlock(cb)->removePositionedObjects(this);
+        }
+    }
+
+    RenderBox::styleWillChange(diff, newStyle);
 }
 
-void RenderBlock::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
-    RenderFlow::styleDidChange(diff, oldStyle);
+    RenderBox::styleDidChange(diff, oldStyle);
 
     // FIXME: We could save this call when the change only affected non-inherited properties
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
@@ -172,14 +246,22 @@ void RenderBlock::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldS
     m_lineHeight = -1;
 
     // Update pseudos for :before and :after now.
-    if (!isAnonymous() && canHaveChildren()) {
-        updateBeforeAfterContent(RenderStyle::BEFORE);
-        updateBeforeAfterContent(RenderStyle::AFTER);
+    if (!isAnonymous() && document()->usesBeforeAfterRules() && canHaveChildren()) {
+        updateBeforeAfterContent(BEFORE);
+        updateBeforeAfterContent(AFTER);
     }
     updateFirstLetter();
 }
 
-void RenderBlock::addChildToFlow(RenderObject* newChild, RenderObject* beforeChild)
+void RenderBlock::updateBeforeAfterContent(PseudoId pseudoId)
+{
+    // If this is an anonymous wrapper, then the parent applies its own pseudo-element style to it.
+    if (parent() && parent()->createsAnonymousWrapper())
+        return;
+    return children()->updateBeforeAfterContent(this, pseudoId);
+}
+    
+void RenderBlock::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
     if (!beforeChild && isAfterContent(lastChild()))
@@ -203,13 +285,13 @@ void RenderBlock::addChildToFlow(RenderObject* newChild, RenderObject* beforeChi
             if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
                 beforeChild->parent()->addChild(newChild, beforeChild);
             else
-                addChildToFlow(newChild, beforeChild->parent());
+                addChild(newChild, beforeChild->parent());
             return;
         }
 
         ASSERT(anonymousChild->isTable());
-        if (newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP
-                || newChild->isRenderBlock() && newChild->style()->display() == TABLE_CAPTION
+        if ((newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP)
+                || (newChild->isRenderBlock() && newChild->style()->display() == TABLE_CAPTION)
                 || newChild->isTableSection()
                 || newChild->isTableRow()
                 || newChild->isTableCell()) {
@@ -225,7 +307,7 @@ void RenderBlock::addChildToFlow(RenderObject* newChild, RenderObject* beforeChi
     // A block has to either have all of its children inline, or all of its children as blocks.
     // So, if our children are currently inline and a block child has to be inserted, we move all our
     // inline children into anonymous block boxes.
-    if (m_childrenInline && !newChild->isInline() && !newChild->isFloatingOrPositioned()) {
+    if (childrenInline() && !newChild->isInline() && !newChild->isFloatingOrPositioned()) {
         // This is a block with inline content. Wrap the inline content in anonymous blocks.
         makeChildrenNonInline(beforeChild);
         madeBoxesNonInline = true;
@@ -235,7 +317,7 @@ void RenderBlock::addChildToFlow(RenderObject* newChild, RenderObject* beforeChi
             ASSERT(beforeChild->isAnonymousBlock());
             ASSERT(beforeChild->parent() == this);
         }
-    } else if (!m_childrenInline && (newChild->isFloatingOrPositioned() || newChild->isInline())) {
+    } else if (!childrenInline() && (newChild->isFloatingOrPositioned() || newChild->isInline())) {
         // If we're inserting an inline child but all of our children are blocks, then we have to make sure
         // it is put into an anomyous block box. We try to use an existing anonymous box if possible, otherwise
         // a new one is created and inserted into our list of children in the appropriate position.
@@ -249,17 +331,16 @@ void RenderBlock::addChildToFlow(RenderObject* newChild, RenderObject* beforeChi
         if (newChild->isInline()) {
             // No suitable existing anonymous box - create a new one.
             RenderBlock* newBox = createAnonymousBlock();
-            RenderContainer::addChild(newBox, beforeChild);
+            RenderBox::addChild(newBox, beforeChild);
             newBox->addChild(newChild);
             return;
         }
     }
 
-    RenderContainer::addChild(newChild, beforeChild);
-    // ### care about aligned stuff
+    RenderBox::addChild(newChild, beforeChild);
 
-    if (madeBoxesNonInline && parent() && isAnonymousBlock())
-        parent()->removeLeftoverAnonymousBlock(this);
+    if (madeBoxesNonInline && parent() && isAnonymousBlock() && parent()->isRenderBlock())
+        toRenderBlock(parent())->removeLeftoverAnonymousBlock(this);
     // this object may be dead here
 }
 
@@ -305,14 +386,19 @@ static void getInlineRun(RenderObject* start, RenderObject* boundary,
 
 void RenderBlock::deleteLineBoxTree()
 {
-    InlineFlowBox* line = m_firstLineBox;
-    InlineFlowBox* nextLine;
-    while (line) {
-        nextLine = line->nextFlowBox();
-        line->deleteLine(renderArena());
-        line = nextLine;
-    }
-    m_firstLineBox = m_lastLineBox = 0;
+    m_lineBoxes.deleteLineBoxTree(renderArena());
+}
+
+RootInlineBox* RenderBlock::createRootBox()
+{
+    return new (renderArena()) RootInlineBox(this);
+}
+
+RootInlineBox* RenderBlock::createRootInlineBox()
+{
+    RootInlineBox* rootBox = createRootBox();
+    m_lineBoxes.appendLineBox(rootBox);
+    return rootBox;
 }
 
 void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
@@ -327,7 +413,7 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
     ASSERT(isInlineBlockOrInlineTable() || !isInline());
     ASSERT(!insertionPoint || insertionPoint->parent() == this);
 
-    m_childrenInline = false;
+    setChildrenInline(false);
 
     RenderObject *child = firstChild();
     if (!child)
@@ -344,16 +430,16 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
 
         child = inlineRunEnd->nextSibling();
 
-        RenderBlock* box = createAnonymousBlock();
-        insertChildNode(box, inlineRunStart);
+        RenderBlock* block = createAnonymousBlock();
+        children()->insertChildNode(this, block, inlineRunStart);
         RenderObject* o = inlineRunStart;
-        while(o != inlineRunEnd)
-        {
+        while (o != inlineRunEnd) {
             RenderObject* no = o;
             o = no->nextSibling();
-            box->moveChildNode(no);
+            
+            moveChild(block, block->children(), this, children(), no);
         }
-        box->moveChildNode(inlineRunEnd);
+        moveChild(block, block->children(), this, children(), inlineRunEnd);
     }
 
 #ifndef NDEBUG
@@ -364,7 +450,49 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
     repaint();
 }
 
-void RenderBlock::removeChild(RenderObject *oldChild)
+void RenderBlock::removeLeftoverAnonymousBlock(RenderBlock* child)
+{
+    ASSERT(child->isAnonymousBlock());
+    ASSERT(!child->childrenInline());
+    
+    if (child->inlineContinuation()) 
+        return;
+    
+    RenderObject* firstAnChild = child->m_children.firstChild();
+    RenderObject* lastAnChild = child->m_children.lastChild();
+    if (firstAnChild) {
+        RenderObject* o = firstAnChild;
+        while (o) {
+            o->setParent(this);
+            o = o->nextSibling();
+        }
+        firstAnChild->setPreviousSibling(child->previousSibling());
+        lastAnChild->setNextSibling(child->nextSibling());
+        if (child->previousSibling())
+            child->previousSibling()->setNextSibling(firstAnChild);
+        if (child->nextSibling())
+            child->nextSibling()->setPreviousSibling(lastAnChild);
+    } else {
+        if (child->previousSibling())
+            child->previousSibling()->setNextSibling(child->nextSibling());
+        if (child->nextSibling())
+            child->nextSibling()->setPreviousSibling(child->previousSibling());
+    }
+    if (child == m_children.firstChild())
+        m_children.setFirstChild(firstAnChild);
+    if (child == m_children.lastChild())
+        m_children.setLastChild(lastAnChild);
+    child->setParent(0);
+    child->setPreviousSibling(0);
+    child->setNextSibling(0);
+    
+    child->children()->setFirstChild(0);
+    child->m_next = 0;
+
+    child->destroy();
+}
+
+void RenderBlock::removeChild(RenderObject* oldChild)
 {
     // If this child is a block, and if our previous and next siblings are
     // both anonymous blocks with inline content, then we can go ahead and
@@ -372,7 +500,7 @@ void RenderBlock::removeChild(RenderObject *oldChild)
     RenderObject* prev = oldChild->previousSibling();
     RenderObject* next = oldChild->nextSibling();
     bool canDeleteAnonymousBlocks = !documentBeingDestroyed() && !isInline() && !oldChild->isInline() && 
-                                    !oldChild->continuation() && 
+                                    (!oldChild->isRenderBlock() || !toRenderBlock(oldChild)->inlineContinuation()) && 
                                     (!prev || (prev->isAnonymousBlock() && prev->childrenInline())) &&
                                     (!next || (next->isAnonymousBlock() && next->childrenInline()));
     if (canDeleteAnonymousBlocks && prev && next) {
@@ -380,20 +508,22 @@ void RenderBlock::removeChild(RenderObject *oldChild)
         // the |prev| block.
         prev->setNeedsLayoutAndPrefWidthsRecalc();
         RenderObject* o = next->firstChild();
+    
+        RenderBlock* nextBlock = toRenderBlock(next);
+        RenderBlock* prevBlock = toRenderBlock(prev);
         while (o) {
             RenderObject* no = o;
             o = no->nextSibling();
-            prev->moveChildNode(no);
+            moveChild(prevBlock, prevBlock->children(), nextBlock, nextBlock->children(), no);
         }
  
-        RenderBlock* nextBlock = static_cast<RenderBlock*>(next);
         nextBlock->deleteLineBoxTree();
         
         // Nuke the now-empty block.
         next->destroy();
     }
 
-    RenderFlow::removeChild(oldChild);
+    RenderBox::removeChild(oldChild);
 
     RenderObject* child = prev ? prev : next;
     if (canDeleteAnonymousBlocks && child && !child->previousSibling() && !child->nextSibling() && !isFlexibleBox()) {
@@ -401,13 +531,13 @@ void RenderBlock::removeChild(RenderObject *oldChild)
         // box.  We can go ahead and pull the content right back up into our
         // box.
         setNeedsLayoutAndPrefWidthsRecalc();
-        RenderBlock* anonBlock = static_cast<RenderBlock*>(removeChildNode(child, false));
-        m_childrenInline = true;
+        RenderBlock* anonBlock = toRenderBlock(children()->removeChildNode(this, child, false));
+        setChildrenInline(true);
         RenderObject* o = anonBlock->firstChild();
         while (o) {
             RenderObject* no = o;
             o = no->nextSibling();
-            moveChildNode(no);
+            moveChild(this, children(), anonBlock, anonBlock->children(), no);
         }
 
         // Delete the now-empty block's lines and nuke it.
@@ -422,10 +552,10 @@ int RenderBlock::overflowHeight(bool includeInterior) const
         int shadowHeight = 0;
         for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next)
             shadowHeight = max(boxShadow->y + boxShadow->blur, shadowHeight);
-        int height = m_height + shadowHeight;
+        int inflatedHeight = height() + shadowHeight;
         if (hasReflection())
-            height = max(height, reflectionBox().bottom());
-        return height;
+            inflatedHeight = max(inflatedHeight, reflectionBox().bottom());
+        return inflatedHeight;
     }
     return m_overflowHeight;
 }
@@ -436,10 +566,10 @@ int RenderBlock::overflowWidth(bool includeInterior) const
         int shadowWidth = 0;
         for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next)
             shadowWidth = max(boxShadow->x + boxShadow->blur, shadowWidth);
-        int width = m_width + shadowWidth;
+        int inflatedWidth = width() + shadowWidth;
         if (hasReflection())
-            width = max(width, reflectionBox().right());
-        return width;
+            inflatedWidth = max(inflatedWidth, reflectionBox().right());
+        return inflatedWidth;
     }
     return m_overflowWidth;
 }
@@ -475,7 +605,7 @@ int RenderBlock::overflowTop(bool includeInterior) const
 IntRect RenderBlock::overflowRect(bool includeInterior) const
 {
     if (!includeInterior && hasOverflowClip()) {
-        IntRect box = borderBox();
+        IntRect box = borderBoxRect();
         int shadowLeft = 0;
         int shadowRight = 0;
         int shadowTop = 0;
@@ -508,10 +638,10 @@ IntRect RenderBlock::overflowRect(bool includeInterior) const
     }
 
     if (!includeInterior && hasOverflowClip())
-        return borderBox();
+        return borderBoxRect();
     int l = overflowLeft(includeInterior);
-    int t = min(overflowTop(includeInterior), -borderTopExtra());
-    return IntRect(l, t, overflowWidth(includeInterior) - l, max(overflowHeight(includeInterior), height() + borderBottomExtra()) - t);
+    int t = overflowTop(includeInterior);
+    return IntRect(l, t, overflowWidth(includeInterior) - l, max(overflowHeight(includeInterior), height()) - t);
 }
 
 bool RenderBlock::isSelfCollapsingBlock() const
@@ -522,7 +652,7 @@ bool RenderBlock::isSelfCollapsingBlock() const
     // (c) have border/padding,
     // (d) have a min-height
     // (e) have specified that one of our margins can't collapse using a CSS extension
-    if (m_height > 0 ||
+    if (height() > 0 ||
         isTable() || (borderBottom() + paddingBottom() + borderTop() + paddingTop()) != 0 ||
         style()->minHeight().isPositive() || 
         style()->marginTopCollapse() == MSEPARATE || style()->marginBottomCollapse() == MSEPARATE)
@@ -547,7 +677,7 @@ bool RenderBlock::isSelfCollapsingBlock() const
         
         // Whether or not we collapse is dependent on whether all our normal flow children
         // are also self-collapsing.
-        for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+        for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
             if (child->isFloatingOrPositioned())
                 continue;
             if (!child->isSelfCollapsingBlock())
@@ -570,8 +700,8 @@ void RenderBlock::layout()
     // It's safe to check for control clip here, since controls can never be table cells.
     if (hasControlClip()) {
         // Because of the lightweight clip, there can never be any overflow from children.
-        m_overflowWidth = m_width;
-        m_overflowHeight = m_height;
+        m_overflowWidth = width();
+        m_overflowHeight = height();
         m_overflowLeft = 0;
         m_overflowTop = 0;
     }
@@ -587,35 +717,29 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     if (!relayoutChildren && layoutOnlyPositionedObjects())
         return;
 
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = m_everHadLayout && checkForRepaintDuringLayout();
-    if (checkForRepaint) {
-        oldBounds = absoluteClippedOverflowRect();
-        oldOutlineBox = absoluteOutlineBounds();
-    }
-
-    LayoutStateMaintainer statePusher(view(), this, IntSize(xPos(), yPos()), !m_hasColumns && !hasReflection());
+    LayoutRepainter repainter(*this, m_everHadLayout && checkForRepaintDuringLayout());
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection());
 
-    int oldWidth = m_width;
+    int oldWidth = width();
     int oldColumnWidth = desiredColumnWidth();
 
     calcWidth();
     calcColumnWidth();
 
-    m_overflowWidth = m_width;
+    m_overflowWidth = width();
     m_overflowLeft = 0;
 
-    if (oldWidth != m_width || oldColumnWidth != desiredColumnWidth())
+    if (oldWidth != width() || oldColumnWidth != desiredColumnWidth())
         relayoutChildren = true;
 
     clearFloats();
 
-    int previousHeight = m_height;
-    m_height = 0;
+    int previousHeight = height();
+    setHeight(0);
+
     m_overflowHeight = 0;
 
-    // We use four values, maxTopPos, maxPosNeg, maxBottomPos, and maxBottomNeg, to track
+    // We use four values, maxTopPos, maxTopNeg, maxBottomPos, and maxBottomNeg, to track
     // our current maximal positive and negative margins.  These values are used when we
     // are collapsed with adjacent blocks, so for example, if you have block A and B
     // collapsing together, then you'd take the maximal positive margin from both A and B
@@ -629,11 +753,11 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     if (!isCell) {
         initMaxMarginValues();
 
-        m_topMarginQuirk = style()->marginTop().quirk();
-        m_bottomMarginQuirk = style()->marginBottom().quirk();
+        setTopMarginQuirk(style()->marginTop().quirk());
+        setBottomMarginQuirk(style()->marginBottom().quirk());
 
-        Node* node = element();
-        if (node && node->hasTagName(formTag) && static_cast<HTMLFormElement*>(node)->isMalformed()) {
+        Node* n = node();
+        if (n && n->hasTagName(formTag) && static_cast<HTMLFormElement*>(n)->isMalformed()) {
             // See if this form is malformed (i.e., unclosed). If so, don't give the form
             // a bottom margin.
             setMaxBottomMargins(0, 0);
@@ -643,9 +767,9 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     // For overflow:scroll blocks, ensure we have both scrollbars in place always.
     if (scrollsOverflow()) {
         if (style()->overflowX() == OSCROLL)
-            m_layer->setHasHorizontalScrollbar(true);
+            layer()->setHasHorizontalScrollbar(true);
         if (style()->overflowY() == OSCROLL)
-            m_layer->setHasVerticalScrollbar(true);
+            layer()->setHasVerticalScrollbar(true);
     }
 
     int repaintTop = 0;
@@ -658,25 +782,24 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
 
     // Expand our intrinsic height to encompass floats.
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
-    if (floatBottom() > (m_height - toAdd) && (isInlineBlockOrInlineTable() || isFloatingOrPositioned() || hasOverflowClip() ||
-                                    (parent() && parent()->isFlexibleBox() || m_hasColumns)))
-        m_height = floatBottom() + toAdd;
+    if (floatBottom() > (height() - toAdd) && expandsToEncloseOverhangingFloats())
+        setHeight(floatBottom() + toAdd);
     
     // Now lay out our columns within this intrinsic height, since they can slightly affect the intrinsic height as
     // we adjust for clean column breaks.
     int singleColumnBottom = layoutColumns();
 
     // Calculate our new height.
-    int oldHeight = m_height;
+    int oldHeight = height();
     calcHeight();
-    if (oldHeight != m_height) {
-        if (oldHeight > m_height && maxFloatBottom > m_height && !childrenInline()) {
+    if (oldHeight != height()) {
+        if (oldHeight > height() && maxFloatBottom > height() && !childrenInline()) {
             // One of our children's floats may have become an overhanging float for us. We need to look for it.
             for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
                 if (child->isBlockFlow() && !child->isFloatingOrPositioned()) {
-                    RenderBlock* block = static_cast<RenderBlock*>(child);
-                    if (block->floatBottom() + block->yPos() > m_height)
-                        addOverhangingFloats(block, -block->xPos(), -block->yPos(), false);
+                    RenderBlock* block = toRenderBlock(child);
+                    if (block->floatBottom() + block->y() > height())
+                        addOverhangingFloats(block, -block->x(), -block->y(), false);
                 }
             }
         }
@@ -684,21 +807,14 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
         layoutColumns(singleColumnBottom);
 
         // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > m_height)
+        if (m_overflowHeight > height())
             m_overflowHeight -= toAdd;
-        if (m_overflowHeight < m_height)
-            m_overflowHeight = m_height;
+        if (m_overflowHeight < height())
+            m_overflowHeight = height();
     }
-    if (previousHeight != m_height)
+    if (previousHeight != height())
         relayoutChildren = true;
 
-    // Some classes of objects (floats and fieldsets with no specified heights and table cells) expand to encompass
-    // overhanging floats.
-    if (hasOverhangingFloats() && expandsToEncloseOverhangingFloats()) {
-        m_height = floatBottom();
-        m_height += borderBottom() + paddingBottom();
-    }
-
     if ((isCell || isInline() || isFloatingOrPositioned() || isRoot()) && !hasOverflowClip() && !hasControlClip())
         addVisualOverflow(floatRect());
 
@@ -707,15 +823,15 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     positionListMarker();
 
     // Always ensure our overflow width/height are at least as large as our width/height.
-    m_overflowWidth = max(m_overflowWidth, m_width);
-    m_overflowHeight = max(m_overflowHeight, m_height);
+    m_overflowWidth = max(m_overflowWidth, width());
+    m_overflowHeight = max(m_overflowHeight, height());
 
     if (!hasOverflowClip()) {
         for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
             m_overflowLeft = min(m_overflowLeft, boxShadow->x - boxShadow->blur);
-            m_overflowWidth = max(m_overflowWidth, m_width + boxShadow->x + boxShadow->blur);
+            m_overflowWidth = max(m_overflowWidth, width() + boxShadow->x + boxShadow->blur);
             m_overflowTop = min(m_overflowTop, boxShadow->y - boxShadow->blur);
-            m_overflowHeight = max(m_overflowHeight, m_height + boxShadow->y + boxShadow->blur);
+            m_overflowHeight = max(m_overflowHeight, height() + boxShadow->y + boxShadow->blur);
         }
         
         if (hasReflection()) {
@@ -729,12 +845,10 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     // Update our scroll information if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
     if (hasOverflowClip())
-        m_layer->updateScrollInfoAfterLayout();
+        layer()->updateScrollInfoAfterLayout();
 
     // Repaint with our new bounds if they are different from our old bounds.
-    bool didFullRepaint = false;
-    if (checkForRepaint)
-        didFullRepaint = repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
+    bool didFullRepaint = repainter.repaintAfterLayout();
     if (!didFullRepaint && repaintTop != repaintBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
         IntRect repaintRect(m_overflowLeft, repaintTop, m_overflowWidth - m_overflowLeft, repaintBottom - repaintTop);
 
@@ -752,30 +866,35 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
             repaintRect.setY(y);
 
             // Don't allow this rect to spill out of our overflow box.
-            repaintRect.intersect(IntRect(0, 0, m_width, m_height));
+            repaintRect.intersect(IntRect(0, 0, width(), height()));
         }
 
         // Make sure the rect is still non-empty after intersecting for overflow above
         if (!repaintRect.isEmpty()) {
             repaintRectangle(repaintRect); // We need to do a partial repaint of our content.
             if (hasReflection())
-                layer()->reflection()->repaintRectangle(repaintRect);
+                repaintRectangle(reflectedRect(repaintRect));
         }
     }
     setNeedsLayout(false);
 }
 
-void RenderBlock::adjustPositionedBlock(RenderObject* child, const MarginInfo& marginInfo)
+bool RenderBlock::expandsToEncloseOverhangingFloats() const
+{
+    return isInlineBlockOrInlineTable() || isFloatingOrPositioned() || hasOverflowClip() || (parent() && parent()->isFlexibleBox()) || hasColumns() || isTableCell() || isFieldset();
+}
+
+void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marginInfo)
 {
-    if (child->hasStaticX()) {
+    if (child->style()->hasStaticX()) {
         if (style()->direction() == LTR)
-            child->setStaticX(borderLeft() + paddingLeft());
+            child->layer()->setStaticX(borderLeft() + paddingLeft());
         else
-            child->setStaticX(borderRight() + paddingRight());
+            child->layer()->setStaticX(borderRight() + paddingRight());
     }
 
-    if (child->hasStaticY()) {
-        int y = m_height;
+    if (child->style()->hasStaticY()) {
+        int y = height();
         if (!marginInfo.canCollapseWithTop()) {
             child->calcVerticalMargins();
             int marginTop = child->marginTop();
@@ -790,7 +909,7 @@ void RenderBlock::adjustPositionedBlock(RenderObject* child, const MarginInfo& m
             }
             y += (collapsedTopPos - collapsedTopNeg) - marginTop;
         }
-        child->setStaticY(y);
+        child->layer()->setStaticY(y);
     }
 }
 
@@ -810,143 +929,95 @@ void RenderBlock::adjustFloatingBlock(const MarginInfo& marginInfo)
     // http://www.hixie.ch/tests/adhoc/css/box/block/margin-collapse/046.html for
     // an example of this scenario.
     int marginOffset = marginInfo.canCollapseWithTop() ? 0 : marginInfo.margin();
-    m_height += marginOffset;
+    setHeight(height() + marginOffset);
     positionNewFloats();
-    m_height -= marginOffset;
+    setHeight(height() - marginOffset);
 }
 
-RenderObject* RenderBlock::handleSpecialChild(RenderObject* child, const MarginInfo& marginInfo, CompactInfo& compactInfo, bool& handled)
+bool RenderBlock::handleSpecialChild(RenderBox* child, const MarginInfo& marginInfo)
 {
-    // Handle positioned children first.
-    RenderObject* next = handlePositionedChild(child, marginInfo, handled);
-    if (handled) return next;
-    
-    // Handle floating children next.
-    next = handleFloatingChild(child, marginInfo, handled);
-    if (handled) return next;
-
-    // See if we have a compact element.  If we do, then try to tuck the compact element into the margin space of the next block.
-    next = handleCompactChild(child, compactInfo, handled);
-    if (handled) return next;
-
-    // Finally, see if we have a run-in element.
-    return handleRunInChild(child, handled);
+    // Handle in the given order
+    return handlePositionedChild(child, marginInfo)
+        || handleFloatingChild(child, marginInfo)
+        || handleRunInChild(child);
 }
 
 
-RenderObject* RenderBlock::handlePositionedChild(RenderObject* child, const MarginInfo& marginInfo, bool& handled)
+bool RenderBlock::handlePositionedChild(RenderBox* child, const MarginInfo& marginInfo)
 {
     if (child->isPositioned()) {
-        handled = true;
         child->containingBlock()->insertPositionedObject(child);
         adjustPositionedBlock(child, marginInfo);
-        return child->nextSibling();
+        return true;
     }
-
-    return 0;
+    return false;
 }
 
-RenderObject* RenderBlock::handleFloatingChild(RenderObject* child, const MarginInfo& marginInfo, bool& handled)
+bool RenderBlock::handleFloatingChild(RenderBox* child, const MarginInfo& marginInfo)
 {
     if (child->isFloating()) {
-        handled = true;
         insertFloatingObject(child);
         adjustFloatingBlock(marginInfo);
-        return child->nextSibling();
-    }
-    
-    return 0;
-}
-
-RenderObject* RenderBlock::handleCompactChild(RenderObject* child, CompactInfo& compactInfo, bool& handled)
-{
-    // FIXME: We only deal with one compact at a time.  It is unclear what should be
-    // done if multiple contiguous compacts are encountered.  For now we assume that
-    // compact A followed by another compact B should simply be treated as block A.
-    if (child->isCompact() && !compactInfo.compact() && (child->childrenInline() || child->isReplaced())) {
-        // Get the next non-positioned/non-floating RenderBlock.
-        RenderObject* next = child->nextSibling();
-        RenderObject* curr = next;
-        while (curr && curr->isFloatingOrPositioned())
-            curr = curr->nextSibling();
-        if (curr && curr->isRenderBlock() && !curr->isCompact() && !curr->isRunIn()) {
-            curr->calcWidth(); // So that horizontal margins are correct.
-                               
-            child->setInline(true); // Need to compute the margins/width for the child as though it is an inline, so that it won't try to puff up the margins to
-                                    // fill the containing block width.
-            child->calcWidth();
-            int childMargins = child->marginLeft() + child->marginRight();
-            int margin = style()->direction() == LTR ? curr->marginLeft() : curr->marginRight();
-            if (margin >= (childMargins + child->maxPrefWidth())) {
-                // The compact will fit in the margin.
-                handled = true;
-                compactInfo.set(child, curr);
-                child->setPos(0,0); // This position will be updated to reflect the compact's
-                                    // desired position and the line box for the compact will
-                                    // pick that position up.
-                
-                // Remove the child.
-                RenderObject* next = child->nextSibling();
-                removeChildNode(child);
-                
-                // Now insert the child under |curr|.
-                curr->insertChildNode(child, curr->firstChild());
-                return next;
-            }
-            else
-                child->setInline(false); // We didn't fit, so we remain a block-level element.
-        }
-    }
-    return 0;
-}
-
-void RenderBlock::insertCompactIfNeeded(RenderObject* child, CompactInfo& compactInfo)
-{
-    if (compactInfo.matches(child)) {
-        // We have a compact child to squeeze in.
-        RenderObject* compactChild = compactInfo.compact();
-        int compactXPos = borderLeft() + paddingLeft() + compactChild->marginLeft();
-        if (style()->direction() == RTL) {
-            compactChild->calcWidth(); // have to do this because of the capped maxwidth
-            compactXPos = width() - borderRight() - paddingRight() - marginRight() -
-                compactChild->width() - compactChild->marginRight();
-        }
-        compactXPos -= child->xPos(); // Put compactXPos into the child's coordinate space.
-        compactChild->setPos(compactXPos, compactChild->yPos()); // Set the x position.
-        compactInfo.clear();
+        return true;
     }
+    return false;
 }
 
-RenderObject* RenderBlock::handleRunInChild(RenderObject* child, bool& handled)
+bool RenderBlock::handleRunInChild(RenderBox* child)
 {
     // See if we have a run-in element with inline children.  If the
     // children aren't inline, then just treat the run-in as a normal
     // block.
-    if (child->isRunIn() && (child->childrenInline() || child->isReplaced())) {
-        // Get the next non-positioned/non-floating RenderBlock.
-        RenderObject* curr = child->nextSibling();
-        while (curr && curr->isFloatingOrPositioned())
-            curr = curr->nextSibling();
-        if (curr && (curr->isRenderBlock() && curr->childrenInline() && !curr->isCompact() && !curr->isRunIn())) {
-            // The block acts like an inline, so just null out its
-            // position.
-            handled = true;
-            child->setInline(true);
-            child->setPos(0,0);
-            
-            // Remove the child.
-            RenderObject* next = child->nextSibling();
-            removeChildNode(child);
-            
-            // Now insert the child under |curr|.
-            curr->insertChildNode(child, curr->firstChild());
-            return next;
+    if (!child->isRunIn() || !child->childrenInline() && !child->isReplaced())
+        return false;
+
+    RenderBlock* blockRunIn = toRenderBlock(child);
+    // Get the next non-positioned/non-floating RenderBlock.
+    RenderObject* curr = blockRunIn->nextSibling();
+    while (curr && curr->isFloatingOrPositioned())
+        curr = curr->nextSibling();
+
+    if (!curr || !curr->isRenderBlock() || !curr->childrenInline() || curr->isRunIn())
+        return false;
+
+    RenderBlock* currBlock = toRenderBlock(curr);
+
+    // Remove the old child.
+    children()->removeChildNode(this, blockRunIn);
+
+    // Create an inline.
+    Node* runInNode = blockRunIn->node();
+    RenderInline* inlineRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document());
+    inlineRunIn->setStyle(blockRunIn->style());
+
+    bool runInIsGenerated = child->style()->styleType() == BEFORE || child->style()->styleType() == AFTER;
+
+    // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
+    // been regenerated by the new inline.
+    for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
+        if (runInIsGenerated || runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
+            blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
+            inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
         }
     }
-    return 0;
+
+    // Now insert the new child under |currBlock|.
+    currBlock->children()->insertChildNode(currBlock, inlineRunIn, currBlock->firstChild());
+    
+    // If the run-in had an element, we need to set the new renderer.
+    if (runInNode)
+        runInNode->setRenderer(inlineRunIn);
+
+    // Destroy the block run-in.
+    blockRunIn->destroy();
+
+    // The block acts like an inline, so just null out its
+    // position.
+    
+    return true;
 }
 
-void RenderBlock::collapseMargins(RenderObject* child, MarginInfo& marginInfo, int yPosEstimate)
+int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
 {
     // Get our max pos and neg top margins.
     int posTop = child->maxTopMargin(true);
@@ -975,7 +1046,7 @@ void RenderBlock::collapseMargins(RenderObject* child, MarginInfo& marginInfo, i
         // has an example of this, a <dt> with 0.8em author-specified inside
         // a <dl> inside a <td>.
         if (!marginInfo.determinedTopQuirk() && !topQuirk && (posTop-negTop)) {
-            m_topMarginQuirk = false;
+            setTopMarginQuirk(false);
             marginInfo.setDeterminedTopQuirk(true);
         }
 
@@ -985,13 +1056,13 @@ void RenderBlock::collapseMargins(RenderObject* child, MarginInfo& marginInfo, i
             // This deals with the <td><div><p> case.
             // Don't do this for a block that split two inlines though.  You do
             // still apply margins in this case.
-            m_topMarginQuirk = true;
+            setTopMarginQuirk(true);
     }
 
     if (marginInfo.quirkContainer() && marginInfo.atTopOfBlock() && (posTop - negTop))
         marginInfo.setTopQuirk(topQuirk);
 
-    int ypos = m_height;
+    int ypos = height();
     if (child->isSelfCollapsingBlock()) {
         // This child has no height.  We need to compute our
         // position before we collapse the child's margins together,
@@ -1010,20 +1081,20 @@ void RenderBlock::collapseMargins(RenderObject* child, MarginInfo& marginInfo, i
             // is correct, since it could have overflowing content
             // that needs to be positioned correctly (e.g., a block that
             // had a specified height of 0 but that actually had subcontent).
-            ypos = m_height + collapsedTopPos - collapsedTopNeg;
+            ypos = height() + collapsedTopPos - collapsedTopNeg;
     }
     else {
         if (child->style()->marginTopCollapse() == MSEPARATE) {
-            m_height += marginInfo.margin() + child->marginTop();
-            ypos = m_height;
+            setHeight(height() + marginInfo.margin() + child->marginTop());
+            ypos = height();
         }
         else if (!marginInfo.atTopOfBlock() ||
             (!marginInfo.canCollapseTopWithChildren()
              && (!style()->htmlHacks() || !marginInfo.quirkContainer() || !marginInfo.topQuirk()))) {
             // We're collapsing with a previous sibling's margins and not
             // with the top of the block.
-            m_height += max(marginInfo.posMargin(), posTop) - max(marginInfo.negMargin(), negTop);
-            ypos = m_height;
+            setHeight(height() + max(marginInfo.posMargin(), posTop) - max(marginInfo.negMargin(), negTop));
+            ypos = height();
         }
 
         marginInfo.setPosMargin(child->maxBottomMargin(true));
@@ -1034,34 +1105,15 @@ void RenderBlock::collapseMargins(RenderObject* child, MarginInfo& marginInfo, i
 
         marginInfo.setSelfCollapsingBlockClearedFloat(false);
     }
-
-    view()->addLayoutDelta(IntSize(0, yPosEstimate - ypos));
-    child->setPos(child->xPos(), ypos);
-    if (ypos != yPosEstimate) {
-        if (child->shrinkToAvoidFloats())
-            // The child's width depends on the line width.
-            // When the child shifts to clear an item, its width can
-            // change (because it has more available line width).
-            // So go ahead and mark the item as dirty.
-            child->setChildNeedsLayout(true, false);
-
-        if (!child->avoidsFloats() && child->containsFloats())
-            child->markAllDescendantsWithFloatsForLayout();
-
-        // Our guess was wrong. Make the child lay itself out again.
-        child->layoutIfNeeded();
-    }
+    
+    return ypos;
 }
 
-void RenderBlock::clearFloatsIfNeeded(RenderObject* child, MarginInfo& marginInfo, int oldTopPosMargin, int oldTopNegMargin)
+int RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, int oldTopPosMargin, int oldTopNegMargin, int yPos)
 {
-    int heightIncrease = getClearDelta(child);
+    int heightIncrease = getClearDelta(child, yPos);
     if (!heightIncrease)
-        return;
-
-    // The child needs to be lowered.  Move the child so that it just clears the float.
-    view()->addLayoutDelta(IntSize(0, -heightIncrease));
-    child->setPos(child->xPos(), child->yPos() + heightIncrease);
+        return yPos;
 
     if (child->isSelfCollapsingBlock()) {
         // For self-collapsing blocks that clear, they can still collapse their
@@ -1071,7 +1123,7 @@ void RenderBlock::clearFloatsIfNeeded(RenderObject* child, MarginInfo& marginInf
         marginInfo.setNegMargin(max(child->maxTopMargin(false), child->maxBottomMargin(false)));
         
         // Adjust our height such that we are ready to be collapsed with subsequent siblings.
-        m_height = child->yPos() - max(0, marginInfo.margin());
+        setHeight(child->y() - max(0, marginInfo.margin()));
         
         // Set a flag that we cleared a float so that we know both to increase the height of the block
         // to compensate for the clear and to avoid collapsing our margins with the parent block's
@@ -1079,7 +1131,7 @@ void RenderBlock::clearFloatsIfNeeded(RenderObject* child, MarginInfo& marginInf
         marginInfo.setSelfCollapsingBlockClearedFloat(true);
     } else
         // Increase our height by the amount we had to clear.
-        m_height += heightIncrease;
+        setHeight(height() + heightIncrease);
     
     if (marginInfo.canCollapseWithTop()) {
         // We can no longer collapse with the top of the block since a clear
@@ -1090,34 +1142,24 @@ void RenderBlock::clearFloatsIfNeeded(RenderObject* child, MarginInfo& marginInf
         setMaxTopMargins(oldTopPosMargin, oldTopNegMargin);
         marginInfo.setAtTopOfBlock(false);
     }
-
-    // If our value of clear caused us to be repositioned vertically to be
-    // underneath a float, we might have to do another layout to take into account
-    // the extra space we now have available.
-    if (child->shrinkToAvoidFloats())
-        // The child's width depends on the line width.
-        // When the child shifts to clear an item, its width can
-        // change (because it has more available line width).
-        // So go ahead and mark the item as dirty.
-        child->setChildNeedsLayout(true, false);
-    if (!child->avoidsFloats() && child->containsFloats())
-        child->markAllDescendantsWithFloatsForLayout();
-    child->layoutIfNeeded();
+    
+    return yPos + heightIncrease;
 }
 
-int RenderBlock::estimateVerticalPosition(RenderObject* child, const MarginInfo& marginInfo)
+int RenderBlock::estimateVerticalPosition(RenderBox* child, const MarginInfo& marginInfo)
 {
     // FIXME: We need to eliminate the estimation of vertical position, because when it's wrong we sometimes trigger a pathological
     // relayout if there are intruding floats.
-    int yPosEstimate = m_height;
+    int yPosEstimate = height();
     if (!marginInfo.canCollapseWithTop()) {
         int childMarginTop = child->selfNeedsLayout() ? child->marginTop() : child->collapsedMarginTop();
         yPosEstimate += max(marginInfo.margin(), childMarginTop);
     }
+    yPosEstimate += getClearDelta(child, yPosEstimate);
     return yPosEstimate;
 }
 
-void RenderBlock::determineHorizontalPosition(RenderObject* child)
+void RenderBlock::determineHorizontalPosition(RenderBox* child)
 {
     if (style()->direction() == LTR) {
         int xPos = borderLeft() + paddingLeft();
@@ -1128,7 +1170,7 @@ void RenderBlock::determineHorizontalPosition(RenderObject* child)
         // Some objects (e.g., tables, horizontal rules, overflow:auto blocks) avoid floats.  They need
         // to shift over as necessary to dodge any floats that might get in the way.
         if (child->avoidsFloats()) {
-            int leftOff = leftOffset(m_height);
+            int leftOff = leftOffset(height(), false);
             if (style()->textAlign() != WEBKIT_CENTER && child->style()->marginLeft().type() != Auto) {
                 if (child->marginLeft() < 0)
                     leftOff += child->marginLeft();
@@ -1140,17 +1182,17 @@ void RenderBlock::determineHorizontalPosition(RenderObject* child)
                 // width computation will take into account the delta between |leftOff| and |xPos|
                 // so that we can just pass the content width in directly to the |calcHorizontalMargins|
                 // function.
-                static_cast<RenderBox*>(child)->calcHorizontalMargins(child->style()->marginLeft(), child->style()->marginRight(), lineWidth(child->yPos()));
+                child->calcHorizontalMargins(child->style()->marginLeft(), child->style()->marginRight(), lineWidth(child->y(), false));
                 chPos = leftOff + child->marginLeft();
             }
         }
-        view()->addLayoutDelta(IntSize(child->xPos() - chPos, 0));
-        child->setPos(chPos, child->yPos());
+        view()->addLayoutDelta(IntSize(child->x() - chPos, 0));
+        child->setLocation(chPos, child->y());
     } else {
-        int xPos = m_width - borderRight() - paddingRight() - verticalScrollbarWidth();
+        int xPos = width() - borderRight() - paddingRight() - verticalScrollbarWidth();
         int chPos = xPos - (child->width() + child->marginRight());
         if (child->avoidsFloats()) {
-            int rightOff = rightOffset(m_height);
+            int rightOff = rightOffset(height(), false);
             if (style()->textAlign() != WEBKIT_CENTER && child->style()->marginRight().type() != Auto) {
                 if (child->marginRight() < 0)
                     rightOff -= child->marginRight();
@@ -1161,12 +1203,12 @@ void RenderBlock::determineHorizontalPosition(RenderObject* child)
                 // width computation will take into account the delta between |rightOff| and |xPos|
                 // so that we can just pass the content width in directly to the |calcHorizontalMargins|
                 // function.
-                static_cast<RenderBox*>(child)->calcHorizontalMargins(child->style()->marginLeft(), child->style()->marginRight(), lineWidth(child->yPos()));
+                child->calcHorizontalMargins(child->style()->marginLeft(), child->style()->marginRight(), lineWidth(child->y(), false));
                 chPos = rightOff - child->marginRight() - child->width();
             }
         }
-        view()->addLayoutDelta(IntSize(child->xPos() - chPos, 0));
-        child->setPos(chPos, child->yPos());
+        view()->addLayoutDelta(IntSize(child->x() - chPos, 0));
+        child->setLocation(chPos, child->y());
     }
 }
 
@@ -1178,13 +1220,13 @@ void RenderBlock::setCollapsedBottomMargin(const MarginInfo& marginInfo)
         setMaxBottomMargins(max(maxBottomPosMargin(), marginInfo.posMargin()), max(maxBottomNegMargin(), marginInfo.negMargin()));
 
         if (!marginInfo.bottomQuirk())
-            m_bottomMarginQuirk = false;
+            setBottomMarginQuirk(false);
 
         if (marginInfo.bottomQuirk() && marginBottom() == 0)
             // We have no bottom margin and our last child has a quirky margin.
             // We will pick up this quirky margin and pass it through.
             // This deals with the <td><div><p> case.
-            m_bottomMarginQuirk = true;
+            setBottomMarginQuirk(true);
     }
 }
 
@@ -1205,17 +1247,17 @@ void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInf
     // If we can't collapse with children then go ahead and add in the bottom margin.
     if (!marginInfo.canCollapseWithBottom() && !marginInfo.canCollapseWithTop()
         && (!style()->htmlHacks() || !marginInfo.quirkContainer() || !marginInfo.bottomQuirk()))
-        m_height += marginInfo.margin();
+        setHeight(height() + marginInfo.margin());
         
     // Now add in our bottom border/padding.
-    m_height += bottom;
+    setHeight(height() + bottom);
 
     // Negative margins can cause our height to shrink below our minimal height (border/padding).
     // If this happens, ensure that the computed height is increased to the minimal height.
-    m_height = max(m_height, top + bottom);
+    setHeight(max(height(), top + bottom));
 
     // Always make sure our overflow height is at least our height.
-    m_overflowHeight = max(m_height, m_overflowHeight);
+    m_overflowHeight = max(height(), m_overflowHeight);
 
     // Update our bottom collapsed margin info.
     setCollapsedBottomMargin(marginInfo);
@@ -1244,11 +1286,11 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
     int top = borderTop() + paddingTop();
     int bottom = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
 
-    m_height = m_overflowHeight = top;
+    m_overflowHeight = top;
+    setHeight(m_overflowHeight);
 
     // The margin struct caches all our current margin collapsing state.  The compact struct caches state when we encounter compacts,
     MarginInfo marginInfo(this, top, bottom);
-    CompactInfo compactInfo;
 
     // Fieldsets need to find their legend and position it inside the border of the object.
     // The legend then gets skipped during normal layout.
@@ -1257,12 +1299,14 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
     int previousFloatBottom = 0;
     maxFloatBottom = 0;
 
-    RenderObject* child = firstChild();
-    while (child) {
-        if (legend == child) {
-            child = child->nextSibling();
+    RenderBox* next = firstChildBox();
+
+    while (next) {
+        RenderBox* child = next;
+        next = child->nextSiblingBox();
+
+        if (legend == child)
             continue; // Skip the legend, since it has already been positioned up in the fieldset's border.
-        }
 
         int oldTopPosMargin = maxTopPosMargin();
         int oldTopNegMargin = maxTopNegMargin();
@@ -1279,12 +1323,8 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
 
         // Handle the four types of special elements first.  These include positioned content, floating content, compacts and
         // run-ins.  When we encounter these four types of objects, we don't actually lay them out as normal flow blocks.
-        bool handled = false;
-        RenderObject* next = handleSpecialChild(child, marginInfo, compactInfo, handled);
-        if (handled) {
-            child = next;
+        if (handleSpecialChild(child, marginInfo))
             continue;
-        }
 
         // The child is a normal flow object.  Compute its vertical margins now.
         child->calcVerticalMargins();
@@ -1301,28 +1341,31 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         int yPosEstimate = estimateVerticalPosition(child, marginInfo);
 
         // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
-        IntRect oldRect(child->xPos(), child->yPos() , child->width(), child->height());
-          
+        IntRect oldRect(child->x(), child->y() , child->width(), child->height());
+#ifndef NDEBUG
+        IntSize oldLayoutDelta = view()->layoutDelta();
+#endif
         // Go ahead and position the child as though it didn't collapse with the top.
-        view()->addLayoutDelta(IntSize(0, child->yPos() - yPosEstimate));
-        child->setPos(child->xPos(), yPosEstimate);
+        view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
+        child->setLocation(child->x(), yPosEstimate);
 
         bool markDescendantsWithFloats = false;
-        if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->containsFloats())
+        if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
             markDescendantsWithFloats = true;
         else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
             // If an element might be affected by the presence of floats, then always mark it for
             // layout.
             int fb = max(previousFloatBottom, floatBottom());
-            if (fb > m_height || fb > yPosEstimate)
+            if (fb > yPosEstimate)
                 markDescendantsWithFloats = true;
         }
 
-        if (markDescendantsWithFloats)
-            child->markAllDescendantsWithFloatsForLayout();
+        if (child->isRenderBlock()) {
+            if (markDescendantsWithFloats)
+                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
 
-        if (child->isRenderBlock())
-            previousFloatBottom = max(previousFloatBottom, oldRect.y() + static_cast<RenderBlock*>(child)->floatBottom());
+            previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
+        }
 
         bool childHadLayout = child->m_everHadLayout;
         bool childNeededLayout = child->needsLayout();
@@ -1331,10 +1374,28 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
 
         // Now determine the correct ypos based off examination of collapsing margin
         // values.
-        collapseMargins(child, marginInfo, yPosEstimate);
+        int yBeforeClear = collapseMargins(child, marginInfo);
 
         // Now check for clear.
-        clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin);
+        int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
+        
+        view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
+        child->setLocation(child->x(), yAfterClear);
+    
+        // Now we have a final y position.  See if it really does end up being different from our estimate.
+        if (yAfterClear != yPosEstimate) {
+            if (child->shrinkToAvoidFloats()) {
+                // The child's width depends on the line width.
+                // When the child shifts to clear an item, its width can
+                // change (because it has more available line width).
+                // So go ahead and mark the item as dirty.
+                child->setChildNeedsLayout(true, false);
+            }
+            if (!child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
+            // Our guess was wrong. Make the child lay itself out again.
+            child->layoutIfNeeded();
+        }
 
         // We are no longer at the top of the block if we encounter a non-empty child.  
         // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
@@ -1345,25 +1406,26 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         determineHorizontalPosition(child);
 
         // Update our height now that the child has been placed in the correct position.
-        m_height += child->height();
+        setHeight(height() + child->height());
         if (child->style()->marginBottomCollapse() == MSEPARATE) {
-            m_height += child->marginBottom();
+            setHeight(height() + child->marginBottom());
             marginInfo.clearMargin();
         }
         // If the child has overhanging floats that intrude into following siblings (or possibly out
         // of this block), then the parent gets notified of the floats now.
-        maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(static_cast<RenderBlock *>(child), -child->xPos(), -child->yPos(), !childNeededLayout));
-
-        // Update our overflow in case the child spills out the block.
-        m_overflowTop = min(m_overflowTop, child->yPos() + child->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, m_height + child->overflowHeight(false) - child->height());
-        m_overflowWidth = max(child->xPos() + child->overflowWidth(false), m_overflowWidth);
-        m_overflowLeft = min(child->xPos() + child->overflowLeft(false), m_overflowLeft);
-        
-        // Insert our compact into the block margin if we have one.
-        insertCompactIfNeeded(child, compactInfo);
+        if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+            maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
+
+        // Update our visual overflow in case the child spills out the block, but only if we were going to paint
+        // the child block ourselves.
+        if (!child->hasSelfPaintingLayer()) {
+            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
+            m_overflowHeight = max(m_overflowHeight, height() + child->overflowHeight(false) - child->height());
+            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
+            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
+        }
 
-        IntSize childOffset(child->xPos() - oldRect.x(), child->yPos() - oldRect.y());
+        IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
         if (childOffset.width() || childOffset.height()) {
             view()->addLayoutDelta(childOffset);
 
@@ -1377,7 +1439,7 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         if (!childHadLayout && child->checkForRepaintDuringLayout())
             child->repaint();
 
-        child = child->nextSibling();
+        ASSERT(oldLayoutDelta == view()->layoutDelta());
     }
 
     // Now do the handling of the bottom of the block, adding in our bottom border/padding and
@@ -1390,7 +1452,7 @@ bool RenderBlock::layoutOnlyPositionedObjects()
     if (!posChildNeedsLayout() || normalChildNeedsLayout() || selfNeedsLayout())
         return false;
 
-    LayoutStateMaintainer statePusher(view(), this, IntSize(xPos(), yPos()), !m_hasColumns);
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection());
 
     if (needsPositionedMovementLayout()) {
         tryLayoutDoingPositionedMovementOnly();
@@ -1404,7 +1466,7 @@ bool RenderBlock::layoutOnlyPositionedObjects()
     statePusher.pop();
 
     if (hasOverflowClip())
-        m_layer->updateScrollInfoAfterLayout();
+        layer()->updateScrollInfoAfterLayout();
 
     setNeedsLayout(false);
     return true;
@@ -1413,7 +1475,7 @@ bool RenderBlock::layoutOnlyPositionedObjects()
 void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
 {
     if (m_positionedObjects) {
-        RenderObject* r;
+        RenderBox* r;
         Iterator end = m_positionedObjects->end();
         for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
             r = *it;
@@ -1421,11 +1483,11 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
             // non-positioned block.  Rather than trying to detect all of these movement cases, we just always lay out positioned
             // objects that are positioned implicitly like this.  Such objects are rare, and so in typical DHTML menu usage (where everything is
             // positioned explicitly) this should not incur a performance penalty.
-            if (relayoutChildren || (r->hasStaticY() && r->parent() != this && r->parent()->isBlockFlow()))
+            if (relayoutChildren || (r->style()->hasStaticY() && r->parent() != this && r->parent()->isBlockFlow()))
                 r->setChildNeedsLayout(true, false);
                 
             // If relayoutChildren is set and we have percentage padding, we also need to invalidate the child's pref widths.
-            if (relayoutChildren && (r->style()->paddingLeft().isPercent() || r->style()->paddingRight().isPercent()))
+            //if (relayoutChildren && (r->style()->paddingLeft().isPercent() || r->style()->paddingRight().isPercent()))
                 r->setPrefWidthsDirty(true, false);
             
             // We don't have to do a full layout.  We just have to update our position. Try that first. If we have shrink-to-fit width
@@ -1440,7 +1502,7 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
 void RenderBlock::markPositionedObjectsForLayout()
 {
     if (m_positionedObjects) {
-        RenderObject* r;
+        RenderBox* r;
         Iterator end = m_positionedObjects->end();
         for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
             r = *it;
@@ -1469,7 +1531,7 @@ void RenderBlock::repaintOverhangingFloats(bool paintAllDescendants)
             // Only repaint the object if it is overhanging, is not in its own layer, and
             // is our responsibility to paint (m_shouldPaint is set). When paintAllDescendants is true, the latter
             // condition is replaced with being a descendant of us.
-            if (r->m_bottom > m_height && (paintAllDescendants && r->m_renderer->isDescendantOf(this) || r->m_shouldPaint) && !r->m_renderer->hasLayer()) {                
+            if (r->m_bottom > height() && ((paintAllDescendants && r->m_renderer->isDescendantOf(this)) || r->m_shouldPaint) && !r->m_renderer->hasSelfPaintingLayer()) {
                 r->m_renderer->repaint();
                 r->m_renderer->repaintOverhangingFloats();
             }
@@ -1477,18 +1539,18 @@ void RenderBlock::repaintOverhangingFloats(bool paintAllDescendants)
         view()->enableLayoutState();
     }
 }
-
+ 
 void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
     
     PaintPhase phase = paintInfo.phase;
 
     // Check if we need to do anything at all.
     // FIXME: Could eliminate the isRoot() check if we fix background painting so that the RenderView
     // paints the root's background.
-    if (!isInlineFlow() && !isRoot()) {
+    if (!isRoot()) {
         IntRect overflowBox = overflowRect(false);
         overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
         overflowBox.move(tx, ty);
@@ -1496,52 +1558,69 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
             return;
     }
 
-    bool useControlClip = phase != PaintPhaseBlockBackground && phase != PaintPhaseSelfOutline && phase != PaintPhaseMask && hasControlClip();
+    bool pushedClip = pushContentsClip(paintInfo, tx, ty);
+    paintObject(paintInfo, tx, ty);
+    if (pushedClip)
+        popContentsClip(paintInfo, phase, tx, ty);
 
-    // Push a clip.
-    if (useControlClip) {
-        if (phase == PaintPhaseOutline)
-            paintInfo.phase = PaintPhaseChildOutlines;
-        else if (phase == PaintPhaseChildBlockBackground) {
-            paintInfo.phase = PaintPhaseBlockBackground;
-            paintObject(paintInfo, tx, ty);
-            paintInfo.phase = PaintPhaseChildBlockBackgrounds;
-        }
-        IntRect clipRect(controlClipRect(tx, ty));
-        if (clipRect.isEmpty())
-            return;
-        paintInfo.context->save();
-        paintInfo.context->clip(clipRect);
-    }
+    // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
+    // z-index.  We paint after we painted the background/border, so that the scrollbars will
+    // sit above the background/border.
+    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground))
+        layer()->paintOverflowControls(paintInfo.context, tx, ty, paintInfo.rect);
+}
 
-    paintObject(paintInfo, tx, ty);
-    
-    // Pop the clip.
-    if (useControlClip) {
-        paintInfo.context->restore();
-        if (phase == PaintPhaseOutline) {
-            paintInfo.phase = PaintPhaseSelfOutline;
-            paintObject(paintInfo, tx, ty);
-            paintInfo.phase = phase;
-        } else if (phase == PaintPhaseChildBlockBackground)
-            paintInfo.phase = phase;
+void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
+{
+    const Color& ruleColor = style()->columnRuleColor();
+    bool ruleTransparent = style()->columnRuleIsTransparent();
+    EBorderStyle ruleStyle = style()->columnRuleStyle();
+    int ruleWidth = style()->columnRuleWidth();
+    int colGap = columnGap();
+    bool renderRule = ruleStyle > BHIDDEN && !ruleTransparent && ruleWidth <= colGap;
+    if (!renderRule)
+        return;
+
+    // We need to do multiple passes, breaking up our child painting into strips.
+    int currXOffset = 0;
+    int ruleAdd = borderLeft() + paddingLeft();
+    int ruleX = 0;
+    Vector<IntRect>* colRects = columnRects();
+    unsigned colCount = colRects->size();
+    for (unsigned i = 0; i < colCount; i++) {
+        // For each rect, we clip to the rect, and then we adjust our coords.
+        IntRect colRect = colRects->at(i);
+
+        // Move to the next position.
+        if (style()->direction() == LTR) {
+            ruleX += colRect.width() + colGap / 2;
+            currXOffset += colRect.width() + colGap;
+        } else {
+            ruleX -= (colRect.width() + colGap / 2);
+            currXOffset -= (colRect.width() + colGap);
+        }
+       
+        // Now paint the column rule.
+        if (i < colCount - 1) {
+            int ruleStart = tx + ruleX - ruleWidth / 2 + ruleAdd;
+            int ruleEnd = ruleStart + ruleWidth;
+            int ruleTop = ty + borderTop() + paddingTop();
+            int ruleBottom = ruleTop + contentHeight();
+            drawLineForBoxSide(paintInfo.context, ruleStart, ruleTop, ruleEnd, ruleBottom,
+                               style()->direction() == LTR ? BSLeft : BSRight, ruleColor, style()->color(), ruleStyle, 0, 0);
+        }
+        
+        ruleX = currXOffset;
     }
 }
 
-void RenderBlock::paintColumns(PaintInfo& paintInfo, int tx, int ty, bool paintingFloats)
+void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool paintingFloats)
 {
     // We need to do multiple passes, breaking up our child painting into strips.
     GraphicsContext* context = paintInfo.context;
     int currXOffset = 0;
     int currYOffset = 0;
-    int ruleAdd = borderLeft() + paddingLeft();
-    int ruleX = 0;
     int colGap = columnGap();
-    const Color& ruleColor = style()->columnRuleColor();
-    bool ruleTransparent = style()->columnRuleIsTransparent();
-    EBorderStyle ruleStyle = style()->columnRuleStyle();
-    int ruleWidth = style()->columnRuleWidth();
-    bool renderRule = !paintingFloats && ruleStyle > BHIDDEN && !ruleTransparent && ruleWidth <= colGap;
     Vector<IntRect>* colRects = columnRects();
     unsigned colCount = colRects->size();
     for (unsigned i = 0; i < colCount; i++) {
@@ -1567,27 +1646,14 @@ void RenderBlock::paintColumns(PaintInfo& paintInfo, int tx, int ty, bool painti
             paintContents(info, finalX, finalY);
 
         // Move to the next position.
-        if (style()->direction() == LTR) {
-            ruleX += colRect.width() + colGap / 2;
+        if (style()->direction() == LTR)
             currXOffset += colRect.width() + colGap;
-        } else {
-            ruleX -= (colRect.width() + colGap / 2);
+        else
             currXOffset -= (colRect.width() + colGap);
-        }
-
+        
         currYOffset -= colRect.height();
         
         context->restore();
-        
-        // Now paint the column rule.
-        if (renderRule && paintInfo.phase == PaintPhaseForeground && i < colCount - 1) {
-            int ruleStart = ruleX - ruleWidth / 2 + ruleAdd;
-            int ruleEnd = ruleStart + ruleWidth;
-            drawBorder(paintInfo.context, tx + ruleStart, ty + borderTop() + paddingTop(), tx + ruleEnd, ty + borderTop() + paddingTop() + contentHeight(),
-                       style()->direction() == LTR ? BSLeft : BSRight, ruleColor, style()->color(), ruleStyle, 0, 0);
-        }
-        
-        ruleX = currXOffset;
     }
 }
 
@@ -1600,7 +1666,7 @@ void RenderBlock::paintContents(PaintInfo& paintInfo, int tx, int ty)
         return;
 
     if (childrenInline())
-        paintLines(paintInfo, tx, ty);
+        m_lineBoxes.paint(this, paintInfo, tx, ty);
     else
         paintChildren(paintInfo, tx, ty);
 }
@@ -1616,23 +1682,23 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
     info.paintingRoot = paintingRootForChildren(paintInfo);
     bool isPrinting = document()->printing();
 
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {        
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {        
         // Check for page-break-before: always, and if it's set, break and bail.
         if (isPrinting && !childrenInline() && child->style()->pageBreakBefore() == PBALWAYS &&
-            inRootBlockContext() && (ty + child->yPos()) > paintInfo.rect.y() && 
-            (ty + child->yPos()) < paintInfo.rect.bottom()) {
-            view()->setBestTruncatedAt(ty + child->yPos(), this, true);
+            inRootBlockContext() && (ty + child->y()) > paintInfo.rect.y() && 
+            (ty + child->y()) < paintInfo.rect.bottom()) {
+            view()->setBestTruncatedAt(ty + child->y(), this, true);
             return;
         }
 
-        if (!child->hasLayer() && !child->isFloating())
+        if (!child->hasSelfPaintingLayer() && !child->isFloating())
             child->paint(info, tx, ty);
 
         // Check for page-break-after: always, and if it's set, break and bail.
         if (isPrinting && !childrenInline() && child->style()->pageBreakAfter() == PBALWAYS && 
-            inRootBlockContext() && (ty + child->yPos() + child->height()) > paintInfo.rect.y() && 
-            (ty + child->yPos() + child->height()) < paintInfo.rect.bottom()) {
-            view()->setBestTruncatedAt(ty + child->yPos() + child->height() + max(0, child->collapsedMarginBottom()), this, true);
+            inRootBlockContext() && (ty + child->y() + child->height()) > paintInfo.rect.y() && 
+            (ty + child->y() + child->height()) < paintInfo.rect.bottom()) {
+            view()->setBestTruncatedAt(ty + child->y() + child->height() + max(0, child->collapsedMarginBottom()), this, true);
             return;
         }
     }
@@ -1642,9 +1708,10 @@ void RenderBlock::paintCaret(PaintInfo& paintInfo, int tx, int ty, CaretType typ
 {
     SelectionController* selection = type == CursorCaret ? document()->frame()->selection() : document()->frame()->dragCaretController();
 
-    // Ask the SelectionController if the caret should be painted by this block
+    // Paint the caret if the SelectionController says so or if caret browsing is enabled
+    bool caretBrowsing = document()->frame()->settings() && document()->frame()->settings()->caretBrowsingEnabled();
     RenderObject* caretPainter = selection->caretRenderer();
-    if (caretPainter == this && selection->isContentEditable()) {
+    if (caretPainter == this && (selection->isContentEditable() || caretBrowsing)) {
         // Convert the painting offset into the local coordinate system of this renderer,
         // to match the localCaretRect computed by the SelectionController
         offsetForContents(tx, ty);
@@ -1660,14 +1727,12 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, int tx, int ty)
 {
     PaintPhase paintPhase = paintInfo.phase;
 
-    // If we're a repositioned run-in or a compact, don't paint background/borders.
-    bool inlineFlow = isInlineFlow();
-
     // 1. paint background, borders etc
-    if (!inlineFlow &&
-        (paintPhase == PaintPhaseBlockBackground || paintPhase == PaintPhaseChildBlockBackground) &&
-        hasBoxDecorations() && style()->visibility() == VISIBLE) {
-        paintBoxDecorations(paintInfo, tx, ty);
+    if ((paintPhase == PaintPhaseBlockBackground || paintPhase == PaintPhaseChildBlockBackground) && style()->visibility() == VISIBLE) {
+        if (hasBoxDecorations())
+            paintBoxDecorations(paintInfo, tx, ty);
+        if (hasColumns())
+            paintColumnRules(paintInfo, tx, ty);
     }
 
     if (paintPhase == PaintPhaseMask && style()->visibility() == VISIBLE) {
@@ -1683,12 +1748,12 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, int tx, int ty)
     int scrolledX = tx;
     int scrolledY = ty;
     if (hasOverflowClip())
-        m_layer->subtractScrolledContentOffset(scrolledX, scrolledY);
+        layer()->subtractScrolledContentOffset(scrolledX, scrolledY);
 
     // 2. paint contents
     if (paintPhase != PaintPhaseSelfOutline) {
-        if (m_hasColumns)
-            paintColumns(paintInfo, scrolledX, scrolledY);
+        if (hasColumns())
+            paintColumnContents(paintInfo, scrolledX, scrolledY);
         else
             paintContents(paintInfo, scrolledX, scrolledY);
     }
@@ -1696,30 +1761,30 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, int tx, int ty)
     // 3. paint selection
     // FIXME: Make this work with multi column layouts.  For now don't fill gaps.
     bool isPrinting = document()->printing();
-    if (!inlineFlow && !isPrinting && !m_hasColumns)
+    if (!isPrinting && !hasColumns())
         paintSelection(paintInfo, scrolledX, scrolledY); // Fill in gaps in selection on lines and between blocks.
 
     // 4. paint floats.
-    if (!inlineFlow && (paintPhase == PaintPhaseFloat || paintPhase == PaintPhaseSelection || paintPhase == PaintPhaseTextClip)) {
-        if (m_hasColumns)
-            paintColumns(paintInfo, scrolledX, scrolledY, true);
+    if (paintPhase == PaintPhaseFloat || paintPhase == PaintPhaseSelection || paintPhase == PaintPhaseTextClip) {
+        if (hasColumns())
+            paintColumnContents(paintInfo, scrolledX, scrolledY, true);
         else
             paintFloats(paintInfo, scrolledX, scrolledY, paintPhase == PaintPhaseSelection || paintPhase == PaintPhaseTextClip);
     }
 
     // 5. paint outline.
-    if (!inlineFlow && (paintPhase == PaintPhaseOutline || paintPhase == PaintPhaseSelfOutline) && hasOutline() && style()->visibility() == VISIBLE)
-        RenderObject::paintOutline(paintInfo.context, tx, ty, width(), height(), style());
+    if ((paintPhase == PaintPhaseOutline || paintPhase == PaintPhaseSelfOutline) && hasOutline() && style()->visibility() == VISIBLE)
+        paintOutline(paintInfo.context, tx, ty, width(), height(), style());
 
     // 6. paint continuation outlines.
-    if (!inlineFlow && (paintPhase == PaintPhaseOutline || paintPhase == PaintPhaseChildOutlines)) {
-        if (continuation() && continuation()->hasOutline() && continuation()->style()->visibility() == VISIBLE) {
-            RenderFlow* inlineFlow = static_cast<RenderFlow*>(continuation()->element()->renderer());
-            if (!inlineFlow->hasLayer())
-                containingBlock()->addContinuationWithOutline(inlineFlow);
-            else if (!inlineFlow->firstLineBox())
-                inlineFlow->paintOutline(paintInfo.context, tx - xPos() + inlineFlow->containingBlock()->xPos(),
-                                         ty - yPos() + inlineFlow->containingBlock()->yPos());
+    if ((paintPhase == PaintPhaseOutline || paintPhase == PaintPhaseChildOutlines)) {
+        if (inlineContinuation() && inlineContinuation()->hasOutline() && inlineContinuation()->style()->visibility() == VISIBLE) {
+            RenderInline* inlineRenderer = toRenderInline(inlineContinuation()->node()->renderer());
+            if (!inlineRenderer->hasSelfPaintingLayer())
+                containingBlock()->addContinuationWithOutline(inlineRenderer);
+            else if (!inlineRenderer->firstLineBox())
+                inlineRenderer->paintOutline(paintInfo.context, tx - x() + inlineRenderer->containingBlock()->x(),
+                                             ty - y() + inlineRenderer->containingBlock()->y());
         }
         paintContinuationOutlines(paintInfo, tx, ty);
     }
@@ -1727,7 +1792,7 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, int tx, int ty)
     // 7. paint caret.
     // If the caret's node's render object's containing block is this block, and the paint action is PaintPhaseForeground,
     // then paint the caret.
-    if (!inlineFlow && paintPhase == PaintPhaseForeground) {        
+    if (paintPhase == PaintPhaseForeground) {        
         paintCaret(paintInfo, scrolledX, scrolledY, CursorCaret);
         paintCaret(paintInfo, scrolledX, scrolledY, DragCaret);
     }
@@ -1742,11 +1807,11 @@ void RenderBlock::paintFloats(PaintInfo& paintInfo, int tx, int ty, bool preserv
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (; (r = it.current()); ++it) {
         // Only paint the object if our m_shouldPaint flag is set.
-        if (r->m_shouldPaint && !r->m_renderer->hasLayer()) {
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
             PaintInfo currentPaintInfo(paintInfo);
             currentPaintInfo.phase = preservePhase ? paintInfo.phase : PaintPhaseBlockBackground;
-            int currentTX = tx + r->m_left - r->m_renderer->xPos() + r->m_renderer->marginLeft();
-            int currentTY = ty + r->m_top - r->m_renderer->yPos() + r->m_renderer->marginTop();
+            int currentTX = tx + r->m_left - r->m_renderer->x() + r->m_renderer->marginLeft();
+            int currentTY = ty + r->m_top - r->m_renderer->y() + r->m_renderer->marginTop();
             r->m_renderer->paint(currentPaintInfo, currentTX, currentTY);
             if (!preservePhase) {
                 currentPaintInfo.phase = PaintPhaseChildBlockBackgrounds;
@@ -1770,8 +1835,8 @@ void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, int tx, int ty)
     if (style()->visibility() == VISIBLE && paintInfo.phase == PaintPhaseForeground) {
         // We can check the first box and last box and avoid painting if we don't
         // intersect.
-        int yPos = ty + firstLineBox()->yPos();
-        int h = lastLineBox()->yPos() + lastLineBox()->height() - firstLineBox()->yPos();
+        int yPos = ty + firstLineBox()->y();
+        int h = lastLineBox()->y() + lastLineBox()->height() - firstLineBox()->y();
         if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
             return;
 
@@ -1779,7 +1844,7 @@ void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, int tx, int ty)
         // them.  Note that boxes can easily overlap, so we can't make any assumptions
         // based off positions of our first line box or our last line box.
         for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-            yPos = ty + curr->yPos();
+            yPos = ty + curr->y();
             h = curr->height();
             if (curr->ellipsisBox() && yPos < paintInfo.rect.bottom() && yPos + h > paintInfo.rect.y())
                 curr->paintEllipsisBox(paintInfo, tx, ty);
@@ -1787,22 +1852,22 @@ void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, int tx, int ty)
     }
 }
 
-ContinuationOutlineTableMap* continuationOutlineTable()
+static ContinuationOutlineTableMap* continuationOutlineTable()
 {
     DEFINE_STATIC_LOCAL(ContinuationOutlineTableMap, table, ());
     return &table;
 }
 
-void RenderBlock::addContinuationWithOutline(RenderFlow* flow)
+void RenderBlock::addContinuationWithOutline(RenderInline* flow)
 {
     // We can't make this work if the inline is in a layer.  We'll just rely on the broken
     // way of painting.
-    ASSERT(!flow->layer());
+    ASSERT(!flow->layer() && !flow->isInlineContinuation());
     
     ContinuationOutlineTableMap* table = continuationOutlineTable();
-    RenderFlowSequencedSet* continuations = table->get(this);
+    ListHashSet<RenderInline*>* continuations = table->get(this);
     if (!continuations) {
-        continuations = new RenderFlowSequencedSet;
+        continuations = new ListHashSet<RenderInline*>;
         table->set(this, continuations);
     }
     
@@ -1815,19 +1880,19 @@ void RenderBlock::paintContinuationOutlines(PaintInfo& info, int tx, int ty)
     if (table->isEmpty())
         return;
         
-    RenderFlowSequencedSet* continuations = table->get(this);
+    ListHashSet<RenderInline*>* continuations = table->get(this);
     if (!continuations)
         return;
         
     // Paint each continuation outline.
-    RenderFlowSequencedSet::iterator end = continuations->end();
-    for (RenderFlowSequencedSet::iterator it = continuations->begin(); it != end; ++it) {
+    ListHashSet<RenderInline*>::iterator end = continuations->end();
+    for (ListHashSet<RenderInline*>::iterator it = continuations->begin(); it != end; ++it) {
         // Need to add in the coordinates of the intervening blocks.
-        RenderFlow* flow = *it;
+        RenderInline* flow = *it;
         RenderBlock* block = flow->containingBlock();
         for ( ; block && block != this; block = block->containingBlock()) {
-            tx += block->xPos();
-            ty += block->yPos();
+            tx += block->x();
+            ty += block->y();
         }
         ASSERT(block);   
         flow->paintOutline(info.context, tx, ty);
@@ -1848,9 +1913,9 @@ void RenderBlock::setSelectionState(SelectionState s)
 
     if ((s == SelectionStart && selectionState() == SelectionEnd) ||
         (s == SelectionEnd && selectionState() == SelectionStart))
-        m_selectionState = SelectionBoth;
+        RenderBox::setSelectionState(SelectionBoth);
     else
-        m_selectionState = s;
+        RenderBox::setSelectionState(s);
     
     RenderBlock* cb = containingBlock();
     if (cb && !cb->isRenderView())
@@ -1859,12 +1924,12 @@ void RenderBlock::setSelectionState(SelectionState s)
 
 bool RenderBlock::shouldPaintSelectionGaps() const
 {
-    return m_selectionState != SelectionNone && style()->visibility() == VISIBLE && isSelectionRoot();
+    return selectionState() != SelectionNone && style()->visibility() == VISIBLE && isSelectionRoot();
 }
 
 bool RenderBlock::isSelectionRoot() const
 {
-    if (!element())
+    if (!node())
         return false;
         
     // FIXME: Eventually tables should have to learn how to fill gaps between cells, at least in simple non-spanning cases.
@@ -1877,27 +1942,27 @@ bool RenderBlock::isSelectionRoot() const
         return true;
     
     if (view() && view()->selectionStart()) {
-        Node* startElement = view()->selectionStart()->element();
-        if (startElement && startElement->rootEditableElement() == element())
+        Node* startElement = view()->selectionStart()->node();
+        if (startElement && startElement->rootEditableElement() == node())
             return true;
     }
     
     return false;
 }
 
-GapRects RenderBlock::selectionGapRects()
+GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* /*repaintContainer*/)
 {
     ASSERT(!needsLayout());
 
     if (!shouldPaintSelectionGaps())
         return GapRects();
 
-    // FIXME: this is broken with transforms
-    FloatPoint absContentPoint = localToAbsoluteForContent(FloatPoint());
+    // FIXME: this is broken with transforms and a non-null repaintContainer
+    FloatPoint absContentPoint = localToAbsolute(FloatPoint());
     if (hasOverflowClip())
         absContentPoint -= layer()->scrolledContentOffset();
 
-    int lastTop = -borderTopExtra();
+    int lastTop = 0;
     int lastLeft = leftSelectionOffset(this, lastTop);
     int lastRight = rightSelectionOffset(this, lastTop);
     
@@ -1907,7 +1972,7 @@ GapRects RenderBlock::selectionGapRects()
 void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
 {
     if (shouldPaintSelectionGaps() && paintInfo.phase == PaintPhaseForeground) {
-        int lastTop = -borderTopExtra();
+        int lastTop = 0;
         int lastLeft = leftSelectionOffset(this, lastTop);
         int lastRight = rightSelectionOffset(this, lastTop);
         paintInfo.context->save();
@@ -1916,21 +1981,24 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
     }
 }
 
-static void clipOutPositionedObjects(const RenderObject::PaintInfo* paintInfo, int tx, int ty, ListHashSet<RenderObject*>* positionedObjects)
+#ifndef BUILDING_ON_TIGER
+static void clipOutPositionedObjects(const RenderObject::PaintInfo* paintInfo, int tx, int ty, ListHashSet<RenderBox*>* positionedObjects)
 {
     if (!positionedObjects)
         return;
     
-    ListHashSet<RenderObject*>::const_iterator end = positionedObjects->end();
-    for (ListHashSet<RenderObject*>::const_iterator it = positionedObjects->begin(); it != end; ++it) {
-        RenderObject* r = *it;
-        paintInfo->context->clipOut(IntRect(tx + r->xPos(), ty + r->yPos(), r->width(), r->height()));
+    ListHashSet<RenderBox*>::const_iterator end = positionedObjects->end();
+    for (ListHashSet<RenderBox*>::const_iterator it = positionedObjects->begin(); it != end; ++it) {
+        RenderBox* r = *it;
+        paintInfo->context->clipOut(IntRect(tx + r->x(), ty + r->y(), r->width(), r->height()));
     }
 }
+#endif
 
 GapRects RenderBlock::fillSelectionGaps(RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
                                         int& lastTop, int& lastLeft, int& lastRight, const PaintInfo* paintInfo)
 {
+#ifndef BUILDING_ON_TIGER
     // IMPORTANT: Callers of this method that intend for painting to happen need to do a save/restore.
     // Clip out floating and positioned objects when painting selection gaps.
     if (paintInfo) {
@@ -1938,7 +2006,7 @@ GapRects RenderBlock::fillSelectionGaps(RenderBlock* rootBlock, int blockX, int
         clipOutPositionedObjects(paintInfo, tx, ty, m_positionedObjects);
         if (isBody() || isRoot()) // The <body> must make sure to examine its containingBlock's positioned objects.
             for (RenderBlock* cb = containingBlock(); cb && !cb->isRenderView(); cb = cb->containingBlock())
-                clipOutPositionedObjects(paintInfo, cb->xPos(), cb->yPos(), cb->m_positionedObjects);
+                clipOutPositionedObjects(paintInfo, cb->x(), cb->y(), cb->m_positionedObjects);
         if (m_floatingObjects) {
             for (DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects); it.current(); ++it) {
                 FloatingObject* r = it.current();
@@ -1948,6 +2016,7 @@ GapRects RenderBlock::fillSelectionGaps(RenderBlock* rootBlock, int blockX, int
             }
         }
     }
+#endif
 
     // FIXME: overflow: auto/scroll regions need more math here, since painting in the border box is different from painting in the padding box (one is scrolled, the other is
     // fixed).
@@ -1955,7 +2024,7 @@ GapRects RenderBlock::fillSelectionGaps(RenderBlock* rootBlock, int blockX, int
     if (!isBlockFlow()) // FIXME: Make multi-column selection gap filling work someday.
         return result;
 
-    if (m_hasColumns || hasTransform()) {
+    if (hasColumns() || hasTransform()) {
         // FIXME: We should learn how to gap fill multiple columns and transforms eventually.
         lastTop = (ty - blockY) + height();
         lastLeft = leftSelectionOffset(rootBlock, height());
@@ -1969,8 +2038,8 @@ GapRects RenderBlock::fillSelectionGaps(RenderBlock* rootBlock, int blockX, int
         result = fillBlockSelectionGaps(rootBlock, blockX, blockY, tx, ty, lastTop, lastLeft, lastRight, paintInfo);
 
     // Go ahead and fill the vertical gap all the way to the bottom of our block if the selection extends past our block.
-    if (rootBlock == this && (m_selectionState != SelectionBoth && m_selectionState != SelectionEnd))
-        result.uniteCenter(fillVerticalSelectionGap(lastTop, lastLeft, lastRight, ty + height() + borderBottomExtra(),
+    if (rootBlock == this && (selectionState() != SelectionBoth && selectionState() != SelectionEnd))
+        result.uniteCenter(fillVerticalSelectionGap(lastTop, lastLeft, lastRight, ty + height(),
                                                     rootBlock, blockX, blockY, paintInfo));
     return result;
 }
@@ -2007,14 +2076,14 @@ GapRects RenderBlock::fillInlineSelectionGaps(RenderBlock* rootBlock, int blockX
             result.uniteCenter(fillVerticalSelectionGap(lastTop, lastLeft, lastRight, ty + selTop,
                                                         rootBlock, blockX, blockY, paintInfo));
 
-        if (!paintInfo || ty + selTop < paintInfo->rect.bottom() && ty + selTop + selHeight > paintInfo->rect.y())
+        if (!paintInfo || (ty + selTop < paintInfo->rect.bottom() && ty + selTop + selHeight > paintInfo->rect.y()))
             result.unite(curr->fillLineSelectionGap(selTop, selHeight, rootBlock, blockX, blockY, tx, ty, paintInfo));
 
         lastSelectedLine = curr;
     }
 
     if (containsStart && !lastSelectedLine)
-        // Selection must start just after our last line.
+        // VisibleSelection must start just after our last line.
         lastSelectedLine = lastRootBox();
 
     if (lastSelectedLine && selectionState() != SelectionEnd && selectionState() != SelectionBoth) {
@@ -2032,10 +2101,10 @@ GapRects RenderBlock::fillBlockSelectionGaps(RenderBlock* rootBlock, int blockX,
     GapRects result;
 
     // Go ahead and jump right to the first block child that contains some selected objects.
-    RenderObject* curr;
-    for (curr = firstChild(); curr && curr->selectionState() == SelectionNone; curr = curr->nextSibling()) { }
+    RenderBox* curr;
+    for (curr = firstChildBox(); curr && curr->selectionState() == SelectionNone; curr = curr->nextSiblingBox()) { }
 
-    for (bool sawSelectionEnd = false; curr && !sawSelectionEnd; curr = curr->nextSibling()) {
+    for (bool sawSelectionEnd = false; curr && !sawSelectionEnd; curr = curr->nextSiblingBox()) {
         SelectionState childState = curr->selectionState();
         if (childState == SelectionBoth || childState == SelectionEnd)
             sawSelectionEnd = true;
@@ -2058,7 +2127,7 @@ GapRects RenderBlock::fillBlockSelectionGaps(RenderBlock* rootBlock, int blockX,
             if (childState == SelectionEnd || childState == SelectionInside)
                 // Fill the gap above the object.
                 result.uniteCenter(fillVerticalSelectionGap(lastTop, lastLeft, lastRight, 
-                                                            ty + curr->yPos(), rootBlock, blockX, blockY, paintInfo));
+                                                            ty + curr->y(), rootBlock, blockX, blockY, paintInfo));
 
             // Only fill side gaps for objects that paint their own selection if we know for sure the selection is going to extend all the way *past*
             // our object.  We know this if the selection did not end inside our object.
@@ -2070,19 +2139,19 @@ GapRects RenderBlock::fillBlockSelectionGaps(RenderBlock* rootBlock, int blockX,
             getHorizontalSelectionGapInfo(childState, leftGap, rightGap);
 
             if (leftGap)
-                result.uniteLeft(fillLeftSelectionGap(this, curr->xPos(), curr->yPos(), curr->height(), rootBlock, blockX, blockY, tx, ty, paintInfo));
+                result.uniteLeft(fillLeftSelectionGap(this, curr->x(), curr->y(), curr->height(), rootBlock, blockX, blockY, tx, ty, paintInfo));
             if (rightGap)
-                result.uniteRight(fillRightSelectionGap(this, curr->xPos() + curr->width(), curr->yPos(), curr->height(), rootBlock, blockX, blockY, tx, ty, paintInfo));
+                result.uniteRight(fillRightSelectionGap(this, curr->x() + curr->width(), curr->y(), curr->height(), rootBlock, blockX, blockY, tx, ty, paintInfo));
 
             // Update lastTop to be just underneath the object.  lastLeft and lastRight extend as far as
             // they can without bumping into floating or positioned objects.  Ideally they will go right up
             // to the border of the root selection block.
-            lastTop = (ty - blockY) + (curr->yPos() + curr->height());
-            lastLeft = leftSelectionOffset(rootBlock, curr->yPos() + curr->height());
-            lastRight = rightSelectionOffset(rootBlock, curr->yPos() + curr->height());
+            lastTop = (ty - blockY) + (curr->y() + curr->height());
+            lastLeft = leftSelectionOffset(rootBlock, curr->y() + curr->height());
+            lastRight = rightSelectionOffset(rootBlock, curr->y() + curr->height());
         } else if (childState != SelectionNone)
             // We must be a block that has some selected object inside it.  Go ahead and recur.
-            result.unite(static_cast<RenderBlock*>(curr)->fillSelectionGaps(rootBlock, blockX, blockY, tx + curr->xPos(), ty + curr->yPos(), 
+            result.unite(toRenderBlock(curr)->fillSelectionGaps(rootBlock, blockX, blockY, tx + curr->x(), ty + curr->y(), 
                                                                             lastTop, lastLeft, lastRight, paintInfo));
     }
     return result;
@@ -2162,19 +2231,19 @@ void RenderBlock::getHorizontalSelectionGapInfo(SelectionState state, bool& left
                (state == RenderObject::SelectionEnd && !ltr);
 }
 
-int RenderBlock::leftSelectionOffset(RenderBlock* rootBlock, int y)
+int RenderBlock::leftSelectionOffset(RenderBlock* rootBlock, int yPos)
 {
-    int left = leftOffset(y);
+    int left = leftOffset(yPos, false);
     if (left == borderLeft() + paddingLeft()) {
         if (rootBlock != this)
             // The border can potentially be further extended by our containingBlock().
-            return containingBlock()->leftSelectionOffset(rootBlock, y + yPos());
+            return containingBlock()->leftSelectionOffset(rootBlock, yPos + y());
         return left;
     }
     else {
         RenderBlock* cb = this;
         while (cb != rootBlock) {
-            left += cb->xPos();
+            left += cb->x();
             cb = cb->containingBlock();
         }
     }
@@ -2182,35 +2251,35 @@ int RenderBlock::leftSelectionOffset(RenderBlock* rootBlock, int y)
     return left;
 }
 
-int RenderBlock::rightSelectionOffset(RenderBlock* rootBlock, int y)
+int RenderBlock::rightSelectionOffset(RenderBlock* rootBlock, int yPos)
 {
-    int right = rightOffset(y);
+    int right = rightOffset(yPos, false);
     if (right == (contentWidth() + (borderLeft() + paddingLeft()))) {
         if (rootBlock != this)
             // The border can potentially be further extended by our containingBlock().
-            return containingBlock()->rightSelectionOffset(rootBlock, y + yPos());
+            return containingBlock()->rightSelectionOffset(rootBlock, yPos + y());
         return right;
     }
     else {
         RenderBlock* cb = this;
         while (cb != rootBlock) {
-            right += cb->xPos();
+            right += cb->x();
             cb = cb->containingBlock();
         }
     }
     return right;
 }
 
-void RenderBlock::insertPositionedObject(RenderObject *o)
+void RenderBlock::insertPositionedObject(RenderBox* o)
 {
     // Create the list of special objects if we don't aleady have one
     if (!m_positionedObjects)
-        m_positionedObjects = new ListHashSet<RenderObject*>;
+        m_positionedObjects = new ListHashSet<RenderBox*>;
 
     m_positionedObjects->add(o);
 }
 
-void RenderBlock::removePositionedObject(RenderObject *o)
+void RenderBlock::removePositionedObject(RenderBox* o)
 {
     if (m_positionedObjects)
         m_positionedObjects->remove(o);
@@ -2221,11 +2290,11 @@ void RenderBlock::removePositionedObjects(RenderBlock* o)
     if (!m_positionedObjects)
         return;
     
-    RenderObject* r;
+    RenderBox* r;
     
     Iterator end = m_positionedObjects->end();
     
-    Vector<RenderObject*, 16> deadObjects;
+    Vector<RenderBox*, 16> deadObjects;
 
     for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
         r = *it;
@@ -2249,7 +2318,7 @@ void RenderBlock::removePositionedObjects(RenderBlock* o)
         m_positionedObjects->remove(deadObjects.at(i));
 }
 
-void RenderBlock::insertFloatingObject(RenderObject *o)
+void RenderBlock::insertFloatingObject(RenderBox* o)
 {
     ASSERT(o->isFloating());
 
@@ -2276,14 +2345,14 @@ void RenderBlock::insertFloatingObject(RenderObject *o)
     newObj->m_top = -1;
     newObj->m_bottom = -1;
     newObj->m_width = o->width() + o->marginLeft() + o->marginRight();
-    newObj->m_shouldPaint = !o->hasLayer(); // If a layer exists, the float will paint itself.  Otherwise someone else will.
+    newObj->m_shouldPaint = !o->hasSelfPaintingLayer(); // If a layer exists, the float will paint itself.  Otherwise someone else will.
     newObj->m_isDescendant = true;
     newObj->m_renderer = o;
 
     m_floatingObjects->append(newObj);
 }
 
-void RenderBlock::removeFloatingObject(RenderObject *o)
+void RenderBlock::removeFloatingObject(RenderBox* o)
 {
     if (m_floatingObjects) {
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
@@ -2318,7 +2387,7 @@ bool RenderBlock::positionNewFloats()
         lastFloat = m_floatingObjects->getPrev();
     }
 
-    int y = m_height;
+    int y = height();
     
     // The float cannot start above the y position of the last positioned float.
     if (lastFloat)
@@ -2333,7 +2402,7 @@ bool RenderBlock::positionNewFloats()
             continue;
         }
 
-        RenderObject* o = f->m_renderer;
+        RenderBox* o = f->m_renderer;
         int _height = o->height() + o->marginTop() + o->marginBottom();
 
         int ro = rightOffset(); // Constant part of right offset.
@@ -2342,7 +2411,7 @@ bool RenderBlock::positionNewFloats()
         if (ro - lo < fwidth)
             fwidth = ro - lo; // Never look for more than what will be available.
         
-        IntRect oldRect(o->xPos(), o->yPos() , o->width(), o->height());
+        IntRect oldRect(o->x(), o->y() , o->width(), o->height());
         
         if (o->style()->clear() & CLEFT)
             y = max(leftBottom(), y);
@@ -2359,7 +2428,7 @@ bool RenderBlock::positionNewFloats()
             }
             fx = max(0, fx);
             f->m_left = fx;
-            o->setPos(fx + o->marginLeft(), y + o->marginTop());
+            o->setLocation(fx + o->marginLeft(), y + o->marginTop());
         } else {
             int heightRemainingLeft = 1;
             int heightRemainingRight = 1;
@@ -2369,7 +2438,7 @@ bool RenderBlock::positionNewFloats()
                 fx = rightRelOffset(y, ro, false, &heightRemainingRight);
             }
             f->m_left = fx - f->m_width;
-            o->setPos(fx - o->marginRight() - o->width(), y + o->marginTop());
+            o->setLocation(fx - o->marginRight() - o->width(), y + o->marginTop());
         }
 
         f->m_top = y;
@@ -2402,8 +2471,8 @@ void RenderBlock::newLine(EClear clear)
         default:
             break;
     }
-    if (m_height < newY)
-        m_height = newY;
+    if (height() < newY)
+        setHeight(newY);
 }
 
 void RenderBlock::addPercentHeightDescendant(RenderBox* descendant)
@@ -2461,15 +2530,17 @@ void RenderBlock::removePercentHeightDescendant(RenderBox* descendant)
     delete containerSet;
 }
 
-int
-RenderBlock::leftOffset() const
+HashSet<RenderBox*>* RenderBlock::percentHeightDescendants() const
 {
-    return borderLeft()+paddingLeft();
+    return gPercentHeightDescendantsMap ? gPercentHeightDescendantsMap->get(this) : 0;
 }
 
-int
-RenderBlock::leftRelOffset(int y, int fixedOffset, bool applyTextIndent,
-                           int *heightRemaining ) const
+int RenderBlock::leftOffset() const
+{
+    return borderLeft() + paddingLeft();
+}
+
+int RenderBlock::leftRelOffset(int y, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
 {
     int left = fixedOffset;
     if (m_floatingObjects) {
@@ -2487,7 +2558,7 @@ RenderBlock::leftRelOffset(int y, int fixedOffset, bool applyTextIndent,
         }
     }
 
-    if (applyTextIndent && m_firstLine && style()->direction() == LTR) {
+    if (applyTextIndent && style()->direction() == LTR) {
         int cw = 0;
         if (style()->textIndent().isPercent())
             cw = containingBlock()->availableWidth();
@@ -2497,15 +2568,12 @@ RenderBlock::leftRelOffset(int y, int fixedOffset, bool applyTextIndent,
     return left;
 }
 
-int
-RenderBlock::rightOffset() const
+int RenderBlock::rightOffset() const
 {
     return borderLeft() + paddingLeft() + availableWidth();
 }
 
-int
-RenderBlock::rightRelOffset(int y, int fixedOffset, bool applyTextIndent,
-                            int *heightRemaining ) const
+int RenderBlock::rightRelOffset(int y, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
 {
     int right = fixedOffset;
 
@@ -2524,7 +2592,7 @@ RenderBlock::rightRelOffset(int y, int fixedOffset, bool applyTextIndent,
         }
     }
     
-    if (applyTextIndent && m_firstLine && style()->direction() == RTL) {
+    if (applyTextIndent && style()->direction() == RTL) {
         int cw = 0;
         if (style()->textIndent().isPercent())
             cw = containingBlock()->availableWidth();
@@ -2535,9 +2603,9 @@ RenderBlock::rightRelOffset(int y, int fixedOffset, bool applyTextIndent,
 }
 
 int
-RenderBlock::lineWidth(int y) const
+RenderBlock::lineWidth(int y, bool firstLine) const
 {
-    int result = rightOffset(y) - leftOffset(y);
+    int result = rightOffset(y, firstLine) - leftOffset(y, firstLine);
     return (result < 0) ? 0 : result;
 }
 
@@ -2578,7 +2646,7 @@ IntRect RenderBlock::floatRect() const
     FloatingObject* r;
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (; (r = it.current()); ++it) {
-        if (r->m_shouldPaint && !r->m_renderer->hasLayer()) {
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
             IntRect childRect = r->m_renderer->overflowRect(false);
             childRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
             result.unite(childRect);
@@ -2590,7 +2658,27 @@ IntRect RenderBlock::floatRect() const
 
 int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int bottom = RenderFlow::lowestPosition(includeOverflowInterior, includeSelf);
+    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
+        return includeSelf && width() > 0 ? overflowHeight(false) : 0;
+    
+    int bottom = includeSelf && width() > 0 ? height() : 0;
+    if (!hasColumns()) {
+        // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
+        // For now, we have to descend into all the children, since we may have a huge abs div inside
+        // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
+        // the abs div.
+        // See the last test case in https://bugs.webkit.org/show_bug.cgi?id=9314 for why this is a problem.
+        // For inline children, we miss relative positioned boxes that might be buried inside <span>s.
+        for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
+            if (!c->isFloatingOrPositioned() && c->isBox()) {
+                RenderBox* childBox = toRenderBox(c);
+                bottom = max(bottom, childBox->y() + childBox->lowestPosition(false));
+            }
+        }
+    }
+
+    if (includeSelf && isRelPositioned())
+        bottom += relativePositionOffsetY();     
     if (!includeOverflowInterior && hasOverflowClip())
         return bottom;
 
@@ -2600,7 +2688,7 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
         bottom = max(bottom, m_overflowHeight + relativeOffset);
         
     if (m_positionedObjects) {
-        RenderObject* r;
+        RenderBox* r;
         Iterator end = m_positionedObjects->end();
         for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
             r = *it;
@@ -2610,15 +2698,15 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
                 // FIXME: Should work for overflow sections too.
                 // If a positioned object lies completely to the left of the root it will be unreachable via scrolling.
                 // Therefore we should not allow it to contribute to the lowest position.
-                if (!isRenderView() || r->xPos() + r->width() > 0 || r->xPos() + r->rightmostPosition(false) > 0) {
-                    int lp = r->yPos() + r->lowestPosition(false);
+                if (!isRenderView() || r->x() + r->width() > 0 || r->x() + r->rightmostPosition(false) > 0) {
+                    int lp = r->y() + r->lowestPosition(false);
                     bottom = max(bottom, lp + relativeOffset);
                 }
             }
         }
     }
 
-    if (m_hasColumns) {
+    if (hasColumns()) {
         Vector<IntRect>* colRects = columnRects();
         for (unsigned i = 0; i < colRects->size(); i++)
             bottom = max(bottom, colRects->at(i).bottom() + relativeOffset);
@@ -2629,17 +2717,30 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
         FloatingObject* r;
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
         for ( ; (r = it.current()); ++it ) {
-            if (r->m_shouldPaint || r->m_renderer->hasLayer()) {
+            if (r->m_shouldPaint || r->m_renderer->hasSelfPaintingLayer()) {
                 int lp = r->m_top + r->m_renderer->marginTop() + r->m_renderer->lowestPosition(false);
                 bottom = max(bottom, lp + relativeOffset);
             }
         }
     }
 
-
-    if (!includeSelf && lastLineBox()) {
-        int lp = lastLineBox()->yPos() + lastLineBox()->height();
-        bottom = max(bottom, lp);
+    if (!includeSelf) {
+        bottom = max(bottom, borderTop() + paddingTop() + paddingBottom() + relativeOffset);
+        if (childrenInline()) {
+            if (lastLineBox()) {
+                int childBottomEdge = lastLineBox()->y() + lastLineBox()->height();
+                bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
+            }
+        } else {
+            // Find the last normal flow child.
+            RenderBox* currBox = lastChildBox();
+            while (currBox && currBox->isFloatingOrPositioned())
+                currBox = currBox->previousSiblingBox();
+            if (currBox) {
+                int childBottomEdge = currBox->y() + currBox->height() + currBox->collapsedMarginBottom();
+                bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
+            }
+        }
     }
     
     return bottom;
@@ -2647,7 +2748,27 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
 
 int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int right = RenderFlow::rightmostPosition(includeOverflowInterior, includeSelf);
+    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
+        return includeSelf && height() > 0 ? overflowWidth(false) : 0;
+
+    int right = includeSelf && height() > 0 ? width() : 0;
+
+    if (!hasColumns()) {
+        // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
+        // For now, we have to descend into all the children, since we may have a huge abs div inside
+        // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
+        // the abs div.
+        for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
+            if (!c->isFloatingOrPositioned() && c->isBox()) {
+                RenderBox* childBox = toRenderBox(c);
+                right = max(right, childBox->x() + childBox->rightmostPosition(false));
+            }
+        }
+    }
+
+    if (includeSelf && isRelPositioned())
+        right += relativePositionOffsetX();
+
     if (!includeOverflowInterior && hasOverflowClip())
         return right;
 
@@ -2657,7 +2778,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
         right = max(right, m_overflowWidth + relativeOffset);
 
     if (m_positionedObjects) {
-        RenderObject* r;
+        RenderBox* r;
         Iterator end = m_positionedObjects->end();
         for (Iterator it = m_positionedObjects->begin() ; it != end; ++it) {
             r = *it;
@@ -2667,15 +2788,15 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
                 // FIXME: Should work for overflow sections too.
                 // If a positioned object lies completely above the root it will be unreachable via scrolling.
                 // Therefore we should not allow it to contribute to the rightmost position.
-                if (!isRenderView() || r->yPos() + r->height() > 0 || r->yPos() + r->lowestPosition(false) > 0) {
-                    int rp = r->xPos() + r->rightmostPosition(false);
+                if (!isRenderView() || r->y() + r->height() > 0 || r->y() + r->lowestPosition(false) > 0) {
+                    int rp = r->x() + r->rightmostPosition(false);
                     right = max(right, rp + relativeOffset);
                 }
             }
         }
     }
 
-    if (m_hasColumns) {
+    if (hasColumns()) {
         // This only matters for LTR
         if (style()->direction() == LTR)
             right = max(columnRects()->last().right() + relativeOffset, right);
@@ -2686,21 +2807,33 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
         FloatingObject* r;
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
         for ( ; (r = it.current()); ++it ) {
-            if (r->m_shouldPaint || r->m_renderer->hasLayer()) {
+            if (r->m_shouldPaint || r->m_renderer->hasSelfPaintingLayer()) {
                 int rp = r->m_left + r->m_renderer->marginLeft() + r->m_renderer->rightmostPosition(false);
                 right = max(right, rp + relativeOffset);
             }
         }
     }
 
-    if (!includeSelf && firstLineBox()) {
-        for (InlineRunBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox()) {
-            int rp = currBox->xPos() + currBox->width();
-            // If this node is a root editable element, then the rightmostPosition should account for a caret at the end.
-            // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
-            if (node()->isContentEditable() && node() == node()->rootEditableElement() && style()->direction() == LTR)
-                rp += 1;
-            right = max(right, rp);
+    if (!includeSelf) {
+        right = max(right, borderLeft() + paddingLeft() + paddingRight() + relativeOffset);
+        if (childrenInline()) {
+            for (InlineRunBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox()) {
+                int childRightEdge = currBox->x() + currBox->width();
+                
+                // If this node is a root editable element, then the rightmostPosition should account for a caret at the end.
+                // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
+                if (node() && node()->isContentEditable() && node() == node()->rootEditableElement() && style()->direction() == LTR && !paddingRight())
+                    childRightEdge += 1;
+                right = max(right, childRightEdge + paddingRight() + relativeOffset);
+            }
+        } else {
+            // Walk all normal flow children.
+            for (RenderBox* currBox = firstChildBox(); currBox; currBox = currBox->nextSiblingBox()) {
+                if (currBox->isFloatingOrPositioned())
+                    continue;
+                int childRightEdge = currBox->x() + currBox->width() + currBox->marginRight();
+                right = max(right, childRightEdge + paddingRight() + relativeOffset);
+            }
         }
     }
     
@@ -2709,7 +2842,26 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
 
 int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int left = RenderFlow::leftmostPosition(includeOverflowInterior, includeSelf);
+    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
+        return includeSelf && height() > 0 ? overflowLeft(false) : width();
+
+    int left = includeSelf && height() > 0 ? 0 : width();
+    if (!hasColumns()) {
+        // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
+        // For now, we have to descend into all the children, since we may have a huge abs div inside
+        // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
+        // the abs div.
+        for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
+            if (!c->isFloatingOrPositioned() && c->isBox()) {
+                RenderBox* childBox = toRenderBox(c);
+                left = min(left, childBox->x() + childBox->leftmostPosition(false));
+            }
+        }
+    }
+
+    if (includeSelf && isRelPositioned())
+        left += relativePositionOffsetX(); 
+
     if (!includeOverflowInterior && hasOverflowClip())
         return left;
     
@@ -2719,7 +2871,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
         left = min(left, m_overflowLeft + relativeOffset);
 
     if (m_positionedObjects) {
-        RenderObject* r;
+        RenderBox* r;
         Iterator end = m_positionedObjects->end();
         for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
             r = *it;
@@ -2729,15 +2881,15 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
                 // FIXME: Should work for overflow sections too.
                 // If a positioned object lies completely above the root it will be unreachable via scrolling.
                 // Therefore we should not allow it to contribute to the leftmost position.
-                if (!isRenderView() || r->yPos() + r->height() > 0 || r->yPos() + r->lowestPosition(false) > 0) {
-                    int lp = r->xPos() + r->leftmostPosition(false);
+                if (!isRenderView() || r->y() + r->height() > 0 || r->y() + r->lowestPosition(false) > 0) {
+                    int lp = r->x() + r->leftmostPosition(false);
                     left = min(left, lp + relativeOffset);
                 }
             }
         }
     }
 
-    if (m_hasColumns) {
+    if (hasColumns()) {
         // This only matters for RTL
         if (style()->direction() == RTL)
             left = min(columnRects()->last().x() + relativeOffset, left);
@@ -2748,7 +2900,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
         FloatingObject* r;
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
         for ( ; (r = it.current()); ++it ) {
-            if (r->m_shouldPaint || r->m_renderer->hasLayer()) {
+            if (r->m_shouldPaint || r->m_renderer->hasSelfPaintingLayer()) {
                 int lp = r->m_left + r->m_renderer->marginLeft() + r->m_renderer->leftmostPosition(false);
                 left = min(left, lp + relativeOffset);
             }
@@ -2757,7 +2909,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
 
     if (!includeSelf && firstLineBox()) {
         for (InlineRunBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox())
-            left = min(left, (int)currBox->xPos());
+            left = min(left, (int)currBox->x() + relativeOffset);
     }
     
     return left;
@@ -2834,31 +2986,33 @@ void RenderBlock::clearFloats()
     // out of flow (like floating/positioned elements), and we also skip over any objects that may have shifted
     // to avoid floats.
     bool parentHasFloats = false;
-    RenderObject *prev = previousSibling();
-    while (prev && (!prev->isRenderBlock() || prev->avoidsFloats() || prev->isFloatingOrPositioned())) {
+    RenderObject* prev = previousSibling();
+    while (prev && (prev->isFloatingOrPositioned() || !prev->isBox() || !prev->isRenderBlock() || toRenderBlock(prev)->avoidsFloats())) {
         if (prev->isFloating())
             parentHasFloats = true;
          prev = prev->previousSibling();
     }
 
     // First add in floats from the parent.
-    int offset = m_y;
-    if (parentHasFloats)
-        addIntrudingFloats(static_cast<RenderBlock *>(parent()),
-                           parent()->borderLeft() + parent()->paddingLeft(), offset);
-
+    int offset = y();
+    if (parentHasFloats) {
+        RenderBlock* parentBlock = toRenderBlock(parent());
+        addIntrudingFloats(parentBlock, parentBlock->borderLeft() + parentBlock->paddingLeft(), offset);
+    }
+    
     int xoffset = 0;
     if (prev)
-        offset -= prev->yPos();
-    else {
+        offset -= toRenderBox(prev)->y();
+    else if (parent()->isBox()) {
         prev = parent();
-        xoffset += prev->borderLeft() + prev->paddingLeft();
+        xoffset += toRenderBox(prev)->borderLeft() + toRenderBox(prev)->paddingLeft();
     }
 
     // Add overhanging floats from the previous RenderBlock, but only if it has a float that intrudes into our space.
-    if (!prev->isRenderBlock()) return;
-    RenderBlock* block = static_cast<RenderBlock *>(prev);
-
+    if (!prev || !prev->isRenderBlock())
+        return;
+    
+    RenderBlock* block = toRenderBlock(prev);
     if (block->m_floatingObjects && block->floatBottom() > offset)
         addIntrudingFloats(block, xoffset, offset);
 
@@ -2913,7 +3067,7 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
     IntRect floatsOverflowRect;
     DeprecatedPtrListIterator<FloatingObject> it(*child->m_floatingObjects);
     for (FloatingObject* r; (r = it.current()); ++it) {
-        int bottom = child->yPos() + r->m_bottom;
+        int bottom = child->y() + r->m_bottom;
         lowestFloatBottom = max(lowestFloatBottom, bottom);
 
         if (bottom > height()) {
@@ -2929,8 +3083,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
                 // The nearest enclosing layer always paints the float (so that zindex and stacking
                 // behaves properly).  We always want to propagate the desire to paint the float as
                 // far out as we can, to the outermost block that overlaps the float, stopping only
-                // if we hit a layer boundary.
-                if (r->m_renderer->enclosingLayer() == enclosingLayer())
+                // if we hit a self-painting layer boundary.
+                if (r->m_renderer->enclosingSelfPaintingLayer() == enclosingSelfPaintingLayer())
                     r->m_shouldPaint = false;
                 else
                     floatingObj->m_shouldPaint = false;
@@ -2942,7 +3096,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
                 }
                 m_floatingObjects->append(floatingObj);
             }
-        } else if (makeChildPaintOtherFloats && !r->m_shouldPaint && !r->m_renderer->hasLayer() && r->m_renderer->isDescendantOf(child) && r->m_renderer->enclosingLayer() == child->enclosingLayer())
+        } else if (makeChildPaintOtherFloats && !r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer() &&
+                   r->m_renderer->isDescendantOf(child) && r->m_renderer->enclosingLayer() == child->enclosingLayer())
             // The float is not overhanging from this block, so if it is a descendant of the child, the child should
             // paint it (the other case is that it is intruding into the child), unless it has its own layer or enclosing
             // layer.
@@ -2950,7 +3105,7 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
             // it should paint.
             r->m_shouldPaint = true;
 
-        if (r->m_shouldPaint && !r->m_renderer->hasLayer()) {
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
             IntRect floatOverflowRect = r->m_renderer->overflowRect(false);
             floatOverflowRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
             floatsOverflowRect.unite(floatOverflowRect);
@@ -3010,7 +3165,7 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int xoff, int yoff)
 bool RenderBlock::avoidsFloats() const
 {
     // Floats can't intrude into our box if we have a non-auto column count or width.
-    return RenderFlow::avoidsFloats() || !style()->hasAutoColumnCount() || !style()->hasAutoColumnWidth();
+    return RenderBox::avoidsFloats() || !style()->hasAutoColumnCount() || !style()->hasAutoColumnWidth();
 }
 
 bool RenderBlock::containsFloat(RenderObject* o)
@@ -3026,9 +3181,9 @@ bool RenderBlock::containsFloat(RenderObject* o)
     return false;
 }
 
-void RenderBlock::markAllDescendantsWithFloatsForLayout(RenderObject* floatToRemove)
+void RenderBlock::markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove, bool inLayout)
 {
-    setChildNeedsLayout(true);
+    setChildNeedsLayout(true, !inLayout);
 
     if (floatToRemove)
         removeFloatingObject(floatToRemove);
@@ -3036,14 +3191,16 @@ void RenderBlock::markAllDescendantsWithFloatsForLayout(RenderObject* floatToRem
     // Iterate over our children and mark them as needed.
     if (!childrenInline()) {
         for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-            if (isBlockFlow() && !child->isFloatingOrPositioned() &&
-                ((floatToRemove ? child->containsFloat(floatToRemove) : child->containsFloats()) || child->shrinkToAvoidFloats()))
-                child->markAllDescendantsWithFloatsForLayout(floatToRemove);
+            if ((!floatToRemove && child->isFloatingOrPositioned()) || !child->isRenderBlock())
+                continue;
+            RenderBlock* childBlock = toRenderBlock(child);
+            if ((floatToRemove ? childBlock->containsFloat(floatToRemove) : childBlock->containsFloats()) || childBlock->shrinkToAvoidFloats())
+                childBlock->markAllDescendantsWithFloatsForLayout(floatToRemove, inLayout);
         }
     }
 }
 
-int RenderBlock::getClearDelta(RenderObject *child)
+int RenderBlock::getClearDelta(RenderBox* child, int yPos)
 {
     // There is no need to compute clearance if we have no floats.
     if (!containsFloats())
@@ -3071,11 +3228,11 @@ int RenderBlock::getClearDelta(RenderObject *child)
     // to fit) and not all (we should be using nextFloatBottomBelow and looping).
     // Do not allow tables to wrap in quirks or even in almost strict mode 
     // (ebay on the PLT, finance.yahoo.com in the real world, versiontracker.com forces even almost strict mode not to work)
-    int result = clearSet ? max(0, bottom - child->yPos()) : 0;
+    int result = clearSet ? max(0, bottom - yPos) : 0;
     if (!result && child->avoidsFloats() && child->style()->width().isFixed() && 
-        child->minPrefWidth() > lineWidth(child->yPos()) && child->minPrefWidth() <= availableWidth() && 
+        child->minPrefWidth() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth() && 
         document()->inStrictMode())   
-        result = max(0, floatBottom() - child->yPos());
+        result = max(0, floatBottom() - yPos);
     return result;
 }
 
@@ -3099,12 +3256,10 @@ bool RenderBlock::isPointInOverflowControl(HitTestResult& result, int, int, int,
 
 bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
 {
-    bool inlineFlow = isInlineFlow();
-
-    int tx = _tx + m_x;
-    int ty = _ty + m_y + borderTopExtra();
+    int tx = _tx + x();
+    int ty = _ty + y();
 
-    if (!inlineFlow && !isRenderView()) {
+    if (!isRenderView()) {
         // Check if we need to do anything at all.
         IntRect overflowBox = overflowRect(false);
         overflowBox.move(tx, ty);
@@ -3112,43 +3267,43 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
             return false;
     }
 
-    if (isPointInOverflowControl(result, _x, _y, tx, ty)) {
-        if (hitTestAction == HitTestBlockBackground) {
-            updateHitTestResult(result, IntPoint(_x - tx, _y - ty));
-            return true;
-        }
-        return false;
+    if ((hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) && isPointInOverflowControl(result, _x, _y, tx, ty)) {
+        updateHitTestResult(result, IntPoint(_x - tx, _y - ty));
+        return true;
     }
 
-     // If we have lightweight control clipping, then we can't have any spillout. 
-    if (!hasControlClip() || controlClipRect(tx, ty).contains(_x, _y)) {
+    // If we have clipping, then we can't have any spillout.
+    bool useOverflowClip = hasOverflowClip() && !hasSelfPaintingLayer();
+    bool useClip = (hasControlClip() || useOverflowClip);
+    bool checkChildren = !useClip || (hasControlClip() ? controlClipRect(tx, ty).contains(_x, _y) : overflowClipRect(tx, ty).contains(_x, _y));
+    if (checkChildren) {
         // Hit test descendants first.
         int scrolledX = tx;
         int scrolledY = ty;
         if (hasOverflowClip())
-            m_layer->subtractScrolledContentOffset(scrolledX, scrolledY);
+            layer()->subtractScrolledContentOffset(scrolledX, scrolledY);
 
         // Hit test contents if we don't have columns.
-        if (!m_hasColumns && hitTestContents(request, result, _x, _y, scrolledX, scrolledY, hitTestAction))
+        if (!hasColumns() && hitTestContents(request, result, _x, _y, scrolledX, scrolledY, hitTestAction))
             return true;
             
         // Hit test our columns if we do have them.
-        if (m_hasColumns && hitTestColumns(request, result, _x, _y, scrolledX, scrolledY, hitTestAction))
+        if (hasColumns() && hitTestColumns(request, result, _x, _y, scrolledX, scrolledY, hitTestAction))
             return true;
 
         // Hit test floats.
         if (hitTestAction == HitTestFloat && m_floatingObjects) {
             if (isRenderView()) {
-                scrolledX += static_cast<RenderView*>(this)->frameView()->scrollX();
-                scrolledY += static_cast<RenderView*>(this)->frameView()->scrollY();
+                scrolledX += toRenderView(this)->frameView()->scrollX();
+                scrolledY += toRenderView(this)->frameView()->scrollY();
             }
             
             FloatingObject* o;
             DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
             for (it.toLast(); (o = it.current()); --it) {
-                if (o->m_shouldPaint && !o->m_renderer->hasLayer()) {
-                    int xoffset = scrolledX + o->m_left + o->m_renderer->marginLeft() - o->m_renderer->xPos();
-                    int yoffset =  scrolledY + o->m_top + o->m_renderer->marginTop() - o->m_renderer->yPos();
+                if (o->m_shouldPaint && !o->m_renderer->hasSelfPaintingLayer()) {
+                    int xoffset = scrolledX + o->m_left + o->m_renderer->marginLeft() - o->m_renderer->x();
+                    int yoffset =  scrolledY + o->m_top + o->m_renderer->marginTop() - o->m_renderer->y();
                     if (o->m_renderer->hitTest(request, result, IntPoint(_x, _y), xoffset, yoffset)) {
                         updateHitTestResult(result, IntPoint(_x - xoffset, _y - yoffset));
                         return true;
@@ -3159,11 +3314,10 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     }
 
     // Now hit test our background
-    if (!inlineFlow && (hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground)) {
-        int topExtra = borderTopExtra();
-        IntRect boundsRect(tx, ty - topExtra, m_width, m_height + topExtra + borderBottomExtra());
+    if (hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) {
+        IntRect boundsRect(tx, ty, width(), height());
         if (visibleToHitTesting() && boundsRect.contains(_x, _y)) {
-            updateHitTestResult(result, IntPoint(_x - tx, _y - ty + topExtra));
+            updateHitTestResult(result, IntPoint(_x - tx, _y - ty));
             return true;
         }
     }
@@ -3209,7 +3363,7 @@ bool RenderBlock::hitTestContents(const HitTestRequest& request, HitTestResult&
 {
     if (childrenInline() && !isTable()) {
         // We have to hit-test our line boxes.
-        if (hitTestLines(request, result, x, y, tx, ty, hitTestAction)) {
+        if (m_lineBoxes.hitTest(this, request, result, x, y, tx, ty, hitTestAction)) {
             updateHitTestResult(result, IntPoint(x - tx, y - ty));
             return true;
         }
@@ -3218,10 +3372,8 @@ bool RenderBlock::hitTestContents(const HitTestRequest& request, HitTestResult&
         HitTestAction childHitTest = hitTestAction;
         if (hitTestAction == HitTestChildBlockBackgrounds)
             childHitTest = HitTestChildBlockBackground;
-        for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-            // FIXME: We have to skip over inline flows, since they can show up inside RenderTables at the moment (a demoted inline <form> for example).  If we ever implement a
-            // table-specific hit-test method (which we should do for performance reasons anyway), then we can remove this check.
-            if (!child->hasLayer() && !child->isFloating() && !child->isInlineFlow() && child->nodeAtPoint(request, result, x, y, tx, ty, childHitTest)) {
+        for (RenderBox* child = lastChildBox(); child; child = child->previousSiblingBox()) {
+            if (!child->hasSelfPaintingLayer() && !child->isFloating() && child->nodeAtPoint(request, result, x, y, tx, ty, childHitTest)) {
                 updateHitTestResult(result, IntPoint(x - tx, y - ty));
                 return true;
             }
@@ -3236,158 +3388,178 @@ Position RenderBlock::positionForBox(InlineBox *box, bool start) const
     if (!box)
         return Position();
 
-    if (!box->object()->element())
-        return Position(element(), start ? caretMinOffset() : caretMaxOffset());
+    if (!box->renderer()->node())
+        return Position(node(), start ? caretMinOffset() : caretMaxOffset());
 
     if (!box->isInlineTextBox())
-        return Position(box->object()->element(), start ? box->object()->caretMinOffset() : box->object()->caretMaxOffset());
+        return Position(box->renderer()->node(), start ? box->renderer()->caretMinOffset() : box->renderer()->caretMaxOffset());
 
     InlineTextBox *textBox = static_cast<InlineTextBox *>(box);
-    return Position(box->object()->element(), start ? textBox->start() : textBox->start() + textBox->len());
+    return Position(box->renderer()->node(), start ? textBox->start() : textBox->start() + textBox->len());
 }
 
 Position RenderBlock::positionForRenderer(RenderObject* renderer, bool start) const
 {
     if (!renderer)
-        return Position(element(), 0);
+        return Position(node(), 0);
 
-    Node* node = renderer->element() ? renderer->element() : element();
-    if (!node)
+    Node* n = renderer->node() ? renderer->node() : node();
+    if (!n)
         return Position();
 
-    ASSERT(renderer == node->renderer());
+    ASSERT(renderer == n->renderer());
 
     int offset = start ? renderer->caretMinOffset() : renderer->caretMaxOffset();
 
     // FIXME: This was a runtime check that seemingly couldn't fail; changed it to an assertion for now.
-    ASSERT(!node->isCharacterDataNode() || renderer->isText());
+    ASSERT(!n->isCharacterDataNode() || renderer->isText());
 
-    return Position(node, offset);
+    return Position(n, offset);
 }
 
-VisiblePosition RenderBlock::positionForCoordinates(int x, int y)
+// FIXME: This function should go on RenderObject as an instance method. Then
+// all cases in which positionForPoint recurs could call this instead to
+// prevent crossing editable boundaries. This would require many tests.
+static VisiblePosition positionForPointRespectingEditingBoundaries(RenderBox* parent, RenderBox* child, const IntPoint& pointInParentCoordinates)
 {
-    if (isTable())
-        return RenderFlow::positionForCoordinates(x, y); 
+    IntPoint pointInChildCoordinates(pointInParentCoordinates - child->location());
 
-    int top = borderTop();
-    int bottom = top + borderTopExtra() + paddingTop() + contentHeight() + paddingBottom() + borderBottomExtra();
+    // If this is an anonymous renderer, we just recur normally
+    Node* childNode = child->node();
+    if (!childNode)
+        return child->positionForPoint(pointInChildCoordinates);
 
-    int left = borderLeft();
-    int right = left + paddingLeft() + contentWidth() + paddingRight();
+    // Otherwise, first make sure that the editability of the parent and child agree.
+    // If they don't agree, then we return a visible position just before or after the child
+    RenderObject* ancestor = parent;
+    while (ancestor && !ancestor->node())
+        ancestor = ancestor->parent();
 
-    Node* n = element();
-    
-    int contentsX = x;
-    int contentsY = y;
-    offsetForContents(contentsX, contentsY);
+    // If we can't find an ancestor to check editability on, or editability is unchanged, we recur like normal
+    if (!ancestor || ancestor->node()->isContentEditable() == childNode->isContentEditable())
+        return child->positionForPoint(pointInChildCoordinates);
 
-    if (isReplaced()) {
-        if (y < 0 || y < height() && x < 0)
-            return VisiblePosition(n, caretMinOffset(), DOWNSTREAM);
-        if (y >= height() || y >= 0 && x >= width())
-            return VisiblePosition(n, caretMaxOffset(), DOWNSTREAM);
-    } 
+    // Otherwise return before or after the child, depending on if the click was left or right of the child
+    int childMidX = child->width() / 2;
+    if (pointInChildCoordinates.x() < childMidX)
+        return ancestor->createVisiblePosition(childNode->nodeIndex(), DOWNSTREAM);
+    return ancestor->createVisiblePosition(childNode->nodeIndex() + 1, UPSTREAM);
+}
 
-    // If we start inside the shadow tree, we will stay inside (even if the point is above or below).
-    if (!(n && n->isShadowNode()) && !childrenInline()) {
-        // Don't return positions inside editable roots for coordinates outside those roots, except for coordinates outside
-        // a document that is entirely editable.
-        bool isEditableRoot = n && n->rootEditableElement() == n && !n->hasTagName(bodyTag) && !n->hasTagName(htmlTag);
-
-        if (y < top || (isEditableRoot && (y < bottom && x < left))) {
-            if (!isEditableRoot)
-                if (RenderObject* c = firstChild()) { // FIXME: This code doesn't make any sense.  This child could be an inline or a positioned element or a float or a compact, etc.
-                    VisiblePosition p = c->positionForCoordinates(contentsX - c->xPos(), contentsY - c->yPos());
-                    if (p.isNotNull())
-                        return p;
-                }
-            if (n) {
-                if (Node* sp = n->shadowParentNode())
-                    n = sp;
-                if (Node* p = n->parent())
-                    return VisiblePosition(p, n->nodeIndex(), DOWNSTREAM);
-            }
-            return VisiblePosition(n, 0, DOWNSTREAM);
-        }
+VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint& pointInContents)
+{
+    ASSERT(childrenInline());
 
-        if (y >= bottom || (isEditableRoot && (y >= top && x >= right))) {
-            if (!isEditableRoot)
-                if (RenderObject* c = lastChild()) { // FIXME: This code doesn't make any sense.  This child could be an inline or a positioned element or a float or a compact, ect.
-                    VisiblePosition p = c->positionForCoordinates(contentsX - c->xPos(), contentsY - c->yPos());
-                    if (p.isNotNull())
-                        return p;
-                }
-            if (n) {
-                if (Node* sp = n->shadowParentNode())
-                    n = sp;
-                if (Node* p = n->parent())
-                    return VisiblePosition(p, n->nodeIndex() + 1, DOWNSTREAM);
-            }
-            return VisiblePosition(n, 0, DOWNSTREAM);
+    if (!firstRootBox())
+        return createVisiblePosition(0, DOWNSTREAM);
+
+    // look for the closest line box in the root box which is at the passed-in y coordinate
+    InlineBox* closestBox = 0;
+    RootInlineBox* firstRootBoxWithChildren = 0;
+    RootInlineBox* lastRootBoxWithChildren = 0;
+    for (RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox()) {
+        if (!root->firstChild())
+            continue;
+        if (!firstRootBoxWithChildren)
+            firstRootBoxWithChildren = root;
+        lastRootBoxWithChildren = root;
+
+        // set the bottom based on whether there is a next root box
+        // FIXME: This will consider nextRootBox even if it has no children, and maybe it shouldn't.
+        int bottom;
+        if (root->nextRootBox()) {
+            // FIXME: We would prefer to make the break point halfway between the bottom
+            // of the previous root box and the top of the next root box.
+            bottom = root->nextRootBox()->topOverflow();
+        } else
+            bottom = root->bottomOverflow() + verticalLineClickFudgeFactor;
+
+        // check if this root line box is located at this y coordinate
+        if (pointInContents.y() < bottom) {
+            closestBox = root->closestLeafChildForXPos(pointInContents.x());
+            if (closestBox)
+                break;
         }
     }
 
-    if (childrenInline()) {
-        if (!firstRootBox())
-            return VisiblePosition(n, 0, DOWNSTREAM);
+    Settings* settings = document()->settings();
+    bool useWindowsBehavior = settings && settings->editingBehavior() == EditingWindowsBehavior;
 
-        if (contentsY < firstRootBox()->topOverflow() - verticalLineClickFudgeFactor)
-            // y coordinate is above first root line box
-            return VisiblePosition(positionForBox(firstRootBox()->firstLeafChild(), true), DOWNSTREAM);
-        
-        // look for the closest line box in the root box which is at the passed-in y coordinate
-        for (RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox()) {
-            // set the bottom based on whether there is a next root box
-            if (root->nextRootBox())
-                // FIXME: make the break point halfway between the bottom of the previous root box and the top of the next root box
-                bottom = root->nextRootBox()->topOverflow();
-            else
-                bottom = root->bottomOverflow() + verticalLineClickFudgeFactor;
-            // check if this root line box is located at this y coordinate
-            if (contentsY < bottom && root->firstChild()) {
-                InlineBox* closestBox = root->closestLeafChildForXPos(x);
-                if (closestBox)
-                    // pass the box a y position that is inside it
-                    return closestBox->object()->positionForCoordinates(contentsX, closestBox->m_y);
-            }
+    if (useWindowsBehavior && !closestBox && lastRootBoxWithChildren) {
+        // y coordinate is below last root line box, pretend we hit it
+        closestBox = lastRootBoxWithChildren->closestLeafChildForXPos(pointInContents.x());
+    }
+
+    if (closestBox) {
+        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->topOverflow() - verticalLineClickFudgeFactor) {
+            // y coordinate is above first root line box, so return the start of the first
+            return VisiblePosition(positionForBox(firstRootBoxWithChildren->firstLeafChild(), true), DOWNSTREAM);
         }
 
-        if (lastRootBox())
-            // y coordinate is below last root line box
-            return VisiblePosition(positionForBox(lastRootBox()->lastLeafChild(), false), DOWNSTREAM);
+        // pass the box a y position that is inside it
+        return closestBox->renderer()->positionForPoint(IntPoint(pointInContents.x(), closestBox->m_y));
+    }
 
-        return VisiblePosition(n, 0, DOWNSTREAM);
+    if (lastRootBoxWithChildren) {
+        // We hit this case for Mac behavior when the Y coordinate is below the last box.
+        ASSERT(!useWindowsBehavior);
+        return VisiblePosition(positionForBox(lastRootBoxWithChildren->lastLeafChild(), false), DOWNSTREAM);
     }
-    
-    // See if any child blocks exist at this y coordinate.
-    if (firstChild() && contentsY < firstChild()->yPos())
-        return VisiblePosition(n, 0, DOWNSTREAM);
-    for (RenderObject* renderer = firstChild(); renderer; renderer = renderer->nextSibling()) {
-        if (renderer->height() == 0 || renderer->style()->visibility() != VISIBLE || renderer->isFloatingOrPositioned())
-            continue;
-        RenderObject* next = renderer->nextSibling();
-        while (next && next->isFloatingOrPositioned())
-            next = next->nextSibling();
-        if (next) 
-            bottom = next->yPos();
-        else
-            bottom = top + scrollHeight();
-        if (contentsY >= renderer->yPos() && contentsY < bottom)
-            return renderer->positionForCoordinates(contentsX - renderer->xPos(), contentsY - renderer->yPos());
+
+    // Can't reach this. We have a root line box, but it has no kids.
+    // FIXME: This should ASSERT_NOT_REACHED(), but clicking on placeholder text
+    // seems to hit this code path.
+    return createVisiblePosition(0, DOWNSTREAM);
+}
+
+static inline bool isChildHitTestCandidate(RenderBox* box)
+{
+    return box->height() && box->style()->visibility() == VISIBLE && !box->isFloatingOrPositioned();
+}
+
+VisiblePosition RenderBlock::positionForPoint(const IntPoint& point)
+{
+    if (isTable())
+        return RenderBox::positionForPoint(point);
+
+    if (isReplaced()) {
+        if (point.y() < 0 || (point.y() < height() && point.x() < 0))
+            return createVisiblePosition(caretMinOffset(), DOWNSTREAM);
+        if (point.y() >= height() || (point.y() >= 0 && point.x() >= width()))
+            return createVisiblePosition(caretMaxOffset(), DOWNSTREAM);
+    } 
+
+    int contentsX = point.x();
+    int contentsY = point.y();
+    offsetForContents(contentsX, contentsY);
+    IntPoint pointInContents(contentsX, contentsY);
+
+    if (childrenInline())
+        return positionForPointWithInlineChildren(pointInContents);
+
+    if (lastChildBox() && contentsY > lastChildBox()->y()) {
+        for (RenderBox* childBox = lastChildBox(); childBox; childBox = childBox->previousSiblingBox()) {
+            if (isChildHitTestCandidate(childBox))
+                return positionForPointRespectingEditingBoundaries(this, childBox, pointInContents);
+        }
+    } else {
+        for (RenderBox* childBox = firstChildBox(); childBox; childBox = childBox->nextSiblingBox()) {
+            // We hit child if our click is above the bottom of its padding box (like IE6/7 and FF3).
+            if (isChildHitTestCandidate(childBox) && contentsY < childBox->frameRect().bottom())
+                return positionForPointRespectingEditingBoundaries(this, childBox, pointInContents);
+        }
     }
-    
-    return RenderFlow::positionForCoordinates(x, y);
+
+    // We only get here if there are no hit test candidate children below the click.
+    return RenderBox::positionForPoint(point);
 }
 
 void RenderBlock::offsetForContents(int& tx, int& ty) const
 {
-    ty -= borderTopExtra();
-    
     if (hasOverflowClip())
-        m_layer->addScrolledContentOffset(tx, ty);
+        layer()->addScrolledContentOffset(tx, ty);
 
-    if (m_hasColumns) {
+    if (hasColumns()) {
         IntPoint contentsPoint(tx, ty);
         adjustPointToColumnContents(contentsPoint);
         tx = contentsPoint.x();
@@ -3398,7 +3570,7 @@ void RenderBlock::offsetForContents(int& tx, int& ty) const
 int RenderBlock::availableWidth() const
 {
     // If we have multiple columns, then the available width is reduced to our column width.
-    if (m_hasColumns)
+    if (hasColumns())
         return desiredColumnWidth();
     return contentWidth();
 }
@@ -3456,20 +3628,20 @@ void RenderBlock::calcColumnWidth()
 void RenderBlock::setDesiredColumnCountAndWidth(int count, int width)
 {
     if (count == 1) {
-        if (m_hasColumns) {
+        if (hasColumns()) {
             delete gColumnInfoMap->take(this);
-            m_hasColumns = false;
+            setHasColumns(false);
         }
     } else {
         ColumnInfo* info;
-        if (m_hasColumns)
+        if (hasColumns())
             info = gColumnInfoMap->get(this);
         else {
             if (!gColumnInfoMap)
                 gColumnInfoMap = new ColumnInfoMap;
             info = new ColumnInfo;
             gColumnInfoMap->add(this, info);
-            m_hasColumns = true;
+            setHasColumns(true);
         }
         info->m_desiredColumnCount = count;
         info->m_desiredColumnWidth = width;   
@@ -3478,21 +3650,21 @@ void RenderBlock::setDesiredColumnCountAndWidth(int count, int width)
 
 int RenderBlock::desiredColumnWidth() const
 {
-    if (!m_hasColumns)
+    if (!hasColumns())
         return contentWidth();
     return gColumnInfoMap->get(this)->m_desiredColumnWidth;
 }
 
 unsigned RenderBlock::desiredColumnCount() const
 {
-    if (!m_hasColumns)
+    if (!hasColumns())
         return 1;
     return gColumnInfoMap->get(this)->m_desiredColumnCount;
 }
 
 Vector<IntRect>* RenderBlock::columnRects() const
 {
-    if (!m_hasColumns)
+    if (!hasColumns())
         return 0;
     return &gColumnInfoMap->get(this)->m_columnRects;    
 }
@@ -3500,7 +3672,7 @@ Vector<IntRect>* RenderBlock::columnRects() const
 int RenderBlock::layoutColumns(int endOfContent)
 {
     // Don't do anything if we have no columns
-    if (!m_hasColumns)
+    if (!hasColumns())
         return -1;
 
     ColumnInfo* info = gColumnInfoMap->get(this);
@@ -3552,9 +3724,9 @@ int RenderBlock::layoutColumns(int endOfContent)
         GraphicsContext context((PlatformGraphicsContext*)0);
         RenderObject::PaintInfo paintInfo(&context, pageRect, PaintPhaseForeground, false, 0, 0);
         
-        m_hasColumns = false;
+        setHasColumns(false);
         paintObject(paintInfo, 0, 0);
-        m_hasColumns = true;
+        setHasColumns(true);
 
         int adjustedBottom = v->bestTruncatedAt();
         if (adjustedBottom <= currY)
@@ -3592,14 +3764,14 @@ int RenderBlock::layoutColumns(int endOfContent)
             colCount++;
     }
 
-    m_overflowWidth = max(m_width, currX - colGap);
+    m_overflowWidth = max(width(), currX - colGap);
     m_overflowLeft = min(0, currX + desiredColumnWidth + colGap);
 
     m_overflowHeight = maxColBottom;
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
         
     if (computeIntrinsicHeight)
-        m_height = m_overflowHeight + toAdd;
+        setHeight(m_overflowHeight + toAdd);
 
     v->setPrintRect(IntRect());
     v->setTruncatedAt(0);
@@ -3612,7 +3784,7 @@ int RenderBlock::layoutColumns(int endOfContent)
 void RenderBlock::adjustPointToColumnContents(IntPoint& point) const
 {
     // Just bail if we have no columns.
-    if (!m_hasColumns)
+    if (!hasColumns())
         return;
     
     Vector<IntRect>* colRects = columnRects();
@@ -3641,7 +3813,7 @@ void RenderBlock::adjustPointToColumnContents(IntPoint& point) const
 void RenderBlock::adjustRectForColumns(IntRect& r) const
 {
     // Just bail if we have no columns.
-    if (!m_hasColumns)
+    if (!hasColumns())
         return;
     
     Vector<IntRect>* colRects = columnRects();
@@ -3698,7 +3870,7 @@ void RenderBlock::calcPrefWidths()
             m_minPrefWidth = m_maxPrefWidth;
             
             // A horizontal marquee with inline children has no minimum width.
-            if (m_layer && m_layer->marquee() && m_layer->marquee()->isHorizontal())
+            if (layer() && layer()->marquee() && layer()->marquee()->isHorizontal())
                 m_minPrefWidth = 0;
         }
 
@@ -3760,7 +3932,7 @@ RenderObject* InlineMinMaxIterator::next()
             result = current->firstChild();
         if (!result) {
             // We hit the end of our inline. (It was empty, e.g., <span></span>.)
-            if (!oldEndOfInline && current->isInlineFlow()) {
+            if (!oldEndOfInline && current->isRenderInline()) {
                 result = current;
                 endOfInline = true;
                 break;
@@ -3770,7 +3942,7 @@ RenderObject* InlineMinMaxIterator::next()
                 result = current->nextSibling();
                 if (result) break;
                 current = current->parent();
-                if (current && current != parent && current->isInlineFlow()) {
+                if (current && current != parent && current->isRenderInline()) {
                     result = current;
                     endOfInline = true;
                     break;
@@ -3781,7 +3953,7 @@ RenderObject* InlineMinMaxIterator::next()
         if (!result)
             break;
 
-        if (!result->isPositioned() && (result->isText() || result->isFloating() || result->isReplaced() || result->isInlineFlow()))
+        if (!result->isPositioned() && (result->isText() || result->isFloating() || result->isReplaced() || result->isRenderInline()))
              break;
         
         current = result;
@@ -3800,7 +3972,7 @@ static int getBPMWidth(int childValue, Length cssUnit)
     return 0;
 }
 
-static int getBorderPaddingMargin(const RenderObject* child, bool endOfInline)
+static int getBorderPaddingMargin(const RenderBoxModelObject* child, bool endOfInline)
 {
     RenderStyle* cstyle = child->style();
     int result = 0;
@@ -3820,7 +3992,7 @@ static inline void stripTrailingSpace(int& inlineMax, int& inlineMin,
 {
     if (trailingSpaceChild && trailingSpaceChild->isText()) {
         // Collapse away the trailing space at the end of a block.
-        RenderText* t = static_cast<RenderText*>(trailingSpaceChild);
+        RenderText* t = toRenderText(trailingSpaceChild);
         const UChar space = ' ';
         const Font& font = t->style()->font(); // FIXME: This ignores first-line.
         int spaceWidth = font.width(TextRun(&space, 1));
@@ -3900,10 +4072,10 @@ void RenderBlock::calcInlinePrefWidths()
 
             if (!child->isText()) {
                 // Case (1) and (2).  Inline replaced and inline flow elements.
-                if (child->isInlineFlow()) {
+                if (child->isRenderInline()) {
                     // Add in padding/border/margin from the appropriate side of
                     // the element.
-                    int bpm = getBorderPaddingMargin(child, childIterator.endOfInline);
+                    int bpm = getBorderPaddingMargin(toRenderInline(child), childIterator.endOfInline);
                     childMin += bpm;
                     childMax += bpm;
 
@@ -3935,14 +4107,14 @@ void RenderBlock::calcInlinePrefWidths()
                 bool clearPreviousFloat;
                 if (child->isFloating()) {
                     clearPreviousFloat = (prevFloat
-                        && (prevFloat->style()->floating() == FLEFT && (child->style()->clear() & CLEFT)
-                            || prevFloat->style()->floating() == FRIGHT && (child->style()->clear() & CRIGHT)));
+                        && ((prevFloat->style()->floating() == FLEFT && (child->style()->clear() & CLEFT))
+                            || (prevFloat->style()->floating() == FRIGHT && (child->style()->clear() & CRIGHT))));
                     prevFloat = child;
                 } else
                     clearPreviousFloat = false;
 
                 bool canBreakReplacedElement = !child->isImage() || allowImagesToBreak;
-                if (canBreakReplacedElement && (autoWrap || oldAutoWrap) || clearPreviousFloat) {
+                if ((canBreakReplacedElement && (autoWrap || oldAutoWrap)) || clearPreviousFloat) {
                     m_minPrefWidth = max(inlineMin, m_minPrefWidth);
                     inlineMin = 0;
                 }
@@ -3986,7 +4158,7 @@ void RenderBlock::calcInlinePrefWidths()
                 }
             } else if (child->isText()) {
                 // Case (3). Text.
-                RenderText* t = static_cast<RenderText *>(child);
+                RenderText* t = toRenderText(child);
 
                 if (t->isWordBreak()) {
                     m_minPrefWidth = max(inlineMin, m_minPrefWidth);
@@ -4077,7 +4249,7 @@ void RenderBlock::calcInlinePrefWidths()
         }
 
         oldAutoWrap = autoWrap;
-        if (!child->isInlineFlow())
+        if (!child->isRenderInline())
             previousLeaf = child;
     }
 
@@ -4104,7 +4276,7 @@ void RenderBlock::calcBlockPrefWidths()
             continue;
         }
 
-        if (child->isFloating() || child->avoidsFloats()) {
+        if (child->isFloating() || (child->isBox() && toRenderBox(child)->avoidsFloats())) {
             int floatTotalWidth = floatLeftWidth + floatRightWidth;
             if (child->style()->clear() & CLEFT) {
                 m_maxPrefWidth = max(floatTotalWidth, m_maxPrefWidth);
@@ -4138,7 +4310,7 @@ void RenderBlock::calcBlockPrefWidths()
         w = child->maxPrefWidth() + margin;
 
         if (!child->isFloating()) {
-            if (child->avoidsFloats()) {
+            if (child->isBox() && toRenderBox(child)->avoidsFloats()) {
                 // Determine a left and right max value based off whether or not the floats can fit in the
                 // margins of the object.  For negative margins, we will attempt to overlap the float if the negative margin
                 // is smaller than the float width.
@@ -4194,11 +4366,11 @@ void RenderBlock::calcBlockPrefWidths()
 
 bool RenderBlock::hasLineIfEmpty() const
 {
-    return element() && (element()->isContentEditable() && element()->rootEditableElement() == element() ||
-                         element()->isShadowNode() && element()->shadowParentNode()->hasTagName(inputTag));
+    return node() && ((node()->isContentEditable() && node()->rootEditableElement() == node()) ||
+            (node()->isShadowNode() && node()->shadowParentNode()->hasTagName(inputTag)));
 }
 
-int RenderBlock::lineHeight(bool b, bool isRootLineBox) const
+int RenderBlock::lineHeight(bool firstLine, bool isRootLineBox) const
 {
     // Inline blocks are replaced elements. Otherwise, just pass off to
     // the base class.  If we're being queried as though we're the root line
@@ -4206,7 +4378,17 @@ int RenderBlock::lineHeight(bool b, bool isRootLineBox) const
     // just like a block.
     if (isReplaced() && !isRootLineBox)
         return height() + marginTop() + marginBottom();
-    return RenderFlow::lineHeight(b, isRootLineBox);
+    
+    if (firstLine && document()->usesFirstLineRules()) {
+        RenderStyle* s = style(firstLine);
+        if (s != style())
+            return s->computedLineHeight();
+    }
+    
+    if (m_lineHeight == -1)
+        m_lineHeight = style()->computedLineHeight();
+
+    return m_lineHeight;
 }
 
 int RenderBlock::baselinePosition(bool b, bool isRootLineBox) const
@@ -4228,31 +4410,31 @@ int RenderBlock::baselinePosition(bool b, bool isRootLineBox) const
         // We also give up on finding a baseline if we have a vertical scrollbar, or if we are scrolled
         // vertically (e.g., an overflow:hidden block that has had scrollTop moved) or if the baseline is outside
         // of our content box.
-        int baselinePos = (m_layer && (m_layer->marquee() || m_layer->verticalScrollbar() || m_layer->scrollYOffset() != 0)) ? -1 : getBaselineOfLastLineBox();
+        int baselinePos = (layer() && (layer()->marquee() || layer()->verticalScrollbar() || layer()->scrollYOffset() != 0)) ? -1 : lastLineBoxBaseline();
         if (baselinePos != -1 && baselinePos <= borderTop() + paddingTop() + contentHeight())
             return marginTop() + baselinePos;
         return height() + marginTop() + marginBottom();
     }
-    return RenderFlow::baselinePosition(b, isRootLineBox);
+    return RenderBox::baselinePosition(b, isRootLineBox);
 }
 
-int RenderBlock::getBaselineOfFirstLineBox() const
+int RenderBlock::firstLineBoxBaseline() const
 {
     if (!isBlockFlow())
-        return RenderFlow::getBaselineOfFirstLineBox();
+        return -1;
 
     if (childrenInline()) {
         if (firstLineBox())
-            return firstLineBox()->yPos() + firstLineBox()->baseline();
+            return firstLineBox()->y() + style(true)->font().ascent();
         else
             return -1;
     }
     else {
-        for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        for (RenderBox* curr = firstChildBox(); curr; curr = curr->nextSiblingBox()) {
             if (!curr->isFloatingOrPositioned()) {
-                int result = curr->getBaselineOfFirstLineBox();
+                int result = curr->firstLineBoxBaseline();
                 if (result != -1)
-                    return curr->yPos() + result; // Translate to our coordinate space.
+                    return curr->y() + result; // Translate to our coordinate space.
             }
         }
     }
@@ -4260,30 +4442,30 @@ int RenderBlock::getBaselineOfFirstLineBox() const
     return -1;
 }
 
-int RenderBlock::getBaselineOfLastLineBox() const
+int RenderBlock::lastLineBoxBaseline() const
 {
     if (!isBlockFlow())
-        return RenderFlow::getBaselineOfLastLineBox();
+        return -1;
 
     if (childrenInline()) {
         if (!firstLineBox() && hasLineIfEmpty())
-            return RenderFlow::baselinePosition(true, true) + borderTop() + paddingTop();
+            return RenderBox::baselinePosition(true, true) + borderTop() + paddingTop();
         if (lastLineBox())
-            return lastLineBox()->yPos() + lastLineBox()->baseline();
+            return lastLineBox()->y() + style(lastLineBox() == firstLineBox())->font().ascent();
         return -1;
     }
     else {
         bool haveNormalFlowChild = false;
-        for (RenderObject* curr = lastChild(); curr; curr = curr->previousSibling()) {
+        for (RenderBox* curr = lastChildBox(); curr; curr = curr->previousSiblingBox()) {
             if (!curr->isFloatingOrPositioned()) {
                 haveNormalFlowChild = true;
-                int result = curr->getBaselineOfLastLineBox();
+                int result = curr->lastLineBoxBaseline();
                 if (result != -1)
-                    return curr->yPos() + result; // Translate to our coordinate space.
+                    return curr->y() + result; // Translate to our coordinate space.
             }
         }
         if (!haveNormalFlowChild && hasLineIfEmpty())
-            return RenderFlow::baselinePosition(true, true) + borderTop() + paddingTop();
+            return RenderBox::baselinePosition(true, true) + borderTop() + paddingTop();
     }
 
     return -1;
@@ -4302,31 +4484,32 @@ bool RenderBlock::containsNonZeroBidiLevel() const
 
 RenderBlock* RenderBlock::firstLineBlock() const
 {
-    const RenderObject* firstLineBlock = this;
+    RenderBlock* firstLineBlock = const_cast<RenderBlock*>(this);
     bool hasPseudo = false;
     while (true) {
-        hasPseudo = firstLineBlock->style()->hasPseudoStyle(RenderStyle::FIRST_LINE);
+        hasPseudo = firstLineBlock->style()->hasPseudoStyle(FIRST_LINE);
         if (hasPseudo)
             break;
         RenderObject* parentBlock = firstLineBlock->parent();
         if (firstLineBlock->isReplaced() || firstLineBlock->isFloating() || 
             !parentBlock || parentBlock->firstChild() != firstLineBlock || !parentBlock->isBlockFlow())
             break;
-        firstLineBlock = parentBlock;
+        ASSERT(parentBlock->isRenderBlock());
+        firstLineBlock = toRenderBlock(parentBlock);
     } 
     
     if (!hasPseudo)
         return 0;
     
-    return (RenderBlock*)(firstLineBlock);
+    return firstLineBlock;
 }
 
 void RenderBlock::updateFirstLetter()
 {
     if (!document()->usesFirstLetterRules())
         return;
-    // Don't recurse
-    if (style()->styleType() == RenderStyle::FIRST_LETTER)
+    // Don't recur
+    if (style()->styleType() == FIRST_LETTER)
         return;
 
     // FIXME: We need to destroy the first-letter object if it is no longer the first child.  Need to find
@@ -4336,7 +4519,7 @@ void RenderBlock::updateFirstLetter()
     while (true) {
         // We only honor first-letter if the firstLetterBlock can have children in the DOM. This correctly 
         // prevents form controls from honoring first-letter.
-        hasPseudoStyle = firstLetterBlock->style()->hasPseudoStyle(RenderStyle::FIRST_LETTER) 
+        hasPseudoStyle = firstLetterBlock->style()->hasPseudoStyle(FIRST_LETTER) 
             && firstLetterBlock->canHaveChildren();
         if (hasPseudoStyle)
             break;
@@ -4354,7 +4537,7 @@ void RenderBlock::updateFirstLetter()
     RenderObject* currChild = firstLetterBlock->firstChild();
     while (currChild && currChild->needsLayout() && (!currChild->isReplaced() || currChild->isFloatingOrPositioned()) && !currChild->isText()) {
         if (currChild->isFloatingOrPositioned()) {
-            if (currChild->style()->styleType() == RenderStyle::FIRST_LETTER)
+            if (currChild->style()->styleType() == FIRST_LETTER)
                 break;
             currChild = currChild->nextSibling();
         } else
@@ -4372,8 +4555,8 @@ void RenderBlock::updateFirstLetter()
 
     // If the child already has style, then it has already been created, so we just want
     // to update it.
-    if (currChild->style()->styleType() == RenderStyle::FIRST_LETTER) {
-        RenderStyle* pseudo = firstLetterBlock->getCachedPseudoStyle(RenderStyle::FIRST_LETTER,
+    if (currChild->style()->styleType() == FIRST_LETTER) {
+        RenderStyle* pseudo = firstLetterBlock->getCachedPseudoStyle(FIRST_LETTER,
                                                                      firstLetterContainer->firstLineStyle());
         currChild->setStyle(pseudo);
         for (RenderObject* genChild = currChild->firstChild(); genChild; genChild = genChild->nextSibling()) {
@@ -4384,22 +4567,27 @@ void RenderBlock::updateFirstLetter()
     }
 
     // If the child does not already have style, we create it here.
-    if (currChild->isText() && !currChild->isBR() && currChild->parent()->style()->styleType() != RenderStyle::FIRST_LETTER) {
+    if (currChild->isText() && !currChild->isBR() && currChild->parent()->style()->styleType() != FIRST_LETTER) {
         // Our layout state is not valid for the repaints we are going to trigger by
         // adding and removing children of firstLetterContainer.
         view()->disableLayoutState();
 
-        RenderText* textObj = static_cast<RenderText*>(currChild);
+        RenderText* textObj = toRenderText(currChild);
         
         // Create our pseudo style now that we have our firstLetterContainer determined.
-        RenderStyle* pseudoStyle = firstLetterBlock->getCachedPseudoStyle(RenderStyle::FIRST_LETTER,
+        RenderStyle* pseudoStyle = firstLetterBlock->getCachedPseudoStyle(FIRST_LETTER,
                                                                           firstLetterContainer->firstLineStyle());
         
         // Force inline display (except for floating first-letters)
-        pseudoStyle->setDisplay( pseudoStyle->isFloating() ? BLOCK : INLINE);
-        pseudoStyle->setPosition( StaticPosition ); // CSS2 says first-letter can't be positioned.
+        pseudoStyle->setDisplay(pseudoStyle->isFloating() ? BLOCK : INLINE);
+        pseudoStyle->setPosition(StaticPosition); // CSS2 says first-letter can't be positioned.
         
-        RenderObject* firstLetter = RenderFlow::createAnonymousFlow(document(), pseudoStyle); // anonymous box
+        RenderObject* firstLetter = 0;
+        if (pseudoStyle->display() == INLINE)
+            firstLetter = new (renderArena()) RenderInline(document());
+        else
+            firstLetter = new (renderArena()) RenderBlock(document());
+        firstLetter->setStyle(pseudoStyle);
         firstLetterContainer->addChild(firstLetter, currChild);
         
         // The original string is going to be either a generated content string or a DOM node's
@@ -4421,10 +4609,10 @@ void RenderBlock::updateFirstLetter()
             // construct text fragment for the text after the first letter
             // NOTE: this might empty
             RenderTextFragment* remainingText = 
-                new (renderArena()) RenderTextFragment(textObj->node(), oldText.get(), length, oldText->length() - length);
+                new (renderArena()) RenderTextFragment(textObj->node() ? textObj->node() : textObj->document(), oldText.get(), length, oldText->length() - length);
             remainingText->setStyle(textObj->style());
-            if (remainingText->element())
-                remainingText->element()->setRenderer(remainingText);
+            if (remainingText->node())
+                remainingText->node()->setRenderer(remainingText);
             
             RenderObject* nextObj = textObj->nextSibling();
             firstLetterContainer->removeChild(textObj);
@@ -4433,7 +4621,7 @@ void RenderBlock::updateFirstLetter()
             
             // construct text fragment for the first letter
             RenderTextFragment* letter = 
-                new (renderArena()) RenderTextFragment(remainingText->node(), oldText.get(), 0, length);
+                new (renderArena()) RenderTextFragment(remainingText->node() ? remainingText->node() : remainingText->document(), oldText.get(), 0, length);
             RefPtr<RenderStyle> newStyle = RenderStyle::create();
             newStyle->inheritFrom(pseudoStyle);
             letter->setStyle(newStyle.release());
@@ -4460,7 +4648,7 @@ bool RenderBlock::inRootBlockContext() const
 // (crawling into blocks).
 static bool shouldCheckLines(RenderObject* obj)
 {
-    return !obj->isFloatingOrPositioned() && !obj->isCompact() && !obj->isRunIn() &&
+    return !obj->isFloatingOrPositioned() && !obj->isRunIn() &&
             obj->isBlockFlow() && obj->style()->height().isAuto() &&
             (!obj->isFlexibleBox() || obj->style()->boxOrient() == VERTICAL);
 }
@@ -4477,7 +4665,7 @@ static RootInlineBox* getLineAtIndex(RenderBlock* block, int i, int& count)
         else {
             for (RenderObject* obj = block->firstChild(); obj; obj = obj->nextSibling()) {
                 if (shouldCheckLines(obj)) {
-                    RootInlineBox *box = getLineAtIndex(static_cast<RenderBlock*>(obj), i, count);
+                    RootInlineBox *box = getLineAtIndex(toRenderBlock(obj), i, count);
                     if (box)
                         return box;
                 }
@@ -4487,7 +4675,7 @@ static RootInlineBox* getLineAtIndex(RenderBlock* block, int i, int& count)
     return 0;
 }
 
-int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom, int& count)
+static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom, int& count)
 {
     if (block->style()->visibility() == VISIBLE) {
         if (block->childrenInline()) {
@@ -4497,18 +4685,18 @@ int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom, int& co
             }
         }
         else {
-            RenderObject* normalFlowChildWithoutLines = 0;
-            for (RenderObject* obj = block->firstChild(); obj; obj = obj->nextSibling()) {
+            RenderBox* normalFlowChildWithoutLines = 0;
+            for (RenderBox* obj = block->firstChildBox(); obj; obj = obj->nextSiblingBox()) {
                 if (shouldCheckLines(obj)) {
-                    int result = getHeightForLineCount(static_cast<RenderBlock*>(obj), l, false, count);
+                    int result = getHeightForLineCount(toRenderBlock(obj), l, false, count);
                     if (result != -1)
-                        return result + obj->yPos() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                        return result + obj->y() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
                 }
-                else if (!obj->isFloatingOrPositioned() && !obj->isCompact() && !obj->isRunIn())
+                else if (!obj->isFloatingOrPositioned() && !obj->isRunIn())
                     normalFlowChildWithoutLines = obj;
             }
             if (normalFlowChildWithoutLines && l == 0)
-                return normalFlowChildWithoutLines->yPos() + normalFlowChildWithoutLines->height();
+                return normalFlowChildWithoutLines->y() + normalFlowChildWithoutLines->height();
         }
     }
     
@@ -4531,7 +4719,7 @@ int RenderBlock::lineCount()
         else
             for (RenderObject* obj = firstChild(); obj; obj = obj->nextSibling())
                 if (shouldCheckLines(obj))
-                    count += static_cast<RenderBlock*>(obj)->lineCount();
+                    count += toRenderBlock(obj)->lineCount();
     }
     return count;
 }
@@ -4550,20 +4738,20 @@ void RenderBlock::adjustForBorderFit(int x, int& left, int& right) const
         if (childrenInline()) {
             for (RootInlineBox* box = firstRootBox(); box; box = box->nextRootBox()) {
                 if (box->firstChild())
-                    left = min(left, x + box->firstChild()->xPos());
+                    left = min(left, x + box->firstChild()->x());
                 if (box->lastChild())
-                    right = max(right, x + box->lastChild()->xPos() + box->lastChild()->width());
+                    right = max(right, x + box->lastChild()->x() + box->lastChild()->width());
             }
         }
         else {
-            for (RenderObject* obj = firstChild(); obj; obj = obj->nextSibling()) {
+            for (RenderBox* obj = firstChildBox(); obj; obj = obj->nextSiblingBox()) {
                 if (!obj->isFloatingOrPositioned()) {
                     if (obj->isBlockFlow() && !obj->hasOverflowClip())
-                        static_cast<RenderBlock*>(obj)->adjustForBorderFit(x + obj->xPos(), left, right);
+                        toRenderBlock(obj)->adjustForBorderFit(x + obj->x(), left, right);
                     else if (obj->style()->visibility() == VISIBLE) {
                         // We are a replaced element or some kind of non-block-flow object.
-                        left = min(left, x + obj->xPos());
-                        right = max(right, x + obj->xPos() + obj->width());
+                        left = min(left, x + obj->x());
+                        right = max(right, x + obj->x() + obj->width());
                     }
                 }
             }
@@ -4575,7 +4763,7 @@ void RenderBlock::adjustForBorderFit(int x, int& left, int& right) const
             for (; (r = it.current()); ++it) {
                 // Only examine the object if our m_shouldPaint flag is set.
                 if (r->m_shouldPaint) {
-                    int floatLeft = r->m_left - r->m_renderer->xPos() + r->m_renderer->marginLeft();
+                    int floatLeft = r->m_left - r->m_renderer->x() + r->m_renderer->marginLeft();
                     int floatRight = floatLeft + r->m_renderer->width();
                     left = min(left, floatLeft);
                     right = max(right, floatRight);
@@ -4620,7 +4808,7 @@ void RenderBlock::clearTruncation()
         else
             for (RenderObject* obj = firstChild(); obj; obj = obj->nextSibling())
                 if (shouldCheckLines(obj))
-                    static_cast<RenderBlock*>(obj)->clearTruncation();
+                    toRenderBlock(obj)->clearTruncation();
     }
 }
 
@@ -4646,6 +4834,218 @@ void RenderBlock::setMaxBottomMargins(int pos, int neg)
     m_maxMargin->m_bottomNeg = neg;
 }
 
+void RenderBlock::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
+{
+    // For blocks inside inlines, we go ahead and include margins so that we run right up to the
+    // inline boxes above and below us (thus getting merged with them to form a single irregular
+    // shape).
+    if (inlineContinuation()) {
+        rects.append(IntRect(tx, ty - collapsedMarginTop(),
+                             width(), height() + collapsedMarginTop() + collapsedMarginBottom()));
+        inlineContinuation()->absoluteRects(rects,
+                                            tx - x() + inlineContinuation()->containingBlock()->x(),
+                                            ty - y() + inlineContinuation()->containingBlock()->y());
+    } else
+        rects.append(IntRect(tx, ty, width(), height()));
+}
+
+void RenderBlock::absoluteQuads(Vector<FloatQuad>& quads)
+{
+    // For blocks inside inlines, we go ahead and include margins so that we run right up to the
+    // inline boxes above and below us (thus getting merged with them to form a single irregular
+    // shape).
+    if (inlineContinuation()) {
+        FloatRect localRect(0, -collapsedMarginTop(),
+                            width(), height() + collapsedMarginTop() + collapsedMarginBottom());
+        quads.append(localToAbsoluteQuad(localRect));
+        inlineContinuation()->absoluteQuads(quads);
+    } else
+        quads.append(RenderBox::localToAbsoluteQuad(FloatRect(0, 0, width(), height())));
+}
+
+IntRect RenderBlock::rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth)
+{
+    IntRect r(RenderBox::rectWithOutlineForRepaint(repaintContainer, outlineWidth));
+    if (inlineContinuation())
+        r.inflateY(collapsedMarginTop());
+    return r;
+}
+
+RenderObject* RenderBlock::hoverAncestor() const
+{
+    return inlineContinuation() ? inlineContinuation() : RenderBox::hoverAncestor();
+}
+
+void RenderBlock::updateDragState(bool dragOn)
+{
+    RenderBox::updateDragState(dragOn);
+    if (inlineContinuation())
+        inlineContinuation()->updateDragState(dragOn);
+}
+
+RenderStyle* RenderBlock::outlineStyleForRepaint() const
+{
+    return inlineContinuation() ? inlineContinuation()->style() : style();
+}
+
+void RenderBlock::childBecameNonInline(RenderObject*)
+{
+    makeChildrenNonInline();
+    if (isAnonymousBlock() && parent() && parent()->isRenderBlock())
+        toRenderBlock(parent())->removeLeftoverAnonymousBlock(this);
+    // |this| may be dead here
+}
+
+void RenderBlock::updateHitTestResult(HitTestResult& result, const IntPoint& point)
+{
+    if (result.innerNode())
+        return;
+
+    Node* n = node();
+    if (inlineContinuation())
+        // We are in the margins of block elements that are part of a continuation.  In
+        // this case we're actually still inside the enclosing inline element that was
+        // split.  Go ahead and set our inner node accordingly.
+        n = inlineContinuation()->node();
+
+    if (n) {
+        result.setInnerNode(n);
+        if (!result.innerNonSharedNode())
+            result.setInnerNonSharedNode(n);
+        result.setLocalPoint(point);
+    }
+}
+
+IntRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, int* extraWidthToEndOfLine)
+{
+    // Do the normal calculation in most cases.
+    if (firstChild())
+        return RenderBox::localCaretRect(inlineBox, caretOffset, extraWidthToEndOfLine);
+
+    // This is a special case:
+    // The element is not an inline element, and it's empty. So we have to
+    // calculate a fake position to indicate where objects are to be inserted.
+    
+    // FIXME: This does not take into account either :first-line or :first-letter
+    // However, as soon as some content is entered, the line boxes will be
+    // constructed and this kludge is not called any more. So only the caret size
+    // of an empty :first-line'd block is wrong. I think we can live with that.
+    RenderStyle* currentStyle = firstLineStyle();
+    int height = lineHeight(true);
+
+    enum CaretAlignment { alignLeft, alignRight, alignCenter };
+
+    CaretAlignment alignment = alignLeft;
+
+    switch (currentStyle->textAlign()) {
+        case TAAUTO:
+        case JUSTIFY:
+            if (currentStyle->direction() == RTL)
+                alignment = alignRight;
+            break;
+        case LEFT:
+        case WEBKIT_LEFT:
+            break;
+        case CENTER:
+        case WEBKIT_CENTER:
+            alignment = alignCenter;
+            break;
+        case RIGHT:
+        case WEBKIT_RIGHT:
+            alignment = alignRight;
+            break;
+    }
+
+    int x = borderLeft() + paddingLeft();
+    int w = width();
+
+    switch (alignment) {
+        case alignLeft:
+            break;
+        case alignCenter:
+            x = (x + w - (borderRight() + paddingRight())) / 2;
+            break;
+        case alignRight:
+            x = w - (borderRight() + paddingRight()) - caretWidth;
+            break;
+    }
+
+    if (extraWidthToEndOfLine) {
+        if (isRenderBlock()) {
+            *extraWidthToEndOfLine = w - (x + caretWidth);
+        } else {
+            // FIXME: This code looks wrong.
+            // myRight and containerRight are set up, but then clobbered.
+            // So *extraWidthToEndOfLine will always be 0 here.
+
+            int myRight = x + caretWidth;
+            // FIXME: why call localToAbsoluteForContent() twice here, too?
+            FloatPoint absRightPoint = localToAbsolute(FloatPoint(myRight, 0));
+
+            int containerRight = containingBlock()->x() + containingBlockWidthForContent();
+            FloatPoint absContainerPoint = localToAbsolute(FloatPoint(containerRight, 0));
+
+            *extraWidthToEndOfLine = absContainerPoint.x() - absRightPoint.x();
+        }
+    }
+
+    int y = paddingTop() + borderTop();
+
+    return IntRect(x, y, caretWidth, height);
+}
+
+void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+{
+    // For blocks inside inlines, we go ahead and include margins so that we run right up to the
+    // inline boxes above and below us (thus getting merged with them to form a single irregular
+    // shape).
+    if (inlineContinuation()) {
+        // FIXME: This check really isn't accurate. 
+        bool nextInlineHasLineBox = inlineContinuation()->firstLineBox();
+        // FIXME: This is wrong. The principal renderer may not be the continuation preceding this block.
+        bool prevInlineHasLineBox = toRenderInline(inlineContinuation()->node()->renderer())->firstLineBox(); 
+        int topMargin = prevInlineHasLineBox ? collapsedMarginTop() : 0;
+        int bottomMargin = nextInlineHasLineBox ? collapsedMarginBottom() : 0;
+        graphicsContext->addFocusRingRect(IntRect(tx, ty - topMargin, 
+                                                  width(), height() + topMargin + bottomMargin));
+    } else
+        graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
+
+    if (!hasOverflowClip() && !hasControlClip()) {
+        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
+            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+
+        for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+            if (!curr->isText() && !curr->isListMarker() && curr->isBox()) {
+                RenderBox* box = toRenderBox(curr);
+                FloatPoint pos;
+                // FIXME: This doesn't work correctly with transforms.
+                if (box->layer()) 
+                    pos = curr->localToAbsolute();
+                else
+                    pos = FloatPoint(tx + box->x(), ty + box->y());
+                box->addFocusRingRects(graphicsContext, pos.x(), pos.y());
+            }
+        }
+    }
+
+    if (inlineContinuation())
+        inlineContinuation()->addFocusRingRects(graphicsContext, 
+                                                tx - x() + inlineContinuation()->containingBlock()->x(),
+                                                ty - y() + inlineContinuation()->containingBlock()->y());
+}
+
+RenderBlock* RenderBlock::createAnonymousBlock() const
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(style());
+    newStyle->setDisplay(BLOCK);
+
+    RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
+    newBox->setStyle(newStyle.release());
+    return newBox;
+}
+
 const char* RenderBlock::renderName() const
 {
     if (isBody())
@@ -4661,8 +5061,6 @@ const char* RenderBlock::renderName() const
         return "RenderBlock (generated)";
     if (isRelPositioned())
         return "RenderBlock (relative positioned)";
-    if (isCompact())
-        return "RenderBlock (compact)";
     if (isRunIn())
         return "RenderBlock (run-in)";
     return "RenderBlock";
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
index 902460d248..f313b3d890 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
@@ -27,27 +27,37 @@
 
 #include "DeprecatedPtrList.h"
 #include "GapRects.h"
-#include "RenderFlow.h"
+#include "RenderBox.h"
+#include "RenderLineBoxList.h"
 #include "RootInlineBox.h"
 #include <wtf/ListHashSet.h>
 
 namespace WebCore {
 
 class InlineIterator;
-class BidiRun;
 class Position;
+class RenderInline;
 class RootInlineBox;
 
+struct BidiRun;
+
 template <class Iterator, class Run> class BidiResolver;
 typedef BidiResolver<InlineIterator, BidiRun> InlineBidiResolver;
 
 enum CaretType { CursorCaret, DragCaret };
 
-class RenderBlock : public RenderFlow {
+class RenderBlock : public RenderBox {
 public:
     RenderBlock(Node*);
     virtual ~RenderBlock();
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
+    virtual void destroy();
+
     virtual const char* renderName() const;
 
     // These two functions are overridden for inline-block.
@@ -56,13 +66,19 @@ public:
 
     virtual bool isRenderBlock() const { return true; }
     virtual bool isBlockFlow() const { return (!isInline() || isReplaced()) && !isTable(); }
-    virtual bool isInlineFlow() const { return isInline() && !isReplaced(); }
     virtual bool isInlineBlockOrInlineTable() const { return isInline() && isReplaced(); }
 
-    virtual bool childrenInline() const { return m_childrenInline; }
-    virtual void setChildrenInline(bool b) { m_childrenInline = b; }
     void makeChildrenNonInline(RenderObject* insertionPoint = 0);
+    virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
+
+    RenderLineBoxList* lineBoxes() { return &m_lineBoxes; }
+    const RenderLineBoxList* lineBoxes() const { return &m_lineBoxes; }
+
+    InlineFlowBox* firstLineBox() const { return m_lineBoxes.firstLineBox(); }
+    InlineFlowBox* lastLineBox() const { return m_lineBoxes.lastLineBox(); }
+
     void deleteLineBoxTree();
+    virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
 
     // The height (and width) of a block when you include overflow spillage out of the bottom
     // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
@@ -78,8 +94,6 @@ public:
     void addVisualOverflow(const IntRect&);
 
     virtual bool isSelfCollapsingBlock() const;
-    virtual bool isTopMarginQuirk() const { return m_topMarginQuirk; }
-    virtual bool isBottomMarginQuirk() const { return m_bottomMarginQuirk; }
 
     virtual int maxTopMargin(bool positive) const { return positive ? maxTopPosMargin() : maxTopNegMargin(); }
     virtual int maxBottomMargin(bool positive) const { return positive ? maxBottomPosMargin() : maxBottomNegMargin(); }
@@ -101,7 +115,7 @@ public:
         }
     }
 
-    virtual void addChildToFlow(RenderObject* newChild, RenderObject* beforeChild);
+    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject*);
 
     virtual void repaintOverhangingFloats(bool paintAllDescendants);
@@ -112,34 +126,39 @@ public:
     void layoutInlineChildren(bool relayoutChildren, int& repaintTop, int& repaintBottom);
 
     void layoutPositionedObjects(bool relayoutChildren);
-    void insertPositionedObject(RenderObject*);
-    void removePositionedObject(RenderObject*);
-    virtual void removePositionedObjects(RenderBlock*);
+    void insertPositionedObject(RenderBox*);
+    void removePositionedObject(RenderBox*);
+    void removePositionedObjects(RenderBlock*);
 
     void addPercentHeightDescendant(RenderBox*);
     static void removePercentHeightDescendant(RenderBox*);
+    HashSet<RenderBox*>* percentHeightDescendants() const;
 
     virtual void positionListMarker() { }
 
     virtual void borderFitAdjust(int& x, int& w) const; // Shrink the box in which the border paints if border-fit is set.
 
+    virtual void updateBeforeAfterContent(PseudoId);
+
+    RootInlineBox* createRootInlineBox();
+
     // Called to lay out the legend for a fieldset.
     virtual RenderObject* layoutLegend(bool /*relayoutChildren*/) { return 0; }
 
     // the implementation of the following functions is in bidi.cpp
     struct FloatWithRect {
-        FloatWithRect(RenderObject* f)
+        FloatWithRect(RenderBox* f)
             : object(f)
-            , rect(IntRect(f->xPos() - f->marginLeft(), f->yPos() - f->marginTop(), f->width() + f->marginLeft() + f->marginRight(), f->height() + f->marginTop() + f->marginBottom()))
+            , rect(IntRect(f->x() - f->marginLeft(), f->y() - f->marginTop(), f->width() + f->marginLeft() + f->marginRight(), f->height() + f->marginTop() + f->marginBottom()))
         {
         }
 
-        RenderObject* object;
+        RenderBox* object;
         IntRect rect;
     };
 
     void bidiReorderLine(InlineBidiResolver&, const InlineIterator& end);
-    RootInlineBox* determineStartPosition(bool& fullLayout, InlineBidiResolver&, Vector<FloatWithRect>& floats, unsigned& numCleanFloats);
+    RootInlineBox* determineStartPosition(bool& firstLine, bool& fullLayout, InlineBidiResolver&, Vector<FloatWithRect>& floats, unsigned& numCleanFloats);
     RootInlineBox* determineEndPosition(RootInlineBox* startBox, InlineIterator& cleanLineStart,
                                         BidiStatus& cleanLineBidiStatus,
                                         int& yPos);
@@ -147,12 +166,12 @@ public:
                         RootInlineBox*& endLine, int& endYPos, int& repaintBottom, int& repaintTop);
     bool generatesLineBoxesForInlineChild(RenderObject*);
     void skipTrailingWhitespace(InlineIterator&);
-    int skipLeadingWhitespace(InlineBidiResolver&);
-    void fitBelowFloats(int widthToFit, int& availableWidth);
-    InlineIterator findNextLineBreak(InlineBidiResolver&, EClear* clear = 0);
-    RootInlineBox* constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool lastLine, RenderObject* endObject);
-    InlineFlowBox* createLineBoxes(RenderObject*);
-    void computeHorizontalPositionsForLine(RootInlineBox*, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd);
+    int skipLeadingWhitespace(InlineBidiResolver&, bool firstLine);
+    void fitBelowFloats(int widthToFit, bool firstLine, int& availableWidth);
+    InlineIterator findNextLineBreak(InlineBidiResolver&, bool firstLine, EClear* clear = 0);
+    RootInlineBox* constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject);
+    InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine);
+    void computeHorizontalPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd);
     void computeVerticalPositionsForLine(RootInlineBox*, BidiRun*);
     void checkLinesForOverflow();
     void deleteEllipsisLineBoxes();
@@ -163,29 +182,30 @@ public:
     virtual void paintObject(PaintInfo&, int tx, int ty);
     void paintFloats(PaintInfo&, int tx, int ty, bool preservePhase = false);
     void paintContents(PaintInfo&, int tx, int ty);
-    void paintColumns(PaintInfo&, int tx, int ty, bool paintFloats = false);
+    void paintColumnContents(PaintInfo&, int tx, int ty, bool paintFloats = false);
+    void paintColumnRules(PaintInfo&, int tx, int ty);
     void paintChildren(PaintInfo&, int tx, int ty);
     void paintEllipsisBoxes(PaintInfo&, int tx, int ty);
     void paintSelection(PaintInfo&, int tx, int ty);
     void paintCaret(PaintInfo&, int tx, int ty, CaretType);
 
-    void insertFloatingObject(RenderObject*);
-    void removeFloatingObject(RenderObject*);
+    void insertFloatingObject(RenderBox*);
+    void removeFloatingObject(RenderBox*);
 
     // Called from lineWidth, to position the floats added in the last line.
     // Returns ture if and only if it has positioned any floats.
     bool positionNewFloats();
     void clearFloats();
-    int getClearDelta(RenderObject* child);
-    virtual void markAllDescendantsWithFloatsForLayout(RenderObject* floatToRemove = 0);
+    int getClearDelta(RenderBox* child, int yPos);
+    void markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove = 0, bool inLayout = true);
     void markPositionedObjectsForLayout();
 
-    virtual bool containsFloats() { return m_floatingObjects && !m_floatingObjects->isEmpty(); }
-    virtual bool containsFloat(RenderObject*);
+    bool containsFloats() { return m_floatingObjects && !m_floatingObjects->isEmpty(); }
+    bool containsFloat(RenderObject*);
 
     virtual bool avoidsFloats() const;
 
-    virtual bool hasOverhangingFloats() { return !hasColumns() && floatBottom() > m_height; }
+    bool hasOverhangingFloats() { return parent() && !hasColumns() && floatBottom() > height(); }
     void addIntrudingFloats(RenderBlock* prev, int xoffset, int yoffset);
     int addOverhangingFloats(RenderBlock* child, int xoffset, int yoffset, bool makeChildPaintOtherFloats);
 
@@ -195,18 +215,18 @@ public:
     inline int rightBottom();
     IntRect floatRect() const;
 
-    virtual int lineWidth(int) const;
+    int lineWidth(int y, bool firstLine) const;
     virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
 
     int rightOffset() const;
     int rightRelOffset(int y, int fixedOffset, bool applyTextIndent = true, int* heightRemaining = 0) const;
-    int rightOffset(int y) const { return rightRelOffset(y, rightOffset(), true); }
+    int rightOffset(int y, bool firstLine) const { return rightRelOffset(y, rightOffset(), firstLine); }
 
     int leftOffset() const;
     int leftRelOffset(int y, int fixedOffset, bool applyTextIndent = true, int* heightRemaining = 0) const;
-    int leftOffset(int y) const { return leftRelOffset(y, leftOffset(), true); }
+    int leftOffset(int y, bool firstLine) const { return leftRelOffset(y, leftOffset(), firstLine); }
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual bool hitTestColumns(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
@@ -214,7 +234,7 @@ public:
 
     virtual bool isPointInOverflowControl(HitTestResult&, int x, int y, int tx, int ty);
 
-    virtual VisiblePosition positionForCoordinates(int x, int y);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
     
     // Block flows subclass availableWidth to handle multi column layout (shrinking the width available to children when laying out.)
     virtual int availableWidth() const;
@@ -223,8 +243,8 @@ public:
     void calcInlinePrefWidths();
     void calcBlockPrefWidths();
 
-    virtual int getBaselineOfFirstLineBox() const;
-    virtual int getBaselineOfLastLineBox() const;
+    virtual int firstLineBoxBaseline() const;
+    virtual int lastLineBoxBaseline() const;
 
     RootInlineBox* firstRootBox() const { return static_cast<RootInlineBox*>(firstLineBox()); }
     RootInlineBox* lastRootBox() const { return static_cast<RootInlineBox*>(lastLineBox()); }
@@ -238,38 +258,22 @@ public:
 
     bool inRootBlockContext() const;
 
-    void setHasMarkupTruncation(bool b = true) { m_hasMarkupTruncation = b; }
-    bool hasMarkupTruncation() const { return m_hasMarkupTruncation; }
+    virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
+    virtual RenderStyle* outlineStyleForRepaint() const;
+    
+    virtual RenderObject* hoverAncestor() const;
+    virtual void updateDragState(bool dragOn);
+    virtual void updateHitTestResult(HitTestResult&, const IntPoint&);
+    
+    virtual void childBecameNonInline(RenderObject* child);
 
-    virtual bool hasSelectedChildren() const { return m_selectionState != SelectionNone; }
-    virtual SelectionState selectionState() const { return static_cast<SelectionState>(m_selectionState); }
     virtual void setSelectionState(SelectionState s);
 
-    struct BlockSelectionInfo {
-        RenderBlock* m_block;
-        GapRects m_rects;
-        SelectionState m_state;
-
-        BlockSelectionInfo()
-            : m_block(0)
-            , m_state(SelectionNone)
-        {
-        }
-
-        BlockSelectionInfo(RenderBlock* b)
-            : m_block(b)
-            , m_rects(b->needsLayout() ? GapRects() : b->selectionGapRects())
-            , m_state(b->selectionState())
-        { 
-        }
-
-        RenderBlock* block() const { return m_block; }
-        GapRects rects() const { return m_rects; }
-        SelectionState state() const { return m_state; }
-    };
-
-    virtual IntRect selectionRect(bool) { return selectionGapRects(); }
-    GapRects selectionGapRects();
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool /*clipToVisibleContent*/)
+    {
+        return selectionGapRectsForRepaint(repaintContainer);
+    }
+    GapRects selectionGapRectsForRepaint(RenderBoxModelObject* repaintContainer);
     virtual bool shouldPaintSelectionGaps() const;
     bool isSelectionRoot() const;
     GapRects fillSelectionGaps(RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
@@ -290,6 +294,9 @@ public:
     int leftSelectionOffset(RenderBlock* rootBlock, int y);
     int rightSelectionOffset(RenderBlock* rootBlock, int y);
 
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+
     // Helper methods for computing line counts and heights for line counts.
     RootInlineBox* lineAtIndex(int);
     int lineCount();
@@ -300,12 +307,24 @@ public:
     unsigned desiredColumnCount() const;
     Vector<IntRect>* columnRects() const;
     void setDesiredColumnCountAndWidth(int count, int width);
+    int columnGap() const;
     
     void adjustRectForColumns(IntRect&) const;
 
-    void addContinuationWithOutline(RenderFlow*);
+    void addContinuationWithOutline(RenderInline*);
     void paintContinuationOutlines(PaintInfo&, int tx, int ty);
 
+    RenderInline* inlineContinuation() const { return m_inlineContinuation; }
+    void setInlineContinuation(RenderInline* c) { m_inlineContinuation = c; }
+
+    virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
+
+    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+
+    // This function is a convenience helper for creating an anonymous block that inherits its
+    // style from this RenderBlock.
+    RenderBlock* createAnonymousBlock() const;
+
 private:
     void adjustPointToColumnContents(IntPoint&) const;
     void adjustForBorderFit(int x, int& left, int& right) const; // Helper function for borderFitAdjust
@@ -313,24 +332,28 @@ private:
     void markLinesDirtyInVerticalRange(int top, int bottom);
 
 protected:
-    virtual void styleWillChange(RenderStyle::Diff, const RenderStyle* newStyle);
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     void newLine(EClear);
     virtual bool hasLineIfEmpty() const;
     bool layoutOnlyPositionedObjects();
 
+    virtual RootInlineBox* createRootBox(); // Subclassed by SVG.
+    
 private:
     Position positionForBox(InlineBox*, bool start = true) const;
     Position positionForRenderer(RenderObject*, bool start = true) const;
+    VisiblePosition positionForPointWithInlineChildren(const IntPoint&);
 
     // Adjust tx and ty from painting offsets to the local coords of this renderer
     void offsetForContents(int& tx, int& ty) const;
 
-    int columnGap() const;
     void calcColumnWidth();
     int layoutColumns(int endOfContent = -1);
 
+    bool expandsToEncloseOverhangingFloats() const;
+
 protected:
     struct FloatingObject {
         enum Type {
@@ -352,7 +375,7 @@ protected:
 
         Type type() { return static_cast<Type>(m_type); }
 
-        RenderObject* m_renderer;
+        RenderBox* m_renderer;
         int m_top;
         int m_bottom;
         int m_left;
@@ -362,25 +385,6 @@ protected:
         bool m_isDescendant : 1;
     };
 
-    // The following helper functions and structs are used by layoutBlockChildren.
-    class CompactInfo {
-        // A compact child that needs to be collapsed into the margin of the following block.
-        RenderObject* m_compact;
-
-        // The block with the open margin that the compact child is going to place itself within.
-        RenderObject* m_block;
-
-    public:
-        RenderObject* compact() const { return m_compact; }
-        RenderObject* block() const { return m_block; }
-        bool matches(RenderObject* child) const { return m_compact && m_block == child; }
-
-        void clear() { set(0, 0); }
-        void set(RenderObject* c, RenderObject* b) { m_compact = c; m_block = b; }
-
-        CompactInfo() { clear(); }
-    };
-
     class MarginInfo {
         // Collapsing flags for whether we can collapse our margins with our children's margins.
         bool m_canCollapseWithChildren : 1;
@@ -447,27 +451,31 @@ protected:
         int margin() const { return m_posMargin - m_negMargin; }
     };
 
-    void adjustPositionedBlock(RenderObject* child, const MarginInfo&);
+    void adjustPositionedBlock(RenderBox* child, const MarginInfo&);
     void adjustFloatingBlock(const MarginInfo&);
-    RenderObject* handleSpecialChild(RenderObject* child, const MarginInfo&, CompactInfo&, bool& handled);
-    RenderObject* handleFloatingChild(RenderObject* child, const MarginInfo&, bool& handled);
-    RenderObject* handlePositionedChild(RenderObject* child, const MarginInfo&, bool& handled);
-    RenderObject* handleCompactChild(RenderObject* child, CompactInfo&, bool& handled);
-    RenderObject* handleRunInChild(RenderObject* child, bool& handled);
-    void collapseMargins(RenderObject* child, MarginInfo&, int yPosEstimate);
-    void clearFloatsIfNeeded(RenderObject* child, MarginInfo&, int oldTopPosMargin, int oldTopNegMargin);
-    void insertCompactIfNeeded(RenderObject* child, CompactInfo&);
-    int estimateVerticalPosition(RenderObject* child, const MarginInfo&);
-    void determineHorizontalPosition(RenderObject* child);
+    bool handleSpecialChild(RenderBox* child, const MarginInfo&);
+    bool handleFloatingChild(RenderBox* child, const MarginInfo&);
+    bool handlePositionedChild(RenderBox* child, const MarginInfo&);
+    bool handleRunInChild(RenderBox* child);
+    int collapseMargins(RenderBox* child, MarginInfo&);
+    int clearFloatsIfNeeded(RenderBox* child, MarginInfo&, int oldTopPosMargin, int oldTopNegMargin, int yPos);
+    int estimateVerticalPosition(RenderBox* child, const MarginInfo&);
+    void determineHorizontalPosition(RenderBox* child);
     void handleBottomOfBlock(int top, int bottom, MarginInfo&);
     void setCollapsedBottomMargin(const MarginInfo&);
     // End helper functions and structs used by layoutBlockChildren.
 
 private:
-    typedef ListHashSet<RenderObject*>::const_iterator Iterator;
+    typedef ListHashSet<RenderBox*>::const_iterator Iterator;
     DeprecatedPtrList<FloatingObject>* m_floatingObjects;
-    ListHashSet<RenderObject*>* m_positionedObjects;
-         
+    ListHashSet<RenderBox*>* m_positionedObjects;
+
+    // An inline can be split with blocks occurring in between the inline content.
+    // When this occurs we need a pointer to our next object.  We can basically be
+    // split into a sequence of inlines and blocks.  The continuation will either be
+    // an anonymous block (that houses other blocks) or it will be an inline flow.
+    RenderInline* m_inlineContinuation;
+
     // Allocated only when some of these fields have non-default values
     struct MaxMargin {
         MaxMargin(const RenderBlock* o) 
@@ -492,13 +500,33 @@ private:
     MaxMargin* m_maxMargin;
 
 protected:
+    RenderObjectChildList m_children;
+    RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
+
     // How much content overflows out of our block vertically or horizontally.
     int m_overflowHeight;
     int m_overflowWidth;
     int m_overflowLeft;
     int m_overflowTop;
+    
+    mutable int m_lineHeight;
 };
 
+inline RenderBlock* toRenderBlock(RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderBlock());
+    return static_cast<RenderBlock*>(o);
+}
+
+inline const RenderBlock* toRenderBlock(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderBlock());
+    return static_cast<const RenderBlock*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderBlock(const RenderBlock* o);
+
 } // namespace WebCore
 
 #endif // RenderBlock_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index 78691dee5c..e9db716e48 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -30,21 +30,28 @@
 #include "Document.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "htmlediting.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
+#include "FloatQuad.h"
 #include "Frame.h"
 #include "Page.h"
 #include "RenderArena.h"
 #include "RenderFlexibleBox.h"
+#include "RenderInline.h"
 #include "RenderLayer.h"
-#include "RenderReplica.h"
 #include "RenderTableCell.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "TransformState.h"
 #include <algorithm>
 #include <math.h>
 
+#if ENABLE(WML)
+#include "WMLNames.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -55,24 +62,19 @@ using namespace HTMLNames;
 typedef WTF::HashMap<const RenderBox*, int> OverrideSizeMap;
 static OverrideSizeMap* gOverrideSizeMap = 0;
 
-bool RenderBox::s_wasFloating = false;
 bool RenderBox::s_hadOverflowClip = false;
 
 RenderBox::RenderBox(Node* node)
-    : RenderObject(node)
-    , m_width(0)
-    , m_height(0)
-    , m_x(0)
-    , m_y(0)
+    : RenderBoxModelObject(node)
     , m_marginLeft(0)
     , m_marginRight(0)
     , m_marginTop(0)
     , m_marginBottom(0)
     , m_minPrefWidth(-1)
     , m_maxPrefWidth(-1)
-    , m_layer(0)
     , m_inlineBoxWrapper(0)
 {
+    setIsBox();
 }
 
 RenderBox::~RenderBox()
@@ -87,60 +89,107 @@ void RenderBox::destroy()
     if (hasOverrideSize())
         gOverrideSizeMap->remove(this);
 
-    // This must be done before we destroy the RenderObject.
-    if (m_layer)
-        m_layer->clearClipRects();
-
     if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
-    RenderObject::destroy();
+    RenderBoxModelObject::destroy();
 }
 
-void RenderBox::styleWillChange(RenderStyle::Diff diff, const RenderStyle* newStyle)
+void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
 {
-    s_wasFloating = isFloating();
-    s_hadOverflowClip = hasOverflowClip();
+    ASSERT(isFloatingOrPositioned());
+
+    if (documentBeingDestroyed())
+        return;
 
-    RenderObject::styleWillChange(diff, newStyle);
+    if (isFloating()) {
+        RenderBlock* outermostBlock = containingBlock();
+        for (RenderBlock* p = outermostBlock; p && !p->isRenderView(); p = p->containingBlock()) {
+            if (p->containsFloat(this))
+                outermostBlock = p;
+        }
+
+        if (outermostBlock)
+            outermostBlock->markAllDescendantsWithFloatsForLayout(this, false);
+    }
+
+    if (isPositioned()) {
+        RenderObject* p;
+        for (p = parent(); p; p = p->parent()) {
+            if (p->isRenderBlock())
+                toRenderBlock(p)->removePositionedObject(this);
+        }
+    }
 }
 
-void RenderBox::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
-    // We need to ensure that view->maximalOutlineSize() is valid for any repaints that happen
-    // during the style change (it's used by absoluteClippedOverflowRect()).
-    if (style()->outlineWidth() > 0 && style()->outlineSize() > maximalOutlineSize(PaintPhaseOutline))
-        static_cast<RenderView*>(document()->renderer())->setMaximalOutlineSize(style()->outlineSize());
+    s_hadOverflowClip = hasOverflowClip();
+
+    if (style()) {
+        // The background of the root element or the body element could propagate up to
+        // the canvas.  Just dirty the entire canvas when our style changes substantially.
+        if (diff >= StyleDifferenceRepaint && node() &&
+                (node()->hasTagName(htmlTag) || node()->hasTagName(bodyTag)))
+            view()->repaint();
+        
+        // When a layout hint happens and an object's position style changes, we have to do a layout
+        // to dirty the render tree using the old position value now.
+        if (diff == StyleDifferenceLayout && parent() && style()->position() != newStyle->position()) {
+            markContainingBlocksForLayout();
+            if (style()->position() == StaticPosition)
+                repaint();
+            if (isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
+                removeFloatingOrPositionedChildFromBlockLists();
+        }
+    }
+
+    RenderBoxModelObject::styleWillChange(diff, newStyle);
+}
 
-    RenderObject::styleDidChange(diff, oldStyle);
+void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBoxModelObject::styleDidChange(diff, oldStyle);
 
     if (needsLayout() && oldStyle && (oldStyle->height().isPercent() || oldStyle->minHeight().isPercent() || oldStyle->maxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
-    // The root and the RenderView always paint their backgrounds/borders.
-    if (isRoot() || isRenderView())
-        setHasBoxDecorations(true);
+    // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
+    // new zoomed coordinate space.
+    if (hasOverflowClip() && oldStyle && style() && oldStyle->effectiveZoom() != style()->effectiveZoom()) {
+        int left = scrollLeft();
+        if (left) {
+            left = (left / oldStyle->effectiveZoom()) * style()->effectiveZoom();
+            setScrollLeft(left);
+        }
+        int top = scrollTop();
+        if (top) {
+            top = (top / oldStyle->effectiveZoom()) * style()->effectiveZoom();
+            setScrollTop(top);
+        }
+    }
 
-    setInline(style()->isDisplayInlineType());
+    // Set the text color if we're the body.
+    if (isBody())
+        document()->setTextColor(style()->color());
+}
 
-    switch (style()->position()) {
-        case AbsolutePosition:
-        case FixedPosition:
-            setPositioned(true);
-            break;
-        default:
-            setPositioned(false);
+void RenderBox::updateBoxModelInfoFromStyle()
+{
+    RenderBoxModelObject::updateBoxModelInfoFromStyle();
 
-            if (style()->isFloating())
-                setFloating(true);
+    bool isRootObject = isRoot();
+    bool isViewObject = isRenderView();
 
-            if (style()->position() == RelativePosition)
-                setRelPositioned(true);
-            break;
-    }
+    // The root and the RenderView always paint their backgrounds/borders.
+    if (isRootObject || isViewObject)
+        setHasBoxDecorations(true);
+
+    setPositioned(style()->position() == AbsolutePosition || style()->position() == FixedPosition);
+    setFloating(!isPositioned() && style()->isFloating());
 
     // We also handle <body> and <html>, whose overflow applies to the viewport.
-    if (!isRoot() && (isRenderBlock() || isTableRow() || isTableSection()) && style()->overflowX() != OVISIBLE) {
+    if (style()->overflowX() != OVISIBLE && !isRootObject && (isRenderBlock() || isTableRow() || isTableSection())) {
         bool boxHasOverflowClip = true;
         if (isBody()) {
             // Overflow on the body can propagate to the viewport under the following conditions.
@@ -148,7 +197,7 @@ void RenderBox::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldSty
             // (2) We are the primary <body> (can be checked by looking at document.body).
             // (3) The root element has visible overflow.
             if (document()->documentElement()->hasTagName(htmlTag) &&
-                document()->body() == element() &&
+                document()->body() == node() &&
                 document()->documentElement()->renderer()->style()->overflowX() == OVISIBLE)
                 boxHasOverflowClip = false;
         }
@@ -163,52 +212,220 @@ void RenderBox::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldSty
         }
     }
 
-    setHasTransform(style()->hasTransform());
+    setHasTransform(style()->hasTransformRelatedProperty());
     setHasReflection(style()->boxReflect());
+}
 
-    if (requiresLayer()) {
-        if (!m_layer) {
-            if (s_wasFloating && isFloating())
-                setChildNeedsLayout(true);
-            m_layer = new (renderArena()) RenderLayer(this);
-            setHasLayer(true);
-            m_layer->insertOnlyThisLayer();
-            if (parent() && !needsLayout() && containingBlock())
-                m_layer->updateLayerPositions();
-        }
-    } else if (m_layer && !isRoot() && !isRenderView()) {
-        ASSERT(m_layer->parent());
-        RenderLayer* layer = m_layer;
-        m_layer = 0;
-        setHasLayer(false);
-        setHasTransform(false); // Either a transform wasn't specified or the object doesn't support transforms, so just null out the bit.
-        setHasReflection(false);
-        layer->removeOnlyThisLayer();
-        if (s_wasFloating && isFloating())
-            setChildNeedsLayout(true);
+void RenderBox::layout()
+{
+    ASSERT(needsLayout());
+
+    RenderObject* child = firstChild();
+    if (!child) {
+        setNeedsLayout(false);
+        return;
     }
 
-    // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
-    // new zoomed coordinate space.
-    if (hasOverflowClip() && oldStyle && style() && oldStyle->effectiveZoom() != style()->effectiveZoom()) {
-        int left = scrollLeft();
-        if (left) {
-            left = (left / oldStyle->effectiveZoom()) * style()->effectiveZoom();
-            setScrollLeft(left);
-        }
-        int top = scrollTop();
-        if (top) {
-            top = (top / oldStyle->effectiveZoom()) * style()->effectiveZoom();
-            setScrollTop(top);
-        }
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()));
+    while (child) {
+        child->layoutIfNeeded();
+        ASSERT(!child->needsLayout());
+        child = child->nextSibling();
     }
+    statePusher.pop();
+    setNeedsLayout(false);
+}
 
-    if (m_layer)
-        m_layer->styleChanged(diff, oldStyle);
+// More IE extensions.  clientWidth and clientHeight represent the interior of an object
+// excluding border and scrollbar.
+int RenderBox::clientWidth() const
+{
+    return width() - borderLeft() - borderRight() - verticalScrollbarWidth();
+}
 
-    // Set the text color if we're the body.
-    if (isBody())
-        document()->setTextColor(style()->color());
+int RenderBox::clientHeight() const
+{
+    return height() - borderTop() - borderBottom() - horizontalScrollbarHeight();
+}
+
+// scrollWidth/scrollHeight will be the same as overflowWidth/overflowHeight unless the
+// object has overflow:hidden/scroll/auto specified and also has overflow.
+// FIXME: It's not completely clear how scrollWidth/Height should behave for 
+// objects with visible overflow.
+int RenderBox::scrollWidth() const
+{
+    if (hasOverflowClip())
+        return layer()->scrollWidth();
+    return overflowWidth();
+}
+
+int RenderBox::scrollHeight() const
+{
+    if (hasOverflowClip())
+        return layer()->scrollHeight();
+    return overflowHeight();
+}
+
+int RenderBox::scrollLeft() const
+{
+    return hasOverflowClip() ? layer()->scrollXOffset() : 0;
+}
+
+int RenderBox::scrollTop() const
+{
+    return hasOverflowClip() ? layer()->scrollYOffset() : 0;
+}
+
+void RenderBox::setScrollLeft(int newLeft)
+{
+    if (hasOverflowClip())
+        layer()->scrollToXOffset(newLeft);
+}
+
+void RenderBox::setScrollTop(int newTop)
+{
+    if (hasOverflowClip())
+        layer()->scrollToYOffset(newTop);
+}
+
+void RenderBox::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
+{
+    rects.append(IntRect(tx, ty, width(), height()));
+}
+
+void RenderBox::absoluteQuads(Vector<FloatQuad>& quads)
+{
+    quads.append(localToAbsoluteQuad(FloatRect(0, 0, width(), height())));
+}
+
+IntRect RenderBox::absoluteContentBox() const
+{
+    IntRect rect = contentBoxRect();
+    FloatPoint absPos = localToAbsolute(FloatPoint());
+    rect.move(absPos.x(), absPos.y());
+    return rect;
+}
+
+FloatQuad RenderBox::absoluteContentQuad() const
+{
+    IntRect rect = contentBoxRect();
+    return localToAbsoluteQuad(FloatRect(rect));
+}
+
+IntRect RenderBox::outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer) const
+{
+    IntRect box = borderBoundingBox();
+    adjustRectForOutlineAndShadow(box);
+
+    FloatQuad containerRelativeQuad = localToContainerQuad(FloatRect(box), repaintContainer);
+    box = containerRelativeQuad.enclosingBoundingBox();
+
+    // FIXME: layoutDelta needs to be applied in parts before/after transforms and
+    // repaint containers. https://bugs.webkit.org/show_bug.cgi?id=23308
+    box.move(view()->layoutDelta());
+
+    return box;
+}
+
+void RenderBox::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+{
+    graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
+}
+
+
+IntRect RenderBox::reflectionBox() const
+{
+    IntRect result;
+    if (!style()->boxReflect())
+        return result;
+    IntRect box = borderBoxRect();
+    result = box;
+    switch (style()->boxReflect()->direction()) {
+        case ReflectionBelow:
+            result.move(0, box.height() + reflectionOffset());
+            break;
+        case ReflectionAbove:
+            result.move(0, -box.height() - reflectionOffset());
+            break;
+        case ReflectionLeft:
+            result.move(-box.width() - reflectionOffset(), 0);
+            break;
+        case ReflectionRight:
+            result.move(box.width() + reflectionOffset(), 0);
+            break;
+    }
+    return result;
+}
+
+int RenderBox::reflectionOffset() const
+{
+    if (!style()->boxReflect())
+        return 0;
+    if (style()->boxReflect()->direction() == ReflectionLeft || style()->boxReflect()->direction() == ReflectionRight)
+        return style()->boxReflect()->offset().calcValue(borderBoxRect().width());
+    return style()->boxReflect()->offset().calcValue(borderBoxRect().height());
+}
+
+IntRect RenderBox::reflectedRect(const IntRect& r) const
+{
+    if (!style()->boxReflect())
+        return IntRect();
+
+    IntRect box = borderBoxRect();
+    IntRect result = r;
+    switch (style()->boxReflect()->direction()) {
+        case ReflectionBelow:
+            result.setY(box.bottom() + reflectionOffset() + (box.bottom() - r.bottom()));
+            break;
+        case ReflectionAbove:
+            result.setY(box.y() - reflectionOffset() - box.height() + (box.bottom() - r.bottom()));
+            break;
+        case ReflectionLeft:
+            result.setX(box.x() - reflectionOffset() - box.width() + (box.right() - r.right()));
+            break;
+        case ReflectionRight:
+            result.setX(box.right() + reflectionOffset() + (box.right() - r.right()));
+            break;
+    }
+    return result;
+}
+
+int RenderBox::verticalScrollbarWidth() const
+{
+    return includeVerticalScrollbarSize() ? layer()->verticalScrollbarWidth() : 0;
+}
+
+int RenderBox::horizontalScrollbarHeight() const
+{
+    return includeHorizontalScrollbarSize() ? layer()->horizontalScrollbarHeight() : 0;
+}
+
+bool RenderBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+{
+    RenderLayer* l = layer();
+    if (l && l->scroll(direction, granularity, multiplier))
+        return true;
+    RenderBlock* b = containingBlock();
+    if (b && !b->isRenderView())
+        return b->scroll(direction, granularity, multiplier);
+    return false;
+}
+    
+bool RenderBox::canBeProgramaticallyScrolled(bool) const
+{
+    return (hasOverflowClip() && (scrollsOverflow() || (node() && node()->isContentEditable()))) || (node() && node()->isDocumentNode());
+}
+
+void RenderBox::autoscroll()
+{
+    if (layer())
+        layer()->autoscroll();
+}
+
+void RenderBox::panScroll(const IntPoint& source)
+{
+    if (layer())
+        layer()->panScrollFromPoint(source);
 }
 
 int RenderBox::minPrefWidth() const
@@ -251,22 +468,12 @@ void RenderBox::setOverrideSize(int s)
 
 int RenderBox::overrideWidth() const
 {
-    return hasOverrideSize() ? overrideSize() : m_width;
+    return hasOverrideSize() ? overrideSize() : width();
 }
 
 int RenderBox::overrideHeight() const
 {
-    return hasOverrideSize() ? overrideSize() : m_height;
-}
-
-void RenderBox::setPos(int xPos, int yPos)
-{
-    // Optimize for the case where we don't move at all.
-    if (xPos == m_x && yPos == m_y)
-        return;
-
-    m_x = xPos;
-    m_y = yPos;
+    return hasOverrideSize() ? overrideSize() : height();
 }
 
 int RenderBox::calcBorderBoxWidth(int width) const
@@ -300,27 +507,23 @@ int RenderBox::calcContentBoxHeight(int height) const
 }
 
 // Hit Testing
-bool RenderBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction action)
+bool RenderBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int xPos, int yPos, int tx, int ty, HitTestAction action)
 {
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
 
     // Check kids first.
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-        // FIXME: We have to skip over inline flows, since they can show up inside table rows
-        // at the moment (a demoted inline <form> for example). If we ever implement a
-        // table-specific hit-test method (which we should do for performance reasons anyway),
-        // then we can remove this check.
-        if (!child->hasLayer() && !child->isInlineFlow() && child->nodeAtPoint(request, result, x, y, tx, ty, action)) {
-            updateHitTestResult(result, IntPoint(x - tx, y - ty));
+        if (!child->hasLayer() && child->nodeAtPoint(request, result, xPos, yPos, tx, ty, action)) {
+            updateHitTestResult(result, IntPoint(xPos - tx, yPos - ty));
             return true;
         }
     }
 
     // Check our bounds next. For this purpose always assume that we can only be hit in the
     // foreground phase (which is true for replaced elements like images).
-    if (visibleToHitTesting() && action == HitTestForeground && IntRect(tx, ty, m_width, m_height).contains(x, y)) {
-        updateHitTestResult(result, IntPoint(x - tx, y - ty));
+    if (visibleToHitTesting() && action == HitTestForeground && IntRect(tx, ty, width(), height()).contains(xPos, yPos)) {
+        updateHitTestResult(result, IntPoint(xPos - tx, yPos - ty));
         return true;
     }
 
@@ -331,8 +534,8 @@ bool RenderBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result
 
 void RenderBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
 
     // default implementation. Just pass paint through to the children
     PaintInfo childInfo(paintInfo);
@@ -345,7 +548,7 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
     const FillLayer* bgLayer = style()->backgroundLayers();
     Color bgColor = style()->backgroundColor();
-    if (!style()->hasBackground() && element() && element()->hasTagName(HTMLNames::htmlTag)) {
+    if (!style()->hasBackground() && node() && node()->hasTagName(HTMLNames::htmlTag)) {
         // Locate the <body> element using the DOM.  This is easier than trying
         // to crawl around a render tree with potential :before/:after content and
         // anonymous blocks created by inline <body> tags etc.  We can locate the <body>
@@ -398,8 +601,7 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     }
 
     int w = width();
-    int h = height() + borderTopExtra() + borderBottomExtra();
-    ty -= borderTopExtra();
+    int h = height();
 
     // border-fit can adjust where we paint our border and background.  If set, we snugly fit our line box descendants.  (The iChat
     // balloon layout is an example of this).
@@ -440,8 +642,7 @@ void RenderBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
         return;
 
     int w = width();
-    int h = height() + borderTopExtra() + borderBottomExtra();
-    ty -= borderTopExtra();
+    int h = height();
 
     // border-fit can adjust where we paint our border and background.  If set, we snugly fit our line box descendants.  (The iChat
     // balloon layout is an example of this).
@@ -462,13 +663,24 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int my, int mh, int
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
     StyleImage* maskBoxImage = style()->maskBoxImage().image();
-    if ((maskBoxImage && style()->maskLayers()->hasImage()) || style()->maskLayers()->next())
+    if (maskBoxImage && style()->maskLayers()->hasImage()) {
+        pushTransparencyLayer = true;
+    } else {
         // We have to use an extra image buffer to hold the mask. Multiple mask images need
         // to composite together using source-over so that they can then combine into a single unified mask that
         // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
         // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
         // and composite that buffer as the mask.
-        pushTransparencyLayer = true;
+        // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
+        // before pushing the transparency layer.
+        for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
+            if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
+                pushTransparencyLayer = true;
+                // We found one image that can be used in rendering, exit the loop
+                break;
+            }
+        }
+    }
     
     CompositeOperator compositeOp = CompositeDestinationIn;
     if (pushTransparencyLayer) {
@@ -486,7 +698,7 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int my, int mh, int
 
 IntRect RenderBox::maskClipRect()
 {
-    IntRect bbox = borderBox();
+    IntRect bbox = borderBoxRect();
     if (style()->maskBoxImage().image())
         return bbox;
     
@@ -519,63 +731,25 @@ void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const
     paintFillLayerExtended(paintInfo, c, fillLayer, clipY, clipH, tx, ty, width, height, 0, op);
 }
 
-IntSize RenderBox::calculateBackgroundSize(const FillLayer* bgLayer, int scaledWidth, int scaledHeight) const
-{
-    StyleImage* bg = bgLayer->image();
-    bg->setImageContainerSize(IntSize(scaledWidth, scaledHeight)); // Use the box established by background-origin.
-
-    if (bgLayer->isSizeSet()) {
-        int w = scaledWidth;
-        int h = scaledHeight;
-        Length bgWidth = bgLayer->size().width();
-        Length bgHeight = bgLayer->size().height();
-
-        if (bgWidth.isFixed())
-            w = bgWidth.value();
-        else if (bgWidth.isPercent())
-            w = bgWidth.calcValue(scaledWidth);
-        
-        if (bgHeight.isFixed())
-            h = bgHeight.value();
-        else if (bgHeight.isPercent())
-            h = bgHeight.calcValue(scaledHeight);
-        
-        // If one of the values is auto we have to use the appropriate
-        // scale to maintain our aspect ratio.
-        if (bgWidth.isAuto() && !bgHeight.isAuto())
-            w = bg->imageSize(this, style()->effectiveZoom()).width() * h / bg->imageSize(this, style()->effectiveZoom()).height();        
-        else if (!bgWidth.isAuto() && bgHeight.isAuto())
-            h = bg->imageSize(this, style()->effectiveZoom()).height() * w / bg->imageSize(this, style()->effectiveZoom()).width();
-        else if (bgWidth.isAuto() && bgHeight.isAuto()) {
-            // If both width and height are auto, we just want to use the image's
-            // intrinsic size.
-            w = bg->imageSize(this, style()->effectiveZoom()).width();
-            h = bg->imageSize(this, style()->effectiveZoom()).height();
-        }
-        
-        return IntSize(max(1, w), max(1, h));
-    } else
-        return bg->imageSize(this, style()->effectiveZoom());
-}
-
 void RenderBox::imageChanged(WrappedImagePtr image, const IntRect*)
 {
-    if (isInlineFlow() ||
-        style()->borderImage().image() && style()->borderImage().image()->data() == image ||
-        style()->maskBoxImage().image() && style()->maskBoxImage().image()->data() == image) {
+    if (!parent())
+        return;
+
+    if ((style()->borderImage().image() && style()->borderImage().image()->data() == image) ||
+        (style()->maskBoxImage().image() && style()->maskBoxImage().image()->data() == image)) {
         repaint();
         return;
     }
 
     bool didFullRepaint = repaintLayerRectsForImage(image, style()->backgroundLayers(), true);
-    if (!didFullRepaint) {
+    if (!didFullRepaint)
         repaintLayerRectsForImage(image, style()->maskLayers(), false);
-    }
 }
 
 bool RenderBox::repaintLayerRectsForImage(WrappedImagePtr image, const FillLayer* layers, bool drawingBackground)
 {
-    IntRect absoluteRect;
+    IntRect rendererRect;
     RenderBox* layerRenderer = 0;
 
     for (const FillLayer* curLayer = layers; curLayer; curLayer = curLayer->next()) {
@@ -590,287 +764,35 @@ bool RenderBox::repaintLayerRectsForImage(WrappedImagePtr image, const FillLayer
                     int rw;
                     int rh;
 
-                    if (FrameView* frameView = static_cast<RenderView*>(layerRenderer)->frameView()) {
+                    if (FrameView* frameView = toRenderView(layerRenderer)->frameView()) {
                         rw = frameView->contentsWidth();
                         rh = frameView->contentsHeight();
                     } else {
                         rw = layerRenderer->width();
                         rh = layerRenderer->height();
                     }
-                    absoluteRect = IntRect(-layerRenderer->marginLeft(),
+                    rendererRect = IntRect(-layerRenderer->marginLeft(),
                         -layerRenderer->marginTop(),
                         max(layerRenderer->width() + layerRenderer->marginLeft() + layerRenderer->marginRight() + layerRenderer->borderLeft() + layerRenderer->borderRight(), rw),
                         max(layerRenderer->height() + layerRenderer->marginTop() + layerRenderer->marginBottom() + layerRenderer->borderTop() + layerRenderer->borderBottom(), rh));
                 } else {
                     layerRenderer = this;
-                    absoluteRect = borderBox();
+                    rendererRect = borderBoxRect();
                 }
-
-                layerRenderer->computeAbsoluteRepaintRect(absoluteRect);
             }
 
             IntRect repaintRect;
             IntPoint phase;
             IntSize tileSize;
-            layerRenderer->calculateBackgroundImageGeometry(curLayer, absoluteRect.x(), absoluteRect.y(), absoluteRect.width(), absoluteRect.height(), repaintRect, phase, tileSize);
-            view()->repaintViewRectangle(repaintRect);
-            if (repaintRect == absoluteRect)
+            layerRenderer->calculateBackgroundImageGeometry(curLayer, rendererRect.x(), rendererRect.y(), rendererRect.width(), rendererRect.height(), repaintRect, phase, tileSize);
+            layerRenderer->repaintRectangle(repaintRect);
+            if (repaintRect == rendererRect)
                 return true;
         }
     }
     return false;
 }
 
-void RenderBox::calculateBackgroundImageGeometry(const FillLayer* bgLayer, int tx, int ty, int w, int h, IntRect& destRect, IntPoint& phase, IntSize& tileSize)
-{
-    int pw;
-    int ph;
-    int left = 0;
-    int right = 0;
-    int top = 0;
-    int bottom = 0;
-    int cx;
-    int cy;
-    int rw = 0;
-    int rh = 0;
-
-    // CSS2 chapter 14.2.1
-
-    if (bgLayer->attachment()) {
-        // Scroll
-        if (bgLayer->origin() != BorderFillBox) {
-            left = borderLeft();
-            right = borderRight();
-            top = borderTop();
-            bottom = borderBottom();
-            if (bgLayer->origin() == ContentFillBox) {
-                left += paddingLeft();
-                right += paddingRight();
-                top += paddingTop();
-                bottom += paddingBottom();
-            }
-        }
-        
-        // The background of the box generated by the root element covers the entire canvas including
-        // its margins.  Since those were added in already, we have to factor them out when computing the
-        // box used by background-origin/size/position.
-        if (isRoot()) {
-            rw = width() - left - right;
-            rh = height() - top - bottom; 
-            left += marginLeft();
-            right += marginRight();
-            top += marginTop();
-            bottom += marginBottom();
-        }
-        cx = tx;
-        cy = ty;
-        pw = w - left - right;
-        ph = h - top - bottom;
-    } else {
-        // Fixed
-        IntRect vr = viewRect();
-        cx = vr.x();
-        cy = vr.y();
-        pw = vr.width();
-        ph = vr.height();
-    }
-
-    int sx = 0;
-    int sy = 0;
-    int cw;
-    int ch;
-
-    IntSize scaledImageSize;
-    if (isRoot() && bgLayer->attachment())
-        scaledImageSize = calculateBackgroundSize(bgLayer, rw, rh);
-    else
-        scaledImageSize = calculateBackgroundSize(bgLayer, pw, ph);
-        
-    int scaledImageWidth = scaledImageSize.width();
-    int scaledImageHeight = scaledImageSize.height();
-
-    EFillRepeat backgroundRepeat = bgLayer->repeat();
-    
-    int xPosition;
-    if (isRoot() && bgLayer->attachment())
-        xPosition = bgLayer->xPosition().calcMinValue(rw - scaledImageWidth, true);
-    else
-        xPosition = bgLayer->xPosition().calcMinValue(pw - scaledImageWidth, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatXFill) {
-        cw = pw + left + right;
-        sx = scaledImageWidth ? scaledImageWidth - (xPosition + left) % scaledImageWidth : 0;
-    } else {
-        cx += max(xPosition + left, 0);
-        sx = -min(xPosition + left, 0);
-        cw = scaledImageWidth + min(xPosition + left, 0);
-    }
-    
-    int yPosition;
-    if (isRoot() && bgLayer->attachment())
-        yPosition = bgLayer->yPosition().calcMinValue(rh - scaledImageHeight, true);
-    else 
-        yPosition = bgLayer->yPosition().calcMinValue(ph - scaledImageHeight, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatYFill) {
-        ch = ph + top + bottom;
-        sy = scaledImageHeight ? scaledImageHeight - (yPosition + top) % scaledImageHeight : 0;
-    } else {
-        cy += max(yPosition + top, 0);
-        sy = -min(yPosition + top, 0);
-        ch = scaledImageHeight + min(yPosition + top, 0);
-    }
-
-    if (!bgLayer->attachment()) {
-        sx += max(tx - cx, 0);
-        sy += max(ty - cy, 0);
-    }
-
-    destRect = IntRect(cx, cy, cw, ch);
-    destRect.intersect(IntRect(tx, ty, w, h));
-    phase = IntPoint(sx, sy);
-    tileSize = IntSize(scaledImageWidth, scaledImageHeight);
-}
-
-void RenderBox::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int clipY, int clipH,
-                                       int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
-{
-    GraphicsContext* context = paintInfo.context;
-    bool includeLeftEdge = box ? box->includeLeftEdge() : true;
-    bool includeRightEdge = box ? box->includeRightEdge() : true;
-    int bLeft = includeLeftEdge ? borderLeft() : 0;
-    int bRight = includeRightEdge ? borderRight() : 0;
-    int pLeft = includeLeftEdge ? paddingLeft() : 0;
-    int pRight = includeRightEdge ? paddingRight() : 0;
-
-    bool clippedToBorderRadius = false;
-    if (style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge)) {
-        context->save();
-        context->addRoundedRectClip(IntRect(tx, ty, w, h),
-            includeLeftEdge ? style()->borderTopLeftRadius() : IntSize(),
-            includeRightEdge ? style()->borderTopRightRadius() : IntSize(),
-            includeLeftEdge ? style()->borderBottomLeftRadius() : IntSize(),
-            includeRightEdge ? style()->borderBottomRightRadius() : IntSize());
-        clippedToBorderRadius = true;
-    }
-
-    if (bgLayer->clip() == PaddingFillBox || bgLayer->clip() == ContentFillBox) {
-        // Clip to the padding or content boxes as necessary.
-        bool includePadding = bgLayer->clip() == ContentFillBox;
-        int x = tx + bLeft + (includePadding ? pLeft : 0);
-        int y = ty + borderTop() + (includePadding ? paddingTop() : 0);
-        int width = w - bLeft - bRight - (includePadding ? pLeft + pRight : 0);
-        int height = h - borderTop() - borderBottom() - (includePadding ? paddingTop() + paddingBottom() : 0);
-        context->save();
-        context->clip(IntRect(x, y, width, height));
-    } else if (bgLayer->clip() == TextFillBox) {
-        // We have to draw our text into a mask that can then be used to clip background drawing.
-        // First figure out how big the mask has to be.  It should be no bigger than what we need
-        // to actually render, so we should intersect the dirty rect with the border box of the background.
-        IntRect maskRect(tx, ty, w, h);
-        maskRect.intersect(paintInfo.rect);
-        
-        // Now create the mask.
-        auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
-        if (!maskImage.get())
-            return;
-        
-        GraphicsContext* maskImageContext = maskImage->context();
-        maskImageContext->translate(-maskRect.x(), -maskRect.y());
-        
-        // Now add the text to the clip.  We do this by painting using a special paint phase that signals to
-        // InlineTextBoxes that they should just add their contents to the clip.
-        PaintInfo info(maskImageContext, maskRect, PaintPhaseTextClip, true, 0, 0);
-        if (box)
-            box->paint(info, tx - box->xPos(), ty - box->yPos());
-        else
-            paint(info, tx, ty);
-            
-        // The mask has been created.  Now we just need to clip to it.
-        context->save();
-        context->clipToImageBuffer(maskRect, maskImage.get());
-    }
-    
-    StyleImage* bg = bgLayer->image();
-    bool shouldPaintBackgroundImage = bg && bg->canRender(style()->effectiveZoom());
-    Color bgColor = c;
-
-    // When this style flag is set, change existing background colors and images to a solid white background.
-    // If there's no bg color or image, leave it untouched to avoid affecting transparency.
-    // We don't try to avoid loading the background images, because this style flag is only set
-    // when printing, and at that point we've already loaded the background images anyway. (To avoid
-    // loading the background images we'd have to do this check when applying styles rather than
-    // while rendering.)
-    if (style()->forceBackgroundsToWhite()) {
-        // Note that we can't reuse this variable below because the bgColor might be changed
-        bool shouldPaintBackgroundColor = !bgLayer->next() && bgColor.isValid() && bgColor.alpha() > 0;
-        if (shouldPaintBackgroundImage || shouldPaintBackgroundColor) {
-            bgColor = Color::white;
-            shouldPaintBackgroundImage = false;
-        }
-    }
-
-    // Only fill with a base color (e.g., white) if we're the root document, since iframes/frames with
-    // no background in the child document should show the parent's background.
-    bool isTransparent = false;
-    if (!bgLayer->next() && isRoot() && !(bgColor.isValid() && bgColor.alpha() > 0) && view()->frameView()) {
-        Node* elt = document()->ownerElement();
-        if (elt) {
-            if (!elt->hasTagName(frameTag)) {
-                // Locate the <body> element using the DOM.  This is easier than trying
-                // to crawl around a render tree with potential :before/:after content and
-                // anonymous blocks created by inline <body> tags etc.  We can locate the <body>
-                // render object very easily via the DOM.
-                HTMLElement* body = document()->body();
-                isTransparent = !body || !body->hasLocalName(framesetTag); // Can't scroll a frameset document anyway.
-            }
-        } else
-            isTransparent = view()->frameView()->isTransparent();
-
-        // FIXME: This needs to be dynamic.  We should be able to go back to blitting if we ever stop being transparent.
-        if (isTransparent)
-            view()->frameView()->setUseSlowRepaints(); // The parent must show behind the child.
-    }
-
-    // Paint the color first underneath all images.
-    if (!bgLayer->next()) {
-        IntRect rect(tx, clipY, w, clipH);
-        // If we have an alpha and we are painting the root element, go ahead and blend with the base background color.
-        if (isRoot() && (!bgColor.isValid() || bgColor.alpha() < 0xFF) && !isTransparent) {
-            Color baseColor = view()->frameView()->baseBackgroundColor();
-            if (baseColor.alpha() > 0) {
-                context->save();
-                context->setCompositeOperation(CompositeCopy);
-                context->fillRect(rect, baseColor);
-                context->restore();
-            } else
-                context->clearRect(rect);
-        }
-
-        if (bgColor.isValid() && bgColor.alpha() > 0)
-            context->fillRect(rect, bgColor);
-    }
-
-    // no progressive loading of the background image
-    if (shouldPaintBackgroundImage) {
-        IntRect destRect;
-        IntPoint phase;
-        IntSize tileSize;
-
-        calculateBackgroundImageGeometry(bgLayer, tx, ty, w, h, destRect, phase, tileSize);
-        if (!destRect.isEmpty()) {
-            CompositeOperator compositeOp = op == CompositeSourceOver ? bgLayer->composite() : op;
-            context->drawTiledImage(bg->image(this, tileSize), destRect, phase, tileSize, compositeOp);
-        }
-    }
-
-    if (bgLayer->clip() != BorderFillBox)
-        // Undo the background clip
-        context->restore();
-
-    if (clippedToBorderRadius)
-        // Undo the border radius clip
-        context->restore();
-}
-
 #if PLATFORM(MAC)
 
 void RenderBox::paintCustomHighlight(int tx, int ty, const AtomicString& type, bool behindText)
@@ -885,18 +807,63 @@ void RenderBox::paintCustomHighlight(int tx, int ty, const AtomicString& type, b
     InlineBox* boxWrap = inlineBoxWrapper();
     RootInlineBox* r = boxWrap ? boxWrap->root() : 0;
     if (r) {
-        FloatRect rootRect(tx + r->xPos(), ty + r->selectionTop(), r->width(), r->selectionHeight());
-        FloatRect imageRect(tx + m_x, rootRect.y(), width(), rootRect.height());
+        FloatRect rootRect(tx + r->x(), ty + r->selectionTop(), r->width(), r->selectionHeight());
+        FloatRect imageRect(tx + x(), rootRect.y(), width(), rootRect.height());
         page->chrome()->client()->paintCustomHighlight(node(), type, imageRect, rootRect, behindText, false);
     } else {
-        FloatRect imageRect(tx + m_x, ty + m_y, width(), height());
+        FloatRect imageRect(tx + x(), ty + y(), width(), height());
         page->chrome()->client()->paintCustomHighlight(node(), type, imageRect, imageRect, behindText, false);
     }
 }
 
 #endif
 
-IntRect RenderBox::getOverflowClipRect(int tx, int ty)
+bool RenderBox::pushContentsClip(PaintInfo& paintInfo, int tx, int ty)
+{
+    if (paintInfo.phase == PaintPhaseBlockBackground || paintInfo.phase == PaintPhaseSelfOutline || paintInfo.phase == PaintPhaseMask)
+        return false;
+        
+    bool isControlClip = hasControlClip();
+    bool isOverflowClip = hasOverflowClip() && !layer()->isSelfPaintingLayer();
+    
+    if (!isControlClip && !isOverflowClip)
+        return false;
+    
+    if (paintInfo.phase == PaintPhaseOutline)
+        paintInfo.phase = PaintPhaseChildOutlines;
+    else if (paintInfo.phase == PaintPhaseChildBlockBackground) {
+        paintInfo.phase = PaintPhaseBlockBackground;
+        paintObject(paintInfo, tx, ty);
+        paintInfo.phase = PaintPhaseChildBlockBackgrounds;
+    }
+    IntRect clipRect(isControlClip ? controlClipRect(tx, ty) : overflowClipRect(tx, ty));
+    paintInfo.context->save();
+    if (style()->hasBorderRadius()) {
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+    }
+    
+    paintInfo.context->clip(clipRect);
+    return true;
+}
+
+void RenderBox::popContentsClip(PaintInfo& paintInfo, PaintPhase originalPhase, int tx, int ty)
+{
+    ASSERT(hasControlClip() || (hasOverflowClip() && !layer()->isSelfPaintingLayer()));
+
+    paintInfo.context->restore();
+    if (originalPhase == PaintPhaseOutline) {
+        paintInfo.phase = PaintPhaseSelfOutline;
+        paintObject(paintInfo, tx, ty);
+        paintInfo.phase = originalPhase;
+    } else if (originalPhase == PaintPhaseChildBlockBackground)
+        paintInfo.phase = originalPhase;
+}
+
+IntRect RenderBox::overflowClipRect(int tx, int ty)
 {
     // FIXME: When overflow-clip (CSS3) is implemented, we'll obtain the property
     // here.
@@ -906,103 +873,68 @@ IntRect RenderBox::getOverflowClipRect(int tx, int ty)
 
     int clipX = tx + bLeft;
     int clipY = ty + bTop;
-    int clipWidth = m_width - bLeft - borderRight();
-    int clipHeight = m_height - bTop - borderBottom() + borderTopExtra() + borderBottomExtra();
+    int clipWidth = width() - bLeft - borderRight();
+    int clipHeight = height() - bTop - borderBottom();
 
     // Subtract out scrollbars if we have them.
-    if (m_layer) {
-        clipWidth -= m_layer->verticalScrollbarWidth();
-        clipHeight -= m_layer->horizontalScrollbarHeight();
+    if (layer()) {
+        clipWidth -= layer()->verticalScrollbarWidth();
+        clipHeight -= layer()->horizontalScrollbarHeight();
     }
 
     return IntRect(clipX, clipY, clipWidth, clipHeight);
 }
 
-IntRect RenderBox::getClipRect(int tx, int ty)
+IntRect RenderBox::clipRect(int tx, int ty)
 {
     int clipX = tx;
     int clipY = ty;
-    int clipWidth = m_width;
-    int clipHeight = m_height;
+    int clipWidth = width();
+    int clipHeight = height();
 
     if (!style()->clipLeft().isAuto()) {
-        int c = style()->clipLeft().calcValue(m_width);
+        int c = style()->clipLeft().calcValue(width());
         clipX += c;
         clipWidth -= c;
     }
 
     if (!style()->clipRight().isAuto())
-        clipWidth -= m_width - style()->clipRight().calcValue(m_width);
+        clipWidth -= width() - style()->clipRight().calcValue(width());
 
     if (!style()->clipTop().isAuto()) {
-        int c = style()->clipTop().calcValue(m_height);
+        int c = style()->clipTop().calcValue(height());
         clipY += c;
         clipHeight -= c;
     }
 
     if (!style()->clipBottom().isAuto())
-        clipHeight -= m_height - style()->clipBottom().calcValue(m_height);
+        clipHeight -= height() - style()->clipBottom().calcValue(height());
 
     return IntRect(clipX, clipY, clipWidth, clipHeight);
 }
 
-int RenderBox::containingBlockWidth() const
+int RenderBox::containingBlockWidthForContent() const
 {
     RenderBlock* cb = containingBlock();
-    if (!cb)
-        return 0;
     if (shrinkToAvoidFloats())
-        return cb->lineWidth(m_y);
+        return cb->lineWidth(y(), false);
     return cb->availableWidth();
 }
 
-IntSize RenderBox::offsetForPositionedInContainer(RenderObject* container) const
+void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
 {
-    if (!container->isRelPositioned() || !container->isInlineFlow())
-        return IntSize();
-
-    // When we have an enclosing relpositioned inline, we need to add in the offset of the first line
-    // box from the rest of the content, but only in the cases where we know we're positioned
-    // relative to the inline itself.
-
-    IntSize offset;
-    RenderFlow* flow = static_cast<RenderFlow*>(container);
-    int sx;
-    int sy;
-    if (flow->firstLineBox()) {
-        sx = flow->firstLineBox()->xPos();
-        sy = flow->firstLineBox()->yPos();
-    } else {
-        sx = flow->staticX();
-        sy = flow->staticY();
-    }
-
-    if (!hasStaticX())
-        offset.setWidth(sx);
-    // This is not terribly intuitive, but we have to match other browsers.  Despite being a block display type inside
-    // an inline, we still keep our x locked to the left of the relative positioned inline.  Arguably the correct
-    // behavior would be to go flush left to the block that contains the inline, but that isn't what other browsers
-    // do.
-    else if (!style()->isOriginalDisplayInlineType())
-        // Avoid adding in the left border/padding of the containing block twice.  Subtract it out.
-        offset.setWidth(sx - (containingBlock()->borderLeft() + containingBlock()->paddingLeft()));
-
-    if (!hasStaticY())
-        offset.setHeight(sy);
-
-    return offset;
-}
+    if (repaintContainer == this)
+        return;
 
-FloatPoint RenderBox::localToAbsolute(FloatPoint localPoint, bool fixed, bool useTransforms) const
-{
     if (RenderView* v = view()) {
-        if (LayoutState* layoutState = v->layoutState()) {
+        if (v->layoutStateEnabled() && !repaintContainer) {
+            LayoutState* layoutState = v->layoutState();
             IntSize offset = layoutState->m_offset;
-            offset.expand(m_x, m_y);
-            localPoint += offset;
-            if (style()->position() == RelativePosition && m_layer)
-                localPoint += m_layer->relativePositionOffset();
-            return localPoint;
+            offset.expand(x(), y());
+            if (style()->position() == RelativePosition && layer())
+                offset += layer()->relativePositionOffset();
+            transformState.move(offset);
+            return;
         }
     }
 
@@ -1010,73 +942,53 @@ FloatPoint RenderBox::localToAbsolute(FloatPoint localPoint, bool fixed, bool us
         fixed = true;
 
     RenderObject* o = container();
-    if (o) {
-        if (useTransforms && m_layer && m_layer->transform()) {
-            fixed = false;  // Elements with transforms act as a containing block for fixed position descendants
-            localPoint = m_layer->transform()->mapPoint(localPoint);
-        }
+    if (!o)
+        return;
 
-        localPoint += offsetFromContainer(o);
+    bool hasTransform = hasLayer() && layer()->transform();
+    if (hasTransform)
+        fixed = false;  // Elements with transforms act as a containing block for fixed position descendants
 
-        return o->localToAbsoluteForContent(localPoint, fixed, useTransforms);
-    }
-    
-    return FloatPoint();
+    IntSize containerOffset = offsetFromContainer(o);
+
+    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+
+    o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
 
-FloatPoint RenderBox::absoluteToLocal(FloatPoint containerPoint, bool fixed, bool useTransforms) const
+void RenderBox::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
 {
     // We don't expect absoluteToLocal() to be called during layout (yet)
-    ASSERT(!view() || !view()->layoutState());
+    ASSERT(!view() || !view()->layoutStateEnabled());
     
     if (style()->position() == FixedPosition)
         fixed = true;
 
-    if (useTransforms && m_layer && m_layer->transform())
-        fixed = false;
+    bool hasTransform = hasLayer() && layer()->transform();
+    if (hasTransform)
+        fixed = false;  // Elements with transforms act as a containing block for fixed position descendants
     
     RenderObject* o = container();
-    if (o) {
-        FloatPoint localPoint = o->absoluteToLocal(containerPoint, fixed, useTransforms);
-
-        // Take into account space above a vertically aligned table cell
-        // (see localToAbsoluteForContent())
-        localPoint.move(0.0f, -static_cast<float>(borderTopExtra()));
-
-        localPoint -= offsetFromContainer(o);
-
-        if (useTransforms && m_layer && m_layer->transform())
-            localPoint = m_layer->transform()->inverse().mapPoint(localPoint);
-        
-        return localPoint;
-    }
-    
-    return FloatPoint();
-}
-
-FloatQuad RenderBox::localToAbsoluteQuad(const FloatQuad& localQuad, bool fixed) const
-{
-    if (style()->position() == FixedPosition)
-        fixed = true;
-
-    RenderObject* o = container();
-    if (o) {
-        FloatQuad quad = localQuad;
-        if (m_layer && m_layer->transform()) {
-            fixed = false;  // Elements with transforms act as a containing block for fixed position descendants
-            quad = m_layer->transform()->mapQuad(quad);
-        }
+    if (!o)
+        return;
 
-        quad += offsetFromContainer(o);
+    o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
 
-        // Take into account space above a vertically aligned table cell
-        // (see localToAbsoluteForContent())
-        quad.move(0.0f, static_cast<float>(o->borderTopExtra()));
+    IntSize containerOffset = offsetFromContainer(o);
 
-        return o->localToAbsoluteQuad(quad, fixed);
-    }
-    
-    return FloatQuad();
+    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 }
 
 IntSize RenderBox::offsetFromContainer(RenderObject* o) const
@@ -1090,24 +1002,29 @@ IntSize RenderBox::offsetFromContainer(RenderObject* o) const
     if (!isInline() || isReplaced()) {
         RenderBlock* cb;
         if (o->isBlockFlow() && style()->position() != AbsolutePosition && style()->position() != FixedPosition
-                && (cb = static_cast<RenderBlock*>(o))->hasColumns()) {
-            IntRect rect(m_x, m_y, 1, 1);
+                && (cb = toRenderBlock(o))->hasColumns()) {
+            IntRect rect(x(), y(), 1, 1);
             cb->adjustRectForColumns(rect);
             offset.expand(rect.x(), rect.y());
         } else
-            offset.expand(m_x, m_y);
+            offset.expand(x(), y());
     }
 
     if (o->hasOverflowClip())
-        offset -= o->layer()->scrolledContentOffset();
+        offset -= toRenderBox(o)->layer()->scrolledContentOffset();
 
-    if (style()->position() == AbsolutePosition)
-        offset += offsetForPositionedInContainer(o);
+    if (style()->position() == AbsolutePosition && o->isRelPositioned() && o->isRenderInline())
+        offset += toRenderInline(o)->relativePositionedInlineOffset(this);
 
     return offset;
 }
 
-void RenderBox::dirtyLineBoxes(bool fullLayout, bool /*isRootLineBox*/)
+InlineBox* RenderBox::createInlineBox()
+{
+    return new (renderArena()) InlineBox(this);
+}
+
+void RenderBox::dirtyLineBoxes(bool fullLayout)
 {
     if (m_inlineBoxWrapper) {
         if (fullLayout) {
@@ -1118,23 +1035,23 @@ void RenderBox::dirtyLineBoxes(bool fullLayout, bool /*isRootLineBox*/)
     }
 }
 
-void RenderBox::position(InlineBox* box)
+void RenderBox::positionLineBox(InlineBox* box)
 {
     if (isPositioned()) {
         // Cache the x position only if we were an INLINE type originally.
         bool wasInline = style()->isOriginalDisplayInlineType();
-        if (wasInline && hasStaticX()) {
+        if (wasInline && style()->hasStaticX()) {
             // The value is cached in the xPos of the box.  We only need this value if
             // our object was inline originally, since otherwise it would have ended up underneath
             // the inlines.
-            setStaticX(box->xPos());
+            layer()->setStaticX(box->x());
             setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
-        } else if (!wasInline && hasStaticY()) {
+        } else if (!wasInline && style()->hasStaticY()) {
             // Our object was a block originally, so we make our normal flow position be
             // just below the line box (as though all the inlines that came before us got
             // wrapped in an anonymous block, which is what would have happened had we been
-            // in flow).  This value was cached in the yPos() of the box.
-            setStaticY(box->yPos());
+            // in flow).  This value was cached in the y() of the box.
+            layer()->setStaticY(box->y());
             setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
         }
 
@@ -1142,8 +1059,7 @@ void RenderBox::position(InlineBox* box)
         box->remove();
         box->destroy(renderArena());
     } else if (isReplaced()) {
-        m_x = box->xPos();
-        m_y = box->yPos();
+        setLocation(box->x(), box->y());
         m_inlineBoxWrapper = box;
     }
 }
@@ -1158,7 +1074,7 @@ void RenderBox::deleteLineBoxWrapper()
     }
 }
 
-IntRect RenderBox::absoluteClippedOverflowRect()
+IntRect RenderBox::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
         return IntRect();
@@ -1166,9 +1082,12 @@ IntRect RenderBox::absoluteClippedOverflowRect()
     IntRect r = overflowRect(false);
 
     RenderView* v = view();
-    if (v)
+    if (v) {
+        // FIXME: layoutDelta needs to be applied in parts before/after transforms and
+        // repaint containers. https://bugs.webkit.org/show_bug.cgi?id=23308
         r.move(v->layoutDelta());
-
+    }
+    
     if (style()) {
         if (style()->hasAppearance())
             // The theme may wish to inflate the rect used when repainting.
@@ -1181,18 +1100,24 @@ IntRect RenderBox::absoluteClippedOverflowRect()
             r.inflate(v->maximalOutlineSize());
         }
     }
-    computeAbsoluteRepaintRect(r);
+    computeRectForRepaint(repaintContainer, r);
     return r;
 }
 
-void RenderBox::computeAbsoluteRepaintRect(IntRect& rect, bool fixed)
+void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed)
 {
     if (RenderView* v = view()) {
-        if (LayoutState* layoutState = v->layoutState()) {
-            if (style()->position() == RelativePosition && m_layer)
-                rect.move(m_layer->relativePositionOffset());
+        // LayoutState is only valid for root-relative repainting
+        if (v->layoutStateEnabled() && !repaintContainer) {
+            LayoutState* layoutState = v->layoutState();
+
+            if (layer() && layer()->transform())
+                rect = layer()->transform()->mapRect(rect);
+
+            if (style()->position() == RelativePosition && layer())
+                rect.move(layer()->relativePositionOffset());
 
-            rect.move(m_x, m_y);
+            rect.move(x(), y());
             rect.move(layoutState->m_offset);
             if (layoutState->m_clipped)
                 rect.intersect(layoutState->m_clipRect);
@@ -1203,18 +1128,21 @@ void RenderBox::computeAbsoluteRepaintRect(IntRect& rect, bool fixed)
     if (hasReflection())
         rect.unite(reflectedRect(rect));
 
+    if (repaintContainer == this)
+        return;
+
     RenderObject* o = container();
     if (!o)
         return;
 
     IntPoint topLeft = rect.location();
-    topLeft.move(m_x, m_y);
+    topLeft.move(x(), y());
 
     if (style()->position() == FixedPosition)
         fixed = true;
 
     if (o->isBlockFlow() && style()->position() != AbsolutePosition && style()->position() != FixedPosition) {
-        RenderBlock* cb = static_cast<RenderBlock*>(o);
+        RenderBlock* cb = toRenderBlock(o);
         if (cb->hasColumns()) {
             IntRect repaintRect(topLeft, rect.size());
             cb->adjustRectForColumns(repaintRect);
@@ -1225,92 +1153,63 @@ void RenderBox::computeAbsoluteRepaintRect(IntRect& rect, bool fixed)
 
     // We are now in our parent container's coordinate space.  Apply our transform to obtain a bounding box
     // in the parent's coordinate space that encloses us.
-    if (m_layer && m_layer->transform()) {
+    if (layer() && layer()->transform()) {
         fixed = false;
-        rect = m_layer->transform()->mapRect(rect);
+        rect = layer()->transform()->mapRect(rect);
         // FIXME: this clobbers topLeft adjustment done for multicol above
         topLeft = rect.location();
-        topLeft.move(m_x, m_y);
+        topLeft.move(x(), y());
     }
 
-    if (style()->position() == AbsolutePosition)
-        topLeft += offsetForPositionedInContainer(o);
-    else if (style()->position() == RelativePosition && m_layer) {
+    if (style()->position() == AbsolutePosition && o->isRelPositioned() && o->isRenderInline())
+        topLeft += toRenderInline(o)->relativePositionedInlineOffset(this);
+    else if (style()->position() == RelativePosition && layer()) {
         // Apply the relative position offset when invalidating a rectangle.  The layer
         // is translated, but the render box isn't, so we need to do this to get the
         // right dirty rect.  Since this is called from RenderObject::setStyle, the relative position
         // flag on the RenderObject has been cleared, so use the one on the style().
-        topLeft += m_layer->relativePositionOffset();
+        topLeft += layer()->relativePositionOffset();
     }
     
     // FIXME: We ignore the lightweight clipping rect that controls use, since if |o| is in mid-layout,
     // its controlClipRect will be wrong. For overflow clip we use the values cached by the layer.
     if (o->hasOverflowClip()) {
+        RenderBox* containerBox = toRenderBox(o);
+
         // o->height() is inaccurate if we're in the middle of a layout of |o|, so use the
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
-        topLeft -= o->layer()->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
+        topLeft -= containerBox->layer()->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         IntRect repaintRect(topLeft, rect.size());
-        IntRect boxRect(0, 0, o->layer()->width(), o->layer()->height());
+        IntRect boxRect(0, 0, containerBox->layer()->width(), containerBox->layer()->height());
         rect = intersection(repaintRect, boxRect);
         if (rect.isEmpty())
             return;
     } else
         rect.setLocation(topLeft);
     
-    o->computeAbsoluteRepaintRect(rect, fixed);
+    o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
 
 void RenderBox::repaintDuringLayoutIfMoved(const IntRect& rect)
 {
-    int newX = m_x;
-    int newY = m_y;
-    int newWidth = m_width;
-    int newHeight = m_height;
+    int newX = x();
+    int newY = y();
+    int newWidth = width();
+    int newHeight = height();
     if (rect.x() != newX || rect.y() != newY) {
         // The child moved.  Invalidate the object's old and new positions.  We have to do this
         // since the object may not have gotten a layout.
-        m_x = rect.x();
-        m_y = rect.y();
-        m_width = rect.width();
-        m_height = rect.height();
+        m_frameRect = rect;
         repaint();
         repaintOverhangingFloats(true);
-
-        m_x = newX;
-        m_y = newY;
-        m_width = newWidth;
-        m_height = newHeight;
+        m_frameRect = IntRect(newX, newY, newWidth, newHeight);
         repaint();
         repaintOverhangingFloats(true);
     }
 }
 
-int RenderBox::relativePositionOffsetX() const
-{
-    if (!style()->left().isAuto()) {
-        if (!style()->right().isAuto() && containingBlock()->style()->direction() == RTL)
-            return -style()->right().calcValue(containingBlockWidth());
-        return style()->left().calcValue(containingBlockWidth());
-    }
-    if (!style()->right().isAuto())
-        return -style()->right().calcValue(containingBlockWidth());
-    return 0;
-}
-
-int RenderBox::relativePositionOffsetY() const
-{
-    if (!style()->top().isAuto()) {
-        if (!style()->top().isPercent() || containingBlock()->style()->height().isFixed())
-            return style()->top().calcValue(containingBlockHeight());
-    } else if (!style()->bottom().isAuto()) {
-        if (!style()->bottom().isPercent() || containingBlock()->style()->height().isFixed())
-            return -style()->bottom().calcValue(containingBlockHeight());
-    }
-    return 0;
-}
-
 void RenderBox::calcWidth()
 {
     if (isPositioned()) {
@@ -1326,7 +1225,7 @@ void RenderBox::calcWidth()
     // width.  Use the width from the style context.
     if (hasOverrideSize() &&  parent()->style()->boxOrient() == HORIZONTAL
             && parent()->isFlexibleBox() && parent()->isFlexingChildren()) {
-        m_width = overrideSize();
+        setWidth(overrideSize());
         return;
     }
 
@@ -1334,10 +1233,10 @@ void RenderBox::calcWidth()
     bool stretching = (parent()->style()->boxAlign() == BSTRETCH);
     bool treatAsReplaced = shouldCalculateSizeAsReplaced() && (!inVerticalBox || !stretching);
 
-    Length width = (treatAsReplaced) ? Length(calcReplacedWidth(), Fixed) : style()->width();
+    Length w = (treatAsReplaced) ? Length(calcReplacedWidth(), Fixed) : style()->width();
 
     RenderBlock* cb = containingBlock();
-    int containerWidth = max(0, containingBlockWidth());
+    int containerWidth = max(0, containingBlockWidthForContent());
 
     Length marginLeft = style()->marginLeft();
     Length marginRight = style()->marginRight();
@@ -1347,42 +1246,42 @@ void RenderBox::calcWidth()
         m_marginLeft = marginLeft.calcMinValue(containerWidth);
         m_marginRight = marginRight.calcMinValue(containerWidth);
         if (treatAsReplaced)
-            m_width = max(width.value() + borderLeft() + borderRight() + paddingLeft() + paddingRight(), minPrefWidth());
+            setWidth(max(w.value() + borderLeft() + borderRight() + paddingLeft() + paddingRight(), minPrefWidth()));
 
         return;
     }
 
     // Width calculations
     if (treatAsReplaced)
-        m_width = width.value() + borderLeft() + borderRight() + paddingLeft() + paddingRight();
+        setWidth(w.value() + borderLeft() + borderRight() + paddingLeft() + paddingRight());
     else {
         // Calculate Width
-        m_width = calcWidthUsing(Width, containerWidth);
+        setWidth(calcWidthUsing(Width, containerWidth));
 
         // Calculate MaxWidth
         if (!style()->maxWidth().isUndefined()) {
             int maxW = calcWidthUsing(MaxWidth, containerWidth);
-            if (m_width > maxW) {
-                m_width = maxW;
-                width = style()->maxWidth();
+            if (width() > maxW) {
+                setWidth(maxW);
+                w = style()->maxWidth();
             }
         }
 
         // Calculate MinWidth
         int minW = calcWidthUsing(MinWidth, containerWidth);
-        if (m_width < minW) {
-            m_width = minW;
-            width = style()->minWidth();
+        if (width() < minW) {
+            setWidth(minW);
+            w = style()->minWidth();
         }
     }
 
     if (stretchesToMinIntrinsicWidth()) {
-        m_width = max(m_width, minPrefWidth());
-        width = Length(m_width, Fixed);
+        setWidth(max(width(), minPrefWidth()));
+        w = Length(width(), Fixed);
     }
 
     // Margin calculations
-    if (width.isAuto()) {
+    if (w.isAuto()) {
         m_marginLeft = marginLeft.calcMinValue(containerWidth);
         m_marginRight = marginRight.calcMinValue(containerWidth);
     } else {
@@ -1391,18 +1290,18 @@ void RenderBox::calcWidth()
         calcHorizontalMargins(marginLeft, marginRight, containerWidth);
     }
 
-    if (containerWidth && containerWidth != (m_width + m_marginLeft + m_marginRight)
+    if (containerWidth && containerWidth != (width() + m_marginLeft + m_marginRight)
             && !isFloating() && !isInline() && !cb->isFlexibleBox()) {
         if (cb->style()->direction() == LTR)
-            m_marginRight = containerWidth - m_width - m_marginLeft;
+            m_marginRight = containerWidth - width() - m_marginLeft;
         else
-            m_marginLeft = containerWidth - m_width - m_marginRight;
+            m_marginLeft = containerWidth - width() - m_marginRight;
     }
 }
 
 int RenderBox::calcWidthUsing(WidthType widthType, int cw)
 {
-    int width = m_width;
+    int widthResult = width();
     Length w;
     if (widthType == Width)
         w = style()->width();
@@ -1415,24 +1314,23 @@ int RenderBox::calcWidthUsing(WidthType widthType, int cw)
         int marginLeft = style()->marginLeft().calcMinValue(cw);
         int marginRight = style()->marginRight().calcMinValue(cw);
         if (cw)
-            width = cw - marginLeft - marginRight;
+            widthResult = cw - marginLeft - marginRight;
 
         if (sizesToIntrinsicWidth(widthType)) {
-            width = max(width, minPrefWidth());
-            width = min(width, maxPrefWidth());
+            widthResult = max(widthResult, minPrefWidth());
+            widthResult = min(widthResult, maxPrefWidth());
         }
     } else
-        width = calcBorderBoxWidth(w.calcValue(cw));
+        widthResult = calcBorderBoxWidth(w.calcValue(cw));
 
-    return width;
+    return widthResult;
 }
 
 bool RenderBox::sizesToIntrinsicWidth(WidthType widthType) const
 {
     // Marquees in WinIE are like a mixture of blocks and inline-blocks.  They size as though they're blocks,
     // but they allow text to sit on the same line as the marquee.
-    if (isFloating() || (isCompact() && isInline())
-            || (isInlineBlockOrInlineTable() && !isHTMLMarquee()))
+    if (isFloating() || (isInlineBlockOrInlineTable() && !isHTMLMarquee()))
         return true;
 
     // This code may look a bit strange.  Basically width:intrinsic should clamp the size when testing both
@@ -1467,20 +1365,20 @@ void RenderBox::calcHorizontalMargins(const Length& marginLeft, const Length& ma
         return;
     }
 
-    if ((marginLeft.isAuto() && marginRight.isAuto() && m_width < containerWidth)
+    if ((marginLeft.isAuto() && marginRight.isAuto() && width() < containerWidth)
             || (!marginLeft.isAuto() && !marginRight.isAuto() && containingBlock()->style()->textAlign() == WEBKIT_CENTER)) {
-        m_marginLeft = max(0, (containerWidth - m_width) / 2);
-        m_marginRight = containerWidth - m_width - m_marginLeft;
-    } else if ((marginRight.isAuto() && m_width < containerWidth)
+        m_marginLeft = max(0, (containerWidth - width()) / 2);
+        m_marginRight = containerWidth - width() - m_marginLeft;
+    } else if ((marginRight.isAuto() && width() < containerWidth)
             || (!marginLeft.isAuto() && containingBlock()->style()->direction() == RTL && containingBlock()->style()->textAlign() == WEBKIT_LEFT)) {
         m_marginLeft = marginLeft.calcValue(containerWidth);
-        m_marginRight = containerWidth - m_width - m_marginLeft;
-    } else if ((marginLeft.isAuto() && m_width < containerWidth)
+        m_marginRight = containerWidth - width() - m_marginLeft;
+    } else if ((marginLeft.isAuto() && width() < containerWidth)
             || (!marginRight.isAuto() && containingBlock()->style()->direction() == LTR && containingBlock()->style()->textAlign() == WEBKIT_RIGHT)) {
         m_marginRight = marginRight.calcValue(containerWidth);
-        m_marginLeft = containerWidth - m_width - m_marginRight;
+        m_marginLeft = containerWidth - width() - m_marginRight;
     } else {
-        // This makes auto margins 0 if we failed a m_width < containerWidth test above (css2.1, 10.3.3).
+        // This makes auto margins 0 if we failed a width() < containerWidth test above (css2.1, 10.3.3).
         m_marginLeft = marginLeft.calcMinValue(containerWidth);
         m_marginRight = marginRight.calcMinValue(containerWidth);
     }
@@ -1492,6 +1390,7 @@ void RenderBox::calcHeight()
     if (isTableCell() || (isInline() && !isReplaced()))
         return;
 
+    Length h;
     if (isPositioned())
         calcAbsoluteVertical();
     else {
@@ -1501,7 +1400,6 @@ void RenderBox::calcHeight()
         if (isTable())
             return;
 
-        Length h;
         bool inHorizontalBox = parent()->isFlexibleBox() && parent()->style()->boxOrient() == HORIZONTAL;
         bool stretching = parent()->style()->boxAlign() == BSTRETCH;
         bool treatAsReplaced = shouldCalculateSizeAsReplaced() && (!inHorizontalBox || !stretching);
@@ -1522,44 +1420,49 @@ void RenderBox::calcHeight()
         // Block children of horizontal flexible boxes fill the height of the box.
         if (h.isAuto() && parent()->isFlexibleBox() && parent()->style()->boxOrient() == HORIZONTAL
                 && parent()->isStretchingChildren()) {
-            h = Length(parent()->contentHeight() - marginTop() - marginBottom() -
+            h = Length(parentBox()->contentHeight() - marginTop() - marginBottom() -
                        borderTop() - paddingTop() - borderBottom() - paddingBottom(), Fixed);
             checkMinMaxHeight = false;
         }
 
-        int height;
+        int heightResult;
         if (checkMinMaxHeight) {
-            height = calcHeightUsing(style()->height());
-            if (height == -1)
-                height = m_height;
+            heightResult = calcHeightUsing(style()->height());
+            if (heightResult == -1)
+                heightResult = height();
             int minH = calcHeightUsing(style()->minHeight()); // Leave as -1 if unset.
-            int maxH = style()->maxHeight().isUndefined() ? height : calcHeightUsing(style()->maxHeight());
+            int maxH = style()->maxHeight().isUndefined() ? heightResult : calcHeightUsing(style()->maxHeight());
             if (maxH == -1)
-                maxH = height;
-            height = min(maxH, height);
-            height = max(minH, height);
-        } else
+                maxH = heightResult;
+            heightResult = min(maxH, heightResult);
+            heightResult = max(minH, heightResult);
+        } else {
             // The only times we don't check min/max height are when a fixed length has
             // been given as an override.  Just use that.  The value has already been adjusted
             // for box-sizing.
-            height = h.value() + borderTop() + borderBottom() + paddingTop() + paddingBottom();
+            heightResult = h.value() + borderTop() + borderBottom() + paddingTop() + paddingBottom();
+        }
 
-        m_height = height;
+        setHeight(heightResult);
     }
 
     // WinIE quirk: The <html> block always fills the entire canvas in quirks mode.  The <body> always fills the
     // <html> block in quirks mode.  Only apply this quirk if the block is normal flow and no height
-    // is specified.
-    if (stretchesToViewHeight() && !document()->printing()) {
+    // is specified. When we're printing, we also need this quirk if the body or root has a percentage 
+    // height since we don't set a height in RenderView when we're printing. So without this quirk, the 
+    // height has nothing to be a percentage of, and it ends up being 0. That is bad.
+    bool printingNeedsBaseHeight = document()->printing() && h.isPercent()
+        && (isRoot() || isBody() && document()->documentElement()->renderer()->style()->height().isPercent());
+    if (stretchesToViewHeight() || printingNeedsBaseHeight) {
         int margins = collapsedMarginTop() + collapsedMarginBottom();
-        int visHeight = view()->viewHeight();
+        int visHeight = document()->printing() ? view()->frameView()->visibleHeight() : view()->viewHeight();
         if (isRoot())
-            m_height = max(m_height, visHeight - margins);
+            setHeight(max(height(), visHeight - margins));
         else {
-            int marginsBordersPadding = margins + parent()->marginTop() + parent()->marginBottom()
-                + parent()->borderTop() + parent()->borderBottom()
-                + parent()->paddingTop() + parent()->paddingBottom();
-            m_height = max(m_height, visHeight - marginsBordersPadding);
+            int marginsBordersPadding = margins + parentBox()->marginTop() + parentBox()->marginBottom()
+                + parentBox()->borderTop() + parentBox()->borderBottom()
+                + parentBox()->paddingTop() + parentBox()->paddingBottom();
+            setHeight(max(height(), visHeight - marginsBordersPadding));
         }
     }
 }
@@ -1630,7 +1533,7 @@ int RenderBox::calcPercentageHeight(const Length& height)
         if (result != -1)
             result = cb->calcContentBoxHeight(result);
     } else if (cb->isRenderView() || (cb->isBody() && style()->htmlHacks()) || isPositionedWithSpecifiedHeight) {
-        // Don't allow this to affect the block' m_height member variable, since this
+        // Don't allow this to affect the block' height() member variable, since this
         // can get called while the block is still laying out its kids.
         int oldHeight = cb->height();
         cb->calcHeight();
@@ -1669,7 +1572,7 @@ int RenderBox::calcReplacedWidthUsing(Length width) const
         case Fixed:
             return calcContentBoxWidth(width.value());
         case Percent: {
-            const int cw = isPositioned() ? containingBlockWidthForPositioned(container()) : containingBlockWidth();
+            const int cw = isPositioned() ? containingBlockWidthForPositioned(toRenderBoxModelObject(container())) : containingBlockWidthForContent();
             if (cw > 0)
                 return calcContentBoxWidth(width.calcMinValue(cw));
         }
@@ -1698,12 +1601,12 @@ int RenderBox::calcReplacedHeightUsing(Length height) const
             RenderObject* cb = isPositioned() ? container() : containingBlock();
             while (cb->isAnonymous()) {
                 cb = cb->containingBlock();
-                static_cast<RenderBlock*>(cb)->addPercentHeightDescendant(const_cast<RenderBox*>(this));
+                toRenderBlock(cb)->addPercentHeightDescendant(const_cast<RenderBox*>(this));
             }
 
             if (cb->isPositioned() && cb->style()->height().isAuto() && !(cb->style()->top().isAuto() || cb->style()->bottom().isAuto())) {
                 ASSERT(cb->isRenderBlock());
-                RenderBlock* block = static_cast<RenderBlock*>(cb);
+                RenderBlock* block = toRenderBlock(cb);
                 int oldHeight = block->height();
                 block->calcHeight();
                 int newHeight = block->calcContentBoxHeight(block->contentHeight());
@@ -1711,7 +1614,7 @@ int RenderBox::calcReplacedHeightUsing(Length height) const
                 return calcContentBoxHeight(height.calcValue(newHeight));
             }
             
-            int availableHeight = isPositioned() ? containingBlockHeightForPositioned(cb) : cb->availableHeight();
+            int availableHeight = isPositioned() ? containingBlockHeightForPositioned(toRenderBoxModelObject(cb)) : toRenderBox(cb)->availableHeight();
 
             // It is necessary to use the border-box to match WinIE's broken
             // box model.  This is essential for sizing inside
@@ -1742,7 +1645,7 @@ int RenderBox::availableHeightUsing(const Length& h) const
         return calcContentBoxHeight(h.value());
 
     if (isRenderView())
-        return static_cast<const RenderView*>(this)->frameView()->visibleHeight();
+        return toRenderView(this)->frameView()->visibleHeight();
 
     // We need to stop here, since we don't want to increase the height of the table
     // artificially.  We're going to rely on this cell getting expanded to some new
@@ -1754,7 +1657,7 @@ int RenderBox::availableHeightUsing(const Length& h) const
        return calcContentBoxHeight(h.calcValue(containingBlock()->availableHeight()));
 
     if (isRenderBlock() && isPositioned() && style()->height().isAuto() && !(style()->top().isAuto() || style()->bottom().isAuto())) {
-        RenderBlock* block = const_cast<RenderBlock*>(static_cast<const RenderBlock*>(this));
+        RenderBlock* block = const_cast<RenderBlock*>(toRenderBlock(this));
         int oldHeight = block->height();
         block->calcHeight();
         int newHeight = block->calcContentBoxHeight(block->contentHeight());
@@ -1781,65 +1684,46 @@ void RenderBox::calcVerticalMargins()
     m_marginBottom = style()->marginBottom().calcMinValue(cw);
 }
 
-int RenderBox::staticX() const
-{
-    return m_layer ? m_layer->staticX() : 0;
-}
-
-int RenderBox::staticY() const
+int RenderBox::containingBlockWidthForPositioned(const RenderBoxModelObject* containingBlock) const
 {
-    return m_layer ? m_layer->staticY() : 0;
-}
-
-void RenderBox::setStaticX(int staticX)
-{
-    ASSERT(isPositioned() || isRelPositioned());
-    m_layer->setStaticX(staticX);
-}
-
-void RenderBox::setStaticY(int staticY)
-{
-    ASSERT(isPositioned() || isRelPositioned());
-    
-    if (staticY == m_layer->staticY())
-        return;
+    if (containingBlock->isBox()) {
+        const RenderBox* containingBlockBox = toRenderBox(containingBlock);
+        return containingBlockBox->width() - containingBlockBox->borderLeft() - containingBlockBox->borderRight() - containingBlockBox->verticalScrollbarWidth();
+    }
     
-    m_layer->setStaticY(staticY);
-    setChildNeedsLayout(true, false);
-}
+    ASSERT(containingBlock->isRenderInline() && containingBlock->isRelPositioned());
 
-int RenderBox::containingBlockWidthForPositioned(const RenderObject* containingBlock) const
-{
-    if (containingBlock->isInlineFlow()) {
-        ASSERT(containingBlock->isRelPositioned());
+    const RenderInline* flow = toRenderInline(containingBlock);
+    InlineFlowBox* first = flow->firstLineBox();
+    InlineFlowBox* last = flow->lastLineBox();
 
-        const RenderFlow* flow = static_cast<const RenderFlow*>(containingBlock);
-        InlineFlowBox* first = flow->firstLineBox();
-        InlineFlowBox* last = flow->lastLineBox();
-
-        // If the containing block is empty, return a width of 0.
-        if (!first || !last)
-            return 0;
-
-        int fromLeft;
-        int fromRight;
-        if (containingBlock->style()->direction() == LTR) {
-            fromLeft = first->xPos() + first->borderLeft();
-            fromRight = last->xPos() + last->width() - last->borderRight();
-        } else {
-            fromRight = first->xPos() + first->width() - first->borderRight();
-            fromLeft = last->xPos() + last->borderLeft();
-        }
+    // If the containing block is empty, return a width of 0.
+    if (!first || !last)
+        return 0;
 
-        return max(0, (fromRight - fromLeft));
+    int fromLeft;
+    int fromRight;
+    if (containingBlock->style()->direction() == LTR) {
+        fromLeft = first->x() + first->borderLeft();
+        fromRight = last->x() + last->width() - last->borderRight();
+    } else {
+        fromRight = first->x() + first->width() - first->borderRight();
+        fromLeft = last->x() + last->borderLeft();
     }
 
-    return containingBlock->width() - containingBlock->borderLeft() - containingBlock->borderRight() - containingBlock->verticalScrollbarWidth();
+    return max(0, (fromRight - fromLeft));
 }
 
-int RenderBox::containingBlockHeightForPositioned(const RenderObject* containingBlock) const
-{
-    return containingBlock->height() - containingBlock->borderTop() - containingBlock->borderBottom();
+int RenderBox::containingBlockHeightForPositioned(const RenderBoxModelObject* containingBlock) const
+{   
+    int heightResult = 0;
+    if (containingBlock->isBox())
+         heightResult = toRenderBox(containingBlock)->height();
+    else if (containingBlock->isRenderInline()) {
+        ASSERT(containingBlock->isRelPositioned());
+        heightResult = toRenderInline(containingBlock)->linesBoundingBox().height();
+    }
+    return heightResult - containingBlock->borderTop() - containingBlock->borderBottom();
 }
 
 void RenderBox::calcAbsoluteHorizontal()
@@ -1864,7 +1748,7 @@ void RenderBox::calcAbsoluteHorizontal()
     // NOTE: 'static' is not a legal value for 'left' or 'right' as of CSS 2.1.
 
     // FIXME 3: Can perhaps optimize out cases when max-width/min-width are greater
-    // than or less than the computed m_width.  Be careful of box-sizing and
+    // than or less than the computed width().  Be careful of box-sizing and
     // percentage issues.
 
     // The following is based off of the W3C Working Draft from April 11, 2006 of
@@ -1876,8 +1760,8 @@ void RenderBox::calcAbsoluteHorizontal()
 
     // We don't use containingBlock(), since we may be positioned by an enclosing
     // relative positioned inline.
-    const RenderObject* containerBlock = container();
-
+    const RenderBoxModelObject* containerBlock = toRenderBoxModelObject(container());
+    
     const int containerWidth = containingBlockWidthForPositioned(containerBlock);
 
     // To match WinIE, in quirks mode use the parent's 'direction' property
@@ -1919,25 +1803,35 @@ void RenderBox::calcAbsoluteHorizontal()
     if (left.isAuto() && right.isAuto()) {
         if (containerDirection == LTR) {
             // 'staticX' should already have been set through layout of the parent.
-            int staticPosition = staticX() - containerBlock->borderLeft();
-            for (RenderObject* po = parent(); po && po != containerBlock; po = po->parent())
-                staticPosition += po->xPos();
+            int staticPosition = layer()->staticX() - containerBlock->borderLeft();
+            for (RenderObject* po = parent(); po && po != containerBlock; po = po->parent()) {
+                if (po->isBox())
+                    staticPosition += toRenderBox(po)->x();
+            }
             left.setValue(Fixed, staticPosition);
         } else {
             RenderObject* po = parent();
             // 'staticX' should already have been set through layout of the parent.
-            int staticPosition = staticX() + containerWidth + containerBlock->borderRight() - po->width();
-            for (; po && po != containerBlock; po = po->parent())
-                staticPosition -= po->xPos();
+            int staticPosition = layer()->staticX() + containerWidth + containerBlock->borderRight();
+            if (po->isBox())
+                staticPosition -= toRenderBox(po)->width();
+            for (; po && po != containerBlock; po = po->parent()) {
+                if (po->isBox())
+                    staticPosition -= toRenderBox(po)->x();
+            }
             right.setValue(Fixed, staticPosition);
         }
     }
 
     // Calculate constraint equation values for 'width' case.
+    int widthResult;
+    int xResult;
     calcAbsoluteHorizontalValues(style()->width(), containerBlock, containerDirection,
                                  containerWidth, bordersPlusPadding,
                                  left, right, marginLeft, marginRight,
-                                 m_width, m_marginLeft, m_marginRight, m_x);
+                                 widthResult, m_marginLeft, m_marginRight, xResult);
+    setWidth(widthResult);
+    setX(xResult);
 
     // Calculate constraint equation values for 'max-width' case.
     if (!style()->maxWidth().isUndefined()) {
@@ -1951,11 +1845,11 @@ void RenderBox::calcAbsoluteHorizontal()
                                      left, right, marginLeft, marginRight,
                                      maxWidth, maxMarginLeft, maxMarginRight, maxXPos);
 
-        if (m_width > maxWidth) {
-            m_width = maxWidth;
+        if (width() > maxWidth) {
+            setWidth(maxWidth);
             m_marginLeft = maxMarginLeft;
             m_marginRight = maxMarginRight;
-            m_x = maxXPos;
+            m_frameRect.setX(maxXPos);
         }
     }
 
@@ -1971,25 +1865,28 @@ void RenderBox::calcAbsoluteHorizontal()
                                      left, right, marginLeft, marginRight,
                                      minWidth, minMarginLeft, minMarginRight, minXPos);
 
-        if (m_width < minWidth) {
-            m_width = minWidth;
+        if (width() < minWidth) {
+            setWidth(minWidth);
             m_marginLeft = minMarginLeft;
             m_marginRight = minMarginRight;
-            m_x = minXPos;
+            m_frameRect.setX(minXPos);
         }
     }
 
-    if (stretchesToMinIntrinsicWidth() && m_width < minPrefWidth() - bordersPlusPadding)
+    if (stretchesToMinIntrinsicWidth() && width() < minPrefWidth() - bordersPlusPadding) {
         calcAbsoluteHorizontalValues(Length(minPrefWidth() - bordersPlusPadding, Fixed), containerBlock, containerDirection,
                                      containerWidth, bordersPlusPadding,
                                      left, right, marginLeft, marginRight,
-                                     m_width, m_marginLeft, m_marginRight, m_x);
+                                     widthResult, m_marginLeft, m_marginRight, xResult);
+        setWidth(widthResult);
+        setX(xResult);
+    }
 
-    // Put m_width into correct form.
-    m_width += bordersPlusPadding;
+    // Put width() into correct form.
+    setWidth(width() + bordersPlusPadding);
 }
 
-void RenderBox::calcAbsoluteHorizontalValues(Length width, const RenderObject* containerBlock, TextDirection containerDirection,
+void RenderBox::calcAbsoluteHorizontalValues(Length width, const RenderBoxModelObject* containerBlock, TextDirection containerDirection,
                                              const int containerWidth, const int bordersPlusPadding,
                                              const Length left, const Length right, const Length marginLeft, const Length marginRight,
                                              int& widthValue, int& marginLeftValue, int& marginRightValue, int& xPos)
@@ -2145,15 +2042,15 @@ void RenderBox::calcAbsoluteHorizontalValues(Length width, const RenderObject* c
     // Use computed values to calculate the horizontal position.
 
     // FIXME: This hack is needed to calculate the xPos for a 'rtl' relatively
-    // positioned, inline containing block because right now, it is using the xPos
+    // positioned, inline because right now, it is using the xPos
     // of the first line box when really it should use the last line box.  When
     // this is fixed elsewhere, this block should be removed.
-    if (containerBlock->isInline() && containerBlock->style()->direction() == RTL) {
-        const RenderFlow* flow = static_cast<const RenderFlow*>(containerBlock);
+    if (containerBlock->isRenderInline() && containerBlock->style()->direction() == RTL) {
+        const RenderInline* flow = toRenderInline(containerBlock);
         InlineFlowBox* firstLine = flow->firstLineBox();
         InlineFlowBox* lastLine = flow->lastLineBox();
         if (firstLine && lastLine && firstLine != lastLine) {
-            xPos = leftValue + marginLeftValue + lastLine->borderLeft() + (lastLine->xPos() - firstLine->xPos());
+            xPos = leftValue + marginLeftValue + lastLine->borderLeft() + (lastLine->x() - firstLine->x());
             return;
         }
     }
@@ -2176,7 +2073,7 @@ void RenderBox::calcAbsoluteVertical()
 
 
     // We don't use containingBlock(), since we may be positioned by an enclosing relpositioned inline.
-    const RenderObject* containerBlock = container();
+    const RenderBoxModelObject* containerBlock = toRenderBoxModelObject(container());
 
     const int containerHeight = containingBlockHeightForPositioned(containerBlock);
 
@@ -2207,21 +2104,23 @@ void RenderBox::calcAbsoluteVertical()
     // Calculate the static distance if needed.
     if (top.isAuto() && bottom.isAuto()) {
         // staticY should already have been set through layout of the parent()
-        int staticTop = staticY() - containerBlock->borderTop();
+        int staticTop = layer()->staticY() - containerBlock->borderTop();
         for (RenderObject* po = parent(); po && po != containerBlock; po = po->parent()) {
-            if (!po->isTableRow())
-                staticTop += po->yPos();
+            if (po->isBox() && !po->isTableRow())
+                staticTop += toRenderBox(po)->y();
         }
         top.setValue(Fixed, staticTop);
     }
 
 
-    int height; // Needed to compute overflow.
+    int h; // Needed to compute overflow.
+    int y;
 
     // Calculate constraint equation values for 'height' case.
     calcAbsoluteVerticalValues(style()->height(), containerBlock, containerHeight, bordersPlusPadding,
                                top, bottom, marginTop, marginBottom,
-                               height, m_marginTop, m_marginBottom, m_y);
+                               h, m_marginTop, m_marginBottom, y);
+    setY(y);
 
     // Avoid doing any work in the common case (where the values of min-height and max-height are their defaults).
     // see FIXME 3
@@ -2237,11 +2136,11 @@ void RenderBox::calcAbsoluteVertical()
                                    top, bottom, marginTop, marginBottom,
                                    maxHeight, maxMarginTop, maxMarginBottom, maxYPos);
 
-        if (height > maxHeight) {
-            height = maxHeight;
+        if (h > maxHeight) {
+            h = maxHeight;
             m_marginTop = maxMarginTop;
             m_marginBottom = maxMarginBottom;
-            m_y = maxYPos;
+            m_frameRect.setY(maxYPos);
         }
     }
 
@@ -2256,19 +2155,19 @@ void RenderBox::calcAbsoluteVertical()
                                    top, bottom, marginTop, marginBottom,
                                    minHeight, minMarginTop, minMarginBottom, minYPos);
 
-        if (height < minHeight) {
-            height = minHeight;
+        if (h < minHeight) {
+            h = minHeight;
             m_marginTop = minMarginTop;
             m_marginBottom = minMarginBottom;
-            m_y = minYPos;
+            m_frameRect.setY(minYPos);
         }
     }
 
     // Set final height value.
-    m_height = height + bordersPlusPadding;
+    setHeight(h + bordersPlusPadding);
 }
 
-void RenderBox::calcAbsoluteVerticalValues(Length height, const RenderObject* containerBlock,
+void RenderBox::calcAbsoluteVerticalValues(Length h, const RenderBoxModelObject* containerBlock,
                                            const int containerHeight, const int bordersPlusPadding,
                                            const Length top, const Length bottom, const Length marginTop, const Length marginBottom,
                                            int& heightValue, int& marginTopValue, int& marginBottomValue, int& yPos)
@@ -2277,17 +2176,17 @@ void RenderBox::calcAbsoluteVerticalValues(Length height, const RenderObject* co
     // converted to the static position in calcAbsoluteVertical()
     ASSERT(!(top.isAuto() && bottom.isAuto()));
 
-    int contentHeight = m_height - bordersPlusPadding;
+    int contentHeight = height() - bordersPlusPadding;
 
     int topValue = 0;
 
-    bool heightIsAuto = height.isAuto();
+    bool heightIsAuto = h.isAuto();
     bool topIsAuto = top.isAuto();
     bool bottomIsAuto = bottom.isAuto();
 
     // Height is never unsolved for tables.
     if (isTable()) {
-        height.setValue(Fixed, contentHeight);
+        h.setValue(Fixed, contentHeight);
         heightIsAuto = false;
     }
 
@@ -2303,7 +2202,7 @@ void RenderBox::calcAbsoluteVerticalValues(Length height, const RenderObject* co
         // NOTE:  It is not necessary to solve for 'bottom' in the over constrained
         // case because the value is not used for any further calculations.
 
-        heightValue = calcContentBoxHeight(height.calcValue(containerHeight));
+        heightValue = calcContentBoxHeight(h.calcValue(containerHeight));
         topValue = top.calcValue(containerHeight);
 
         const int availableSpace = containerHeight - (topValue + heightValue + bottom.calcValue(containerHeight) + bordersPlusPadding);
@@ -2370,7 +2269,7 @@ void RenderBox::calcAbsoluteVerticalValues(Length height, const RenderObject* co
             heightValue = contentHeight;
         } else if (topIsAuto && !heightIsAuto && !bottomIsAuto) {
             // RULE 4: (solve of top)
-            heightValue = calcContentBoxHeight(height.calcValue(containerHeight));
+            heightValue = calcContentBoxHeight(h.calcValue(containerHeight));
             topValue = availableSpace - (heightValue + bottom.calcValue(containerHeight));
         } else if (!topIsAuto && heightIsAuto && !bottomIsAuto) {
             // RULE 5: (solve of height)
@@ -2378,7 +2277,7 @@ void RenderBox::calcAbsoluteVerticalValues(Length height, const RenderObject* co
             heightValue = max(0, availableSpace - (topValue + bottom.calcValue(containerHeight)));
         } else if (!topIsAuto && !heightIsAuto && bottomIsAuto) {
             // RULE 6: (no need solve of bottom)
-            heightValue = calcContentBoxHeight(height.calcValue(containerHeight));
+            heightValue = calcContentBoxHeight(h.calcValue(containerHeight));
             topValue = top.calcValue(containerHeight);
         }
     }
@@ -2397,7 +2296,7 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
 
     // We don't use containingBlock(), since we may be positioned by an enclosing
     // relative positioned inline.
-    const RenderObject* containerBlock = container();
+    const RenderBoxModelObject* containerBlock = toRenderBoxModelObject(container());
 
     const int containerWidth = containingBlockWidthForPositioned(containerBlock);
 
@@ -2419,8 +2318,8 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
     // NOTE: This value of width is FINAL in that the min/max width calculations
     // are dealt with in calcReplacedWidth().  This means that the steps to produce
     // correct max/min in the non-replaced version, are not necessary.
-    m_width = calcReplacedWidth() + borderLeft() + borderRight() + paddingLeft() + paddingRight();
-    const int availableSpace = containerWidth - m_width;
+    setWidth(calcReplacedWidth() + borderLeft() + borderRight() + paddingLeft() + paddingRight());
+    const int availableSpace = containerWidth - width();
 
     /*-----------------------------------------------------------------------*\
      * 2. If both 'left' and 'right' have the value 'auto', then if 'direction'
@@ -2432,16 +2331,20 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
         // see FIXME 1
         if (containerDirection == LTR) {
             // 'staticX' should already have been set through layout of the parent.
-            int staticPosition = staticX() - containerBlock->borderLeft();
-            for (RenderObject* po = parent(); po && po != containerBlock; po = po->parent())
-                staticPosition += po->xPos();
+            int staticPosition = layer()->staticX() - containerBlock->borderLeft();
+            for (RenderObject* po = parent(); po && po != containerBlock; po = po->parent()) {
+                if (po->isBox())
+                    staticPosition += toRenderBox(po)->x();
+            }
             left.setValue(Fixed, staticPosition);
         } else {
             RenderObject* po = parent();
             // 'staticX' should already have been set through layout of the parent.
-            int staticPosition = staticX() + containerWidth + containerBlock->borderRight() - po->width();
-            for (; po && po != containerBlock; po = po->parent())
-                staticPosition -= po->xPos();
+            int staticPosition = layer()->staticX() + containerWidth + containerBlock->borderRight();
+            for ( ; po && po != containerBlock; po = po->parent()) {
+                if (po->isBox())
+                    staticPosition += toRenderBox(po)->x();
+            }
             right.setValue(Fixed, staticPosition);
         }
     }
@@ -2538,7 +2441,7 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
     \*-----------------------------------------------------------------------*/
     // NOTE:  It is not necessary to solve for 'right' when the direction is
     // LTR because the value is not used.
-    int totalWidth = m_width + leftValue + rightValue +  m_marginLeft + m_marginRight;
+    int totalWidth = width() + leftValue + rightValue +  m_marginLeft + m_marginRight;
     if (totalWidth > containerWidth && (containerDirection == RTL))
         leftValue = containerWidth - (totalWidth - leftValue);
 
@@ -2549,16 +2452,16 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
     // of the first line box when really it should use the last line box.  When
     // this is fixed elsewhere, this block should be removed.
     if (containerBlock->isInline() && containerBlock->style()->direction() == RTL) {
-        const RenderFlow* flow = static_cast<const RenderFlow*>(containerBlock);
+        const RenderInline* flow = toRenderInline(containerBlock);
         InlineFlowBox* firstLine = flow->firstLineBox();
         InlineFlowBox* lastLine = flow->lastLineBox();
         if (firstLine && lastLine && firstLine != lastLine) {
-            m_x = leftValue + m_marginLeft + lastLine->borderLeft() + (lastLine->xPos() - firstLine->xPos());
+            m_frameRect.setX(leftValue + m_marginLeft + lastLine->borderLeft() + (lastLine->x() - firstLine->x()));
             return;
         }
     }
 
-    m_x = leftValue + m_marginLeft + containerBlock->borderLeft();
+    m_frameRect.setX(leftValue + m_marginLeft + containerBlock->borderLeft());
 }
 
 void RenderBox::calcAbsoluteVerticalReplaced()
@@ -2570,7 +2473,7 @@ void RenderBox::calcAbsoluteVerticalReplaced()
     // the numbers correspond to numbers in spec)
 
     // We don't use containingBlock(), since we may be positioned by an enclosing relpositioned inline.
-    const RenderObject* containerBlock = container();
+    const RenderBoxModelObject* containerBlock = toRenderBoxModelObject(container());
 
     const int containerHeight = containingBlockHeightForPositioned(containerBlock);
 
@@ -2588,8 +2491,8 @@ void RenderBox::calcAbsoluteVerticalReplaced()
     // NOTE: This value of height is FINAL in that the min/max height calculations
     // are dealt with in calcReplacedHeight().  This means that the steps to produce
     // correct max/min in the non-replaced version, are not necessary.
-    m_height = calcReplacedHeight() + borderTop() + borderBottom() + paddingTop() + paddingBottom();
-    const int availableSpace = containerHeight - m_height;
+    setHeight(calcReplacedHeight() + borderTop() + borderBottom() + paddingTop() + paddingBottom());
+    const int availableSpace = containerHeight - height();
 
     /*-----------------------------------------------------------------------*\
      * 2. If both 'top' and 'bottom' have the value 'auto', replace 'top'
@@ -2598,10 +2501,10 @@ void RenderBox::calcAbsoluteVerticalReplaced()
     // see FIXME 2
     if (top.isAuto() && bottom.isAuto()) {
         // staticY should already have been set through layout of the parent().
-        int staticTop = staticY() - containerBlock->borderTop();
+        int staticTop = layer()->staticY() - containerBlock->borderTop();
         for (RenderObject* po = parent(); po && po != containerBlock; po = po->parent()) {
-            if (!po->isTableRow())
-                staticTop += po->yPos();
+            if (po->isBox() && !po->isTableRow())
+                staticTop += toRenderBox(po)->y();
         }
         top.setValue(Fixed, staticTop);
     }
@@ -2690,7 +2593,7 @@ void RenderBox::calcAbsoluteVerticalReplaced()
     // or not.
 
     // Use computed values to calculate the vertical position.
-    m_y = topValue + m_marginTop + containerBlock->borderTop();
+    m_frameRect.setY(topValue + m_marginTop + containerBlock->borderTop());
 }
 
 IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWidthToEndOfLine)
@@ -2701,12 +2604,11 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
     // FIXME: Paint the carets inside empty blocks differently than the carets before/after elements.
 
     // FIXME: What about border and padding?
-    const int caretWidth = 1;
-    IntRect rect(xPos(), yPos(), caretWidth, m_height);
+    IntRect rect(x(), y(), caretWidth, height());
     TextDirection direction = box ? box->direction() : style()->direction();
 
     if ((!caretOffset) ^ (direction == LTR))
-        rect.move(IntSize(m_width - caretWidth, 0));
+        rect.move(IntSize(width() - caretWidth, 0));
 
     if (box) {
         RootInlineBox* rootBox = box->root();
@@ -2724,22 +2626,22 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
     //
     // FIXME: ignoring :first-line, missing good reason to take care of
     int fontHeight = style()->font().height();
-    if (fontHeight > rect.height() || !isReplaced() && !isTable())
+    if (fontHeight > rect.height() || (!isReplaced() && !isTable()))
         rect.setHeight(fontHeight);
 
     if (extraWidthToEndOfLine)
-        *extraWidthToEndOfLine = xPos() + m_width - rect.right();
+        *extraWidthToEndOfLine = x() + width() - rect.right();
 
     // Move to local coords
-    rect.move(-xPos(), -yPos());
+    rect.move(-x(), -y());
     return rect;
 }
 
 int RenderBox::lowestPosition(bool /*includeOverflowInterior*/, bool includeSelf) const
 {
-    if (!includeSelf || !m_width)
+    if (!includeSelf || !width())
         return 0;
-    int bottom = m_height;
+    int bottom = height();
     if (isRelPositioned())
         bottom += relativePositionOffsetY();
     return bottom;
@@ -2747,9 +2649,9 @@ int RenderBox::lowestPosition(bool /*includeOverflowInterior*/, bool includeSelf
 
 int RenderBox::rightmostPosition(bool /*includeOverflowInterior*/, bool includeSelf) const
 {
-    if (!includeSelf || !m_height)
+    if (!includeSelf || !height())
         return 0;
-    int right = m_width;
+    int right = width();
     if (isRelPositioned())
         right += relativePositionOffsetX();
     return right;
@@ -2757,12 +2659,133 @@ int RenderBox::rightmostPosition(bool /*includeOverflowInterior*/, bool includeS
 
 int RenderBox::leftmostPosition(bool /*includeOverflowInterior*/, bool includeSelf) const
 {
-    if (!includeSelf || !m_height)
-        return m_width;
+    if (!includeSelf || !height())
+        return width();
     int left = 0;
     if (isRelPositioned())
         left += relativePositionOffsetX();
     return left;
 }
 
+bool RenderBox::isAfterContent(RenderObject* child) const
+{
+    return (child && child->style()->styleType() == AFTER && (!child->isText() || child->isBR()));
+}
+
+VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
+{
+    // no children...return this render object's element, if there is one, and offset 0
+    if (!firstChild())
+        return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+
+    int xPos = point.x();
+    int yPos = point.y();
+
+    if (isTable() && node()) {
+        int right = contentWidth() + borderRight() + paddingRight() + borderLeft() + paddingLeft();
+        int bottom = contentHeight() + borderTop() + paddingTop() + borderBottom() + paddingBottom();
+        
+        if (xPos < 0 || xPos > right || yPos < 0 || yPos > bottom) {
+            if (xPos <= right / 2)
+                return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+            return createVisiblePosition(lastDeepEditingPositionForNode(node()));
+        }
+    }
+
+    // Pass off to the closest child.
+    int minDist = INT_MAX;
+    RenderBox* closestRenderer = 0;
+    int newX = xPos;
+    int newY = yPos;
+    if (isTableRow()) {
+        newX += x();
+        newY += y();
+    }
+    for (RenderObject* renderObject = firstChild(); renderObject; renderObject = renderObject->nextSibling()) {
+        if ((!renderObject->firstChild() && !renderObject->isInline() && !renderObject->isBlockFlow() )
+            || renderObject->style()->visibility() != VISIBLE)
+            continue;
+        
+        if (!renderObject->isBox())
+            continue;
+        
+        RenderBox* renderer = toRenderBox(renderObject);
+
+        int top = renderer->borderTop() + renderer->paddingTop() + (isTableRow() ? 0 : renderer->y());
+        int bottom = top + renderer->contentHeight();
+        int left = renderer->borderLeft() + renderer->paddingLeft() + (isTableRow() ? 0 : renderer->x());
+        int right = left + renderer->contentWidth();
+        
+        if (xPos <= right && xPos >= left && yPos <= top && yPos >= bottom) {
+            if (renderer->isTableRow())
+                return renderer->positionForCoordinates(xPos + newX - renderer->x(), yPos + newY - renderer->y());
+            return renderer->positionForCoordinates(xPos - renderer->x(), yPos - renderer->y());
+        }
+
+        // Find the distance from (x, y) to the box.  Split the space around the box into 8 pieces
+        // and use a different compare depending on which piece (x, y) is in.
+        IntPoint cmp;
+        if (xPos > right) {
+            if (yPos < top)
+                cmp = IntPoint(right, top);
+            else if (yPos > bottom)
+                cmp = IntPoint(right, bottom);
+            else
+                cmp = IntPoint(right, yPos);
+        } else if (xPos < left) {
+            if (yPos < top)
+                cmp = IntPoint(left, top);
+            else if (yPos > bottom)
+                cmp = IntPoint(left, bottom);
+            else
+                cmp = IntPoint(left, yPos);
+        } else {
+            if (yPos < top)
+                cmp = IntPoint(xPos, top);
+            else
+                cmp = IntPoint(xPos, bottom);
+        }
+        
+        int x1minusx2 = cmp.x() - xPos;
+        int y1minusy2 = cmp.y() - yPos;
+        
+        int dist = x1minusx2 * x1minusx2 + y1minusy2 * y1minusy2;
+        if (dist < minDist) {
+            closestRenderer = renderer;
+            minDist = dist;
+        }
+    }
+    
+    if (closestRenderer)
+        return closestRenderer->positionForCoordinates(newX - closestRenderer->x(), newY - closestRenderer->y());
+    
+    return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+}
+
+bool RenderBox::shrinkToAvoidFloats() const
+{
+    // FIXME: Technically we should be able to shrink replaced elements on a line, but this is difficult to accomplish, since this
+    // involves doing a relayout during findNextLineBreak and somehow overriding the containingBlockWidth method to return the
+    // current remaining width on a line.
+    if ((isInline() && !isHTMLMarquee()) || !avoidsFloats())
+        return false;
+
+    // All auto-width objects that avoid floats should always use lineWidth.
+    return style()->width().isAuto();
+}
+
+bool RenderBox::avoidsFloats() const
+{
+    return isReplaced() || hasOverflowClip() || isHR();
+}
+
+#if ENABLE(SVG)
+
+TransformationMatrix RenderBox::localTransform() const
+{
+    return TransformationMatrix(1, 0, 0, 1, x(), y());
+}
+
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
index 54349fa6e0..ceb3302e44 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
@@ -23,19 +23,127 @@
 #ifndef RenderBox_h
 #define RenderBox_h
 
-#include "RenderObject.h"
+#include "RenderBoxModelObject.h"
+#include "ScrollTypes.h"
 
 namespace WebCore {
 
-    enum WidthType { Width, MinWidth, MaxWidth };
+enum WidthType { Width, MinWidth, MaxWidth };
 
-class RenderBox : public RenderObject {
+class RenderBox : public RenderBoxModelObject {
 public:
     RenderBox(Node*);
     virtual ~RenderBox();
 
-    virtual const char* renderName() const { return "RenderBox"; }
+    // Use this with caution! No type checking is done!
+    RenderBox* firstChildBox() const;
+    RenderBox* lastChildBox() const;
 
+    int x() const { return m_frameRect.x(); }
+    int y() const { return m_frameRect.y(); }
+    int width() const { return m_frameRect.width(); }
+    int height() const { return m_frameRect.height(); }
+    
+    void setX(int x) { m_frameRect.setX(x); }
+    void setY(int y) { m_frameRect.setY(y); }
+    void setWidth(int width) { m_frameRect.setWidth(width); }
+    void setHeight(int height) { m_frameRect.setHeight(height); }
+    
+    IntPoint location() const { return m_frameRect.location(); }
+    IntSize size() const { return m_frameRect.size(); }
+
+    void setLocation(const IntPoint& location) { m_frameRect.setLocation(location); }
+    void setLocation(int x, int y) { setLocation(IntPoint(x, y)); }
+    
+    void setSize(const IntSize& size) { m_frameRect.setSize(size); }
+    void move(int dx, int dy) { m_frameRect.move(dx, dy); }
+
+    IntRect frameRect() const { return m_frameRect; }
+    void setFrameRect(const IntRect& rect) { m_frameRect = rect; }
+
+    IntRect borderBoxRect() const { return IntRect(0, 0, width(), height()); }
+    virtual IntRect borderBoundingBox() const { return borderBoxRect(); } 
+    
+    // The content area of the box (excludes padding and border).
+    IntRect contentBoxRect() const { return IntRect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), contentWidth(), contentHeight()); }
+    // The content box in absolute coords. Ignores transforms.
+    IntRect absoluteContentBox() const;
+    // The content box converted to absolute coords (taking transforms into account).
+    FloatQuad absoluteContentQuad() const;
+
+    // Bounds of the outline box in absolute coords. Respects transforms
+    virtual IntRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/) const;
+    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+
+    // Use this with caution! No type checking is done!
+    RenderBox* previousSiblingBox() const;
+    RenderBox* nextSiblingBox() const;
+    RenderBox* parentBox() const;
+
+    // The height of a block when you include normal flow overflow spillage out of the bottom
+    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
+    // it would have an overflow height of borderTop() + paddingTop() + 100px.
+    virtual int overflowHeight(bool /*includeInterior*/ = true) const { return height(); }
+    virtual int overflowWidth(bool /*includeInterior*/ = true) const { return width(); }
+    virtual void setOverflowHeight(int) { }
+    virtual void setOverflowWidth(int) { }
+    virtual int overflowLeft(bool /*includeInterior*/ = true) const { return 0; }
+    virtual int overflowTop(bool /*includeInterior*/ = true) const { return 0; }
+    virtual IntRect overflowRect(bool /*includeInterior*/ = true) const { return borderBoxRect(); }
+
+    int contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
+    int contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
+
+    // IE extensions. Used to calculate offsetWidth/Height.  Overridden by inlines (RenderFlow)
+    // to return the remaining width on a given line (and the height of a single line).
+    virtual int offsetWidth() const { return width(); }
+    virtual int offsetHeight() const { return height(); }
+
+    // More IE extensions.  clientWidth and clientHeight represent the interior of an object
+    // excluding border and scrollbar.  clientLeft/Top are just the borderLeftWidth and borderTopWidth.
+    int clientLeft() const { return borderLeft(); }
+    int clientTop() const { return borderTop(); }
+    int clientWidth() const;
+    int clientHeight() const;
+
+    // scrollWidth/scrollHeight will be the same as clientWidth/clientHeight unless the
+    // object has overflow:hidden/scroll/auto specified and also has overflow.
+    // scrollLeft/Top return the current scroll position.  These methods are virtual so that objects like
+    // textareas can scroll shadow content (but pretend that they are the objects that are
+    // scrolling).
+    virtual int scrollLeft() const;
+    virtual int scrollTop() const;
+    virtual int scrollWidth() const;
+    virtual int scrollHeight() const;
+    virtual void setScrollLeft(int);
+    virtual void setScrollTop(int);
+
+    virtual int marginTop() const { return m_marginTop; }
+    virtual int marginBottom() const { return m_marginBottom; }
+    virtual int marginLeft() const { return m_marginLeft; }
+    virtual int marginRight() const { return m_marginRight; }
+
+    // The following five functions are used to implement collapsing margins.
+    // All objects know their maximal positive and negative margins.  The
+    // formula for computing a collapsed margin is |maxPosMargin| - |maxNegmargin|.
+    // For a non-collapsing box, such as a leaf element, this formula will simply return
+    // the margin of the element.  Blocks override the maxTopMargin and maxBottomMargin
+    // methods.
+    virtual bool isSelfCollapsingBlock() const { return false; }
+    int collapsedMarginTop() const { return maxTopMargin(true) - maxTopMargin(false); }
+    int collapsedMarginBottom() const { return maxBottomMargin(true) - maxBottomMargin(false); }
+    virtual int maxTopMargin(bool positive) const { return positive ? std::max(0, marginTop()) : -std::min(0, marginTop()); }
+    virtual int maxBottomMargin(bool positive) const { return positive ? std::max(0, marginBottom()) : -std::min(0, marginBottom()); }
+
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+    
+    IntRect reflectionBox() const;
+    int reflectionOffset() const;
+    // Given a rect in the object's coordinate space, returns the corresponding rect in the reflection.
+    IntRect reflectedRect(const IntRect&) const;
+
+    virtual void layout();
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
@@ -44,33 +152,13 @@ public:
     virtual int minPrefWidth() const;
     virtual int maxPrefWidth() const;
 
-    virtual int overrideSize() const;
-    virtual int overrideWidth() const;
-    virtual int overrideHeight() const;
+    int overrideSize() const;
+    int overrideWidth() const;
+    int overrideHeight() const;
     virtual void setOverrideSize(int);
 
-    virtual FloatPoint localToAbsolute(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
-    virtual FloatPoint absoluteToLocal(FloatPoint containerPoint, bool fixed = false, bool useTransforms = false) const;
-    virtual FloatQuad localToAbsoluteQuad(const FloatQuad&, bool fixed = false) const;
-
     virtual IntSize offsetFromContainer(RenderObject*) const;
-
-    virtual int xPos() const { return m_x; }
-    virtual int yPos() const { return m_y; }
-    virtual void setPos(int x, int y);
-
-    virtual int width() const { return m_width; }
-    virtual int height() const { return m_height; }
-    virtual void setWidth(int width) { m_width = width; }
-    virtual void setHeight(int height) { m_height = height; }
-
-    virtual int marginTop() const { return m_marginTop; }
-    virtual int marginBottom() const { return m_marginBottom; }
-    virtual int marginLeft() const { return m_marginLeft; }
-    virtual int marginRight() const { return m_marginRight; }
-
-    virtual IntRect borderBox() const { return IntRect(0, -borderTopExtra(), width(), height() + borderTopExtra() + borderBottomExtra()); }
-
+    
     int calcBorderBoxWidth(int width) const;
     int calcBorderBoxHeight(int height) const;
     int calcContentBoxWidth(int width) const;
@@ -84,28 +172,28 @@ public:
     // shifted. -dwh
     void calcHorizontalMargins(const Length& marginLeft, const Length& marginRight, int containerWidth);
 
-    virtual void position(InlineBox*);
+    void positionLineBox(InlineBox*);
 
-    virtual void dirtyLineBoxes(bool fullLayout, bool isRootLineBox = false);
+    virtual InlineBox* createInlineBox();
+    void dirtyLineBoxes(bool fullLayout);
 
     // For inline replaced elements, this function returns the inline box that owns us.  Enables
     // the replaced RenderObject to quickly determine what line it is contained on and to easily
     // iterate over structures on the line.
-    virtual InlineBox* inlineBoxWrapper() const { return m_inlineBoxWrapper; }
-    virtual void setInlineBoxWrapper(InlineBox* boxWrapper) { m_inlineBoxWrapper = boxWrapper; }
-    virtual void deleteLineBoxWrapper();
+    InlineBox* inlineBoxWrapper() const { return m_inlineBoxWrapper; }
+    void setInlineBoxWrapper(InlineBox* boxWrapper) { m_inlineBoxWrapper = boxWrapper; }
+    void deleteLineBoxWrapper();
 
     virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
 
-    virtual IntRect absoluteClippedOverflowRect();
-    virtual void computeAbsoluteRepaintRect(IntRect&, bool fixed = false);
-    IntSize offsetForPositionedInContainer(RenderObject*) const;
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
     virtual void repaintDuringLayoutIfMoved(const IntRect&);
 
-    virtual int containingBlockWidth() const;
+    virtual int containingBlockWidthForContent() const;
 
     virtual void calcWidth();
     virtual void calcHeight();
@@ -132,31 +220,36 @@ public:
 
     int calcPercentageHeight(const Length& height);
 
+    // Block flows subclass availableWidth to handle multi column layout (shrinking the width available to children when laying out.)
+    virtual int availableWidth() const { return contentWidth(); }
     virtual int availableHeight() const;
     int availableHeightUsing(const Length&) const;
 
     void calcVerticalMargins();
 
-    int relativePositionOffsetX() const;
-    int relativePositionOffsetY() const;
-    IntSize relativePositionOffset() const { return IntSize(relativePositionOffsetX(), relativePositionOffsetY()); }
+    virtual int verticalScrollbarWidth() const;
+    int horizontalScrollbarHeight() const;
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool canBeProgramaticallyScrolled(bool) const;
+    virtual void autoscroll();
+    virtual void stopAutoscroll() { }
+    virtual void panScroll(const IntPoint&);
+    bool hasAutoVerticalScrollbar() const { return hasOverflowClip() && (style()->overflowY() == OAUTO || style()->overflowY() == OOVERLAY); }
+    bool hasAutoHorizontalScrollbar() const { return hasOverflowClip() && (style()->overflowX() == OAUTO || style()->overflowX() == OOVERLAY); }
+    bool scrollsOverflow() const { return scrollsOverflowX() || scrollsOverflowY(); }
+    bool scrollsOverflowX() const { return hasOverflowClip() && (style()->overflowX() == OSCROLL || hasAutoHorizontalScrollbar()); }
+    bool scrollsOverflowY() const { return hasOverflowClip() && (style()->overflowY() == OSCROLL || hasAutoVerticalScrollbar()); }
     
-    virtual RenderLayer* layer() const { return m_layer; }
-
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
 
-    virtual void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight,
-                                        int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
-    IntSize calculateBackgroundSize(const FillLayer*, int scaledWidth, int scaledHeight) const;
-
-    virtual int staticX() const;
-    virtual int staticY() const;
-    virtual void setStaticX(int staticX);
-    virtual void setStaticY(int staticY);
-
-    virtual IntRect getOverflowClipRect(int tx, int ty);
-    virtual IntRect getClipRect(int tx, int ty);
+    virtual IntRect overflowClipRect(int tx, int ty);
+    IntRect clipRect(int tx, int ty);
+    virtual bool hasControlClip() const { return false; }
+    virtual IntRect controlClipRect(int /*tx*/, int /*ty*/) const { return IntRect(); }
+    bool pushContentsClip(PaintInfo&, int tx, int ty);
+    void popContentsClip(PaintInfo&, PaintPhase originalPhase, int tx, int ty);
 
+    virtual void paintObject(PaintInfo&, int /*tx*/, int /*ty*/) { ASSERT_NOT_REACHED(); }
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
     virtual void paintMask(PaintInfo& paintInfo, int tx, int ty);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
@@ -165,20 +258,35 @@ public:
     // that just updates the object's position.
     virtual void tryLayoutDoingPositionedMovementOnly()
     {
-        int oldWidth = m_width;
+        int oldWidth = width();
         calcWidth();
         // If we shrink to fit our width may have changed, so we still need full layout.
-        if (oldWidth != m_width)
+        if (oldWidth != width())
             return;
         calcHeight();
         setNeedsLayout(false);
     }
 
-    virtual IntRect maskClipRect();
+    IntRect maskClipRect();
+
+    virtual VisiblePosition positionForPoint(const IntPoint&);
+
+    void removeFloatingOrPositionedChildFromBlockLists();
     
+    virtual int firstLineBoxBaseline() const { return -1; }
+    virtual int lastLineBoxBaseline() const { return -1; }
+
+    bool shrinkToAvoidFloats() const;
+    virtual bool avoidsFloats() const;
+
+#if ENABLE(SVG)
+    virtual TransformationMatrix localTransform() const;
+#endif
+
 protected:
-    virtual void styleWillChange(RenderStyle::Diff, const RenderStyle* newStyle);
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+    virtual void updateBoxModelInfoFromStyle();
 
     void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
     void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
@@ -193,22 +301,26 @@ protected:
     
     virtual bool shouldCalculateSizeAsReplaced() const { return isReplaced() && !isInlineBlockOrInlineTable(); }
 
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
+
 private:
+    bool includeVerticalScrollbarSize() const { return hasOverflowClip() && (style()->overflowY() == OSCROLL || style()->overflowY() == OAUTO); }
+    bool includeHorizontalScrollbarSize() const { return hasOverflowClip() && (style()->overflowX() == OSCROLL || style()->overflowX() == OAUTO); }
+
     void paintRootBoxDecorations(PaintInfo&, int tx, int ty);
     // Returns true if we did a full repaint
     bool repaintLayerRectsForImage(WrappedImagePtr image, const FillLayer* layers, bool drawingBackground);
-
-    void calculateBackgroundImageGeometry(const FillLayer*, int tx, int ty, int w, int h, IntRect& destRect, IntPoint& phase, IntSize& tileSize);
-    
-    int containingBlockWidthForPositioned(const RenderObject* containingBlock) const;
-    int containingBlockHeightForPositioned(const RenderObject* containingBlock) const;
+   
+    int containingBlockWidthForPositioned(const RenderBoxModelObject* containingBlock) const;
+    int containingBlockHeightForPositioned(const RenderBoxModelObject* containingBlock) const;
 
     void calcAbsoluteVertical();
-    void calcAbsoluteHorizontalValues(Length width, const RenderObject* cb, TextDirection containerDirection,
+    void calcAbsoluteHorizontalValues(Length width, const RenderBoxModelObject* cb, TextDirection containerDirection,
                                       int containerWidth, int bordersPlusPadding,
                                       Length left, Length right, Length marginLeft, Length marginRight,
                                       int& widthValue, int& marginLeftValue, int& marginRightValue, int& xPos);
-    void calcAbsoluteVerticalValues(Length height, const RenderObject* cb,
+    void calcAbsoluteVerticalValues(Length height, const RenderBoxModelObject* cb,
                                     int containerHeight, int bordersPlusPadding,
                                     Length top, Length bottom, Length marginTop, Length marginBottom,
                                     int& heightValue, int& marginTopValue, int& marginBottomValue, int& yPos);
@@ -219,16 +331,16 @@ private:
     // This function calculates the minimum and maximum preferred widths for an object.
     // These values are used in shrink-to-fit layout systems.
     // These include tables, positioned objects, floats and flexible boxes.
-    virtual void calcPrefWidths() = 0;
+    virtual void calcPrefWidths() { setPrefWidthsDirty(false); }
 
 protected:
-    // The width/height of the contents + borders + padding.
-    int m_width;
-    int m_height;
+    bool isAfterContent(RenderObject* child) const;
 
-    int m_x;
-    int m_y;
+private:
+    // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
+    IntRect m_frameRect;
 
+protected:
     int m_marginLeft;
     int m_marginRight;
     int m_marginTop;
@@ -240,18 +352,54 @@ protected:
     // The preferred width of the element if it never breaks any lines at all.
     int m_maxPrefWidth;
 
-    // A pointer to our layer if we have one.
-    RenderLayer* m_layer;
-
     // For inline replaced elements, the inline box that owns us.
     InlineBox* m_inlineBoxWrapper;
 
 private:
     // Used to store state between styleWillChange and styleDidChange
-    static bool s_wasFloating;
     static bool s_hadOverflowClip;
 };
 
+inline RenderBox* toRenderBox(RenderObject* o)
+{ 
+    ASSERT(!o || o->isBox());
+    return static_cast<RenderBox*>(o);
+}
+
+inline const RenderBox* toRenderBox(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isBox());
+    return static_cast<const RenderBox*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderBox(const RenderBox*);
+
+inline RenderBox* RenderBox::previousSiblingBox() const
+{
+    return toRenderBox(previousSibling());
+}
+
+inline RenderBox* RenderBox::nextSiblingBox() const
+{ 
+    return toRenderBox(nextSibling());
+}
+
+inline RenderBox* RenderBox::parentBox() const
+{
+    return toRenderBox(parent());
+}
+
+inline RenderBox* RenderBox::firstChildBox() const
+{
+    return toRenderBox(firstChild());
+}
+
+inline RenderBox* RenderBox::lastChildBox() const
+{
+    return toRenderBox(lastChild());
+}
+
 } // namespace WebCore
 
 #endif // RenderBox_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
new file mode 100644
index 0000000000..467fa82931
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
@@ -0,0 +1,1177 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
+ *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderBoxModelObject.h"
+
+#include "GraphicsContext.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "ImageBuffer.h"
+#include "RenderBlock.h"
+#include "RenderInline.h"
+#include "RenderLayer.h"
+#include "RenderView.h"
+
+using namespace std;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+bool RenderBoxModelObject::s_wasFloating = false;
+bool RenderBoxModelObject::s_hadLayer = false;
+bool RenderBoxModelObject::s_layerWasSelfPainting = false;
+
+RenderBoxModelObject::RenderBoxModelObject(Node* node)
+    : RenderObject(node)
+    , m_layer(0)
+{
+}
+
+RenderBoxModelObject::~RenderBoxModelObject()
+{
+    // Our layer should have been destroyed and cleared by now
+    ASSERT(!hasLayer());
+    ASSERT(!m_layer);
+}
+
+void RenderBoxModelObject::destroyLayer()
+{
+    ASSERT(!hasLayer()); // Callers should have already called setHasLayer(false)
+    ASSERT(m_layer);
+    m_layer->destroy(renderArena());
+    m_layer = 0;
+}
+
+void RenderBoxModelObject::destroy()
+{
+    // This must be done before we destroy the RenderObject.
+    if (m_layer)
+        m_layer->clearClipRects();
+
+    // RenderObject::destroy calls back to destroyLayer() for layer destruction
+    RenderObject::destroy();
+}
+
+bool RenderBoxModelObject::hasSelfPaintingLayer() const
+{
+    return m_layer && m_layer->isSelfPaintingLayer();
+}
+
+void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
+{
+    s_wasFloating = isFloating();
+    s_hadLayer = hasLayer();
+    if (s_hadLayer)
+        s_layerWasSelfPainting = layer()->isSelfPaintingLayer();
+
+    // If our z-index changes value or our visibility changes,
+    // we need to dirty our stacking context's z-order list.
+    if (style() && newStyle) {
+        if (parent()) {
+            // Do a repaint with the old style first, e.g., for example if we go from
+            // having an outline to not having an outline.
+            if (diff == StyleDifferenceRepaintLayer) {
+                layer()->repaintIncludingDescendants();
+                if (!(style()->clip() == newStyle->clip()))
+                    layer()->clearClipRectsIncludingDescendants();
+            } else if (diff == StyleDifferenceRepaint || newStyle->outlineSize() < style()->outlineSize())
+                repaint();
+        }
+        
+        if (diff == StyleDifferenceLayout) {
+            // When a layout hint happens, we go ahead and do a repaint of the layer, since the layer could
+            // end up being destroyed.
+            if (hasLayer()) {
+                if (style()->position() != newStyle->position() ||
+                    style()->zIndex() != newStyle->zIndex() ||
+                    style()->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
+                    !(style()->clip() == newStyle->clip()) ||
+                    style()->hasClip() != newStyle->hasClip() ||
+                    style()->opacity() != newStyle->opacity() ||
+                    style()->transform() != newStyle->transform())
+                layer()->repaintIncludingDescendants();
+            } else if (newStyle->hasTransform() || newStyle->opacity() < 1) {
+                // If we don't have a layer yet, but we are going to get one because of transform or opacity,
+                //  then we need to repaint the old position of the object.
+                repaint();
+            }
+        }
+
+        if (hasLayer() && (style()->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
+                           style()->zIndex() != newStyle->zIndex() ||
+                           style()->visibility() != newStyle->visibility())) {
+            layer()->dirtyStackingContextZOrderLists();
+            if (style()->hasAutoZIndex() != newStyle->hasAutoZIndex() || style()->visibility() != newStyle->visibility())
+                layer()->dirtyZOrderLists();
+        }
+    }
+
+    RenderObject::styleWillChange(diff, newStyle);
+}
+
+void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderObject::styleDidChange(diff, oldStyle);
+    updateBoxModelInfoFromStyle();
+    
+    if (requiresLayer()) {
+        if (!layer()) {
+            if (s_wasFloating && isFloating())
+                setChildNeedsLayout(true);
+            m_layer = new (renderArena()) RenderLayer(this);
+            setHasLayer(true);
+            m_layer->insertOnlyThisLayer();
+            if (parent() && !needsLayout() && containingBlock())
+                m_layer->updateLayerPositions();
+        }
+    } else if (layer() && layer()->parent()) {
+        setHasTransform(false); // Either a transform wasn't specified or the object doesn't support transforms, so just null out the bit.
+        setHasReflection(false);
+        m_layer->removeOnlyThisLayer(); // calls destroyLayer() which clears m_layer
+        if (s_wasFloating && isFloating())
+            setChildNeedsLayout(true);
+    }
+
+    if (layer()) {
+        layer()->styleChanged(diff, oldStyle);
+        if (s_hadLayer && layer()->isSelfPaintingLayer() != s_layerWasSelfPainting)
+            setChildNeedsLayout(true);
+    }
+}
+
+void RenderBoxModelObject::updateBoxModelInfoFromStyle()
+{
+    // Set the appropriate bits for a box model object.  Since all bits are cleared in styleWillChange,
+    // we only check for bits that could possibly be set to true.
+    setHasBoxDecorations(style()->hasBorder() || style()->hasBackground() || style()->hasAppearance() || style()->boxShadow());
+    setInline(style()->isDisplayInlineType());
+    setRelPositioned(style()->position() == RelativePosition);
+}
+
+int RenderBoxModelObject::relativePositionOffsetX() const
+{
+    if (!style()->left().isAuto()) {
+        if (!style()->right().isAuto() && containingBlock()->style()->direction() == RTL)
+            return -style()->right().calcValue(containingBlockWidthForContent());
+        return style()->left().calcValue(containingBlockWidthForContent());
+    }
+    if (!style()->right().isAuto())
+        return -style()->right().calcValue(containingBlockWidthForContent());
+    return 0;
+}
+
+int RenderBoxModelObject::relativePositionOffsetY() const
+{
+    if (!style()->top().isAuto())
+        return style()->top().calcValue(containingBlock()->availableHeight());
+    else if (!style()->bottom().isAuto())
+        return -style()->bottom().calcValue(containingBlock()->availableHeight());
+
+    return 0;
+}
+
+int RenderBoxModelObject::offsetLeft() const
+{
+    // If the element is the HTML body element or does not have an associated box
+    // return 0 and stop this algorithm.
+    if (isBody())
+        return 0;
+    
+    RenderBoxModelObject* offsetPar = offsetParent();
+    int xPos = (isBox() ? toRenderBox(this)->x() : 0);
+    
+    // If the offsetParent of the element is null, or is the HTML body element,
+    // return the distance between the canvas origin and the left border edge 
+    // of the element and stop this algorithm.
+    if (offsetPar) {
+        if (offsetPar->isBox() && !offsetPar->isBody())
+            xPos -= toRenderBox(offsetPar)->borderLeft();
+        if (!isPositioned()) {
+            if (isRelPositioned())
+                xPos += relativePositionOffsetX();
+            RenderObject* curr = parent();
+            while (curr && curr != offsetPar) {
+                // FIXME: What are we supposed to do inside SVG content?
+                if (curr->isBox() && !curr->isTableRow())
+                    xPos += toRenderBox(curr)->x();
+                curr = curr->parent();
+            }
+            if (offsetPar->isBox() && offsetPar->isBody() && !offsetPar->isRelPositioned() && !offsetPar->isPositioned())
+                xPos += toRenderBox(offsetPar)->x();
+        }
+    }
+
+    return xPos;
+}
+
+int RenderBoxModelObject::offsetTop() const
+{
+    // If the element is the HTML body element or does not have an associated box
+    // return 0 and stop this algorithm.
+    if (isBody())
+        return 0;
+    
+    RenderBoxModelObject* offsetPar = offsetParent();
+    int yPos = (isBox() ? toRenderBox(this)->y() : 0);
+    
+    // If the offsetParent of the element is null, or is the HTML body element,
+    // return the distance between the canvas origin and the top border edge 
+    // of the element and stop this algorithm.
+    if (offsetPar) {
+        if (offsetPar->isBox() && !offsetPar->isBody())
+            yPos -= toRenderBox(offsetPar)->borderTop();
+        if (!isPositioned()) {
+            if (isRelPositioned())
+                yPos += relativePositionOffsetY();
+            RenderObject* curr = parent();
+            while (curr && curr != offsetPar) {
+                // FIXME: What are we supposed to do inside SVG content?
+                if (curr->isBox() && !curr->isTableRow())
+                    yPos += toRenderBox(curr)->y();
+                curr = curr->parent();
+            }
+            if (offsetPar->isBox() && offsetPar->isBody() && !offsetPar->isRelPositioned() && !offsetPar->isPositioned())
+                yPos += toRenderBox(offsetPar)->y();
+        }
+    }
+    return yPos;
+}
+
+int RenderBoxModelObject::paddingTop(bool) const
+{
+    int w = 0;
+    Length padding = style()->paddingTop();
+    if (padding.isPercent())
+        w = containingBlock()->availableWidth();
+    return padding.calcMinValue(w);
+}
+
+int RenderBoxModelObject::paddingBottom(bool) const
+{
+    int w = 0;
+    Length padding = style()->paddingBottom();
+    if (padding.isPercent())
+        w = containingBlock()->availableWidth();
+    return padding.calcMinValue(w);
+}
+
+int RenderBoxModelObject::paddingLeft(bool) const
+{
+    int w = 0;
+    Length padding = style()->paddingLeft();
+    if (padding.isPercent())
+        w = containingBlock()->availableWidth();
+    return padding.calcMinValue(w);
+}
+
+int RenderBoxModelObject::paddingRight(bool) const
+{
+    int w = 0;
+    Length padding = style()->paddingRight();
+    if (padding.isPercent())
+        w = containingBlock()->availableWidth();
+    return padding.calcMinValue(w);
+}
+
+
+void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int clipY, int clipH,
+                                                  int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
+{
+    GraphicsContext* context = paintInfo.context;
+    bool includeLeftEdge = box ? box->includeLeftEdge() : true;
+    bool includeRightEdge = box ? box->includeRightEdge() : true;
+    int bLeft = includeLeftEdge ? borderLeft() : 0;
+    int bRight = includeRightEdge ? borderRight() : 0;
+    int pLeft = includeLeftEdge ? paddingLeft() : 0;
+    int pRight = includeRightEdge ? paddingRight() : 0;
+
+    bool clippedToBorderRadius = false;
+    if (style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge)) {
+        context->save();
+
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect(tx, ty, w, h);
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        context->addRoundedRectClip(borderRect, includeLeftEdge ? topLeft : IntSize(),
+                                                includeRightEdge ? topRight : IntSize(),
+                                                includeLeftEdge ? bottomLeft : IntSize(),
+                                                includeRightEdge ? bottomRight : IntSize());
+        clippedToBorderRadius = true;
+    }
+
+    if (bgLayer->clip() == PaddingFillBox || bgLayer->clip() == ContentFillBox) {
+        // Clip to the padding or content boxes as necessary.
+        bool includePadding = bgLayer->clip() == ContentFillBox;
+        int x = tx + bLeft + (includePadding ? pLeft : 0);
+        int y = ty + borderTop() + (includePadding ? paddingTop() : 0);
+        int width = w - bLeft - bRight - (includePadding ? pLeft + pRight : 0);
+        int height = h - borderTop() - borderBottom() - (includePadding ? paddingTop() + paddingBottom() : 0);
+        context->save();
+        context->clip(IntRect(x, y, width, height));
+    } else if (bgLayer->clip() == TextFillBox) {
+        // We have to draw our text into a mask that can then be used to clip background drawing.
+        // First figure out how big the mask has to be.  It should be no bigger than what we need
+        // to actually render, so we should intersect the dirty rect with the border box of the background.
+        IntRect maskRect(tx, ty, w, h);
+        maskRect.intersect(paintInfo.rect);
+        
+        // Now create the mask.
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
+        if (!maskImage)
+            return;
+        
+        GraphicsContext* maskImageContext = maskImage->context();
+        maskImageContext->translate(-maskRect.x(), -maskRect.y());
+        
+        // Now add the text to the clip.  We do this by painting using a special paint phase that signals to
+        // InlineTextBoxes that they should just add their contents to the clip.
+        PaintInfo info(maskImageContext, maskRect, PaintPhaseTextClip, true, 0, 0);
+        if (box)
+            box->paint(info, tx - box->x(), ty - box->y());
+        else {
+            int x = isBox() ? toRenderBox(this)->x() : 0;
+            int y = isBox() ? toRenderBox(this)->y() : 0;
+            paint(info, tx - x, ty - y);
+        }
+        
+        // The mask has been created.  Now we just need to clip to it.
+        context->save();
+        context->clipToImageBuffer(maskRect, maskImage.get());
+    }
+    
+    StyleImage* bg = bgLayer->image();
+    bool shouldPaintBackgroundImage = bg && bg->canRender(style()->effectiveZoom());
+    Color bgColor = c;
+
+    // When this style flag is set, change existing background colors and images to a solid white background.
+    // If there's no bg color or image, leave it untouched to avoid affecting transparency.
+    // We don't try to avoid loading the background images, because this style flag is only set
+    // when printing, and at that point we've already loaded the background images anyway. (To avoid
+    // loading the background images we'd have to do this check when applying styles rather than
+    // while rendering.)
+    if (style()->forceBackgroundsToWhite()) {
+        // Note that we can't reuse this variable below because the bgColor might be changed
+        bool shouldPaintBackgroundColor = !bgLayer->next() && bgColor.isValid() && bgColor.alpha() > 0;
+        if (shouldPaintBackgroundImage || shouldPaintBackgroundColor) {
+            bgColor = Color::white;
+            shouldPaintBackgroundImage = false;
+        }
+    }
+
+    bool isRoot = this->isRoot();
+
+    // Only fill with a base color (e.g., white) if we're the root document, since iframes/frames with
+    // no background in the child document should show the parent's background.
+    bool isOpaqueRoot = false;
+    if (isRoot) {
+        isOpaqueRoot = true;
+        if (!bgLayer->next() && !(bgColor.isValid() && bgColor.alpha() == 255) && view()->frameView()) {
+            Element* ownerElement = document()->ownerElement();
+            if (ownerElement) {
+                if (!ownerElement->hasTagName(frameTag)) {
+                    // Locate the <body> element using the DOM.  This is easier than trying
+                    // to crawl around a render tree with potential :before/:after content and
+                    // anonymous blocks created by inline <body> tags etc.  We can locate the <body>
+                    // render object very easily via the DOM.
+                    HTMLElement* body = document()->body();
+                    if (body) {
+                        // Can't scroll a frameset document anyway.
+                        isOpaqueRoot = body->hasLocalName(framesetTag);
+                    }
+                }
+            } else
+                isOpaqueRoot = !view()->frameView()->isTransparent();
+        }
+        view()->frameView()->setContentIsOpaque(isOpaqueRoot);
+    }
+
+    // Paint the color first underneath all images.
+    if (!bgLayer->next()) {
+        IntRect rect(tx, clipY, w, clipH);
+        // If we have an alpha and we are painting the root element, go ahead and blend with the base background color.
+        if (isOpaqueRoot) {
+            Color baseColor = view()->frameView()->baseBackgroundColor();
+            if (baseColor.alpha() > 0) {
+                context->save();
+                context->setCompositeOperation(CompositeCopy);
+                context->fillRect(rect, baseColor);
+                context->restore();
+            } else
+                context->clearRect(rect);
+        }
+
+        if (bgColor.isValid() && bgColor.alpha() > 0)
+            context->fillRect(rect, bgColor);
+    }
+
+    // no progressive loading of the background image
+    if (shouldPaintBackgroundImage) {
+        IntRect destRect;
+        IntPoint phase;
+        IntSize tileSize;
+
+        calculateBackgroundImageGeometry(bgLayer, tx, ty, w, h, destRect, phase, tileSize);
+        IntPoint destOrigin = destRect.location();
+        destRect.intersect(paintInfo.rect);
+        if (!destRect.isEmpty()) {
+            phase += destRect.location() - destOrigin;
+            CompositeOperator compositeOp = op == CompositeSourceOver ? bgLayer->composite() : op;
+            RenderObject* clientForBackgroundImage = this;
+            // Check if this is the root element painting a background layer propagated from <body>,
+            // and pass the body's renderer as the client in that case.
+            if (isRoot && !style()->hasBackground()) {
+                ASSERT(node()->hasTagName(htmlTag));
+                HTMLElement* body = document()->body();
+                ASSERT(body);
+                ASSERT(body->hasLocalName(bodyTag));
+                ASSERT(body->renderer());
+                if (body) {
+                    if (RenderObject* bodyRenderer = body->renderer())
+                        clientForBackgroundImage = bodyRenderer;
+                }
+            }
+            context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), destRect, phase, tileSize, compositeOp);
+        }
+    }
+
+    if (bgLayer->clip() != BorderFillBox)
+        // Undo the background clip
+        context->restore();
+
+    if (clippedToBorderRadius)
+        // Undo the border radius clip
+        context->restore();
+}
+
+IntSize RenderBoxModelObject::calculateBackgroundSize(const FillLayer* bgLayer, int scaledWidth, int scaledHeight) const
+{
+    StyleImage* bg = bgLayer->image();
+    bg->setImageContainerSize(IntSize(scaledWidth, scaledHeight)); // Use the box established by background-origin.
+
+    if (bgLayer->isSizeSet()) {
+        int w = scaledWidth;
+        int h = scaledHeight;
+        Length bgWidth = bgLayer->size().width();
+        Length bgHeight = bgLayer->size().height();
+
+        if (bgWidth.isFixed())
+            w = bgWidth.value();
+        else if (bgWidth.isPercent())
+            w = bgWidth.calcValue(scaledWidth);
+        
+        if (bgHeight.isFixed())
+            h = bgHeight.value();
+        else if (bgHeight.isPercent())
+            h = bgHeight.calcValue(scaledHeight);
+        
+        // If one of the values is auto we have to use the appropriate
+        // scale to maintain our aspect ratio.
+        if (bgWidth.isAuto() && !bgHeight.isAuto())
+            w = bg->imageSize(this, style()->effectiveZoom()).width() * h / bg->imageSize(this, style()->effectiveZoom()).height();        
+        else if (!bgWidth.isAuto() && bgHeight.isAuto())
+            h = bg->imageSize(this, style()->effectiveZoom()).height() * w / bg->imageSize(this, style()->effectiveZoom()).width();
+        else if (bgWidth.isAuto() && bgHeight.isAuto()) {
+            // If both width and height are auto, we just want to use the image's
+            // intrinsic size.
+            w = bg->imageSize(this, style()->effectiveZoom()).width();
+            h = bg->imageSize(this, style()->effectiveZoom()).height();
+        }
+        
+        return IntSize(max(1, w), max(1, h));
+    } else
+        return bg->imageSize(this, style()->effectiveZoom());
+}
+
+void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* bgLayer, int tx, int ty, int w, int h, 
+                                                            IntRect& destRect, IntPoint& phase, IntSize& tileSize)
+{
+    int pw;
+    int ph;
+    int left = 0;
+    int right = 0;
+    int top = 0;
+    int bottom = 0;
+    int cx;
+    int cy;
+    int rw = 0;
+    int rh = 0;
+
+    // CSS2 chapter 14.2.1
+
+    if (bgLayer->attachment()) {
+        // Scroll
+        if (bgLayer->origin() != BorderFillBox) {
+            left = borderLeft();
+            right = borderRight();
+            top = borderTop();
+            bottom = borderBottom();
+            if (bgLayer->origin() == ContentFillBox) {
+                left += paddingLeft();
+                right += paddingRight();
+                top += paddingTop();
+                bottom += paddingBottom();
+            }
+        }
+        
+        // The background of the box generated by the root element covers the entire canvas including
+        // its margins.  Since those were added in already, we have to factor them out when computing the
+        // box used by background-origin/size/position.
+        if (isRoot()) {
+            rw = toRenderBox(this)->width() - left - right;
+            rh = toRenderBox(this)->height() - top - bottom; 
+            left += marginLeft();
+            right += marginRight();
+            top += marginTop();
+            bottom += marginBottom();
+        }
+        cx = tx;
+        cy = ty;
+        pw = w - left - right;
+        ph = h - top - bottom;
+    } else {
+        // Fixed
+        IntRect vr = viewRect();
+        cx = vr.x();
+        cy = vr.y();
+        pw = vr.width();
+        ph = vr.height();
+    }
+
+    int sx = 0;
+    int sy = 0;
+    int cw;
+    int ch;
+
+    IntSize scaledImageSize;
+    if (isRoot() && bgLayer->attachment())
+        scaledImageSize = calculateBackgroundSize(bgLayer, rw, rh);
+    else
+        scaledImageSize = calculateBackgroundSize(bgLayer, pw, ph);
+        
+    int scaledImageWidth = scaledImageSize.width();
+    int scaledImageHeight = scaledImageSize.height();
+
+    EFillRepeat backgroundRepeat = bgLayer->repeat();
+    
+    int xPosition;
+    if (isRoot() && bgLayer->attachment())
+        xPosition = bgLayer->xPosition().calcMinValue(rw - scaledImageWidth, true);
+    else
+        xPosition = bgLayer->xPosition().calcMinValue(pw - scaledImageWidth, true);
+    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatXFill) {
+        cw = pw + left + right;
+        sx = scaledImageWidth ? scaledImageWidth - (xPosition + left) % scaledImageWidth : 0;
+    } else {
+        cx += max(xPosition + left, 0);
+        sx = -min(xPosition + left, 0);
+        cw = scaledImageWidth + min(xPosition + left, 0);
+    }
+    
+    int yPosition;
+    if (isRoot() && bgLayer->attachment())
+        yPosition = bgLayer->yPosition().calcMinValue(rh - scaledImageHeight, true);
+    else 
+        yPosition = bgLayer->yPosition().calcMinValue(ph - scaledImageHeight, true);
+    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatYFill) {
+        ch = ph + top + bottom;
+        sy = scaledImageHeight ? scaledImageHeight - (yPosition + top) % scaledImageHeight : 0;
+    } else {
+        cy += max(yPosition + top, 0);
+        sy = -min(yPosition + top, 0);
+        ch = scaledImageHeight + min(yPosition + top, 0);
+    }
+
+    if (!bgLayer->attachment()) {
+        sx += max(tx - cx, 0);
+        sy += max(ty - cy, 0);
+    }
+
+    destRect = IntRect(cx, cy, cw, ch);
+    destRect.intersect(IntRect(tx, ty, w, h));
+    phase = IntPoint(sx, sy);
+    tileSize = IntSize(scaledImageWidth, scaledImageHeight);
+}
+
+int RenderBoxModelObject::verticalPosition(bool firstLine) const
+{
+    // This method determines the vertical position for inline elements.
+    ASSERT(isInline());
+    if (!isInline())
+        return 0;
+
+    int vpos = 0;
+    EVerticalAlign va = style()->verticalAlign();
+    if (va == TOP)
+        vpos = PositionTop;
+    else if (va == BOTTOM)
+        vpos = PositionBottom;
+    else {
+        bool checkParent = parent()->isRenderInline() && parent()->style()->verticalAlign() != TOP && parent()->style()->verticalAlign() != BOTTOM;
+        vpos = checkParent ? toRenderInline(parent())->verticalPositionFromCache(firstLine) : 0;
+        // don't allow elements nested inside text-top to have a different valignment.
+        if (va == BASELINE)
+            return vpos;
+
+        const Font& f = parent()->style(firstLine)->font();
+        int fontsize = f.pixelSize();
+
+        if (va == SUB)
+            vpos += fontsize / 5 + 1;
+        else if (va == SUPER)
+            vpos -= fontsize / 3 + 1;
+        else if (va == TEXT_TOP)
+            vpos += baselinePosition(firstLine) - f.ascent();
+        else if (va == MIDDLE)
+            vpos += -static_cast<int>(f.xHeight() / 2) - lineHeight(firstLine) / 2 + baselinePosition(firstLine);
+        else if (va == TEXT_BOTTOM) {
+            vpos += f.descent();
+            if (!isReplaced()) // lineHeight - baselinePosition is always 0 for replaced elements, so don't bother wasting time in that case.
+                vpos -= (lineHeight(firstLine) - baselinePosition(firstLine));
+        } else if (va == BASELINE_MIDDLE)
+            vpos += -lineHeight(firstLine) / 2 + baselinePosition(firstLine);
+        else if (va == LENGTH)
+            vpos -= style()->verticalAlignLength().calcValue(lineHeight(firstLine));
+    }
+
+    return vpos;
+}
+
+bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext, int tx, int ty, int w, int h, const RenderStyle* style,
+                                               const NinePieceImage& ninePieceImage, CompositeOperator op)
+{
+    StyleImage* styleImage = ninePieceImage.image();
+    if (!styleImage)
+        return false;
+
+    if (!styleImage->isLoaded())
+        return true; // Never paint a nine-piece image incrementally, but don't paint the fallback borders either.
+
+    if (!styleImage->canRender(style->effectiveZoom()))
+        return false;
+
+    // FIXME: border-image is broken with full page zooming when tiling has to happen, since the tiling function
+    // doesn't have any understanding of the zoom that is in effect on the tile.
+    styleImage->setImageContainerSize(IntSize(w, h));
+    IntSize imageSize = styleImage->imageSize(this, 1.0f);
+    int imageWidth = imageSize.width();
+    int imageHeight = imageSize.height();
+
+    int topSlice = min(imageHeight, ninePieceImage.m_slices.top().calcValue(imageHeight));
+    int bottomSlice = min(imageHeight, ninePieceImage.m_slices.bottom().calcValue(imageHeight));
+    int leftSlice = min(imageWidth, ninePieceImage.m_slices.left().calcValue(imageWidth));
+    int rightSlice = min(imageWidth, ninePieceImage.m_slices.right().calcValue(imageWidth));
+
+    ENinePieceImageRule hRule = ninePieceImage.horizontalRule();
+    ENinePieceImageRule vRule = ninePieceImage.verticalRule();
+
+    bool fitToBorder = style->borderImage() == ninePieceImage;
+    
+    int leftWidth = fitToBorder ? style->borderLeftWidth() : leftSlice;
+    int topWidth = fitToBorder ? style->borderTopWidth() : topSlice;
+    int rightWidth = fitToBorder ? style->borderRightWidth() : rightSlice;
+    int bottomWidth = fitToBorder ? style->borderBottomWidth() : bottomSlice;
+
+    bool drawLeft = leftSlice > 0 && leftWidth > 0;
+    bool drawTop = topSlice > 0 && topWidth > 0;
+    bool drawRight = rightSlice > 0 && rightWidth > 0;
+    bool drawBottom = bottomSlice > 0 && bottomWidth > 0;
+    bool drawMiddle = (imageWidth - leftSlice - rightSlice) > 0 && (w - leftWidth - rightWidth) > 0 &&
+                      (imageHeight - topSlice - bottomSlice) > 0 && (h - topWidth - bottomWidth) > 0;
+
+    Image* image = styleImage->image(this, imageSize);
+
+    if (drawLeft) {
+        // Paint the top and bottom left corners.
+
+        // The top left corner rect is (tx, ty, leftWidth, topWidth)
+        // The rect to use from within the image is obtained from our slice, and is (0, 0, leftSlice, topSlice)
+        if (drawTop)
+            graphicsContext->drawImage(image, IntRect(tx, ty, leftWidth, topWidth),
+                                       IntRect(0, 0, leftSlice, topSlice), op);
+
+        // The bottom left corner rect is (tx, ty + h - bottomWidth, leftWidth, bottomWidth)
+        // The rect to use from within the image is (0, imageHeight - bottomSlice, leftSlice, botomSlice)
+        if (drawBottom)
+            graphicsContext->drawImage(image, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
+                                       IntRect(0, imageHeight - bottomSlice, leftSlice, bottomSlice), op);
+
+        // Paint the left edge.
+        // Have to scale and tile into the border rect.
+        graphicsContext->drawTiledImage(image, IntRect(tx, ty + topWidth, leftWidth,
+                                        h - topWidth - bottomWidth),
+                                        IntRect(0, topSlice, leftSlice, imageHeight - topSlice - bottomSlice),
+                                        Image::StretchTile, (Image::TileRule)vRule, op);
+    }
+
+    if (drawRight) {
+        // Paint the top and bottom right corners
+        // The top right corner rect is (tx + w - rightWidth, ty, rightWidth, topWidth)
+        // The rect to use from within the image is obtained from our slice, and is (imageWidth - rightSlice, 0, rightSlice, topSlice)
+        if (drawTop)
+            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
+                                       IntRect(imageWidth - rightSlice, 0, rightSlice, topSlice), op);
+
+        // The bottom right corner rect is (tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth)
+        // The rect to use from within the image is (imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice)
+        if (drawBottom)
+            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
+                                       IntRect(imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice), op);
+
+        // Paint the right edge.
+        graphicsContext->drawTiledImage(image, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
+                                        h - topWidth - bottomWidth),
+                                        IntRect(imageWidth - rightSlice, topSlice, rightSlice, imageHeight - topSlice - bottomSlice),
+                                        Image::StretchTile, (Image::TileRule)vRule, op);
+    }
+
+    // Paint the top edge.
+    if (drawTop)
+        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
+                                        IntRect(leftSlice, 0, imageWidth - rightSlice - leftSlice, topSlice),
+                                        (Image::TileRule)hRule, Image::StretchTile, op);
+
+    // Paint the bottom edge.
+    if (drawBottom)
+        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + h - bottomWidth,
+                                        w - leftWidth - rightWidth, bottomWidth),
+                                        IntRect(leftSlice, imageHeight - bottomSlice, imageWidth - rightSlice - leftSlice, bottomSlice),
+                                        (Image::TileRule)hRule, Image::StretchTile, op);
+
+    // Paint the middle.
+    if (drawMiddle)
+        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
+                                        h - topWidth - bottomWidth),
+                                        IntRect(leftSlice, topSlice, imageWidth - rightSlice - leftSlice, imageHeight - topSlice - bottomSlice),
+                                        (Image::TileRule)hRule, (Image::TileRule)vRule, op);
+
+    return true;
+}
+
+void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
+                               const RenderStyle* style, bool begin, bool end)
+{
+    if (paintNinePieceImage(graphicsContext, tx, ty, w, h, style, style->borderImage()))
+        return;
+
+    const Color& topColor = style->borderTopColor();
+    const Color& bottomColor = style->borderBottomColor();
+    const Color& leftColor = style->borderLeftColor();
+    const Color& rightColor = style->borderRightColor();
+
+    bool topTransparent = style->borderTopIsTransparent();
+    bool bottomTransparent = style->borderBottomIsTransparent();
+    bool rightTransparent = style->borderRightIsTransparent();
+    bool leftTransparent = style->borderLeftIsTransparent();
+
+    EBorderStyle topStyle = style->borderTopStyle();
+    EBorderStyle bottomStyle = style->borderBottomStyle();
+    EBorderStyle leftStyle = style->borderLeftStyle();
+    EBorderStyle rightStyle = style->borderRightStyle();
+
+    bool renderTop = topStyle > BHIDDEN && !topTransparent;
+    bool renderLeft = leftStyle > BHIDDEN && begin && !leftTransparent;
+    bool renderRight = rightStyle > BHIDDEN && end && !rightTransparent;
+    bool renderBottom = bottomStyle > BHIDDEN && !bottomTransparent;
+
+    bool renderRadii = false;
+    IntSize topLeft, topRight, bottomLeft, bottomRight;
+
+    if (style->hasBorderRadius()) {
+        IntRect borderRect = IntRect(tx, ty, w, h);
+
+        IntSize topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius;
+        style->getBorderRadiiForRect(borderRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+        if (begin) {
+            topLeft = topLeftRadius;
+            bottomLeft = bottomLeftRadius;
+        }
+        if (end) {
+            topRight = topRightRadius;
+            bottomRight = bottomRightRadius;
+        }
+
+        renderRadii = true;
+
+        // Clip to the rounded rectangle.
+        graphicsContext->save();
+        graphicsContext->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+    }
+
+    int firstAngleStart, secondAngleStart, firstAngleSpan, secondAngleSpan;
+    float thickness;
+    bool upperLeftBorderStylesMatch = renderLeft && (topStyle == leftStyle) && (topColor == leftColor);
+    bool upperRightBorderStylesMatch = renderRight && (topStyle == rightStyle) && (topColor == rightColor) && (topStyle != OUTSET) && (topStyle != RIDGE) && (topStyle != INSET) && (topStyle != GROOVE);
+    bool lowerLeftBorderStylesMatch = renderLeft && (bottomStyle == leftStyle) && (bottomColor == leftColor) && (bottomStyle != OUTSET) && (bottomStyle != RIDGE) && (bottomStyle != INSET) && (bottomStyle != GROOVE);
+    bool lowerRightBorderStylesMatch = renderRight && (bottomStyle == rightStyle) && (bottomColor == rightColor);
+
+    if (renderTop) {
+        bool ignore_left = (renderRadii && topLeft.width() > 0) ||
+            (topColor == leftColor && topTransparent == leftTransparent && topStyle >= OUTSET &&
+             (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
+
+        bool ignore_right = (renderRadii && topRight.width() > 0) ||
+            (topColor == rightColor && topTransparent == rightTransparent && topStyle >= OUTSET &&
+             (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
+
+        int x = tx;
+        int x2 = tx + w;
+        if (renderRadii) {
+            x += topLeft.width();
+            x2 -= topRight.width();
+        }
+
+        drawLineForBoxSide(graphicsContext, x, ty, x2, ty + style->borderTopWidth(), BSTop, topColor, style->color(), topStyle,
+                   ignore_left ? 0 : style->borderLeftWidth(), ignore_right ? 0 : style->borderRightWidth());
+
+        if (renderRadii) {
+            int leftY = ty;
+
+            // We make the arc double thick and let the clip rect take care of clipping the extra off.
+            // We're doing this because it doesn't seem possible to match the curve of the clip exactly
+            // with the arc-drawing function.
+            thickness = style->borderTopWidth() * 2;
+
+            if (topLeft.width()) {
+                int leftX = tx;
+                // The inner clip clips inside the arc. This is especially important for 1px borders.
+                bool applyLeftInnerClip = (style->borderLeftWidth() < topLeft.width())
+                    && (style->borderTopWidth() < topLeft.height())
+                    && (topStyle != DOUBLE || style->borderTopWidth() > 6);
+                if (applyLeftInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(leftX, leftY, topLeft.width() * 2, topLeft.height() * 2),
+                                                             style->borderTopWidth());
+                }
+
+                firstAngleStart = 90;
+                firstAngleSpan = upperLeftBorderStylesMatch ? 90 : 45;
+
+                // Draw upper left arc
+                drawArcForBoxSide(graphicsContext, leftX, leftY, thickness, topLeft, firstAngleStart, firstAngleSpan,
+                              BSTop, topColor, style->color(), topStyle, true);
+                if (applyLeftInnerClip)
+                    graphicsContext->restore();
+            }
+
+            if (topRight.width()) {
+                int rightX = tx + w - topRight.width() * 2;
+                bool applyRightInnerClip = (style->borderRightWidth() < topRight.width())
+                    && (style->borderTopWidth() < topRight.height())
+                    && (topStyle != DOUBLE || style->borderTopWidth() > 6);
+                if (applyRightInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(rightX, leftY, topRight.width() * 2, topRight.height() * 2),
+                                                             style->borderTopWidth());
+                }
+
+                if (upperRightBorderStylesMatch) {
+                    secondAngleStart = 0;
+                    secondAngleSpan = 90;
+                } else {
+                    secondAngleStart = 45;
+                    secondAngleSpan = 45;
+                }
+
+                // Draw upper right arc
+                drawArcForBoxSide(graphicsContext, rightX, leftY, thickness, topRight, secondAngleStart, secondAngleSpan,
+                              BSTop, topColor, style->color(), topStyle, false);
+                if (applyRightInnerClip)
+                    graphicsContext->restore();
+            }
+        }
+    }
+
+    if (renderBottom) {
+        bool ignore_left = (renderRadii && bottomLeft.width() > 0) ||
+            (bottomColor == leftColor && bottomTransparent == leftTransparent && bottomStyle >= OUTSET &&
+             (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
+
+        bool ignore_right = (renderRadii && bottomRight.width() > 0) ||
+            (bottomColor == rightColor && bottomTransparent == rightTransparent && bottomStyle >= OUTSET &&
+             (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
+
+        int x = tx;
+        int x2 = tx + w;
+        if (renderRadii) {
+            x += bottomLeft.width();
+            x2 -= bottomRight.width();
+        }
+
+        drawLineForBoxSide(graphicsContext, x, ty + h - style->borderBottomWidth(), x2, ty + h, BSBottom, bottomColor, style->color(), bottomStyle,
+                   ignore_left ? 0 : style->borderLeftWidth(), ignore_right ? 0 : style->borderRightWidth());
+
+        if (renderRadii) {
+            thickness = style->borderBottomWidth() * 2;
+
+            if (bottomLeft.width()) {
+                int leftX = tx;
+                int leftY = ty + h - bottomLeft.height() * 2;
+                bool applyLeftInnerClip = (style->borderLeftWidth() < bottomLeft.width())
+                    && (style->borderBottomWidth() < bottomLeft.height())
+                    && (bottomStyle != DOUBLE || style->borderBottomWidth() > 6);
+                if (applyLeftInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(leftX, leftY, bottomLeft.width() * 2, bottomLeft.height() * 2),
+                                                             style->borderBottomWidth());
+                }
+
+                if (lowerLeftBorderStylesMatch) {
+                    firstAngleStart = 180;
+                    firstAngleSpan = 90;
+                } else {
+                    firstAngleStart = 225;
+                    firstAngleSpan = 45;
+                }
+
+                // Draw lower left arc
+                drawArcForBoxSide(graphicsContext, leftX, leftY, thickness, bottomLeft, firstAngleStart, firstAngleSpan,
+                              BSBottom, bottomColor, style->color(), bottomStyle, true);
+                if (applyLeftInnerClip)
+                    graphicsContext->restore();
+            }
+
+            if (bottomRight.width()) {
+                int rightY = ty + h - bottomRight.height() * 2;
+                int rightX = tx + w - bottomRight.width() * 2;
+                bool applyRightInnerClip = (style->borderRightWidth() < bottomRight.width())
+                    && (style->borderBottomWidth() < bottomRight.height())
+                    && (bottomStyle != DOUBLE || style->borderBottomWidth() > 6);
+                if (applyRightInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(rightX, rightY, bottomRight.width() * 2, bottomRight.height() * 2),
+                                                             style->borderBottomWidth());
+                }
+
+                secondAngleStart = 270;
+                secondAngleSpan = lowerRightBorderStylesMatch ? 90 : 45;
+
+                // Draw lower right arc
+                drawArcForBoxSide(graphicsContext, rightX, rightY, thickness, bottomRight, secondAngleStart, secondAngleSpan,
+                              BSBottom, bottomColor, style->color(), bottomStyle, false);
+                if (applyRightInnerClip)
+                    graphicsContext->restore();
+            }
+        }
+    }
+
+    if (renderLeft) {
+        bool ignore_top = (renderRadii && topLeft.height() > 0) ||
+            (topColor == leftColor && topTransparent == leftTransparent && leftStyle >= OUTSET &&
+             (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
+
+        bool ignore_bottom = (renderRadii && bottomLeft.height() > 0) ||
+            (bottomColor == leftColor && bottomTransparent == leftTransparent && leftStyle >= OUTSET &&
+             (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
+
+        int y = ty;
+        int y2 = ty + h;
+        if (renderRadii) {
+            y += topLeft.height();
+            y2 -= bottomLeft.height();
+        }
+
+        drawLineForBoxSide(graphicsContext, tx, y, tx + style->borderLeftWidth(), y2, BSLeft, leftColor, style->color(), leftStyle,
+                   ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
+
+        if (renderRadii && (!upperLeftBorderStylesMatch || !lowerLeftBorderStylesMatch)) {
+            int topX = tx;
+            thickness = style->borderLeftWidth() * 2;
+
+            if (!upperLeftBorderStylesMatch && topLeft.width()) {
+                int topY = ty;
+                bool applyTopInnerClip = (style->borderLeftWidth() < topLeft.width())
+                    && (style->borderTopWidth() < topLeft.height())
+                    && (leftStyle != DOUBLE || style->borderLeftWidth() > 6);
+                if (applyTopInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(topX, topY, topLeft.width() * 2, topLeft.height() * 2),
+                                                             style->borderLeftWidth());
+                }
+
+                firstAngleStart = 135;
+                firstAngleSpan = 45;
+
+                // Draw top left arc
+                drawArcForBoxSide(graphicsContext, topX, topY, thickness, topLeft, firstAngleStart, firstAngleSpan,
+                              BSLeft, leftColor, style->color(), leftStyle, true);
+                if (applyTopInnerClip)
+                    graphicsContext->restore();
+            }
+
+            if (!lowerLeftBorderStylesMatch && bottomLeft.width()) {
+                int bottomY = ty + h - bottomLeft.height() * 2;
+                bool applyBottomInnerClip = (style->borderLeftWidth() < bottomLeft.width())
+                    && (style->borderBottomWidth() < bottomLeft.height())
+                    && (leftStyle != DOUBLE || style->borderLeftWidth() > 6);
+                if (applyBottomInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(topX, bottomY, bottomLeft.width() * 2, bottomLeft.height() * 2),
+                                                             style->borderLeftWidth());
+                }
+
+                secondAngleStart = 180;
+                secondAngleSpan = 45;
+
+                // Draw bottom left arc
+                drawArcForBoxSide(graphicsContext, topX, bottomY, thickness, bottomLeft, secondAngleStart, secondAngleSpan,
+                              BSLeft, leftColor, style->color(), leftStyle, false);
+                if (applyBottomInnerClip)
+                    graphicsContext->restore();
+            }
+        }
+    }
+
+    if (renderRight) {
+        bool ignore_top = (renderRadii && topRight.height() > 0) ||
+            ((topColor == rightColor) && (topTransparent == rightTransparent) &&
+            (rightStyle >= DOTTED || rightStyle == INSET) &&
+            (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
+
+        bool ignore_bottom = (renderRadii && bottomRight.height() > 0) ||
+            ((bottomColor == rightColor) && (bottomTransparent == rightTransparent) &&
+            (rightStyle >= DOTTED || rightStyle == INSET) &&
+            (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
+
+        int y = ty;
+        int y2 = ty + h;
+        if (renderRadii) {
+            y += topRight.height();
+            y2 -= bottomRight.height();
+        }
+
+        drawLineForBoxSide(graphicsContext, tx + w - style->borderRightWidth(), y, tx + w, y2, BSRight, rightColor, style->color(), rightStyle,
+                   ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
+
+        if (renderRadii && (!upperRightBorderStylesMatch || !lowerRightBorderStylesMatch)) {
+            thickness = style->borderRightWidth() * 2;
+
+            if (!upperRightBorderStylesMatch && topRight.width()) {
+                int topX = tx + w - topRight.width() * 2;
+                int topY = ty;
+                bool applyTopInnerClip = (style->borderRightWidth() < topRight.width())
+                    && (style->borderTopWidth() < topRight.height())
+                    && (rightStyle != DOUBLE || style->borderRightWidth() > 6);
+                if (applyTopInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(topX, topY, topRight.width() * 2, topRight.height() * 2),
+                                                             style->borderRightWidth());
+                }
+
+                firstAngleStart = 0;
+                firstAngleSpan = 45;
+
+                // Draw top right arc
+                drawArcForBoxSide(graphicsContext, topX, topY, thickness, topRight, firstAngleStart, firstAngleSpan,
+                              BSRight, rightColor, style->color(), rightStyle, true);
+                if (applyTopInnerClip)
+                    graphicsContext->restore();
+            }
+
+            if (!lowerRightBorderStylesMatch && bottomRight.width()) {
+                int bottomX = tx + w - bottomRight.width() * 2;
+                int bottomY = ty + h - bottomRight.height() * 2;
+                bool applyBottomInnerClip = (style->borderRightWidth() < bottomRight.width())
+                    && (style->borderBottomWidth() < bottomRight.height())
+                    && (rightStyle != DOUBLE || style->borderRightWidth() > 6);
+                if (applyBottomInnerClip) {
+                    graphicsContext->save();
+                    graphicsContext->addInnerRoundedRectClip(IntRect(bottomX, bottomY, bottomRight.width() * 2, bottomRight.height() * 2),
+                                                             style->borderRightWidth());
+                }
+
+                secondAngleStart = 315;
+                secondAngleSpan = 45;
+
+                // Draw bottom right arc
+                drawArcForBoxSide(graphicsContext, bottomX, bottomY, thickness, bottomRight, secondAngleStart, secondAngleSpan,
+                              BSRight, rightColor, style->color(), rightStyle, false);
+                if (applyBottomInnerClip)
+                    graphicsContext->restore();
+            }
+        }
+    }
+
+    if (renderRadii)
+        graphicsContext->restore();
+}
+
+void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int ty, int w, int h, const RenderStyle* s, bool begin, bool end)
+{
+    // FIXME: Deal with border-image.  Would be great to use border-image as a mask.
+
+    IntRect rect(tx, ty, w, h);
+    bool hasBorderRadius = s->hasBorderRadius();
+    bool hasOpaqueBackground = s->backgroundColor().isValid() && s->backgroundColor().alpha() == 255;
+    for (ShadowData* shadow = s->boxShadow(); shadow; shadow = shadow->next) {
+        context->save();
+
+        IntSize shadowOffset(shadow->x, shadow->y);
+        int shadowBlur = shadow->blur;
+        IntRect fillRect(rect);
+
+        if (hasBorderRadius) {
+            IntRect shadowRect(rect);
+            shadowRect.inflate(shadowBlur);
+            shadowRect.move(shadowOffset);
+            context->clip(shadowRect);
+
+            // Move the fill just outside the clip, adding 1 pixel separation so that the fill does not
+            // bleed in (due to antialiasing) if the context is transformed.
+            IntSize extraOffset(w + max(0, shadowOffset.width()) + shadowBlur + 1, 0);
+            shadowOffset -= extraOffset;
+            fillRect.move(extraOffset);
+        }
+
+        context->setShadow(shadowOffset, shadowBlur, shadow->color);
+        if (hasBorderRadius) {
+            IntSize topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius;
+            s->getBorderRadiiForRect(rect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+            IntSize topLeft = begin ? topLeftRadius : IntSize();
+            IntSize topRight = end ? topRightRadius : IntSize();
+            IntSize bottomLeft = begin ? bottomLeftRadius : IntSize();
+            IntSize bottomRight = end ? bottomRightRadius : IntSize();
+
+            if (!hasOpaqueBackground)
+                context->clipOutRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
+            context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black);
+        } else {
+            if (!hasOpaqueBackground)
+                context->clipOut(rect);
+            context->fillRect(fillRect, Color::black);
+        }
+        context->restore();
+    }
+}
+
+int RenderBoxModelObject::containingBlockWidthForContent() const
+{
+    return containingBlock()->availableWidth();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
new file mode 100644
index 0000000000..f2c6326123
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2003, 2006, 2007, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderBoxModelObject_h
+#define RenderBoxModelObject_h
+
+#include "RenderObject.h"
+
+namespace WebCore {
+
+// Values for vertical alignment.
+const int PositionTop = -0x7fffffff;
+const int PositionBottom = 0x7fffffff;
+const int PositionUndefined = 0x80000000;
+
+// This class is the base for all objects that adhere to the CSS box model as described
+// at http://www.w3.org/TR/CSS21/box.html
+
+class RenderBoxModelObject : public RenderObject {
+public:
+    RenderBoxModelObject(Node*);
+    virtual ~RenderBoxModelObject();
+    
+    virtual void destroy();
+
+    int relativePositionOffsetX() const;
+    int relativePositionOffsetY() const;
+    IntSize relativePositionOffset() const { return IntSize(relativePositionOffsetX(), relativePositionOffsetY()); }
+
+    // IE extensions. Used to calculate offsetWidth/Height.  Overridden by inlines (RenderFlow)
+    // to return the remaining width on a given line (and the height of a single line).
+    virtual int offsetLeft() const;
+    virtual int offsetTop() const;
+    virtual int offsetWidth() const = 0;
+    virtual int offsetHeight() const = 0;
+
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+    virtual void updateBoxModelInfoFromStyle();
+
+    bool hasSelfPaintingLayer() const;
+    RenderLayer* layer() const { return m_layer; }
+    virtual bool requiresLayer() const { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection(); }
+
+    // This will work on inlines to return the bounding box of all of the lines' border boxes.
+    virtual IntRect borderBoundingBox() const = 0;
+
+    // Virtual since table cells override
+    virtual int paddingTop(bool includeIntrinsicPadding = true) const;
+    virtual int paddingBottom(bool includeIntrinsicPadding = true) const;
+    virtual int paddingLeft(bool includeIntrinsicPadding = true) const;
+    virtual int paddingRight(bool includeIntrinsicPadding = true) const;
+
+    virtual int borderTop() const { return style()->borderTopWidth(); }
+    virtual int borderBottom() const { return style()->borderBottomWidth(); }
+    virtual int borderLeft() const { return style()->borderLeftWidth(); }
+    virtual int borderRight() const { return style()->borderRightWidth(); }
+
+    virtual int marginTop() const = 0;
+    virtual int marginBottom() const = 0;
+    virtual int marginLeft() const = 0;
+    virtual int marginRight() const = 0;
+
+    bool hasHorizontalBordersPaddingOrMargin() const { return hasHorizontalBordersOrPadding() || marginLeft() != 0 || marginRight() != 0; }
+    bool hasHorizontalBordersOrPadding() const { return borderLeft() != 0 || borderRight() != 0 || paddingLeft() != 0 || paddingRight() != 0; }
+
+    virtual int containingBlockWidthForContent() const;
+
+    virtual void childBecameNonInline(RenderObject* /*child*/) { }
+
+    void paintBorder(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
+    bool paintNinePieceImage(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, const NinePieceImage&, CompositeOperator = CompositeSourceOver);
+    void paintBoxShadow(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
+    virtual void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight,
+                                        int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
+
+    // The difference between this inline's baseline position and the line's baseline position.
+    int verticalPosition(bool firstLine) const;
+
+    // Called by RenderObject::destroy() (and RenderWidget::destroy()) and is the only way layers should ever be destroyed
+    void destroyLayer();
+
+protected:
+    void calculateBackgroundImageGeometry(const FillLayer*, int tx, int ty, int w, int h, IntRect& destRect, IntPoint& phase, IntSize& tileSize);
+    IntSize calculateBackgroundSize(const FillLayer*, int scaledWidth, int scaledHeight) const;
+
+private:
+    virtual bool isBoxModelObject() const { return true; }
+    friend class RenderView;
+
+    RenderLayer* m_layer;
+    
+    // Used to store state between styleWillChange and styleDidChange
+    static bool s_wasFloating;
+    static bool s_hadLayer;
+    static bool s_layerWasSelfPainting;
+};
+
+inline RenderBoxModelObject* toRenderBoxModelObject(RenderObject* o)
+{ 
+    ASSERT(!o || o->isBoxModelObject());
+    return static_cast<RenderBoxModelObject*>(o);
+}
+
+inline const RenderBoxModelObject* toRenderBoxModelObject(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isBoxModelObject());
+    return static_cast<const RenderBoxModelObject*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderBoxModelObject(const RenderBoxModelObject*);
+
+} // namespace WebCore
+
+#endif // RenderBoxModelObject_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
index 10e21c3023..b266f42e5e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
@@ -69,7 +69,7 @@ void RenderButton::removeChild(RenderObject* oldChild)
         m_inner->removeChild(oldChild);
 }
 
-void RenderButton::styleWillChange(RenderStyle::Diff diff, const RenderStyle* newStyle)
+void RenderButton::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     if (m_inner) {
         // RenderBlock::setStyle is going to apply a new style to the inner block, which
@@ -81,7 +81,7 @@ void RenderButton::styleWillChange(RenderStyle::Diff diff, const RenderStyle* ne
     RenderBlock::styleWillChange(diff, newStyle);
 }
 
-void RenderButton::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderButton::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
@@ -108,23 +108,26 @@ void RenderButton::setupInnerStyle(RenderStyle* innerStyle)
     // RenderBlock::createAnonymousBlock creates a new RenderStyle, so this is
     // safe to modify.
     innerStyle->setBoxFlex(1.0f);
-    if (style()->hasAppearance())
-        theme()->adjustButtonInnerStyle(innerStyle);
+
+    innerStyle->setPaddingTop(Length(theme()->buttonInternalPaddingTop(), Fixed));
+    innerStyle->setPaddingRight(Length(theme()->buttonInternalPaddingRight(), Fixed));
+    innerStyle->setPaddingBottom(Length(theme()->buttonInternalPaddingBottom(), Fixed));
+    innerStyle->setPaddingLeft(Length(theme()->buttonInternalPaddingLeft(), Fixed));
 }
 
 void RenderButton::updateFromElement()
 {
     // If we're an input element, we may need to change our button text.
-    if (element()->hasTagName(inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(element());
+    if (node()->hasTagName(inputTag)) {
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
         String value = input->valueWithDefault();
         setText(value);
     }
 
 
 #if ENABLE(WML)
-    else if (element()->hasTagName(WMLNames::doTag)) {
-        WMLDoElement* doElement = static_cast<WMLDoElement*>(element());
+    else if (node()->hasTagName(WMLNames::doTag)) {
+        WMLDoElement* doElement = static_cast<WMLDoElement*>(node());
 
         String value = doElement->label();
         if (value.isEmpty())
@@ -140,7 +143,7 @@ bool RenderButton::canHaveChildren() const
     // Input elements can't have children, but button elements can.  We'll
     // write the code assuming any other button types that might emerge in the future
     // can also have children.
-    return !element()->hasTagName(inputTag);
+    return !node()->hasTagName(inputTag);
 }
 
 void RenderButton::setText(const String& str)
@@ -161,22 +164,29 @@ void RenderButton::setText(const String& str)
     }
 }
 
-void RenderButton::updateBeforeAfterContent(RenderStyle::PseudoId type)
+void RenderButton::updateBeforeAfterContent(PseudoId type)
 {
     if (m_inner)
-        m_inner->updateBeforeAfterContentForContainer(type, this);
+        m_inner->children()->updateBeforeAfterContent(m_inner, type, this);
     else
-        updateBeforeAfterContentForContainer(type, this);
+        children()->updateBeforeAfterContent(this, type);
 }
 
 IntRect RenderButton::controlClipRect(int tx, int ty) const
 {
     // Clip to the padding box to at least give content the extra padding space.
-    return IntRect(tx + borderLeft(), ty + borderTop(), m_width - borderLeft() - borderRight(), m_height - borderTop() - borderBottom());
+    return IntRect(tx + borderLeft(), ty + borderTop(), width() - borderLeft() - borderRight(), height() - borderTop() - borderBottom());
 }
 
 void RenderButton::timerFired(Timer<RenderButton>*)
 {
+    // FIXME Bug 25110: Ideally we would stop our timer when our Document
+    // enters the page cache. But we currently have no way of being notified
+    // when that happens, so we'll just ignore the timer firing as long as
+    // we're in the cache.
+    if (document()->inPageCache())
+        return;
+
     repaint();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
index 24e4767731..89f7cf86bc 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
@@ -39,6 +39,7 @@ public:
     RenderButton(Node*);
 
     virtual const char* renderName() const { return "RenderButton"; }
+    virtual bool isRenderButton() const { return true; }
 
     virtual void addChild(RenderObject* newChild, RenderObject *beforeChild = 0);
     virtual void removeChild(RenderObject*);
@@ -48,7 +49,7 @@ public:
     void setupInnerStyle(RenderStyle*);
     virtual void updateFromElement();
 
-    virtual void updateBeforeAfterContent(RenderStyle::PseudoId);
+    virtual void updateBeforeAfterContent(PseudoId);
 
     virtual bool hasControlClip() const { return true; }
     virtual IntRect controlClipRect(int /*tx*/, int /*ty*/) const;
@@ -58,8 +59,8 @@ public:
     virtual bool canHaveChildren() const;
 
 protected:
-    virtual void styleWillChange(RenderStyle::Diff, const RenderStyle* newStyle);
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual bool hasLineIfEmpty() const { return true; }
 
@@ -72,6 +73,21 @@ protected:
     bool m_default;
 };
 
+inline RenderButton* toRenderButton(RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderButton());
+    return static_cast<RenderButton*>(o);
+}
+
+inline const RenderButton* toRenderButton(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderButton());
+    return static_cast<const RenderButton*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderButton(const RenderButton*);
+
 } // namespace WebCore
 
 #endif // RenderButton_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderContainer.cpp
deleted file mode 100644
index 9f6d737119..0000000000
--- a/src/3rdparty/webkit/WebCore/rendering/RenderContainer.cpp
+++ /dev/null
@@ -1,701 +0,0 @@
-/**
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2000 Dirk Mueller (mueller@kde.org)
- *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
- * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "RenderContainer.h"
-
-#include "AXObjectCache.h"
-#include "Document.h"
-#include "RenderCounter.h"
-#include "RenderImageGeneratedContent.h"
-#include "RenderLayer.h"
-#include "RenderListItem.h"
-#include "RenderTable.h"
-#include "RenderTextFragment.h"
-#include "RenderView.h"
-#include "htmlediting.h"
-
-namespace WebCore {
-
-RenderContainer::RenderContainer(Node* node)
-    : RenderBox(node)
-    , m_firstChild(0)
-    , m_lastChild(0)
-{
-}
-
-RenderContainer::~RenderContainer()
-{
-}
-
-void RenderContainer::destroy()
-{
-    destroyLeftoverChildren();
-    RenderBox::destroy();
-}
-
-void RenderContainer::destroyLeftoverChildren()
-{
-    while (m_firstChild) {
-        if (m_firstChild->isListMarker() || (m_firstChild->style()->styleType() == RenderStyle::FIRST_LETTER && !m_firstChild->isText()))
-            m_firstChild->remove();  // List markers are owned by their enclosing list and so don't get destroyed by this container. Similarly, first letters are destroyed by their remaining text fragment.
-        else {
-        // Destroy any anonymous children remaining in the render tree, as well as implicit (shadow) DOM elements like those used in the engine-based text fields.
-            if (m_firstChild->element())
-                m_firstChild->element()->setRenderer(0);
-            m_firstChild->destroy();
-        }
-    }
-}
-
-bool RenderContainer::canHaveChildren() const
-{
-    return true;
-}
-
-static void updateListMarkerNumbers(RenderObject* child)
-{
-    for (RenderObject* r = child; r; r = r->nextSibling())
-        if (r->isListItem())
-            static_cast<RenderListItem*>(r)->updateValue();
-}
-
-void RenderContainer::addChild(RenderObject* newChild, RenderObject* beforeChild)
-{
-    bool needsTable = false;
-
-    if (newChild->isListItem())
-        updateListMarkerNumbers(beforeChild ? beforeChild : m_lastChild);
-    else if (newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP)
-        needsTable = !isTable();
-    else if (newChild->isRenderBlock() && newChild->style()->display() == TABLE_CAPTION)
-        needsTable = !isTable();
-    else if (newChild->isTableSection())
-        needsTable = !isTable();
-    else if (newChild->isTableRow())
-        needsTable = !isTableSection();
-    else if (newChild->isTableCell()) {
-        needsTable = !isTableRow();
-        // I'm not 100% sure this is the best way to fix this, but without this
-        // change we recurse infinitely when trying to render the CSS2 test page:
-        // http://www.bath.ac.uk/%7Epy8ieh/internet/eviltests/htmlbodyheadrendering2.html.
-        // See Radar 2925291.
-        if (needsTable && isTableCell() && !m_firstChild && !newChild->isTableCell())
-            needsTable = false;
-    }
-
-    if (needsTable) {
-        RenderTable* table;
-        RenderObject* afterChild = beforeChild ? beforeChild->previousSibling() : m_lastChild;
-        if (afterChild && afterChild->isAnonymous() && afterChild->isTable())
-            table = static_cast<RenderTable*>(afterChild);
-        else {
-            table = new (renderArena()) RenderTable(document() /* is anonymous */);
-            RefPtr<RenderStyle> newStyle = RenderStyle::create();
-            newStyle->inheritFrom(style());
-            newStyle->setDisplay(TABLE);
-            table->setStyle(newStyle.release());
-            addChild(table, beforeChild);
-        }
-        table->addChild(newChild);
-    } else {
-        // just add it...
-        insertChildNode(newChild, beforeChild);
-    }
-    
-    if (newChild->isText() && newChild->style()->textTransform() == CAPITALIZE) {
-        RefPtr<StringImpl> textToTransform = static_cast<RenderText*>(newChild)->originalText();
-        if (textToTransform)
-            static_cast<RenderText*>(newChild)->setText(textToTransform.release(), true);
-    }
-}
-
-RenderObject* RenderContainer::removeChildNode(RenderObject* oldChild, bool fullRemove)
-{
-    ASSERT(oldChild->parent() == this);
-
-    // So that we'll get the appropriate dirty bit set (either that a normal flow child got yanked or
-    // that a positioned child got yanked).  We also repaint, so that the area exposed when the child
-    // disappears gets repainted properly.
-    if (!documentBeingDestroyed() && fullRemove && oldChild->m_everHadLayout) {
-        oldChild->setNeedsLayoutAndPrefWidthsRecalc();
-        oldChild->repaint();
-    }
-        
-    // If we have a line box wrapper, delete it.
-    oldChild->deleteLineBoxWrapper();
-
-    if (!documentBeingDestroyed() && fullRemove) {
-        // if we remove visible child from an invisible parent, we don't know the layer visibility any more
-        RenderLayer* layer = 0;
-        if (m_style->visibility() != VISIBLE && oldChild->style()->visibility() == VISIBLE && !oldChild->hasLayer()) {
-            layer = enclosingLayer();
-            layer->dirtyVisibleContentStatus();
-        }
-
-         // Keep our layer hierarchy updated.
-        if (oldChild->firstChild() || oldChild->hasLayer()) {
-            if (!layer) layer = enclosingLayer();            
-            oldChild->removeLayers(layer);
-        }
-        
-        // renumber ordered lists
-        if (oldChild->isListItem())
-            updateListMarkerNumbers(oldChild->nextSibling());
-        
-        if (oldChild->isPositioned() && childrenInline())
-            dirtyLinesFromChangedChild(oldChild);
-    }
-    
-    // If oldChild is the start or end of the selection, then clear the selection to
-    // avoid problems of invalid pointers.
-    // FIXME: The SelectionController should be responsible for this when it
-    // is notified of DOM mutations.
-    if (!documentBeingDestroyed() && oldChild->isSelectionBorder())
-        view()->clearSelection();
-
-    // remove the child
-    if (oldChild->previousSibling())
-        oldChild->previousSibling()->setNextSibling(oldChild->nextSibling());
-    if (oldChild->nextSibling())
-        oldChild->nextSibling()->setPreviousSibling(oldChild->previousSibling());
-
-    if (m_firstChild == oldChild)
-        m_firstChild = oldChild->nextSibling();
-    if (m_lastChild == oldChild)
-        m_lastChild = oldChild->previousSibling();
-
-    oldChild->setPreviousSibling(0);
-    oldChild->setNextSibling(0);
-    oldChild->setParent(0);
-
-    if (AXObjectCache::accessibilityEnabled())
-        document()->axObjectCache()->childrenChanged(this);
-
-    return oldChild;
-}
-
-void RenderContainer::removeChild(RenderObject* oldChild)
-{
-    // We do this here instead of in removeChildNode, since the only extremely low-level uses of remove/appendChildNode
-    // cannot affect the positioned object list, and the floating object list is irrelevant (since the list gets cleared on
-    // layout anyway).
-    oldChild->removeFromObjectLists();
-    
-    removeChildNode(oldChild);
-}
-
-RenderObject* RenderContainer::beforeAfterContainer(RenderStyle::PseudoId type)
-{
-    if (type == RenderStyle::BEFORE) {
-        RenderObject* first = this;
-        do {
-            // Skip list markers.
-            first = first->firstChild();
-            while (first && first->isListMarker())
-                first = first->nextSibling();
-        } while (first && first->isAnonymous() && first->style()->styleType() == RenderStyle::NOPSEUDO);
-        if (first && first->style()->styleType() != type)
-            return 0;
-        return first;
-    }
-    if (type == RenderStyle::AFTER) {
-        RenderObject* last = this;
-        do {
-            last = last->lastChild();
-        } while (last && last->isAnonymous() && last->style()->styleType() == RenderStyle::NOPSEUDO && !last->isListMarker());
-        if (last && last->style()->styleType() != type)
-            return 0;
-        return last;
-    }
-
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-void RenderContainer::updateBeforeAfterContent(RenderStyle::PseudoId type)
-{
-    // If this is an anonymous wrapper, then the parent applies its own pseudo-element style to it.
-    if (parent() && parent()->createsAnonymousWrapper())
-        return;
-    updateBeforeAfterContentForContainer(type, this);
-}
-
-static RenderObject* findBeforeAfterParent(RenderObject* object)
-{
-    // Only table parts need to search for the :before or :after parent
-    if (!(object->isTable() || object->isTableSection() || object->isTableRow()))
-        return object;
-
-    RenderObject* beforeAfterParent = object;
-    while (beforeAfterParent && !(beforeAfterParent->isText() || beforeAfterParent->isImage()))
-        beforeAfterParent = beforeAfterParent->firstChild();
-    return beforeAfterParent;
-}
-
-void RenderContainer::updateBeforeAfterContentForContainer(RenderStyle::PseudoId type, RenderContainer* styledObject)
-{
-    // In CSS2, before/after pseudo-content cannot nest.  Check this first.
-    if (style()->styleType() == RenderStyle::BEFORE || style()->styleType() == RenderStyle::AFTER)
-        return;
-    
-    RenderStyle* pseudoElementStyle = styledObject->getCachedPseudoStyle(type);
-    RenderObject* child = beforeAfterContainer(type);
-
-    // Whether or not we currently have generated content attached.
-    bool oldContentPresent = child;
-
-    // Whether or not we now want generated content.  
-    bool newContentWanted = pseudoElementStyle && pseudoElementStyle->display() != NONE;
-
-    // For <q><p/></q>, if this object is the inline continuation of the <q>, we only want to generate
-    // :after content and not :before content.
-    if (newContentWanted && type == RenderStyle::BEFORE && isInlineContinuation())
-        newContentWanted = false;
-
-    // Similarly, if we're the beginning of a <q>, and there's an inline continuation for our object,
-    // then we don't generate the :after content.
-    if (newContentWanted && type == RenderStyle::AFTER && isRenderInline() && continuation())
-        newContentWanted = false;
-    
-    // If we don't want generated content any longer, or if we have generated content, but it's no longer
-    // identical to the new content data we want to build render objects for, then we nuke all
-    // of the old generated content.
-    if (!newContentWanted || (oldContentPresent && Node::diff(child->style(), pseudoElementStyle) == Node::Detach)) {
-        // Nuke the child. 
-        if (child && child->style()->styleType() == type) {
-            oldContentPresent = false;
-            child->destroy();
-            child = (type == RenderStyle::BEFORE) ? m_firstChild : m_lastChild;
-        }
-    }
-
-    // If we have no pseudo-element style or if the pseudo-element style's display type is NONE, then we
-    // have no generated content and can now return.
-    if (!newContentWanted)
-        return;
-
-    if (isInlineFlow() && !pseudoElementStyle->isDisplayInlineType() && pseudoElementStyle->floating() == FNONE &&
-        !(pseudoElementStyle->position() == AbsolutePosition || pseudoElementStyle->position() == FixedPosition))
-        // According to the CSS2 spec (the end of section 12.1), the only allowed
-        // display values for the pseudo style are NONE and INLINE for inline flows.
-        // FIXME: CSS2.1 lifted this restriction, but block display types will crash.
-        // For now we at least relax the restriction to allow all inline types like inline-block
-        // and inline-table.
-        pseudoElementStyle->setDisplay(INLINE);
-
-    if (oldContentPresent) {
-        if (child && child->style()->styleType() == type) {
-            // We have generated content present still.  We want to walk this content and update our
-            // style information with the new pseudo-element style.
-            child->setStyle(pseudoElementStyle);
-
-            RenderObject* beforeAfterParent = findBeforeAfterParent(child);
-            if (!beforeAfterParent)
-                return;
-
-            // Note that if we ever support additional types of generated content (which should be way off
-            // in the future), this code will need to be patched.
-            for (RenderObject* genChild = beforeAfterParent->firstChild(); genChild; genChild = genChild->nextSibling()) {
-                if (genChild->isText())
-                    // Generated text content is a child whose style also needs to be set to the pseudo-element style.
-                    genChild->setStyle(pseudoElementStyle);
-                else if (genChild->isImage()) {
-                    // Images get an empty style that inherits from the pseudo.
-                    RefPtr<RenderStyle> style = RenderStyle::create();
-                    style->inheritFrom(pseudoElementStyle);
-                    genChild->setStyle(style.release());
-                } else
-                    // Must be a first-letter container. updateFirstLetter() will take care of it.
-                    ASSERT(genChild->style()->styleType() == RenderStyle::FIRST_LETTER);
-            }
-        }
-        return; // We've updated the generated content. That's all we needed to do.
-    }
-    
-    RenderObject* insertBefore = (type == RenderStyle::BEFORE) ? firstChild() : 0;
-
-    // Generated content consists of a single container that houses multiple children (specified
-    // by the content property).  This generated content container gets the pseudo-element style set on it.
-    RenderObject* generatedContentContainer = 0;
-    
-    // Walk our list of generated content and create render objects for each.
-    for (const ContentData* content = pseudoElementStyle->contentData(); content; content = content->m_next) {
-        RenderObject* renderer = 0;
-        switch (content->m_type) {
-            case CONTENT_NONE:
-                break;
-            case CONTENT_TEXT:
-                renderer = new (renderArena()) RenderTextFragment(document() /* anonymous object */, content->m_content.m_text);
-                renderer->setStyle(pseudoElementStyle);
-                break;
-            case CONTENT_OBJECT: {
-                RenderImageGeneratedContent* image = new (renderArena()) RenderImageGeneratedContent(document()); // anonymous object
-                RefPtr<RenderStyle> style = RenderStyle::create();
-                style->inheritFrom(pseudoElementStyle);
-                image->setStyle(style.release());
-                if (StyleImage* styleImage = content->m_content.m_image)
-                    image->setStyleImage(styleImage);
-                renderer = image;
-                break;
-            }
-            case CONTENT_COUNTER:
-                renderer = new (renderArena()) RenderCounter(document(), *content->m_content.m_counter);
-                renderer->setStyle(pseudoElementStyle);
-                break;
-        }
-
-        if (renderer) {
-            if (!generatedContentContainer) {
-                // Make a generated box that might be any display type now that we are able to drill down into children
-                // to find the original content properly.
-                generatedContentContainer = RenderObject::createObject(document(), pseudoElementStyle);
-                generatedContentContainer->setStyle(pseudoElementStyle);
-                addChild(generatedContentContainer, insertBefore);
-            }
-            generatedContentContainer->addChild(renderer);
-        }
-    }
-}
-
-bool RenderContainer::isAfterContent(RenderObject* child) const
-{
-    if (!child)
-        return false;
-    if (child->style()->styleType() != RenderStyle::AFTER)
-        return false;
-    // Text nodes don't have their own styles, so ignore the style on a text node.
-    if (child->isText() && !child->isBR())
-        return false;
-    return true;
-}
-
-static void invalidateCountersInContainer(RenderObject* container)
-{
-    if (!container)
-        return;
-    container = findBeforeAfterParent(container);
-    if (!container)
-        return;
-    for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
-        if (content->isCounter())
-            static_cast<RenderCounter*>(content)->invalidate();
-    }
-}
-
-void RenderContainer::invalidateCounters()
-{
-    if (documentBeingDestroyed())
-        return;
-
-    invalidateCountersInContainer(beforeAfterContainer(RenderStyle::BEFORE));
-    invalidateCountersInContainer(beforeAfterContainer(RenderStyle::AFTER));
-}
-
-void RenderContainer::appendChildNode(RenderObject* newChild, bool fullAppend)
-{
-    ASSERT(newChild->parent() == 0);
-    ASSERT(!isBlockFlow() || (!newChild->isTableSection() && !newChild->isTableRow() && !newChild->isTableCell()));
-
-    newChild->setParent(this);
-    RenderObject* lChild = m_lastChild;
-
-    if (lChild) {
-        newChild->setPreviousSibling(lChild);
-        lChild->setNextSibling(newChild);
-    } else
-        m_firstChild = newChild;
-
-    m_lastChild = newChild;
-    
-    if (fullAppend) {
-        // Keep our layer hierarchy updated.  Optimize for the common case where we don't have any children
-        // and don't have a layer attached to ourselves.
-        RenderLayer* layer = 0;
-        if (newChild->firstChild() || newChild->hasLayer()) {
-            layer = enclosingLayer();
-            newChild->addLayers(layer, newChild);
-        }
-
-        // if the new child is visible but this object was not, tell the layer it has some visible content
-        // that needs to be drawn and layer visibility optimization can't be used
-        if (style()->visibility() != VISIBLE && newChild->style()->visibility() == VISIBLE && !newChild->hasLayer()) {
-            if (!layer)
-                layer = enclosingLayer();
-            if (layer)
-                layer->setHasVisibleContent(true);
-        }
-        
-        if (!newChild->isFloatingOrPositioned() && childrenInline())
-            dirtyLinesFromChangedChild(newChild);
-    }
-
-    newChild->setNeedsLayoutAndPrefWidthsRecalc(); // Goes up the containing block hierarchy.
-    if (!normalChildNeedsLayout())
-        setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
-    
-    if (AXObjectCache::accessibilityEnabled())
-        document()->axObjectCache()->childrenChanged(this);
-}
-
-void RenderContainer::insertChildNode(RenderObject* child, RenderObject* beforeChild, bool fullInsert)
-{
-    if (!beforeChild) {
-        appendChildNode(child);
-        return;
-    }
-
-    ASSERT(!child->parent());
-    while (beforeChild->parent() != this && beforeChild->parent()->isAnonymousBlock())
-        beforeChild = beforeChild->parent();
-    ASSERT(beforeChild->parent() == this);
-
-    ASSERT(!isBlockFlow() || (!child->isTableSection() && !child->isTableRow() && !child->isTableCell()));
-
-    if (beforeChild == m_firstChild)
-        m_firstChild = child;
-
-    RenderObject* prev = beforeChild->previousSibling();
-    child->setNextSibling(beforeChild);
-    beforeChild->setPreviousSibling(child);
-    if(prev) prev->setNextSibling(child);
-    child->setPreviousSibling(prev);
-
-    child->setParent(this);
-    
-    if (fullInsert) {
-        // Keep our layer hierarchy updated.  Optimize for the common case where we don't have any children
-        // and don't have a layer attached to ourselves.
-        RenderLayer* layer = 0;
-        if (child->firstChild() || child->hasLayer()) {
-            layer = enclosingLayer();
-            child->addLayers(layer, child);
-        }
-
-        // if the new child is visible but this object was not, tell the layer it has some visible content
-        // that needs to be drawn and layer visibility optimization can't be used
-        if (style()->visibility() != VISIBLE && child->style()->visibility() == VISIBLE && !child->hasLayer()) {
-            if (!layer)
-                layer = enclosingLayer();
-            if (layer)
-                layer->setHasVisibleContent(true);
-        }
-
-        
-        if (!child->isFloating() && childrenInline())
-            dirtyLinesFromChangedChild(child);
-    }
-
-    child->setNeedsLayoutAndPrefWidthsRecalc();
-    if (!normalChildNeedsLayout())
-        setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
-    
-    if (AXObjectCache::accessibilityEnabled())
-        document()->axObjectCache()->childrenChanged(this);
-}
-
-void RenderContainer::layout()
-{
-    ASSERT(needsLayout());
-
-    LayoutStateMaintainer statePusher(view(), this, IntSize(m_x, m_y));
-
-    RenderObject* child = m_firstChild;
-    while (child) {
-        child->layoutIfNeeded();
-        ASSERT(child->isRenderInline() || !child->needsLayout());
-        child = child->nextSibling();
-    }
-
-    statePusher.pop();
-    setNeedsLayout(false);
-}
-
-void RenderContainer::removeLeftoverAnonymousBlock(RenderBlock* child)
-{
-    ASSERT(child->isAnonymousBlock());
-    ASSERT(!child->childrenInline());
-    
-    if (child->continuation()) 
-        return;
-    
-    RenderObject* firstAnChild = child->firstChild();
-    RenderObject* lastAnChild = child->lastChild();
-    if (firstAnChild) {
-        RenderObject* o = firstAnChild;
-        while(o) {
-            o->setParent(this);
-            o = o->nextSibling();
-        }
-        firstAnChild->setPreviousSibling(child->previousSibling());
-        lastAnChild->setNextSibling(child->nextSibling());
-        if (child->previousSibling())
-            child->previousSibling()->setNextSibling(firstAnChild);
-        if (child->nextSibling())
-            child->nextSibling()->setPreviousSibling(lastAnChild);
-    } else {
-        if (child->previousSibling())
-            child->previousSibling()->setNextSibling(child->nextSibling());
-        if (child->nextSibling())
-            child->nextSibling()->setPreviousSibling(child->previousSibling());
-    }
-    if (child == m_firstChild)
-        m_firstChild = firstAnChild;
-    if (child == m_lastChild)
-        m_lastChild = lastAnChild;
-    child->setParent(0);
-    child->setPreviousSibling(0);
-    child->setNextSibling(0);
-    if (!child->isText()) {
-        RenderContainer *c = static_cast<RenderContainer*>(child);
-        c->m_firstChild = 0;
-        c->m_next = 0;
-    }
-    child->destroy();
-}
-
-VisiblePosition RenderContainer::positionForCoordinates(int x, int y)
-{
-    // no children...return this render object's element, if there is one, and offset 0
-    if (!m_firstChild)
-        return VisiblePosition(element(), 0, DOWNSTREAM);
-        
-    if (isTable() && element()) {
-        int right = contentWidth() + borderRight() + paddingRight() + borderLeft() + paddingLeft();
-        int bottom = contentHeight() + borderTop() + paddingTop() + borderBottom() + paddingBottom();
-        
-        if (x < 0 || x > right || y < 0 || y > bottom) {
-            if (x <= right / 2)
-                return VisiblePosition(Position(element(), 0));
-            else
-                return VisiblePosition(Position(element(), maxDeepOffset(element())));
-        }
-    }
-
-    // Pass off to the closest child.
-    int minDist = INT_MAX;
-    RenderObject* closestRenderer = 0;
-    int newX = x;
-    int newY = y;
-    if (isTableRow()) {
-        newX += xPos();
-        newY += yPos();
-    }
-    for (RenderObject* renderer = m_firstChild; renderer; renderer = renderer->nextSibling()) {
-        if (!renderer->firstChild() && !renderer->isInline() && !renderer->isBlockFlow() 
-            || renderer->style()->visibility() != VISIBLE)
-            continue;
-        
-        int top = borderTop() + paddingTop() + (isTableRow() ? 0 : renderer->yPos());
-        int bottom = top + renderer->contentHeight();
-        int left = borderLeft() + paddingLeft() + (isTableRow() ? 0 : renderer->xPos());
-        int right = left + renderer->contentWidth();
-        
-        if (x <= right && x >= left && y <= top && y >= bottom) {
-            if (renderer->isTableRow())
-                return renderer->positionForCoordinates(x + newX - renderer->xPos(), y + newY - renderer->yPos());
-            return renderer->positionForCoordinates(x - renderer->xPos(), y - renderer->yPos());
-        }
-
-        // Find the distance from (x, y) to the box.  Split the space around the box into 8 pieces
-        // and use a different compare depending on which piece (x, y) is in.
-        IntPoint cmp;
-        if (x > right) {
-            if (y < top)
-                cmp = IntPoint(right, top);
-            else if (y > bottom)
-                cmp = IntPoint(right, bottom);
-            else
-                cmp = IntPoint(right, y);
-        } else if (x < left) {
-            if (y < top)
-                cmp = IntPoint(left, top);
-            else if (y > bottom)
-                cmp = IntPoint(left, bottom);
-            else
-                cmp = IntPoint(left, y);
-        } else {
-            if (y < top)
-                cmp = IntPoint(x, top);
-            else
-                cmp = IntPoint(x, bottom);
-        }
-        
-        int x1minusx2 = cmp.x() - x;
-        int y1minusy2 = cmp.y() - y;
-        
-        int dist = x1minusx2 * x1minusx2 + y1minusy2 * y1minusy2;
-        if (dist < minDist) {
-            closestRenderer = renderer;
-            minDist = dist;
-        }
-    }
-    
-    if (closestRenderer)
-        return closestRenderer->positionForCoordinates(newX - closestRenderer->xPos(), newY - closestRenderer->yPos());
-    
-    return VisiblePosition(element(), 0, DOWNSTREAM);
-}
-
-void RenderContainer::addLineBoxRects(Vector<IntRect>& rects, unsigned start, unsigned end, bool)
-{
-    if (!m_firstChild && (isInline() || isAnonymousBlock())) {
-        FloatPoint absPos = localToAbsoluteForContent(FloatPoint());
-        absoluteRects(rects, absPos.x(), absPos.y());
-        return;
-    }
-
-    if (!m_firstChild)
-        return;
-
-    unsigned offset = start;
-    for (RenderObject* child = childAt(start); child && offset < end; child = child->nextSibling(), ++offset) {
-        if (child->isText() || child->isInline() || child->isAnonymousBlock()) {
-            FloatPoint absPos = child->localToAbsoluteForContent(FloatPoint());
-            child->absoluteRects(rects, absPos.x(), absPos.y());
-        }
-    }
-}
-
-void RenderContainer::collectAbsoluteLineBoxQuads(Vector<FloatQuad>& quads, unsigned start, unsigned end, bool /*useSelectionHeight*/)
-{
-    if (!m_firstChild && (isInline() || isAnonymousBlock())) {
-        absoluteQuads(quads);
-        return;
-    }
-
-    if (!m_firstChild)
-        return;
-
-    unsigned offset = start;
-    for (RenderObject* child = childAt(start); child && offset < end; child = child->nextSibling(), ++offset) {
-        if (child->isText() || child->isInline() || child->isAnonymousBlock())
-            child->absoluteQuads(quads);
-    }
-}
-
-#undef DEBUG_LAYOUT
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderContainer.h
deleted file mode 100644
index 68aba84f00..0000000000
--- a/src/3rdparty/webkit/WebCore/rendering/RenderContainer.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright (C) 2001 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef RenderContainer_h
-#define RenderContainer_h
-
-#include "RenderBox.h"
-
-namespace WebCore {
-
-// Base class for rendering objects that can have children.
-class RenderContainer : public RenderBox {
-public:
-    RenderContainer(Node*);
-    virtual ~RenderContainer();
-
-    virtual RenderObject* firstChild() const { return m_firstChild; }
-    virtual RenderObject* lastChild() const { return m_lastChild; }
-
-    virtual bool canHaveChildren() const;
-    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
-    virtual void removeChild(RenderObject*);
-
-    virtual void destroy();
-    void destroyLeftoverChildren();
-
-    virtual RenderObject* removeChildNode(RenderObject*, bool fullRemove = true);
-    virtual void appendChildNode(RenderObject*, bool fullAppend = true);
-    virtual void insertChildNode(RenderObject* child, RenderObject* before, bool fullInsert = true);
-    
-    // Designed for speed.  Don't waste time doing a bunch of work like layer updating and repainting when we know that our
-    // change in parentage is not going to affect anything.
-    virtual void moveChildNode(RenderObject* child) { appendChildNode(child->parent()->removeChildNode(child, false), false); }
-    
-    virtual void layout();
-    virtual void calcPrefWidths() { setPrefWidthsDirty(false); }
-
-    virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
-
-    RenderObject* beforeAfterContainer(RenderStyle::PseudoId);
-    virtual void updateBeforeAfterContent(RenderStyle::PseudoId);
-    void updateBeforeAfterContentForContainer(RenderStyle::PseudoId, RenderContainer*);
-    bool isAfterContent(RenderObject* child) const;
-    virtual void invalidateCounters();
-
-    virtual VisiblePosition positionForCoordinates(int x, int y);
-
-    virtual void addLineBoxRects(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
-    virtual void collectAbsoluteLineBoxQuads(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
-
-private:
-    RenderObject* m_firstChild;
-    RenderObject* m_lastChild;
-};
-
-} // namespace WebCore
-
-#endif // RenderContainer_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
index 598f40d747..fd6d80dbc5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
@@ -116,7 +116,7 @@ static bool planCounter(RenderObject* object, const AtomicString& counterName, b
             isReset = false;
             return true;
         }
-        if (Node* e = object->element()) {
+        if (Node* e = object->node()) {
             if (e->hasTagName(olTag)) {
                 value = static_cast<HTMLOListElement*>(e)->start();
                 isReset = true;
@@ -251,13 +251,6 @@ PassRefPtr<StringImpl> RenderCounter::originalText() const
     return text.impl();
 }
 
-void RenderCounter::dirtyLineBoxes(bool fullLayout, bool dummy)
-{
-    if (prefWidthsDirty())
-        calcPrefWidths(0);
-    RenderText::dirtyLineBoxes(fullLayout, dummy);
-}
-
 void RenderCounter::calcPrefWidths(int lead)
 {
     setTextInternal(originalText());
@@ -278,7 +271,11 @@ static void destroyCounterNodeChildren(AtomicStringImpl* identifier, CounterNode
         child->parent()->removeChild(child);
         ASSERT(counterMaps().get(child->renderer())->get(identifier) == child);
         counterMaps().get(child->renderer())->remove(identifier);
-        child->renderer()->invalidateCounters();
+        if (!child->renderer()->documentBeingDestroyed()) {
+            RenderObjectChildList* children = child->renderer()->virtualChildren();
+            if (children)
+                children->invalidateCounters(child->renderer());
+        }
         delete child;
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
index 10be06613f..55aab73007 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
@@ -37,7 +37,6 @@ public:
     virtual bool isCounter() const;
     virtual PassRefPtr<StringImpl> originalText() const;
     
-    virtual void dirtyLineBoxes(bool, bool);
     virtual void calcPrefWidths(int leadWidth);
 
     void invalidate();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
index 0e944f4617..310dbe44e6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
@@ -48,7 +48,7 @@ RenderFieldset::RenderFieldset(Node* element)
 void RenderFieldset::calcPrefWidths()
 {
     RenderBlock::calcPrefWidths();
-    if (RenderObject* legend = findLegend()) {
+    if (RenderBox* legend = findLegend()) {
         int legendMinWidth = legend->minPrefWidth();
 
         Length legendMarginLeft = legend->style()->marginLeft();
@@ -66,7 +66,7 @@ void RenderFieldset::calcPrefWidths()
 
 RenderObject* RenderFieldset::layoutLegend(bool relayoutChildren)
 {
-    RenderObject* legend = findLegend();
+    RenderBox* legend = findLegend();
     if (legend) {
         if (relayoutChildren)
             legend->setNeedsLayout(true);
@@ -79,18 +79,18 @@ RenderObject* RenderFieldset::layoutLegend(bool relayoutChildren)
                     xPos = borderLeft() + paddingLeft();
                     break;
                 case CENTER:
-                    xPos = (m_width - legend->width()) / 2;
+                    xPos = (width() - legend->width()) / 2;
                     break;
                 default:
-                    xPos = m_width - paddingRight() - borderRight() - legend->width() - legend->marginRight();
+                    xPos = width() - paddingRight() - borderRight() - legend->width() - legend->marginRight();
             }
         } else {
             switch (legend->style()->textAlign()) {
                 case RIGHT:
-                    xPos = m_width - paddingRight() - borderRight() - legend->width();
+                    xPos = width() - paddingRight() - borderRight() - legend->width();
                     break;
                 case CENTER:
-                    xPos = (m_width - legend->width()) / 2;
+                    xPos = (width() - legend->width()) / 2;
                     break;
                 default:
                     xPos = borderLeft() + paddingLeft() + legend->marginLeft();
@@ -98,22 +98,22 @@ RenderObject* RenderFieldset::layoutLegend(bool relayoutChildren)
         }
         int b = borderTop();
         int h = legend->height();
-        legend->setPos(xPos, max((b-h)/2, 0));
-        m_height = max(b,h) + paddingTop();
+        legend->setLocation(xPos, max((b-h)/2, 0));
+        setHeight(max(b,h) + paddingTop());
     }
     return legend;
 }
 
-RenderObject* RenderFieldset::findLegend() const
+RenderBox* RenderFieldset::findLegend() const
 {
     for (RenderObject* legend = firstChild(); legend; legend = legend->nextSibling()) {
-        if (!legend->isFloatingOrPositioned() && legend->element() &&
-            legend->element()->hasTagName(legendTag)
+        if (!legend->isFloatingOrPositioned() && legend->node() &&
+            legend->node()->hasTagName(legendTag)
 #if ENABLE(WML)
-            || legend->element()->hasTagName(WMLNames::insertedLegendTag)
+            || legend->node()->hasTagName(WMLNames::insertedLegendTag)
 #endif
            )
-            return legend;
+            return toRenderBox(legend);
     }
     return 0;
 }
@@ -121,15 +121,15 @@ RenderObject* RenderFieldset::findLegend() const
 void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
     int w = width();
-    int h = height() + borderTopExtra() + borderBottomExtra();
-    RenderObject* legend = findLegend();
+    int h = height();
+    RenderBox* legend = findLegend();
     if (!legend)
         return RenderBlock::paintBoxDecorations(paintInfo, tx, ty);
 
-    int yOff = (legend->yPos() > 0) ? 0 : (legend->height() - borderTop()) / 2;
-    int legendBottom = ty + legend->yPos() + legend->height();
+    int yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
+    int legendBottom = ty + legend->y() + legend->height();
     h -= yOff;
-    ty += yOff - borderTopExtra();
+    ty += yOff;
 
     int my = max(ty, paintInfo.rect.y());
     int end = min(paintInfo.rect.bottom(), ty + h);
@@ -144,7 +144,7 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
     // Save time by not saving and restoring the GraphicsContext in the straight border case
     if (!style()->hasBorderRadius())
-        return paintBorderMinusLegend(paintInfo.context, tx, ty, w, h, style(), legend->xPos(), legend->width(), legendBottom);
+        return paintBorderMinusLegend(paintInfo.context, tx, ty, w, h, style(), legend->x(), legend->width(), legendBottom);
     
     // We have rounded borders, create a clipping region 
     // around the legend and paint the border as normal
@@ -154,7 +154,7 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     int clipTop = ty;
     int clipHeight = max(static_cast<int>(style()->borderTopWidth()), legend->height());
 
-    graphicsContext->clipOut(IntRect(tx + legend->xPos(), clipTop,
+    graphicsContext->clipOut(IntRect(tx + legend->x(), clipTop,
                                        legend->width(), clipHeight));
     paintBorder(paintInfo.context, tx, ty, w, h, style(), true, true);
 
@@ -167,14 +167,14 @@ void RenderFieldset::paintMask(PaintInfo& paintInfo, int tx, int ty)
         return;
 
     int w = width();
-    int h = height() + borderTopExtra() + borderBottomExtra();
-    RenderObject* legend = findLegend();
+    int h = height();
+    RenderBox* legend = findLegend();
     if (!legend)
         return RenderBlock::paintMask(paintInfo, tx, ty);
 
-    int yOff = (legend->yPos() > 0) ? 0 : (legend->height() - borderTop()) / 2;
+    int yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
     h -= yOff;
-    ty += yOff - borderTopExtra();
+    ty += yOff;
 
     int my = max(ty, paintInfo.rect.y());
     int end = min(paintInfo.rect.bottom(), ty + h);
@@ -204,17 +204,17 @@ void RenderFieldset::paintBorderMinusLegend(GraphicsContext* graphicsContext, in
 
     if (render_t) {
         if (lx >= borderLeftWidth)
-            drawBorder(graphicsContext, tx, ty, tx + min(lx, w), ty + style->borderTopWidth(), BSTop, tc, style->color(), ts,
+            drawLineForBoxSide(graphicsContext, tx, ty, tx + min(lx, w), ty + style->borderTopWidth(), BSTop, tc, style->color(), ts,
                        (render_l && (ls == DOTTED || ls == DASHED || ls == DOUBLE) ? borderLeftWidth : 0),
                        (lx >= w && render_r && (rs == DOTTED || rs == DASHED || rs == DOUBLE) ? borderRightWidth : 0));
         if (lx + lw <=  w - borderRightWidth)
-            drawBorder(graphicsContext, tx + max(0, lx + lw), ty, tx + w, ty + style->borderTopWidth(), BSTop, tc, style->color(), ts,
+            drawLineForBoxSide(graphicsContext, tx + max(0, lx + lw), ty, tx + w, ty + style->borderTopWidth(), BSTop, tc, style->color(), ts,
                        (lx + lw <= 0 && render_l && (ls == DOTTED || ls == DASHED || ls == DOUBLE) ? borderLeftWidth : 0),
                        (render_r && (rs == DOTTED || rs == DASHED || rs == DOUBLE) ? borderRightWidth : 0));
     }
 
     if (render_b)
-        drawBorder(graphicsContext, tx, ty + h - style->borderBottomWidth(), tx + w, ty + h, BSBottom, bc, style->color(), bs,
+        drawLineForBoxSide(graphicsContext, tx, ty + h - style->borderBottomWidth(), tx + w, ty + h, BSBottom, bc, style->color(), bs,
                    (render_l && (ls == DOTTED || ls == DASHED || ls == DOUBLE) ? style->borderLeftWidth() : 0),
                    (render_r && (rs == DOTTED || rs == DASHED || rs == DOUBLE) ? style->borderRightWidth() : 0));
 
@@ -238,7 +238,7 @@ void RenderFieldset::paintBorderMinusLegend(GraphicsContext* graphicsContext, in
             startY = lb;
         }
 
-        drawBorder(graphicsContext, tx, startY, tx + borderLeftWidth, ty + h, BSLeft, lc, style->color(), ls,
+        drawLineForBoxSide(graphicsContext, tx, startY, tx + borderLeftWidth, ty + h, BSLeft, lc, style->color(), ls,
                    ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
     }
 
@@ -262,12 +262,12 @@ void RenderFieldset::paintBorderMinusLegend(GraphicsContext* graphicsContext, in
             startY = lb;
         }
 
-        drawBorder(graphicsContext, tx + w - borderRightWidth, startY, tx + w, ty + h, BSRight, rc, style->color(), rs,
+        drawLineForBoxSide(graphicsContext, tx + w - borderRightWidth, startY, tx + w, ty + h, BSRight, rc, style->color(), rs,
                    ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
     }
 }
 
-void RenderFieldset::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderFieldset::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h
index 47d1a913ea..ed57d3a508 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h
@@ -41,13 +41,12 @@ public:
 
     virtual void calcPrefWidths();
     virtual bool avoidsFloats() const { return true; }
-    virtual bool expandsToEncloseOverhangingFloats() const { return style()->height().isAuto(); }
     virtual bool stretchesToMinIntrinsicWidth() const { return true; }
 
-    RenderObject* findLegend() const;
+    RenderBox* findLegend() const;
 
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp
index 6a4bb54cab..72623f73e4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.cpp
@@ -22,6 +22,7 @@
 #include "RenderFileUploadControl.h"
 
 #include "FileList.h"
+#include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLInputElement.h"
@@ -73,7 +74,7 @@ RenderFileUploadControl::~RenderFileUploadControl()
     m_fileChooser->disconnectClient();
 }
 
-void RenderFileUploadControl::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderFileUploadControl::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
     if (m_button)
@@ -84,12 +85,12 @@ void RenderFileUploadControl::styleDidChange(RenderStyle::Diff diff, const Rende
 
 void RenderFileUploadControl::valueChanged()
 {
-    // onChange may destroy this renderer
+    // dispatchFormControlChangeEvent may destroy this renderer
     RefPtr<FileChooser> fileChooser = m_fileChooser;
 
     HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(node());
     inputElement->setFileListFromRenderer(fileChooser->filenames());
-    inputElement->onChange();
+    inputElement->dispatchFormControlChangeEvent();
  
     // only repaint if it doesn't seem we have been destroyed
     if (!fileChooser->disconnected())
@@ -147,13 +148,13 @@ void RenderFileUploadControl::updateFromElement()
 
 int RenderFileUploadControl::maxFilenameWidth() const
 {
-    return max(0, contentWidth() - m_button->renderer()->width() - afterButtonSpacing
+    return max(0, contentWidth() - m_button->renderBox()->width() - afterButtonSpacing
         - (m_fileChooser->icon() ? iconWidth + iconFilenameSpacing : 0));
 }
 
 PassRefPtr<RenderStyle> RenderFileUploadControl::createButtonStyle(const RenderStyle* parentStyle) const
 {
-    RefPtr<RenderStyle> style = getCachedPseudoStyle(RenderStyle::FILE_UPLOAD_BUTTON);
+    RefPtr<RenderStyle> style = getCachedPseudoStyle(FILE_UPLOAD_BUTTON);
     if (!style) {
         style = RenderStyle::create();
         if (parentStyle)
@@ -190,7 +191,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
         
         // Determine where the filename should be placed
         int contentLeft = tx + borderLeft() + paddingLeft();
-        int buttonAndIconWidth = m_button->renderer()->width() + afterButtonSpacing
+        int buttonAndIconWidth = m_button->renderBox()->width() + afterButtonSpacing
             + (m_fileChooser->icon() ? iconWidth + iconFilenameSpacing : 0);
         int textX;
         if (style()->direction() == LTR)
@@ -198,25 +199,24 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
         else
             textX = contentLeft + contentWidth() - buttonAndIconWidth - style()->font().width(textRun);
         // We want to match the button's baseline
-        RenderButton* buttonRenderer = static_cast<RenderButton*>(m_button->renderer());
+        RenderButton* buttonRenderer = toRenderButton(m_button->renderer());
         int textY = buttonRenderer->absoluteBoundingBoxRect().y()
             + buttonRenderer->marginTop() + buttonRenderer->borderTop() + buttonRenderer->paddingTop()
             + buttonRenderer->baselinePosition(true, false);
 
-        paintInfo.context->setFont(style()->font());
         paintInfo.context->setFillColor(style()->color());
         
         // Draw the filename
-        paintInfo.context->drawBidiText(textRun, IntPoint(textX, textY));
+        paintInfo.context->drawBidiText(style()->font(), textRun, IntPoint(textX, textY));
         
         if (m_fileChooser->icon()) {
             // Determine where the icon should be placed
             int iconY = ty + borderTop() + paddingTop() + (contentHeight() - iconHeight) / 2;
             int iconX;
             if (style()->direction() == LTR)
-                iconX = contentLeft + m_button->renderer()->width() + afterButtonSpacing;
+                iconX = contentLeft + m_button->renderBox()->width() + afterButtonSpacing;
             else
-                iconX = contentLeft + contentWidth() - m_button->renderer()->width() - afterButtonSpacing - iconWidth;
+                iconX = contentLeft + contentWidth() - m_button->renderBox()->width() - afterButtonSpacing - iconWidth;
 
             // Draw the file icon
             m_fileChooser->icon()->paint(paintInfo.context, IntRect(iconX, iconY, iconWidth, iconHeight));
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
index 60e7a7b1c8..85bc09f1c1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
@@ -55,7 +55,7 @@ public:
     bool allowsMultipleFiles();
 
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
     int maxFilenameWidth() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
index 08bc567972..1dcef36f15 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
@@ -45,11 +45,11 @@ public:
         lastOrdinal = 1; 
         if (!forward) {
             // No choice, since we're going backwards, we have to find out the highest ordinal up front.
-            RenderObject* child = box->firstChild();
+            RenderBox* child = box->firstChildBox();
             while (child) {
                 if (child->style()->boxOrdinalGroup() > lastOrdinal)
                     lastOrdinal = child->style()->boxOrdinalGroup();
-                child = child->nextSibling();
+                child = child->nextSiblingBox();
             }
         }
         
@@ -61,29 +61,28 @@ public:
         currentOrdinal = forward ? 0 : lastOrdinal+1;
     }
 
-    RenderObject* first() {
+    RenderBox* first() {
         reset();
         return next();
     }
     
-    RenderObject* next() {
-
+    RenderBox* next() {
         do { 
             if (!current) {
                 if (forward) {
                     currentOrdinal++; 
                     if (currentOrdinal > lastOrdinal)
                         return 0;
-                    current = box->firstChild();
+                    current = box->firstChildBox();
                 } else {
                     currentOrdinal--;
                     if (currentOrdinal == 0)
                         return 0;
-                    current = box->lastChild();
+                    current = box->lastChildBox();
                 }
             }
             else
-                current = forward ? current->nextSibling() : current->previousSibling();
+                current = forward ? current->nextSiblingBox() : current->previousSiblingBox();
             if (current && current->style()->boxOrdinalGroup() > lastOrdinal)
                 lastOrdinal = current->style()->boxOrdinalGroup();
         } while (!current || current->style()->boxOrdinalGroup() != currentOrdinal ||
@@ -93,7 +92,7 @@ public:
 
 private:
     RenderFlexibleBox* box;
-    RenderObject* current;
+    RenderBox* current;
     bool forward;
     unsigned int currentOrdinal;
     unsigned int lastOrdinal;
@@ -112,13 +111,10 @@ RenderFlexibleBox::~RenderFlexibleBox()
 
 void RenderFlexibleBox::calcHorizontalPrefWidths()
 {
-    RenderObject *child = firstChild();
-    while (child) {
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
         // positioned children don't affect the minmaxwidth
-        if (child->isPositioned() || child->style()->visibility() == COLLAPSE) {
-            child = child->nextSibling();
+        if (child->isPositioned() || child->style()->visibility() == COLLAPSE)
             continue;
-        }
 
         // A margin basically has three types: fixed, percentage, and auto (variable).
         // Auto and percentage margins simply become 0 when computing min/max width.
@@ -134,21 +130,15 @@ void RenderFlexibleBox::calcHorizontalPrefWidths()
 
         m_minPrefWidth += child->minPrefWidth() + margin;
         m_maxPrefWidth += child->maxPrefWidth() + margin;
-
-        child = child->nextSibling();
     }    
 }
 
 void RenderFlexibleBox::calcVerticalPrefWidths()
 {
-    RenderObject *child = firstChild();
-    while(child != 0)
-    {
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
         // Positioned children and collapsed children don't affect the min/max width
-        if (child->isPositioned() || child->style()->visibility() == COLLAPSE) {
-            child = child->nextSibling();
+        if (child->isPositioned() || child->style()->visibility() == COLLAPSE)
             continue;
-        }
 
         // A margin basically has three types: fixed, percentage, and auto (variable).
         // Auto/percentage margins simply become 0 when computing min/max width.
@@ -166,8 +156,6 @@ void RenderFlexibleBox::calcVerticalPrefWidths()
         
         w = child->maxPrefWidth() + margin;
         m_maxPrefWidth = max(w, m_maxPrefWidth);
-
-        child = child->nextSibling();
     }    
 }
 
@@ -212,29 +200,22 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     if (!relayoutChildren && layoutOnlyPositionedObjects())
         return;
 
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout();
-    if (checkForRepaint) {
-        oldBounds = absoluteClippedOverflowRect();
-        oldOutlineBox = absoluteOutlineBounds();
-    }
-
-    LayoutStateMaintainer statePusher(view(), this, IntSize(m_x, m_y), !hasReflection());
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasTransform() || hasReflection());
 
-    int previousWidth = m_width;
-    int previousHeight = m_height;
+    int previousWidth = width();
+    int previousHeight = height();
     
     calcWidth();
     calcHeight();
-    m_overflowWidth = m_width;
+    m_overflowWidth = width();
 
-    if (previousWidth != m_width || previousHeight != m_height ||
+    if (previousWidth != width() || previousHeight != height() ||
         (parent()->isFlexibleBox() && parent()->style()->boxOrient() == HORIZONTAL &&
          parent()->style()->boxAlign() == BSTRETCH))
         relayoutChildren = true;
 
-    m_height = 0;
+    setHeight(0);
     m_overflowHeight = 0;
     m_flexingChildren = m_stretchingChildren = false;
 
@@ -243,9 +224,9 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     // For overflow:scroll blocks, ensure we have both scrollbars in place always.
     if (scrollsOverflow()) {
         if (style()->overflowX() == OSCROLL)
-            m_layer->setHasHorizontalScrollbar(true);
+            layer()->setHasHorizontalScrollbar(true);
         if (style()->overflowY() == OSCROLL)
-            m_layer->setHasVerticalScrollbar(true);
+            layer()->setHasVerticalScrollbar(true);
     }
 
     if (isHorizontal())
@@ -253,21 +234,21 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     else
         layoutVerticalBox(relayoutChildren);
 
-    int oldHeight = m_height;
+    int oldHeight = height();
     calcHeight();
-    if (oldHeight != m_height) {
+    if (oldHeight != height()) {
         // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > m_height)
+        if (m_overflowHeight > height())
             m_overflowHeight -= (borderBottom() + paddingBottom() + horizontalScrollbarHeight());
-        if (m_overflowHeight < m_height)
-            m_overflowHeight = m_height;
+        if (m_overflowHeight < height())
+            m_overflowHeight = height();
     }
-    if (previousHeight != m_height)
+    if (previousHeight != height())
         relayoutChildren = true;
 
     layoutPositionedObjects(relayoutChildren || isRoot());
 
-    if (!isFloatingOrPositioned() && m_height == 0) {
+    if (!isFloatingOrPositioned() && height() == 0) {
         // We are a block with no border and padding and a computed height
         // of 0.  The CSS spec states that zero-height blocks collapse their margins
         // together.
@@ -286,15 +267,15 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     }
 
     // Always ensure our overflow width is at least as large as our width.
-    if (m_overflowWidth < m_width)
-        m_overflowWidth = m_width;
+    if (m_overflowWidth < width())
+        m_overflowWidth = width();
 
     if (!hasOverflowClip()) {
         for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
             m_overflowLeft = min(m_overflowLeft, boxShadow->x - boxShadow->blur);
-            m_overflowWidth = max(m_overflowWidth, m_width + boxShadow->x + boxShadow->blur);
+            m_overflowWidth = max(m_overflowWidth, width() + boxShadow->x + boxShadow->blur);
             m_overflowTop = min(m_overflowTop, boxShadow->y - boxShadow->blur);
-            m_overflowHeight = max(m_overflowHeight, m_height + boxShadow->y + boxShadow->blur);
+            m_overflowHeight = max(m_overflowHeight, height() + boxShadow->y + boxShadow->blur);
         }
         
         if (hasReflection()) {
@@ -311,11 +292,10 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     // Update our scrollbars if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
     if (hasOverflowClip())
-        m_layer->updateScrollInfoAfterLayout();
+        layer()->updateScrollInfoAfterLayout();
 
     // Repaint with our new bounds if they are different from our old bounds.
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
+    repainter.repaintAfterLayout();
     
     setNeedsLayout(false);
 }
@@ -332,11 +312,11 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     unsigned int lowestFlexGroup = 0;
     bool haveFlex = false;
     int remainingSpace = 0;
-    m_overflowHeight = m_height;
+    m_overflowHeight = height();
 
     // The first walk over our kids is to find out if we have any flexible children.
     FlexBoxIterator iterator(this);
-    RenderObject* child = iterator.next();
+    RenderBox* child = iterator.next();
     while (child) {
         // Check to see if this child flexes.
         if (!child->isPositioned() && child->style()->boxFlex() > 0.0f) {
@@ -361,8 +341,8 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     // their preferred widths.  The second pass handles flexing the children.
     do {
         // Reset our height.
-        m_height = yPos;
-        m_overflowHeight = m_height;
+        setHeight(yPos);
+        m_overflowHeight = height();
         xPos = borderLeft() + paddingLeft();
                 
         // Our first pass is done without flexing.  We simply lay the children
@@ -388,9 +368,10 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     
             // Update our height and overflow height.
             if (style()->boxAlign() == BBASELINE) {
-                int ascent = child->marginTop() + child->getBaselineOfFirstLineBox();
+                int ascent = child->firstLineBoxBaseline();
                 if (ascent == -1)
-                    ascent = child->marginTop() + child->height() + child->marginBottom();
+                    ascent = child->height() + child->marginBottom();
+                ascent += child->marginTop();
                 int descent = (child->marginTop() + child->height() + child->marginBottom()) - ascent;
                 
                 // Update our maximum ascent.
@@ -400,28 +381,28 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                 maxDescent = max(maxDescent, descent);
                 
                 // Now update our height.
-                m_height = max(yPos + maxAscent + maxDescent, m_height);
+                setHeight(max(yPos + maxAscent + maxDescent, height()));
             }
             else
-                m_height = max(m_height, yPos + child->marginTop() + child->height() + child->marginBottom());
+                setHeight(max(height(), yPos + child->marginTop() + child->height() + child->marginBottom()));
 
             child = iterator.next();
         }
         
         if (!iterator.first() && hasLineIfEmpty())
-            m_height += lineHeight(true, true);
+            setHeight(height() + lineHeight(true, true));
         
-        m_height += toAdd;
+        setHeight(height() + toAdd);
 
         // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < m_height)
-            m_overflowHeight = m_height;
+        if (m_overflowHeight < height())
+            m_overflowHeight = height();
         
-        oldHeight = m_height;
+        oldHeight = height();
         calcHeight();
 
         relayoutChildren = false;
-        if (oldHeight != m_height)
+        if (oldHeight != height())
             heightSpecified = true;
         
         // Now that our height is actually known, we can place our boxes.
@@ -430,13 +411,13 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         while (child) {
             if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
-                if (child->hasStaticX()) {
+                if (child->style()->hasStaticX()) {
                     if (style()->direction() == LTR)
-                        child->setStaticX(xPos);
-                    else child->setStaticX(width() - xPos);
+                        child->layer()->setStaticX(xPos);
+                    else child->layer()->setStaticX(width() - xPos);
                 }
-                if (child->hasStaticY())
-                    child->setStaticY(yPos);
+                if (child->style()->hasStaticY())
+                    child->layer()->setStaticY(yPos);
                 child = iterator.next();
                 continue;
             }
@@ -445,7 +426,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             // fill the height of a containing box by default.
             // Now do a layout.
             int oldChildHeight = child->height();
-            static_cast<RenderBox*>(child)->calcHeight();
+            child->calcHeight();
             if (oldChildHeight != child->height())
                 child->setChildNeedsLayout(true, false);
             child->layoutIfNeeded();
@@ -458,9 +439,10 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                     childY += child->marginTop() + max(0, (contentHeight() - (child->height() + child->marginTop() + child->marginBottom()))/2);
                     break;
                 case BBASELINE: {
-                    int ascent = child->marginTop() + child->getBaselineOfFirstLineBox();
+                    int ascent = child->firstLineBoxBaseline();
                     if (ascent == -1)
-                        ascent = child->marginTop() + child->height() + child->marginBottom();
+                        ascent = child->height() + child->marginBottom();
+                    ascent += child->marginTop();
                     childY += child->marginTop() + (maxAscent - ascent);
                     break;
                 }
@@ -475,10 +457,10 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             placeChild(child, xPos, childY);
 
             if (child->isRenderBlock())
-                static_cast<RenderBlock*>(child)->addVisualOverflow(static_cast<RenderBlock*>(child)->floatRect());
+                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
 
             m_overflowHeight = max(m_overflowHeight, childY + child->overflowHeight(false));
-            m_overflowTop = min(m_overflowTop, child->yPos() + child->overflowTop(false));
+            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
             
             xPos += child->width() + child->marginRight();
     
@@ -619,7 +601,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                     remainingSpace -= (remainingSpace/totalChildren);
                     totalChildren--;
 
-                    placeChild(child, child->xPos()+offset, child->yPos());
+                    placeChild(child, child->x()+offset, child->y());
                     child = iterator.next();
                 }
             }
@@ -634,7 +616,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                     child = iterator.next();
                     continue;
                 }
-                placeChild(child, child->xPos()+offset, child->yPos());
+                placeChild(child, child->x()+offset, child->y());
                 child = iterator.next();
             }
         }
@@ -646,20 +628,20 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     }
     
     if (child) {
-        m_overflowLeft = min(child->xPos() + child->overflowLeft(false), m_overflowLeft);
+        m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
 
-        RenderObject* lastChild = child;
+        RenderBox* lastChild = child;
         while ((child = iterator.next())) {
             if (!child->isPositioned())
                 lastChild = child;
         }
-        m_overflowWidth = max(lastChild->xPos() + lastChild->overflowWidth(false), m_overflowWidth);
+        m_overflowWidth = max(lastChild->x() + lastChild->overflowWidth(false), m_overflowWidth);
     }
     
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
     if (heightSpecified)
-        m_height = oldHeight;
+        setHeight(oldHeight);
 }
 
 void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
@@ -667,7 +649,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     int xPos = borderLeft() + paddingLeft();
     int yPos = borderTop() + paddingTop();
     if( style()->direction() == RTL )
-        xPos = m_width - paddingRight() - borderRight();
+        xPos = width() - paddingRight() - borderRight();
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
     bool heightSpecified = false;
     int oldHeight = 0;
@@ -679,7 +661,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     
     // The first walk over our kids is to find out if we have any flexible children.
     FlexBoxIterator iterator(this);
-    RenderObject *child = iterator.next();
+    RenderBox* child = iterator.next();
     while (child) {
         // Check to see if this child flexes.
         if (!child->isPositioned() && child->style()->boxFlex() > 0.0f) {
@@ -714,13 +696,13 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     
                     // Dirty all the positioned objects.
                     if (child->isRenderBlock()) {
-                        static_cast<RenderBlock*>(child)->markPositionedObjectsForLayout();
-                        static_cast<RenderBlock*>(child)->clearTruncation();
+                        toRenderBlock(child)->markPositionedObjectsForLayout();
+                        toRenderBlock(child)->clearTruncation();
                     }
                 }
                 child->layoutIfNeeded();
                 if (child->style()->height().isAuto() && child->isBlockFlow())
-                    maxLineCount = max(maxLineCount, static_cast<RenderBlock*>(child)->lineCount());
+                    maxLineCount = max(maxLineCount, toRenderBlock(child)->lineCount());
             }
             child = iterator.next();
         }
@@ -733,7 +715,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                 if (child->isPositioned() || !child->style()->height().isAuto() || !child->isBlockFlow())
                     continue;
                 
-                RenderBlock* blockChild = static_cast<RenderBlock*>(child);
+                RenderBlock* blockChild = toRenderBlock(child);
                 int lineCount = blockChild->lineCount();
                 if (lineCount <= numVisibleLines)
                     continue;
@@ -762,9 +744,9 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                 InlineBox* anchorBox = lastLine->lastChild();
                 if (!anchorBox)
                     continue;
-                if (!anchorBox->object()->element())
+                if (!anchorBox->renderer()->node())
                     continue;
-                if (!anchorBox->object()->element()->isLink())
+                if (!anchorBox->renderer()->node()->isLink())
                     continue;
                 
                 RootInlineBox* lastVisibleLine = blockChild->lineAtIndex(numVisibleLines-1);
@@ -781,23 +763,27 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                 int totalWidth = ellipsisAndSpaceWidth + anchorBox->width();
                 
                 // See if this width can be accommodated on the last visible line
-                RenderBlock* destBlock = static_cast<RenderBlock*>(lastVisibleLine->object());
-                RenderBlock* srcBlock = static_cast<RenderBlock*>(lastLine->object());
+                RenderBlock* destBlock = toRenderBlock(lastVisibleLine->renderer());
+                RenderBlock* srcBlock = toRenderBlock(lastLine->renderer());
                 
                 // FIXME: Directions of src/destBlock could be different from our direction and from one another.
                 if (srcBlock->style()->direction() != LTR)
                     continue;
                 if (destBlock->style()->direction() != LTR)
                     continue;
+                int ltr = true;
+
+                int blockRightEdge = destBlock->rightOffset(lastVisibleLine->y(), false);
+                int blockLeftEdge = destBlock->leftOffset(lastVisibleLine->y(), false);
 
-                int blockEdge = destBlock->rightOffset(lastVisibleLine->yPos());
-                if (!lastVisibleLine->canAccommodateEllipsis(true, blockEdge, 
-                                                             lastVisibleLine->xPos() + lastVisibleLine->width(),
+                int blockEdge = ltr ? blockRightEdge : blockLeftEdge;
+                if (!lastVisibleLine->canAccommodateEllipsis(ltr, blockEdge,
+                                                             lastVisibleLine->x() + lastVisibleLine->width(),
                                                              totalWidth))
                     continue;
 
                 // Let the truncation code kick in.
-                lastVisibleLine->placeEllipsis(ellipsisAndSpaceStr, true, blockEdge, totalWidth, anchorBox);
+                lastVisibleLine->placeEllipsis(ellipsisAndSpaceStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
                 destBlock->setHasMarkupTruncation(true);
             }
         }
@@ -808,9 +794,9 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     // Our first pass is done without flexing.  We simply lay the children
     // out within the box.
     do {
-        m_height = borderTop() + paddingTop();
-        int minHeight = m_height + toAdd;
-        m_overflowHeight = m_height;
+        setHeight(borderTop() + paddingTop());
+        int minHeight = height() + toAdd;
+        m_overflowHeight = height();
 
         child = iterator.first();
         while (child) {
@@ -821,14 +807,14 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (child->isPositioned())
             {
                 child->containingBlock()->insertPositionedObject(child);
-                if (child->hasStaticX()) {
+                if (child->style()->hasStaticX()) {
                     if (style()->direction() == LTR)
-                        child->setStaticX(borderLeft()+paddingLeft());
+                        child->layer()->setStaticX(borderLeft()+paddingLeft());
                     else
-                        child->setStaticX(borderRight()+paddingRight());
+                        child->layer()->setStaticX(borderRight()+paddingRight());
                 }
-                if (child->hasStaticY())
-                    child->setStaticY(m_height);
+                if (child->style()->hasStaticY())
+                    child->layer()->setStaticY(height());
                 child = iterator.next();
                 continue;
             } 
@@ -837,7 +823,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             child->calcVerticalMargins();
     
             // Add in the child's marginTop to our height.
-            m_height += child->marginTop();
+            setHeight(height() + child->marginTop());
     
             // Now do a layout.
             child->layoutIfNeeded();
@@ -864,39 +850,39 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             }
     
             // Place the child.
-            placeChild(child, childX, m_height);
-            m_height += child->height() + child->marginBottom();
+            placeChild(child, childX, height());
+            setHeight(height() + child->height() + child->marginBottom());
     
             if (child->isRenderBlock())
-                static_cast<RenderBlock*>(child)->addVisualOverflow(static_cast<RenderBlock*>(child)->floatRect());
+                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
 
             // See if this child has made our overflow need to grow.
-            m_overflowWidth = max(child->xPos() + child->overflowWidth(false), m_overflowWidth);
-            m_overflowLeft = min(child->xPos() + child->overflowLeft(false), m_overflowLeft);
+            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
+            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
             
             child = iterator.next();
         }
 
-        yPos = m_height;
+        yPos = height();
         
         if (!iterator.first() && hasLineIfEmpty())
-            m_height += lineHeight(true, true);
+            setHeight(height() + lineHeight(true, true));
     
-        m_height += toAdd;
+        setHeight(height() + toAdd);
 
         // Negative margins can cause our height to shrink below our minimal height (border/padding).
         // If this happens, ensure that the computed height is increased to the minimal height.
-        if (m_height < minHeight)
-            m_height = minHeight;
+        if (height() < minHeight)
+            setHeight(minHeight);
 
         // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < m_height)
-            m_overflowHeight = m_height;
+        if (m_overflowHeight < height())
+            m_overflowHeight = height();
 
         // Now we have to calc our height, so we know how much space we have remaining.
-        oldHeight = m_height;
+        oldHeight = height();
         calcHeight();
-        if (oldHeight != m_height)
+        if (oldHeight != height())
             heightSpecified = true;
 
         remainingSpace = borderTop() + paddingTop() + contentHeight() - yPos;
@@ -1028,7 +1014,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     offset += remainingSpace/totalChildren;
                     remainingSpace -= (remainingSpace/totalChildren);
                     totalChildren--;
-                    placeChild(child, child->xPos(), child->yPos()+offset);
+                    placeChild(child, child->x(), child->y()+offset);
                     child = iterator.next();
                 }
             }
@@ -1043,7 +1029,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     child = iterator.next();
                     continue;
                 }
-                placeChild(child, child->xPos(), child->yPos()+offset);
+                placeChild(child, child->x(), child->y()+offset);
                 child = iterator.next();
             }
         }
@@ -1055,28 +1041,28 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     }
     
     if (child) {
-        m_overflowTop = min(child->yPos() + child->overflowTop(false), m_overflowTop);
+        m_overflowTop = min(child->y() + child->overflowTop(false), m_overflowTop);
 
-        RenderObject* lastChild = child;
+        RenderBox* lastChild = child;
         while ((child = iterator.next())) {
             if (!child->isPositioned())
                 lastChild = child;
         }
-        m_overflowHeight = max(lastChild->yPos() + lastChild->overflowHeight(false), m_overflowHeight);
+        m_overflowHeight = max(lastChild->y() + lastChild->overflowHeight(false), m_overflowHeight);
     }
 
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
     if (heightSpecified)
-        m_height = oldHeight; 
+        setHeight(oldHeight); 
 }
 
-void RenderFlexibleBox::placeChild(RenderObject* child, int x, int y)
+void RenderFlexibleBox::placeChild(RenderBox* child, int x, int y)
 {
-    IntRect oldRect(child->xPos(), child->yPos() , child->width(), child->height());
+    IntRect oldRect(child->x(), child->y() , child->width(), child->height());
 
     // Place the child.
-    child->setPos(x, y);
+    child->setLocation(x, y);
 
     // If the child moved, we have to repaint it as well as any floating/positioned
     // descendants.  An exception is if we need a layout.  In this case, we know we're going to
@@ -1085,7 +1071,7 @@ void RenderFlexibleBox::placeChild(RenderObject* child, int x, int y)
         child->repaintDuringLayoutIfMoved(oldRect);
 }
 
-int RenderFlexibleBox::allowedChildFlex(RenderObject* child, bool expanding, unsigned int group)
+int RenderFlexibleBox::allowedChildFlex(RenderBox* child, bool expanding, unsigned int group)
 {
     if (child->isPositioned() || child->style()->boxFlex() == 0.0f || child->style()->boxFlexGroup() != group)
         return 0;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.h
index f48caf5103..a0f84ce429 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.h
@@ -48,10 +48,10 @@ public:
     virtual bool isFlexingChildren() const { return m_flexingChildren; }
     virtual bool isStretchingChildren() const { return m_stretchingChildren; }
 
-    void placeChild(RenderObject* child, int x, int y);
+    void placeChild(RenderBox* child, int x, int y);
 
 protected:
-    int allowedChildFlex(RenderObject* child, bool expanding, unsigned group);
+    int allowedChildFlex(RenderBox* child, bool expanding, unsigned group);
 
     bool hasMultipleLines() const { return style()->boxLines() == MULTIPLE; }
     bool isVertical() const { return style()->boxOrient() == VERTICAL; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFlow.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFlow.cpp
deleted file mode 100644
index 86a92f3a80..0000000000
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFlow.cpp
+++ /dev/null
@@ -1,883 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "RenderFlow.h"
-
-#include "Document.h"
-#include "GraphicsContext.h"
-#include "HTMLNames.h"
-#include "InlineTextBox.h"
-#include "RenderArena.h"
-#include "RenderInline.h"
-#include "RenderLayer.h"
-#include "RenderView.h"
-
-using namespace std;
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-#ifndef NDEBUG
-
-RenderFlow::~RenderFlow()
-{
-    ASSERT(!m_firstLineBox);
-    ASSERT(!m_lastLineBox);
-}
-
-#endif
-
-RenderFlow* RenderFlow::createAnonymousFlow(Document* doc, PassRefPtr<RenderStyle> style)
-{
-    RenderFlow* result;
-    if (style->display() == INLINE)
-        result = new (doc->renderArena()) RenderInline(doc);
-    else
-        result = new (doc->renderArena()) RenderBlock(doc);
-    result->setStyle(style);
-    return result;
-}
-
-RenderFlow* RenderFlow::continuationBefore(RenderObject* beforeChild)
-{
-    if (beforeChild && beforeChild->parent() == this)
-        return this;
-
-    RenderFlow* curr = continuation();
-    RenderFlow* nextToLast = this;
-    RenderFlow* last = this;
-    while (curr) {
-        if (beforeChild && beforeChild->parent() == curr) {
-            if (curr->firstChild() == beforeChild)
-                return last;
-            return curr;
-        }
-
-        nextToLast = last;
-        last = curr;
-        curr = curr->continuation();
-    }
-
-    if (!beforeChild && !last->firstChild())
-        return nextToLast;
-    return last;
-}
-
-void RenderFlow::addChildWithContinuation(RenderObject* newChild, RenderObject* beforeChild)
-{
-    if (beforeChild && (beforeChild->parent()->isTableRow() || beforeChild->parent()->isTableSection() || beforeChild->parent()->isTable())) {
-        RenderObject* anonymousTablePart = beforeChild->parent();
-        ASSERT(anonymousTablePart->isAnonymous());
-        while (!anonymousTablePart->isTable()) {
-            anonymousTablePart = anonymousTablePart->parent();
-            ASSERT(anonymousTablePart->isAnonymous());
-        }
-        return anonymousTablePart->addChild(newChild, beforeChild);
-    }
-
-    RenderFlow* flow = continuationBefore(beforeChild);
-    ASSERT(!beforeChild || beforeChild->parent()->isRenderBlock() ||
-                beforeChild->parent()->isRenderInline());
-    RenderFlow* beforeChildParent = beforeChild ? static_cast<RenderFlow*>(beforeChild->parent()) : 
-                                    (flow->continuation() ? flow->continuation() : flow);
-
-    if (newChild->isFloatingOrPositioned())
-        return beforeChildParent->addChildToFlow(newChild, beforeChild);
-
-    // A continuation always consists of two potential candidates: an inline or an anonymous
-    // block box holding block children.
-    bool childInline = newChild->isInline();
-    bool bcpInline = beforeChildParent->isInline();
-    bool flowInline = flow->isInline();
-
-    if (flow == beforeChildParent)
-        return flow->addChildToFlow(newChild, beforeChild);
-    else {
-        // The goal here is to match up if we can, so that we can coalesce and create the
-        // minimal # of continuations needed for the inline.
-        if (childInline == bcpInline)
-            return beforeChildParent->addChildToFlow(newChild, beforeChild);
-        else if (flowInline == childInline)
-            return flow->addChildToFlow(newChild, 0); // Just treat like an append.
-        else
-            return beforeChildParent->addChildToFlow(newChild, beforeChild);
-    }
-}
-
-void RenderFlow::addChild(RenderObject* newChild, RenderObject* beforeChild)
-{
-    if (continuation())
-        return addChildWithContinuation(newChild, beforeChild);
-    return addChildToFlow(newChild, beforeChild);
-}
-
-void RenderFlow::extractLineBox(InlineFlowBox* box)
-{
-    checkConsistency();
-
-    m_lastLineBox = box->prevFlowBox();
-    if (box == m_firstLineBox)
-        m_firstLineBox = 0;
-    if (box->prevLineBox())
-        box->prevLineBox()->setNextLineBox(0);
-    box->setPreviousLineBox(0);
-    for (InlineRunBox* curr = box; curr; curr = curr->nextLineBox())
-        curr->setExtracted();
-
-    checkConsistency();
-}
-
-void RenderFlow::attachLineBox(InlineFlowBox* box)
-{
-    checkConsistency();
-
-    if (m_lastLineBox) {
-        m_lastLineBox->setNextLineBox(box);
-        box->setPreviousLineBox(m_lastLineBox);
-    } else
-        m_firstLineBox = box;
-    InlineFlowBox* last = box;
-    for (InlineFlowBox* curr = box; curr; curr = curr->nextFlowBox()) {
-        curr->setExtracted(false);
-        last = curr;
-    }
-    m_lastLineBox = last;
-
-    checkConsistency();
-}
-
-void RenderFlow::removeLineBox(InlineFlowBox* box)
-{
-    checkConsistency();
-
-    if (box == m_firstLineBox)
-        m_firstLineBox = box->nextFlowBox();
-    if (box == m_lastLineBox)
-        m_lastLineBox = box->prevFlowBox();
-    if (box->nextLineBox())
-        box->nextLineBox()->setPreviousLineBox(box->prevLineBox());
-    if (box->prevLineBox())
-        box->prevLineBox()->setNextLineBox(box->nextLineBox());
-
-    checkConsistency();
-}
-
-void RenderFlow::deleteLineBoxes()
-{
-    if (m_firstLineBox) {
-        RenderArena* arena = renderArena();
-        InlineRunBox* next;
-        for (InlineRunBox* curr = m_firstLineBox; curr; curr = next) {
-            next = curr->nextLineBox();
-            curr->destroy(arena);
-        }
-        m_firstLineBox = 0;
-        m_lastLineBox = 0;
-    }
-}
-
-void RenderFlow::destroy()
-{
-    // Detach our continuation first.
-    if (m_continuation)
-        m_continuation->destroy();
-    m_continuation = 0;
-
-    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
-    // properly dirty line boxes that they are removed from.  Effects that do :before/:after only on hover could crash otherwise.
-    RenderContainer::destroyLeftoverChildren();
-
-    if (!documentBeingDestroyed()) {
-        if (m_firstLineBox) {
-            // We can't wait for RenderContainer::destroy to clear the selection,
-            // because by then we will have nuked the line boxes.
-            // FIXME: The SelectionController should be responsible for this when it
-            // is notified of DOM mutations.
-            if (isSelectionBorder())
-                view()->clearSelection();
-
-            // If line boxes are contained inside a root, that means we're an inline.
-            // In that case, we need to remove all the line boxes so that the parent
-            // lines aren't pointing to deleted children. If the first line box does
-            // not have a parent that means they are either already disconnected or
-            // root lines that can just be destroyed without disconnecting.
-            if (m_firstLineBox->parent()) {
-                for (InlineRunBox* box = m_firstLineBox; box; box = box->nextLineBox())
-                    box->remove();
-            }
-
-            // If we are an anonymous block, then our line boxes might have children
-            // that will outlast this block. In the non-anonymous block case those
-            // children will be destroyed by the time we return from this function.
-            if (isAnonymousBlock()) {
-                for (InlineFlowBox* box = m_firstLineBox; box; box = box->nextFlowBox()) {
-                    while (InlineBox* childBox = box->firstChild())
-                        childBox->remove();
-                }
-            }
-        } else if (isInline() && parent())
-            parent()->dirtyLinesFromChangedChild(this);
-    }
-
-    deleteLineBoxes();
-
-    RenderContainer::destroy();
-}
-
-void RenderFlow::dirtyLinesFromChangedChild(RenderObject* child)
-{
-    if (!parent() || (selfNeedsLayout() && !isInlineFlow()) || isTable())
-        return;
-
-    // If we have no first line box, then just bail early.
-    if (!firstLineBox()) {
-        // For an empty inline, go ahead and propagate the check up to our parent, unless the parent
-        // is already dirty.
-        if (isInline() && !parent()->selfNeedsLayout())
-            parent()->dirtyLinesFromChangedChild(this);
-        return;
-    }
-
-    // Try to figure out which line box we belong in.  First try to find a previous
-    // line box by examining our siblings.  If we didn't find a line box, then use our 
-    // parent's first line box.
-    RootInlineBox* box = 0;
-    RenderObject* curr = 0;
-    for (curr = child->previousSibling(); curr; curr = curr->previousSibling()) {
-        if (curr->isFloatingOrPositioned())
-            continue;
-
-        if (curr->isReplaced()) {
-            InlineBox* wrapper = curr->inlineBoxWrapper();
-            if (wrapper)
-                box = wrapper->root();
-        } else if (curr->isText()) {
-            InlineTextBox* textBox = static_cast<RenderText*>(curr)->lastTextBox();
-            if (textBox)
-                box = textBox->root();
-        } else if (curr->isInlineFlow()) {
-            InlineRunBox* runBox = static_cast<RenderFlow*>(curr)->lastLineBox();
-            if (runBox)
-                box = runBox->root();
-        }
-
-        if (box)
-            break;
-    }
-    if (!box)
-        box = firstLineBox()->root();
-
-    // If we found a line box, then dirty it.
-    if (box) {
-        RootInlineBox* adjacentBox;
-        box->markDirty();
-
-        // dirty the adjacent lines that might be affected
-        // NOTE: we dirty the previous line because RootInlineBox objects cache
-        // the address of the first object on the next line after a BR, which we may be
-        // invalidating here.  For more info, see how RenderBlock::layoutInlineChildren
-        // calls setLineBreakInfo with the result of findNextLineBreak.  findNextLineBreak,
-        // despite the name, actually returns the first RenderObject after the BR.
-        // <rdar://problem/3849947> "Typing after pasting line does not appear until after window resize."
-        adjacentBox = box->prevRootBox();
-        if (adjacentBox)
-            adjacentBox->markDirty();
-        if (child->isBR() || (curr && curr->isBR())) {
-            adjacentBox = box->nextRootBox();
-            if (adjacentBox)
-                adjacentBox->markDirty();
-        }
-    }
-}
-
-int RenderFlow::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
-{
-    if (firstLine) {
-        RenderStyle* s = style(firstLine);
-        Length lh = s->lineHeight();
-        if (lh.isNegative()) {
-            if (s == style()) {
-                if (m_lineHeight == -1)
-                    m_lineHeight = RenderObject::lineHeight(false);
-                return m_lineHeight;
-            }
-            return s->font().lineSpacing();
-        }
-        if (lh.isPercent())
-            return lh.calcMinValue(s->fontSize());
-        return lh.value();
-    }
-
-    if (m_lineHeight == -1)
-        m_lineHeight = RenderObject::lineHeight(false);
-    return m_lineHeight;
-}
-
-void RenderFlow::dirtyLineBoxes(bool fullLayout, bool isRootLineBox)
-{
-    if (!isRootLineBox && isReplaced())
-        return RenderContainer::dirtyLineBoxes(fullLayout, isRootLineBox);
-
-    if (fullLayout)
-        deleteLineBoxes();
-    else {
-        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-            curr->dirtyLineBoxes();
-    }
-}
-
-InlineBox* RenderFlow::createInlineBox(bool makePlaceHolderBox, bool isRootLineBox, bool /*isOnlyRun*/)
-{
-    checkConsistency();
-
-    if (!isRootLineBox &&
-        (isReplaced() || makePlaceHolderBox))                     // Inline tables and inline blocks
-        return RenderContainer::createInlineBox(false, isRootLineBox);  // (or positioned element placeholders).
-
-    InlineFlowBox* flowBox = 0;
-    if (isInlineFlow())
-        flowBox = new (renderArena()) InlineFlowBox(this);
-    else
-        flowBox = new (renderArena()) RootInlineBox(this);
-
-    if (!m_firstLineBox)
-        m_firstLineBox = m_lastLineBox = flowBox;
-    else {
-        m_lastLineBox->setNextLineBox(flowBox);
-        flowBox->setPreviousLineBox(m_lastLineBox);
-        m_lastLineBox = flowBox;
-    }
-
-    checkConsistency();
-
-    return flowBox;
-}
-
-void RenderFlow::paintLines(PaintInfo& paintInfo, int tx, int ty)
-{
-    // Only paint during the foreground/selection phases.
-    if (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection && paintInfo.phase != PaintPhaseOutline 
-        && paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines && paintInfo.phase != PaintPhaseTextClip
-        && paintInfo.phase != PaintPhaseMask)
-        return;
-
-    bool inlineFlow = isInlineFlow();
-    if (inlineFlow)
-        ASSERT(m_layer); // The only way a compact/run-in/inline could paint like this is if it has a layer.
-
-    // If we have no lines then we have no work to do.
-    if (!firstLineBox())
-        return;
-
-    // We can check the first box and last box and avoid painting if we don't
-    // intersect.  This is a quick short-circuit that we can take to avoid walking any lines.
-    // FIXME: This check is flawed in the following extremely obscure way:
-    // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    int yPos = firstLineBox()->root()->topOverflow() - maximalOutlineSize(paintInfo.phase);
-    int h = maximalOutlineSize(paintInfo.phase) + lastLineBox()->root()->bottomOverflow() - yPos;
-    yPos += ty;
-    if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
-        return;
-
-    PaintInfo info(paintInfo);
-    RenderFlowSequencedSet outlineObjects;
-    info.outlineObjects = &outlineObjects;
-
-    // See if our root lines intersect with the dirty rect.  If so, then we paint
-    // them.  Note that boxes can easily overlap, so we can't make any assumptions
-    // based off positions of our first line box or our last line box.
-    RenderView* v = view();
-    bool usePrintRect = !v->printRect().isEmpty();
-    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextFlowBox()) {
-        if (usePrintRect) {
-            // FIXME: This is a feeble effort to avoid splitting a line across two pages.
-            // It is utterly inadequate, and this should not be done at paint time at all.
-            // The whole way objects break across pages needs to be redone.
-            // Try to avoid splitting a line vertically, but only if it's less than the height
-            // of the entire page.
-            if (curr->root()->bottomOverflow() - curr->root()->topOverflow() <= v->printRect().height()) {
-                if (ty + curr->root()->bottomOverflow() > v->printRect().bottom()) {
-                    if (ty + curr->root()->topOverflow() < v->truncatedAt())
-                        v->setBestTruncatedAt(ty + curr->root()->topOverflow(), this);
-                    // If we were able to truncate, don't paint.
-                    if (ty + curr->root()->topOverflow() >= v->truncatedAt())
-                        break;
-                }
-            }
-        }
-
-        int top = min(curr->root()->topOverflow(), curr->root()->selectionTop()) - maximalOutlineSize(info.phase);
-        int bottom = curr->root()->bottomOverflow() + maximalOutlineSize(info.phase);
-        h = bottom - top;
-        yPos = ty + top;
-        if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
-            curr->paint(info, tx, ty);
-    }
-
-    if (info.phase == PaintPhaseOutline || info.phase == PaintPhaseSelfOutline || info.phase == PaintPhaseChildOutlines) {
-        RenderFlowSequencedSet::iterator end = info.outlineObjects->end();
-        for (RenderFlowSequencedSet::iterator it = info.outlineObjects->begin(); it != end; ++it) {
-            RenderFlow* flow = *it;
-            flow->paintOutline(info.context, tx, ty);
-        }
-        info.outlineObjects->clear();
-    }
-}
-
-bool RenderFlow::hitTestLines(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
-{
-    if (hitTestAction != HitTestForeground)
-        return false;
-
-    bool inlineFlow = isInlineFlow();
-    if (inlineFlow)
-        ASSERT(m_layer); // The only way a compact/run-in/inline could paint like this is if it has a layer.
-
-    // If we have no lines then we have no work to do.
-    if (!firstLineBox())
-        return false;
-
-    // We can check the first box and last box and avoid hit testing if we don't
-    // contain the point.  This is a quick short-circuit that we can take to avoid walking any lines.
-    // FIXME: This check is flawed in the following extremely obscure way:
-    // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    if ((y >= ty + lastLineBox()->root()->bottomOverflow()) || (y < ty + firstLineBox()->root()->topOverflow()))
-        return false;
-
-    // See if our root lines contain the point.  If so, then we hit test
-    // them further.  Note that boxes can easily overlap, so we can't make any assumptions
-    // based off positions of our first line box or our last line box.
-    for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevFlowBox()) {
-        if (y >= ty + curr->root()->topOverflow() && y < ty + curr->root()->bottomOverflow()) {
-            bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty);
-            if (inside) {
-                updateHitTestResult(result, IntPoint(x - tx, y - ty));
-                return true;
-            }
-        }
-    }
-    
-    return false;
-}
-
-IntRect RenderFlow::absoluteClippedOverflowRect()
-{
-    if (isInlineFlow()) {
-        // Only compacts and run-ins are allowed in here during layout.
-        ASSERT(!view() || !view()->layoutState() || isCompact() || isRunIn());
-
-        if (!firstLineBox() && !continuation())
-            return IntRect();
-
-        // Find our leftmost position.
-        int left = 0;
-        int top = firstLineBox() ? firstLineBox()->yPos() : 0;
-        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
-            if (curr == firstLineBox() || curr->xPos() < left)
-                left = curr->xPos();
-        }
-
-        // Now invalidate a rectangle.
-        int ow = style() ? style()->outlineSize() : 0;
-        if (isCompact())
-            left -= m_x;
-        
-        // We need to add in the relative position offsets of any inlines (including us) up to our
-        // containing block.
-        RenderBlock* cb = containingBlock();
-        for (RenderObject* inlineFlow = this; inlineFlow && inlineFlow->isInlineFlow() && inlineFlow != cb; 
-             inlineFlow = inlineFlow->parent()) {
-             if (inlineFlow->style()->position() == RelativePosition && inlineFlow->hasLayer())
-                inlineFlow->layer()->relativePositionOffset(left, top);
-        }
-
-        IntRect r(-ow + left, -ow + top, width() + ow * 2, height() + ow * 2);
-        if (cb->hasColumns())
-            cb->adjustRectForColumns(r);
-
-        if (cb->hasOverflowClip()) {
-            // cb->height() is inaccurate if we're in the middle of a layout of |cb|, so use the
-            // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
-            // anyway if its size does change.
-            int x = r.x();
-            int y = r.y();
-            IntRect boxRect(0, 0, cb->layer()->width(), cb->layer()->height());
-            cb->layer()->subtractScrolledContentOffset(x, y); // For overflow:auto/scroll/hidden.
-            IntRect repaintRect(x, y, r.width(), r.height());
-            r = intersection(repaintRect, boxRect);
-        }
-        cb->computeAbsoluteRepaintRect(r);
-
-        if (ow) {
-            for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-                if (!curr->isText()) {
-                    IntRect childRect = curr->getAbsoluteRepaintRectWithOutline(ow);
-                    r.unite(childRect);
-                }
-            }
-
-            if (continuation() && !continuation()->isInline()) {
-                IntRect contRect = continuation()->getAbsoluteRepaintRectWithOutline(ow);
-                r.unite(contRect);
-            }
-        }
-
-        return r;
-    }
-
-    return RenderContainer::absoluteClippedOverflowRect();
-}
-
-int RenderFlow::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
-{
-    ASSERT(!isInlineFlow());
-    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && m_width > 0 ? overflowHeight(false) : 0;
-
-    int bottom = includeSelf && m_width > 0 ? m_height : 0;
-    if (!hasColumns()) {
-        // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
-        // For now, we have to descend into all the children, since we may have a huge abs div inside
-        // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
-        // the abs div.
-        for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
-            if (!c->isFloatingOrPositioned() && !c->isText() && !c->isInlineFlow())
-                bottom = max(bottom, c->yPos() + c->lowestPosition(false));
-        }
-    }
-
-    if (includeSelf && isRelPositioned())
-        bottom += relativePositionOffsetY();         
-
-    return bottom;
-}
-
-int RenderFlow::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
-{
-    ASSERT(!isInlineFlow());
-    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && m_height > 0 ? overflowWidth(false) : 0;
-
-    int right = includeSelf && m_height > 0 ? m_width : 0;
-    if (!hasColumns()) {
-        // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
-        // For now, we have to descend into all the children, since we may have a huge abs div inside
-        // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
-        // the abs div.
-        for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
-            if (!c->isFloatingOrPositioned() && !c->isText() && !c->isInlineFlow())
-                right = max(right, c->xPos() + c->rightmostPosition(false));
-        }
-    }
-
-    if (includeSelf && isRelPositioned())
-        right += relativePositionOffsetX();
-
-    return right;
-}
-
-int RenderFlow::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
-{
-    ASSERT(!isInlineFlow());
-    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && m_height > 0 ? overflowLeft(false) : m_width;
-
-    int left = includeSelf && m_height > 0 ? 0 : m_width;
-    if (!hasColumns()) {
-        // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
-        // For now, we have to descend into all the children, since we may have a huge abs div inside
-        // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
-        // the abs div.
-        for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
-            if (!c->isFloatingOrPositioned() && !c->isText() && !c->isInlineFlow())
-                left = min(left, c->xPos() + c->leftmostPosition(false));
-        }
-    }
-
-    if (includeSelf && isRelPositioned())
-        left += relativePositionOffsetX(); 
-
-    return left;
-}
-
-IntRect RenderFlow::localCaretRect(InlineBox* inlineBox, int caretOffset, int* extraWidthToEndOfLine)
-{
-    // Do the normal calculation in most cases.
-    if (firstChild() || style()->display() == INLINE)
-        return RenderContainer::localCaretRect(inlineBox, caretOffset, extraWidthToEndOfLine);
-
-    // This is a special case:
-    // The element is not an inline element, and it's empty. So we have to
-    // calculate a fake position to indicate where objects are to be inserted.
-    
-    // FIXME: This does not take into account either :first-line or :first-letter
-    // However, as soon as some content is entered, the line boxes will be
-    // constructed and this kludge is not called any more. So only the caret size
-    // of an empty :first-line'd block is wrong. I think we can live with that.
-    RenderStyle* currentStyle = firstLineStyle();
-    int height = lineHeight(true);
-    const int caretWidth = 1;
-
-    enum CaretAlignment { alignLeft, alignRight, alignCenter };
-
-    CaretAlignment alignment = alignLeft;
-
-    switch (currentStyle->textAlign()) {
-        case TAAUTO:
-        case JUSTIFY:
-            if (currentStyle->direction() == RTL)
-                alignment = alignRight;
-            break;
-        case LEFT:
-        case WEBKIT_LEFT:
-            break;
-        case CENTER:
-        case WEBKIT_CENTER:
-            alignment = alignCenter;
-            break;
-        case RIGHT:
-        case WEBKIT_RIGHT:
-            alignment = alignRight;
-            break;
-    }
-
-    int x = borderLeft() + paddingLeft();
-    int w = width();
-
-    switch (alignment) {
-        case alignLeft:
-            break;
-        case alignCenter:
-            x = (x + w - (borderRight() + paddingRight())) / 2;
-            break;
-        case alignRight:
-            x = w - (borderRight() + paddingRight());
-            break;
-    }
-
-    if (extraWidthToEndOfLine) {
-        if (isRenderBlock()) {
-            *extraWidthToEndOfLine = w - (x + caretWidth);
-        } else {
-            // FIXME: This code looks wrong.
-            // myRight and containerRight are set up, but then clobbered.
-            // So *extraWidthToEndOfLine will always be 0 here.
-
-            int myRight = x + caretWidth;
-            // FIXME: why call localToAbsoluteForContent() twice here, too?
-            FloatPoint absRightPoint = localToAbsoluteForContent(FloatPoint(myRight, 0));
-
-            int containerRight = containingBlock()->xPos() + containingBlockWidth();
-            FloatPoint absContainerPoint = localToAbsoluteForContent(FloatPoint(containerRight, 0));
-
-            *extraWidthToEndOfLine = absContainerPoint.x() - absRightPoint.x();
-        }
-    }
-
-    int y = paddingTop() + borderTop();
-
-    return IntRect(x, y, caretWidth, height);
-}
-
-void RenderFlow::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
-{
-    if (isRenderBlock()) {
-        // Continuations should include their margins in the outline rect.
-        if (continuation()) {
-            bool nextInlineHasLineBox = continuation()->firstLineBox();
-            bool prevInlineHasLineBox = static_cast<RenderFlow*>(continuation()->element()->renderer())->firstLineBox();
-            int topMargin = prevInlineHasLineBox ? collapsedMarginTop() : 0;
-            int bottomMargin = nextInlineHasLineBox ? collapsedMarginBottom() : 0;
-            graphicsContext->addFocusRingRect(IntRect(tx, ty - topMargin, 
-                                                      width(), height() + topMargin + bottomMargin));
-        } else
-            graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
-    }
-
-    if (!hasOverflowClip() && !hasControlClip()) {
-        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-            graphicsContext->addFocusRingRect(IntRect(tx + curr->xPos(), ty + curr->yPos(), curr->width(), curr->height()));
-
-        for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling())
-            if (!curr->isText() && !curr->isListMarker()) {
-                FloatPoint pos;
-                // FIXME: This doesn't work correctly with transforms.
-                if (curr->layer()) 
-                    pos = curr->localToAbsolute();
-                else
-                    pos = FloatPoint(tx + curr->xPos(), ty + curr->yPos());
-                curr->addFocusRingRects(graphicsContext, pos.x(), pos.y());
-            }
-    }
-
-    if (continuation()) {
-        if (isInline())
-            continuation()->addFocusRingRects(graphicsContext, 
-                                              tx - containingBlock()->xPos() + continuation()->xPos(),
-                                              ty - containingBlock()->yPos() + continuation()->yPos());
-        else
-            continuation()->addFocusRingRects(graphicsContext, 
-                                              tx - xPos() + continuation()->containingBlock()->xPos(),
-                                              ty - yPos() + continuation()->containingBlock()->yPos());
-    }
-}
-
-void RenderFlow::paintOutline(GraphicsContext* graphicsContext, int tx, int ty)
-{
-    if (!hasOutline())
-        return;
-    
-    if (style()->outlineStyleIsAuto() || hasOutlineAnnotation()) {
-        int ow = style()->outlineWidth();
-        Color oc = style()->outlineColor();
-        if (!oc.isValid())
-            oc = style()->color();
-
-        graphicsContext->initFocusRing(ow, style()->outlineOffset());
-        addFocusRingRects(graphicsContext, tx, ty);
-        if (style()->outlineStyleIsAuto())
-            graphicsContext->drawFocusRing(oc);
-        else
-            addPDFURLRect(graphicsContext, graphicsContext->focusRingBoundingRect());
-        graphicsContext->clearFocusRing();
-    }
-
-    if (style()->outlineStyleIsAuto() || style()->outlineStyle() == BNONE)
-        return;
-
-    Vector<IntRect> rects;
-
-    rects.append(IntRect());
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        rects.append(IntRect(curr->xPos(), curr->yPos(), curr->width(), curr->height()));
-
-    rects.append(IntRect());
-
-    for (unsigned i = 1; i < rects.size() - 1; i++)
-        paintOutlineForLine(graphicsContext, tx, ty, rects.at(i - 1), rects.at(i), rects.at(i + 1));
-}
-
-void RenderFlow::paintOutlineForLine(GraphicsContext* graphicsContext, int tx, int ty,
-                                     const IntRect& lastline, const IntRect& thisline, const IntRect& nextline)
-{
-    int ow = style()->outlineWidth();
-    EBorderStyle os = style()->outlineStyle();
-    Color oc = style()->outlineColor();
-    if (!oc.isValid())
-        oc = style()->color();
-
-    int offset = style()->outlineOffset();
-
-    int t = ty + thisline.y() - offset;
-    int l = tx + thisline.x() - offset;
-    int b = ty + thisline.bottom() + offset;
-    int r = tx + thisline.right() + offset;
-    
-    // left edge
-    drawBorder(graphicsContext,
-               l - ow,
-               t - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.right() - 1) <= thisline.x() ? ow : 0),
-               l,
-               b + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.right() - 1) <= thisline.x() ? ow : 0),
-               BSLeft,
-               oc, style()->color(), os,
-               (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.right() - 1) <= thisline.x() ? ow : -ow),
-               (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.right() - 1) <= thisline.x() ? ow : -ow));
-    
-    // right edge
-    drawBorder(graphicsContext,
-               r,
-               t - (lastline.isEmpty() || lastline.right() < thisline.right() || (thisline.right() - 1) <= lastline.x() ? ow : 0),
-               r + ow,
-               b + (nextline.isEmpty() || nextline.right() <= thisline.right() || (thisline.right() - 1) <= nextline.x() ? ow : 0),
-               BSRight,
-               oc, style()->color(), os,
-               (lastline.isEmpty() || lastline.right() < thisline.right() || (thisline.right() - 1) <= lastline.x() ? ow : -ow),
-               (nextline.isEmpty() || nextline.right() <= thisline.right() || (thisline.right() - 1) <= nextline.x() ? ow : -ow));
-    // upper edge
-    if (thisline.x() < lastline.x())
-        drawBorder(graphicsContext,
-                   l - ow,
-                   t - ow,
-                   min(r+ow, (lastline.isEmpty() ? 1000000 : tx + lastline.x())),
-                   t ,
-                   BSTop, oc, style()->color(), os,
-                   ow,
-                   (!lastline.isEmpty() && tx + lastline.x() + 1 < r + ow) ? -ow : ow);
-    
-    if (lastline.right() < thisline.right())
-        drawBorder(graphicsContext,
-                   max(lastline.isEmpty() ? -1000000 : tx + lastline.right(), l - ow),
-                   t - ow,
-                   r + ow,
-                   t ,
-                   BSTop, oc, style()->color(), os,
-                   (!lastline.isEmpty() && l - ow < tx + lastline.right()) ? -ow : ow,
-                   ow);
-    
-    // lower edge
-    if (thisline.x() < nextline.x())
-        drawBorder(graphicsContext,
-                   l - ow,
-                   b,
-                   min(r + ow, !nextline.isEmpty() ? tx + nextline.x() + 1 : 1000000),
-                   b + ow,
-                   BSBottom, oc, style()->color(), os,
-                   ow,
-                   (!nextline.isEmpty() && tx + nextline.x() + 1 < r + ow) ? -ow : ow);
-    
-    if (nextline.right() < thisline.right())
-        drawBorder(graphicsContext,
-                   max(!nextline.isEmpty() ? tx + nextline.right() : -1000000, l - ow),
-                   b,
-                   r + ow,
-                   b + ow,
-                   BSBottom, oc, style()->color(), os,
-                   (!nextline.isEmpty() && l - ow < tx + nextline.right()) ? -ow : ow,
-                   ow);
-}
-
-void RenderFlow::calcMargins(int containerWidth)
-{
-    m_marginLeft = style()->marginLeft().calcMinValue(containerWidth);
-    m_marginRight = style()->marginRight().calcMinValue(containerWidth);
-}
-
-#ifndef NDEBUG
-
-void RenderFlow::checkConsistency() const
-{
-#ifdef CHECK_CONSISTENCY
-    const InlineFlowBox* prev = 0;
-    for (const InlineFlowBox* child = m_firstLineBox; child != 0; child = child->nextFlowBox()) {
-        ASSERT(child->object() == this);
-        ASSERT(child->prevFlowBox() == prev);
-        prev = child;
-    }
-    ASSERT(prev == m_lastLineBox);
-#endif
-}
-
-#endif
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFlow.h b/src/3rdparty/webkit/WebCore/rendering/RenderFlow.h
deleted file mode 100644
index 7e3a345d56..0000000000
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFlow.h
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef RenderFlow_h
-#define RenderFlow_h
-
-#include "RenderContainer.h"
-
-namespace WebCore {
-
-/**
- * all geometry managing stuff is only in the block elements.
- *
- * Inline elements don't layout themselves, but the whole paragraph
- * gets flowed by the surrounding block element. This is, because
- * one needs to know the whole paragraph to calculate bidirectional
- * behaviour of text, so putting the layouting routines in the inline
- * elements is impossible.
- */
-class RenderFlow : public RenderContainer {
-public:
-    RenderFlow(Node* node)
-        : RenderContainer(node)
-        , m_continuation(0)
-        , m_firstLineBox(0)
-        , m_lastLineBox(0)
-        , m_lineHeight(-1)
-        , m_childrenInline(true)
-        , m_firstLine(false)
-        , m_topMarginQuirk(false) 
-        , m_bottomMarginQuirk(false)
-        , m_hasMarkupTruncation(false)
-        , m_selectionState(SelectionNone)
-        , m_hasColumns(false)
-        , m_isContinuation(false)
-    {
-    }
-#ifndef NDEBUG
-    virtual ~RenderFlow();
-#endif
-
-    virtual RenderFlow* continuation() const { return m_continuation; }
-    void setContinuation(RenderFlow* c) { m_continuation = c; }
-    RenderFlow* continuationBefore(RenderObject* beforeChild);
-
-    void addChildWithContinuation(RenderObject* newChild, RenderObject* beforeChild);
-    virtual void addChildToFlow(RenderObject* newChild, RenderObject* beforeChild) = 0;
-    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
-
-    static RenderFlow* createAnonymousFlow(Document*, PassRefPtr<RenderStyle>);
-
-    void extractLineBox(InlineFlowBox*);
-    void attachLineBox(InlineFlowBox*);
-    void removeLineBox(InlineFlowBox*);
-    void deleteLineBoxes();
-    virtual void destroy();
-
-    virtual void dirtyLinesFromChangedChild(RenderObject* child);
-
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
-
-    InlineFlowBox* firstLineBox() const { return m_firstLineBox; }
-    InlineFlowBox* lastLineBox() const { return m_lastLineBox; }
-
-    virtual InlineBox* createInlineBox(bool makePlaceHolderBox, bool isRootLineBox, bool isOnlyRun=false);
-    virtual void dirtyLineBoxes(bool fullLayout, bool isRootLineBox = false);
-
-    void paintLines(PaintInfo&, int tx, int ty);
-    bool hitTestLines(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-
-    virtual IntRect absoluteClippedOverflowRect();
-
-    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-
-    virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
-
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
-    void paintOutlineForLine(GraphicsContext*, int tx, int ty, const IntRect& prevLine, const IntRect& thisLine, const IntRect& nextLine);
-    void paintOutline(GraphicsContext*, int tx, int ty);
-
-    virtual bool hasColumns() const { return m_hasColumns; }
-
-    void calcMargins(int containerWidth);
-
-    void checkConsistency() const;
-
-private:
-    // An inline can be split with blocks occurring in between the inline content.
-    // When this occurs we need a pointer to our next object.  We can basically be
-    // split into a sequence of inlines and blocks.  The continuation will either be
-    // an anonymous block (that houses other blocks) or it will be an inline flow.
-    RenderFlow* m_continuation;
-
-protected:
-    // For block flows, each box represents the root inline box for a line in the
-    // paragraph.
-    // For inline flows, each box represents a portion of that inline.
-    InlineFlowBox* m_firstLineBox;
-    InlineFlowBox* m_lastLineBox;
-
-    mutable int m_lineHeight;
-    
-    // These bitfields are moved here from subclasses to pack them together
-    // from RenderBlock
-    bool m_childrenInline : 1;
-    bool m_firstLine : 1;
-    bool m_topMarginQuirk : 1;
-    bool m_bottomMarginQuirk : 1;
-    bool m_hasMarkupTruncation : 1;
-    unsigned m_selectionState : 3; // SelectionState
-    bool m_hasColumns : 1;
-    
-    // from RenderInline
-    bool m_isContinuation : 1; // Whether or not we're a continuation of an inline.
-};
-
-#ifdef NDEBUG
-inline void RenderFlow::checkConsistency() const
-{
-}
-#endif
-
-} // namespace WebCore
-
-#endif // RenderFlow_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp
index 83401fcca4..b15d55c347 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.cpp
@@ -1,7 +1,6 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2009 Google, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,6 +28,7 @@
 #include "RenderView.h"
 #include "SVGForeignObjectElement.h"
 #include "SVGLength.h"
+#include "SVGRenderSupport.h"
 #include "SVGTransformList.h"
 
 namespace WebCore {
@@ -38,93 +38,84 @@ RenderForeignObject::RenderForeignObject(SVGForeignObjectElement* node)
 {
 }
 
-TransformationMatrix RenderForeignObject::translationForAttributes()
+TransformationMatrix RenderForeignObject::translationForAttributes() const
 {
-    SVGForeignObjectElement* foreign = static_cast<SVGForeignObjectElement*>(element());
+    SVGForeignObjectElement* foreign = static_cast<SVGForeignObjectElement*>(node());
     return TransformationMatrix().translate(foreign->x().value(foreign), foreign->y().value(foreign));
 }
 
-void RenderForeignObject::paint(PaintInfo& paintInfo, int parentX, int parentY)
+void RenderForeignObject::paint(PaintInfo& paintInfo, int, int)
 {
     if (paintInfo.context->paintingDisabled())
         return;
 
-    paintInfo.context->save();
-    paintInfo.context->concatCTM(TransformationMatrix().translate(parentX, parentY));
-    paintInfo.context->concatCTM(localTransform());
-    paintInfo.context->concatCTM(translationForAttributes());
-    paintInfo.context->clip(getClipRect(parentX, parentY));
+    // Copy the paint info so that modifications to the damage rect do not affect callers
+    PaintInfo childPaintInfo = paintInfo;
+    childPaintInfo.context->save();
+    applyTransformToPaintInfo(childPaintInfo, localToParentTransform());
+    childPaintInfo.context->clip(clipRect(0, 0));
 
     float opacity = style()->opacity();
     if (opacity < 1.0f)
-        // FIXME: Possible optimization by clipping to bbox here, once relativeBBox is implemented & clip, mask and filter support added.
-        paintInfo.context->beginTransparencyLayer(opacity);
+        childPaintInfo.context->beginTransparencyLayer(opacity);
 
-    PaintInfo pi(paintInfo);
-    pi.rect = absoluteTransform().inverse().mapRect(paintInfo.rect);
-    RenderBlock::paint(pi, 0, 0);
+    RenderBlock::paint(childPaintInfo, 0, 0);
 
     if (opacity < 1.0f)
-        paintInfo.context->endTransparencyLayer();
+        childPaintInfo.context->endTransparencyLayer();
 
-    paintInfo.context->restore();
+    childPaintInfo.context->restore();
 }
 
-void RenderForeignObject::computeAbsoluteRepaintRect(IntRect& r, bool f)
+FloatRect RenderForeignObject::objectBoundingBox() const
 {
-    TransformationMatrix transform = translationForAttributes() * localTransform();
-    r = transform.mapRect(r);
+    return borderBoxRect();
+}
 
-    RenderBlock::computeAbsoluteRepaintRect(r, f);
+FloatRect RenderForeignObject::repaintRectInLocalCoordinates() const
+{
+    // HACK: to maintain historical LayoutTest results for now.
+    // RenderForeignObject is a RenderBlock (not a RenderSVGModelObject) so this
+    // should not affect repaint correctness.  But it should really be:
+    // return borderBoxRect();
+    return FloatRect();
 }
 
-bool RenderForeignObject::requiresLayer()
+void RenderForeignObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed)
 {
-    return false;
+    rect = localToParentTransform().mapRect(rect);
+    RenderBlock::computeRectForRepaint(repaintContainer, rect, fixed);
 }
 
-bool RenderForeignObject::calculateLocalTransform()
+TransformationMatrix RenderForeignObject::localToParentTransform() const
 {
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGForeignObjectElement*>(element())->animatedLocalTransform();
-    return (oldTransform != m_localTransform);
+    return localTransform() * translationForAttributes();
 }
 
 void RenderForeignObject::layout()
 {
     ASSERT(needsLayout());
+    ASSERT(!view()->layoutStateEnabled()); // RenderSVGRoot disables layoutState for the SVG rendering tree.
 
-    // Arbitrary affine transforms are incompatible with LayoutState.
-    view()->disableLayoutState();
-
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout();
-    if (checkForRepaint) {
-        oldBounds = m_absoluteBounds;
-        oldOutlineBox = absoluteOutlineBounds();
-    }
-    
-    calculateLocalTransform();
-    
-    RenderBlock::layout();
-
-    m_absoluteBounds = absoluteClippedOverflowRect();
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+    m_localTransform = static_cast<SVGForeignObjectElement*>(node())->animatedLocalTransform();
 
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
+    RenderBlock::layout();
+    repainter.repaintAfterLayout();
 
-    view()->enableLayoutState();
     setNeedsLayout(false);
 }
 
-bool RenderForeignObject::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
+bool RenderForeignObject::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
-    TransformationMatrix totalTransform = absoluteTransform();
-    totalTransform *= translationForAttributes();
-    double localX, localY;
-    totalTransform.inverse().map(x, y, &localX, &localY);
-    return RenderBlock::nodeAtPoint(request, result, static_cast<int>(localX), static_cast<int>(localY), tx, ty, hitTestAction);
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+    return RenderBlock::nodeAtPoint(request, result, static_cast<int>(localPoint.x()), static_cast<int>(localPoint.y()), 0, 0, hitTestAction);
+}
+
+bool RenderForeignObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h
index c7f30e97dc..8fdb816787 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderForeignObject.h
@@ -1,7 +1,6 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2009 Google, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,20 +38,24 @@ public:
 
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
-    virtual TransformationMatrix localTransform() const { return m_localTransform; }
-    virtual bool calculateLocalTransform();
+    virtual TransformationMatrix localToParentTransform() const;
 
-    virtual void computeAbsoluteRepaintRect(IntRect&, bool fixed);
-    virtual bool requiresLayer();
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+    virtual bool requiresLayer() const { return false; }
     virtual void layout();
 
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
  private:
-    TransformationMatrix translationForAttributes();
+    TransformationMatrix translationForAttributes() const;
+
+    virtual TransformationMatrix localTransform() const { return m_localTransform; }
 
     TransformationMatrix m_localTransform;
-    IntRect m_absoluteBounds;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp
index 15bd24ee41..a7b131b2b6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.cpp
@@ -1,10 +1,8 @@
-/**
- * This file is part of the KDE project.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,15 +23,12 @@
 
 #include "config.h"
 #include "RenderFrame.h"
-#include "RenderFrameSet.h"
+
 #include "FrameView.h"
-#include "HTMLFrameSetElement.h"
-#include "HTMLNames.h"
+#include "HTMLFrameElement.h"
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
 RenderFrame::RenderFrame(HTMLFrameElement* frame)
     : RenderPart(frame)
 {
@@ -42,21 +37,25 @@ RenderFrame::RenderFrame(HTMLFrameElement* frame)
 
 FrameEdgeInfo RenderFrame::edgeInfo() const
 {
-    return FrameEdgeInfo(element()->noResize(), element()->hasFrameBorder());
+    HTMLFrameElement* element = static_cast<HTMLFrameElement*>(node());
+    return FrameEdgeInfo(element->noResize(), element->hasFrameBorder());
 }
 
 void RenderFrame::viewCleared()
 {
-    if (element() && m_widget && m_widget->isFrameView()) {
-        FrameView* view = static_cast<FrameView*>(m_widget);
-        int marginw = element()->getMarginWidth();
-        int marginh = element()->getMarginHeight();
-
-        if (marginw != -1)
-            view->setMarginWidth(marginw);
-        if (marginh != -1)
-            view->setMarginHeight(marginh);
-    }
+    HTMLFrameElement* element = static_cast<HTMLFrameElement*>(node());
+    if (!element || !widget() || !widget()->isFrameView())
+        return;
+
+    FrameView* view = static_cast<FrameView*>(widget());
+
+    int marginw = element->getMarginWidth();
+    int marginh = element->getMarginHeight();
+
+    if (marginw != -1)
+        view->setMarginWidth(marginw);
+    if (marginh != -1)
+        view->setMarginHeight(marginh);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h
index 49aedd3506..2716e14fbd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,23 +23,23 @@
 #ifndef RenderFrame_h
 #define RenderFrame_h
 
-#include "HTMLFrameElement.h"
 #include "RenderPart.h"
 #include "RenderFrameSet.h"
 
 namespace WebCore {
 
+class HTMLFrameElement;
+
 class RenderFrame : public RenderPart {
 public:
     RenderFrame(HTMLFrameElement*);
 
+    FrameEdgeInfo edgeInfo() const;
+
+private:
     virtual const char* renderName() const { return "RenderFrame"; }
     virtual bool isFrame() const { return true; }
 
-    HTMLFrameElement* element() const { return static_cast<HTMLFrameElement*>(RenderPart::element()); }
-
-    FrameEdgeInfo edgeInfo() const;
-
     virtual void viewCleared();
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
index d93fa86ff0..59951175b4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
@@ -42,7 +42,7 @@
 namespace WebCore {
 
 RenderFrameSet::RenderFrameSet(HTMLFrameSetElement* frameSet)
-    : RenderContainer(frameSet)
+    : RenderBox(frameSet)
     , m_isResizing(false)
     , m_isChildResizing(false)
 {
@@ -126,8 +126,8 @@ void RenderFrameSet::paint(PaintInfo& paintInfo, int tx, int ty)
         return;
 
     // Add in our offsets.
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
 
     int rows = frameSet()->totalRows();
     int cols = frameSet()->totalCols();
@@ -161,11 +161,11 @@ bool RenderFrameSet::nodeAtPoint(const HitTestRequest& request, HitTestResult& r
     if (action != HitTestForeground)
         return false;
 
-    bool inside = RenderContainer::nodeAtPoint(request, result, x, y, tx, ty, action)
-        || m_isResizing || canResize(IntPoint(x, y));
+    bool inside = RenderBox::nodeAtPoint(request, result, x, y, tx, ty, action)
+        || m_isResizing;
 
     if (inside && frameSet()->noResize()
-            && !request.readonly && !result.innerNode()) {
+            && !request.readOnly() && !result.innerNode()) {
         result.setInnerNode(node());
         result.setInnerNonSharedNode(node());
     }
@@ -457,8 +457,8 @@ void RenderFrameSet::layout()
         oldBounds = absoluteClippedOverflowRect();
 
     if (!parent()->isFrameSet() && !document()->printing()) {
-        m_width = view()->viewWidth();
-        m_height = view()->viewHeight();
+        setWidth(view()->viewWidth());
+        setHeight(view()->viewHeight());
     }
 
     size_t cols = frameSet()->totalCols();
@@ -470,12 +470,12 @@ void RenderFrameSet::layout()
     }
 
     int borderThickness = frameSet()->border();
-    layOutAxis(m_rows, frameSet()->rowLengths(), m_height - (rows - 1) * borderThickness);
-    layOutAxis(m_cols, frameSet()->colLengths(), m_width - (cols - 1) * borderThickness);
+    layOutAxis(m_rows, frameSet()->rowLengths(), height() - (rows - 1) * borderThickness);
+    layOutAxis(m_cols, frameSet()->colLengths(), width() - (cols - 1) * borderThickness);
 
     positionFrames();
 
-    RenderContainer::layout();
+    RenderBox::layout();
 
     computeEdgeInfo();
 
@@ -491,7 +491,7 @@ void RenderFrameSet::layout()
 
 void RenderFrameSet::positionFrames()
 {
-    RenderObject* child = firstChild();
+    RenderBox* child = firstChildBox();
     if (!child)
         return;
 
@@ -504,7 +504,7 @@ void RenderFrameSet::positionFrames()
         int xPos = 0;
         int height = m_rows.m_sizes[r];
         for (int c = 0; c < cols; c++) {
-            child->setPos(xPos, yPos);
+            child->setLocation(xPos, yPos);
             int width = m_cols.m_sizes[c];
 
             // has to be resized and itself resize its contents
@@ -517,7 +517,7 @@ void RenderFrameSet::positionFrames()
 
             xPos += width + borderThickness;
 
-            child = child->nextSibling();
+            child = child->nextSiblingBox();
             if (!child)
                 return;
         }
@@ -525,7 +525,7 @@ void RenderFrameSet::positionFrames()
     }
 
     // all the remaining frames are hidden to avoid ugly spurious unflowed frames
-    for (; child; child = child->nextSibling()) {
+    for (; child; child = child->nextSiblingBox()) {
         child->setWidth(0);
         child->setHeight(0);
         child->setNeedsLayout(false);
@@ -564,8 +564,9 @@ bool RenderFrameSet::userResize(MouseEvent* evt)
         if (needsLayout())
             return false;
         if (evt->type() == eventNames().mousedownEvent && evt->button() == LeftButton) {
-            startResizing(m_cols, evt->pageX() - xPos());
-            startResizing(m_rows, evt->pageY() - yPos());
+            FloatPoint pos = localToAbsolute();
+            startResizing(m_cols, evt->absoluteLocation().x() - pos.x());
+            startResizing(m_rows, evt->absoluteLocation().y() - pos.y());
             if (m_cols.m_splitBeingResized != noSplit || m_rows.m_splitBeingResized != noSplit) {
                 setIsResizing(true);
                 return true;
@@ -573,8 +574,9 @@ bool RenderFrameSet::userResize(MouseEvent* evt)
         }
     } else {
         if (evt->type() == eventNames().mousemoveEvent || (evt->type() == eventNames().mouseupEvent && evt->button() == LeftButton)) {
-            continueResizing(m_cols, evt->pageX() - xPos());
-            continueResizing(m_rows, evt->pageY() - yPos());
+            FloatPoint pos = localToAbsolute();
+            continueResizing(m_cols, evt->absoluteLocation().x() - pos.x());
+            continueResizing(m_rows, evt->absoluteLocation().y() - pos.y());
             if (evt->type() == eventNames().mouseupEvent && evt->button() == LeftButton) {
                 setIsResizing(false);
                 return true;
@@ -605,11 +607,6 @@ bool RenderFrameSet::isResizingColumn() const
     return m_isResizing && m_cols.m_splitBeingResized != noSplit;
 }
 
-bool RenderFrameSet::canResize(const IntPoint& p) const
-{
-    return hitTestSplit(m_cols, p.x()) != noSplit || hitTestSplit(m_rows, p.y()) != noSplit;
-}
-
 bool RenderFrameSet::canResizeRow(const IntPoint& p) const
 {
     int r = hitTestSplit(m_rows, p.y());
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
index 5401c1b798..294e5df71f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
@@ -23,7 +23,7 @@
 #ifndef RenderFrameSet_h
 #define RenderFrameSet_h
 
-#include "RenderContainer.h"
+#include "RenderBox.h"
 
 namespace WebCore {
 
@@ -53,11 +53,16 @@ private:
     Vector<bool> m_allowBorder;
 };
 
-class RenderFrameSet : public RenderContainer {
+class RenderFrameSet : public RenderBox {
 public:
     RenderFrameSet(HTMLFrameSetElement*);
     virtual ~RenderFrameSet();
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
     virtual const char* renderName() const { return "RenderFrameSet"; }
     virtual bool isFrameSet() const { return true; }
 
@@ -93,7 +98,6 @@ private:
 
     inline HTMLFrameSetElement* frameSet() const;
 
-    bool canResize(const IntPoint&) const;
     void setIsResizing(bool);
 
     void layOutAxis(GridAxis&, const Length*, int availableSpace);
@@ -110,6 +114,8 @@ private:
     void paintRowBorder(const PaintInfo& paintInfo, const IntRect& rect);
     void paintColumnBorder(const PaintInfo& paintInfo, const IntRect& rect);
 
+    RenderObjectChildList m_children;
+
     GridAxis m_rows;
     GridAxis m_cols;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp
index cc8c2c19bf..1fc07f0348 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -31,6 +31,7 @@
 #include "HTMLCanvasElement.h"
 #include "HTMLNames.h"
 #include "RenderView.h"
+#include "FrameView.h"
 
 namespace WebCore {
 
@@ -39,32 +40,33 @@ using namespace HTMLNames;
 RenderHTMLCanvas::RenderHTMLCanvas(HTMLCanvasElement* element)
     : RenderReplaced(element, element->size())
 {
+    view()->frameView()->setIsVisuallyNonEmpty();
 }
 
 void RenderHTMLCanvas::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 {
-    IntRect rect = contentBox();
+    IntRect rect = contentBoxRect();
     rect.move(tx, ty);
     static_cast<HTMLCanvasElement*>(node())->paint(paintInfo.context, rect);
 }
 
 void RenderHTMLCanvas::canvasSizeChanged()
 {
-    IntSize size = static_cast<HTMLCanvasElement*>(node())->size();
-    IntSize zoomedSize(size.width() * style()->effectiveZoom(), size.height() * style()->effectiveZoom());
+    IntSize canvasSize = static_cast<HTMLCanvasElement*>(node())->size();
+    IntSize zoomedSize(canvasSize.width() * style()->effectiveZoom(), canvasSize.height() * style()->effectiveZoom());
 
-    if (size == intrinsicSize())
+    if (canvasSize == intrinsicSize())
         return;
 
-    setIntrinsicSize(size);
+    setIntrinsicSize(canvasSize);
 
     if (!prefWidthsDirty())
         setPrefWidthsDirty(true);
 
-    IntSize oldSize = IntSize(m_width, m_height);
+    IntSize oldSize = size();
     calcWidth();
     calcHeight();
-    if (oldSize == IntSize(m_width, m_height))
+    if (oldSize == size())
         return;
 
     if (!selfNeedsLayout())
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
index fc6f19bf6b..56ad490187 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
@@ -37,7 +37,8 @@
 #include "HitTestResult.h"
 #include "Page.h"
 #include "RenderView.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(WML)
 #include "WMLImageElement.h"
@@ -281,21 +282,21 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
         // layout when we get added in to the render tree hierarchy later.
         if (containingBlock()) {
             // lets see if we need to relayout at all..
-            int oldwidth = m_width;
-            int oldheight = m_height;
+            int oldwidth = width();
+            int oldheight = height();
             if (!prefWidthsDirty())
                 setPrefWidthsDirty(true);
             calcWidth();
             calcHeight();
 
-            if (imageSizeChanged || m_width != oldwidth || m_height != oldheight) {
+            if (imageSizeChanged || width() != oldwidth || height() != oldheight) {
                 shouldRepaint = false;
                 if (!selfNeedsLayout())
                     setNeedsLayout(true);
             }
 
-            m_width = oldwidth;
-            m_height = oldheight;
+            setWidth(oldwidth);
+            setHeight(oldheight);
         }
     }
 
@@ -304,16 +305,39 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
         if (rect) {
             // The image changed rect is in source image coordinates (pre-zooming),
             // so map from the bounds of the image to the contentsBox.
-            repaintRect = enclosingIntRect(mapRect(*rect, FloatRect(FloatPoint(), imageSize(1.0f)), contentBox()));
+            repaintRect = enclosingIntRect(mapRect(*rect, FloatRect(FloatPoint(), imageSize(1.0f)), contentBoxRect()));
             // Guard against too-large changed rects.
-            repaintRect.intersect(contentBox());
+            repaintRect.intersect(contentBoxRect());
         } else
-            repaintRect = contentBox();
+            repaintRect = contentBoxRect();
         
         repaintRectangle(repaintRect);
+
+#if USE(ACCELERATED_COMPOSITING)
+        if (hasLayer()) {
+            // Tell any potential compositing layers that the image needs updating.
+            layer()->rendererContentChanged();
+        }
+#endif
     }
 }
 
+void RenderImage::notifyFinished(CachedResource* newImage)
+{
+    if (documentBeingDestroyed())
+        return;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if ((newImage == m_cachedImage) && hasLayer()) {
+        // tell any potential compositing layers
+        // that the image is done and they can reference it directly.
+        layer()->rendererContentChanged();
+    }
+#else
+    UNUSED_PARAM(newImage);
+#endif
+}
+    
 void RenderImage::resetAnimation()
 {
     if (m_cachedImage) {
@@ -371,9 +395,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
             }
 
             if (!m_altText.isEmpty()) {
-                String text = m_altText;
-                text.replace('\\', backslashAsCurrencySymbol());
-                context->setFont(style()->font());
+                String text = document()->displayStringModifiedByEncoding(m_altText);
                 context->setFillColor(style()->color());
                 int ax = tx + leftBorder + leftPad;
                 int ay = ty + topBorder + topPad;
@@ -386,9 +408,9 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
                 int textWidth = font.width(textRun);
                 if (errorPictureDrawn) {
                     if (usableWidth >= textWidth && font.height() <= imageY)
-                        context->drawText(textRun, IntPoint(ax, ay + ascent));
+                        context->drawText(style()->font(), textRun, IntPoint(ax, ay + ascent));
                 } else if (usableWidth >= textWidth && cHeight >= font.height())
-                    context->drawText(textRun, IntPoint(ax, ay + ascent));
+                    context->drawText(style()->font(), textRun, IntPoint(ax, ay + ascent));
             }
         }
     } else if (hasImage() && cWidth > 0 && cHeight > 0) {
@@ -398,13 +420,13 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 
 #if PLATFORM(MAC)
         if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
-            paintCustomHighlight(tx - m_x, ty - m_y, style()->highlight(), true);
+            paintCustomHighlight(tx - x(), ty - y(), style()->highlight(), true);
 #endif
 
         IntSize contentSize(cWidth, cHeight);
         bool useLowQualityScaling = RenderImageScaleObserver::shouldImagePaintAtLowQuality(this, contentSize);
         IntRect rect(IntPoint(tx + leftBorder + leftPad, ty + topBorder + topPad), contentSize);
-        HTMLImageElement* imageElt = (element() && element()->hasTagName(imgTag)) ? static_cast<HTMLImageElement*>(element()) : 0;
+        HTMLImageElement* imageElt = (node() && node()->hasTagName(imgTag)) ? static_cast<HTMLImageElement*>(node()) : 0;
         CompositeOperator compositeOperator = imageElt ? imageElt->compositeOperator() : CompositeSourceOver;
         context->drawImage(image(cWidth, cHeight), rect, compositeOperator, useLowQualityScaling);
     }
@@ -417,41 +439,44 @@ int RenderImage::minimumReplacedHeight() const
 
 HTMLMapElement* RenderImage::imageMap()
 {
-    HTMLImageElement* i = element() && element()->hasTagName(imgTag) ? static_cast<HTMLImageElement*>(element()) : 0;
+    HTMLImageElement* i = node() && node()->hasTagName(imgTag) ? static_cast<HTMLImageElement*>(node()) : 0;
     return i ? i->document()->getImageMap(i->useMap()) : 0;
 }
 
 bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
 {
-    bool inside = RenderReplaced::nodeAtPoint(request, result, _x, _y, _tx, _ty, hitTestAction);
+    HitTestResult tempResult(result.point());
+    bool inside = RenderReplaced::nodeAtPoint(request, tempResult, _x, _y, _tx, _ty, hitTestAction);
 
-    if (inside && element()) {
-        int tx = _tx + m_x;
-        int ty = _ty + m_y;
+    if (inside && node()) {
+        int tx = _tx + x();
+        int ty = _ty + y();
         
         HTMLMapElement* map = imageMap();
         if (map) {
             // we're a client side image map
-            inside = map->mapMouseEvent(_x - tx, _y - ty, IntSize(contentWidth(), contentHeight()), result);
-            result.setInnerNonSharedNode(element());
+            inside = map->mapMouseEvent(_x - tx, _y - ty, IntSize(contentWidth(), contentHeight()), tempResult);
+            tempResult.setInnerNonSharedNode(node());
         }
     }
 
+    if (inside)
+        result = tempResult;
     return inside;
 }
 
 void RenderImage::updateAltText()
 {
-    if (!element())
+    if (!node())
         return;
 
-    if (element()->hasTagName(inputTag))
-        m_altText = static_cast<HTMLInputElement*>(element())->altText();
-    else if (element()->hasTagName(imgTag))
-        m_altText = static_cast<HTMLImageElement*>(element())->altText();
+    if (node()->hasTagName(inputTag))
+        m_altText = static_cast<HTMLInputElement*>(node())->altText();
+    else if (node()->hasTagName(imgTag))
+        m_altText = static_cast<HTMLImageElement*>(node())->altText();
 #if ENABLE(WML)
-    else if (element()->hasTagName(WMLNames::imgTag))
-        m_altText = static_cast<WMLImageElement*>(element())->altText();
+    else if (node()->hasTagName(WMLNames::imgTag))
+        m_altText = static_cast<WMLImageElement*>(node())->altText();
 #endif
 }
 
@@ -492,8 +517,10 @@ bool RenderImage::isHeightSpecified() const
 int RenderImage::calcReplacedWidth(bool includeMaxWidth) const
 {
     if (imageHasRelativeWidth())
-        if (RenderObject* cb = isPositioned() ? container() : containingBlock())
-            setImageContainerSize(IntSize(cb->availableWidth(), cb->availableHeight()));
+        if (RenderObject* cb = isPositioned() ? container() : containingBlock()) {
+            if (cb->isBox())
+                setImageContainerSize(IntSize(toRenderBox(cb)->availableWidth(), toRenderBox(cb)->availableHeight()));
+        }
 
     int width;
     if (isWidthSpecified())
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.h b/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
index 71896d6212..042452f9bb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
@@ -48,6 +48,7 @@ public:
     virtual int minimumReplacedHeight() const;
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
+    virtual void notifyFinished(CachedResource*);
     
     bool setImageSizeForAltText(CachedImage* newImage = 0);
 
@@ -102,6 +103,21 @@ protected:
     friend class RenderImageScaleObserver;
 };
 
+inline RenderImage* toRenderImage(RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderImage());
+    return static_cast<RenderImage*>(o);
+}
+
+inline const RenderImage* toRenderImage(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderImage());
+    return static_cast<const RenderImage*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderImage(const RenderImage*);
+
 } // namespace WebCore
 
 #endif // RenderImage_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImageGeneratedContent.h b/src/3rdparty/webkit/WebCore/rendering/RenderImageGeneratedContent.h
index cab0192c2c..9f8330d817 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImageGeneratedContent.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImageGeneratedContent.h
@@ -27,16 +27,14 @@
 #define RenderImageGeneratedContent_h
 
 #include "RenderImage.h"
+#include "StyleImage.h"
 #include <wtf/RefPtr.h>
 
-#include "RenderStyle.h"
-
 namespace WebCore {
 
 class StyleImage;
 
-class RenderImageGeneratedContent : public RenderImage
-{
+class RenderImageGeneratedContent : public RenderImage {
 public:
     RenderImageGeneratedContent(Node*);
     virtual ~RenderImageGeneratedContent();
@@ -53,12 +51,14 @@ protected:
     virtual bool imageHasRelativeWidth() const { return m_styleImage->imageHasRelativeWidth(); }
     virtual bool imageHasRelativeHeight() const { return m_styleImage->imageHasRelativeHeight(); }
     virtual IntSize imageSize(float multiplier) const { return m_styleImage->imageSize(this, multiplier); }
-    virtual WrappedImagePtr imagePtr() const { return m_styleImage->data(); }
+    
+    // |m_styleImage| can be 0 if we get a callback for a background image from RenderObject::setStyle.
+    virtual WrappedImagePtr imagePtr() const { return m_styleImage ? m_styleImage->data() : 0; }
 
 private:
     RefPtr<StyleImage> m_styleImage;
 };
 
-}
+} // namespace WebCore
 
-#endif
+#endif // RenderImageGeneratedContent_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
index 40e5029ee0..3965d94f9f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
@@ -25,28 +25,95 @@
 #include "config.h"
 #include "RenderInline.h"
 
-#include "Document.h"
+#include "FloatQuad.h"
+#include "GraphicsContext.h"
+#include "HitTestResult.h"
+#include "Page.h"
 #include "RenderArena.h"
 #include "RenderBlock.h"
+#include "RenderView.h"
 #include "VisiblePosition.h"
 
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Frame.h"
+#endif
+
+using namespace std;
+
 namespace WebCore {
 
 RenderInline::RenderInline(Node* node)
-    : RenderFlow(node)
+    : RenderBoxModelObject(node)
+    , m_continuation(0)
+    , m_lineHeight(-1)
+    , m_verticalPosition(PositionUndefined)
 {
+    setChildrenInline(true);
 }
 
 RenderInline::~RenderInline()
 {
 }
 
-void RenderInline::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderInline::destroy()
+{
+    // Detach our continuation first.
+    if (m_continuation)
+        m_continuation->destroy();
+    m_continuation = 0;
+    
+    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
+    // properly dirty line boxes that they are removed from.  Effects that do :before/:after only on hover could crash otherwise.
+    children()->destroyLeftoverChildren();
+
+    if (!documentBeingDestroyed()) {
+        if (firstLineBox()) {
+            // We can't wait for RenderBoxModelObject::destroy to clear the selection,
+            // because by then we will have nuked the line boxes.
+            // FIXME: The SelectionController should be responsible for this when it
+            // is notified of DOM mutations.
+            if (isSelectionBorder())
+                view()->clearSelection();
+
+            // If line boxes are contained inside a root, that means we're an inline.
+            // In that case, we need to remove all the line boxes so that the parent
+            // lines aren't pointing to deleted children. If the first line box does
+            // not have a parent that means they are either already disconnected or
+            // root lines that can just be destroyed without disconnecting.
+            if (firstLineBox()->parent()) {
+                for (InlineRunBox* box = firstLineBox(); box; box = box->nextLineBox())
+                    box->remove();
+            }
+        } else if (isInline() && parent())
+            parent()->dirtyLinesFromChangedChild(this);
+    }
+
+    m_lineBoxes.deleteLineBoxes(renderArena());
+
+    RenderBoxModelObject::destroy();
+}
+
+RenderInline* RenderInline::inlineContinuation() const
+{
+    if (!m_continuation || m_continuation->isInline())
+        return toRenderInline(m_continuation);
+    return toRenderBlock(m_continuation)->inlineContinuation();
+}
+
+void RenderInline::updateBoxModelInfoFromStyle()
 {
-    RenderFlow::styleDidChange(diff, oldStyle);
+    RenderBoxModelObject::updateBoxModelInfoFromStyle();
 
-    setInline(true);
-    setHasReflection(false);
+    setInline(true); // Needed for run-ins, since run-in is considered a block display type.
+
+    // FIXME: Support transforms and reflections on inline flows someday.
+    setHasTransform(false);
+    setHasReflection(false);    
+}
+
+void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBoxModelObject::styleDidChange(diff, oldStyle);
 
     // Ensure that all of the split inlines pick up the new style. We
     // only do this if we're an inline, since we don't want to propagate
@@ -54,36 +121,27 @@ void RenderInline::styleDidChange(RenderStyle::Diff diff, const RenderStyle* old
     // e.g., <font>foo <h4>goo</h4> moo</font>.  The <font> inlines before
     // and after the block share the same style, but the block doesn't
     // need to pass its style on to anyone else.
-    RenderFlow* currCont = continuation();
-    while (currCont) {
-        if (currCont->isInline()) {
-            RenderFlow* nextCont = currCont->continuation();
-            currCont->setContinuation(0);
-            currCont->setStyle(style());
-            currCont->setContinuation(nextCont);
-        }
-        currCont = currCont->continuation();
+    for (RenderInline* currCont = inlineContinuation(); currCont; currCont = currCont->inlineContinuation()) {
+        RenderBoxModelObject* nextCont = currCont->continuation();
+        currCont->setContinuation(0);
+        currCont->setStyle(style());
+        currCont->setContinuation(nextCont);
     }
 
     m_lineHeight = -1;
 
     // Update pseudos for :before and :after now.
-    if (!isAnonymous()) {
-        updateBeforeAfterContent(RenderStyle::BEFORE);
-        updateBeforeAfterContent(RenderStyle::AFTER);
+    if (!isAnonymous() && document()->usesBeforeAfterRules()) {
+        children()->updateBeforeAfterContent(this, BEFORE);
+        children()->updateBeforeAfterContent(this, AFTER);
     }
 }
 
-bool RenderInline::isInlineContinuation() const
-{
-    return m_isContinuation;
-}
-
 static inline bool isAfterContent(RenderObject* child)
 {
     if (!child)
         return false;
-    if (child->style()->styleType() != RenderStyle::AFTER)
+    if (child->style()->styleType() != AFTER)
         return false;
     // Text nodes don't have their own styles, so ignore the style on a text node.
     if (child->isText() && !child->isBR())
@@ -91,7 +149,46 @@ static inline bool isAfterContent(RenderObject* child)
     return true;
 }
 
-void RenderInline::addChildToFlow(RenderObject* newChild, RenderObject* beforeChild)
+void RenderInline::addChild(RenderObject* newChild, RenderObject* beforeChild)
+{
+    if (continuation())
+        return addChildToContinuation(newChild, beforeChild);
+    return addChildIgnoringContinuation(newChild, beforeChild);
+}
+
+static RenderBoxModelObject* nextContinuation(RenderObject* renderer)
+{
+    if (renderer->isInline() && !renderer->isReplaced())
+        return toRenderInline(renderer)->continuation();
+    return toRenderBlock(renderer)->inlineContinuation();
+}
+
+RenderBoxModelObject* RenderInline::continuationBefore(RenderObject* beforeChild)
+{
+    if (beforeChild && beforeChild->parent() == this)
+        return this;
+
+    RenderBoxModelObject* curr = nextContinuation(this);
+    RenderBoxModelObject* nextToLast = this;
+    RenderBoxModelObject* last = this;
+    while (curr) {
+        if (beforeChild && beforeChild->parent() == curr) {
+            if (curr->firstChild() == beforeChild)
+                return last;
+            return curr;
+        }
+
+        nextToLast = last;
+        last = curr;
+        curr = nextContinuation(curr);
+    }
+
+    if (!beforeChild && !last->firstChild())
+        return nextToLast;
+    return last;
+}
+
+void RenderInline::addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
     if (!beforeChild && isAfterContent(lastChild()))
@@ -108,14 +205,15 @@ void RenderInline::addChildToFlow(RenderObject* newChild, RenderObject* beforeCh
 
         RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
         newBox->setStyle(newStyle.release());
-        RenderFlow* oldContinuation = continuation();
+        RenderBoxModelObject* oldContinuation = continuation();
         setContinuation(newBox);
 
         // Someone may have put a <p> inside a <q>, causing a split.  When this happens, the :after content
         // has to move into the inline continuation.  Call updateBeforeAfterContent to ensure that our :after
         // content gets properly destroyed.
         bool isLastChild = (beforeChild == lastChild());
-        updateBeforeAfterContent(RenderStyle::AFTER);
+        if (document()->usesBeforeAfterRules())
+            children()->updateBeforeAfterContent(this, AFTER);
         if (isLastChild && beforeChild != lastChild())
             beforeChild = 0; // We destroyed the last child, so now we need to update our insertion
                              // point to be 0.  It's just a straight append now.
@@ -124,22 +222,21 @@ void RenderInline::addChildToFlow(RenderObject* newChild, RenderObject* beforeCh
         return;
     }
 
-    RenderContainer::addChild(newChild, beforeChild);
+    RenderBoxModelObject::addChild(newChild, beforeChild);
 
     newChild->setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-RenderInline* RenderInline::cloneInline(RenderFlow* src)
+RenderInline* RenderInline::cloneInline(RenderInline* src)
 {
-    RenderInline* o = new (src->renderArena()) RenderInline(src->element());
-    o->m_isContinuation = true;
+    RenderInline* o = new (src->renderArena()) RenderInline(src->node());
     o->setStyle(src->style());
     return o;
 }
 
 void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
                                 RenderBlock* middleBlock,
-                                RenderObject* beforeChild, RenderFlow* oldCont)
+                                RenderObject* beforeChild, RenderBoxModelObject* oldCont)
 {
     // Create a clone of this inline.
     RenderInline* clone = cloneInline(this);
@@ -151,18 +248,18 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
     while (o) {
         RenderObject* tmp = o;
         o = tmp->nextSibling();
-        clone->addChildToFlow(removeChildNode(tmp), 0);
+        clone->addChildIgnoringContinuation(children()->removeChildNode(this, tmp), 0);
         tmp->setNeedsLayoutAndPrefWidthsRecalc();
     }
 
     // Hook |clone| up as the continuation of the middle block.
-    middleBlock->setContinuation(clone);
+    middleBlock->setInlineContinuation(clone);
 
     // We have been reparented and are now under the fromBlock.  We need
     // to walk up our inline parent chain until we hit the containing block.
     // Once we hit the containing block we're done.
-    RenderFlow* curr = static_cast<RenderFlow*>(parent());
-    RenderFlow* currChild = this;
+    RenderBoxModelObject* curr = static_cast<RenderBoxModelObject*>(parent());
+    RenderBoxModelObject* currChild = this;
     
     // FIXME: Because splitting is O(n^2) as tags nest pathologically, we cap the depth at which we're willing to clone.
     // There will eventually be a better approach to this problem that will let us nest to a much
@@ -171,23 +268,26 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
     unsigned splitDepth = 1;
     const unsigned cMaxSplitDepth = 200; 
     while (curr && curr != fromBlock) {
+        ASSERT(curr->isRenderInline());
         if (splitDepth < cMaxSplitDepth) {
             // Create a new clone.
             RenderInline* cloneChild = clone;
-            clone = cloneInline(curr);
+            clone = cloneInline(toRenderInline(curr));
 
             // Insert our child clone as the first child.
-            clone->addChildToFlow(cloneChild, 0);
+            clone->addChildIgnoringContinuation(cloneChild, 0);
 
             // Hook the clone up as a continuation of |curr|.
-            RenderFlow* oldCont = curr->continuation();
-            curr->setContinuation(clone);
+            RenderInline* inlineCurr = toRenderInline(curr);
+            oldCont = inlineCurr->continuation();
+            inlineCurr->setContinuation(clone);
             clone->setContinuation(oldCont);
 
             // Someone may have indirectly caused a <q> to split.  When this happens, the :after content
             // has to move into the inline continuation.  Call updateBeforeAfterContent to ensure that the inline's :after
             // content gets properly destroyed.
-            curr->updateBeforeAfterContent(RenderStyle::AFTER);
+            if (document()->usesBeforeAfterRules())
+                inlineCurr->children()->updateBeforeAfterContent(this, AFTER);
 
             // Now we need to take all of the children starting from the first child
             // *after* currChild and append them all to the clone.
@@ -195,19 +295,19 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
             while (o) {
                 RenderObject* tmp = o;
                 o = tmp->nextSibling();
-                clone->addChildToFlow(curr->removeChildNode(tmp), 0);
+                clone->addChildIgnoringContinuation(inlineCurr->children()->removeChildNode(curr, tmp), 0);
                 tmp->setNeedsLayoutAndPrefWidthsRecalc();
             }
         }
         
         // Keep walking up the chain.
         currChild = curr;
-        curr = static_cast<RenderFlow*>(curr->parent());
+        curr = static_cast<RenderBoxModelObject*>(curr->parent());
         splitDepth++;
     }
 
     // Now we are at the block level. We need to put the clone into the toBlock.
-    toBlock->appendChildNode(clone);
+    toBlock->children()->appendChildNode(toBlock, clone);
 
     // Now take all the children after currChild and remove them from the fromBlock
     // and put them in the toBlock.
@@ -215,12 +315,12 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
     while (o) {
         RenderObject* tmp = o;
         o = tmp->nextSibling();
-        toBlock->appendChildNode(fromBlock->removeChildNode(tmp));
+        toBlock->children()->appendChildNode(toBlock, fromBlock->children()->removeChildNode(fromBlock, tmp));
     }
 }
 
 void RenderInline::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
-                             RenderObject* newChild, RenderFlow* oldCont)
+                             RenderObject* newChild, RenderBoxModelObject* oldCont)
 {
     RenderBlock* pre = 0;
     RenderBlock* block = containingBlock();
@@ -232,6 +332,7 @@ void RenderInline::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox
     if (block->isAnonymousBlock() && (!block->parent() || !block->parent()->createsAnonymousWrapper())) {
         // We can reuse this block and make it the preBlock of the next continuation.
         pre = block;
+        pre->removePositionedObjects(0);
         block = block->containingBlock();
     } else {
         // No anonymous block available for use.  Make one.
@@ -243,9 +344,9 @@ void RenderInline::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox
 
     RenderObject* boxFirst = madeNewBeforeBlock ? block->firstChild() : pre->nextSibling();
     if (madeNewBeforeBlock)
-        block->insertChildNode(pre, boxFirst);
-    block->insertChildNode(newBlockBox, boxFirst);
-    block->insertChildNode(post, boxFirst);
+        block->children()->insertChildNode(block, pre, boxFirst);
+    block->children()->insertChildNode(block, newBlockBox, boxFirst);
+    block->children()->insertChildNode(block, post, boxFirst);
     block->setChildrenInline(false);
     
     if (madeNewBeforeBlock) {
@@ -253,7 +354,7 @@ void RenderInline::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox
         while (o) {
             RenderObject* no = o;
             o = no->nextSibling();
-            pre->appendChildNode(block->removeChildNode(no));
+            pre->children()->appendChildNode(pre, block->children()->removeChildNode(block, no));
             no->setNeedsLayoutAndPrefWidthsRecalc();
         }
     }
@@ -264,12 +365,10 @@ void RenderInline::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox
     // time in makeChildrenNonInline by just setting this explicitly up front.
     newBlockBox->setChildrenInline(false);
 
-    // We don't just call addChild, since it would pass things off to the
-    // continuation, so we call addChildToFlow explicitly instead.  We delayed
-    // adding the newChild until now so that the |newBlockBox| would be fully
+    // We delayed adding the newChild until now so that the |newBlockBox| would be fully
     // connected, thus allowing newChild access to a renderArena should it need
     // to wrap itself in additional boxes (e.g., table construction).
-    newBlockBox->addChildToFlow(newChild, 0);
+    newBlockBox->addChild(newChild);
 
     // Always just do a full layout in order to ensure that line boxes (especially wrappers for images)
     // get deleted properly.  Because objects moves from the pre block into the post block, we want to
@@ -279,121 +378,656 @@ void RenderInline::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox
     post->setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-void RenderInline::paint(PaintInfo& paintInfo, int tx, int ty)
-{
-    paintLines(paintInfo, tx, ty);
-}
-
-void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel)
+void RenderInline::addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild)
 {
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        rects.append(IntRect(tx + curr->xPos(), ty + curr->yPos(), curr->width(), curr->height()));
-
-    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-        if (!curr->isText())
-            curr->absoluteRects(rects, tx + curr->xPos(), ty + curr->yPos(), false);
+    RenderBoxModelObject* flow = continuationBefore(beforeChild);
+    ASSERT(!beforeChild || beforeChild->parent()->isRenderBlock() || beforeChild->parent()->isRenderInline());
+    RenderBoxModelObject* beforeChildParent = 0;
+    if (beforeChild)
+        beforeChildParent = static_cast<RenderBoxModelObject*>(beforeChild->parent());
+    else {
+        RenderBoxModelObject* cont = nextContinuation(flow);
+        if (cont)
+            beforeChildParent = cont;
+        else
+            beforeChildParent = flow;
     }
 
-    if (continuation() && topLevel)
-        continuation()->absoluteRects(rects, 
-                                      tx - containingBlock()->xPos() + continuation()->xPos(),
-                                      ty - containingBlock()->yPos() + continuation()->yPos(),
-                                      topLevel);
-}
+    if (newChild->isFloatingOrPositioned())
+        return beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild);
 
-void RenderInline::absoluteQuads(Vector<FloatQuad>& quads, bool topLevel)
-{
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
-        FloatRect localRect(curr->xPos(), curr->yPos(), curr->width(), curr->height());
-        quads.append(localToAbsoluteQuad(localRect));
-    }
-    
-    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-        if (!curr->isText())
-            curr->absoluteQuads(quads, false);
-    }
+    // A continuation always consists of two potential candidates: an inline or an anonymous
+    // block box holding block children.
+    bool childInline = newChild->isInline();
+    bool bcpInline = beforeChildParent->isInline();
+    bool flowInline = flow->isInline();
 
-    if (continuation() && topLevel)
-        continuation()->absoluteQuads(quads, topLevel);
+    if (flow == beforeChildParent)
+        return flow->addChildIgnoringContinuation(newChild, beforeChild);
+    else {
+        // The goal here is to match up if we can, so that we can coalesce and create the
+        // minimal # of continuations needed for the inline.
+        if (childInline == bcpInline)
+            return beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild);
+        else if (flowInline == childInline)
+            return flow->addChildIgnoringContinuation(newChild, 0); // Just treat like an append.
+        else
+            return beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild);
+    }
 }
 
-bool RenderInline::requiresLayer()
+void RenderInline::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    return isRelPositioned() || isTransparent() || hasMask();
+    m_lineBoxes.paint(this, paintInfo, tx, ty);
 }
 
-int RenderInline::width() const
+void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
-    // Return the width of the minimal left side and the maximal right side.
-    int leftSide = 0;
-    int rightSide = 0;
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
-        if (curr == firstLineBox() || curr->xPos() < leftSide)
-            leftSide = curr->xPos();
-        if (curr == firstLineBox() || curr->xPos() + curr->width() > rightSide)
-            rightSide = curr->xPos() + curr->width();
-    }
+    if (InlineRunBox* curr = firstLineBox()) {
+        for (; curr; curr = curr->nextLineBox())
+            rects.append(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+    } else
+        rects.append(IntRect(tx, ty, 0, 0));
 
-    return rightSide - leftSide;
+    if (continuation()) {
+        if (continuation()->isBox()) {
+            RenderBox* box = toRenderBox(continuation());
+            continuation()->absoluteRects(rects, 
+                                          tx - containingBlock()->x() + box->x(),
+                                          ty - containingBlock()->y() + box->y());
+        } else
+            continuation()->absoluteRects(rects, tx - containingBlock()->x(), ty - containingBlock()->y());
+    }
 }
 
-int RenderInline::height() const
+void RenderInline::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    // See <rdar://problem/5289721>, for an unknown reason the linked list here is sometimes inconsistent, first is non-zero and last is zero.  We have been
-    // unable to reproduce this at all (and consequently unable to figure ot why this is happening).  The assert will hopefully catch the problem in debug
-    // builds and help us someday figure out why.  We also put in a redundant check of lastLineBox() to avoid the crash for now.
-    ASSERT(!firstLineBox() == !lastLineBox());  // Either both are null or both exist.
-    if (firstLineBox() && lastLineBox())
-        return lastLineBox()->yPos() + lastLineBox()->height() - firstLineBox()->yPos();
-    return 0;
+    if (InlineRunBox* curr = firstLineBox()) {
+        for (; curr; curr = curr->nextLineBox()) {
+            FloatRect localRect(curr->x(), curr->y(), curr->width(), curr->height());
+            quads.append(localToAbsoluteQuad(localRect));
+        }
+    } else
+        quads.append(localToAbsoluteQuad(FloatRect()));
+
+    if (continuation())
+        continuation()->absoluteQuads(quads);
 }
 
 int RenderInline::offsetLeft() const
 {
-    int x = RenderFlow::offsetLeft();
+    int x = RenderBoxModelObject::offsetLeft();
     if (firstLineBox())
-        x += firstLineBox()->xPos();
+        x += firstLineBox()->x();
     return x;
 }
 
 int RenderInline::offsetTop() const
 {
-    int y = RenderFlow::offsetTop();
+    int y = RenderBoxModelObject::offsetTop();
     if (firstLineBox())
-        y += firstLineBox()->yPos();
+        y += firstLineBox()->y();
     return y;
 }
 
+int RenderInline::marginLeft() const
+{
+    Length margin = style()->marginLeft();
+    if (margin.isAuto())
+        return 0;
+    if (margin.isFixed())
+        return margin.value();
+    if (margin.isPercent())
+        return margin.calcMinValue(max(0, containingBlock()->availableWidth()));
+    return 0;
+}
+
+int RenderInline::marginRight() const
+{
+    Length margin = style()->marginRight();
+    if (margin.isAuto())
+        return 0;
+    if (margin.isFixed())
+        return margin.value();
+    if (margin.isPercent())
+        return margin.calcMinValue(max(0, containingBlock()->availableWidth()));
+    return 0;
+}
+
 const char* RenderInline::renderName() const
 {
     if (isRelPositioned())
         return "RenderInline (relative positioned)";
     if (isAnonymous())
         return "RenderInline (generated)";
+    if (isRunIn())
+        return "RenderInline (run-in)";
     return "RenderInline";
 }
 
 bool RenderInline::nodeAtPoint(const HitTestRequest& request, HitTestResult& result,
                                 int x, int y, int tx, int ty, HitTestAction hitTestAction)
 {
-    return hitTestLines(request, result, x, y, tx, ty, hitTestAction);
+    return m_lineBoxes.hitTest(this, request, result, x, y, tx, ty, hitTestAction);
 }
 
-VisiblePosition RenderInline::positionForCoordinates(int x, int y)
+VisiblePosition RenderInline::positionForPoint(const IntPoint& point)
 {
-    // Translate the coords from the pre-anonymous block to the post-anonymous block.
+    // FIXME: Does not deal with relative positioned inlines (should it?)
     RenderBlock* cb = containingBlock();
-    int parentBlockX = cb->xPos() + x;
-    int parentBlockY = cb->yPos() + y;
-    for (RenderObject* c = continuation(); c; c = c->continuation()) {
-        RenderObject* contBlock = c;
-        if (c->isInline())
-            contBlock = c->containingBlock();
+    if (firstLineBox()) {
+        // This inline actually has a line box.  We must have clicked in the border/padding of one of these boxes.  We
+        // should try to find a result by asking our containing block.
+        return cb->positionForPoint(point);
+    }
+
+    // Translate the coords from the pre-anonymous block to the post-anonymous block.
+    int parentBlockX = cb->x() + point.x();
+    int parentBlockY = cb->y() + point.y();
+    RenderBoxModelObject* c = continuation();
+    while (c) {
+        RenderBox* contBlock = c->isInline() ? c->containingBlock() : toRenderBlock(c);
         if (c->isInline() || c->firstChild())
-            return c->positionForCoordinates(parentBlockX - contBlock->xPos(), parentBlockY - contBlock->yPos());
+            return c->positionForCoordinates(parentBlockX - contBlock->x(), parentBlockY - contBlock->y());
+        c = toRenderBlock(c)->inlineContinuation();
+    }
+    
+    return RenderBoxModelObject::positionForPoint(point);
+}
+
+IntRect RenderInline::linesBoundingBox() const
+{
+    IntRect result;
+    
+    // See <rdar://problem/5289721>, for an unknown reason the linked list here is sometimes inconsistent, first is non-zero and last is zero.  We have been
+    // unable to reproduce this at all (and consequently unable to figure ot why this is happening).  The assert will hopefully catch the problem in debug
+    // builds and help us someday figure out why.  We also put in a redundant check of lastLineBox() to avoid the crash for now.
+    ASSERT(!firstLineBox() == !lastLineBox());  // Either both are null or both exist.
+    if (firstLineBox() && lastLineBox()) {
+        // Return the width of the minimal left side and the maximal right side.
+        int leftSide = 0;
+        int rightSide = 0;
+        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+            if (curr == firstLineBox() || curr->x() < leftSide)
+                leftSide = curr->x();
+            if (curr == firstLineBox() || curr->x() + curr->width() > rightSide)
+                rightSide = curr->x() + curr->width();
+        }
+        result.setWidth(rightSide - leftSide);
+        result.setX(leftSide);
+        result.setHeight(lastLineBox()->y() + lastLineBox()->height() - firstLineBox()->y());
+        result.setY(firstLineBox()->y());
     }
 
-    return RenderFlow::positionForCoordinates(x, y);
+    return result;
+}
+
+IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
+{
+    // Only run-ins are allowed in here during layout.
+    ASSERT(!view() || !view()->layoutStateEnabled() || isRunIn());
+
+    if (!firstLineBox() && !continuation())
+        return IntRect();
+
+    // Find our leftmost position.
+    IntRect boundingBox(linesBoundingBox());
+    int left = boundingBox.x();
+    int top = boundingBox.y();
+
+    // Now invalidate a rectangle.
+    int ow = style() ? style()->outlineSize() : 0;
+    
+    // We need to add in the relative position offsets of any inlines (including us) up to our
+    // containing block.
+    RenderBlock* cb = containingBlock();
+    for (RenderObject* inlineFlow = this; inlineFlow && inlineFlow->isRenderInline() && inlineFlow != cb; 
+         inlineFlow = inlineFlow->parent()) {
+         if (inlineFlow->style()->position() == RelativePosition && inlineFlow->hasLayer())
+            toRenderInline(inlineFlow)->layer()->relativePositionOffset(left, top);
+    }
+
+    IntRect r(-ow + left, -ow + top, boundingBox.width() + ow * 2, boundingBox.height() + ow * 2);
+    if (cb->hasColumns())
+        cb->adjustRectForColumns(r);
+
+    if (cb->hasOverflowClip()) {
+        // cb->height() is inaccurate if we're in the middle of a layout of |cb|, so use the
+        // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
+        // anyway if its size does change.
+        int x = r.x();
+        int y = r.y();
+        IntRect boxRect(0, 0, cb->layer()->width(), cb->layer()->height());
+        cb->layer()->subtractScrolledContentOffset(x, y); // For overflow:auto/scroll/hidden.
+        IntRect repaintRect(x, y, r.width(), r.height());
+        r = intersection(repaintRect, boxRect);
+    }
+    
+    // FIXME: need to ensure that we compute the correct repaint rect when the repaint container
+    // is an inline.
+    if (repaintContainer != this)
+        cb->computeRectForRepaint(repaintContainer, r);
+
+    if (ow) {
+        for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+            if (!curr->isText()) {
+                IntRect childRect = curr->rectWithOutlineForRepaint(repaintContainer, ow);
+                r.unite(childRect);
+            }
+        }
+
+        if (continuation() && !continuation()->isInline()) {
+            IntRect contRect = continuation()->rectWithOutlineForRepaint(repaintContainer, ow);
+            r.unite(contRect);
+        }
+    }
+
+    return r;
+}
+
+IntRect RenderInline::rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth)
+{
+    IntRect r(RenderBoxModelObject::rectWithOutlineForRepaint(repaintContainer, outlineWidth));
+    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (!curr->isText())
+            r.unite(curr->rectWithOutlineForRepaint(repaintContainer, outlineWidth));
+    }
+    return r;
+}
+
+void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed)
+{
+    if (RenderView* v = view()) {
+        // LayoutState is only valid for root-relative repainting
+        if (v->layoutStateEnabled() && !repaintContainer) {
+            LayoutState* layoutState = v->layoutState();
+            if (style()->position() == RelativePosition && layer())
+                rect.move(layer()->relativePositionOffset());
+            rect.move(layoutState->m_offset);
+            if (layoutState->m_clipped)
+                rect.intersect(layoutState->m_clipRect);
+            return;
+        }
+    }
+
+    if (repaintContainer == this)
+        return;
+
+    RenderObject* o = container();
+    if (!o)
+        return;
+
+    IntPoint topLeft = rect.location();
+
+    if (o->isBlockFlow() && style()->position() != AbsolutePosition && style()->position() != FixedPosition) {
+        RenderBlock* cb = toRenderBlock(o);
+        if (cb->hasColumns()) {
+            IntRect repaintRect(topLeft, rect.size());
+            cb->adjustRectForColumns(repaintRect);
+            topLeft = repaintRect.location();
+            rect = repaintRect;
+        }
+    }
+
+    if (style()->position() == RelativePosition && layer()) {
+        // Apply the relative position offset when invalidating a rectangle.  The layer
+        // is translated, but the render box isn't, so we need to do this to get the
+        // right dirty rect.  Since this is called from RenderObject::setStyle, the relative position
+        // flag on the RenderObject has been cleared, so use the one on the style().
+        topLeft += layer()->relativePositionOffset();
+    }
+    
+    // FIXME: We ignore the lightweight clipping rect that controls use, since if |o| is in mid-layout,
+    // its controlClipRect will be wrong. For overflow clip we use the values cached by the layer.
+    if (o->hasOverflowClip()) {
+        RenderBox* containerBox = toRenderBox(o);
+
+        // o->height() is inaccurate if we're in the middle of a layout of |o|, so use the
+        // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
+        // anyway if its size does change.
+        topLeft -= containerBox->layer()->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
+
+        IntRect repaintRect(topLeft, rect.size());
+        IntRect boxRect(0, 0, containerBox->layer()->width(), containerBox->layer()->height());
+        rect = intersection(repaintRect, boxRect);
+        if (rect.isEmpty())
+            return;
+    } else
+        rect.setLocation(topLeft);
+    
+    o->computeRectForRepaint(repaintContainer, rect, fixed);
+}
+
+void RenderInline::updateDragState(bool dragOn)
+{
+    RenderBoxModelObject::updateDragState(dragOn);
+    if (continuation())
+        continuation()->updateDragState(dragOn);
+}
+
+void RenderInline::childBecameNonInline(RenderObject* child)
+{
+    // We have to split the parent flow.
+    RenderBlock* newBox = containingBlock()->createAnonymousBlock();
+    RenderBoxModelObject* oldContinuation = continuation();
+    setContinuation(newBox);
+    RenderObject* beforeChild = child->nextSibling();
+    children()->removeChildNode(this, child);
+    splitFlow(beforeChild, newBox, child, oldContinuation);
+}
+
+void RenderInline::updateHitTestResult(HitTestResult& result, const IntPoint& point)
+{
+    if (result.innerNode())
+        return;
+
+    Node* n = node();
+    IntPoint localPoint(point);
+    if (n) {
+        if (isInlineContinuation()) {
+            // We're in the continuation of a split inline.  Adjust our local point to be in the coordinate space
+            // of the principal renderer's containing block.  This will end up being the innerNonSharedNode.
+            RenderBlock* firstBlock = n->renderer()->containingBlock();
+            
+            // Get our containing block.
+            RenderBox* block = containingBlock();
+            localPoint.move(block->x() - firstBlock->x(), block->y() - firstBlock->y());
+        }
+
+        result.setInnerNode(n);
+        if (!result.innerNonSharedNode())
+            result.setInnerNonSharedNode(n);
+        result.setLocalPoint(localPoint);
+    }
+}
+
+void RenderInline::dirtyLineBoxes(bool fullLayout)
+{
+    if (fullLayout)
+        m_lineBoxes.deleteLineBoxes(renderArena());
+    else
+        m_lineBoxes.dirtyLineBoxes();
+}
+
+InlineFlowBox* RenderInline::createFlowBox()
+{
+    return new (renderArena()) InlineFlowBox(this);
+}
+
+InlineFlowBox* RenderInline::createInlineFlowBox()
+{
+    InlineFlowBox* flowBox = createFlowBox();
+    m_lineBoxes.appendLineBox(flowBox);
+    return flowBox;
+}
+
+int RenderInline::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
+{
+    if (firstLine && document()->usesFirstLineRules()) {
+        RenderStyle* s = style(firstLine);
+        if (s != style())
+            return s->computedLineHeight();
+    }
+    
+    if (m_lineHeight == -1)
+        m_lineHeight = style()->computedLineHeight();
+    
+    return m_lineHeight;
+}
+
+int RenderInline::verticalPositionFromCache(bool firstLine) const
+{
+    if (firstLine) // We're only really a first-line style if the document actually uses first-line rules.
+        firstLine = document()->usesFirstLineRules();
+    int vpos = m_verticalPosition;
+    if (m_verticalPosition == PositionUndefined || firstLine) {
+        vpos = verticalPosition(firstLine);
+        if (!firstLine)
+            m_verticalPosition = vpos;
+    }
+    return vpos;
+}
+
+IntSize RenderInline::relativePositionedInlineOffset(const RenderBox* child) const
+{
+    ASSERT(isRelPositioned());
+    if (!isRelPositioned())
+        return IntSize();
+
+    // When we have an enclosing relpositioned inline, we need to add in the offset of the first line
+    // box from the rest of the content, but only in the cases where we know we're positioned
+    // relative to the inline itself.
+
+    IntSize offset;
+    int sx;
+    int sy;
+    if (firstLineBox()) {
+        sx = firstLineBox()->x();
+        sy = firstLineBox()->y();
+    } else {
+        sx = layer()->staticX();
+        sy = layer()->staticY();
+    }
+
+    if (!child->style()->hasStaticX())
+        offset.setWidth(sx);
+    // This is not terribly intuitive, but we have to match other browsers.  Despite being a block display type inside
+    // an inline, we still keep our x locked to the left of the relative positioned inline.  Arguably the correct
+    // behavior would be to go flush left to the block that contains the inline, but that isn't what other browsers
+    // do.
+    else if (!child->style()->isOriginalDisplayInlineType())
+        // Avoid adding in the left border/padding of the containing block twice.  Subtract it out.
+        offset.setWidth(sx - (child->containingBlock()->borderLeft() + child->containingBlock()->paddingLeft()));
+
+    if (!child->style()->hasStaticY())
+        offset.setHeight(sy);
+
+    return offset;
+}
+
+void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
+{
+    if (!parent())
+        return;
+        
+    // FIXME: We can do better.
+    repaint();
+}
+
+void RenderInline::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+{
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
+        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+
+    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (!curr->isText() && !curr->isListMarker()) {
+            FloatPoint pos(tx, ty);
+            // FIXME: This doesn't work correctly with transforms.
+            if (curr->hasLayer()) 
+                pos = curr->localToAbsolute();
+            else if (curr->isBox())
+                pos.move(toRenderBox(curr)->x(), toRenderBox(curr)->y());
+           curr->addFocusRingRects(graphicsContext, pos.x(), pos.y());
+        }
+    }
+
+    if (continuation()) {
+        if (continuation()->isInline())
+            continuation()->addFocusRingRects(graphicsContext, 
+                                              tx - containingBlock()->x() + continuation()->containingBlock()->x(),
+                                              ty - containingBlock()->y() + continuation()->containingBlock()->y());
+        else
+            continuation()->addFocusRingRects(graphicsContext, 
+                                              tx - containingBlock()->x() + toRenderBox(continuation())->x(),
+                                              ty - containingBlock()->y() + toRenderBox(continuation())->y());
+    }
+}
+
+void RenderInline::paintOutline(GraphicsContext* graphicsContext, int tx, int ty)
+{
+    if (!hasOutline())
+        return;
+    
+    if (style()->outlineStyleIsAuto() || hasOutlineAnnotation()) {
+        int ow = style()->outlineWidth();
+        Color oc = style()->outlineColor();
+        if (!oc.isValid())
+            oc = style()->color();
+
+        graphicsContext->initFocusRing(ow, style()->outlineOffset());
+        addFocusRingRects(graphicsContext, tx, ty);
+        if (style()->outlineStyleIsAuto())
+            graphicsContext->drawFocusRing(oc);
+        else
+            addPDFURLRect(graphicsContext, graphicsContext->focusRingBoundingRect());
+        graphicsContext->clearFocusRing();
+    }
+
+    if (style()->outlineStyleIsAuto() || style()->outlineStyle() == BNONE)
+        return;
+
+    Vector<IntRect> rects;
+
+    rects.append(IntRect());
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
+        rects.append(IntRect(curr->x(), curr->y(), curr->width(), curr->height()));
+
+    rects.append(IntRect());
+
+    for (unsigned i = 1; i < rects.size() - 1; i++)
+        paintOutlineForLine(graphicsContext, tx, ty, rects.at(i - 1), rects.at(i), rects.at(i + 1));
+}
+
+void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, int tx, int ty,
+                                       const IntRect& lastline, const IntRect& thisline, const IntRect& nextline)
+{
+    int ow = style()->outlineWidth();
+    EBorderStyle os = style()->outlineStyle();
+    Color oc = style()->outlineColor();
+    if (!oc.isValid())
+        oc = style()->color();
+
+    int offset = style()->outlineOffset();
+
+    int t = ty + thisline.y() - offset;
+    int l = tx + thisline.x() - offset;
+    int b = ty + thisline.bottom() + offset;
+    int r = tx + thisline.right() + offset;
+    
+    // left edge
+    drawLineForBoxSide(graphicsContext,
+               l - ow,
+               t - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.right() - 1) <= thisline.x() ? ow : 0),
+               l,
+               b + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.right() - 1) <= thisline.x() ? ow : 0),
+               BSLeft,
+               oc, style()->color(), os,
+               (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.right() - 1) <= thisline.x() ? ow : -ow),
+               (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.right() - 1) <= thisline.x() ? ow : -ow));
+    
+    // right edge
+    drawLineForBoxSide(graphicsContext,
+               r,
+               t - (lastline.isEmpty() || lastline.right() < thisline.right() || (thisline.right() - 1) <= lastline.x() ? ow : 0),
+               r + ow,
+               b + (nextline.isEmpty() || nextline.right() <= thisline.right() || (thisline.right() - 1) <= nextline.x() ? ow : 0),
+               BSRight,
+               oc, style()->color(), os,
+               (lastline.isEmpty() || lastline.right() < thisline.right() || (thisline.right() - 1) <= lastline.x() ? ow : -ow),
+               (nextline.isEmpty() || nextline.right() <= thisline.right() || (thisline.right() - 1) <= nextline.x() ? ow : -ow));
+    // upper edge
+    if (thisline.x() < lastline.x())
+        drawLineForBoxSide(graphicsContext,
+                   l - ow,
+                   t - ow,
+                   min(r+ow, (lastline.isEmpty() ? 1000000 : tx + lastline.x())),
+                   t ,
+                   BSTop, oc, style()->color(), os,
+                   ow,
+                   (!lastline.isEmpty() && tx + lastline.x() + 1 < r + ow) ? -ow : ow);
+    
+    if (lastline.right() < thisline.right())
+        drawLineForBoxSide(graphicsContext,
+                   max(lastline.isEmpty() ? -1000000 : tx + lastline.right(), l - ow),
+                   t - ow,
+                   r + ow,
+                   t ,
+                   BSTop, oc, style()->color(), os,
+                   (!lastline.isEmpty() && l - ow < tx + lastline.right()) ? -ow : ow,
+                   ow);
+    
+    // lower edge
+    if (thisline.x() < nextline.x())
+        drawLineForBoxSide(graphicsContext,
+                   l - ow,
+                   b,
+                   min(r + ow, !nextline.isEmpty() ? tx + nextline.x() + 1 : 1000000),
+                   b + ow,
+                   BSBottom, oc, style()->color(), os,
+                   ow,
+                   (!nextline.isEmpty() && tx + nextline.x() + 1 < r + ow) ? -ow : ow);
+    
+    if (nextline.right() < thisline.right())
+        drawLineForBoxSide(graphicsContext,
+                   max(!nextline.isEmpty() ? tx + nextline.right() : -1000000, l - ow),
+                   b,
+                   r + ow,
+                   b + ow,
+                   BSBottom, oc, style()->color(), os,
+                   (!nextline.isEmpty() && l - ow < tx + nextline.right()) ? -ow : ow,
+                   ow);
+}
+
+#if ENABLE(DASHBOARD_SUPPORT)
+void RenderInline::addDashboardRegions(Vector<DashboardRegionValue>& regions)
+{
+    // Convert the style regions to absolute coordinates.
+    if (style()->visibility() != VISIBLE)
+        return;
+
+    const Vector<StyleDashboardRegion>& styleRegions = style()->dashboardRegions();
+    unsigned i, count = styleRegions.size();
+    for (i = 0; i < count; i++) {
+        StyleDashboardRegion styleRegion = styleRegions[i];
+
+        IntRect linesBoundingBox = this->linesBoundingBox();
+        int w = linesBoundingBox.width();
+        int h = linesBoundingBox.height();
+
+        DashboardRegionValue region;
+        region.label = styleRegion.label;
+        region.bounds = IntRect(linesBoundingBox.x() + styleRegion.offset.left().value(),
+                                linesBoundingBox.y() + styleRegion.offset.top().value(),
+                                w - styleRegion.offset.left().value() - styleRegion.offset.right().value(),
+                                h - styleRegion.offset.top().value() - styleRegion.offset.bottom().value());
+        region.type = styleRegion.type;
+
+        RenderObject* container = containingBlock();
+        if (!container)
+            container = this;
+
+        region.clip = region.bounds;
+        container->computeAbsoluteRepaintRect(region.clip);
+        if (region.clip.height() < 0) {
+            region.clip.setHeight(0);
+            region.clip.setWidth(0);
+        }
+
+        FloatPoint absPos = container->localToAbsolute();
+        region.bounds.setX(absPos.x() + region.bounds.x());
+        region.bounds.setY(absPos.y() + region.bounds.y());
+
+        if (document()->frame()) {
+            float pageScaleFactor = document()->frame()->page()->chrome()->scaleFactor();
+            if (pageScaleFactor != 1.0f) {
+                region.bounds.scale(pageScaleFactor);
+                region.clip.scale(pageScaleFactor);
+            }
+        }
+
+        regions.append(region);
+    }
 }
+#endif
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
index 1c42a6f96b..cf6b84b080 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
@@ -25,60 +25,147 @@
 #ifndef RenderInline_h
 #define RenderInline_h
 
-#include "RenderFlow.h"
+#include "RenderBoxModelObject.h"
+#include "RenderLineBoxList.h"
 
 namespace WebCore {
 
 class Position;
 
-class RenderInline : public RenderFlow {
+class RenderInline : public RenderBoxModelObject {
 public:
     RenderInline(Node*);
     virtual ~RenderInline();
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
+    virtual void destroy();
+
     virtual const char* renderName() const;
 
     virtual bool isRenderInline() const { return true; }
-    virtual bool isInlineFlow() const { return true; }
-    virtual bool childrenInline() const { return true; }
 
-    virtual bool isInlineContinuation() const;
+    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
+    void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
+    virtual void addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild = 0);
 
-    virtual void addChildToFlow(RenderObject* newChild, RenderObject* beforeChild);
     void splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock, RenderBlock* middleBlock,
-                      RenderObject* beforeChild, RenderFlow* oldCont);
+                      RenderObject* beforeChild, RenderBoxModelObject* oldCont);
     void splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
-                   RenderObject* newChild, RenderFlow* oldCont);
+                   RenderObject* newChild, RenderBoxModelObject* oldCont);
 
-    virtual void layout() { } // Do nothing for layout()
+    virtual void layout() { ASSERT_NOT_REACHED(); } // Do nothing for layout()
 
     virtual void paint(PaintInfo&, int tx, int ty);
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-    // overrides RenderObject
-    virtual bool requiresLayer();
-
-    virtual int width() const;
-    virtual int height() const;
+    virtual bool requiresLayer() const { return isRelPositioned() || isTransparent() || hasMask(); }
 
-    // used to calculate offsetWidth/Height.  Overridden by inlines (RenderFlow) to return
-    // the remaining width on a given line (and the height of a single line).
     virtual int offsetLeft() const;
     virtual int offsetTop() const;
+    virtual int offsetWidth() const { return linesBoundingBox().width(); }
+    virtual int offsetHeight() const { return linesBoundingBox().height(); }
+
+    // Just ignore top/bottom margins on RenderInlines.
+    virtual int marginTop() const { return 0; }
+    virtual int marginBottom() const { return 0; }
+    virtual int marginLeft() const;
+    virtual int marginRight() const;
+    
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed);
+
+    virtual VisiblePosition positionForPoint(const IntPoint&);
+
+    IntRect linesBoundingBox() const;
+    
+    virtual IntRect borderBoundingBox() const
+    {
+        IntRect boundingBox = linesBoundingBox();
+        return IntRect(0, 0, boundingBox.width(), boundingBox.height());
+    }
+
+    InlineFlowBox* createInlineFlowBox();    
+    void dirtyLineBoxes(bool fullLayout);
+    virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
+
+    RenderLineBoxList* lineBoxes() { return &m_lineBoxes; }
+    const RenderLineBoxList* lineBoxes() const { return &m_lineBoxes; }
+
+    InlineFlowBox* firstLineBox() const { return m_lineBoxes.firstLineBox(); }
+    InlineFlowBox* lastLineBox() const { return m_lineBoxes.lastLineBox(); }
 
-    void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
 
-    virtual VisiblePosition positionForCoordinates(int x, int y);
+    RenderBoxModelObject* continuation() const { return m_continuation; }
+    RenderInline* inlineContinuation() const;
+    void setContinuation(RenderBoxModelObject* c) { m_continuation = c; }
+    
+    virtual void updateDragState(bool dragOn);
+    
+    virtual void childBecameNonInline(RenderObject* child);
 
+    virtual void updateHitTestResult(HitTestResult&, const IntPoint&);
+
+    IntSize relativePositionedInlineOffset(const RenderBox* child) const;
+
+    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    void paintOutline(GraphicsContext*, int tx, int ty);
+
+    virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
+
+    int verticalPositionFromCache(bool firstLine) const;
+    void invalidateVerticalPosition() { m_verticalPosition = PositionUndefined; }
+
+#if ENABLE(DASHBOARD_SUPPORT)
+    virtual void addDashboardRegions(Vector<DashboardRegionValue>&);
+#endif
+    
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+    virtual void updateBoxModelInfoFromStyle();
+    virtual InlineFlowBox* createFlowBox(); // Subclassed by SVG
+    
+    static RenderInline* cloneInline(RenderInline* src);
 
-    static RenderInline* cloneInline(RenderFlow* src);
+private:
+    void paintOutlineForLine(GraphicsContext*, int tx, int ty, const IntRect& prevLine, const IntRect& thisLine, const IntRect& nextLine);
+    RenderBoxModelObject* continuationBefore(RenderObject* beforeChild);
 
+protected:
+    RenderObjectChildList m_children;
+    RenderLineBoxList m_lineBoxes;   // All of the line boxes created for this inline flow.  For example, <i>Hello<br>world.</i> will have two <i> line boxes.
+
+private:
+    RenderBoxModelObject* m_continuation; // Can be either a block or an inline. <b><i><p>Hello</p></i></b>. In this example the <i> will have a block as its continuation but the
+                                          // <b> will just have an inline as its continuation.
+    mutable int m_lineHeight;
+    mutable int m_verticalPosition;
 };
 
+inline RenderInline* toRenderInline(RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderInline());
+    return static_cast<RenderInline*>(o);
+}
+
+inline const RenderInline* toRenderInline(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isRenderInline());
+    return static_cast<const RenderInline*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderInline(const RenderInline*);
+
 } // namespace WebCore
 
 #endif // RenderInline_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index 9c9eff0fe9..780b48f9d4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -44,10 +44,14 @@
 #include "config.h"
 #include "RenderLayer.h"
 
+#include "CString.h"
 #include "CSSPropertyNames.h"
+#include "CSSStyleDeclaration.h"
+#include "CSSStyleSelector.h"
 #include "Document.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "FloatPoint3D.h"
 #include "FloatRect.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -59,6 +63,7 @@
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "OverflowEvent.h"
+#include "OverlapTestRequestClient.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "RenderArena.h"
@@ -73,8 +78,16 @@
 #include "Scrollbar.h"
 #include "ScrollbarTheme.h"
 #include "SelectionController.h"
+#include "TransformationMatrix.h"
+#include "TransformState.h"
 #include "TranslateTransformOperation.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerBacking.h"
+#include "RenderLayerCompositor.h"
+#endif
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
@@ -88,12 +101,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-const RenderLayer::ScrollAlignment RenderLayer::gAlignCenterIfNeeded = { RenderLayer::noScroll, RenderLayer::alignCenter, RenderLayer::alignToClosestEdge };
-const RenderLayer::ScrollAlignment RenderLayer::gAlignToEdgeIfNeeded = { RenderLayer::noScroll, RenderLayer::alignToClosestEdge, RenderLayer::alignToClosestEdge };
-const RenderLayer::ScrollAlignment RenderLayer::gAlignCenterAlways = { RenderLayer::alignCenter, RenderLayer::alignCenter, RenderLayer::alignCenter };
-const RenderLayer::ScrollAlignment RenderLayer::gAlignTopAlways = { RenderLayer::alignTop, RenderLayer::alignTop, RenderLayer::alignTop };
-const RenderLayer::ScrollAlignment RenderLayer::gAlignBottomAlways = { RenderLayer::alignBottom, RenderLayer::alignBottom, RenderLayer::alignBottom };
-
 const int MinimumWidthWhileResizing = 100;
 const int MinimumHeightWhileResizing = 40;
 
@@ -116,8 +123,8 @@ void ClipRects::destroy(RenderArena* renderArena)
     renderArena->free(*(size_t *)this, this);
 }
 
-RenderLayer::RenderLayer(RenderObject* object)
-    : m_object(object)
+RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
+    : m_renderer(renderer)
     , m_parent(0)
     , m_previous(0)
     , m_next(0)
@@ -138,15 +145,15 @@ RenderLayer::RenderLayer(RenderObject* object)
     , m_inResizeMode(false)
     , m_posZOrderList(0)
     , m_negZOrderList(0)
-    , m_overflowList(0)
+    , m_normalFlowList(0)
     , m_clipRects(0) 
 #ifndef NDEBUG    
     , m_clipRectsRoot(0)
 #endif
     , m_scrollDimensionsDirty(true)
     , m_zOrderListsDirty(true)
-    , m_overflowListDirty(true)
-    , m_isOverflowOnly(shouldBeOverflowOnly())
+    , m_normalFlowListDirty(true)
+    , m_isNormalFlowOnly(shouldBeNormalFlowOnly())
     , m_usedTransparency(false)
     , m_paintingInsideReflection(false)
     , m_inOverflowRelayout(false)
@@ -156,17 +163,22 @@ RenderLayer::RenderLayer(RenderObject* object)
     , m_hasVisibleContent(false)
     , m_visibleDescendantStatusDirty(false)
     , m_hasVisibleDescendant(false)
+    , m_3DTransformedDescendantStatusDirty(true)
+    , m_has3DTransformedDescendant(false)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_hasCompositingDescendant(false)
+    , m_mustOverlayCompositedLayers(false)
+#endif
     , m_marquee(0)
     , m_staticX(0)
     , m_staticY(0)
-    , m_transform(0)
     , m_reflection(0)
     , m_scrollCorner(0)
     , m_resizer(0)
 {
-    if (!object->firstChild() && object->style()) {
+    if (!renderer->firstChild() && renderer->style()) {
         m_visibleContentStatusDirty = false;
-        m_hasVisibleContent = object->style()->visibility() == VISIBLE;
+        m_hasVisibleContent = renderer->style()->visibility() == VISIBLE;
     }
 }
 
@@ -185,9 +197,13 @@ RenderLayer::~RenderLayer()
 
     delete m_posZOrderList;
     delete m_negZOrderList;
-    delete m_overflowList;
+    delete m_normalFlowList;
     delete m_marquee;
 
+#if USE(ACCELERATED_COMPOSITING)
+    clearBacking();
+#endif
+    
     // Make sure we have no lingering clip rects.
     ASSERT(!m_clipRects);
     
@@ -204,11 +220,40 @@ RenderLayer::~RenderLayer()
         m_resizer->destroy();
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+RenderLayerCompositor* RenderLayer::compositor() const
+{
+    ASSERT(renderer()->view());
+    return renderer()->view()->compositor();
+}
+
+void RenderLayer::rendererContentChanged()
+{
+    if (m_backing)
+        m_backing->rendererContentChanged();
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+void RenderLayer::setStaticY(int staticY)
+{
+    if (m_staticY == staticY)
+        return;
+    m_staticY = staticY;
+    renderer()->setChildNeedsLayout(true, false);
+}
+
 void RenderLayer::updateLayerPositions(bool doFullRepaint, bool checkForRepaint)
 {
     if (doFullRepaint) {
-        m_object->repaint();
+        renderer()->repaint();
+#if USE(ACCELERATED_COMPOSITING)
+        checkForRepaint = false;
+        // We need the full repaint to propagate to child layers if we are hardware compositing.
+        if (!compositor()->inCompositingMode())
+            doFullRepaint = false;
+#else
         checkForRepaint = doFullRepaint = false;
+#endif
     }
     
     updateLayerPosition(); // For relpositioned layers or non-positioned layers,
@@ -225,22 +270,23 @@ void RenderLayer::updateLayerPositions(bool doFullRepaint, bool checkForRepaint)
     updateTransform();
      
     if (m_hasVisibleContent) {
-        RenderView* view = m_object->view();
+        RenderView* view = renderer()->view();
         ASSERT(view);
         // FIXME: Optimize using LayoutState and remove the disableLayoutState() call
         // from updateScrollInfoAfterLayout().
-        ASSERT(!view->layoutState());
+        ASSERT(!view->layoutStateEnabled());
 
-        IntRect newRect = m_object->absoluteClippedOverflowRect();
-        IntRect newOutlineBox = m_object->absoluteOutlineBounds();
+        RenderBoxModelObject* repaintContainer = renderer()->containerForRepaint();
+        IntRect newRect = renderer()->clippedOverflowRectForRepaint(repaintContainer);
+        IntRect newOutlineBox = renderer()->outlineBoundsForRepaint(repaintContainer);
         if (checkForRepaint) {
             if (view && !view->printing()) {
                 if (m_needsFullRepaint) {
-                    view->repaintViewRectangle(m_repaintRect);
+                    renderer()->repaintUsingContainer(repaintContainer, m_repaintRect);
                     if (newRect != m_repaintRect)
-                        view->repaintViewRectangle(newRect);
+                        renderer()->repaintUsingContainer(repaintContainer, newRect);
                 } else
-                    m_object->repaintAfterLayoutIfNeeded(m_repaintRect, m_outlineBox);
+                    renderer()->repaintAfterLayoutIfNeeded(repaintContainer, m_repaintRect, m_outlineBox);
             }
         }
         m_repaintRect = newRect;
@@ -258,6 +304,14 @@ void RenderLayer::updateLayerPositions(bool doFullRepaint, bool checkForRepaint)
 
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
         child->updateLayerPositions(doFullRepaint, checkForRepaint);
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (!parent())
+        compositor()->updateRootLayerPosition();
+
+    if (isComposited())
+        backing()->updateAfterLayout();
+#endif
         
     // With all our children positioned, now update our marquee if we need to.
     if (m_marquee)
@@ -266,7 +320,11 @@ void RenderLayer::updateLayerPositions(bool doFullRepaint, bool checkForRepaint)
 
 void RenderLayer::updateTransform()
 {
-    bool hasTransform = renderer()->hasTransform();
+    // hasTransform() on the renderer is also true when there is transform-style: preserve-3d or perspective set,
+    // so check style too.
+    bool hasTransform = renderer()->hasTransform() && renderer()->style()->hasTransform();
+    bool had3DTransform = has3DTransform();
+
     bool hadTransform = m_transform;
     if (hasTransform != hadTransform) {
         if (hasTransform)
@@ -276,9 +334,33 @@ void RenderLayer::updateTransform()
     }
     
     if (hasTransform) {
-        m_transform->reset();
-        renderer()->style()->applyTransform(*m_transform, renderer()->borderBox().size());
+        RenderBox* box = renderBox();
+        ASSERT(box);
+        m_transform->makeIdentity();
+        box->style()->applyTransform(*m_transform, box->borderBoxRect().size(), RenderStyle::IncludeTransformOrigin);
+        makeMatrixRenderable(*m_transform);
     }
+
+    if (had3DTransform != has3DTransform())
+        dirty3DTransformedDescendantStatus();
+}
+
+TransformationMatrix RenderLayer::currentTransform() const
+{
+    if (!m_transform)
+        return TransformationMatrix();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (renderer()->style()->isRunningAcceleratedAnimation()) {
+        TransformationMatrix currTransform;
+        RefPtr<RenderStyle> style = renderer()->animation()->getAnimatedStyleForRenderer(renderer());
+        style->applyTransform(currTransform, renderBox()->borderBoxRect().size(), RenderStyle::IncludeTransformOrigin);
+        makeMatrixRenderable(currTransform);
+        return currTransform;
+    }
+#endif
+
+    return *m_transform;
 }
 
 void RenderLayer::setHasVisibleContent(bool b)
@@ -288,9 +370,10 @@ void RenderLayer::setHasVisibleContent(bool b)
     m_visibleContentStatusDirty = false; 
     m_hasVisibleContent = b;
     if (m_hasVisibleContent) {
-        m_repaintRect = renderer()->absoluteClippedOverflowRect();
-        m_outlineBox = renderer()->absoluteOutlineBounds();
-        if (!isOverflowOnly())
+        RenderBoxModelObject* repaintContainer = renderer()->containerForRepaint();
+        m_repaintRect = renderer()->clippedOverflowRectForRepaint(repaintContainer);
+        m_outlineBox = renderer()->outlineBoundsForRepaint(repaintContainer);
+        if (!isNormalFlowOnly())
             dirtyStackingContextZOrderLists();
     }
     if (parent())
@@ -342,12 +425,12 @@ void RenderLayer::updateVisibilityStatus()
     }
 
     if (m_visibleContentStatusDirty) {
-        if (m_object->style()->visibility() == VISIBLE)
+        if (renderer()->style()->visibility() == VISIBLE)
             m_hasVisibleContent = true;
         else {
             // layer may be hidden but still have some visible content, check for this
             m_hasVisibleContent = false;
-            RenderObject* r = m_object->firstChild();
+            RenderObject* r = renderer()->firstChild();
             while (r) {
                 if (r->style()->visibility() == VISIBLE && !r->hasLayer()) {
                     m_hasVisibleContent = true;
@@ -360,7 +443,7 @@ void RenderLayer::updateVisibilityStatus()
                 else {
                     do {
                         r = r->parent();
-                        if (r==m_object)
+                        if (r==renderer())
                             r = 0;
                     } while (r && !r->nextSibling());
                     if (r)
@@ -372,83 +455,180 @@ void RenderLayer::updateVisibilityStatus()
     }
 }
 
+void RenderLayer::dirty3DTransformedDescendantStatus()
+{
+    RenderLayer* curr = stackingContext();
+    if (curr)
+        curr->m_3DTransformedDescendantStatusDirty = true;
+        
+    // This propagates up through preserve-3d hierarchies to the enclosing flattening layer.
+    // Note that preserves3D() creates stacking context, so we can just run up the stacking contexts.
+    while (curr && curr->preserves3D()) {
+        curr->m_3DTransformedDescendantStatusDirty = true;
+        curr = curr->stackingContext();
+    }
+}
+
+// Return true if this layer or any preserve-3d descendants have 3d.
+bool RenderLayer::update3DTransformedDescendantStatus()
+{
+    if (m_3DTransformedDescendantStatusDirty) {
+        m_has3DTransformedDescendant = false;
+
+        // Transformed or preserve-3d descendants can only be in the z-order lists, not
+        // in the normal flow list, so we only need to check those.
+        if (m_posZOrderList) {
+            for (unsigned i = 0; i < m_posZOrderList->size(); ++i)
+                m_has3DTransformedDescendant |= m_posZOrderList->at(i)->update3DTransformedDescendantStatus();
+        }
+
+        // Now check our negative z-index children.
+        if (m_negZOrderList) {
+            for (unsigned i = 0; i < m_negZOrderList->size(); ++i)
+                m_has3DTransformedDescendant |= m_negZOrderList->at(i)->update3DTransformedDescendantStatus();
+        }
+        
+        m_3DTransformedDescendantStatusDirty = false;
+    }
+    
+    // If we live in a 3d hierarchy, then the layer at the root of that hierarchy needs
+    // the m_has3DTransformedDescendant set.
+    if (preserves3D())
+        return has3DTransform() || m_has3DTransformedDescendant;
+
+    return has3DTransform();
+}
+
 void RenderLayer::updateLayerPosition()
 {
     // Clear our cached clip rect information.
     clearClipRects();
 
-    int x = m_object->xPos();
-    int y = m_object->yPos() - m_object->borderTopExtra();
+    RenderBox* rendererBox = renderBox();
+    
+    int x = rendererBox ? rendererBox->x() : 0;
+    int y = rendererBox ? rendererBox->y() : 0;
 
-    if (!m_object->isPositioned() && m_object->parent()) {
+    if (!renderer()->isPositioned() && renderer()->parent()) {
         // We must adjust our position by walking up the render tree looking for the
         // nearest enclosing object with a layer.
-        RenderObject* curr = m_object->parent();
+        RenderObject* curr = renderer()->parent();
         while (curr && !curr->hasLayer()) {
-            if (!curr->isTableRow()) {
+            if (curr->isBox() && !curr->isTableRow()) {
                 // Rows and cells share the same coordinate space (that of the section).
                 // Omit them when computing our xpos/ypos.
-                x += curr->xPos();
-                y += curr->yPos();
+                RenderBox* currBox = toRenderBox(curr);
+                x += currBox->x();
+                y += currBox->y();
             }
             curr = curr->parent();
         }
-        y += curr->borderTopExtra();
-        if (curr->isTableRow()) {
+        if (curr->isBox() && curr->isTableRow()) {
             // Put ourselves into the row coordinate space.
-            x -= curr->xPos();
-            y -= curr->yPos();
+            RenderBox* currBox = toRenderBox(curr);
+            x -= currBox->x();
+            y -= currBox->y();
         }
     }
 
     m_relX = m_relY = 0;
-    if (m_object->isRelPositioned()) {
-        m_relX = static_cast<RenderBox*>(m_object)->relativePositionOffsetX();
-        m_relY = static_cast<RenderBox*>(m_object)->relativePositionOffsetY();
+    if (renderer()->isRelPositioned()) {
+        m_relX = renderer()->relativePositionOffsetX();
+        m_relY = renderer()->relativePositionOffsetY();
         x += m_relX; y += m_relY;
     }
     
     // Subtract our parent's scroll offset.
-    if (m_object->isPositioned() && enclosingPositionedAncestor()) {
+    if (renderer()->isPositioned() && enclosingPositionedAncestor()) {
         RenderLayer* positionedParent = enclosingPositionedAncestor();
 
         // For positioned layers, we subtract out the enclosing positioned layer's scroll offset.
         positionedParent->subtractScrolledContentOffset(x, y);
         
-        if (m_object->isPositioned()) {
-            IntSize offset = static_cast<RenderBox*>(m_object)->offsetForPositionedInContainer(positionedParent->renderer());
+        if (renderer()->isPositioned() && positionedParent->renderer()->isRelPositioned() && positionedParent->renderer()->isRenderInline()) {
+            IntSize offset = toRenderInline(positionedParent->renderer())->relativePositionedInlineOffset(toRenderBox(renderer()));
             x += offset.width();
             y += offset.height();
         }
     } else if (parent())
         parent()->subtractScrolledContentOffset(x, y);
     
-    setPos(x,y);
+    // FIXME: We'd really like to just get rid of the concept of a layer rectangle and rely on the renderers.
 
-    setWidth(m_object->width());
-    setHeight(m_object->height() + m_object->borderTopExtra() + m_object->borderBottomExtra());
+    setLocation(x, y);
 
-    if (!m_object->hasOverflowClip()) {
-        if (m_object->overflowWidth() > m_object->width())
-            setWidth(m_object->overflowWidth());
-        if (m_object->overflowHeight() > m_object->height())
-            setHeight(m_object->overflowHeight());
+    if (renderer()->isRenderInline()) {
+        RenderInline* inlineFlow = toRenderInline(renderer());
+        IntRect lineBox = inlineFlow->linesBoundingBox();
+        setWidth(lineBox.width());
+        setHeight(lineBox.height());
+    } else if (RenderBox* box = renderBox()) {
+        setWidth(box->width());
+        setHeight(box->height());
+
+        if (!box->hasOverflowClip()) {
+            if (box->overflowWidth() > box->width())
+                setWidth(box->overflowWidth());
+            if (box->overflowHeight() > box->height())
+                setHeight(box->overflowHeight());
+        }
     }
 }
 
-RenderLayer *RenderLayer::stackingContext() const
+TransformationMatrix RenderLayer::perspectiveTransform() const
 {
-    RenderLayer* curr = parent();
-    for ( ; curr && !curr->m_object->isRenderView() && !curr->m_object->isRoot() &&
-          curr->m_object->style()->hasAutoZIndex();
-          curr = curr->parent()) { }
-    return curr;
+    if (!renderer()->hasTransform())
+        return TransformationMatrix();
+
+    RenderStyle* style = renderer()->style();
+    if (!style->hasPerspective())
+        return TransformationMatrix();
+
+    // Maybe fetch the perspective from the backing?
+    const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
+    const float boxWidth = borderBox.width();
+    const float boxHeight = borderBox.height();
+
+    float perspectiveOriginX = style->perspectiveOriginX().calcFloatValue(boxWidth);
+    float perspectiveOriginY = style->perspectiveOriginY().calcFloatValue(boxHeight);
+
+    // A perspective origin of 0,0 makes the vanishing point in the center of the element.
+    // We want it to be in the top-left, so subtract half the height and width.
+    perspectiveOriginX -= boxWidth / 2.0f;
+    perspectiveOriginY -= boxHeight / 2.0f;
+    
+    TransformationMatrix t;
+    t.translate(perspectiveOriginX, perspectiveOriginY);
+    t.applyPerspective(style->perspective());
+    t.translate(-perspectiveOriginX, -perspectiveOriginY);
+    
+    return t;
+}
+
+FloatPoint RenderLayer::perspectiveOrigin() const
+{
+    if (!renderer()->hasTransform())
+        return FloatPoint();
+
+    const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
+    RenderStyle* style = renderer()->style();
+
+    return FloatPoint(style->perspectiveOriginX().calcFloatValue(borderBox.width()),
+                      style->perspectiveOriginY().calcFloatValue(borderBox.height()));
+}
+
+RenderLayer* RenderLayer::stackingContext() const
+{
+    RenderLayer* layer = parent();
+    while (layer && !layer->renderer()->isRenderView() && !layer->renderer()->isRoot() && layer->renderer()->style()->hasAutoZIndex())
+        layer = layer->parent();
+    return layer;
 }
 
 RenderLayer* RenderLayer::enclosingPositionedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->m_object->isRenderView() && !curr->m_object->isPositioned() && !curr->m_object->isRelPositioned() && !curr->hasTransform();
+    for ( ; curr && !curr->renderer()->isRenderView() && !curr->renderer()->isPositioned() && !curr->renderer()->isRelPositioned() && !curr->hasTransform();
          curr = curr->parent()) { }
     return curr;
 }
@@ -456,11 +636,32 @@ RenderLayer* RenderLayer::enclosingPositionedAncestor() const
 RenderLayer* RenderLayer::enclosingTransformedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->m_object->isRenderView() && !curr->transform(); curr = curr->parent())
+    for ( ; curr && !curr->renderer()->isRenderView() && !curr->transform(); curr = curr->parent())
         { }
     return curr;
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
+{
+    if (includeSelf && isComposited())
+        return const_cast<RenderLayer*>(this);
+
+    // Compositing layers are parented according to stacking order and overflow list,
+    // so we have to check whether the parent is a stacking context, or whether 
+    // the child is overflow-only.
+    bool inNormalFlowList = isNormalFlowOnly();
+    for (RenderLayer* curr = parent(); curr; curr = curr->parent()) {
+        if (curr->isComposited() && (inNormalFlowList || curr->isStackingContext()))
+            return curr;
+        
+        inNormalFlowList = curr->isNormalFlowOnly();
+    }
+         
+    return 0;
+}
+#endif
+
 IntPoint RenderLayer::absoluteToContents(const IntPoint& absolutePoint) const
 {
     // We don't use convertToLayerCoords because it doesn't know about transforms
@@ -479,18 +680,24 @@ bool RenderLayer::requiresSlowRepaints() const
 bool RenderLayer::isTransparent() const
 {
 #if ENABLE(SVG)
-    if (m_object->node()->namespaceURI() == SVGNames::svgNamespaceURI)
+    if (renderer()->node() && renderer()->node()->namespaceURI() == SVGNames::svgNamespaceURI)
         return false;
 #endif
-    return m_object->isTransparent() || m_object->hasMask();
+    return renderer()->isTransparent() || renderer()->hasMask();
 }
 
-RenderLayer*
-RenderLayer::transparentAncestor()
+RenderLayer* RenderLayer::transparentPaintingAncestor()
 {
-    RenderLayer* curr = parent();
-    for ( ; curr && !curr->isTransparent(); curr = curr->parent()) { }
-    return curr;
+    if (isComposited())
+        return 0;
+
+    for (RenderLayer* curr = parent(); curr; curr = curr->parent()) {
+        if (curr->isComposited())
+            return 0;
+        if (curr->isTransparent())
+            return curr;
+    }
+    return 0;
 }
 
 static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransform, const RenderLayer* l, const RenderLayer* rootLayer)
@@ -499,16 +706,16 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
     // paintDirtyRect, and that should cut down on the amount we have to paint.  Still it
     // would be better to respect clips.
     
-    TransformationMatrix* t = l->transform();
-    if (t && rootLayer != l) {
+    if (rootLayer != l && l->paintsWithTransform()) {
         // The best we can do here is to use enclosed bounding boxes to establish a "fuzzy" enough clip to encompass
         // the transformed layer and all of its children.
         int x = 0;
         int y = 0;
         l->convertToLayerCoords(rootLayer, x, y);
+
         TransformationMatrix transform;
         transform.translate(x, y);
-        transform = *t * transform;
+        transform = *l->transform() * transform;
         transform = transform * enclosingTransform;
 
         // We now have a transform that will produce a rectangle in our view's space.
@@ -542,14 +749,14 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
 
 void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer* rootLayer)
 {
-    if (p->paintingDisabled() || (isTransparent() && m_usedTransparency))
+    if (p->paintingDisabled() || (paintsWithTransparency() && m_usedTransparency))
         return;
     
-    RenderLayer* ancestor = transparentAncestor();
+    RenderLayer* ancestor = transparentPaintingAncestor();
     if (ancestor)
         ancestor->beginTransparencyLayers(p, rootLayer);
     
-    if (isTransparent()) {
+    if (paintsWithTransparency()) {
         m_usedTransparency = true;
         p->save();
         p->clip(transparencyClipBox(TransformationMatrix(), this, rootLayer));
@@ -569,7 +776,7 @@ void RenderLayer::operator delete(void* ptr, size_t sz)
 }
 
 void RenderLayer::destroy(RenderArena* renderArena)
-{    
+{
     delete this;
 
     // Recover the size left there for us by operator delete and free the memory.
@@ -593,10 +800,10 @@ void RenderLayer::addChild(RenderLayer* child, RenderLayer* beforeChild)
 
     child->setParent(this);
 
-    if (child->isOverflowOnly())
-        dirtyOverflowList();
+    if (child->isNormalFlowOnly())
+        dirtyNormalFlowList();
 
-    if (!child->isOverflowOnly() || child->firstChild()) {
+    if (!child->isNormalFlowOnly() || child->firstChild()) {
         // Dirty the z-order list in which we are contained.  The stackingContext() can be null in the
         // case where we're building up generated content layers.  This is ok, since the lists will start
         // off dirty in that case anyway.
@@ -606,10 +813,19 @@ void RenderLayer::addChild(RenderLayer* child, RenderLayer* beforeChild)
     child->updateVisibilityStatus();
     if (child->m_hasVisibleContent || child->m_hasVisibleDescendant)
         childVisibilityChanged(true);
+    
+#if USE(ACCELERATED_COMPOSITING)
+    compositor()->layerWasAdded(this, child);
+#endif
 }
 
 RenderLayer* RenderLayer::removeChild(RenderLayer* oldChild)
 {
+#if USE(ACCELERATED_COMPOSITING)
+    if (!renderer()->documentBeingDestroyed())
+        compositor()->layerWillBeRemoved(this, oldChild);
+#endif
+
     // remove the child
     if (oldChild->previousSibling())
         oldChild->previousSibling()->setNextSibling(oldChild->nextSibling());
@@ -621,9 +837,9 @@ RenderLayer* RenderLayer::removeChild(RenderLayer* oldChild)
     if (m_last == oldChild)
         m_last = oldChild->previousSibling();
 
-    if (oldChild->isOverflowOnly())
-        dirtyOverflowList();
-    if (!oldChild->isOverflowOnly() || oldChild->firstChild()) { 
+    if (oldChild->isNormalFlowOnly())
+        dirtyNormalFlowList();
+    if (!oldChild->isNormalFlowOnly() || oldChild->firstChild()) { 
         // Dirty the z-order list in which we are contained.  When called via the
         // reattachment process in removeOnlyThisLayer, the layer may already be disconnected
         // from the main layer tree, so we need to null-check the |stackingContext| value.
@@ -645,7 +861,15 @@ void RenderLayer::removeOnlyThisLayer()
 {
     if (!m_parent)
         return;
-    
+
+    // Mark that we are about to lose our layer. This makes render tree
+    // walks ignore this layer while we're removing it.
+    m_renderer->setHasLayer(false);
+
+#if USE(ACCELERATED_COMPOSITING)
+    compositor()->layerWillBeRemoved(m_parent, this);
+#endif
+
     // Dirty the clip rects.
     clearClipRectsIncludingDescendants();
 
@@ -663,11 +887,11 @@ void RenderLayer::removeOnlyThisLayer()
         RenderLayer* next = current->nextSibling();
         removeChild(current);
         parent->addChild(current, nextSib);
-        current->updateLayerPositions();
+        current->updateLayerPositions(); // Depends on hasLayer() already being false for proper layout.
         current = next;
     }
-    
-    destroy(renderer()->renderArena());
+
+    m_renderer->destroyLayer();
 }
 
 void RenderLayer::insertOnlyThisLayer()
@@ -676,46 +900,46 @@ void RenderLayer::insertOnlyThisLayer()
         // We need to connect ourselves when our renderer() has a parent.
         // Find our enclosingLayer and add ourselves.
         RenderLayer* parentLayer = renderer()->parent()->enclosingLayer();
+        ASSERT(parentLayer);
         RenderLayer* beforeChild = parentLayer->reflectionLayer() != this ? renderer()->parent()->findNextLayer(parentLayer, renderer()) : 0;
-        if (parentLayer)
-            parentLayer->addChild(this, beforeChild);
+        parentLayer->addChild(this, beforeChild);
     }
-    
+
     // Remove all descendant layers from the hierarchy and add them to the new position.
     for (RenderObject* curr = renderer()->firstChild(); curr; curr = curr->nextSibling())
         curr->moveLayers(m_parent, this);
-        
+
     // Clear out all the clip rects.
     clearClipRectsIncludingDescendants();
 }
 
 void 
-RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& x, int& y) const
+RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, int& yPos) const
 {
     if (ancestorLayer == this)
         return;
         
-    if (m_object->style()->position() == FixedPosition) {
+    if (renderer()->style()->position() == FixedPosition) {
         // Add in the offset of the view.  We can obtain this by calling
         // localToAbsolute() on the RenderView.
-        FloatPoint absPos = m_object->localToAbsolute(FloatPoint(), true);
-        x += absPos.x();
-        y += absPos.y();
+        FloatPoint absPos = renderer()->localToAbsolute(FloatPoint(), true);
+        xPos += absPos.x();
+        yPos += absPos.y();
         return;
     }
  
     RenderLayer* parentLayer;
-    if (m_object->style()->position() == AbsolutePosition)
+    if (renderer()->style()->position() == AbsolutePosition)
         parentLayer = enclosingPositionedAncestor();
     else
         parentLayer = parent();
     
     if (!parentLayer) return;
     
-    parentLayer->convertToLayerCoords(ancestorLayer, x, y);
+    parentLayer->convertToLayerCoords(ancestorLayer, xPos, yPos);
 
-    x += xPos();
-    y += yPos();
+    xPos += x();
+    yPos += y();
 }
 
 void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint) 
@@ -758,10 +982,10 @@ void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint)
 void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 {
     bool restrictedByLineClamp = false;
-    if (m_object->parent())
-        restrictedByLineClamp = m_object->parent()->style()->lineClamp() >= 0;
+    if (renderer()->parent())
+        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
 
-    if (m_object->hasOverflowClip() && !restrictedByLineClamp) {
+    if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
         int newOffsetX = scrollXOffset() + xDelta;
         int newOffsetY = scrollYOffset() + yDelta;
         scrollToOffset(newOffsetX, newOffsetY);
@@ -769,14 +993,14 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
         // If this layer can't do the scroll we ask its parent
         int leftToScrollX = newOffsetX - scrollXOffset();
         int leftToScrollY = newOffsetY - scrollYOffset();
-        if ((leftToScrollX || leftToScrollY) && m_object->parent()) {
-            m_object->parent()->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
+        if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
+            renderer()->parent()->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
             Frame* frame = renderer()->document()->frame();
             if (frame)
                 frame->eventHandler()->updateAutoscrollRenderer();
         }
-    } else if (m_object->view()->frameView())
-        m_object->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
+    } else if (renderer()->view()->frameView())
+        renderer()->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
 }
 
 
@@ -796,14 +1020,18 @@ RenderLayer::subtractScrolledContentOffset(int& x, int& y) const
 
 void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repaint)
 {
-    if (renderer()->style()->overflowX() != OMARQUEE) {
+    RenderBox* box = renderBox();
+    if (!box)
+        return;
+
+    if (box->style()->overflowX() != OMARQUEE) {
         if (x < 0) x = 0;
         if (y < 0) y = 0;
     
         // Call the scrollWidth/Height functions so that the dimensions will be computed if they need
         // to be (for overflow:hidden blocks).
-        int maxX = scrollWidth() - m_object->clientWidth();
-        int maxY = scrollHeight() - m_object->clientHeight();
+        int maxX = scrollWidth() - box->clientWidth();
+        int maxY = scrollHeight() - box->clientHeight();
         
         if (x > maxX) x = maxX;
         if (y > maxY) y = maxY;
@@ -823,6 +1051,11 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
     // Update the positions of our child layers.
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
         child->updateLayerPositions(false, false);
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (isComposited())
+        m_backing->updateGraphicsLayerGeometry();
+#endif
     
     RenderView* view = renderer()->view();
     
@@ -845,7 +1078,7 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
 
     // Just schedule a full repaint of our object.
     if (repaint)
-        m_object->repaint();
+        renderer()->repaint();
     
     if (updateScrollbars) {
         if (m_hBar)
@@ -857,7 +1090,7 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
     // Schedule the scroll DOM event.
     if (view) {
         if (FrameView* frameView = view->frameView())
-            frameView->scheduleEvent(Event::create(eventNames().scrollEvent, false, false), EventTargetNodeCast(renderer()->element()));
+            frameView->scheduleEvent(Event::create(eventNames().scrollEvent, false, false), renderer()->node());
     }
 }
 
@@ -868,24 +1101,26 @@ void RenderLayer::scrollRectToVisible(const IntRect &rect, bool scrollToAnchor,
     int xOffset = 0, yOffset = 0;
 
     // We may end up propagating a scroll event. It is important that we suspend events until 
-    // the end of the function since they could delete the layer or the layer's m_object.
-    FrameView* frameView = m_object->document()->view();
+    // the end of the function since they could delete the layer or the layer's renderer().
+    FrameView* frameView = renderer()->document()->view();
     if (frameView)
         frameView->pauseScheduledEvents();
 
     bool restrictedByLineClamp = false;
-    if (m_object->parent()) {
-        parentLayer = m_object->parent()->enclosingLayer();
-        restrictedByLineClamp = m_object->parent()->style()->lineClamp() >= 0;
+    if (renderer()->parent()) {
+        parentLayer = renderer()->parent()->enclosingLayer();
+        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
     }
 
-    if (m_object->hasOverflowClip() && !restrictedByLineClamp) {
+    if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
         // Don't scroll to reveal an overflow layer that is restricted by the -webkit-line-clamp property.
         // This will prevent us from revealing text hidden by the slider in Safari RSS.
-        FloatPoint absPos = m_object->localToAbsolute();
-        absPos.move(m_object->borderLeft(), m_object->borderTop());
+        RenderBox* box = renderBox();
+        ASSERT(box);
+        FloatPoint absPos = box->localToAbsolute();
+        absPos.move(box->borderLeft(), box->borderTop());
 
-        IntRect layerBounds = IntRect(absPos.x() + scrollXOffset(), absPos.y() + scrollYOffset(), m_object->clientWidth(), m_object->clientHeight());
+        IntRect layerBounds = IntRect(absPos.x() + scrollXOffset(), absPos.y() + scrollYOffset(), box->clientWidth(), box->clientHeight());
         IntRect exposeRect = IntRect(rect.x() + scrollXOffset(), rect.y() + scrollYOffset(), rect.width(), rect.height());
         IntRect r = getRectToExpose(layerBounds, exposeRect, alignX, alignY);
         
@@ -904,9 +1139,9 @@ void RenderLayer::scrollRectToVisible(const IntRect &rect, bool scrollToAnchor,
             newRect.setX(rect.x() - diffX);
             newRect.setY(rect.y() - diffY);
         }
-    } else if (!parentLayer && renderer()->canBeProgramaticallyScrolled(scrollToAnchor)) {
+    } else if (!parentLayer && renderer()->isBox() && renderBox()->canBeProgramaticallyScrolled(scrollToAnchor)) {
         if (frameView) {
-            if (m_object->document() && m_object->document()->ownerElement() && m_object->document()->ownerElement()->renderer()) {
+            if (renderer()->document() && renderer()->document()->ownerElement() && renderer()->document()->ownerElement()->renderer()) {
                 IntRect viewRect = frameView->visibleContentRect();
                 IntRect r = getRectToExpose(viewRect, rect, alignX, alignY);
                 
@@ -917,7 +1152,7 @@ void RenderLayer::scrollRectToVisible(const IntRect &rect, bool scrollToAnchor,
                 yOffset = max(0, min(frameView->contentsHeight(), yOffset));
 
                 frameView->setScrollPosition(IntPoint(xOffset, yOffset));
-                parentLayer = m_object->document()->ownerElement()->renderer()->enclosingLayer();
+                parentLayer = renderer()->document()->ownerElement()->renderer()->enclosingLayer();
                 newRect.setX(rect.x() - frameView->scrollX() + frameView->x());
                 newRect.setY(rect.y() - frameView->scrollY() + frameView->y());
             } else {
@@ -948,17 +1183,17 @@ IntRect RenderLayer::getRectToExpose(const IntRect &visibleRect, const IntRect &
         // If the rectangle is fully visible, use the specified visible behavior.
         // If the rectangle is partially visible, but over a certain threshold,
         // then treat it as fully visible to avoid unnecessary horizontal scrolling
-        scrollX = getVisibleBehavior(alignX);
+        scrollX = ScrollAlignment::getVisibleBehavior(alignX);
     else if (intersectWidth == visibleRect.width()) {
         // If the rect is bigger than the visible area, don't bother trying to center. Other alignments will work.
-        scrollX = getVisibleBehavior(alignX);
+        scrollX = ScrollAlignment::getVisibleBehavior(alignX);
         if (scrollX == alignCenter)
             scrollX = noScroll;
     } else if (intersectWidth > 0)
         // If the rectangle is partially visible, but not above the minimum threshold, use the specified partial behavior
-        scrollX = getPartialBehavior(alignX);
+        scrollX = ScrollAlignment::getPartialBehavior(alignX);
     else
-        scrollX = getHiddenBehavior(alignX);
+        scrollX = ScrollAlignment::getHiddenBehavior(alignX);
     // If we're trying to align to the closest edge, and the exposeRect is further right
     // than the visibleRect, and not bigger than the visible area, then align with the right.
     if (scrollX == alignToClosestEdge && exposeRect.right() > visibleRect.right() && exposeRect.width() < visibleRect.width())
@@ -981,17 +1216,17 @@ IntRect RenderLayer::getRectToExpose(const IntRect &visibleRect, const IntRect &
     int intersectHeight = intersection(visibleRect, exposeRectY).height();
     if (intersectHeight == exposeRect.height())
         // If the rectangle is fully visible, use the specified visible behavior.
-        scrollY = getVisibleBehavior(alignY);
+        scrollY = ScrollAlignment::getVisibleBehavior(alignY);
     else if (intersectHeight == visibleRect.height()) {
         // If the rect is bigger than the visible area, don't bother trying to center. Other alignments will work.
-        scrollY = getVisibleBehavior(alignY);
+        scrollY = ScrollAlignment::getVisibleBehavior(alignY);
         if (scrollY == alignCenter)
             scrollY = noScroll;
     } else if (intersectHeight > 0)
         // If the rectangle is partially visible, use the specified partial behavior
-        scrollY = getPartialBehavior(alignY);
+        scrollY = ScrollAlignment::getPartialBehavior(alignY);
     else
-        scrollY = getHiddenBehavior(alignY);
+        scrollY = ScrollAlignment::getHiddenBehavior(alignY);
     // If we're trying to align to the closest edge, and the exposeRect is further down
     // than the visibleRect, and not bigger than the visible area, then align with the bottom.
     if (scrollY == alignToClosestEdge && exposeRect.bottom() > visibleRect.bottom() && exposeRect.height() < visibleRect.height())
@@ -1024,18 +1259,19 @@ void RenderLayer::autoscroll()
     frame->eventHandler()->updateSelectionForMouseDrag();
 
     IntPoint currentDocumentPosition = frameView->windowToContents(frame->eventHandler()->currentMousePosition());
-    scrollRectToVisible(IntRect(currentDocumentPosition, IntSize(1, 1)), false, gAlignToEdgeIfNeeded, gAlignToEdgeIfNeeded);    
+    scrollRectToVisible(IntRect(currentDocumentPosition, IntSize(1, 1)), false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignToEdgeIfNeeded);
 }
 
 void RenderLayer::resize(const PlatformMouseEvent& evt, const IntSize& oldOffset)
 {
-    if (!inResizeMode() || !m_object->hasOverflowClip())
+    // FIXME: This should be possible on generated content but is not right now.
+    if (!inResizeMode() || !renderer()->hasOverflowClip() || !renderer()->node())
         return;
 
     // Set the width and height of the shadow ancestor node if there is one.
     // This is necessary for textarea elements since the resizable layer is in the shadow content.
-    Element* element = static_cast<Element*>(m_object->node()->shadowAncestorNode());
-    RenderBox* renderer = static_cast<RenderBox*>(element->renderer());
+    Element* element = static_cast<Element*>(renderer()->node()->shadowAncestorNode());
+    RenderBox* renderer = toRenderBox(element->renderer());
 
     EResize resize = renderer->style()->resize();
     if (resize == RESIZE_NONE)
@@ -1065,7 +1301,7 @@ void RenderLayer::resize(const PlatformMouseEvent& evt, const IntSize& oldOffset
     ExceptionCode ec;
 
     if (difference.width()) {
-        if (element && element->isControl()) {
+        if (element->isFormControlElement()) {
             // Make implicit margins from the theme explicit (see <http://bugs.webkit.org/show_bug.cgi?id=9547>).
             style->setProperty(CSSPropertyMarginLeft, String::number(renderer->marginLeft() / zoomFactor) + "px", false, ec);
             style->setProperty(CSSPropertyMarginRight, String::number(renderer->marginRight() / zoomFactor) + "px", false, ec);
@@ -1077,7 +1313,7 @@ void RenderLayer::resize(const PlatformMouseEvent& evt, const IntSize& oldOffset
     }
 
     if (difference.height()) {
-        if (element && element->isControl()) {
+        if (element->isFormControlElement()) {
             // Make implicit margins from the theme explicit (see <http://bugs.webkit.org/show_bug.cgi?id=9547>).
             style->setProperty(CSSPropertyMarginTop, String::number(renderer->marginTop() / zoomFactor) + "px", false, ec);
             style->setProperty(CSSPropertyMarginBottom, String::number(renderer->marginBottom() / zoomFactor) + "px", false, ec);
@@ -1164,6 +1400,7 @@ static IntRect scrollCornerRect(const RenderLayer* layer, const IntRect& bounds)
 
 static IntRect resizerCornerRect(const RenderLayer* layer, const IntRect& bounds)
 {
+    ASSERT(layer->renderer()->isBox());
     if (layer->renderer()->style()->resize() == RESIZE_NONE)
         return IntRect();
     return cornerRect(layer, bounds);
@@ -1171,28 +1408,32 @@ static IntRect resizerCornerRect(const RenderLayer* layer, const IntRect& bounds
 
 bool RenderLayer::scrollbarCornerPresent() const
 {
-    return !scrollCornerRect(this, m_object->borderBox()).isEmpty();
+    ASSERT(renderer()->isBox());
+    return !scrollCornerRect(this, renderBox()->borderBoxRect()).isEmpty();
 }
 
 void RenderLayer::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
 {
     IntRect scrollRect = rect;
+    RenderBox* box = renderBox();
+    ASSERT(box);
     if (scrollbar == m_vBar.get())
-        scrollRect.move(renderer()->width() - renderer()->borderRight() - scrollbar->width(), renderer()->borderTop());
+        scrollRect.move(box->width() - box->borderRight() - scrollbar->width(), box->borderTop());
     else
-        scrollRect.move(renderer()->borderLeft(), renderer()->height() - renderer()->borderBottom() - scrollbar->height());
+        scrollRect.move(box->borderLeft(), box->height() - box->borderBottom() - scrollbar->height());
     renderer()->repaintRectangle(scrollRect);
 }
 
 PassRefPtr<Scrollbar> RenderLayer::createScrollbar(ScrollbarOrientation orientation)
 {
     RefPtr<Scrollbar> widget;
-    bool hasCustomScrollbarStyle = m_object->node()->shadowAncestorNode()->renderer()->style()->hasPseudoStyle(RenderStyle::SCROLLBAR);
+    RenderObject* actualRenderer = renderer()->node() ? renderer()->node()->shadowAncestorNode()->renderer() : renderer();
+    bool hasCustomScrollbarStyle = actualRenderer->isBox() && actualRenderer->style()->hasPseudoStyle(SCROLLBAR);
     if (hasCustomScrollbarStyle)
-        widget = RenderScrollbar::createCustomScrollbar(this, orientation, m_object->node()->shadowAncestorNode()->renderer());
+        widget = RenderScrollbar::createCustomScrollbar(this, orientation, toRenderBox(actualRenderer));
     else
         widget = Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
-    m_object->document()->view()->addChild(widget.get());        
+    renderer()->document()->view()->addChild(widget.get());        
     return widget.release();
 }
 
@@ -1224,8 +1465,8 @@ void RenderLayer::setHasHorizontalScrollbar(bool hasScrollbar)
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // Force an update since we know the scrollbars have changed things.
-    if (m_object->document()->hasDashboardRegions())
-        m_object->document()->setDashboardRegionsDirty(true);
+    if (renderer()->document()->hasDashboardRegions())
+        renderer()->document()->setDashboardRegionsDirty(true);
 #endif
 }
 
@@ -1247,8 +1488,8 @@ void RenderLayer::setHasVerticalScrollbar(bool hasScrollbar)
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // Force an update since we know the scrollbars have changed things.
-    if (m_object->document()->hasDashboardRegions())
-        m_object->document()->setDashboardRegionsDirty(true);
+    if (renderer()->document()->hasDashboardRegions())
+        renderer()->document()->setDashboardRegionsDirty(true);
 #endif
 }
 
@@ -1276,28 +1517,32 @@ IntSize RenderLayer::offsetFromResizeCorner(const IntPoint& absolutePoint) const
 
 void RenderLayer::positionOverflowControls(int tx, int ty)
 {
-    if (!m_hBar && !m_vBar && (!m_object->hasOverflowClip() || m_object->style()->resize() == RESIZE_NONE))
+    if (!m_hBar && !m_vBar && (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE))
         return;
     
-    IntRect borderBox = m_object->borderBox();
+    RenderBox* box = renderBox();
+    if (!box)
+        return;
+
+    IntRect borderBox = box->borderBoxRect();
     IntRect scrollCorner(scrollCornerRect(this, borderBox));
     IntRect absBounds(borderBox.x() + tx, borderBox.y() + ty, borderBox.width(), borderBox.height());
     if (m_vBar)
-        m_vBar->setFrameRect(IntRect(absBounds.right() - m_object->borderRight() - m_vBar->width(),
-                                     absBounds.y() + m_object->borderTop(),
+        m_vBar->setFrameRect(IntRect(absBounds.right() - box->borderRight() - m_vBar->width(),
+                                     absBounds.y() + box->borderTop(),
                                      m_vBar->width(),
-                                     absBounds.height() - (m_object->borderTop() + m_object->borderBottom()) - scrollCorner.height()));
+                                     absBounds.height() - (box->borderTop() + box->borderBottom()) - scrollCorner.height()));
 
     if (m_hBar)
-        m_hBar->setFrameRect(IntRect(absBounds.x() + m_object->borderLeft(),
-                                     absBounds.bottom() - m_object->borderBottom() - m_hBar->height(),
-                                     absBounds.width() - (m_object->borderLeft() + m_object->borderRight()) - scrollCorner.width(),
+        m_hBar->setFrameRect(IntRect(absBounds.x() + box->borderLeft(),
+                                     absBounds.bottom() - box->borderBottom() - m_hBar->height(),
+                                     absBounds.width() - (box->borderLeft() + box->borderRight()) - scrollCorner.width(),
                                      m_hBar->height()));
     
     if (m_scrollCorner)
-        m_scrollCorner->setRect(scrollCorner);
+        m_scrollCorner->setFrameRect(scrollCorner);
     if (m_resizer)
-        m_resizer->setRect(resizerCornerRect(this, borderBox));
+        m_resizer->setFrameRect(resizerCornerRect(this, borderBox));
 }
 
 int RenderLayer::scrollWidth()
@@ -1316,19 +1561,22 @@ int RenderLayer::scrollHeight()
 
 void RenderLayer::computeScrollDimensions(bool* needHBar, bool* needVBar)
 {
+    RenderBox* box = renderBox();
+    ASSERT(box);
+    
     m_scrollDimensionsDirty = false;
     
-    bool ltr = m_object->style()->direction() == LTR;
+    bool ltr = renderer()->style()->direction() == LTR;
 
-    int clientWidth = m_object->clientWidth();
-    int clientHeight = m_object->clientHeight();
+    int clientWidth = box->clientWidth();
+    int clientHeight = box->clientHeight();
 
-    m_scrollLeftOverflow = ltr ? 0 : min(0, m_object->leftmostPosition(true, false) - m_object->borderLeft());
+    m_scrollLeftOverflow = ltr ? 0 : min(0, box->leftmostPosition(true, false) - box->borderLeft());
 
     int rightPos = ltr ?
-                    m_object->rightmostPosition(true, false) - m_object->borderLeft() :
+                    box->rightmostPosition(true, false) - box->borderLeft() :
                     clientWidth - m_scrollLeftOverflow;
-    int bottomPos = m_object->lowestPosition(true, false) - m_object->borderTop();
+    int bottomPos = box->lowestPosition(true, false) - box->borderTop();
 
     m_scrollWidth = max(rightPos, clientWidth);
     m_scrollHeight = max(bottomPos, clientHeight);
@@ -1358,9 +1606,9 @@ void RenderLayer::updateOverflowStatus(bool horizontalOverflow, bool verticalOve
         m_horizontalOverflow = horizontalOverflow;
         m_verticalOverflow = verticalOverflow;
         
-        if (FrameView* frameView = m_object->document()->view()) {
+        if (FrameView* frameView = renderer()->document()->view()) {
             frameView->scheduleEvent(OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow, verticalOverflowChanged, verticalOverflow),
-                EventTargetNodeCast(m_object->element()));
+                renderer()->node());
         }
     }
 }
@@ -1368,18 +1616,22 @@ void RenderLayer::updateOverflowStatus(bool horizontalOverflow, bool verticalOve
 void
 RenderLayer::updateScrollInfoAfterLayout()
 {
+    RenderBox* box = renderBox();
+    if (!box)
+        return;
+
     m_scrollDimensionsDirty = true;
 
     bool horizontalOverflow, verticalOverflow;
     computeScrollDimensions(&horizontalOverflow, &verticalOverflow);
 
-    if (m_object->style()->overflowX() != OMARQUEE) {
+    if (box->style()->overflowX() != OMARQUEE) {
         // Layout may cause us to be in an invalid scroll position.  In this case we need
         // to pull our scroll offsets back to the max (or push them up to the min).
-        int newX = max(0, min(scrollXOffset(), scrollWidth() - m_object->clientWidth()));
-        int newY = max(0, min(m_scrollY, scrollHeight() - m_object->clientHeight()));
+        int newX = max(0, min(scrollXOffset(), scrollWidth() - box->clientWidth()));
+        int newY = max(0, min(m_scrollY, scrollHeight() - box->clientHeight()));
         if (newX != scrollXOffset() || newY != m_scrollY) {
-            RenderView* view = m_object->view();
+            RenderView* view = renderer()->view();
             ASSERT(view);
             // scrollToOffset() may call updateLayerPositions(), which doesn't work
             // with LayoutState.
@@ -1396,58 +1648,58 @@ RenderLayer::updateScrollInfoAfterLayout()
     bool haveVerticalBar = m_vBar;
     
     // overflow:scroll should just enable/disable.
-    if (m_object->style()->overflowX() == OSCROLL)
+    if (renderer()->style()->overflowX() == OSCROLL)
         m_hBar->setEnabled(horizontalOverflow);
-    if (m_object->style()->overflowY() == OSCROLL)
+    if (renderer()->style()->overflowY() == OSCROLL)
         m_vBar->setEnabled(verticalOverflow);
 
     // A dynamic change from a scrolling overflow to overflow:hidden means we need to get rid of any
     // scrollbars that may be present.
-    if (m_object->style()->overflowX() == OHIDDEN && haveHorizontalBar)
+    if (renderer()->style()->overflowX() == OHIDDEN && haveHorizontalBar)
         setHasHorizontalScrollbar(false);
-    if (m_object->style()->overflowY() == OHIDDEN && haveVerticalBar)
+    if (renderer()->style()->overflowY() == OHIDDEN && haveVerticalBar)
         setHasVerticalScrollbar(false);
     
     // overflow:auto may need to lay out again if scrollbars got added/removed.
-    bool scrollbarsChanged = (m_object->hasAutoHorizontalScrollbar() && haveHorizontalBar != horizontalOverflow) || 
-                             (m_object->hasAutoVerticalScrollbar() && haveVerticalBar != verticalOverflow);    
+    bool scrollbarsChanged = (box->hasAutoHorizontalScrollbar() && haveHorizontalBar != horizontalOverflow) || 
+                             (box->hasAutoVerticalScrollbar() && haveVerticalBar != verticalOverflow);    
     if (scrollbarsChanged) {
-        if (m_object->hasAutoHorizontalScrollbar())
+        if (box->hasAutoHorizontalScrollbar())
             setHasHorizontalScrollbar(horizontalOverflow);
-        if (m_object->hasAutoVerticalScrollbar())
+        if (box->hasAutoVerticalScrollbar())
             setHasVerticalScrollbar(verticalOverflow);
 
 #if ENABLE(DASHBOARD_SUPPORT)
         // Force an update since we know the scrollbars have changed things.
-        if (m_object->document()->hasDashboardRegions())
-            m_object->document()->setDashboardRegionsDirty(true);
+        if (renderer()->document()->hasDashboardRegions())
+            renderer()->document()->setDashboardRegionsDirty(true);
 #endif
 
-        m_object->repaint();
+        renderer()->repaint();
 
-        if (m_object->style()->overflowX() == OAUTO || m_object->style()->overflowY() == OAUTO) {
+        if (renderer()->style()->overflowX() == OAUTO || renderer()->style()->overflowY() == OAUTO) {
             if (!m_inOverflowRelayout) {
                 // Our proprietary overflow: overlay value doesn't trigger a layout.
                 m_inOverflowRelayout = true;
-                m_object->setNeedsLayout(true);
-                if (m_object->isRenderBlock())
-                    static_cast<RenderBlock*>(m_object)->layoutBlock(true);
+                renderer()->setNeedsLayout(true, false);
+                if (renderer()->isRenderBlock())
+                    toRenderBlock(renderer())->layoutBlock(true);
                 else
-                    m_object->layout();
+                    renderer()->layout();
                 m_inOverflowRelayout = false;
             }
         }
     }
     
     // If overflow:scroll is turned into overflow:auto a bar might still be disabled (Bug 11985).
-    if (m_hBar && m_object->hasAutoHorizontalScrollbar())
+    if (m_hBar && box->hasAutoHorizontalScrollbar())
         m_hBar->setEnabled(true);
-    if (m_vBar && m_object->hasAutoVerticalScrollbar())
+    if (m_vBar && box->hasAutoVerticalScrollbar())
         m_vBar->setEnabled(true);
 
     // Set up the range (and page step/line step).
     if (m_hBar) {
-        int clientWidth = m_object->clientWidth();
+        int clientWidth = box->clientWidth();
         int pageStep = (clientWidth - cAmountToKeepWhenPaging);
         if (pageStep < 0) pageStep = clientWidth;
         m_hBar->setSteps(cScrollbarPixelsPerLineStep, pageStep);
@@ -1455,21 +1707,21 @@ RenderLayer::updateScrollInfoAfterLayout()
         m_hBar->setValue(scrollXOffset());
     }
     if (m_vBar) {
-        int clientHeight = m_object->clientHeight();
+        int clientHeight = box->clientHeight();
         int pageStep = (clientHeight - cAmountToKeepWhenPaging);
         if (pageStep < 0) pageStep = clientHeight;
         m_vBar->setSteps(cScrollbarPixelsPerLineStep, pageStep);
         m_vBar->setProportion(clientHeight, m_scrollHeight);
     }
  
-    if (m_object->element() && m_object->document()->hasListenerType(Document::OVERFLOWCHANGED_LISTENER))
+    if (renderer()->node() && renderer()->document()->hasListenerType(Document::OVERFLOWCHANGED_LISTENER))
         updateOverflowStatus(horizontalOverflow, verticalOverflow);
 }
 
 void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
 {
     // Don't do anything if we have no overflow.
-    if (!m_object->hasOverflowClip())
+    if (!renderer()->hasOverflowClip())
         return;
     
     // Move the scrollbar widgets if necessary.  We normally move and resize widgets during layout, but sometimes
@@ -1493,7 +1745,10 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty
 
 void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
 {
-    IntRect cornerRect = scrollCornerRect(this, m_object->borderBox());
+    RenderBox* box = renderBox();
+    ASSERT(box);
+
+    IntRect cornerRect = scrollCornerRect(this, box->borderBoxRect());
     IntRect absRect = IntRect(cornerRect.x() + tx, cornerRect.y() + ty, cornerRect.width(), cornerRect.height());
     if (!absRect.intersects(damageRect))
         return;
@@ -1513,10 +1768,13 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, co
 
 void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
 {
-    if (m_object->style()->resize() == RESIZE_NONE)
+    if (renderer()->style()->resize() == RESIZE_NONE)
         return;
 
-    IntRect cornerRect = resizerCornerRect(this, m_object->borderBox());
+    RenderBox* box = renderBox();
+    ASSERT(box);
+
+    IntRect cornerRect = resizerCornerRect(this, box->borderBoxRect());
     IntRect absRect = IntRect(cornerRect.x() + tx, cornerRect.y() + ty, cornerRect.width(), cornerRect.height());
     if (!absRect.intersects(damageRect))
         return;
@@ -1540,6 +1798,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
     // Clipping will exclude the right and bottom edges of this frame.
     if (m_hBar || m_vBar) {
         context->save();
+        context->clip(absRect);
         IntRect largerCorner = absRect;
         largerCorner.setSize(IntSize(largerCorner.width() + 1, largerCorner.height() + 1));
         context->setStrokeColor(Color(makeRGB(217, 217, 217)));
@@ -1552,12 +1811,15 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
 
 bool RenderLayer::isPointInResizeControl(const IntPoint& absolutePoint) const
 {
-    if (!m_object->hasOverflowClip() || m_object->style()->resize() == RESIZE_NONE)
+    if (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE)
         return false;
     
+    RenderBox* box = renderBox();
+    ASSERT(box);
+
     IntPoint localPoint = absoluteToContents(absolutePoint);
 
-    IntRect localBounds(0, 0, m_object->width(), m_object->height());
+    IntRect localBounds(0, 0, box->width(), box->height());
     return resizerCornerRect(this, localBounds).contains(localPoint);
 }
     
@@ -1566,10 +1828,13 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result)
     if (!m_hBar && !m_vBar && (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE))
         return false;
 
+    RenderBox* box = renderBox();
+    ASSERT(box);
+
     int x = 0;
     int y = 0;
     convertToLayerCoords(root(), x, y);
-    IntRect absBounds(x, y, renderer()->width(), renderer()->height());
+    IntRect absBounds(x, y, box->width(), box->height());
     
     IntRect resizeControlRect;
     if (renderer()->style()->resize() != RESIZE_NONE) {
@@ -1581,7 +1846,10 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result)
     int resizeControlSize = max(resizeControlRect.height(), 0);
 
     if (m_vBar) {
-        IntRect vBarRect(absBounds.right() - renderer()->borderRight() - m_vBar->width(), absBounds.y() + renderer()->borderTop(), m_vBar->width(), absBounds.height() - (renderer()->borderTop() + renderer()->borderBottom()) - (m_hBar ? m_hBar->height() : resizeControlSize));
+        IntRect vBarRect(absBounds.right() - box->borderRight() - m_vBar->width(), 
+                         absBounds.y() + box->borderTop(),
+                         m_vBar->width(),
+                         absBounds.height() - (box->borderTop() + box->borderBottom()) - (m_hBar ? m_hBar->height() : resizeControlSize));
         if (vBarRect.contains(result.point())) {
             result.setScrollbar(m_vBar.get());
             return true;
@@ -1590,7 +1858,10 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result)
 
     resizeControlSize = max(resizeControlRect.width(), 0);
     if (m_hBar) {
-        IntRect hBarRect(absBounds.x() + renderer()->borderLeft(), absBounds.bottom() - renderer()->borderBottom() - m_hBar->height(), absBounds.width() - (renderer()->borderLeft() + renderer()->borderRight()) - (m_vBar ? m_vBar->width() : resizeControlSize), m_hBar->height());
+        IntRect hBarRect(absBounds.x() + box->borderLeft(),
+                         absBounds.bottom() - box->borderBottom() - m_hBar->height(),
+                         absBounds.width() - (box->borderLeft() + box->borderRight()) - (m_vBar ? m_vBar->width() : resizeControlSize),
+                         m_hBar->height());
         if (hBarRect.contains(result.point())) {
             result.setScrollbar(m_hBar.get());
             return true;
@@ -1620,10 +1891,13 @@ bool RenderLayer::scroll(ScrollDirection direction, ScrollGranularity granularit
     return (didHorizontalScroll || didVerticalScroll);
 }
 
-void
-RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintRestriction paintRestriction, RenderObject *paintingRoot)
+void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintRestriction paintRestriction, RenderObject *paintingRoot)
 {
-    paintLayer(this, p, damageRect, false, paintRestriction, paintingRoot);
+    RenderObject::OverlapTestRequestMap overlapTestRequests;
+    paintLayer(this, p, damageRect, false, paintRestriction, paintingRoot, &overlapTestRequests);
+    RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
+    for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it)
+        it->first->setOverlapTestResult(false);
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
@@ -1641,11 +1915,32 @@ static void restoreClip(GraphicsContext* p, const IntRect& paintDirtyRect, const
     p->restore();
 }
 
-void
-RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
+static void performOverlapTests(RenderObject::OverlapTestRequestMap& overlapTestRequests, const IntRect& layerBounds)
+{
+    Vector<OverlapTestRequestClient*> overlappedRequestClients;
+    RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
+    for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it) {
+        if (!layerBounds.intersects(it->second))
+            continue;
+
+        it->first->setOverlapTestResult(true);
+        overlappedRequestClients.append(it->first);
+    }
+    for (size_t i = 0; i < overlappedRequestClients.size(); ++i)
+        overlapTestRequests.remove(overlappedRequestClients[i]);
+}
+
+void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
                         const IntRect& paintDirtyRect, bool haveTransparency, PaintRestriction paintRestriction,
-                        RenderObject* paintingRoot, bool appliedTransform, bool temporaryClipRects)
+                        RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
+                        bool appliedTransform, bool temporaryClipRects)
 {
+#if USE(ACCELERATED_COMPOSITING)
+    // Composited RenderLayers are painted via the backing's paintIntoLayer().
+    if (isComposited() && !backing()->paintingGoesToWindow())
+        return;
+#endif
+
     // Avoid painting layers when stylesheets haven't loaded.  This eliminates FOUC.
     // It's ok not to draw, because later on, when all the stylesheets do load, updateStyleSelector on the Document
     // will do a full repaint().
@@ -1653,14 +1948,14 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         return;
     
     // If this layer is totally invisible then there is nothing to paint.
-    if (!m_object->opacity())
+    if (!renderer()->opacity())
         return;
 
-    if (isTransparent())
+    if (paintsWithTransparency())
         haveTransparency = true;
 
     // Apply a transform if we have one.  A reflection is considered to be a transform, since it is a flip and a translate.
-    if (m_transform && !appliedTransform) {
+    if (paintsWithTransform() && !appliedTransform) {
         // If the transform can't be inverted, then don't paint anything.
         if (!m_transform->isInvertible())
             return;
@@ -1673,14 +1968,9 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         // Make sure the parent's clip rects have been calculated.
         IntRect clipRect = paintDirtyRect;
         if (parent()) {
-            if (temporaryClipRects) {
-                ClipRects parentClipRects;
-                parent()->calculateClipRects(rootLayer, parentClipRects);
-                clipRect = parentClipRects.overflowClipRect();
-            } else {
-                parent()->updateClipRects(rootLayer);
-                clipRect = parent()->clipRects()->overflowClipRect();
-            }
+            ClipRects parentRects;
+            parentClipRects(rootLayer, parentRects, temporaryClipRects);
+            clipRect = parentRects.overflowClipRect();
             clipRect.intersect(paintDirtyRect);
         }
         
@@ -1701,8 +1991,8 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         p->concatCTM(transform);
 
         // Now do a paint with the root layer shifted to be us.
-        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), haveTransparency, paintRestriction, paintingRoot, true, temporaryClipRects);
-        
+        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, true, temporaryClipRects);
+
         p->restore();
         
         // Restore the clip.
@@ -1715,7 +2005,7 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (m_reflection && !m_paintingInsideReflection && (!m_transform || appliedTransform)) {
         // Mark that we are now inside replica painting.
         m_paintingInsideReflection = true;
-        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
+        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
         m_paintingInsideReflection = false;
     }
 
@@ -1724,12 +2014,11 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     calculateRects(rootLayer, paintDirtyRect, layerBounds, damageRect, clipRectToApply, outlineRect, temporaryClipRects);
     int x = layerBounds.x();
     int y = layerBounds.y();
-    int tx = x - renderer()->xPos();
-    int ty = y - renderer()->yPos() + renderer()->borderTopExtra();
+    int tx = x - renderBoxX();
+    int ty = y - renderBoxY();
                              
     // Ensure our lists are up-to-date.
-    updateZOrderLists();
-    updateOverflowList();
+    updateLayerListsIfNeeded();
 
     bool selectionOnly = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
     bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
@@ -1739,11 +2028,14 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Else, our renderer tree may or may not contain the painting root, so we pass that root along
     // so it will be tested against as we decend through the renderers.
     RenderObject* paintingRootForRenderer = 0;
-    if (paintingRoot && !m_object->isDescendantOf(paintingRoot))
+    if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
 
+    if (overlapTestRequests)
+        performOverlapTests(*overlapTestRequests, layerBounds);
+
     // We want to paint our layer, but only if we intersect the damage rect.
-    bool shouldPaint = intersectsDamageRect(layerBounds, damageRect, rootLayer) && m_hasVisibleContent;
+    bool shouldPaint = intersectsDamageRect(layerBounds, damageRect, rootLayer) && m_hasVisibleContent && isSelfPaintingLayer();
     if (shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
@@ -1757,11 +2049,6 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         RenderObject::PaintInfo paintInfo(p, damageRect, PaintPhaseBlockBackground, false, paintingRootForRenderer, 0);
         renderer()->paint(paintInfo, tx, ty);
 
-        // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
-        // z-index.  We paint after we painted the background/border, so that the scrollbars will
-        // sit above the background/border.
-        paintOverflowControls(p, x, y, damageRect);
-        
         // Restore the clip.
         restoreClip(p, paintDirtyRect, damageRect);
     }
@@ -1769,7 +2056,7 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Now walk the sorted list of children with negative z-indices.
     if (m_negZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_negZOrderList->begin(); it != m_negZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
     
     // Now establish the appropriate clip and paint our child RenderObjects.
     if (shouldPaint && !clipRectToApply.isEmpty()) {
@@ -1787,6 +2074,7 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
             paintInfo.phase = PaintPhaseFloat;
             renderer()->paint(paintInfo, tx, ty);
             paintInfo.phase = PaintPhaseForeground;
+            paintInfo.overlapTestRequests = overlapTestRequests;
             renderer()->paint(paintInfo, tx, ty);
             paintInfo.phase = PaintPhaseChildOutlines;
             renderer()->paint(paintInfo, tx, ty);
@@ -1796,7 +2084,7 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         restoreClip(p, paintDirtyRect, clipRectToApply);
     }
     
-    if (!outlineRect.isEmpty()) {
+    if (!outlineRect.isEmpty() && isSelfPaintingLayer()) {
         // Paint our own outline
         RenderObject::PaintInfo paintInfo(p, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
         setClip(p, paintDirtyRect, outlineRect);
@@ -1805,14 +2093,14 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     }
     
     // Paint any child layers that have overflow.
-    if (m_overflowList)
-        for (Vector<RenderLayer*>::iterator it = m_overflowList->begin(); it != m_overflowList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
-    
+    if (m_normalFlowList)
+        for (Vector<RenderLayer*>::iterator it = m_normalFlowList->begin(); it != m_normalFlowList->end(); ++it)
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
+
     // Now walk the sorted list of children with positive z-indices.
     if (m_posZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_posZOrderList->begin(); it != m_posZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
     
     if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         setClip(p, paintDirtyRect, damageRect);
@@ -1826,7 +2114,7 @@ RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     }
 
     // End our transparency layer
-    if (isTransparent() && m_usedTransparency) {
+    if (haveTransparency && m_usedTransparency && !m_paintingInsideReflection) {
         p->endTransparencyLayer();
         p->restore();
         m_usedTransparency = false;
@@ -1847,9 +2135,19 @@ bool RenderLayer::hitTest(const HitTestRequest& request, HitTestResult& result)
     renderer()->document()->updateLayout();
     
     IntRect boundsRect(m_x, m_y, width(), height());
-    boundsRect.intersect(frameVisibleRect(renderer()));
-
-    RenderLayer* insideLayer = hitTestLayer(this, request, result, boundsRect, result.point());
+    if (!request.ignoreClipping())
+        boundsRect.intersect(frameVisibleRect(renderer()));
+
+    RenderLayer* insideLayer = hitTestLayer(this, 0, request, result, boundsRect, result.point(), false);
+    if (!insideLayer) {
+        // We didn't hit any layer. If we are the root layer and the mouse is -- or just was -- down, 
+        // return ourselves. We do this so mouse events continue getting delivered after a drag has 
+        // exited the WebView, and so hit testing over a scrollbar hits the content document.
+        if ((request.active() || request.mouseUp()) && renderer()->isRenderView()) {
+            renderer()->updateHitTestResult(result, result.point());
+            insideLayer = this;
+        }
+    }
 
     // Now determine if the result is inside an anchor; make sure an image map wins if
     // it already set URLElement and only use the innermost.
@@ -1872,135 +2170,306 @@ bool RenderLayer::hitTest(const HitTestRequest& request, HitTestResult& result)
 Node* RenderLayer::enclosingElement() const
 {
     for (RenderObject* r = renderer(); r; r = r->parent()) {
-        if (Node* e = r->element())
+        if (Node* e = r->node())
             return e;
     }
     ASSERT_NOT_REACHED();
     return 0;
 }
 
-RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, const HitTestRequest& request, HitTestResult& result,
-                                       const IntRect& hitTestRect, const IntPoint& hitTestPoint, bool appliedTransform)
+// Compute the z-offset of the point in the transformState.
+// This is effectively projecting a ray normal to the plane of ancestor, finding where that
+// ray intersects target, and computing the z delta between those two points.
+static double computeZOffset(const HitTestingTransformState& transformState)
+{
+    // We got an affine transform, so no z-offset
+    if (transformState.m_accumulatedTransform.isAffine())
+        return 0;
+
+    // Flatten the point into the target plane
+    FloatPoint targetPoint = transformState.mappedPoint();
+    
+    // Now map the point back through the transform, which computes Z.
+    FloatPoint3D backmappedPoint = transformState.m_accumulatedTransform.mapPoint(FloatPoint3D(targetPoint));
+    return backmappedPoint.z();
+}
+
+PassRefPtr<HitTestingTransformState> RenderLayer::createLocalTransformState(RenderLayer* rootLayer, RenderLayer* containerLayer,
+                                        const IntRect& hitTestRect, const IntPoint& hitTestPoint,
+                                        const HitTestingTransformState* containerTransformState) const
 {
+    RefPtr<HitTestingTransformState> transformState;
+    int offsetX = 0;
+    int offsetY = 0;
+    if (containerTransformState) {
+        // If we're already computing transform state, then it's relative to the container (which we know is non-null).
+        transformState = HitTestingTransformState::create(*containerTransformState);
+        convertToLayerCoords(containerLayer, offsetX, offsetY);
+    } else {
+        // If this is the first time we need to make transform state, then base it off of hitTestPoint,
+        // which is relative to rootLayer.
+        transformState = HitTestingTransformState::create(hitTestPoint, FloatQuad(hitTestRect));
+        convertToLayerCoords(rootLayer, offsetX, offsetY);
+    }
+    
+    RenderObject* containerRenderer = containerLayer ? containerLayer->renderer() : 0;
+    if (renderer()->shouldUseTransformFromContainer(containerRenderer)) {
+        TransformationMatrix containerTransform;
+        renderer()->getTransformFromContainer(containerRenderer, IntSize(offsetX, offsetY), containerTransform);
+        transformState->applyTransform(containerTransform, HitTestingTransformState::AccumulateTransform);
+    } else {
+        transformState->translate(offsetX, offsetY, HitTestingTransformState::AccumulateTransform);
+    }
+    
+    return transformState;
+}
+
+
+static bool isHitCandidate(const RenderLayer* hitLayer, bool canDepthSort, double* zOffset, const HitTestingTransformState* transformState)
+{
+    if (!hitLayer)
+        return false;
+
+    // The hit layer is depth-sorting with other layers, so just say that it was hit.
+    if (canDepthSort)
+        return true;
+    
+    // We need to look at z-depth to decide if this layer was hit.
+    if (zOffset) {
+        ASSERT(transformState);
+        // This is actually computing our z, but that's OK because the hitLayer is coplanar with us.
+        double childZOffset = computeZOffset(*transformState);
+        if (childZOffset > *zOffset) {
+            *zOffset = childZOffset;
+            return true;
+        }
+        return false;
+    }
+
+    return true;
+}
+
+// hitTestPoint and hitTestRect are relative to rootLayer.
+// A 'flattening' layer is one preserves3D() == false.
+// transformState.m_accumulatedTransform holds the transform from the containing flattening layer.
+// transformState.m_lastPlanarPoint is the hitTestPoint in the plane of the containing flattening layer.
+// transformState.m_lastPlanarQuad is the hitTestRect as a quad in the plane of the containing flattening layer.
+// 
+// If zOffset is non-null (which indicates that the caller wants z offset information), 
+//  *zOffset on return is the z offset of the hit point relative to the containing flattening layer.
+RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
+                                                const IntRect& hitTestRect, const IntPoint& hitTestPoint, bool appliedTransform,
+                                                const HitTestingTransformState* transformState, double* zOffset)
+{
+    // The natural thing would be to keep HitTestingTransformState on the stack, but it's big, so we heap-allocate.
+
+    bool useTemporaryClipRects = false;
+#if USE(ACCELERATED_COMPOSITING)
+    useTemporaryClipRects = compositor()->inCompositingMode();
+#endif
+    
     // Apply a transform if we have one.
-    if (m_transform && !appliedTransform) {
-        // If the transform can't be inverted, then don't hit test this layer at all.
-        if (!m_transform->isInvertible())
-            return 0;
-  
+    if (transform() && !appliedTransform) {
         // Make sure the parent's clip rects have been calculated.
         if (parent()) {
-            parent()->updateClipRects(rootLayer);
-        
+            ClipRects parentRects;
+            parentClipRects(rootLayer, parentRects, useTemporaryClipRects);
+            IntRect clipRect = parentRects.overflowClipRect();
             // Go ahead and test the enclosing clip now.
-            IntRect clipRect = parent()->clipRects()->overflowClipRect();
             if (!clipRect.contains(hitTestPoint))
                 return 0;
         }
 
-        // Adjust the transform such that the renderer's upper left corner is at (0,0) in user space.
-        // This involves subtracting out the position of the layer in our current coordinate space.
-        int x = 0;
-        int y = 0;
-        convertToLayerCoords(rootLayer, x, y);
-        TransformationMatrix transform;
-        transform.translate(x, y);
-        transform = *m_transform * transform;
-        
-        // Map the hit test point into the transformed space and then do a hit test with the root layer shifted to be us.
-        return hitTestLayer(this, request, result, transform.inverse().mapRect(hitTestRect), transform.inverse().mapPoint(hitTestPoint), true);
+        // Create a transform state to accumulate this transform.
+        RefPtr<HitTestingTransformState> newTransformState = createLocalTransformState(rootLayer, containerLayer, hitTestRect, hitTestPoint, transformState);
+
+        // If the transform can't be inverted, then don't hit test this layer at all.
+        if (!newTransformState->m_accumulatedTransform.isInvertible())
+            return 0;
+
+        // Compute the point and the hit test rect in the coords of this layer by using the values
+        // from the transformState, which store the point and quad in the coords of the last flattened
+        // layer, and the accumulated transform which lets up map through preserve-3d layers.
+        //
+        // We can't just map hitTestPoint and hitTestRect because they may have been flattened (losing z)
+        // by our container.
+        IntPoint localPoint = roundedIntPoint(newTransformState->mappedPoint());
+        IntRect localHitTestRect;
+#if USE(ACCELERATED_COMPOSITING)
+        if (isComposited()) {
+            // It doesn't make sense to project hitTestRect into the plane of this layer, so use the same bounds we use for painting.
+            localHitTestRect = compositor()->calculateCompositedBounds(this, this);
+        } else
+#endif
+            localHitTestRect = newTransformState->mappedQuad().enclosingBoundingBox();
+
+        // Now do a hit test with the root layer shifted to be us.
+        return hitTestLayer(this, containerLayer, request, result, localHitTestRect, localPoint, true, newTransformState.get(), zOffset);
     }
 
+    // Ensure our lists and 3d status are up-to-date.
+    updateLayerListsIfNeeded();
+    update3DTransformedDescendantStatus();
+    
+    RefPtr<HitTestingTransformState> localTransformState;
+    if (appliedTransform) {
+        // We computed the correct state in the caller (above code), so just reference it.
+        ASSERT(transformState);
+        localTransformState = const_cast<HitTestingTransformState*>(transformState);
+    } else if (transformState || m_has3DTransformedDescendant || preserves3D()) {
+        // We need transform state for the first time, or to offset the container state, so create it here.
+        localTransformState = createLocalTransformState(rootLayer, containerLayer, hitTestRect, hitTestPoint, transformState);
+    }
+
+    // Check for hit test on backface if backface-visibility is 'hidden'
+    if (localTransformState && renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden) {
+        TransformationMatrix invertedMatrix = localTransformState->m_accumulatedTransform.inverse();
+        // If the z-vector of the matrix is negative, the back is facing towards the viewer.
+        if (invertedMatrix.m33() < 0)
+            return 0;
+    }
+
+    RefPtr<HitTestingTransformState> unflattenedTransformState = localTransformState;
+    if (localTransformState && !preserves3D()) {
+        // Keep a copy of the pre-flattening state, for computing z-offsets for the container
+        unflattenedTransformState = HitTestingTransformState::create(*localTransformState);
+        // This layer is flattening, so flatten the state passed to descendants.
+        localTransformState->flatten();
+    }
+    
     // Calculate the clip rects we should use.
     IntRect layerBounds;
     IntRect bgRect;
     IntRect fgRect;
     IntRect outlineRect;
-    calculateRects(rootLayer, hitTestRect, layerBounds, bgRect, fgRect, outlineRect);
-    
-    // Ensure our lists are up-to-date.
-    updateZOrderLists();
-    updateOverflowList();
-
-    // This variable tracks which layer the mouse ends up being inside.  The minute we find an insideLayer,
-    // we are done and can return it.
-    RenderLayer* insideLayer = 0;
-    
-    // Begin by walking our list of positive layers from highest z-index down to the lowest
-    // z-index.
+    calculateRects(rootLayer, hitTestRect, layerBounds, bgRect, fgRect, outlineRect, useTemporaryClipRects);
+    
+    // The following are used for keeping track of the z-depth of the hit point of 3d-transformed
+    // descendants.
+    double localZOffset = -numeric_limits<double>::infinity();
+    double* zOffsetForDescendantsPtr = 0;
+    double* zOffsetForContentsPtr = 0;
+    
+    bool depthSortDescendants = false;
+    if (preserves3D()) {
+        depthSortDescendants = true;
+        // Our layers can depth-test with our container, so share the z depth pointer with the container, if it passed one down.
+        zOffsetForDescendantsPtr = zOffset ? zOffset : &localZOffset;
+        zOffsetForContentsPtr = zOffset ? zOffset : &localZOffset;
+    } else if (m_has3DTransformedDescendant) {
+        // Flattening layer with 3d children; use a local zOffset pointer to depth-test children and foreground.
+        depthSortDescendants = true;
+        zOffsetForDescendantsPtr = zOffset ? zOffset : &localZOffset;
+        zOffsetForContentsPtr = zOffset ? zOffset : &localZOffset;
+    } else if (zOffset) {
+        zOffsetForDescendantsPtr = 0;
+        // Container needs us to give back a z offset for the hit layer.
+        zOffsetForContentsPtr = zOffset;
+    }
+    
+    // This variable tracks which layer the mouse ends up being inside. 
+    RenderLayer* candidateLayer = 0;
+
+    // Begin by walking our list of positive layers from highest z-index down to the lowest z-index.
     if (m_posZOrderList) {
         for (int i = m_posZOrderList->size() - 1; i >= 0; --i) {
-            insideLayer = m_posZOrderList->at(i)->hitTestLayer(rootLayer, request, result, hitTestRect, hitTestPoint);
-            if (insideLayer)
-                return insideLayer;
+            HitTestResult tempResult(result.point());
+            RenderLayer* hitLayer = m_posZOrderList->at(i)->hitTestLayer(rootLayer, this, request, tempResult, hitTestRect, hitTestPoint, false, localTransformState.get(), zOffsetForDescendantsPtr);
+            if (isHitCandidate(hitLayer, depthSortDescendants, zOffset, unflattenedTransformState.get())) {
+                result = tempResult;
+                if (!depthSortDescendants)
+                    return hitLayer;
+
+                candidateLayer = hitLayer;
+            }
         }
     }
 
     // Now check our overflow objects.
-    if (m_overflowList) {
-        for (int i = m_overflowList->size() - 1; i >= 0; --i) {
-            insideLayer = m_overflowList->at(i)->hitTestLayer(rootLayer, request, result, hitTestRect, hitTestPoint);
-            if (insideLayer)
-                return insideLayer;
+    if (m_normalFlowList) {
+        for (int i = m_normalFlowList->size() - 1; i >= 0; --i) {
+            RenderLayer* currLayer = m_normalFlowList->at(i);
+            HitTestResult tempResult(result.point());
+            RenderLayer* hitLayer = currLayer->hitTestLayer(rootLayer, this, request, tempResult, hitTestRect, hitTestPoint, false, localTransformState.get(), zOffsetForDescendantsPtr);
+            if (isHitCandidate(hitLayer, depthSortDescendants, zOffset, unflattenedTransformState.get())) {
+                result = tempResult;
+                if (!depthSortDescendants)
+                    return hitLayer;
+
+                candidateLayer = hitLayer;
+            }
         }
     }
 
     // Next we want to see if the mouse pos is inside the child RenderObjects of the layer.
-    if (fgRect.contains(hitTestPoint) && 
-        renderer()->hitTest(request, result, hitTestPoint,
-                            layerBounds.x() - renderer()->xPos(),
-                            layerBounds.y() - renderer()->yPos() + m_object->borderTopExtra(), 
-                            HitTestDescendants)) {
-        // For positioned generated content, we might still not have a
-        // node by the time we get to the layer level, since none of
-        // the content in the layer has an element. So just walk up
-        // the tree.
-        if (!result.innerNode() || !result.innerNonSharedNode()) {
-            Node* e = enclosingElement();
-            if (!result.innerNode())
-                result.setInnerNode(e);
-            if (!result.innerNonSharedNode())
-                result.setInnerNonSharedNode(e);
+    if (fgRect.contains(hitTestPoint) && isSelfPaintingLayer()) {
+        // Hit test with a temporary HitTestResult, because we onlyl want to commit to 'result' if we know we're frontmost.
+        HitTestResult tempResult(result.point());
+        if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestDescendants) &&
+            isHitCandidate(this, false, zOffsetForContentsPtr, unflattenedTransformState.get())) {
+            result = tempResult;
+            if (!depthSortDescendants)
+                return this;
+            // Foreground can depth-sort with descendant layers, so keep this as a candidate.
+            candidateLayer = this;
         }
-
-        return this;
     }
-        
+
     // Now check our negative z-index children.
     if (m_negZOrderList) {
         for (int i = m_negZOrderList->size() - 1; i >= 0; --i) {
-            insideLayer = m_negZOrderList->at(i)->hitTestLayer(rootLayer, request, result, hitTestRect, hitTestPoint);
-            if (insideLayer)
-                return insideLayer;
+            HitTestResult tempResult(result.point());
+            RenderLayer* hitLayer = m_negZOrderList->at(i)->hitTestLayer(rootLayer, this, request, tempResult, hitTestRect, hitTestPoint, false, localTransformState.get(), zOffsetForDescendantsPtr);
+            if (isHitCandidate(hitLayer, depthSortDescendants, zOffset, unflattenedTransformState.get())) {
+                result = tempResult;
+                if (!depthSortDescendants)
+                    return hitLayer;
+
+                candidateLayer = hitLayer;
+            }
         }
     }
+    
+    // If we found a layer, return. Child layers, and foreground always render in front of background.
+    if (candidateLayer)
+        return candidateLayer;
 
-    // Next we want to see if the mouse is inside this layer but not any of its children.
-    if (bgRect.contains(hitTestPoint) &&
-        renderer()->hitTest(request, result, hitTestPoint,
-                            layerBounds.x() - renderer()->xPos(),
-                            layerBounds.y() - renderer()->yPos() + m_object->borderTopExtra(),
-                            HitTestSelf)) {
-        if (!result.innerNode() || !result.innerNonSharedNode()) {
-            Node* e = enclosingElement();
-            if (!result.innerNode())
-                result.setInnerNode(e);
-            if (!result.innerNonSharedNode())
-                result.setInnerNonSharedNode(e);
+    if (bgRect.contains(hitTestPoint) && isSelfPaintingLayer()) {
+        HitTestResult tempResult(result.point());
+        if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestSelf) &&
+            isHitCandidate(this, false, zOffsetForContentsPtr, unflattenedTransformState.get())) {
+            result = tempResult;
+            return this;
         }
-
-        return this;
     }
+    
+    return 0;
+}
 
-    // We didn't hit any layer. If we are the root layer and the mouse is -- or just was -- down, 
-    // return ourselves. We do this so mouse events continue getting delivered after a drag has 
-    // exited the WebView, and so hit testing over a scrollbar hits the content document.
-    if ((request.active || request.mouseUp) && renderer()->isRenderView()) {
-        renderer()->updateHitTestResult(result, hitTestPoint);
-        return this;
+bool RenderLayer::hitTestContents(const HitTestRequest& request, HitTestResult& result, const IntRect& layerBounds, const IntPoint& hitTestPoint, HitTestFilter hitTestFilter) const
+{
+    if (!renderer()->hitTest(request, result, hitTestPoint,
+                            layerBounds.x() - renderBoxX(),
+                            layerBounds.y() - renderBoxY(), 
+                            hitTestFilter)) {
+        // It's wrong to set innerNode, but then claim that you didn't hit anything.
+        ASSERT(!result.innerNode());
+        return false;
     }
 
-    return 0;
+    // For positioned generated content, we might still not have a
+    // node by the time we get to the layer level, since none of
+    // the content in the layer has an element. So just walk up
+    // the tree.
+    if (!result.innerNode() || !result.innerNonSharedNode()) {
+        Node* e = enclosingElement();
+        if (!result.innerNode())
+            result.setInnerNode(e);
+        if (!result.innerNonSharedNode())
+            result.setInnerNonSharedNode(e);
+    }
+        
+    return true;
 }
 
 void RenderLayer::updateClipRects(const RenderLayer* rootLayer)
@@ -2022,7 +2491,7 @@ void RenderLayer::updateClipRects(const RenderLayer* rootLayer)
     if (parentLayer && parentLayer->clipRects() && clipRects == *parentLayer->clipRects())
         m_clipRects = parentLayer->clipRects();
     else
-        m_clipRects = new (m_object->renderArena()) ClipRects(clipRects);
+        m_clipRects = new (renderer()->renderArena()) ClipRects(clipRects);
     m_clipRects->ref();
 #ifndef NDEBUG
     m_clipRectsRoot = rootLayer;
@@ -2031,10 +2500,9 @@ void RenderLayer::updateClipRects(const RenderLayer* rootLayer)
 
 void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& clipRects, bool useCached) const
 {
-    IntRect infiniteRect(INT_MIN/2, INT_MIN/2, INT_MAX, INT_MAX);
     if (!parent()) {
         // The root layer's clip rect is always infinite.
-        clipRects.reset(infiniteRect);
+        clipRects.reset(ClipRects::infiniteRect());
         return;
     }
 
@@ -2050,22 +2518,22 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& cl
             parentLayer->calculateClipRects(rootLayer, clipRects);
     }
     else
-        clipRects.reset(infiniteRect);
+        clipRects.reset(ClipRects::infiniteRect());
 
     // A fixed object is essentially the root of its containing block hierarchy, so when
     // we encounter such an object, we reset our clip rects to the fixedClipRect.
-    if (m_object->style()->position() == FixedPosition) {
+    if (renderer()->style()->position() == FixedPosition) {
         clipRects.setPosClipRect(clipRects.fixedClipRect());
         clipRects.setOverflowClipRect(clipRects.fixedClipRect());
         clipRects.setFixed(true);
     }
-    else if (m_object->style()->position() == RelativePosition)
+    else if (renderer()->style()->position() == RelativePosition)
         clipRects.setPosClipRect(clipRects.overflowClipRect());
-    else if (m_object->style()->position() == AbsolutePosition)
+    else if (renderer()->style()->position() == AbsolutePosition)
         clipRects.setOverflowClipRect(clipRects.posClipRect());
     
     // Update the clip rects that will be passed to child layers.
-    if (m_object->hasOverflowClip() || m_object->hasClip()) {
+    if (renderer()->hasOverflowClip() || renderer()->hasClip()) {
         // This layer establishes a clip of some kind.
         int x = 0;
         int y = 0;
@@ -2077,14 +2545,14 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& cl
             y -= view->frameView()->scrollY();
         }
         
-        if (m_object->hasOverflowClip()) {
-            IntRect newOverflowClip = m_object->getOverflowClipRect(x,y);
+        if (renderer()->hasOverflowClip()) {
+            IntRect newOverflowClip = toRenderBox(renderer())->overflowClipRect(x,y);
             clipRects.setOverflowClipRect(intersection(newOverflowClip, clipRects.overflowClipRect()));
-            if (m_object->isPositioned() || m_object->isRelPositioned())
+            if (renderer()->isPositioned() || renderer()->isRelPositioned())
                 clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
         }
-        if (m_object->hasClip()) {
-            IntRect newPosClip = m_object->getClipRect(x,y);
+        if (renderer()->hasClip()) {
+            IntRect newPosClip = toRenderBox(renderer())->clipRect(x,y);
             clipRects.setPosClipRect(intersection(newPosClip, clipRects.posClipRect()));
             clipRects.setOverflowClipRect(intersection(newPosClip, clipRects.overflowClipRect()));
             clipRects.setFixedClipRect(intersection(newPosClip, clipRects.fixedClipRect()));
@@ -2092,24 +2560,30 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& cl
     }
 }
 
+void RenderLayer::parentClipRects(const RenderLayer* rootLayer, ClipRects& clipRects, bool temporaryClipRects) const
+{
+    ASSERT(parent());
+    if (temporaryClipRects) {
+        parent()->calculateClipRects(rootLayer, clipRects);
+        return;
+    }
+
+    parent()->updateClipRects(rootLayer);
+    clipRects = *parent()->clipRects();
+}
+
 void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& paintDirtyRect, IntRect& layerBounds,
                                  IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects) const
 {
     if (rootLayer != this && parent()) {
-        ClipRects parentClipRects;
-        if (temporaryClipRects)
-            parent()->calculateClipRects(rootLayer, parentClipRects);
-        else {
-            parent()->updateClipRects(rootLayer);
-            parentClipRects = *parent()->clipRects();
-        }
-
-        backgroundRect = m_object->style()->position() == FixedPosition ? parentClipRects.fixedClipRect() :
-                         (m_object->isPositioned() ? parentClipRects.posClipRect() : 
-                                                     parentClipRects.overflowClipRect());
+        ClipRects parentRects;
+        parentClipRects(rootLayer, parentRects, temporaryClipRects);
+        backgroundRect = renderer()->style()->position() == FixedPosition ? parentRects.fixedClipRect() :
+                         (renderer()->isPositioned() ? parentRects.posClipRect() : 
+                                                       parentRects.overflowClipRect());
         RenderView* view = renderer()->view();
         ASSERT(view);
-        if (view && parentClipRects.fixed() && rootLayer->renderer() == view)
+        if (view && parentRects.fixed() && rootLayer->renderer() == view)
             backgroundRect.move(view->frameView()->scrollX(), view->frameView()->scrollY());
 
         backgroundRect.intersect(paintDirtyRect);
@@ -2122,16 +2596,16 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
     int x = 0;
     int y = 0;
     convertToLayerCoords(rootLayer, x, y);
-    layerBounds = IntRect(x,y,width(),height());
+    layerBounds = IntRect(x, y, width(), height());
     
     // Update the clip rects that will be passed to child layers.
-    if (m_object->hasOverflowClip() || m_object->hasClip()) {
+    if (renderer()->hasOverflowClip() || renderer()->hasClip()) {
         // This layer establishes a clip of some kind.
-        if (m_object->hasOverflowClip())
-            foregroundRect.intersect(m_object->getOverflowClipRect(x,y));
-        if (m_object->hasClip()) {
+        if (renderer()->hasOverflowClip())
+            foregroundRect.intersect(toRenderBox(renderer())->overflowClipRect(x,y));
+        if (renderer()->hasClip()) {
             // Clip applies to *us* as well, so go ahead and update the damageRect.
-            IntRect newPosClip = m_object->getClipRect(x,y);
+            IntRect newPosClip = toRenderBox(renderer())->clipRect(x,y);
             backgroundRect.intersect(newPosClip);
             foregroundRect.intersect(newPosClip);
             outlineRect.intersect(newPosClip);
@@ -2156,7 +2630,7 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
 
 IntRect RenderLayer::childrenClipRect() const
 {
-    RenderLayer* rootLayer = renderer()->document()->renderer()->layer();
+    RenderLayer* rootLayer = renderer()->view()->layer();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
     calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
     return foregroundRect;
@@ -2164,7 +2638,7 @@ IntRect RenderLayer::childrenClipRect() const
 
 IntRect RenderLayer::selfClipRect() const
 {
-    RenderLayer* rootLayer = renderer()->document()->renderer()->layer();
+    RenderLayer* rootLayer = renderer()->view()->layer();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
     calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
     return backgroundRect;
@@ -2182,7 +2656,7 @@ bool RenderLayer::intersectsDamageRect(const IntRect& layerBounds, const IntRect
     // can go ahead and return true.
     RenderView* view = renderer()->view();
     ASSERT(view);
-    if (view && !renderer()->isInlineFlow()) {
+    if (view && !renderer()->isRenderInline()) {
         IntRect b = layerBounds;
         b.inflate(view->maximalOutlineSize());
         if (b.intersects(damageRect))
@@ -2194,7 +2668,7 @@ bool RenderLayer::intersectsDamageRect(const IntRect& layerBounds, const IntRect
     return boundingBox(rootLayer).intersects(damageRect);
 }
 
-IntRect RenderLayer::boundingBox(const RenderLayer* rootLayer) const
+IntRect RenderLayer::localBoundingBox() const
 {
     // There are three special cases we need to consider.
     // (1) Inline Flows.  For inline flows we will create a bounding box that fully encompasses all of the lines occupied by the
@@ -2206,64 +2680,66 @@ IntRect RenderLayer::boundingBox(const RenderLayer* rootLayer) const
     // as part of our bounding box.  We do this because we are the responsible layer for both hit testing and painting those
     // floats.
     IntRect result;
-    if (renderer()->isInlineFlow()) {
+    if (renderer()->isRenderInline()) {
         // Go from our first line box to our last line box.
-        RenderInline* inlineFlow = static_cast<RenderInline*>(renderer());
+        RenderInline* inlineFlow = toRenderInline(renderer());
         InlineFlowBox* firstBox = inlineFlow->firstLineBox();
         if (!firstBox)
             return result;
         int top = firstBox->root()->topOverflow();
         int bottom = inlineFlow->lastLineBox()->root()->bottomOverflow();
-        int left = firstBox->xPos();
+        int left = firstBox->x();
         for (InlineRunBox* curr = firstBox->nextLineBox(); curr; curr = curr->nextLineBox())
-            left = min(left, curr->xPos());
-        result = IntRect(m_x + left, m_y + (top - renderer()->yPos()), width(), bottom - top);
+            left = min(left, curr->x());
+        result = IntRect(left, top, width(), bottom - top);
     } else if (renderer()->isTableRow()) {
         // Our bounding box is just the union of all of our cells' border/overflow rects.
         for (RenderObject* child = renderer()->firstChild(); child; child = child->nextSibling()) {
             if (child->isTableCell()) {
-                IntRect bbox = child->borderBox();
-                bbox.move(0, child->borderTopExtra());
+                IntRect bbox = toRenderBox(child)->borderBoxRect();
                 result.unite(bbox);
-                IntRect overflowRect = renderer()->overflowRect(false);
-                overflowRect.move(0, child->borderTopExtra());
+                IntRect overflowRect = renderBox()->overflowRect(false);
                 if (bbox != overflowRect)
                     result.unite(overflowRect);
             }
         }
-        result.move(m_x, m_y);
     } else {
-        if (renderer()->hasMask())
-            result = renderer()->maskClipRect();
+        RenderBox* box = renderBox();
+        ASSERT(box);
+        if (box->hasMask())
+            result = box->maskClipRect();
         else {
-            IntRect bbox = renderer()->borderBox();
+            IntRect bbox = box->borderBoxRect();
             result = bbox;
-            IntRect overflowRect = renderer()->overflowRect(false);
+            IntRect overflowRect = box->overflowRect(false);
             if (bbox != overflowRect)
                 result.unite(overflowRect);
         }
-
-        // We have to adjust the x/y of this result so that it is in the coordinate space of the layer.
-        // We also have to add in borderTopExtra here, since borderBox(), in order to play well with methods like
-        // floatRect that deal with child content, uses an origin of (0,0) that is at the child content box (so
-        // border box returns a y coord of -borderTopExtra().  The layer, however, uses the outer box.  This is all
-        // really confusing.
-        result.move(m_x, m_y + renderer()->borderTopExtra());
     }
-    
-    // Convert the bounding box to an absolute position.  We can do this easily by looking at the delta
-    // between the bounding box's xpos and our layer's xpos and then applying that to the absolute layerBounds
-    // passed in.
-    int absX = 0, absY = 0;
-    convertToLayerCoords(rootLayer, absX, absY);
-    result.move(absX - m_x, absY - m_y);
+
     RenderView* view = renderer()->view();
     ASSERT(view);
     if (view)
-        result.inflate(view->maximalOutlineSize());
+        result.inflate(view->maximalOutlineSize()); // Used to apply a fudge factor to dirty-rect checks on blocks/tables.
+
+    return result;
+}
+
+IntRect RenderLayer::boundingBox(const RenderLayer* ancestorLayer) const
+{    
+    IntRect result = localBoundingBox();
+
+    int deltaX = 0, deltaY = 0;
+    convertToLayerCoords(ancestorLayer, deltaX, deltaY);
+    result.move(deltaX, deltaY);
     return result;
 }
 
+IntRect RenderLayer::absoluteBoundingBox() const
+{
+    return boundingBox(root());
+}
+
 void RenderLayer::clearClipRectsIncludingDescendants()
 {
     if (!m_clipRects)
@@ -2278,7 +2754,7 @@ void RenderLayer::clearClipRectsIncludingDescendants()
 void RenderLayer::clearClipRects()
 {
     if (m_clipRects) {
-        m_clipRects->deref(m_object->renderArena());
+        m_clipRects->deref(renderer()->renderArena());
         m_clipRects = 0;
 #ifndef NDEBUG
         m_clipRectsRoot = 0;
@@ -2286,6 +2762,38 @@ void RenderLayer::clearClipRects()
     }
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+RenderLayerBacking* RenderLayer::ensureBacking()
+{
+    if (!m_backing)
+        m_backing.set(new RenderLayerBacking(this));
+    return m_backing.get();
+}
+
+void RenderLayer::clearBacking()
+{
+    m_backing.clear();
+}
+#endif
+
+void RenderLayer::setParent(RenderLayer* parent)
+{
+    if (parent == m_parent)
+        return;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_parent && !renderer()->documentBeingDestroyed())
+        compositor()->layerWillBeRemoved(m_parent, this);
+#endif
+    
+    m_parent = parent;
+    
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_parent && !renderer()->documentBeingDestroyed())
+        compositor()->layerWasAdded(m_parent, this);
+#endif
+}
+
 static RenderObject* commonAncestor(RenderObject* obj1, RenderObject* obj2)
 {
     if (!obj1 || !obj2)
@@ -2301,28 +2809,28 @@ static RenderObject* commonAncestor(RenderObject* obj1, RenderObject* obj2)
 
 void RenderLayer::updateHoverActiveState(const HitTestRequest& request, HitTestResult& result)
 {
-    // We don't update :hover/:active state when the result is marked as readonly.
-    if (request.readonly)
+    // We don't update :hover/:active state when the result is marked as readOnly.
+    if (request.readOnly())
         return;
 
     Document* doc = renderer()->document();
 
     Node* activeNode = doc->activeNode();
-    if (activeNode && !request.active) {
+    if (activeNode && !request.active()) {
         // We are clearing the :active chain because the mouse has been released.
         for (RenderObject* curr = activeNode->renderer(); curr; curr = curr->parent()) {
-            if (curr->element() && !curr->isText())
-                curr->element()->setInActiveChain(false);
+            if (curr->node() && !curr->isText())
+                curr->node()->setInActiveChain(false);
         }
         doc->setActiveNode(0);
     } else {
         Node* newActiveNode = result.innerNode();
-        if (!activeNode && newActiveNode && request.active) {
+        if (!activeNode && newActiveNode && request.active()) {
             // We are setting the :active chain and freezing it. If future moves happen, they
             // will need to reference this chain.
             for (RenderObject* curr = newActiveNode->renderer(); curr; curr = curr->parent()) {
-                if (curr->element() && !curr->isText()) {
-                    curr->element()->setInActiveChain(true);
+                if (curr->node() && !curr->isText()) {
+                    curr->node()->setInActiveChain(true);
                 }
             }
             doc->setActiveNode(newActiveNode);
@@ -2332,7 +2840,7 @@ void RenderLayer::updateHoverActiveState(const HitTestRequest& request, HitTestR
     // If the mouse is down and if this is a mouse move event, we want to restrict changes in 
     // :hover/:active to only apply to elements that are in the :active chain that we froze
     // at the time the mouse went down.
-    bool mustBeInActiveChain = request.active && request.mouseMove;
+    bool mustBeInActiveChain = request.active() && request.mouseMove();
 
     // Check to see if the hovered node has changed.  If not, then we don't need to
     // do anything.  
@@ -2352,18 +2860,18 @@ void RenderLayer::updateHoverActiveState(const HitTestRequest& request, HitTestR
     if (oldHoverObj != newHoverObj) {
         // The old hover path only needs to be cleared up to (and not including) the common ancestor;
         for (RenderObject* curr = oldHoverObj; curr && curr != ancestor; curr = curr->hoverAncestor()) {
-            if (curr->element() && !curr->isText() && (!mustBeInActiveChain || curr->element()->inActiveChain())) {
-                curr->element()->setActive(false);
-                curr->element()->setHovered(false);
+            if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain())) {
+                curr->node()->setActive(false);
+                curr->node()->setHovered(false);
             }
         }
     }
 
     // Now set the hover state for our new object up to the root.
     for (RenderObject* curr = newHoverObj; curr; curr = curr->hoverAncestor()) {
-        if (curr->element() && !curr->isText() && (!mustBeInActiveChain || curr->element()->inActiveChain())) {
-            curr->element()->setActive(request.active);
-            curr->element()->setHovered(true);
+        if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain())) {
+            curr->node()->setActive(request.active());
+            curr->node()->setHovered(true);
         }
     }
 }
@@ -2381,6 +2889,11 @@ void RenderLayer::dirtyZOrderLists()
     if (m_negZOrderList)
         m_negZOrderList->clear();
     m_zOrderListsDirty = true;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (!renderer()->documentBeingDestroyed())
+        compositor()->setCompositingLayersNeedUpdate();
+#endif
 }
 
 void RenderLayer::dirtyStackingContextZOrderLists()
@@ -2390,18 +2903,23 @@ void RenderLayer::dirtyStackingContextZOrderLists()
         sc->dirtyZOrderLists();
 }
 
-void RenderLayer::dirtyOverflowList()
+void RenderLayer::dirtyNormalFlowList()
 {
-    if (m_overflowList)
-        m_overflowList->clear();
-    m_overflowListDirty = true;
+    if (m_normalFlowList)
+        m_normalFlowList->clear();
+    m_normalFlowListDirty = true;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (!renderer()->documentBeingDestroyed())
+        compositor()->setCompositingLayersNeedUpdate();
+#endif
 }
 
 void RenderLayer::updateZOrderLists()
 {
     if (!isStackingContext() || !m_zOrderListsDirty)
         return;
-        
+
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
         if (!m_reflection || reflectionLayer() != child)
             child->collectLayers(m_posZOrderList, m_negZOrderList);
@@ -2409,27 +2927,28 @@ void RenderLayer::updateZOrderLists()
     // Sort the two lists.
     if (m_posZOrderList)
         std::stable_sort(m_posZOrderList->begin(), m_posZOrderList->end(), compareZIndex);
+
     if (m_negZOrderList)
         std::stable_sort(m_negZOrderList->begin(), m_negZOrderList->end(), compareZIndex);
 
     m_zOrderListsDirty = false;
 }
 
-void RenderLayer::updateOverflowList()
+void RenderLayer::updateNormalFlowList()
 {
-    if (!m_overflowListDirty)
+    if (!m_normalFlowListDirty)
         return;
         
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling()) {
         // Ignore non-overflow layers and reflections.
-        if (child->isOverflowOnly() && (!m_reflection || reflectionLayer() != child)) {
-            if (!m_overflowList)
-                m_overflowList = new Vector<RenderLayer*>;
-            m_overflowList->append(child);
+        if (child->isNormalFlowOnly() && (!m_reflection || reflectionLayer() != child)) {
+            if (!m_normalFlowList)
+                m_normalFlowList = new Vector<RenderLayer*>;
+            m_normalFlowList->append(child);
         }
     }
     
-    m_overflowListDirty = false;
+    m_normalFlowListDirty = false;
 }
 
 void RenderLayer::collectLayers(Vector<RenderLayer*>*& posBuffer, Vector<RenderLayer*>*& negBuffer)
@@ -2437,7 +2956,7 @@ void RenderLayer::collectLayers(Vector<RenderLayer*>*& posBuffer, Vector<RenderL
     updateVisibilityStatus();
 
     // Overflow layers are just painted by their enclosing layers, so they don't get put in zorder lists.
-    if ((m_hasVisibleContent || (m_hasVisibleDescendant && isStackingContext())) && !isOverflowOnly()) {
+    if ((m_hasVisibleContent || (m_hasVisibleDescendant && isStackingContext())) && !isNormalFlowOnly()) {
         // Determine which buffer the child should be in.
         Vector<RenderLayer*>*& buffer = (zIndex() >= 0) ? posBuffer : negBuffer;
 
@@ -2460,34 +2979,97 @@ void RenderLayer::collectLayers(Vector<RenderLayer*>*& posBuffer, Vector<RenderL
     }
 }
 
+void RenderLayer::updateLayerListsIfNeeded()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (compositor()->inCompositingMode()) {
+        if ((isStackingContext() && m_zOrderListsDirty) || m_normalFlowListDirty)
+            compositor()->updateCompositingLayers(this);
+        return;
+    }
+#endif
+    updateZOrderLists();
+    updateNormalFlowList();
+}
+
 void RenderLayer::repaintIncludingDescendants()
 {
-    m_object->repaint();
+    renderer()->repaint();
     for (RenderLayer* curr = firstChild(); curr; curr = curr->nextSibling())
         curr->repaintIncludingDescendants();
 }
 
-bool RenderLayer::shouldBeOverflowOnly() const
+#if USE(ACCELERATED_COMPOSITING)
+void RenderLayer::setBackingNeedsRepaint()
+{
+    ASSERT(isComposited());
+    if (backing()->paintingGoesToWindow()) {
+        // If we're trying to repaint the placeholder document layer, propagate the
+        // repaint to the native view system.
+        RenderView* view = renderer()->view();
+        if (view)
+            view->repaintViewRectangle(absoluteBoundingBox());
+    } else
+        backing()->setContentsNeedDisplay();
+}
+
+void RenderLayer::setBackingNeedsRepaintInRect(const IntRect& r)
 {
-    return (renderer()->hasOverflowClip() || renderer()->hasReflection()) && 
+    ASSERT(isComposited());
+    if (backing()->paintingGoesToWindow()) {
+        // If we're trying to repaint the placeholder document layer, propagate the
+        // repaint to the native view system.
+        IntRect absRect(r);
+        int x = 0;
+        int y = 0;
+        convertToLayerCoords(root(), x, y);
+        absRect.move(x, y);
+
+        RenderView* view = renderer()->view();
+        if (view)
+            view->repaintViewRectangle(absRect);
+    } else
+        backing()->setContentsNeedDisplayInRect(r);
+}
+
+// Since we're only painting non-composited layers, we know that they all share the same repaintContainer.
+void RenderLayer::repaintIncludingNonCompositingDescendants(RenderBoxModelObject* repaintContainer)
+{
+    renderer()->repaintUsingContainer(repaintContainer, renderer()->clippedOverflowRectForRepaint(repaintContainer));
+
+    for (RenderLayer* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (!curr->isComposited())
+            curr->repaintIncludingNonCompositingDescendants(repaintContainer);
+    }
+}
+#endif
+
+bool RenderLayer::shouldBeNormalFlowOnly() const
+{
+    return (renderer()->hasOverflowClip() || renderer()->hasReflection() || renderer()->hasMask()) &&
            !renderer()->isPositioned() &&
            !renderer()->isRelPositioned() &&
            !renderer()->hasTransform() &&
            !isTransparent();
 }
 
-void RenderLayer::styleChanged(RenderStyle::Diff, const RenderStyle*)
+bool RenderLayer::isSelfPaintingLayer() const
 {
-    bool isOverflowOnly = shouldBeOverflowOnly();
-    if (isOverflowOnly != m_isOverflowOnly) {
-        m_isOverflowOnly = isOverflowOnly;
+    return !isNormalFlowOnly() || renderer()->hasReflection() || renderer()->hasMask() || renderer()->isTableRow();
+}
+
+void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
+{
+    bool isNormalFlowOnly = shouldBeNormalFlowOnly();
+    if (isNormalFlowOnly != m_isNormalFlowOnly) {
+        m_isNormalFlowOnly = isNormalFlowOnly;
         RenderLayer* p = parent();
         if (p)
-            p->dirtyOverflowList();
+            p->dirtyNormalFlowList();
         dirtyStackingContextZOrderLists();
     }
 
-    if (m_object->style()->overflowX() == OMARQUEE && m_object->style()->marqueeBehavior() != MNONE) {
+    if (renderer()->style()->overflowX() == OMARQUEE && renderer()->style()->marqueeBehavior() != MNONE) {
         if (!m_marquee)
             m_marquee = new RenderMarquee(this);
         m_marquee->updateMarqueeStyle();
@@ -2514,16 +3096,30 @@ void RenderLayer::styleChanged(RenderStyle::Diff, const RenderStyle*)
     
     updateScrollCornerStyle();
     updateResizerStyle();
+
+#if USE(ACCELERATED_COMPOSITING)
+    updateTransform();
+
+    if (compositor()->updateLayerCompositingState(this))
+        compositor()->setCompositingLayersNeedUpdate();
+    else if (m_backing)
+        m_backing->updateGraphicsLayerGeometry();
+
+    if (m_backing && diff >= StyleDifferenceRepaint)
+        m_backing->setContentsNeedDisplay();
+#else
+    UNUSED_PARAM(diff);
+#endif
 }
 
 void RenderLayer::updateScrollCornerStyle()
 {
-    RenderObject* actualRenderer = m_object->node()->isElementNode() ? m_object->node()->shadowAncestorNode()->renderer() : m_object;
-    RefPtr<RenderStyle> corner = m_object->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(RenderStyle::SCROLLBAR_CORNER, actualRenderer->style()) : 0;
+    RenderObject* actualRenderer = renderer()->node() ? renderer()->node()->shadowAncestorNode()->renderer() : renderer();
+    RefPtr<RenderStyle> corner = renderer()->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, actualRenderer->style()) : 0;
     if (corner) {
         if (!m_scrollCorner) {
-            m_scrollCorner = new (m_object->renderArena()) RenderScrollbarPart(m_object->document());
-            m_scrollCorner->setParent(m_object);
+            m_scrollCorner = new (renderer()->renderArena()) RenderScrollbarPart(renderer()->document());
+            m_scrollCorner->setParent(renderer());
         }
         m_scrollCorner->setStyle(corner.release());
     } else if (m_scrollCorner) {
@@ -2534,12 +3130,12 @@ void RenderLayer::updateScrollCornerStyle()
 
 void RenderLayer::updateResizerStyle()
 {
-    RenderObject* actualRenderer = m_object->node()->isElementNode() ? m_object->node()->shadowAncestorNode()->renderer() : m_object;
-    RefPtr<RenderStyle> resizer = m_object->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(RenderStyle::RESIZER, actualRenderer->style()) : 0;
+    RenderObject* actualRenderer = renderer()->node() ? renderer()->node()->shadowAncestorNode()->renderer() : renderer();
+    RefPtr<RenderStyle> resizer = renderer()->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(RESIZER, actualRenderer->style()) : 0;
     if (resizer) {
         if (!m_resizer) {
-            m_resizer = new (m_object->renderArena()) RenderScrollbarPart(m_object->document());
-            m_resizer->setParent(m_object);
+            m_resizer = new (renderer()->renderArena()) RenderScrollbarPart(renderer()->document());
+            m_resizer->setParent(renderer());
         }
         m_resizer->setStyle(resizer.release());
     } else if (m_resizer) {
@@ -2597,13 +3193,4 @@ void RenderLayer::updateReflectionStyle()
     m_reflection->setStyle(newStyle.release());
 }
 
-void RenderLayer::suspendMarquees()
-{
-    if (m_marquee)
-        m_marquee->suspend();
-    
-    for (RenderLayer* curr = firstChild(); curr; curr = curr->nextSibling())
-        curr->suspendMarquees();
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
index b2ba48c239..9c8de5e196 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
@@ -44,19 +44,20 @@
 #ifndef RenderLayer_h
 #define RenderLayer_h
 
+#include "RenderBox.h"
+#include "ScrollBehavior.h"
 #include "ScrollbarClient.h"
-#include "RenderObject.h"
 #include "Timer.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-class TransformationMatrix;
 class CachedResource;
+class HitTestRequest;
 class HitTestResult;
+class HitTestingTransformState;
 class RenderFrameSet;
 class RenderMarquee;
-class RenderObject;
 class RenderReplica;
 class RenderScrollbarPart;
 class RenderStyle;
@@ -64,8 +65,12 @@ class RenderTable;
 class RenderText;
 class RenderView;
 class Scrollbar;
+class TransformationMatrix;
 
-struct HitTestRequest;
+#if USE(ACCELERATED_COMPOSITING)
+class RenderLayerBacking;
+class RenderLayerCompositor;
+#endif
 
 class ClipRects {
 public:
@@ -140,7 +145,9 @@ public:
         m_fixed = other.fixed();
         return *this;
     }
-        
+    
+    static IntRect infiniteRect() { return IntRect(INT_MIN/2, INT_MIN/2, INT_MAX, INT_MAX); }
+
 private:
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
@@ -155,38 +162,13 @@ private:
 
 class RenderLayer : public ScrollbarClient {
 public:
-    enum ScrollBehavior {
-        noScroll,
-        alignCenter,
-        alignTop,
-        alignBottom, 
-        alignLeft,
-        alignRight,
-        alignToClosestEdge
-    };
-
-    struct ScrollAlignment {
-        ScrollBehavior m_rectVisible;
-        ScrollBehavior m_rectHidden;
-        ScrollBehavior m_rectPartial;
-    };
-
     friend class RenderReplica;
 
-    static const ScrollAlignment gAlignCenterIfNeeded;
-    static const ScrollAlignment gAlignToEdgeIfNeeded;
-    static const ScrollAlignment gAlignCenterAlways;
-    static const ScrollAlignment gAlignTopAlways;
-    static const ScrollAlignment gAlignBottomAlways;
-
-    static ScrollBehavior getVisibleBehavior(const ScrollAlignment& s) { return s.m_rectVisible; }
-    static ScrollBehavior getPartialBehavior(const ScrollAlignment& s) { return s.m_rectPartial; }
-    static ScrollBehavior getHiddenBehavior(const ScrollAlignment& s) { return s.m_rectHidden; }
-
-    RenderLayer(RenderObject*);
+    RenderLayer(RenderBoxModelObject*);
     ~RenderLayer();
 
-    RenderObject* renderer() const { return m_object; }
+    RenderBoxModelObject* renderer() const { return m_renderer; }
+    RenderBox* renderBox() const { return m_renderer && m_renderer->isBox() ? toRenderBox(m_renderer) : 0; }
     RenderLayer* parent() const { return m_parent; }
     RenderLayer* previousSibling() const { return m_previous; }
     RenderLayer* nextSibling() const { return m_next; }
@@ -201,20 +183,28 @@ public:
 
     void repaintIncludingDescendants();
 
-    void styleChanged(RenderStyle::Diff, const RenderStyle*);
+#if USE(ACCELERATED_COMPOSITING)
+    // Indicate that the layer contents need to be repainted. Only has an effect
+    // if layer compositing is being used,
+    void setBackingNeedsRepaint();
+    void setBackingNeedsRepaintInRect(const IntRect& r); // r is in the coordinate space of the layer's render object
+    void repaintIncludingNonCompositingDescendants(RenderBoxModelObject* repaintContainer);
+#endif
+
+    void styleChanged(StyleDifference, const RenderStyle*);
 
     RenderMarquee* marquee() const { return m_marquee; }
-    void suspendMarquees();
 
-    bool isOverflowOnly() const { return m_isOverflowOnly; }
+    bool isNormalFlowOnly() const { return m_isNormalFlowOnly; }
+    bool isSelfPaintingLayer() const;
 
     bool requiresSlowRepaints() const;
 
     bool isTransparent() const;
-    RenderLayer* transparentAncestor();
+    RenderLayer* transparentPaintingAncestor();
     void beginTransparencyLayers(GraphicsContext*, const RenderLayer* rootLayer);
 
-    bool hasReflection() const { return m_object->hasReflection(); }
+    bool hasReflection() const { return renderer()->hasReflection(); }
     RenderReplica* reflection() const { return m_reflection; }
     RenderLayer* reflectionLayer() const;
 
@@ -226,12 +216,12 @@ public:
         return curr;
     }
     
-    int xPos() const { return m_x; }
-    int yPos() const { return m_y; }
-    void setPos(int xPos, int yPos)
+    int x() const { return m_x; }
+    int y() const { return m_y; }
+    void setLocation(int x, int y)
     {
-        m_x = xPos;
-        m_y = yPos;
+        m_x = x;
+        m_y = y;
     }
 
     int width() const { return m_width; }
@@ -256,9 +246,9 @@ public:
     void scrollToOffset(int x, int y, bool updateScrollbars = true, bool repaint = true);
     void scrollToXOffset(int x) { scrollToOffset(x, m_scrollY); }
     void scrollToYOffset(int y) { scrollToOffset(m_scrollX + m_scrollOriginX, y); }
-    void scrollRectToVisible(const IntRect&, bool scrollToAnchor = false, const ScrollAlignment& alignX = gAlignCenterIfNeeded, const ScrollAlignment& alignY = gAlignCenterIfNeeded);
+    void scrollRectToVisible(const IntRect&, bool scrollToAnchor = false, const ScrollAlignment& alignX = ScrollAlignment::alignCenterIfNeeded, const ScrollAlignment& alignY = ScrollAlignment::alignCenterIfNeeded);
 
-    IntRect getRectToExpose(const IntRect& visibleRect, const IntRect& exposeRect, const ScrollAlignment& alignX, const ScrollAlignment& alignY);    
+    IntRect getRectToExpose(const IntRect& visibleRect, const IntRect& exposeRect, const ScrollAlignment& alignX, const ScrollAlignment& alignY);
 
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
@@ -289,6 +279,16 @@ public:
     void resize(const PlatformMouseEvent&, const IntSize&);
     bool inResizeMode() const { return m_inResizeMode; }
     void setInResizeMode(bool b) { m_inResizeMode = b; }
+
+    bool isRootLayer() const { return renderer()->isRenderView(); }
+    
+#if USE(ACCELERATED_COMPOSITING)
+    RenderLayerCompositor* compositor() const;
+    
+    // Notification from the renderer that its content changed (e.g. current frame of image changed).
+    // Allows updates of layer content without repainting.
+    void rendererContentChanged();
+#endif
     
     void updateLayerPosition();
     void updateLayerPositions(bool doFullRepaint = false, bool checkForRepaint = true);
@@ -312,9 +312,9 @@ public:
     Vector<RenderLayer*>* posZOrderList() const { return m_posZOrderList; }
     Vector<RenderLayer*>* negZOrderList() const { return m_negZOrderList; }
 
-    void dirtyOverflowList();
-    void updateOverflowList();
-    Vector<RenderLayer*>* overflowList() const { return m_overflowList; }
+    void dirtyNormalFlowList();
+    void updateNormalFlowList();
+    Vector<RenderLayer*>* normalFlowList() const { return m_normalFlowList; }
 
     bool hasVisibleContent() const { return m_hasVisibleContent; }
     void setHasVisibleContent(bool);
@@ -324,6 +324,13 @@ public:
     // the <html> layer and the root layer).
     RenderLayer* enclosingPositionedAncestor() const;
 
+#if USE(ACCELERATED_COMPOSITING)
+    // Enclosing compositing layer; if includeSelf is true, may return this.
+    RenderLayer* enclosingCompositingLayer(bool includeSelf = true) const;
+    // Ancestor compositing layer, excluding this.
+    RenderLayer* ancestorCompositingLayer() const { return enclosingCompositingLayer(false); }
+#endif
+
     void convertToLayerCoords(const RenderLayer* ancestorLayer, int& x, int& y) const;
 
     bool hasAutoZIndex() const { return renderer()->style()->hasAutoZIndex(); }
@@ -354,23 +361,39 @@ public:
 
     bool intersectsDamageRect(const IntRect& layerBounds, const IntRect& damageRect, const RenderLayer* rootLayer) const;
 
-    // Returns a bounding box for this layer only.
+    // Bounding box relative to some ancestor layer.
     IntRect boundingBox(const RenderLayer* rootLayer) const;
+    // Bounding box in the coordinates of this layer.
+    IntRect localBoundingBox() const;
+    // Bounding box relative to the root.
+    IntRect absoluteBoundingBox() const;
 
     void updateHoverActiveState(const HitTestRequest&, HitTestResult&);
 
+    // Return a cached repaint rect, computed relative to the layer renderer's containerForRepaint.
     IntRect repaintRect() const { return m_repaintRect; }
     void setNeedsFullRepaint(bool f = true) { m_needsFullRepaint = f; }
     
     int staticX() const { return m_staticX; }
     int staticY() const { return m_staticY; }
     void setStaticX(int staticX) { m_staticX = staticX; }
-    void setStaticY(int staticY) { m_staticY = staticY; }
+    void setStaticY(int staticY);
 
-    bool hasTransform() const { return m_object->hasTransform(); }
+    bool hasTransform() const { return renderer()->hasTransform(); }
+    // Note that this transform has the transform-origin baked in.
     TransformationMatrix* transform() const { return m_transform.get(); }
-
-    void destroy(RenderArena*);
+    // currentTransform computes a transform which takes accelerated animations into account. The
+    // resulting transform has transform-origin baked in. If the layer does not have a transform,
+    // returns the identity matrix.
+    TransformationMatrix currentTransform() const;
+    
+    // Get the perspective transform, which is applied to transformed sublayers.
+    // Returns true if the layer has a -webkit-perspective.
+    // Note that this transform has the perspective-origin baked in.
+    TransformationMatrix perspectiveTransform() const;
+    FloatPoint perspectiveOrigin() const;
+    bool preserves3D() const { return renderer()->style()->transformStyle3D() == TransformStyle3DPreserve3D; }
+    bool has3DTransform() const { return m_transform && !m_transform->isAffine(); }
 
      // Overloaded new operator.  Derived classes must override operator new
     // in order to allocate out of the RenderArena.
@@ -379,6 +402,25 @@ public:
     // Overridden to prevent the normal delete from being called.
     void operator delete(void*, size_t);
 
+#if USE(ACCELERATED_COMPOSITING)
+    bool isComposited() const { return m_backing != 0; }
+    RenderLayerBacking* backing() const { return m_backing.get(); }
+    RenderLayerBacking* ensureBacking();
+    void clearBacking();
+#else
+    bool isComposited() const { return false; }
+#endif
+
+    bool paintsWithTransparency() const
+    {
+        return isTransparent() && !isComposited();
+    }
+
+    bool paintsWithTransform() const
+    {
+        return transform() && !isComposited();
+    }
+
 private:
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
@@ -386,19 +428,35 @@ private:
 private:
     void setNextSibling(RenderLayer* next) { m_next = next; }
     void setPreviousSibling(RenderLayer* prev) { m_previous = prev; }
-    void setParent(RenderLayer* parent) { m_parent = parent; }
+    void setParent(RenderLayer* parent);
     void setFirstChild(RenderLayer* first) { m_first = first; }
     void setLastChild(RenderLayer* last) { m_last = last; }
 
+    int renderBoxX() const { return renderer()->isBox() ? toRenderBox(renderer())->x() : 0; }
+    int renderBoxY() const { return renderer()->isBox() ? toRenderBox(renderer())->y() : 0; }
+
     void collectLayers(Vector<RenderLayer*>*&, Vector<RenderLayer*>*&);
 
+    void updateLayerListsIfNeeded();
+    
     void paintLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
                     bool haveTransparency, PaintRestriction, RenderObject* paintingRoot,
+                    RenderObject::OverlapTestRequestMap* = 0,
                     bool appliedTransform = false, bool temporaryClipRects = false);
-    RenderLayer* hitTestLayer(RenderLayer* rootLayer, const HitTestRequest&, HitTestResult&, const IntRect& hitTestRect, const IntPoint& hitTestPoint, bool appliedTransform = false);
+
+    RenderLayer* hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
+                            const IntRect& hitTestRect, const IntPoint& hitTestPoint, bool appliedTransform,
+                            const HitTestingTransformState* transformState = 0, double* zOffset = 0);
+
+    PassRefPtr<HitTestingTransformState> createLocalTransformState(RenderLayer* rootLayer, RenderLayer* containerLayer,
+                            const IntRect& hitTestRect, const IntPoint& hitTestPoint,
+                            const HitTestingTransformState* containerTransformState) const;
+    
+    bool hitTestContents(const HitTestRequest&, HitTestResult&, const IntRect& layerBounds, const IntPoint& hitTestPoint, HitTestFilter) const;
+    
     void computeScrollDimensions(bool* needHBar = 0, bool* needVBar = 0);
 
-    bool shouldBeOverflowOnly() const;
+    bool shouldBeNormalFlowOnly() const; 
 
     virtual void valueChanged(Scrollbar*);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
@@ -411,11 +469,21 @@ private:
     void dirtyVisibleDescendantStatus();
     void updateVisibilityStatus();
 
+    // This flag is computed by RenderLayerCompositor, which knows more about 3d hierarchies than we do.
+    void setHas3DTransformedDescendant(bool b) { m_has3DTransformedDescendant = b; }
+    bool has3DTransformedDescendant() const { return m_has3DTransformedDescendant; }
+    
+    void dirty3DTransformedDescendantStatus();
+    // Both updates the status, and returns true if descendants of this have 3d.
+    bool update3DTransformedDescendantStatus();
+
     Node* enclosingElement() const;
 
     void createReflection();
     void updateReflectionStyle();
     bool paintingInsideReflection() const { return m_paintingInsideReflection; }
+    
+    void parentClipRects(const RenderLayer* rootLayer, ClipRects&, bool temporaryClipRects = false) const;
 
     RenderLayer* enclosingTransformedAncestor() const;
 
@@ -425,8 +493,24 @@ private:
     void updateScrollCornerStyle();
     void updateResizerStyle();
 
-protected:   
-    RenderObject* m_object;
+#if USE(ACCELERATED_COMPOSITING)    
+    bool hasCompositingDescendant() const { return m_hasCompositingDescendant; }
+    void setHasCompositingDescendant(bool b)  { m_hasCompositingDescendant = b; }
+    
+    bool mustOverlayCompositedLayers() const { return m_mustOverlayCompositedLayers; }
+    void setMustOverlayCompositedLayers(bool b) { m_mustOverlayCompositedLayers = b; }
+#endif
+
+private:
+    friend class RenderLayerBacking;
+    friend class RenderLayerCompositor;
+    friend class RenderBoxModelObject;
+
+    // Only safe to call from RenderBoxModelObject::destroyLayer(RenderArena*)
+    void destroy(RenderArena*);
+
+protected:
+    RenderBoxModelObject* m_renderer;
 
     RenderLayer* m_parent;
     RenderLayer* m_previous;
@@ -475,7 +559,7 @@ protected:
 
     // This list contains child layers that cannot create stacking contexts.  For now it is just
     // overflow layers, but that may change in the future.
-    Vector<RenderLayer*>* m_overflowList;
+    Vector<RenderLayer*>* m_normalFlowList;
 
     ClipRects* m_clipRects;      // Cached clip rects used when painting and hit testing.
 #ifndef NDEBUG
@@ -484,8 +568,8 @@ protected:
 
     bool m_scrollDimensionsDirty : 1;
     bool m_zOrderListsDirty : 1;
-    bool m_overflowListDirty: 1;
-    bool m_isOverflowOnly : 1;
+    bool m_normalFlowListDirty: 1;
+    bool m_isNormalFlowOnly : 1;
 
     bool m_usedTransparency : 1; // Tracks whether we need to close a transparent layer, i.e., whether
                                  // we ended up painting this layer or any descendants (and therefore need to
@@ -502,6 +586,14 @@ protected:
     bool m_visibleDescendantStatusDirty : 1;
     bool m_hasVisibleDescendant : 1;
 
+    bool m_3DTransformedDescendantStatusDirty : 1;
+    bool m_has3DTransformedDescendant : 1;  // Set on a stacking context layer that has 3D descendants anywhere
+                                            // in a preserves3D hierarchy. Hint to do 3D-aware hit testing.
+#if USE(ACCELERATED_COMPOSITING)
+    bool m_hasCompositingDescendant : 1;
+    bool m_mustOverlayCompositedLayers : 1;
+#endif
+
     RenderMarquee* m_marquee; // Used by layers with overflow:marquee
     
     // Cached normal flow values for absolute positioned elements with static left/top values.
@@ -516,6 +608,10 @@ protected:
     // Renderers to hold our custom scroll corner and resizer.
     RenderScrollbarPart* m_scrollCorner;
     RenderScrollbarPart* m_resizer;
+
+#if USE(ACCELERATED_COMPOSITING)
+    OwnPtr<RenderLayerBacking> m_backing;
+#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
new file mode 100644
index 0000000000..e16ecf787b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -0,0 +1,1023 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "AnimationController.h"
+#include "CSSPropertyNames.h"
+#include "CSSStyleSelector.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "GraphicsLayer.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "RenderBox.h"
+#include "RenderImage.h"
+#include "RenderLayerCompositor.h"
+#include "RenderVideo.h"
+#include "RenderView.h"
+
+#include "RenderLayerBacking.h"
+
+using namespace std;
+
+namespace WebCore {
+
+static bool hasBorderOutlineOrShadow(const RenderStyle*);
+static bool hasBoxDecorations(const RenderStyle*);
+static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle*);
+
+RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
+    : m_owningLayer(layer)
+    , m_ancestorClippingLayer(0)
+    , m_graphicsLayer(0)
+    , m_contentsLayer(0)
+    , m_clippingLayer(0)
+    , m_hasDirectlyCompositedContent(false)
+    , m_compositingContentOffsetDirty(true)
+{
+    createGraphicsLayer();
+}
+
+RenderLayerBacking::~RenderLayerBacking()
+{
+    updateClippingLayers(false, false);
+    updateContentsLayer(false);
+    destroyGraphicsLayer();
+}
+
+void RenderLayerBacking::createGraphicsLayer()
+{
+    m_graphicsLayer = GraphicsLayer::createGraphicsLayer(this);
+    
+#ifndef NDEBUG
+    if (renderer()->node()->isDocumentNode())
+        m_graphicsLayer->setName("Document Node");
+    else {
+        if (renderer()->node()->isHTMLElement() && renderer()->node()->hasID())
+            m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->id());
+        else
+            m_graphicsLayer->setName(renderer()->renderName());
+    }
+#endif  // NDEBUG
+
+    updateLayerOpacity();
+    updateLayerTransform();
+}
+
+void RenderLayerBacking::destroyGraphicsLayer()
+{
+    if (m_graphicsLayer)
+        m_graphicsLayer->removeFromParent();
+
+    delete m_graphicsLayer;
+    m_graphicsLayer = 0;
+
+    delete m_contentsLayer;
+    m_contentsLayer = 0;
+
+    delete m_clippingLayer;
+    m_clippingLayer = 0;
+}
+
+void RenderLayerBacking::updateLayerOpacity()
+{
+    m_graphicsLayer->setOpacity(compositingOpacity(renderer()->opacity()), 0, 0);
+}
+
+void RenderLayerBacking::updateLayerTransform()
+{
+    RenderStyle* style = renderer()->style();
+
+    // FIXME: This could use m_owningLayer->transform(), but that currently has transform-origin
+    // baked into it, and we don't want that.
+    TransformationMatrix t;
+    if (m_owningLayer->hasTransform()) {
+        style->applyTransform(t, toRenderBox(renderer())->borderBoxRect().size(), RenderStyle::ExcludeTransformOrigin);
+        makeMatrixRenderable(t);
+    }
+    
+    m_graphicsLayer->setTransform(t);
+}
+
+void RenderLayerBacking::updateAfterLayout()
+{
+    // Only need to update geometry if there isn't a layer update pending.
+    if (!compositor()->compositingLayersNeedUpdate())
+        updateGraphicsLayerGeometry();
+}
+
+bool RenderLayerBacking::updateGraphicsLayerConfiguration()
+{
+    RenderLayerCompositor* compositor = this->compositor();
+
+    bool layerConfigChanged = false;
+    if (updateContentsLayer(compositor->needsContentsCompositingLayer(m_owningLayer)))
+        layerConfigChanged = true;
+    
+    if (updateClippingLayers(compositor->clippedByAncestor(m_owningLayer), compositor->clipsCompositingDescendants(m_owningLayer)))
+        layerConfigChanged = true;
+
+    m_hasDirectlyCompositedContent = false;
+    if (canUseDirectCompositing()) {
+        if (renderer()->isImage()) {
+            updateImageContents();
+            m_hasDirectlyCompositedContent = true;
+            m_graphicsLayer->setDrawsContent(false);
+        }
+
+        if (rendererHasBackground())
+            m_graphicsLayer->setBackgroundColor(rendererBackgroundColor());
+        else
+            m_graphicsLayer->clearBackgroundColor();
+    }
+
+    return layerConfigChanged;
+}
+
+void RenderLayerBacking::updateGraphicsLayerGeometry()
+{
+    // If we haven't built z-order lists yet, wait until later.
+    if (m_owningLayer->isStackingContext() && m_owningLayer->m_zOrderListsDirty)
+        return;
+
+    // Set transform property, if it is not animating. We have to do this here because the transform
+    // is affected by the layer dimensions.
+    if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyWebkitTransform))
+        updateLayerTransform();
+
+    // Set opacity, if it is not animating.
+    if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyOpacity))
+        updateLayerOpacity();
+    
+    RenderStyle* style = renderer()->style();
+    m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D);
+    m_graphicsLayer->setBackfaceVisibility(style->backfaceVisibility() == BackfaceVisibilityVisible);
+
+    m_compositingContentOffsetDirty = true;
+    
+    RenderLayer* compAncestor = m_owningLayer->ancestorCompositingLayer();
+    
+    // We compute everything relative to the enclosing compositing layer.
+    IntRect ancestorCompositingBounds;
+    if (compAncestor)
+        ancestorCompositingBounds = compositor()->calculateCompositedBounds(compAncestor, compAncestor);
+    
+    IntRect localCompositingBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
+
+    IntRect relativeCompositingBounds(localCompositingBounds);
+    int deltaX = 0, deltaY = 0;
+    m_owningLayer->convertToLayerCoords(compAncestor, deltaX, deltaY);
+    relativeCompositingBounds.move(deltaX, deltaY);
+
+    IntPoint graphicsLayerParentLocation;
+    if (compAncestor && compAncestor->backing()->hasClippingLayer()) {
+        // If the compositing ancestor has a layer to clip children, we parent in that, and therefore
+        // position relative to it.
+        graphicsLayerParentLocation = toRenderBox(compAncestor->renderer())->overflowClipRect(0, 0).location();
+    } else
+        graphicsLayerParentLocation = ancestorCompositingBounds.location();
+    
+    if (compAncestor && m_ancestorClippingLayer) {
+        // Call calculateRects to get the backgroundRect which is what is used to clip the contents of this
+        // layer. Note that we call it with temporaryClipRects = true because normally when computing clip rects
+        // for a compositing layer, rootLayer is the layer itself.
+        ClipRects parentRects;
+        m_owningLayer->parentClipRects(compAncestor, parentRects, true);
+        IntRect parentClipRect = parentRects.overflowClipRect();
+        
+        m_ancestorClippingLayer->setPosition(FloatPoint() + (parentClipRect.location() - graphicsLayerParentLocation));
+        m_ancestorClippingLayer->setSize(parentClipRect.size());
+
+        // backgroundRect is relative to compAncestor, so subtract deltaX/deltaY to get back to local coords.
+        IntSize rendererOffset(parentClipRect.location().x() - deltaX, parentClipRect.location().y() - deltaY);
+        m_ancestorClippingLayer->setOffsetFromRenderer(rendererOffset);
+
+        // The primary layer is then parented in, and positioned relative to this clipping layer.
+        graphicsLayerParentLocation = parentClipRect.location();
+    }
+
+    m_graphicsLayer->setPosition(FloatPoint() + (relativeCompositingBounds.location() - graphicsLayerParentLocation));
+    m_graphicsLayer->setOffsetFromRenderer(localCompositingBounds.location() - IntPoint());
+    
+    FloatSize oldSize = m_graphicsLayer->size();
+    FloatSize newSize = relativeCompositingBounds.size();
+    if (oldSize != newSize) {
+        m_graphicsLayer->setSize(newSize);
+        // A bounds change will almost always require redisplay. Usually that redisplay
+        // will happen because of a repaint elsewhere, but not always:
+        // e.g. see RenderView::setMaximalOutlineSize()
+        m_graphicsLayer->setNeedsDisplay();
+    }
+
+    // If we have a layer that clips children, position it.
+    if (m_clippingLayer) {
+        IntRect clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
+        m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
+        m_clippingLayer->setSize(clippingBox.size());
+        m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
+    }
+    
+    if (m_owningLayer->hasTransform()) {
+        const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
+
+        // Get layout bounds in the coords of compAncestor to match relativeCompositingBounds.
+        IntRect layerBounds = IntRect(deltaX, deltaY, borderBox.width(), borderBox.height());
+
+        // Update properties that depend on layer dimensions
+        FloatPoint3D transformOrigin = computeTransformOrigin(borderBox);
+        // Compute the anchor point, which is in the center of the renderer box unless transform-origin is set.
+        FloatPoint3D anchor(relativeCompositingBounds.width()  != 0.0f ? ((layerBounds.x() - relativeCompositingBounds.x()) + transformOrigin.x()) / relativeCompositingBounds.width()  : 0.5f,
+                            relativeCompositingBounds.height() != 0.0f ? ((layerBounds.y() - relativeCompositingBounds.y()) + transformOrigin.y()) / relativeCompositingBounds.height() : 0.5f,
+                            transformOrigin.z());
+        m_graphicsLayer->setAnchorPoint(anchor);
+
+        RenderStyle* style = renderer()->style();
+        if (style->hasPerspective()) {
+            TransformationMatrix t = owningLayer()->perspectiveTransform();
+            
+            if (m_clippingLayer) {
+                m_clippingLayer->setChildrenTransform(t);
+                m_graphicsLayer->setChildrenTransform(TransformationMatrix());
+            }
+            else
+                m_graphicsLayer->setChildrenTransform(t);
+        } else {
+            if (m_clippingLayer)
+                m_clippingLayer->setChildrenTransform(TransformationMatrix());
+            else
+                m_graphicsLayer->setChildrenTransform(TransformationMatrix());
+        }
+    } else {
+        m_graphicsLayer->setAnchorPoint(FloatPoint3D(0.5f, 0.5f, 0));
+    }
+
+    if (m_contentsLayer) {
+        // The contents layer is always coincidental with the graphicsLayer for now.
+        m_contentsLayer->setPosition(IntPoint(0, 0));
+        m_contentsLayer->setSize(newSize);
+        m_contentsLayer->setOffsetFromRenderer(m_graphicsLayer->offsetFromRenderer());
+    }
+
+    m_graphicsLayer->updateContentsRect();
+    if (!m_hasDirectlyCompositedContent)
+        m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow());
+}
+
+void RenderLayerBacking::updateInternalHierarchy()
+{
+    // m_contentsLayer has to be inserted in the correct order with child layers,
+    // so it's not inserted here.
+    if (m_ancestorClippingLayer) {
+        m_ancestorClippingLayer->removeAllChildren();
+        m_graphicsLayer->removeFromParent();
+        m_ancestorClippingLayer->addChild(m_graphicsLayer);
+    }
+
+    if (m_clippingLayer) {
+        m_clippingLayer->removeFromParent();
+        m_graphicsLayer->addChild(m_clippingLayer);
+    }
+}
+
+// Return true if the layers changed.
+bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needsDescendantClip)
+{
+    bool layersChanged = false;
+
+    if (needsAncestorClip) {
+        if (!m_ancestorClippingLayer) {
+            m_ancestorClippingLayer = GraphicsLayer::createGraphicsLayer(this);
+#ifndef NDEBUG
+            m_ancestorClippingLayer->setName("Ancestor clipping Layer");
+#endif
+            m_ancestorClippingLayer->setMasksToBounds(true);
+            layersChanged = true;
+        }
+    } else if (m_ancestorClippingLayer) {
+        m_ancestorClippingLayer->removeFromParent();
+        delete m_ancestorClippingLayer;
+        m_ancestorClippingLayer = 0;
+        layersChanged = true;
+    }
+    
+    if (needsDescendantClip) {
+        if (!m_clippingLayer) {
+            m_clippingLayer = GraphicsLayer::createGraphicsLayer(0);
+#ifndef NDEBUG
+            m_clippingLayer->setName("Child clipping Layer");
+#endif
+            m_clippingLayer->setMasksToBounds(true);
+            layersChanged = true;
+        }
+    } else if (m_clippingLayer) {
+        m_clippingLayer->removeFromParent();
+        delete m_clippingLayer;
+        m_clippingLayer = 0;
+        layersChanged = true;
+    }
+    
+    if (layersChanged)
+        updateInternalHierarchy();
+
+    return layersChanged;
+}
+
+bool RenderLayerBacking::updateContentsLayer(bool needsContentsLayer)
+{
+    bool layerChanged = false;
+    if (needsContentsLayer) {
+        if (!m_contentsLayer) {
+            m_contentsLayer = GraphicsLayer::createGraphicsLayer(this);
+#ifndef NDEBUG
+            m_contentsLayer->setName("Contents");
+#endif
+            m_contentsLayer->setDrawsContent(true);
+            m_contentsLayer->setDrawingPhase(GraphicsLayerPaintForegroundMask);
+            m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintBackgroundMask);
+            layerChanged = true;
+        }
+    } else if (m_contentsLayer) {
+        m_contentsLayer->removeFromParent();
+        delete m_contentsLayer;
+        m_contentsLayer = 0;
+        m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintAllMask);
+        layerChanged = true;
+    }
+    return layerChanged;
+}
+
+float RenderLayerBacking::compositingOpacity(float rendererOpacity) const
+{
+    float finalOpacity = rendererOpacity;
+    
+    for (RenderLayer* curr = m_owningLayer->parent(); curr; curr = curr->parent()) {
+        // We only care about parents that are stacking contexts.
+        // Recall that opacity creates stacking context.
+        if (!curr->isStackingContext())
+            continue;
+        
+        // If we found a compositing layer, we want to compute opacity
+        // relative to it. So we can break here.
+        if (curr->isComposited())
+            break;
+        
+        finalOpacity *= curr->renderer()->opacity();
+    }
+
+    return finalOpacity;
+}
+
+static bool hasBorderOutlineOrShadow(const RenderStyle* style)
+{
+    return style->hasBorder() || style->hasBorderRadius() || style->hasOutline() || style->hasAppearance() || style->boxShadow();
+}
+
+static bool hasBoxDecorations(const RenderStyle* style)
+{
+    return hasBorderOutlineOrShadow(style) || style->hasBackground();
+}
+
+static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle* style)
+{
+    return hasBorderOutlineOrShadow(style) || style->hasBackgroundImage();
+}
+
+bool RenderLayerBacking::rendererHasBackground() const
+{
+    // FIXME: share more code here
+    if (renderer()->node()->isDocumentNode()) {
+        RenderObject* htmlObject = renderer()->firstChild();
+        if (!htmlObject)
+            return false;
+        
+        RenderStyle* style = htmlObject->style();
+        if (style->hasBackground())
+            return true;
+        
+        RenderObject* bodyObject = htmlObject->firstChild();
+        if (!bodyObject)
+            return false;
+        
+        style = bodyObject->style();
+        return style->hasBackground();
+    }
+    
+    return renderer()->style()->hasBackground();
+}
+
+const Color& RenderLayerBacking::rendererBackgroundColor() const
+{
+    // FIXME: share more code here
+    if (renderer()->node()->isDocumentNode()) {
+        RenderObject* htmlObject = renderer()->firstChild();
+        RenderStyle* style = htmlObject->style();
+        if (style->hasBackground())
+            return style->backgroundColor();
+
+        RenderObject* bodyObject = htmlObject->firstChild();
+        style = bodyObject->style();
+        return style->backgroundColor();
+    }
+
+    return renderer()->style()->backgroundColor();
+}
+
+// A "simple container layer" is a RenderLayer which has no visible content to render.
+// It may have no children, or all its children may be themselves composited.
+// This is a useful optimization, because it allows us to avoid allocating backing store.
+bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
+{
+    RenderObject* renderObject = renderer();
+    if (renderObject->isReplaced() ||       // replaced objects are not containers
+        renderObject->hasMask())            // masks require special treatment
+        return false;
+
+    RenderStyle* style = renderObject->style();
+
+    // Reject anything that has a border, a border-radius or outline,
+    // or any background (color or image).
+    // FIXME: we could optimize layers for simple backgrounds.
+    if (hasBoxDecorations(style))
+        return false;
+
+    // If we have got this far and the renderer has no children, then we're ok.
+    if (!renderObject->firstChild())
+        return true;
+    
+    if (renderObject->node()->isDocumentNode()) {
+        // Look to see if the root object has a non-simple backgound
+        RenderObject* rootObject = renderObject->document()->documentElement()->renderer();
+        if (!rootObject)
+            return false;
+        
+        style = rootObject->style();
+        
+        // Reject anything that has a border, a border-radius or outline,
+        // or is not a simple background (no background, or solid color).
+        if (hasBoxDecorationsWithBackgroundImage(style))
+            return false;
+        
+        // Now look at the body's renderer.
+        HTMLElement* body = renderObject->document()->body();
+        RenderObject* bodyObject = (body && body->hasLocalName(HTMLNames::bodyTag)) ? body->renderer() : 0;
+        if (!bodyObject)
+            return false;
+        
+        style = bodyObject->style();
+        
+        if (hasBoxDecorationsWithBackgroundImage(style))
+            return false;
+
+        // Ceck to see if all the body's children are compositing layers.
+        if (hasNonCompositingContent())
+            return false;
+        
+        return true;
+    }
+
+    // Check to see if all the renderer's children are compositing layers.
+    if (hasNonCompositingContent())
+        return false;
+    
+    return true;
+}
+
+bool RenderLayerBacking::hasNonCompositingContent() const
+{
+    // Conservative test for having no rendered children.
+    
+    // Some HTML can cause whitespace text nodes to have renderers, like:
+    // <div>
+    // <img src=...>
+    // </div>
+    // so test for 0x0 RenderTexts here
+    for (RenderObject* child = renderer()->firstChild(); child; child = child->nextSibling()) {
+        if (!child->hasLayer()) {
+            if (child->isRenderInline() || !child->isBox())
+                return true;
+            
+            if (toRenderBox(child)->width() > 0 || toRenderBox(child)->height() > 0)
+                return true;
+        }
+    }
+
+    // FIXME: test for overflow controls.
+    if (m_owningLayer->isStackingContext()) {
+        // Use the m_hasCompositingDescendant bit to optimize?
+        Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
+        if (negZOrderList && negZOrderList->size() > 0) {
+            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                if (!curLayer->isComposited())
+                    return true;
+            }
+        }
+
+        Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList();
+        if (posZOrderList && posZOrderList->size() > 0) {
+            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                if (!curLayer->isComposited())
+                    return true;
+            }
+        }
+    }
+
+    Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList();
+    if (normalFlowList && normalFlowList->size() > 0) {
+        for (Vector<RenderLayer*>::const_iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
+            RenderLayer* curLayer = (*it);
+            if (!curLayer->isComposited())
+                return true;
+        }
+    }
+
+    return false;
+}
+
+// A layer can use direct compositing if the render layer's object is a replaced object and has no children.
+// This allows the GraphicsLayer to display the RenderLayer contents directly; it's used for images.
+bool RenderLayerBacking::canUseDirectCompositing() const
+{
+    RenderObject* renderObject = renderer();
+    
+    // Reject anything that isn't an image
+    if (!renderObject->isImage())
+        return false;
+    
+    if (renderObject->hasMask() || renderObject->hasReflection())
+        return false;
+    
+    // Reject anything that would require the image to be drawn via the GraphicsContext,
+    // like border, shadows etc. Solid background color is OK.
+    return !hasBoxDecorationsWithBackgroundImage(renderObject->style());
+}
+    
+void RenderLayerBacking::rendererContentChanged()
+{
+    if (canUseDirectCompositing() && renderer()->isImage())
+        updateImageContents();
+}
+
+void RenderLayerBacking::updateImageContents()
+{
+    ASSERT(renderer()->isImage());
+    RenderImage* imageRenderer = static_cast<RenderImage*>(renderer());
+
+    CachedImage* cachedImage = imageRenderer->cachedImage();
+    if (!cachedImage)
+        return;
+
+    Image* image = cachedImage->image();
+    if (!image)
+        return;
+
+    // We have to wait until the image is fully loaded before setting it on the layer.
+    if (!cachedImage->isLoaded())
+        return;
+
+    // This is a no-op if the layer doesn't have an inner layer for the image.
+    m_graphicsLayer->setContentsToImage(image);
+    
+    // Image animation is "lazy", in that it automatically stops unless someone is drawing
+    // the image. So we have to kick the animation each time; this has the downside that the
+    // image will keep animating, even if its layer is not visible.
+    image->startAnimation();
+}
+
+FloatPoint3D RenderLayerBacking::computeTransformOrigin(const IntRect& borderBox) const
+{
+    RenderStyle* style = renderer()->style();
+
+    FloatPoint3D origin;
+    origin.setX(style->transformOriginX().calcFloatValue(borderBox.width()));
+    origin.setY(style->transformOriginY().calcFloatValue(borderBox.height()));
+    origin.setZ(style->transformOriginZ());
+
+    return origin;
+}
+
+FloatPoint RenderLayerBacking::computePerspectiveOrigin(const IntRect& borderBox) const
+{
+    RenderStyle* style = renderer()->style();
+
+    float boxWidth = borderBox.width();
+    float boxHeight = borderBox.height();
+
+    FloatPoint origin;
+    origin.setX(style->perspectiveOriginX().calcFloatValue(boxWidth));
+    origin.setY(style->perspectiveOriginY().calcFloatValue(boxHeight));
+
+    return origin;
+}
+
+// Return the offset from the top-left of this compositing layer at which the renderer's contents are painted.
+IntSize RenderLayerBacking::contentOffsetInCompostingLayer()
+{
+    if (!m_compositingContentOffsetDirty)
+        return m_compositingContentOffset;
+
+    IntRect relativeCompositingBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
+    m_compositingContentOffset = IntSize(-relativeCompositingBounds.x(), -relativeCompositingBounds.y());
+    m_compositingContentOffsetDirty = false;
+
+    return m_compositingContentOffset;
+}
+
+IntRect RenderLayerBacking::contentsBox(const GraphicsLayer*)
+{
+    if (!renderer()->isBox())
+        return IntRect();
+
+    IntRect contentsRect = toRenderBox(renderer())->contentBoxRect();
+    IntSize contentOffset = contentOffsetInCompostingLayer();
+    contentsRect.move(contentOffset);
+    return contentsRect;
+}
+
+// Map the given point from coordinates in the GraphicsLayer to RenderLayer coordinates.
+FloatPoint RenderLayerBacking::graphicsLayerToContentsCoordinates(const GraphicsLayer* graphicsLayer, const FloatPoint& point)
+{
+    return point + FloatSize(graphicsLayer->offsetFromRenderer());
+}
+
+// Map the given point from coordinates in the RenderLayer to GraphicsLayer coordinates.
+FloatPoint RenderLayerBacking::contentsToGraphicsLayerCoordinates(const GraphicsLayer* graphicsLayer, const FloatPoint& point)
+{
+    return point - FloatSize(graphicsLayer->offsetFromRenderer());
+}
+
+bool RenderLayerBacking::paintingGoesToWindow() const
+{
+    return m_owningLayer->isRootLayer();
+}
+
+void RenderLayerBacking::setContentsNeedDisplay()
+{
+    if (m_graphicsLayer)
+        m_graphicsLayer->setNeedsDisplay();
+    if (m_contentsLayer)
+        m_contentsLayer->setNeedsDisplay();
+}
+
+// r is in the coordinate space of the layer's render object
+void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
+{
+    if (m_graphicsLayer) {
+        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer, FloatPoint(r.x(), r.y()));
+        FloatRect dirtyRect(dirtyOrigin, r.size());
+        FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
+        if (bounds.intersects(dirtyRect))
+            m_graphicsLayer->setNeedsDisplayInRect(dirtyRect);
+    }
+
+    if (m_contentsLayer) {
+        // FIXME: do incremental repaint
+        m_contentsLayer->setNeedsDisplay();
+    }
+}
+
+static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
+{
+    if (paintDirtyRect == clipRect)
+        return;
+    p->save();
+    p->clip(clipRect);
+}
+
+static void restoreClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
+{
+    if (paintDirtyRect == clipRect)
+        return;
+    p->restore();
+}
+
+// Share this with RenderLayer::paintLayer, which would have to be educated about GraphicsLayerPaintingPhase?
+void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext* context,
+                    const IntRect& paintDirtyRect,      // in the coords of rootLayer
+                    bool haveTransparency, PaintRestriction paintRestriction, GraphicsLayerPaintingPhase paintingPhase,
+                    RenderObject* paintingRoot)
+{
+    if (paintingGoesToWindow()) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    
+    m_owningLayer->updateLayerListsIfNeeded();
+    
+    // Calculate the clip rects we should use.
+    IntRect layerBounds, damageRect, clipRectToApply, outlineRect;
+    m_owningLayer->calculateRects(rootLayer, paintDirtyRect, layerBounds, damageRect, clipRectToApply, outlineRect);
+    
+    int x = layerBounds.x();        // layerBounds is computed relative to rootLayer
+    int y = layerBounds.y();
+    int tx = x - m_owningLayer->renderBoxX();
+    int ty = y - m_owningLayer->renderBoxY();
+
+    // If this layer's renderer is a child of the paintingRoot, we render unconditionally, which
+    // is done by passing a nil paintingRoot down to our renderer (as if no paintingRoot was ever set).
+    // Else, our renderer tree may or may not contain the painting root, so we pass that root along
+    // so it will be tested against as we decend through the renderers.
+    RenderObject *paintingRootForRenderer = 0;
+    if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
+        paintingRootForRenderer = paintingRoot;
+
+    if (paintingPhase & GraphicsLayerPaintBackgroundMask) {
+        // If this is the root then we need to send in a bigger bounding box
+        // because we'll be painting the background as well (see RenderBox::paintRootBoxDecorations()).
+        IntRect paintBox = clipRectToApply;
+        
+        // FIXME: do we need this code?
+        if (renderer()->node()->isDocumentNode() && renderer()->document()->isHTMLDocument()) {
+            RenderBox* box = toRenderBox(renderer());
+            int w = box->width();
+            int h = box->height();
+            
+            int rw;
+            int rh;
+            if (box->view()->frameView()) {
+                rw = box->view()->frameView()->contentsWidth();
+                rh = box->view()->frameView()->contentsHeight();
+            } else {
+                rw = box->view()->width();
+                rh = box->view()->height();
+            }
+            
+            int bx = tx - box->marginLeft();
+            int by = ty - box->marginTop();
+            int bw = max(w + box->marginLeft() + box->marginRight() + box->borderLeft() + box->borderRight(), rw);
+            int bh = max(h + box->marginTop() + box->marginBottom() + box->borderTop() + box->borderBottom(), rh);
+            paintBox = IntRect(bx, by, bw, bh);
+        }
+
+        // Paint our background first, before painting any child layers.
+        // Establish the clip used to paint our background.
+        setClip(context, paintDirtyRect, damageRect);
+        
+        RenderObject::PaintInfo info(context, paintBox, PaintPhaseBlockBackground, false, paintingRootForRenderer, 0);
+        renderer()->paint(info, tx, ty);
+
+        // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
+        // z-index.  We paint after we painted the background/border, so that the scrollbars will
+        // sit above the background/border.
+        m_owningLayer->paintOverflowControls(context, x, y, damageRect);
+        
+        // Restore the clip.
+        restoreClip(context, paintDirtyRect, damageRect);
+    }
+                
+    if (paintingPhase & GraphicsLayerPaintForegroundMask) {
+        // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
+        // FIXME: should these be painted as background?
+        Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
+        if (negZOrderList) {
+            for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it)
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot);
+        }
+
+        bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+        bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+
+        // Set up the clip used when painting our children.
+        setClip(context, paintDirtyRect, clipRectToApply);
+        RenderObject::PaintInfo paintInfo(context, clipRectToApply, 
+                                          selectionOnly ? PaintPhaseSelection : PaintPhaseChildBlockBackgrounds,
+                                          forceBlackText, paintingRootForRenderer, 0);
+        renderer()->paint(paintInfo, tx, ty);
+
+        if (!selectionOnly) {
+            paintInfo.phase = PaintPhaseFloat;
+            renderer()->paint(paintInfo, tx, ty);
+
+            paintInfo.phase = PaintPhaseForeground;
+            renderer()->paint(paintInfo, tx, ty);
+
+            paintInfo.phase = PaintPhaseChildOutlines;
+            renderer()->paint(paintInfo, tx, ty);
+        }
+
+        // Now restore our clip.
+        restoreClip(context, paintDirtyRect, clipRectToApply);
+
+        if (!outlineRect.isEmpty()) {
+            // Paint our own outline
+            RenderObject::PaintInfo paintInfo(context, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
+            setClip(context, paintDirtyRect, outlineRect);
+            renderer()->paint(paintInfo, tx, ty);
+            restoreClip(context, paintDirtyRect, outlineRect);
+        }
+
+        // Paint any child layers that have overflow.
+        Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList();
+        if (normalFlowList) {
+            for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it)
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot);
+        }
+
+        // Now walk the sorted list of children with positive z-indices.
+        Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList();
+        if (posZOrderList) {
+            for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot);
+        }
+        
+        if (renderer()->hasMask() && !selectionOnly && !damageRect.isEmpty()) {
+            setClip(context, paintDirtyRect, damageRect);
+
+            // Paint the mask.
+            RenderObject::PaintInfo paintInfo(context, damageRect, PaintPhaseMask, false, paintingRootForRenderer, 0);
+            renderer()->paint(paintInfo, tx, ty);
+            
+            // Restore the clip.
+            restoreClip(context, paintDirtyRect, damageRect);
+        }
+    }
+
+    ASSERT(!m_owningLayer->m_usedTransparency);
+}
+
+// Up-call from compositing layer drawing callback.
+void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase drawingPhase, const IntRect& clip)
+{
+    // We have to use the same root as for hit testing, because both methods
+    // can compute and cache clipRects.
+    IntRect enclosingBBox = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
+
+    IntRect clipRect(clip);
+    
+    // Set up the coordinate space to be in the layer's rendering coordinates.
+    context.translate(-enclosingBBox.x(), -enclosingBBox.y());
+
+    // Offset the clip.
+    clipRect.move(enclosingBBox.x(), enclosingBBox.y());
+    
+    // The dirtyRect is in the coords of the painting root.
+    IntRect dirtyRect = enclosingBBox;
+    dirtyRect.intersect(clipRect);
+
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, false, PaintRestrictionNone, drawingPhase, renderer());
+}
+
+bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
+{
+    bool hasOpacity = keyframes.containsProperty(CSSPropertyOpacity);
+    bool hasTransform = keyframes.containsProperty(CSSPropertyWebkitTransform);
+    
+    if (!hasOpacity && !hasTransform)
+        return false;
+    
+    GraphicsLayer::TransformValueList transformVector;
+    GraphicsLayer::FloatValueList opacityVector;
+
+    for (Vector<KeyframeValue>::const_iterator it = keyframes.beginKeyframes(); it != keyframes.endKeyframes(); ++it) {
+        const RenderStyle* keyframeStyle = it->style();
+        float key = it->key();
+
+        if (!keyframeStyle)
+            continue;
+            
+        // get timing function
+        const TimingFunction* tf = keyframeStyle->hasAnimations() ? &((*keyframeStyle->animations()).animation(0)->timingFunction()) : 0;
+        
+        if (hasTransform)
+            transformVector.insert(key, &(keyframeStyle->transform()), tf);
+
+        if (hasOpacity)
+            opacityVector.insert(key, keyframeStyle->opacity(), tf);
+    }
+
+    bool didAnimateTransform = !hasTransform;
+    bool didAnimateOpacity = !hasOpacity;
+    
+    if (hasTransform && m_graphicsLayer->animateTransform(transformVector, toRenderBox(renderer())->borderBoxRect().size(), anim, beginTime, false))
+        didAnimateTransform = true;
+
+    if (hasOpacity && m_graphicsLayer->animateFloat(AnimatedPropertyOpacity, opacityVector, anim, beginTime))
+        didAnimateOpacity = true;
+    
+    return didAnimateTransform && didAnimateOpacity;
+}
+
+bool RenderLayerBacking::startTransition(double beginTime, int property, const RenderStyle* fromStyle, const RenderStyle* toStyle)
+{
+    bool didAnimate = false;
+    ASSERT(property != cAnimateAll);
+
+    if (property == (int)CSSPropertyOpacity) {
+        const Animation* opacityAnim = toStyle->transitionForProperty(CSSPropertyOpacity);
+        if (opacityAnim && !opacityAnim->isEmptyOrZeroDuration()) {
+            // If beginTime is not 0, we are restarting this transition, so first set the from value
+            // in case it was smashed by a previous animation.
+            if (beginTime > 0)
+                m_graphicsLayer->setOpacity(compositingOpacity(fromStyle->opacity()), 0, 0);
+
+            if (m_graphicsLayer->setOpacity(compositingOpacity(toStyle->opacity()), opacityAnim, beginTime))
+                didAnimate = true;
+        }
+    }
+
+    if (property == (int)CSSPropertyWebkitTransform && m_owningLayer->hasTransform()) {
+        // We get a TransformOperation, which is a linked list of primitive operations and their arguments.
+        // Arguments can be floats or Length values, which need to be converted to numbers using
+        // val.calcFloatValue(renderer()->width()) (or height()).
+        const Animation* transformAnim = toStyle->transitionForProperty(CSSPropertyWebkitTransform);
+        if (transformAnim && !transformAnim->isEmptyOrZeroDuration()) {
+            GraphicsLayer::TransformValueList transformVector;
+            transformVector.insert(0, &fromStyle->transform(), 0);        
+            transformVector.insert(1, &toStyle->transform(), 0);        
+            if (m_graphicsLayer->animateTransform(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, beginTime, true))
+                didAnimate = true;
+        }
+    }
+    
+    return didAnimate;
+}
+
+void RenderLayerBacking::notifyAnimationStarted(const GraphicsLayer*, double time)
+{
+    renderer()->animation()->notifyAnimationStarted(renderer(), time);
+}
+
+void RenderLayerBacking::animationFinished(const String& name, int index, bool reset)
+{
+    m_graphicsLayer->removeFinishedAnimations(name, index, reset);
+}
+
+void RenderLayerBacking::transitionFinished(int property)
+{
+    AnimatedPropertyID animatedProperty = cssToGraphicsLayerProperty(property);
+    if (animatedProperty != AnimatedPropertyInvalid)
+        m_graphicsLayer->removeFinishedTransitions(animatedProperty);
+}
+
+void RenderLayerBacking::suspendAnimations()
+{
+    m_graphicsLayer->suspendAnimations();
+}
+
+void RenderLayerBacking::resumeAnimations()
+{
+    m_graphicsLayer->resumeAnimations();
+}
+
+int RenderLayerBacking::graphicsLayerToCSSProperty(AnimatedPropertyID property)
+{
+    int cssProperty = CSSPropertyInvalid;
+    switch (property) {
+        case AnimatedPropertyWebkitTransform:
+            cssProperty = CSSPropertyWebkitTransform;
+            break;
+        case AnimatedPropertyOpacity:
+            cssProperty = CSSPropertyOpacity;
+            break;
+        case AnimatedPropertyBackgroundColor:
+            cssProperty = CSSPropertyBackgroundColor;
+            break;
+        case AnimatedPropertyInvalid:
+            ASSERT_NOT_REACHED();
+    }
+    return cssProperty;
+}
+
+AnimatedPropertyID RenderLayerBacking::cssToGraphicsLayerProperty(int cssProperty)
+{
+    switch (cssProperty) {
+        case CSSPropertyWebkitTransform:
+            return AnimatedPropertyWebkitTransform;
+        case CSSPropertyOpacity:
+            return AnimatedPropertyOpacity;
+        case CSSPropertyBackgroundColor:
+            return AnimatedPropertyBackgroundColor;
+        // It's fine if we see other css properties here; they are just not accelerated.
+    }
+    return AnimatedPropertyInvalid;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
new file mode 100644
index 0000000000..a6a6c1fc53
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RenderLayerBacking_h
+#define RenderLayerBacking_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "FloatPoint.h"
+#include "FloatPoint3D.h"
+#include "GraphicsLayer.h"
+#include "GraphicsLayerClient.h"
+#include "RenderLayer.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+class KeyframeList;
+class RenderLayerCompositor;
+
+// RenderLayerBacking controls the compositing behavior for a single RenderLayer.
+// It holds the various GraphicsLayers, and makes decisions about intra-layer rendering
+// optimizations.
+// 
+// There is one RenderLayerBacking for each RenderLayer that is composited.
+
+class RenderLayerBacking : public GraphicsLayerClient {
+public:
+    RenderLayerBacking(RenderLayer*);
+    ~RenderLayerBacking();
+
+    RenderLayer* owningLayer() const { return m_owningLayer; }
+
+    void updateAfterLayout();
+    
+    // Returns true if layer configuration changed.
+    bool updateGraphicsLayerConfiguration();
+    void updateGraphicsLayerGeometry();
+    void updateInternalHierarchy();
+    
+    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer; }
+
+    // Layer to clip children
+    bool hasClippingLayer() const { return m_clippingLayer != 0; }
+    GraphicsLayer* clippingLayer() const { return m_clippingLayer; }
+
+    // Layer to get clipped by ancestor
+    bool hasAncestorClippingLayer() const { return m_ancestorClippingLayer != 0; }
+    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer; }
+
+    bool hasContentsLayer() const { return m_contentsLayer != 0; }
+    GraphicsLayer* contentsLayer() const { return m_contentsLayer; }
+    
+    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer : m_graphicsLayer; }
+    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer : m_graphicsLayer; }
+
+    // RenderLayers with backing normally short-circuit paintLayer() because
+    // their content is rendered via callbacks from GraphicsLayer. However, the document
+    // layer is special, because it has a GraphicsLayer to act as a container for the GraphicsLayers
+    // for descendants, but its contents usually render into the window (in which case this returns true).
+    // This returns false for other layers, and when the document layer actually needs to paint into its backing store
+    // for some reason.
+    bool paintingGoesToWindow() const;
+
+    void setContentsNeedDisplay();
+    // r is in the coordinate space of the layer's render object
+    void setContentsNeedDisplayInRect(const IntRect& r);
+
+    // Notification from the renderer that its content changed; used by RenderImage.
+    void rendererContentChanged();
+
+    // Interface to start, finish, suspend and resume animations and transitions
+    bool startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes);
+    bool startTransition(double beginTime, int property, const RenderStyle* fromStyle, const RenderStyle* toStyle);
+    void animationFinished(const String& name, int index, bool reset);
+    void transitionFinished(int property);
+
+    void suspendAnimations();
+    void resumeAnimations();
+
+    FloatPoint graphicsLayerToContentsCoordinates(const GraphicsLayer*, const FloatPoint&);
+    FloatPoint contentsToGraphicsLayerCoordinates(const GraphicsLayer*, const FloatPoint&);
+
+    // GraphicsLayerClient interface
+    virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime);
+
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& clip);
+
+    virtual IntRect contentsBox(const GraphicsLayer*);
+    
+private:
+    void createGraphicsLayer();
+    void destroyGraphicsLayer();
+
+    RenderBoxModelObject* renderer() const { return m_owningLayer->renderer(); }
+    RenderLayerCompositor* compositor() const { return m_owningLayer->compositor(); }
+
+    bool updateClippingLayers(bool needsAncestorClip, bool needsDescendantClip);
+    bool updateContentsLayer(bool needsContentsLayer);
+
+    IntSize contentOffsetInCompostingLayer();
+    // Result is transform origin in pixels.
+    FloatPoint3D computeTransformOrigin(const IntRect& borderBox) const;
+    // Result is perspective origin in pixels.
+    FloatPoint computePerspectiveOrigin(const IntRect& borderBox) const;
+
+    void updateLayerOpacity();
+    void updateLayerTransform();
+
+    // Return the opacity value that this layer should use for compositing.
+    float compositingOpacity(float rendererOpacity) const;
+    
+    // Returns true if this RenderLayer only has content that can be rendered directly
+    // by the compositing layer, without drawing (e.g. solid background color).
+    bool isSimpleContainerCompositingLayer() const;
+    // Returns true if we can optimize the RenderLayer to draw the replaced content
+    // directly into a compositing buffer
+    bool canUseDirectCompositing() const;
+    void updateImageContents();
+
+    bool rendererHasBackground() const;
+    const Color& rendererBackgroundColor() const;
+
+    bool hasNonCompositingContent() const;
+    
+    void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
+                    bool haveTransparency, PaintRestriction paintRestriction, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
+
+    static int graphicsLayerToCSSProperty(AnimatedPropertyID);
+    static AnimatedPropertyID cssToGraphicsLayerProperty(int);
+
+private:
+    RenderLayer* m_owningLayer;
+
+    GraphicsLayer* m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
+    GraphicsLayer* m_graphicsLayer;
+    GraphicsLayer* m_contentsLayer;         // only used in cases where we need to draw the foreground separately
+    GraphicsLayer* m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+
+    IntSize m_compositingContentOffset;
+
+    bool m_hasDirectlyCompositedContent: 1;
+    bool m_compositingContentOffsetDirty: 1;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // RenderLayerBacking_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
new file mode 100644
index 0000000000..fec3b1d5b1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -0,0 +1,827 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerCompositor.h"
+
+#include "AnimationController.h"
+#include "ChromeClient.h"
+#include "CSSPropertyNames.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GraphicsLayer.h"
+#include "HitTestRequest.h"
+#include "HitTestResult.h"
+#include "Page.h"
+#include "RenderLayerBacking.h"
+#include "RenderView.h"
+
+#if PROFILE_LAYER_REBUILD
+#include <wtf/CurrentTime.h>
+#endif
+
+#ifndef NDEBUG
+#include "CString.h"
+#include "RenderTreeAsText.h"
+#endif
+
+#if ENABLE(3D_RENDERING)
+// This symbol is used to determine from a script whether 3D rendering is enabled (via 'nm').
+bool WebCoreHas3DRendering = true;
+#endif
+
+namespace WebCore {
+
+struct CompositingState {
+    CompositingState(RenderLayer* compAncestor)
+        : m_subtreeIsCompositing(false)
+        , m_compositingAncestor(compAncestor)
+#ifndef NDEBUG
+        , m_depth(0)
+#endif
+    {
+    }
+    
+    bool m_subtreeIsCompositing;
+    RenderLayer* m_compositingAncestor;
+#ifndef NDEBUG
+    int m_depth;
+#endif
+};
+
+static TransformationMatrix flipTransform()
+{
+    TransformationMatrix flipper;
+    flipper.flipY();
+    return flipper;
+}
+
+RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
+    : m_renderView(renderView)
+    , m_rootPlatformLayer(0)
+    , m_compositing(false)
+    , m_rootLayerAttached(false)
+    , m_compositingLayersNeedUpdate(false)
+#if PROFILE_LAYER_REBUILD
+    , m_rootLayerUpdateCount(0)
+#endif // PROFILE_LAYER_REBUILD
+{
+}
+
+RenderLayerCompositor::~RenderLayerCompositor()
+{
+    ASSERT(!m_rootLayerAttached);
+    delete m_rootPlatformLayer;
+}
+
+void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
+{
+    if (enable != m_compositing) {
+        m_compositing = enable;
+        
+        // We never go out of compositing mode for a given page,
+        // but if all the layers disappear, we'll just be left with
+        // the empty root layer, which has minimal overhead.
+        if (m_compositing)
+            ensureRootPlatformLayer();
+    }
+}
+
+void RenderLayerCompositor::setCompositingLayersNeedUpdate(bool needUpdate)
+{
+    if (inCompositingMode()) {
+        if (!m_compositingLayersNeedUpdate && needUpdate)
+            scheduleViewUpdate();
+
+        m_compositingLayersNeedUpdate = needUpdate;
+    }
+}
+
+void RenderLayerCompositor::scheduleViewUpdate()
+{
+    Frame* frame = m_renderView->frameView()->frame();
+    Page* page = frame ? frame->page() : 0;
+    if (!page)
+        return;
+
+    page->chrome()->client()->scheduleViewUpdate();
+}
+
+void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
+{
+    if (!m_compositingLayersNeedUpdate)
+        return;
+
+    ASSERT(inCompositingMode());
+
+    if (!updateRoot) {
+        // Only clear the flag if we're updating the entire hierarchy
+        m_compositingLayersNeedUpdate = false;
+        updateRoot = rootRenderLayer();
+    }
+
+#if PROFILE_LAYER_REBUILD
+    ++m_rootLayerUpdateCount;
+    
+    double startTime = WTF::currentTime();
+#endif        
+
+    // Go through the layers in presentation order, so that we can compute which
+    // RLs need compositing layers.
+    // FIXME: we could maybe do this in one pass, but the parenting logic would be more
+    // complex.
+    {
+        CompositingState compState(updateRoot);
+        computeCompositingRequirements(updateRoot, compState);
+    }
+
+    // Now create and parent the compositing layers.
+    {
+        CompositingState compState(updateRoot);
+        rebuildCompositingLayerTree(updateRoot, compState);
+    }
+    
+#if PROFILE_LAYER_REBUILD
+    double endTime = WTF::currentTime();
+    if (updateRoot == rootRenderLayer())
+        fprintf(stderr, "Update %d: computeCompositingRequirements for the world took %fms\n",
+                    m_rootLayerUpdateCount, 1000.0 * (endTime - startTime));
+#endif
+    ASSERT(updateRoot || !m_compositingLayersNeedUpdate);
+}
+
+bool RenderLayerCompositor::updateLayerCompositingState(RenderLayer* layer, CompositingChangeRepaint shouldRepaint)
+{
+    bool needsLayer = needsToBeComposited(layer);
+    bool layerChanged = false;
+
+    if (needsLayer) {
+        enableCompositingMode();
+        if (!layer->backing()) {
+
+            // If we need to repaint, do so before making backing
+            if (shouldRepaint == CompositingChangeRepaintNow)
+                repaintOnCompositingChange(layer);
+
+            layer->ensureBacking();
+            layerChanged = true;
+        }
+    } else {
+        if (layer->backing()) {
+            layer->clearBacking();
+            layerChanged = true;
+
+            // If we need to repaint, do so now that we've removed the backing
+            if (shouldRepaint == CompositingChangeRepaintNow)
+                repaintOnCompositingChange(layer);
+        }
+    }
+    
+    // See if we need content or clipping layers. Methods called here should assume
+    // that the compositing state of descendant layers has not been updated yet.
+    if (layer->backing() && layer->backing()->updateGraphicsLayerConfiguration())
+        layerChanged = true;
+
+    return layerChanged;
+}
+
+void RenderLayerCompositor::repaintOnCompositingChange(RenderLayer* layer)
+{
+    RenderBoxModelObject* repaintContainer = layer->renderer()->containerForRepaint();
+    if (!repaintContainer)
+        repaintContainer = m_renderView;
+
+    layer->repaintIncludingNonCompositingDescendants(repaintContainer);
+    if (repaintContainer == m_renderView) {
+        // The contents of this layer may be moving between the window
+        // and a GraphicsLayer, so we need to make sure the window system
+        // synchronizes those changes on the screen.
+        m_renderView->frameView()->setNeedsOneShotDrawingSynchronization();
+    }
+}
+
+// The bounds of the GraphicsLayer created for a compositing layer is the union of the bounds of all the descendant
+// RenderLayers that are rendered by the composited RenderLayer.
+IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer, IntRect* layerBoundingBox)
+{
+    IntRect boundingBoxRect, unionBounds;
+    boundingBoxRect = unionBounds = layer->localBoundingBox();
+    
+    ASSERT(layer->isStackingContext() || (!layer->m_posZOrderList || layer->m_posZOrderList->size() == 0));
+
+    Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
+    if (negZOrderList) {
+        for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
+            RenderLayer* curLayer = (*it);
+            if (!curLayer->isComposited()) {
+                IntRect childUnionBounds = calculateCompositedBounds(curLayer, layer);
+                unionBounds.unite(childUnionBounds);
+            }
+        }
+    }
+
+    Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
+    if (posZOrderList) {
+        for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
+            RenderLayer* curLayer = (*it);
+            if (!curLayer->isComposited()) {
+                IntRect childUnionBounds = calculateCompositedBounds(curLayer, layer);
+                unionBounds.unite(childUnionBounds);
+            }
+        }
+    }
+
+    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
+    if (normalFlowList) {
+        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
+            RenderLayer* curLayer = (*it);
+            if (!curLayer->isComposited()) {
+                IntRect curAbsBounds = calculateCompositedBounds(curLayer, layer);
+                unionBounds.unite(curAbsBounds);
+            }
+        }
+    }
+
+    if (layer->paintsWithTransform()) {
+        TransformationMatrix* affineTrans = layer->transform();
+        boundingBoxRect = affineTrans->mapRect(boundingBoxRect);
+        unionBounds = affineTrans->mapRect(unionBounds);
+    }
+
+    int ancestorRelX = 0, ancestorRelY = 0;
+    layer->convertToLayerCoords(ancestorLayer, ancestorRelX, ancestorRelY);
+    unionBounds.move(ancestorRelX, ancestorRelY);
+
+    if (layerBoundingBox) {
+        boundingBoxRect.move(ancestorRelX, ancestorRelY);
+        *layerBoundingBox = boundingBoxRect;
+    }
+    
+    return unionBounds;
+}
+
+void RenderLayerCompositor::layerWasAdded(RenderLayer* /*parent*/, RenderLayer* /*child*/)
+{
+    setCompositingLayersNeedUpdate();
+}
+
+void RenderLayerCompositor::layerWillBeRemoved(RenderLayer* parent, RenderLayer* child)
+{
+    if (child->isComposited())
+        setCompositingParent(child, 0);
+    
+    // If the document is being torn down (document's renderer() is null), then there's
+    // no need to do any layer updating.
+    if (parent->renderer()->documentBeingDestroyed())
+        return;
+
+    RenderLayer* compLayer = parent->enclosingCompositingLayer();
+    if (compLayer) {
+        IntRect ancestorRect = calculateCompositedBounds(child, compLayer);
+        compLayer->setBackingNeedsRepaintInRect(ancestorRect);
+        // The contents of this layer may be moving from a GraphicsLayer to the window,
+        // so we need to make sure the window system synchronizes those changes on the screen.
+        m_renderView->frameView()->setNeedsOneShotDrawingSynchronization();
+    }
+
+    setCompositingLayersNeedUpdate();
+}
+
+RenderLayer* RenderLayerCompositor::enclosingNonStackingClippingLayer(const RenderLayer* layer) const
+{
+    for (RenderLayer* curr = layer->parent(); curr != 0; curr = curr->parent()) {
+        if (curr->isStackingContext())
+            return 0;
+
+        if (curr->renderer()->hasOverflowClip())
+            return curr;
+    }
+    return 0;
+}
+
+//  Recurse through the layers in z-index and overflow order (which is equivalent to painting order)
+//  For the z-order children of a compositing layer:
+//      If a child layers has a compositing layer, then all subsequent layers must
+//      be compositing in order to render above that layer.
+//
+//      If a child in the negative z-order list is compositing, then the layer itself
+//      must be compositing so that its contents render over that child.
+//      This implies that its positive z-index children must also be compositing.
+//
+void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, struct CompositingState& ioCompState)
+{
+    layer->updateLayerPosition();
+    layer->updateZOrderLists();
+    layer->updateNormalFlowList();
+    
+    // Clear the flag
+    layer->setHasCompositingDescendant(false);
+    layer->setMustOverlayCompositedLayers(ioCompState.m_subtreeIsCompositing);
+    
+    const bool willBeComposited = needsToBeComposited(layer);
+    // If we are going to become composited, repaint the old rendering destination
+    if (!layer->isComposited() && willBeComposited)
+        repaintOnCompositingChange(layer);
+
+    ioCompState.m_subtreeIsCompositing = willBeComposited;
+
+    CompositingState childState = ioCompState;
+    if (willBeComposited)
+        childState.m_compositingAncestor = layer;
+
+    // The children of this stacking context don't need to composite, unless there is
+    // a compositing layer among them, so start by assuming false.
+    childState.m_subtreeIsCompositing = false;
+
+#ifndef NDEBUG
+    ++childState.m_depth;
+#endif
+
+    if (layer->isStackingContext()) {
+        ASSERT(!layer->m_zOrderListsDirty);
+        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
+        if (negZOrderList && negZOrderList->size() > 0) {
+            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                computeCompositingRequirements(curLayer, childState);
+
+                // if we have to make a layer for this child, make one now so we can have a contents layer
+                // (since we need to ensure that the -ve z-order child renders underneath our contents)
+                if (childState.m_subtreeIsCompositing) {
+                    // make |this| compositing
+                    layer->setMustOverlayCompositedLayers(true);
+                    childState.m_compositingAncestor = layer;
+                }
+            }
+        }
+    }
+    
+    ASSERT(!layer->m_normalFlowListDirty);
+    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
+    if (normalFlowList && normalFlowList->size() > 0) {
+        for (Vector<RenderLayer*>::const_iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
+            RenderLayer* curLayer = (*it);
+            computeCompositingRequirements(curLayer, childState);
+        }
+    }
+
+    if (layer->isStackingContext()) {
+        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
+        if (posZOrderList && posZOrderList->size() > 0) {
+            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                computeCompositingRequirements(curLayer, childState);
+            }
+        }
+    }
+
+    // If we have a software transform, and we have layers under us, we need to also
+    // be composited. Also, if we have opacity < 1, then we need to be a layer so that
+    // the child layers are opaque, then rendered with opacity on this layer.
+    if (childState.m_subtreeIsCompositing &&
+        (layer->renderer()->hasTransform() || layer->renderer()->style()->opacity() < 1))
+        layer->setMustOverlayCompositedLayers(true);
+
+    // Subsequent layers in the parent stacking context also need to composite.
+    if (childState.m_subtreeIsCompositing)
+        ioCompState.m_subtreeIsCompositing = true;
+
+    // Set the flag to say that this SC has compositing children.
+    // this can affect the answer to needsToBeComposited() when clipping,
+    // but that's ok here.
+    layer->setHasCompositingDescendant(childState.m_subtreeIsCompositing);
+}
+
+void RenderLayerCompositor::setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer)
+{
+    ASSERT(childLayer->isComposited());
+    ASSERT(!parentLayer || parentLayer->isComposited());
+    
+    if (parentLayer) {
+        GraphicsLayer* hostingLayer = parentLayer->backing()->parentForSublayers();
+        GraphicsLayer* hostedLayer = childLayer->backing()->childForSuperlayers();
+        
+        hostingLayer->addChild(hostedLayer);
+    } else
+        childLayer->backing()->childForSuperlayers()->removeFromParent();
+}
+
+void RenderLayerCompositor::removeCompositedChildren(RenderLayer* layer)
+{
+    ASSERT(layer->isComposited());
+
+    GraphicsLayer* hostingLayer = layer->backing()->parentForSublayers();
+    hostingLayer->removeAllChildren();
+}
+
+void RenderLayerCompositor::parentInRootLayer(RenderLayer* layer)
+{
+    ASSERT(layer->isComposited());
+
+    GraphicsLayer* layerAnchor = layer->backing()->childForSuperlayers();
+
+    if (layerAnchor->parent() != m_rootPlatformLayer) {
+        layerAnchor->removeFromParent();
+        if (m_rootPlatformLayer)
+            m_rootPlatformLayer->addChild(layerAnchor);
+    }
+}
+
+void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& ioCompState)
+{
+    bool wasComposited = layer->isComposited();
+
+    // Make the layer compositing if necessary, and set up clipping and content layers.
+    // Note that we can only do work here that is independent of whether the descendant layers
+    // have been processed. computeCompositingRequirements() will already have done the repaint if necessary.
+    updateLayerCompositingState(layer, CompositingChangeWillRepaintLater);
+
+    // host the document layer in the RenderView's root layer
+    if (layer->isRootLayer())
+        parentInRootLayer(layer);
+
+    CompositingState childState = ioCompState;
+    if (layer->isComposited())
+        childState.m_compositingAncestor = layer;
+
+#ifndef NDEBUG
+    ++childState.m_depth;
+#endif
+
+    RenderLayerBacking* layerBacking = layer->backing();
+    
+    // FIXME: make this more incremental
+    if (layerBacking) {
+        layerBacking->parentForSublayers()->removeAllChildren();
+        layerBacking->updateInternalHierarchy();
+    }
+    
+    // The children of this stacking context don't need to composite, unless there is
+    // a compositing layer among them, so start by assuming false.
+    childState.m_subtreeIsCompositing = false;
+
+    if (layer->isStackingContext()) {
+        ASSERT(!layer->m_zOrderListsDirty);
+
+        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
+        if (negZOrderList && negZOrderList->size() > 0) {
+            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                rebuildCompositingLayerTree(curLayer, childState);
+                if (curLayer->isComposited())
+                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+            }
+        }
+
+        if (layerBacking && layerBacking->contentsLayer()) {
+            // we only have a contents layer if we have an m_layer
+            layerBacking->contentsLayer()->removeFromParent();
+
+            GraphicsLayer* hostingLayer = layerBacking->clippingLayer() ? layerBacking->clippingLayer() : layerBacking->graphicsLayer();
+            hostingLayer->addChild(layerBacking->contentsLayer());
+        }
+    }
+
+    ASSERT(!layer->m_normalFlowListDirty);
+    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
+    if (normalFlowList && normalFlowList->size() > 0) {
+        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
+            RenderLayer* curLayer = (*it);
+            rebuildCompositingLayerTree(curLayer, childState);
+            if (curLayer->isComposited())
+                setCompositingParent(curLayer, childState.m_compositingAncestor);
+        }
+    }
+    
+    if (layer->isStackingContext()) {
+        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
+        if (posZOrderList && posZOrderList->size() > 0) {
+            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                rebuildCompositingLayerTree(curLayer, childState);
+                if (curLayer->isComposited())
+                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+            }
+        }
+    }
+    
+    if (layerBacking) {
+        // Do work here that requires that we've processed all of the descendant layers
+        layerBacking->updateGraphicsLayerGeometry();
+    } else if (wasComposited) {
+        // We stopped being a compositing layer. Now that our descendants have been udated, we can
+        // repaint our new rendering destination.
+        repaintOnCompositingChange(layer);
+    }
+}
+
+void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& absRect)
+{
+    recursiveRepaintLayerRect(rootRenderLayer(), absRect);
+}
+
+void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect)
+{
+    if (layer->isComposited())
+        layer->setBackingNeedsRepaintInRect(rect);
+
+    if (layer->hasCompositingDescendant()) {
+        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
+        if (negZOrderList) {
+            for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                int x = 0, y = 0;
+                curLayer->convertToLayerCoords(layer, x, y);
+                IntRect childRect(rect);
+                childRect.move(-x, -y);
+                recursiveRepaintLayerRect(curLayer, childRect);
+            }
+        }
+
+        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
+        if (posZOrderList) {
+            for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                int x = 0, y = 0;
+                curLayer->convertToLayerCoords(layer, x, y);
+                IntRect childRect(rect);
+                childRect.move(-x, -y);
+                recursiveRepaintLayerRect(curLayer, childRect);
+            }
+        }
+        
+        Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
+        if (normalFlowList) {
+            for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                int x = 0, y = 0;
+                curLayer->convertToLayerCoords(layer, x, y);
+                IntRect childRect(rect);
+                childRect.move(-x, -y);
+                recursiveRepaintLayerRect(curLayer, childRect);
+            }
+        }
+    }
+}
+
+RenderLayer* RenderLayerCompositor::rootRenderLayer() const
+{
+    return m_renderView->layer();
+}
+
+GraphicsLayer* RenderLayerCompositor::rootPlatformLayer() const
+{
+    return m_rootPlatformLayer;
+}
+
+void RenderLayerCompositor::didMoveOnscreen()
+{
+    if (!m_rootPlatformLayer)
+        return;
+
+    Frame* frame = m_renderView->frameView()->frame();
+    Page* page = frame ? frame->page() : 0;
+    if (!page)
+        return;
+
+    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer);
+    m_rootLayerAttached = true;
+}
+
+void RenderLayerCompositor::willMoveOffscreen()
+{
+    if (!m_rootPlatformLayer || !m_rootLayerAttached)
+        return;
+
+    Frame* frame = m_renderView->frameView()->frame();
+    Page* page = frame ? frame->page() : 0;
+    if (!page)
+        return;
+
+    page->chrome()->client()->attachRootGraphicsLayer(frame, 0);
+    m_rootLayerAttached = false;
+}
+
+void RenderLayerCompositor::updateRootLayerPosition()
+{
+    if (m_rootPlatformLayer)
+        m_rootPlatformLayer->setSize(FloatSize(m_renderView->docWidth(), m_renderView->docHeight()));
+}
+
+bool RenderLayerCompositor::has3DContent() const
+{
+    return layerHas3DContent(rootRenderLayer());
+}
+
+bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
+{
+    return requiresCompositingLayer(layer) || layer->mustOverlayCompositedLayers();
+}
+
+#define VERBOSE_COMPOSITINGLAYER    0
+
+// Note: this specifies whether the RL needs a compositing layer for intrinsic reasons.
+// Use needsToBeComposited() to determine if a RL actually needs a compositing layer.
+// static
+bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) const
+{
+    // FIXME: cache the result of these tests?
+#if VERBOSE_COMPOSITINGLAYER
+    bool gotReason = false;
+
+    if (!gotReason && inCompositingMode() && layer->isRootLayer()) {
+        fprintf(stderr, "RenderLayer %p requires compositing layer because: it's the document root\n", layer);
+        gotReason = true;
+    }
+    
+    if (!gotReason && requiresCompositingForTransform(layer->renderer())) {
+        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has 3d transform, perspective, backface, or animating transform\n", layer);
+        gotReason = true;
+    }
+
+    if (!gotReason && layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden) {
+        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has backface-visibility: hidden\n", layer);
+        gotReason = true;
+    }
+
+    if (!gotReason && clipsCompositingDescendants(layer)) {
+        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has overflow clip\n", layer);
+        gotReason = true;
+    }
+
+    if (!gotReason && requiresCompositingForAnimation(layer->renderer())) {
+        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has a running transition for opacity or transform\n", layer);
+        gotReason = true;
+    }
+    
+    if (!gotReason)
+        fprintf(stderr, "RenderLayer %p does not require compositing layer\n", layer);
+#endif
+
+    // The root layer always has a compositing layer, but it may not have backing.
+    return (inCompositingMode() && layer->isRootLayer()) ||
+             requiresCompositingForTransform(layer->renderer()) ||
+             layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden ||
+             clipsCompositingDescendants(layer) ||
+             requiresCompositingForAnimation(layer->renderer());
+}
+
+// Return true if the given layer has some ancestor in the RenderLayer hierarchy that clips,
+// up to the enclosing compositing ancestor. This is required because compositing layers are parented
+// according to the z-order hierarchy, yet clipping goes down the renderer hierarchy.
+// Thus, a RenderLayer can be clipped by a RenderLayer that is an ancestor in the renderer hierarchy,
+// but a sibling in the z-order hierarchy.
+bool RenderLayerCompositor::clippedByAncestor(RenderLayer* layer) const
+{
+    if (!layer->isComposited() || !layer->parent())
+        return false;
+
+    RenderLayer* compositingAncestor = layer->ancestorCompositingLayer();
+    if (!compositingAncestor)
+        return false;
+
+    // If the compositingAncestor clips, that will be taken care of by clipsCompositingDescendants(),
+    // so we only care about clipping between its first child that is our ancestor (the computeClipRoot),
+    // and layer.
+    RenderLayer* computeClipRoot = 0;
+    RenderLayer* curr = layer;
+    while (curr) {
+        RenderLayer* next = curr->parent();
+        if (next == compositingAncestor) {
+            computeClipRoot = curr;
+            break;
+        }
+        curr = next;
+    }
+    
+    if (!computeClipRoot || computeClipRoot == layer)
+        return false;
+
+    ClipRects parentRects;
+    layer->parentClipRects(computeClipRoot, parentRects, true);
+
+    return parentRects.overflowClipRect() != ClipRects::infiniteRect();
+}
+
+// Return true if the given layer is a stacking context and has compositing child
+// layers that it needs to clip. In this case we insert a clipping GraphicsLayer
+// into the hierarchy between this layer and its children in the z-order hierarchy.
+bool RenderLayerCompositor::clipsCompositingDescendants(const RenderLayer* layer) const
+{
+    // FIXME: need to look at hasClip() too eventually
+    return layer->hasCompositingDescendant() &&
+           layer->renderer()->hasOverflowClip();
+}
+
+bool RenderLayerCompositor::requiresCompositingForTransform(RenderObject* renderer)
+{
+    RenderStyle* style = renderer->style();
+    // Note that we ask the renderer if it has a transform, because the style may have transforms,
+    // but the renderer may be an inline that doesn't suppport them.
+    return renderer->hasTransform() && (style->transform().has3DOperation() || style->transformStyle3D() == TransformStyle3DPreserve3D || style->hasPerspective());
+}
+
+bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer)
+{
+    AnimationController* animController = renderer->animation();
+    if (animController)
+        return animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyOpacity) ||
+               animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyWebkitTransform);
+    return false;
+}
+
+// If an element has negative z-index children, those children render in front of the 
+// layer background, so we need an extra 'contents' layer for the foreground of the layer
+// object.
+bool RenderLayerCompositor::needsContentsCompositingLayer(const RenderLayer* layer) const
+{
+    return (layer->m_negZOrderList && layer->m_negZOrderList->size() > 0);
+}
+
+void RenderLayerCompositor::ensureRootPlatformLayer()
+{
+    if (m_rootPlatformLayer)
+        return;
+
+    m_rootPlatformLayer = GraphicsLayer::createGraphicsLayer(0);
+    m_rootPlatformLayer->setSize(FloatSize(m_renderView->docWidth(), m_renderView->docHeight()));
+    m_rootPlatformLayer->setPosition(FloatPoint(0, 0));
+
+    if (GraphicsLayer::compositingCoordinatesOrientation() == GraphicsLayer::CompositingCoordinatesBottomUp)
+        m_rootPlatformLayer->setChildrenTransform(flipTransform());
+
+    // Need to clip to prevent transformed content showing outside this frame
+    m_rootPlatformLayer->setMasksToBounds(true);
+    
+    didMoveOnscreen();
+}
+
+bool RenderLayerCompositor::layerHas3DContent(const RenderLayer* layer) const
+{
+    const RenderStyle* style = layer->renderer()->style();
+
+    if (style && 
+        (style->transformStyle3D() == TransformStyle3DPreserve3D ||
+         style->hasPerspective() ||
+         style->transform().has3DOperation()))
+        return true;
+
+    if (layer->isStackingContext()) {
+        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
+        if (negZOrderList) {
+            for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                if (layerHas3DContent(curLayer))
+                    return true;
+            }
+        }
+
+        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
+        if (posZOrderList) {
+            for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
+                RenderLayer* curLayer = (*it);
+                if (layerHas3DContent(curLayer))
+                    return true;
+            }
+        }
+    }
+
+    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
+    if (normalFlowList) {
+        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
+            RenderLayer* curLayer = (*it);
+            if (layerHas3DContent(curLayer))
+                return true;
+        }
+    }
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
new file mode 100644
index 0000000000..76cb35f1ed
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RenderLayerCompositor_h
+#define RenderLayerCompositor_h
+
+#include "RenderLayer.h"
+
+namespace WebCore {
+
+#define PROFILE_LAYER_REBUILD 0
+
+class GraphicsLayer;
+
+// RenderLayerCompositor manages the hierarchy of
+// composited RenderLayers. It determines which RenderLayers
+// become compositing, and creates and maintains a hierarchy of
+// GraphicsLayers based on the RenderLayer painting order.
+// 
+// There is one RenderLayerCompositor per RenderView.
+
+class RenderLayerCompositor {
+public:
+
+    RenderLayerCompositor(RenderView*);
+    ~RenderLayerCompositor();
+    
+    // Return true if this RenderView is in "compositing mode" (i.e. has one or more
+    // composited RenderLayers)
+    bool inCompositingMode() const { return m_compositing; }
+    // This will make a compositing layer at the root automatically, and hook up to
+    // the native view/window system.
+    void enableCompositingMode(bool enable = true);
+
+    void setCompositingLayersNeedUpdate(bool needUpdate = true);
+    bool compositingLayersNeedUpdate() const { return m_compositingLayersNeedUpdate; }
+
+    void scheduleViewUpdate();
+    
+    // Rebuild the tree of compositing layers
+    void updateCompositingLayers(RenderLayer* updateRoot = 0);
+
+    // Update the compositing state of the given layer. Returns true if that state changed.
+    enum CompositingChangeRepaint { CompositingChangeRepaintNow, CompositingChangeWillRepaintLater };
+    bool updateLayerCompositingState(RenderLayer*, CompositingChangeRepaint = CompositingChangeRepaintNow);
+
+    // Whether layer's backing needs a graphics layer to do clipping by an ancestor (non-stacking-context parent with overflow).
+    bool clippedByAncestor(RenderLayer*) const;
+    // Whether layer's backing needs a graphics layer to clip z-order children of the given layer.
+    bool clipsCompositingDescendants(const RenderLayer*) const;
+
+    // Whether the given layer needs an extra 'contents' layer.
+    bool needsContentsCompositingLayer(const RenderLayer*) const;
+    // Return the bounding box required for compositing layer and its childern, relative to ancestorLayer.
+    // If layerBoundingBox is not 0, on return it contains the bounding box of this layer only.
+    IntRect calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer, IntRect* layerBoundingBox = 0);
+
+    // Repaint the appropriate layers when the given RenderLayer starts or stops being composited.
+    void repaintOnCompositingChange(RenderLayer*);
+    
+    // Notify us that a layer has been added or removed
+    void layerWasAdded(RenderLayer* parent, RenderLayer* child);
+    void layerWillBeRemoved(RenderLayer* parent, RenderLayer* child);
+
+    // Get the nearest ancestor layer that has overflow or clip, but is not a stacking context
+    RenderLayer* enclosingNonStackingClippingLayer(const RenderLayer* layer) const;
+
+    // Repaint parts of all composited layers that intersect the given absolute rectangle.
+    void repaintCompositedLayersAbsoluteRect(const IntRect&);
+
+    RenderLayer* rootRenderLayer() const;
+    GraphicsLayer* rootPlatformLayer() const;
+
+    void didMoveOnscreen();
+    void willMoveOffscreen();
+
+    void updateRootLayerPosition();
+
+    // Walk the tree looking for layers with 3d transforms. Useful in case you need
+    // to know if there is non-affine content, e.g. for drawing into an image.
+    bool has3DContent() const;
+
+private:
+    // Whether the given RL needs a compositing layer.
+    bool needsToBeComposited(const RenderLayer*) const;
+    // Whether the layer has an intrinsic need for compositing layer.
+    bool requiresCompositingLayer(const RenderLayer*) const;
+
+    // Repaint the given rect (which is layer's coords), and regions of child layers that intersect that rect.
+    void recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect);
+
+    void computeCompositingRequirements(RenderLayer*, struct CompositingState&);
+    void rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState&);
+
+    // Hook compositing layers together
+    void setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer);
+    void removeCompositedChildren(RenderLayer*);
+
+    void parentInRootLayer(RenderLayer*);
+
+    bool layerHas3DContent(const RenderLayer*) const;
+
+    void ensureRootPlatformLayer();
+
+    // Whether a running transition or animation enforces the need for a compositing layer.
+    static bool requiresCompositingForAnimation(RenderObject*);
+    static bool requiresCompositingForTransform(RenderObject*);
+
+private:
+    RenderView* m_renderView;
+    GraphicsLayer* m_rootPlatformLayer;
+    bool m_compositing;
+    bool m_rootLayerAttached;
+    bool m_compositingLayersNeedUpdate;
+#if PROFILE_LAYER_REBUILD
+    int m_rootLayerUpdateCount;
+#endif
+};
+
+
+} // namespace WebCore
+
+#endif // RenderLayerCompositor_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
new file mode 100644
index 0000000000..00566b87b4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
@@ -0,0 +1,333 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderLineBoxList.h"
+
+#include "InlineTextBox.h"
+#include "RenderArena.h"
+#include "RenderInline.h"
+#include "RenderView.h"
+#include "RootInlineBox.h"
+
+using namespace std;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+RenderLineBoxList::~RenderLineBoxList()
+{
+    ASSERT(!m_firstLineBox);
+    ASSERT(!m_lastLineBox);
+}
+#endif
+
+void RenderLineBoxList::appendLineBox(InlineFlowBox* box)
+{
+    checkConsistency();
+    
+    if (!m_firstLineBox)
+        m_firstLineBox = m_lastLineBox = box;
+    else {
+        m_lastLineBox->setNextLineBox(box);
+        box->setPreviousLineBox(m_lastLineBox);
+        m_lastLineBox = box;
+    }
+
+    checkConsistency();
+}
+
+void RenderLineBoxList::deleteLineBoxTree(RenderArena* arena)
+{
+    InlineFlowBox* line = m_firstLineBox;
+    InlineFlowBox* nextLine;
+    while (line) {
+        nextLine = line->nextFlowBox();
+        line->deleteLine(arena);
+        line = nextLine;
+    }
+    m_firstLineBox = m_lastLineBox = 0;
+}
+
+void RenderLineBoxList::extractLineBox(InlineFlowBox* box)
+{
+    checkConsistency();
+    
+    m_lastLineBox = box->prevFlowBox();
+    if (box == m_firstLineBox)
+        m_firstLineBox = 0;
+    if (box->prevLineBox())
+        box->prevLineBox()->setNextLineBox(0);
+    box->setPreviousLineBox(0);
+    for (InlineRunBox* curr = box; curr; curr = curr->nextLineBox())
+        curr->setExtracted();
+
+    checkConsistency();
+}
+
+void RenderLineBoxList::attachLineBox(InlineFlowBox* box)
+{
+    checkConsistency();
+
+    if (m_lastLineBox) {
+        m_lastLineBox->setNextLineBox(box);
+        box->setPreviousLineBox(m_lastLineBox);
+    } else
+        m_firstLineBox = box;
+    InlineFlowBox* last = box;
+    for (InlineFlowBox* curr = box; curr; curr = curr->nextFlowBox()) {
+        curr->setExtracted(false);
+        last = curr;
+    }
+    m_lastLineBox = last;
+
+    checkConsistency();
+}
+
+void RenderLineBoxList::removeLineBox(InlineFlowBox* box)
+{
+    checkConsistency();
+
+    if (box == m_firstLineBox)
+        m_firstLineBox = box->nextFlowBox();
+    if (box == m_lastLineBox)
+        m_lastLineBox = box->prevFlowBox();
+    if (box->nextLineBox())
+        box->nextLineBox()->setPreviousLineBox(box->prevLineBox());
+    if (box->prevLineBox())
+        box->prevLineBox()->setNextLineBox(box->nextLineBox());
+
+    checkConsistency();
+}
+
+void RenderLineBoxList::deleteLineBoxes(RenderArena* arena)
+{
+    if (m_firstLineBox) {
+        InlineRunBox* next;
+        for (InlineRunBox* curr = m_firstLineBox; curr; curr = next) {
+            next = curr->nextLineBox();
+            curr->destroy(arena);
+        }
+        m_firstLineBox = 0;
+        m_lastLineBox = 0;
+    }
+}
+
+void RenderLineBoxList::dirtyLineBoxes()
+{
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
+        curr->dirtyLineBoxes();
+}
+
+void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::PaintInfo& paintInfo, int tx, int ty) const
+{
+    // Only paint during the foreground/selection phases.
+    if (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection && paintInfo.phase != PaintPhaseOutline 
+        && paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines && paintInfo.phase != PaintPhaseTextClip
+        && paintInfo.phase != PaintPhaseMask)
+        return;
+
+    ASSERT(renderer->isRenderBlock() || (renderer->isRenderInline() && renderer->hasLayer())); // The only way an inline could paint like this is if it has a layer.
+
+    // If we have no lines then we have no work to do.
+    if (!firstLineBox())
+        return;
+
+    // We can check the first box and last box and avoid painting if we don't
+    // intersect.  This is a quick short-circuit that we can take to avoid walking any lines.
+    // FIXME: This check is flawed in the following extremely obscure way:
+    // if some line in the middle has a huge overflow, it might actually extend below the last line.
+    int yPos = firstLineBox()->root()->topOverflow() - renderer->maximalOutlineSize(paintInfo.phase);
+    int h = renderer->maximalOutlineSize(paintInfo.phase) + lastLineBox()->root()->bottomOverflow() - yPos;
+    yPos += ty;
+    if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
+        return;
+
+    RenderObject::PaintInfo info(paintInfo);
+    ListHashSet<RenderInline*> outlineObjects;
+    info.outlineObjects = &outlineObjects;
+
+    // See if our root lines intersect with the dirty rect.  If so, then we paint
+    // them.  Note that boxes can easily overlap, so we can't make any assumptions
+    // based off positions of our first line box or our last line box.
+    RenderView* v = renderer->view();
+    bool usePrintRect = !v->printRect().isEmpty();
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextFlowBox()) {
+        if (usePrintRect) {
+            // FIXME: This is a feeble effort to avoid splitting a line across two pages.
+            // It is utterly inadequate, and this should not be done at paint time at all.
+            // The whole way objects break across pages needs to be redone.
+            // Try to avoid splitting a line vertically, but only if it's less than the height
+            // of the entire page.
+            if (curr->root()->bottomOverflow() - curr->root()->topOverflow() <= v->printRect().height()) {
+                if (ty + curr->root()->bottomOverflow() > v->printRect().bottom()) {
+                    if (ty + curr->root()->topOverflow() < v->truncatedAt())
+                        v->setBestTruncatedAt(ty + curr->root()->topOverflow(), renderer);
+                    // If we were able to truncate, don't paint.
+                    if (ty + curr->root()->topOverflow() >= v->truncatedAt())
+                        break;
+                }
+            }
+        }
+
+        int top = min(curr->root()->topOverflow(), curr->root()->selectionTop()) - renderer->maximalOutlineSize(info.phase);
+        int bottom = curr->root()->bottomOverflow() + renderer->maximalOutlineSize(info.phase);
+        h = bottom - top;
+        yPos = ty + top;
+        if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
+            curr->paint(info, tx, ty);
+    }
+
+    if (info.phase == PaintPhaseOutline || info.phase == PaintPhaseSelfOutline || info.phase == PaintPhaseChildOutlines) {
+        ListHashSet<RenderInline*>::iterator end = info.outlineObjects->end();
+        for (ListHashSet<RenderInline*>::iterator it = info.outlineObjects->begin(); it != end; ++it) {
+            RenderInline* flow = *it;
+            flow->paintOutline(info.context, tx, ty);
+        }
+        info.outlineObjects->clear();
+    }
+}
+
+
+bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction) const
+{
+    if (hitTestAction != HitTestForeground)
+        return false;
+
+    ASSERT(renderer->isRenderBlock() || (renderer->isRenderInline() && renderer->hasLayer())); // The only way an inline could hit test like this is if it has a layer.
+
+    // If we have no lines then we have no work to do.
+    if (!firstLineBox())
+        return false;
+
+    // We can check the first box and last box and avoid hit testing if we don't
+    // contain the point.  This is a quick short-circuit that we can take to avoid walking any lines.
+    // FIXME: This check is flawed in the following extremely obscure way:
+    // if some line in the middle has a huge overflow, it might actually extend below the last line.
+    if ((y >= ty + lastLineBox()->root()->bottomOverflow()) || (y < ty + firstLineBox()->root()->topOverflow()))
+        return false;
+
+    // See if our root lines contain the point.  If so, then we hit test
+    // them further.  Note that boxes can easily overlap, so we can't make any assumptions
+    // based off positions of our first line box or our last line box.
+    for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevFlowBox()) {
+        if (y >= ty + curr->root()->topOverflow() && y < ty + curr->root()->bottomOverflow()) {
+            bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty);
+            if (inside) {
+                renderer->updateHitTestResult(result, IntPoint(x - tx, y - ty));
+                return true;
+            }
+        }
+    }
+    
+    return false;
+}
+
+void RenderLineBoxList::dirtyLinesFromChangedChild(RenderObject* container, RenderObject* child)
+{
+    if (!container->parent() || (container->isRenderBlock() && (container->selfNeedsLayout() || !container->isBlockFlow())))
+        return;
+
+    // If we have no first line box, then just bail early.
+    if (!firstLineBox()) {
+        // For an empty inline, go ahead and propagate the check up to our parent, unless the parent
+        // is already dirty.
+        if (container->isInline() && !container->parent()->selfNeedsLayout())
+            container->parent()->dirtyLinesFromChangedChild(container);
+        return;
+    }
+
+    // Try to figure out which line box we belong in.  First try to find a previous
+    // line box by examining our siblings.  If we didn't find a line box, then use our 
+    // parent's first line box.
+    RootInlineBox* box = 0;
+    RenderObject* curr = 0;
+    for (curr = child->previousSibling(); curr; curr = curr->previousSibling()) {
+        if (curr->isFloatingOrPositioned())
+            continue;
+
+        if (curr->isReplaced()) {
+            InlineBox* wrapper = toRenderBox(curr)->inlineBoxWrapper();
+            if (wrapper)
+                box = wrapper->root();
+        } else if (curr->isText()) {
+            InlineTextBox* textBox = toRenderText(curr)->lastTextBox();
+            if (textBox)
+                box = textBox->root();
+        } else if (curr->isRenderInline()) {
+            InlineRunBox* runBox = toRenderInline(curr)->lastLineBox();
+            if (runBox)
+                box = runBox->root();
+        }
+
+        if (box)
+            break;
+    }
+    if (!box)
+        box = firstLineBox()->root();
+
+    // If we found a line box, then dirty it.
+    if (box) {
+        RootInlineBox* adjacentBox;
+        box->markDirty();
+
+        // dirty the adjacent lines that might be affected
+        // NOTE: we dirty the previous line because RootInlineBox objects cache
+        // the address of the first object on the next line after a BR, which we may be
+        // invalidating here.  For more info, see how RenderBlock::layoutInlineChildren
+        // calls setLineBreakInfo with the result of findNextLineBreak.  findNextLineBreak,
+        // despite the name, actually returns the first RenderObject after the BR.
+        // <rdar://problem/3849947> "Typing after pasting line does not appear until after window resize."
+        adjacentBox = box->prevRootBox();
+        if (adjacentBox)
+            adjacentBox->markDirty();
+        if (child->isBR() || (curr && curr->isBR())) {
+            adjacentBox = box->nextRootBox();
+            if (adjacentBox)
+                adjacentBox->markDirty();
+        }
+    }
+}
+
+#ifndef NDEBUG
+
+void RenderLineBoxList::checkConsistency() const
+{
+#ifdef CHECK_CONSISTENCY
+    const InlineFlowBox* prev = 0;
+    for (const InlineFlowBox* child = m_firstLineBox; child != 0; child = child->nextFlowBox()) {
+        ASSERT(child->prevFlowBox() == prev);
+        prev = child;
+    }
+    ASSERT(prev == m_lastLineBox);
+#endif
+}
+
+#endif
+
+}
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.h b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.h
new file mode 100644
index 0000000000..52d7542352
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef RenderLineBoxList_h
+#define RenderLineBoxList_h
+
+#include "RenderBox.h"
+
+namespace WebCore {
+
+class RenderLineBoxList {
+public:
+    RenderLineBoxList()
+        : m_firstLineBox(0)
+        , m_lastLineBox(0)
+    {
+    }
+
+#ifndef NDEBUG
+    ~RenderLineBoxList();
+#endif
+
+    InlineFlowBox* firstLineBox() const { return m_firstLineBox; }
+    InlineFlowBox* lastLineBox() const { return m_lastLineBox; }
+
+    void checkConsistency() const;
+
+    void appendLineBox(InlineFlowBox*);
+
+    void deleteLineBoxTree(RenderArena*);
+    void deleteLineBoxes(RenderArena*);
+
+    void extractLineBox(InlineFlowBox*);
+    void attachLineBox(InlineFlowBox*);
+    void removeLineBox(InlineFlowBox*);
+    
+    void dirtyLineBoxes();
+    void dirtyLinesFromChangedChild(RenderObject* parent, RenderObject* child);
+
+    void paint(RenderBoxModelObject*, RenderObject::PaintInfo&, int x, int y) const;
+    bool hitTest(RenderBoxModelObject*, const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction) const;
+    
+private:
+    // For block flows, each box represents the root inline box for a line in the
+    // paragraph.
+    // For inline flows, each box represents a portion of that inline.
+    InlineFlowBox* m_firstLineBox;
+    InlineFlowBox* m_lastLineBox;
+};
+
+
+#ifdef NDEBUG
+inline void RenderLineBoxList::checkConsistency() const
+{
+}
+#endif
+
+} // namespace WebCore
+
+#endif // RenderFlow_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
index 35b9451495..83c569ece9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
@@ -2,6 +2,7 @@
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *               2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,15 +42,15 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
-#include "HTMLOptGroupElement.h"
-#include "HTMLOptionElement.h"
-#include "HTMLSelectElement.h"
 #include "HitTestResult.h"
+#include "OptionGroupElement.h"
+#include "OptionElement.h"
 #include "Page.h"
 #include "RenderScrollbar.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Scrollbar.h"
+#include "SelectElement.h"
 #include "SelectionController.h"
 #include "NodeRenderStyle.h"
 #include <math.h>
@@ -71,7 +72,7 @@ const int maxDefaultSize = 10;
 // widget, but I'm not sure this is right for the new control.
 const int baselineAdjustment = 7;
 
-RenderListBox::RenderListBox(HTMLSelectElement* element)
+RenderListBox::RenderListBox(Element* element)
     : RenderBlock(element)
     , m_optionsChanged(true)
     , m_scrollToRevealSelectionAfterLayout(false)
@@ -86,7 +87,7 @@ RenderListBox::~RenderListBox()
     setHasVerticalScrollbar(false);
 }
 
-void RenderListBox::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderListBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
     setReplaced(isInline());
@@ -95,18 +96,18 @@ void RenderListBox::styleDidChange(RenderStyle::Diff diff, const RenderStyle* ol
 void RenderListBox::updateFromElement()
 {
     if (m_optionsChanged) {
-        const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(node())->listItems();
+        const Vector<Element*>& listItems = toSelectElement(static_cast<Element*>(node()))->listItems();
         int size = numItems();
         
         float width = 0;
         for (int i = 0; i < size; ++i) {
-            HTMLElement* element = listItems[i];
+            Element* element = listItems[i];
             String text;
             Font itemFont = style()->font();
-            if (element->hasTagName(optionTag))
-                text = static_cast<HTMLOptionElement*>(element)->optionText();
-            else if (element->hasTagName(optgroupTag)) {
-                text = static_cast<HTMLOptGroupElement*>(element)->groupLabelText();
+            if (OptionElement* optionElement = toOptionElement(element))
+                text = optionElement->textIndentedToRespectGroupLabel();
+            else if (OptionGroupElement* optionGroupElement = toOptionGroupElement(element)) {
+                text = optionGroupElement->groupLabelText();
                 FontDescription d = itemFont.fontDescription();
                 d.setWeight(d.bolderWeight());
                 itemFont = Font(d, itemFont.letterSpacing(), itemFont.wordSpacing());
@@ -150,7 +151,7 @@ void RenderListBox::layout()
 
 void RenderListBox::scrollToRevealSelection()
 {    
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
 
     m_scrollToRevealSelectionAfterLayout = false;
 
@@ -196,7 +197,7 @@ void RenderListBox::calcPrefWidths()
 
 int RenderListBox::size() const
 {
-    int specifiedSize = static_cast<HTMLSelectElement*>(node())->size();
+    int specifiedSize = toSelectElement(static_cast<Element*>(node()))->size();
     if (specifiedSize > 1)
         return max(minSize, specifiedSize);
     return min(max(minSize, numItems()), maxDefaultSize);
@@ -210,7 +211,7 @@ int RenderListBox::numVisibleItems() const
 
 int RenderListBox::numItems() const
 {
-    return static_cast<HTMLSelectElement*>(node())->listItems().size();
+    return toSelectElement(static_cast<Element*>(node()))->listItems().size();
 }
 
 int RenderListBox::listHeight() const
@@ -223,7 +224,7 @@ void RenderListBox::calcHeight()
     int toAdd = paddingTop() + paddingBottom() + borderTop() + borderBottom();
  
     int itemHeight = RenderListBox::itemHeight();
-    m_height = itemHeight * size() - rowSpacing + toAdd;
+    setHeight(itemHeight * size() - rowSpacing + toAdd);
     
     RenderBlock::calcHeight();
     
@@ -292,16 +293,17 @@ void RenderListBox::paintScrollbar(PaintInfo& paintInfo, int tx, int ty)
 
 void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, int listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    const Vector<HTMLElement*>& listItems = select->listItems();
-    HTMLElement* element = listItems[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    const Vector<Element*>& listItems = select->listItems();
+    Element* element = listItems[listIndex];
+    OptionElement* optionElement = toOptionElement(element);
 
     String itemText;
-    if (element->hasTagName(optionTag))
-        itemText = static_cast<HTMLOptionElement*>(element)->optionText();
-    else if (element->hasTagName(optgroupTag))
-        itemText = static_cast<HTMLOptGroupElement*>(element)->groupLabelText();
-       
+    if (optionElement)
+        itemText = optionElement->textIndentedToRespectGroupLabel();
+    else if (OptionGroupElement* optionGroupElement = toOptionGroupElement(element))
+        itemText = optionGroupElement->groupLabelText();      
+
     // Determine where the item text should be placed
     IntRect r = itemBoundingBoxRect(tx, ty, listIndex);
     r.move(optionsSpacingHorizontal, style()->font().ascent());
@@ -311,7 +313,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
         itemStyle = style();
     
     Color textColor = element->renderStyle() ? element->renderStyle()->color() : style()->color();
-    if (element->hasTagName(optionTag) && static_cast<HTMLOptionElement*>(element)->selected()) {
+    if (optionElement && optionElement->selected()) {
         if (document()->frame()->selection()->isFocusedAndActive() && document()->focusedNode() == node())
             textColor = theme()->activeListBoxSelectionForegroundColor();
         // Honor the foreground color for disabled items
@@ -322,31 +324,31 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
     paintInfo.context->setFillColor(textColor);
 
     Font itemFont = style()->font();
-    if (element->hasTagName(optgroupTag)) {
+    if (isOptionGroupElement(element)) {
         FontDescription d = itemFont.fontDescription();
         d.setWeight(d.bolderWeight());
         itemFont = Font(d, itemFont.letterSpacing(), itemFont.wordSpacing());
         itemFont.update(document()->styleSelector()->fontSelector());
     }
-    paintInfo.context->setFont(itemFont);
-    
+
     unsigned length = itemText.length();
     const UChar* string = itemText.characters();
     TextRun textRun(string, length, 0, 0, 0, itemStyle->direction() == RTL, itemStyle->unicodeBidi() == Override, false, false);
 
     // Draw the item text
     if (itemStyle->visibility() != HIDDEN)
-        paintInfo.context->drawBidiText(textRun, r.location());
+        paintInfo.context->drawBidiText(itemFont, textRun, r.location());
 }
 
 void RenderListBox::paintItemBackground(PaintInfo& paintInfo, int tx, int ty, int listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    const Vector<HTMLElement*>& listItems = select->listItems();
-    HTMLElement* element = listItems[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    const Vector<Element*>& listItems = select->listItems();
+    Element* element = listItems[listIndex];
+    OptionElement* optionElement = toOptionElement(element);
 
     Color backColor;
-    if (element->hasTagName(optionTag) && static_cast<HTMLOptionElement*>(element)->selected()) {
+    if (optionElement && optionElement->selected()) {
         if (document()->frame()->selection()->isFocusedAndActive() && document()->focusedNode() == node())
             backColor = theme()->activeListBoxSelectionBackgroundColor();
         else
@@ -368,9 +370,9 @@ bool RenderListBox::isPointInOverflowControl(HitTestResult& result, int _x, int
         return false;
 
     IntRect vertRect(_tx + width() - borderRight() - m_vBar->width(),
-                   _ty + borderTop() - borderTopExtra(),
-                   m_vBar->width(),
-                   height() + borderTopExtra() + borderBottomExtra() - borderTop() - borderBottom());
+                     _ty,
+                     m_vBar->width(),
+                     height() - borderTop() - borderBottom());
 
     if (vertRect.contains(_x, _y)) {
         result.setScrollbar(m_vBar.get());
@@ -436,7 +438,7 @@ void RenderListBox::panScroll(const IntPoint& panStartMousePosition)
         return;
 
     m_inAutoscroll = true;
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     select->updateListBoxSelection(!select->multiple());
     m_inAutoscroll = false;
 }
@@ -466,7 +468,7 @@ void RenderListBox::autoscroll()
 
     int endIndex = scrollToward(pos);
     if (endIndex >= 0) {
-        HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+        SelectElement* select = toSelectElement(static_cast<Element*>(node()));
         m_inAutoscroll = true;
 
         if (!select->multiple())
@@ -480,7 +482,7 @@ void RenderListBox::autoscroll()
 
 void RenderListBox::stopAutoscroll()
 {
-    static_cast<HTMLSelectElement*>(node())->listBoxOnChange();
+    toSelectElement(static_cast<Element*>(node()))->listBoxOnChange();
 }
 
 bool RenderListBox::scrollToRevealElementAtListIndex(int index)
@@ -513,9 +515,10 @@ bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granular
 
 void RenderListBox::valueChanged(unsigned listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    Element* element = static_cast<Element*>(node());
+    SelectElement* select = toSelectElement(element);
     select->setSelectedIndex(select->listToOptionIndex(listIndex));
-    select->onChange();
+    element->dispatchFormControlChangeEvent();
 }
 
 void RenderListBox::valueChanged(Scrollbar*)
@@ -525,7 +528,7 @@ void RenderListBox::valueChanged(Scrollbar*)
         m_indexOffset = newOffset;
         repaint();
         // Fire the scroll DOM event.
-        EventTargetNodeCast(node())->dispatchEventForType(eventNames().scrollEvent, false, false);
+        node()->dispatchEvent(eventNames().scrollEvent, false, false);
     }
 }
 
@@ -577,9 +580,32 @@ void RenderListBox::setScrollTop(int newTop)
         m_vBar->setValue(index);
 }
 
+bool RenderListBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
+{
+    if (!RenderBlock::nodeAtPoint(request, result, x, y, tx, ty, hitTestAction))
+        return false;
+    const Vector<Element*>& listItems = toSelectElement(static_cast<Element*>(node()))->listItems();
+    int size = numItems();
+    tx += this->x();
+    ty += this->y();
+    for (int i = 0; i < size; ++i) {
+        if (itemBoundingBoxRect(tx, ty, i).contains(x, y)) {
+            if (Element* node = listItems[i]) {
+                result.setInnerNode(node);
+                if (!result.innerNonSharedNode())
+                    result.setInnerNonSharedNode(node);
+                result.setLocalPoint(IntPoint(x - tx, y - ty));
+                break;
+            }
+        }
+    }
+
+    return true;
+}
+
 IntRect RenderListBox::controlClipRect(int tx, int ty) const
 {
-    IntRect clipRect = contentBox();
+    IntRect clipRect = contentBoxRect();
     clipRect.move(tx, ty);
     return clipRect;
 }
@@ -597,21 +623,14 @@ void RenderListBox::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect&
     repaintRectangle(scrollRect);
 }
 
-bool RenderListBox::isScrollable() const
-{
-    if (numVisibleItems() < numItems())
-        return true;
-    return RenderObject::isScrollable();
-}
-
 PassRefPtr<Scrollbar> RenderListBox::createScrollbar()
 {
     RefPtr<Scrollbar> widget;
-    bool hasCustomScrollbarStyle = style()->hasPseudoStyle(RenderStyle::SCROLLBAR);
+    bool hasCustomScrollbarStyle = style()->hasPseudoStyle(SCROLLBAR);
     if (hasCustomScrollbarStyle)
         widget = RenderScrollbar::createCustomScrollbar(this, VerticalScrollbar, this);
     else
-        widget = Scrollbar::createNativeScrollbar(this, VerticalScrollbar, SmallScrollbar);
+        widget = Scrollbar::createNativeScrollbar(this, VerticalScrollbar, theme()->scrollbarControlSizeForPart(ListboxPart));
     document()->view()->addChild(widget.get());        
     return widget.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
index ccc684779d..b8c0540926 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
@@ -36,11 +36,9 @@
 
 namespace WebCore {
 
-class HTMLSelectElement;
-
 class RenderListBox : public RenderBlock, private ScrollbarClient {
 public:
-    RenderListBox(HTMLSelectElement*);
+    RenderListBox(Element*);
     ~RenderListBox();
 
     virtual const char* renderName() const { return "RenderListBox"; }
@@ -58,7 +56,6 @@ public:
     virtual bool isPointInOverflowControl(HitTestResult&, int x, int y, int tx, int ty);
 
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
-    virtual bool isScrollable() const;
 
     virtual void calcPrefWidths();
     virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
@@ -93,8 +90,10 @@ public:
     virtual void setScrollLeft(int);
     virtual void setScrollTop(int);
 
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
     // ScrollbarClient interface.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
index f88f131e1a..fb965d2cc9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
@@ -49,7 +49,7 @@ RenderListItem::RenderListItem(Node* node)
     setInline(false);
 }
 
-void RenderListItem::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderListItem::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
@@ -144,7 +144,7 @@ static RenderObject* getParentOfFirstLineBox(RenderBlock* curr, RenderObject* ma
         if (currChild == marker)
             continue;
 
-        if (currChild->isInline() && (!currChild->isInlineFlow() || curr->generatesLineBoxesForInlineChild(currChild)))
+        if (currChild->isInline() && (!currChild->isRenderInline() || curr->generatesLineBoxesForInlineChild(currChild)))
             return curr;
 
         if (currChild->isFloating() || currChild->isPositioned())
@@ -153,11 +153,11 @@ static RenderObject* getParentOfFirstLineBox(RenderBlock* curr, RenderObject* ma
         if (currChild->isTable() || !currChild->isRenderBlock())
             break;
 
-        if (curr->isListItem() && currChild->style()->htmlHacks() && currChild->element() &&
-            (currChild->element()->hasTagName(ulTag)|| currChild->element()->hasTagName(olTag)))
+        if (curr->isListItem() && currChild->style()->htmlHacks() && currChild->node() &&
+            (currChild->node()->hasTagName(ulTag)|| currChild->node()->hasTagName(olTag)))
             break;
 
-        RenderObject* lineBox = getParentOfFirstLineBox(static_cast<RenderBlock*>(currChild), marker);
+        RenderObject* lineBox = getParentOfFirstLineBox(toRenderBlock(currChild), marker);
         if (lineBox)
             return lineBox;
     }
@@ -235,12 +235,12 @@ void RenderListItem::layout()
 void RenderListItem::positionListMarker()
 {
     if (m_marker && !m_marker->isInside() && m_marker->inlineBoxWrapper()) {
-        int markerOldX = m_marker->xPos();
+        int markerOldX = m_marker->x();
         int yOffset = 0;
         int xOffset = 0;
-        for (RenderObject* o = m_marker->parent(); o != this; o = o->parent()) {
-            yOffset += o->yPos();
-            xOffset += o->xPos();
+        for (RenderBox* o = m_marker->parentBox(); o != this; o = o->parentBox()) {
+            yOffset += o->y();
+            xOffset += o->x();
         }
 
         bool adjustOverflow = false;
@@ -248,7 +248,7 @@ void RenderListItem::positionListMarker()
         RootInlineBox* root = m_marker->inlineBoxWrapper()->root();
 
         if (style()->direction() == LTR) {
-            int leftLineOffset = leftRelOffset(yOffset, leftOffset(yOffset));
+            int leftLineOffset = leftRelOffset(yOffset, leftOffset(yOffset, false), false);
             markerXPos = leftLineOffset - xOffset - paddingLeft() - borderLeft() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
             if (markerXPos < root->leftOverflow()) {
@@ -256,7 +256,7 @@ void RenderListItem::positionListMarker()
                 adjustOverflow = true;
             }
         } else {
-            int rightLineOffset = rightRelOffset(yOffset, rightOffset(yOffset));
+            int rightLineOffset = rightRelOffset(yOffset, rightOffset(yOffset, false), false);
             markerXPos = rightLineOffset - xOffset + paddingRight() + borderRight() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
             if (markerXPos + m_marker->width() > root->rightOverflow()) {
@@ -267,12 +267,12 @@ void RenderListItem::positionListMarker()
 
         if (adjustOverflow) {
             IntRect markerRect(markerXPos + xOffset, yOffset, m_marker->width(), m_marker->height());
-            RenderObject* o = m_marker;
+            RenderBox* o = m_marker;
             do {
-                o = o->parent();
+                o = o->parentBox();
                 if (o->isRenderBlock())
-                    static_cast<RenderBlock*>(o)->addVisualOverflow(markerRect);
-                markerRect.move(-o->xPos(), -o->yPos());
+                    toRenderBlock(o)->addVisualOverflow(markerRect);
+                markerRect.move(-o->x(), -o->y());
             } while (o != this);
         }
     }
@@ -280,7 +280,7 @@ void RenderListItem::positionListMarker()
 
 void RenderListItem::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!m_height)
+    if (!height())
         return;
 
     RenderBlock::paint(paintInfo, tx, ty);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
index d4dd675e3d..91844f7165 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
@@ -61,7 +61,7 @@ public:
     const String& markerText() const;
 
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
     void updateMarkerLocation();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
index 4209906682..9627711780 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
@@ -28,7 +28,6 @@
 #include "CharacterNames.h"
 #include "Document.h"
 #include "GraphicsContext.h"
-#include "ListMarkerBox.h"
 #include "RenderLayer.h"
 #include "RenderListItem.h"
 #include "RenderView.h"
@@ -159,7 +158,7 @@ static int toArmenianUnder10000(int number, bool upper, bool addCircumflex, UCha
 
     int lowerOffset = upper ? 0 : 0x0030;
 
-    if (int thousands = number / 1000)
+    if (int thousands = number / 1000) {
         if (thousands == 7) {
             letters[length++] = 0x0548 + lowerOffset;
             letters[length++] = 0x0552 + lowerOffset;
@@ -170,6 +169,7 @@ static int toArmenianUnder10000(int number, bool upper, bool addCircumflex, UCha
             if (addCircumflex)
                 letters[length++] = 0x0302;
         }
+    }
 
     if (int hundreds = (number / 100) % 10) {
         letters[length++] = (0x0543 - 1 + lowerOffset) + hundreds;
@@ -472,7 +472,6 @@ String listMarkerText(EListStyleType type, int value)
 RenderListMarker::RenderListMarker(RenderListItem* item)
     : RenderBox(item->document())
     , m_listItem(item)
-    , m_selectionState(SelectionNone)
 {
     // init RenderObject attributes
     setInline(true);   // our object is Inline
@@ -485,7 +484,7 @@ RenderListMarker::~RenderListMarker()
         m_image->removeClient(this);
 }
 
-void RenderListMarker::styleWillChange(RenderStyle::Diff diff, const RenderStyle* newStyle)
+void RenderListMarker::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     if (style() && (newStyle->listStylePosition() != style()->listStylePosition() || newStyle->listStyleType() != style()->listStyleType()))
         setNeedsLayoutAndPrefWidthsRecalc();
@@ -493,7 +492,7 @@ void RenderListMarker::styleWillChange(RenderStyle::Diff diff, const RenderStyle
     RenderBox::styleWillChange(diff, newStyle);
 }
 
-void RenderListMarker::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderListMarker::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBox::styleDidChange(diff, oldStyle);
 
@@ -506,12 +505,11 @@ void RenderListMarker::styleDidChange(RenderStyle::Diff diff, const RenderStyle*
     }
 }
 
-InlineBox* RenderListMarker::createInlineBox(bool, bool isRootLineBox, bool)
+InlineBox* RenderListMarker::createInlineBox()
 {
-    ASSERT(!isRootLineBox);
-    ListMarkerBox* box = new (renderArena()) ListMarkerBox(this);
-    m_inlineBoxWrapper = box;
-    return box;
+    InlineBox* result = RenderBox::createInlineBox();
+    result->setIsText(isText());
+    return result;
 }
 
 bool RenderListMarker::isImage() const
@@ -530,7 +528,7 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
     IntRect marker = getRelativeMarkerRect();
     marker.move(tx, ty);
 
-    IntRect box(tx + m_x, ty + m_y, m_width, m_height);
+    IntRect box(tx + x(), ty + y(), width(), height());
 
     if (box.y() > paintInfo.rect.bottom() || box.y() + box.height() < paintInfo.rect.y())
         return;
@@ -539,7 +537,6 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
         paintBoxDecorations(paintInfo, box.x(), box.y());
 
     GraphicsContext* context = paintInfo.context;
-    context->setFont(style()->font());
 
     if (isImage()) {
 #if PLATFORM(MAC)
@@ -547,8 +544,10 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
             paintCustomHighlight(tx, ty, style()->highlight(), true);
 #endif
         context->drawImage(m_image->image(this, marker.size()), marker.location());
-        if (selectionState() != SelectionNone)
+        if (selectionState() != SelectionNone) {
+            // FIXME: selectionRect() is in absolute, not painting coordinates.
             context->fillRect(selectionRect(), selectionBackgroundColor());
+        }
         return;
     }
 
@@ -558,8 +557,10 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
         paintCustomHighlight(tx, ty, style()->highlight(), true);
 #endif
 
-    if (selectionState() != SelectionNone)
+    if (selectionState() != SelectionNone) {
+        // FIXME: selectionRect() is in absolute, not painting coordinates.
         context->fillRect(selectionRect(), selectionBackgroundColor());
+    }
 
     const Color color(style()->color());
     context->setStrokeColor(color);
@@ -619,15 +620,15 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
     const Font& font = style()->font();
     if (style()->direction() == LTR) {
         int width = font.width(textRun);
-        context->drawText(textRun, marker.location());
+        context->drawText(style()->font(), textRun, marker.location());
         const UChar periodSpace[2] = { '.', ' ' };
-        context->drawText(TextRun(periodSpace, 2), marker.location() + IntSize(width, 0));
+        context->drawText(style()->font(), TextRun(periodSpace, 2), marker.location() + IntSize(width, 0));
     } else {
         const UChar spacePeriod[2] = { ' ', '.' };
         TextRun spacePeriodRun(spacePeriod, 2);
         int width = font.width(spacePeriodRun);
-        context->drawText(spacePeriodRun, marker.location());
-        context->drawText(textRun, marker.location() + IntSize(width, 0));
+        context->drawText(style()->font(), spacePeriodRun, marker.location());
+        context->drawText(style()->font(), textRun, marker.location() + IntSize(width, 0));
     }
 }
 
@@ -637,11 +638,11 @@ void RenderListMarker::layout()
     ASSERT(!prefWidthsDirty());
 
     if (isImage()) {
-        m_width = m_image->imageSize(this, style()->effectiveZoom()).width();
-        m_height = m_image->imageSize(this, style()->effectiveZoom()).height();
+        setWidth(m_image->imageSize(this, style()->effectiveZoom()).width());
+        setHeight(m_image->imageSize(this, style()->effectiveZoom()).height());
     } else {
-        m_width = minPrefWidth();
-        m_height = style()->font().height();
+        setWidth(minPrefWidth());
+        setHeight(style()->font().height());
     }
 
     m_marginLeft = m_marginRight = 0;
@@ -662,7 +663,7 @@ void RenderListMarker::imageChanged(WrappedImagePtr o, const IntRect*)
     if (o != m_image->data())
         return;
 
-    if (m_width != m_image->imageSize(this, style()->effectiveZoom()).width() || m_height != m_image->imageSize(this, style()->effectiveZoom()).height() || m_image->errorOccurred())
+    if (width() != m_image->imageSize(this, style()->effectiveZoom()).width() || height() != m_image->imageSize(this, style()->effectiveZoom()).height() || m_image->errorOccurred())
         setNeedsLayoutAndPrefWidthsRecalc();
     else
         repaint();
@@ -830,7 +831,7 @@ bool RenderListMarker::isInside() const
 IntRect RenderListMarker::getRelativeMarkerRect()
 {
     if (isImage())
-        return IntRect(m_x, m_y, m_image->imageSize(this, style()->effectiveZoom()).width(), m_image->imageSize(this, style()->effectiveZoom()).height());
+        return IntRect(x(), y(), m_image->imageSize(this, style()->effectiveZoom()).width(), m_image->imageSize(this, style()->effectiveZoom()).height());
 
     switch (style()->listStyleType()) {
         case DISC:
@@ -840,7 +841,7 @@ IntRect RenderListMarker::getRelativeMarkerRect()
             const Font& font = style()->font();
             int ascent = font.ascent();
             int bulletWidth = (ascent * 2 / 3 + 1) / 2;
-            return IntRect(m_x + 1, m_y + 3 * (ascent - ascent * 2 / 3) / 2, bulletWidth, bulletWidth);
+            return IntRect(x() + 1, y() + 3 * (ascent - ascent * 2 / 3) / 2, bulletWidth, bulletWidth);
         }
         case LNONE:
             return IntRect();
@@ -867,7 +868,7 @@ IntRect RenderListMarker::getRelativeMarkerRect()
             int itemWidth = font.width(m_text);
             const UChar periodSpace[2] = { '.', ' ' };
             int periodSpaceWidth = font.width(TextRun(periodSpace, 2));
-            return IntRect(m_x, m_y + font.ascent(), itemWidth + periodSpaceWidth, font.height());
+            return IntRect(x(), y() + font.ascent(), itemWidth + periodSpaceWidth, font.height());
     }
 
     return IntRect();
@@ -875,14 +876,14 @@ IntRect RenderListMarker::getRelativeMarkerRect()
 
 void RenderListMarker::setSelectionState(SelectionState state)
 {
-    m_selectionState = state;
+    RenderBox::setSelectionState(state);
     if (InlineBox* box = inlineBoxWrapper())
         if (RootInlineBox* root = box->root())
             root->setHasSelectedChildren(state != SelectionNone);
     containingBlock()->setSelectionState(state);
 }
 
-IntRect RenderListMarker::selectionRect(bool clipToVisibleContent)
+IntRect RenderListMarker::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent)
 {
     ASSERT(!needsLayout());
 
@@ -890,14 +891,12 @@ IntRect RenderListMarker::selectionRect(bool clipToVisibleContent)
         return IntRect();
 
     RootInlineBox* root = inlineBoxWrapper()->root();
-    IntRect rect(0, root->selectionTop() - yPos(), width(), root->selectionHeight());
+    IntRect rect(0, root->selectionTop() - y(), width(), root->selectionHeight());
             
     if (clipToVisibleContent)
-        computeAbsoluteRepaintRect(rect);
-    else {
-        FloatPoint absPos = localToAbsolute();
-        rect.move(absPos.x(), absPos.y());
-    }
+        computeRectForRepaint(repaintContainer, rect);
+    else
+        rect = localToContainerQuad(FloatRect(rect), repaintContainer).enclosingBoundingBox();
     
     return rect;
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
index 738427cae3..57580a87b8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
@@ -49,7 +49,7 @@ public:
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
-    virtual InlineBox* createInlineBox(bool, bool, bool);
+    virtual InlineBox* createInlineBox();
 
     virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
@@ -60,16 +60,15 @@ public:
 
     bool isInside() const;
 
-    virtual SelectionState selectionState() const { return m_selectionState; }
     virtual void setSelectionState(SelectionState);
-    virtual IntRect selectionRect(bool clipToVisibleContent = true);
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
     virtual bool canBeSelectionLeaf() const { return true; }
 
     void updateMargins();
 
 protected:
-    virtual void styleWillChange(RenderStyle::Diff, const RenderStyle* newStyle);
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
     IntRect getRelativeMarkerRect();
@@ -77,7 +76,6 @@ private:
     String m_text;
     RefPtr<StyleImage> m_image;
     RenderListItem* m_listItem;
-    SelectionState m_selectionState;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp
index 96d26ea08a..48659f7061 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp
@@ -68,9 +68,9 @@ RenderMarquee::RenderMarquee(RenderLayer* l)
 int RenderMarquee::marqueeSpeed() const
 {
     int result = m_layer->renderer()->style()->marqueeSpeed();
-    Node* elt = m_layer->renderer()->element();
-    if (elt && elt->hasTagName(marqueeTag)) {
-        HTMLMarqueeElement* marqueeElt = static_cast<HTMLMarqueeElement*>(elt);
+    Node* n = m_layer->renderer()->node();
+    if (n && n->hasTagName(marqueeTag)) {
+        HTMLMarqueeElement* marqueeElt = static_cast<HTMLMarqueeElement*>(n);
         result = max(result, marqueeElt->minimumDelay());
     }
     return result;
@@ -105,17 +105,18 @@ bool RenderMarquee::isHorizontal() const
 
 int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge)
 {
-    RenderObject* o = m_layer->renderer();
-    RenderStyle* s = o->style();
+    RenderBox* box = m_layer->renderBox();
+    ASSERT(box);
+    RenderStyle* s = box->style();
     if (isHorizontal()) {
         bool ltr = s->direction() == LTR;
-        int clientWidth = o->clientWidth();
-        int contentWidth = ltr ? o->rightmostPosition(true, false) : o->leftmostPosition(true, false);
+        int clientWidth = box->clientWidth();
+        int contentWidth = ltr ? box->rightmostPosition(true, false) : box->leftmostPosition(true, false);
         if (ltr)
-            contentWidth += (o->paddingRight() - o->borderLeft());
+            contentWidth += (box->paddingRight() - box->borderLeft());
         else {
-            contentWidth = o->width() - contentWidth;
-            contentWidth += (o->paddingLeft() - o->borderRight());
+            contentWidth = box->width() - contentWidth;
+            contentWidth += (box->paddingLeft() - box->borderRight());
         }
         if (dir == MRIGHT) {
             if (stopAtContentEdge)
@@ -131,9 +132,9 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
         }
     }
     else {
-        int contentHeight = m_layer->renderer()->lowestPosition(true, false) - 
-                            m_layer->renderer()->borderTop() + m_layer->renderer()->paddingBottom();
-        int clientHeight = m_layer->renderer()->clientHeight();
+        int contentHeight = box->lowestPosition(true, false) - 
+                            box->borderTop() + box->paddingBottom();
+        int clientHeight = box->clientHeight();
         if (dir == MUP) {
             if (stopAtContentEdge)
                  return min(contentHeight - clientHeight, 0);
@@ -283,7 +284,7 @@ void RenderMarquee::timerFired(Timer<RenderMarquee>*)
             addIncrement = !addIncrement;
         }
         bool positive = range > 0;
-        int clientSize = (isHorizontal() ? m_layer->renderer()->clientWidth() : m_layer->renderer()->clientHeight());
+        int clientSize = (isHorizontal() ? m_layer->renderBox()->clientWidth() : m_layer->renderBox()->clientHeight());
         int increment = max(1, abs(m_layer->renderer()->style()->marqueeIncrement().calcValue(clientSize)));
         int currentPos = (isHorizontal() ? m_layer->scrollXOffset() : m_layer->scrollYOffset());
         newPos =  currentPos + (addIncrement ? increment : -increment);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h
index d9d20cd4b4..886c3431b1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.h
@@ -44,7 +44,8 @@
 #ifndef RenderMarquee_h
 #define RenderMarquee_h
 
-#include "RenderStyle.h"
+#include "Length.h"
+#include "RenderStyleConstants.h"
 #include "Timer.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
index a22413623a..2ffa2f6291 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,25 +28,20 @@
 #if ENABLE(VIDEO)
 #include "RenderMedia.h"
 
-#include "CSSStyleSelector.h"
-#include "Event.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
-#include "MediaPlayer.h"
-#include "RenderSlider.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
 using namespace std;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static const double cTimeUpdateRepeatDelay = 0.2;
 static const double cOpacityAnimationRepeatDelay = 0.05;
 // FIXME get this from style
@@ -82,8 +77,14 @@ RenderMedia::~RenderMedia()
 void RenderMedia::destroy()
 {
     if (m_controlsShadowRoot && m_controlsShadowRoot->renderer()) {
+
+        // detach the panel before removing the shadow renderer to prevent a crash in m_controlsShadowRoot->detach() 
+        //  when display: style changes
+        m_panel->detach();
+
         removeChild(m_controlsShadowRoot->renderer());
         m_controlsShadowRoot->detach();
+        m_controlsShadowRoot = 0;
     }
     RenderReplaced::destroy();
 }
@@ -98,18 +99,40 @@ MediaPlayer* RenderMedia::player() const
     return mediaElement()->player();
 }
 
+void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderReplaced::styleDidChange(diff, oldStyle);
+
+    if (m_controlsShadowRoot) {
+        if (m_panel->renderer())
+            m_panel->renderer()->setStyle(getCachedPseudoStyle(MEDIA_CONTROLS_PANEL));
+
+        if (m_timelineContainer->renderer())
+            m_timelineContainer->renderer()->setStyle(getCachedPseudoStyle(MEDIA_CONTROLS_TIMELINE_CONTAINER));
+        
+        m_muteButton->updateStyle();
+        m_playButton->updateStyle();
+        m_seekBackButton->updateStyle();
+        m_seekForwardButton->updateStyle();
+        m_timeline->updateStyle();
+        m_fullscreenButton->updateStyle();
+        m_currentTimeDisplay->updateStyle();
+        m_timeRemainingDisplay->updateStyle();
+    }
+}
+
 void RenderMedia::layout()
 {
-    IntSize oldSize = contentBox().size();
+    IntSize oldSize = contentBoxRect().size();
 
     RenderReplaced::layout();
 
-    RenderObject* controlsRenderer = m_controlsShadowRoot ? m_controlsShadowRoot->renderer() : 0;
+    RenderBox* controlsRenderer = m_controlsShadowRoot ? m_controlsShadowRoot->renderBox() : 0;
     if (!controlsRenderer)
         return;
-    IntSize newSize = contentBox().size();
+    IntSize newSize = contentBoxRect().size();
     if (newSize != oldSize || controlsRenderer->needsLayout()) {
-        controlsRenderer->setPos(borderLeft() + paddingLeft(), borderTop() + paddingTop());
+        controlsRenderer->setLocation(borderLeft() + paddingLeft(), borderTop() + paddingTop());
         controlsRenderer->style()->setHeight(Length(newSize.height(), Fixed));
         controlsRenderer->style()->setWidth(Length(newSize.width(), Fixed));
         controlsRenderer->setNeedsLayout(true, false);
@@ -118,34 +141,17 @@ void RenderMedia::layout()
     }
 }
 
-RenderObject* RenderMedia::firstChild() const 
-{ 
-    return m_controlsShadowRoot ? m_controlsShadowRoot->renderer() : 0; 
-}
-
-RenderObject* RenderMedia::lastChild() const 
-{ 
-    return m_controlsShadowRoot ? m_controlsShadowRoot->renderer() : 0;
-}
-    
-void RenderMedia::removeChild(RenderObject* child)
-{
-    ASSERT(m_controlsShadowRoot);
-    ASSERT(child == m_controlsShadowRoot->renderer());
-    child->removeLayers(enclosingLayer());
-    static_cast<RenderMediaControlShadowRoot*>(child)->setParent(0);
-}
-    
 void RenderMedia::createControlsShadowRoot()
 {
     ASSERT(!m_controlsShadowRoot);
     m_controlsShadowRoot = new MediaControlShadowRootElement(document(), mediaElement());
+    addChild(m_controlsShadowRoot->renderer());
 }
 
 void RenderMedia::createPanel()
 {
     ASSERT(!m_panel);
-    RenderStyle* style = getCachedPseudoStyle(RenderStyle::MEDIA_CONTROLS_PANEL);
+    RenderStyle* style = getCachedPseudoStyle(MEDIA_CONTROLS_PANEL);
     m_panel = new HTMLDivElement(HTMLNames::divTag, document());
     RenderObject* renderer = m_panel->createRenderer(renderArena(), style);
     if (renderer) {
@@ -186,27 +192,42 @@ void RenderMedia::createSeekForwardButton()
     m_seekForwardButton->attachToParent(m_panel.get());
 }
 
+void RenderMedia::createTimelineContainer()
+{
+    ASSERT(!m_timelineContainer);
+    RenderStyle* style = getCachedPseudoStyle(MEDIA_CONTROLS_TIMELINE_CONTAINER);
+    m_timelineContainer = new HTMLDivElement(HTMLNames::divTag, document());
+    RenderObject* renderer = m_timelineContainer->createRenderer(renderArena(), style);
+    if (renderer) {
+        m_timelineContainer->setRenderer(renderer);
+        renderer->setStyle(style);
+        m_timelineContainer->setAttached();
+        m_timelineContainer->setInDocument(true);
+        m_panel->addChild(m_timelineContainer);
+        m_panel->renderer()->addChild(renderer);
+    }
+}
+
 void RenderMedia::createTimeline()
 {
     ASSERT(!m_timeline);
     m_timeline = new MediaControlTimelineElement(document(), mediaElement());
-    m_timeline->attachToParent(m_panel.get());
+    m_timeline->setAttribute(precisionAttr, "float");
+    m_timeline->attachToParent(m_timelineContainer.get());
 }
   
-void RenderMedia::createTimeDisplay()
+void RenderMedia::createCurrentTimeDisplay()
 {
-    ASSERT(!m_timeDisplay);
-    RenderStyle* style = getCachedPseudoStyle(RenderStyle::MEDIA_CONTROLS_TIME_DISPLAY);
-    m_timeDisplay = new HTMLDivElement(HTMLNames::divTag, document());
-    RenderObject* renderer = m_timeDisplay->createRenderer(renderArena(), style);
-    if (renderer) {
-        m_timeDisplay->setRenderer(renderer);
-        renderer->setStyle(style);
-        m_timeDisplay->setAttached();
-        m_timeDisplay->setInDocument(true);
-        m_panel->addChild(m_timeDisplay);
-        m_panel->renderer()->addChild(renderer);
-    }
+    ASSERT(!m_currentTimeDisplay);
+    m_currentTimeDisplay = new MediaTimeDisplayElement(document(), mediaElement(), true);
+    m_currentTimeDisplay->attachToParent(m_timelineContainer.get());
+}
+
+void RenderMedia::createTimeRemainingDisplay()
+{
+    ASSERT(!m_timeRemainingDisplay);
+    m_timeRemainingDisplay = new MediaTimeDisplayElement(document(), mediaElement(), false);
+    m_timeRemainingDisplay->attachToParent(m_timelineContainer.get());
 }
 
 void RenderMedia::createFullscreenButton()
@@ -230,10 +251,12 @@ void RenderMedia::updateControls()
             m_panel = 0;
             m_muteButton = 0;
             m_playButton = 0;
+            m_timelineContainer = 0;
             m_timeline = 0;
             m_seekBackButton = 0;
             m_seekForwardButton = 0;
-            m_timeDisplay = 0;
+            m_currentTimeDisplay = 0;
+            m_timeRemainingDisplay = 0;
             m_fullscreenButton = 0;
             m_controlsShadowRoot = 0;
         }
@@ -248,17 +271,23 @@ void RenderMedia::updateControls()
         createPanel();
         createMuteButton();
         createPlayButton();
+        createTimelineContainer();
         createTimeline();
         createSeekBackButton();
         createSeekForwardButton();
-        createTimeDisplay();
+        createCurrentTimeDisplay();
+        createTimeRemainingDisplay();
         createFullscreenButton();
     }
-    
-    if (media->paused() || media->ended() || media->networkState() < HTMLMediaElement::LOADED_METADATA)
-        m_timeUpdateTimer.stop();
-    else
+
+    if (media->canPlay()) {
+        if (m_timeUpdateTimer.isActive())
+            m_timeUpdateTimer.stop();
+    } else if (style()->visibility() == VISIBLE && m_timeline && m_timeline->renderer() && m_timeline->renderer()->style()->display() != NONE ) {
         m_timeUpdateTimer.startRepeating(cTimeUpdateRepeatDelay);
+    }
+
+    m_previousVisible = style()->visibility();
     
     if (m_muteButton)
         m_muteButton->update();
@@ -287,32 +316,47 @@ String RenderMedia::formatTime(float time)
 {
     if (!isfinite(time))
         time = 0;
-    int seconds = (int)time; 
+    int seconds = (int)fabsf(time); 
     int hours = seconds / (60 * 60);
     int minutes = (seconds / 60) % 60;
     seconds %= 60;
-    return String::format("%02d:%02d:%02d", hours, minutes, seconds);
+    if (hours) {
+        if (hours > 9)
+            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+        else
+            return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+    }
+    else
+        return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
 }
 
 void RenderMedia::updateTimeDisplay()
 {
-    if (!m_timeDisplay)
+    if (!m_currentTimeDisplay || !m_currentTimeDisplay->renderer() || m_currentTimeDisplay->renderer()->style()->display() == NONE || style()->visibility() != VISIBLE)
         return;
-    String timeString = formatTime(mediaElement()->currentTime());
+    float now = mediaElement()->currentTime();
+    float duration = mediaElement()->duration();
+
+    String timeString = formatTime(now);
     ExceptionCode ec;
-    m_timeDisplay->setInnerText(timeString, ec);
-}
+    m_currentTimeDisplay->setInnerText(timeString, ec);
     
+    timeString = formatTime(now - duration);
+    m_timeRemainingDisplay->setInnerText(timeString, ec);
+}
+
 void RenderMedia::updateControlVisibility() 
 {
     if (!m_panel || !m_panel->renderer())
         return;
+
     // Don't fade for audio controls.
     HTMLMediaElement* media = mediaElement();
-    if (player() && !player()->hasVideo() || !media->isVideo())
+    if (!media->hasVideo())
         return;
+
     // do fading manually, css animations don't work well with shadow trees
-    bool visible = style()->visibility() == VISIBLE && (m_mouseOver || media->paused() || media->ended() || media->networkState() < HTMLMediaElement::LOADED_METADATA);
+    bool visible = style()->visibility() == VISIBLE && (m_mouseOver || media->canPlay());
     if (visible == (m_opacityAnimationTo > 0))
         return;
 
@@ -320,7 +364,7 @@ void RenderMedia::updateControlVisibility()
         // don't fade gradually if it the element has just changed visibility
         m_previousVisible = style()->visibility();
         m_opacityAnimationTo = m_previousVisible == VISIBLE ? 1.0f : 0;
-        changeOpacity(m_panel.get(), 0);
+        changeOpacity(m_panel.get(), m_opacityAnimationTo);
         return;
     }
 
@@ -361,7 +405,7 @@ void RenderMedia::forwardEvent(Event* event)
 {
     if (event->isMouseEvent() && m_controlsShadowRoot) {
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
-        IntPoint point(mouseEvent->pageX(), mouseEvent->pageY());
+        IntPoint point(mouseEvent->absoluteLocation());
         if (m_muteButton && m_muteButton->hitTest(point))
             m_muteButton->defaultEventHandler(event);
 
@@ -385,8 +429,10 @@ void RenderMedia::forwardEvent(Event* event)
             updateControlVisibility();
         }
         if (event->type() == eventNames().mouseoutEvent) {
-            // FIXME: moving over scrollbar thumb generates mouseout for the ancestor media element for some reason
-            m_mouseOver = absoluteBoundingBoxRect().contains(point);
+            // When the scrollbar thumb captures mouse events, we should treat the mouse as still being over our renderer if the new target is a descendant
+            Node* mouseOverNode = mouseEvent->relatedTarget() ? mouseEvent->relatedTarget()->toNode() : 0;
+            RenderObject* mouseOverRenderer = mouseOverNode ? mouseOverNode->renderer() : 0;
+            m_mouseOver = mouseOverRenderer && mouseOverRenderer->isDescendantOf(this);
             updateControlVisibility();
         }
     }
@@ -398,7 +444,7 @@ int RenderMedia::lowestPosition(bool includeOverflowInterior, bool includeSelf)
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return bottom;
     
-    return max(bottom,  m_controlsShadowRoot->renderer()->yPos() + m_controlsShadowRoot->renderer()->lowestPosition(includeOverflowInterior, includeSelf));
+    return max(bottom,  m_controlsShadowRoot->renderBox()->y() + m_controlsShadowRoot->renderBox()->lowestPosition(includeOverflowInterior, includeSelf));
 }
 
 int RenderMedia::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
@@ -407,7 +453,7 @@ int RenderMedia::rightmostPosition(bool includeOverflowInterior, bool includeSel
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return right;
     
-    return max(right, m_controlsShadowRoot->renderer()->xPos() + m_controlsShadowRoot->renderer()->rightmostPosition(includeOverflowInterior, includeSelf));
+    return max(right, m_controlsShadowRoot->renderBox()->x() + m_controlsShadowRoot->renderBox()->rightmostPosition(includeOverflowInterior, includeSelf));
 }
 
 int RenderMedia::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
@@ -416,7 +462,7 @@ int RenderMedia::leftmostPosition(bool includeOverflowInterior, bool includeSelf
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return left;
     
-    return min(left, m_controlsShadowRoot->renderer()->xPos() +  m_controlsShadowRoot->renderer()->leftmostPosition(includeOverflowInterior, includeSelf));
+    return min(left, m_controlsShadowRoot->renderBox()->x() +  m_controlsShadowRoot->renderBox()->leftmostPosition(includeOverflowInterior, includeSelf));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
index 8f48cafce0..6013d7b771 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
@@ -40,6 +40,7 @@ class MediaControlPlayButtonElement;
 class MediaControlSeekButtonElement;
 class MediaControlTimelineElement;
 class MediaControlFullscreenButtonElement;
+class MediaTimeDisplayElement;
 class MediaPlayer;
 
 class RenderMedia : public RenderReplaced {
@@ -48,9 +49,11 @@ public:
     RenderMedia(HTMLMediaElement*, const IntSize& intrinsicSize);
     virtual ~RenderMedia();
     
-    virtual RenderObject* firstChild() const;
-    virtual RenderObject* lastChild() const;
-    virtual void removeChild(RenderObject*);
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
     virtual void destroy();
     
     virtual void layout();
@@ -66,6 +69,7 @@ public:
     void updateFromElement();
     void updatePlayer();
     void updateControls();
+    void updateTimeDisplay();
     
     void forwardEvent(Event*);
 
@@ -75,22 +79,26 @@ public:
 
 private:
     void createControlsShadowRoot();
+    void destroyControlsShadowRoot();
     void createPanel();
     void createMuteButton();
     void createPlayButton();
     void createSeekBackButton();
     void createSeekForwardButton();
+    void createTimelineContainer();
     void createTimeline();
-    void createTimeDisplay();
+    void createCurrentTimeDisplay();
+    void createTimeRemainingDisplay();
     void createFullscreenButton();
     
     void timeUpdateTimerFired(Timer<RenderMedia>*);
-    void updateTimeDisplay();
     
     void updateControlVisibility();
     void changeOpacity(HTMLElement*, float opacity);
     void opacityAnimationTimerFired(Timer<RenderMedia>*);
 
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
     RefPtr<HTMLElement> m_controlsShadowRoot;
     RefPtr<HTMLElement> m_panel;
     RefPtr<MediaControlMuteButtonElement> m_muteButton;
@@ -99,9 +107,12 @@ private:
     RefPtr<MediaControlSeekButtonElement> m_seekForwardButton;
     RefPtr<MediaControlTimelineElement> m_timeline;
     RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
-    RefPtr<HTMLElement> m_timeDisplay;
-    EventTargetNode* m_lastUnderNode;
-    EventTargetNode* m_nodeUnderMouse;
+    RefPtr<HTMLElement> m_timelineContainer;
+    RefPtr<MediaTimeDisplayElement> m_currentTimeDisplay;
+    RefPtr<MediaTimeDisplayElement> m_timeRemainingDisplay;
+    RenderObjectChildList m_children;
+    Node* m_lastUnderNode;
+    Node* m_nodeUnderMouse;
     
     Timer<RenderMedia> m_timeUpdateTimer;
     Timer<RenderMedia> m_opacityAnimationTimer;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
new file mode 100644
index 0000000000..f1ff55fb0d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RenderMediaControls.h"
+
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "RenderThemeSafari.h"
+#include "SoftLinking.h"
+#include <CoreGraphics/CoreGraphics.h>
+ 
+using namespace std;
+ 
+namespace WebCore {
+
+#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
+#else
+SOFT_LINK_LIBRARY(SafariTheme)
+#endif
+
+SOFT_LINK(SafariTheme, paintThemePart, void, __stdcall, (ThemePart part, CGContextRef context, const CGRect& rect, NSControlSize size, ThemeControlState state), (part, context, rect, size, state))
+SOFT_LINK(SafariTheme, STPaintProgressIndicator, void, APIENTRY, (ProgressIndicatorType type, CGContextRef context, const CGRect& rect, NSControlSize size, ThemeControlState state, float value), (type, context, rect, size, state, value))
+
+#if ENABLE(VIDEO)
+
+static ThemeControlState determineState(RenderObject* o)
+{
+    ThemeControlState result = 0;
+    if (theme()->isActive(o))
+        result |= SafariTheme::ActiveState;
+    if (theme()->isEnabled(o) && !theme()->isReadOnlyControl(o))
+        result |= SafariTheme::EnabledState;
+    if (theme()->isPressed(o))
+        result |= SafariTheme::PressedState;
+    if (theme()->isChecked(o))
+        result |= SafariTheme::CheckedState;
+    if (theme()->isIndeterminate(o))
+        result |= SafariTheme::IndeterminateCheckedState;
+    if (theme()->isFocused(o))
+        result |= SafariTheme::FocusedState;
+    if (theme()->isDefault(o))
+        result |= SafariTheme::DefaultState;
+    return result;
+}
+
+static const int mediaSliderThumbWidth = 13;
+static const int mediaSliderThumbHeight = 14;
+
+void RenderMediaControls::adjustMediaSliderThumbSize(RenderObject* o)
+{
+    if (o->style()->appearance() != MediaSliderThumbPart)
+        return;
+
+    float zoomLevel = o->style()->effectiveZoom();
+    o->style()->setWidth(Length(static_cast<int>(mediaSliderThumbWidth * zoomLevel), Fixed));
+    o->style()->setHeight(Length(static_cast<int>(mediaSliderThumbHeight * zoomLevel), Fixed));
+}
+
+static HTMLMediaElement* parentMediaElement(RenderObject* o)
+{
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+
+bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    ASSERT(SafariThemeLibrary());
+
+    switch (part) {
+        case MediaFullscreenButton:
+            paintThemePart(SafariTheme::MediaFullscreenButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaMuteButton:
+        case MediaUnMuteButton:
+            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+                paintThemePart(mediaElement->muted() ? SafariTheme::MediaUnMuteButtonPart : SafariTheme::MediaMuteButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaPauseButton:
+        case MediaPlayButton:
+            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+                paintThemePart(mediaElement->canPlay() ? SafariTheme::MediaPlayButtonPart : SafariTheme::MediaPauseButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaSeekBackButton:
+            paintThemePart(SafariTheme::MediaSeekBackButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaSeekForwardButton:
+            paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaSlider: {
+            HTMLMediaElement* mediaElement = parentMediaElement(o);
+            if (!mediaElement)
+                break;
+
+            MediaPlayer* player = mediaElement->player();
+            float duration = player ? player->duration() : 0;
+            float percentLoaded = duration ? player->maxTimeBuffered() /duration : 0;
+
+            STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, percentLoaded);
+            break;
+        }
+        case MediaSliderThumb:
+            paintThemePart(SafariTheme::MediaSliderThumbPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaTimelineContainer:
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaCurrentTimeDisplay:
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaTimeRemainingDisplay:
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaControlsPanel:
+            ASSERT_NOT_REACHED();
+            break;
+    }
+    return false;
+}
+
+#endif  // #if ENABLE(VIDEO)
+
+} // namespace WebCore
+
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.h b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.h
new file mode 100644
index 0000000000..529dbac7ae
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RenderMediaControls_h
+#define RenderMediaControls_h
+
+#include "RenderObject.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+class HTMLMediaElement;
+class RenderMediaControls {
+public:
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static void adjustMediaSliderThumbSize(RenderObject*);
+};
+
+} // namespace WebCore
+
+#endif // RenderMediaControls_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
index baec309b7c..95de7a22c8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
@@ -1,7 +1,8 @@
-/**
+/*
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *               2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,20 +25,16 @@
 #include "RenderMenuList.h"
 
 #include "CSSStyleSelector.h"
-#include "Document.h"
-#include "FontSelector.h"
 #include "FrameView.h"
-#include "GraphicsContext.h"
 #include "HTMLNames.h"
-#include "HTMLOptionElement.h"
-#include "HTMLOptGroupElement.h"
-#include "HTMLSelectElement.h"
+#include "NodeRenderStyle.h"
+#include "OptionElement.h"
+#include "OptionGroupElement.h"
 #include "PopupMenu.h"
 #include "RenderBR.h"
 #include "RenderScrollbar.h"
-#include "RenderText.h"
 #include "RenderTheme.h"
-#include "NodeRenderStyle.h"
+#include "SelectElement.h"
 #include <math.h>
 
 using namespace std;
@@ -46,7 +43,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-RenderMenuList::RenderMenuList(HTMLSelectElement* element)
+RenderMenuList::RenderMenuList(Element* element)
     : RenderFlexibleBox(element)
     , m_buttonText(0)
     , m_innerBlock(0)
@@ -64,12 +61,6 @@ RenderMenuList::~RenderMenuList()
     m_popup = 0;
 }
 
-// this static cast is safe because RenderMenuLists are only created for HTMLSelectElements
-HTMLSelectElement* RenderMenuList::selectElement()
-{
-    return static_cast<HTMLSelectElement*>(node());
-}
-
 void RenderMenuList::createInnerBlock()
 {
     if (m_innerBlock) {
@@ -118,7 +109,7 @@ void RenderMenuList::removeChild(RenderObject* oldChild)
         m_innerBlock->removeChild(oldChild);
 }
 
-void RenderMenuList::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderMenuList::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
@@ -137,15 +128,25 @@ void RenderMenuList::styleDidChange(RenderStyle::Diff diff, const RenderStyle* o
 void RenderMenuList::updateOptionsWidth()
 {
     float maxOptionWidth = 0;
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(node())->listItems();
+    const Vector<Element*>& listItems = toSelectElement(static_cast<Element*>(node()))->listItems();
     int size = listItems.size();    
     for (int i = 0; i < size; ++i) {
-        HTMLElement* element = listItems[i];
-        if (element->hasTagName(optionTag)) {
-            String text = static_cast<HTMLOptionElement*>(element)->optionText();
+        Element* element = listItems[i];
+        OptionElement* optionElement = toOptionElement(element);
+        if (!optionElement)
+            continue;
+
+        String text = optionElement->textIndentedToRespectGroupLabel();
+        if (theme()->popupOptionSupportsTextIndent()) {
+            // Add in the option's text indent.  We can't calculate percentage values for now.
+            float optionWidth = 0;
+            if (RenderStyle* optionStyle = element->renderStyle())
+                optionWidth += optionStyle->textIndent().calcMinValue(0);
             if (!text.isEmpty())
-                maxOptionWidth = max(maxOptionWidth, style()->font().floatWidth(text));
-        }
+                optionWidth += style()->font().floatWidth(text);
+            maxOptionWidth = max(maxOptionWidth, optionWidth);
+        } else if (!text.isEmpty())
+            maxOptionWidth = max(maxOptionWidth, style()->font().floatWidth(text));
     }
 
     int width = static_cast<int>(ceilf(maxOptionWidth));
@@ -153,7 +154,8 @@ void RenderMenuList::updateOptionsWidth()
         return;
 
     m_optionsWidth = width;
-    setNeedsLayoutAndPrefWidthsRecalc();
+    if (parent())
+        setNeedsLayoutAndPrefWidthsRecalc();
 }
 
 void RenderMenuList::updateFromElement()
@@ -166,22 +168,22 @@ void RenderMenuList::updateFromElement()
     if (m_popupIsVisible)
         m_popup->updateFromElement();
     else
-        setTextFromOption(static_cast<HTMLSelectElement*>(node())->selectedIndex());
+        setTextFromOption(toSelectElement(static_cast<Element*>(node()))->selectedIndex());
 }
 
 void RenderMenuList::setTextFromOption(int optionIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    const Vector<HTMLElement*>& listItems = select->listItems();
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    const Vector<Element*>& listItems = select->listItems();
     int size = listItems.size();
 
     int i = select->optionToListIndex(optionIndex);
     String text = "";
     if (i >= 0 && i < size) {
-        HTMLElement* element = listItems[i];
-        if (element->hasTagName(optionTag))
-            text = static_cast<HTMLOptionElement*>(listItems[i])->optionText();
+        if (OptionElement* optionElement = toOptionElement(listItems[i]))
+            text = optionElement->textIndentedToRespectGroupLabel();
     }
+
     setText(text.stripWhiteSpace());
 }
 
@@ -224,8 +226,8 @@ IntRect RenderMenuList::controlClipRect(int tx, int ty) const
                    contentWidth(), 
                    contentHeight());
     
-    IntRect innerBox(tx + m_innerBlock->xPos() + m_innerBlock->paddingLeft(), 
-                   ty + m_innerBlock->yPos() + m_innerBlock->paddingTop(),
+    IntRect innerBox(tx + m_innerBlock->x() + m_innerBlock->paddingLeft(), 
+                   ty + m_innerBlock->y() + m_innerBlock->paddingTop(),
                    m_innerBlock->contentWidth(), 
                    m_innerBlock->contentHeight());
 
@@ -273,7 +275,7 @@ void RenderMenuList::showPopup()
     createInnerBlock();
     if (!m_popup)
         m_popup = PopupMenu::create(this);
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     m_popupIsVisible = true;
 
     // Compute the top left taking transforms into account, but use
@@ -294,46 +296,52 @@ void RenderMenuList::hidePopup()
 
 void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     select->setSelectedIndex(select->listToOptionIndex(listIndex), true, fireOnChange);
 }
 
 String RenderMenuList::itemText(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
-    if (element->hasTagName(optgroupTag))
-        return static_cast<HTMLOptGroupElement*>(element)->groupLabelText();
-    else if (element->hasTagName(optionTag))
-        return static_cast<HTMLOptionElement*>(element)->optionText();
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
+    if (OptionGroupElement* optionGroupElement = toOptionGroupElement(element))
+        return optionGroupElement->groupLabelText();
+    else if (OptionElement* optionElement = toOptionElement(element))
+        return optionElement->textIndentedToRespectGroupLabel();
     return String();
 }
 
 bool RenderMenuList::itemIsEnabled(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
-    if (!element->hasTagName(optionTag))
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
+    if (!isOptionElement(element))
         return false;
+
     bool groupEnabled = true;
-    if (element->parentNode() && element->parentNode()->hasTagName(optgroupTag))
-        groupEnabled = element->parentNode()->isEnabled();
-    return element->isEnabled() && groupEnabled;
+    if (Element* parentElement = element->parentElement()) {
+        if (isOptionGroupElement(parentElement))
+            groupEnabled = parentElement->isEnabledFormControl();
+    }
+    if (!groupEnabled)
+        return false;
+
+    return element->isEnabledFormControl();
 }
 
 PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
     
     RenderStyle* style = element->renderStyle() ? element->renderStyle() : element->computedStyle();
-    return style ? PopupMenuStyle(style->color(), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE) : menuStyle();
+    return style ? PopupMenuStyle(style->color(), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE, style->textIndent(), style->direction()) : menuStyle();
 }
 
 Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
 
     Color backgroundColor;
     if (element->renderStyle())
@@ -355,7 +363,7 @@ PopupMenuStyle RenderMenuList::menuStyle() const
 {
 
     RenderStyle* s = m_innerBlock ? m_innerBlock->style() : style();
-    return PopupMenuStyle(s->color(), s->backgroundColor(), s->font(), s->visibility() == VISIBLE);
+    return PopupMenuStyle(s->color(), s->backgroundColor(), s->font(), s->visibility() == VISIBLE, s->textIndent(), s->direction());
 }
 
 HostWindow* RenderMenuList::hostWindow() const
@@ -366,7 +374,7 @@ HostWindow* RenderMenuList::hostWindow() const
 PassRefPtr<Scrollbar> RenderMenuList::createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize controlSize)
 {
     RefPtr<Scrollbar> widget;
-    bool hasCustomScrollbarStyle = style()->hasPseudoStyle(RenderStyle::SCROLLBAR);
+    bool hasCustomScrollbarStyle = style()->hasPseudoStyle(SCROLLBAR);
     if (hasCustomScrollbarStyle)
         widget = RenderScrollbar::createCustomScrollbar(client, orientation, this);
     else
@@ -396,40 +404,42 @@ int RenderMenuList::clientPaddingRight() const
 
 int RenderMenuList::listSize() const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     return select->listItems().size();
 }
 
 int RenderMenuList::selectedIndex() const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     return select->optionToListIndex(select->selectedIndex());
 }
 
 bool RenderMenuList::itemIsSeparator(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
     return element->hasTagName(hrTag);
 }
 
 bool RenderMenuList::itemIsLabel(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
-    return element->hasTagName(optgroupTag);
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
+    return isOptionGroupElement(element);
 }
 
 bool RenderMenuList::itemIsSelected(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
-    return element->hasTagName(optionTag)&& static_cast<HTMLOptionElement*>(element)->selected();
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
+    if (OptionElement* optionElement = toOptionElement(element))
+        return optionElement->selected();
+    return false;
 }
 
 void RenderMenuList::setTextFromItem(unsigned listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     setTextFromOption(select->listToOptionIndex(listIndex));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
index f31ef32411..7966eff347 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
@@ -23,8 +23,8 @@
 #ifndef RenderMenuList_h
 #define RenderMenuList_h
 
-#include "RenderFlexibleBox.h"
 #include "PopupMenuClient.h"
+#include "RenderFlexibleBox.h"
 
 #if PLATFORM(MAC)
 #define POPUP_MENU_PULLS_DOWN 0
@@ -34,16 +34,15 @@
 
 namespace WebCore {
 
-class HTMLSelectElement;
 class PopupMenu;
+class RenderText;
 
 class RenderMenuList : public RenderFlexibleBox, private PopupMenuClient {
 public:
-    RenderMenuList(HTMLSelectElement*);
+    RenderMenuList(Element*);
     ~RenderMenuList();
-    
-    HTMLSelectElement* selectElement();
 
+private:
     virtual bool isMenuList() const { return true; }
 
     virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
@@ -60,6 +59,7 @@ public:
 
     virtual void calcPrefWidths();
 
+public:
     bool popupIsVisible() const { return m_popupIsVisible; }
     void showPopup();
     void hidePopup();
@@ -68,10 +68,9 @@ public:
 
     String text() const;
 
-protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
-
 private:
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
     // PopupMenuClient methods
     virtual String itemText(unsigned listIndex) const;
     virtual bool itemIsEnabled(unsigned listIndex) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
index 3ef7af7344..f81018dec3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
@@ -26,26 +26,14 @@
 #include "RenderObject.h"
 
 #include "AXObjectCache.h"
-#include "TransformationMatrix.h"
-#include "AnimationController.h"
 #include "CSSStyleSelector.h"
-#include "CachedImage.h"
-#include "Chrome.h"
-#include "Document.h"
-#include "Element.h"
-#include "EventHandler.h"
-#include "FloatRect.h"
+#include "FloatQuad.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
-#include "HTMLOListElement.h"
-#include "HitTestRequest.h"
 #include "HitTestResult.h"
-#include "KURL.h"
 #include "Page.h"
-#include "PlatformScreen.h"
-#include "Position.h"
 #include "RenderArena.h"
 #include "RenderCounter.h"
 #include "RenderFlexibleBox.h"
@@ -55,14 +43,17 @@
 #include "RenderTableCell.h"
 #include "RenderTableCol.h"
 #include "RenderTableRow.h"
-#include "RenderText.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
-#include "SelectionController.h"
-#include "TextResourceDecoder.h"
+#include "TransformState.h"
 #include <algorithm>
 #include <stdio.h>
 #include <wtf/RefCountedLeakCounter.h>
+#include <wtf/UnusedParam.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerCompositor.h"
+#endif
 
 #if ENABLE(WML)
 #include "WMLNames.h"
@@ -102,10 +93,10 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     // Works only if we have exactly one piece of content and it's a URL.
     // Otherwise acts as if we didn't support this feature.
     const ContentData* contentData = style->contentData();
-    if (contentData && !contentData->m_next && contentData->m_type == CONTENT_OBJECT && doc != node) {
+    if (contentData && !contentData->next() && contentData->isImage() && doc != node) {
         RenderImageGeneratedContent* image = new (arena) RenderImageGeneratedContent(node);
         image->setStyle(style);
-        if (StyleImage* styleImage = contentData->m_content.m_image)
+        if (StyleImage* styleImage = contentData->image())
             image->setStyleImage(styleImage);
         return image;
     }
@@ -175,8 +166,8 @@ RenderObject::RenderObject(Node* node)
     , m_next(0)
 #ifndef NDEBUG
     , m_hasAXObject(false)
+    , m_setNeedsLayoutForbidden(false)
 #endif
-    , m_verticalPosition(PositionUndefined)
     , m_needsLayout(false)
     , m_needsPositionedMovementLayout(false)
     , m_normalChildNeedsLayout(false)
@@ -188,6 +179,7 @@ RenderObject::RenderObject(Node* node)
     , m_paintBackground(false)
     , m_isAnonymous(node == node->document())
     , m_isText(false)
+    , m_isBox(false)
     , m_inline(true)
     , m_replaced(false)
     , m_isDragging(false)
@@ -198,10 +190,19 @@ RenderObject::RenderObject(Node* node)
     , m_hasOverrideSize(false)
     , m_hasCounterNodeMap(false)
     , m_everHadLayout(false)
+    , m_childrenInline(false)
+    , m_topMarginQuirk(false) 
+    , m_bottomMarginQuirk(false)
+    , m_hasMarkupTruncation(false)
+    , m_selectionState(SelectionNone)
+    , m_hasColumns(false)
+    , m_cellWidthChanged(false)
+    , m_replacedHasOverflow(false)
 {
 #ifndef NDEBUG
     renderObjectCounter.increment();
 #endif
+    ASSERT(node);
 }
 
 RenderObject::~RenderObject()
@@ -224,63 +225,95 @@ bool RenderObject::isDescendantOf(const RenderObject* obj) const
 
 bool RenderObject::isBody() const
 {
-    return node()->hasTagName(bodyTag);
+    return node() && node()->hasTagName(bodyTag);
 }
 
 bool RenderObject::isHR() const
 {
-    return element() && element()->hasTagName(hrTag);
+    return node() && node()->hasTagName(hrTag);
 }
 
 bool RenderObject::isHTMLMarquee() const
 {
-    return element() && element()->renderer() == this && element()->hasTagName(marqueeTag);
-}
-
-bool RenderObject::canHaveChildren() const
-{
-    return false;
-}
-
-RenderFlow* RenderObject::continuation() const
-{
-    return 0;
-}
-
-bool RenderObject::isInlineContinuation() const
-{
-    return false;
+    return node() && node()->renderer() == this && node()->hasTagName(marqueeTag);
 }
 
-void RenderObject::addChild(RenderObject*, RenderObject*)
+static void updateListMarkerNumbers(RenderObject* child)
 {
-    ASSERT_NOT_REACHED();
-}
-
-RenderObject* RenderObject::removeChildNode(RenderObject*, bool)
-{
-    ASSERT_NOT_REACHED();
-    return 0;
+    for (RenderObject* r = child; r; r = r->nextSibling())
+        if (r->isListItem())
+            static_cast<RenderListItem*>(r)->updateValue();
 }
 
-void RenderObject::removeChild(RenderObject*)
+void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
-    ASSERT_NOT_REACHED();
-}
+    RenderObjectChildList* children = virtualChildren();
+    ASSERT(children);
+    if (!children)
+        return;
 
-void RenderObject::moveChildNode(RenderObject*)
-{
-    ASSERT_NOT_REACHED();
+    bool needsTable = false;
+
+    if (newChild->isListItem())
+        updateListMarkerNumbers(beforeChild ? beforeChild : children->lastChild());
+    else if (newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP)
+        needsTable = !isTable();
+    else if (newChild->isRenderBlock() && newChild->style()->display() == TABLE_CAPTION)
+        needsTable = !isTable();
+    else if (newChild->isTableSection())
+        needsTable = !isTable();
+    else if (newChild->isTableRow())
+        needsTable = !isTableSection();
+    else if (newChild->isTableCell()) {
+        needsTable = !isTableRow();
+        // I'm not 100% sure this is the best way to fix this, but without this
+        // change we recurse infinitely when trying to render the CSS2 test page:
+        // http://www.bath.ac.uk/%7Epy8ieh/internet/eviltests/htmlbodyheadrendering2.html.
+        // See Radar 2925291.
+        if (needsTable && isTableCell() && !children->firstChild() && !newChild->isTableCell())
+            needsTable = false;
+    }
+
+    if (needsTable) {
+        RenderTable* table;
+        RenderObject* afterChild = beforeChild ? beforeChild->previousSibling() : children->lastChild();
+        if (afterChild && afterChild->isAnonymous() && afterChild->isTable())
+            table = static_cast<RenderTable*>(afterChild);
+        else {
+            table = new (renderArena()) RenderTable(document() /* is anonymous */);
+            RefPtr<RenderStyle> newStyle = RenderStyle::create();
+            newStyle->inheritFrom(style());
+            newStyle->setDisplay(TABLE);
+            table->setStyle(newStyle.release());
+            addChild(table, beforeChild);
+        }
+        table->addChild(newChild);
+    } else {
+        // Just add it...
+        children->insertChildNode(this, newChild, beforeChild);
+    }
+    
+    if (newChild->isText() && newChild->style()->textTransform() == CAPITALIZE) {
+        RefPtr<StringImpl> textToTransform = toRenderText(newChild)->originalText();
+        if (textToTransform)
+            toRenderText(newChild)->setText(textToTransform.release(), true);
+    }
 }
 
-void RenderObject::appendChildNode(RenderObject*, bool)
+void RenderObject::removeChild(RenderObject* oldChild)
 {
-    ASSERT_NOT_REACHED();
-}
+    RenderObjectChildList* children = virtualChildren();
+    ASSERT(children);
+    if (!children)
+        return;
 
-void RenderObject::insertChildNode(RenderObject*, RenderObject*, bool)
-{
-    ASSERT_NOT_REACHED();
+    // We do this here instead of in removeChildNode, since the only extremely low-level uses of remove/appendChildNode
+    // cannot affect the positioned object list, and the floating object list is irrelevant (since the list gets cleared on
+    // layout anyway).
+    if (oldChild->isFloatingOrPositioned())
+        toRenderBox(oldChild)->removeFloatingOrPositionedChildFromBlockLists();
+        
+    children->removeChildNode(this, oldChild);
 }
 
 RenderObject* RenderObject::nextInPreOrder() const
@@ -352,20 +385,6 @@ RenderObject* RenderObject::childAt(unsigned index) const
     return child;
 }
 
-bool RenderObject::isEditable() const
-{
-    RenderText* textRenderer = 0;
-    if (isText())
-        textRenderer = static_cast<RenderText*>(const_cast<RenderObject*>(this));
-
-    return style()->visibility() == VISIBLE &&
-        element() && element()->isContentEditable() &&
-        ((isBlockFlow() && !firstChild()) ||
-        isReplaced() ||
-        isBR() ||
-        (textRenderer && textRenderer->firstTextBox()));
-}
-
 RenderObject* RenderObject::firstLeafChild() const
 {
     RenderObject* r = firstChild();
@@ -403,7 +422,7 @@ static void addLayers(RenderObject* obj, RenderLayer* parentLayer, RenderObject*
             beforeChild = newObject->parent()->findNextLayer(parentLayer, newObject);
             newObject = 0;
         }
-        parentLayer->addChild(obj->layer(), beforeChild);
+        parentLayer->addChild(toRenderBoxModelObject(obj)->layer(), beforeChild);
         return;
     }
 
@@ -427,7 +446,7 @@ void RenderObject::removeLayers(RenderLayer* parentLayer)
         return;
 
     if (hasLayer()) {
-        parentLayer->removeChild(layer());
+        parentLayer->removeChild(toRenderBoxModelObject(this)->layer());
         return;
     }
 
@@ -441,9 +460,11 @@ void RenderObject::moveLayers(RenderLayer* oldParent, RenderLayer* newParent)
         return;
 
     if (hasLayer()) {
+        RenderLayer* layer = toRenderBoxModelObject(this)->layer();
+        ASSERT(oldParent == layer->parent());
         if (oldParent)
-            oldParent->removeChild(layer());
-        newParent->addChild(layer());
+            oldParent->removeChild(layer);
+        newParent->addChild(layer);
         return;
     }
 
@@ -459,7 +480,7 @@ RenderLayer* RenderObject::findNextLayer(RenderLayer* parentLayer, RenderObject*
         return 0;
 
     // Step 1: If our layer is a child of the desired parent, then return our layer.
-    RenderLayer* ourLayer = layer();
+    RenderLayer* ourLayer = hasLayer() ? toRenderBoxModelObject(this)->layer() : 0;
     if (ourLayer && ourLayer->parent() == parentLayer)
         return ourLayer;
 
@@ -491,7 +512,7 @@ RenderLayer* RenderObject::enclosingLayer() const
 {
     const RenderObject* curr = this;
     while (curr) {
-        RenderLayer* layer = curr->layer();
+        RenderLayer* layer = curr->hasLayer() ? toRenderBoxModelObject(curr)->layer() : 0;
         if (layer)
             return layer;
         curr = curr->parent();
@@ -499,190 +520,34 @@ RenderLayer* RenderObject::enclosingLayer() const
     return 0;
 }
 
-bool RenderObject::requiresLayer()
-{
-    return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection();
-}
-
-RenderBlock* RenderObject::firstLineBlock() const
-{
-    return 0;
-}
-
-int RenderObject::offsetLeft() const
-{
-    RenderObject* offsetPar = offsetParent();
-    if (!offsetPar)
-        return 0;
-    int x = xPos() - offsetPar->borderLeft();
-    if (!isPositioned()) {
-        if (isRelPositioned())
-            x += static_cast<const RenderBox*>(this)->relativePositionOffsetX();
-        RenderObject* curr = parent();
-        while (curr && curr != offsetPar) {
-            x += curr->xPos();
-            curr = curr->parent();
-        }
-        if (offsetPar->isBody() && !offsetPar->isRelPositioned() && !offsetPar->isPositioned())
-            x += offsetPar->xPos();
-    }
-    return x;
-}
-
-int RenderObject::offsetTop() const
+RenderLayer* RenderObject::enclosingSelfPaintingLayer() const
 {
-    RenderObject* offsetPar = offsetParent();
-    if (!offsetPar)
-        return 0;
-    int y = yPos() - borderTopExtra() - offsetPar->borderTop();
-    if (!isPositioned()) {
-        if (isRelPositioned())
-            y += static_cast<const RenderBox*>(this)->relativePositionOffsetY();
-        RenderObject* curr = parent();
-        while (curr && curr != offsetPar) {
-            if (!curr->isTableRow())
-                y += curr->yPos();
-            curr = curr->parent();
-        }
-        if (offsetPar->isBody() && !offsetPar->isRelPositioned() && !offsetPar->isPositioned())
-            y += offsetPar->yPos();
+    const RenderObject* curr = this;
+    while (curr) {
+        RenderLayer* layer = curr->hasLayer() ? toRenderBoxModelObject(curr)->layer() : 0;
+        if (layer && layer->isSelfPaintingLayer())
+            return layer;
+        curr = curr->parent();
     }
-    return y;
+    return 0;
 }
 
-RenderObject* RenderObject::offsetParent() const
+RenderBox* RenderObject::enclosingBox() const
 {
-    // FIXME: It feels like this function could almost be written using containing blocks.
-    if (isBody())
-        return 0;
-
-    bool skipTables = isPositioned() || isRelPositioned();
-    float currZoom = style()->effectiveZoom();
-    RenderObject* curr = parent();
-    while (curr && (!curr->element() ||
-                    (!curr->isPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
-        Node* element = curr->element();
-        if (!skipTables && element) {
-            bool isTableElement = element->hasTagName(tableTag) ||
-                                  element->hasTagName(tdTag) ||
-                                  element->hasTagName(thTag);
-
-#if ENABLE(WML)
-            if (!isTableElement && element->isWMLElement())
-                isTableElement = element->hasTagName(WMLNames::tableTag) ||
-                                 element->hasTagName(WMLNames::tdTag);
-#endif
-
-            if (isTableElement)
-                break;
-        }
-
-        float newZoom = curr->style()->effectiveZoom();
-        if (currZoom != newZoom)
-            break;
-        currZoom = newZoom;
+    RenderObject* curr = const_cast<RenderObject*>(this);
+    while (curr) {
+        if (curr->isBox())
+            return toRenderBox(curr);
         curr = curr->parent();
     }
-    return curr;
-}
-
-int RenderObject::verticalScrollbarWidth() const
-{
-    return includeVerticalScrollbarSize() ? layer()->verticalScrollbarWidth() : 0;
-}
-
-int RenderObject::horizontalScrollbarHeight() const
-{
-    return includeHorizontalScrollbarSize() ? layer()->horizontalScrollbarHeight() : 0;
-}
-
-// More IE extensions.  clientWidth and clientHeight represent the interior of an object
-// excluding border and scrollbar.
-int RenderObject::clientWidth() const
-{
-    return width() - borderLeft() - borderRight() - verticalScrollbarWidth();
-}
-
-int RenderObject::clientHeight() const
-{
-    return height() - borderTop() - borderBottom() - horizontalScrollbarHeight();
-}
-
-// scrollWidth/scrollHeight will be the same as clientWidth/clientHeight unless the
-// object has overflow:hidden/scroll/auto specified and also has overflow.
-int RenderObject::scrollWidth() const
-{
-    return hasOverflowClip() ? layer()->scrollWidth() : overflowWidth();
-}
-
-int RenderObject::scrollHeight() const
-{
-    return hasOverflowClip() ? layer()->scrollHeight() : overflowHeight();
-}
-
-int RenderObject::scrollLeft() const
-{
-    return hasOverflowClip() ? layer()->scrollXOffset() : 0;
-}
-
-int RenderObject::scrollTop() const
-{
-    return hasOverflowClip() ? layer()->scrollYOffset() : 0;
-}
-
-void RenderObject::setScrollLeft(int newLeft)
-{
-    if (hasOverflowClip())
-        layer()->scrollToXOffset(newLeft);
-}
-
-void RenderObject::setScrollTop(int newTop)
-{
-    if (hasOverflowClip())
-        layer()->scrollToYOffset(newTop);
-}
-
-bool RenderObject::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
-{
-    RenderLayer* l = layer();
-    if (l && l->scroll(direction, granularity, multiplier))
-        return true;
-    RenderBlock* b = containingBlock();
-    if (b && !b->isRenderView())
-        return b->scroll(direction, granularity, multiplier);
-    return false;
-}
     
-bool RenderObject::canBeProgramaticallyScrolled(bool) const
-{
-    if (!layer())
-        return false;
-
-    return (hasOverflowClip() && (scrollsOverflow() || (node() && node()->isContentEditable()))) || (node() && node()->isDocumentNode());
-}
-
-void RenderObject::autoscroll()
-{
-    layer()->autoscroll();
-}
-
-void RenderObject::panScroll(const IntPoint& source)
-{
-    layer()->panScrollFromPoint(source);
-}
-
-bool RenderObject::hasStaticX() const
-{
-    return (style()->left().isAuto() && style()->right().isAuto()) || style()->left().isStatic() || style()->right().isStatic();
-}
-
-bool RenderObject::hasStaticY() const
-{
-    return (style()->top().isAuto() && style()->bottom().isAuto()) || style()->top().isStatic();
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
-void RenderObject::markAllDescendantsWithFloatsForLayout(RenderObject*)
+RenderBlock* RenderObject::firstLineBlock() const
 {
+    return 0;
 }
 
 void RenderObject::setPrefWidthsDirty(bool b, bool markParents)
@@ -699,109 +564,25 @@ void RenderObject::invalidateContainerPrefWidths()
     // in the chain that we mark dirty (even though they're kind of irrelevant).
     RenderObject* o = isTableCell() ? containingBlock() : container();
     while (o && !o->m_prefWidthsDirty) {
+        // Don't invalidate the outermost object of an unrooted subtree. That object will be 
+        // invalidated when the subtree is added to the document.
+        RenderObject* container = o->isTableCell() ? o->containingBlock() : o->container();
+        if (!container && !o->isRenderView())
+            break;
+
         o->m_prefWidthsDirty = true;
         if (o->style()->position() == FixedPosition || o->style()->position() == AbsolutePosition)
             // A positioned object has no effect on the min/max width of its containing block ever.
             // We can optimize this case and not go up any further.
             break;
-        o = o->isTableCell() ? o->containingBlock() : o->container();
-    }
-}
-
-void RenderObject::setNeedsLayout(bool b, bool markParents)
-{
-    bool alreadyNeededLayout = m_needsLayout;
-    m_needsLayout = b;
-    if (b) {
-        if (!alreadyNeededLayout) {
-            if (markParents)
-                markContainingBlocksForLayout();
-            if (hasLayer())
-                layer()->setNeedsFullRepaint();
-        }
-    } else {
-        m_everHadLayout = true;
-        m_posChildNeedsLayout = false;
-        m_normalChildNeedsLayout = false;
-        m_needsPositionedMovementLayout = false;
-    }
-}
-
-void RenderObject::setChildNeedsLayout(bool b, bool markParents)
-{
-    bool alreadyNeededLayout = m_normalChildNeedsLayout;
-    m_normalChildNeedsLayout = b;
-    if (b) {
-        if (!alreadyNeededLayout && markParents)
-            markContainingBlocksForLayout();
-    } else {
-        m_posChildNeedsLayout = false;
-        m_normalChildNeedsLayout = false;
-        m_needsPositionedMovementLayout = false;
-    }
-}
-
-void RenderObject::setNeedsPositionedMovementLayout()
-{
-    bool alreadyNeededLayout = needsLayout();
-    m_needsPositionedMovementLayout = true;
-    if (!alreadyNeededLayout) {
-        markContainingBlocksForLayout();
-        if (hasLayer())
-            layer()->setNeedsFullRepaint();
+        o = container;
     }
 }
 
-static inline bool objectIsRelayoutBoundary(const RenderObject *obj) 
+void RenderObject::setLayerNeedsFullRepaint()
 {
-    // FIXME: In future it may be possible to broaden this condition in order to improve performance.
-    // Table cells are excluded because even when their CSS height is fixed, their height()
-    // may depend on their contents.
-    return obj->isTextField() || obj->isTextArea()
-        || obj->hasOverflowClip() && !obj->style()->width().isIntrinsicOrAuto() && !obj->style()->height().isIntrinsicOrAuto() && !obj->style()->height().isPercent() && !obj->isTableCell()
-#if ENABLE(SVG)
-           || obj->isSVGRoot()
-#endif
-           ;
-}
-    
-void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderObject* newRoot)
-{
-    ASSERT(!scheduleRelayout || !newRoot);
-
-    RenderObject* o = container();
-    RenderObject* last = this;
-
-    while (o) {
-        if (!last->isText() && (last->style()->position() == FixedPosition || last->style()->position() == AbsolutePosition)) {
-            if (last->hasStaticY()) {
-                RenderObject* parent = last->parent();
-                if (!parent->normalChildNeedsLayout()) {
-                    parent->setChildNeedsLayout(true, false);
-                    if (parent != newRoot)
-                        parent->markContainingBlocksForLayout(scheduleRelayout, newRoot);
-                }
-            }
-            if (o->m_posChildNeedsLayout)
-                return;
-            o->m_posChildNeedsLayout = true;
-        } else {
-            if (o->m_normalChildNeedsLayout)
-                return;
-            o->m_normalChildNeedsLayout = true;
-        }
-
-        if (o == newRoot)
-            return;
-
-        last = o;
-        if (scheduleRelayout && objectIsRelayoutBoundary(last))
-            break;
-        o = o->container();
-    }
-
-    if (scheduleRelayout)
-        last->scheduleRelayout();
+    ASSERT(hasLayer());
+    toRenderBoxModelObject(this)->layer()->setNeedsFullRepaint(true);
 }
 
 RenderBlock* RenderObject::containingBlock() const
@@ -814,7 +595,7 @@ RenderBlock* RenderObject::containingBlock() const
     }
 
     if (isRenderView())
-        return const_cast<RenderBlock*>(static_cast<const RenderBlock*>(this));
+        return const_cast<RenderView*>(toRenderView(this));
 
     RenderObject* o = parent();
     if (!isText() && m_style->position() == FixedPosition) {
@@ -844,19 +625,7 @@ RenderBlock* RenderObject::containingBlock() const
     if (!o || !o->isRenderBlock())
         return 0; // Probably doesn't happen any more, but leave just in case. -dwh
 
-    return static_cast<RenderBlock*>(o);
-}
-
-int RenderObject::containingBlockWidth() const
-{
-    // FIXME ?
-    return containingBlock()->availableWidth();
-}
-
-int RenderObject::containingBlockHeight() const
-{
-    // FIXME ?
-    return containingBlock()->contentHeight();
+    return toRenderBlock(o);
 }
 
 static bool mustRepaintFillLayers(const RenderObject* renderer, const FillLayer* layer)
@@ -905,97 +674,9 @@ bool RenderObject::mustRepaintBackgroundOrBorder() const
     return false;
 }
 
-void RenderObject::drawBorderArc(GraphicsContext* graphicsContext, int x, int y, float thickness, IntSize radius,
-                                 int angleStart, int angleSpan, BorderSide s, Color c, const Color& textColor,
-                                 EBorderStyle style, bool firstCorner)
-{
-    if ((style == DOUBLE && thickness / 2 < 3) || ((style == RIDGE || style == GROOVE) && thickness / 2 < 2))
-        style = SOLID;
-
-    if (!c.isValid()) {
-        if (style == INSET || style == OUTSET || style == RIDGE || style == GROOVE)
-            c.setRGB(238, 238, 238);
-        else
-            c = textColor;
-    }
-
-    switch (style) {
-        case BNONE:
-        case BHIDDEN:
-            return;
-        case DOTTED:
-        case DASHED:
-            graphicsContext->setStrokeColor(c);
-            graphicsContext->setStrokeStyle(style == DOTTED ? DottedStroke : DashedStroke);
-            graphicsContext->setStrokeThickness(thickness);
-            graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
-            break;
-        case DOUBLE: {
-            float third = thickness / 3.0f;
-            float innerThird = (thickness + 1.0f) / 6.0f;
-            int shiftForInner = static_cast<int>(innerThird * 2.5f);
-
-            int outerY = y;
-            int outerHeight = radius.height() * 2;
-            int innerX = x + shiftForInner;
-            int innerY = y + shiftForInner;
-            int innerWidth = (radius.width() - shiftForInner) * 2;
-            int innerHeight = (radius.height() - shiftForInner) * 2;
-            if (innerThird > 1 && (s == BSTop || (firstCorner && (s == BSLeft || s == BSRight)))) {
-                outerHeight += 2;
-                innerHeight += 2;
-            }
-
-            graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
-            graphicsContext->setStrokeThickness(third);
-            graphicsContext->strokeArc(IntRect(x, outerY, radius.width() * 2, outerHeight), angleStart, angleSpan);
-            graphicsContext->setStrokeThickness(innerThird > 2 ? innerThird - 1 : innerThird);
-            graphicsContext->strokeArc(IntRect(innerX, innerY, innerWidth, innerHeight), angleStart, angleSpan);
-            break;
-        }
-        case GROOVE:
-        case RIDGE: {
-            Color c2;
-            if ((style == RIDGE && (s == BSTop || s == BSLeft)) ||
-                    (style == GROOVE && (s == BSBottom || s == BSRight)))
-                c2 = c.dark();
-            else {
-                c2 = c;
-                c = c.dark();
-            }
-
-            graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
-            graphicsContext->setStrokeThickness(thickness);
-            graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
-
-            float halfThickness = (thickness + 1.0f) / 4.0f;
-            int shiftForInner = static_cast<int>(halfThickness * 1.5f);
-            graphicsContext->setStrokeColor(c2);
-            graphicsContext->setStrokeThickness(halfThickness > 2 ? halfThickness - 1 : halfThickness);
-            graphicsContext->strokeArc(IntRect(x + shiftForInner, y + shiftForInner, (radius.width() - shiftForInner) * 2,
-                                       (radius.height() - shiftForInner) * 2), angleStart, angleSpan);
-            break;
-        }
-        case INSET:
-            if (s == BSTop || s == BSLeft)
-                c = c.dark();
-        case OUTSET:
-            if (style == OUTSET && (s == BSBottom || s == BSRight))
-                c = c.dark();
-        case SOLID:
-            graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
-            graphicsContext->setStrokeThickness(thickness);
-            graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
-            break;
-    }
-}
-
-void RenderObject::drawBorder(GraphicsContext* graphicsContext, int x1, int y1, int x2, int y2,
-                              BorderSide s, Color c, const Color& textcolor, EBorderStyle style,
-                              int adjbw1, int adjbw2)
+void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1, int y1, int x2, int y2,
+                                      BoxSide s, Color c, const Color& textcolor, EBorderStyle style,
+                                      int adjbw1, int adjbw2)
 {
     int width = (s == BSTop || s == BSBottom ? y2 - y1 : x2 - x1);
 
@@ -1058,34 +739,34 @@ void RenderObject::drawBorder(GraphicsContext* graphicsContext, int x1, int y1,
 
                 switch (s) {
                     case BSTop:
-                        drawBorder(graphicsContext, x1 + max((-adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x1 + max((-adjbw1 * 2 + 1) / 3, 0),
                                    y1, x2 - max((-adjbw2 * 2 + 1) / 3, 0), y1 + third,
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawBorder(graphicsContext, x1 + max((adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x1 + max((adjbw1 * 2 + 1) / 3, 0),
                                    y2 - third, x2 - max((adjbw2 * 2 + 1) / 3, 0), y2,
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
                         break;
                     case BSLeft:
-                        drawBorder(graphicsContext, x1, y1 + max((-adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x1, y1 + max((-adjbw1 * 2 + 1) / 3, 0),
                                    x1 + third, y2 - max((-adjbw2 * 2 + 1) / 3, 0),
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawBorder(graphicsContext, x2 - third, y1 + max((adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((adjbw1 * 2 + 1) / 3, 0),
                                    x2, y2 - max((adjbw2 * 2 + 1) / 3, 0),
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
                         break;
                     case BSBottom:
-                        drawBorder(graphicsContext, x1 + max((adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x1 + max((adjbw1 * 2 + 1) / 3, 0),
                                    y1, x2 - max((adjbw2 * 2 + 1) / 3, 0), y1 + third,
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawBorder(graphicsContext, x1 + max((-adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x1 + max((-adjbw1 * 2 + 1) / 3, 0),
                                    y2 - third, x2 - max((-adjbw2 * 2 + 1) / 3, 0), y2,
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
                         break;
                     case BSRight:
-                        drawBorder(graphicsContext, x1, y1 + max((adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x1, y1 + max((adjbw1 * 2 + 1) / 3, 0),
                                    x1 + third, y2 - max(( adjbw2 * 2 + 1) / 3, 0),
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawBorder(graphicsContext, x2 - third, y1 + max((-adjbw1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((-adjbw1 * 2 + 1) / 3, 0),
                                    x2, y2 - max((-adjbw2 * 2 + 1) / 3, 0),
                                    s, c, textcolor, SOLID, adjbw1bigthird, adjbw2bigthird);
                         break;
@@ -1113,27 +794,27 @@ void RenderObject::drawBorder(GraphicsContext* graphicsContext, int x1, int y1,
 
             switch (s) {
                 case BSTop:
-                    drawBorder(graphicsContext, x1 + max(-adjbw1, 0) / 2, y1, x2 - max(-adjbw2, 0) / 2, (y1 + y2 + 1) / 2,
+                    drawLineForBoxSide(graphicsContext, x1 + max(-adjbw1, 0) / 2, y1, x2 - max(-adjbw2, 0) / 2, (y1 + y2 + 1) / 2,
                                s, c, textcolor, s1, adjbw1bighalf, adjbw2bighalf);
-                    drawBorder(graphicsContext, x1 + max(adjbw1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(adjbw2 + 1, 0) / 2, y2,
+                    drawLineForBoxSide(graphicsContext, x1 + max(adjbw1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(adjbw2 + 1, 0) / 2, y2,
                                s, c, textcolor, s2, adjbw1 / 2, adjbw2 / 2);
                     break;
                 case BSLeft:
-                    drawBorder(graphicsContext, x1, y1 + max(-adjbw1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(-adjbw2, 0) / 2,
+                    drawLineForBoxSide(graphicsContext, x1, y1 + max(-adjbw1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(-adjbw2, 0) / 2,
                                s, c, textcolor, s1, adjbw1bighalf, adjbw2bighalf);
-                    drawBorder(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(adjbw1 + 1, 0) / 2, x2, y2 - max(adjbw2 + 1, 0) / 2,
+                    drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(adjbw1 + 1, 0) / 2, x2, y2 - max(adjbw2 + 1, 0) / 2,
                                s, c, textcolor, s2, adjbw1 / 2, adjbw2 / 2);
                     break;
                 case BSBottom:
-                    drawBorder(graphicsContext, x1 + max(adjbw1, 0) / 2, y1, x2 - max(adjbw2, 0) / 2, (y1 + y2 + 1) / 2,
+                    drawLineForBoxSide(graphicsContext, x1 + max(adjbw1, 0) / 2, y1, x2 - max(adjbw2, 0) / 2, (y1 + y2 + 1) / 2,
                                s, c, textcolor, s2, adjbw1bighalf, adjbw2bighalf);
-                    drawBorder(graphicsContext, x1 + max(-adjbw1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(-adjbw2 + 1, 0) / 2, y2,
+                    drawLineForBoxSide(graphicsContext, x1 + max(-adjbw1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(-adjbw2 + 1, 0) / 2, y2,
                                s, c, textcolor, s1, adjbw1/2, adjbw2/2);
                     break;
                 case BSRight:
-                    drawBorder(graphicsContext, x1, y1 + max(adjbw1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(adjbw2, 0) / 2,
+                    drawLineForBoxSide(graphicsContext, x1, y1 + max(adjbw1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(adjbw2, 0) / 2,
                                s, c, textcolor, s2, adjbw1bighalf, adjbw2bighalf);
-                    drawBorder(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(-adjbw1 + 1, 0) / 2, x2, y2 - max(-adjbw2 + 1, 0) / 2,
+                    drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(-adjbw1 + 1, 0) / 2, x2, y2 - max(-adjbw2 + 1, 0) / 2,
                                s, c, textcolor, s1, adjbw1/2, adjbw2/2);
                     break;
             }
@@ -1189,536 +870,156 @@ void RenderObject::drawBorder(GraphicsContext* graphicsContext, int x1, int y1,
     }
 }
 
-bool RenderObject::paintNinePieceImage(GraphicsContext* graphicsContext, int tx, int ty, int w, int h, const RenderStyle* style,
-                                       const NinePieceImage& ninePieceImage, CompositeOperator op)
+void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, int y, float thickness, IntSize radius,
+                                     int angleStart, int angleSpan, BoxSide s, Color c, const Color& textColor,
+                                     EBorderStyle style, bool firstCorner)
 {
-    StyleImage* styleImage = ninePieceImage.image();
-    if (!styleImage || !styleImage->canRender(style->effectiveZoom()))
-        return false;
-
-    if (!styleImage->isLoaded())
-        return true; // Never paint a nine-piece image incrementally, but don't paint the fallback borders either.
-
-    // If we have a border radius, the image gets clipped to the rounded rect.
-    bool clipped = false;
-    if (style->hasBorderRadius()) {
-        IntRect clipRect(tx, ty, w, h);
-        graphicsContext->save();
-        graphicsContext->addRoundedRectClip(clipRect, style->borderTopLeftRadius(), style->borderTopRightRadius(),
-                                            style->borderBottomLeftRadius(), style->borderBottomRightRadius());
-        clipped = true;
-    }
-
-    // FIXME: border-image is broken with full page zooming when tiling has to happen, since the tiling function
-    // doesn't have any understanding of the zoom that is in effect on the tile.
-    styleImage->setImageContainerSize(IntSize(w, h));
-    IntSize imageSize = styleImage->imageSize(this, 1.0f);
-    int imageWidth = imageSize.width();
-    int imageHeight = imageSize.height();
-
-    int topSlice = min(imageHeight, ninePieceImage.m_slices.top().calcValue(imageHeight));
-    int bottomSlice = min(imageHeight, ninePieceImage.m_slices.bottom().calcValue(imageHeight));
-    int leftSlice = min(imageWidth, ninePieceImage.m_slices.left().calcValue(imageWidth));
-    int rightSlice = min(imageWidth, ninePieceImage.m_slices.right().calcValue(imageWidth));
-
-    ENinePieceImageRule hRule = ninePieceImage.horizontalRule();
-    ENinePieceImageRule vRule = ninePieceImage.verticalRule();
-
-    bool fitToBorder = style->borderImage() == ninePieceImage;
-    
-    int leftWidth = fitToBorder ? style->borderLeftWidth() : leftSlice;
-    int topWidth = fitToBorder ? style->borderTopWidth() : topSlice;
-    int rightWidth = fitToBorder ? style->borderRightWidth() : rightSlice;
-    int bottomWidth = fitToBorder ? style->borderBottomWidth() : bottomSlice;
-
-    bool drawLeft = leftSlice > 0 && leftWidth > 0;
-    bool drawTop = topSlice > 0 && topWidth > 0;
-    bool drawRight = rightSlice > 0 && rightWidth > 0;
-    bool drawBottom = bottomSlice > 0 && bottomWidth > 0;
-    bool drawMiddle = (imageWidth - leftSlice - rightSlice) > 0 && (w - leftWidth - rightWidth) > 0 &&
-                      (imageHeight - topSlice - bottomSlice) > 0 && (h - topWidth - bottomWidth) > 0;
-
-    Image* image = styleImage->image(this, imageSize);
-
-    if (drawLeft) {
-        // Paint the top and bottom left corners.
-
-        // The top left corner rect is (tx, ty, leftWidth, topWidth)
-        // The rect to use from within the image is obtained from our slice, and is (0, 0, leftSlice, topSlice)
-        if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx, ty, leftWidth, topWidth),
-                                       IntRect(0, 0, leftSlice, topSlice), op);
-
-        // The bottom left corner rect is (tx, ty + h - bottomWidth, leftWidth, bottomWidth)
-        // The rect to use from within the image is (0, imageHeight - bottomSlice, leftSlice, botomSlice)
-        if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
-                                       IntRect(0, imageHeight - bottomSlice, leftSlice, bottomSlice), op);
-
-        // Paint the left edge.
-        // Have to scale and tile into the border rect.
-        graphicsContext->drawTiledImage(image, IntRect(tx, ty + topWidth, leftWidth,
-                                        h - topWidth - bottomWidth),
-                                        IntRect(0, topSlice, leftSlice, imageHeight - topSlice - bottomSlice),
-                                        Image::StretchTile, (Image::TileRule)vRule, op);
-    }
-
-    if (drawRight) {
-        // Paint the top and bottom right corners
-        // The top right corner rect is (tx + w - rightWidth, ty, rightWidth, topWidth)
-        // The rect to use from within the image is obtained from our slice, and is (imageWidth - rightSlice, 0, rightSlice, topSlice)
-        if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
-                                       IntRect(imageWidth - rightSlice, 0, rightSlice, topSlice), op);
-
-        // The bottom right corner rect is (tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth)
-        // The rect to use from within the image is (imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice)
-        if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
-                                       IntRect(imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice), op);
-
-        // Paint the right edge.
-        graphicsContext->drawTiledImage(image, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
-                                        h - topWidth - bottomWidth),
-                                        IntRect(imageWidth - rightSlice, topSlice, rightSlice, imageHeight - topSlice - bottomSlice),
-                                        Image::StretchTile, (Image::TileRule)vRule, op);
-    }
-
-    // Paint the top edge.
-    if (drawTop)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
-                                        IntRect(leftSlice, 0, imageWidth - rightSlice - leftSlice, topSlice),
-                                        (Image::TileRule)hRule, Image::StretchTile, op);
-
-    // Paint the bottom edge.
-    if (drawBottom)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + h - bottomWidth,
-                                        w - leftWidth - rightWidth, bottomWidth),
-                                        IntRect(leftSlice, imageHeight - bottomSlice, imageWidth - rightSlice - leftSlice, bottomSlice),
-                                        (Image::TileRule)hRule, Image::StretchTile, op);
-
-    // Paint the middle.
-    if (drawMiddle)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
-                                        h - topWidth - bottomWidth),
-                                        IntRect(leftSlice, topSlice, imageWidth - rightSlice - leftSlice, imageHeight - topSlice - bottomSlice),
-                                        (Image::TileRule)hRule, (Image::TileRule)vRule, op);
-
-    // Clear the clip for the border radius.
-    if (clipped)
-        graphicsContext->restore();
-
-    return true;
-}
-
-void RenderObject::paintBorder(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
-                               const RenderStyle* style, bool begin, bool end)
-{
-    if (paintNinePieceImage(graphicsContext, tx, ty, w, h, style, style->borderImage()))
-        return;
-
-    const Color& tc = style->borderTopColor();
-    const Color& bc = style->borderBottomColor();
-    const Color& lc = style->borderLeftColor();
-    const Color& rc = style->borderRightColor();
-
-    bool tt = style->borderTopIsTransparent();
-    bool bt = style->borderBottomIsTransparent();
-    bool rt = style->borderRightIsTransparent();
-    bool lt = style->borderLeftIsTransparent();
-
-    EBorderStyle ts = style->borderTopStyle();
-    EBorderStyle bs = style->borderBottomStyle();
-    EBorderStyle ls = style->borderLeftStyle();
-    EBorderStyle rs = style->borderRightStyle();
-
-    bool renderTop = ts > BHIDDEN && !tt;
-    bool renderLeft = ls > BHIDDEN && begin && !lt;
-    bool renderRight = rs > BHIDDEN && end && !rt;
-    bool renderBottom = bs > BHIDDEN && !bt;
-
-    // Need sufficient width and height to contain border radius curves.  Sanity check our border radii
-    // and our width/height values to make sure the curves can all fit. If not, then we won't paint
-    // any border radii.
-    bool renderRadii = false;
-    IntSize topLeft = style->borderTopLeftRadius();
-    IntSize topRight = style->borderTopRightRadius();
-    IntSize bottomLeft = style->borderBottomLeftRadius();
-    IntSize bottomRight = style->borderBottomRightRadius();
-
-    if (style->hasBorderRadius() &&
-        static_cast<unsigned>(w) >= static_cast<unsigned>(topLeft.width()) + static_cast<unsigned>(topRight.width()) &&
-        static_cast<unsigned>(w) >= static_cast<unsigned>(bottomLeft.width()) + static_cast<unsigned>(bottomRight.width()) &&
-        static_cast<unsigned>(h) >= static_cast<unsigned>(topLeft.height()) + static_cast<unsigned>(bottomLeft.height()) &&
-        static_cast<unsigned>(h) >= static_cast<unsigned>(topRight.height()) + static_cast<unsigned>(bottomRight.height()))
-        renderRadii = true;
-
-    // Clip to the rounded rectangle.
-    if (renderRadii) {
-        graphicsContext->save();
-        graphicsContext->addRoundedRectClip(IntRect(tx, ty, w, h), topLeft, topRight, bottomLeft, bottomRight);
-    }
-
-    int firstAngleStart, secondAngleStart, firstAngleSpan, secondAngleSpan;
-    float thickness;
-    bool upperLeftBorderStylesMatch = renderLeft && (ts == ls) && (tc == lc);
-    bool upperRightBorderStylesMatch = renderRight && (ts == rs) && (tc == rc) && (ts != OUTSET) && (ts != RIDGE) && (ts != INSET) && (ts != GROOVE);
-    bool lowerLeftBorderStylesMatch = renderLeft && (bs == ls) && (bc == lc) && (bs != OUTSET) && (bs != RIDGE) && (bs != INSET) && (bs != GROOVE);
-    bool lowerRightBorderStylesMatch = renderRight && (bs == rs) && (bc == rc);
-
-    if (renderTop) {
-        bool ignore_left = (renderRadii && topLeft.width() > 0) ||
-            (tc == lc && tt == lt && ts >= OUTSET &&
-             (ls == DOTTED || ls == DASHED || ls == SOLID || ls == OUTSET));
-
-        bool ignore_right = (renderRadii && topRight.width() > 0) ||
-            (tc == rc && tt == rt && ts >= OUTSET &&
-             (rs == DOTTED || rs == DASHED || rs == SOLID || rs == INSET));
-
-        int x = tx;
-        int x2 = tx + w;
-        if (renderRadii) {
-            x += topLeft.width();
-            x2 -= topRight.width();
-        }
-
-        drawBorder(graphicsContext, x, ty, x2, ty + style->borderTopWidth(), BSTop, tc, style->color(), ts,
-                   ignore_left ? 0 : style->borderLeftWidth(), ignore_right ? 0 : style->borderRightWidth());
-
-        if (renderRadii) {
-            int leftY = ty;
-
-            // We make the arc double thick and let the clip rect take care of clipping the extra off.
-            // We're doing this because it doesn't seem possible to match the curve of the clip exactly
-            // with the arc-drawing function.
-            thickness = style->borderTopWidth() * 2;
-
-            if (topLeft.width()) {
-                int leftX = tx;
-                // The inner clip clips inside the arc. This is especially important for 1px borders.
-                bool applyLeftInnerClip = (style->borderLeftWidth() < topLeft.width())
-                    && (style->borderTopWidth() < topLeft.height())
-                    && (ts != DOUBLE || style->borderTopWidth() > 6);
-                if (applyLeftInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(leftX, leftY, topLeft.width() * 2, topLeft.height() * 2),
-                                                             style->borderTopWidth());
-                }
-
-                firstAngleStart = 90;
-                firstAngleSpan = upperLeftBorderStylesMatch ? 90 : 45;
-
-                // Draw upper left arc
-                drawBorderArc(graphicsContext, leftX, leftY, thickness, topLeft, firstAngleStart, firstAngleSpan,
-                              BSTop, tc, style->color(), ts, true);
-                if (applyLeftInnerClip)
-                    graphicsContext->restore();
-            }
-
-            if (topRight.width()) {
-                int rightX = tx + w - topRight.width() * 2;
-                bool applyRightInnerClip = (style->borderRightWidth() < topRight.width())
-                    && (style->borderTopWidth() < topRight.height())
-                    && (ts != DOUBLE || style->borderTopWidth() > 6);
-                if (applyRightInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(rightX, leftY, topRight.width() * 2, topRight.height() * 2),
-                                                             style->borderTopWidth());
-                }
-
-                if (upperRightBorderStylesMatch) {
-                    secondAngleStart = 0;
-                    secondAngleSpan = 90;
-                } else {
-                    secondAngleStart = 45;
-                    secondAngleSpan = 45;
-                }
+    if ((style == DOUBLE && thickness / 2 < 3) || ((style == RIDGE || style == GROOVE) && thickness / 2 < 2))
+        style = SOLID;
 
-                // Draw upper right arc
-                drawBorderArc(graphicsContext, rightX, leftY, thickness, topRight, secondAngleStart, secondAngleSpan,
-                              BSTop, tc, style->color(), ts, false);
-                if (applyRightInnerClip)
-                    graphicsContext->restore();
-            }
-        }
+    if (!c.isValid()) {
+        if (style == INSET || style == OUTSET || style == RIDGE || style == GROOVE)
+            c.setRGB(238, 238, 238);
+        else
+            c = textColor;
     }
 
-    if (renderBottom) {
-        bool ignore_left = (renderRadii && bottomLeft.width() > 0) ||
-            (bc == lc && bt == lt && bs >= OUTSET &&
-             (ls == DOTTED || ls == DASHED || ls == SOLID || ls == OUTSET));
-
-        bool ignore_right = (renderRadii && bottomRight.width() > 0) ||
-            (bc == rc && bt == rt && bs >= OUTSET &&
-             (rs == DOTTED || rs == DASHED || rs == SOLID || rs == INSET));
-
-        int x = tx;
-        int x2 = tx + w;
-        if (renderRadii) {
-            x += bottomLeft.width();
-            x2 -= bottomRight.width();
-        }
-
-        drawBorder(graphicsContext, x, ty + h - style->borderBottomWidth(), x2, ty + h, BSBottom, bc, style->color(), bs,
-                   ignore_left ? 0 : style->borderLeftWidth(), ignore_right ? 0 : style->borderRightWidth());
-
-        if (renderRadii) {
-            thickness = style->borderBottomWidth() * 2;
-
-            if (bottomLeft.width()) {
-                int leftX = tx;
-                int leftY = ty + h - bottomLeft.height() * 2;
-                bool applyLeftInnerClip = (style->borderLeftWidth() < bottomLeft.width())
-                    && (style->borderBottomWidth() < bottomLeft.height())
-                    && (bs != DOUBLE || style->borderBottomWidth() > 6);
-                if (applyLeftInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(leftX, leftY, bottomLeft.width() * 2, bottomLeft.height() * 2),
-                                                             style->borderBottomWidth());
-                }
-
-                if (lowerLeftBorderStylesMatch) {
-                    firstAngleStart = 180;
-                    firstAngleSpan = 90;
-                } else {
-                    firstAngleStart = 225;
-                    firstAngleSpan = 45;
-                }
-
-                // Draw lower left arc
-                drawBorderArc(graphicsContext, leftX, leftY, thickness, bottomLeft, firstAngleStart, firstAngleSpan,
-                              BSBottom, bc, style->color(), bs, true);
-                if (applyLeftInnerClip)
-                    graphicsContext->restore();
-            }
-
-            if (bottomRight.width()) {
-                int rightY = ty + h - bottomRight.height() * 2;
-                int rightX = tx + w - bottomRight.width() * 2;
-                bool applyRightInnerClip = (style->borderRightWidth() < bottomRight.width())
-                    && (style->borderBottomWidth() < bottomRight.height())
-                    && (bs != DOUBLE || style->borderBottomWidth() > 6);
-                if (applyRightInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(rightX, rightY, bottomRight.width() * 2, bottomRight.height() * 2),
-                                                             style->borderBottomWidth());
-                }
-
-                secondAngleStart = 270;
-                secondAngleSpan = lowerRightBorderStylesMatch ? 90 : 45;
+    switch (style) {
+        case BNONE:
+        case BHIDDEN:
+            return;
+        case DOTTED:
+        case DASHED:
+            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeStyle(style == DOTTED ? DottedStroke : DashedStroke);
+            graphicsContext->setStrokeThickness(thickness);
+            graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
+            break;
+        case DOUBLE: {
+            float third = thickness / 3.0f;
+            float innerThird = (thickness + 1.0f) / 6.0f;
+            int shiftForInner = static_cast<int>(innerThird * 2.5f);
 
-                // Draw lower right arc
-                drawBorderArc(graphicsContext, rightX, rightY, thickness, bottomRight, secondAngleStart, secondAngleSpan,
-                              BSBottom, bc, style->color(), bs, false);
-                if (applyRightInnerClip)
-                    graphicsContext->restore();
+            int outerY = y;
+            int outerHeight = radius.height() * 2;
+            int innerX = x + shiftForInner;
+            int innerY = y + shiftForInner;
+            int innerWidth = (radius.width() - shiftForInner) * 2;
+            int innerHeight = (radius.height() - shiftForInner) * 2;
+            if (innerThird > 1 && (s == BSTop || (firstCorner && (s == BSLeft || s == BSRight)))) {
+                outerHeight += 2;
+                innerHeight += 2;
             }
-        }
-    }
 
-    if (renderLeft) {
-        bool ignore_top = (renderRadii && topLeft.height() > 0) ||
-            (tc == lc && tt == lt && ls >= OUTSET &&
-             (ts == DOTTED || ts == DASHED || ts == SOLID || ts == OUTSET));
-
-        bool ignore_bottom = (renderRadii && bottomLeft.height() > 0) ||
-            (bc == lc && bt == lt && ls >= OUTSET &&
-             (bs == DOTTED || bs == DASHED || bs == SOLID || bs == INSET));
-
-        int y = ty;
-        int y2 = ty + h;
-        if (renderRadii) {
-            y += topLeft.height();
-            y2 -= bottomLeft.height();
+            graphicsContext->setStrokeStyle(SolidStroke);
+            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeThickness(third);
+            graphicsContext->strokeArc(IntRect(x, outerY, radius.width() * 2, outerHeight), angleStart, angleSpan);
+            graphicsContext->setStrokeThickness(innerThird > 2 ? innerThird - 1 : innerThird);
+            graphicsContext->strokeArc(IntRect(innerX, innerY, innerWidth, innerHeight), angleStart, angleSpan);
+            break;
         }
-
-        drawBorder(graphicsContext, tx, y, tx + style->borderLeftWidth(), y2, BSLeft, lc, style->color(), ls,
-                   ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
-
-        if (renderRadii && (!upperLeftBorderStylesMatch || !lowerLeftBorderStylesMatch)) {
-            int topX = tx;
-            thickness = style->borderLeftWidth() * 2;
-
-            if (!upperLeftBorderStylesMatch && topLeft.width()) {
-                int topY = ty;
-                bool applyTopInnerClip = (style->borderLeftWidth() < topLeft.width())
-                    && (style->borderTopWidth() < topLeft.height())
-                    && (ls != DOUBLE || style->borderLeftWidth() > 6);
-                if (applyTopInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(topX, topY, topLeft.width() * 2, topLeft.height() * 2),
-                                                             style->borderLeftWidth());
-                }
-
-                firstAngleStart = 135;
-                firstAngleSpan = 45;
-
-                // Draw top left arc
-                drawBorderArc(graphicsContext, topX, topY, thickness, topLeft, firstAngleStart, firstAngleSpan,
-                              BSLeft, lc, style->color(), ls, true);
-                if (applyTopInnerClip)
-                    graphicsContext->restore();
+        case GROOVE:
+        case RIDGE: {
+            Color c2;
+            if ((style == RIDGE && (s == BSTop || s == BSLeft)) ||
+                    (style == GROOVE && (s == BSBottom || s == BSRight)))
+                c2 = c.dark();
+            else {
+                c2 = c;
+                c = c.dark();
             }
 
-            if (!lowerLeftBorderStylesMatch && bottomLeft.width()) {
-                int bottomY = ty + h - bottomLeft.height() * 2;
-                bool applyBottomInnerClip = (style->borderLeftWidth() < bottomLeft.width())
-                    && (style->borderBottomWidth() < bottomLeft.height())
-                    && (ls != DOUBLE || style->borderLeftWidth() > 6);
-                if (applyBottomInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(topX, bottomY, bottomLeft.width() * 2, bottomLeft.height() * 2),
-                                                             style->borderLeftWidth());
-                }
-
-                secondAngleStart = 180;
-                secondAngleSpan = 45;
+            graphicsContext->setStrokeStyle(SolidStroke);
+            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeThickness(thickness);
+            graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
 
-                // Draw bottom left arc
-                drawBorderArc(graphicsContext, topX, bottomY, thickness, bottomLeft, secondAngleStart, secondAngleSpan,
-                              BSLeft, lc, style->color(), ls, false);
-                if (applyBottomInnerClip)
-                    graphicsContext->restore();
-            }
+            float halfThickness = (thickness + 1.0f) / 4.0f;
+            int shiftForInner = static_cast<int>(halfThickness * 1.5f);
+            graphicsContext->setStrokeColor(c2);
+            graphicsContext->setStrokeThickness(halfThickness > 2 ? halfThickness - 1 : halfThickness);
+            graphicsContext->strokeArc(IntRect(x + shiftForInner, y + shiftForInner, (radius.width() - shiftForInner) * 2,
+                                       (radius.height() - shiftForInner) * 2), angleStart, angleSpan);
+            break;
         }
+        case INSET:
+            if (s == BSTop || s == BSLeft)
+                c = c.dark();
+        case OUTSET:
+            if (style == OUTSET && (s == BSBottom || s == BSRight))
+                c = c.dark();
+        case SOLID:
+            graphicsContext->setStrokeStyle(SolidStroke);
+            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeThickness(thickness);
+            graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
+            break;
     }
+}
 
-    if (renderRight) {
-        bool ignore_top = (renderRadii && topRight.height() > 0) ||
-            ((tc == rc) && (tt == rt) &&
-            (rs >= DOTTED || rs == INSET) &&
-            (ts == DOTTED || ts == DASHED || ts == SOLID || ts == OUTSET));
-
-        bool ignore_bottom = (renderRadii && bottomRight.height() > 0) ||
-            ((bc == rc) && (bt == rt) &&
-            (rs >= DOTTED || rs == INSET) &&
-            (bs == DOTTED || bs == DASHED || bs == SOLID || bs == INSET));
-
-        int y = ty;
-        int y2 = ty + h;
-        if (renderRadii) {
-            y += topRight.height();
-            y2 -= bottomRight.height();
-        }
-
-        drawBorder(graphicsContext, tx + w - style->borderRightWidth(), y, tx + w, y2, BSRight, rc, style->color(), rs,
-                   ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
-
-        if (renderRadii && (!upperRightBorderStylesMatch || !lowerRightBorderStylesMatch)) {
-            thickness = style->borderRightWidth() * 2;
-
-            if (!upperRightBorderStylesMatch && topRight.width()) {
-                int topX = tx + w - topRight.width() * 2;
-                int topY = ty;
-                bool applyTopInnerClip = (style->borderRightWidth() < topRight.width())
-                    && (style->borderTopWidth() < topRight.height())
-                    && (rs != DOUBLE || style->borderRightWidth() > 6);
-                if (applyTopInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(topX, topY, topRight.width() * 2, topRight.height() * 2),
-                                                             style->borderRightWidth());
-                }
+void RenderObject::addPDFURLRect(GraphicsContext* context, const IntRect& rect)
+{
+    if (rect.isEmpty())
+        return;
+    Node* n = node();
+    if (!n || !n->isLink() || !n->isElementNode())
+        return;
+    const AtomicString& href = static_cast<Element*>(n)->getAttribute(hrefAttr);
+    if (href.isNull())
+        return;
+    context->setURLForRect(n->document()->completeURL(href), rect);
+}
 
-                firstAngleStart = 0;
-                firstAngleSpan = 45;
+void RenderObject::paintOutline(GraphicsContext* graphicsContext, int tx, int ty, int w, int h, const RenderStyle* style)
+{
+    if (!hasOutline())
+        return;
 
-                // Draw top right arc
-                drawBorderArc(graphicsContext, topX, topY, thickness, topRight, firstAngleStart, firstAngleSpan,
-                              BSRight, rc, style->color(), rs, true);
-                if (applyTopInnerClip)
-                    graphicsContext->restore();
-            }
+    int ow = style->outlineWidth();
+    EBorderStyle os = style->outlineStyle();
 
-            if (!lowerRightBorderStylesMatch && bottomRight.width()) {
-                int bottomX = tx + w - bottomRight.width() * 2;
-                int bottomY = ty + h - bottomRight.height() * 2;
-                bool applyBottomInnerClip = (style->borderRightWidth() < bottomRight.width())
-                    && (style->borderBottomWidth() < bottomRight.height())
-                    && (rs != DOUBLE || style->borderRightWidth() > 6);
-                if (applyBottomInnerClip) {
-                    graphicsContext->save();
-                    graphicsContext->addInnerRoundedRectClip(IntRect(bottomX, bottomY, bottomRight.width() * 2, bottomRight.height() * 2),
-                                                             style->borderRightWidth());
-                }
+    Color oc = style->outlineColor();
+    if (!oc.isValid())
+        oc = style->color();
 
-                secondAngleStart = 315;
-                secondAngleSpan = 45;
+    int offset = style->outlineOffset();
 
-                // Draw bottom right arc
-                drawBorderArc(graphicsContext, bottomX, bottomY, thickness, bottomRight, secondAngleStart, secondAngleSpan,
-                              BSRight, rc, style->color(), rs, false);
-                if (applyBottomInnerClip)
-                    graphicsContext->restore();
-            }
+    if (style->outlineStyleIsAuto() || hasOutlineAnnotation()) {
+        if (!theme()->supportsFocusRing(style)) {
+            // Only paint the focus ring by hand if the theme isn't able to draw the focus ring.
+            graphicsContext->initFocusRing(ow, offset);
+            addFocusRingRects(graphicsContext, tx, ty);
+            if (style->outlineStyleIsAuto())
+                graphicsContext->drawFocusRing(oc);
+            else
+                addPDFURLRect(graphicsContext, graphicsContext->focusRingBoundingRect());
+            graphicsContext->clearFocusRing();
         }
     }
 
-    if (renderRadii)
-        graphicsContext->restore();
-}
-
-void RenderObject::paintBoxShadow(GraphicsContext* context, int tx, int ty, int w, int h, const RenderStyle* s, bool begin, bool end)
-{
-    // FIXME: Deal with border-image.  Would be great to use border-image as a mask.
-
-    IntRect rect(tx, ty, w, h);
-    bool hasBorderRadius = s->hasBorderRadius();
-    bool hasOpaqueBackground = s->backgroundColor().isValid() && s->backgroundColor().alpha() == 255;
-    for (ShadowData* shadow = s->boxShadow(); shadow; shadow = shadow->next) {
-        context->save();
+    if (style->outlineStyleIsAuto() || style->outlineStyle() == BNONE)
+        return;
 
-        IntSize shadowOffset(shadow->x, shadow->y);
-        int shadowBlur = shadow->blur;
-        IntRect fillRect(rect);
+    tx -= offset;
+    ty -= offset;
+    w += 2 * offset;
+    h += 2 * offset;
 
-        if (hasBorderRadius) {
-            IntRect shadowRect(rect);
-            shadowRect.inflate(shadowBlur);
-            shadowRect.move(shadowOffset);
-            context->clip(shadowRect);
+    if (h < 0 || w < 0)
+        return;
 
-            // Move the fill just outside the clip, adding 1 pixel separation so that the fill does not
-            // bleed in (due to antialiasing) if the context is transformed.
-            IntSize extraOffset(w + max(0, shadowOffset.width()) + shadowBlur + 1, 0);
-            shadowOffset -= extraOffset;
-            fillRect.move(extraOffset);
-        }
+    drawLineForBoxSide(graphicsContext, tx - ow, ty - ow, tx, ty + h + ow,
+               BSLeft, Color(oc), style->color(), os, ow, ow);
 
-        context->setShadow(shadowOffset, shadowBlur, shadow->color);
-        if (hasBorderRadius) {
-            IntSize topLeft = begin ? s->borderTopLeftRadius() : IntSize();
-            IntSize topRight = end ? s->borderTopRightRadius() : IntSize();
-            IntSize bottomLeft = begin ? s->borderBottomLeftRadius() : IntSize();
-            IntSize bottomRight = end ? s->borderBottomRightRadius() : IntSize();
-            if (!hasOpaqueBackground)
-                context->clipOutRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
-            context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black);
-        } else {
-            if (!hasOpaqueBackground)
-                context->clipOut(rect);
-            context->fillRect(fillRect, Color::black);
-        }
-        context->restore();
-    }
-}
+    drawLineForBoxSide(graphicsContext, tx - ow, ty - ow, tx + w + ow, ty,
+               BSTop, Color(oc), style->color(), os, ow, ow);
 
-void RenderObject::addLineBoxRects(Vector<IntRect>&, unsigned, unsigned, bool)
-{
-}
+    drawLineForBoxSide(graphicsContext, tx + w, ty - ow, tx + w + ow, ty + h + ow,
+               BSRight, Color(oc), style->color(), os, ow, ow);
 
-void RenderObject::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel)
-{
-    // For blocks inside inlines, we go ahead and include margins so that we run right up to the
-    // inline boxes above and below us (thus getting merged with them to form a single irregular
-    // shape).
-    if (topLevel && continuation()) {
-        rects.append(IntRect(tx, ty - collapsedMarginTop(),
-                             width(), height() + collapsedMarginTop() + collapsedMarginBottom()));
-        continuation()->absoluteRects(rects,
-                                      tx - xPos() + continuation()->containingBlock()->xPos(),
-                                      ty - yPos() + continuation()->containingBlock()->yPos(), topLevel);
-    } else
-        rects.append(IntRect(tx, ty, width(), height() + borderTopExtra() + borderBottomExtra()));
+    drawLineForBoxSide(graphicsContext, tx - ow, ty + h, tx + w + ow, ty + h + ow,
+               BSBottom, Color(oc), style->color(), os, ow, ow);
 }
 
 IntRect RenderObject::absoluteBoundingBoxRect(bool useTransforms)
@@ -1751,24 +1052,6 @@ IntRect RenderObject::absoluteBoundingBoxRect(bool useTransforms)
     return result;
 }
 
-void RenderObject::collectAbsoluteLineBoxQuads(Vector<FloatQuad>&, unsigned, unsigned, bool)
-{
-}
-
-void RenderObject::absoluteQuads(Vector<FloatQuad>& quads, bool topLevel)
-{
-    // For blocks inside inlines, we go ahead and include margins so that we run right up to the
-    // inline boxes above and below us (thus getting merged with them to form a single irregular
-    // shape).
-    if (topLevel && continuation()) {
-        FloatRect localRect(0, -collapsedMarginTop(),
-                            width(), height() + collapsedMarginTop() + collapsedMarginBottom());
-        quads.append(localToAbsoluteQuad(localRect));
-        continuation()->absoluteQuads(quads, topLevel);
-    } else
-        quads.append(localToAbsoluteQuad(FloatRect(0, 0, width(), height() + borderTopExtra() + borderBottomExtra())));
-}
-
 void RenderObject::addAbsoluteRectForLayer(IntRect& result)
 {
     if (hasLayer())
@@ -1786,128 +1069,84 @@ IntRect RenderObject::paintingRootRect(IntRect& topLevelRect)
     return result;
 }
 
-void RenderObject::addPDFURLRect(GraphicsContext* context, const IntRect& rect)
-{
-    if (rect.isEmpty())
-        return;
-    Node* node = element();
-    if (!node || !node->isLink() || !node->isElementNode())
-        return;
-    const AtomicString& href = static_cast<Element*>(node)->getAttribute(hrefAttr);
-    if (href.isNull())
-        return;
-    context->setURLForRect(node->document()->completeURL(href), rect);
-}
-
-
-void RenderObject::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
+void RenderObject::paint(PaintInfo& /*paintInfo*/, int /*tx*/, int /*ty*/)
 {
-    // For blocks inside inlines, we go ahead and include margins so that we run right up to the
-    // inline boxes above and below us (thus getting merged with them to form a single irregular
-    // shape).
-    if (continuation()) {
-        graphicsContext->addFocusRingRect(IntRect(tx, ty - collapsedMarginTop(), width(), height() + collapsedMarginTop() + collapsedMarginBottom()));
-        continuation()->addFocusRingRects(graphicsContext,
-                                          tx - xPos() + continuation()->containingBlock()->xPos(),
-                                          ty - yPos() + continuation()->containingBlock()->yPos());
-    } else
-        graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
 }
 
-void RenderObject::paintOutline(GraphicsContext* graphicsContext, int tx, int ty, int w, int h, const RenderStyle* style)
+RenderBoxModelObject* RenderObject::containerForRepaint() const
 {
-    if (!hasOutline())
-        return;
-
-    int ow = style->outlineWidth();
-
-    EBorderStyle os = style->outlineStyle();
-
-    Color oc = style->outlineColor();
-    if (!oc.isValid())
-        oc = style->color();
-
-    int offset = style->outlineOffset();
-
-    if (style->outlineStyleIsAuto() || hasOutlineAnnotation()) {
-        if (!theme()->supportsFocusRing(style)) {
-            // Only paint the focus ring by hand if the theme isn't able to draw the focus ring.
-            graphicsContext->initFocusRing(ow, offset);
-            if (style->outlineStyleIsAuto())
-                addFocusRingRects(graphicsContext, tx, ty);
-            else
-                addPDFURLRect(graphicsContext, graphicsContext->focusRingBoundingRect());
-            graphicsContext->drawFocusRing(oc);
-            graphicsContext->clearFocusRing();
+#if USE(ACCELERATED_COMPOSITING)
+    if (RenderView* v = view()) {
+        if (v->usesCompositing()) {
+            RenderLayer* compLayer = enclosingLayer()->enclosingCompositingLayer();
+            return compLayer ? compLayer->renderer() : 0;
         }
     }
-
-    if (style->outlineStyleIsAuto() || style->outlineStyle() == BNONE)
-        return;
-
-    tx -= offset;
-    ty -= offset;
-    w += 2 * offset;
-    h += 2 * offset;
-
-    if (h < 0 || w < 0)
-        return;
-
-    drawBorder(graphicsContext, tx - ow, ty - ow, tx, ty + h + ow,
-               BSLeft, Color(oc), style->color(), os, ow, ow);
-
-    drawBorder(graphicsContext, tx - ow, ty - ow, tx + w + ow, ty,
-               BSTop, Color(oc), style->color(), os, ow, ow);
-
-    drawBorder(graphicsContext, tx + w, ty - ow, tx + w + ow, ty + h + ow,
-               BSRight, Color(oc), style->color(), os, ow, ow);
-
-    drawBorder(graphicsContext, tx - ow, ty + h, tx + w + ow, ty + h + ow,
-               BSBottom, Color(oc), style->color(), os, ow, ow);
+#endif
+    // Do root-relative repaint.
+    return 0;
 }
 
-void RenderObject::paint(PaintInfo& /*paintInfo*/, int /*tx*/, int /*ty*/)
+void RenderObject::repaintUsingContainer(RenderBoxModelObject* repaintContainer, const IntRect& r, bool immediate)
 {
+    if (!repaintContainer || repaintContainer->isRenderView()) {
+        RenderView* v = repaintContainer ? toRenderView(repaintContainer) : view();
+        v->repaintViewRectangle(r, immediate);
+    } else {
+#if USE(ACCELERATED_COMPOSITING)
+        RenderView* v = view();
+        if (v->usesCompositing()) {
+            ASSERT(repaintContainer->hasLayer() && repaintContainer->layer()->isComposited());
+            repaintContainer->layer()->setBackingNeedsRepaintInRect(r);
+        }
+#else
+        ASSERT_NOT_REACHED();
+#endif
+    }
 }
 
 void RenderObject::repaint(bool immediate)
 {
-    // Can't use view(), since we might be unrooted.
-    RenderObject* o = this;
-    while (o->parent())
-        o = o->parent();
-    if (!o->isRenderView())
+    // Don't repaint if we're unrooted (note that view() still returns the view when unrooted)
+    RenderView* view;
+    if (!isRooted(&view))
         return;
-    RenderView* view = static_cast<RenderView*>(o);
+
     if (view->printing())
         return; // Don't repaint if we're printing.
-    view->repaintViewRectangle(absoluteClippedOverflowRect(), immediate);
+
+    RenderBoxModelObject* repaintContainer = containerForRepaint();
+    repaintUsingContainer(repaintContainer ? repaintContainer : view, clippedOverflowRectForRepaint(repaintContainer), immediate);
 }
 
 void RenderObject::repaintRectangle(const IntRect& r, bool immediate)
 {
-    // Can't use view(), since we might be unrooted.
-    RenderObject* o = this;
-    while (o->parent())
-        o = o->parent();
-    if (!o->isRenderView())
+    // Don't repaint if we're unrooted (note that view() still returns the view when unrooted)
+    RenderView* view;
+    if (!isRooted(&view))
         return;
-    RenderView* view = static_cast<RenderView*>(o);
+
     if (view->printing())
         return; // Don't repaint if we're printing.
-    IntRect absRect(r);
-    absRect.move(view->layoutDelta());
-    computeAbsoluteRepaintRect(absRect);
-    view->repaintViewRectangle(absRect, immediate);
+
+    IntRect dirtyRect(r);
+
+    // FIXME: layoutDelta needs to be applied in parts before/after transforms and
+    // repaint containers. https://bugs.webkit.org/show_bug.cgi?id=23308
+    dirtyRect.move(view->layoutDelta());
+
+    RenderBoxModelObject* repaintContainer = containerForRepaint();
+    computeRectForRepaint(repaintContainer, dirtyRect);
+    repaintUsingContainer(repaintContainer ? repaintContainer : view, dirtyRect, immediate);
 }
 
-bool RenderObject::repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const IntRect& oldOutlineBox)
+bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintContainer, const IntRect& oldBounds, const IntRect& oldOutlineBox)
 {
     RenderView* v = view();
     if (v->printing())
         return false; // Don't repaint if we're printing.
 
-    IntRect newBounds = absoluteClippedOverflowRect();
+    IntRect newBounds = clippedOverflowRectForRepaint(repaintContainer);
     IntRect newOutlineBox;
 
     bool fullRepaint = selfNeedsLayout();
@@ -1915,14 +1154,18 @@ bool RenderObject::repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const In
     if (!fullRepaint && style()->borderFit() == BorderFitLines)
         fullRepaint = true;
     if (!fullRepaint) {
-        newOutlineBox = absoluteOutlineBounds();
+        newOutlineBox = outlineBoundsForRepaint(repaintContainer);
         if (newOutlineBox.location() != oldOutlineBox.location() || (mustRepaintBackgroundOrBorder() && (newBounds != oldBounds || newOutlineBox != oldOutlineBox)))
             fullRepaint = true;
     }
+
+    if (!repaintContainer)
+        repaintContainer = v;
+
     if (fullRepaint) {
-        v->repaintViewRectangle(oldBounds);
+        repaintUsingContainer(repaintContainer, oldBounds);
         if (newBounds != oldBounds)
-            v->repaintViewRectangle(newBounds);
+            repaintUsingContainer(repaintContainer, newBounds);
         return true;
     }
 
@@ -1931,34 +1174,34 @@ bool RenderObject::repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const In
 
     int deltaLeft = newBounds.x() - oldBounds.x();
     if (deltaLeft > 0)
-        v->repaintViewRectangle(IntRect(oldBounds.x(), oldBounds.y(), deltaLeft, oldBounds.height()));
+        repaintUsingContainer(repaintContainer, IntRect(oldBounds.x(), oldBounds.y(), deltaLeft, oldBounds.height()));
     else if (deltaLeft < 0)
-        v->repaintViewRectangle(IntRect(newBounds.x(), newBounds.y(), -deltaLeft, newBounds.height()));
+        repaintUsingContainer(repaintContainer, IntRect(newBounds.x(), newBounds.y(), -deltaLeft, newBounds.height()));
 
     int deltaRight = newBounds.right() - oldBounds.right();
     if (deltaRight > 0)
-        v->repaintViewRectangle(IntRect(oldBounds.right(), newBounds.y(), deltaRight, newBounds.height()));
+        repaintUsingContainer(repaintContainer, IntRect(oldBounds.right(), newBounds.y(), deltaRight, newBounds.height()));
     else if (deltaRight < 0)
-        v->repaintViewRectangle(IntRect(newBounds.right(), oldBounds.y(), -deltaRight, oldBounds.height()));
+        repaintUsingContainer(repaintContainer, IntRect(newBounds.right(), oldBounds.y(), -deltaRight, oldBounds.height()));
 
     int deltaTop = newBounds.y() - oldBounds.y();
     if (deltaTop > 0)
-        v->repaintViewRectangle(IntRect(oldBounds.x(), oldBounds.y(), oldBounds.width(), deltaTop));
+        repaintUsingContainer(repaintContainer, IntRect(oldBounds.x(), oldBounds.y(), oldBounds.width(), deltaTop));
     else if (deltaTop < 0)
-        v->repaintViewRectangle(IntRect(newBounds.x(), newBounds.y(), newBounds.width(), -deltaTop));
+        repaintUsingContainer(repaintContainer, IntRect(newBounds.x(), newBounds.y(), newBounds.width(), -deltaTop));
 
     int deltaBottom = newBounds.bottom() - oldBounds.bottom();
     if (deltaBottom > 0)
-        v->repaintViewRectangle(IntRect(newBounds.x(), oldBounds.bottom(), newBounds.width(), deltaBottom));
+        repaintUsingContainer(repaintContainer, IntRect(newBounds.x(), oldBounds.bottom(), newBounds.width(), deltaBottom));
     else if (deltaBottom < 0)
-        v->repaintViewRectangle(IntRect(oldBounds.x(), newBounds.bottom(), oldBounds.width(), -deltaBottom));
+        repaintUsingContainer(repaintContainer, IntRect(oldBounds.x(), newBounds.bottom(), oldBounds.width(), -deltaBottom));
 
     if (newOutlineBox == oldOutlineBox)
         return false;
 
     // We didn't move, but we did change size.  Invalidate the delta, which will consist of possibly
     // two rectangles (but typically only one).
-    RenderStyle* outlineStyle = !isInline() && continuation() ? continuation()->style() : style();
+    RenderStyle* outlineStyle = outlineStyleForRepaint();
     int ow = outlineStyle->outlineSize();
     ShadowData* boxShadow = style()->boxShadow();
     int width = abs(newOutlineBox.width() - oldOutlineBox.width());
@@ -1967,7 +1210,8 @@ bool RenderObject::repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const In
         for (ShadowData* shadow = boxShadow; shadow; shadow = shadow->next)
             shadowRight = max(shadow->x + shadow->blur, shadowRight);
 
-        int borderWidth = max(-outlineStyle->outlineOffset(), max(borderRight(), max(style()->borderTopRightRadius().width(), style()->borderBottomRightRadius().width()))) + max(ow, shadowRight);
+        int borderRight = isBox() ? toRenderBox(this)->borderRight() : 0;
+        int borderWidth = max(-outlineStyle->outlineOffset(), max(borderRight, max(style()->borderTopRightRadius().width(), style()->borderBottomRightRadius().width()))) + max(ow, shadowRight);
         IntRect rightRect(newOutlineBox.x() + min(newOutlineBox.width(), oldOutlineBox.width()) - borderWidth,
             newOutlineBox.y(),
             width + borderWidth,
@@ -1975,7 +1219,7 @@ bool RenderObject::repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const In
         int right = min(newBounds.right(), oldBounds.right());
         if (rightRect.x() < right) {
             rightRect.setWidth(min(rightRect.width(), right - rightRect.x()));
-            v->repaintViewRectangle(rightRect);
+            repaintUsingContainer(repaintContainer, rightRect);
         }
     }
     int height = abs(newOutlineBox.height() - oldOutlineBox.height());
@@ -1984,7 +1228,8 @@ bool RenderObject::repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const In
         for (ShadowData* shadow = boxShadow; shadow; shadow = shadow->next)
             shadowBottom = max(shadow->y + shadow->blur, shadowBottom);
 
-        int borderHeight = max(-outlineStyle->outlineOffset(), max(borderBottom(), max(style()->borderBottomLeftRadius().height(), style()->borderBottomRightRadius().height()))) + max(ow, shadowBottom);
+        int borderBottom = isBox() ? toRenderBox(this)->borderBottom() : 0;
+        int borderHeight = max(-outlineStyle->outlineOffset(), max(borderBottom, max(style()->borderBottomLeftRadius().height(), style()->borderBottomRightRadius().height()))) + max(ow, shadowBottom);
         IntRect bottomRect(newOutlineBox.x(),
             min(newOutlineBox.bottom(), oldOutlineBox.bottom()) - borderHeight,
             max(newOutlineBox.width(), oldOutlineBox.width()),
@@ -1992,7 +1237,7 @@ bool RenderObject::repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const In
         int bottom = min(newBounds.bottom(), oldBounds.bottom());
         if (bottomRect.y() < bottom) {
             bottomRect.setHeight(min(bottomRect.height(), bottom - bottomRect.y()));
-            v->repaintViewRectangle(bottomRect);
+            repaintUsingContainer(repaintContainer, bottomRect);
         }
     }
     return false;
@@ -2014,36 +1259,27 @@ bool RenderObject::checkForRepaintDuringLayout() const
     return !document()->view()->needsFullRepaint() && !hasLayer();
 }
 
-IntRect RenderObject::getAbsoluteRepaintRectWithOutline(int ow)
+IntRect RenderObject::rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth)
 {
-    IntRect r(absoluteClippedOverflowRect());
-    r.inflate(ow);
-
-    if (continuation() && !isInline())
-        r.inflateY(collapsedMarginTop());
-
-    if (isInlineFlow()) {
-        for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-            if (!curr->isText())
-                r.unite(curr->getAbsoluteRepaintRectWithOutline(ow));
-        }
-    }
-
+    IntRect r(clippedOverflowRectForRepaint(repaintContainer));
+    r.inflate(outlineWidth);
     return r;
 }
 
-IntRect RenderObject::absoluteClippedOverflowRect()
+IntRect RenderObject::clippedOverflowRectForRepaint(RenderBoxModelObject*)
 {
-    if (parent())
-        return parent()->absoluteClippedOverflowRect();
+    ASSERT_NOT_REACHED();
     return IntRect();
 }
 
-void RenderObject::computeAbsoluteRepaintRect(IntRect& rect, bool fixed)
+void RenderObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed)
 {
+    if (repaintContainer == this)
+        return;
+
     if (RenderObject* o = parent()) {
         if (o->isBlockFlow()) {
-            RenderBlock* cb = static_cast<RenderBlock*>(o);
+            RenderBlock* cb = toRenderBlock(o);
             if (cb->hasColumns())
                 cb->adjustRectForColumns(rect);
         }
@@ -2052,17 +1288,19 @@ void RenderObject::computeAbsoluteRepaintRect(IntRect& rect, bool fixed)
             // o->height() is inaccurate if we're in the middle of a layout of |o|, so use the
             // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
             // anyway if its size does change.
-            IntRect boxRect(0, 0, o->layer()->width(), o->layer()->height());
+            RenderBox* boxParent = toRenderBox(o);
+
+            IntRect boxRect(0, 0, boxParent->layer()->width(), boxParent->layer()->height());
             int x = rect.x();
             int y = rect.y();
-            o->layer()->subtractScrolledContentOffset(x, y); // For overflow:auto/scroll/hidden.
+            boxParent->layer()->subtractScrolledContentOffset(x, y); // For overflow:auto/scroll/hidden.
             IntRect repaintRect(x, y, rect.width(), rect.height());
             rect = intersection(repaintRect, boxRect);
             if (rect.isEmpty())
                 return;
         }
 
-        o->computeAbsoluteRepaintRect(rect, fixed);
+        o->computeRectForRepaint(repaintContainer, rect, fixed);
     }
 }
 
@@ -2074,8 +1312,8 @@ void RenderObject::dirtyLinesFromChangedChild(RenderObject*)
 
 void RenderObject::showTreeForThis() const
 {
-    if (element())
-        element()->showTreeForThis();
+    if (node())
+        node()->showTreeForThis();
 }
 
 #endif // NDEBUG
@@ -2084,7 +1322,7 @@ Color RenderObject::selectionBackgroundColor() const
 {
     Color color;
     if (style()->userSelect() != SELECT_NONE) {
-        RenderStyle* pseudoStyle = getCachedPseudoStyle(RenderStyle::SELECTION);
+         RefPtr<RenderStyle> pseudoStyle = getUncachedPseudoStyle(SELECTION);
         if (pseudoStyle && pseudoStyle->backgroundColor().isValid())
             color = pseudoStyle->backgroundColor().blendWithWhite();
         else
@@ -2102,14 +1340,14 @@ Color RenderObject::selectionForegroundColor() const
     if (style()->userSelect() == SELECT_NONE)
         return color;
 
-    if (RenderStyle* pseudoStyle = getCachedPseudoStyle(RenderStyle::SELECTION)) {
+    if (RefPtr<RenderStyle> pseudoStyle = getUncachedPseudoStyle(SELECTION)) {
         color = pseudoStyle->textFillColor();
         if (!color.isValid())
             color = pseudoStyle->color();
     } else
         color = document()->frame()->selection()->isFocusedAndActive() ?
-                theme()->platformActiveSelectionForegroundColor() :
-                theme()->platformInactiveSelectionForegroundColor();
+                theme()->activeSelectionForegroundColor() :
+                theme()->inactiveSelectionForegroundColor();
 
     return color;
 }
@@ -2120,7 +1358,7 @@ Node* RenderObject::draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& d
         return 0;
 
     for (const RenderObject* curr = this; curr; curr = curr->parent()) {
-        Node* elt = curr->element();
+        Node* elt = curr->node();
         if (elt && elt->nodeType() == Node::TEXT_NODE) {
             // Since there's no way for the author to address the -webkit-user-drag style for a text node,
             // we use our own judgement.
@@ -2154,17 +1392,6 @@ void RenderObject::selectionStartEnd(int& spos, int& epos) const
     view()->selectionStartEnd(spos, epos);
 }
 
-RenderBlock* RenderObject::createAnonymousBlock()
-{
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(m_style.get());
-    newStyle->setDisplay(BLOCK);
-
-    RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
-    newBox->setStyle(newStyle.release());
-    return newBox;
-}
-
 void RenderObject::handleDynamicFloatPositionChange()
 {
     // We have gone from not affecting the inline status of the parent flow to suddenly
@@ -2172,30 +1399,14 @@ void RenderObject::handleDynamicFloatPositionChange()
     // childrenInline() state and our state.
     setInline(style()->isDisplayInlineType());
     if (isInline() != parent()->childrenInline()) {
-        if (!isInline()) {
-            if (parent()->isRenderInline()) {
-                // We have to split the parent flow.
-                RenderInline* parentInline = static_cast<RenderInline*>(parent());
-                RenderBlock* newBox = parentInline->createAnonymousBlock();
-
-                RenderFlow* oldContinuation = parent()->continuation();
-                parentInline->setContinuation(newBox);
-
-                RenderObject* beforeChild = nextSibling();
-                parent()->removeChildNode(this);
-                parentInline->splitFlow(beforeChild, newBox, this, oldContinuation);
-            } else if (parent()->isRenderBlock()) {
-                RenderBlock* o = static_cast<RenderBlock*>(parent());
-                o->makeChildrenNonInline();
-                if (o->isAnonymousBlock() && o->parent())
-                    o->parent()->removeLeftoverAnonymousBlock(o);
-                // o may be dead here
-            }
-        } else {
+        if (!isInline())
+            toRenderBoxModelObject(parent())->childBecameNonInline(this);
+        else {
             // An anonymous block must be made to wrap this inline.
-            RenderBlock* box = createAnonymousBlock();
-            parent()->insertChildNode(box, this);
-            box->appendChildNode(parent()->removeChildNode(this));
+            RenderBlock* block = toRenderBlock(parent())->createAnonymousBlock();
+            RenderObjectChildList* childlist = parent()->virtualChildren();
+            childlist->insertChildNode(parent(), block, this);
+            block->children()->appendChildNode(block, childlist->removeChildNode(parent(), this));
         }
     }
 }
@@ -2208,18 +1419,50 @@ void RenderObject::setAnimatableStyle(PassRefPtr<RenderStyle> style)
         setStyle(style);
 }
 
+StyleDifference RenderObject::adjustStyleDifference(StyleDifference diff, unsigned contextSensitiveProperties) const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    // If transform changed, and we are not composited, need to do a layout.
+    if (contextSensitiveProperties & ContextSensitivePropertyTransform) {
+        // Text nodes share style with their parents but transforms don't apply to them,
+        // hence the !isText() check.
+        // FIXME: when transforms are taken into account for overflow, we will need to do a layout.
+        if (!isText() && (!hasLayer() || !toRenderBoxModelObject(this)->layer()->isComposited()))
+            diff = StyleDifferenceLayout;
+        else if (diff < StyleDifferenceRecompositeLayer)
+            diff = StyleDifferenceRecompositeLayer;
+    }
+
+    // If opacity changed, and we are not composited, need to repaint (also
+    // ignoring text nodes)
+    if (contextSensitiveProperties & ContextSensitivePropertyOpacity) {
+        if (!isText() && (!hasLayer() || !toRenderBoxModelObject(this)->layer()->isComposited()))
+            diff = StyleDifferenceRepaintLayer;
+        else if (diff < StyleDifferenceRecompositeLayer)
+            diff = StyleDifferenceRecompositeLayer;
+    }
+#else
+    UNUSED_PARAM(contextSensitiveProperties);
+#endif
+
+    // If we have no layer(), just treat a RepaintLayer hint as a normal Repaint.
+    if (diff == StyleDifferenceRepaintLayer && !hasLayer())
+        diff = StyleDifferenceRepaint;
+
+    return diff;
+}
+
 void RenderObject::setStyle(PassRefPtr<RenderStyle> style)
 {
     if (m_style == style)
         return;
 
-    RenderStyle::Diff diff = RenderStyle::Equal;
+    StyleDifference diff = StyleDifferenceEqual;
+    unsigned contextSensitiveProperties = ContextSensitivePropertyNone;
     if (m_style)
-        diff = m_style->diff(style.get());
+        diff = m_style->diff(style.get(), contextSensitiveProperties);
 
-    // If we have no layer(), just treat a RepaintLayer hint as a normal Repaint.
-    if (diff == RenderStyle::RepaintLayer && !hasLayer())
-        diff = RenderStyle::Repaint;
+    diff = adjustStyleDifference(diff, contextSensitiveProperties);
 
     styleWillChange(diff, style.get());
     
@@ -2232,7 +1475,32 @@ void RenderObject::setStyle(PassRefPtr<RenderStyle> style)
     updateImage(oldStyle ? oldStyle->borderImage().image() : 0, m_style ? m_style->borderImage().image() : 0);
     updateImage(oldStyle ? oldStyle->maskBoxImage().image() : 0, m_style ? m_style->maskBoxImage().image() : 0);
 
+    // We need to ensure that view->maximalOutlineSize() is valid for any repaints that happen
+    // during styleDidChange (it's used by clippedOverflowRectForRepaint()).
+    if (m_style->outlineWidth() > 0 && m_style->outlineSize() > maximalOutlineSize(PaintPhaseOutline))
+        toRenderView(document()->renderer())->setMaximalOutlineSize(m_style->outlineSize());
+
     styleDidChange(diff, oldStyle.get());
+
+    if (!m_parent || isText())
+        return;
+
+    // Now that the layer (if any) has been updated, we need to adjust the diff again,
+    // check whether we should layout now, and decide if we need to repaint.
+    StyleDifference updatedDiff = adjustStyleDifference(diff, contextSensitiveProperties);
+    
+    if (diff <= StyleDifferenceLayoutPositionedMovementOnly) {
+        if (updatedDiff == StyleDifferenceLayout)
+            setNeedsLayoutAndPrefWidthsRecalc();
+        else if (updatedDiff == StyleDifferenceLayoutPositionedMovementOnly)
+            setNeedsPositionedMovementLayout();
+    }
+    
+    if (updatedDiff == StyleDifferenceRepaintLayer || updatedDiff == StyleDifferenceRepaint) {
+        // Do a repaint with the new style now, e.g., for example if we go from
+        // not having an outline to having an outline.
+        repaint();
+    }
 }
 
 void RenderObject::setStyleInternal(PassRefPtr<RenderStyle> style)
@@ -2240,120 +1508,53 @@ void RenderObject::setStyleInternal(PassRefPtr<RenderStyle> style)
     m_style = style;
 }
 
-void RenderObject::styleWillChange(RenderStyle::Diff diff, const RenderStyle* newStyle)
+void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     if (m_style) {
         // If our z-index changes value or our visibility changes,
         // we need to dirty our stacking context's z-order list.
         if (newStyle) {
+            bool visibilityChanged = m_style->visibility() != newStyle->visibility() 
+                || m_style->zIndex() != newStyle->zIndex() 
+                || m_style->hasAutoZIndex() != newStyle->hasAutoZIndex();
 #if ENABLE(DASHBOARD_SUPPORT)
-            if (m_style->visibility() != newStyle->visibility() ||
-                    m_style->zIndex() != newStyle->zIndex() ||
-                    m_style->hasAutoZIndex() != newStyle->hasAutoZIndex())
+            if (visibilityChanged)
                 document()->setDashboardRegionsDirty(true);
 #endif
+            if (visibilityChanged && AXObjectCache::accessibilityEnabled())
+                document()->axObjectCache()->childrenChanged(this);
 
-            if ((m_style->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
-                    m_style->zIndex() != newStyle->zIndex() ||
-                    m_style->visibility() != newStyle->visibility()) && hasLayer()) {
-                layer()->dirtyStackingContextZOrderLists();
-                if (m_style->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
-                        m_style->visibility() != newStyle->visibility())
-                    layer()->dirtyZOrderLists();
-            }
-            // keep layer hierarchy visibility bits up to date if visibility changes
+            // Keep layer hierarchy visibility bits up to date if visibility changes.
             if (m_style->visibility() != newStyle->visibility()) {
                 if (RenderLayer* l = enclosingLayer()) {
                     if (newStyle->visibility() == VISIBLE)
                         l->setHasVisibleContent(true);
                     else if (l->hasVisibleContent() && (this == l->renderer() || l->renderer()->style()->visibility() != VISIBLE)) {
                         l->dirtyVisibleContentStatus();
-                        if (diff > RenderStyle::RepaintLayer)
+                        if (diff > StyleDifferenceRepaintLayer)
                             repaint();
                     }
                 }
             }
         }
 
-        // The background of the root element or the body element could propagate up to
-        // the canvas.  Just dirty the entire canvas when our style changes substantially.
-        if (diff >= RenderStyle::Repaint && element() &&
-                (element()->hasTagName(htmlTag) || element()->hasTagName(bodyTag)))
-            view()->repaint();
-        else if (m_parent && !isText()) {
-            // Do a repaint with the old style first, e.g., for example if we go from
-            // having an outline to not having an outline.
-            if (diff == RenderStyle::RepaintLayer) {
-                layer()->repaintIncludingDescendants();
-                if (!(m_style->clip() == newStyle->clip()))
-                    layer()->clearClipRectsIncludingDescendants();
-            } else if (diff == RenderStyle::Repaint || newStyle->outlineSize() < m_style->outlineSize())
-                repaint();
-        }
-
-        if (diff == RenderStyle::Layout) {
-            // When a layout hint happens, we go ahead and do a repaint of the layer, since the layer could
-            // end up being destroyed.
-            if (hasLayer()) {
-                if (m_style->position() != newStyle->position() ||
-                    m_style->zIndex() != newStyle->zIndex() ||
-                    m_style->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
-                    !(m_style->clip() == newStyle->clip()) ||
-                    m_style->hasClip() != newStyle->hasClip() ||
-                    m_style->opacity() != newStyle->opacity() ||
-                    m_style->transform() != newStyle->transform())
-                layer()->repaintIncludingDescendants();
-            } else if (newStyle->hasTransform() || newStyle->opacity() < 1) {
-                // If we don't have a layer yet, but we are going to get one because of transform or opacity,
-                //  then we need to repaint the old position of the object.
-                repaint();
-            }
-        }
-        
-        // When a layout hint happens and an object's position style changes, we have to do a layout
-        // to dirty the render tree using the old position value now.
-        if (diff == RenderStyle::Layout && m_parent && m_style->position() != newStyle->position()) {
-            markContainingBlocksForLayout();
-            if (m_style->position() == StaticPosition)
-                repaint();
-            if (isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
-                removeFromObjectLists();
-            if (isRenderBlock()) {
-                if (newStyle->position() == StaticPosition)
-                    // Clear our positioned objects list. Our absolutely positioned descendants will be
-                    // inserted into our containing block's positioned objects list during layout.
-                    removePositionedObjects(0);
-                else if (m_style->position() == StaticPosition) {
-                    // Remove our absolutely positioned descendants from their current containing block.
-                    // They will be inserted into our positioned objects list during layout.
-                    RenderObject* cb = parent();
-                    while (cb && (cb->style()->position() == StaticPosition || (cb->isInline() && !cb->isReplaced())) && !cb->isRenderView()) {
-                        if (cb->style()->position() == RelativePosition && cb->isInline() && !cb->isReplaced()) {
-                            cb = cb->containingBlock();
-                            break;
-                        }
-                        cb = cb->parent();
-                    }
-                    cb->removePositionedObjects(static_cast<RenderBlock*>(this));
-                }
-            }
-        }
-
+        if (m_parent && (diff == StyleDifferenceRepaint || newStyle->outlineSize() < m_style->outlineSize()))
+            repaint();
         if (isFloating() && (m_style->floating() != newStyle->floating()))
             // For changes in float styles, we need to conceivably remove ourselves
             // from the floating objects list.
-            removeFromObjectLists();
+            toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
         else if (isPositioned() && (newStyle->position() != AbsolutePosition && newStyle->position() != FixedPosition))
             // For changes in positioning styles, we need to conceivably remove ourselves
             // from the positioned objects list.
-            removeFromObjectLists();
+            toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
 
         s_affectsParentBlock = isFloatingOrPositioned() &&
             (!newStyle->isFloating() && newStyle->position() != AbsolutePosition && newStyle->position() != FixedPosition)
-            && parent() && (parent()->isBlockFlow() || parent()->isInlineFlow());
+            && parent() && (parent()->isBlockFlow() || parent()->isRenderInline());
 
         // reset style flags
-        if (diff == RenderStyle::Layout || diff == RenderStyle::LayoutPositionedMovementOnly) {
+        if (diff == StyleDifferenceLayout || diff == StyleDifferenceLayoutPositionedMovementOnly) {
             m_floating = false;
             m_positioned = false;
             m_relPositioned = false;
@@ -2379,25 +1580,21 @@ void RenderObject::styleWillChange(RenderStyle::Diff diff, const RenderStyle* ne
     }
 }
 
-void RenderObject::styleDidChange(RenderStyle::Diff diff, const RenderStyle*)
+void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle*)
 {
-    setHasBoxDecorations(m_style->hasBorder() || m_style->hasBackground() || m_style->hasAppearance() || m_style->boxShadow());
-
     if (s_affectsParentBlock)
         handleDynamicFloatPositionChange();
 
-    // No need to ever schedule repaints from a style change of a text run, since
-    // we already did this for the parent of the text run.
-    // We do have to schedule layouts, though, since a style change can force us to
-    // need to relayout.
-    if (diff == RenderStyle::Layout && m_parent)
+    if (!m_parent)
+        return;
+    
+    if (diff == StyleDifferenceLayout)
         setNeedsLayoutAndPrefWidthsRecalc();
-    else if (diff == RenderStyle::LayoutPositionedMovementOnly && m_parent && !isText())
+    else if (diff == StyleDifferenceLayoutPositionedMovementOnly)
         setNeedsPositionedMovementLayout();
-    else if (m_parent && !isText() && (diff == RenderStyle::RepaintLayer || diff == RenderStyle::Repaint))
-        // Do a repaint with the new style now, e.g., for example if we go from
-        // not having an outline to having an outline.
-        repaint();
+
+    // Don't check for repaint here; we need to wait until the layer has been
+    // updated by subclasses before we know if we have to repaint (in setStyle()).
 }
 
 void RenderObject::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers)
@@ -2430,42 +1627,92 @@ IntRect RenderObject::viewRect() const
 
 FloatPoint RenderObject::localToAbsolute(FloatPoint localPoint, bool fixed, bool useTransforms) const
 {
+    TransformState transformState(TransformState::ApplyTransformDirection, localPoint);
+    mapLocalToContainer(0, fixed, useTransforms, transformState);
+    transformState.flatten();
+    
+    return transformState.lastPlanarPoint();
+}
+
+FloatPoint RenderObject::absoluteToLocal(FloatPoint containerPoint, bool fixed, bool useTransforms) const
+{
+    TransformState transformState(TransformState::UnapplyInverseTransformDirection, containerPoint);
+    mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
+    transformState.flatten();
+    
+    return transformState.lastPlanarPoint();
+}
+
+void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
+{
+    if (repaintContainer == this)
+        return;
+
     RenderObject* o = parent();
-    if (o) {
-        localPoint.move(0.0f, static_cast<float>(o->borderTopExtra()));
-        if (o->hasOverflowClip())
-            localPoint -= o->layer()->scrolledContentOffset();
-        return o->localToAbsolute(localPoint, fixed, useTransforms);
-    }
+    if (!o)
+        return;
 
-    return FloatPoint();
+    if (o->hasOverflowClip())
+        transformState.move(-toRenderBox(o)->layer()->scrolledContentOffset());
+
+    o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
 
-FloatPoint RenderObject::absoluteToLocal(FloatPoint containerPoint, bool fixed, bool useTransforms) const
+void RenderObject::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
 {
     RenderObject* o = parent();
     if (o) {
-        FloatPoint localPoint = o->absoluteToLocal(containerPoint, fixed, useTransforms);
-        localPoint.move(0.0f, -static_cast<float>(o->borderTopExtra()));
+        o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
         if (o->hasOverflowClip())
-            localPoint += o->layer()->scrolledContentOffset();
-        return localPoint;
+            transformState.move(toRenderBox(o)->layer()->scrolledContentOffset());
     }
-    return FloatPoint();
 }
 
-FloatQuad RenderObject::localToAbsoluteQuad(const FloatQuad& localQuad, bool fixed) const
+bool RenderObject::shouldUseTransformFromContainer(const RenderObject* containerObject) const
 {
-    RenderObject* o = parent();
-    if (o) {
-        FloatQuad quad = localQuad;
-        quad.move(0.0f, static_cast<float>(o->borderTopExtra()));
-        if (o->hasOverflowClip())
-            quad -= o->layer()->scrolledContentOffset();
-        return o->localToAbsoluteQuad(quad, fixed);
+#if ENABLE(3D_RENDERING)
+    // hasTransform() indicates whether the object has transform, transform-style or perspective. We just care about transform,
+    // so check the layer's transform directly.
+    return (hasLayer() && toRenderBoxModelObject(this)->layer()->transform()) || (containerObject && containerObject->style()->hasPerspective());
+#else
+    UNUSED_PARAM(containerObject);
+    return hasTransform();
+#endif
+}
+
+void RenderObject::getTransformFromContainer(const RenderObject* containerObject, const IntSize& offsetInContainer, TransformationMatrix& transform) const
+{
+    transform.makeIdentity();
+    transform.translate(offsetInContainer.width(), offsetInContainer.height());
+    RenderLayer* layer;
+    if (hasLayer() && (layer = toRenderBoxModelObject(this)->layer()) && layer->transform())
+        transform.multLeft(layer->currentTransform());
+    
+#if ENABLE(3D_RENDERING)
+    if (containerObject && containerObject->style()->hasPerspective()) {
+        // Perpsective on the container affects us, so we have to factor it in here.
+        ASSERT(containerObject->hasLayer());
+        FloatPoint perspectiveOrigin = toRenderBox(containerObject)->layer()->perspectiveOrigin();
+
+        TransformationMatrix perspectiveMatrix;
+        perspectiveMatrix.applyPerspective(containerObject->style()->perspective());
+        
+        transform.translateRight3d(-perspectiveOrigin.x(), -perspectiveOrigin.y(), 0);
+        transform.multiply(perspectiveMatrix);
+        transform.translateRight3d(perspectiveOrigin.x(), perspectiveOrigin.y(), 0);
     }
+#else
+    UNUSED_PARAM(containerObject);
+#endif
+}
 
-    return FloatQuad();
+FloatQuad RenderObject::localToContainerQuad(const FloatQuad& localQuad, RenderBoxModelObject* repaintContainer, bool fixed) const
+{
+    TransformState transformState(TransformState::ApplyTransformDirection, FloatPoint(), &localQuad);
+    mapLocalToContainer(repaintContainer, fixed, true, transformState);
+    transformState.flatten();
+    
+    return transformState.lastPlanarQuad();
 }
 
 IntSize RenderObject::offsetFromContainer(RenderObject* o) const
@@ -2473,10 +1720,8 @@ IntSize RenderObject::offsetFromContainer(RenderObject* o) const
     ASSERT(o == container());
 
     IntSize offset;
-    offset.expand(0, o->borderTopExtra());
-
     if (o->hasOverflowClip())
-        offset -= o->layer()->scrolledContentOffset();
+        offset -= toRenderBox(o)->layer()->scrolledContentOffset();
 
     return offset;
 }
@@ -2489,50 +1734,29 @@ IntRect RenderObject::localCaretRect(InlineBox*, int, int* extraWidthToEndOfLine
     return IntRect();
 }
 
-int RenderObject::paddingTop() const
+RenderView* RenderObject::view() const
 {
-    int w = 0;
-    Length padding = m_style->paddingTop();
-    if (padding.isPercent())
-        w = containingBlock()->availableWidth();
-    return padding.calcMinValue(w);
+    return toRenderView(document()->renderer());
 }
 
-int RenderObject::paddingBottom() const
+bool RenderObject::isRooted(RenderView** view)
 {
-    int w = 0;
-    Length padding = style()->paddingBottom();
-    if (padding.isPercent())
-        w = containingBlock()->availableWidth();
-    return padding.calcMinValue(w);
-}
+    RenderObject* o = this;
+    while (o->parent())
+        o = o->parent();
 
-int RenderObject::paddingLeft() const
-{
-    int w = 0;
-    Length padding = style()->paddingLeft();
-    if (padding.isPercent())
-        w = containingBlock()->availableWidth();
-    return padding.calcMinValue(w);
-}
+    if (!o->isRenderView())
+        return false;
 
-int RenderObject::paddingRight() const
-{
-    int w = 0;
-    Length padding = style()->paddingRight();
-    if (padding.isPercent())
-        w = containingBlock()->availableWidth();
-    return padding.calcMinValue(w);
-}
+    if (view)
+        *view = toRenderView(o);
 
-RenderView* RenderObject::view() const
-{
-    return static_cast<RenderView*>(document()->renderer());
+    return true;
 }
 
 bool RenderObject::hasOutlineAnnotation() const
 {
-    return element() && element()->isLink() && document()->printing();
+    return node() && node()->isLink() && document()->printing();
 }
 
 RenderObject* RenderObject::container() const
@@ -2559,6 +1783,8 @@ RenderObject* RenderObject::container() const
         // as we can.  If we're in the tree, we'll get the root.  If we
         // aren't we'll get the root of our little subtree (most likely
         // we'll just return 0).
+        // FIXME: The definition of view() has changed to not crawl up the render tree.  It might
+        // be safe now to use it.
         while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
     } else if (pos == AbsolutePosition) {
@@ -2572,51 +1798,19 @@ RenderObject* RenderObject::container() const
     return o;
 }
 
-// This code has been written to anticipate the addition of CSS3-::outside and ::inside generated
-// content (and perhaps XBL).  That's why it uses the render tree and not the DOM tree.
-RenderObject* RenderObject::hoverAncestor() const
-{
-    return (!isInline() && continuation()) ? continuation() : parent();
-}
-
 bool RenderObject::isSelectionBorder() const
 {
     SelectionState st = selectionState();
     return st == SelectionStart || st == SelectionEnd || st == SelectionBoth;
 }
 
-void RenderObject::removeFromObjectLists()
-{
-    if (documentBeingDestroyed())
-        return;
-
-    if (isFloating()) {
-        RenderBlock* outermostBlock = containingBlock();
-        for (RenderBlock* p = outermostBlock; p && !p->isRenderView(); p = p->containingBlock()) {
-            if (p->containsFloat(this))
-                outermostBlock = p;
-        }
-
-        if (outermostBlock)
-            outermostBlock->markAllDescendantsWithFloatsForLayout(this);
-    }
-
-    if (isPositioned()) {
-        RenderObject* p;
-        for (p = parent(); p; p = p->parent()) {
-            if (p->isRenderBlock())
-                static_cast<RenderBlock*>(p)->removePositionedObject(this);
-        }
-    }
-}
-
-bool RenderObject::documentBeingDestroyed() const
-{
-    return !document()->renderer();
-}
-
 void RenderObject::destroy()
 {
+    // Destroy any leftover anonymous children.
+    RenderObjectChildList* children = virtualChildren();
+    if (children)
+        children->destroyLeftoverChildren();
+
     // If this renderer is being autoscrolled, stop the autoscroll timer
     if (document()->frame() && document()->frame()->eventHandler()->autoscrollRenderer() == this)
         document()->frame()->eventHandler()->stopAutoscrollTimer(true);
@@ -2624,9 +1818,10 @@ void RenderObject::destroy()
     if (m_hasCounterNodeMap)
         RenderCounter::destroyCounterNodes(this);
 
-    if (AXObjectCache::accessibilityEnabled())
+    if (AXObjectCache::accessibilityEnabled()) {
+        document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
-
+    }
     animation()->cancelAnimations(this);
 
     // By default no ref-counting. RenderWidget::destroy() doesn't call
@@ -2635,12 +1830,13 @@ void RenderObject::destroy()
 
     remove();
 
-    RenderArena* arena = renderArena();
-
-    if (hasLayer())
-        layer()->destroy(arena);
-
-    arenaDelete(arena, this);
+    // FIXME: Would like to do this in RenderBoxModelObject, but the timing is so complicated that this can't easily
+    // be moved into RenderBoxModelObject::destroy.
+    if (hasLayer()) {
+        setHasLayer(false);
+        toRenderBoxModelObject(this)->destroyLayer();
+    }
+    arenaDelete(renderArena(), this);
 }
 
 void RenderObject::arenaDelete(RenderArena* arena, void* base)
@@ -2676,9 +1872,14 @@ void RenderObject::arenaDelete(RenderArena* arena, void* base)
     arena->free(*(size_t*)base, base);
 }
 
-VisiblePosition RenderObject::positionForCoordinates(int, int)
+VisiblePosition RenderObject::positionForCoordinates(int x, int y)
 {
-    return VisiblePosition(element(), caretMinOffset(), DOWNSTREAM);
+    return positionForPoint(IntPoint(x, y));
+}
+
+VisiblePosition RenderObject::positionForPoint(const IntPoint&)
+{
+    return createVisiblePosition(caretMinOffset(), DOWNSTREAM);
 }
 
 void RenderObject::updateDragState(bool dragOn)
@@ -2686,11 +1887,9 @@ void RenderObject::updateDragState(bool dragOn)
     bool valueChanged = (dragOn != m_isDragging);
     m_isDragging = dragOn;
     if (valueChanged && style()->affectedByDragRules())
-        element()->setChanged();
+        node()->setNeedsStyleRecalc();
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling())
         curr->updateDragState(dragOn);
-    if (continuation())
-        continuation()->updateDragState(dragOn);
 }
 
 bool RenderObject::hitTest(const HitTestRequest& request, HitTestResult& result, const IntPoint& point, int tx, int ty, HitTestFilter hitTestFilter)
@@ -2721,34 +1920,12 @@ void RenderObject::updateHitTestResult(HitTestResult& result, const IntPoint& po
     if (result.innerNode())
         return;
 
-    Node* node = element();
-    IntPoint localPoint(point);
-    if (isRenderView())
-        node = document()->documentElement();
-    else if (!isInline() && continuation())
-        // We are in the margins of block elements that are part of a continuation.  In
-        // this case we're actually still inside the enclosing inline element that was
-        // split.  Go ahead and set our inner node accordingly.
-        node = continuation()->element();
-
-    if (node) {
-        if (node->renderer() && node->renderer()->continuation() && node->renderer() != this) {
-            // We're in the continuation of a split inline.  Adjust our local point to be in the coordinate space
-            // of the principal renderer's containing block.  This will end up being the innerNonSharedNode.
-            RenderObject* firstBlock = node->renderer()->containingBlock();
-            
-            // Get our containing block.
-            RenderObject* block = this;
-            if (isInline())
-                block = containingBlock();
-        
-            localPoint.move(block->xPos() - firstBlock->xPos(), block->yPos() - firstBlock->yPos());
-        }
-
-        result.setInnerNode(node);
+    Node* n = node();
+    if (n) {
+        result.setInnerNode(n);
         if (!result.innerNonSharedNode())
-            result.setInnerNonSharedNode(node);
-        result.setLocalPoint(localPoint);
+            result.setInnerNonSharedNode(n);
+        result.setLocalPoint(point);
     }
 }
 
@@ -2757,78 +1934,9 @@ bool RenderObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int /*x*/,
     return false;
 }
 
-int RenderObject::verticalPositionHint(bool firstLine) const
-{
-    if (firstLine) // We're only really a first-line style if the document actually uses first-line rules.
-        firstLine = document()->usesFirstLineRules();
-    int vpos = m_verticalPosition;
-    if (m_verticalPosition == PositionUndefined || firstLine) {
-        vpos = getVerticalPosition(firstLine);
-        if (!firstLine)
-            m_verticalPosition = vpos;
-    }
-
-    return vpos;
-}
-
-int RenderObject::getVerticalPosition(bool firstLine) const
-{
-    if (!isInline())
-        return 0;
-
-    // This method determines the vertical position for inline elements.
-    int vpos = 0;
-    EVerticalAlign va = style()->verticalAlign();
-    if (va == TOP)
-        vpos = PositionTop;
-    else if (va == BOTTOM)
-        vpos = PositionBottom;
-    else {
-        bool checkParent = parent()->isInline() && !parent()->isInlineBlockOrInlineTable() && parent()->style()->verticalAlign() != TOP && parent()->style()->verticalAlign() != BOTTOM;
-        vpos = checkParent ? parent()->verticalPositionHint(firstLine) : 0;
-        // don't allow elements nested inside text-top to have a different valignment.
-        if (va == BASELINE)
-            return vpos;
-
-        const Font& f = parent()->style(firstLine)->font();
-        int fontsize = f.pixelSize();
-
-        if (va == SUB)
-            vpos += fontsize / 5 + 1;
-        else if (va == SUPER)
-            vpos -= fontsize / 3 + 1;
-        else if (va == TEXT_TOP)
-            vpos += baselinePosition(firstLine) - f.ascent();
-        else if (va == MIDDLE)
-            vpos += -static_cast<int>(f.xHeight() / 2) - lineHeight(firstLine) / 2 + baselinePosition(firstLine);
-        else if (va == TEXT_BOTTOM) {
-            vpos += f.descent();
-            if (!isReplaced())
-                vpos -= style(firstLine)->font().descent();
-        } else if (va == BASELINE_MIDDLE)
-            vpos += -lineHeight(firstLine) / 2 + baselinePosition(firstLine);
-        else if (va == LENGTH)
-            vpos -= style()->verticalAlignLength().calcValue(lineHeight(firstLine));
-    }
-
-    return vpos;
-}
-
 int RenderObject::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
 {
-    RenderStyle* s = style(firstLine);
-
-    Length lh = s->lineHeight();
-
-    // its "unset", choose nice default
-    if (lh.isNegative())
-        return s->font().lineSpacing();
-
-    if (lh.isPercent())
-        return lh.calcMinValue(s->fontSize());
-
-    // its fixed
-    return lh.value();
+    return style(firstLine)->computedLineHeight();
 }
 
 int RenderObject::baselinePosition(bool firstLine, bool isRootLineBox) const
@@ -2840,7 +1948,7 @@ int RenderObject::baselinePosition(bool firstLine, bool isRootLineBox) const
 void RenderObject::scheduleRelayout()
 {
     if (isRenderView()) {
-        FrameView* view = static_cast<RenderView*>(this)->frameView();
+        FrameView* view = toRenderView(this)->frameView();
         if (view)
             view->scheduleRelayout();
     } else if (parent()) {
@@ -2850,59 +1958,42 @@ void RenderObject::scheduleRelayout()
     }
 }
 
-void RenderObject::removeLeftoverAnonymousBlock(RenderBlock*)
-{
-}
-
-InlineBox* RenderObject::createInlineBox(bool, bool isRootLineBox, bool)
-{
-    ASSERT(!isRootLineBox);
-    return new (renderArena()) InlineBox(this);
-}
-
-void RenderObject::dirtyLineBoxes(bool, bool)
-{
-}
-
-InlineBox* RenderObject::inlineBoxWrapper() const
-{
-    return 0;
-}
-
-void RenderObject::setInlineBoxWrapper(InlineBox*)
-{
-}
-
-void RenderObject::deleteLineBoxWrapper()
+void RenderObject::layout()
 {
+    ASSERT(needsLayout());
+    RenderObject* child = firstChild();
+    while (child) {
+        child->layoutIfNeeded();
+        ASSERT(!child->needsLayout());
+        child = child->nextSibling();
+    }
+    setNeedsLayout(false);
 }
 
-RenderStyle* RenderObject::firstLineStyle() const
+RenderStyle* RenderObject::firstLineStyleSlowCase() const
 {
-    if (!document()->usesFirstLineRules())
-        return m_style.get();
+    ASSERT(document()->usesFirstLineRules());
 
-    RenderStyle* s = m_style.get();
-    const RenderObject* obj = isText() ? parent() : this;
-    if (obj->isBlockFlow()) {
-        RenderBlock* firstLineBlock = obj->firstLineBlock();
-        if (firstLineBlock)
-            s = firstLineBlock->getCachedPseudoStyle(RenderStyle::FIRST_LINE, style());
-    } else if (!obj->isAnonymous() && obj->isInlineFlow()) {
-        RenderStyle* parentStyle = obj->parent()->firstLineStyle();
-        if (parentStyle != obj->parent()->style()) {
-            // A first-line style is in effect. We need to cache a first-line style
-            // for ourselves.
-            style()->setHasPseudoStyle(RenderStyle::FIRST_LINE_INHERITED);
-            s = obj->getCachedPseudoStyle(RenderStyle::FIRST_LINE_INHERITED, parentStyle);
+    RenderStyle* style = m_style.get();
+    const RenderObject* renderer = isText() ? parent() : this;
+    if (renderer->isBlockFlow()) {
+        if (RenderBlock* firstLineBlock = renderer->firstLineBlock())
+            style = firstLineBlock->getCachedPseudoStyle(FIRST_LINE, style);
+    } else if (!renderer->isAnonymous() && renderer->isRenderInline()) {
+        RenderStyle* parentStyle = renderer->parent()->firstLineStyle();
+        if (parentStyle != renderer->parent()->style()) {
+            // A first-line style is in effect. Cache a first-line style for ourselves.
+            style->setHasPseudoStyle(FIRST_LINE_INHERITED);
+            style = renderer->getCachedPseudoStyle(FIRST_LINE_INHERITED, parentStyle);
         }
     }
-    return s;
+
+    return style;
 }
 
-RenderStyle* RenderObject::getCachedPseudoStyle(RenderStyle::PseudoId pseudo, RenderStyle* parentStyle) const
+RenderStyle* RenderObject::getCachedPseudoStyle(PseudoId pseudo, RenderStyle* parentStyle) const
 {
-    if (pseudo < RenderStyle::FIRST_INTERNAL_PSEUDOID && !style()->hasPseudoStyle(pseudo))
+    if (pseudo < FIRST_INTERNAL_PSEUDOID && !style()->hasPseudoStyle(pseudo))
         return 0;
 
     RenderStyle* cachedStyle = style()->getCachedPseudoStyle(pseudo);
@@ -2915,26 +2006,26 @@ RenderStyle* RenderObject::getCachedPseudoStyle(RenderStyle::PseudoId pseudo, Re
     return 0;
 }
 
-PassRefPtr<RenderStyle> RenderObject::getUncachedPseudoStyle(RenderStyle::PseudoId pseudo, RenderStyle* parentStyle) const
+PassRefPtr<RenderStyle> RenderObject::getUncachedPseudoStyle(PseudoId pseudo, RenderStyle* parentStyle) const
 {
-    if (pseudo < RenderStyle::FIRST_INTERNAL_PSEUDOID && !style()->hasPseudoStyle(pseudo))
+    if (pseudo < FIRST_INTERNAL_PSEUDOID && !style()->hasPseudoStyle(pseudo))
         return 0;
     
     if (!parentStyle)
         parentStyle = style();
 
-    Node* node = element();
-    while (node && !node->isElementNode())
-        node = node->parentNode();
-    if (!node)
+    Node* n = node();
+    while (n && !n->isElementNode())
+        n = n->parentNode();
+    if (!n)
         return 0;
 
     RefPtr<RenderStyle> result;
-    if (pseudo == RenderStyle::FIRST_LINE_INHERITED) {
-        result = document()->styleSelector()->styleForElement(static_cast<Element*>(node), parentStyle, false);
-        result->setStyleType(RenderStyle::FIRST_LINE_INHERITED);
+    if (pseudo == FIRST_LINE_INHERITED) {
+        result = document()->styleSelector()->styleForElement(static_cast<Element*>(n), parentStyle, false);
+        result->setStyleType(FIRST_LINE_INHERITED);
     } else
-        result = document()->styleSelector()->pseudoStyleForElement(pseudo, static_cast<Element*>(node), parentStyle);
+        result = document()->styleSelector()->pseudoStyleForElement(pseudo, static_cast<Element*>(n), parentStyle);
     return result.release();
 }
 
@@ -2977,10 +2068,10 @@ void RenderObject::getTextDecorationColors(int decorations, Color& underline, Co
             }
         }
         curr = curr->parent();
-        if (curr && curr->isRenderBlock() && curr->continuation())
-            curr = curr->continuation();
-    } while (curr && decorations && (!quirksMode || !curr->element() ||
-                                     (!curr->element()->hasTagName(aTag) && !curr->element()->hasTagName(fontTag))));
+        if (curr && curr->isRenderBlock() && toRenderBlock(curr)->inlineContinuation())
+            curr = toRenderBlock(curr)->inlineContinuation();
+    } while (curr && decorations && (!quirksMode || !curr->node() ||
+                                     (!curr->node()->hasTagName(aTag) && !curr->node()->hasTagName(fontTag))));
 
     // If we bailed out, use the element we bailed out at (typically a <font> or <a> element).
     if (decorations && curr) {
@@ -2993,24 +2084,22 @@ void RenderObject::getTextDecorationColors(int decorations, Color& underline, Co
     }
 }
 
-void RenderObject::updateWidgetPosition()
-{
-}
-
 #if ENABLE(DASHBOARD_SUPPORT)
 void RenderObject::addDashboardRegions(Vector<DashboardRegionValue>& regions)
 {
     // Convert the style regions to absolute coordinates.
-    if (style()->visibility() != VISIBLE)
+    if (style()->visibility() != VISIBLE || !isBox())
         return;
+    
+    RenderBox* box = toRenderBox(this);
 
     const Vector<StyleDashboardRegion>& styleRegions = style()->dashboardRegions();
     unsigned i, count = styleRegions.size();
     for (i = 0; i < count; i++) {
         StyleDashboardRegion styleRegion = styleRegions[i];
 
-        int w = width();
-        int h = height();
+        int w = box->width();
+        int h = box->height();
 
         DashboardRegionValue region;
         region.label = styleRegion.label;
@@ -3056,32 +2145,6 @@ void RenderObject::collectDashboardRegions(Vector<DashboardRegionValue>& regions
 }
 #endif
 
-bool RenderObject::avoidsFloats() const
-{
-    return isReplaced() || hasOverflowClip() || isHR();
-}
-
-bool RenderObject::shrinkToAvoidFloats() const
-{
-    // FIXME: Technically we should be able to shrink replaced elements on a line, but this is difficult to accomplish, since this
-    // involves doing a relayout during findNextLineBreak and somehow overriding the containingBlockWidth method to return the
-    // current remaining width on a line.
-    if (isInline() && !isHTMLMarquee() || !avoidsFloats())
-        return false;
-
-    // All auto-width objects that avoid floats should always use lineWidth.
-    return style()->width().isAuto();
-}
-
-UChar RenderObject::backslashAsCurrencySymbol() const
-{
-    if (Node *node = element()) {
-        if (TextResourceDecoder* decoder = node->document()->decoder())
-            return decoder->encoding().backslashAsCurrencySymbol();
-    }
-    return '\\';
-}
-
 bool RenderObject::willRenderImage(CachedImage*)
 {
     // Without visibility we won't render (and therefore don't care about animation).
@@ -3097,7 +2160,7 @@ int RenderObject::maximalOutlineSize(PaintPhase p) const
 {
     if (p != PaintPhaseOutline && p != PaintPhaseSelfOutline && p != PaintPhaseChildOutlines)
         return 0;
-    return static_cast<RenderView*>(document()->renderer())->maximalOutlineSize();
+    return toRenderView(document()->renderer())->maximalOutlineSize();
 }
 
 int RenderObject::caretMinOffset() const
@@ -3108,7 +2171,7 @@ int RenderObject::caretMinOffset() const
 int RenderObject::caretMaxOffset() const
 {
     if (isReplaced())
-        return element() ? max(1U, element()->childNodeCount()) : 1;
+        return node() ? max(1U, node()->childNodeCount()) : 1;
     if (isHR())
         return 1;
     return 0;
@@ -3124,44 +2187,19 @@ int RenderObject::previousOffset(int current) const
     return current - 1;
 }
 
-int RenderObject::nextOffset(int current) const
-{
-    return current + 1;
-}
-
-int RenderObject::maxTopMargin(bool positive) const
-{
-    return positive ? max(0, marginTop()) : -min(0, marginTop());
-}
-
-int RenderObject::maxBottomMargin(bool positive) const
-{
-    return positive ? max(0, marginBottom()) : -min(0, marginBottom());
-}
-
-IntRect RenderObject::contentBox() const
-{
-    return IntRect(borderLeft() + paddingLeft(), borderTop() + paddingTop(),
-        contentWidth(), contentHeight());
-}
-
-IntRect RenderObject::absoluteContentBox() const
+int RenderObject::previousOffsetForBackwardDeletion(int current) const
 {
-    IntRect rect = contentBox();
-    FloatPoint absPos = localToAbsoluteForContent(FloatPoint());
-    rect.move(absPos.x(), absPos.y());
-    return rect;
+    return current - 1;
 }
 
-FloatQuad RenderObject::absoluteContentQuad() const
+int RenderObject::nextOffset(int current) const
 {
-    IntRect rect = contentBox();
-    return localToAbsoluteQuad(FloatRect(rect));
+    return current + 1;
 }
 
 void RenderObject::adjustRectForOutlineAndShadow(IntRect& rect) const
 {
-    int outlineSize = !isInline() && continuation() ? continuation()->style()->outlineSize() : style()->outlineSize();
+    int outlineSize = outlineStyleForRepaint()->outlineSize();
     if (ShadowData* boxShadow = style()->boxShadow()) {
         int shadowLeft = 0;
         int shadowRight = 0;
@@ -3184,24 +2222,6 @@ void RenderObject::adjustRectForOutlineAndShadow(IntRect& rect) const
         rect.inflate(outlineSize);
 }
 
-IntRect RenderObject::absoluteOutlineBounds() const
-{
-    IntRect box = borderBox();
-    adjustRectForOutlineAndShadow(box);
-
-    FloatQuad absOutlineQuad = localToAbsoluteQuad(FloatRect(box));
-    box = absOutlineQuad.enclosingBoundingBox();
-    box.move(view()->layoutDelta());
-
-    return box;
-}
-
-bool RenderObject::isScrollable() const
-{
-    RenderLayer* l = enclosingLayer();
-    return l && (l->verticalScrollbar() || l->horizontalScrollbar());
-}
-
 AnimationController* RenderObject::animation() const
 {
     return document()->frame()->animation();
@@ -3212,82 +2232,150 @@ void RenderObject::imageChanged(CachedImage* image, const IntRect* rect)
     imageChanged(static_cast<WrappedImagePtr>(image), rect);
 }
 
-IntRect RenderObject::reflectionBox() const
+RenderBoxModelObject* RenderObject::offsetParent() const
 {
-    IntRect result;
-    if (!m_style->boxReflect())
-        return result;
-    IntRect box = borderBox();
-    result = box;
-    switch (m_style->boxReflect()->direction()) {
-        case ReflectionBelow:
-            result.move(0, box.height() + reflectionOffset());
-            break;
-        case ReflectionAbove:
-            result.move(0, -box.height() - reflectionOffset());
-            break;
-        case ReflectionLeft:
-            result.move(-box.width() - reflectionOffset(), 0);
-            break;
-        case ReflectionRight:
-            result.move(box.width() + reflectionOffset(), 0);
+    // If any of the following holds true return null and stop this algorithm:
+    // A is the root element.
+    // A is the HTML body element.
+    // The computed value of the position property for element A is fixed.
+    if (isRoot() || isBody() || (isPositioned() && style()->position() == FixedPosition))
+        return 0;
+
+    // If A is an area HTML element which has a map HTML element somewhere in the ancestor
+    // chain return the nearest ancestor map HTML element and stop this algorithm.
+    // FIXME: Implement!
+    
+    // Return the nearest ancestor element of A for which at least one of the following is
+    // true and stop this algorithm if such an ancestor is found:
+    //     * The computed value of the position property is not static.
+    //     * It is the HTML body element.
+    //     * The computed value of the position property of A is static and the ancestor
+    //       is one of the following HTML elements: td, th, or table.
+    //     * Our own extension: if there is a difference in the effective zoom
+    bool skipTables = isPositioned() || isRelPositioned();
+    float currZoom = style()->effectiveZoom();
+    RenderObject* curr = parent();
+    while (curr && (!curr->node() ||
+                    (!curr->isPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
+        Node* element = curr->node();
+        if (!skipTables && element) {
+            bool isTableElement = element->hasTagName(tableTag) ||
+                                  element->hasTagName(tdTag) ||
+                                  element->hasTagName(thTag);
+
+#if ENABLE(WML)
+            if (!isTableElement && element->isWMLElement())
+                isTableElement = element->hasTagName(WMLNames::tableTag) ||
+                                 element->hasTagName(WMLNames::tdTag);
+#endif
+
+            if (isTableElement)
+                break;
+        }
+
+        float newZoom = curr->style()->effectiveZoom();
+        if (currZoom != newZoom)
             break;
+        currZoom = newZoom;
+        curr = curr->parent();
     }
-    return result;
+    return curr && curr->isBoxModelObject() ? toRenderBoxModelObject(curr) : 0;
 }
 
-int RenderObject::reflectionOffset() const
+VisiblePosition RenderObject::createVisiblePosition(int offset, EAffinity affinity)
 {
-    if (!m_style->boxReflect())
-        return 0;
-    if (m_style->boxReflect()->direction() == ReflectionLeft || m_style->boxReflect()->direction() == ReflectionRight)
-        return m_style->boxReflect()->offset().calcValue(borderBox().width());
-    return m_style->boxReflect()->offset().calcValue(borderBox().height());
+    // If this is a non-anonymous renderer, then it's simple.
+    if (Node* node = this->node())
+        return VisiblePosition(node, offset, affinity);
+
+    // We don't want to cross the boundary between editable and non-editable
+    // regions of the document, but that is either impossible or at least
+    // extremely unlikely in any normal case because we stop as soon as we
+    // find a single non-anonymous renderer.
+
+    // Find a nearby non-anonymous renderer.
+    RenderObject* child = this;
+    while (RenderObject* parent = child->parent()) {
+        // Find non-anonymous content after.
+        RenderObject* renderer = child;
+        while ((renderer = renderer->nextInPreOrder(parent))) {
+            if (Node* node = renderer->node())
+                return VisiblePosition(node, 0, DOWNSTREAM);
+        }
+
+        // Find non-anonymous content before.
+        renderer = child;
+        while ((renderer = renderer->previousInPreOrder())) {
+            if (renderer == parent)
+                break;
+            if (Node* node = renderer->node())
+                return VisiblePosition(lastDeepEditingPositionForNode(node), DOWNSTREAM);
+        }
+
+        // Use the parent itself unless it too is anonymous.
+        if (Node* node = parent->node())
+            return VisiblePosition(node, 0, DOWNSTREAM);
+
+        // Repeat at the next level up.
+        child = parent;
+    }
+
+    // Everything was anonymous. Give up.
+    return VisiblePosition();
 }
 
-IntRect RenderObject::reflectedRect(const IntRect& r) const
+VisiblePosition RenderObject::createVisiblePosition(const Position& position)
 {
-    if (!m_style->boxReflect())
-        return IntRect();
+    if (position.isNotNull())
+        return VisiblePosition(position);
 
-    IntRect box = borderBox();
-    IntRect result = r;
-    switch (m_style->boxReflect()->direction()) {
-        case ReflectionBelow:
-            result.setY(box.bottom() + reflectionOffset() + (box.bottom() - r.bottom()));
-            break;
-        case ReflectionAbove:
-            result.setY(box.y() - reflectionOffset() - box.height() + (box.bottom() - r.bottom()));
-            break;
-        case ReflectionLeft:
-            result.setX(box.x() - reflectionOffset() - box.width() + (box.right() - r.right()));
-            break;
-        case ReflectionRight:
-            result.setX(box.right() + reflectionOffset() + (box.right() - r.right()));
-            break;
-    }
-    return result;
+    ASSERT(!node());
+    return createVisiblePosition(0, DOWNSTREAM);
 }
 
 #if ENABLE(SVG)
 
-FloatRect RenderObject::relativeBBox(bool) const
+FloatRect RenderObject::objectBoundingBox() const
 {
+    ASSERT_NOT_REACHED();
+    return FloatRect();
+}
+
+// Returns the smallest rectangle enclosing all of the painted content
+// respecting clipping, masking, filters, opacity, stroke-width and markers
+FloatRect RenderObject::repaintRectInLocalCoordinates() const
+{
+    ASSERT_NOT_REACHED();
     return FloatRect();
 }
 
 TransformationMatrix RenderObject::localTransform() const
 {
-    return TransformationMatrix(1, 0, 0, 1, xPos(), yPos());
+    return TransformationMatrix();
+}
+
+TransformationMatrix RenderObject::localToParentTransform() const
+{
+    // FIXME: This double virtual call indirection is temporary until I can land the
+    // rest of the of the localToParentTransform() support for SVG.
+    return localTransform();
 }
 
 TransformationMatrix RenderObject::absoluteTransform() const
 {
+    // FIXME: This should use localToParentTransform(), but much of the SVG code
+    // depends on RenderBox::absoluteTransform() being the sum of the localTransform()s of all parent renderers.
     if (parent())
         return localTransform() * parent()->absoluteTransform();
     return localTransform();
 }
 
+bool RenderObject::nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint&, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 #endif // ENABLE(SVG)
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index 70841b7d4d..0901bffbfd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -3,7 +3,7 @@
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,38 +27,29 @@
 
 #include "CachedResourceClient.h"
 #include "Document.h"
+#include "Element.h"
 #include "FloatQuad.h"
+#include "RenderObjectChildList.h"
 #include "RenderStyle.h"
-#include "ScrollTypes.h"
-#include "VisiblePosition.h"
-#include <wtf/HashMap.h>
+#include "TextAffinity.h"
+#include "TransformationMatrix.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
-class TransformationMatrix;
 class AnimationController;
-class Color;
-class Document;
-class Element;
-class Event;
-class FloatRect;
-class FrameView;
-class HTMLAreaElement;
 class HitTestResult;
 class InlineBox;
 class InlineFlowBox;
+class OverlapTestRequestClient;
 class Position;
-class RenderArena;
+class RenderBoxModelObject;
+class RenderInline;
 class RenderBlock;
 class RenderFlow;
-class RenderFrameSet;
 class RenderLayer;
-class RenderTable;
-class RenderText;
-class RenderView;
-class String;
-
-struct HitTestRequest;
+class TransformState;
+class VisiblePosition;
 
 /*
  *  The painting of a layer occurs in three distinct phases.  Each phase involves
@@ -104,12 +95,17 @@ enum HitTestAction {
     HitTestForeground
 };
 
-enum VerticalPositionHint {
-    PositionTop = -0x7fffffff,
-    PositionBottom = 0x7fffffff,
-    PositionUndefined = static_cast<int>(0x80000000)
+// Sides used when drawing borders and outlines.  This is in RenderObject rather than RenderBoxModelObject since outlines can
+// be drawn by SVG around bounding boxes.
+enum BoxSide {
+    BSTop,
+    BSBottom,
+    BSLeft,
+    BSRight
 };
 
+const int caretWidth = 1;
+
 #if ENABLE(DASHBOARD_SUPPORT)
 struct DashboardRegionValue {
     bool operator==(const DashboardRegionValue& o) const
@@ -128,22 +124,20 @@ struct DashboardRegionValue {
 };
 #endif
 
-// FIXME: This should be a HashSequencedSet, but we don't have that data structure yet.
-// This means the paint order of outlines will be wrong, although this is a minor issue.
-typedef HashSet<RenderFlow*> RenderFlowSequencedSet;
-
 // Base class for all rendering tree objects.
 class RenderObject : public CachedResourceClient {
-    friend class RenderContainer;
-    friend class RenderSVGContainer;
+    friend class RenderBlock;
+    friend class RenderBox;
     friend class RenderLayer;
+    friend class RenderObjectChildList;
+    friend class RenderSVGContainer;
 public:
     // Anonymous objects should pass the document as their node, and they will then automatically be
     // marked as anonymous in the constructor.
     RenderObject(Node*);
     virtual ~RenderObject();
 
-    virtual const char* renderName() const { return "RenderObject"; }
+    virtual const char* renderName() const = 0;
 
     RenderObject* parent() const { return m_parent; }
     bool isDescendantOf(const RenderObject*) const;
@@ -151,8 +145,20 @@ public:
     RenderObject* previousSibling() const { return m_previous; }
     RenderObject* nextSibling() const { return m_next; }
 
-    virtual RenderObject* firstChild() const { return 0; }
-    virtual RenderObject* lastChild() const { return 0; }
+    RenderObject* firstChild() const
+    {
+        if (const RenderObjectChildList* children = virtualChildren())
+            return children->firstChild();
+        return 0;
+    }
+    RenderObject* lastChild() const
+    {
+        if (const RenderObjectChildList* children = virtualChildren())
+            return children->lastChild();
+        return 0;
+    }
+    virtual RenderObjectChildList* virtualChildren() { return 0; }
+    virtual const RenderObjectChildList* virtualChildren() const { return 0; }
 
     RenderObject* nextInPreOrder() const;
     RenderObject* nextInPreOrder(RenderObject* stayWithin) const;
@@ -164,30 +170,26 @@ public:
     RenderObject* firstLeafChild() const;
     RenderObject* lastLeafChild() const;
 
-    virtual RenderLayer* layer() const { return 0; }
+    // The following six functions are used when the render tree hierarchy changes to make sure layers get
+    // properly added and removed.  Since containership can be implemented by any subclass, and since a hierarchy
+    // can contain a mixture of boxes and other object types, these functions need to be in the base class.
     RenderLayer* enclosingLayer() const;
+    RenderLayer* enclosingSelfPaintingLayer() const;
     void addLayers(RenderLayer* parentLayer, RenderObject* newObject);
     void removeLayers(RenderLayer* parentLayer);
     void moveLayers(RenderLayer* oldParent, RenderLayer* newParent);
     RenderLayer* findNextLayer(RenderLayer* parentLayer, RenderObject* startPoint, bool checkParent = true);
-    virtual void positionChildLayers() { }
-    virtual bool requiresLayer();
-
-    virtual IntRect getOverflowClipRect(int /*tx*/, int /*ty*/) { return IntRect(0, 0, 0, 0); }
-    virtual IntRect getClipRect(int /*tx*/, int /*ty*/) { return IntRect(0, 0, 0, 0); }
-    bool hasClip() { return isPositioned() && style()->hasClip(); }
-
-    virtual int getBaselineOfFirstLineBox() const { return -1; }
-    virtual int getBaselineOfLastLineBox() const { return -1; }
 
+    // Convenience function for getting to the nearest enclosing box of a RenderObject.
+    RenderBox* enclosingBox() const;
+    
     virtual bool isEmpty() const { return firstChild() == 0; }
 
-    virtual bool isEdited() const { return false; }
-    virtual void setEdited(bool) { }
-
 #ifndef NDEBUG
     void setHasAXObject(bool flag) { m_hasAXObject = flag; }
     bool hasAXObject() const { return m_hasAXObject; }
+    bool isSetNeedsLayoutForbidden() const { return m_setNeedsLayoutForbidden; }
+    void setNeedsLayoutIsForbidden(bool flag) { m_setNeedsLayoutForbidden = flag; }
 #endif
 
     // Obtains the nearest enclosing block (including this block) that contributes a first-line style to our inline
@@ -198,35 +200,15 @@ public:
     // again.  We have to make sure the render tree updates as needed to accommodate the new
     // normal flow object.
     void handleDynamicFloatPositionChange();
-
-    // This function is a convenience helper for creating an anonymous block that inherits its
-    // style from this RenderObject.
-    RenderBlock* createAnonymousBlock();
-
-    // Whether or not a positioned element requires normal flow x/y to be computed
-    // to determine its position.
-    bool hasStaticX() const;
-    bool hasStaticY() const;
-    virtual void setStaticX(int /*staticX*/) { }
-    virtual void setStaticY(int /*staticY*/) { }
-    virtual int staticX() const { return 0; }
-    virtual int staticY() const { return 0; }
-
+    
     // RenderObject tree manipulation
     //////////////////////////////////////////
-    virtual bool canHaveChildren() const;
+    virtual bool canHaveChildren() const { return virtualChildren(); }
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const { return true; }
     virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
+    virtual void addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild = 0) { return addChild(newChild, beforeChild); }
     virtual void removeChild(RenderObject*);
     virtual bool createsAnonymousWrapper() const { return false; }
-
-    // raw tree manipulation
-    virtual RenderObject* removeChildNode(RenderObject*, bool fullRemove = true);
-    virtual void appendChildNode(RenderObject*, bool fullAppend = true);
-    virtual void insertChildNode(RenderObject* child, RenderObject* before, bool fullInsert = true);
-    // Designed for speed.  Don't waste time doing a bunch of work like layer updating and repainting when we know that our
-    // change in parentage is not going to affect anything.
-    virtual void moveChildNode(RenderObject*);
     //////////////////////////////////////////
 
 protected:
@@ -238,6 +220,7 @@ protected:
     //////////////////////////////////////////
 private:
     void addAbsoluteRectForLayer(IntRect& result);
+    void setLayerNeedsFullRepaint();
 
 public:
 #ifndef NDEBUG
@@ -263,20 +246,20 @@ public:
     virtual bool isApplet() const { return false; }
     virtual bool isBR() const { return false; }
     virtual bool isBlockFlow() const { return false; }
+    virtual bool isBoxModelObject() const { return false; }
     virtual bool isCounter() const { return false; }
     virtual bool isFieldset() const { return false; }
     virtual bool isFrame() const { return false; }
     virtual bool isFrameSet() const { return false; }
     virtual bool isImage() const { return false; }
     virtual bool isInlineBlockOrInlineTable() const { return false; }
-    virtual bool isInlineContinuation() const;
-    virtual bool isInlineFlow() const { return false; }
     virtual bool isListBox() const { return false; }
     virtual bool isListItem() const { return false; }
     virtual bool isListMarker() const { return false; }
     virtual bool isMedia() const { return false; }
     virtual bool isMenuList() const { return false; }
     virtual bool isRenderBlock() const { return false; }
+    virtual bool isRenderButton() const { return false; }
     virtual bool isRenderImage() const { return false; }
     virtual bool isRenderInline() const { return false; }
     virtual bool isRenderPart() const { return false; }
@@ -287,50 +270,79 @@ public:
     virtual bool isTableCol() const { return false; }
     virtual bool isTableRow() const { return false; }
     virtual bool isTableSection() const { return false; }
+    virtual bool isTextControl() const { return false; }
     virtual bool isTextArea() const { return false; }
     virtual bool isTextField() const { return false; }
     virtual bool isWidget() const { return false; }
 
-
-    bool isRoot() const { return document()->documentElement() == node(); }
+    bool isRoot() const { return document()->documentElement() == m_node; }
     bool isBody() const;
     bool isHR() const;
 
     bool isHTMLMarquee() const;
 
-    virtual bool childrenInline() const { return false; }
-    virtual void setChildrenInline(bool) { }
-
-    virtual RenderFlow* continuation() const;
+    bool childrenInline() const { return m_childrenInline; }
+    void setChildrenInline(bool b = true) { m_childrenInline = b; }
+    bool hasColumns() const { return m_hasColumns; }
+    void setHasColumns(bool b = true) { m_hasColumns = b; }
+    bool cellWidthChanged() const { return m_cellWidthChanged; }
+    void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
 
 #if ENABLE(SVG)
+    // FIXME: Until all SVG renders can be subclasses of RenderSVGModelObject we have
+    // to add SVG renderer methods to RenderObject with an ASSERT_NOT_REACHED() default implementation.
     virtual bool isSVGRoot() const { return false; }
     virtual bool isSVGContainer() const { return false; }
     virtual bool isSVGHiddenContainer() const { return false; }
     virtual bool isRenderPath() const { return false; }
     virtual bool isSVGText() const { return false; }
+    virtual bool isSVGImage() const { return false; }
+
+    // Per SVG 1.1 objectBoundingBox ignores clipping, masking, filter effects, opacity and stroke-width.
+    // This is used for all computation of objectBoundingBox relative units and by SVGLocateable::getBBox().
+    // NOTE: Markers are not specifically ignored here by SVG 1.1 spec, but we ignore them
+    // since stroke-width is ignored (and marker size can depend on stroke-width).
+    // objectBoundingBox is returned local coordinates.
+    // The name objectBoundingBox is taken from the SVG 1.1 spec.
+    virtual FloatRect objectBoundingBox() const;
+
+    // Returns the smallest rectangle enclosing all of the painted content
+    // respecting clipping, masking, filters, opacity, stroke-width and markers
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    // FIXME: This accessor is deprecated and mostly around for SVGRenderTreeAsText.
+    // This only returns the transform="" value from the element
+    // most callsites want localToParentTransform() instead.
+    virtual TransformationMatrix localTransform() const;
 
-    virtual FloatRect relativeBBox(bool includeStroke = true) const;
+    // Returns the full transform mapping from local coordinates to local coords for the parent SVG renderer
+    // This includes any viewport transforms and x/y offsets as well as the transform="" value off the element.
+    virtual TransformationMatrix localToParentTransform() const;
 
-    virtual TransformationMatrix localTransform() const;
+    // Walks up the parent chain to create a transform which maps from local to document coords
+    // NOTE: This method is deprecated!  It doesn't respect scroll offsets or repaint containers.
+    // FIXME: This is only virtual so that RenderSVGHiddenContainer can override it to match old LayoutTest results.
     virtual TransformationMatrix absoluteTransform() const;
-#endif
 
-    virtual bool isEditable() const;
+    // SVG uses FloatPoint precise hit testing, and passes the point in parent
+    // coordinates instead of in repaint container coordinates.  Eventually the
+    // rest of the rendering tree will move to a similar model.
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
+#endif
 
     bool isAnonymous() const { return m_isAnonymous; }
     void setIsAnonymous(bool b) { m_isAnonymous = b; }
     bool isAnonymousBlock() const
     {
-        return m_isAnonymous && style()->display() == BLOCK && style()->styleType() == RenderStyle::NOPSEUDO && !isListMarker();
+        return m_isAnonymous && style()->display() == BLOCK && style()->styleType() == NOPSEUDO && !isListMarker();
     }
-
+    bool isInlineContinuation() const { return (node() ? node()->renderer() != this : false) && isRenderInline(); }
     bool isFloating() const { return m_floating; }
     bool isPositioned() const { return m_positioned; } // absolute or fixed positioning
     bool isRelPositioned() const { return m_relPositioned; } // relative positioning
     bool isText() const  { return m_isText; }
+    bool isBox() const { return m_isBox; }
     bool isInline() const { return m_inline; }  // inline object
-    bool isCompact() const { return style()->display() == COMPACT; } // compact object
     bool isRunIn() const { return style()->display() == RUN_IN; } // run-in object
     bool isDragging() const { return m_isDragging; }
     bool isReplaced() const { return m_replaced; } // a "replaced" element (see CSS)
@@ -340,9 +352,6 @@ public:
     bool hasBoxDecorations() const { return m_paintBackground; }
     bool mustRepaintBackgroundOrBorder() const;
 
-    bool hasHorizontalBordersPaddingOrMargin() const { return hasHorizontalBordersOrPadding() || marginLeft() != 0 || marginRight() != 0; }
-    bool hasHorizontalBordersOrPadding() const { return borderLeft() != 0 || borderRight() != 0 || paddingLeft() != 0 || paddingRight() != 0; }
-                                                              
     bool needsLayout() const { return m_needsLayout || m_normalChildNeedsLayout || m_posChildNeedsLayout || m_needsPositionedMovementLayout; }
     bool selfNeedsLayout() const { return m_needsLayout; }
     bool needsPositionedMovementLayout() const { return m_needsPositionedMovementLayout; }
@@ -354,43 +363,33 @@ public:
 
     bool isSelectionBorder() const;
 
+    bool hasClip() const { return isPositioned() && style()->hasClip(); }
     bool hasOverflowClip() const { return m_hasOverflowClip; }
-    virtual bool hasControlClip() const { return false; }
-    virtual IntRect controlClipRect(int /*tx*/, int /*ty*/) const { return IntRect(); }
-
-    bool hasAutoVerticalScrollbar() const { return hasOverflowClip() && (style()->overflowY() == OAUTO || style()->overflowY() == OOVERLAY); }
-    bool hasAutoHorizontalScrollbar() const { return hasOverflowClip() && (style()->overflowX() == OAUTO || style()->overflowX() == OOVERLAY); }
 
-    bool scrollsOverflow() const { return scrollsOverflowX() || scrollsOverflowY(); }
-    bool scrollsOverflowX() const { return hasOverflowClip() && (style()->overflowX() == OSCROLL || hasAutoHorizontalScrollbar()); }
-    bool scrollsOverflowY() const { return hasOverflowClip() && (style()->overflowY() == OSCROLL || hasAutoVerticalScrollbar()); }
-
-    virtual int verticalScrollbarWidth() const;
-    virtual int horizontalScrollbarHeight() const;
-    
     bool hasTransform() const { return m_hasTransform; }
     bool hasMask() const { return style() && style()->hasMask(); }
-    virtual IntRect maskClipRect() { return borderBox(); }
 
-private:
-    bool includeVerticalScrollbarSize() const { return hasOverflowClip() && (style()->overflowY() == OSCROLL || style()->overflowY() == OAUTO); }
-    bool includeHorizontalScrollbarSize() const { return hasOverflowClip() && (style()->overflowX() == OSCROLL || style()->overflowX() == OAUTO); }
+    void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
+                            Color, const Color& textcolor, EBorderStyle, int adjbw1, int adjbw2);
+    void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, IntSize radius, int angleStart,
+                           int angleSpan, BoxSide, Color, const Color& textcolor, EBorderStyle, bool firstCorner);
 
 public:
     // The pseudo element style can be cached or uncached.  Use the cached method if the pseudo element doesn't respect
     // any pseudo classes (and therefore has no concept of changing state).
-    RenderStyle* getCachedPseudoStyle(RenderStyle::PseudoId, RenderStyle* parentStyle = 0) const;
-    PassRefPtr<RenderStyle> getUncachedPseudoStyle(RenderStyle::PseudoId, RenderStyle* parentStyle = 0) const;
+    RenderStyle* getCachedPseudoStyle(PseudoId, RenderStyle* parentStyle = 0) const;
+    PassRefPtr<RenderStyle> getUncachedPseudoStyle(PseudoId, RenderStyle* parentStyle = 0) const;
     
-    void updateDragState(bool dragOn);
+    virtual void updateDragState(bool dragOn);
 
     RenderView* view() const;
 
-    // don't even think about making this method virtual!
-    Node* element() const { return m_isAnonymous ? 0 : m_node; }
+    // Returns true if this renderer is rooted, and optionally returns the hosting view (the root of the hierarchy).
+    bool isRooted(RenderView** = 0);
+
+    Node* node() const { return m_isAnonymous ? 0 : m_node; }
     Document* document() const { return m_node->document(); }
     void setNode(Node* node) { m_node = node; }
-    Node* node() const { return m_node; }
 
     bool hasOutlineAnnotation() const;
     bool hasOutline() const { return style()->hasOutline() || hasOutlineAnnotation(); }
@@ -400,16 +399,17 @@ public:
      * positioned elements
      */
     RenderObject* container() const;
-    RenderObject* hoverAncestor() const;
+    virtual RenderObject* hoverAncestor() const { return parent(); }
+
+    // IE Extension that can be called on any RenderObject.  See the implementation for the details.
+    RenderBoxModelObject* offsetParent() const;
 
-    virtual void markAllDescendantsWithFloatsForLayout(RenderObject* floatToRemove = 0);
     void markContainingBlocksForLayout(bool scheduleRelayout = true, RenderObject* newRoot = 0);
     void setNeedsLayout(bool b, bool markParents = true);
     void setChildNeedsLayout(bool b, bool markParents = true);
     void setNeedsPositionedMovementLayout();
     void setPrefWidthsDirty(bool, bool markParents = true);
     void invalidateContainerPrefWidths();
-    virtual void invalidateCounters() { }
     
     void setNeedsLayoutAndPrefWidthsRecalc()
     {
@@ -422,7 +422,8 @@ public:
     void setFloating(bool b = true) { m_floating = b; }
     void setInline(bool b = true) { m_inline = b; }
     void setHasBoxDecorations(bool b = true) { m_paintBackground = b; }
-    void setRenderText() { m_isText = true; }
+    void setIsText() { m_isText = true; }
+    void setIsBox() { m_isBox = true; }
     void setReplaced(bool b = true) { m_replaced = b; }
     void setHasOverflowClip(bool b = true) { m_hasOverflowClip = b; }
     void setHasLayer(bool b = true) { m_hasLayer = b; }
@@ -434,37 +435,29 @@ public:
     void updateFillImages(const FillLayer*, const FillLayer*);
     void updateImage(StyleImage*, StyleImage*);
 
-    virtual InlineBox* createInlineBox(bool makePlaceHolderBox, bool isRootLineBox, bool isOnlyRun = false);
-    virtual void dirtyLineBoxes(bool fullLayout, bool isRootLineBox = false);
-
-    // For inline replaced elements, this function returns the inline box that owns us.  Enables
-    // the replaced RenderObject to quickly determine what line it is contained on and to easily
-    // iterate over structures on the line.
-    virtual InlineBox* inlineBoxWrapper() const;
-    virtual void setInlineBoxWrapper(InlineBox*);
-    virtual void deleteLineBoxWrapper();
-
     // for discussion of lineHeight see CSS2 spec
     virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
     // for the vertical-align property of inline elements
-    // the difference between this objects baseline position and the lines baseline position.
-    virtual int verticalPositionHint(bool firstLine) const;
     // the offset of baseline from the top of the object.
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
 
+    typedef HashMap<OverlapTestRequestClient*, IntRect> OverlapTestRequestMap;
+
     /*
      * Paint the object and its children, clipped by (x|y|w|h).
      * (tx|ty) is the calculated position of the parent
      */
     struct PaintInfo {
         PaintInfo(GraphicsContext* newContext, const IntRect& newRect, PaintPhase newPhase, bool newForceBlackText,
-                  RenderObject* newPaintingRoot, RenderFlowSequencedSet* newOutlineObjects)
+                  RenderObject* newPaintingRoot, ListHashSet<RenderInline*>* newOutlineObjects,
+                  OverlapTestRequestMap* overlapTestRequests = 0)
             : context(newContext)
             , rect(newRect)
             , phase(newPhase)
             , forceBlackText(newForceBlackText)
             , paintingRoot(newPaintingRoot)
             , outlineObjects(newOutlineObjects)
+            , overlapTestRequests(overlapTestRequests)
         {
         }
 
@@ -473,40 +466,14 @@ public:
         PaintPhase phase;
         bool forceBlackText;
         RenderObject* paintingRoot; // used to draw just one element and its visual kids
-        RenderFlowSequencedSet* outlineObjects; // used to list outlines that should be painted by a block with inline children
+        ListHashSet<RenderInline*>* outlineObjects; // used to list outlines that should be painted by a block with inline children
+        OverlapTestRequestMap* overlapTestRequests;
     };
 
     virtual void paint(PaintInfo&, int tx, int ty);
-    void paintBorder(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
-    bool paintNinePieceImage(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, const NinePieceImage&, CompositeOperator = CompositeSourceOver);
-    void paintOutline(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*);
-    void paintBoxShadow(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
-
-    // RenderBox implements this.
-    virtual void paintBoxDecorations(PaintInfo&, int /*tx*/, int /*ty*/) { }
-    virtual void paintMask(PaintInfo&, int /*tx*/, int /*ty*/) { }
-    virtual void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*,
-                                        int /*clipY*/, int /*clipH*/, int /*tx*/, int /*ty*/, int /*width*/, int /*height*/,
-                                        InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver) { }
-
-    
-    /*
-     * Calculates the actual width of the object (only for non inline
-     * objects)
-     */
-    virtual void calcWidth() { }
 
-    /*
-     * This function should cause the Element to calculate its
-     * width and height and the layout of its content
-     *
-     * when the Element calls setNeedsLayout(false), layout() is no
-     * longer called during relayouts, as long as there is no
-     * style sheet change. When that occurs, m_needsLayout will be
-     * set to true and the Element receives layout() calls
-     * again.
-     */
-    virtual void layout() = 0;
+    // Recursive function that computes the size and position of this object and all its descendants.
+    virtual void layout();
 
     /* This function performs a layout only if one is needed. */
     void layoutIfNeeded() { if (needsLayout()) layout(); }
@@ -519,24 +486,19 @@ public:
     // repaint and do not need a relayout
     virtual void updateFromElement() { }
 
-    // Block flows subclass availableWidth to handle multi column layout (shrinking the width available to children when laying out.)
-    virtual int availableWidth() const { return contentWidth(); }
-    
-    virtual int availableHeight() const { return 0; }
-
-    virtual void updateWidgetPosition();
-
 #if ENABLE(DASHBOARD_SUPPORT)
-    void addDashboardRegions(Vector<DashboardRegionValue>&);
+    virtual void addDashboardRegions(Vector<DashboardRegionValue>&);
     void collectDashboardRegions(Vector<DashboardRegionValue>&);
 #endif
 
     bool hitTest(const HitTestRequest&, HitTestResult&, const IntPoint&, int tx, int ty, HitTestFilter = HitTestAll);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-    void updateHitTestResult(HitTestResult&, const IntPoint&);
+    virtual void updateHitTestResult(HitTestResult&, const IntPoint&);
 
-    virtual VisiblePosition positionForCoordinates(int x, int y);
-    VisiblePosition positionForPoint(const IntPoint& point) { return positionForCoordinates(point.x(), point.y()); }
+    VisiblePosition positionForCoordinates(int x, int y);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
+    VisiblePosition createVisiblePosition(int offset, EAffinity);
+    VisiblePosition createVisiblePosition(const Position&);
 
     virtual void dirtyLinesFromChangedChild(RenderObject*);
 
@@ -555,186 +517,54 @@ public:
     // returns the containing block level element for this element.
     RenderBlock* containingBlock() const;
 
-    // return just the width of the containing block
-    virtual int containingBlockWidth() const;
-    // return just the height of the containing block
-    virtual int containingBlockHeight() const;
-
-    // content area (box minus padding/border)
-    IntRect contentBox() const;
-    // absolute coords of content area. Ignores transforms.
-    IntRect absoluteContentBox() const;
-    // content rect converted to absolute coords, taking transforms into account
-    FloatQuad absoluteContentQuad() const;
-    
-    int contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
-    int contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
-
-    // used by flexible boxes to impose a flexed width/height override
-    virtual int overrideSize() const { return 0; }
-    virtual int overrideWidth() const { return 0; }
-    virtual int overrideHeight() const { return 0; }
-    virtual void setOverrideSize(int /*overrideSize*/) { }
-
-    // relative to parent node
-    virtual void setPos(int /*xPos*/, int /*yPos*/) { }
-    virtual void setWidth(int /*width*/) { }
-    virtual void setHeight(int /*height*/) { }
-    virtual void setRect(const IntRect& rect) { setPos(rect.x(), rect.y()); setWidth(rect.width()); setHeight(rect.height()); }
-
-    virtual int xPos() const { return 0; }
-    virtual int yPos() const { return 0; }
-
     // Convert the given local point to absolute coordinates
     // FIXME: Temporary. If useTransforms is true, take transforms into account. Eventually localToAbsolute() will always be transform-aware.
-    virtual FloatPoint localToAbsolute(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
-    virtual FloatPoint absoluteToLocal(FloatPoint, bool fixed = false, bool useTransforms = false) const;
+    FloatPoint localToAbsolute(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
+    FloatPoint absoluteToLocal(FloatPoint, bool fixed = false, bool useTransforms = false) const;
 
-    // This function is used to deal with the extra top space that can occur in table cells (called borderTopExtra).
-    // The children of the cell do not factor this space in, so we have to add it in.  Any code that wants to
-    // accurately deal with the contents of a cell must call this function instad of absolutePosition.
-    FloatPoint localToAbsoluteForContent(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const
+    // Convert a local quad to absolute coordinates, taking transforms into account.
+    FloatQuad localToAbsoluteQuad(const FloatQuad& quad, bool fixed = false) const
     {
-        localPoint.move(0.0f, static_cast<float>(borderTopExtra()));
-        return localToAbsolute(localPoint, fixed, useTransforms);
+        return localToContainerQuad(quad, 0, fixed);
     }
-
-    // Convert a local quad to an absolute quad, taking transforms into account.
-    virtual FloatQuad localToAbsoluteQuad(const FloatQuad&, bool fixed = false) const;
+    // Convert a local quad into the coordinate system of container, taking transforms into account.
+    FloatQuad localToContainerQuad(const FloatQuad&, RenderBoxModelObject* repaintContainer, bool fixed = false) const;
 
     // Return the offset from the container() renderer (excluding transforms)
     virtual IntSize offsetFromContainer(RenderObject*) const;
-
-    // width and height are without margins but include paddings and borders
-    virtual int width() const { return 0; }
-    virtual int height() const { return 0; }
-
-    virtual IntRect borderBox() const { return IntRect(0, 0, width(), height()); }
-    // Bounds of the outline box in absolute coords. Respects transforms
-    IntRect absoluteOutlineBounds() const;
-
-    // The height of a block when you include normal flow overflow spillage out of the bottom
-    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
-    // it would have an overflow height of borderTop() + paddingTop() + 100px.
-    virtual int overflowHeight(bool /*includeInterior*/ = true) const { return height(); }
-    virtual int overflowWidth(bool /*includeInterior*/ = true) const { return width(); }
-    virtual void setOverflowHeight(int) { }
-    virtual void setOverflowWidth(int) { }
-    virtual int overflowLeft(bool /*includeInterior*/ = true) const { return 0; }
-    virtual int overflowTop(bool /*includeInterior*/ = true) const { return 0; }
-    virtual IntRect overflowRect(bool /*includeInterior*/ = true) const { return borderBox(); }
-
-    // IE extensions. Used to calculate offsetWidth/Height.  Overridden by inlines (RenderFlow)
-    // to return the remaining width on a given line (and the height of a single line).
-    virtual int offsetWidth() const { return width(); }
-    virtual int offsetHeight() const { return height() + borderTopExtra() + borderBottomExtra(); }
-
-    // IE extensions.  Also supported by Gecko.  We override in render flow to get the
-    // left and top correct. -dwh
-    virtual int offsetLeft() const;
-    virtual int offsetTop() const;
-    virtual RenderObject* offsetParent() const;
-
-    // More IE extensions.  clientWidth and clientHeight represent the interior of an object
-    // excluding border and scrollbar.  clientLeft/Top are just the borderLeftWidth and borderTopWidth.
-    int clientLeft() const { return borderLeft(); }
-    int clientTop() const { return borderTop(); }
-    int clientWidth() const;
-    int clientHeight() const;
-
-    // scrollWidth/scrollHeight will be the same as clientWidth/clientHeight unless the
-    // object has overflow:hidden/scroll/auto specified and also has overflow.
-    // scrollLeft/Top return the current scroll position.  These methods are virtual so that objects like
-    // textareas can scroll shadow content (but pretend that they are the objects that are
-    // scrolling).
-    virtual int scrollLeft() const;
-    virtual int scrollTop() const;
-    virtual int scrollWidth() const;
-    virtual int scrollHeight() const;
-    virtual void setScrollLeft(int);
-    virtual void setScrollTop(int);
-
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
-    virtual bool canBeProgramaticallyScrolled(bool) const;
-    virtual void autoscroll();
-    virtual void stopAutoscroll() { }
-
-    virtual void panScroll(const IntPoint&);
-
-    virtual bool isScrollable() const;
-
-    // The following seven functions are used to implement collapsing margins.
-    // All objects know their maximal positive and negative margins.  The
-    // formula for computing a collapsed margin is |maxPosMargin|-|maxNegmargin|.
-    // For a non-collapsing, e.g., a leaf element, this formula will simply return
-    // the margin of the element.  Blocks override the maxTopMargin and maxBottomMargin
-    // methods.
-    virtual bool isSelfCollapsingBlock() const { return false; }
-    virtual int collapsedMarginTop() const { return maxTopMargin(true) - maxTopMargin(false); }
-    virtual int collapsedMarginBottom() const { return maxBottomMargin(true) - maxBottomMargin(false); }
-    virtual bool isTopMarginQuirk() const { return false; }
-    virtual bool isBottomMarginQuirk() const { return false; }
-
-    virtual int maxTopMargin(bool positive) const;
-    virtual int maxBottomMargin(bool positive) const;
-
-    virtual int marginTop() const { return 0; }
-    virtual int marginBottom() const { return 0; }
-    virtual int marginLeft() const { return 0; }
-    virtual int marginRight() const { return 0; }
-
-    // Virtual since table cells override
-    virtual int paddingTop() const;
-    virtual int paddingBottom() const;
-    virtual int paddingLeft() const;
-    virtual int paddingRight() const;
-
-    virtual int borderTop() const { return style()->borderTopWidth(); }
-    virtual int borderBottom() const { return style()->borderBottomWidth(); }
-    virtual int borderTopExtra() const { return 0; }
-    virtual int borderBottomExtra() const { return 0; }
-    virtual int borderLeft() const { return style()->borderLeftWidth(); }
-    virtual int borderRight() const { return style()->borderRightWidth(); }
-
-    virtual void addLineBoxRects(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
-
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
+    
+    virtual void absoluteRects(Vector<IntRect>&, int, int) { }
     // FIXME: useTransforms should go away eventually
     IntRect absoluteBoundingBoxRect(bool useTransforms = false);
 
     // Build an array of quads in absolute coords for line boxes
-    virtual void collectAbsoluteLineBoxQuads(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteQuads(Vector<FloatQuad>&) { }
 
     // the rect that will be painted if this object is passed as the paintingRoot
     IntRect paintingRootRect(IntRect& topLevelRect);
 
-    void addPDFURLRect(GraphicsContext*, const IntRect&);
-
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
-
     virtual int minPrefWidth() const { return 0; }
     virtual int maxPrefWidth() const { return 0; }
 
     RenderStyle* style() const { return m_style.get(); }
-    RenderStyle* firstLineStyle() const;
+    RenderStyle* firstLineStyle() const { return document()->usesFirstLineRules() ? firstLineStyleSlowCase() : style(); }
     RenderStyle* style(bool firstLine) const { return firstLine ? firstLineStyle() : style(); }
-
+    
+    // Anonymous blocks that are part of of a continuation chain will return their inline continuation's outline style instead.
+    // This is typically only relevant when repainting.
+    virtual RenderStyle* outlineStyleForRepaint() const { return style(); }
+    
     void getTextDecorationColors(int decorations, Color& underline, Color& overline,
                                  Color& linethrough, bool quirksMode = false);
 
-    enum BorderSide {
-        BSTop,
-        BSBottom,
-        BSLeft,
-        BSRight
-    };
-
-    void drawBorderArc(GraphicsContext*, int x, int y, float thickness, IntSize radius, int angleStart,
-                       int angleSpan, BorderSide, Color, const Color& textcolor, EBorderStyle, bool firstCorner);
-    void drawBorder(GraphicsContext*, int x1, int y1, int x2, int y2, BorderSide,
-                    Color, const Color& textcolor, EBorderStyle, int adjbw1, int adjbw2);
-
+    // Return the RenderBox in the container chain which is responsible for painting this object, or 0
+    // if painting is root-relative. This is the container that should be passed to the 'forRepaint'
+    // methods.
+    RenderBoxModelObject* containerForRepaint() const;
+    // Actually do the repaint of rect r for this object which has been computed in the coordinate space
+    // of repaintContainer. If repaintContainer is 0, repaint via the view.
+    void repaintUsingContainer(RenderBoxModelObject* repaintContainer, const IntRect& r, bool immediate = false);
+    
     // Repaint the entire object.  Called when, e.g., the color of a border changes, or when a border
     // style changes.
     void repaint(bool immediate = false);
@@ -743,7 +573,7 @@ public:
     void repaintRectangle(const IntRect&, bool immediate = false);
 
     // Repaint only if our old bounds and new bounds are different.
-    bool repaintAfterLayoutIfNeeded(const IntRect& oldBounds, const IntRect& oldOutlineBox);
+    bool repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintContainer, const IntRect& oldBounds, const IntRect& oldOutlineBox);
 
     // Repaint only if the object moved.
     virtual void repaintDuringLayoutIfMoved(const IntRect& rect);
@@ -755,42 +585,38 @@ public:
 
     // Returns the rect that should be repainted whenever this object changes.  The rect is in the view's
     // coordinate space.  This method deals with outlines and overflow.
-    virtual IntRect absoluteClippedOverflowRect();
-
-    IntRect getAbsoluteRepaintRectWithOutline(int ow);
+    IntRect absoluteClippedOverflowRect()
+    {
+        return clippedOverflowRectForRepaint(0);
+    }
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);    
+    virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
 
-    // Given a rect in the object's coordinate space, this method converts the rectangle to the view's
-    // coordinate space.
-    virtual void computeAbsoluteRepaintRect(IntRect&, bool fixed = false);
+    // Given a rect in the object's coordinate space, compute a rect suitable for repainting
+    // that rect in view coordinates.
+    void computeAbsoluteRepaintRect(IntRect& r, bool fixed = false)
+    {
+        return computeRectForRepaint(0, r, fixed);
+    }
+    // Given a rect in the object's coordinate space, compute a rect suitable for repainting
+    // that rect in the coordinate space of repaintContainer.
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
     virtual unsigned int length() const { return 1; }
 
     bool isFloatingOrPositioned() const { return (isFloating() || isPositioned()); }
-    virtual bool containsFloats() { return false; }
-    virtual bool containsFloat(RenderObject*) { return false; }
-    virtual bool hasOverhangingFloats() { return false; }
-    virtual bool expandsToEncloseOverhangingFloats() const { return isFloating() && style()->height().isAuto(); }
-
-    virtual void removePositionedObjects(RenderBlock*) { }
-
-    virtual bool avoidsFloats() const;
-    bool shrinkToAvoidFloats() const;
-
-    // positioning of inline children (bidi)
-    virtual void position(InlineBox*) { }
 
     bool isTransparent() const { return style()->opacity() < 1.0f; }
     float opacity() const { return style()->opacity(); }
 
     bool hasReflection() const { return m_hasReflection; }
-    IntRect reflectionBox() const;
-    int reflectionOffset() const;
-    // Given a rect in the object's coordinate space, returns the corresponding rect in the reflection.
-    IntRect reflectedRect(const IntRect&) const;
 
     // Applied as a "slop" to dirty rect checks during the outline painting phase's dirty-rect checks.
     int maximalOutlineSize(PaintPhase) const;
 
+    void setHasMarkupTruncation(bool b = true) { m_hasMarkupTruncation = b; }
+    bool hasMarkupTruncation() const { return m_hasMarkupTruncation; }
+
     enum SelectionState {
         SelectionNone, // The object is not selected.
         SelectionStart, // The object either contains the start of a selection run or is the start of a run
@@ -801,20 +627,21 @@ public:
 
     // The current selection state for an object.  For blocks, the state refers to the state of the leaf
     // descendants (as described above in the SelectionState enum declaration).
-    virtual SelectionState selectionState() const { return SelectionNone; }
+    SelectionState selectionState() const { return static_cast<SelectionState>(m_selectionState);; }
 
     // Sets the selection state for an object.
-    virtual void setSelectionState(SelectionState state) { if (parent()) parent()->setSelectionState(state); }
+    virtual void setSelectionState(SelectionState state) { m_selectionState = state; }
 
     // A single rectangle that encompasses all of the selected objects within this object.  Used to determine the tightest
     // possible bounding box for the selection.
-    virtual IntRect selectionRect(bool) { return IntRect(); }
+    IntRect selectionRect(bool clipToVisibleContent = true) { return selectionRectForRepaint(0, clipToVisibleContent); }
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* /*repaintContainer*/, bool /*clipToVisibleContent*/ = true) { return IntRect(); }
 
     // Whether or not an object can be part of the leaf elements of the selection.
     virtual bool canBeSelectionLeaf() const { return false; }
 
     // Whether or not a block has selected children.
-    virtual bool hasSelectedChildren() const { return false; }
+    bool hasSelectedChildren() const { return m_selectionState != SelectionNone; }
 
     // Obtains the selection colors that should be used when painting a selection.
     Color selectionBackgroundColor() const;
@@ -823,30 +650,6 @@ public:
     // Whether or not a given block needs to paint selection gaps.
     virtual bool shouldPaintSelectionGaps() const { return false; }
 
-    // This struct is used when the selection changes to cache the old and new state of the selection for each RenderObject.
-    struct SelectionInfo {
-        SelectionInfo()
-            : m_object(0)
-            , m_state(SelectionNone)
-        {
-        }
-
-        SelectionInfo(RenderObject* o, bool clipToVisibleContent)
-            : m_object(o)
-            , m_rect(o->needsLayout() ? IntRect() : o->selectionRect(clipToVisibleContent))
-            , m_state(o->selectionState())
-        {
-        }
-
-        RenderObject* object() const { return m_object; }
-        IntRect rect() const { return m_rect; }
-        SelectionState state() const { return m_state; }
-
-        RenderObject* m_object;
-        IntRect m_rect;
-        SelectionState m_state;
-    };
-
     Node* draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& dhtmlWillDrag) const;
 
     /**
@@ -857,12 +660,11 @@ public:
      */
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
 
-    virtual int lowestPosition(bool /*includeOverflowInterior*/ = true, bool /*includeSelf*/ = true) const { return 0; }
-    virtual int rightmostPosition(bool /*includeOverflowInterior*/ = true, bool /*includeSelf*/ = true) const { return 0; }
-    virtual int leftmostPosition(bool /*includeOverflowInterior*/ = true, bool /*includeSelf*/ = true) const { return 0; }
-
     virtual void calcVerticalMargins() { }
-    void removeFromObjectLists();
+    bool isTopMarginQuirk() const { return m_topMarginQuirk; }
+    bool isBottomMarginQuirk() const { return m_bottomMarginQuirk; }
+    void setTopMarginQuirk(bool b = true) { m_topMarginQuirk = b; }
+    void setBottomMarginQuirk(bool b = true) { m_bottomMarginQuirk = b; }
 
     // When performing a global document tear-down, the renderer of the document is cleared.  We use this
     // as a hook to detect the case of document destruction and don't waste time doing unnecessary work.
@@ -875,21 +677,19 @@ public:
     virtual bool isFlexingChildren() const { return false; }
     virtual bool isStretchingChildren() const { return false; }
 
-    // Convenience, to avoid repeating the code to dig down to get this.
-    UChar backslashAsCurrencySymbol() const;
-
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
     virtual unsigned caretMaxRenderedOffset() const;
 
     virtual int previousOffset(int current) const;
+    virtual int previousOffsetForBackwardDeletion(int current) const;
     virtual int nextOffset(int current) const;
 
     virtual void imageChanged(CachedImage*, const IntRect* = 0);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0) { }
     virtual bool willRenderImage(CachedImage*);
 
-    virtual void selectionStartEnd(int& spos, int& epos) const;
+    void selectionStartEnd(int& spos, int& epos) const;
 
     RenderObject* paintingRootForChildren(PaintInfo& paintInfo) const
     {
@@ -907,33 +707,79 @@ public:
     
     void remove() { if (parent()) parent()->removeChild(this); }
 
-    void invalidateVerticalPosition() { m_verticalPosition = PositionUndefined; }
-    
-    virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
-    
-    virtual void capsLockStateMayHaveChanged() { }
-
     AnimationController* animation() const;
 
     bool visibleToHitTesting() const { return style()->visibility() == VISIBLE && style()->pointerEvents() != PE_NONE; }
+
+    // Map points and quads through elements, potentially via 3d transforms. You should never need to call these directly; use
+    // localToAbsolute/absoluteToLocal methods instead.
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
+
+    bool shouldUseTransformFromContainer(const RenderObject* container) const;
+    void getTransformFromContainer(const RenderObject* container, const IntSize& offsetInContainer, TransformationMatrix&) const;
+    
+    virtual void addFocusRingRects(GraphicsContext*, int /*tx*/, int /*ty*/) { };
+
+    IntRect absoluteOutlineBounds() const
+    {
+        return outlineBoundsForRepaint(0);
+    }
+
+    bool replacedHasOverflow() const { return m_replacedHasOverflow; }
+    void setReplacedHasOverflow(bool b = true) { m_replacedHasOverflow = b; }
     
 protected:
     // Overrides should call the superclass at the end
-    virtual void styleWillChange(RenderStyle::Diff, const RenderStyle* newStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     // Overrides should call the superclass at the start
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
-    
-    virtual void printBoxDecorations(GraphicsContext*, int /*x*/, int /*y*/, int /*w*/, int /*h*/, int /*tx*/, int /*ty*/) { }
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-    virtual IntRect viewRect() const;
+    void paintOutline(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*);
+    void addPDFURLRect(GraphicsContext*, const IntRect&);
 
-    int getVerticalPosition(bool firstLine) const;
+    virtual IntRect viewRect() const;
 
     void adjustRectForOutlineAndShadow(IntRect&) const;
 
     void arenaDelete(RenderArena*, void* objectBase);
 
+    virtual IntRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/) const { return IntRect(); }
+
+    class LayoutRepainter {
+    public:
+        LayoutRepainter(RenderObject& object, bool checkForRepaint, const IntRect* oldBounds = 0)
+            : m_object(object)
+            , m_repaintContainer(0)
+            , m_checkForRepaint(checkForRepaint)
+        {
+            if (m_checkForRepaint) {
+                m_repaintContainer = m_object.containerForRepaint();
+                m_oldBounds = oldBounds ? *oldBounds : m_object.clippedOverflowRectForRepaint(m_repaintContainer);
+                m_oldOutlineBox = m_object.outlineBoundsForRepaint(m_repaintContainer);
+            }
+        }
+        
+        // Return true if it repainted.
+        bool repaintAfterLayout()
+        {
+            return m_checkForRepaint ? m_object.repaintAfterLayoutIfNeeded(m_repaintContainer, m_oldBounds, m_oldOutlineBox) : false;
+        }
+        
+        bool checkForRepaint() const { return m_checkForRepaint; }
+        
+    private:
+        RenderObject& m_object;
+        RenderBoxModelObject* m_repaintContainer;
+        IntRect m_oldBounds;
+        IntRect m_oldOutlineBox;
+        bool m_checkForRepaint;
+    };
+    
 private:
+    RenderStyle* firstLineStyleSlowCase() const;
+    StyleDifference adjustStyleDifference(StyleDifference, unsigned contextSensitiveProperties) const;
+    
     RefPtr<RenderStyle> m_style;
 
     Node* m_node;
@@ -944,9 +790,10 @@ private:
 
 #ifndef NDEBUG
     bool m_hasAXObject;
+    bool m_setNeedsLayoutForbidden : 1;
 #endif
-    mutable int m_verticalPosition;
 
+    // 32 bits have been used here. THERE ARE NO FREE BITS AVAILABLE.
     bool m_needsLayout               : 1;
     bool m_needsPositionedMovementLayout :1;
     bool m_normalChildNeedsLayout    : 1;
@@ -961,6 +808,7 @@ private:
 
     bool m_isAnonymous               : 1;
     bool m_isText                    : 1;
+    bool m_isBox                     : 1;
     bool m_inline                    : 1;
     bool m_replaced                  : 1;
     bool m_isDragging                : 1;
@@ -977,10 +825,145 @@ public:
     bool m_everHadLayout             : 1;
 
 private:
+    // These bitfields are moved here from subclasses to pack them together
+    // from RenderBlock
+    bool m_childrenInline : 1;
+    bool m_topMarginQuirk : 1;
+    bool m_bottomMarginQuirk : 1;
+    bool m_hasMarkupTruncation : 1;
+    unsigned m_selectionState : 3; // SelectionState
+    bool m_hasColumns : 1;
+    
+    // from RenderTableCell
+    bool m_cellWidthChanged : 1;
+
+    // from RenderReplaced
+    bool m_replacedHasOverflow : 1;
+
+private:
     // Store state between styleWillChange and styleDidChange
     static bool s_affectsParentBlock;
 };
 
+inline bool RenderObject::documentBeingDestroyed() const
+{
+    return !document()->renderer();
+}
+
+inline void RenderObject::setNeedsLayout(bool b, bool markParents)
+{
+    bool alreadyNeededLayout = m_needsLayout;
+    m_needsLayout = b;
+    if (b) {
+        ASSERT(!isSetNeedsLayoutForbidden());
+        if (!alreadyNeededLayout) {
+            if (markParents)
+                markContainingBlocksForLayout();
+            if (hasLayer())
+                setLayerNeedsFullRepaint();
+        }
+    } else {
+        m_everHadLayout = true;
+        m_posChildNeedsLayout = false;
+        m_normalChildNeedsLayout = false;
+        m_needsPositionedMovementLayout = false;
+    }
+}
+
+inline void RenderObject::setChildNeedsLayout(bool b, bool markParents)
+{
+    bool alreadyNeededLayout = m_normalChildNeedsLayout;
+    m_normalChildNeedsLayout = b;
+    if (b) {
+        ASSERT(!isSetNeedsLayoutForbidden());
+        if (!alreadyNeededLayout && markParents)
+            markContainingBlocksForLayout();
+    } else {
+        m_posChildNeedsLayout = false;
+        m_normalChildNeedsLayout = false;
+        m_needsPositionedMovementLayout = false;
+    }
+}
+
+inline void RenderObject::setNeedsPositionedMovementLayout()
+{
+    bool alreadyNeededLayout = needsLayout();
+    m_needsPositionedMovementLayout = true;
+    if (!alreadyNeededLayout) {
+        markContainingBlocksForLayout();
+        if (hasLayer())
+            setLayerNeedsFullRepaint();
+    }
+}
+
+inline bool objectIsRelayoutBoundary(const RenderObject *obj) 
+{
+    // FIXME: In future it may be possible to broaden this condition in order to improve performance.
+    // Table cells are excluded because even when their CSS height is fixed, their height()
+    // may depend on their contents.
+    return obj->isTextControl()
+        || (obj->hasOverflowClip() && !obj->style()->width().isIntrinsicOrAuto() && !obj->style()->height().isIntrinsicOrAuto() && !obj->style()->height().isPercent() && !obj->isTableCell())
+#if ENABLE(SVG)
+           || obj->isSVGRoot()
+#endif
+           ;
+}
+
+inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderObject* newRoot)
+{
+    ASSERT(!scheduleRelayout || !newRoot);
+
+    RenderObject* o = container();
+    RenderObject* last = this;
+
+    while (o) {
+        // Don't mark the outermost object of an unrooted subtree. That object will be 
+        // marked when the subtree is added to the document.
+        RenderObject* container = o->container();
+        if (!container && !o->isRenderView())
+            return;
+        if (!last->isText() && (last->style()->position() == FixedPosition || last->style()->position() == AbsolutePosition)) {
+            if ((last->style()->top().isAuto() && last->style()->bottom().isAuto()) || last->style()->top().isStatic()) {
+                RenderObject* parent = last->parent();
+                if (!parent->normalChildNeedsLayout()) {
+                    parent->setChildNeedsLayout(true, false);
+                    if (parent != newRoot)
+                        parent->markContainingBlocksForLayout(scheduleRelayout, newRoot);
+                }
+            }
+            if (o->m_posChildNeedsLayout)
+                return;
+            o->m_posChildNeedsLayout = true;
+            ASSERT(!o->isSetNeedsLayoutForbidden());
+        } else {
+            if (o->m_normalChildNeedsLayout)
+                return;
+            o->m_normalChildNeedsLayout = true;
+            ASSERT(!o->isSetNeedsLayoutForbidden());
+        }
+
+        if (o == newRoot)
+            return;
+
+        last = o;
+        if (scheduleRelayout && objectIsRelayoutBoundary(last))
+            break;
+        o = container;
+    }
+
+    if (scheduleRelayout)
+        last->scheduleRelayout();
+}
+
+inline void makeMatrixRenderable(TransformationMatrix& matrix)
+{
+#if !ENABLE(3D_RENDERING)
+    matrix.makeAffine();
+#else
+    UNUSED_PARAM(matrix);
+#endif
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
new file mode 100644
index 0000000000..32e856f3d6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
@@ -0,0 +1,426 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RenderObjectChildList.h"
+
+#include "AXObjectCache.h"
+#include "RenderBlock.h"
+#include "RenderCounter.h"
+#include "RenderImageGeneratedContent.h"
+#include "RenderInline.h"
+#include "RenderLayer.h"
+#include "RenderListItem.h"
+#include "RenderStyle.h"
+#include "RenderTextFragment.h"
+#include "RenderView.h"
+
+namespace WebCore {
+
+static void updateListMarkerNumbers(RenderObject* child)
+{
+    for (RenderObject* r = child; r; r = r->nextSibling()) {
+        if (r->isListItem())
+            static_cast<RenderListItem*>(r)->updateValue();
+    }
+}
+
+
+void RenderObjectChildList::destroyLeftoverChildren()
+{
+    while (firstChild()) {
+        if (firstChild()->isListMarker() || (firstChild()->style()->styleType() == FIRST_LETTER && !firstChild()->isText()))
+            firstChild()->remove();  // List markers are owned by their enclosing list and so don't get destroyed by this container. Similarly, first letters are destroyed by their remaining text fragment.
+        else {
+            // Destroy any anonymous children remaining in the render tree, as well as implicit (shadow) DOM elements like those used in the engine-based text fields.
+            if (firstChild()->node())
+                firstChild()->node()->setRenderer(0);
+            firstChild()->destroy();
+        }
+    }
+}
+
+RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, RenderObject* oldChild, bool fullRemove)
+{
+    ASSERT(oldChild->parent() == owner);
+
+    // So that we'll get the appropriate dirty bit set (either that a normal flow child got yanked or
+    // that a positioned child got yanked).  We also repaint, so that the area exposed when the child
+    // disappears gets repainted properly.
+    if (!owner->documentBeingDestroyed() && fullRemove && oldChild->m_everHadLayout) {
+        oldChild->setNeedsLayoutAndPrefWidthsRecalc();
+        oldChild->repaint();
+    }
+        
+    // If we have a line box wrapper, delete it.
+    if (oldChild->isBox())
+        toRenderBox(oldChild)->deleteLineBoxWrapper();
+
+    if (!owner->documentBeingDestroyed() && fullRemove) {
+        // if we remove visible child from an invisible parent, we don't know the layer visibility any more
+        RenderLayer* layer = 0;
+        if (owner->style()->visibility() != VISIBLE && oldChild->style()->visibility() == VISIBLE && !oldChild->hasLayer()) {
+            layer = owner->enclosingLayer();
+            layer->dirtyVisibleContentStatus();
+        }
+
+         // Keep our layer hierarchy updated.
+        if (oldChild->firstChild() || oldChild->hasLayer()) {
+            if (!layer)
+                layer = owner->enclosingLayer();
+            oldChild->removeLayers(layer);
+        }
+        
+        // renumber ordered lists
+        if (oldChild->isListItem())
+            updateListMarkerNumbers(oldChild->nextSibling());
+        
+        if (oldChild->isPositioned() && owner->childrenInline())
+            owner->dirtyLinesFromChangedChild(oldChild);
+    }
+    
+    // If oldChild is the start or end of the selection, then clear the selection to
+    // avoid problems of invalid pointers.
+    // FIXME: The SelectionController should be responsible for this when it
+    // is notified of DOM mutations.
+    if (!owner->documentBeingDestroyed() && oldChild->isSelectionBorder())
+        owner->view()->clearSelection();
+
+    // remove the child
+    if (oldChild->previousSibling())
+        oldChild->previousSibling()->setNextSibling(oldChild->nextSibling());
+    if (oldChild->nextSibling())
+        oldChild->nextSibling()->setPreviousSibling(oldChild->previousSibling());
+
+    if (firstChild() == oldChild)
+        setFirstChild(oldChild->nextSibling());
+    if (lastChild() == oldChild)
+        setLastChild(oldChild->previousSibling());
+
+    oldChild->setPreviousSibling(0);
+    oldChild->setNextSibling(0);
+    oldChild->setParent(0);
+
+    if (AXObjectCache::accessibilityEnabled())
+        owner->document()->axObjectCache()->childrenChanged(owner);
+
+    return oldChild;
+}
+
+void RenderObjectChildList::appendChildNode(RenderObject* owner, RenderObject* newChild, bool fullAppend)
+{
+    ASSERT(newChild->parent() == 0);
+    ASSERT(!owner->isBlockFlow() || (!newChild->isTableSection() && !newChild->isTableRow() && !newChild->isTableCell()));
+
+    newChild->setParent(owner);
+    RenderObject* lChild = lastChild();
+
+    if (lChild) {
+        newChild->setPreviousSibling(lChild);
+        lChild->setNextSibling(newChild);
+    } else
+        setFirstChild(newChild);
+
+    setLastChild(newChild);
+    
+    if (fullAppend) {
+        // Keep our layer hierarchy updated.  Optimize for the common case where we don't have any children
+        // and don't have a layer attached to ourselves.
+        RenderLayer* layer = 0;
+        if (newChild->firstChild() || newChild->hasLayer()) {
+            layer = owner->enclosingLayer();
+            newChild->addLayers(layer, newChild);
+        }
+
+        // if the new child is visible but this object was not, tell the layer it has some visible content
+        // that needs to be drawn and layer visibility optimization can't be used
+        if (owner->style()->visibility() != VISIBLE && newChild->style()->visibility() == VISIBLE && !newChild->hasLayer()) {
+            if (!layer)
+                layer = owner->enclosingLayer();
+            if (layer)
+                layer->setHasVisibleContent(true);
+        }
+        
+        if (!newChild->isFloatingOrPositioned() && owner->childrenInline())
+            owner->dirtyLinesFromChangedChild(newChild);
+    }
+
+    newChild->setNeedsLayoutAndPrefWidthsRecalc(); // Goes up the containing block hierarchy.
+    if (!owner->normalChildNeedsLayout())
+        owner->setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
+    
+    if (AXObjectCache::accessibilityEnabled())
+        owner->document()->axObjectCache()->childrenChanged(owner);
+}
+
+void RenderObjectChildList::insertChildNode(RenderObject* owner, RenderObject* child, RenderObject* beforeChild, bool fullInsert)
+{
+    if (!beforeChild) {
+        appendChildNode(owner, child);
+        return;
+    }
+
+    ASSERT(!child->parent());
+    while (beforeChild->parent() != owner && beforeChild->parent()->isAnonymousBlock())
+        beforeChild = beforeChild->parent();
+    ASSERT(beforeChild->parent() == owner);
+
+    ASSERT(!owner->isBlockFlow() || (!child->isTableSection() && !child->isTableRow() && !child->isTableCell()));
+
+    if (beforeChild == firstChild())
+        setFirstChild(child);
+
+    RenderObject* prev = beforeChild->previousSibling();
+    child->setNextSibling(beforeChild);
+    beforeChild->setPreviousSibling(child);
+    if (prev)
+        prev->setNextSibling(child);
+    child->setPreviousSibling(prev);
+
+    child->setParent(owner);
+    
+    if (fullInsert) {
+        // Keep our layer hierarchy updated.  Optimize for the common case where we don't have any children
+        // and don't have a layer attached to ourselves.
+        RenderLayer* layer = 0;
+        if (child->firstChild() || child->hasLayer()) {
+            layer = owner->enclosingLayer();
+            child->addLayers(layer, child);
+        }
+
+        // if the new child is visible but this object was not, tell the layer it has some visible content
+        // that needs to be drawn and layer visibility optimization can't be used
+        if (owner->style()->visibility() != VISIBLE && child->style()->visibility() == VISIBLE && !child->hasLayer()) {
+            if (!layer)
+                layer = owner->enclosingLayer();
+            if (layer)
+                layer->setHasVisibleContent(true);
+        }
+
+        
+        if (!child->isFloating() && owner->childrenInline())
+            owner->dirtyLinesFromChangedChild(child);
+    }
+
+    child->setNeedsLayoutAndPrefWidthsRecalc();
+    if (!owner->normalChildNeedsLayout())
+        owner->setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
+    
+    if (AXObjectCache::accessibilityEnabled())
+        owner->document()->axObjectCache()->childrenChanged(owner);
+}
+
+static RenderObject* beforeAfterContainer(RenderObject* container, PseudoId type)
+{
+    if (type == BEFORE) {
+        RenderObject* first = container;
+        do {
+            // Skip list markers.
+            first = first->firstChild();
+            while (first && first->isListMarker())
+                first = first->nextSibling();
+        } while (first && first->isAnonymous() && first->style()->styleType() == NOPSEUDO);
+        if (first && first->style()->styleType() != type)
+            return 0;
+        return first;
+    }
+    if (type == AFTER) {
+        RenderObject* last = container;
+        do {
+            last = last->lastChild();
+        } while (last && last->isAnonymous() && last->style()->styleType() == NOPSEUDO && !last->isListMarker());
+        if (last && last->style()->styleType() != type)
+            return 0;
+        return last;
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static RenderObject* findBeforeAfterParent(RenderObject* object)
+{
+    // Only table parts need to search for the :before or :after parent
+    if (!(object->isTable() || object->isTableSection() || object->isTableRow()))
+        return object;
+
+    RenderObject* beforeAfterParent = object;
+    while (beforeAfterParent && !(beforeAfterParent->isText() || beforeAfterParent->isImage()))
+        beforeAfterParent = beforeAfterParent->firstChild();
+    return beforeAfterParent;
+}
+
+static void invalidateCountersInContainer(RenderObject* container)
+{
+    if (!container)
+        return;
+    container = findBeforeAfterParent(container);
+    if (!container)
+        return;
+    for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
+        if (content->isCounter())
+            static_cast<RenderCounter*>(content)->invalidate();
+    }
+}
+
+void RenderObjectChildList::invalidateCounters(RenderObject* owner)
+{
+    ASSERT(!owner->documentBeingDestroyed());
+    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE));
+    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER));
+}
+
+void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject)
+{
+    // Double check that the document did in fact use generated content rules.  Otherwise we should not have been called.
+    ASSERT(owner->document()->usesBeforeAfterRules());
+
+    // In CSS2, before/after pseudo-content cannot nest.  Check this first.
+    if (owner->style()->styleType() == BEFORE || owner->style()->styleType() == AFTER)
+        return;
+    
+    if (!styledObject)
+        styledObject = owner;
+
+    RenderStyle* pseudoElementStyle = styledObject->getCachedPseudoStyle(type);
+    RenderObject* child = beforeAfterContainer(owner, type);
+
+    // Whether or not we currently have generated content attached.
+    bool oldContentPresent = child;
+
+    // Whether or not we now want generated content.  
+    bool newContentWanted = pseudoElementStyle && pseudoElementStyle->display() != NONE;
+
+    // For <q><p/></q>, if this object is the inline continuation of the <q>, we only want to generate
+    // :after content and not :before content.
+    if (newContentWanted && type == BEFORE && owner->isRenderInline() && toRenderInline(owner)->isInlineContinuation())
+        newContentWanted = false;
+
+    // Similarly, if we're the beginning of a <q>, and there's an inline continuation for our object,
+    // then we don't generate the :after content.
+    if (newContentWanted && type == AFTER && owner->isRenderInline() && toRenderInline(owner)->continuation())
+        newContentWanted = false;
+    
+    // If we don't want generated content any longer, or if we have generated content, but it's no longer
+    // identical to the new content data we want to build render objects for, then we nuke all
+    // of the old generated content.
+    if (!newContentWanted || (oldContentPresent && Node::diff(child->style(), pseudoElementStyle) == Node::Detach)) {
+        // Nuke the child. 
+        if (child && child->style()->styleType() == type) {
+            oldContentPresent = false;
+            child->destroy();
+            child = (type == BEFORE) ? owner->virtualChildren()->firstChild() : owner->virtualChildren()->lastChild();
+        }
+    }
+
+    // If we have no pseudo-element style or if the pseudo-element style's display type is NONE, then we
+    // have no generated content and can now return.
+    if (!newContentWanted)
+        return;
+
+    if (owner->isRenderInline() && !pseudoElementStyle->isDisplayInlineType() && pseudoElementStyle->floating() == FNONE &&
+        !(pseudoElementStyle->position() == AbsolutePosition || pseudoElementStyle->position() == FixedPosition))
+        // According to the CSS2 spec (the end of section 12.1), the only allowed
+        // display values for the pseudo style are NONE and INLINE for inline flows.
+        // FIXME: CSS2.1 lifted this restriction, but block display types will crash.
+        // For now we at least relax the restriction to allow all inline types like inline-block
+        // and inline-table.
+        pseudoElementStyle->setDisplay(INLINE);
+
+    if (oldContentPresent) {
+        if (child && child->style()->styleType() == type) {
+            // We have generated content present still.  We want to walk this content and update our
+            // style information with the new pseudo-element style.
+            child->setStyle(pseudoElementStyle);
+
+            RenderObject* beforeAfterParent = findBeforeAfterParent(child);
+            if (!beforeAfterParent)
+                return;
+
+            // Note that if we ever support additional types of generated content (which should be way off
+            // in the future), this code will need to be patched.
+            for (RenderObject* genChild = beforeAfterParent->firstChild(); genChild; genChild = genChild->nextSibling()) {
+                if (genChild->isText())
+                    // Generated text content is a child whose style also needs to be set to the pseudo-element style.
+                    genChild->setStyle(pseudoElementStyle);
+                else if (genChild->isImage()) {
+                    // Images get an empty style that inherits from the pseudo.
+                    RefPtr<RenderStyle> style = RenderStyle::create();
+                    style->inheritFrom(pseudoElementStyle);
+                    genChild->setStyle(style.release());
+                } else
+                    // Must be a first-letter container. updateFirstLetter() will take care of it.
+                    ASSERT(genChild->style()->styleType() == FIRST_LETTER);
+            }
+        }
+        return; // We've updated the generated content. That's all we needed to do.
+    }
+    
+    RenderObject* insertBefore = (type == BEFORE) ? owner->virtualChildren()->firstChild() : 0;
+
+    // Generated content consists of a single container that houses multiple children (specified
+    // by the content property).  This generated content container gets the pseudo-element style set on it.
+    RenderObject* generatedContentContainer = 0;
+    
+    // Walk our list of generated content and create render objects for each.
+    for (const ContentData* content = pseudoElementStyle->contentData(); content; content = content->next()) {
+        RenderObject* renderer = 0;
+        switch (content->type()) {
+            case CONTENT_NONE:
+                break;
+            case CONTENT_TEXT:
+                renderer = new (owner->renderArena()) RenderTextFragment(owner->document() /* anonymous object */, content->text());
+                renderer->setStyle(pseudoElementStyle);
+                break;
+            case CONTENT_OBJECT: {
+                RenderImageGeneratedContent* image = new (owner->renderArena()) RenderImageGeneratedContent(owner->document()); // anonymous object
+                RefPtr<RenderStyle> style = RenderStyle::create();
+                style->inheritFrom(pseudoElementStyle);
+                image->setStyle(style.release());
+                if (StyleImage* styleImage = content->image())
+                    image->setStyleImage(styleImage);
+                renderer = image;
+                break;
+            }
+            case CONTENT_COUNTER:
+                renderer = new (owner->renderArena()) RenderCounter(owner->document(), *content->counter());
+                renderer->setStyle(pseudoElementStyle);
+                break;
+        }
+
+        if (renderer) {
+            if (!generatedContentContainer) {
+                // Make a generated box that might be any display type now that we are able to drill down into children
+                // to find the original content properly.
+                generatedContentContainer = RenderObject::createObject(owner->document(), pseudoElementStyle);
+                generatedContentContainer->setStyle(pseudoElementStyle);
+                owner->addChild(generatedContentContainer, insertBefore);
+            }
+            generatedContentContainer->addChild(renderer);
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.h b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.h
new file mode 100644
index 0000000000..bf8800a2d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RenderObjectChildList_h
+#define RenderObjectChildList_h
+
+#include "RenderStyleConstants.h"
+
+namespace WebCore {
+
+class RenderObject;
+
+class RenderObjectChildList {
+public:
+    RenderObjectChildList()
+        : m_firstChild(0)
+        , m_lastChild(0)
+    {
+    }
+
+    RenderObject* firstChild() const { return m_firstChild; }
+    RenderObject* lastChild() const { return m_lastChild; }
+    
+    // FIXME: Temporary while RenderBox still exists. Eventually this will just happen during insert/append/remove methods on the child list, and nobody
+    // will need to manipulate firstChild or lastChild directly.
+    void setFirstChild(RenderObject* child) { m_firstChild = child; }
+    void setLastChild(RenderObject* child) { m_lastChild = child; }
+    
+    void destroyLeftoverChildren();
+
+    RenderObject* removeChildNode(RenderObject* owner, RenderObject*, bool fullRemove = true);
+    void appendChildNode(RenderObject* owner, RenderObject*, bool fullAppend = true);
+    void insertChildNode(RenderObject* owner, RenderObject* child, RenderObject* before, bool fullInsert = true);
+
+    void updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject = 0);
+    void invalidateCounters(RenderObject* owner);
+
+private:
+    RenderObject* m_firstChild;
+    RenderObject* m_lastChild;
+};
+
+} // namespace WebCore
+
+#endif // RenderObjectChildList_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp
index d8404184b1..bcf9ef9a50 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPart.cpp
@@ -1,10 +1,8 @@
-/**
- * This file is part of the KDE project.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,22 +20,16 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "RenderPart.h"
 
-#include "Document.h"
 #include "Frame.h"
-#include "FrameTree.h"
 #include "FrameView.h"
-#include "HTMLFrameOwnerElement.h"
-#include "HTMLNames.h"
-#include "Page.h"
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
-RenderPart::RenderPart(HTMLFrameOwnerElement* node)
+RenderPart::RenderPart(Element* node)
     : RenderWidget(node)
 {
     // init RenderObject attributes
@@ -46,71 +38,37 @@ RenderPart::RenderPart(HTMLFrameOwnerElement* node)
 
 RenderPart::~RenderPart()
 {
-    // Since deref ends up calling setWidget back on us, need to make sure
-    // that widget is already 0 so it won't do any work.
-    Widget* widget = m_widget;
-    m_widget = 0;
-    if (widget && widget->isFrameView())
-        static_cast<FrameView*>(widget)->deref();
-    else
-        delete widget;
+    clearWidget();
 }
 
 void RenderPart::setWidget(Widget* widget)
 {
-    if (widget != m_widget) {
-        if (widget && widget->isFrameView())
-            static_cast<FrameView*>(widget)->ref();
-        RenderWidget::setWidget(widget);
+    if (widget == this->widget())
+        return;
 
-        // make sure the scrollbars are set correctly for restore
-        // ### find better fix
-        viewCleared();
-    }
-}
+    if (widget && widget->isFrameView())
+        static_cast<FrameView*>(widget)->ref();
+    RenderWidget::setWidget(widget);
 
-void RenderPart::viewCleared()
-{
+    // make sure the scrollbars are set correctly for restore
+    // ### find better fix
+    viewCleared();
 }
 
-void RenderPart::deleteWidget()
+void RenderPart::viewCleared()
 {
-    if (m_widget && m_widget->isFrameView())
-        static_cast<FrameView*>(m_widget)->deref();
-    else
-        delete m_widget;
 }
 
-// FIXME: This should not be necessary.  Remove this once WebKit knows to properly schedule
-// layouts using WebCore when objects resize.
-void RenderPart::updateWidgetPosition()
+void RenderPart::deleteWidget(Widget* widget)
 {
-    if (!m_widget)
-        return;
-    
-    int width, height;
-    FloatPoint absPos = localToAbsolute();
-    absPos.move(borderLeft() + paddingLeft(), borderTop() + paddingTop());
-    width = m_width - borderLeft() - borderRight() - paddingLeft() - paddingRight();
-    height = m_height - borderTop() - borderBottom() - paddingTop() - paddingBottom();
-    IntRect newBounds(absPos.x(), absPos.y(), width, height);
-    bool boundsChanged = newBounds != m_widget->frameRect();
-    if (boundsChanged) {
-        // The widget changed positions.  Update the frame geometry.
-        RenderArena *arena = ref();
-        element()->ref();
-        m_widget->setFrameRect(newBounds);
-        element()->deref();
-        deref(arena);
-    }
+    // Since deref ends up calling setWidget back on us, need to make sure
+    // that widget is already 0 so it won't do any work.
+    ASSERT(!this->widget());
 
-    // if the frame bounds got changed, or if view needs layout (possibly indicating
-    // content size is wrong) we have to do a layout to set the right widget size
-    if (m_widget && m_widget->isFrameView()) {
-        FrameView* frameView = static_cast<FrameView*>(m_widget);
-        if (boundsChanged || frameView->needsLayout())
-            frameView->layout();
-    }
+    if (widget && widget->isFrameView())
+        static_cast<FrameView*>(widget)->deref();
+    else
+        delete widget;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPart.h b/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
index e339468d91..e47ead0285 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,32 +27,24 @@
 
 namespace WebCore {
 
-class Frame;
-class HTMLFrameOwnerElement;
-
 class RenderPart : public RenderWidget {
 public:
-    RenderPart(HTMLFrameOwnerElement*);
+    RenderPart(Element*);
     virtual ~RenderPart();
     
-    virtual bool isRenderPart() const { return true; }
-    virtual const char* renderName() const { return "RenderPart"; }
-
-    virtual void setWidget(Widget*);
-
-    // FIXME: This should not be necessary.
-    // Remove this once WebKit knows to properly schedule layouts using WebCore when objects resize.
-    virtual void updateWidgetPosition();
-
     bool hasFallbackContent() const { return m_hasFallbackContent; }
 
+    virtual void setWidget(Widget*);
     virtual void viewCleared();
 
 protected:
     bool m_hasFallbackContent;
 
 private:
-    virtual void deleteWidget();
+    virtual bool isRenderPart() const { return true; }
+    virtual const char* renderName() const { return "RenderPart"; }
+
+    virtual void deleteWidget(Widget*);
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
index e5200e2359..5d9de1e1c1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,10 +25,7 @@
 #include "RenderPartObject.h"
 
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "FrameLoaderClient.h"
-#include "FrameTree.h"
-#include "FrameView.h"
 #include "HTMLEmbedElement.h"
 #include "HTMLIFrameElement.h"
 #include "HTMLNames.h"
@@ -40,11 +37,15 @@
 #include "RenderView.h"
 #include "Text.h"
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "HTMLVideoElement.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
 
-RenderPartObject::RenderPartObject(HTMLFrameOwnerElement* element)
+RenderPartObject::RenderPartObject(Element* element)
     : RenderPart(element)
 {
     // init RenderObject attributes
@@ -57,8 +58,8 @@ RenderPartObject::RenderPartObject(HTMLFrameOwnerElement* element)
 
 RenderPartObject::~RenderPartObject()
 {
-    if (m_view)
-        m_view->removeWidgetToUpdate(this);
+    if (frameView())
+        frameView()->removeWidgetToUpdate(this);
 }
 
 static bool isURLAllowed(Document* doc, const String& url)
@@ -80,46 +81,65 @@ static bool isURLAllowed(Document* doc, const String& url)
     return true;
 }
 
-static inline void mapClassIdToServiceType(const String& classId, String& serviceType, const PluginData* pluginData)
+typedef HashMap<String, String, CaseFoldingHash> ClassIdToTypeMap;
+
+static ClassIdToTypeMap* createClassIdToTypeMap()
+{
+    ClassIdToTypeMap* map = new ClassIdToTypeMap;
+    map->add("clsid:D27CDB6E-AE6D-11CF-96B8-444553540000", "application/x-shockwave-flash");
+    map->add("clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA", "audio/x-pn-realaudio-plugin");
+    map->add("clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B", "video/quicktime");
+    map->add("clsid:166B1BCA-3F9C-11CF-8075-444553540000", "application/x-director");
+#if ENABLE(ACTIVEX_TYPE_CONVERSION_WMPLAYER)
+    map->add("clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6", "application/x-mplayer2");
+    map->add("clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95", "application/x-mplayer2");
+#endif
+    return map;
+}
+
+static const String& activeXType()
+{
+    DEFINE_STATIC_LOCAL(String, activeXType, ("application/x-oleobject"));
+    return activeXType;
+}
+
+static inline bool havePlugin(const PluginData* pluginData, const String& type)
+{
+    return pluginData && !type.isEmpty() && pluginData->supportsMimeType(type);
+}
+
+static String serviceTypeForClassId(const String& classId, const PluginData* pluginData)
 {
     // Return early if classId is empty (since we won't do anything below).
     // Furthermore, if classId is null, calling get() below will crash.
     if (classId.isEmpty())
-        return;
-
-    typedef HashMap<String, String, CaseFoldingHash> ServiceTypeHashMap;
-    static ServiceTypeHashMap* serviceTypeFallbackForClassId = 0;
-    if (!serviceTypeFallbackForClassId) {
-        serviceTypeFallbackForClassId = new ServiceTypeHashMap;
-        serviceTypeFallbackForClassId->add("clsid:D27CDB6E-AE6D-11CF-96B8-444553540000", "application/x-shockwave-flash");
-        serviceTypeFallbackForClassId->add("clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA", "audio/x-pn-realaudio-plugin");
-        serviceTypeFallbackForClassId->add("clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B", "video/quicktime");
-        serviceTypeFallbackForClassId->add("clsid:166B1BCA-3F9C-11CF-8075-444553540000", "application/x-director");
-#if ENABLE(ACTIVEX_TYPE_CONVERSION_WMPLAYER)
-        serviceTypeFallbackForClassId->add("clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6", "application/x-mplayer2");
-        serviceTypeFallbackForClassId->add("clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95", "application/x-mplayer2");
-#endif
-    }
+        return String();
+
+    static ClassIdToTypeMap* map = createClassIdToTypeMap();
+    String type = map->get(classId);
 
-    const String fallbackServiceType = serviceTypeFallbackForClassId->get(classId);
-    if (pluginData->supportsMimeType(fallbackServiceType))
-        serviceType = fallbackServiceType;
-    else if (pluginData->supportsMimeType("application/x-oleobject"))
-        serviceType = "application/x-oleobject";
+    // If we do have a plug-in that supports generic ActiveX content and don't have a plug-in
+    // for the MIME type we came up with, ignore the MIME type we came up with and just use
+    // the ActiveX type.
+    if (havePlugin(pluginData, activeXType()) && !havePlugin(pluginData, type))
+        return activeXType();
+
+    return type;
 }
 
-static bool shouldUseChildEmbedOfObject(HTMLObjectElement* o, const PluginData* pluginData)
+static inline bool shouldUseEmbedDescendant(HTMLObjectElement* objectElement, const PluginData* pluginData)
 {
-    // An OBJECT tag with a classId is some kind of ActiveX control.  The most
-    // common controls have parallel plugin versions and thus possibly nested
-    // EMBED tags.  If this is the case, the OBJECT's classId should map to some
-    // known plugin MIME type.  If it doesn't, either the control is unlikely to
-    // have a parallel plugin implementation (so there's no point looking
-    // inside), or we've purposefully disabled conversion for this classId, in
-    // which case we want to use the ActiveX OBJECT instead of the EMBED anyway.
-    String serviceType;
-    mapClassIdToServiceType(o->classId(), serviceType, pluginData);
-    return serviceType != "application/x-oleobject";
+#if PLATFORM(MAC)
+    UNUSED_PARAM(objectElement);
+    UNUSED_PARAM(pluginData);
+    // On Mac, we always want to use the embed descendant.
+    return true;
+#else
+    // If we have both an <object> and <embed>, we always want to use the <embed> except when we have
+    // an ActiveX plug-in and plan to use it.
+    return !(havePlugin(pluginData, activeXType())
+        && serviceTypeForClassId(objectElement->classId(), pluginData) == activeXType());
+#endif
 }
 
 void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
@@ -128,10 +148,10 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
     String serviceType;
     Vector<String> paramNames;
     Vector<String> paramValues;
-    Frame* frame = m_view->frame();
+    Frame* frame = frameView()->frame();
 
-    if (element()->hasTagName(objectTag)) {
-        HTMLObjectElement* o = static_cast<HTMLObjectElement*>(element());
+    if (node()->hasTagName(objectTag)) {
+        HTMLObjectElement* o = static_cast<HTMLObjectElement*>(node());
 
         o->setNeedWidgetUpdate(false);
         if (!o->isFinishedParsingChildren())
@@ -140,8 +160,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         // Check for a child EMBED tag.
         HTMLEmbedElement* embed = 0;
         const PluginData* pluginData = frame->page()->pluginData();
-        if (pluginData && shouldUseChildEmbedOfObject(o, pluginData)) {
-            for (Node* child = o->firstChild(); child;) {
+        if (shouldUseEmbedDescendant(o, pluginData)) {
+            for (Node* child = o->firstChild(); child; ) {
                 if (child->hasTagName(embedTag)) {
                     embed = static_cast<HTMLEmbedElement*>(child);
                     break;
@@ -206,7 +226,7 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         }
         
         // Turn the attributes of either the EMBED tag or OBJECT tag into arrays, but don't override PARAM values.
-        NamedAttrMap* attributes = embedOrObject->attributes();
+        NamedNodeMap* attributes = embedOrObject->attributes();
         if (attributes) {
             for (unsigned i = 0; i < attributes->length(); ++i) {
                 Attribute* it = attributes->attributeItem(i);
@@ -219,8 +239,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         }
 
         // If we still don't have a type, try to map from a specific CLASSID to a type.
-        if (pluginData && serviceType.isEmpty())
-            mapClassIdToServiceType(o->classId(), serviceType, pluginData);
+        if (serviceType.isEmpty())
+            serviceType = serviceTypeForClassId(o->classId(), pluginData);
 
         if (!isURLAllowed(document(), url))
             return;
@@ -245,8 +265,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         bool success = frame->loader()->requestObject(this, url, AtomicString(o->name()), serviceType, paramNames, paramValues);
         if (!success && m_hasFallbackContent)
             o->renderFallbackContent();
-    } else if (element()->hasTagName(embedTag)) {
-        HTMLEmbedElement *o = static_cast<HTMLEmbedElement*>(element());
+    } else if (node()->hasTagName(embedTag)) {
+        HTMLEmbedElement *o = static_cast<HTMLEmbedElement*>(node());
         o->setNeedWidgetUpdate(false);
         url = o->url();
         serviceType = o->serviceType();
@@ -257,7 +277,7 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
             return;
 
         // add all attributes set on the embed object
-        NamedAttrMap* a = o->attributes();
+        NamedNodeMap* a = o->attributes();
         if (a) {
             for (unsigned i = 0; i < a->length(); ++i) {
                 Attribute* it = a->attributeItem(i);
@@ -278,6 +298,30 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
     }
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)        
+    else if (node()->hasTagName(videoTag) || node()->hasTagName(audioTag)) {
+        HTMLMediaElement* o = static_cast<HTMLMediaElement*>(node());
+
+        o->setNeedWidgetUpdate(false);
+        if (node()->hasTagName(videoTag)) {
+            HTMLVideoElement* vid = static_cast<HTMLVideoElement*>(node());
+            String poster = vid->poster();
+            if (!poster.isEmpty()) {
+                paramNames.append("_media_element_poster_");
+                paramValues.append(poster);
+            }
+        }
+
+        url = o->initialURL();
+        if (!url.isEmpty()) {
+            paramNames.append("_media_element_src_");
+            paramValues.append(url);
+        }
+
+        serviceType = "application/x-media-element-proxy-plugin";
+        frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
+    }
+#endif
 }
 
 void RenderPartObject::layout()
@@ -286,24 +330,24 @@ void RenderPartObject::layout()
 
     calcWidth();
     calcHeight();
-    adjustOverflowForBoxShadow();
+    adjustOverflowForBoxShadowAndReflect();
 
     RenderPart::layout();
 
-    if (!m_widget && m_view)
-        m_view->addWidgetToUpdate(this);
+    if (!widget() && frameView())
+        frameView()->addWidgetToUpdate(this);
 
     setNeedsLayout(false);
 }
 
 void RenderPartObject::viewCleared()
 {
-    if (element() && m_widget && m_widget->isFrameView()) {
-        FrameView* view = static_cast<FrameView*>(m_widget);
+    if (node() && widget() && widget()->isFrameView()) {
+        FrameView* view = static_cast<FrameView*>(widget());
         int marginw = -1;
         int marginh = -1;
-        if (element()->hasTagName(iframeTag)) {
-            HTMLIFrameElement* frame = static_cast<HTMLIFrameElement*>(element());
+        if (node()->hasTagName(iframeTag)) {
+            HTMLIFrameElement* frame = static_cast<HTMLIFrameElement*>(node());
             marginw = frame->getMarginWidth();
             marginh = frame->getMarginHeight();
         }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
index 98de5b9fa6..2159d3c069 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,13 +29,15 @@ namespace WebCore {
 
 class RenderPartObject : public RenderPart {
 public:
-    RenderPartObject(HTMLFrameOwnerElement*);
+    RenderPartObject(Element*);
     virtual ~RenderPartObject();
 
+    void updateWidget(bool onlyCreateNonNetscapePlugins);
+
+private:
     virtual const char* renderName() const { return "RenderPartObject"; }
 
     virtual void layout();
-    void updateWidget(bool onlyCreateNonNetscapePlugins);
 
     virtual void viewCleared();
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp
index e59574596f..4a7662f23f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPath.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
                   2005, 2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,9 +25,8 @@
 #if ENABLE(SVG)
 #include "RenderPath.h"
 
-#include <math.h>
-
 #include "FloatPoint.h"
+#include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "PointerEventsHitRules.h"
 #include "RenderSVGContainer.h"
@@ -41,7 +39,6 @@
 #include "SVGStyledTransformableElement.h"
 #include "SVGTransformList.h"
 #include "SVGURIReference.h"
-
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
@@ -66,16 +63,14 @@ private:
     RenderStyle* m_style;
 };
 
-// RenderPath
-RenderPath::RenderPath(RenderStyle* style, SVGStyledTransformableElement* node)
-    : RenderObject(node)
+RenderPath::RenderPath(SVGStyledTransformableElement* node)
+    : RenderSVGModelObject(node)
 {
-    ASSERT(style != 0);
-    ASSERT(static_cast<SVGElement*>(node)->isStyledTransformable());
 }
 
-RenderPath::~RenderPath()
+TransformationMatrix RenderPath::localToParentTransform() const
 {
+    return m_localTransform;
 }
 
 TransformationMatrix RenderPath::localTransform() const
@@ -83,16 +78,6 @@ TransformationMatrix RenderPath::localTransform() const
     return m_localTransform;
 }
 
-FloatPoint RenderPath::mapAbsolutePointToLocal(const FloatPoint& point) const
-{
-    // FIXME: does it make sense to map incoming points with the inverse of the
-    // absolute transform? 
-    double localX;
-    double localY;
-    absoluteTransform().inverse().map(point.x(), point.y(), &localX, &localY);
-    return FloatPoint::narrowPrecision(localX, localY);
-}
-
 bool RenderPath::fillContains(const FloatPoint& point, bool requiresFill) const
 {
     if (m_path.isEmpty())
@@ -104,110 +89,74 @@ bool RenderPath::fillContains(const FloatPoint& point, bool requiresFill) const
     return m_path.contains(point, style()->svgStyle()->fillRule());
 }
 
-FloatRect RenderPath::relativeBBox(bool includeStroke) const
+bool RenderPath::strokeContains(const FloatPoint& point, bool requiresStroke) const
 {
     if (m_path.isEmpty())
-        return FloatRect();
-
-    if (includeStroke) {
-        if (m_strokeBbox.isEmpty()) {
-            if (style()->svgStyle()->hasStroke()) {
-                BoundingRectStrokeStyleApplier strokeStyle(this, style());
-                m_strokeBbox = m_path.strokeBoundingRect(&strokeStyle);
-            } else {
-                if (m_fillBBox.isEmpty())
-                    m_fillBBox = m_path.boundingRect();
-
-                m_strokeBbox = m_fillBBox;
-            }
-        }
-
-        return m_strokeBbox;
-    }
+        return false;
 
-    if (m_fillBBox.isEmpty())
-        m_fillBBox = m_path.boundingRect();
+    if (requiresStroke && !SVGPaintServer::strokePaintServer(style(), this))
+        return false;
 
-    return m_fillBBox;
+    BoundingRectStrokeStyleApplier strokeStyle(this, style());
+    return m_path.strokeContains(&strokeStyle, point);
 }
 
-void RenderPath::setPath(const Path& newPath)
+FloatRect RenderPath::objectBoundingBox() const
 {
-    m_path = newPath;
-    m_strokeBbox = FloatRect();
-    m_fillBBox = FloatRect();
-}
+    if (m_path.isEmpty())
+        return FloatRect();
 
-const Path& RenderPath::path() const
-{
-    return m_path;
-}
+    if (m_cachedLocalFillBBox.isEmpty())
+        m_cachedLocalFillBBox = m_path.boundingRect();
 
-bool RenderPath::calculateLocalTransform()
-{
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGStyledTransformableElement*>(element())->animatedLocalTransform();
-    return (m_localTransform != oldTransform);
+    return m_cachedLocalFillBBox;
 }
 
-void RenderPath::layout()
+FloatRect RenderPath::repaintRectInLocalCoordinates() const
 {
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout() && selfNeedsLayout();
-    if (checkForRepaint) {
-        oldBounds = m_absoluteBounds;
-        oldOutlineBox = absoluteOutlineBounds();
-    }
-        
-    calculateLocalTransform();
-
-    setPath(static_cast<SVGStyledTransformableElement*>(element())->toPathData());
+    if (m_path.isEmpty())
+        return FloatRect();
 
-    m_absoluteBounds = absoluteClippedOverflowRect();
+    // If we already have a cached repaint rect, return that
+    if (!m_cachedLocalRepaintRect.isEmpty())
+        return m_cachedLocalRepaintRect;
 
-    setWidth(m_absoluteBounds.width());
-    setHeight(m_absoluteBounds.height());
+    if (!style()->svgStyle()->hasStroke())
+        m_cachedLocalRepaintRect = objectBoundingBox();
+    else {
+        BoundingRectStrokeStyleApplier strokeStyle(this, style());
+        m_cachedLocalRepaintRect = m_path.strokeBoundingRect(&strokeStyle);
+    }
 
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
+    // Markers and filters can paint outside of the stroke path
+    m_cachedLocalRepaintRect.unite(m_markerBounds);
+    m_cachedLocalRepaintRect.unite(filterBoundingBoxForRenderer(this));
 
-    setNeedsLayout(false);
+    return m_cachedLocalRepaintRect;
 }
 
-IntRect RenderPath::absoluteClippedOverflowRect()
+void RenderPath::setPath(const Path& newPath)
 {
-    FloatRect repaintRect = absoluteTransform().mapRect(relativeBBox(true));
-
-    // Markers can expand the bounding box
-    repaintRect.unite(m_markerBounds);
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(filter->filterBBoxForItemBBox(repaintRect));
-#endif
-
-    if (!repaintRect.isEmpty())
-        repaintRect.inflate(1); // inflate 1 pixel for antialiasing
-
-    return enclosingIntRect(repaintRect);
+    m_path = newPath;
+    m_cachedLocalRepaintRect = FloatRect();
+    m_cachedLocalFillBBox = FloatRect();
 }
 
-bool RenderPath::requiresLayer()
+const Path& RenderPath::path() const
 {
-    return false;
+    return m_path;
 }
 
-int RenderPath::lineHeight(bool, bool) const
+void RenderPath::layout()
 {
-    return relativeBBox(true).height();
-}
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout());
 
-int RenderPath::baselinePosition(bool, bool) const
-{
-    return relativeBBox(true).height();
+    SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
+    m_localTransform = element->animatedLocalTransform();
+    setPath(element->toPathData());
+
+    repainter.repaintAfterLayout();
+    setNeedsLayout(false);
 }
 
 static inline void fillAndStrokePath(const Path& path, GraphicsContext* context, RenderStyle* style, RenderPath* object)
@@ -233,23 +182,23 @@ void RenderPath::paint(PaintInfo& paintInfo, int, int)
         return;
             
     paintInfo.context->save();
-    paintInfo.context->concatCTM(localTransform());
+    paintInfo.context->concatCTM(localToParentTransform());
 
     SVGResourceFilter* filter = 0;
 
-    FloatRect boundingBox = relativeBBox(true);
+    FloatRect boundingBox = repaintRectInLocalCoordinates();
     if (paintInfo.phase == PaintPhaseForeground) {
         PaintInfo savedInfo(paintInfo);
 
         prepareToRenderSVGContent(this, paintInfo, boundingBox, filter);
         if (style()->svgStyle()->shapeRendering() == SR_CRISPEDGES)
-            paintInfo.context->setUseAntialiasing(false);
+            paintInfo.context->setShouldAntialias(false);
         fillAndStrokePath(m_path, paintInfo.context, style(), this);
 
-        if (static_cast<SVGStyledElement*>(element())->supportsMarkers())
+        if (static_cast<SVGStyledElement*>(node())->supportsMarkers())
             m_markerBounds = drawMarkersIfNeeded(paintInfo.context, paintInfo.rect, m_path);
 
-        finishRenderSVGContent(this, paintInfo, boundingBox, filter, savedInfo.context);
+        finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
     }
 
     if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth())
@@ -259,37 +208,28 @@ void RenderPath::paint(PaintInfo& paintInfo, int, int)
     paintInfo.context->restore();
 }
 
+// This method is called from inside paintOutline() since we call paintOutline()
+// while transformed to our coord system, return local coords
 void RenderPath::addFocusRingRects(GraphicsContext* graphicsContext, int, int) 
 {
-    graphicsContext->addFocusRingRect(enclosingIntRect(relativeBBox(true)));
+    graphicsContext->addFocusRingRect(enclosingIntRect(repaintRectInLocalCoordinates()));
 }
 
-void RenderPath::absoluteRects(Vector<IntRect>& rects, int, int, bool)
-{
-    rects.append(absoluteClippedOverflowRect());
-}
-
-void RenderPath::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    quads.append(absoluteClippedOverflowRect());
-}
-
-bool RenderPath::nodeAtPoint(const HitTestRequest&, HitTestResult& result, int _x, int _y, int, int, HitTestAction hitTestAction)
+bool RenderPath::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     // We only draw in the forground phase, so we only hit-test then.
     if (hitTestAction != HitTestForeground)
         return false;
-    
-    IntPoint absolutePoint(_x, _y);
+
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
     PointerEventsHitRules hitRules(PointerEventsHitRules::SVG_PATH_HITTESTING, style()->pointerEvents());
 
     bool isVisible = (style()->visibility() == VISIBLE);
     if (isVisible || !hitRules.requireVisible) {
-        FloatPoint hitPoint = mapAbsolutePointToLocal(absolutePoint);
-        if ((hitRules.canHitStroke && (style()->svgStyle()->hasStroke() || !hitRules.requireStroke) && strokeContains(hitPoint, hitRules.requireStroke))
-            || (hitRules.canHitFill && (style()->svgStyle()->hasFill() || !hitRules.requireFill) && fillContains(hitPoint, hitRules.requireFill))) {
-            updateHitTestResult(result, absolutePoint);
+        if ((hitRules.canHitStroke && (style()->svgStyle()->hasStroke() || !hitRules.requireStroke) && strokeContains(localPoint, hitRules.requireStroke))
+            || (hitRules.canHitFill && (style()->svgStyle()->hasFill() || !hitRules.requireFill) && fillContains(localPoint, hitRules.requireFill))) {
+            updateHitTestResult(result, roundedIntPoint(localPoint));
             return true;
         }
     }
@@ -421,7 +361,7 @@ FloatRect RenderPath::drawMarkersIfNeeded(GraphicsContext* context, const FloatR
 {
     Document* doc = document();
 
-    SVGElement* svgElement = static_cast<SVGElement*>(element());
+    SVGElement* svgElement = static_cast<SVGElement*>(node());
     ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
 
     SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(svgElement);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPath.h b/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
index e96439d9b1..a4aefedc45 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
@@ -3,8 +3,7 @@
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
                   2006 Apple Computer, Inc
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,64 +26,51 @@
 
 #if ENABLE(SVG)
 
-#include "TransformationMatrix.h"
 #include "FloatRect.h"
-
-#include "RenderObject.h"
+#include "RenderSVGModelObject.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
 class FloatPoint;
-class Path;
 class RenderSVGContainer;
 class SVGStyledTransformableElement;
 
-class RenderPath : public RenderObject
-{
+class RenderPath : public RenderSVGModelObject {
 public:
-    RenderPath(RenderStyle*, SVGStyledTransformableElement*);
-    virtual ~RenderPath();
+    RenderPath(SVGStyledTransformableElement*);
 
     // Hit-detection seperated for the fill and the stroke
     bool fillContains(const FloatPoint&, bool requiresFill = true) const;
     bool strokeContains(const FloatPoint&, bool requiresStroke = true) const;
 
-    // Returns an unscaled bounding box (not even including localTransform()) for this vector path
-    virtual FloatRect relativeBBox(bool includeStroke = true) const;
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    virtual TransformationMatrix localToParentTransform() const;
 
     const Path& path() const;
-    void setPath(const Path& newPath);
+    void setPath(const Path&);
 
     virtual bool isRenderPath() const { return true; }
     virtual const char* renderName() const { return "RenderPath"; }
-    
-    bool calculateLocalTransform();
-    virtual TransformationMatrix localTransform() const;
-    
+
     virtual void layout();
-    virtual IntRect absoluteClippedOverflowRect();
-    virtual bool requiresLayer();
-    virtual int lineHeight(bool b, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
     virtual void paint(PaintInfo&, int parentX, int parentY);
-
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
     FloatRect drawMarkersIfNeeded(GraphicsContext*, const FloatRect&, const Path&) const;
-    
+
 private:
-    FloatPoint mapAbsolutePointToLocal(const FloatPoint&) const;
+    virtual TransformationMatrix localTransform() const;
 
     mutable Path m_path;
-    mutable FloatRect m_fillBBox;
-    mutable FloatRect m_strokeBbox;
+    mutable FloatRect m_cachedLocalFillBBox;
+    mutable FloatRect m_cachedLocalRepaintRect;
     FloatRect m_markerBounds;
     TransformationMatrix m_localTransform;
-    IntRect m_absoluteBounds;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
index 79df0f1b48..e61ac8e780 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
@@ -28,6 +28,7 @@
 #include "RenderLayer.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "VisiblePosition.h"
 
 using namespace std;
 
@@ -42,8 +43,6 @@ const int cDefaultHeight = 150;
 RenderReplaced::RenderReplaced(Node* node)
     : RenderBox(node)
     , m_intrinsicSize(cDefaultWidth, cDefaultHeight)
-    , m_selectionState(SelectionNone)
-    , m_hasOverflow(false)
 {
     setReplaced(true);
 }
@@ -51,19 +50,17 @@ RenderReplaced::RenderReplaced(Node* node)
 RenderReplaced::RenderReplaced(Node* node, const IntSize& intrinsicSize)
     : RenderBox(node)
     , m_intrinsicSize(intrinsicSize)
-    , m_selectionState(SelectionNone)
-    , m_hasOverflow(false)
 {
     setReplaced(true);
 }
 
 RenderReplaced::~RenderReplaced()
 {
-    if (m_hasOverflow)
+    if (replacedHasOverflow())
         gOverflowRectMap->remove(this);
 }
 
-void RenderReplaced::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBox::styleDidChange(diff, oldStyle);
 
@@ -77,23 +74,16 @@ void RenderReplaced::layout()
 {
     ASSERT(needsLayout());
     
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout();
-    if (checkForRepaint) {
-        oldBounds = absoluteClippedOverflowRect();
-        oldOutlineBox = absoluteOutlineBounds();
-    }
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
     
-    m_height = minimumReplacedHeight();
+    setHeight(minimumReplacedHeight());
     
     calcWidth();
     calcHeight();
-    adjustOverflowForBoxShadow();
-    
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
+    adjustOverflowForBoxShadowAndReflect();
     
+    repainter.repaintAfterLayout();    
+
     setNeedsLayout(false);
 }
  
@@ -110,8 +100,8 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
     if (!shouldPaint(paintInfo, tx, ty))
         return;
     
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
     
     if (hasBoxDecorations() && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)) 
         paintBoxDecorations(paintInfo, tx, ty);
@@ -137,8 +127,25 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
         drawSelectionTint = false;
     }
 
+    bool clipToBorderRadius = style()->overflowX() != OVISIBLE && style()->hasBorderRadius(); 
+    if (clipToBorderRadius) {
+        // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
+        paintInfo.context->save();
+        
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+    }
+
     paintReplaced(paintInfo, tx, ty);
-    
+
+    if (clipToBorderRadius)
+        paintInfo.context->restore();
+        
+    // The selection tint never gets clipped by border-radius rounding, since we want it to run right up to the edges of
+    // surrounding content.
     if (drawSelectionTint) {
         IntRect selectionPaintingRect = localSelectionRect();
         selectionPaintingRect.move(tx, ty);
@@ -159,8 +166,8 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     if (style()->visibility() != VISIBLE)
         return false;
 
-    int currentTX = tx + m_x;
-    int currentTY = ty + m_y;
+    int currentTX = tx + x();
+    int currentTY = ty + y();
 
     // Early exit if the element touches the edges.
     int top = currentTY + overflowTop();
@@ -215,11 +222,11 @@ unsigned RenderReplaced::caretMaxRenderedOffset() const
     return 1; 
 }
 
-VisiblePosition RenderReplaced::positionForCoordinates(int x, int y)
+VisiblePosition RenderReplaced::positionForPoint(const IntPoint& point)
 {
     InlineBox* box = inlineBoxWrapper();
     if (!box)
-        return VisiblePosition(element(), 0, DOWNSTREAM);
+        return createVisiblePosition(0, DOWNSTREAM);
 
     // FIXME: This code is buggy if the replaced element is relative positioned.
 
@@ -228,22 +235,22 @@ VisiblePosition RenderReplaced::positionForCoordinates(int x, int y)
     int top = root->topOverflow();
     int bottom = root->nextRootBox() ? root->nextRootBox()->topOverflow() : root->bottomOverflow();
 
-    if (y + yPos() < top)
-        return VisiblePosition(element(), caretMinOffset(), DOWNSTREAM); // coordinates are above
+    if (point.y() + y() < top)
+        return createVisiblePosition(caretMinOffset(), DOWNSTREAM); // coordinates are above
     
-    if (y + yPos() >= bottom)
-        return VisiblePosition(element(), caretMaxOffset(), DOWNSTREAM); // coordinates are below
+    if (point.y() + y() >= bottom)
+        return createVisiblePosition(caretMaxOffset(), DOWNSTREAM); // coordinates are below
     
-    if (element()) {
-        if (x <= width() / 2)
-            return VisiblePosition(element(), 0, DOWNSTREAM);
-        return VisiblePosition(element(), 1, DOWNSTREAM);
+    if (node()) {
+        if (point.x() <= width() / 2)
+            return createVisiblePosition(0, DOWNSTREAM);
+        return createVisiblePosition(1, DOWNSTREAM);
     }
 
-    return RenderBox::positionForCoordinates(x, y);
+    return RenderBox::positionForPoint(point);
 }
 
-IntRect RenderReplaced::selectionRect(bool clipToVisibleContent)
+IntRect RenderReplaced::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent)
 {
     ASSERT(!needsLayout());
 
@@ -252,11 +259,9 @@ IntRect RenderReplaced::selectionRect(bool clipToVisibleContent)
     
     IntRect rect = localSelectionRect();
     if (clipToVisibleContent)
-        computeAbsoluteRepaintRect(rect);
-    else {
-        FloatPoint absPos = localToAbsoluteForContent(FloatPoint());
-        rect.move(absPos.x(), absPos.y());
-    }
+        computeRectForRepaint(repaintContainer, rect);
+    else
+        rect = localToContainerQuad(FloatRect(rect), repaintContainer).enclosingBoundingBox();
     
     return rect;
 }
@@ -268,19 +273,19 @@ IntRect RenderReplaced::localSelectionRect(bool checkWhetherSelected) const
 
     if (!m_inlineBoxWrapper)
         // We're a block-level replaced element.  Just return our own dimensions.
-        return IntRect(0, 0, width(), height() + borderTopExtra() + borderBottomExtra());
+        return IntRect(0, 0, width(), height());
 
     RenderBlock* cb =  containingBlock();
     if (!cb)
         return IntRect();
     
     RootInlineBox* root = m_inlineBoxWrapper->root();
-    return IntRect(0, root->selectionTop() - yPos(), width(), root->selectionHeight());
+    return IntRect(0, root->selectionTop() - y(), width(), root->selectionHeight());
 }
 
 void RenderReplaced::setSelectionState(SelectionState s)
 {
-    m_selectionState = s;
+    RenderBox::setSelectionState(s);
     if (m_inlineBoxWrapper) {
         RootInlineBox* line = m_inlineBoxWrapper->root();
         if (line)
@@ -303,7 +308,7 @@ bool RenderReplaced::isSelected() const
     if (s == SelectionStart)
         return selectionStart == 0;
         
-    int end = element()->hasChildNodes() ? element()->childNodeCount() : 1;
+    int end = node()->hasChildNodes() ? node()->childNodeCount() : 1;
     if (s == SelectionEnd)
         return selectionEnd == end;
     if (s == SelectionBoth)
@@ -323,31 +328,39 @@ void RenderReplaced::setIntrinsicSize(const IntSize& size)
     m_intrinsicSize = size;
 }
 
-void RenderReplaced::adjustOverflowForBoxShadow()
+void RenderReplaced::adjustOverflowForBoxShadowAndReflect()
 {
     IntRect overflow;
     for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-        IntRect shadow = borderBox();
+        IntRect shadow = borderBoxRect();
         shadow.move(boxShadow->x, boxShadow->y);
         shadow.inflate(boxShadow->blur);
         overflow.unite(shadow);
     }
 
+    // Now that we have an overflow rect including shadow, let's make sure that
+    // the reflection (which can also include the shadow) is also included.
+    if (hasReflection()) {
+        if (overflow.isEmpty())
+            overflow = borderBoxRect();
+        overflow.unite(reflectedRect(overflow));
+    }
+
     if (!overflow.isEmpty()) {
         if (!gOverflowRectMap)
             gOverflowRectMap = new OverflowRectMap();
-        overflow.unite(borderBox());
+        overflow.unite(borderBoxRect());
         gOverflowRectMap->set(this, overflow);
-        m_hasOverflow = true;
-    } else if (m_hasOverflow) {
+        setReplacedHasOverflow(true);
+    } else if (replacedHasOverflow()) {
         gOverflowRectMap->remove(this);
-        m_hasOverflow = false;
+        setReplacedHasOverflow(false);
     }
 }
 
 int RenderReplaced::overflowHeight(bool) const
 {
-    if (m_hasOverflow) {
+    if (replacedHasOverflow()) {
         IntRect *r = &gOverflowRectMap->find(this)->second;
         return r->height() + r->y();
     }
@@ -357,7 +370,7 @@ int RenderReplaced::overflowHeight(bool) const
 
 int RenderReplaced::overflowWidth(bool) const
 {
-    if (m_hasOverflow) {
+    if (replacedHasOverflow()) {
         IntRect *r = &gOverflowRectMap->find(this)->second;
         return r->width() + r->x();
     }
@@ -367,7 +380,7 @@ int RenderReplaced::overflowWidth(bool) const
 
 int RenderReplaced::overflowLeft(bool) const
 {
-    if (m_hasOverflow)
+    if (replacedHasOverflow())
         return gOverflowRectMap->get(this).x();
 
     return 0;
@@ -375,7 +388,7 @@ int RenderReplaced::overflowLeft(bool) const
 
 int RenderReplaced::overflowTop(bool) const
 {
-    if (m_hasOverflow)
+    if (replacedHasOverflow())
         return gOverflowRectMap->get(this).y();
 
     return 0;
@@ -383,24 +396,27 @@ int RenderReplaced::overflowTop(bool) const
 
 IntRect RenderReplaced::overflowRect(bool) const
 {
-    if (m_hasOverflow)
+    if (replacedHasOverflow())
         return gOverflowRectMap->find(this)->second;
 
-    return borderBox();
+    return borderBoxRect();
 }
 
-IntRect RenderReplaced::absoluteClippedOverflowRect()
+IntRect RenderReplaced::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
         return IntRect();
 
-    // The selectionRect can project outside of the overflowRect, so use
-    // that for repainting to avoid selection painting glitches
-    IntRect r = localSelectionRect(false);
+    // The selectionRect can project outside of the overflowRect, so take their union
+    // for repainting to avoid selection painting glitches.
+    IntRect r = unionRect(localSelectionRect(false), overflowRect(false));
 
     RenderView* v = view();
-    if (v)
+    if (v) {
+        // FIXME: layoutDelta needs to be applied in parts before/after transforms and
+        // repaint containers. https://bugs.webkit.org/show_bug.cgi?id=23308
         r.move(v->layoutDelta());
+    }
 
     if (style()) {
         if (style()->hasAppearance())
@@ -409,7 +425,7 @@ IntRect RenderReplaced::absoluteClippedOverflowRect()
         if (v)
             r.inflate(style()->outlineSize());
     }
-    computeAbsoluteRepaintRect(r);
+    computeRectForRepaint(repaintContainer, r);
     return r;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
index 31867183d9..493744674a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
@@ -34,6 +34,8 @@ public:
 
     virtual const char* renderName() const { return "RenderReplaced"; }
 
+    virtual bool canHaveChildren() const { return false; }
+
     virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
 
@@ -53,33 +55,29 @@ public:
     virtual int overflowTop(bool includeInterior = true) const;
     virtual IntRect overflowRect(bool includeInterior = true) const;
 
-    virtual IntRect absoluteClippedOverflowRect();
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
 
     virtual unsigned caretMaxRenderedOffset() const;
-    virtual VisiblePosition positionForCoordinates(int x, int y);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
     
     virtual bool canBeSelectionLeaf() const { return true; }
-    virtual SelectionState selectionState() const { return static_cast<SelectionState>(m_selectionState); }
     virtual void setSelectionState(SelectionState);
-    virtual IntRect selectionRect(bool clipToVisibleContent = true);
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
 
     bool isSelected() const;
 
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     void setIntrinsicSize(const IntSize&);
     virtual void intrinsicSizeChanged();
 
     bool shouldPaint(PaintInfo&, int& tx, int& ty);
-    void adjustOverflowForBoxShadow();
+    void adjustOverflowForBoxShadowAndReflect();
     IntRect localSelectionRect(bool checkWhetherSelected = true) const;
 
 private:
     IntSize m_intrinsicSize;
-    
-    unsigned m_selectionState : 3; // SelectionState
-    bool m_hasOverflow : 1;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp
index 9556980599..e805298f2f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.cpp
@@ -35,24 +35,26 @@ namespace WebCore {
 
 RenderReplica::RenderReplica(Node* n)
 : RenderBox(n)
-{}
+{
+    // This is a hack. Replicas are synthetic, and don't pick up the attributes of the
+    // renderers being replicated, so they always report that they are inline, non-replaced.
+    // However, we need transforms to be applied to replicas for reflections, so have to pass
+    // the if (!isInline() || isReplaced()) check before setHasTransform().
+    setReplaced(true);
+}
 
 RenderReplica::~RenderReplica()
 {}
     
 void RenderReplica::layout()
 {
-    IntRect box = parent()->borderBox();
-    m_x = box.x();
-    m_y = box.y();
-    m_width = box.width();
-    m_height = box.height();
+    setFrameRect(parentBox()->borderBoxRect());
     setNeedsLayout(false);
 }
 
 void RenderReplica::calcPrefWidths()
 {
-    m_minPrefWidth = parent()->width();
+    m_minPrefWidth = parentBox()->width();
     m_maxPrefWidth = m_minPrefWidth;
     setPrefWidthsDirty(false);
 }
@@ -62,15 +64,15 @@ void RenderReplica::paint(PaintInfo& paintInfo, int tx, int ty)
     if (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseMask)
         return;
  
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
 
     if (paintInfo.phase == PaintPhaseForeground)
         // Turn around and paint the parent layer. Use temporary clipRects, so that the layer doesn't end up caching clip rects
         // computing using the wrong rootLayer
         layer()->parent()->paintLayer(layer()->transform() ? layer()->parent() : layer()->enclosingTransformedAncestor(),
                                       paintInfo.context, paintInfo.rect,
-                                      true, PaintRestrictionNone, 0,
+                                      true, PaintRestrictionNone, 0, 0,
                                       true,     // appliedTransform
                                       true);    // temporaryClipRects
     else if (paintInfo.phase == PaintPhaseMask)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h
index d3a90262d5..d5db3b742f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplica.h
@@ -40,7 +40,7 @@ public:
 
     virtual const char* renderName() const { return "RenderReplica"; }
     
-    virtual bool requiresLayer() { return true; }
+    virtual bool requiresLayer() const { return true; }
 
     virtual void layout();
     virtual void calcPrefWidths();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
index d545fd00de..f8afd0f6d7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
@@ -25,12 +25,13 @@
 #if ENABLE(SVG)
 
 #include "RenderBlock.h"
+#include "SVGRenderSupport.h"
 
 namespace WebCore {
 
 class SVGElement;
 
-class RenderSVGBlock : public RenderBlock {
+class RenderSVGBlock : public RenderBlock, protected SVGRenderBase {
 public:
     RenderSVGBlock(SVGElement*);
     virtual void setStyle(PassRefPtr<RenderStyle>);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
index 2d6b57fcb5..8a77d2edbe 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007, 2008 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,6 +26,7 @@
 #include "RenderSVGContainer.h"
 
 #include "AXObjectCache.h"
+#include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "RenderView.h"
 #include "SVGRenderSupport.h"
@@ -37,157 +37,15 @@
 namespace WebCore {
 
 RenderSVGContainer::RenderSVGContainer(SVGStyledElement* node)
-    : RenderObject(node)
-    , m_firstChild(0)
-    , m_lastChild(0)
-    , m_width(0)
-    , m_height(0)
+    : RenderSVGModelObject(node)
     , m_drawsContents(true)
 {
-    setReplaced(true);
 }
 
 RenderSVGContainer::~RenderSVGContainer()
 {
 }
 
-bool RenderSVGContainer::canHaveChildren() const
-{
-    return true;
-}
-
-void RenderSVGContainer::addChild(RenderObject* newChild, RenderObject* beforeChild)
-{
-    insertChildNode(newChild, beforeChild);
-}
-
-void RenderSVGContainer::removeChild(RenderObject* oldChild)
-{
-    // We do this here instead of in removeChildNode, since the only extremely low-level uses of remove/appendChildNode
-    // cannot affect the positioned object list, and the floating object list is irrelevant (since the list gets cleared on
-    // layout anyway).
-    oldChild->removeFromObjectLists();
-
-    removeChildNode(oldChild);
-}
-
-void RenderSVGContainer::destroy()
-{
-    destroyLeftoverChildren();
-    RenderObject::destroy();
-}
-
-void RenderSVGContainer::destroyLeftoverChildren()
-{
-    while (m_firstChild) {
-        // Destroy any anonymous children remaining in the render tree, as well as implicit (shadow) DOM elements like those used in the engine-based text fields.
-        if (m_firstChild->element())
-            m_firstChild->element()->setRenderer(0);
-
-        m_firstChild->destroy();
-    }
-}
-
-RenderObject* RenderSVGContainer::removeChildNode(RenderObject* oldChild, bool fullRemove)
-{
-    ASSERT(oldChild->parent() == this);
-
-    // So that we'll get the appropriate dirty bit set (either that a normal flow child got yanked or
-    // that a positioned child got yanked).  We also repaint, so that the area exposed when the child
-    // disappears gets repainted properly.
-    if (!documentBeingDestroyed() && fullRemove) {
-        oldChild->setNeedsLayoutAndPrefWidthsRecalc();
-        oldChild->repaint();
-    }
-
-    // If we have a line box wrapper, delete it.
-    oldChild->deleteLineBoxWrapper();
-
-    if (!documentBeingDestroyed() && fullRemove) {
-        // If oldChild is the start or end of the selection, then clear the selection to
-        // avoid problems of invalid pointers.
-        // FIXME: The SelectionController should be responsible for this when it
-        // is notified of DOM mutations.
-        if (oldChild->isSelectionBorder())
-            view()->clearSelection();
-    }
-
-    // remove the child
-    if (oldChild->previousSibling())
-        oldChild->previousSibling()->setNextSibling(oldChild->nextSibling());
-    if (oldChild->nextSibling())
-        oldChild->nextSibling()->setPreviousSibling(oldChild->previousSibling());
-
-    if (m_firstChild == oldChild)
-        m_firstChild = oldChild->nextSibling();
-    if (m_lastChild == oldChild)
-        m_lastChild = oldChild->previousSibling();
-
-    oldChild->setPreviousSibling(0);
-    oldChild->setNextSibling(0);
-    oldChild->setParent(0);
-
-    if (AXObjectCache::accessibilityEnabled())
-        document()->axObjectCache()->childrenChanged(this);
-
-    return oldChild;
-}
-
-void RenderSVGContainer::appendChildNode(RenderObject* newChild, bool)
-{
-    ASSERT(!newChild->parent());
-    ASSERT(newChild->element()->isSVGElement());
-
-    newChild->setParent(this);
-    RenderObject* lChild = m_lastChild;
-
-    if (lChild) {
-        newChild->setPreviousSibling(lChild);
-        lChild->setNextSibling(newChild);
-    } else
-        m_firstChild = newChild;
-
-    m_lastChild = newChild;
-
-    newChild->setNeedsLayoutAndPrefWidthsRecalc(); // Goes up the containing block hierarchy.
-    if (!normalChildNeedsLayout())
-        setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
-
-    if (AXObjectCache::accessibilityEnabled())
-        document()->axObjectCache()->childrenChanged(this);
-}
-
-void RenderSVGContainer::insertChildNode(RenderObject* child, RenderObject* beforeChild, bool)
-{
-    if (!beforeChild) {
-        appendChildNode(child);
-        return;
-    }
-
-    ASSERT(!child->parent());
-    ASSERT(beforeChild->parent() == this);
-    ASSERT(child->element()->isSVGElement());
-
-    if (beforeChild == m_firstChild)
-        m_firstChild = child;
-
-    RenderObject* prev = beforeChild->previousSibling();
-    child->setNextSibling(beforeChild);
-    beforeChild->setPreviousSibling(child);
-    if (prev)
-        prev->setNextSibling(child);
-    child->setPreviousSibling(prev);
-
-    child->setParent(this);
-
-    child->setNeedsLayoutAndPrefWidthsRecalc();
-    if (!normalChildNeedsLayout())
-        setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
-
-    if (AXObjectCache::accessibilityEnabled())
-        document()->axObjectCache()->childrenChanged(this);
-}
-
 bool RenderSVGContainer::drawsContents() const
 {
     return m_drawsContents;
@@ -198,49 +56,15 @@ void RenderSVGContainer::setDrawsContents(bool drawsContents)
     m_drawsContents = drawsContents;
 }
 
-TransformationMatrix RenderSVGContainer::localTransform() const
-{
-    return m_localTransform;
-}
-
-bool RenderSVGContainer::requiresLayer()
-{
-    // Only allow an <svg> element to generate a layer when it's positioned in a non-SVG context
-    return false;
-}
-
-int RenderSVGContainer::lineHeight(bool, bool) const
-{
-    return height() + marginTop() + marginBottom();
-}
-
-int RenderSVGContainer::baselinePosition(bool, bool) const
-{
-    return height() + marginTop() + marginBottom();
-}
-
-bool RenderSVGContainer::calculateLocalTransform()
-{
-    // subclasses can override this to add transform support
-    return false;
-}
-
 void RenderSVGContainer::layout()
 {
     ASSERT(needsLayout());
+    ASSERT(!view()->layoutStateEnabled()); // RenderSVGRoot disables layoutState for the SVG rendering tree.
 
-    // Arbitrary affine transforms are incompatible with LayoutState.
-    view()->disableLayoutState();
+    calcViewport(); // Allow RenderSVGViewportContainer to update its viewport
 
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout() && selfWillPaint();
-    if (checkForRepaint) {
-        oldBounds = m_absoluteBounds;
-        oldOutlineBox = absoluteOutlineBounds();
-    }
-    
-    calculateLocalTransform();
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() || selfWillPaint());
+    calculateLocalTransform(); // Allow RenderSVGTransformableContainer to update its transform
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         // Only force our kids to layout if we're being asked to relayout as a result of a parent changing
@@ -253,67 +77,14 @@ void RenderSVGContainer::layout()
         child->layoutIfNeeded();
         ASSERT(!child->needsLayout());
     }
+    repainter.repaintAfterLayout();
 
-    calcBounds();
-
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
-
-    view()->enableLayoutState();
     setNeedsLayout(false);
 }
 
-int RenderSVGContainer::calcReplacedWidth() const
-{
-    switch (style()->width().type()) {
-    case Fixed:
-        return max(0, style()->width().value());
-    case Percent:
-    {
-        const int cw = containingBlockWidth();
-        return cw > 0 ? max(0, style()->width().calcMinValue(cw)) : 0;
-    }
-    default:
-        return 0;
-    }
-}
-
-int RenderSVGContainer::calcReplacedHeight() const
-{
-    switch (style()->height().type()) {
-    case Fixed:
-        return max(0, style()->height().value());
-    case Percent:
-    {
-        RenderBlock* cb = containingBlock();
-        return style()->height().calcValue(cb->availableHeight());
-    }
-    default:
-        return 0;
-    }
-}
-
-void RenderSVGContainer::applyContentTransforms(PaintInfo& paintInfo)
-{
-    if (!localTransform().isIdentity())
-        paintInfo.context->concatCTM(localTransform());
-}
-
-void RenderSVGContainer::applyAdditionalTransforms(PaintInfo&)
-{
-    // no-op
-}
-
-void RenderSVGContainer::calcBounds()
-{
-    m_width = calcReplacedWidth();
-    m_height = calcReplacedHeight();
-    m_absoluteBounds = absoluteClippedOverflowRect();
-}
-
 bool RenderSVGContainer::selfWillPaint() const
 {
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     const SVGRenderStyle* svgStyle = style()->svgStyle();
     SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
     if (filter)
@@ -330,98 +101,75 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, int, int)
      // Spec: groups w/o children still may render filter content.
     if (!firstChild() && !selfWillPaint())
         return;
-    
-    paintInfo.context->save();
-    applyContentTransforms(paintInfo);
 
-    SVGResourceFilter* filter = 0;
-    PaintInfo savedInfo(paintInfo);
+    PaintInfo childPaintInfo(paintInfo);
 
-    FloatRect boundingBox = relativeBBox(true);
-    if (paintInfo.phase == PaintPhaseForeground)
-        prepareToRenderSVGContent(this, paintInfo, boundingBox, filter); 
+    childPaintInfo.context->save();
+
+    // Let the RenderSVGViewportContainer subclass clip if necessary
+    applyViewportClip(childPaintInfo);
 
-    applyAdditionalTransforms(paintInfo);
+    applyTransformToPaintInfo(childPaintInfo, localToParentTransform());
+
+    SVGResourceFilter* filter = 0;
+    FloatRect boundingBox = repaintRectInLocalCoordinates();
+    if (childPaintInfo.phase == PaintPhaseForeground)
+        prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
 
-    // default implementation. Just pass paint through to the children
-    PaintInfo childInfo(paintInfo);
-    childInfo.paintingRoot = paintingRootForChildren(paintInfo);
+    childPaintInfo.paintingRoot = paintingRootForChildren(childPaintInfo);
     for (RenderObject* child = firstChild(); child; child = child->nextSibling())
-        child->paint(childInfo, 0, 0);
+        child->paint(childPaintInfo, 0, 0);
 
     if (paintInfo.phase == PaintPhaseForeground)
-        finishRenderSVGContent(this, paintInfo, boundingBox, filter, savedInfo.context);
+        finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
 
-    paintInfo.context->restore();
-    
+    childPaintInfo.context->restore();
+
+    // FIXME: This really should be drawn from local coordinates, but currently we hack it
+    // to avoid our clip killing our outline rect.  Thus we translate our
+    // outline rect into parent coords before drawing.
+    // FIXME: This means our focus ring won't share our rotation like it should.
+    // We should instead disable our clip during PaintPhaseOutline
+    IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
     if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE)
-        paintOutline(paintInfo.context, m_absoluteBounds.x(), m_absoluteBounds.y(), m_absoluteBounds.width(), m_absoluteBounds.height(), style());
+        paintOutline(paintInfo.context, paintRectInParent.x(), paintRectInParent.y(), paintRectInParent.width(), paintRectInParent.height(), style());
 }
 
-TransformationMatrix RenderSVGContainer::viewportTransform() const
+// addFocusRingRects is called from paintOutline and needs to be in the same coordinates as the paintOuline call
+void RenderSVGContainer::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
 {
-     return TransformationMatrix();
+    IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
+    graphicsContext->addFocusRingRect(paintRectInParent);
 }
 
-IntRect RenderSVGContainer::absoluteClippedOverflowRect()
+FloatRect RenderSVGContainer::objectBoundingBox() const
 {
-    FloatRect repaintRect;
-
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        repaintRect.unite(current->absoluteClippedOverflowRect());
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(filter->filterBBoxForItemBBox(repaintRect));
-#endif
-
-    if (!repaintRect.isEmpty())
-        repaintRect.inflate(1); // inflate 1 pixel for antialiasing
-
-    return enclosingIntRect(repaintRect);
+    return computeContainerBoundingBox(this, false);
 }
 
-void RenderSVGContainer::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
+// RenderSVGContainer is used for <g> elements which do not themselves have a
+// width or height, so we union all of our child rects as our repaint rect.
+FloatRect RenderSVGContainer::repaintRectInLocalCoordinates() const
 {
-    graphicsContext->addFocusRingRect(m_absoluteBounds);
-}
+    FloatRect repaintRect = computeContainerBoundingBox(this, true);
 
-void RenderSVGContainer::absoluteRects(Vector<IntRect>& rects, int, int, bool)
-{
-    rects.append(absoluteClippedOverflowRect());
-}
+    // A filter on this container can paint outside of the union of the child repaint rects
+    repaintRect.unite(filterBoundingBoxForRenderer(this));
 
-void RenderSVGContainer::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    quads.append(absoluteClippedOverflowRect());
+    return repaintRect;
 }
 
-FloatRect RenderSVGContainer::relativeBBox(bool includeStroke) const
+bool RenderSVGContainer::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
-    FloatRect rect;
-    
-    RenderObject* current = firstChild();
-    for (; current != 0; current = current->nextSibling()) {
-        FloatRect childBBox = current->relativeBBox(includeStroke);
-        FloatRect mappedBBox = current->localTransform().mapRect(childBBox);
-
-        // <svg> can have a viewBox contributing to the bbox
-        if (current->isSVGContainer())
-            mappedBBox = static_cast<RenderSVGContainer*>(current)->viewportTransform().mapRect(mappedBBox);
-
-        rect.unite(mappedBBox);
-    }
+    // Give RenderSVGViewportContainer a chance to apply its viewport clip
+    if (!pointIsInsideViewportClip(pointInParent))
+        return false;
 
-    return rect;
-}
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
-bool RenderSVGContainer::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
-{
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-        if (child->nodeAtPoint(request, result, _x, _y, _tx, _ty, hitTestAction)) {
-            updateHitTestResult(result, IntPoint(_x - _tx, _y - _ty));
+        if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
+            updateHitTestResult(result, roundedIntPoint(localPoint));
             return true;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
index 48f5694501..4bb7e44d32 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -25,93 +24,52 @@
 
 #if ENABLE(SVG)
 
-#include "RenderPath.h"
-#include "SVGPreserveAspectRatio.h"
+#include "RenderSVGModelObject.h"
 
 namespace WebCore {
 
 class SVGElement;
 
-class RenderSVGContainer : public RenderObject {
+class RenderSVGContainer : public RenderSVGModelObject {
 public:
     RenderSVGContainer(SVGStyledElement*);
     ~RenderSVGContainer();
 
-    virtual RenderObject* firstChild() const { return m_firstChild; }
-    virtual RenderObject* lastChild() const { return m_lastChild; }
-
-    virtual int width() const { return m_width; }
-    virtual int height() const { return m_height; }
-
-    virtual bool canHaveChildren() const;
-    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
-    virtual void removeChild(RenderObject*);
-
-    virtual void destroy();
-    void destroyLeftoverChildren();
-
-    virtual RenderObject* removeChildNode(RenderObject*, bool fullRemove = true);
-    virtual void appendChildNode(RenderObject*, bool fullAppend = true);
-    virtual void insertChildNode(RenderObject* child, RenderObject* before, bool fullInsert = true);
-
-    // Designed for speed.  Don't waste time doing a bunch of work like layer updating and repainting when we know that our
-    // change in parentage is not going to affect anything.
-    virtual void moveChildNode(RenderObject* child) { appendChildNode(child->parent()->removeChildNode(child, false), false); }
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
 
-    virtual void calcPrefWidths() { setPrefWidthsDirty(false); }
-
-    // Some containers do not want it's children
-    // to be drawn, because they may be 'referenced'
-    // Example: <marker> children in SVG
+    // <marker> uses these methods to only allow drawing children during a special marker draw time
     void setDrawsContents(bool);
     bool drawsContents() const;
 
     virtual bool isSVGContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGContainer"; }
 
-    virtual bool requiresLayer();
-    virtual int lineHeight(bool b, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
-
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
-
-    virtual IntRect absoluteClippedOverflowRect();
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
-    FloatRect relativeBBox(bool includeStroke = true) const;
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
 
-    virtual bool calculateLocalTransform();
-    virtual TransformationMatrix localTransform() const;
-    virtual TransformationMatrix viewportTransform() const;
-
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
 protected:
-    virtual void applyContentTransforms(PaintInfo&);
-    virtual void applyAdditionalTransforms(PaintInfo&);
+    // Allow RenderSVGTransformableContainer to hook in at the right time in layout()
+    virtual void calculateLocalTransform() { }
 
-    void calcBounds();
+    // Allow RenderSVGViewportContainer to hook in at the right times in layout(), paint() and nodeAtFloatPoint()
+    virtual void calcViewport() { }
+    virtual void applyViewportClip(PaintInfo&) { }
+    virtual bool pointIsInsideViewportClip(const FloatPoint& /*pointInParent*/) { return true; }
 
 private:
-    int calcReplacedWidth() const;
-    int calcReplacedHeight() const;
-
-    RenderObject* m_firstChild;
-    RenderObject* m_lastChild;
-
-    int m_width;
-    int m_height;
-    
     bool selfWillPaint() const;
 
+    RenderObjectChildList m_children;
     bool m_drawsContents : 1;
-    
-protected:    
-    IntRect m_absoluteBounds;
-    TransformationMatrix m_localTransform;
 };
   
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp
index d0dc88116e..b81e7f41ff 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.cpp
@@ -42,7 +42,7 @@ RenderSVGGradientStop::~RenderSVGGradientStop()
 {
 }
 
-void RenderSVGGradientStop::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderSVGGradientStop::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderObject::styleDidChange(diff, oldStyle);
 
@@ -61,7 +61,7 @@ void RenderSVGGradientStop::layout()
 
 SVGGradientElement* RenderSVGGradientStop::gradientElement() const
 {
-    Node* parentNode = element()->parent();
+    Node* parentNode = node()->parent();
     if (parentNode->hasTagName(linearGradientTag) || parentNode->hasTagName(radialGradientTag))
         return static_cast<SVGGradientElement*>(parentNode);
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.h
index 86de6d04b3..1d0858d878 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGGradientStop.h
@@ -1,7 +1,6 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -41,14 +40,15 @@ namespace WebCore {
 
         virtual void layout();
 
-        // This override is needed to prevent crashing on <svg><stop /></svg>
-        // RenderObject's default impl asks the parent Object and RenderSVGRoot
-        // asks all child RenderObjects for overflow rects, thus infinite loop.
+        // This overrides are needed to prevent ASSERTs on <svg><stop /></svg>
+        // RenderObject's default implementations ASSERT_NOT_REACHED()
         // https://bugs.webkit.org/show_bug.cgi?id=20400
-        virtual IntRect absoluteClippedOverflowRect() { return IntRect(); }
-    
+        virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject*) { return IntRect(); }
+        virtual FloatRect objectBoundingBox() const { return FloatRect(); }
+        virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(); }
+
     protected:
-        virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+        virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     private:
         SVGGradientElement* gradientElement() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
index 4a7d6b20f5..f08c00808f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
@@ -39,21 +39,6 @@ RenderSVGHiddenContainer::~RenderSVGHiddenContainer()
 {
 }
 
-bool RenderSVGHiddenContainer::requiresLayer()
-{
-    return false;
-}
-
-int RenderSVGHiddenContainer::lineHeight(bool, bool) const
-{
-    return 0;
-}
-
-int RenderSVGHiddenContainer::baselinePosition(bool, bool) const
-{
-    return 0;
-}
-
 void RenderSVGHiddenContainer::layout()
 {
     ASSERT(needsLayout());
@@ -76,37 +61,32 @@ void RenderSVGHiddenContainer::paint(PaintInfo&, int, int)
     // This subtree does not paint.
 }
 
-IntRect RenderSVGHiddenContainer::absoluteClippedOverflowRect()
+IntRect RenderSVGHiddenContainer::clippedOverflowRectForRepaint(RenderBoxModelObject* /*repaintContainer*/)
 {
     return IntRect();
 }
 
-void RenderSVGHiddenContainer::absoluteRects(Vector<IntRect>&, int, int, bool)
+void RenderSVGHiddenContainer::absoluteRects(Vector<IntRect>&, int, int)
 {
     // This subtree does not take up space or paint
 }
 
-void RenderSVGHiddenContainer::absoluteQuads(Vector<FloatQuad>&, bool)
+void RenderSVGHiddenContainer::absoluteQuads(Vector<FloatQuad>&)
 {
     // This subtree does not take up space or paint
 }
 
-TransformationMatrix RenderSVGHiddenContainer::absoluteTransform() const
-{
-    return TransformationMatrix();
-}
-
-TransformationMatrix RenderSVGHiddenContainer::localTransform() const
+bool RenderSVGHiddenContainer::nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint&, HitTestAction)
 {
-    return TransformationMatrix();
+    return false;
 }
 
-bool RenderSVGHiddenContainer::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+FloatRect RenderSVGHiddenContainer::objectBoundingBox() const
 {
-    return false;
+    return FloatRect();
 }
 
-FloatRect RenderSVGHiddenContainer::relativeBBox(bool) const
+FloatRect RenderSVGHiddenContainer::repaintRectInLocalCoordinates() const
 {
     return FloatRect();
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
index 24c7ddde6a..5a208d0b2c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
@@ -37,29 +37,28 @@ namespace WebCore {
     public:
         RenderSVGHiddenContainer(SVGStyledElement*);
         virtual ~RenderSVGHiddenContainer();
-        
+
         virtual bool isSVGContainer() const { return true; }
         virtual bool isSVGHiddenContainer() const { return true; }
 
         virtual const char* renderName() const { return "RenderSVGHiddenContainer"; }
-        
-        virtual bool requiresLayer();
-        
-        virtual int lineHeight(bool b, bool isRootLineBox = false) const;
-        virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
-        
+
+        virtual bool requiresLayer() const { return false; }
+
         virtual void layout();
         virtual void paint(PaintInfo&, int parentX, int parentY);
         
-        virtual IntRect absoluteClippedOverflowRect();
-        virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-        virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
-        
-        virtual TransformationMatrix absoluteTransform() const;
-        virtual TransformationMatrix localTransform() const;
+        virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+        virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+        virtual void absoluteQuads(Vector<FloatQuad>&);
+
+        // FIXME: This override only exists to match existing LayoutTest results.
+        virtual TransformationMatrix absoluteTransform() const { return TransformationMatrix(); }
+
+        virtual FloatRect objectBoundingBox() const;
+        virtual FloatRect repaintRectInLocalCoordinates() const;
 
-        virtual FloatRect relativeBBox(bool includeStroke = true) const;
-        virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+        virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
index 61f65a0d6e..b38352ec72 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
@@ -3,8 +3,7 @@
     Copyright (C) 2006 Apple Computer, Inc.
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
     Copyright (C) 2007, 2008 Rob Buis <buis@kde.org>
-
-    This file is part of the WebKit project
+    Copyright (C) 2009, Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -29,8 +28,10 @@
 
 #include "Attr.h"
 #include "FloatConversion.h"
+#include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "PointerEventsHitRules.h"
+#include "RenderLayer.h"
 #include "SVGImageElement.h"
 #include "SVGLength.h"
 #include "SVGPreserveAspectRatio.h"
@@ -125,41 +126,25 @@ void RenderSVGImage::adjustRectsForAspectRatio(FloatRect& destRect, FloatRect& s
     }
 }
 
-bool RenderSVGImage::calculateLocalTransform()
-{
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGStyledTransformableElement*>(element())->animatedLocalTransform();
-    return (m_localTransform != oldTransform);
-}
-
 void RenderSVGImage::layout()
 {
     ASSERT(needsLayout());
-    
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout();
-    if (checkForRepaint) {
-        oldBounds = absoluteClippedOverflowRect();
-        oldOutlineBox = absoluteOutlineBounds();
-    }
-    
-    calculateLocalTransform();
+
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+
+    SVGImageElement* image = static_cast<SVGImageElement*>(node());
+    m_localTransform = image->animatedLocalTransform();
     
     // minimum height
-    m_height = errorOccurred() ? intrinsicSize().height() : 0;
+    setHeight(errorOccurred() ? intrinsicSize().height() : 0);
 
     calcWidth();
     calcHeight();
 
-    SVGImageElement* image = static_cast<SVGImageElement*>(node());
     m_localBounds = FloatRect(image->x().value(image), image->y().value(image), image->width().value(image), image->height().value(image));
 
-    calculateAbsoluteBounds();
-
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
-
+    repainter.repaintAfterLayout();
+    
     setNeedsLayout(false);
 }
 
@@ -169,7 +154,7 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
         return;
 
     paintInfo.context->save();
-    paintInfo.context->concatCTM(localTransform());
+    paintInfo.context->concatCTM(localToParentTransform());
 
     if (paintInfo.phase == PaintPhaseForeground) {
         SVGResourceFilter* filter = 0;
@@ -186,14 +171,16 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
             adjustRectsForAspectRatio(destRect, srcRect, imageElt->preserveAspectRatio());
 
         paintInfo.context->drawImage(image(), destRect, srcRect);
-
-        finishRenderSVGContent(this, paintInfo, m_localBounds, filter, savedInfo.context);
+        finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
     }
-    
+
+    if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth())
+        paintOutline(paintInfo.context, 0, 0, width(), height(), style());
+
     paintInfo.context->restore();
 }
 
-bool RenderSVGImage::nodeAtPoint(const HitTestRequest&, HitTestResult& result, int _x, int _y, int, int, HitTestAction hitTestAction)
+bool RenderSVGImage::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     // We only draw in the forground phase, so we only hit-test then.
     if (hitTestAction != HitTestForeground)
@@ -203,12 +190,11 @@ bool RenderSVGImage::nodeAtPoint(const HitTestRequest&, HitTestResult& result, i
     
     bool isVisible = (style()->visibility() == VISIBLE);
     if (isVisible || !hitRules.requireVisible) {
-        double localX, localY;
-        absoluteTransform().inverse().map(_x, _y, &localX, &localY);
+        FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
         if (hitRules.canHitFill) {
-            if (m_localBounds.contains(narrowPrecisionToFloat(localX), narrowPrecisionToFloat(localY))) {
-                updateHitTestResult(result, IntPoint(_x, _y));
+            if (m_localBounds.contains(localPoint)) {
+                updateHitTestResult(result, roundedIntPoint(localPoint));
                 return true;
             }
         }
@@ -217,60 +203,63 @@ bool RenderSVGImage::nodeAtPoint(const HitTestRequest&, HitTestResult& result, i
     return false;
 }
 
-bool RenderSVGImage::requiresLayer()
+bool RenderSVGImage::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
 {
+    ASSERT_NOT_REACHED();
     return false;
 }
 
-FloatRect RenderSVGImage::relativeBBox(bool) const
+FloatRect RenderSVGImage::objectBoundingBox() const
 {
     return m_localBounds;
 }
 
+FloatRect RenderSVGImage::repaintRectInLocalCoordinates() const
+{
+    FloatRect repaintRect = m_localBounds;
+
+    // Filters can paint outside the image content
+    repaintRect.unite(filterBoundingBoxForRenderer(this));
+
+    return repaintRect;
+}
+
 void RenderSVGImage::imageChanged(WrappedImagePtr image, const IntRect* rect)
 {
     RenderImage::imageChanged(image, rect);
 
     // We override to invalidate a larger rect, since SVG images can draw outside their "bounds"
-    repaintRectangle(absoluteClippedOverflowRect());
+    repaintRectangle(absoluteClippedOverflowRect());    // FIXME: Isn't this just repaint()?
 }
 
-void RenderSVGImage::calculateAbsoluteBounds()
+IntRect RenderSVGImage::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    // FIXME: broken with CSS transforms
-    FloatRect absoluteRect = absoluteTransform().mapRect(relativeBBox(true));
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        absoluteRect.unite(filter->filterBBoxForItemBBox(absoluteRect));
-#endif
-
-    if (!absoluteRect.isEmpty())
-        absoluteRect.inflate(1); // inflate 1 pixel for antialiasing
+    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+}
 
-    m_absoluteBounds = enclosingIntRect(absoluteRect);
+void RenderSVGImage::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+{
+    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
-IntRect RenderSVGImage::absoluteClippedOverflowRect()
+void RenderSVGImage::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
 {
-    return m_absoluteBounds;
+    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 void RenderSVGImage::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
 {
     // this is called from paint() after the localTransform has already been applied
-    IntRect contentRect = enclosingIntRect(relativeBBox());
+    IntRect contentRect = enclosingIntRect(repaintRectInLocalCoordinates());
     graphicsContext->addFocusRingRect(contentRect);
 }
 
-void RenderSVGImage::absoluteRects(Vector<IntRect>& rects, int, int, bool)
+void RenderSVGImage::absoluteRects(Vector<IntRect>& rects, int, int)
 {
     rects.append(absoluteClippedOverflowRect());
 }
 
-void RenderSVGImage::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderSVGImage::absoluteQuads(Vector<FloatQuad>& quads)
 {
     quads.append(FloatRect(absoluteClippedOverflowRect()));
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
index de8a2d3461..01b8b6503e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
@@ -2,8 +2,7 @@
     Copyright (C) 2006 Alexander Kellett <lypanov@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.
     Copyright (C) 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the WebKit project.
+    Copyright (C) 2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -29,23 +28,33 @@
 #include "TransformationMatrix.h"
 #include "FloatRect.h"
 #include "RenderImage.h"
+#include "SVGRenderSupport.h"
 
 namespace WebCore {
 
     class SVGImageElement;
     class SVGPreserveAspectRatio;
 
-    class RenderSVGImage : public RenderImage {
+    class RenderSVGImage : public RenderImage, SVGRenderBase {
     public:
         RenderSVGImage(SVGImageElement*);
         virtual ~RenderSVGImage();
-        
-        virtual TransformationMatrix localTransform() const { return m_localTransform; }
-        
-        virtual FloatRect relativeBBox(bool includeStroke = true) const;
-        virtual IntRect absoluteClippedOverflowRect();
-        virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-        virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+
+        virtual const char* renderName() const { return "RenderSVGImage"; }
+        virtual bool isSVGImage() const { return true; }
+
+        virtual TransformationMatrix localToParentTransform() const { return m_localTransform; }
+
+        virtual FloatRect objectBoundingBox() const;
+        virtual FloatRect repaintRectInLocalCoordinates() const;
+
+        virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+        virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+
+        virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
+        virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+        virtual void absoluteQuads(Vector<FloatQuad>&);
         virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
         virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
@@ -54,17 +63,16 @@ namespace WebCore {
         virtual void layout();
         virtual void paint(PaintInfo&, int parentX, int parentY);
 
-        bool requiresLayer();
+        bool requiresLayer() const { return false; }
 
+        virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
         virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int _x, int _y, int _tx, int _ty, HitTestAction);
 
-        bool calculateLocalTransform();
-
     private:
-        void calculateAbsoluteBounds();
+        virtual TransformationMatrix localTransform() const { return m_localTransform; }
+
         TransformationMatrix m_localTransform;
         FloatRect m_localBounds;
-        IntRect m_absoluteBounds;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp
index 11da004e9f..3c44dd813e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.cpp
@@ -2,7 +2,7 @@
  * This file is part of the WebKit project.
  *
  * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
- *           (C) 2006 Apple Computer Inc.
+ * Copyright (C) 2006 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,7 +26,11 @@
 #if ENABLE(SVG)
 #include "RenderSVGInline.h"
 
+#include "FloatQuad.h"
+#include "RenderBlock.h"
 #include "SVGInlineFlowBox.h"
+#include "SVGInlineTextBox.h"
+#include "SVGRootInlineBox.h"
 
 namespace WebCore {
     
@@ -35,22 +39,49 @@ RenderSVGInline::RenderSVGInline(Node* n)
 {
 }
 
-InlineBox* RenderSVGInline::createInlineBox(bool makePlaceHolderBox, bool isRootLineBox, bool isOnlyRun)
+InlineFlowBox* RenderSVGInline::createFlowBox()
 {
-    ASSERT(!(!isRootLineBox && (isReplaced() || makePlaceHolderBox)));
-    ASSERT(isInlineFlow());
+    InlineFlowBox* box = new (renderArena()) SVGInlineFlowBox(this);
+    box->setIsSVG(true);
+    return box;
+}
+
+void RenderSVGInline::absoluteRects(Vector<IntRect>& rects, int, int)
+{
+    InlineRunBox* firstBox = firstLineBox();
+
+    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
+    RenderBox* object = rootBox ? rootBox->block() : 0;
+
+    if (!object)
+        return;
+
+    int xRef = object->x();
+    int yRef = object->y();
+
+    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
+        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
+        rects.append(enclosingIntRect(localToAbsoluteQuad(rect).boundingBox()));
+    }
+}
+
+void RenderSVGInline::absoluteQuads(Vector<FloatQuad>& quads)
+{
+    InlineRunBox* firstBox = firstLineBox();
+
+    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
+    RenderBox* object = rootBox ? rootBox->block() : 0;
+
+    if (!object)
+        return;
 
-    InlineFlowBox* flowBox = new (renderArena()) SVGInlineFlowBox(this);
+    int xRef = object->x();
+    int yRef = object->y();
 
-    if (!m_firstLineBox)
-        m_firstLineBox = m_lastLineBox = flowBox;
-    else {
-        m_lastLineBox->setNextLineBox(flowBox);
-        flowBox->setPreviousLineBox(m_lastLineBox);
-        m_lastLineBox = flowBox;
+    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
+        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
+        quads.append(localToAbsoluteQuad(rect));
     }
-        
-    return flowBox;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h
index 42fdafcf2f..1ff8d02bfa 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInline.h
@@ -28,13 +28,21 @@
 #include "RenderInline.h"
 
 namespace WebCore {
+
 class RenderSVGInline : public RenderInline {
 public:
-        RenderSVGInline(Node*);
-        virtual const char* renderName() const { return "RenderSVGInline"; }
-        virtual InlineBox* createInlineBox(bool makePlaceHolderBox, bool isRootLineBox, bool isOnlyRun = false);
-        virtual bool requiresLayer() { return false; }
-    };
+    RenderSVGInline(Node*);
+    virtual const char* renderName() const { return "RenderSVGInline"; }
+    virtual bool requiresLayer() const { return false; }
+
+    // These are shared between RenderSVGTSpan and RenderSVGTextPath
+    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+    
+private:
+    virtual InlineFlowBox* createFlowBox();
+};
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.cpp
index 2212d783bf..b1a21d76f4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.cpp
@@ -29,10 +29,12 @@
 #include "RenderSVGInlineText.h"
 
 #include "FloatConversion.h"
+#include "FloatQuad.h"
 #include "RenderBlock.h"
 #include "RenderSVGRoot.h"
 #include "SVGInlineTextBox.h"
 #include "SVGRootInlineBox.h"
+#include "VisiblePosition.h"
 
 namespace WebCore {
 
@@ -53,27 +55,37 @@ RenderSVGInlineText::RenderSVGInlineText(Node* n, PassRefPtr<StringImpl> str)
 {
 }
 
-void RenderSVGInlineText::absoluteRects(Vector<IntRect>& rects, int, int, bool)
+
+void RenderSVGInlineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    // Skip RenderText's possible layout scheduling on style change
+    RenderObject::styleDidChange(diff, oldStyle);
+    
+    // FIXME: SVG text is apparently always transformed?
+    if (RefPtr<StringImpl> textToTransform = originalText())
+        setText(textToTransform.release(), true);
+}
+
+void RenderSVGInlineText::absoluteRects(Vector<IntRect>& rects, int, int)
 {
-    rects.append(computeAbsoluteRectForRange(0, textLength()));
+    rects.append(computeRepaintRectForRange(0, 0, textLength()));
 }
 
-void RenderSVGInlineText::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderSVGInlineText::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    quads.append(FloatRect(computeAbsoluteRectForRange(0, textLength())));
+    quads.append(computeRepaintQuadForRange(0, 0, textLength()));
 }
 
-IntRect RenderSVGInlineText::selectionRect(bool)
+IntRect RenderSVGInlineText::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool /*clipToVisibleContent*/)
 {
     ASSERT(!needsLayout());
 
-    IntRect rect;
     if (selectionState() == SelectionNone)
-        return rect;
+        return IntRect();
 
     // Early exit if we're ie. a <text> within a <defs> section.
     if (isChildOfHiddenContainer(this))
-        return rect;
+        return IntRect();
 
     // Now calculate startPos and endPos for painting selection.
     // We include a selection while endPos > 0
@@ -91,79 +103,83 @@ IntRect RenderSVGInlineText::selectionRect(bool)
     }
 
     if (startPos == endPos)
-        return rect;
+        return IntRect();
 
-    return computeAbsoluteRectForRange(startPos, endPos);
+    return computeRepaintRectForRange(repaintContainer, startPos, endPos);
 }
 
-IntRect RenderSVGInlineText::computeAbsoluteRectForRange(int startPos, int endPos)
+IntRect RenderSVGInlineText::computeRepaintRectForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos)
 {
-    IntRect rect;
+    FloatQuad repaintQuad = computeRepaintQuadForRange(repaintContainer, startPos, endPos);
+    return enclosingIntRect(repaintQuad.boundingBox());
+}
 
+FloatQuad RenderSVGInlineText::computeRepaintQuadForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos)
+{
     RenderBlock* cb = containingBlock();
     if (!cb || !cb->container())
-        return rect;
+        return FloatQuad();
 
     RenderSVGRoot* root = findSVGRootObject(parent());
     if (!root)
-        return rect;
+        return FloatQuad();
 
+    IntRect rect;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
         rect.unite(box->selectionRect(0, 0, startPos, endPos));
 
-    // Mimic RenderBox::computeAbsoluteRepaintRect() functionality. But only the subset needed for SVG and respecting SVG transformations.
-    FloatPoint absPos = cb->container()->localToAbsolute();
-
-    // Remove HTML parent translation offsets here! These need to be retrieved from the RenderSVGRoot object.
-    // But do take the containingBlocks's container position into account, ie. SVG text in scrollable <div>.
-    TransformationMatrix htmlParentCtm = root->RenderContainer::absoluteTransform();
-
-    FloatRect fixedRect(narrowPrecisionToFloat(rect.x() + absPos.x() - xPos() - htmlParentCtm.e()),
-                        narrowPrecisionToFloat(rect.y() + absPos.y() - yPos() - htmlParentCtm.f()), rect.width(), rect.height());
-    // FIXME: broken with CSS transforms
-    return enclosingIntRect(absoluteTransform().mapRect(fixedRect));
+    return localToContainerQuad(FloatQuad(rect), repaintContainer);
 }
 
-InlineTextBox* RenderSVGInlineText::createInlineTextBox()
+InlineTextBox* RenderSVGInlineText::createTextBox()
 {
-    return new (renderArena()) SVGInlineTextBox(this);
+    InlineTextBox* box = new (renderArena()) SVGInlineTextBox(this);
+    box->setIsSVG(true);
+    return box;
 }
 
-IntRect RenderSVGInlineText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* extraWidthToEndOfLine)
+IntRect RenderSVGInlineText::localCaretRect(InlineBox*, int, int*)
 {
-    // SVG doesn't have any editable content where a caret rect would be needed
+    // SVG doesn't have any editable content where a caret rect would be needed.
+    // FIXME: That's not sufficient. The localCaretRect function is also used for selection.
     return IntRect();
 }
 
-VisiblePosition RenderSVGInlineText::positionForCoordinates(int x, int y)
+VisiblePosition RenderSVGInlineText::positionForPoint(const IntPoint& point)
 {
     SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(firstTextBox());
 
     if (!textBox || textLength() == 0)
-        return VisiblePosition(element(), 0, DOWNSTREAM);
+        return createVisiblePosition(0, DOWNSTREAM);
 
     SVGRootInlineBox* rootBox = textBox->svgRootInlineBox();
-    RenderObject* object = rootBox ? rootBox->object() : 0;
+    RenderBlock* object = rootBox ? rootBox->block() : 0;
 
     if (!object)
-        return VisiblePosition(element(), 0, DOWNSTREAM);
+        return createVisiblePosition(0, DOWNSTREAM);
 
-    int offset = 0;
+    int closestOffsetInBox = 0;
 
+    // FIXME: This approach is wrong.  The correct code would first find the
+    // closest SVGInlineTextBox to the point, and *then* ask only that inline box
+    // what the closest text offset to that point is.  This code instead walks
+    // through all boxes in order, so when you click "near" a box, you'll actually
+    // end up returning the nearest offset in the last box, even if the
+    // nearest offset to your click is contained in another box.
     for (SVGInlineTextBox* box = textBox; box; box = static_cast<SVGInlineTextBox*>(box->nextTextBox())) {
-        if (box->svgCharacterHitsPosition(x + object->xPos(), y + object->yPos(), offset)) {
+        if (box->svgCharacterHitsPosition(point.x() + object->x(), point.y() + object->y(), closestOffsetInBox)) {
             // If we're not at the end/start of the box, stop looking for other selected boxes.
             if (box->direction() == LTR) {
-                if (offset <= (int) box->end() + 1)
+                if (closestOffsetInBox <= (int) box->end() + 1)
                     break;
             } else {
-                if (offset > (int) box->start())
+                if (closestOffsetInBox > (int) box->start())
                     break;
             }
         }
     }
 
-    return VisiblePosition(element(), offset, DOWNSTREAM);
+    return createVisiblePosition(closestOffsetInBox, DOWNSTREAM);
 }
 
 void RenderSVGInlineText::destroy()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
index cc371662f3..c4a096d46f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
@@ -34,22 +34,25 @@ class RenderSVGInlineText : public RenderText {
 public:
     RenderSVGInlineText(Node*, PassRefPtr<StringImpl>);
     virtual const char* renderName() const { return "RenderSVGInlineText"; }
+        
+    virtual void styleDidChange(StyleDifference, const RenderStyle*);
 
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
 
-    virtual bool requiresLayer() { return false; }
-    virtual IntRect selectionRect(bool clipToVisibleContent = true);
+    virtual bool requiresLayer() const { return false; }
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
     virtual bool isSVGText() const { return true; }
-    virtual InlineTextBox* createInlineTextBox();
 
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
-    virtual VisiblePosition positionForCoordinates(int x, int y);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
 
     virtual void destroy();
 
 private:
-    IntRect computeAbsoluteRectForRange(int startPos, int endPos);
+    virtual InlineTextBox* createTextBox();
+    IntRect computeRepaintRectForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos);
+    FloatQuad computeRepaintQuadForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos);
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.cpp
new file mode 100644
index 0000000000..3fab5a6bab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "RenderSVGModelObject.h"
+
+#include "GraphicsContext.h"
+#include "RenderLayer.h"
+#include "RenderView.h"
+#include "SVGStyledElement.h"
+
+#if ENABLE(FILTERS)
+#include "SVGResourceFilter.h"
+#endif
+
+namespace WebCore {
+
+RenderSVGModelObject::RenderSVGModelObject(SVGStyledElement* node)
+    : RenderObject(node)
+{
+}
+
+IntRect RenderSVGModelObject::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
+{
+    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+}
+
+void RenderSVGModelObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+{
+    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+}
+
+void RenderSVGModelObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
+{
+    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
+}
+
+// Copied from RenderBox, this method likely requires further refactoring to work easily for both SVG and CSS Box Model content.
+// FIXME: This may also need to move into SVGRenderBase as the RenderBox version depends
+// on borderBoundingBox() which SVG RenderBox subclases (like SVGRenderBlock) do not implement.
+IntRect RenderSVGModelObject::outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer) const
+{
+    IntRect box = enclosingIntRect(repaintRectInLocalCoordinates());
+    adjustRectForOutlineAndShadow(box);
+
+    FloatQuad containerRelativeQuad = localToContainerQuad(FloatRect(box), repaintContainer);
+    return containerRelativeQuad.enclosingBoundingBox();
+}
+
+void RenderSVGModelObject::absoluteRects(Vector<IntRect>& rects, int, int)
+{
+    rects.append(absoluteClippedOverflowRect());
+}
+
+void RenderSVGModelObject::absoluteQuads(Vector<FloatQuad>& quads)
+{
+    quads.append(absoluteClippedOverflowRect());
+}
+
+bool RenderSVGModelObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.h
new file mode 100644
index 0000000000..0aa13adc8f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGModelObject.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderSVGModelObject_h
+#define RenderSVGModelObject_h
+
+#if ENABLE(SVG)
+
+#include "RenderObject.h"
+#include "SVGRenderSupport.h"
+
+namespace WebCore {
+
+// Most renderers in the SVG rendering tree will inherit from this class
+// but not all. (e.g. RenderSVGForeignObject, RenderSVGBlock, RenderSVGImage) thus methods
+// required by SVG renders need to be declared on RenderObject, but shared
+// logic can go in this class or in SVGRenderBase.
+
+class SVGStyledElement;
+
+class RenderSVGModelObject : public RenderObject, protected SVGRenderBase {
+public:
+    RenderSVGModelObject(SVGStyledElement*);
+
+    virtual bool requiresLayer() const { return false; }
+
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+    virtual IntRect outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer) const;
+
+    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
+private:
+    // This method should never be called, SVG uses a different nodeAtPoint method
+    bool nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int xInContainer, int yInContainer, int dxParentToContainer, int dyParentToContainer, HitTestAction hitTestAction);
+};
+
+}
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
index 457ac0234e..80c29dd39e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007, 2008, 2009 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,24 +26,24 @@
 #include "RenderSVGRoot.h"
 
 #include "GraphicsContext.h"
-#include "RenderPath.h"
 #include "RenderSVGContainer.h"
 #include "RenderView.h"
 #include "SVGLength.h"
 #include "SVGRenderSupport.h"
-#include "SVGResourceClipper.h"
-#include "SVGResourceFilter.h"
-#include "SVGResourceMasker.h"
 #include "SVGSVGElement.h"
 #include "SVGStyledElement.h"
-#include "SVGURIReference.h"
+#include "TransformState.h"
+
+#if ENABLE(FILTERS)
+#include "SVGResourceFilter.h"
+#endif
 
 using namespace std;
 
 namespace WebCore {
 
 RenderSVGRoot::RenderSVGRoot(SVGStyledElement* node)
-    : RenderContainer(node)
+    : RenderBox(node)
 {
     setReplaced(true);
 }
@@ -86,69 +85,43 @@ void RenderSVGRoot::layout()
 {
     ASSERT(needsLayout());
 
-    calcViewport();
-
     // Arbitrary affine transforms are incompatible with LayoutState.
     view()->disableLayoutState();
 
-    IntRect oldBounds = m_absoluteBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout() && selfNeedsLayout();
-    if (checkForRepaint)
-        oldOutlineBox = absoluteOutlineBounds();
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout());
 
     calcWidth();
     calcHeight();
 
-    m_absoluteBounds = absoluteClippedOverflowRect();
-    SVGSVGElement* svg = static_cast<SVGSVGElement*>(element());
-    m_width = static_cast<int>(m_width * svg->currentScale());
-    m_height = static_cast<int>(m_height * svg->currentScale());
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
+    setWidth(static_cast<int>(width() * svg->currentScale()));
+    setHeight(static_cast<int>(height() * svg->currentScale()));
+
+    calcViewport();
     
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (selfNeedsLayout()) // either bounds or transform changed, force kids to relayout
-            child->setNeedsLayout(true);
+            child->setNeedsLayout(true, false);
         
         child->layoutIfNeeded();
         ASSERT(!child->needsLayout());
     }
 
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
+    repainter.repaintAfterLayout();
 
     view()->enableLayoutState();
     setNeedsLayout(false);
 }
 
-void RenderSVGRoot::applyContentTransforms(PaintInfo& paintInfo, int parentX, int parentY)
+bool RenderSVGRoot::selfWillPaint() const
 {
-    // Translate from parent offsets (html renderers) to a relative transform (svg renderers)
-    IntPoint origin;
-    origin.move(parentX, parentY);
-    origin.move(m_x, m_y);
-    origin.move(borderLeft(), borderTop());
-    origin.move(paddingLeft(), paddingTop());
-
-    if (origin.x() || origin.y()) {
-        paintInfo.context->concatCTM(TransformationMatrix().translate(origin.x(), origin.y()));
-        paintInfo.rect.move(-origin.x(), -origin.y());
-    }
-
-    // Respect scroll offset caused by html parents
-    TransformationMatrix ctm = RenderContainer::absoluteTransform();
-    paintInfo.rect.move(static_cast<int>(ctm.e()), static_cast<int>(ctm.f()));
-
-    SVGSVGElement* svg = static_cast<SVGSVGElement*>(element());
-    paintInfo.context->concatCTM(TransformationMatrix().scale(svg->currentScale()));
-
-    if (!viewport().isEmpty()) {
-        if (style()->overflowX() != OVISIBLE)
-            paintInfo.context->clip(enclosingIntRect(viewport())); // FIXME: Eventually we'll want float-precision clipping
-        
-        paintInfo.context->concatCTM(TransformationMatrix().translate(viewport().x(), viewport().y()));
-    }
-
-    paintInfo.context->concatCTM(TransformationMatrix().translate(svg->currentTranslate().x(), svg->currentTranslate().y()));
+#if ENABLE(FILTERS)
+    const SVGRenderStyle* svgStyle = style()->svgStyle();
+    SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
+    if (filter)
+        return true;
+#endif
+    return false;
 }
 
 void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
@@ -156,141 +129,131 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
     if (paintInfo.context->paintingDisabled())
         return;
 
-    calcViewport();
+    IntPoint parentOriginInContainer(parentX, parentY);
+    IntPoint borderBoxOriginInContainer = parentOriginInContainer + IntSize(x(), y());
+
+    if (hasBoxDecorations() && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)) 
+        paintBoxDecorations(paintInfo, borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y());
 
-    SVGSVGElement* svg = static_cast<SVGSVGElement*>(element());
-    // A value of zero disables rendering of the element. 
-    if (viewport().width() <= 0. || viewport().height() <= 0.)
+    // An empty viewport disables rendering.  FIXME: Should we still render filters?
+    if (viewportSize().isEmpty())
         return;
 
-    // This should only exist for <svg> renderers
-    if (hasBoxDecorations() && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)) 
-        paintBoxDecorations(paintInfo, m_x + parentX, m_y + parentY);
-
-    if (!firstChild()) {
-#if ENABLE(SVG_FILTERS)
-        // Spec: groups w/o children still may render filter content.
-        const SVGRenderStyle* svgStyle = style()->svgStyle();
-        SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
-        if (!filter)
-#endif
-            return;
-    }
+    // Don't paint if we don't have kids, except if we have filters we should paint those.
+    if (!firstChild() && !selfWillPaint())
+        return;
 
+    // Make a copy of the PaintInfo because applyTransformToPaintInfo will modify the damage rect.
     RenderObject::PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
- 
-    applyContentTransforms(childPaintInfo, parentX, parentY);
 
-    SVGResourceFilter* filter = 0;
+    // SVG does not support independent x/y clipping
+    if (style()->overflowX() != OVISIBLE)
+        childPaintInfo.context->clip(overflowClipRect(borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y()));
+
+    // Convert from container offsets (html renderers) to a relative transform (svg renderers).
+    // Transform from our paint container's coordinate system to our local coords.
+    applyTransformToPaintInfo(childPaintInfo, localToRepaintContainerTransform(parentOriginInContainer));
 
-    FloatRect boundingBox = relativeBBox(true);
+    SVGResourceFilter* filter = 0;
+    FloatRect boundingBox = repaintRectInLocalCoordinates();
     if (childPaintInfo.phase == PaintPhaseForeground)
-        prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);        
+        prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
 
-    childPaintInfo.context->concatCTM(svg->viewBoxToViewTransform(width(), height()));
-    RenderContainer::paint(childPaintInfo, 0, 0);
+    RenderBox::paint(childPaintInfo, 0, 0);
 
     if (childPaintInfo.phase == PaintPhaseForeground)
-        finishRenderSVGContent(this, childPaintInfo, boundingBox, filter, paintInfo.context);
+        finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
 
     childPaintInfo.context->restore();
-    
-    if ((childPaintInfo.phase == PaintPhaseOutline || childPaintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE)
-        paintOutline(childPaintInfo.context, m_absoluteBounds.x(), m_absoluteBounds.y(), m_absoluteBounds.width(), m_absoluteBounds.height(), style());
+
+    if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE)
+        paintOutline(paintInfo.context, borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y(), width(), height(), style());
 }
 
-FloatRect RenderSVGRoot::viewport() const
+const FloatSize& RenderSVGRoot::viewportSize() const
 {
-    return m_viewport;
+    return m_viewportSize;
 }
 
 void RenderSVGRoot::calcViewport()
 {
-    SVGElement* svgelem = static_cast<SVGElement*>(element());
-    if (svgelem->hasTagName(SVGNames::svgTag)) {
-        SVGSVGElement* svg = static_cast<SVGSVGElement*>(element());
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
 
-        if (!selfNeedsLayout() && !svg->hasRelativeValues())
-            return;
+    if (!selfNeedsLayout() && !svg->hasRelativeValues())
+        return;
 
-        float w, h;
+    if (!svg->hasSetContainerSize()) {
+        // In the normal case of <svg> being stand-alone or in a CSSBoxModel object we use
+        // RenderBox::width()/height() (which pulls data from RenderStyle)
+        m_viewportSize = FloatSize(width(), height());
+    } else {
+        // In the SVGImage case grab the SVGLength values off of SVGSVGElement and use
+        // the special relativeWidthValue accessors which respect the specified containerSize
         SVGLength width = svg->width();
-        if (width.unitType() == LengthTypePercentage && svg->hasSetContainerSize())
-            w = svg->relativeWidthValue();
-        else
-            w = width.value(svg);
-        
         SVGLength height = svg->height();
-        if (height.unitType() == LengthTypePercentage && svg->hasSetContainerSize())
-            h = svg->relativeHeightValue();
-        else
-            h = height.value(svg);
-
-        m_viewport = FloatRect(0, 0, w, h);
+        float viewportWidth = (width.unitType() == LengthTypePercentage) ? svg->relativeWidthValue() : width.value(svg);
+        float viewportHeight = (height.unitType() == LengthTypePercentage) ? svg->relativeHeightValue() : height.value(svg);
+        m_viewportSize = FloatSize(viewportWidth, viewportHeight);
     }
 }
 
-IntRect RenderSVGRoot::absoluteClippedOverflowRect()
+// RenderBox methods will expect coordinates w/o any transforms in coordinates
+// relative to our borderBox origin.  This method gives us exactly that.
+TransformationMatrix RenderSVGRoot::localToBorderBoxTransform() const
 {
-    IntRect repaintRect;
-
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        repaintRect.unite(current->absoluteClippedOverflowRect());
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(enclosingIntRect(filter->filterBBoxForItemBBox(repaintRect)));
-#endif
+    TransformationMatrix ctm;
+    IntSize borderAndPadding = borderOriginToContentBox();
+    ctm.translate(borderAndPadding.width(), borderAndPadding.height());
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
+    ctm.scale(svg->currentScale());
+    ctm.translate(svg->currentTranslate().x(), svg->currentTranslate().y());
+    return svg->viewBoxToViewTransform(width(), height()) * ctm;
+}
 
-    return repaintRect;
+IntSize RenderSVGRoot::parentOriginToBorderBox() const
+{
+    return IntSize(x(), y());
 }
 
-void RenderSVGRoot::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
+IntSize RenderSVGRoot::borderOriginToContentBox() const
 {
-    graphicsContext->addFocusRingRect(m_absoluteBounds);
+    return IntSize(borderLeft() + paddingLeft(), borderTop() + paddingTop());
 }
 
-void RenderSVGRoot::absoluteRects(Vector<IntRect>& rects, int, int)
+TransformationMatrix RenderSVGRoot::localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const
 {
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        current->absoluteRects(rects, 0, 0);
+    TransformationMatrix parentToContainer;
+    parentToContainer.translate(parentOriginInContainer.x(), parentOriginInContainer.y());
+    return localToParentTransform() * parentToContainer;
 }
 
-void RenderSVGRoot::absoluteQuads(Vector<FloatQuad>& quads, bool)
+TransformationMatrix RenderSVGRoot::localToParentTransform() const
 {
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        current->absoluteQuads(quads);
+    IntSize parentToBorderBoxOffset = parentOriginToBorderBox();
+
+    TransformationMatrix borderBoxOriginToParentOrigin;
+    borderBoxOriginToParentOrigin.translate(parentToBorderBoxOffset.width(), parentToBorderBoxOffset.height());
+
+    return localToBorderBoxTransform() * borderBoxOriginToParentOrigin;
 }
 
+// FIXME: This method should be removed as soon as callers to RenderBox::absoluteTransform() can be removed.
 TransformationMatrix RenderSVGRoot::absoluteTransform() const
 {
-    TransformationMatrix ctm = RenderContainer::absoluteTransform();
-    ctm.translate(m_x, m_y);
-    SVGSVGElement* svg = static_cast<SVGSVGElement*>(element());
-    ctm.scale(svg->currentScale());
-    ctm.translate(svg->currentTranslate().x(), svg->currentTranslate().y());
-    ctm.translate(viewport().x(), viewport().y());
-    return svg->viewBoxToViewTransform(width(), height()) * ctm;
+    // This would apply localTransform() twice if localTransform() were not the identity.
+    return localToParentTransform() * RenderBox::absoluteTransform();
 }
 
-FloatRect RenderSVGRoot::relativeBBox(bool includeStroke) const
+FloatRect RenderSVGRoot::objectBoundingBox() const
 {
-    FloatRect rect;
-    
-    RenderObject* current = firstChild();
-    for (; current != 0; current = current->nextSibling()) {
-        FloatRect childBBox = current->relativeBBox(includeStroke);
-        FloatRect mappedBBox = current->localTransform().mapRect(childBBox);
-        // <svg> can have a viewBox contributing to the bbox
-        if (current->isSVGContainer())
-            mappedBBox = static_cast<RenderSVGContainer*>(current)->viewportTransform().mapRect(mappedBBox);
-        rect.unite(mappedBBox);
-    }
+    return computeContainerBoundingBox(this, false);
+}
 
-    return rect;
+FloatRect RenderSVGRoot::repaintRectInLocalCoordinates() const
+{
+    // FIXME: This does not include the border but it should!
+    return computeContainerBoundingBox(this, true);
 }
 
 TransformationMatrix RenderSVGRoot::localTransform() const
@@ -298,48 +261,56 @@ TransformationMatrix RenderSVGRoot::localTransform() const
     return TransformationMatrix();
 }
 
+void RenderSVGRoot::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+{
+    // Apply our local transforms (except for x/y translation) and call RenderBox's method to handle all the normal CSS Box model bits
+    repaintRect = localToBorderBoxTransform().mapRect(repaintRect);
+    RenderBox::computeRectForRepaint(repaintContainer, repaintRect, fixed);
+}
+
+void RenderSVGRoot::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
+{
+    ASSERT(!fixed); // We should have no fixed content in the SVG rendering tree.
+    ASSERT(useTransforms); // mapping a point through SVG w/o respecting trasnforms is useless.
+
+    // Transform to our border box and let RenderBox transform the rest of the way.
+    transformState.applyTransform(localToBorderBoxTransform());
+    RenderBox::mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
+}
+
 bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
 {
-    TransformationMatrix ctm = RenderContainer::absoluteTransform();
-
-    int sx = (_tx - static_cast<int>(ctm.e())); // scroll offset
-    int sy = (_ty - static_cast<int>(ctm.f())); // scroll offset
- 
-    if (!viewport().isEmpty()
-        && style()->overflowX() == OHIDDEN
-        && style()->overflowY() == OHIDDEN) {
-        int tx = m_x - _tx + sx;
-        int ty = m_y - _ty + sy;
-
-        // Check if we need to do anything at all.
-        IntRect overflowBox = overflowRect(false);
-        overflowBox.move(tx, ty);
-        ctm.translate(viewport().x(), viewport().y());
-        double localX, localY;
-        ctm.inverse().map(_x - _tx, _y - _ty, &localX, &localY);
-        if (!overflowBox.contains((int)localX, (int)localY))
+    IntPoint pointInContainer(_x, _y);
+    IntSize containerToParentOffset(_tx, _ty);
+
+    IntPoint pointInParent = pointInContainer - containerToParentOffset;
+    IntPoint pointInBorderBox = pointInParent - parentOriginToBorderBox();
+
+    // Note: For now, we're ignoring hits to border and padding for <svg>
+
+    if (style()->overflowX() == OHIDDEN) {
+        // SVG doesn't support independent x/y overflow
+        ASSERT(style()->overflowY() == OHIDDEN);
+        IntPoint pointInContentBox = pointInBorderBox - borderOriginToContentBox();
+        if (!contentBoxRect().contains(pointInContentBox))
             return false;
     }
 
+    IntPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-        if (child->nodeAtPoint(request, result, _x - sx, _y - sy, 0, 0, hitTestAction)) {
-            updateHitTestResult(result, IntPoint(_x - _tx, _y - _ty));
+        if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
+            // FIXME: CSS/HTML assumes the local point is relative to the border box, right?
+            updateHitTestResult(result, pointInBorderBox);
             return true;
         }
     }
-    
-    // Spec: Only graphical elements can be targeted by the mouse, period.
+
+    // Spec: Only graphical elements can be targeted by the mouse, so we don't check self here.
     // 16.4: "If there are no graphics elements whose relevant graphics content is under the pointer (i.e., there is no target element), the event is not dispatched."
     return false;
 }
 
-void RenderSVGRoot::position(InlineBox* box)
-{
-    RenderContainer::position(box);
-    if (m_absoluteBounds.isEmpty())
-        setNeedsLayout(true, false);
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
index acac78b879..50866d2feb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,54 +23,66 @@
 #define RenderSVGRoot_h
 
 #if ENABLE(SVG)
-#include "RenderContainer.h"
+#include "RenderBox.h"
 #include "FloatRect.h"
+#include "SVGRenderSupport.h"
 
 namespace WebCore {
 
 class SVGStyledElement;
 class TransformationMatrix;
 
-class RenderSVGRoot : public RenderContainer {
+class RenderSVGRoot : public RenderBox, SVGRenderBase {
 public:
     RenderSVGRoot(SVGStyledElement*);
     ~RenderSVGRoot();
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
     virtual bool isSVGRoot() const { return true; }
     virtual const char* renderName() const { return "RenderSVGRoot"; }
 
     virtual int lineHeight(bool b, bool isRootLineBox = false) const;
     virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
     virtual void calcPrefWidths();
-    
+
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
-    
-    virtual IntRect absoluteClippedOverflowRect();
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
-    virtual TransformationMatrix absoluteTransform() const;
+    virtual TransformationMatrix localToParentTransform() const;
 
     bool fillContains(const FloatPoint&) const;
     bool strokeContains(const FloatPoint&) const;
-    FloatRect relativeBBox(bool includeStroke = true) const;
-    
+
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    // FIXME: Both of these overrides should be removed.
     virtual TransformationMatrix localTransform() const;
-   
-    FloatRect viewport() const;
+    virtual TransformationMatrix absoluteTransform() const;
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-    virtual void position(InlineBox*);
-    
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed);
+
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
 private:
-    void calcViewport(); 
-    void applyContentTransforms(PaintInfo&, int parentX, int parentY);
+    void calcViewport();
+    const FloatSize& viewportSize() const;
+
+    bool selfWillPaint() const;
+
+    IntSize parentOriginToBorderBox() const;
+    IntSize borderOriginToContentBox() const;
+    TransformationMatrix localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const;
+    TransformationMatrix localToBorderBoxTransform() const;
 
-    FloatRect m_viewport;
-    IntRect m_absoluteBounds;
+    RenderObjectChildList m_children;
+    FloatSize m_viewportSize;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.cpp
index fd2d3dd05e..90ff36c42b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.cpp
@@ -26,10 +26,6 @@
 #if ENABLE(SVG)
 #include "RenderSVGTSpan.h"
 
-#include "FloatRect.h"
-#include "SVGInlineTextBox.h"
-#include "SVGRootInlineBox.h"
-
 namespace WebCore {
 
 RenderSVGTSpan::RenderSVGTSpan(Node* n)
@@ -37,46 +33,6 @@ RenderSVGTSpan::RenderSVGTSpan(Node* n)
 {
 }
 
-void RenderSVGTSpan::absoluteRects(Vector<IntRect>& rects, int, int, bool)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderObject* object = rootBox ? rootBox->object() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->xPos() + xPos();
-    int yRef = object->yPos() + yPos();
- 
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->xPos(), yRef + curr->yPos(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        rects.append(enclosingIntRect(absoluteTransform().mapRect(rect)));
-    }
-}
-
-void RenderSVGTSpan::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderObject* object = rootBox ? rootBox->object() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->xPos() + xPos();
-    int yRef = object->yPos() + yPos();
- 
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->xPos(), yRef + curr->yPos(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        quads.append(absoluteTransform().mapRect(rect));
-    }
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h
index d34cd2fe77..652c5e39ea 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTSpan.h
@@ -1,8 +1,7 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
  *           (C) 2006 Apple Computer Inc.
+ *           (C) 2009 Google Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,8 +31,12 @@ class RenderSVGTSpan : public RenderSVGInline {
 public:
     RenderSVGTSpan(Node*);
     virtual const char* renderName() const { return "RenderSVGTSpan"; }
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+
+    // FIXME: These are incorrect, but have always behaved this way.
+    // These empty implementations prevent us from hitting RenderObject ASSERTS.
+    // tspan.getBBox() will be wrong, and repainting for tspans may not work correctly!
+    virtual FloatRect objectBoundingBox() const { return FloatRect(); }
+    virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(); }
 };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp
index 1a1196b35a..9e9809d11f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp
@@ -30,16 +30,19 @@
 #include "RenderSVGText.h"
 
 #include "FloatConversion.h"
+#include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "PointerEventsHitRules.h"
+#include "RenderLayer.h"
 #include "RenderSVGRoot.h"
-#include "SimpleFontData.h"
 #include "SVGLengthList.h"
+#include "SVGRenderSupport.h"
 #include "SVGResourceFilter.h"
 #include "SVGRootInlineBox.h"
 #include "SVGTextElement.h"
 #include "SVGTransformList.h"
 #include "SVGURIReference.h"
+#include "SimpleFontData.h"
 
 namespace WebCore {
 
@@ -48,174 +51,145 @@ RenderSVGText::RenderSVGText(SVGTextElement* node)
 {
 }
 
-IntRect RenderSVGText::absoluteClippedOverflowRect()
+IntRect RenderSVGText::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    FloatRect repaintRect = absoluteTransform().mapRect(relativeBBox(true));
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(filter->filterBBoxForItemBBox(repaintRect));
-#endif
-
-    if (!repaintRect.isEmpty())
-        repaintRect.inflate(1); // inflate 1 pixel for antialiasing
-
-    return enclosingIntRect(repaintRect);
+    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
-bool RenderSVGText::requiresLayer()
+void RenderSVGText::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    return false;
+    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
-bool RenderSVGText::calculateLocalTransform()
+void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
 {
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGTextElement*>(element())->animatedLocalTransform();
-    return (oldTransform != m_localTransform);
+    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 void RenderSVGText::layout()
 {
     ASSERT(needsLayout());
-    
+
     // FIXME: This is a hack to avoid the RenderBlock::layout() partial repainting code which is not (yet) SVG aware
     setNeedsLayout(true);
 
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout();
-    if (checkForRepaint) {
-        oldBounds = m_absoluteBounds;
-        oldOutlineBox = absoluteOutlineBounds();
-    }
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
 
     // Best guess for a relative starting point
-    SVGTextElement* text = static_cast<SVGTextElement*>(element());
+    SVGTextElement* text = static_cast<SVGTextElement*>(node());
     int xOffset = (int)(text->x()->getFirst().value(text));
     int yOffset = (int)(text->y()->getFirst().value(text));
-    setPos(xOffset, yOffset);
-    
-    calculateLocalTransform();
+    setLocation(xOffset, yOffset);
 
-    RenderBlock::layout();
+    m_localTransform = text->animatedLocalTransform();
 
-    m_absoluteBounds = absoluteClippedOverflowRect();
+    RenderBlock::layout();
 
-    bool repainted = false;
-    if (checkForRepaint)
-        repainted = repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
-    
+    repainter.repaintAfterLayout();
     setNeedsLayout(false);
 }
 
-InlineBox* RenderSVGText::createInlineBox(bool, bool, bool)
+RootInlineBox* RenderSVGText::createRootBox()
 {
-    ASSERT(!isInlineFlow());
-    InlineFlowBox* flowBox = new (renderArena()) SVGRootInlineBox(this);
-    
-    if (!m_firstLineBox)
-        m_firstLineBox = m_lastLineBox = flowBox;
-    else {
-        m_lastLineBox->setNextLineBox(flowBox);
-        flowBox->setPreviousLineBox(m_lastLineBox);
-        m_lastLineBox = flowBox;
-    }
-    
-    return flowBox;
+    RootInlineBox* box = new (renderArena()) SVGRootInlineBox(this);
+    box->setIsSVG(true);
+    return box;
 }
 
-bool RenderSVGText::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
+bool RenderSVGText::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     PointerEventsHitRules hitRules(PointerEventsHitRules::SVG_TEXT_HITTESTING, style()->pointerEvents());
     bool isVisible = (style()->visibility() == VISIBLE);
     if (isVisible || !hitRules.requireVisible) {
         if ((hitRules.canHitStroke && (style()->svgStyle()->hasStroke() || !hitRules.requireStroke))
             || (hitRules.canHitFill && (style()->svgStyle()->hasFill() || !hitRules.requireFill))) {
-            TransformationMatrix totalTransform = absoluteTransform();
-            double localX, localY;
-            totalTransform.inverse().map(_x, _y, &localX, &localY);
-            FloatPoint hitPoint(_x, _y);
-            return RenderBlock::nodeAtPoint(request, result, (int)localX, (int)localY, _tx, _ty, hitTestAction);
+            FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+            return RenderBlock::nodeAtPoint(request, result, (int)localPoint.x(), (int)localPoint.y(), 0, 0, hitTestAction);
         }
     }
 
     return false;
 }
 
-void RenderSVGText::absoluteRects(Vector<IntRect>& rects, int, int, bool)
+bool RenderSVGText::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void RenderSVGText::absoluteRects(Vector<IntRect>& rects, int, int)
 {
     RenderSVGRoot* root = findSVGRootObject(parent());
     if (!root)
         return;
-
-    FloatPoint absPos = localToAbsolute();
-
-    TransformationMatrix htmlParentCtm = root->RenderContainer::absoluteTransform();
  
-    // Don't use relativeBBox here, as it's unites the selection rects. Makes it hard
+    // Don't use objectBoundingBox here, as it's unites the selection rects. Makes it hard
     // to spot errors, if there are any using WebInspector. Individually feed them into 'rects'.
     for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
         ASSERT(runBox->isInlineFlowBox());
 
         InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
         for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine()) {
-            FloatRect boxRect(box->xPos(), box->yPos(), box->width(), box->height());
-            boxRect.move(narrowPrecisionToFloat(absPos.x() - htmlParentCtm.e()), narrowPrecisionToFloat(absPos.y() - htmlParentCtm.f()));
-            // FIXME: broken with CSS transforms
-            rects.append(enclosingIntRect(absoluteTransform().mapRect(boxRect)));
+            FloatRect boxRect(box->x(), box->y(), box->width(), box->height());
+            // FIXME: crawling up the parent chain to map each rect is very inefficient
+            // we should compute the absoluteTransform outside this loop first.
+            rects.append(enclosingIntRect(localToAbsoluteQuad(boxRect).boundingBox()));
         }
     }
 }
 
-void RenderSVGText::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderSVGText::absoluteQuads(Vector<FloatQuad>& quads)
 {
     RenderSVGRoot* root = findSVGRootObject(parent());
     if (!root)
         return;
-
-    FloatPoint absPos = localToAbsolute();
-
-    TransformationMatrix htmlParentCtm = root->RenderContainer::absoluteTransform();
  
-    // Don't use relativeBBox here, as it's unites the selection rects. Makes it hard
+    // Don't use objectBoundingBox here, as it's unites the selection rects. Makes it hard
     // to spot errors, if there are any using WebInspector. Individually feed them into 'rects'.
     for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
         ASSERT(runBox->isInlineFlowBox());
 
         InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
         for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine()) {
-            FloatRect boxRect(box->xPos(), box->yPos(), box->width(), box->height());
-            boxRect.move(narrowPrecisionToFloat(absPos.x() - htmlParentCtm.e()), narrowPrecisionToFloat(absPos.y() - htmlParentCtm.f()));
-            // FIXME: broken with CSS transforms
-            quads.append(absoluteTransform().mapRect(boxRect));
+            FloatRect boxRect(box->x(), box->y(), box->width(), box->height());
+            // FIXME: crawling up the parent chain to map each quad is very inefficient
+            // we should compute the absoluteTransform outside this loop first.
+            quads.append(localToAbsoluteQuad(boxRect));
         }
     }
 }
 
 void RenderSVGText::paint(PaintInfo& paintInfo, int, int)
 {   
-    RenderObject::PaintInfo pi(paintInfo);
-    pi.rect = absoluteTransform().inverse().mapRect(pi.rect);
+    PaintInfo pi(paintInfo);
+    pi.context->save();
+    applyTransformToPaintInfo(pi, localToParentTransform());
     RenderBlock::paint(pi, 0, 0);
+    pi.context->restore();
 }
 
-FloatRect RenderSVGText::relativeBBox(bool includeStroke) const
+FloatRect RenderSVGText::objectBoundingBox() const
 {
-    FloatRect repaintRect;
+    FloatRect boundingBox;
 
     for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
         ASSERT(runBox->isInlineFlowBox());
 
         InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
         for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine())
-            repaintRect.unite(FloatRect(box->xPos(), box->yPos(), box->width(), box->height()));
+            boundingBox.unite(FloatRect(box->x(), box->y(), box->width(), box->height()));
     }
 
+    boundingBox.move(x(), y());
+    return boundingBox;
+}
+
+FloatRect RenderSVGText::repaintRectInLocalCoordinates() const
+{
+    FloatRect repaintRect = objectBoundingBox();
+
     // SVG needs to include the strokeWidth(), not the textStrokeWidth().
-    if (includeStroke && style()->svgStyle()->hasStroke()) {
+    if (style()->svgStyle()->hasStroke()) {
         float strokeWidth = SVGRenderStyle::cssPrimitiveToLength(this, style()->svgStyle()->strokeWidth(), 0.0f);
 
 #if ENABLE(SVG_FONTS)
@@ -231,7 +205,8 @@ FloatRect RenderSVGText::relativeBBox(bool includeStroke) const
         repaintRect.inflate(strokeWidth);
     }
 
-    repaintRect.move(xPos(), yPos());
+    repaintRect.unite(filterBoundingBoxForRenderer(this));
+
     return repaintRect;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
index d76d451f52..c1f1430388 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
@@ -38,29 +38,36 @@ public:
     RenderSVGText(SVGTextElement* node);
 
     virtual const char* renderName() const { return "RenderSVGText"; }
-    
+
     virtual bool isSVGText() const { return true; }
-    
-    bool calculateLocalTransform();
-    virtual TransformationMatrix localTransform() const { return m_localTransform; }
-    
+
+    virtual TransformationMatrix localToParentTransform() const { return m_localTransform; }
+
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-    
-    virtual bool requiresLayer();
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
+
+    virtual bool requiresLayer() const { return false; }
     virtual void layout();
-    
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
 
-    virtual IntRect absoluteClippedOverflowRect();
-    virtual FloatRect relativeBBox(bool includeStroke = true) const;
-    
-    virtual InlineBox* createInlineBox(bool makePlaceHolderBox, bool isRootLineBox, bool isOnlyRun = false);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
 
 private:
+    // FIXME: This can be removed when localTransform() is removed from RenderObject
+    virtual TransformationMatrix localTransform() const { return m_localTransform; }
+
+    virtual RootInlineBox* createRootBox();
+
     TransformationMatrix m_localTransform;
-    IntRect m_absoluteBounds;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.cpp
index aa0209c4f5..5d977f9f15 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.cpp
@@ -25,7 +25,8 @@
 #if ENABLE(SVG)
 #include "RenderSVGTextPath.h"
 
-#include "FloatRect.h"
+#include "FloatQuad.h"
+#include "RenderBlock.h"
 #include "SVGInlineTextBox.h"
 #include "SVGPathElement.h"
 #include "SVGRootInlineBox.h"
@@ -44,7 +45,7 @@ RenderSVGTextPath::RenderSVGTextPath(Node* n)
 
 Path RenderSVGTextPath::layoutPath() const
 {
-    SVGTextPathElement* textPathElement = static_cast<SVGTextPathElement*>(element());
+    SVGTextPathElement* textPathElement = static_cast<SVGTextPathElement*>(node());
         String pathId = SVGURIReference::getTarget(textPathElement->href());
     Element* targetElement = textPathElement->document()->getElementById(pathId);    
     if (!targetElement || !targetElement->hasTagName(SVGNames::pathTag))
@@ -64,57 +65,17 @@ Path RenderSVGTextPath::layoutPath() const
 
 float RenderSVGTextPath::startOffset() const
 {
-    return static_cast<SVGTextPathElement*>(element())->startOffset().valueAsPercentage();
+    return static_cast<SVGTextPathElement*>(node())->startOffset().valueAsPercentage();
 }
 
 bool RenderSVGTextPath::exactAlignment() const
 {
-    return static_cast<SVGTextPathElement*>(element())->spacing() == SVG_TEXTPATH_SPACINGTYPE_EXACT;
+    return static_cast<SVGTextPathElement*>(node())->spacing() == SVG_TEXTPATH_SPACINGTYPE_EXACT;
 }
 
 bool RenderSVGTextPath::stretchMethod() const
 {
-    return static_cast<SVGTextPathElement*>(element())->method() == SVG_TEXTPATH_METHODTYPE_STRETCH;
-}
-
-void RenderSVGTextPath::absoluteRects(Vector<IntRect>& rects, int, int)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderObject* object = rootBox ? rootBox->object() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->xPos() + xPos();
-    int yRef = object->yPos() + yPos();
-
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->xPos(), yRef + curr->yPos(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        rects.append(enclosingIntRect(absoluteTransform().mapRect(rect)));
-    }
-}
-
-void RenderSVGTextPath::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderObject* object = rootBox ? rootBox->object() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->xPos() + xPos();
-    int yRef = object->yPos() + yPos();
-
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->xPos(), yRef + curr->yPos(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        quads.append(absoluteTransform().mapRect(rect));
-    }
+    return static_cast<SVGTextPathElement*>(node())->method() == SVG_TEXTPATH_METHODTYPE_STRETCH;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h
index 4fd4cc3e09..efab659aec 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h
@@ -38,8 +38,6 @@ namespace WebCore {
         bool stretchMethod() const;
 
         virtual const char* renderName() const { return "RenderSVGTextPath"; }
-        virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
-        virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
 
     private:
         float m_startOffset;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp
index 17d64f345a..2324eee4f0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
-    2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2004, 2005, 2006 Rob Buis <buis@kde.org>
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -35,11 +34,19 @@ RenderSVGTransformableContainer::RenderSVGTransformableContainer(SVGStyledTransf
 {
 }
 
-bool RenderSVGTransformableContainer::calculateLocalTransform()
+TransformationMatrix RenderSVGTransformableContainer::localToParentTransform() const
+{
+    return m_localTransform;
+}
+
+TransformationMatrix RenderSVGTransformableContainer::localTransform() const
+{
+    return m_localTransform;
+}
+
+void RenderSVGTransformableContainer::calculateLocalTransform()
 {
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGStyledTransformableElement*>(element())->animatedLocalTransform();
-    return (m_localTransform != oldTransform);
+    m_localTransform = static_cast<SVGStyledTransformableElement*>(node())->animatedLocalTransform();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h
index 897cc63c97..c929761f16 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTransformableContainer.h
@@ -1,5 +1,6 @@
 /*
-    Copyright (C) 2007 Eric Seidel <eric@webkit.org
+    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+                  2009 Google, Inc.
       
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -17,7 +18,6 @@
     Boston, MA 02110-1301, USA.
  */
 
-
 #ifndef RenderSVGTransformableContainer_h
 #define RenderSVGTransformableContainer_h
 
@@ -30,8 +30,15 @@ namespace WebCore {
     class RenderSVGTransformableContainer : public RenderSVGContainer {
     public:
         RenderSVGTransformableContainer(SVGStyledTransformableElement*);
-        
-        virtual bool calculateLocalTransform();
+
+        virtual TransformationMatrix localToParentTransform() const;
+
+    private:
+        virtual void calculateLocalTransform();
+        // FIXME: This can be made non-virtual once SVGRenderTreeAsText stops using localTransform()
+        virtual TransformationMatrix localTransform() const;
+
+        TransformationMatrix m_localTransform;
     };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
index f6ac424a50..d208621463 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -37,45 +36,12 @@ namespace WebCore {
 RenderSVGViewportContainer::RenderSVGViewportContainer(SVGStyledElement* node)
     : RenderSVGContainer(node)
 {
-    setReplaced(true);
 }
 
 RenderSVGViewportContainer::~RenderSVGViewportContainer()
 {
 }
 
-void RenderSVGViewportContainer::layout()
-{
-    ASSERT(needsLayout());
-    
-    calcViewport();
-    
-    // Arbitrary affine transforms are incompatible with LayoutState.
-    view()->disableLayoutState();
-    
-    IntRect oldBounds = m_absoluteBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout() && selfNeedsLayout();
-    if (checkForRepaint)
-        oldOutlineBox = absoluteOutlineBounds();
-
-    calcBounds();    
-    
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (selfNeedsLayout())
-            child->setNeedsLayout(true);
-        
-        child->layoutIfNeeded();
-        ASSERT(!child->needsLayout());
-    }
-    
-    if (checkForRepaint)
-        repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
-    
-    view()->enableLayoutState();
-    setNeedsLayout(false);
-}
-
 void RenderSVGViewportContainer::paint(PaintInfo& paintInfo, int parentX, int parentY)
 {
     // A value of zero disables rendering of the element. 
@@ -85,22 +51,10 @@ void RenderSVGViewportContainer::paint(PaintInfo& paintInfo, int parentX, int pa
     RenderSVGContainer::paint(paintInfo, parentX, parentY);
 }
 
-void RenderSVGViewportContainer::applyContentTransforms(PaintInfo& paintInfo)
-{
-    if (!viewport().isEmpty()) {
-        if (style()->overflowX() != OVISIBLE)
-            paintInfo.context->clip(enclosingIntRect(viewport())); // FIXME: Eventually we'll want float-precision clipping
-        
-        paintInfo.context->concatCTM(TransformationMatrix().translate(viewport().x(), viewport().y()));
-    }
-
-    RenderSVGContainer::applyContentTransforms(paintInfo);
-}
-
-void RenderSVGViewportContainer::applyAdditionalTransforms(PaintInfo& paintInfo)
+void RenderSVGViewportContainer::applyViewportClip(PaintInfo& paintInfo)
 {
-    paintInfo.context->concatCTM(viewportTransform());
-    RenderSVGContainer::applyAdditionalTransforms(paintInfo);
+    if (style()->overflowX() != OVISIBLE)
+        paintInfo.context->clip(enclosingIntRect(viewport())); // FIXME: Eventually we'll want float-precision clipping
 }
 
 FloatRect RenderSVGViewportContainer::viewport() const
@@ -110,9 +64,9 @@ FloatRect RenderSVGViewportContainer::viewport() const
 
 void RenderSVGViewportContainer::calcViewport()
 {
-    SVGElement* svgelem = static_cast<SVGElement*>(element());
+    SVGElement* svgelem = static_cast<SVGElement*>(node());
     if (svgelem->hasTagName(SVGNames::svgTag)) {
-        SVGSVGElement* svg = static_cast<SVGSVGElement*>(element());
+        SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
 
         if (!selfNeedsLayout() && !svg->hasRelativeValues())
             return;
@@ -126,7 +80,7 @@ void RenderSVGViewportContainer::calcViewport()
         if (!selfNeedsLayout())
             return;
 
-        SVGMarkerElement* svg = static_cast<SVGMarkerElement*>(element());
+        SVGMarkerElement* svg = static_cast<SVGMarkerElement*>(node());
         float w = svg->markerWidth().value(svg);
         float h = svg->markerHeight().value(svg);
         m_viewport = FloatRect(0, 0, w, h);
@@ -135,60 +89,42 @@ void RenderSVGViewportContainer::calcViewport()
 
 TransformationMatrix RenderSVGViewportContainer::viewportTransform() const
 {
-    if (element()->hasTagName(SVGNames::svgTag)) {
-        SVGSVGElement* svg = static_cast<SVGSVGElement*>(element());
+    if (node()->hasTagName(SVGNames::svgTag)) {
+        SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
         return svg->viewBoxToViewTransform(viewport().width(), viewport().height());
-    } else if (element()->hasTagName(SVGNames::markerTag)) {
-        SVGMarkerElement* marker = static_cast<SVGMarkerElement*>(element());
+    } else if (node()->hasTagName(SVGNames::markerTag)) {
+        SVGMarkerElement* marker = static_cast<SVGMarkerElement*>(node());
         return marker->viewBoxToViewTransform(viewport().width(), viewport().height());
     }
- 
-     return TransformationMatrix();
+
+    return TransformationMatrix();
 }
 
+TransformationMatrix RenderSVGViewportContainer::localToParentTransform() const
+{
+    TransformationMatrix viewportTranslation;
+    viewportTranslation.translate(viewport().x(), viewport().y());
+    return viewportTransform() * viewportTranslation;
+    // If this class were ever given a localTransform(), then the above would read:
+    // return viewportTransform() * localTransform() * viewportTranslation;
+}
+
+// FIXME: This method should be removed as soon as callers to RenderBox::absoluteTransform() can be removed.
 TransformationMatrix RenderSVGViewportContainer::absoluteTransform() const
 {
-    TransformationMatrix ctm = RenderObject::absoluteTransform();
-    ctm.translate(viewport().x(), viewport().y());
-    return viewportTransform() * ctm;
+    // This would apply localTransform() twice if localTransform() were not the identity.
+    return localToParentTransform() * RenderSVGContainer::absoluteTransform();
 }
 
-bool RenderSVGViewportContainer::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
+bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& pointInParent)
 {
-    if (!viewport().isEmpty()
-        && style()->overflowX() == OHIDDEN
-        && style()->overflowY() == OHIDDEN) {
-        // Check if we need to do anything at all.
-        IntRect overflowBox = overflowRect(false);
-        overflowBox.move(_tx, _ty);
-        TransformationMatrix ctm = RenderObject::absoluteTransform();
-        ctm.translate(viewport().x(), viewport().y());
-        double localX, localY;
-        ctm.inverse().map(_x - _tx, _y - _ty, &localX, &localY);
-        if (!overflowBox.contains((int)localX, (int)localY))
+    // Respect the viewport clip (which is in parent coords).  SVG does not support separate x/y overflow rules.
+    if (style()->overflowX() == OHIDDEN) {
+        ASSERT(style()->overflowY() == OHIDDEN);
+        if (!viewport().contains(pointInParent))
             return false;
     }
-
-    int sx = 0;
-    int sy = 0;
-
-    // Respect parent translation offset for non-outermost <svg> elements.
-    // Outermost <svg> element is handled by RenderSVGRoot.
-    if (element()->hasTagName(SVGNames::svgTag)) {
-        sx = _tx;
-        sy = _ty;
-    }
-
-    for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-        if (child->nodeAtPoint(request, result, _x - sx, _y - sy, _tx, _ty, hitTestAction)) {
-            updateHitTestResult(result, IntPoint(_x - _tx, _y - _ty));
-            return true;
-        }
-    }
-
-    // Spec: Only graphical elements can be targeted by the mouse, period.
-    // 16.4: "If there are no graphics elements whose relevant graphics content is under the pointer (i.e., there is no target element), the event is not dispatched."
-    return false;
+    return true;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
index 2e4a49cb64..8657af4c8b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -29,6 +28,8 @@
 
 namespace WebCore {
 
+// This is used for non-root <svg> elements and <marker> elements, neither of which are SVGTransformable
+// thus we inherit from RenderSVGContainer instead of RenderSVGTransformableContainer
 class RenderSVGViewportContainer : public RenderSVGContainer {
 public:
     RenderSVGViewportContainer(SVGStyledElement*);
@@ -37,22 +38,24 @@ public:
     virtual bool isSVGContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
 
-    virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
-    virtual TransformationMatrix absoluteTransform() const;
-    virtual TransformationMatrix viewportTransform() const;
+    virtual TransformationMatrix localToParentTransform() const;
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    // FIXME: This override should be removed once callers of RenderBox::absoluteTransform() can be removed.
+    virtual TransformationMatrix absoluteTransform() const;
 
     FloatRect viewport() const;
 
+    // FIXME: This is only public for SVGResourceMarker::draw, likely the callsite should be changed.
+    TransformationMatrix viewportTransform() const;
+
 private:
-    void calcViewport(); 
+    virtual void calcViewport();
+
+    virtual void applyViewportClip(PaintInfo&);
+    virtual bool pointIsInsideViewportClip(const FloatPoint& pointInParent);
 
-    virtual void applyContentTransforms(PaintInfo&);
-    virtual void applyAdditionalTransforms(PaintInfo&);
-    
     FloatRect m_viewport;
 };
   
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp
index b7045d6cf4..db24a060ca 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp
@@ -30,12 +30,12 @@
 
 namespace WebCore {
 
-PassRefPtr<Scrollbar> RenderScrollbar::createCustomScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, RenderObject* renderer)
+PassRefPtr<Scrollbar> RenderScrollbar::createCustomScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, RenderBox* renderer)
 {
     return adoptRef(new RenderScrollbar(client, orientation, renderer));
 }
 
-RenderScrollbar::RenderScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, RenderObject* renderer)
+RenderScrollbar::RenderScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, RenderBox* renderer)
     : Scrollbar(client, orientation, RegularScrollbar, RenderScrollbarTheme::renderScrollbarTheme())
     , m_owner(renderer)
 {
@@ -50,7 +50,7 @@ void RenderScrollbar::setParent(ScrollView* parent)
 {
     Scrollbar::setParent(parent);
     if (!parent) {
-        // Destroy all of the scrollbar's RenderObjects.
+        // Destroy all of the scrollbar's RenderBoxes.
         updateScrollbarParts(true);
     }
 }
@@ -117,7 +117,7 @@ ScrollbarPart RenderScrollbar::partForStyleResolve()
     return s_styleResolvePart;
 }
 
-PassRefPtr<RenderStyle> RenderScrollbar::getScrollbarPseudoStyle(ScrollbarPart partType, RenderStyle::PseudoId pseudoId)
+PassRefPtr<RenderStyle> RenderScrollbar::getScrollbarPseudoStyle(ScrollbarPart partType, PseudoId pseudoId)
 {
     s_styleResolvePart = partType;
     s_styleResolveScrollbar = this;
@@ -158,23 +158,23 @@ void RenderScrollbar::updateScrollbarParts(bool destroy)
     }
 }
 
-static RenderStyle::PseudoId pseudoForScrollbarPart(ScrollbarPart part)
+static PseudoId pseudoForScrollbarPart(ScrollbarPart part)
 {
     switch (part) {
         case BackButtonStartPart:
         case ForwardButtonStartPart:
         case BackButtonEndPart:
         case ForwardButtonEndPart:
-            return RenderStyle::SCROLLBAR_BUTTON;
+            return SCROLLBAR_BUTTON;
         case BackTrackPart:
         case ForwardTrackPart:
-            return RenderStyle::SCROLLBAR_TRACK_PIECE;
+            return SCROLLBAR_TRACK_PIECE;
         case ThumbPart:
-            return RenderStyle::SCROLLBAR_THUMB;
+            return SCROLLBAR_THUMB;
         case TrackBGPart:
-            return RenderStyle::SCROLLBAR_TRACK;
+            return SCROLLBAR_TRACK;
         default:
-            return RenderStyle::SCROLLBAR;
+            return SCROLLBAR;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h
index ad97001eec..524c4e8cf4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h
@@ -26,23 +26,24 @@
 #ifndef RenderScrollbar_h
 #define RenderScrollbar_h
 
+#include "RenderStyleConstants.h"
 #include "Scrollbar.h"
-#include "RenderStyle.h"
 #include <wtf/HashMap.h>
 
 namespace WebCore {
 
-class RenderObject;
+class RenderBox;
+class RenderStyle;
 class RenderScrollbarPart;
 class RenderStyle;
 
 class RenderScrollbar : public Scrollbar {
 protected:
-    RenderScrollbar(ScrollbarClient*, ScrollbarOrientation, RenderObject*);
+    RenderScrollbar(ScrollbarClient*, ScrollbarOrientation, RenderBox*);
 
 public:
     friend class Scrollbar;
-    static PassRefPtr<Scrollbar> createCustomScrollbar(ScrollbarClient*, ScrollbarOrientation, RenderObject*);
+    static PassRefPtr<Scrollbar> createCustomScrollbar(ScrollbarClient*, ScrollbarOrientation, RenderBox*);
     virtual ~RenderScrollbar();
 
     virtual void setParent(ScrollView*);
@@ -60,7 +61,7 @@ public:
 
     virtual void styleChanged();
 
-    RenderObject* owningRenderer() const { return m_owner; }
+    RenderBox* owningRenderer() const { return m_owner; }
 
     void paintPart(GraphicsContext*, ScrollbarPart, const IntRect&);
 
@@ -71,10 +72,10 @@ public:
     int minimumThumbLength();
 
 private:
-    PassRefPtr<RenderStyle> getScrollbarPseudoStyle(ScrollbarPart, RenderStyle::PseudoId);
+    PassRefPtr<RenderStyle> getScrollbarPseudoStyle(ScrollbarPart, PseudoId);
     void updateScrollbarPart(ScrollbarPart, bool destroy = false);
 
-    RenderObject* m_owner;
+    RenderBox* m_owner;
     HashMap<unsigned, RenderScrollbarPart*> m_parts;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp
index 3f69ba6354..0f29aeb1fc 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp
@@ -45,14 +45,14 @@ RenderScrollbarPart::~RenderScrollbarPart()
 
 void RenderScrollbarPart::layout()
 {
-    setPos(0, 0); // We don't worry about positioning ourselves.  We're just determining our minimum width/height.
+    setLocation(IntPoint()); // We don't worry about positioning ourselves.  We're just determining our minimum width/height.
     if (m_scrollbar->orientation() == HorizontalScrollbar)
         layoutHorizontalPart();
     else
         layoutVerticalPart();
 
-    m_overflowWidth = max(m_width, m_overflowWidth);
-    m_overflowHeight = max(m_height, m_overflowHeight);
+    m_overflowWidth = max(width(), m_overflowWidth);
+    m_overflowHeight = max(height(), m_overflowHeight);
     
     setNeedsLayout(false);
 }
@@ -60,11 +60,11 @@ void RenderScrollbarPart::layout()
 void RenderScrollbarPart::layoutHorizontalPart()
 {
     if (m_part == ScrollbarBGPart) {
-        m_width = m_scrollbar->width();
+        setWidth(m_scrollbar->width());
         computeScrollbarHeight();
     } else {
         computeScrollbarWidth();
-        m_height = m_scrollbar->height();
+        setHeight(m_scrollbar->height());
     }
 }
 
@@ -72,9 +72,9 @@ void RenderScrollbarPart::layoutVerticalPart()
 {
     if (m_part == ScrollbarBGPart) {
         computeScrollbarWidth();
-        m_height = m_scrollbar->height();
+        setHeight(m_scrollbar->height());
     } else {
-        m_width = m_scrollbar->width();
+        setWidth(m_scrollbar->width());
         computeScrollbarHeight();
     } 
 }
@@ -89,10 +89,10 @@ static int calcScrollbarThicknessUsing(const Length& l, int containingLength)
 void RenderScrollbarPart::computeScrollbarWidth()
 {
     int visibleSize = m_scrollbar->owningRenderer()->width() - m_scrollbar->owningRenderer()->borderLeft() - m_scrollbar->owningRenderer()->borderRight();
-    int width = calcScrollbarThicknessUsing(style()->width(), visibleSize);
+    int w = calcScrollbarThicknessUsing(style()->width(), visibleSize);
     int minWidth = calcScrollbarThicknessUsing(style()->minWidth(), visibleSize);
-    int maxWidth = style()->maxWidth().isUndefined() ? width : calcScrollbarThicknessUsing(style()->maxWidth(), visibleSize);
-    m_width = max(minWidth, min(maxWidth, width));
+    int maxWidth = style()->maxWidth().isUndefined() ? w : calcScrollbarThicknessUsing(style()->maxWidth(), visibleSize);
+    setWidth(max(minWidth, min(maxWidth, w)));
     
     // Buttons and track pieces can all have margins along the axis of the scrollbar. 
     m_marginLeft = style()->marginLeft().calcMinValue(visibleSize);
@@ -102,10 +102,10 @@ void RenderScrollbarPart::computeScrollbarWidth()
 void RenderScrollbarPart::computeScrollbarHeight()
 {
     int visibleSize = m_scrollbar->owningRenderer()->height() -  m_scrollbar->owningRenderer()->borderTop() - m_scrollbar->owningRenderer()->borderBottom();
-    int height = calcScrollbarThicknessUsing(style()->height(), visibleSize);
+    int h = calcScrollbarThicknessUsing(style()->height(), visibleSize);
     int minHeight = calcScrollbarThicknessUsing(style()->minHeight(), visibleSize);
-    int maxHeight = style()->maxHeight().isUndefined() ? height : calcScrollbarThicknessUsing(style()->maxHeight(), visibleSize);
-    m_height = max(minHeight, min(maxHeight, height));
+    int maxHeight = style()->maxHeight().isUndefined() ? h : calcScrollbarThicknessUsing(style()->maxHeight(), visibleSize);
+    setHeight(max(minHeight, min(maxHeight, h)));
 
     // Buttons and track pieces can all have margins along the axis of the scrollbar. 
     m_marginTop = style()->marginTop().calcMinValue(visibleSize);
@@ -122,14 +122,20 @@ void RenderScrollbarPart::calcPrefWidths()
     setPrefWidthsDirty(false);
 }
 
-void RenderScrollbarPart::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderScrollbarPart::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
+{
+    RenderBlock::styleWillChange(diff, newStyle);
+    setInline(false);
+}
+
+void RenderScrollbarPart::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
     setInline(false);
     setPositioned(false);
     setFloating(false);
     setHasOverflowClip(false);
-    if (oldStyle && m_scrollbar && m_part != NoPart && diff >= RenderStyle::Repaint)
+    if (oldStyle && m_scrollbar && m_part != NoPart && diff >= StyleDifferenceRepaint)
         m_scrollbar->theme()->invalidatePart(m_scrollbar, m_part);
 }
 
@@ -144,7 +150,7 @@ void RenderScrollbarPart::imageChanged(WrappedImagePtr image, const IntRect* rec
 void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx, int ty, const IntRect& rect)
 {
     // Make sure our dimensions match the rect.
-    setPos(rect.x() - tx, rect.y() - ty);
+    setLocation(rect.x() - tx, rect.y() - ty);
     setWidth(rect.width());
     setHeight(rect.height());
     setOverflowWidth(max(rect.width(), overflowWidth()));
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.h b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.h
index 2010f97000..114bbff119 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.h
@@ -40,7 +40,7 @@ public:
 
     virtual const char* renderName() const { return "RenderScrollbarPart"; }
     
-    virtual bool requiresLayer() { return false; }
+    virtual bool requiresLayer() const { return false; }
 
     virtual void layout();
     virtual void calcPrefWidths();
@@ -48,7 +48,8 @@ public:
     void paintIntoRect(GraphicsContext*, int tx, int ty, const IntRect&);
     
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleWillChange(StyleDifference diff, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSelectionInfo.h b/src/3rdparty/webkit/WebCore/rendering/RenderSelectionInfo.h
new file mode 100644
index 0000000000..e7b7b7893f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSelectionInfo.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
+ *           (C) 2000 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2000 Dirk Mueller (mueller@kde.org)
+ *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef SelectionInfo_h
+#define SelectionInfo_h
+
+#include "IntRect.h"
+#include "RenderBox.h"
+
+namespace WebCore {
+
+class RenderSelectionInfoBase {
+public:
+    RenderSelectionInfoBase()
+        : m_object(0)
+        , m_repaintContainer(0)
+        , m_state(RenderObject::SelectionNone)
+    {
+    }
+
+    RenderSelectionInfoBase(RenderObject* o)
+        : m_object(o)
+        , m_repaintContainer(o->containerForRepaint())
+        , m_state(o->selectionState())
+    {
+    }
+    
+    RenderObject* object() const { return m_object; }
+    RenderBoxModelObject* repaintContainer() const { return m_repaintContainer; }
+    RenderObject::SelectionState state() const { return m_state; }
+
+protected:
+    RenderObject* m_object;
+    RenderBoxModelObject* m_repaintContainer;
+    RenderObject::SelectionState m_state;
+};
+
+// This struct is used when the selection changes to cache the old and new state of the selection for each RenderObject.
+class RenderSelectionInfo : public RenderSelectionInfoBase {
+public:
+    RenderSelectionInfo(RenderObject* o, bool clipToVisibleContent)
+        : RenderSelectionInfoBase(o)
+        , m_rect(o->needsLayout() ? IntRect() : o->selectionRectForRepaint(m_repaintContainer, clipToVisibleContent))
+    {
+    }
+    
+    void repaint()
+    {
+        m_object->repaintUsingContainer(m_repaintContainer, m_rect);
+    }
+
+    IntRect rect() const { return m_rect; }
+
+private:
+    IntRect m_rect; // relative to repaint container
+};
+
+
+// This struct is used when the selection changes to cache the old and new state of the selection for each RenderBlock.
+class RenderBlockSelectionInfo : public RenderSelectionInfoBase {
+public:
+    RenderBlockSelectionInfo(RenderBlock* b)
+        : RenderSelectionInfoBase(b)
+        , m_rects(b->needsLayout() ? GapRects() : block()->selectionGapRectsForRepaint(m_repaintContainer))
+    { 
+    }
+
+    void repaint()
+    {
+        m_object->repaintUsingContainer(m_repaintContainer, m_rects);
+    }
+    
+    RenderBlock* block() const { return toRenderBlock(m_object); }
+    GapRects rects() const { return m_rects; }
+
+private:
+    GapRects m_rects; // relative to repaint container
+};
+
+} // namespace WebCore
+
+
+#endif // SelectionInfo_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
index 040fa31910..610a060490 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
@@ -1,6 +1,5 @@
-/**
- *
- * Copyright (C) 2006, 2007, 2008 Apple Computer, Inc.
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,8 +30,11 @@
 #include "HTMLInputElement.h"
 #include "HTMLDivElement.h"
 #include "HTMLNames.h"
+#include "MediaControlElements.h"
 #include "MouseEvent.h"
+#include "RenderLayer.h"
 #include "RenderTheme.h"
+#include "RenderView.h"
 #include <wtf/MathExtras.h>
 
 using std::min;
@@ -41,44 +43,115 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-const int defaultTrackLength = 129;
+static const int defaultTrackLength = 129;
+
+// FIXME: The SliderRange class and functions are entirely based on the DOM,
+// and could be put with HTMLInputElement (possibly with a new name) instead of here.
+struct SliderRange {
+    bool isIntegral;
+    double minimum;
+    double maximum;
+
+    explicit SliderRange(HTMLInputElement*);
+    double clampValue(double value);
+
+    // Map value into 0-1 range
+    double proportionFromValue(double value)
+    {
+        if (minimum == maximum)
+            return 0;
 
-class HTMLSliderThumbElement : public HTMLDivElement {
+        return (value - minimum) / (maximum - minimum);
+    }
+    
+    // Map from 0-1 range to value
+    double valueFromProportion(double proportion)
+    {
+        return minimum + proportion * (maximum - minimum);
+    }
+    
+    double valueFromElement(HTMLInputElement*, bool* wasClamped = 0);
+};
+
+SliderRange::SliderRange(HTMLInputElement* element)
+{
+    // FIXME: What's the right way to handle an integral range with non-integral minimum and maximum?
+    // Currently values are guaranteed to be integral but could be outside the range in that case.
+
+    isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
+
+    // FIXME: This treats maximum strings that can't be parsed as 0, but perhaps 100 would be more appropriate.
+    const AtomicString& maxString = element->getAttribute(maxAttr);
+    maximum = maxString.isNull() ? 100.0 : maxString.toDouble();
+
+    // If the maximum is smaller, use it as the minimum.
+    minimum = min(element->getAttribute(minAttr).toDouble(), maximum);
+}
+
+double SliderRange::clampValue(double value)
+{
+    double clampedValue = max(minimum, min(value, maximum));
+    return isIntegral ? round(clampedValue) : clampedValue;
+}
+
+double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
+{
+    String valueString = element->value();
+    double oldValue = valueString.isNull() ? (minimum + maximum) / 2 : valueString.toDouble();
+    double newValue = clampValue(oldValue);
+
+    if (wasClamped)
+        *wasClamped = valueString.isNull() || newValue != oldValue;
+
+    return newValue;
+}
+
+// Returns a value between 0 and 1.
+// As with SliderRange, this could be on HTMLInputElement instead of here.
+static double sliderPosition(HTMLInputElement* element)
+{
+    SliderRange range(element);
+    return range.proportionFromValue(range.valueFromElement(element));
+}
+
+class SliderThumbElement : public HTMLDivElement {
 public:
-    HTMLSliderThumbElement(Document*, Node* shadowParent = 0);
-        
+    SliderThumbElement(Document*, Node* shadowParent);
+    
+    bool inDragMode() const { return m_inDragMode; }
+
     virtual void defaultEventHandler(Event*);
+
+private:        
     virtual bool isShadowNode() const { return true; }
     virtual Node* shadowParentNode() { return m_shadowParent; }
-    
-    bool inDragMode() const { return m_inDragMode; }
-private:
+
     Node* m_shadowParent;
     FloatPoint m_initialClickPoint;       // initial click point in RenderSlider-local coordinates
     int m_initialPosition;
     bool m_inDragMode;
 };
 
-HTMLSliderThumbElement::HTMLSliderThumbElement(Document* doc, Node* shadowParent)
-    : HTMLDivElement(divTag, doc)
+SliderThumbElement::SliderThumbElement(Document* document, Node* shadowParent)
+    : HTMLDivElement(divTag, document)
     , m_shadowParent(shadowParent)
-    , m_initialClickPoint(IntPoint())
     , m_initialPosition(0)
     , m_inDragMode(false)
 {
 }
 
-void HTMLSliderThumbElement::defaultEventHandler(Event* event)
+void SliderThumbElement::defaultEventHandler(Event* event)
 {
     const AtomicString& eventType = event->type();
     if (eventType == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
         RenderSlider* slider;
-        if (document()->frame() && renderer() && renderer()->parent() &&
+        if (document()->frame() && renderer() &&
                 (slider = static_cast<RenderSlider*>(renderer()->parent())) &&
                 slider->mouseEventIsInThumb(mouseEvent)) {
+            
             // Cache the initial point where the mouse down occurred, in slider coordinates
-            m_initialClickPoint = slider->absoluteToLocal(FloatPoint(mouseEvent->pageX(), mouseEvent->pageY()), false, true);
+            m_initialClickPoint = slider->absoluteToLocal(mouseEvent->absoluteLocation(), false, true);
             // Cache the initial position of the thumb.
             m_initialPosition = slider->currentPosition();
             m_inDragMode = true;
@@ -101,16 +174,11 @@ void HTMLSliderThumbElement::defaultEventHandler(Event* event)
             // Move the slider
             MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
             RenderSlider* slider = static_cast<RenderSlider*>(renderer()->parent());
-            FloatPoint curPoint = slider->absoluteToLocal(FloatPoint(mouseEvent->pageX(), mouseEvent->pageY()), false, true);
-            int newPosition = slider->positionForOffset(
-                IntPoint(m_initialPosition + curPoint.x() - m_initialClickPoint.x()
-                        + (renderer()->width() / 2), 
-                    m_initialPosition + curPoint.y() - m_initialClickPoint.y()
-                        + (renderer()->height() / 2)));
-            if (slider->currentPosition() != newPosition) {
-                slider->setCurrentPosition(newPosition);
-                slider->valueChanged();
-            }
+
+            FloatPoint curPoint = slider->absoluteToLocal(mouseEvent->absoluteLocation(), false, true);
+            IntPoint eventOffset(m_initialPosition + curPoint.x() - m_initialClickPoint.x() + renderBox()->width() / 2, 
+                m_initialPosition + curPoint.y() - m_initialClickPoint.y() + renderBox()->height() / 2);
+            slider->setValueForPosition(slider->positionForOffset(eventOffset));
             event->setDefaultHandled();
             return;
         }
@@ -121,7 +189,6 @@ void HTMLSliderThumbElement::defaultEventHandler(Event* event)
 
 RenderSlider::RenderSlider(HTMLInputElement* element)
     : RenderBlock(element)
-    , m_thumb(0)
 {
 }
 
@@ -166,20 +233,20 @@ void RenderSlider::calcPrefWidths()
     setPrefWidthsDirty(false); 
 }
 
-void RenderSlider::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderSlider::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
-    
+
     if (m_thumb)
-        m_thumb->renderer()->setStyle(createThumbStyle(style(), m_thumb->renderer()->style()));
-        
+        m_thumb->renderer()->setStyle(createThumbStyle(style()));
+
     setReplaced(isInline());
 }
 
-PassRefPtr<RenderStyle> RenderSlider::createThumbStyle(const RenderStyle* parentStyle, const RenderStyle* oldStyle)
+PassRefPtr<RenderStyle> RenderSlider::createThumbStyle(const RenderStyle* parentStyle)
 {
     RefPtr<RenderStyle> style;
-    RenderStyle* pseudoStyle = getCachedPseudoStyle(RenderStyle::SLIDER_THUMB);
+    RenderStyle* pseudoStyle = getCachedPseudoStyle(SLIDER_THUMB);
     if (pseudoStyle)
         // We may be sharing style with another slider, but we must not share the thumb style.
         style = RenderStyle::clone(pseudoStyle);
@@ -190,16 +257,11 @@ PassRefPtr<RenderStyle> RenderSlider::createThumbStyle(const RenderStyle* parent
         style->inheritFrom(parentStyle);
 
     style->setDisplay(BLOCK);
-    style->setPosition(RelativePosition);
-    if (oldStyle) {
-        style->setLeft(oldStyle->left());
-        style->setTop(oldStyle->top());
-    }
 
     if (parentStyle->appearance() == SliderVerticalPart)
-       style->setAppearance(SliderThumbVerticalPart);
+        style->setAppearance(SliderThumbVerticalPart);
     else if (parentStyle->appearance() == SliderHorizontalPart)
-       style->setAppearance(SliderThumbHorizontalPart);
+        style->setAppearance(SliderThumbHorizontalPart);
     else if (parentStyle->appearance() == MediaSliderPart)
         style->setAppearance(MediaSliderThumbPart);
 
@@ -207,42 +269,97 @@ PassRefPtr<RenderStyle> RenderSlider::createThumbStyle(const RenderStyle* parent
 }
 
 void RenderSlider::layout()
-{    
-    bool relayoutChildren = false;
-    
-    if (m_thumb && m_thumb->renderer()) {
-            
-        int oldWidth = m_width;
-        calcWidth();
-        int oldHeight = m_height;
-        calcHeight();
-        
-        if (oldWidth != m_width || oldHeight != m_height)
-            relayoutChildren = true;  
-
-        // Allow the theme to set the size of the thumb
-        if (m_thumb->renderer()->style()->hasAppearance())
-            theme()->adjustSliderThumbSize(m_thumb->renderer());
+{
+    ASSERT(needsLayout());
+
+    RenderBox* thumb = m_thumb ? toRenderBox(m_thumb->renderer()) : 0;
+
+    IntSize baseSize(borderLeft() + paddingLeft() + paddingRight() + borderRight(),
+        borderTop() + paddingTop() + paddingBottom() + borderBottom());
+
+    if (thumb) {
+        // Allow the theme to set the size of the thumb.
+        if (thumb->style()->hasAppearance()) {
+            // FIXME: This should pass the style, not the renderer, to the theme.
+            theme()->adjustSliderThumbSize(thumb);
+        }
+
+        baseSize.expand(thumb->style()->width().calcMinValue(0), thumb->style()->height().calcMinValue(0));
+    }
+
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+
+    IntSize oldSize = size();
+
+    setSize(baseSize);
+    calcWidth();
+    calcHeight();
+
+    IntRect overflowRect(IntPoint(), size());
+
+    if (thumb) {
+        if (oldSize != size())
+            thumb->setChildNeedsLayout(true, false);
+
+        LayoutStateMaintainer statePusher(view(), this, size());
+
+        IntRect oldThumbRect = thumb->frameRect();
 
+        thumb->layoutIfNeeded();
+
+        IntRect thumbRect;
+
+        thumbRect.setWidth(thumb->style()->width().calcMinValue(contentWidth()));
+        thumbRect.setHeight(thumb->style()->height().calcMinValue(contentHeight()));
+
+        double fraction = sliderPosition(static_cast<HTMLInputElement*>(node()));
+        IntRect contentRect = contentBoxRect();
         if (style()->appearance() == SliderVerticalPart) {
-            // FIXME: Handle percentage widths correctly. See http://bugs.webkit.org/show_bug.cgi?id=12104
-            m_thumb->renderer()->style()->setLeft(Length(contentWidth() / 2 - m_thumb->renderer()->style()->width().value() / 2, Fixed));
+            thumbRect.setX(contentRect.x() + (contentRect.width() - thumbRect.width()) / 2);
+            thumbRect.setY(contentRect.y() + static_cast<int>(nextafter((contentRect.height() - thumbRect.height()) + 1, 0) * (1 - fraction)));
         } else {
-            // FIXME: Handle percentage heights correctly. See http://bugs.webkit.org/show_bug.cgi?id=12104
-            m_thumb->renderer()->style()->setTop(Length(contentHeight() / 2 - m_thumb->renderer()->style()->height().value() / 2, Fixed));
+            thumbRect.setX(contentRect.x() + static_cast<int>(nextafter((contentRect.width() - thumbRect.width()) + 1, 0) * fraction));
+            thumbRect.setY(contentRect.y() + (contentRect.height() - thumbRect.height()) / 2);
         }
 
-        if (relayoutChildren)
-            setPositionFromValue(true);
+        thumb->setFrameRect(thumbRect);
+
+        if (thumb->checkForRepaintDuringLayout())
+            thumb->repaintDuringLayoutIfMoved(oldThumbRect);
+
+        statePusher.pop();
+
+        IntRect thumbOverflowRect = thumb->overflowRect();
+        thumbOverflowRect.move(thumb->x(), thumb->y());
+        overflowRect.unite(thumbOverflowRect);
     }
 
-    RenderBlock::layoutBlock(relayoutChildren);
+    // FIXME: m_overflowWidth and m_overflowHeight should be renamed
+    // m_overflowRight and m_overflowBottom.
+    m_overflowLeft = overflowRect.x();
+    m_overflowTop = overflowRect.y();
+    m_overflowWidth = overflowRect.right();
+    m_overflowHeight = overflowRect.bottom();
+
+    repainter.repaintAfterLayout();    
+
+    setNeedsLayout(false);
 }
 
 void RenderSlider::updateFromElement()
 {
+    HTMLInputElement* element = static_cast<HTMLInputElement*>(node());
+
+    // Send the value back to the element if the range changes it.
+    SliderRange range(element);
+    bool clamped;
+    double value = range.valueFromElement(element, &clamped);
+    if (clamped)
+        element->setValueFromRenderer(String::number(value));
+
+    // Layout will take care of the thumb's size and position.
     if (!m_thumb) {
-        m_thumb = new HTMLSliderThumbElement(document(), node());
+        m_thumb = new SliderThumbElement(document(), node());
         RefPtr<RenderStyle> thumbStyle = createThumbStyle(style());
         m_thumb->setRenderer(m_thumb->createRenderer(renderArena(), thumbStyle.get()));
         m_thumb->renderer()->setStyle(thumbStyle.release());
@@ -250,17 +367,23 @@ void RenderSlider::updateFromElement()
         m_thumb->setInDocument(true);
         addChild(m_thumb->renderer());
     }
-    setPositionFromValue();
-    setNeedsLayout(true, false);
+    setNeedsLayout(true);
 }
 
 bool RenderSlider::mouseEventIsInThumb(MouseEvent* evt)
 {
     if (!m_thumb || !m_thumb->renderer())
         return false;
- 
-    FloatPoint localPoint = m_thumb->renderer()->absoluteToLocal(FloatPoint(evt->pageX(), evt->pageY()), false, true);
-    IntRect thumbBounds = m_thumb->renderer()->borderBox();
+
+#if ENABLE(VIDEO)
+    if (style()->appearance() == MediaSliderPart) {
+        MediaControlInputElement *sliderThumb = static_cast<MediaControlInputElement*>(m_thumb->renderer()->node());
+        return sliderThumb->hitTest(evt->absoluteLocation());
+    }
+#endif
+
+    FloatPoint localPoint = m_thumb->renderBox()->absoluteToLocal(evt->absoluteLocation(), false, true);
+    IntRect thumbBounds = m_thumb->renderBox()->borderBoxRect();
     return thumbBounds.contains(roundedIntPoint(localPoint));
 }
 
@@ -268,135 +391,79 @@ void RenderSlider::setValueForPosition(int position)
 {
     if (!m_thumb || !m_thumb->renderer())
         return;
-    
-    const AtomicString& minStr = static_cast<HTMLInputElement*>(node())->getAttribute(minAttr);
-    const AtomicString& maxStr = static_cast<HTMLInputElement*>(node())->getAttribute(maxAttr);
-    const AtomicString& precision = static_cast<HTMLInputElement*>(node())->getAttribute(precisionAttr);
-    
-    double minVal = minStr.isNull() ? 0.0 : minStr.toDouble();
-    double maxVal = maxStr.isNull() ? 100.0 : maxStr.toDouble();
-    minVal = min(minVal, maxVal); // Make sure the range is sane.
-    
-    // Calculate the new value based on the position
-    double factor = (double)position / (double)trackSize();
-    if (style()->appearance() == SliderVerticalPart)
-        factor = 1.0 - factor;
-    double val = minVal + factor * (maxVal - minVal);
-            
-    val = max(minVal, min(val, maxVal)); // Make sure val is within min/max.
 
-    // Force integer value if not float.
-    if (!equalIgnoringCase(precision, "float"))
-        val = lround(val);
-
-    static_cast<HTMLInputElement*>(node())->setValueFromRenderer(String::number(val));
-    
-    if (position != currentPosition()) {
-        setCurrentPosition(position);
-        static_cast<HTMLInputElement*>(node())->onChange();
-    }
-}
+    HTMLInputElement* element = static_cast<HTMLInputElement*>(node());
 
-double RenderSlider::setPositionFromValue(bool inLayout)
-{
-    if (!m_thumb || !m_thumb->renderer())
-        return 0;
-    
-    if (!inLayout)
-        document()->updateLayout();
-        
-    String value = static_cast<HTMLInputElement*>(node())->value();
-    const AtomicString& minStr = static_cast<HTMLInputElement*>(node())->getAttribute(minAttr);
-    const AtomicString& maxStr = static_cast<HTMLInputElement*>(node())->getAttribute(maxAttr);
-    const AtomicString& precision = static_cast<HTMLInputElement*>(node())->getAttribute(precisionAttr);
-    
-    double minVal = minStr.isNull() ? 0.0 : minStr.toDouble();
-    double maxVal = maxStr.isNull() ? 100.0 : maxStr.toDouble();
-    minVal = min(minVal, maxVal); // Make sure the range is sane.
-    
-    double oldVal = value.isNull() ? (maxVal + minVal)/2.0 : value.toDouble();
-    double val = max(minVal, min(oldVal, maxVal)); // Make sure val is within min/max.
-        
-    // Force integer value if not float.
-    if (!equalIgnoringCase(precision, "float"))
-        val = lround(val);
-
-    // Calculate the new position based on the value
-    double factor = (val - minVal) / (maxVal - minVal);
+    // Calculate the new value based on the position, and send it to the element.
+    SliderRange range(element);
+    double fraction = static_cast<double>(position) / trackSize();
     if (style()->appearance() == SliderVerticalPart)
-        factor = 1.0 - factor;
+        fraction = 1 - fraction;
+    double value = range.clampValue(range.valueFromProportion(fraction));
+    element->setValueFromRenderer(String::number(value));
 
-    setCurrentPosition((int)(factor * trackSize()));
-    
-    if (value.isNull() || val != oldVal)
-        static_cast<HTMLInputElement*>(node())->setValueFromRenderer(String::number(val));
-    
-    return val;
+    // Also update the position if appropriate.
+    if (position != currentPosition()) {
+        setNeedsLayout(true);
+
+        // FIXME: It seems like this could send extra change events if the same value is set
+        // multiple times with no layout in between.
+        element->dispatchFormControlChangeEvent();
+    }
 }
 
 int RenderSlider::positionForOffset(const IntPoint& p)
 {
     if (!m_thumb || !m_thumb->renderer())
         return 0;
-   
+
     int position;
     if (style()->appearance() == SliderVerticalPart)
-        position = p.y() - m_thumb->renderer()->height() / 2;
+        position = p.y() - m_thumb->renderBox()->height() / 2;
     else
-        position = p.x() - m_thumb->renderer()->width() / 2;
+        position = p.x() - m_thumb->renderBox()->width() / 2;
     
     return max(0, min(position, trackSize()));
 }
 
-void RenderSlider::valueChanged()
-{
-    setValueForPosition(currentPosition());
-    static_cast<HTMLInputElement*>(node())->onChange();
-}
-
 int RenderSlider::currentPosition()
 {
-    if (!m_thumb || !m_thumb->renderer())
-        return 0;
-
-    if (style()->appearance() == SliderVerticalPart)
-        return m_thumb->renderer()->style()->top().value();
-    return m_thumb->renderer()->style()->left().value();
-}
-
-void RenderSlider::setCurrentPosition(int pos)
-{
-    if (!m_thumb || !m_thumb->renderer())
-        return;
+    ASSERT(m_thumb);
+    ASSERT(m_thumb->renderer());
 
     if (style()->appearance() == SliderVerticalPart)
-        m_thumb->renderer()->style()->setTop(Length(pos, Fixed));
-    else
-        m_thumb->renderer()->style()->setLeft(Length(pos, Fixed));
-
-    m_thumb->renderer()->layer()->updateLayerPosition();
-    repaint();
-    m_thumb->renderer()->repaint();
+        return toRenderBox(m_thumb->renderer())->y() - contentBoxRect().y();
+    return toRenderBox(m_thumb->renderer())->x() - contentBoxRect().x();
 }
 
 int RenderSlider::trackSize()
 {
-    if (!m_thumb || !m_thumb->renderer())
-        return 0;
+    ASSERT(m_thumb);
+    ASSERT(m_thumb->renderer());
 
     if (style()->appearance() == SliderVerticalPart)
-        return contentHeight() - m_thumb->renderer()->height();
-    return contentWidth() - m_thumb->renderer()->width();
+        return contentHeight() - m_thumb->renderBox()->height();
+    return contentWidth() - m_thumb->renderBox()->width();
 }
 
-void RenderSlider::forwardEvent(Event* evt)
+void RenderSlider::forwardEvent(Event* event)
 {
-    m_thumb->defaultEventHandler(evt);
+    if (event->isMouseEvent()) {
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        if (event->type() == eventNames().mousedownEvent && mouseEvent->button() == LeftButton) {
+            if (!mouseEventIsInThumb(mouseEvent)) {
+                IntPoint eventOffset = roundedIntPoint(absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
+                setValueForPosition(positionForOffset(eventOffset));
+            }
+        }
+    }
+
+    m_thumb->defaultEventHandler(event);
 }
 
 bool RenderSlider::inDragMode() const
 {
-    return m_thumb->inDragMode();
+    return m_thumb && m_thumb->inDragMode();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
index 2667672554..f1eab9cb13 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
@@ -1,6 +1,5 @@
-/**
- *
- * Copyright (C) 2006 Apple Computer, Inc.
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,16 +25,19 @@
 
 namespace WebCore {
 
-    class HTMLDivElement;
     class HTMLInputElement;
-    class HTMLSliderThumbElement;
     class MouseEvent;
+    class SliderThumbElement;
     
     class RenderSlider : public RenderBlock {
     public:
         RenderSlider(HTMLInputElement*);
-        ~RenderSlider();
+        virtual ~RenderSlider();
+
+        void forwardEvent(Event*);
+        bool inDragMode() const;
 
+    private:
         virtual const char* renderName() const { return "RenderSlider"; }
         virtual bool isSlider() const { return true; }
 
@@ -43,30 +45,25 @@ namespace WebCore {
         virtual void calcPrefWidths();
         virtual void layout();
         virtual void updateFromElement();
-        
+
         bool mouseEventIsInThumb(MouseEvent*);
 
         void setValueForPosition(int position);
-        double setPositionFromValue(bool inLayout = false);
+        void setPositionFromValue();
         int positionForOffset(const IntPoint&);
 
-        void valueChanged();
-        
         int currentPosition();
-        void setCurrentPosition(int pos);        
-        
-        void forwardEvent(Event*);
-        bool inDragMode() const;
 
-    protected:
-        virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
-    
-    private:
-        PassRefPtr<RenderStyle> createThumbStyle(const RenderStyle* parentStyle, const RenderStyle* oldStyle = 0);
+        virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+        PassRefPtr<RenderStyle> createThumbStyle(const RenderStyle* parentStyle);
+
         int trackSize();
 
-        RefPtr<HTMLSliderThumbElement> m_thumb;
-};
+        RefPtr<SliderThumbElement> m_thumb;
+
+        friend class SliderThumbElement;
+    };
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
index 4561d57006..105cdf7073 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
@@ -52,8 +52,6 @@ RenderTable::RenderTable(Node* node)
     , m_firstBody(0)
     , m_tableLayout(0)
     , m_currentBorder(0)
-    , m_frame(Void)
-    , m_rules(None)
     , m_hasColElements(false)
     , m_needsSectionRecalc(0)
     , m_hSpacing(0)
@@ -70,7 +68,7 @@ RenderTable::~RenderTable()
     delete m_tableLayout;
 }
 
-void RenderTable::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderTable::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
@@ -110,8 +108,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
 
-    bool wrapInAnonymousSection = true;
-    bool isTableElement = element() && element()->hasTagName(tableTag);
+    bool wrapInAnonymousSection = !child->isPositioned();
 
     if (child->isRenderBlock() && child->style()->display() == TABLE_CAPTION) {
         // First caption wins.
@@ -123,7 +120,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
                 m_caption = 0;
         }
         if (!m_caption)
-            m_caption = static_cast<RenderBlock*>(child);
+            m_caption = toRenderBlock(child);
         wrapInAnonymousSection = false;
     } else if (child->isTableCol()) {
         m_hasColElements = true;
@@ -131,56 +128,44 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
     } else if (child->isTableSection()) {
         switch (child->style()->display()) {
             case TABLE_HEADER_GROUP:
-                if (child->isTableSection()) {
-                    resetSectionPointerIfNotBefore(m_head, beforeChild);
-                    if (!m_head) {
-                        m_head = static_cast<RenderTableSection*>(child);
-                    } else {
-                        resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
-                        if (!m_firstBody) 
-                            m_firstBody = static_cast<RenderTableSection*>(child);
-                    }
+                resetSectionPointerIfNotBefore(m_head, beforeChild);
+                if (!m_head) {
+                    m_head = static_cast<RenderTableSection*>(child);
+                } else {
+                    resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
+                    if (!m_firstBody) 
+                        m_firstBody = static_cast<RenderTableSection*>(child);
                 }
                 wrapInAnonymousSection = false;
                 break;
             case TABLE_FOOTER_GROUP:
-                if (child->isTableSection()) {
-                    resetSectionPointerIfNotBefore(m_foot, beforeChild);
-                    if (!m_foot) {
-                        m_foot = static_cast<RenderTableSection*>(child);
-                        wrapInAnonymousSection = false;
-                        break;
-                    }
+                resetSectionPointerIfNotBefore(m_foot, beforeChild);
+                if (!m_foot) {
+                    m_foot = static_cast<RenderTableSection*>(child);
+                    wrapInAnonymousSection = false;
+                    break;
                 }
                 // Fall through.
             case TABLE_ROW_GROUP:
-                if (child->isTableSection()) {
-                    resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
-                    if (!m_firstBody)
-                        m_firstBody = static_cast<RenderTableSection*>(child);
-                }
+                resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
+                if (!m_firstBody)
+                    m_firstBody = static_cast<RenderTableSection*>(child);
                 wrapInAnonymousSection = false;
                 break;
             default:
                 ASSERT_NOT_REACHED();
         }
-    } else if (child->isTableCell() || child->isTableRow()) {
+    } else if (child->isTableCell() || child->isTableRow())
+        wrapInAnonymousSection = true;
+    else
         wrapInAnonymousSection = true;
-    } else {
-        // Allow a form to just sit at the top level.
-        wrapInAnonymousSection = !isTableElement || !child->element() || !(child->element()->hasTagName(formTag) && document()->isHTMLDocument());
-
-        // FIXME: Allow the delete button container element to sit at the top level. This is needed until http://bugs.webkit.org/show_bug.cgi?id=11363 is fixed.
-        if (wrapInAnonymousSection && child->element() && child->element()->isHTMLElement() && static_cast<HTMLElement*>(child->element())->id() == DeleteButtonController::containerElementIdentifier)
-            wrapInAnonymousSection = false;
-    }
 
     if (!wrapInAnonymousSection) {
         // If the next renderer is actually wrapped in an anonymous table section, we need to go up and find that.
         while (beforeChild && !beforeChild->isTableSection() && !beforeChild->isTableCol() && beforeChild->style()->display() != TABLE_CAPTION)
             beforeChild = beforeChild->parent();
 
-        RenderContainer::addChild(child, beforeChild);
+        RenderBox::addChild(child, beforeChild);
         return;
     }
 
@@ -208,6 +193,12 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
     section->addChild(child);
 }
 
+void RenderTable::removeChild(RenderObject* oldChild)
+{
+    RenderBox::removeChild(oldChild);
+    setNeedsSectionRecalc();
+}
+
 void RenderTable::calcWidth()
 {
     if (isPositioned())
@@ -219,12 +210,12 @@ void RenderTable::calcWidth()
     LengthType widthType = style()->width().type();
     if (widthType > Relative && style()->width().isPositive()) {
         // Percent or fixed table
-        m_width = style()->width().calcMinValue(availableWidth);
-        m_width = max(minPrefWidth(), m_width);
+        setWidth(style()->width().calcMinValue(availableWidth));
+        setWidth(max(minPrefWidth(), width()));
     } else {
         // An auto width table should shrink to fit within the line width if necessary in order to 
         // avoid overlapping floats.
-        availableWidth = cb->lineWidth(m_y);
+        availableWidth = cb->lineWidth(y(), false);
         
         // Subtract out any fixed margins from our available width for auto width tables.
         int marginTotal = 0;
@@ -237,10 +228,10 @@ void RenderTable::calcWidth()
         int availContentWidth = max(0, availableWidth - marginTotal);
         
         // Ensure we aren't bigger than our max width or smaller than our min width.
-        m_width = min(availContentWidth, maxPrefWidth());
+        setWidth(min(availContentWidth, maxPrefWidth()));
     }
     
-    m_width = max(m_width, minPrefWidth());
+    setWidth(max(width(), minPrefWidth()));
 
     // Finally, with our true width determined, compute our margins for real.
     m_marginRight = 0;
@@ -257,32 +248,25 @@ void RenderTable::layout()
 
     recalcSectionsIfNeeded();
         
-    IntRect oldBounds;
-    IntRect oldOutlineBox;
-    bool checkForRepaint = checkForRepaintDuringLayout();
-    if (checkForRepaint) {
-        oldBounds = absoluteClippedOverflowRect();
-        oldOutlineBox = absoluteOutlineBounds();
-    }
-    
-    LayoutStateMaintainer statePusher(view(), this, IntSize(m_x, m_y));
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()));
 
-    m_height = 0;
+    setHeight(0);
     m_overflowHeight = 0;
     m_overflowTop = 0;
     initMaxMarginValues();
     
-    int oldWidth = m_width;
+    int oldWidth = width();
     calcWidth();
 
-    if (m_caption && m_width != oldWidth)
+    if (m_caption && width() != oldWidth)
         m_caption->setNeedsLayout(true, false);
 
     // FIXME: The optimisation below doesn't work since the internal table
     // layout could have changed.  we need to add a flag to the table
     // layout that tells us if something has changed in the min max
     // calculations to do it correctly.
-//     if ( oldWidth != m_width || columns.size() + 1 != columnPos.size() )
+//     if ( oldWidth != width() || columns.size() + 1 != columnPos.size() )
     m_tableLayout->layout();
 
     setCellWidths();
@@ -294,18 +278,21 @@ void RenderTable::layout()
     bool collapsing = collapseBorders();
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        // FIXME: What about a form that has a display value that makes it a table section?
-        if (child->needsLayout() && !(child->element() && child->element()->hasTagName(formTag)))
-            child->layout();
         if (child->isTableSection()) {
+            child->layoutIfNeeded();
             RenderTableSection* section = static_cast<RenderTableSection*>(child);
             calculatedHeight += section->calcRowHeight();
             if (collapsing)
                 section->recalcOuterBorder();
+            ASSERT(!section->needsLayout());
         }
     }
 
-    m_overflowWidth = m_width + (collapsing ? outerBorderRight() - borderRight() : 0);
+    // Only lay out one caption, since it's the only one we're going to end up painting.
+    if (m_caption)
+        m_caption->layoutIfNeeded();
+
+    m_overflowWidth = width() + (collapsing ? outerBorderRight() - borderRight() : 0);
     m_overflowLeft = collapsing ? borderLeft() - outerBorderLeft() : 0;
 
     // If any table section moved vertically, we will just repaint everything from that
@@ -316,28 +303,28 @@ void RenderTable::layout()
 
     // FIXME: Collapse caption margin.
     if (m_caption && m_caption->style()->captionSide() != CAPBOTTOM) {
-        IntRect captionRect(m_caption->xPos(), m_caption->yPos(), m_caption->width(), m_caption->height());
+        IntRect captionRect(m_caption->x(), m_caption->y(), m_caption->width(), m_caption->height());
 
-        m_caption->setPos(m_caption->marginLeft(), m_height);
+        m_caption->setLocation(m_caption->marginLeft(), height());
         if (!selfNeedsLayout() && m_caption->checkForRepaintDuringLayout())
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
-        m_height += m_caption->height() + m_caption->marginTop() + m_caption->marginBottom();
-        m_overflowLeft = min(m_overflowLeft, m_caption->xPos() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->xPos() + m_caption->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, m_caption->yPos() + m_caption->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, m_caption->yPos() + m_caption->overflowHeight(false));
+        setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
+        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
+        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
+        m_overflowTop = min(m_overflowTop, m_caption->y() + m_caption->overflowTop(false));
+        m_overflowHeight = max(m_overflowHeight, m_caption->y() + m_caption->overflowHeight(false));
 
-        if (m_height != oldTableTop) {
+        if (height() != oldTableTop) {
             sectionMoved = true;
-            movedSectionTop = min(m_height, oldTableTop);
+            movedSectionTop = min(height(), oldTableTop);
         }
     }
 
     int bpTop = borderTop() + (collapsing ? 0 : paddingTop());
     int bpBottom = borderBottom() + (collapsing ? 0 : paddingBottom());
     
-    m_height += bpTop;
+    setHeight(height() + bpTop);
 
     if (!isPositioned())
         calcHeight();
@@ -352,16 +339,15 @@ void RenderTable::layout()
     th = max(0, th);
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (!child->isTableSection())
-            continue;
-        // FIXME: Distribute extra height between all table body sections instead of giving it all to the first one.
-        static_cast<RenderTableSection*>(child)->layoutRows(child == m_firstBody ? max(0, th - calculatedHeight) : 0);
+        if (child->isTableSection())
+            // FIXME: Distribute extra height between all table body sections instead of giving it all to the first one.
+            static_cast<RenderTableSection*>(child)->layoutRows(child == m_firstBody ? max(0, th - calculatedHeight) : 0);
     }
 
     if (!m_firstBody && th > calculatedHeight && !style()->htmlHacks()) {
         // Completely empty tables (with no sections or anything) should at least honor specified height
         // in strict mode.
-        m_height += th;
+        setHeight(height() + th);
     }
     
     int bl = borderLeft();
@@ -371,38 +357,38 @@ void RenderTable::layout()
     // position the table sections
     RenderTableSection* section = m_head ? m_head : (m_firstBody ? m_firstBody : m_foot);
     while (section) {
-        if (!sectionMoved && section->yPos() != m_height) {
+        if (!sectionMoved && section->y() != height()) {
             sectionMoved = true;
-            movedSectionTop = min(m_height, section->yPos()) + section->overflowTop(false);
+            movedSectionTop = min(height(), section->y()) + section->overflowTop(false);
         }
-        section->setPos(bl, m_height);
+        section->setLocation(bl, height());
 
-        m_height += section->height();
-        m_overflowLeft = min(m_overflowLeft, section->xPos() + section->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, section->xPos() + section->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, section->yPos() + section->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, section->yPos() + section->overflowHeight(false));
+        setHeight(height() + section->height());
+        m_overflowLeft = min(m_overflowLeft, section->x() + section->overflowLeft(false));
+        m_overflowWidth = max(m_overflowWidth, section->x() + section->overflowWidth(false));
+        m_overflowTop = min(m_overflowTop, section->y() + section->overflowTop(false));
+        m_overflowHeight = max(m_overflowHeight, section->y() + section->overflowHeight(false));
         section = sectionBelow(section);
     }
 
-    m_height += bpBottom;
+    setHeight(height() + bpBottom);
 
     if (m_caption && m_caption->style()->captionSide() == CAPBOTTOM) {
-        IntRect captionRect(m_caption->xPos(), m_caption->yPos(), m_caption->width(), m_caption->height());
+        IntRect captionRect(m_caption->x(), m_caption->y(), m_caption->width(), m_caption->height());
 
-        m_caption->setPos(m_caption->marginLeft(), m_height);
+        m_caption->setLocation(m_caption->marginLeft(), height());
         if (!selfNeedsLayout() && m_caption->checkForRepaintDuringLayout())
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
-        m_height += m_caption->height() + m_caption->marginTop() + m_caption->marginBottom();
-        m_overflowLeft = min(m_overflowLeft, m_caption->xPos() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->xPos() + m_caption->overflowWidth(false));
+        setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
+        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
+        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
     }
 
     if (isPositioned())
         calcHeight();
 
-    m_overflowHeight = max(m_overflowHeight, m_height);
+    m_overflowHeight = max(m_overflowHeight, height());
 
     // table can be containing block of positioned elements.
     // FIXME: Only pass true if width or height changed.
@@ -411,9 +397,9 @@ void RenderTable::layout()
     if (!hasOverflowClip()) {
         for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
             m_overflowLeft = min(m_overflowLeft, boxShadow->x - boxShadow->blur);
-            m_overflowWidth = max(m_overflowWidth, m_width + boxShadow->x + boxShadow->blur);
+            m_overflowWidth = max(m_overflowWidth, width() + boxShadow->x + boxShadow->blur);
             m_overflowTop = min(m_overflowTop, boxShadow->y - boxShadow->blur);
-            m_overflowHeight = max(m_overflowHeight, m_height + boxShadow->y + boxShadow->blur);
+            m_overflowHeight = max(m_overflowHeight, height() + boxShadow->y + boxShadow->blur);
         }
         
         if (hasReflection()) {
@@ -427,10 +413,8 @@ void RenderTable::layout()
 
     statePusher.pop();
 
-    bool didFullRepaint = true;
+    bool didFullRepaint = repainter.repaintAfterLayout();
     // Repaint with our new bounds if they are different from our old bounds.
-    if (checkForRepaint)
-        didFullRepaint = repaintAfterLayoutIfNeeded(oldBounds, oldOutlineBox);
     if (!didFullRepaint && sectionMoved)
         repaintRectangle(IntRect(m_overflowLeft, movedSectionTop, m_overflowWidth - m_overflowLeft, m_overflowHeight - movedSectionTop));
     
@@ -447,8 +431,8 @@ void RenderTable::setCellWidths()
 
 void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    tx += xPos();
-    ty += yPos();
+    tx += x();
+    ty += y();
 
     PaintPhase paintPhase = paintInfo.phase;
 
@@ -458,6 +442,15 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
     if (tx + overflowLeft(false) >= paintInfo.rect.right() + os || tx + overflowWidth(false) <= paintInfo.rect.x() - os)
         return;
 
+    bool pushedClip = pushContentsClip(paintInfo, tx, ty);    
+    paintObject(paintInfo, tx, ty);
+    if (pushedClip)
+        popContentsClip(paintInfo, paintPhase, tx, ty);
+}
+
+void RenderTable::paintObject(PaintInfo& paintInfo, int tx, int ty)
+{
+    PaintPhase paintPhase = paintInfo.phase;
     if ((paintPhase == PaintPhaseBlockBackground || paintPhase == PaintPhaseChildBlockBackground) && hasBoxDecorations() && style()->visibility() == VISIBLE)
         paintBoxDecorations(paintInfo, tx, ty);
 
@@ -469,19 +462,20 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
     // We're done.  We don't bother painting any children.
     if (paintPhase == PaintPhaseBlockBackground)
         return;
-
+    
     // We don't paint our own background, but we do let the kids paint their backgrounds.
     if (paintPhase == PaintPhaseChildBlockBackgrounds)
         paintPhase = PaintPhaseChildBlockBackground;
+
     PaintInfo info(paintInfo);
     info.phase = paintPhase;
     info.paintingRoot = paintingRootForChildren(paintInfo);
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (!child->hasLayer() && (child->isTableSection() || child == m_caption))
+        if (child->isBox() && !toRenderBox(child)->hasSelfPaintingLayer() && (child->isTableSection() || child == m_caption))
             child->paint(info, tx, ty);
     }
-
+    
     if (collapseBorders() && paintPhase == PaintPhaseChildBlockBackground && style()->visibility() == VISIBLE) {
         // Collect all the unique border styles that we want to paint in a sorted list.  Once we
         // have all the styles sorted, we then do individual passes, painting each style of border
@@ -664,7 +658,7 @@ void RenderTable::recalcSections() const
         switch (child->style()->display()) {
             case TABLE_CAPTION:
                 if (!m_caption && child->isRenderBlock()) {
-                    m_caption = static_cast<RenderBlock*>(child);
+                    m_caption = toRenderBlock(child);
                     m_caption->setNeedsLayout(true);
                 }
                 break;
@@ -724,12 +718,6 @@ void RenderTable::recalcSections() const
     m_needsSectionRecalc = false;
 }
 
-RenderObject* RenderTable::removeChildNode(RenderObject* child, bool fullRemove)
-{
-    setNeedsSectionRecalc();
-    return RenderContainer::removeChildNode(child, fullRemove);
-}
-
 int RenderTable::calcBorderLeft() const
 {
     if (collapseBorders()) {
@@ -1119,7 +1107,7 @@ void RenderTable::updateFirstLetter()
 {
 }
 
-int RenderTable::getBaselineOfFirstLineBox() const
+int RenderTable::firstLineBoxBaseline() const
 {
     RenderTableSection* firstNonEmptySection = m_head ? m_head : (m_firstBody ? m_firstBody : m_foot);
     if (firstNonEmptySection && !firstNonEmptySection->numRows())
@@ -1128,12 +1116,12 @@ int RenderTable::getBaselineOfFirstLineBox() const
     if (!firstNonEmptySection)
         return -1;
 
-    return firstNonEmptySection->yPos() + firstNonEmptySection->getBaselineOfFirstLineBox();
+    return firstNonEmptySection->y() + firstNonEmptySection->firstLineBoxBaseline();
 }
 
-IntRect RenderTable::getOverflowClipRect(int tx, int ty)
+IntRect RenderTable::overflowClipRect(int tx, int ty)
 {
-    IntRect rect = RenderBlock::getOverflowClipRect(tx, ty);
+    IntRect rect = RenderBlock::overflowClipRect(tx, ty);
     
     // If we have a caption, expand the clip to include the caption.
     // FIXME: Technically this is wrong, but it's virtually impossible to fix this
@@ -1149,4 +1137,29 @@ IntRect RenderTable::getOverflowClipRect(int tx, int ty)
     return rect;
 }
 
+bool RenderTable::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int xPos, int yPos, int tx, int ty, HitTestAction action)
+{
+    tx += x();
+    ty += y();
+
+    // Check kids first.
+    if (!hasOverflowClip() || overflowClipRect(tx, ty).contains(xPos, yPos)) {
+        for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
+            if (child->isBox() && !toRenderBox(child)->hasSelfPaintingLayer() && (child->isTableSection() || child == m_caption) &&
+                child->nodeAtPoint(request, result, xPos, yPos, tx, ty, action)) {
+                updateHitTestResult(result, IntPoint(xPos - tx, yPos - ty));
+                return true;
+            }
+        }
+    }
+
+    // Check our bounds next.
+    if (visibleToHitTesting() && (action == HitTestBlockBackground || action == HitTestChildBlockBackground) && IntRect(tx, ty, width(), height()).contains(xPos, yPos)) {
+        updateHitTestResult(result, IntPoint(xPos - tx, yPos - ty));
+        return true;
+    }
+
+    return false;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.h b/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
index 59cb00e4b3..07e02b05ef 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
@@ -39,26 +39,6 @@ class TableLayout;
 
 class RenderTable : public RenderBlock {
 public:
-    enum Rules {
-        None    = 0x00,
-        RGroups = 0x01,
-        CGroups = 0x02,
-        Groups  = 0x03,
-        Rows    = 0x05,
-        Cols    = 0x0a,
-        All     = 0x0f
-    };
-    enum Frame {
-        Void   = 0x00,
-        Above  = 0x01,
-        Below  = 0x02,
-        Lhs    = 0x04,
-        Rhs    = 0x08,
-        Hsides = 0x03,
-        Vsides = 0x0c,
-        Box    = 0x0f
-    };
-
     RenderTable(Node*);
     ~RenderTable();
 
@@ -79,8 +59,6 @@ public:
     int borderTop() const;
     int borderBottom() const;
     
-    Rules getRules() const { return static_cast<Rules>(m_rules); }
-
     const Color& bgColor() const { return style()->backgroundColor(); }
 
     int outerBorderTop() const;
@@ -94,13 +72,17 @@ public:
 
     // overrides
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* oldChild);
+
     virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paintObject(PaintInfo&, int tx, int ty);
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
     virtual void paintMask(PaintInfo& paintInfo, int tx, int ty);
     virtual void layout();
     virtual void calcPrefWidths();
-
-    virtual int getBaselineOfFirstLineBox() const;
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int xPos, int yPos, int tx, int ty, HitTestAction);
+    
+    virtual int firstLineBoxBaseline() const;
 
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
@@ -169,8 +151,6 @@ public:
         setNeedsLayout(true);
     }
 
-    virtual RenderObject* removeChildNode(RenderObject*, bool fullRemove = true);
-
     RenderTableSection* sectionAbove(const RenderTableSection*, bool skipEmptySections = false) const;
     RenderTableSection* sectionBelow(const RenderTableSection*, bool skipEmptySections = false) const;
 
@@ -183,7 +163,7 @@ public:
     
     bool hasSections() const { return m_head || m_foot || m_firstBody; }
 
-    virtual IntRect getOverflowClipRect(int tx, int ty);
+    virtual IntRect overflowClipRect(int tx, int ty);
 
     void recalcSectionsIfNeeded() const
     {
@@ -192,7 +172,7 @@ public:
     }
 
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
     void recalcSections() const;
@@ -209,9 +189,6 @@ private:
 
     const CollapsedBorderValue* m_currentBorder;
     
-    unsigned m_frame : 4; // Frame
-    unsigned m_rules : 4; // Rules
-
     mutable bool m_hasColElements : 1;
     mutable bool m_needsSectionRecalc : 1;
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
index 02e7729f4a..81c96f16cf 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
@@ -1,4 +1,4 @@
-/**
+/*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
@@ -25,11 +25,13 @@
 #include "config.h"
 #include "RenderTableCell.h"
 
+#include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "HTMLTableCellElement.h"
 #include "RenderTableCol.h"
 #include "RenderView.h"
+#include "TransformState.h"
 
 using namespace std;
 
@@ -43,9 +45,8 @@ RenderTableCell::RenderTableCell(Node* node)
     , m_column(-1)
     , m_rowSpan(1)
     , m_columnSpan(1)
-    , m_topExtra(0)
-    , m_bottomExtra(0)
-    , m_widthChanged(false)
+    , m_intrinsicPaddingTop(0)
+    , m_intrinsicPaddingBottom(0)
     , m_percentageHeight(0)
 {
     updateFromElement();
@@ -63,9 +64,9 @@ void RenderTableCell::destroy()
 
 void RenderTableCell::updateFromElement()
 {
-    Node* node = element();
-    if (node && (node->hasTagName(tdTag) || node->hasTagName(thTag))) {
-        HTMLTableCellElement* tc = static_cast<HTMLTableCellElement*>(node);
+    Node* n = node();
+    if (n && (n->hasTagName(tdTag) || n->hasTagName(thTag))) {
+        HTMLTableCellElement* tc = static_cast<HTMLTableCellElement*>(n);
         int oldRSpan = m_rowSpan;
         int oldCSpan = m_columnSpan;
 
@@ -105,10 +106,10 @@ void RenderTableCell::calcPrefWidths()
     table()->recalcSectionsIfNeeded();
 
     RenderBlock::calcPrefWidths();
-    if (element() && style()->autoWrap()) {
+    if (node() && style()->autoWrap()) {
         // See if nowrap was set.
         Length w = styleOrColWidth();
-        String nowrap = static_cast<Element*>(element())->getAttribute(nowrapAttr);
+        String nowrap = static_cast<Element*>(node())->getAttribute(nowrapAttr);
         if (!nowrap.isNull() && w.isFixed())
             // Nowrap is set, but we didn't actually use it because of the
             // fixed width set on the cell.  Even so, it is a WinIE/Moz trait
@@ -123,28 +124,44 @@ void RenderTableCell::calcWidth()
 {
 }
 
-void RenderTableCell::setWidth(int width)
+void RenderTableCell::updateWidth(int w)
 {
-    if (width != m_width) {
-        m_width = width;
-        m_widthChanged = true;
+    if (w != width()) {
+        setWidth(w);
+        setCellWidthChanged(true);
     }
 }
 
 void RenderTableCell::layout()
 {
-    layoutBlock(m_widthChanged);
-    m_widthChanged = false;
+    layoutBlock(cellWidthChanged());
+    setCellWidthChanged(false);
 }
 
-IntRect RenderTableCell::absoluteClippedOverflowRect()
+int RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
+{
+    return RenderBlock::paddingTop() + (includeIntrinsicPadding ? intrinsicPaddingTop() : 0);
+}
+
+int RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
+{
+    return RenderBlock::paddingBottom() + (includeIntrinsicPadding ? intrinsicPaddingBottom() : 0);
+}
+
+void RenderTableCell::setOverrideSize(int size)
+{
+    clearIntrinsicPadding();
+    RenderBlock::setOverrideSize(size);
+}
+
+IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // If the table grid is dirty, we cannot get reliable information about adjoining cells,
     // so we ignore outside borders. This should not be a problem because it means that
     // the table is going to recalculate the grid, relayout and repaint its current rect, which
     // includes any outside borders of this cell.
     if (!table()->collapseBorders() || table()->needsSectionRecalc())
-        return RenderBlock::absoluteClippedOverflowRect();
+        return RenderBlock::clippedOverflowRectForRepaint(repaintContainer);
 
     bool rtl = table()->style()->direction() == RTL;
     int outlineSize = style()->outlineSize();
@@ -152,13 +169,13 @@ IntRect RenderTableCell::absoluteClippedOverflowRect()
     int right = max(borderHalfRight(true), outlineSize);
     int top = max(borderHalfTop(true), outlineSize);
     int bottom = max(borderHalfBottom(true), outlineSize);
-    if (left && !rtl || right && rtl) {
+    if ((left && !rtl) || (right && rtl)) {
         if (RenderTableCell* before = table()->cellBefore(this)) {
             top = max(top, before->borderHalfTop(true));
             bottom = max(bottom, before->borderHalfBottom(true));
         }
     }
-    if (left && rtl || right && !rtl) {
+    if ((left && rtl) || (right && !rtl)) {
         if (RenderTableCell* after = table()->cellAfter(this)) {
             top = max(top, after->borderHalfTop(true));
             bottom = max(bottom, after->borderHalfBottom(true));
@@ -177,69 +194,68 @@ IntRect RenderTableCell::absoluteClippedOverflowRect()
         }
     }
     left = max(left, -overflowLeft(false));
-    top = max(top, -overflowTop(false) - borderTopExtra());
-    IntRect r(-left, -borderTopExtra() - top, left + max(width() + right, overflowWidth(false)), borderTopExtra() + top + max(height() + bottom + borderBottomExtra(), overflowHeight(false)));
+    top = max(top, -overflowTop(false));
+    IntRect r(-left, - top, left + max(width() + right, overflowWidth(false)), top + max(height() + bottom, overflowHeight(false)));
 
-    if (RenderView* v = view())
+    if (RenderView* v = view()) {
+        // FIXME: layoutDelta needs to be applied in parts before/after transforms and
+        // repaint containers. https://bugs.webkit.org/show_bug.cgi?id=23308
         r.move(v->layoutDelta());
-
-    computeAbsoluteRepaintRect(r);
+    }
+    computeRectForRepaint(repaintContainer, r);
     return r;
 }
 
-void RenderTableCell::computeAbsoluteRepaintRect(IntRect& r, bool fixed)
+void RenderTableCell::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& r, bool fixed)
 {
-    r.setY(r.y() + m_topExtra);
+    if (repaintContainer == this)
+        return;
+    r.setY(r.y());
     RenderView* v = view();
-    if ((!v || !v->layoutState()) && parent())
-        r.move(-parent()->xPos(), -parent()->yPos()); // Rows are in the same coordinate space, so don't add their offset in.
-    RenderBlock::computeAbsoluteRepaintRect(r, fixed);
+    if ((!v || !v->layoutStateEnabled()) && parent())
+        r.move(-parentBox()->x(), -parentBox()->y()); // Rows are in the same coordinate space, so don't add their offset in.
+    RenderBlock::computeRectForRepaint(repaintContainer, r, fixed);
 }
 
-FloatPoint RenderTableCell::localToAbsolute(FloatPoint localPoint, bool fixed, bool useTransforms) const
+void RenderTableCell::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
 {
+    if (repaintContainer == this)
+        return;
+
     RenderView* v = view();
-    if ((!v || !v->layoutState()) && parent()) {
+    if ((!v || !v->layoutStateEnabled()) && parent()) {
         // Rows are in the same coordinate space, so don't add their offset in.
-        localPoint.move(-parent()->xPos(), -parent()->yPos());
+        // FIXME: this is wrong with transforms
+        transformState.move(-parentBox()->x(), -parentBox()->y());
     }
-    return RenderBlock::localToAbsolute(localPoint, fixed, useTransforms);
+    RenderBlock::mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
 
-FloatPoint RenderTableCell::absoluteToLocal(FloatPoint containerPoint, bool fixed, bool useTransforms) const
+void RenderTableCell::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
 {
-    FloatPoint localPoint = RenderBlock::absoluteToLocal(containerPoint, fixed, useTransforms);
+    RenderBlock::mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
     if (parent()) {
         // Rows are in the same coordinate space, so add their offset back in.
-        localPoint.move(parent()->xPos(), parent()->yPos());
+        // FIXME: this is wrong with transforms
+        transformState.move(parentBox()->x(), parentBox()->y());
     }
-    return localPoint;
 }
 
-FloatQuad RenderTableCell::localToAbsoluteQuad(const FloatQuad& localQuad, bool fixed) const
+int RenderTableCell::baselinePosition(bool firstLine, bool isRootLineBox) const
 {
-    FloatQuad quad = localQuad;
-    if (parent()) {
-        // Rows are in the same coordinate space, so don't add their offset in.
-        quad.move(-parent()->xPos(), -parent()->yPos());
-    }
-    return RenderBlock::localToAbsoluteQuad(quad, fixed);
-}
+    if (isRootLineBox)
+        return RenderBox::baselinePosition(firstLine, isRootLineBox);
 
-int RenderTableCell::baselinePosition(bool /*firstLine*/, bool /*isRootLineBox*/) const
-{
     // <http://www.w3.org/TR/2007/CR-CSS21-20070719/tables.html#height-layout>: The baseline of a cell is the baseline of
     // the first in-flow line box in the cell, or the first in-flow table-row in the cell, whichever comes first. If there
     // is no such line box or table-row, the baseline is the bottom of content edge of the cell box.
-
-    int firstLineBaseline = getBaselineOfFirstLineBox();
+    int firstLineBaseline = firstLineBoxBaseline();
     if (firstLineBaseline != -1)
         return firstLineBaseline;
-
     return paddingTop() + borderTop() + contentHeight();
 }
 
-void RenderTableCell::styleWillChange(RenderStyle::Diff diff, const RenderStyle* newStyle)
+void RenderTableCell::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     if (parent() && section() && style() && style()->height() != newStyle->height())
         section()->setNeedsCellRecalc();
@@ -249,17 +265,12 @@ void RenderTableCell::styleWillChange(RenderStyle::Diff diff, const RenderStyle*
     RenderBlock::styleWillChange(diff, newStyle);
 }
 
-void RenderTableCell::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderTableCell::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
     setHasBoxDecorations(true);
 }
 
-bool RenderTableCell::requiresLayer()
-{
-    return isPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection();
-}
-
 // The following rules apply for resolving conflicts and figuring out which border
 // to use.
 // (1) Borders with the 'border-style' of 'hidden' take precedence over all other conflicting 
@@ -630,24 +641,17 @@ int RenderTableCell::borderHalfBottom(bool outer) const
 
 void RenderTableCell::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    tx += m_x;
-    ty += m_y;
-
-    // check if we need to do anything at all...
-    int os = 2 * maximalOutlineSize(paintInfo.phase);
-
     if (paintInfo.phase == PaintPhaseCollapsedTableBorders && style()->visibility() == VISIBLE) {
-        if (ty - table()->outerBorderTop() >= paintInfo.rect.bottom() + os ||
-                ty + m_topExtra + m_height + m_bottomExtra + table()->outerBorderBottom() <= paintInfo.rect.y() - os)
-            return;
-        int w = width();
-        int h = height() + borderTopExtra() + borderBottomExtra();
-        paintCollapsedBorder(paintInfo.context, tx, ty, w, h);
-    } else {
-        if (ty + overflowTop(false) >= paintInfo.rect.bottom() + os || ty + m_topExtra + overflowHeight(false) + m_bottomExtra <= paintInfo.rect.y() - os)
-            return;
-        RenderBlock::paintObject(paintInfo, tx, ty + m_topExtra);
-    }
+        tx += x();
+        ty += y();
+        int os = 2 * maximalOutlineSize(paintInfo.phase);
+        if (ty - table()->outerBorderTop() < paintInfo.rect.bottom() + os &&
+            ty + height() + table()->outerBorderBottom() > paintInfo.rect.y() - os)
+            paintCollapsedBorder(paintInfo.context, tx, ty, width(), height());
+        return;
+    } 
+    
+    RenderBlock::paint(paintInfo, tx, ty);
 }
 
 static EBorderStyle collapsedBorderStyle(EBorderStyle style)
@@ -661,7 +665,7 @@ static EBorderStyle collapsedBorderStyle(EBorderStyle style)
 
 struct CollapsedBorder {
     CollapsedBorderValue borderValue;
-    RenderObject::BorderSide side;
+    BoxSide side;
     bool shouldPaint;
     int x1;
     int y1;
@@ -677,7 +681,7 @@ public:
     {
     }
     
-    void addBorder(const CollapsedBorderValue& borderValue, RenderObject::BorderSide borderSide, bool shouldPaint,
+    void addBorder(const CollapsedBorderValue& borderValue, BoxSide borderSide, bool shouldPaint,
                    int x1, int y1, int x2, int y2, EBorderStyle borderStyle)
     {
         if (borderValue.exists() && shouldPaint) {
@@ -789,8 +793,8 @@ void RenderTableCell::paintCollapsedBorder(GraphicsContext* graphicsContext, int
     
     for (CollapsedBorder* border = borders.nextBorder(); border; border = borders.nextBorder()) {
         if (border->borderValue == *table()->currentBorderStyle())
-            drawBorder(graphicsContext, border->x1, border->y1, border->x2, border->y2, border->side, 
-                       border->borderValue.color(), style()->color(), border->style, 0, 0);
+            drawLineForBoxSide(graphicsContext, border->x1, border->y1, border->x2, border->y2, border->side, 
+                               border->borderValue.color(), style()->color(), border->style, 0, 0);
     }
 }
 
@@ -807,13 +811,12 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
         return;
 
     if (backgroundObject != this) {
-        tx += m_x;
-        ty += m_y + m_topExtra;
+        tx += x();
+        ty += y();
     }
 
     int w = width();
-    int h = height() + borderTopExtra() + borderBottomExtra();
-    ty -= borderTopExtra();
+    int h = height();
 
     int my = max(ty, paintInfo.rect.y());
     int end = min(paintInfo.rect.bottom(), ty + h);
@@ -845,10 +848,10 @@ void RenderTableCell::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
         return;
 
     int w = width();
-    int h = height() + borderTopExtra() + borderBottomExtra();
+    int h = height();
    
     if (style()->boxShadow())
-        paintBoxShadow(paintInfo.context, tx, ty - borderTopExtra(), w, h, style());
+        paintBoxShadow(paintInfo.context, tx, ty, w, h, style());
     
     // Paint our cell background.
     paintBackgroundsBehindCell(paintInfo, tx, ty, this);
@@ -856,7 +859,6 @@ void RenderTableCell::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     if (!style()->hasBorder() || tableElt->collapseBorders())
         return;
 
-    ty -= borderTopExtra();
     paintBorder(paintInfo.context, tx, ty, w, h, style());
 }
 
@@ -870,7 +872,7 @@ void RenderTableCell::paintMask(PaintInfo& paintInfo, int tx, int ty)
         return;
 
     int w = width();
-    int h = height() + borderTopExtra() + borderBottomExtra();
+    int h = height();
    
     int my = max(ty, paintInfo.rect.y());
     int end = min(paintInfo.rect.bottom(), ty + h);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
index 20b7da7048..a57b24bb60 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
@@ -59,13 +59,11 @@ public:
 
     Length styleOrColWidth() const;
 
-    virtual bool requiresLayer();
+    virtual bool requiresLayer() const { return isPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection(); }
 
     virtual void calcPrefWidths();
     virtual void calcWidth();
-    virtual void setWidth(int);
-
-    virtual bool expandsToEncloseOverhangingFloats() const { return true; }
+    void updateWidth(int);
 
     int borderLeft() const;
     int borderRight() const;
@@ -96,35 +94,38 @@ public:
     void paintCollapsedBorder(GraphicsContext*, int x, int y, int w, int h);
     void paintBackgroundsBehindCell(PaintInfo&, int tx, int ty, RenderObject* backgroundObject);
 
-    // Lie about position to outside observers.
-    virtual int yPos() const { return m_y + m_topExtra; }
-
-    virtual IntRect absoluteClippedOverflowRect();
-    virtual void computeAbsoluteRepaintRect(IntRect&, bool fixed = false);
-    virtual FloatPoint localToAbsolute(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
-    virtual FloatPoint absoluteToLocal(FloatPoint containerPoint, bool fixed = false, bool useTransforms = false) const;
-    virtual FloatQuad localToAbsoluteQuad(const FloatQuad&, bool fixed = false) const;
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
     virtual int baselinePosition(bool firstLine = false, bool isRootLineBox = false) const;
 
-    void setCellTopExtra(int p) { m_topExtra = p; }
-    void setCellBottomExtra(int p) { m_bottomExtra = p; }
+    void setIntrinsicPaddingTop(int p) { m_intrinsicPaddingTop = p; }
+    void setIntrinsicPaddingBottom(int p) { m_intrinsicPaddingBottom = p; }
+    void setIntrinsicPadding(int top, int bottom) { setIntrinsicPaddingTop(top); setIntrinsicPaddingBottom(bottom); }
+    void clearIntrinsicPadding() { setIntrinsicPadding(0, 0); }
+
+    int intrinsicPaddingTop() const { return m_intrinsicPaddingTop; }
+    int intrinsicPaddingBottom() const { return m_intrinsicPaddingBottom; }
 
-    virtual int borderTopExtra() const { return m_topExtra; }
-    virtual int borderBottomExtra() const { return m_bottomExtra; }
+    virtual int paddingTop(bool includeIntrinsicPadding = true) const;
+    virtual int paddingBottom(bool includeIntrinsicPadding = true) const;
+
+    virtual void setOverrideSize(int);
 
 protected:
-    virtual void styleWillChange(RenderStyle::Diff, const RenderStyle* newStyle);
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
 private:
     int m_row;
     int m_column;
     int m_rowSpan;
     int m_columnSpan;
-    int m_topExtra : 31;
-    int m_bottomExtra : 31;
-    bool m_widthChanged : 1;
+    int m_intrinsicPaddingTop;
+    int m_intrinsicPaddingBottom;
     int m_percentageHeight;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp
index 5c2a0490b0..f17963c7cd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp
@@ -37,7 +37,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 RenderTableCol::RenderTableCol(Node* node)
-    : RenderContainer(node), m_span(1)
+    : RenderBox(node), m_span(1)
 {
     // init RenderObject attributes
     setInline(true); // our object is not Inline
@@ -47,9 +47,9 @@ RenderTableCol::RenderTableCol(Node* node)
 void RenderTableCol::updateFromElement()
 {
     int oldSpan = m_span;
-    Node* node = element();
-    if (node && (node->hasTagName(colTag) || node->hasTagName(colgroupTag))) {
-        HTMLTableColElement* tc = static_cast<HTMLTableColElement*>(node);
+    Node* n = node();
+    if (n && (n->hasTagName(colTag) || n->hasTagName(colgroupTag))) {
+        HTMLTableColElement* tc = static_cast<HTMLTableColElement*>(n);
         m_span = tc->span();
     } else
         m_span = !(style() && style()->display() == TABLE_COLUMN_GROUP);
@@ -69,16 +69,17 @@ bool RenderTableCol::canHaveChildren() const
     return style()->display() == TABLE_COLUMN_GROUP;
 }
 
-IntRect RenderTableCol::absoluteClippedOverflowRect()
+IntRect RenderTableCol::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // For now, just repaint the whole table.
     // FIXME: Find a better way to do this, e.g., need to repaint all the cells that we
     // might have propagated a background color or borders into.
+    // FIXME: check for repaintContainer each time here?
     RenderObject* table = parent();
     if (table && !table->isTable())
         table = table->parent();
     if (table && table->isTable())
-        return table->absoluteClippedOverflowRect();
+        return table->clippedOverflowRectForRepaint(repaintContainer);
 
     return IntRect();
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h
index 6752bd8582..8c494b2514 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h
@@ -28,15 +28,20 @@
 #ifndef RenderTableCol_h
 #define RenderTableCol_h
 
-#include "RenderContainer.h"
+#include "RenderBox.h"
 
 namespace WebCore {
 
-class RenderTableCol : public RenderContainer
+class RenderTableCol : public RenderBox
 {
 public:
     RenderTableCol(Node*);
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
     virtual const char* renderName() const { return "RenderTableCol"; }
     virtual bool isTableCol() const { return true; }
     virtual int lineHeight(bool) const { return 0; }
@@ -44,15 +49,16 @@ public:
 
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
     virtual bool canHaveChildren() const;
-    virtual bool requiresLayer() { return false; }
+    virtual bool requiresLayer() const { return false; }
 
-    virtual IntRect absoluteClippedOverflowRect();
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
     int span() const { return m_span; }
     void setSpan(int s) { m_span = s; }
     
 private:
+    RenderObjectChildList m_children;
     int m_span;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
index 21ba91a54d..33b2c39577 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
@@ -33,16 +33,12 @@
 #include "RenderTableCell.h"
 #include "RenderView.h"
 
-#if ENABLE(WML)
-#include "WMLNames.h"
-#endif
-
 namespace WebCore {
 
 using namespace HTMLNames;
 
 RenderTableRow::RenderTableRow(Node* node)
-    : RenderContainer(node)
+    : RenderBox(node)
 {
     // init RenderObject attributes
     setInline(false);   // our object is not Inline
@@ -52,20 +48,20 @@ void RenderTableRow::destroy()
 {
     RenderTableSection* recalcSection = section();
     
-    RenderContainer::destroy();
+    RenderBox::destroy();
     
     if (recalcSection)
         recalcSection->setNeedsCellRecalc();
 }
 
-void RenderTableRow::styleWillChange(RenderStyle::Diff diff, const RenderStyle* newStyle)
+void RenderTableRow::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     if (section() && style() && style()->height() != newStyle->height())
         section()->setNeedsCellRecalc();
 
     ASSERT(newStyle->display() == TABLE_ROW);
 
-    RenderContainer::styleWillChange(diff, newStyle);
+    RenderBox::styleWillChange(diff, newStyle);
 }
 
 void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
@@ -74,19 +70,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
 
-    bool isTableRow = element() && element()->hasTagName(trTag);
-
-#if ENABLE(WML)
-    if (!isTableRow && element() && element()->isWMLElement())
-        isTableRow = element()->hasTagName(WMLNames::trTag);
-#endif
-
     if (!child->isTableCell()) {
-        if (isTableRow && child->element() && child->element()->hasTagName(formTag) && document()->isHTMLDocument()) {
-            RenderContainer::addChild(child, beforeChild);
-            return;
-        }
-
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
@@ -121,8 +105,8 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
     if (parent())
         section()->addCell(cell, this);
 
-    ASSERT(!beforeChild || beforeChild->isTableCell() || isTableRow && beforeChild->element() && beforeChild->element()->hasTagName(formTag) && document()->isHTMLDocument());
-    RenderContainer::addChild(cell, beforeChild);
+    ASSERT(!beforeChild || beforeChild->isTableCell());
+    RenderBox::addChild(cell, beforeChild);
 
     if (beforeChild || nextSibling())
         section()->setNeedsCellRecalc();
@@ -148,7 +132,7 @@ void RenderTableRow::layout()
     // We only ever need to repaint if our cells didn't, which menas that they didn't need
     // layout, so we know that our bounds didn't change. This code is just making up for
     // the fact that we did not repaint in setStyle() because we had a layout hint.
-    // We cannot call repaint() because our absoluteClippedOverflowRect() is taken from the
+    // We cannot call repaint() because our clippedOverflowRectForRepaint() is taken from the
     // parent table, and being mid-layout, that is invalid. Instead, we repaint our cells.
     if (selfNeedsLayout() && checkForRepaintDuringLayout()) {
         for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
@@ -161,13 +145,14 @@ void RenderTableRow::layout()
     setNeedsLayout(false);
 }
 
-IntRect RenderTableRow::absoluteClippedOverflowRect()
+IntRect RenderTableRow::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // For now, just repaint the whole table.
     // FIXME: Find a better way to do this, e.g., need to repaint all the cells that we
     // might have propagated a background color into.
+    // FIXME: do repaintContainer checks here
     if (RenderTable* parentTable = table())
-        return parentTable->absoluteClippedOverflowRect();
+        return parentTable->clippedOverflowRectForRepaint(repaintContainer);
 
     return IntRect();
 }
@@ -182,7 +167,7 @@ bool RenderTableRow::nodeAtPoint(const HitTestRequest& request, HitTestResult& r
         // at the moment (a demoted inline <form> for example). If we ever implement a
         // table-specific hit-test method (which we should do for performance reasons anyway),
         // then we can remove this check.
-        if (!child->hasLayer() && !child->isInlineFlow() && child->nodeAtPoint(request, result, x, y, tx, ty, action)) {
+        if (child->isTableCell() && !toRenderBox(child)->hasSelfPaintingLayer() && child->nodeAtPoint(request, result, x, y, tx, ty, action)) {
             updateHitTestResult(result, IntPoint(x - tx, y - ty));
             return true;
         }
@@ -193,10 +178,9 @@ bool RenderTableRow::nodeAtPoint(const HitTestRequest& request, HitTestResult& r
 
 void RenderTableRow::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    ASSERT(m_layer);
-    if (!m_layer)
+    ASSERT(hasSelfPaintingLayer());
+    if (!layer())
         return;
-
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableCell()) {
             // Paint the row background behind the cell.
@@ -204,7 +188,7 @@ void RenderTableRow::paint(PaintInfo& paintInfo, int tx, int ty)
                 RenderTableCell* cell = static_cast<RenderTableCell*>(child);
                 cell->paintBackgroundsBehindCell(paintInfo, tx, ty, this);
             }
-            if (!child->hasLayer())
+            if (!toRenderBox(child)->hasSelfPaintingLayer())
                 child->paint(paintInfo, tx, ty);
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h
index a65d0e97b2..9622480b5d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h
@@ -31,10 +31,15 @@
 
 namespace WebCore {
 
-class RenderTableRow : public RenderContainer {
+class RenderTableRow : public RenderBox {
 public:
     RenderTableRow(Node*);
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
     RenderTableSection* section() const { return static_cast<RenderTableSection*>(parent()); }
     RenderTable* table() const { return static_cast<RenderTable*>(parent()->parent()); }
 
@@ -47,19 +52,21 @@ private:
 
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual int lineHeight(bool, bool) const { return 0; }
-    virtual void position(InlineBox*) { }
     virtual void layout();
-    virtual IntRect absoluteClippedOverflowRect();
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
     // The only time rows get a layer is when they have transparency.
-    virtual bool requiresLayer() { return isTransparent() || hasOverflowClip(); }
+    virtual bool requiresLayer() const { return isTransparent() || hasOverflowClip() || hasTransform() || hasMask(); }
 
     virtual void paint(PaintInfo&, int tx, int ty);
+
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
-    virtual void styleWillChange(RenderStyle::Diff, const RenderStyle* newStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
 
+private:
+    RenderObjectChildList m_children;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
index be43ab8c37..27c230bb29 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
@@ -43,11 +43,10 @@ namespace WebCore {
 using namespace HTMLNames;
 
 RenderTableSection::RenderTableSection(Node* node)
-    : RenderContainer(node)
+    : RenderBox(node)
     , m_gridRows(0)
     , m_cCol(0)
     , m_cRow(-1)
-    , m_needsCellRecalc(false)
     , m_outerBorderLeft(0)
     , m_outerBorderRight(0)
     , m_outerBorderTop(0)
@@ -56,6 +55,7 @@ RenderTableSection::RenderTableSection(Node* node)
     , m_overflowWidth(0)
     , m_overflowTop(0)
     , m_overflowHeight(0)
+    , m_needsCellRecalc(false)
     , m_hasOverflowingCell(false)
 {
     // init RenderObject attributes
@@ -71,7 +71,7 @@ void RenderTableSection::destroy()
 {
     RenderTable* recalcTable = table();
     
-    RenderContainer::destroy();
+    RenderBox::destroy();
     
     // recalc cell info because RenderTable has unguarded pointers
     // stored that point to this RenderTableSection.
@@ -85,14 +85,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
 
-    bool isTableSection = element() && (element()->hasTagName(theadTag) || element()->hasTagName(tbodyTag) || element()->hasTagName(tfootTag));
-
     if (!child->isTableRow()) {
-        if (isTableSection && child->element() && child->element()->hasTagName(formTag) && document()->isHTMLDocument()) {
-            RenderContainer::addChild(child, beforeChild);
-            return;
-        }
-
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
@@ -111,7 +104,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
             return;
         }
 
-        RenderObject* row = new (renderArena()) RenderTableRow(document() /* anonymous table */);
+        RenderObject* row = new (renderArena()) RenderTableRow(document() /* anonymous table row */);
         RefPtr<RenderStyle> newStyle = RenderStyle::create();
         newStyle->inheritFrom(style());
         newStyle->setDisplay(TABLE_ROW);
@@ -131,7 +124,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
     if (!ensureRows(m_cRow + 1))
         return;
 
-    m_grid[m_cRow].rowRenderer = child;
+    m_grid[m_cRow].rowRenderer = static_cast<RenderTableRow*>(child);
 
     if (!beforeChild) {
         m_grid[m_cRow].height = child->style()->height();
@@ -143,8 +136,14 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
     while (beforeChild && beforeChild->parent() != this)
         beforeChild = beforeChild->parent();
 
-    ASSERT(!beforeChild || beforeChild->isTableRow() || isTableSection && beforeChild->element() && beforeChild->element()->hasTagName(formTag) && document()->isHTMLDocument());
-    RenderContainer::addChild(child, beforeChild);
+    ASSERT(!beforeChild || beforeChild->isTableRow());
+    RenderBox::addChild(child, beforeChild);
+}
+
+void RenderTableSection::removeChild(RenderObject* oldChild)
+{
+    setNeedsCellRecalc();
+    RenderBox::removeChild(oldChild);
 }
 
 bool RenderTableSection::ensureRows(int numRows)
@@ -174,7 +173,7 @@ bool RenderTableSection::ensureRows(int numRows)
     return true;
 }
 
-void RenderTableSection::addCell(RenderTableCell* cell, RenderObject* row)
+void RenderTableSection::addCell(RenderTableCell* cell, RenderTableRow* row)
 {
     int rSpan = cell->rowSpan();
     int cSpan = cell->colSpan();
@@ -238,7 +237,7 @@ void RenderTableSection::addCell(RenderTableCell* cell, RenderObject* row)
 
         for (int r = 0; r < rSpan; r++) {
             CellStruct& c = cellAt(m_cRow + r, m_cCol);
-            if (currentCell.cell && !c.cell)
+            if (!c.cell)
                 c.cell = currentCell.cell;
             if (currentCell.inColSpan)
                 c.inColSpan = true;
@@ -248,10 +247,8 @@ void RenderTableSection::addCell(RenderTableCell* cell, RenderObject* row)
         currentCell.cell = 0;
         currentCell.inColSpan = true;
     }
-    if (cell) {
-        cell->setRow(m_cRow);
-        cell->setCol(table()->effColToCol(col));
-    }
+    cell->setRow(m_cRow);
+    cell->setCol(table()->effColToCol(col));
 }
 
 void RenderTableSection::setCellWidths()
@@ -283,11 +280,11 @@ void RenderTableSection::setCellWidths()
                     if (!statePusher.didPush()) {
                         // Technically, we should also push state for the row, but since
                         // rows don't push a coordinate transform, that's not necessary.
-                        statePusher.push(this, IntSize(m_x, m_y));
+                        statePusher.push(this, IntSize(x(), y()));
                     }
                     cell->repaint();
                 }
-                cell->setWidth(w);
+                cell->updateWidth(w);
             }
         }
     }
@@ -297,6 +294,12 @@ void RenderTableSection::setCellWidths()
 
 int RenderTableSection::calcRowHeight()
 {
+#ifndef NDEBUG
+    setNeedsLayoutIsForbidden(true);
+#endif
+
+    ASSERT(!needsLayout());
+
     RenderTableCell* cell;
 
     int spacing = table()->vBorderSpacing();
@@ -333,19 +336,23 @@ int RenderTableSection::calcRowHeight()
                 if (!statePusher.didPush()) {
                     // Technically, we should also push state for the row, but since
                     // rows don't push a coordinate transform, that's not necessary.
-                    statePusher.push(this, IntSize(m_x, m_y));
+                    statePusher.push(this, IntSize(x(), y()));
                 }
                 cell->setOverrideSize(-1);
                 cell->setChildNeedsLayout(true, false);
                 cell->layoutIfNeeded();
             }
             
+            int adjustedPaddingTop = cell->paddingTop() - cell->intrinsicPaddingTop();
+            int adjustedPaddingBottom = cell->paddingBottom() - cell->intrinsicPaddingBottom();
+            int adjustedHeight = cell->height() - (cell->intrinsicPaddingTop() + cell->intrinsicPaddingBottom());
+        
             // Explicit heights use the border box in quirks mode.  In strict mode do the right
             // thing and actually add in the border and padding.
             ch = cell->style()->height().calcValue(0) + 
-                (cell->style()->htmlHacks() ? 0 : (cell->paddingTop() + cell->paddingBottom() +
+                (cell->style()->htmlHacks() ? 0 : (adjustedPaddingTop + adjustedPaddingBottom +
                                                    cell->borderTop() + cell->borderBottom()));
-            ch = max(ch, cell->height());
+            ch = max(ch, adjustedHeight);
 
             pos = m_rowPos[indx] + ch + (m_grid[r].rowRenderer ? spacing : 0);
 
@@ -356,8 +363,8 @@ int RenderTableSection::calcRowHeight()
             if (va == BASELINE || va == TEXT_BOTTOM || va == TEXT_TOP || va == SUPER || va == SUB) {
                 int b = cell->baselinePosition();
                 if (b > cell->borderTop() + cell->paddingTop()) {
-                    baseline = max(baseline, b);
-                    bdesc = max(bdesc, m_rowPos[indx] + ch - b);
+                    baseline = max(baseline, b - cell->intrinsicPaddingTop());
+                    bdesc = max(bdesc, m_rowPos[indx] + ch - (b - cell->intrinsicPaddingTop()));
                 }
             }
         }
@@ -372,21 +379,48 @@ int RenderTableSection::calcRowHeight()
         m_rowPos[r + 1] = max(m_rowPos[r + 1], m_rowPos[r]);
     }
 
+#ifndef NDEBUG
+    setNeedsLayoutIsForbidden(false);
+#endif
+
+    ASSERT(!needsLayout());
+
     statePusher.pop();
 
     return m_rowPos[m_gridRows];
 }
 
+void RenderTableSection::layout()
+{
+    ASSERT(needsLayout());
+
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()));
+    for (RenderObject* child = children()->firstChild(); child; child = child->nextSibling()) {
+        if (child->isTableRow()) {
+            child->layoutIfNeeded();
+            ASSERT(!child->needsLayout());
+        }
+    }
+    statePusher.pop();
+    setNeedsLayout(false);
+}
+
 int RenderTableSection::layoutRows(int toAdd)
 {
+#ifndef NDEBUG
+    setNeedsLayoutIsForbidden(true);
+#endif
+
+    ASSERT(!needsLayout());
+
     int rHeight;
     int rindx;
     int totalRows = m_gridRows;
     
     // Set the width of our section now.  The rows will also be this width.
-    m_width = table()->contentWidth();
+    setWidth(table()->contentWidth());
     m_overflowLeft = 0;
-    m_overflowWidth = m_width;
+    m_overflowWidth = width();
     m_overflowTop = 0;
     m_overflowHeight = 0;
     m_hasOverflowingCell = false;
@@ -454,13 +488,13 @@ int RenderTableSection::layoutRows(int toAdd)
     int vspacing = table()->vBorderSpacing();
     int nEffCols = table()->numEffCols();
 
-    LayoutStateMaintainer statePusher(view(), this, IntSize(m_x, m_y));
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()));
 
     for (int r = 0; r < totalRows; r++) {
         // Set the row's x/y position and width/height.
-        if (RenderObject* rowRenderer = m_grid[r].rowRenderer) {
-            rowRenderer->setPos(0, m_rowPos[r]);
-            rowRenderer->setWidth(m_width);
+        if (RenderTableRow* rowRenderer = m_grid[r].rowRenderer) {
+            rowRenderer->setLocation(0, m_rowPos[r]);
+            rowRenderer->setWidth(width());
             rowRenderer->setHeight(m_rowPos[r + 1] - m_rowPos[r] - vspacing);
         }
 
@@ -494,19 +528,40 @@ int RenderTableSection::layoutRows(int toAdd)
                 (!table()->style()->height().isAuto() && rHeight != cell->height());
 
             for (RenderObject* o = cell->firstChild(); o; o = o->nextSibling()) {
-                if (!o->isText() && o->style()->height().isPercent() && (o->isReplaced() || o->scrollsOverflow() || flexAllChildren)) {
+                if (!o->isText() && o->style()->height().isPercent() && (flexAllChildren || o->isReplaced() || (o->isBox() && toRenderBox(o)->scrollsOverflow()))) {
                     // Tables with no sections do not flex.
                     if (!o->isTable() || static_cast<RenderTable*>(o)->hasSections()) {
                         o->setNeedsLayout(true, false);
-                        cell->setChildNeedsLayout(true, false);
                         cellChildrenFlex = true;
                     }
                 }
             }
+
+            if (HashSet<RenderBox*>* percentHeightDescendants = cell->percentHeightDescendants()) {
+                HashSet<RenderBox*>::iterator end = percentHeightDescendants->end();
+                for (HashSet<RenderBox*>::iterator it = percentHeightDescendants->begin(); it != end; ++it) {
+                    RenderBox* box = *it;
+                    if (!box->isReplaced() && !box->scrollsOverflow() && !flexAllChildren)
+                        continue;
+
+                    while (box != cell) {
+                        if (box->normalChildNeedsLayout())
+                            break;
+                        box->setChildNeedsLayout(true, false);
+                        box = box->containingBlock();
+                        ASSERT(box);
+                        if (!box)
+                            break;
+                    }
+                    cellChildrenFlex = true;
+                }
+            }
+
             if (cellChildrenFlex) {
+                cell->setChildNeedsLayout(true, false);
                 // Alignment within a cell is based off the calculated
                 // height, which becomes irrelevant once the cell has
-                // been resized based off its percentage. -dwh
+                // been resized based off its percentage.
                 cell->setOverrideSize(max(0, 
                                            rHeight - cell->borderTop() - cell->paddingTop() - 
                                                      cell->borderBottom() - cell->paddingBottom()));
@@ -521,48 +576,57 @@ int RenderTableSection::layoutRows(int toAdd)
                 }
             }
             
+            int oldTe = cell->intrinsicPaddingTop();
+            int oldBe = cell->intrinsicPaddingBottom();
+            int heightWithoutIntrinsicPadding = cell->height() - oldTe - oldBe;
+            
             int te = 0;
             switch (cell->style()->verticalAlign()) {
                 case SUB:
                 case SUPER:
                 case TEXT_TOP:
                 case TEXT_BOTTOM:
-                case BASELINE:
-                    te = getBaseline(r) - cell->baselinePosition();
+                case BASELINE: {
+                    int b = cell->baselinePosition();
+                    if (b > cell->borderTop() + cell->paddingTop())
+                        te = getBaseline(r) - (b - oldTe);
                     break;
+                }
                 case TOP:
                     te = 0;
                     break;
                 case MIDDLE:
-                    te = (rHeight - cell->height()) / 2;
+                    te = (rHeight - heightWithoutIntrinsicPadding) / 2;
                     break;
                 case BOTTOM:
-                    te = rHeight - cell->height();
+                    te = rHeight - heightWithoutIntrinsicPadding;
                     break;
                 default:
                     break;
             }
-                
-            int oldTe = cell->borderTopExtra();
-            int oldBe = cell->borderBottomExtra();
-                
-            int be = rHeight - cell->height() - te;
-            cell->setCellTopExtra(te);
-            cell->setCellBottomExtra(be);
+            
+            int be = rHeight - heightWithoutIntrinsicPadding - te;
+            cell->setIntrinsicPaddingTop(te);
+            cell->setIntrinsicPaddingBottom(be);
+            if (te != oldTe || be != oldBe) {
+                cell->setNeedsLayout(true, false);
+                cell->layoutIfNeeded();
+            }
+
             if ((te != oldTe || be > oldBe) && !table()->selfNeedsLayout() && cell->checkForRepaintDuringLayout())
                 cell->repaint();
             
-            IntRect oldCellRect(cell->xPos(), cell->yPos() - cell->borderTopExtra() , cell->width(), cell->height());
+            IntRect oldCellRect(cell->x(), cell->y() , cell->width(), cell->height());
         
             if (style()->direction() == RTL) {
-                cell->setPos(table()->columnPositions()[nEffCols] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + hspacing, m_rowPos[rindx]);
+                cell->setLocation(table()->columnPositions()[nEffCols] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + hspacing, m_rowPos[rindx]);
             } else
-                cell->setPos(table()->columnPositions()[c] + hspacing, m_rowPos[rindx]);
+                cell->setLocation(table()->columnPositions()[c] + hspacing, m_rowPos[rindx]);
 
-            m_overflowLeft = min(m_overflowLeft, cell->xPos() + cell->overflowLeft(false));
-            m_overflowWidth = max(m_overflowWidth, cell->xPos() + cell->overflowWidth(false));
-            m_overflowTop = min(m_overflowTop, cell->yPos() + cell->overflowTop(false));
-            m_overflowHeight = max(m_overflowHeight, cell->yPos() + cell->overflowHeight(false));
+            m_overflowLeft = min(m_overflowLeft, cell->x() + cell->overflowLeft(false));
+            m_overflowWidth = max(m_overflowWidth, cell->x() + cell->overflowWidth(false));
+            m_overflowTop = min(m_overflowTop, cell->y() + cell->overflowTop(false));
+            m_overflowHeight = max(m_overflowHeight, cell->y() + cell->overflowHeight(false));
             m_hasOverflowingCell |= cell->overflowLeft(false) || cell->overflowWidth(false) > cell->width() || cell->overflowTop(false) || cell->overflowHeight(false) > cell->height();
 
             // If the cell moved, we have to repaint it as well as any floating/positioned
@@ -573,23 +637,31 @@ int RenderTableSection::layoutRows(int toAdd)
         }
     }
 
+#ifndef NDEBUG
+    setNeedsLayoutIsForbidden(false);
+#endif
+
+    ASSERT(!needsLayout());
+
     statePusher.pop();
 
-    m_height = m_rowPos[totalRows];
-    m_overflowHeight = max(m_overflowHeight, m_height);
-    return m_height;
+    setHeight(m_rowPos[totalRows]);
+    m_overflowHeight = max(m_overflowHeight, height());
+    return height();
 }
 
 int RenderTableSection::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int bottom = RenderContainer::lowestPosition(includeOverflowInterior, includeSelf);
+    int bottom = RenderBox::lowestPosition(includeOverflowInterior, includeSelf);
     if (!includeOverflowInterior && hasOverflowClip())
         return bottom;
 
     for (RenderObject* row = firstChild(); row; row = row->nextSibling()) {
-        for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
-            if (cell->isTableCell())
-                bottom = max(bottom, cell->yPos() + cell->lowestPosition(false));
+        for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
+            if (curr->isTableCell()) {
+                RenderTableCell* cell = static_cast<RenderTableCell*>(curr);
+                bottom = max(bottom, cell->y() + cell->lowestPosition(false));
+            }
         }
     }
     
@@ -598,14 +670,16 @@ int RenderTableSection::lowestPosition(bool includeOverflowInterior, bool includ
 
 int RenderTableSection::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int right = RenderContainer::rightmostPosition(includeOverflowInterior, includeSelf);
+    int right = RenderBox::rightmostPosition(includeOverflowInterior, includeSelf);
     if (!includeOverflowInterior && hasOverflowClip())
         return right;
 
     for (RenderObject* row = firstChild(); row; row = row->nextSibling()) {
-        for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
-            if (cell->isTableCell())
-                right = max(right, cell->xPos() + cell->rightmostPosition(false));
+        for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
+            if (curr->isTableCell()) {
+                RenderTableCell* cell = static_cast<RenderTableCell*>(curr);
+                right = max(right, cell->x() + cell->rightmostPosition(false));
+            }
         }
     }
     
@@ -614,14 +688,16 @@ int RenderTableSection::rightmostPosition(bool includeOverflowInterior, bool inc
 
 int RenderTableSection::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    int left = RenderContainer::leftmostPosition(includeOverflowInterior, includeSelf);
+    int left = RenderBox::leftmostPosition(includeOverflowInterior, includeSelf);
     if (!includeOverflowInterior && hasOverflowClip())
         return left;
     
     for (RenderObject* row = firstChild(); row; row = row->nextSibling()) {
-        for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
-            if (cell->isTableCell())
-                left = min(left, cell->xPos() + cell->leftmostPosition(false));
+        for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
+            if (curr->isTableCell()) {
+                RenderTableCell* cell = static_cast<RenderTableCell*>(curr);
+                left = min(left, cell->x() + cell->leftmostPosition(false));
+            }
         }
     }
     
@@ -837,7 +913,7 @@ void RenderTableSection::recalcOuterBorder()
     m_outerBorderRight = calcOuterBorderRight(rtl);
 }
 
-int RenderTableSection::getBaselineOfFirstLineBox() const
+int RenderTableSection::firstLineBoxBaseline() const
 {
     if (!m_gridRows)
         return -1;
@@ -851,7 +927,7 @@ int RenderTableSection::getBaselineOfFirstLineBox() const
     for (size_t i = 0; i < firstRow->size(); ++i) {
         RenderTableCell* cell = firstRow->at(i).cell;
         if (cell)
-            firstLineBaseline = max(firstLineBaseline, cell->yPos() + cell->paddingTop() + cell->borderTop() + cell->contentHeight());
+            firstLineBaseline = max(firstLineBaseline, cell->y() + cell->paddingTop() + cell->borderTop() + cell->contentHeight());
     }
 
     return firstLineBaseline;
@@ -871,11 +947,23 @@ void RenderTableSection::paint(PaintInfo& paintInfo, int tx, int ty)
     if (!totalRows || !totalCols)
         return;
 
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
+
+    PaintPhase phase = paintInfo.phase;
+    bool pushedClip = pushContentsClip(paintInfo, tx, ty);
+    paintObject(paintInfo, tx, ty);
+    if (pushedClip)
+        popContentsClip(paintInfo, phase, tx, ty);
+}
 
+void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
+{
     // Check which rows and cols are visible and only paint these.
     // FIXME: Could use a binary search here.
+    unsigned totalRows = m_gridRows;
+    unsigned totalCols = table()->columns().size();
+
     PaintPhase paintPhase = paintInfo.phase;
     int x = paintInfo.rect.x();
     int y = paintInfo.rect.y();
@@ -962,11 +1050,11 @@ void RenderTableSection::paint(PaintInfo& paintInfo, int tx, int ty)
 
                     // Paint the row next, but only if it doesn't have a layer.  If a row has a layer, it will be responsible for
                     // painting the row background for the cell.
-                    if (!row->hasLayer())
+                    if (!row->hasSelfPaintingLayer())
                         cell->paintBackgroundsBehindCell(paintInfo, tx, ty, row);
                 }
 
-                if ((!cell->hasLayer() && !row->hasLayer()) || paintInfo.phase == PaintPhaseCollapsedTableBorders)
+                if ((!cell->hasSelfPaintingLayer() && !row->hasSelfPaintingLayer()) || paintInfo.phase == PaintPhaseCollapsedTableBorders)
                     cell->paint(paintInfo, tx, ty);
             }
         }
@@ -992,11 +1080,13 @@ void RenderTableSection::recalcCells()
             m_cCol = 0;
             if (!ensureRows(m_cRow + 1))
                 break;
-            m_grid[m_cRow].rowRenderer = row;
+            
+            RenderTableRow* tableRow = static_cast<RenderTableRow*>(row);
+            m_grid[m_cRow].rowRenderer = tableRow;
 
             for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
                 if (cell->isTableCell())
-                    addCell(static_cast<RenderTableCell*>(cell), row);
+                    addCell(static_cast<RenderTableCell*>(cell), tableRow);
             }
         }
     }
@@ -1049,27 +1139,24 @@ void RenderTableSection::splitColumn(int pos, int newSize)
     }
 }
 
-RenderObject* RenderTableSection::removeChildNode(RenderObject* child, bool fullRemove)
-{
-    setNeedsCellRecalc();
-    return RenderContainer::removeChildNode(child, fullRemove);
-}
-
 // Hit Testing
-bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction action)
+bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int xPos, int yPos, int tx, int ty, HitTestAction action)
 {
     // Table sections cannot ever be hit tested.  Effectively they do not exist.
     // Just forward to our children always.
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
+
+    if (hasOverflowClip() && !overflowClipRect(tx, ty).contains(xPos, yPos))
+        return false;
 
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
         // FIXME: We have to skip over inline flows, since they can show up inside table rows
         // at the moment (a demoted inline <form> for example). If we ever implement a
         // table-specific hit-test method (which we should do for performance reasons anyway),
         // then we can remove this check.
-        if (!child->hasLayer() && !child->isInlineFlow() && child->nodeAtPoint(request, result, x, y, tx, ty, action)) {
-            updateHitTestResult(result, IntPoint(x - tx, y - ty));
+        if (child->isBox() && !toRenderBox(child)->hasSelfPaintingLayer() && child->nodeAtPoint(request, result, xPos, yPos, tx, ty, action)) {
+            updateHitTestResult(result, IntPoint(xPos - tx, yPos - ty));
             return true;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h
index 8d460cbd18..30614f0909 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h
@@ -33,23 +33,32 @@
 namespace WebCore {
 
 class RenderTableCell;
+class RenderTableRow;
 
-class RenderTableSection : public RenderContainer {
+class RenderTableSection : public RenderBox {
 public:
     RenderTableSection(Node*);
     ~RenderTableSection();
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+
     virtual const char* renderName() const { return isAnonymous() ? "RenderTableSection (anonymous)" : "RenderTableSection"; }
 
     virtual bool isTableSection() const { return true; }
 
     virtual void destroy();
 
+    virtual void layout();
+
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* oldChild);
 
-    virtual int getBaselineOfFirstLineBox() const;
+    virtual int firstLineBoxBaseline() const;
 
-    void addCell(RenderTableCell*, RenderObject* row);
+    void addCell(RenderTableCell*, RenderTableRow* row);
 
     void setCellWidths();
     int calcRowHeight();
@@ -66,7 +75,7 @@ public:
 
     struct RowStruct {
         Row* row;
-        RenderObject* rowRenderer;
+        RenderTableRow* rowRenderer;
         int baseline;
         Length height;
     };
@@ -77,9 +86,9 @@ public:
     void appendColumn(int pos);
     void splitColumn(int pos, int newSize);
 
-    virtual int overflowWidth(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? m_width : m_overflowWidth; }
+    virtual int overflowWidth(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? width() : m_overflowWidth; }
     virtual int overflowLeft(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowLeft; }
-    virtual int overflowHeight(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? m_height : m_overflowHeight; }
+    virtual int overflowHeight(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? height() : m_overflowHeight; }
     virtual int overflowTop(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowTop; }
 
     virtual int lowestPosition(bool includeOverflowInterior, bool includeSelf) const;
@@ -98,6 +107,8 @@ public:
     int outerBorderRight() const { return m_outerBorderRight; }
 
     virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paintObject(PaintInfo&, int tx, int ty);
+
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
     int numRows() const { return m_gridRows; }
@@ -118,25 +129,24 @@ public:
 
     int getBaseline(int row) { return m_grid[row].baseline; }
 
-    virtual RenderObject* removeChildNode(RenderObject*, bool fullRemove = true);
-
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
 private:
     virtual int lineHeight(bool, bool) const { return 0; }
-    virtual void position(InlineBox*) { }
 
     bool ensureRows(int);
     void clearGrid();
 
+    RenderObjectChildList m_children;
+
     Vector<RowStruct> m_grid;
-    int m_gridRows;
     Vector<int> m_rowPos;
 
+    int m_gridRows;
+
     // the current insertion position
     int m_cCol;
     int m_cRow;
-    bool m_needsCellRecalc;
 
     int m_outerBorderLeft;
     int m_outerBorderRight;
@@ -146,6 +156,8 @@ private:
     int m_overflowWidth;
     int m_overflowTop;
     int m_overflowHeight;
+
+    bool m_needsCellRecalc;
     bool m_hasOverflowingCell;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
index d7fdbb916b..ada3961d70 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
@@ -1,4 +1,4 @@
-/**
+/*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
@@ -26,6 +26,7 @@
 #include "RenderText.h"
 
 #include "CharacterNames.h"
+#include "FloatQuad.h"
 #include "FrameView.h"
 #include "InlineTextBox.h"
 #include "Range.h"
@@ -35,6 +36,7 @@
 #include "RenderView.h"
 #include "Text.h"
 #include "TextBreakIterator.h"
+#include "VisiblePosition.h"
 #include "break_lines.h"
 #include <wtf/AlwaysInline.h>
 
@@ -52,23 +54,26 @@ static inline bool charactersAreAllASCII(StringImpl* text)
 
 RenderText::RenderText(Node* node, PassRefPtr<StringImpl> str)
      : RenderObject(node)
-     , m_text(str)
+     , m_minWidth(-1)
+     , m_text(document()->displayStringModifiedByEncoding(str))
      , m_firstTextBox(0)
      , m_lastTextBox(0)
-     , m_minWidth(-1)
      , m_maxWidth(-1)
      , m_beginMinWidth(0)
      , m_endMinWidth(0)
-     , m_selectionState(SelectionNone)
      , m_hasTab(false)
      , m_linesDirty(false)
      , m_containsReversedText(false)
      , m_isAllASCII(charactersAreAllASCII(m_text.get()))
+     , m_knownNotToUseFallbackFonts(false)
 {
     ASSERT(m_text);
-    setRenderText();
-    m_text = m_text->replace('\\', backslashAsCurrencySymbol());
 
+    setIsText();
+
+    // FIXME: It would be better to call this only if !m_text->containsOnlyWhitespace().
+    // But that might slow things down, and maybe should only be done if visuallyNonEmpty
+    // is still false. Not making any change for now, but should consider in the future.
     view()->frameView()->setIsVisuallyNonEmpty();
 }
 
@@ -97,18 +102,21 @@ bool RenderText::isWordBreak() const
     return false;
 }
 
-void RenderText::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
-    RenderObject::styleDidChange(diff, oldStyle);
+    // There is no need to ever schedule repaints from a style change of a text run, since
+    // we already did this for the parent of the text run.
+    // We do have to schedule layouts, though, since a style change can force us to
+    // need to relayout.
+    if (diff == StyleDifferenceLayout) {
+        setNeedsLayoutAndPrefWidthsRecalc();
+        m_knownNotToUseFallbackFonts = false;
+    }
 
     ETextTransform oldTransform = oldStyle ? oldStyle->textTransform() : TTNONE;
     ETextSecurity oldSecurity = oldStyle ? oldStyle->textSecurity() : TSNONE;
 
-    if (oldTransform != style()->textTransform() || oldSecurity != style()->textSecurity()
-#if ENABLE(SVG)
-        || isSVGText() /* All SVG text has to be transformed */
-#endif
-       ) {
+    if (oldTransform != style()->textTransform() || oldSecurity != style()->textSecurity()) {
         if (RefPtr<StringImpl> textToTransform = originalText())
             setText(textToTransform.release(), true);
     }
@@ -198,17 +206,17 @@ void RenderText::deleteTextBoxes()
 
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
-    Node* e = element();
+    Node* e = node();
     return e ? static_cast<Text*>(e)->string() : 0;
 }
 
-void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool)
+void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        rects.append(IntRect(tx + box->xPos(), ty + box->yPos(), box->width(), box->height()));
+        rects.append(IntRect(tx + box->x(), ty + box->y(), box->width(), box->height()));
 }
 
-void RenderText::addLineBoxRects(Vector<IntRect>& rects, unsigned start, unsigned end, bool useSelectionHeight)
+void RenderText::absoluteRectsForRange(Vector<IntRect>& rects, unsigned start, unsigned end, bool useSelectionHeight)
 {
     // Work around signed/unsigned issues. This function takes unsigneds, and is often passed UINT_MAX
     // to mean "all the way to the end". InlineTextBox coordinates are unsigneds, so changing this 
@@ -220,12 +228,12 @@ void RenderText::addLineBoxRects(Vector<IntRect>& rects, unsigned start, unsigne
     start = min(start, static_cast<unsigned>(INT_MAX));
     end = min(end, static_cast<unsigned>(INT_MAX));
     
-    FloatPoint absPos = localToAbsoluteForContent(FloatPoint());
+    FloatPoint absPos = localToAbsolute(FloatPoint());
 
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
         // Note: box->end() returns the index of the last character, not the index past it
         if (start <= box->start() && box->end() < end) {
-            IntRect r = IntRect(absPos.x() + box->xPos(), absPos.y() + box->yPos(), box->width(), box->height());
+            IntRect r = IntRect(absPos.x() + box->x(), absPos.y() + box->y(), box->width(), box->height());
             if (useSelectionHeight) {
                 IntRect selectionRect = box->selectionRect(absPos.x(), absPos.y(), start, end);
                 r.setHeight(selectionRect.height());
@@ -239,7 +247,7 @@ void RenderText::addLineBoxRects(Vector<IntRect>& rects, unsigned start, unsigne
                 if (!useSelectionHeight) {
                     // change the height and y position because selectionRect uses selection-specific values
                     r.setHeight(box->height());
-                    r.setY(absPos.y() + box->yPos());
+                    r.setY(absPos.y() + box->y());
                 }
                 rects.append(r);
             }
@@ -247,13 +255,13 @@ void RenderText::addLineBoxRects(Vector<IntRect>& rects, unsigned start, unsigne
     }
 }
 
-void RenderText::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderText::absoluteQuads(Vector<FloatQuad>& quads)
 {
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        quads.append(localToAbsoluteQuad(FloatRect(box->xPos(), box->yPos(), box->width(), box->height())));
+        quads.append(localToAbsoluteQuad(FloatRect(box->x(), box->y(), box->width(), box->height())));
 }
 
-void RenderText::collectAbsoluteLineBoxQuads(Vector<FloatQuad>& quads, unsigned start, unsigned end, bool useSelectionHeight)
+void RenderText::absoluteQuadsForRange(Vector<FloatQuad>& quads, unsigned start, unsigned end, bool useSelectionHeight)
 {
     // Work around signed/unsigned issues. This function takes unsigneds, and is often passed UINT_MAX
     // to mean "all the way to the end". InlineTextBox coordinates are unsigneds, so changing this 
@@ -268,7 +276,7 @@ void RenderText::collectAbsoluteLineBoxQuads(Vector<FloatQuad>& quads, unsigned
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
         // Note: box->end() returns the index of the last character, not the index past it
         if (start <= box->start() && box->end() < end) {
-            IntRect r = IntRect(box->xPos(), box->yPos(), box->width(), box->height());
+            IntRect r = IntRect(box->x(), box->y(), box->width(), box->height());
             if (useSelectionHeight) {
                 IntRect selectionRect = box->selectionRect(0, 0, start, end);
                 r.setHeight(selectionRect.height());
@@ -282,7 +290,7 @@ void RenderText::collectAbsoluteLineBoxQuads(Vector<FloatQuad>& quads, unsigned
                 if (!useSelectionHeight) {
                     // change the height and y position because selectionRect uses selection-specific values
                     r.setHeight(box->height());
-                    r.setY(box->yPos());
+                    r.setY(box->y());
                 }
                 quads.append(localToAbsoluteQuad(FloatRect(r)));
             }
@@ -301,71 +309,71 @@ InlineTextBox* RenderText::findNextInlineTextBox(int offset, int& pos) const
         return 0;
 
     InlineTextBox* s = m_firstTextBox;
-    int off = s->m_len;
+    int off = s->len();
     while (offset > off && s->nextTextBox()) {
         s = s->nextTextBox();
-        off = s->m_start + s->m_len;
+        off = s->start() + s->len();
     }
     // we are now in the correct text run
-    pos = (offset > off ? s->m_len : s->m_len - (off - offset) );
+    pos = (offset > off ? s->len() : s->len() - (off - offset) );
     return s;
 }
 
-VisiblePosition RenderText::positionForCoordinates(int x, int y)
+VisiblePosition RenderText::positionForPoint(const IntPoint& point)
 {
     if (!firstTextBox() || textLength() == 0)
-        return VisiblePosition(element(), 0, DOWNSTREAM);
+        return createVisiblePosition(0, DOWNSTREAM);
 
     // Get the offset for the position, since this will take rtl text into account.
     int offset;
 
     // FIXME: We should be able to roll these special cases into the general cases in the loop below.
-    if (firstTextBox() && y <  firstTextBox()->root()->bottomOverflow() && x < firstTextBox()->m_x) {
+    if (firstTextBox() && point.y() <  firstTextBox()->root()->bottomOverflow() && point.x() < firstTextBox()->m_x) {
         // at the y coordinate of the first line or above
         // and the x coordinate is to the left of the first text box left edge
-        offset = firstTextBox()->offsetForPosition(x);
-        return VisiblePosition(element(), offset + firstTextBox()->m_start, DOWNSTREAM);
+        offset = firstTextBox()->offsetForPosition(point.x());
+        return createVisiblePosition(offset + firstTextBox()->start(), DOWNSTREAM);
     }
-    if (lastTextBox() && y >= lastTextBox()->root()->topOverflow() && x >= lastTextBox()->m_x + lastTextBox()->m_width) {
+    if (lastTextBox() && point.y() >= lastTextBox()->root()->topOverflow() && point.x() >= lastTextBox()->m_x + lastTextBox()->m_width) {
         // at the y coordinate of the last line or below
         // and the x coordinate is to the right of the last text box right edge
-        offset = lastTextBox()->offsetForPosition(x);
-        return VisiblePosition(element(), offset + lastTextBox()->m_start, DOWNSTREAM);
+        offset = lastTextBox()->offsetForPosition(point.x());
+        return createVisiblePosition(offset + lastTextBox()->start(), DOWNSTREAM);
     }
 
     InlineTextBox* lastBoxAbove = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
-        if (y >= box->root()->topOverflow()) {
+        if (point.y() >= box->root()->topOverflow()) {
             int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->topOverflow() : box->root()->bottomOverflow();
-            if (y < bottom) {
-                offset = box->offsetForPosition(x);
+            if (point.y() < bottom) {
+                offset = box->offsetForPosition(point.x());
 
-                if (x == box->m_x)
+                if (point.x() == box->m_x)
                     // the x coordinate is equal to the left edge of this box
                     // the affinity must be downstream so the position doesn't jump back to the previous line
-                    return VisiblePosition(element(), offset + box->m_start, DOWNSTREAM);
+                    return createVisiblePosition(offset + box->start(), DOWNSTREAM);
 
-                if (x < box->m_x + box->m_width)
+                if (point.x() < box->m_x + box->m_width)
                     // and the x coordinate is to the left of the right edge of this box
                     // check to see if position goes in this box
-                    return VisiblePosition(element(), offset + box->m_start, offset > 0 ? VP_UPSTREAM_IF_POSSIBLE : DOWNSTREAM);
+                    return createVisiblePosition(offset + box->start(), offset > 0 ? VP_UPSTREAM_IF_POSSIBLE : DOWNSTREAM);
 
-                if (!box->prevOnLine() && x < box->m_x)
+                if (!box->prevOnLine() && point.x() < box->m_x)
                     // box is first on line
                     // and the x coordinate is to the left of the first text box left edge
-                    return VisiblePosition(element(), offset + box->m_start, DOWNSTREAM);
+                    return createVisiblePosition(offset + box->start(), DOWNSTREAM);
 
                 if (!box->nextOnLine())
                     // box is last on line
                     // and the x coordinate is to the right of the last text box right edge
                     // generate VisiblePosition, use UPSTREAM affinity if possible
-                    return VisiblePosition(element(), offset + box->m_start, offset > 0 ? VP_UPSTREAM_IF_POSSIBLE : DOWNSTREAM);
+                    return createVisiblePosition(offset + box->start(), offset > 0 ? VP_UPSTREAM_IF_POSSIBLE : DOWNSTREAM);
             }
             lastBoxAbove = box;
         }
     }
 
-    return VisiblePosition(element(), lastBoxAbove ? lastBoxAbove->m_start + lastBoxAbove->m_len : 0, DOWNSTREAM);
+    return createVisiblePosition(lastBoxAbove ? lastBoxAbove->start() + lastBoxAbove->len() : 0, DOWNSTREAM);
 }
 
 IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* extraWidthToEndOfLine)
@@ -384,7 +392,13 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
     int left = box->positionForOffset(caretOffset);
 
-    int rootLeft = box->root()->xPos();
+    // Distribute the caret's width to either side of the offset.
+    int caretWidthLeftOfOffset = caretWidth / 2;
+    left -= caretWidthLeftOfOffset;
+    int caretWidthRightOfOffset = caretWidth - caretWidthLeftOfOffset;
+
+    int rootLeft = box->root()->x();
+    int rootRight = rootLeft + box->root()->width();
     // FIXME: should we use the width of the root inline box or the
     // width of the containing block for this?
     if (extraWidthToEndOfLine)
@@ -392,18 +406,28 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
     RenderBlock* cb = containingBlock();
     if (style()->autoWrap()) {
-        int availableWidth = cb->lineWidth(top);
+        int availableWidth = cb->lineWidth(top, false);
         if (box->direction() == LTR)
-            left = min(left, rootLeft + availableWidth - 1);
+            left = min(left, rootLeft + availableWidth - caretWidthRightOfOffset);
         else
+            left = max(left, cb->x());
+    } else {
+        // If there is no wrapping, the caret can leave its containing block, but not its root line box.
+        if (cb->style()->direction() == LTR) {
+            int rightEdge = max(cb->width(), rootRight);
+            left = min(left, rightEdge - caretWidthRightOfOffset);
             left = max(left, rootLeft);
+        } else {
+            int leftEdge = min(cb->x(), rootLeft);
+            left = max(left, leftEdge);
+            left = min(left, rootRight - caretWidth);
+        }
     }
 
-    const int caretWidth = 1;
     return IntRect(left, top, caretWidth, height);
 }
 
-ALWAYS_INLINE int RenderText::widthFromCache(const Font& f, int start, int len, int xPos) const
+ALWAYS_INLINE int RenderText::widthFromCache(const Font& f, int start, int len, int xPos, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
     if (f.isFixedPitch() && !f.isSmallCaps() && m_isAllASCII) {
         int monospaceCharacterWidth = f.spaceWidth();
@@ -433,7 +457,7 @@ ALWAYS_INLINE int RenderText::widthFromCache(const Font& f, int start, int len,
         return w;
     }
 
-    return f.width(TextRun(text()->characters() + start, len, allowTabs(), xPos));
+    return f.width(TextRun(text()->characters() + start, len, allowTabs(), xPos), fallbackFonts);
 }
 
 void RenderText::trimmedPrefWidths(int leadWidth,
@@ -502,7 +526,7 @@ void RenderText::trimmedPrefWidths(int leadWidth,
                 linelen++;
 
             if (linelen) {
-                endMaxW = widthFromCache(f, i, linelen, leadWidth + endMaxW);
+                endMaxW = widthFromCache(f, i, linelen, leadWidth + endMaxW, 0);
                 if (firstLine) {
                     firstLine = false;
                     leadWidth = 0;
@@ -546,7 +570,15 @@ int RenderText::maxPrefWidth() const
 
 void RenderText::calcPrefWidths(int leadWidth)
 {
-    ASSERT(m_hasTab || prefWidthsDirty());
+    HashSet<const SimpleFontData*> fallbackFonts;
+    calcPrefWidths(leadWidth, fallbackFonts);
+    if (fallbackFonts.isEmpty())
+        m_knownNotToUseFallbackFonts = true;
+}
+
+void RenderText::calcPrefWidths(int leadWidth, HashSet<const SimpleFontData*>& fallbackFonts)
+{
+    ASSERT(m_hasTab || prefWidthsDirty() || !m_knownNotToUseFallbackFonts);
 
     m_minWidth = 0;
     m_beginMinWidth = 0;
@@ -618,7 +650,7 @@ void RenderText::calcPrefWidths(int leadWidth)
             lastWordBoundary++;
             continue;
         } else if (c == softHyphen) {
-            currMaxWidth += widthFromCache(f, lastWordBoundary, i - lastWordBoundary, leadWidth + currMaxWidth);
+            currMaxWidth += widthFromCache(f, lastWordBoundary, i - lastWordBoundary, leadWidth + currMaxWidth, &fallbackFonts);
             lastWordBoundary = i + 1;
             continue;
         }
@@ -641,13 +673,13 @@ void RenderText::calcPrefWidths(int leadWidth)
 
         int wordLen = j - i;
         if (wordLen) {
-            int w = widthFromCache(f, i, wordLen, leadWidth + currMaxWidth);
+            int w = widthFromCache(f, i, wordLen, leadWidth + currMaxWidth, &fallbackFonts);
             currMinWidth += w;
             if (betweenWords) {
                 if (lastWordBoundary == i)
                     currMaxWidth += w;
                 else
-                    currMaxWidth += widthFromCache(f, lastWordBoundary, j - lastWordBoundary, leadWidth + currMaxWidth);
+                    currMaxWidth += widthFromCache(f, lastWordBoundary, j - lastWordBoundary, leadWidth + currMaxWidth, &fallbackFonts);
                 lastWordBoundary = j;
             }
 
@@ -707,7 +739,7 @@ void RenderText::calcPrefWidths(int leadWidth)
         }
     }
 
-    if (needsWordSpacing && len > 1 || ignoringSpaces && !firstWord)
+    if ((needsWordSpacing && len > 1) || (ignoringSpaces && !firstWord))
         currMaxWidth += wordSpacing;
 
     m_minWidth = max(currMinWidth, m_minWidth);
@@ -734,33 +766,26 @@ bool RenderText::containsOnlyWhitespace(unsigned from, unsigned len) const
     return currPos >= (from + len);
 }
 
-int RenderText::minXPos() const
+IntPoint RenderText::firstRunOrigin() const
 {
-    if (!m_firstTextBox)
-        return 0;
-
-    // FIXME: we should not use an arbitrary value like this.  Perhaps we should use INT_MAX.
-    int minXPos = 6666666;
-    for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        minXPos = min(minXPos, static_cast<int>(box->m_x));
-    return minXPos;
+    return IntPoint(firstRunX(), firstRunY());
 }
 
-int RenderText::xPos() const
+int RenderText::firstRunX() const
 {
     return m_firstTextBox ? m_firstTextBox->m_x : 0;
 }
 
-int RenderText::yPos() const
+int RenderText::firstRunY() const
 {
     return m_firstTextBox ? m_firstTextBox->m_y : 0;
 }
-
+    
 void RenderText::setSelectionState(SelectionState state)
 {
     InlineTextBox* box;
 
-    m_selectionState = state;
+    RenderObject::setSelectionState(state);
     if (state == SelectionStart || state == SelectionEnd || state == SelectionBoth) {
         int startPos, endPos;
         selectionStartEnd(startPos, endPos);
@@ -846,6 +871,11 @@ void RenderText::setTextWithOffset(PassRefPtr<StringImpl> text, unsigned offset,
         RootInlineBox* prev = firstRootBox->prevRootBox();
         if (prev)
             firstRootBox = prev;
+    } else if (lastTextBox()) {
+        ASSERT(!lastRootBox);
+        firstRootBox = lastTextBox()->root();
+        firstRootBox->markDirty();
+        dirtiedLines = true;
     }
     for (RootInlineBox* curr = firstRootBox; curr && curr != lastRootBox; curr = curr->nextRootBox()) {
         if (curr->lineBreakObj() == this && curr->lineBreakPos() > end)
@@ -864,11 +894,11 @@ void RenderText::setTextWithOffset(PassRefPtr<StringImpl> text, unsigned offset,
 
 static inline bool isInlineFlowOrEmptyText(RenderObject* o)
 {
-    if (o->isInlineFlow())
+    if (o->isRenderInline())
         return true;
     if (!o->isText())
         return false;
-    StringImpl* text = static_cast<RenderText*>(o)->text();
+    StringImpl* text = toRenderText(o)->text();
     if (!text)
         return true;
     return !text->length();
@@ -883,18 +913,17 @@ UChar RenderText::previousCharacter()
             break;
     UChar prev = ' ';
     if (previousText && previousText->isText())
-        if (StringImpl* previousString = static_cast<RenderText*>(previousText)->text())
+        if (StringImpl* previousString = toRenderText(previousText)->text())
             prev = (*previousString)[previousString->length() - 1];
     return prev;
 }
 
 void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
 {
-    m_text = text;
+    ASSERT(text);
+    m_text = document()->displayStringModifiedByEncoding(text);
     ASSERT(m_text);
 
-    m_text = m_text->replace('\\', backslashAsCurrencySymbol());
-
 #if ENABLE(SVG)
     if (isSVGText()) {
         if (style() && style()->whiteSpace() == PRE) {
@@ -971,14 +1000,7 @@ void RenderText::setText(PassRefPtr<StringImpl> text, bool force)
 
     setTextInternal(text);
     setNeedsLayoutAndPrefWidthsRecalc();
-}
-
-int RenderText::height() const
-{
-    int retval = 0;
-    if (firstTextBox())
-        retval = lastTextBox()->m_y + lastTextBox()->height() - firstTextBox()->m_y;
-    return retval;
+    m_knownNotToUseFallbackFonts = false;
 }
 
 int RenderText::lineHeight(bool firstLine, bool) const
@@ -987,7 +1009,7 @@ int RenderText::lineHeight(bool firstLine, bool) const
     return parent()->lineHeight(firstLine, true);
 }
 
-void RenderText::dirtyLineBoxes(bool fullLayout, bool)
+void RenderText::dirtyLineBoxes(bool fullLayout)
 {
     if (fullLayout)
         deleteTextBoxes();
@@ -998,15 +1020,14 @@ void RenderText::dirtyLineBoxes(bool fullLayout, bool)
     m_linesDirty = false;
 }
 
-InlineTextBox* RenderText::createInlineTextBox()
+InlineTextBox* RenderText::createTextBox()
 {
     return new (renderArena()) InlineTextBox(this);
 }
 
-InlineBox* RenderText::createInlineBox(bool, bool isRootLineBox, bool)
+InlineTextBox* RenderText::createInlineTextBox()
 {
-    ASSERT(!isRootLineBox);
-    InlineTextBox* textBox = createInlineTextBox();
+    InlineTextBox* textBox = createTextBox();
     if (!m_firstTextBox)
         m_firstTextBox = m_lastTextBox = textBox;
     else {
@@ -1014,15 +1035,16 @@ InlineBox* RenderText::createInlineBox(bool, bool isRootLineBox, bool)
         textBox->setPreviousLineBox(m_lastTextBox);
         m_lastTextBox = textBox;
     }
+    textBox->setIsText(true);
     return textBox;
 }
 
-void RenderText::position(InlineBox* box)
+void RenderText::positionLineBox(InlineBox* box)
 {
     InlineTextBox* s = static_cast<InlineTextBox*>(box);
 
     // FIXME: should not be needed!!!
-    if (!s->m_len) {
+    if (!s->len()) {
         // We want the box to be destroyed.
         s->remove();
         s->destroy(renderArena());
@@ -1033,7 +1055,7 @@ void RenderText::position(InlineBox* box)
     m_containsReversedText |= s->direction() == RTL;
 }
 
-unsigned int RenderText::width(unsigned int from, unsigned int len, int xPos, bool firstLine) const
+unsigned RenderText::width(unsigned from, unsigned len, int xPos, bool firstLine, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
     if (from >= textLength())
         return 0;
@@ -1041,61 +1063,74 @@ unsigned int RenderText::width(unsigned int from, unsigned int len, int xPos, bo
     if (from + len > textLength())
         len = textLength() - from;
 
-    return width(from, len, style(firstLine)->font(), xPos);
+    return width(from, len, style(firstLine)->font(), xPos, fallbackFonts);
 }
 
-unsigned int RenderText::width(unsigned int from, unsigned int len, const Font& f, int xPos) const
+unsigned RenderText::width(unsigned from, unsigned len, const Font& f, int xPos, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
-    if (!characters() || from > textLength())
+    ASSERT(from + len <= textLength());
+    if (!characters())
         return 0;
 
-    if (from + len > textLength())
-        len = textLength() - from;
-
     int w;
     if (&f == &style()->font()) {
-        if (!style()->preserveNewline() && !from && len == textLength())
-            w = maxPrefWidth();
-        else
-            w = widthFromCache(f, from, len, xPos);
+        if (!style()->preserveNewline() && !from && len == textLength()) {
+            if (fallbackFonts) {
+                if (prefWidthsDirty() || !m_knownNotToUseFallbackFonts) {
+                    const_cast<RenderText*>(this)->calcPrefWidths(0, *fallbackFonts);
+                    if (fallbackFonts->isEmpty())
+                        m_knownNotToUseFallbackFonts = true;
+                }
+                w = m_maxWidth;
+            } else
+                w = maxPrefWidth();
+        } else
+            w = widthFromCache(f, from, len, xPos, fallbackFonts);
     } else
-        w = f.width(TextRun(text()->characters() + from, len, allowTabs(), xPos));
+        w = f.width(TextRun(text()->characters() + from, len, allowTabs(), xPos), fallbackFonts);
 
     return w;
 }
 
-int RenderText::width() const
+IntRect RenderText::linesBoundingBox() const
 {
-    // FIXME: we should not use an arbitrary value like this.  Perhaps we should use INT_MAX.
-    int minx = 100000000;
-    int maxx = 0;
-    // slooow
-    for (InlineTextBox* s = firstTextBox(); s; s = s->nextTextBox()) {
-        if (s->m_x < minx)
-            minx = s->m_x;
-        if (s->m_x + s->m_width > maxx)
-            maxx = s->m_x + s->m_width;
+    IntRect result;
+    
+    ASSERT(!firstTextBox() == !lastTextBox());  // Either both are null or both exist.
+    if (firstTextBox() && lastTextBox()) {
+        // Return the width of the minimal left side and the maximal right side.
+        int leftSide = 0;
+        int rightSide = 0;
+        for (InlineTextBox* curr = firstTextBox(); curr; curr = curr->nextTextBox()) {
+            if (curr == firstTextBox() || curr->x() < leftSide)
+                leftSide = curr->x();
+            if (curr == firstTextBox() || curr->x() + curr->width() > rightSide)
+                rightSide = curr->x() + curr->width();
+        }
+        result.setWidth(rightSide - leftSide);
+        result.setX(leftSide);
+        result.setHeight(lastTextBox()->y() + lastTextBox()->height() - firstTextBox()->y());
+        result.setY(firstTextBox()->y());
     }
 
-    return max(0, maxx - minx);
+    return result;
 }
 
-IntRect RenderText::absoluteClippedOverflowRect()
+IntRect RenderText::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     RenderObject* cb = containingBlock();
-    return cb->absoluteClippedOverflowRect();
+    return cb->clippedOverflowRectForRepaint(repaintContainer);
 }
 
-IntRect RenderText::selectionRect(bool clipToVisibleContent)
+IntRect RenderText::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent)
 {
     ASSERT(!needsLayout());
 
-    IntRect rect;
     if (selectionState() == SelectionNone)
-        return rect;
+        return IntRect();
     RenderBlock* cb =  containingBlock();
     if (!cb)
-        return rect;
+        return IntRect();
 
     // Now calculate startPos and endPos for painting selection.
     // We include a selection while endPos > 0
@@ -1113,39 +1148,32 @@ IntRect RenderText::selectionRect(bool clipToVisibleContent)
     }
 
     if (startPos == endPos)
-        return rect;
+        return IntRect();
 
+    IntRect rect;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
         rect.unite(box->selectionRect(0, 0, startPos, endPos));
 
     if (clipToVisibleContent)
-        computeAbsoluteRepaintRect(rect);
+        computeRectForRepaint(repaintContainer, rect);
     else {
         if (cb->hasColumns())
             cb->adjustRectForColumns(rect);
-        // FIXME: This doesn't work correctly with transforms.
-        FloatPoint absPos = localToAbsolute();
-        rect.move(absPos.x(), absPos.y());
+
+        rect = localToContainerQuad(FloatRect(rect), repaintContainer).enclosingBoundingBox();
     }
 
     return rect;
 }
 
-int RenderText::verticalPositionHint(bool firstLine) const
-{
-    if (parent()->isReplaced())
-        return 0; // Treat inline blocks just like blocks.  There can't be any vertical position hint.
-    return parent()->verticalPositionHint(firstLine);
-}
-
 int RenderText::caretMinOffset() const
 {
     InlineTextBox* box = firstTextBox();
     if (!box)
         return 0;
-    int minOffset = box->m_start;
+    int minOffset = box->start();
     for (box = box->nextTextBox(); box; box = box->nextTextBox())
-        minOffset = min(minOffset, box->m_start);
+        minOffset = min<int>(minOffset, box->start());
     return minOffset;
 }
 
@@ -1154,9 +1182,9 @@ int RenderText::caretMaxOffset() const
     InlineTextBox* box = lastTextBox();
     if (!box)
         return textLength();
-    int maxOffset = box->m_start + box->m_len;
+    int maxOffset = box->start() + box->len();
     for (box = box->prevTextBox(); box; box = box->prevTextBox())
-        maxOffset = max(maxOffset, box->m_start + box->m_len);
+        maxOffset = max<int>(maxOffset, box->start() + box->len());
     return maxOffset;
 }
 
@@ -1164,14 +1192,14 @@ unsigned RenderText::caretMaxRenderedOffset() const
 {
     int l = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        l += box->m_len;
+        l += box->len();
     return l;
 }
 
 int RenderText::previousOffset(int current) const
 {
     StringImpl* si = m_text.get();
-    TextBreakIterator* iterator = characterBreakIterator(si->characters(), si->length());
+    TextBreakIterator* iterator = cursorMovementIterator(si->characters(), si->length());
     if (!iterator)
         return current - 1;
 
@@ -1179,13 +1207,122 @@ int RenderText::previousOffset(int current) const
     if (result == TextBreakDone)
         result = current - 1;
 
+#ifdef BUILDING_ON_TIGER
+    // ICU 3.2 allows character breaks before a half-width Katakana voiced mark.
+    if (static_cast<unsigned>(result) < si->length()) {
+        UChar character = (*si)[result];
+        if (character == 0xFF9E || character == 0xFF9F)
+            --result;
+    }
+#endif
+
     return result;
 }
 
+#define HANGUL_CHOSEONG_START (0x1100)
+#define HANGUL_CHOSEONG_END (0x115F)
+#define HANGUL_JUNGSEONG_START (0x1160)
+#define HANGUL_JUNGSEONG_END (0x11A2)
+#define HANGUL_JONGSEONG_START (0x11A8)
+#define HANGUL_JONGSEONG_END (0x11F9)
+#define HANGUL_SYLLABLE_START (0xAC00)
+#define HANGUL_SYLLABLE_END (0xD7AF)
+#define HANGUL_JONGSEONG_COUNT (28)
+
+enum HangulState {
+    HangulStateL,
+    HangulStateV,
+    HangulStateT,
+    HangulStateLV,
+    HangulStateLVT,
+    HangulStateBreak
+};
+
+inline bool isHangulLVT(UChar32 character)
+{
+    return (character - HANGUL_SYLLABLE_START) % HANGUL_JONGSEONG_COUNT;
+}
+
+int RenderText::previousOffsetForBackwardDeletion(int current) const
+{
+#if PLATFORM(MAC)
+    UChar32 character;
+    while (current > 0) {
+        if (U16_IS_TRAIL((*m_text)[--current]))
+            --current;
+        if (current < 0)
+            break;
+
+        UChar32 character = m_text->characterStartingAt(current);
+
+        // We don't combine characters in Armenian ... Limbu range for backward deletion.
+        if ((character >= 0x0530) && (character < 0x1950))
+            break;
+
+        if (u_isbase(character) && (character != 0xFF9E) && (character != 0xFF9F))
+            break;
+    }
+
+    if (current <= 0)
+        return current;
+
+    // Hangul
+    character = m_text->characterStartingAt(current);
+    if (((character >= HANGUL_CHOSEONG_START) && (character <= HANGUL_JONGSEONG_END)) || ((character >= HANGUL_SYLLABLE_START) && (character <= HANGUL_SYLLABLE_END))) {
+        HangulState state;
+        HangulState initialState;
+
+        if (character < HANGUL_JUNGSEONG_START)
+            state = HangulStateL;
+        else if (character < HANGUL_JONGSEONG_START)
+            state = HangulStateV;
+        else if (character < HANGUL_SYLLABLE_START)
+            state = HangulStateT;
+        else
+            state = isHangulLVT(character) ? HangulStateLVT : HangulStateLV;
+
+        initialState = state;
+
+        while (current > 0 && ((character = m_text->characterStartingAt(current - 1)) >= HANGUL_CHOSEONG_START) && (character <= HANGUL_SYLLABLE_END) && ((character <= HANGUL_JONGSEONG_END) || (character >= HANGUL_SYLLABLE_START))) {
+            switch (state) {
+            case HangulStateV:
+                if (character <= HANGUL_CHOSEONG_END)
+                    state = HangulStateL;
+                else if ((character >= HANGUL_SYLLABLE_START) && (character <= HANGUL_SYLLABLE_END) && !isHangulLVT(character))
+                    state = HangulStateLV;
+                else if (character > HANGUL_JUNGSEONG_END)
+                    state = HangulStateBreak;
+                break;
+            case HangulStateT:
+                if ((character >= HANGUL_JUNGSEONG_START) && (character <= HANGUL_JUNGSEONG_END))
+                    state = HangulStateV;
+                else if ((character >= HANGUL_SYLLABLE_START) && (character <= HANGUL_SYLLABLE_END))
+                    state = (isHangulLVT(character) ? HangulStateLVT : HangulStateLV);
+                else if (character < HANGUL_JUNGSEONG_START)
+                    state = HangulStateBreak;
+                break;
+            default:
+                state = (character < HANGUL_JUNGSEONG_START) ? HangulStateL : HangulStateBreak;
+                break;
+            }
+            if (state == HangulStateBreak)
+                break;
+
+            --current;
+        }
+    }
+
+    return current;
+#else
+    // Platforms other than Mac delete by one code point.
+    return current - 1;
+#endif
+}
+
 int RenderText::nextOffset(int current) const
 {
     StringImpl* si = m_text.get();
-    TextBreakIterator* iterator = characterBreakIterator(si->characters(), si->length());
+    TextBreakIterator* iterator = cursorMovementIterator(si->characters(), si->length());
     if (!iterator)
         return current + 1;
 
@@ -1193,6 +1330,15 @@ int RenderText::nextOffset(int current) const
     if (result == TextBreakDone)
         result = current + 1;
 
+#ifdef BUILDING_ON_TIGER
+    // ICU 3.2 allows character breaks before a half-width Katakana voiced mark.
+    if (static_cast<unsigned>(result) < si->length()) {
+        UChar character = (*si)[result];
+        if (character == 0xFF9E || character == 0xFF9F)
+            ++result;
+    }
+#endif
+
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.h b/src/3rdparty/webkit/WebCore/rendering/RenderText.h
index 4c6263819a..2e04a9e92b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.h
@@ -1,7 +1,7 @@
 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -52,26 +52,23 @@ public:
 
     StringImpl* text() const { return m_text.get(); }
 
-    virtual InlineBox* createInlineBox(bool makePlaceHolderBox, bool isRootLineBox, bool isOnlyRun = false);
-    virtual InlineTextBox* createInlineTextBox();
-    virtual void dirtyLineBoxes(bool fullLayout, bool isRootInlineBox = false);
+    InlineTextBox* createInlineTextBox();
+    void dirtyLineBoxes(bool fullLayout);
 
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void addLineBoxRects(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    void absoluteRectsForRange(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
 
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
-    virtual void collectAbsoluteLineBoxQuads(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+    void absoluteQuadsForRange(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
 
-    virtual VisiblePosition positionForCoordinates(int x, int y);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
 
     const UChar* characters() const { return m_text->characters(); }
     unsigned textLength() const { return m_text->length(); } // non virtual implementation of length()
-    virtual void position(InlineBox*);
+    void positionLineBox(InlineBox*);
 
-    virtual unsigned width(unsigned from, unsigned len, const Font&, int xPos) const;
-    virtual unsigned width(unsigned from, unsigned len, int xPos, bool firstLine = false) const;
-    virtual int width() const;
-    virtual int height() const;
+    virtual unsigned width(unsigned from, unsigned len, const Font&, int xPos, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
+    virtual unsigned width(unsigned from, unsigned len, int xPos, bool firstLine = false, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
 
     virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
 
@@ -85,28 +82,24 @@ public:
                            int& beginMaxW, int& endMaxW,
                            int& minW, int& maxW, bool& stripFrontSpaces);
 
-    // returns the minimum x position of all runs relative to the parent.
-    // defaults to 0.
-    int minXPos() const;
+    IntRect linesBoundingBox() const;
 
-    virtual int xPos() const;
-    virtual int yPos() const;
-
-    virtual int verticalPositionHint(bool firstLine) const;
+    IntPoint firstRunOrigin() const;
+    int firstRunX() const;
+    int firstRunY() const;
 
     void setText(PassRefPtr<StringImpl>, bool force = false);
     void setTextWithOffset(PassRefPtr<StringImpl>, unsigned offset, unsigned len, bool force = false);
 
     virtual bool canBeSelectionLeaf() const { return true; }
-    virtual SelectionState selectionState() const { return static_cast<SelectionState>(m_selectionState); }
     virtual void setSelectionState(SelectionState s);
-    virtual IntRect selectionRect(bool clipToVisibleContent = true);
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
 
     virtual int marginLeft() const { return style()->marginLeft().calcMinValue(0); }
     virtual int marginRight() const { return style()->marginRight().calcMinValue(0); }
 
-    virtual IntRect absoluteClippedOverflowRect();
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
 
     InlineTextBox* firstTextBox() const { return m_firstTextBox; }
     InlineTextBox* lastTextBox() const { return m_lastTextBox; }
@@ -116,6 +109,7 @@ public:
     virtual unsigned caretMaxRenderedOffset() const;
 
     virtual int previousOffset(int current) const;
+    virtual int previousOffsetForBackwardDeletion(int current) const;
     virtual int nextOffset(int current) const;
 
     bool containsReversedText() const { return m_containsReversedText; }
@@ -126,14 +120,20 @@ public:
 
     void checkConsistency() const;
 
+    virtual void calcPrefWidths(int leadWidth);
+
 protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleWillChange(StyleDifference, const RenderStyle*) { }
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual void setTextInternal(PassRefPtr<StringImpl>);
-    virtual void calcPrefWidths(int leadWidth);
     virtual UChar previousCharacter();
+    
+    virtual InlineTextBox* createTextBox(); // Subclassed by SVG.
 
 private:
+    void calcPrefWidths(int leadWidth, HashSet<const SimpleFontData*>& fallbackFonts);
+
     // Make length() private so that callers that have a RenderText*
     // will use the more efficient textLength() instead, while
     // callers with a RenderObject* can continue to use length().
@@ -145,20 +145,20 @@ private:
 
     void deleteTextBoxes();
     bool containsOnlyWhitespace(unsigned from, unsigned len) const;
-    int widthFromCache(const Font&, int start, int len, int xPos) const;
+    int widthFromCache(const Font&, int start, int len, int xPos, HashSet<const SimpleFontData*>* fallbackFonts) const;
     bool isAllASCII() const { return m_isAllASCII; }
 
+    int m_minWidth; // here to minimize padding in 64-bit.
+
     RefPtr<StringImpl> m_text;
 
     InlineTextBox* m_firstTextBox;
     InlineTextBox* m_lastTextBox;
 
-    int m_minWidth;
     int m_maxWidth;
     int m_beginMinWidth;
     int m_endMinWidth;
 
-    unsigned m_selectionState : 3; // enums on Windows are signed, so this needs to be unsigned to prevent it turning negative. 
     bool m_hasBreakableChar : 1; // Whether or not we can be broken into multiple lines.
     bool m_hasBreak : 1; // Whether or not we have a hard break (e.g., <pre> with '\n').
     bool m_hasTab : 1; // Whether or not we have a variable width tab character (e.g., <pre> with '\t').
@@ -170,8 +170,24 @@ private:
                            // or removed).
     bool m_containsReversedText : 1;
     bool m_isAllASCII : 1;
+    mutable bool m_knownNotToUseFallbackFonts : 1;
 };
 
+inline RenderText* toRenderText(RenderObject* o)
+{ 
+    ASSERT(!o || o->isText());
+    return static_cast<RenderText*>(o);
+}
+
+inline const RenderText* toRenderText(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isText());
+    return static_cast<const RenderText*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderText(const RenderText*);
+
 #ifdef NDEBUG
 inline void RenderText::checkConsistency() const
 {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
index 8f853f8dac..ea6f8b128a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
@@ -22,19 +22,21 @@
 #include "config.h"
 #include "RenderTextControl.h"
 
+#include "AXObjectCache.h"
 #include "CharacterNames.h"
 #include "Editor.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "HTMLBRElement.h"
-#include "HTMLFormControlElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
+#include "RenderLayer.h"
+#include "RenderText.h"
 #include "ScrollbarTheme.h"
 #include "SelectionController.h"
-#include "TextControlInnerElements.h"
 #include "Text.h"
+#include "TextControlInnerElements.h"
 #include "TextIterator.h"
 
 using namespace std;
@@ -79,12 +81,12 @@ RenderTextControl::~RenderTextControl()
         m_innerText->detach();
 }
 
-void RenderTextControl::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderTextControl::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
     if (m_innerText) {
-        RenderBlock* textBlockRenderer = static_cast<RenderBlock*>(m_innerText->renderer());
+        RenderBlock* textBlockRenderer = toRenderBlock(m_innerText->renderer());
         RefPtr<RenderStyle> textBlockStyle = createInnerTextStyle(style());
         // We may have set the width and the height in the old style in layout().
         // Reset them now to avoid getting a spurious layout hint.
@@ -97,18 +99,32 @@ void RenderTextControl::styleDidChange(RenderStyle::Diff diff, const RenderStyle
         }
     }
 
-    setHasOverflowClip(false);
     setReplaced(isInline());
 }
 
+static inline bool updateUserModifyProperty(Node* node, RenderStyle* style)
+{
+    bool isEnabled = true;
+    bool isReadOnlyControl = false;
+
+    if (node->isElementNode()) {
+        Element* element = static_cast<Element*>(node);
+        isEnabled = element->isEnabledFormControl();
+        isReadOnlyControl = element->isReadOnlyFormControl();
+    }
+
+    style->setUserModify((isReadOnlyControl || !isEnabled) ? READ_ONLY : READ_WRITE_PLAINTEXT_ONLY);
+    return !isEnabled;
+}
+
 void RenderTextControl::adjustInnerTextStyle(const RenderStyle* startStyle, RenderStyle* textBlockStyle) const
 {
     // The inner block, if present, always has its direction set to LTR,
     // so we need to inherit the direction from the element.
     textBlockStyle->setDirection(style()->direction());
-    textBlockStyle->setUserModify((node()->isReadOnlyControl() || !node()->isEnabled()) ? READ_ONLY : READ_WRITE_PLAINTEXT_ONLY);
 
-    if (!node()->isEnabled())
+    bool disabled = updateUserModifyProperty(node(), textBlockStyle);
+    if (disabled)
         textBlockStyle->setColor(disabledTextColor(textBlockStyle->color(), startStyle->backgroundColor()));
 }
 
@@ -126,18 +142,18 @@ void RenderTextControl::createSubtreeIfNeeded(TextControlInnerElement* innerBloc
 
 int RenderTextControl::textBlockHeight() const
 {
-    return m_height - paddingTop() - paddingBottom() - borderTop() - borderBottom();
+    return height() - paddingTop() - paddingBottom() - borderTop() - borderBottom();
 }
 
 int RenderTextControl::textBlockWidth() const
 {
-    return m_width - paddingLeft() - paddingRight() - borderLeft() - borderRight()
-           - m_innerText->renderer()->paddingLeft() - m_innerText->renderer()->paddingRight();
+    return width() - paddingLeft() - paddingRight() - borderLeft() - borderRight()
+           - m_innerText->renderBox()->paddingLeft() - m_innerText->renderBox()->paddingRight();
 }
 
 void RenderTextControl::updateFromElement()
 {
-    m_innerText->renderer()->style()->setUserModify((node()->isReadOnlyControl() || !node()->isEnabled()) ? READ_ONLY : READ_WRITE_PLAINTEXT_ONLY); 
+    updateUserModifyProperty(node(), m_innerText->renderer()->style());
 }
 
 void RenderTextControl::setInnerTextValue(const String& innerTextValue)
@@ -148,13 +164,17 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
         value = "";
     else {
         value = innerTextValue; 
-        value = value.replace('\\', backslashAsCurrencySymbol());
+        value = document()->displayStringModifiedByEncoding(value);
     }
 
     if (value != text() || !m_innerText->hasChildNodes()) {
         if (value != text()) {
-            if (Frame* frame = document()->frame())
+            if (Frame* frame = document()->frame()) {
                 frame->editor()->clearUndoRedoOperations();
+                
+                if (AXObjectCache::accessibilityEnabled())
+                    document()->axObjectCache()->postNotification(this, "AXValueChanged", false);
+            }
         }
 
         ExceptionCode ec = 0;
@@ -170,7 +190,7 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
         m_userEdited = false;
     }
 
-    formControlElement()->setValueMatchesRenderer();
+    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(true);
 }
 
 void RenderTextControl::setUserEdited(bool isUserEdited)
@@ -217,7 +237,7 @@ void RenderTextControl::setSelectionRange(int start, int end)
 
     document()->updateLayout();
 
-    if (style()->visibility() == HIDDEN || !m_innerText || !m_innerText->renderer() || !m_innerText->renderer()->height()) {
+    if (style()->visibility() == HIDDEN || !m_innerText || !m_innerText->renderer() || !m_innerText->renderBox()->height()) {
         cacheSelection(start, end);
         return;
     }
@@ -231,7 +251,7 @@ void RenderTextControl::setSelectionRange(int start, int end)
     ASSERT(startPosition.isNotNull() && endPosition.isNotNull());
     ASSERT(startPosition.deepEquivalent().node()->shadowAncestorNode() == node() && endPosition.deepEquivalent().node()->shadowAncestorNode() == node());
 
-    Selection newSelection = Selection(startPosition, endPosition);
+    VisibleSelection newSelection = VisibleSelection(startPosition, endPosition);
 
     if (Frame* frame = document()->frame())
         frame->selection()->setSelection(newSelection);
@@ -242,10 +262,10 @@ void RenderTextControl::setSelectionRange(int start, int end)
         frame->setSelectionGranularity(CharacterGranularity);
 }
 
-Selection RenderTextControl::selection(int start, int end) const
+VisibleSelection RenderTextControl::selection(int start, int end) const
 {
-    return Selection(VisiblePosition(m_innerText.get(), start, VP_DEFAULT_AFFINITY),
-                     VisiblePosition(m_innerText.get(), end, VP_DEFAULT_AFFINITY));
+    return VisibleSelection(VisiblePosition(m_innerText.get(), start, VP_DEFAULT_AFFINITY),
+                            VisiblePosition(m_innerText.get(), end, VP_DEFAULT_AFFINITY));
 }
 
 VisiblePosition RenderTextControl::visiblePositionForIndex(int index)
@@ -274,7 +294,7 @@ int RenderTextControl::indexForVisiblePosition(const VisiblePosition& pos)
     RefPtr<Range> range = Range::create(document());
     range->setStart(m_innerText.get(), 0, ec);
     ASSERT(!ec);
-    range->setEnd(indexPosition.node(), indexPosition.offset(), ec);
+    range->setEnd(indexPosition.node(), indexPosition.deprecatedEditingOffset(), ec);
     ASSERT(!ec);
     return TextIterator::rangeLength(range.get());
 }
@@ -293,14 +313,8 @@ String RenderTextControl::finishText(Vector<UChar>& result) const
         result.shrink(--size);
 
     // Convert backslash to currency symbol.
-    UChar symbol = backslashAsCurrencySymbol();
-    if (symbol != '\\') {
-        for (size_t i = 0; i < size; ++i) {
-            if (result[i] == '\\')
-                result[i] = symbol;
-        }
-    }
-
+    document()->displayBufferModifiedByEncoding(result.data(), result.size());
+    
     return String::adopt(result);
 }
 
@@ -349,6 +363,7 @@ static void getNextSoftBreak(RootInlineBox*& line, Node*& breakNode, unsigned& b
         }
     }
     breakNode = 0;
+    breakOffset = 0;
 }
 
 String RenderTextControl::textWithHardLineBreaks()
@@ -365,7 +380,7 @@ String RenderTextControl::textWithHardLineBreaks()
     if (!renderer)
         return "";
 
-    InlineBox* box = renderer->isText() ? static_cast<RenderText*>(renderer)->firstTextBox() : renderer->inlineBoxWrapper();
+    InlineBox* box = renderer->isText() ? toRenderText(renderer)->firstTextBox() : toRenderBox(renderer)->inlineBoxWrapper();
     if (!box)
         return "";
 
@@ -424,25 +439,26 @@ int RenderTextControl::scrollbarThickness() const
 
 void RenderTextControl::calcHeight()
 {
-    m_height = m_innerText->renderer()->borderTop() + m_innerText->renderer()->borderBottom() +
-               m_innerText->renderer()->paddingTop() + m_innerText->renderer()->paddingBottom() +
-               m_innerText->renderer()->marginTop() + m_innerText->renderer()->marginBottom();
+    setHeight(m_innerText->renderBox()->borderTop() + m_innerText->renderBox()->borderBottom() +
+              m_innerText->renderBox()->paddingTop() + m_innerText->renderBox()->paddingBottom() +
+              m_innerText->renderBox()->marginTop() + m_innerText->renderBox()->marginBottom());
 
     adjustControlHeightBasedOnLineHeight(m_innerText->renderer()->lineHeight(true, true));
-    m_height += paddingTop() + paddingBottom() + borderTop() + borderBottom();
+    setHeight(height() + paddingTop() + paddingBottom() + borderTop() + borderBottom());
 
     // We are able to have a horizontal scrollbar if the overflow style is scroll, or if its auto and there's no word wrap.
-    if (m_innerText->renderer()->style()->overflowX() == OSCROLL ||  (m_innerText->renderer()->style()->overflowX() == OAUTO && m_innerText->renderer()->style()->wordWrap() == NormalWordWrap))
-        m_height += scrollbarThickness();
+    if (style()->overflowX() == OSCROLL ||  (style()->overflowX() == OAUTO && m_innerText->renderer()->style()->wordWrap() == NormalWordWrap))
+        setHeight(height() + scrollbarThickness());
 
     RenderBlock::calcHeight();
 }
 
-void RenderTextControl::hitInnerTextBlock(HitTestResult& result, int x, int y, int tx, int ty)
+void RenderTextControl::hitInnerTextElement(HitTestResult& result, int xPos, int yPos, int tx, int ty)
 {
     result.setInnerNode(m_innerText.get());
-    result.setLocalPoint(IntPoint(x - tx - m_x - m_innerText->renderer()->xPos(),
-                                  y - ty - m_y - m_innerText->renderer()->yPos()));
+    result.setInnerNonSharedNode(m_innerText.get());
+    result.setLocalPoint(IntPoint(xPos - tx - x() - m_innerText->renderBox()->x(),
+                                  yPos - ty - y() - m_innerText->renderBox()->y()));
 }
 
 void RenderTextControl::forwardEvent(Event* event)
@@ -454,7 +470,7 @@ void RenderTextControl::forwardEvent(Event* event)
 
 IntRect RenderTextControl::controlClipRect(int tx, int ty) const
 {
-    IntRect clipRect = contentBox();
+    IntRect clipRect = contentBoxRect();
     clipRect.move(tx, ty);
     return clipRect;
 }
@@ -469,11 +485,9 @@ void RenderTextControl::calcPrefWidths()
     if (style()->width().isFixed() && style()->width().value() > 0)
         m_minPrefWidth = m_maxPrefWidth = calcContentBoxWidth(style()->width().value());
     else {
-        // Figure out how big a text control needs to be for a given number of characters
-        // (using "0" as the nominal character).
-        const UChar ch = '0';
-        float charWidth = style()->font().floatWidth(TextRun(&ch, 1, false, 0, 0, false, false, false));
-        m_maxPrefWidth = preferredContentWidth(charWidth) + m_innerText->renderer()->paddingLeft() + m_innerText->renderer()->paddingRight();
+        // Use average character width. Matches IE.
+        float charWidth = style()->font().primaryFont()->avgCharWidth();
+        m_maxPrefWidth = preferredContentWidth(charWidth) + m_innerText->renderBox()->paddingLeft() + m_innerText->renderBox()->paddingRight();
     }
 
     if (style()->minWidth().isFixed() && style()->minWidth().value() > 0) {
@@ -503,7 +517,7 @@ void RenderTextControl::selectionChanged(bool userTriggered)
 
     if (Frame* frame = document()->frame()) {
         if (frame->selection()->isRange() && userTriggered)
-            static_cast<EventTargetNode*>(node())->dispatchEventForType(eventNames().selectEvent, true, false);
+            node()->dispatchEvent(eventNames().selectEvent, true, false);
     }
 }
 
@@ -512,80 +526,9 @@ void RenderTextControl::addFocusRingRects(GraphicsContext* graphicsContext, int
     graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
 }
 
-void RenderTextControl::autoscroll()
-{
-    RenderLayer* layer = m_innerText->renderer()->layer();
-    if (layer)
-        layer->autoscroll();
-}
-
-int RenderTextControl::scrollWidth() const
-{
-    if (m_innerText)
-        return m_innerText->scrollWidth();
-    return RenderBlock::scrollWidth();
-}
-
-int RenderTextControl::scrollHeight() const
-{
-    if (m_innerText)
-        return m_innerText->scrollHeight();
-    return RenderBlock::scrollHeight();
-}
-
-int RenderTextControl::scrollLeft() const
-{
-    if (m_innerText)
-        return m_innerText->scrollLeft();
-    return RenderBlock::scrollLeft();
-}
-
-int RenderTextControl::scrollTop() const
-{
-    if (m_innerText)
-        return m_innerText->scrollTop();
-    return RenderBlock::scrollTop();
-}
-
-void RenderTextControl::setScrollLeft(int newLeft)
-{
-    if (m_innerText)
-        m_innerText->setScrollLeft(newLeft);
-}
-
-void RenderTextControl::setScrollTop(int newTop)
-{
-    if (m_innerText)
-        m_innerText->setScrollTop(newTop);
-}
-
-bool RenderTextControl::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
-{
-    RenderLayer* layer = m_innerText->renderer()->layer();
-    if (layer && layer->scroll(direction, granularity, multiplier))
-        return true;
-    return RenderObject::scroll(direction, granularity, multiplier);
-}
-
-bool RenderTextControl::isScrollable() const
-{
-    if (m_innerText && m_innerText->renderer()->isScrollable())
-        return true;
-    return RenderObject::isScrollable();
-}
-
 HTMLElement* RenderTextControl::innerTextElement() const
 {
     return m_innerText.get();
 }
 
-FormControlElement* RenderTextControl::formControlElement() const
-{
-    if (node()->isHTMLElement())
-        return static_cast<HTMLFormControlElement*>(node());
-
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
index 40f5116040..bce961988e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
@@ -26,8 +26,7 @@
 
 namespace WebCore {
 
-class FormControlElement;
-class Selection;
+class VisibleSelection;
 class TextControlInnerElement;
 class TextControlInnerTextElement;
 
@@ -36,6 +35,7 @@ public:
     virtual ~RenderTextControl();
 
     virtual const char* renderName() const { return "RenderTextControl"; }
+    virtual bool isTextControl() const { return true; }
     virtual bool hasControlClip() const { return false; }
     virtual IntRect controlClipRect(int tx, int ty) const;
     virtual void calcHeight();
@@ -45,8 +45,8 @@ public:
     virtual bool canHaveChildren() const { return false; }
     virtual bool avoidsFloats() const { return true; }
     
-    virtual bool isEdited() const { return m_edited; }
-    virtual void setEdited(bool isEdited) { m_edited = isEdited; }
+    bool isEdited() const { return m_edited; }
+    void setEdited(bool isEdited) { m_edited = isEdited; }
 
     bool isUserEdited() const { return m_userEdited; }
     void setUserEdited(bool isUserEdited);
@@ -57,7 +57,7 @@ public:
     void setSelectionEnd(int);
     void select();
     void setSelectionRange(int start, int end);
-    Selection selection(int start, int end) const;
+    VisibleSelection selection(int start, int end) const;
 
     virtual void subtreeHasChanged();
     String text();
@@ -67,17 +67,6 @@ public:
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
     virtual bool canBeProgramaticallyScrolled(bool) const { return true; }
-    virtual void autoscroll();
-
-    // Subclassed to forward to our inner div.
-    virtual int scrollLeft() const;
-    virtual int scrollTop() const;
-    virtual int scrollWidth() const;
-    virtual int scrollHeight() const;
-    virtual void setScrollLeft(int);
-    virtual void setScrollTop(int);
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
-    virtual bool isScrollable() const;
 
     VisiblePosition visiblePositionForIndex(int index);
     int indexForVisiblePosition(const VisiblePosition&);
@@ -89,10 +78,10 @@ protected:
     void adjustInnerTextStyle(const RenderStyle* startStyle, RenderStyle* textBlockStyle) const;
     void setInnerTextValue(const String&);
 
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     void createSubtreeIfNeeded(TextControlInnerElement* innerBlock);
-    void hitInnerTextBlock(HitTestResult&, int x, int y, int tx, int ty);
+    void hitInnerTextElement(HitTestResult&, int x, int y, int tx, int ty);
     void forwardEvent(Event*);
 
     int textBlockWidth() const;
@@ -106,8 +95,6 @@ protected:
     friend class TextIterator;
     HTMLElement* innerTextElement() const;
 
-    FormControlElement* formControlElement() const;
-
 private:
     String finishText(Vector<UChar>&) const;
 
@@ -116,6 +103,21 @@ private:
     RefPtr<TextControlInnerTextElement> m_innerText;
 };
 
+inline RenderTextControl* toRenderTextControl(RenderObject* o)
+{ 
+    ASSERT(!o || o->isTextControl());
+    return static_cast<RenderTextControl*>(o);
+}
+
+inline const RenderTextControl* toRenderTextControl(const RenderObject* o)
+{ 
+    ASSERT(!o || o->isTextControl());
+    return static_cast<const RenderTextControl*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTextControl(const RenderTextControl*);
+
 } // namespace WebCore
 
 #endif // RenderTextControl_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
index f86052467d..7ff251c9f8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -43,7 +43,7 @@ RenderTextControlMultiLine::~RenderTextControlMultiLine()
 void RenderTextControlMultiLine::subtreeHasChanged()
 {
     RenderTextControl::subtreeHasChanged();
-    formControlElement()->setValueMatchesRenderer(false);
+    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(false);
 
     if (!node()->focused())
         return;
@@ -52,43 +52,15 @@ void RenderTextControlMultiLine::subtreeHasChanged()
         frame->textDidChangeInTextArea(static_cast<Element*>(node()));
 }
 
-void RenderTextControlMultiLine::layout()
-{
-    int oldHeight = m_height;
-    calcHeight();
-
-    int oldWidth = m_width;
-    calcWidth();
-
-    bool relayoutChildren = oldHeight != m_height || oldWidth != m_width;
-    RenderObject* innerTextRenderer = innerTextElement()->renderer();
-
-    // Set the text block height
-    int desiredHeight = textBlockHeight();
-    if (desiredHeight != innerTextRenderer->height())
-        relayoutChildren = true;
-    innerTextRenderer->style()->setHeight(Length(desiredHeight, Fixed));
-
-    // Set the text block width
-    int desiredWidth = textBlockWidth();
-    if (desiredWidth != innerTextRenderer->width())
-        relayoutChildren = true;
-    innerTextRenderer->style()->setWidth(Length(desiredWidth, Fixed));
-
-    RenderBlock::layoutBlock(relayoutChildren);
-}
-
 bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
 {
     if (!RenderTextControl::nodeAtPoint(request, result, x, y, tx, ty, hitTestAction))
         return false;
 
-    if (result.innerNode() == element()) {
-        hitInnerTextBlock(result, x, y, tx, ty);
-        return true;
-    }
+    if (result.innerNode() == node() || result.innerNode() == innerTextElement())
+        hitInnerTextElement(result, x, y, tx, ty);
 
-    return false;
+    return true;
 }
 
 void RenderTextControlMultiLine::forwardEvent(Event* event)
@@ -104,7 +76,7 @@ int RenderTextControlMultiLine::preferredContentWidth(float charWidth) const
 
 void RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight(int lineHeight)
 {
-    m_height += lineHeight * static_cast<HTMLTextAreaElement*>(node())->rows();
+    setHeight(height() + lineHeight * static_cast<HTMLTextAreaElement*>(node())->rows());
 }
 
 int RenderTextControlMultiLine::baselinePosition(bool, bool) const
@@ -132,10 +104,9 @@ PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const R
 
     adjustInnerTextStyle(startStyle, textBlockStyle.get());
 
-    // Forward overflow properties.
-    textBlockStyle->setOverflowX(startStyle->overflowX() == OVISIBLE ? OAUTO : startStyle->overflowX());
-    textBlockStyle->setOverflowY(startStyle->overflowY() == OVISIBLE ? OAUTO : startStyle->overflowY());
-
+    // FIXME: This code should just map wrap into CSS in the DOM code.
+    // Then here we should set the textBlockStyle appropriately based off this
+    // object's style()->whiteSpace() and style->wordWrap().
     // Set word wrap property based on wrap attribute.
     if (static_cast<HTMLTextAreaElement*>(node())->shouldWrapText()) {
         textBlockStyle->setWhiteSpace(PRE_WRAP);
@@ -147,10 +118,6 @@ PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const R
 
     textBlockStyle->setDisplay(BLOCK);
 
-    // We're adding three extra pixels of padding to line textareas up with text fields.
-    textBlockStyle->setPaddingLeft(Length(3, Fixed));
-    textBlockStyle->setPaddingRight(Length(3, Fixed));
-
     return textBlockStyle.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
index 591a65da87..579047dd94 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
@@ -33,7 +33,6 @@ public:
     virtual bool isTextArea() const { return true; }
 
     virtual void subtreeHasChanged();
-    virtual void layout();
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     void forwardEvent(Event*);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
index 4f52527cdd..b75ace9c3b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -30,6 +30,7 @@
 #include "HitTestResult.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "InputElement.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "PlatformKeyboardEvent.h"
@@ -38,6 +39,7 @@
 #include "SearchPopupMenu.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "SimpleFontData.h"
 #include "TextControlInnerElements.h"
 
 using namespace std;
@@ -69,7 +71,7 @@ RenderTextControlSingleLine::~RenderTextControlSingleLine()
 
 bool RenderTextControlSingleLine::placeholderShouldBeVisible() const
 {
-    return static_cast<HTMLInputElement*>(node())->placeholderShouldBeVisible();
+    return inputElement()->placeholderShouldBeVisible();
 }
 
 void RenderTextControlSingleLine::updatePlaceholderVisibility()
@@ -90,6 +92,7 @@ void RenderTextControlSingleLine::updatePlaceholderVisibility()
 
 void RenderTextControlSingleLine::addSearchResult()
 {
+    ASSERT(node()->isHTMLElement());
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
     if (input->maxResults() <= 0)
         return;
@@ -121,11 +124,13 @@ void RenderTextControlSingleLine::addSearchResult()
 
 void RenderTextControlSingleLine::stopSearchEventTimer()
 {
+    ASSERT(node()->isHTMLElement());
     m_searchEventTimer.stop();
 }
 
 void RenderTextControlSingleLine::showPopup()
 {
+    ASSERT(node()->isHTMLElement());
     if (m_searchPopupIsVisible)
         return;
 
@@ -155,6 +160,7 @@ void RenderTextControlSingleLine::showPopup()
 
 void RenderTextControlSingleLine::hidePopup()
 {
+    ASSERT(node()->isHTMLElement());
     if (m_searchPopup)
         m_searchPopup->hide();
 
@@ -166,24 +172,24 @@ void RenderTextControlSingleLine::subtreeHasChanged()
     bool wasEdited = isEdited();
     RenderTextControl::subtreeHasChanged();
 
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
+    InputElement* input = inputElement();
     input->setValueFromRenderer(input->constrainValue(text()));
 
-    if (RenderObject* cancelButtonRenderer = m_cancelButton ? m_cancelButton->renderer() : 0)
-        updateCancelButtonVisibility(cancelButtonRenderer->style());
+    if (m_cancelButton)
+        updateCancelButtonVisibility();
 
     // If the incremental attribute is set, then dispatch the search event
-    if (!input->getAttribute(incrementalAttr).isNull())
+    if (input->searchEventsShouldBeDispatched())
         startSearchEventTimer();
 
-    if (!wasEdited && input->focused()) {
+    if (!wasEdited && node()->focused()) {
         if (Frame* frame = document()->frame())
-            frame->textFieldDidBeginEditing(input);
+            frame->textFieldDidBeginEditing(static_cast<Element*>(node()));
     }
 
-    if (input->focused()) {
+    if (node()->focused()) {
         if (Frame* frame = document()->frame())
-            frame->textDidChangeInTextField(input);
+            frame->textDidChangeInTextField(static_cast<Element*>(node()));
     }
 }
 
@@ -192,32 +198,32 @@ void RenderTextControlSingleLine::paint(PaintInfo& paintInfo, int tx, int ty)
     RenderTextControl::paint(paintInfo, tx, ty);
 
     if (paintInfo.phase == PaintPhaseBlockBackground && m_shouldDrawCapsLockIndicator) {
-        IntRect contentsRect = contentBox();
+        IntRect contentsRect = contentBoxRect();
 
         // Convert the rect into the coords used for painting the content
-        contentsRect.move(tx + xPos(), ty + yPos());
+        contentsRect.move(tx + x(), ty + y());
         theme()->paintCapsLockIndicator(this, paintInfo, contentsRect);
     }
 }
 
 void RenderTextControlSingleLine::layout()
 {
-    int oldHeight = m_height;
+    int oldHeight = height();
     calcHeight();
 
-    int oldWidth = m_width;
+    int oldWidth = width();
     calcWidth();
 
-    bool relayoutChildren = oldHeight != m_height || oldWidth != m_width;
+    bool relayoutChildren = oldHeight != height() || oldWidth != width();
 
-    RenderObject* innerTextRenderer = innerTextElement()->renderer();
-    RenderObject* innerBlockRenderer = m_innerBlock ? m_innerBlock->renderer() : 0;
+    RenderBox* innerTextRenderer = innerTextElement()->renderBox();
+    RenderBox* innerBlockRenderer = m_innerBlock ? m_innerBlock->renderBox() : 0;
 
     // Set the text block height
     int desiredHeight = textBlockHeight();
     int currentHeight = innerTextRenderer->height();
 
-    if (m_innerBlock || currentHeight > m_height) {
+    if (m_innerBlock || currentHeight > height()) {
         if (desiredHeight != currentHeight)
             relayoutChildren = true;
         innerTextRenderer->style()->setHeight(Length(desiredHeight, Fixed));
@@ -237,7 +243,7 @@ void RenderTextControlSingleLine::layout()
     innerTextRenderer->style()->setWidth(Length(desiredWidth, Fixed));
 
     if (m_innerBlock) {
-        int innerBlockWidth = m_width - paddingLeft() - paddingRight() - borderLeft() - borderRight();
+        int innerBlockWidth = width() - paddingLeft() - paddingRight() - borderLeft() - borderRight();
         if (innerBlockWidth != innerBlockRenderer->width())
             relayoutChildren = true;
         innerBlockRenderer->style()->setWidth(Length(innerBlockWidth, Fixed));
@@ -249,12 +255,12 @@ void RenderTextControlSingleLine::layout()
     // Don't do this for search fields, since we don't honor height for them
     if (!m_innerBlock) {
         currentHeight = innerTextRenderer->height();
-        if (currentHeight < m_height)
-            innerTextRenderer->setPos(innerTextRenderer->xPos(), (m_height - currentHeight) / 2);
+        if (currentHeight < height())
+            innerTextRenderer->setLocation(innerTextRenderer->x(), (height() - currentHeight) / 2);
     }
 }
 
-bool RenderTextControlSingleLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
+bool RenderTextControlSingleLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int xPos, int yPos, int tx, int ty, HitTestAction hitTestAction)
 {
     // If we're within the text control, we want to act as if we've hit the inner text block element, in case the point
     // was on the control but not on the inner element (see Radar 4617841).
@@ -262,37 +268,39 @@ bool RenderTextControlSingleLine::nodeAtPoint(const HitTestRequest& request, Hit
     // In a search field, we want to act as if we've hit the results block if we're to the left of the inner text block,
     // and act as if we've hit the close block if we're to the right of the inner text block.
 
-    if (!RenderTextControl::nodeAtPoint(request, result, x, y, tx, ty, hitTestAction))
-        return false;
-
-    if (result.innerNode() != element() && result.innerNode() != m_innerBlock.get())
+    if (!RenderTextControl::nodeAtPoint(request, result, xPos, yPos, tx, ty, hitTestAction))
         return false;
 
-    hitInnerTextBlock(result, x, y, tx, ty);
+    // If we hit a node inside the inner text element, say that we hit that element,
+    // and if we hit our node (e.g. we're over the border or padding), also say that we hit the
+    // inner text element so that it gains focus.
+    if (result.innerNode()->isDescendantOf(innerTextElement()) || result.innerNode() == node())
+        hitInnerTextElement(result, xPos, yPos, tx, ty);
 
-    if (!m_innerBlock)
+    // If we're not a search field, or we already found the results or cancel buttons, we're done.
+    if (!m_innerBlock || result.innerNode() == m_resultsButton || result.innerNode() == m_cancelButton)
         return true;
 
     Node* innerNode = 0;
-    RenderObject* innerBlockRenderer = m_innerBlock->renderer();
-    RenderObject* innerTextRenderer = innerTextElement()->renderer();
+    RenderBox* innerBlockRenderer = m_innerBlock->renderBox();
+    RenderBox* innerTextRenderer = innerTextElement()->renderBox();
 
     IntPoint localPoint = result.localPoint();
-    localPoint.move(-innerBlockRenderer->xPos(), -innerBlockRenderer->yPos());
+    localPoint.move(-innerBlockRenderer->x(), -innerBlockRenderer->y());
 
-    int textLeft = tx + m_x + innerBlockRenderer->xPos() + innerTextRenderer->xPos();
-    if (m_resultsButton && m_resultsButton->renderer() && x < textLeft)
+    int textLeft = tx + x() + innerBlockRenderer->x() + innerTextRenderer->x();
+    if (m_resultsButton && m_resultsButton->renderer() && xPos < textLeft)
         innerNode = m_resultsButton.get();
 
     if (!innerNode) {
         int textRight = textLeft + innerTextRenderer->width();
-        if (m_cancelButton && m_cancelButton->renderer() && x > textRight)
+        if (m_cancelButton && m_cancelButton->renderer() && xPos > textRight)
             innerNode = m_cancelButton.get();
     }
 
     if (innerNode) {
         result.setInnerNode(innerNode);
-        localPoint.move(-innerNode->renderer()->xPos(), -innerNode->renderer()->yPos());
+        localPoint.move(-innerNode->renderBox()->x(), -innerNode->renderBox()->y());
     }
 
     result.setLocalPoint(localPoint);
@@ -301,7 +309,7 @@ bool RenderTextControlSingleLine::nodeAtPoint(const HitTestRequest& request, Hit
 
 void RenderTextControlSingleLine::forwardEvent(Event* event)
 {
-    RenderObject* innerTextRenderer = innerTextElement()->renderer();
+    RenderBox* innerTextRenderer = innerTextElement()->renderBox();
 
     if (event->type() == eventNames().blurEvent) {
         if (innerTextRenderer) {
@@ -318,16 +326,16 @@ void RenderTextControlSingleLine::forwardEvent(Event* event)
         return;
     }
 
-    FloatPoint localPoint = innerTextRenderer->absoluteToLocal(FloatPoint(static_cast<MouseEvent*>(event)->pageX(), static_cast<MouseEvent*>(event)->pageY()), false, true);
-    if (m_resultsButton && localPoint.x() < innerTextRenderer->borderBox().x())
+    FloatPoint localPoint = innerTextRenderer->absoluteToLocal(static_cast<MouseEvent*>(event)->absoluteLocation(), false, true);
+    if (m_resultsButton && localPoint.x() < innerTextRenderer->borderBoxRect().x())
         m_resultsButton->defaultEventHandler(event);
-    else if (m_cancelButton && localPoint.x() > innerTextRenderer->borderBox().right())
+    else if (m_cancelButton && localPoint.x() > innerTextRenderer->borderBoxRect().right())
         m_cancelButton->defaultEventHandler(event);
     else
         RenderTextControl::forwardEvent(event);
 }
 
-void RenderTextControlSingleLine::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderTextControlSingleLine::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderTextControl::styleDidChange(diff, oldStyle);
 
@@ -344,6 +352,8 @@ void RenderTextControlSingleLine::styleDidChange(RenderStyle::Diff diff, const R
 
     if (RenderObject* cancelRenderer = m_cancelButton ? m_cancelButton->renderer() : 0)
         cancelRenderer->setStyle(createCancelButtonStyle(style()));
+
+    setHasOverflowClip(false);
 }
 
 void RenderTextControlSingleLine::capsLockStateMayHaveChanged()
@@ -359,7 +369,7 @@ void RenderTextControlSingleLine::capsLockStateMayHaveChanged()
     bool shouldDrawCapsLockIndicator = false;
 
     if (Frame* frame = document()->frame())
-        shouldDrawCapsLockIndicator = static_cast<HTMLInputElement*>(node())->inputType() == HTMLInputElement::PASSWORD
+        shouldDrawCapsLockIndicator = inputElement()->isPasswordField()
                                       && frame->selection()->isFocusedAndActive()
                                       && document()->focusedNode() == node()
                                       && PlatformKeyboardEvent::currentCapsLockState();
@@ -374,14 +384,14 @@ int RenderTextControlSingleLine::textBlockWidth() const
 {
     int width = RenderTextControl::textBlockWidth();
 
-    if (RenderObject* resultsRenderer = m_resultsButton ? m_resultsButton->renderer() : 0) {
+    if (RenderBox* resultsRenderer = m_resultsButton ? m_resultsButton->renderBox() : 0) {
         resultsRenderer->calcWidth();
-        width -= resultsRenderer->width();
+        width -= resultsRenderer->width() + resultsRenderer->marginLeft() + resultsRenderer->marginRight();
     }
 
-    if (RenderObject* cancelRenderer = m_cancelButton ? m_cancelButton->renderer() : 0) {
+    if (RenderBox* cancelRenderer = m_cancelButton ? m_cancelButton->renderBox() : 0) {
         cancelRenderer->calcWidth();
-        width -= cancelRenderer->width();
+        width -= cancelRenderer->width() + cancelRenderer->marginLeft() + cancelRenderer->marginRight();
     }
 
     return width;
@@ -389,17 +399,20 @@ int RenderTextControlSingleLine::textBlockWidth() const
 
 int RenderTextControlSingleLine::preferredContentWidth(float charWidth) const
 {
-    int factor = static_cast<HTMLInputElement*>(node())->size();
+    int factor = inputElement()->size();
     if (factor <= 0)
         factor = 20;
 
     int result = static_cast<int>(ceilf(charWidth * factor));
 
-    if (RenderObject* resultsRenderer = m_resultsButton ? m_resultsButton->renderer() : 0)
+    // For text inputs, IE adds some extra width.
+    result += style()->font().primaryFont()->maxCharWidth() - charWidth;
+
+    if (RenderBox* resultsRenderer = m_resultsButton ? m_resultsButton->renderBox() : 0)
         result += resultsRenderer->borderLeft() + resultsRenderer->borderRight() +
                   resultsRenderer->paddingLeft() + resultsRenderer->paddingRight();
 
-    if (RenderObject* cancelRenderer = m_cancelButton ? m_cancelButton->renderer() : 0)
+    if (RenderBox* cancelRenderer = m_cancelButton ? m_cancelButton->renderBox() : 0)
         result += cancelRenderer->borderLeft() + cancelRenderer->borderRight() +
                   cancelRenderer->paddingLeft() + cancelRenderer->paddingRight();
 
@@ -408,30 +421,30 @@ int RenderTextControlSingleLine::preferredContentWidth(float charWidth) const
 
 void RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight(int lineHeight)
 {
-    if (RenderObject* resultsRenderer = m_resultsButton ? m_resultsButton->renderer() : 0) {
-        static_cast<RenderBlock*>(resultsRenderer)->calcHeight();
-        m_height = max(m_height,
-                       resultsRenderer->borderTop() + resultsRenderer->borderBottom() +
-                       resultsRenderer->paddingTop() + resultsRenderer->paddingBottom() +
-                       resultsRenderer->marginTop() + resultsRenderer->marginBottom());
+    if (RenderBox* resultsRenderer = m_resultsButton ? m_resultsButton->renderBox() : 0) {
+        toRenderBlock(resultsRenderer)->calcHeight();
+        setHeight(max(height(),
+                  resultsRenderer->borderTop() + resultsRenderer->borderBottom() +
+                  resultsRenderer->paddingTop() + resultsRenderer->paddingBottom() +
+                  resultsRenderer->marginTop() + resultsRenderer->marginBottom()));
         lineHeight = max(lineHeight, resultsRenderer->height());
     }
 
-    if (RenderObject* cancelRenderer = m_cancelButton ? m_cancelButton->renderer() : 0) {
-        static_cast<RenderBlock*>(cancelRenderer)->calcHeight();
-        m_height = max(m_height,
-                       cancelRenderer->borderTop() + cancelRenderer->borderBottom() +
-                       cancelRenderer->paddingTop() + cancelRenderer->paddingBottom() +
-                       cancelRenderer->marginTop() + cancelRenderer->marginBottom());
+    if (RenderBox* cancelRenderer = m_cancelButton ? m_cancelButton->renderBox() : 0) {
+        toRenderBlock(cancelRenderer)->calcHeight();
+        setHeight(max(height(),
+                  cancelRenderer->borderTop() + cancelRenderer->borderBottom() +
+                  cancelRenderer->paddingTop() + cancelRenderer->paddingBottom() +
+                  cancelRenderer->marginTop() + cancelRenderer->marginBottom()));
         lineHeight = max(lineHeight, cancelRenderer->height());
     }
 
-    m_height += lineHeight;
+    setHeight(height() + lineHeight);
 }
 
 void RenderTextControlSingleLine::createSubtreeIfNeeded()
 {
-    if (!static_cast<HTMLInputElement*>(node())->isSearchField()) {
+    if (!inputElement()->isSearchField()) {
         RenderTextControl::createSubtreeIfNeeded(m_innerBlock.get());
         return;
     }
@@ -466,17 +479,15 @@ void RenderTextControlSingleLine::updateFromElement()
     bool placeholderVisibilityShouldChange = m_placeholderVisible != placeholderShouldBeVisible();
     m_placeholderVisible = placeholderShouldBeVisible();
 
-    if (RenderObject* cancelButtonRenderer = m_cancelButton ? m_cancelButton->renderer() : 0)
-        updateCancelButtonVisibility(cancelButtonRenderer->style());
-
-    HTMLInputElement* element = static_cast<HTMLInputElement*>(node());
+    if (m_cancelButton)
+        updateCancelButtonVisibility();
 
     if (m_placeholderVisible) {
         ExceptionCode ec = 0;
-        innerTextElement()->setInnerText(element->getAttribute(placeholderAttr), ec);
-        ASSERT(ec == 0);
-    } else if (!formControlElement()->valueMatchesRenderer() || placeholderVisibilityShouldChange)
-        setInnerTextValue(element->value());
+        innerTextElement()->setInnerText(inputElement()->placeholder(), ec);
+        ASSERT(!ec);
+    } else if (!static_cast<Element*>(node())->formControlValueMatchesRenderer() || placeholderVisibilityShouldChange)
+        setInnerTextValue(inputElement()->value());
 
     if (m_searchPopupIsVisible)
         m_searchPopup->updateFromElement();
@@ -484,16 +495,17 @@ void RenderTextControlSingleLine::updateFromElement()
 
 void RenderTextControlSingleLine::cacheSelection(int start, int end)
 {
-    static_cast<HTMLInputElement*>(node())->cacheSelection(start, end);
+    inputElement()->cacheSelection(start, end);
 }
 
 PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const RenderStyle* startStyle) const
 {
     RefPtr<RenderStyle> textBlockStyle;
     if (placeholderShouldBeVisible()) {
-        RenderStyle* pseudoStyle = getCachedPseudoStyle(RenderStyle::INPUT_PLACEHOLDER);
-        textBlockStyle = RenderStyle::clone(pseudoStyle);
-    } else {
+        if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
+            textBlockStyle = RenderStyle::clone(pseudoStyle);
+    } 
+    if (!textBlockStyle) {
         textBlockStyle = RenderStyle::create();   
         textBlockStyle->inheritFrom(startStyle);
     }
@@ -527,6 +539,8 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const
 
 PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerBlockStyle(const RenderStyle* startStyle) const
 {
+    ASSERT(node()->isHTMLElement());
+
     RefPtr<RenderStyle> innerBlockStyle = RenderStyle::create();
     innerBlockStyle->inheritFrom(startStyle);
 
@@ -541,15 +555,16 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerBlockStyle(const
 
 PassRefPtr<RenderStyle> RenderTextControlSingleLine::createResultsButtonStyle(const RenderStyle* startStyle) const
 {
+    ASSERT(node()->isHTMLElement());
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
 
     RefPtr<RenderStyle> resultsBlockStyle;
     if (input->maxResults() < 0)
-        resultsBlockStyle = getCachedPseudoStyle(RenderStyle::SEARCH_DECORATION);
+        resultsBlockStyle = getCachedPseudoStyle(SEARCH_DECORATION);
     else if (!input->maxResults())
-        resultsBlockStyle = getCachedPseudoStyle(RenderStyle::SEARCH_RESULTS_DECORATION);
+        resultsBlockStyle = getCachedPseudoStyle(SEARCH_RESULTS_DECORATION);
     else
-        resultsBlockStyle = getCachedPseudoStyle(RenderStyle::SEARCH_RESULTS_BUTTON);
+        resultsBlockStyle = getCachedPseudoStyle(SEARCH_RESULTS_BUTTON);
 
     if (!resultsBlockStyle)
         resultsBlockStyle = RenderStyle::create();
@@ -562,9 +577,10 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createResultsButtonStyle(co
 
 PassRefPtr<RenderStyle> RenderTextControlSingleLine::createCancelButtonStyle(const RenderStyle* startStyle) const
 {
+    ASSERT(node()->isHTMLElement());
     RefPtr<RenderStyle> cancelBlockStyle;
     
-    if (RefPtr<RenderStyle> pseudoStyle = getCachedPseudoStyle(RenderStyle::SEARCH_CANCEL_BUTTON))
+    if (RefPtr<RenderStyle> pseudoStyle = getCachedPseudoStyle(SEARCH_CANCEL_BUTTON))
         // We may be sharing style with another search field, but we must not share the cancel button style.
         cancelBlockStyle = RenderStyle::clone(pseudoStyle.get());
     else
@@ -573,14 +589,30 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createCancelButtonStyle(con
     if (startStyle)
         cancelBlockStyle->inheritFrom(startStyle);
 
-    updateCancelButtonVisibility(cancelBlockStyle.get());
+    cancelBlockStyle->setVisibility(visibilityForCancelButton());
     return cancelBlockStyle.release();
 }
 
-void RenderTextControlSingleLine::updateCancelButtonVisibility(RenderStyle* style) const
+void RenderTextControlSingleLine::updateCancelButtonVisibility() const
+{
+    if (!m_cancelButton->renderer())
+        return;
+
+    const RenderStyle* curStyle = m_cancelButton->renderer()->style();
+    EVisibility buttonVisibility = visibilityForCancelButton();
+    if (curStyle->visibility() == buttonVisibility)
+        return;
+
+    RefPtr<RenderStyle> cancelButtonStyle = RenderStyle::clone(curStyle);
+    cancelButtonStyle->setVisibility(buttonVisibility);
+    m_cancelButton->renderer()->setStyle(cancelButtonStyle);
+}
+
+EVisibility RenderTextControlSingleLine::visibilityForCancelButton() const
 {
+    ASSERT(node()->isHTMLElement());
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
-    style->setVisibility(input->value().isEmpty() ? HIDDEN : VISIBLE);
+    return input->value().isEmpty() ? HIDDEN : VISIBLE;
 }
 
 const AtomicString& RenderTextControlSingleLine::autosaveName() const
@@ -590,6 +622,7 @@ const AtomicString& RenderTextControlSingleLine::autosaveName() const
 
 void RenderTextControlSingleLine::startSearchEventTimer()
 {
+    ASSERT(node()->isHTMLElement());
     unsigned length = text().length();
 
     // If there's no text, fire the event right away.
@@ -606,12 +639,14 @@ void RenderTextControlSingleLine::startSearchEventTimer()
 
 void RenderTextControlSingleLine::searchEventTimerFired(Timer<RenderTextControlSingleLine>*)
 {
+    ASSERT(node()->isHTMLElement());
     static_cast<HTMLInputElement*>(node())->onSearch();
 }
 
 // PopupMenuClient methods
 void RenderTextControlSingleLine::valueChanged(unsigned listIndex, bool fireEvents)
 {
+    ASSERT(node()->isHTMLElement());
     ASSERT(static_cast<int>(listIndex) < listSize());
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
     if (static_cast<int>(listIndex) == (listSize() - 1)) {
@@ -662,7 +697,7 @@ PopupMenuStyle RenderTextControlSingleLine::itemStyle(unsigned) const
 
 PopupMenuStyle RenderTextControlSingleLine::menuStyle() const
 {
-    return PopupMenuStyle(style()->color(), style()->backgroundColor(), style()->font(), style()->visibility() == VISIBLE);
+    return PopupMenuStyle(style()->color(), style()->backgroundColor(), style()->font(), style()->visibility() == VISIBLE, style()->textIndent(), style()->direction());
 }
 
 int RenderTextControlSingleLine::clientInsetLeft() const
@@ -682,9 +717,9 @@ int RenderTextControlSingleLine::clientInsetRight() const
 
 int RenderTextControlSingleLine::clientPaddingLeft() const
 {
-    int padding = clientPaddingLeft();
+    int padding = paddingLeft();
 
-    if (RenderObject* resultsRenderer = m_resultsButton ? m_resultsButton->renderer() : 0)
+    if (RenderBox* resultsRenderer = m_resultsButton ? m_resultsButton->renderBox() : 0)
         padding += resultsRenderer->width();
 
     return padding;
@@ -692,9 +727,9 @@ int RenderTextControlSingleLine::clientPaddingLeft() const
 
 int RenderTextControlSingleLine::clientPaddingRight() const
 {
-    int padding = clientPaddingRight();
+    int padding = paddingRight();
 
-    if (RenderObject* cancelRenderer = m_cancelButton ? m_cancelButton->renderer() : 0)
+    if (RenderBox* cancelRenderer = m_cancelButton ? m_cancelButton->renderBox() : 0)
         padding += cancelRenderer->width();
 
     return padding;
@@ -732,6 +767,7 @@ bool RenderTextControlSingleLine::itemIsSelected(unsigned) const
 
 void RenderTextControlSingleLine::setTextFromItem(unsigned listIndex)
 {
+    ASSERT(node()->isHTMLElement());
     static_cast<HTMLInputElement*>(node())->setValue(itemText(listIndex));
 }
 
@@ -745,10 +781,65 @@ HostWindow* RenderTextControlSingleLine::hostWindow() const
     return document()->view()->hostWindow();
 }
 
+void RenderTextControlSingleLine::autoscroll()
+{
+    RenderLayer* layer = innerTextElement()->renderBox()->layer();
+    if (layer)
+        layer->autoscroll();
+}
+
+int RenderTextControlSingleLine::scrollWidth() const
+{
+    if (innerTextElement())
+        return innerTextElement()->scrollWidth();
+    return RenderBlock::scrollWidth();
+}
+
+int RenderTextControlSingleLine::scrollHeight() const
+{
+    if (innerTextElement())
+        return innerTextElement()->scrollHeight();
+    return RenderBlock::scrollHeight();
+}
+
+int RenderTextControlSingleLine::scrollLeft() const
+{
+    if (innerTextElement())
+        return innerTextElement()->scrollLeft();
+    return RenderBlock::scrollLeft();
+}
+
+int RenderTextControlSingleLine::scrollTop() const
+{
+    if (innerTextElement())
+        return innerTextElement()->scrollTop();
+    return RenderBlock::scrollTop();
+}
+
+void RenderTextControlSingleLine::setScrollLeft(int newLeft)
+{
+    if (innerTextElement())
+        innerTextElement()->setScrollLeft(newLeft);
+}
+
+void RenderTextControlSingleLine::setScrollTop(int newTop)
+{
+    if (innerTextElement())
+        innerTextElement()->setScrollTop(newTop);
+}
+
+bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+{
+    RenderLayer* layer = innerTextElement()->renderBox()->layer();
+    if (layer && layer->scroll(direction, granularity, multiplier))
+        return true;
+    return RenderBlock::scroll(direction, granularity, multiplier);
+}
+
 PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize controlSize)
 {
     RefPtr<Scrollbar> widget;
-    bool hasCustomScrollbarStyle = style()->hasPseudoStyle(RenderStyle::SCROLLBAR);
+    bool hasCustomScrollbarStyle = style()->hasPseudoStyle(SCROLLBAR);
     if (hasCustomScrollbarStyle)
         widget = RenderScrollbar::createCustomScrollbar(client, orientation, this);
     else
@@ -756,4 +847,9 @@ PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollbarClie
     return widget.release();
 }
 
+InputElement* RenderTextControlSingleLine::inputElement() const
+{
+    return toInputElement(static_cast<Element*>(node()));
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
index a0d8d682a6..23352b45b2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
@@ -27,6 +27,7 @@
 
 namespace WebCore {
 
+class InputElement;
 class SearchFieldCancelButtonElement;
 class SearchFieldResultsButtonElement;
 class SearchPopupMenu;
@@ -58,9 +59,20 @@ public:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     void forwardEvent(Event*);
 
-private:
-    virtual void capsLockStateMayHaveChanged();
+    void capsLockStateMayHaveChanged();
+
+    virtual void autoscroll();
+
+    // Subclassed to forward to our inner div.
+    virtual int scrollLeft() const;
+    virtual int scrollTop() const;
+    virtual int scrollWidth() const;
+    virtual int scrollHeight() const;
+    virtual void setScrollLeft(int);
+    virtual void setScrollTop(int);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
 
+private:
     int textBlockWidth() const;
     virtual int preferredContentWidth(float charWidth) const;
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight);
@@ -68,14 +80,15 @@ private:
     void createSubtreeIfNeeded();
     virtual void updateFromElement();
     virtual void cacheSelection(int start, int end);
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createInnerBlockStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createResultsButtonStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createCancelButtonStyle(const RenderStyle* startStyle) const;
 
-    void updateCancelButtonVisibility(RenderStyle*) const;
+    void updateCancelButtonVisibility() const;
+    EVisibility visibilityForCancelButton() const;
     const AtomicString& autosaveName() const;
 
     void startSearchEventTimer();
@@ -104,6 +117,8 @@ private:
     virtual HostWindow* hostWindow() const;
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarClient*, ScrollbarOrientation, ScrollbarControlSize);
 
+    InputElement* inputElement() const;
+
 private:
     bool m_placeholderVisible;
     bool m_searchPopupIsVisible;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
index c8beba0def..7da9e5a98c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
@@ -46,7 +46,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
-    Node* e = element();
+    Node* e = node();
     RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->string() : contentString());
     if (result && (start() > 0 || start() < result->length()))
         result = result->substring(start(), end());
@@ -75,7 +75,7 @@ void RenderTextFragment::setTextInternal(PassRefPtr<StringImpl> text)
 UChar RenderTextFragment::previousCharacter()
 {
     if (start()) {
-        Node* e = element();
+        Node* e = node();
         StringImpl*  original = (e ? static_cast<Text*>(e)->string() : contentString());
         if (original)
             return (*original)[start() - 1];
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
index aa184076aa..e67e612ef8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
@@ -268,6 +268,12 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             if (o->parent()->isSlider())
                 return paintMediaSliderThumb(o, paintInfo, r);
             break;
+        case MediaTimeRemainingPart:
+            return paintMediaTimeRemaining(o, paintInfo, r);
+        case MediaCurrentTimePart:
+            return paintMediaCurrentTime(o, paintInfo, r);
+        case MediaTimelineContainerPart:
+            return paintMediaTimelineContainer(o, paintInfo, r);
         case MenulistButtonPart:
         case TextFieldPart:
         case TextAreaPart:
@@ -365,24 +371,68 @@ bool RenderTheme::paintDecorations(RenderObject* o, const RenderObject::PaintInf
 #if ENABLE(VIDEO)
 bool RenderTheme::hitTestMediaControlPart(RenderObject* o, const IntPoint& absPoint)
 {
-    FloatPoint localPoint = o->absoluteToLocal(absPoint, false, true);  // respect transforms
+    if (!o->isBox())
+        return false;
 
-    return o->borderBox().contains(roundedIntPoint(localPoint));
+    FloatPoint localPoint = o->absoluteToLocal(absPoint, false, true);  // respect transforms
+    return toRenderBox(o)->borderBoxRect().contains(roundedIntPoint(localPoint));
 }
 #endif
 
 Color RenderTheme::activeSelectionBackgroundColor() const
 {
-    if (!m_activeSelectionColor.isValid())
-        m_activeSelectionColor = platformActiveSelectionBackgroundColor().blendWithWhite();
-    return m_activeSelectionColor;
+    if (!m_activeSelectionBackgroundColor.isValid())
+        m_activeSelectionBackgroundColor = platformActiveSelectionBackgroundColor().blendWithWhite();
+    return m_activeSelectionBackgroundColor;
 }
 
 Color RenderTheme::inactiveSelectionBackgroundColor() const
 {
-    if (!m_inactiveSelectionColor.isValid())
-        m_inactiveSelectionColor = platformInactiveSelectionBackgroundColor().blendWithWhite();
-    return m_inactiveSelectionColor;
+    if (!m_inactiveSelectionBackgroundColor.isValid())
+        m_inactiveSelectionBackgroundColor = platformInactiveSelectionBackgroundColor().blendWithWhite();
+    return m_inactiveSelectionBackgroundColor;
+}
+
+Color RenderTheme::activeSelectionForegroundColor() const
+{
+    if (!m_activeSelectionForegroundColor.isValid() && supportsSelectionForegroundColors())
+        m_activeSelectionForegroundColor = platformActiveSelectionForegroundColor();
+    return m_activeSelectionForegroundColor;
+}
+
+Color RenderTheme::inactiveSelectionForegroundColor() const
+{
+    if (!m_inactiveSelectionForegroundColor.isValid() && supportsSelectionForegroundColors())
+        m_inactiveSelectionForegroundColor = platformInactiveSelectionForegroundColor();
+    return m_inactiveSelectionForegroundColor;
+}
+
+Color RenderTheme::activeListBoxSelectionBackgroundColor() const
+{
+    if (!m_activeListBoxSelectionBackgroundColor.isValid())
+        m_activeListBoxSelectionBackgroundColor = platformActiveListBoxSelectionBackgroundColor();
+    return m_activeListBoxSelectionBackgroundColor;
+}
+
+Color RenderTheme::inactiveListBoxSelectionBackgroundColor() const
+{
+    if (!m_inactiveListBoxSelectionBackgroundColor.isValid())
+        m_inactiveListBoxSelectionBackgroundColor = platformInactiveListBoxSelectionBackgroundColor();
+    return m_inactiveListBoxSelectionBackgroundColor;
+}
+
+Color RenderTheme::activeListBoxSelectionForegroundColor() const
+{
+    if (!m_activeListBoxSelectionForegroundColor.isValid() && supportsListBoxSelectionForegroundColors())
+        m_activeListBoxSelectionForegroundColor = platformActiveListBoxSelectionForegroundColor();
+    return m_activeListBoxSelectionForegroundColor;
+}
+
+Color RenderTheme::inactiveListBoxSelectionForegroundColor() const
+{
+    if (!m_inactiveListBoxSelectionForegroundColor.isValid() && supportsListBoxSelectionForegroundColors())
+        m_inactiveListBoxSelectionForegroundColor = platformInactiveListBoxSelectionForegroundColor();
+    return m_inactiveListBoxSelectionForegroundColor;
 }
 
 Color RenderTheme::platformActiveSelectionBackgroundColor() const
@@ -391,50 +441,56 @@ Color RenderTheme::platformActiveSelectionBackgroundColor() const
     return Color(0, 0, 255);
 }
 
-Color RenderTheme::platformInactiveSelectionBackgroundColor() const
+Color RenderTheme::platformActiveSelectionForegroundColor() const
 {
-    // Use a grey color by default if the platform theme doesn't define anything.
-    return Color(128, 128, 128);
+    // Use a white color by default if the platform theme doesn't define anything.
+    return Color::white;
 }
 
-Color RenderTheme::platformActiveSelectionForegroundColor() const
+Color RenderTheme::platformInactiveSelectionBackgroundColor() const
 {
-    return Color();
+    // Use a grey color by default if the platform theme doesn't define anything.
+    // This color matches Firefox's inactive color.
+    return Color(176, 176, 176);
 }
 
 Color RenderTheme::platformInactiveSelectionForegroundColor() const
 {
-    return Color();
+    // Use a black color by default.
+    return Color::black;
 }
 
-Color RenderTheme::activeListBoxSelectionBackgroundColor() const
+Color RenderTheme::platformActiveListBoxSelectionBackgroundColor() const
 {
-    return activeSelectionBackgroundColor();
+    return platformActiveSelectionBackgroundColor();
 }
 
-Color RenderTheme::activeListBoxSelectionForegroundColor() const
+Color RenderTheme::platformActiveListBoxSelectionForegroundColor() const
 {
-    // Use a white color by default if the platform theme doesn't define anything.
-    return Color(255, 255, 255);
+    return platformActiveSelectionForegroundColor();
 }
 
-Color RenderTheme::inactiveListBoxSelectionBackgroundColor() const
+Color RenderTheme::platformInactiveListBoxSelectionBackgroundColor() const
 {
-    return inactiveSelectionBackgroundColor();
+    return platformInactiveSelectionBackgroundColor();
 }
 
-Color RenderTheme::inactiveListBoxSelectionForegroundColor() const
+Color RenderTheme::platformInactiveListBoxSelectionForegroundColor() const
 {
-    // Use a black color by default if the platform theme doesn't define anything.
-    return Color(0, 0, 0);
+    return platformInactiveSelectionForegroundColor();
 }
 
 int RenderTheme::baselinePosition(const RenderObject* o) const
 {
+    if (!o->isBox())
+        return 0;
+
+    const RenderBox* box = toRenderBox(o);
+
 #if USE(NEW_THEME)
-    return o->height() + o->marginTop() + m_theme->baselinePositionAdjustment(o->style()->appearance()) * o->style()->effectiveZoom();
+    return box->height() + box->marginTop() + m_theme->baselinePositionAdjustment(o->style()->appearance()) * o->style()->effectiveZoom();
 #else
-    return o->height() + o->marginTop();
+    return box->height() + box->marginTop();
 #endif
 }
 
@@ -521,7 +577,7 @@ ControlStates RenderTheme::controlStatesForRenderer(const RenderObject* o) const
 
 bool RenderTheme::isActive(const RenderObject* o) const
 {
-    Node* node = o->element();
+    Node* node = o->node();
     if (!node)
         return false;
 
@@ -538,28 +594,39 @@ bool RenderTheme::isActive(const RenderObject* o) const
 
 bool RenderTheme::isChecked(const RenderObject* o) const
 {
-    if (!o->element())
+    if (!o->node() || !o->node()->isElementNode())
         return false;
-    return o->element()->isChecked();
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(o->node()));
+    if (!inputElement)
+        return false;
+
+    return inputElement->isChecked();
 }
 
 bool RenderTheme::isIndeterminate(const RenderObject* o) const
 {
-    if (!o->element())
+    if (!o->node() || !o->node()->isElementNode())
         return false;
-    return o->element()->isIndeterminate();
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(o->node()));
+    if (!inputElement)
+        return false;
+
+    return inputElement->isIndeterminate();
 }
 
 bool RenderTheme::isEnabled(const RenderObject* o) const
 {
-    if (!o->element())
+    Node* node = o->node();
+    if (!node || !node->isElementNode())
         return true;
-    return o->element()->isEnabled();
+    return static_cast<Element*>(node)->isEnabledFormControl();
 }
 
 bool RenderTheme::isFocused(const RenderObject* o) const
 {
-    Node* node = o->element();
+    Node* node = o->node();
     if (!node)
         return false;
     Document* document = node->document();
@@ -569,23 +636,24 @@ bool RenderTheme::isFocused(const RenderObject* o) const
 
 bool RenderTheme::isPressed(const RenderObject* o) const
 {
-    if (!o->element())
+    if (!o->node())
         return false;
-    return o->element()->active();
+    return o->node()->active();
 }
 
 bool RenderTheme::isReadOnlyControl(const RenderObject* o) const
 {
-    if (!o->element())
+    Node* node = o->node();
+    if (!node || !node->isElementNode())
         return false;
-    return o->element()->isReadOnlyControl();
+    return static_cast<Element*>(node)->isReadOnlyFormControl();
 }
 
 bool RenderTheme::isHovered(const RenderObject* o) const
 {
-    if (!o->element())
+    if (!o->node())
         return false;
-    return o->element()->hovered();
+    return o->node()->hovered();
 }
 
 bool RenderTheme::isDefault(const RenderObject* o) const
@@ -661,10 +729,6 @@ void RenderTheme::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Ele
 {
 }
 
-void RenderTheme::adjustButtonInnerStyle(RenderStyle*) const
-{
-}
-
 void RenderTheme::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const
 {
 }
@@ -699,8 +763,15 @@ void RenderTheme::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderS
 
 void RenderTheme::platformColorsDidChange()
 {
-    m_activeSelectionColor = Color();
-    m_inactiveSelectionColor = Color();
+    m_activeSelectionForegroundColor = Color();
+    m_inactiveSelectionForegroundColor = Color();
+    m_activeSelectionBackgroundColor = Color();
+    m_inactiveSelectionBackgroundColor = Color();
+
+    m_activeListBoxSelectionForegroundColor = Color();
+    m_inactiveListBoxSelectionForegroundColor = Color();
+    m_activeListBoxSelectionBackgroundColor = Color();
+    m_inactiveListBoxSelectionForegroundColor = Color();
 }
 
 Color RenderTheme::systemColor(int cssValueId) const
@@ -768,9 +839,14 @@ Color RenderTheme::systemColor(int cssValueId) const
     return Color();
 }
 
-Color RenderTheme::platformTextSearchHighlightColor() const
+Color RenderTheme::platformActiveTextSearchHighlightColor() const
+{
+    return Color(255, 150, 50); // Orange.
+}
+
+Color RenderTheme::platformInactiveTextSearchHighlightColor() const
 {
-    return Color(255, 255, 0);
+    return Color(255, 255, 0); // Yellow.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
index f948936a91..bc81d4d924 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
@@ -29,6 +29,7 @@
 #else
 #include "ThemeTypes.h"
 #endif
+#include "ScrollTypes.h"
 
 namespace WebCore {
 
@@ -104,23 +105,21 @@ public:
     // A method asking if the theme's controls actually care about redrawing when hovered.
     virtual bool supportsHover(const RenderStyle*) const { return false; }
 
-    // The selection color.
+    // Text selection colors.
     Color activeSelectionBackgroundColor() const;
     Color inactiveSelectionBackgroundColor() const;
+    Color activeSelectionForegroundColor() const;
+    Color inactiveSelectionForegroundColor() const;
 
-    virtual Color platformTextSearchHighlightColor() const;
+    // List box selection colors
+    Color activeListBoxSelectionBackgroundColor() const;
+    Color activeListBoxSelectionForegroundColor() const;
+    Color inactiveListBoxSelectionBackgroundColor() const;
+    Color inactiveListBoxSelectionForegroundColor() const;
 
-    // The platform selection color.
-    virtual Color platformActiveSelectionBackgroundColor() const;
-    virtual Color platformInactiveSelectionBackgroundColor() const;
-    virtual Color platformActiveSelectionForegroundColor() const;
-    virtual Color platformInactiveSelectionForegroundColor() const;
-
-    // List Box selection color
-    virtual Color activeListBoxSelectionBackgroundColor() const;
-    virtual Color activeListBoxSelectionForegroundColor() const;
-    virtual Color inactiveListBoxSelectionBackgroundColor() const;
-    virtual Color inactiveListBoxSelectionForegroundColor() const;
+    // Highlighting colors for TextMatches.
+    virtual Color platformActiveTextSearchHighlightColor() const;
+    virtual Color platformInactiveTextSearchHighlightColor() const;
 
     virtual void platformColorsDidChange();
 
@@ -132,22 +131,44 @@ public:
 
     virtual int minimumMenuListSize(RenderStyle*) const { return 0; }
 
-    virtual void adjustButtonInnerStyle(RenderStyle*) const;
     virtual void adjustSliderThumbSize(RenderObject*) const;
 
     virtual int popupInternalPaddingLeft(RenderStyle*) const { return 0; }
     virtual int popupInternalPaddingRight(RenderStyle*) const { return 0; }
     virtual int popupInternalPaddingTop(RenderStyle*) const { return 0; }
     virtual int popupInternalPaddingBottom(RenderStyle*) const { return 0; }
-    
+    virtual bool popupOptionSupportsTextIndent() const { return false; }
+
+    virtual int buttonInternalPaddingLeft() const { return 0; }
+    virtual int buttonInternalPaddingRight() const { return 0; }
+    virtual int buttonInternalPaddingTop() const { return 0; }
+    virtual int buttonInternalPaddingBottom() const { return 0; }
+
+    virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return RegularScrollbar; }
+
     // Method for painting the caps lock indicator
     virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return 0; };
 
 #if ENABLE(VIDEO)
+    // Media controls
     virtual bool hitTestMediaControlPart(RenderObject*, const IntPoint& absPoint);
 #endif
 
 protected:
+    // The platform selection color.
+    virtual Color platformActiveSelectionBackgroundColor() const;
+    virtual Color platformInactiveSelectionBackgroundColor() const;
+    virtual Color platformActiveSelectionForegroundColor() const;
+    virtual Color platformInactiveSelectionForegroundColor() const;
+
+    virtual Color platformActiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformInactiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformActiveListBoxSelectionForegroundColor() const;
+    virtual Color platformInactiveListBoxSelectionForegroundColor() const;
+
+    virtual bool supportsSelectionForegroundColors() const { return true; }
+    virtual bool supportsListBoxSelectionForegroundColors() const { return true; }
+
 #if !USE(NEW_THEME)
     // Methods for each appearance value.
     virtual void adjustCheckboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
@@ -203,6 +224,9 @@ protected:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaTimelineContainer(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
 
 public:
     // Methods for state querying
@@ -218,8 +242,16 @@ public:
     bool isDefault(const RenderObject*) const;
 
 private:
-    mutable Color m_activeSelectionColor;
-    mutable Color m_inactiveSelectionColor;
+    mutable Color m_activeSelectionBackgroundColor;
+    mutable Color m_inactiveSelectionBackgroundColor;
+    mutable Color m_activeSelectionForegroundColor;
+    mutable Color m_inactiveSelectionForegroundColor;
+
+    mutable Color m_activeListBoxSelectionBackgroundColor;
+    mutable Color m_inactiveListBoxSelectionBackgroundColor;
+    mutable Color m_activeListBoxSelectionForegroundColor;
+    mutable Color m_inactiveListBoxSelectionForegroundColor;
+
 #if USE(NEW_THEME)
     Theme* m_theme; // The platform-specific theme.
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
new file mode 100644
index 0000000000..94ee64ff5e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -0,0 +1,607 @@
+/*
+ * Copyright (C) 2007 Apple Inc.
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2008 Collabora Ltd.
+ * Copyright (C) 2008, 2009 Google Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderThemeChromiumLinux.h"
+
+#include "ChromiumBridge.h"
+#include "CSSValueKeywords.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "Image.h"
+#include "MediaControlElements.h"
+#include "PlatformContextSkia.h"
+#include "RenderBox.h"
+#include "RenderObject.h"
+#include "ScrollbarTheme.h"
+#include "TransformationMatrix.h"
+#include "UserAgentStyleSheets.h"
+
+#include "SkShader.h"
+#include "SkGradientShader.h"
+
+namespace WebCore {
+
+enum PaddingType {
+    TopPadding,
+    RightPadding,
+    BottomPadding,
+    LeftPadding
+};
+
+static const int styledMenuListInternalPadding[4] = { 1, 4, 1, 4 };
+
+// The default variable-width font size.  We use this as the default font
+// size for the "system font", and as a base size (which we then shrink) for
+// form control fonts.
+static const float defaultFontSize = 16.0;
+
+// The background for the media player controls should be a 60% opaque black rectangle. This
+// matches the UI mockups for the default UI theme.
+static const float defaultMediaControlOpacity = 0.6f;
+
+// These values all match Safari/Win.
+static const float defaultControlFontPixelSize = 13;
+static const float defaultCancelButtonSize = 9;
+static const float minCancelButtonSize = 5;
+static const float maxCancelButtonSize = 21;
+static const float defaultSearchFieldResultsDecorationSize = 13;
+static const float minSearchFieldResultsDecorationSize = 9;
+static const float maxSearchFieldResultsDecorationSize = 30;
+static const float defaultSearchFieldResultsButtonWidth = 18;
+
+static bool supportsFocus(ControlPart appearance)
+{
+    // This causes WebKit to draw the focus rings for us.
+    return false;
+}
+
+static void setSizeIfAuto(RenderStyle* style, const IntSize& size)
+{
+    if (style->width().isIntrinsicOrAuto())
+        style->setWidth(Length(size.width(), Fixed));
+    if (style->height().isAuto())
+        style->setHeight(Length(size.height(), Fixed));
+}
+
+// We aim to match IE here.
+// -IE uses a font based on the encoding as the default font for form controls.
+// -Gecko uses MS Shell Dlg (actually calls GetStockObject(DEFAULT_GUI_FONT),
+// which returns MS Shell Dlg)
+// -Safari uses Lucida Grande.
+//
+// FIXME: The only case where we know we don't match IE is for ANSI encodings.
+// IE uses MS Shell Dlg there, which we render incorrectly at certain pixel
+// sizes (e.g. 15px). So, for now we just use Arial.
+static const char* defaultGUIFont()
+{
+    return "Arial";
+}
+
+#if ENABLE(VIDEO)
+// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
+static HTMLMediaElement* mediaElementParent(Node* node)
+{
+    if (!node)
+        return 0;
+    Node* mediaNode = node->shadowAncestorNode();
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+#endif
+
+RenderTheme* theme()
+{
+    static RenderThemeChromiumLinux theme;
+    return &theme;
+}
+
+RenderThemeChromiumLinux::RenderThemeChromiumLinux()
+{
+}
+
+// Use the Windows style sheets to match their metrics.
+String RenderThemeChromiumLinux::extraDefaultStyleSheet()
+{
+    return String(themeWinUserAgentStyleSheet, sizeof(themeWinUserAgentStyleSheet));
+}
+
+String RenderThemeChromiumLinux::extraQuirksStyleSheet()
+{
+    return String(themeWinQuirksUserAgentStyleSheet, sizeof(themeWinQuirksUserAgentStyleSheet));
+}
+
+#if ENABLE(VIDEO)
+String RenderThemeChromiumLinux::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
+}
+#endif
+
+bool RenderThemeChromiumLinux::supportsFocusRing(const RenderStyle* style) const
+{
+    return supportsFocus(style->appearance());
+}
+
+Color RenderThemeChromiumLinux::platformActiveSelectionBackgroundColor() const
+{
+    return Color(0x1e, 0x90, 0xff);
+}
+
+Color RenderThemeChromiumLinux::platformInactiveSelectionBackgroundColor() const
+{
+    return Color(0xc8, 0xc8, 0xc8);
+}
+
+Color RenderThemeChromiumLinux::platformActiveSelectionForegroundColor() const
+{
+    return Color::black;
+}
+
+Color RenderThemeChromiumLinux::platformInactiveSelectionForegroundColor() const
+{
+    return Color(0x32, 0x32, 0x32);
+}
+
+Color RenderThemeChromiumLinux::platformTextSearchHighlightColor() const
+{
+    return Color(0xff, 0xff, 0x96);
+}
+
+double RenderThemeChromiumLinux::caretBlinkInterval() const
+{
+    // Disable the blinking caret in layout test mode, as it introduces
+    // a race condition for the pixel tests. http://b/1198440
+    if (ChromiumBridge::layoutTestMode())
+        return 0;
+
+    // We cache the interval so we don't have to repeatedly request it from gtk.
+    return 0.5;
+}
+
+void RenderThemeChromiumLinux::systemFont(int propId, FontDescription& fontDescription) const
+{
+    float fontSize = defaultFontSize;
+
+    switch (propId) {
+    case CSSValueWebkitMiniControl:
+    case CSSValueWebkitSmallControl:
+    case CSSValueWebkitControl:
+        // Why 2 points smaller? Because that's what Gecko does. Note that we
+        // are assuming a 96dpi screen, which is the default that we use on
+        // Windows.
+        static const float pointsPerInch = 72.0f;
+        static const float pixelsPerInch = 96.0f;
+        fontSize -= (2.0f / pointsPerInch) * pixelsPerInch;
+        break;
+    }
+
+    fontDescription.firstFamily().setFamily(defaultGUIFont());
+    fontDescription.setSpecifiedSize(fontSize);
+    fontDescription.setIsAbsoluteSize(true);
+    fontDescription.setGenericFamily(FontDescription::NoFamily);
+    fontDescription.setWeight(FontWeightNormal);
+    fontDescription.setItalic(false);
+}
+
+int RenderThemeChromiumLinux::minimumMenuListSize(RenderStyle* style) const
+{
+    return 0;
+}
+
+bool RenderThemeChromiumLinux::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    static Image* const checkedImage = Image::loadPlatformResource("linuxCheckboxOn").releaseRef();
+    static Image* const uncheckedImage = Image::loadPlatformResource("linuxCheckboxOff").releaseRef();
+
+    Image* image = this->isChecked(o) ? checkedImage : uncheckedImage;
+    i.context->drawImage(image, rect);
+    return false;
+}
+
+void RenderThemeChromiumLinux::setCheckboxSize(RenderStyle* style) const
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    // FIXME:  A hard-coded size of 13 is used.  This is wrong but necessary
+    // for now.  It matches Firefox.  At different DPI settings on Windows,
+    // querying the theme gives you a larger size that accounts for the higher
+    // DPI.  Until our entire engine honors a DPI setting other than 96, we
+    // can't rely on the theme's metrics.
+    const IntSize size(13, 13);
+    setSizeIfAuto(style, size);
+}
+
+bool RenderThemeChromiumLinux::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    static Image* const checkedImage = Image::loadPlatformResource("linuxRadioOn").releaseRef();
+    static Image* const uncheckedImage = Image::loadPlatformResource("linuxRadioOff").releaseRef();
+
+    Image* image = this->isChecked(o) ? checkedImage : uncheckedImage;
+    i.context->drawImage(image, rect);
+    return false;
+}
+
+void RenderThemeChromiumLinux::setRadioSize(RenderStyle* style) const
+{
+    // Use same sizing for radio box as checkbox.
+    setCheckboxSize(style);
+}
+
+static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect) {
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+    SkPaint paint;
+    SkRect skrect;
+    const int right = rect.x() + rect.width();
+    const int bottom = rect.y() + rect.height();
+
+    // If the button is too small, fallback to drawing a single, solid color
+    if (rect.width() < 5 || rect.height() < 5) {
+        paint.setARGB(0xff, 0xe9, 0xe9, 0xe9);
+        skrect.set(rect.x(), rect.y(), right, bottom);
+        canvas->drawRect(skrect, paint);
+        return;
+    }
+
+    const int borderAlpha = theme->isHovered(o) ? 0x80 : 0x55;
+    paint.setARGB(borderAlpha, 0, 0, 0);
+    canvas->drawLine(rect.x() + 1, rect.y(), right - 1, rect.y(), paint);
+    canvas->drawLine(right - 1, rect.y() + 1, right - 1, bottom - 1, paint);
+    canvas->drawLine(rect.x() + 1, bottom - 1, right - 1, bottom - 1, paint);
+    canvas->drawLine(rect.x(), rect.y() + 1, rect.x(), bottom - 1, paint);
+
+    paint.setARGB(0xff, 0, 0, 0);
+    SkPoint p[2];
+    const int lightEnd = theme->isPressed(o) ? 1 : 0;
+    const int darkEnd = !lightEnd;
+    p[lightEnd].set(SkIntToScalar(rect.x()), SkIntToScalar(rect.y()));
+    p[darkEnd].set(SkIntToScalar(rect.x()), SkIntToScalar(bottom - 1));
+    SkColor colors[2];
+    colors[0] = SkColorSetARGB(0xff, 0xf8, 0xf8, 0xf8);
+    colors[1] = SkColorSetARGB(0xff, 0xdd, 0xdd, 0xdd);
+
+    SkShader* s = SkGradientShader::CreateLinear(
+        p, colors, NULL, 2, SkShader::kClamp_TileMode, NULL);
+    paint.setStyle(SkPaint::kFill_Style);
+    paint.setShader(s);
+    s->unref();
+
+    skrect.set(rect.x() + 1, rect.y() + 1, right - 1, bottom - 1);
+    canvas->drawRect(skrect, paint);
+
+    paint.setShader(NULL);
+    paint.setARGB(0xff, 0xce, 0xce, 0xce);
+    canvas->drawPoint(rect.x() + 1, rect.y() + 1, paint);
+    canvas->drawPoint(right - 2, rect.y() + 1, paint);
+    canvas->drawPoint(rect.x() + 1, bottom - 2, paint);
+    canvas->drawPoint(right - 2, bottom - 2, paint);
+}
+
+bool RenderThemeChromiumLinux::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    paintButtonLike(this, o, i, rect);
+    return false;
+}
+
+bool RenderThemeChromiumLinux::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    return true;
+}
+
+void RenderThemeChromiumLinux::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int cancelButtonSize = lroundf(std::min(std::max(minCancelButtonSize, defaultCancelButtonSize * fontScale), maxCancelButtonSize));
+    style->setWidth(Length(cancelButtonSize, Fixed));
+    style->setHeight(Length(cancelButtonSize, Fixed));
+}
+
+bool RenderThemeChromiumLinux::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled button stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
+    static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
+    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    return false;
+}
+
+void RenderThemeChromiumLinux::adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    IntSize emptySize(1, 11);
+    style->setWidth(Length(emptySize.width(), Fixed));
+    style->setHeight(Length(emptySize.height(), Fixed));
+}
+
+void RenderThemeChromiumLinux::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the decoration size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierSize = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                         maxSearchFieldResultsDecorationSize));
+    style->setWidth(Length(magnifierSize, Fixed));
+    style->setHeight(Length(magnifierSize, Fixed));
+}
+
+bool RenderThemeChromiumLinux::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the decoration vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+    
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+void RenderThemeChromiumLinux::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierHeight = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                           maxSearchFieldResultsDecorationSize));
+    int magnifierWidth = lroundf(magnifierHeight * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize);
+    style->setWidth(Length(magnifierWidth, Fixed));
+    style->setHeight(Length(magnifierHeight, Fixed));
+}
+
+bool RenderThemeChromiumLinux::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent())
+        return false;
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.height(), bounds.height()));
+    bounds.setWidth(std::min(parentBox.width(), static_cast<int>(bounds.height() * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize)));
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+bool RenderThemeChromiumLinux::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    context->beginTransparencyLayer(defaultMediaControlOpacity);
+
+    // Draw background.
+    Color oldFill = context->fillColor();
+    Color oldStroke = context->strokeColor();
+
+    context->setFillColor(Color::black);
+    context->setStrokeColor(Color::black);
+    context->drawRect(rect);
+
+    context->setFillColor(oldFill);
+    context->setStrokeColor(oldStroke);
+
+    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
+    IntRect imageRect = image->rect();
+    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
+    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
+
+    context->drawImage(image, imageRect, CompositeSourceAtop);
+    context->endTransparencyLayer();
+
+    return false;
+}
+
+bool RenderThemeChromiumLinux::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
+    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+#else
+    return false;
+#endif
+}
+
+bool RenderThemeChromiumLinux::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
+    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+#else
+    return false;
+#endif
+}
+
+void RenderThemeChromiumLinux::adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle* style, WebCore::Element* e) const
+{
+    // Height is locked to auto on all browsers.
+    style->setLineHeight(RenderStyle::initialLineHeight());
+}
+
+bool RenderThemeChromiumLinux::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+    const int right = rect.x() + rect.width();
+    const int middle = rect.y() + rect.height() / 2;
+
+    paintButtonLike(this, o, i, rect);
+
+    SkPaint paint;
+    paint.setARGB(0xff, 0, 0, 0);
+    paint.setAntiAlias(true);
+    paint.setStyle(SkPaint::kFill_Style);
+
+    SkPath path;
+    path.moveTo(right - 13, middle - 3);
+    path.rLineTo(6, 0);
+    path.rLineTo(-3, 6);
+    path.close();
+    canvas->drawPath(path, paint);
+
+    return false;
+}
+
+void RenderThemeChromiumLinux::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    adjustMenuListStyle(selector, style, e);
+}
+
+// Used to paint styled menulists (i.e. with a non-default border)
+bool RenderThemeChromiumLinux::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    return paintMenuList(o, i, rect);
+}
+
+int RenderThemeChromiumLinux::popupInternalPaddingLeft(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, LeftPadding);
+}
+
+int RenderThemeChromiumLinux::popupInternalPaddingRight(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, RightPadding);
+}
+
+int RenderThemeChromiumLinux::popupInternalPaddingTop(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, TopPadding);
+}
+
+int RenderThemeChromiumLinux::popupInternalPaddingBottom(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, BottomPadding);
+}
+
+int RenderThemeChromiumLinux::buttonInternalPaddingLeft() const
+{
+    return 3;
+}
+
+int RenderThemeChromiumLinux::buttonInternalPaddingRight() const
+{
+    return 3;
+}
+
+int RenderThemeChromiumLinux::buttonInternalPaddingTop() const
+{
+    return 1;
+}
+
+int RenderThemeChromiumLinux::buttonInternalPaddingBottom() const
+{
+    return 1;
+}
+
+bool RenderThemeChromiumLinux::controlSupportsTints(const RenderObject* o) const
+{
+    return isEnabled(o);
+}
+
+Color RenderThemeChromiumLinux::activeListBoxSelectionBackgroundColor() const
+{
+    return Color(0x28, 0x28, 0x28);
+}
+
+Color RenderThemeChromiumLinux::activeListBoxSelectionForegroundColor() const
+{
+    return Color::black;
+}
+
+Color RenderThemeChromiumLinux::inactiveListBoxSelectionBackgroundColor() const
+{
+    return Color(0xc8, 0xc8, 0xc8);
+}
+
+Color RenderThemeChromiumLinux::inactiveListBoxSelectionForegroundColor() const
+{
+    return Color(0x32, 0x32, 0x32);
+}
+
+int RenderThemeChromiumLinux::menuListInternalPadding(RenderStyle* style, int paddingType) const
+{
+    // This internal padding is in addition to the user-supplied padding.
+    // Matches the FF behavior.
+    int padding = styledMenuListInternalPadding[paddingType];
+
+    // Reserve the space for right arrow here. The rest of the padding is
+    // set by adjustMenuListStyle, since PopMenuWin.cpp uses the padding from
+    // RenderMenuList to lay out the individual items in the popup.
+    // If the MenuList actually has appearance "NoAppearance", then that means
+    // we don't draw a button, so don't reserve space for it.
+    const int bar_type = style->direction() == LTR ? RightPadding : LeftPadding;
+    if (paddingType == bar_type && style->appearance() != NoControlPart)
+        padding += ScrollbarTheme::nativeTheme()->scrollbarThickness();
+
+    return padding;
+}
+
+}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
new file mode 100644
index 0000000000..78385092f5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -0,0 +1,138 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
+ * Copyright (C) 2007 Holger Hans Peter Freyther
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2008, 2009 Google, Inc.
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderThemeChromiumLinux_h
+#define RenderThemeChromiumLinux_h
+
+#include "RenderTheme.h"
+
+namespace WebCore {
+
+    class RenderThemeChromiumLinux : public RenderTheme {
+    public:
+        RenderThemeChromiumLinux();
+        ~RenderThemeChromiumLinux() { }
+
+        virtual String extraDefaultStyleSheet();
+        virtual String extraQuirksStyleSheet();
+#if ENABLE(VIDEO)
+        virtual String extraMediaControlsStyleSheet();
+#endif
+
+        // A method asking if the theme's controls actually care about redrawing when hovered.
+        virtual bool supportsHover(const RenderStyle*) const { return true; }
+
+        // A method asking if the theme is able to draw the focus ring.
+        virtual bool supportsFocusRing(const RenderStyle*) const;
+
+        // The platform selection color.
+        virtual Color platformActiveSelectionBackgroundColor() const;
+        virtual Color platformInactiveSelectionBackgroundColor() const;
+        virtual Color platformActiveSelectionForegroundColor() const;
+        virtual Color platformInactiveSelectionForegroundColor() const;
+        virtual Color platformTextSearchHighlightColor() const;
+
+        virtual double caretBlinkInterval() const;
+
+        // System fonts.
+        virtual void systemFont(int propId, FontDescription&) const;
+
+        virtual int minimumMenuListSize(RenderStyle*) const;
+
+        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setCheckboxSize(RenderStyle*) const;
+
+        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setRadioSize(RenderStyle*) const;
+
+        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintTextField(o, i, r); }
+
+        virtual bool paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintTextField(o, i, r); }
+
+        virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        // MenuList refers to an unstyled menulist (meaning a menulist without
+        // background-color or border set) and MenuListButton refers to a styled
+        // menulist (a menulist with background-color or border set). They have
+        // this distinction to support showing aqua style themes whenever they
+        // possibly can, which is something we don't want to replicate.
+        //
+        // In short, we either go down the MenuList code path or the MenuListButton
+        // codepath. We never go down both. And in both cases, they render the
+        // entire menulist.
+        virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        // These methods define the padding for the MenuList's inner block.
+        virtual int popupInternalPaddingLeft(RenderStyle*) const;
+        virtual int popupInternalPaddingRight(RenderStyle*) const;
+        virtual int popupInternalPaddingTop(RenderStyle*) const;
+        virtual int popupInternalPaddingBottom(RenderStyle*) const;
+
+        virtual int buttonInternalPaddingLeft() const;
+        virtual int buttonInternalPaddingRight() const;
+        virtual int buttonInternalPaddingTop() const;
+        virtual int buttonInternalPaddingBottom() const;
+
+        // A method asking if the control changes its tint when the window has focus or not.
+        virtual bool controlSupportsTints(const RenderObject*) const;
+
+        // A general method asking if any control tinting is supported at all.
+        virtual bool supportsControlTints() const { return true; }
+
+        // List Box selection color
+        virtual Color activeListBoxSelectionBackgroundColor() const;
+        virtual Color activeListBoxSelectionForegroundColor() const;
+        virtual Color inactiveListBoxSelectionBackgroundColor() const;
+        virtual Color inactiveListBoxSelectionForegroundColor() const;
+
+    private:
+        int menuListInternalPadding(RenderStyle*, int paddingType) const;
+        bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
new file mode 100644
index 0000000000..f072000d93
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
@@ -0,0 +1,215 @@
+/*
+ * This file is part of the theme implementation for form controls in WebCore.
+ *
+ * Copyright (C) 2005 Apple Computer, Inc.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderThemeChromiumMac_h
+#define RenderThemeChromiumMac_h
+
+#import "RenderTheme.h"
+#import <AppKit/AppKit.h>
+#import <wtf/HashMap.h>
+#import <wtf/RetainPtr.h>
+
+#ifdef __OBJC__
+@class WebCoreRenderThemeNotificationObserver;
+#else
+class WebCoreRenderThemeNotificationObserver;
+#endif
+
+namespace WebCore {
+
+    class RenderStyle;
+
+    class RenderThemeChromiumMac : public RenderTheme {
+    public:
+        RenderThemeChromiumMac();
+        virtual ~RenderThemeChromiumMac();
+
+        // A method to obtain the baseline position for a "leaf" control.  This will only be used if a baseline
+        // position cannot be determined by examining child content. Checkboxes and radio buttons are examples of
+        // controls that need to do this.
+        virtual int baselinePosition(const RenderObject*) const;
+
+        // A method asking if the control changes its tint when the window has focus or not.
+        virtual bool controlSupportsTints(const RenderObject*) const;
+
+        // A general method asking if any control tinting is supported at all.
+        virtual bool supportsControlTints() const { return true; }
+
+        virtual void adjustRepaintRect(const RenderObject*, IntRect&);
+
+        virtual bool isControlStyled(const RenderStyle*, const BorderData&,
+                                     const FillLayer&, const Color& backgroundColor) const;
+
+        virtual Color platformActiveSelectionBackgroundColor() const;
+        virtual Color platformInactiveSelectionBackgroundColor() const;
+        virtual Color activeListBoxSelectionBackgroundColor() const;
+        
+        virtual void platformColorsDidChange();
+
+        // System fonts.
+        virtual void systemFont(int cssValueId, FontDescription&) const;
+
+        virtual int minimumMenuListSize(RenderStyle*) const;
+
+        virtual void adjustSliderThumbSize(RenderObject*) const;
+        
+        virtual int popupInternalPaddingLeft(RenderStyle*) const;
+        virtual int popupInternalPaddingRight(RenderStyle*) const;
+        virtual int popupInternalPaddingTop(RenderStyle*) const;
+        virtual int popupInternalPaddingBottom(RenderStyle*) const;
+        
+        virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
+    
+        virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual Color systemColor(int cssValueId) const;
+
+    protected:
+        virtual bool supportsSelectionForegroundColors() const { return false; }
+
+        // Methods for each appearance value.
+        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setCheckboxSize(RenderStyle*) const;
+
+        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setRadioSize(RenderStyle*) const;
+
+        virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
+        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setButtonSize(RenderStyle*) const;
+
+        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    private:
+        IntRect inflateRect(const IntRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
+
+        // Get the control size based off the font.  Used by some of the controls (like buttons).
+        NSControlSize controlSizeForFont(RenderStyle*) const;
+        NSControlSize controlSizeForSystemFont(RenderStyle*) const;
+        void setControlSize(NSCell*, const IntSize* sizes, const IntSize& minSize, float zoomLevel = 1.0f);
+        void setSizeFromFont(RenderStyle*, const IntSize* sizes) const;
+        IntSize sizeForFont(RenderStyle*, const IntSize* sizes) const;
+        IntSize sizeForSystemFont(RenderStyle*, const IntSize* sizes) const;
+        void setFontFromControlSize(CSSStyleSelector*, RenderStyle*, NSControlSize) const;
+
+        void updateCheckedState(NSCell*, const RenderObject*);
+        void updateEnabledState(NSCell*, const RenderObject*);
+        void updateFocusedState(NSCell*, const RenderObject*);
+        void updatePressedState(NSCell*, const RenderObject*);
+
+        // Helpers for adjusting appearance and for painting
+        const IntSize* checkboxSizes() const;
+        const int* checkboxMargins() const;
+        void setCheckboxCellState(const RenderObject*, const IntRect&);
+
+        const IntSize* radioSizes() const;
+        const int* radioMargins() const;
+        void setRadioCellState(const RenderObject*, const IntRect&);
+
+        void setButtonPaddingFromControlSize(RenderStyle*, NSControlSize) const;
+        const IntSize* buttonSizes() const;
+        const int* buttonMargins() const;
+        void setButtonCellState(const RenderObject*, const IntRect&);
+
+        void setPopupButtonCellState(const RenderObject*, const IntRect&);
+        const IntSize* popupButtonSizes() const;
+        const int* popupButtonMargins() const;
+        const int* popupButtonPadding(NSControlSize) const;
+        void paintMenuListButtonGradients(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        const IntSize* menuListSizes() const;
+
+        const IntSize* searchFieldSizes() const;
+        const IntSize* cancelButtonSizes() const;
+        const IntSize* resultsButtonSizes() const;
+        void setSearchCellState(RenderObject*, const IntRect&);
+        void setSearchFieldSize(RenderStyle*) const;
+        
+        NSButtonCell* checkbox() const;
+        NSButtonCell* radio() const;
+        NSButtonCell* button() const;
+        NSPopUpButtonCell* popupButton() const;
+        NSSearchFieldCell* search() const;
+        NSMenu* searchMenuTemplate() const;
+        NSSliderCell* sliderThumbHorizontal() const;
+        NSSliderCell* sliderThumbVertical() const;
+
+    private:
+        mutable RetainPtr<NSButtonCell> m_checkbox;
+        mutable RetainPtr<NSButtonCell> m_radio;
+        mutable RetainPtr<NSButtonCell> m_button;
+        mutable RetainPtr<NSPopUpButtonCell> m_popupButton;
+        mutable RetainPtr<NSSearchFieldCell> m_search;
+        mutable RetainPtr<NSMenu> m_searchMenuTemplate;
+        mutable RetainPtr<NSSliderCell> m_sliderThumbHorizontal;
+        mutable RetainPtr<NSSliderCell> m_sliderThumbVertical;
+
+        bool m_isSliderThumbHorizontalPressed;
+        bool m_isSliderThumbVerticalPressed;
+
+        mutable HashMap<int, RGBA32> m_systemColorCache;
+
+        RetainPtr<WebCoreRenderThemeNotificationObserver> m_notificationObserver;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
new file mode 100644
index 0000000000..f6081a5ba2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -0,0 +1,1997 @@
+/*
+ * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+// FIXME: we still need to figure out if passing a null view to the cell
+// drawing routines will work. I expect not, and if that's the case we'll have
+// to figure out something else. For now, at least leave the lines commented
+// in, but the procurement of the view if 0'd.
+
+#import "config.h"
+#import "RenderThemeChromiumMac.h"
+
+#import <Carbon/Carbon.h>
+#import <Cocoa/Cocoa.h>
+#import <math.h>
+
+#import "BitmapImage.h"
+#import "CSSStyleSelector.h"
+#import "CSSValueKeywords.h"
+#import "Element.h"
+#import "FoundationExtras.h"
+#import "FrameView.h"
+#import "GraphicsContext.h"
+#import "HTMLInputElement.h"
+#import "HTMLMediaElement.h"
+#import "HTMLNames.h"
+#import "Image.h"
+#import "LocalCurrentGraphicsContext.h"
+#import "MediaControlElements.h"
+#import "RenderSlider.h"
+#import "RenderView.h"
+#import "SharedBuffer.h"
+#import "WebCoreSystemInterface.h"
+#import <wtf/RetainPtr.h>
+
+#ifdef BUILDING_ON_TIGER
+typedef int NSInteger;
+typedef unsigned NSUInteger;
+#endif
+
+using std::min;
+
+// The methods in this file are specific to the Mac OS X platform.
+
+// FIXME: The platform-independent code in this class should be factored out and merged with RenderThemeSafari. 
+
+@interface WebCoreRenderThemeNotificationObserver : NSObject
+{
+    WebCore::RenderTheme *_theme;
+}
+
+- (id)initWithTheme:(WebCore::RenderTheme *)theme;
+- (void)systemColorsDidChange:(NSNotification *)notification;
+
+@end
+
+@implementation WebCoreRenderThemeNotificationObserver
+
+- (id)initWithTheme:(WebCore::RenderTheme *)theme
+{
+    [super init];
+    _theme = theme;
+    
+    return self;
+}
+
+- (void)systemColorsDidChange:(NSNotification *)notification
+{
+    ASSERT([[notification name] isEqualToString:NSSystemColorsDidChangeNotification]);
+    _theme->platformColorsDidChange();
+}
+
+@end
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+enum {
+    TopMargin,
+    RightMargin,
+    BottomMargin,
+    LeftMargin
+};
+
+enum {
+    TopPadding,
+    RightPadding,
+    BottomPadding,
+    LeftPadding
+};
+
+// In our Mac port, we don't define PLATFORM(MAC) and thus don't pick up the
+// |operator NSRect()| on WebCore::IntRect and FloatRect. This substitues for
+// that missing conversion operator.
+NSRect IntRectToNSRect(const IntRect & rect)
+{
+    return NSMakeRect(rect.x(), rect.y(), rect.width(), rect.height());
+}
+
+NSRect FloatRectToNSRect(const FloatRect & rect)
+{
+    return NSMakeRect(rect.x(), rect.y(), rect.width(), rect.height());
+}
+
+IntRect NSRectToIntRect(const NSRect & rect)
+{
+    return IntRect(rect.origin.x, rect.origin.y, rect.size.width, rect.size.height);
+}
+
+RenderTheme* theme()
+{
+    static RenderThemeChromiumMac* macTheme = new RenderThemeChromiumMac;
+    return macTheme;
+}
+
+RenderThemeChromiumMac::RenderThemeChromiumMac()
+    : m_isSliderThumbHorizontalPressed(false)
+    , m_isSliderThumbVerticalPressed(false)
+    , m_notificationObserver(AdoptNS, [[WebCoreRenderThemeNotificationObserver alloc] initWithTheme:this])
+{
+    [[NSNotificationCenter defaultCenter] addObserver:m_notificationObserver.get()
+                                                        selector:@selector(systemColorsDidChange:)
+                                                            name:NSSystemColorsDidChangeNotification
+                                                          object:nil];
+}
+
+RenderThemeChromiumMac::~RenderThemeChromiumMac()
+{
+    [[NSNotificationCenter defaultCenter] removeObserver:m_notificationObserver.get()];
+}
+
+Color RenderThemeChromiumMac::platformActiveSelectionBackgroundColor() const
+{
+    NSColor* color = [[NSColor selectedTextBackgroundColor] colorUsingColorSpaceName:NSDeviceRGBColorSpace];
+    return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
+}
+
+Color RenderThemeChromiumMac::platformInactiveSelectionBackgroundColor() const
+{
+    NSColor* color = [[NSColor secondarySelectedControlColor] colorUsingColorSpaceName:NSDeviceRGBColorSpace];
+    return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
+}
+
+Color RenderThemeChromiumMac::activeListBoxSelectionBackgroundColor() const
+{
+    NSColor* color = [[NSColor alternateSelectedControlColor] colorUsingColorSpaceName:NSDeviceRGBColorSpace];
+    return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
+}
+
+static FontWeight toFontWeight(NSInteger appKitFontWeight)
+{
+    ASSERT(appKitFontWeight > 0 && appKitFontWeight < 15);
+    if (appKitFontWeight > 14)
+        appKitFontWeight = 14;
+    else if (appKitFontWeight < 1)
+        appKitFontWeight = 1;
+
+    static FontWeight fontWeights[] = {
+        FontWeight100,
+        FontWeight100,
+        FontWeight200,
+        FontWeight300,
+        FontWeight400,
+        FontWeight500,
+        FontWeight600,
+        FontWeight600,
+        FontWeight700,
+        FontWeight800,
+        FontWeight800,
+        FontWeight900,
+        FontWeight900,
+        FontWeight900
+    };
+    return fontWeights[appKitFontWeight - 1];
+}
+
+void RenderThemeChromiumMac::systemFont(int cssValueId, FontDescription& fontDescription) const
+{
+    static FontDescription systemFont;
+    static FontDescription smallSystemFont;
+    static FontDescription menuFont;
+    static FontDescription labelFont;
+    static FontDescription miniControlFont;
+    static FontDescription smallControlFont;
+    static FontDescription controlFont;
+
+    FontDescription* cachedDesc;
+    NSFont* font = nil;
+    switch (cssValueId) {
+    case CSSValueSmallCaption:
+        cachedDesc = &smallSystemFont;
+        if (!smallSystemFont.isAbsoluteSize())
+            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
+        break;
+    case CSSValueMenu:
+        cachedDesc = &menuFont;
+        if (!menuFont.isAbsoluteSize())
+            font = [NSFont menuFontOfSize:[NSFont systemFontSize]];
+        break;
+    case CSSValueStatusBar:
+        cachedDesc = &labelFont;
+        if (!labelFont.isAbsoluteSize())
+            font = [NSFont labelFontOfSize:[NSFont labelFontSize]];
+        break;
+    case CSSValueWebkitMiniControl:
+        cachedDesc = &miniControlFont;
+        if (!miniControlFont.isAbsoluteSize())
+            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSMiniControlSize]];
+        break;
+    case CSSValueWebkitSmallControl:
+        cachedDesc = &smallControlFont;
+        if (!smallControlFont.isAbsoluteSize())
+            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSSmallControlSize]];
+        break;
+    case CSSValueWebkitControl:
+        cachedDesc = &controlFont;
+        if (!controlFont.isAbsoluteSize())
+            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSRegularControlSize]];
+        break;
+    default:
+        cachedDesc = &systemFont;
+        if (!systemFont.isAbsoluteSize())
+            font = [NSFont systemFontOfSize:[NSFont systemFontSize]];
+    }
+
+    if (font) {
+        NSFontManager *fontManager = [NSFontManager sharedFontManager];
+        cachedDesc->setIsAbsoluteSize(true);
+        cachedDesc->setGenericFamily(FontDescription::NoFamily);
+        cachedDesc->firstFamily().setFamily([font familyName]);
+        cachedDesc->setSpecifiedSize([font pointSize]);
+        cachedDesc->setWeight(toFontWeight([fontManager weightOfFont:font]));
+        cachedDesc->setItalic([fontManager traitsOfFont:font] & NSItalicFontMask);
+    }
+    fontDescription = *cachedDesc;
+}
+
+static RGBA32 convertNSColorToColor(NSColor *color)
+{
+    NSColor *colorInColorSpace = [color colorUsingColorSpaceName:NSCalibratedRGBColorSpace];
+    if (colorInColorSpace) {
+        static const double scaleFactor = nextafter(256.0, 0.0);
+        return makeRGB(static_cast<int>(scaleFactor * [colorInColorSpace redComponent]),
+            static_cast<int>(scaleFactor * [colorInColorSpace greenComponent]),
+            static_cast<int>(scaleFactor * [colorInColorSpace blueComponent]));
+    }
+
+    // This conversion above can fail if the NSColor in question is an NSPatternColor 
+    // (as many system colors are). These colors are actually a repeating pattern
+    // not just a solid color. To work around this we simply draw a 1x1 image of
+    // the color and use that pixel's color. It might be better to use an average of
+    // the colors in the pattern instead.
+    NSBitmapImageRep *offscreenRep = [[NSBitmapImageRep alloc] initWithBitmapDataPlanes:nil
+                                                                             pixelsWide:1
+                                                                             pixelsHigh:1
+                                                                          bitsPerSample:8
+                                                                        samplesPerPixel:4
+                                                                               hasAlpha:YES
+                                                                               isPlanar:NO
+                                                                         colorSpaceName:NSCalibratedRGBColorSpace
+                                                                            bytesPerRow:4
+                                                                           bitsPerPixel:32];
+
+    [NSGraphicsContext saveGraphicsState];
+    [NSGraphicsContext setCurrentContext:[NSGraphicsContext graphicsContextWithBitmapImageRep:offscreenRep]];
+    NSEraseRect(NSMakeRect(0, 0, 1, 1));
+    [color drawSwatchInRect:NSMakeRect(0, 0, 1, 1)];
+    [NSGraphicsContext restoreGraphicsState];
+
+    NSUInteger pixel[4];
+    [offscreenRep getPixel:pixel atX:0 y:0];
+
+    [offscreenRep release];
+
+    return makeRGB(pixel[0], pixel[1], pixel[2]);
+}
+
+static RGBA32 menuBackgroundColor()
+{
+    NSBitmapImageRep *offscreenRep = [[NSBitmapImageRep alloc] initWithBitmapDataPlanes:nil
+                                                                             pixelsWide:1
+                                                                             pixelsHigh:1
+                                                                          bitsPerSample:8
+                                                                        samplesPerPixel:4
+                                                                               hasAlpha:YES
+                                                                               isPlanar:NO
+                                                                         colorSpaceName:NSCalibratedRGBColorSpace
+                                                                            bytesPerRow:4
+                                                                           bitsPerPixel:32];
+
+    CGContextRef context = static_cast<CGContextRef>([[NSGraphicsContext graphicsContextWithBitmapImageRep:offscreenRep] graphicsPort]);
+    CGRect rect = CGRectMake(0, 0, 1, 1);
+    HIThemeMenuDrawInfo drawInfo;
+    drawInfo.version =  0;
+    drawInfo.menuType = kThemeMenuTypePopUp;
+    HIThemeDrawMenuBackground(&rect, &drawInfo, context, kHIThemeOrientationInverted);
+
+    NSUInteger pixel[4];
+    [offscreenRep getPixel:pixel atX:0 y:0];
+
+    [offscreenRep release];
+
+    return makeRGB(pixel[0], pixel[1], pixel[2]);
+}
+
+void RenderThemeChromiumMac::platformColorsDidChange()
+{
+    m_systemColorCache.clear();
+    RenderTheme::platformColorsDidChange();
+}
+
+Color RenderThemeChromiumMac::systemColor(int cssValueId) const
+{
+    if (m_systemColorCache.contains(cssValueId))
+        return m_systemColorCache.get(cssValueId);
+    
+    Color color;
+    switch (cssValueId) {
+    case CSSValueActiveborder:
+        color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
+        break;
+    case CSSValueActivecaption:
+        color = convertNSColorToColor([NSColor windowFrameTextColor]);
+        break;
+    case CSSValueAppworkspace:
+        color = convertNSColorToColor([NSColor headerColor]);
+        break;
+    case CSSValueBackground:
+        // Use theme independent default
+        break;
+    case CSSValueButtonface:
+        // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
+        // We may want to change this to use the NSColor in future.
+        color = 0xFFC0C0C0;
+        break;
+    case CSSValueButtonhighlight:
+        color = convertNSColorToColor([NSColor controlHighlightColor]);
+        break;
+    case CSSValueButtonshadow:
+        color = convertNSColorToColor([NSColor controlShadowColor]);
+        break;
+    case CSSValueButtontext:
+        color = convertNSColorToColor([NSColor controlTextColor]);
+        break;
+    case CSSValueCaptiontext:
+        color = convertNSColorToColor([NSColor textColor]);
+        break;
+    case CSSValueGraytext:
+        color = convertNSColorToColor([NSColor disabledControlTextColor]);
+        break;
+    case CSSValueHighlight:
+        color = convertNSColorToColor([NSColor selectedTextBackgroundColor]);
+        break;
+    case CSSValueHighlighttext:
+        color = convertNSColorToColor([NSColor selectedTextColor]);
+        break;
+    case CSSValueInactiveborder:
+        color = convertNSColorToColor([NSColor controlBackgroundColor]);
+        break;
+    case CSSValueInactivecaption:
+        color = convertNSColorToColor([NSColor controlBackgroundColor]);
+        break;
+    case CSSValueInactivecaptiontext:
+        color = convertNSColorToColor([NSColor textColor]);
+        break;
+    case CSSValueInfobackground:
+        // There is no corresponding NSColor for this so we use a hard coded value.
+        color = 0xFFFBFCC5;
+        break;
+    case CSSValueInfotext:
+        color = convertNSColorToColor([NSColor textColor]);
+        break;
+    case CSSValueMenu:
+        color = menuBackgroundColor();
+        break;
+    case CSSValueMenutext:
+        color = convertNSColorToColor([NSColor selectedMenuItemTextColor]);
+        break;
+    case CSSValueScrollbar:
+        color = convertNSColorToColor([NSColor scrollBarColor]);
+        break;
+    case CSSValueText:
+        color = convertNSColorToColor([NSColor textColor]);
+        break;
+    case CSSValueThreeddarkshadow:
+        color = convertNSColorToColor([NSColor controlDarkShadowColor]);
+        break;
+    case CSSValueThreedshadow:
+        color = convertNSColorToColor([NSColor shadowColor]);
+        break;
+    case CSSValueThreedface:
+        // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
+        // We may want to change this to use the NSColor in future.
+        color = 0xFFC0C0C0;
+        break;
+    case CSSValueThreedhighlight:
+        color = convertNSColorToColor([NSColor highlightColor]);
+        break;
+    case CSSValueThreedlightshadow:
+        color = convertNSColorToColor([NSColor controlLightHighlightColor]);
+        break;
+    case CSSValueWindow:
+        color = convertNSColorToColor([NSColor windowBackgroundColor]);
+        break;
+    case CSSValueWindowframe:
+        color = convertNSColorToColor([NSColor windowFrameColor]);
+        break;
+    case CSSValueWindowtext:
+        color = convertNSColorToColor([NSColor windowFrameTextColor]);
+        break;
+    }
+
+    if (!color.isValid())
+        color = RenderTheme::systemColor(cssValueId);
+
+    if (color.isValid())
+        m_systemColorCache.set(cssValueId, color.rgb());
+
+    return color;
+}
+
+bool RenderThemeChromiumMac::isControlStyled(const RenderStyle* style, const BorderData& border,
+                                             const FillLayer& background, const Color& backgroundColor) const
+{
+    if (style->appearance() == TextFieldPart || style->appearance() == TextAreaPart || style->appearance() == ListboxPart)
+        return style->border() != border;
+        
+    // FIXME: This is horrible, but there is not much else that can be done.  Menu lists cannot draw properly when
+    // scaled.  They can't really draw properly when transformed either.  We can't detect the transform case at style
+    // adjustment time so that will just have to stay broken.  We can however detect that we're zooming.  If zooming
+    // is in effect we treat it like the control is styled.
+    if (style->appearance() == MenulistPart && style->effectiveZoom() != 1.0f)
+        return true;
+
+    return RenderTheme::isControlStyled(style, border, background, backgroundColor);
+}
+
+// FIXME: Use the code from the old upstream version, before it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::adjustRepaintRect(const RenderObject* o, IntRect& r)
+{
+    float zoomLevel = o->style()->effectiveZoom();
+
+    switch (o->style()->appearance()) {
+    case CheckboxPart: {
+        // Since we query the prototype cell, we need to update its state to match.
+        setCheckboxCellState(o, r);
+
+        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
+        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
+        IntSize size = checkboxSizes()[[checkbox() controlSize]];
+        size.setHeight(size.height() * zoomLevel);
+        size.setWidth(size.width() * zoomLevel);
+        r = inflateRect(r, size, checkboxMargins(), zoomLevel);
+        break;
+    }
+    case RadioPart: {
+        // Since we query the prototype cell, we need to update its state to match.
+        setRadioCellState(o, r);
+
+        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
+        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
+        IntSize size = radioSizes()[[radio() controlSize]];
+        size.setHeight(size.height() * zoomLevel);
+        size.setWidth(size.width() * zoomLevel);
+        r = inflateRect(r, size, radioMargins(), zoomLevel);
+        break;
+    }
+    case PushButtonPart:
+    case DefaultButtonPart:
+    case ButtonPart: {
+        // Since we query the prototype cell, we need to update its state to match.
+        setButtonCellState(o, r);
+
+        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
+        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
+        if ([button() bezelStyle] == NSRoundedBezelStyle) {
+            IntSize size = buttonSizes()[[button() controlSize]];
+            size.setHeight(size.height() * zoomLevel);
+            size.setWidth(r.width());
+            r = inflateRect(r, size, buttonMargins(), zoomLevel);
+        }
+        break;
+    }
+    case MenulistPart: {
+        setPopupButtonCellState(o, r);
+        IntSize size = popupButtonSizes()[[popupButton() controlSize]];
+        size.setHeight(size.height() * zoomLevel);
+        size.setWidth(r.width());
+        r = inflateRect(r, size, popupButtonMargins(), zoomLevel);
+        break;
+    }
+    default:
+        break;
+    }
+}
+
+IntRect RenderThemeChromiumMac::inflateRect(const IntRect& r, const IntSize& size, const int* margins, float zoomLevel) const
+{
+    // Only do the inflation if the available width/height are too small.  Otherwise try to
+    // fit the glow/check space into the available box's width/height.
+    int widthDelta = r.width() - (size.width() + margins[LeftMargin] * zoomLevel + margins[RightMargin] * zoomLevel);
+    int heightDelta = r.height() - (size.height() + margins[TopMargin] * zoomLevel + margins[BottomMargin] * zoomLevel);
+    IntRect result(r);
+    if (widthDelta < 0) {
+        result.setX(result.x() - margins[LeftMargin] * zoomLevel);
+        result.setWidth(result.width() - widthDelta);
+    }
+    if (heightDelta < 0) {
+        result.setY(result.y() - margins[TopMargin] * zoomLevel);
+        result.setHeight(result.height() - heightDelta);
+    }
+    return result;
+}
+
+void RenderThemeChromiumMac::updateCheckedState(NSCell* cell, const RenderObject* o)
+{
+    bool oldIndeterminate = [cell state] == NSMixedState;
+    bool indeterminate = isIndeterminate(o);
+    bool checked = isChecked(o);
+
+    if (oldIndeterminate != indeterminate) {
+        [cell setState:indeterminate ? NSMixedState : (checked ? NSOnState : NSOffState)];
+        return;
+    }
+
+    bool oldChecked = [cell state] == NSOnState;
+    if (checked != oldChecked)
+        [cell setState:checked ? NSOnState : NSOffState];
+}
+
+void RenderThemeChromiumMac::updateEnabledState(NSCell* cell, const RenderObject* o)
+{
+    bool oldEnabled = [cell isEnabled];
+    bool enabled = isEnabled(o);
+    if (enabled != oldEnabled)
+        [cell setEnabled:enabled];
+}
+
+void RenderThemeChromiumMac::updateFocusedState(NSCell* cell, const RenderObject* o)
+{
+    bool oldFocused = [cell showsFirstResponder];
+    bool focused = isFocused(o) && o->style()->outlineStyleIsAuto();
+    if (focused != oldFocused)
+        [cell setShowsFirstResponder:focused];
+}
+
+void RenderThemeChromiumMac::updatePressedState(NSCell* cell, const RenderObject* o)
+{
+    bool oldPressed = [cell isHighlighted];
+    bool pressed = (o->node() && o->node()->active());
+    if (pressed != oldPressed)
+        [cell setHighlighted:pressed];
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+int RenderThemeChromiumMac::baselinePosition(const RenderObject* o) const
+{
+    if (!o->isBox())
+        return 0;
+
+    if (o->style()->appearance() == CheckboxPart || o->style()->appearance() == RadioPart) {
+        const RenderBox* box = toRenderBox(o);
+        return box->marginTop() + box->height() - 2 * o->style()->effectiveZoom(); // The baseline is 2px up from the bottom of the checkbox/radio in AppKit.
+    }
+    return RenderTheme::baselinePosition(o);
+}
+
+bool RenderThemeChromiumMac::controlSupportsTints(const RenderObject* o) const
+{
+    // An alternate way to implement this would be to get the appropriate cell object
+    // and call the private _needRedrawOnWindowChangedKeyState method. An advantage of
+    // that would be that we would match AppKit behavior more closely, but a disadvantage
+    // would be that we would rely on an AppKit SPI method.
+
+    if (!isEnabled(o))
+        return false;
+
+    // Checkboxes only have tint when checked.
+    if (o->style()->appearance() == CheckboxPart)
+        return isChecked(o);
+
+    // For now assume other controls have tint if enabled.
+    return true;
+}
+
+NSControlSize RenderThemeChromiumMac::controlSizeForFont(RenderStyle* style) const
+{
+    int fontSize = style->fontSize();
+    if (fontSize >= 16)
+        return NSRegularControlSize;
+    if (fontSize >= 11)
+        return NSSmallControlSize;
+    return NSMiniControlSize;
+}
+
+void RenderThemeChromiumMac::setControlSize(NSCell* cell, const IntSize* sizes, const IntSize& minSize, float zoomLevel)
+{
+    NSControlSize size;
+    if (minSize.width() >= static_cast<int>(sizes[NSRegularControlSize].width() * zoomLevel) &&
+        minSize.height() >= static_cast<int>(sizes[NSRegularControlSize].height() * zoomLevel))
+        size = NSRegularControlSize;
+    else if (minSize.width() >= static_cast<int>(sizes[NSSmallControlSize].width() * zoomLevel) &&
+             minSize.height() >= static_cast<int>(sizes[NSSmallControlSize].height() * zoomLevel))
+        size = NSSmallControlSize;
+    else
+        size = NSMiniControlSize;
+    if (size != [cell controlSize]) // Only update if we have to, since AppKit does work even if the size is the same.
+        [cell setControlSize:size];
+}
+
+IntSize RenderThemeChromiumMac::sizeForFont(RenderStyle* style, const IntSize* sizes) const
+{
+    if (style->effectiveZoom() != 1.0f) {
+        IntSize result = sizes[controlSizeForFont(style)];
+        return IntSize(result.width() * style->effectiveZoom(), result.height() * style->effectiveZoom());
+    }
+    return sizes[controlSizeForFont(style)];
+}
+
+IntSize RenderThemeChromiumMac::sizeForSystemFont(RenderStyle* style, const IntSize* sizes) const
+{
+    if (style->effectiveZoom() != 1.0f) {
+        IntSize result = sizes[controlSizeForSystemFont(style)];
+        return IntSize(result.width() * style->effectiveZoom(), result.height() * style->effectiveZoom());
+    }
+    return sizes[controlSizeForSystemFont(style)];
+}
+
+void RenderThemeChromiumMac::setSizeFromFont(RenderStyle* style, const IntSize* sizes) const
+{
+    // FIXME: Check is flawed, since it doesn't take min-width/max-width into account.
+    IntSize size = sizeForFont(style, sizes);
+    if (style->width().isIntrinsicOrAuto() && size.width() > 0)
+        style->setWidth(Length(size.width(), Fixed));
+    if (style->height().isAuto() && size.height() > 0)
+        style->setHeight(Length(size.height(), Fixed));
+}
+
+void RenderThemeChromiumMac::setFontFromControlSize(CSSStyleSelector* selector, RenderStyle* style, NSControlSize controlSize) const
+{
+    FontDescription fontDescription;
+    fontDescription.setIsAbsoluteSize(true);
+    fontDescription.setGenericFamily(FontDescription::SerifFamily);
+
+    NSFont* font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:controlSize]];
+    fontDescription.firstFamily().setFamily([font familyName]);
+    fontDescription.setComputedSize([font pointSize] * style->effectiveZoom());
+    fontDescription.setSpecifiedSize([font pointSize] * style->effectiveZoom());
+
+    // Reset line height
+    style->setLineHeight(RenderStyle::initialLineHeight());
+
+    if (style->setFontDescription(fontDescription))
+        style->font().update(0);
+}
+
+NSControlSize RenderThemeChromiumMac::controlSizeForSystemFont(RenderStyle* style) const
+{
+    int fontSize = style->fontSize();
+    if (fontSize >= [NSFont systemFontSizeForControlSize:NSRegularControlSize])
+        return NSRegularControlSize;
+    if (fontSize >= [NSFont systemFontSizeForControlSize:NSSmallControlSize])
+        return NSSmallControlSize;
+    return NSMiniControlSize;
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+bool RenderThemeChromiumMac::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    setCheckboxCellState(o, r);
+
+    paintInfo.context->save();
+
+    float zoomLevel = o->style()->effectiveZoom();
+
+    // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
+    // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
+    NSButtonCell* checkbox = this->checkbox();
+    IntSize size = checkboxSizes()[[checkbox controlSize]];
+    size.setWidth(size.width() * zoomLevel);
+    size.setHeight(size.height() * zoomLevel);
+    IntRect inflatedRect = inflateRect(r, size, checkboxMargins(), zoomLevel);
+    
+    if (zoomLevel != 1.0f) {
+        inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
+        inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
+        paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
+        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+        paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
+    }
+    
+    [checkbox drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:nil];
+    [checkbox setControlView:nil];
+
+    paintInfo.context->restore();
+
+    return false;
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+const IntSize* RenderThemeChromiumMac::checkboxSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(14, 14), IntSize(12, 12), IntSize(10, 10) };
+    return sizes;
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+const int* RenderThemeChromiumMac::checkboxMargins() const
+{
+    static const int margins[3][4] =
+    {
+        { 3, 4, 4, 2 },
+        { 4, 3, 3, 3 },
+        { 4, 3, 3, 3 },
+    };
+    return margins[[checkbox() controlSize]];
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::setCheckboxCellState(const RenderObject* o, const IntRect& r)
+{
+    NSButtonCell* checkbox = this->checkbox();
+
+    // Set the control size based off the rectangle we're painting into.
+    setControlSize(checkbox, checkboxSizes(), r.size(), o->style()->effectiveZoom());
+
+    // Update the various states we respond to.
+    updateCheckedState(checkbox, o);
+    updateEnabledState(checkbox, o);
+    updatePressedState(checkbox, o);
+    updateFocusedState(checkbox, o);
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::setCheckboxSize(RenderStyle* style) const
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    // Use the font size to determine the intrinsic width of the control.
+    setSizeFromFont(style, checkboxSizes());
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+bool RenderThemeChromiumMac::paintRadio(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    setRadioCellState(o, r);
+
+    paintInfo.context->save();
+
+    float zoomLevel = o->style()->effectiveZoom();
+
+    // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
+    // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
+    NSButtonCell* radio = this->radio();
+    IntSize size = radioSizes()[[radio controlSize]];
+    size.setWidth(size.width() * zoomLevel);
+    size.setHeight(size.height() * zoomLevel);
+    IntRect inflatedRect = inflateRect(r, size, radioMargins(), zoomLevel);
+    
+    if (zoomLevel != 1.0f) {
+        inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
+        inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
+        paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
+        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+        paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
+    }
+
+    [radio drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:nil];
+    [radio setControlView:nil];
+
+    paintInfo.context->restore();
+
+    return false;
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+const IntSize* RenderThemeChromiumMac::radioSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(14, 15), IntSize(12, 13), IntSize(10, 10) };
+    return sizes;
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+const int* RenderThemeChromiumMac::radioMargins() const
+{
+    static const int margins[3][4] =
+    {
+        { 2, 2, 4, 2 },
+        { 3, 2, 3, 2 },
+        { 1, 0, 2, 0 },
+    };
+    return margins[[radio() controlSize]];
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::setRadioCellState(const RenderObject* o, const IntRect& r)
+{
+    NSButtonCell* radio = this->radio();
+
+    // Set the control size based off the rectangle we're painting into.
+    setControlSize(radio, radioSizes(), r.size(), o->style()->effectiveZoom());
+
+    // Update the various states we respond to.
+    updateCheckedState(radio, o);
+    updateEnabledState(radio, o);
+    updatePressedState(radio, o);
+    updateFocusedState(radio, o);
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::setRadioSize(RenderStyle* style) const
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    // Use the font size to determine the intrinsic width of the control.
+    setSizeFromFont(style, radioSizes());
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::setButtonPaddingFromControlSize(RenderStyle* style, NSControlSize size) const
+{
+    // Just use 8px.  AppKit wants to use 11px for mini buttons, but that padding is just too large
+    // for real-world Web sites (creating a huge necessary minimum width for buttons whose space is
+    // by definition constrained, since we select mini only for small cramped environments.
+    // This also guarantees the HTML4 <button> will match our rendering by default, since we're using a consistent
+    // padding.
+    const int padding = 8 * style->effectiveZoom();
+    style->setPaddingLeft(Length(padding, Fixed));
+    style->setPaddingRight(Length(padding, Fixed));
+    style->setPaddingTop(Length(0, Fixed));
+    style->setPaddingBottom(Length(0, Fixed));
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    // There are three appearance constants for buttons.
+    // (1) Push-button is the constant for the default Aqua system button.  Push buttons will not scale vertically and will not allow
+    // custom fonts or colors.  <input>s use this constant.  This button will allow custom colors and font weights/variants but won't
+    // scale vertically.
+    // (2) square-button is the constant for the square button.  This button will allow custom fonts and colors and will scale vertically.
+    // (3) Button is the constant that means "pick the best button as appropriate."  <button>s use this constant.  This button will
+    // also scale vertically and allow custom fonts and colors.  It will attempt to use Aqua if possible and will make this determination
+    // solely on the rectangle of the control.
+
+    // Determine our control size based off our font.
+    NSControlSize controlSize = controlSizeForFont(style);
+
+    if (style->appearance() == PushButtonPart) {
+        // Ditch the border.
+        style->resetBorder();
+
+        // Height is locked to auto.
+        style->setHeight(Length(Auto));
+
+        // White-space is locked to pre
+        style->setWhiteSpace(PRE);
+
+        // Set the button's vertical size.
+        setButtonSize(style);
+
+        // Add in the padding that we'd like to use.
+        setButtonPaddingFromControlSize(style, controlSize);
+
+        // Our font is locked to the appropriate system font size for the control.  To clarify, we first use the CSS-specified font to figure out
+        // a reasonable control size, but once that control size is determined, we throw that font away and use the appropriate
+        // system font for the control size instead.
+        setFontFromControlSize(selector, style, controlSize);
+    } else {
+        // Set a min-height so that we can't get smaller than the mini button.
+        style->setMinHeight(Length(static_cast<int>(15 * style->effectiveZoom()), Fixed));
+
+        // Reset the top and bottom borders.
+        style->resetBorderTop();
+        style->resetBorderBottom();
+    }
+
+    style->setBoxShadow(0);
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+const IntSize* RenderThemeChromiumMac::buttonSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(0, 21), IntSize(0, 18), IntSize(0, 15) };
+    return sizes;
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+const int* RenderThemeChromiumMac::buttonMargins() const
+{
+    static const int margins[3][4] =
+    {
+        { 4, 6, 7, 6 },
+        { 4, 5, 6, 5 },
+        { 0, 1, 1, 1 },
+    };
+    return margins[[button() controlSize]];
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::setButtonSize(RenderStyle* style) const
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    // Use the font size to determine the intrinsic width of the control.
+    setSizeFromFont(style, buttonSizes());
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+void RenderThemeChromiumMac::setButtonCellState(const RenderObject* o, const IntRect& r)
+{
+    NSButtonCell* button = this->button();
+
+    // Set the control size based off the rectangle we're painting into.
+    if (o->style()->appearance() == SquareButtonPart ||
+        r.height() > buttonSizes()[NSRegularControlSize].height() * o->style()->effectiveZoom()) {
+        // Use the square button
+        if ([button bezelStyle] != NSShadowlessSquareBezelStyle)
+            [button setBezelStyle:NSShadowlessSquareBezelStyle];
+    } else if ([button bezelStyle] != NSRoundedBezelStyle)
+        [button setBezelStyle:NSRoundedBezelStyle];
+
+    setControlSize(button, buttonSizes(), r.size(), o->style()->effectiveZoom());
+
+    NSWindow *window = [nil window];
+    BOOL isDefaultButton = (isDefault(o) && [window isKeyWindow]);
+    [button setKeyEquivalent:(isDefaultButton ? @"\r" : @"")];
+
+    // Update the various states we respond to.
+    updateCheckedState(button, o);
+    updateEnabledState(button, o);
+    updatePressedState(button, o);
+    updateFocusedState(button, o);
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+bool RenderThemeChromiumMac::paintButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    NSButtonCell* button = this->button();
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    setButtonCellState(o, r);
+
+    paintInfo.context->save();
+
+    // We inflate the rect as needed to account for padding included in the cell to accommodate the button
+    // shadow.  We don't consider this part of the bounds of the control in WebKit.
+    float zoomLevel = o->style()->effectiveZoom();
+    IntSize size = buttonSizes()[[button controlSize]];
+    size.setWidth(r.width());
+    size.setHeight(size.height() * zoomLevel);
+    IntRect inflatedRect = r;
+    if ([button bezelStyle] == NSRoundedBezelStyle) {
+        // Center the button within the available space.
+        if (inflatedRect.height() > size.height()) {
+            inflatedRect.setY(inflatedRect.y() + (inflatedRect.height() - size.height()) / 2);
+            inflatedRect.setHeight(size.height());
+        }
+
+        // Now inflate it to account for the shadow.
+        inflatedRect = inflateRect(inflatedRect, size, buttonMargins(), zoomLevel);
+
+        if (zoomLevel != 1.0f) {
+            inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
+            inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
+            paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
+            paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+            paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
+        }
+    } 
+
+    NSView *view = nil;
+    NSWindow *window = [view window];
+    NSButtonCell *previousDefaultButtonCell = [window defaultButtonCell];
+
+    if (isDefault(o) && [window isKeyWindow]) {
+        [window setDefaultButtonCell:button];
+        wkAdvanceDefaultButtonPulseAnimation(button);
+    } else if ([previousDefaultButtonCell isEqual:button])
+        [window setDefaultButtonCell:nil];
+
+    [button drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:view];
+    [button setControlView:nil];
+
+    if (![previousDefaultButtonCell isEqual:button])
+        [window setDefaultButtonCell:previousDefaultButtonCell];
+
+    paintInfo.context->restore();
+
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintTextField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawBezeledTextFieldCell(IntRectToNSRect(r), isEnabled(o) && !isReadOnlyControl(o));
+    return false;
+}
+
+void RenderThemeChromiumMac::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+{
+}
+
+bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    if (paintInfo.context->paintingDisabled())
+        return true;
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawCapsLockIndicator(paintInfo.context->platformContext(), r);
+    
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawBezeledTextArea(IntRectToNSRect(r), isEnabled(o) && !isReadOnlyControl(o));
+    return false;
+}
+
+void RenderThemeChromiumMac::adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+{
+}
+
+const int* RenderThemeChromiumMac::popupButtonMargins() const
+{
+    static const int margins[3][4] =
+    {
+        { 0, 3, 1, 3 },
+        { 0, 3, 2, 3 },
+        { 0, 1, 0, 1 }
+    };
+    return margins[[popupButton() controlSize]];
+}
+
+const IntSize* RenderThemeChromiumMac::popupButtonSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(0, 21), IntSize(0, 18), IntSize(0, 15) };
+    return sizes;
+}
+
+const int* RenderThemeChromiumMac::popupButtonPadding(NSControlSize size) const
+{
+    static const int padding[3][4] =
+    {
+        { 2, 26, 3, 8 },
+        { 2, 23, 3, 8 },
+        { 2, 22, 3, 10 }
+    };
+    return padding[size];
+}
+
+bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    setPopupButtonCellState(o, r);
+
+    NSPopUpButtonCell* popupButton = this->popupButton();
+
+    float zoomLevel = o->style()->effectiveZoom();
+    IntSize size = popupButtonSizes()[[popupButton controlSize]];
+    size.setHeight(size.height() * zoomLevel);
+    size.setWidth(r.width());
+
+    // Now inflate it to account for the shadow.
+    IntRect inflatedRect = r;
+    if (r.width() >= minimumMenuListSize(o->style()))
+        inflatedRect = inflateRect(inflatedRect, size, popupButtonMargins(), zoomLevel);
+
+    paintInfo.context->save();
+    
+#ifndef BUILDING_ON_TIGER
+    // On Leopard, the cell will draw outside of the given rect, so we have to clip to the rect
+    paintInfo.context->clip(inflatedRect);
+#endif
+
+    if (zoomLevel != 1.0f) {
+        inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
+        inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
+        paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
+        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+        paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
+    }
+
+    [popupButton drawWithFrame:IntRectToNSRect(inflatedRect) inView:nil];
+    [popupButton setControlView:nil];
+
+    paintInfo.context->restore();
+
+    return false;
+}
+
+static const float baseFontSize = 11.0f;
+static const float baseArrowHeight = 4.0f;
+static const float baseArrowWidth = 5.0f;
+static const float baseSpaceBetweenArrows = 2.0f;
+static const int arrowPaddingLeft = 6;
+static const int arrowPaddingRight = 6;
+static const int paddingBeforeSeparator = 4;
+static const int baseBorderRadius = 5;
+static const int styledPopupPaddingLeft = 8;
+static const int styledPopupPaddingTop = 1;
+static const int styledPopupPaddingBottom = 2;
+
+static void TopGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+{
+    static float dark[4] = { 1.0f, 1.0f, 1.0f, 0.4f };
+    static float light[4] = { 1.0f, 1.0f, 1.0f, 0.15f };
+    float a = inData[0];
+    int i = 0;
+    for (i = 0; i < 4; i++)
+        outData[i] = (1.0f - a) * dark[i] + a * light[i];
+}
+
+static void BottomGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+{
+    static float dark[4] = { 1.0f, 1.0f, 1.0f, 0.0f };
+    static float light[4] = { 1.0f, 1.0f, 1.0f, 0.3f };
+    float a = inData[0];
+    int i = 0;
+    for (i = 0; i < 4; i++)
+        outData[i] = (1.0f - a) * dark[i] + a * light[i];
+}
+
+static void MainGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+{
+    static float dark[4] = { 0.0f, 0.0f, 0.0f, 0.15f };
+    static float light[4] = { 0.0f, 0.0f, 0.0f, 0.0f };
+    float a = inData[0];
+    int i = 0;
+    for (i = 0; i < 4; i++)
+        outData[i] = (1.0f - a) * dark[i] + a * light[i];
+}
+
+static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+{
+    static float dark[4] = { 0.0f, 0.0f, 0.0f, 0.678f };
+    static float light[4] = { 0.0f, 0.0f, 0.0f, 0.13f };
+    float a = inData[0];
+    int i = 0;
+    for (i = 0; i < 4; i++)
+        outData[i] = (1.0f - a) * dark[i] + a * light[i];
+}
+
+void RenderThemeChromiumMac::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    CGContextRef context = paintInfo.context->platformContext();
+
+    paintInfo.context->save();
+
+    int radius = o->style()->borderTopLeftRadius().width();
+
+    RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
+
+    FloatRect topGradient(r.x(), r.y(), r.width(), r.height() / 2.0f);
+    struct CGFunctionCallbacks topCallbacks = { 0, TopGradientInterpolate, NULL };
+    RetainPtr<CGFunctionRef> topFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &topCallbacks));
+    RetainPtr<CGShadingRef> topShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(topGradient.x(), topGradient.y()), CGPointMake(topGradient.x(), topGradient.bottom()), topFunction.get(), false, false));
+
+    FloatRect bottomGradient(r.x() + radius, r.y() + r.height() / 2.0f, r.width() - 2.0f * radius, r.height() / 2.0f);
+    struct CGFunctionCallbacks bottomCallbacks = { 0, BottomGradientInterpolate, NULL };
+    RetainPtr<CGFunctionRef> bottomFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &bottomCallbacks));
+    RetainPtr<CGShadingRef> bottomShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(bottomGradient.x(),  bottomGradient.y()), CGPointMake(bottomGradient.x(), bottomGradient.bottom()), bottomFunction.get(), false, false));
+
+    struct CGFunctionCallbacks mainCallbacks = { 0, MainGradientInterpolate, NULL };
+    RetainPtr<CGFunctionRef> mainFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &mainCallbacks));
+    RetainPtr<CGShadingRef> mainShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.x(),  r.y()), CGPointMake(r.x(), r.bottom()), mainFunction.get(), false, false));
+
+    RetainPtr<CGShadingRef> leftShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.x(),  r.y()), CGPointMake(r.x() + radius, r.y()), mainFunction.get(), false, false));
+
+    RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
+    paintInfo.context->save();
+    CGContextClipToRect(context, r);
+    paintInfo.context->addRoundedRectClip(r,
+        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
+        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    CGContextDrawShading(context, mainShading.get());
+    paintInfo.context->restore();
+
+    paintInfo.context->save();
+    CGContextClipToRect(context, topGradient);
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
+        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
+        IntSize(), IntSize());
+    CGContextDrawShading(context, topShading.get());
+    paintInfo.context->restore();
+
+    paintInfo.context->save();
+    CGContextClipToRect(context, bottomGradient);
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
+        IntSize(), IntSize(),
+        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    CGContextDrawShading(context, bottomShading.get());
+    paintInfo.context->restore();
+
+    paintInfo.context->save();
+    CGContextClipToRect(context, r);
+    paintInfo.context->addRoundedRectClip(r,
+        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
+        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    CGContextDrawShading(context, leftShading.get());
+    CGContextDrawShading(context, rightShading.get());
+    paintInfo.context->restore();
+
+    paintInfo.context->restore();
+}
+
+bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    paintInfo.context->save();
+
+    IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
+                             r.y() + o->style()->borderTopWidth(),
+                             r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
+                             r.height() - o->style()->borderTopWidth() - o->style()->borderBottomWidth());
+    // Draw the gradients to give the styled popup menu a button appearance
+    paintMenuListButtonGradients(o, paintInfo, bounds);
+
+    // Since we actually know the size of the control here, we restrict the font scale to make sure the arrows will fit vertically in the bounds
+    float fontScale = min(o->style()->fontSize() / baseFontSize, bounds.height() / (baseArrowHeight * 2 + baseSpaceBetweenArrows));
+    float centerY = bounds.y() + bounds.height() / 2.0f;
+    float arrowHeight = baseArrowHeight * fontScale;
+    float arrowWidth = baseArrowWidth * fontScale;
+    float leftEdge = bounds.right() - arrowPaddingRight * o->style()->effectiveZoom() - arrowWidth;
+    float spaceBetweenArrows = baseSpaceBetweenArrows * fontScale;
+
+    if (bounds.width() < arrowWidth + arrowPaddingLeft * o->style()->effectiveZoom())
+        return false;
+    
+    paintInfo.context->setFillColor(o->style()->color());
+    paintInfo.context->setStrokeStyle(NoStroke);
+
+    FloatPoint arrow1[3];
+    arrow1[0] = FloatPoint(leftEdge, centerY - spaceBetweenArrows / 2.0f);
+    arrow1[1] = FloatPoint(leftEdge + arrowWidth, centerY - spaceBetweenArrows / 2.0f);
+    arrow1[2] = FloatPoint(leftEdge + arrowWidth / 2.0f, centerY - spaceBetweenArrows / 2.0f - arrowHeight);
+
+    // Draw the top arrow
+    paintInfo.context->drawConvexPolygon(3, arrow1, true);
+
+    FloatPoint arrow2[3];
+    arrow2[0] = FloatPoint(leftEdge, centerY + spaceBetweenArrows / 2.0f);
+    arrow2[1] = FloatPoint(leftEdge + arrowWidth, centerY + spaceBetweenArrows / 2.0f);
+    arrow2[2] = FloatPoint(leftEdge + arrowWidth / 2.0f, centerY + spaceBetweenArrows / 2.0f + arrowHeight);
+
+    // Draw the bottom arrow
+    paintInfo.context->drawConvexPolygon(3, arrow2, true);
+
+    Color leftSeparatorColor(0, 0, 0, 40);
+    Color rightSeparatorColor(255, 255, 255, 40);
+
+    // FIXME: Should the separator thickness and space be scaled up by fontScale?
+    int separatorSpace = 2; // Deliberately ignores zoom since it looks nicer if it stays thin.
+    int leftEdgeOfSeparator = static_cast<int>(leftEdge - arrowPaddingLeft * o->style()->effectiveZoom()); // FIXME: Round?
+
+    // Draw the separator to the left of the arrows
+    paintInfo.context->setStrokeThickness(1.0f); // Deliberately ignores zoom since it looks nicer if it stays thin.
+    paintInfo.context->setStrokeStyle(SolidStroke);
+    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
+                                IntPoint(leftEdgeOfSeparator, bounds.bottom()));
+
+    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
+                                IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
+
+    paintInfo.context->restore();
+    return false;
+}
+
+static const IntSize* menuListButtonSizes()
+{
+    static const IntSize sizes[3] = { IntSize(0, 21), IntSize(0, 18), IntSize(0, 15) };
+    return sizes;
+}
+
+void RenderThemeChromiumMac::adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    NSControlSize controlSize = controlSizeForFont(style);
+
+    style->resetBorder();
+    style->resetPadding();
+    
+    // Height is locked to auto.
+    style->setHeight(Length(Auto));
+
+    // White-space is locked to pre
+    style->setWhiteSpace(PRE);
+
+    // Set the foreground color to black or gray when we have the aqua look.
+    // Cast to RGB32 is to work around a compiler bug.
+    style->setColor(e && e->isEnabledFormControl() ? static_cast<RGBA32>(Color::black) : Color::darkGray);
+
+    // Set the button's vertical size.
+    setSizeFromFont(style, menuListButtonSizes());
+
+    // Our font is locked to the appropriate system font size for the control.  To clarify, we first use the CSS-specified font to figure out
+    // a reasonable control size, but once that control size is determined, we throw that font away and use the appropriate
+    // system font for the control size instead.
+    setFontFromControlSize(selector, style, controlSize);
+
+    style->setBoxShadow(0);
+}
+
+int RenderThemeChromiumMac::popupInternalPaddingLeft(RenderStyle* style) const
+{
+    if (style->appearance() == MenulistPart)
+        return popupButtonPadding(controlSizeForFont(style))[LeftPadding] * style->effectiveZoom();
+    if (style->appearance() == MenulistButtonPart)
+        return styledPopupPaddingLeft * style->effectiveZoom();
+    return 0;
+}
+
+int RenderThemeChromiumMac::popupInternalPaddingRight(RenderStyle* style) const
+{
+    if (style->appearance() == MenulistPart)
+        return popupButtonPadding(controlSizeForFont(style))[RightPadding] * style->effectiveZoom();
+    if (style->appearance() == MenulistButtonPart) {
+        float fontScale = style->fontSize() / baseFontSize;
+        float arrowWidth = baseArrowWidth * fontScale;
+        return static_cast<int>(ceilf(arrowWidth + (arrowPaddingLeft + arrowPaddingRight + paddingBeforeSeparator) * style->effectiveZoom()));
+    }
+    return 0;
+}
+
+int RenderThemeChromiumMac::popupInternalPaddingTop(RenderStyle* style) const
+{
+    if (style->appearance() == MenulistPart)
+        return popupButtonPadding(controlSizeForFont(style))[TopPadding] * style->effectiveZoom();
+    if (style->appearance() == MenulistButtonPart)
+        return styledPopupPaddingTop * style->effectiveZoom();
+    return 0;
+}
+
+int RenderThemeChromiumMac::popupInternalPaddingBottom(RenderStyle* style) const
+{
+    if (style->appearance() == MenulistPart)
+        return popupButtonPadding(controlSizeForFont(style))[BottomPadding] * style->effectiveZoom();
+    if (style->appearance() == MenulistButtonPart)
+        return styledPopupPaddingBottom * style->effectiveZoom();
+    return 0;
+}
+
+void RenderThemeChromiumMac::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    float fontScale = style->fontSize() / baseFontSize;
+
+    style->resetPadding();
+    style->setBorderRadius(IntSize(int(baseBorderRadius + fontScale - 1), int(baseBorderRadius + fontScale - 1))); // FIXME: Round up?
+
+    const int minHeight = 15;
+    style->setMinHeight(Length(minHeight, Fixed));
+    
+    style->setLineHeight(RenderStyle::initialLineHeight());
+}
+
+void RenderThemeChromiumMac::setPopupButtonCellState(const RenderObject* o, const IntRect& r)
+{
+    NSPopUpButtonCell* popupButton = this->popupButton();
+
+    // Set the control size based off the rectangle we're painting into.
+    setControlSize(popupButton, popupButtonSizes(), r.size(), o->style()->effectiveZoom());
+
+    // Update the various states we respond to.
+    updateCheckedState(popupButton, o);
+    updateEnabledState(popupButton, o);
+    updatePressedState(popupButton, o);
+    updateFocusedState(popupButton, o);
+}
+
+const IntSize* RenderThemeChromiumMac::menuListSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(9, 0), IntSize(5, 0), IntSize(0, 0) };
+    return sizes;
+}
+
+int RenderThemeChromiumMac::minimumMenuListSize(RenderStyle* style) const
+{
+    return sizeForSystemFont(style, menuListSizes()).width();
+}
+
+static const int trackWidth = 5;
+static const int trackRadius = 2;
+
+void RenderThemeChromiumMac::adjustSliderTrackStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeChromiumMac::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    IntRect bounds = r;
+    float zoomLevel = o->style()->effectiveZoom();
+    float zoomedTrackWidth = trackWidth * zoomLevel;
+
+    if (o->style()->appearance() ==  SliderHorizontalPart || o->style()->appearance() ==  MediaSliderPart) {
+        bounds.setHeight(zoomedTrackWidth);
+        bounds.setY(r.y() + r.height() / 2 - zoomedTrackWidth / 2);
+    } else if (o->style()->appearance() == SliderVerticalPart) {
+        bounds.setWidth(zoomedTrackWidth);
+        bounds.setX(r.x() + r.width() / 2 - zoomedTrackWidth / 2);
+    }
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    CGContextRef context = paintInfo.context->platformContext();
+    RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
+
+    paintInfo.context->save();
+    CGContextClipToRect(context, bounds);
+
+    struct CGFunctionCallbacks mainCallbacks = { 0, TrackGradientInterpolate, NULL };
+    RetainPtr<CGFunctionRef> mainFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &mainCallbacks));
+    RetainPtr<CGShadingRef> mainShading;
+    if (o->style()->appearance() == SliderVerticalPart)
+        mainShading.adoptCF(CGShadingCreateAxial(cspace.get(), CGPointMake(bounds.x(),  bounds.bottom()), CGPointMake(bounds.right(), bounds.bottom()), mainFunction.get(), false, false));
+    else
+        mainShading.adoptCF(CGShadingCreateAxial(cspace.get(), CGPointMake(bounds.x(),  bounds.y()), CGPointMake(bounds.x(), bounds.bottom()), mainFunction.get(), false, false));
+
+    IntSize radius(trackRadius, trackRadius);
+    paintInfo.context->addRoundedRectClip(bounds,
+        radius, radius,
+        radius, radius);
+    CGContextDrawShading(context, mainShading.get());
+    paintInfo.context->restore();
+    
+    return false;
+}
+
+void RenderThemeChromiumMac::adjustSliderThumbStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    style->setBoxShadow(0);
+}
+
+static const float verticalSliderHeightPadding = 0.1f;
+
+bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    ASSERT(o->parent()->isSlider());
+
+    NSSliderCell* sliderThumbCell = o->style()->appearance() == SliderThumbVerticalPart
+        ? sliderThumbVertical()
+        : sliderThumbHorizontal();
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    // Update the various states we respond to.
+    updateEnabledState(sliderThumbCell, o->parent());
+    updateFocusedState(sliderThumbCell, o->parent());
+
+    // Update the pressed state using the NSCell tracking methods, since that's how NSSliderCell keeps track of it.
+    bool oldPressed;
+    if (o->style()->appearance() == SliderThumbVerticalPart)
+        oldPressed = m_isSliderThumbVerticalPressed;
+    else
+        oldPressed = m_isSliderThumbHorizontalPressed;
+
+    bool pressed = static_cast<RenderSlider*>(o->parent())->inDragMode();
+
+    if (o->style()->appearance() == SliderThumbVerticalPart)
+        m_isSliderThumbVerticalPressed = pressed;
+    else
+        m_isSliderThumbHorizontalPressed = pressed;
+
+    if (pressed != oldPressed) {
+        if (pressed)
+            [sliderThumbCell startTrackingAt:NSPoint() inView:nil];
+        else
+            [sliderThumbCell stopTracking:NSPoint() at:NSPoint() inView:nil mouseIsUp:YES];
+    }
+
+    FloatRect bounds = r;
+    // Make the height of the vertical slider slightly larger so NSSliderCell will draw a vertical slider.
+    if (o->style()->appearance() == SliderThumbVerticalPart)
+        bounds.setHeight(bounds.height() + verticalSliderHeightPadding * o->style()->effectiveZoom());
+
+    paintInfo.context->save();
+    float zoomLevel = o->style()->effectiveZoom();
+    
+    FloatRect unzoomedRect = bounds;
+    if (zoomLevel != 1.0f) {
+        unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
+        unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
+        paintInfo.context->translate(unzoomedRect.x(), unzoomedRect.y());
+        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+        paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
+    }
+
+    [sliderThumbCell drawWithFrame:FloatRectToNSRect(unzoomedRect) inView:nil];
+    [sliderThumbCell setControlView:nil];
+
+    paintInfo.context->restore();
+
+    return false;
+}
+
+const int sliderThumbWidth = 15;
+const int sliderThumbHeight = 15;
+const int mediaSliderThumbWidth = 13;
+const int mediaSliderThumbHeight = 14;
+
+void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
+{
+    float zoomLevel = o->style()->effectiveZoom();
+    if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == SliderThumbVerticalPart) {
+        o->style()->setWidth(Length(static_cast<int>(sliderThumbWidth * zoomLevel), Fixed));
+        o->style()->setHeight(Length(static_cast<int>(sliderThumbHeight * zoomLevel), Fixed));
+    } else if (o->style()->appearance() == MediaSliderThumbPart) {
+        o->style()->setWidth(Length(mediaSliderThumbWidth, Fixed));
+        o->style()->setHeight(Length(mediaSliderThumbHeight, Fixed));
+    }
+}
+
+bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    NSSearchFieldCell* search = this->search();
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    setSearchCellState(o, r);
+
+    paintInfo.context->save();
+
+    float zoomLevel = o->style()->effectiveZoom();
+
+    IntRect unzoomedRect = r;
+    
+    if (zoomLevel != 1.0f) {
+        unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
+        unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
+        paintInfo.context->translate(unzoomedRect.x(), unzoomedRect.y());
+        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+        paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
+    }
+
+    // Set the search button to nil before drawing.  Then reset it so we can draw it later.
+    [search setSearchButtonCell:nil];
+
+    [search drawWithFrame:NSRect(IntRectToNSRect(unzoomedRect)) inView:nil];
+#ifdef BUILDING_ON_TIGER
+    if ([search showsFirstResponder])
+        wkDrawTextFieldCellFocusRing(search, NSRect(unzoomedRect));
+#endif
+
+    [search setControlView:nil];
+    [search resetSearchButtonCell];
+
+    paintInfo.context->restore();
+
+    return false;
+}
+
+void RenderThemeChromiumMac::setSearchCellState(RenderObject* o, const IntRect& r)
+{
+    NSSearchFieldCell* search = this->search();
+
+    [search setControlSize:controlSizeForFont(o->style())];
+
+    // Update the various states we respond to.
+    updateEnabledState(search, o);
+    updateFocusedState(search, o);
+}
+
+const IntSize* RenderThemeChromiumMac::searchFieldSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(0, 22), IntSize(0, 19), IntSize(0, 17) };
+    return sizes;
+}
+
+void RenderThemeChromiumMac::setSearchFieldSize(RenderStyle* style) const
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+    
+    // Use the font size to determine the intrinsic width of the control.
+    setSizeFromFont(style, searchFieldSizes());
+}
+
+void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    // Override border.
+    style->resetBorder();
+    const short borderWidth = 2 * style->effectiveZoom();
+    style->setBorderLeftWidth(borderWidth);
+    style->setBorderLeftStyle(INSET);
+    style->setBorderRightWidth(borderWidth);
+    style->setBorderRightStyle(INSET);
+    style->setBorderBottomWidth(borderWidth);
+    style->setBorderBottomStyle(INSET);
+    style->setBorderTopWidth(borderWidth);
+    style->setBorderTopStyle(INSET);    
+    
+    // Override height.
+    style->setHeight(Length(Auto));
+    setSearchFieldSize(style);
+    
+    // Override padding size to match AppKit text positioning.
+    const int padding = 1 * style->effectiveZoom();
+    style->setPaddingLeft(Length(padding, Fixed));
+    style->setPaddingRight(Length(padding, Fixed));
+    style->setPaddingTop(Length(padding, Fixed));
+    style->setPaddingBottom(Length(padding, Fixed));
+    
+    NSControlSize controlSize = controlSizeForFont(style);
+    setFontFromControlSize(selector, style, controlSize);
+
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    Node* input = o->node()->shadowAncestorNode();
+    setSearchCellState(input->renderer(), r);
+
+    NSSearchFieldCell* search = this->search();
+
+    updatePressedState([search cancelButtonCell], o);
+
+    paintInfo.context->save();
+
+    float zoomLevel = o->style()->effectiveZoom();
+
+    NSRect bounds = [search cancelButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
+    
+    IntRect unzoomedRect(NSRectToIntRect(bounds));
+    if (zoomLevel != 1.0f) {
+        unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
+        unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
+        paintInfo.context->translate(unzoomedRect.x(), unzoomedRect.y());
+        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+        paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
+    }
+
+    [[search cancelButtonCell] drawWithFrame:IntRectToNSRect(unzoomedRect) inView:nil];
+    [[search cancelButtonCell] setControlView:nil];
+
+    paintInfo.context->restore();
+    return false;
+}
+
+const IntSize* RenderThemeChromiumMac::cancelButtonSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(16, 13), IntSize(13, 11), IntSize(13, 9) };
+    return sizes;
+}
+
+void RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    IntSize size = sizeForSystemFont(style, cancelButtonSizes());
+    style->setWidth(Length(size.width(), Fixed));
+    style->setHeight(Length(size.height(), Fixed));
+    style->setBoxShadow(0);
+}
+
+const IntSize* RenderThemeChromiumMac::resultsButtonSizes() const
+{
+    static const IntSize sizes[3] = { IntSize(19, 13), IntSize(17, 11), IntSize(17, 9) };
+    return sizes;
+}
+
+static const int emptyResultsOffset = 9;
+void RenderThemeChromiumMac::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    IntSize size = sizeForSystemFont(style, resultsButtonSizes());
+    style->setWidth(Length(size.width() - emptyResultsOffset, Fixed));
+    style->setHeight(Length(size.height(), Fixed));
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeChromiumMac::paintSearchFieldDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return false;
+}
+
+void RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    IntSize size = sizeForSystemFont(style, resultsButtonSizes());
+    style->setWidth(Length(size.width(), Fixed));
+    style->setHeight(Length(size.height(), Fixed));
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeChromiumMac::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    Node* input = o->node()->shadowAncestorNode();
+    setSearchCellState(input->renderer(), r);
+
+    NSSearchFieldCell* search = this->search();
+
+    if ([search searchMenuTemplate] != nil)
+        [search setSearchMenuTemplate:nil];
+
+    NSRect bounds = [search searchButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
+    [[search searchButtonCell] drawWithFrame:bounds inView:nil];
+    [[search searchButtonCell] setControlView:nil];
+    return false;
+}
+
+static const int resultsArrowWidth = 5;
+void RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    IntSize size = sizeForSystemFont(style, resultsButtonSizes());
+    style->setWidth(Length(size.width() + resultsArrowWidth, Fixed));
+    style->setHeight(Length(size.height(), Fixed));
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
+    Node* input = o->node()->shadowAncestorNode();
+    setSearchCellState(input->renderer(), r);
+
+    NSSearchFieldCell* search = this->search();
+
+    if (![search searchMenuTemplate])
+        [search setSearchMenuTemplate:searchMenuTemplate()];
+
+    paintInfo.context->save();
+
+    float zoomLevel = o->style()->effectiveZoom();
+
+    NSRect bounds = [search searchButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
+    
+    IntRect unzoomedRect(NSRectToIntRect(bounds));
+    if (zoomLevel != 1.0f) {
+        unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
+        unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
+        paintInfo.context->translate(unzoomedRect.x(), unzoomedRect.y());
+        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
+        paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
+    }
+
+    [[search searchButtonCell] drawWithFrame:IntRectToNSRect(unzoomedRect) inView:nil];
+    [[search searchButtonCell] setControlView:nil];
+    
+    paintInfo.context->restore();
+
+    return false;
+}
+
+#if ENABLE(VIDEO)
+// FIXME: This enum is lifted from RenderThemeMac.mm  We need to decide which theme to use for the default controls, or decide to avoid wkDrawMediaUIPart and render our own.
+typedef enum {
+    MediaControllerThemeClassic   = 1,
+    MediaControllerThemeQT        = 2
+} MediaControllerThemeStyle;
+#endif
+
+bool RenderThemeChromiumMac::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+#if ENABLE(VIDEO)
+    Node* node = o->node();
+    if (!node)
+        return false;
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaFullscreenButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
+#endif
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+#if ENABLE(VIDEO)
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
+        return false;
+
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
+    if (!mediaElement)
+        return false;
+    
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
+#endif
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+#if ENABLE(VIDEO)
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
+        return false;
+
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
+    if (!mediaElement)
+        return false;
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(mediaElement->canPlay() ? MediaPlayButton : MediaPauseButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
+#endif
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+#if ENABLE(VIDEO)
+    Node* node = o->node();
+    if (!node)
+        return false;
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaSeekBackButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
+#endif
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+#if ENABLE(VIDEO)
+    Node* node = o->node();
+    if (!node)
+        return false;
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaSeekForwardButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
+#endif
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+#if ENABLE(VIDEO)
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
+        return false;
+
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
+    if (!mediaElement)
+        return false;
+
+    float timeLoaded = 0;
+    float currentTime = 0;
+    float duration = 0;
+    if (MediaPlayer* player = mediaElement->player()) {
+        duration = player->duration();
+        timeLoaded = player->maxTimeBuffered();
+        currentTime = player->currentTime();
+    }
+
+    wkDrawMediaSliderTrack(MediaControllerThemeClassic, paintInfo.context->platformContext(), r, timeLoaded, currentTime, duration);
+#endif
+    return false;
+}
+
+bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+#if ENABLE(VIDEO)
+    Node* node = o->node();
+    if (!node)
+        return false;
+
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaSliderThumb, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
+#endif
+    return false;
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+NSButtonCell* RenderThemeChromiumMac::checkbox() const
+{
+    if (!m_checkbox) {
+        m_checkbox.adoptNS([[NSButtonCell alloc] init]);
+        [m_checkbox.get() setButtonType:NSSwitchButton];
+        [m_checkbox.get() setTitle:nil];
+        [m_checkbox.get() setAllowsMixedState:YES];
+        [m_checkbox.get() setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    return m_checkbox.get();
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+NSButtonCell* RenderThemeChromiumMac::radio() const
+{
+    if (!m_radio) {
+        m_radio.adoptNS([[NSButtonCell alloc] init]);
+        [m_radio.get() setButtonType:NSRadioButton];
+        [m_radio.get() setTitle:nil];
+        [m_radio.get() setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    return m_radio.get();
+}
+
+// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
+NSButtonCell* RenderThemeChromiumMac::button() const
+{
+    if (!m_button) {
+        m_button.adoptNS([[NSButtonCell alloc] init]);
+        [m_button.get() setTitle:nil];
+        [m_button.get() setButtonType:NSMomentaryPushInButton];
+    }
+    
+    return m_button.get();
+}
+
+NSPopUpButtonCell* RenderThemeChromiumMac::popupButton() const
+{
+    if (!m_popupButton) {
+        m_popupButton.adoptNS([[NSPopUpButtonCell alloc] initTextCell:@"" pullsDown:NO]);
+        [m_popupButton.get() setUsesItemFromMenu:NO];
+        [m_popupButton.get() setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    return m_popupButton.get();
+}
+
+NSSearchFieldCell* RenderThemeChromiumMac::search() const
+{
+    if (!m_search) {
+        m_search.adoptNS([[NSSearchFieldCell alloc] initTextCell:@""]);
+        [m_search.get() setBezelStyle:NSTextFieldRoundedBezel];
+        [m_search.get() setBezeled:YES];
+        [m_search.get() setEditable:YES];
+        [m_search.get() setFocusRingType:NSFocusRingTypeExterior];
+    }
+
+    return m_search.get();
+}
+
+NSMenu* RenderThemeChromiumMac::searchMenuTemplate() const
+{
+    if (!m_searchMenuTemplate)
+        m_searchMenuTemplate.adoptNS([[NSMenu alloc] initWithTitle:@""]);
+
+    return m_searchMenuTemplate.get();
+}
+
+NSSliderCell* RenderThemeChromiumMac::sliderThumbHorizontal() const
+{
+    if (!m_sliderThumbHorizontal) {
+        m_sliderThumbHorizontal.adoptNS([[NSSliderCell alloc] init]);
+        [m_sliderThumbHorizontal.get() setTitle:nil];
+        [m_sliderThumbHorizontal.get() setSliderType:NSLinearSlider];
+        [m_sliderThumbHorizontal.get() setControlSize:NSSmallControlSize];
+        [m_sliderThumbHorizontal.get() setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    return m_sliderThumbHorizontal.get();
+}
+
+NSSliderCell* RenderThemeChromiumMac::sliderThumbVertical() const
+{
+    if (!m_sliderThumbVertical) {
+        m_sliderThumbVertical.adoptNS([[NSSliderCell alloc] init]);
+        [m_sliderThumbVertical.get() setTitle:nil];
+        [m_sliderThumbVertical.get() setSliderType:NSLinearSlider];
+        [m_sliderThumbVertical.get() setControlSize:NSSmallControlSize];
+        [m_sliderThumbVertical.get() setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    return m_sliderThumbVertical.get();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
new file mode 100644
index 0000000000..bf217c8695
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -0,0 +1,2 @@
+// FIXME: This is a placeholder to avoid some issues with webkit.gyp in the chromium tree. Having this placeholder until we can factor out
+// RenderThemeChromiumSkia from RenderThemeChromiumLinux will keep the HEAD of both trees compatible.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
new file mode 100644
index 0000000000..bf217c8695
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -0,0 +1,2 @@
+// FIXME: This is a placeholder to avoid some issues with webkit.gyp in the chromium tree. Having this placeholder until we can factor out
+// RenderThemeChromiumSkia from RenderThemeChromiumLinux will keep the HEAD of both trees compatible.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
new file mode 100644
index 0000000000..52881917d5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -0,0 +1,930 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderThemeChromiumWin.h"
+
+#include <windows.h>
+#include <uxtheme.h>
+#include <vssym32.h>
+
+#include "ChromiumBridge.h"
+#include "CSSStyleSheet.h"
+#include "CSSValueKeywords.h"
+#include "FontSelector.h"
+#include "FontUtilsChromiumWin.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "MediaControlElements.h"
+#include "RenderBox.h"
+#include "RenderSlider.h"
+#include "ScrollbarTheme.h"
+#include "SkiaUtils.h"
+#include "TransparencyWin.h"
+#include "UserAgentStyleSheets.h"
+#include "WindowsVersion.h"
+
+// FIXME: This dependency should eventually be removed.
+#include <skia/ext/skia_utils_win.h>
+
+#define SIZEOF_STRUCT_WITH_SPECIFIED_LAST_MEMBER(structName, member) \
+    offsetof(structName, member) + \
+    (sizeof static_cast<structName*>(0)->member)
+#define NONCLIENTMETRICS_SIZE_PRE_VISTA \
+    SIZEOF_STRUCT_WITH_SPECIFIED_LAST_MEMBER(NONCLIENTMETRICS, lfMessageFont)
+
+namespace WebCore {
+
+namespace {
+
+// The background for the media player controls should be a 60% opaque black rectangle. This
+// matches the UI mockups for the default UI theme.
+static const float defaultMediaControlOpacity = 0.6f;
+
+// These values all match Safari/Win.
+static const float defaultControlFontPixelSize = 13;
+static const float defaultCancelButtonSize = 9;
+static const float minCancelButtonSize = 5;
+static const float maxCancelButtonSize = 21;
+static const float defaultSearchFieldResultsDecorationSize = 13;
+static const float minSearchFieldResultsDecorationSize = 9;
+static const float maxSearchFieldResultsDecorationSize = 30;
+static const float defaultSearchFieldResultsButtonWidth = 18;
+
+bool canvasHasMultipleLayers(const SkCanvas* canvas)
+{
+    SkCanvas::LayerIter iter(const_cast<SkCanvas*>(canvas), false);
+    iter.next();  // There is always at least one layer.
+    return !iter.done();  // There is > 1 layer if the the iterator can stil advance.
+}
+
+class ThemePainter : public TransparencyWin {
+public:
+    ThemePainter(GraphicsContext* context, const IntRect& r)
+    {
+        TransformMode transformMode = getTransformMode(context->getCTM());
+        init(context, getLayerMode(context, transformMode), transformMode, r);
+    }
+
+    ~ThemePainter()
+    {
+        composite();
+    }
+
+private:
+    static LayerMode getLayerMode(GraphicsContext* context, TransformMode transformMode)
+    {
+        if (context->platformContext()->isDrawingToImageBuffer())  // Might have transparent background.
+            return WhiteLayer;
+        else if (canvasHasMultipleLayers(context->platformContext()->canvas()))  // Needs antialiasing help.
+            return OpaqueCompositeLayer;
+        else  // Nothing interesting.
+            return transformMode == KeepTransform ? NoLayer : OpaqueCompositeLayer;
+    }
+
+    static TransformMode getTransformMode(const TransformationMatrix& matrix)
+    {
+        if (matrix.b() != 0 || matrix.c() != 0)  // Skew.
+            return Untransform;
+        else if (matrix.a() != 1.0 || matrix.d() != 1.0)  // Scale.
+            return ScaleTransform;
+        else  // Nothing interesting.
+            return KeepTransform;
+    }
+};
+
+}  // namespace
+
+static void getNonClientMetrics(NONCLIENTMETRICS* metrics) {
+    static UINT size = WebCore::isVistaOrNewer() ?
+        sizeof(NONCLIENTMETRICS) : NONCLIENTMETRICS_SIZE_PRE_VISTA;
+    metrics->cbSize = size;
+    bool success = !!SystemParametersInfo(SPI_GETNONCLIENTMETRICS, size, metrics, 0);
+    ASSERT(success);
+}
+
+enum PaddingType {
+    TopPadding,
+    RightPadding,
+    BottomPadding,
+    LeftPadding
+};
+
+static const int styledMenuListInternalPadding[4] = { 1, 4, 1, 4 };
+
+// The default variable-width font size.  We use this as the default font
+// size for the "system font", and as a base size (which we then shrink) for
+// form control fonts.
+static float defaultFontSize = 16.0;
+
+static FontDescription smallSystemFont;
+static FontDescription menuFont;
+static FontDescription labelFont;
+
+// Internal static helper functions.  We don't put them in an anonymous
+// namespace so they have easier access to the WebCore namespace.
+
+static bool supportsFocus(ControlPart appearance)
+{
+    switch (appearance) {
+    case PushButtonPart:
+    case ButtonPart:
+    case DefaultButtonPart:
+    case SearchFieldPart:
+    case TextFieldPart:
+    case TextAreaPart:
+        return true;
+    }
+    return false;
+}
+
+static void setFixedPadding(RenderStyle* style, const int padding[4])
+{
+    style->setPaddingLeft(Length(padding[LeftPadding], Fixed));
+    style->setPaddingRight(Length(padding[RightPadding], Fixed));
+    style->setPaddingTop(Length(padding[TopPadding], Fixed));
+    style->setPaddingBottom(Length(padding[BottomPadding], Fixed));
+}
+
+// Return the height of system font |font| in pixels.  We use this size by
+// default for some non-form-control elements.
+static float systemFontSize(const LOGFONT& font)
+{
+    float size = -font.lfHeight;
+    if (size < 0) {
+        HFONT hFont = CreateFontIndirect(&font);
+        if (hFont) {
+            HDC hdc = GetDC(0);  // What about printing?  Is this the right DC?
+            if (hdc) {
+                HGDIOBJ hObject = SelectObject(hdc, hFont);
+                TEXTMETRIC tm;
+                GetTextMetrics(hdc, &tm);
+                SelectObject(hdc, hObject);
+                ReleaseDC(0, hdc);
+                size = tm.tmAscent;
+            }
+            DeleteObject(hFont);
+        }
+    }
+
+    // The "codepage 936" bit here is from Gecko; apparently this helps make
+    // fonts more legible in Simplified Chinese where the default font size is
+    // too small.
+    //
+    // FIXME: http://b/1119883 Since this is only used for "small caption",
+    // "menu", and "status bar" objects, I'm not sure how much this even
+    // matters.  Plus the Gecko patch went in back in 2002, and maybe this
+    // isn't even relevant anymore.  We should investigate whether this should
+    // be removed, or perhaps broadened to be "any CJK locale".
+    //
+    return ((size < 12.0f) && (GetACP() == 936)) ? 12.0f : size;
+}
+
+// We aim to match IE here.
+// -IE uses a font based on the encoding as the default font for form controls.
+// -Gecko uses MS Shell Dlg (actually calls GetStockObject(DEFAULT_GUI_FONT),
+// which returns MS Shell Dlg)
+// -Safari uses Lucida Grande.
+//
+// FIXME: The only case where we know we don't match IE is for ANSI encodings.
+// IE uses MS Shell Dlg there, which we render incorrectly at certain pixel
+// sizes (e.g. 15px). So, for now we just use Arial.
+static wchar_t* defaultGUIFont()
+{
+    return L"Arial";
+}
+
+// Converts |points| to pixels.  One point is 1/72 of an inch.
+static float pointsToPixels(float points)
+{
+    static float pixelsPerInch = 0.0f;
+    if (!pixelsPerInch) {
+        HDC hdc = GetDC(0);  // What about printing?  Is this the right DC?
+        if (hdc) {  // Can this ever actually be NULL?
+            pixelsPerInch = GetDeviceCaps(hdc, LOGPIXELSY);
+            ReleaseDC(0, hdc);
+        } else {
+            pixelsPerInch = 96.0f;
+        }
+    }
+
+    static const float pointsPerInch = 72.0f;
+    return points / pointsPerInch * pixelsPerInch;
+}
+
+static void setSizeIfAuto(RenderStyle* style, const IntSize& size)
+{
+    if (style->width().isIntrinsicOrAuto())
+        style->setWidth(Length(size.width(), Fixed));
+    if (style->height().isAuto())
+        style->setHeight(Length(size.height(), Fixed));
+}
+
+static double querySystemBlinkInterval(double defaultInterval)
+{
+    UINT blinkTime = GetCaretBlinkTime();
+    if (blinkTime == 0)
+        return defaultInterval;
+    if (blinkTime == INFINITE)
+        return 0;
+    return blinkTime / 1000.0;
+}
+
+#if ENABLE(VIDEO)
+// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
+static HTMLMediaElement* mediaElementParent(Node* node)
+{
+    if (!node)
+        return 0;
+    Node* mediaNode = node->shadowAncestorNode();
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+#endif
+
+// Implement WebCore::theme() for getting the global RenderTheme.
+RenderTheme* theme()
+{
+    static RenderThemeChromiumWin winTheme;
+    return &winTheme;
+}
+
+String RenderThemeChromiumWin::extraDefaultStyleSheet()
+{
+    return String(themeWinUserAgentStyleSheet, sizeof(themeWinUserAgentStyleSheet));
+}
+
+String RenderThemeChromiumWin::extraQuirksStyleSheet()
+{
+    return String(themeWinQuirksUserAgentStyleSheet, sizeof(themeWinQuirksUserAgentStyleSheet));
+}
+
+#if ENABLE(VIDEO)
+String RenderThemeChromiumWin::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
+}
+#endif
+
+bool RenderThemeChromiumWin::supportsFocusRing(const RenderStyle* style) const
+{
+   // Let webkit draw one of its halo rings around any focused element,
+   // except push buttons. For buttons we use the windows PBS_DEFAULTED
+   // styling to give it a blue border.
+   return style->appearance() == ButtonPart
+       || style->appearance() == PushButtonPart;
+}
+
+Color RenderThemeChromiumWin::platformActiveSelectionBackgroundColor() const
+{
+    if (ChromiumBridge::layoutTestMode())
+        return Color(0x00, 0x00, 0xff);  // Royal blue.
+    COLORREF color = GetSysColor(COLOR_HIGHLIGHT);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
+}
+
+Color RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor() const
+{
+    if (ChromiumBridge::layoutTestMode())
+        return Color(0x99, 0x99, 0x99);  // Medium gray.
+    COLORREF color = GetSysColor(COLOR_GRAYTEXT);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
+}
+
+Color RenderThemeChromiumWin::platformActiveSelectionForegroundColor() const
+{
+    if (ChromiumBridge::layoutTestMode())
+        return Color(0xff, 0xff, 0xcc);  // Pale yellow.
+    COLORREF color = GetSysColor(COLOR_HIGHLIGHTTEXT);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
+}
+
+Color RenderThemeChromiumWin::platformInactiveSelectionForegroundColor() const
+{
+    return Color::white;
+}
+
+Color RenderThemeChromiumWin::platformActiveTextSearchHighlightColor() const
+{
+    return Color(0xff, 0x96, 0x32);  // Orange.
+}
+
+Color RenderThemeChromiumWin::platformInactiveTextSearchHighlightColor() const
+{
+    return Color(0xff, 0xff, 0x96); // Yellow.
+}
+
+double RenderThemeChromiumWin::caretBlinkInterval() const
+{
+    // Disable the blinking caret in layout test mode, as it introduces
+    // a race condition for the pixel tests. http://b/1198440
+    if (ChromiumBridge::layoutTestMode())
+        return 0;
+
+    // This involves a system call, so we cache the result.
+    static double blinkInterval = querySystemBlinkInterval(RenderTheme::caretBlinkInterval());
+    return blinkInterval;
+}
+
+void RenderThemeChromiumWin::systemFont(int propId, FontDescription& fontDescription) const
+{
+    // This logic owes much to RenderThemeSafari.cpp.
+    FontDescription* cachedDesc = NULL;
+    wchar_t* faceName = 0;
+    float fontSize = 0;
+    switch (propId) {
+    case CSSValueSmallCaption:
+        cachedDesc = &smallSystemFont;
+        if (!smallSystemFont.isAbsoluteSize()) {
+            NONCLIENTMETRICS metrics;
+            getNonClientMetrics(&metrics);
+            faceName = metrics.lfSmCaptionFont.lfFaceName;
+            fontSize = systemFontSize(metrics.lfSmCaptionFont);
+        }
+        break;
+    case CSSValueMenu:
+        cachedDesc = &menuFont;
+        if (!menuFont.isAbsoluteSize()) {
+            NONCLIENTMETRICS metrics;
+            getNonClientMetrics(&metrics);
+            faceName = metrics.lfMenuFont.lfFaceName;
+            fontSize = systemFontSize(metrics.lfMenuFont);
+        }
+        break;
+    case CSSValueStatusBar:
+        cachedDesc = &labelFont;
+        if (!labelFont.isAbsoluteSize()) {
+            NONCLIENTMETRICS metrics;
+            getNonClientMetrics(&metrics);
+            faceName = metrics.lfStatusFont.lfFaceName;
+            fontSize = systemFontSize(metrics.lfStatusFont);
+        }
+        break;
+    case CSSValueWebkitMiniControl:
+    case CSSValueWebkitSmallControl:
+    case CSSValueWebkitControl:
+        faceName = defaultGUIFont();
+        // Why 2 points smaller?  Because that's what Gecko does.
+        fontSize = defaultFontSize - pointsToPixels(2);
+        break;
+    default:
+        faceName = defaultGUIFont();
+        fontSize = defaultFontSize;
+        break;
+    }
+
+    if (!cachedDesc)
+        cachedDesc = &fontDescription;
+
+    if (fontSize) {
+        ASSERT(faceName);
+        cachedDesc->firstFamily().setFamily(AtomicString(faceName,
+                                                         wcslen(faceName)));
+        cachedDesc->setIsAbsoluteSize(true);
+        cachedDesc->setGenericFamily(FontDescription::NoFamily);
+        cachedDesc->setSpecifiedSize(fontSize);
+        cachedDesc->setWeight(FontWeightNormal);
+        cachedDesc->setItalic(false);
+    }
+    fontDescription = *cachedDesc;
+}
+
+int RenderThemeChromiumWin::minimumMenuListSize(RenderStyle* style) const
+{
+    return 0;
+}
+
+void RenderThemeChromiumWin::adjustSliderThumbSize(RenderObject* o) const
+{
+    // These sizes match what WinXP draws for various menus.
+    const int sliderThumbAlongAxis = 11;
+    const int sliderThumbAcrossAxis = 21;
+    if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == MediaSliderThumbPart) {
+        o->style()->setWidth(Length(sliderThumbAlongAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAcrossAxis, Fixed));
+    } else if (o->style()->appearance() == SliderThumbVerticalPart) {
+        o->style()->setWidth(Length(sliderThumbAcrossAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAlongAxis, Fixed));
+    }
+}
+
+void RenderThemeChromiumWin::setCheckboxSize(RenderStyle* style) const
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    // FIXME:  A hard-coded size of 13 is used.  This is wrong but necessary
+    // for now.  It matches Firefox.  At different DPI settings on Windows,
+    // querying the theme gives you a larger size that accounts for the higher
+    // DPI.  Until our entire engine honors a DPI setting other than 96, we
+    // can't rely on the theme's metrics.
+    const IntSize size(13, 13);
+    setSizeIfAuto(style, size);
+}
+
+void RenderThemeChromiumWin::setRadioSize(RenderStyle* style) const
+{
+    // Use same sizing for radio box as checkbox.
+    setCheckboxSize(style);
+}
+
+bool RenderThemeChromiumWin::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    const ThemeData& themeData = getThemeData(o);
+
+    WebCore::ThemePainter painter(i.context, r);
+    ChromiumBridge::paintButton(painter.context(),
+                                themeData.m_part,
+                                themeData.m_state,
+                                themeData.m_classicState,
+                                painter.drawRect());
+    return false;
+}
+
+bool RenderThemeChromiumWin::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    return paintTextFieldInternal(o, i, r, true);
+}
+
+bool RenderThemeChromiumWin::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    const ThemeData& themeData = getThemeData(o);
+
+    WebCore::ThemePainter painter(i.context, r);
+    ChromiumBridge::paintTrackbar(painter.context(),
+                                  themeData.m_part,
+                                  themeData.m_state,
+                                  themeData.m_classicState,
+                                  painter.drawRect());
+    return false;
+}
+
+void RenderThemeChromiumWin::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int cancelButtonSize = lroundf(std::min(std::max(minCancelButtonSize, defaultCancelButtonSize * fontScale), maxCancelButtonSize));
+    style->setWidth(Length(cancelButtonSize, Fixed));
+    style->setHeight(Length(cancelButtonSize, Fixed));
+}
+
+bool RenderThemeChromiumWin::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled button stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
+    static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
+    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    return false;
+}
+
+void RenderThemeChromiumWin::adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    IntSize emptySize(1, 11);
+    style->setWidth(Length(emptySize.width(), Fixed));
+    style->setHeight(Length(emptySize.height(), Fixed));
+}
+
+void RenderThemeChromiumWin::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the decoration size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierSize = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                         maxSearchFieldResultsDecorationSize));
+    style->setWidth(Length(magnifierSize, Fixed));
+    style->setHeight(Length(magnifierSize, Fixed));
+}
+
+bool RenderThemeChromiumWin::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the decoration vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+    
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+void RenderThemeChromiumWin::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierHeight = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                           maxSearchFieldResultsDecorationSize));
+    int magnifierWidth = lroundf(magnifierHeight * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize);
+    style->setWidth(Length(magnifierWidth, Fixed));
+    style->setHeight(Length(magnifierHeight, Fixed));
+}
+
+bool RenderThemeChromiumWin::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent())
+        return false;
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.height(), bounds.height()));
+    bounds.setWidth(std::min(parentBox.width(), static_cast<int>(bounds.height() * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize)));
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+bool RenderThemeChromiumWin::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    context->beginTransparencyLayer(defaultMediaControlOpacity);
+
+    // Draw background.
+    Color oldFill = context->fillColor();
+    Color oldStroke = context->strokeColor();
+
+    context->setFillColor(Color::black);
+    context->setStrokeColor(Color::black);
+    context->drawRect(rect);
+
+    context->setFillColor(oldFill);
+    context->setStrokeColor(oldStroke);
+
+    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
+    IntRect imageRect = image->rect();
+    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
+    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
+
+    context->drawImage(image, imageRect, CompositeSourceAtop);
+    context->endTransparencyLayer();
+
+    return false;
+}
+
+bool RenderThemeChromiumWin::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
+    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+#else
+    return false;
+#endif
+}
+
+bool RenderThemeChromiumWin::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
+    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+#else
+    return false;
+#endif
+}
+
+void RenderThemeChromiumWin::adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    // Height is locked to auto on all browsers.
+    style->setLineHeight(RenderStyle::initialLineHeight());
+}
+
+// Used to paint unstyled menulists (i.e. with the default border)
+bool RenderThemeChromiumWin::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    if (!o->isBox())
+        return false;
+
+    const RenderBox* box = toRenderBox(o);
+    int borderRight = box->borderRight();
+    int borderLeft = box->borderLeft();
+    int borderTop = box->borderTop();
+    int borderBottom = box->borderBottom();
+
+    // If all the borders are 0, then tell skia not to paint the border on the
+    // textfield.  FIXME: http://b/1210017 Figure out how to get Windows to not
+    // draw individual borders and then pass that to skia so we can avoid
+    // drawing any borders that are set to 0. For non-zero borders, we draw the
+    // border, but webkit just draws over it.
+    bool drawEdges = !(borderRight == 0 && borderLeft == 0 && borderTop == 0 && borderBottom == 0);
+
+    paintTextFieldInternal(o, i, r, drawEdges);
+
+    // Take padding and border into account.  If the MenuList is smaller than
+    // the size of a button, make sure to shrink it appropriately and not put
+    // its x position to the left of the menulist.
+    const int buttonWidth = GetSystemMetrics(SM_CXVSCROLL);
+    int spacingLeft = borderLeft + box->paddingLeft();
+    int spacingRight = borderRight + box->paddingRight();
+    int spacingTop = borderTop + box->paddingTop();
+    int spacingBottom = borderBottom + box->paddingBottom();
+
+    int buttonX;
+    if (r.right() - r.x() < buttonWidth)
+        buttonX = r.x();
+    else
+        buttonX = o->style()->direction() == LTR ? r.right() - spacingRight - buttonWidth : r.x() + spacingLeft;
+
+    // Compute the rectangle of the button in the destination image.
+    IntRect rect(buttonX,
+                 r.y() + spacingTop,
+                 std::min(buttonWidth, r.right() - r.x()),
+                 r.height() - (spacingTop + spacingBottom));
+
+    // Get the correct theme data for a textfield and paint the menu.
+    WebCore::ThemePainter painter(i.context, rect);
+    ChromiumBridge::paintMenuList(painter.context(),
+                                  CP_DROPDOWNBUTTON,
+                                  determineState(o),
+                                  determineClassicState(o),
+                                  painter.drawRect());
+    return false;
+}
+
+void RenderThemeChromiumWin::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    adjustMenuListStyle(selector, style, e);
+}
+
+// Used to paint styled menulists (i.e. with a non-default border)
+bool RenderThemeChromiumWin::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    return paintMenuList(o, i, r);
+}
+
+int RenderThemeChromiumWin::popupInternalPaddingLeft(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, LeftPadding);
+}
+
+int RenderThemeChromiumWin::popupInternalPaddingRight(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, RightPadding);
+}
+
+int RenderThemeChromiumWin::popupInternalPaddingTop(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, TopPadding);
+}
+
+int RenderThemeChromiumWin::popupInternalPaddingBottom(RenderStyle* style) const
+{
+    return menuListInternalPadding(style, BottomPadding);
+}
+
+int RenderThemeChromiumWin::buttonInternalPaddingLeft() const
+{
+    return 3;
+}
+
+int RenderThemeChromiumWin::buttonInternalPaddingRight() const
+{
+    return 3;
+}
+
+int RenderThemeChromiumWin::buttonInternalPaddingTop() const
+{
+    return 1;
+}
+
+int RenderThemeChromiumWin::buttonInternalPaddingBottom() const
+{
+    return 1;
+}
+
+// static
+void RenderThemeChromiumWin::setDefaultFontSize(int fontSize)
+{
+    defaultFontSize = static_cast<float>(fontSize);
+
+    // Reset cached fonts.
+    smallSystemFont = menuFont = labelFont = FontDescription();
+}
+
+unsigned RenderThemeChromiumWin::determineState(RenderObject* o)
+{
+    unsigned result = TS_NORMAL;
+    ControlPart appearance = o->style()->appearance();
+    if (!isEnabled(o))
+        result = TS_DISABLED;
+    else if (isReadOnlyControl(o) && (TextFieldPart == appearance || TextAreaPart == appearance || SearchFieldPart == appearance))
+        result = ETS_READONLY; // Readonly is supported on textfields.
+    else if (isPressed(o)) // Active overrides hover and focused.
+        result = TS_PRESSED;
+    else if (supportsFocus(appearance) && isFocused(o))
+        result = ETS_FOCUSED;
+    else if (isHovered(o))
+        result = TS_HOT;
+    if (isChecked(o))
+        result += 4; // 4 unchecked states, 4 checked states.
+    return result;
+}
+
+unsigned RenderThemeChromiumWin::determineSliderThumbState(RenderObject* o)
+{
+    unsigned result = TUS_NORMAL;
+    if (!isEnabled(o->parent()))
+        result = TUS_DISABLED;
+    else if (supportsFocus(o->style()->appearance()) && isFocused(o->parent()))
+        result = TUS_FOCUSED;
+    else if (static_cast<RenderSlider*>(o->parent())->inDragMode())
+        result = TUS_PRESSED;
+    else if (isHovered(o))
+        result = TUS_HOT;
+    return result;
+}
+
+unsigned RenderThemeChromiumWin::determineClassicState(RenderObject* o)
+{
+    unsigned result = 0;
+    if (!isEnabled(o))
+        result = DFCS_INACTIVE;
+    else if (isPressed(o)) // Active supersedes hover
+        result = DFCS_PUSHED;
+    else if (isHovered(o))
+        result = DFCS_HOT;
+    if (isChecked(o))
+        result |= DFCS_CHECKED;
+    return result;
+}
+
+ThemeData RenderThemeChromiumWin::getThemeData(RenderObject* o)
+{
+    ThemeData result;
+    switch (o->style()->appearance()) {
+    case CheckboxPart:
+        result.m_part = BP_CHECKBOX;
+        result.m_state = determineState(o);
+        result.m_classicState = DFCS_BUTTONCHECK;
+        break;
+    case RadioPart:
+        result.m_part = BP_RADIOBUTTON;
+        result.m_state = determineState(o);
+        result.m_classicState = DFCS_BUTTONRADIO;
+        break;
+    case PushButtonPart:
+    case ButtonPart:
+        result.m_part = BP_PUSHBUTTON;
+        result.m_state = determineState(o);
+        result.m_classicState = DFCS_BUTTONPUSH;
+        break;
+    case SliderHorizontalPart:
+        result.m_part = TKP_TRACK;
+        result.m_state = TRS_NORMAL;
+        break;
+    case SliderVerticalPart:
+        result.m_part = TKP_TRACKVERT;
+        result.m_state = TRVS_NORMAL;
+        break;
+    case SliderThumbHorizontalPart:
+        result.m_part = TKP_THUMBBOTTOM;
+        result.m_state = determineSliderThumbState(o);
+        break;
+    case SliderThumbVerticalPart:
+        result.m_part = TKP_THUMBVERT;
+        result.m_state = determineSliderThumbState(o);
+        break;
+    case ListboxPart:
+    case MenulistPart:
+    case SearchFieldPart:
+    case TextFieldPart:
+    case TextAreaPart:
+        result.m_part = EP_EDITTEXT;
+        result.m_state = determineState(o);
+        break;
+    }
+
+    result.m_classicState |= determineClassicState(o);
+
+    return result;
+}
+
+bool RenderThemeChromiumWin::paintTextFieldInternal(RenderObject* o,
+                                                    const RenderObject::PaintInfo& i,
+                                                    const IntRect& r,
+                                                    bool drawEdges)
+{
+    // Nasty hack to make us not paint the border on text fields with a
+    // border-radius. Webkit paints elements with border-radius for us.
+    // FIXME: Get rid of this if-check once we can properly clip rounded
+    // borders: http://b/1112604 and http://b/1108635
+    // FIXME: make sure we do the right thing if css background-clip is set.
+    if (o->style()->hasBorderRadius())
+        return false;
+
+    const ThemeData& themeData = getThemeData(o);
+
+    // Fallback to white if the specified color object is invalid.
+    Color backgroundColor(Color::white);
+    if (o->style()->backgroundColor().isValid()) {
+        backgroundColor = o->style()->backgroundColor();
+    }
+
+    // If we have background-image, don't fill the content area to expose the
+    // parent's background. Also, we shouldn't fill the content area if the
+    // alpha of the color is 0. The API of Windows GDI ignores the alpha.
+    //
+    // Note that we should paint the content area white if we have neither the
+    // background color nor background image explicitly specified to keep the
+    // appearance of select element consistent with other browsers.
+    bool fillContentArea = !o->style()->hasBackgroundImage() && backgroundColor.alpha() != 0;
+
+    WebCore::ThemePainter painter(i.context, r);
+    ChromiumBridge::paintTextField(painter.context(),
+                                   themeData.m_part,
+                                   themeData.m_state,
+                                   themeData.m_classicState,
+                                   painter.drawRect(),
+                                   backgroundColor,
+                                   fillContentArea,
+                                   drawEdges);
+    return false;
+}
+
+int RenderThemeChromiumWin::menuListInternalPadding(RenderStyle* style, int paddingType) const
+{
+    // This internal padding is in addition to the user-supplied padding.
+    // Matches the FF behavior.
+    int padding = styledMenuListInternalPadding[paddingType];
+
+    // Reserve the space for right arrow here. The rest of the padding is set
+    // by adjustMenuListStyle, since PopupMenuChromium.cpp uses the padding
+    // from RenderMenuList to lay out the individual items in the popup.  If
+    // the MenuList actually has appearance "NoAppearance", then that means we
+    // don't draw a button, so don't reserve space for it.
+    const int barType = style->direction() == LTR ? RightPadding : LeftPadding;
+    if (paddingType == barType && style->appearance() != NoControlPart)
+        padding += ScrollbarTheme::nativeTheme()->scrollbarThickness();
+
+    return padding;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
new file mode 100644
index 0000000000..6ba6595e92
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
@@ -0,0 +1,158 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderThemeChromiumWin_h
+#define RenderThemeChromiumWin_h
+
+#include "RenderTheme.h"
+
+#if WIN32
+typedef void* HANDLE;
+typedef struct HINSTANCE__* HINSTANCE;
+typedef HINSTANCE HMODULE;
+#endif
+
+namespace WebCore {
+
+    struct ThemeData {
+        ThemeData() : m_part(0), m_state(0), m_classicState(0) {}
+
+        unsigned m_part;
+        unsigned m_state;
+        unsigned m_classicState;
+    };
+
+    class RenderThemeChromiumWin : public RenderTheme {
+    public:
+        RenderThemeChromiumWin() { }
+        ~RenderThemeChromiumWin() { }
+
+        virtual String extraDefaultStyleSheet();
+        virtual String extraQuirksStyleSheet();
+#if ENABLE(VIDEO)
+        virtual String extraMediaControlsStyleSheet();
+#endif
+
+        // A method asking if the theme's controls actually care about redrawing when hovered.
+        virtual bool supportsHover(const RenderStyle*) const { return true; }
+
+        // A method asking if the theme is able to draw the focus ring.
+        virtual bool supportsFocusRing(const RenderStyle*) const;
+
+        // The platform selection color.
+        virtual Color platformActiveSelectionBackgroundColor() const;
+        virtual Color platformInactiveSelectionBackgroundColor() const;
+        virtual Color platformActiveSelectionForegroundColor() const;
+        virtual Color platformInactiveSelectionForegroundColor() const;
+        virtual Color platformActiveTextSearchHighlightColor() const;
+        virtual Color platformInactiveTextSearchHighlightColor() const;
+
+        virtual double caretBlinkInterval() const;
+
+        // System fonts.
+        virtual void systemFont(int propId, FontDescription&) const;
+
+        virtual int minimumMenuListSize(RenderStyle*) const;
+
+        virtual void adjustSliderThumbSize(RenderObject*) const;
+
+        virtual bool paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintButton(o, i, r); }
+        virtual void setCheckboxSize(RenderStyle*) const;
+
+        virtual bool paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintButton(o, i, r); }
+        virtual void setRadioSize(RenderStyle*) const;
+
+        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintTextField(o, i, r); }
+
+        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintSliderTrack(o, i, r); }
+
+        virtual bool paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintTextField(o, i, r); }
+
+        virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        // MenuList refers to an unstyled menulist (meaning a menulist without
+        // background-color or border set) and MenuListButton refers to a styled
+        // menulist (a menulist with background-color or border set). They have
+        // this distinction to support showing aqua style themes whenever they
+        // possibly can, which is something we don't want to replicate.
+        //
+        // In short, we either go down the MenuList code path or the MenuListButton
+        // codepath. We never go down both. And in both cases, they render the
+        // entire menulist.
+        virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        // These methods define the padding for the MenuList's inner block.
+        virtual int popupInternalPaddingLeft(RenderStyle*) const;
+        virtual int popupInternalPaddingRight(RenderStyle*) const;
+        virtual int popupInternalPaddingTop(RenderStyle*) const;
+        virtual int popupInternalPaddingBottom(RenderStyle*) const;
+
+        virtual int buttonInternalPaddingLeft() const;
+        virtual int buttonInternalPaddingRight() const;
+        virtual int buttonInternalPaddingTop() const;
+        virtual int buttonInternalPaddingBottom() const;
+
+        // Provide a way to pass the default font size from the Settings object
+        // to the render theme.  FIXME: http://b/1129186 A cleaner way would be
+        // to remove the default font size from this object and have callers
+        // that need the value to get it directly from the appropriate Settings
+        // object.
+        static void setDefaultFontSize(int);
+
+    private:
+        unsigned determineState(RenderObject*);
+        unsigned determineSliderThumbState(RenderObject*);
+        unsigned determineClassicState(RenderObject*);
+
+        ThemeData getThemeData(RenderObject*);
+
+        bool paintTextFieldInternal(RenderObject*, const RenderObject::PaintInfo&, const IntRect&, bool);
+        bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
+
+        int menuListInternalPadding(RenderStyle*, int paddingType) const;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
index a1da7ff6f8..63f1d978c7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
@@ -55,7 +55,12 @@ public:
 
     virtual Color platformActiveSelectionBackgroundColor() const;
     virtual Color platformInactiveSelectionBackgroundColor() const;
-    virtual Color activeListBoxSelectionBackgroundColor() const;
+    virtual Color platformActiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformActiveListBoxSelectionForegroundColor() const;
+    virtual Color platformInactiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformInactiveListBoxSelectionForegroundColor() const;
+
+    virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
     
     virtual void platformColorsDidChange();
 
@@ -76,6 +81,8 @@ public:
     virtual Color systemColor(int cssValueId) const;
 
 protected:
+    virtual bool supportsSelectionForegroundColors() const { return false; }
+
     virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
@@ -109,6 +116,7 @@ protected:
     virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+#if ENABLE(VIDEO)
     virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
@@ -116,6 +124,14 @@ protected:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaTimelineContainer(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    // Media controls
+    virtual bool hitTestMediaControlPart(RenderObject*, const IntPoint& absPoint);
+    virtual String extraMediaControlsStyleSheet();
+#endif
 
 private:
     IntRect inflateRect(const IntRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
index 31315bcacc..3affd1fd57 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
@@ -34,6 +34,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "RenderMediaControls.h"
 #include "RenderSlider.h"
 #include "RenderView.h"
 #include "RetainPtr.h"
@@ -272,8 +273,14 @@ IntRect RenderThemeSafari::inflateRect(const IntRect& r, const IntSize& size, co
 
 int RenderThemeSafari::baselinePosition(const RenderObject* o) const
 {
-    if (o->style()->appearance() == CheckboxPart || o->style()->appearance() == RadioPart)
-        return o->marginTop() + o->height() - 2; // The baseline is 2px up from the bottom of the checkbox/radio in AppKit.
+    if (!o->isBox())
+        return 0;
+
+    if (o->style()->appearance() == CheckboxPart || o->style()->appearance() == RadioPart) {
+        const RenderBox* box = toRenderBox(o);
+        return box->marginTop() + box->height() - 2; // The baseline is 2px up from the bottom of the checkbox/radio in AppKit.
+    }
+
     return RenderTheme::baselinePosition(o);
 }
 
@@ -828,7 +835,7 @@ void RenderThemeSafari::adjustMenuListStyle(CSSStyleSelector* selector, RenderSt
 
     // Set the foreground color to black or gray when we have the aqua look.
     // Cast to RGB32 is to work around a compiler bug.
-    style->setColor(e->isEnabled() ? static_cast<RGBA32>(Color::black) : Color::darkGray);
+    style->setColor(e && e->isEnabledFormControl() ? static_cast<RGBA32>(Color::black) : Color::darkGray);
 
     // Set the button's vertical size.
     setButtonSize(style);
@@ -909,8 +916,7 @@ bool RenderThemeSafari::paintSliderTrack(RenderObject* o, const RenderObject::Pa
 {
     IntRect bounds = r;
 
-    if (o->style()->appearance() ==  SliderHorizontalPart || 
-        o->style()->appearance() == MediaSliderPart) {
+    if (o->style()->appearance() ==  SliderHorizontalPart) {
         bounds.setHeight(trackWidth);
         bounds.setY(r.y() + r.height() / 2 - trackWidth / 2);
     } else if (o->style()->appearance() == SliderVerticalPart) {
@@ -967,19 +973,17 @@ bool RenderThemeSafari::paintSliderThumb(RenderObject* o, const RenderObject::Pa
 
 const int sliderThumbWidth = 15;
 const int sliderThumbHeight = 15;
-const int mediaSliderThumbWidth = 13;
-const int mediaSliderThumbHeight = 14;
 
 void RenderThemeSafari::adjustSliderThumbSize(RenderObject* o) const
 {
     if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == SliderThumbVerticalPart) {
         o->style()->setWidth(Length(sliderThumbWidth, Fixed));
         o->style()->setHeight(Length(sliderThumbHeight, Fixed));
-    } else if (o->style()->appearance() == MediaSliderThumbPart) {
-        o->style()->setWidth(Length(mediaSliderThumbWidth, Fixed));
-        o->style()->setHeight(Length(mediaSliderThumbHeight, Fixed));
-    }
-
+    } 
+#if ENABLE(VIDEO)
+    else if (o->style()->appearance() == MediaSliderThumbPart) 
+        RenderMediaControls::adjustMediaSliderThumbSize(o);
+#endif
 }
 
 bool RenderThemeSafari::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
@@ -1129,104 +1133,37 @@ bool RenderThemeSafari::paintSearchFieldResultsButton(RenderObject* o, const Ren
 #if ENABLE(VIDEO)
 bool RenderThemeSafari::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(SafariTheme::MediaFullscreenButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* node = o->element();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(mediaElement->muted() ? SafariTheme::MediaUnMuteButtonPart : SafariTheme::MediaMuteButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaMuteButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* node = o->element();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(mediaElement->canPlay() ? SafariTheme::MediaPlayButtonPart : SafariTheme::MediaPauseButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaPlayButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(SafariTheme::MediaSeekBackButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekBackButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekForwardButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* node = o->element();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-    float percentLoaded = 0;
-    if (MediaPlayer* player = mediaElement->player())
-        if (player->duration())
-            percentLoaded = player->maxTimeBuffered() / player->duration();
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, percentLoaded);
-#endif
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSlider, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    ASSERT(SafariThemeLibrary());
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    paintThemePart(SafariTheme::MediaSliderThumbPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
 }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
index fd07b54f78..1fa51629db 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
@@ -21,17 +21,20 @@
 #include "config.h"
 #include "RenderThemeWin.h"
 
-#include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
-#include "Document.h"
+#include "Element.h"
+#include "Frame.h"
 #include "GraphicsContext.h"
-#include "HTMLElement.h"
-#include "HTMLSelectElement.h"
-#include "Icon.h"
 #include "RenderSlider.h"
+#include "Settings.h"
 #include "SoftLinking.h"
+#include "SystemInfo.h"
 #include "UserAgentStyleSheets.h"
 
+#if ENABLE(VIDEO)
+#include "RenderMediaControls.h"
+#endif
+
 #include <tchar.h>
 
 /* 
@@ -54,10 +57,14 @@
 
 // Textfield constants
 #define TFP_TEXTFIELD 1
+#define EP_EDITBORDER_NOSCROLL 6
 #define TFS_READONLY  6
 
-// ComboBox constants (from tmschema.h)
+// ComboBox constants (from vsstyle.h)
 #define CP_DROPDOWNBUTTON 1
+#define CP_BORDER 4
+#define CP_READONLY 5
+#define CP_DROPDOWNBUTTONRIGHT 6
 
 // TrackBar (slider) parts
 #define TKP_TRACK       1
@@ -83,14 +90,6 @@
 #define PBS_DISABLED    4
 #define PBS_DEFAULTED   5
 
-// This is the fixed width IE and Firefox use for buttons on dropdown menus
-static const int dropDownButtonWidth = 17;
-
-static const int shell32MagnifierIconIndex = 22;
-
-// Default font size to match Firefox.
-static const float defaultControlFontPixelSize = 13;
-
 SOFT_LINK_LIBRARY(uxtheme)
 SOFT_LINK(uxtheme, OpenThemeData, HANDLE, WINAPI, (HWND hwnd, LPCWSTR pszClassList), (hwnd, pszClassList))
 SOFT_LINK(uxtheme, CloseThemeData, HRESULT, WINAPI, (HANDLE hTheme), (hTheme))
@@ -100,10 +99,36 @@ SOFT_LINK(uxtheme, IsThemeBackgroundPartiallyTransparent, BOOL, WINAPI, (HANDLE
 
 static bool haveTheme;
 
+static const unsigned vistaMenuListButtonOutset = 1;
+
+using namespace std;
+
 namespace WebCore {
 
+// This is the fixed width IE and Firefox use for buttons on dropdown menus
+static const int dropDownButtonWidth = 17;
+
+static const int shell32MagnifierIconIndex = 22;
+
+// Default font size to match Firefox.
+static const float defaultControlFontPixelSize = 13;
+
+static const float defaultCancelButtonSize = 9;
+static const float minCancelButtonSize = 5;
+static const float maxCancelButtonSize = 21;
+static const float defaultSearchFieldResultsDecorationSize = 13;
+static const float minSearchFieldResultsDecorationSize = 9;
+static const float maxSearchFieldResultsDecorationSize = 30;
+static const float defaultSearchFieldResultsButtonWidth = 18;
+
 static bool gWebKitIsBeingUnloaded;
 
+static bool documentIsInApplicationChromeMode(const Document* document)
+{
+    Settings* settings = document->settings();
+    return settings && settings->inApplicationChromeMode();
+}
+
 void RenderThemeWin::setWebKitIsBeingUnloaded()
 {
     gWebKitIsBeingUnloaded = true;
@@ -202,24 +227,24 @@ bool RenderThemeWin::supportsHover(const RenderStyle*) const
 Color RenderThemeWin::platformActiveSelectionBackgroundColor() const
 {
     COLORREF color = GetSysColor(COLOR_HIGHLIGHT);
-    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 255);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color));
 }
 
 Color RenderThemeWin::platformInactiveSelectionBackgroundColor() const
 {
-    COLORREF color = GetSysColor(COLOR_GRAYTEXT);
-    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 255);
+    // This color matches Firefox.
+    return Color(176, 176, 176);
 }
 
 Color RenderThemeWin::platformActiveSelectionForegroundColor() const
 {
     COLORREF color = GetSysColor(COLOR_HIGHLIGHTTEXT);
-    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 255);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color));
 }
 
 Color RenderThemeWin::platformInactiveSelectionForegroundColor() const
 {
-    return Color::white;
+    return platformActiveSelectionForegroundColor();
 }
 
 static void fillFontDescription(FontDescription& fontDescription, LOGFONT& logFont, float fontSize)
@@ -319,22 +344,23 @@ void RenderThemeWin::systemFont(int propId, FontDescription& fontDescription) co
     }
 }
 
-bool RenderThemeWin::supportsFocus(ControlPart appearance)
+bool RenderThemeWin::supportsFocus(ControlPart appearance) const
 {
     switch (appearance) {
         case PushButtonPart:
         case ButtonPart:
         case DefaultButtonPart:
-        case TextFieldPart:
-        case TextAreaPart:
             return true;
-        case MenulistPart:
-            return false;
         default:
             return false;
     }
 }
 
+bool RenderThemeWin::supportsFocusRing(const RenderStyle* style) const
+{
+    return supportsFocus(style->appearance());
+}
+
 unsigned RenderThemeWin::determineClassicState(RenderObject* o)
 {
     unsigned state = 0;
@@ -376,7 +402,7 @@ unsigned RenderThemeWin::determineState(RenderObject* o)
     ControlPart appearance = o->style()->appearance();
     if (!isEnabled(o))
         result = TS_DISABLED;
-    else if (isReadOnlyControl(o) && (TextFieldPart == appearance || TextAreaPart == appearance))
+    else if (isReadOnlyControl(o) && (TextFieldPart == appearance || TextAreaPart == appearance || SearchFieldPart == appearance))
         result = TFS_READONLY; // Readonly is supported on textfields.
     else if (isPressed(o)) // Active overrides hover and focused.
         result = TS_ACTIVE;
@@ -435,6 +461,7 @@ ThemeData RenderThemeWin::getClassicThemeData(RenderObject* o)
             result.m_part = DFC_SCROLL;
             result.m_state = determineClassicState(o);
             break;
+        case SearchFieldPart:
         case TextFieldPart:
         case TextAreaPart:
             result.m_part = TFP_TEXTFIELD;
@@ -481,16 +508,22 @@ ThemeData RenderThemeWin::getThemeData(RenderObject* o)
             break;
         case MenulistPart:
         case MenulistButtonPart:
-            result.m_part = CP_DROPDOWNBUTTON;
-            result.m_state = determineState(o);
+            result.m_part = isRunningOnVistaOrLater() ? CP_DROPDOWNBUTTONRIGHT : CP_DROPDOWNBUTTON;
+            if (isRunningOnVistaOrLater() && documentIsInApplicationChromeMode(o->document())) {
+                // The "readonly" look we use in application chrome mode
+                // only uses a "normal" look for the drop down button.
+                result.m_state = TS_NORMAL;
+            } else
+                result.m_state = determineState(o);
             break;
         case RadioPart:
             result.m_part = BP_RADIO;
             result.m_state = determineState(o);
             break;
+        case SearchFieldPart:
         case TextFieldPart:
         case TextAreaPart:
-            result.m_part = TFP_TEXTFIELD;
+            result.m_part = isRunningOnVistaOrLater() ? EP_EDITBORDER_NOSCROLL : TFP_TEXTFIELD;
             result.m_state = determineState(o);
             break;
         case SliderHorizontalPart:
@@ -602,8 +635,20 @@ bool RenderThemeWin::paintTextField(RenderObject* o, const RenderObject::PaintIn
 
 bool RenderThemeWin::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    // The outer box of a menu list is just a text field.  Paint it first.
-    drawControl(i.context,  o, textFieldTheme(), ThemeData(TFP_TEXTFIELD, determineState(o)), r);
+    HANDLE theme;
+    int part;
+    if (haveTheme && isRunningOnVistaOrLater()) {
+        theme = menuListTheme();
+        if (documentIsInApplicationChromeMode(o->document()))
+            part = CP_READONLY;
+        else
+            part = CP_BORDER;
+    } else {
+        theme = textFieldTheme();
+        part = TFP_TEXTFIELD;
+    }
+
+    drawControl(i.context,  o, theme, ThemeData(part, determineState(o)), r);
     
     return paintMenuListButton(o, i, r);
 }
@@ -656,6 +701,13 @@ bool RenderThemeWin::paintMenuListButton(RenderObject* o, const RenderObject::Pa
         buttonRect.setX(buttonRect.right() - dropDownButtonWidth);
     buttonRect.setWidth(dropDownButtonWidth);
 
+    if (isRunningOnVistaOrLater()) {
+        // Outset the top, right, and bottom borders of the button so that they coincide with the <select>'s border.
+        buttonRect.setY(buttonRect.y() - vistaMenuListButtonOutset);
+        buttonRect.setHeight(buttonRect.height() + 2 * vistaMenuListButtonOutset);
+        buttonRect.setWidth(buttonRect.width() + vistaMenuListButtonOutset);
+    }
+
     drawControl(i.context, o, menuListTheme(), getThemeData(o), buttonRect);
 
     return false;
@@ -697,15 +749,30 @@ void RenderThemeWin::adjustSliderThumbSize(RenderObject* o) const
         o->style()->setWidth(Length(sliderThumbWidth, Fixed));
         o->style()->setHeight(Length(sliderThumbHeight, Fixed));
     }
+#if ENABLE(VIDEO)
+    else if (o->style()->appearance() == MediaSliderThumbPart) 
+        RenderMediaControls::adjustMediaSliderThumbSize(o);
+#endif
+}
+
+int RenderThemeWin::buttonInternalPaddingLeft() const
+{
+    return 3;
+}
+
+int RenderThemeWin::buttonInternalPaddingRight() const
+{
+    return 3;
+}
+
+int RenderThemeWin::buttonInternalPaddingTop() const
+{
+    return 1;
 }
 
-void RenderThemeWin::adjustButtonInnerStyle(RenderStyle* style) const
+int RenderThemeWin::buttonInternalPaddingBottom() const
 {
-    // This inner padding matches Firefox.
-    style->setPaddingTop(Length(1, Fixed));
-    style->setPaddingRight(Length(3, Fixed));
-    style->setPaddingBottom(Length(1, Fixed));
-    style->setPaddingLeft(Length(3, Fixed));
+    return 1;
 }
 
 bool RenderThemeWin::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
@@ -714,44 +781,49 @@ bool RenderThemeWin::paintSearchField(RenderObject* o, const RenderObject::Paint
 }
 
 void RenderThemeWin::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
-{   
-    // Override padding size to match AppKit text positioning.
+{
+    // Override paddingSize to match AppKit text positioning.
     const int padding = 1;
     style->setPaddingLeft(Length(padding, Fixed));
     style->setPaddingRight(Length(padding, Fixed));
     style->setPaddingTop(Length(padding, Fixed));
     style->setPaddingBottom(Length(padding, Fixed));
+    if (e && e->focused() && e->document()->frame()->selection()->isFocusedAndActive())
+        style->setOutlineOffset(-2);
 }
 
 bool RenderThemeWin::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    Color buttonColor = (o->element() && o->element()->active()) ? Color(138, 138, 138) : Color(186, 186, 186);
-
-    IntSize cancelSize(10, 10);
-    IntSize cancelRadius(cancelSize.width() / 2, cancelSize.height() / 2);
-    int x = r.x() + (r.width() - cancelSize.width()) / 2;
-    int y = r.y() + (r.height() - cancelSize.height()) / 2 + 1;
-    IntRect cancelBounds(IntPoint(x, y), cancelSize);
-    paintInfo.context->save();
-    paintInfo.context->addRoundedRectClip(cancelBounds, cancelRadius, cancelRadius, cancelRadius, cancelRadius);
-    paintInfo.context->fillRect(cancelBounds, buttonColor);
-
-    // Draw the 'x'
-    IntSize xSize(3, 3);
-    IntRect xBounds(cancelBounds.location() + IntSize(3, 3), xSize);
-    paintInfo.context->setStrokeColor(Color::white);
-    paintInfo.context->drawLine(xBounds.location(),  xBounds.location() + xBounds.size());
-    paintInfo.context->drawLine(IntPoint(xBounds.right(), xBounds.y()),  IntPoint(xBounds.x(), xBounds.bottom()));
-
-    paintInfo.context->restore(); 
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled button stays square and will fit in its parent's box
+    bounds.setHeight(min(parentBox.width(), min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
+    static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
+    paintInfo.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
     return false;
 }
 
 void RenderThemeWin::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
 {
-    IntSize cancelSize(13, 11);
-    style->setWidth(Length(cancelSize.width(), Fixed));
-    style->setHeight(Length(cancelSize.height(), Fixed));
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int cancelButtonSize = lroundf(min(max(minCancelButtonSize, defaultCancelButtonSize * fontScale), maxCancelButtonSize));
+    style->setWidth(Length(cancelButtonSize, Fixed));
+    style->setHeight(Length(cancelButtonSize, Fixed));
 }
 
 void RenderThemeWin::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
@@ -760,46 +832,73 @@ void RenderThemeWin::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector
     style->setWidth(Length(emptySize.width(), Fixed));
     style->setHeight(Length(emptySize.height(), Fixed));
 }
-   
+
 void RenderThemeWin::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
 {
-    IntSize magnifierSize(15, 11);
-    style->setWidth(Length(magnifierSize.width(), Fixed));
-    style->setHeight(Length(magnifierSize.height(), Fixed));
+    // Scale the decoration size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierSize = lroundf(min(max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                     maxSearchFieldResultsDecorationSize));
+    style->setWidth(Length(magnifierSize, Fixed));
+    style->setHeight(Length(magnifierSize, Fixed));
 }
 
 bool RenderThemeWin::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration stays square and will fit in its parent's box
+    bounds.setHeight(min(parentBox.width(), min(parentBox.height(), bounds.height())));
     bounds.setWidth(bounds.height());
 
-    TCHAR buffer[MAX_PATH];
-    UINT length = ::GetSystemDirectory(buffer, ARRAYSIZE(buffer));
-    if (!length)
-        return 0;
+    // Center the decoration vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
     
-    if (_tcscat_s(buffer, TEXT("\\shell32.dll")))
-        return 0;
-
-    HICON hIcon;
-    if (!::ExtractIconEx(buffer, shell32MagnifierIconIndex, 0, &hIcon, 1))
-        return 0;
-
-    RefPtr<Icon> icon = Icon::create(hIcon);
-    icon->paint(paintInfo.context, bounds);
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
+    paintInfo.context->drawImage(magnifierImage, bounds);
     return false;
 }
 
 void RenderThemeWin::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
 {
-    IntSize magnifierSize(15, 11);
-    style->setWidth(Length(magnifierSize.width(), Fixed));
-    style->setHeight(Length(magnifierSize.height(), Fixed));
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierHeight = lroundf(min(max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                   maxSearchFieldResultsDecorationSize));
+    int magnifierWidth = lroundf(magnifierHeight * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize);
+    style->setWidth(Length(magnifierWidth, Fixed));
+    style->setHeight(Length(magnifierHeight, Fixed));
 }
 
 bool RenderThemeWin::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintSearchFieldResultsDecoration(o, paintInfo, r);
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent())
+        return false;
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration will fit in its parent's box
+    bounds.setHeight(min(parentBox.height(), bounds.height()));
+    bounds.setWidth(min(parentBox.width(), static_cast<int>(bounds.height() * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize)));
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
+    paintInfo.context->drawImage(magnifierImage, bounds);
     return false;
 }
 
@@ -849,4 +948,41 @@ Color RenderThemeWin::systemColor(int cssValueId) const
     return Color(GetRValue(color), GetGValue(color), GetBValue(color));
 }
 
+#if ENABLE(VIDEO)
+bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaMuteButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaPlayButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekBackButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekForwardButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSlider, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h
index 8562b22468..25473a1b32 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.h
@@ -92,7 +92,12 @@ public:
     virtual bool paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
     virtual void adjustSliderThumbSize(RenderObject*) const;
 
-    virtual void adjustButtonInnerStyle(RenderStyle*) const;
+    virtual bool popupOptionSupportsTextIndent() const { return true; }
+
+    virtual int buttonInternalPaddingLeft() const;
+    virtual int buttonInternalPaddingRight() const;
+    virtual int buttonInternalPaddingTop() const;
+    virtual int buttonInternalPaddingBottom() const;
 
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
@@ -117,6 +122,18 @@ public:
 
     static void setWebKitIsBeingUnloaded();
 
+    virtual bool supportsFocusRing(const RenderStyle*) const;
+
+#if ENABLE(VIDEO)
+    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+#endif
+
 private:
     void addIntrinsicMargins(RenderStyle*) const;
     void close();
@@ -126,7 +143,7 @@ private:
     unsigned determineSliderThumbState(RenderObject*);
     unsigned determineButtonState(RenderObject*);
 
-    bool supportsFocus(ControlPart);
+    bool supportsFocus(ControlPart) const;
 
     ThemeData getThemeData(RenderObject*);
     ThemeData getClassicThemeData(RenderObject* o);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
index f46ff20a2c..79d172406d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RenderTreeAsText.h"
 
+#include "CSSMutableStyleDeclaration.h"
 #include "CharacterNames.h"
 #include "Document.h"
 #include "Frame.h"
@@ -34,6 +35,7 @@
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "RenderBR.h"
+#include "RenderInline.h"
 #include "RenderListMarker.h"
 #include "RenderTableCell.h"
 #include "RenderView.h"
@@ -43,9 +45,11 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(SVG)
-#include "RenderSVGRoot.h"
+#include "RenderPath.h"
 #include "RenderSVGContainer.h"
+#include "RenderSVGImage.h"
 #include "RenderSVGInlineText.h"
+#include "RenderSVGRoot.h"
 #include "RenderSVGText.h"
 #include "SVGRenderTreeAsText.h"
 #endif
@@ -69,7 +73,7 @@ static void writeIndent(TextStream& ts, int indent)
         ts << "  ";
 }
 
-static void printBorderStyle(TextStream& ts, const RenderObject& o, const EBorderStyle borderStyle)
+static void printBorderStyle(TextStream& ts, const EBorderStyle borderStyle)
 {
     switch (borderStyle) {
         case BNONE:
@@ -169,18 +173,46 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
     if (o.style() && o.style()->zIndex())
         ts << " zI: " << o.style()->zIndex();
 
-    if (o.element()) {
-        String tagName = getTagName(o.element());
+    if (o.node()) {
+        String tagName = getTagName(o.node());
         if (!tagName.isEmpty()) {
             ts << " {" << tagName << "}";
             // flag empty or unstyled AppleStyleSpan because we never
             // want to leave them in the DOM
-            if (isEmptyOrUnstyledAppleStyleSpan(o.element()))
+            if (isEmptyOrUnstyledAppleStyleSpan(o.node()))
                 ts << " *empty or unstyled AppleStyleSpan*";
         }
     }
 
-    IntRect r(o.xPos(), o.yPos(), o.width(), o.height());
+    bool adjustForTableCells = o.containingBlock()->isTableCell();
+
+    IntRect r;
+    if (o.isText()) {
+        // FIXME: Would be better to dump the bounding box x and y rather than the first run's x and y, but that would involve updating
+        // many test results.
+        const RenderText& text = *toRenderText(&o);
+        IntRect linesBox = text.linesBoundingBox();
+        r = IntRect(text.firstRunX(), text.firstRunY(), linesBox.width(), linesBox.height());
+        if (adjustForTableCells && !text.firstTextBox())
+            adjustForTableCells = false;
+    } else if (o.isRenderInline()) {
+        // FIXME: Would be better not to just dump 0, 0 as the x and y here.
+        const RenderInline& inlineFlow = *toRenderInline(&o);
+        r = IntRect(0, 0, inlineFlow.linesBoundingBox().width(), inlineFlow.linesBoundingBox().height());
+        adjustForTableCells = false;
+    } else if (o.isTableCell()) {
+        // FIXME: Deliberately dump the "inner" box of table cells, since that is what current results reflect.  We'd like
+        // to clean up the results to dump both the outer box and the intrinsic padding so that both bits of information are
+        // captured by the results.
+        const RenderTableCell& cell = static_cast<const RenderTableCell&>(o);
+        r = IntRect(cell.x(), cell.y() + cell.intrinsicPaddingTop(), cell.width(), cell.height() - cell.intrinsicPaddingTop() - cell.intrinsicPaddingBottom());
+    } else if (o.isBox())
+        r = toRenderBox(&o)->frameRect();
+
+    // FIXME: Temporary in order to ensure compatibility with existing layout test results.
+    if (adjustForTableCells)
+        r.move(0, -static_cast<RenderTableCell*>(o.containingBlock())->intrinsicPaddingTop());
+
     ts << " " << r;
 
     if (!(o.isText() && !o.isBR())) {
@@ -206,17 +238,21 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
             o.style()->textStrokeWidth() > 0)
             ts << " [textStrokeWidth=" << o.style()->textStrokeWidth() << "]";
 
-        if (o.borderTop() || o.borderRight() || o.borderBottom() || o.borderLeft()) {
+        if (!o.isBoxModelObject())
+            return ts;
+
+        const RenderBoxModelObject& box = *toRenderBoxModelObject(&o);
+        if (box.borderTop() || box.borderRight() || box.borderBottom() || box.borderLeft()) {
             ts << " [border:";
 
             BorderValue prevBorder;
             if (o.style()->borderTop() != prevBorder) {
                 prevBorder = o.style()->borderTop();
-                if (!o.borderTop())
+                if (!box.borderTop())
                     ts << " none";
                 else {
-                    ts << " (" << o.borderTop() << "px ";
-                    printBorderStyle(ts, o, o.style()->borderTopStyle());
+                    ts << " (" << box.borderTop() << "px ";
+                    printBorderStyle(ts, o.style()->borderTopStyle());
                     Color col = o.style()->borderTopColor();
                     if (!col.isValid())
                         col = o.style()->color();
@@ -226,11 +262,11 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
 
             if (o.style()->borderRight() != prevBorder) {
                 prevBorder = o.style()->borderRight();
-                if (!o.borderRight())
+                if (!box.borderRight())
                     ts << " none";
                 else {
-                    ts << " (" << o.borderRight() << "px ";
-                    printBorderStyle(ts, o, o.style()->borderRightStyle());
+                    ts << " (" << box.borderRight() << "px ";
+                    printBorderStyle(ts, o.style()->borderRightStyle());
                     Color col = o.style()->borderRightColor();
                     if (!col.isValid())
                         col = o.style()->color();
@@ -239,12 +275,12 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
             }
 
             if (o.style()->borderBottom() != prevBorder) {
-                prevBorder = o.style()->borderBottom();
-                if (!o.borderBottom())
+                prevBorder = box.style()->borderBottom();
+                if (!box.borderBottom())
                     ts << " none";
                 else {
-                    ts << " (" << o.borderBottom() << "px ";
-                    printBorderStyle(ts, o, o.style()->borderBottomStyle());
+                    ts << " (" << box.borderBottom() << "px ";
+                    printBorderStyle(ts, o.style()->borderBottomStyle());
                     Color col = o.style()->borderBottomColor();
                     if (!col.isValid())
                         col = o.style()->color();
@@ -254,11 +290,11 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
 
             if (o.style()->borderLeft() != prevBorder) {
                 prevBorder = o.style()->borderLeft();
-                if (!o.borderLeft())
+                if (!box.borderLeft())
                     ts << " none";
                 else {
-                    ts << " (" << o.borderLeft() << "px ";
-                    printBorderStyle(ts, o, o.style()->borderLeftStyle());
+                    ts << " (" << box.borderLeft() << "px ";
+                    printBorderStyle(ts, o.style()->borderLeftStyle());
                     Color col = o.style()->borderLeftColor();
                     if (!col.isValid())
                         col = o.style()->color();
@@ -304,14 +340,18 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
 
 static void writeTextRun(TextStream& ts, const RenderText& o, const InlineTextBox& run)
 {
-    ts << "text run at (" << run.m_x << "," << run.m_y << ") width " << run.m_width;
+    // FIXME: Table cell adjustment is temporary until results can be updated.
+    int y = run.m_y;
+    if (o.containingBlock()->isTableCell())
+        y -= static_cast<RenderTableCell*>(o.containingBlock())->intrinsicPaddingTop();
+    ts << "text run at (" << run.m_x << "," << y << ") width " << run.m_width;
     if (run.direction() == RTL || run.m_dirOverride) {
         ts << (run.direction() == RTL ? " RTL" : " LTR");
         if (run.m_dirOverride)
             ts << " override";
     }
     ts << ": "
-        << quoteAndEscapeNonPrintables(String(o.text()).substring(run.m_start, run.m_len))
+        << quoteAndEscapeNonPrintables(String(o.text()).substring(run.start(), run.len()))
         << "\n";
 }
 
@@ -337,6 +377,10 @@ void write(TextStream& ts, const RenderObject& o, int indent)
             write(ts, static_cast<const RenderSVGInlineText&>(o), indent);
         return;
     }
+    if (o.isSVGImage()) {
+        write(ts, static_cast<const RenderSVGImage&>(o), indent);
+        return;
+    }
 #endif
 
     writeIndent(ts, indent);
@@ -344,7 +388,7 @@ void write(TextStream& ts, const RenderObject& o, int indent)
     ts << o << "\n";
 
     if (o.isText() && !o.isBR()) {
-        const RenderText& text = static_cast<const RenderText&>(o);
+        const RenderText& text = *toRenderText(&o);
         for (InlineTextBox* box = text.firstTextBox(); box; box = box->nextTextBox()) {
             writeIndent(ts, indent + 1);
             writeTextRun(ts, text, *box);
@@ -361,12 +405,12 @@ void write(TextStream& ts, const RenderObject& o, int indent)
         Widget* widget = static_cast<const RenderWidget&>(o).widget();
         if (widget && widget->isFrameView()) {
             FrameView* view = static_cast<FrameView*>(widget);
-            RenderObject* root = view->frame()->contentRenderer();
+            RenderView* root = view->frame()->contentRenderer();
             if (root) {
                 view->layout();
                 RenderLayer* l = root->layer();
                 if (l)
-                    writeLayers(ts, l, l, IntRect(l->xPos(), l->yPos(), l->width(), l->height()), indent + 1);
+                    writeLayers(ts, l, l, IntRect(l->x(), l->y(), l->width(), l->height()), indent + 1);
             }
         }
     }
@@ -394,9 +438,9 @@ static void write(TextStream& ts, RenderLayer& l,
             ts << " scrollX " << l.scrollXOffset();
         if (l.scrollYOffset())
             ts << " scrollY " << l.scrollYOffset();
-        if (l.renderer()->clientWidth() != l.scrollWidth())
+        if (l.renderBox() && l.renderBox()->clientWidth() != l.scrollWidth())
             ts << " scrollWidth " << l.scrollWidth();
-        if (l.renderer()->clientHeight() != l.scrollHeight())
+        if (l.renderBox() && l.renderBox()->clientHeight() != l.scrollHeight())
             ts << " scrollHeight " << l.scrollHeight();
     }
 
@@ -420,7 +464,7 @@ static void writeLayers(TextStream& ts, const RenderLayer* rootLayer, RenderLaye
 
     // Ensure our lists are up-to-date.
     l->updateZOrderLists();
-    l->updateOverflowList();
+    l->updateNormalFlowList();
 
     bool shouldPaint = l->intersectsDamageRect(layerBounds, damageRect, rootLayer);
     Vector<RenderLayer*>* negList = l->negZOrderList();
@@ -435,10 +479,10 @@ static void writeLayers(TextStream& ts, const RenderLayer* rootLayer, RenderLaye
     if (shouldPaint)
         write(ts, *l, layerBounds, damageRect, clipRectToApply, outlineRect, negList && negList->size() > 0, indent);
 
-    Vector<RenderLayer*>* overflowList = l->overflowList();
-    if (overflowList) {
-        for (unsigned i = 0; i != overflowList->size(); ++i)
-            writeLayers(ts, rootLayer, overflowList->at(i), paintDirtyRect, indent);
+    Vector<RenderLayer*>* normalFlowList = l->normalFlowList();
+    if (normalFlowList) {
+        for (unsigned i = 0; i != normalFlowList->size(); ++i)
+            writeLayers(ts, rootLayer, normalFlowList->at(i), paintDirtyRect, indent);
     }
 
     Vector<RenderLayer*>* posList = l->posZOrderList();
@@ -470,7 +514,7 @@ static String nodePosition(Node* node)
 
 static void writeSelection(TextStream& ts, const RenderObject* o)
 {
-    Node* n = o->element();
+    Node* n = o->node();
     if (!n || !n->isDocumentNode())
         return;
 
@@ -479,15 +523,15 @@ static void writeSelection(TextStream& ts, const RenderObject* o)
     if (!frame)
         return;
 
-    Selection selection = frame->selection()->selection();
+    VisibleSelection selection = frame->selection()->selection();
     if (selection.isCaret()) {
-        ts << "caret: position " << selection.start().offset() << " of " << nodePosition(selection.start().node());
+        ts << "caret: position " << selection.start().deprecatedEditingOffset() << " of " << nodePosition(selection.start().node());
         if (selection.affinity() == UPSTREAM)
             ts << " (upstream affinity)";
         ts << "\n";
     } else if (selection.isRange())
-        ts << "selection start: position " << selection.start().offset() << " of " << nodePosition(selection.start().node()) << "\n"
-           << "selection end:   position " << selection.end().offset() << " of " << nodePosition(selection.end().node()) << "\n";
+        ts << "selection start: position " << selection.start().deprecatedEditingOffset() << " of " << nodePosition(selection.start().node()) << "\n"
+           << "selection end:   position " << selection.end().deprecatedEditingOffset() << " of " << nodePosition(selection.end().node()) << "\n";
 }
 
 String externalRepresentation(RenderObject* o)
@@ -501,9 +545,9 @@ String externalRepresentation(RenderObject* o)
 #endif
     if (o->view()->frameView())
         o->view()->frameView()->layout();
-    RenderLayer* l = o->layer();
-    if (l) {
-        writeLayers(ts, l, l, IntRect(l->xPos(), l->yPos(), l->width(), l->height()));
+    if (o->hasLayer()) {
+        RenderLayer* l = toRenderBox(o)->layer();
+        writeLayers(ts, l, l, IntRect(l->x(), l->y(), l->width(), l->height()));
         writeSelection(ts, o);
     }
     return ts.release();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp
index 3d9cb3db91..d47e2f33fb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.cpp
@@ -41,9 +41,24 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static const int cDefaultWidth = 300;
+static const int cDefaultHeight = 150;
+
 RenderVideo::RenderVideo(HTMLMediaElement* video)
-    : RenderMedia(video, video->player() ? video->player()->naturalSize() : IntSize(300, 150))
+    : RenderMedia(video)
 {
+    if (video->player())
+        setIntrinsicSize(video->player()->naturalSize());
+    else {
+        // Video in standalone media documents should not use the default 300x150
+        // size since they also have audio thrown at them. By setting the intrinsic
+        // size to 300x1 the video will resize itself in these cases, and audio will
+        // have the correct height (it needs to be > 0 for controls to render properly).
+        if (video->ownerDocument() && video->ownerDocument()->isMediaDocument())
+            setIntrinsicSize(IntSize(cDefaultWidth, 1));
+        else
+            setIntrinsicSize(IntSize(cDefaultWidth, cDefaultHeight));
+    }
 }
 
 RenderVideo::~RenderVideo()
@@ -68,7 +83,7 @@ void RenderVideo::videoSizeChanged()
 
 IntRect RenderVideo::videoBox() const 
 {
-    IntRect contentRect = contentBox();
+    IntRect contentRect = contentBoxRect();
     
     if (intrinsicSize().isEmpty() || contentRect.isEmpty())
         return IntRect();
@@ -125,12 +140,9 @@ void RenderVideo::updatePlayer()
         return;
     }
     
-    // FIXME: This doesn't work correctly with transforms.
-    FloatPoint absPos = localToAbsolute();
     IntRect videoBounds = videoBox(); 
-    videoBounds.move(absPos.x(), absPos.y());
     mediaPlayer->setFrameView(document()->view());
-    mediaPlayer->setRect(videoBounds);
+    mediaPlayer->setSize(IntSize(videoBounds.width(), videoBounds.height()));
     mediaPlayer->setVisible(true);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
index 1715509e4e..05d40bc4f3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
@@ -1,8 +1,6 @@
-/**
- * This file is part of the HTML widget for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,10 +23,19 @@
 
 #include "Document.h"
 #include "Element.h"
+#include "FloatQuad.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HitTestResult.h"
 #include "RenderLayer.h"
+#include "RenderSelectionInfo.h"
+#include "RenderWidget.h"
+#include "TransformState.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerCompositor.h"
+#endif
 
 namespace WebCore {
 
@@ -50,10 +57,7 @@ RenderView::RenderView(Node* node, FrameView* view)
 
     // init RenderObject attributes
     setInline(false);
-
-    // try to contrain the width to the views width
-    m_width = 0;
-    m_height = 0;
+    
     m_minPrefWidth = 0;
     m_maxPrefWidth = 0;
 
@@ -73,13 +77,13 @@ RenderView::~RenderView()
 void RenderView::calcHeight()
 {
     if (!printing() && m_frameView)
-        m_height = viewHeight();
+        setHeight(viewHeight());
 }
 
 void RenderView::calcWidth()
 {
     if (!printing() && m_frameView)
-        m_width = viewWidth();
+        setWidth(viewWidth());
     m_marginLeft = 0;
     m_marginRight = 0;
 }
@@ -96,10 +100,10 @@ void RenderView::calcPrefWidths()
 void RenderView::layout()
 {
     if (printing())
-        m_minPrefWidth = m_maxPrefWidth = m_width;
+        m_minPrefWidth = m_maxPrefWidth = width();
 
     // Use calcWidth/Height to get the new width/height, since this will take the full page zoom factor into account.
-    bool relayoutChildren = !printing() && (!m_frameView || m_width != viewWidth() || m_height != viewHeight());
+    bool relayoutChildren = !printing() && (!m_frameView || width() != viewWidth() || height() != viewHeight());
     if (relayoutChildren) {
         setChildNeedsLayout(true, false);
         for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
@@ -117,10 +121,10 @@ void RenderView::layout()
     if (needsLayout())
         RenderBlock::layout();
 
-    // Ensure that docWidth() >= width() and docHeight() >= height().
-    setOverflowWidth(m_width);
-    setOverflowHeight(m_height);
-
+    // Reset overflowWidth and overflowHeight, since they act as a lower bound for docWidth() and docHeight().
+    setOverflowWidth(width());
+    setOverflowHeight(height());
+    
     setOverflowWidth(docWidth());
     setOverflowHeight(docHeight());
 
@@ -131,29 +135,20 @@ void RenderView::layout()
     setNeedsLayout(false);
 }
 
-FloatPoint RenderView::localToAbsolute(FloatPoint localPoint, bool fixed, bool) const
+void RenderView::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool /*useTransforms*/, TransformState& transformState) const
 {
-    if (fixed && m_frameView)
-        localPoint += m_frameView->scrollOffset();
+    // If a container was specified, and was not 0 or the RenderView,
+    // then we should have found it by now.
+    ASSERT_UNUSED(repaintContainer, !repaintContainer || repaintContainer == this);
 
-    return localPoint;
-}
-
-FloatPoint RenderView::absoluteToLocal(FloatPoint containerPoint, bool fixed, bool) const
-{
     if (fixed && m_frameView)
-        containerPoint -= m_frameView->scrollOffset();
-
-    return containerPoint;
+        transformState.move(m_frameView->scrollOffset());
 }
 
-FloatQuad RenderView::localToAbsoluteQuad(const FloatQuad& localQuad, bool fixed) const
+void RenderView::mapAbsoluteToLocalPoint(bool fixed, bool /*useTransforms*/, TransformState& transformState) const
 {
-    FloatQuad quad = localQuad;
     if (fixed && m_frameView)
-        quad += m_frameView->scrollOffset();
-
-    return quad;
+        transformState.move(-m_frameView->scrollOffset());
 }
 
 void RenderView::paint(PaintInfo& paintInfo, int tx, int ty)
@@ -212,12 +207,20 @@ void RenderView::paintBoxDecorations(PaintInfo& paintInfo, int, int)
     }
 }
 
-void RenderView::repaintViewRectangle(const IntRect& ur, bool immediate)
+bool RenderView::shouldRepaint(const IntRect& r) const
 {
-    if (printing() || ur.width() == 0 || ur.height() == 0)
-        return;
+    if (printing() || r.width() == 0 || r.height() == 0)
+        return false;
 
     if (!m_frameView)
+        return false;
+    
+    return true;
+}
+
+void RenderView::repaintViewRectangle(const IntRect& ur, bool immediate)
+{
+    if (!shouldRepaint(ur))
         return;
 
     // We always just invalidate the root view, since we could be an iframe that is clipped out
@@ -225,7 +228,7 @@ void RenderView::repaintViewRectangle(const IntRect& ur, bool immediate)
     Element* elt = document()->ownerElement();
     if (!elt)
         m_frameView->repaintContentRectangle(ur, immediate);
-    else if (RenderObject* obj = elt->renderer()) {
+    else if (RenderBox* obj = elt->renderBox()) {
         IntRect vr = viewRect();
         IntRect r = intersection(ur, vr);
         
@@ -240,8 +243,30 @@ void RenderView::repaintViewRectangle(const IntRect& ur, bool immediate)
     }
 }
 
-void RenderView::computeAbsoluteRepaintRect(IntRect& rect, bool fixed)
+void RenderView::repaintRectangleInViewAndCompositedLayers(const IntRect& ur, bool immediate)
 {
+    if (!shouldRepaint(ur))
+        return;
+
+    repaintViewRectangle(ur, immediate);
+    
+#if USE(ACCELERATED_COMPOSITING)
+    // If we're a frame, repaintViewRectangle will have repainted via a RenderObject in the
+    // parent document.
+    if (document()->ownerElement())
+        return;
+
+    if (compositor()->inCompositingMode())
+        compositor()->repaintCompositedLayersAbsoluteRect(ur);
+#endif
+}
+
+void RenderView::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed)
+{
+    // If a container was specified, and was not 0 or the RenderView,
+    // then we should have found it by now.
+    ASSERT_UNUSED(repaintContainer, !repaintContainer || repaintContainer == this);
+
     if (printing())
         return;
 
@@ -253,17 +278,17 @@ void RenderView::computeAbsoluteRepaintRect(IntRect& rect, bool fixed)
         rect = m_layer->transform()->mapRect(rect);
 }
 
-void RenderView::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool)
+void RenderView::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     rects.append(IntRect(tx, ty, m_layer->width(), m_layer->height()));
 }
 
-void RenderView::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderView::absoluteQuads(Vector<FloatQuad>& quads)
 {
     quads.append(FloatRect(0, 0, m_layer->width(), m_layer->height()));
 }
 
-RenderObject* rendererAfterPosition(RenderObject* object, unsigned offset)
+static RenderObject* rendererAfterPosition(RenderObject* object, unsigned offset)
 {
     if (!object)
         return 0;
@@ -272,21 +297,11 @@ RenderObject* rendererAfterPosition(RenderObject* object, unsigned offset)
     return child ? child : object->nextInPreOrderAfterChildren();
 }
 
-IntRect RenderView::selectionRect(bool clipToVisibleContent)
-{
-    // The virtual selectionRect() should never be called on the RenderView.
-    // We assert because there used to be ambiguity between
-    // RenderView::selectionRect(bool) and
-    // virtual RenderObject::selectionRect(bool) const
-    ASSERT_NOT_REACHED();
-    return RenderBlock::selectionRect(clipToVisibleContent);
-}
-
 IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
-    typedef HashMap<RenderObject*, SelectionInfo*> SelectionMap;
+    typedef HashMap<RenderObject*, RenderSelectionInfo*> SelectionMap;
     SelectionMap selectedObjects;
 
     RenderObject* os = m_selectionStart;
@@ -294,13 +309,13 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
     while (os && os != stop) {
         if ((os->canBeSelectionLeaf() || os == m_selectionStart || os == m_selectionEnd) && os->selectionState() != SelectionNone) {
             // Blocks are responsible for painting line gaps and margin gaps. They must be examined as well.
-            selectedObjects.set(os, new SelectionInfo(os, clipToVisibleContent));
+            selectedObjects.set(os, new RenderSelectionInfo(os, clipToVisibleContent));
             RenderBlock* cb = os->containingBlock();
             while (cb && !cb->isRenderView()) {
-                SelectionInfo* blockInfo = selectedObjects.get(cb);
+                RenderSelectionInfo* blockInfo = selectedObjects.get(cb);
                 if (blockInfo)
                     break;
-                selectedObjects.set(cb, new SelectionInfo(cb, clipToVisibleContent));
+                selectedObjects.set(cb, new RenderSelectionInfo(cb, clipToVisibleContent));
                 cb = cb->containingBlock();
             }
         }
@@ -312,14 +327,29 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
     IntRect selRect;
     SelectionMap::iterator end = selectedObjects.end();
     for (SelectionMap::iterator i = selectedObjects.begin(); i != end; ++i) {
-        SelectionInfo* info = i->second;
+        RenderSelectionInfo* info = i->second;
         selRect.unite(info->rect());
         delete info;
     }
     return selRect;
 }
 
-void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos)
+#if USE(ACCELERATED_COMPOSITING)
+// Compositing layer dimensions take outline size into account, so we have to recompute layer
+// bounds when it changes.
+// FIXME: This is ugly; it would be nice to have a better way to do this.
+void RenderView::setMaximalOutlineSize(int o)
+{
+    if (o != m_maximalOutlineSize) {
+        m_maximalOutlineSize = o;
+
+        if (m_frameView)
+            m_frameView->updateCompositingLayers(FrameView::ForcedCompositingUpdate);
+    }
+}
+#endif
+
+void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos, SelectionRepaintMode blockRepaintMode)
 {
     // Make sure both our start and end objects are defined.
     // Check www.msnbc.com and try clicking around to find the case where this happened.
@@ -337,14 +367,14 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     int oldEndPos = m_selectionEndPos;
 
     // Objects each have a single selection rect to examine.
-    typedef HashMap<RenderObject*, SelectionInfo*> SelectedObjectMap;
+    typedef HashMap<RenderObject*, RenderSelectionInfo*> SelectedObjectMap;
     SelectedObjectMap oldSelectedObjects;
     SelectedObjectMap newSelectedObjects;
 
     // Blocks contain selected objects and fill gaps between them, either on the left, right, or in between lines and blocks.
     // In order to get the repaint rect right, we have to examine left, middle, and right rects individually, since otherwise
     // the union of those rects might remain the same even when changes have occurred.
-    typedef HashMap<RenderBlock*, BlockSelectionInfo*> SelectedBlockMap;
+    typedef HashMap<RenderBlock*, RenderBlockSelectionInfo*> SelectedBlockMap;
     SelectedBlockMap oldSelectedBlocks;
     SelectedBlockMap newSelectedBlocks;
 
@@ -353,13 +383,13 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     while (os && os != stop) {
         if ((os->canBeSelectionLeaf() || os == m_selectionStart || os == m_selectionEnd) && os->selectionState() != SelectionNone) {
             // Blocks are responsible for painting line gaps and margin gaps.  They must be examined as well.
-            oldSelectedObjects.set(os, new SelectionInfo(os, true));
+            oldSelectedObjects.set(os, new RenderSelectionInfo(os, true));
             RenderBlock* cb = os->containingBlock();
             while (cb && !cb->isRenderView()) {
-                BlockSelectionInfo* blockInfo = oldSelectedBlocks.get(cb);
+                RenderBlockSelectionInfo* blockInfo = oldSelectedBlocks.get(cb);
                 if (blockInfo)
                     break;
-                oldSelectedBlocks.set(cb, new BlockSelectionInfo(cb));
+                oldSelectedBlocks.set(cb, new RenderBlockSelectionInfo(cb));
                 cb = cb->containingBlock();
             }
         }
@@ -397,18 +427,22 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         o = o->nextInPreOrder();
     }
 
+    m_cachedSelectionBounds = IntRect();
+
     // Now that the selection state has been updated for the new objects, walk them again and
     // put them in the new objects list.
     o = start;
     while (o && o != stop) {
         if ((o->canBeSelectionLeaf() || o == start || o == end) && o->selectionState() != SelectionNone) {
-            newSelectedObjects.set(o, new SelectionInfo(o, true));
+            newSelectedObjects.set(o, new RenderSelectionInfo(o, true));
             RenderBlock* cb = o->containingBlock();
             while (cb && !cb->isRenderView()) {
-                BlockSelectionInfo* blockInfo = newSelectedBlocks.get(cb);
+                RenderBlockSelectionInfo* blockInfo = newSelectedBlocks.get(cb);
                 if (blockInfo)
                     break;
-                newSelectedBlocks.set(cb, new BlockSelectionInfo(cb));
+                blockInfo = new RenderBlockSelectionInfo(cb);
+                newSelectedBlocks.set(cb, blockInfo);
+                m_cachedSelectionBounds.unite(blockInfo->rects());
                 cb = cb->containingBlock();
             }
         }
@@ -429,14 +463,14 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     // Have any of the old selected objects changed compared to the new selection?
     for (SelectedObjectMap::iterator i = oldSelectedObjects.begin(); i != oldObjectsEnd; ++i) {
         RenderObject* obj = i->first;
-        SelectionInfo* newInfo = newSelectedObjects.get(obj);
-        SelectionInfo* oldInfo = i->second;
+        RenderSelectionInfo* newInfo = newSelectedObjects.get(obj);
+        RenderSelectionInfo* oldInfo = i->second;
         if (!newInfo || oldInfo->rect() != newInfo->rect() || oldInfo->state() != newInfo->state() ||
             (m_selectionStart == obj && oldStartPos != m_selectionStartPos) ||
             (m_selectionEnd == obj && oldEndPos != m_selectionEndPos)) {
-            repaintViewRectangle(oldInfo->rect());
+            oldInfo->repaint();
             if (newInfo) {
-                repaintViewRectangle(newInfo->rect());
+                newInfo->repaint();
                 newSelectedObjects.remove(obj);
                 delete newInfo;
             }
@@ -447,8 +481,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     // Any new objects that remain were not found in the old objects dict, and so they need to be updated.
     SelectedObjectMap::iterator newObjectsEnd = newSelectedObjects.end();
     for (SelectedObjectMap::iterator i = newSelectedObjects.begin(); i != newObjectsEnd; ++i) {
-        SelectionInfo* newInfo = i->second;
-        repaintViewRectangle(newInfo->rect());
+        RenderSelectionInfo* newInfo = i->second;
+        newInfo->repaint();
         delete newInfo;
     }
 
@@ -456,12 +490,13 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     SelectedBlockMap::iterator oldBlocksEnd = oldSelectedBlocks.end();
     for (SelectedBlockMap::iterator i = oldSelectedBlocks.begin(); i != oldBlocksEnd; ++i) {
         RenderBlock* block = i->first;
-        BlockSelectionInfo* newInfo = newSelectedBlocks.get(block);
-        BlockSelectionInfo* oldInfo = i->second;
+        RenderBlockSelectionInfo* newInfo = newSelectedBlocks.get(block);
+        RenderBlockSelectionInfo* oldInfo = i->second;
         if (!newInfo || oldInfo->rects() != newInfo->rects() || oldInfo->state() != newInfo->state()) {
-            repaintViewRectangle(oldInfo->rects());
+            if (blockRepaintMode == RepaintNewXOROld)
+                oldInfo->repaint();
             if (newInfo) {
-                repaintViewRectangle(newInfo->rects());
+                newInfo->repaint();
                 newSelectedBlocks.remove(block);
                 delete newInfo;
             }
@@ -472,15 +507,16 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     // Any new blocks that remain were not found in the old blocks dict, and so they need to be updated.
     SelectedBlockMap::iterator newBlocksEnd = newSelectedBlocks.end();
     for (SelectedBlockMap::iterator i = newSelectedBlocks.begin(); i != newBlocksEnd; ++i) {
-        BlockSelectionInfo* newInfo = i->second;
-        repaintViewRectangle(newInfo->rects());
+        RenderBlockSelectionInfo* newInfo = i->second;
+        newInfo->repaint();
         delete newInfo;
     }
 }
 
 void RenderView::clearSelection()
 {
-    setSelection(0, -1, 0, -1);
+    repaintViewRectangle(m_cachedSelectionBounds);
+    setSelection(0, -1, 0, -1, RepaintNewMinusOld);
 }
 
 void RenderView::selectionStartEnd(int& startPos, int& endPos) const
@@ -496,17 +532,17 @@ bool RenderView::printing() const
 
 void RenderView::updateWidgetPositions()
 {
-    RenderObjectSet::iterator end = m_widgets.end();
-    for (RenderObjectSet::iterator it = m_widgets.begin(); it != end; ++it)
+    RenderWidgetSet::iterator end = m_widgets.end();
+    for (RenderWidgetSet::iterator it = m_widgets.begin(); it != end; ++it)
         (*it)->updateWidgetPosition();
 }
 
-void RenderView::addWidget(RenderObject* o)
+void RenderView::addWidget(RenderWidget* o)
 {
     m_widgets.add(o);
 }
 
-void RenderView::removeWidget(RenderObject* o)
+void RenderView::removeWidget(RenderWidget* o)
 {
     m_widgets.remove(o);
 }
@@ -514,7 +550,7 @@ void RenderView::removeWidget(RenderObject* o)
 IntRect RenderView::viewRect() const
 {
     if (printing())
-        return IntRect(0, 0, m_width, m_height);
+        return IntRect(0, 0, width(), height());
     if (m_frameView)
         return m_frameView->visibleContentRect();
     return IntRect();
@@ -522,16 +558,13 @@ IntRect RenderView::viewRect() const
 
 int RenderView::docHeight() const
 {
-    int h = m_height;
-    int lowestPos = lowestPosition();
-    if (lowestPos > h)
-        h = lowestPos;
+    int h = lowestPosition();
 
     // FIXME: This doesn't do any margin collapsing.
     // Instead of this dh computation we should keep the result
     // when we call RenderBlock::layout.
     int dh = 0;
-    for (RenderObject* c = firstChild(); c; c = c->nextSibling())
+    for (RenderBox* c = firstChildBox(); c; c = c->nextSiblingBox())
         dh += c->height() + c->marginTop() + c->marginBottom();
 
     if (dh > h)
@@ -542,12 +575,9 @@ int RenderView::docHeight() const
 
 int RenderView::docWidth() const
 {
-    int w = m_width;
-    int rightmostPos = rightmostPosition();
-    if (rightmostPos > w)
-        w = rightmostPos;
+    int w = rightmostPosition();
 
-    for (RenderObject *c = firstChild(); c; c = c->nextSibling()) {
+    for (RenderBox* c = firstChildBox(); c; c = c->nextSiblingBox()) {
         int dw = c->width() + c->marginLeft() + c->marginRight();
         if (dw > w)
             w = dw;
@@ -576,9 +606,17 @@ int RenderView::viewWidth() const
     return width;
 }
 
+float RenderView::zoomFactor() const
+{
+    if (m_frameView->frame() && m_frameView->frame()->shouldApplyPageZoom())
+        return m_frameView->frame()->zoomFactor();
+
+    return 1.0f;
+}
+
 // The idea here is to take into account what object is moving the pagination point, and
 // thus choose the best place to chop it.
-void RenderView::setBestTruncatedAt(int y, RenderObject* forRenderer, bool forcedBreak)
+void RenderView::setBestTruncatedAt(int y, RenderBoxModelObject* forRenderer, bool forcedBreak)
 {
     // Nobody else can set a page break once we have a forced break.
     if (m_forcedPageBreak)
@@ -591,21 +629,66 @@ void RenderView::setBestTruncatedAt(int y, RenderObject* forRenderer, bool force
         return;
     }
 
-    // prefer the widest object who tries to move the pagination point
-    int width = forRenderer->width();
-    if (width > m_truncatorWidth) {
-        m_truncatorWidth = width;
+    // Prefer the widest object that tries to move the pagination point
+    IntRect boundingBox = forRenderer->borderBoundingBox();
+    if (boundingBox.width() > m_truncatorWidth) {
+        m_truncatorWidth = boundingBox.width();
         m_bestTruncatedAt = y;
     }
 }
 
 void RenderView::pushLayoutState(RenderObject* root)
 {
-    ASSERT(!m_frameView->needsFullRepaint());
+    ASSERT(!doingFullRepaint());
     ASSERT(m_layoutStateDisableCount == 0);
     ASSERT(m_layoutState == 0);
 
     m_layoutState = new (renderArena()) LayoutState(root);
 }
 
+void RenderView::updateHitTestResult(HitTestResult& result, const IntPoint& point)
+{
+    if (result.innerNode())
+        return;
+
+    Node* node = document()->documentElement();
+    if (node) {
+        result.setInnerNode(node);
+        if (!result.innerNonSharedNode())
+            result.setInnerNonSharedNode(node);
+        result.setLocalPoint(point);
+    }
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+bool RenderView::usesCompositing() const
+{
+    return m_compositor && m_compositor->inCompositingMode();
+}
+
+RenderLayerCompositor* RenderView::compositor()
+{
+    if (!m_compositor)
+        m_compositor.set(new RenderLayerCompositor(this));
+
+    return m_compositor.get();
+}
+#endif
+
+void RenderView::didMoveOnscreen()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_compositor)
+        m_compositor->didMoveOnscreen();
+#endif
+}
+
+void RenderView::willMoveOffscreen()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_compositor)
+        m_compositor->willMoveOffscreen();
+#endif
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderView.h b/src/3rdparty/webkit/WebCore/rendering/RenderView.h
index 96597de1b5..b0de7dd8f0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderView.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderView.h
@@ -25,12 +25,18 @@
 #define RenderView_h
 
 #include "FrameView.h"
-#include "Frame.h"
 #include "LayoutState.h"
 #include "RenderBlock.h"
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
+class RenderWidget;
+
+#if USE(ACCELERATED_COMPOSITING)
+class RenderLayerCompositor;
+#endif
+
 class RenderView : public RenderBlock {
 public:
     RenderView(Node*, FrameView*);
@@ -44,30 +50,26 @@ public:
     virtual void calcWidth();
     virtual void calcHeight();
     virtual void calcPrefWidths();
-    virtual FloatPoint localToAbsolute(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
-    virtual FloatPoint absoluteToLocal(FloatPoint containerPoint, bool fixed = false, bool useTransforms = false) const;
-    virtual FloatQuad localToAbsoluteQuad(const FloatQuad&, bool fixed = false) const;
-    
-    int docHeight() const;
-    int docWidth() const;
 
     // The same as the FrameView's layoutHeight/layoutWidth but with null check guards.
     int viewHeight() const;
     int viewWidth() const;
-    
-    float zoomFactor() const { return m_frameView->frame() && m_frameView->frame()->shouldApplyPageZoom() ? m_frameView->frame()->zoomFactor() : 1.0f; }
 
-    FrameView* frameView() const { return m_frameView; }
+    float zoomFactor() const;
 
-    virtual bool hasOverhangingFloats() { return false; }
+    FrameView* frameView() const { return m_frameView; }
 
-    virtual void computeAbsoluteRepaintRect(IntRect&, bool fixed = false);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
     virtual void repaintViewRectangle(const IntRect&, bool immediate = false);
+    // Repaint the view, and all composited layers that intersect the given absolute rectangle.
+    // FIXME: ideally we'd never have to do this, if all repaints are container-relative.
+    virtual void repaintRectangleInViewAndCompositedLayers(const IntRect&, bool immediate = false);
 
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
 
-    void setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos);
+    enum SelectionRepaintMode { RepaintNewXOROld, RepaintNewMinusOld };
+    void setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos, SelectionRepaintMode = RepaintNewXOROld);
     void clearSelection();
     virtual RenderObject* selectionStart() const { return m_selectionStart; }
     virtual RenderObject* selectionEnd() const { return m_selectionEnd; }
@@ -76,39 +78,54 @@ public:
     void setPrintImages(bool enable) { m_printImages = enable; }
     bool printImages() const { return m_printImages; }
     void setTruncatedAt(int y) { m_truncatedAt = y; m_bestTruncatedAt = m_truncatorWidth = 0; m_forcedPageBreak = false; }
-    void setBestTruncatedAt(int y, RenderObject *forRenderer, bool forcedBreak = false);
+    void setBestTruncatedAt(int y, RenderBoxModelObject* forRenderer, bool forcedBreak = false);
     int bestTruncatedAt() const { return m_bestTruncatedAt; }
 
     int truncatedAt() const { return m_truncatedAt; }
 
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
 
     IntRect selectionBounds(bool clipToVisibleContent = true) const;
 
+#if USE(ACCELERATED_COMPOSITING)
+    void setMaximalOutlineSize(int o);
+#else
     void setMaximalOutlineSize(int o) { m_maximalOutlineSize = o; }
+#endif
     int maximalOutlineSize() const { return m_maximalOutlineSize; }
 
     virtual IntRect viewRect() const;
 
-    virtual void selectionStartEnd(int& startPos, int& endPos) const;
+    void selectionStartEnd(int& startPos, int& endPos) const;
 
     IntRect printRect() const { return m_printRect; }
     void setPrintRect(const IntRect& r) { m_printRect = r; }
 
     void updateWidgetPositions();
-    void addWidget(RenderObject*);
-    void removeWidget(RenderObject*);
+    void addWidget(RenderWidget*);
+    void removeWidget(RenderWidget*);
 
     // layoutDelta is used transiently during layout to store how far an object has moved from its
-    // last layout location, in order to repaint correctly
-    const IntSize& layoutDelta() const { return m_layoutDelta; }
-    void addLayoutDelta(const IntSize& delta) { m_layoutDelta += delta; }
+    // last layout location, in order to repaint correctly.
+    // If we're doing a full repaint m_layoutState will be 0, but in that case layoutDelta doesn't matter.
+    IntSize layoutDelta() const
+    {
+        return m_layoutState ? m_layoutState->m_layoutDelta : IntSize();
+    }
+    void addLayoutDelta(const IntSize& delta) 
+    {
+        if (m_layoutState)
+            m_layoutState->m_layoutDelta += delta;
+    }
+
+    bool doingFullRepaint() const { return m_frameView->needsFullRepaint(); }
 
     void pushLayoutState(RenderBox* renderer, const IntSize& offset)
     {
-        if (m_layoutStateDisableCount || m_frameView->needsFullRepaint())
+        if (doingFullRepaint())
             return;
+        // We push LayoutState even if layoutState is disabled because it stores layoutDelta too.
         m_layoutState = new (renderArena()) LayoutState(m_layoutState, renderer, offset);
     }
 
@@ -116,24 +133,45 @@ public:
 
     void popLayoutState()
     {
-        if (m_layoutStateDisableCount || m_frameView->needsFullRepaint())
+        if (doingFullRepaint())
             return;
         LayoutState* state = m_layoutState;
         m_layoutState = state->m_next;
         state->destroy(renderArena());
     }
 
-    LayoutState* layoutState() const { return m_layoutStateDisableCount ? 0 : m_layoutState; }
+    // Returns true if layoutState should be used for its cached offset and clip.
+    bool layoutStateEnabled() const { return m_layoutStateDisableCount == 0 && m_layoutState; }
+    LayoutState* layoutState() const { return m_layoutState; }
 
     // Suspends the LayoutState optimization. Used under transforms that cannot be represented by
     // LayoutState (common in SVG) and when manipulating the render tree during layout in ways
     // that can trigger repaint of a non-child (e.g. when a list item moves its list marker around).
+    // Note that even when disabled, LayoutState is still used to store layoutDelta.
     void disableLayoutState() { m_layoutStateDisableCount++; }
     void enableLayoutState() { ASSERT(m_layoutStateDisableCount > 0); m_layoutStateDisableCount--; }
 
+    virtual void updateHitTestResult(HitTestResult&, const IntPoint&);
+
+    // Notifications that this view became visible in a window, or will be
+    // removed from the window.
+    void didMoveOnscreen();
+    void willMoveOffscreen();
+
+#if USE(ACCELERATED_COMPOSITING)
+    RenderLayerCompositor* compositor();
+    bool usesCompositing() const;
+#endif
+
+protected:
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
+
 private:
-    // selectionRect should never be called on a RenderView
-    virtual IntRect selectionRect(bool);
+    bool shouldRepaint(const IntRect& r) const;
+        
+    int docHeight() const;
+    int docWidth() const;
 
 protected:
     FrameView* m_frameView;
@@ -150,26 +188,46 @@ protected:
     int m_maximalOutlineSize; // Used to apply a fudge factor to dirty-rect checks on blocks/tables.
     IntRect m_printRect; // Used when printing.
 
-    typedef HashSet<RenderObject*> RenderObjectSet;
+    typedef HashSet<RenderWidget*> RenderWidgetSet;
 
-    RenderObjectSet m_widgets;
+    RenderWidgetSet m_widgets;
 
 private:
+    IntRect m_cachedSelectionBounds;
+
     int m_bestTruncatedAt;
     int m_truncatorWidth;
     bool m_forcedPageBreak;
-    IntSize m_layoutDelta;
     LayoutState* m_layoutState;
     unsigned m_layoutStateDisableCount;
+#if USE(ACCELERATED_COMPOSITING)
+    OwnPtr<RenderLayerCompositor> m_compositor;
+#endif
 };
 
+inline RenderView* toRenderView(RenderObject* o)
+{
+    ASSERT(!o || o->isRenderView());
+    return static_cast<RenderView*>(o);
+}
+
+inline const RenderView* toRenderView(const RenderObject* o)
+{
+    ASSERT(!o || o->isRenderView());
+    return static_cast<const RenderView*>(o);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderView(const RenderView*);
+
+
 // Stack-based class to assist with LayoutState push/pop
 class LayoutStateMaintainer : Noncopyable {
 public:
     // ctor to push now
-    LayoutStateMaintainer(RenderView* view, RenderBox* root, IntSize offset, bool shouldPush = true)
+    LayoutStateMaintainer(RenderView* view, RenderBox* root, IntSize offset, bool disableState = false)
         : m_view(view)
-        , m_shouldPushPop(shouldPush)
+        , m_disabled(disableState)
         , m_didStart(false)
         , m_didEnd(false)
     {
@@ -179,7 +237,7 @@ public:
     // ctor to maybe push later
     LayoutStateMaintainer(RenderView* view)
         : m_view(view)
-        , m_shouldPushPop(true)
+        , m_disabled(false)
         , m_didStart(false)
         , m_didEnd(false)
     {
@@ -190,33 +248,32 @@ public:
         ASSERT(m_didStart == m_didEnd);   // if this fires, it means that someone did a push(), but forgot to pop().
     }
 
+    void push(RenderBox* root, IntSize offset)
+    {
+        ASSERT(!m_didStart);
+        // We push state even if disabled, because we still need to store layoutDelta
+        m_view->pushLayoutState(root, offset);
+        if (m_disabled)
+            m_view->disableLayoutState();
+        m_didStart = true;
+    }
+
     void pop()
     {
         if (m_didStart) {
             ASSERT(!m_didEnd);
-            if (m_shouldPushPop)
-                m_view->popLayoutState();
-            else
+            m_view->popLayoutState();
+            if (m_disabled)
                 m_view->enableLayoutState();
             m_didEnd = true;
         }
     }
 
-    void push(RenderBox* root, IntSize offset)
-    {
-        ASSERT(!m_didStart);
-        if (m_shouldPushPop)
-            m_view->pushLayoutState(root, offset);
-        else
-            m_view->disableLayoutState();
-        m_didStart = true;
-    }
-    
     bool didPush() const { return m_didStart; }
 
 private:
     RenderView* m_view;
-    bool m_shouldPushPop : 1;   // true if we should push/pop, rather than disable/enable
+    bool m_disabled : 1;        // true if the offset and clip part of layoutState is disabled
     bool m_didStart : 1;        // true if we did a push or disable
     bool m_didEnd : 1;          // true if we popped or re-enabled
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
index 1a9744a147..ec2ee6a174 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
@@ -1,9 +1,7 @@
-/**
- * This file is part of the HTML widget for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,13 +25,8 @@
 
 #include "AnimationController.h"
 #include "AXObjectCache.h"
-#include "Document.h"
-#include "Element.h"
-#include "Event.h"
-#include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
-#include "RenderLayer.h"
 #include "RenderView.h"
 
 using namespace std;
@@ -47,14 +40,11 @@ static HashMap<const Widget*, RenderWidget*>& widgetRendererMap()
 }
 
 RenderWidget::RenderWidget(Node* node)
-      : RenderReplaced(node)
-      , m_widget(0)
-      , m_refCount(0)
+    : RenderReplaced(node)
+    , m_widget(0)
+    , m_frameView(node->document()->view())
+    , m_refCount(0)
 {
-    // a replaced element doesn't support being anonymous
-    ASSERT(node);
-    m_view = node->document()->view();
-
     view()->addWidget(this);
 
     // Reference counting is used to prevent the widget from being
@@ -75,14 +65,15 @@ void RenderWidget::destroy()
     if (RenderView* v = view())
         v->removeWidget(this);
 
-    if (AXObjectCache::accessibilityEnabled())
+    if (AXObjectCache::accessibilityEnabled()) {
+        document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
-
+    }
     remove();
 
     if (m_widget) {
-        if (m_view)
-            m_view->removeChild(m_widget);
+        if (m_frameView)
+            m_frameView->removeChild(m_widget);
         widgetRendererMap().remove(m_widget);
     }
     
@@ -90,33 +81,33 @@ void RenderWidget::destroy()
     if (hasOverrideSize())
         setOverrideSize(-1);
 
-    RenderLayer* layer = m_layer;
-    RenderArena* arena = renderArena();
-
-    if (layer)
-        layer->clearClipRects();
-
     if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
+    if (hasLayer()) {
+        layer()->clearClipRects();
+        setHasLayer(false);
+        destroyLayer();
+    }
+
+    // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
+    // Clear the node before deref-ing, as this may be deleted when deref is called.
+    RenderArena* arena = renderArena();
     setNode(0);
     deref(arena);
-
-    if (layer)
-        layer->destroy(arena);
 }
 
 RenderWidget::~RenderWidget()
 {
     ASSERT(m_refCount <= 0);
-    deleteWidget();
+    clearWidget();
 }
 
 void RenderWidget::setWidgetGeometry(const IntRect& frame)
 {
-    if (element() && m_widget->frameRect() != frame) {
+    if (node() && m_widget->frameRect() != frame) {
         RenderArena* arena = ref();
-        RefPtr<Node> protectedElement(element());
+        RefPtr<Node> protectedElement(node());
         m_widget->setFrameRect(frame);
         deref(arena);
     }
@@ -128,7 +119,7 @@ void RenderWidget::setWidget(Widget* widget)
         if (m_widget) {
             m_widget->removeFromParent();
             widgetRendererMap().remove(m_widget);
-            deleteWidget();
+            clearWidget();
         }
         m_widget = widget;
         if (m_widget) {
@@ -144,7 +135,7 @@ void RenderWidget::setWidget(Widget* widget)
                 else
                     m_widget->show();
             }
-            m_view->addChild(m_widget);
+            m_frameView->addChild(m_widget);
         }
     }
 }
@@ -156,7 +147,7 @@ void RenderWidget::layout()
     setNeedsLayout(false);
 }
 
-void RenderWidget::styleDidChange(RenderStyle::Diff diff, const RenderStyle* oldStyle)
+void RenderWidget::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderReplaced::styleDidChange(diff, oldStyle);
     if (m_widget) {
@@ -172,8 +163,8 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
     if (!shouldPaint(paintInfo, tx, ty))
         return;
 
-    tx += m_x;
-    ty += m_y;
+    tx += x();
+    ty += y();
 
     if (hasBoxDecorations() && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection))
         paintBoxDecorations(paintInfo, tx, ty);
@@ -183,14 +174,26 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
         return;
     }
 
-    if (!m_view || paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE)
+    if (!m_frameView || paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE)
         return;
 
 #if PLATFORM(MAC)
     if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
-        paintCustomHighlight(tx - m_x, ty - m_y, style()->highlight(), true);
+        paintCustomHighlight(tx - x(), ty - y(), style()->highlight(), true);
 #endif
 
+    bool clipToBorderRadius = style()->overflowX() != OVISIBLE && style()->hasBorderRadius(); 
+    if (clipToBorderRadius) {
+        // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
+        paintInfo.context->save();
+        
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+    }
+
     if (m_widget) {
         // Move the widget if necessary.  We normally move and resize widgets during layout, but sometimes
         // widgets can move without layout occurring (most notably when you scroll a document that
@@ -200,11 +203,28 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
         m_widget->paint(paintInfo.context, paintInfo.rect);
+
+        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget)->useSlowRepaints()) {
+            ASSERT(!paintInfo.overlapTestRequests->contains(this));
+            paintInfo.overlapTestRequests->set(this, m_widget->frameRect());
+        }
     }
 
+    if (clipToBorderRadius)
+        paintInfo.context->restore();
+
     // Paint a partially transparent wash over selected widgets.
-    if (isSelected() && !document()->printing())
+    if (isSelected() && !document()->printing()) {
+        // FIXME: selectionRect() is in absolute, not painting coordinates.
         paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor());
+    }
+}
+
+void RenderWidget::setOverlapTestResult(bool isOverlapped)
+{
+    ASSERT(m_widget);
+    ASSERT(m_widget->isFrameView());
+    static_cast<FrameView*>(m_widget)->setIsOverlapped(isOverlapped);
 }
 
 void RenderWidget::deref(RenderArena *arena)
@@ -222,27 +242,27 @@ void RenderWidget::updateWidgetPosition()
     FloatPoint absPos = localToAbsolute();
     absPos.move(borderLeft() + paddingLeft(), borderTop() + paddingTop());
 
-    int width = m_width - borderLeft() - borderRight() - paddingLeft() - paddingRight();
-    int height = m_height - borderTop() - borderBottom() - paddingTop() - paddingBottom();
+    int w = width() - borderLeft() - borderRight() - paddingLeft() - paddingRight();
+    int h = height() - borderTop() - borderBottom() - paddingTop() - paddingBottom();
 
-    IntRect newBounds(absPos.x(), absPos.y(), width, height);
+    IntRect newBounds(absPos.x(), absPos.y(), w, h);
     IntRect oldBounds(m_widget->frameRect());
-    if (newBounds != oldBounds) {
-        // The widget changed positions.  Update the frame geometry.
-        if (checkForRepaintDuringLayout()) {
-            RenderView* v = view();
-            if (!v->printing()) {
-                v->repaintViewRectangle(oldBounds);
-                v->repaintViewRectangle(newBounds);
-            }
-        }
-
+    bool boundsChanged = newBounds != oldBounds;
+    if (boundsChanged) {
         RenderArena* arena = ref();
-        element()->ref();
+        node()->ref();
         m_widget->setFrameRect(newBounds);
-        element()->deref();
+        node()->deref();
         deref(arena);
     }
+    
+    // if the frame bounds got changed, or if view needs layout (possibly indicating
+    // content size is wrong) we have to do a layout to set the right widget size
+    if (m_widget->isFrameView()) {
+        FrameView* frameView = static_cast<FrameView*>(m_widget);
+        if (boundsChanged || frameView->needsLayout())
+            frameView->layout();
+    }
 }
 
 void RenderWidget::setSelectionState(SelectionState state)
@@ -254,9 +274,17 @@ void RenderWidget::setSelectionState(SelectionState state)
     }
 }
 
-void RenderWidget::deleteWidget()
+void RenderWidget::clearWidget()
+{
+    Widget* widget = m_widget;
+    m_widget = 0;
+    if (widget)
+        deleteWidget(widget);
+}
+
+void RenderWidget::deleteWidget(Widget* widget)
 {
-    delete m_widget;
+    delete widget;
 }
 
 RenderWidget* RenderWidget::find(const Widget* widget)
@@ -270,8 +298,8 @@ bool RenderWidget::nodeAtPoint(const HitTestRequest& request, HitTestResult& res
     bool inside = RenderReplaced::nodeAtPoint(request, result, x, y, tx, ty, action);
     
     // Check to see if we are really over the widget itself (and not just in the border/padding area).
-    if (inside && !hadResult && result.innerNode() == element())
-        result.setIsOverWidget(contentBox().contains(result.localPoint()));
+    if (inside && !hadResult && result.innerNode() == node())
+        result.setIsOverWidget(contentBoxRect().contains(result.localPoint()));
     return inside;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
index a64bb54738..d23dbb35e9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the HTML widget for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,51 +22,51 @@
 #ifndef RenderWidget_h
 #define RenderWidget_h
 
+#include "OverlapTestRequestClient.h"
 #include "RenderReplaced.h"
 
 namespace WebCore {
 
 class Widget;
 
-class RenderWidget : public RenderReplaced {
+class RenderWidget : public RenderReplaced, private OverlapTestRequestClient {
 public:
-    RenderWidget(Node*);
     virtual ~RenderWidget();
 
-    virtual bool isWidget() const { return true; }
+    Widget* widget() const { return m_widget; }
+    virtual void setWidget(Widget*);
 
-    virtual void paint(PaintInfo&, int tx, int ty);
+    static RenderWidget* find(const Widget*);
 
-    virtual void destroy();
-    virtual void layout();
+    void updateWidgetPosition();
 
-    Widget* widget() const { return m_widget; }
-    static RenderWidget* find(const Widget*);
+protected:
+    RenderWidget(Node*);
 
-    RenderArena* ref() { ++m_refCount; return renderArena(); }
-    void deref(RenderArena*);
+    FrameView* frameView() const { return m_frameView; }
 
-    virtual void setSelectionState(SelectionState);
+    void clearWidget();
 
-    virtual void updateWidgetPosition();
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+    virtual void layout();
 
-    virtual void setWidget(Widget*);
+private:
+    virtual bool isWidget() const { return true; }
 
+    virtual void paint(PaintInfo&, int x, int y);
+    virtual void destroy();
+    virtual void setSelectionState(SelectionState);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual void deleteWidget(Widget*);
+    virtual void setOverlapTestResult(bool);
 
-protected:
-    virtual void styleDidChange(RenderStyle::Diff, const RenderStyle* oldStyle);
-
-private:
     void setWidgetGeometry(const IntRect&);
 
-    virtual void deleteWidget();
+    RenderArena* ref() { ++m_refCount; return renderArena(); }
+    void deref(RenderArena*);
 
-protected:
     Widget* m_widget;
-    FrameView* m_view;
-
-private:
+    FrameView* m_frameView;
     int m_refCount;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
index bb88f24cfd..ed125ee581 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
@@ -74,10 +74,15 @@ void RootInlineBox::detachEllipsisBox(RenderArena* arena)
     }
 }
 
+RenderLineBoxList* RootInlineBox::rendererLineBoxes() const
+{
+    return block()->lineBoxes();
+}
+
 void RootInlineBox::clearTruncation()
 {
     if (m_hasEllipsisBox) {
-        detachEllipsisBox(m_object->renderArena());
+        detachEllipsisBox(renderer()->renderArena());
         InlineFlowBox::clearTruncation();
     }
 }
@@ -94,13 +99,13 @@ bool RootInlineBox::canAccommodateEllipsis(bool ltr, int blockEdge, int lineBoxE
     return InlineFlowBox::canAccommodateEllipsis(ltr, blockEdge, ellipsisWidth);
 }
 
-void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, int blockEdge, int ellipsisWidth,
+void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth,
                                   InlineBox* markupBox)
 {
     // Create an ellipsis box.
-    EllipsisBox* ellipsisBox = new (m_object->renderArena()) EllipsisBox(m_object, ellipsisStr, this,
-                                                              ellipsisWidth - (markupBox ? markupBox->width() : 0),
-                                                              yPos(), height(), baseline(), !prevRootBox(),
+    EllipsisBox* ellipsisBox = new (renderer()->renderArena()) EllipsisBox(renderer(), ellipsisStr, this,
+                                                              ellipsisWidth - (markupBox ? markupBox->width() : 0), height(),
+                                                              y(), !prevRootBox(),
                                                               markupBox);
     
     if (!gEllipsisBoxMap)
@@ -108,8 +113,9 @@ void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, in
     gEllipsisBoxMap->add(this, ellipsisBox);
     m_hasEllipsisBox = true;
 
-    if (ltr && (xPos() + width() + ellipsisWidth) <= blockEdge) {
-        ellipsisBox->m_x = xPos() + width();
+    // FIXME: Do we need an RTL version of this?
+    if (ltr && (x() + width() + ellipsisWidth) <= blockRightEdge) {
+        ellipsisBox->m_x = x() + width();
         return;
     }
 
@@ -117,20 +123,20 @@ void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, in
     // of that glyph.  Mark all of the objects that intersect the ellipsis box as not painting (as being
     // truncated).
     bool foundBox = false;
-    ellipsisBox->m_x = placeEllipsisBox(ltr, blockEdge, ellipsisWidth, foundBox);
+    ellipsisBox->m_x = placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, foundBox);
 }
 
-int RootInlineBox::placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox)
+int RootInlineBox::placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool& foundBox)
 {
-    int result = InlineFlowBox::placeEllipsisBox(ltr, blockEdge, ellipsisWidth, foundBox);
+    int result = InlineFlowBox::placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, foundBox);
     if (result == -1)
-        result = ltr ? blockEdge - ellipsisWidth : blockEdge;
+        result = ltr ? blockRightEdge - ellipsisWidth : blockLeftEdge;
     return result;
 }
 
 void RootInlineBox::paintEllipsisBox(RenderObject::PaintInfo& paintInfo, int tx, int ty) const
 {
-    if (m_hasEllipsisBox && object()->shouldPaintWithinRoot(paintInfo) && object()->style()->visibility() == VISIBLE &&
+    if (m_hasEllipsisBox && renderer()->shouldPaintWithinRoot(paintInfo) && renderer()->style()->visibility() == VISIBLE &&
             paintInfo.phase == PaintPhaseForeground)
         ellipsisBox()->paint(paintInfo, tx, ty);
 }
@@ -139,7 +145,7 @@ void RootInlineBox::paintEllipsisBox(RenderObject::PaintInfo& paintInfo, int tx,
 
 void RootInlineBox::addHighlightOverflow()
 {
-    Frame* frame = object()->document()->frame();
+    Frame* frame = renderer()->document()->frame();
     if (!frame)
         return;
     Page* page = frame->page();
@@ -148,17 +154,17 @@ void RootInlineBox::addHighlightOverflow()
 
     // Highlight acts as a selection inflation.
     FloatRect rootRect(0, selectionTop(), width(), selectionHeight());
-    IntRect inflatedRect = enclosingIntRect(page->chrome()->client()->customHighlightRect(object()->node(), object()->style()->highlight(), rootRect));
+    IntRect inflatedRect = enclosingIntRect(page->chrome()->client()->customHighlightRect(renderer()->node(), renderer()->style()->highlight(), rootRect));
     setHorizontalOverflowPositions(min(leftOverflow(), inflatedRect.x()), max(rightOverflow(), inflatedRect.right()));
     setVerticalOverflowPositions(min(topOverflow(), inflatedRect.y()), max(bottomOverflow(), inflatedRect.bottom()));
 }
 
 void RootInlineBox::paintCustomHighlight(RenderObject::PaintInfo& paintInfo, int tx, int ty, const AtomicString& highlightType)
 {
-    if (!object()->shouldPaintWithinRoot(paintInfo) || object()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
+    if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
         return;
 
-    Frame* frame = object()->document()->frame();
+    Frame* frame = renderer()->document()->frame();
     if (!frame)
         return;
     Page* page = frame->page();
@@ -166,10 +172,10 @@ void RootInlineBox::paintCustomHighlight(RenderObject::PaintInfo& paintInfo, int
         return;
 
     // Get the inflated rect so that we can properly hit test.
-    FloatRect rootRect(tx + xPos(), ty + selectionTop(), width(), selectionHeight());
-    FloatRect inflatedRect = page->chrome()->client()->customHighlightRect(object()->node(), highlightType, rootRect);
+    FloatRect rootRect(tx + x(), ty + selectionTop(), width(), selectionHeight());
+    FloatRect inflatedRect = page->chrome()->client()->customHighlightRect(renderer()->node(), highlightType, rootRect);
     if (inflatedRect.intersects(paintInfo.rect))
-        page->chrome()->client()->paintCustomHighlight(object()->node(), highlightType, rootRect, rootRect, false, true);
+        page->chrome()->client()->paintCustomHighlight(renderer()->node(), highlightType, rootRect, rootRect, false, true);
 }
 
 #endif
@@ -179,7 +185,7 @@ void RootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     InlineFlowBox::paint(paintInfo, tx, ty);
     paintEllipsisBox(paintInfo, tx, ty);
 #if PLATFORM(MAC)
-    RenderStyle* styleToUse = object()->style(m_firstLine);
+    RenderStyle* styleToUse = renderer()->style(m_firstLine);
     if (styleToUse->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
         paintCustomHighlight(paintInfo, tx, ty, styleToUse->highlight());
 #endif
@@ -189,7 +195,7 @@ bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 {
     if (m_hasEllipsisBox && visibleToHitTesting()) {
         if (ellipsisBox()->nodeAtPoint(request, result, x, y, tx, ty)) {
-            object()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
+            renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
             return true;
         }
     }
@@ -210,10 +216,10 @@ void RootInlineBox::adjustPosition(int dx, int dy)
 
 void RootInlineBox::childRemoved(InlineBox* box)
 {
-    if (box->object() == m_lineBreakObj)
+    if (box->renderer() == m_lineBreakObj)
         setLineBreakInfo(0, 0, BidiStatus());
 
-    for (RootInlineBox* prev = prevRootBox(); prev && prev->lineBreakObj() == box->object(); prev = prev->prevRootBox()) {
+    for (RootInlineBox* prev = prevRootBox(); prev && prev->lineBreakObj() == box->renderer(); prev = prev->prevRootBox()) {
         prev->setLineBreakInfo(0, 0, BidiStatus());
         prev->markDirty();
     }
@@ -232,26 +238,36 @@ GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBl
     InlineBox* firstBox = firstSelectedBox();
     InlineBox* lastBox = lastSelectedBox();
     if (leftGap)
-        result.uniteLeft(block()->fillLeftSelectionGap(firstBox->parent()->object(),
-                                                       firstBox->xPos(), selTop, selHeight,
+        result.uniteLeft(block()->fillLeftSelectionGap(firstBox->parent()->renderer(),
+                                                       firstBox->x(), selTop, selHeight,
                                                        rootBlock, blockX, blockY, tx, ty, paintInfo));
     if (rightGap)
-        result.uniteRight(block()->fillRightSelectionGap(lastBox->parent()->object(),
-                                                         lastBox->xPos() + lastBox->width(), selTop, selHeight,
+        result.uniteRight(block()->fillRightSelectionGap(lastBox->parent()->renderer(),
+                                                         lastBox->x() + lastBox->width(), selTop, selHeight,
                                                          rootBlock, blockX, blockY, tx, ty, paintInfo));
 
+    // When dealing with bidi text, a non-contiguous selection region is possible.
+    // e.g. The logical text aaaAAAbbb (capitals denote RTL text and non-capitals LTR) is layed out
+    // visually as 3 text runs |aaa|bbb|AAA| if we select 4 characters from the start of the text the
+    // selection will look like (underline denotes selection):
+    // |aaa|bbb|AAA|
+    //  ___       _
+    // We can see that the |bbb| run is not part of the selection while the runs around it are.
     if (firstBox && firstBox != lastBox) {
         // Now fill in any gaps on the line that occurred between two selected elements.
-        int lastX = firstBox->xPos() + firstBox->width();
+        int lastX = firstBox->x() + firstBox->width();
+        bool isPreviousBoxSelected = firstBox->selectionState() != RenderObject::SelectionNone;
         for (InlineBox* box = firstBox->nextLeafChild(); box; box = box->nextLeafChild()) {
             if (box->selectionState() != RenderObject::SelectionNone) {
-                result.uniteCenter(block()->fillHorizontalSelectionGap(box->parent()->object(),
-                                                                       lastX + tx, selTop + ty,
-                                                                       box->xPos() - lastX, selHeight, paintInfo));
-                lastX = box->xPos() + box->width();
+                if (isPreviousBoxSelected)  // VisibleSelection may be non-contiguous, see comment above.
+                    result.uniteCenter(block()->fillHorizontalSelectionGap(box->parent()->renderer(),
+                                                                           lastX + tx, selTop + ty,
+                                                                           box->x() - lastX, selHeight, paintInfo));
+                lastX = box->x() + box->width();
             }
             if (box == lastBox)
                 break;
+            isPreviousBoxSelected = box->selectionState() != RenderObject::SelectionNone;
         }
     }
 
@@ -316,10 +332,10 @@ int RootInlineBox::selectionTop()
         // This line has actually been moved further down, probably from a large line-height, but possibly because the
         // line was forced to clear floats.  If so, let's check the offsets, and only be willing to use the previous
         // line's bottom overflow if the offsets are greater on both sides.
-        int prevLeft = block()->leftOffset(prevBottom);
-        int prevRight = block()->rightOffset(prevBottom);
-        int newLeft = block()->leftOffset(selectionTop);
-        int newRight = block()->rightOffset(selectionTop);
+        int prevLeft = block()->leftOffset(prevBottom, !prevRootBox());
+        int prevRight = block()->rightOffset(prevBottom, !prevRootBox());
+        int newLeft = block()->leftOffset(selectionTop, !prevRootBox());
+        int newRight = block()->rightOffset(selectionTop, !prevRootBox());
         if (prevLeft > newLeft || prevRight < newRight)
             return selectionTop;
     }
@@ -329,12 +345,12 @@ int RootInlineBox::selectionTop()
 
 RenderBlock* RootInlineBox::block() const
 {
-    return static_cast<RenderBlock*>(m_object);
+    return toRenderBlock(renderer());
 }
 
-bool isEditableLeaf(InlineBox* leaf)
+static bool isEditableLeaf(InlineBox* leaf)
 {
-    return leaf && leaf->object() && leaf->object()->element() && leaf->object()->element()->isContentEditable();
+    return leaf && leaf->renderer() && leaf->renderer()->node() && leaf->renderer()->node()->isContentEditable();
 }
 
 InlineBox* RootInlineBox::closestLeafChildForXPos(int x, bool onlyEditableLeaves)
@@ -345,19 +361,19 @@ InlineBox* RootInlineBox::closestLeafChildForXPos(int x, bool onlyEditableLeaves
         return firstLeaf;
 
     // Avoid returning a list marker when possible.
-    if (x <= firstLeaf->m_x && !firstLeaf->object()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
+    if (x <= firstLeaf->m_x && !firstLeaf->renderer()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
         // The x coordinate is less or equal to left edge of the firstLeaf.
         // Return it.
         return firstLeaf;
 
-    if (x >= lastLeaf->m_x + lastLeaf->m_width && !lastLeaf->object()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
+    if (x >= lastLeaf->m_x + lastLeaf->m_width && !lastLeaf->renderer()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
         // The x coordinate is greater or equal to right edge of the lastLeaf.
         // Return it.
         return lastLeaf;
 
     InlineBox* closestLeaf = 0;
     for (InlineBox* leaf = firstLeaf; leaf; leaf = leaf->nextLeafChild()) {
-        if (!leaf->object()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(leaf))) {
+        if (!leaf->renderer()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(leaf))) {
             closestLeaf = leaf;
             if (x < leaf->m_x + leaf->m_width)
                 // The x coordinate is less than the right edge of the box.
@@ -394,12 +410,28 @@ EllipsisBox* RootInlineBox::ellipsisBox() const
 void RootInlineBox::setVerticalOverflowPositions(int top, int bottom) 
 { 
     if (!m_overflow) {
-        if (top == m_y && bottom == m_y + m_height)
+        const Font& font = renderer()->style(m_firstLine)->font();
+        if (top == m_y && bottom == m_y + font.height())
             return;
-        m_overflow = new (m_object->renderArena()) Overflow(this);
+        m_overflow = new (renderer()->renderArena()) Overflow(this);
     }
     m_overflow->m_topOverflow = top; 
     m_overflow->m_bottomOverflow = bottom; 
 }
 
+void RootInlineBox::removeLineBoxFromRenderObject()
+{
+    block()->lineBoxes()->removeLineBox(this);
+}
+
+void RootInlineBox::extractLineBoxFromRenderObject()
+{
+    block()->lineBoxes()->extractLineBox(this);
+}
+
+void RootInlineBox::attachLineBoxToRenderObject()
+{
+    block()->lineBoxes()->attachLineBox(this);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
index 4724110d0a..171be9d1da 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
@@ -28,9 +28,10 @@
 
 namespace WebCore {
 
-class BidiStatus;
 class EllipsisBox;
 class HitTestResult;
+
+struct BidiStatus;
 struct GapRects;
 
 class RootInlineBox : public InlineFlowBox {
@@ -43,7 +44,7 @@ public:
     {
     }
 
-    virtual bool isRootInlineBox() { return true; }
+    virtual bool isRootInlineBox() const { return true; }
 
     virtual void destroy(RenderArena*);
     void detachEllipsisBox(RenderArena*);
@@ -53,16 +54,18 @@ public:
 
     virtual void adjustPosition(int dx, int dy);
 
-    virtual int topOverflow() { return m_overflow ? m_overflow->m_topOverflow : m_y; }
-    virtual int bottomOverflow() { return m_overflow ? m_overflow->m_bottomOverflow : m_y + m_height; }
-    virtual int leftOverflow() { return m_overflow ? m_overflow->m_leftOverflow : m_x; }
-    virtual int rightOverflow() { return m_overflow ? m_overflow->m_rightOverflow : m_x + m_width; }
+    virtual int topOverflow() const { return m_overflow ? m_overflow->m_topOverflow : m_y; }
+    virtual int bottomOverflow() const { return m_overflow ? m_overflow->m_bottomOverflow : m_y + m_renderer->style(m_firstLine)->font().height(); }
+    virtual int leftOverflow() const { return m_overflow ? m_overflow->m_leftOverflow : m_x; }
+    virtual int rightOverflow() const { return m_overflow ? m_overflow->m_rightOverflow : m_x + m_width; }
 
     virtual void setVerticalOverflowPositions(int top, int bottom);
     void setHorizontalOverflowPositions(int left, int right);
 
     virtual void setVerticalSelectionPositions(int top, int bottom);
 
+    virtual RenderLineBoxList* rendererLineBoxes() const;
+
 #if ENABLE(SVG)
     virtual void computePerCharacterLayoutInformation() { }
 #endif
@@ -83,8 +86,8 @@ public:
     void childRemoved(InlineBox* box);
 
     bool canAccommodateEllipsis(bool ltr, int blockEdge, int lineBoxEdge, int ellipsisWidth);
-    void placeEllipsis(const AtomicString& ellipsisStr, bool ltr, int blockEdge, int ellipsisWidth, InlineBox* markupBox = 0);
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox);
+    void placeEllipsis(const AtomicString& ellipsisStr, bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, InlineBox* markupBox = 0);
+    virtual int placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool& foundBox);
 
     EllipsisBox* ellipsisBox() const;
 
@@ -114,20 +117,24 @@ public:
     RenderBlock* block() const;
 
     int selectionTop();
-    int selectionBottom() { return m_overflow ? m_overflow->m_selectionBottom : m_y + m_height; }
+    int selectionBottom() { return m_overflow ? m_overflow->m_selectionBottom : m_y + height(); }
     int selectionHeight() { return max(0, selectionBottom() - selectionTop()); }
 
     InlineBox* closestLeafChildForXPos(int x, bool onlyEditableLeaves = false);
 
-    Vector<RenderObject*>& floats()
+    Vector<RenderBox*>& floats()
     {
         ASSERT(!isDirty());
         if (!m_overflow)
-            m_overflow = new (m_object->renderArena()) Overflow(this);
+            m_overflow = new (m_renderer->renderArena()) Overflow(this);
         return m_overflow->floats;
     }
 
-    Vector<RenderObject*>* floatsPtr() { ASSERT(!isDirty()); return m_overflow ? &m_overflow->floats : 0; }
+    Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_overflow ? &m_overflow->floats : 0; }
+
+    virtual void extractLineBoxFromRenderObject();
+    virtual void attachLineBoxToRenderObject();
+    virtual void removeLineBoxFromRenderObject();
 
 protected:
     // Normally we are only as tall as the style on our block dictates, but we might have content
@@ -138,11 +145,11 @@ protected:
     struct Overflow {
         Overflow(RootInlineBox* box) 
             : m_topOverflow(box->m_y)
-            , m_bottomOverflow(box->m_y + box->m_height)
+            , m_bottomOverflow(box->m_y + box->height())
             , m_leftOverflow(box->m_x)
             , m_rightOverflow(box->m_x + box->m_width)
             , m_selectionTop(box->m_y)
-            , m_selectionBottom(box->m_y + box->m_height)
+            , m_selectionBottom(box->m_y + box->height())
         {
         }
 
@@ -158,7 +165,7 @@ protected:
         int m_selectionBottom;
         // Floats hanging off the line are pushed into this vector during layout. It is only
         // good for as long as the line has not been marked dirty.
-        Vector<RenderObject*> floats;
+        Vector<RenderBox*> floats;
     private:
         void* operator new(size_t) throw();
     };
@@ -184,7 +191,7 @@ inline void RootInlineBox::setHorizontalOverflowPositions(int left, int right)
     if (!m_overflow) {
         if (left == m_x && right == m_x + m_width)
             return;
-        m_overflow = new (m_object->renderArena()) Overflow(this);       
+        m_overflow = new (m_renderer->renderArena()) Overflow(this);       
     }
     m_overflow->m_leftOverflow = left; 
     m_overflow->m_rightOverflow = right; 
@@ -193,9 +200,10 @@ inline void RootInlineBox::setHorizontalOverflowPositions(int left, int right)
 inline void RootInlineBox::setVerticalSelectionPositions(int top, int bottom) 
 { 
     if (!m_overflow) {
-        if (top == m_y && bottom == m_y + m_height)
+        const Font& font = m_renderer->style(m_firstLine)->font();
+        if (top == m_y && bottom == m_y + font.height())
             return;
-        m_overflow = new (m_object->renderArena()) Overflow(this);
+        m_overflow = new (m_renderer->renderArena()) Overflow(this);
     }
     m_overflow->m_selectionTop = top; 
     m_overflow->m_selectionBottom = bottom; 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
index 89bab2d0e7..8871a7551c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
@@ -274,7 +274,7 @@ void SVGCharacterLayoutInfo::addLayoutInformation(InlineFlowBox* flowBox, float
                            angleStack.isEmpty() && baselineShiftStack.isEmpty() &&
                            curx == 0.0f && cury == 0.0f;
 
-    RenderSVGTextPath* textPath = static_cast<RenderSVGTextPath*>(flowBox->object());
+    RenderSVGTextPath* textPath = static_cast<RenderSVGTextPath*>(flowBox->renderer());
     Path path = textPath->layoutPath();
 
     float baselineShift = calculateBaselineShift(textPath);
@@ -521,7 +521,7 @@ TransformationMatrix SVGChar::characterTransform() const
     ctm.rotate(angle);
 
     if (pathData) {
-        ctm.scale(pathData->xScale, pathData->yScale);
+        ctm.scaleNonUniform(pathData->xScale, pathData->yScale);
         ctm.translate(pathData->xShift, pathData->yShift);
         ctm.rotate(pathData->orientationAngle);
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.cpp
index 3ea1193a93..2649664cc8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.cpp
@@ -43,9 +43,10 @@ int SVGInlineFlowBox::placeBoxesHorizontally(int, int&, int&, bool&)
     return 0;
 }
 
-void SVGInlineFlowBox::verticallyAlignBoxes(int&)
+int SVGInlineFlowBox::verticallyAlignBoxes(int)
 {
     // no-op
+    return 0;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.h b/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.h
index 96c5d4a2ff..1aa2637956 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGInlineFlowBox.h
@@ -33,12 +33,19 @@ class SVGInlineFlowBox : public InlineFlowBox {
 public:
     SVGInlineFlowBox(RenderObject* obj)
         : InlineFlowBox(obj)
+        , m_height(0)
     {
     }
 
+    virtual int svgBoxHeight() const { return m_height; }
+    void setHeight(int h) { m_height = h; }
+
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
     virtual int placeBoxesHorizontally(int x, int& leftPosition, int& rightPosition, bool& needsWordSpacing);
-    virtual void verticallyAlignBoxes(int& heightOfBlock);
+    virtual int verticallyAlignBoxes(int heightOfBlock);
+    
+private:
+    int m_height;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp
index 5f59700bec..d0fa9ae0ca 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.cpp
@@ -38,12 +38,11 @@
 
 #include <float.h>
 
-using std::max;
-
 namespace WebCore {
 
 SVGInlineTextBox::SVGInlineTextBox(RenderObject* obj)
     : InlineTextBox(obj)
+    , m_height(0)
 {
 }
 
@@ -77,7 +76,7 @@ SVGRootInlineBox* SVGInlineTextBox::svgRootInlineBox() const
 float SVGInlineTextBox::calculateGlyphWidth(RenderStyle* style, int offset, int extraCharsAvailable, int& charsConsumed, String& glyphName) const
 {
     ASSERT(style);
-    return style->font().floatWidth(svgTextRunForInlineTextBox(textObject()->text()->characters() + offset, 1, style, this, 0), extraCharsAvailable, charsConsumed, glyphName);
+    return style->font().floatWidth(svgTextRunForInlineTextBox(textRenderer()->text()->characters() + offset, 1, style, this, 0), extraCharsAvailable, charsConsumed, glyphName);
 }
 
 float SVGInlineTextBox::calculateGlyphHeight(RenderStyle* style, int, int) const
@@ -125,14 +124,14 @@ struct SVGInlineTextBoxClosestCharacterToPositionWalker {
         , m_distance(FLT_MAX)
         , m_x(x)
         , m_y(y)
-        , m_offset(0)
+        , m_offsetOfHitCharacter(0)
     {
     }
 
     void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
-        RenderStyle* style = textBox->textObject()->style();
+        RenderStyle* style = textBox->textRenderer()->style();
 
         Vector<SVGChar>::iterator closestCharacter = 0;
         unsigned int closestOffset = UINT_MAX;
@@ -164,7 +163,7 @@ struct SVGInlineTextBoxClosestCharacterToPositionWalker {
         if (closestOffset != UINT_MAX) {
             // Record current chunk, if it contains the current closest character next to the mouse.
             m_character = closestCharacter;
-            m_offset = closestOffset;
+            m_offsetOfHitCharacter = closestOffset;
         }
     }
 
@@ -173,12 +172,12 @@ struct SVGInlineTextBoxClosestCharacterToPositionWalker {
         return m_character;
     }
 
-    int offset() const
+    int offsetOfHitCharacter() const
     {
         if (!m_character)
             return 0;
 
-        return m_offset;
+        return m_offsetOfHitCharacter;
     }
 
 private:
@@ -187,7 +186,7 @@ private:
 
     int m_x;
     int m_y;
-    int m_offset;
+    int m_offsetOfHitCharacter;
 };
 
 // Helper class for selectionRect()
@@ -199,7 +198,7 @@ struct SVGInlineTextBoxSelectionRectWalker {
     void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
-        RenderStyle* style = textBox->textObject()->style();
+        RenderStyle* style = textBox->textRenderer()->style();
 
         for (Vector<SVGChar>::iterator it = start; it != end; ++it) {
             if (it->isHidden())
@@ -221,7 +220,7 @@ private:
     FloatRect m_selectionRect;
 };
 
-SVGChar* SVGInlineTextBox::closestCharacterToPosition(int x, int y, int& offset) const
+SVGChar* SVGInlineTextBox::closestCharacterToPosition(int x, int y, int& offsetOfHitCharacter) const
 {
     SVGRootInlineBox* rootBox = svgRootInlineBox();
     if (!rootBox)
@@ -232,25 +231,30 @@ SVGChar* SVGInlineTextBox::closestCharacterToPosition(int x, int y, int& offset)
 
     rootBox->walkTextChunks(&walker, this);
 
-    offset = walkerCallback.offset();
+    offsetOfHitCharacter = walkerCallback.offsetOfHitCharacter();
     return walkerCallback.character();
 }
 
-bool SVGInlineTextBox::svgCharacterHitsPosition(int x, int y, int& offset) const
+bool SVGInlineTextBox::svgCharacterHitsPosition(int x, int y, int& closestOffsetInBox) const
 {
-    SVGChar* charAtPosPtr = closestCharacterToPosition(x, y, offset);
+    int offsetOfHitCharacter = 0;
+    SVGChar* charAtPosPtr = closestCharacterToPosition(x, y, offsetOfHitCharacter);
     if (!charAtPosPtr)
         return false;
 
     SVGChar& charAtPos = *charAtPosPtr;
-    RenderStyle* style = textObject()->style(m_firstLine);
-    FloatRect glyphRect = calculateGlyphBoundaries(style, offset, charAtPos);
+    RenderStyle* style = textRenderer()->style(m_firstLine);
+    FloatRect glyphRect = calculateGlyphBoundaries(style, offsetOfHitCharacter, charAtPos);
 
+    // FIXME: Why?
     if (direction() == RTL)
-        offset++;
+        offsetOfHitCharacter++;
+
+    // The caller actually the closest offset before/after the hit char
+    // closestCharacterToPosition returns us offsetOfHitCharacter.
+    closestOffsetInBox = offsetOfHitCharacter;
 
-    // FIXME: todo list
-    // (#13910) This code does not handle bottom-to-top/top-to-bottom vertical text.
+    // FIXME: (bug 13910) This code does not handle bottom-to-top/top-to-bottom vertical text.
 
     // Check whether y position hits the current character 
     if (y < charAtPos.y - glyphRect.height() || y > charAtPos.y)
@@ -258,21 +262,21 @@ bool SVGInlineTextBox::svgCharacterHitsPosition(int x, int y, int& offset) const
 
     // Check whether x position hits the current character
     if (x < charAtPos.x) {
-        if (offset > 0 && direction() == LTR)
+        if (closestOffsetInBox > 0 && direction() == LTR)
             return true;
-        else if (offset < (int) end() && direction() == RTL)
+        else if (closestOffsetInBox < (int) end() && direction() == RTL)
             return true;
 
         return false;
     }
 
-    // If we are past the last glyph of this box, don't mark it as 'hit' anymore.
-    if (x >= charAtPos.x + glyphRect.width() && offset == (int) end())
-        return false;
-
-    // Snap to character at half of it's advance
+    // Adjust the closest offset to after the char if x was after the char midpoint
     if (x >= charAtPos.x + glyphRect.width() / 2.0)
-        offset += direction() == RTL ? -1 : 1;
+        closestOffsetInBox += direction() == RTL ? -1 : 1;
+
+    // If we are past the last glyph of this box, don't mark it as 'hit'
+    if (x >= charAtPos.x + glyphRect.width() && closestOffsetInBox == (int) end())
+        return false;
 
     return true;
 }
@@ -296,8 +300,8 @@ bool SVGInlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result,
     ASSERT(!isLineBreak());
 
     IntRect rect = selectionRect(0, 0, 0, len());
-    if (object()->style()->visibility() == VISIBLE && rect.contains(x, y)) {
-        object()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
+    if (renderer()->style()->visibility() == VISIBLE && rect.contains(x, y)) {
+        renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
         return true;
     }
 
@@ -324,12 +328,12 @@ IntRect SVGInlineTextBox::selectionRect(int, int, int startPos, int endPos)
 
 void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int tx, int ty, const SVGChar& svgChar, const UChar* chars, int length, SVGPaintServer* activePaintServer)
 {
-    if (object()->style()->visibility() != VISIBLE || paintInfo.phase == PaintPhaseOutline)
+    if (renderer()->style()->visibility() != VISIBLE || paintInfo.phase == PaintPhaseOutline)
         return;
 
     ASSERT(paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines);
 
-    RenderText* text = textObject();
+    RenderText* text = textRenderer();
     ASSERT(text);
 
     bool isPrinting = text->document()->printing();
@@ -346,9 +350,7 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
 
     // Set our font
     RenderStyle* styleToUse = text->style(isFirstLineStyle());
-    const Font* font = &styleToUse->font();
-    if (*font != paintInfo.context->font())
-        paintInfo.context->setFont(*font);
+    const Font& font = styleToUse->font();
 
     TransformationMatrix ctm = svgChar.characterTransform();
     if (!ctm.isIdentity())
@@ -365,8 +367,8 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
 
         if (containsComposition && !useCustomUnderlines)
             paintCompositionBackground(paintInfo.context, tx, ty, styleToUse, font, 
-                                                text->document()->frame()->editor()->compositionStart(),
-                                                text->document()->frame()->editor()->compositionEnd());
+                                       text->document()->frame()->editor()->compositionStart(),
+                                       text->document()->frame()->editor()->compositionEnd());
         
         paintDocumentMarkers(paintInfo.context, tx, ty, styleToUse, font, true);
 
@@ -395,7 +397,7 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
     run.setActivePaintServer(activePaintServer);
 #endif
 
-    paintInfo.context->drawText(run, origin);
+    paintInfo.context->drawText(font, run, origin);
 
     if (paintInfo.phase != PaintPhaseSelection) {
         paintDocumentMarkers(paintInfo.context, tx, ty, styleToUse, font, false);
@@ -434,7 +436,7 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
         paintInfo.context->concatCTM(ctm.inverse());
 }
 
-void SVGInlineTextBox::paintSelection(int boxStartOffset, const SVGChar& svgChar, const UChar*, int length, GraphicsContext* p, RenderStyle* style, const Font* f)
+void SVGInlineTextBox::paintSelection(int boxStartOffset, const SVGChar& svgChar, const UChar*, int length, GraphicsContext* p, RenderStyle* style, const Font& font)
 {
     if (selectionState() == RenderObject::SelectionNone)
         return;
@@ -446,7 +448,7 @@ void SVGInlineTextBox::paintSelection(int boxStartOffset, const SVGChar& svgChar
         return;
 
     Color textColor = style->color();
-    Color color = object()->selectionBackgroundColor();
+    Color color = renderer()->selectionBackgroundColor();
     if (!color.isValid() || color.alpha() == 0)
         return;
 
@@ -473,9 +475,9 @@ void SVGInlineTextBox::paintSelection(int boxStartOffset, const SVGChar& svgChar
     p->save();
 
     int adjust = startPos >= boxStartOffset ? boxStartOffset : 0;
-    p->drawHighlightForText(svgTextRunForInlineTextBox(textObject()->text()->characters() + start() + boxStartOffset, length, style, this, svgChar.x),
-                            IntPoint((int) svgChar.x, (int) svgChar.y - f->ascent()),
-                            f->ascent() + f->descent(), color, startPos - adjust, endPos - adjust);
+    p->drawHighlightForText(font, svgTextRunForInlineTextBox(textRenderer()->text()->characters() + start() + boxStartOffset, length, style, this, svgChar.x),
+                            IntPoint((int) svgChar.x, (int) svgChar.y - font.ascent()),
+                            font.ascent() + font.descent(), color, startPos - adjust, endPos - adjust);
 
     p->restore();
 }
@@ -498,7 +500,7 @@ static inline Path pathForDecoration(ETextDecoration decoration, RenderObject* o
 
 void SVGInlineTextBox::paintDecoration(ETextDecoration decoration, GraphicsContext* context, int tx, int ty, int width, const SVGChar& svgChar, const SVGTextDecorationInfo& info)
 {
-    if (object()->style()->visibility() != VISIBLE)
+    if (renderer()->style()->visibility() != VISIBLE)
         return;
 
     // This function does NOT accept combinated text decorations. It's meant to be invoked for just one.
@@ -510,10 +512,11 @@ void SVGInlineTextBox::paintDecoration(ETextDecoration decoration, GraphicsConte
     if (!isFilled && !isStroked)
         return;
 
+    int baseline = renderer()->style(m_firstLine)->font().ascent();
     if (decoration == UNDERLINE)
-        ty += m_baseline;
+        ty += baseline;
     else if (decoration == LINE_THROUGH)
-        ty += 2 * m_baseline / 3;
+        ty += 2 * baseline / 3;
 
     context->save();
     context->beginPath();
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h
index 1ddc23a61d..410218d5e3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGInlineTextBox.h
@@ -29,14 +29,18 @@
 
 namespace WebCore {
 
-    class SVGChar;
     class SVGRootInlineBox;
-    class SVGTextDecorationInfo;
+
+    struct SVGChar;
+    struct SVGTextDecorationInfo;
 
     class SVGInlineTextBox : public InlineTextBox {
     public:
         SVGInlineTextBox(RenderObject* obj);
 
+        virtual int svgBoxHeight() const { return m_height; }
+        void setHeight(int h) { m_height = h; }
+
         virtual int selectionTop();
         virtual int selectionHeight();
 
@@ -50,7 +54,7 @@ namespace WebCore {
         void paintCharacters(RenderObject::PaintInfo&, int tx, int ty, const SVGChar&, const UChar* chars, int length, SVGPaintServer*);
 
         // SVGs custom paint selection method
-        void paintSelection(int boxStartOffset, const SVGChar&, const UChar*, int length, GraphicsContext*, RenderStyle*, const Font*);
+        void paintSelection(int boxStartOffset, const SVGChar&, const UChar*, int length, GraphicsContext*, RenderStyle*, const Font&);
 
         // SVGs custom paint decoration method
         void paintDecoration(ETextDecoration, GraphicsContext*, int tx, int ty, int width, const SVGChar&, const SVGTextDecorationInfo&);
@@ -67,6 +71,8 @@ namespace WebCore {
     private:
         friend class RenderSVGInlineText;
         bool svgCharacterHitsPosition(int x, int y, int& offset) const;
+        
+        int m_height;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
index c88e8e8c63..c2c8e0bc03 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2007, 2008 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *           (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,7 +26,6 @@
 #if ENABLE(SVG)
 #include "SVGRenderSupport.h"
 
-#include "TransformationMatrix.h"
 #include "ImageBuffer.h"
 #include "RenderObject.h"
 #include "RenderSVGContainer.h"
@@ -35,14 +35,50 @@
 #include "SVGResourceMasker.h"
 #include "SVGStyledElement.h"
 #include "SVGURIReference.h"
+#include "TransformState.h"
+#include "TransformationMatrix.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
-void prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& boundingBox, SVGResourceFilter*& filter, SVGResourceFilter* rootFilter)
-{    
-    SVGElement* svgElement = static_cast<SVGElement*>(object->element());
-    ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
+IntRect SVGRenderBase::clippedOverflowRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer)
+{
+    // Return early for any cases where we don't actually paint
+    if (object->style()->visibility() != VISIBLE && !object->enclosingLayer()->hasVisibleContent())
+        return IntRect();
+
+    // Pass our local paint rect to computeRectForRepaint() which will
+    // map to parent coords and recurse up the parent chain.
+    IntRect repaintRect = enclosingIntRect(object->repaintRectInLocalCoordinates());
+    object->computeRectForRepaint(repaintContainer, repaintRect);
+    return repaintRect;
+}
+
+void SVGRenderBase::computeRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+{
+    // Translate to coords in our parent renderer, and then call computeRectForRepaint on our parent
+    repaintRect = object->localToParentTransform().mapRect(repaintRect);
+    object->parent()->computeRectForRepaint(repaintContainer, repaintRect, fixed);
+}
+
+void SVGRenderBase::mapLocalToContainer(const RenderObject* object, RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState)
+{
+    ASSERT(!fixed); // We should have no fixed content in the SVG rendering tree.
+    ASSERT(useTransforms); // mapping a point through SVG w/o respecting trasnforms is useless.
+    transformState.applyTransform(object->localToParentTransform());
+    object->parent()->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
+}
+
+void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& boundingBox, SVGResourceFilter*& filter, SVGResourceFilter* rootFilter)
+{
+#if !ENABLE(FILTERS)
+    UNUSED_PARAM(filter);
+    UNUSED_PARAM(rootFilter);
+#endif
+
     ASSERT(object);
+    SVGElement* svgElement = static_cast<SVGElement*>(object->node());
+    ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
 
     SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(svgElement);
     const RenderStyle* style = object->style();
@@ -58,7 +94,7 @@ void prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& pa
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     AtomicString filterId(svgStyle->filter());
 #endif
 
@@ -67,7 +103,7 @@ void prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& pa
 
     Document* document = object->document();
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     SVGResourceFilter* newFilter = getFilterById(document, filterId);
     if (newFilter == rootFilter) {
         // Catch <text filter="url(#foo)">Test<tspan filter="url(#foo)">123</tspan></text>.
@@ -81,10 +117,10 @@ void prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& pa
     SVGResourceClipper* clipper = getClipperById(document, clipperId);
     SVGResourceMasker* masker = getMaskerById(document, maskerId);
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     if (filter) {
         filter->addClient(styledElement);
-        filter->prepareFilter(paintInfo.context, boundingBox);
+        filter->prepareFilter(paintInfo.context, object->objectBoundingBox());
     } else if (!filterId.isEmpty())
         svgElement->document()->accessSVGExtensions()->addPendingResource(filterId, styledElement);
 #endif
@@ -102,16 +138,21 @@ void prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& pa
         svgElement->document()->accessSVGExtensions()->addPendingResource(maskerId, styledElement);
 }
 
-void finishRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& boundingBox, SVGResourceFilter*& filter, GraphicsContext* savedContext)
+void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, SVGResourceFilter*& filter, GraphicsContext* savedContext)
 {
+#if !ENABLE(FILTERS)
+    UNUSED_PARAM(filter);
+    UNUSED_PARAM(savedContext);
+#endif
+
     ASSERT(object);
 
     const RenderStyle* style = object->style();
     ASSERT(style);
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     if (filter) {
-        filter->applyFilter(paintInfo.context, boundingBox);
+        filter->applyFilter(paintInfo.context, object->objectBoundingBox());
         paintInfo.context = savedContext;
     }
 #endif
@@ -143,17 +184,13 @@ void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
         svgContainer->setDrawsContents(false);
 }
 
-void clampImageBufferSizeToViewport(RenderObject* object, IntSize& size)
+void clampImageBufferSizeToViewport(FrameView* frameView, IntSize& size)
 {
-    if (!object || !object->isRenderView())
+    if (!frameView)
         return;
 
-    RenderView* view = static_cast<RenderView*>(object);
-    if (!view->frameView())
-        return;
-
-    int viewWidth = view->frameView()->visibleWidth();
-    int viewHeight = view->frameView()->visibleHeight();
+    int viewWidth = frameView->visibleWidth();
+    int viewHeight = frameView->visibleHeight();
 
     if (size.width() > viewWidth)
         size.setWidth(viewWidth);
@@ -162,6 +199,41 @@ void clampImageBufferSizeToViewport(RenderObject* object, IntSize& size)
         size.setHeight(viewHeight);
 }
 
+FloatRect SVGRenderBase::computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent)
+{
+    FloatRect boundingBox;
+
+    RenderObject* current = container->firstChild();
+    for (; current != 0; current = current->nextSibling()) {
+        FloatRect childBBox = includeAllPaintedContent ? current->repaintRectInLocalCoordinates() : current->objectBoundingBox();
+        FloatRect childBBoxInLocalCoords = current->localToParentTransform().mapRect(childBBox);
+        boundingBox.unite(childBBoxInLocalCoords);
+    }
+
+    return boundingBox;
+}
+
+FloatRect SVGRenderBase::filterBoundingBoxForRenderer(const RenderObject* object)
+{
+#if ENABLE(FILTERS)
+    SVGResourceFilter* filter = getFilterById(object->document(), object->style()->svgStyle()->filter());
+    if (filter)
+        return filter->filterBBoxForItemBBox(object->objectBoundingBox());
+#else
+    UNUSED_PARAM(object);
+#endif
+    return FloatRect();
+}
+
+void applyTransformToPaintInfo(RenderObject::PaintInfo& paintInfo, const TransformationMatrix& localToAncestorTransform)
+{
+    if (localToAncestorTransform.isIdentity())
+        return;
+
+    paintInfo.context->concatCTM(localToAncestorTransform);
+    paintInfo.rect = localToAncestorTransform.inverse().mapRect(paintInfo.rect);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h
index 7fdfcf82aa..da2bf5910c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.h
@@ -1,9 +1,8 @@
 /**
- * This file is part of the DOM implementation for WebKit.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *           (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,21 +21,53 @@
  *
  */
 
+#ifndef SVGRenderBase_h
+#define SVGRenderBase_h
+
 #if ENABLE(SVG)
 #include "RenderObject.h"
 
 namespace WebCore {
 
-class SVGResourceFilter;
-void prepareToRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, SVGResourceFilter* rootFilter = 0);
-void finishRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, GraphicsContext* savedContext);
+    class SVGResourceFilter;
+    class ImageBuffer;
+
+    // SVGRendererBase is an abstract base class which all SVG renderers inherit
+    // from in order to share SVG renderer code.
+    // FIXME: This code can all move into RenderSVGModelObject once
+    // all SVG renderers inherit from RenderSVGModelObject.
+    class SVGRenderBase {
+    public:
+        // FIXME: These are only public for SVGRootInlineBox.
+        // It's unclear if these should be exposed or not.  SVGRootInlineBox may
+        // pass the wrong RenderObject* and boundingBox to these functions.
+        static void prepareToRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, SVGResourceFilter* rootFilter = 0);
+        static void finishRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, SVGResourceFilter*&, GraphicsContext* savedContext);
+
+    protected:
+        static IntRect clippedOverflowRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer);
+        static void computeRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer, IntRect&, bool fixed);
+
+        static void mapLocalToContainer(const RenderObject*, RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&);
+
+        // Used to share the "walk all the children" logic between objectBoundingBox
+        // and repaintRectInLocalCoordinates in RenderSVGRoot and RenderSVGContainer
+        static FloatRect computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent);
+
+        // returns the filter bounding box (or the empty rect if no filter) in local coordinates
+        static FloatRect filterBoundingBoxForRenderer(const RenderObject*);
+    };
+
+    // FIXME: This should move to RenderObject or PaintInfo
+    // Used for transforming the GraphicsContext and damage rect before passing PaintInfo to child renderers.
+    void applyTransformToPaintInfo(RenderObject::PaintInfo&, const TransformationMatrix& localToChildTransform);
 
-// This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
-class ImageBuffer;
-void renderSubtreeToImage(ImageBuffer*, RenderObject*);
+    // This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
+    void renderSubtreeToImage(ImageBuffer*, RenderObject*);
 
-void clampImageBufferSizeToViewport(RenderObject*, IntSize&);
+    void clampImageBufferSizeToViewport(FrameView*, IntSize& imageBufferSize);
+} // namespace WebCore
 
-}
+#endif // ENABLE(SVG)
 
-#endif
+#endif // SVGRenderBase_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
index eff2fffa06..33baebac87 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
@@ -33,7 +33,9 @@
 #include "GraphicsTypes.h"
 #include "InlineTextBox.h"
 #include "HTMLNames.h"
+#include "RenderPath.h"
 #include "RenderSVGContainer.h"
+#include "RenderSVGImage.h"
 #include "RenderSVGInlineText.h"
 #include "RenderSVGText.h"
 #include "RenderSVGRoot.h"
@@ -78,6 +80,31 @@ TextStream& operator<<(TextStream& ts, TextStreamSeparator& sep)
     return ts;
 }
 
+template<typename ValueType>
+static void writeNameValuePair(TextStream& ts, const char* name, ValueType value)
+{
+    ts << " [" << name << "=" << value << "]";
+}
+
+template<typename ValueType>
+static void writeNameAndQuotedValue(TextStream& ts, const char* name, ValueType value)
+{
+    ts << " [" << name << "=\"" << value << "\"]";
+}
+
+static void writeIfNotEmpty(TextStream& ts, const char* name, const String& value)
+{
+    if (!value.isEmpty())
+        writeNameValuePair(ts, name, value);
+}
+
+template<typename ValueType>
+static void writeIfNotDefault(TextStream& ts, const char* name, ValueType value, ValueType defaultValue)
+{
+    if (value != defaultValue)
+        writeNameValuePair(ts, name, value);
+}
+
 TextStream& operator<<(TextStream& ts, const IntPoint& p)
 {
     return ts << "(" << p.x() << "," << p.y() << ")";
@@ -88,7 +115,7 @@ TextStream& operator<<(TextStream& ts, const IntRect& r)
     return ts << "at (" << r.x() << "," << r.y() << ") size " << r.width() << "x" << r.height();
 }
 
-bool hasFractions(double val)
+static bool hasFractions(double val)
 {
     double epsilon = 0.0001;
     int ival = static_cast<int>(val);
@@ -232,11 +259,9 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
     const SVGRenderStyle* svgStyle = style->svgStyle();
 
     if (!object.localTransform().isIdentity())
-        ts << " [transform=" << object.localTransform() << "]";
-    if (svgStyle->imageRendering() != SVGRenderStyle::initialImageRendering())
-        ts << " [image rendering=" << svgStyle->imageRendering() << "]";
-    if (style->opacity() != RenderStyle::initialOpacity())
-        ts << " [opacity=" << style->opacity() << "]";
+        writeNameValuePair(ts, "transform", object.localTransform());
+    writeIfNotDefault(ts, "image rendering", svgStyle->imageRendering(), SVGRenderStyle::initialImageRendering());
+    writeIfNotDefault(ts, "opacity", style->opacity(), RenderStyle::initialOpacity());
     if (object.isRenderPath()) {
         const RenderPath& path = static_cast<const RenderPath&>(object);
         SVGPaintServer* strokePaintServer = SVGPaintServer::strokePaintServer(style, &path);
@@ -250,20 +275,15 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
             const DashArray& dashArray = dashArrayFromRenderingStyle(style);
             double strokeWidth = SVGRenderStyle::cssPrimitiveToLength(&path, svgStyle->strokeWidth(), 1.0f);
 
-            if (svgStyle->strokeOpacity() != 1.0f)
-                ts << s << "[opacity=" << svgStyle->strokeOpacity() << "]";
-            if (strokeWidth != 1.0f)
-                ts << s << "[stroke width=" << strokeWidth << "]";
-            if (svgStyle->strokeMiterLimit() != 4)
-                ts << s << "[miter limit=" << svgStyle->strokeMiterLimit() << "]";
-            if (svgStyle->capStyle() != 0)
-                ts << s << "[line cap=" << svgStyle->capStyle() << "]";
-            if (svgStyle->joinStyle() != 0)
-                ts << s << "[line join=" << svgStyle->joinStyle() << "]";
-            if (dashOffset != 0.0f)
-                ts << s << "[dash offset=" << dashOffset << "]";
+            writeIfNotDefault(ts, "opacity", svgStyle->strokeOpacity(), 1.0f);
+            writeIfNotDefault(ts, "stroke width", strokeWidth, 1.0);
+            writeIfNotDefault(ts, "miter limit", svgStyle->strokeMiterLimit(), 4.0f);
+            writeIfNotDefault(ts, "line cap", svgStyle->capStyle(), ButtCap);
+            writeIfNotDefault(ts, "line join", svgStyle->joinStyle(), MiterJoin);
+            writeIfNotDefault(ts, "dash offset", dashOffset, 0.0);
             if (!dashArray.isEmpty())
-                ts << s << "[dash array=" << dashArray << "]";
+                writeNameValuePair(ts, "dash array", dashArray);
+
             ts << "}]";
         }
         SVGPaintServer* fillPaintServer = SVGPaintServer::fillPaintServer(style, &path);
@@ -273,52 +293,47 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
             if (fillPaintServer)
                 ts << s << *fillPaintServer;
 
-            if (style->svgStyle()->fillOpacity() != 1.0f)
-                ts << s << "[opacity=" << style->svgStyle()->fillOpacity() << "]";
-            if (style->svgStyle()->fillRule() != RULE_NONZERO)
-                ts << s << "[fill rule=" << style->svgStyle()->fillRule() << "]";
+            writeIfNotDefault(ts, "opacity", svgStyle->fillOpacity(), 1.0f);
+            writeIfNotDefault(ts, "fill rule", svgStyle->fillRule(), RULE_NONZERO);
             ts << "}]";
         }
     }
+
     if (!svgStyle->clipPath().isEmpty())
-        ts << " [clip path=\"" << svgStyle->clipPath() << "\"]";
-    if (!svgStyle->startMarker().isEmpty())
-        ts << " [start marker=" << svgStyle->startMarker() << "]";
-    if (!svgStyle->midMarker().isEmpty())
-        ts << " [middle marker=" << svgStyle->midMarker() << "]";
-    if (!svgStyle->endMarker().isEmpty())
-        ts << " [end marker=" << svgStyle->endMarker() << "]";
-    if (!svgStyle->filter().isEmpty())
-        ts << " [filter=" << svgStyle->filter() << "]";
+        writeNameAndQuotedValue(ts, "clip path", svgStyle->clipPath());
+    writeIfNotEmpty(ts, "start marker", svgStyle->startMarker());
+    writeIfNotEmpty(ts, "middle marker", svgStyle->midMarker());
+    writeIfNotEmpty(ts, "end marker", svgStyle->endMarker());
+    writeIfNotEmpty(ts, "filter", svgStyle->filter());
 }
 
-static TextStream& operator<<(TextStream& ts, const RenderPath& path)
+static TextStream& writePositionAndStyle(TextStream& ts, const RenderObject& object)
 {
-    ts << " " << path.absoluteTransform().mapRect(path.relativeBBox());
-
-    writeStyle(ts, path);
-
-    ts << " [data=\"" << path.path().debugString() << "\"]";
+    ts << " " << object.absoluteTransform().mapRect(object.repaintRectInLocalCoordinates());
+    writeStyle(ts, object);
+    return ts;
+}
 
+static TextStream& operator<<(TextStream& ts, const RenderPath& path)
+{
+    writePositionAndStyle(ts, path);
+    writeNameAndQuotedValue(ts, "data", path.path().debugString());
     return ts;
 }
 
 static TextStream& operator<<(TextStream& ts, const RenderSVGContainer& container)
 {
-    ts << " " << container.absoluteTransform().mapRect(container.relativeBBox());
-
-    writeStyle(ts, container);
-
-    return ts;
+    return writePositionAndStyle(ts, container);
 }
 
 static TextStream& operator<<(TextStream& ts, const RenderSVGRoot& root)
 {
-    ts << " " << root.absoluteTransform().mapRect(root.relativeBBox());
-
-    writeStyle(ts, root);
+    return writePositionAndStyle(ts, root);
+}
 
-    return ts;
+static TextStream& operator<<(TextStream& ts, const RenderSVGImage& root)
+{
+    return writePositionAndStyle(ts, root);
 }
 
 static TextStream& operator<<(TextStream& ts, const RenderSVGText& text)
@@ -329,10 +344,10 @@ static TextStream& operator<<(TextStream& ts, const RenderSVGText& text)
         return ts;
 
     Vector<SVGTextChunk>& chunks = const_cast<Vector<SVGTextChunk>& >(box->svgTextChunks());
-    ts << " at (" << text.xPos() << "," << text.yPos() << ") size " << box->width() << "x" << box->height() << " contains " << chunks.size() << " chunk(s)";
+    ts << " at (" << text.x() << "," << text.y() << ") size " << box->width() << "x" << box->height() << " contains " << chunks.size() << " chunk(s)";
 
     if (text.parent() && (text.parent()->style()->color() != text.style()->color()))
-        ts << " [color=" << text.style()->color().name() << "]";
+        writeNameValuePair(ts, "color", text.style()->color().name());
 
     return ts;
 }
@@ -430,7 +445,7 @@ static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textB
                     ts << " override";
             }
 
-            ts << ": " << quoteAndEscapeNonPrintables(String(textBox->textObject()->text()).substring(textBox->start() + range.startOffset, offset)) << "\n";
+            ts << ": " << quoteAndEscapeNonPrintables(String(textBox->textRenderer()->text()).substring(textBox->start() + range.startOffset, offset)) << "\n";
 
             j++;
         }
@@ -445,93 +460,63 @@ static inline void writeSVGInlineText(TextStream& ts, const RenderSVGInlineText&
         writeSVGInlineTextBox(ts, static_cast<SVGInlineTextBox*>(box), indent);
 }
 
-static String getTagName(SVGStyledElement* elem)
+static void writeStandardPrefix(TextStream& ts, const RenderObject& object, int indent)
 {
-    if (elem)
-        return elem->nodeName();
-    return "";
+    writeIndent(ts, indent);
+    ts << object.renderName();
+
+    if (object.node())
+        ts << " {" << object.node()->nodeName() << "}";
 }
 
-void write(TextStream& ts, const RenderSVGContainer& container, int indent)
+static void writeChildren(TextStream& ts, const RenderObject& object, int indent)
 {
-    writeIndent(ts, indent);
-    ts << container.renderName();
-
-    if (container.element()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(container.element()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
+    for (RenderObject* child = object.firstChild(); child; child = child->nextSibling())
+        write(ts, *child, indent + 1);
+}
 
+void write(TextStream& ts, const RenderSVGContainer& container, int indent)
+{
+    writeStandardPrefix(ts, container, indent);
     ts << container << "\n";
-
-    for (RenderObject* child = container.firstChild(); child; child = child->nextSibling())
-        write(ts, *child, indent + 1);
+    writeChildren(ts, container, indent);
 }
 
 void write(TextStream& ts, const RenderSVGRoot& root, int indent)
 {
-    writeIndent(ts, indent);
-    ts << root.renderName();
-
-    if (root.element()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(root.element()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
+    writeStandardPrefix(ts, root, indent);
     ts << root << "\n";
-
-    for (RenderObject* child = root.firstChild(); child; child = child->nextSibling())
-        write(ts, *child, indent + 1);
+    writeChildren(ts, root, indent);
 }
 
 void write(TextStream& ts, const RenderSVGText& text, int indent)
 {
-    writeIndent(ts, indent);
-    ts << text.renderName();
-
-    if (text.element()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(text.element()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
+    writeStandardPrefix(ts, text, indent);
     ts << text << "\n";
-
-    for (RenderObject* child = text.firstChild(); child; child = child->nextSibling())
-        write(ts, *child, indent + 1);
+    writeChildren(ts, text, indent);
 }
 
 void write(TextStream& ts, const RenderSVGInlineText& text, int indent)
 {
-    writeIndent(ts, indent);
-    ts << text.renderName();
-
-    if (text.element()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(text.element()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
+    writeStandardPrefix(ts, text, indent);
 
-    ts << " at (" << text.xPos() << "," << text.yPos() << ") size " << text.width() << "x" << text.height() << "\n";
+    // Why not just linesBoundingBox()?
+    ts << " " << FloatRect(text.firstRunOrigin(), text.linesBoundingBox().size()) << "\n";
     writeSVGInlineText(ts, text, indent);
 }
 
 void write(TextStream& ts, const RenderPath& path, int indent)
 {
-    writeIndent(ts, indent);
-    ts << path.renderName();
-
-    if (path.element()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(path.element()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
+    writeStandardPrefix(ts, path, indent);
     ts << path << "\n";
 }
 
+void write(TextStream& ts, const RenderSVGImage& image, int indent)
+{
+    writeStandardPrefix(ts, image, indent);
+    ts << image << "\n";
+}
+
 void writeRenderResources(TextStream& ts, Node* parent)
 {
     ASSERT(parent);
@@ -549,6 +534,7 @@ void writeRenderResources(TextStream& ts, Node* parent)
             continue;
 
         String elementId = svgElement->getAttribute(HTMLNames::idAttr);
+        // FIXME: These names are lies!
         if (resource->isPaintServer()) {
             RefPtr<SVGPaintServer> paintServer = WTF::static_pointer_cast<SVGPaintServer>(resource);
             ts << "KRenderingPaintServer {id=\"" << elementId << "\" " << *paintServer << "}" << "\n";
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
index c4d832dd1a..35c3d5ccc7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
@@ -45,13 +45,15 @@ namespace WebCore {
     class RenderSVGInlineText;
     class RenderSVGRoot;
     class RenderSVGText; 
+    class RenderSVGImage;
 
 // functions used by the main RenderTreeAsText code
 void write(TextStream&, const RenderPath&, int indent = 0);
 void write(TextStream&, const RenderSVGContainer&, int indent = 0);
-void write(TextStream&, const RenderSVGInlineText&, int ident = 0);
+void write(TextStream&, const RenderSVGInlineText&, int indent = 0);
 void write(TextStream&, const RenderSVGRoot&, int indent = 0);
-void write(TextStream&, const RenderSVGText&, int ident = 0);
+void write(TextStream&, const RenderSVGText&, int indent = 0);
+void write(TextStream&, const RenderSVGImage&, int indent = 0);
 
 void writeRenderResources(TextStream&, Node* parent);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
index f7623baa79..d92f54cf86 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
@@ -30,6 +30,7 @@
 #include "Editor.h"
 #include "Frame.h"
 #include "GraphicsContext.h"
+#include "RenderBlock.h"
 #include "RenderSVGRoot.h"
 #include "SVGInlineFlowBox.h"
 #include "SVGInlineTextBox.h"
@@ -343,7 +344,7 @@ struct SVGRootInlineBoxPaintWalker {
         , m_chunkStarted(false)
         , m_paintInfo(paintInfo)
         , m_savedInfo(paintInfo)
-        , m_boundingBox(tx + rootBox->xPos(), ty + rootBox->yPos(), rootBox->width(), rootBox->height())
+        , m_boundingBox(tx + rootBox->x(), ty + rootBox->y(), rootBox->width(), rootBox->height())
         , m_filter(0)
         , m_rootFilter(rootFilter)
         , m_fillPaintServer(0)
@@ -395,21 +396,15 @@ struct SVGRootInlineBoxPaintWalker {
         InlineFlowBox* flowBox = box->parent();
 
         // Initialize text rendering
-        RenderObject* object = flowBox->object();
+        RenderObject* object = flowBox->renderer();
         ASSERT(object);
 
         m_savedInfo = m_paintInfo;
         m_paintInfo.context->save();
 
+        // FIXME: Why is this done here instead of in RenderSVGText?
         if (!flowBox->isRootInlineBox())
-            m_paintInfo.context->concatCTM(m_rootBox->object()->localTransform());
-
-        m_paintInfo.context->concatCTM(object->localTransform());
-
-        if (!flowBox->isRootInlineBox()) {
-            prepareToRenderSVGContent(object, m_paintInfo, m_boundingBox, m_filter, m_rootFilter);
-            m_paintInfo.rect = object->localTransform().inverse().mapRect(m_paintInfo.rect);
-        }
+            SVGRenderBase::prepareToRenderSVGContent(object, m_paintInfo, m_boundingBox, m_filter, m_rootFilter);
     }
 
     void chunkEndCallback(InlineBox* box)
@@ -419,7 +414,7 @@ struct SVGRootInlineBoxPaintWalker {
 
         InlineFlowBox* flowBox = box->parent();
 
-        RenderObject* object = flowBox->object();
+        RenderObject* object = flowBox->renderer();
         ASSERT(object);
 
         // Clean up last used paint server
@@ -428,7 +423,7 @@ struct SVGRootInlineBoxPaintWalker {
 
         // Finalize text rendering 
         if (!flowBox->isRootInlineBox()) {
-            finishRenderSVGContent(object, m_paintInfo, m_boundingBox, m_filter, m_savedInfo.context);
+            SVGRenderBase::finishRenderSVGContent(object, m_paintInfo, m_filter, m_savedInfo.context);
             m_filter = 0;
         }
 
@@ -442,7 +437,7 @@ struct SVGRootInlineBoxPaintWalker {
         InlineFlowBox* flowBox = box->parent();
 
         // Setup fill paint server
-        RenderObject* object = flowBox->object();
+        RenderObject* object = flowBox->renderer();
         ASSERT(object);
 
         ASSERT(!m_strokePaintServer);
@@ -463,7 +458,7 @@ struct SVGRootInlineBoxPaintWalker {
         InlineFlowBox* flowBox = box->parent();
 
         // Setup stroke paint server
-        RenderObject* object = flowBox->object();
+        RenderObject* object = flowBox->renderer();
         ASSERT(object);
 
         // If we're both stroked & filled, teardown fill paint server before stroking.
@@ -484,7 +479,7 @@ struct SVGRootInlineBoxPaintWalker {
     void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix& chunkCtm,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
-        RenderText* text = textBox->textObject();
+        RenderText* text = textBox->textRenderer();
         ASSERT(text);
 
         RenderStyle* styleToUse = text->style(textBox->isFirstLineStyle());
@@ -580,12 +575,10 @@ void SVGRootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     paintInfo.context->save();
 
     SVGResourceFilter* filter = 0;
-    FloatRect boundingBox(tx + xPos(), ty + yPos(), width(), height());
+    FloatRect boundingBox(tx + x(), ty + y(), width(), height());
 
     // Initialize text rendering
-    paintInfo.context->concatCTM(object()->localTransform());
-    prepareToRenderSVGContent(object(), paintInfo, boundingBox, filter);
-    paintInfo.context->concatCTM(object()->localTransform().inverse());
+    SVGRenderBase::prepareToRenderSVGContent(renderer(), paintInfo, boundingBox, filter);
  
     // Render text, chunk-by-chunk
     SVGRootInlineBoxPaintWalker walkerCallback(this, filter, paintInfo, tx, ty);
@@ -599,7 +592,7 @@ void SVGRootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     walkTextChunks(&walker);
 
     // Finalize text rendering 
-    finishRenderSVGContent(object(), paintInfo, boundingBox, filter, savedInfo.context);
+    SVGRenderBase::finishRenderSVGContent(renderer(), paintInfo, filter, savedInfo.context);
     paintInfo.context->restore();
 }
 
@@ -611,10 +604,10 @@ int SVGRootInlineBox::placeBoxesHorizontally(int, int& leftPosition, int& rightP
     return 0;
 }
 
-void SVGRootInlineBox::verticallyAlignBoxes(int& heightOfBlock)
+int SVGRootInlineBox::verticallyAlignBoxes(int)
 {
     // height is set by layoutInlineBoxes.
-    heightOfBlock = height();
+    return height();
 }
 
 float cummulatedWidthOfInlineBoxCharacterRange(SVGInlineBoxCharacterRange& range)
@@ -624,7 +617,7 @@ float cummulatedWidthOfInlineBoxCharacterRange(SVGInlineBoxCharacterRange& range
     ASSERT(range.box->isInlineTextBox());
 
     InlineTextBox* textBox = static_cast<InlineTextBox*>(range.box);
-    RenderText* text = textBox->textObject();
+    RenderText* text = textBox->textRenderer();
     RenderStyle* style = text->style();
 
     return style->font().floatWidth(svgTextRunForInlineTextBox(text->characters() + textBox->start() + range.startOffset, range.endOffset - range.startOffset, style, textBox, 0));
@@ -637,7 +630,7 @@ float cummulatedHeightOfInlineBoxCharacterRange(SVGInlineBoxCharacterRange& rang
     ASSERT(range.box->isInlineTextBox());
 
     InlineTextBox* textBox = static_cast<InlineTextBox*>(range.box);
-    RenderText* text = textBox->textObject();
+    RenderText* text = textBox->textRenderer();
     const Font& font = text->style()->font();
 
     return (range.endOffset - range.startOffset) * (font.ascent() + font.descent());
@@ -651,7 +644,7 @@ TextRun svgTextRunForInlineTextBox(const UChar* c, int len, RenderStyle* style,
     TextRun run(c, len, false, static_cast<int>(xPos), textBox->toAdd(), textBox->direction() == RTL, textBox->m_dirOverride || style->visuallyOrdered());
 
 #if ENABLE(SVG_FONTS)
-    run.setReferencingRenderObject(textBox->textObject()->parent());
+    run.setReferencingRenderObject(textBox->textRenderer()->parent());
 #endif
 
     // We handle letter & word spacing ourselves
@@ -671,7 +664,7 @@ static float cummulatedWidthOrHeightOfTextChunk(SVGTextChunk& chunk, bool calcWi
         SVGInlineBoxCharacterRange& range = *it;
 
         SVGInlineTextBox* box = static_cast<SVGInlineTextBox*>(range.box);
-        RenderStyle* style = box->object()->style();
+        RenderStyle* style = box->renderer()->style();
 
         for (int i = range.startOffset; i < range.endOffset; ++i) {
             ASSERT(charIt <= chunk.end);
@@ -790,13 +783,12 @@ static void applyTextAnchorToTextChunk(SVGTextChunk& chunk)
 
         InlineBox* curBox = range.box;
         ASSERT(curBox->isInlineTextBox());
-        ASSERT(curBox->parent() && (curBox->parent()->isRootInlineBox() || curBox->parent()->isInlineFlowBox()));
 
         // Move target box
         if (chunk.isVerticalText)
-            curBox->setYPos(curBox->yPos() + static_cast<int>(shift));
+            curBox->setY(curBox->y() + static_cast<int>(shift));
         else
-            curBox->setXPos(curBox->xPos() + static_cast<int>(shift));
+            curBox->setX(curBox->x() + static_cast<int>(shift));
     }
 }
 
@@ -819,9 +811,9 @@ static float calculateTextLengthCorrectionForTextChunk(SVGTextChunk& chunk, ELen
 
     if (lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS) {
         if (chunk.isVerticalText)
-            chunk.ctm.scale(1.0f, chunk.textLength / computedLength);
+            chunk.ctm.scaleNonUniform(1.0f, chunk.textLength / computedLength);
         else
-            chunk.ctm.scale(chunk.textLength / computedLength, 1.0f);
+            chunk.ctm.scaleNonUniform(chunk.textLength / computedLength, 1.0f);
 
         return 0.0f;
     }
@@ -887,7 +879,7 @@ void SVGRootInlineBox::computePerCharacterLayoutInformation()
     // Finally the top left position of our box is known.
     // Propogate this knownledge to our RenderSVGText parent.
     FloatPoint topLeft = topLeftPositionOfCharacterRange(m_svgChars);
-    object()->setPos((int) floorf(topLeft.x()), (int) floorf(topLeft.y()));
+    block()->setLocation((int) floorf(topLeft.x()), (int) floorf(topLeft.y()));
 
     // Layout all InlineText/Flow boxes
     // BEWARE: This requires the root top/left position to be set correctly before!
@@ -897,9 +889,9 @@ void SVGRootInlineBox::computePerCharacterLayoutInformation()
 void SVGRootInlineBox::buildLayoutInformation(InlineFlowBox* start, SVGCharacterLayoutInfo& info)
 {
     if (start->isRootInlineBox()) {
-        ASSERT(start->object()->element()->hasTagName(SVGNames::textTag));
+        ASSERT(start->renderer()->node()->hasTagName(SVGNames::textTag));
 
-        SVGTextPositioningElement* positioningElement = static_cast<SVGTextPositioningElement*>(start->object()->element());
+        SVGTextPositioningElement* positioningElement = static_cast<SVGTextPositioningElement*>(start->renderer()->node());
         ASSERT(positioningElement);
         ASSERT(positioningElement->parentNode());
 
@@ -909,20 +901,20 @@ void SVGRootInlineBox::buildLayoutInformation(InlineFlowBox* start, SVGCharacter
     LastGlyphInfo lastGlyph;
     
     for (InlineBox* curr = start->firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->object()->isText())
+        if (curr->renderer()->isText())
             buildLayoutInformationForTextBox(info, static_cast<InlineTextBox*>(curr), lastGlyph);
         else {
             ASSERT(curr->isInlineFlowBox());
             InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(curr);
 
-            if (!flowBox->object()->element())
+            if (!flowBox->renderer()->node())
                 continue; // Skip generated content.
 
-            bool isAnchor = flowBox->object()->element()->hasTagName(SVGNames::aTag);
-            bool isTextPath = flowBox->object()->element()->hasTagName(SVGNames::textPathTag);
+            bool isAnchor = flowBox->renderer()->node()->hasTagName(SVGNames::aTag);
+            bool isTextPath = flowBox->renderer()->node()->hasTagName(SVGNames::textPathTag);
 
             if (!isTextPath && !isAnchor) {
-                SVGTextPositioningElement* positioningElement = static_cast<SVGTextPositioningElement*>(flowBox->object()->element());
+                SVGTextPositioningElement* positioningElement = static_cast<SVGTextPositioningElement*>(flowBox->renderer()->node());
                 ASSERT(positioningElement);
                 ASSERT(positioningElement->parentNode());
 
@@ -932,13 +924,13 @@ void SVGRootInlineBox::buildLayoutInformation(InlineFlowBox* start, SVGCharacter
 
                 // Handle text-anchor/textLength on path, which is special.
                 SVGTextContentElement* textContent = 0;
-                Node* node = flowBox->object()->element();
+                Node* node = flowBox->renderer()->node();
                 if (node && node->isSVGElement())
                     textContent = static_cast<SVGTextContentElement*>(node);
                 ASSERT(textContent);
 
                 ELengthAdjust lengthAdjust = (ELengthAdjust) textContent->lengthAdjust();
-                ETextAnchor anchor = flowBox->object()->style()->svgStyle()->textAnchor();
+                ETextAnchor anchor = flowBox->renderer()->style()->svgStyle()->textAnchor();
                 float textAnchorStartOffset = 0.0f;
 
                 // Initialize sub-layout. We need to create text chunks from the textPath
@@ -1007,10 +999,8 @@ void SVGRootInlineBox::layoutInlineBoxes()
 void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::iterator& it, int& lowX, int& highX, int& lowY, int& highY)
 {
     for (InlineBox* curr = start->firstChild(); curr; curr = curr->nextOnLine()) {
-        RenderStyle* style = curr->object()->style();    
-        const Font& font = style->font();
-
-        if (curr->object()->isText()) {
+        RenderStyle* style = curr->renderer()->style();    
+        if (curr->renderer()->isText()) {
             SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(curr);
             unsigned length = textBox->len();
 
@@ -1038,12 +1028,11 @@ void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::
             int minY = enclosedStringRect.y();
             int maxY = minY + enclosedStringRect.height();
 
-            curr->setXPos(minX - object()->xPos());
+            curr->setX(minX - block()->x());
             curr->setWidth(enclosedStringRect.width());
 
-            curr->setYPos(minY - object()->yPos());
-            curr->setBaseline(font.ascent());
-            curr->setHeight(enclosedStringRect.height());
+            curr->setY(minY - block()->y());
+            textBox->setHeight(enclosedStringRect.height());
 
             if (minX < lowX)
                 lowX = minX;
@@ -1066,17 +1055,16 @@ void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::
 
             InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(curr);
             
-            if (!flowBox->object()->element())
+            if (!flowBox->renderer()->node())
                 continue; // Skip generated content.
     
             layoutInlineBoxes(flowBox, it, minX, maxX, minY, maxY);
 
-            curr->setXPos(minX - object()->xPos());
+            curr->setX(minX - block()->x());
             curr->setWidth(maxX - minX);
 
-            curr->setYPos(minY - object()->yPos());
-            curr->setBaseline(font.ascent());
-            curr->setHeight(maxY - minY);
+            curr->setY(minY - block()->y());
+            static_cast<SVGInlineFlowBox*>(curr)->setHeight(maxY - minY);
 
             if (minX < lowX)
                 lowX = minX;
@@ -1092,15 +1080,15 @@ void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::
         }
     }
 
-    if (start->isRootInlineBox()) {
-        int top = lowY - object()->yPos();
-        int bottom = highY - object()->yPos();
+    if (start->isSVGRootInlineBox()) {
+        int top = lowY - block()->y();
+        int bottom = highY - block()->y();
 
-        start->setXPos(lowX - object()->xPos());
-        start->setYPos(top);
+        start->setX(lowX - block()->x());
+        start->setY(top);
 
         start->setWidth(highX - lowX);
-        start->setHeight(highY - lowY);
+        static_cast<SVGRootInlineBox*>(start)->setHeight(highY - lowY);
 
         start->setVerticalOverflowPositions(top, bottom);
         start->setVerticalSelectionPositions(top, bottom);
@@ -1109,7 +1097,7 @@ void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::
 
 void SVGRootInlineBox::buildLayoutInformationForTextBox(SVGCharacterLayoutInfo& info, InlineTextBox* textBox, LastGlyphInfo& lastGlyph)
 {
-    RenderText* text = textBox->textObject();
+    RenderText* text = textBox->textRenderer();
     ASSERT(text);
 
     RenderStyle* style = text->style(textBox->isFirstLineStyle());
@@ -1140,11 +1128,11 @@ void SVGRootInlineBox::buildLayoutInformationForTextBox(SVGCharacterLayoutInfo&
         if (textBox->direction() == RTL) {
             glyphWidth = svgTextBox->calculateGlyphWidth(style, textBox->end() - i, extraCharsAvailable, charsConsumed, glyphName);
             glyphHeight = svgTextBox->calculateGlyphHeight(style, textBox->end() - i, extraCharsAvailable);
-            unicodeStr = String(textBox->textObject()->text()->characters() + textBox->end() - i, charsConsumed);
+            unicodeStr = String(textBox->textRenderer()->text()->characters() + textBox->end() - i, charsConsumed);
         } else {
             glyphWidth = svgTextBox->calculateGlyphWidth(style, textBox->start() + i, extraCharsAvailable, charsConsumed, glyphName);
             glyphHeight = svgTextBox->calculateGlyphHeight(style, textBox->start() + i, extraCharsAvailable);
-            unicodeStr = String(textBox->textObject()->text()->characters() + textBox->start() + i, charsConsumed);
+            unicodeStr = String(textBox->textRenderer()->text()->characters() + textBox->start() + i, charsConsumed);
         }
 
         bool assignedX = false;
@@ -1194,7 +1182,7 @@ void SVGRootInlineBox::buildLayoutInformationForTextBox(SVGCharacterLayoutInfo&
         }
 
         // Take letter & word spacing and kerning into account
-        float spacing = font.letterSpacing() + calculateKerning(textBox->object()->element()->renderer());
+        float spacing = font.letterSpacing() + calculateKerning(textBox->renderer()->node()->renderer());
 
         const UChar* currentCharacter = text->characters() + (textBox->direction() == RTL ? textBox->end() - i : textBox->start() + i);
         const UChar* lastCharacter = 0;
@@ -1369,7 +1357,7 @@ void SVGRootInlineBox::buildTextChunks(Vector<SVGChar>& svgChars, InlineFlowBox*
 #endif
 
     for (InlineBox* curr = start->firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->object()->isText()) {
+        if (curr->renderer()->isText()) {
             InlineTextBox* textBox = static_cast<InlineTextBox*>(curr);
 
             unsigned length = textBox->len();
@@ -1381,12 +1369,12 @@ void SVGRootInlineBox::buildTextChunks(Vector<SVGChar>& svgChars, InlineFlowBox*
                             textBox, length, textBox->start(), textBox->end(), (int) info.handlingTextPath);
 #endif
 
-            RenderText* text = textBox->textObject();
+            RenderText* text = textBox->textRenderer();
             ASSERT(text);
-            ASSERT(text->element());
+            ASSERT(text->node());
 
             SVGTextContentElement* textContent = 0;
-            Node* node = text->element()->parent();
+            Node* node = text->node()->parent();
             while (node && node->isSVGElement() && !textContent) {
                 if (static_cast<SVGElement*>(node)->isTextContent())
                     textContent = static_cast<SVGTextContentElement*>(node);
@@ -1524,10 +1512,10 @@ void SVGRootInlineBox::buildTextChunks(Vector<SVGChar>& svgChars, InlineFlowBox*
             ASSERT(curr->isInlineFlowBox());
             InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(curr);
 
-            if (!flowBox->object()->element())
+            if (!flowBox->renderer()->node())
                 continue; // Skip generated content.
 
-            bool isTextPath = flowBox->object()->element()->hasTagName(SVGNames::textPathTag);
+            bool isTextPath = flowBox->renderer()->node()->hasTagName(SVGNames::textPathTag);
 
 #if DEBUG_CHUNK_BUILDING > 1
             fprintf(stderr, " -> Handle inline flow box (%p), isTextPath=%i\n", flowBox, (int) isTextPath);
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h
index 800664b84d..735f7559cc 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.h
@@ -47,15 +47,19 @@ class SVGRootInlineBox : public RootInlineBox {
 public:
     SVGRootInlineBox(RenderObject* obj)
         : RootInlineBox(obj)
+        , m_height(0)
     {
     }
 
     virtual bool isSVGRootInlineBox() { return true; }
 
+    virtual int svgBoxHeight() const { return m_height; }
+    void setHeight(int h) { m_height = h; }
+    
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
 
     virtual int placeBoxesHorizontally(int x, int& leftPosition, int& rightPosition, bool& needsWordSpacing);
-    virtual void verticallyAlignBoxes(int& heightOfBlock);
+    virtual int verticallyAlignBoxes(int heightOfBlock);
 
     virtual void computePerCharacterLayoutInformation();
 
@@ -80,6 +84,7 @@ private:
     SVGTextDecorationInfo retrievePaintServersForTextDecoration(RenderObject* start);
 
 private:
+    int m_height;
     Vector<SVGChar> m_svgChars;
     Vector<SVGTextChunk> m_svgTextChunks;
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/ScrollBehavior.cpp b/src/3rdparty/webkit/WebCore/rendering/ScrollBehavior.cpp
new file mode 100644
index 0000000000..232ea199e7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/ScrollBehavior.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Portions are Copyright (C) 1998 Netscape Communications Corporation.
+ *
+ * Other contributors:
+ *   Robert O'Callahan <roc+@cs.cmu.edu>
+ *   David Baron <dbaron@fas.harvard.edu>
+ *   Christian Biesinger <cbiesinger@web.de>
+ *   Randall Jesup <rjesup@wgate.com>
+ *   Roland Mainz <roland.mainz@informatik.med.uni-giessen.de>
+ *   Josh Soref <timeless@mac.com>
+ *   Boris Zbarsky <bzbarsky@mit.edu>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Alternatively, the contents of this file may be used under the terms
+ * of either the Mozilla Public License Version 1.1, found at
+ * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
+ * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
+ * (the "GPL"), in which case the provisions of the MPL or the GPL are
+ * applicable instead of those above.  If you wish to allow use of your
+ * version of this file only under the terms of one of those two
+ * licenses (the MPL or the GPL) and not to allow others to use your
+ * version of this file under the LGPL, indicate your decision by
+ * deletingthe provisions above and replace them with the notice and
+ * other provisions required by the MPL or the GPL, as the case may be.
+ * If you do not delete the provisions above, a recipient may use your
+ * version of this file under any of the LGPL, the MPL or the GPL.
+ */
+
+#include "config.h"
+#include "ScrollBehavior.h"
+
+namespace WebCore {
+
+const ScrollAlignment ScrollAlignment::alignCenterIfNeeded = { noScroll, alignCenter, alignToClosestEdge };
+const ScrollAlignment ScrollAlignment::alignToEdgeIfNeeded = { noScroll, alignToClosestEdge, alignToClosestEdge };
+const ScrollAlignment ScrollAlignment::alignCenterAlways = { alignCenter, alignCenter, alignCenter };
+const ScrollAlignment ScrollAlignment::alignTopAlways = { alignTop, alignTop, alignTop };
+const ScrollAlignment ScrollAlignment::alignBottomAlways = { alignBottom, alignBottom, alignBottom };
+
+}; // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/ScrollBehavior.h b/src/3rdparty/webkit/WebCore/rendering/ScrollBehavior.h
new file mode 100644
index 0000000000..390c68a5f6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/ScrollBehavior.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2003, 2009 Apple Inc.  All rights reserved.
+ *
+ * Portions are Copyright (C) 1998 Netscape Communications Corporation.
+ *
+ * Other contributors:
+ *   Robert O'Callahan <roc+@cs.cmu.edu>
+ *   David Baron <dbaron@fas.harvard.edu>
+ *   Christian Biesinger <cbiesinger@web.de>
+ *   Randall Jesup <rjesup@wgate.com>
+ *   Roland Mainz <roland.mainz@informatik.med.uni-giessen.de>
+ *   Josh Soref <timeless@mac.com>
+ *   Boris Zbarsky <bzbarsky@mit.edu>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Alternatively, the contents of this file may be used under the terms
+ * of either the Mozilla Public License Version 1.1, found at
+ * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
+ * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
+ * (the "GPL"), in which case the provisions of the MPL or the GPL are
+ * applicable instead of those above.  If you wish to allow use of your
+ * version of this file only under the terms of one of those two
+ * licenses (the MPL or the GPL) and not to allow others to use your
+ * version of this file under the LGPL, indicate your decision by
+ * deletingthe provisions above and replace them with the notice and
+ * other provisions required by the MPL or the GPL, as the case may be.
+ * If you do not delete the provisions above, a recipient may use your
+ * version of this file under any of the LGPL, the MPL or the GPL.
+ */
+
+#ifndef ScrollBehavior_h
+#define ScrollBehavior_h
+
+namespace WebCore {
+
+enum ScrollBehavior {
+    noScroll,
+    alignCenter,
+    alignTop,
+    alignBottom, 
+    alignLeft,
+    alignRight,
+    alignToClosestEdge
+};
+
+struct ScrollAlignment {
+    static ScrollBehavior getVisibleBehavior(const ScrollAlignment& s) { return s.m_rectVisible; }
+    static ScrollBehavior getPartialBehavior(const ScrollAlignment& s) { return s.m_rectPartial; }
+    static ScrollBehavior getHiddenBehavior(const ScrollAlignment& s) { return s.m_rectHidden; }
+
+    static const ScrollAlignment alignCenterIfNeeded;
+    static const ScrollAlignment alignToEdgeIfNeeded;
+    static const ScrollAlignment alignCenterAlways;
+    static const ScrollAlignment alignTopAlways;
+    static const ScrollAlignment alignBottomAlways;
+
+    ScrollBehavior m_rectVisible;
+    ScrollBehavior m_rectHidden;
+    ScrollBehavior m_rectPartial;
+};
+
+
+}; // namespace WebCore
+
+#endif // ScrollBehavior_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp b/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
index 452333cbf7..cd067de70e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
@@ -35,15 +35,19 @@
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
 #include "MouseEvent.h"
+#include "RenderLayer.h"
 #include "RenderTextControlSingleLine.h"
 
 namespace WebCore {
 
 class RenderTextControlInnerBlock : public RenderBlock {
 public:
-    RenderTextControlInnerBlock(Node* node) : RenderBlock(node) { }
+    RenderTextControlInnerBlock(Node* node, bool isMultiLine) : RenderBlock(node), m_multiLine(isMultiLine) { }
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
+    private:
+        bool m_multiLine;
 };
 
 bool RenderTextControlInnerBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
@@ -57,6 +61,22 @@ bool RenderTextControlInnerBlock::nodeAtPoint(const HitTestRequest& request, Hit
     return RenderBlock::nodeAtPoint(request, result, x, y, tx, ty, placeholderIsVisible ? HitTestBlockBackground : hitTestAction);
 }
 
+VisiblePosition RenderTextControlInnerBlock::positionForPoint(const IntPoint& point)
+{
+    int contentsX = point.x();
+    int contentsY = point.y();
+
+    // Multiline text controls have the scroll on shadowAncestorNode, so we need to take that
+    // into account here.
+    if (m_multiLine) {
+        RenderTextControl* renderer = static_cast<RenderTextControl*>(node()->shadowAncestorNode()->renderer());
+        if (renderer->hasOverflowClip())
+            renderer->layer()->addScrolledContentOffset(contentsX, contentsY);
+    }
+
+    return RenderBlock::positionForPoint(IntPoint(contentsX, contentsY));
+}
+
 TextControlInnerElement::TextControlInnerElement(Document* doc, Node* shadowParent)
     : HTMLDivElement(HTMLNames::divTag, doc)
     , m_shadowParent(shadowParent)
@@ -98,14 +118,15 @@ void TextControlInnerTextElement::defaultEventHandler(Event* evt)
     // FIXME: In the future, we should add a way to have default event listeners.  Then we would add one to the text field's inner div, and we wouldn't need this subclass.
     Node* shadowAncestor = shadowAncestorNode();
     if (shadowAncestor && shadowAncestor->renderer()) {
-        ASSERT(shadowAncestor->renderer()->isTextField() || shadowAncestor->renderer()->isTextArea());
-        if (evt->isBeforeTextInsertedEvent())
+        ASSERT(shadowAncestor->renderer()->isTextControl());
+        if (evt->isBeforeTextInsertedEvent()) {
             if (shadowAncestor->renderer()->isTextField())
                 static_cast<HTMLInputElement*>(shadowAncestor)->defaultEventHandler(evt);
             else
                 static_cast<HTMLTextAreaElement*>(shadowAncestor)->defaultEventHandler(evt);
+        }
         if (evt->type() == eventNames().webkitEditableContentChangedEvent)
-            static_cast<RenderTextControl*>(shadowAncestor->renderer())->subtreeHasChanged();
+            toRenderTextControl(shadowAncestor->renderer())->subtreeHasChanged();
     }
     if (!evt->defaultHandled())
         HTMLDivElement::defaultEventHandler(evt);
@@ -113,7 +134,13 @@ void TextControlInnerTextElement::defaultEventHandler(Event* evt)
 
 RenderObject* TextControlInnerTextElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderTextControlInnerBlock(this);
+    bool multiLine = false;
+    Node* shadowAncestor = shadowAncestorNode();
+    if (shadowAncestor && shadowAncestor->renderer()) {
+        ASSERT(shadowAncestor->renderer()->isTextField() || shadowAncestor->renderer()->isTextArea());
+        multiLine = shadowAncestor->renderer()->isTextArea();
+    }
+    return new (arena) RenderTextControlInnerBlock(this, multiLine);
 }
 
 SearchFieldResultsButtonElement::SearchFieldResultsButtonElement(Document* doc)
diff --git a/src/3rdparty/webkit/WebCore/rendering/TransformState.cpp b/src/3rdparty/webkit/WebCore/rendering/TransformState.cpp
new file mode 100644
index 0000000000..a9e68f4b1a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/TransformState.cpp
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TransformState.h"
+
+namespace WebCore {
+
+void TransformState::move(int x, int y, TransformAccumulation accumulate)
+{
+    if (m_accumulatingTransform && m_accumulatedTransform) {
+        // If we're accumulating into an existing transform, apply the translation.
+        if (m_direction == ApplyTransformDirection)
+            m_accumulatedTransform->translateRight(x, y);
+        else
+            m_accumulatedTransform->translate(-x, -y);  // We're unapplying, so negate
+        
+        // Then flatten if necessary.
+        if (accumulate == FlattenTransform)
+            flatten();
+    } else {
+        // Just move the point and, optionally, the quad.
+        m_lastPlanarPoint.move(x, y);
+        if (m_mapQuad)
+            m_lastPlanarQuad.move(x, y);
+    }
+    m_accumulatingTransform = accumulate == AccumulateTransform;
+}
+
+void TransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate)
+{
+    // If we have an accumulated transform from last time, multiply in this transform
+    if (m_accumulatedTransform) {
+        if (m_direction == ApplyTransformDirection)
+            m_accumulatedTransform->multiply(transformFromContainer);
+        else
+            m_accumulatedTransform->multLeft(transformFromContainer);
+    } else if (accumulate == AccumulateTransform) {
+        // Make one if we started to accumulate
+        m_accumulatedTransform.set(new TransformationMatrix(transformFromContainer));
+    }
+    
+    if (accumulate == FlattenTransform) {
+        const TransformationMatrix* finalTransform = m_accumulatedTransform ? m_accumulatedTransform.get() : &transformFromContainer;
+        flattenWithTransform(*finalTransform);
+    }
+    m_accumulatingTransform = accumulate == AccumulateTransform;
+}
+
+void TransformState::flatten()
+{
+    if (!m_accumulatedTransform) {
+        m_accumulatingTransform = false;
+        return;
+    }
+    
+    flattenWithTransform(*m_accumulatedTransform);
+}
+
+FloatPoint TransformState::mappedPoint() const
+{
+    if (!m_accumulatedTransform)
+        return m_lastPlanarPoint;
+
+    if (m_direction == ApplyTransformDirection)
+        return m_accumulatedTransform->mapPoint(m_lastPlanarPoint);
+
+    return m_accumulatedTransform->inverse().projectPoint(m_lastPlanarPoint);
+}
+
+FloatQuad TransformState::mappedQuad() const
+{
+    if (!m_accumulatedTransform)
+        return m_lastPlanarQuad;
+
+    if (m_direction == ApplyTransformDirection)
+        return m_accumulatedTransform->mapQuad(m_lastPlanarQuad);
+
+    return m_accumulatedTransform->inverse().projectQuad(m_lastPlanarQuad);
+}
+
+void TransformState::flattenWithTransform(const TransformationMatrix& t)
+{
+    if (m_direction == ApplyTransformDirection) {
+        m_lastPlanarPoint = t.mapPoint(m_lastPlanarPoint);
+        if (m_mapQuad)
+            m_lastPlanarQuad = t.mapQuad(m_lastPlanarQuad);
+    } else {
+        TransformationMatrix inverseTransform = t.inverse();
+        m_lastPlanarPoint = inverseTransform.projectPoint(m_lastPlanarPoint);
+        if (m_mapQuad)
+            m_lastPlanarQuad = inverseTransform.projectQuad(m_lastPlanarQuad);
+    }
+
+    // We could throw away m_accumulatedTransform if we wanted to here, but that
+    // would cause thrash when traversing hierarachies with alternating
+    // preserve-3d and flat elements.
+    if (m_accumulatedTransform)
+        m_accumulatedTransform->makeIdentity();
+    m_accumulatingTransform = false;
+}
+
+// HitTestingTransformState methods
+void HitTestingTransformState::translate(int x, int y, TransformAccumulation accumulate)
+{
+    m_accumulatedTransform.translate(x, y);    
+    if (accumulate == FlattenTransform)
+        flattenWithTransform(m_accumulatedTransform);
+
+    m_accumulatingTransform = accumulate == AccumulateTransform;
+}
+
+void HitTestingTransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate)
+{
+    m_accumulatedTransform.multLeft(transformFromContainer);    
+    if (accumulate == FlattenTransform)
+        flattenWithTransform(m_accumulatedTransform);
+
+    m_accumulatingTransform = accumulate == AccumulateTransform;
+}
+
+void HitTestingTransformState::flatten()
+{
+    flattenWithTransform(m_accumulatedTransform);
+}
+
+void HitTestingTransformState::flattenWithTransform(const TransformationMatrix& t)
+{
+    TransformationMatrix inverseTransform = t.inverse();
+    m_lastPlanarPoint = inverseTransform.projectPoint(m_lastPlanarPoint);
+    m_lastPlanarQuad = inverseTransform.projectQuad(m_lastPlanarQuad);
+
+    m_accumulatedTransform.makeIdentity();
+    m_accumulatingTransform = false;
+}
+
+FloatPoint HitTestingTransformState::mappedPoint() const
+{
+    return m_accumulatedTransform.inverse().projectPoint(m_lastPlanarPoint);
+}
+
+FloatQuad HitTestingTransformState::mappedQuad() const
+{
+    return m_accumulatedTransform.inverse().projectQuad(m_lastPlanarQuad);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/TransformState.h b/src/3rdparty/webkit/WebCore/rendering/TransformState.h
new file mode 100644
index 0000000000..92275f9fef
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/TransformState.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TransformState_h
+#define TransformState_h
+
+#include "FloatPoint.h"
+#include "FloatQuad.h"
+#include "IntSize.h"
+#include "TransformationMatrix.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class TransformState : Noncopyable {
+public:
+    enum TransformDirection { ApplyTransformDirection, UnapplyInverseTransformDirection };
+    enum TransformAccumulation { FlattenTransform, AccumulateTransform };
+
+    // If quad is non-null, it will be mapped
+    TransformState(TransformDirection mappingDirection, const FloatPoint& p, const FloatQuad* quad = 0)
+        : m_lastPlanarPoint(p)
+        , m_accumulatingTransform(false)
+        , m_mapQuad(quad != 0)
+        , m_direction(mappingDirection)
+    {
+        if (quad)
+            m_lastPlanarQuad = *quad;
+    }
+    
+    void move(const IntSize& s, TransformAccumulation accumulate = FlattenTransform)
+    {
+        move(s.width(), s.height(), accumulate);
+    }
+    
+    void move(int x, int y, TransformAccumulation = FlattenTransform);
+    void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation = FlattenTransform);
+    void flatten();
+
+    // Return the coords of the point or quad in the last flattened layer
+    FloatPoint lastPlanarPoint() const { return m_lastPlanarPoint; }
+    FloatQuad lastPlanarQuad() const { return m_lastPlanarQuad; }
+
+    // Return the point or quad mapped through the current transform
+    FloatPoint mappedPoint() const;
+    FloatQuad mappedQuad() const;
+
+private:
+    void flattenWithTransform(const TransformationMatrix&);
+    
+    FloatPoint m_lastPlanarPoint;
+    FloatQuad m_lastPlanarQuad;
+
+    // We only allocate the transform if we need to
+    OwnPtr<TransformationMatrix> m_accumulatedTransform;
+    bool m_accumulatingTransform;
+    bool m_mapQuad;
+    TransformDirection m_direction;
+};
+
+class HitTestingTransformState : public RefCounted<HitTestingTransformState> {
+public:
+    static PassRefPtr<HitTestingTransformState> create(const FloatPoint& p, const FloatQuad& quad)
+    {
+        return adoptRef(new HitTestingTransformState(p, quad));
+    }
+
+    static PassRefPtr<HitTestingTransformState> create(const HitTestingTransformState& other)
+    {
+        return adoptRef(new HitTestingTransformState(other));
+    }
+
+    enum TransformAccumulation { FlattenTransform, AccumulateTransform };
+    void translate(int x, int y, TransformAccumulation);
+    void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation);
+
+    FloatPoint mappedPoint() const;
+    FloatQuad mappedQuad() const;
+    void flatten();
+
+    FloatPoint m_lastPlanarPoint;
+    FloatQuad m_lastPlanarQuad;
+    TransformationMatrix m_accumulatedTransform;
+    bool m_accumulatingTransform;
+
+private:
+    HitTestingTransformState(const FloatPoint& p, const FloatQuad& quad)
+        : m_lastPlanarPoint(p)
+        , m_lastPlanarQuad(quad)
+        , m_accumulatingTransform(false)
+    {
+    }
+    
+    HitTestingTransformState(const HitTestingTransformState& other)
+        : RefCounted<HitTestingTransformState>()
+        , m_lastPlanarPoint(other.m_lastPlanarPoint)
+        , m_lastPlanarQuad(other.m_lastPlanarQuad)
+        , m_accumulatedTransform(other.m_accumulatedTransform)
+        , m_accumulatingTransform(other.m_accumulatingTransform)
+    {
+    }
+    
+    void flattenWithTransform(const TransformationMatrix&);
+};
+
+} // namespace WebCore
+
+#endif // TransformState_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/bidi.cpp b/src/3rdparty/webkit/WebCore/rendering/bidi.cpp
index 6ff2d59f7f..3659912996 100644
--- a/src/3rdparty/webkit/WebCore/rendering/bidi.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/bidi.cpp
@@ -29,6 +29,7 @@
 #include "InlineTextBox.h"
 #include "Logging.h"
 #include "RenderArena.h"
+#include "RenderInline.h"
 #include "RenderLayer.h"
 #include "RenderListMarker.h"
 #include "RenderView.h"
@@ -88,7 +89,7 @@ static bool betweenMidpoints;
 static bool isLineEmpty = true;
 static bool previousLineBrokeCleanly = true;
 
-static int getBorderPaddingMargin(RenderObject* child, bool endOfInline)
+static int getBorderPaddingMargin(RenderBoxModelObject* child, bool endOfInline)
 {
     bool leftSide = (child->style()->direction() == LTR) ? !endOfInline : endOfInline;
     if (leftSide)
@@ -102,10 +103,10 @@ static int inlineWidth(RenderObject* child, bool start = true, bool end = true)
     int extraWidth = 0;
     RenderObject* parent = child->parent();
     while (parent->isInline() && !parent->isInlineBlockOrInlineTable() && lineDepth++ < cMaxLineDepth) {
-        if (start && parent->firstChild() == child)
-            extraWidth += getBorderPaddingMargin(parent, false);
-        if (end && parent->lastChild() == child)
-            extraWidth += getBorderPaddingMargin(parent, true);
+        if (start && !child->previousSibling())
+            extraWidth += getBorderPaddingMargin(toRenderBoxModelObject(parent), false);
+        if (end && !child->nextSibling())
+            extraWidth += getBorderPaddingMargin(toRenderBoxModelObject(parent), true);
         child = parent;
         parent = child->parent();
     }
@@ -172,9 +173,9 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
 
     while (current) {
         next = 0;
-        if (!oldEndOfInline && !current->isFloating() && !current->isReplaced() && !current->isPositioned()) {
+        if (!oldEndOfInline && !current->isFloating() && !current->isReplaced() && !current->isPositioned() && !current->isText()) {
             next = current->firstChild();
-            if (next && resolver && next->isInlineFlow()) {
+            if (next && resolver && next->isRenderInline()) {
                 EUnicodeBidi ub = next->style()->unicodeBidi();
                 if (ub != UBNormal) {
                     TextDirection dir = next->style()->direction();
@@ -187,19 +188,19 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
         }
 
         if (!next) {
-            if (!skipInlines && !oldEndOfInline && current->isInlineFlow()) {
+            if (!skipInlines && !oldEndOfInline && current->isRenderInline()) {
                 next = current;
                 endOfInline = true;
                 break;
             }
 
             while (current && current != block) {
-                if (resolver && current->isInlineFlow() && current->style()->unicodeBidi() != UBNormal)
+                if (resolver && current->isRenderInline() && current->style()->unicodeBidi() != UBNormal)
                     resolver->embed(PopDirectionalFormat);
 
                 next = current->nextSibling();
                 if (next) {
-                    if (resolver && next->isInlineFlow()) {
+                    if (resolver && next->isRenderInline()) {
                         EUnicodeBidi ub = next->style()->unicodeBidi();
                         if (ub != UBNormal) {
                             TextDirection dir = next->style()->direction();
@@ -213,7 +214,7 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
                 }
                 
                 current = current->parent();
-                if (!skipInlines && current && current != block && current->isInlineFlow()) {
+                if (!skipInlines && current && current != block && current->isRenderInline()) {
                     next = current;
                     endOfInline = true;
                     break;
@@ -226,7 +227,7 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
 
         if (next->isText() || next->isFloating() || next->isReplaced() || next->isPositioned()
             || ((!skipInlines || !next->firstChild()) // Always return EMPTY inlines.
-                && next->isInlineFlow()))
+                && next->isRenderInline()))
             break;
         current = next;
     }
@@ -243,7 +244,7 @@ static RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* resolver,
         return 0;
     
     RenderObject* o = block->firstChild();
-    if (o->isInlineFlow()) {
+    if (o->isRenderInline()) {
         if (resolver) {
             EUnicodeBidi ub = o->style()->unicodeBidi();
             if (ub != UBNormal) {
@@ -278,7 +279,7 @@ inline void InlineIterator::increment(InlineBidiResolver* resolver)
         return;
     if (obj->isText()) {
         pos++;
-        if (pos >= static_cast<RenderText*>(obj)->textLength()) {
+        if (pos >= toRenderText(obj)->textLength()) {
             obj = bidiNext(block, obj, resolver);
             pos = 0;
             nextBreakablePosition = -1;
@@ -306,7 +307,7 @@ inline UChar InlineIterator::current() const
     if (!obj || !obj->isText())
         return 0;
 
-    RenderText* text = static_cast<RenderText*>(obj);
+    RenderText* text = toRenderText(obj);
     if (pos >= text->textLength())
         return 0;
 
@@ -358,12 +359,12 @@ static void checkMidpoints(InlineIterator& lBreak)
             if (endpoint.obj->style()->collapseWhiteSpace()) {
                 if (endpoint.obj->isText()) {
                     // Don't shave a character off the endpoint if it was from a soft hyphen.
-                    RenderText* textObj = static_cast<RenderText*>(endpoint.obj);
+                    RenderText* textObj = toRenderText(endpoint.obj);
                     if (endpoint.pos + 1 < textObj->textLength()) {
                         if (textObj->characters()[endpoint.pos+1] == softHyphen)
                             return;
                     } else if (startpoint.obj->isText()) {
-                        RenderText *startText = static_cast<RenderText*>(startpoint.obj);
+                        RenderText *startText = toRenderText(startpoint.obj);
                         if (startText->textLength() && startText->characters()[0] == softHyphen)
                             return;
                     }
@@ -386,7 +387,7 @@ static void addMidpoint(const InlineIterator& midpoint)
 static void appendRunsForObject(int start, int end, RenderObject* obj, InlineBidiResolver& resolver)
 {
     if (start > end || obj->isFloating() ||
-        (obj->isPositioned() && !obj->hasStaticX() && !obj->hasStaticY() && !obj->container()->isInlineFlow()))
+        (obj->isPositioned() && !obj->style()->hasStaticX() && !obj->style()->hasStaticY() && !obj->container()->isRenderInline()))
         return;
 
     bool haveNextMidpoint = (sCurrMidpoint < sNumMidpoints);
@@ -455,7 +456,37 @@ void InlineBidiResolver::appendRun()
     m_status.eor = OtherNeutral;
 }
 
-InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj)
+static inline InlineBox* createInlineBoxForRenderer(RenderObject* obj, bool isRootLineBox, bool isOnlyRun = false)
+{
+    if (isRootLineBox)
+        return toRenderBlock(obj)->createRootInlineBox();
+    
+    if (obj->isText()) {
+        InlineTextBox* textBox = toRenderText(obj)->createInlineTextBox();
+        // We only treat a box as text for a <br> if we are on a line by ourself or in strict mode
+        // (Note the use of strict mode.  In "almost strict" mode, we don't treat the box for <br> as text.)
+        if (obj->isBR())
+            textBox->setIsText(isOnlyRun || obj->document()->inStrictMode());
+        return textBox;
+    }
+    
+    if (obj->isBox())
+        return toRenderBox(obj)->createInlineBox();
+    
+    return toRenderInline(obj)->createInlineFlowBox();
+}
+
+static inline void dirtyLineBoxesForRenderer(RenderObject* o, bool fullLayout)
+{
+    if (o->isText()) {
+        if (o->prefWidthsDirty() && o->isCounter())
+            toRenderText(o)->calcPrefWidths(0); // FIXME: Counters depend on this hack. No clue why. Should be investigated and removed.
+        toRenderText(o)->dirtyLineBoxes(fullLayout);
+    } else
+        toRenderInline(o)->dirtyLineBoxes(fullLayout);
+}
+
+InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
 {
     // See if we have an unconstructed line box for this object that is also
     // the last item on the line.
@@ -464,11 +495,10 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj)
     InlineFlowBox* parentBox = 0;
     InlineFlowBox* result = 0;
     do {
-        ASSERT(obj->isInlineFlow() || obj == this);
-        RenderFlow* flow = static_cast<RenderFlow*>(obj);
-
+        ASSERT(obj->isRenderInline() || obj == this);
+        
         // Get the last box we made for this render object.
-        parentBox = flow->lastLineBox();
+        parentBox = obj->isRenderInline() ? toRenderInline(obj)->lastLineBox() : toRenderBlock(obj)->lastLineBox();
 
         // If this box is constructed then it is from a previous line, and we need
         // to make a new box for our line.  If this box is unconstructed but it has
@@ -479,10 +509,10 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj)
         if (!parentBox || parentBox->isConstructed() || parentBox->nextOnLine()) {
             // We need to make a new box for this render object.  Once
             // made, we need to place it at the end of the current line.
-            InlineBox* newBox = obj->createInlineBox(false, obj == this);
+            InlineBox* newBox = createInlineBoxForRenderer(obj, obj == this);
             ASSERT(newBox->isInlineFlowBox());
             parentBox = static_cast<InlineFlowBox*>(newBox);
-            parentBox->setFirstLineStyleBit(m_firstLine);
+            parentBox->setFirstLineStyleBit(firstLine);
             constructedNewBox = true;
         }
 
@@ -509,7 +539,7 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj)
     return result;
 }
 
-RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool lastLine, RenderObject* endObject)
+RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject)
 {
     ASSERT(firstRun);
 
@@ -520,29 +550,31 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
         if (runCount == 2 && !r->m_object->isListMarker())
             isOnlyRun = ((style()->direction() == RTL) ? lastRun : firstRun)->m_object->isListMarker();
 
-        InlineBox* box = r->m_object->createInlineBox(r->m_object->isPositioned(), false, isOnlyRun);
+        InlineBox* box = createInlineBoxForRenderer(r->m_object, false, isOnlyRun);
         r->m_box = box;
 
-        if (box) {
-            // If we have no parent box yet, or if the run is not simply a sibling,
-            // then we need to construct inline boxes as necessary to properly enclose the
-            // run's inline box.
-            if (!parentBox || parentBox->object() != r->m_object->parent())
-                // Create new inline boxes all the way back to the appropriate insertion point.
-                parentBox = createLineBoxes(r->m_object->parent());
-
-            // Append the inline box to this line.
-            parentBox->addToLine(box);
-
-            bool visuallyOrdered = r->m_object->style()->visuallyOrdered();
-            box->setBidiLevel(visuallyOrdered ? 0 : r->level());
-
-            if (box->isInlineTextBox()) {
-                InlineTextBox* text = static_cast<InlineTextBox*>(box);
-                text->setStart(r->m_start);
-                text->setLen(r->m_stop - r->m_start);
-                text->m_dirOverride = r->dirOverride(visuallyOrdered);
-            }
+        ASSERT(box);
+        if (!box)
+            continue;
+
+        // If we have no parent box yet, or if the run is not simply a sibling,
+        // then we need to construct inline boxes as necessary to properly enclose the
+        // run's inline box.
+        if (!parentBox || parentBox->renderer() != r->m_object->parent())
+            // Create new inline boxes all the way back to the appropriate insertion point.
+            parentBox = createLineBoxes(r->m_object->parent(), firstLine);
+
+        // Append the inline box to this line.
+        parentBox->addToLine(box);
+
+        bool visuallyOrdered = r->m_object->style()->visuallyOrdered();
+        box->setBidiLevel(visuallyOrdered ? 0 : r->level());
+
+        if (box->isInlineTextBox()) {
+            InlineTextBox* text = static_cast<InlineTextBox*>(box);
+            text->setStart(r->m_start);
+            text->setLen(r->m_stop - r->m_start);
+            text->m_dirOverride = r->dirOverride(visuallyOrdered);
         }
     }
 
@@ -563,10 +595,10 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
     return lastRootBox();
 }
 
-void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd)
+void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd)
 {
     // First determine our total width.
-    int availableWidth = lineWidth(m_height);
+    int availableWidth = lineWidth(height(), firstLine);
     int totWidth = lineBox->getFlowSpacingWidth();
     bool needsWordSpacing = false;
     unsigned numSpaces = 0;
@@ -578,7 +610,7 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
                       // correct static x position.  They have no effect on the width.
                       // Similarly, line break boxes have no effect on the width.
         if (r->m_object->isText()) {
-            RenderText* rt = static_cast<RenderText*>(r->m_object);
+            RenderText* rt = toRenderText(r->m_object);
 
             if (textAlign == JUSTIFY && r != trailingSpaceRun) {
                 const UChar* characters = rt->characters();
@@ -590,28 +622,35 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
             }
 
             if (int length = rt->textLength()) {
-                if (!r->m_compact && !r->m_start && needsWordSpacing && isSpaceOrNewline(rt->characters()[r->m_start]))
-                    totWidth += rt->style(m_firstLine)->font().wordSpacing();
+                if (!r->m_start && needsWordSpacing && isSpaceOrNewline(rt->characters()[r->m_start]))
+                    totWidth += rt->style(firstLine)->font().wordSpacing();
                 needsWordSpacing = !isSpaceOrNewline(rt->characters()[r->m_stop - 1]) && r->m_stop == length;          
             }
-            r->m_box->setWidth(rt->width(r->m_start, r->m_stop - r->m_start, totWidth, m_firstLine));
-        } else if (!r->m_object->isInlineFlow()) {
-            r->m_object->calcWidth();
-            r->m_box->setWidth(r->m_object->width());
-            if (!r->m_compact)
-                 totWidth += r->m_object->marginLeft() + r->m_object->marginRight();
+            HashSet<const SimpleFontData*> fallbackFonts;
+            r->m_box->setWidth(rt->width(r->m_start, r->m_stop - r->m_start, totWidth, firstLine, &fallbackFonts));
+            if (!fallbackFonts.isEmpty()
+#if ENABLE(SVG)
+                    && !isSVGText()
+#endif
+            ) {
+                ASSERT(r->m_box->isText());
+                static_cast<InlineTextBox*>(r->m_box)->setFallbackFonts(fallbackFonts);
+            }
+        } else if (!r->m_object->isRenderInline()) {
+            RenderBox* renderBox = toRenderBox(r->m_object);
+            renderBox->calcWidth();
+            r->m_box->setWidth(renderBox->width());
+            totWidth += renderBox->marginLeft() + renderBox->marginRight();
         }
 
-        // Compacts don't contribute to the width of the line, since they are placed in the margin.
-        if (!r->m_compact)
-            totWidth += r->m_box->width();
+        totWidth += r->m_box->width();
     }
 
     // Armed with the total width of the line (without justification),
     // we now examine our text-align property in order to determine where to position the
     // objects horizontally.  The total width of the line can be increased if we end up
     // justifying text.
-    int x = leftOffset(m_height);
+    int x = leftOffset(height(), firstLine);
     switch(textAlign) {
         case LEFT:
         case WEBKIT_LEFT:
@@ -619,7 +658,7 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
             // particular with RTL blocks, wide lines should still spill out to the left.
             if (style()->direction() == LTR) {
                 if (totWidth > availableWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setWidth(trailingSpaceRun->m_box->width() - totWidth + availableWidth);
+                    trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceRun->m_box->width() - totWidth + availableWidth));
             } else {
                 if (trailingSpaceRun)
                     trailingSpaceRun->m_box->setWidth(0);
@@ -641,7 +680,7 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
             // for right to left fall through to right aligned
             if (style()->direction() == LTR) {
                 if (totWidth > availableWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setWidth(trailingSpaceRun->m_box->width() - totWidth + availableWidth);
+                    trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceRun->m_box->width() - totWidth + availableWidth));
                 break;
             }
         case RIGHT:
@@ -658,7 +697,7 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
                     x += availableWidth - totWidth;
             } else {
                 if (totWidth > availableWidth && trailingSpaceRun) {
-                    trailingSpaceRun->m_box->setWidth(trailingSpaceRun->m_box->width() - totWidth + availableWidth);
+                    trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceRun->m_box->width() - totWidth + availableWidth));
                     totWidth -= trailingSpaceRun->m_box->width();
                 } else
                     x += availableWidth - totWidth;
@@ -670,7 +709,7 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
             if (trailingSpaceRun) {
                 totWidth -= trailingSpaceRun->m_box->width();
                 trailingSpaceWidth = min(trailingSpaceRun->m_box->width(), (availableWidth - totWidth + 1) / 2);
-                trailingSpaceRun->m_box->setWidth(trailingSpaceWidth);
+                trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceWidth));
             }
             if (style()->direction() == LTR)
                 x += max((availableWidth - totWidth) / 2, 0);
@@ -685,9 +724,9 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
                 continue;
 
             int spaceAdd = 0;
-            if (r->m_object->isText() && !r->m_compact) {
+            if (r->m_object->isText()) {
                 unsigned spaces = 0;
-                const UChar* characters = static_cast<RenderText*>(r->m_object)->characters();
+                const UChar* characters = toRenderText(r->m_object)->characters();
                 for (int i = r->m_start; i < r->m_stop; i++) {
                     UChar c = characters[i];
                     if (c == ' ' || c == '\n' || c == '\t')
@@ -720,27 +759,31 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, Bidi
 
 void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRun* firstRun)
 {
-    lineBox->verticallyAlignBoxes(m_height);
-    lineBox->setBlockHeight(m_height);
+    setHeight(lineBox->verticallyAlignBoxes(height()));
+    lineBox->setBlockHeight(height());
 
     // See if the line spilled out.  If so set overflow height accordingly.
     int bottomOfLine = lineBox->bottomOverflow();
-    if (bottomOfLine > m_height && bottomOfLine > m_overflowHeight)
+    if (bottomOfLine > height() && bottomOfLine > m_overflowHeight)
         m_overflowHeight = bottomOfLine;
 
     // Now make sure we place replaced render objects correctly.
     for (BidiRun* r = firstRun; r; r = r->next()) {
+        ASSERT(r->m_box);
         if (!r->m_box)
             continue; // Skip runs with no line boxes.
 
         // Align positioned boxes with the top of the line box.  This is
         // a reasonable approximation of an appropriate y position.
         if (r->m_object->isPositioned())
-            r->m_box->setYPos(m_height);
+            r->m_box->setY(height());
 
         // Position is used to properly position both replaced elements and
         // to update the static normal flow x/y of positioned elements.
-        r->m_object->position(r->m_box);
+        if (r->m_object->isText())
+            toRenderText(r->m_object)->positionLineBox(r->m_box);
+        else if (r->m_object->isBox())
+            toRenderBox(r->m_object)->positionLineBox(r->m_box);
     }
     // Positioned objects and zero-length text nodes destroy their boxes in
     // position(), which unnecessarily dirties the line.
@@ -753,34 +796,6 @@ void RenderBlock::bidiReorderLine(InlineBidiResolver& resolver, const InlineIter
     resolver.createBidiRunsForLine(end, style()->visuallyOrdered(), previousLineBrokeCleanly);
 }
 
-static void buildCompactRuns(RenderObject* compactObj, InlineBidiResolver& resolver)
-{
-    ASSERT(compactObj->isRenderBlock());
-    ASSERT(!resolver.firstRun());
-
-    // Format the compact like it is its own single line.  We build up all the runs for
-    // the little compact and then reorder them for bidi.
-    RenderBlock* compactBlock = static_cast<RenderBlock*>(compactObj);
-
-    InlineIterator start(compactBlock, bidiFirst(compactBlock, &resolver), 0);
-    resolver.setPosition(start);
-
-    betweenMidpoints = false;
-    isLineEmpty = true;
-    previousLineBrokeCleanly = true;
-
-    InlineIterator end = compactBlock->findNextLineBreak(resolver);
-    if (!isLineEmpty)
-        compactBlock->bidiReorderLine(resolver, end);
-
-    for (BidiRun* run = resolver.firstRun(); run; run = run->next())
-        run->m_compact = true;
-
-    sNumMidpoints = 0;
-    sCurrMidpoint = 0;
-    betweenMidpoints = false;
-}
-
 static inline bool isCollapsibleSpace(UChar character, RenderText* renderer)
 {
     if (character == ' ' || character == '\t' || character == softHyphen)
@@ -795,12 +810,10 @@ static inline bool isCollapsibleSpace(UChar character, RenderText* renderer)
 void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, int& repaintBottom)
 {
     bool useRepaintBounds = false;
-
-    invalidateVerticalPosition();
     
     m_overflowHeight = 0;
         
-    m_height = borderTop() + paddingTop();
+    setHeight(borderTop() + paddingTop());
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
 
     // Figure out if we should clear out our line boxes.
@@ -808,7 +821,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
     // FIXME: Do something better when floats are present.
     bool fullLayout = !firstLineBox() || !firstChild() || selfNeedsLayout() || relayoutChildren;
     if (fullLayout)
-        deleteLineBoxes();
+        lineBoxes()->deleteLineBoxes(renderArena());
 
     // Text truncation only kicks in if your overflow isn't visible and your text-overflow-mode isn't
     // clip.
@@ -826,10 +839,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         bool endOfInline = false;
         RenderObject* o = bidiFirst(this, 0, false);
         Vector<FloatWithRect> floats;
-        int containerWidth = max(0, containingBlockWidth());
         while (o) {
-            o->invalidateVerticalPosition();
             if (o->isReplaced() || o->isFloating() || o->isPositioned()) {
+                RenderBox* box = toRenderBox(o);
+                
                 if (relayoutChildren || o->style()->width().isPercent() || o->style()->height().isPercent())
                     o->setChildNeedsLayout(true, false);
                     
@@ -838,23 +851,21 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                     o->setPrefWidthsDirty(true, false);
             
                 if (o->isPositioned())
-                    o->containingBlock()->insertPositionedObject(o);
+                    o->containingBlock()->insertPositionedObject(box);
                 else {
                     if (o->isFloating())
-                        floats.append(FloatWithRect(o));
+                        floats.append(FloatWithRect(box));
                     else if (fullLayout || o->needsLayout()) // Replaced elements
-                        o->dirtyLineBoxes(fullLayout);
+                        toRenderBox(o)->dirtyLineBoxes(fullLayout);
 
                     o->layoutIfNeeded();
                 }
-            } else if (o->isText() || (o->isInlineFlow() && !endOfInline)) {
+            } else if (o->isText() || (o->isRenderInline() && !endOfInline)) {
                 if (fullLayout || o->selfNeedsLayout())
-                    o->dirtyLineBoxes(fullLayout);
-                
-                // Calculate margins of inline flows so that they can be used later by line layout.
-                if (o->isInlineFlow())
-                    static_cast<RenderFlow*>(o)->calcMargins(containerWidth);
+                    dirtyLineBoxesForRenderer(o, fullLayout);
                 o->setNeedsLayout(false);
+                if (!o->isText())
+                    toRenderInline(o)->invalidateVerticalPosition(); // FIXME: Should do better here and not always invalidate everything.
             }
             o = bidiNext(this, o, 0, false, &endOfInline);
         }
@@ -862,19 +873,19 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         // We want to skip ahead to the first dirty line
         InlineBidiResolver resolver;
         unsigned floatIndex;
-        RootInlineBox* startLine = determineStartPosition(fullLayout, resolver, floats, floatIndex);
+        bool firstLine = true;
+        RootInlineBox* startLine = determineStartPosition(firstLine, fullLayout, resolver, floats, floatIndex);
 
         if (fullLayout && !selfNeedsLayout()) {
             setNeedsLayout(true, false);  // Mark ourselves as needing a full layout. This way we'll repaint like
                                           // we're supposed to.
-            if (!document()->view()->needsFullRepaint() && m_layer) {
+            RenderView* v = view();
+            if (v && !v->doingFullRepaint() && hasLayer()) {
                 // Because we waited until we were already inside layout to discover
                 // that the block really needed a full layout, we missed our chance to repaint the layer
                 // before layout started.  Luckily the layer has cached the repaint rect for its original
                 // position and size, and so we can use that to make a repaint happen now.
-                RenderView* c = view();
-                if (c && !c->printing())
-                    c->repaintViewRectangle(m_layer->repaintRect());
+                repaintUsingContainer(containerForRepaint(), layer()->repaintRect());
             }
         }
 
@@ -896,8 +907,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 
         if (startLine) {
             useRepaintBounds = true;
-            repaintTop = m_height;
-            repaintBottom = m_height;
+            repaintTop = height();
+            repaintBottom = height();
             RenderArena* arena = renderArena();
             RootInlineBox* box = startLine;
             while (box) {
@@ -916,9 +927,9 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
             // adjust the height accordingly.
             // A line break can be either the first or the last object on a line, depending on its direction.
             if (InlineBox* lastLeafChild = lastRootBox()->lastLeafChild()) {
-                RenderObject* lastObject = lastLeafChild->object();
+                RenderObject* lastObject = lastLeafChild->renderer();
                 if (!lastObject->isBR())
-                    lastObject = lastRootBox()->firstLeafChild()->object();
+                    lastObject = lastRootBox()->firstLeafChild()->renderer();
                 if (lastObject->isBR()) {
                     EClear clear = lastObject->style()->clear();
                     if (clear != CNONE)
@@ -930,7 +941,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         bool endLineMatched = false;
         bool checkForEndLineMatch = endLine;
         bool checkForFloatsFromLastLine = false;
-        int lastHeight = m_height;
+        int lastHeight = height();
 
         while (!end.atEnd()) {
             // FIXME: Is this check necessary before the first iteration or can it be moved to the end?
@@ -939,12 +950,9 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 
             betweenMidpoints = false;
             isLineEmpty = true;
-            if (m_firstLine && firstChild()->isCompact() && firstChild()->isRenderBlock()) {
-                buildCompactRuns(firstChild(), resolver);
-                resolver.setPosition(InlineIterator(this, firstChild()->nextSibling(), 0));
-            }
+            
             EClear clear = CNONE;
-            end = findNextLineBreak(resolver, &clear);
+            end = findNextLineBreak(resolver, firstLine, &clear);
             if (resolver.position().atEnd()) {
                 resolver.deleteRuns();
                 checkForFloatsFromLastLine = true;
@@ -957,11 +965,12 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 ASSERT(resolver.position() == end);
 
                 BidiRun* trailingSpaceRun = 0;
-                if (!previousLineBrokeCleanly && resolver.runCount() && resolver.logicallyLastRun()->m_object->style()->breakOnlyAfterWhiteSpace()) {
+                if (!previousLineBrokeCleanly && resolver.runCount() && resolver.logicallyLastRun()->m_object->style()->breakOnlyAfterWhiteSpace()
+                        && resolver.logicallyLastRun()->m_object->style()->autoWrap()) {
                     trailingSpaceRun = resolver.logicallyLastRun();
                     RenderObject* lastObject = trailingSpaceRun->m_object;
                     if (lastObject->isText()) {
-                        RenderText* lastText = static_cast<RenderText*>(lastObject);
+                        RenderText* lastText = toRenderText(lastObject);
                         const UChar* characters = lastText->characters();
                         int firstSpace = trailingSpaceRun->stop();
                         while (firstSpace > trailingSpaceRun->start()) {
@@ -976,26 +985,18 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                             TextDirection direction = style()->direction();
                             bool shouldReorder = trailingSpaceRun != (direction == LTR ? resolver.lastRun() : resolver.firstRun());
                             if (firstSpace != trailingSpaceRun->start()) {
-                                ETextAlign textAlign = style()->textAlign();
-                                // If the trailing white space is at the right hand side of a left-aligned line, then computeHorizontalPositionsForLine()
-                                // does not care if trailingSpaceRun includes non-spaces at the beginning. In all other cases, trailingSpaceRun has to
-                                // contain only the spaces, either because we re-order them or because computeHorizontalPositionsForLine() needs to know
-                                // their width.
-                                bool shouldSeparateSpaces = textAlign != LEFT && textAlign != WEBKIT_LEFT && textAlign != TAAUTO || trailingSpaceRun->m_level % 2 || direction == RTL || shouldReorder;
-                                if (shouldSeparateSpaces) {
-                                    BidiContext* baseContext = resolver.context();
-                                    while (BidiContext* parent = baseContext->parent())
-                                        baseContext = parent;
-
-                                    BidiRun* newTrailingRun = new (renderArena()) BidiRun(firstSpace, trailingSpaceRun->m_stop, trailingSpaceRun->m_object, baseContext, OtherNeutral);
-                                    trailingSpaceRun->m_stop = firstSpace;
-                                    if (direction == LTR)
-                                        resolver.addRun(newTrailingRun);
-                                    else
-                                        resolver.prependRun(newTrailingRun);
-                                    trailingSpaceRun = newTrailingRun;
-                                    shouldReorder = false;
-                                }
+                                BidiContext* baseContext = resolver.context();
+                                while (BidiContext* parent = baseContext->parent())
+                                    baseContext = parent;
+
+                                BidiRun* newTrailingRun = new (renderArena()) BidiRun(firstSpace, trailingSpaceRun->m_stop, trailingSpaceRun->m_object, baseContext, OtherNeutral);
+                                trailingSpaceRun->m_stop = firstSpace;
+                                if (direction == LTR)
+                                    resolver.addRun(newTrailingRun);
+                                else
+                                    resolver.prependRun(newTrailingRun);
+                                trailingSpaceRun = newTrailingRun;
+                                shouldReorder = false;
                             }
                             if (shouldReorder) {
                                 if (direction == LTR) {
@@ -1017,12 +1018,12 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 
                 RootInlineBox* lineBox = 0;
                 if (resolver.runCount()) {
-                    lineBox = constructLine(resolver.runCount(), resolver.firstRun(), resolver.lastRun(), !end.obj, end.obj && !end.pos ? end.obj : 0);
+                    lineBox = constructLine(resolver.runCount(), resolver.firstRun(), resolver.lastRun(), firstLine, !end.obj, end.obj && !end.pos ? end.obj : 0);
                     if (lineBox) {
                         lineBox->setEndsWithBreak(previousLineBrokeCleanly);
 
                         // Now we position all of our text runs horizontally.
-                        computeHorizontalPositionsForLine(lineBox, resolver.firstRun(), trailingSpaceRun, end.atEnd());
+                        computeHorizontalPositionsForLine(lineBox, firstLine, resolver.firstRun(), trailingSpaceRun, end.atEnd());
 
                         // Now position our text runs vertically.
                         computeVerticalPositionsForLine(lineBox, resolver.firstRun());
@@ -1050,7 +1051,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                     }
                 }
 
-                m_firstLine = false;
+                firstLine = false;
                 newLine(clear);
             }
 
@@ -1073,7 +1074,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 lastFloat = m_floatingObjects->last();
             }
 
-            lastHeight = m_height;
+            lastHeight = height();
             sNumMidpoints = 0;
             sCurrMidpoint = 0;
             resolver.setPosition(end);
@@ -1082,7 +1083,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         if (endLine) {
             if (endLineMatched) {
                 // Attach all the remaining lines, and then adjust their y-positions as needed.
-                int delta = m_height - endLineYPos;
+                int delta = height() - endLineYPos;
                 for (RootInlineBox* line = endLine; line; line = line->nextRootBox()) {
                     line->attachLine();
                     if (delta) {
@@ -1090,17 +1091,17 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                         repaintBottom = max(repaintBottom, line->bottomOverflow() + max(delta, 0));
                         line->adjustPosition(0, delta);
                     }
-                    if (Vector<RenderObject*>* cleanLineFloats = line->floatsPtr()) {
-                        Vector<RenderObject*>::iterator end = cleanLineFloats->end();
-                        for (Vector<RenderObject*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
-                            int floatTop = (*f)->yPos() - (*f)->marginTop();
+                    if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
+                        Vector<RenderBox*>::iterator end = cleanLineFloats->end();
+                        for (Vector<RenderBox*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
+                            int floatTop = (*f)->y() - (*f)->marginTop();
                             insertFloatingObject(*f);
-                            m_height = floatTop + delta;
+                            setHeight(floatTop + delta);
                             positionNewFloats();
                         }
                     }
                 }
-                m_height = lastRootBox()->blockHeight();
+                setHeight(lastRootBox()->blockHeight());
             } else {
                 // Delete all the remaining lines.
                 InlineRunBox* line = endLine;
@@ -1136,16 +1137,16 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
     sCurrMidpoint = 0;
 
     // Now add in the bottom border/padding.
-    m_height += toAdd;
+    setHeight(height() + toAdd);
 
     // Always make sure this is at least our height.
-    m_overflowHeight = max(m_height, m_overflowHeight);
+    m_overflowHeight = max(height(), m_overflowHeight);
 
     // See if any lines spill out of the block.  If so, we need to update our overflow width.
     checkLinesForOverflow();
 
     if (!firstLineBox() && hasLineIfEmpty())
-        m_height += lineHeight(true, true);
+        setHeight(height() + lineHeight(true, true));
 
     // See if we have any lines that spill out of our block.  If we do, then we will possibly need to
     // truncate text.
@@ -1153,7 +1154,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         checkLinesForTextOverflow();
 }
 
-RootInlineBox* RenderBlock::determineStartPosition(bool& fullLayout, InlineBidiResolver& resolver, Vector<FloatWithRect>& floats, unsigned& numCleanFloats)
+RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLayout, InlineBidiResolver& resolver, Vector<FloatWithRect>& floats, unsigned& numCleanFloats)
 {
     RootInlineBox* curr = 0;
     RootInlineBox* last = 0;
@@ -1162,10 +1163,10 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& fullLayout, InlineBidiR
     if (!fullLayout) {
         size_t floatIndex = 0;
         for (curr = firstRootBox(); curr && !curr->isDirty(); curr = curr->nextRootBox()) {
-            if (Vector<RenderObject*>* cleanLineFloats = curr->floatsPtr()) {
-                Vector<RenderObject*>::iterator end = cleanLineFloats->end();
-                for (Vector<RenderObject*>::iterator o = cleanLineFloats->begin(); o != end; ++o) {
-                    RenderObject* f = *o;
+            if (Vector<RenderBox*>* cleanLineFloats = curr->floatsPtr()) {
+                Vector<RenderBox*>::iterator end = cleanLineFloats->end();
+                for (Vector<RenderBox*>::iterator o = cleanLineFloats->begin(); o != end; ++o) {
+                    RenderBox* f = *o;
                     IntSize newSize(f->width() + f->marginLeft() +f->marginRight(), f->height() + f->marginTop() + f->marginBottom());
                     ASSERT(floatIndex < floats.size());
                     if (floats[floatIndex].object != f) {
@@ -1209,7 +1210,7 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& fullLayout, InlineBidiR
             // We have a dirty line.
             if (RootInlineBox* prevRootBox = curr->prevRootBox()) {
                 // We have a previous line.
-                if (!dirtiedByFloat && (!prevRootBox->endsWithBreak() || prevRootBox->lineBreakObj()->isText() && prevRootBox->lineBreakPos() >= static_cast<RenderText*>(prevRootBox->lineBreakObj())->textLength()))
+                if (!dirtiedByFloat && (!prevRootBox->endsWithBreak() || (prevRootBox->lineBreakObj()->isText() && prevRootBox->lineBreakPos() >= toRenderText(prevRootBox->lineBreakObj())->textLength())))
                     // The previous line didn't break cleanly or broke at a newline
                     // that has been deleted, so treat it as dirty too.
                     curr = prevRootBox;
@@ -1227,15 +1228,15 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& fullLayout, InlineBidiR
 
     numCleanFloats = 0;
     if (!floats.isEmpty()) {
-        int savedHeight = m_height;
+        int savedHeight = height();
         // Restore floats from clean lines.
         RootInlineBox* line = firstRootBox();
         while (line != curr) {
-            if (Vector<RenderObject*>* cleanLineFloats = line->floatsPtr()) {
-                Vector<RenderObject*>::iterator end = cleanLineFloats->end();
-                for (Vector<RenderObject*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
+            if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
+                Vector<RenderBox*>::iterator end = cleanLineFloats->end();
+                for (Vector<RenderBox*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
                     insertFloatingObject(*f);
-                    m_height = (*f)->yPos() - (*f)->marginTop();
+                    setHeight((*f)->y() - (*f)->marginTop());
                     positionNewFloats();
                     ASSERT(floats[numCleanFloats].object == *f);
                     numCleanFloats++;
@@ -1243,16 +1244,16 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& fullLayout, InlineBidiR
             }
             line = line->nextRootBox();
         }
-        m_height = savedHeight;
+        setHeight(savedHeight);
     }
 
-    m_firstLine = !last;
+    firstLine = !last;
     previousLineBrokeCleanly = !last || last->endsWithBreak();
 
     RenderObject* startObj;
     int pos = 0;
     if (last) {
-        m_height = last->blockHeight();
+        setHeight(last->blockHeight());
         startObj = last->lineBreakObj();
         pos = last->lineBreakPos();
         resolver.setStatus(last->lineBreakBidiStatus());
@@ -1263,12 +1264,12 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& fullLayout, InlineBidiR
     #endif
             ;
 
-        BidiContext* context = new BidiContext(ltr ? 0 : 1, ltr ? LeftToRight : RightToLeft, style()->unicodeBidi() == Override);
+        Direction direction = ltr ? LeftToRight : RightToLeft;
+        resolver.setLastStrongDir(direction);
+        resolver.setLastDir(direction);
+        resolver.setEorDir(direction);
+        resolver.setContext(BidiContext::create(ltr ? 0 : 1, direction, style()->unicodeBidi() == Override));
 
-        resolver.setLastStrongDir(context->dir());
-        resolver.setLastDir(context->dir());
-        resolver.setEorDir(context->dir());
-        resolver.setContext(context);
         startObj = bidiFirst(this, &resolver);
     }
 
@@ -1312,12 +1313,12 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
         if (resolver.status() != endLineStatus)
             return false;
 
-        int delta = m_height - endYPos;
+        int delta = height() - endYPos;
         if (!delta || !m_floatingObjects)
             return true;
 
         // See if any floats end in the range along which we want to shift the lines vertically.
-        int top = min(m_height, endYPos);
+        int top = min(height(), endYPos);
 
         RootInlineBox* lastLine = endLine;
         while (RootInlineBox* nextLine = lastLine->nextRootBox())
@@ -1348,10 +1349,10 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
             if (result)
                 endYPos = line->blockHeight();
 
-            int delta = m_height - endYPos;
+            int delta = height() - endYPos;
             if (delta && m_floatingObjects) {
                 // See if any floats end in the range along which we want to shift the lines vertically.
-                int top = min(m_height, endYPos);
+                int top = min(height(), endYPos);
 
                 RootInlineBox* lastLine = endLine;
                 while (RootInlineBox* nextLine = lastLine->nextRootBox())
@@ -1415,12 +1416,12 @@ static inline bool shouldPreserveNewline(RenderObject* object)
     return object->style()->preserveNewline();
 }
 
-static bool inlineFlowRequiresLineBox(RenderObject* flow)
+static bool inlineFlowRequiresLineBox(RenderInline* flow)
 {
     // FIXME: Right now, we only allow line boxes for inlines that are truly empty.
     // We need to fix this, though, because at the very least, inlines containing only
     // ignorable whitespace should should also have line boxes. 
-    return flow->isInlineFlow() && !flow->firstChild() && flow->hasHorizontalBordersPaddingOrMargin();
+    return !flow->firstChild() && flow->hasHorizontalBordersPaddingOrMargin();
 }
 
 static inline bool requiresLineBox(const InlineIterator& it)
@@ -1428,7 +1429,7 @@ static inline bool requiresLineBox(const InlineIterator& it)
     if (it.obj->isFloatingOrPositioned())
         return false;
 
-    if (it.obj->isInlineFlow() && !inlineFlowRequiresLineBox(it.obj))
+    if (it.obj->isRenderInline() && !inlineFlowRequiresLineBox(toRenderInline(it.obj)))
         return false;
 
     if (!shouldCollapseWhiteSpace(it.obj->style()) || it.obj->isBR())
@@ -1460,63 +1461,65 @@ void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator)
     while (!iterator.atEnd() && !requiresLineBox(iterator)) {
         RenderObject* object = iterator.obj;
         if (object->isFloating()) {
-            insertFloatingObject(object);
+            insertFloatingObject(toRenderBox(object));
         } else if (object->isPositioned()) {
             // FIXME: The math here is actually not really right.  It's a best-guess approximation that
             // will work for the common cases
             RenderObject* c = object->container();
-            if (c->isInlineFlow()) {
+            if (c->isRenderInline()) {
                 // A relative positioned inline encloses us.  In this case, we also have to determine our
                 // position as though we were an inline.  Set |staticX| and |staticY| on the relative positioned
                 // inline so that we can obtain the value later.
-                c->setStaticX(style()->direction() == LTR ? leftOffset(m_height) : rightOffset(m_height));
-                c->setStaticY(m_height);
+                toRenderInline(c)->layer()->setStaticX(style()->direction() == LTR ? leftOffset(height(), false) : rightOffset(height(), false));
+                toRenderInline(c)->layer()->setStaticY(height());
             }
     
-            if (object->hasStaticX()) {
-                if (object->style()->isOriginalDisplayInlineType())
-                    object->setStaticX(style()->direction() == LTR ? leftOffset(m_height) : width() - rightOffset(m_height));
+            RenderBox* box = toRenderBox(object);
+            if (box->style()->hasStaticX()) {
+                if (box->style()->isOriginalDisplayInlineType())
+                    box->layer()->setStaticX(style()->direction() == LTR ? leftOffset(height(), false) : width() - rightOffset(height(), false));
                 else
-                    object->setStaticX(style()->direction() == LTR ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
+                    box->layer()->setStaticX(style()->direction() == LTR ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
             }
     
-            if (object->hasStaticY())
-                object->setStaticY(m_height);
+            if (box->style()->hasStaticY())
+                box->layer()->setStaticY(height());
         }
         iterator.increment();
     }
 }
 
-int RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver)
+int RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstLine)
 {
-    int availableWidth = lineWidth(m_height);
+    int availableWidth = lineWidth(height(), firstLine);
     while (!resolver.position().atEnd() && !requiresLineBox(resolver.position())) {
         RenderObject* object = resolver.position().obj;
         if (object->isFloating()) {
-            insertFloatingObject(object);
+            insertFloatingObject(toRenderBox(object));
             positionNewFloats();
-            availableWidth = lineWidth(m_height);
+            availableWidth = lineWidth(height(), firstLine);
         } else if (object->isPositioned()) {
             // FIXME: The math here is actually not really right.  It's a best-guess approximation that
             // will work for the common cases
             RenderObject* c = object->container();
-            if (c->isInlineFlow()) {
+            if (c->isRenderInline()) {
                 // A relative positioned inline encloses us.  In this case, we also have to determine our
                 // position as though we were an inline.  Set |staticX| and |staticY| on the relative positioned
                 // inline so that we can obtain the value later.
-                c->setStaticX(style()->direction() == LTR ? leftOffset(m_height) : rightOffset(m_height));
-                c->setStaticY(m_height);
+                toRenderInline(c)->layer()->setStaticX(style()->direction() == LTR ? leftOffset(height(), firstLine) : rightOffset(height(), firstLine));
+                toRenderInline(c)->layer()->setStaticY(height());
             }
     
-            if (object->hasStaticX()) {
-                if (object->style()->isOriginalDisplayInlineType())
-                    object->setStaticX(style()->direction() == LTR ? leftOffset(m_height) : width() - rightOffset(m_height));
+            RenderBox* box = toRenderBox(object);
+            if (box->style()->hasStaticX()) {
+                if (box->style()->isOriginalDisplayInlineType())
+                    box->layer()->setStaticX(style()->direction() == LTR ? leftOffset(height(), firstLine) : width() - rightOffset(height(), firstLine));
                 else
-                    object->setStaticX(style()->direction() == LTR ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
+                    box->layer()->setStaticX(style()->direction() == LTR ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
             }
     
-            if (object->hasStaticY())
-                object->setStaticY(m_height);
+            if (box->style()->hasStaticY())
+                box->layer()->setStaticY(height());
         }
         resolver.increment();
     }
@@ -1529,8 +1532,8 @@ int RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver)
 static bool shouldSkipWhitespaceAfterStartObject(RenderBlock* block, RenderObject* o)
 {
     RenderObject* next = bidiNext(block, o);
-    if (next && !next->isBR() && next->isText() && static_cast<RenderText*>(next)->textLength() > 0) {
-        RenderText* nextText = static_cast<RenderText*>(next);
+    if (next && !next->isBR() && next->isText() && toRenderText(next)->textLength() > 0) {
+        RenderText* nextText = toRenderText(next);
         UChar nextChar = nextText->characters()[0];
         if (nextText->style()->isCollapsibleWhiteSpace(nextChar)) {
             addMidpoint(InlineIterator(0, o, 0));
@@ -1541,37 +1544,44 @@ static bool shouldSkipWhitespaceAfterStartObject(RenderBlock* block, RenderObjec
     return false;
 }
 
-void RenderBlock::fitBelowFloats(int widthToFit, int& availableWidth)
+void RenderBlock::fitBelowFloats(int widthToFit, bool firstLine, int& availableWidth)
 {
     ASSERT(widthToFit > availableWidth);
 
     int floatBottom;
-    int lastFloatBottom = m_height;
+    int lastFloatBottom = height();
     int newLineWidth = availableWidth;
     while (true) {
         floatBottom = nextFloatBottomBelow(lastFloatBottom);
         if (!floatBottom)
             break;
 
-        newLineWidth = lineWidth(floatBottom);
+        newLineWidth = lineWidth(floatBottom, firstLine);
         lastFloatBottom = floatBottom;
         if (newLineWidth >= widthToFit)
             break;
     }
 
     if (newLineWidth > availableWidth) {
-        m_height = lastFloatBottom;
+        setHeight(lastFloatBottom);
         availableWidth = newLineWidth;
     }
 }
 
-InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, EClear* clear)
+static inline unsigned textWidth(RenderText* text, unsigned from, unsigned len, const Font& font, int xPos, bool isFixedPitch, bool collapseWhiteSpace)
+{
+    if (isFixedPitch || (!from && len == text->textLength()))
+        return text->width(from, len, font, xPos);
+    return font.width(TextRun(text->characters() + from, len, !collapseWhiteSpace, xPos));
+}
+
+InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool firstLine, EClear* clear)
 {
     ASSERT(resolver.position().block == this);
 
     bool appliedStartWidth = resolver.position().pos > 0;
 
-    int width = skipLeadingWhitespace(resolver);
+    int width = skipLeadingWhitespace(resolver, firstLine);
 
     int w = 0;
     int tmpW = 0;
@@ -1653,22 +1663,24 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
         if (o->isFloatingOrPositioned()) {
             // add to special objects...
             if (o->isFloating()) {
-                insertFloatingObject(o);
+                RenderBox* floatBox = toRenderBox(o);
+                insertFloatingObject(floatBox);
                 // check if it fits in the current line.
                 // If it does, position it now, otherwise, position
                 // it after moving to next line (in newLine() func)
-                if (floatsFitOnLine && o->width() + o->marginLeft() + o->marginRight() + w + tmpW <= width) {
+                if (floatsFitOnLine && floatBox->width() + floatBox->marginLeft() + floatBox->marginRight() + w + tmpW <= width) {
                     positionNewFloats();
-                    width = lineWidth(m_height);
+                    width = lineWidth(height(), firstLine);
                 } else
                     floatsFitOnLine = false;
             } else if (o->isPositioned()) {
                 // If our original display wasn't an inline type, then we can
                 // go ahead and determine our static x position now.
-                bool isInlineType = o->style()->isOriginalDisplayInlineType();
-                bool needToSetStaticX = o->hasStaticX();
-                if (o->hasStaticX() && !isInlineType) {
-                    o->setStaticX(o->parent()->style()->direction() == LTR ?
+                RenderBox* box = toRenderBox(o);
+                bool isInlineType = box->style()->isOriginalDisplayInlineType();
+                bool needToSetStaticX = box->style()->hasStaticX();
+                if (box->style()->hasStaticX() && !isInlineType) {
+                    box->layer()->setStaticX(o->parent()->style()->direction() == LTR ?
                                   borderLeft() + paddingLeft() :
                                   borderRight() + paddingRight());
                     needToSetStaticX = false;
@@ -1676,15 +1688,15 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
 
                 // If our original display was an INLINE type, then we can go ahead
                 // and determine our static y position now.
-                bool needToSetStaticY = o->hasStaticY();
-                if (o->hasStaticY() && isInlineType) {
-                    o->setStaticY(m_height);
+                bool needToSetStaticY = box->style()->hasStaticY();
+                if (box->style()->hasStaticY() && isInlineType) {
+                    box->layer()->setStaticY(height());
                     needToSetStaticY = false;
                 }
                 
                 bool needToCreateLineBox = needToSetStaticX || needToSetStaticY;
                 RenderObject* c = o->container();
-                if (c->isInlineFlow() && (!needToSetStaticX || !needToSetStaticY))
+                if (c->isRenderInline() && (!needToSetStaticX || !needToSetStaticY))
                     needToCreateLineBox = true;
 
                 // If we're ignoring spaces, we have to stop and include this object and
@@ -1700,15 +1712,17 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                     
                 }
             }
-        } else if (o->isInlineFlow()) {
+        } else if (o->isRenderInline()) {
             // Right now, we should only encounter empty inlines here.
             ASSERT(!o->firstChild());
     
+            RenderInline* flowBox = toRenderInline(o);
+            
             // Now that some inline flows have line boxes, if we are already ignoring spaces, we need 
             // to make sure that we stop to include this object and then start ignoring spaces again. 
             // If this object is at the start of the line, we need to behave like list markers and 
             // start ignoring spaces.
-            if (inlineFlowRequiresLineBox(o)) {
+            if (inlineFlowRequiresLineBox(flowBox)) {
                 isLineEmpty = false;
                 if (ignoringSpaces) {
                     trailingSpaceObject = 0;
@@ -1724,9 +1738,11 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                 }
             }
 
-            tmpW += o->marginLeft() + o->borderLeft() + o->paddingLeft() +
-                    o->marginRight() + o->borderRight() + o->paddingRight();
+            tmpW += flowBox->marginLeft() + flowBox->borderLeft() + flowBox->paddingLeft() +
+                    flowBox->marginRight() + flowBox->borderRight() + flowBox->paddingRight();
         } else if (o->isReplaced()) {
+            RenderBox* replacedBox = toRenderBox(o);
+
             // Break on replaced elements if either has normal white-space.
             if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!o->isImage() || allowImagesToBreak)) {
                 w += tmpW;
@@ -1756,18 +1772,19 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                     ignoringSpaces = true;
                 }
             } else
-                tmpW += o->width() + o->marginLeft() + o->marginRight() + inlineWidth(o);
+                tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
         } else if (o->isText()) {
             if (!pos)
                 appliedStartWidth = false;
 
-            RenderText* t = static_cast<RenderText*>(o);
+            RenderText* t = toRenderText(o);
 
             int strlen = t->textLength();
             int len = strlen - pos;
             const UChar* str = t->characters();
 
-            const Font& f = t->style(m_firstLine)->font();
+            const Font& f = t->style(firstLine)->font();
+            bool isFixedPitch = f.isFixedPitch();
 
             int lastSpace = pos;
             int wordSpacing = o->style()->wordSpacing();
@@ -1808,7 +1825,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                         if (pos)
                             beforeSoftHyphen = InlineIterator(0, o, pos - 1);
                         else
-                            beforeSoftHyphen = InlineIterator(0, last, last->isText() ? static_cast<RenderText*>(last)->textLength() - 1 : 0);
+                            beforeSoftHyphen = InlineIterator(0, last, last->isText() ? toRenderText(last)->textLength() - 1 : 0);
                         // Two consecutive soft hyphens. Avoid overlapping midpoints.
                         if (sNumMidpoints && smidpoints->at(sNumMidpoints - 1).obj == o && smidpoints->at(sNumMidpoints - 1).pos == pos)
                             sNumMidpoints--;
@@ -1816,12 +1833,12 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                             addMidpoint(beforeSoftHyphen);
 
                         // Add the width up to but not including the hyphen.
-                        tmpW += t->width(lastSpace, pos - lastSpace, f, w + tmpW) + lastSpaceWordSpacing;
+                        tmpW += textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
 
                         // For wrapping text only, include the hyphen.  We need to ensure it will fit
                         // on the line if it shows when we break.
                         if (autoWrap)
-                            tmpW += t->width(pos, 1, f, w + tmpW);
+                            tmpW += textWidth(t, pos, 1, f, w + tmpW, isFixedPitch, collapseWhiteSpace);
 
                         InlineIterator afterSoftHyphen(0, o, pos);
                         afterSoftHyphen.increment();
@@ -1841,7 +1858,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
 
                 if ((breakAll || breakWords) && !midWordBreak) {
                     wrapW += charWidth;
-                    charWidth = t->width(pos, 1, f, w + wrapW);
+                    charWidth = textWidth(t, pos, 1, f, w + wrapW, isFixedPitch, collapseWhiteSpace);
                     midWordBreak = w + wrapW + charWidth > width;
                 }
 
@@ -1866,7 +1883,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                         }
                     }
 
-                    int additionalTmpW = t->width(lastSpace, pos - lastSpace, f, w+tmpW) + lastSpaceWordSpacing;
+                    int additionalTmpW = textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
                     tmpW += additionalTmpW;
                     if (!appliedStartWidth) {
                         tmpW += inlineWidth(o, true, false);
@@ -1876,14 +1893,14 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                     applyWordSpacing =  wordSpacing && currentCharacterIsSpace && !previousCharacterIsSpace;
 
                     if (!w && autoWrap && tmpW > width)
-                        fitBelowFloats(tmpW, width);
+                        fitBelowFloats(tmpW, firstLine, width);
 
                     if (autoWrap || breakWords) {
                         // If we break only after white-space, consider the current character
                         // as candidate width for this line.
                         bool lineWasTooWide = false;
                         if (w + tmpW <= width && currentCharacterIsWS && o->style()->breakOnlyAfterWhiteSpace() && !midWordBreak) {
-                            int charWidth = t->width(pos, 1, f, w + tmpW) + (applyWordSpacing ? wordSpacing : 0);
+                            int charWidth = textWidth(t, pos, 1, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + (applyWordSpacing ? wordSpacing : 0);
                             // Check if line is too big even without the extra space
                             // at the end of the line. If it is not, do nothing. 
                             // If the line needs the extra whitespace to be too long, 
@@ -1898,7 +1915,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                             }
                         }
                         if (lineWasTooWide || w + tmpW > width) {
-                            if (lBreak.obj && shouldPreserveNewline(lBreak.obj) && lBreak.obj->isText() && !static_cast<RenderText*>(lBreak.obj)->isWordBreak() && static_cast<RenderText*>(lBreak.obj)->characters()[lBreak.pos] == '\n') {
+                            if (lBreak.obj && shouldPreserveNewline(lBreak.obj) && lBreak.obj->isText() && !toRenderText(lBreak.obj)->isWordBreak() && toRenderText(lBreak.obj)->characters()[lBreak.pos] == '\n') {
                                 if (!stoppedIgnoringSpaces && pos > 0) {
                                     // We need to stop right before the newline and then start up again.
                                     addMidpoint(InlineIterator(0, o, pos - 1)); // Stop
@@ -1913,7 +1930,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                                 tmpW -= additionalTmpW;
                             if (pos > 0 && str[pos-1] == softHyphen)
                                 // Subtract the width of the soft hyphen out since we fit on a line.
-                                tmpW -= t->width(pos-1, 1, f, w+tmpW);
+                                tmpW -= textWidth(t, pos - 1, 1, f, w + tmpW, isFixedPitch, collapseWhiteSpace);
                         }
                     }
 
@@ -2004,7 +2021,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
 
             // IMPORTANT: pos is > length here!
             if (!ignoringSpaces)
-                tmpW += t->width(lastSpace, pos - lastSpace, f, w+tmpW) + lastSpaceWordSpacing;
+                tmpW += textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
             tmpW += inlineWidth(o, !appliedStartWidth, true);
         } else
             ASSERT_NOT_REACHED();
@@ -2019,7 +2036,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                     checkForBreak = true;
                 else {
                     checkForBreak = false;
-                    RenderText* nextText = static_cast<RenderText*>(next);
+                    RenderText* nextText = toRenderText(next);
                     if (nextText->textLength()) {
                         UChar c = nextText->characters()[0];
                         if (c == ' ' || c == '\t' || (c == '\n' && !shouldPreserveNewline(next)))
@@ -2031,7 +2048,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
                         checkForBreak = true;
                     bool willFitOnLine = w + tmpW <= width;
                     if (!willFitOnLine && !w) {
-                        fitBelowFloats(tmpW, width);
+                        fitBelowFloats(tmpW, firstLine, width);
                         willFitOnLine = tmpW <= width;
                     }
                     bool canPlaceOnLine = willFitOnLine || !autoWrapWasEverTrueOnLine;
@@ -2054,7 +2071,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
             if (w)
                 goto end;
 
-            fitBelowFloats(tmpW, width);
+            fitBelowFloats(tmpW, firstLine, width);
 
             // |width| may have been adjusted because we got shoved down past a float (thus
             // giving us more room), so we need to retest, and only jump to
@@ -2094,8 +2111,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
     }
 
  end:
-
-    if (lBreak == resolver.position() && !lBreak.obj->isBR()) {
+    if (lBreak == resolver.position() && (!lBreak.obj || !lBreak.obj->isBR())) {
         // we just add as much as possible
         if (style()->whiteSpace() == PRE) {
             // FIXME: Don't really understand this case.
@@ -2143,7 +2159,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
         //    lBreak.pos--;
         else if (lBreak.obj == 0 && trailingSpaceObject->isText()) {
             // Add a new end midpoint that stops right at the very end.
-            RenderText* text = static_cast<RenderText *>(trailingSpaceObject);
+            RenderText* text = toRenderText(trailingSpaceObject);
             unsigned length = text->textLength();
             unsigned pos = length >= 2 ? length - 2 : UINT_MAX;
             InlineIterator endMid(0, trailingSpaceObject, pos);
@@ -2163,7 +2179,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
     if (lBreak.obj && lBreak.pos >= 2 && lBreak.obj->isText()) {
         // For soft hyphens on line breaks, we have to chop out the midpoints that made us
         // ignore the hyphen so that it will render at the end of the line.
-        UChar c = static_cast<RenderText*>(lBreak.obj)->characters()[lBreak.pos-1];
+        UChar c = toRenderText(lBreak.obj)->characters()[lBreak.pos-1];
         if (c == softHyphen)
             chopMidpointsAt(lBreak.obj, lBreak.pos-2);
     }
@@ -2173,7 +2189,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, ECle
 
 void RenderBlock::checkLinesForOverflow()
 {
-    m_overflowWidth = m_width;
+    m_overflowWidth = width();
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
         m_overflowLeft = min(curr->leftOverflow(), m_overflowLeft);
         m_overflowTop = min(curr->topOverflow(), m_overflowTop);
@@ -2205,16 +2221,18 @@ void RenderBlock::checkLinesForTextOverflow()
     // Include the scrollbar for overflow blocks, which means we want to use "contentWidth()"
     bool ltr = style()->direction() == LTR;
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-        int blockEdge = ltr ? rightOffset(curr->yPos()) : leftOffset(curr->yPos());
-        int lineBoxEdge = ltr ? curr->xPos() + curr->width() : curr->xPos();
-        if ((ltr && lineBoxEdge > blockEdge) || (!ltr && lineBoxEdge < blockEdge)) {
+        int blockRightEdge = rightOffset(curr->y(), curr == firstRootBox());
+        int blockLeftEdge = leftOffset(curr->y(), curr == firstRootBox());
+        int lineBoxEdge = ltr ? curr->x() + curr->width() : curr->x();
+        if ((ltr && lineBoxEdge > blockRightEdge) || (!ltr && lineBoxEdge < blockLeftEdge)) {
             // This line spills out of our box in the appropriate direction.  Now we need to see if the line
             // can be truncated.  In order for truncation to be possible, the line must have sufficient space to
             // accommodate our truncation string, and no replaced elements (images, tables) can overlap the ellipsis
             // space.
             int width = curr == firstRootBox() ? firstLineEllipsisWidth : ellipsisWidth;
+            int blockEdge = ltr ? blockRightEdge : blockLeftEdge;
             if (curr->canAccommodateEllipsis(ltr, blockEdge, lineBoxEdge, width))
-                curr->placeEllipsis(ellipsisStr, ltr, blockEdge, width);
+                curr->placeEllipsis(ellipsisStr, ltr, blockLeftEdge, blockRightEdge, width);
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/bidi.h b/src/3rdparty/webkit/WebCore/rendering/bidi.h
index fc6de5bf2b..9058eeba72 100644
--- a/src/3rdparty/webkit/WebCore/rendering/bidi.h
+++ b/src/3rdparty/webkit/WebCore/rendering/bidi.h
@@ -38,7 +38,6 @@ struct BidiRun : BidiCharacterRun {
         : BidiCharacterRun(start, stop, context, dir)
         , m_object(object)
         , m_box(0)
-        , m_compact(false)
     {
     }
 
@@ -59,7 +58,6 @@ private:
 public:
     RenderObject* m_object;
     InlineBox* m_box;
-    bool m_compact;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp b/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp
index 05748ac509..9b46cd2e34 100644
--- a/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/break_lines.cpp
@@ -68,7 +68,7 @@ static inline bool needsLineBreakIterator(UChar ch)
     return ch > 0x7F && ch != noBreakSpace;
 }
 
-#ifdef BUILDING_ON_TIGER
+#if PLATFORM(MAC) && defined(BUILDING_ON_TIGER)
 static inline TextBreakLocatorRef lineBreakLocator()
 {
     TextBreakLocatorRef locator = 0;
@@ -79,7 +79,7 @@ static inline TextBreakLocatorRef lineBreakLocator()
 
 int nextBreakablePosition(const UChar* str, int pos, int len, bool treatNoBreakSpaceAsBreak)
 {
-#ifndef BUILDING_ON_TIGER
+#if !PLATFORM(MAC) || !defined(BUILDING_ON_TIGER)
     TextBreakIterator* breakIterator = 0;
 #endif
     int nextBreak = -1;
@@ -93,7 +93,7 @@ int nextBreakablePosition(const UChar* str, int pos, int len, bool treatNoBreakS
 
         if (needsLineBreakIterator(ch) || needsLineBreakIterator(lastCh)) {
             if (nextBreak < i && i) {
-#ifndef BUILDING_ON_TIGER
+#if !PLATFORM(MAC) || !defined(BUILDING_ON_TIGER)
                 if (!breakIterator)
                     breakIterator = lineBreakIterator(str, len);
                 if (breakIterator)
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/ContentData.cpp b/src/3rdparty/webkit/WebCore/rendering/style/ContentData.cpp
index b38cc49a24..410cad4e88 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/ContentData.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/ContentData.cpp
@@ -30,22 +30,9 @@ namespace WebCore {
 
 void ContentData::clear()
 {
-    switch (m_type) {
-        case CONTENT_NONE:
-            break;
-        case CONTENT_OBJECT:
-            m_content.m_image->deref();
-            break;
-        case CONTENT_TEXT:
-            m_content.m_text->deref();
-            break;
-        case CONTENT_COUNTER:
-            delete m_content.m_counter;
-            break;
-    }
+    deleteContent();
 
     ContentData* n = m_next;
-    m_type = CONTENT_NONE;
     m_next = 0;
 
     // Reverse the list so we can delete without recursing.
@@ -63,4 +50,47 @@ void ContentData::clear()
     }
 }
 
+bool ContentData::dataEquivalent(const ContentData& other) const
+{
+    if (type() != other.type())
+        return false;
+
+    switch (type()) {
+        case CONTENT_NONE:
+            return true;
+            break;
+        case CONTENT_TEXT:
+            return equal(text(), other.text());
+            break;
+        case CONTENT_OBJECT:
+            return StyleImage::imagesEquivalent(image(), other.image());
+            break;
+        case CONTENT_COUNTER:
+            return *counter() == *other.counter();
+            break;
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void ContentData::deleteContent()
+{
+    switch (m_type) {
+        case CONTENT_NONE:
+            break;
+        case CONTENT_OBJECT:
+            m_content.m_image->deref();
+            break;
+        case CONTENT_TEXT:
+            m_content.m_text->deref();
+            break;
+        case CONTENT_COUNTER:
+            delete m_content.m_counter;
+            break;
+    }
+
+    m_type = CONTENT_NONE;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h b/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h
index d924d1a423..24d5f86f95 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/ContentData.h
@@ -25,16 +25,18 @@
 #ifndef ContentData_h
 #define ContentData_h
 
+#include "PlatformString.h"
 #include "RenderStyleConstants.h"
+#include "StringImpl.h"
+#include "StyleImage.h"
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
 class CounterContent;
-class StringImpl;
-class StyleImage;
 
 struct ContentData : Noncopyable {
+public:
     ContentData()
         : m_type(CONTENT_NONE)
         , m_next(0)
@@ -48,7 +50,49 @@ struct ContentData : Noncopyable {
 
     void clear();
 
-    ContentType m_type;
+    bool isCounter() const { return m_type == CONTENT_COUNTER; }
+    bool isImage() const { return m_type == CONTENT_OBJECT; }
+    bool isNone() const { return m_type == CONTENT_NONE; }
+    bool isText() const { return m_type == CONTENT_TEXT; }
+
+    StyleContentType type() const { return m_type; }
+
+    bool dataEquivalent(const ContentData&) const;
+
+    StyleImage* image() const { return m_content.m_image; }
+    void setImage(PassRefPtr<StyleImage> image)
+    {
+        deleteContent();
+        m_type = CONTENT_OBJECT;
+        m_content.m_image = image.releaseRef();
+    }
+
+    StringImpl* text() const { return m_content.m_text; }
+    void setText(PassRefPtr<StringImpl> text)
+    {
+        deleteContent();
+        m_type = CONTENT_TEXT;
+        m_content.m_text = text.releaseRef();
+    }
+
+    CounterContent* counter() const { return m_content.m_counter; }
+    void setCounter(CounterContent* counter)
+    {
+        deleteContent();
+        m_type = CONTENT_COUNTER;
+        m_content.m_counter = counter;
+    }
+
+    ContentData* next() const { return m_next; }
+    void setNext(ContentData* next)
+    {
+        m_next = next;
+    }
+
+private:
+    void deleteContent();
+
+    StyleContentType m_type;
     union {
         StyleImage* m_image;
         StringImpl* m_text;
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h b/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h
index 06440ad045..cf118132ee 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/CounterContent.h
@@ -49,11 +49,11 @@ private:
     AtomicString m_separator;
 };
 
-static inline bool operator!=(const CounterContent& a, const CounterContent& b)
+static inline bool operator==(const CounterContent& a, const CounterContent& b)
 {
-    return a.identifier() != b.identifier()
-        || a.listStyle() != b.listStyle()
-        || a.separator() != b.separator();
+    return a.identifier() == b.identifier()
+        && a.listStyle() == b.listStyle()
+        && a.separator() == b.separator();
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
index 872ee9c9d7..f3a2cd9048 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
@@ -32,9 +32,9 @@
 #include <wtf/StdLibExtras.h>
 #include <algorithm>
 
-namespace WebCore {
+using namespace std;
 
-TransformOperations RenderStyle::s_initialTransform;
+namespace WebCore {
 
 inline RenderStyle* defaultStyle()
 {
@@ -58,14 +58,7 @@ PassRefPtr<RenderStyle> RenderStyle::clone(const RenderStyle* other)
 }
 
 RenderStyle::RenderStyle()
-    : box(defaultStyle()->box)
-    , visual(defaultStyle()->visual)
-    , background(defaultStyle()->background)
-    , surround(defaultStyle()->surround)
-    , rareNonInheritedData(defaultStyle()->rareNonInheritedData)
-    , rareInheritedData(defaultStyle()->rareInheritedData)
-    , inherited(defaultStyle()->inherited)
-    , m_pseudoState(PseudoUnknown)
+    : m_pseudoState(PseudoUnknown)
     , m_affectedByAttributeSelectors(false)
     , m_unique(false)
     , m_affectedByEmpty(false)
@@ -78,6 +71,13 @@ RenderStyle::RenderStyle()
     , m_firstChildState(false)
     , m_lastChildState(false)
     , m_childIndex(0)
+    , box(defaultStyle()->box)
+    , visual(defaultStyle()->visual)
+    , background(defaultStyle()->background)
+    , surround(defaultStyle()->surround)
+    , rareNonInheritedData(defaultStyle()->rareNonInheritedData)
+    , rareInheritedData(defaultStyle()->rareInheritedData)
+    , inherited(defaultStyle()->inherited)
 #if ENABLE(SVG)
     , m_svgStyle(defaultStyle()->m_svgStyle)
 #endif
@@ -121,15 +121,6 @@ RenderStyle::RenderStyle(bool)
 
 RenderStyle::RenderStyle(const RenderStyle& o)
     : RefCounted<RenderStyle>()
-    , inherited_flags(o.inherited_flags)
-    , noninherited_flags(o.noninherited_flags)
-    , box(o.box)
-    , visual(o.visual)
-    , background(o.background)
-    , surround(o.surround)
-    , rareNonInheritedData(o.rareNonInheritedData)
-    , rareInheritedData(o.rareInheritedData)
-    , inherited(o.inherited)
     , m_pseudoState(o.m_pseudoState)
     , m_affectedByAttributeSelectors(false)
     , m_unique(false)
@@ -143,9 +134,18 @@ RenderStyle::RenderStyle(const RenderStyle& o)
     , m_firstChildState(false)
     , m_lastChildState(false)
     , m_childIndex(0)
+    , box(o.box)
+    , visual(o.visual)
+    , background(o.background)
+    , surround(o.surround)
+    , rareNonInheritedData(o.rareNonInheritedData)
+    , rareInheritedData(o.rareInheritedData)
+    , inherited(o.inherited)
 #if ENABLE(SVG)
     , m_svgStyle(o.m_svgStyle)
 #endif
+    , inherited_flags(o.inherited_flags)
+    , noninherited_flags(o.noninherited_flags)
 {
 }
 
@@ -187,7 +187,7 @@ bool RenderStyle::isStyleAvailable() const
     return this != CSSStyleSelector::styleNotYetAvailable();
 }
 
-static inline int pseudoBit(RenderStyle::PseudoId pseudo)
+static inline int pseudoBit(PseudoId pseudo)
 {
     return 1 << (pseudo - 1);
 }
@@ -235,7 +235,7 @@ bool RenderStyle::inheritedNotEqual(RenderStyle* other) const
            rareInheritedData != other->rareInheritedData;
 }
 
-bool positionedObjectMoved(const LengthBox& a, const LengthBox& b)
+static bool positionedObjectMoved(const LengthBox& a, const LengthBox& b)
 {
     // If any unit types are different, then we can't guarantee
     // that this was just a movement.
@@ -273,14 +273,16 @@ bool positionedObjectMoved(const LengthBox& a, const LengthBox& b)
   optimisations are unimplemented, and currently result in the
   worst case result causing a relayout of the containing block.
 */
-RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
+StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedContextSensitiveProperties) const
 {
+    changedContextSensitiveProperties = ContextSensitivePropertyNone;
+
 #if ENABLE(SVG)
     // This is horribly inefficient.  Eventually we'll have to integrate
     // this more directly by calling: Diff svgDiff = svgStyle->diff(other)
     // and then checking svgDiff and returning from the appropriate places below.
     if (m_svgStyle != other->m_svgStyle)
-        return Layout;
+        return StyleDifferenceLayout;
 #endif
 
     if (box->width != other->box->width ||
@@ -289,19 +291,19 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
         box->height != other->box->height ||
         box->min_height != other->box->min_height ||
         box->max_height != other->box->max_height)
-        return Layout;
+        return StyleDifferenceLayout;
 
     if (box->vertical_align != other->box->vertical_align || noninherited_flags._vertical_align != other->noninherited_flags._vertical_align)
-        return Layout;
+        return StyleDifferenceLayout;
 
     if (box->boxSizing != other->box->boxSizing)
-        return Layout;
+        return StyleDifferenceLayout;
 
     if (surround->margin != other->surround->margin)
-        return Layout;
+        return StyleDifferenceLayout;
 
     if (surround->padding != other->surround->padding)
-        return Layout;
+        return StyleDifferenceLayout;
 
     if (rareNonInheritedData.get() != other->rareNonInheritedData.get()) {
         if (rareNonInheritedData->m_appearance != other->rareNonInheritedData->m_appearance ||
@@ -309,30 +311,47 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
             rareNonInheritedData->marginBottomCollapse != other->rareNonInheritedData->marginBottomCollapse ||
             rareNonInheritedData->lineClamp != other->rareNonInheritedData->lineClamp ||
             rareNonInheritedData->textOverflow != other->rareNonInheritedData->textOverflow)
-            return Layout;
+            return StyleDifferenceLayout;
 
         if (rareNonInheritedData->flexibleBox.get() != other->rareNonInheritedData->flexibleBox.get() &&
             *rareNonInheritedData->flexibleBox.get() != *other->rareNonInheritedData->flexibleBox.get())
-            return Layout;
+            return StyleDifferenceLayout;
 
         if (!rareNonInheritedData->shadowDataEquivalent(*other->rareNonInheritedData.get()))
-            return Layout;
+            return StyleDifferenceLayout;
 
         if (!rareNonInheritedData->reflectionDataEquivalent(*other->rareNonInheritedData.get()))
-            return Layout;
+            return StyleDifferenceLayout;
 
         if (rareNonInheritedData->m_multiCol.get() != other->rareNonInheritedData->m_multiCol.get() &&
             *rareNonInheritedData->m_multiCol.get() != *other->rareNonInheritedData->m_multiCol.get())
-            return Layout;
+            return StyleDifferenceLayout;
 
         if (rareNonInheritedData->m_transform.get() != other->rareNonInheritedData->m_transform.get() &&
-            *rareNonInheritedData->m_transform.get() != *other->rareNonInheritedData->m_transform.get())
-            return Layout;
+            *rareNonInheritedData->m_transform.get() != *other->rareNonInheritedData->m_transform.get()) {
+#if USE(ACCELERATED_COMPOSITING)
+            changedContextSensitiveProperties |= ContextSensitivePropertyTransform;
+            // Don't return; keep looking for another change
+#else
+            return StyleDifferenceLayout;
+#endif
+        }
+
+#if !USE(ACCELERATED_COMPOSITING)
+        if (rareNonInheritedData.get() != other->rareNonInheritedData.get()) {
+            if (rareNonInheritedData->m_transformStyle3D != other->rareNonInheritedData->m_transformStyle3D ||
+                rareNonInheritedData->m_backfaceVisibility != other->rareNonInheritedData->m_backfaceVisibility ||
+                rareNonInheritedData->m_perspective != other->rareNonInheritedData->m_perspective ||
+                rareNonInheritedData->m_perspectiveOriginX != other->rareNonInheritedData->m_perspectiveOriginX ||
+                rareNonInheritedData->m_perspectiveOriginY != other->rareNonInheritedData->m_perspectiveOriginY)
+                return StyleDifferenceLayout;
+        }
+#endif
 
 #if ENABLE(DASHBOARD_SUPPORT)
         // If regions change, trigger a relayout to re-calc regions.
         if (rareNonInheritedData->m_dashboardRegions != other->rareNonInheritedData->m_dashboardRegions)
-            return Layout;
+            return StyleDifferenceLayout;
 #endif
     }
 
@@ -344,13 +363,13 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
             rareInheritedData->nbspMode != other->rareInheritedData->nbspMode ||
             rareInheritedData->khtmlLineBreak != other->rareInheritedData->khtmlLineBreak ||
             rareInheritedData->textSecurity != other->rareInheritedData->textSecurity)
-            return Layout;
+            return StyleDifferenceLayout;
 
         if (!rareInheritedData->shadowDataEquivalent(*other->rareInheritedData.get()))
-            return Layout;
+            return StyleDifferenceLayout;
 
         if (textStrokeWidth() != other->textStrokeWidth())
-            return Layout;
+            return StyleDifferenceLayout;
     }
 
     if (inherited->indent != other->inherited->indent ||
@@ -365,7 +384,7 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
         noninherited_flags._position != other->noninherited_flags._position ||
         noninherited_flags._floating != other->noninherited_flags._floating ||
         noninherited_flags._originalDisplay != other->noninherited_flags._originalDisplay)
-        return Layout;
+        return StyleDifferenceLayout;
 
 
     if (((int)noninherited_flags._effectiveDisplay) >= TABLE) {
@@ -373,26 +392,26 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
             inherited_flags._empty_cells != other->inherited_flags._empty_cells ||
             inherited_flags._caption_side != other->inherited_flags._caption_side ||
             noninherited_flags._table_layout != other->noninherited_flags._table_layout)
-            return Layout;
+            return StyleDifferenceLayout;
 
         // In the collapsing border model, 'hidden' suppresses other borders, while 'none'
         // does not, so these style differences can be width differences.
         if (inherited_flags._border_collapse &&
-            (borderTopStyle() == BHIDDEN && other->borderTopStyle() == BNONE ||
-             borderTopStyle() == BNONE && other->borderTopStyle() == BHIDDEN ||
-             borderBottomStyle() == BHIDDEN && other->borderBottomStyle() == BNONE ||
-             borderBottomStyle() == BNONE && other->borderBottomStyle() == BHIDDEN ||
-             borderLeftStyle() == BHIDDEN && other->borderLeftStyle() == BNONE ||
-             borderLeftStyle() == BNONE && other->borderLeftStyle() == BHIDDEN ||
-             borderRightStyle() == BHIDDEN && other->borderRightStyle() == BNONE ||
-             borderRightStyle() == BNONE && other->borderRightStyle() == BHIDDEN))
-            return Layout;
+            ((borderTopStyle() == BHIDDEN && other->borderTopStyle() == BNONE) ||
+             (borderTopStyle() == BNONE && other->borderTopStyle() == BHIDDEN) ||
+             (borderBottomStyle() == BHIDDEN && other->borderBottomStyle() == BNONE) ||
+             (borderBottomStyle() == BNONE && other->borderBottomStyle() == BHIDDEN) ||
+             (borderLeftStyle() == BHIDDEN && other->borderLeftStyle() == BNONE) ||
+             (borderLeftStyle() == BNONE && other->borderLeftStyle() == BHIDDEN) ||
+             (borderRightStyle() == BHIDDEN && other->borderRightStyle() == BNONE) ||
+             (borderRightStyle() == BNONE && other->borderRightStyle() == BHIDDEN)))
+            return StyleDifferenceLayout;
     }
 
     if (noninherited_flags._effectiveDisplay == LIST_ITEM) {
         if (inherited_flags._list_style_type != other->inherited_flags._list_style_type ||
             inherited_flags._list_style_position != other->inherited_flags._list_style_position)
-            return Layout;
+            return StyleDifferenceLayout;
     }
 
     if (inherited_flags._text_align != other->inherited_flags._text_align ||
@@ -400,12 +419,12 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
         inherited_flags._direction != other->inherited_flags._direction ||
         inherited_flags._white_space != other->inherited_flags._white_space ||
         noninherited_flags._clear != other->noninherited_flags._clear)
-        return Layout;
+        return StyleDifferenceLayout;
 
     // Overflow returns a layout hint.
     if (noninherited_flags._overflowX != other->noninherited_flags._overflowX ||
         noninherited_flags._overflowY != other->noninherited_flags._overflowY)
-        return Layout;
+        return StyleDifferenceLayout;
 
     // If our border widths change, then we need to layout.  Other changes to borders
     // only necessitate a repaint.
@@ -413,19 +432,19 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
         borderTopWidth() != other->borderTopWidth() ||
         borderBottomWidth() != other->borderBottomWidth() ||
         borderRightWidth() != other->borderRightWidth())
-        return Layout;
+        return StyleDifferenceLayout;
 
     // If the counter directives change, trigger a relayout to re-calculate counter values and rebuild the counter node tree.
     const CounterDirectiveMap* mapA = rareNonInheritedData->m_counterDirectives.get();
     const CounterDirectiveMap* mapB = other->rareNonInheritedData->m_counterDirectives.get();
     if (!(mapA == mapB || (mapA && mapB && *mapA == *mapB)))
-        return Layout;
+        return StyleDifferenceLayout;
     if (visual->counterIncrement != other->visual->counterIncrement ||
         visual->counterReset != other->visual->counterReset)
-        return Layout;
+        return StyleDifferenceLayout;
 
     if (inherited->m_effectiveZoom != other->inherited->m_effectiveZoom)
-        return Layout;
+        return StyleDifferenceLayout;
 
     // Make sure these left/top/right/bottom checks stay below all layout checks and above
     // all visible checks.
@@ -433,7 +452,7 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
         if (surround->offset != other->surround->offset) {
              // Optimize for the case where a positioned layer is moving but not changing size.
             if (position() == AbsolutePosition && positionedObjectMoved(surround->offset, other->surround->offset))
-                return LayoutPositionedMovementOnly;
+                return StyleDifferenceLayoutPositionedMovementOnly;
 
             // FIXME: We will need to do a bit of work in RenderObject/Box::setStyle before we
             // can stop doing a layout when relative positioned objects move.  In particular, we'll need
@@ -441,16 +460,24 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
             //if (other->position() == RelativePosition)
             //    return RepaintLayer;
             //else
-                return Layout;
+                return StyleDifferenceLayout;
         } else if (box->z_index != other->box->z_index || box->z_auto != other->box->z_auto ||
                  visual->clip != other->visual->clip || visual->hasClip != other->visual->hasClip)
-            return RepaintLayer;
+            return StyleDifferenceRepaintLayer;
+    }
+
+    if (rareNonInheritedData->opacity != other->rareNonInheritedData->opacity) {
+#if USE(ACCELERATED_COMPOSITING)
+        changedContextSensitiveProperties |= ContextSensitivePropertyOpacity;
+        // Don't return; keep looking for another change.
+#else
+        return StyleDifferenceRepaintLayer;
+#endif
     }
 
-    if (rareNonInheritedData->opacity != other->rareNonInheritedData->opacity ||
-        rareNonInheritedData->m_mask != other->rareNonInheritedData->m_mask ||
+    if (rareNonInheritedData->m_mask != other->rareNonInheritedData->m_mask ||
         rareNonInheritedData->m_maskBoxImage != other->rareNonInheritedData->m_maskBoxImage)
-        return RepaintLayer;
+        return StyleDifferenceRepaintLayer;
 
     if (inherited->color != other->inherited->color ||
         inherited_flags._visibility != other->inherited_flags._visibility ||
@@ -465,19 +492,30 @@ RenderStyle::Diff RenderStyle::diff(const RenderStyle* other) const
         rareNonInheritedData->m_borderFit != other->rareNonInheritedData->m_borderFit ||
         rareInheritedData->textFillColor != other->rareInheritedData->textFillColor ||
         rareInheritedData->textStrokeColor != other->rareInheritedData->textStrokeColor)
-        return Repaint;
+        return StyleDifferenceRepaint;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (rareNonInheritedData.get() != other->rareNonInheritedData.get()) {
+        if (rareNonInheritedData->m_transformStyle3D != other->rareNonInheritedData->m_transformStyle3D ||
+            rareNonInheritedData->m_backfaceVisibility != other->rareNonInheritedData->m_backfaceVisibility ||
+            rareNonInheritedData->m_perspective != other->rareNonInheritedData->m_perspective ||
+            rareNonInheritedData->m_perspectiveOriginX != other->rareNonInheritedData->m_perspectiveOriginX ||
+            rareNonInheritedData->m_perspectiveOriginY != other->rareNonInheritedData->m_perspectiveOriginY)
+            return StyleDifferenceRecompositeLayer;
+    }
+#endif
 
     // Cursors are not checked, since they will be set appropriately in response to mouse events,
     // so they don't need to cause any repaint or layout.
 
     // Animations don't need to be checked either.  We always set the new style on the RenderObject, so we will get a chance to fire off
     // the resulting transition properly.
-    return Equal;
+    return StyleDifferenceEqual;
 }
 
 void RenderStyle::setClip(Length top, Length right, Length bottom, Length left)
 {
-    StyleVisualData *data = visual.access();
+    StyleVisualData* data = visual.access();
     data->clip.m_top = top;
     data->clip.m_right = right;
     data->clip.m_bottom = bottom;
@@ -501,40 +539,8 @@ void RenderStyle::setCursorList(PassRefPtr<CursorList> other)
 
 void RenderStyle::clearCursorList()
 {
-    inherited.access()->cursorData = CursorList::create();
-}
-
-bool RenderStyle::contentDataEquivalent(const RenderStyle* otherStyle) const
-{
-    ContentData* c1 = rareNonInheritedData->m_content.get();
-    ContentData* c2 = otherStyle->rareNonInheritedData->m_content.get();
-
-    while (c1 && c2) {
-        if (c1->m_type != c2->m_type)
-            return false;
-
-        switch (c1->m_type) {
-            case CONTENT_NONE:
-                break;
-            case CONTENT_TEXT:
-                if (!equal(c1->m_content.m_text, c2->m_content.m_text))
-                    return false;
-                break;
-            case CONTENT_OBJECT:
-                if (!StyleImage::imagesEquivalent(c1->m_content.m_image, c2->m_content.m_image))
-                    return false;
-                break;
-            case CONTENT_COUNTER:
-                if (*c1->m_content.m_counter != *c2->m_content.m_counter)
-                    return false;
-                break;
-        }
-
-        c1 = c1->m_next;
-        c2 = c2->m_next;
-    }
-
-    return !c1 && !c2;
+    if (inherited->cursorData)
+        inherited.access()->cursorData = 0;
 }
 
 void RenderStyle::clearContent()
@@ -550,8 +556,8 @@ void RenderStyle::setContent(PassRefPtr<StyleImage> image, bool add)
 
     OwnPtr<ContentData>& content = rareNonInheritedData.access()->m_content;
     ContentData* lastContent = content.get();
-    while (lastContent && lastContent->m_next)
-        lastContent = lastContent->m_next;
+    while (lastContent && lastContent->next())
+        lastContent = lastContent->next();
 
     bool reuseContent = !add;
     ContentData* newContentData;
@@ -562,34 +568,30 @@ void RenderStyle::setContent(PassRefPtr<StyleImage> image, bool add)
         newContentData = new ContentData;
 
     if (lastContent && !reuseContent)
-        lastContent->m_next = newContentData;
+        lastContent->setNext(newContentData);
     else
         content.set(newContentData);
 
-    newContentData->m_content.m_image = image.releaseRef();
-    newContentData->m_type = CONTENT_OBJECT;
+    newContentData->setImage(image);
 }
 
-void RenderStyle::setContent(StringImpl* s, bool add)
+void RenderStyle::setContent(PassRefPtr<StringImpl> s, bool add)
 {
     if (!s)
         return; // The string is null. Nothing to do. Just bail.
 
     OwnPtr<ContentData>& content = rareNonInheritedData.access()->m_content;
     ContentData* lastContent = content.get();
-    while (lastContent && lastContent->m_next)
-        lastContent = lastContent->m_next;
+    while (lastContent && lastContent->next())
+        lastContent = lastContent->next();
 
     bool reuseContent = !add;
     if (add && lastContent) {
-        if (lastContent->m_type == CONTENT_TEXT) {
+        if (lastContent->isText()) {
             // We can augment the existing string and share this ContentData node.
-            StringImpl* oldStr = lastContent->m_content.m_text;
-            String newStr = oldStr;
-            newStr.append(s);
-            newStr.impl()->ref();
-            oldStr->deref();
-            lastContent->m_content.m_text = newStr.impl();
+            String newStr = lastContent->text();
+            newStr.append(s.get());
+            lastContent->setText(newStr.impl());
             return;
         }
     }
@@ -602,13 +604,11 @@ void RenderStyle::setContent(StringImpl* s, bool add)
         newContentData = new ContentData;
 
     if (lastContent && !reuseContent)
-        lastContent->m_next = newContentData;
+        lastContent->setNext(newContentData);
     else
         content.set(newContentData);
 
-    newContentData->m_content.m_text = s;
-    newContentData->m_content.m_text->ref();
-    newContentData->m_type = CONTENT_TEXT;
+    newContentData->setText(s);
 }
 
 void RenderStyle::setContent(CounterContent* c, bool add)
@@ -618,8 +618,8 @@ void RenderStyle::setContent(CounterContent* c, bool add)
 
     OwnPtr<ContentData>& content = rareNonInheritedData.access()->m_content;
     ContentData* lastContent = content.get();
-    while (lastContent && lastContent->m_next)
-        lastContent = lastContent->m_next;
+    while (lastContent && lastContent->next())
+        lastContent = lastContent->next();
 
     bool reuseContent = !add;
     ContentData* newContentData = 0;
@@ -630,15 +630,14 @@ void RenderStyle::setContent(CounterContent* c, bool add)
         newContentData = new ContentData;
 
     if (lastContent && !reuseContent)
-        lastContent->m_next = newContentData;
+        lastContent->setNext(newContentData);
     else
         content.set(newContentData);
 
-    newContentData->m_content.m_counter = c;
-    newContentData->m_type = CONTENT_COUNTER;
+    newContentData->setCounter(c);
 }
 
-void RenderStyle::applyTransform(TransformationMatrix& transform, const IntSize& borderBoxSize, bool includeTransformOrigin) const
+void RenderStyle::applyTransform(TransformationMatrix& transform, const IntSize& borderBoxSize, ApplyTransformOrigin applyOrigin) const
 {
     // transform-origin brackets the transform with translate operations.
     // Optimize for the case where the only transform is a translation, since the transform-origin is irrelevant
@@ -646,26 +645,31 @@ void RenderStyle::applyTransform(TransformationMatrix& transform, const IntSize&
     bool applyTransformOrigin = false;
     unsigned s = rareNonInheritedData->m_transform->m_operations.operations().size();
     unsigned i;
-    if (includeTransformOrigin) {
+    if (applyOrigin == IncludeTransformOrigin) {
         for (i = 0; i < s; i++) {
             TransformOperation::OperationType type = rareNonInheritedData->m_transform->m_operations.operations()[i]->getOperationType();
             if (type != TransformOperation::TRANSLATE_X &&
                     type != TransformOperation::TRANSLATE_Y &&
-                    type != TransformOperation::TRANSLATE) {
+                    type != TransformOperation::TRANSLATE && 
+                    type != TransformOperation::TRANSLATE_Z && 
+                    type != TransformOperation::TRANSLATE_3D
+                    ) {
                 applyTransformOrigin = true;
                 break;
             }
         }
     }
 
-    if (applyTransformOrigin)
-        transform.translate(transformOriginX().calcFloatValue(borderBoxSize.width()), transformOriginY().calcFloatValue(borderBoxSize.height()));
+    if (applyTransformOrigin) {
+        transform.translate3d(transformOriginX().calcFloatValue(borderBoxSize.width()), transformOriginY().calcFloatValue(borderBoxSize.height()), transformOriginZ());
+    }
 
     for (i = 0; i < s; i++)
         rareNonInheritedData->m_transform->m_operations.operations()[i]->apply(transform, borderBoxSize);
 
-    if (applyTransformOrigin)
-        transform.translate(-transformOriginX().calcFloatValue(borderBoxSize.width()), -transformOriginY().calcFloatValue(borderBoxSize.height()));
+    if (applyTransformOrigin) {
+        transform.translate3d(-transformOriginX().calcFloatValue(borderBoxSize.width()), -transformOriginY().calcFloatValue(borderBoxSize.height()), -transformOriginZ());
+    }
 }
 
 #if ENABLE(XBL)
@@ -707,6 +711,58 @@ void RenderStyle::setBoxShadow(ShadowData* shadowData, bool add)
     rareData->m_boxShadow.set(shadowData);
 }
 
+void RenderStyle::getBorderRadiiForRect(const IntRect& r, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight) const
+{
+    topLeft = surround->border.topLeft;
+    topRight = surround->border.topRight;
+    
+    bottomLeft = surround->border.bottomLeft;
+    bottomRight = surround->border.bottomRight;
+
+    // Constrain corner radii using CSS3 rules:
+    // http://www.w3.org/TR/css3-background/#the-border-radius
+    
+    float factor = 1;
+    unsigned radiiSum;
+
+    // top
+    radiiSum = static_cast<unsigned>(topLeft.width()) + static_cast<unsigned>(topRight.width()); // Casts to avoid integer overflow.
+    if (radiiSum > static_cast<unsigned>(r.width()))
+        factor = min(static_cast<float>(r.width()) / radiiSum, factor);
+
+    // bottom
+    radiiSum = static_cast<unsigned>(bottomLeft.width()) + static_cast<unsigned>(bottomRight.width());
+    if (radiiSum > static_cast<unsigned>(r.width()))
+        factor = min(static_cast<float>(r.width()) / radiiSum, factor);
+    
+    // left
+    radiiSum = static_cast<unsigned>(topLeft.height()) + static_cast<unsigned>(bottomLeft.height());
+    if (radiiSum > static_cast<unsigned>(r.height()))
+        factor = min(static_cast<float>(r.height()) / radiiSum, factor);
+    
+    // right
+    radiiSum = static_cast<unsigned>(topRight.height()) + static_cast<unsigned>(bottomRight.height());
+    if (radiiSum > static_cast<unsigned>(r.height()))
+        factor = min(static_cast<float>(r.height()) / radiiSum, factor);
+    
+    // Scale all radii by f if necessary.
+    if (factor < 1) {
+        // If either radius on a corner becomes zero, reset both radii on that corner.
+        topLeft.scale(factor);
+        if (!topLeft.width() || !topLeft.height())
+            topLeft = IntSize();
+        topRight.scale(factor);
+        if (!topRight.width() || !topRight.height())
+            topRight = IntSize();
+        bottomLeft.scale(factor);
+        if (!bottomLeft.width() || !bottomLeft.height())
+            bottomLeft = IntSize();
+        bottomRight.scale(factor);
+        if (!bottomRight.width() || !bottomRight.height())
+            bottomRight = IntSize();
+    }
+}
+
 const CounterDirectiveMap* RenderStyle::counterDirectives() const
 {
     return rareNonInheritedData->m_counterDirectives.get();
@@ -753,7 +809,7 @@ void RenderStyle::adjustAnimations()
     if (!animationList)
         return;
 
-    // get rid of empty transitions and anything beyond them
+    // Get rid of empty animations and anything beyond them
     for (size_t i = 0; i < animationList->size(); ++i) {
         if (animationList->animation(i)->isEmpty()) {
             animationList->resize(i);
@@ -776,7 +832,7 @@ void RenderStyle::adjustTransitions()
     if (!transitionList)
         return;
 
-    // get rid of empty transitions and anything beyond them
+    // Get rid of empty transitions and anything beyond them
     for (size_t i = 0; i < transitionList->size(); ++i) {
         if (transitionList->animation(i)->isEmpty()) {
             transitionList->resize(i);
@@ -819,7 +875,7 @@ AnimationList* RenderStyle::accessTransitions()
     return rareNonInheritedData->m_transitions.get();
 }
 
-const Animation* RenderStyle::transitionForProperty(int property)
+const Animation* RenderStyle::transitionForProperty(int property) const
 {
     if (transitions()) {
         for (size_t i = 0; i < transitions()->size(); ++i) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
index f38f94312c..a390ea3fff 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
@@ -106,20 +106,46 @@ class StyleImage;
 
 class RenderStyle: public RefCounted<RenderStyle> {
     friend class CSSStyleSelector;
+protected:
 
-public:
-    // static pseudo styles. Dynamic ones are produced on the fly.
-    enum PseudoId { NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
-                    SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
-                    MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIME_DISPLAY,
-                    MEDIA_CONTROLS_SEEK_BACK_BUTTON, MEDIA_CONTROLS_SEEK_FORWARD_BUTTON , MEDIA_CONTROLS_FULLSCREEN_BUTTON,
-                    SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER };
-    static const int FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON;
+    // The following bitfield is 32-bits long, which optimizes padding with the
+    // int refCount in the base class. Beware when adding more bits.
+    unsigned m_pseudoState : 3; // PseudoState
+    bool m_affectedByAttributeSelectors : 1;
+    bool m_unique : 1;
 
-private:
-    static TransformOperations s_initialTransform;
+    // Bits for dynamic child matching.
+    bool m_affectedByEmpty : 1;
+    bool m_emptyState : 1;
 
-protected:
+    // We optimize for :first-child and :last-child.  The other positional child selectors like nth-child or
+    // *-child-of-type, we will just give up and re-evaluate whenever children change at all.
+    bool m_childrenAffectedByFirstChildRules : 1;
+    bool m_childrenAffectedByLastChildRules : 1;
+    bool m_childrenAffectedByDirectAdjacentRules : 1;
+    bool m_childrenAffectedByForwardPositionalRules : 1;
+    bool m_childrenAffectedByBackwardPositionalRules : 1;
+    bool m_firstChildState : 1;
+    bool m_lastChildState : 1;
+    unsigned m_childIndex : 18; // Plenty of bits to cache an index.
+
+    // non-inherited attributes
+    DataRef<StyleBoxData> box;
+    DataRef<StyleVisualData> visual;
+    DataRef<StyleBackgroundData> background;
+    DataRef<StyleSurroundData> surround;
+    DataRef<StyleRareNonInheritedData> rareNonInheritedData;
+
+    // inherited attributes
+    DataRef<StyleRareInheritedData> rareInheritedData;
+    DataRef<StyleInheritedData> inherited;
+
+    // list of associated pseudo styles
+    RefPtr<RenderStyle> m_cachedPseudoStyle;
+
+#if ENABLE(SVG)
+    DataRef<SVGRenderStyle> m_svgStyle;
+#endif
 
 // !START SYNC!: Keep this in sync with the copy constructor in RenderStyle.cpp
 
@@ -162,12 +188,14 @@ protected:
         bool _border_collapse : 1 ;
         unsigned _white_space : 3; // EWhiteSpace
         unsigned _box_direction : 1; // EBoxDirection (CSS3 box_direction property, flexible box layout module)
-
+        // 32 bits
+        
         // non CSS2 inherited
         bool _visuallyOrdered : 1;
-        bool _htmlHacks :1;
+        bool _htmlHacks : 1;
         bool _force_backgrounds_to_white : 1;
         unsigned _pointerEvents : 4; // EPointerEvents
+        // 39 bits
     } inherited_flags;
 
 // don't inherit
@@ -214,45 +242,9 @@ protected:
         bool _affectedByDrag : 1;
         unsigned _pseudoBits : 7;
         unsigned _unicodeBidi : 2; // EUnicodeBidi
+        // 48 bits
     } noninherited_flags;
 
-    // non-inherited attributes
-    DataRef<StyleBoxData> box;
-    DataRef<StyleVisualData> visual;
-    DataRef<StyleBackgroundData> background;
-    DataRef<StyleSurroundData> surround;
-    DataRef<StyleRareNonInheritedData> rareNonInheritedData;
-
-    // inherited attributes
-    DataRef<StyleRareInheritedData> rareInheritedData;
-    DataRef<StyleInheritedData> inherited;
-
-    // list of associated pseudo styles
-    RefPtr<RenderStyle> m_cachedPseudoStyle;
-
-    unsigned m_pseudoState : 3; // PseudoState
-    bool m_affectedByAttributeSelectors : 1;
-    bool m_unique : 1;
-
-    // Bits for dynamic child matching.
-    bool m_affectedByEmpty : 1;
-    bool m_emptyState : 1;
-
-    // We optimize for :first-child and :last-child.  The other positional child selectors like nth-child or
-    // *-child-of-type, we will just give up and re-evaluate whenever children change at all.
-    bool m_childrenAffectedByFirstChildRules : 1;
-    bool m_childrenAffectedByLastChildRules : 1;
-    bool m_childrenAffectedByDirectAdjacentRules : 1;
-    bool m_childrenAffectedByForwardPositionalRules : 1;
-    bool m_childrenAffectedByBackwardPositionalRules : 1;
-    bool m_firstChildState : 1;
-    bool m_lastChildState : 1;
-    unsigned m_childIndex : 18; // Plenty of bits to cache an index.
-
-#if ENABLE(SVG)
-    DataRef<SVGRenderStyle> m_svgStyle;
-#endif
-
 // !END SYNC!
 
 protected:
@@ -337,6 +329,7 @@ public:
             return true;
         return background->m_background.hasImage();
     }
+    bool hasBackgroundImage() const { return background->m_background.hasImage(); }
     bool hasFixedBackgroundImage() const { return background->m_background.hasFixedImage(); }
     bool hasAppearance() const { return appearance() != NoControlPart; }
 
@@ -358,6 +351,11 @@ public:
     Length top() const { return surround->offset.top(); }
     Length bottom() const { return surround->offset.bottom(); }
 
+    // Whether or not a positioned element requires normal flow x/y to be computed
+    // to determine its position.
+    bool hasStaticX() const { return (left().isAuto() && right().isAuto()) || left().isStatic() || right().isStatic(); }
+    bool hasStaticY() const { return (top().isAuto() && bottom().isAuto()) || top().isStatic(); }
+
     EPosition position() const { return static_cast<EPosition>(noninherited_flags._position); }
     EFloat floating() const { return static_cast<EFloat>(noninherited_flags._floating); }
 
@@ -448,6 +446,19 @@ public:
 
     TextDirection direction() const { return static_cast<TextDirection>(inherited_flags._direction); }
     Length lineHeight() const { return inherited->line_height; }
+    int computedLineHeight() const
+    {
+        Length lh = lineHeight();
+
+        // Negative value means the line height is not set.  Use the font's built-in spacing.
+        if (lh.isNegative())
+            return font().lineSpacing();
+
+        if (lh.isPercent())
+            return lh.calcMinValue(fontSize());
+
+        return lh.value();
+    }
 
     EWhiteSpace whiteSpace() const { return static_cast<EWhiteSpace>(inherited_flags._white_space); }
     static bool autoWrap(EWhiteSpace ws)
@@ -630,8 +641,16 @@ public:
     const TransformOperations& transform() const { return rareNonInheritedData->m_transform->m_operations; }
     Length transformOriginX() const { return rareNonInheritedData->m_transform->m_x; }
     Length transformOriginY() const { return rareNonInheritedData->m_transform->m_y; }
+    float transformOriginZ() const { return rareNonInheritedData->m_transform->m_z; }
     bool hasTransform() const { return !rareNonInheritedData->m_transform->m_operations.operations().isEmpty(); }
-    void applyTransform(TransformationMatrix&, const IntSize& borderBoxSize, bool includeTransformOrigin = true) const;
+    
+    // Return true if any transform related property (currently transform, transformStyle3D or perspective) 
+    // indicates that we are transforming
+    bool hasTransformRelatedProperty() const { return hasTransform() || preserves3D() || hasPerspective(); }
+
+    enum ApplyTransformOrigin { IncludeTransformOrigin, ExcludeTransformOrigin };
+    void applyTransform(TransformationMatrix&, const IntSize& borderBoxSize, ApplyTransformOrigin = IncludeTransformOrigin) const;
+
     bool hasMask() const { return rareNonInheritedData->m_mask.hasImage() || rareNonInheritedData->m_maskBoxImage.hasImage(); }
     // End CSS3 Getters
 
@@ -647,7 +666,21 @@ public:
     bool hasTransitions() const { return rareNonInheritedData->m_transitions && rareNonInheritedData->m_transitions->size() > 0; }
 
     // return the first found Animation (including 'all' transitions)
-    const Animation* transitionForProperty(int property);
+    const Animation* transitionForProperty(int property) const;
+
+    ETransformStyle3D transformStyle3D() const { return rareNonInheritedData->m_transformStyle3D; }
+    bool preserves3D() const { return rareNonInheritedData->m_transformStyle3D == TransformStyle3DPreserve3D; }
+
+    EBackfaceVisibility backfaceVisibility() const { return rareNonInheritedData->m_backfaceVisibility; }
+    float perspective() const { return rareNonInheritedData->m_perspective; }
+    bool hasPerspective() const { return rareNonInheritedData->m_perspective > 0; }
+    Length perspectiveOriginX() const { return rareNonInheritedData->m_perspectiveOriginX; }
+    Length perspectiveOriginY() const { return rareNonInheritedData->m_perspectiveOriginY; }
+    
+#if USE(ACCELERATED_COMPOSITING)
+    // When set, this ensures that styles compare as different. Used during accelerated animations.
+    bool isRunningAcceleratedAnimation() const { return rareNonInheritedData->m_runningAcceleratedAnimation; }
+#endif
 
     int lineClamp() const { return rareNonInheritedData->lineClamp; }
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
@@ -708,6 +741,10 @@ public:
 
     void setBackgroundColor(const Color& v) { SET_VAR(background, m_color, v) }
 
+    void setBackgroundXPosition(Length l) { SET_VAR(background, m_background.m_xPosition, l) }
+    void setBackgroundYPosition(Length l) { SET_VAR(background, m_background.m_yPosition, l) }
+    void setBackgroundSize(LengthSize l) { SET_VAR(background, m_background.m_size, l) }
+    
     void setBorderImage(const NinePieceImage& b) { SET_VAR(surround, border.image, b) }
 
     void setBorderTopLeftRadius(const IntSize& s) { SET_VAR(surround, border.topLeft, s) }
@@ -722,6 +759,8 @@ public:
         setBorderBottomLeftRadius(s);
         setBorderBottomRightRadius(s);
     }
+    
+    void getBorderRadiiForRect(const IntRect&, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight) const;
 
     void setBorderLeftWidth(unsigned short v) { SET_VAR(surround, border.left.width, v) }
     void setBorderLeftStyle(EBorderStyle v) { SET_VAR(surround, border.left.m_style, v) }
@@ -815,6 +854,9 @@ public:
     }
 
     void setMaskBoxImage(const NinePieceImage& b) { SET_VAR(rareNonInheritedData, m_maskBoxImage, b) }
+    void setMaskXPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_xPosition, l) }
+    void setMaskYPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_yPosition, l) }
+    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_size, l) }
 
     void setBorderCollapse(bool collapse) { inherited_flags._border_collapse = collapse; }
     void setHorizontalBorderSpacing(short v) { SET_VAR(inherited, horizontal_border_spacing, v) }
@@ -924,6 +966,7 @@ public:
     void setTransform(const TransformOperations& ops) { SET_VAR(rareNonInheritedData.access()->m_transform, m_operations, ops); }
     void setTransformOriginX(Length l) { SET_VAR(rareNonInheritedData.access()->m_transform, m_x, l); }
     void setTransformOriginY(Length l) { SET_VAR(rareNonInheritedData.access()->m_transform, m_y, l); }
+    void setTransformOriginZ(float f) { SET_VAR(rareNonInheritedData.access()->m_transform, m_z, f); }
     // End CSS3 Setters
 
     // Apple-specific property setters
@@ -944,6 +987,16 @@ public:
     void adjustAnimations();
     void adjustTransitions();
 
+    void setTransformStyle3D(ETransformStyle3D b) { SET_VAR(rareNonInheritedData, m_transformStyle3D, b); }
+    void setBackfaceVisibility(EBackfaceVisibility b) { SET_VAR(rareNonInheritedData, m_backfaceVisibility, b); }
+    void setPerspective(float p) { SET_VAR(rareNonInheritedData, m_perspective, p); }
+    void setPerspectiveOriginX(Length l) { SET_VAR(rareNonInheritedData, m_perspectiveOriginX, l); }
+    void setPerspectiveOriginY(Length l) { SET_VAR(rareNonInheritedData, m_perspectiveOriginY, l); }
+
+#if USE(ACCELERATED_COMPOSITING)
+    void setIsRunningAcceleratedAnimation(bool b = true) { SET_VAR(rareNonInheritedData, m_runningAcceleratedAnimation, b); }
+#endif
+
     void setLineClamp(int c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
     void setTextSizeAdjust(bool b) { SET_VAR(rareInheritedData, textSizeAdjust, b); }
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
@@ -963,9 +1016,9 @@ public:
 #endif
 
     const ContentData* contentData() const { return rareNonInheritedData->m_content.get(); }
-    bool contentDataEquivalent(const RenderStyle* otherStyle) const;
+    bool contentDataEquivalent(const RenderStyle* otherStyle) const { return const_cast<RenderStyle*>(this)->rareNonInheritedData->contentDataEquivalent(*const_cast<RenderStyle*>(otherStyle)->rareNonInheritedData); }
     void clearContent();
-    void setContent(StringImpl*, bool add = false);
+    void setContent(PassRefPtr<StringImpl>, bool add = false);
     void setContent(PassRefPtr<StyleImage>, bool add = false);
     void setContent(CounterContent*, bool add = false);
 
@@ -974,13 +1027,7 @@ public:
 
     bool inheritedNotEqual(RenderStyle*) const;
 
-    // The difference between two styles.  The following values are used:
-    // (1) Equal - The two styles are identical
-    // (2) Repaint - The object just needs to be repainted.
-    // (3) RepaintLayer - The layer and its descendant layers needs to be repainted.
-    // (4) Layout - A layout is required.
-    enum Diff { Equal, Repaint, RepaintLayer, LayoutPositionedMovementOnly, Layout };
-    Diff diff(const RenderStyle*) const;
+    StyleDifference diff(const RenderStyle*, unsigned& changedContextSensitiveProperties) const;
 
     bool isDisplayReplacedType() const
     {
@@ -1109,10 +1156,16 @@ public:
     static bool initialVisuallyOrdered() { return false; }
     static float initialTextStrokeWidth() { return 0; }
     static unsigned short initialColumnCount() { return 1; }
-    static const TransformOperations& initialTransform() { return s_initialTransform; }
+    static const TransformOperations& initialTransform() { DEFINE_STATIC_LOCAL(TransformOperations, ops, ()); return ops; }
     static Length initialTransformOriginX() { return Length(50.0, Percent); }
     static Length initialTransformOriginY() { return Length(50.0, Percent); }
     static EPointerEvents initialPointerEvents() { return PE_AUTO; }
+    static float initialTransformOriginZ() { return 0; }
+    static ETransformStyle3D initialTransformStyle3D() { return TransformStyle3DFlat; }
+    static EBackfaceVisibility initialBackfaceVisibility() { return BackfaceVisibilityVisible; }
+    static float initialPerspective() { return 0; }
+    static Length initialPerspectiveOriginX() { return Length(50.0, Percent); }
+    static Length initialPerspectiveOriginY() { return Length(50.0, Percent); }
 
     // Keep these at the end.
     static int initialLineClamp() { return -1; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
index 40ad3cc35c..405cf7c80d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
@@ -36,6 +36,44 @@ namespace WebCore {
  * and produce invalid results.
  */
 
+// The difference between two styles.  The following values are used:
+// (1) StyleDifferenceEqual - The two styles are identical
+// (2) StyleDifferenceRecompositeLayer - The layer needs its position and transform updated, but no repaint
+// (3) StyleDifferenceRepaint - The object just needs to be repainted.
+// (4) StyleDifferenceRepaintLayer - The layer and its descendant layers needs to be repainted.
+// (5) StyleDifferenceLayout - A layout is required.
+enum StyleDifference {
+    StyleDifferenceEqual,
+#if USE(ACCELERATED_COMPOSITING)
+    StyleDifferenceRecompositeLayer,
+#endif
+    StyleDifferenceRepaint,
+    StyleDifferenceRepaintLayer,
+    StyleDifferenceLayoutPositionedMovementOnly,
+    StyleDifferenceLayout
+};
+
+// When some style properties change, different amounts of work have to be done depending on
+// context (e.g. whether the property is changing on an element which has a compositing layer).
+// A simple StyleDifference does not provide enough information so we return a bit mask of
+// StyleDifferenceContextSensitiveProperties from RenderStyle::diff() too.
+enum StyleDifferenceContextSensitiveProperty {
+    ContextSensitivePropertyNone = 0,
+    ContextSensitivePropertyTransform = (1 << 0),
+    ContextSensitivePropertyOpacity = (1 << 1)
+};
+
+// Static pseudo styles. Dynamic ones are produced on the fly.
+enum PseudoId {
+    NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
+    SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
+    MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
+    MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON, 
+    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, 
+    SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+
+    FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON
+};
 
 // These have been defined in the order of their precedence for border-collapsing. Do
 // not change this order!
@@ -163,7 +201,7 @@ enum EListStyleType {
      HIRAGANA, KATAKANA, HIRAGANA_IROHA, KATAKANA_IROHA, LNONE
 };
 
-enum ContentType {
+enum StyleContentType {
     CONTENT_NONE, CONTENT_OBJECT, CONTENT_TEXT, CONTENT_COUNTER
 };
 
@@ -171,11 +209,6 @@ enum EBorderFit { BorderFitBorder, BorderFitLines };
 
 enum ETimingFunctionType { LinearTimingFunction, CubicBezierTimingFunction };
 
-enum EAnimPlayState {
-    AnimPlayStatePlaying = 0x0,
-    AnimPlayStatePaused = 0x1
-};
-
 enum EWhiteSpace {
     NORMAL, PRE, PRE_WRAP, PRE_LINE, NOWRAP, KHTML_NOWRAP
 };
@@ -263,6 +296,14 @@ enum EPointerEvents {
     PE_VISIBLE_STROKE, PE_VISIBLE_FILL, PE_VISIBLE_PAINTED, PE_ALL
 };
 
+enum ETransformStyle3D {
+    TransformStyle3DFlat, TransformStyle3DPreserve3D
+};
+
+enum EBackfaceVisibility {
+    BackfaceVisibilityVisible, BackfaceVisibilityHidden
+};
+
 } // namespace WebCore
 
 #endif // RenderStyleConstants_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
index 17499780e6..c5f06481fd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -128,7 +128,7 @@ float SVGRenderStyle::cssPrimitiveToLength(const RenderObject* item, CSSValue* v
         return defaultValue;
 
     if (cssType == CSSPrimitiveValue::CSS_PERCENTAGE) {
-        SVGStyledElement* element = static_cast<SVGStyledElement*>(item->element());
+        SVGStyledElement* element = static_cast<SVGStyledElement*>(item->node());
         SVGElement* viewportElement = (element ? element->viewportElement() : 0);
         if (viewportElement) {
             float result = primitive->getFloatValue() / 100.0f;
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleGeneratedImage.cpp b/src/3rdparty/webkit/WebCore/rendering/style/StyleGeneratedImage.cpp
index fa361e8843..610e73d9e6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleGeneratedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleGeneratedImage.cpp
@@ -34,11 +34,26 @@ PassRefPtr<CSSValue> StyleGeneratedImage::cssValue()
     return m_generator;
 }
 
-IntSize StyleGeneratedImage::imageSize(const RenderObject* renderer, float /* multiplier */) const
+IntSize StyleGeneratedImage::imageSize(const RenderObject* renderer, float multiplier) const
 {
-    // We can ignore the multiplier, since we always store a raw zoomed size.
-    if (m_fixedSize)
-        return m_generator->fixedSize(renderer);
+    if (m_fixedSize) {
+        IntSize fixedSize = m_generator->fixedSize(renderer);
+        if (multiplier == 1.0f)
+            return fixedSize;
+
+        int width = fixedSize.width() * multiplier;
+        int height = fixedSize.height() * multiplier;
+
+        // Don't let images that have a width/height >= 1 shrink below 1 when zoomed.
+        if (fixedSize.width() > 0)
+            width = max(1, width);
+
+        if (fixedSize.height() > 0)
+            height = max(1, height);
+
+        return IntSize(width, height);
+    }
+    
     return m_containerSize;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp b/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp
index 56d2686750..f59c0c2420 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleInheritedData.cpp
@@ -66,7 +66,7 @@ static bool cursorDataEquivalent(const CursorList* c1, const CursorList* c2)
 {
     if (c1 == c2)
         return true;
-    if (!c1 && c2 || c1 && !c2)
+    if ((!c1 && c2) || (c1 && !c2))
         return false;
     return (*c1 == *c2);
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp
index b8fb2ddee1..790799bc79 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -85,7 +85,7 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
 
 bool StyleRareInheritedData::shadowDataEquivalent(const StyleRareInheritedData& o) const
 {
-    if (!textShadow && o.textShadow || textShadow && !o.textShadow)
+    if ((!textShadow && o.textShadow) || (textShadow && !o.textShadow))
         return false;
     if (textShadow && o.textShadow && (*textShadow != *o.textShadow))
         return false;
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.cpp b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.cpp
index e8ceeebc30..401c04f47a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.cpp
@@ -23,7 +23,10 @@
 #include "StyleRareNonInheritedData.h"
 
 #include "CSSStyleSelector.h"
+#include "ContentData.h"
+#include "RenderCounter.h"
 #include "RenderStyle.h"
+#include "StyleImage.h"
 
 namespace WebCore {
 
@@ -39,10 +42,18 @@ StyleRareNonInheritedData::StyleRareNonInheritedData()
     , matchNearestMailBlockquoteColor(RenderStyle::initialMatchNearestMailBlockquoteColor())
     , m_appearance(RenderStyle::initialAppearance())
     , m_borderFit(RenderStyle::initialBorderFit())
+#if USE(ACCELERATED_COMPOSITING)
+    , m_runningAcceleratedAnimation(false)
+#endif
     , m_boxShadow(0)
     , m_animations(0)
     , m_transitions(0)
     , m_mask(FillLayer(MaskFillLayer))
+    , m_transformStyle3D(RenderStyle::initialTransformStyle3D())
+    , m_backfaceVisibility(RenderStyle::initialBackfaceVisibility())
+    , m_perspective(RenderStyle::initialPerspective())
+    , m_perspectiveOriginX(RenderStyle::initialPerspectiveOriginX())
+    , m_perspectiveOriginY(RenderStyle::initialPerspectiveOriginY())
 #if ENABLE(XBL)
     , bindingURI(0)
 #endif
@@ -66,12 +77,20 @@ StyleRareNonInheritedData::StyleRareNonInheritedData(const StyleRareNonInherited
     , matchNearestMailBlockquoteColor(o.matchNearestMailBlockquoteColor)
     , m_appearance(o.m_appearance)
     , m_borderFit(o.m_borderFit)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_runningAcceleratedAnimation(o.m_runningAcceleratedAnimation)
+#endif
     , m_boxShadow(o.m_boxShadow ? new ShadowData(*o.m_boxShadow) : 0)
     , m_boxReflect(o.m_boxReflect)
     , m_animations(o.m_animations ? new AnimationList(*o.m_animations) : 0)
     , m_transitions(o.m_transitions ? new AnimationList(*o.m_transitions) : 0)
     , m_mask(o.m_mask)
     , m_maskBoxImage(o.m_maskBoxImage)
+    , m_transformStyle3D(o.m_transformStyle3D)
+    , m_backfaceVisibility(o.m_backfaceVisibility)
+    , m_perspective(o.m_perspective)
+    , m_perspectiveOriginX(o.m_perspectiveOriginX)
+    , m_perspectiveOriginY(o.m_perspectiveOriginY)
 #if ENABLE(XBL)
     , bindingURI(o.bindingURI ? o.bindingURI->copy() : 0)
 #endif
@@ -105,7 +124,7 @@ bool StyleRareNonInheritedData::operator==(const StyleRareNonInheritedData& o) c
         && marquee == o.marquee
         && m_multiCol == o.m_multiCol
         && m_transform == o.m_transform
-        && m_content == o.m_content
+        && contentDataEquivalent(o)
         && m_counterDirectives == o.m_counterDirectives
         && userDrag == o.userDrag
         && textOverflow == o.textOverflow
@@ -114,6 +133,9 @@ bool StyleRareNonInheritedData::operator==(const StyleRareNonInheritedData& o) c
         && matchNearestMailBlockquoteColor == o.matchNearestMailBlockquoteColor
         && m_appearance == o.m_appearance
         && m_borderFit == o.m_borderFit
+#if USE(ACCELERATED_COMPOSITING)
+        && !m_runningAcceleratedAnimation && !o.m_runningAcceleratedAnimation
+#endif
         && shadowDataEquivalent(o)
         && reflectionDataEquivalent(o)
         && animationDataEquivalent(o)
@@ -123,12 +145,32 @@ bool StyleRareNonInheritedData::operator==(const StyleRareNonInheritedData& o) c
 #if ENABLE(XBL)
         && bindingsEquivalent(o)
 #endif
+        && (m_transformStyle3D == o.m_transformStyle3D)
+        && (m_backfaceVisibility == o.m_backfaceVisibility)
+        && (m_perspective == o.m_perspective)
+        && (m_perspectiveOriginX == o.m_perspectiveOriginX)
+        && (m_perspectiveOriginY == o.m_perspectiveOriginY)
         ;
 }
 
+bool StyleRareNonInheritedData::contentDataEquivalent(const StyleRareNonInheritedData& o) const
+{
+    ContentData* c1 = m_content.get();
+    ContentData* c2 = o.m_content.get();
+
+    while (c1 && c2) {
+        if (!c1->dataEquivalent(*c2))
+            return false;
+        c1 = c1->next();
+        c2 = c2->next();
+    }
+
+    return !c1 && !c2;
+}
+
 bool StyleRareNonInheritedData::shadowDataEquivalent(const StyleRareNonInheritedData& o) const
 {
-    if (!m_boxShadow && o.m_boxShadow || m_boxShadow && !o.m_boxShadow)
+    if ((!m_boxShadow && o.m_boxShadow) || (m_boxShadow && !o.m_boxShadow))
         return false;
     if (m_boxShadow && o.m_boxShadow && (*m_boxShadow != *o.m_boxShadow))
         return false;
@@ -148,7 +190,7 @@ bool StyleRareNonInheritedData::reflectionDataEquivalent(const StyleRareNonInher
 
 bool StyleRareNonInheritedData::animationDataEquivalent(const StyleRareNonInheritedData& o) const
 {
-    if (!m_animations && o.m_animations || m_animations && !o.m_animations)
+    if ((!m_animations && o.m_animations) || (m_animations && !o.m_animations))
         return false;
     if (m_animations && o.m_animations && (*m_animations != *o.m_animations))
         return false;
@@ -157,7 +199,7 @@ bool StyleRareNonInheritedData::animationDataEquivalent(const StyleRareNonInheri
 
 bool StyleRareNonInheritedData::transitionDataEquivalent(const StyleRareNonInheritedData& o) const
 {
-    if (!m_transitions && o.m_transitions || m_transitions && !o.m_transitions)
+    if ((!m_transitions && o.m_transitions) || (m_transitions && !o.m_transitions))
         return false;
     if (m_transitions && o.m_transitions && (*m_transitions != *o.m_transitions))
         return false;
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h
index 6ce6a33513..8dd22b39b1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -30,6 +30,7 @@
 #include "DataRef.h"
 #include "FillLayer.h"
 #include "NinePieceImage.h"
+#include "StyleTransformData.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
@@ -69,7 +70,8 @@ public:
 
     bool operator==(const StyleRareNonInheritedData&) const;
     bool operator!=(const StyleRareNonInheritedData& o) const { return !(*this == o); }
- 
+
+    bool contentDataEquivalent(const StyleRareNonInheritedData& o) const;
     bool shadowDataEquivalent(const StyleRareNonInheritedData& o) const;
     bool reflectionDataEquivalent(const StyleRareNonInheritedData& o) const;
     bool animationDataEquivalent(const StyleRareNonInheritedData&) const;
@@ -96,6 +98,9 @@ public:
     unsigned matchNearestMailBlockquoteColor : 1; // EMatchNearestMailBlockquoteColor, FIXME: This property needs to be eliminated. It should never have been added.
     unsigned m_appearance : 6; // EAppearance
     unsigned m_borderFit : 1; // EBorderFit
+#if USE(ACCELERATED_COMPOSITING)
+    bool m_runningAcceleratedAnimation : 1;
+#endif    
     OwnPtr<ShadowData> m_boxShadow;  // For box-shadow decorations.
     
     RefPtr<StyleReflection> m_boxReflect;
@@ -106,6 +111,12 @@ public:
     FillLayer m_mask;
     NinePieceImage m_maskBoxImage;
 
+    ETransformStyle3D m_transformStyle3D;
+    EBackfaceVisibility m_backfaceVisibility;
+    float m_perspective;
+    Length m_perspectiveOriginX;
+    Length m_perspectiveOriginY;
+
 #if ENABLE(XBL)
     OwnPtr<BindingURI> bindingURI; // The XBL binding URI list.
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.cpp b/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.cpp
index de20e77ea3..2baebf9b14 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.cpp
@@ -30,6 +30,7 @@ StyleTransformData::StyleTransformData()
     : m_operations(RenderStyle::initialTransform())
     , m_x(RenderStyle::initialTransformOriginX())
     , m_y(RenderStyle::initialTransformOriginY())
+    , m_z(RenderStyle::initialTransformOriginZ())
 {
 }
 
@@ -38,12 +39,13 @@ StyleTransformData::StyleTransformData(const StyleTransformData& o)
     , m_operations(o.m_operations)
     , m_x(o.m_x)
     , m_y(o.m_y)
+    , m_z(o.m_z)
 {
 }
 
 bool StyleTransformData::operator==(const StyleTransformData& o) const
 {
-    return m_x == o.m_x && m_y == o.m_y && m_operations == o.m_operations;
+    return m_x == o.m_x && m_y == o.m_y && m_z == o.m_z && m_operations == o.m_operations;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.h b/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.h
index 157e6008fb..6039824d55 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/StyleTransformData.h
@@ -46,6 +46,7 @@ public:
     TransformOperations m_operations;
     Length m_x;
     Length m_y;
+    float m_z;
 
 private:
     StyleTransformData();
diff --git a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
index 54c317c250..a2be615311 100644
--- a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "ChangeVersionWrapper.h"
 
+#if ENABLE(DATABASE)
 #include "Database.h"
 
 namespace WebCore {
@@ -75,3 +76,5 @@ bool ChangeVersionWrapper::performPostflight(SQLTransaction* transaction)
 }
     
 } // namespace WebCore
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.h b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.h
index c2983ebd0d..b14fe5574f 100644
--- a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.h
+++ b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.h
@@ -28,6 +28,8 @@
 #ifndef ChangeVersionWrapper_h
 #define ChangeVersionWrapper_h
 
+#if ENABLE(DATABASE)
+
 #include "PlatformString.h"
 #include "SQLTransaction.h"
 
@@ -52,4 +54,6 @@ private:
 
 } // namespace WebCore
 
+#endif
+
 #endif // ChangeVersionWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.cpp b/src/3rdparty/webkit/WebCore/storage/Database.cpp
index 93d87a7ac7..53bccbeabf 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/Database.cpp
@@ -29,6 +29,9 @@
 #include "config.h"
 #include "Database.h"
 
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(DATABASE)
 #include "ChangeVersionWrapper.h"
 #include "CString.h"
 #include "DatabaseAuthorizer.h"
@@ -40,7 +43,6 @@
 #include "FileSystem.h"
 #include "Frame.h"
 #include "InspectorController.h"
-#include "JSDOMWindow.h"
 #include "Logging.h"
 #include "NotImplemented.h"
 #include "Page.h"
@@ -48,12 +50,24 @@
 #include "SQLiteDatabase.h"
 #include "SQLiteStatement.h"
 #include "SQLResultSet.h"
-#include <runtime/InitializeThreading.h>
 #include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
+#endif
+
+#if USE(JSC)
+#include "JSDOMWindow.h"
+#include <runtime/InitializeThreading.h>
+#endif
 
 namespace WebCore {
 
+const String& Database::databaseInfoTableName()
+{
+    DEFINE_STATIC_LOCAL(String, name, ("__WebKitDatabaseInfoTable__"));
+    return name;
+}
+
+#if ENABLE(DATABASE)
+
 static Mutex& guidMutex()
 {
     // Note: We don't have to use AtomicallyInitializedStatic here because
@@ -77,12 +91,6 @@ static GuidDatabaseMap& guidToDatabaseMap()
     return map;
 }
 
-const String& Database::databaseInfoTableName()
-{
-    DEFINE_STATIC_LOCAL(String, name, ("__WebKitDatabaseInfoTable__"));
-    return name;
-}
-
 static const String& databaseVersionKey()
 {
     DEFINE_STATIC_LOCAL(String, key, ("WebKitDatabaseVersionKey"));
@@ -111,7 +119,7 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
     document->setHasOpenDatabases();
 
     if (Page* page = document->frame()->page())
-        page->inspectorController()->didOpenDatabase(database.get(), document->domain(), name, expectedVersion);
+        page->inspectorController()->didOpenDatabase(database.get(), document->securityOrigin()->host(), name, expectedVersion);
 
     return database;
 }
@@ -131,9 +139,11 @@ Database::Database(Document* document, const String& name, const String& expecte
     if (m_name.isNull())
         m_name = "";
 
+#if USE(JSC)
     JSC::initializeThreading();
     // Database code violates the normal JSCore contract by calling jsUnprotect from a secondary thread, and thus needs additional locking.
     JSDOMWindow::commonJSGlobalData()->heap.setGCProtectNeedsLocking();
+#endif
 
     m_guid = guidForOriginAndName(m_securityOrigin->toString(), name);
 
@@ -357,6 +367,12 @@ void Database::enableAuthorizer()
     m_databaseAuthorizer->enable();
 }
 
+void Database::setAuthorizerReadOnly()
+{
+    ASSERT(m_databaseAuthorizer);
+    m_databaseAuthorizer->setReadOnly();
+}
+
 static int guidForOriginAndName(const String& origin, const String& name)
 {
     String stringID;
@@ -421,18 +437,23 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
         }
     }
 
-
     String currentVersion;
     {
         MutexLocker locker(guidMutex());
-        currentVersion = guidToVersionMap().get(m_guid);
 
-        if (currentVersion.isNull())
-            LOG(StorageAPI, "Current cached version for guid %i is null", m_guid);
-        else
-            LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
+        // Note: It is not safe to put an empty string into the guidToVersionMap() map.
+        // That's because the map is cross-thread, but empty strings are per-thread.
+        // The copy() function makes a version of the string you can use on the current
+        // thread, but we need a string we can keep in a cross-thread data structure.
+        // FIXME: This is a quite-awkward restriction to have to program with.
 
-        if (currentVersion.isNull()) {
+        GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
+        if (entry != guidToVersionMap().end()) {
+            // Map null string to empty string (see comment above).
+            currentVersion = entry->second.isNull() ? String("") : entry->second;
+            LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
+        } else {
+            LOG(StorageAPI, "No cached version for guid %i", m_guid);
             if (!getVersionFromDatabase(currentVersion)) {
                 LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
                 e = INVALID_STATE_ERR;
@@ -447,11 +468,11 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
                     e = INVALID_STATE_ERR;
                     return false;
                 }
-
                 currentVersion = m_expectedVersion;
             }
 
-            guidToVersionMap().set(m_guid, currentVersion.copy());
+            // Map empty string to null string (see comment above).
+            guidToVersionMap().set(m_guid, currentVersion.isEmpty() ? String() : currentVersion.copy());
         }
     }
 
@@ -594,4 +615,6 @@ String Database::stringIdentifier() const
     return m_name.copy();
 }
 
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.h b/src/3rdparty/webkit/WebCore/storage/Database.h
index 955f0235f3..385485a2be 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.h
+++ b/src/3rdparty/webkit/WebCore/storage/Database.h
@@ -29,6 +29,7 @@
 #ifndef Database_h
 #define Database_h
 
+#if ENABLE(DATABASE)
 #include <wtf/MessageQueue.h>
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
@@ -44,7 +45,11 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Deque.h>
+#else
+#include "PlatformString.h"
+#endif
 
+#if ENABLE(DATABASE)
 namespace WebCore {
 
 class DatabaseAuthorizer;
@@ -78,6 +83,7 @@ public:
 
     void disableAuthorizer();
     void enableAuthorizer();
+    void setAuthorizerReadOnly();
 
     Vector<String> tableNames();
 
@@ -145,4 +151,15 @@ private:
 
 } // namespace WebCore
 
+#else
+
+namespace WebCore {
+class Database : public ThreadSafeShared<Database> {
+public:
+    static const String& databaseInfoTableName();
+};
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
+
 #endif // Database_h
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.idl b/src/3rdparty/webkit/WebCore/storage/Database.idl
index e28db9b046..1e4b316aff 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.idl
+++ b/src/3rdparty/webkit/WebCore/storage/Database.idl
@@ -28,7 +28,9 @@
 
 module storage {
 
-    interface Database {
+    interface [
+        Conditional=DATABASE
+    ] Database {
         readonly attribute DOMString version;
         [Custom] void changeVersion(in DOMString oldVersion, in DOMString newVersion, in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
         [Custom] void transaction(in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
index ca0a7f20f8..2d182ce553 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
@@ -44,10 +44,14 @@ void DatabaseAuthorizer::reset()
 {
     m_lastActionWasInsert = false;
     m_lastActionChangedDatabase = false;
+    m_readOnly = false;
 }
 
 int DatabaseAuthorizer::createTable(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -59,6 +63,9 @@ int DatabaseAuthorizer::createTempTable(const String& tableName)
 
 int DatabaseAuthorizer::dropTable(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -69,12 +76,18 @@ int DatabaseAuthorizer::dropTempTable(const String& tableName)
 
 int DatabaseAuthorizer::allowAlterTable(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
 
 int DatabaseAuthorizer::createIndex(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -86,6 +99,9 @@ int DatabaseAuthorizer::createTempIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropIndex(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -96,6 +112,9 @@ int DatabaseAuthorizer::dropTempIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTrigger(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -107,6 +126,9 @@ int DatabaseAuthorizer::createTempTrigger(const String&, const String& tableName
 
 int DatabaseAuthorizer::dropTrigger(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -117,22 +139,34 @@ int DatabaseAuthorizer::dropTempTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createVTable(const String&, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
 }
 
 int DatabaseAuthorizer::dropVTable(const String&, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
 }
 
 int DatabaseAuthorizer::allowDelete(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
 int DatabaseAuthorizer::allowInsert(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     m_lastActionWasInsert = true;
     return denyBasedOnTableName(tableName);
@@ -140,6 +174,9 @@ int DatabaseAuthorizer::allowInsert(const String& tableName)
 
 int DatabaseAuthorizer::allowUpdate(const String& tableName, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -192,6 +229,11 @@ void DatabaseAuthorizer::enable()
     m_securityEnabled = true;
 }
 
+void DatabaseAuthorizer::setReadOnly()
+{
+    m_readOnly = true;
+}
+
 int DatabaseAuthorizer::denyBasedOnTableName(const String& tableName)
 {
     if (!m_securityEnabled)
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
index 685bb97f80..e53ea50c28 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
@@ -85,6 +85,7 @@ public:
 
     void disable();
     void enable();
+    void setReadOnly();
 
     void reset();
 
@@ -95,9 +96,10 @@ private:
     DatabaseAuthorizer();
     int denyBasedOnTableName(const String&);
 
-    bool m_securityEnabled;
-    bool m_lastActionWasInsert;
-    bool m_lastActionChangedDatabase;
+    bool m_securityEnabled : 1;
+    bool m_lastActionWasInsert : 1;
+    bool m_lastActionChangedDatabase : 1;
+    bool m_readOnly : 1;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h b/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
index 677362b2f4..a4d85fdf17 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
@@ -29,6 +29,8 @@
 #ifndef DatabaseDetails_h
 #define DatabaseDetails_h
 
+#if ENABLE(DATABASE)
+
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -64,4 +66,6 @@ private:
 
 } // namespace WebCore
 
+#endif
+
 #endif // DatabaseDetails_h
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp
index 7957d2accb..755da7c487 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.cpp
@@ -28,6 +28,8 @@
 #include "config.h"
 #include "DatabaseTask.h"
 
+#if ENABLE(DATABASE)
+
 #include "Database.h"
 #include "Logging.h"
 
@@ -175,3 +177,5 @@ const char* DatabaseTableNamesTask::debugTaskName() const
 #endif
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h
index 50d297fe76..a3814d789b 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTask.h
@@ -28,6 +28,7 @@
 #ifndef DatabaseTask_h
 #define DatabaseTask_h
 
+#if ENABLE(DATABASE)
 #include "ExceptionCode.h"
 #include "PlatformString.h"
 #include <wtf/OwnPtr.h>
@@ -148,4 +149,5 @@ private:
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
 #endif // DatabaseTask_h
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
index faecd3d153..fab02a2fe5 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
@@ -25,9 +25,12 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #include "config.h"
 #include "DatabaseThread.h"
 
+#if ENABLE(DATABASE)
+
 #include "AutodrainedPool.h"
 #include "Database.h"
 #include "DatabaseTask.h"
@@ -35,7 +38,7 @@
 
 namespace WebCore {
 
-DatabaseThread::DatabaseThread(Document* document)
+DatabaseThread::DatabaseThread()
     : m_threadID(0)
 {
     m_selfRef = this;
@@ -53,7 +56,7 @@ bool DatabaseThread::start()
     if (m_threadID)
         return true;
 
-    m_threadID = createThread(DatabaseThread::databaseThreadStart, this, "WebCore::Database");
+    m_threadID = createThread(DatabaseThread::databaseThreadStart, this, "WebCore: Database");
 
     return m_threadID;
 }
@@ -134,3 +137,4 @@ void DatabaseThread::unscheduleDatabaseTasks(Database* database)
 }
 
 } // namespace WebCore
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
index cd343222f0..9f13c33c85 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
@@ -28,6 +28,7 @@
 #ifndef DatabaseThread_h
 #define DatabaseThread_h
 
+#if ENABLE(DATABASE)
 #include <wtf/Deque.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -42,10 +43,9 @@ class Database;
 class DatabaseTask;
 class Document;
 
-class DatabaseThread : public ThreadSafeShared<DatabaseThread>
-{
+class DatabaseThread : public ThreadSafeShared<DatabaseThread> {
 public:
-    static PassRefPtr<DatabaseThread> create(Document* doc) { return adoptRef(new DatabaseThread(doc)); }
+    static PassRefPtr<DatabaseThread> create() { return adoptRef(new DatabaseThread); }
     ~DatabaseThread();
 
     bool start();
@@ -57,7 +57,7 @@ public:
     void unscheduleDatabaseTasks(Database*);
 
 private:
-    DatabaseThread(Document*);
+    DatabaseThread();
 
     static void* databaseThreadStart(void*);
     void* databaseThread();
@@ -71,4 +71,5 @@ private:
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
 #endif // DatabaseThread_h
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
index d139283785..9311bc6bac 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "DatabaseTracker.h"
 
+#if ENABLE(DATABASE)
+
 #include "ChromeClient.h"
 #include "Database.h"
 #include "DatabaseTrackerClient.h"
@@ -828,3 +830,4 @@ void DatabaseTracker::notifyDatabasesChanged(void*)
 
 
 } // namespace WebCore
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
index 8969a54155..dc50965583 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
@@ -29,6 +29,8 @@
 #ifndef DatabaseTracker_h
 #define DatabaseTracker_h
 
+#if ENABLE(DATABASE)
+
 #include "DatabaseDetails.h"
 #include "PlatformString.h"
 #include "SQLiteDatabase.h"
@@ -130,4 +132,5 @@ private:
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
 #endif // DatabaseTracker_h
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTrackerClient.h b/src/3rdparty/webkit/WebCore/storage/DatabaseTrackerClient.h
index f9b0f70ba5..b43123ca22 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTrackerClient.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTrackerClient.h
@@ -28,6 +28,8 @@
 #ifndef DatabaseTrackerClient_h
 #define DatabaseTrackerClient_h
 
+#if ENABLE(DATABASE)
+
 namespace WebCore {
 
 class SecurityOrigin;
@@ -42,4 +44,6 @@ public:
 
 } // namespace WebCore
 
+#endif
+
 #endif // DatabaseTrackerClient_h
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
index 37841be0a9..8b84e174b6 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
@@ -79,7 +79,7 @@ LocalStorage::~LocalStorage()
     localStorageMap().remove(m_path);
 }
 
-PassRefPtr<StorageArea> LocalStorage::storageArea(Frame* sourceFrame, SecurityOrigin* origin)
+PassRefPtr<StorageArea> LocalStorage::storageArea(SecurityOrigin* origin)
 {
     ASSERT(isMainThread());
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h b/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
index 4816de7eab..1fd1f7a7c1 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
@@ -46,7 +46,7 @@ namespace WebCore {
 
         static PassRefPtr<LocalStorage> localStorage(const String& path);
 
-        PassRefPtr<StorageArea> storageArea(Frame* sourceFrame, SecurityOrigin*);
+        PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
 
         bool scheduleImport(PassRefPtr<LocalStorageArea>);
         void scheduleSync(PassRefPtr<LocalStorageArea>);
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp
index 56dc246ca1..bec0233f4f 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,17 +27,16 @@
 #include "LocalStorageArea.h"
 
 #include "CString.h"
+#include "DOMWindow.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "FrameTree.h"
+#include "HTMLElement.h"
 #include "LocalStorage.h"
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "PlatformString.h"
-#include "SecurityOrigin.h"
 #include "SQLiteStatement.h"
+#include "StorageEvent.h"
+#include "SuddenTermination.h"
 
 namespace WebCore {
 
@@ -68,7 +67,13 @@ LocalStorageArea::~LocalStorageArea()
 
 void LocalStorageArea::scheduleFinalSync()
 {
-    m_syncTimer.stop();
+    if (m_syncTimer.isActive())
+        m_syncTimer.stop();
+    else {
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
     syncTimerFired(&m_syncTimer);
     m_finalSyncScheduled = true;
 }
@@ -219,16 +224,13 @@ void LocalStorageArea::dispatchStorageEvent(const String& key, const String& old
     HashSet<Page*>::const_iterator end = pages.end();
     for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
         for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (Document* document = frame->document())
-                if (document->securityOrigin()->equal(securityOrigin()))
-                    frames.append(frame);
+            if (frame->document()->securityOrigin()->equal(securityOrigin()))
+                frames.append(frame);
         }
     }
 
-    for (unsigned i = 0; i < frames.size(); ++i) {
-        if (HTMLElement* body = frames[i]->document()->body())
-            body->dispatchStorageEvent(eventNames().storageEvent, key, oldValue, newValue, sourceFrame);        
-    }
+    for (unsigned i = 0; i < frames.size(); ++i)
+        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
 }
 
 void LocalStorageArea::scheduleItemForSync(const String& key, const String& value)
@@ -237,8 +239,13 @@ void LocalStorageArea::scheduleItemForSync(const String& key, const String& valu
     ASSERT(!m_finalSyncScheduled);
 
     m_changedItems.set(key, value);
-    if (!m_syncTimer.isActive())
+    if (!m_syncTimer.isActive()) {
         m_syncTimer.startOneShot(LocalStorageSyncInterval);
+
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
 }
 
 void LocalStorageArea::scheduleClear()
@@ -248,8 +255,13 @@ void LocalStorageArea::scheduleClear()
 
     m_changedItems.clear();
     m_itemsCleared = true;
-    if (!m_syncTimer.isActive())
+    if (!m_syncTimer.isActive()) {
         m_syncTimer.startOneShot(LocalStorageSyncInterval);
+
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
 }
 
 void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
@@ -273,10 +285,19 @@ void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
+
+            // The following is balanced by the call to enableSuddenTermination in the
+            // performSync function.
+            disableSuddenTermination();
+
             m_localStorage->scheduleSync(this);
         }
     }
 
+    // The following is balanced by the calls to disableSuddenTermination in the
+    // scheduleItemForSync, scheduleClear, and scheduleFinalSync functions.
+    enableSuddenTermination();
+
     m_changedItems.clear();
 }
 
@@ -347,25 +368,15 @@ void LocalStorageArea::markImported()
     m_importCondition.signal();
 }
 
-void LocalStorageArea::performSync()
+void LocalStorageArea::sync(bool clearItems, const HashMap<String, String>& items)
 {
     ASSERT(!isMainThread());
 
     if (!m_database.isOpen())
         return;
 
-    HashMap<String, String> items;
-    bool clearFirst = false;
-    {
-        MutexLocker locker(m_syncLock);
-        m_itemsPendingSync.swap(items);
-        clearFirst = m_clearItemsWhileSyncing;
-        m_clearItemsWhileSyncing = false;
-        m_syncScheduled = false;
-    }
-
-    // If the clear flag is marked, then we clear all items out before we write any new ones in
-    if (clearFirst) {
+    // If the clear flag is set, then we clear all items out before we write any new ones in.
+    if (clearItems) {
         SQLiteStatement clear(m_database, "DELETE FROM ItemTable");
         if (clear.prepare() != SQLResultOk) {
             LOG_ERROR("Failed to prepare clear statement - cannot write to local storage database");
@@ -391,10 +402,10 @@ void LocalStorageArea::performSync()
         return;
     }
 
-    HashMap<String, String>::iterator end = items.end();
+    HashMap<String, String>::const_iterator end = items.end();
 
-    for (HashMap<String, String>::iterator it = items.begin(); it != end; ++it) {
-        // Based on the null-ness of the second argument, decide whether this is an insert or a delete
+    for (HashMap<String, String>::const_iterator it = items.begin(); it != end; ++it) {
+        // Based on the null-ness of the second argument, decide whether this is an insert or a delete.
         SQLiteStatement& query = it->second.isNull() ? remove : insert;        
 
         query.bindText(1, it->first);
@@ -413,4 +424,29 @@ void LocalStorageArea::performSync()
     }
 }
 
+void LocalStorageArea::performSync()
+{
+    ASSERT(!isMainThread());
+
+    bool clearItems;
+    HashMap<String, String> items;
+    {
+        MutexLocker locker(m_syncLock);
+
+        ASSERT(m_syncScheduled);
+
+        clearItems = m_clearItemsWhileSyncing;
+        m_itemsPendingSync.swap(items);
+
+        m_clearItemsWhileSyncing = false;
+        m_syncScheduled = false;
+    }
+
+    sync(clearItems, items);
+
+    // The following is balanced by the call to disableSuddenTermination in the
+    // syncTimerFired function.
+    enableSuddenTermination();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h
index c6e701576d..f3c6dcef36 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,17 +26,11 @@
 #ifndef LocalStorageArea_h
 #define LocalStorageArea_h
 
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
-
 #include "SQLiteDatabase.h"
 #include "StorageArea.h"
 #include "StringHash.h"
 #include "Timer.h"
-
 #include <wtf/HashMap.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
 
 namespace WebCore {
     
@@ -88,6 +82,7 @@ namespace WebCore {
 
     private:
         void syncTimerFired(Timer<LocalStorageArea>*);
+        void sync(bool clearItems, const HashMap<String, String>& items);
 
         Mutex m_syncLock;
         HashMap<String, String> m_itemsPendingSync;
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index 92aa43e20a..da50c906c0 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -50,7 +50,7 @@ bool LocalStorageThread::start()
     if (m_threadID)
         return true;
 
-    m_threadID = createThread(LocalStorageThread::localStorageThreadStart, this, "WebCore::LocalStorage");
+    m_threadID = createThread(LocalStorageThread::localStorageThreadStart, this, "WebCore: LocalStorage");
 
     return m_threadID;
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
index fa2a580d9e..2b98ab7a72 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
@@ -28,6 +28,8 @@
 #include "config.h"
 #include "OriginQuotaManager.h"
 
+#if ENABLE(DATABASE)
+
 #include "Database.h"
 #include "OriginUsageRecord.h"
 
@@ -121,3 +123,5 @@ unsigned long long OriginQuotaManager::diskUsage(SecurityOrigin* origin) const
 
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h
index 81a29e5dd3..2e3615d271 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.h
@@ -29,6 +29,8 @@
 #ifndef OriginQuotaManager_h
 #define OriginQuotaManager_h
 
+#if ENABLE(DATABASE)
+
 #include "StringHash.h"
 #include "SecurityOriginHash.h"
 #include <wtf/HashMap.h>
@@ -67,4 +69,6 @@ private:
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif // OriginQuotaManager_h
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
index d7a7b11722..211ba6993f 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
@@ -28,6 +28,8 @@
 #include "config.h"
 #include "OriginUsageRecord.h"
 
+#if ENABLE(DATABASE)
+
 #include "FileSystem.h"
 
 namespace WebCore {
@@ -102,3 +104,5 @@ unsigned long long OriginUsageRecord::diskUsage()
 }
     
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
index 094ce3dc92..3442ae1572 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
+++ b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
@@ -28,6 +28,8 @@
 #ifndef OriginUsageRecord_h
 #define OriginUsageRecord_h
 
+#if ENABLE(DATABASE)
+
 #include "PlatformString.h"
 #include "StringHash.h"
 
@@ -64,4 +66,6 @@ private:
 
 } // namespace WebCore
 
+#endif
+
 #endif 
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLError.h b/src/3rdparty/webkit/WebCore/storage/SQLError.h
index 69c1228980..b6ebb5c42d 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLError.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLError.h
@@ -29,6 +29,8 @@
 #ifndef SQLError_h
 #define SQLError_h
 
+#if ENABLE(DATABASE)
+
 #include "PlatformString.h"
 #include <wtf/Threading.h>
 
@@ -49,4 +51,6 @@ private:
 
 }
 
+#endif
+
 #endif // SQLError_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLError.idl b/src/3rdparty/webkit/WebCore/storage/SQLError.idl
index 188b9db747..d889c5b8a2 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLError.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLError.idl
@@ -28,8 +28,10 @@
 
 module storage {
 
-    interface SQLError {
-        readonly attribute unsigned int code;
+    interface [
+        Conditional=DATABASE
+    ] SQLError {
+        readonly attribute unsigned long code;
         readonly attribute DOMString message;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.cpp b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.cpp
index 37024a1d91..19c66c7839 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "SQLResultSet.h"
 
+#if ENABLE(DATABASE)
+
 #include "ExceptionCode.h"
 #include "SQLValue.h"
 
@@ -79,3 +81,5 @@ void SQLResultSet::setRowsAffected(int count)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.h b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.h
index 58f13b763b..5a0ff78c61 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.h
@@ -29,6 +29,8 @@
 #ifndef SQLResultSet_h
 #define SQLResultSet_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLResultSetRowList.h"
 #include <wtf/Threading.h>
 
@@ -60,4 +62,6 @@ private:
 
 } // namespace WebCore
 
+#endif
+
 #endif // SQLResultSet_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl
index fbad936dc9..1db07cdc1a 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSet.idl
@@ -28,11 +28,13 @@
 
 module storage {
 
-    interface SQLResultSet {
+    interface [
+        Conditional=DATABASE
+    ] SQLResultSet {
         readonly attribute SQLResultSetRowList rows;
 
-        readonly attribute int insertId
+        readonly attribute long insertId
             getter raises(DOMException);
-        readonly attribute int rowsAffected;
+        readonly attribute long rowsAffected;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.cpp b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.cpp
index 5b5b94305c..c1e4844df7 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "SQLResultSetRowList.h"
 
+#if ENABLE(DATABASE)
+
 namespace WebCore {
 
 unsigned SQLResultSetRowList::length() const
@@ -42,3 +44,5 @@ unsigned SQLResultSetRowList::length() const
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h
index 1b8a8b454a..96a6aa1214 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h
@@ -29,6 +29,8 @@
 #ifndef SQLResultSetRowList_h
 #define SQLResultSetRowList_h
 
+#if ENABLE(DATABASE)
+
 #include <wtf/PassRefPtr.h>
 #include "SQLValue.h"
 
@@ -56,3 +58,5 @@ private:
 }
 
 #endif
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl
index f853e9030e..6a477e9071 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.idl
@@ -28,7 +28,9 @@
 
 module storage {
 
-    interface SQLResultSetRowList {
+    interface [
+        Conditional=DATABASE
+    ] SQLResultSetRowList {
         readonly attribute unsigned long length;
         [Custom] DOMObject item(in unsigned long index);
     };
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
index 9bd62dd419..38ca75da4d 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
@@ -28,6 +28,8 @@
 #include "config.h"
 #include "SQLStatement.h"
 
+#if ENABLE(DATABASE)
+
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
 #include "Logging.h"
@@ -42,16 +44,17 @@
 
 namespace WebCore {
 
-PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback)
+PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
 {
-    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback));
+    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback, readOnly));
 }
 
-SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback)
+SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
     : m_statement(statement.copy())
     , m_arguments(arguments)
     , m_statementCallback(callback)
     , m_statementErrorCallback(errorCallback)
+    , m_readOnly(readOnly)
 {
 }
    
@@ -67,6 +70,9 @@ bool SQLStatement::execute(Database* db)
     if (m_error)
         return false;
         
+    if (m_readOnly)
+        db->setAuthorizerReadOnly();
+    
     SQLiteDatabase* database = &db->m_sqliteDatabase;
     
     SQLiteStatement statement(*database, m_statement);
@@ -195,3 +201,5 @@ bool SQLStatement::lastExecutionFailedDueToQuota() const
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatement.h b/src/3rdparty/webkit/WebCore/storage/SQLStatement.h
index e72fcf7459..831aeccaa3 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatement.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatement.h
@@ -28,6 +28,8 @@
 #ifndef SQLStatement_h
 #define SQLStatement_h
 
+#if ENABLE(DATABASE)
+
 #include "PlatformString.h"
 
 #include "SQLError.h"
@@ -49,7 +51,7 @@ class String;
 
 class SQLStatement : public ThreadSafeShared<SQLStatement> {
 public:
-    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>);
+    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, bool readOnly);
     
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
@@ -64,7 +66,7 @@ public:
     
     SQLError* sqlError() const { return m_error.get(); }
 private:
-    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback);
+    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
@@ -76,8 +78,12 @@ private:
     
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
+    
+    bool m_readOnly;
 };
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif // SQLStatement_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h
index 58a94364ae..14d19bbe30 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h
@@ -28,6 +28,8 @@
 #ifndef SQLStatementCallback_h
 #define SQLStatementCallback_h
 
+#if ENABLE(DATABASE)
+
 #include <wtf/Threading.h>
 
 namespace WebCore {
@@ -43,6 +45,6 @@ public:
 
 }
 
-#endif // SQLStatementErrorCallback_h
-
+#endif
 
+#endif // SQLStatementErrorCallback_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h
index 5dc3f5a67b..ef0c328870 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef SQLStatementErrorCallback_h
 #define SQLStatementErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include <wtf/Threading.h>
 
 namespace WebCore {
@@ -44,6 +46,6 @@ public:
 
 }
 
-#endif // SQLStatementErrorCallback_h
-
+#endif
 
+#endif // SQLStatementErrorCallback_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
index 5820d7f194..3331e6ec05 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "SQLTransaction.h"
 
+#if ENABLE(DATABASE)
+
 #include "ChromeClient.h"
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
@@ -41,6 +43,7 @@
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
+#include "Settings.h"
 #include "SQLError.h"
 #include "SQLiteTransaction.h"
 #include "SQLResultSet.h"
@@ -72,7 +75,6 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
     , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
     , m_shouldRetryCurrentStatement(false)
-    , m_shouldCommitAfterErrorCallback(true)
     , m_modifiedDatabase(false)
 {
     ASSERT(m_database);
@@ -88,15 +90,20 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
         e = INVALID_STATE_ERR;
         return;
     }
+
+    bool readOnlyMode = false;
+    Page* page = m_database->document()->page();
+    if (!page || page->settings()->privateBrowsingEnabled())
+        readOnlyMode = true;
     
-    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement.copy(), arguments, callback, callbackError);
+    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, readOnlyMode);
 
     if (m_database->deleted())
         statement->setDatabaseDeletedError();
 
     if (!m_database->versionMatchesExpected())
         statement->setVersionMismatchedError();
-        
+
     enqueueStatement(statement);
 }
 
@@ -422,7 +429,6 @@ void SQLTransaction::postflightAndCommit()
 
     // If the commit failed, the transaction will still be marked as "in progress"
     if (m_sqliteTransaction->inProgress()) {
-        m_shouldCommitAfterErrorCallback = false;
         m_transactionError = SQLError::create(0, "failed to commit the transaction");
         handleTransactionError(false);
         return;
@@ -483,8 +489,8 @@ void SQLTransaction::handleTransactionError(bool inCallback)
         return;
     }
     
-    // Transaction Step 12 - If the callback couldn't be called, then rollback the transaction.
-    m_shouldCommitAfterErrorCallback = false;
+    // No error callback, so fast-forward to:
+    // Transaction Step 12 - Rollback the transaction.
     if (inCallback) {
         m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
         LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
@@ -498,10 +504,10 @@ void SQLTransaction::deliverTransactionErrorCallback()
 {
     ASSERT(m_transactionError);
     
-    // Transaction Step 12 - If the callback didn't return false, then rollback the transaction.
-    // This includes the callback not existing, returning true, or throwing an exception
-    if (!m_errorCallback || m_errorCallback->handleEvent(m_transactionError.get()))
-        m_shouldCommitAfterErrorCallback = false;
+    // Transaction Step 12 - If exists, invoke error callback with the last
+    // error to have occurred in this transaction.
+    if (m_errorCallback)
+        m_errorCallback->handleEvent(m_transactionError.get());
 
     m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
     LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
@@ -512,19 +518,8 @@ void SQLTransaction::cleanupAfterTransactionErrorCallback()
 {
     m_database->m_databaseAuthorizer->disable();
     if (m_sqliteTransaction) {
-        // Transaction Step 12 -If the error callback returned false, and the last error wasn't itself a 
-        // failure when committing the transaction, then try to commit the transaction
-        if (m_shouldCommitAfterErrorCallback)
-            m_sqliteTransaction->commit();
-        
-        if (m_sqliteTransaction->inProgress()) {
-            // Transaction Step 12 - If that fails, or if the callback couldn't be called 
-            // or if it didn't return false, then rollback the transaction.
-            m_sqliteTransaction->rollback();
-        } else if (m_modifiedDatabase) {
-            // But if the commit was successful, notify the delegates if the transaction modified this database
-            DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(m_database->m_securityOrigin.get(), m_database->m_name);
-        }
+        // Transaction Step 12 - Rollback the transaction.
+        m_sqliteTransaction->rollback();
         
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
         m_sqliteTransaction.clear();
@@ -548,3 +543,5 @@ void SQLTransaction::cleanupAfterTransactionErrorCallback()
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
index 87d438ef8f..e77c1831e7 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
@@ -28,6 +28,8 @@
 #ifndef SQLTransaction_h
 #define SQLTransaction_h
 
+#if ENABLE(DATABASE)
+
 #include <wtf/Threading.h>
 
 #include "SQLiteTransaction.h"
@@ -117,7 +119,6 @@ private:
     RefPtr<SQLTransactionErrorCallback> m_errorCallback;
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
-    bool m_shouldCommitAfterErrorCallback;
     bool m_modifiedDatabase;
     
     Mutex m_statementMutex;
@@ -128,4 +129,6 @@ private:
     
 } // namespace WebCore
 
+#endif
+
 #endif // SQLTransaction_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl
index 41436f1707..5d4885c9c9 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.idl
@@ -28,7 +28,9 @@
 
 module storage {
 
-    interface SQLTransaction {
+    interface [
+        Conditional=DATABASE
+    ] SQLTransaction {
         [Custom] void executeSql(in DOMString sqlStatement, in ObjectArray arguments, in SQLStatementCallback callback, in SQLStatementErrorCallback errorCallback);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h
index bbe62a5314..a4cd940567 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h
@@ -29,6 +29,8 @@
 #ifndef SQLTransactionCallback_h
 #define SQLTransactionCallback_h
 
+#if ENABLE(DATABASE)
+
 #include <wtf/Threading.h>
 
 namespace WebCore {
@@ -44,4 +46,6 @@ public:
 
 }
 
+#endif
+
 #endif // SQLTransactionCallback_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h
index 2890556a71..9dd3fd3f9f 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef SQLTransactionErrorCallback_h
 #define SQLTransactionErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include <wtf/Threading.h>
 
 namespace WebCore {
@@ -38,11 +40,13 @@ namespace WebCore {
     class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
     public:
         virtual ~SQLTransactionErrorCallback() { }
-        virtual bool handleEvent(SQLError*) = 0;
+        virtual void handleEvent(SQLError*) = 0;
     };
     
 }
 
+#endif
+
 #endif // SQLTransactionErrorCallback_h
 
 
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp
index 048c488afa..60c9501dc8 100644
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp
@@ -26,12 +26,15 @@
 #include "config.h"
 #include "SessionStorageArea.h"
 
+#include "DOMWindow.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameTree.h"
+#include "HTMLElement.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
+#include "StorageEvent.h"
 #include "StorageMap.h"
 
 namespace WebCore {
@@ -75,15 +78,12 @@ void SessionStorageArea::dispatchStorageEvent(const String& key, const String& o
     // For SessionStorage events, each frame in the page's frametree with the same origin as this StorageArea needs to be notified of the change
     Vector<RefPtr<Frame> > frames;
     for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-        if (Document* document = frame->document())
-            if (document->securityOrigin()->equal(securityOrigin()))
-                frames.append(frame);
-    }
-        
-    for (unsigned i = 0; i < frames.size(); ++i) {
-        if (HTMLElement* body = frames[i]->document()->body())
-            body->dispatchStorageEvent(eventNames().storageEvent, key, oldValue, newValue, sourceFrame);        
+        if (frame->document()->securityOrigin()->equal(securityOrigin()))
+            frames.append(frame);
     }
+
+    for (unsigned i = 0; i < frames.size(); ++i)
+        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
index 78b25c191b..27f961243b 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
@@ -28,7 +28,10 @@
 
 #include "CString.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
+#include "Page.h"
 #include "SecurityOrigin.h"
+#include "Settings.h"
 #include "StorageMap.h"
 
 namespace WebCore {
@@ -71,14 +74,19 @@ String StorageArea::internalGetItem(const String& key) const
     return m_storageMap->getItem(key);
 }
 
-void StorageArea::internalSetItem(const String& key, const String& value, ExceptionCode&, Frame* frame)
+void StorageArea::internalSetItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
 {
     ASSERT(!value.isNull());
     
+    if (frame->page()->settings()->privateBrowsingEnabled()) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
+
     // FIXME: For LocalStorage where a disk quota will be enforced, here is where we need to do quota checking.
     //        If we decide to enforce a memory quota for SessionStorage, this is where we'd do that, also.
     // if (<over quota>) {
-    //     ec = INVALID_ACCESS_ERR;
+    //     ec = QUOTA_EXCEEDED_ERR;
     //     return;
     // }
     
@@ -94,7 +102,10 @@ void StorageArea::internalSetItem(const String& key, const String& value, Except
 }
 
 void StorageArea::internalRemoveItem(const String& key, Frame* frame)
-{   
+{
+    if (frame->page()->settings()->privateBrowsingEnabled())
+        return;
+
     String oldValue;
     RefPtr<StorageMap> newMap = m_storageMap->removeItem(key, oldValue);
     if (newMap)
@@ -107,6 +118,9 @@ void StorageArea::internalRemoveItem(const String& key, Frame* frame)
 
 void StorageArea::internalClear(Frame* frame)
 {
+    if (frame->page()->settings()->privateBrowsingEnabled())
+        return;
+    
     m_storageMap = StorageMap::create();
     
     areaCleared(frame);
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
index 54fd9ad57e..851abb1f49 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,20 +27,22 @@
 #include "StorageEvent.h"
 
 #include "DOMWindow.h"
+#include "Storage.h"
 
 namespace WebCore {
 
-StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
     : Event(type, false, true)
     , m_key(key)
     , m_oldValue(oldValue)
     , m_newValue(newValue)
     , m_uri(uri)
     , m_source(source)
+    , m_storageArea(storageArea)
 {
 }
 
-void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
 {
     if (dispatched())
         return;
@@ -52,6 +54,7 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
     m_newValue = newValue;
     m_uri = uri;
     m_source = source;
+    m_storageArea = storageArea;
 }
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
index 1cd87c6373..3795518320 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@
 #define StorageEvent_h
 
 #include "Event.h"
+#include "Storage.h"
 
 namespace WebCore {
 
@@ -38,9 +39,9 @@ namespace WebCore {
         {
             return adoptRef(new StorageEvent);
         }
-        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
         {
-            return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source));
+            return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source, storageArea));
         }
 
         const String& key() const { return m_key; }
@@ -48,23 +49,25 @@ namespace WebCore {
         const String& newValue() const { return m_newValue; }
         const String& uri() const { return m_uri; }
         DOMWindow* source() const { return m_source.get(); }
-        
-        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source);
-        
+        Storage* storageArea() const { return m_storageArea.get(); }
+
+        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg,  Storage storageAreaArg);
 
         virtual bool isStorageEvent() const { return true; }
-        
+
     private:    
         StorageEvent() { }
-        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source);
+        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
         
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
         RefPtr<DOMWindow> m_source;
+        RefPtr<Storage> m_storageArea;        
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
index 47ef67db2c..fe82cf83de 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,10 +33,11 @@ module storage {
         readonly attribute [ConvertNullStringTo=Null] DOMString newValue;
         readonly attribute DOMString uri;
         readonly attribute DOMWindow source;
-        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg);
+        readonly attribute Storage storageArea;
+        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/Filter.cpp b/src/3rdparty/webkit/WebCore/svg/Filter.cpp
deleted file mode 100644
index 24a9fb8e87..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/Filter.cpp
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
-    Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
-    
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "Filter.h"
-
-namespace WebCore {
-
-Filter::Filter(FilterEffect* effect)
-    : m_effect(effect)
-{
-}
-
-PassRefPtr<Filter> Filter::create(FilterEffect* effect)
-{ 
-    return adoptRef(new Filter(effect));
-}
-
-} //namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/FilterEffect.h b/src/3rdparty/webkit/WebCore/svg/FilterEffect.h
deleted file mode 100644
index 8f53ae1a13..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/FilterEffect.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
-    Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef FilterEffect_h
-#define FilterEffect_h
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "TextStream.h"
-
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
-
-namespace WebCore {
-
-    class FilterEffect : public RefCounted<FilterEffect> {
-    public:
-        virtual ~FilterEffect();
-        
-        virtual void apply() = 0;
-        virtual void dump() = 0;
-        
-        virtual TextStream& externalRepresentation(TextStream&) const;
-    protected:
-        FilterEffect();
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#endif // FilterEffect_h
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
index d06fbbcb18..6fd0274a00 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
@@ -34,13 +34,14 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "PlatformMouseEvent.h"
-#include "RenderSVGTransformableContainer.h"
 #include "RenderSVGInline.h"
+#include "RenderSVGTransformableContainer.h"
 #include "ResourceRequest.h"
-#include "SVGSMILElement.h"
 #include "SVGNames.h"
+#include "SVGSMILElement.h"
 #include "XLinkNames.h"
 
 namespace WebCore {
@@ -92,7 +93,7 @@ void SVGAElement::svgAttributeChanged(const QualifiedName& attrName)
         setIsLink(!href().isNull());
 
         if (wasLink != isLink())
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
@@ -151,7 +152,7 @@ void SVGAElement::defaultEventHandler(Event* evt)
             }
 #endif
             if (document()->frame())
-                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, true);
+                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, false, true);
         }
 
         evt->setDefaultHandled();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
new file mode 100644
index 0000000000..2e34ee3dc5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "ColorDistance.cpp"
+#include "SVGAElement.cpp"
+#include "SVGAltGlyphElement.cpp"
+#include "SVGAngle.cpp"
+#include "SVGAnimateColorElement.cpp"
+#include "SVGAnimateElement.cpp"
+#include "SVGAnimateMotionElement.cpp"
+#include "SVGAnimateTransformElement.cpp"
+#include "SVGAnimatedPathData.cpp"
+#include "SVGAnimatedPoints.cpp"
+#include "SVGAnimationElement.cpp"
+#include "SVGCircleElement.cpp"
+#include "SVGClipPathElement.cpp"
+#include "SVGColor.cpp"
+#include "SVGComponentTransferFunctionElement.cpp"
+#include "SVGCursorElement.cpp"
+#include "SVGDefinitionSrcElement.cpp"
+#include "SVGDefsElement.cpp"
+#include "SVGDescElement.cpp"
+#include "SVGDocument.cpp"
+#include "SVGDocumentExtensions.cpp"
+#include "SVGElement.cpp"
+#include "SVGElementInstance.cpp"
+#include "SVGElementInstanceList.cpp"
+#include "SVGEllipseElement.cpp"
+#include "SVGExternalResourcesRequired.cpp"
+#include "SVGFEBlendElement.cpp"
+#include "SVGFEColorMatrixElement.cpp"
+#include "SVGFEComponentTransferElement.cpp"
+#include "SVGFECompositeElement.cpp"
+#include "SVGFEDiffuseLightingElement.cpp"
+#include "SVGFEDisplacementMapElement.cpp"
+#include "SVGFEDistantLightElement.cpp"
+#include "SVGFEFloodElement.cpp"
+#include "SVGFEFuncAElement.cpp"
+#include "SVGFEFuncBElement.cpp"
+#include "SVGFEFuncGElement.cpp"
+#include "SVGFEFuncRElement.cpp"
+#include "SVGFEGaussianBlurElement.cpp"
+#include "SVGFEImageElement.cpp"
+#include "SVGFELightElement.cpp"
+#include "SVGFEMergeElement.cpp"
+#include "SVGFEMergeNodeElement.cpp"
+#include "SVGFEOffsetElement.cpp"
+#include "SVGFEPointLightElement.cpp"
+#include "SVGFESpecularLightingElement.cpp"
+#include "SVGFESpotLightElement.cpp"
+#include "SVGFETileElement.cpp"
+#include "SVGFETurbulenceElement.cpp"
+#include "SVGFilterElement.cpp"
+#include "SVGFilterPrimitiveStandardAttributes.cpp"
+#include "SVGFitToViewBox.cpp"
+#include "SVGFont.cpp"
+#include "SVGFontData.cpp"
+#include "SVGFontElement.cpp"
+#include "SVGFontFaceFormatElement.cpp"
+#include "SVGFontFaceNameElement.cpp"
+#include "SVGFontFaceSrcElement.cpp"
+#include "SVGFontFaceUriElement.cpp"
+#include "SVGForeignObjectElement.cpp"
+#include "SVGGElement.cpp"
+#include "SVGGradientElement.cpp"
+#include "SVGImageElement.cpp"
+#include "SVGImageLoader.cpp"
+#include "SVGLangSpace.cpp"
+#include "SVGLength.cpp"
+#include "SVGLengthList.cpp"
+#include "SVGLineElement.cpp"
+#include "SVGLinearGradientElement.cpp"
+#include "SVGLocatable.cpp"
+#include "SVGMPathElement.cpp"
+#include "SVGMarkerElement.cpp"
+#include "SVGMetadataElement.cpp"
+#include "SVGMissingGlyphElement.cpp"
+#include "SVGNumberList.cpp"
+#include "SVGPaint.cpp"
+#include "SVGParserUtilities.cpp"
+#include "SVGPathElement.cpp"
+#include "SVGPathSegArc.cpp"
+#include "SVGPathSegClosePath.cpp"
+#include "SVGPathSegCurvetoCubic.cpp"
+#include "SVGPathSegCurvetoCubicSmooth.cpp"
+#include "SVGPathSegCurvetoQuadratic.cpp"
+#include "SVGPathSegCurvetoQuadraticSmooth.cpp"
+#include "SVGPathSegLineto.cpp"
+#include "SVGPathSegLinetoHorizontal.cpp"
+#include "SVGPathSegLinetoVertical.cpp"
+#include "SVGPathSegList.cpp"
+#include "SVGPathSegMoveto.cpp"
+#include "SVGPatternElement.cpp"
+#include "SVGPointList.cpp"
+#include "SVGPolyElement.cpp"
+#include "SVGPolygonElement.cpp"
+#include "SVGPolylineElement.cpp"
+#include "SVGPreserveAspectRatio.cpp"
+#include "SVGRadialGradientElement.cpp"
+#include "SVGRectElement.cpp"
+#include "SVGSVGElement.cpp"
+#include "SVGScriptElement.cpp"
+#include "SVGSetElement.cpp"
+#include "SVGStopElement.cpp"
+#include "SVGStringList.cpp"
+#include "SVGStylable.cpp"
+#include "SVGStyledLocatableElement.cpp"
+#include "SVGStyledTransformableElement.cpp"
+#include "SVGSwitchElement.cpp"
+#include "SVGSymbolElement.cpp"
+#include "SVGTRefElement.cpp"
+#include "SVGTSpanElement.cpp"
+#include "SVGTests.cpp"
+#include "SVGTextContentElement.cpp"
+#include "SVGTextElement.cpp"
+#include "SVGTextPathElement.cpp"
+#include "SVGTextPositioningElement.cpp"
+#include "SVGTitleElement.cpp"
+#include "SVGTransform.cpp"
+#include "SVGTransformDistance.cpp"
+#include "SVGTransformList.cpp"
+#include "SVGTransformable.cpp"
+#include "SVGURIReference.cpp"
+#include "SVGUseElement.cpp"
+#include "SVGViewElement.cpp"
+#include "SVGViewSpec.cpp"
+#include "SVGZoomAndPan.cpp"
+#include "SVGZoomEvent.cpp"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp
index b6422f5c24..44bf5fb014 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateMotionElement.cpp
@@ -22,9 +22,11 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 #include "SVGAnimateMotionElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGElementInstance.h"
 #include "SVGMPathElement.h"
@@ -150,7 +152,7 @@ void SVGAnimateMotionElement::resetToBaseValue(const String&)
     TransformationMatrix* transform = target->supplementalTransform();
     if (!transform)
         return;
-    transform->reset();
+    transform->makeIdentity();
 }
 
 bool SVGAnimateMotionElement::calculateFromAndToValues(const String& fromString, const String& toString)
@@ -179,7 +181,7 @@ void SVGAnimateMotionElement::calculateAnimatedValue(float percentage, unsigned,
         return;
     
     if (!isAdditive())
-        transform->reset();
+        transform->makeIdentity();
     
     // FIXME: Implement accumulate.
     
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp
index 99e4c42f9b..3ebba06313 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimateTransformElement.cpp
@@ -23,10 +23,11 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 #include "SVGAnimateTransformElement.h"
 
-#include "TransformationMatrix.h"
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGAngle.h"
 #include "SVGElementInstance.h"
@@ -37,7 +38,7 @@
 #include "SVGTransform.h"
 #include "SVGTransformList.h"
 #include "SVGUseElement.h"
-
+#include "TransformationMatrix.h"
 #include <math.h>
 #include <wtf/MathExtras.h>
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
index e7439a4a05..725711d6ba 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
@@ -430,7 +430,7 @@ namespace WebCore {
     {
         AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
 
-        NamedAttrMap* namedAttrMap = ownerElement->attributes(false); 
+        NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
         Attribute* old = namedAttrMap->getAttributeItem(attributeName);
         if (old && value.isNull()) 
             namedAttrMap->removeAttribute(old->name()); 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
index 649b74d7df..b817ad87bd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
@@ -23,6 +23,7 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG_ANIMATION)
 #include "SVGAnimationElement.h"
 
@@ -34,6 +35,7 @@
 #include "EventListener.h"
 #include "FloatConversion.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
 #include "SVGURIReference.h"
@@ -321,7 +323,7 @@ void SVGAnimationElement::setTargetAttributeAnimatedValue(const String& value)
             shadowTreeElement->style()->setProperty(attributeName, value, "", ec);
         else
             shadowTreeElement->setAttribute(attributeName, value, ec);
-        (*it)->correspondingUseElement()->setChanged();
+        (*it)->correspondingUseElement()->setNeedsStyleRecalc();
     }
 }
     
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
index 8817506ae5..0c48f5130e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGCircleElement.h"
 
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
index a41bb45051..691e4d5baa 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
@@ -27,6 +27,7 @@
 
 #include "CSSStyleSelector.h"
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGTransformList.h"
 #include "SVGUnitTypes.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index f2be038101..e479fae049 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGFEComponentTransferElement.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
index 5e20e37f58..82d57b4de3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGComponentTransferFunctionElement_h
 #define SVGComponentTransferFunctionElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 #include "SVGNumberList.h"
 #include "FEComponentTransfer.h"
@@ -53,5 +53,5 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl
index a479aa202d..0868175c74 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGComponentTransferFunctionElement : SVGElement {
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGComponentTransferFunctionElement : SVGElement {
         // Component Transfer Types
         const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN  = 0;
         const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
index 8ff973503d..12e9e5da89 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
@@ -27,8 +27,9 @@
 
 #include "Attr.h"
 #include "Document.h"
-#include "SVGNames.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
@@ -91,7 +92,7 @@ void SVGCursorElement::svgAttributeChanged(const QualifiedName& attrName)
         HashSet<SVGElement*>::const_iterator end = m_clients.end();
 
         for (; it != end; ++it)
-            (*it)->setChanged();
+            (*it)->setNeedsStyleRecalc();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
index 29ba9a0e6d..3a7d3d42ef 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
@@ -33,7 +33,7 @@
 #include "EventNames.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
-#include "PlatformString.h"
+#include "MappedAttribute.h"
 #include "RegisteredEventListener.h"
 #include "RenderObject.h"
 #include "SVGCursorElement.h"
@@ -44,6 +44,7 @@
 #include "SVGSVGElement.h"
 #include "SVGURIReference.h"
 #include "SVGUseElement.h"
+#include "ScriptEventListener.h"
 #include "XMLNames.h"
 
 namespace WebCore {
@@ -150,25 +151,25 @@ void SVGElement::parseMappedAttribute(MappedAttribute* attr)
 {
     // standard events
     if (attr->name() == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onclickAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().clickEvent, attr);
+        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmousedownAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousedownEvent, attr);
+        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmousemoveAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousemoveEvent, attr);
+        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmouseoutAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoutEvent, attr);
+        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmouseoverAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoverEvent, attr);
+        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmouseupAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseupEvent, attr);
+        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onfocusinAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().DOMFocusInEvent, attr);
+        setAttributeEventListener(eventNames().DOMFocusInEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onfocusoutAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().DOMFocusOutEvent, attr);
+        setAttributeEventListener(eventNames().DOMFocusOutEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onactivateAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().DOMActivateEvent, attr);
+        setAttributeEventListener(eventNames().DOMActivateEvent, createAttributeEventListener(this, attr));
     else
         StyledElement::parseMappedAttribute(attr);
 }
@@ -211,8 +212,7 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
         if (hasLoadListener(currentTarget.get())) {
             RefPtr<Event> event = Event::create(eventNames().loadEvent, false, false);
             event->setTarget(currentTarget);
-            ExceptionCode ignored = 0;
-            currentTarget->dispatchGenericEvent(event.release(), ignored);
+            currentTarget->dispatchGenericEvent(event.release());
         }
         currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : 0;
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
index 997f474335..7cc1798dbb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
@@ -130,7 +130,7 @@ void SVGElementInstance::setNeedsUpdate(bool value)
     m_needsUpdate = value;
 
     if (m_needsUpdate)
-        correspondingUseElement()->setChanged();
+        correspondingUseElement()->setNeedsStyleRecalc();
 }
 
 ScriptExecutionContext* SVGElementInstance::scriptExecutionContext() const
@@ -169,407 +169,407 @@ bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
     evt->setTarget(this);
 
     RefPtr<FrameView> view = element->document()->view();
-    return element->dispatchGenericEvent(evt.release(), ec);
+    return element->dispatchGenericEvent(evt.release());
 }
 
 EventListener* SVGElementInstance::onabort() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().abortEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().abortEvent);
 }
 
 void SVGElementInstance::setOnabort(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().abortEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().abortEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onblur() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().blurEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().blurEvent);
 }
 
 void SVGElementInstance::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().blurEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onchange() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().changeEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().changeEvent);
 }
 
 void SVGElementInstance::setOnchange(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().changeEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().changeEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onclick() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().clickEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().clickEvent);
 }
 
 void SVGElementInstance::setOnclick(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().clickEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().clickEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oncontextmenu() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().contextmenuEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().contextmenuEvent);
 }
 
 void SVGElementInstance::setOncontextmenu(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().contextmenuEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondblclick() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dblclickEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dblclickEvent);
 }
 
 void SVGElementInstance::setOndblclick(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dblclickEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onerror() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().errorEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().errorEvent);
 }
 
 void SVGElementInstance::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().errorEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onfocus() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().focusEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().focusEvent);
 }
 
 void SVGElementInstance::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().focusEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oninput() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().inputEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().inputEvent);
 }
 
 void SVGElementInstance::setOninput(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().inputEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().inputEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onkeydown() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().keydownEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().keydownEvent);
 }
 
 void SVGElementInstance::setOnkeydown(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().keydownEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onkeypress() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().keypressEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().keypressEvent);
 }
 
 void SVGElementInstance::setOnkeypress(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().keypressEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onkeyup() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().keyupEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().keyupEvent);
 }
 
 void SVGElementInstance::setOnkeyup(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().keyupEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onload() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().loadEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().loadEvent);
 }
 
 void SVGElementInstance::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().loadEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmousedown() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mousedownEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mousedownEvent);
 }
 
 void SVGElementInstance::setOnmousedown(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mousedownEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmousemove() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mousemoveEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mousemoveEvent);
 }
 
 void SVGElementInstance::setOnmousemove(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmouseout() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mouseoutEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mouseoutEvent);
 }
 
 void SVGElementInstance::setOnmouseout(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmouseover() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mouseoverEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mouseoverEvent);
 }
 
 void SVGElementInstance::setOnmouseover(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmouseup() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mouseupEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mouseupEvent);
 }
 
 void SVGElementInstance::setOnmouseup(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mouseupEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmousewheel() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mousewheelEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mousewheelEvent);
 }
 
 void SVGElementInstance::setOnmousewheel(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onbeforecut() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().beforecutEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().beforecutEvent);
 }
 
 void SVGElementInstance::setOnbeforecut(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().beforecutEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().beforecutEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oncut() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().cutEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().cutEvent);
 }
 
 void SVGElementInstance::setOncut(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().cutEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().cutEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onbeforecopy() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().beforecopyEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().beforecopyEvent);
 }
 
 void SVGElementInstance::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().beforecopyEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oncopy() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().copyEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().copyEvent);
 }
 
 void SVGElementInstance::setOncopy(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().copyEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().copyEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onbeforepaste() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().beforepasteEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().beforepasteEvent);
 }
 
 void SVGElementInstance::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().beforepasteEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onpaste() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().pasteEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().pasteEvent);
 }
 
 void SVGElementInstance::setOnpaste(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().pasteEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().pasteEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragenter() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragenterEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragenterEvent);
 }
 
 void SVGElementInstance::setOndragenter(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragenterEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragenterEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragover() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragoverEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragoverEvent);
 }
 
 void SVGElementInstance::setOndragover(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragoverEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragoverEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragleave() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragleaveEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragleaveEvent);
 }
 
 void SVGElementInstance::setOndragleave(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragleaveEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondrop() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dropEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dropEvent);
 }
 
 void SVGElementInstance::setOndrop(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dropEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dropEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragstart() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragstartEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragstartEvent);
 }
 
 void SVGElementInstance::setOndragstart(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragstartEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragstartEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondrag() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragEvent);
 }
 
 void SVGElementInstance::setOndrag(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragend() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragendEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragendEvent);
 }
 
 void SVGElementInstance::setOndragend(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragendEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragendEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onreset() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().resetEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().resetEvent);
 }
 
 void SVGElementInstance::setOnreset(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().resetEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().resetEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onresize() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().resizeEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().resizeEvent);
 }
 
 void SVGElementInstance::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onscroll() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().scrollEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().scrollEvent);
 }
 
 void SVGElementInstance::setOnscroll(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().scrollEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onsearch() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().searchEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().searchEvent);
 }
 
 void SVGElementInstance::setOnsearch(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().searchEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().searchEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onselect() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().selectEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().selectEvent);
 }
 
 void SVGElementInstance::setOnselect(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().selectEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().selectEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onselectstart() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().selectstartEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().selectstartEvent);
 }
 
 void SVGElementInstance::setOnselectstart(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().selectstartEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().selectstartEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onsubmit() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().submitEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().submitEvent);
 }
 
 void SVGElementInstance::setOnsubmit(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().submitEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().submitEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onunload() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().unloadEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().unloadEvent);
 }
 
 void SVGElementInstance::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
index 261d34a9c6..7c5679248b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
@@ -55,12 +55,13 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        virtual EventTargetNode* toNode() { return shadowTreeElement(); }
+        virtual Node* toNode() { return shadowTreeElement(); }
         virtual SVGElementInstance* toSVGElementInstance() { return this; }
 
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
         virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
         virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        const RegisteredEventListenerVector& eventListeners() const { return correspondingElement()->eventListeners(); }
 
         SVGElement* correspondingElement() const { return m_element.get(); }
         SVGUseElement* correspondingUseElement() const { return m_useElement; }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl
index 92da5a63b7..3d8817804f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.idl
@@ -28,13 +28,13 @@ module svg {
 
     interface [
         Conditional=SVG,
-        ObjCCustomInternalImpl,
         CustomListeners,
+        CustomMarkFunction,
         CustomPushEventHandlerScope,
         GenerateToJS,
         GenerateNativeConverter
     ] SVGElementInstance
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
     {
@@ -48,47 +48,47 @@ module svg {
         readonly attribute SVGElementInstance nextSibling;
 
         // EventTarget
-#if !defined(LANGUAGE_OBJECTIVE_C)
-        attribute [DontEnum, ProtectedListener] EventListener onabort;
-        attribute [DontEnum, ProtectedListener] EventListener onblur;
-        attribute [DontEnum, ProtectedListener] EventListener onchange;
-        attribute [DontEnum, ProtectedListener] EventListener onclick;
-        attribute [DontEnum, ProtectedListener] EventListener oncontextmenu;
-        attribute [DontEnum, ProtectedListener] EventListener ondblclick;
-        attribute [DontEnum, ProtectedListener] EventListener onerror;
-        attribute [DontEnum, ProtectedListener] EventListener onfocus;
-        attribute [DontEnum, ProtectedListener] EventListener oninput;
-        attribute [DontEnum, ProtectedListener] EventListener onkeydown;
-        attribute [DontEnum, ProtectedListener] EventListener onkeypress;
-        attribute [DontEnum, ProtectedListener] EventListener onkeyup;
-        attribute [DontEnum, ProtectedListener] EventListener onload;
-        attribute [DontEnum, ProtectedListener] EventListener onmousedown;
-        attribute [DontEnum, ProtectedListener] EventListener onmousemove;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseout;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseover;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseup;
-        attribute [DontEnum, ProtectedListener] EventListener onmousewheel;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecut;
-        attribute [DontEnum, ProtectedListener] EventListener oncut;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecopy;
-        attribute [DontEnum, ProtectedListener] EventListener oncopy;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforepaste;
-        attribute [DontEnum, ProtectedListener] EventListener onpaste;
-        attribute [DontEnum, ProtectedListener] EventListener ondragenter;
-        attribute [DontEnum, ProtectedListener] EventListener ondragover;
-        attribute [DontEnum, ProtectedListener] EventListener ondragleave;
-        attribute [DontEnum, ProtectedListener] EventListener ondrop;
-        attribute [DontEnum, ProtectedListener] EventListener ondragstart;
-        attribute [DontEnum, ProtectedListener] EventListener ondrag;
-        attribute [DontEnum, ProtectedListener] EventListener ondragend;
-        attribute [DontEnum, ProtectedListener] EventListener onreset;
-        attribute [DontEnum, ProtectedListener] EventListener onresize;
-        attribute [DontEnum, ProtectedListener] EventListener onscroll;
-        attribute [DontEnum, ProtectedListener] EventListener onsearch;
-        attribute [DontEnum, ProtectedListener] EventListener onselect;
-        attribute [DontEnum, ProtectedListener] EventListener onselectstart;
-        attribute [DontEnum, ProtectedListener] EventListener onsubmit;
-        attribute [DontEnum, ProtectedListener] EventListener onunload;
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+        attribute [DontEnum] EventListener onabort;
+        attribute [DontEnum] EventListener onblur;
+        attribute [DontEnum] EventListener onchange;
+        attribute [DontEnum] EventListener onclick;
+        attribute [DontEnum] EventListener oncontextmenu;
+        attribute [DontEnum] EventListener ondblclick;
+        attribute [DontEnum] EventListener onerror;
+        attribute [DontEnum] EventListener onfocus;
+        attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener onkeydown;
+        attribute [DontEnum] EventListener onkeypress;
+        attribute [DontEnum] EventListener onkeyup;
+        attribute [DontEnum] EventListener onload;
+        attribute [DontEnum] EventListener onmousedown;
+        attribute [DontEnum] EventListener onmousemove;
+        attribute [DontEnum] EventListener onmouseout;
+        attribute [DontEnum] EventListener onmouseover;
+        attribute [DontEnum] EventListener onmouseup;
+        attribute [DontEnum] EventListener onmousewheel;
+        attribute [DontEnum] EventListener onbeforecut;
+        attribute [DontEnum] EventListener oncut;
+        attribute [DontEnum] EventListener onbeforecopy;
+        attribute [DontEnum] EventListener oncopy;
+        attribute [DontEnum] EventListener onbeforepaste;
+        attribute [DontEnum] EventListener onpaste;
+        attribute [DontEnum] EventListener ondragenter;
+        attribute [DontEnum] EventListener ondragover;
+        attribute [DontEnum] EventListener ondragleave;
+        attribute [DontEnum] EventListener ondrop;
+        attribute [DontEnum] EventListener ondragstart;
+        attribute [DontEnum] EventListener ondrag;
+        attribute [DontEnum] EventListener ondragend;
+        attribute [DontEnum] EventListener onreset;
+        attribute [DontEnum] EventListener onresize;
+        attribute [DontEnum] EventListener onscroll;
+        attribute [DontEnum] EventListener onsearch;
+        attribute [DontEnum] EventListener onselect;
+        attribute [DontEnum] EventListener onselectstart;
+        attribute [DontEnum] EventListener onsubmit;
+        attribute [DontEnum] EventListener onunload;
 
         [Custom] void addEventListener(in DOMString type, 
                                        in EventListener listener, 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
index a07a9a7c72..6d56ff82a0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGEllipseElement.h"
 
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGException.idl b/src/3rdparty/webkit/WebCore/svg/SVGException.idl
index b7e97c7690..233f653883 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGException.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGException.idl
@@ -29,7 +29,7 @@ module svg {
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
index d087f64b26..640f92e5b3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -26,8 +26,9 @@
 #include "SVGExternalResourcesRequired.h"
 
 #include "Attr.h"
-#include "SVGNames.h"
+#include "MappedAttribute.h"
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp
index 3c8557ed1e..f78412cdb2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEBlendElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -34,7 +35,6 @@ SVGFEBlendElement::SVGFEBlendElement(const QualifiedName& tagName, Document* doc
     , m_in1(this, SVGNames::inAttr)
     , m_in2(this, SVGNames::in2Attr)
     , m_mode(this, SVGNames::modeAttr, FEBLEND_MODE_NORMAL)
-    , m_filterEffect(0)
 {
 }
 
@@ -64,21 +64,16 @@ void SVGFEBlendElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEBlendElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEBlendElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED(); 
-    return 0;
-}
-
-bool SVGFEBlendElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
-    FilterEffect* input2 = builder->getEffectById(in2());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+    FilterEffect* input2 = filterResource->builder()->getEffectById(in2());
 
     if(!input1 || !input2)
         return false;
 
-    builder->add(result(), FEBlend::create(input1, input2, static_cast<BlendModeType> (mode())));
+    RefPtr<FilterEffect> effect = FEBlend::create(input1, input2, static_cast<BlendModeType>(mode()));
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h
index a85d174b7e..70e5e06cf1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEBlendElement_h
 #define SVGFEBlendElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FEBlend.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -36,15 +36,12 @@ namespace WebCore
         virtual ~SVGFEBlendElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::in2AttrString, String, In2, in2)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::modeAttrString, int, Mode, mode)
-
-        mutable RefPtr<FEBlend> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl
index b45b57fdc5..4c1a18bc1a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEBlendElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFEBlendElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEBlendElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
         // Blend Mode Types
         const unsigned short SVG_FEBLEND_MODE_UNKNOWN  = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp
index c3a8f014a0..660f00021d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEColorMatrixElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
 #include "SVGResourceFilter.h"
@@ -36,7 +37,6 @@ SVGFEColorMatrixElement::SVGFEColorMatrixElement(const QualifiedName& tagName, D
     , m_in1(this, SVGNames::inAttr)
     , m_type(this, SVGNames::typeAttr, FECOLORMATRIX_TYPE_UNKNOWN)
     , m_values(this, SVGNames::valuesAttr, SVGNumberList::create(SVGNames::valuesAttr))
-    , m_filterEffect(0)
 {
 }
 
@@ -65,15 +65,9 @@ void SVGFEColorMatrixElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEColorMatrixElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEColorMatrixElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEColorMatrixElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
@@ -86,7 +80,8 @@ bool SVGFEColorMatrixElement::build(FilterBuilder* builder)
     for (unsigned int i = 0;i < nr;i++)
         _values.append(numbers->getItem(i, ec));
 
-    builder->add(result(), FEColorMatrix::create(input1, static_cast<ColorMatrixType> (type()), _values));
+    RefPtr<FilterEffect> effect = FEColorMatrix::create(input1, static_cast<ColorMatrixType>(type()), _values);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h
index f39db86cd7..5b7a9aedc9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEColorMatrixElement_h
 #define SVGFEColorMatrixElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FEColorMatrix.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGNumberList.h"
@@ -36,15 +36,12 @@ namespace WebCore {
         virtual ~SVGFEColorMatrixElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::typeAttrString, int, Type, type)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::valuesAttrString, SVGNumberList, Values, values)
-
-        mutable RefPtr<FEColorMatrix> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl
index ae0e293237..c116fe755c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEColorMatrixElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFEColorMatrixElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEColorMatrixElement : SVGElement,
                                                           SVGFilterPrimitiveStandardAttributes {
         // Color Matrix Types
         const unsigned short SVG_FECOLORMATRIX_TYPE_UNKNOWN          = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp
index e1be6ae63e..cad60dc9b7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.cpp
@@ -22,16 +22,17 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEComponentTransferElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
+#include "SVGFEFuncAElement.h"
+#include "SVGFEFuncBElement.h"
+#include "SVGFEFuncGElement.h"
+#include "SVGFEFuncRElement.h"
 #include "SVGNames.h"
 #include "SVGRenderStyle.h"
-#include "SVGFEFuncRElement.h"
-#include "SVGFEFuncGElement.h"
-#include "SVGFEFuncBElement.h"
-#include "SVGFEFuncAElement.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -39,7 +40,6 @@ namespace WebCore {
 SVGFEComponentTransferElement::SVGFEComponentTransferElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
     , m_in1(this, SVGNames::inAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -56,15 +56,9 @@ void SVGFEComponentTransferElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEComponentTransferElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEComponentTransferElement::build(FilterBuilder* builder)
+bool SVGFEComponentTransferElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
     
     if(!input1)
         return false;
@@ -85,7 +79,8 @@ bool SVGFEComponentTransferElement::build(FilterBuilder* builder)
             alpha = static_cast<SVGFEFuncAElement*>(n)->transferFunction();
     }
     
-    builder->add(result(), FEComponentTransfer::create(input1, red, green, blue, alpha));
+    RefPtr<FilterEffect> effect = FEComponentTransfer::create(input1, red, green, blue, alpha);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h
index e80ea942c6..21c95d20d4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEComponentTransferElement_h
 #define SVGFEComponentTransferElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "FEComponentTransfer.h"
 
@@ -35,13 +35,10 @@ namespace WebCore {
         virtual ~SVGFEComponentTransferElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEComponentTransferElement, SVGNames::feComponentTransferTagString, SVGNames::inAttrString, String, In1, in1)
-
-        mutable RefPtr<FEComponentTransfer> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.idl
index 783c9b7d1d..7ec0741f3a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEComponentTransferElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEComponentTransferElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEComponentTransferElement : SVGElement,
                                                                 SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp
index f2fc4dcf62..2205243357 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFECompositeElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGResourceFilter.h"
 
@@ -39,7 +40,6 @@ SVGFECompositeElement::SVGFECompositeElement(const QualifiedName& tagName, Docum
     , m_k2(this, SVGNames::k2Attr)
     , m_k3(this, SVGNames::k3Attr)
     , m_k4(this, SVGNames::k4Attr)
-    , m_filterEffect(0)
 {
 }
 
@@ -80,23 +80,17 @@ void SVGFECompositeElement::parseMappedAttribute(MappedAttribute *attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFECompositeElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFECompositeElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFECompositeElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
-    FilterEffect* input2 = builder->getEffectById(in2());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+    FilterEffect* input2 = filterResource->builder()->getEffectById(in2());
     
     if(!input1 || !input2)
         return false;
     
-    RefPtr<FilterEffect> addedEffect = FEComposite::create(input1, input2, static_cast<CompositeOperationType> (_operator()),
+    RefPtr<FilterEffect> effect = FEComposite::create(input1, input2, static_cast<CompositeOperationType>(_operator()),
                                         k1(), k2(), k3(), k4());
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h
index 89ad7df783..fc97169638 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFECompositeElement_h
 #define SVGFECompositeElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FEComposite.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -35,8 +35,7 @@ namespace WebCore {
         virtual ~SVGFECompositeElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::inAttrString, String, In1, in1)
@@ -46,8 +45,6 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k2AttrString, float, K2, k2)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k3AttrString, float, K3, k3)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k4AttrString, float, K4, k4)
-
-        mutable RefPtr<FEComposite> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
index 01821e853b..97a13fc5f7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFECompositeElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFECompositeElement : SVGElement,
                                                         SVGFilterPrimitiveStandardAttributes {
         // Composite Operators
         const unsigned short SVG_FECOMPOSITE_OPERATOR_UNKNOWN    = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index 87fa33a35d..00ff55a80a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -19,17 +19,18 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDiffuseLightingElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGColor.h"
+#include "SVGFEDiffuseLighting.h"
 #include "SVGFELightElement.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGRenderStyle.h"
-#include "SVGFEDiffuseLighting.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -44,7 +45,6 @@ SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement(const QualifiedName& ta
     , m_surfaceScale(this, SVGNames::surfaceScaleAttr, 1.0f)
     , m_kernelUnitLengthX(this, SVGNames::kernelUnitLengthAttr)
     , m_kernelUnitLengthY(this, SVGNames::kernelUnitLengthAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -71,15 +71,9 @@ void SVGFEDiffuseLightingElement::parseMappedAttribute(MappedAttribute *attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEDiffuseLightingElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEDiffuseLightingElement::build(FilterBuilder* builder)
+bool SVGFEDiffuseLightingElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
     
     if(!input1)
         return false;
@@ -87,9 +81,9 @@ bool SVGFEDiffuseLightingElement::build(FilterBuilder* builder)
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
     Color color = filterStyle->svgStyle()->lightingColor();
     
-    RefPtr<FilterEffect> addedEffect = FEDiffuseLighting::create(input1, color, surfaceScale(), diffuseConstant(), 
+    RefPtr<FilterEffect> effect = FEDiffuseLighting::create(input1, color, surfaceScale(), diffuseConstant(), 
                                             kernelUnitLengthX(), kernelUnitLengthY(), findLights());
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h
index 70c67773f4..fcb5eee938 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.h
@@ -22,7 +22,7 @@
 #ifndef SVGFEDiffuseLightingElement_h
 #define SVGFEDiffuseLightingElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -40,8 +40,7 @@ namespace WebCore {
         virtual ~SVGFEDiffuseLightingElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGNames::inAttrString, String, In1, in1)
@@ -51,8 +50,6 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
 
         LightSource* findLights() const;
-        
-        mutable RefPtr<FEDiffuseLighting> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.idl
index ca54f8b638..c48a4f1d14 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDiffuseLightingElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEDiffuseLightingElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEDiffuseLightingElement : SVGElement,
                                                               SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber surfaceScale;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp
index 3b6dfbf6c6..8ac668c56b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.cpp
@@ -17,12 +17,12 @@
  Boston, MA 02110-1301, USA.
  */
 
-
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMapElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -34,7 +34,6 @@ SVGFEDisplacementMapElement::SVGFEDisplacementMapElement(const QualifiedName& ta
     , m_xChannelSelector(this, SVGNames::xChannelSelectorAttr, CHANNEL_A)
     , m_yChannelSelector(this, SVGNames::yChannelSelectorAttr, CHANNEL_A)
     , m_scale(this, SVGNames::scaleAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -73,24 +72,18 @@ void SVGFEDisplacementMapElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEDisplacementMapElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEDisplacementMapElement::build(FilterBuilder* builder)
+bool SVGFEDisplacementMapElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input1 = builder->getEffectById(in1());
-    FilterEffect* input2 = builder->getEffectById(in2());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+    FilterEffect* input2 = filterResource->builder()->getEffectById(in2());
     
     if(!input1 || !input2)
         return false;
         
     
-    RefPtr<FilterEffect> addedEffect = FEDisplacementMap::create(input1, input2, static_cast<ChannelSelectorType> (xChannelSelector()), 
-                                        static_cast<ChannelSelectorType> (yChannelSelector()), scale());
-    builder->add(result(), addedEffect.release());
+    RefPtr<FilterEffect> effect = FEDisplacementMap::create(input1, input2, static_cast<ChannelSelectorType>(xChannelSelector()), 
+                                        static_cast<ChannelSelectorType>(yChannelSelector()), scale());
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h
index 21b93f4d95..48e6930623 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFEDisplacementMapElement_h
 #define SVGFEDisplacementMapElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMap.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -34,8 +34,7 @@ namespace WebCore {
         static ChannelSelectorType stringToChannel(const String&);
         
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
         
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::inAttrString, String, In1, in1)
@@ -43,8 +42,6 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::xChannelSelectorAttrString, int, XChannelSelector, xChannelSelector)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::yChannelSelectorAttrString, int, YChannelSelector, yChannelSelector)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::scaleAttrString, float, Scale, scale)
-
-        mutable RefPtr<FEDisplacementMap> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl
index d819794897..4fde2191bd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDisplacementMapElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFEDisplacementMapElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEDisplacementMapElement : SVGElement,
                                                               SVGFilterPrimitiveStandardAttributes {    
         // Channel Selectors
         const unsigned short SVG_CHANNEL_UNKNOWN = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp
index e9ec48d320..35c487bed7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDistantLightElement.h"
 #include "SVGDistantLightSource.h"
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h
index e43282f0b2..e34054917a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFEDistantLightElement_h
 #define SVGFEDistantLightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 
 namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.idl
index 8bd606704c..16e7467ec3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEDistantLightElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEDistantLightElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFEDistantLightElement : SVGElement {
         readonly attribute SVGAnimatedNumber azimuth;
         readonly attribute SVGAnimatedNumber elevation;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
index 98e7d6f805..e12b4e14fc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
@@ -22,13 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFloodElement.h"
 
-#include "Attr.h"
-#include "Document.h"
+#include "MappedAttribute.h"
 #include "RenderStyle.h"
-#include "SVGNames.h"
 #include "SVGRenderStyle.h"
 #include "SVGResourceFilter.h"
 
@@ -36,7 +34,7 @@ namespace WebCore {
 
 SVGFEFloodElement::SVGFEFloodElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_filterEffect(0)
+    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -46,23 +44,27 @@ SVGFEFloodElement::~SVGFEFloodElement()
 
 void SVGFEFloodElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
+    const String& value = attr->value();
+    if (attr->name() == SVGNames::inAttr)
+        setIn1BaseValue(value);
+    else
+        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEFloodElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
+    FilterEffect* input = filterResource->builder()->getEffectById(in1());
+
+    if(!input)
+        return false;
 
-bool SVGFEFloodElement::build(FilterBuilder* builder)
-{
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
 
     Color color = filterStyle->svgStyle()->floodColor();
     float opacity = filterStyle->svgStyle()->floodOpacity();
 
-    builder->add(result(), FEFlood::create(color, opacity));
+    RefPtr<FilterEffect> effect = FEFlood::create(input, color, opacity);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
index 046f418867..4a4cffcfdf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
@@ -23,9 +23,9 @@
 #ifndef SVGFEFloodElement_h
 #define SVGFEFloodElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "SVGFilterPrimitiveStandardAttributes.h"
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFlood.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore
 {
@@ -36,11 +36,10 @@ namespace WebCore
         virtual ~SVGFEFloodElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
-        mutable RefPtr<FEFlood> m_filterEffect;
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEFloodElement, SVGNames::feFloodTagString, SVGNames::inAttrString, String, In1, in1)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
index d2356bf273..814bbdfa5d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
@@ -25,8 +25,10 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFloodElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEFloodElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
-    };
 
+        readonly attribute SVGAnimatedString      in1;
+
+    };
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp
index 595e2e62ed..41118fefa1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncAElement.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h
index 3fd6816d69..2c24039f1a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncAElement_h
 #define SVGFEFuncAElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.idl
index 7675f7df3b..8901551706 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncAElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncAElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncAElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp
index de6cb8899a..190b23ac37 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncBElement.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h
index 2dd9615e80..1eb0889ba1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncBElement_h
 #define SVGFEFuncBElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.idl
index 7717f6a363..fada0282d7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncBElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncBElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncBElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp
index 958f547678..d5e5625e6c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncGElement.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h
index 8f1c3682bd..973360e117 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncGElement_h
 #define SVGFEFuncGElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.idl
index 1ec24fae1d..33fc9a0f0d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncGElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncGElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncGElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp
index e376781389..e3d7ee4052 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncRElement.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h
index 49214886bd..3553954792 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncRElement_h
 #define SVGFEFuncRElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.idl
index 0a6ac30edb..e9b8e26f58 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFuncRElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncRElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncRElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp
index 4fbabe35b3..be3554f811 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEGaussianBlurElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
@@ -39,7 +40,6 @@ SVGFEGaussianBlurElement::SVGFEGaussianBlurElement(const QualifiedName& tagName,
     , m_in1(this, SVGNames::inAttr)
     , m_stdDeviationX(this, SVGNames::stdDeviationAttr)
     , m_stdDeviationY(this, SVGNames::stdDeviationAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -47,8 +47,9 @@ SVGFEGaussianBlurElement::~SVGFEGaussianBlurElement()
 {
 }
 
-void SVGFEGaussianBlurElement::setStdDeviation(float stdDeviationX, float stdDeviationY)
+void SVGFEGaussianBlurElement::setStdDeviation(float, float)
 {
+    // FIXME: Needs an implementation.
 }
 
 void SVGFEGaussianBlurElement::parseMappedAttribute(MappedAttribute* attr)
@@ -66,20 +67,15 @@ void SVGFEGaussianBlurElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEGaussianBlurElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEGaussianBlurElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEGaussianBlurElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
 
-    builder->add(result(), FEGaussianBlur::create(input1, stdDeviationX(), stdDeviationY()));
+    RefPtr<FilterEffect> effect = FEGaussianBlur::create(input1, stdDeviationX(), stdDeviationY());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
index 9e1c15c4df..187c2129cc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEGaussianBlurElement_h
 #define SVGFEGaussianBlurElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEGaussianBlur.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -40,15 +40,12 @@ namespace WebCore {
         void setStdDeviation(float stdDeviationX, float stdDeviationY);
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGStdDeviationXAttrIdentifier, float, StdDeviationX, stdDeviationX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGStdDeviationYAttrIdentifier, float, StdDeviationY, stdDeviationY)
-
-        mutable RefPtr<FEGaussianBlur> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.idl
index 7dc7526bf0..efa09b800f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEGaussianBlurElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEGaussianBlurElement : SVGElement,
                                                            SVGFilterPrimitiveStandardAttributes { 
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber stdDeviationX;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
index 3ceb5604d6..ae69e0d15d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
@@ -22,13 +22,14 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEImageElement.h"
 
 #include "Attr.h"
 #include "CachedImage.h"
 #include "DocLoader.h"
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPreserveAspectRatio.h"
@@ -42,8 +43,6 @@ SVGFEImageElement::SVGFEImageElement(const QualifiedName& tagName, Document* doc
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
-    , m_cachedImage(0)
-    , m_filterEffect(0)
 {
 }
 
@@ -81,24 +80,17 @@ void SVGFEImageElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
-void SVGFEImageElement::notifyFinished(CachedResource* finishedObj)
+void SVGFEImageElement::notifyFinished(CachedResource*)
 {
-    if (finishedObj == m_cachedImage && m_filterEffect)
-        m_filterEffect->setCachedImage(m_cachedImage.get());
 }
 
-SVGFilterEffect* SVGFEImageElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEImageElement::build(FilterBuilder* builder)
+bool SVGFEImageElement::build(SVGResourceFilter* filterResource)
 {
     if(!m_cachedImage)
         return false;
 
-    builder->add(result(), FEImage::create(m_cachedImage.get()));
+    RefPtr<FilterEffect> effect = FEImage::create(m_cachedImage.get());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
index 98d59413c3..67f3bd5e7d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEImageElement_h
 #define SVGFEImageElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "CachedResourceHandle.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGURIReference.h"
@@ -47,17 +47,15 @@ namespace WebCore {
         virtual void notifyFinished(CachedResource*);
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     protected:
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
         virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
         CachedResourceHandle<CachedImage> m_cachedImage;
-        mutable RefPtr<FEImage> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl
index c9ee66905f..23b9c86c8f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEImageElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEImageElement : SVGElement,
                                                     SVGURIReference,
                                                     SVGLangSpace,
                                                     SVGExternalResourcesRequired,
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp
index 73c088f6e1..bb954eb4a4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.cpp
@@ -21,8 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
+
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
index 5c4a78550f..a66ccf5dab 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
@@ -22,7 +22,7 @@
 #ifndef SVGFELightElement_h
 #define SVGFELightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 #include "SVGLightSource.h"
 
@@ -56,5 +56,5 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
index 5ccf403605..0640066332 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMergeElement.h"
 
 #include "SVGFEMergeNodeElement.h"
@@ -32,7 +32,6 @@ namespace WebCore {
 
 SVGFEMergeElement::SVGFEMergeElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_filterEffect(0)
 {
 }
 
@@ -40,18 +39,12 @@ SVGFEMergeElement::~SVGFEMergeElement()
 {
 }
 
-SVGFilterEffect* SVGFEMergeElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEMergeElement::build(FilterBuilder* builder)
+bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
 {
     Vector<FilterEffect*> mergeInputs;
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feMergeNodeTag)) {
-            FilterEffect* mergeEffect = builder->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
+            FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
             mergeInputs.append(mergeEffect);
         }
     }
@@ -59,7 +52,8 @@ bool SVGFEMergeElement::build(FilterBuilder* builder)
     if(mergeInputs.isEmpty())
         return false;
 
-    builder->add(result(), FEMerge::create(mergeInputs));
+    RefPtr<FilterEffect> effect = FEMerge::create(mergeInputs);
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h
index 6449286085..e63ed04fa4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEMergeElement_h
 #define SVGFEMergeElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMerge.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -34,11 +34,7 @@ namespace WebCore {
         SVGFEMergeElement(const QualifiedName&, Document*);
         virtual ~SVGFEMergeElement();
 
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
-
-    private:
-        mutable RefPtr<FEMerge> m_filterEffect;
+        virtual bool build(SVGResourceFilter*);
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.idl
index 6cec2fc359..0b03845dca 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEMergeElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEMergeElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp
index e68f4d72c1..ae08706ba4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -22,9 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMergeNodeElement.h"
 
+#include "MappedAttribute.h"
+
 namespace WebCore {
 
 SVGFEMergeNodeElement::SVGFEMergeNodeElement(const QualifiedName& tagName, Document* doc)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
index c1abd2fc30..e2af6429c2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEMergeNodeElement_h
 #define SVGFEMergeNodeElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.idl
index f385755fc8..4bddcb2f23 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEMergeNodeElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFEMergeNodeElement : SVGElement {
         readonly attribute SVGAnimatedString in1;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp
index 4fa572fc00..c7e4e77186 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.cpp
@@ -22,10 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEOffsetElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -35,7 +36,6 @@ SVGFEOffsetElement::SVGFEOffsetElement(const QualifiedName& tagName, Document* d
     , m_in1(this, SVGNames::inAttr)
     , m_dx(this, SVGNames::dxAttr)
     , m_dy(this, SVGNames::dyAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -56,20 +56,15 @@ void SVGFEOffsetElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEOffsetElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEOffsetElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEOffsetElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
 
-    builder->add(result(), FEOffset::create(input1, dx(), dy()));
+    RefPtr<FilterEffect> effect = FEOffset::create(input1, dx(), dy());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h
index 2d1b0ba225..1471abe8e3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEOffsetElement_h
 #define SVGFEOffsetElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGFEOffset.h"
 
@@ -35,15 +35,12 @@ namespace WebCore {
         virtual ~SVGFEOffsetElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::dxAttrString, float, Dx, dx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::dyAttrString, float, Dy, dy)
-
-        mutable RefPtr<FEOffset> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.idl
index a62d8da06f..ba3ee4e7df 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEOffsetElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEOffsetElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEOffsetElement : SVGElement,
                                                      SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber dx;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp
index f30f6dbd76..088f8787c8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEPointLightElement.h"
 #include "SVGPointLightSource.h"
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h
index 5b72e093bb..edb9f9d149 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFEPointLightElement_h
 #define SVGFEPointLightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 
 namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.idl
index 12dbe2f034..f5ad94c385 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEPointLightElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEPointLightElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFEPointLightElement : SVGElement {
         readonly attribute SVGAnimatedNumber x;
         readonly attribute SVGAnimatedNumber y;
         readonly attribute SVGAnimatedNumber z;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp
index c7b7410dbd..36dd453593 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -21,13 +21,14 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpecularLightingElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGColor.h"
-#include "SVGNames.h"
 #include "SVGFELightElement.h"
+#include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
 
@@ -41,7 +42,6 @@ SVGFESpecularLightingElement::SVGFESpecularLightingElement(const QualifiedName&
     , m_surfaceScale(this, SVGNames::surfaceScaleAttr, 1.0f)
     , m_kernelUnitLengthX(this, SVGNames::kernelUnitLengthAttr)
     , m_kernelUnitLengthY(this, SVGNames::kernelUnitLengthAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -70,12 +70,6 @@ void SVGFESpecularLightingElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFESpecularLightingElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 LightSource* SVGFESpecularLightingElement::findLights() const
 {
     LightSource* light = 0;
@@ -92,9 +86,9 @@ LightSource* SVGFESpecularLightingElement::findLights() const
     return light;
 }
 
-bool SVGFESpecularLightingElement::build(FilterBuilder* builder)
+bool SVGFESpecularLightingElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
     
     if(!input1)
         return false;
@@ -103,9 +97,9 @@ bool SVGFESpecularLightingElement::build(FilterBuilder* builder)
     
     Color color = filterStyle->svgStyle()->lightingColor();
     
-    RefPtr<FilterEffect> addedEffect = FESpecularLighting::create(input1, color, surfaceScale(), specularConstant(), 
+    RefPtr<FilterEffect> effect = FESpecularLighting::create(input1, color, surfaceScale(), specularConstant(), 
                                         specularExponent(), kernelUnitLengthX(), kernelUnitLengthY(), findLights());
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h
index d76cb43d30..8ef490a01e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.h
@@ -22,7 +22,7 @@
 #ifndef SVGFESpecularLightingElement_h
 #define SVGFESpecularLightingElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpecularLighting.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -39,8 +39,7 @@ namespace WebCore {
         virtual ~SVGFESpecularLightingElement();
         
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::inAttrString, String, In1, in1)
@@ -49,8 +48,6 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::surfaceScaleAttrString, float, SurfaceScale, surfaceScale)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
-
-        mutable RefPtr<FESpecularLighting> m_filterEffect;
         
         LightSource* findLights() const;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.idl
index d79a70ebc4..5fce7fafb8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpecularLightingElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFESpecularLightingElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFESpecularLightingElement : SVGElement,
                                                                SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber surfaceScale;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp
index 5add579be8..980a3bb6cd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpotLightElement.h"
 #include "SVGSpotLightSource.h"
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h
index 2989b14d62..629e51a13c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFESpotLightElement_h
 #define SVGFESpotLightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 
 namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.idl
index 339d545630..5a41202519 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFESpotLightElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFESpotLightElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFESpotLightElement : SVGElement {
         readonly attribute SVGAnimatedNumber x;
         readonly attribute SVGAnimatedNumber y;
         readonly attribute SVGAnimatedNumber z;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp
index bf90c33dec..d5828eb964 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.cpp
@@ -22,10 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETileElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "SVGRenderStyle.h"
 #include "SVGResourceFilter.h"
 
@@ -34,7 +35,6 @@ namespace WebCore {
 SVGFETileElement::SVGFETileElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
     , m_in1(this, SVGNames::inAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -51,20 +51,15 @@ void SVGFETileElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFETileElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFETileElement::build(SVGResourceFilter* filterResource)
 {
-   ASSERT_NOT_REACHED();
-   return 0;
-}
-
-bool SVGFETileElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
 
-    builder->add(result(), FETile::create(input1));
+    RefPtr<FilterEffect> effect = FETile::create(input1);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h
index ba681151c3..b4fc0c54ba 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFETileElement_h
 #define SVGFETileElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGFETile.h"
 
@@ -35,13 +35,10 @@ namespace WebCore {
         virtual ~SVGFETileElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETileElement, SVGNames::feTileTagString, SVGNames::inAttrString, String, In1, in1)
-
-        mutable RefPtr<FETile> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.idl
index 68bfcc514c..4a59a05a85 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETileElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFETileElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFETileElement : SVGElement,
                                                    SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp
index f51d835a5b..b296e00598 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETurbulenceElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
 
@@ -41,7 +42,6 @@ SVGFETurbulenceElement::SVGFETurbulenceElement(const QualifiedName& tagName, Doc
     , m_seed(this, SVGNames::seedAttr)
     , m_stitchTiles(this, SVGNames::stitchTilesAttr, SVG_STITCHTYPE_NOSTITCH)
     , m_type(this, SVGNames::typeAttr, FETURBULENCE_TYPE_TURBULENCE)
-    , m_filterEffect(0)
 {
 }
 
@@ -76,17 +76,11 @@ void SVGFETurbulenceElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFETurbulenceElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFETurbulenceElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFETurbulenceElement::build(FilterBuilder* builder)
-{
-    RefPtr<FilterEffect> addedEffect = FETurbulence::create(static_cast<TurbulanceType> (type()), baseFrequencyX(), 
+    RefPtr<FilterEffect> effect = FETurbulence::create(static_cast<TurbulanceType>(type()), baseFrequencyX(), 
                                         baseFrequencyY(), numOctaves(), seed(), stitchTiles() == SVG_STITCHTYPE_STITCH);
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h
index bae2d9b043..3c95da8d1b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFETurbulenceElement_h
 #define SVGFETurbulenceElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETurbulence.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -44,8 +44,7 @@ namespace WebCore {
         virtual ~SVGFETurbulenceElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGBaseFrequencyXIdentifier, float, BaseFrequencyX, baseFrequencyX)
@@ -54,8 +53,6 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::seedAttrString, float, Seed, seed)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::stitchTilesAttrString, int, StitchTiles, stitchTiles)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::typeAttrString, int, Type, type)
-
-        mutable RefPtr<FETurbulence> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl
index 79fc63fa36..9cec66c111 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFETurbulenceElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFETurbulenceElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFETurbulenceElement : SVGElement,
                                                          SVGFilterPrimitiveStandardAttributes { 
         // Turbulence Types
         const unsigned short SVG_TURBULENCE_TYPE_UNKNOWN      = 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
index 774232f959..7703b6f8fa 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
@@ -23,14 +23,17 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterElement.h"
 
 #include "Attr.h"
-#include "SVGResourceFilter.h"
+#include "SVGFilterBuilder.h"
+#include "MappedAttribute.h"
+#include "PlatformString.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
+#include "SVGResourceFilter.h"
 #include "SVGUnitTypes.h"
 
 namespace WebCore {
@@ -130,19 +133,18 @@ SVGResource* SVGFilterElement::canvasResource()
     bool primitiveBBoxMode = primitiveUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
 
-    // TODO : use switch/case instead?
-    m_filter->clearEffects();
+    m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         SVGElement* element = 0;
-        if (n->isSVGElement())
+        if (n->isSVGElement()) {
             element = static_cast<SVGElement*>(n);
-        if (element && element->isFilterEffect()) {
-            SVGFilterPrimitiveStandardAttributes* filterAttributes = static_cast<SVGFilterPrimitiveStandardAttributes*>(element);
-            SVGFilterEffect* filterEffect = filterAttributes->filterEffect(m_filter.get());
-            if (!filterEffect)
-                continue;
-
-            m_filter->addFilterEffect(filterEffect);
+            if (element->isFilterEffect()) {
+                SVGFilterPrimitiveStandardAttributes* effectElement = static_cast<SVGFilterPrimitiveStandardAttributes*>(element);
+                if (!effectElement->build(m_filter.get())) {
+                    m_filter->builder()->clearEffects();
+                    break;
+                }
+            }
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
index c907b9c5e0..541ec14ac4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
@@ -24,7 +24,7 @@
 #ifndef SVGFilterElement_h
 #define SVGFilterElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGResourceFilter.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.idl
index 9d1e15ae20..10b4f5e778 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFilterElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFilterElement : SVGElement,
                                                    SVGURIReference,
                                                    SVGLangSpace,
                                                    SVGExternalResourcesRequired,
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index eab7bdd85b..13116a5fbe 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -22,11 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
-#include "SVGFilterElement.h"
-#include "SVGFilterEffect.h"
+#include "FilterEffect.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGStyledElement.h"
@@ -69,17 +69,17 @@ void SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(MappedAttribute*
         return SVGStyledElement::parseMappedAttribute(attr);
 }
 
-void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGFilterEffect* filterEffect) const
+void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilter* resourceFilter, FilterEffect* filterEffect) const
 {
     ASSERT(filterEffect);
     if (!filterEffect)
         return;
 
-    ASSERT(filterEffect->filter());
+    ASSERT(resourceFilter);
 
     float _x, _y, _width, _height;
 
-    if (filterEffect->filter()->effectBoundingBoxMode()) {
+    if (resourceFilter->effectBoundingBoxMode()) {
         _x = x().valueAsPercentage();
         _y = y().valueAsPercentage();
         _width = width().valueAsPercentage();
@@ -120,7 +120,6 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGFilterEffect
     }
 
     filterEffect->setSubRegion(FloatRect(_x, _y, _width, _height));
-    filterEffect->setResult(result());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index bbdeb0033c..fa82f6a419 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -23,15 +23,15 @@
 #ifndef SVGFilterPrimitiveStandardAttributes_h
 #define SVGFilterPrimitiveStandardAttributes_h
 
-#if ENABLE(SVG)
-#include "FilterBuilder.h"
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFilterBuilder.h"
+#include "SVGResourceFilter.h"
 #include "SVGStyledElement.h"
 
 namespace WebCore {
 
     extern char SVGFilterPrimitiveStandardAttributesIdentifier[];
 
-    class SVGFilterEffect;
     class SVGResourceFilter;
 
     class SVGFilterPrimitiveStandardAttributes : public SVGStyledElement {
@@ -42,13 +42,14 @@ namespace WebCore {
         virtual bool isFilterEffect() const { return true; }
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const = 0;
+        virtual bool build(SVGResourceFilter*) = 0;
 
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
     protected:
+        friend class SVGResourceFilter;
+        void setStandardAttributes(SVGResourceFilter*, FilterEffect*) const;
         virtual const SVGElement* contextElement() const { return this; }
-        void setStandardAttributes(SVGFilterEffect*) const;
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::xAttrString, SVGLength, X, x)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
index 13e4c03768..847038c0ca 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
@@ -25,13 +25,14 @@
 #if ENABLE(SVG)
 #include "SVGFitToViewBox.h"
 
-#include "TransformationMatrix.h"
 #include "Document.h"
 #include "FloatRect.h"
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGPreserveAspectRatio.h"
 #include "StringImpl.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp
index 6211d8910e..7e3cec049f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFont.cpp
@@ -253,8 +253,8 @@ struct SVGTextRunWalker {
         bool haveAltGlyph = false;
         SVGGlyphIdentifier altGlyphIdentifier;
         if (RenderObject* renderObject = run.referencingRenderObject()) {
-            if (renderObject->element() && renderObject->element()->hasTagName(SVGNames::altGlyphTag)) {
-                SVGGlyphElement* glyphElement = static_cast<SVGAltGlyphElement*>(renderObject->element())->glyphElement();
+            if (renderObject->node() && renderObject->node()->hasTagName(SVGNames::altGlyphTag)) {
+                SVGGlyphElement* glyphElement = static_cast<SVGAltGlyphElement*>(renderObject->node())->glyphElement();
                 if (glyphElement) {
                     haveAltGlyph = true;
                     altGlyphIdentifier = glyphElement->buildGlyphIdentifier();
@@ -340,7 +340,7 @@ struct SVGTextRunWalkerMeasuredLengthData {
     const Font* font;
 };
 
-bool floatWidthUsingSVGFontCallback(const SVGGlyphIdentifier& identifier, SVGTextRunWalkerMeasuredLengthData& data)
+static bool floatWidthUsingSVGFontCallback(const SVGGlyphIdentifier& identifier, SVGTextRunWalkerMeasuredLengthData& data)
 {
     if (data.at >= data.from && data.at < data.to)
         data.length += identifier.horizontalAdvanceX * data.scale;
@@ -349,7 +349,7 @@ bool floatWidthUsingSVGFontCallback(const SVGGlyphIdentifier& identifier, SVGTex
     return data.at < data.to;
 }
 
-void floatWidthMissingGlyphCallback(const TextRun& run, SVGTextRunWalkerMeasuredLengthData& data)
+static void floatWidthMissingGlyphCallback(const TextRun& run, SVGTextRunWalkerMeasuredLengthData& data)
 {
     // Handle system font fallback
     FontDescription fontDescription(data.font->fontDescription());
@@ -407,7 +407,7 @@ static float floatWidthOfSubStringUsingSVGFont(const Font* font, const TextRun&
         if (RenderObject* renderObject = run.referencingRenderObject()) {
             isVerticalText = isVerticalWritingMode(renderObject->style()->svgStyle());
 
-            if (SVGElement* element = static_cast<SVGElement*>(renderObject->element()))
+            if (SVGElement* element = static_cast<SVGElement*>(renderObject->node()))
                 language = element->getAttribute(XMLNames::langAttr);
         }
 
@@ -442,13 +442,13 @@ struct SVGTextRunWalkerDrawTextData {
     Vector<UChar> fallbackCharacters;
 };
 
-bool drawTextUsingSVGFontCallback(const SVGGlyphIdentifier& identifier, SVGTextRunWalkerDrawTextData& data)
+static bool drawTextUsingSVGFontCallback(const SVGGlyphIdentifier& identifier, SVGTextRunWalkerDrawTextData& data)
 {
     data.glyphIdentifiers.append(identifier);
     return true;
 }
 
-void drawTextMissingGlyphCallback(const TextRun& run, SVGTextRunWalkerDrawTextData& data)
+static void drawTextMissingGlyphCallback(const TextRun& run, SVGTextRunWalkerDrawTextData& data)
 {
     ASSERT(run.length() == 1);
     data.glyphIdentifiers.append(SVGGlyphIdentifier());
@@ -496,7 +496,7 @@ void Font::drawTextUsingSVGFont(GraphicsContext* context, const TextRun& run,
         if (run.referencingRenderObject()) {
             isVerticalText = isVerticalWritingMode(run.referencingRenderObject()->style()->svgStyle());    
 
-            if (SVGElement* element = static_cast<SVGElement*>(run.referencingRenderObject()->element()))
+            if (SVGElement* element = static_cast<SVGElement*>(run.referencingRenderObject()->node()))
                 language = element->getAttribute(XMLNames::langAttr);
         }
 
@@ -533,6 +533,9 @@ void Font::drawTextUsingSVGFont(GraphicsContext* context, const TextRun& run,
                     context->beginPath();
                     context->addPath(identifier.pathData);
 
+                    // FIXME: setup() tries to get objectBoundingBox() from run.referencingRenderObject()
+                    // which is wrong.  We need to change setup() to take a bounding box instead, or pass
+                    // a RenderObject which would return the bounding box for identifier.pathData
                     if (activePaintServer->setup(context, run.referencingRenderObject(), targetType)) {
                         // Spec: Any properties specified on a text elements which represents a length, such as the
                         // 'stroke-width' property, might produce surprising results since the length value will be
@@ -553,10 +556,10 @@ void Font::drawTextUsingSVGFont(GraphicsContext* context, const TextRun& run,
                     currentPoint.move(identifier.horizontalAdvanceX * scale, 0.0f);
             } else {
                 // Handle system font fallback
-                FontDescription fontDescription(context->font().fontDescription());
+                FontDescription fontDescription(m_fontDescription);
                 fontDescription.setFamily(FontFamily());
                 Font font(fontDescription, 0, 0); // spacing handled by SVG text code.
-                font.update(context->font().fontSelector());
+                font.update(fontSelector());
 
                 TextRun fallbackCharacterRun(run);
                 fallbackCharacterRun.setText(&data.fallbackCharacters[run.rtl() ? data.fallbackCharacters.size() - fallbackCharacterIndex - 1 : fallbackCharacterIndex], 1);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
index 973e890f8c..1e5a0febcf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
@@ -23,6 +23,7 @@
 
 #if ENABLE(SVG_FONTS)
 #include "SVGFontFaceElement.h"
+
 #include "CString.h"
 #include "CSSFontFaceRule.h"
 #include "CSSFontFaceSrcValue.h"
@@ -35,12 +36,12 @@
 #include "CSSValueList.h"
 #include "Document.h"
 #include "Font.h"
+#include "MappedAttribute.h"
 #include "SVGDefinitionSrcElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceSrcElement.h"
 #include "SVGGlyphElement.h"
 #include "SVGNames.h"
-
 #include <math.h>
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp
index 7f6c6d25d2..096f0c25f1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.cpp
@@ -1,5 +1,6 @@
 /*
    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+   Copyright (C) 2009 Apple Inc. All rights reserved.
 
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Library General Public
@@ -23,6 +24,10 @@
 #include "SVGFontFaceUriElement.h"
 
 #include "CSSFontFaceSrcValue.h"
+#include "CachedFont.h"
+#include "DocLoader.h"
+#include "Document.h"
+#include "MappedAttribute.h"
 #include "SVGFontFaceElement.h"
 #include "SVGNames.h"
 #include "XLinkNames.h"
@@ -36,6 +41,12 @@ SVGFontFaceUriElement::SVGFontFaceUriElement(const QualifiedName& tagName, Docum
 {
 }
 
+SVGFontFaceUriElement::~SVGFontFaceUriElement()
+{
+    if (m_cachedFont)
+        m_cachedFont->removeClient(this);
+}
+
 PassRefPtr<CSSFontFaceSrcValue> SVGFontFaceUriElement::srcValue() const
 {
     RefPtr<CSSFontFaceSrcValue> src = CSSFontFaceSrcValue::create(getAttribute(XLinkNames::hrefAttr));
@@ -44,6 +55,15 @@ PassRefPtr<CSSFontFaceSrcValue> SVGFontFaceUriElement::srcValue() const
     return src.release();
 }
 
+void SVGFontFaceUriElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    const QualifiedName& attrName = attr->name();
+    if (attrName == XLinkNames::hrefAttr)
+        loadFont();
+    else
+        SVGElement::parseMappedAttribute(attr);
+}
+
 void SVGFontFaceUriElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
@@ -56,6 +76,28 @@ void SVGFontFaceUriElement::childrenChanged(bool changedByParser, Node* beforeCh
         static_cast<SVGFontFaceElement*>(grandParent)->rebuildFontFace();
 }
 
+void SVGFontFaceUriElement::insertedIntoDocument()
+{
+    loadFont();
+    SVGElement::insertedIntoDocument();
+}
+
+void SVGFontFaceUriElement::loadFont()
+{
+    if (m_cachedFont)
+        m_cachedFont->removeClient(this);
+
+    String href = getAttribute(XLinkNames::hrefAttr);
+    if (!href.isNull()) {        
+        DocLoader* docLoader = document()->docLoader();
+        m_cachedFont = docLoader->requestFont(href);
+        m_cachedFont->setSVGFont(true);
+        m_cachedFont->addClient(this);
+        m_cachedFont->beginLoadIfNeeded(docLoader);
+    } else
+        m_cachedFont = 0;
+}
+
 }
 
 #endif // ENABLE(SVG_FONTS)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.h
index cdeb743bdf..1d880e5568 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceUriElement.h
@@ -21,17 +21,30 @@
 #define SVGFontFaceUriElement_h
 
 #if ENABLE(SVG_FONTS)
+#include "CachedResourceClient.h"
+#include "CachedResourceHandle.h"
 #include "SVGElement.h"
 
 namespace WebCore {
+
     class CSSFontFaceSrcValue;
-    class SVGFontFaceUriElement : public SVGElement {
+    class CachedFont;
+
+    class SVGFontFaceUriElement : public SVGElement, public CachedResourceClient {
     public:
         SVGFontFaceUriElement(const QualifiedName&, Document*);
+        ~SVGFontFaceUriElement();
         
         PassRefPtr<CSSFontFaceSrcValue> srcValue() const;
-        
+
+        virtual void parseMappedAttribute(MappedAttribute*);
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+        virtual void insertedIntoDocument();
+
+    private:
+        void loadFont();
+
+        CachedResourceHandle<CachedFont> m_cachedFont;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
index 342a6f0317..5cfca8ae04 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
@@ -26,10 +26,10 @@
 #include "SVGForeignObjectElement.h"
 
 #include "CSSPropertyNames.h"
+#include "MappedAttribute.h"
 #include "RenderForeignObject.h"
-#include "SVGNames.h"
 #include "SVGLength.h"
-
+#include "SVGNames.h"
 #include <wtf/Assertions.h>
 
 namespace WebCore {
@@ -113,7 +113,7 @@ static inline void addCSSPropertyAndNotifyAttributeMap(StyledElement* element, c
         attrs->declRemoved();
     }
 
-    element->setChanged();
+    element->setNeedsStyleRecalc();
     element->addCSSProperty(mappedAttr, cssProperty, value);
 
     if (CSSMappedAttributeDeclaration* decl = mappedAttr->decl()) {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp
index ebf5dd0f65..7be0181552 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.cpp
@@ -24,9 +24,10 @@
 #if ENABLE(SVG_FONTS)
 #include "SVGGlyphElement.h"
 
+#include "MappedAttribute.h"
+#include "SVGFontData.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
-#include "SVGFontData.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SimpleFontData.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.h b/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.h
index 62ae263a96..0662097e0e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGlyphElement.h
@@ -31,7 +31,7 @@
 namespace WebCore {
 
     class AtomicString;
-    struct SVGFontData;
+    class SVGFontData;
 
     // Describe a SVG <glyph> element
     struct SVGGlyphIdentifier {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
index e4e32137a0..80342869b9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGGradientElement.h"
 
 #include "CSSStyleSelector.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "RenderSVGHiddenContainer.h"
 #include "SVGNames.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.h b/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.h
index 6fda779ce8..32772bdb5a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGHKernElement.h
@@ -31,7 +31,7 @@
 namespace WebCore {
 
     class AtomicString;
-    struct SVGFontData;
+    class SVGFontData;
 
     // Describe an SVG <hkern> element
     struct SVGHorizontalKerningPair {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
index c827c89422..9aff93d3af 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
@@ -27,6 +27,7 @@
 #include "SVGImageElement.h"
 
 #include "CSSPropertyNames.h"
+#include "MappedAttribute.h"
 #include "RenderSVGImage.h"
 #include "SVGDocument.h"
 #include "SVGLength.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageLoader.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageLoader.cpp
index 6e0915d001..9333f7536a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageLoader.cpp
@@ -42,16 +42,12 @@ SVGImageLoader::~SVGImageLoader()
 
 void SVGImageLoader::dispatchLoadEvent()
 {
-    if (!haveFiredLoadEvent() && image()) {
-        setHaveFiredLoadEvent(true);
-        
-        if (image()->errorOccurred())
-            element()->dispatchEventForType(eventNames().errorEvent, false, false);
-        else {
-            SVGImageElement* imageElement = static_cast<SVGImageElement*>(element());
-            if (imageElement->externalResourcesRequiredBaseValue())
-                imageElement->sendSVGLoadEventIfPossible(true);
-        }
+    if (image()->errorOccurred())
+        element()->dispatchEvent(eventNames().errorEvent, false, false);
+    else {
+        SVGImageElement* imageElement = static_cast<SVGImageElement*>(element());
+        if (imageElement->externalResourcesRequiredBaseValue())
+            imageElement->sendSVGLoadEventIfPossible(true);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp
index 099934de75..d49e09a332 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLangSpace.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGLangSpace.h"
 
+#include "MappedAttribute.h"
 #include "SVGElement.h"
 #include "XMLNames.h"
 #include <wtf/StdLibExtras.h>
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp
index 86714f9be4..ca3bac3f3f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLength.cpp
@@ -285,7 +285,7 @@ float SVGLength::PercentageOfViewport(float value, const SVGElement* context, SV
     Document* doc = context->document();
     if (doc->documentElement() == context) {
         // We have to ask the canvas for the full "canvas size"...
-        RenderView* view = static_cast<RenderView*>(doc->renderer());
+        RenderView* view = toRenderView(doc->renderer());
         if (view && view->frameView()) {
             width = view->frameView()->visibleWidth(); // TODO: recheck!
             height = view->frameView()->visibleHeight(); // TODO: recheck!
@@ -301,8 +301,11 @@ float SVGLength::PercentageOfViewport(float value, const SVGElement* context, SV
         }
     } else if (context->parent() && !context->parent()->isSVGElement()) {
         if (RenderObject* renderer = context->renderer()) {
-            width = renderer->width();
-            height = renderer->height();
+            if (renderer->isBox()) {
+                RenderBox* box = toRenderBox(renderer);
+                width = box->width();
+                height = box->height();
+            }
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
index 12f54e3016..17c110c542 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGLineElement.h"
 
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
index ac2b6b1282..9927a506c9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
@@ -28,6 +28,7 @@
 #include "Document.h"
 #include "FloatPoint.h"
 #include "LinearGradientAttributes.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPaintServerLinearGradient.h"
@@ -87,6 +88,7 @@ void SVGLinearGradientElement::buildGradient() const
     FloatPoint endPoint = FloatPoint::narrowPrecision(attributes.x2(), attributes.y2());
 
     RefPtr<Gradient> gradient = Gradient::create(startPoint, endPoint);
+    gradient->setSpreadMethod(attributes.spreadMethod());
 
     Vector<SVGGradientStop> m_stops = attributes.stops();
     float previousOffset = 0.0f;
@@ -107,7 +109,6 @@ void SVGLinearGradientElement::buildGradient() const
     linearGradient->setGradientStops(attributes.stops());
 
     // These should possibly be supported on Gradient
-    linearGradient->setGradientSpreadMethod(attributes.spreadMethod());
     linearGradient->setGradientTransform(attributes.gradientTransform());
     linearGradient->setGradientStart(startPoint);
     linearGradient->setGradientEnd(endPoint);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGList.h b/src/3rdparty/webkit/WebCore/svg/SVGList.h
index d4f764121c..53815986f0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGList.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGList.h
@@ -96,7 +96,11 @@ namespace WebCore {
 
         Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
         {
-            m_vector.insert(index, newItem);
+            if (index < m_vector.size()) {
+                m_vector.insert(index, newItem);
+            } else {
+                m_vector.append(newItem);
+            }
             return newItem;
         }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp
index 002bf28761..00acc2a0d7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLocatable.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -40,69 +39,52 @@ SVGLocatable::~SVGLocatable()
 {
 }
 
-SVGElement* SVGLocatable::nearestViewportElement(const SVGElement* e)
+static bool isViewportElement(Node* node)
 {
-    Node* n = e->parentNode();
-    while (n && !n->isDocumentNode()) {
-        if (n->hasTagName(SVGNames::svgTag) || n->hasTagName(SVGNames::symbolTag) ||
-            n->hasTagName(SVGNames::imageTag))
-            return static_cast<SVGElement*>(n);
+    return (node->hasTagName(SVGNames::svgTag)
+        || node->hasTagName(SVGNames::symbolTag)
 #if ENABLE(SVG_FOREIGN_OBJECT)
-        if (n->hasTagName(SVGNames::foreignObjectTag))
-            return static_cast<SVGElement*>(n);
+        || node->hasTagName(SVGNames::foreignObjectTag)
 #endif
+        || node->hasTagName(SVGNames::imageTag));
+}
 
-        n = n->parentNode();
+SVGElement* SVGLocatable::nearestViewportElement(const SVGElement* element)
+{
+    ASSERT(element);
+    for (Node* n = element->parentNode(); n && !n->isDocumentNode(); n = n->parentNode()) {
+        if (isViewportElement(n))
+            return static_cast<SVGElement*>(n);
     }
 
     return 0;
 }
 
-SVGElement* SVGLocatable::farthestViewportElement(const SVGElement* e)
+SVGElement* SVGLocatable::farthestViewportElement(const SVGElement* element)
 {
-    // FIXME : likely this will be always the <svg> farthest away.
-    // If we have a different implementation of documentElement(), one
-    // that give the documentElement() of the svg fragment, it could be
-    // used instead. This depends on cdf demands though(Rob.)
+    ASSERT(element);
     SVGElement* farthest = 0;
-    Node* n = e->parentNode();
-    while (n && !n->isDocumentNode()) {
-        if (n->hasTagName(SVGNames::svgTag) || n->hasTagName(SVGNames::symbolTag) ||
-            n->hasTagName(SVGNames::imageTag))
-            farthest = static_cast<SVGElement*>(n);
-#if ENABLE(SVG_FOREIGN_OBJECT)
-        if (n->hasTagName(SVGNames::foreignObjectTag))
+    for (Node* n = element->parentNode(); n && !n->isDocumentNode(); n = n->parentNode()) {
+        if (isViewportElement(n))
             farthest = static_cast<SVGElement*>(n);
-#endif
-
-        n = n->parentNode();
     }
-
     return farthest;
 }
 
-// Spec:
-// http://www.w3.org/TR/2005/WD-SVGMobile12-20050413/svgudom.html#svg::SVGLocatable
-FloatRect SVGLocatable::getBBox(const SVGElement* e)
+FloatRect SVGLocatable::getBBox(const SVGElement* element)
 {
-    FloatRect bboxRect;
+    element->document()->updateLayoutIgnorePendingStylesheets();
 
-    e->document()->updateLayoutIgnorePendingStylesheets();
+    // FIXME: Eventually we should support getBBox for detached elements.
+    if (!element->renderer())
+        return FloatRect();
 
-    if (e && e->renderer()) {
-        // Need this to make sure we have render object dimensions.
-        // See bug 11686.
-        bboxRect = e->renderer()->relativeBBox(false);
-    }
-
-    return bboxRect;
+    return element->renderer()->objectBoundingBox();
 }
 
 TransformationMatrix SVGLocatable::getCTM(const SVGElement* element)
 {
-    if (!element)
-        return TransformationMatrix();
-
+    ASSERT(element);
     TransformationMatrix ctm;
 
     Node* parent = element->parentNode();
@@ -119,9 +101,7 @@ TransformationMatrix SVGLocatable::getCTM(const SVGElement* element)
 
 TransformationMatrix SVGLocatable::getScreenCTM(const SVGElement* element)
 {
-    if (!element)
-        return TransformationMatrix();
-
+    ASSERT(element);
     TransformationMatrix ctm;
 
     Node* parent = element->parentNode();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
index a89c478432..55809939b1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGMarkerElement.h"
 
+#include "MappedAttribute.h"
 #include "PlatformString.h"
 #include "RenderSVGViewportContainer.h"
 #include "SVGAngle.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
index 9f9ae34805..59a5e01572 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
@@ -29,6 +29,7 @@
 #include "CSSStyleSelector.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
+#include "MappedAttribute.h"
 #include "RenderSVGContainer.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -124,7 +125,7 @@ void SVGMaskElement::childrenChanged(bool changedByParser, Node* beforeChange, N
     m_masker->invalidate();
 }
 
-auto_ptr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
+PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
 {    
     // Determine specified mask size
     float xValue;
@@ -145,7 +146,7 @@ auto_ptr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetR
     } 
 
     IntSize imageSize(lroundf(widthValue), lroundf(heightValue));
-    clampImageBufferSizeToViewport(document()->renderer(), imageSize);
+    clampImageBufferSizeToViewport(document()->view(), imageSize);
 
     if (imageSize.width() < static_cast<int>(widthValue))
         widthValue = imageSize.width();
@@ -153,9 +154,9 @@ auto_ptr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetR
     if (imageSize.height() < static_cast<int>(heightValue))
         heightValue = imageSize.height();
 
-    auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, false);
-    if (!maskImage.get())
-        return maskImage;
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, false);
+    if (!maskImage)
+        return 0;
 
     maskDestRect = FloatRect(xValue, yValue, widthValue, heightValue);
     if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
@@ -192,7 +193,7 @@ auto_ptr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetR
         maskImageContext->restore();
 
     maskImageContext->restore();
-    return maskImage;
+    return maskImage.release();
 }
  
 RenderObject* SVGMaskElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
index 4bcf82f31b..f2b7ae5627 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
@@ -29,6 +29,7 @@
 #include "SVGStyledLocatableElement.h"
 #include "SVGTests.h"
 #include "SVGURIReference.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -51,7 +52,7 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-        std::auto_ptr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
+        PassOwnPtr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
 
     protected:
         virtual const SVGElement* contextElement() const { return this; }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl b/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl
index fd733cd4df..cb8c08bd03 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMatrix.idl
@@ -34,19 +34,19 @@ module svg {
         attribute double e;
         attribute double f;
 
-        [Custom] SVGMatrix multiply(in SVGMatrix secondMatrix);
+        [Immutable] SVGMatrix multiply(in SVGMatrix secondMatrix);
         [Custom] SVGMatrix inverse()
             raises(SVGException);
-        [Custom] SVGMatrix translate(in float x, in float y);
-        [Custom] SVGMatrix scale(in float scaleFactor);
-        [Custom] SVGMatrix scaleNonUniform(in float scaleFactorX, in float scaleFactorY);
-        [Custom] SVGMatrix rotate(in float angle);
+        [Immutable] SVGMatrix translate(in float x, in float y);
+        [Immutable] SVGMatrix scale(in float scaleFactor);
+        [Immutable] SVGMatrix scaleNonUniform(in float scaleFactorX, in float scaleFactorY);
+        [Immutable] SVGMatrix rotate(in float angle);
         [Custom] SVGMatrix rotateFromVector(in float x, in float y)
             raises(SVGException);
-        [Custom] SVGMatrix flipX();
-        [Custom] SVGMatrix flipY();
-        [Custom] SVGMatrix skewX(in float angle);
-        [Custom] SVGMatrix skewY(in float angle);
+        [Immutable] SVGMatrix flipX();
+        [Immutable] SVGMatrix flipY();
+        [Immutable] SVGMatrix skewX(in float angle);
+        [Immutable] SVGMatrix skewY(in float angle);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp b/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp
index b38960b2e2..7d93f5989a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp
@@ -1,8 +1,8 @@
-/* This file is part of the KDE project
+/*
    Copyright (C) 2002, 2003 The Karbon Developers
                  2006       Alexander Kellett <lypanov@kde.org>
                  2006, 2007 Rob Buis <buis@kde.org>
-                 2007       Apple, Inc.  All rights reserved.
+   Copyrigth (C) 2007, 2009 Apple, Inc.  All rights reserved.
 
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Library General Public
@@ -226,9 +226,6 @@ bool pointsListFromSVGData(SVGPointList* pointsList, const String& points)
     
 bool SVGPathParser::parseSVG(const String& s, bool process)
 {
-    if (s.isEmpty())
-        return false;
-
     const UChar* ptr = s.characters();
     const UChar* end = ptr + s.length();
 
@@ -672,13 +669,16 @@ void SVGPathParser::calculateArc(bool relative, double& curx, double& cury, doub
         cury += y;    
 }
 
-class PathBuilder : public SVGPathParser
-{
+class PathBuilder : private SVGPathParser {
 public:
     bool build(Path* path, const String& d)
     {
-        m_path = path;
-        return parseSVG(d, true);
+        Path temporaryPath;
+        m_path = &temporaryPath;
+        if (!parseSVG(d, true))
+            return false;
+        temporaryPath.swap(*path);
+        return true;
     }
 
 private:
@@ -712,6 +712,7 @@ private:
     {
         m_path->closeSubpath();
     }
+
     Path* m_path;
     FloatPoint current;
 };
@@ -722,118 +723,106 @@ bool pathFromSVGData(Path& path, const String& d)
     return builder.build(&path, d);
 }
 
-class SVGPathSegListBuilder : public SVGPathParser
-{
+class SVGPathSegListBuilder : private SVGPathParser {
 public:
     bool build(SVGPathSegList* segList, const String& d, bool process)
     {
-        m_pathSegList = segList;
-        return parseSVG(d, process);
+        if (!parseSVG(d, process))
+            return false;
+        size_t size = m_vector.size();
+        for (size_t i = 0; i < size; ++i) {
+            ExceptionCode ec;
+            segList->appendItem(m_vector[i].release(), ec);
+        }
+        m_vector.clear();
+        return true;
     }
 
 private:
     virtual void svgMoveTo(double x1, double y1, bool, bool abs = true)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegMovetoAbs(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegMovetoAbs(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegMovetoRel(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegMovetoRel(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)));
     }
     virtual void svgLineTo(double x1, double y1, bool abs = true)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegLinetoAbs(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegLinetoAbs(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegLinetoRel(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegLinetoRel(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1)));
     }
     virtual void svgLineToHorizontal(double x, bool abs)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegLinetoHorizontalAbs(narrowPrecisionToFloat(x)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegLinetoHorizontalAbs(narrowPrecisionToFloat(x)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegLinetoHorizontalRel(narrowPrecisionToFloat(x)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegLinetoHorizontalRel(narrowPrecisionToFloat(x)));
     }
     virtual void svgLineToVertical(double y, bool abs)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegLinetoVerticalAbs(narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegLinetoVerticalAbs(narrowPrecisionToFloat(y)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegLinetoVerticalRel(narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegLinetoVerticalRel(narrowPrecisionToFloat(y)));
     }
     virtual void svgCurveToCubic(double x1, double y1, double x2, double y2, double x, double y, bool abs = true)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoCubicAbs(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoCubicAbs(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
                                                                                       narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1),
-                                                                                      narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2)), ec);
+                                                                                      narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoCubicRel(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoCubicRel(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
                                                                                       narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1),
-                                                                                      narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2)), ec);
+                                                                                      narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2)));
     }
     virtual void svgCurveToCubicSmooth(double x, double y, double x2, double y2, bool abs)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoCubicSmoothAbs(narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2),
-                                                                                            narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoCubicSmoothAbs(narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2),
+                                                                                            narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoCubicSmoothRel(narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2),
-                                                                                            narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoCubicSmoothRel(narrowPrecisionToFloat(x2), narrowPrecisionToFloat(y2),
+                                                                                            narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)));
     }
     virtual void svgCurveToQuadratic(double x, double y, double x1, double y1, bool abs)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoQuadraticAbs(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1), 
-                                                                                          narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoQuadraticAbs(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1), 
+                                                                                          narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoQuadraticRel(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1), 
-                                                                                          narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoQuadraticRel(narrowPrecisionToFloat(x1), narrowPrecisionToFloat(y1), 
+                                                                                          narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)));
     }
     virtual void svgCurveToQuadraticSmooth(double x, double y, bool abs)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothAbs(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothAbs(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothRel(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)), ec);
+            m_vector.append(SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothRel(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y)));
     }
     virtual void svgArcTo(double x, double y, double r1, double r2, double angle, bool largeArcFlag, bool sweepFlag, bool abs)
     {
-        ExceptionCode ec = 0;
-
         if (abs)
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegArcAbs(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
+            m_vector.append(SVGPathElement::createSVGPathSegArcAbs(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
                                                                              narrowPrecisionToFloat(r1), narrowPrecisionToFloat(r2), 
-                                                                             narrowPrecisionToFloat(angle), largeArcFlag, sweepFlag), ec);
+                                                                             narrowPrecisionToFloat(angle), largeArcFlag, sweepFlag));
         else
-            m_pathSegList->appendItem(SVGPathElement::createSVGPathSegArcRel(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
+            m_vector.append(SVGPathElement::createSVGPathSegArcRel(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y),
                                                                              narrowPrecisionToFloat(r1), narrowPrecisionToFloat(r2),
-                                                                             narrowPrecisionToFloat(angle), largeArcFlag, sweepFlag), ec);
+                                                                             narrowPrecisionToFloat(angle), largeArcFlag, sweepFlag));
     }
     virtual void svgClosePath()
     {
-        ExceptionCode ec = 0;
-        m_pathSegList->appendItem(SVGPathElement::createSVGPathSegClosePath(), ec);
+        m_vector.append(SVGPathElement::createSVGPathSegClosePath());
     }
-    SVGPathSegList* m_pathSegList;
+
+    Vector<RefPtr<SVGPathSeg> > m_vector;
 };
 
-bool pathSegListFromSVGData(SVGPathSegList* path , const String& d, bool process)
+bool pathSegListFromSVGData(SVGPathSegList* path, const String& d, bool process)
 {
     SVGPathSegListBuilder builder;
     return builder.build(path, d, process);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
index bdd60e56a3..172cac17c5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGPathElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl b/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl
index 3076750526..597b01d286 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSeg.idl
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor, ObjCCustomInternalImpl] SVGPathSeg {
+    interface [Conditional=SVG, GenerateConstructor, Polymorphic] SVGPathSeg {
         // Path Segment Types
         const unsigned short PATHSEG_UNKNOWN                      = 0;
         const unsigned short PATHSEG_CLOSEPATH                    = 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
index 8b8998cc5a..816ba0f795 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
@@ -32,7 +32,7 @@ namespace WebCore {
     class SVGPathSegCurvetoCubicSmooth : public SVGPathSeg {
     public:
         SVGPathSegCurvetoCubicSmooth(float x, float y, float x2, float y2)
-        : SVGPathSeg(), m_x(x), m_y(y), m_x2(x2), m_y2(y) {}
+        : m_x(x), m_y(y), m_x2(x2), m_y2(y2) { }
 
         virtual String toString() const { return pathSegTypeAsLetter() + String::format(" %.6lg %.6lg %.6lg %.6lg", m_x2, m_y2, m_x, m_y); }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.idl b/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.idl
index f55167edb2..8c67bd3071 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathSegList.idl
@@ -29,19 +29,19 @@ module svg {
     interface [Conditional=SVG] SVGPathSegList {
         readonly attribute unsigned long numberOfItems;
 
-        [Custom] void clear()
+        [JSCCustom] void clear()
             raises(DOMException);
-        [Custom] SVGPathSeg initialize(in SVGPathSeg newItem)
+        [JSCCustom] SVGPathSeg initialize(in SVGPathSeg newItem)
             raises(DOMException, SVGException);
-        [Custom] SVGPathSeg getItem(in unsigned long index)
+        [JSCCustom] SVGPathSeg getItem(in unsigned long index)
             raises(DOMException);
-        [Custom] SVGPathSeg insertItemBefore(in SVGPathSeg newItem, in unsigned long index)
+        [JSCCustom] SVGPathSeg insertItemBefore(in SVGPathSeg newItem, in unsigned long index)
             raises(DOMException, SVGException);
-        [Custom] SVGPathSeg replaceItem(in SVGPathSeg newItem, in unsigned long index)
+        [JSCCustom] SVGPathSeg replaceItem(in SVGPathSeg newItem, in unsigned long index)
             raises(DOMException, SVGException);
-        [Custom] SVGPathSeg removeItem(in unsigned long index)
+        [JSCCustom] SVGPathSeg removeItem(in unsigned long index)
             raises(DOMException);
-        [Custom] SVGPathSeg appendItem(in SVGPathSeg newItem)
+        [JSCCustom] SVGPathSeg appendItem(in SVGPathSeg newItem)
             raises(DOMException, SVGException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
index 5d21b947df..cfae42598b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
@@ -25,26 +25,26 @@
 #if ENABLE(SVG)
 #include "SVGPatternElement.h"
 
-#include "TransformationMatrix.h"
 #include "Document.h"
 #include "FloatConversion.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
+#include "MappedAttribute.h"
 #include "PatternAttributes.h"
 #include "RenderSVGContainer.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPaintServerPattern.h"
 #include "SVGRenderSupport.h"
-#include "SVGStyledTransformableElement.h"
 #include "SVGSVGElement.h"
+#include "SVGStyledTransformableElement.h"
 #include "SVGTransformList.h"
 #include "SVGTransformable.h"
 #include "SVGUnitTypes.h"
-
+#include "TransformationMatrix.h"
 #include <math.h>
-#include <wtf/OwnPtr.h>
 #include <wtf/MathExtras.h>
+#include <wtf/OwnPtr.h>
 
 using namespace std;
 
@@ -177,7 +177,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
         patternBoundaries.setHeight(targetRect.height());
 
     IntSize patternSize(patternBoundaries.width(), patternBoundaries.height());
-    clampImageBufferSizeToViewport(document()->renderer(), patternSize);
+    clampImageBufferSizeToViewport(document()->view(), patternSize);
 
     if (patternSize.width() < static_cast<int>(patternBoundaries.width()))
         patternBoundaries.setWidth(patternSize.width());
@@ -191,7 +191,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
         for (Node* n = attributes.patternContentElement()->firstChild(); n; n = n->nextSibling()) {
             if (!n->isSVGElement() || !static_cast<SVGElement*>(n)->isStyledTransformable() || !n->renderer())
                 continue;
-            patternContentBoundaries.unite(n->renderer()->relativeBBox(true));
+            patternContentBoundaries.unite(n->renderer()->repaintRectInLocalCoordinates());
         }
     }
 
@@ -212,11 +212,11 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
     }
 
     IntSize imageSize(lroundf(patternBoundariesIncludingOverflow.width()), lroundf(patternBoundariesIncludingOverflow.height()));
-    clampImageBufferSizeToViewport(document()->renderer(), imageSize);
+    clampImageBufferSizeToViewport(document()->view(), imageSize);
 
-    auto_ptr<ImageBuffer> patternImage = ImageBuffer::create(imageSize, false);
+    OwnPtr<ImageBuffer> patternImage = ImageBuffer::create(imageSize, false);
 
-    if (!patternImage.get())
+    if (!patternImage)
         return;
 
     GraphicsContext* context = patternImage->context();
@@ -251,7 +251,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
 
     m_resource->setPatternTransform(attributes.patternTransform());
     m_resource->setPatternBoundaries(patternBoundaries); 
-    m_resource->setTile(patternImage);
+    m_resource->setTile(patternImage.release());
 }
 
 RenderObject* SVGPatternElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl b/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl
index 3ac8b1aa12..cf82dff099 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPointList.idl
@@ -28,19 +28,19 @@ module svg {
     interface [Conditional=SVG] SVGPointList {
         readonly attribute unsigned long numberOfItems;
 
-        [Custom] void clear()
+        [JSCCustom] void clear()
             raises(DOMException);
-        [Custom] SVGPoint initialize(in SVGPoint item)
+        [JSCCustom] SVGPoint initialize(in SVGPoint item)
             raises(DOMException, SVGException);
-        [Custom] SVGPoint getItem(in unsigned long index)
+        [JSCCustom] SVGPoint getItem(in unsigned long index)
             raises(DOMException);
-        [Custom] SVGPoint insertItemBefore(in SVGPoint item, in unsigned long index)
+        [JSCCustom] SVGPoint insertItemBefore(in SVGPoint item, in unsigned long index)
             raises(DOMException, SVGException);
-        [Custom] SVGPoint replaceItem(in SVGPoint item, in unsigned long index)
+        [JSCCustom] SVGPoint replaceItem(in SVGPoint item, in unsigned long index)
             raises(DOMException, SVGException);
-        [Custom] SVGPoint removeItem(in unsigned long index)
+        [JSCCustom] SVGPoint removeItem(in unsigned long index)
             raises(DOMException);
-        [Custom] SVGPoint appendItem(in SVGPoint item)
+        [JSCCustom] SVGPoint appendItem(in SVGPoint item)
             raises(DOMException, SVGException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
index 3d15a438df..db39c52164 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
@@ -27,6 +27,7 @@
 
 #include "Document.h"
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGAnimatedProperty.h"
 #include "SVGNames.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp
index 9c9e1104a3..57939760ed 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPreserveAspectRatio.cpp
@@ -178,10 +178,10 @@ TransformationMatrix SVGPreserveAspectRatio::getCTM(double logicX, double logicY
     double svgar = physWidth / physHeight;
 
     if (align() == SVG_PRESERVEASPECTRATIO_NONE) {
-        temp.scale(physWidth / logicWidth, physHeight / logicHeight);
+        temp.scaleNonUniform(physWidth / logicWidth, physHeight / logicHeight);
         temp.translate(-logicX, -logicY);
     } else if (vpar < svgar && (meetOrSlice() == SVG_MEETORSLICE_MEET) || vpar >= svgar && (meetOrSlice() == SVG_MEETORSLICE_SLICE)) {
-        temp.scale(physHeight / logicHeight, physHeight / logicHeight);
+        temp.scaleNonUniform(physHeight / logicHeight, physHeight / logicHeight);
 
         if (align() == SVG_PRESERVEASPECTRATIO_XMINYMIN || align() == SVG_PRESERVEASPECTRATIO_XMINYMID || align() == SVG_PRESERVEASPECTRATIO_XMINYMAX)
             temp.translate(-logicX, -logicY);
@@ -190,7 +190,7 @@ TransformationMatrix SVGPreserveAspectRatio::getCTM(double logicX, double logicY
         else
             temp.translate(-logicX - (logicWidth - physWidth * logicHeight / physHeight), -logicY);
     } else {
-        temp.scale(physWidth / logicWidth, physWidth / logicWidth);
+        temp.scaleNonUniform(physWidth / logicWidth, physWidth / logicWidth);
 
         if (align() == SVG_PRESERVEASPECTRATIO_XMINYMIN || align() == SVG_PRESERVEASPECTRATIO_XMIDYMIN || align() == SVG_PRESERVEASPECTRATIO_XMAXYMIN)
             temp.translate(-logicX, -logicY);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
index 4f4fd8f165..23a8579846 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
@@ -27,6 +27,7 @@
 
 #include "FloatConversion.h"
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RadialGradientAttributes.h"
 #include "RenderObject.h"
 #include "SVGLength.h"
@@ -114,6 +115,7 @@ void SVGRadialGradientElement::buildGradient() const
         0.f, // SVG does not support a "focus radius"
         centerPoint,
         narrowPrecisionToFloat(attributes.r()));
+    gradient->setSpreadMethod(attributes.spreadMethod());
 
     Vector<SVGGradientStop> stops = attributes.stops();
     float previousOffset = 0.0f;
@@ -129,7 +131,6 @@ void SVGRadialGradientElement::buildGradient() const
         return;
 
     radialGradient->setBoundingBoxMode(attributes.boundingBoxMode());
-    radialGradient->setGradientSpreadMethod(attributes.spreadMethod()); 
     radialGradient->setGradientTransform(attributes.gradientTransform());
     radialGradient->setGradientCenter(centerPoint);
     radialGradient->setGradientFocal(focalPoint);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
index 367e12efad..bfb62056e8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGRectElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
index 27f11aae25..fcecd8c2ca 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
@@ -24,7 +24,6 @@
 #if ENABLE(SVG)
 #include "SVGSVGElement.h"
 
-#include "TransformationMatrix.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
@@ -34,8 +33,10 @@
 #include "FloatRect.h"
 #include "Frame.h"
 #include "HTMLNames.h"
-#include "RenderSVGViewportContainer.h"
+#include "MappedAttribute.h"
 #include "RenderSVGRoot.h"
+#include "RenderSVGViewportContainer.h"
+#include "SMILTimeContainer.h"
 #include "SVGAngle.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -45,8 +46,9 @@
 #include "SVGViewElement.h"
 #include "SVGViewSpec.h"
 #include "SVGZoomEvent.h"
+#include "ScriptEventListener.h"
 #include "SelectionController.h"
-#include "SMILTimeContainer.h"
+#include "TransformationMatrix.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -125,8 +127,8 @@ FloatRect SVGSVGElement::viewport() const
     TransformationMatrix viewBox = viewBoxToViewTransform(w, h);
     double wDouble = w;
     double hDouble = h;
-    viewBox.map(_x, _y, &_x, &_y);
-    viewBox.map(w, h, &wDouble, &hDouble);
+    viewBox.map(_x, _y, _x, _y);
+    viewBox.map(w, h, wDouble, hDouble);
     return FloatRect::narrowPrecision(_x, _y, wDouble, hDouble);
 }
 
@@ -220,13 +222,13 @@ void SVGSVGElement::parseMappedAttribute(MappedAttribute* attr)
 
         // Only handle events if we're the outermost <svg> element
         if (attr->name() == onunloadAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
         else if (attr->name() == onresizeAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().resizeEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
         else if (attr->name() == onscrollAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
         else if (attr->name() == SVGNames::onzoomAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().zoomEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().zoomEvent, createAttributeEventListener(document()->frame(), attr));
         else
             setListener = false;
  
@@ -235,9 +237,9 @@ void SVGSVGElement::parseMappedAttribute(MappedAttribute* attr)
     }
 
     if (attr->name() == onabortAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().abortEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onerrorAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().errorEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == SVGNames::xAttr)
         setXBaseValue(SVGLength(LengthModeWidth, attr->value()));
     else if (attr->name() == SVGNames::yAttr)
@@ -268,15 +270,34 @@ void SVGSVGElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
+// This hack will not handle the case where we're setting a width/height
+// on a root <svg> via svg.width.baseValue = when it has none.
+static void updateCSSForAttribute(SVGSVGElement* element, const QualifiedName& attrName, CSSPropertyID property, const SVGLength& value)
+{
+    Attribute* attribute = element->attributes(false)->getAttributeItem(attrName);
+    if (!attribute || !attribute->isMappedAttribute())
+        return;
+    element->addCSSProperty(static_cast<MappedAttribute*>(attribute), property, value.valueAsString());
+}
+
 void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledElement::svgAttributeChanged(attrName);
 
+    // FIXME: Ugly, ugly hack to around that parseMappedAttribute is not called
+    // when svg.width.baseValue = 100 is evaluated.
+    // Thus the CSS length value for width is not updated, and width() calcWidth()
+    // calculations on RenderSVGRoot will be wrong.
+    // https://bugs.webkit.org/show_bug.cgi?id=25387
+    if (attrName == SVGNames::widthAttr)
+        updateCSSForAttribute(this, attrName, CSSPropertyWidth, widthBaseValue());
+    else if (attrName == SVGNames::heightAttr)
+        updateCSSForAttribute(this, attrName, CSSPropertyHeight, heightBaseValue());
+
     if (!renderer())
         return;
 
     if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
-        attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr ||
         SVGTests::isKnownAttribute(attrName) ||
         SVGLangSpace::isKnownAttribute(attrName) ||
         SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
@@ -387,7 +408,7 @@ TransformationMatrix SVGSVGElement::getCTM() const
     if (!isOutermostSVG())
         mat.translate(x().value(this), y().value(this));
 
-    if (attributes()->getNamedItem(SVGNames::viewBoxAttr)) {
+    if (attributes()->getAttributeItem(SVGNames::viewBoxAttr)) {
         TransformationMatrix viewBox = viewBoxToViewTransform(width().value(this), height().value(this));
         mat = viewBox * mat;
     }
@@ -398,14 +419,14 @@ TransformationMatrix SVGSVGElement::getCTM() const
 TransformationMatrix SVGSVGElement::getScreenCTM() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    FloatPoint rootLocation;    
+    FloatPoint rootLocation;
 
     if (RenderObject* renderer = this->renderer()) {
         if (isOutermostSVG()) {
             // FIXME: This doesn't work correctly with CSS transforms.
             FloatPoint point;
             if (renderer->parent())
-                point = renderer->localToAbsolute(point, true);
+                point = renderer->localToAbsolute(point, false, true);
             rootLocation.move(point.x(), point.y());
         } else
             rootLocation.move(x().value(this), y().value(this));
@@ -414,7 +435,7 @@ TransformationMatrix SVGSVGElement::getScreenCTM() const
     TransformationMatrix mat = SVGStyledLocatableElement::getScreenCTM();
     mat.translate(rootLocation.x(), rootLocation.y());
 
-    if (attributes()->getNamedItem(SVGNames::viewBoxAttr)) {
+    if (attributes()->getAttributeItem(SVGNames::viewBoxAttr)) {
         TransformationMatrix viewBox = viewBoxToViewTransform(width().value(this), height().value(this));
         mat = viewBox * mat;
     }
@@ -477,6 +498,10 @@ bool SVGSVGElement::hasRelativeValues() const
 
 bool SVGSVGElement::isOutermostSVG() const
 {
+    // Element may not be in the document, pretend we're outermost for viewport(), getCTM(), etc.
+    if (!parentNode())
+        return true;
+
     // This is true whenever this is the outermost SVG, even if there are HTML elements outside it
     return !parentNode()->isSVGElement();
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
index 1b7f4d9685..2ecf912181 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
@@ -27,6 +27,7 @@
 
 #include "Document.h"
 #include "EventNames.h"
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 
 namespace WebCore {
@@ -173,6 +174,11 @@ String SVGScriptElement::languageAttributeValue() const
     return String();
 }
 
+String SVGScriptElement::forAttributeValue() const
+{
+    return String();
+}
+
 void SVGScriptElement::dispatchLoadEvent()
 {
     bool externalResourcesRequired = externalResourcesRequiredBaseValue();
@@ -203,7 +209,7 @@ void SVGScriptElement::dispatchLoadEvent()
 
 void SVGScriptElement::dispatchErrorEvent()
 {
-    dispatchEventForType(eventNames().errorEvent, true, false);
+    dispatchEvent(eventNames().errorEvent, true, false);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
index 090cd2db0f..f2efc8e1dc 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
@@ -57,6 +57,8 @@ namespace WebCore {
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
+        virtual bool shouldExecuteAsJavaScript() const { return false; }
+
     protected:
         virtual const SVGElement* contextElement() const { return this; }
         virtual bool haveLoadedRequiredResources();
@@ -65,6 +67,7 @@ namespace WebCore {
         virtual String charsetAttributeValue() const;
         virtual String typeAttributeValue() const;
         virtual String languageAttributeValue() const;
+        virtual String forAttributeValue() const;
 
         virtual void dispatchLoadEvent();
         virtual void dispatchErrorEvent();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp
index 4747824324..51582d7f51 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGStopElement.h"
 
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "RenderSVGGradientStop.h"
 #include "SVGGradientElement.h"
 #include "SVGNames.h"
@@ -51,7 +52,7 @@ void SVGStopElement::parseMappedAttribute(MappedAttribute* attr)
         else
             setOffsetBaseValue(value.toFloat());
 
-        setChanged();
+        setNeedsStyleRecalc();
     } else
         SVGStyledElement::parseMappedAttribute(attr);
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
index 2f5968035a..72f70e66be 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
@@ -22,6 +22,7 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG)
 #include "SVGStyleElement.h"
 
@@ -29,6 +30,7 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "XMLNames.h"
 #include <wtf/StdLibExtras.h>
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
index 466ce3c44e..98b6459ba1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledElement.cpp
@@ -19,6 +19,7 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG)
 #include "SVGStyledElement.h"
 
@@ -28,11 +29,12 @@
 #include "CString.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "PlatformString.h"
+#include "RenderObject.h"
 #include "SVGElement.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
-#include "RenderObject.h"
 #include "SVGRenderStyle.h"
 #include "SVGResource.h"
 #include "SVGSVGElement.h"
@@ -165,7 +167,7 @@ void SVGStyledElement::parseMappedAttribute(MappedAttribute* attr)
     int propId = SVGStyledElement::cssPropertyIdForSVGAttributeName(attrName);
     if (propId > 0) {
         addCSSProperty(attr, propId, attr->value());
-        setChanged();
+        setNeedsStyleRecalc();
         return;
     }
     
@@ -240,7 +242,10 @@ PassRefPtr<RenderStyle> SVGStyledElement::resolveStyle(RenderStyle* parentStyle)
 
 PassRefPtr<CSSValue> SVGStyledElement::getPresentationAttribute(const String& name)
 {
-    Attribute* attr = mappedAttributes()->getAttributeItem(name, false);
+    if (!mappedAttributes())
+        return 0;
+
+    Attribute* attr = mappedAttributes()->getAttributeItem(QualifiedName(nullAtom, name, nullAtom));
     if (!attr || !attr->isMappedAttribute() || !attr->style())
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp
index 53605120f3..b7cf979fa8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -26,12 +26,12 @@
 #include "SVGStyledTransformableElement.h"
 
 #include "Attr.h"
-#include "RegularExpression.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGDocument.h"
-#include "TransformationMatrix.h"
 #include "SVGStyledElement.h"
 #include "SVGTransformList.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
@@ -107,10 +107,10 @@ FloatRect SVGStyledTransformableElement::getBBox() const
     return SVGTransformable::getBBox(this);
 }
 
-RenderObject* SVGStyledTransformableElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* SVGStyledTransformableElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     // By default, any subclass is expected to do path-based drawing
-    return new (arena) RenderPath(style, this);
+    return new (arena) RenderPath(this);
 }
 
 Path SVGStyledTransformableElement::toClipPath() const
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTests.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTests.cpp
index 06a81f2db0..258c12ceac 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTests.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTests.cpp
@@ -25,6 +25,7 @@
 
 #include "DOMImplementation.h"
 #include "Language.h"
+#include "MappedAttribute.h"
 #include "SVGElement.h"
 #include "SVGNames.h"
 #include "SVGStringList.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
index 6057da8bb7..067f35f5ec 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
@@ -29,14 +29,15 @@
 #include "FloatPoint.h"
 #include "FloatRect.h"
 #include "Frame.h"
+#include "MappedAttribute.h"
 #include "Position.h"
 #include "RenderSVGText.h"
-#include "SelectionController.h"
 #include "SVGCharacterLayoutInfo.h"
-#include "SVGRootInlineBox.h"
-#include "SVGLength.h"
 #include "SVGInlineTextBox.h"
+#include "SVGLength.h"
 #include "SVGNames.h"
+#include "SVGRootInlineBox.h"
+#include "SelectionController.h"
 #include "XMLNames.h"
 #include <wtf/StdLibExtras.h>
 
@@ -65,7 +66,7 @@ static inline float cumulativeCharacterRangeLength(const Vector<SVGChar>::iterat
         return 0.0f;
 
     float textLength = 0.0f;
-    RenderStyle* style = textBox->textObject()->style();
+    RenderStyle* style = textBox->textRenderer()->style();
 
     bool usesFullRange = (startPosition == -1 && length == -1);
 
@@ -128,7 +129,7 @@ struct SVGInlineTextBoxQueryWalker {
     void chunkPortionCallback(SVGInlineTextBox* textBox, int startOffset, const TransformationMatrix&,
                               const Vector<SVGChar>::iterator& start, const Vector<SVGChar>::iterator& end)
     {
-        RenderStyle* style = textBox->textObject()->style();
+        RenderStyle* style = textBox->textRenderer()->style();
         bool isVerticalText = style->svgStyle()->writingMode() == WM_TBRL || style->svgStyle()->writingMode() == WM_TB;
 
         switch (m_mode) {
@@ -309,7 +310,7 @@ static Vector<SVGInlineTextBox*> findInlineTextBoxInTextChunks(const SVGTextCont
         for (; boxIt != boxEnd; ++boxIt) {
             SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(boxIt->box);
 
-            Node* textElement = textBox->textObject()->parent()->element();
+            Node* textElement = textBox->textRenderer()->parent()->node();
             ASSERT(textElement);
 
             if (textElement == element || textElement->parent() == element)
@@ -370,7 +371,7 @@ static inline SVGInlineTextBoxQueryWalker executeTextQuery(const SVGTextContentE
     return walkerCallback;
 }
 
-long SVGTextContentElement::getNumberOfChars() const
+unsigned SVGTextContentElement::getNumberOfChars() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
@@ -384,12 +385,12 @@ float SVGTextContentElement::getComputedTextLength() const
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::TextLength).floatResult();
 }
 
-float SVGTextContentElement::getSubStringLength(long charnum, long nchars, ExceptionCode& ec) const
+float SVGTextContentElement::getSubStringLength(unsigned charnum, unsigned nchars, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    long numberOfChars = getNumberOfChars();
-    if (charnum < 0 || nchars < 0 || charnum >= numberOfChars) {
+    unsigned numberOfChars = getNumberOfChars();
+    if (charnum >= numberOfChars) {
         ec = INDEX_SIZE_ERR;
         return 0.0f;
     }
@@ -397,11 +398,11 @@ float SVGTextContentElement::getSubStringLength(long charnum, long nchars, Excep
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::SubStringLength, charnum, nchars).floatResult();
 }
 
-FloatPoint SVGTextContentElement::getStartPositionOfChar(long charnum, ExceptionCode& ec) const
+FloatPoint SVGTextContentElement::getStartPositionOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return FloatPoint();
     }
@@ -409,11 +410,11 @@ FloatPoint SVGTextContentElement::getStartPositionOfChar(long charnum, Exception
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::StartPosition, charnum).pointResult();
 }
 
-FloatPoint SVGTextContentElement::getEndPositionOfChar(long charnum, ExceptionCode& ec) const
+FloatPoint SVGTextContentElement::getEndPositionOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return FloatPoint();
     }
@@ -421,11 +422,11 @@ FloatPoint SVGTextContentElement::getEndPositionOfChar(long charnum, ExceptionCo
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::EndPosition, charnum).pointResult();
 }
 
-FloatRect SVGTextContentElement::getExtentOfChar(long charnum, ExceptionCode& ec) const
+FloatRect SVGTextContentElement::getExtentOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return FloatRect();
     }
@@ -433,11 +434,11 @@ FloatRect SVGTextContentElement::getExtentOfChar(long charnum, ExceptionCode& ec
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::Extent, charnum).rectResult();
 }
 
-float SVGTextContentElement::getRotationOfChar(long charnum, ExceptionCode& ec) const
+float SVGTextContentElement::getRotationOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return 0.0f;
     }
@@ -445,17 +446,17 @@ float SVGTextContentElement::getRotationOfChar(long charnum, ExceptionCode& ec)
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::Rotation, charnum).floatResult();
 }
 
-long SVGTextContentElement::getCharNumAtPosition(const FloatPoint& point) const
+int SVGTextContentElement::getCharNumAtPosition(const FloatPoint& point) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::CharacterNumberAtPosition, 0.0f, 0.0f, point).longResult();
 }
 
-void SVGTextContentElement::selectSubString(long charnum, long nchars, ExceptionCode& ec) const
+void SVGTextContentElement::selectSubString(unsigned charnum, unsigned nchars, ExceptionCode& ec) const
 {
-    long numberOfChars = getNumberOfChars();
-    if (charnum < 0 || nchars < 0 || charnum >= numberOfChars) {
+    unsigned numberOfChars = getNumberOfChars();
+    if (charnum >= numberOfChars) {
         ec = INDEX_SIZE_ERR;
         return;
     }
@@ -472,15 +473,15 @@ void SVGTextContentElement::selectSubString(long charnum, long nchars, Exception
 
     // Find selection start
     VisiblePosition start(const_cast<SVGTextContentElement*>(this), 0, SEL_DEFAULT_AFFINITY);
-    for (long i = 0; i < charnum; ++i)
+    for (unsigned i = 0; i < charnum; ++i)
         start = start.next();
 
     // Find selection end
     VisiblePosition end(start);
-    for (long i = 0; i < nchars; ++i)
+    for (unsigned i = 0; i < nchars; ++i)
         end = end.next();
 
-    controller->setSelection(Selection(start, end));
+    controller->setSelection(VisibleSelection(start, end));
 }
 
 void SVGTextContentElement::parseMappedAttribute(MappedAttribute* attr)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
index d6b9d93a58..9933b2c6d7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
@@ -52,15 +52,15 @@ namespace WebCore {
         virtual bool isValid() const { return SVGTests::isValid(); }
         virtual bool isTextContent() const { return true; }
 
-        long getNumberOfChars() const;
+        unsigned getNumberOfChars() const;
         float getComputedTextLength() const;
-        float getSubStringLength(long charnum, long nchars, ExceptionCode&) const;
-        FloatPoint getStartPositionOfChar(long charnum, ExceptionCode&) const;
-        FloatPoint getEndPositionOfChar(long charnum, ExceptionCode&) const;
-        FloatRect getExtentOfChar(long charnum, ExceptionCode&) const;
-        float getRotationOfChar(long charnum, ExceptionCode&) const;
-        long getCharNumAtPosition(const FloatPoint&) const;
-        void selectSubString(long charnum, long nchars, ExceptionCode&) const;
+        float getSubStringLength(unsigned charnum, unsigned nchars, ExceptionCode&) const;
+        FloatPoint getStartPositionOfChar(unsigned charnum, ExceptionCode&) const;
+        FloatPoint getEndPositionOfChar(unsigned charnum, ExceptionCode&) const;
+        FloatRect getExtentOfChar(unsigned charnum, ExceptionCode&) const;
+        float getRotationOfChar(unsigned charnum, ExceptionCode&) const;
+        int getCharNumAtPosition(const FloatPoint&) const;
+        void selectSubString(unsigned charnum, unsigned nchars, ExceptionCode&) const;
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl
index e4e01639d4..394b39876b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.idl
@@ -40,20 +40,20 @@ module svg {
 
         long getNumberOfChars();
         float getComputedTextLength();
-        float getSubStringLength(in unsigned long offset, 
-                                 in unsigned long length)
+        float getSubStringLength(in [IsIndex] unsigned long offset, 
+                                 in [IsIndex] unsigned long length)
             raises(DOMException);
-        SVGPoint getStartPositionOfChar(in unsigned long offset)
+        SVGPoint getStartPositionOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGPoint getEndPositionOfChar(in unsigned long offset)
+        SVGPoint getEndPositionOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGRect getExtentOfChar(in unsigned long offset)
+        SVGRect getExtentOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
-        float getRotationOfChar(in unsigned long offset)
+        float getRotationOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
         long getCharNumAtPosition(in SVGPoint point);
-        void selectSubString(in unsigned long offset, 
-                             in unsigned long length)
+        void selectSubString(in [IsIndex] unsigned long offset, 
+                             in [IsIndex] unsigned long length)
             raises(DOMException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp
index b2ee7982e3..b8c7331796 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextElement.cpp
@@ -25,13 +25,14 @@
 #if ENABLE(SVG)
 #include "SVGTextElement.h"
 
-#include "TransformationMatrix.h"
 #include "FloatRect.h"
+#include "MappedAttribute.h"
 #include "RenderSVGText.h"
 #include "SVGLengthList.h"
 #include "SVGRenderStyle.h"
 #include "SVGTSpanElement.h"
 #include "SVGTransformList.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
index f7f974beb4..0d8560aa9a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
@@ -24,14 +24,14 @@
 #if ENABLE(SVG)
 #include "SVGTextPathElement.h"
 
-#include "TransformationMatrix.h"
 #include "FloatRect.h"
+#include "MappedAttribute.h"
 #include "RenderSVGTextPath.h"
 #include "SVGLengthList.h"
 #include "SVGPathElement.h"
 #include "SVGRenderStyle.h"
-#include "SVGTextPathElement.h"
 #include "SVGTransformList.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp
index e9ceaa18a5..32d9dc0c12 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPositioningElement.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGTextPositioningElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGLengthList.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp
index fac88bdc93..17d9b8f1e8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransform.cpp
@@ -96,7 +96,7 @@ void SVGTransform::setTranslate(float tx, float ty)
     m_type = SVG_TRANSFORM_TRANSLATE;
     m_angle = 0;
 
-    m_matrix.reset();
+    m_matrix.makeIdentity();
     m_matrix.translate(tx, ty);
 }
 
@@ -111,8 +111,8 @@ void SVGTransform::setScale(float sx, float sy)
     m_angle = 0;
     m_center = FloatPoint();
 
-    m_matrix.reset();
-    m_matrix.scale(sx, sy);
+    m_matrix.makeIdentity();
+    m_matrix.scaleNonUniform(sx, sy);
 }
 
 FloatSize SVGTransform::scale() const
@@ -127,7 +127,7 @@ void SVGTransform::setRotate(float angle, float cx, float cy)
     m_center = FloatPoint(cx, cy);
 
     // TODO: toString() implementation, which can show cx, cy (need to be stored?)
-    m_matrix.reset();
+    m_matrix.makeIdentity();
     m_matrix.translate(cx, cy);
     m_matrix.rotate(angle);
     m_matrix.translate(-cx, -cy);
@@ -138,7 +138,7 @@ void SVGTransform::setSkewX(float angle)
     m_type = SVG_TRANSFORM_SKEWX;
     m_angle = angle;
 
-    m_matrix.reset();
+    m_matrix.makeIdentity();
     m_matrix.skewX(angle);
 }
 
@@ -147,7 +147,7 @@ void SVGTransform::setSkewY(float angle)
     m_type = SVG_TRANSFORM_SKEWY;
     m_angle = angle;
 
-    m_matrix.reset();
+    m_matrix.makeIdentity();
     m_matrix.skewY(angle);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp
index b46370bfd0..34adc6343b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformDistance.cpp
@@ -79,7 +79,7 @@ SVGTransformDistance::SVGTransformDistance(const SVGTransform& fromSVGTransform,
     {
         float scaleX = toSVGTransform.scale().width() - fromSVGTransform.scale().width();        
         float scaleY = toSVGTransform.scale().height() - fromSVGTransform.scale().height();
-        m_transform.scale(scaleX, scaleY);
+        m_transform.scaleNonUniform(scaleX, scaleY);
         return;
     }
     case SVGTransform::SVG_TRANSFORM_SKEWX:
@@ -188,7 +188,7 @@ void SVGTransformDistance::addSVGTransform(const SVGTransform& transform, bool a
     {
         float scaleX = absoluteValue ? fabsf(transform.scale().width()) : transform.scale().width();
         float scaleY = absoluteValue ? fabsf(transform.scale().height()) : transform.scale().height();
-        m_transform.scale(scaleX, scaleY);
+        m_transform.scaleNonUniform(scaleX, scaleY);
         return;
     }
     case SVGTransform::SVG_TRANSFORM_SKEWX:
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl
index 67968ff15b..8c9c86e95d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformList.idl
@@ -29,19 +29,19 @@ module svg {
     interface [Conditional=SVG] SVGTransformList {
         readonly attribute unsigned long numberOfItems;
 
-        [Custom] void clear()
+        [JSCCustom] void clear()
             raises(DOMException);
-        [Custom] SVGTransform initialize(in SVGTransform item)
+        [JSCCustom] SVGTransform initialize(in SVGTransform item)
             raises(DOMException, SVGException);
-        [Custom] SVGTransform getItem(in unsigned long index)
+        [JSCCustom] SVGTransform getItem(in unsigned long index)
             raises(DOMException);
-        [Custom] SVGTransform insertItemBefore(in SVGTransform item, in unsigned long index)
+        [JSCCustom] SVGTransform insertItemBefore(in SVGTransform item, in unsigned long index)
             raises(DOMException, SVGException);
-        [Custom] SVGTransform replaceItem(in SVGTransform item, in unsigned long index)
+        [JSCCustom] SVGTransform replaceItem(in SVGTransform item, in unsigned long index)
             raises(DOMException, SVGException);
-        [Custom] SVGTransform removeItem(in unsigned long index)
+        [JSCCustom] SVGTransform removeItem(in unsigned long index)
             raises(DOMException);
-        [Custom] SVGTransform appendItem(in SVGTransform item)
+        [JSCCustom] SVGTransform appendItem(in SVGTransform item)
             raises(DOMException, SVGException);
         SVGTransform createSVGTransformFromMatrix(in SVGMatrix matrix);
         SVGTransform consolidate();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp
index 3d143273fa..6dbfc1a33b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTransformable.cpp
@@ -28,7 +28,6 @@
 
 #include "TransformationMatrix.h"
 #include "FloatConversion.h"
-#include "RegularExpression.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGStyledElement.h"
@@ -56,7 +55,7 @@ TransformationMatrix SVGTransformable::getScreenCTM(const SVGElement* element) c
     return animatedLocalTransform() * ctm;
 }
 
-int parseTransformParamList(const UChar*& ptr, const UChar* end, float* values, int required, int optional)
+static int parseTransformParamList(const UChar*& ptr, const UChar* end, float* values, int required, int optional)
 {
     int optionalParams = 0, requiredParams = 0;
     
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
index d18e49afbb..8871229675 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
@@ -23,6 +23,8 @@
 #if ENABLE(SVG)
 #include "SVGURIReference.h"
 
+#include "MappedAttribute.h"
+
 namespace WebCore {
 
 char SVGURIReferenceIdentifier[] = "SVGURIReference";
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
index 593d2743eb..32019f2659 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
@@ -22,12 +22,6 @@
 
 #include "config.h"
 
-// Dump SVGElementInstance object tree - useful to debug instanceRoot problems
-// #define DUMP_INSTANCE_TREE
-
-// Dump the deep-expanded shadow tree (where the renderes are built from)
-// #define DUMP_SHADOW_TREE
-
 #if ENABLE(SVG)
 #include "SVGUseElement.h"
 
@@ -37,6 +31,7 @@
 #include "Event.h"
 #include "EventListener.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeRenderStyle.h"
 #include "RegisteredEventListener.h"
 #include "RenderSVGTransformableContainer.h"
@@ -51,6 +46,12 @@
 #include "XLinkNames.h"
 #include "XMLSerializer.h"
 
+// Dump SVGElementInstance object tree - useful to debug instanceRoot problems
+// #define DUMP_INSTANCE_TREE
+
+// Dump the deep-expanded shadow tree (where the renderers are built from)
+// #define DUMP_SHADOW_TREE
+
 namespace WebCore {
 
 SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
@@ -138,7 +139,7 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
         buildPendingResource();
 
         if (m_shadowTreeRootElement)
-            m_shadowTreeRootElement->setChanged();
+            m_shadowTreeRootElement->setNeedsStyleRecalc();
     }
 }
 
@@ -152,7 +153,7 @@ void SVGUseElement::childrenChanged(bool changedByParser, Node* beforeChange, No
     buildPendingResource();
 
     if (m_shadowTreeRootElement)
-        m_shadowTreeRootElement->setChanged();
+        m_shadowTreeRootElement->setNeedsStyleRecalc();
 }
  
 static bool shadowTreeContainsChangedNodes(SVGElementInstance* target)
@@ -169,11 +170,11 @@ static bool shadowTreeContainsChangedNodes(SVGElementInstance* target)
 
 void SVGUseElement::recalcStyle(StyleChange change)
 {
-    if (attached() && changed() && shadowTreeContainsChangedNodes(m_targetElementInstance.get())) {
+    if (attached() && needsStyleRecalc() && shadowTreeContainsChangedNodes(m_targetElementInstance.get())) {
         buildPendingResource();
 
         if (m_shadowTreeRootElement)
-            m_shadowTreeRootElement->setChanged();
+            m_shadowTreeRootElement->setNeedsStyleRecalc();
     }
 
     SVGStyledElement::recalcStyle(change);
@@ -186,7 +187,7 @@ void SVGUseElement::recalcStyle(StyleChange change)
     // Mimic Element::recalcStyle(). The main difference is that we don't call attach() on the
     // shadow tree root element, but call attachShadowTree() here. Calling attach() will crash
     // as the shadow tree root element has no (direct) parent node. Yes, shadow trees are tricky.
-    if (change >= Inherit || m_shadowTreeRootElement->changed()) {
+    if (change >= Inherit || m_shadowTreeRootElement->needsStyleRecalc()) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(m_shadowTreeRootElement.get());
         StyleChange ch = Node::diff(m_shadowTreeRootElement->renderStyle(), newStyle.get());
         if (ch == Detach) {
@@ -195,8 +196,8 @@ void SVGUseElement::recalcStyle(StyleChange change)
             attachShadowTree();
 
             // attach recalulates the style for all children. No need to do it twice.
-            m_shadowTreeRootElement->setChanged(NoStyleChange);
-            m_shadowTreeRootElement->setHasChangedChild(false);
+            m_shadowTreeRootElement->setNeedsStyleRecalc(NoStyleChange);
+            m_shadowTreeRootElement->setChildNeedsStyleRecalc(false);
             return;
         }
     }
@@ -564,10 +565,10 @@ void SVGUseElement::buildShadowTree(SVGElement* target, SVGElementInstance* targ
     if (isDisallowedElement(target))
         return;
 
-    RefPtr<Node> newChild = targetInstance->correspondingElement()->cloneNode(true);
+    RefPtr<Element> newChild = targetInstance->correspondingElement()->cloneElementWithChildren();
 
     // We don't walk the target tree element-by-element, and clone each element,
-    // but instead use cloneNode(deep=true). This is an optimization for the common
+    // but instead use cloneElementWithChildren(). This is an optimization for the common
     // case where <use> doesn't contain disallowed elements (ie. <foreignObject>).
     // Though if there are disallowed elements in the subtree, we have to remove them.
     // For instance: <use> on <g> containing <foreignObject> (indirect case).
@@ -643,10 +644,10 @@ void SVGUseElement::expandUseElementsInShadowTree(Node* element)
                 return;
             }
 
-            RefPtr<Node> newChild = target->cloneNode(true);
+            RefPtr<Element> newChild = target->cloneElementWithChildren();
 
             // We don't walk the target tree element-by-element, and clone each element,
-            // but instead use cloneNode(deep=true). This is an optimization for the common
+            // but instead use cloneElementWithChildren(). This is an optimization for the common
             // case where <use> doesn't contain disallowed elements (ie. <foreignObject>).
             // Though if there are disallowed elements in the subtree, we have to remove them.
             // For instance: <use> on <g> containing <foreignObject> (indirect case).
@@ -719,9 +720,8 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
             removeDisallowedElementsFromSubtree(svgElement.get());
 
         // Replace <symbol> with <svg>.
-        // ASSERT(element->parentNode());
-        if (element->parentNode())
-            element->parentNode()->replaceChild(svgElement.release(), element, ec);
+        ASSERT(element->parentNode()); 
+        element->parentNode()->replaceChild(svgElement.release(), element, ec);
         ASSERT(ec == 0);
 
         // Immediately stop here, and restart expanding.
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
index cb16b626d3..61cb397536 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGViewElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "PlatformString.h"
 #include "SVGFitToViewBox.h"
 #include "SVGNames.h"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.idl b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.idl
index 46d4c8e13f..24d18f881d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCCustomInternalImpl] SVGViewSpec : SVGZoomAndPan, SVGFitToViewBox
+    interface [Conditional=SVG] SVGViewSpec : SVGZoomAndPan, SVGFitToViewBox
     {
           readonly attribute SVGTransformList transform;
           readonly attribute SVGElement       viewTarget;
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SMILTime.h b/src/3rdparty/webkit/WebCore/svg/animation/SMILTime.h
index 5196030a51..ebbd765e7b 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SMILTime.h
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SMILTime.h
@@ -62,8 +62,6 @@ namespace WebCore {
     inline bool operator>=(const SMILTime& a, const SMILTime& b) { return a.value() > b.value() || operator==(a, b); }
     inline bool operator<=(const SMILTime& a, const SMILTime& b) { return a.value() < b.value() || operator==(a, b); }
 
-    inline SMILTime max(const SMILTime& a, const SMILTime& b) { return std::max(a.value(), b.value()); }
-    inline SMILTime min(const SMILTime& a, const SMILTime& b) { return std::min(a.value(), b.value()); }
     SMILTime operator+(const SMILTime&, const SMILTime&);
     SMILTime operator-(const SMILTime&, const SMILTime&);
     // So multiplying times does not make too much sense but SMIL defines it for duration * repeatCount
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp b/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp
index 0e809fb32a..a37e48166f 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -34,7 +34,7 @@
 #include "SVGAnimationElement.h"
 #include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 using namespace std;
 
@@ -276,7 +276,7 @@ void SMILTimeContainer::updateAnimations(SMILTime elapsed)
 
     startTimer(earliersFireTime, animationFrameDelay);
     
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
index a2e2b0ec68..63a0d820c9 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
@@ -24,6 +24,7 @@
  */
 
 #include "config.h"
+
 #if ENABLE(SVG_ANIMATION)
 #include "SVGSMILElement.h"
 
@@ -34,11 +35,12 @@
 #include "FloatConversion.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "SMILTimeContainer.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGSVGElement.h"
 #include "SVGURIReference.h"
-#include "SMILTimeContainer.h"
 #include "XLinkNames.h"
 #include <math.h>
 #include <wtf/MathExtras.h>
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index 45d58efa76..2157144ad0 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
- * Copyright (C) 2008 Apple, Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,8 +35,9 @@
 #include "FrameLoader.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HTMLFormElement.h"
+#include "ImageBuffer.h"
 #include "ImageObserver.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderView.h"
 #include "ResourceError.h"
@@ -46,6 +47,9 @@
 #include "SVGSVGElement.h"
 #include "Settings.h"
 
+// Moving this #include above FrameLoader.h causes the Windows build to fail due to warnings about
+// alignment in Timer<FrameLoader>. It seems that the definition of EmptyFrameLoaderClient is what
+// causes this (removing that definition fixes the warnings), but it isn't clear why.
 #include "EmptyClients.h"
 
 namespace WebCore {
@@ -76,36 +80,33 @@ private:
 
 SVGImage::SVGImage(ImageObserver* observer)
     : Image(observer)
-    , m_document(0)
-    , m_chromeClient(0)
-    , m_page(0)
-    , m_frame(0)
-    , m_frameView(0)
 {
 }
 
 SVGImage::~SVGImage()
 {
-    if (m_frame)
-        m_frame->loader()->frameDetached(); // Break both the loader and view references to the frame
+    if (m_page) {
+        m_page->mainFrame()->loader()->frameDetached(); // Break both the loader and view references to the frame
+
+        // Clear explicitly because we want to delete the page before the ChromeClient.
+        // FIXME: I believe that's already guaranteed by C++ object destruction rules,
+        // so this may matter only for the assertion below.
+        m_page.clear();
+    }
 
-    // Clear these manually so we can safely delete the ChromeClient afterwards
-    m_frameView.clear();
-    m_frame.clear();
-    m_page.clear();
-    
     // Verify that page teardown destroyed the Chrome
     ASSERT(!m_chromeClient->image());
 }
 
 void SVGImage::setContainerSize(const IntSize& containerSize)
 {
-    if (containerSize.width() <= 0 || containerSize.height() <= 0)
+    if (containerSize.isEmpty())
         return;
 
-    if (!m_frame || !m_frame->document())
+    if (!m_page)
         return;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    Frame* frame = m_page->mainFrame();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(frame->document())->rootElement();
     if (!rootElement)
         return;
 
@@ -114,9 +115,10 @@ void SVGImage::setContainerSize(const IntSize& containerSize)
 
 bool SVGImage::usesContainerSize() const
 {
-    if (!m_frame || !m_frame->document())
+    if (!m_page)
         return false;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    Frame* frame = m_page->mainFrame();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(frame->document())->rootElement();
     if (!rootElement)
         return false;
 
@@ -125,10 +127,10 @@ bool SVGImage::usesContainerSize() const
 
 IntSize SVGImage::size() const
 {
-    if (!m_frame || !m_frame->document())
+    if (!m_page)
         return IntSize();
-    
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    Frame* frame = m_page->mainFrame();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(frame->document())->rootElement();
     if (!rootElement)
         return IntSize();
     
@@ -151,9 +153,9 @@ IntSize SVGImage::size() const
 
 bool SVGImage::hasRelativeWidth() const
 {
-    if (!m_frame || !m_frame->document())
+    if (!m_page)
         return false;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_page->mainFrame()->document())->rootElement();
     if (!rootElement)
         return false;
 
@@ -162,9 +164,9 @@ bool SVGImage::hasRelativeWidth() const
 
 bool SVGImage::hasRelativeHeight() const
 {
-    if (!m_frame || !m_frame->document())
+    if (!m_page)
         return false;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_page->mainFrame()->document())->rootElement();
     if (!rootElement)
         return false;
 
@@ -173,22 +175,24 @@ bool SVGImage::hasRelativeHeight() const
 
 void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
 {
-    if (!m_frame)
+    if (!m_page)
         return;
-    
+
+    FrameView* view = m_page->mainFrame()->view();
+
     context->save();
     context->setCompositeOperation(compositeOp);
     context->clip(enclosingIntRect(dstRect));
     if (compositeOp != CompositeSourceOver)
-        context->beginTransparencyLayer(1.0f);
+        context->beginTransparencyLayer(1);
     context->translate(dstRect.location().x(), dstRect.location().y());
-    context->scale(FloatSize(dstRect.width()/srcRect.width(), dstRect.height()/srcRect.height()));
+    context->scale(FloatSize(dstRect.width() / srcRect.width(), dstRect.height() / srcRect.height()));
 
-    m_frame->view()->resize(size());
+    view->resize(size());
 
-    if (m_frame->view()->needsLayout())
-        m_frame->view()->layout();
-    m_frame->view()->paint(context, enclosingIntRect(srcRect));
+    if (view->needsLayout())
+        view->layout();
+    view->paint(context, enclosingIntRect(srcRect));
 
     if (compositeOp != CompositeSourceOver)
         context->endTransparencyLayer();
@@ -205,20 +209,22 @@ NativeImagePtr SVGImage::nativeImageForCurrentFrame()
     // frame cache, or better yet, not use a cache for tiled drawing at all, instead
     // having a tiled drawing callback (hopefully non-virtual).
     if (!m_frameCache) {
-        m_frameCache.set(ImageBuffer::create(size(), false).release());
+        if (!m_page)
+            return 0;
+        m_frameCache = ImageBuffer::create(size(), false);
         if (!m_frameCache) // failed to allocate image
             return 0;
-        renderSubtreeToImage(m_frameCache.get(), m_frame->contentRenderer());
+        renderSubtreeToImage(m_frameCache.get(), m_page->mainFrame()->contentRenderer());
     }
     return m_frameCache->image()->nativeImageForCurrentFrame();
 }
 
 bool SVGImage::dataChanged(bool allDataReceived)
 {
-    int length = m_data->size();
-    if (!length) // if this was an empty image
+    // Don't do anything if is an empty image.
+    if (!m_data->size())
         return true;
-    
+
     if (allDataReceived) {
         static FrameLoaderClient* dummyFrameLoaderClient =  new EmptyFrameLoaderClient;
         static EditorClient* dummyEditorClient = new EmptyEditorClient;
@@ -228,28 +234,29 @@ bool SVGImage::dataChanged(bool allDataReceived)
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
-        // FIXME: If this SVG ends up loading itself, we'll leak this Frame (and associated DOM & render trees).
-        // The Cache code does not know about CachedImages holding Frames and won't know to break the cycle.
+        // FIXME: If this SVG ends up loading itself, we might leak the world.
+        // THe comment said that the Cache code does not know about CachedImages
+        // holding Frames and won't know to break the cycle. But 
         m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
-        m_frame = Frame::create(m_page.get(), 0, dummyFrameLoaderClient);
-        m_frameView = new FrameView(m_frame.get());
-        m_frameView->deref(); // FIXME: FrameView starts with a refcount of 1
-        m_frame->setView(m_frameView.get());
-        m_frame->init();
+        RefPtr<Frame> frame = Frame::create(m_page.get(), 0, dummyFrameLoaderClient);
+        frame->setView(FrameView::create(frame.get()));
+        frame->init();
         ResourceRequest fakeRequest(KURL(""));
-        m_frame->loader()->load(fakeRequest); // Make sure the DocumentLoader is created
-        m_frame->loader()->cancelContentPolicyCheck(); // cancel any policy checks
-        m_frame->loader()->commitProvisionalLoad(0);
-        m_frame->loader()->setResponseMIMEType("image/svg+xml");
-        m_frame->loader()->begin(KURL()); // create the empty document
-        m_frame->loader()->write(m_data->data(), m_data->size());
-        m_frame->loader()->end();
-        m_frameView->setTransparent(true); // SVG Images are transparent.
+        FrameLoader* loader = frame->loader();
+        loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
+        loader->cancelContentPolicyCheck(); // cancel any policy checks
+        loader->commitProvisionalLoad(0);
+        loader->setResponseMIMEType("image/svg+xml");
+        loader->begin(KURL()); // create the empty document
+        loader->write(m_data->data(), m_data->size());
+        loader->end();
+        frame->view()->setTransparent(true); // SVG Images are transparent.
     }
-    return m_frameView;
+
+    return m_page;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h
index 062c0a2886..2cea91ac95 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,15 +30,10 @@
 #if ENABLE(SVG)
 
 #include "Image.h"
-#include "ImageBuffer.h"
-#include "IntSize.h"
-#include <wtf/OwnPtr.h>
 
 namespace WebCore {
-    
-    class SVGDocument;
-    class Frame;
-    class FrameView;
+
+    class ImageBuffer;
     class Page;
     class SVGImageChromeClient;
     
@@ -72,12 +68,8 @@ namespace WebCore {
         
         virtual NativeImagePtr nativeImageForCurrentFrame();
         
-        SVGDocument* m_document;
         OwnPtr<SVGImageChromeClient> m_chromeClient;
         OwnPtr<Page> m_page;
-        RefPtr<Frame> m_frame;
-        RefPtr<FrameView> m_frameView;
-        IntSize m_minSize;
         OwnPtr<ImageBuffer> m_frameCache;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp
index 0240532827..0fcd7224f3 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
  *               2007 Rob Buis <buis@kde.org>
+ *               2008 Dirk Schulze <krit@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,6 +37,10 @@
 #include "SVGStyledElement.h"
 #include "SVGURIReference.h"
 
+#if PLATFORM(SKIA)
+#include "PlatformContextSkia.h"
+#endif
+
 namespace WebCore {
 
 SVGPaintServer::SVGPaintServer()
@@ -81,7 +86,7 @@ SVGPaintServer* SVGPaintServer::fillPaintServer(const RenderStyle* style, const
         AtomicString id(SVGURIReference::getTarget(fill->uri()));
         fillPaintServer = getPaintServerById(item->document(), id);
 
-        SVGElement* svgElement = static_cast<SVGElement*>(item->element());
+        SVGElement* svgElement = static_cast<SVGElement*>(item->node());
         ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
 
         if (item->isRenderPath() && fillPaintServer)
@@ -122,7 +127,7 @@ SVGPaintServer* SVGPaintServer::strokePaintServer(const RenderStyle* style, cons
         AtomicString id(SVGURIReference::getTarget(stroke->uri()));
         strokePaintServer = getPaintServerById(item->document(), id);
 
-        SVGElement* svgElement = static_cast<SVGElement*>(item->element());
+        SVGElement* svgElement = static_cast<SVGElement*>(item->node());
         ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
  
         if (item->isRenderPath() && strokePaintServer)
@@ -158,6 +163,44 @@ void applyStrokeStyleToContext(GraphicsContext* context, RenderStyle* style, con
     context->setLineDash(dashes, dashOffset);
 }
 
+void SVGPaintServer::draw(GraphicsContext*& context, const RenderObject* path, SVGPaintTargetType type) const
+{
+    if (!setup(context, path, type))
+        return;
+
+    renderPath(context, path, type);
+    teardown(context, path, type);
+}
+
+void SVGPaintServer::renderPath(GraphicsContext*& context, const RenderObject* path, SVGPaintTargetType type) const
+{
+    const SVGRenderStyle* style = path ? path->style()->svgStyle() : 0;
+
+    if ((type & ApplyToFillTargetType) && (!style || style->hasFill()))
+        context->fillPath();
+
+    if ((type & ApplyToStrokeTargetType) && (!style || style->hasStroke()))
+        context->strokePath();
+}
+
+#if PLATFORM(SKIA)
+void SVGPaintServer::teardown(GraphicsContext*& context, const RenderObject*, SVGPaintTargetType, bool) const
+{
+    // FIXME: Move this into the GraphicsContext
+    // WebKit implicitly expects us to reset the path.
+    // For example in fillAndStrokePath() of RenderPath.cpp the path is 
+    // added back to the context after filling. This is because internally it
+    // calls CGContextFillPath() which closes the path.
+    context->beginPath();
+    context->platformContext()->setGradient(0);
+    context->platformContext()->setPattern(0);
+}
+#else
+void SVGPaintServer::teardown(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool) const
+{
+}
+#endif
+
 DashArray dashArrayFromRenderingStyle(const RenderStyle* style)
 {
     DashArray array;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h
index 5722e8bd0c..9174f66f7c 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServer.h
@@ -77,12 +77,6 @@ namespace WebCore {
         static SVGPaintServerSolid* sharedSolidPaintServer();
 
     protected:
-#if PLATFORM(CG)
-        void strokePath(CGContextRef, const RenderObject*) const;
-        void fillPath(CGContextRef, const RenderObject*) const;
-#endif
-
-    protected:
         SVGPaintServer();        
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
index ba080aeee7..9ba224ee1a 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
@@ -34,22 +34,18 @@
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
 #include "RenderObject.h"
+#include "RenderView.h"
 #include "SVGGradientElement.h"
 #include "SVGPaintServerLinearGradient.h"
 #include "SVGPaintServerRadialGradient.h"
 #include "SVGRenderSupport.h"
 #include "SVGRenderTreeAsText.h"
 
-#if PLATFORM(CG)
-#include <wtf/MathExtras.h>
-#include <wtf/RetainPtr.h>
-#endif
-
 using namespace std;
 
 namespace WebCore {
 
-TextStream& operator<<(TextStream& ts, GradientSpreadMethod m)
+static TextStream& operator<<(TextStream& ts, GradientSpreadMethod m)
 {
     switch (m) {
         case SpreadMethodPad:
@@ -63,7 +59,7 @@ TextStream& operator<<(TextStream& ts, GradientSpreadMethod m)
     return ts;
 }
 
-TextStream& operator<<(TextStream& ts, const Vector<SVGGradientStop>& l)
+static TextStream& operator<<(TextStream& ts, const Vector<SVGGradientStop>& l)
 {
     ts << "[";
     for (Vector<SVGGradientStop>::const_iterator it = l.begin(); it != l.end(); ++it) {
@@ -76,10 +72,8 @@ TextStream& operator<<(TextStream& ts, const Vector<SVGGradientStop>& l)
 }
 
 SVGPaintServerGradient::SVGPaintServerGradient(const SVGGradientElement* owner)
-    : m_spreadMethod(SpreadMethodPad)
-    , m_boundingBoxMode(true)
+    : m_boundingBoxMode(true)
     , m_ownerElement(owner)
-
 #if PLATFORM(CG)
     , m_savedContext(0)
     , m_imageBuffer(0)
@@ -102,16 +96,6 @@ void SVGPaintServerGradient::setGradient(PassRefPtr<Gradient> gradient)
     m_gradient = gradient;
 }
 
-GradientSpreadMethod SVGPaintServerGradient::spreadMethod() const
-{
-    return m_spreadMethod;
-}
-
-void SVGPaintServerGradient::setGradientSpreadMethod(const GradientSpreadMethod& method)
-{
-    m_spreadMethod = method;
-}
-
 bool SVGPaintServerGradient::boundingBoxMode() const
 {
     return m_boundingBoxMode;
@@ -133,8 +117,6 @@ void SVGPaintServerGradient::setGradientTransform(const TransformationMatrix& tr
 }
 
 #if PLATFORM(CG)
-// Helper function for text painting in CG
-// This Cg specific code should move to GraphicsContext and Font* in a next step.
 static inline const RenderObject* findTextRootObject(const RenderObject* start)
 {
     while (start && !start->isSVGText())
@@ -149,15 +131,15 @@ static inline bool createMaskAndSwapContextForTextGradient(
     GraphicsContext*& context, GraphicsContext*& savedContext,
     OwnPtr<ImageBuffer>& imageBuffer, const RenderObject* object)
 {
-    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->relativeBBox(false);
+    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
     IntRect maskRect = enclosingIntRect(object->absoluteTransform().mapRect(maskBBox));
 
     IntSize maskSize(maskRect.width(), maskRect.height());
-    clampImageBufferSizeToViewport(object->document()->renderer(), maskSize);
+    clampImageBufferSizeToViewport(object->view()->frameView(), maskSize);
 
-    auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(maskSize, false);
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskSize, false);
 
-    if (!maskImage.get())
+    if (!maskImage)
         return false;
 
     GraphicsContext* maskImageContext = maskImage->context();
@@ -174,18 +156,18 @@ static inline bool createMaskAndSwapContextForTextGradient(
     return true;
 }
 
-static inline void clipToTextMask(GraphicsContext* context,
+static inline TransformationMatrix clipToTextMask(GraphicsContext* context,
     OwnPtr<ImageBuffer>& imageBuffer, const RenderObject* object,
     const SVGPaintServerGradient* gradientServer)
 {
-    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->relativeBBox(false);
+    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
 
     // Fixup transformations to be able to clip to mask
     TransformationMatrix transform = object->absoluteTransform();
     FloatRect textBoundary = transform.mapRect(maskBBox);
 
     IntSize maskSize(lroundf(textBoundary.width()), lroundf(textBoundary.height()));
-    clampImageBufferSizeToViewport(object->document()->renderer(), maskSize);
+    clampImageBufferSizeToViewport(object->view()->frameView(), maskSize);
     textBoundary.setSize(textBoundary.size().shrunkTo(maskSize));
 
     // Clip current context to mask image (gradient)
@@ -193,11 +175,13 @@ static inline void clipToTextMask(GraphicsContext* context,
     context->clipToImageBuffer(textBoundary, imageBuffer.get());
     context->concatCTM(transform);
 
+    TransformationMatrix matrix;
     if (gradientServer->boundingBoxMode()) {
-        context->translate(maskBBox.x(), maskBBox.y());
-        context->scale(FloatSize(maskBBox.width(), maskBBox.height()));
+        matrix.translate(maskBBox.x(), maskBBox.y());
+        matrix.scaleNonUniform(maskBBox.width(), maskBBox.height());
     }
-    context->concatCTM(gradientServer->gradientTransform());
+    matrix.multiply(gradientServer->gradientTransform());
+    return matrix;
 }
 #endif
 
@@ -234,54 +218,51 @@ bool SVGPaintServerGradient::setup(GraphicsContext*& context, const RenderObject
         applyStrokeStyleToContext(context, object->style(), object);
     }
 
+    TransformationMatrix matrix;
+    // CG platforms will handle the gradient space transform for text in
+    // teardown, so we don't apply it here.  For non-CG platforms, we
+    // want the text bounding box applied to the gradient space transform now,
+    // so the gradient shader can use it.
+#if PLATFORM(CG)
     if (boundingBoxMode() && !isPaintingText) {
-        FloatRect bbox = object->relativeBBox(false);
-        // Don't use gradientes for 1d objects like horizontal/vertical 
+#else
+    if (boundingBoxMode()) {
+#endif
+        FloatRect bbox = object->objectBoundingBox();
+        // Don't use gradients for 1d objects like horizontal/vertical 
         // lines or rectangles without width or height.
         if (bbox.width() == 0 || bbox.height() == 0) {
             Color color(0, 0, 0);
             context->setStrokeColor(color);
             return true;
         }
-        context->translate(bbox.x(), bbox.y());
-        context->scale(FloatSize(bbox.width(), bbox.height()));
-
-        // With scaling the context, the strokeThickness is scaled too. We have to
-        // undo this.
-        float strokeThickness = std::max((context->strokeThickness() / ((bbox.width() + bbox.height()) / 2) - 0.001f), 0.f);
-        context->setStrokeThickness(strokeThickness);
+        matrix.translate(bbox.x(), bbox.y());
+        matrix.scaleNonUniform(bbox.width(), bbox.height());
     }
-    context->concatCTM(gradientTransform());
-    context->setSpreadMethod(spreadMethod());
+    matrix.multiply(gradientTransform());
+    m_gradient->setGradientSpaceTransform(matrix);
 
     return true;
 }
 
-void SVGPaintServerGradient::renderPath(GraphicsContext*& context, const RenderObject* path, SVGPaintTargetType type) const
-{
-    const SVGRenderStyle* style = path->style()->svgStyle();
-
-    if ((type & ApplyToFillTargetType) && style->hasFill())
-        context->fillPath();
-
-    if ((type & ApplyToStrokeTargetType) && style->hasStroke())
-        context->strokePath();
-}
-
 void SVGPaintServerGradient::teardown(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType, bool isPaintingText) const
 {
 #if PLATFORM(CG)
     // renderPath() is not used when painting text, so we paint the gradient during teardown()
     if (isPaintingText && m_savedContext) {
+
         // Restore on-screen drawing context
         context = m_savedContext;
         m_savedContext = 0;
 
-        clipToTextMask(context, m_imageBuffer, object, this);
+        TransformationMatrix matrix = clipToTextMask(context, m_imageBuffer, object, this);
+        m_gradient->setGradientSpaceTransform(matrix);
+        context->setFillGradient(m_gradient);
+
+        FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
+
+        context->fillRect(maskBBox);
 
-        // finally fill the text clip with the shading
-        CGContextDrawShading(context->platformContext(), m_gradient->platformGradient());
- 
         m_imageBuffer.clear(); // we're done with our text mask buffer
     }
 #endif
@@ -295,8 +276,8 @@ TextStream& SVGPaintServerGradient::externalRepresentation(TextStream& ts) const
 
     // abstract, don't stream type
     ts  << "[stops=" << gradientStops() << "]";
-    if (spreadMethod() != SpreadMethodPad)
-        ts << "[method=" << spreadMethod() << "]";
+    if (m_gradient->spreadMethod() != SpreadMethodPad)
+        ts << "[method=" << m_gradient->spreadMethod() << "]";
     if (!boundingBoxMode())
         ts << " [bounding box mode=" << boundingBoxMode() << "]";
     if (!gradientTransform().isIdentity())
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h
index 9f0b71495d..b24c417be2 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.h
@@ -52,9 +52,6 @@ namespace WebCore {
         void setGradient(PassRefPtr<Gradient>);
         Gradient* gradient() const;
 
-        GradientSpreadMethod spreadMethod() const;
-        void setGradientSpreadMethod(const GradientSpreadMethod&);
-
         // Gradient start and end points are percentages when used in boundingBox mode.
         // For instance start point with value (0,0) is top-left and end point with
         // value (100, 100) is bottom-right. BoundingBox mode is enabled by default.
@@ -71,7 +68,6 @@ namespace WebCore {
 
         virtual bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
         virtual void teardown(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
-        virtual void renderPath(GraphicsContext*&, const RenderObject*, SVGPaintTargetType) const;
 
     protected:
         SVGPaintServerGradient(const SVGGradientElement* owner);
@@ -79,7 +75,6 @@ namespace WebCore {
     private:
         Vector<SVGGradientStop> m_stops;
         RefPtr<Gradient> m_gradient;
-        GradientSpreadMethod m_spreadMethod;
         bool m_boundingBoxMode;
         TransformationMatrix m_gradientTransform;
         const SVGGradientElement* m_ownerElement;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
index 0eae21260c..74ea27a282 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
+ *               2008 Dirk Schulze <krit@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,9 +29,14 @@
 #if ENABLE(SVG)
 #include "SVGPaintServerPattern.h"
 
+#include "GraphicsContext.h"
+#include "Image.h"
 #include "ImageBuffer.h"
+#include "Pattern.h"
+#include "RenderObject.h"
 #include "SVGPatternElement.h"
 #include "SVGRenderTreeAsText.h"
+#include "TransformationMatrix.h"
 
 using namespace std;
 
@@ -38,20 +44,13 @@ namespace WebCore {
 
 SVGPaintServerPattern::SVGPaintServerPattern(const SVGPatternElement* owner)
     : m_ownerElement(owner)
-#if PLATFORM(CG)
-    , m_patternSpace(0)
     , m_pattern(0)
-#endif
 {
     ASSERT(owner);
 }
 
 SVGPaintServerPattern::~SVGPaintServerPattern()
 {
-#if PLATFORM(CG)
-    CGPatternRelease(m_pattern);
-    CGColorSpaceRelease(m_patternSpace);
-#endif
 }
 
 FloatRect SVGPaintServerPattern::patternBoundaries() const
@@ -69,9 +68,9 @@ ImageBuffer* SVGPaintServerPattern::tile() const
     return m_tile.get();
 }
 
-void SVGPaintServerPattern::setTile(auto_ptr<ImageBuffer> tile)
+void SVGPaintServerPattern::setTile(PassOwnPtr<ImageBuffer> tile)
 {
-    m_tile.set(tile.release());
+    m_tile = tile;
 }
 
 TransformationMatrix SVGPaintServerPattern::patternTransform() const
@@ -96,6 +95,89 @@ TextStream& SVGPaintServerPattern::externalRepresentation(TextStream& ts) const
     return ts;
 }
 
+bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType type, bool isPaintingText) const
+{
+    FloatRect targetRect = object->objectBoundingBox();
+
+    const SVGRenderStyle* style = object->style()->svgStyle();
+    bool isFilled = (type & ApplyToFillTargetType) && style->hasFill();
+    bool isStroked = (type & ApplyToStrokeTargetType) && style->hasStroke();
+
+    ASSERT(isFilled && !isStroked || !isFilled && isStroked);
+
+    m_ownerElement->buildPattern(targetRect);
+    if (!tile())
+        return false;
+
+    context->save();
+
+    ASSERT(!m_pattern);
+
+    IntRect tileRect = tile()->image()->rect();
+    if (tileRect.width() > patternBoundaries().width() || tileRect.height() > patternBoundaries().height()) {
+        // Draw the first cell of the pattern manually to support overflow="visible" on all platforms.
+        int tileWidth = static_cast<int>(patternBoundaries().width() + 0.5f);
+        int tileHeight = static_cast<int>(patternBoundaries().height() + 0.5f);
+        OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(IntSize(tileWidth, tileHeight), false);
+  
+        GraphicsContext* tileImageContext = tileImage->context();
+
+        int numY = static_cast<int>(ceilf(tileRect.height() / tileHeight)) + 1;
+        int numX = static_cast<int>(ceilf(tileRect.width() / tileWidth)) + 1;
+
+        tileImageContext->save();
+        tileImageContext->translate(-patternBoundaries().width() * numX, -patternBoundaries().height() * numY);
+        for (int i = numY; i > 0; i--) {
+            tileImageContext->translate(0, patternBoundaries().height());
+            for (int j = numX; j > 0; j--) {
+                tileImageContext->translate(patternBoundaries().width(), 0);
+                tileImageContext->drawImage(tile()->image(), tileRect, tileRect);
+            }
+            tileImageContext->translate(-patternBoundaries().width() * numX, 0);
+        }
+        tileImageContext->restore();
+
+        m_pattern = Pattern::create(tileImage->image(), true, true);
+    }
+    else
+        m_pattern = Pattern::create(tile()->image(), true, true);
+
+    if (isFilled) {
+        context->setAlpha(style->fillOpacity());
+        context->setFillPattern(m_pattern);
+        context->setFillRule(style->fillRule());
+    }
+    if (isStroked) {
+        context->setAlpha(style->strokeOpacity());
+        context->setStrokePattern(m_pattern);
+        applyStrokeStyleToContext(context, object->style(), object);
+    }
+
+    TransformationMatrix matrix;
+    matrix.translate(patternBoundaries().x(), patternBoundaries().y());
+    matrix.multiply(patternTransform());
+    m_pattern->setPatternSpaceTransform(matrix);
+
+    if (isPaintingText) {
+        context->setTextDrawingMode(isFilled ? cTextFill : cTextStroke);
+#if PLATFORM(CG)
+        if (isFilled)
+            context->applyFillPattern();
+        else
+            context->applyStrokePattern();
+#endif
+    }
+
+    return true;
+}
+
+void SVGPaintServerPattern::teardown(GraphicsContext*& context, const RenderObject*, SVGPaintTargetType, bool) const
+{
+    m_pattern = 0;
+
+    context->restore();
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h
index ee23e5bb08..253e0126cb 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.h
@@ -30,11 +30,13 @@
 
 #include "TransformationMatrix.h"
 #include "FloatRect.h"
+#include "Pattern.h"
 #include "SVGPaintServer.h"
 
 #include <memory>
 
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -55,7 +57,7 @@ namespace WebCore {
         FloatRect patternBoundaries() const;
 
         ImageBuffer* tile() const;
-        void setTile(std::auto_ptr<ImageBuffer>);
+        void setTile(PassOwnPtr<ImageBuffer>);
 
         TransformationMatrix patternTransform() const;
         void setPatternTransform(const TransformationMatrix&);
@@ -63,9 +65,7 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
         virtual bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
-#if PLATFORM(CG) || PLATFORM(QT)
         virtual void teardown(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
-#endif
 
     private:
         SVGPaintServerPattern(const SVGPatternElement*);
@@ -75,10 +75,7 @@ namespace WebCore {
         TransformationMatrix m_patternTransform;
         FloatRect m_patternBoundaries;
 
-#if PLATFORM(CG)
-        mutable CGColorSpaceRef m_patternSpace;
-        mutable CGPatternRef m_pattern;
-#endif                
+        mutable RefPtr<Pattern> m_pattern;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp
index e862115170..b333042d84 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.cpp
@@ -88,17 +88,6 @@ bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* o
     return true;
 }
 
-void SVGPaintServerSolid::renderPath(GraphicsContext*& context, const RenderObject* path, SVGPaintTargetType type) const
-{
-    const SVGRenderStyle* svgStyle = path ? path->style()->svgStyle() : 0;
-
-    if ((type & ApplyToFillTargetType) && (!svgStyle || svgStyle->hasFill()))
-        context->fillPath();
-
-    if ((type & ApplyToStrokeTargetType) && (!svgStyle || svgStyle->hasStroke()))
-        context->strokePath();
-}
-
 } // namespace WebCore
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h
index 120752c5d3..0166c87c59 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerSolid.h
@@ -46,7 +46,6 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
         virtual bool setup(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const;
-        virtual void renderPath(GraphicsContext*&, const RenderObject*, SVGPaintTargetType) const;
 
     private:
         SVGPaintServerSolid();
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.cpp
index 51bda0d975..5998afb7eb 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceClipper.cpp
@@ -72,7 +72,7 @@ void SVGResourceClipper::applyClip(GraphicsContext* context, const FloatRect& bo
         if (clipData.bboxUnits) {
             TransformationMatrix transform;
             transform.translate(boundingBox.x(), boundingBox.y());
-            transform.scale(boundingBox.width(), boundingBox.height());
+            transform.scaleNonUniform(boundingBox.width(), boundingBox.height());
             clipPath.transform(transform);
         }
         context->addPath(clipPath);
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
index 8fb2dfa6de..6c1dccb0d7 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -21,64 +22,97 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGResourceFilter.h"
 
+#include "FilterEffect.h"
+#include "GraphicsContext.h"
+#include "ImageBuffer.h"
+#include "PlatformString.h"
+#include "SVGFilter.h"
+#include "SVGFilterBuilder.h"
 #include "SVGRenderTreeAsText.h"
-#include "SVGFilterEffect.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
 
 SVGResourceFilter::SVGResourceFilter()
-    : m_platformData(createPlatformData())
-    , m_filterBBoxMode(false)
+    : m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
     , m_xBBoxMode(false)
     , m_yBBoxMode(false)
+    , m_savedContext(0)
+    , m_sourceGraphicBuffer(0)
 {
+    m_filterBuilder.set(new SVGFilterBuilder());
 }
 
-void SVGResourceFilter::clearEffects()
+void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
-    m_effects.clear();
+    effectAttributes->setStandardAttributes(this, effect.get());
+    builder()->add(effectAttributes->result(), effect);
 }
 
-void SVGResourceFilter::addFilterEffect(SVGFilterEffect* effect)
+FloatRect SVGResourceFilter::filterBBoxForItemBBox(const FloatRect& itemBBox) const
 {
-    ASSERT(effect);
+    FloatRect filterBBox = filterRect();
 
-    if (effect) {
-        ASSERT(effect->filter() == this);
-        m_effects.append(effect);
-    }
+    if (filterBoundingBoxMode())
+        filterBBox = FloatRect(itemBBox.x() + filterBBox.x() * itemBBox.width(),
+                               itemBBox.y() + filterBBox.y() * itemBBox.height(),
+                               filterBBox.width() * itemBBox.width(),
+                               filterBBox.height() * itemBBox.height());
+
+    return filterBBox;
 }
 
-FloatRect SVGResourceFilter::filterBBoxForItemBBox(const FloatRect& itemBBox) const
+void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const FloatRect& itemRect)
 {
-    FloatRect filterBBox = filterRect();
+    // Draw the content of the current element and it's childs to a imageBuffer to get the SourceGraphic.
+    // The size of the SourceGraphic must match the size of the element, the filter is aplied to.
+    IntSize bufferSize = IntSize(itemRect.width(), itemRect.height());
+    OwnPtr<ImageBuffer> sourceGraphic(ImageBuffer::create(bufferSize, false));
+    
+    if (!sourceGraphic.get())
+        return;
+
+    GraphicsContext* sourceGraphicContext = sourceGraphic->context();
+    sourceGraphicContext->translate(-itemRect.x(), -itemRect.y());
+    sourceGraphicContext->clearRect(FloatRect(0, 0, itemRect.width(), itemRect.height()));
+    m_sourceGraphicBuffer.set(sourceGraphic.release());
+    m_savedContext = context;
+
+    context = sourceGraphicContext;
+}
 
-    float xOffset = 0.0f;
-    float yOffset = 0.0f;
+void SVGResourceFilter::applyFilter(GraphicsContext*& context, const FloatRect& itemRect)
+{
+    if (!m_savedContext)
+        return;
 
-    if (!effectBoundingBoxMode()) {
-        xOffset = itemBBox.x();
-        yOffset = itemBBox.y();
-    }
+    FloatRect filterRect = filterBBoxForItemBBox(itemRect);
 
-    if (filterBoundingBoxMode()) {
-        filterBBox = FloatRect(xOffset + filterBBox.x() * itemBBox.width(),
-                               yOffset + filterBBox.y() * itemBBox.height(),
-                               filterBBox.width() * itemBBox.width(),
-                               filterBBox.height() * itemBBox.height());
-    } else {
-        if (xBoundingBoxMode())
-            filterBBox.setX(xOffset + filterBBox.x());
+    setFilterBoundingBox(filterRect);
+    setItemBoundingBox(itemRect);
+
+    context = m_savedContext;
+    m_savedContext = 0;
 
-        if (yBoundingBoxMode())
-            filterBBox.setY(yOffset + filterBBox.y());
+    FilterEffect* lastEffect = m_filterBuilder->lastEffect();
+
+    if (lastEffect && !filterRect.isEmpty()) {
+        RefPtr<Filter> filter = SVGFilter::create(m_itemBBox, m_filterBBox, m_effectBBoxMode, m_filterBBoxMode);
+        filter->setSourceImage(m_sourceGraphicBuffer->image());
+        lastEffect->apply(filter.get());
+
+        context->clip(filterRect);
+
+        if (lastEffect->resultImage())
+            context->drawImage(lastEffect->resultImage()->image(), 
+                            lastEffect->subRegion());
     }
 
-    return filterBBox;
+    m_sourceGraphicBuffer.clear();
 }
 
 TextStream& SVGResourceFilter::externalRepresentation(TextStream& ts) const
@@ -102,8 +136,6 @@ TextStream& SVGResourceFilter::externalRepresentation(TextStream& ts) const
         ts << " [bounding box mode=" << filterBoundingBoxMode() << "]";
     if (effectBoundingBoxMode()) // default is false
         ts << " [effect bounding box mode=" << effectBoundingBoxMode() << "]";
-    if (m_effects.size() > 0)
-        ts << " [effects=" << m_effects << "]";
 
     return ts;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
index 646c7324a6..d081b6b29c 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -22,23 +23,25 @@
 #ifndef SVGResourceFilter_h
 #define SVGResourceFilter_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGResource.h"
-#include "SVGFilterEffect.h"
 
+#include "Image.h"
+#include "ImageBuffer.h"
 #include "FloatRect.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
 
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
+class Filter;
+class FilterEffect;
 class GraphicsContext;
-class SVGFilterEffect;
-    
-class SVGResourceFilterPlatformData {
-public:
-    virtual ~SVGResourceFilterPlatformData() {}
-};
+class SVGFilterBuilder;
+class SVGFilterPrimitiveStandardAttributes;
 
 class SVGResourceFilter : public SVGResource {
 public:
@@ -61,24 +64,24 @@ public:
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
-    FloatRect filterBBoxForItemBBox(const FloatRect& itemBBox) const;
+    FloatRect filterBoundingBox() { return m_filterBBox; }
+    void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
+
+    FloatRect itemBoundingBox() { return m_itemBBox; }
+    void setItemBoundingBox(const FloatRect& rect) { m_itemBBox = rect; }
 
-    void clearEffects();
-    void addFilterEffect(SVGFilterEffect*);
+    FloatRect filterBBoxForItemBBox(const FloatRect& itemBBox) const;
 
     virtual TextStream& externalRepresentation(TextStream&) const;
 
-    // To be implemented in platform specific code.
-    void prepareFilter(GraphicsContext*&, const FloatRect& bbox);
-    void applyFilter(GraphicsContext*&, const FloatRect& bbox);
-    
-    SVGResourceFilterPlatformData* platformData() { return m_platformData.get(); }
-    const Vector<SVGFilterEffect*>& effects() { return m_effects; }
+    void prepareFilter(GraphicsContext*&, const FloatRect&);
+    void applyFilter(GraphicsContext*&, const FloatRect&);
+
+    void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
+
+    SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
     
 private:
-    SVGResourceFilterPlatformData* createPlatformData();
-    
-    OwnPtr<SVGResourceFilterPlatformData> m_platformData;
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
@@ -87,7 +90,13 @@ private:
     bool m_yBBoxMode : 1;
 
     FloatRect m_filterRect;
-    Vector<SVGFilterEffect*> m_effects;
+
+    FloatRect m_filterBBox;
+    FloatRect m_itemBBox;
+
+    OwnPtr<SVGFilterBuilder> m_filterBuilder;
+    GraphicsContext* m_savedContext;
+    OwnPtr<ImageBuffer> m_sourceGraphicBuffer;
 };
 
 SVGResourceFilter* getFilterById(Document*, const AtomicString&);
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp
index c50f5e3270..112e4d6c8a 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMarker.cpp
@@ -82,14 +82,14 @@ void SVGResourceMarker::draw(GraphicsContext* context, const FloatRect& rect, do
     // the translation performed on the viewport itself.
     TransformationMatrix viewportTransform;
     if (m_useStrokeWidth)
-        viewportTransform.scale(strokeWidth, strokeWidth);
+        viewportTransform.scaleNonUniform(strokeWidth, strokeWidth);
     viewportTransform *= m_marker->viewportTransform();
     double refX, refY;
-    viewportTransform.map(m_refX, m_refY, &refX, &refY);
+    viewportTransform.map(m_refX, m_refY, refX, refY);
     transform.translate(-refX, -refY);
 
     if (m_useStrokeWidth)
-        transform.scale(strokeWidth, strokeWidth);
+        transform.scaleNonUniform(strokeWidth, strokeWidth);
 
     // FIXME: PaintInfo should be passed into this method instead of being created here
     // FIXME: bounding box fractions are lost
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
index 842f04f22f..3c213505c7 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
@@ -28,9 +28,18 @@
 #if ENABLE(SVG)
 #include "SVGResourceMasker.h"
 
+#include "CanvasPixelArray.h"
+#include "Image.h"
 #include "ImageBuffer.h"
+#include "ImageData.h"
+#include "GraphicsContext.h"
+#include "SVGMaskElement.h"
+#include "SVGRenderSupport.h"
+#include "SVGRenderStyle.h"
 #include "TextStream.h"
 
+#include <wtf/ByteArray.h>
+
 using namespace std;
 
 namespace WebCore {
@@ -51,6 +60,44 @@ void SVGResourceMasker::invalidate()
     m_mask.clear();
 }
 
+void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& boundingBox)
+{
+    if (!m_mask)
+        m_mask = m_ownerElement->drawMaskerContent(boundingBox, m_maskRect);
+
+    if (!m_mask)
+        return;
+
+    IntSize imageSize(m_mask->size());
+    IntRect intImageRect(0, 0, imageSize.width(), imageSize.height());
+
+    // Create new ImageBuffer to apply luminance
+    OwnPtr<ImageBuffer> luminancedImage = ImageBuffer::create(imageSize, false);
+    if (!luminancedImage)
+        return;
+
+    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getImageData(intImageRect)->data());
+    PassRefPtr<ImageData> destImageData(luminancedImage->getImageData(intImageRect));
+
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset++) {
+        unsigned pixelByteOffset = pixelOffset * 4;
+
+        unsigned char r = 0, g = 0, b = 0, a = 0;
+        srcPixelArray->get(pixelByteOffset, r);
+        srcPixelArray->get(pixelByteOffset + 1, g);
+        srcPixelArray->get(pixelByteOffset + 2, b);
+        srcPixelArray->get(pixelByteOffset + 3, a);
+
+        double luma = (r * 0.2125 + g * 0.7154 + b * 0.0721) * ((double)a / 255.0);
+
+        destImageData->data()->set(pixelByteOffset + 3, luma);
+    }
+
+    luminancedImage->putImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
+
+    context->clipToImageBuffer(m_maskRect, luminancedImage.get());
+}
+
 TextStream& SVGResourceMasker::externalRepresentation(TextStream& ts) const
 {
     ts << "[type=MASKER]";
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h
index 25c20457ce..07ac16cd4b 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGDistantLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGDistantLightSource_h
 #define SVGDistantLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGLightSource.h"
 
 namespace WebCore {
@@ -48,6 +48,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGDistantLightSource_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
index 4b82e5a814..51972154d3 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
@@ -21,8 +21,9 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEConvolveMatrix.h"
+#include "Filter.h"
 #include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
@@ -133,7 +134,7 @@ void FEConvolveMatrix::setPreserveAlpha(bool preserveAlpha)
     m_preserveAlpha = preserveAlpha; 
 }
 
-void FEConvolveMatrix::apply()
+void FEConvolveMatrix::apply(Filter*)
 {
 }
 
@@ -174,4 +175,4 @@ TextStream& FEConvolveMatrix::externalRepresentation(TextStream& ts) const
 
 }; // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
index c3eea2bacb..9b3b33f19c 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
@@ -22,11 +22,11 @@
 #ifndef SVGFEConvolveMatrix_h
 #define SVGFEConvolveMatrix_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
 #include "FloatPoint.h"
 #include "FloatSize.h"
-
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -68,8 +68,8 @@ namespace WebCore {
         bool preserveAlpha() const;
         void setPreserveAlpha(bool);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -90,6 +90,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEConvolveMatrix_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
index 6399c5e711..c5364786fc 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
@@ -21,10 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGLightSource.h"
 #include "SVGFEDiffuseLighting.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -112,7 +113,7 @@ void FEDiffuseLighting::setLightSource(LightSource* lightSource)
     m_lightSource = lightSource;
 }
 
-void FEDiffuseLighting::apply()
+void FEDiffuseLighting::apply(Filter*)
 {
 }
 
@@ -132,4 +133,4 @@ TextStream& FEDiffuseLighting::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
index a817ce2b6a..f4b4dadb7c 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
@@ -22,9 +22,10 @@
 #ifndef SVGFEDiffuseLighting_h
 #define SVGFEDiffuseLighting_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "Color.h"
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -54,8 +55,8 @@ namespace WebCore {
         const LightSource* lightSource() const;
         void setLightSource(LightSource*);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
         
     private:
@@ -73,6 +74,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEDiffuseLighting_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
index f7996e3894..abb57ee9ce 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMap.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -74,7 +75,7 @@ void FEDisplacementMap::setScale(float scale)
     m_scale = scale;
 }
 
-void FEDisplacementMap::apply()
+void FEDisplacementMap::apply(Filter*)
 {
 }
 
@@ -113,4 +114,4 @@ TextStream& FEDisplacementMap::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h
index 0218d576f8..1fd6db9989 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h
@@ -22,9 +22,10 @@
 #ifndef SVGFEDisplacementMap_h
 #define SVGFEDisplacementMap_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "PlatformString.h"
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -50,8 +51,8 @@ namespace WebCore {
         float scale() const;
         void setScale(float scale);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -67,6 +68,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEDisplacementMap_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 3d52f6381b..9bdb8ca991 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -21,22 +21,24 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFlood.h"
+#include "Filter.h"
 #include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
 
-FEFlood::FEFlood(const Color& floodColor, const float& floodOpacity)
+FEFlood::FEFlood(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
     : FilterEffect()
+    , m_in(in)
     , m_floodColor(floodColor)
     , m_floodOpacity(floodOpacity)
 {
 }
 
-PassRefPtr<FEFlood> FEFlood::create(const Color& floodColor, const float& floodOpacity)
+PassRefPtr<FEFlood> FEFlood::create(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
 {
-    return adoptRef(new FEFlood(floodColor, floodOpacity));
+    return adoptRef(new FEFlood(in, floodColor, floodOpacity));
 }
 
 Color FEFlood::floodColor() const
@@ -59,7 +61,7 @@ void FEFlood::setFloodOpacity(float floodOpacity)
     m_floodOpacity = floodOpacity;
 }
 
-void FEFlood::apply()
+void FEFlood::apply(Filter*)
 {
 }
 
@@ -78,4 +80,4 @@ TextStream& FEFlood::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
index 055877402c..21985db567 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
@@ -22,15 +22,16 @@
 #ifndef SVGFEFlood_h
 #define SVGFEFlood_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "Color.h"
+#include "Filter.h"
 #include "FilterEffect.h"
 
 namespace WebCore {
 
     class FEFlood : public FilterEffect {
     public:
-        static PassRefPtr<FEFlood> create(const Color&, const float&);
+        static PassRefPtr<FEFlood> create(FilterEffect*, const Color&, const float&);
 
         Color floodColor() const;
         void setFloodColor(const Color &);
@@ -38,19 +39,20 @@ namespace WebCore {
         float floodOpacity() const;
         void setFloodOpacity(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEFlood(const Color&, const float&);
+        FEFlood(FilterEffect*, const Color&, const float&);
 
+        RefPtr<FilterEffect> m_in;
         Color m_floodColor;
         float m_floodOpacity;
     };
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEFlood_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
index 4e64c582e2..601c39ec77 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEGaussianBlur.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -60,7 +61,7 @@ void FEGaussianBlur::setStdDeviationY(float y)
     m_y = y;
 }
 
-void FEGaussianBlur::apply()
+void FEGaussianBlur::apply(Filter*)
 {
 }
 
@@ -78,4 +79,4 @@ TextStream& FEGaussianBlur::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
index 33ad0c773f..a377f89334 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
@@ -22,8 +22,9 @@
 #ifndef SVGFEGaussianBlur_h
 #define SVGFEGaussianBlur_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -37,8 +38,8 @@ namespace WebCore {
         float stdDeviationY() const;
         void setStdDeviationY(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -51,6 +52,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEGaussianBlur_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp
index 2bf83bef81..a01ad3b7b2 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEImage.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -63,7 +64,7 @@ void FEImage::setCachedImage(CachedImage* image)
         m_cachedImage->addClient(this);
 }
 
-void FEImage::apply()
+void FEImage::apply(Filter*)
 {
 }
 
@@ -81,4 +82,4 @@ TextStream& FEImage::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h
index fcf413fff1..3fdc26a495 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEImage.h
@@ -22,11 +22,12 @@
 #ifndef SVGFEImage_h
 #define SVGFEImage_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "CachedImage.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceHandle.h"
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -41,8 +42,8 @@ namespace WebCore {
         CachedImage* cachedImage() const;
         void setCachedImage(CachedImage*);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
         
     private:
@@ -53,6 +54,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEImage_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp
index 8ce15a7f66..7f12c4cc52 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMerge.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -48,7 +49,7 @@ void FEMerge::setMergeInputs(const Vector<FilterEffect*>& mergeInputs)
     m_mergeInputs = mergeInputs;
 }
 
-void FEMerge::apply()
+void FEMerge::apply(Filter*)
 {
 }
 
@@ -75,4 +76,4 @@ TextStream& FEMerge::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h
index 6415c9fd52..e41e55416a 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMerge.h
@@ -22,9 +22,9 @@
 #ifndef SVGFEMerge_h
 #define SVGFEMerge_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
-
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -36,8 +36,8 @@ namespace WebCore {
         const Vector<FilterEffect*>& mergeInputs() const;
         void setMergeInputs(const Vector<FilterEffect*>& mergeInputs);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -48,6 +48,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEMerge_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index 7838a8c1a5..37677347fa 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMorphology.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -71,7 +72,7 @@ void FEMorphology::setRadiusY(float radiusY)
     m_radiusY = radiusY;
 }
 
-void FEMorphology::apply()
+void FEMorphology::apply(Filter*)
 {
 }
 
@@ -104,4 +105,4 @@ TextStream& FEMorphology::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
index 98ab6336b8..1db8bc4c4b 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
@@ -22,8 +22,9 @@
 #ifndef SVGFEMorphology_h
 #define SVGFEMorphology_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -45,8 +46,8 @@ namespace WebCore {
         float radiusY() const;
         void setRadiusY(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -60,6 +61,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEMorphology_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp
index c2a0fc9d43..63775fbdf3 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEOffset.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -60,7 +61,7 @@ void FEOffset::setDy(float dy)
     m_dy = dy;
 }
 
-void FEOffset::apply()
+void FEOffset::apply(Filter*)
 {
 }
 
@@ -78,4 +79,4 @@ TextStream& FEOffset::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.h
index 86128da91f..93bdde9128 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEOffset.h
@@ -22,8 +22,9 @@
 #ifndef SVGFEOffset_h
 #define SVGFEOffset_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -37,8 +38,8 @@ namespace WebCore {
         float dy() const;
         void setDy(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -51,6 +52,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEOffset_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
index e3446ed56f..eb0c280775 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpecularLighting.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -124,7 +125,7 @@ void FESpecularLighting::setLightSource(LightSource* lightSource)
     m_lightSource = lightSource;
 }
 
-void FESpecularLighting::apply()
+void FESpecularLighting::apply(Filter*)
 {
 }
 
@@ -144,4 +145,4 @@ TextStream& FESpecularLighting::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
index e1c1930a52..4efff93447 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
@@ -22,10 +22,11 @@
 #ifndef SVGFESpecularLighting_h
 #define SVGFESpecularLighting_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "Color.h"
-#include "SVGLightSource.h"
 #include "FilterEffect.h"
+#include "SVGLightSource.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -56,8 +57,8 @@ namespace WebCore {
         const LightSource* lightSource() const;
         void setLightSource(LightSource*);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -76,6 +77,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFESpecularLighting_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
index 773a5cdff5..fecd1057d9 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
@@ -19,9 +19,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETile.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -36,7 +37,7 @@ PassRefPtr<FETile> FETile::create(FilterEffect* in)
     return adoptRef(new FETile(in));
 }
 
-void FETile::apply()
+void FETile::apply(Filter*)
 {
 }
 
@@ -53,5 +54,5 @@ TextStream& FETile::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.h
index 986f6fd4ef..f1e8d1ae93 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.h
@@ -22,8 +22,9 @@
 #ifndef SVGFETile_h
 #define SVGFETile_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
     
@@ -31,8 +32,8 @@ namespace WebCore {
     public:
         static PassRefPtr<FETile> create(FilterEffect*);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
         
     private:
@@ -43,6 +44,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFETile_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.cpp
index 9731c49164..542c576203 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETurbulence.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -105,7 +106,7 @@ void FETurbulence::setStitchTiles(bool stitch)
     m_stitchTiles = stitch;
 }
 
-void FETurbulence::apply()
+void FETurbulence::apply(Filter*)
 {
 }
 
@@ -142,4 +143,4 @@ TextStream& FETurbulence::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.h
index 6977460e1a..e7f40f61f8 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETurbulence.h
@@ -22,8 +22,9 @@
 #ifndef SVGFETurbulence_h
 #define SVGFETurbulence_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -56,8 +57,8 @@ namespace WebCore {
         bool stitchTiles() const;
         void setStitchTiles(bool);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -74,6 +75,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFETurbulence_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
new file mode 100644
index 0000000000..71c00eb250
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -0,0 +1,47 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFilter.h"
+
+namespace WebCore {
+
+SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+    : Filter()
+    , m_itemBox(itemBox)
+    , m_filterRect(filterRect)
+    , m_effectBBoxMode(effectBBoxMode)
+    , m_filterBBoxMode(filterBBoxMode)
+{
+}
+
+void SVGFilter::calculateEffectSubRegion(FilterEffect*)
+{
+}
+
+PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+{
+    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode, filterBBoxMode));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
new file mode 100644
index 0000000000..95b34142ff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGFilter_h
+#define SVGFilter_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "Filter.h"
+#include "FilterEffect.h"
+#include "FloatRect.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class SVGFilter : public Filter {
+    public:
+        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool, bool);
+
+        void calculateEffectSubRegion(FilterEffect*);
+
+    private:
+        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool itemBBoxMode, bool filterBBoxMode);
+
+        FloatRect m_itemBox;
+        FloatRect m_filterRect;
+        bool m_effectBBoxMode;
+        bool m_filterBBoxMode;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
+
+#endif // SVGFilter_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
new file mode 100644
index 0000000000..67668d6511
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
@@ -0,0 +1,79 @@
+
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFilterBuilder.h"
+
+#include "FilterEffect.h"
+#include "PlatformString.h"
+#include "SourceAlpha.h"
+#include "SourceGraphic.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+SVGFilterBuilder::SVGFilterBuilder()
+{
+    m_builtinEffects.add(SourceGraphic::effectName(), SourceGraphic::create());
+    m_builtinEffects.add(SourceAlpha::effectName(), SourceAlpha::create());
+}
+
+void SVGFilterBuilder::add(const AtomicString& id, RefPtr<FilterEffect> effect)
+{
+    if (id.isEmpty()) {
+        m_lastEffect = effect.get();
+        return;
+    }
+
+    if (m_builtinEffects.contains(id))
+        return;
+
+    m_lastEffect = effect.get();
+    m_namedEffects.set(id, m_lastEffect);
+}
+
+FilterEffect* SVGFilterBuilder::getEffectById(const AtomicString& id) const
+{
+    if (id.isEmpty()) {
+        if (m_lastEffect)
+            return m_lastEffect.get();
+
+        return m_builtinEffects.get(SourceGraphic::effectName()).get();
+    }
+
+    if (m_builtinEffects.contains(id))
+        return m_builtinEffects.get(id).get();
+
+    return m_namedEffects.get(id).get();
+}
+
+void SVGFilterBuilder::clearEffects()
+{
+    m_lastEffect = 0;
+    m_namedEffects.clear();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/FilterBuilder.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.h
index 630537c7b5..55844c9b4e 100644
--- a/src/3rdparty/webkit/WebCore/svg/FilterBuilder.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterBuilder.h
@@ -17,35 +17,40 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef FilterBuilder_h
-#define FilterBuilder_h
+#ifndef SVGFilterBuilder_h
+#define SVGFilterBuilder_h
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "PlatformString.h"
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "AtomicStringHash.h"
 #include "FilterEffect.h"
-#include "Filter.h"
+#include "PlatformString.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
     
-    class FilterBuilder : public RefCounted<FilterBuilder> {
+    class SVGFilterBuilder : public RefCounted<SVGFilterBuilder> {
     public:
-        void add(const String& id, PassRefPtr<FilterEffect> effect) { m_namedEffects.set(id.impl(), effect); }
-        FilterEffect* getEffectById(const String& id) const { return m_namedEffects.get(id.impl()).get(); }
-        
-        PassRefPtr<Filter> filter() const { return m_filter; }
-        
+        SVGFilterBuilder();
+
+        void add(const AtomicString& id, RefPtr<FilterEffect> effect);
+
+        FilterEffect* getEffectById(const AtomicString& id) const;
+        FilterEffect* lastEffect() const { return m_lastEffect.get(); }
+
+        void clearEffects();
+
     private:
-        HashMap<StringImpl*, RefPtr<FilterEffect> > m_namedEffects;
-        
-        RefPtr<Filter> m_filter;
+        HashMap<AtomicString, RefPtr<FilterEffect> > m_builtinEffects;
+        HashMap<AtomicString, RefPtr<FilterEffect> > m_namedEffects;
+
+        RefPtr<FilterEffect> m_lastEffect;
     };
     
 } //namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterEffect.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterEffect.cpp
deleted file mode 100644
index f8e246fe62..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterEffect.cpp
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric@webkit.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "SVGFilterEffect.h"
-
-#include "SVGRenderTreeAsText.h"
-#include "SVGResourceFilter.h"
-
-namespace WebCore {
-
-SVGFilterEffect::SVGFilterEffect(SVGResourceFilter* filter)
-    : m_filter(filter)
-    , m_xBBoxMode(false)
-    , m_yBBoxMode(false)
-    , m_widthBBoxMode(false)
-    , m_heightBBoxMode(false)
-{
-}
-
-FloatRect SVGFilterEffect::primitiveBBoxForFilterBBox(const FloatRect& filterBBox, const FloatRect& itemBBox) const
-{
-    FloatRect subRegionBBox = subRegion();
-    FloatRect useBBox = filterBBox;
-
-    ASSERT(m_filter);
-    if (!m_filter)
-        return FloatRect();
-
-    if (m_filter->effectBoundingBoxMode()) {
-        if (!m_filter->filterBoundingBoxMode())
-            useBBox = itemBBox;
-
-        subRegionBBox = FloatRect(useBBox.x() + subRegionBBox.x() * useBBox.width(),
-                                  useBBox.y() + subRegionBBox.y() * useBBox.height(),
-                                  subRegionBBox.width() * useBBox.width(),
-                                  subRegionBBox.height() * useBBox.height());
-    } else {
-        if (xBoundingBoxMode())
-            subRegionBBox.setX(useBBox.x() + subRegionBBox.x() * useBBox.width());
-
-        if (yBoundingBoxMode())
-            subRegionBBox.setY(useBBox.y() + subRegionBBox.y() * useBBox.height());
-
-        if (widthBoundingBoxMode())
-            subRegionBBox.setWidth(subRegionBBox.width() * useBBox.width());
-
-        if (heightBoundingBoxMode())
-            subRegionBBox.setHeight(subRegionBBox.height() * useBBox.height());
-    }
-
-    return subRegionBBox;
-}
-
-FloatRect SVGFilterEffect::subRegion() const
-{
-    return m_subRegion;
-}
-
-void SVGFilterEffect::setSubRegion(const FloatRect& subRegion)
-{
-    m_subRegion = subRegion;
-}
-
-String SVGFilterEffect::in() const
-{
-    return m_in;
-}
-
-void SVGFilterEffect::setIn(const String& in)
-{
-    m_in = in;
-}
-
-String SVGFilterEffect::result() const
-{
-    return m_result;
-}
-
-void SVGFilterEffect::setResult(const String& result)
-{
-    m_result = result;
-}
-
-SVGResourceFilter* SVGFilterEffect::filter() const
-{
-    return m_filter;
-}
-
-void SVGFilterEffect::setFilter(SVGResourceFilter* filter)
-{
-    m_filter = filter;
-}
-
-TextStream& SVGFilterEffect::externalRepresentation(TextStream& ts) const
-{
-    if (!in().isEmpty())
-        ts << "[in=\"" << in() << "\"]";
-    if (!result().isEmpty())
-        ts << " [result=\"" << result() << "\"]";
-    if (!subRegion().isEmpty())
-        ts << " [subregion=\"" << subRegion() << "\"]";
-    return ts;
-}
-
-TextStream& operator<<(TextStream& ts, const SVGFilterEffect& e)
-{
-    return e.externalRepresentation(ts);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterEffect.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterEffect.h
deleted file mode 100644
index d497f8b6d3..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilterEffect.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric@webkit.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef SVGFilterEffect_h
-#define SVGFilterEffect_h
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "FloatRect.h"
-#include "PlatformString.h"
-
-#if PLATFORM(CI)
-#ifdef __OBJC__
-@class CIFilter;
-#else
-class CIFilter;
-#endif
-#endif
-
-namespace WebCore {
-
-class SVGResourceFilter;
-class TextStream;
-
-class SVGFilterEffect : public RefCounted<SVGFilterEffect> {
-public:
-    SVGFilterEffect(SVGResourceFilter*);
-    virtual ~SVGFilterEffect() { }
-
-    bool xBoundingBoxMode() const { return m_xBBoxMode; }
-    void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-    bool yBoundingBoxMode() const { return m_yBBoxMode; }
-    void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
-    bool widthBoundingBoxMode() const { return m_widthBBoxMode; }
-    void setWidthBoundingBoxMode(bool bboxMode) { m_widthBBoxMode = bboxMode; }
-
-    bool heightBoundingBoxMode() const { return m_heightBBoxMode; }
-    void setHeightBoundingBoxMode(bool bboxMode) { m_heightBBoxMode = bboxMode; }
-
-    FloatRect primitiveBBoxForFilterBBox(const FloatRect& filterBBox, const FloatRect& itemBBox) const;
-
-    FloatRect subRegion() const;
-    void setSubRegion(const FloatRect&);
-
-    String in() const;
-    void setIn(const String&);
-
-    String result() const;
-    void setResult(const String&);
-
-    SVGResourceFilter* filter() const;
-    void setFilter(SVGResourceFilter*);
-
-    virtual TextStream& externalRepresentation(TextStream&) const;
-
-#if PLATFORM(CI)
-    virtual CIFilter* getCIFilter(const FloatRect& bbox) const;
-#endif
-
-private:
-    SVGResourceFilter* m_filter;
-
-    bool m_xBBoxMode : 1;
-    bool m_yBBoxMode : 1;
-    bool m_widthBBoxMode : 1;
-    bool m_heightBBoxMode : 1;
-
-    FloatRect m_subRegion;
- 
-    String m_in;
-    String m_result;
-};
-
-TextStream& operator<<(TextStream&, const SVGFilterEffect&);
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#endif // SVGFilterEffect_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.cpp
index 77611ca8e0..9176b4caca 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.cpp
@@ -21,7 +21,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGPointLightSource.h"
 #include "SVGRenderTreeAsText.h"
 #include "SVGSpotLightSource.h"
@@ -62,4 +62,4 @@ TextStream& DistantLightSource::externalRepresentation(TextStream& ts) const
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h
index 779e147cd5..22b43c8a2b 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGLightSource_h
 #define SVGLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
@@ -53,6 +53,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGLightSource_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h
index 099a165d94..772e278f98 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGPointLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGPointLightSource_h
 #define SVGPointLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FloatPoint3D.h"
 #include "SVGLightSource.h"
 
@@ -46,6 +46,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGPointLightSource_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h
index a4aa1fbcf1..9a787fb23d 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGSpotLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGSpotLightSource_h
 #define SVGSpotLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FloatPoint3D.h"
 #include "SVGLightSource.h"
 
@@ -57,6 +57,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGSpotLightSource_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/qt/RenderPathQt.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/qt/RenderPathQt.cpp
deleted file mode 100644
index 6bc2682aeb..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/qt/RenderPathQt.cpp
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <wildfox@kde.org>
-                  2004, 2005, 2006 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric.seidel@kdemail.net>
-
-    This file is part of the KDE project
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "RenderPath.h"
-#include "SVGRenderStyle.h"
-#include "SVGPaintServer.h"
-
-#include <QDebug>
-#include <QPainterPathStroker>
-
-namespace WebCore {
-    
-bool RenderPath::strokeContains(const FloatPoint& point, bool requiresStroke) const
-{
-    if (path().isEmpty())
-        return false;
-
-    if (requiresStroke && !SVGPaintServer::strokePaintServer(style(), this))
-        return false;
-
-    return false;
-}
-
-}
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGPaintServerPatternQt.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGPaintServerPatternQt.cpp
deleted file mode 100644
index 8ae5a1a88c..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGPaintServerPatternQt.cpp
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
-    Copyright (C) 2006 Nikolas Zimmermann <wildfox@kde.org>
-    Copyright (C) 2008 Dirk Schulze <vbs85@gmx.de>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SVGPaintServerPattern.h"
-
-#include "TransformationMatrix.h"
-#include "GraphicsContext.h"
-#include "ImageBuffer.h"
-#include "Pattern.h"
-#include "RenderObject.h"
-#include "SVGPatternElement.h"
-
-#include <QPainter>
-#include <QPainterPath>
-
-namespace WebCore {
-
-bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType type, bool isPaintingText) const
-{
-    Q_ASSERT(context);
-    Q_ASSERT(object);
-
-    FloatRect targetRect = object->relativeBBox(false);
-    m_ownerElement->buildPattern(targetRect);
-
-    if (!tile())
-        return false;
-
-    QPainter* painter = context->platformContext();
-    QPainterPath* path = context->currentPath();
-
-    RenderStyle* style = object->style();
-    const SVGRenderStyle* svgStyle = object->style()->svgStyle();
-
-    RefPtr<Pattern> pattern = Pattern::create(tile()->image(), true, true);
-
-    context->save();
-    painter->setPen(Qt::NoPen);
-    painter->setBrush(Qt::NoBrush);
-
-    TransformationMatrix affine;
-    affine.translate(patternBoundaries().x(), patternBoundaries().y());
-    affine.multiply(patternTransform());
-
-    QBrush brush(pattern->createPlatformPattern(affine));
-    if ((type & ApplyToFillTargetType) && svgStyle->hasFill()) {
-        painter->setBrush(brush);
-        context->setFillRule(svgStyle->fillRule());
-    }
-
-    if ((type & ApplyToStrokeTargetType) && svgStyle->hasStroke()) {
-        QPen pen;
-        pen.setBrush(brush);
-        painter->setPen(pen);
-        applyStrokeStyleToContext(context, style, object);
-    }
-
-    return true;
-}
-
-void SVGPaintServerPattern::teardown(GraphicsContext*& context, const RenderObject*, SVGPaintTargetType, bool) const
-{
-    context->restore();
-}
-
-} // namespace WebCore
-
-#endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGPaintServerQt.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGPaintServerQt.cpp
deleted file mode 100644
index 801201b82e..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGPaintServerQt.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
-    Copyright (C) 2006 Nikolas Zimmermann <wildfox@kde.org>
-    Copyright (C) 2008 Holger Hans Peter Freyther
-
-    This file is part of the KDE project
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SVGPaintServer.h"
-
-#include "GraphicsContext.h"
-#include "SVGRenderStyle.h"
-#include "RenderObject.h"
-
-#include <QPainter>
-#include <QVector>
-
-namespace WebCore {
-
-void SVGPaintServer::draw(GraphicsContext*& context, const RenderObject* path, SVGPaintTargetType type) const
-{
-    if (!setup(context, path, type))
-        return;
-
-    renderPath(context, path, type);
-    teardown(context, path, type);
-}
-
-void SVGPaintServer::teardown(GraphicsContext*&, const RenderObject*, SVGPaintTargetType, bool isPaintingText) const
-{
-    // no-op
-}
-
-void SVGPaintServer::renderPath(GraphicsContext*& context, const RenderObject* path, SVGPaintTargetType type) const
-{
-    RenderStyle* renderStyle = path ? path->style(): 0;
-
-    QPainter* painter(context ? context->platformContext() : 0);
-    Q_ASSERT(painter);
-
-    QPainterPath* painterPath(context ? context->currentPath() : 0);
-    Q_ASSERT(painterPath);
-
-    if ((type & ApplyToFillTargetType) && (!renderStyle || renderStyle->svgStyle()->hasFill()))
-        painter->fillPath(*painterPath, painter->brush());
-
-    if ((type & ApplyToStrokeTargetType) && (!renderStyle || renderStyle->svgStyle()->hasStroke()))
-        painter->strokePath(*painterPath, painter->pen());
-}
-
-} // namespace WebCore
-
-#endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGResourceFilterQt.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGResourceFilterQt.cpp
deleted file mode 100644
index cbf90cd0d0..0000000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/qt/SVGResourceFilterQt.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
-    Copyright (C) 2006 Nikolas Zimmermann <wildfox@kde.org>
-
-    This file is part of the KDE project
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "SVGResourceFilter.h"
-#include "NotImplemented.h"
-
-namespace WebCore {
-
-SVGResourceFilterPlatformData* SVGResourceFilter::createPlatformData()
-{
-    notImplemented();
-    return 0;
-}
-
-void SVGResourceFilter::prepareFilter(GraphicsContext*&, const FloatRect&)
-{
-    notImplemented();
-}
-
-void SVGResourceFilter::applyFilter(GraphicsContext*&, const FloatRect&)
-{
-    notImplemented();
-}
-
-} // namespace WebCore
-
-#endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/svgattrs.in b/src/3rdparty/webkit/WebCore/svg/svgattrs.in
index f1bd66bc58..1ab5b064aa 100644
--- a/src/3rdparty/webkit/WebCore/svg/svgattrs.in
+++ b/src/3rdparty/webkit/WebCore/svg/svgattrs.in
@@ -1,8 +1,8 @@
 namespace="SVG"
 namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
-attrsNullNamespace="1"
-exportStrings="1"
+attrsNullNamespace
+exportStrings
 
 accent-height
 accumulate
diff --git a/src/3rdparty/webkit/WebCore/svg/svgtags.in b/src/3rdparty/webkit/WebCore/svg/svgtags.in
index ea6ee9dc22..6ac430d071 100644
--- a/src/3rdparty/webkit/WebCore/svg/svgtags.in
+++ b/src/3rdparty/webkit/WebCore/svg/svgtags.in
@@ -1,7 +1,7 @@
 namespace="SVG"
 namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
-exportStrings="1"
+exportStrings
 
 a
 #if ENABLE_SVG_FONTS
@@ -30,7 +30,7 @@ definition_src
 defs
 desc
 ellipse
-#if ENABLE_SVG_FILTERS
+#if ENABLE_FILTERS
 feBlend
 feColorMatrix
 feComponentTransfer
@@ -98,9 +98,9 @@ polygon
 polyline
 radialGradient
 rect
-script constructorNeedsCreatedByParser=1
+script constructorNeedsCreatedByParser
 stop
-style constructorNeedsCreatedByParser=1
+style constructorNeedsCreatedByParser
 svg interfaceName=SVGSVGElement
 switch
 symbol
diff --git a/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in b/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in
index f91fb97b21..2e4890378d 100644
--- a/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in
+++ b/src/3rdparty/webkit/WebCore/svg/xlinkattrs.in
@@ -1,6 +1,6 @@
 namespace="XLink"
 namespaceURI="http://www.w3.org/1999/xlink"
-exportStrings="1"
+exportStrings
 
 actuate
 arcrole
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
index b3a8ecc37e..5fbeac63d9 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
@@ -37,8 +37,9 @@
 #include "FrameLoader.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
-#include "RenderFlow.h"
+#include "RenderBox.h"
 #include "WMLNames.h"
 
 namespace WebCore {
@@ -56,7 +57,7 @@ void WMLAElement::parseMappedAttribute(MappedAttribute* attr)
         bool wasLink = isLink();
         setIsLink(!attr->isNull());
         if (wasLink != isLink())
-            setChanged();
+            setNeedsStyleRecalc();
         if (isLink() && document()->isDNSPrefetchEnabled()) {
             String value = attr->value();
             if (protocolIs(value, "http") || protocolIs(value, "https") || value.startsWith("//"))
@@ -101,12 +102,14 @@ bool WMLAElement::isKeyboardFocusable(KeyboardEvent* event) const
     if (!document()->frame()->eventHandler()->tabsToLinks(event))
         return false;
 
+    if (!renderer() || !renderer()->isBoxModelObject())
+        return false;
+
     // Before calling absoluteRects, check for the common case where the renderer
-    // or one of the continuations is non-empty, since this is a faster check and
-    // almost always returns true.
-    for (RenderObject* r = renderer(); r; r = r->continuation())
-        if (r->width() > 0 && r->height() > 0)
-            return true;
+    // is non-empty, since this is a faster check and almost always returns true.
+    RenderBoxModelObject* box = toRenderBoxModelObject(renderer());
+    if (!box->borderBoundingBox().isEmpty())
+        return true;
 
     Vector<IntRect> rects;
     FloatPoint absPos = renderer()->localToAbsolute();
@@ -148,7 +151,7 @@ void WMLAElement::defaultEventHandler(Event* event)
  
         if (!event->defaultPrevented() && document()->frame()) {
             KURL url = document()->completeURL(parseURL(getAttribute(HTMLNames::hrefAttr)));
-            document()->frame()->loader()->urlSelected(url, target(), event, false, true);
+            document()->frame()->loader()->urlSelected(url, target(), event, false, false, true);
         }
 
         event->setDefaultHandled();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp
index 7668c74848..db0ab6729d 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(WML)
 #include "WMLAccessElement.h"
 
+#include "MappedAttribute.h"
 #include "WMLDocument.h"
 #include "WMLNames.h"
 #include "WMLVariables.h"
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAttributeNames.in b/src/3rdparty/webkit/WebCore/wml/WMLAttributeNames.in
index 9c0e8c5448..e2711fb880 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAttributeNames.in
@@ -1,7 +1,7 @@
 namespace="WML"
 namespaceURI="http://www.wapforum.org/DTD/wml_1.1.xml"
 guardFactoryWith="ENABLE(WML)"
-attrsNullNamespace="1"
+attrsNullNamespace
 
 cache_control
 columns
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLBRElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLBRElement.cpp
index 7bd63602d4..035619f65f 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLBRElement.cpp
@@ -30,6 +30,7 @@
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderBR.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
index a2555a497e..c8e92afaf9 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,10 +26,12 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "RenderStyle.h"
 #include "WMLDocument.h"
 #include "WMLDoElement.h"
+#include "WMLInputElement.h"
 #include "WMLIntrinsicEventHandler.h"
 #include "WMLNames.h"
 #include "WMLTemplateElement.h"
@@ -41,13 +43,14 @@ namespace WebCore {
 using namespace WMLNames;
 
 WMLCardElement::WMLCardElement(const QualifiedName& tagName, Document* doc)
-    : WMLEventHandlingElement(tagName, doc)
+    : WMLElement(tagName, doc)
     , m_isNewContext(false)
     , m_isOrdered(false)
     , m_isVisible(false)
     , m_eventTimer(0)
     , m_template(0)
 {
+    ASSERT(hasTagName(cardTag));
 }
 
 WMLCardElement::~WMLCardElement()
@@ -162,16 +165,18 @@ void WMLCardElement::handleIntrinsicEventIfNeeded()
     if (m_eventTimer)
         m_eventTimer->start();
 
-    // FIXME: Initialize input/select  elements in this card
-    /*
-    Node* node = this;
-    while (node = node->traverseNextNode()) {
+    // FIXME: Initialize select elements in this card
+    for (Node* node = traverseNextNode(); node != 0; node = node->traverseNextNode()) {
+        if (!node->isElementNode())
+            continue;
+
         if (node->hasTagName(inputTag))
-            static_cast<WMLInputElement*>(node)->init();
+            static_cast<WMLInputElement*>(node)->initialize();
+        /*
         else if (node->hasTagName(selectTag))
             static_cast<WMLSelectElement*>(node)->selectInitialOptions();
+        */
     }
-    */
 }
 
 void WMLCardElement::handleDeckLevelTaskOverridesIfNeeded()
@@ -216,7 +221,7 @@ void WMLCardElement::parseMappedAttribute(MappedAttribute* attr)
     else if (attr->name() == orderedAttr)
         m_isOrdered = (attr->value() == "true");
     else {
-        WMLEventHandlingElement::parseMappedAttribute(attr);
+        WMLElement::parseMappedAttribute(attr);
         return;
     }
 
@@ -232,7 +237,7 @@ void WMLCardElement::parseMappedAttribute(MappedAttribute* attr)
 
 void WMLCardElement::insertedIntoDocument()
 {
-    WMLEventHandlingElement::insertedIntoDocument();
+    WMLElement::insertedIntoDocument();
 
     // The first card inserted into a document, is visible by default.
     if (!m_isVisible) {
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
index 5bc763a1fd..972961e59e 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,7 +31,7 @@ namespace WebCore {
 class WMLTemplateElement;
 class WMLTimerElement;
 
-class WMLCardElement : public WMLEventHandlingElement {
+class WMLCardElement : public WMLElement, public WMLEventHandlingElement {
 public:
     WMLCardElement(const QualifiedName&, Document*);
     virtual ~WMLCardElement();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
index 8739e5c79c..916bc6ec4c 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
@@ -1,5 +1,5 @@
 /**
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,6 +27,7 @@
 #include "EventNames.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderButton.h"
 #include "WMLCardElement.h"
@@ -119,11 +120,8 @@ void WMLDoElement::insertedIntoDocument()
     if (!parent || !parent->isWMLElement())
         return;
 
-    WMLElement* parentElement = static_cast<WMLElement*>(parent);
-    if (!parentElement->isWMLEventHandlingElement())
-        return;
-
-    static_cast<WMLEventHandlingElement*>(parentElement)->registerDoElement(this);
+    if (WMLEventHandlingElement* eventHandlingElement = toWMLEventHandlingElement(static_cast<WMLElement*>(parent)))
+        eventHandlingElement->registerDoElement(this, document());
 }
 
 RenderObject* WMLDoElement::createRenderer(RenderArena* arena, RenderStyle* style)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
index 36c436fb8a..7f73848b03 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
@@ -61,6 +61,12 @@ void WMLDocument::finishedParsing()
     // Remember that we'e successfully entered the deck
     wmlPageState->setNeedCheckDeckAccess(false);
 
+    initialize();
+    Document::finishedParsing();
+}
+
+void WMLDocument::initialize()
+{
     // Notify the existance of templates to all cards of the current deck
     WMLTemplateElement::registerTemplatesInDocument(this);
 
@@ -77,8 +83,6 @@ void WMLDocument::finishedParsing()
 
     // Handle card-level intrinsic event
     card->handleIntrinsicEventIfNeeded();
-
-    Document::finishedParsing();
 }
 
 WMLPageState* wmlPageStateForDocument(Document* doc)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDocument.h b/src/3rdparty/webkit/WebCore/wml/WMLDocument.h
index d7eb8b2860..91890850f7 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDocument.h
@@ -40,6 +40,8 @@ public:
     virtual bool isWMLDocument() const { return true; }
     virtual void finishedParsing();
 
+    void initialize();
+
 private:
     WMLDocument(Frame*);
 };
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
index c88c5d35ac..e818f9d029 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
@@ -25,6 +25,7 @@
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "WMLErrorHandling.h"
 #include "WMLNames.h"
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.h b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
index e5421da610..61bd98f408 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,7 +32,6 @@ public:
     WMLElement(const QualifiedName& tagName, Document*);
 
     virtual bool isWMLElement() const { return true; }
-    virtual bool isWMLEventHandlingElement() const { return false; }
     virtual bool isWMLTaskElement() const { return false; }
 
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp
index 69b2f8e47a..28489853aa 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp
@@ -1,5 +1,5 @@
 /**
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,17 +23,19 @@
 #if ENABLE(WML)
 #include "WMLEventHandlingElement.h"
 
+#include "WMLCardElement.h"
 #include "WMLDoElement.h"
 #include "WMLIntrinsicEventHandler.h"
+#include "WMLOptionElement.h"
 #include "WMLTaskElement.h"
+#include "WMLTemplateElement.h"
 #include "WMLNames.h"
 
 namespace WebCore {
 
 using namespace WMLNames;
 
-WMLEventHandlingElement::WMLEventHandlingElement(const QualifiedName& tagName, Document* doc)
-    : WMLElement(tagName, doc)
+WMLEventHandlingElement::WMLEventHandlingElement()
 {
 }
 
@@ -47,14 +49,14 @@ void WMLEventHandlingElement::createEventHandlerIfNeeded()
         m_eventHandler.set(new WMLIntrinsicEventHandler);
 }
 
-void WMLEventHandlingElement::registerDoElement(WMLDoElement* doElement)
+void WMLEventHandlingElement::registerDoElement(WMLDoElement* doElement, Document* document)
 {
     Vector<WMLDoElement*>::iterator it = m_doElements.begin();
     Vector<WMLDoElement*>::iterator end = m_doElements.end();
 
     for (; it != end; ++it) {
         if ((*it)->name() == doElement->name()) {
-            reportWMLError(document(), WMLErrorDuplicatedDoElement);
+            reportWMLError(document, WMLErrorDuplicatedDoElement);
             return;
         }
     }
@@ -63,6 +65,21 @@ void WMLEventHandlingElement::registerDoElement(WMLDoElement* doElement)
     doElement->setActive(true);
 }
 
+WMLEventHandlingElement* toWMLEventHandlingElement(WMLElement* element)
+{
+    if (!element->isWMLElement())
+        return 0;
+
+    if (element->hasTagName(cardTag))
+        return static_cast<WMLCardElement*>(element);
+    else if (element->hasTagName(optionTag))
+        return static_cast<WMLOptionElement*>(element);
+    else if (element->hasTagName(templateTag))
+        return static_cast<WMLTemplateElement*>(element);
+
+    return 0;
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h
index cb66e538fb..92ae2890aa 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h
@@ -1,5 +1,5 @@
 /**
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,7 +22,6 @@
 #define WMLEventHandlingElement_h
 
 #if ENABLE(WML)
-#include "WMLElement.h"
 #include "WMLIntrinsicEventHandler.h"
 
 #include <wtf/OwnPtr.h>
@@ -30,26 +29,27 @@
 
 namespace WebCore {
 
+class WMLElement;
 class WMLDoElement;
 
-class WMLEventHandlingElement : public WMLElement {
+class WMLEventHandlingElement {
 public:
-    WMLEventHandlingElement(const QualifiedName& tagName, Document*);
-    virtual ~WMLEventHandlingElement();
-
-    virtual bool isWMLEventHandlingElement() const { return true; }
+    WMLEventHandlingElement();
+    ~WMLEventHandlingElement();
 
     WMLIntrinsicEventHandler* eventHandler() const { return m_eventHandler.get(); }
     void createEventHandlerIfNeeded();
 
     Vector<WMLDoElement*>& doElements() { return m_doElements; }
-    void registerDoElement(WMLDoElement*);
+    void registerDoElement(WMLDoElement*, Document*);
 
 private:
     OwnPtr<WMLIntrinsicEventHandler> m_eventHandler;
     Vector<WMLDoElement*> m_doElements;
 };
 
+WMLEventHandlingElement* toWMLEventHandlingElement(WMLElement*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
index d32f9b178e..8146375241 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
@@ -24,6 +24,7 @@
 #include "WMLFieldSetElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderFieldset.h"
 #include "Text.h"
 #include "WMLElementFactory.h"
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.cpp
new file mode 100644
index 0000000000..f849ac8e64
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.cpp
@@ -0,0 +1,80 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WML)
+#include "WMLFormControlElement.h"
+
+#include "RenderBox.h"
+#include "RenderObject.h"
+#include "RenderStyle.h"
+
+namespace WebCore {
+
+WMLFormControlElement::WMLFormControlElement(const QualifiedName& tagName, Document* document)
+    : WMLElement(tagName, document)
+    , m_valueMatchesRenderer(false)
+{
+}
+
+WMLFormControlElement::~WMLFormControlElement()
+{
+}
+
+bool WMLFormControlElement::isFocusable() const
+{
+    if (!renderer() || !renderer()->isBox())
+        return false;
+
+    if (toRenderBox(renderer())->size().isEmpty())
+        return false;
+
+    if (RenderStyle* style = renderer()->style()) {
+        if (style->visibility() != VISIBLE)
+            return false;
+    }
+
+    return true;
+}
+
+void WMLFormControlElement::attach()
+{
+    ASSERT(!attached());
+    WMLElement::attach();
+
+    // The call to updateFromElement() needs to go after the call through
+    // to the base class's attach() because that can sometimes do a close
+    // on the renderer.
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void WMLFormControlElement::recalcStyle(StyleChange change)
+{
+    WMLElement::recalcStyle(change);
+
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.h b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.h
new file mode 100644
index 0000000000..dde86ed33b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.h
@@ -0,0 +1,53 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WMLFormControlElement_h
+#define WMLFormControlElement_h
+
+#if ENABLE(WML)
+#include "WMLElement.h"
+
+namespace WebCore {
+
+class WMLFormControlElement : public WMLElement {
+public:
+    WMLFormControlElement(const QualifiedName&, Document*);
+    virtual ~WMLFormControlElement();
+
+    virtual bool isFormControlElement() const { return true; }
+    virtual bool isReadOnlyFormControl() const { return false; }
+    virtual bool isTextFormControl() const { return false; }
+
+    virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
+    virtual void setFormControlValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
+
+    virtual bool isFocusable() const;
+
+    virtual void attach();
+    virtual void recalcStyle(StyleChange);
+
+private:
+    bool m_valueMatchesRenderer;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp
index 5ecf495838..7293e66844 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp
@@ -28,6 +28,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "ResourceRequest.h"
 #include "TextEncoding.h"
 #include "WMLCardElement.h"
@@ -64,7 +65,7 @@ void WMLGoElement::parseMappedAttribute(MappedAttribute* attr)
         WMLTaskElement::parseMappedAttribute(attr);
 }
 
-void WMLGoElement::executeTask(Event* event)
+void WMLGoElement::executeTask(Event*)
 {
     Document* doc = document();
     WMLPageState* pageState = wmlPageStateForDocument(doc);
@@ -131,7 +132,7 @@ void WMLGoElement::executeTask(Event* event)
             request.setCachePolicy(ReloadIgnoringCacheData);
     }
 
-    loader->load(request);
+    loader->load(request, false);
 }
 
 void WMLGoElement::preparePOSTRequest(ResourceRequest& request, bool inSameDeck, const String& cacheControl)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
index 05ed9a0b4c..d47868a446 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
@@ -27,6 +27,7 @@
 #include "CSSValueKeywords.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "WMLNames.h"
 #include "WMLVariables.h"
@@ -70,7 +71,7 @@ void WMLImageElement::parseMappedAttribute(MappedAttribute* attr)
 
     if (attrName == HTMLNames::altAttr) {
         if (renderer() && renderer()->isImage())
-            static_cast<RenderImage*>(renderer())->updateAltText();
+            toRenderImage(renderer())->updateAltText();
     } else if (attrName == HTMLNames::srcAttr || attrName == localsrcAttr)
         m_imageLoader.updateFromElementIgnoringPreviousError();
     else if (attrName == HTMLNames::widthAttr)
@@ -94,7 +95,7 @@ void WMLImageElement::attach()
     WMLElement::attach();
 
     if (renderer() && renderer()->isImage()) {
-        RenderImage* imageObj = static_cast<RenderImage*>(renderer());
+        RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLImageLoader.cpp b/src/3rdparty/webkit/WebCore/wml/WMLImageLoader.cpp
index a1a020d97f..c77b5119a2 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLImageLoader.cpp
@@ -45,10 +45,6 @@ WMLImageLoader::~WMLImageLoader()
 void WMLImageLoader::dispatchLoadEvent()
 {
     // WML doesn't fire any events.
-    if (haveFiredLoadEvent())
-        return;
-
-    setHaveFiredLoadEvent(true);
 }
 
 String WMLImageLoader::sourceURI(const AtomicString& attr) const
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
new file mode 100644
index 0000000000..cb824d1e5a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
@@ -0,0 +1,507 @@
+/**
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WML)
+#include "WMLInputElement.h"
+
+#include "EventNames.h"
+#include "FormDataList.h"
+#include "Frame.h"
+#include "HTMLNames.h"
+#include "KeyboardEvent.h"
+#include "MappedAttribute.h"
+#include "RenderTextControlSingleLine.h"
+#include "TextEvent.h"
+#include "WMLDocument.h"
+#include "WMLNames.h"
+#include "WMLPageState.h"
+
+namespace WebCore {
+
+WMLInputElement::WMLInputElement(const QualifiedName& tagName, Document* doc)
+    : WMLFormControlElement(tagName, doc)
+    , m_isPasswordField(false)
+    , m_isEmptyOk(false)
+    , m_numOfCharsAllowedByMask(0)
+{
+}
+
+WMLInputElement::~WMLInputElement()
+{
+    if (m_isPasswordField)
+        document()->unregisterForDocumentActivationCallbacks(this);
+}
+
+static const AtomicString& formatCodes()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, codes, ("AaNnXxMm"));
+    return codes;
+}
+
+bool WMLInputElement::isKeyboardFocusable(KeyboardEvent*) const
+{
+    return WMLFormControlElement::isFocusable();
+}
+
+bool WMLInputElement::isMouseFocusable() const
+{
+    return WMLFormControlElement::isFocusable();
+}
+
+void WMLInputElement::dispatchFocusEvent()
+{
+    InputElement::dispatchFocusEvent(m_data, this, this);
+    WMLElement::dispatchFocusEvent();
+}
+
+void WMLInputElement::dispatchBlurEvent()
+{
+    // Firstly check if it is allowed to leave this input field
+    String val = value();
+    if ((!m_isEmptyOk && val.isEmpty()) || !isConformedToInputMask(val)) {
+        updateFocusAppearance(true);
+        return;
+    }
+
+    // update the name variable of WML input elmenet
+    String nameVariable = formControlName();
+    if (!nameVariable.isEmpty())
+        wmlPageStateForDocument(document())->storeVariable(nameVariable, val); 
+
+    InputElement::dispatchBlurEvent(m_data, this, this);
+    WMLElement::dispatchBlurEvent();
+}
+
+void WMLInputElement::updateFocusAppearance(bool restorePreviousSelection)
+{
+    InputElement::updateFocusAppearance(m_data, this, this, restorePreviousSelection);
+}
+
+void WMLInputElement::aboutToUnload()
+{
+    InputElement::aboutToUnload(this, this);
+}
+
+int WMLInputElement::size() const
+{
+    return m_data.size();
+}
+
+const AtomicString& WMLInputElement::formControlType() const
+{
+    // needs to be lowercase according to DOM spec
+    if (m_isPasswordField) {
+        DEFINE_STATIC_LOCAL(const AtomicString, password, ("password"));
+        return password;
+    }
+
+    DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
+    return text;
+}
+
+const AtomicString& WMLInputElement::formControlName() const
+{
+    return m_data.name();
+}
+
+String WMLInputElement::value() const
+{
+    String value = m_data.value();
+    if (value.isNull())
+        value = constrainValue(getAttribute(HTMLNames::valueAttr));
+
+    return value;
+}
+
+void WMLInputElement::setValue(const String& value)
+{
+    InputElement::updatePlaceholderVisibility(m_data, this, this);
+    setFormControlValueMatchesRenderer(false);
+    m_data.setValue(constrainValue(value));
+    if (inDocument())
+        document()->updateStyleIfNeeded();
+    if (renderer())
+        renderer()->updateFromElement();
+    setNeedsStyleRecalc();
+
+    unsigned max = m_data.value().length();
+    if (document()->focusedNode() == this)
+        InputElement::updateSelectionRange(this, this, max, max);
+    else
+        cacheSelection(max, max);
+
+    InputElement::notifyFormStateChanged(this);
+}
+
+void WMLInputElement::setValueFromRenderer(const String& value)
+{
+    InputElement::setValueFromRenderer(m_data, this, this, value);
+}
+
+bool WMLInputElement::saveFormControlState(String& result) const
+{
+    if (m_isPasswordField)
+        return false;
+
+    result = value();
+    return true;
+}
+
+void WMLInputElement::restoreFormControlState(const String& state)
+{
+    ASSERT(!m_isPasswordField); // should never save/restore password fields
+    setValue(state);
+}
+
+void WMLInputElement::select()
+{
+    if (RenderTextControl* r = toRenderTextControl(renderer()))
+        r->select();
+}
+
+void WMLInputElement::accessKeyAction(bool)
+{
+    // should never restore previous selection here
+    focus(false);
+}
+
+void WMLInputElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    if (attr->name() == HTMLNames::nameAttr)
+        m_data.setName(parseValueForbiddingVariableReferences(attr->value()));
+    else if (attr->name() == HTMLNames::typeAttr) {
+        String type = parseValueForbiddingVariableReferences(attr->value());
+        m_isPasswordField = (type == "password");
+    } else if (attr->name() == HTMLNames::valueAttr) {
+        // We only need to setChanged if the form is looking at the default value right now.
+        if (m_data.value().isNull())
+            setNeedsStyleRecalc();
+        setFormControlValueMatchesRenderer(false);
+    } else if (attr->name() == HTMLNames::maxlengthAttr)
+        InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
+    else if (attr->name() == HTMLNames::sizeAttr)
+        InputElement::parseSizeAttribute(m_data, this, attr);
+    else if (attr->name() == WMLNames::formatAttr)
+        m_formatMask = validateInputMask(parseValueForbiddingVariableReferences(attr->value()));
+    else if (attr->name() == WMLNames::emptyokAttr)
+        m_isEmptyOk = (attr->value() == "true");
+    else
+        WMLElement::parseMappedAttribute(attr);
+
+    // FIXME: Handle 'accesskey' attribute
+    // FIXME: Handle 'tabindex' attribute
+    // FIXME: Handle 'title' attribute
+}
+
+void WMLInputElement::copyNonAttributeProperties(const Element* source)
+{
+    const WMLInputElement* sourceElement = static_cast<const WMLInputElement*>(source);
+    m_data.setValue(sourceElement->m_data.value());
+    WMLElement::copyNonAttributeProperties(source);
+}
+
+RenderObject* WMLInputElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderTextControlSingleLine(this);
+}
+
+void WMLInputElement::detach()
+{
+    WMLElement::detach();
+    setFormControlValueMatchesRenderer(false);
+}
+    
+bool WMLInputElement::appendFormData(FormDataList& encoding, bool)
+{
+    if (formControlName().isEmpty())
+        return false;
+
+    encoding.appendData(formControlName(), value());
+    return true;
+}
+
+void WMLInputElement::reset()
+{
+    setValue(String());
+}
+
+void WMLInputElement::defaultEventHandler(Event* evt)
+{
+    bool clickDefaultFormButton = false;
+
+    if (evt->type() == eventNames().textInputEvent && evt->isTextEvent()) {
+        TextEvent* textEvent = static_cast<TextEvent*>(evt);
+        if (textEvent->data() == "\n")
+            clickDefaultFormButton = true;
+        else if (renderer() && !isConformedToInputMask(textEvent->data()[0], toRenderTextControl(renderer())->text().length() + 1))
+            // If the inputed char doesn't conform to the input mask, stop handling 
+            return;
+    }
+
+    if (evt->type() == eventNames().keydownEvent && evt->isKeyboardEvent() && focused() && document()->frame()
+        && document()->frame()->doTextFieldCommandFromEvent(this, static_cast<KeyboardEvent*>(evt))) {
+        evt->setDefaultHandled();
+        return;
+    }
+    
+    // Let the key handling done in EventTargetNode take precedence over the event handling here for editable text fields
+    if (!clickDefaultFormButton) {
+        WMLElement::defaultEventHandler(evt);
+        if (evt->defaultHandled())
+            return;
+    }
+
+    // Use key press event here since sending simulated mouse events
+    // on key down blocks the proper sending of the key press event.
+    if (evt->type() == eventNames().keypressEvent && evt->isKeyboardEvent()) {
+        // Simulate mouse click on the default form button for enter for these types of elements.
+        if (static_cast<KeyboardEvent*>(evt)->charCode() == '\r')
+            clickDefaultFormButton = true;
+    }
+
+    if (clickDefaultFormButton) {
+        // Fire onChange for text fields.
+        RenderObject* r = renderer();
+        if (r && toRenderTextControl(r)->isEdited()) {
+            dispatchEvent(eventNames().changeEvent, true, false);
+            
+            // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
+            r = renderer();
+            if (r)
+                toRenderTextControl(r)->setEdited(false);
+        }
+
+        evt->setDefaultHandled();
+        return;
+    }
+
+    if (evt->isBeforeTextInsertedEvent())
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
+
+    if (renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
+        static_cast<RenderTextControlSingleLine*>(renderer())->forwardEvent(evt);
+}
+
+void WMLInputElement::cacheSelection(int start, int end)
+{
+    m_data.setCachedSelectionStart(start);
+    m_data.setCachedSelectionEnd(end);
+}
+
+String WMLInputElement::constrainValue(const String& proposedValue) const
+{
+    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
+}
+
+void WMLInputElement::documentDidBecomeActive()
+{
+    ASSERT(m_isPasswordField);
+    reset();
+}
+
+bool WMLInputElement::placeholderShouldBeVisible() const
+{
+    return m_data.placeholderShouldBeVisible();
+}
+
+void WMLInputElement::willMoveToNewOwnerDocument()
+{
+    // Always unregister for cache callbacks when leaving a document, even if we would otherwise like to be registered
+    if (m_isPasswordField)
+        document()->unregisterForDocumentActivationCallbacks(this);
+
+    WMLElement::willMoveToNewOwnerDocument();
+}
+
+void WMLInputElement::didMoveToNewOwnerDocument()
+{
+    if (m_isPasswordField)
+        document()->registerForDocumentActivationCallbacks(this);
+
+    WMLElement::didMoveToNewOwnerDocument();
+}
+
+void WMLInputElement::initialize()
+{
+    String nameVariable = formControlName();
+    String variableValue;
+    WMLPageState* pageSate = wmlPageStateForDocument(document()); 
+    ASSERT(pageSate);
+    if (!nameVariable.isEmpty())
+        variableValue = pageSate->getVariable(nameVariable);
+
+    if (variableValue.isEmpty() || !isConformedToInputMask(variableValue)) {
+        String val = value();
+        if (isConformedToInputMask(val))
+            variableValue = val;
+        else
+            variableValue = "";
+ 
+        pageSate->storeVariable(nameVariable, variableValue);
+    }
+    setValue(variableValue);
+ 
+    if (!hasAttribute(WMLNames::emptyokAttr)) {
+        if (m_formatMask.isEmpty() || 
+            // check if the format codes is just "*f"
+           (m_formatMask.length() == 2 && m_formatMask[0] == '*' && formatCodes().find(m_formatMask[1]) != -1))
+            m_isEmptyOk = true;
+    }
+}
+
+String WMLInputElement::validateInputMask(const String& inputMask)
+{
+    bool isValid = true;
+    bool hasWildcard = false;
+    unsigned escapeCharCount = 0;
+    unsigned maskLength = inputMask.length();
+    UChar formatCode;
+ 
+    for (unsigned i = 0; i < maskLength; ++i) {
+        formatCode = inputMask[i];
+        if (formatCodes().find(formatCode) == -1) {
+            if (formatCode == '*' || (WTF::isASCIIDigit(formatCode) && formatCode != '0')) {
+                // validate codes which ends with '*f' or 'nf'
+                formatCode = inputMask[++i];
+                if ((i + 1 != maskLength) || formatCodes().find(formatCode) == -1) {
+                    isValid = false;
+                    break;
+                }
+                hasWildcard = true;
+            } else if (formatCode == '\\') {
+                //skip over the next mask character
+                ++i;
+                ++escapeCharCount;
+            } else {
+                isValid = false;
+                break;
+            }
+        }
+    }
+
+    if (!isValid)
+        return String();
+ 
+    // calculate the number of characters allowed to be entered by input mask
+    m_numOfCharsAllowedByMask = maskLength;
+
+    if (escapeCharCount)
+        m_numOfCharsAllowedByMask -= escapeCharCount;
+
+    if (hasWildcard) {
+        formatCode = inputMask[maskLength - 2];
+        if (formatCode == '*')
+            m_numOfCharsAllowedByMask = m_data.maxLength();
+        else {
+            unsigned leftLen = String(&formatCode).toInt();
+            m_numOfCharsAllowedByMask = leftLen + m_numOfCharsAllowedByMask - 2;
+        }
+    }
+
+    return inputMask;
+}
+
+bool WMLInputElement::isConformedToInputMask(const String& inputChars)
+{
+    for (unsigned i = 0; i < inputChars.length(); ++i)
+        if (!isConformedToInputMask(inputChars[i], i + 1, false))
+            return false;
+
+    return true;
+}
+ 
+bool WMLInputElement::isConformedToInputMask(UChar inChar, unsigned inputCharCount, bool isUserInput)
+{
+    if (m_formatMask.isEmpty())
+        return true;
+ 
+    if (inputCharCount > m_numOfCharsAllowedByMask)
+        return false;
+
+    unsigned maskIndex = 0;
+    if (isUserInput) {
+        unsigned cursorPosition = 0;
+        if (renderer())
+            cursorPosition = toRenderTextControl(renderer())->selectionStart(); 
+        else
+            cursorPosition = m_data.cachedSelectionStart();
+
+        maskIndex = cursorPositionToMaskIndex(cursorPosition);
+    } else
+        maskIndex = cursorPositionToMaskIndex(inputCharCount - 1);
+
+    bool ok = true;
+    UChar mask = m_formatMask[maskIndex];
+    // match the inputed character with input mask
+    switch (mask) {
+    case 'A':
+        ok = !WTF::isASCIIDigit(inChar) && !WTF::isASCIILower(inChar) && WTF::isASCIIPrintable(inChar);
+        break;
+    case 'a':
+        ok = !WTF::isASCIIDigit(inChar) && !WTF::isASCIIUpper(inChar) && WTF::isASCIIPrintable(inChar);
+        break;
+    case 'N':
+        ok = WTF::isASCIIDigit(inChar);
+        break;
+    case 'n':
+        ok = !WTF::isASCIIAlpha(inChar) && WTF::isASCIIPrintable(inChar);
+        break;
+    case 'X':
+        ok = !WTF::isASCIILower(inChar) && WTF::isASCIIPrintable(inChar);
+        break;
+    case 'x':
+        ok = !WTF::isASCIIUpper(inChar) && WTF::isASCIIPrintable(inChar);
+        break;
+    case 'M':
+        ok = WTF::isASCIIPrintable(inChar);
+        break;
+    case 'm':
+        ok = WTF::isASCIIPrintable(inChar);
+        break;
+    default:
+        ok = (mask == inChar);
+        break;
+    }
+
+    return ok;
+}
+
+unsigned WMLInputElement::cursorPositionToMaskIndex(unsigned cursorPosition)
+{
+    UChar mask;
+    int index = -1;
+    do {
+        mask = m_formatMask[++index];
+        if (mask == '\\')
+            ++index;
+        else if (mask == '*' || (WTF::isASCIIDigit(mask) && mask != '0')) {
+            index = m_formatMask.length() - 1;
+            break;
+        }
+    } while (cursorPosition--);
+ 
+    return index;
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
new file mode 100644
index 0000000000..7529968b77
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
@@ -0,0 +1,110 @@
+/**
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WMLInputElement_h
+#define WMLInputElement_h
+
+#if ENABLE(WML)
+#include "WMLFormControlElement.h"
+#include "InputElement.h"
+
+namespace WebCore {
+
+class FormDataList;
+
+class WMLInputElement : public WMLFormControlElement, public InputElement {
+public:
+    WMLInputElement(const QualifiedName& tagName, Document*);
+    virtual ~WMLInputElement();
+
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isMouseFocusable() const;
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+    virtual void updateFocusAppearance(bool restorePreviousSelection);
+    virtual void aboutToUnload();
+
+    virtual bool shouldUseInputMethod() const { return !m_isPasswordField; }
+    virtual bool isChecked() const { return false; }
+    virtual bool isAutofilled() const { return false; }
+    virtual bool isIndeterminate() const { return false; }
+    virtual bool isTextFormControl() const { return true; }
+    virtual bool isRadioButton() const { return false; }
+    virtual bool isTextField() const { return true; }
+    virtual bool isSearchField() const { return false; }
+    virtual bool isInputTypeHidden() const { return false; }
+    virtual bool isPasswordField() const { return m_isPasswordField; }
+    virtual bool searchEventsShouldBeDispatched() const { return false; }
+
+    virtual int size() const;
+    virtual const AtomicString& formControlType() const;
+    virtual const AtomicString& formControlName() const;
+    virtual String value() const;
+    virtual void setValue(const String&);
+    virtual String placeholder() const { return String(); }
+    virtual void setPlaceholder(const String&) { }
+    virtual void setValueFromRenderer(const String&);
+
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
+
+    virtual void select();
+    virtual void accessKeyAction(bool sendToAnyElement);
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual void copyNonAttributeProperties(const Element* source);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual void detach();
+    virtual bool appendFormData(FormDataList&, bool);
+    virtual void reset();
+
+    virtual void defaultEventHandler(Event*);
+    virtual void cacheSelection(int start, int end);
+
+    virtual String constrainValue(const String& proposedValue) const;
+
+    virtual void documentDidBecomeActive();
+    virtual bool placeholderShouldBeVisible() const;
+
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
+
+    bool isConformedToInputMask(const String&);
+    bool isConformedToInputMask(UChar, unsigned, bool isUserInput = true);
+
+private:
+    friend class WMLCardElement;
+    void initialize();
+
+    String validateInputMask(const String&);
+    unsigned cursorPositionToMaskIndex(unsigned);
+
+    InputElementData m_data;
+    bool m_isPasswordField;
+    bool m_isEmptyOk;
+    String m_formatMask;
+    unsigned m_numOfCharsAllowedByMask;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.cpp
index 7decd77096..1464e71cd1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.cpp
@@ -23,8 +23,6 @@
 #if ENABLE(WML)
 #include "WMLInsertedLegendElement.h"
 
-#include "RenderLegend.h"
-
 namespace WebCore {
 
 WMLInsertedLegendElement::WMLInsertedLegendElement(const QualifiedName& tagName, Document* doc)
@@ -36,11 +34,6 @@ WMLInsertedLegendElement::~WMLInsertedLegendElement()
 {
 }
 
-RenderObject* WMLInsertedLegendElement::createRenderer(RenderArena* arena, RenderStyle*)
-{
-    return new (arena) RenderLegend(this);
-}
-
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.h b/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.h
index d758487672..73392ad45c 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInsertedLegendElement.h
@@ -30,8 +30,6 @@ class WMLInsertedLegendElement : public WMLElement {
 public:
     WMLInsertedLegendElement(const QualifiedName& tagName, Document*);
     virtual ~WMLInsertedLegendElement();
-
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLMetaElement.cpp
index 71bbf5191a..81109ae839 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLMetaElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp
index 0460d9fe15..1ba1c18b35 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp
@@ -53,7 +53,7 @@ void WMLNoopElement::insertedIntoDocument()
     if (parent->hasTagName(doTag)) {
         WMLDoElement* doElement = static_cast<WMLDoElement*>(parent);
         doElement->setNoop(true);
-        doElement->setChanged();
+        doElement->setNeedsStyleRecalc();
     } else if (parent->hasTagName(anchorTag))
         reportWMLError(document(), WMLErrorForbiddenTaskInAnchorElement);
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp
index 2e9e519ba9..a8d35a000e 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp
@@ -1,5 +1,5 @@
 /**
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +24,7 @@
 #include "WMLOnEventElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLErrorHandling.h"
 #include "WMLEventHandlingElement.h"
 #include "WMLIntrinsicEventHandler.h"
@@ -71,11 +72,10 @@ void WMLOnEventElement::registerTask(WMLTaskElement* task)
     if (!parent || !parent->isWMLElement())
         return;
 
-    WMLElement* parentElement = static_cast<WMLElement*>(parent);
-    if (!parentElement->isWMLEventHandlingElement())
+    WMLEventHandlingElement* eventHandlingElement = toWMLEventHandlingElement(static_cast<WMLElement*>(parent));
+    if (!eventHandlingElement)
         return;
 
-    WMLEventHandlingElement* eventHandlingElement = static_cast<WMLEventHandlingElement*>(parentElement);
     eventHandlingElement->createEventHandlerIfNeeded();
 
     RefPtr<WMLIntrinsicEvent> event = WMLIntrinsicEvent::createWithTask(task);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
new file mode 100644
index 0000000000..d70731cf4d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
@@ -0,0 +1,175 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WML)
+#include "WMLOptGroupElement.h"
+
+#include "Document.h"
+#include "MappedAttribute.h"
+#include "HTMLNames.h"
+#include "NodeRenderStyle.h"
+#include "RenderStyle.h"
+#include "WMLNames.h"
+#include "WMLSelectElement.h"
+
+namespace WebCore {
+
+using namespace WMLNames;
+
+WMLOptGroupElement::WMLOptGroupElement(const QualifiedName& tagName, Document* doc)
+    : WMLFormControlElement(tagName, doc)
+{
+}
+
+WMLOptGroupElement::~WMLOptGroupElement()
+{
+}
+
+const AtomicString& WMLOptGroupElement::formControlType() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
+    return optgroup;
+}
+
+bool WMLOptGroupElement::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
+{
+    bool result = WMLFormControlElement::insertBefore(newChild, refChild, ec, shouldLazyAttach);
+    if (result)
+        recalcSelectOptions();
+    return result;
+}
+
+bool WMLOptGroupElement::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode& ec, bool shouldLazyAttach)
+{
+    bool result = WMLFormControlElement::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
+    if (result)
+        recalcSelectOptions();
+    return result;
+}
+
+bool WMLOptGroupElement::removeChild(Node* oldChild, ExceptionCode& ec)
+{
+    bool result = WMLFormControlElement::removeChild(oldChild, ec);
+    if (result)
+        recalcSelectOptions();
+    return result;
+}
+
+bool WMLOptGroupElement::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
+{
+    bool result = WMLFormControlElement::appendChild(newChild, ec, shouldLazyAttach);
+    if (result)
+        recalcSelectOptions();
+    return result;
+}
+
+bool WMLOptGroupElement::removeChildren()
+{
+    bool result = WMLFormControlElement::removeChildren();
+    if (result)
+        recalcSelectOptions();
+    return result;
+}
+
+static inline WMLSelectElement* ownerSelectElement(Element* element)
+{
+    Node* select = element->parentNode();
+    while (select && !select->hasTagName(selectTag))
+        select = select->parentNode();
+
+    if (!select)
+        return 0;
+
+    return static_cast<WMLSelectElement*>(select);
+}
+
+void WMLOptGroupElement::accessKeyAction(bool)
+{
+    WMLSelectElement* select = ownerSelectElement(this);
+    if (!select || select->focused())
+        return;
+
+    // send to the parent to bring focus to the list box
+    select->accessKeyAction(false);
+}
+
+void WMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    recalcSelectOptions();
+    WMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+}
+
+void WMLOptGroupElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    if (attr->name() == HTMLNames::titleAttr) {
+        m_title = parseValueSubstitutingVariableReferences(attr->value());
+        return;
+    }
+
+    WMLFormControlElement::parseMappedAttribute(attr);
+    recalcSelectOptions();
+}
+
+void WMLOptGroupElement::attach()
+{
+    if (parentNode()->renderStyle())
+        setRenderStyle(styleForRenderer());
+    WMLFormControlElement::attach();
+}
+
+void WMLOptGroupElement::detach()
+{
+    m_style.clear();
+    WMLFormControlElement::detach();
+}
+
+void WMLOptGroupElement::setRenderStyle(PassRefPtr<RenderStyle> style)
+{
+    m_style = style;
+}
+
+RenderStyle* WMLOptGroupElement::nonRendererRenderStyle() const
+{
+    return m_style.get();
+}
+
+String WMLOptGroupElement::groupLabelText() const
+{
+    String itemText = document()->displayStringModifiedByEncoding(m_title);
+
+    // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
+    itemText = itemText.stripWhiteSpace();
+    // We want to collapse our whitespace too.  This will match other browsers.
+    itemText = itemText.simplifyWhiteSpace();
+
+    return itemText;
+}
+
+void WMLOptGroupElement::recalcSelectOptions()
+{
+    if (WMLSelectElement* select = ownerSelectElement(this))
+        select->setRecalcListItems();
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
new file mode 100644
index 0000000000..1ba5ac19ff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
@@ -0,0 +1,69 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WMLOptGroupElement_h
+#define WMLOptGroupElement_h
+
+#if ENABLE(WML)
+#include "WMLFormControlElement.h"
+#include "OptionGroupElement.h"
+
+namespace WebCore {
+
+class WMLOptGroupElement : public WMLFormControlElement, public OptionGroupElement {
+public:
+    WMLOptGroupElement(const QualifiedName& tagName, Document*);
+    virtual ~WMLOptGroupElement();
+
+    String title() const { return m_title; }
+
+    virtual const AtomicString& formControlType() const;
+
+    virtual bool rendererIsNeeded(RenderStyle*) { return false; }
+
+    virtual bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
+    virtual bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
+    virtual bool removeChild(Node* child, ExceptionCode&);
+    virtual bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
+    virtual bool removeChildren();
+
+    virtual void accessKeyAction(bool sendToAnyElement);
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual void attach();
+    virtual void detach();
+    virtual void setRenderStyle(PassRefPtr<RenderStyle>);
+
+    virtual String groupLabelText() const;
+
+private:
+    virtual RenderStyle* nonRendererRenderStyle() const;
+    void recalcSelectOptions();
+
+private:
+    String m_title;
+    RefPtr<RenderStyle> m_style;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.cpp
new file mode 100644
index 0000000000..1087134ff0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.cpp
@@ -0,0 +1,163 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WML)
+#include "WMLOptionElement.h"
+
+#include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "NodeRenderStyle.h"
+#include "RenderStyle.h"
+#include "WMLNames.h"
+#include "WMLSelectElement.h"
+
+namespace WebCore {
+
+using namespace WMLNames;
+
+WMLOptionElement::WMLOptionElement(const QualifiedName& tagName, Document* doc)
+    : WMLFormControlElement(tagName, doc)
+{
+}
+
+WMLOptionElement::~WMLOptionElement()
+{
+}
+
+const AtomicString& WMLOptionElement::formControlType() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, option, ("option"));
+    return option;
+}
+
+static inline WMLSelectElement* ownerSelectElement(Element* element)
+{
+    Node* select = element->parentNode();
+    while (select && !select->hasTagName(selectTag))
+        select = select->parentNode();
+
+    if (!select)
+        return 0;
+
+    return static_cast<WMLSelectElement*>(select);
+}
+
+void WMLOptionElement::accessKeyAction(bool)
+{
+    if (WMLSelectElement* select = ownerSelectElement(this))
+        select->accessKeySetSelectedIndex(OptionElement::optionIndex(select, this));
+}
+
+void WMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    if (WMLSelectElement* select = ownerSelectElement(this))
+        select->childrenChanged(changedByParser);
+
+    WMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+}
+
+void WMLOptionElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    if (attr->name() == HTMLNames::valueAttr)
+        m_data.setValue(parseValueSubstitutingVariableReferences(attr->value()));
+    else if (attr->name() == HTMLNames::titleAttr)
+        m_data.setLabel(parseValueSubstitutingVariableReferences(attr->value()));
+    else if (attr->name() == onpickAttr) {
+        // Register intrinsic event in card
+        RefPtr<WMLIntrinsicEvent> event = WMLIntrinsicEvent::create(document(), attr->value());
+
+        createEventHandlerIfNeeded();
+        eventHandler()->registerIntrinsicEvent(WMLIntrinsicEventOnPick, event);
+    } else
+        WMLFormControlElement::parseMappedAttribute(attr);
+}
+
+void WMLOptionElement::attach()
+{
+    if (parentNode()->renderStyle())
+        setRenderStyle(styleForRenderer());
+    WMLFormControlElement::attach();
+}
+
+void WMLOptionElement::detach()
+{
+    m_style.clear();
+    WMLFormControlElement::detach();
+}
+
+void WMLOptionElement::setRenderStyle(PassRefPtr<RenderStyle> style)
+{
+    m_style = style;
+}
+
+void WMLOptionElement::insertedIntoDocument()
+{
+    WMLSelectElement* select;
+    if (selected() && (select = ownerSelectElement(this)))
+        select->scrollToSelection();
+
+    WMLFormControlElement::insertedIntoDocument();
+}
+
+bool WMLOptionElement::selected() const
+{
+    return m_data.selected();
+}
+
+void WMLOptionElement::setSelectedState(bool selected)
+{
+    OptionElement::setSelectedState(m_data, this, selected);
+}
+
+String WMLOptionElement::value() const
+{
+    return OptionElement::collectOptionValue(m_data, this);
+}
+
+String WMLOptionElement::text() const
+{
+    return OptionElement::collectOptionText(m_data, this);
+}
+
+String WMLOptionElement::textIndentedToRespectGroupLabel() const
+{
+    return OptionElement::collectOptionTextRespectingGroupLabel(m_data, this);
+}
+
+RenderStyle* WMLOptionElement::nonRendererRenderStyle() const
+{
+    return m_style.get();
+}
+
+void WMLOptionElement::handleIntrinsicEventIfNeeded()
+{
+    WMLIntrinsicEventHandler* eventHandler = this->eventHandler();
+    if (!eventHandler)
+        return;
+
+    if (eventHandler->hasIntrinsicEvent(WMLIntrinsicEventOnPick))
+        eventHandler->triggerIntrinsicEvent(WMLIntrinsicEventOnPick);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.h b/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.h
new file mode 100644
index 0000000000..c34f319ac3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.h
@@ -0,0 +1,69 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WMLOptionElement_h
+#define WMLOptionElement_h
+
+#if ENABLE(WML)
+#include "OptionElement.h"
+#include "WMLFormControlElement.h"
+#include "WMLEventHandlingElement.h"
+
+namespace WebCore {
+
+class WMLOptionElement : public WMLFormControlElement, public WMLEventHandlingElement, public OptionElement {
+public:
+    WMLOptionElement(const QualifiedName& tagName, Document*);
+    virtual ~WMLOptionElement();
+
+    virtual const AtomicString& formControlType() const;
+
+    virtual bool rendererIsNeeded(RenderStyle*) { return false; }
+
+    virtual void accessKeyAction(bool sendToAnyElement);
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual void attach();
+    virtual void detach();
+    virtual void setRenderStyle(PassRefPtr<RenderStyle>);
+
+    virtual void insertedIntoDocument();
+
+    virtual bool selected() const;
+    virtual void setSelectedState(bool);
+
+    virtual String text() const;
+    virtual String textIndentedToRespectGroupLabel() const;
+    virtual String value() const;
+
+private:
+    virtual RenderStyle* nonRendererRenderStyle() const;
+    void handleIntrinsicEventIfNeeded();
+
+private:
+    OptionElementData m_data;
+    RefPtr<RenderStyle> m_style;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPElement.cpp
index 3655b2e041..0cec653580 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPElement.cpp
@@ -30,6 +30,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "WMLNames.h"
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
index 0cc7d425b4..69f61f584e 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
@@ -26,6 +26,7 @@
 #include "CString.h"
 #include "TextEncoding.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLDocument.h"
 #include "WMLGoElement.h"
 #include "WMLNames.h"
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
new file mode 100644
index 0000000000..5b5aed167b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
@@ -0,0 +1,224 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WML)
+#include "WMLSelectElement.h"
+
+#include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "RenderListBox.h"
+#include "RenderMenuList.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+WMLSelectElement::WMLSelectElement(const QualifiedName& tagName, Document* document)
+    : WMLFormControlElement(tagName, document)
+{
+}
+
+WMLSelectElement::~WMLSelectElement()
+{
+}
+
+const AtomicString& WMLSelectElement::formControlType() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, selectMultiple, ("select-multiple"));
+    DEFINE_STATIC_LOCAL(const AtomicString, selectOne, ("select-one"));
+    return m_data.multiple() ? selectMultiple : selectOne;
+}
+
+bool WMLSelectElement::isKeyboardFocusable(KeyboardEvent* event) const
+{
+    if (renderer())
+        return isFocusable();
+
+    return WMLFormControlElement::isKeyboardFocusable(event);
+}
+
+bool WMLSelectElement::isMouseFocusable() const
+{
+    if (renderer())
+        return isFocusable();
+
+    return WMLFormControlElement::isMouseFocusable();
+}
+
+void WMLSelectElement::selectAll()
+{
+    SelectElement::selectAll(m_data, this);
+}
+
+void WMLSelectElement::recalcStyle(StyleChange change)
+{
+    SelectElement::recalcStyle(m_data, this);
+    WMLFormControlElement::recalcStyle(change);
+}
+
+void WMLSelectElement::dispatchFocusEvent()
+{
+    SelectElement::dispatchFocusEvent(m_data, this);
+    WMLFormControlElement::dispatchFocusEvent();
+}
+
+void WMLSelectElement::dispatchBlurEvent()
+{
+    SelectElement::dispatchBlurEvent(m_data, this);
+    WMLFormControlElement::dispatchBlurEvent();
+}
+
+int WMLSelectElement::selectedIndex() const
+{
+    return SelectElement::selectedIndex(m_data, this);
+}
+    
+void WMLSelectElement::setSelectedIndex(int index, bool deselect, bool fireOnChange)
+{
+    SelectElement::setSelectedIndex(m_data, this, index, deselect, fireOnChange);
+}
+
+bool WMLSelectElement::saveFormControlState(String& value) const
+{
+    return SelectElement::saveFormControlState(m_data, this, value);
+}
+
+void WMLSelectElement::restoreFormControlState(const String& state)
+{
+    SelectElement::restoreFormControlState(m_data, this, state);
+}
+
+void WMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    SelectElement::setRecalcListItems(m_data, this);
+    WMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+}
+
+void WMLSelectElement::parseMappedAttribute(MappedAttribute* attr) 
+{
+    if (attr->name() == HTMLNames::multipleAttr)
+        SelectElement::parseMultipleAttribute(m_data, this, attr);
+    else
+        WMLFormControlElement::parseMappedAttribute(attr);
+}
+
+RenderObject* WMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    if (m_data.usesMenuList())
+        return new (arena) RenderMenuList(this);
+    return new (arena) RenderListBox(this);
+}
+
+bool WMLSelectElement::appendFormData(FormDataList& list, bool)
+{
+    return SelectElement::appendFormData(m_data, this, list);
+}
+
+int WMLSelectElement::optionToListIndex(int optionIndex) const
+{
+    return SelectElement::optionToListIndex(m_data, this, optionIndex);
+}
+
+int WMLSelectElement::listToOptionIndex(int listIndex) const
+{
+    return SelectElement::listToOptionIndex(m_data, this, listIndex);
+}
+
+void WMLSelectElement::reset()
+{
+    SelectElement::reset(m_data, this);
+}
+
+void WMLSelectElement::defaultEventHandler(Event* event)
+{
+    SelectElement::defaultEventHandler(m_data, this, event);
+}
+
+void WMLSelectElement::accessKeyAction(bool sendToAnyElement)
+{
+    focus();
+    dispatchSimulatedClick(0, sendToAnyElement);
+}
+
+void WMLSelectElement::setActiveSelectionAnchorIndex(int index)
+{
+    SelectElement::setActiveSelectionAnchorIndex(m_data, this, index);
+}
+    
+void WMLSelectElement::setActiveSelectionEndIndex(int index)
+{
+    SelectElement::setActiveSelectionEndIndex(m_data, index);
+}
+
+void WMLSelectElement::updateListBoxSelection(bool deselectOtherOptions)
+{
+    SelectElement::updateListBoxSelection(m_data, this, deselectOtherOptions);
+}
+
+void WMLSelectElement::listBoxOnChange()
+{
+    SelectElement::listBoxOnChange(m_data, this);
+}
+
+void WMLSelectElement::menuListOnChange()
+{
+    SelectElement::menuListOnChange(m_data, this);
+}
+
+int WMLSelectElement::activeSelectionStartListIndex() const
+{
+    if (m_data.activeSelectionAnchorIndex() >= 0)
+        return m_data.activeSelectionAnchorIndex();
+    return optionToListIndex(selectedIndex());
+}
+
+int WMLSelectElement::activeSelectionEndListIndex() const
+{
+    if (m_data.activeSelectionEndIndex() >= 0)
+        return m_data.activeSelectionEndIndex();
+    return SelectElement::lastSelectedListIndex(m_data, this);
+}
+
+void WMLSelectElement::accessKeySetSelectedIndex(int index)
+{
+    SelectElement::accessKeySetSelectedIndex(m_data, this, index);
+}
+
+void WMLSelectElement::setRecalcListItems()
+{
+    SelectElement::setRecalcListItems(m_data, this);
+}
+
+void WMLSelectElement::scrollToSelection()
+{
+    SelectElement::scrollToSelection(m_data, this);
+}
+
+void WMLSelectElement::insertedIntoTree(bool deep)
+{
+    SelectElement::insertedIntoTree(m_data, this);
+    WMLFormControlElement::insertedIntoTree(deep);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.h b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.h
new file mode 100644
index 0000000000..8d3e0f91aa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.h
@@ -0,0 +1,94 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WMLSelectElement_h
+#define WMLSelectElement_h
+
+#if ENABLE(WML)
+#include "WMLFormControlElement.h"
+#include "SelectElement.h"
+
+namespace WebCore {
+
+class WMLSelectElement : public WMLFormControlElement, public SelectElement {
+public:
+    WMLSelectElement(const QualifiedName&, Document*);
+    virtual ~WMLSelectElement();
+
+    virtual const AtomicString& formControlType() const;
+ 
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isMouseFocusable() const;
+    virtual bool canSelectAll() const { return !m_data.usesMenuList(); }
+    virtual void selectAll();
+
+    virtual void recalcStyle(StyleChange);
+
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+
+    virtual bool canStartSelection() const { return false; }
+
+    virtual int selectedIndex() const;
+    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
+
+    virtual int size() const { return m_data.size(); }
+    virtual bool multiple() const { return m_data.multiple(); }
+
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
+
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool appendFormData(FormDataList&, bool);
+    virtual int optionToListIndex(int optionIndex) const;
+    virtual int listToOptionIndex(int listIndex) const;
+
+    virtual const Vector<Element*>& listItems() const { return m_data.listItems(this); }
+    virtual void reset();
+
+    virtual void defaultEventHandler(Event*);
+    virtual void accessKeyAction(bool sendToAnyElement);
+    virtual void setActiveSelectionAnchorIndex(int index);
+    virtual void setActiveSelectionEndIndex(int index);
+    virtual void updateListBoxSelection(bool deselectOtherOptions);
+    virtual void listBoxOnChange();
+    virtual void menuListOnChange();
+
+    virtual int activeSelectionStartListIndex() const;
+    virtual int activeSelectionEndListIndex() const;
+
+    void accessKeySetSelectedIndex(int);
+    void setRecalcListItems();
+    void scrollToSelection();
+
+private:
+    virtual void insertedIntoTree(bool);
+
+    SelectElementData m_data;
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
index 9bce9443d3..da9a1f4535 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
@@ -24,6 +24,7 @@
 #include "WMLSetvarElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLErrorHandling.h"
 #include "WMLTaskElement.h"
 #include "WMLVariables.h"
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp
index f241f46651..92c7580587 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp
@@ -28,6 +28,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "RenderObject.h"
 #include "Text.h"
@@ -66,7 +67,7 @@ void WMLTableElement::parseMappedAttribute(MappedAttribute* attr)
 
         // Spec: This required attribute specifies the number of columns for the table.
         // The user agent must create a table with exactly the number of columns specified
-        // by the attribute value. It is an error to specify a value of zero (“0”).
+        // by the attribute value. It is an error to specify a value of zero ("0")
         if (!m_columns || !isNumber)
             reportWMLError(document(), WMLErrorInvalidColumnsNumberInTable);
     } else if (attr->name() == HTMLNames::alignAttr)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in b/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in
index 293c60359d..fd7c762cdf 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in
@@ -12,23 +12,24 @@ fieldset interfaceName=WMLFieldSetElement
 go
 head interfaceName=WMLElement
 img interfaceName=WMLImageElement
+input
+#if 0
 # Note: 'insertedLegend' is not an official WML element - internal purpose only!
+#endif
 insertedLegend interfaceName=WMLInsertedLegendElement
 meta
 noop
 onevent interfaceName=WMLOnEventElement
+optgroup interfaceName=WMLOptGroupElement
+option
 p
 postfield
 prev
 refresh
+select
 setvar
 table
 td interfaceName=WMLElement
 template
 timer
 tr interfaceName=WMLElement
-
-#if 0
-# These elements have a corresponding HTML*Element class, that we want to share code with.
-# input, optgroup, option, select
-#endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.cpp
index d0bfa61035..2575c9a3e2 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,6 +23,7 @@
 #if ENABLE(WML)
 #include "WMLTemplateElement.h"
 
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "WMLCardElement.h"
 #include "WMLDocument.h"
@@ -34,7 +35,7 @@ namespace WebCore {
 using namespace WMLNames;
 
 WMLTemplateElement::WMLTemplateElement(const QualifiedName& tagName, Document* doc)
-    : WMLEventHandlingElement(tagName, doc)
+    : WMLElement(tagName, doc)
 {
 }
 
@@ -53,7 +54,7 @@ void WMLTemplateElement::parseMappedAttribute(MappedAttribute* attr)
     else if (attr->name() == ontimerAttr)
         eventType = WMLIntrinsicEventOnTimer;
     else {
-        WMLEventHandlingElement::parseMappedAttribute(attr);
+        WMLElement::parseMappedAttribute(attr);
         return;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.h b/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.h
index 1ba720ea0e..3fc0eda668 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTemplateElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,11 +22,12 @@
 #define WMLTemplateElement_h
 
 #if ENABLE(WML)
+#include "WMLElement.h"
 #include "WMLEventHandlingElement.h"
 
 namespace WebCore {
 
-class WMLTemplateElement : public WMLEventHandlingElement {
+class WMLTemplateElement : public WMLElement, public WMLEventHandlingElement {
 public:
     WMLTemplateElement(const QualifiedName&, Document*);
     virtual ~WMLTemplateElement();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
index 7cd2e50bf0..00c7036c6a 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
@@ -24,6 +24,7 @@
 #include "WMLTimerElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLCardElement.h"
 #include "WMLDocument.h"
 #include "WMLNames.h"
diff --git a/src/3rdparty/webkit/WebCore/workers/GenericWorkerTask.h b/src/3rdparty/webkit/WebCore/workers/GenericWorkerTask.h
new file mode 100644
index 0000000000..96b0e70985
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/GenericWorkerTask.h
@@ -0,0 +1,415 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GenericWorkerTask_h
+#define GenericWorkerTask_h
+
+#if ENABLE(WORKERS)
+
+#include "CrossThreadCopier.h"
+#include "ScriptExecutionContext.h"
+#include <memory>
+#include <wtf/PassRefPtr.h>
+#include <wtf/TypeTraits.h>
+
+namespace WebCore {
+
+    // Traits for the GenericWorkerTask.
+    template<typename T> struct GenericWorkerTaskTraits {
+        typedef const T& ParamType;
+    };
+
+    template<typename T> struct GenericWorkerTaskTraits<T*> {
+        typedef T* ParamType;
+    };
+
+    template<typename T> struct GenericWorkerTaskTraits<std::auto_ptr<T> > {
+        typedef std::auto_ptr<T> ParamType;
+    };
+
+    template<typename T> struct GenericWorkerTaskTraits<PassRefPtr<T> > {
+        typedef PassRefPtr<T> ParamType;
+    };
+
+    template<typename P1, typename MP1>
+    class GenericWorkerTask1 : public ScriptExecutionContext::Task {
+    public:
+        typedef void (*Method)(ScriptExecutionContext*, MP1);
+        typedef GenericWorkerTask1<P1, MP1> GenericWorkerTask;
+        typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
+
+        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1)
+        {
+            return adoptRef(new GenericWorkerTask(method, parameter1));
+        }
+
+    private:
+        GenericWorkerTask1(Method method, Param1 parameter1)
+            : m_method(method)
+            , m_parameter1(parameter1)
+        {
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            (*m_method)(context, m_parameter1);
+        }
+
+    private:
+        Method m_method;
+        P1 m_parameter1;
+    };
+
+    template<typename P1, typename MP1, typename P2, typename MP2>
+    class GenericWorkerTask2 : public ScriptExecutionContext::Task {
+    public:
+        typedef void (*Method)(ScriptExecutionContext*, MP1, MP2);
+        typedef GenericWorkerTask2<P1, MP1, P2, MP2> GenericWorkerTask;
+        typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
+        typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
+
+        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2)
+        {
+            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2));
+        }
+
+    private:
+        GenericWorkerTask2(Method method, Param1 parameter1, Param2 parameter2)
+            : m_method(method)
+            , m_parameter1(parameter1)
+            , m_parameter2(parameter2)
+        {
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            (*m_method)(context, m_parameter1, m_parameter2);
+        }
+
+    private:
+        Method m_method;
+        P1 m_parameter1;
+        P2 m_parameter2;
+    };
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
+    class GenericWorkerTask3 : public ScriptExecutionContext::Task {
+    public:
+        typedef void (*Method)(ScriptExecutionContext*, MP1, MP2, MP3);
+        typedef GenericWorkerTask3<P1, MP1, P2, MP2, P3, MP3> GenericWorkerTask;
+        typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
+        typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
+        typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
+
+        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+        {
+            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3));
+        }
+
+    private:
+        GenericWorkerTask3(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+            : m_method(method)
+            , m_parameter1(parameter1)
+            , m_parameter2(parameter2)
+            , m_parameter3(parameter3)
+        {
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            (*m_method)(context, m_parameter1, m_parameter2, m_parameter3);
+        }
+
+    private:
+        Method m_method;
+        P1 m_parameter1;
+        P2 m_parameter2;
+        P3 m_parameter3;
+    };
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
+    class GenericWorkerTask4 : public ScriptExecutionContext::Task {
+    public:
+        typedef void (*Method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4);
+        typedef GenericWorkerTask4<P1, MP1, P2, MP2, P3, MP3, P4, MP4> GenericWorkerTask;
+        typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
+        typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
+        typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
+        typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
+
+        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+        {
+            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4));
+        }
+
+    private:
+        GenericWorkerTask4(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+            : m_method(method)
+            , m_parameter1(parameter1)
+            , m_parameter2(parameter2)
+            , m_parameter3(parameter3)
+            , m_parameter4(parameter4)
+        {
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            (*m_method)(context, m_parameter1, m_parameter2, m_parameter3, m_parameter4);
+        }
+
+    private:
+        Method m_method;
+        P1 m_parameter1;
+        P2 m_parameter2;
+        P3 m_parameter3;
+        P4 m_parameter4;
+    };
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5>
+    class GenericWorkerTask5 : public ScriptExecutionContext::Task {
+    public:
+        typedef void (*Method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5);
+        typedef GenericWorkerTask5<P1, MP1, P2, MP2, P3, MP3, P4, MP4, P5, MP5> GenericWorkerTask;
+        typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
+        typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
+        typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
+        typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
+        typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
+
+        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
+        {
+            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5));
+        }
+
+    private:
+        GenericWorkerTask5(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
+            : m_method(method)
+            , m_parameter1(parameter1)
+            , m_parameter2(parameter2)
+            , m_parameter3(parameter3)
+            , m_parameter4(parameter4)
+            , m_parameter5(parameter5)
+        {
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            (*m_method)(context, m_parameter1, m_parameter2, m_parameter3, m_parameter4, m_parameter5);
+        }
+
+    private:
+        Method m_method;
+        P1 m_parameter1;
+        P2 m_parameter2;
+        P3 m_parameter3;
+        P4 m_parameter4;
+        P5 m_parameter5;
+    };
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6>
+    class GenericWorkerTask6 : public ScriptExecutionContext::Task {
+    public:
+        typedef void (*Method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6);
+        typedef GenericWorkerTask6<P1, MP1, P2, MP2, P3, MP3, P4, MP4, P5, MP5, P6, MP6> GenericWorkerTask;
+        typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
+        typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
+        typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
+        typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
+        typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
+        typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
+
+        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
+        {
+            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6));
+        }
+
+    private:
+        GenericWorkerTask6(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
+            : m_method(method)
+            , m_parameter1(parameter1)
+            , m_parameter2(parameter2)
+            , m_parameter3(parameter3)
+            , m_parameter4(parameter4)
+            , m_parameter5(parameter5)
+            , m_parameter6(parameter6)
+        {
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            (*m_method)(context, m_parameter1, m_parameter2, m_parameter3, m_parameter4, m_parameter5, m_parameter6);
+        }
+
+    private:
+        Method m_method;
+        P1 m_parameter1;
+        P2 m_parameter2;
+        P3 m_parameter3;
+        P4 m_parameter4;
+        P5 m_parameter5;
+        P6 m_parameter6;
+    };
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7>
+    class GenericWorkerTask7 : public ScriptExecutionContext::Task {
+    public:
+        typedef void (*Method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7);
+        typedef GenericWorkerTask7<P1, MP1, P2, MP2, P3, MP3, P4, MP4, P5, MP5, P6, MP6, P7, MP7> GenericWorkerTask;
+        typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
+        typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
+        typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
+        typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
+        typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
+        typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
+        typedef typename GenericWorkerTaskTraits<P7>::ParamType Param7;
+
+        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
+        {
+            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7));
+        }
+
+    private:
+        GenericWorkerTask7(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
+            : m_method(method)
+            , m_parameter1(parameter1)
+            , m_parameter2(parameter2)
+            , m_parameter3(parameter3)
+            , m_parameter4(parameter4)
+            , m_parameter5(parameter5)
+            , m_parameter6(parameter6)
+            , m_parameter7(parameter7)
+        {
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            (*m_method)(context, m_parameter1, m_parameter2, m_parameter3, m_parameter4, m_parameter5, m_parameter6, m_parameter7);
+        }
+
+    private:
+        Method m_method;
+        P1 m_parameter1;
+        P2 m_parameter2;
+        P3 m_parameter3;
+        P4 m_parameter4;
+        P5 m_parameter5;
+        P6 m_parameter6;
+        P7 m_parameter7;
+    };
+
+    template<typename P1, typename MP1>
+    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+        void (*method)(ScriptExecutionContext*, MP1),
+        const P1& parameter1)
+    {
+        return GenericWorkerTask1<typename CrossThreadCopier<P1>::Type, MP1>::create(
+            method,
+            CrossThreadCopier<P1>::copy(parameter1));
+    }
+
+    template<typename P1, typename MP1, typename P2, typename MP2>
+    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+        void (*method)(ScriptExecutionContext*, MP1, MP2),
+        const P1& parameter1, const P2& parameter2)
+    {
+        return GenericWorkerTask2<typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2>::create(
+            method,
+            CrossThreadCopier<P1>::copy(parameter1), CrossThreadCopier<P2>::copy(parameter2));
+    }
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
+    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+        void (*method)(ScriptExecutionContext*, MP1, MP2, MP3),
+        const P1& parameter1, const P2& parameter2, const P3& parameter3)
+    {
+        return GenericWorkerTask3<typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3>::create(
+            method,
+            CrossThreadCopier<P1>::copy(parameter1), CrossThreadCopier<P2>::copy(parameter2),
+            CrossThreadCopier<P3>::copy(parameter3));
+    }
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
+    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+        void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4),
+        const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4)
+    {
+        return GenericWorkerTask4<typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3,
+            typename CrossThreadCopier<P4>::Type, MP4>::create(
+                method,
+                CrossThreadCopier<P1>::copy(parameter1), CrossThreadCopier<P2>::copy(parameter2),
+                CrossThreadCopier<P3>::copy(parameter3), CrossThreadCopier<P4>::copy(parameter4));
+    }
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5>
+    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+        void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5),
+        const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5)
+    {
+        return GenericWorkerTask5<typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3,
+            typename CrossThreadCopier<P4>::Type, MP4, typename CrossThreadCopier<P5>::Type, MP5>::create(
+                method,
+                CrossThreadCopier<P1>::copy(parameter1), CrossThreadCopier<P2>::copy(parameter2),
+                CrossThreadCopier<P3>::copy(parameter3), CrossThreadCopier<P4>::copy(parameter4),
+                CrossThreadCopier<P5>::copy(parameter5));
+    }
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6>
+    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+        void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6),
+        const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6)
+    {
+        return GenericWorkerTask6<typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3,
+            typename CrossThreadCopier<P4>::Type, MP4, typename CrossThreadCopier<P5>::Type, MP5, typename CrossThreadCopier<P6>::Type, MP6>::create(
+                method,
+                CrossThreadCopier<P1>::copy(parameter1), CrossThreadCopier<P2>::copy(parameter2),
+                CrossThreadCopier<P3>::copy(parameter3), CrossThreadCopier<P4>::copy(parameter4),
+                CrossThreadCopier<P5>::copy(parameter5), CrossThreadCopier<P6>::copy(parameter6));
+    }
+
+    template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7>
+    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+        void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7),
+        const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6, const P7& parameter7)
+    {
+        return GenericWorkerTask7<typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3,
+            typename CrossThreadCopier<P4>::Type, MP4, typename CrossThreadCopier<P5>::Type, MP5, typename CrossThreadCopier<P6>::Type, MP6,
+            typename CrossThreadCopier<P7>::Type, MP7>::create(
+                method,
+                CrossThreadCopier<P1>::copy(parameter1), CrossThreadCopier<P2>::copy(parameter2),
+                CrossThreadCopier<P3>::copy(parameter3), CrossThreadCopier<P4>::copy(parameter4),
+                CrossThreadCopier<P5>::copy(parameter5), CrossThreadCopier<P6>::copy(parameter6),
+                CrossThreadCopier<P7>::copy(parameter7));
+    }
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // GenericWorkerTask_h
diff --git a/src/3rdparty/webkit/WebCore/dom/Worker.cpp b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
index bdd083fb3d..85ba690555 100644
--- a/src/3rdparty/webkit/WebCore/dom/Worker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,60 +43,57 @@
 #include "FrameLoader.h"
 #include "MessageEvent.h"
 #include "SecurityOrigin.h"
-#include "WorkerContext.h"
-#include "WorkerMessagingProxy.h"
-#include "WorkerTask.h"
+#include "TextEncoding.h"
+#include "WorkerContextProxy.h"
 #include "WorkerThread.h"
 #include <wtf/MainThread.h>
 
 namespace WebCore {
 
-Worker::Worker(const String& url, Document* doc, ExceptionCode& ec)
-    : ActiveDOMObject(doc, this)
-    , m_messagingProxy(new WorkerMessagingProxy(doc, this))
+Worker::Worker(const String& url, ScriptExecutionContext* context, ExceptionCode& ec)
+    : ActiveDOMObject(context, this)
+    , m_contextProxy(WorkerContextProxy::create(this))
 {
-    m_scriptURL = doc->completeURL(url);
+    m_scriptURL = context->completeURL(url);
     if (url.isEmpty() || !m_scriptURL.isValid()) {
         ec = SYNTAX_ERR;
         return;
     }
 
-    if (!doc->securityOrigin()->canAccess(SecurityOrigin::create(m_scriptURL).get())) {
+    if (!context->securityOrigin()->canAccess(SecurityOrigin::create(m_scriptURL).get())) {
         ec = SECURITY_ERR;
         return;
     }
 
-    m_cachedScript = doc->docLoader()->requestScript(m_scriptURL, document()->charset());
+    // FIXME: Nested workers need loading support. Consider adopting ThreadableLoader here.
+    ASSERT(scriptExecutionContext()->isDocument());
+    Document* document = static_cast<Document*>(scriptExecutionContext());
+
+    m_cachedScript = document->docLoader()->requestScript(m_scriptURL, "UTF-8");
     if (!m_cachedScript) {
         dispatchErrorEvent();
         return;
     }
 
-    setPendingActivity(this);  // The worker context does not exist while loading, so we much ensure that the worker object is not collected, as well as its event listeners.
+    setPendingActivity(this);  // The worker context does not exist while loading, so we must ensure that the worker object is not collected, as well as its event listeners.
     m_cachedScript->addClient(this);
 }
 
 Worker::~Worker()
 {
     ASSERT(isMainThread());
-    ASSERT(scriptExecutionContext()); // The context is protected by messaging proxy, so it cannot be destroyed while a Worker exists.
-    m_messagingProxy->workerObjectDestroyed();
-}
-
-Document* Worker::document() const
-{
-    ASSERT(scriptExecutionContext()->isDocument());
-    return static_cast<Document*>(scriptExecutionContext());
+    ASSERT(scriptExecutionContext()); // The context is protected by worker context proxy, so it cannot be destroyed while a Worker exists.
+    m_contextProxy->workerObjectDestroyed();
 }
 
 void Worker::postMessage(const String& message)
 {
-    m_messagingProxy->postMessageToWorkerContext(message);
+    m_contextProxy->postMessageToWorkerContext(message);
 }
 
 void Worker::terminate()
 {
-    m_messagingProxy->terminate();
+    m_contextProxy->terminateWorkerContext();
 }
 
 bool Worker::canSuspend() const
@@ -111,20 +109,17 @@ void Worker::stop()
 
 bool Worker::hasPendingActivity() const
 {
-    return m_messagingProxy->workerThreadHasPendingActivity() || ActiveDOMObject::hasPendingActivity();
+    return m_contextProxy->hasPendingActivity() || ActiveDOMObject::hasPendingActivity();
 }
 
-void Worker::notifyFinished(CachedResource* resource)
+void Worker::notifyFinished(CachedResource* unusedResource)
 {
-    ASSERT(resource == m_cachedScript.get());
+    ASSERT_UNUSED(unusedResource, unusedResource == m_cachedScript);
+
     if (m_cachedScript->errorOccurred())
         dispatchErrorEvent();
-    else {
-        String userAgent = document()->frame() ? document()->frame()->loader()->userAgent(m_scriptURL) : String();
-        RefPtr<WorkerThread> thread = WorkerThread::create(m_scriptURL, userAgent, m_cachedScript->script(), m_messagingProxy);
-        m_messagingProxy->workerThreadCreated(thread);
-        thread->start();
-    }
+    else
+        m_contextProxy->startWorkerContext(m_scriptURL, scriptExecutionContext()->userAgent(m_scriptURL), m_cachedScript->script());
 
     m_cachedScript->removeClient(this);
     m_cachedScript = 0;
@@ -197,6 +192,21 @@ bool Worker::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
     return !event->defaultPrevented();
 }
 
+void Worker::dispatchMessage(const String& message)
+{
+    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, 0);
+
+    if (m_onMessageListener.get()) {
+        evt->setTarget(this);
+        evt->setCurrentTarget(this);
+        m_onMessageListener->handleEvent(evt.get(), false);
+    }
+
+    ExceptionCode ec = 0;
+    dispatchEvent(evt.release(), ec);
+    ASSERT(!ec);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/dom/Worker.h b/src/3rdparty/webkit/WebCore/workers/Worker.h
index 6a47bac44d..d05f9d5c89 100644
--- a/src/3rdparty/webkit/WebCore/dom/Worker.h
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.h
@@ -43,21 +43,18 @@ namespace WebCore {
 
     class CachedResource;
     class CachedScript;
-    class Document;
     class ScriptExecutionContext;
     class String;
-    class WorkerMessagingProxy;
-    class WorkerTask;
+    class WorkerContextProxy;
 
     typedef int ExceptionCode;
 
     class Worker : public RefCounted<Worker>, public ActiveDOMObject, private CachedResourceClient, public EventTarget {
     public:
-        static PassRefPtr<Worker> create(const String& url, Document* document, ExceptionCode& ec) { return adoptRef(new Worker(url, document, ec)); }
+        static PassRefPtr<Worker> create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec) { return adoptRef(new Worker(url, context, ec)); }
         ~Worker();
 
         virtual ScriptExecutionContext* scriptExecutionContext() const { return ActiveDOMObject::scriptExecutionContext(); }
-        Document* document() const;
 
         virtual Worker* toWorker() { return this; }
 
@@ -65,6 +62,9 @@ namespace WebCore {
 
         void terminate();
 
+        void dispatchMessage(const String&);
+        void dispatchErrorEvent();
+
         virtual bool canSuspend() const;
         virtual void stop();
         virtual bool hasPendingActivity() const;
@@ -87,19 +87,17 @@ namespace WebCore {
         EventListener* onerror() const { return m_onErrorListener.get(); }
 
     private:
-        Worker(const String&, Document*, ExceptionCode&);
+        Worker(const String&, ScriptExecutionContext*, ExceptionCode&);
 
         virtual void notifyFinished(CachedResource*);
 
-        void dispatchErrorEvent();
-
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
 
         KURL m_scriptURL;
         CachedResourceHandle<CachedScript> m_cachedScript;
 
-        WorkerMessagingProxy* m_messagingProxy; // The proxy outlives the worker to perform thread shutdown.
+        WorkerContextProxy* m_contextProxy; // The proxy outlives the worker to perform thread shutdown.
 
         RefPtr<EventListener> m_onMessageListener;
         RefPtr<EventListener> m_onErrorListener;
diff --git a/src/3rdparty/webkit/WebCore/dom/Worker.idl b/src/3rdparty/webkit/WebCore/workers/Worker.idl
index 2ef9b62c7e..2ef9b62c7e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Worker.idl
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.idl
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
index 8a9af07dd5..59168c741c 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,24 +32,33 @@
 #include "WorkerContext.h"
 
 #include "ActiveDOMObject.h"
+#include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "Event.h"
 #include "EventException.h"
+#include "MessageEvent.h"
+#include "NotImplemented.h"
+#include "ResourceRequest.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
 #include "SecurityOrigin.h"
+#include "ThreadableLoader.h"
+#include "WorkerImportScriptsClient.h"
 #include "WorkerLocation.h"
-#include "WorkerMessagingProxy.h"
 #include "WorkerNavigator.h"
-#include "WorkerTask.h"
+#include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
+#include "XMLHttpRequestException.h"
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
 WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThread* thread)
     : m_url(url)
     , m_userAgent(userAgent)
-    , m_location(WorkerLocation::create(url))
     , m_script(new WorkerScriptController(this))
     , m_thread(thread)
+    , m_closing(false)
 {
     setSecurityOrigin(SecurityOrigin::create(url));
 }
@@ -57,7 +67,7 @@ WorkerContext::~WorkerContext()
 {
     ASSERT(currentThread() == m_thread->threadID());
 
-    m_thread->messagingProxy()->workerContextDestroyed();
+    m_thread->workerObjectProxy()->workerContextDestroyed();
 }
 
 ScriptExecutionContext* WorkerContext::scriptExecutionContext() const
@@ -81,8 +91,29 @@ KURL WorkerContext::completeURL(const String& url) const
     // FIXME: Should we change the KURL constructor to have this behavior?
     if (url.isNull())
         return KURL();
-    // FIXME: does this need to provide a charset, like Document::completeURL does?
-    return KURL(m_location->url(), url);
+    // Always use UTF-8 in Workers.
+    return KURL(m_url, url);
+}
+
+String WorkerContext::userAgent(const KURL&) const
+{
+    return m_userAgent;
+}
+
+WorkerLocation* WorkerContext::location() const
+{
+    if (!m_location)
+        m_location = WorkerLocation::create(m_url);
+    return m_location.get();
+}
+
+void WorkerContext::close()
+{
+    if (m_closing)
+        return;
+
+    m_closing = true;
+    m_thread->stop();
 }
 
 WorkerNavigator* WorkerContext::navigator() const
@@ -105,12 +136,32 @@ bool WorkerContext::hasPendingActivity() const
 
 void WorkerContext::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
 {
-    m_thread->messagingProxy()->postWorkerException(errorMessage, lineNumber, sourceURL);
+    m_thread->workerObjectProxy()->postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+}
+
+void WorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    m_thread->workerObjectProxy()->postConsoleMessageToWorkerObject(destination, source, level, message, lineNumber, sourceURL);
+}
+
+void WorkerContext::resourceRetrievedByXMLHttpRequest(unsigned long, const ScriptString&)
+{
+    // FIXME: The implementation is pending the fixes in https://bugs.webkit.org/show_bug.cgi?id=23175
+    notImplemented();
+}
+
+void WorkerContext::scriptImported(unsigned long, const String&)
+{
+    // FIXME: The implementation is pending the fixes in https://bugs.webkit.org/show_bug.cgi?id=23175
+    notImplemented();
 }
 
 void WorkerContext::postMessage(const String& message)
 {
-    m_thread->messagingProxy()->postMessageToWorkerObject(message);
+    if (m_closing)
+        return;
+
+    m_thread->workerObjectProxy()->postMessageToWorkerObject(message);
 }
 
 void WorkerContext::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
@@ -164,30 +215,84 @@ bool WorkerContext::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
     return !event->defaultPrevented();
 }
 
-class ScriptExecutionContextTaskWorkerTask : public WorkerTask {
-public:
-    static PassRefPtr<ScriptExecutionContextTaskWorkerTask> create(PassRefPtr<ScriptExecutionContext::Task> task)
-    {
-        return adoptRef(new ScriptExecutionContextTaskWorkerTask(task));
-    }
+void WorkerContext::postTask(PassRefPtr<Task> task)
+{
+    thread()->runLoop().postTask(task);
+}
 
-private:
-    ScriptExecutionContextTaskWorkerTask(PassRefPtr<ScriptExecutionContext::Task> task)
-        : m_task(task)
-    {
-    }
+int WorkerContext::setTimeout(ScheduledAction* action, int timeout)
+{
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, true);
+}
+
+void WorkerContext::clearTimeout(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+int WorkerContext::setInterval(ScheduledAction* action, int timeout)
+{
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, false);
+}
+
+void WorkerContext::clearInterval(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+void WorkerContext::dispatchMessage(const String& message)
+{
+    // Since close() stops the thread event loop, this should not ever get called while closing.
+    ASSERT(!m_closing);
+    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, 0);
 
-    virtual void performTask(WorkerContext* context)
-    {
-        m_task->performTask(context);
+    if (m_onmessageListener.get()) {
+        evt->setTarget(this);
+        evt->setCurrentTarget(this);
+        m_onmessageListener->handleEvent(evt.get(), false);
     }
 
-    RefPtr<ScriptExecutionContext::Task> m_task;
-};
+    ExceptionCode ec = 0;
+    dispatchEvent(evt.release(), ec);
+    ASSERT(!ec);
+}
 
-void WorkerContext::postTask(PassRefPtr<Task> task)
+void WorkerContext::importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode& ec)
 {
-    thread()->messageQueue().append(ScriptExecutionContextTaskWorkerTask::create(task));
+    ec = 0;
+    Vector<String>::const_iterator urlsEnd = urls.end();
+    Vector<KURL> completedURLs;
+    for (Vector<String>::const_iterator it = urls.begin(); it != urlsEnd; ++it) {
+        const KURL& url = scriptExecutionContext()->completeURL(*it);
+        if (!url.isValid()) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+        completedURLs.append(url);
+    }
+    String securityOrigin = scriptExecutionContext()->securityOrigin()->toString();
+    Vector<KURL>::const_iterator end = completedURLs.end();
+
+    for (Vector<KURL>::const_iterator it = completedURLs.begin(); it != end; ++it) {
+        ResourceRequest request(*it);
+        request.setHTTPMethod("GET");
+        request.setHTTPOrigin(securityOrigin);
+        WorkerImportScriptsClient client(scriptExecutionContext(), *it, callerURL, callerLine);
+        ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, client, AllowStoredCredentials);
+        
+        // If the fetching attempt failed, throw a NETWORK_ERR exception and abort all these steps.
+        if (client.failed()) {
+            ec = XMLHttpRequestException::NETWORK_ERR;
+            return;
+        }
+
+        ScriptValue exception;
+        m_script->evaluate(ScriptSourceCode(client.script(), *it), &exception);
+        if (!exception.hasNoValue()) {
+            m_script->setException(exception);
+            return;
+        }
+    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerContext.h b/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
index c9774d91e5..ce782f81de 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,9 +41,9 @@
 
 namespace WebCore {
 
+    class ScheduledAction;
     class WorkerLocation;
     class WorkerNavigator;
-    class WorkerTask;
     class WorkerThread;
 
     class WorkerContext : public RefCounted<WorkerContext>, public ScriptExecutionContext, public EventTarget {
@@ -57,55 +57,85 @@ namespace WebCore {
 
         virtual bool isWorkerContext() const { return true; }
 
+        virtual WorkerContext* toWorkerContext() { return this; }
+
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
         const KURL& url() const { return m_url; }
         KURL completeURL(const String&) const;
 
-        WorkerLocation* location() const { return m_location.get(); }
-        WorkerNavigator* navigator() const;
+        virtual String userAgent(const KURL&) const;
 
         WorkerScriptController* script() { return m_script.get(); }
         void clearScript() { return m_script.clear(); }
+
         WorkerThread* thread() { return m_thread; }
 
         bool hasPendingActivity() const;
 
         virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
+        virtual void addMessage(MessageDestination, MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
+        virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+        virtual void scriptImported(unsigned long identifier, const String& sourceString);
+
+        virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
-        virtual WorkerContext* toWorkerContext() { return this; }
 
+        // WorkerGlobalScope
+        WorkerContext* self() { return this; }
+        WorkerLocation* location() const;
+        void close();
+
+        // WorkerUtils
+        void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
+        WorkerNavigator* navigator() const;
+
+
+        // DedicatedWorkerGlobalScope
         void postMessage(const String& message);
-        virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessageListener = eventListener; }
+        EventListener* onmessage() const { return m_onmessageListener.get(); }
+
+        // Timers
+        int setTimeout(ScheduledAction*, int timeout);
+        void clearTimeout(int timeoutId);
+        int setInterval(ScheduledAction*, int timeout);
+        void clearInterval(int timeoutId);
 
+        // EventTarget
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
         virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
         virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
 
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessageListener = eventListener; }
-        EventListener* onmessage() const { return m_onmessageListener.get(); }
-
         typedef Vector<RefPtr<EventListener> > ListenerVector;
         typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
         EventListenersMap& eventListeners() { return m_eventListeners; }
 
+        void dispatchMessage(const String&);
+
+        // These methods are used for GC marking. See JSWorkerContext::mark() in
+        // JSWorkerContextCustom.cpp.
+        WorkerNavigator* optionalNavigator() const { return m_navigator.get(); }
+        WorkerLocation* optionalLocation() const { return m_location.get(); }
+
         using RefCounted<WorkerContext>::ref;
         using RefCounted<WorkerContext>::deref;
 
     private:
+        WorkerContext(const KURL&, const String&, WorkerThread*);
+
         virtual void refScriptExecutionContext() { ref(); }
         virtual void derefScriptExecutionContext() { deref(); }
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
 
-        WorkerContext(const KURL&, const String&, WorkerThread*);
-
         virtual const KURL& virtualURL() const;
         virtual KURL virtualCompleteURL(const String&) const;
 
         KURL m_url;
         String m_userAgent;
-        RefPtr<WorkerLocation> m_location;
+
+        mutable RefPtr<WorkerLocation> m_location;
         mutable RefPtr<WorkerNavigator> m_navigator;
 
         OwnPtr<WorkerScriptController> m_script;
@@ -113,6 +143,8 @@ namespace WebCore {
 
         RefPtr<EventListener> m_onmessageListener;
         EventListenersMap m_eventListeners;
+
+        bool m_closing;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
index 6e7223cefc..60568fb2db 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
@@ -34,18 +34,36 @@ module threads {
         LegacyParent=JSWorkerContextBase,
         NoStaticTables
     ] WorkerContext {
-#if defined(LANGUAGE_JAVASCRIPT)
-        attribute [Custom] WorkerContext self;
+
+        // WorkerGlobalScope
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+                 attribute [Replaceable] WorkerContext self;
 #endif
+                 attribute [Replaceable] WorkerLocation location;
+        void close();
+        //         attribute EventListener onclose;
+        //         attribute EventListener onerror;
+
+        // WorkerUtils
+        [Custom] void importScripts(/*[Variadic] in DOMString urls */);
+                 attribute [Replaceable] WorkerNavigator navigator;
+        // Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize);
+        // DatabaseSync openDatabaseSync(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize);
+
 
-        attribute EventListener onmessage;
+        // DedicatedWorkerGlobalScope
         void postMessage(in DOMString message);
+                 attribute EventListener onmessage;
+
+
+        // Timers
+        [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setTimeout(in DOMString code, in long timeout);
+        void clearTimeout(in long handle);
+        [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setInterval(in DOMString code, in long timeout);
+        void clearInterval(in long handle);
 
-        attribute [Replaceable] WorkerLocation location;
-        attribute [Replaceable] WorkerNavigator navigator;
-        
-        attribute MessageEventConstructor MessageEvent;
-        attribute WorkerLocationConstructor WorkerLocation;
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type, 
@@ -56,6 +74,13 @@ module threads {
                                           in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
+
+
+        // Constructors
+        attribute MessageEventConstructor MessageEvent;
+        attribute WorkerLocationConstructor WorkerLocation;
+
+        attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
new file mode 100644
index 0000000000..c8f57614af
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerContextProxy_h
+#define WorkerContextProxy_h
+
+#if ENABLE(WORKERS)
+
+namespace WebCore {
+
+    class KURL;
+    class String;
+    class Worker;
+
+    // A proxy to talk to the worker context.
+    class WorkerContextProxy {
+    public:
+        static WorkerContextProxy* create(Worker*);
+
+        virtual ~WorkerContextProxy() {}
+
+        virtual void startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode) = 0;
+
+        virtual void terminateWorkerContext() = 0;
+
+        virtual void postMessageToWorkerContext(const String&) = 0;
+
+        virtual bool hasPendingActivity() const = 0;
+
+        virtual void workerObjectDestroyed() = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // WorkerContextProxy_h
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerImportScriptsClient.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerImportScriptsClient.cpp
new file mode 100644
index 0000000000..7b8061be25
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerImportScriptsClient.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "WorkerImportScriptsClient.h"
+
+#include "ScriptExecutionContext.h"
+
+namespace WebCore {
+
+void WorkerImportScriptsClient::didReceiveResponse(const ResourceResponse& response)
+{
+    if (response.httpStatusCode() / 100 != 2 && response.httpStatusCode() != 0) {
+        m_failed = true;
+        return;
+    }
+    m_responseEncoding = response.textEncodingName();
+}
+
+void WorkerImportScriptsClient::didReceiveData(const char* data, int len)
+{
+    if (m_failed)
+        return;
+
+    if (!m_decoder) {
+        if (!m_responseEncoding.isEmpty())
+            m_decoder = TextResourceDecoder::create("text/javascript", m_responseEncoding);
+        else
+            m_decoder = TextResourceDecoder::create("text/javascript", "UTF-8");
+    }
+
+    if (!len)
+        return;
+    
+    if (len == -1)
+        len = strlen(data);
+    
+    m_script += m_decoder->decode(data, len);
+}
+
+void WorkerImportScriptsClient::didFinishLoading(unsigned long identifier)
+{
+    if (m_failed)
+        return;
+
+    if (m_decoder)
+        m_script += m_decoder->flush();
+    
+    m_scriptExecutionContext->scriptImported(identifier, m_script);
+    m_scriptExecutionContext->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageLevel, "Worker script imported: \"" + m_url + "\".", m_callerLineNumber, m_callerURL);
+}
+
+void WorkerImportScriptsClient::didFail(const ResourceError&)
+{
+    m_failed = true;
+}
+
+void WorkerImportScriptsClient::didFailRedirectCheck()
+{
+    m_failed = true;
+}
+
+void WorkerImportScriptsClient::didReceiveAuthenticationCancellation(const ResourceResponse&)
+{
+    m_failed = true;
+}
+
+}
+
+#endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerImportScriptsClient.h b/src/3rdparty/webkit/WebCore/workers/WorkerImportScriptsClient.h
new file mode 100644
index 0000000000..ec27054e74
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerImportScriptsClient.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef WorkerImportScriptsClient_h
+#define WorkerImportScriptsClient_h
+
+#if ENABLE(WORKERS)
+
+#include "ResourceResponse.h"
+#include "ScriptString.h"
+#include "TextResourceDecoder.h"
+#include "ThreadableLoaderClient.h"
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+    
+    class WorkerImportScriptsClient : public ThreadableLoaderClient {
+    public:
+        WorkerImportScriptsClient(ScriptExecutionContext* scriptExecutionContext, const String& url, const String& callerURL, int callerLineNumber)
+            : m_scriptExecutionContext(scriptExecutionContext)
+            , m_url(url)
+            , m_callerURL(callerURL)
+            , m_callerLineNumber(callerLineNumber)
+            , m_failed(false)
+        {
+        }
+
+        const String& script() const { return m_script; }
+        bool failed() const { return m_failed; }
+
+        virtual void didReceiveResponse(const ResourceResponse& response);
+        virtual void didReceiveData(const char* data, int lengthReceived);
+        virtual void didFinishLoading(unsigned long identifier);
+        virtual void didFail(const ResourceError&);
+        virtual void didFailRedirectCheck();
+        virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
+
+    private:
+        ScriptExecutionContext* m_scriptExecutionContext;
+        String m_url;
+        String m_callerURL;
+        int m_callerLineNumber;
+        String m_responseEncoding;        
+        RefPtr<TextResourceDecoder> m_decoder;
+        String m_script;
+        bool m_failed;
+    };
+
+}
+
+#endif // ENABLE(WORKERS)
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerLocation.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.cpp
index 115a9ad58e..e84bf937a0 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.cpp
@@ -66,12 +66,12 @@ String WorkerLocation::pathname() const
 
 String WorkerLocation::search() const
 {
-    return m_url.query();
+    return m_url.query().isEmpty() ? "" : "?" + m_url.query();
 }
 
 String WorkerLocation::hash() const
 {
-    return m_url.ref().isNull() ? "" : "#" + m_url.ref();
+    return m_url.ref().isEmpty() ? "" : "#" + m_url.ref();
 }
 
 String WorkerLocation::toString() const
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerLocation.h b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.h
index 52c31ade0c..52c31ade0c 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerLocation.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.h
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerLocation.idl b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.idl
index 5551f18abc..5551f18abc 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerLocation.idl
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.idl
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerMessagingProxy.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
index b69b9c50e9..07ee4f9c08 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerMessagingProxy.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,15 +33,16 @@
 
 #include "DOMWindow.h"
 #include "Document.h"
+#include "GenericWorkerTask.h"
 #include "MessageEvent.h"
+#include "ScriptExecutionContext.h"
 #include "Worker.h"
 #include "WorkerContext.h"
-#include "WorkerTask.h"
 #include "WorkerThread.h"
 
 namespace WebCore {
 
-class MessageWorkerContextTask : public WorkerTask {
+class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
     static PassRefPtr<MessageWorkerContextTask> create(const String& message)
     {
@@ -53,21 +55,14 @@ private:
     {
     }
 
-    virtual void performTask(WorkerContext* context)
+    virtual void performTask(ScriptExecutionContext* scriptContext)
     {
-        RefPtr<Event> evt = MessageEvent::create(m_message, "", "", 0, 0);
+        ASSERT(scriptContext->isWorkerContext());
+        WorkerContext* context = static_cast<WorkerContext*>(scriptContext);
 
-        if (context->onmessage()) {
-            evt->setTarget(context);
-            evt->setCurrentTarget(context);
-            context->onmessage()->handleEvent(evt.get(), false);
-        }
+        context->dispatchMessage(m_message);
 
-        ExceptionCode ec = 0;
-        context->dispatchEvent(evt.release(), ec);
-        ASSERT(!ec);
-
-        context->thread()->messagingProxy()->confirmWorkerThreadMessage(context->hasPendingActivity());
+        context->thread()->workerObjectProxy()->confirmMessageFromWorkerObject(context->hasPendingActivity());
     }
 
 private:
@@ -94,17 +89,7 @@ private:
         if (!workerObject || m_messagingProxy->askedToTerminate())
             return;
 
-        RefPtr<Event> evt = MessageEvent::create(m_message, "", "", 0, 0);
-
-        if (workerObject->onmessage()) {
-            evt->setTarget(workerObject);
-            evt->setCurrentTarget(workerObject);
-            workerObject->onmessage()->handleEvent(evt.get(), false);
-        }
-
-        ExceptionCode ec = 0;
-        workerObject->dispatchEvent(evt.release(), ec);
-        ASSERT(!ec);
+        workerObject->dispatchMessage(m_message);
     }
 
 private:
@@ -178,7 +163,7 @@ private:
 
     virtual void performTask(ScriptExecutionContext*)
     {
-        m_messagingProxy->reportWorkerThreadActivityInternal(m_confirmingMessage, m_hasPendingActivity);
+        m_messagingProxy->reportPendingActivityInternal(m_confirmingMessage, m_hasPendingActivity);
     }
 
     WorkerMessagingProxy* m_messagingProxy;
@@ -187,8 +172,15 @@ private:
 };
 
 
-WorkerMessagingProxy::WorkerMessagingProxy(PassRefPtr<ScriptExecutionContext> scriptExecutionContext, Worker* workerObject)
-    : m_scriptExecutionContext(scriptExecutionContext)
+#if !PLATFORM(CHROMIUM)
+WorkerContextProxy* WorkerContextProxy::create(Worker* worker)
+{
+    return new WorkerMessagingProxy(worker);
+}
+#endif
+
+WorkerMessagingProxy::WorkerMessagingProxy(Worker* workerObject)
+    : m_scriptExecutionContext(workerObject->scriptExecutionContext())
     , m_workerObject(workerObject)
     , m_unconfirmedMessageCount(0)
     , m_workerThreadHadPendingActivity(false)
@@ -196,14 +188,21 @@ WorkerMessagingProxy::WorkerMessagingProxy(PassRefPtr<ScriptExecutionContext> sc
 {
     ASSERT(m_workerObject);
     ASSERT((m_scriptExecutionContext->isDocument() && isMainThread())
-        || (m_scriptExecutionContext->isWorkerContext() && currentThread() == static_cast<WorkerContext*>(m_scriptExecutionContext.get())->thread()->threadID()));
+           || (m_scriptExecutionContext->isWorkerContext() && currentThread() == static_cast<WorkerContext*>(m_scriptExecutionContext.get())->thread()->threadID()));
 }
 
 WorkerMessagingProxy::~WorkerMessagingProxy()
 {
     ASSERT(!m_workerObject);
     ASSERT((m_scriptExecutionContext->isDocument() && isMainThread())
-        || (m_scriptExecutionContext->isWorkerContext() && currentThread() == static_cast<WorkerContext*>(m_scriptExecutionContext.get())->thread()->threadID()));
+           || (m_scriptExecutionContext->isWorkerContext() && currentThread() == static_cast<WorkerContext*>(m_scriptExecutionContext.get())->thread()->threadID()));
+}
+
+void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
+{
+    RefPtr<WorkerThread> thread = WorkerThread::create(scriptURL, userAgent, sourceCode, this);
+    workerThreadCreated(thread);
+    thread->start();
 }
 
 void WorkerMessagingProxy::postMessageToWorkerObject(const String& message)
@@ -218,15 +217,46 @@ void WorkerMessagingProxy::postMessageToWorkerContext(const String& message)
 
     if (m_workerThread) {
         ++m_unconfirmedMessageCount;
-        m_workerThread->messageQueue().append(MessageWorkerContextTask::create(message));
+        m_workerThread->runLoop().postTask(MessageWorkerContextTask::create(message));
     } else
         m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message));
 }
 
-void WorkerMessagingProxy::postWorkerException(const String& errorMessage, int lineNumber, const String& sourceURL)
+void WorkerMessagingProxy::postTaskToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task)
+{
+    postTaskForModeToWorkerContext(task, WorkerRunLoop::defaultMode());
+}
+
+void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    if (m_askedToTerminate)
+        return;
+
+    ASSERT(m_workerThread);
+    m_workerThread->runLoop().postTaskForMode(task, mode);
+}
+
+void WorkerMessagingProxy::postTaskToWorkerObject(PassRefPtr<ScriptExecutionContext::Task> task)
+{
+    m_scriptExecutionContext->postTask(task);
+}
+
+void WorkerMessagingProxy::postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL)
 {
     m_scriptExecutionContext->postTask(WorkerExceptionTask::create(errorMessage, lineNumber, sourceURL, this));
 }
+    
+static void postConsoleMessageTask(ScriptExecutionContext* context, WorkerMessagingProxy* messagingProxy, MessageDestination destination, MessageSource source, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    if (messagingProxy->askedToTerminate())
+        return;
+    context->addMessage(destination, source, level, message, lineNumber, sourceURL);
+}
+
+void WorkerMessagingProxy::postConsoleMessageToWorkerObject(MessageDestination destination, MessageSource source, MessageLevel level, const String& message, int lineNumber, const String& sourceURL)
+{
+    m_scriptExecutionContext->postTask(createCallbackTask(&postConsoleMessageTask, this, destination, source, level, message, lineNumber, sourceURL));
+}
 
 void WorkerMessagingProxy::workerThreadCreated(PassRefPtr<WorkerThread> workerThread)
 {
@@ -238,10 +268,11 @@ void WorkerMessagingProxy::workerThreadCreated(PassRefPtr<WorkerThread> workerTh
     } else {
         unsigned taskCount = m_queuedEarlyTasks.size();
         ASSERT(!m_unconfirmedMessageCount);
-        m_unconfirmedMessageCount = taskCount + 1; // Worker initialization counts as a pending message.
+        m_unconfirmedMessageCount = taskCount;
+        m_workerThreadHadPendingActivity = true; // Worker initialization means a pending activity.
 
         for (unsigned i = 0; i < taskCount; ++i)
-            m_workerThread->messageQueue().append(m_queuedEarlyTasks[i]);
+            m_workerThread->runLoop().postTask(m_queuedEarlyTasks[i]);
         m_queuedEarlyTasks.clear();
     }
 }
@@ -250,9 +281,9 @@ void WorkerMessagingProxy::workerObjectDestroyed()
 {
     m_workerObject = 0;
     if (m_workerThread)
-        terminate();
+        terminateWorkerContext();
     else
-        workerContextDestroyedInternal(); // It never existed, just do our cleanup.
+        workerContextDestroyedInternal();
 }
 
 void WorkerMessagingProxy::workerContextDestroyed()
@@ -265,11 +296,13 @@ void WorkerMessagingProxy::workerContextDestroyedInternal()
 {
     // WorkerContextDestroyedTask is always the last to be performed, so the proxy is not needed for communication
     // in either side any more. However, the Worker object may still exist, and it assumes that the proxy exists, too.
+    m_askedToTerminate = true;
+    m_workerThread = 0;
     if (!m_workerObject)
         delete this;
 }
 
-void WorkerMessagingProxy::terminate()
+void WorkerMessagingProxy::terminateWorkerContext()
 {
     if (m_askedToTerminate)
         return;
@@ -279,19 +312,19 @@ void WorkerMessagingProxy::terminate()
         m_workerThread->stop();
 }
 
-void WorkerMessagingProxy::confirmWorkerThreadMessage(bool hasPendingActivity)
+void WorkerMessagingProxy::confirmMessageFromWorkerObject(bool hasPendingActivity)
 {
     m_scriptExecutionContext->postTask(WorkerThreadActivityReportTask::create(this, true, hasPendingActivity));
-    // Will execute reportWorkerThreadActivityInternal() on context's thread.
+    // Will execute reportPendingActivityInternal() on context's thread.
 }
 
-void WorkerMessagingProxy::reportWorkerThreadActivity(bool hasPendingActivity)
+void WorkerMessagingProxy::reportPendingActivity(bool hasPendingActivity)
 {
     m_scriptExecutionContext->postTask(WorkerThreadActivityReportTask::create(this, false, hasPendingActivity));
-    // Will execute reportWorkerThreadActivityInternal() on context's thread.
+    // Will execute reportPendingActivityInternal() on context's thread.
 }
 
-void WorkerMessagingProxy::reportWorkerThreadActivityInternal(bool confirmingMessage, bool hasPendingActivity)
+void WorkerMessagingProxy::reportPendingActivityInternal(bool confirmingMessage, bool hasPendingActivity)
 {
     if (confirmingMessage && !m_askedToTerminate) {
         ASSERT(m_unconfirmedMessageCount);
@@ -301,7 +334,7 @@ void WorkerMessagingProxy::reportWorkerThreadActivityInternal(bool confirmingMes
     m_workerThreadHadPendingActivity = hasPendingActivity;
 }
 
-bool WorkerMessagingProxy::workerThreadHasPendingActivity() const
+bool WorkerMessagingProxy::hasPendingActivity() const
 {
     return (m_unconfirmedMessageCount || m_workerThreadHadPendingActivity) && !m_askedToTerminate;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerMessagingProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
index c004940dca..8d81deb54c 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerMessagingProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
@@ -29,6 +29,9 @@
 
 #if ENABLE(WORKERS)
 
+#include "ScriptExecutionContext.h"
+#include "WorkerContextProxy.h"
+#include "WorkerObjectProxy.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -39,40 +42,48 @@ namespace WebCore {
     class ScriptExecutionContext;
     class String;
     class Worker;
-    class WorkerTask;
     class WorkerThread;
 
-    class WorkerMessagingProxy : Noncopyable {
+    class WorkerMessagingProxy : public WorkerContextProxy, public WorkerObjectProxy, Noncopyable {
     public:
-        WorkerMessagingProxy(PassRefPtr<ScriptExecutionContext>, Worker*);
-
-        void postMessageToWorkerObject(const String& message);
-        void postMessageToWorkerContext(const String& message);
-
-        void postWorkerException(const String& errorMessage, int lineNumber, const String& sourceURL);
+        WorkerMessagingProxy(Worker*);
+
+        // Implementations of WorkerContextProxy.
+        // (Only use these methods in the worker object thread.)
+        virtual void startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode);
+        virtual void terminateWorkerContext();
+        virtual void postMessageToWorkerContext(const String& message);
+        virtual bool hasPendingActivity() const;
+        virtual void workerObjectDestroyed();
+
+        // Implementations of WorkerObjectProxy.
+        // (Only use these methods in the worker context thread.)
+        virtual void postMessageToWorkerObject(const String& message);
+        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
+        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
+        virtual void confirmMessageFromWorkerObject(bool hasPendingActivity);
+        virtual void reportPendingActivity(bool hasPendingActivity);
+        virtual void workerContextDestroyed();
+
+        void postTaskToWorkerObject(PassRefPtr<ScriptExecutionContext::Task>);
+        void postTaskToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>);
+        void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
 
         void workerThreadCreated(PassRefPtr<WorkerThread>);
-        void workerObjectDestroyed();
-        void workerContextDestroyed();
-
-        void terminate();
 
-        void confirmWorkerThreadMessage(bool hasPendingActivity);
-        void reportWorkerThreadActivity(bool hasPendingActivity);
-        bool workerThreadHasPendingActivity() const;
+        // Only use this method on the worker object thread.
+        bool askedToTerminate() const { return m_askedToTerminate; }
 
     private:
         friend class MessageWorkerTask;
         friend class WorkerContextDestroyedTask;
-        friend class WorkerExceptionTask;
         friend class WorkerThreadActivityReportTask;
 
-        ~WorkerMessagingProxy();
+        virtual ~WorkerMessagingProxy();
 
         void workerContextDestroyedInternal();
-        void reportWorkerThreadActivityInternal(bool confirmingMessage, bool hasPendingActivity);
+        void reportPendingActivityInternal(bool confirmingMessage, bool hasPendingActivity);
         Worker* workerObject() const { return m_workerObject; }
-        bool askedToTerminate() { return m_askedToTerminate; }
 
         RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
         Worker* m_workerObject;
@@ -83,7 +94,7 @@ namespace WebCore {
 
         bool m_askedToTerminate;
 
-        Vector<RefPtr<WorkerTask> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
+        Vector<RefPtr<ScriptExecutionContext::Task> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
new file mode 100644
index 0000000000..3b86028d4a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerObjectProxy_h
+#define WorkerObjectProxy_h
+
+#if ENABLE(WORKERS)
+
+#include "Console.h"
+
+namespace WebCore {
+
+    class String;
+
+    // A proxy to talk to the worker object.
+    class WorkerObjectProxy {
+    public:
+        virtual ~WorkerObjectProxy() {}
+
+        virtual void postMessageToWorkerObject(const String&) = 0;
+
+        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
+
+        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageLevel, const String& message, int lineNumber, const String& sourceURL) = 0;
+
+        virtual void confirmMessageFromWorkerObject(bool hasPendingActivity) = 0;
+
+        virtual void reportPendingActivity(bool hasPendingActivity) = 0;
+
+        virtual void workerContextDestroyed() = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // WorkerObjectProxy_h
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
new file mode 100644
index 0000000000..1e5e510320
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "ScriptExecutionContext.h"
+#include "SharedTimer.h"
+#include "ThreadGlobalData.h"
+#include "ThreadTimers.h"
+#include "WorkerRunLoop.h"
+#include "WorkerContext.h"
+#include "WorkerThread.h"
+
+namespace WebCore {
+
+class WorkerSharedTimer : public SharedTimer {
+public:
+    WorkerSharedTimer()
+        : m_sharedTimerFunction(0)
+        , m_nextFireTime(0)
+    {
+    }
+
+    // SharedTimer interface.
+    virtual void setFiredFunction(void (*function)()) { m_sharedTimerFunction = function; }
+    virtual void setFireTime(double fireTime) { m_nextFireTime = fireTime; }
+    virtual void stop() { m_nextFireTime = 0; }
+
+    bool isActive() { return m_sharedTimerFunction && m_nextFireTime; }
+    double fireTime() { return m_nextFireTime; }
+    void fire() { m_sharedTimerFunction(); }
+
+private:
+    void (*m_sharedTimerFunction)();
+    double m_nextFireTime;
+};
+
+class WorkerRunLoop::Task : public RefCounted<Task> {
+public:
+    static PassRefPtr<Task> create(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+    {
+        return adoptRef(new Task(task, mode));
+    }
+
+    const String& mode() const { return m_mode; }
+    void performTask(ScriptExecutionContext* context) { m_task->performTask(context); }
+
+private:
+    Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+        : m_task(task)
+        , m_mode(mode.copy())
+    {
+    }
+
+    RefPtr<ScriptExecutionContext::Task> m_task;
+    String m_mode;
+};
+
+class ModePredicate {
+public:
+    ModePredicate(const String& mode)
+        : m_mode(mode)
+        , m_defaultMode(mode == WorkerRunLoop::defaultMode())
+    {
+    }
+
+    bool isDefaultMode() const
+    {
+        return m_defaultMode;
+    }
+
+    bool operator()(PassRefPtr<WorkerRunLoop::Task> task) const
+    {
+        return m_defaultMode || m_mode == task->mode();
+    }
+
+private:
+    String m_mode;
+    bool m_defaultMode;
+};
+
+WorkerRunLoop::WorkerRunLoop()
+    : m_sharedTimer(new WorkerSharedTimer)
+    , m_nestedCount(0)
+    , m_uniqueId(0)
+{
+}
+
+WorkerRunLoop::~WorkerRunLoop()
+{
+    ASSERT(!m_nestedCount);
+}
+
+String WorkerRunLoop::defaultMode()
+{
+    return String();
+}
+
+class RunLoopSetup : Noncopyable
+{
+public:
+    RunLoopSetup(WorkerRunLoop& runLoop)
+        : m_runLoop(runLoop)
+    {
+        if (!m_runLoop.m_nestedCount)
+            threadGlobalData().threadTimers().setSharedTimer(m_runLoop.m_sharedTimer.get());
+        m_runLoop.m_nestedCount++;
+    }
+
+    ~RunLoopSetup()
+    {
+        m_runLoop.m_nestedCount--;
+        if (!m_runLoop.m_nestedCount)
+            threadGlobalData().threadTimers().setSharedTimer(0);
+    }
+private:
+    WorkerRunLoop& m_runLoop;
+};
+
+void WorkerRunLoop::run(WorkerContext* context)
+{
+    RunLoopSetup setup(*this);
+    ModePredicate modePredicate(defaultMode());
+    MessageQueueWaitResult result;
+    do {
+        result = runInMode(context, modePredicate);
+    } while (result != MessageQueueTerminated);
+}
+
+MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const String& mode)
+{
+    RunLoopSetup setup(*this);
+    ModePredicate modePredicate(mode);
+    MessageQueueWaitResult result = runInMode(context, modePredicate);
+    return result;
+}
+
+MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const ModePredicate& predicate)
+{
+    ASSERT(context);
+    ASSERT(context->thread());
+    ASSERT(context->thread()->threadID() == currentThread());
+
+    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<RefPtr<Task> >::infiniteTime();
+    RefPtr<Task> task;
+    MessageQueueWaitResult result = m_messageQueue.waitForMessageFilteredWithTimeout(task, predicate, absoluteTime);
+
+    switch (result) {
+    case MessageQueueTerminated:
+        break;
+
+    case MessageQueueMessageReceived:
+        task->performTask(context);
+        break;
+
+    case MessageQueueTimeout:
+        m_sharedTimer->fire();
+        break;
+    }
+
+    return result;
+}
+
+void WorkerRunLoop::terminate()
+{
+    m_messageQueue.kill();
+}
+
+void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
+{
+    postTaskForMode(task, defaultMode());
+}
+
+void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    m_messageQueue.append(Task::create(task, mode.copy()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.h b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.h
new file mode 100644
index 0000000000..5f74f01aa7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerRunLoop_h
+#define WorkerRunLoop_h
+
+#if ENABLE(WORKERS)
+
+#include "ScriptExecutionContext.h"
+#include <wtf/MessageQueue.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class ModePredicate;
+    class WorkerContext;
+    class WorkerSharedTimer;
+
+    class WorkerRunLoop {
+    public:
+        WorkerRunLoop();
+        ~WorkerRunLoop();
+        
+        // Blocking call. Waits for tasks and timers, invokes the callbacks.
+        void run(WorkerContext*);
+
+        // Waits for a single task and returns.
+        MessageQueueWaitResult runInMode(WorkerContext*, const String& mode);
+
+        void terminate();
+        bool terminated() { return m_messageQueue.killed(); }
+
+        void postTask(PassRefPtr<ScriptExecutionContext::Task>);
+        void postTaskForMode(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+
+        unsigned long createUniqueId() { return ++m_uniqueId; }
+
+        static String defaultMode();
+        class Task;
+    private:
+        friend class RunLoopSetup;
+        MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&);
+
+        MessageQueue<RefPtr<Task> > m_messageQueue;
+        OwnPtr<WorkerSharedTimer> m_sharedTimer;
+        int m_nestedCount;
+        unsigned long m_uniqueId;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // WorkerRunLoop_h
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
index d2c493315c..d1026b15ea 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerThread.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
@@ -34,10 +34,8 @@
 #include "PlatformString.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
-#include "Worker.h"
 #include "WorkerContext.h"
-#include "WorkerMessagingProxy.h"
-#include "WorkerTask.h"
+#include "WorkerObjectProxy.h"
 
 #include <utility>
 #include <wtf/Noncopyable.h>
@@ -64,14 +62,14 @@ WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const St
 {
 }
 
-PassRefPtr<WorkerThread> WorkerThread::create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerMessagingProxy* messagingProxy)
+PassRefPtr<WorkerThread> WorkerThread::create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerObjectProxy* workerObjectProxy)
 {
-    return adoptRef(new WorkerThread(scriptURL, userAgent, sourceCode, messagingProxy));
+    return adoptRef(new WorkerThread(scriptURL, userAgent, sourceCode, workerObjectProxy));
 }
 
-WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerMessagingProxy* messagingProxy)
+WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerObjectProxy* workerObjectProxy)
     : m_threadID(0)
-    , m_messagingProxy(messagingProxy)
+    , m_workerObjectProxy(workerObjectProxy)
     , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode))
 {
 }
@@ -88,7 +86,7 @@ bool WorkerThread::start()
     if (m_threadID)
         return true;
 
-    m_threadID = createThread(WorkerThread::workerThreadStart, this, "WebCore::Worker");
+    m_threadID = createThread(WorkerThread::workerThreadStart, this, "WebCore: Worker");
 
     return m_threadID;
 }
@@ -103,6 +101,11 @@ void* WorkerThread::workerThread()
     {
         MutexLocker lock(m_threadCreationMutex);
         m_workerContext = WorkerContext::create(m_startupData->m_scriptURL, m_startupData->m_userAgent, this);
+        if (m_runLoop.terminated()) {
+            // The worker was terminated before the thread had a chance to run. Since the context didn't exist yet, 
+            // forbidExecution() couldn't be called from stop().
+           m_workerContext->script()->forbidExecution();
+        }
     }
 
     WorkerScriptController* script = m_workerContext->script();
@@ -112,18 +115,14 @@ void* WorkerThread::workerThread()
     // WorkerThread::~WorkerThread happens on a different thread where it was created.
     m_startupData.clear();
 
-    m_messagingProxy->confirmWorkerThreadMessage(m_workerContext->hasPendingActivity()); // This wasn't really a message, but it counts as one for GC.
+    m_workerObjectProxy->reportPendingActivity(m_workerContext->hasPendingActivity());
 
-    while (true) {
-        RefPtr<WorkerTask> task;
-        if (!m_messageQueue.waitForMessage(task))
-            break;
-
-        task->performTask(m_workerContext.get());
-    }
+    // Blocks until terminated.
+    m_runLoop.run(m_workerContext.get());
 
     ThreadIdentifier threadID = m_threadID;
 
+    m_workerContext->stopActiveDOMObjects();
     m_workerContext->clearScript();
     ASSERT(m_workerContext->hasOneRef());
     // The below assignment will destroy the context, which will in turn notify messaging proxy.
@@ -146,7 +145,7 @@ void WorkerThread::stop()
         m_workerContext->script()->forbidExecution();
 
     // FIXME: Rudely killing the thread won't work when we allow nested workers, because they will try to post notifications of their destruction.
-    m_messageQueue.kill();
+    m_runLoop.terminate();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/WorkerThread.h b/src/3rdparty/webkit/WebCore/workers/WorkerThread.h
index 07e3e8ade9..f1a8a524a7 100644
--- a/src/3rdparty/webkit/WebCore/dom/WorkerThread.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerThread.h
@@ -29,7 +29,7 @@
 
 #if ENABLE(WORKERS)
 
-#include <wtf/MessageQueue.h>
+#include "WorkerRunLoop.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -39,36 +39,34 @@ namespace WebCore {
     class KURL;
     class String;
     class WorkerContext;
-    class WorkerMessagingProxy;
-    class WorkerTask;
-    class WorkerThreadStartupData;
+    class WorkerObjectProxy;
+    struct WorkerThreadStartupData;
 
     class WorkerThread : public RefCounted<WorkerThread> {
     public:
-        static PassRefPtr<WorkerThread> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerMessagingProxy*);
+        static PassRefPtr<WorkerThread> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerObjectProxy*);
         ~WorkerThread();
 
         bool start();
         void stop();
 
         ThreadIdentifier threadID() const { return m_threadID; }
-        MessageQueue<RefPtr<WorkerTask> >& messageQueue() { return m_messageQueue; }
-
-        WorkerMessagingProxy* messagingProxy() const { return m_messagingProxy; }
+        WorkerRunLoop& runLoop() { return m_runLoop; }
+        WorkerObjectProxy* workerObjectProxy() const { return m_workerObjectProxy; }
 
     private:
-        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerMessagingProxy*);
+        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerObjectProxy*);
 
         static void* workerThreadStart(void*);
         void* workerThread();
 
         ThreadIdentifier m_threadID;
-        WorkerMessagingProxy* m_messagingProxy;
+        WorkerRunLoop m_runLoop;
+        WorkerObjectProxy* m_workerObjectProxy;
 
         RefPtr<WorkerContext> m_workerContext;
         Mutex m_threadCreationMutex;
 
-        MessageQueue<RefPtr<WorkerTask> > m_messageQueue;
         OwnPtr<WorkerThreadStartupData> m_startupData;
     };
 
@@ -77,3 +75,4 @@ namespace WebCore {
 #endif // ENABLE(WORKERS)
 
 #endif // WorkerThread_h
+
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
index cc92c2a70e..a837c8c424 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
@@ -23,32 +23,27 @@
 #include "XMLHttpRequest.h"
 
 #include "CString.h"
-#include "Console.h"
+#include "CrossOriginAccessControl.h"
+#include "CrossOriginPreflightResultCache.h"
 #include "DOMImplementation.h"
-#include "DOMWindow.h"
+#include "Document.h"
 #include "Event.h"
 #include "EventException.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "File.h"
-#include "Frame.h"
-#include "FrameLoader.h"
 #include "HTTPParsers.h"
-#include "InspectorController.h"
-#include "KURL.h"
-#include "KURLHash.h"
-#include "Page.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "SubresourceLoader.h"
-#include "SystemTime.h"
 #include "TextResourceDecoder.h"
+#include "ThreadableLoader.h"
 #include "XMLHttpRequestException.h"
 #include "XMLHttpRequestProgressEvent.h"
 #include "XMLHttpRequestUpload.h"
 #include "markup.h"
-#include <wtf/Noncopyable.h>
 #include <wtf/StdLibExtras.h>
-#include <wtf/Threading.h>
 
 #if USE(JSC)
 #include "JSDOMWindow.h"
@@ -56,14 +51,11 @@
 
 namespace WebCore {
 
-typedef HashSet<String, CaseFoldingHash> HeadersSet;
-
 struct XMLHttpRequestStaticData {
     XMLHttpRequestStaticData();
     String m_proxyHeaderPrefix;
     String m_secHeaderPrefix;
     HashSet<String, CaseFoldingHash> m_forbiddenRequestHeaders;
-    HashSet<String, CaseFoldingHash> m_allowedCrossSiteResponseHeaders;
 };
 
 XMLHttpRequestStaticData::XMLHttpRequestStaticData()
@@ -72,76 +64,25 @@ XMLHttpRequestStaticData::XMLHttpRequestStaticData()
 {
     m_forbiddenRequestHeaders.add("accept-charset");
     m_forbiddenRequestHeaders.add("accept-encoding");
+    m_forbiddenRequestHeaders.add("access-control-request-headers");
+    m_forbiddenRequestHeaders.add("access-control-request-method");
     m_forbiddenRequestHeaders.add("connection");
     m_forbiddenRequestHeaders.add("content-length");
     m_forbiddenRequestHeaders.add("content-transfer-encoding");
+    m_forbiddenRequestHeaders.add("cookie");
+    m_forbiddenRequestHeaders.add("cookie2");
     m_forbiddenRequestHeaders.add("date");
     m_forbiddenRequestHeaders.add("expect");
     m_forbiddenRequestHeaders.add("host");
     m_forbiddenRequestHeaders.add("keep-alive");
+    m_forbiddenRequestHeaders.add("origin");
     m_forbiddenRequestHeaders.add("referer");
     m_forbiddenRequestHeaders.add("te");
     m_forbiddenRequestHeaders.add("trailer");
     m_forbiddenRequestHeaders.add("transfer-encoding");
     m_forbiddenRequestHeaders.add("upgrade");
+    m_forbiddenRequestHeaders.add("user-agent");
     m_forbiddenRequestHeaders.add("via");
-
-    m_allowedCrossSiteResponseHeaders.add("cache-control");
-    m_allowedCrossSiteResponseHeaders.add("content-language");
-    m_allowedCrossSiteResponseHeaders.add("content-type");
-    m_allowedCrossSiteResponseHeaders.add("expires");
-    m_allowedCrossSiteResponseHeaders.add("last-modified");
-    m_allowedCrossSiteResponseHeaders.add("pragma");
-}
-
-class PreflightResultCacheItem : Noncopyable {
-public:
-    PreflightResultCacheItem(bool credentials)
-        : m_absoluteExpiryTime(0)
-        , m_credentials(credentials)
-    {
-    }
-
-    bool parse(const ResourceResponse&);
-    bool allowsCrossSiteMethod(const String&) const;
-    bool allowsCrossSiteHeaders(const HTTPHeaderMap&) const;
-    bool allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const;
-
-private:
-    template<class HashType>
-    static void addToAccessControlAllowList(const String& string, unsigned start, unsigned end, HashSet<String, HashType>&);
-    template<class HashType>
-    static bool parseAccessControlAllowList(const String& string, HashSet<String, HashType>&);
-    static bool parseAccessControlMaxAge(const String& string, unsigned& expiryDelta);
-
-    // FIXME: A better solution to holding onto the absolute expiration time might be
-    // to start a timer for the expiration delta, that removes this from the cache when
-    // it fires.
-    double m_absoluteExpiryTime;
-    bool m_credentials;
-    HashSet<String> m_methods;
-    HeadersSet m_headers;
-};
-
-class PreflightResultCache : Noncopyable {
-public:
-    static PreflightResultCache& shared();
-
-    void appendEntry(const String& origin, const KURL&, PreflightResultCacheItem*);
-    bool canSkipPreflight(const String& origin, const KURL&, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders);
-
-private:
-    PreflightResultCache() { }
-
-    typedef HashMap<std::pair<String, KURL>, PreflightResultCacheItem*> PreflightResultHashMap;
-
-    PreflightResultHashMap m_preflightHashMap;
-    Mutex m_mutex;
-};
-
-static bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name)
-{
-    return equalIgnoringCase(name, "accept") || equalIgnoringCase(name, "accept-language") || equalIgnoringCase(name, "content-type");
 }
 
 // Determines if a string is a valid token, as defined by
@@ -178,131 +119,6 @@ static bool isSetCookieHeader(const AtomicString& name)
     return equalIgnoringCase(name, "set-cookie") || equalIgnoringCase(name, "set-cookie2");
 }
 
-template<class HashType>
-void PreflightResultCacheItem::addToAccessControlAllowList(const String& string, unsigned start, unsigned end, HashSet<String, HashType>& set)
-{
-    StringImpl* stringImpl = string.impl();
-    if (!stringImpl)
-        return;
-
-    // Skip white space from start.
-    while (start <= end && isSpaceOrNewline((*stringImpl)[start]))
-        start++;
-
-    // only white space
-    if (start > end) 
-        return;
-
-    // Skip white space from end.
-    while (end && isSpaceOrNewline((*stringImpl)[end]))
-        end--;
-
-    // substringCopy() is called on the strings because the cache is accessed on multiple threads.
-    set.add(string.substringCopy(start, end - start + 1));
-}
-
-
-template<class HashType>
-bool PreflightResultCacheItem::parseAccessControlAllowList(const String& string, HashSet<String, HashType>& set)
-{
-    int start = 0;
-    int end;
-    while ((end = string.find(',', start)) != -1) {
-        if (start == end)
-            return false;
-
-        addToAccessControlAllowList(string, start, end - 1, set);
-        start = end + 1;
-    }
-    if (start != static_cast<int>(string.length()))
-        addToAccessControlAllowList(string, start, string.length() - 1, set);
-
-    return true;
-}
-
-bool PreflightResultCacheItem::parseAccessControlMaxAge(const String& string, unsigned& expiryDelta)
-{
-    // FIXME: this will not do the correct thing for a number starting with a '+'
-    bool ok = false;
-    expiryDelta = string.toUIntStrict(&ok);
-    return ok;
-}
-
-bool PreflightResultCacheItem::parse(const ResourceResponse& response)
-{
-    m_methods.clear();
-    if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Methods"), m_methods))
-        return false;
-
-    m_headers.clear();
-    if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Headers"), m_headers))
-        return false;
-
-    unsigned expiryDelta = 0;
-    if (!parseAccessControlMaxAge(response.httpHeaderField("Access-Control-Max-Age"), expiryDelta))
-        expiryDelta = 5;
-
-    m_absoluteExpiryTime = currentTime() + expiryDelta;
-    return true;
-}
-
-bool PreflightResultCacheItem::allowsCrossSiteMethod(const String& method) const
-{
-    return m_methods.contains(method) || method == "GET" || method == "POST";
-}
-
-bool PreflightResultCacheItem::allowsCrossSiteHeaders(const HTTPHeaderMap& requestHeaders) const
-{
-    HTTPHeaderMap::const_iterator end = requestHeaders.end();
-    for (HTTPHeaderMap::const_iterator it = requestHeaders.begin(); it != end; ++it) {
-        if (!m_headers.contains(it->first) && !isOnAccessControlSimpleRequestHeaderWhitelist(it->first))
-            return false;
-    }
-    return true;
-}
-
-bool PreflightResultCacheItem::allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const
-{
-    if (m_absoluteExpiryTime < currentTime())
-        return false;
-    if (includeCredentials && !m_credentials)
-        return false;
-    if (!allowsCrossSiteMethod(method))
-        return false;
-    if (!allowsCrossSiteHeaders(requestHeaders))
-        return false;
-    return true;
-}
-
-PreflightResultCache& PreflightResultCache::shared()
-{
-    AtomicallyInitializedStatic(PreflightResultCache&, cache = *new PreflightResultCache);
-    return cache;
-}
-
-void PreflightResultCache::appendEntry(const String& origin, const KURL& url, PreflightResultCacheItem* preflightResult)
-{
-    MutexLocker lock(m_mutex);
-    // Note that the entry may already be present in the HashMap if another thread is accessing the same location.
-    m_preflightHashMap.set(std::make_pair(origin.copy(), url.copy()), preflightResult);
-}
-
-bool PreflightResultCache::canSkipPreflight(const String& origin, const KURL& url, bool includeCredentials,
-                                            const String& method, const HTTPHeaderMap& requestHeaders)
-{
-    MutexLocker lock(m_mutex);
-    PreflightResultHashMap::iterator cacheIt = m_preflightHashMap.find(std::make_pair(origin, url));
-    if (cacheIt == m_preflightHashMap.end())
-        return false;
-
-    if (cacheIt->second->allowsRequest(includeCredentials, method, requestHeaders))
-        return true;
-
-    delete cacheIt->second;
-    m_preflightHashMap.remove(cacheIt);
-    return false;
-}
-
 static const XMLHttpRequestStaticData* staticData = 0;
 
 static const XMLHttpRequestStaticData* createXMLHttpRequestStaticData()
@@ -318,12 +134,11 @@ static const XMLHttpRequestStaticData* initializeXMLHttpRequestStaticData()
     return dummy;
 }
 
-XMLHttpRequest::XMLHttpRequest(Document* doc)
-    : ActiveDOMObject(doc, this)
+XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context)
+    : ActiveDOMObject(context, this)
     , m_async(true)
     , m_includeCredentials(false)
     , m_state(UNSENT)
-    , m_identifier(std::numeric_limits<unsigned long>::max())
     , m_responseText("")
     , m_createdDocument(false)
     , m_error(false)
@@ -332,8 +147,8 @@ XMLHttpRequest::XMLHttpRequest(Document* doc)
     , m_inPreflight(false)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
+    , m_exceptionCode(0)
 {
-    ASSERT(document());
     initializeXMLHttpRequestStaticData();
 }
 
@@ -349,6 +164,16 @@ Document* XMLHttpRequest::document() const
     return static_cast<Document*>(scriptExecutionContext());
 }
 
+#if ENABLE(DASHBOARD_SUPPORT)
+bool XMLHttpRequest::usesDashboardBackwardCompatibilityMode() const
+{
+    if (scriptExecutionContext()->isWorkerContext())
+        return false;
+    Settings* settings = document()->settings();
+    return settings && settings->usesDashboardBackwardCompatibilityMode();
+}
+#endif
+
 XMLHttpRequest::State XMLHttpRequest::readyState() const
 {
     return m_state;
@@ -372,7 +197,7 @@ Document* XMLHttpRequest::responseXML() const
             m_responseXML = document()->implementation()->createDocument(0);
             m_responseXML->open();
             m_responseXML->setURL(m_url);
-            // FIXME: set Last-Modified and cookies (currently, those are only available for HTMLDocuments).
+            // FIXME: Set Last-Modified.
             m_responseXML->write(String(m_responseText));
             m_responseXML->finishParsing();
             m_responseXML->close();
@@ -458,10 +283,20 @@ void XMLHttpRequest::callReadyStateChangeListener()
 
     dispatchReadyStateChangeEvent();
 
-    if (m_state == DONE)
+    if (m_state == DONE && !m_error)
         dispatchLoadEvent();
 }
 
+void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)
+{
+    if (m_state != OPENED || m_loader) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    m_includeCredentials = value;
+}
+
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionCode& ec)
 {
     internalAbort();
@@ -555,12 +390,11 @@ void XMLHttpRequest::send(Document* document, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && (m_url.protocolIs("http") || m_url.protocolIs("https"))) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
-            Settings* settings = document->settings();
-            if (settings && settings->usesDashboardBackwardCompatibilityMode())
+            if (usesDashboardBackwardCompatibilityMode())
                 setRequestHeaderInternal("Content-Type", "application/x-www-form-urlencoded");
             else
 #endif
@@ -587,12 +421,11 @@ void XMLHttpRequest::send(const String& body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && (m_url.protocolIs("http") || m_url.protocolIs("https"))) {
+    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
-            Settings* settings = document()->settings();
-            if (settings && settings->usesDashboardBackwardCompatibilityMode())
+            if (usesDashboardBackwardCompatibilityMode())
                 setRequestHeaderInternal("Content-Type", "application/x-www-form-urlencoded");
             else
 #endif
@@ -612,7 +445,7 @@ void XMLHttpRequest::send(File* body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && (m_url.protocolIs("http") || m_url.protocolIs("https"))) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
         // FIXME: Should we set a Content-Type if one is not set.
         // FIXME: add support for uploading bundles.
         m_requestEntityBody = FormData::create();
@@ -624,19 +457,28 @@ void XMLHttpRequest::send(File* body, ExceptionCode& ec)
 
 void XMLHttpRequest::createRequest(ExceptionCode& ec)
 {
+    // Upload event listeners should be disallowed for simple cross-origin requests, because POSTing to an URL that does not
+    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all. If a listener exists
+    // when creating the request, it will force preflight.
+    // Also, only async requests support upload progress events.
+    m_uploadEventsAllowed = false;
     if (m_async) {
         dispatchLoadStartEvent();
-        if (m_requestEntityBody && m_upload)
+        if (m_requestEntityBody && m_upload) {
+            m_uploadEventsAllowed = m_upload->hasListeners();
             m_upload->dispatchLoadStartEvent();
+        }
     }
 
     m_sameOriginRequest = scriptExecutionContext()->securityOrigin()->canRequest(m_url);
 
     if (!m_sameOriginRequest) {
-        makeCrossSiteAccessRequest(ec);
+        makeCrossOriginAccessRequest(ec);
         return;
     }
 
+    m_uploadEventsAllowed = true;
+
     makeSameOriginRequest(ec);
 }
 
@@ -649,6 +491,7 @@ void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
 
     if (m_requestEntityBody) {
         ASSERT(m_method != "GET");
+        ASSERT(m_method != "HEAD");
         request.setHTTPBody(m_requestEntityBody.release());
     }
 
@@ -661,38 +504,31 @@ void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
         loadRequestSynchronously(request, ec);
 }
 
-bool XMLHttpRequest::isSimpleCrossSiteAccessRequest() const
-{
-    if (m_method != "GET" && m_method != "POST")
-        return false;
-
-    HTTPHeaderMap::const_iterator end = m_requestHeaders.end();
-    for (HTTPHeaderMap::const_iterator it = m_requestHeaders.begin(); it != end; ++it) {
-        if (!isOnAccessControlSimpleRequestHeaderWhitelist(it->first))
-            return false;
-    }
-
-    return true;
-}
-
-void XMLHttpRequest::makeCrossSiteAccessRequest(ExceptionCode& ec)
+void XMLHttpRequest::makeCrossOriginAccessRequest(ExceptionCode& ec)
 {
     ASSERT(!m_sameOriginRequest);
 
-    if (isSimpleCrossSiteAccessRequest())
-        makeSimpleCrossSiteAccessRequest(ec);
+    if (!m_uploadEventsAllowed && isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders))
+        makeSimpleCrossOriginAccessRequest(ec);
     else
-        makeCrossSiteAccessRequestWithPreflight(ec);
+        makeCrossOriginAccessRequestWithPreflight(ec);
 }
 
-void XMLHttpRequest::makeSimpleCrossSiteAccessRequest(ExceptionCode& ec)
+void XMLHttpRequest::makeSimpleCrossOriginAccessRequest(ExceptionCode& ec)
 {
-    ASSERT(isSimpleCrossSiteAccessRequest());
+    ASSERT(isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders));
+
+    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
+    if (!m_url.protocolInHTTPFamily()) {
+        ec = XMLHttpRequestException::NETWORK_ERR;
+        networkError();
+        return;
+    }
 
     KURL url = m_url;
     url.setUser(String());
     url.setPass(String());
- 
+
     ResourceRequest request(url);
     request.setHTTPMethod(m_method);
     request.setAllowHTTPCookies(m_includeCredentials);
@@ -701,20 +537,26 @@ void XMLHttpRequest::makeSimpleCrossSiteAccessRequest(ExceptionCode& ec)
     if (m_requestHeaders.size() > 0)
         request.addHTTPHeaderFields(m_requestHeaders);
 
+    if (m_requestEntityBody) {
+        ASSERT(m_method != "GET");
+        ASSERT(m_method != "HEAD");
+        request.setHTTPBody(m_requestEntityBody.release());
+    }
+
     if (m_async)
         loadRequestAsynchronously(request);
     else
         loadRequestSynchronously(request, ec);
 }
 
-void XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight(ExceptionCode& ec)
+void XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight(ExceptionCode& ec)
 {
     String origin = scriptExecutionContext()->securityOrigin()->toString();
     KURL url = m_url;
     url.setUser(String());
     url.setPass(String());
 
-    if (!PreflightResultCache::shared().canSkipPreflight(origin, url, m_includeCredentials, m_method, m_requestHeaders)) {
+    if (!CrossOriginPreflightResultCache::shared().canSkipPreflight(origin, url, m_includeCredentials, m_method, m_requestHeaders)) {
         m_inPreflight = true;
         ResourceRequest preflightRequest(url);
         preflightRequest.setHTTPMethod("OPTIONS");
@@ -739,6 +581,7 @@ void XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight(ExceptionCode& ec)
         }
 
         if (m_async) {
+            m_uploadEventsAllowed = true;
             loadRequestAsynchronously(preflightRequest);
             return;
         }
@@ -761,10 +604,12 @@ void XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight(ExceptionCode& ec)
 
     if (m_requestEntityBody) {
         ASSERT(m_method != "GET");
+        ASSERT(m_method != "HEAD");
         request.setHTTPBody(m_requestEntityBody.release());
     }
 
     if (m_async) {
+        m_uploadEventsAllowed = true;
         loadRequestAsynchronously(request);
         return;
     }
@@ -793,53 +638,43 @@ void XMLHttpRequest::handleAsynchronousPreflightResult()
 
     if (m_requestEntityBody) {
         ASSERT(m_method != "GET");
+        ASSERT(m_method != "HEAD");
         request.setHTTPBody(m_requestEntityBody.release());
     }
 
+    m_uploadEventsAllowed = true;
     loadRequestAsynchronously(request);
 }
 
 void XMLHttpRequest::loadRequestSynchronously(ResourceRequest& request, ExceptionCode& ec)
 {
     ASSERT(!m_async);
-    Vector<char> data;
-    ResourceError error;
-    ResourceResponse response;
-
-    if (document()->frame())
-        m_identifier = document()->frame()->loader()->loadResourceSynchronously(request, error, response, data);
 
     m_loader = 0;
+    m_exceptionCode = 0;
+    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
 
-    // No exception for file:/// resources, see <rdar://problem/4962298>.
-    // Also, if we have an HTTP response, then it wasn't a network error in fact.
-    if (error.isNull() || request.url().isLocalFile() || response.httpStatusCode() > 0) {
-        processSyncLoadResults(data, response, ec);
-        return;
-    }
-
-    if (error.isCancellation()) {
-        abortError();
-        ec = XMLHttpRequestException::ABORT_ERR;
-        return;
-    }
-
-    networkError();
-    ec = XMLHttpRequestException::NETWORK_ERR;
+    ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, storedCredentials);
+    if (!m_exceptionCode && m_error)
+        m_exceptionCode = XMLHttpRequestException::NETWORK_ERR;
+    ec = m_exceptionCode;
 }
 
-
 void XMLHttpRequest::loadRequestAsynchronously(ResourceRequest& request)
 {
     ASSERT(m_async);
+    m_exceptionCode = 0;
     // SubresourceLoader::create can return null here, for example if we're no longer attached to a page.
     // This is true while running onunload handlers.
     // FIXME: We need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
     // FIXME: Maybe create can return null for other reasons too?
-    // We need to keep content sniffing enabled for local files due to CFNetwork not providing a MIME type
-    // for local files otherwise, <rdar://problem/5671813>.
-    bool sendResourceLoadCallbacks = !m_inPreflight;
-    m_loader = SubresourceLoader::create(document()->frame(), this, request, false, sendResourceLoadCallbacks, request.url().isLocalFile());
+    LoadCallbacks callbacks = m_inPreflight ? DoNotSendLoadCallbacks : SendLoadCallbacks;
+    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
+
+    if (m_upload)
+        request.setReportUploadProgress(true);
+
+    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, callbacks, DoNotSniffContent, storedCredentials);
 
     if (m_loader) {
         // Neither this object nor the JavaScript wrapper should be deleted while
@@ -863,7 +698,7 @@ void XMLHttpRequest::abort()
     
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
         m_state = UNSENT;
-     else {
+    else {
         ASSERT(!m_loader);
         changeState(DONE);
         m_state = UNSENT;
@@ -872,7 +707,7 @@ void XMLHttpRequest::abort()
     dispatchAbortEvent();
     if (!m_uploadComplete) {
         m_uploadComplete = true;
-        if (m_upload)
+        if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchAbortEvent();
     }
 }
@@ -917,8 +752,7 @@ void XMLHttpRequest::genericError()
     clearRequest();
     m_error = true;
 
-    // The spec says we should "Synchronously switch the state to DONE." and then "Synchronously dispatch a readystatechange event on the object"
-    // but this does not match Firefox.
+    changeState(DONE);
 }
 
 void XMLHttpRequest::networkError()
@@ -927,9 +761,10 @@ void XMLHttpRequest::networkError()
     dispatchErrorEvent();
     if (!m_uploadComplete) {
         m_uploadComplete = true;
-        if (m_upload)
+        if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchErrorEvent();
     }
+    internalAbort();
 }
 
 void XMLHttpRequest::abortError()
@@ -938,7 +773,7 @@ void XMLHttpRequest::abortError()
     dispatchAbortEvent();
     if (!m_uploadComplete) {
         m_uploadComplete = true;
-        if (m_upload)
+        if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchAbortEvent();
     }
 }
@@ -953,11 +788,9 @@ void XMLHttpRequest::dropProtection()
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
 
-    if (JSDOMWindow* window = toJSDOMWindow(document()->frame())) {
-        JSC::JSValuePtr wrapper = getCachedDOMObjectWrapper(*window->globalData(), this);
-        if (wrapper)
-            JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
-    }
+   if (JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext()))
+       if (DOMObject* wrapper = getCachedDOMObjectWrapper(*globalObject->globalData(), this))
+           JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
 #endif
 
     unsetPendingActivity(this);
@@ -968,24 +801,20 @@ void XMLHttpRequest::overrideMimeType(const String& override)
     m_mimeTypeOverride = override;
 }
 
-static void reportUnsafeUsage(Document* document, const String& message)
+static void reportUnsafeUsage(ScriptExecutionContext* context, const String& message)
 {
-    if (!document)
-        return;
-    Frame* frame = document->frame();
-    if (!frame)
+    if (!context)
         return;
-    // It's not good to report the bad usage without indicating what source line it came from.
+    // FIXME: It's not good to report the bad usage without indicating what source line it came from.
     // We should pass additional parameters so we can tell the console where the mistake occurred.
-    frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, 1, String());
+    context->addMessage(ConsoleDestination, JSMessageSource, ErrorMessageLevel, message, 1, String());
 }
 
 void XMLHttpRequest::setRequestHeader(const AtomicString& name, const String& value, ExceptionCode& ec)
 {
     if (m_state != OPENED || m_loader) {
 #if ENABLE(DASHBOARD_SUPPORT)
-        Settings* settings = document() ? document()->settings() : 0;
-        if (settings && settings->usesDashboardBackwardCompatibilityMode())
+        if (usesDashboardBackwardCompatibilityMode())
             return;
 #endif
 
@@ -1000,7 +829,7 @@ void XMLHttpRequest::setRequestHeader(const AtomicString& name, const String& va
 
     // A privileged script (e.g. a Dashboard widget) can set any headers.
     if (!scriptExecutionContext()->securityOrigin()->canLoadLocalResources() && !isSafeRequestHeader(name)) {
-        reportUnsafeUsage(document(), "Refused to set unsafe header \"" + name + "\"");
+        reportUnsafeUsage(scriptExecutionContext(), "Refused to set unsafe header \"" + name + "\"");
         return;
     }
 
@@ -1071,23 +900,18 @@ String XMLHttpRequest::getResponseHeader(const AtomicString& name, ExceptionCode
 
     // See comment in getAllResponseHeaders above.
     if (isSetCookieHeader(name) && !scriptExecutionContext()->securityOrigin()->canLoadLocalResources()) {
-        reportUnsafeUsage(document(), "Refused to get unsafe header \"" + name + "\"");
+        reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
         return "";
     }
 
     if (!m_sameOriginRequest && !isOnAccessControlResponseHeaderWhitelist(name)) {
-        reportUnsafeUsage(document(), "Refused to get unsafe header \"" + name + "\"");
+        reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
         return "";
     }
 
     return m_response.httpHeaderField(name);
 }
 
-bool XMLHttpRequest::isOnAccessControlResponseHeaderWhitelist(const String& name) const
-{
-    return staticData->m_allowedCrossSiteResponseHeaders.contains(name);
-}
-
 String XMLHttpRequest::responseMIMEType() const
 {
     String mimeType = extractMIMETypeFromMediaType(m_mimeTypeOverride);
@@ -1124,76 +948,56 @@ int XMLHttpRequest::status(ExceptionCode& ec) const
 
 String XMLHttpRequest::statusText(ExceptionCode& ec) const
 {
-    // FIXME: <http://bugs.webkit.org/show_bug.cgi?id=3547> XMLHttpRequest.statusText returns always "OK".
-    if (m_response.httpStatusCode())
-        return "OK";
+    if (!m_response.httpStatusText().isNull())
+        return m_response.httpStatusText();
 
     if (m_state == OPENED) {
-        // See comments in getStatus() above.
+        // See comments in status() above.
         ec = INVALID_STATE_ERR;
     }
 
     return String();
 }
 
-void XMLHttpRequest::processSyncLoadResults(const Vector<char>& data, const ResourceResponse& response, ExceptionCode& ec)
-{
-    if (m_sameOriginRequest && !scriptExecutionContext()->securityOrigin()->canRequest(response.url())) {
-        abort();
-        return;
-    }
-    
-    didReceiveResponse(0, response);
-    changeState(HEADERS_RECEIVED);
-
-    const char* bytes = static_cast<const char*>(data.data());
-    int len = static_cast<int>(data.size());
-    didReceiveData(0, bytes, len);
-
-    didFinishLoading(0);
-    if (m_error)
-        ec = XMLHttpRequestException::NETWORK_ERR;
-}
-
-void XMLHttpRequest::didFail(SubresourceLoader*, const ResourceError& error)
+void XMLHttpRequest::didFail(const ResourceError& error)
 {
     // If we are already in an error state, for instance we called abort(), bail out early.
     if (m_error)
         return;
 
     if (error.isCancellation()) {
+        m_exceptionCode = XMLHttpRequestException::ABORT_ERR;
         abortError();
         return;
     }
 
+    m_exceptionCode = XMLHttpRequestException::NETWORK_ERR;
     networkError();
-    return;
 }
 
-void XMLHttpRequest::didFinishLoading(SubresourceLoader* loader)
+void XMLHttpRequest::didFailRedirectCheck()
+{
+    networkError();
+}
+
+void XMLHttpRequest::didFinishLoading(unsigned long identifier)
 {
     if (m_error)
         return;
 
     if (m_inPreflight) {
-        didFinishLoadingPreflight(loader);
+        didFinishLoadingPreflight();
         return;
     }
 
-    ASSERT(loader == m_loader);
-
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
 
     if (m_decoder)
         m_responseText += m_decoder->flush();
 
-    if (Frame* frame = document()->frame()) {
-        if (Page* page = frame->page()) {
-            page->inspectorController()->resourceRetrievedByXMLHttpRequest(m_loader ? m_loader->identifier() : m_identifier, m_responseText);
-            page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageLevel, "XHR finished loading: \"" + m_url + "\".", m_lastSendLineNumber, m_lastSendURL);
-        }
-    }
+    scriptExecutionContext()->resourceRetrievedByXMLHttpRequest(identifier, m_responseText);
+    scriptExecutionContext()->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageLevel, "XHR finished loading: \"" + m_url + "\".", m_lastSendLineNumber, m_lastSendURL);
 
     bool hadLoader = m_loader;
     m_loader = 0;
@@ -1205,7 +1009,7 @@ void XMLHttpRequest::didFinishLoading(SubresourceLoader* loader)
         dropProtection();
 }
 
-void XMLHttpRequest::didFinishLoadingPreflight(SubresourceLoader*)
+void XMLHttpRequest::didFinishLoadingPreflight()
 {
     ASSERT(m_inPreflight);
     ASSERT(!m_sameOriginRequest);
@@ -1218,60 +1022,30 @@ void XMLHttpRequest::didFinishLoadingPreflight(SubresourceLoader*)
         unsetPendingActivity(this);
 }
 
-void XMLHttpRequest::willSendRequest(SubresourceLoader*, ResourceRequest& request, const ResourceResponse&)
-{
-    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
-    if (!scriptExecutionContext()->securityOrigin()->canRequest(request.url())) {
-        internalAbort();
-        networkError();
-    }
-}
-
-void XMLHttpRequest::didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     if (!m_upload)
         return;
 
-    m_upload->dispatchProgressEvent(bytesSent, totalBytesToBeSent);
+    if (m_uploadEventsAllowed)
+        m_upload->dispatchProgressEvent(bytesSent, totalBytesToBeSent);
 
     if (bytesSent == totalBytesToBeSent && !m_uploadComplete) {
         m_uploadComplete = true;
-        m_upload->dispatchLoadEvent();
+        if (m_uploadEventsAllowed)
+            m_upload->dispatchLoadEvent();
     }
 }
 
-bool XMLHttpRequest::accessControlCheck(const ResourceResponse& response)
-{
-    const String& accessControlOriginString = response.httpHeaderField("Access-Control-Origin");
-    if (accessControlOriginString == "*" && !m_includeCredentials)
-        return true;
-
-    KURL accessControlOriginURL(accessControlOriginString);
-    if (!accessControlOriginURL.isValid())
-        return false;
-
-    RefPtr<SecurityOrigin> accessControlOrigin = SecurityOrigin::create(accessControlOriginURL);
-    if (!accessControlOrigin->isSameSchemeHostPort(scriptExecutionContext()->securityOrigin()))
-        return false;
-
-    if (m_includeCredentials) {
-        const String& accessControlCredentialsString = response.httpHeaderField("Access-Control-Credentials");
-        if (accessControlCredentialsString != "true")
-            return false;
-    }
-
-    return true;
-}
-
-void XMLHttpRequest::didReceiveResponse(SubresourceLoader* loader, const ResourceResponse& response)
+void XMLHttpRequest::didReceiveResponse(const ResourceResponse& response)
 {
     if (m_inPreflight) {
-        didReceiveResponsePreflight(loader, response);
+        didReceiveResponsePreflight(response);
         return;
     }
 
     if (!m_sameOriginRequest) {
-        if (!accessControlCheck(response)) {
+        if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
             networkError();
             return;
         }
@@ -1283,43 +1057,35 @@ void XMLHttpRequest::didReceiveResponse(SubresourceLoader* loader, const Resourc
         m_responseEncoding = response.textEncodingName();
 }
 
-void XMLHttpRequest::didReceiveResponsePreflight(SubresourceLoader*, const ResourceResponse& response)
+void XMLHttpRequest::didReceiveResponsePreflight(const ResourceResponse& response)
 {
     ASSERT(m_inPreflight);
     ASSERT(!m_sameOriginRequest);
 
-    if (!accessControlCheck(response)) {
-        networkError();
-        return;
-    }
-
-    OwnPtr<PreflightResultCacheItem> preflightResult(new PreflightResultCacheItem(m_includeCredentials));
-    if (!preflightResult->parse(response))  {
+    if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
         networkError();
         return;
     }
 
-    if (!preflightResult->allowsCrossSiteMethod(m_method)) {
+    OwnPtr<CrossOriginPreflightResultCacheItem> preflightResult(new CrossOriginPreflightResultCacheItem(m_includeCredentials));
+    if (!preflightResult->parse(response)
+        || !preflightResult->allowsCrossOriginMethod(m_method)
+        || !preflightResult->allowsCrossOriginHeaders(m_requestHeaders)) {
         networkError();
         return;
     }
 
-    if (!preflightResult->allowsCrossSiteHeaders(m_requestHeaders)) {
-        networkError();
-        return;
-    }
-
-    PreflightResultCache::shared().appendEntry(scriptExecutionContext()->securityOrigin()->toString(), m_url, preflightResult.release());
+    CrossOriginPreflightResultCache::shared().appendEntry(scriptExecutionContext()->securityOrigin()->toString(), m_url, preflightResult.release());
 }
 
-void XMLHttpRequest::receivedCancellation(SubresourceLoader*, const AuthenticationChallenge& challenge)
+void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse& failureResponse)
 {
-    m_response = challenge.failureResponse();
+    m_response = failureResponse;
 }
 
-void XMLHttpRequest::didReceiveData(SubresourceLoader*, const char* data, int len)
+void XMLHttpRequest::didReceiveData(const char* data, int len)
 {
-    if (m_inPreflight)
+    if (m_inPreflight || m_error)
         return;
 
     if (m_state < HEADERS_RECEIVED)
@@ -1329,14 +1095,17 @@ void XMLHttpRequest::didReceiveData(SubresourceLoader*, const char* data, int le
         if (!m_responseEncoding.isEmpty())
             m_decoder = TextResourceDecoder::create("text/plain", m_responseEncoding);
         // allow TextResourceDecoder to look inside the m_response if it's XML or HTML
-        else if (responseIsXML())
+        else if (responseIsXML()) {
             m_decoder = TextResourceDecoder::create("application/xml");
-        else if (responseMIMEType() == "text/html")
+            // Don't stop on encoding errors, unlike it is done for other kinds of XML resources. This matches the behavior of previous WebKit versions, Firefox and Opera.
+            m_decoder->useLenientXMLDecoding();
+        } else if (responseMIMEType() == "text/html")
             m_decoder = TextResourceDecoder::create("text/html", "UTF-8");
         else
             m_decoder = TextResourceDecoder::create("text/plain", "UTF-8");
     }
-    if (len == 0)
+
+    if (!len)
         return;
 
     if (len == -1)
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
index 858f228a9e..6955c11e4d 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
@@ -26,19 +26,21 @@
 #include "EventTarget.h"
 #include "FormData.h"
 #include "ResourceResponse.h"
-#include "SubresourceLoaderClient.h"
 #include "ScriptString.h"
+#include "ThreadableLoaderClient.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
 class Document;
 class File;
+struct ResourceRequest;
 class TextResourceDecoder;
+class ThreadableLoader;
 
-class XMLHttpRequest : public RefCounted<XMLHttpRequest>, public EventTarget, private SubresourceLoaderClient, public ActiveDOMObject {
+class XMLHttpRequest : public RefCounted<XMLHttpRequest>, public EventTarget, private ThreadableLoaderClient, public ActiveDOMObject {
 public:
-    static PassRefPtr<XMLHttpRequest> create(Document* document) { return adoptRef(new XMLHttpRequest(document)); }
+    static PassRefPtr<XMLHttpRequest> create(ScriptExecutionContext* context) { return adoptRef(new XMLHttpRequest(context)); }
     ~XMLHttpRequest();
 
     // These exact numeric values are important because JS expects them.
@@ -61,6 +63,8 @@ public:
     String statusText(ExceptionCode&) const;
     int status(ExceptionCode&) const;
     State readyState() const;
+    bool withCredentials() const { return m_includeCredentials; }
+    void setWithCredentials(bool, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, const String& user, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, const String& user, const String& password, ExceptionCode&);
@@ -112,26 +116,29 @@ public:
     using RefCounted<XMLHttpRequest>::deref;
 
 private:
-    XMLHttpRequest(Document*);
+    XMLHttpRequest(ScriptExecutionContext*);
     
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
     Document* document() const;
 
-    virtual void willSendRequest(SubresourceLoader*, ResourceRequest& request, const ResourceResponse& redirectResponse);
-    virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
-    virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&);
-    virtual void didReceiveData(SubresourceLoader*, const char* data, int size);
-    virtual void didFail(SubresourceLoader*, const ResourceError&);
-    virtual void didFinishLoading(SubresourceLoader*);
-    virtual void receivedCancellation(SubresourceLoader*, const AuthenticationChallenge&);
+#if ENABLE(DASHBOARD_SUPPORT)
+    bool usesDashboardBackwardCompatibilityMode() const;
+#endif
+
+    virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
+    virtual void didReceiveResponse(const ResourceResponse&);
+    virtual void didReceiveData(const char* data, int lengthReceived);
+    virtual void didFinishLoading(unsigned long identifier);
+    virtual void didFail(const ResourceError&);
+    virtual void didFailRedirectCheck();
+    virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
 
     // Special versions for the preflight
-    void didReceiveResponsePreflight(SubresourceLoader*, const ResourceResponse&);
-    void didFinishLoadingPreflight(SubresourceLoader*);
+    void didReceiveResponsePreflight(const ResourceResponse&);
+    void didFinishLoadingPreflight();
 
-    void processSyncLoadResults(const Vector<char>& data, const ResourceResponse&, ExceptionCode&);
     void updateAndDispatchOnProgress(unsigned int len);
 
     String responseMIMEType() const;
@@ -153,21 +160,15 @@ private:
     void createRequest(ExceptionCode&);
 
     void makeSameOriginRequest(ExceptionCode&);
-    void makeCrossSiteAccessRequest(ExceptionCode&);
+    void makeCrossOriginAccessRequest(ExceptionCode&);
 
-    void makeSimpleCrossSiteAccessRequest(ExceptionCode&);
-    void makeCrossSiteAccessRequestWithPreflight(ExceptionCode&);
+    void makeSimpleCrossOriginAccessRequest(ExceptionCode&);
+    void makeCrossOriginAccessRequestWithPreflight(ExceptionCode&);
     void handleAsynchronousPreflightResult();
 
     void loadRequestSynchronously(ResourceRequest&, ExceptionCode&);
     void loadRequestAsynchronously(ResourceRequest&);
 
-    bool isOnAccessControlResponseHeaderWhitelist(const String&) const;
-
-    bool isSimpleCrossSiteAccessRequest() const;
-    String accessControlOrigin() const;
-    bool accessControlCheck(const ResourceResponse&);
-
     void genericError();
     void networkError();
     void abortError();
@@ -198,16 +199,15 @@ private:
     bool m_async;
     bool m_includeCredentials;
 
-    RefPtr<SubresourceLoader> m_loader;
+    RefPtr<ThreadableLoader> m_loader;
     State m_state;
 
     ResourceResponse m_response;
     String m_responseEncoding;
 
     RefPtr<TextResourceDecoder> m_decoder;
-    unsigned long m_identifier;
 
-    // Unlike most strings in the DOM, we keep this as a JSC::UString, not a WebCore::String.
+    // Unlike most strings in the DOM, we keep this as a ScriptString, not a WebCore::String.
     // That's because these strings can easily get huge (they are filled from the network with
     // no parsing) and because JS can easily observe many intermediate states, so it's very useful
     // to be able to share the buffer with JavaScript versions of the whole or partial string.
@@ -219,6 +219,7 @@ private:
 
     bool m_error;
 
+    bool m_uploadEventsAllowed;
     bool m_uploadComplete;
 
     bool m_sameOriginRequest;
@@ -230,6 +231,7 @@ private:
     
     unsigned m_lastSendLineNumber;
     String m_lastSendURL;
+    ExceptionCode m_exceptionCode;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl
index 315d95c4c4..79005e22b6 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.idl
@@ -29,7 +29,8 @@
 module xml {
 
     interface [
-        CustomMarkFunction
+        CustomMarkFunction,
+        NoStaticTables
     ] XMLHttpRequest {
         // From XMLHttpRequestEventTarget
         // event handler attributes
@@ -52,6 +53,8 @@ module xml {
         readonly attribute unsigned short readyState;
 
         // request
+        attribute boolean withCredentials
+            setter raises(DOMException);
         // void open(in DOMString method, in DOMString url);
         // void open(in DOMString method, in DOMString url, in boolean async);
         // void open(in DOMString method, in DOMString url, in boolean async, in DOMString user);
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl
index 2feb57459e..380e426c75 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestException.idl
@@ -29,14 +29,15 @@
 module xml {
 
     interface [
-        GenerateConstructor
+        GenerateConstructor,
+        NoStaticTables
     ] XMLHttpRequestException {
 
         readonly attribute unsigned short   code;
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl
index 6de9690045..549308babf 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestProgressEvent.idl
@@ -26,7 +26,8 @@
 module events {
 
     interface [
-        GenerateConstructor
+        GenerateConstructor,
+        NoStaticTables
     // We should also inherit from LSProgressEvent when the idl is added.
     ] XMLHttpRequestProgressEvent : ProgressEvent {
          readonly attribute unsigned long   position;
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp
index a58c2716da..d8a76d5f82 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp
@@ -30,7 +30,6 @@
 #include "Event.h"
 #include "EventException.h"
 #include "EventNames.h"
-#include "Frame.h"
 #include "XMLHttpRequest.h"
 #include "XMLHttpRequestProgressEvent.h"
 #include <wtf/Assertions.h>
@@ -42,6 +41,11 @@ XMLHttpRequestUpload::XMLHttpRequestUpload(XMLHttpRequest* xmlHttpRequest)
 {
 }
 
+bool XMLHttpRequestUpload::hasListeners() const
+{
+    return m_onAbortListener || m_onErrorListener || m_onLoadListener || m_onLoadStartListener || m_onProgressListener || !m_eventListeners.isEmpty();
+}
+
 ScriptExecutionContext* XMLHttpRequestUpload::scriptExecutionContext() const
 {
     XMLHttpRequest* xmlHttpRequest = associatedXMLHttpRequest();
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.h b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.h
index 93fa7f9c68..b4f40e04e2 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.h
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.h
@@ -48,6 +48,8 @@ namespace WebCore {
             return adoptRef(new XMLHttpRequestUpload(xmlHttpRequest));
         }
 
+        bool hasListeners() const;
+
         virtual XMLHttpRequestUpload* toXMLHttpRequestUpload() { return this; }
 
         XMLHttpRequest* associatedXMLHttpRequest() const { return m_xmlHttpRequest; }
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl
index c06671018c..3172f68ec1 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.idl
@@ -30,7 +30,8 @@ module xml {
 
     interface [
         GenerateConstructor,
-        CustomMarkFunction
+        CustomMarkFunction,
+        NoStaticTables
     ] XMLHttpRequestUpload {
         // From XMLHttpRequestEventTarget
         // event handler attributes
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathException.idl b/src/3rdparty/webkit/WebCore/xml/XPathException.idl
index 6e25514076..c3c95e37e9 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathException.idl
+++ b/src/3rdparty/webkit/WebCore/xml/XPathException.idl
@@ -37,7 +37,7 @@ module xpath {
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathExpression.cpp b/src/3rdparty/webkit/WebCore/xml/XPathExpression.cpp
index 446a7adbf5..618842649b 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathExpression.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,9 +30,8 @@
 #if ENABLE(XPATH)
 
 #include "Document.h"
-#include "ExceptionCode.h"
-#include "Node.h"
 #include "PlatformString.h"
+#include "XPathException.h"
 #include "XPathExpressionNode.h"
 #include "XPathNSResolver.h"
 #include "XPathParser.h"
@@ -67,17 +66,21 @@ PassRefPtr<XPathResult> XPathExpression::evaluate(Node* contextNode, unsigned sh
         return 0;
     }
 
-    EventTargetNode* eventTarget = contextNode->ownerDocument()
-        ? contextNode->ownerDocument()
-        : static_cast<EventTargetNode*>(contextNode);
-
     EvaluationContext& evaluationContext = Expression::evaluationContext();
     evaluationContext.node = contextNode;
     evaluationContext.size = 1;
     evaluationContext.position = 1;
-    RefPtr<XPathResult> result = XPathResult::create(eventTarget, m_topExpression->evaluate());
+    evaluationContext.hadTypeConversionError = false;
+    RefPtr<XPathResult> result = XPathResult::create(contextNode->document(), m_topExpression->evaluate());
     evaluationContext.node = 0; // Do not hold a reference to the context node, as this may prevent the whole document from being destroyed in time.
 
+    if (evaluationContext.hadTypeConversionError) {
+        // It is not specified what to do if type conversion fails while evaluating an expression, and INVALID_EXPRESSION_ERR is not exactly right
+        // when the failure happens in an otherwise valid expression because of a variable. But XPathEvaluator does not support variables, so it's close enough.
+        ec = XPathException::INVALID_EXPRESSION_ERR;
+        return 0;
+    }
+
     if (type != XPathResult::ANY_TYPE) {
         ec = 0;
         result->convertTo(type, ec);
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.cpp b/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.cpp
index 647c6af20b..4656f8d1e0 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.cpp
@@ -30,7 +30,6 @@
 #if ENABLE(XPATH)
 
 #include "Node.h"
-#include "XPathValue.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -43,6 +42,9 @@ EvaluationContext& Expression::evaluationContext()
 }
 
 Expression::Expression()
+    : m_isContextNodeSensitive(false)
+    , m_isContextPositionSensitive(false)
+    , m_isContextSizeSensitive(false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h b/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h
index 9c5f79b808..d12b451dd6 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathExpressionNode.h
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,23 +31,21 @@
 
 #include "StringHash.h"
 #include "Node.h"
+#include "XPathValue.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
     namespace XPath {
-
-        class Value;
         
         struct EvaluationContext {
-            EvaluationContext() : node(0), size(0), position(0) { }
-
             RefPtr<Node> node;
             unsigned long size;
             unsigned long position;
             HashMap<String, String> variableBindings;
 
+            bool hadTypeConversionError;
         };
 
         class ParseNode {
@@ -64,7 +62,22 @@ namespace WebCore {
 
             virtual Value evaluate() const = 0;
 
-            void addSubExpression(Expression* expr) { m_subExpressions.append(expr); }
+            void addSubExpression(Expression* expr)
+            {
+                m_subExpressions.append(expr);
+                m_isContextNodeSensitive |= expr->m_isContextNodeSensitive;
+                m_isContextPositionSensitive |= expr->m_isContextPositionSensitive;
+                m_isContextSizeSensitive |= expr->m_isContextSizeSensitive;
+            }
+
+            bool isContextNodeSensitive() const { return m_isContextNodeSensitive; }
+            bool isContextPositionSensitive() const { return m_isContextPositionSensitive; }
+            bool isContextSizeSensitive() const { return m_isContextSizeSensitive; }
+            void setIsContextNodeSensitive(bool value) { m_isContextNodeSensitive = value; }
+            void setIsContextPositionSensitive(bool value) { m_isContextPositionSensitive = value; }
+            void setIsContextSizeSensitive(bool value) { m_isContextSizeSensitive = value; }
+
+            virtual Value::Type resultType() const = 0;
 
         protected:
             unsigned subExprCount() const { return m_subExpressions.size(); }
@@ -73,6 +86,11 @@ namespace WebCore {
 
         private:
             Vector<Expression*> m_subExpressions;
+
+            // Evaluation details that can be used for optimization.
+            bool m_isContextNodeSensitive;
+            bool m_isContextPositionSensitive;
+            bool m_isContextSizeSensitive;
         };
 
     }
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
index 841b436b0f..da39443266 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -32,7 +32,8 @@
 
 #include "Document.h"
 #include "Element.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
+#include "ProcessingInstruction.h"
 #include "XMLNames.h"
 #include "XPathUtil.h"
 #include "XPathValue.h"
@@ -74,110 +75,157 @@ static HashMap<String, FunctionRec>* functionMap;
 
 class FunLast : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunLast() { setIsContextSizeSensitive(true); }
 };
 
 class FunPosition : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunPosition() { setIsContextPositionSensitive(true); }
 };
 
 class FunCount : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunId : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NodeSetValue; }
 };
 
 class FunLocalName : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunLocalName() { setIsContextNodeSensitive(true); } // local-name() with no arguments uses context node. 
 };
 
 class FunNamespaceURI : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunNamespaceURI() { setIsContextNodeSensitive(true); } // namespace-uri() with no arguments uses context node. 
 };
 
 class FunName : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunName() { setIsContextNodeSensitive(true); } // name() with no arguments uses context node. 
 };
 
 class FunString : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunString() { setIsContextNodeSensitive(true); } // string() with no arguments uses context node. 
 };
 
 class FunConcat : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunStartsWith : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunContains : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunSubstringBefore : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunSubstringAfter : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunSubstring : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunStringLength : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunStringLength() { setIsContextNodeSensitive(true); } // string-length() with no arguments uses context node. 
 };
 
 class FunNormalizeSpace : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunNormalizeSpace() { setIsContextNodeSensitive(true); } // normalize-space() with no arguments uses context node. 
 };
 
 class FunTranslate : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunBoolean : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunNot : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunTrue : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunFalse : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunLang : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
+public:
+    FunLang() { setIsContextNodeSensitive(true); } // lang() always works on context node. 
 };
 
 class FunNumber : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunNumber() { setIsContextNodeSensitive(true); } // number() with no arguments uses context node. 
 };
 
 class FunSum : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunFloor : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunCeiling : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunRound : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 public:
     static double round(double);
 };
@@ -246,8 +294,13 @@ inline bool Interval::contains(int value) const
 
 void Function::setArguments(const Vector<Expression*>& args)
 {
-    Vector<Expression*>::const_iterator end = args.end();
+    ASSERT(!subExprCount());
+
+    // Some functions use context node as implicit argument, so when explicit arguments are added, they may no longer be context node sensitive.
+    if (m_name != "lang" && !args.isEmpty())
+        setIsContextNodeSensitive(false);
 
+    Vector<Expression*>::const_iterator end = args.end();
     for (Vector<Expression*>::const_iterator it = args.begin(); it != end; it++)
         addSubExpression(*it);
 }
@@ -310,71 +363,67 @@ Value FunId::evaluate() const
     return Value(result, Value::adopt);
 }
 
+static inline String expandedNameLocalPart(Node* node)
+{
+    // The local part of an XPath expanded-name matches DOM local name for most node types, except for namespace nodes and processing instruction nodes.
+    ASSERT(node->nodeType() != Node::XPATH_NAMESPACE_NODE); // Not supported yet.
+    if (node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE)
+        return static_cast<ProcessingInstruction*>(node)->target();
+    return node->localName().string();
+}
+
+static inline String expandedName(Node* node)
+{
+    const AtomicString& prefix = node->prefix();
+    return prefix.isEmpty() ? expandedNameLocalPart(node) : prefix + ":" + expandedNameLocalPart(node);
+}
+
 Value FunLocalName::evaluate() const
 {
-    Node* node = 0;
     if (argCount() > 0) {
         Value a = arg(0)->evaluate();
         if (!a.isNodeSet())
             return "";
 
-        node = a.toNodeSet().firstNode();
-        if (!node)
-            return "";
+        Node* node = a.toNodeSet().firstNode();
+        return node ? expandedNameLocalPart(node) : "";
     }
 
-    if (!node)
-        node = evaluationContext().node.get();
-
-    return node->localName().string();
+    return expandedNameLocalPart(evaluationContext().node.get());
 }
 
 Value FunNamespaceURI::evaluate() const
 {
-    Node* node = 0;
     if (argCount() > 0) {
         Value a = arg(0)->evaluate();
         if (!a.isNodeSet())
             return "";
 
-        node = a.toNodeSet().firstNode();
-        if (!node)
-            return "";
+        Node* node = a.toNodeSet().firstNode();
+        return node ? node->namespaceURI().string() : "";
     }
 
-    if (!node)
-        node = evaluationContext().node.get();
-
-    return node->namespaceURI().string();
+    return evaluationContext().node->namespaceURI().string();
 }
 
 Value FunName::evaluate() const
 {
-    Node* node = 0;
     if (argCount() > 0) {
         Value a = arg(0)->evaluate();
         if (!a.isNodeSet())
             return "";
 
-        node = a.toNodeSet().firstNode();
-        if (!node)
-            return "";
+        Node* node = a.toNodeSet().firstNode();
+        return node ? expandedName(node) : "";
     }
 
-    if (!node)
-        node = evaluationContext().node.get();
-
-    const AtomicString& prefix = node->prefix();
-    return prefix.isEmpty() ? node->localName().string() : prefix + ":" + node->localName();
+    return expandedName(evaluationContext().node.get());
 }
 
 Value FunCount::evaluate() const
 {
     Value a = arg(0)->evaluate();
     
-    if (!a.isNodeSet())
-        return 0.0;
-    
     return double(a.toNodeSet().size());
 }
 
@@ -534,30 +583,30 @@ Value FunLang::evaluate() const
 {
     String lang = arg(0)->evaluate().toString();
 
-    RefPtr<Node> langNode = 0;
+    Attribute* languageAttribute = 0;
     Node* node = evaluationContext().node.get();
     while (node) {
-        NamedAttrMap* attrs = node->attributes();
+        NamedNodeMap* attrs = node->attributes();
         if (attrs)
-            langNode = attrs->getNamedItemNS(XMLNames::xmlNamespaceURI, "lang");
-        if (langNode)
+            languageAttribute = attrs->getAttributeItem(XMLNames::langAttr);
+        if (languageAttribute)
             break;
         node = node->parentNode();
     }
 
-    if (!langNode)
+    if (!languageAttribute)
         return false;
 
-    String langNodeValue = langNode->nodeValue();
+    String langValue = languageAttribute->value();
     while (true) {
-        if (equalIgnoringCase(langNodeValue, lang))
+        if (equalIgnoringCase(langValue, lang))
             return true;
 
         // Remove suffixes one by one.
-        int index = langNodeValue.reverseFind('-');
+        int index = langValue.reverseFind('-');
         if (index == -1)
             break;
-        langNodeValue = langNodeValue.left(index);
+        langValue = langValue.left(index);
     }
 
     return false;
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.h b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.h
index f22d3ef74c..62d687fa1e 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.h
@@ -1,6 +1,6 @@
 /*
- * functions.h - Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,7 +39,6 @@ namespace WebCore {
         public:
             void setArguments(const Vector<Expression*>&);
             void setName(const String& name) { m_name = name; }
-
         protected:
             Expression* arg(int pos) { return subExpr(pos); }
             const Expression* arg(int pos) const { return subExpr(pos); }
@@ -52,11 +51,10 @@ namespace WebCore {
 
         Function* createFunction(const String& name, const Vector<Expression*>& args = Vector<Expression*>());
 
-    }
+    } // namespace XPath
 
-}
+} // namespace WebCore
 
 #endif // ENABLE(XPATH)
 
-#endif // XPath_Functions_H
-
+#endif // XPathFunctions_h
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathGrammar.y b/src/3rdparty/webkit/WebCore/xml/XPathGrammar.y
index 7b21038a73..15a859bff5 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathGrammar.y
+++ b/src/3rdparty/webkit/WebCore/xml/XPathGrammar.y
@@ -68,8 +68,8 @@ using namespace XPath;
 
 %{
 
-int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
-void xpathyyerror(const char*) { }
+static int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
+static void xpathyyerror(const char*) { }
     
 %}
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.cpp b/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.cpp
index e29c0967cd..ba9423ec87 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.cpp
@@ -162,7 +162,7 @@ void NodeSet::sort() const
     
     // It is not possible to just assign the result to m_nodes, because some nodes may get dereferenced and destroyed.
     Vector<RefPtr<Node> > sortedNodes;
-    sortedNodes.reserveCapacity(nodeCount);
+    sortedNodes.reserveInitialCapacity(nodeCount);
     for (unsigned i = 0; i < nodeCount; ++i)
         sortedNodes.append(parentMatrix[i][0]);
     
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h b/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h
index 2ab6f1fb86..1130488e63 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathNodeSet.h
@@ -39,17 +39,14 @@ namespace WebCore {
 
         class NodeSet {
         public:
-        
-            NodeSet() : m_isSorted(true) {}
-            NodeSet(const NodeSet& other) : m_isSorted(other.m_isSorted), m_nodes(other.m_nodes) {}
-            NodeSet& operator=(const NodeSet& other) { m_isSorted = other.m_isSorted; m_nodes = other.m_nodes; return *this; }
+            NodeSet() : m_isSorted(true), m_subtreesAreDisjoint(false) { }
             
             size_t size() const { return m_nodes.size(); }
             bool isEmpty() const { return !m_nodes.size(); }
             Node* operator[](unsigned i) const { return m_nodes.at(i).get(); }
             void reserveCapacity(size_t newCapacity) { m_nodes.reserveCapacity(newCapacity); }
             void clear() { m_nodes.clear(); }
-            void swap(NodeSet& other) { std::swap(m_isSorted, other.m_isSorted); m_nodes.swap(other.m_nodes); }
+            void swap(NodeSet& other) { std::swap(m_isSorted, other.m_isSorted); std::swap(m_subtreesAreDisjoint, other.m_subtreesAreDisjoint); m_nodes.swap(other.m_nodes); }
 
             // NodeSet itself does not verify that nodes in it are unique.
             void append(Node* node) { m_nodes.append(node); }
@@ -62,16 +59,21 @@ namespace WebCore {
             // Returns 0 if the set is empty.
             Node* anyNode() const;
 
-            // NodeSet itself doesn't check if it is contains sorted data - the caller should tell it if it does not.
+            // NodeSet itself doesn't check if it contains nodes in document order - the caller should tell it if it does not.
             void markSorted(bool isSorted) { m_isSorted = isSorted; }
-            bool isSorted() const { return m_isSorted; }
+            bool isSorted() const { return m_isSorted || m_nodes.size() < 2; }
 
             void sort() const;
 
+            // No node in the set is ancestor of another. Unlike m_isSorted, this is assumed to be false, unless the caller sets it to true.
+            void markSubtreesDisjoint(bool disjoint) { m_subtreesAreDisjoint = disjoint; }
+            bool subtreesAreDisjoint() const { return m_subtreesAreDisjoint || m_nodes.size() < 2; }
+
             void reverse();
         
         private:
             bool m_isSorted;
+            bool m_subtreesAreDisjoint;
             Vector<RefPtr<Node> > m_nodes;
         };
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathPath.cpp b/src/3rdparty/webkit/WebCore/xml/XPathPath.cpp
index bc7b153033..1a7ed3f433 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathPath.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathPath.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -41,6 +41,9 @@ namespace XPath {
 Filter::Filter(Expression* expr, const Vector<Predicate*>& predicates)
     : m_expr(expr), m_predicates(predicates)
 {
+    setIsContextNodeSensitive(m_expr->isContextNodeSensitive());
+    setIsContextPositionSensitive(m_expr->isContextPositionSensitive());
+    setIsContextSizeSensitive(m_expr->isContextSizeSensitive());
 }
 
 Filter::~Filter()
@@ -53,9 +56,6 @@ Value Filter::evaluate() const
 {
     Value v = m_expr->evaluate();
     
-    if (!v.isNodeSet()) 
-        return v;
-
     NodeSet& nodes = v.modifiableNodeSet();
     nodes.sort();
 
@@ -83,6 +83,7 @@ Value Filter::evaluate() const
 LocationPath::LocationPath()
     : m_absolute(false)
 {
+    setIsContextNodeSensitive(true);
 }
 
 LocationPath::~LocationPath()
@@ -94,9 +95,8 @@ Value LocationPath::evaluate() const
 {
     EvaluationContext& evaluationContext = Expression::evaluationContext();
     EvaluationContext backupContext = evaluationContext;
-    /* For absolute location paths, the context node is ignored - the
-     * document's root node is used instead.
-     */
+    // For absolute location paths, the context node is ignored - the
+    // document's root node is used instead.
     Node* context = evaluationContext.node.get();
     if (m_absolute && context->nodeType() != Node::DOCUMENT_NODE) 
         context = context->ownerDocument();
@@ -111,18 +111,33 @@ Value LocationPath::evaluate() const
 
 void LocationPath::evaluate(NodeSet& nodes) const
 {
+    bool resultIsSorted = nodes.isSorted();
+
     for (unsigned i = 0; i < m_steps.size(); i++) {
         Step* step = m_steps[i];
         NodeSet newNodes;
         HashSet<Node*> newNodesSet;
 
+        bool needToCheckForDuplicateNodes = !nodes.subtreesAreDisjoint() || (step->axis() != Step::ChildAxis && step->axis() != Step::SelfAxis
+            && step->axis() != Step::DescendantAxis && step->axis() != Step::DescendantOrSelfAxis && step->axis() != Step::AttributeAxis);
+
+        if (needToCheckForDuplicateNodes)
+            resultIsSorted = false;
+
+        // This is a simplified check that can be improved to handle more cases.
+        if (nodes.subtreesAreDisjoint() && (step->axis() == Step::ChildAxis || step->axis() == Step::SelfAxis))
+            newNodes.markSubtreesDisjoint(true);
+
         for (unsigned j = 0; j < nodes.size(); j++) {
             NodeSet matches;
             step->evaluate(nodes[j], matches);
-            
+
+            if (!matches.isSorted())
+                resultIsSorted = false;
+
             for (size_t nodeIndex = 0; nodeIndex < matches.size(); ++nodeIndex) {
                 Node* node = matches[nodeIndex];
-                if (newNodesSet.add(node).second)
+                if (!needToCheckForDuplicateNodes || newNodesSet.add(node).second)
                     newNodes.append(node);
             }
         }
@@ -130,53 +145,46 @@ void LocationPath::evaluate(NodeSet& nodes) const
         nodes.swap(newNodes);
     }
 
-    nodes.markSorted(false);
+    nodes.markSorted(resultIsSorted);
 }
 
-void LocationPath::optimizeStepPair(unsigned index)
+void LocationPath::appendStep(Step* step)
 {
-    Step* first = m_steps[index];
-    
-    if (first->axis() == Step::DescendantOrSelfAxis
-        && first->nodeTest().kind() == Step::NodeTest::AnyNodeTest
-        && first->predicates().size() == 0) {
-
-        Step* second = m_steps[index + 1];
-        if (second->axis() == Step::ChildAxis
-            && second->nodeTest().namespaceURI().isEmpty()
-            && second->nodeTest().kind() == Step::NodeTest::NameTest
-            && second->nodeTest().data() == "*") {
-
-            // Optimize the common case of "//*" AKA descendant-or-self::node()/child::*.
-            first->setAxis(Step::DescendantAxis);
-            second->setAxis(Step::SelfAxis);
-            second->setNodeTest(Step::NodeTest::ElementNodeTest);
-            ASSERT(second->nodeTest().data().isEmpty());
+    unsigned stepCount = m_steps.size();
+    if (stepCount) {
+        bool dropSecondStep;
+        optimizeStepPair(m_steps[stepCount - 1], step, dropSecondStep);
+        if (dropSecondStep) {
+            delete step;
+            return;
         }
     }
-}
-
-void LocationPath::appendStep(Step* step)
-{
+    step->optimize();
     m_steps.append(step);
-    
-    unsigned stepCount = m_steps.size();
-    if (stepCount > 1)
-        optimizeStepPair(stepCount - 2);
 }
 
 void LocationPath::insertFirstStep(Step* step)
 {
+    if (m_steps.size()) {
+        bool dropSecondStep;
+        optimizeStepPair(step, m_steps[0], dropSecondStep);
+        if (dropSecondStep) {
+            delete m_steps[0];
+            m_steps[0] = step;
+            return;
+        }
+    }
+    step->optimize();
     m_steps.insert(0, step);
-
-    if (m_steps.size() > 1)
-        optimizeStepPair(0);
 }
 
 Path::Path(Filter* filter, LocationPath* path)
-    : m_filter(filter),
-    m_path(path)
+    : m_filter(filter)
+    , m_path(path)
 {
+    setIsContextNodeSensitive(filter->isContextNodeSensitive());
+    setIsContextPositionSensitive(filter->isContextPositionSensitive());
+    setIsContextSizeSensitive(filter->isContextSizeSensitive());
 }
 
 Path::~Path()
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathPath.h b/src/3rdparty/webkit/WebCore/xml/XPathPath.h
index 97692b23e7..dc7797137c 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathPath.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathPath.h
@@ -1,6 +1,6 @@
 /*
- * path.h - Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,8 +32,6 @@
 #include "XPathExpressionNode.h"
 #include "XPathNodeSet.h"
 
-int xpathyyparse(void*);
-
 namespace WebCore {
 
     namespace XPath {
@@ -49,6 +47,8 @@ namespace WebCore {
             virtual Value evaluate() const;
 
         private:
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
+
             Expression* m_expr;
             Vector<Predicate*> m_predicates;
         };
@@ -57,7 +57,7 @@ namespace WebCore {
         public:
             LocationPath();
             virtual ~LocationPath();
-            void setAbsolute(bool value) { m_absolute = value; }
+            void setAbsolute(bool value) { m_absolute = value; setIsContextNodeSensitive(!m_absolute); }
 
             virtual Value evaluate() const;
             void evaluate(NodeSet& nodes) const; // nodes is an input/output parameter
@@ -66,7 +66,7 @@ namespace WebCore {
             void insertFirstStep(Step* step);
 
         private:
-            void optimizeStepPair(unsigned index);
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
 
             Vector<Step*> m_steps;
             bool m_absolute;
@@ -81,6 +81,8 @@ namespace WebCore {
             virtual Value evaluate() const;
 
         private:
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
+
             Filter* m_filter;
             LocationPath* m_path;
         };
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathPredicate.cpp b/src/3rdparty/webkit/WebCore/xml/XPathPredicate.cpp
index 7b3e4d817b..2a6482fe98 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathPredicate.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathPredicate.cpp
@@ -233,8 +233,6 @@ Value Union::evaluate() const
 {
     Value lhsResult = subExpr(0)->evaluate();
     Value rhs = subExpr(1)->evaluate();
-    if (!lhsResult.isNodeSet() || !rhs.isNodeSet())
-        return NodeSet();
     
     NodeSet& resultSet = lhsResult.modifiableNodeSet();
     const NodeSet& rhsNodes = rhs.toNodeSet();
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathPredicate.h b/src/3rdparty/webkit/WebCore/xml/XPathPredicate.h
index 8d1b0d83f4..6c9d413e3f 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathPredicate.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathPredicate.h
@@ -41,6 +41,8 @@ namespace WebCore {
             Number(double);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NumberValue; }
+
             Value m_value;
         };
 
@@ -49,12 +51,15 @@ namespace WebCore {
             StringExpression(const String&);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::StringValue; }
+
             Value m_value;
         };
 
         class Negative : public Expression {
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NumberValue; }
         };
 
         class NumericOp : public Expression {
@@ -65,6 +70,8 @@ namespace WebCore {
             NumericOp(Opcode, Expression* lhs, Expression* rhs);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NumberValue; }
+
             Opcode m_opcode;
         };
 
@@ -74,7 +81,9 @@ namespace WebCore {
             EqTestOp(Opcode, Expression* lhs, Expression* rhs);
             virtual Value evaluate() const;
         private:
+            virtual Value::Type resultType() const { return Value::BooleanValue; }
             bool compare(const Value&, const Value&) const;
+
             Opcode m_opcode;
         };
 
@@ -83,14 +92,17 @@ namespace WebCore {
             enum Opcode { OP_And, OP_Or };
             LogicalOp(Opcode, Expression* lhs, Expression* rhs);
         private:
+            virtual Value::Type resultType() const { return Value::BooleanValue; }
             bool shortCircuitOn() const;
             virtual Value evaluate() const;
+
             Opcode m_opcode;
         };
 
         class Union : public Expression {
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
         };
 
         class Predicate : Noncopyable {
@@ -98,6 +110,10 @@ namespace WebCore {
             Predicate(Expression*);
             ~Predicate();
             bool evaluate() const;
+
+            bool isContextPositionSensitive() const { return m_expr->isContextPositionSensitive() || m_expr->resultType() == Value::NumberValue; }
+            bool isContextSizeSensitive() const { return m_expr->isContextSizeSensitive(); }
+
         private:
             Expression* m_expr;
         };
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathResult.cpp b/src/3rdparty/webkit/WebCore/xml/XPathResult.cpp
index 285350e353..b608280c9b 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathResult.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,9 +29,8 @@
 
 #if ENABLE(XPATH)
 
-#include "EventListener.h"
-#include "EventNames.h"
-#include "EventTargetNode.h"
+#include "Document.h"
+#include "Node.h"
 #include "ExceptionCode.h"
 #include "XPathEvaluator.h"
 #include "XPathException.h"
@@ -40,22 +39,9 @@ namespace WebCore {
 
 using namespace XPath;
 
-class InvalidatingEventListener : public EventListener {
-public:
-    static PassRefPtr<InvalidatingEventListener> create(XPathResult* result) { return adoptRef(new InvalidatingEventListener(result)); }
-    virtual void handleEvent(Event*, bool) { m_result->invalidateIteratorState(); }
-
-private:
-    InvalidatingEventListener(XPathResult* result) : m_result(result) { }
-    XPathResult* m_result;
-};
-
-XPathResult::XPathResult(EventTargetNode* eventTarget, const Value& value)
+XPathResult::XPathResult(Document* document, const Value& value)
     : m_value(value)
-    , m_eventTarget(eventTarget)
 {
-    m_eventListener = InvalidatingEventListener::create(this);
-    m_eventTarget->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener, false);
     switch (m_value.type()) {
         case Value::BooleanValue:
             m_resultType = BOOLEAN_TYPE;
@@ -70,7 +56,8 @@ XPathResult::XPathResult(EventTargetNode* eventTarget, const Value& value)
             m_resultType = UNORDERED_NODE_ITERATOR_TYPE;
             m_nodeSetPosition = 0;
             m_nodeSet = m_value.toNodeSet();
-            m_invalidIteratorState = false;
+            m_document = document;
+            m_domTreeVersion = document->domTreeVersion();
             return;
     }
     ASSERT_NOT_REACHED();
@@ -78,8 +65,6 @@ XPathResult::XPathResult(EventTargetNode* eventTarget, const Value& value)
 
 XPathResult::~XPathResult()
 {
-    if (m_eventTarget)
-        m_eventTarget->removeEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
 }
 
 void XPathResult::convertTo(unsigned short type, ExceptionCode& ec)
@@ -174,24 +159,13 @@ Node* XPathResult::singleNodeValue(ExceptionCode& ec) const
         return nodes.anyNode();
 }
 
-void XPathResult::invalidateIteratorState()
-{ 
-    m_invalidIteratorState = true;
-    
-    ASSERT(m_eventTarget);
-    ASSERT(m_eventListener);
-    
-    m_eventTarget->removeEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-    
-    m_eventTarget = 0;
-}
-
 bool XPathResult::invalidIteratorState() const
 {
     if (resultType() != UNORDERED_NODE_ITERATOR_TYPE && resultType() != ORDERED_NODE_ITERATOR_TYPE)
         return false;
-    
-    return m_invalidIteratorState;
+
+    ASSERT(m_document);
+    return m_document->domTreeVersion() != m_domTreeVersion;
 }
 
 unsigned long XPathResult::snapshotLength(ExceptionCode& ec) const
@@ -211,7 +185,7 @@ Node* XPathResult::iterateNext(ExceptionCode& ec)
         return 0;
     }
     
-    if (m_invalidIteratorState) {
+    if (invalidIteratorState()) {
         ec = INVALID_STATE_ERR;
         return 0;
     }
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathResult.h b/src/3rdparty/webkit/WebCore/xml/XPathResult.h
index ecd5cacec2..3b91d661ce 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathResult.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathResult.h
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,15 +29,14 @@
 
 #if ENABLE(XPATH)
 
-#include <wtf/RefCounted.h>
 #include "XPathValue.h"
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
     typedef int ExceptionCode;
 
-    class EventListener;
-    class EventTargetNode;
+    class Document;
     class Node;
     class String;
 
@@ -56,7 +55,7 @@ namespace WebCore {
             FIRST_ORDERED_NODE_TYPE = 9
         };
         
-        static PassRefPtr<XPathResult> create(EventTargetNode* eventTarget, const XPath::Value& value) { return adoptRef(new XPathResult(eventTarget, value)); }
+        static PassRefPtr<XPathResult> create(Document* document, const XPath::Value& value) { return adoptRef(new XPathResult(document, value)); }
         ~XPathResult();
         
         void convertTo(unsigned short type, ExceptionCode&);
@@ -73,21 +72,18 @@ namespace WebCore {
         Node* iterateNext(ExceptionCode&);
         Node* snapshotItem(unsigned long index, ExceptionCode&);
 
-        void invalidateIteratorState();
-
     private:
-        XPathResult(EventTargetNode*, const XPath::Value&);
+        XPathResult(Document*, const XPath::Value&);
         
         XPath::Value m_value;
         unsigned m_nodeSetPosition;
         XPath::NodeSet m_nodeSet; // FIXME: why duplicate the node set stored in m_value?
         unsigned short m_resultType;
-        bool m_invalidIteratorState;
-        RefPtr<EventTargetNode> m_eventTarget;
-        RefPtr<EventListener> m_eventListener;
+        RefPtr<Document> m_document;
+        unsigned m_domTreeVersion;
     };
 
-}
+} // namespace WebCore
 
 #endif // ENABLE(XPATH)
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp b/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp
index abdcba5b06..411b616eb9 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathStep.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,10 +30,10 @@
 
 #if ENABLE(XPATH)
 
+#include "Attr.h"
 #include "Document.h"
 #include "Element.h"
-#include "NamedAttrMap.h"
-#include "XPathNSResolver.h"
+#include "NamedNodeMap.h"
 #include "XPathParser.h"
 #include "XPathUtil.h"
 
@@ -50,14 +50,74 @@ Step::Step(Axis axis, const NodeTest& nodeTest, const Vector<Predicate*>& predic
 Step::~Step()
 {
     deleteAllValues(m_predicates);
+    deleteAllValues(m_nodeTest.mergedPredicates());
+}
+
+void Step::optimize()
+{
+    // Evaluate predicates as part of node test if possible to avoid building unnecessary NodeSets.
+    // E.g., there is no need to build a set of all "foo" nodes to evaluate "foo[@bar]", we can check the predicate while enumerating.
+    // This optimization can be applied to predicates that are not context node list sensitive, or to first predicate that is only context position sensitive, e.g. foo[position() mod 2 = 0].
+    Vector<Predicate*> remainingPredicates;
+    for (size_t i = 0; i < m_predicates.size(); ++i) {
+        Predicate* predicate = m_predicates[i];
+        if ((!predicate->isContextPositionSensitive() || m_nodeTest.mergedPredicates().isEmpty()) && !predicate->isContextSizeSensitive() && remainingPredicates.isEmpty()) {
+            m_nodeTest.mergedPredicates().append(predicate);
+        } else
+            remainingPredicates.append(predicate);
+    }
+    swap(remainingPredicates, m_predicates);
+}
+
+void optimizeStepPair(Step* first, Step* second, bool& dropSecondStep)
+{
+    dropSecondStep = false;
+
+    if (first->m_axis == Step::DescendantOrSelfAxis
+        && first->m_nodeTest.kind() == Step::NodeTest::AnyNodeTest
+        && !first->m_predicates.size()
+        && !first->m_nodeTest.mergedPredicates().size()) {
+
+        ASSERT(first->m_nodeTest.data().isEmpty());
+        ASSERT(first->m_nodeTest.namespaceURI().isEmpty());
+
+        // Optimize the common case of "//" AKA /descendant-or-self::node()/child::NodeTest to /descendant::NodeTest.
+        if (second->m_axis == Step::ChildAxis && second->predicatesAreContextListInsensitive()) {
+            first->m_axis = Step::DescendantAxis;
+            first->m_nodeTest = Step::NodeTest(second->m_nodeTest.kind(), second->m_nodeTest.data(), second->m_nodeTest.namespaceURI());
+            swap(second->m_nodeTest.mergedPredicates(), first->m_nodeTest.mergedPredicates());
+            swap(second->m_predicates, first->m_predicates);
+            first->optimize();
+            dropSecondStep = true;
+        }
+    }
+}
+
+bool Step::predicatesAreContextListInsensitive() const
+{
+    for (size_t i = 0; i < m_predicates.size(); ++i) {
+        Predicate* predicate = m_predicates[i];
+        if (predicate->isContextPositionSensitive() || predicate->isContextSizeSensitive())
+            return false;
+    }
+
+    for (size_t i = 0; i < m_nodeTest.mergedPredicates().size(); ++i) {
+        Predicate* predicate = m_nodeTest.mergedPredicates()[i];
+        if (predicate->isContextPositionSensitive() || predicate->isContextSizeSensitive())
+            return false;
+    }
+
+    return true;
 }
 
 void Step::evaluate(Node* context, NodeSet& nodes) const
 {
-    nodesInAxis(context, nodes);
-    
     EvaluationContext& evaluationContext = Expression::evaluationContext();
-    
+    evaluationContext.position = 0;
+
+    nodesInAxis(context, nodes);
+
+    // Check predicates that couldn't be merged into node test.
     for (unsigned i = 0; i < m_predicates.size(); i++) {
         Predicate* predicate = m_predicates[i];
 
@@ -68,7 +128,7 @@ void Step::evaluate(Node* context, NodeSet& nodes) const
         for (unsigned j = 0; j < nodes.size(); j++) {
             Node* node = nodes[j];
 
-            Expression::evaluationContext().node = node;
+            evaluationContext.node = node;
             evaluationContext.size = nodes.size();
             evaluationContext.position = j + 1;
             if (predicate->evaluate())
@@ -79,6 +139,95 @@ void Step::evaluate(Node* context, NodeSet& nodes) const
     }
 }
 
+static inline Node::NodeType primaryNodeType(Step::Axis axis)
+{
+    switch (axis) {
+        case Step::AttributeAxis:
+            return Node::ATTRIBUTE_NODE;
+        case Step::NamespaceAxis:
+            return Node::XPATH_NAMESPACE_NODE;
+        default:
+            return Node::ELEMENT_NODE;
+    }
+}
+
+// Evaluate NodeTest without considering merged predicates.
+static inline bool nodeMatchesBasicTest(Node* node, Step::Axis axis, const Step::NodeTest& nodeTest)
+{
+    switch (nodeTest.kind()) {
+        case Step::NodeTest::TextNodeTest:
+            return node->nodeType() == Node::TEXT_NODE || node->nodeType() == Node::CDATA_SECTION_NODE;
+        case Step::NodeTest::CommentNodeTest:
+            return node->nodeType() == Node::COMMENT_NODE;
+        case Step::NodeTest::ProcessingInstructionNodeTest: {
+            const AtomicString& name = nodeTest.data();
+            return node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE && (name.isEmpty() || node->nodeName() == name);
+        }
+        case Step::NodeTest::AnyNodeTest:
+            return true;
+        case Step::NodeTest::NameTest: {
+            const AtomicString& name = nodeTest.data();
+            const AtomicString& namespaceURI = nodeTest.namespaceURI();
+
+            if (axis == Step::AttributeAxis) {
+                ASSERT(node->isAttributeNode());
+
+                // In XPath land, namespace nodes are not accessible on the attribute axis.
+                if (node->namespaceURI() == "http://www.w3.org/2000/xmlns/")
+                    return false;
+
+                if (name == starAtom)
+                    return namespaceURI.isEmpty() || node->namespaceURI() == namespaceURI;
+
+                return node->localName() == name && node->namespaceURI() == namespaceURI;
+            }
+
+            // Node test on the namespace axis is not implemented yet, the caller has a check for it.
+            ASSERT(axis != Step::NamespaceAxis);
+
+            // For other axes, the principal node type is element.
+            ASSERT(primaryNodeType(axis) == Node::ELEMENT_NODE);
+            if (node->nodeType() != Node::ELEMENT_NODE)
+                return false;
+
+            if (name == starAtom)
+                return namespaceURI.isEmpty() || namespaceURI == node->namespaceURI();
+
+            if (node->isHTMLElement() && node->document()->isHTMLDocument()) {
+                // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
+                return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+            }
+            return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI();
+        }
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+static inline bool nodeMatches(Node* node, Step::Axis axis, const Step::NodeTest& nodeTest)
+{
+    if (!nodeMatchesBasicTest(node, axis, nodeTest))
+        return false;
+
+    EvaluationContext& evaluationContext = Expression::evaluationContext();
+
+    // Only the first merged predicate may depend on position.
+    ++evaluationContext.position;
+
+    const Vector<Predicate*>& mergedPredicates = nodeTest.mergedPredicates();
+    for (unsigned i = 0; i < mergedPredicates.size(); i++) {
+        Predicate* predicate = mergedPredicates[i];
+
+        evaluationContext.node = node;
+        // No need to set context size - we only get here when evaluating predicates that do not depend on it.
+        if (!predicate->evaluate())
+            return false;
+    }
+
+    return true;
+}
+
+// Result nodes are ordered in axis order. Node test (including merged predicates) is applied.
 void Step::nodesInAxis(Node* context, NodeSet& nodes) const
 {
     ASSERT(nodes.isEmpty());
@@ -88,7 +237,7 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
                 return;
 
             for (Node* n = context->firstChild(); n; n = n->nextSibling())
-                if (nodeMatches(n))
+                if (nodeMatches(n, ChildAxis, m_nodeTest))
                     nodes.append(n);
             return;
         case DescendantAxis:
@@ -96,17 +245,17 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
                 return;
 
             for (Node* n = context->firstChild(); n; n = n->traverseNextNode(context))
-                if (nodeMatches(n))
+                if (nodeMatches(n, DescendantAxis, m_nodeTest))
                     nodes.append(n);
             return;
         case ParentAxis:
             if (context->isAttributeNode()) {
                 Node* n = static_cast<Attr*>(context)->ownerElement();
-                if (nodeMatches(n))
+                if (nodeMatches(n, ParentAxis, m_nodeTest))
                     nodes.append(n);
             } else {
                 Node* n = context->parentNode();
-                if (n && nodeMatches(n))
+                if (n && nodeMatches(n, ParentAxis, m_nodeTest))
                     nodes.append(n);
             }
             return;
@@ -114,11 +263,11 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
             Node* n = context;
             if (context->isAttributeNode()) {
                 n = static_cast<Attr*>(context)->ownerElement();
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorAxis, m_nodeTest))
                     nodes.append(n);
             }
             for (n = n->parentNode(); n; n = n->parentNode())
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorAxis, m_nodeTest))
                     nodes.append(n);
             nodes.markSorted(false);
             return;
@@ -129,7 +278,7 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
                 return;
             
             for (Node* n = context->nextSibling(); n; n = n->nextSibling())
-                if (nodeMatches(n))
+                if (nodeMatches(n, FollowingSiblingAxis, m_nodeTest))
                     nodes.append(n);
             return;
         case PrecedingSiblingAxis:
@@ -138,7 +287,7 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
                 return;
             
             for (Node* n = context->previousSibling(); n; n = n->previousSibling())
-                if (nodeMatches(n))
+                if (nodeMatches(n, PrecedingSiblingAxis, m_nodeTest))
                     nodes.append(n);
 
             nodes.markSorted(false);
@@ -147,15 +296,15 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
             if (context->isAttributeNode()) {
                 Node* p = static_cast<Attr*>(context)->ownerElement();
                 while ((p = p->traverseNextNode()))
-                    if (nodeMatches(p))
+                    if (nodeMatches(p, FollowingAxis, m_nodeTest))
                         nodes.append(p);
             } else {
                 for (Node* p = context; !isRootDomNode(p); p = p->parentNode()) {
                     for (Node* n = p->nextSibling(); n; n = n->nextSibling()) {
-                        if (nodeMatches(n))
+                        if (nodeMatches(n, FollowingAxis, m_nodeTest))
                             nodes.append(n);
                         for (Node* c = n->firstChild(); c; c = c->traverseNextNode(n))
-                            if (nodeMatches(c))
+                            if (nodeMatches(c, FollowingAxis, m_nodeTest))
                                 nodes.append(c);
                     }
                 }
@@ -168,7 +317,7 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
             Node* n = context;
             while (Node* parent = n->parent()) {
                 for (n = n->traversePreviousNode(); n != parent; n = n->traversePreviousNode())
-                    if (nodeMatches(n))
+                    if (nodeMatches(n, PrecedingAxis, m_nodeTest))
                         nodes.append(n);
                 n = parent;
             }
@@ -180,21 +329,23 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
                 return;
 
             // Avoid lazily creating attribute nodes for attributes that we do not need anyway.
-            if (m_nodeTest.kind() == NodeTest::NameTest && m_nodeTest.data() != "*") {
+            if (m_nodeTest.kind() == NodeTest::NameTest && m_nodeTest.data() != starAtom) {
                 RefPtr<Node> n = static_cast<Element*>(context)->getAttributeNodeNS(m_nodeTest.namespaceURI(), m_nodeTest.data());
-                if (n && n->namespaceURI() != "http://www.w3.org/2000/xmlns/") // In XPath land, namespace nodes are not accessible on the attribute axis.
-                    nodes.append(n.release());
+                if (n && n->namespaceURI() != "http://www.w3.org/2000/xmlns/") { // In XPath land, namespace nodes are not accessible on the attribute axis.
+                    if (nodeMatches(n.get(), AttributeAxis, m_nodeTest)) // Still need to check merged predicates.
+                        nodes.append(n.release());
+                }
                 return;
             }
             
-            NamedAttrMap* attrs = context->attributes();
+            NamedNodeMap* attrs = context->attributes();
             if (!attrs)
                 return;
 
-            for (unsigned long i = 0; i < attrs->length(); ++i) {
-                RefPtr<Node> n = attrs->item(i);
-                if (nodeMatches(n.get()))
-                    nodes.append(n.release());
+            for (unsigned i = 0; i < attrs->length(); ++i) {
+                RefPtr<Attr> attr = attrs->attributeItem(i)->createAttrIfNeeded(static_cast<Element*>(context));
+                if (nodeMatches(attr.get(), AttributeAxis, m_nodeTest))
+                    nodes.append(attr.release());
             }
             return;
         }
@@ -202,30 +353,30 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
             // XPath namespace nodes are not implemented yet.
             return;
         case SelfAxis:
-            if (nodeMatches(context))
+            if (nodeMatches(context, SelfAxis, m_nodeTest))
                 nodes.append(context);
             return;
         case DescendantOrSelfAxis:
-            if (nodeMatches(context))
+            if (nodeMatches(context, DescendantOrSelfAxis, m_nodeTest))
                 nodes.append(context);
             if (context->isAttributeNode()) // In XPath model, attribute nodes do not have children.
                 return;
 
             for (Node* n = context->firstChild(); n; n = n->traverseNextNode(context))
-            if (nodeMatches(n))
+            if (nodeMatches(n, DescendantOrSelfAxis, m_nodeTest))
                 nodes.append(n);
             return;
         case AncestorOrSelfAxis: {
-            if (nodeMatches(context))
+            if (nodeMatches(context, AncestorOrSelfAxis, m_nodeTest))
                 nodes.append(context);
             Node* n = context;
             if (context->isAttributeNode()) {
                 n = static_cast<Attr*>(context)->ownerElement();
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorOrSelfAxis, m_nodeTest))
                     nodes.append(n);
             }
             for (n = n->parentNode(); n; n = n->parentNode())
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorOrSelfAxis, m_nodeTest))
                     nodes.append(n);
 
             nodes.markSorted(false);
@@ -236,70 +387,6 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
 }
 
 
-bool Step::nodeMatches(Node* node) const
-{
-    switch (m_nodeTest.kind()) {
-        case NodeTest::TextNodeTest:
-            return node->nodeType() == Node::TEXT_NODE || node->nodeType() == Node::CDATA_SECTION_NODE;
-        case NodeTest::CommentNodeTest:
-            return node->nodeType() == Node::COMMENT_NODE;
-        case NodeTest::ProcessingInstructionNodeTest: {
-            const String& name = m_nodeTest.data();
-            return node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE && (name.isEmpty() || node->nodeName() == name);
-        }
-        case NodeTest::ElementNodeTest:
-            return node->isElementNode();
-        case NodeTest::AnyNodeTest:
-            return true;
-        case NodeTest::NameTest: {
-            const String& name = m_nodeTest.data();
-            const String& namespaceURI = m_nodeTest.namespaceURI();
-
-            if (m_axis == AttributeAxis) {
-                ASSERT(node->isAttributeNode());
-
-                // In XPath land, namespace nodes are not accessible on the attribute axis.
-                if (node->namespaceURI() == "http://www.w3.org/2000/xmlns/")
-                    return false;
-
-                if (name == "*")
-                    return namespaceURI.isEmpty() || node->namespaceURI() == namespaceURI;
-
-                return node->localName() == name && node->namespaceURI() == namespaceURI;
-            }
-
-            if (m_axis == NamespaceAxis) {
-                // Node test on the namespace axis is not implemented yet
-                return false;
-            }
-            
-            if (name == "*")
-                return node->nodeType() == primaryNodeType(m_axis) && (namespaceURI.isEmpty() || namespaceURI == node->namespaceURI());
-
-            // We use tagQName here because we don't want the element name in uppercase 
-            // like we get with HTML elements.
-            // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace.
-            return node->nodeType() == Node::ELEMENT_NODE
-                    && static_cast<Element*>(node)->tagQName().localName() == name
-                    && ((node->isHTMLElement() && node->document()->isHTMLDocument() && namespaceURI.isNull()) || namespaceURI == node->namespaceURI());
-        }
-    }
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-Node::NodeType Step::primaryNodeType(Axis axis) const
-{
-    switch (axis) {
-        case AttributeAxis:
-            return Node::ATTRIBUTE_NODE;
-        case NamespaceAxis:
-            return Node::XPATH_NAMESPACE_NODE;
-        default:
-            return Node::ELEMENT_NODE;
-    }
-}
-
 }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathStep.h b/src/3rdparty/webkit/WebCore/xml/XPathStep.h
index f1420d0e58..1c26327738 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathStep.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathStep.h
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,8 +52,7 @@ namespace WebCore {
             class NodeTest {
             public:
                 enum Kind {
-                    TextNodeTest, CommentNodeTest, ProcessingInstructionNodeTest, AnyNodeTest, NameTest,
-                    ElementNodeTest // XPath 2.0
+                    TextNodeTest, CommentNodeTest, ProcessingInstructionNodeTest, AnyNodeTest, NameTest
                 };
                 
                 NodeTest(Kind kind) : m_kind(kind) {}
@@ -61,44 +60,48 @@ namespace WebCore {
                 NodeTest(Kind kind, const String& data, const String& namespaceURI) : m_kind(kind), m_data(data), m_namespaceURI(namespaceURI) {}
                 
                 Kind kind() const { return m_kind; }
-                const String data() const { return m_data; }
-                const String namespaceURI() const { return m_namespaceURI; }
+                const AtomicString& data() const { return m_data; }
+                const AtomicString& namespaceURI() const { return m_namespaceURI; }
+                Vector<Predicate*>& mergedPredicates() { return m_mergedPredicates; }
+                const Vector<Predicate*>& mergedPredicates() const { return m_mergedPredicates; }
                 
             private:
                 Kind m_kind;
-                String m_data;
-                String m_namespaceURI;
+                AtomicString m_data;
+                AtomicString m_namespaceURI;
+
+                // When possible, we merge some or all predicates with node test for better performance.
+                Vector<Predicate*> m_mergedPredicates;
             };
 
             Step(Axis, const NodeTest& nodeTest, const Vector<Predicate*>& predicates = Vector<Predicate*>());
             ~Step();
 
+            void optimize();
+
             void evaluate(Node* context, NodeSet&) const;
-            
+
             Axis axis() const { return m_axis; }
-            NodeTest nodeTest() const { return m_nodeTest; }
-            const Vector<Predicate*>& predicates() const { return m_predicates; }
-            
-            void setAxis(Axis axis) { m_axis = axis; }
-            void setNodeTest(NodeTest nodeTest) { m_nodeTest = nodeTest; }
-            void setPredicates(const Vector<Predicate*>& predicates) { m_predicates = predicates; }
-            
+            const NodeTest& nodeTest() const { return m_nodeTest; }
+
         private:
+            friend void optimizeStepPair(Step*, Step*, bool&);
+            bool predicatesAreContextListInsensitive() const;
+
             void parseNodeTest(const String&);
             void nodesInAxis(Node* context, NodeSet&) const;
-            bool nodeMatches(Node*) const;
             String namespaceFromNodetest(const String& nodeTest) const;
-            Node::NodeType primaryNodeType(Axis) const;
 
             Axis m_axis;
             NodeTest m_nodeTest;
             Vector<Predicate*> m_predicates;
         };
 
+        void optimizeStepPair(Step*, Step*, bool& dropSecondStep);
     }
 
 }
 
 #endif // ENABLE(XPATH)
 
-#endif // XPath_Step_H
+#endif // XPathStep_h
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathUtil.cpp b/src/3rdparty/webkit/WebCore/xml/XPathUtil.cpp
index ab4b1d46f8..0100bea48b 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathUtil.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathUtil.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,13 +51,17 @@ String stringValue(Node* node)
             return node->nodeValue();
         default:
             if (isRootDomNode(node) || node->nodeType() == Node::ELEMENT_NODE) {
-                String str;
-                
-                for (Node* n = node->firstChild(); n; n = n->traverseNextNode(node))
-                    if (n->isTextNode())
-                        str += n->nodeValue();
+                Vector<UChar> result;
+                result.reserveCapacity(1024);
 
-                return str;
+                for (Node* n = node->firstChild(); n; n = n->traverseNextNode(node)) {
+                    if (n->isTextNode()) {
+                        const String& nodeValue = n->nodeValue();
+                        result.append(nodeValue.characters(), nodeValue.length());
+                    }
+                }
+
+                return String::adopt(result);
             }
     }
     
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp b/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp
index bac0e13942..29e211e13c 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathValue.cpp
@@ -30,11 +30,11 @@
 #if ENABLE(XPATH)
 
 #include "Node.h"
+#include "XPathExpressionNode.h"
 #include "XPathUtil.h"
-
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
-#include <limits>
 
 using std::numeric_limits;
 
@@ -45,6 +45,9 @@ const Value::AdoptTag Value::adopt = {};
 
 const NodeSet& Value::toNodeSet() const
 {
+    if (!isNodeSet())
+        Expression::evaluationContext().hadTypeConversionError = true;
+
     if (!m_data) {
         DEFINE_STATIC_LOCAL(NodeSet, emptyNodeSet, ());
         return emptyNodeSet;
@@ -55,6 +58,9 @@ const NodeSet& Value::toNodeSet() const
 
 NodeSet& Value::modifiableNodeSet()
 {
+    if (!isNodeSet())
+        Expression::evaluationContext().hadTypeConversionError = true;
+
     if (!m_data)
         m_data = ValueData::create();
     
@@ -86,8 +92,18 @@ double Value::toNumber() const
         case NumberValue:
             return m_number;
         case StringValue: {
+            const String& str = m_data->m_string.simplifyWhiteSpace();
+
+            // String::toDouble() supports exponential notation, which is not allowed in XPath.
+            unsigned len = str.length();
+            for (unsigned i = 0; i < len; ++i) {
+                UChar c = str[i];
+                if (!isASCIIDigit(c) && c != '.'  && c != '-')
+                    return numeric_limits<double>::quiet_NaN();
+            }
+
             bool canConvert;
-            double value = m_data->m_string.simplifyWhiteSpace().toDouble(&canConvert);
+            double value = str.toDouble(&canConvert);
             if (canConvert)
                 return value;
             return numeric_limits<double>::quiet_NaN();
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathVariableReference.h b/src/3rdparty/webkit/WebCore/xml/XPathVariableReference.h
index 811176da46..5e5a59abdd 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathVariableReference.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathVariableReference.h
@@ -33,12 +33,14 @@
 namespace WebCore {
 
     namespace XPath {
-    
+
+        // Variable references are not used with XPathEvaluator.
         class VariableReference : public Expression {
         public:
             VariableReference(const String& name);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { ASSERT_NOT_REACHED(); return Value::NumberValue; }
             String m_name;
         };
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.cpp b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.cpp
index 0d112a5dfa..b7d52f850f 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLStyleSheet.cpp
@@ -30,11 +30,12 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "Frame.h"
-#include "loader.h"
 #include "Node.h"
 #include "XMLTokenizer.h"
+#include "XMLTokenizerScope.h"
 #include "XSLImportRule.h"
 #include "XSLTProcessor.h"
+#include "loader.h"
 
 #include <libxml/uri.h>
 #include <libxslt/xsltutils.h>
@@ -138,7 +139,6 @@ bool XSLStyleSheet::parseString(const String& string, bool)
     // Parse in a single chunk into an xmlDocPtr
     const UChar BOM = 0xFEFF;
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-    setLoaderForLibXMLCallbacks(docLoader());
     if (!m_stylesheetDocTaken)
         xmlFreeDoc(m_stylesheetDoc);
     m_stylesheetDocTaken = false;
@@ -146,8 +146,8 @@ bool XSLStyleSheet::parseString(const String& string, bool)
     Console* console = 0;
     if (Frame* frame = ownerDocument()->frame())
         console = frame->domWindow()->console();
-    xmlSetStructuredErrorFunc(console, XSLTProcessor::parseErrorFunc);
-    xmlSetGenericErrorFunc(console, XSLTProcessor::genericErrorFunc);
+
+    XMLTokenizerScope scope(docLoader(), XSLTProcessor::genericErrorFunc, XSLTProcessor::parseErrorFunc, console);
 
     const char* buffer = reinterpret_cast<const char*>(string.characters());
     int size = string.length() * sizeof(UChar);
@@ -171,13 +171,9 @@ bool XSLStyleSheet::parseString(const String& string, bool)
         BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
         XML_PARSE_NOENT | XML_PARSE_DTDATTR | XML_PARSE_NOWARNING | XML_PARSE_NOCDATA);
     xmlFreeParserCtxt(ctxt);
-    
-    loadChildSheets();
 
-    xmlSetStructuredErrorFunc(0, 0);
-    xmlSetGenericErrorFunc(0, 0);
+    loadChildSheets();
 
-    setLoaderForLibXMLCallbacks(0);
     return m_stylesheetDoc;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTExtensions.cpp b/src/3rdparty/webkit/WebCore/xml/XSLTExtensions.cpp
index d89f08b4f7..069ddd81bb 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTExtensions.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTExtensions.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 
 #if ENABLE(XSLT)
+#include "XSLTExtensions.h"
 
 #include <libxml/xpathInternals.h>
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
index b6444868bf..3865124dbc 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
@@ -55,11 +55,10 @@
 #include <wtf/Assertions.h>
 #include <wtf/Platform.h>
 #include <wtf/Vector.h>
+
 #if PLATFORM(MAC)
 #include "SoftLinking.h"
-#endif
 
-#if PLATFORM(MAC)
 SOFT_LINK_LIBRARY(libxslt);
 SOFT_LINK(libxslt, xsltFreeStylesheet, void, (xsltStylesheetPtr sheet), (sheet))
 SOFT_LINK(libxslt, xsltFreeTransformContext, void, (xsltTransformContextPtr ctxt), (ctxt))
@@ -128,7 +127,7 @@ static xmlDocPtr docLoaderFunc(const xmlChar* uri,
 
             bool requestAllowed = globalDocLoader->frame() && globalDocLoader->doc()->securityOrigin()->canRequest(url);
             if (requestAllowed) {
-                globalDocLoader->frame()->loader()->loadResourceSynchronously(url, error, response, data);
+                globalDocLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
                 requestAllowed = globalDocLoader->doc()->securityOrigin()->canRequest(response.url());
             }
             if (!requestAllowed) {
@@ -284,7 +283,7 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
     return result.release();
 }
 
-static inline RefPtr<DocumentFragment> createFragmentFromSource(const String& sourceString, const String& sourceMIMEType, Node* sourceNode, Document* outputDoc)
+static inline RefPtr<DocumentFragment> createFragmentFromSource(const String& sourceString, const String& sourceMIMEType, Document* outputDoc)
 {
     RefPtr<DocumentFragment> fragment = new DocumentFragment(outputDoc);
     
@@ -433,7 +432,7 @@ PassRefPtr<DocumentFragment> XSLTProcessor::transformToFragment(Node* sourceNode
     
     if (!transformToString(sourceNode, resultMIMEType, resultString, resultEncoding))
         return 0;
-    return createFragmentFromSource(resultString, resultMIMEType, sourceNode, outputDoc);
+    return createFragmentFromSource(resultString, resultMIMEType, outputDoc);
 }
 
 void XSLTProcessor::setParameter(const String& /*namespaceURI*/, const String& localName, const String& value)
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTUnicodeSort.cpp b/src/3rdparty/webkit/WebCore/xml/XSLTUnicodeSort.cpp
index ed66112175..b0b9c7289b 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTUnicodeSort.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTUnicodeSort.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,10 +32,8 @@
 #if ENABLE(XSLT)
 
 #include "PlatformString.h"
-
 #include <libxslt/templates.h>
 #include <libxslt/xsltutils.h>
-
 #include <wtf/unicode/Collator.h>
 
 #if PLATFORM(MAC)
@@ -43,57 +41,29 @@
 #endif
 
 #if PLATFORM(MAC)
+
 SOFT_LINK_LIBRARY(libxslt)
 SOFT_LINK(libxslt, xsltComputeSortResult, xmlXPathObjectPtr*, (xsltTransformContextPtr ctxt, xmlNodePtr sort), (ctxt, sort))
 SOFT_LINK(libxslt, xsltEvalAttrValueTemplate, xmlChar*, (xsltTransformContextPtr ctxt, xmlNodePtr node, const xmlChar *name, const xmlChar *ns), (ctxt, node, name, ns))
 
-static void init_xsltTransformError(xsltTransformContextPtr ctxt, xsltStylesheetPtr style, xmlNodePtr node, const char *, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
-static void (*softLink_xsltTransformError)(xsltTransformContextPtr ctxt, xsltStylesheetPtr style, xmlNodePtr node, const char *, ...) WTF_ATTRIBUTE_PRINTF(4, 5) = init_xsltTransformError;
+static void xsltTransformErrorTrampoline(xsltTransformContextPtr, xsltStylesheetPtr, xmlNodePtr, const char* message, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
 
-static void init_xsltTransformError(xsltTransformContextPtr ctxt, xsltStylesheetPtr style, xmlNodePtr node, const char* msg, ...)
+void xsltTransformErrorTrampoline(xsltTransformContextPtr context, xsltStylesheetPtr style, xmlNodePtr node, const char* message, ...)
 {
-    softLink_xsltTransformError = (void (*) (xsltTransformContextPtr ctxt, xsltStylesheetPtr style, xmlNodePtr node, const char *, ...))dlsym(libxsltLibrary(), "xsltTransformError");
-    ASSERT(softLink_xsltTransformError);
-
     va_list args;
-    va_start(args, msg);
-#if PLATFORM(WIN_OS)
-    char str[1024];
-    vsnprintf(str, sizeof(str) - 1, msg, args);
-#else
-    char* str;
-    vasprintf(&str, msg, args);
-#endif
+    va_start(args, message);
+    char* messageWithArgs;
+    vasprintf(&messageWithArgs, message, args);
     va_end(args);
 
-    softLink_xsltTransformError(ctxt, style, node, "%s", str);
+    static void (*xsltTransformErrorPointer)(xsltTransformContextPtr, xsltStylesheetPtr, xmlNodePtr, const char*, ...) WTF_ATTRIBUTE_PRINTF(4, 5)
+        = reinterpret_cast<void (*)(xsltTransformContextPtr, xsltStylesheetPtr, xmlNodePtr, const char*, ...)>(dlsym(libxsltLibrary(), "xsltTransformError"));
+    xsltTransformErrorPointer(context, style, node, "%s", messageWithArgs);
 
-#if !PLATFORM(WIN_OS)
-    free(str);
-#endif
+    free(messageWithArgs);
 }
 
-inline void xsltTransformError(xsltTransformContextPtr ctxt, xsltStylesheetPtr style, xmlNodePtr node, const char* msg, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
-
-inline void xsltTransformError(xsltTransformContextPtr ctxt, xsltStylesheetPtr style, xmlNodePtr node, const char* msg, ...)
-{
-    va_list args;
-    va_start(args, msg);
-#if PLATFORM(WIN_OS)
-    char str[1024];
-    vsnprintf(str, sizeof(str) - 1, msg, args);
-#else
-    char* str;
-    vasprintf(&str, msg, args);
-#endif
-    va_end(args);
-
-    softLink_xsltTransformError(ctxt, style, node, "%s", str);
-
-#if !PLATFORM(WIN_OS)
-    free(str);
-#endif
-}
+#define xsltTransformError xsltTransformErrorTrampoline
 
 #endif
 
diff --git a/src/3rdparty/webkit/WebKit.pri b/src/3rdparty/webkit/WebKit.pri
index 229890ccc9..ea109bba20 100644
--- a/src/3rdparty/webkit/WebKit.pri
+++ b/src/3rdparty/webkit/WebKit.pri
@@ -14,7 +14,12 @@ building-libs {
         QT += webkit
     } else {
         QMAKE_LIBDIR = $$OUTPUT_DIR/lib $$QMAKE_LIBDIR
-        LIBS += -lQtWebKit
+        mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+            LIBS += -framework QtWebKit
+            QMAKE_FRAMEWORKPATH = $$OUTPUT_DIR/lib $$QMAKE_FRAMEWORKPATH
+        } else {
+            LIBS += -lQtWebKit
+        }
     }
     DEPENDPATH += $$PWD/WebKit/qt/Api
 }
diff --git a/src/3rdparty/webkit/WebKit/ChangeLog b/src/3rdparty/webkit/WebKit/ChangeLog
index 141980eeb1..4d399e2982 100644
--- a/src/3rdparty/webkit/WebKit/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/ChangeLog
@@ -1,3 +1,320 @@
+2009-06-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alice Liu.
+
+        Move WebView internal data into WebViewData.h/mm.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-06-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Added WebDelegateImplementationCaching.h/mm
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-06-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add WebViewInternal.mm.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - WebKit project part of eliminating WebCoreTextRenderer
+
+        * WebKit.xcodeproj/project.pbxproj: Changed WebKitNSStringExtras.m to
+            compile as Objective-C++.
+
+2009-06-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26113: break WebTextCompletionController out into its own source file
+        https://bugs.webkit.org/show_bug.cgi?id=26113
+
+        * WebKit.xcodeproj/project.pbxproj: Add WebTextCompletionController.h/mm.
+
+2009-05-28  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Symlink WebKitPluginHost.app in to place if needed.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-05-24  Darin Adler  <darin@apple.com>
+
+        * StringsNotToBeLocalized.txt: Updated for recent changes. Got rid of most full-file exceptions.
+
+2009-05-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig and Dan Bernstein.
+
+        Fix <rdar://problem/6889644>.
+        
+        * English.lproj/Localizable.strings:
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6870383> Have to enter credentials twice when downloading from a protected page
+
+        * WebKit.xcodeproj/project.pbxproj: Renamed Misc/WebDownload.m as WebDownload.mm, so that
+        it could use C++ code from AuthenticaitonMac.h.
+
+2009-04-27  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Add localizable strings for 
+        <rdar://problem/6724106> WebViews need to implement text checking
+
+        Reviewed by Justin Garcia.
+
+        * English.lproj/Localizable.strings:
+
+2009-04-27  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlsson.
+                
+        <rdar://problem/6352982>
+
+        * WebKit.xcodeproj/project.pbxproj: Added WebNetscapeContainerCheckContextInfo.mm to the project.
+
+2009-04-23  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        * WebKit.xcodeproj/project.pbxproj: Added WebNetscapeContainerCheckPrivate.mm and header to the project.
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Update StringsNotToBeLocalized.txt for recent changes
+
+        Rubber-stamped by John Sullivan.
+
+        * StringsNotToBeLocalized.txt:
+
+2009-04-19  Darin Adler  <darin@apple.com>
+
+        * StringsNotToBeLocalized.txt: Updated for recent changes.
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * WebKit.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+
+2009-04-10  Timothy Hatcher  <timothy@apple.com>
+
+        Remove DOMDocumentPrivate.h now that <rdar://problem/6730996> is fixed.
+
+        Rubber-stamped by Mark Rowe.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-04-09  Mike Thole  <mthole@apple.com>
+
+        Reviewed by Adam Roben.
+
+        * WebKit.xcodeproj/project.pbxproj:
+            Set the Localizable.strings encoding to UTF-16.
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Leopard build once more.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Another attempt at fixing the build.
+        
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-04-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * WebKit.xcodeproj/project.pbxproj: 
+        Add WebDOMOperationsInternal.h and make WebDOMOperationsPrivate.h private. 
+
+2009-04-01  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24990
+        Put SECTORDER_FLAGS into xcconfig files.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-03-27  Darin Adler  <darin@apple.com>
+
+        * StringsNotToBeLocalized.txt: Updated for recent changes.
+
+2009-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/Localizable.strings: Updated.
+        * StringsNotToBeLocalized.txt: Updated for recent changes.
+
+2009-03-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Update Geolocation perimission dialogs to be asynchronous.
+        https://bugs.webkit.org/show_bug.cgi?id=24505
+
+        Add WebGeolocation, a wrapper around WebCore::Geolocation. It mimics the
+        coding style set by WebSecurityOrigin.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-03-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6610666> Revise the Cocoa event model text API
+        
+        Remove nptextinput.h
+        
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-03-03  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6581203> WebCore and WebKit should install the same set of headers during installhdrs phase as build phase
+
+        Reviewed by Mark Rowe.
+
+        The fix is to add INSTALLHDRS_COPY_PHASE = YES and
+        INSTALLHDRS_SCRIPT_PHASE = YES to WebKit.xcconfig, then to
+        make sure various build phase scripts work with the installhdrs
+        build phase.
+
+        * WebKit.xcodeproj/project.pbxproj:
+        - Added shell code to prevent running "Check For Global
+          Initializers", "Check For Exit Time Destructors" and "Check
+          For Weak VTables" scripts during the installhdrs build phase.
+        - Removed UMBRELLA_FRAMEWORKS_DIR from the Debug and Release
+          targets since it's no longer needed after defining
+          WEBCORE_PRIVATE_HEADERS_DIR in WebKit.xcconfig.
+
+2009-03-03  David Kilzer  <ddkilzer@apple.com>
+
+        Remove last vestiges of JAVASCRIPTCORE_PRIVATE_HEADERS_DIR from WebKit
+
+        Reviewed by Adam Roben.
+
+        Use of JAVASCRIPTCORE_PRIVATE_HEADERS_DIR was removed in r37465
+        since NPAPI headers had migrated from JavaScriptCore to WebCore
+        before that.
+
+        * WebKit.xcodeproj/project.pbxproj: Removed
+        JAVASCRIPTCORE_PRIVATE_HEADERS_DIR build setting from from Debug
+        and Release configurations.
+
+2009-03-02  Anders Carlsson  <andersca@apple.com>
+
+        WebNetscapePluginPackage.mm is an Objective-C++ file.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-03-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Rename WebNetscapePluginPackage.m to WebNetscapePluginPackage.mm
+        
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-02-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add new files.
+        
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-02-13  Darin Adler  <darin@apple.com>
+
+        * StringsNotToBeLocalized.txt: Updated for recent changes.
+
+2009-02-07  Darin Adler  <darin@apple.com>
+
+        * StringsNotToBeLocalized.txt: Updated for recent changes.
+
+2009-02-04  Timothy Hatcher  <timothy@apple.com>
+
+        Removed the WebDefaultScriptDebugDelegate now that we have CallScriptDebugDelegate.
+
+        <rdar://problem/6508457> Launching widget in Dashcode debugger is
+        super-slow due forwardInvocation: calling debug delegate
+
+        Reviewed by Oliver Hunt.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        Remove WebKitPluginContainerView.{h|mm}, they aren't used anywhere.
+        
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-01-26  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Clean up after r40240.
+
+        * WebKit.xcodeproj/project.pbxproj: Reinstate WebKitPluginHost.defs.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Try to fix full build on Mac Leopard.
+
+        * WebKit.xcodeproj/project.pbxproj: Removed WebKitPluginClient.defs from the WebKit target.
+        Maybe this is temporary, but I had to do it to get the full build to succeed.
+
+2009-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Improve the consistency of settings in our .xcconfig files.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-01-23  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Darin Adler
+
+        Rename CachedPagePlatformData to CachedFramePlatformData to more accurately reflect its true role.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-01-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add ProxyInstance files.
+        
+        * WebKit.xcodeproj/project.pbxproj:
+
 2009-01-04  David Kilzer  <ddkilzer@apple.com>
 
         Don't install internal headers in WebKit framework
diff --git a/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt b/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
index 4aef3b2ee4..003de11053 100644
--- a/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
+++ b/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
@@ -7,6 +7,7 @@
 " >>>"
 " Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko) %@"
 " Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko)"
+" Version/3.2.1"
 " webViewDrawResizer delegate call"
 "#"
 "%"
@@ -42,6 +43,7 @@
 ","
 "-"
 "-1px"
+"-createPluginMIMETypesPreferences"
 "-khtml-text-decorations-in-effect"
 "."
 "._"
@@ -58,6 +60,7 @@
 "/Volumes"
 "/tmp/XXXXXX.tiff"
 "0"
+"062AEEE3-9E42-44DC-A8A9-236B216FE011"
 "1"
 "1000"
 "12px"
@@ -75,6 +78,7 @@
 ":"
 "://"
 ":/?#"
+";"
 "<!"
 "<%@ %@>"
 "<?"
@@ -93,6 +97,7 @@
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+.-"
 "AXEnhancedUserInterface"
+"AccessibleBase"
 "AccessibleObjectFromWindow"
 "AllowsUndo"
 "Apple Web Archive pasteboard type"
@@ -103,16 +108,17 @@
 "BEGIN:VCARD"
 "BP_CreatePluginMIMETypesPreferences"
 "CFDictionaryPropertyBag"
-"CFNetwork"
-"CFNetwork_debug"
-"CFURLCacheCopySharedURLCache"
 "CSS"
+"Change Back to \\U201C%@\\U201D"
 "Content-Encoding"
 "Content-Length"
 "Content-Type"
+"D"
 "DCMDictionaryServiceWindowShow"
 "DELEGATE METHODS"
 "DOCBASE"
+"DOMHTMLObjectElement"
+"DOMNode"
 "DYLD_FRAMEWORK_PATH"
 "DefaultDownloadDelegate"
 "DefaultPolicyDelegate"
@@ -120,6 +126,7 @@
 "DeleteForward"
 "DeleteWordBackward"
 "DeleteWordForward"
+"DisableWebKitDeveloperExtras"
 "FD3B2381-0BB6-4B59-AF09-0E599C8901CF"
 "FastMallocFreeSizeInCaches"
 "FastMallocFreeSizeInHeap"
@@ -127,8 +134,10 @@
 "FastMallocReturnedSize"
 "FrameName"
 "GEN_DOMObject"
+"GET"
 "GroupName"
 "HIDictionaryWindowShow"
+"HTTP "
 "Helvetica"
 "IDNScriptWhiteList"
 "IDNScriptWhiteList.txt"
@@ -145,6 +154,7 @@
 "ImmReleaseContext"
 "ImmSetCandidateWindow"
 "ImmSetOpenStatus"
+"IncludeDebugMenu"
 "InsertBacktab"
 "InsertNewline"
 "InsertTab"
@@ -153,16 +163,16 @@
 "JavaScriptFreeSize"
 "JavaScriptHeapSize"
 "Joy!peff"
-"KWQScrollBar"
 "LTR"
 "Library/Caches"
 "Library/Internet Plug-Ins"
 "LresultFromObject"
 "Lucida Grande"
-"MIMEType"
 "MIME\\Database\\Content Type"
 "MainPageJavaScript.js"
 "MemoryStream"
+"MenuCommands"
+"Microsoft/com.microsoft.Messenger"
 "MoveDown"
 "MoveDownAndModifySelection"
 "MoveLeft"
@@ -188,7 +198,9 @@
 "MoveWordRight"
 "MoveWordRightAndModifySelection"
 "Mozilla/5.0 (Macintosh; U; "
+"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-us) AppleWebKit/525.28.3 (KHTML, like Gecko) Version/3.2.3 Safari/525.28.3"
 "Mozilla/5.0 (Windows; U; %s; %s) AppleWebKit/%s (KHTML, like Gecko)%s%s"
+"Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.28.3 (KHTML, like Gecko) Version/3.2.3 Safari/525.29"
 "NP_GetEntryPoints"
 "NP_Initialize"
 "NP_Shutdown"
@@ -207,6 +219,7 @@
 "PDFViewChangedPage"
 "PDFViewDisplayModeChanged"
 "PDFViewScaleChanged"
+"PNG"
 "POST"
 "PPC"
 "Quartz.framework"
@@ -215,6 +228,7 @@
 "SAMILang"
 "SAMIStyle"
 "Safari.exe"
+"SelectAll"
 "Times"
 "ToggleBold"
 "ToggleItalic"
@@ -224,6 +238,7 @@
 "UseBackForwardList"
 "User-Agent"
 "Volumes"
+"W"
 "WEBKIT_UNSET_DYLD_FRAMEWORK_PATH"
 "WebActionButtonKey"
 "WebActionElementKey"
@@ -299,6 +314,7 @@
 "WebJavaScriptCollector"
 "WebJavaScriptTextInputPanel"
 "WebKitClassFactory"
+"WebKitDeveloperExtras"
 "WebKitErrorDomain"
 "WebKitErrorMIMETypeKey"
 "WebKitErrorPlugInNameKey"
@@ -307,6 +323,8 @@
 "WebKitHistoryItemLimit"
 "WebKitInspectorAttached"
 "WebKitInspectorAttachedViewHeight"
+"WebKitInspectorHiddenPanels"
+"WebKitLocalCache"
 "WebKitLogLevel"
 "WebKitOmitPDFSupport"
 "WebKitOriginalBottomMargin"
@@ -347,6 +365,9 @@
 "WebPluginTypeEnabled"
 "WebPluginWillPresentNativeUserInterface"
 "WebPreferences"
+"WebPreferences%d"
+"WebPreferencesChangedNotification"
+"WebPreferencesRemovedNotification"
 "WebProgressEstimateChangedNotification"
 "WebProgressFinishedNotification"
 "WebProgressStartedNotification"
@@ -358,8 +379,6 @@
 "WebResourceResponse"
 "WebResourceTextEncodingName"
 "WebResourceURL"
-"WebScriptCallFrame"
-"WebScriptDebugServer"
 "WebScriptErrorDescription"
 "WebScriptErrorDomain"
 "WebScriptErrorLineNumber"
@@ -375,6 +394,7 @@
 "WebURLCredential"
 "WebURLProtectionSpace"
 "WebURLResponse"
+"WebURLsWithTitlesPboardType"
 "WebView"
 "WebViewDidBeginEditingNotification"
 "WebViewDidChangeNotification"
@@ -382,6 +402,12 @@
 "WebViewDidChangeTypingStyleNotification"
 "WebViewDidEndEditingNotification"
 "WebViewWindowClass"
+"WhatsNewPanel"
+"Windows %d.%d"
+"Windows 95"
+"Windows 98"
+"Windows 98; Win 9x 4.90"
+"Windows NT %d.%d"
 "XSL"
 "XXXXXX-"
 "\"@?"
@@ -399,12 +425,15 @@
 "\n--------------------------------------------\n"
 "\r"
 "\xFF\xD8\xFF\xE0"
+"_isUsingAcceleratedCompositing"
 "_top"
 "a"
 "ab"
 "about:"
+"ads.pointroll.com"
 "applewebdata"
 "applewebdata://%@"
+"application.pdf"
 "application/atom+xml"
 "application/octet-stream"
 "application/pdf"
@@ -423,6 +452,7 @@
 "canGoBack"
 "canGoForward"
 "com.RealNetworks.RealOne Player"
+"com.adiumX.adiumX"
 "com.adobe.Acrobat"
 "com.adobe.Acrobat.Pro"
 "com.adobe.Contribute"
@@ -433,8 +463,15 @@
 "com.adobe.Soundbooth"
 "com.adobe.distiller"
 "com.adobe.dreamweaver-9.0"
+"com.alientechnology.Proteus"
+"com.app4mac.KidsBrowsercom.app4mac.wKiosk"
+"com.apple."
 "com.apple.Aperture"
 "com.apple.AppKit"
+"com.apple.Automator"
+"com.apple.Automator."
+"com.apple.AutomatorRunner"
+"com.apple.Dashcode"
 "com.apple.Dictionary"
 "com.apple.HIWebView"
 "com.apple.JavaAppletPlugin"
@@ -445,31 +482,64 @@
 "com.apple.WebCore"
 "com.apple.WebKit"
 "com.apple.WebKit.PluginAgent"
+"com.apple.Xcode"
+"com.apple.dashboard.client"
+"com.apple.helpviewer"
 "com.apple.hiview"
+"com.apple.iChat"
 "com.apple.iWeb"
+"com.apple.installer"
 "com.apple.mail"
 "com.apple.quicktime.webplugin"
 "com.apple.universalaccess"
+"com.barebones.bbedit"
+"com.barebones.textwrangler"
+"com.barebones.yojimbo"
+"com.culturedcode.xyle"
+"com.equinux.iSale4"
+"com.freeverse.bumpercar"
+"com.growl.growlframework"
+"com.intrarts.PandoraMan"
+"com.karelia.Sandvox"
 "com.lizardtech.NPDjVu"
+"com.macrabbit.CSSEdit"
+"com.macromates.textmate"
+"com.macromedia.Flash Player.plugin"
 "com.macromedia.fireworks"
+"com.microsoft.SilverlightPlugin"
 "com.microsoft.WMP.defaultplugin"
-"copyData"
+"com.omnigroup.OmniWeb5"
+"com.panic.Coda"
+"com.ranchero.NetNewsWire"
+"com.realmacsoftware.rapidweaverpro"
+"com.red-sweater.marsedit"
+"com.sunrisebrowser.Sunrise"
+"com.thinkmac.NewsLife"
+"com.yahoo.messenger3"
+"cp949"
 "cpuType"
+"de.codingmonkeys.SubEthaEdit"
 "dir"
 "displayTitle"
 "doctype"
 "en"
 "estimatedProgress"
-"eval"
+"fi.karppinen.Pyro"
 "file:"
 "frameName"
 "ftp:"
+"fullFrame"
+"groupName"
 "htm"
 "html"
+"http"
+"http:"
 "http://"
 "http://www.google.com/search?q="
 "https"
+"https:"
 "i"
+"iLifeWelcomePanel"
 "icon.db"
 "image.pict"
 "image.png"
@@ -480,12 +550,19 @@
 "image/svg+xml"
 "image/tiff"
 "img"
+"info.colloquy"
 "insertText:"
 "isLoading"
 "isindex"
 "javascript:"
+"jpeg"
+"jpg"
 "js"
+"kioskmode"
+"ks_c_5601-1987"
+"kungfoo.tv.ecto"
 "lastVisitWasFailure"
+"lastVisitWasHTTPNonGet"
 "lastVisitedDate"
 "line-through"
 "lineNumber"
@@ -497,23 +574,40 @@
 "mainFrameIcon"
 "mainFrameTitle"
 "mainFrameURL"
-"mainResource"
 "mimeType"
+"missingImage"
 "name: %@\npath: %@\nmimeTypes:\n%@\npluginDescription:%@"
+"net.hmdt-web.Shiira"
+"nullPlugin"
 "nullplugin"
 "oleacc.dll"
+"org.xlife.NewsFire"
+"panEastCursor"
+"panIcon"
+"panNorthCursor"
+"panNorthEastCursor"
+"panNorthWestCursor"
+"panSouthCursor"
+"panSouthEastCursor"
+"panSouthWestCursor"
+"panWestCursor"
 "pluginHostPath"
 "pluginspage"
+"public.url"
+"public.url-name"
 "r"
 "r+b"
+"redirectURLs"
 "rgb(%.0f,%.0f,%.0f)"
 "rgba(%.0f,%.0f,%.0f,%f)"
 "s"
+"searchCancel"
+"searchCancelPressed"
+"searchMagnifier"
+"searchMagnifierResults"
 "sourceURL"
 "src"
 "sub"
-"subframeArchives"
-"subresources"
 "text/calendar"
 "text/directory"
 "text/html"
@@ -530,13 +624,17 @@
 "text/x-vcalendar"
 "text/x-vcard"
 "text/x-vcf"
-"textEncodingName"
+"textAreaResizeCorner"
 "tiff"
 "txt"
 "u"
+"uk.co.opencommunity.vienna2"
 "userAgent"
+"userInfo"
 "utf-16"
 "vImagePermuteChannels_ARGB8888"
+"verticalTextCursor"
+"visibleName"
 "visitCount"
 "webkit-fake-url"
 "webplugin"
@@ -544,35 +642,38 @@
 "x-apple-web-kit/"
 "xml"
 "xsl"
+"zoomInCursor"
+"zoomOutCursor"
 "{A3676398-4485-4a9d-87DC-CB5A40E6351D}"
 "~/Library/Icons"
 "~/Library/WebKit/Databases"
 WebKit/mac/History/WebHistoryItem.mm:" in \"%@\""
 WebKit/mac/History/WebHistoryItem.mm:"children"
 WebKit/mac/History/WebHistoryItem.mm:"title"
-WebKit/mac/History/WebURLsWithTitles.h:"WebURLsWithTitlesPboardType"
 WebKit/mac/Misc/WebCache.mm:"Images"
 WebKit/mac/Misc/WebKitLogging.h:"<not running on main thread>"
 WebKit/mac/Misc/WebKitVersionChecks.m:"WebKit"
-WebKit/mac/Misc/WebNSNotificationCenterExtras.m
-WebKit/mac/Misc/WebNSObjectExtras.mm:"selector"
-WebKit/mac/Misc/WebNSObjectExtras.mm:"value"
-WebKit/mac/Misc/WebNSPasteboardExtras.mm
+WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"name"
+WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"object"
 WebKit/mac/Misc/WebNSURLExtras.mm:"file"
 WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:" OK\n"
 WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:"HTTP "
 WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:"identity"
+WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm:"localization"
 WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm:" OK\n"
 WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm:"HTTP "
 WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm:"identity"
+WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"DIRECT"
+WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"PROXY "
+WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"SOCKS "
+WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"basic"
+WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"digest"
+WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"true"
 WebKit/mac/Plugins/WebBasePluginPackage.mm:"Java Applet Plugin Enabler"
-WebKit/mac/Plugins/WebNetscapePluginPackage.m:"RealPlayer Plugin"
-WebKit/mac/Plugins/WebNetscapePluginPackage.m:"main"
+WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"RealPlayer Plugin"
+WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"main"
 WebKit/mac/Plugins/WebNetscapePluginView.mm:"height"
 WebKit/mac/Plugins/WebNetscapePluginView.mm:"width"
-WebKit/mac/Plugins/nptextinput.h
 WebKit/mac/WebCoreSupport/WebChromeClient.mm:"dialog"
 WebKit/mac/WebCoreSupport/WebChromeClient.mm:"fullscreen"
 WebKit/mac/WebCoreSupport/WebChromeClient.mm:"height"
@@ -591,7 +692,6 @@ WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"height"
 WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"width"
 WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Web Inspector 2"
 WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"inspector"
-WebKit/mac/WebView/WebArchive.mm:"result"
 WebKit/mac/WebView/WebHTMLView.mm:"'%@'"
 WebKit/mac/WebView/WebHTMLView.mm:"Version:"
 WebKit/mac/WebView/WebHTMLView.mm:"applet"
@@ -617,19 +717,26 @@ WebKit/mac/WebView/WebHTMLView.mm:"transparent"
 WebKit/mac/WebView/WebHTMLView.mm:"underline"
 WebKit/mac/WebView/WebHTMLView.mm:"white"
 WebKit/mac/WebView/WebPreferenceKeysPrivate.h
-WebKit/mac/WebView/WebPreferences.mm
-WebKit/mac/WebView/WebResource.mm:"URL"
-WebKit/mac/WebView/WebResource.mm:"data"
-WebKit/mac/WebView/WebResource.mm:"response"
-WebKit/mac/WebView/WebResource.mm:"result"
+WebKit/mac/WebView/WebPreferences.mm:"Apple Chancery"
+WebKit/mac/WebView/WebPreferences.mm:"Courier"
+WebKit/mac/WebView/WebPreferences.mm:"ISO-8859-1"
+WebKit/mac/WebView/WebPreferences.mm:"Identifier"
+WebKit/mac/WebView/WebPreferences.mm:"Papyrus"
+WebKit/mac/WebView/WebPreferences.mm:"Values"
 WebKit/mac/WebView/WebView.mm:"At least one WebView is still open."
 WebKit/mac/WebView/WebView.mm:"At least one WebView was closed with fast teardown."
 WebKit/mac/WebView/WebView.mm:"Preferences"
 WebKit/mac/WebView/WebView.mm:"Search With Google"
 WebKit/mac/WebView/WebView.mm:"control"
+WebKit/mac/WebView/WebView.mm:"data"
+WebKit/mac/WebView/WebView.mm:"decoder"
+WebKit/mac/WebView/WebView.mm:"frame"
 WebKit/mac/WebView/WebView.mm:"return "
-WebKit/win/AccessibleBase.cpp
-WebKit/win/DOMCoreClasses.h
+WebKit/win/AccessibleBase.cpp:"Alt+"
+WebKit/win/AccessibleBase.cpp:"Ctrl+"
+WebKit/win/AccessibleBase.cpp:"Description: "
+WebKit/win/AccessibleBase.cpp:"Shift+"
+WebKit/win/AccessibleBase.cpp:"Win+"
 WebKit/win/ProgIDMacros.h:"OpenSource"
 WebKit/win/ProgIDMacros.h:"WebKit."
 WebKit/win/WebCache.cpp:"images"
@@ -640,15 +747,11 @@ WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Web Inspector"
 WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"inspector"
 WebKit/win/WebDatabaseManager.cpp:"Databases"
 WebKit/win/WebHistoryItem.cpp:"title"
-WebKit/win/WebKitDLL.cpp
 WebKit/win/WebPreferenceKeysPrivate.h
 WebKit/win/WebPreferences.cpp:"Arial"
 WebKit/win/WebPreferences.cpp:"Comic Sans MS"
 WebKit/win/WebPreferences.cpp:"Courier New"
 WebKit/win/WebPreferences.cpp:"Times New Roman"
-WebKit/win/WebScriptCallFrame.cpp:"False"
-WebKit/win/WebScriptCallFrame.cpp:"True"
-WebKit/win/WebScriptCallFrame.cpp:"undefined"
 WebKit/win/WebURLResponse.cpp:"Extension"
 WebKit/win/WebView.cpp:"Cancel"
 WebKit/win/WebView.cpp:"Copy"
@@ -656,11 +759,5 @@ WebKit/win/WebView.cpp:"Cut"
 WebKit/win/WebView.cpp:"Delete"
 WebKit/win/WebView.cpp:"Paste"
 WebKit/win/WebView.cpp:"Redo"
-WebKit/win/WebView.cpp:"SelectAll"
 WebKit/win/WebView.cpp:"Undo"
-WebKit/win/WebView.cpp:"Windows %d.%d"
-WebKit/win/WebView.cpp:"Windows 95"
-WebKit/win/WebView.cpp:"Windows 98"
-WebKit/win/WebView.cpp:"Windows 98; Win 9x 4.90"
-WebKit/win/WebView.cpp:"Windows NT %d.%d"
 WebKit/win/WebView.cpp:"about"
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/headers.pri b/src/3rdparty/webkit/WebKit/qt/Api/headers.pri
index 2b3c94048a..e4bb618a8a 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/headers.pri
+++ b/src/3rdparty/webkit/WebKit/qt/Api/headers.pri
@@ -5,4 +5,5 @@ WEBKIT_API_HEADERS = $$PWD/qwebframe.h \
                      $$PWD/qwebsettings.h \
                      $$PWD/qwebhistoryinterface.h \
                      $$PWD/qwebdatabase.h \
-                     $$PWD/qwebsecurityorigin.h
+                     $$PWD/qwebsecurityorigin.h \
+                     $$PWD/qwebelement.h
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebdatabase.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebdatabase.cpp
index 489ab17a57..2db9cd006a 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebdatabase.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebdatabase.cpp
@@ -19,6 +19,7 @@
 
 #include "config.h"
 #include "qwebdatabase.h"
+
 #include "qwebdatabase_p.h"
 #include "qwebsecurityorigin.h"
 #include "qwebsecurityorigin_p.h"
@@ -69,8 +70,12 @@ QString QWebDatabase::name() const
 */
 QString QWebDatabase::displayName() const
 {
+#if ENABLE(DATABASE)
     DatabaseDetails details = DatabaseTracker::tracker().detailsForNameAndOrigin(d->name, d->origin.get());
     return details.displayName();
+#else
+    return QString();
+#endif
 }
 
 /*!
@@ -78,8 +83,12 @@ QString QWebDatabase::displayName() const
 */
 qint64 QWebDatabase::expectedSize() const
 {
+#if ENABLE(DATABASE)
     DatabaseDetails details = DatabaseTracker::tracker().detailsForNameAndOrigin(d->name, d->origin.get());
     return details.expectedUsage();
+#else
+    return 0;
+#endif
 }
 
 /*!
@@ -87,8 +96,12 @@ qint64 QWebDatabase::expectedSize() const
 */
 qint64 QWebDatabase::size() const
 {
+#if ENABLE(DATABASE)
     DatabaseDetails details = DatabaseTracker::tracker().detailsForNameAndOrigin(d->name, d->origin.get());
     return details.currentUsage();
+#else
+    return 0;
+#endif
 }
 
 /*!
@@ -118,7 +131,11 @@ QWebDatabase::QWebDatabase(QWebDatabasePrivate* priv)
 */
 QString QWebDatabase::fileName() const
 {
+#if ENABLE(DATABASE)
     return DatabaseTracker::tracker().fullPathForDatabase(d->origin.get(), d->name, false);
+#else
+    return QString();
+#endif
 }
 
 /*!
@@ -137,7 +154,9 @@ QWebSecurityOrigin QWebDatabase::origin() const
 */
 void QWebDatabase::removeDatabase(const QWebDatabase &db)
 {
+#if ENABLE(DATABASE)
     DatabaseTracker::tracker().deleteDatabase(db.d->origin.get(), db.d->name);
+#endif
 }
 
 /*!
@@ -146,3 +165,4 @@ void QWebDatabase::removeDatabase(const QWebDatabase &db)
 QWebDatabase::~QWebDatabase()
 {
 }
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
new file mode 100644
index 0000000000..ff0463b0d4
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
@@ -0,0 +1,1603 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qwebelement.h"
+
+#include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSParser.h"
+#include "CSSRuleList.h"
+#include "CSSRule.h"
+#include "CSSStyleRule.h"
+#include "CString.h"
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "FrameView.h"
+#include "HTMLElement.h"
+#include "JSGlobalObject.h"
+#include "JSHTMLElement.h"
+#include "JSObject.h"
+#include "NodeList.h"
+#include "PropertyNameArray.h"
+#include "ScriptFunctionCall.h"
+#include "StaticNodeList.h"
+#include "qt_runtime.h"
+#include "qwebframe.h"
+#include "qwebframe_p.h"
+#include "runtime_root.h"
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+
+class QWebElementPrivate
+{
+public:
+};
+
+/*!
+    \class QWebElement
+    \since 4.6
+    \brief The QWebElement class provides convenience access to DOM elements in a QWebFrame.
+    \preliminary
+
+    QWebElement is the main class to provide easy access to the document model.
+    The document model is represented by a tree-like structure of DOM elements.
+    The root of the tree is called the document element and can be accessed using QWebFrame::documentElement().
+
+    You can reach specific elements by using the findAll() and findFirst() functions, which
+    allow the use of CSS selectors to identify elements.
+
+    \snippet webkitsnippets/webelement/main.cpp FindAll
+
+    The first list contains all span elements in the document. The second list contains
+    only the span elements that are children of the paragraph that is classified
+    as "intro" paragraph.
+
+    Alternatively you can manually traverse the document using firstChild() and nextSibling():
+
+    \snippet webkitsnippets/webelement/main.cpp Traversing with QWebElement
+
+    The underlying content of QWebElement is explicitly shared. Creating a copy of a QWebElement
+    does not create a copy of the content, both instances point to the same underlying element.
+
+    The element's attributes can be read using attribute() and changed using setAttribute().
+
+    The content of the child elements can be converted to plain text using toPlainText() and to
+    x(html) using toXml(), and it is possible to replace the content using setPlainText() and setXml().
+
+    Depending on the type of the underlying element there may be extra functionality available, not
+    covered through QWebElement's API. For example a HTML form element can be triggered to submit the
+    entire form. These list of these functions is available through functions() and they can be called
+    directly using callFunction().
+*/
+
+/*!
+    Constructs a null web element.
+*/
+QWebElement::QWebElement()
+    : d(0)
+    , m_element(0)
+{
+}
+
+/*!
+    \internal
+*/
+QWebElement::QWebElement(WebCore::Element* domElement)
+    : d(0)
+    , m_element(domElement)
+{
+    if (m_element)
+        m_element->ref();
+}
+
+/*!
+    \internal
+*/
+QWebElement::QWebElement(WebCore::Node* node)
+    : d(0)
+    , m_element(0)
+{
+    if (node && node->isHTMLElement()) {
+        m_element = static_cast<HTMLElement*>(node);
+        m_element->ref();
+    }
+}
+
+/*!
+    Constructs a copy of \a other.
+*/
+QWebElement::QWebElement(const QWebElement &other)
+    : d(0)
+    , m_element(other.m_element)
+{
+    if (m_element)
+        m_element->ref();
+}
+
+/*!
+    Assigns \a other to this element and returns a reference to this element.
+*/
+QWebElement &QWebElement::operator=(const QWebElement &other)
+{
+    // ### handle "d" assignment
+    if (this != &other) {
+        Element *otherElement = other.m_element;
+        if (otherElement)
+            otherElement->ref();
+        if (m_element)
+            m_element->deref();
+        m_element = otherElement;
+    }
+    return *this;
+}
+
+/*!
+    Destroys the element. The underlying DOM element is not destroyed.
+*/
+QWebElement::~QWebElement()
+{
+    delete d;
+    if (m_element)
+        m_element->deref();
+}
+
+bool QWebElement::operator==(const QWebElement& o) const
+{
+    return m_element == o.m_element;
+}
+
+bool QWebElement::operator!=(const QWebElement& o) const
+{
+    return m_element != o.m_element;
+}
+
+/*!
+    Returns true if the element is a null element; false otherwise.
+*/
+bool QWebElement::isNull() const
+{
+    return !m_element;
+}
+
+/*!
+    Returns a new collection of elements that are children of this element
+    and that match the given CSS selector \a selectorQuery.
+
+    The query is specified using \l{http://www.w3.org/TR/REC-CSS2/selector.html#q1}{standard CSS2 selectors}.
+*/
+QList<QWebElement> QWebElement::findAll(const QString &selectorQuery) const
+{
+    QList<QWebElement> elements;
+    if (!m_element)
+        return elements;
+
+    ExceptionCode exception = 0; // ###
+    RefPtr<NodeList> nodes = m_element->querySelectorAll(selectorQuery, exception);
+    if (!nodes)
+        return elements;
+
+    for (int i = 0; i < nodes->length(); ++i) {
+        WebCore::Node* n = nodes->item(i);
+        elements.append(QWebElement(static_cast<Element*>(n)));
+    }
+
+    return elements;
+}
+
+/*!
+    Returns the first child element that matches the given CSS selector \a selectorQuery.
+
+    This function is equivalent to calling findAll() and taking only the
+    first element in the returned collection of elements. However calling
+    this function is more efficient.
+*/
+QWebElement QWebElement::findFirst(const QString &selectorQuery) const
+{
+    if (!m_element)
+        return QWebElement();
+    ExceptionCode exception = 0; // ###
+    return QWebElement(m_element->querySelector(selectorQuery, exception).get());
+}
+
+/*!
+    Replaces the existing content of this element with \a text.
+
+    This is equivalent to setting the HTML innerText property.
+*/
+void QWebElement::setPlainText(const QString &text)
+{
+    if (!m_element || !m_element->isHTMLElement())
+        return;
+    ExceptionCode exception = 0;
+    static_cast<HTMLElement*>(m_element)->setInnerText(text, exception);
+}
+
+/*!
+    Returns the text between the start and the end tag of this
+    element.
+
+    This is equivalent to reading the HTML innerText property.
+*/
+QString QWebElement::toPlainText() const
+{
+    if (!m_element || !m_element->isHTMLElement())
+        return QString();
+    return static_cast<HTMLElement*>(m_element)->innerText();
+}
+
+/*!
+    Replaces the contents of this element as well as its own tag with \a markup.
+    The string may contain HTML or XML tags, which is parsed and formatted
+    before insertion into the document.
+
+    \note This is currently only implemented for (X)HTML elements.
+*/
+void QWebElement::setOuterXml(const QString &markup)
+{
+    if (!m_element || !m_element->isHTMLElement())
+        return;
+
+    ExceptionCode exception = 0;
+
+    static_cast<HTMLElement*>(m_element)->setOuterHTML(markup, exception);
+}
+
+/*!
+    Returns this element converted to XML, including the start and the end
+    tag of this element and its attributes.
+
+    \note This is currently only implemented for (X)HTML elements.
+*/
+QString QWebElement::toOuterXml() const
+{
+    if (!m_element || !m_element->isHTMLElement())
+        return QString();
+
+    return static_cast<HTMLElement*>(m_element)->outerHTML();
+}
+
+/*!
+    Replaces the content of this element with \a markup.
+    The string may contain HTML or XML tags, which is parsed and formatted
+    before insertion into the document.
+
+    \note This is currently only implemented for (X)HTML elements.
+*/
+void QWebElement::setInnerXml(const QString &markup)
+{
+    if (!m_element || !m_element->isHTMLElement())
+        return;
+
+    ExceptionCode exception = 0;
+
+    static_cast<HTMLElement*>(m_element)->setInnerHTML(markup, exception);
+}
+
+/*!
+    Returns the XML between the start and the end tag of this
+    element.
+
+    \note This is currently only implemented for (X)HTML elements.
+*/
+QString QWebElement::toInnerXml() const
+{
+    if (!m_element || !m_element->isHTMLElement())
+        return QString();
+
+    return static_cast<HTMLElement*>(m_element)->innerHTML();
+}
+
+/*!
+    Adds an attribute called \a name with the value \a value. If an attribute
+    with the same name exists, its value is replaced by \a value.
+*/
+void QWebElement::setAttribute(const QString &name, const QString &value)
+{
+    if (!m_element)
+        return;
+    ExceptionCode exception = 0;
+    m_element->setAttribute(name, value, exception);
+}
+
+/*!
+    Adds an attribute called \a name in the namespace described with \a namespaceUri
+    with the value \a value. If an attribute with the same name exists, its value is
+    replaced by \a value.
+*/
+void QWebElement::setAttributeNS(const QString &namespaceUri, const QString &name, const QString &value)
+{
+    if (!m_element)
+        return;
+    WebCore::ExceptionCode exception = 0;
+    m_element->setAttributeNS(namespaceUri, name, value, exception);
+}
+
+/*!
+    Returns the attributed called \a name. If the attribute does not exist \a defaultValue is
+    returned.
+*/
+QString QWebElement::attribute(const QString &name, const QString &defaultValue) const
+{
+    if (!m_element)
+        return QString();
+    if (m_element->hasAttribute(name))
+        return m_element->getAttribute(name);
+    else
+        return defaultValue;
+}
+
+/*!
+    Returns the attributed called \a name in the namespace described with \a namespaceUri.
+    If the attribute does not exist \a defaultValue is returned.
+*/
+QString QWebElement::attributeNS(const QString &namespaceUri, const QString &name, const QString &defaultValue) const
+{
+    if (!m_element)
+        return QString();
+    if (m_element->hasAttributeNS(namespaceUri, name))
+        return m_element->getAttributeNS(namespaceUri, name);
+    else
+        return defaultValue;
+}
+
+/*!
+    Returns true if this element has an attribute called \a name; otherwise returns false.
+*/
+bool QWebElement::hasAttribute(const QString &name) const
+{
+    if (!m_element)
+        return false;
+    return m_element->hasAttribute(name);
+}
+
+/*!
+    Returns true if this element has an attribute called \a name in the namespace described
+    with \a namespaceUri; otherwise returns false.
+*/
+bool QWebElement::hasAttributeNS(const QString &namespaceUri, const QString &name) const
+{
+    if (!m_element)
+        return false;
+    return m_element->hasAttributeNS(namespaceUri, name);
+}
+
+/*!
+    Removes the attribute called \a name from this element.
+*/
+void QWebElement::removeAttribute(const QString &name)
+{
+    if (!m_element)
+        return;
+    ExceptionCode exception = 0;
+    m_element->removeAttribute(name, exception);
+}
+
+/*!
+    Removes the attribute called \a name in the namespace described with \a namespaceUri
+    from this element.
+*/
+void QWebElement::removeAttributeNS(const QString &namespaceUri, const QString &name)
+{
+    if (!m_element)
+        return;
+    WebCore::ExceptionCode exception = 0;
+    m_element->removeAttributeNS(namespaceUri, name, exception);
+}
+
+/*!
+    Returns true if the element has any attributes defined; otherwise returns false;
+*/
+bool QWebElement::hasAttributes() const
+{
+    if (!m_element)
+        return false;
+    return m_element->hasAttributes();
+}
+
+/*!
+    Returns the geometry of this element, relative to its containing frame.
+*/
+QRect QWebElement::geometry() const
+{
+    if (!m_element)
+        return QRect();
+    return m_element->getRect();
+}
+
+/*!
+    Returns the tag name of this element.
+*/
+QString QWebElement::tagName() const
+{
+    if (!m_element)
+        return QString();
+    return m_element->tagName();
+}
+
+/*!
+    Returns the namespace prefix of the element or an empty string if the element has no namespace prefix.
+*/
+QString QWebElement::prefix() const
+{
+    if (!m_element)
+        return QString();
+    return m_element->prefix();
+}
+
+/*!
+    If the element uses namespaces, this function returns the local name of the element;
+    otherwise it returns an empty string.
+*/
+QString QWebElement::localName() const
+{
+    if (!m_element)
+        return QString();
+    return m_element->localName();
+}
+
+/*!
+    Returns the namespace URI of this element or an empty string if the element has no namespace URI.
+*/
+QString QWebElement::namespaceUri() const
+{
+    if (!m_element)
+        return QString();
+    return m_element->namespaceURI();
+}
+
+/*!
+    Returns the parent element of this element or a null element if this element
+    is the root document element.
+*/
+QWebElement QWebElement::parent() const
+{
+    if (m_element)
+        return QWebElement(m_element->parentElement());
+    return QWebElement();
+}
+
+/*!
+    Returns the first child element of this element.
+
+    \sa lastChild() previousSibling() nextSibling()
+*/
+QWebElement QWebElement::firstChild() const
+{
+    if (!m_element)
+        return QWebElement();
+    for (Node* child = m_element->firstChild(); child; child = child->nextSibling()) {
+        if (!child->isElementNode())
+            continue;
+        Element* e = static_cast<Element*>(child);
+        return QWebElement(e);
+    }
+    return QWebElement();
+}
+
+/*!
+    Returns the last child element of this element.
+
+    \sa firstChild() previousSibling() nextSibling()
+*/
+QWebElement QWebElement::lastChild() const
+{
+    if (!m_element)
+        return QWebElement();
+    for (Node* child = m_element->lastChild(); child; child = child->previousSibling()) {
+        if (!child->isElementNode())
+            continue;
+        Element* e = static_cast<Element*>(child);
+        return QWebElement(e);
+    }
+    return QWebElement();
+}
+
+/*!
+    Returns the next sibling element of this element.
+
+    \sa firstChild() previousSibling() lastChild()
+*/
+QWebElement QWebElement::nextSibling() const
+{
+    if (!m_element)
+        return QWebElement();
+    for (Node* sib = m_element->nextSibling(); sib; sib = sib->nextSibling()) {
+        if (!sib->isElementNode())
+            continue;
+        Element* e = static_cast<Element*>(sib);
+        return QWebElement(e);
+    }
+    return QWebElement();
+}
+
+/*!
+    Returns the previous sibling element of this element.
+
+    \sa firstChild() nextSibling() lastChild()
+*/
+QWebElement QWebElement::previousSibling() const
+{
+    if (!m_element)
+        return QWebElement();
+    for (Node* sib = m_element->previousSibling(); sib; sib = sib->previousSibling()) {
+        if (!sib->isElementNode())
+            continue;
+        Element* e = static_cast<Element*>(sib);
+        return QWebElement(e);
+    }
+    return QWebElement();
+}
+
+/*!
+    Returns the document this element belongs to.
+*/
+QWebElement QWebElement::document() const
+{
+    if (!m_element)
+        return QWebElement();
+    Document* document = m_element->document();
+    if (!document)
+        return QWebElement();
+    return QWebElement(document->documentElement());
+}
+
+/*!
+    Returns the web frame this elements is a part of. If the element is
+    a null element null is returned.
+*/
+QWebFrame *QWebElement::webFrame() const
+{
+    if (!m_element)
+        return 0;
+
+    Document* document = m_element->document();
+    if (!document)
+        return 0;
+
+    Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    return QWebFramePrivate::kit(frame);
+}
+
+static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValue, ScriptState*& state, ScriptController*& scriptController)
+{
+    if (!element)
+        return false;
+
+    Document* document = element->document();
+    if (!document)
+        return false;
+
+    Frame* frame = document->frame();
+    if (!frame)
+        return false;
+
+    scriptController = frame->script();
+    if (!scriptController)
+        return false;
+
+    state = scriptController->globalObject()->globalExec();
+    if (!state)
+        return false;
+
+    thisValue = toJS(state, element);
+    if (!thisValue)
+        return false;
+
+    return true;
+}
+
+
+static bool setupScriptObject(WebCore::Element* element, ScriptObject& object, ScriptState*& state, ScriptController*& scriptController)
+{
+    if (!element)
+        return false;
+
+    Document* document = element->document();
+    if (!document)
+        return false;
+
+    Frame* frame = document->frame();
+    if (!frame)
+        return false;
+
+    scriptController = frame->script();
+
+    state = scriptController->globalObject()->globalExec();
+
+    JSC::JSValue thisValue = toJS(state, element);
+    if (!thisValue)
+        return false;
+
+    JSC::JSObject* thisObject = thisValue.toObject(state);
+    if (!thisObject)
+        return false;
+
+    object = ScriptObject(thisObject);
+    return true;
+}
+
+/*!
+    Executes the \a scriptSource with this element as the `this' object.
+
+    \sa callFunction()
+*/
+QVariant QWebElement::evaluateScript(const QString& scriptSource)
+{
+    if (scriptSource.isEmpty())
+        return QVariant();
+
+    ScriptState* state = 0;
+    JSC::JSValue thisValue;
+    ScriptController* scriptController = 0;
+
+    if (!setupScriptContext(m_element, thisValue, state, scriptController))
+        return QVariant();
+
+    JSC::ScopeChain& scopeChain = state->dynamicGlobalObject()->globalScopeChain();
+    JSC::UString script((const ushort*)scriptSource.data(), scriptSource.length());
+    JSC::Completion completion = JSC::evaluate(state, scopeChain, JSC::makeSource(script), thisValue);
+    if ((completion.complType() != JSC::ReturnValue) && (completion.complType() != JSC::Normal))
+        return QVariant();
+
+    JSC::JSValue result = completion.value();
+    if (!result)
+        return QVariant();
+
+    int distance = 0;
+    return JSC::Bindings::convertValueToQVariant(state, result, QMetaType::Void, &distance);
+}
+
+/*!
+    Calls the function with the given \a name and \a arguments.
+
+    The underlying DOM element that QWebElement wraps may have dedicated functions depending
+    on its type. For example a form element can have the "submit" function, that would submit
+    the form to the destination specified in the HTML.
+
+    \sa functions()
+*/
+QVariant QWebElement::callFunction(const QString &name, const QVariantList &arguments)
+{
+    ScriptState* state = 0;
+    ScriptObject thisObject;
+    ScriptController* scriptController = 0;
+
+    if (!setupScriptObject(m_element, thisObject, state, scriptController))
+        return QVariant();
+
+    ScriptFunctionCall functionCall(state, thisObject, name);
+
+    for (QVariantList::ConstIterator it = arguments.constBegin(), end = arguments.constEnd();
+         it != end; ++it)
+        functionCall.appendArgument(JSC::Bindings::convertQVariantToValue(state, scriptController->bindingRootObject(), *it));
+
+    bool hadException = false;
+    ScriptValue result = functionCall.call(hadException);
+    if (hadException)
+        return QVariant();
+
+    int distance = 0;
+    return JSC::Bindings::convertValueToQVariant(state, result.jsValue(), QMetaType::Void, &distance);
+}
+
+/*!
+    Returns a list of function names this element supports.
+
+    The function names returned are the same functions that are callable from the DOM
+    element's JavaScript binding.
+
+    \sa callFunction()
+*/
+QStringList QWebElement::functions() const
+{
+    ScriptState* state = 0;
+    ScriptObject thisObject;
+    ScriptController* scriptController = 0;
+
+    if (!setupScriptObject(m_element, thisObject, state, scriptController))
+        return QStringList();
+
+    JSC::JSObject* object = thisObject.jsObject();
+    if (!object)
+        return QStringList();
+
+    QStringList names;
+
+    // Enumerate the contents of the object
+    JSC::PropertyNameArray properties(state);
+    object->getPropertyNames(state, properties);
+    for (JSC::PropertyNameArray::const_iterator it = properties.begin();
+         it != properties.end(); ++it) {
+
+        JSC::JSValue property = object->get(state, *it);
+        if (!property)
+            continue;
+
+        JSC::JSObject* function = property.toObject(state);
+        if (!function)
+            continue;
+
+        JSC::CallData callData;
+        JSC::CallType callType = function->getCallData(callData);
+        if (callType == JSC::CallTypeNone)
+            continue;
+
+        JSC::UString ustring = (*it).ustring();
+        names << QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
+    }
+
+    if (state->hadException())
+        state->clearException();
+
+    return names;
+}
+
+/*!
+    Returns the value of the element's \a name property.
+
+    If no such property exists, the returned variant is invalid.
+
+    The return property has the same value as the corresponding property
+    in the element's JavaScript binding with the same name.
+
+    Information about all available properties is provided through scriptProperties().
+
+    \sa setScriptableProperty(), scriptableProperties()
+*/
+QVariant QWebElement::scriptableProperty(const QString &name) const
+{
+    ScriptState* state = 0;
+    ScriptObject thisObject;
+    ScriptController *scriptController = 0;
+
+    if (!setupScriptObject(m_element, thisObject, state, scriptController))
+        return QVariant();
+
+    String wcName(name);
+    JSC::JSValue property = thisObject.jsObject()->get(state, JSC::Identifier(state, wcName));
+
+    // ###
+    if (state->hadException())
+        state->clearException();
+
+    int distance = 0;
+    return JSC::Bindings::convertValueToQVariant(state, property, QMetaType::Void, &distance);
+}
+
+/*!
+    Sets the value of the element's \a name property to \a value.
+
+    Information about all available properties is provided through scriptProperties().
+
+    Setting the property will affect the corresponding property
+    in the element's JavaScript binding with the same name.
+
+    \sa scriptableProperty(), scriptableProperties()
+*/
+void QWebElement::setScriptableProperty(const QString &name, const QVariant &value)
+{
+    ScriptState* state = 0;
+    ScriptObject thisObject;
+    ScriptController* scriptController = 0;
+
+    if (!setupScriptObject(m_element, thisObject, state, scriptController))
+        return;
+
+    JSC::JSValue jsValue = JSC::Bindings::convertQVariantToValue(state, scriptController->bindingRootObject(), value);
+    if (!jsValue)
+        return;
+
+    String wcName(name);
+    JSC::PutPropertySlot slot;
+    thisObject.jsObject()->put(state, JSC::Identifier(state, wcName), jsValue, slot);
+    if (state->hadException())
+        state->clearException();
+}
+
+/*!
+    Returns a list of property names this element supports.
+
+    The function names returned are the same properties that are accessible from the DOM
+    element's JavaScript binding.
+
+    \sa setScriptableProperty(), scriptableProperty()
+*/
+QStringList QWebElement::scriptableProperties() const
+{
+    if (!m_element)
+        return QStringList();
+
+    Document* document = m_element->document();
+    if (!document)
+        return QStringList();
+
+    Frame* frame = document->frame();
+    if (!frame)
+        return QStringList();
+
+    ScriptController* script = frame->script();
+    JSC::ExecState* exec = script->globalObject()->globalExec();
+
+    JSC::JSValue thisValue = toJS(exec, m_element);
+    if (!thisValue)
+        return QStringList();
+
+    JSC::JSObject* object = thisValue.toObject(exec);
+    if (!object)
+        return QStringList();
+
+    QStringList names;
+
+    // Enumerate the contents of the object
+    JSC::PropertyNameArray properties(exec);
+    object->getPropertyNames(exec, properties);
+    for (JSC::PropertyNameArray::const_iterator it = properties.begin();
+         it != properties.end(); ++it) {
+
+        JSC::JSValue property = object->get(exec, *it);
+        if (!property)
+            continue;
+
+        JSC::JSObject* function = property.toObject(exec);
+        if (!function)
+            continue;
+
+        JSC::CallData callData;
+        JSC::CallType callType = function->getCallData(callData);
+        if (callType != JSC::CallTypeNone)
+            continue;
+
+        JSC::UString ustring = (*it).ustring();
+        names << QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
+    }
+
+    if (exec->hadException())
+        exec->clearException();
+
+    return names;
+}
+
+/*!
+    \enum QWebElement::ResolveRule
+    \since 4.6
+
+    This enum describes how QWebElement's styleProperty resolves the given
+    property name.
+
+    \value IgnoreCascadingStyles Return the property value as it is defined
+    in the element, without respecting style inheritance and other CSS rules.
+    \value RespectCascadingStyles The property's value is determined using
+    the inheritance and importance rules defined in the document's stylesheet.
+*/
+
+/*!
+    \enum QWebElement::StylePriority
+    \since 4.6
+
+    This enum describes the priority newly set CSS properties should have when
+    set using QWebElement::setStyleProperty().
+
+    \value NormalStylePriority Define the property without important
+    priority even if "!important" is explicitly set in \a value.
+    \value DeclaredStylePriority Define the property respecting the
+    priority specified in \a value.
+    \value ImportantStylePriority Define the property to have
+    an important priority, this is equal to appending "!important" to the value.
+*/
+
+/*!
+    Returns the value of the style named \a name or an empty string if such one
+    does not exist.
+
+    If \a rule is IgnoreCascadingStyles, the value defined inside the element
+    (inline in CSS terminology) is returned.
+
+    if \a rule is RespectCascadingStyles, the actual style applied to the
+    element is returned.
+
+    In CSS, the cascading part has to do with which CSS rule has priority and
+    is thus applied. Generally speaking, the last defined rule has priority,
+    thus an inline style rule has priority over an embedded block style rule,
+    which in return has priority over an external style rule.
+
+    If the !important declaration is set on one of those, the declaration gets
+    highest priority, unless other declarations also use the !important
+    declaration, in which the last !important declaration takes predecence.
+*/
+QString QWebElement::styleProperty(const QString &name, ResolveRule rule) const
+{
+    if (!m_element || !m_element->isStyledElement())
+        return QString();
+
+    int propID = cssPropertyID(name);
+
+    if (!propID)
+        return QString();
+
+    CSSStyleDeclaration* style = static_cast<StyledElement*>(m_element)->style();
+
+    if (rule == IgnoreCascadingStyles)
+        return style->getPropertyValue(propID);
+
+    if (rule == RespectCascadingStyles) {
+        if (style->getPropertyPriority(propID))
+            return style->getPropertyValue(propID);
+
+        // We are going to resolve the style property by walking through the
+        // list of non-inline matched CSS rules for the element, looking for
+        // the highest priority definition.
+
+        // Get an array of matched CSS rules for the given element sorted
+        // by importance and inheritance order. This include external CSS
+        // declarations, as well as embedded and inline style declarations.
+
+        DOMWindow* domWindow = m_element->document()->frame()->domWindow();
+        if (RefPtr<CSSRuleList> rules = domWindow->getMatchedCSSRules(m_element, "")) {
+            for (int i = rules->length(); i > 0; --i) {
+                CSSStyleRule* rule = static_cast<CSSStyleRule*>(rules->item(i - 1));
+
+                if (rule->style()->getPropertyPriority(propID))
+                    return rule->style()->getPropertyValue(propID);
+
+                if (style->getPropertyValue(propID).isEmpty())
+                    style = rule->style();
+            }
+        }
+
+        return style->getPropertyValue(propID);
+    }
+
+    return QString();
+}
+
+/*!
+    Sets the value of the style named \a name to \a value.
+
+    Setting a value, doesn't necessarily mean that it will become the applied
+    value, due to the fact that the style property's value might have been set
+    earlier with priority in external or embedded style declarations.
+
+    In order to ensure that the value will be applied, ImportantStylePriority
+    should be used as \a priority.
+
+    Following the CSS syntax for property values, this is equal to appending
+    "!important" to the value.
+
+    This syntax is supported when using DeclaredStylePriority as \a priority.
+
+    Using NormalStylePriority as \a priority, the property will have normal
+    priority, and any "!important" declaration will be ignored. On the other
+    hand, using ImportantStylePriority sets the important priority even when
+    not explicit passed in \a value.
+    By using DeclaredStylePriority as \a priority the property will respect the
+    priority specified in \a value.
+*/
+void QWebElement::setStyleProperty(const QString &name, const QString &value, StylePriority priority)
+{
+    if (!m_element || !m_element->isStyledElement())
+        return;
+
+    int propID = cssPropertyID(name);
+    CSSStyleDeclaration* style = static_cast<StyledElement*>(m_element)->style();
+    if (!propID || !style)
+        return;
+
+    ExceptionCode exception = 0;
+
+    const QRegExp hasImportantTest(QLatin1String("!\\s*important"));
+    int index = value.indexOf(hasImportantTest);
+
+    QString newValue = (index != -1) ? value.left(index - 1) : value;
+
+    switch (priority) {
+    case NormalStylePriority:
+        style->setProperty(name, newValue, "", exception);
+        break;
+    case DeclaredStylePriority:
+        style->setProperty(name, newValue, (index != -1) ? "important" : "", exception);
+        break;
+    case ImportantStylePriority:
+        style->setProperty(name, newValue, "important", exception);
+        break;
+    default:
+        break;
+    }
+}
+
+/*!
+    Returns the computed value for style named \a name or an empty string if the style has no such name.
+*/
+QString QWebElement::computedStyleProperty(const QString &name) const
+{
+    if (!m_element || !m_element->isStyledElement())
+        return QString();
+
+    int propID = cssPropertyID(name);
+
+    RefPtr<CSSComputedStyleDeclaration> style = computedStyle(m_element);
+    if (!propID || !style)
+        return QString();
+
+    return style->getPropertyValue(propID);
+}
+
+/*!
+    Returns the list of classes of this element.
+*/
+QStringList QWebElement::classes() const
+{
+    if (!hasAttribute("class"))
+        return QStringList();
+
+    QStringList classes =  attribute("class").simplified().split(' ', QString::SkipEmptyParts);
+#if QT_VERSION >= 0x040500
+    classes.removeDuplicates();
+#else
+    int n = classes.size();
+    int j = 0;
+    QSet<QString> seen;
+    seen.reserve(n);
+    for (int i = 0; i < n; ++i) {
+        const QString& s = classes.at(i);
+        if (seen.contains(s))
+            continue;
+        seen.insert(s);
+        if (j != i)
+            classes[j] = s;
+        ++j;
+    }
+    if (n != j)
+        classes.erase(classes.begin() + j, classes.end());
+#endif
+    return classes;
+}
+
+/*!
+    Returns true if this element has a class called \a name; otherwise returns false.
+*/
+bool QWebElement::hasClass(const QString &name) const
+{
+    QStringList list = classes();
+    return list.contains(name);
+}
+
+/*!
+    Adds the specified class \a name to the element.
+*/
+void QWebElement::addClass(const QString &name)
+{
+    QStringList list = classes();
+    if (!list.contains(name)) {
+        list.append(name);
+        QString value = list.join(" ");
+        setAttribute("class", value);
+    }
+}
+
+/*!
+    Removes the specified class \a name from the element.
+*/
+void QWebElement::removeClass(const QString &name)
+{
+    QStringList list = classes();
+    if (list.contains(name)) {
+        list.removeAll(name);
+        QString value = list.join(" ");
+        setAttribute("class", value);
+    }
+}
+
+/*!
+    Adds the specified class \a name if it is not present,
+    removes it if it is already present.
+*/
+void QWebElement::toggleClass(const QString &name)
+{
+    QStringList list = classes();
+    if (list.contains(name))
+        list.removeAll(name);
+    else
+        list.append(name);
+
+    QString value = list.join(" ");
+    setAttribute("class", value);
+}
+
+/*!
+    Appends \a element as the element's last child.
+
+    If \a element is the child of another element, it is re-parented
+    to this element. If \a element is a child of this element, then
+    its position in the list of children is changed.
+
+    Calling this function on a null element does nothing.
+
+    \sa prependInside(), prependOutside(), appendOutside()
+*/
+void QWebElement::appendInside(const QWebElement &element)
+{
+    if (!m_element || element.isNull())
+        return;
+
+    ExceptionCode exception = 0;
+    m_element->appendChild(element.m_element, exception);
+}
+
+/*!
+    Appends the result of parsing \a markup as the element's last child.
+
+    Calling this function on a null element does nothing.
+
+    \sa prependInside(), prependOutside(), appendOutside()
+*/
+void QWebElement::appendInside(const QString &markup)
+{
+    if (!m_element)
+        return;
+
+    if (!m_element->isHTMLElement())
+        return;
+
+    HTMLElement* htmlElement = static_cast<HTMLElement*>(m_element);
+    RefPtr<DocumentFragment> fragment = htmlElement->createContextualFragment(markup);
+
+    ExceptionCode exception = 0;
+    m_element->appendChild(fragment, exception);
+}
+
+/*!
+    Prepends \a element as the element's first child.
+
+    If \a element is the child of another element, it is re-parented
+    to this element. If \a element is a child of this element, then
+    its position in the list of children is changed.
+
+    Calling this function on a null element does nothing.
+
+    \sa appendInside(), prependOutside(), appendOutside()
+*/
+void QWebElement::prependInside(const QWebElement &element)
+{
+    if (!m_element || element.isNull())
+        return;
+
+    ExceptionCode exception = 0;
+
+    if (m_element->hasChildNodes())
+        m_element->insertBefore(element.m_element, m_element->firstChild(), exception);
+    else
+        m_element->appendChild(element.m_element, exception);
+}
+
+/*!
+    Prepends the result of parsing \a markup as the element's first child.
+
+    Calling this function on a null element does nothing.
+
+    \sa appendInside(), prependOutside(), appendOutside()
+*/
+void QWebElement::prependInside(const QString &markup)
+{
+    if (!m_element)
+        return;
+
+    if (!m_element->isHTMLElement())
+        return;
+
+    HTMLElement* htmlElement = static_cast<HTMLElement*>(m_element);
+    RefPtr<DocumentFragment> fragment = htmlElement->createContextualFragment(markup);
+
+    ExceptionCode exception = 0;
+
+    if (m_element->hasChildNodes())
+        m_element->insertBefore(fragment, m_element->firstChild(), exception);
+    else
+        m_element->appendChild(fragment, exception);
+}
+
+
+/*!
+    Inserts \a element before this element.
+
+    If \a element is the child of another element, it is re-parented
+    to the parent of this element.
+
+    Calling this function on a null element does nothing.
+
+    \sa appendInside(), prependInside(), appendOutside()
+*/
+void QWebElement::prependOutside(const QWebElement &element)
+{
+    if (!m_element || element.isNull())
+        return;
+
+    if (!m_element->parent())
+        return;
+
+    ExceptionCode exception = 0;
+    m_element->parent()->insertBefore(element.m_element, m_element, exception);
+}
+
+/*!
+    Inserts the result of parsing \a markup before this element.
+
+    Calling this function on a null element does nothing.
+
+    \sa appendInside(), prependInside(), appendOutside()
+*/
+void QWebElement::prependOutside(const QString &markup)
+{
+    if (!m_element)
+        return;
+
+    if (!m_element->parent())
+        return;
+
+    if (!m_element->isHTMLElement())
+        return;
+
+    HTMLElement* htmlElement = static_cast<HTMLElement*>(m_element);
+    RefPtr<DocumentFragment> fragment = htmlElement->createContextualFragment(markup);
+
+    ExceptionCode exception = 0;
+    m_element->parent()->insertBefore(fragment, m_element, exception);
+}
+
+/*!
+    Inserts \a element after this element.
+
+    If \a element is the child of another element, it is re-parented
+    to the parent of this element.
+
+    Calling this function on a null element does nothing.
+
+    \sa appendInside(), prependInside(), prependOutside()
+*/
+void QWebElement::appendOutside(const QWebElement &element)
+{
+    if (!m_element || element.isNull())
+        return;
+
+    if (!m_element->parent())
+        return;
+
+    ExceptionCode exception = 0;
+    if (!m_element->nextSibling())
+        m_element->parent()->appendChild(element.m_element, exception);
+    else
+        m_element->parent()->insertBefore(element.m_element, m_element->nextSibling(), exception);
+}
+
+/*!
+    Inserts the result of parsing \a markup after this element.
+
+    Calling this function on a null element does nothing.
+
+    \sa appendInside(), prependInside(), prependOutside()
+*/
+void QWebElement::appendOutside(const QString &markup)
+{
+    if (!m_element)
+        return;
+
+    if (!m_element->parent())
+        return;
+
+    if (!m_element->isHTMLElement())
+        return;
+
+    HTMLElement* htmlElement = static_cast<HTMLElement*>(m_element);
+    RefPtr<DocumentFragment> fragment = htmlElement->createContextualFragment(markup);
+
+    ExceptionCode exception = 0;
+    if (!m_element->nextSibling())
+        m_element->parent()->appendChild(fragment, exception);
+    else
+        m_element->parent()->insertBefore(fragment, m_element->nextSibling(), exception);
+}
+
+/*!
+    Returns a clone of this element.
+
+    The clone may be inserted at any point in the document.
+
+    \sa appendInside(), prependInside(), prependOutside(), appendOutside()
+*/
+QWebElement QWebElement::clone() const
+{
+    if (!m_element)
+        return QWebElement();
+
+    return QWebElement(m_element->cloneElementWithChildren().get());
+}
+
+/*!
+    Removes this element from the document and returns a reference
+    to this.
+
+    The element is still valid after removal, and can be inserted into
+    other parts of the document.
+
+    \sa removeChildren(), removeFromDocument()
+*/
+QWebElement &QWebElement::takeFromDocument()
+{
+    if (!m_element)
+        return *this;
+
+    ExceptionCode exception = 0;
+    m_element->remove(exception);
+
+    return *this;
+}
+
+/*!
+    Removes this element from the document and makes this
+    a null element.
+
+    \sa removeChildren(), takeFromDocument()
+*/
+void QWebElement::removeFromDocument()
+{
+    if (!m_element)
+        return;
+
+    ExceptionCode exception = 0;
+    m_element->remove(exception);
+    m_element->deref();
+    m_element = 0;
+}
+
+/*!
+    Removes all children from this element.
+
+    \sa removeFromDocument(), takeFromDocument()
+*/
+void QWebElement::removeChildren()
+{
+    if (!m_element)
+        return;
+
+    m_element->removeAllChildren();
+}
+
+static RefPtr<Node> findInsertionPoint(PassRefPtr<Node> root)
+{
+    RefPtr<Node> node = root;
+
+    // Go as far down the tree as possible.
+    while (node->hasChildNodes() && node->firstChild()->isElementNode())
+        node = node->firstChild();
+
+    // TODO: Implement SVG support
+    if (node->isHTMLElement()) {
+        HTMLElement* element = static_cast<HTMLElement*>(node.get());
+
+        // The insert point could be a non-enclosable tag and it can thus
+        // never have children, so go one up. Get the parent element, and not
+        // note as a root note will always exist.
+        if (element->endTagRequirement() == TagStatusForbidden)
+            node = node->parentElement();
+    }
+
+    return node;
+}
+
+/*!
+    Enclose the contents of this element in \a element as the child
+    of the deepest descendant element within the structure of the
+    first element provided.
+
+    \sa encloseWith()
+*/
+void QWebElement::encloseContentsWith(const QWebElement &element)
+{
+    if (!m_element || element.isNull())
+        return;
+
+    RefPtr<Node> insertionPoint = findInsertionPoint(element.m_element);
+
+    if (!insertionPoint)
+        return;
+
+    ExceptionCode exception = 0;
+
+    // reparent children
+    for (RefPtr<Node> child = m_element->firstChild(); child;) {
+        RefPtr<Node> next = child->nextSibling();
+        insertionPoint->appendChild(child, exception);
+        child = next;
+    }
+
+    if (m_element->hasChildNodes())
+        m_element->insertBefore(element.m_element, m_element->firstChild(), exception);
+    else
+        m_element->appendChild(element.m_element, exception);
+}
+
+/*!
+    Enclose the contents of this element in the result of parsing
+    \a markup as the child of the deepest descendant element within
+    the structure of the first element provided.
+
+    \sa encloseWith()
+*/
+void QWebElement::encloseContentsWith(const QString &markup)
+{
+    if (!m_element)
+        return;
+
+    if (!m_element->parent())
+        return;
+
+    if (!m_element->isHTMLElement())
+        return;
+
+    HTMLElement* htmlElement = static_cast<HTMLElement*>(m_element);
+    RefPtr<DocumentFragment> fragment = htmlElement->createContextualFragment(markup);
+
+    if (!fragment || !fragment->firstChild())
+        return;
+
+    RefPtr<Node> insertionPoint = findInsertionPoint(fragment->firstChild());
+
+    if (!insertionPoint)
+        return;
+
+    ExceptionCode exception = 0;
+
+    // reparent children
+    for (RefPtr<Node> child = m_element->firstChild(); child;) {
+        RefPtr<Node> next = child->nextSibling();
+        insertionPoint->appendChild(child, exception);
+        child = next;
+    }
+
+    if (m_element->hasChildNodes())
+        m_element->insertBefore(fragment, m_element->firstChild(), exception);
+    else
+        m_element->appendChild(fragment, exception);
+}
+
+/*!
+    Enclose this element in \a element as the child of the deepest
+    descendant element within the structure of the first element
+    provided.
+
+    \sa replace()
+*/
+void QWebElement::encloseWith(const QWebElement &element)
+{
+    if (!m_element || element.isNull())
+        return;
+
+    RefPtr<Node> insertionPoint = findInsertionPoint(element.m_element);
+
+    if (!insertionPoint)
+        return;
+
+    // Keep reference to these two nodes before pulling out this element and
+    // wrapping it in the fragment. The reason for doing it in this order is
+    // that once the fragment has been added to the document it is empty, so
+    // we no longer have access to the nodes it contained.
+    Node* parentNode = m_element->parent();
+    Node* siblingNode = m_element->nextSibling();
+
+    ExceptionCode exception = 0;
+    insertionPoint->appendChild(m_element, exception);
+
+    if (!siblingNode)
+        parentNode->appendChild(element.m_element, exception);
+    else
+        parentNode->insertBefore(element.m_element, siblingNode, exception);
+}
+
+/*!
+    Enclose this element in the result of parsing \a markup,
+    as the last child.
+
+    \sa replace()
+*/
+void QWebElement::encloseWith(const QString &markup)
+{
+    if (!m_element)
+        return;
+
+    if (!m_element->parent())
+        return;
+
+    if (!m_element->isHTMLElement())
+        return;
+
+    HTMLElement* htmlElement = static_cast<HTMLElement*>(m_element);
+    RefPtr<DocumentFragment> fragment = htmlElement->createContextualFragment(markup);
+
+    if (!fragment || !fragment->firstChild())
+        return;
+
+    RefPtr<Node> insertionPoint = findInsertionPoint(fragment->firstChild());
+
+    if (!insertionPoint)
+        return;
+
+    // Keep reference to these two nodes before pulling out this element and
+    // wrapping it in the fragment. The reason for doing it in this order is
+    // that once the fragment has been added to the document it is empty, so
+    // we no longer have access to the nodes it contained.
+    Node* parentNode = m_element->parent();
+    Node* siblingNode = m_element->nextSibling();
+
+    ExceptionCode exception = 0;
+    insertionPoint->appendChild(m_element, exception);
+
+    if (!siblingNode)
+        parentNode->appendChild(fragment, exception);
+    else
+        parentNode->insertBefore(fragment, siblingNode, exception);
+}
+
+/*!
+    Replaces this element with \a element.
+
+    It is not possible to replace the <html>, <head>, or <body>
+    elements using this method.
+
+    \sa encloseWith()
+*/
+void QWebElement::replace(const QWebElement &element)
+{
+    if (!m_element || element.isNull())
+        return;
+
+    appendOutside(element);
+    takeFromDocument();
+}
+
+/*!
+    Replaces this element with the result of parsing \a markup.
+
+    It is not possible to replace the <html>, <head>, or <body>
+    elements using this method.
+
+    \sa encloseWith()
+*/
+void QWebElement::replace(const QString &markup)
+{
+    if (!m_element)
+        return;
+
+    appendOutside(markup);
+    takeFromDocument();
+}
+
+/*!
+    \fn inline bool QWebElement::operator==(const QWebElement& o) const;
+
+    Returns true if this element points to the same underlying DOM object than \a o; otherwise returns false.
+*/
+
+/*!
+    \fn inline bool QWebElement::operator!=(const QWebElement& o) const;
+
+    Returns true if this element points to a different underlying DOM object than \a o; otherwise returns false.
+*/
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
new file mode 100644
index 0000000000..7e56d0ff05
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
@@ -0,0 +1,153 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QWEBELEMENT_H
+#define QWEBELEMENT_H
+
+#include <QString>
+#include <QRect>
+#include <QVariant>
+#include <QExplicitlySharedDataPointer>
+
+#include "qwebkitglobal.h"
+namespace WebCore {
+    class Element;
+    class Node;
+}
+
+class QWebFrame;
+class QWebElementPrivate;
+
+class QWEBKIT_EXPORT QWebElement
+{
+public:
+    QWebElement();
+    QWebElement(const QWebElement &);
+    QWebElement &operator=(const QWebElement &);
+    ~QWebElement();
+
+    bool operator==(const QWebElement& o) const;
+    bool operator!=(const QWebElement& o) const;
+
+    bool isNull() const;
+
+    QList<QWebElement> findAll(const QString &selectorQuery) const;
+    QWebElement findFirst(const QString &selectorQuery) const;
+
+    void setPlainText(const QString &text);
+    QString toPlainText() const;
+
+    void setOuterXml(const QString &markup);
+    QString toOuterXml() const;
+
+    void setInnerXml(const QString &markup);
+    QString toInnerXml() const;
+
+    void setAttribute(const QString &name, const QString &value);
+    void setAttributeNS(const QString &namespaceUri, const QString &name, const QString &value);
+    QString attribute(const QString &name, const QString &defaultValue = QString()) const;
+    QString attributeNS(const QString &namespaceUri, const QString &name, const QString &defaultValue = QString()) const;
+    bool hasAttribute(const QString &name) const;
+    bool hasAttributeNS(const QString &namespaceUri, const QString &name) const;
+    void removeAttribute(const QString &name);
+    void removeAttributeNS(const QString &namespaceUri, const QString &name);
+    bool hasAttributes() const;
+
+    QStringList classes() const;
+    bool hasClass(const QString &name) const;
+    void addClass(const QString &name);
+    void removeClass(const QString &name);
+    void toggleClass(const QString &name);
+
+    QRect geometry() const;
+
+    QString tagName() const;
+    QString prefix() const;
+    QString localName() const;
+    QString namespaceUri() const;
+
+    QWebElement parent() const;
+    QWebElement firstChild() const;
+    QWebElement lastChild() const;
+    QWebElement nextSibling() const;
+    QWebElement previousSibling() const;
+    QWebElement document() const;
+    QWebFrame *webFrame() const;
+
+    // TODO: Add QList<QWebElement> overloads
+    // docs need example snippet
+    void appendInside(const QString &markup);
+    void appendInside(const QWebElement &element);
+
+    // docs need example snippet
+    void prependInside(const QString &markup);
+    void prependInside(const QWebElement &element);
+
+    // docs need example snippet
+    void appendOutside(const QString &markup);
+    void appendOutside(const QWebElement &element);
+
+    // docs need example snippet
+    void prependOutside(const QString &markup);
+    void prependOutside(const QWebElement &element);
+
+    // docs need example snippet
+    void encloseContentsWith(const QWebElement &element);
+    void encloseContentsWith(const QString &markup);
+    void encloseWith(const QString &markup);
+    void encloseWith(const QWebElement &element);
+
+    void replace(const QString &markup);
+    void replace(const QWebElement &element);
+
+    QWebElement clone() const;
+    QWebElement &takeFromDocument();
+    void removeFromDocument();
+    void removeChildren();
+
+    QVariant evaluateScript(const QString& scriptSource);
+
+    QVariant callFunction(const QString &functionName, const QVariantList &arguments = QVariantList());
+    QStringList functions() const;
+
+    QVariant scriptableProperty(const QString &name) const;
+    void setScriptableProperty(const QString &name, const QVariant &value);
+    QStringList scriptableProperties() const;
+
+    enum ResolveRule { IgnoreCascadingStyles, RespectCascadingStyles };
+    QString styleProperty(const QString &name, ResolveRule = IgnoreCascadingStyles) const;
+
+    enum StylePriority { NormalStylePriority, DeclaredStylePriority, ImportantStylePriority };
+    void setStyleProperty(const QString &name, const QString &value, StylePriority = DeclaredStylePriority);
+
+    QString computedStyleProperty(const QString &name) const;
+
+private:
+    explicit QWebElement(WebCore::Element *domElement);
+    explicit QWebElement(WebCore::Node *node);
+
+    friend class QWebFrame;
+    friend class QWebHitTestResult;
+    friend class QWebHitTestResultPrivate;
+
+    QWebElementPrivate *d;
+    WebCore::Element *m_element;
+};
+
+#endif // QWEBELEMENT_H
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index e565476418..db4bfecdc2 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -25,6 +25,7 @@
 #include "qwebframe_p.h"
 #include "qwebsecurityorigin.h"
 #include "qwebsecurityorigin_p.h"
+#include "qwebelement.h"
 
 #include "DocumentLoader.h"
 #include "FocusController.h"
@@ -44,6 +45,7 @@
 #include "SubstituteData.h"
 
 #include "markup.h"
+#include "htmlediting.h"
 #include "RenderTreeAsText.h"
 #include "Element.h"
 #include "Document.h"
@@ -95,6 +97,7 @@ QT_END_NAMESPACE
 
 void QWEBKIT_EXPORT qt_drt_setJavaScriptProfilingEnabled(QWebFrame* qframe, bool enabled)
 {
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     Frame* frame = QWebFramePrivate::core(qframe);
     InspectorController* controller = frame->page()->inspectorController();
     if (!controller)
@@ -103,6 +106,64 @@ void QWEBKIT_EXPORT qt_drt_setJavaScriptProfilingEnabled(QWebFrame* qframe, bool
         controller->enableProfiler();
     else
         controller->disableProfiler();
+#endif
+}
+
+// Pause a given CSS animation or transition on the target node at a specific time.
+// If the animation or transition is already paused, it will update its pause time.
+// This method is only intended to be used for testing the CSS animation and transition system.
+bool QWEBKIT_EXPORT qt_drt_pauseAnimation(QWebFrame *qframe, const QString &animationName, double time, const QString &elementId)
+{
+    Frame* frame = QWebFramePrivate::core(qframe);
+    if (!frame)
+        return false;
+
+    AnimationController* controller = frame->animation();
+    if (!controller)
+        return false;
+
+    Document* doc = frame->document();
+    Q_ASSERT(doc);
+
+    Node* coreNode = doc->getElementById(elementId);
+    if (!coreNode || !coreNode->renderer())
+        return false;
+
+    return controller->pauseAnimationAtTime(coreNode->renderer(), animationName, time);
+}
+
+bool QWEBKIT_EXPORT qt_drt_pauseTransitionOfProperty(QWebFrame *qframe, const QString &propertyName, double time, const QString &elementId)
+{
+    Frame* frame = QWebFramePrivate::core(qframe);
+    if (!frame)
+        return false;
+
+    AnimationController* controller = frame->animation();
+    if (!controller)
+        return false;
+
+    Document* doc = frame->document();
+    Q_ASSERT(doc);
+
+    Node* coreNode = doc->getElementById(elementId);
+    if (!coreNode || !coreNode->renderer())
+        return false;
+
+    return controller->pauseTransitionAtTime(coreNode->renderer(), propertyName, time);
+}
+
+// Returns the total number of currently running animations (includes both CSS transitions and CSS animations).
+int QWEBKIT_EXPORT qt_drt_numberOfActiveAnimations(QWebFrame *qframe)
+{
+    Frame* frame = QWebFramePrivate::core(qframe);
+    if (!frame)
+        return false;
+
+    AnimationController* controller = frame->animation();
+    if (!controller)
+        return false;
+
+    return controller->numberOfActiveAnimations();
 }
 
 void QWebFramePrivate::init(QWebFrame *qframe, WebCore::Page *webcorePage, QWebFrameData *frameData)
@@ -144,6 +205,37 @@ WebCore::Scrollbar* QWebFramePrivate::verticalScrollBar() const
     return frame->view()->verticalScrollbar();
 }
 
+void QWebFramePrivate::renderPrivate(QPainter *painter, const QRegion &clip, bool contents)
+{
+    if (!frame->view() || !frame->contentRenderer())
+        return;
+
+    QVector<QRect> vector = clip.rects();
+    if (vector.isEmpty())
+        return;
+
+    WebCore::FrameView* view = frame->view();
+    view->layoutIfNeededRecursive();
+
+    GraphicsContext context(painter);
+
+    if (!contents)
+        view->paint(&context, vector.first());
+    else
+        view->paintContents(&context, vector.first());
+
+    for (int i = 1; i < vector.size(); ++i) {
+        const QRect& clipRect = vector.at(i);
+        painter->save();
+        painter->setClipRect(clipRect, Qt::IntersectClip);
+        if (!contents)
+            view->paint(&context, clipRect);
+        else
+            view->paintContents(&context, clipRect);
+        painter->restore();
+    }
+}
+
 /*!
     \class QWebFrame
     \since 4.4
@@ -192,7 +284,7 @@ QWebFrame::QWebFrame(QWebPage *parent, QWebFrameData *frameData)
 
     if (!frameData->url.isEmpty()) {
         WebCore::ResourceRequest request(frameData->url, frameData->referrer);
-        d->frame->loader()->load(request, frameData->name);
+        d->frame->loader()->load(request, frameData->name, false);
     }
 }
 
@@ -260,15 +352,15 @@ void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object
 
     JSC::ExecState* exec = window->globalExec();
 
-    JSC::JSObject*runtimeObject =
-        JSC::Bindings::Instance::createRuntimeObject(exec, JSC::Bindings::QtInstance::getQtInstance(object, root, ownership));
+    JSC::JSObject* runtimeObject =
+            JSC::Bindings::QtInstance::getQtInstance(object, root, ownership)->createRuntimeObject(exec);
 
     JSC::PutPropertySlot slot;
     window->put(exec, JSC::Identifier(exec, (const UChar *) name.constData(), name.length()), runtimeObject, slot);
 }
 
 /*!
-    Returns the frame's content as HTML, enclosed in HTML and BODY tags.
+    Returns the frame's content, converted to HTML.
 
     \sa setHtml(), toPlainText()
 */
@@ -280,8 +372,7 @@ QString QWebFrame::toHtml() const
 }
 
 /*!
-    Returns the content of this frame converted to plain text, completely
-    stripped of all HTML formatting.
+    Returns the content of this frame converted to plain text.
 
     \sa toHtml()
 */
@@ -468,7 +559,7 @@ void QWebFrame::load(const QWebNetworkRequest &req)
     if (!postData.isEmpty())
         request.setHTTPBody(WebCore::FormData::create(postData.constData(), postData.size()));
 
-    d->frame->loader()->load(request);
+    d->frame->loader()->load(request, false);
 
     if (d->parentFrame())
         d->page->d->insideOpenCall = false;
@@ -524,7 +615,7 @@ void QWebFrame::load(const QNetworkRequest &req,
     if (!body.isEmpty())
         request.setHTTPBody(WebCore::FormData::create(body.constData(), body.size()));
 
-    d->frame->loader()->load(request);
+    d->frame->loader()->load(request, false);
 
     if (d->parentFrame())
         d->page->d->insideOpenCall = false;
@@ -551,7 +642,7 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
     const QByteArray utf8 = html.toUtf8();
     WTF::RefPtr<WebCore::SharedBuffer> data = WebCore::SharedBuffer::create(utf8.constData(), utf8.length());
     WebCore::SubstituteData substituteData(data, WebCore::String("text/html"), WebCore::String("utf-8"), kurl);
-    d->frame->loader()->load(request, substituteData);
+    d->frame->loader()->load(request, substituteData, false);
 }
 
 /*!
@@ -574,7 +665,7 @@ void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, cons
     if (actualMimeType.isEmpty())
         actualMimeType = QLatin1String("text/html");
     WebCore::SubstituteData substituteData(buffer, WebCore::String(actualMimeType), WebCore::String(), kurl);
-    d->frame->loader()->load(request, substituteData);
+    d->frame->loader()->load(request, substituteData, false);
 }
 
 
@@ -712,6 +803,21 @@ int QWebFrame::scrollBarMinimum(Qt::Orientation orientation) const
 }
 
 /*!
+  \since 4.6
+  Returns the geometry for the scrollbar with orientation \a orientation.
+
+  If the scrollbar does not exist an empty rect is returned.
+*/
+QRect QWebFrame::scrollBarGeometry(Qt::Orientation orientation) const
+{
+    Scrollbar *sb;
+    sb = (orientation == Qt::Horizontal) ? d->horizontalScrollBar() : d->verticalScrollBar();
+    if (sb)
+        return sb->frameRect();
+    return QRect();
+}
+
+/*!
   \since 4.5
   Scrolls the frame \a dx pixels to the right and \a dy pixels downward. Both
   \a dx and \a dy may be negative.
@@ -757,25 +863,7 @@ void QWebFrame::setScrollPosition(const QPoint &pos)
 */
 void QWebFrame::render(QPainter *painter, const QRegion &clip)
 {
-    if (!d->frame->view() || !d->frame->contentRenderer())
-        return;
-
-    d->frame->view()->layoutIfNeededRecursive();
-
-    GraphicsContext ctx(painter);
-    QVector<QRect> vector = clip.rects();
-    WebCore::FrameView* view = d->frame->view();
-    for (int i = 0; i < vector.size(); ++i) {
-        if (i > 0) {
-            painter->save();
-            painter->setClipRect(vector.at(i), Qt::IntersectClip);
-        }
-
-        view->paint(&ctx, vector.at(i));
-
-        if (i > 0)
-            painter->restore();
-    }
+    d->renderPrivate(painter, clip);
 }
 
 /*!
@@ -783,14 +871,19 @@ void QWebFrame::render(QPainter *painter, const QRegion &clip)
 */
 void QWebFrame::render(QPainter *painter)
 {
-    if (!d->frame->view() || !d->frame->contentRenderer())
+    if (!d->frame->view())
         return;
 
-    d->frame->view()->layoutIfNeededRecursive();
+    d->renderPrivate(painter, QRegion(d->frame->view()->frameRect()));
+}
 
-    GraphicsContext ctx(painter);
-    WebCore::FrameView* view = d->frame->view();
-    view->paint(&ctx, view->frameRect());
+/*!
+  \since 4.6
+  Render the frame's \a contents into \a painter while clipping to \a contents.
+*/
+void QWebFrame::renderContents(QPainter *painter, const QRegion &contents)
+{
+    d->renderPrivate(painter, contents, true);
 }
 
 /*!
@@ -862,6 +955,8 @@ QRect QWebFrame::geometry() const
 /*!
     \property QWebFrame::contentsSize
     \brief the size of the contents in this frame
+
+    \sa contentsSizeChanged()
 */
 QSize QWebFrame::contentsSize() const
 {
@@ -872,6 +967,47 @@ QSize QWebFrame::contentsSize() const
 }
 
 /*!
+    \since 4.6
+
+    Returns the document element of this frame.
+
+    The document element provides access to the entire structured
+    content of the frame.
+*/
+QWebElement QWebFrame::documentElement() const
+{
+    WebCore::Document *doc = d->frame->document();
+    if (!doc)
+        return QWebElement();
+    return QWebElement(doc->documentElement());
+}
+
+/*!
+    \since 4.6
+    Returns a new collection of elements that are children of the frame's
+    document element and that match the given CSS selector \a selectorQuery.
+
+    \sa QWebElement::findAll()
+*/
+QList<QWebElement> QWebFrame::findAllElements(const QString &selectorQuery) const
+{
+    return documentElement().findAll(selectorQuery);
+}
+
+/*!
+    \since 4.6
+    Returns the first element in the frame's document that matches the
+    given CSS selector \a selectorQuery. Returns a null element if there is no
+    match.
+
+    \sa QWebElement::findFirst()
+*/
+QWebElement QWebFrame::findFirstElement(const QString &selectorQuery) const
+{
+    return documentElement().findFirst(selectorQuery);
+}
+
+/*!
     Performs a hit test on the frame contents at the given position \a pos and returns the hit test result.
 */
 QWebHitTestResult QWebFrame::hitTestContent(const QPoint &pos) const
@@ -879,7 +1015,7 @@ QWebHitTestResult QWebFrame::hitTestContent(const QPoint &pos) const
     if (!d->frame->view() || !d->frame->contentRenderer())
         return QWebHitTestResult();
 
-    HitTestResult result = d->frame->eventHandler()->hitTestResultAtPoint(d->frame->view()->windowToContents(pos), /*allowShadowContent*/ false);
+    HitTestResult result = d->frame->eventHandler()->hitTestResultAtPoint(d->frame->view()->windowToContents(pos), /*allowShadowContent*/ false, /*ignoreClipping*/ true);
     return QWebHitTestResult(new QWebHitTestResultPrivate(result));
 }
 
@@ -994,11 +1130,9 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     ScriptController *proxy = d->frame->script();
     QVariant rc;
     if (proxy) {
-        JSC::JSValuePtr v = proxy->evaluate(ScriptSourceCode(scriptSource)).jsValue();
-        if (v) {
-            int distance = 0;
-            rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
-        }
+        JSC::JSValue v = proxy->evaluate(ScriptSourceCode(scriptSource)).jsValue();
+        int distance = 0;
+        rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
     }
     return rc;
 }
@@ -1080,6 +1214,16 @@ QWebFrame* QWebFramePrivate::kit(WebCore::Frame* coreFrame)
 */
 
 /*!
+  \fn void QWebFrame::contentsSizeChanged(const QSize &size)
+  \since 4.6
+
+  This signal is emitted when the frame's contents size changes
+  to \a size.
+
+  \sa contentsSize()
+*/
+
+/*!
     \class QWebHitTestResult
     \since 4.4
     \brief The QWebHitTestResult class provides information about the web
@@ -1100,6 +1244,7 @@ QWebHitTestResult::QWebHitTestResult(QWebHitTestResultPrivate *priv)
 QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult &hitTest)
     : isContentEditable(false)
     , isContentSelected(false)
+    , isScrollBar(false)
 {
     if (!hitTest.innerNode())
         return;
@@ -1111,6 +1256,7 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
     linkTitle = hitTest.titleDisplayString();
     alternateText = hitTest.altDisplayString();
     imageUrl = hitTest.absoluteImageURL();
+    innerNode = hitTest.innerNode();
     innerNonSharedNode = hitTest.innerNonSharedNode();
     WebCore::Image *img = hitTest.image();
     if (img) {
@@ -1121,13 +1267,19 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
     WebCore::Frame *wframe = hitTest.targetFrame();
     if (wframe)
         linkTargetFrame = QWebFramePrivate::kit(wframe);
+    Element* urlElement = hitTest.URLElement();
+    if (urlElement)
+        linkTarget = urlElement->target();
 
     isContentEditable = hitTest.isContentEditable();
     isContentSelected = hitTest.isSelected();
+    isScrollBar = hitTest.scrollbar();
 
     if (innerNonSharedNode && innerNonSharedNode->document()
         && innerNonSharedNode->document()->frame())
         frame = QWebFramePrivate::kit(innerNonSharedNode->document()->frame());
+
+    enclosingBlock = QWebElement(WebCore::enclosingBlock(innerNode.get()));
 }
 
 /*!
@@ -1204,6 +1356,21 @@ QRect QWebHitTestResult::boundingRect() const
 }
 
 /*!
+    \since 4.6
+    Returns the block element that encloses the element hit.
+
+    A block element is an element that is rendered using the
+    CSS "block" style. This includes for example text
+    paragraphs.
+*/
+QWebElement QWebHitTestResult::enclosingBlockElement() const
+{
+    if (!d)
+        return QWebElement();
+    return d->enclosingBlock;
+}
+
+/*!
     Returns the title of the nearest enclosing HTML element.
 */
 QString QWebHitTestResult::title() const
@@ -1244,7 +1411,22 @@ QUrl QWebHitTestResult::linkTitle() const
 }
 
 /*!
+  \since 4.6
+  Returns the name of the target frame that will load the link if it is activated.
+
+  \sa linkTargetFrame()
+*/
+QString QWebHitTestResult::linkTarget() const
+{
+    if (!d)
+        return 0;
+    return d->linkTarget;
+}
+
+/*!
     Returns the frame that will load the link if it is activated.
+
+    \sa linkTarget()
 */
 QWebFrame *QWebHitTestResult::linkTargetFrame() const
 {
@@ -1305,6 +1487,18 @@ bool QWebHitTestResult::isContentSelected() const
 }
 
 /*!
+    \since 4.6
+    Returns the underlying DOM element as QWebElement.
+*/
+QWebElement QWebHitTestResult::element() const
+{
+    if (!d || !d->innerNonSharedNode || !d->innerNonSharedNode->isElementNode())
+        return QWebElement();
+
+    return QWebElement(static_cast<WebCore::Element*>(d->innerNonSharedNode.get()));
+}
+
+/*!
     Returns the frame the hit test was executed in.
 */
 QWebFrame *QWebHitTestResult::frame() const
@@ -1314,3 +1508,13 @@ QWebFrame *QWebHitTestResult::frame() const
     return d->frame;
 }
 
+/*!
+    \since 4.6
+    Returns true if the test includes a scrollbar.
+*/
+bool QWebHitTestResult::isScrollBar() const
+{
+    if (!d)
+        return false;
+    return d->isScrollBar;
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
index 18ae69755e..ebc22fe829 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.h
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2008,2009 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2007 Staikos Computing Services Inc.
 
     This library is free software; you can redistribute it and/or
@@ -49,6 +49,7 @@ class QWebPage;
 class QWebHitTestResult;
 class QWebHistoryItem;
 class QWebSecurityOrigin;
+class QWebElement;
 
 namespace WebCore {
     class WidgetPrivate;
@@ -71,12 +72,14 @@ public:
 
     QPoint pos() const;
     QRect boundingRect() const;
+    QWebElement enclosingBlockElement() const;
     QString title() const;
 
     QString linkText() const;
     QUrl linkUrl() const;
     QUrl linkTitle() const;
     QWebFrame *linkTargetFrame() const;
+    QString linkTarget() const;
 
     QString alternateText() const; // for img, area, input and applet
 
@@ -86,8 +89,12 @@ public:
     bool isContentEditable() const;
     bool isContentSelected() const;
 
+    QWebElement element() const;
+
     QWebFrame *frame() const;
 
+    bool isScrollBar() const;
+
 private:
     QWebHitTestResult(QWebHitTestResultPrivate *priv);
     QWebHitTestResultPrivate *d;
@@ -150,6 +157,7 @@ public:
     int scrollBarValue(Qt::Orientation orientation) const;
     int scrollBarMinimum(Qt::Orientation orientation) const;
     int scrollBarMaximum(Qt::Orientation orientation) const;
+    QRect scrollBarGeometry(Qt::Orientation orientation) const;
 
     void scroll(int, int);
     QPoint scrollPosition() const;
@@ -157,6 +165,7 @@ public:
 
     void render(QPainter *painter, const QRegion &clip);
     void render(QPainter *painter);
+    void renderContents(QPainter *painter, const QRegion &contents);
 
     void setTextSizeMultiplier(qreal factor);
     qreal textSizeMultiplier() const;
@@ -168,6 +177,10 @@ public:
     QRect geometry() const;
     QSize contentsSize() const;
 
+    QWebElement documentElement() const;
+    QList<QWebElement> findAllElements(const QString &selectorQuery) const;
+    QWebElement findFirstElement(const QString &selectorQuery) const;
+
     QWebHitTestResult hitTestContent(const QPoint &pos) const;
 
     virtual bool event(QEvent *);
@@ -191,6 +204,8 @@ Q_SIGNALS:
 
     void iconChanged();
 
+    void contentsSizeChanged(const QSize &size);
+
 private:
     friend class QWebPage;
     friend class QWebPagePrivate;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
index 14f69cd694..325e6e098c 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
@@ -27,6 +27,7 @@
 #include "EventHandler.h"
 #include "KURL.h"
 #include "PlatformString.h"
+#include "qwebelement.h"
 #include "wtf/RefPtr.h"
 #include "Frame.h"
 
@@ -39,7 +40,6 @@ namespace WebCore
 }
 class QWebPage;
 
-
 class QWebFrameData
 {
 public:
@@ -81,6 +81,8 @@ public:
     static WebCore::Frame* core(QWebFrame*);
     static QWebFrame* kit(WebCore::Frame*);
 
+    void renderPrivate(QPainter *painter, const QRegion &clip, bool contents = false);
+
     QWebFrame *q;
     WebCore::FrameLoaderClientQt *frameLoaderClient;
     WebCore::Frame *frame;
@@ -94,22 +96,26 @@ public:
 class QWebHitTestResultPrivate
 {
 public:
-    QWebHitTestResultPrivate() : isContentEditable(false), isContentSelected(false) {}
+    QWebHitTestResultPrivate() : isContentEditable(false), isContentSelected(false), isScrollBar(false) {}
     QWebHitTestResultPrivate(const WebCore::HitTestResult &hitTest);
 
     QPoint pos;
     QRect boundingRect;
+    QWebElement enclosingBlock;
     QString title;
     QString linkText;
     QUrl linkUrl;
     QString linkTitle;
     QPointer<QWebFrame> linkTargetFrame;
+    QString linkTarget;
     QString alternateText;
     QUrl imageUrl;
     QPixmap pixmap;
     bool isContentEditable;
     bool isContentSelected;
+    bool isScrollBar;
     QPointer<QWebFrame> frame;
+    RefPtr<WebCore::Node> innerNode;
     RefPtr<WebCore::Node> innerNonSharedNode;
 };
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h
index 19d92185fc..0885bdc754 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitglobal.h
@@ -22,22 +22,14 @@
 
 #include <QtCore/qglobal.h>
 
-#if defined(Q_OS_WIN)
-#  if defined(QT_NODLL)
-#    undef QT_MAKEDLL
-#    undef QT_DLL
-#  elif defined(QT_MAKEDLL)        /* create a Qt DLL library */
-#    if defined(QT_DLL)
-#      undef QT_DLL
-#    endif
-#    if defined(BUILD_WEBKIT)
-#        define QWEBKIT_EXPORT Q_DECL_EXPORT
-#    else
-#        define QWEBKIT_EXPORT Q_DECL_IMPORT
-#    endif
-#  elif defined(QT_DLL) /* use a Qt DLL library */
-#    define QWEBKIT_EXPORT Q_DECL_IMPORT
+#if defined(QT_MAKEDLL)        /* create a Qt DLL library */
+#  if defined(BUILD_WEBKIT)
+#      define QWEBKIT_EXPORT Q_DECL_EXPORT
+#  else
+#      define QWEBKIT_EXPORT Q_DECL_IMPORT
 #  endif
+#elif defined(QT_DLL) /* use a Qt DLL library */
+#  define QWEBKIT_EXPORT Q_DECL_IMPORT
 #endif
 
 #if !defined(QWEBKIT_EXPORT)
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 77add54789..ee64cad703 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -34,6 +34,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClientQt.h"
 #include "FrameView.h"
+#include "FormState.h"
 #include "ChromeClientQt.h"
 #include "ContextMenu.h"
 #include "ContextMenuClientQt.h"
@@ -60,9 +61,11 @@
 #include "ProgressTracker.h"
 #include "RefPtr.h"
 #include "HashMap.h"
+#include "HTMLFormElement.h"
 #include "HitTestResult.h"
 #include "WindowFeatures.h"
 #include "LocalizedStrings.h"
+#include "Cache.h"
 #include "runtime/InitializeThreading.h"
 
 #include <QApplication>
@@ -179,6 +182,21 @@ static const char* editorCommandWebActions[] =
 
     "SelectAll", // SelectAll
 
+    "PasteAndMatchStyle", // PasteAndMatchStyle
+    "RemoveFormat", // RemoveFormat
+    "Strikethrough", // ToggleStrikethrough,
+    "Subscript", // ToggleSubscript
+    "Superscript", // ToggleSuperscript
+    "InsertUnorderedList", // InsertUnorderedList
+    "InsertOrderedList", // InsertOrderedList
+    "Indent", // Indent
+    "Outdent", // Outdent,
+
+    "AlignCenter", // AlignCenter,
+    "AlignJustified", // AlignJustified,
+    "AlignLeft", // AlignLeft,
+    "AlignRight", // AlignRight,
+
     0 // WebActionCount
 };
 
@@ -263,6 +281,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     insideOpenCall = false;
     forwardUnsupportedContent = false;
     editable = false;
+    useFixedLayout = false;
     linkPolicy = QWebPage::DontDelegateLinks;
 #ifndef QT_NO_CONTEXTMENU
     currentContextMenu = 0;
@@ -426,6 +445,14 @@ void QWebPagePrivate::_q_webActionTriggered(bool checked)
     q->triggerAction(action, checked);
 }
 
+#ifndef NDEBUG
+void QWebPagePrivate::_q_cleanupLeakMessages()
+{
+    // Need this to make leak messages accurate.
+    cache()->setCapacities(0, 0, 0);
+}
+#endif
+
 void QWebPagePrivate::updateAction(QWebPage::WebAction action)
 {
     QAction *a = actions[action];
@@ -535,6 +562,19 @@ void QWebPagePrivate::updateEditorActions()
     updateAction(QWebPage::ToggleUnderline);
     updateAction(QWebPage::InsertParagraphSeparator);
     updateAction(QWebPage::InsertLineSeparator);
+    updateAction(QWebPage::PasteAndMatchStyle);
+    updateAction(QWebPage::RemoveFormat);
+    updateAction(QWebPage::ToggleStrikethrough);
+    updateAction(QWebPage::ToggleSubscript);
+    updateAction(QWebPage::ToggleSuperscript);
+    updateAction(QWebPage::InsertUnorderedList);
+    updateAction(QWebPage::InsertOrderedList);
+    updateAction(QWebPage::Indent);
+    updateAction(QWebPage::Outdent);
+    updateAction(QWebPage::AlignCenter);
+    updateAction(QWebPage::AlignJustified);
+    updateAction(QWebPage::AlignLeft);
+    updateAction(QWebPage::AlignRight);
 }
 
 void QWebPagePrivate::timerEvent(QTimerEvent *ev)
@@ -1026,9 +1066,9 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
     case Qt::ImCursorPosition: {
         Frame *frame = d->page->focusController()->focusedFrame();
         if (frame) {
-            Selection selection = frame->selection()->selection();
+            VisibleSelection selection = frame->selection()->selection();
             if (selection.isCaret()) {
-                return QVariant(selection.start().offset());
+                return QVariant(selection.start().deprecatedEditingOffset());
             }
         }
         return QVariant();
@@ -1155,6 +1195,21 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
     \value InsertParagraphSeparator Insert a new paragraph.
     \value InsertLineSeparator Insert a new line.
     \value SelectAll Selects all content.
+    \value PasteAndMatchStyle Paste content from the clipboard with current style.
+    \value RemoveFormat Removes formatting and style.
+    \value ToggleStrikethrough Toggle the formatting between strikethrough and normal style.
+    \value ToggleSubscript Toggle the formatting between subscript and baseline.
+    \value ToggleSuperscript Toggle the formatting between supercript and baseline.
+    \value InsertUnorderedList Toggles the selection between an ordered list and a normal block.
+    \value InsertOrderedList Toggles the selection between an ordered list and a normal block.
+    \value Indent Increases the indentation of the currently selected format block by one increment.
+    \value Outdent Decreases the indentation of the currently selected format block by one increment.
+    \value AlignCenter Applies center alignment to content.
+    \value AlignJustified Applies full justification to content.
+    \value AlignLeft Applies left justification to content.
+    \value AlignRight Applies right justification to content.
+
+
     \omitvalue WebActionCount
 
 */
@@ -1230,6 +1285,9 @@ QWebPage::QWebPage(QObject *parent)
     setView(qobject_cast<QWidget *>(parent));
 
     connect(this, SIGNAL(loadProgress(int)), this, SLOT(_q_onLoadProgressChanged(int)));
+#ifndef NDEBUG
+    connect(QCoreApplication::instance(), SIGNAL(aboutToQuit()), this, SLOT(_q_cleanupLeakMessages()));
+#endif
 }
 
 /*!
@@ -1433,10 +1491,9 @@ void QWebPage::triggerAction(WebAction action, bool checked)
         case OpenLink:
             if (QWebFrame *targetFrame = d->hitTestResult.linkTargetFrame()) {
                 WTF::RefPtr<WebCore::Frame> wcFrame = targetFrame->d->frame;
-                targetFrame->d->frame->loader()->loadFrameRequestWithFormAndValues(frameLoadRequest(d->hitTestResult.linkUrl(), wcFrame.get()),
-                                                                                   /*lockHistory*/ false, /*event*/ 0,
-                                                                                   /*HTMLFormElement*/ 0, /*formValues*/
-                                                                                   WTF::HashMap<String, String>());
+                targetFrame->d->frame->loader()->loadFrameRequest(frameLoadRequest(d->hitTestResult.linkUrl(), wcFrame.get()),
+                                                                  /*lockHistory*/ false, /*lockBackForwardList*/ false, /*event*/ 0,
+                                                                  /*FormState*/ 0);
                 break;
             }
             // fall through
@@ -1536,11 +1593,61 @@ void QWebPage::setViewportSize(const QSize &size) const
     if (frame->d->frame && frame->d->frame->view()) {
         WebCore::FrameView* view = frame->d->frame->view();
         view->setFrameRect(QRect(QPoint(0, 0), size));
-        frame->d->frame->forceLayout();
+        view->forceLayout();
         view->adjustViewSize();
     }
 }
 
+QSize QWebPage::fixedLayoutSize() const
+{
+    if (d->mainFrame && d->mainFrame->d->frame->view())
+        return d->mainFrame->d->frame->view()->fixedLayoutSize();
+
+    return d->fixedLayoutSize;
+}
+
+/*!
+    \property QWebPage::fixedLayoutSize
+    \since 4.6
+    \brief the size of the fixed layout
+
+    The size affects the layout of the page in the viewport.  If set to a fixed size of
+    1024x768 for example then webkit will layout the page as if the viewport were that size
+    rather than something different.
+*/
+void QWebPage::setFixedLayoutSize(const QSize &size) const
+{
+    d->fixedLayoutSize = size;
+
+    QWebFrame *frame = mainFrame();
+    if (frame->d->frame && frame->d->frame->view()) {
+        WebCore::FrameView* view = frame->d->frame->view();
+        view->setFixedLayoutSize(size);
+        view->forceLayout();
+    }
+}
+
+bool QWebPage::useFixedLayout() const
+{
+    return d->useFixedLayout;
+}
+
+/*!
+    \property QWebPage::useFixedLayout
+    \since 4.6
+    \brief whether to use a fixed layout size
+*/
+void QWebPage::setUseFixedLayout(bool useFixedLayout)
+{
+    d->useFixedLayout = useFixedLayout;
+
+    QWebFrame *frame = mainFrame();
+    if (frame->d->frame && frame->d->frame->view()) {
+        WebCore::FrameView* view = frame->d->frame->view();
+        view->setUseFixedLayout(useFixedLayout);
+        view->forceLayout();
+    }
+}
 
 /*!
     \fn bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, QWebPage::NavigationType type)
@@ -1568,7 +1675,7 @@ bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QWebNetworkReques
                 return true;
 
             case DelegateExternalLinks:
-                if (WebCore::FrameLoader::shouldTreatSchemeAsLocal(request.url().scheme()))
+                if (WebCore::FrameLoader::shouldTreatURLSchemeAsLocal(request.url().scheme()))
                     return true;
                 emit linkClicked(request.url());
                 return false;
@@ -1808,6 +1915,52 @@ QAction *QWebPage::action(WebAction action) const
             text = tr("Insert a new line");
             break;
 
+        case PasteAndMatchStyle:
+            text = tr("Paste and Match Style");
+            break;
+        case RemoveFormat:
+            text = tr("Remove formatting");
+            break;
+
+        case ToggleStrikethrough:
+            text = tr("Strikethrough");
+            checkable = true;
+            break;
+        case ToggleSubscript:
+            text = tr("Subscript");
+            checkable = true;
+            break;
+        case ToggleSuperscript:
+            text = tr("Superscript");
+            checkable = true;
+            break;
+        case InsertUnorderedList:
+            text = tr("Insert Bulleted List");
+            checkable = true;
+            break;
+        case InsertOrderedList:
+            text = tr("Insert Numbered List");
+            checkable = true;
+            break;
+        case Indent:
+            text = tr("Indent");
+            break;
+        case Outdent:
+            text = tr("Outdent");
+            break;
+        case AlignCenter:
+            text = tr("Center");
+            break;
+        case AlignJustified:
+            text = tr("Justify");
+            break;
+        case AlignLeft:
+            text = tr("Align Left");
+            break;
+        case AlignRight:
+            text = tr("Align Right");
+            break;
+
         case NoWebAction:
             return 0;
     }
@@ -1986,12 +2139,10 @@ bool QWebPage::isContentEditable() const
 
 /*!
     \property QWebPage::forwardUnsupportedContent
-    \brief whether QWebPage should forward unsupported content
-
-    If enabled, the unsupportedContent() signal is emitted with a network reply that
-    can be used to read the content.
+    \brief whether QWebPage should forward unsupported content through the
+    unsupportedContent signal
 
-    If disabled, the download of such content is aborted immediately.
+    If disabled the download of such content is aborted immediately.
 
     By default unsupported content is not forwarded.
 */
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
index 7253cee3c0..2152865311 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
@@ -52,10 +52,11 @@ namespace WebCore {
     class ChromeClientQt;
     class EditorClientQt;
     class FrameLoaderClientQt;
-    class FrameLoadRequest;
     class InspectorClientQt;
     class ResourceHandle;
     class HitTestResult;
+
+    struct FrameLoadRequest;
 }
 
 class QWEBKIT_EXPORT QWebPage : public QObject
@@ -65,6 +66,8 @@ class QWEBKIT_EXPORT QWebPage : public QObject
     Q_PROPERTY(bool modified READ isModified)
     Q_PROPERTY(QString selectedText READ selectedText)
     Q_PROPERTY(QSize viewportSize READ viewportSize WRITE setViewportSize)
+    Q_PROPERTY(QSize fixedLayoutSize READ fixedLayoutSize WRITE setFixedLayoutSize)
+    Q_PROPERTY(bool useFixedLayout READ useFixedLayout WRITE setUseFixedLayout)
     Q_PROPERTY(bool forwardUnsupportedContent READ forwardUnsupportedContent WRITE setForwardUnsupportedContent)
     Q_PROPERTY(LinkDelegationPolicy linkDelegationPolicy READ linkDelegationPolicy WRITE setLinkDelegationPolicy)
     Q_PROPERTY(QPalette palette READ palette WRITE setPalette)
@@ -148,6 +151,22 @@ public:
 
         SelectAll,
 
+        PasteAndMatchStyle,
+        RemoveFormat,
+
+        ToggleStrikethrough,
+        ToggleSubscript,
+        ToggleSuperscript,
+        InsertUnorderedList,
+        InsertOrderedList,
+        Indent,
+        Outdent,
+
+        AlignCenter,
+        AlignJustified,
+        AlignLeft,
+        AlignRight,
+
         WebActionCount
     };
 
@@ -215,6 +234,12 @@ public:
     QSize viewportSize() const;
     void setViewportSize(const QSize &size) const;
 
+    QSize fixedLayoutSize() const;
+    void setFixedLayoutSize(const QSize &size) const;
+
+    bool useFixedLayout() const;
+    void setUseFixedLayout(bool useFixedLayout);
+
     virtual bool event(QEvent*);
     bool focusNextPrevChild(bool next);
 
@@ -317,6 +342,9 @@ protected:
 private:
     Q_PRIVATE_SLOT(d, void _q_onLoadProgressChanged(int))
     Q_PRIVATE_SLOT(d, void _q_webActionTriggered(bool checked))
+#ifndef NDEBUG
+    Q_PRIVATE_SLOT(d, void _q_cleanupLeakMessages())
+#endif
     QWebPagePrivate *d;
 
     friend class QWebFrame;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
index a1f33ab33e..a897bf157b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
@@ -79,6 +79,9 @@ public:
 
     void _q_onLoadProgressChanged(int);
     void _q_webActionTriggered(bool checked);
+#ifndef NDEBUG
+    void _q_cleanupLeakMessages();
+#endif
     void updateAction(QWebPage::WebAction action);
     void updateNavigationActions();
     void updateEditorActions();
@@ -154,6 +157,7 @@ public:
     QWebPage::LinkDelegationPolicy linkPolicy;
 
     QSize viewportSize;
+    QSize fixedLayoutSize;
     QWebHistory history;
     QWebHitTestResult hitTestResult;
 #ifndef QT_NO_CONTEXTMENU
@@ -162,6 +166,7 @@ public:
     QWebSettings *settings;
     QPalette palette;
     bool editable;
+    bool useFixedLayout;
 
     QAction *actions[QWebPage::WebActionCount];
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
index 52173624a7..da9278c1a1 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
@@ -101,7 +101,11 @@ int QWebSecurityOrigin::port() const
 */
 qint64 QWebSecurityOrigin::databaseUsage() const
 {
+#if ENABLE(DATABASE)
     return DatabaseTracker::tracker().usageForOrigin(d->origin.get());
+#else
+    return 0;
+#endif
 }
 
 /*!
@@ -109,7 +113,11 @@ qint64 QWebSecurityOrigin::databaseUsage() const
 */
 qint64 QWebSecurityOrigin::databaseQuota() const
 {
+#if ENABLE(DATABASE)
     return DatabaseTracker::tracker().quotaForOrigin(d->origin.get());
+#else
+    return 0;
+#endif
 }
 
 /*!
@@ -121,7 +129,9 @@ qint64 QWebSecurityOrigin::databaseQuota() const
 */
 void QWebSecurityOrigin::setDatabaseQuota(qint64 quota)
 {
+#if ENABLE(DATABASE)
     DatabaseTracker::tracker().setQuota(d->origin.get(), quota);
+#endif
 }
 
 /*!
@@ -144,14 +154,18 @@ QWebSecurityOrigin::QWebSecurityOrigin(QWebSecurityOriginPrivate* priv)
 */
 QList<QWebSecurityOrigin> QWebSecurityOrigin::allOrigins()
 {
+    QList<QWebSecurityOrigin> webOrigins;
+
+#if ENABLE(DATABASE)
     Vector<RefPtr<SecurityOrigin> > coreOrigins;
     DatabaseTracker::tracker().origins(coreOrigins);
-    QList<QWebSecurityOrigin> webOrigins;
 
     for (unsigned i = 0; i < coreOrigins.size(); ++i) {
         QWebSecurityOriginPrivate* priv = new QWebSecurityOriginPrivate(coreOrigins[i].get());
         webOrigins.append(priv);
     }
+#endif
+
     return webOrigins;
 }
 
@@ -160,8 +174,11 @@ QList<QWebSecurityOrigin> QWebSecurityOrigin::allOrigins()
 */
 QList<QWebDatabase> QWebSecurityOrigin::databases() const
 {
-    Vector<String> nameVector;
     QList<QWebDatabase> databases;
+
+#if ENABLE(DATABASE)
+    Vector<String> nameVector;
+
     if (!DatabaseTracker::tracker().databaseNamesForOrigin(d->origin.get(), nameVector))
         return databases;
     for (unsigned i = 0; i < nameVector.size(); ++i) {
@@ -171,6 +188,8 @@ QList<QWebDatabase> QWebSecurityOrigin::databases() const
         QWebDatabase webDatabase(priv);
         databases.append(webDatabase);
     }
+#endif
+
     return databases;
 }
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
index b5162637f4..8192e68cb7 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
@@ -24,6 +24,8 @@
 #include "qwebpage_p.h"
 
 #include "Cache.h"
+#include "CrossOriginPreflightResultCache.h"
+#include "FontCache.h"
 #include "Page.h"
 #include "PageCache.h"
 #include "Settings.h"
@@ -52,6 +54,7 @@ public:
     QHash<int, int> fontSizes;
     QHash<int, bool> attributes;
     QUrl userStyleSheetLocation;
+    QString defaultTextEncoding;
     QString localStorageDatabasePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
@@ -161,6 +164,9 @@ void QWebSettingsPrivate::apply()
         QUrl location = !userStyleSheetLocation.isEmpty() ? userStyleSheetLocation : global->userStyleSheetLocation;
         settings->setUserStyleSheetLocation(WebCore::KURL(location));
 
+        QString encoding = !defaultTextEncoding.isEmpty() ? defaultTextEncoding: global->defaultTextEncoding;
+        settings->setDefaultTextEncodingName(encoding);
+
         QString localStoragePath = !localStorageDatabasePath.isEmpty() ? localStorageDatabasePath : global->localStorageDatabasePath;
         settings->setLocalStorageDatabasePath(localStoragePath);
 
@@ -183,6 +189,10 @@ void QWebSettingsPrivate::apply()
         value = attributes.value(QWebSettings::LocalStorageDatabaseEnabled,
                                       global->attributes.value(QWebSettings::LocalStorageDatabaseEnabled));
         settings->setLocalStorageEnabled(value);
+
+        value = attributes.value(QWebSettings::AllowUniversalAccessFromFileUrls,
+                                      global->attributes.value(QWebSettings::AllowUniversalAccessFromFileUrls));
+        settings->setAllowUniversalAccessFromFileURLs(value);
     } else {
         QList<QWebSettingsPrivate *> settings = *::allSettings();
         for (int i = 0; i < settings.count(); ++i)
@@ -213,25 +223,17 @@ QWebSettings *QWebSettings::globalSettings()
     Each QWebPage object has its own QWebSettings object, which configures the
     settings for that page. If a setting is not configured, then it is looked
     up in the global settings object, which can be accessed using
-    globalSettings().
+    QWebSettings::globalSettings().
 
-    QWebSettings allows configuration of browser properties, such as font sizes and
-    families, the location of a custom style sheet, and generic attributes like
-    JavaScript and plugins. Individual attributes are set using the setAttribute()
-    function. The \l{QWebSettings::WebAttribute}{WebAttribute} enum further describes
-    each attribute.
+    QWebSettings allows configuring font properties such as font size and font
+    family, the location of a custom stylesheet, and generic attributes like java
+    script, plugins, etc. The \l{QWebSettings::WebAttribute}{WebAttribute}
+    enum further describes this.
 
-    QWebSettings also configures global properties such as the Web page memory
-    cache and the Web page icon database, local database storage and offline
+    QWebSettings also configures global properties such as the web page memory
+    cache and the web page icon database, local database storage and offline
     applications storage.
 
-    \section1 Enabling Plugins
-
-    Support for browser plugins can enabled by setting the
-    \l{QWebSettings::PluginsEnabled}{PluginsEnabled} attribute. For many applications,
-    this attribute is enabled for all pages by setting it on the
-    \l{globalSettings()}{global settings object}.
-
     \section1 Web Application Support
 
     WebKit provides support for features specified in \l{HTML 5} that improve the
@@ -318,6 +320,8 @@ QWebSettings *QWebSettings::globalSettings()
         web application cache feature is enabled or not.
     \value LocalStorageDatabaseEnabled Specifies whether support for the HTML 5
         local storage feature is enabled or not.
+    \value AllowUniversalAccessFromFileUrls Specifies whether documents from file
+        Urls should be granted universal access (e.g., to HTTP and HTTPS documents).
 */
 
 /*!
@@ -346,6 +350,7 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::OfflineStorageDatabaseEnabled, true);
     d->attributes.insert(QWebSettings::OfflineWebApplicationCacheEnabled, true);
     d->attributes.insert(QWebSettings::LocalStorageDatabaseEnabled, true);
+    d->attributes.insert(QWebSettings::AllowUniversalAccessFromFileUrls, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
 
 }
@@ -432,6 +437,33 @@ QUrl QWebSettings::userStyleSheetUrl() const
 }
 
 /*!
+    \since 4.6
+    Specifies the default text encoding system.
+
+    The \a encoding, must be a string describing an encoding such as "utf-8",
+    "iso-8859-1", etc. If left empty a default value will be used. For a more
+    extensive list of encoding names see \l{QTextCodec}
+
+    \sa defaultTextEncoding()
+*/
+void QWebSettings::setDefaultTextEncoding(const QString &encoding)
+{
+    d->defaultTextEncoding = encoding;
+    d->apply();
+}
+
+/*!
+    \since 4.6
+    Returns the default text encoding.
+
+    \sa setDefaultTextEncoding()
+*/
+QString QWebSettings::defaultTextEncoding() const
+{
+    return d->defaultTextEncoding;
+}
+
+/*!
     Sets the path of the icon database to \a path. The icon database is used
     to store "favicons" associated with web sites.
 
@@ -535,6 +567,40 @@ QPixmap QWebSettings::webGraphic(WebGraphic type)
 }
 
 /*!
+    Frees up as much memory as possible by cleaning all memory caches such
+    as page, object and font cache.
+
+    \since 4.6
+ */
+void QWebSettings::clearMemoryCaches()
+{
+    // Turn the cache on and off.  Disabling the object cache will remove all
+    // resources from the cache.  They may still live on if they are referenced
+    // by some Web page though.
+    if (!WebCore::cache()->disabled()) {
+        WebCore::cache()->setDisabled(true);
+        WebCore::cache()->setDisabled(false);
+    }
+
+    int pageCapacity = WebCore::pageCache()->capacity();
+    // Setting size to 0, makes all pages be released.
+    WebCore::pageCache()->setCapacity(0);
+    WebCore::pageCache()->releaseAutoreleasedPagesNow();
+    WebCore::pageCache()->setCapacity(pageCapacity);
+
+    // Invalidating the font cache and freeing all inactive font data.
+    WebCore::fontCache()->invalidate();
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    // Empty the application cache.
+    WebCore::cacheStorage().empty();
+#endif
+
+    // Empty the Cross-Origin Preflight cache
+    WebCore::CrossOriginPreflightResultCache::shared().empty();
+}
+
+/*!
     Sets the maximum number of pages to hold in the memory cache to \a pages.
 */
 void QWebSettings::setMaximumPagesInCache(int pages)
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
index 3d0660b9aa..da0c9f25f8 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
@@ -63,7 +63,8 @@ public:
         PrintElementBackgrounds,
         OfflineStorageDatabaseEnabled,
         OfflineWebApplicationCacheEnabled,
-        LocalStorageDatabaseEnabled
+        LocalStorageDatabaseEnabled,
+        AllowUniversalAccessFromFileUrls
     };
     enum WebGraphic {
         MissingImageGraphic,
@@ -95,6 +96,9 @@ public:
     void setUserStyleSheetUrl(const QUrl &location);
     QUrl userStyleSheetUrl() const;
 
+    void setDefaultTextEncoding(const QString &encoding);
+    QString defaultTextEncoding() const;
+
     static void setIconDatabasePath(const QString &location);
     static QString iconDatabasePath();
     static void clearIconDatabase();
@@ -112,6 +116,8 @@ public:
     static void setOfflineStorageDefaultQuota(qint64 maximumSize);
     static qint64 offlineStorageDefaultQuota();
 
+    static void clearMemoryCaches();
+
     inline QWebSettingsPrivate* handle() const { return d; }
 
 private:
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index 9753f4f9c5..3c56b93f12 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -27,6 +27,8 @@
 #include "qevent.h"
 #include "qpainter.h"
 #include "qprinter.h"
+#include "qdir.h"
+#include "qfile.h"
 
 class QWebViewPrivate
 {
@@ -34,6 +36,7 @@ public:
     QWebViewPrivate(QWebView *view)
         : view(view)
         , page(0)
+        , renderHints(QPainter::TextAntialiasing)
 #ifndef QT_NO_CURSOR
         , cursorSetByWebCore(false)
         , usesWebCoreCursor(true)
@@ -43,6 +46,7 @@ public:
     QWebView *view;
     QWebPage *page;
 
+    QPainter::RenderHints renderHints;
 
 #ifndef QT_NO_CURSOR
     /*
@@ -245,11 +249,79 @@ void QWebView::setPage(QWebPage *page)
 }
 
 /*!
+    Returns a valid URL from a user supplied \a string if one can be deducted.
+    In the case that is not possible, an invalid QUrl() is returned.
+
+    \since 4.6
+
+    Most applications that can browse the web, allow the user to input a URL
+    in the form of a plain string. This string can be manually typed into
+    a location bar, obtained from the clipboard, or passed in via command
+    line arguments.
+
+    When the string is not already a valid URL, a best guess is performed,
+    making various web related assumptions.
+
+    In the case the string corresponds to a valid file path on the system,
+    a file:// URL is constructed, using QUrl::fromLocalFile().
+
+    If that is not the case, an attempt is made to turn the string into a
+    http:// or ftp:// URL. The latter in the case the string starts with
+    'ftp'. The result is then passed through QUrl's tolerant parser, and
+    in the case or success, a valid QUrl is returned, or else a QUrl().
+
+    Examples
+    - webkit.org becomes http://webkit.org
+    - ftp.webkit.org becomes ftp://ftp.webkit.org
+    - localhost becomes http://localhost
+    - /home/user/test.html becomes file:///home/user/test.html (if exists)
+
+    Tips when dealing with URLs and strings
+    - When creating a QString from a QByteArray or a char*, always use
+      QString::fromUtf8().
+    - Do not use QUrl(string), nor QUrl::toString() anywhere where the URL might
+      be used, such as in the location bar, as those functions loose data.
+      Instead use QUrl::fromEncoded() and QUrl::toEncoded(), respectively.
+
+ */
+QUrl QWebView::guessUrlFromString(const QString &string)
+{
+    QString trimmedString = string.trimmed();
+
+    // Check the most common case of a valid url with scheme and host first
+    QUrl url = QUrl::fromEncoded(trimmedString.toUtf8(), QUrl::TolerantMode);
+    if (url.isValid() && !url.scheme().isEmpty() && !url.host().isEmpty())
+        return url;
+
+    // Absolute files that exists
+    if (QDir::isAbsolutePath(trimmedString) && QFile::exists(trimmedString))
+        return QUrl::fromLocalFile(trimmedString);
+
+    // If the string is missing the scheme or the scheme is not valid prepend a scheme
+    QString scheme = url.scheme();
+    if (scheme.isEmpty() || scheme.contains(QLatin1Char('.')) || scheme == QLatin1String("localhost")) {
+        // Do not do anything for strings such as "foo", only "foo.com"
+        int dotIndex = trimmedString.indexOf(QLatin1Char('.'));
+        if (dotIndex != -1 || trimmedString.startsWith(QLatin1String("localhost"))) {
+            const QString hostscheme = trimmedString.left(dotIndex).toLower();
+            QByteArray scheme = (hostscheme == QLatin1String("ftp")) ? "ftp" : "http";
+            trimmedString = QLatin1String(scheme) + QLatin1String("://") + trimmedString;
+        }
+        url = QUrl::fromEncoded(trimmedString.toUtf8(), QUrl::TolerantMode);
+    }
+
+    if (url.isValid())
+        return url;
+
+    return QUrl();
+}
+
+/*!
     Loads the specified \a url and displays it.
 
     \note The view remains the same until enough data has arrived to display the new \a url.
 
-    \sa setUrl(), url(), urlChanged()
+    \sa setUrl(), url(), urlChanged(), guessUrlFromString()
 */
 void QWebView::load(const QUrl &url)
 {
@@ -533,6 +605,47 @@ qreal QWebView::textSizeMultiplier() const
 }
 
 /*!
+    \property QWebView::renderHints
+    \since 4.6
+    \brief the default render hints for the view
+
+    These hints are used to initialize QPainter before painting the web page.
+
+    QPainter::TextAntialiasing is enabled by default.
+*/
+QPainter::RenderHints QWebView::renderHints() const
+{
+    return d->renderHints;
+}
+
+void QWebView::setRenderHints(QPainter::RenderHints hints)
+{
+    if (hints == d->renderHints)
+        return;
+    d->renderHints = hints;
+    update();
+}
+
+/*!
+    If \a enabled is true, the render hint \a hint is enabled; otherwise it
+    is disabled.
+
+    \since 4.6
+    \sa renderHints
+*/
+void QWebView::setRenderHint(QPainter::RenderHint hint, bool enabled)
+{
+    QPainter::RenderHints oldHints = d->renderHints;
+    if (enabled)
+        d->renderHints |= hint;
+    else
+        d->renderHints &= ~hint;
+    if (oldHints != d->renderHints)
+        update();
+}
+
+
+/*!
     Finds the next occurrence of the string, \a subString, in the page, using
     the given \a options. Returns true of \a subString was found and selects
     the match visually; otherwise returns false.
@@ -680,6 +793,7 @@ void QWebView::paintEvent(QPaintEvent *ev)
 
     QWebFrame *frame = d->page->mainFrame();
     QPainter p(this);
+    p.setRenderHints(d->renderHints);
 
     frame->render(&p, ev->region());
 
@@ -914,7 +1028,10 @@ void QWebView::changeEvent(QEvent *e)
 
     This signal is emitted whenever the icon of the page is loaded or changes.
 
-    \sa icon()
+    In order for icons to be loaded, you will need to set an icon database path
+    using QWebSettings::setIconDatabasePath().
+
+    \sa icon(), QWebSettings::setIconDatabasePath()
 */
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
index 1172f39605..5c2c7a0b8d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
@@ -25,6 +25,7 @@
 #include "qwebpage.h"
 #include <QtGui/qwidget.h>
 #include <QtGui/qicon.h>
+#include <QtGui/qpainter.h>
 #include <QtCore/qurl.h>
 #if QT_VERSION >= 0x040400
 #include <QtNetwork/qnetworkaccessmanager.h>
@@ -50,6 +51,8 @@ class QWEBKIT_EXPORT QWebView : public QWidget
     //Q_PROPERTY(Qt::TextInteractionFlags textInteractionFlags READ textInteractionFlags WRITE setTextInteractionFlags)
     Q_PROPERTY(qreal textSizeMultiplier READ textSizeMultiplier WRITE setTextSizeMultiplier DESIGNABLE false)
     Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor)
+    Q_PROPERTY(QPainter::RenderHints renderHints READ renderHints WRITE setRenderHints)
+    Q_FLAGS(QPainter::RenderHints)
 public:
     explicit QWebView(QWidget *parent = 0);
     virtual ~QWebView();
@@ -57,6 +60,8 @@ public:
     QWebPage *page() const;
     void setPage(QWebPage *page);
 
+    static QUrl guessUrlFromString(const QString &string);
+
     void load(const QUrl &url);
 #if QT_VERSION < 0x040400 && !defined(qdoc)
     void load(const QWebNetworkRequest &request);
@@ -99,6 +104,10 @@ public:
     void setTextSizeMultiplier(qreal factor);
     qreal textSizeMultiplier() const;
 
+    QPainter::RenderHints renderHints() const;
+    void setRenderHints(QPainter::RenderHints hints);
+    void setRenderHint(QPainter::RenderHint hint, bool enabled);
+
     bool findText(const QString &subString, QWebPage::FindFlags options = 0);
 
     virtual bool event(QEvent *);
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index d9f925a154..f3bac7361c 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,223 @@
+2009-06-10  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Documented ResolveRule and StylePriority enum values as well as their use in
+        QWebElement::styleProperty and QWebElement::setStyleProperty methods.
+
+        Based on the work of Simon Hausmann.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+        (QWebElement::setStyleProperty):
+        * Api/qwebelement.h:
+
+2009-06-09  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Fix qdoc warning, function parameter string must be referred.
+
+        * Api/qwebview.cpp:
+
+2009-06-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Renamed QWebElement::enclosingBlock to enclosingBlockElement
+        and changed the return type to QWebElement, as discussed in
+        the API review. This API is more generic and through
+        QWebElement's geometry() it is possible to retrieve the
+        same information.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::QWebElement):
+        * Api/qwebelement.h:
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+        (QWebHitTestResult::enclosingBlockElement):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add missing includes of config.h
+
+        * Api/qcookiejar.cpp:
+        * Api/qwebnetworkinterface.cpp:
+        * Plugins/ICOHandler.cpp:
+        * WebCoreSupport/DragClientQt.cpp:
+        * WebCoreSupport/EditCommandQt.cpp:
+
+2009-06-03  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add API to make it possible to clear all memory caches used by
+        QtWebKit.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::clearMemoryCaches):
+        * Api/qwebsettings.h:
+
+2009-06-01  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Before guessing the url trim the string to remove whitespace added to the start/end by the user.
+
+        * Api/qwebview.cpp:
+        (QWebView::guessUrlFromString):
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::guessUrlFromString_data):
+
+2009-06-01  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Use QLatin1Char() to compile when QT_NO_CAST_FROM_ASCII and QT_NO_CAST_TO_ASCII is defined
+
+        * Api/qwebview.cpp:
+        (QWebView::guessUrlFromString):
+
+2009-06-01  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Cleanup autotest file
+        - use proper includes
+        - remove useless constructor and destructor
+        - add missing newline at the end of the file
+
+        * tests/qwebview/tst_qwebview.cpp:
+
+2009-06-01  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Add a missing space between two words in the documentation.
+
+        * Api/qwebview.cpp:
+
+2009-05-26  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25823
+
+        Add an API to generate a QUrl out of a string correcting for errors and missing information.
+        See the API documentation for more details about the function.
+
+        Autotests: included
+
+        * Api/qwebview.cpp:
+        (QWebView::guessUrlFromString):
+        * Api/qwebview.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+        (MainWindow::changeLocation):
+        * tests/qwebview/.gitignore: Added.
+        * tests/qwebview/qwebview.pro:
+        (tst_QWebView::initTestCase):
+        (tst_QWebView::cleanupTestCase):
+        (tst_QWebView::init):
+        (tst_QWebView::cleanup):
+        (tst_QWebView::guessUrlFromString_data):
+        (tst_QWebView::guessUrlFromString):
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::createHTMLParserQuirks): Return a
+        PassOwnPtr<> instead of a raw HTMLParserQuirks pointer.
+
+2009-05-23  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25863
+
+        Expose the default text encoding property to Qt.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::setDefaultTextEncoding):
+        (QWebSettings::defaultTextEncoding):
+        * Api/qwebsettings.h:
+
+2009-05-21  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Additional test for resource load (CSS file) for QWebFrame.
+
+        * tests/qwebframe/qwebframe.qrc:
+        * tests/qwebframe/style.css: Added.
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-05-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt build fix.
+
+        Provide dummy implementation of pure virtual EditorClient method.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::getAutoCorrectSuggestionForMisspelledWord):
+        * WebCoreSupport/EditorClientQt.h:
+
+2009-05-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann and Holger Freyther.
+
+        [Qt] Add renderHints property to QWebView.
+
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::QWebViewPrivate):
+        (QWebView::renderHints):
+        (QWebView::setRenderHints):
+        (QWebView::setRenderHint):
+        (QWebView::paintEvent):
+        * Api/qwebview.h:
+        * tests/qwebview/qwebview.pro: Added.
+        * tests/qwebview/tst_qwebview.cpp: Added.
+        (tst_QWebView::tst_QWebView):
+        (tst_QWebView::~tst_QWebView):
+        (tst_QWebView::init):
+        (tst_QWebView::cleanup):
+        (tst_QWebView::renderHints):
+        * tests/tests.pro:
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25834
+
+        Make ChromeClient a interface again
+
+        With recent additions to ChromeClient.h empty defaults were
+        added. This is bad for porters as these changes go unnoticed
+        and at runtime no notImplemented warning is logged and grepping
+        for notImplemented will not show anything. Change this Client
+        to be like the other Clients again and always have pure virtuals
+        (but for stuff inside #ifdef PLATFORM(MAC)).
+
+        Update the various WebKit/* implementations to compile again.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::setCursor):
+        (WebCore::ChromeClientQt::requestGeolocationPermissionForFrame):
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::scrollRectIntoView):
+
 2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
 
         Reviewed by Simon Hausmann.
@@ -12,16 +232,472 @@
         * WebCoreSupport/FrameLoaderClientQt.cpp:
         (WebCore::):
 
-2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+2009-05-18  Zoltan Horvath <horvath.zoltan.6@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        Makes QtLauncher to accept multiple urls in command line and opens these in separate windows.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::newWindow):
+        (main):
+
+2009-05-14  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Add a comment to QWebView::iconChanged(), mentioning that you will
+        need to set the icon database path for icons to be loaded, and thus
+        receive the signal.
+
+        * Api/qwebview.cpp:
+
+2009-05-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix setHtml test case by adding <head> tag to the expected result. This tag is automatically added by WebKit.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-05-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Add a test case for the signal urlChanged().
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-05-13  Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Move emitting the signal QWebFrame::urlChanged to FrameLoaderClientQt::dispatchDidCommitLoad().
+        This is to ensure that urlChanged() is emitted even if the frame has no title.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveTitle):
+        (WebCore::FrameLoaderClientQt::dispatchDidCommitLoad):
+
+2009-05-13  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Rubberstamped by Ariya Hidayat.
+
+        Fix coding style: Add {} to contents of if, containing a for loop.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+
+2009-05-12  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fixed a possible crash @styleProperty when there is no embedded/external CSS set.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+
+2009-05-12  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Added external CSS test cases to QWebElement::styleProperty() method.
+
+        Also some ::styleProperty() tests cleanup.
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+
+2009-05-12  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Many methods were not considering the case of the element not having
+        siblings or children when inserting nodes, and thus broke in some
+        situations. This patch fixes that.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::prependInside):
+        (QWebElement::appendOutside):
+        (QWebElement::encloseWith):
+
+2009-05-08  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Make is possible to mark a style property as important while setting
+        it. Also support the normal CSS property syntax "!important", while
+        accepting spaces between the ! and the important keyword.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::setStyleProperty):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+
+2009-05-08  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Working with Antonio Gomes.
+
+        Add support for finding the style property actually applied to the element.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24538: class/struct mixup in forward declarations
+        https://bugs.webkit.org/show_bug.cgi?id=24538
+
+        * Api/qwebpage.h:
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix Qt build when ENABLE_DATABASE is turned off
+
+        https://bugs.webkit.org/show_bug.cgi?id=25587
+
+        * Api/qwebdatabase.cpp:
+        (QWebDatabase::displayName):
+        (QWebDatabase::expectedSize):
+        (QWebDatabase::size):
+        (QWebDatabase::fileName):
+        (QWebDatabase::removeDatabase):
+        * Api/qwebdatabase_p.h:
+        * Api/qwebsecurityorigin.cpp:
+        (QWebSecurityOrigin::allOrigins):
+        (QWebSecurityOrigin::databases):
+
+2009-05-05  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
 
         Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24746
+        Improve behaviour of the QWebElement enclose* functions, to work
+        similar to the jQuery wrap functions. We now enclose the contents
+        of the element in the child of the deepest descendant element
+        within the structure of the enclose element structure given.
+
+        * Api/qwebelement.cpp:
+        (findInsertionPoint):
+        (QWebElement::encloseContentsWith):
+        (QWebElement::encloseWith):
+        (QWebElement::replace):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::encloseContentsWith):
+        (tst_QWebElement::encloseWith):
+
+2009-05-06  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        After commit rev @43215, setHtml() without a <head> tag,
+        automatically adds it, so update our test case to respect this.
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::textHtml):
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt build fix.
+
+        Dont' use ENABLE() in Qt API headers, as they are not available when building
+        against the API.
+
+        * Api/qwebdatabase.h:
+        * Api/qwebsecurityorigin.h:
+
+2009-05-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+        
+        Add #if ENABLE(DATABASE) guards around database code so toggling ENABLE_DATABASE off does not break builds.
+        https://bugs.webkit.org/show_bug.cgi?id=24776
+
+        * Api/qwebdatabase.cpp:
+        * Api/qwebdatabase.h:
+        * Api/qwebdatabase_p.h:
+        * Api/qwebsecurityorigin.cpp:
+        (QWebSecurityOrigin::databaseUsage):
+        (QWebSecurityOrigin::databaseQuota):
+        (QWebSecurityOrigin::setDatabaseQuota):
+        * Api/qwebsecurityorigin.h:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::exceededDatabaseQuota):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Various improvements to the class documentation, including a simple snippet for QWebElement.
+
+        * Api/qwebelement.cpp:
+        * Api/qwebframe.cpp:
+        * docs/webkitsnippets/webelement/main.cpp: Added.
+        * docs/webkitsnippets/webelement/webelement.pro: Added.
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Simplify variant conversion by moving the null check into
+        convertValueToQVariant.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript): Moved null check into conversion function.
+        * tests/qwebframe/tst_qwebframe.cpp:
+        Added test to verify the correct conversion of null values to QVariant.
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * Api/qwebelement.cpp:
+        (setupScriptContext):
+        (setupScriptObject):
+        (QWebElement::evaluateScript):
+        (QWebElement::functions):
+        (QWebElement::scriptableProperty):
+        (QWebElement::setScriptableProperty):
+        (QWebElement::scriptableProperties):
+
+2009-05-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a FrameLoaderClient callback for the ResourceRetrievedByXMLHttpRequest.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25347
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidLoadResourceByXMLHttpRequest):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-04-30  David Kilzer  <ddkilzer@apple.com>
+
+        Provide a mechanism to create a quirks delegate for HTMLParser
+
+        Reviewed by David Hyatt.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::createHTMLParserQuirks): Added.  The
+        default implementation of this factory method returns 0.
+
+2009-04-30  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed build fix after r43072.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_setJavaScriptProfilingEnabled): Enclose with JAVASCRIPT_DEBUGGER.
+
+2009-04-30  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed build fix after r43063.
 
-        Improved selection tests.
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::addMessageToConsole):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2009-04-30  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement encloseContentsWith and rename wrap to encloseWith.
 
+        Also in encloseWith, make sure that you cannot enclose with
+        non-enclosable elements.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::encloseContentsWith):
+        (QWebElement::encloseWith):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::encloseContentsWith):
+        (tst_QWebElement::encloseWith):
+
+2009-04-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        The Qt API exposes a global history patch CSSStyleSelector to make API consumers work again
+
+        https://bugs.webkit.org/show_bug.cgi?id=20952
+
+        The QtWebKit port made the mistake of exposing a global history. This broke
+        with the addition of PageGroup and LinkHash. This needs to be repaired
+        for Qt4.5.
+
+        Add a function to LinkHash.cpp that is resolving a URL. Use this
+        function from within CSSStyleSelector to forward the url to the
+        QWebHistoryInterface API.
+
+        It is sad that there is a path within visitedLinkHash which is now
+        doing a memcpy, it is sad to add a PLATFORM(QT) define to CSSStyleSelector
+        and using QtWebKit types within WebCore is a layering violation as well.
+
+        PageGroup::setShouldTrackVisitedLinks is currently not enabled. For
+        Qt4.6 a second version of the QWebHistoryInterface is going to be
+        added which will fix things up.
+
+        * Api/qwebhistoryinterface.cpp:
+        (QWebHistoryInterface::setDefaultInterface): Add note for Qt4.6
+        * Api/qwebpage.cpp: Remove PageGroup::setShouldTrackVisitedLinks(true)
+        (QWebPagePrivate::QWebPagePrivate):
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro: Added unit test.
+        * tests/qwebhistoryinterface/tst_qwebhistoryinterface.cpp: Added unit test.
+        (tst_QWebHistoryInterface::tst_QWebHistoryInterface):
+        (tst_QWebHistoryInterface::~tst_QWebHistoryInterface):
+        (tst_QWebHistoryInterface::init):
+        (tst_QWebHistoryInterface::cleanup):
+        (FakeHistoryImplementation::addHistoryEntry):
+        (FakeHistoryImplementation::historyContains):
+        (tst_QWebHistoryInterface::visitedLinks): Check the Qt4.4 behaviour.
+        * tests/tests.pro:
+
+2009-04-30  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed build fix, after r43035.
+
+        Temporarily use Position::deprecatedEditingOffset().
+
+        * Api/qwebpage.cpp:
+        (QWebPage::inputMethodQuery):
+
+2009-03-27  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Simon Hausmann.
+
+        Update the page actions when a finishing loading even if the frame is
+        not the top frame such as when browsing inside of a website with frames.
+        https://bugs.webkit.org/show_bug.cgi?id=24890
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad):
+        * tests/qwebpage/frametest/frame_a.html: Added.
+        * tests/qwebpage/frametest/index.html: Added.
         * tests/qwebpage/tst_qwebpage.cpp:
-        (tst_QWebPage::textSelection):
+        (tst_QWebPage::backActionUpdate):
+
+2009-04-29  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implement QWebElement::evaluateScript.
+
+        * Api/qwebelement.cpp:
+        (setupScriptContext):
+        (QWebElement::evaluateScript):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::evaluateScript):
+
+2009-04-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Replaced QWebElementCollection with QList<QWebElement>.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        * Api/qwebelement.h:
+        * Api/qwebframe.cpp:
+        (QWebFrame::findAllElements):
+        * Api/qwebframe.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::selectElements):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::simpleCollection):
+        (tst_QWebElement::namespaceURI):
+        (tst_QWebElement::nullSelect):
+
+2009-04-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        QWebElement API changes after another round of API review:
+
+        * Fix argument names of findAll/findFirst
+        * Split up toXml into innerXml and outerXml
+        * Removed confusing toggleClass overload
+        * Fixed casing of namespaceUri to follow QXmlStreamReader
+        * Removed tagName from firstChild/nextSibling/etc.
+        * Renamed append/prepend/insertAfter/insertBefore to [append|prepend][Inside|Outside]
+        * Renamed wrapWith() back to wrap()
+        * Made clone() const
+        * Renamed remove() to takeFromDocument(), added removeFromDocument()
+        * Renamed clear() to removeChildren()
+        * Renamed scriptsFunctions/callScriptFunction to functions()/callFunction()
+        * Renamed scriptProperty to scriptableProperty
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        (QWebElement::findFirst):
+        (QWebElement::setOuterXml):
+        (QWebElement::toOuterXml):
+        (QWebElement::setInnerXml):
+        (QWebElement::toInnerXml):
+        (QWebElement::namespaceUri):
+        (QWebElement::firstChild):
+        (QWebElement::lastChild):
+        (QWebElement::nextSibling):
+        (QWebElement::previousSibling):
+        (QWebElement::callFunction):
+        (QWebElement::functions):
+        (QWebElement::scriptableProperty):
+        (QWebElement::setScriptableProperty):
+        (QWebElement::scriptableProperties):
+        (QWebElement::appendInside):
+        (QWebElement::prependInside):
+        (QWebElement::prependOutside):
+        (QWebElement::appendOutside):
+        (QWebElement::clone):
+        (QWebElement::takeFromDocument):
+        (QWebElement::removeFromDocument):
+        (QWebElement::removeChildren):
+        (QWebElement::wrap):
+        (QWebElement::replace):
+        * Api/qwebelement.h:
+        * Api/qwebframe.cpp:
+        (QWebFrame::findAllElements):
+        (QWebFrame::findFirstElement):
+        * Api/qwebframe.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::textHtml):
+        (tst_QWebElement::classes):
+        (tst_QWebElement::namespaceURI):
+        (tst_QWebElement::foreachManipulation):
+        (tst_QWebElement::callFunction):
+        (tst_QWebElement::callFunctionSubmitForm):
+        (tst_QWebElement::functionNames):
+        (tst_QWebElement::properties):
+        (tst_QWebElement::appendAndPrepend):
+        (tst_QWebElement::insertBeforeAndAfter):
+        (tst_QWebElement::remove):
+        (tst_QWebElement::clear):
+        (tst_QWebElement::replaceWith):
+
+2009-04-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix some qdoc warnings.
+
+        * Api/qwebframe.cpp: Fix links.
+        * Api/qwebnetworkinterface.cpp: Make docs internal.
+        * Api/qwebnetworkinterface.h: Ditto.
+        * Api/qwebpage.cpp: Fix property name in \property.
 
 2009-04-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
@@ -51,27 +727,223 @@
         * docs/webkitsnippets/webpage/main.cpp: Added.
         * docs/webkitsnippets/webpage/webpage.pro: Added.
 
-2009-03-02  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+2009-04-23  Antonio Gomes   <antonio.gomes@openbossa.org>
 
-        Reviewed by George Staikos.
+        Reviewed by Ariya Hidayat.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21230
-        On X11 match the behavior of Firefox and also copy the url to the
-        clipboard selection when the action Copy Link Location is executed.
+        [Qt] Added QWebElement::computedStyleProperty method.
 
-        * Api/qwebpage.cpp:
-        (QWebPage::triggerAction):
+        * Api/qwebelement.cpp:
+        (QWebElement::computedStyleProperty):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::computedStyle):
 
-2009-03-07  Adam Treat  <adam.treat@torchmobile.com>
+2009-04-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed by Cameron Zwarich.
+        Rubber-stamped by Ariya Hidayat.
 
-        These methods are clearly returning the wrong values as the two were
-        returning swapped information.
+        [Qt] Rename QWebElement arguments from html to markup
+
+        * Api/qwebelement.cpp:
+        (QWebElement::append):
+        (QWebElement::prepend):
+        (QWebElement::insertBefore):
+        (QWebElement::insertAfter):
+        * Api/qwebelement.h:
+
+2009-04-21  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        QWebElementSelection renamed to QWebElementCollection.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        (QWebElementCollectionPrivate::QWebElementCollectionPrivate):
+        (QWebElementCollectionPrivate::create):
+        (QWebElementCollection::QWebElementCollection):
+        (QWebElementCollection::operator=):
+        (QWebElementCollection::~QWebElementCollection):
+        (QWebElementCollection::operator+):
+        (QWebElementCollection::append):
+        (QWebElementCollection::count):
+        (QWebElementCollection::at):
+        (QWebElementCollection::toList):
+        * Api/qwebelement.h:
+        * Api/qwebframe.cpp:
+        (QWebFrame::findAllElements):
+        * Api/qwebframe.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::selectElements):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::simpleCollection):
+        (tst_QWebElement::iteration):
+        (tst_QWebElement::emptyCollection):
+        (tst_QWebElement::appendCollection):
+        (tst_QWebElement::nullSelect):
+
+2009-04-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25242
+
+        Remove QtCore 4.5 dependency from QWebElement test
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::iteration): Use QList::count() instead of QList::length()
+
+2009-04-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Make the operator== and operator!= non inline to
+        allow looking at the d-pointer in the future.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::operator==):
+        (QWebElement::operator!=):
+        * Api/qwebelement.h:
+
+2009-04-15  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Rename extend() method in QWebElementSelection to append().
+
+        * Api/qwebelement.cpp:
+        (QWebElementSelection::append):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::appendSelection):
+
+2009-04-15  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed nit/typo in QWebElement documentation.
+
+        * Api/qwebelement.cpp:
+
+2009-04-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24841
+
+        Fix linking against QtWebKit for Symbian and other platforms
+        where the OS ABI distinguishes between an import or an export situation.
+
+        * Api/qwebkitglobal.h: Instead of white-listing Win, remove the test.
+
+2009-04-14  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebElement::setHtml and html to setXml and toXml respectivily.
+        
+        Also add a mean to define the scope (inner or other).
+
+        * Api/qwebelement.cpp:
+        (QWebElement::setXml):
+        (QWebElement::toXml):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::textHtml):
+        (tst_QWebElement::foreachManipulation):
+
+2009-04-14  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebElement::setText() and text() to ::setPlainText and
+        ::toPlainText, respectively.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::setPlainText):
+        (QWebElement::toPlainText):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::textHtml):
+        (tst_QWebElement::simpleSelection):
+        (tst_QWebElement::appendAndPrepend):
+        (tst_QWebElement::insertBeforeAndAfter):
+        (tst_QWebElement::replaceWith):
+        (tst_QWebElement::wrap):
+        (tst_QWebElement::firstChildNextSiblingWithTag):
+        (tst_QWebElement::lastChildPreviousSiblingWithTag):
+
+2009-04-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Rename DOM API select function to findFirst, findAll, etc.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        (QWebElement::findFirst):
+        * Api/qwebelement.h:
+        * Api/qwebframe.cpp:
+        (QWebFrame::findAllElements):
+        (QWebFrame::findFirstElement):
+        * Api/qwebframe.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::selectElements):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::simpleSelection):
+        (tst_QWebElement::attributesNS):
+        (tst_QWebElement::classes):
+        (tst_QWebElement::namespaceURI):
+        (tst_QWebElement::iteration):
+        (tst_QWebElement::foreachManipulation):
+        (tst_QWebElement::callFunctionSubmitForm):
+        (tst_QWebElement::documentElement):
+        (tst_QWebElement::frame):
+        (tst_QWebElement::style):
+        (tst_QWebElement::extendSelection):
+        (tst_QWebElement::properties):
+        (tst_QWebElement::appendAndPrepend):
+        (tst_QWebElement::insertBeforeAndAfter):
+        (tst_QWebElement::remove):
+        (tst_QWebElement::clear):
+        (tst_QWebElement::replaceWith):
+        (tst_QWebElement::wrap):
+        (tst_QWebElement::nullSelect):
+        (tst_QWebElement::firstChildNextSibling):
+        (tst_QWebElement::firstChildNextSiblingWithTag):
+        (tst_QWebElement::lastChildPreviousSibling):
+        (tst_QWebElement::lastChildPreviousSiblingWithTag):
+
+2009-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
+            Ariya Hidayat <ariya.hidayat@nokia.com>
+            Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+            Genevieve Mak <gen@staikos.net>
+
+        Reviewed by Tor Arne Vestbø, Simon Hausmann
+
+        First revision of new API in the Qt port to access the DOM.
+
+        * Api/headers.pri: Added qwebelement.h to the API headers.
+        * Api/qwebelement.cpp: Added.
+        * Api/qwebelement.h: Added.
+        * Api/qwebframe.cpp:
+        (QWebFrame::documentElement): Added accessor for the document element.
+        (QWebFrame::selectElements): Added convenienc query method.
+        (QWebFrame::selectElement): Ditto.
+        (QWebHitTestResult::element): Added accessor for underlying DOM element.
+        * Api/qwebframe.h:
+        * QtLauncher/main.cpp: Simple test gui for element selections.
+        * tests/qwebelement/qwebelement.pro: Added.
+        * tests/qwebelement/tst_qwebelement.cpp: Added.
+        * tests/tests.pro: Added QWebElement & QWebElementSelection unit tests.
+
+2009-04-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
 
         * Api/qwebpage.cpp:
-        (QWebPage::totalBytes):
-        (QWebPage::bytesReceived):
+        (QWebPage::triggerAction): Adapted code to renamed loadFrameRequest function.
 
 2009-04-02  Takumi Asaki <takumi.asaki@nokia.com>
 
@@ -95,6 +967,53 @@
         * Api/qwebframe.cpp:
         * Api/qwebview.cpp:
 
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build.
+
+        * WebCoreSupport/EditorClientQt.cpp: Added include of HTMLElement.h.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp: Added include of FormState.h.
+        (WebCore::FrameLoaderClientQt::prepareForDataSourceReplacement):
+        Removed unneeded call to detachChildren, which is called by FrameLoader
+        right after this.
+        (WebCore::FrameLoaderClientQt::createFrame): Use loadURLIntoChildFrame
+        as other platforms do in the corresponding functions.
+
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24869
+
+        Fixes an incorrect case in tst_qwebpage.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::cursorMovements):
+
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24746
+
+        Add new editing related QWebPage::WebActions
+        * Clipboard: PasteAndMatchStyle
+        * Formatting: RemoveFormat, ToggleStrikethrough, ToggleSubscript, and
+          ToggleSuperscript
+        * List Editing: InsertUnorderedList, InsertOrderedList, Indent, Outdent
+        * Paragraph Justification: AlignCenter, AlignJustified, AlignLeft, AlignRight 
+
+        Improved selection and editing tests.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::updateEditorActions):
+        (QWebPage::action):
+        * Api/qwebpage.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::textSelection):
+        (tst_QWebPage::textEditing):
+
 2009-03-26  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Rubber-stamped by Tor Arne Vestbø.
@@ -168,6 +1087,63 @@
         * WebCoreSupport/ChromeClientQt.cpp:
         (WebCore::ChromeClientQt::setToolTip):
 
+2009-03-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for Qt after r41555.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::acceptNavigationRequest):
+
+2009-03-10  Xan Lopez  <xlopez@igalia.com>
+
+        Build fix, no review.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::inputMethodQuery):
+
+2009-03-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Cameron Zwarich.
+
+        These methods are clearly returning the wrong values as the two were
+        returning swapped information.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::totalBytes):
+        (QWebPage::bytesReceived):
+
+2009-03-05  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] NPAPI plugins are supported, adjust the API documentation.
+
+        * Api/qwebsettings.cpp:
+
+2009-03-04  Adam Barth  <abath@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24356
+
+        Fix WebKit style for allowUniversalAccessFromFileURLs.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+
+2009-03-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24340
+
+        Expose AllowUniversalAccessFromFileUrls to Qt clients.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
 2009-03-03  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
         Rubber-stamped by Simon Hausmann.
@@ -181,60 +1157,60 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::textSelection):
 
-2009-02-25  Kavindra Palaraja  <kavindra.palaraja@nokia.com>
+2009-03-02  Adam Treat  <adam.treat@torchmobile.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Eric Seidel.
 
-        Fix the documentation for the linkHovered signal.
+        Add three new drt helper functions that enable all of the tests in
+        LayoutTests/animation/* and LayoutTests/transitions/* to now pass.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pauseAnimation):
+        (qt_drt_pauseTransitionOfProperty):
+        (qt_drt_numberOfActiveAnimations):
+
+2009-03-02  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21230
+        On X11 match the behavior of Firefox and also copy the url to the
+        clipboard selection when the action Copy Link Location is executed.
 
         * Api/qwebpage.cpp:
+        (QWebPage::triggerAction):
 
-2009-02-23  Thiago Macieira  <thiago.macieira@nokia.com>
+2009-02-25  Kavindra Palaraja  <kavindra.palaraja@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix the Copyright notices in a few files
-
-        * WebKit_pch.h:
+        Fix the documentation for the linkHovered signal.
 
-2008-12-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+        * Api/qwebpage.cpp:
 
-        Reviewed by NOBODY (OOPS!).
+2009-02-23  Adam Treat  <adam.treat@torchmobile.com>
 
-        The Qt API exposes a global history patch CSSStyleSelector to make API consumers work again
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20952
+        https://bugs.webkit.org/show_bug.cgi?id=24094
+        Make sure to empty the cache on exit to get rid of superfluous leak messages
+        for CachedResource's in order to keep the leak messages accurate.  This
+        is analagous to what the Mac port is doing on application exit when all
+        WebView's have been closed.
 
-        The QtWebKit port made the mistake of exposing a global history. This broke
-        with the addition of PageGroup and LinkHash. This needs to be repaired
-        for Qt4.5.
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::_q_cleanupLeakMessages):
+        (QWebPage::QWebPage):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
 
-        Add a function to LinkHash.cpp that is resolving a URL. Use this
-        function from within CSSStyleSelector to forward the url to the
-        QWebHistoryInterface API.
+2009-02-23  Thiago Macieira  <thiago.macieira@nokia.com>
 
-        It is sad that there is a path within visitedLinkHash which is now
-        doing a memcpy, it is sad to add a PLATFORM(QT) define to CSSStyleSelector
-        and using QtWebKit types within WebCore is a layering violation as well.
+        Reviewed by Simon Hausmann.
 
-        PageGroup::setShouldTrackVisitedLinks is currently not enabled. For
-        Qt4.6 a second version of the QWebHistoryInterface is going to be
-        added which will fix things up.
+        Fix the Copyright notices in a few files
 
-        * Api/qwebhistoryinterface.cpp:
-        (QWebHistoryInterface::setDefaultInterface): Add note for Qt4.6
-        * Api/qwebpage.cpp: Remove PageGroup::setShouldTrackVisitedLinks(true)
-        (QWebPagePrivate::QWebPagePrivate):
-        * tests/qwebhistoryinterface/qwebhistoryinterface.pro: Added unit test.
-        * tests/qwebhistoryinterface/tst_qwebhistoryinterface.cpp: Added unit test.
-        (tst_QWebHistoryInterface::tst_QWebHistoryInterface):
-        (tst_QWebHistoryInterface::~tst_QWebHistoryInterface):
-        (tst_QWebHistoryInterface::init):
-        (tst_QWebHistoryInterface::cleanup):
-        (FakeHistoryImplementation::addHistoryEntry):
-        (FakeHistoryImplementation::historyContains):
-        (tst_QWebHistoryInterface::visitedLinks): Check the Qt4.4 behaviour.
-        * tests/tests.pro:
+        * WebKit_pch.h:
 
 2009-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
 
@@ -246,6 +1222,22 @@
         (WebCore::FrameLoaderClientQt::canShowMIMEType): Don't call into the
         PluginDatabase if plugins are disabled in the settings.
 
+2009-02-13  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23738
+        Expose the url elements target frame string.  This is the sister function
+        to the existing linkTargetFrame which returns the QWebFrame*.  When the
+        linkTargetFrame is 0 it is useful to know what the target was to be.
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+        (QWebHitTestResult::linkTarget):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * tests/qwebframe/tst_qwebframe.cpp:
+
 2009-02-13  David Boddie  <dboddie@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -262,6 +1254,16 @@
 
         * Api/qwebsettings.cpp:
 
+2009-02-11  Dimitri Dupuis-latour  <dupuislatour@apple.com>
+
+        Stub out InspectorClientQt::hiddenPanels.
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::hiddenPanels):
+        * WebCoreSupport/InspectorClientQt.h:
+
 2009-02-10  Karsten Heimrich  <kheimric@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -273,6 +1275,21 @@
         (WebCore::FrameLoaderClientQt::dispatchDidChangeLocationWithinPage):
         update and emit in case we navigate inside a webpage
 
+2009-02-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build as class Selection is now VisibleSelection.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::inputMethodQuery):
+
+2009-02-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::updateGlobalHistoryRedirectLinks):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
 2009-02-06  Kavindra Palaraja  <kavindra.palaraja@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -293,6 +1310,27 @@
         * tests/qwebframe/tst_qwebframe.cpp: Added unit tests for ownership
         models.
 
+2009-02-06  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Holger Freyther.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::documentElementAvailable):)
+        Fix compile error in Qt build introduced by the below change (r40694).
+
+2009-02-05  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23708
+        Adds documentElementAvailable() callback to FrameLoaderClient.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClient::documentElementAvailable):
+        Stub out documentElementAvailable().
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        Ditto.
+
 2009-02-04  David Boddie  <dboddie@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -310,6 +1348,126 @@
 
         * tests/qwebframe/tst_qwebframe.cpp:
 
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::QWebFrame):
+        (QWebFrame::load):
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createFrame):
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Track redirects in global history.
+
+        Keep Qt building.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::updateGlobalHistoryForRedirectWithoutHistoryItem):
+        (WebCore::FrameLoaderClientQt::createFrame):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Update for changes to WebCore.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+        (WebCore::FrameLoaderClientQt::createJavaAppletWidget):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-02-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23587
+        Refactor HitTestRequest to eliminate all the ugly boolean arguments and
+        use an enum bitflag instead.  Cleanup all the code that constructs the
+        various HitTestRequests to make the code more readable.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::hitTestContent):
+
+2009-02-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build to call forceLayout on the view instead.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::setFixedLayoutSize):
+        (QWebPage::setUseFixedLayout):
+
+2009-02-02  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Move Frame::forceLayout, Frame::adjustPageHeight and Frame::forceLayoutWithPageWidthRange to FrameView
+
+        https://bugs.webkit.org/show_bug.cgi?id=23428
+
+        FrameView::forceLayout could be killed but the comment might
+        contain a value over the the plain FrameView::layout...
+
+        Adjust the WebCore/WebKit consumers of these methods.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::setViewportSize):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::forceLayout):
+
+2009-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createFrame):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22056
+
+        Kill FrameLoaderClient.cpp, move the code over to Frame::createView
+
+        FrameLoaderClient is supposed to be an interface, move the
+        to be shared code to Frame which is a controller and is
+        allowed to create a FrameView.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):
+
+2009-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Split "lockHistory" into "lockHistory" and "lockBackForwardList" in
+        preparation for setting them differently during a redirect.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::triggerAction):
+
+2009-01-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Remove FrameLoaderClient code that is now handled by FrameLoader itself
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::frameLoadCompleted):
+
 2009-01-30  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -322,6 +1480,18 @@
         (qt_websettings_offlineWebApplicationCachePath):
         * Api/qwebsettings.h:
 
+2009-01-28  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann and George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23557
+        Do not clip the QWebFrame::hitTestContent method to the visible viewport
+        and add a regression test to make sure it works.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::hitTestContent):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
 2009-01-28  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
         Rubber-stamped by Simon Hausmann.
@@ -347,6 +1517,37 @@
         * Api/qwebframe.cpp:
         (QWebFrame::print):
 
+2009-01-27  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Rework FrameLoaderClient to work on a CachedFrame basis instead of CachedPage
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::savePlatformDataToCachedFrame):
+        (WebCore::FrameLoaderClientQt::transitionToCommittedFromCachedFrame):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by David Hyatt
+        
+        Back out r40285, because it was checked in with no bug number, no
+        testcase, is rendering change that did not get thorough review,
+        and broke the Mac build.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::hitTestContent):
+
+2009-01-26  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Do not clip the QWebFrame::hitTestContent method to the visible viewport.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::hitTestContent):
+
 2009-01-26  David Boddie  <dboddie@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -409,6 +1610,25 @@
 
         * Api/qwebhistory.h:
 
+2009-01-24  Adam Treat  <adam.treat@torchmobile.com>
+
+        Oops, fix the Qt build.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::render):
+
+2009-01-24  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add QWebFrame::renderContents() method which allows arbitary rendering
+        of any content region within the QWebFrame.  It also does not draw any
+        scrollbars.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::renderContents):
+        * Api/qwebframe.h:
+
 2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -488,6 +1708,13 @@
 
         * Api/qwebpage.cpp:
 
+2009-01-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Another attempt at fixing the Qt build.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::addToJavaScriptWindowObject):
+
 2009-01-14  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -558,6 +1785,25 @@
         (CursorTrackedPage::isSelectionCollapsed):
         (tst_QWebPage::cursorMovements):
 
+2009-01-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23187
+
+        Update webview with the intersected rect.
+
+        In ChromeClientQt::repaint, view should be updated with the
+        intersected rect, not the whole windowRect;
+
+        This generally is not a problem for normal viewport setup where
+        viewport size is the same as the qwebview widget size.  However, if we
+        set the viewport size smaller than qwebkit widget, we will see
+        unwanted painting outside the viewport.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::repaint):
+
 2009-01-13  Ariya Hidayat  <ariya.hidayat@trolltech.com>
 
         Rubber-stamped by Tor Arne Vestbø.
@@ -580,25 +1826,6 @@
         (QWebPagePrivate::updateAction):
         (QWebPage::action):
 
-2009-01-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23187
-
-        Update webview with the intersected rect.
-
-        In ChromeClientQt::repaint, view should be updated with the
-        intersected rect, not the whole windowRect;
-
-        This generally is not a problem for normal viewport setup where
-        viewport size is the same as the qwebview widget size.  However, if we
-        set the viewport size smaller than qwebkit widget, we will see
-        unwanted painting outside the viewport.
-
-        * WebCoreSupport/ChromeClientQt.cpp:
-        (WebCore::ChromeClientQt::repaint):
-
 2009-01-13  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -756,6 +1983,29 @@
 
         Reviewed by George Staikos.
 
+        Add Qt API to QWebHitTestResult::isScrollBar method
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+        (QWebHitTestResult::isScrollBar):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+
+2009-01-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add Qt API for QWebFrame::scrollBarGeometry method
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::scrollBarGeometry):
+        * Api/qwebframe.h:
+
+2009-01-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
         Fix unused variable warnings
 
         * tests/qwebpage/tst_qwebpage.cpp:
@@ -780,6 +2030,28 @@
 
         * Api/qwebkitglobal.h:
 
+2009-01-06  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Simon Hausmann.
+
+        Update the documentation to reflect when these API changes will land in
+        upstream Qt
+
+        * Api/qwebframe.cpp:
+        * Api/qwebpage.cpp:
+
+2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add Qt API for QWebFrame::contentsSizeChanged signal
+
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::contentsSizeChanged):
+        * WebCoreSupport/ChromeClientQt.h:
+
 2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
 
         Reviewed by George Staikos.
@@ -792,6 +2064,36 @@
         * WebCoreSupport/FrameLoaderClientQt.cpp:
         (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):
 
+2009-01-04  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add new API to QWebHitTestResult to return a rect for the smallest enclosing
+        block element of the hit test
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+        (QWebHitTestResult::enclosingBlock):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+
+2008-12-30  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Make the qt port build and work with the new fixedLayoutSize feature
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPage::fixedLayoutSize):
+        (QWebPage::setFixedLayoutSize):
+        (QWebPage::useFixedLayout):
+        (QWebPage::setUseFixedLayout):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):
+
 2008-12-19  Jade Han <jade.han@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
diff --git a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp b/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp
index 44f3d44ec1..d7fae07ca6 100644
--- a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp
@@ -6,6 +6,7 @@
  *
  */
 
+#include "config.h"
 #include "ICOHandler.h"
 
 #include <cstring>
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 19b629d17d..d001035c87 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -228,8 +228,8 @@ void ChromeClientQt::setResizable(bool)
     notImplemented();
 }
 
-void ChromeClientQt::addMessageToConsole(const String& message, unsigned int lineNumber,
-                                         const String& sourceID)
+void ChromeClientQt::addMessageToConsole(MessageSource, MessageLevel, const String& message,
+                                         unsigned int lineNumber, const String& sourceID)
 {
     QString x = message;
     QString y = sourceID;
@@ -345,8 +345,9 @@ PlatformWidget ChromeClientQt::platformWindow() const
     return m_webPage->view();
 }
 
-void ChromeClientQt::contentsSizeChanged(Frame*, const IntSize&) const
+void ChromeClientQt::contentsSizeChanged(Frame* frame, const IntSize& size) const
 {
+    emit QWebFramePrivate::kit(frame)->contentsSizeChanged(size);
 }
 
 void ChromeClientQt::mouseDidMoveOverElement(const HitTestResult& result, unsigned modifierFlags)
@@ -386,15 +387,17 @@ void ChromeClientQt::print(Frame *frame)
     emit m_webPage->printRequested(QWebFramePrivate::kit(frame));
 }
 
+#if ENABLE(DATABASE)
 void ChromeClientQt::exceededDatabaseQuota(Frame* frame, const String& databaseName)
 {
     quint64 quota = QWebSettings::offlineStorageDefaultQuota();
-#if ENABLE(DATABASE)
+
     if (!DatabaseTracker::tracker().hasEntryForOrigin(frame->document()->securityOrigin()))
         DatabaseTracker::tracker().setQuota(frame->document()->securityOrigin(), quota);
-#endif
+
     emit m_webPage->databaseQuotaExceeded(QWebFramePrivate::kit(frame), databaseName);
 }
+#endif
 
 void ChromeClientQt::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> prpFileChooser)
 {
@@ -428,4 +431,16 @@ void ChromeClientQt::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> prpFileC
     }
 }
 
+bool ChromeClientQt::setCursor(PlatformCursorHandle)
+{
+    notImplemented();
+    return false;
+}
+
+void ChromeClientQt::requestGeolocationPermissionForFrame(Frame*, Geolocation*)
+{
+    // See the comment in WebCore/page/ChromeClient.h
+    notImplemented();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index a13bb7cf2c..9f2c1b5fe4 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -83,8 +83,8 @@ namespace WebCore {
 
         virtual void setResizable(bool);
 
-        virtual void addMessageToConsole(const String& message, unsigned int lineNumber,
-                                         const String& sourceID);
+        virtual void addMessageToConsole(MessageSource, MessageLevel, const String& message,
+                                         unsigned int lineNumber, const String& sourceID);
 
         virtual bool canRunBeforeUnloadConfirmPanel();
         virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame* frame);
@@ -113,13 +113,21 @@ namespace WebCore {
         virtual void setToolTip(const String&);
 
         virtual void print(Frame*);
-
+#if ENABLE(DATABASE)
         virtual void exceededDatabaseQuota(Frame*, const String&);
-
+#endif
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
 
         virtual void formStateDidChange(const Node*) { }
 
+        virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
+
+        virtual bool setCursor(PlatformCursorHandle);
+
+        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
+
+        virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
+
         QWebPage* m_webPage;
         WebCore::KURL lastHoverURL;
         WebCore::String lastHoverTitle;
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
index b7198684d0..0df0768add 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "DragClientQt.h"
 
 #include "ClipboardQt.h"
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp
index 153238889f..a16684083a 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditCommandQt.cpp
@@ -17,6 +17,7 @@
     Boston, MA 02110-1301, USA.
 */
 
+#include "config.h"
 #include <wtf/Platform.h>
 #include "EditCommandQt.h"
 
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index a6887790dd..6c31bd85d1 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006, 2008 Apple Computer, Inc.
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  *
  * All rights reserved.
@@ -34,18 +34,19 @@
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 
+#include "CSSStyleDeclaration.h"
 #include "Document.h"
 #include "EditCommandQt.h"
-#include "Page.h"
 #include "Editor.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "HTMLElement.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
+#include "NotImplemented.h"
+#include "Page.h"
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
-#include "NotImplemented.h"
-#include "Node.h"
 #include "Range.h"
 
 #include <stdio.h>
@@ -546,6 +547,12 @@ void EditorClientQt::checkSpellingOfString(const UChar*, int, int*, int*)
     notImplemented();
 }
 
+String EditorClientQt::getAutoCorrectSuggestionForMisspelledWord(const String&)
+{
+    notImplemented();
+    return String();
+}
+
 void EditorClientQt::checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*)
 {
     notImplemented();
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.h
index b39f02bd30..42a402f673 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.h
@@ -98,6 +98,7 @@ public:
     virtual void ignoreWordInSpellDocument(const String&);
     virtual void learnWord(const String&);
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength);
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord);
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength);
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail&);
     virtual void updateSpellingUIWithMisspelledWord(const String&);
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index a2b33c03f0..8f29523dd8 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -32,6 +32,7 @@
 #include "config.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSPropertyNames.h"
+#include "FormState.h"
 #include "FrameLoaderClientQt.h"
 #include "FrameTree.h"
 #include "FrameView.h"
@@ -45,12 +46,15 @@
 #include "RenderPart.h"
 #include "ResourceRequest.h"
 #include "HistoryItem.h"
+#include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
+#include "HTMLPlugInElement.h"
 #include "NotImplemented.h"
 #include "QNetworkReplyHandler.h"
 #include "ResourceHandleInternal.h"
 #include "ResourceHandle.h"
 #include "Settings.h"
+#include "ScriptString.h"
 
 #include "qwebpage.h"
 #include "qwebframe.h"
@@ -199,12 +203,12 @@ bool FrameLoaderClientQt::hasWebView() const
     return true;
 }
 
-void FrameLoaderClientQt::savePlatformDataToCachedPage(CachedPage*) 
+void FrameLoaderClientQt::savePlatformDataToCachedFrame(CachedFrame*) 
 {
     notImplemented();
 }
 
-void FrameLoaderClientQt::transitionToCommittedFromCachedPage(CachedPage*)
+void FrameLoaderClientQt::transitionToCommittedFromCachedFrame(CachedFrame*)
 {
 }
 
@@ -215,12 +219,12 @@ void FrameLoaderClientQt::transitionToCommittedForNewPage()
 
     QBrush brush = m_webFrame->page()->palette().brush(QPalette::Base);
     QColor backgroundColor = brush.style() == Qt::SolidPattern ? brush.color() : QColor();
-    WebCore::FrameLoaderClient::transitionToCommittedForNewPage(m_frame, m_webFrame->page()->viewportSize(),
-                                                                backgroundColor, !backgroundColor.alpha(),
-                                                                /*fixedLayoutSize*/ IntSize(),
-                                                                /*useFixedLayout*/ false,
-                                                                (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Horizontal),
-                                                                (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Vertical));
+    m_frame->createView(m_webFrame->page()->viewportSize(),
+                        backgroundColor, !backgroundColor.alpha(),
+                        m_webFrame->page()->fixedLayoutSize(),
+                        m_webFrame->page()->useFixedLayout(),
+                        (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Horizontal),
+                        (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Vertical));
 }
 
 
@@ -232,7 +236,9 @@ void FrameLoaderClientQt::makeRepresentation(DocumentLoader*)
 
 void FrameLoaderClientQt::forceLayout()
 {
-    m_frame->forceLayout(true);
+    FrameView* view = m_frame->view();
+    if (view)
+        view->forceLayout(true);
 }
 
 
@@ -332,10 +338,6 @@ void FrameLoaderClientQt::dispatchDidReceiveTitle(const String& title)
     if (!m_webFrame)
         return;
 
-
-
-    // ### hack
-    emit m_webFrame->urlChanged(m_webFrame->url());
     emit titleChanged(title);
 }
 
@@ -348,6 +350,7 @@ void FrameLoaderClientQt::dispatchDidCommitLoad()
     if (m_frame->tree()->parent() || !m_webFrame)
         return;
 
+    emit m_webFrame->urlChanged(m_webFrame->url());
     m_webFrame->page()->d->updateNavigationActions();
 
     // We should assume first the frame has no title. If it has, then the above dispatchDidReceiveTitle()
@@ -363,7 +366,7 @@ void FrameLoaderClientQt::dispatchDidFinishDocumentLoad()
         printf("%s - didFinishDocumentLoadForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
     if (QWebPagePrivate::drtRun) {
-        int unloadEventCount = m_frame->eventHandler()->pendingFrameUnloadEventCount();
+        int unloadEventCount = m_frame->domWindow()->pendingUnloadEventListeners();
         if (unloadEventCount)
             printf("%s - has %u onunload handler(s)\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)), unloadEventCount);
     }
@@ -382,7 +385,7 @@ void FrameLoaderClientQt::dispatchDidFinishLoad()
 
     m_loadSucceeded = true;
 
-    if (m_frame->tree()->parent() || !m_webFrame)
+    if (!m_webFrame)
         return;
     m_webFrame->page()->d->updateNavigationActions();
 }
@@ -536,9 +539,6 @@ String FrameLoaderClientQt::generatedMIMETypeForURLScheme(const String& URLSchem
 void FrameLoaderClientQt::frameLoadCompleted()
 {
     // Note: Can be called multiple times.
-    // Even if already complete, we might have set a previous item on a frame that
-    // didn't do any data loading on the past transaction. Make sure to clear these out.
-    m_frame->loader()->setPreviousHistoryItem(0);
 }
 
 
@@ -564,7 +564,6 @@ void FrameLoaderClientQt::didFinishLoad()
 
 void FrameLoaderClientQt::prepareForDataSourceReplacement()
 {
-    m_frame->loader()->detachChildren();
 }
 
 void FrameLoaderClientQt::setTitle(const String&, const KURL&)
@@ -614,6 +613,11 @@ void FrameLoaderClientQt::windowObjectCleared()
         emit m_webFrame->javaScriptWindowObjectCleared();
 }
 
+void FrameLoaderClientQt::documentElementAvailable()
+{
+    return;
+}
+
 void FrameLoaderClientQt::didPerformFirstNavigation() const
 {
     if (m_frame->tree()->parent() || !m_webFrame)
@@ -633,6 +637,10 @@ void FrameLoaderClientQt::updateGlobalHistory()
         history->addHistoryEntry(m_frame->loader()->documentLoader()->urlForHistory().prettyURL());
 }
 
+void FrameLoaderClientQt::updateGlobalHistoryRedirectLinks()
+{
+}
+
 bool FrameLoaderClientQt::shouldGoToHistoryItem(WebCore::HistoryItem *item) const
 {
     return true;
@@ -841,6 +849,11 @@ bool FrameLoaderClientQt::dispatchDidLoadResourceFromMemoryCache(WebCore::Docume
     return false;
 }
 
+void FrameLoaderClientQt::dispatchDidLoadResourceByXMLHttpRequest(unsigned long, const WebCore::ScriptString&)
+{
+    notImplemented();
+}
+
 void FrameLoaderClientQt::dispatchDidFailProvisionalLoad(const WebCore::ResourceError&)
 {
     if (dumpFrameLoaderCallbacks)
@@ -971,9 +984,9 @@ PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String
     // ### set override encoding if we have one
 
     FrameLoadType loadType = m_frame->loader()->loadType();
-    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedHistory;
+    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
 
-    childFrame->loader()->loadURL(frameData.url, frameData.referrer, String(), childLoadType, 0, 0);
+    childFrame->loader()->loadURLIntoChildFrame(frameData.url, frameData.referrer, childFrame.get());
 
     // The frame's onload handler may have removed it from the document.
     if (!childFrame->tree()->parent())
@@ -1068,7 +1081,7 @@ public:
     }
 };
 
-Widget* FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, Element* element, const KURL& url, const Vector<String>& paramNames,
+Widget* FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
                                           const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
 //     qDebug()<<"------ Creating plugin in FrameLoaderClientQt::createPlugin for "<<url.prettyURL() << mimeType;
@@ -1156,7 +1169,7 @@ void FrameLoaderClientQt::redirectDataToPlugin(Widget* pluginWidget)
     m_hasSentResponseToPlugin = false;
 }
 
-Widget* FrameLoaderClientQt::createJavaAppletWidget(const IntSize&, Element*, const KURL& baseURL,
+Widget* FrameLoaderClientQt::createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL,
                                                     const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
     notImplemented();
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index c743c233bd..4d2dcbc7f6 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -98,6 +98,7 @@ namespace WebCore {
         virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long);
         virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long, const WebCore::ResourceError&);
         virtual bool dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&, int);
+        virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const WebCore::ScriptString& sourceString);
 
         virtual void dispatchDidHandleOnloadEvents();
         virtual void dispatchDidReceiveServerRedirectForProvisionalLoad();
@@ -147,6 +148,7 @@ namespace WebCore {
         virtual void finishedLoading(DocumentLoader*);
 
         virtual void updateGlobalHistory();
+        virtual void updateGlobalHistoryRedirectLinks();
         virtual bool shouldGoToHistoryItem(HistoryItem*) const;
 
         virtual ResourceError cancelledError(const ResourceRequest&);
@@ -177,8 +179,8 @@ namespace WebCore {
 
         virtual String userAgent(const WebCore::KURL&);
 
-        virtual void savePlatformDataToCachedPage(WebCore::CachedPage*);
-        virtual void transitionToCommittedFromCachedPage(WebCore::CachedPage*);
+        virtual void savePlatformDataToCachedFrame(WebCore::CachedFrame*);
+        virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
         virtual void transitionToCommittedForNewPage();
 
         virtual bool canCachePage() const;
@@ -186,15 +188,16 @@ namespace WebCore {
 
         virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight) ;
-        virtual Widget* createPlugin(const IntSize&, Element*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool);
+        virtual Widget* createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool);
         virtual void redirectDataToPlugin(Widget* pluginWidget);
 
-        virtual Widget* createJavaAppletWidget(const IntSize&, Element*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues);
+        virtual Widget* createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues);
 
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
         virtual String overrideMediaType() const;
 
         virtual void windowObjectCleared();
+        virtual void documentElementAvailable();
         virtual void didPerformFirstNavigation() const;
 
         virtual void registerForIconNotification(bool);
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index 7335280e7f..fe4d43ad62 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -114,6 +114,12 @@ String InspectorClientQt::localizedStringsURL()
     return String();
 }
 
+String InspectorClientQt::hiddenPanels()
+{
+    notImplemented();
+    return String();
+}
+
 void InspectorClientQt::showWindow()
 {
     if (!m_webPage)
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
index 49c2d566be..60ed77a6b6 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
@@ -52,6 +52,8 @@ namespace WebCore {
 
         virtual String localizedStringsURL();
 
+        virtual String hiddenPanels();
+
         virtual void showWindow();
         virtual void closeWindow();
         virtual bool windowVisible();
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdoc b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdoc
index 119c126516..06305e04b5 100644
--- a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdoc
+++ b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdoc
@@ -96,8 +96,7 @@
 
     Since WebKit supports the Netscape Plugin API, Qt applications can display
     Web pages that embed common plugins, as long as the user has the appropriate
-    binary files for those plugins installed and the \l{QWebSettings::PluginsEnabled}
-    attribute is set for the application.
+    binary files for those plugins installed.
 
     The following locations are searched for plugins:
 
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/main.cpp b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
new file mode 100644
index 0000000000..d437a6f7c7
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
@@ -0,0 +1,69 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QApplication>
+#include <QUrl>
+#include <qwebview.h>
+#include <qwebframe.h>
+#include <qwebelement.h>
+#include <qdebug.h>
+
+static QWebFrame *frame;
+
+static void traverse()
+{
+//! [Traversing with QWebElement]
+    frame->setHtml("<html><body><p>First Paragraph</p><p>Second Paragraph</p></body></html>");
+    QWebElement doc = frame->documentElement();
+    QWebElement body = doc.firstChild();
+    QWebElement firstParagraph = body.firstChild();
+    QWebElement secondParagraph = firstParagraph.nextSibling();
+//! [Traversing with QWebElement]
+}
+
+static void findAll()
+{
+//! [FindAll]
+    QWebElement document = frame->documentElement();
+    /* Assume the document has the following structure:
+
+       <p class=intro>
+         <span>Intro</span>
+         <span>Snippets</span>
+       </p>
+       <p>
+         <span>Content</span>
+         <span>Here</span>
+       </p>
+    */
+
+    QList<QWebElement> allSpans = document.findAll("span");
+    QList<QWebElement> introSpans = document.findAll("p.intro span");
+//! [FindAll]
+}
+
+int main(int argc, char *argv[])
+{
+    QApplication app(argc, argv);
+    QWebView *view = new QWebView(0);
+    frame = view->page()->mainFrame();
+    traverse();
+    findAll();
+    return 0;
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/webelement.pro b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/webelement.pro
new file mode 100644
index 0000000000..f9b403b254
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/webelement/webelement.pro
@@ -0,0 +1,5 @@
+TEMPLATE = app
+CONFIG -= app_bundle
+SOURCES   = main.cpp
+include(../../../../../WebKit.pri)
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
new file mode 100644
index 0000000000..dd0b88af47
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
@@ -0,0 +1,7 @@
+TEMPLATE = app
+TARGET = tst_qwebelement
+include(../../../../WebKit.pri)
+SOURCES  += tst_qwebelement.cpp
+RESOURCES += qwebelement.qrc
+QT += testlib network
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
new file mode 100644
index 0000000000..ed014407a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
@@ -0,0 +1,6 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource prefix="/">
+<file>style.css</file>
+<file>style2.css</file>
+</qresource>
+</RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style.css b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style.css
new file mode 100644
index 0000000000..2713dfda9b
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style.css
@@ -0,0 +1 @@
+#idP {color: black !important}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style2.css b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style2.css
new file mode 100644
index 0000000000..6575dcb040
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/style2.css
@@ -0,0 +1 @@
+#idP {color: green ! important}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
new file mode 100644
index 0000000000..0819a3ad88
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -0,0 +1,882 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+
+#include <QtTest/QtTest>
+
+#include <qwebpage.h>
+#include <qwidget.h>
+#include <qwebview.h>
+#include <qwebframe.h>
+#include <qwebelement.h>
+//TESTED_CLASS=
+//TESTED_FILES=
+
+/**
+ * Starts an event loop that runs until the given signal is received.
+ Optionally the event loop
+ * can return earlier on a timeout.
+ *
+ * \return \p true if the requested signal was received
+ *         \p false on timeout
+ */
+static bool waitForSignal(QObject* obj, const char* signal, int timeout = 0)
+{
+    QEventLoop loop;
+    QObject::connect(obj, signal, &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
+
+class tst_QWebElement : public QObject
+{
+    Q_OBJECT
+
+public:
+    tst_QWebElement();
+    virtual ~tst_QWebElement();
+
+public slots:
+    void init();
+    void cleanup();
+
+private slots:
+    void textHtml();
+    void simpleCollection();
+    void attributes();
+    void attributesNS();
+    void classes();
+    void namespaceURI();
+    void foreachManipulation();
+    void evaluateScript();
+    void callFunction();
+    void callFunctionSubmitForm();
+    void functionNames();
+    void documentElement();
+    void frame();
+    void style();
+    void computedStyle();
+    void properties();
+    void appendAndPrepend();
+    void insertBeforeAndAfter();
+    void remove();
+    void clear();
+    void replaceWith();
+    void encloseWith();
+    void encloseContentsWith();
+    void nullSelect();
+    void firstChildNextSibling();
+    void lastChildPreviousSibling();
+
+private:
+    QWebView* m_view;
+    QWebPage* m_page;
+    QWebFrame* m_mainFrame;
+};
+
+tst_QWebElement::tst_QWebElement()
+{
+}
+
+tst_QWebElement::~tst_QWebElement()
+{
+}
+
+void tst_QWebElement::init()
+{
+    m_view = new QWebView();
+    m_page = m_view->page();
+    m_mainFrame = m_page->mainFrame();
+}
+
+void tst_QWebElement::cleanup()
+{
+    delete m_view;
+}
+
+void tst_QWebElement::textHtml()
+{
+    QString html = "<head></head><body><p>test</p></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+    QVERIFY(!body.isNull());
+
+    QCOMPARE(body.toPlainText(), QString("test"));
+    QCOMPARE(body.toPlainText(), m_mainFrame->toPlainText());
+
+    QCOMPARE(body.toInnerXml(), html);
+}
+
+void tst_QWebElement::simpleCollection()
+{
+    QString html = "<body><p>first para</p><p>second para</p></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+
+    QList<QWebElement> list = body.findAll("p");
+    QCOMPARE(list.count(), 2);
+    QCOMPARE(list.at(0).toPlainText(), QString("first para"));
+    QCOMPARE(list.at(1).toPlainText(), QString("second para"));
+}
+
+void tst_QWebElement::attributes()
+{
+    m_mainFrame->setHtml("<body><p>Test");
+    QWebElement body = m_mainFrame->documentElement();
+
+    QVERIFY(!body.hasAttribute("title"));
+    QVERIFY(!body.hasAttributes());
+
+    body.setAttribute("title", "test title");
+
+    QVERIFY(body.hasAttributes());
+    QVERIFY(body.hasAttribute("title"));
+
+    QCOMPARE(body.attribute("title"), QString("test title"));
+
+    body.removeAttribute("title");
+
+    QVERIFY(!body.hasAttribute("title"));
+    QVERIFY(!body.hasAttributes());
+
+    QCOMPARE(body.attribute("does-not-exist", "testvalue"), QString("testvalue"));
+}
+
+void tst_QWebElement::attributesNS()
+{
+    QString content = "<html xmlns=\"http://www.w3.org/1999/xhtml\" "
+                      "xmlns:svg=\"http://www.w3.org/2000/svg\">"
+                      "<body><svg:svg id=\"foobar\" width=\"400px\" height=\"300px\">"
+                      "</svg:svg></body></html>";
+
+    m_mainFrame->setContent(content.toUtf8(), "application/xhtml+xml");
+
+    QWebElement svg = m_mainFrame->findFirstElement("svg");
+    QVERIFY(!svg.isNull());
+
+    QVERIFY(!svg.hasAttributeNS("http://www.w3.org/2000/svg", "foobar"));
+    QCOMPARE(svg.attributeNS("http://www.w3.org/2000/svg", "foobar", "defaultblah"), QString("defaultblah"));
+    svg.setAttributeNS("http://www.w3.org/2000/svg", "svg:foobar", "true");
+    QVERIFY(svg.hasAttributeNS("http://www.w3.org/2000/svg", "foobar"));
+    QCOMPARE(svg.attributeNS("http://www.w3.org/2000/svg", "foobar", "defaultblah"), QString("true"));
+}
+
+void tst_QWebElement::classes()
+{
+    m_mainFrame->setHtml("<body><p class=\"a b c d a c\">Test");
+
+    QWebElement body = m_mainFrame->documentElement();
+    QCOMPARE(body.classes().count(), 0);
+
+    QWebElement p = m_mainFrame->documentElement().findAll("p").at(0);
+    QStringList classes = p.classes();
+    QCOMPARE(classes.count(), 4);
+    QCOMPARE(classes[0], QLatin1String("a"));
+    QCOMPARE(classes[1], QLatin1String("b"));
+    QCOMPARE(classes[2], QLatin1String("c"));
+    QCOMPARE(classes[3], QLatin1String("d"));
+    QVERIFY(p.hasClass("a"));
+    QVERIFY(p.hasClass("b"));
+    QVERIFY(p.hasClass("c"));
+    QVERIFY(p.hasClass("d"));
+    QVERIFY(!p.hasClass("e"));
+
+    p.addClass("f");
+    QVERIFY(p.hasClass("f"));
+    p.addClass("a");
+    QCOMPARE(p.classes().count(), 5);
+    QVERIFY(p.hasClass("a"));
+    QVERIFY(p.hasClass("b"));
+    QVERIFY(p.hasClass("c"));
+    QVERIFY(p.hasClass("d"));
+
+    p.toggleClass("a");
+    QVERIFY(!p.hasClass("a"));
+    QVERIFY(p.hasClass("b"));
+    QVERIFY(p.hasClass("c"));
+    QVERIFY(p.hasClass("d"));
+    QVERIFY(p.hasClass("f"));
+    QCOMPARE(p.classes().count(), 4);
+    p.toggleClass("f");
+    QVERIFY(!p.hasClass("f"));
+    QCOMPARE(p.classes().count(), 3);
+    p.toggleClass("a");
+    p.toggleClass("f");
+    QVERIFY(p.hasClass("a"));
+    QVERIFY(p.hasClass("f"));
+    QCOMPARE(p.classes().count(), 5);
+
+    p.removeClass("f");
+    QVERIFY(!p.hasClass("f"));
+    QCOMPARE(p.classes().count(), 4);
+    p.removeClass("d");
+    QVERIFY(!p.hasClass("d"));
+    QCOMPARE(p.classes().count(), 3);
+    p.removeClass("not-exist");
+    QCOMPARE(p.classes().count(), 3);
+    p.removeClass("c");
+    QVERIFY(!p.hasClass("c"));
+    QCOMPARE(p.classes().count(), 2);
+    p.removeClass("b");
+    QVERIFY(!p.hasClass("b"));
+    QCOMPARE(p.classes().count(), 1);
+    p.removeClass("a");
+    QVERIFY(!p.hasClass("a"));
+    QCOMPARE(p.classes().count(), 0);
+    p.removeClass("foobar");
+    QCOMPARE(p.classes().count(), 0);
+}
+
+void tst_QWebElement::namespaceURI()
+{
+    QString content = "<html xmlns=\"http://www.w3.org/1999/xhtml\" "
+                      "xmlns:svg=\"http://www.w3.org/2000/svg\">"
+                      "<body><svg:svg id=\"foobar\" width=\"400px\" height=\"300px\">"
+                      "</svg:svg></body></html>";
+
+    m_mainFrame->setContent(content.toUtf8(), "application/xhtml+xml");
+    QWebElement body = m_mainFrame->documentElement();
+    QCOMPARE(body.namespaceUri(), QLatin1String("http://www.w3.org/1999/xhtml"));
+
+    QWebElement svg = body.findAll("*#foobar").at(0);
+    QCOMPARE(svg.prefix(), QLatin1String("svg"));
+    QCOMPARE(svg.localName(), QLatin1String("svg"));
+    QCOMPARE(svg.tagName(), QLatin1String("svg:svg"));
+    QCOMPARE(svg.namespaceUri(), QLatin1String("http://www.w3.org/2000/svg"));
+
+}
+
+void tst_QWebElement::foreachManipulation()
+{
+    QString html = "<body><p>first para</p><p>second para</p></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+
+    foreach(QWebElement p, body.findAll("p")) {
+        p.setInnerXml("<div>foo</div><div>bar</div>");
+    }
+
+    QCOMPARE(body.findAll("div").count(), 4);
+}
+
+void tst_QWebElement::evaluateScript()
+{
+    QVariant result;
+    m_mainFrame->setHtml("<body><p>test");
+    QWebElement para = m_mainFrame->findFirstElement("p");
+
+    result = para.evaluateScript("this.tagName");
+    QVERIFY(result.isValid());
+    QVERIFY(result.type() == QVariant::String);
+    QCOMPARE(result.toString(), QLatin1String("P"));
+
+    QVERIFY(para.functions().contains("hasAttributes"));
+    result = para.evaluateScript("this.hasAttributes()");
+    QVERIFY(result.isValid());
+    QVERIFY(result.type() == QVariant::Bool);
+    QVERIFY(!result.toBool());
+
+    para.evaluateScript("this.setAttribute('align', 'left');");
+    QCOMPARE(para.attribute("align"), QLatin1String("left"));
+
+    result = para.evaluateScript("this.hasAttributes()");
+    QVERIFY(result.isValid());
+    QVERIFY(result.type() == QVariant::Bool);
+    QVERIFY(result.toBool());
+}
+
+void tst_QWebElement::callFunction()
+{
+    m_mainFrame->setHtml("<body><p>test");
+    QWebElement body = m_mainFrame->documentElement();
+    QVERIFY(body.functions().contains("hasChildNodes"));
+    QVariant result = body.callFunction("hasChildNodes");
+    QVERIFY(result.isValid());
+    QVERIFY(result.type() == QVariant::Bool);
+    QVERIFY(result.toBool());
+
+    body.callFunction("setAttribute", QVariantList() << "foo" << "bar");
+    QCOMPARE(body.attribute("foo"), QString("bar"));
+}
+
+void tst_QWebElement::callFunctionSubmitForm()
+{
+    m_mainFrame->setHtml(QString("<html><body><form name='tstform' action='data:text/html,foo'method='get'>"
+                                 "<input type='text'><input type='submit'></form></body></html>"), QUrl());
+
+    QWebElement form = m_mainFrame->documentElement().findAll("form").at(0);
+    QVERIFY(form.functions().contains("submit"));
+    QVERIFY(!form.isNull());
+    form.callFunction("submit");
+
+    waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+    QCOMPARE(m_mainFrame->url().toString(), QString("data:text/html,foo?"));
+}
+
+void tst_QWebElement::functionNames()
+{
+    m_mainFrame->setHtml("<body><p>Test");
+
+    QWebElement body = m_mainFrame->documentElement();
+
+    QVERIFY(body.functions().contains("setAttribute"));
+}
+
+void tst_QWebElement::documentElement()
+{
+    m_mainFrame->setHtml("<body><p>Test");
+
+    QWebElement para = m_mainFrame->documentElement().findAll("p").at(0);
+    QVERIFY(para.parent().parent() == m_mainFrame->documentElement());
+    QVERIFY(para.document() == m_mainFrame->documentElement());
+}
+
+void tst_QWebElement::frame()
+{
+    m_mainFrame->setHtml("<body><p>test");
+
+    QWebElement doc = m_mainFrame->documentElement();
+    QVERIFY(doc.webFrame() == m_mainFrame);
+
+    m_view->setHtml(QString("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
+                            "<p>frame1\">"
+                            "<frame src=\"data:text/html,<p>frame2\"></frameset>"), QUrl());
+
+    waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+
+    QCOMPARE(m_mainFrame->childFrames().count(), 2);
+
+    QWebFrame* firstFrame = m_mainFrame->childFrames().at(0);
+    QWebFrame* secondFrame = m_mainFrame->childFrames().at(1);
+
+    QCOMPARE(firstFrame->toPlainText(), QString("frame1"));
+    QCOMPARE(secondFrame->toPlainText(), QString("frame2"));
+
+    QWebElement firstPara = firstFrame->documentElement().findAll("p").at(0);
+    QWebElement secondPara = secondFrame->documentElement().findAll("p").at(0);
+
+    QVERIFY(firstPara.webFrame() == firstFrame);
+    QVERIFY(secondPara.webFrame() == secondFrame);
+}
+
+void tst_QWebElement::style()
+{
+    QString html = "<head>"
+        "<style type='text/css'>"
+            "p { color: green !important }"
+            "#idP { color: red }"
+            ".classP { color : yellow ! important }"
+        "</style>"
+    "</head>"
+    "<body>"
+        "<p id='idP' class='classP' style='color: blue;'>some text</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+
+    QWebElement p = m_mainFrame->documentElement().findAll("p").at(0);
+    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
+    QVERIFY(p.styleProperty("cursor").isEmpty());
+
+    p.setStyleProperty("color", "red");
+    p.setStyleProperty("cursor", "auto");
+
+    QCOMPARE(p.styleProperty("color"), QLatin1String("red"));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("yellow"));
+    QCOMPARE(p.styleProperty("cursor"), QLatin1String("auto"));
+
+    p.setStyleProperty("color", "green !important");
+    QCOMPARE(p.styleProperty("color"), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("green"));
+
+    p.setStyleProperty("color", "blue");
+    QCOMPARE(p.styleProperty("color"), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("green"));
+
+    p.setStyleProperty("color", "blue", QWebElement::ImportantStylePriority);
+    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+
+    QString html2 = "<head>"
+        "<style type='text/css'>"
+            "p { color: green }"
+            "#idP { color: red }"
+            ".classP { color: yellow }"
+        "</style>"
+    "</head>"
+    "<body>"
+        "<p id='idP' class='classP' style='color: blue;'>some text</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html2);
+    p = m_mainFrame->documentElement().findAll("p").at(0);
+
+    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+
+    QString html3 = "<head>"
+        "<style type='text/css'>"
+            "p { color: green !important }"
+            "#idP { color: red !important}"
+            ".classP { color: yellow !important}"
+        "</style>"
+    "</head>"
+    "<body>"
+        "<p id='idP' class='classP' style='color: blue !important;'>some text</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html3);
+    p = m_mainFrame->documentElement().findAll("p").at(0);
+
+    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+
+    QString html5 = "<head>"
+        "<style type='text/css'>"
+            "p { color: green }"
+            "#idP { color: red }"
+            ".classP { color: yellow }"
+        "</style>"
+    "</head>"
+    "<body>"
+        "<p id='idP' class='classP'>some text</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html5);
+    p = m_mainFrame->documentElement().findAll("p").at(0);
+
+    QCOMPARE(p.styleProperty("color"), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("red"));
+
+    QString html6 = "<head>"
+        "<link rel='stylesheet' href='qrc:/style.css' type='text/css' />"
+        "<style type='text/css'>"
+            "p { color: green }"
+            "#idP { color: red }"
+            ".classP { color: yellow ! important}"
+        "</style>"
+    "</head>"
+    "<body>"
+        "<p id='idP' class='classP' style='color: blue;'>some text</p>"
+    "</body>";
+
+    // in few seconds, the CSS should be completey loaded
+    QSignalSpy spy(m_page, SIGNAL(loadFinished(bool)));
+    m_mainFrame->setHtml(html6);
+    QTest::qWait(200);
+
+    p = m_mainFrame->documentElement().findAll("p").at(0);
+    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("black"));
+
+    QString html7 = "<head>"
+        "<style type='text/css'>"
+            "@import url(qrc:/style2.css);"
+        "</style>"
+        "<link rel='stylesheet' href='qrc:/style.css' type='text/css' />"
+    "</head>"
+    "<body>"
+        "<p id='idP' style='color: blue;'>some text</p>"
+    "</body>";
+
+    // in few seconds, the style should be completey loaded
+    m_mainFrame->setHtml(html7);
+    QTest::qWait(200);
+
+    p = m_mainFrame->documentElement().findAll("p").at(0);
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("black"));
+
+    QString html8 = "<body><p>some text</p></body>";
+
+    m_mainFrame->setHtml(html8);
+    p = m_mainFrame->documentElement().findAll("p").at(0);
+
+    QCOMPARE(p.styleProperty("color"), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String(""));
+}
+
+void tst_QWebElement::computedStyle()
+{
+    QString html = "<body><p>some text</p></body>";
+    m_mainFrame->setHtml(html);
+
+    QWebElement p = m_mainFrame->documentElement().findAll("p").at(0);
+    QCOMPARE(p.computedStyleProperty("cursor"), QLatin1String("auto"));
+    QVERIFY(!p.computedStyleProperty("cursor").isEmpty());
+    QVERIFY(p.styleProperty("cursor").isEmpty());
+
+    p.setStyleProperty("cursor", "text");
+    p.setStyleProperty("color", "red");
+
+    QCOMPARE(p.computedStyleProperty("cursor"), QLatin1String("text"));
+    QCOMPARE(p.computedStyleProperty("color"), QLatin1String("rgb(255, 0, 0)"));
+    QCOMPARE(p.styleProperty("color"), QLatin1String("red"));
+}
+
+void tst_QWebElement::properties()
+{
+    m_mainFrame->setHtml("<body><form><input type=checkbox id=ourcheckbox checked=true>");
+
+    QWebElement checkBox = m_mainFrame->findFirstElement("#ourcheckbox");
+    QVERIFY(!checkBox.isNull());
+
+    QVERIFY(checkBox.scriptableProperties().contains("checked"));
+
+    QCOMPARE(checkBox.scriptableProperty("checked"), QVariant(true));
+    checkBox.setScriptableProperty("checked", false);
+    QCOMPARE(checkBox.scriptableProperty("checked"), QVariant(false));
+
+    QVERIFY(!checkBox.scriptableProperties().contains("non_existant"));
+    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant());
+
+    checkBox.setScriptableProperty("non_existant", "test");
+
+    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant("test"));
+    QVERIFY(checkBox.scriptableProperties().contains("non_existant"));
+
+    // removing scriptableProperties is currently not supported. We should look into this
+    // and consider the option of just allowing through the QtScript API only.
+#if 0
+    checkBox.setScriptableProperty("non_existant", QVariant());
+
+    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant());
+    QVERIFY(!checkBox.scriptableProperties().contains("non_existant"));
+#endif
+}
+
+void tst_QWebElement::appendAndPrepend()
+{
+    QString html = "<body>"
+        "<p>"
+            "foo"
+        "</p>"
+        "<p>"
+            "bar"
+        "</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement().findFirst("body");
+
+    QCOMPARE(body.findAll("p").count(), 2);
+    body.appendInside(body.findFirst("p"));
+    QCOMPARE(body.findAll("p").count(), 2);
+    QCOMPARE(body.findFirst("p").toPlainText(), QString("bar"));
+    QCOMPARE(body.findAll("p").last().toPlainText(), QString("foo"));
+
+    body.appendInside(body.findFirst("p").clone());
+    QCOMPARE(body.findAll("p").count(), 3);
+    QCOMPARE(body.findFirst("p").toPlainText(), QString("bar"));
+    QCOMPARE(body.findAll("p").last().toPlainText(), QString("bar"));
+
+    body.prependInside(body.findAll("p").at(1).clone());
+    QCOMPARE(body.findAll("p").count(), 4);
+    QCOMPARE(body.findFirst("p").toPlainText(), QString("foo"));
+
+    body.findFirst("p").appendInside("<div>booyakasha</div>");
+    QCOMPARE(body.findAll("p div").count(), 1);
+    QCOMPARE(body.findFirst("p div").toPlainText(), QString("booyakasha"));
+
+    body.findFirst("div").prependInside("<code>yepp</code>");
+    QCOMPARE(body.findAll("p div code").count(), 1);
+    QCOMPARE(body.findFirst("p div code").toPlainText(), QString("yepp"));
+}
+
+void tst_QWebElement::insertBeforeAndAfter()
+{
+    QString html = "<body>"
+        "<p>"
+            "foo"
+        "</p>"
+        "<div>"
+            "yeah"
+        "</div>"
+        "<p>"
+            "bar"
+        "</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement().findFirst("body");
+    QWebElement div = body.findFirst("div");
+
+    QCOMPARE(body.findAll("p").count(), 2);
+    QCOMPARE(body.findAll("div").count(), 1);
+
+    div.prependOutside(body.findAll("p").last().clone());
+    QCOMPARE(body.findAll("p").count(), 3);
+    QCOMPARE(body.findAll("p").at(0).toPlainText(), QString("foo"));
+    QCOMPARE(body.findAll("p").at(1).toPlainText(), QString("bar"));
+    QCOMPARE(body.findAll("p").at(2).toPlainText(), QString("bar"));
+
+    div.appendOutside(body.findFirst("p").clone());
+    QCOMPARE(body.findAll("p").count(), 4);
+    QCOMPARE(body.findAll("p").at(0).toPlainText(), QString("foo"));
+    QCOMPARE(body.findAll("p").at(1).toPlainText(), QString("bar"));
+    QCOMPARE(body.findAll("p").at(2).toPlainText(), QString("foo"));
+    QCOMPARE(body.findAll("p").at(3).toPlainText(), QString("bar"));
+
+    div.prependOutside("<span>hey</span>");
+    QCOMPARE(body.findAll("span").count(), 1);
+
+    div.appendOutside("<span>there</span>");
+    QCOMPARE(body.findAll("span").count(), 2);
+    QCOMPARE(body.findAll("span").at(0).toPlainText(), QString("hey"));
+    QCOMPARE(body.findAll("span").at(1).toPlainText(), QString("there"));
+}
+
+void tst_QWebElement::remove()
+{
+    QString html = "<body>"
+        "<p>"
+            "foo"
+        "</p>"
+        "<div>"
+            "<p>yeah</p>"
+        "</div>"
+        "<p>"
+            "bar"
+        "</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement().findFirst("body");
+
+    QCOMPARE(body.findAll("div").count(), 1);
+    QCOMPARE(body.findAll("p").count(), 3);
+
+    QWebElement div = body.findFirst("div");
+    div.takeFromDocument();
+
+    QCOMPARE(div.isNull(), false);
+    QCOMPARE(body.findAll("div").count(), 0);
+    QCOMPARE(body.findAll("p").count(), 2);
+
+    body.appendInside(div);
+
+    QCOMPARE(body.findAll("div").count(), 1);
+    QCOMPARE(body.findAll("p").count(), 3);
+}
+
+void tst_QWebElement::clear()
+{
+    QString html = "<body>"
+        "<p>"
+            "foo"
+        "</p>"
+        "<div>"
+            "<p>yeah</p>"
+        "</div>"
+        "<p>"
+            "bar"
+        "</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement().findFirst("body");
+
+    QCOMPARE(body.findAll("div").count(), 1);
+    QCOMPARE(body.findAll("p").count(), 3);
+    body.findFirst("div").removeChildren();
+    QCOMPARE(body.findAll("div").count(), 1);
+    QCOMPARE(body.findAll("p").count(), 2);
+}
+
+
+void tst_QWebElement::replaceWith()
+{
+    QString html = "<body>"
+        "<p>"
+            "foo"
+        "</p>"
+        "<div>"
+            "yeah"
+        "</div>"
+        "<p>"
+            "<span>haba</span>"
+        "</p>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement().findFirst("body");
+
+    QCOMPARE(body.findAll("div").count(), 1);
+    QCOMPARE(body.findAll("span").count(), 1);
+    body.findFirst("div").replace(body.findFirst("span").clone());
+    QCOMPARE(body.findAll("div").count(), 0);
+    QCOMPARE(body.findAll("span").count(), 2);
+    QCOMPARE(body.findAll("p").count(), 2);
+
+    body.findFirst("span").replace("<p><code>wow</code></p>");
+    QCOMPARE(body.findAll("p").count(), 3);
+    QCOMPARE(body.findAll("p code").count(), 1);
+    QCOMPARE(body.findFirst("p code").toPlainText(), QString("wow"));
+}
+
+void tst_QWebElement::encloseContentsWith()
+{
+    QString html = "<body>"
+        "<div>"
+            "<i>"
+                "yeah"
+            "</i>"
+            "<i>"
+                "hello"
+            "</i>"
+        "</div>"
+        "<p>"
+            "<span>foo</span>"
+            "<span>bar</span>"
+        "</p>"
+        "<u></u>"
+        "<b></b>"
+        "<em>hey</em>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement().findFirst("body");
+
+    body.findFirst("p").encloseContentsWith(body.findFirst("b"));
+    QCOMPARE(body.findAll("p b span").count(), 2);
+    QCOMPARE(body.findFirst("p b span").toPlainText(), QString("foo"));
+
+    body.findFirst("u").encloseContentsWith("<i></i>");
+    QCOMPARE(body.findAll("u i").count(), 1);
+    QCOMPARE(body.findFirst("u i").toPlainText(), QString());
+
+    body.findFirst("div").encloseContentsWith("<span></span>");
+    QCOMPARE(body.findAll("div span i").count(), 2);
+    QCOMPARE(body.findFirst("div span i").toPlainText(), QString("yeah"));
+
+    QString snippet = ""
+        "<table>"
+            "<tbody>"
+                "<tr>"
+                    "<td></td>"
+                    "<td></td>"
+                "</tr>"
+                "<tr>"
+                    "<td></td>"
+                    "<td></td>"
+                "<tr>"
+            "</tbody>"
+        "</table>";
+
+    body.findFirst("em").encloseContentsWith(snippet);
+    QCOMPARE(body.findFirst("em table tbody tr td").toPlainText(), QString("hey"));
+}
+
+void tst_QWebElement::encloseWith()
+{
+    QString html = "<body>"
+        "<p>"
+            "foo"
+        "</p>"
+        "<div>"
+            "yeah"
+        "</div>"
+        "<p>"
+            "<span>bar</span>"
+        "</p>"
+        "<em>hey</em>"
+        "<h1>hello</h1>"
+    "</body>";
+
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement().findFirst("body");
+
+    body.findFirst("p").encloseWith("<br>");
+    QCOMPARE(body.findAll("br").count(), 0);
+
+    QCOMPARE(body.findAll("div").count(), 1);
+    body.findFirst("div").encloseWith(body.findFirst("span").clone());
+    QCOMPARE(body.findAll("div").count(), 1);
+    QCOMPARE(body.findAll("span").count(), 2);
+    QCOMPARE(body.findAll("p").count(), 2);
+
+    body.findFirst("div").encloseWith("<code></code>");
+    QCOMPARE(body.findAll("code").count(), 1);
+    QCOMPARE(body.findAll("code div").count(), 1);
+    QCOMPARE(body.findFirst("code div").toPlainText(), QString("yeah"));
+
+    QString snippet = ""
+        "<table>"
+            "<tbody>"
+                "<tr>"
+                    "<td></td>"
+                    "<td></td>"
+                "</tr>"
+                "<tr>"
+                    "<td></td>"
+                    "<td></td>"
+                "<tr>"
+            "</tbody>"
+        "</table>";
+
+    body.findFirst("em").encloseWith(snippet);
+    QCOMPARE(body.findFirst("table tbody tr td em").toPlainText(), QString("hey"));
+}
+
+void tst_QWebElement::nullSelect()
+{
+    m_mainFrame->setHtml("<body><p>Test");
+
+    QList<QWebElement> collection = m_mainFrame->findAllElements("invalid{syn(tax;;%#$f223e>>");
+    QVERIFY(collection.count() == 0);
+}
+
+void tst_QWebElement::firstChildNextSibling()
+{
+    m_mainFrame->setHtml("<body><!--comment--><p>Test</p><!--another commend><table>");
+
+    QWebElement body = m_mainFrame->findFirstElement("body");
+    QVERIFY(!body.isNull());
+    QWebElement p = body.firstChild();
+    QVERIFY(!p.isNull());
+    QCOMPARE(p.tagName(), QString("P"));
+    QWebElement table = p.nextSibling();
+    QVERIFY(!table.isNull());
+    QCOMPARE(table.tagName(), QString("TABLE"));
+    QVERIFY(table.nextSibling().isNull());
+}
+
+void tst_QWebElement::lastChildPreviousSibling()
+{
+    m_mainFrame->setHtml("<body><!--comment--><p>Test</p><!--another commend><table>");
+
+    QWebElement body = m_mainFrame->findFirstElement("body");
+    QVERIFY(!body.isNull());
+    QWebElement table = body.lastChild();
+    QVERIFY(!table.isNull());
+    QCOMPARE(table.tagName(), QString("TABLE"));
+    QWebElement p = table.previousSibling();
+    QVERIFY(!p.isNull());
+    QCOMPARE(p.tagName(), QString("P"));
+    QVERIFY(p.previousSibling().isNull());
+}
+
+QTEST_MAIN(tst_QWebElement)
+#include "tst_qwebelement.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.qrc
index 69e62d9c09..266cdce2df 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.qrc
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.qrc
@@ -1,5 +1,6 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource prefix="/">
 <file>image.png</file>
+<file>style.css</file>
 </qresource>
 </RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/style.css b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/style.css
new file mode 100644
index 0000000000..c05b747f14
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/style.css
@@ -0,0 +1 @@
+#idP {color: red !important}
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 36660a3d40..30e33642cc 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -21,6 +21,7 @@
 #include <QtTest/QtTest>
 
 #include <qwebpage.h>
+#include <qwebelement.h>
 #include <qwidget.h>
 #include <qwebview.h>
 #include <qwebframe.h>
@@ -570,14 +571,17 @@ private slots:
     void typeConversion();
     void symmetricUrl();
     void progressSignal();
+    void urlChange();
     void domCycles();
     void setHtml();
     void setHtmlWithResource();
     void ipv6HostEncoding();
     void metaData();
     void popupFocus();
+    void hitTestContent();
     void jsByteArray();
     void ownership();
+    void nullValue();
 private:
     QString  evalJS(const QString&s) {
         // Convert an undefined return variant to the string "undefined"
@@ -2124,6 +2128,26 @@ void tst_QWebFrame::progressSignal()
     QCOMPARE(progressSpy.last().first().toInt(), 100);
 }
 
+void tst_QWebFrame::urlChange()
+{
+    QSignalSpy urlSpy(m_page->mainFrame(), SIGNAL(urlChanged(QUrl)));
+
+    QUrl dataUrl("data:text/html,<h1>Test");
+    m_view->setUrl(dataUrl);
+
+    ::waitForSignal(m_page->mainFrame(), SIGNAL(urlChanged(QUrl)));
+
+    QCOMPARE(urlSpy.size(), 1);
+
+    QUrl dataUrl2("data:text/html,<html><head><title>title</title></head><body><h1>Test</body></html>");
+    m_view->setUrl(dataUrl2);
+
+    ::waitForSignal(m_page->mainFrame(), SIGNAL(urlChanged(QUrl)));
+
+    QCOMPARE(urlSpy.size(), 2);
+}
+
+
 void tst_QWebFrame::domCycles()
 {
     m_view->setHtml("<html><body>");
@@ -2133,7 +2157,7 @@ void tst_QWebFrame::domCycles()
 
 void tst_QWebFrame::setHtml()
 {
-    QString html("<html><body><p>hello world</p></body></html>");
+    QString html("<html><head></head><body><p>hello world</p></body></html>");
     m_view->page()->mainFrame()->setHtml(html);
     QCOMPARE(m_view->page()->mainFrame()->toHtml(), html);
 }
@@ -2154,6 +2178,24 @@ void tst_QWebFrame::setHtmlWithResource()
     QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
     QCOMPARE(frame->evaluateJavaScript("document.images[0].width").toInt(), 128);
     QCOMPARE(frame->evaluateJavaScript("document.images[0].height").toInt(), 128);
+
+    QString html2 =
+        "<html>"
+            "<head>"
+                "<link rel='stylesheet' href='qrc:/style.css' type='text/css' />"
+            "</head>"
+            "<body>"
+                "<p id='idP'>some text</p>"
+            "</body>"
+        "</html>";
+
+    // in few seconds, the CSS should be completey loaded
+    frame->setHtml(html2);
+    QTest::qWait(200);
+    QCOMPARE(spy.size(), 2);
+
+    QWebElement p = frame->documentElement().findAll("p").at(0);
+    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("red"));
 }
 
 class TestNetworkManager : public QNetworkAccessManager
@@ -2274,6 +2316,19 @@ void tst_QWebFrame::popupFocus()
              "The input field should have a blinking caret");
 }
 
+void tst_QWebFrame::hitTestContent()
+{
+    QString html("<html><body><p>A paragraph</p><br/><br/><br/><a href=\"about:blank\" target=\"_foo\">link text</a></body></html>");
+
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    frame->setHtml(html);
+    page.setViewportSize(QSize(200, 0)); //no height so link is not visible
+    QWebHitTestResult result = frame->hitTestContent(QPoint(10, 100));
+    QCOMPARE(result.linkText(), QString("link text"));
+    QCOMPARE(result.linkTarget(), QString("_foo"));
+}
+
 void tst_QWebFrame::jsByteArray()
 {
     QByteArray ba("hello world");
@@ -2351,5 +2406,11 @@ void tst_QWebFrame::ownership()
     }
 }
 
+void tst_QWebFrame::nullValue()
+{
+    QVariant v = m_view->page()->mainFrame()->evaluateJavaScript("null");
+    QVERIFY(v.isNull());
+}
+
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/frame_a.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/frame_a.html
new file mode 100644
index 0000000000..9ff68f13a4
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/frame_a.html
@@ -0,0 +1,2 @@
+<a href="http://google.com" target="frame_b"><img src="" width=100 height=100 alt="Google"></a>
+<a href="http://yahoo.com" target="frame_b"><img src="" width=100 height=100 alt="Yahoo"></a>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/index.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/index.html
new file mode 100644
index 0000000000..c53ad09a7a
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/frametest/index.html
@@ -0,0 +1,4 @@
+<frameset cols="25%,75%">
+   <frame src="frame_a.html" name="frame_a">
+   <frame src="frame_b.html" name="frame_b">
+</frameset>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
index bbd98c6f39..2f3a108972 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -2,5 +2,6 @@ TEMPLATE = app
 TARGET = tst_qwebpage
 include(../../../../WebKit.pri)
 SOURCES  += tst_qwebpage.cpp
+RESOURCES  += tst_qwebpage.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 620aa31a60..1d6a48e7b2 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -105,6 +105,7 @@ private slots:
     void cursorMovements();
     void textSelection();
     void textEditing();
+    void backActionUpdate();
 
     void requestCache();
 
@@ -834,7 +835,7 @@ void tst_QWebPage::cursorMovements()
     // cursor will be before the word "be"
     page->triggerAction(QWebPage::MoveToStartOfBlock);
     QVERIFY(page->isSelectionCollapsed());
-    QCOMPARE(page->selectionStartOffset(), 2);
+    QCOMPARE(page->selectionStartOffset(), 0);
 
     // cursor will be after the word "you!"
     page->triggerAction(QWebPage::MoveToEndOfBlock);
@@ -887,7 +888,7 @@ void tst_QWebPage::textSelection()
     QVERIFY(page->action(QWebPage::SelectStartOfDocument) != 0);
     QVERIFY(page->action(QWebPage::SelectEndOfDocument) != 0);
 
-    // right now they are disabled because contentEditable is false and
+    // right now they are disabled because contentEditable is false and 
     // there isn't an existing selection to modify
     QCOMPARE(page->action(QWebPage::SelectNextChar)->isEnabled(), false);
     QCOMPARE(page->action(QWebPage::SelectPreviousChar)->isEnabled(), false);
@@ -960,15 +961,10 @@ void tst_QWebPage::textEditing()
         "<p>May the source<br/>be with you!</p></body></html>");
     page->mainFrame()->setHtml(content);
 
-    // this will select the first paragraph
-    QString script = "var range = document.createRange(); " \
-        "var node = document.getElementById(\"one\"); " \
-        "range.selectNode(node); " \
-        "getSelection().addRange(range);";
-    page->mainFrame()->evaluateJavaScript(script);
-    QCOMPARE(page->selectedText().trimmed(), QString::fromLatin1("The quick brown fox"));
-
     // these actions must exist
+    QVERIFY(page->action(QWebPage::Cut) != 0);
+    QVERIFY(page->action(QWebPage::Copy) != 0);
+    QVERIFY(page->action(QWebPage::Paste) != 0);
     QVERIFY(page->action(QWebPage::DeleteStartOfWord) != 0);
     QVERIFY(page->action(QWebPage::DeleteEndOfWord) != 0);
     QVERIFY(page->action(QWebPage::SetTextDirectionDefault) != 0);
@@ -979,8 +975,23 @@ void tst_QWebPage::textEditing()
     QVERIFY(page->action(QWebPage::ToggleUnderline) != 0);
     QVERIFY(page->action(QWebPage::InsertParagraphSeparator) != 0);
     QVERIFY(page->action(QWebPage::InsertLineSeparator) != 0);
+    QVERIFY(page->action(QWebPage::PasteAndMatchStyle) != 0);
+    QVERIFY(page->action(QWebPage::RemoveFormat) != 0);
+    QVERIFY(page->action(QWebPage::ToggleStrikethrough) != 0);
+    QVERIFY(page->action(QWebPage::ToggleSubscript) != 0);
+    QVERIFY(page->action(QWebPage::ToggleSuperscript) != 0);
+    QVERIFY(page->action(QWebPage::InsertUnorderedList) != 0);
+    QVERIFY(page->action(QWebPage::InsertOrderedList) != 0);
+    QVERIFY(page->action(QWebPage::Indent) != 0);
+    QVERIFY(page->action(QWebPage::Outdent) != 0);
+    QVERIFY(page->action(QWebPage::AlignCenter) != 0);
+    QVERIFY(page->action(QWebPage::AlignJustified) != 0);
+    QVERIFY(page->action(QWebPage::AlignLeft) != 0);
+    QVERIFY(page->action(QWebPage::AlignRight) != 0);
 
     // right now they are disabled because contentEditable is false
+    QCOMPARE(page->action(QWebPage::Cut)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::Paste)->isEnabled(), false);
     QCOMPARE(page->action(QWebPage::DeleteStartOfWord)->isEnabled(), false);
     QCOMPARE(page->action(QWebPage::DeleteEndOfWord)->isEnabled(), false);
     QCOMPARE(page->action(QWebPage::SetTextDirectionDefault)->isEnabled(), false);
@@ -991,11 +1002,39 @@ void tst_QWebPage::textEditing()
     QCOMPARE(page->action(QWebPage::ToggleUnderline)->isEnabled(), false);
     QCOMPARE(page->action(QWebPage::InsertParagraphSeparator)->isEnabled(), false);
     QCOMPARE(page->action(QWebPage::InsertLineSeparator)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::PasteAndMatchStyle)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::RemoveFormat)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::ToggleStrikethrough)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::ToggleSubscript)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::ToggleSuperscript)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::InsertUnorderedList)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::InsertOrderedList)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::Indent)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::Outdent)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::AlignCenter)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::AlignJustified)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::AlignLeft)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::AlignRight)->isEnabled(), false);
+
+    // Select everything
+    page->triggerAction(QWebPage::SelectAll);
+
+    // make sure it is enabled since there is a selection
+    QCOMPARE(page->action(QWebPage::Copy)->isEnabled(), true);
 
     // make it editable before navigating the cursor
     page->setContentEditable(true);
 
+    // clear the selection
+    page->triggerAction(QWebPage::MoveToStartOfDocument);
+    QVERIFY(page->isSelectionCollapsed());
+    QCOMPARE(page->selectionStartOffset(), 0);
+
+    // make sure it is disabled since there isn't a selection
+    QCOMPARE(page->action(QWebPage::Copy)->isEnabled(), false);
+
     // here the actions are enabled after contentEditable is true
+    QCOMPARE(page->action(QWebPage::Paste)->isEnabled(), true);
     QCOMPARE(page->action(QWebPage::DeleteStartOfWord)->isEnabled(), true);
     QCOMPARE(page->action(QWebPage::DeleteEndOfWord)->isEnabled(), true);
     QCOMPARE(page->action(QWebPage::SetTextDirectionDefault)->isEnabled(), true);
@@ -1006,6 +1045,29 @@ void tst_QWebPage::textEditing()
     QCOMPARE(page->action(QWebPage::ToggleUnderline)->isEnabled(), true);
     QCOMPARE(page->action(QWebPage::InsertParagraphSeparator)->isEnabled(), true);
     QCOMPARE(page->action(QWebPage::InsertLineSeparator)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::PasteAndMatchStyle)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::ToggleStrikethrough)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::ToggleSubscript)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::ToggleSuperscript)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::InsertUnorderedList)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::InsertOrderedList)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::Indent)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::Outdent)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::AlignCenter)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::AlignJustified)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::AlignLeft)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::AlignRight)->isEnabled(), true);
+    
+    // make sure these are disabled since there isn't a selection
+    QCOMPARE(page->action(QWebPage::Cut)->isEnabled(), false);
+    QCOMPARE(page->action(QWebPage::RemoveFormat)->isEnabled(), false);
+    
+    // make sure everything is selected
+    page->triggerAction(QWebPage::SelectAll);
+    
+    // this is only true if there is an editable selection
+    QCOMPARE(page->action(QWebPage::Cut)->isEnabled(), true);
+    QCOMPARE(page->action(QWebPage::RemoveFormat)->isEnabled(), true);
 
     delete page;
 }
@@ -1037,5 +1099,22 @@ void tst_QWebPage::requestCache()
              (int)QNetworkRequest::PreferCache);
 }
 
+void tst_QWebPage::backActionUpdate()
+{
+    QWebView view;
+    QWebPage *page = view.page();
+    QAction *action = page->action(QWebPage::Back);
+    QVERIFY(!action->isEnabled());
+    QSignalSpy loadSpy(page, SIGNAL(loadFinished(bool)));
+    QUrl url = QUrl("qrc:///frametest/index.html");
+    page->mainFrame()->load(url);
+    QTRY_COMPARE(loadSpy.count(), 1);
+    QVERIFY(!action->isEnabled());
+    QTest::mouseClick(&view, Qt::LeftButton, 0, QPoint(10, 10));
+    QTRY_COMPARE(loadSpy.count(), 2);
+
+    QVERIFY(action->isEnabled());
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.qrc
new file mode 100644
index 0000000000..38c5232548
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.qrc
@@ -0,0 +1,7 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource>
+    <file>frametest/index.html</file>
+    <file>frametest/frame_a.html</file>
+</qresource>
+</RCC>
+
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/.gitignore b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/.gitignore
new file mode 100644
index 0000000000..444afe65e6
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/.gitignore
@@ -0,0 +1 @@
+qwebview
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
new file mode 100644
index 0000000000..799ccfb32e
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
@@ -0,0 +1,6 @@
+TEMPLATE = app
+TARGET = tst_qwebview
+include(../../../../WebKit.pri)
+SOURCES  += tst_qwebview.cpp
+QT += testlib network
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
new file mode 100644
index 0000000000..6501bfc3e7
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -0,0 +1,165 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Torch Mobile Inc.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <qtest.h>
+
+#include <qpainter.h>
+#include <qwebview.h>
+#include <qwebpage.h>
+#include <qnetworkrequest.h>
+#include <qdiriterator.h>
+
+class tst_QWebView : public QObject
+{
+    Q_OBJECT
+
+public slots:
+    void initTestCase();
+    void cleanupTestCase();
+    void init();
+    void cleanup();
+
+private slots:
+    void renderHints();
+    void guessUrlFromString_data();
+    void guessUrlFromString();
+};
+
+// This will be called before the first test function is executed.
+// It is only called once.
+void tst_QWebView::initTestCase()
+{
+}
+
+// This will be called after the last test function is executed.
+// It is only called once.
+void tst_QWebView::cleanupTestCase()
+{
+}
+
+// This will be called before each test function is executed.
+void tst_QWebView::init()
+{
+}
+
+// This will be called after every test function.
+void tst_QWebView::cleanup()
+{
+}
+
+void tst_QWebView::renderHints()
+{
+    QWebView webView;
+
+    // default is only text antialiasing
+    QVERIFY(!(webView.renderHints() & QPainter::Antialiasing));
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(!(webView.renderHints() & QPainter::SmoothPixmapTransform));
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::Antialiasing, true);
+    QVERIFY(webView.renderHints() & QPainter::Antialiasing);
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(!(webView.renderHints() & QPainter::SmoothPixmapTransform));
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::Antialiasing, false);
+    QVERIFY(!(webView.renderHints() & QPainter::Antialiasing));
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(!(webView.renderHints() & QPainter::SmoothPixmapTransform));
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::SmoothPixmapTransform, true);
+    QVERIFY(!(webView.renderHints() & QPainter::Antialiasing));
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(webView.renderHints() & QPainter::SmoothPixmapTransform);
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::SmoothPixmapTransform, false);
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(!(webView.renderHints() & QPainter::SmoothPixmapTransform));
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+}
+
+void tst_QWebView::guessUrlFromString_data()
+{
+    QTest::addColumn<QString>("string");
+    QTest::addColumn<QUrl>("guessUrlFromString");
+
+    // Null
+    QTest::newRow("null") << QString() << QUrl();
+
+    // File
+    QDirIterator it(QDir::homePath());
+    QString fileString;
+    int c = 0;
+    while (it.hasNext()) {
+        it.next();
+        QTest::newRow(QString("file-%1").arg(c++).toLatin1()) << it.filePath() << QUrl::fromLocalFile(it.filePath());
+    }
+
+    // basic latin1
+    QTest::newRow("unicode-0") << QString::fromUtf8("å.com/") << QUrl::fromEncoded(QString::fromUtf8("http://å.com/").toUtf8(), QUrl::TolerantMode);
+    // unicode
+    QTest::newRow("unicode-1") << QString::fromUtf8("λ.com/") << QUrl::fromEncoded(QString::fromUtf8("http://λ.com/").toUtf8(), QUrl::TolerantMode);
+
+    // no scheme
+    QTest::newRow("add scheme-0") << "webkit.org" << QUrl("http://webkit.org");
+    QTest::newRow("add scheme-1") << "www.webkit.org" << QUrl("http://www.webkit.org");
+    QTest::newRow("add scheme-2") << "ftp.webkit.org" << QUrl("ftp://ftp.webkit.org");
+    QTest::newRow("add scheme-3") << "webkit" << QUrl("webkit");
+
+    // QUrl's tolerant parser should already handle this
+    QTest::newRow("not-encoded-0") << "http://webkit.org/test page.html" << QUrl("http://webkit.org/test%20page.html");
+
+    // Make sure the :80, i.e. port doesn't screw anything up
+    QUrl portUrl("http://webkit.org");
+    portUrl.setPort(80);
+    QTest::newRow("port-0") << "webkit.org:80" << portUrl;
+    QTest::newRow("port-1") << "http://webkit.org:80" << portUrl;
+
+    // mailto doesn't have a ://, but is valid
+    QUrl mailto("ben@meyerhome.net");
+    mailto.setScheme("mailto");
+    QTest::newRow("mailto") << "mailto:ben@meyerhome.net" << mailto;
+
+    // misc
+    QTest::newRow("localhost-0") << "localhost" << QUrl("http://localhost");
+    QTest::newRow("localhost-1") << "localhost:80" << QUrl("http://localhost:80");
+    QTest::newRow("spaces-0") << "  http://webkit.org/test page.html " << QUrl("http://webkit.org/test%20page.html");
+
+    // FYI: The scheme in the resulting url user
+    QUrl authUrl("user:pass@domain.com");
+    QTest::newRow("misc-1") << "user:pass@domain.com" << authUrl;
+}
+
+// public static QUrl guessUrlFromString(QString const& string)
+void tst_QWebView::guessUrlFromString()
+{
+    QFETCH(QString, string);
+    QFETCH(QUrl, guessUrlFromString);
+
+    QUrl url = QWebView::guessUrlFromString(string);
+    QCOMPARE(url, guessUrlFromString);
+}
+
+QTEST_MAIN(tst_QWebView)
+#include "tst_qwebview.moc"
+
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
index 16cb457ccd..e898ca0a47 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
@@ -1,3 +1,3 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebhistoryinterface
+SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebview